From cb7cba25d059b0b0ec54d404a596ae882b043fe4 Mon Sep 17 00:00:00 2001 From: Ruben Hensen Date: Tue, 19 May 2026 22:50:56 +0200 Subject: [PATCH] Tunnel authentik.rubenhensen.nl through Hetzner MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Same pattern as rss — needed so the OIDC redirect from freshrss (and other relying parties) works for clients outside the home LAN. --- dns/domains/rubenhensen.nl.yaml | 2 +- nix-infra-machine/nodes/node001.nix | 15 +++++++++++++-- 2 files changed, 14 insertions(+), 3 deletions(-) diff --git a/dns/domains/rubenhensen.nl.yaml b/dns/domains/rubenhensen.nl.yaml index 65e47f5..f17d235 100644 --- a/dns/domains/rubenhensen.nl.yaml +++ b/dns/domains/rubenhensen.nl.yaml @@ -18,7 +18,7 @@ records: - name: "authentik" expire: 300 type: A - content: "62.41.87.114" + content: "46.224.26.65" - name: "ldap" expire: 300 type: A diff --git a/nix-infra-machine/nodes/node001.nix b/nix-infra-machine/nodes/node001.nix index fcb5738..2c8c7aa 100644 --- a/nix-infra-machine/nodes/node001.nix +++ b/nix-infra-machine/nodes/node001.nix @@ -53,8 +53,9 @@ in # - tunneled hosts → home cluster ingress on 443 streamConfig = '' map $ssl_preread_server_name $tunnel_upstream { - rss.rubenhensen.nl ${homeIP}:443; - default 127.0.0.1:8443; + rss.rubenhensen.nl ${homeIP}:443; + authentik.rubenhensen.nl ${homeIP}:443; + default 127.0.0.1:8443; } server { @@ -78,6 +79,16 @@ in }; }; + virtualHosts."authentik.rubenhensen.nl" = { + listen = [ + { addr = "0.0.0.0"; port = 80; } + { addr = "[::]"; port = 80; } + ]; + locations."/" = { + proxyPass = "http://${homeIP}"; + }; + }; + virtualHosts."mail.rubenhensen.nl" = { listen = [ { addr = "0.0.0.0"; port = 80; }