rubenhensen/k8scd
1
0
Fork 0
mirror of https://github.com/rubenhensen/k8scd.git synced 2026-09-17 02:12:55 +02:00
Code Issues Packages Projects Releases Wiki Activity

Tunnel authentik.rubenhensen.nl through Hetzner

Browse Source 
Same pattern as rss — needed so the OIDC redirect from freshrss (and
other relying parties) works for clients outside the home LAN.
This commit is contained in:
Ruben Hensen
2026-05-19 22:50:56 +02:00
parent ff9c2d3cef
commit cb7cba25d0
2 changed files with 14 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
dns/domains/rubenhensen.nl.yaml
+1 -1
View File
@@ -18,7 +18,7 @@ records:
- name: "authentik" - name: "authentik"
expire: 300 expire: 300
type: A type: A
content: "62.41.87.114" content: "46.224.26.65"
- name: "ldap" - name: "ldap"
expire: 300 expire: 300
type: A type: A
nix-infra-machine/nodes/node001.nix
+13 -2
View File
@@ -53,8 +53,9 @@ in
# - tunneled hosts → home cluster ingress on 443 # - tunneled hosts → home cluster ingress on 443
streamConfig = '' streamConfig = ''
map $ssl_preread_server_name $tunnel_upstream { map $ssl_preread_server_name $tunnel_upstream {
rss.rubenhensen.nl ${homeIP}:443; rss.rubenhensen.nl ${homeIP}:443;
default 127.0.0.1:8443; authentik.rubenhensen.nl ${homeIP}:443;
default 127.0.0.1:8443;
} }
server { server {
@@ -78,6 +79,16 @@ in
}; };
}; };
virtualHosts."authentik.rubenhensen.nl" = {
listen = [
{ addr = "0.0.0.0"; port = 80; }
{ addr = "[::]"; port = 80; }
];
locations."/" = {
proxyPass = "http://${homeIP}";
};
};
virtualHosts."mail.rubenhensen.nl" = { virtualHosts."mail.rubenhensen.nl" = {
listen = [ listen = [
{ addr = "0.0.0.0"; port = 80; } { addr = "0.0.0.0"; port = 80; }