sail: Alternative frontends should only listen on tailscale

agenix/hosts/sail/config.nix

@@ -95,42 +95,12 @@
       file = ./nitter/config.age;
     };
 
-    nitter-auth = {
-      file = ./nitter/auth.age;
-      owner = "nginx";
-      group = "nginx";
-    };
-
-    libreddit-auth = {
-      file = ./libreddit/auth.age;
-      owner = "nginx";
-      group = "nginx";
-    };
-
-    rimgo-auth = {
-      file = ./rimgo/auth.age;
-      owner = "nginx";
-      group = "nginx";
-    };
-
     anonymous-overflow-config = {
       file = ./anonymous-overflow/config.age;
     };
 
-    anonymous-overflow-auth = {
-      file = ./anonymous-overflow/auth.age;
-      owner = "nginx";
-      group = "nginx";
-    };
-
     proxitok-environment = {
       file = ./proxitok/environment.age;
     };
-
-    proxitok-auth = {
-      file = ./proxitok/auth.age;
-      owner = "nginx";
-      group = "nginx";
-    };
   };
 }

agenix/hosts/sail/nitter/auth.age

@@ -1,9 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 MtGp6g TlltW6mwuZE7iaKfHK128JI0R6Mj4yu1Yq1Hy0YWJRY
-ZRS8nBzX39RHYDeEMnlKepVDuaXjLw1N0WRtP3cvBPY
--> ssh-ed25519 NbV4hw +HmaRasZJ0E+lTm8CYBoHrB/u+7bdfwroLzSHrsCgRw
-xoz0PRPOFIfwMvmJGC1PGS2PsUe+v0aG7E8BIY4yUH8
--> ;r1<;&A-grease sHb XfT4F 4xh];sA@
-IIIGYPwXy4uHMkFV
---- HN3r/Qy0NfVWSwIlgHwT9mR8YlR07VhSABEE1AyZQvM
-
íº^Ží9A¸‹`KuÇø¡º<14>¨".í‹f.8¿;œ–Á%ôH$È#ðÕß*¤µö¯mä	/¶©¾ ²T<C2B2>Ïÿƒ"¾hþP­.©%ù8TsaÙNÙ KƒáfPö|¦;Oè7Ý(œÐÈ¥")ÄÎÃ*

agenix/hosts/sail/proxitok/auth.age

@@ -1,9 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 MtGp6g UsWqApJ+OzlhjmqFPWX+9lYH8WiGLGiRb9ljd2aoE0s
-2QnM7xKexxWwDaP/dkIPn4t62cl0SYgFwJmPjP4qmQg
--> ssh-ed25519 NbV4hw Jxe6FiuxaJ3976a9J3iGFB4voOABKtxOFjjiV5lJg1E
-jYiki61pPUnvcXM0p4zTW/SAdXpdirEPaBVB8qQFSGI
--> SZ+-grease 7`Z3we,h O2THy w@-G^,*
-pING13NREsxJOhDYbGGmh6M
---- YYugx3x05vCiO23wzFQH3E7/HkehfSZJZ4I1Hhn7gCI
-—Õß[ŒŽïJë™Þ:KBKŽöçS‰ãÈVMœ
×<><C397>Š˜ÛJkù$ÿn‡D„KN±ä4áù.<™,à.¿iÆ48§ôF¤8¹kŠû](&nÁ—‹úꚉ‘Œ31þìj<07>r]ñv[Ë•âË=ôhÓ›‘

agenix/hosts/sail/rimgo/auth.age

@@ -1,14 +0,0 @@
------BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE10R3A2ZyAySTBM
-aFBCMXFLc0JJeHlSMjBEM0pqeElpZ3FOYmd6WFI4bndMcGluMWxVCmJ6aHBYNFlW
-RFlyTjhGYkluMWJ3bmRjaU55QWthYUZaWVpnZ081NUxYdDQKLT4gc3NoLWVkMjU1
-MTkgTmJWNGh3IFN2SWJ6ZFloZkk4YVI3NXFFUkJsQnMwemV0czQ0L3Q3d0ZxQkZP
-aXRFQUEKWWRSV2hQOC8zMFZ4aUFack9DcjM0SEg5VmVDdnZoUUdKb1FoTzMvclhI
-YwotPiBtc017cmNSNy1ncmVhc2UgO191L2tOfSAuX2sKYjlmMEpJSTJKbFpNb1h0
-U2s2K1U0NnAyejBjbHhyTDJaUG85dCtORDdMME1iTmFNTWlTZGdpRi90emVVT0ZL
-RgpLemUyVXJHR1ZyNEJCbExuN3cxQWw4Q1ZvKzAzZ1l5bTJ6ekh1N2VtbWhsUAot
-LS0gZDZuVXliZXRqeHpEa24vbTdLRjY2RkdReUgrVk4yRXJVam82ZklCUER5dwoi
-onrE2i7Culh6zYX79xMkJOuhSXlTpX2q4LQin5RA8O0b6lVui5lGR+K+wTkfYvKw
-D92KqHxvQbCpYECM5QrEued9+3ujmRjd5Zh9YBCdmoM1P7BlyTYaMIduUenN7VjP
-LjqdajKkDcu8Jf7p27Qob0A=
------END AGE ENCRYPTED FILE-----

container/proxitok/default.nix

@@ -39,11 +39,11 @@
   ];
 
   services.nginx.virtualHosts."tictac.daniel.sx" = {
+    listenAddresses = [ "100.113.242.85" ];
     http3 = true;
 
     onlySSL = true;
     useACMEHost = "daniel.sx";
-    basicAuthFile = config.age.secrets.proxitok-auth.path;
 
     locations."/" = {
       recommendedProxySettings = true;

secrets.nix

@@ -32,15 +32,8 @@ in
   "agenix/hosts/sail/invidious/databasePassword.age".publicKeys = sail;
 
   "agenix/hosts/sail/nitter/config.age".publicKeys = sail;
-  "agenix/hosts/sail/nitter/auth.age".publicKeys = sail;
-
-  "agenix/hosts/sail/libreddit/auth.age".publicKeys = sail;
-
-  "agenix/hosts/sail/rimgo/auth.age".publicKeys = sail;
 
   "agenix/hosts/sail/anonymous-overflow/config.age".publicKeys = sail;
-  "agenix/hosts/sail/anonymous-overflow/auth.age".publicKeys = sail;
 
   "agenix/hosts/sail/proxitok/environment.age".publicKeys = sail;
-  "agenix/hosts/sail/proxitok/auth.age".publicKeys = sail;
 }

system/nixos/anonymous-overflow.nix

@@ -39,12 +39,12 @@ in
   };
 
   services.nginx.virtualHosts."overflow.daniel.sx" = {
+    listenAddresses = [ "100.113.242.85" ];
     http3 = true;
 
     root = "${anonymous-overflow-pkg}/share/anonymous-overflow/public/";
     onlySSL = true;
     useACMEHost = "daniel.sx";
-    basicAuthFile = config.age.secrets.anonymous-overflow-auth.path;
 
     locations."/" = {
       tryFiles = "$uri @proxy";

system/nixos/libreddit.nix

@@ -9,11 +9,11 @@
   };
 
   services.nginx.virtualHosts."${secret.nginx.hostnames.libreddit}" = {
+    listenAddresses = [ "100.113.242.85" ];
     http3 = true;
 
     onlySSL = true;
     useACMEHost = "daniel.sx";
-    basicAuthFile = config.age.secrets.libreddit-auth.path;
 
     locations."/" = {
       recommendedProxySettings = true;

system/nixos/nitter.nix

@@ -2,11 +2,6 @@
 
 let
   nitter-pkg = pkgs.nitter-unstable;
-
-  proxy-no-auth = {
-    recommendedProxySettings = true;
-    proxyPass = "http://127.0.0.1:8001";
-  };
 in
 {
   # Based on: https://github.com/NixOS/nixpkgs/blob/nixos-unstable/nixos/modules/services/misc/nitter.nix
@@ -53,6 +48,7 @@ in
   };
 
   services.nginx.virtualHosts."${secret.nginx.hostnames.nitter}" = {
+    listenAddresses = [ "100.113.242.85" ];
     http3 = true;
 
     root = "${nitter-pkg}/share/nitter/public/";
@@ -63,11 +59,7 @@ in
       tryFiles = "$uri @proxy";
     };
 
-    locations."/pic/" = proxy-no-auth;
-    locations."/video/" = proxy-no-auth;
-
     locations."@proxy" = {
-      basicAuthFile = config.age.secrets.nitter-auth.path;
       recommendedProxySettings = true;
       proxyPass = "http://127.0.0.1:8001";
     };

system/nixos/rimgo.nix

@@ -41,11 +41,11 @@ in
   };
 
   services.nginx.virtualHosts."ringo.daniel.sx" = {
+    listenAddresses = [ "100.113.242.85" ];
     http3 = true;
 
     onlySSL = true;
     useACMEHost = "daniel.sx";
-    basicAuthFile = config.age.secrets.rimgo-auth.path;
 
     locations."/" = {
       recommendedProxySettings = true;