halkyon/deploy/home-jellyfin/server/wg-quick-after-docker.conf

# The tunnel to Jellyfin at home starts after Docker, whose DOCKER-USER chain its rules
# go into, and restarts with it (ADR 0032, D5). As
# /etc/systemd/system/wg-quick@wg-jellyfin.service.d/after-docker.conf.
[Unit]
After=docker.service
Requires=docker.service
PartOf=docker.service
feat(deploy): Jellyfin at home, published through WireGuard (ADR 0032) The instance serves jellyfin.halkyon.eu and its Caddy proxies through a WireGuard tunnel to a Jellyfin on the operator's own machine, which dials out, so nothing names the home network's address and its router opens no port. compose.jellyfin-home.yaml takes the sidecar's place, with its site's rules unchanged (jellyfin.caddy's upstream is now a setting), and leaves JELLYFIN_URL unset, so the instance suggests it only while it answers. On the instance's server the tunnel reaches Jellyfin from Caddy alone and nothing of the host (wg-jellyfin-rules.sh, set and removed with the tunnel); the CI runner's unit denies it, and CI's Sandbox step fails if a job reaches it. The home end keeps Jellyfin in WireGuard's network namespace, its port on the loopback alone. The steps are in deploy/sidecars/README.md, the rules held by test/deploy/jellyfin_home_test.dart. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me> 2026-10-30 22:49:47 +01:00			`# The tunnel to Jellyfin at home starts after Docker, whose DOCKER-USER chain its rules`
			`# go into, and restarts with it (ADR 0032, D5). As`
			`# /etc/systemd/system/wg-quick@wg-jellyfin.service.d/after-docker.conf.`
			`[Unit]`
			`After=docker.service`
			`Requires=docker.service`
			`PartOf=docker.service`