feat(deploy): Jellyfin at home, published through WireGuard (ADR 0032)
The instance serves jellyfin.halkyon.eu and its Caddy proxies through a
WireGuard tunnel to a Jellyfin on the operator's own machine, which dials
out, so nothing names the home network's address and its router opens no
port. compose.jellyfin-home.yaml takes the sidecar's place, with its
site's rules unchanged (jellyfin.caddy's upstream is now a setting), and
leaves JELLYFIN_URL unset, so the instance suggests it only while it
answers.
On the instance's server the tunnel reaches Jellyfin from Caddy alone and
nothing of the host (wg-jellyfin-rules.sh, set and removed with the
tunnel); the CI runner's unit denies it, and CI's Sandbox step fails if a
job reaches it. The home end keeps Jellyfin in WireGuard's network
namespace, its port on the loopback alone. The steps are in
deploy/sidecars/README.md, the rules held by test/deploy/jellyfin_home_test.dart.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
2026-10-30 22:49:47 +01:00
|
|
|
# The home end of the tunnel to the instance's server (ADR 0032), copied to
|
|
|
|
|
# wireguard/wg_confs/wg0.conf (git-ignored) with its two keys filled in. Setting it up:
|
|
|
|
|
# ../sidecars/README.md, *Jellyfin at home*.
|
|
|
|
|
|
|
|
|
|
[Interface]
|
|
|
|
|
Address = 10.61.96.2/32
|
|
|
|
|
PrivateKey = <the home end's private key>
|
|
|
|
|
|
|
|
|
|
[Peer]
|
|
|
|
|
PublicKey = <the instance's public key>
|
2026-10-31 15:10:46 +01:00
|
|
|
# learn.halkyon.eu's server by its IPv4 address, not its name (ADR 0032, D11): a name
|
|
|
|
|
# needs DNS to come up, which a machine starting or waking hasn't always got yet, and a
|
|
|
|
|
# tunnel that fails to come up takes Jellyfin's internet with it. A new address of the
|
|
|
|
|
# server's goes here too.
|
|
|
|
|
Endpoint = 89.58.53.154:51820
|
feat(deploy): Jellyfin at home, published through WireGuard (ADR 0032)
The instance serves jellyfin.halkyon.eu and its Caddy proxies through a
WireGuard tunnel to a Jellyfin on the operator's own machine, which dials
out, so nothing names the home network's address and its router opens no
port. compose.jellyfin-home.yaml takes the sidecar's place, with its
site's rules unchanged (jellyfin.caddy's upstream is now a setting), and
leaves JELLYFIN_URL unset, so the instance suggests it only while it
answers.
On the instance's server the tunnel reaches Jellyfin from Caddy alone and
nothing of the host (wg-jellyfin-rules.sh, set and removed with the
tunnel); the CI runner's unit denies it, and CI's Sandbox step fails if a
job reaches it. The home end keeps Jellyfin in WireGuard's network
namespace, its port on the loopback alone. The steps are in
deploy/sidecars/README.md, the rules held by test/deploy/jellyfin_home_test.dart.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
2026-10-30 22:49:47 +01:00
|
|
|
# The instance's end alone, through which Caddy's requests come (masqueraded by Docker
|
|
|
|
|
# on the instance's server): nothing else of the internet goes through the tunnel.
|
|
|
|
|
AllowedIPs = 10.61.96.1/32
|
|
|
|
|
# Dialling out keeps the way open through the router and brings the tunnel back within
|
|
|
|
|
# 25 s after the machine wakes (D10).
|
|
|
|
|
PersistentKeepalive = 25
|