Tizian 「ティツィアーン」
d8c827eab6
The instance serves jellyfin.halkyon.eu and its Caddy proxies through a WireGuard tunnel to a Jellyfin on the operator's own machine, which dials out, so nothing names the home network's address and its router opens no port. compose.jellyfin-home.yaml takes the sidecar's place, with its site's rules unchanged (jellyfin.caddy's upstream is now a setting), and leaves JELLYFIN_URL unset, so the instance suggests it only while it answers. On the instance's server the tunnel reaches Jellyfin from Caddy alone and nothing of the host (wg-jellyfin-rules.sh, set and removed with the tunnel); the CI runner's unit denies it, and CI's Sandbox step fails if a job reaches it. The home end keeps Jellyfin in WireGuard's network namespace, its port on the loopback alone. The steps are in deploy/sidecars/README.md, the rules held by test/deploy/jellyfin_home_test.dart. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
17 lines
753 B
Text
17 lines
753 B
Text
# The instance's end of the tunnel to Jellyfin at home (ADR 0032, D4), as
|
|
# /etc/wireguard/wg-jellyfin.conf on the instance's server (root, 0600), brought up by
|
|
# wg-quick@wg-jellyfin. Its private key is a file of its own beside it, never here.
|
|
# Setting it up: sidecars/README.md, *Jellyfin at home*.
|
|
|
|
[Interface]
|
|
Address = 10.61.96.1/30
|
|
ListenPort = 51820
|
|
PostUp = wg set %i private-key /etc/wireguard/wg-jellyfin.key
|
|
# Caddy alone through the tunnel, nothing of the host from it (D5).
|
|
PostUp = /etc/wireguard/wg-jellyfin-rules.sh up %i
|
|
PreDown = /etc/wireguard/wg-jellyfin-rules.sh down %i
|
|
|
|
# The home end, which dials in: no endpoint, so this server never names its address.
|
|
[Peer]
|
|
PublicKey = <the home end's public key>
|
|
AllowedIPs = 10.61.96.2/32
|