Tizian 「ティツィアーン」
d8c827eab6
The instance serves jellyfin.halkyon.eu and its Caddy proxies through a WireGuard tunnel to a Jellyfin on the operator's own machine, which dials out, so nothing names the home network's address and its router opens no port. compose.jellyfin-home.yaml takes the sidecar's place, with its site's rules unchanged (jellyfin.caddy's upstream is now a setting), and leaves JELLYFIN_URL unset, so the instance suggests it only while it answers. On the instance's server the tunnel reaches Jellyfin from Caddy alone and nothing of the host (wg-jellyfin-rules.sh, set and removed with the tunnel); the CI runner's unit denies it, and CI's Sandbox step fails if a job reaches it. The home end keeps Jellyfin in WireGuard's network namespace, its port on the loopback alone. The steps are in deploy/sidecars/README.md, the rules held by test/deploy/jellyfin_home_test.dart. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
19 lines
786 B
Text
19 lines
786 B
Text
# The Jellyfin sidecar's site (compose.jellyfin.yaml).
|
|
{$JELLYFIN_DOMAIN} {
|
|
# Its demo account (sidecars/README.md) has no password and is everyone's: nobody
|
|
# may change a user from outside (give it a password, change its settings or its
|
|
# picture), only sign in. Halkyon Learn writes nothing else under /Users. The setup
|
|
# wizard is closed too. The admin works through an SSH tunnel, which doesn't pass
|
|
# here.
|
|
@userChanges {
|
|
method POST PUT DELETE
|
|
path /Users/* /UserImage /UserImage/*
|
|
not path /Users/AuthenticateByName /Users/AuthenticateWithQuickConnect
|
|
}
|
|
respond @userChanges 403
|
|
respond /Startup/* 403
|
|
|
|
# The sidecar's Jellyfin, or Jellyfin at home through WireGuard
|
|
# (compose.jellyfin-home.yaml, ADR 0032).
|
|
reverse_proxy {$JELLYFIN_UPSTREAM:jellyfin:8096}
|
|
}
|