823af825f4
pinix's Headscale now allocates its own range (100.96.0.0/24, fd7a:115c:a1e0:96::/64). The pinix-dns namespace node forwards exactly TCP 443 to a new Traefik web-internal entrypoint on the veth host side (:8443, websecure untouched) and TCP 22 to sshd. unbound-pinix answers git.lukasrosier.com (AAAA only), distributed via split DNS for that name only. gitserver/: cgit via services.cgit, reduced to reading and snapshot downloads, built without its Python filters; git@ with git-shell and a from= restricted key. Verified from tnix's pinixnet namespace (DNS, HTTPS, snapshot, ls-remote, push) and refused from the public IPv6, the blunix tailnet and the LAN. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JGodmgtRqahbT52gApsM8N
1.7 KiB
1.7 KiB
pinix services
Imported from default.nix; each file/subfolder documents its own service
in more depth where that's non-obvious (calendar/README.md,
prosody/README.md).
| File/dir | Service |
|---|---|
forgejo.nix |
Git hosting (git.${domain}) |
calendar/ |
Radicale (CalDAV) + read-only frontend, see its own README |
phanpy.nix |
Mastodon web client for GoToSocial |
gotosocial.nix |
ActivityPub/Fediverse server |
prosody/ |
XMPP server, see its own README |
xmpp-web.nix |
Web-based XMPP client |
webdav.nix |
WebDAV (port 8012) + SMB (port 445, tailnet-only, for the iOS/iPadOS Files app) file share |
fileserver-internal.nix |
Internal-only file serving |
dashboard.nix |
Backend for the dashboard service dashboard |
website.nix |
Static site preview server |
webhook.nix |
Forgejo push webhook receiver (chat notifications, auto-pull for the frontend repos) |
tailscale.nix, restic.nix, secrets.nix, packages.nix |
Host plumbing, not user-facing services |
gitserver/ |
Personal git server: cgit (read + snapshot download) and SSH for git@, reachable only inside pinix's own tailnet; see docs/intent/gitserver-pinix.md |
tailnet-dns.nix |
Namespace node of pinix's own tailnet: unbound-pinix, split DNS, forwarding of 443/22 to the host |
dex.nix, headscale.nix |
Parallel pinix identity/control-plane stack under domain2; bootstrap notes in docs/pinix-identity-stack.md |
vikunja.nix exists but is commented out of default.nix (disabled
29.07.2026, superseded by the agent@ XMPP inbox; data untouched on disk).
mazanoke.nix also exists but was never added to default.nix at all —
dead config, not currently deployed anywhere.