823af825f4
pinix's Headscale now allocates its own range (100.96.0.0/24, fd7a:115c:a1e0:96::/64). The pinix-dns namespace node forwards exactly TCP 443 to a new Traefik web-internal entrypoint on the veth host side (:8443, websecure untouched) and TCP 22 to sshd. unbound-pinix answers git.lukasrosier.com (AAAA only), distributed via split DNS for that name only. gitserver/: cgit via services.cgit, reduced to reading and snapshot downloads, built without its Python filters; git@ with git-shell and a from= restricted key. Verified from tnix's pinixnet namespace (DNS, HTTPS, snapshot, ls-remote, push) and refused from the public IPv6, the blunix tailnet and the LAN. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JGodmgtRqahbT52gApsM8N
28 lines
1.7 KiB
Markdown
28 lines
1.7 KiB
Markdown
# pinix services
|
|
|
|
Imported from `default.nix`; each file/subfolder documents its own service
|
|
in more depth where that's non-obvious (`calendar/README.md`,
|
|
`prosody/README.md`).
|
|
|
|
| File/dir | Service |
|
|
| --- | --- |
|
|
| `forgejo.nix` | Git hosting (`git.${domain}`) |
|
|
| `calendar/` | Radicale (CalDAV) + read-only frontend, see its own README |
|
|
| `phanpy.nix` | Mastodon web client for GoToSocial |
|
|
| `gotosocial.nix` | ActivityPub/Fediverse server |
|
|
| `prosody/` | XMPP server, see its own README |
|
|
| `xmpp-web.nix` | Web-based XMPP client |
|
|
| `webdav.nix` | WebDAV (port 8012) + SMB (port 445, tailnet-only, for the iOS/iPadOS Files app) file share |
|
|
| `fileserver-internal.nix` | Internal-only file serving |
|
|
| `dashboard.nix` | Backend for the `dashboard` service dashboard |
|
|
| `website.nix` | Static site preview server |
|
|
| `webhook.nix` | Forgejo push webhook receiver (chat notifications, auto-pull for the frontend repos) |
|
|
| `tailscale.nix`, `restic.nix`, `secrets.nix`, `packages.nix` | Host plumbing, not user-facing services |
|
|
| `gitserver/` | Personal git server: cgit (read + snapshot download) and SSH for `git@`, reachable only inside pinix's own tailnet; see `docs/intent/gitserver-pinix.md` |
|
|
| `tailnet-dns.nix` | Namespace node of pinix's own tailnet: `unbound-pinix`, split DNS, forwarding of 443/22 to the host |
|
|
| `dex.nix`, `headscale.nix` | Parallel pinix identity/control-plane stack under `domain2`; bootstrap notes in `docs/pinix-identity-stack.md` |
|
|
|
|
`vikunja.nix` exists but is commented out of `default.nix` (disabled
|
|
29.07.2026, superseded by the `agent@` XMPP inbox; data untouched on disk).
|
|
`mazanoke.nix` also exists but was never added to `default.nix` at all —
|
|
dead config, not currently deployed anywhere.
|