rope/nixos
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

pelican: gate panel behind Authelia, bypass /api/remote/ for wings

Browse source 
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
rope 2026-08-09 12:00:43 +01:00
parent 00ec9a9759
commit 475d394810
3 changed files with 33 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

36
services/nginx.nix
View file

@ -106,15 +106,13 @@ in
"jellyfin.nordhammer.it" = proxy 8096; # streaming to external clients
"seerr.nordhammer.it" = proxy 5055; # own auth via Jellyfin sign-in
# Pelican game panel — own auth. Not Authelia-protected: wings polls
# the panel API and the browser console opens a websocket straight to
# the node, neither of which can follow a forward-auth redirect.
"panel.nordhammer.it" = lib.recursiveUpdate (proxy 8092) {
locations."/".extraConfig = "client_max_body_size 100m;";
};
# wings daemon (see services/pelican.nix). Uploads through the file
# manager are whole server archives, so no body-size cap; the console
# websocket idles between keystrokes, hence the long read timeout.
# wings daemon (see services/pelican.nix). Deliberately NOT behind
# Authelia: the panel container calls this server-to-server and has no
# session cookie to present. wings authenticates every request with its
# own token/JWT, so an unauthenticated caller gets nothing. Uploads
# through the file manager are whole server archives, hence no
# body-size cap; the console websocket idles between keystrokes, hence
# the long read timeout.
"node.nordhammer.it" = lib.recursiveUpdate (proxy 8443) {
locations."/".extraConfig = ''
client_max_body_size 0;
@ -156,6 +154,26 @@ in
};
"notes.nordhammer.it" = protectedProxy 5230;
# Pelican game panel. Can't turn off its own login (no such option
# upstream), so Authelia is the outer gate and the Pelican account
# behind it is a formality. /api/remote/ must skip forward-auth: wings
# polls it with its daemon token and can't follow a 302 to the portal.
"panel.nordhammer.it" = ssl // {
locations = autheliaLocation // {
"/" = {
proxyPass = "http://127.0.0.1:8092";
proxyWebsockets = true;
extraConfig = autheliaAuthConfig + ''
client_max_body_size 100m;
'';
};
"/api/remote/" = {
proxyPass = "http://127.0.0.1:8092";
extraConfig = "client_max_body_size 100m;";
};
};
};
# --- Local-only: serves update history JSON to Homepage's customapi widget ---
"homepage-updates.local" = {
listen = [ { addr = "127.0.0.1"; port = 8083; } ];