move miniflux behind tailscale
diff --git a/.terraform.lock.hcl b/.terraform.lock.hcl
index e15c048..4c87ad3 100644
--- a/.terraform.lock.hcl
+++ b/.terraform.lock.hcl
@@ -2,23 +2,66 @@
# Manual edits may be lost in future updates.
provider "registry.terraform.io/linode/linode" {
- version = "2.18.0"
- constraints = "2.18.0"
+ version = "2.34.0"
+ constraints = "~> 2.18"
hashes = [
- "h1:CeGbgARw4BrgUrEfPVRUjwoPI5WrCtA4bG39ckFHrlQ=",
- "zh:03bc6644991818395759757cc5a3f07b6a8f7f797f04d701441e79e85cb9dc69",
- "zh:5248ed1626e1531616fd227840c7734b8f2d13631427d80672b615e60f106a2d",
- "zh:80a890b44a66639b1dabc2773e5dbb5f22a8e73495ce167a5064296463e17cdc",
- "zh:874f5794a567250fc873af73c8c67a1980eb30de864ef76eb772ae492cf530ba",
- "zh:94469b62cc27ce53fcd06a48b84de256136576699602ba68d157b2ad033ac0ed",
- "zh:a1b9096702e1ee197f84634159d512b54d9223d00ff850ff4073eb9e5ac5eb9d",
- "zh:a39c77dbf770a349529596124d4188fc7eeb8ecaf88ebc06f586d884f68df550",
- "zh:bd5ee9da38d1846edc6af87771ede950bb703d99f78756c05da00fc0ca325be5",
- "zh:c4b1d74d8d44ed258ca96a2b76d0101858672624a8d9731df8a97b8373dba728",
- "zh:c69db2d6e4d7b04f9bc2f00223e61ae12127946043b07bca567fa3883bf5c071",
- "zh:e818b9ea84e55ce1d2eb1f8852ec6606ce5d3691f356ea4eb3a701e5986ed339",
- "zh:eeb7e6d518f62d6f02b497dbb5427a7a8ea38e2e5dddc8a114f7989a7a8c47f7",
- "zh:fa77abf56e34701cdc49799cc13c6298be184d7cb48de20ee8b30e93fb3735a0",
- "zh:fc3e94acd6fb2ad6b526169896fc6821298ba394a4d181c9b2448341e2e0eb54",
+ "h1:iiVqqMGJt7pk9TlpuMa6DKK3ffOh2lKgYAkUquzf4A0=",
+ "zh:46c7b398e6d7b833e8884e0636942216263c41202415a6edff4851ac2d8c20aa",
+ "zh:4858f7ab37315d480fcbb0a5a4abfa85b951ed3f54680e2f41a4a5b08055f824",
+ "zh:48740c443ae0f1f46298a407caede642f6912b869ae13b41cda9cfafa9537b19",
+ "zh:4c7158c29d1c9f4fa7d6955b230e9ea735ec14a099256888788f5257bfc47ee0",
+ "zh:68f002b7dccac0c704ca8eefb1475a5af12f1b9e9656b90bffde8e401244671b",
+ "zh:7da03cbbaa33dff4b1cd47eb2ff28d4fb43444b32f8fa3936111e83c043edadf",
+ "zh:9cc73fdbdf230f2663e35b7493237e64e5596d8520233842942303230e1ea234",
+ "zh:aa9e0166691523f5e19d76ad5d74a17a0b0c419489adfe0a657b565ba641b629",
+ "zh:b33af04cc9740c762a3c55c3753b3f293873349c233f8d7d0a734b8eb9291c32",
+ "zh:cf246a8e4653685f1b02ec2f6c01a88927cc2c1557a4f8f1e3b54a162a96e512",
+ "zh:dcdf67170d07b544f98ffae54c3c8e0e6154d4bbb27bfef33f0746a327cece4b",
+ "zh:f3a34513e650c6df61c2da0cf160f6d83e493e8d210a39d63510405d13c27391",
+ "zh:f5ae88e47ed08fb7d4ebc48d84fedb9daba372c1c634508698d8fbf4c4948231",
+ "zh:f8c7d3c7e7865c221d15cbb6a12f9e60bea95b0a91d573833c3490d24e3b9227",
+ ]
+}
+
+provider "registry.terraform.io/ryanwholey/pihole" {
+ version = "0.2.0"
+ constraints = "~> 0.2"
+ hashes = [
+ "h1:bnOfTUShJbhaEnqAD+hfWECOQRriukCNxVrH478leC4=",
+ "zh:340bf25085869ef0292ca4c4b916f509e7b3af9bf9c5b4dee9279fdf74287281",
+ "zh:4dbed1af421a2b9379e99e9d896898b6597ca874ff071e874c5116ba62f7706c",
+ "zh:532dc4ff9500c2f0225f12e2df53a2fc4da46713fc01756d1575783933dc51e0",
+ "zh:837a7030b30d5651c46307b687bc6c082aff191e2ea31f36914d585bb46ffc0d",
+ "zh:a678331326f465a4ca930d26e10d75e6e62e05ae9220ee406b34d4d1d77e0595",
+ "zh:a6e23c128d71061ab89e78c45ef7a878420a8201551136d3ecbd10ae620676e1",
+ "zh:b5133016ddd29f08f3719da3f7ee41680ed05a6d8f4c3f6b0bb89a6aa5f187da",
+ "zh:b59ce1807603f5cd95e8988f8203c9b03a7754f75dbf613909fee5abe687ecf2",
+ "zh:bd3fb3ea5d72468a08491c27ec4f32b1836533d4036f88f56728508644a9bcb2",
+ "zh:cf69c5127d89bdd8c094f169cdf3c93be2977abc48030c001616129f74f124ca",
+ "zh:e82a08e0be7437ef19b5ced837e76fd5014c490b803c2b479738a8db3a6ad933",
+ "zh:eef96671eba8c9e7d52586a0ef2adc0f92b13f46faf893b553d83366c01cc8ff",
+ "zh:f63758ad86ab442f29041f7d0de417efa594a0f0b2ade0651977ec8831ad9378",
+ ]
+}
+
+provider "registry.terraform.io/tailscale/tailscale" {
+ version = "0.17.2"
+ constraints = "~> 0.17.2"
+ hashes = [
+ "h1:Hb7w+ibr6O6jvQSJbLAH0DI/r7sgnkxKLiAofAjEzpQ=",
+ "zh:13d21db507bfb17018005c5c4f19314591a5734c76bcd51ab6e80984164c2a71",
+ "zh:13dbb3d978aca16f66c49596e5a38d236264d10a66879dc0d06839aca9cdad3f",
+ "zh:1589a8b006da14d60e3fcd55fbc465ccdce7a99e833b6a7455fbf81be59f07f3",
+ "zh:1de3673533c0c20c4fc6070822f0c416a64734656f2e181e6bab5e9df5383ed9",
+ "zh:24eaaf37dacb48e26b53a2a0491ffa7bc5c1977d9c27753ada734ed0191f28aa",
+ "zh:2a0890a012829aa370bb930a8155af49accf53832324e8124e123d0679878c3c",
+ "zh:4f8a462d462b0942add33cf376655c0470b6826db34e57aecc9a62742e286283",
+ "zh:5cf38de52c7e2e8f3a5f8e05e1fbef4db4545c5b2dc2f89b0bfb4b8eea293a14",
+ "zh:8bbf0a4c9a6c37b31dda332a8a7436516fc62ce777e0e586772883f39de56e52",
+ "zh:9213bbdea053d1edbeccb51a7e86829e1539b5295fba08bf0eda9af729e8ba60",
+ "zh:9a645a49430297e27304e93ebc699fcb0d1a068ba8b431c4ec0f9ad4a4e134bf",
+ "zh:b3b70b083161cb97ef0618be579453d13b25ba95c785744cd0c4a84eecc7a0f9",
+ "zh:b3e1e5ac6087120ef548d2ceeafef1b0b469aad17a84eb873f0f4d5eaa2bf6f9",
+ "zh:e323626e070442308bcadfcc51a3ce5b0e6ae41a7632f82bb24318706920a9d3",
]
}
diff --git a/fastmail/main.tf b/fastmail/main.tf
index ef5e686..83ad870 100644
--- a/fastmail/main.tf
+++ b/fastmail/main.tf
@@ -4,7 +4,7 @@ terraform {
required_providers {
linode = {
source = "linode/linode"
- version = "2.18.0"
+ version = "~> 2.18"
}
}
}
diff --git a/lotus-land-story/caddy.yml b/lotus-land-story/caddy.yml
index 9d4c4c0..3d0c08c 100644
--- a/lotus-land-story/caddy.yml
+++ b/lotus-land-story/caddy.yml
@@ -1,9 +1,12 @@
+# The root certificate for local HTTPS is located here:
+# /mnt/lotus-land-story/caddy/data/caddy/pki/authorities/local/root.crt
+
- name: Set up Caddy
hosts: lotus-land-story
vars_files:
- vars.yml
vars:
- version: 2.8.4
+ version: 2.9.1
tasks:
- name: Make /mnt/lotus-land-story/caddy
@@ -37,8 +40,10 @@
- name: Run Caddy
community.docker.docker_container:
name: caddy
- image: caddy:{{ version }}
+ image: ghcr.io/kejadlen/caddy-tailscale:{{ version }}
restart: true
+ env:
+ TS_AUTHKEY: "{{ tailscale.auth_key }}"
ports:
- "80:80"
- "443:443"
diff --git a/lotus-land-story/main.tf b/lotus-land-story/main.tf
index 560b321..9095f9a 100644
--- a/lotus-land-story/main.tf
+++ b/lotus-land-story/main.tf
@@ -65,7 +65,6 @@ resource "linode_domain_record" "subdomains" {
"hledger",
"loki",
"prometheus",
- "rss",
])
name = each.key
}
diff --git a/lotus-land-story/miniflux.yml b/lotus-land-story/miniflux.yml
index 2d612c2..7c38db3 100644
--- a/lotus-land-story/miniflux.yml
+++ b/lotus-land-story/miniflux.yml
@@ -64,15 +64,12 @@
CREATE_ADMIN: "1"
ADMIN_USERNAME: alpha
ADMIN_PASSWORD: "{{ miniflux.password }}"
- BASE_URL: https://rss.{{ domain }}
+ AUTH_PROXY_HEADER: Remote-User
+ AUTH_PROXY_USER_CREATION: "0"
+ BASE_URL: https://rss/
+ DISABLE_LOCAL_AUTH: "0"
METRICS_COLLECTOR: "1"
METRICS_ALLOWED_NETWORKS: "{{ docker_network.network.IPAM.Config[0].Subnet }}"
- OAUTH2_PROVIDER: oidc
- OAUTH2_CLIENT_ID: miniflux
- OAUTH2_CLIENT_SECRET: "{{ miniflux.oidc_secret }}"
- OAUTH2_REDIRECT_URL: https://rss.{{ domain }}/oauth2/oidc/callback
- OAUTH2_OIDC_DISCOVERY_ENDPOINT: https://auth.{{ domain }}
- OAUTH2_USER_CREATION: "1"
LOG_FORMAT: json
LOG_LEVEL: info
restart_policy: unless-stopped
diff --git a/lotus-land-story/templates/Caddyfile b/lotus-land-story/templates/Caddyfile
index 5937bb2..f7bc129 100644
--- a/lotus-land-story/templates/Caddyfile
+++ b/lotus-land-story/templates/Caddyfile
@@ -2,6 +2,11 @@
servers {
metrics
}
+
+ tailscale {
+ auth_key {env.TS_AUTHKEY}
+ state_dir /data/tailscale
+ }
}
# https://www.authelia.com/integration/proxies/caddy/#forwarded-header-trust#trusted-proxies
@@ -17,8 +22,13 @@ loki.kejadlen.dev {
reverse_proxy loki:3100
}
-rss.kejadlen.dev {
- reverse_proxy miniflux:8080
+rss {
+ tls internal
+ bind tailscale/rss
+ tailscale_auth
+ reverse_proxy miniflux:8080 {
+ header_up Remote-User {http.auth.user.tailscale_login}
+ }
}
prometheus.kejadlen.dev {
diff --git a/lotus-land-story/templates/authelia_configuration.yml b/lotus-land-story/templates/authelia_configuration.yml
index 5c7a511..99d3c61 100644
--- a/lotus-land-story/templates/authelia_configuration.yml
+++ b/lotus-land-story/templates/authelia_configuration.yml
@@ -93,17 +93,6 @@ identity_providers:
- email
- profile
- - client_id: miniflux
- client_name: Miniflux
- client_secret: $argon2id$v=19$m=65536,t=3,p=4$tK5aBDAHOmNsEZzSYS88eg$z6tkZVIzB0x6RQjCM0v34lguS454lcQd/Sm0+xRfg7w
- public: false
- redirect_uris:
- - https://rss.{{ domain }}/oauth2/oidc/callback
- scopes:
- - openid
- - email
- - profile
-
- client_id: gotosocial
client_name: GoToSocial
client_secret: $argon2id$v=19$m=65536,t=3,p=4$4fkP2O3FYs26yKH/3WLuvQ$JHkaAA+b752/v7rtyhEzGwGutpSZR+7PSmz8psFb8BM
diff --git a/main.tf b/main.tf
index cd08052..9823fe1 100644
--- a/main.tf
+++ b/main.tf
@@ -9,11 +9,36 @@ terraform {
required_providers {
linode = {
source = "linode/linode"
- version = "2.18.0"
+ version = "~> 2.18"
+ }
+
+ pihole = {
+ source = "ryanwholey/pihole"
+ version = "~> 0.2"
+ }
+
+ tailscale = {
+ source = "tailscale/tailscale"
+ version = "~> 0.17.2"
}
}
}
+provider "linode" {
+ # token = LINODE_TOKEN
+}
+
+provider "pihole" {
+ url = "https://pihole.kejadlen.dev"
+ # api_token = # PIHOLE_API_TOKEN
+}
+
+provider "tailscale" {
+ tailnet = "-"
+ # oauth_client_id = TAILSCALE_OAUTH_CLIENT_ID
+ # oauth_client_secret = TAILSCALE_OAUTH_CLIENT_SECRET
+}
+
variable "soa_email" {
type = string
nullable = false
@@ -38,6 +63,14 @@ data "linode_instances" "lotus_land_story" {
}
}
+data "tailscale_device" "lotus_land_story" {
+ hostname = "lotus-land-story"
+}
+
+data "tailscale_device" "on_fire_within" {
+ hostname = "on-fire-within"
+}
+
locals {
ramble_hard = data.linode_instances.ramble_hard.instances.0
lotus_land_story = data.linode_instances.lotus_land_story.instances.0
@@ -54,3 +87,12 @@ resource "linode_domain" "chislan_family" {
domain = "chislan.family"
soa_email = var.soa_email
}
+
+resource "pihole_dns_record" "rss" {
+ for_each = toset([
+ "rss",
+ ])
+
+ domain = each.key
+ ip = data.tailscale_device.lotus_land_story.addresses.0
+}