stupid wireguard configuration

boxes/copernicus/default.nix

@@ -107,26 +107,13 @@
     hostName = "copernicus";
     firewall = {
       enable = true;
-      interfaces = {
+      allowedTCPPorts = [ 6000 ];
-        eno1 = {
+      allowedTCPPortRanges = [
-          allowedTCPPorts = [ 6000 ];
+        { from = 1714; to = 1764; } # KDE Connect
-          allowedTCPPortRanges = [
+      ];
-            { from = 1714; to = 1764; } # KDE Connect
+      allowedUDPPortRanges = [
-          ];
+        { from = 1714; to = 1764; } # KDE Connect
-          allowedUDPPortRanges = [
+      ];
-            { from = 1714; to = 1764; } # KDE Connect
-          ];
-        };
-        wg0 = {
-          # allow everything bound to the wg0 interface
-          allowedTCPPortRanges = [
-            { from = 1; to = 35565; }
-          ];
-          allowedUDPPortRanges = [
-            { from = 1; to = 35565; }
-          ];
-        };
-      };
     };
   };
 

boxes/copernicus/services/photoprism.nix

@@ -4,12 +4,10 @@
   services.photoprism = {
     enable = true;
     originalsPath = "/var/lib/photoprism/originals";
-    passwordFile = "/home/usr/wg-keys/photoprism-password";
     settings = {
       PHOTOPRISM_ADMIN_USER = "usr";
+      PHOTOPRISM_ADMIN_PASSWORD = "usr";
       PHOTOPRISM_SITE_TITLE = "photos.beepboop.systems";
-      PHOTOPRISM_SITE_URL = "https://photos.beepboop.systems";
-      PHOTOPRISM_DEFAULT_LOCALE = "en";
     };
   };
 }

boxes/copernicus/services/wireguard.nix

@@ -13,7 +13,8 @@
         peers = [
           { # netbox
             publicKey = "0fOqAfsYO4HvshMPnlkKL7Z1RChq98hjDr0Q8o7OJFE=";
-            allowedIPs = [ "10.100.0.0/24" ]; # only stuff in the wg-subnet (10.100.0.*)
+            allowedIPs = [ "10.100.0.1" ]; # only server-bound traffic -- everything else
+                                           # should be routed via consumer isp
             endpoint = "149.28.63.115:51820";
             persistentKeepalive = 25;
           }

boxes/netbox/default.nix

@@ -17,7 +17,6 @@
       ./nginx.nix
       ./franklincce.nix
       ./wireguard.nix
-      ./photoprism-bridge.nix
     ];
 
   nix = {

boxes/netbox/photoprism-bridge.nix

@@ -1,17 +0,0 @@
-{ lib, config, pkgs, ... }:
-{
-  services.nginx.virtualHosts."photos.beepboop.systems" = {
-    forceSSL = true;
-    enableACME = true;
-    locations."/" = {
-      proxyPass = "http://10.100.0.2:2342";
-      proxyWebsockets = true;
-      extraConfig = ''
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header Host $host;
-        proxy_buffering off;
-        proxy_http_version 1.1;
-      '';
-    };
-  };
-}