From 25c6982ceaf76c73eb19d23bf91acc35d23be105 Mon Sep 17 00:00:00 2001 From: erik Date: Mon, 13 Jul 2026 00:26:16 +0200 Subject: [PATCH] feat(audiobookshelf): bind 0.0.0.0 so it's reachable over tailscale (VPS proxy) --- jupiter/services.nix | 6 ++++-- secrets/jupiter.yaml | 6 +++--- 2 files changed, 7 insertions(+), 5 deletions(-) diff --git a/jupiter/services.nix b/jupiter/services.nix index a4ceb6b..6698b26 100644 --- a/jupiter/services.nix +++ b/jupiter/services.nix @@ -108,9 +108,11 @@ # dirs on the RAID (chown/chmod or add it to the owning group as needed). services.audiobookshelf = { enable = true; - host = "127.0.0.1"; + host = "0.0.0.0"; # reachable over tailscale0 (trusted) + localhost port = 8000; - # openFirewall stays off — access is via the caddy reverse proxy. + # openFirewall stays OFF: :8000 is blocked on the LAN, but tailscale0 is a + # trusted interface, so the VPS reaches it via jupiter.hosts.mgaction.town:8000. + # Local caddy (below) still serves LAN clients via localhost:8000. }; users.users.audiobookshelf.extraGroups = [ "users" ]; diff --git a/secrets/jupiter.yaml b/secrets/jupiter.yaml index d171ffa..8adfab5 100644 --- a/secrets/jupiter.yaml +++ b/secrets/jupiter.yaml @@ -1,6 +1,6 @@ samba_password: ENC[AES256_GCM,data:K3FtKC0CrOLMyfQokmxxlyUnDPo=,iv:9bTE/S/i05LJYldOHuBuz3+g8JdTuq0ysFFgXOmfti8=,tag:77NIxy7qpHRqCmbOR83AfA==,type:str] darman_password: ENC[AES256_GCM,data:DOHHlM4Qdw4WgkN+/M51n2LMjJqq5MS0FeGEH8Pz3297yUZ8jBDOKRS/Tek9stC05JKEQRtn/vVVbAY0nXs20MwrsDMo+IEFXx7Ms90vVyYIYe5O5/0aQkPq84vcwGN0RW1Rj5Y3s38vWA==,iv:DAqHbvOBq7FT7ALbmBXJ0HadEGEsL8V2e7R99H5ZH0s=,tag:9XpiRFIbaZjMn59uHCOA1g==,type:str] -tailscale_authkey: ENC[AES256_GCM,data:HY/clkraY7q5+w8gqK4LXGaWYnrZYeEqu1s8Pxq+8is=,iv:IA5PWYMAJCKTWIaYvU2cw1N51+Qhm2VFa2J+JpXZH9Y=,tag:Hgi91/tRiPasEpvfnupaIQ==,type:str] +tailscale_authkey: ENC[AES256_GCM,data:GJjN9zdU3zNBxA8cEBdsmjDrj8G/m04r8JRCEDZkdd7jYplEHyLfhbMcIyZIBe3Sh4d3PM/PcKb191LZoMg/b1G4hiVwciaCoMY0O9kAhRg/aYHXluSIBQ==,iv:R3OsZ+3to0tBhF4IaaSHm0afkw5o0KfXkcTdT9HFucg=,tag:QQNXC9ya88lO087iGIc1sw==,type:str] sops: age: - enc: | @@ -21,7 +21,7 @@ sops: CzjSDQZTcseEXZNwuzZcfB5Mvq0BQvjOj7lGuxzuE4qwWkdJWGfVLQ== -----END AGE ENCRYPTED FILE----- recipient: age1zak7glavmg4026p2389fyqe769vqm4jrryknuqckgqq4merz5f7q44rkkt - lastmodified: "2026-07-12T22:16:53Z" - mac: ENC[AES256_GCM,data:SfevvvHXHEiJi/9MDVgPZQOtYMCShRZw274j77C9jRZY/3HyY9ZsFBmrdNZpMbycD09F1rd1CQV3q/ZGpeViVQ/9c1wi4mYiaDzISr9Rp9os+zsA+wFuNxNIiTf88m1dolejgRhpPBJ3Obg2q9cWgKy0accSe63MnbF5JRrczJA=,iv:35cb8j5w80ctl+BzyCYCp+8i5RO9rROgGuZ/J1WYJK4=,tag:lczFd+2kVECelY/BwqfpAA==,type:str] + lastmodified: "2026-07-12T22:19:04Z" + mac: ENC[AES256_GCM,data:iDcCp2dE657x9xDGM4Ki76gycaOM/7Z8v7qdl3Bcf0HcbH0oKWE2nShBO8/YK67p+Dkhghp/83G8vXCmEo0MA83C+gHha6JAyX2UJtvtVhBgF0ul8LMnXt4l+l7Ps8Bjne+LLtUK3U/2LGvADANPjNbpbCwe6x9OUPHmPXWYDxo=,iv:Cnrxb3xPCvq52DoktC1Osv1WbF/I7wfIYbAVRi2eNg4=,tag:Yodqbtl1+DnDvrtgT1lawQ==,type:str] unencrypted_suffix: _unencrypted version: 3.13.1