From 1550e333e037990f4932a6e73ef5fc6d4f4fb61f Mon Sep 17 00:00:00 2001 From: ulve Date: Mon, 12 Oct 2026 09:08:52 +0200 Subject: [PATCH] nixserve: open Music Assistant/mDNS ports, add paperless service, bump flake inputs Allow TCP 8095 (Music Assistant web UI) and UDP 5353 (mDNS) through the firewall so the LAN interface can reach it and Chromecast discovery works; previously only the trusted tailscale0 interface had access. --- flake.lock | 20 ++++++++++---------- hosts/nixserve/default.nix | 4 ++-- hosts/nixserve/services.nix | 12 ++++++++++++ 3 files changed, 24 insertions(+), 12 deletions(-) diff --git a/flake.lock b/flake.lock index 8d96a0a..e7a398e 100644 --- a/flake.lock +++ b/flake.lock @@ -8,11 +8,11 @@ "rust-overlay": "rust-overlay" }, "locked": { - "lastModified": 1790642832, - "narHash": "sha256-dhAifTJeh8sfK0s/KzUZIo1qHlv+AFit3HOyCT+QC5E=", + "lastModified": 1791759048, + "narHash": "sha256-/KMQbdh5X6Sa1GTUqyKf3vHdHDgpuRfJr9iHommwiH8=", "owner": "ogulcancelik", "repo": "herdr", - "rev": "9dc3a1df2b563df0637264fc0dffcd607c324ac5", + "rev": "dc6b6e5f42831ea7114f34dcf12900680eb36ae0", "type": "github" }, "original": { @@ -28,11 +28,11 @@ ] }, "locked": { - "lastModified": 1790215976, - "narHash": "sha256-VkR1rMGyjU9jtw8ISFx5uqR9e+LEaOlhHwrseFkiIVk=", + "lastModified": 1790996401, + "narHash": "sha256-f+kOxEmOUnQazVAmGg0i8hzwgd1kX/geY+k/Dpheye8=", "owner": "nix-community", "repo": "home-manager", - "rev": "a6631107a83ceab5872f298a2ea710859c80c4cb", + "rev": "db7d5e2332710f5abb088f6b5de927d7f9511b35", "type": "github" }, "original": { @@ -44,11 +44,11 @@ }, "nixpkgs": { "locked": { - "lastModified": 1790533781, - "narHash": "sha256-hzJtu90JIQXnmgxKeP23CAx86G4L+dcQ+GHB1JK04qA=", - "rev": "cf5e76507c6e23b59f7e0ffcc7baa2a39ddd8442", + "lastModified": 1791662279, + "narHash": "sha256-tM6MAMxVwetta6uD2aMzoWQ9v5EAaLLmYumiE4jVZeg=", + "rev": "6fcc160353f63555b560f25588925133c8f61f2a", "type": "tarball", - "url": "https://releases.nixos.org/nixos/26.05/nixos-26.05.10769.cf5e76507c6e/nixexprs.tar.zst" + "url": "https://releases.nixos.org/nixos/26.05/nixos-26.05.11680.6fcc160353f6/nixexprs.tar.zst" }, "original": { "id": "nixpkgs", diff --git a/hosts/nixserve/default.nix b/hosts/nixserve/default.nix index eec65e7..d9884b4 100644 --- a/hosts/nixserve/default.nix +++ b/hosts/nixserve/default.nix @@ -47,8 +47,8 @@ users.groups.media = {}; users.users.jellyfin.extraGroups = [ "media" ]; - networking.firewall.allowedTCPPorts = [ 80 443 /* HTTP */ 111 2049 4000 4001 4002 20048 /* NFS */ 3923 /* copyparty */ 8123 /* Home Assistant (LAN devices, e.g. Cast TTS fetch) */ ]; - networking.firewall.allowedUDPPorts = [ 111 2049 4000 4001 4002 20048 /* NFS */ ]; + networking.firewall.allowedTCPPorts = [ 80 443 /* HTTP */ 111 2049 4000 4001 4002 20048 /* NFS */ 3923 /* copyparty */ 8123 /* Home Assistant (LAN devices, e.g. Cast TTS fetch) */ 8095 /* Music Assistant */ ]; + networking.firewall.allowedUDPPorts = [ 111 2049 4000 4001 4002 20048 /* NFS */ 5353 /* mDNS - Chromecast discovery */ ]; networking.firewall.trustedInterfaces = [ "tailscale0" ]; programs.zsh.enable = true; diff --git a/hosts/nixserve/services.nix b/hosts/nixserve/services.nix index d876a31..77d8914 100644 --- a/hosts/nixserve/services.nix +++ b/hosts/nixserve/services.nix @@ -52,6 +52,17 @@ in services.jellyfin.enable = true; + services.paperless = { + enable = true; + dataDir = "/media/apps/paperless"; + address = "127.0.0.1"; + port = 28981; + domain = "paperless.maybec.at"; + settings = { + PAPERLESS_OCR_LANGUAGE = "eng+swe"; + }; + }; + services.tailscale = { enable = true; openFirewall = true; @@ -313,5 +324,6 @@ virtualHosts."aftersummer.maybec.at" = proxyVhost { upstream = "http://127.0.0. virtualHosts."share.maybec.at" = proxyVhost { upstream = "http://127.0.0.1:8090"; maxBodySize = "10g"; }; virtualHosts."cam.maybec.at" = proxyVhost { upstream = "https://127.0.0.1:8971"; proxySsl = true; }; virtualHosts."home.maybec.at" = proxyVhost { upstream = "http://127.0.0.1:8123"; }; + virtualHosts."paperless.maybec.at" = proxyVhost { upstream = "http://127.0.0.1:28981"; }; }; }