ulve/nixos-dotfiles
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Compare commits

base: ulve/nixos-dotfiles:ff0b2efa06aa7d7f699773e440494df32bf65236
Branches Tags
ulve/nixos-dotfiles:master
...
compare: ulve/nixos-dotfiles:master
Branches Tags
ulve/nixos-dotfiles:master
4 Commits
ff0b2efa06 ... master
Author SHA1 Message Date
ulveandClaude Sonnet 5 5324b5472c nixserve: stop Tailscale from hijacking DNS resolution 
Tailscale's stub resolver (100.100.100.100) intermittently times out
or SERVFAILs under bursty concurrent lookups (a known upstream issue,
e.g. tailscale/tailscale#6850, #10768, #8829), which was breaking HACS
updates in the Home Assistant container (network_mode: host, so it
inherits nixserve's own resolv.conf). Point nixserve at the local
Pi-hole instead and disable Tailscale's accept-dns so it can't
override it.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
 2026-10-24 14:48:48 +02:00
ulveandClaude Sonnet 5 7ac086a420 Bump flake inputs (herdr, home-manager, nixpkgs) 
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
 2026-10-24 14:48:48 +02:00
ulve ba18336430 Added port for chromecast playback 2026-10-12 09:19:37 +02:00
ulve 1550e333e0 nixserve: open Music Assistant/mDNS ports, add paperless service, bump flake inputs 
Allow TCP 8095 (Music Assistant web UI) and UDP 5353 (mDNS) through the
firewall so the LAN interface can reach it and Chromecast discovery works;
previously only the trusted tailscale0 interface had access.
 2026-10-12 09:08:52 +02:00
3 changed files with 35 additions and 12 deletions
Expand all files Collapse all files
flake.lock
Generated
+10 -10
View File
@@ -8,11 +8,11 @@
"rust-overlay": "rust-overlay"
},
"locked": {
"lastModified": 1790642832,
"narHash": "sha256-dhAifTJeh8sfK0s/KzUZIo1qHlv+AFit3HOyCT+QC5E=",
"lastModified": 1792105523,
"narHash": "sha256-DGj+1Z+3zHwyi+Wh6SQqY1ya9kUElF1xVNg3V054X0s=",
"owner": "ogulcancelik",
"repo": "herdr",
"rev": "9dc3a1df2b563df0637264fc0dffcd607c324ac5",
"rev": "143bf5fd4781d164260c63fe28e7dc08054ad32f",
"type": "github"
},
"original": {
@@ -28,11 +28,11 @@
]
},
"locked": {
"lastModified": 1790215976,
"narHash": "sha256-VkR1rMGyjU9jtw8ISFx5uqR9e+LEaOlhHwrseFkiIVk=",
"lastModified": 1792438572,
"narHash": "sha256-5mQQOcggBRBXB7NlzUxO0dbvQN4euJOISjNybrtfxPk=",
"owner": "nix-community",
"repo": "home-manager",
"rev": "a6631107a83ceab5872f298a2ea710859c80c4cb",
"rev": "24f8f8e786f87d6a818e1746cb2389bf922afdab",
"type": "github"
},
"original": {
@@ -44,11 +44,11 @@
},
"nixpkgs": {
"locked": {
"lastModified": 1790533781,
"narHash": "sha256-hzJtu90JIQXnmgxKeP23CAx86G4L+dcQ+GHB1JK04qA=",
"rev": "cf5e76507c6e23b59f7e0ffcc7baa2a39ddd8442",
"lastModified": 1792503283,
"narHash": "sha256-OtQ9jaQ9aXZDm61TqykPLZdXJa2NMykYG3d0tbT683U=",
"rev": "cd4ea8d57de16f4810bc5f14207bac45fbf19f67",
"type": "tarball",
"url": "https://releases.nixos.org/nixos/26.05/nixos-26.05.10769.cf5e76507c6e/nixexprs.tar.zst"
"url": "https://releases.nixos.org/nixos/26.05/nixos-26.05.12297.cd4ea8d57de1/nixexprs.tar.zst"
},
"original": {
"id": "nixpkgs",
hosts/nixserve/default.nix
+7 -2
View File
@@ -9,6 +9,11 @@
networking.hostName = "nixserve";
networking.hostId = "941b956b";
networking.networkmanager.enable = true;
# nixserve's own DNS lookups (e.g. HACS/docker pulls) go to the local Pi-hole
# first instead of detouring through Tailscale's DNS proxy -> home router,
# which was timing out under HACS's bursty concurrent lookups. Tailscale's
# MagicDNS resolver (100.100.100.100) stays as a fallback nameserver.
networking.nameservers = [ "127.0.0.1" ];
boot.supportedFilesystems = [ "zfs" ];
boot.zfs.forceImportRoot = false;
@@ -47,8 +52,8 @@
users.groups.media = {};
users.users.jellyfin.extraGroups = [ "media" ];
networking.firewall.allowedTCPPorts = [ 80 443 /* HTTP */ 111 2049 4000 4001 4002 20048 /* NFS */ 3923 /* copyparty */ 8123 /* Home Assistant (LAN devices, e.g. Cast TTS fetch) */ ];
networking.firewall.allowedUDPPorts = [ 111 2049 4000 4001 4002 20048 /* NFS */ ];
networking.firewall.allowedTCPPorts = [ 80 443 /* HTTP */ 111 2049 4000 4001 4002 20048 /* NFS */ 3923 /* copyparty */ 8123 /* Home Assistant (LAN devices, e.g. Cast TTS fetch) */ 8095 8097 /* Music Assistant (web UI + stream server) */ ];
networking.firewall.allowedUDPPorts = [ 111 2049 4000 4001 4002 20048 /* NFS */ 5353 /* mDNS - Chromecast discovery */ ];
networking.firewall.trustedInterfaces = [ "tailscale0" ];
programs.zsh.enable = true;
hosts/nixserve/services.nix
+18
View File
@@ -52,10 +52,27 @@ in
services.jellyfin.enable = true;
services.paperless = {
enable = true;
dataDir = "/media/apps/paperless";
address = "127.0.0.1";
port = 28981;
domain = "paperless.maybec.at";
settings = {
PAPERLESS_OCR_LANGUAGE = "eng+swe";
};
};
services.tailscale = {
enable = true;
openFirewall = true;
useRoutingFeatures = "server";
# Don't let Tailscale take over nixserve's own DNS resolution: its stub
# resolver (100.100.100.100) intermittently times out under bursty lookups
# (a known upstream issue, e.g. tailscale/tailscale#6850, #10768, #8829),
# which broke HACS updates. nixserve resolves via local Pi-hole instead
# (see networking.nameservers in hosts/nixserve/default.nix).
extraSetFlags = [ "--accept-dns=false" ];
};
services.syncthing = {
@@ -313,5 +330,6 @@ virtualHosts."aftersummer.maybec.at" = proxyVhost { upstream = "http://127.0.0.
virtualHosts."share.maybec.at" = proxyVhost { upstream = "http://127.0.0.1:8090"; maxBodySize = "10g"; };
virtualHosts."cam.maybec.at" = proxyVhost { upstream = "https://127.0.0.1:8971"; proxySsl = true; };
virtualHosts."home.maybec.at" = proxyVhost { upstream = "http://127.0.0.1:8123"; };
virtualHosts."paperless.maybec.at" = proxyVhost { upstream = "http://127.0.0.1:28981"; };
};
}