greg/nixos
1
0
Fork 2
Code Issues Pull Requests 3 Actions Packages Projects Releases Wiki Activity

fix: disable Grafana enforce_domain to allow LAN proxy access
buildbot/nix-eval Build done. (1 warning)
Details
buildbot/nix-build Build done.
Details

Browse Source 
With enforce_domain = true, Grafana redirects any request not matching
the configured domain (hosea.shire-zebra.ts.net) back to that hostname.
Since the nginx proxy serves Grafana at grafana.thehellings.lan, every
proxied request gets redirected to the Tailscale address, making the
proxy useless for non-Tailscale clients.

The domain setting is still correct for cookie scoping; enforce_domain
is only needed if direct port access is a concern, which is mitigated
by the firewall (port 3001 is not open on the LAN).
This commit is contained in:
root
2026-03-25 17:40:38 -05:00
parent ffff7e9683
commit 053e383046
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hosts/unstable/hosea/default.nix
+1 -1
View File
@@ -135,7 +135,7 @@ in
security.secret_key = "$__file{${config.age.secrets.grafana-secret-key.path}}"; security.secret_key = "$__file{${config.age.secrets.grafana-secret-key.path}}";
server = { server = {
domain = "${config.networking.hostName}.shire-zebra.ts.net"; domain = "${config.networking.hostName}.shire-zebra.ts.net";
enforce_domain = true; enforce_domain = false;
http_addr = "0.0.0.0"; http_addr = "0.0.0.0";
enable_gzip = true; enable_gzip = true;
http_port = 3001; http_port = 3001;