From 053e383046ce8451140f5f06ec44265d214506d4 Mon Sep 17 00:00:00 2001 From: root Date: Wed, 25 Mar 2026 17:40:38 -0500 Subject: [PATCH] fix: disable Grafana enforce_domain to allow LAN proxy access With enforce_domain = true, Grafana redirects any request not matching the configured domain (hosea.shire-zebra.ts.net) back to that hostname. Since the nginx proxy serves Grafana at grafana.thehellings.lan, every proxied request gets redirected to the Tailscale address, making the proxy useless for non-Tailscale clients. The domain setting is still correct for cookie scoping; enforce_domain is only needed if direct port access is a concern, which is mitigated by the firewall (port 3001 is not open on the LAN). --- hosts/unstable/hosea/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hosts/unstable/hosea/default.nix b/hosts/unstable/hosea/default.nix index 1b8593f..624b7aa 100644 --- a/hosts/unstable/hosea/default.nix +++ b/hosts/unstable/hosea/default.nix @@ -135,7 +135,7 @@ in security.secret_key = "$__file{${config.age.secrets.grafana-secret-key.path}}"; server = { domain = "${config.networking.hostName}.shire-zebra.ts.net"; - enforce_domain = true; + enforce_domain = false; http_addr = "0.0.0.0"; enable_gzip = true; http_port = 3001;