Richie/dotfiles
1
0
Fork 0
Code Issues 1 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

feat(networking): migrate host services from ZeroTier to Tailscale
test ebook search / test-ebook-search (pull_request) Successful in 35s
Details
build_systems / build-bob (pull_request) Successful in 52s
Details
build_systems / build-brain (pull_request) Successful in 52s
Details
treefmt / nix fmt (pull_request) Successful in 5s
Details
pytest / pytest (pull_request) Successful in 30s
Details
build_systems / build-rhapsody-in-green (pull_request) Successful in 1m3s
Details
build_systems / build-brain (push) Successful in 35s
Details
build_systems / build-bob (push) Successful in 36s
Details
build_systems / build-jeeves (pull_request) Successful in 2m20s
Details
treefmt / nix fmt (push) Successful in 5s
Details
pytest / pytest (push) Successful in 29s
Details
test ebook search / test-ebook-search (push) Successful in 34s
Details
build_systems / build-rhapsody-in-green (push) Successful in 49s
Details
build_systems / build-jeeves (push) Successful in 2m2s
Details

Browse Source 
- replace legacy IP addresses with Tailscale MagicDNS names
- route Prometheus scraping and exporter firewall access through Tailscale
- wait for Tailscale before starting Prometheus
- restrict service UI ports to the Tailscale interface
- update PostgreSQL and Transmission access rules
- remove Jeeves ZeroTier configuration and Docker host overrides
This commit was merged in pull request #63.
This commit is contained in:
Richie
2026-08-27 12:25:27 -04:00
parent dd51e89abf
commit 7e6908ef3d
14 changed files with 34 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files
common/optional/monitoring-agent.nix
+1 -1
View File
@@ -5,7 +5,7 @@
...
}:
let
monitoringInterface = "ztwfunumly";
monitoringInterface = "tailscale0";
nodeTextfileDir = "/var/lib/prometheus-node-exporter-textfile";
mkProcessNameTemplate =
python/ebook_search/config.py
+2 -2
View File
@@ -37,7 +37,7 @@ class RerankConfig(BaseSettings):
model_config = SettingsConfigDict(env_prefix="EBOOK_SEARCH_RERANK_", frozen=True, protected_namespaces=())
enabled: bool = True
base_url: str = "http://192.168.90.25:8001"
base_url: str = "http://bob:8001"
model: str = "qwen3-reranker-06b"
candidates: int = 24
timeout_seconds: float = 30.0
@@ -67,7 +67,7 @@ class EbookSearchConfig(BaseSettings):
)
chat_model: str = "deepseek-v4-flash"
answer_enabled: bool = True
embedding_base_url: str = "http://192.168.90.25:8000/v1"
embedding_base_url: str = "http://bob:8000/v1"
embedding_api_key: str = "not-needed"
embedding_model: str = "qwen3-embedding-0.6b"
embedding_batch_size: int = 32
python/ebook_search/docker/docker-compose.yml
-2
View File
@@ -9,8 +9,6 @@ services:
restart: unless-stopped
ports:
- "${EBOOK_SEARCH_PORT:-8070}:8070"
extra_hosts:
- "jeeves:192.168.90.40"
env_file:
- ../../../.env
environment:
systems/brain/services/home_assistant.nix
+1 -1
View File
@@ -86,7 +86,7 @@
esphome = {
enable = true;
openFirewall = true;
address = "192.168.90.35";
address = "0.0.0.0";
};
};
}
systems/brain/services/postgress.nix
+2 -2
View File
@@ -19,7 +19,7 @@
local all richie trust
host all richie 127.0.0.1/32 trust
host all richie ::1/128 trust
host all richie 192.168.90.1/24 trust
host all richie 100.64.0.0/10 trust
host all richie 192.168.99.1/24 trust
local vaninventory vaninventory trust
@@ -28,7 +28,7 @@
local hass hass trust
# ipv4
host hass hass 192.168.90.1/24 trust
host hass hass 100.64.0.0/10 trust
host hass hass 127.0.0.1/32 trust
# ipv6
systems/brain/syncthing.nix
+1 -1
View File
@@ -3,7 +3,7 @@
services.syncthing = {
overrideFolders = false;
guiAddress = "192.168.90.35:8384";
guiAddress = "0.0.0.0:8384";
settings = {
"dotfiles" = {
path = "/home/richie/dotfiles";
systems/jeeves/monitoring/default.nix
+12 -10
View File
@@ -41,29 +41,29 @@ let
{
job_name = "node";
static_configs = [
(mkTarget "jeeves" "192.168.90.40:9100")
(mkTarget "bob" "192.168.90.25:9100")
(mkTarget "jeeves" "jeeves.taile39c31.ts.net:9100")
(mkTarget "bob" "bob.taile39c31.ts.net:9100")
];
}
{
job_name = "process_grouped";
static_configs = [
(mkTarget "jeeves" "192.168.90.40:9256")
(mkTarget "bob" "192.168.90.25:9256")
(mkTarget "jeeves" "jeeves.taile39c31.ts.net:9256")
(mkTarget "bob" "bob.taile39c31.ts.net:9256")
];
}
{
job_name = "smartctl";
static_configs = [
(mkTarget "jeeves" "192.168.90.40:9633")
(mkTarget "bob" "192.168.90.25:9633")
(mkTarget "jeeves" "jeeves.taile39c31.ts.net:9633")
(mkTarget "bob" "bob.taile39c31.ts.net:9633")
];
}
{
job_name = "zfs";
static_configs = [
(mkTarget "jeeves" "192.168.90.40:9134")
(mkTarget "bob" "192.168.90.25:9134")
(mkTarget "jeeves" "jeeves.taile39c31.ts.net:9134")
(mkTarget "bob" "bob.taile39c31.ts.net:9134")
];
}
];
@@ -79,8 +79,8 @@ let
{
job_name = "process_pid";
static_configs = [
(mkTarget "jeeves" "192.168.90.40:9257")
(mkTarget "bob" "192.168.90.25:9257")
(mkTarget "jeeves" "jeeves.taile39c31.ts.net:9257")
(mkTarget "bob" "bob.taile39c31.ts.net:9257")
];
}
];
@@ -97,7 +97,9 @@ let
after = [
"zfs-media-database-prometheus.mount"
"network.target"
"tailscaled-autoconnect.service"
];
wants = [ "tailscaled-autoconnect.service" ];
requires = [ "zfs-media-database-prometheus.mount" ];
wantedBy = [ "multi-user.target" ];
unitConfig.RequiresMountsFor = [ dataDir ];
systems/jeeves/services/grafana.nix
+2 -2
View File
@@ -19,9 +19,9 @@ in
secret_key = "$__file{${vars.secrets}/services/grafana/secret_key}";
};
server = {
http_addr = "192.168.90.40";
http_addr = "0.0.0.0";
http_port = 3000;
root_url = "http://192.168.90.40:3000/";
root_url = "http://jeeves:3000/";
};
};
provision = {
systems/jeeves/services/postgress.nix
+3 -3
View File
@@ -27,7 +27,7 @@ in
local all richie trust
host all richie 127.0.0.1/32 trust
host all richie ::1/128 trust
host all richie 192.168.90.1/24 trust
host all richie 100.64.0.0/10 trust
host all richie 192.168.99.1/24 trust
host all richie 172.16.0.0/12 trust
@@ -42,12 +42,12 @@ in
local postgres math trust
host postgres math 127.0.0.1/32 trust
host postgres math ::1/128 trust
host postgres math 192.168.90.1/24 trust
host postgres math 100.64.0.0/10 trust
local data_science_dev math trust
host data_science_dev math 127.0.0.1/32 trust
host data_science_dev math ::1/128 trust
host data_science_dev math 192.168.90.1/24 trust
host data_science_dev math 100.64.0.0/10 trust
'';
identMap = ''
systems/jeeves/services/transmission.nix
+2 -2
View File
@@ -21,11 +21,11 @@ in
message-level = 3;
peer-port = 51413;
rpc-bind-address = "0.0.0.0";
rpc-host-whitelist = "127.0.0.1,192.168.90.40";
rpc-host-whitelist = "127.0.0.1,jeeves,jeeves.taile39c31.ts.net";
rpc-host-whitelist-enabled = true;
rpc-port = 9091;
rpc-whitelist-enabled = true;
rpc-whitelist = "127.0.0.1,192.168.90.49";
rpc-whitelist = "127.0.0.1,100.*.*.*";
seed-queue-enabled = false;
};
};
systems/jeeves/syncthing.nix
+2 -2
View File
@@ -2,11 +2,11 @@ let
vars = import ./vars.nix;
in
{
networking.firewall.allowedTCPPorts = [ 8384 ];
networking.firewall.interfaces.tailscale0.allowedTCPPorts = [ 8384 ];
services.syncthing = {
overrideFolders = false;
guiAddress = "192.168.90.40:8384";
guiAddress = "0.0.0.0:8384";
settings = {
devices.davids-server.id = "7GXTDGR-AOXFW2O-K6J7NM3-XYZNRRW-AKHAFWM-GBOWUPQ-OA6JIWD-ER7RDQL"; # cspell:disable-line
folders = {
tests/ebook_search/test_rerank.py
+1 -1
View File
@@ -51,7 +51,7 @@ def test_config_defaults_enable_reranking(mocker: MockerFixture) -> None:
config = load_rerank_config()
assert config.enabled is True
assert config.base_url == "http://192.168.90.25:8001"
assert config.base_url == "http://bob:8001"
assert config.model == "qwen3-reranker-06b"
assert config.candidates == 24
assert config.timeout_seconds == 30
users/richie/home/gui/vscode/settings.json
+1 -1
View File
@@ -35,7 +35,7 @@
"sqltools.connections": [
{
"previewLimit": 50,
"server": "192.168.90.40",
"server": "jeeves.taile39c31.ts.net",
"port": 5432,
"askForPassword": true,
"driver": "PostgreSQL",
users/richie/home/ssh_config.nix
+4 -4
View File
@@ -4,7 +4,7 @@
enableDefaultConfig = false;
settings = {
jeeves = {
HostName = "192.168.90.40";
HostName = "jeeves";
User = "richie";
IdentityFile = "~/.ssh/id_ed25519";
Port = 629;
@@ -18,7 +18,7 @@
Port = 2222;
};
brain = {
HostName = "192.168.90.35";
HostName = "brain";
User = "richie";
IdentityFile = "~/.ssh/id_ed25519";
Port = 129;
@@ -31,14 +31,14 @@
Port = 2222;
};
bob = {
HostName = "192.168.90.25";
HostName = "bob";
User = "richie";
IdentityFile = "~/.ssh/id_ed25519";
Port = 262;
DynamicForward = [ { port = 9050; } ];
};
rhapsody-in-green = {
HostName = "192.168.90.221";
HostName = "rhapsody-in-green";
User = "richie";
IdentityFile = "~/.ssh/id_ed25519";
Port = 922;