feat(portal): move edge proxy services from Jeeves

- move HAProxy and ACME certificate management to Portal - route application backends to Jeeves over Tailscale - restrict Jeeves backend ports to the Tailscale interface - expose Gems for remote proxy access
2026-08-26 07:33:31 -04:00
parent 8245d0f82e
commit 7f08a6f788
11 changed files with 28 additions and 31 deletions
@@ -17,6 +17,15 @@
        allowedTCPPorts = [ ];
        allowedUDPPorts = [ ];
      };
+      interfaces.tailscale0.allowedTCPPorts = [
+        5000 # Nix binary cache
+        6443 # Gitea HTTP
+        8000 # Audiobookshelf
+        8001 # Norn Sight
+        8002 # Gems
+        8091 # Share
+        8096 # Jellyfin HTTP
+      ];
      allowedTCPPorts = [
        8070
      ];