From 998d0dca2f0e55e11cd7993b23a668320d969f2b Mon Sep 17 00:00:00 2001 From: Vuong Hoang Date: Thu, 8 Oct 2026 13:31:34 -0700 Subject: [PATCH] feat(nh3-svos): SVOS front door also on the LAN (10.100.50.43); internal DNS points svos names at it --- configs/svos-front/Caddyfile | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/configs/svos-front/Caddyfile b/configs/svos-front/Caddyfile index 984aab0..663e446 100644 --- a/configs/svos-front/Caddyfile +++ b/configs/svos-front/Caddyfile @@ -1,5 +1,7 @@ # SVOS front door on nh3-svos (eshpfi configs/svos-front/), 2026-10-05. Prime: mesh-only, svos.phasefinal.com. -# - Listens ONLY on the tailnet address (100.64.0.9:443). There is no LAN or internet listener and no :80 redirect server. +# - Listens on the tailnet address (100.64.0.9:443) AND, since 2026-10-08 (Prime: "serve it on the LAN too"), on the +# LAN address (10.100.50.43:443), so non-mesh internal clients work; the internal AdGuards answer 10.100.50.43, the +# headscale MagicDNS records still answer 100.64.0.9. No internet listener and no :80 redirect server. # - Cert: Let's Encrypt via Cloudflare DNS-01 with a phasefinal.com-only token (env CF_API_TOKEN, /etc/caddy/env). # - Identity: HTTP Basic auth (Prime 2026-10-05: "Basic auth is fine, saved in browser is fine"; mesh-only because we # don't host externally). One account, `Vuong` (Prime is how SVOS addresses him). argon2id hash in @@ -28,7 +30,7 @@ } https://svos.phasefinal.com:443 { - bind 100.64.0.9 + bind 100.64.0.9 10.100.50.43 tls { dns cloudflare {env.CF_API_TOKEN} resolvers 1.1.1.1 8.8.8.8 @@ -130,7 +132,7 @@ https://svos.phasefinal.com:443 { } https://svos-terminal.phasefinal.com:443 { - bind 100.64.0.9 + bind 100.64.0.9 10.100.50.43 tls { dns cloudflare {env.CF_API_TOKEN} resolvers 1.1.1.1 8.8.8.8 @@ -150,7 +152,7 @@ https://svos-terminal.phasefinal.com:443 { # The kernel's signed calls come from the box itself (its source on the mesh address); anything else is refused. @not_from_box { path /verbs/* /health - not remote_ip 100.64.0.9 127.0.0.1 + not remote_ip 100.64.0.9 10.100.50.43 127.0.0.1 } handle @not_from_box { respond 403