Fix nginx security

common/etc/ssh/ssh_config

@@ -7,7 +7,7 @@ AddKeysToAgent yes
 ExitOnForwardFailure yes
 Host pve
   HostName pve.strypsteen.com
-Host
+Host infra
   HostName infra.server.home.arpa
 Host home
   HostName home.server.home.arpa

container-config/nginx-home/code

@@ -3,9 +3,8 @@ server {
   server_name *.code-proxy.strypsteen.com;
   listen 443 ssl;
   listen [::]:443 ssl;
-  deny 10.0.0.1;
-  deny fd00::1;
   include snippets/headers.conf;
+  include snippets/local-only.conf;
   location / {
     set $upstream sandbox.server.home.arpa;
     proxy_pass http://$upstream:8080;

container-config/nginx-home/llm

@@ -2,9 +2,8 @@ server {
   server_name llm.strypsteen.com;
   listen 443 ssl;
   listen [::]:443 ssl;
-  deny 10.0.0.1;
-  deny fd00::1;
   include snippets/headers.conf;
+  include snippets/local-only.conf;
   location / {
     set $upstream home.server.home.arpa;
     proxy_pass http://$upstream:8004;

container-config/nginx-home/monitoring

@@ -2,9 +2,8 @@ server {
   server_name monitoring.strypsteen.com;
   listen 443 ssl;
   listen [::]:443 ssl;
-  deny 10.0.0.1;
-  deny fd00::1;
   include snippets/headers.conf;
+  include snippets/local-only.conf;
   location / {
     set $upstream home.server.home.arpa;
     proxy_pass http://$upstream:8008;

container-config/nginx-home/network

@@ -2,9 +2,8 @@ server {
   server_name network.strypsteen.com;
   listen 443 ssl;
   listen [::]:443 ssl;
-  deny 10.0.0.1;
-  deny fd00::1;
   include snippets/headers.conf;
+  include snippets/local-only.conf;
   add_header Content-Security-Policy "default-src 'self'; style-src 'self' 'unsafe-inline'" always;
   location / {
     set $upstream home.server.home.arpa;

container-config/nginx-home/remote-desktop

@@ -2,9 +2,8 @@ server {
   server_name remote-desktop.strypsteen.com;
   listen 443 ssl;
   listen [::]:443 ssl;
-  deny 10.0.0.1;
-  deny fd00::1;
   include snippets/headers.conf;
+  include snippets/local-only.conf;
   add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'" always;
   location / {
     set $upstream gaming-vm.server.home.arpa;

container-config/nginx/snippets/local-only.conf

@@ -0,0 +1,4 @@
+allow 192.168.0.0/16;
+allow fe80::/10;
+allow fc00::/7;
+deny all;

home/etc/containers/systemd/certbot.container.d/override.conf

@@ -1,3 +0,0 @@
-[Container]
-Environment=CERTBOT_TYPE=home
-Secret=cloudflare

home/etc/containers/systemd/forgejo.container

@@ -7,7 +7,7 @@ Secret=forgejo-token
 Secret=forgejo-jwt-secret
 Environment=GITEA_APP_INI=/etc/gitea/app.ini
 PublishPort=2222:2222
-PublishPort=8003:80
+PublishPort=8003:3000
 AutoUpdate=registry
 [Install]
 WantedBy=multi-user.target

home/etc/containers/systemd/nginx.container

@@ -1,15 +0,0 @@
-[Container]
-Image=cgr.dev/chainguard/nginx
-Network=nginx.network
-Volume=/var/lib/system-config/container-config/nginx:/etc/nginx:z,ro
-Volume=/var/lib/system-config/container-config/nginx-home:/etc/nginx-sites:z,ro
-Volume=/var/lib/system-config/container-config/site:/var/www:z,ro
-Volume=/etc/certificates:/etc/certificates:z,ro
-Tmpfs=/var/lib/nginx/tmp
-Tmpfs=/var/lib/nginx/logs
-PublishPort=80:80
-PublishPort=443:443
-Sysctl=net.ipv4.ip_unprivileged_port_start=80
-AutoUpdate=registry
-[Install]
-WantedBy=multi-user.target