Skip to content

update vhosts to correct addresses #13

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
DarthPJB merged 9 commits into from
Jul 31, 2026
Merged

update vhosts to correct addresses #13

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
feb6923
update vhosts to correct addresses
Jul 29, 2026
0466d97
update site
Jul 29, 2026
90848d8
correct vhosts
Jul 29, 2026
a96330a
update website and post live version
Jul 29, 2026
b4bf1cf
correct builder capabilitites
Jul 30, 2026
a2ec570
update website
Jul 30, 2026
fdd3414
feat: add Malayalam (cluster-box) as flake input — verbatim passthrough
Jul 30, 2026
0eb24b7
fix: use extendModules to override nixinate args for WireGuard deploy…
Jul 30, 2026
a30e942
fix: nixpkgs-fmt formatting for cluster-box extendModules block
Jul 31, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
43 changes: 43 additions & 0 deletions documentation/remote-worker-networking.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,43 @@
# Remote-Worker Network Configuration

## IP Addressing

| Interface | IP | Purpose |
|---|---|---|
| `ens3` | `10.0.1.42/26` | WAN (actual interface) |
| `wireg0` | `10.88.127.50/32` | WireGuard |
| `lo` | `127.0.0.1` | Loopback |

## NAT Mapping

The public IP `193.16.42.101` is **not assigned** to any interface on remote-worker.
It is NAT-forwarded to `10.0.1.42` (ens3) by the upstream provider.

**Nginx must bind to `10.0.1.42`, not `193.16.42.101`.**
Binding to the public IP fails with `Cannot assign requested address` (errno 99)
and crashes the entire nginx service — taking down all vhosts including WireGuard.

All nginx listen addresses use the internal WAN IP `10.0.1.42` with a comment
noting the external NAT mapping.

## Split-Horizon DNS

`johnbargman.com` uses split-horizon via cortex-alpha DNS:

- **Internal (LAN/WG)**: resolves to `10.88.127.50` (remote-worker WG) → staging site
- **External**: resolves via public DNS to `193.16.42.101` → NAT → `10.0.1.42` → release site

DNS entry defined in `topology/cortex-alpha.nix` under `dns.static`.

## Nginx VHosts

| VHost | Listen Addresses | Source |
|---|---|---|
| `default` (fallthrough) | `0.0.0.0` | `default.nix` |
| `johnbargman.net` | `10.0.1.42`, `10.88.127.50` | `default.nix` |
| `johnbargman.com` (release) | `10.0.1.42` | `default.nix` |
| `johnbargman.com-lan` (staging) | `10.88.127.50` | `default.nix` |
| `csfinancialconsulting.com` | `10.0.1.42` | `flake.nix` |
| `csfincon.us` | `10.0.1.42` | `flake.nix` |
| `nextcloud.johnbargman.net` | `10.0.1.42`, `10.88.127.50` | `nextcloud.nix` |
| `nextcloud.johnbargman.com` | `10.0.1.42`, `10.88.127.50` | `nextcloud.nix` |
Loading
Loading