feat: glance test

modules/nixos/services/glance/default.nix

@@ -30,8 +30,18 @@ in
       virtualHosts = {
         "${configHelpers.host}" = {
           extraConfig = ''
-            reverse_proxy ${configHelpers.localhost}:${toString configHelpers.service.ports.port0}
+            @allowed_ips {
+              remote_ip ${mars.wireguard.ip0} ${deimos.wireguard.ip0}
+            }
 
+            handle @allowed_ips {
+              redir /.well-known/carddav /remote.php/dav/ 301
+              redir /.well-known/caldav /remote.php/dav/ 301
+              reverse_proxy ${ceres.wireguard.ip0}:${toString configHelpers.service.ports.port0}
+            }
+            handle {
+              respond "Access Denied" 403
+            }
             tls ${configHelpers.service.ssl.cert} ${configHelpers.service.ssl.key}
           '';
         };
@@ -64,7 +74,7 @@ in
 
   networking = {
     firewall = {
-      allowedTCPPorts = [
+      interfaces.wg0.allowedTCPPorts = [
         configHelpers.service.ports.port0
       ];
     };

systems/ceres/config/wireguard.nix

@@ -16,10 +16,6 @@ in
         service.ports.port0
         service.ports.port1
       ];
-      interfaces.wg0.allowedTCPPorts = [
-        searx.ports.port0
-        glance.ports.port0
-      ];
     };
 
     nat = {

systems/deimos/config/wireguard.nix

@@ -8,7 +8,10 @@ in
 {
   networking = {
     hosts = {
-      ${ceres.wireguard.ip0} = [ instances.searx.domains.url0 ];
+      ${ceres.wireguard.ip0} = [
+        instances.searx.domains.url0
+        instances.glance.domains.url0
+      ];
     };
     wireguard.interfaces = {
       wg0 = {