machines/legosi: explicitely only expose xandikos over tailscale

1 files changed, 11 insertions, 3 deletions

diff --git a/machines/profpatsch/legosi.nix b/machines/profpatsch/legosi.nix
index 2159fc15..2c7d4638 100644
--- a/machines/profpatsch/legosi.nix
+++ b/machines/profpatsch/legosi.nix
@@ -17,6 +17,7 @@ let
   qwerkyKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM3ORvMbdHaJfgPgMhWTqgVrP1L7kkvuETQpzl0IjP2G tc@windoof";
 
   xandikosPort = 2345;
+  tailscaleInterface = "tailscale0";
   tailscaleAddress = "100.89.52.54";
 
 in {
@@ -57,9 +58,13 @@ in {
       firewall = {
         allowedTCPPorts = [
           80 443
-          # only binds against tailscale subnet
-          xandikosPort
         ];
+
+        interfaces.${tailscaleInterface} = {
+          allowedTCPPorts = [
+            xandikosPort
+          ];
+        };
       };
 
       interfaces.ens3 = {
@@ -75,7 +80,10 @@ in {
       };
     };
 
-    services.tailscale.enable = true;
+    services.tailscale = {
+      enable = true;
+      interfaceName = tailscaleInterface;
+    };
 
     services.duplicity = {
       enable = true;