Ponyo as media proxy

machines/ponyo/configuration.nix

@@ -22,6 +22,21 @@
 
   services.zerotierone.enable = true;
 
+  services.nginx.enable = true;
+  services.nginx.virtualHosts."jellyfin.neet.cloud" = {
+    enableACME = true;
+    forceSSL = true;
+    locations."/" = {
+      proxyPass = "http://s0.zt.neet.dev:8096";
+      proxyWebsockets = true;
+    };
+  };
+  services.nginx.virtualHosts."navidrome.neet.cloud" = {
+    enableACME = true;
+    forceSSL = true;
+    locations."/".proxyPass = "http://s0.zt.neet.dev:4533";
+  };
+
   security.acme.acceptTerms = true;
   security.acme.email = "zuckerberg@neet.dev";
 }

machines/storage/s0/configuration.nix

@@ -37,11 +37,12 @@
   services.navidrome = {
     enable = true;
     settings = {
-      Address = "127.0.0.1";
+      Address = "0.0.0.0";
       Port = 4533;
       MusicFolder = "/data/samba/Public/Plex/Music";
     };
   };
+  networking.firewall.allowedTCPPorts = [ config.services.navidrome.settings.Port ];
 
   users.users.${config.services.jellyfin.user}.extraGroups = [ "public_data" ];
   users.users.googlebot.extraGroups = [ "transmission" ];
@@ -144,17 +145,6 @@
     proxyWebsockets = true;
   };
 
-  # navidrome over cloudflare
-  services.cloudflared = {
-    enable = true;
-    config = {
-      url = config.services.nginx.virtualHosts."music.s0".locations."/".proxyPass;
-      tunnel = "5975c2f1-d1f4-496a-a704-6d89ccccae0d";
-      credentials-file = "/run/agenix/cloudflared-navidrome.json";
-    };
-  };
-  age.secrets."cloudflared-navidrome.json".file = ../../../secrets/cloudflared-navidrome.json.age;
-
   nixpkgs.overlays = [
     (final: prev: {
       radarr = prev.radarr.overrideAttrs (old: rec {