some fixes

.justfile

@@ -2,3 +2,6 @@
 try-again:
     nix flake update amarth-customer-portal
     nix flake check --all-systems --show-trace
+
+update machine:
+    nixos-rebuild switch --use-remote-sudo --target-host {{ machine }} --flake .#{{ machine }}

modules/nixos/services/authentication/zitadel/default.nix

@@ -117,12 +117,12 @@ in
         enable = true;
         virtualHosts = {
           "auth.kruining.eu".extraConfig = ''
-            reverse_proxy h2c://127.0.0.1:9092
+            reverse_proxy h2c://::1:9092
           '';
         };
         extraConfig = ''
-          (auth-z) {
-            forward_auth h2c://127.0.0.1:9092 {
+          (auth) {
+            forward_auth h2c://::1:9092 {
               uri /api/authz/forward-auth
               copy_headers Remote-User Remote-Groups Remote-Email Remote-Name
             }
@@ -131,6 +131,8 @@ in
       };
     };
       
+    networking.firewall.allowedTCPPorts = [ 80 443 ];
+
     # Secrets
     sops.secrets."zitadel/masterKey" = {
       owner = "zitadel";

modules/nixos/services/observability/loki/default.nix

@@ -23,7 +23,7 @@ in
         common = {
           ring = {
             instance_addr = "127.0.0.1";
-            kvstore.store = "inmmemory";
+            kvstore.store = "inmemory";
           };
           replication_factor = 1;
           path_prefix = "/tmp/loki";

modules/nixos/services/observability/promtail/default.nix

@@ -29,9 +29,11 @@ in
           filename = "filename";
         };
 
-        clients = {
-          url = "http://127.0.0.1:3100/loki/api/v1/push";
-        };
+        clients = [
+          {
+            url = "http://::1:9003/loki/api/v1/push";
+          }
+        ];
 
         scrape_configs = [
           {

systems/x86_64-linux/ulmo/default.nix

@@ -25,9 +25,20 @@
     };
   };
 
+  # Expose amarht cloud stuff like this until I have a proper solution
+  services.caddy.virtualHosts = {
+    "auth.amarth.cloud".extraConfig = ''
+      reverse_proxy http://192.168.1.223:9092
+    '';
+
+    "amarth.cloud".extraConfig = ''
+      reverse_proxy http://192.168.1.223:8080
+    '';
+  };
+
   sneeuwvlok = {
     services = {
-      authentication.authelia.enable = true;
+      # authentication.authelia.enable = true;
       authentication.zitadel.enable = true;
 
       communication.matrix.enable = true;