From 000000f0c5c32cc71ed9f002498de2fffa310257 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Thu, 25 May 2023 22:18:21 +0200
Subject: [PATCH] pipebert: block websites outside of hq

---
 hosts/pipebert/default.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/hosts/pipebert/default.nix b/hosts/pipebert/default.nix
index 7246f6aa..ed997d6f 100644
--- a/hosts/pipebert/default.nix
+++ b/hosts/pipebert/default.nix
@@ -1,4 +1,4 @@
-{ config, lib, pkgs, ... }:
+{ config, lib, libC, pkgs, ... }:
 
 {
   imports = [
@@ -82,7 +82,7 @@
               proxy_set_header X-Scheme $scheme;
               proxy_set_header Accept-Encoding identity;
               client_max_body_size 200M;
-            '';
+            '' + libC.hqNetworkOnly;
           };
           # locations."/cam/stream" = {
           #   proxyPass = "http://localhost:3020/?action=stream";
@@ -104,6 +104,7 @@
           locations."/" = {
             proxyPass = "http://127.0.0.1:8888/";
             proxyWebsockets = true;
+            extraConfig = libC.hqNetworkOnly;
           };
         };
         "mopidy.hq.c3d2.de" = {
@@ -112,6 +113,7 @@
           locations."/" = {
             proxyPass = "http://127.0.0.1:6680";
             proxyWebsockets = true;
+            extraConfig = libC.hqNetworkOnly;
           };
         };
         "pipebert.hq.c3d2.de" = {