.git was corrupted on the machine i worked on these many commits. so here it is all at once :P

2 files changed, 30 insertions, 4 deletions

diff --git a/playbooks/roles/outbound/templates/headscale/config/acl.json b/playbooks/roles/outbound/templates/headscale/config/acl.json
index 449207d..242d01e 100644
--- a/playbooks/roles/outbound/templates/headscale/config/acl.json
+++ b/playbooks/roles/outbound/templates/headscale/config/acl.json
@@ -1,17 +1,24 @@
 {
   "groups": {
-    "group:internal": ["liz{{ oauth_user_suffix }}", "lucina{{ oauth_user_suffix }}", "riley{{ oauth_user_suffix }}"],
+    "group:coffee_admins": ["liz{{ oauth_user_suffix }}", "lucina{{ oauth_user_suffix }}"],
   },
   "acls": [
+{% for user in ["liz", "lucina", "riley"] %}
+    {
+      "action": "accept",
+      "src": ["{{ user }}{{ oauth_user_suffix }}"],
+      "dst": ["{{ user }}{{ oauth_user_suffix }}:*"]
+    },
+{% endfor %}
     {
       "action": "accept",
       "src": ["{{ auth_key_user }}"],
-      "dst": ["{{ auth_key_user }}:*", "10.0.0.0/8:*"]
+      "dst": ["{{ auth_key_user }}:*", "{{ loadbalancer_ip }}/32:*"]
     },
     {
       "action": "accept",
-      "src": ["group:internal"],
-      "dst": ["10.0.0.0/8:*"]
+      "src": ["group:coffee_admins"],
+      "dst": ["{{ loadbalancer_ip }}/32:*"]
     }
   ]
 }
diff --git a/playbooks/roles/outbound/templates/proxy/nginx/conf.d/oci.conf b/playbooks/roles/outbound/templates/proxy/nginx/conf.d/oci.conf
new file mode 100644
index 0000000..5e68fc3
--- /dev/null
+++ b/playbooks/roles/outbound/templates/proxy/nginx/conf.d/oci.conf
@@ -0,0 +1,19 @@
+server {
+    listen 80;
+    server_name oci.liz.coffee;
+
+    real_ip_header X-Forwarded-For;
+    real_ip_recursive on;
+    set_real_ip_from {{ docker_network }};
+
+    location / {
+        proxy_pass https://{{ loadbalancer_ip }};
+        proxy_ssl_verify off;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+}