Emitter: TLS-SNI forward Nextcloud traffic

hosts/Emitter.nix

@@ -102,7 +102,7 @@
                     ${pkgs.dig}/bin/nslookup rupert.gvfr.de
                     ${pkgs.unixtools.ping}/bin/ping -c1 rupert.gvfr.de >/dev/null
                     echo "Opening SSH tunnel."
-                    ${pkgs.openssh}/bin/ssh -i /secrets/id_burp_remote -o IdentitiesOnly=yes -o ExitOnForwardFailure=yes -L 4971:localhost:4971 burp-remote@rupert.gvfr.de -f true
+                    ${pkgs.openssh}/bin/ssh -6 -i /secrets/id_burp_remote -o IdentitiesOnly=yes -o ExitOnForwardFailure=yes -L 4971:localhost:4971 burp-remote@rupert.gvfr.de -f true
                     echo "Beginning backup operation."
                     $out/sbin/burp-untunneled \$@
                     EOF
@@ -142,6 +142,8 @@
         };
     };
 
+    services.postgresql.package = pkgs.postgresql_13;
+
     # This value determines the NixOS release from which the default
     # settings for stateful data, like file locations and database versions
     # on your system were taken. It’s perfectly fine and recommended to leave

hosts/forgejo.nix

@@ -123,6 +123,10 @@ in
             enableACME = true;
             forceSSL = true;
             locations."/".proxyPass = "http://localhost:3001/";
+            extraConfig = ''
+                # Maximum upload file size for git-lfs
+                client_max_body_size 100M;
+            '';
         };
     };
 

hosts/tls_sni.nix

@@ -4,6 +4,7 @@
         streamConfig = ''
             map $ssl_preread_server_name $target_backend {
                 md.gvfr.de rupert;
+                rupert.gvfr.de rupert;
                 default localserv;
             }