From 9ad682ae871aae64a6d889e855c913821dde0b4b Mon Sep 17 00:00:00 2001
From: Zuma <lucien@shenanigans.cc>
Date: Fri, 9 Jan 2026 16:45:28 +0100
Subject: [PATCH] Added D53 and Diplonat

---
 apps/core/d53.hcl                | 45 +++++++++++++++++++++++++++
 apps/core/diplonat.hcl           | 52 ++++++++++++++++++++++++++++++++
 apps/{tricot => core}/tricot.hcl |  4 ++-
 apps/searxng/searxng.hcl         |  3 +-
 cluster.nix                      |  8 +++++
 configuration.nix                |  9 ++++++
 6 files changed, 119 insertions(+), 2 deletions(-)
 create mode 100644 apps/core/d53.hcl
 create mode 100644 apps/core/diplonat.hcl
 rename apps/{tricot => core}/tricot.hcl (94%)

diff --git a/apps/core/d53.hcl b/apps/core/d53.hcl
new file mode 100644
index 0000000..944a2bc
--- /dev/null
+++ b/apps/core/d53.hcl
@@ -0,0 +1,45 @@
+job "d53" {
+  datacenters = ["mayel-house", "gribse-house", "zuma-house"]
+  type = "service"
+  priority = 90
+
+  group "D53" {
+    count = 1
+
+    task "d53" {
+      driver = "docker"
+
+      config {
+        image = "git.shenanigans.cc/zuma/d53:41e79af-dirty"
+        network_mode = "host"
+        readonly_rootfs = true
+      }
+
+      resources {
+        cpu = 100
+        memory = 100
+      }
+
+      restart {
+        interval = "3m"
+        attempts = 10
+        delay    = "15s"
+        mode     = "delay"
+      }
+
+      template {
+        data = <<EOH
+D53_CONSUL_HOST=http://localhost:8500
+D53_PROVIDERS=chokbar.bzh:porkbun
+D53_PORKBUN_API_KEY={{ key "secrets/d53/porkbun_api_key" }}
+D53_PORKBUN_SECRET_API_KEY={{ key "secrets/d53/porkbun_secret_api_key" }}
+D53_ALLOWED_DOMAINS=chokbar.bzh
+RUST_LOG=d53=debug
+EOH
+        destination = "secrets/env"
+        env = true
+      }
+    }
+  }
+}
+
diff --git a/apps/core/diplonat.hcl b/apps/core/diplonat.hcl
new file mode 100644
index 0000000..6f36297
--- /dev/null
+++ b/apps/core/diplonat.hcl
@@ -0,0 +1,52 @@
+job "diplonat" {
+  datacenters = ["zuma-house", "mayel-house", "gribse-house"]
+  type = "system"
+  priority = 90
+
+  update {
+    max_parallel = 2
+    stagger = "1m"
+  }
+
+  group "diplonat" {
+    task "diplonat" {
+      driver = "docker"
+
+      config {
+        image = "git.shenanigans.cc/zuma/diplonat:filouterie"
+        network_mode = "host"
+        readonly_rootfs = true
+        privileged = true
+      }
+
+      restart {
+        interval = "5m"
+        attempts = 10
+        delay    = "15s"
+        mode     = "delay"
+      }
+
+      template {
+        data = <<EOH
+DIPLONAT_REFRESH_TIME=60
+DIPLONAT_EXPIRATION_TIME=300
+DIPLONAT_DISABLE_IGD=true
+DIPLONAT_STUN_SERVER=stun.l.google.com:19302
+DIPLONAT_CONSUL_NODE_NAME={{ env "attr.unique.hostname" }}
+DIPLONAT_CONSUL_URL=http://consul.service.filouterie.consul:8500
+DIPLONAT_CONSUL_TLS_SKIP_VERIFY=true
+RUST_LOG=debug
+RUST_BACKTRACE=1
+EOH
+        destination = "secrets/env"
+        env = true
+      }
+
+      resources {
+        memory = 100
+        memory_max = 200
+      }
+    }
+  }
+}
+
diff --git a/apps/tricot/tricot.hcl b/apps/core/tricot.hcl
similarity index 94%
rename from apps/tricot/tricot.hcl
rename to apps/core/tricot.hcl
index 1c218bb..fc7b343 100644
--- a/apps/tricot/tricot.hcl
+++ b/apps/core/tricot.hcl
@@ -71,7 +71,9 @@ EOH
         name = "tricot-http"
         port = "http_port"
         tags = [
-          "${meta.site}"
+          "${meta.site}",
+          "d53-a global.site.chokbar.bzh",
+          "d53-a ${meta.site}.site.chokbar.bzh",
          ]
         address_mode = "host"
       }
diff --git a/apps/searxng/searxng.hcl b/apps/searxng/searxng.hcl
index cbf8558..9fe091f 100644
--- a/apps/searxng/searxng.hcl
+++ b/apps/searxng/searxng.hcl
@@ -24,7 +24,8 @@ job "searxng" {
 
       service {
         tags = [
-          "tricot search.chokbar.bzh"
+          "tricot search.chokbar.bzh",
+          "d53-cname search.chokbar.bzh"
         ]
         name = "searxng"
         port = "http_port"
diff --git a/cluster.nix b/cluster.nix
index 265031a..743e26f 100644
--- a/cluster.nix
+++ b/cluster.nix
@@ -46,6 +46,11 @@ with lib;
             type = str;
             description = "Wireguard endpoint on the public internet";
           };
+
+	  cnameTarget = mkOption {
+	    type = str;
+	    description = "CNAME target for DNS updater to forward service to right site";
+	  };
         };
       });
     };
@@ -60,18 +65,21 @@ with lib;
       pubkey = "/TJVF6aLEvqngjd8Gq3QkH5esEQSIL+ryz/uKdJaZEQ=";
       address = "10.0.1.1";
       endpoint = "92.179.73.254:19720";
+      cnameTarget = "mayel-house.site.chokbar.bzh";
     };
     "riri" = {
       siteName = "gribse-house";
       pubkey = "lUUTv85m7vtIKY7+s//AWL5r/epjXSBZNJCrgjRfQj0=";
       address = "10.0.2.1";
       endpoint = "176.159.248.209:19720";
+      cnameTarget = "gribse-house.site.chokbar.bzh";
     };
     "loulou" = {
       siteName = "zuma-house";
       pubkey = "J/liQaChv4ZBjwlLmobM0NA/Wwgl8nDcQEcGdsC5Exc=";
       address = "10.0.3.1";
       endpoint = "82.67.117.71:19720";
+      cnameTarget = "zuma-house.site.chokbar.bzh";
     };
   };
 }
diff --git a/configuration.nix b/configuration.nix
index 56b60e5..8b470de 100755
--- a/configuration.nix
+++ b/configuration.nix
@@ -194,6 +194,7 @@ with pkgs.lib;
         extraConfig = {
           node_meta = {
             site = clusterNodeCfg.siteName;
+	    cname_target = clusterNodeCfg.cnameTarget;
           };
           server = true;
 	  bootstrap = false;
@@ -295,11 +296,19 @@ with pkgs.lib;
         ];
 
         extraCommands = ''
+	  # Allow UDP packets comming from port 1900 from a local address,
+          # these are necessary for UPnP/IGD
+            iptables -A INPUT -s 192.168.0.0/16 -p udp --sport 1900 -j ACCEPT
+
+          # Allow docker containers to access all ports
+            iptables -A INPUT -s 172.17.0.0/16 -j ACCEPT
           # Allow other nodes on VPN to access all ports
             iptables -A INPUT -s ${cfg.clusterPrefix} -j ACCEPT
         '';
 
         extraStopCommands = ''
+	  iptables -D INPUT -s 192.168.0.0/16 -p udp --sport 1900 -j ACCEPT
+          iptables -D INPUT -s 172.17.0.0/16 -j ACCEPT
           iptables -D INPUT -s ${cfg.clusterPrefix} -j ACCEPT
         '';
       };