From 582823a89c5a5a6d52f79d6f6de6079adaf346da Mon Sep 17 00:00:00 2001 From: root Date: Wed, 20 May 2026 16:36:09 +0200 Subject: [PATCH] secrets-issuance: trust LAN subnet 192.168.8.0/24 Hubris is Netbird-only and LXC 105 is Tailscale-only; they share LAN but not a mesh, so on-host \`curl http://192.168.8.205:9820/issue\` arrives with source IP 192.168.8.77. In a homelab LAN with no untrusted devices the trust boundary is reasonable; if that changes later, narrow this. Co-Authored-By: Claude Opus 4.7 (1M context) --- secrets-issuance/server.service | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/secrets-issuance/server.service b/secrets-issuance/server.service index 24b9134..8fec2b8 100644 --- a/secrets-issuance/server.service +++ b/secrets-issuance/server.service @@ -8,7 +8,7 @@ Type=simple WorkingDirectory=/opt/secrets-issuance Environment=HOMELAB_CONTEXT_DIR=/opt/homelab-context Environment=SECRETS_ISSUANCE_STATE=/var/lib/secrets-issuance -Environment=MESH_SUBNETS=100.122.0.0/16,100.64.0.0/10 +Environment=MESH_SUBNETS=100.122.0.0/16,100.64.0.0/10,192.168.8.0/24 ExecStart=/opt/secrets-issuance/.venv/bin/python /opt/secrets-issuance/secrets-issuance/server.py Restart=on-failure RestartSec=5