[fanny] disable wp basic auth

problem is wg-quick sets the systemd-resolve dns domain to ~, which routes all queries over that network and ns1 was not jet connected

machines/fanny/configuration.nix

@@ -315,14 +315,16 @@ in
       };
     };
 
-    virtualHosts."www.rm16bleibt.org" = {
+    virtualHosts."rm16bleibt.org" = {
       forceSSL = true;
       enableACME = true;
       locations."/" = {
-        proxyPass = "http://${hosts.malobeo.hosts.wordpress.network.address}:80";
-        recommendedProxySettings = true;
+        proxyPass = "http://${hosts.malobeo.hosts.wordpress.network.address}";
         extraConfig = ''
           proxy_set_header Host $host;
+          proxy_set_header X-Real-IP $remote_addr;
+          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+          proxy_set_header X-Forwarded-Host $host;
           proxy_set_header X-Forwarded-Port 443;
           proxy_set_header X-Forwarded-Proto https;
         '';

machines/fanny/dyndns.nix

@@ -12,7 +12,7 @@
       ${pkgs.curl}/bin/curl --fail --silent --show-error "https://njal.la/update/?h=cloud.malobeo.org&k="$KEYCLOUD"&auto"
       ${pkgs.curl}/bin/curl --fail --silent --show-error "https://njal.la/update/?h=zines.malobeo.org&k="$KEYZINES"&auto"
       ${pkgs.curl}/bin/curl --fail --silent --show-error "https://njal.la/update/?h=antamap.malobeo.org&k="$KEYANATAMAP"&auto"
-      ${pkgs.curl}/bin/curl --fail --silent --show-error "https://njal.la/update/?h=www.rm16bleibt.org&k="$KEYRM16"&auto"
+      ${pkgs.curl}/bin/curl --fail --silent --show-error "https://njal.la/update/?h=rm16bleibt.org&k="$KEYRM16"&auto"
     '';
     serviceConfig = {
       Type = "oneshot";

machines/fanny/secrets.yaml

@@ -4,6 +4,7 @@ shop_auth: ENC[AES256_GCM,data:0NDIRjmGwlSFls12sCb5OlgyGTCHpPQIjycEJGhYlZsWKhEYX
 njalacloud: ENC[AES256_GCM,data:sp79Ij1vd9pQZuPUR1phmw==,iv:AWKZoOfBA/n16pWQCfA0dZmH1KajCztnLvYItoZZbgA=,tag:BIUrobBoO96pxUz1sjIYIw==,type:str]
 njalazines: ENC[AES256_GCM,data:fnObUEnXYvdj9HtkZNzXVA==,iv:0Zj2n2we9w4fj/n7e1ayd9XgFEMAGCHk4QLTu1IlRnQ=,tag:zeOLAB0oE6XbxqdqhdRNxw==,type:str]
 njalaantamap: ENC[AES256_GCM,data:nUc+E7HNbW0EDclzNDV6+w==,iv:H8nqeuOrvvu8O8QhGWkBkYWAQXwkBehf/jU6u/grs1A=,tag:mqX6jn47DyeSuk8xzG0e/Q==,type:str]
+njalarm16: ENC[AES256_GCM,data:Uo/TBNgyvH7EGSJb7ZQUBw==,iv:YDGjr9w9YceiDGJAtNIAPltxaR5pfpEYswu33WtAiQQ=,tag:PtlbcggOHgb1vIb7KBV0hg==,type:str]
 njala_api_key: ENC[AES256_GCM,data:ohSVzQUvFjia/s9WceqnZCdLyk3N1Lm2BCBmXeBlkWD2dyrohKCnd9GiJ499IORpuYcOXyM=,iv:Uczk8op5mgqe8gefxgU9YuTqOsYvjzHCKvzA7GDsgio=,tag:XA7JRq/LsGkpHcQSO36Whg==,type:str]
 sops:
     age:
@@ -25,8 +26,8 @@ sops:
             SKFx7MXcjFRLKS2Ij12V8ftjL3Uod6be5zoMibkxK19KmXY/514Jww==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
-    lastmodified: "2026-08-28T12:19:14Z"
-    mac: ENC[AES256_GCM,data:TnElCRaL/b238clfFVEq+Ot1lwg5MLMchCkmhi5PmADRn2exA42Zeq5v1M/IM5sHt4xEyFLn5R/88Y49DAfehRFwu6rddV+3lnFV40k2rWRtMfQOUXSrCd7lGxZdFbMU0eIXF5jaATFbcP0wO03FohNA69/u6kNsS0y0jK3vuLQ=,iv:xPeNXUIavVYFfAv1fs5TXCHXmvnXQDs4mJZMHOX7qG8=,tag:85hrBTKMh1ckTtXpOxj5lg==,type:str]
+    lastmodified: "2026-09-14T12:42:34Z"
+    mac: ENC[AES256_GCM,data:cOv94thIsHzpsiYnJAP2R/RZIkkdr+NHQuO5jCMxWssFu5WcWzeXC9mbYe0RAhY0Hx+tUHJsEG5SQqRaudpbGH9aYLC+5jkVaURXSYd5FIv+I8aUrBsZtpVrE7NJwo+S3+PAgpOUCO4w0bBFsmAWvgpEQSWIcndnkZvvwF2GtrU=,iv:pupuBdJsZTLY246yanDPdgDlRm2oOZprERy3uNdY7E4=,tag:9c1IAKpXBb2KhI1N6M7hOA==,type:str]
     pgp:
         - created_at: "2025-02-11T18:32:49Z"
           enc: |-

machines/modules/malobeo/wireguard.nix

@@ -72,7 +72,7 @@ in
           mtu = 1340; #seems to be necessary to proxypass nginx traffic through vpn
           address = [ "${myPeer.address}/24" ];
           autostart = cfg.autostart;
-          dns = [peers.ns1.address];
+          #dns = [peers.ns1.address "1.1.1.1"]; #currently broken, see commit message
           listenPort = mkIf (myPeer.role == "server") myPeer.listenPort;
 
           # This allows the wireguard server to route your traffic to the internet and hence be like a VPN

machines/ns1/configuration.nix

@@ -17,6 +17,7 @@ in
     ../modules/sshd.nix
     ../modules/minimal_tools.nix
     ../modules/autoupdate.nix
+    inputs.self.nixosModules.malobeo.vpn
   ];
 
   networking.firewall = {
@@ -25,6 +26,14 @@ in
     allowedUDPPorts = [ 53 ];
   };
 
+  sops.defaultSopsFile = ./secrets.yaml;
+  sops.secrets.wg_private = {};
+  services.malobeo.vpn = {
+    enable = true;
+    name = "ns1";
+    privateKeyFile = config.sops.secrets.wg_private.path;
+  };
+
   services.bind = {
     enable = true;
     forwarders = [

machines/wordpress/configuration.nix

@@ -80,7 +80,7 @@ in {
 
   services.nginx = {
     enable = true;
-    virtualHosts."rm16bleibt.org" = {
+    virtualHosts."_" = {
       #serverName = "rm16bleibt.org";
       root = "/var/lib/wordpress/rm16bleibt.org";
       extraConfig = ''