NixOS Networking | 914 Members | |
| Declaratively manage your switching, routing, wireless, tunneling and more. | 265 Servers |
| Sender | Message | Time |
|---|---|---|
| 15 Jun 2025 | ||
| With any other proper auth built into Moonraker | 19:11:32 | |
| That's a lot of assumptions | 19:29:43 | |
| That the option doesn't explicitly state | 19:29:50 | |
| Or even begin to state | 19:29:56 | |
| Genuinely I don't see a problem with doing the same thing with subdomains | 19:30:10 | |
| And that comes with a significantly smaller number of footguns | 19:30:20 | |
In reply to @k900:0upti.me I didn’t think I’d need to tell anyone not to expose their manufactuing machinary to the public internet 😆 But yeah, the same setup could be performed with DNS, but clearly there are users that serve it at a subpath instead - Moonraker or Fluidd would not support this otherwise? I imagine the subpath could be simpler to manage from an infrastructure configuration perspective, which might be the reason it exists at all | 19:46:15 | |
| * It is a fairly uncommon setup (because most people with printers tend not to go about using a domain at all from my time in the 3D printing community), but some people like myself end up exposing these machines under a subpath that only gets served if the request comes from behind a VPN subnet. If you have many machines, like a print farm, you would also benefit from this sort of setup - easier to serve at a subpath than manage a ton of DNS entries for subdomains etc. But if you mean, “why do Moonraker and the web interface share a domain?” That seems to be the default configuration already for the most part, given that Moonraker gets served at “/websocket” as this combination of apps usually runs from the same SBC and is tightly coupled to control a 3D printer running Klipper. The pattern for these printers is as follows:
| 20:09:34 | |
| I have asked the Moonraker and Fluidd devs if they see a security issue with this pattern - I'll see what they have to say regarding how much of a bad idea this is 😆 If they think it is a bad pattern to support then I will close the PR (and possibly make a flake for my own purposes), otherwise I will respond with more info on the PR | 20:22:27 | |
| 16 Jun 2025 | ||
| The other thing that is a bit odd is the fact that the Moonraker websocket is currently configured with nginx in the Fluidd service (as well as Mainsail)… that doesn’t quite seem like the right pattern? | 00:40:31 | |
| The websocket and regex parts of this nginx configuration probably belong in the moonraker service? | 00:42:06 | |
I was today years old when I found out that systemd.network.enable also enables resolved | 03:48:25 | |
| I kinda get that this is required for the DNS-related settings in networkd to work | 03:48:52 | |
| but when you have a proper resolver enabled and they keep fighting over resolv.conf … | 03:49:13 | |
| I wish we could do better, but I fear there is no clear way out | 03:49:29 | |
oof | 03:50:57 | |
| I want to love systemd, but a lot of the non-init pieces are too half-baked. Went all in with the declarative networkd configs but kept running into paper cuts | 03:52:30 | |
| by proper resolver I mean a recursor | 03:53:05 | |
| * by proper resolver I mean a recursor as opposed to a stub | 03:53:11 | |
| one that can actually validate dnssec for dane | 03:53:22 | |
| * one that can actually validate dnssec, e.g. for dane | 03:53:26 | |
| resolved can talk to your resolver | 04:20:31 | |
| (and provides services like mDNS on top) | 04:20:37 | |
| not interesting for my server | 04:20:58 | |
| * not interesting for my servers | 04:21:03 | |
| it's pretty much the supported configuration for better or worse. like, it also provides the D-Bus resolved API etc. and works with the NSS stuff | 04:21:24 | |
| https://github.com/NixOS/infra/commit/67eb34a7534e9caeda495fbbfea50767a23fb8a0 | 04:21:40 | |
you set services.resolved.fallbackDns and ensure UseDNS=no for networks | 04:21:49 | |
you could also just set services.resolved.enable = false and services.{unbound,kresd,pdns-recursor}.enable instead | 04:22:32 | |
| sure | 04:22:39 | |