ipfs: add to pomerium, explicitly set IPs for swarm

ops/nixos/bvm-ipfs/default.nix

@@ -39,16 +39,30 @@
     dataDir = "/store/ipfs";
     extraConfig = {
       Experimental.FilestoreEnabled = true;
-      Addresses.API = [
-        "/ip4/127.0.0.1/tcp/5001"
-        "/ip4/10.100.0.203/tcp/5001"
-        "/ip4/${config.my.ip.tailscale}/tcp/5001"
-      ];
-      Addresses.Gateway = [
-        "/ip4/127.0.0.1/tcp/8080"
-        "/ip4/10.100.0.203/tcp/8080"
-        "/ip4/${config.my.ip.tailscale}/tcp/8080"
+      Addresses = let
+        internalv4 = ["127.0.0.1" "10.100.0.203" config.my.ip.tailscale];
+        internal = map (a: "/ip4/${a}") internalv4;
+        externalv4 = internalv4 ++ ["92.118.28.4"];
+        externalv6 = ["2a09:a441::4"];
+        external = (map (a: "/ip4/${a}") externalv4) ++ (map (a: "/ip6/${a}") externalv6);
+      in {
+        API = map (f: "${f}/tcp/5001") internal;
+        Gateway = map (f: "${f}/tcp/8080") internal;
+        Swarm = let
+          suffixes = ["/tcp/4001" "/udp/4001/quic"];
+        in builtins.concatMap (suffix: map (prefix: prefix + suffix) external) suffixes;
+      };
+
+      API.HTTPHeaders = {
+        Access-Control-Allow-Origin = [
+          "http://bvm-ipfs:5001"
+          "http://localhost:3000"
+          "http://127.0.0.1:5001"
+          "https://webui.ipfs.io"
+          "https://ipfs.int.lukegb.com"
         ];
+        Access-Control-Allow-Methods = ["PUT" "POST"];
+      };
     };
   };
 

ops/nixos/etheroute-lon01/default.nix

@@ -252,6 +252,8 @@ in {
             "X-Forwarded-Roles" = "pomerium";
           };
         })
+        (service "bvm-ipfs:5001" "ipfs.int.lukegb.com" {})
+        (service "bvm-ipfs:8080" "ipfs-gw.int.lukegb.com" {})
       ];
     };
   };