1# Gandi (public) DNS zone for sbr.pm - uses VPN IPs (10.100.0.x) only
 2{ dns, globals, ... }:
 3let
 4  dnsHelpers = import ../../../../lib/dns-helpers.nix { inherit globals; };
 5  inherit (dnsHelpers) getMachineIP;
 6
 7  # Import the common zone
 8  baseZone = import ./sbr.pm-common.nix {
 9    inherit dns globals;
10    getIPForMachine = getMachineIP;
11  };
12in
13baseZone
14// {
15  subdomains = baseZone.subdomains // {
16    # Override services to point to carthage's public IP (reverse proxy entry point)
17    immich.A = [ "46.224.100.116" ];
18    navidrome.A = [ "46.224.100.116" ];
19    jellyfin.A = [ "46.224.100.116" ];
20    audiobookshelf.A = [ "46.224.100.116" ];
21
22    # Service aliases
23    music.A = [ "46.224.100.116" ]; # navidrome
24    photos.A = [ "46.224.100.116" ]; # immich
25    podcasts.A = [ "46.224.100.116" ]; # audiobookshelf
26    rss.A = [ "46.224.100.116" ]; # miniflux
27    llm.A = [ "10.100.0.50" ]; # rhea VPN IP
28
29    # WireGuard endpoint of the travel exit node, so client configs can use a
30    # name instead of a bare IP. Must be lutece's public address: it is dialled
31    # from outside any tunnel.
32    travel.A = [ "64.31.63.130" ];
33  };
34}