SBEE-Lab · mulatta · Jul 3, 2026 · Jul 2, 2026 · Jul 2, 2026 · Jul 2, 2026
diff --git a/docs/admin/monitoring.md b/docs/admin/monitoring.md
@@ -3,7 +3,7 @@
 ## 대시보드
 
 - **Grafana**: `https://logging.sjanglab.org` (익명 Viewer 접근 가능, wg-admin 경유)
-- **Gatus**: `https://gatus.sjanglab.org` (외부 상태 페이지)
+- **Gatus**: `https://status.sjanglab.org` (tailnet 내부 공개 상태 페이지)
 
 ## 스택 구성
 

diff --git a/docs/admin/network.md b/docs/admin/network.md
@@ -124,10 +124,10 @@ sequenceDiagram
 
 | 호스트 | 외부 개방 포트 | wg-admin 개방 포트 |
 |--------|--------------|-------------------|
-| eta | 80, 443, 10022 (SSH + Rate limiting), 2323 (Upterm relay) | 10022 |
+| eta | 80, 443, 10022 (SSH + Rate limiting), 2323 (Upterm relay) | 10022, 8081 (Gatus) |
 | psi | — | 80/443 (Nixbot upstream), 10022, 5000 (Harmonia), 5432 (Nixbot/PostgreSQL) |
 | rho | — | 10022, 5432 (PostgreSQL), 3000 (Grafana) |
-| tau | — | 10022, 5678 (n8n 웹훅) |
+| tau | — | 10022, 5678 (n8n 웹훅), 8000 (Vaultwarden) |
 
 ## ACME 인증서
 

diff --git a/docs/admin/security.md b/docs/admin/security.md
@@ -237,4 +237,4 @@ flowchart LR
 
 ### 서비스 복구
 
-systemd가 서비스 실패 시 자동 재시작합니다. 모니터링은 Gatus(`gatus.sjanglab.org`)에서 헬스체크를 수행합니다.
+systemd가 서비스 실패 시 자동 재시작합니다. 모니터링은 Gatus(`status.sjanglab.org`)에서 헬스체크를 수행합니다.
diff --git a/hosts/eta.nix b/hosts/eta.nix
@@ -14,7 +14,6 @@ in
     ../modules/uptermd
     ../modules/gatus
     ../modules/monitoring/vector
-    ../modules/monitoring/reverse-proxy.nix
     ../modules/n8n/reverse-proxy.nix
     ../modules/acme/sync.nix
   ];
@@ -25,36 +24,49 @@ in
       serviceName = "acme-sync-to-tau";
       remoteHost = hosts.tau.wg-admin;
     }
-    {
-      domain = "ollama.sjanglab.org";
-      serviceName = "acme-sync-ollama-to-psi";
-      remoteUser = "acme-sync-ollama";
-      remoteHost = hosts.psi.wg-admin;
-    }
     {
       domain = "docling.sjanglab.org";
       serviceName = "acme-sync-docling-to-psi";
       remoteHost = hosts.psi.wg-admin;
     }
     {
-      domain = "vllm.sjanglab.org";
-      serviceName = "acme-sync-vllm-to-psi";
-      remoteUser = "acme-sync-vllm";
-      remoteHost = hosts.psi.wg-admin;
+      domain = "status.sjanglab.org";
+      serviceName = "acme-sync-status-to-rho";
+      remoteUser = "acme-sync-status";
+      remoteHost = hosts.rho.wg-admin;
+    }
+    {
+      domain = "logging.sjanglab.org";
+      serviceName = "acme-sync-logging-to-rho";
+      remoteUser = "acme-sync-logging";
+      remoteHost = hosts.rho.wg-admin;
+    }
+    {
+      domain = "vault.sjanglab.org";
+      serviceName = "acme-sync-vaultwarden-to-tau";
+      remoteUser = "acme-sync-vaultwarden";
+      remoteHost = hosts.tau.wg-admin;
     }
   ];
 
   disko.rootDisk = "/dev/vda";
 
   # ACME certificates for internal services
-  security.acme.certs."ollama.sjanglab.org" = {
+  security.acme.certs."status.sjanglab.org" = {
+    dnsProvider = "cloudflare";
+    environmentFile = config.sops.secrets.cloudflare-credentials.path;
+    webroot = null;
+    group = "acme";
+  };
+
+  security.acme.certs."logging.sjanglab.org" = {
     dnsProvider = "cloudflare";
     environmentFile = config.sops.secrets.cloudflare-credentials.path;
     webroot = null;
     group = "acme";
   };
 
-  security.acme.certs."vllm.sjanglab.org" = {
+  security.acme.certs."vault.sjanglab.org" = {
     dnsProvider = "cloudflare";
     environmentFile = config.sops.secrets.cloudflare-credentials.path;
     webroot = null;

diff --git a/hosts/rho.nix b/hosts/rho.nix
@@ -9,6 +9,8 @@
     ../modules/borgbackup/rho/client.nix
     ../modules/borgbackup/mirror.nix
     ../modules/monitoring/vector/monitor-systems.nix
+    ../modules/monitoring/reverse-proxy.nix
+    ../modules/gatus/reverse-proxy.nix
   ];
 
   disko.rootDisk = "/dev/disk/by-id/nvme-eui.00000000000000006479a79cdac0038a";

diff --git a/hosts/tau.nix b/hosts/tau.nix
@@ -11,6 +11,7 @@
     ../modules/monitoring/vector/monitor-services.nix
     ../modules/nextcloud
     ../modules/n8n
+    ../modules/vaultwarden/reverse-proxy.nix
   ];
 
   disko.rootDisk = "/dev/disk/by-id/nvme-eui.00000000000000006479a79cdac0038f";

diff --git a/modules/authentik/nginx-locations.nix b/modules/authentik/nginx-locations.nix
@@ -27,8 +27,11 @@ in
       extraConfig = ''
         internal;
         proxy_pass_request_body off;
-        proxy_set_header Content-Length "";
-        proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
+        proxy_set_header Content-Length 0;
+        proxy_set_header Host $host;
+        proxy_set_header X-Original-URL $scheme://$host$request_uri;
+        proxy_set_header X-Forwarded-Host $host;
+        proxy_set_header X-Forwarded-Proto $scheme;
         proxy_set_header Authorization $http_authorization;
       '';
     };
@@ -37,7 +40,10 @@ in
     "/outpost.goauthentik.io" = {
       proxyPass = "${authentikOutpost}/outpost.goauthentik.io";
       extraConfig = ''
-        proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
+        proxy_set_header Host $host;
+        proxy_set_header X-Original-URL $scheme://$host$request_uri;
+        proxy_set_header X-Forwarded-Host $host;
+        proxy_set_header X-Forwarded-Proto $scheme;
         proxy_set_header Authorization $http_authorization;
       '';
     };

diff --git a/modules/gatus/check.nix b/modules/gatus/check.nix
@@ -18,7 +18,7 @@
 }:
 let
   cfg = config.gatusCheck;
-  gatusApi = "https://gatus.sjanglab.org";
+  gatusApi = "http://${config.networking.sbee.hosts.eta.wg-admin}:8081";
 
   # Gatus external endpoint key: "${group}_${name}" with spaces/special chars → hyphens
   mkKey =
@@ -135,9 +135,6 @@ in
       message = "gatusCheck.push '${ep.name}': exactly one of 'url' or 'systemdService' must be set";
     }) cfg.push;
 
-    # Resolve gatus.sjanglab.org → eta WG IP for hosts behind NAT/WG
-    networking.hosts.${config.networking.sbee.hosts.eta.wg-admin} = [ "gatus.sjanglab.org" ];
-
     sops.secrets.gatus-push-token = {
       sopsFile = ./secrets.yaml;
     };

diff --git a/modules/gatus/default.nix b/modules/gatus/default.nix
@@ -1,29 +1,22 @@
 { config, lib, ... }:
 let
   inherit (config.networking.sbee) hosts;
-  domain = "gatus.sjanglab.org";
   port = 8081; # 8080 is used by headscale
   systemCollector = hosts.rho.wg-admin;
   cfg = config.gatusCheck;
 in
 {
-  imports = [
-    ../acme
-    ./check.nix
-  ];
+  imports = [ ./check.nix ];
 
   services.gatus = {
     enable = true;
     environmentFile = config.sops.secrets.gatus-env.path;
     settings = {
-      web.port = port;
-      metrics = true;
-
-      security.basic = {
-        username = "admin";
-        # bcrypt hash → base64 encoded, interpolated from environmentFile
-        password-bcrypt-base64 = "\${GATUS_SECURITY_BASIC_PASSWORD}";
+      web = {
+        address = "0.0.0.0";
+        inherit port;
       };
+      metrics = true;
 
       alerting.ntfy = {
         topic = "gatus";
@@ -63,9 +56,7 @@ in
           # psi
           (mkExtEndpoint "Nixbot" "ci")
           (mkExtEndpoint "Nixbot PostgreSQL" "ci")
-          (mkExtEndpoint "Ollama" "ai")
           (mkExtEndpoint "Docling" "ai")
-          (mkExtEndpoint "vLLM" "ai")
           # tau
           (mkExtEndpoint "Nextcloud" "apps")
           (mkExtEndpoint "n8n" "apps")
@@ -82,30 +73,6 @@ in
     sopsFile = ./secrets.yaml;
   };
 
-  # ACME certificate (DNS challenge via Cloudflare)
-  security.acme.certs.${domain} = {
-    dnsProvider = "cloudflare";
-    environmentFile = config.sops.secrets.cloudflare-credentials.path;
-    webroot = null;
-    group = "nginx";
-  };
-
-  # Nginx reverse proxy
-  services.nginx.virtualHosts.${domain} = {
-    forceSSL = true;
-    useACMEHost = domain;
-    locations."/" = {
-      proxyPass = "http://127.0.0.1:${toString port}";
-      proxyWebsockets = true;
-      extraConfig = ''
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-      '';
-    };
-  };
-
   # Vector: scrape Gatus /metrics → push to rho Prometheus
   # Independent source+sink pair, does not interfere with existing Vector pipeline
   services.vector.settings = {
@@ -123,8 +90,5 @@ in
     };
   };
 
-  networking.firewall.allowedTCPPorts = [
-    80
-    443
-  ];
+  networking.firewall.interfaces.wg-admin.allowedTCPPorts = [ port ];
 }
diff --git a/modules/gatus/reverse-proxy.nix b/modules/gatus/reverse-proxy.nix
@@ -0,0 +1,39 @@
+{ config, ... }:
+let
+  inherit (config.networking.sbee) hosts;
+  domain = "status.sjanglab.org";
+  certDir = "/var/lib/acme/${domain}";
+in
+{
+  imports = [ ../acme/sync.nix ];
+
+  acmeSyncer.mkReceiver = [
+    {
+      inherit domain;
+      user = "acme-sync-status";
+    }
+  ];
+
+  services.nginx = {
+    enable = true;
+
+    virtualHosts.${domain} = {
+      forceSSL = true;
+      sslCertificate = "${certDir}/fullchain.pem";
+      sslCertificateKey = "${certDir}/key.pem";
+
+      locations."/" = {
+        proxyPass = "http://${hosts.eta.wg-admin}:8081";
+        proxyWebsockets = true;
+        extraConfig = ''
+          proxy_set_header Host $host;
+          proxy_set_header X-Real-IP $remote_addr;
+          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+          proxy_set_header X-Forwarded-Proto $scheme;
+        '';
+      };
+    };
+  };
+
+  networking.firewall.interfaces.tailscale0.allowedTCPPorts = [ 443 ];
+}
diff --git a/modules/headscale/acl-rules.nix b/modules/headscale/acl-rules.nix
@@ -26,6 +26,7 @@
         "tag:ai:443"
         "tag:apps:80"
         "tag:apps:443"
+        "tag:monitoring:443"
         "tag:monitoring:3000"
       ];
     }

diff --git a/modules/headscale/default.nix b/modules/headscale/default.nix
@@ -56,6 +56,21 @@ in
             type = "A";
             value = "100.64.0.1"; # psi headscale IP
           }
+          {
+            name = "status.sjanglab.org";
+            type = "A";
+            value = "100.64.0.2"; # rho headscale IP
+          }
+          {
+            name = "logging.sjanglab.org";
+            type = "A";
+            value = "100.64.0.2"; # rho headscale IP
+          }
+          {
+            name = "vault.sjanglab.org";
+            type = "A";
+            value = "100.64.0.3"; # tau headscale IP
+          }
           {
             name = "upterm.sjanglab.org";
             type = "A";
Original file line number	Diff line number	Diff line change
Expand Up		@@ -237,4 +237,4 @@ flowchart LR

		### 서비스 복구

		systemd가 서비스 실패 시 자동 재시작합니다. 모니터링은 Gatus(`gatus.sjanglab.org`)에서 헬스체크를 수행합니다.
		systemd가 서비스 실패 시 자동 재시작합니다. 모니터링은 Gatus(`status.sjanglab.org`)에서 헬스체크를 수행합니다.