ergo, but not broken

lxc-ergo.nix

@@ -21,7 +21,7 @@
 
     networking.firewall.trustedInterfaces = [ "br-+" ];
     networking.firewall.allowedTCPPorts = [
-      6667
+      8067
       6697
       443
       80
@@ -45,19 +45,18 @@
       virtualHosts."irc.dukeceph.xyz" = {
         addSSL = true;
         enableACME = true;
-        locations."/webirc" = {
-          proxyPass = "http://unix:/run/ergo/websocket";
-          proxyWebsockets = true;
-          extraConfig = ''
+        root = "/var/www/html";
+        locations."/webirc".extraConfig = ''
+          proxy_pass http://127.0.0.1:8067;
+          proxy_read_timeout 600s;
+          proxy_http_version 1.1;
           proxy_set_header Upgrade $http_upgrade;
           proxy_set_header Connection "Upgrade";
           proxy_set_header X-Forwarded-For $remote_addr;
           proxy_set_header X-Forwarded-Proto $scheme;
-            proxy_read_timeout 10m;
         '';
       };
     };
-    };
 
     users.groups."ergo" = { };
     users.users."ergo" = {
@@ -85,8 +84,15 @@
                 key = "/etc/letsencrypt/live/irc.dukeceph.xyz/privkey.pem";
               };
             };
+            ":8067" = {
+              websocket = true;
             };
           };
+          secure-nets = [
+            "127.0.0.0/24"
+            "192.168.0.0/24"
+          ];
+        };
         oper-classes = {
           chat-moderator = {
             title = "Chat Moderator";
@@ -128,5 +134,6 @@
     systemd.services.ergochat.serviceConfig.DynamicUser = lib.mkForce false;
     systemd.services.ergochat.serviceConfig.User = "ergo";
     systemd.services.ergochat.serviceConfig.Group = "ergo";
+    systemd.services.ergochat.restartIfChanged = false;
   };
 }

vm-homelab.nix

@@ -26,10 +26,6 @@ in
     services.caddy = {
       enable = true;
       virtualHosts = {
-        "dukeceph.xyz".extraConfig = ''
-          root * /mnt/nfs/public
-          file_server browse
-        '';
         "feed.rperce.net".extraConfig = ''
           reverse_proxy http://192.168.0.5:8080
         '';
@@ -77,9 +73,6 @@ in
         "irc.dukeceph.xyz".extraConfig = ''
           reverse_proxy 192.168.0.8
         '';
-        "irc.dukeceph.xyz/webirc".extraConfig = ''
-          reverse_proxy 192.168.0.8:8067
-        '';
       };
     };