From d505d13d9aa8cbcaf0eaf02374b7a7fbb6d01204 Mon Sep 17 00:00:00 2001
From: Jan-Bulthuis <git@bulthuis.dev>
Date: Fri, 23 Oct 2026 03:24:13 +0200
Subject: [PATCH] fix: ipv6 setup and reverse proxy

---
 hosts/ws-home/configuration.nix | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/hosts/ws-home/configuration.nix b/hosts/ws-home/configuration.nix
index 82b2d75..c3fdcd5 100644
--- a/hosts/ws-home/configuration.nix
+++ b/hosts/ws-home/configuration.nix
@@ -16,6 +16,15 @@
     domain.enable = false;
   };
 
+  # Let the kernel handle router advertisements, so the route to the
+  # Thread network advertised by the OTBR gets installed
+  networking.dhcpcd.IPv6rs = false;
+  boot.kernel.sysctl = {
+    "net.ipv6.conf.default.accept_ra_rt_info_max_plen" = 64;
+    "net.ipv6.conf.eno1.accept_ra" = 1;
+    "net.ipv6.conf.eno1.accept_ra_rt_info_max_plen" = 64;
+  };
+
   # Matter controller
   services.matterjs-server = {
     enable = true;
@@ -44,6 +53,11 @@
     extraComponents = [ "matter" ];
     config = {
       homeassistant = { };
+      http = {
+        use_x_forwarded_for = true;
+        # TODO: Narrow down to the address the internal gateway connects from
+        trusted_proxies = [ "10.10.0.0/16" ];
+      };
     };
   };
   networking.firewall.allowedTCPPorts = [