fix(jellybee): update roam-location for localhost CORS + correct funnel command

common/services/roam-location.nix

@@ -0,0 +1,72 @@
+{
+  lib,
+  config,
+  pkgs,
+  inputs,
+  ...
+}:
+with lib; let
+  cfg = config.my.services.roam-location;
+
+  roam-location = pkgs.buildGoModule {
+    name = "roam-location";
+    src = inputs.roam-location;
+    vendorHash = null;
+  };
+in {
+  options.my.services.roam-location = {
+    enable = mkEnableOption "roam-location Starlink GPS location service";
+    starlinkHost = mkOption {
+      type = types.str;
+      default = "192.168.100.1:9200";
+      description = "Starlink dish gRPC address";
+    };
+    pollIntervalSeconds = mkOption {
+      type = types.int;
+      default = 30;
+      description = "How often to poll the Starlink dish for location, in seconds";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.roam-location-funnel = {
+      description = "Tailscale Funnel for roam-location";
+      after = ["tailscaled.service" "roam-location.service"];
+      wants = ["tailscaled.service" "roam-location.service"];
+      wantedBy = ["multi-user.target"];
+      serviceConfig = {
+        Type = "oneshot";
+        RemainAfterExit = true;
+        ExecStart = pkgs.writeShellScript "roam-location-funnel-start" ''
+          ${pkgs.tailscale}/bin/tailscale funnel --bg --https=443 http://localhost:${toString 22495}
+        '';
+        ExecStop = pkgs.writeShellScript "roam-location-funnel-stop" ''
+          ${pkgs.tailscale}/bin/tailscale funnel --https=443 off
+          ${pkgs.tailscale}/bin/tailscale serve --https=443 off
+        '';
+        Restart = "on-failure";
+        RestartSec = "5s";
+      };
+    };
+
+    systemd.services.roam-location = {
+      description = "roam-location Starlink GPS location service";
+      after = ["network-online.target" "tailscaled.service"];
+      wants = ["network-online.target"];
+      wantedBy = ["multi-user.target"];
+      environment = {
+        STARLINK_HOST = cfg.starlinkHost;
+        POLL_INTERVAL_SECONDS = toString cfg.pollIntervalSeconds;
+      };
+      serviceConfig = {
+        ExecStart = "${roam-location}/bin/roam-location";
+        Restart = "on-failure";
+        RestartSec = "5s";
+        DynamicUser = true;
+      };
+    };
+    # tailscale0 is already a trusted interface so no firewall changes are needed
+    # for tailnet access; this only opens the port on non-tailscale interfaces.
+    networking.firewall.allowedTCPPorts = mkIf cfg.enable [];
+  };
+}

flake.lock

@@ -1007,6 +1007,23 @@
         "type": "github"
       }
     },
+    "roam-location": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1775793807,
+        "narHash": "sha256-8ry52du60L6V7A9zbWFU+DUj5uEOrzcZQWI/xyI7DXQ=",
+        "owner": "acaloiaro",
+        "repo": "roam-location",
+        "rev": "7c55e15b9ba1ad97ecb79d0aab4338986f9afc07",
+        "type": "github"
+      },
+      "original": {
+        "owner": "acaloiaro",
+        "ref": "starlink-location",
+        "repo": "roam-location",
+        "type": "github"
+      }
+    },
     "root": {
       "inputs": {
         "agenix": "agenix",
@@ -1023,6 +1040,7 @@
         "nixos-hardware": "nixos-hardware",
         "nixpkgs": "nixpkgs_7",
         "nur": "nur",
+        "roam-location": "roam-location",
         "starship-jj": "starship-jj"
       }
     },

flake.nix

@@ -48,6 +48,11 @@
     inputs.nixpkgs.follows = "nixpkgs";
   };
 
+  inputs.roam-location = {
+    url = "github:acaloiaro/roam-location/starlink-location";
+    flake = false;
+  };
+
   outputs = {
     self,
     nixpkgs,

systems/jellybee/configuration.nix

@@ -14,6 +14,7 @@
     ../../common/services/rclone-webdav-sync.nix
     ../../common/services/silverbullet.nix
     ../../common/services/tailscale-serve.nix
+    ../../common/services/roam-location.nix
   ];
 
   boot = {
@@ -83,6 +84,8 @@
     };
   };
 
+  my.services.roam-location.enable = true;
+
   my = {
     opencloud = {
       enable = true;
@@ -131,7 +134,7 @@
     tailscale = {
       enable = true;
       authKeyFile = config.age.secrets.tailscale_key.path;
-      extraSetFlags = ["--advertise-exit-node" "--advertise-routes=192.168.100.0/24"];
+      extraSetFlags = ["--advertise-exit-node"];
     };
     jellyfin = {
       enable = true;