Commit 09b78e7

@@ -5,6 +5,7 @@
         instances = {
           internal = {
             name = "runner-internal";
+            cacheProxyPort = 4000;
             servers = {
               gateOfInfinity = {
                 url = "https://git.net.trin.one";
@@ -16,9 +17,6 @@
               "ubuntu-latest:docker://ghcr.io/catthehacker/ubuntu:act-latest"
               "nixos-latest:docker://git.net.trin.one/hpcesia/nix-act-image:latest-x86_64-linux"
             ];
-            extraSettings = {
-              container.network = "host";
-            };
           };
           codeberg = {
             name = "runner-codeberg";

@@ -56,8 +56,23 @@
     lines = entryLines config e;
   in "handle {\n${lib.concatMapStrings (l: "\t${l}\n") lines}}";
 
-  forwardAuthBlock = ''
-    forward_auth unix//run/tailscale.nginx-auth.sock {
+  forwardAuthBlock = let
+    podmanRanges = [
+      "10.88.0.0/16"
+      "10.89.0.0/16"
+      "10.90.0.0/16"
+      "10.91.0.0/16"
+      "10.92.0.0/16"
+      "10.93.0.0/16"
+      "10.94.0.0/16"
+      "10.95.0.0/16"
+      "fd00::/8"
+    ];
+  in ''
+    @tailnet-clients {
+      not remote_ip ${lib.concatStringsSep " " podmanRanges}
+    }
+    forward_auth @tailnet-clients unix//run/tailscale.nginx-auth.sock {
         uri /auth
         header_up Remote-Addr {remote_host}
         header_up Remote-Port {remote_port}