From 153ca2c1f056f834a3ca42e8cffe98e74d48496c Mon Sep 17 00:00:00 2001
From: lingkai5wu <lingkai5wu@outlook.com>
Date: Fri, 18 Sep 2026 19:03:01 +0800
Subject: [PATCH] feat: restrict AdGuard Home, Backrest, and qBittorrent to
 internal network

---
 conf.d/adguardhome.conf.template     | 1 +
 conf.d/backrest.conf.template        | 1 +
 conf.d/qbittorrent.conf.template     | 1 +
 snippets/internal-only.conf.template | 2 ++
 4 files changed, 5 insertions(+)
 create mode 100644 snippets/internal-only.conf.template

diff --git a/conf.d/adguardhome.conf.template b/conf.d/adguardhome.conf.template
index ce99cad..c46ecd9 100644
--- a/conf.d/adguardhome.conf.template
+++ b/conf.d/adguardhome.conf.template
@@ -5,6 +5,7 @@ server {
     server_name adguard.${BASE_DOMAIN};
 
     include snippets/proxy.conf;
+    include snippets/internal-only.conf;
 
     location / {
         proxy_pass http://adguardhome;
diff --git a/conf.d/backrest.conf.template b/conf.d/backrest.conf.template
index 3b1bd7c..e557460 100644
--- a/conf.d/backrest.conf.template
+++ b/conf.d/backrest.conf.template
@@ -5,6 +5,7 @@ server {
     server_name backrest.${BASE_DOMAIN};
 
     include snippets/proxy.conf;
+    include snippets/internal-only.conf;
 
     location / {
         proxy_pass http://backrest:9898;
diff --git a/conf.d/qbittorrent.conf.template b/conf.d/qbittorrent.conf.template
index 5b52f6d..bddc427 100644
--- a/conf.d/qbittorrent.conf.template
+++ b/conf.d/qbittorrent.conf.template
@@ -5,6 +5,7 @@ server {
     server_name qbt.${BASE_DOMAIN};
 
     include snippets/proxy.conf;
+    include snippets/internal-only.conf;
 
     location / {
         proxy_pass http://qbittorrent:8080;
diff --git a/snippets/internal-only.conf.template b/snippets/internal-only.conf.template
new file mode 100644
index 0000000..232b40d
--- /dev/null
+++ b/snippets/internal-only.conf.template
@@ -0,0 +1,2 @@
+allow 192.168.10.0/24;
+deny all;