From 08791a7d74363400db594a9ce49f1bdea8811660 Mon Sep 17 00:00:00 2001 From: MrSnowy Date: Tue, 7 Jul 2026 17:07:19 +0200 Subject: [PATCH] bump bump --- default.nix | 25 +- hosts/desktop/hjem-rum/snowy.nix | 8 +- hosts/desktop/services/llm.nix | 4 +- hosts/desktop/system/configuration.nix | 56 +++- hosts/desktop/system/programs.nix | 20 +- hosts/snowcloud/default.nix | 3 +- hosts/snowcloud/services/caddy.nix | 6 + hosts/snowcloud/services/tangled.nix | 24 +- hosts/snowlab/containers/base.nix | 20 +- hosts/snowlab/containers/default.nix | 1 + hosts/snowlab/containers/frigate.nix | 290 ++++++++++++++++++ hosts/snowlab/containers/hass/default.nix | 5 +- hosts/snowlab/default.nix | 3 +- hosts/snowlab/services/blocky.nix | 5 +- hosts/snowlab/services/caddy.nix | 31 +- hosts/snowlab/services/default.nix | 2 +- hosts/snowlab/services/mqtt.nix | 36 +++ hosts/snowlab/services/notify.nix | 27 +- .../snowlab/system/hardware-configuration.nix | 2 +- hosts/snowlab/system/network.nix | 47 ++- hosts/snowlab/system/ports.nix | 2 + justfile | 36 ++- modules/sops/snowlab.nix | 36 +++ modules/sops/snowlab/fmd-server.env | 11 + modules/sops/snowlab/frigate.env | 34 ++ modules/sops/snowlab/mqtt.yaml | 39 +++ modules/sops/snowlab/ntfy.env | 6 +- 27 files changed, 693 insertions(+), 86 deletions(-) create mode 100644 hosts/snowlab/containers/frigate.nix create mode 100644 hosts/snowlab/services/mqtt.nix create mode 100644 modules/sops/snowlab/fmd-server.env create mode 100644 modules/sops/snowlab/frigate.env create mode 100644 modules/sops/snowlab/mqtt.yaml diff --git a/default.nix b/default.nix index 80a02b5..432a07b 100644 --- a/default.nix +++ b/default.nix @@ -13,28 +13,25 @@ let unstable = import pins.nixpkgs-unstable { config.allowUnfree = true; }; + custom = import /mnt/SnowData/snowy/Documents/repos/nixpkgs { config.allowUnfree = true; }; - tauon-fix = import pins.tauon-fix { - - }; + tauon-fix = import pins.tauon-fix { }; }; - - # temp_pkgs = import pins.nixpkgs-stable { }; in { - inherit pins; + # inherit pins; # inherit repos; hosts = { desktop = - let - temp_pkgs = import pins.nixpkgs-unstable { }; - in - nlib.nixosHost rec { + # let + # temp_pkgs = import pins.nixpkgs-unstable { }; + # in + nlib.nixosHost { # nixpkgs = pins.nixpkgs-unstable; system = "x86_64-linux"; @@ -74,14 +71,14 @@ in ]; }; - snowlab = nlib.nixosHost rec { + snowlab = nlib.nixosHost { nixpkgs = pins.nixpkgs-stable; system = "x86_64-linux"; specialArgs = { inherit repos; args = { - inherit nixpkgs; + # inherit nixpkgs; flakes = nlib.gen_flakes [ "sops-nix" ]; @@ -94,14 +91,14 @@ in ]; }; - snowcloud = nlib.nixosHost rec { + snowcloud = nlib.nixosHost { nixpkgs = pins.nixpkgs-stable; system = "x86_64-linux"; specialArgs = { inherit repos; args = { - inherit nixpkgs; + # inherit nixpkgs; flakes = nlib.gen_flakes [ "sops-nix" "home-manager" diff --git a/hosts/desktop/hjem-rum/snowy.nix b/hosts/desktop/hjem-rum/snowy.nix index c774ec1..4b5fd29 100644 --- a/hosts/desktop/hjem-rum/snowy.nix +++ b/hosts/desktop/hjem-rum/snowy.nix @@ -70,8 +70,8 @@ # p2pool # keyguard # bitwarden-desktop - quickshell - pear-desktop + # quickshell + # pear-desktop r2modman hoppscotch # ani-cli @@ -93,7 +93,7 @@ delta nixpkgs-review just - jujutsu + # jujutsu sops android-tools playerctl @@ -103,7 +103,7 @@ ## language servers bash-language-server - hyprls + # hyprls kdePackages.qtdeclarative kdePackages.qtutilities python313Packages.python-lsp-server diff --git a/hosts/desktop/services/llm.nix b/hosts/desktop/services/llm.nix index e7e4ab6..5ce046c 100644 --- a/hosts/desktop/services/llm.nix +++ b/hosts/desktop/services/llm.nix @@ -14,7 +14,7 @@ let src = pkgs.fetchFromGitHub { owner = "TheTom"; repo = "llama-cpp-turboquant"; - tag = "feature-turboquant-kv-cache-b9914-0c8fcfe"; + tag = "feature-turboquant-kv-cache-b9919-558c6b7"; hash = "sha256-zINppNHgGgN60ylOAi5TxFtS8jQ543t3hAOpmfcWEfM="; leaveDotGit = true; postFetch = '' @@ -47,6 +47,8 @@ in services.llama-swap = { enable = true; + listenAddress = "0.0.0.0"; + openFirewall = true; port = 11343; settings = { logLevel = "info"; diff --git a/hosts/desktop/system/configuration.nix b/hosts/desktop/system/configuration.nix index a75a0f0..9912517 100644 --- a/hosts/desktop/system/configuration.nix +++ b/hosts/desktop/system/configuration.nix @@ -52,18 +52,66 @@ swapDevices = [ { - device = "/swapfile"; - size = 16 * 1024; + device = "/swap/swapfile"; + size = 8 * 1024; } ]; + services.btrfs.autoScrub = { + enable = true; + interval = "daily"; + }; + + fileSystems = { + "/".options = [ + "compress=zstd:6" + "discard=async" + ]; + "/nix".options = [ + "compress=zstd:6" + "noatime" + "discard=async" + ]; + "/swap".options = [ "noatime" ]; + "/var/log" = { + options = [ + # "subvol=log" + "compress=zstd:3" + "noatime" + "discard=async" + ]; + + neededForBoot = true; + }; + "/var/lib".options = [ + "compress=zstd:6" + "noatime" + "discard=async" + ]; + }; + # Use the systemd-boot EFI boot loader. boot = { - supportedFilesystems = [ "ntfs" ]; + supportedFilesystems = [ + "ntfs" + "btrfs" + ]; # kernelPackages = pkgs.linuxPackages_cachyos-rc; # kernelPackages = pkgs.linuxPackages_cachyos; # kernelPackages = pkgs.linuxPackages_lqx; - kernelPackages = pkgs.linuxPackages_zen; + # kernelPackages = pkgs.linuxPackages_zen; + kernelPackages = pkgs.linuxPackages; + + # kernelPatches = [ + # # Patch for fixing a crash with certain games + # { + # name = "amdgpu-fix-check-amdgpu_hmm_invalidate_gfx"; + # patch = pkgs.fetchpatch { + # url = "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/patch/?id=52f650963d8825e97a0ccdd2b616f8a01d9d3d38"; + # sha256 = "sha256-9M7jX5nPjpmn4hr5tCQ6NfasSMtzga8v9nxNtuEDAgg="; + # }; + # } + # ]; kernelParams = [ "amdgpu.noretry=1" diff --git a/hosts/desktop/system/programs.nix b/hosts/desktop/system/programs.nix index 360dd50..47a64f7 100644 --- a/hosts/desktop/system/programs.nix +++ b/hosts/desktop/system/programs.nix @@ -34,11 +34,11 @@ nix-ld.enable = true; virt-manager.enable = true; - hyprland = { - enable = true; - xwayland.enable = true; - withUWSM = true; - }; + # hyprland = { + # enable = true; + # xwayland.enable = true; + # withUWSM = true; + # }; niri = { enable = true; @@ -62,11 +62,11 @@ pinentryPackage = pkgs.pinentry-gnome3; }; - winbox = { - package = pkgs.winbox4; - openFirewall = true; - enable = true; - }; + # winbox = { + # package = pkgs.winbox4; + # openFirewall = true; + # enable = true; + # }; # gamemode = { # enable = true; diff --git a/hosts/snowcloud/default.nix b/hosts/snowcloud/default.nix index bf04498..8e2df5b 100644 --- a/hosts/snowcloud/default.nix +++ b/hosts/snowcloud/default.nix @@ -1,6 +1,7 @@ { args, repos, + modulesPath, ... }: { @@ -25,7 +26,7 @@ # ]; imports = [ - "${args.nixpkgs}/nixos/modules/profiles/minimal.nix" # Disables some options by default for a minimal installation: https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/profiles/minimal.nix + "${modulesPath}/profiles/minimal.nix" # Disables some options by default for a minimal installation: https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/profiles/minimal.nix ./system/configuration.nix ./containers ./services diff --git a/hosts/snowcloud/services/caddy.nix b/hosts/snowcloud/services/caddy.nix index 4247cae..b1bb022 100644 --- a/hosts/snowcloud/services/caddy.nix +++ b/hosts/snowcloud/services/caddy.nix @@ -98,6 +98,12 @@ } } + fmd.mrsnowy.dev { + reverse_proxy snowlab.mrsnowy.dev:3050 { + header_up Host {host} + } + } + # hass.mrsnowy.dev { # reverse_proxy snowlab.mrsnowy.dev:8123 # } diff --git a/hosts/snowcloud/services/tangled.nix b/hosts/snowcloud/services/tangled.nix index fb8a640..2013816 100644 --- a/hosts/snowcloud/services/tangled.nix +++ b/hosts/snowcloud/services/tangled.nix @@ -33,7 +33,7 @@ in ''; knotmirrors = [ - "https://mirror.tangled.mrsnowy.dev" + # "https://mirror.tangled.mrsnowy.dev" "https://mirror.tangled.network" # seems to be dead? ]; @@ -45,16 +45,16 @@ in }; }; - # Index for repositories on the tangled network (i think..) - knotmirror = { - enable = true; - listenAddr = "127.0.0.1:${toString config.ports.tangled.knotmirror.public}"; - adminListenAddr = "127.0.0.1:${toString config.ports.tangled.knotmirror.admin}"; - hostname = "mirror.tangled.mrsnowy.dev"; - dbUrl = "mewewe"; # black magic - fullNetwork = false; - tap.port = config.ports.tangled.knotmirror.tap; - }; + # # Index for repositories on the tangled network (i think..) + # knotmirror = { + # enable = true; + # listenAddr = "127.0.0.1:${toString config.ports.tangled.knotmirror.public}"; + # adminListenAddr = "127.0.0.1:${toString config.ports.tangled.knotmirror.admin}"; + # hostname = "mirror.tangled.mrsnowy.dev"; + # dbUrl = "mewewe"; # black magic + # fullNetwork = false; + # tap.port = config.ports.tangled.knotmirror.tap; + # }; # Spindle is for CI (not really ready yet, requires docker) # spindle = { @@ -85,7 +85,7 @@ in ''; # harden these bad boys... man - systemd.services.tap-knotmirror.serviceConfig.DynamicUser = true; + # systemd.services.tap-knotmirror.serviceConfig.DynamicUser = true; systemd.services.knotmirror = { after = [ "sops-install-secrets.service" ]; wants = [ "sops-install-secrets.service" ]; diff --git a/hosts/snowlab/containers/base.nix b/hosts/snowlab/containers/base.nix index 9922b4c..8ef961e 100644 --- a/hosts/snowlab/containers/base.nix +++ b/hosts/snowlab/containers/base.nix @@ -1,9 +1,18 @@ -{ lib, pkgs, ... }: { +{ + lib, + pkgs, + modulesPath, + ... +}: +{ imports = [ + "${modulesPath}/profiles/minimal.nix" ../../../modules/shared/system/minimizing.nix ../../../modules/shared/system/shell.nix ]; + nixpkgs.config.allowUnfree = true; + nix = { enable = false; gc.automatic = lib.mkForce false; @@ -41,11 +50,10 @@ networking = { useDHCP = false; - # Changes the gateway to the Network Address of the bridge, so that it has access to the internet - # The bridge has access to the internet - defaultGateway = { - address = "10.0.0.1"; - }; + + # defaultGateway = { + # address = "10.0.0.1"; + # }; nameservers = [ "10.0.0.1" diff --git a/hosts/snowlab/containers/default.nix b/hosts/snowlab/containers/default.nix index dfb5095..99a8fca 100644 --- a/hosts/snowlab/containers/default.nix +++ b/hosts/snowlab/containers/default.nix @@ -1,5 +1,6 @@ { ... }: { imports = [ ./hass + ./frigate.nix ]; } diff --git a/hosts/snowlab/containers/frigate.nix b/hosts/snowlab/containers/frigate.nix new file mode 100644 index 0000000..6ab8491 --- /dev/null +++ b/hosts/snowlab/containers/frigate.nix @@ -0,0 +1,290 @@ +{ config, ... }: +{ + containers.frigate = { + autoStart = true; + ephemeral = true; + privateUsers = "identity"; + + privateNetwork = true; + localAddress = "10.0.0.3/24"; + hostBridge = "bridgeNAT"; + + bindMounts = { + "/var/lib/frigate" = { + hostPath = "/var/lib/frigate"; + isReadOnly = false; + }; + "/run/secrets/frigate.env" = { + hostPath = "${config.sops.secrets.frigate_env.path}"; + isReadOnly = true; + }; + + "/run/opengl-driver" = { + hostPath = "/run/opengl-driver"; + isReadOnly = true; + }; + "/dev/nvidia0" = { + hostPath = "/dev/nvidia0"; + isReadOnly = false; + }; + "/dev/nvidiactl" = { + hostPath = "/dev/nvidiactl"; + isReadOnly = false; + }; + "/dev/nvidia-modeset" = { + hostPath = "/dev/nvidia-modeset"; + isReadOnly = false; + }; + "/dev/nvidia-uvm" = { + hostPath = "/dev/nvidia-uvm"; + isReadOnly = false; + }; + "/dev/nvidia-uvm-tools" = { + hostPath = "/dev/nvidia-uvm-tools"; + isReadOnly = false; + }; + }; + + allowedDevices = [ + { + modifier = "rw"; + node = "/dev/nvidiactl"; + } + { + modifier = "rw"; + node = "/dev/nvidia0"; + } + { + node = "/dev/nvidia-modeset"; + modifier = "rw"; + } + { + modifier = "rw"; + node = "/dev/nvidia-uvm"; + } + { + modifier = "rw"; + node = "/dev/nvidia-uvm-tools"; + } + ]; + + # forwardPorts = [ + # { + # containerPort = 8554; + # hostPort = 8554; + # protocol = "tcp"; + # } + # { + # containerPort = 8555; + # hostPort = 8555; + # protocol = "tcp"; + # } + # { + # containerPort = 8555; + # hostPort = 8555; + # protocol = "udp"; + # } + # ]; + + # extraFlags = [ + # "--bind=/var/lib/frigate:/var/lib/frigate:idmap" + # "--bind=/run/secrets.d/13/frigate_env:/run/secrets/frigate_env:rootidmap" + # ]; + + config = + { + config, + pkgs, + lib, + ... + }: + { + system.stateVersion = "26.05"; + + # Make networking bridge work :P + networking.defaultGateway.address = "10.0.0.1"; + + imports = [ + ./base.nix + ]; + + # config stuff lol + + networking.firewall = { + allowedTCPPorts = [ + 80 + 8555 + 8554 + ]; + allowedUDPPorts = [ + 8555 + ]; + }; + + # Cuda stuffz + environment.systemPackages = [ config.boot.kernelPackages.nvidiaPackages.stable.bin ]; + hardware.graphics.enable = true; + nixpkgs.config.cudaSupport = true; + + nix.settings = { + substituters = [ + "https://cache.nixos-cuda.org" + ]; + trusted-public-keys = [ + "cache.nixos-cuda.org:74DUi4Ye579gUqzH4ziL9IyiJBlDpMRn9MBN8oNan9M=" + ]; + }; + + # frig-it + services = { + go2rtc = { + enable = true; + settings = { + api.listen = ":1984"; + + streams = { + foscam-zwart = [ + "rtsp://\${FRIGATE_FOSCAM_RTSP}/videoMain" + ]; + thingio = [ + "rtsp://\${FRIGATE_THINGIO_RTSP}/ch0" + ]; + }; + }; + }; + + frigate = { + enable = true; + + # package = pkgs.frigate.overrideAttrs; + + checkConfig = false; # disable since we use env vars ;P + + # disable nginx fuckiness + # Set db path to + hostname = "frigate.mrsnowy.dev"; + settings = { + database.path = "/var/lib/frigate/frigate.db"; # keep it on external drive until we have enough storage on silo + + networking.ipv6.enabled = true; + ffmpeg.hwaccel_args = "preset-nvidia"; + + mqtt = { + enabled = true; + host = "10.0.0.1"; + user = "{FRIGATE_MQTT_USER}"; + password = "{FRIGATE_MQTT_PASS}"; + }; + + go2rtc = { + streams = { + foscam-zwart = [ + "rtsp://{FRIGATE_FOSCAM_RTSP}/videoMain" + ]; + thingio = [ + "rtsp://{FRIGATE_THINGIO_RTSP}/ch0" + ]; + }; + }; + + detectors = { + onnx_0 = { + type = "onnx"; + # device = "CUDA"; + }; + }; + + model = { + model_type = "yolo-generic"; + width = 640; + height = 640; + input_tensor = "nchw"; + input_dtype = "float"; + path = "/var/lib/frigate/models/yolov9-s.onnx"; + labelmap_path = "/var/lib/frigate/models/labelmap.txt"; + }; + + cameras = { + foscam-zwart = { + enabled = false; + ffmpeg.inputs = [ + { + path = "rtsp://{FRIGATE_FOSCAM_RTSP}/videoSub"; + roles = [ "detect" ]; + } + { + path = "rtsp://{FRIGATE_FOSCAM_RTSP}/videoMain"; + roles = [ "record" ]; + } + { + path = "rtsp://{FRIGATE_FOSCAM_RTSP}/audio"; + roles = [ "audio" ]; + } + ]; + onvif = { + host = "{FRIGATE_FOSCAM_IP}"; + port = 888; + user = "{FRIGATE_FOSCAM_ONVIF_USER}"; + password = "{FRIGATE_FOSCAM_ONVIF_PASS}"; + }; + + detect = { + enabled = false; # <---- disable detection until you have a working camera feed + width = 640; + height = 360; + }; + }; + thingio = { + enabled = true; + ffmpeg.inputs = [ + { + path = "rtsp://{FRIGATE_THINGIO_RTSP}/ch1"; + roles = [ "detect" ]; + } + { + path = "rtsp://{FRIGATE_THINGIO_RTSP}/ch0"; + roles = [ + "record" + "audio" + ]; + } + ]; + onvif = { + host = "{FRIGATE_THINGIO_IP}"; + port = 80; + user = "{FRIGATE_THINGIO_ONVIF_USER}"; + password = "{FRIGATE_THINGIO_ONVIF_PASS}"; + }; + detect = { + enabled = false; + width = 640; + height = 360; + }; + }; + }; + }; + }; + }; + + systemd.services = { + frigate.serviceConfig = { + + # KILL KILL KILL MWAHAHAHHAA + TimeoutStopSec = "8s"; + KillMode = "control-group"; + + EnvironmentFile = lib.mkAfter [ + "/run/secrets/frigate.env" + ]; + }; + + go2rtc.serviceConfig.EnvironmentFile = "/run/secrets/frigate.env"; + }; + }; + }; + + systemd.services."container@frigate.service" = { + after = [ "sops-install-secrets.service" ]; + wants = [ "sops-install-secrets.service" ]; + }; +} diff --git a/hosts/snowlab/containers/hass/default.nix b/hosts/snowlab/containers/hass/default.nix index 7cf3e28..21f20d7 100644 --- a/hosts/snowlab/containers/hass/default.nix +++ b/hosts/snowlab/containers/hass/default.nix @@ -46,10 +46,6 @@ ./../base.nix ]; - nixpkgs.config = { - allowUnfree = true; - }; - # config stuff lol networking.firewall.allowedTCPPorts = [ 8123 ]; @@ -95,6 +91,7 @@ customComponents = [ (pkgs.home-assistant.python3Packages.callPackage ./ha-bambulab.nix { }) + pkgs.home-assistant-custom-components.frigate # (pkgs.home-assistant.python3Packages.callPackage ./hacs.nix { # # inherit (home-assistant.python3Packages) ; # }) diff --git a/hosts/snowlab/default.nix b/hosts/snowlab/default.nix index 15fe2c9..82aed23 100644 --- a/hosts/snowlab/default.nix +++ b/hosts/snowlab/default.nix @@ -1,5 +1,6 @@ { args, + modulesPath, ... }: { @@ -8,7 +9,7 @@ ]; imports = [ - "${args.nixpkgs}/nixos/modules/profiles/minimal.nix" # Disables some options by default for a minimal installation: https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/profiles/minimal.nix + "${modulesPath}/profiles/minimal.nix" # Disables some options by default for a minimal installation: https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/profiles/minimal.nix ./system/configuration.nix ../../modules/sops/snowlab.nix ../../modules/snownet diff --git a/hosts/snowlab/services/blocky.nix b/hosts/snowlab/services/blocky.nix index 1d6aee9..52af48d 100644 --- a/hosts/snowlab/services/blocky.nix +++ b/hosts/snowlab/services/blocky.nix @@ -26,10 +26,13 @@ mapping = { "s3.mrsnowy.dev" = "192.168.1.200"; "ente.mrsnowy.dev" = "192.168.1.200"; + "vaultwarden.mrsnowy.dev" = "192.168.1.200"; "ntfy.mrsnowy.dev" = "192.168.1.200"; "mollysocket.mrsnowy.dev" = "192.168.1.200"; + "fmd.mrsnowy.dev" = "192.168.1.200"; + "hass.mrsnowy.dev" = "192.168.1.200"; - "vaultwarden.mrsnowy.dev" = "192.168.1.200"; + "frigate.mrsnowy.dev" = "192.168.1.200"; }; }; }; diff --git a/hosts/snowlab/services/caddy.nix b/hosts/snowlab/services/caddy.nix index 403ec7a..3b91fc9 100644 --- a/hosts/snowlab/services/caddy.nix +++ b/hosts/snowlab/services/caddy.nix @@ -30,18 +30,44 @@ reverse_proxy :${toString config.ports.garage.s3_api} { flush_interval -1 # low-latency mode } + tls { + resolvers 1.1.1.1 8.8.8.8 + } } ntfy.mrsnowy.dev { reverse_proxy :${toString config.ports.ntfy} + tls { + resolvers 1.1.1.1 8.8.8.8 + } } vaultwarden.mrsnowy.dev { reverse_proxy :${toString config.ports.vaultwarden} + tls { + resolvers 1.1.1.1 8.8.8.8 + } } mollysocket.mrsnowy.dev { reverse_proxy :${toString config.ports.mollysocket} + tls { + resolvers 1.1.1.1 8.8.8.8 + } + } + + fmd.mrsnowy.dev { + reverse_proxy :${toString config.ports.fmd-server} + tls { + resolvers 1.1.1.1 8.8.8.8 + } + } + + frigate.mrsnowy.dev { + reverse_proxy 10.0.0.1:${toString config.ports.frigate} + tls { + resolvers 1.1.1.1 8.8.8.8 + } } hass.mrsnowy.dev { @@ -50,12 +76,7 @@ # } header -Alt-Svc # Strip HTTP3 HEADER reverse_proxy :8123 - encode zstd gzip tls { - dns porkbun { - api_key {$CADDY_PORKBUN_KEY} - api_secret_key {$CADDY_PORKBUN_SECRET} - } resolvers 1.1.1.1 8.8.8.8 } } diff --git a/hosts/snowlab/services/default.nix b/hosts/snowlab/services/default.nix index 14196c3..fe1ea81 100644 --- a/hosts/snowlab/services/default.nix +++ b/hosts/snowlab/services/default.nix @@ -8,7 +8,7 @@ ./caddy.nix ./random.nix ./blocky.nix - ./frigate.nix ./notify.nix + ./mqtt.nix ]; } diff --git a/hosts/snowlab/services/mqtt.nix b/hosts/snowlab/services/mqtt.nix new file mode 100644 index 0000000..ec3c002 --- /dev/null +++ b/hosts/snowlab/services/mqtt.nix @@ -0,0 +1,36 @@ +{ config, ... }: { + services.mosquitto = { + enable = true; + + dataDir = "/var/lib/mosquitto"; + persistence = true; + + settings = { }; + + listeners = [ + { + address = "0.0.0.0"; + port = 1883; + + settings.allow_anonymous = false; + + users = { + hass = { + acl = [ "readwrite frigate/#" ]; + passwordFile = config.sops.secrets.mqtt_hass.path; + }; + + frigate = { + acl = [ "readwrite frigate/#" ]; + passwordFile = config.sops.secrets.mqtt_frigate.path; + }; + }; + } + ]; + }; + + systemd.services.mosquitto = { + after = [ "sops-install-secrets.service" ]; + wants = [ "sops-install-secrets.service" ]; + }; +} diff --git a/hosts/snowlab/services/notify.nix b/hosts/snowlab/services/notify.nix index 24f6370..c849d57 100644 --- a/hosts/snowlab/services/notify.nix +++ b/hosts/snowlab/services/notify.nix @@ -41,12 +41,33 @@ # allowed_uuids = [ "*" ]; }; }; + + fmd-server = { + enable = true; + environmentFile = config.sops.secrets.fmd-server_env.path; + databaseDirectory = "/mnt/silo/fmd/db"; + settings = { + PortSecure = ""; + PortInsecure = "${toString config.ports.fmd-server}"; + UserIdLength = 20; + RemoteIpHeader = "X-Forwarded-For"; + + MetricsAddrPort = ""; # TODO ! For prometheus ! + }; + }; }; - # fmd-server = { - # enable = true; + systemd.services.mollysocket = { + after = [ "sops-install-secrets.service" ]; + wants = [ "sops-install-secrets.service" ]; + }; - # }; + users.groups.fmd-server_db = { }; + systemd.services.fmd-server = { + serviceConfig.SupplementaryGroups = "fmd-server_db"; + after = [ "sops-install-secrets.service" ]; + wants = [ "sops-install-secrets.service" ]; + }; systemd.services.ntfy-sh = { after = [ diff --git a/hosts/snowlab/system/hardware-configuration.nix b/hosts/snowlab/system/hardware-configuration.nix index 5a624d2..95cb089 100644 --- a/hosts/snowlab/system/hardware-configuration.nix +++ b/hosts/snowlab/system/hardware-configuration.nix @@ -56,5 +56,5 @@ # networking.interfaces.ens3.useDHCP = lib.mkDefault true; nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; - hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; + hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; } diff --git a/hosts/snowlab/system/network.nix b/hosts/snowlab/system/network.nix index ed9081c..ba12ad2 100644 --- a/hosts/snowlab/system/network.nix +++ b/hosts/snowlab/system/network.nix @@ -41,6 +41,14 @@ firewall = { enable = true; + # TODO! maybe double route this with caddy..? + interfaces."snownet0".allowedTCPPorts = [ + config.ports.vaultwarden + config.ports.ntfy + config.ports.mollysocket + config.ports.fmd-server + ]; + allowedTCPPorts = [ # HTTP 80 @@ -54,10 +62,10 @@ # DNS 53 - # TODO! fix this to only expose on the snownet (or simply double route caddy..?) - config.ports.vaultwarden - config.ports.ntfy - config.ports.mollysocket + 8554 + 8555 + + config.ports.frigate ]; allowedUDPPorts = [ # HTTP3 @@ -69,6 +77,8 @@ # Allow inbound traffic for the DHCP server 67 + + 8555 ]; }; }; @@ -111,6 +121,35 @@ # networkConfig.Bridge = "bridgeNAT"; # }; + networking.nftables.ruleset = '' + table ip bridgeNAT { + + chain PREROUTING { + type nat hook prerouting priority dstnat; policy accept; + tcp dport ${toString config.ports.frigate} dnat to 10.0.0.3:80 + udp dport 8555 dnat to 10.0.0.3:8555 + tcp dport 8555 dnat to 10.0.0.3:8555 + tcp dport 8554 dnat to 10.0.0.3:8554 + } + + chain OUTPUT { + type nat hook output priority dstnat; policy accept; + tcp dport ${toString config.ports.frigate} dnat to 10.0.0.3:80 + udp dport 8555 dnat to 10.0.0.3:8555 + tcp dport 8555 dnat to 10.0.0.3:8555 + tcp dport 8554 dnat to 10.0.0.3:8554 + } + + chain POSTROUTING { + type nat hook postrouting priority srcnat; policy accept; + ip daddr 10.0.0.3 tcp dport 80 masquerade + ip daddr 10.0.0.3 udp dport 8555 masquerade + ip daddr 10.0.0.3 tcp dport 8555 masquerade + ip daddr 10.0.0.3 tcp dport 8554 masquerade + } + } + ''; + # networking.nftables.ruleset = '' # table inet filter { # chain input { diff --git a/hosts/snowlab/system/ports.nix b/hosts/snowlab/system/ports.nix index 5934c31..ea45c3a 100644 --- a/hosts/snowlab/system/ports.nix +++ b/hosts/snowlab/system/ports.nix @@ -21,6 +21,8 @@ vaultwarden = 3020; ntfy = 3030; mollysocket = 3040; + fmd-server = 3050; + frigate = 3060; postgres = 5432; pgdog = 6432; diff --git a/justfile b/justfile index 3af75be..4b65ae4 100644 --- a/justfile +++ b/justfile @@ -28,12 +28,21 @@ deploy target ssh_target=target: # 3. printf "\n\e[1;34m%s\e[0m \e[34m%s \e[1m%s\e[0m\n" "3." "Building derivation on" "\"{{ ssh_target }}\"" - BUILD=$(ssh {{ ssh_target }} "bash -c 'nix run nixpkgs#nix-output-monitor -- build \"${derivation}^*\" --print-out-paths --no-link'") + BUILD=$(ssh {{ ssh_target }} bash -s "${derivation}" <<-'REMOTE' + set -euo pipefail + DERIVATION=$1 - # 4. - printf "\n\e[1;34m%s\e[0m \e[34m%s\e[0m\n" "4." "Showing diff" - ssh {{ ssh_target }} "bash -c 'nix run nixpkgs#nvd -- --color always diff /run/current-system ${BUILD}'" + BUILD=$(nix run nixpkgs#nix-output-monitor -- build "${DERIVATION}^out" --print-out-paths --no-link) + # 4. + printf "\n\e[1;34m%s\e[0m \e[34m%s\e[0m\n" "4." "Showing diff" >&2 + nix run nixpkgs#nvd -- --color always diff /run/current-system "$BUILD" >&2 + + echo "$BUILD" + REMOTE + ) + + # 5. printf "\n\e[33m%s\e[0m\n" "Continue deploying? (Y/n)" read ans if [[ "$ans" = "y" || "$ans" = "" ]]; then @@ -43,24 +52,29 @@ deploy target ssh_target=target: # 5. 1/2 printf "\n\e[1;34m%s\e[0m \e[34m%s\e[0m\n" "5." "Deploying with magic rollback" ssh {{ ssh_target }} bash -s "${BUILD}" "${UNIT}" <<-'REMOTE' - BUILD=$1; UNIT=$2; + set -euo pipefail + BUILD=$1; UNIT=$2; - sudo systemd-run \ + sudo systemd-run \ --unit="$UNIT" \ --description="Magic rollback" \ --on-active=40 \ -- bash -c "echo 'Rewinding back to previous generation' && /nix/var/nix/profiles/system/bin/switch-to-configuration test" - sudo "$BUILD/bin/switch-to-configuration" test + sudo "$BUILD/bin/switch-to-configuration" test REMOTE # 5. 2/2 printf "\n\e[1;34m%s\e[0m \e[34m%s\e[0m\n" "6." "Finalizing deployment" - ssh {{ ssh_target }} "bash -c ' - sudo systemctl stop ${UNIT}.timer ${UNIT}.service || true && - sudo nix-env -p /nix/var/nix/profiles/system --set \"${BUILD}\" && + + ssh {{ ssh_target }} bash -s "${BUILD}" "${UNIT}" <<-'REMOTE' + set -euo pipefail + BUILD=$1; UNIT=$2; + + sudo systemctl stop ${UNIT}.timer ${UNIT}.service || true + sudo nix-env -p /nix/var/nix/profiles/system --set "$BUILD" sudo /nix/var/nix/profiles/system/bin/switch-to-configuration switch - '" + REMOTE printf "\n\e[1;32m%s\e[0m\n" "Deployment successful!" else diff --git a/modules/sops/snowlab.nix b/modules/sops/snowlab.nix index 7587cf1..db72ac3 100644 --- a/modules/sops/snowlab.nix +++ b/modules/sops/snowlab.nix @@ -75,6 +75,42 @@ mode = "0400"; restartUnits = [ "mollysocket.service" ]; }; + + fmd-server_env = { + format = "dotenv"; + sopsFile = ./snowlab/fmd-server.env; + + mode = "0400"; + restartUnits = [ "fmd-server.service" ]; + }; + + frigate_env = { + format = "dotenv"; + sopsFile = ./snowlab/frigate.env; + + mode = "0400"; + # owner = "vu-frigate-0"; + # group = "vg-frigate-0"; + restartUnits = [ "container@frigate.service" ]; + }; + + mqtt_hass = { + format = "yaml"; + sopsFile = ./snowlab/mqtt.yaml; + key = "hass_pass"; + + mode = "0400"; + restartUnits = [ "mosquitto.service" ]; + }; + + mqtt_frigate = { + format = "yaml"; + sopsFile = ./snowlab/mqtt.yaml; + key = "frigate_pass"; + + mode = "0400"; + restartUnits = [ "mosquitto.service" ]; + }; }; }; } diff --git a/modules/sops/snowlab/fmd-server.env b/modules/sops/snowlab/fmd-server.env new file mode 100644 index 0000000..dea6b0c --- /dev/null +++ b/modules/sops/snowlab/fmd-server.env @@ -0,0 +1,11 @@ +#ENC[AES256_GCM,data:eZLACAEkQT92U1eK,iv:sWF7lyV3iR02aUO05evEcbDNHO+MYNvXE9tkywoCSoQ=,tag:3yWxPUACE4ZBzIz5bonBIA==,type:comment] +FMD_REGISTRATIONTOKEN=ENC[AES256_GCM,data:hYR/xSpKRxWTvyUz36p9wsmhjPcs5DBMj9IFO2nZU96SKnLTWhTFRxdRRX7aL1ZiFT8UMzcXwCBrrcPzzmQ9HN5/e1eSRbGx0CXxhGyuqh+zQkaXS+oyQCSW3H+9uNzCLYJ0IB6wz7rJKPDDXfIYOVTcpkpd0JM4ufOOpOPbE8E=,iv:rKbXXk8TOttO9OvADqz92xgRmwFdqg6U6E4VfnLckd8=,tag:CV2KX5calBX3ioBq2JeJ5A==,type:str] +sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0K1MwU0w5REJWSWlMZ0Vt\neTQ4a2hhakJkQmc2OC9rTHVFa0Z1RGxiTXhzCmRlZklYTkZpRGJxaE0wVEtMaDlB\nYmUzaUZnMnkrcHlhK2l0c1Y4WFZmT28KLS0tIHNGWnlYMjNwT3NiU3NBTkNCTVpB\nVElLbGNvN2N4R3loOGpLYU43eE1jUncKgQVrpHr/wEjUckkceBhwKFDO7bq4PcvT\nxYZSL5XSbyZMxsagR4eF1BNtKT5lFhfNSxI6XstbY6Q2oejalk2Drg==\n-----END AGE ENCRYPTED FILE-----\n +sops_age__list_0__map_recipient=age1yjv3ngyz26qqggvef3ekwdw60dfvcmfd0l6n88vs3axux6vusdhsyzlts0 +sops_lastmodified=2026-07-05T00:14:57Z +sops_mac=ENC[AES256_GCM,data:uGt3gPYB7QgCysC2Jd7LYRHQ8987f+rhMIWGTxZbwLZzW7FHfjF4SD6+FqbESiPvC6W+wSuWvBXS5NdBPvtB9mGbdSOVkEARtPhU9ejYLt5gY6E+dzjob3kmY6JW4YK/W5v2dGE1ZBAaOl4EGTKqICW7SzIYYfnEV40dCUts1TE=,iv:uUX7Yag9OkL/G4bK9f8R3kxnQsAWb3UVPzVolysWWZk=,tag:eYbTZ+u7aXGYM/y0SDRGzg==,type:str] +sops_pgp__list_0__map_created_at=2026-07-05T00:14:17Z +sops_pgp__list_0__map_enc=-----BEGIN PGP MESSAGE-----\n\nhQIMA09oKgMfawMUARAAm2A+mtTgohHdlCym/VeSxcytCTRWW2RWbIaULU7JzW/W\nE6hS06vNTABUQpoIJgKWtBwETAzYZ3VmSQFLrN551Z/sfi+lISj5Zn6Ld7dc92p2\nbzuM+ofwtEWSirUovZeOp6UGRX0q5LK2NqPa56kYb3KLq20yCr6kjB1my6lFzd4q\nssLUsV788sZXvt8BG2i1EkaaAlRDIfuNi5hB3nPrkpwJ/4w/7JRseqs67/b2wJtq\n4LMhR182ApoEAEzn0Z8izFxOkloopL4/jOwtGPB1uta5+wu/pEl/NKdtpLyErtrp\nOIeVVPO1wBCxZcPogEHHWqVmkuQLvkfjZRVpbOjTAcO2LvCxkXa85OMtRn+yEw26\n/JFekYtPBnRrPVKs8F+yHxAbjwu8bvXOT9FZYYMBcESytyocnA1+1v9yFvIg8S5/\n7H9XO3fbSiaPZS/itvhihoBlYwDQrl6OuTEVk6SsLb1ln4Jb8buTi5ovD5rcZUvB\nryJZvCLc7OI+H0IrvT+UuiGvwWhsWf6HpctZhRzH87O5pkIOHXHwT5GlyUsY7Of9\nPC+gWcsuTfVLnU5MquHn4oVcw+8nR7xcRs4fQwCrrPeIN39bSgHqYPnaEp4qaEq/\npNkOdRi0OtehGYgYd936EFCV1TdsFQYYIn3AA+PWxSd2UJGwBpzCONS4qqzXC7XS\nXgGL1WntSFJaSUa3etfprCxElLshpxVdlKPC4cYs90pg4M9yEJCdkzymo0RrCoHX\n6jByzti2EiCgWN2EhMW6Lx51SrvZTHB8mFqFuuVg2FMvQ1keWFIhA4bY9GCrMQA=\n=u2p4\n-----END PGP MESSAGE----- +sops_pgp__list_0__map_fp=D40CE1579C09BFD7EF4AB7E631250420834310B5 +sops_unencrypted_suffix=_unencrypted +sops_version=3.13.1 diff --git a/modules/sops/snowlab/frigate.env b/modules/sops/snowlab/frigate.env new file mode 100644 index 0000000..388904d --- /dev/null +++ b/modules/sops/snowlab/frigate.env @@ -0,0 +1,34 @@ +#ENC[AES256_GCM,data:CeW/BRf+7yGn0GDq4EUqbln8lRDVtA==,iv:yC44S4WXhHr9xUmWeCOpFnPv+i7DKNfyfrJ1sY3uyHc=,tag:qhKTowKY580M1lpKchnYRA==,type:comment] +# +FRIGATE_MQTT_USER=ENC[AES256_GCM,data:mZvMQWXo7A==,iv:/2bB5TkBQw3OZsefmz5X0GPbgKXySm8wtce+sYcbDAk=,tag:2ZZvFGZKGA+ospw+oaEdGg==,type:str] +FRIGATE_MQTT_PASS=ENC[AES256_GCM,data:FKuH1POOEEeNVhLUnzZU5t15GEMffqj1AyuVEK0nInqwPq1V/+jSpRZ9uVYyViRaynBQlhkGiA0+wrnyC0DFXPc/crefzA7peWN5M/5AV2Fxl5xm9ei73dyv6PEotXEiL5M9Y31s9RVOtxLUGji8xEj/zrLWbdFgObCGZHB30S0=,iv:JETJf3NEB2ZK9ak2Qii0DanUiVHHstWffetmCtfGo3M=,tag:whtLeI4uslSlmXu7Ydq+/w==,type:str] +# +# +#ENC[AES256_GCM,data:uI2IRRxjugSWOW0Akxpg,iv:0zvoX7i7BhqB555cOS9MGE3iVcsSNBvJKxEHsQCnHpQ=,tag:uWaSRAkK9R9qEZhxerQ8Ow==,type:comment] +FRIGATE_FOSCAM_IP=ENC[AES256_GCM,data:pDqT8nZzGnIenpLJzg==,iv:tspUNHCsWaOzcgEMzuZVS/7cHRWvq20hMsrKWBiaCmk=,tag:YjP51GJKh9EF5qow2hsi2g==,type:str] +# +FRIGATE_FOSCAM_RTSP=ENC[AES256_GCM,data:FcWiz0wC2b1TIqgTNznUjuaZuhqqP0ol5eDCND/qiE40g3o=,iv:dE1DHecscF9qd4W9OWeRtoBbPpzAihJE6Zhd2+QgskM=,tag:Cd7onkjcE9JAYbpBZ04jfA==,type:str] +# +FRIGATE_FOSCAM_ONVIF_PORT=ENC[AES256_GCM,data:ESGw,iv:h70Uk3XrJ6kBfPd7bvlLXeXVxxEf2cGZp/ff9j0hpyw=,tag:KXprEx35vLifL+DuyD4KtQ==,type:str] +FRIGATE_FOSCAM_ONVIF_USER=ENC[AES256_GCM,data:C4n2nSmcSBA=,iv:dOQFhS776an8A2WUWCUJTHIULjayrpve/wa1vzPdlWg=,tag:kgrrMtrH3IOx7L5eU9cuPw==,type:str] +FRIGATE_FOSCAM_ONVIF_PASS=ENC[AES256_GCM,data:C5ATYcNd4KEx,iv:RYXWLyTxWWO0usgZHJSmMvviHm0BT36XGECl5Q6MIjk=,tag:d3ryepgiXXEIVw7Aa88lnQ==,type:str] +# +# +#ENC[AES256_GCM,data:dYMyjHJe3IjXCIG7Dqo=,iv:3wuQ26+R37M+g5W3raCKXWLwkbJRUKrvJ7j4R84qg7g=,tag:SLs5BRwiShmlOin9ptCD5g==,type:comment] +FRIGATE_THINGIO_IP=ENC[AES256_GCM,data:mHD6lREo61D98iZz,iv:hFQPzlRQ19JDybTxDtwQ8oZyy1HVcjDlpcBw/Btxptw=,tag:X1Ij/vacoExsxz4IE3asdQ==,type:str] +# +FRIGATE_THINGIO_RTSP=ENC[AES256_GCM,data:WRvT22sb6anpHOqpMNo0ON/lxa2jQL/jd7vINHzY,iv:q9PDpaupdpLdnYn+43Y5+k4aFuljx5rjwPXVIguAHKs=,tag:VifwCx1j0KDDaa20JkU5/A==,type:str] +# +FRIGATE_THINGIO_ONVIF_PORT=ENC[AES256_GCM,data:3jc=,iv:3nu3QiP5AIvnlnWYae+tYUEpArmVDLXVytKhwHleb1g=,tag:41MNW+Xvvijd8jue5kiwwQ==,type:str] +FRIGATE_THINGIO_ONVIF_USER=ENC[AES256_GCM,data:EP4J65j4Twg=,iv:4JU/mOytLeVSzBXFUbrp8QCZ0ikvEgJzGlzWLD+0l4w=,tag:yUV3PD2AU8b7pr7inj1mOw==,type:str] +FRIGATE_THINGIO_ONVIF_PASS=ENC[AES256_GCM,data:y8vKwGYormc=,iv:yYrZS2CAJSoFQk3hEIY+HUQj+xvPiIMqE/8wzsRvCCQ=,tag:+ZSrxE4Ygct0bUR4b1R48A==,type:str] +# +sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzRCtYWXRxSVd2NzlNekJ4\nZjN5KzRwOVpGM1ptS2FnNGtGVUZCSkU5N1FZCm9oQ1ZYcWhNcGxEOGthN1JxTmV5\nQzBEU21qalJ5NngwWUdIZVNPVjhqSjAKLS0tIHBqc0lJOWorTFFjbWpOS1pNeHEw\nUE15MmFIc0hWQWZka1U5aDFLRHI3NTAK+guBgjUktk9cTPCzwOk1E8B5MKkQQXJy\nsOP6U8gOqFDo8ysACdE8nxbHHdQAYLCZlv5CWal9/tFldEPNOLSeZA==\n-----END AGE ENCRYPTED FILE-----\n +sops_age__list_0__map_recipient=age1yjv3ngyz26qqggvef3ekwdw60dfvcmfd0l6n88vs3axux6vusdhsyzlts0 +sops_lastmodified=2026-07-05T05:56:57Z +sops_mac=ENC[AES256_GCM,data:j93XOCXa7KevfGXy4FFAFiX7KuXKGdl6HeKDuP/AHO01CjfMoBDy9QTiQk/pboCwlvWUE55EcS1J7W8Q6mbxqP8VgyGfNtBX59lxM/bMEq4i96iTN+vjkZ2XW1WgsTIZyilpqxyyjPR4jOjICLkRAMN8uA93FBDvHWrKpyrT3Dw=,iv:zGRcO9FekvfEcdX5Jw3REnLKcwkqUOUCCMmrRRs/WqA=,tag:0WwftaMFcw4jzsbQpTgKEQ==,type:str] +sops_pgp__list_0__map_created_at=2026-07-05T02:04:27Z +sops_pgp__list_0__map_enc=-----BEGIN PGP MESSAGE-----\n\nhQIMA09oKgMfawMUAQ/9F2SVXJA2M1GVB5QLZtHZyeXEe152YzxUDAVIuwgE6TLH\nKTBfp3z+e3LxZPDi/eLe4VjaBfaA6PZEpOORtMPE9fuMl7PpuvjOZqiF8jnKF0M8\nL+rU4FDmGi6ZlgQX5bd0jvfR3Vhz3rmvjPT8t7vOS5YwuQZDYo0zxGXBFqT3rkf5\naT78Cj6VjelDyiSGur9c+FZ9+swGADmoH+h/TUcOfMP1eQxlUvRzPIhyvfhTFV58\ngpY5Xr20eoq9Fon3S/ULZjPl1IXuAuXAKKnelYSQ/XFPVOCRaiZ7jEBwjPVnnfGS\nv30uQ9mjH63aloYiuXwE6XkPJIipBUVEilUSdyigF0W4wMITsUABsT1eJ+zxeBsl\nBjyJYgg+4zm2W7LDmVxGc9P2krUMIdrKpece7eDy9hzc+Pwm6C9QjBWMgNeSrmRF\n27ox0KmHmyv/wOUBa7hzTlNtHvhSxbZybeLa2SDwbt1YQM/PN3ZEcpZsqtKntZiD\naNT+w4uaajeslGBjOuR7nwleiJHbysy+PgkEcgn9Mr57gC3PiXBZQ5LO1v5ka+Bq\nNqsOJ+PgAW6YCayCzbUIYieped0DeDthUPh5TLMom7B1jKhP5RtdHguFiptKbvSN\njzY9jMtPCD+j8uM2xupAUrH0eaBJI/F0UPyZiEPp+NvviYDngqLkzY/xtUKzKpjS\nXgHCXgoPaf0z1BJubPXfKRA6ZvGoqNoeLdNtYlNrE/XdFcTy29xRk2dmdVGFDW24\nrugTh73iADaT7WtPp9i696zEHqlsl0l7xvACAC9VMapOmGBNUNtKZMdDvj3zxMQ=\n=OTks\n-----END PGP MESSAGE----- +sops_pgp__list_0__map_fp=D40CE1579C09BFD7EF4AB7E631250420834310B5 +sops_unencrypted_suffix=_unencrypted +sops_version=3.13.1 diff --git a/modules/sops/snowlab/mqtt.yaml b/modules/sops/snowlab/mqtt.yaml new file mode 100644 index 0000000..144626c --- /dev/null +++ b/modules/sops/snowlab/mqtt.yaml @@ -0,0 +1,39 @@ +#ENC[AES256_GCM,data:TmhLSMziHIg8Zc4m1SIuvg==,iv:5x2Ma8Y7duK1dMvbmfXA1hrmuOh0/ZP0IV4vMJdZvvo=,tag:6CHMukIPYTU3Vfj1LZMnxg==,type:comment] +hass_pass: ENC[AES256_GCM,data:cVmqUJ4ZL74FZsjZ1dWR6Y3VyMv4PFZO5+qPflBxFaRNkyxbOTjWtFa4v+iQQ5ZvrmzOSiIcwrI8vW/5ZFQ6ec5frw9eelgUoHA3zkTq4XyuRxVQhhgWDMklv0jRTC4W4MYpsRAdD01OLYzDHA0LbC7PzNQJgYD20vNc17kagPo=,iv:79FCav9bnYQf06Ru00ijljbzaE6ZjmgbZRDOuODMk4c=,tag:PMZINeyDwI8nCmfUUEXIZA==,type:str] +frigate_pass: ENC[AES256_GCM,data:SWP/wCOH1TuYad545WdSHdGcS9ICBfEpSaIADQtnn4BLp3arrXLNg0h32KfQHaDiZmeeTHY4u6rUBcsbJ8bYNk6zN3r0h5QNevxUGoghhGZ7N4D+YokFjBnNnpSymEf4E6SEGNg7kHbaNzmjv8HRIAImjhwt9spCxfqAEvWKGjA=,iv:kzaTZbGl0vLlDTQg2mSBOyYUdd1lKtHIG8sD0khdy7k=,tag:S5Lylfbjrt+t3zzAT4fIVQ==,type:str] +sops: + age: + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlU1R6bVRKTjl4S2tOZWhN + OTE5clhRamNhYTFMMjdQMDB3QXBsZkVib2pZCjlZc2hUMTJGRnc5UE9Hd0ZpZ1NH + RUp0d2tDT2NDa0pHcWJDVnlhU2cyOUkKLS0tIHhXNEV2SGRxcVhvcStBT01sQmVt + SElVVGpGNy9JR2VLSWsrRUJVY1VOdmcKR9cB1daXhJBr9NVxKxDZxmqJbCd7Gjie + csS5FjvKvHM13z8xOxcHUMaD8pw5HjX8s43FdeDkh8qQYTK2Bf1htQ== + -----END AGE ENCRYPTED FILE----- + recipient: age1yjv3ngyz26qqggvef3ekwdw60dfvcmfd0l6n88vs3axux6vusdhsyzlts0 + lastmodified: "2026-07-05T05:53:17Z" + mac: ENC[AES256_GCM,data:FmdAEqA5oBF2YYCqTgUnh+PyAMsZGDo4bBdhkQNIKfRaLHTiHTSuqTKlOzEXiwzfjWAPf+iXGDauregFyVcu2vKhTNyTyabYl1XOwIRY+1qRbqH1jdE2AorC9kQA2UAm1/DYjMaVMABZBHGXx3cbPJ/WYsZPLxZDbFGgPAUmoow=,iv:eb6QFudx0GXjH1DJo1pzF0rmMBrYR7O9PRjLqdaI1FM=,tag:ZnzQ3h3UoI3s1ZG00yRiAQ==,type:str] + pgp: + - created_at: "2026-07-05T05:52:29Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQIMA09oKgMfawMUAQ//WYOSj93cmcQ+hbUmiLwUmasAd3pKGN5+5JmRg9ALesD6 + p7ocQrb9RvFECH7aSao8G8Hi9gXQv11x+wY2fSSkk4wwWbAx6M9rDUiB8Awjg6Li + UnmZ78BcEvYh+JDbhBKKUtp0MQhW0SjFBprW/bHjpNRqrL7RME/+Zde5FNCLw/cD + vbXXlC3oA0ymHj9SDZNftJLBz4Q+JBm55wOba/6UippBM2YGsUDBojqD8gwkA3hg + f3sTXygThwkgG/Hx3XmlL7156GpAEUMixASrqzYAzxJ2Qji6G2UTYgpaMwlti/RL + eXcTibKazisce/NiE96sc1kZopYNuorxSuh0ikVHc9oJolifqrDJ2iccFa8JN1j0 + nBxyKEhETjFaLzDD/0mznrsWCYnFQqAd1uRSL/AlMlB/TNbUJZ9VWMWDyxmlK8aV + j8Xr/tV9pSh4BnEPVn94OmPP6dNbwT0Da5RMh7z7jBPJvc9HhHyf0OzwcyiLBZAu + qLXBSjMYEPfRR7M/aMPHqlUnugCFGHolGfOmHiSuLLT6PpuYQzNxx5JTe41BnHQ5 + Zy8soMmfPYR0uYUPWb2on/ivEnx7Mpo4kAVd+61JzNl+FxKGGH0rcuOoMhjOAWvR + 2prv6TuMW7jbvNC/osZrcHKMpsKzMcp4W3G0BkZyKyKbHQAw4Cit9BcYrQWaBz/S + XAGTMXBVyhmL/S3bVJzJWOdKp09umIyOOgnRCjIskncmbx93ZB3tMVm/nsNOFikY + C/rVADx+W0WVo6tzS8rpdSgL/GvSg0y/R13n5Kf2RehCu3TF4CgMEBVMMPYF + =6J+m + -----END PGP MESSAGE----- + fp: D40CE1579C09BFD7EF4AB7E631250420834310B5 + unencrypted_suffix: _unencrypted + version: 3.13.1 diff --git a/modules/sops/snowlab/ntfy.env b/modules/sops/snowlab/ntfy.env index d10eefb..b8e73f5 100644 --- a/modules/sops/snowlab/ntfy.env +++ b/modules/sops/snowlab/ntfy.env @@ -3,11 +3,11 @@ NTFY_DATABASE_URL=ENC[AES256_GCM,data:y4ErJHb/3hPSUzQSouYEYiimu8YQHAcU8JTFy6RjTo #ENC[AES256_GCM,data:seOhUBGHPo2r7mo0/Q==,iv:RWd2sW+XW0ky1Pk8HgTGvygmCwYx/6nYdkl18ZTApq8=,tag:hDhYWp5ozpIOusOXWkk8hA==,type:comment] NTFY_ATTACHMENT_CACHE_DIR=ENC[AES256_GCM,data:DYORc8PA5E/Q0NB51k7XSviWDlJv5DfVMaBv8irsy1nW4eyOXt6h3Z/FDBbZJgyISn9oMwwIUdXFO+TGqmZkN6u7plcnrqWz+I1pQSgn5qujIzcg2CUMoUnZAJHcUnaX1SuvRB7OuFTuayvxc/VmA5MP+hit0SjhxmCquZC/b0RQgiCp0DKPNyPEZFvkentXANDYXgt2rApd7w==,iv:oobYDI9u2EiBG754jZIxP1KvURHeYcaBhObOVGdc4w0=,tag:xicGTg28pyh2k3A23II+ag==,type:str] #ENC[AES256_GCM,data:OcUtcGLS,iv:NejdvFzdZSLX9S5vufOUQXbuCKkdhlXiZCKIBhkpy3U=,tag:7lQ2c5y3k4GIB+xrpxNBrg==,type:comment] -NTFY_AUTH_USERS=ENC[AES256_GCM,data:opN7BF7TXbQmRG9lUYBXyClRATFTRRafpIdsXN+TBui8UGz8s5Dl/a7B38neOmd0UvjPEqRVWdNv8ULAnnDC/u6TkAGPGs5iKQAjD3+IrFqskwQF88et64EFrEb5QVOptzfRm7fq5u54scspS1Yy71PBKgcHRa3pxos6SVg0uyJGN476H5C1AttOVuijo6JzKw==,iv:Z7Va1WcBVrQ/2LvckL4L5DSH8voDw0xWg/f+AkDZQso=,tag:4jWbGmVzSmqg5ofsi9Wlww==,type:str] +NTFY_AUTH_USERS=ENC[AES256_GCM,data:JXFaPg+V8LRxBEmNB6L3L/9F2p4K2VjAsNX8nxN/xsckpnstca03MRcgAwUJ7lu1nMNXmaICFunnlTTjEpuxBedKuKw0dZ/vGBPgMq9P0PDL7saXkbgUZgdliUA2wPpRGe82JJGJdrTmgewTGmyFqooyMowjydzwKS27iMaZ6mb/6H8e2vgPLpPqUw5xmEd5QqfKVk6Z/FoRHJaLT1D01E+v1+ue3joashMLKcLIIhO1UwvdO4KEiIVJHRDUeI0mmpo5z+Z95zXj0p+KOFTF2jJDA4ey0m0P,iv:fLMXGfrg/Q90hxOI8mo/aCniQIjsUn9GdiSTuGc2kjE=,tag:7EUbnN1fdch8z0Hh+xAPuQ==,type:str] sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvWDVTNWE3VzB6NnpYcDdY\neDhVNk5kMytZdnAzSXFKWEdCWDEyaU9Damk4CkNQQkJ1RDUrOWpFSndzQkMrM25i\nN3c1OHZEU2paQUZpQkJsZnloNGduVEUKLS0tIERPL0pES0hWNzlKa2N6MU9JdXhM\nVnJrV29LUlN4dzRzOExCVnZTVVBxWXcKut3AV3h0vzesduWqLwTbo9NJsv4qvzYL\nRMT5VWtCvGoBDeA7GzQYzHYNeBFiKv0lxjQA31AmqcnLvNpzV+y/6g==\n-----END AGE ENCRYPTED FILE-----\n sops_age__list_0__map_recipient=age1yjv3ngyz26qqggvef3ekwdw60dfvcmfd0l6n88vs3axux6vusdhsyzlts0 -sops_lastmodified=2026-07-01T11:46:11Z -sops_mac=ENC[AES256_GCM,data:6wNywU0CM0LwhLJGQZG+QGSSacM/JXljh4QYGadfycAGRtl7x08gCIVKDBy03DnkZBbCtVe2AwgH7LOBqg6XS1kujfYe0ls3Ge8rSyqUQqdum0QXEw0XIQBWdvVYnDq8hvPMWRgXSISd4EC9GygrQlPG//FPCKyDXbAbmKxZuxQ=,iv:UpHUkq8RXF/miEKrLTPMyBWSGYZTDL0ZoOjNGS1rnws=,tag:W3IjAu8JqU7kwxs3Y6RJgQ==,type:str] +sops_lastmodified=2026-07-05T05:24:36Z +sops_mac=ENC[AES256_GCM,data:FAGMrPVxGLjVrsGGFnEB63NG39zGTuTWD+JcvPeWKVDzSsWNwwoahUvUEmF2slbw0sRcjeBQc1NOY8TQDrdJdsy5b53OjkM6JUfPCWCMqzeqTKJUWUNpNaptmrK8xw/3z9uAb6Rvq/XqfO0vd2ZJOxkagjbh+60Mh/nvPCdXrvM=,iv:cIepw3/agO2pMVbX4c/ZW5TwDmDq1Ujgs7XAAQJVFrw=,tag:CHuRCsp+POoq1zIeX75PiQ==,type:str] sops_pgp__list_0__map_created_at=2026-06-02T23:40:16Z sops_pgp__list_0__map_enc=-----BEGIN PGP MESSAGE-----\n\nhQIMA09oKgMfawMUAQ/9Fnapvhfy0iiccDctgyUAosVO+LuAX9pcGW+IbxBwU/RB\noT140OD+2Ovcmh5TU2unWjHRRri6JvYAMiLMCsKEq86RjVDJaGSSof5RkhAaeTpp\n4ompB2WYQBspWm8RjP/azaBRy2Gv9UJIpyDv/v2Svb4ArZG3IWEcqxzPom/o/hBw\nmW4gIjO5+78y0f49pkXzGRdLJkD3+UzKp4LVnwIClWJkkskdjv5ai8MaF7bZ9Rto\nEEBm3VpBSwKkZeW/expqnmiNeXHgVPePGUlZqu6a+44WVr7B9Amd/pYTQTl+HkwB\nj/Uu9KH2sPUkrqYq6/YJAsQzemI69On+w9M08I5fKn/pOBdTM7g270tKDN+ezHgo\nPn6cCmIBYO72E0GTL08DGCFIEolAkFTih6amWVccP+2jEAYjgoTzVPV3gns81GxY\neDP8Utq3TFupNfgI6eUj6HHkPIRlQncCaCuZ6Xnt+cmaEMGkJcGk2zTPnZliwvu1\nKSRrujhVSwyTcLrSZrfA/Y2kjuDZvdoU3bSmx+Ha0Nb2hcaf0wVRz/jFA6DIEYq0\nOBGcMcs5QMRJYu2hAdFhjHut5iaXZzz3RM8n2OybqhQrkFGNziGTbVhcyqlEl3k6\nS+2Bf21/pxyp0LKI1IcJKUU06wkXnNMOrnol6K4BJZhHix8IcDDfS11DWmLQsMrS\nXgFcBaJeUeX4oJ0q61XqBEh3qXrRlqZyf8mBDLjUDOeek3cz+51zI+O55VzTFDV9\nxb4n8sosD1dnlWUL1CptDYCvm2bv9x/JinrBk/dphj9p5/0jlU8aZACwqOHwths=\n=wjei\n-----END PGP MESSAGE----- sops_pgp__list_0__map_fp=D40CE1579C09BFD7EF4AB7E631250420834310B5 -- 2.51.2