diff --git a/default.nix b/default.nix index a14b22d..a8211af 100644 --- a/default.nix +++ b/default.nix @@ -92,6 +92,7 @@ in flakes = nlib.gen_flakes [ "sops-nix" "home-manager" + "tangled_core" ]; }; }; diff --git a/hosts/desktop/hjem-rum/snowy.nix b/hosts/desktop/hjem-rum/snowy.nix index bee415a..eadc27f 100644 --- a/hosts/desktop/hjem-rum/snowy.nix +++ b/hosts/desktop/hjem-rum/snowy.nix @@ -9,7 +9,8 @@ { users.users.snowy.packages = with pkgs; [ fluxer-desktop - + nicotine-plus + # factorio # factorio-space-age args.flakes.zen-browser.packages."${stdenv.hostPlatform.system}".twilight @@ -32,7 +33,6 @@ jetbrains.idea # jetbrains.rider - orca-slicer # unityhub #language servers @@ -67,7 +67,7 @@ # helvum # deprecated crosspipe # krita - # orca-slicer + orca-slicer protonplus protontricks winetricks @@ -75,6 +75,7 @@ element-desktop radio-cli # rust heroic + bottles # hydralauncher wineWow64Packages.stagingFull diff --git a/hosts/homelab/services/samba.nix b/hosts/homelab/services/samba.nix index 723a008..2208c2c 100644 --- a/hosts/homelab/services/samba.nix +++ b/hosts/homelab/services/samba.nix @@ -1,6 +1,6 @@ { config, - # pkgs, + pkgs, ... }: { @@ -13,6 +13,7 @@ # samba services.samba = { enable = true; + package = pkgs.samba4Full; # needed for avahi to work (why?) openFirewall = true; settings = { global = { diff --git a/hosts/server/default.nix b/hosts/server/default.nix index 6f54bf9..f9e8393 100644 --- a/hosts/server/default.nix +++ b/hosts/server/default.nix @@ -32,6 +32,12 @@ args.flakes.home-manager.nixosModules.home-manager + # tangled + args.flakes.tangled_core.nixosModules.appview + args.flakes.tangled_core.nixosModules.knot + args.flakes.tangled_core.nixosModules.knotmirror + args.flakes.tangled_core.nixosModules.spindle + ../../modules/sops/vps.nix ../../modules/snownet ]; diff --git a/hosts/server/services/caddy.nix b/hosts/server/services/caddy.nix index 35573ab..a54d18a 100644 --- a/hosts/server/services/caddy.nix +++ b/hosts/server/services/caddy.nix @@ -14,174 +14,170 @@ ''; extraConfig = '' - mail.mrsnowy.dev, fpps4.net, www.paradijs-in-hongarije.nl, paradijs-in-hongarije.nl, smarty.nl, www.zendojaku.nl, zendojaku.nl { - reverse_proxy https://hestia.local { - header_up Host {host} - - transport http { - tls_insecure_skip_verify - } - } - } - - mrsnowy.dev { - root * /var/www/mrsnowy.dev/ - - # Regex for allowing these files to be displayed in the browser - @inlineFiles { - # path *.pub *.gpg - path_regexp ^.*\.(pub|gpg)$ - } - - header @inlineFiles { - Content-Type text/plain - # Content-Disposition inline - } - - file_server browse { - index index.html - } - } - - molly.mrsnowy.dev, rat.mrsnowy.dev { - root * /var/www/rat.mrsnowy.dev/ - - file_server browse { - index index.html - } - } - - silly.mrsnowy.dev { - root * /var/www/silly.mrsnowy.dev/ - file_server browse { - index index.html - } - } - - hestia.mrsnowy.dev { - reverse_proxy https://hestia.local:8083 { - header_up Host {host} - transport http { - tls_insecure_skip_verify - } - } - } - - api.fpps4.net { - encode zstd gzip - - reverse_proxy https://hestia.local { - header_up Host {host} - transport http { - tls_insecure_skip_verify - } - } - - header { - Access-Control-Allow-Origin * - } - } - - dockge.mrsnowy.dev { - reverse_proxy :${toString config.ports.dockge} - } - - vaultwarden.mrsnowy.dev { - reverse_proxy :${toString config.ports.vaultwarden} - } - - stream.mrsnowy.dev { - reverse_proxy :${toString config.ports.broadcast_box} - } - - board.mrsnowy.dev { - reverse_proxy :${toString config.ports.grafana} - } - - adminpg.mrsnowy.dev { - reverse_proxy :${toString config.ports.pgadmin} - } - - obsidian.mrsnowy.dev { - reverse_proxy :${toString config.ports.couchdb} - } - - ente.mrsnowy.dev { - reverse_proxy :${toString config.ports.ente.web} - # header { - # Access-Control-Allow-Origin https://s3.mrsnowy.dev - # } - } - - api.ente.mrsnowy.dev { - reverse_proxy :${toString config.ports.ente.api} - } - - accounts.ente.mrsnowy.dev { - reverse_proxy :${toString config.ports.ente.accounts} - } - - albums.ente.mrsnowy.dev { - reverse_proxy :${toString config.ports.ente.albums} - } - - auth.ente.mrsnowy.dev { - reverse_proxy :${toString config.ports.ente.auth} - } - - cast.ente.mrsnowy.dev { - reverse_proxy :${toString config.ports.ente.cast} - } - - embed.ente.mrsnowy.dev { - reverse_proxy :${toString config.ports.ente.embed} - } - - # minio.ente.mrsnowy.dev { - # reverse_proxy :${toString config.ports.ente.minio.api} - # } - - # minio-web.ente.mrsnowy.dev { - # reverse_proxy :${toString config.ports.ente.minio.web} - # } - - headscale.mrsnowy.dev { - reverse_proxy :${toString config.ports.headscale} - } - - syncthing.mrsnowy.dev { - reverse_proxy :${toString config.ports.syncthing} - } - - *.garage.mrsnowy.dev, garage.mrsnowy.dev { - reverse_proxy :${toString config.ports.garage.web_api} - } - - *.s3.mrsnowy.dev, s3.mrsnowy.dev { - # log { - # output file /var/log/caddy/s3.log - # level DEBUG - # } - - reverse_proxy :${toString config.ports.garage.s3_api} { - flush_interval -1 # low-latency mode - # request_body { - # max_size 5GB # raise for large object uploads - # } - # - - # transport http { - # # compression off - # versions 1.1 - # } - } - } - - http://s4.mrsnowy.dev { - # log { - # output file /var/log/caddy/s4.log - # level DEBUG - # } + mail.mrsnowy.dev, fpps4.net, www.paradijs-in-hongarije.nl, paradijs-in-hongarije.nl, smarty.nl, www.zendojaku.nl, zendojaku.nl { + reverse_proxy https://hestia.local { + header_up Host {host} + + transport http { + tls_insecure_skip_verify + } + } + } + + mrsnowy.dev { + root * /var/www/mrsnowy.dev/ + + # Regex for allowing these files to be displayed in the browser + @inlineFiles { + # path *.pub *.gpg + path_regexp ^.*\.(pub|gpg)$ + } + + header @inlineFiles { + Content-Type text/plain + # Content-Disposition inline + } + + file_server browse { + index index.html + } + } + + molly.mrsnowy.dev, rat.mrsnowy.dev { + root * /var/www/rat.mrsnowy.dev/ + + file_server browse { + index index.html + } + } + + silly.mrsnowy.dev { + root * /var/www/silly.mrsnowy.dev/ + file_server browse { + index index.html + } + } + + hestia.mrsnowy.dev { + reverse_proxy https://hestia.local:8083 { + header_up Host {host} + transport http { + tls_insecure_skip_verify + } + } + } + + api.fpps4.net { + encode zstd gzip + + reverse_proxy https://hestia.local { + header_up Host {host} + transport http { + tls_insecure_skip_verify + } + } + + header { + Access-Control-Allow-Origin * + } + } + + dockge.mrsnowy.dev { + reverse_proxy :${toString config.ports.dockge} + } + + vaultwarden.mrsnowy.dev { + reverse_proxy :${toString config.ports.vaultwarden} + } + + stream.mrsnowy.dev { + reverse_proxy :${toString config.ports.broadcast_box} + } + + board.mrsnowy.dev { + reverse_proxy :${toString config.ports.grafana} + } + + adminpg.mrsnowy.dev { + reverse_proxy :${toString config.ports.pgadmin} + } + + obsidian.mrsnowy.dev { + reverse_proxy :${toString config.ports.couchdb} + } + + ente.mrsnowy.dev { + reverse_proxy :${toString config.ports.ente.web} + # header { + # Access-Control-Allow-Origin https://s3.mrsnowy.dev + # } + } + + api.ente.mrsnowy.dev { + reverse_proxy :${toString config.ports.ente.api} + } + + accounts.ente.mrsnowy.dev { + reverse_proxy :${toString config.ports.ente.accounts} + } + + albums.ente.mrsnowy.dev { + reverse_proxy :${toString config.ports.ente.albums} + } + + auth.ente.mrsnowy.dev { + reverse_proxy :${toString config.ports.ente.auth} + } + + cast.ente.mrsnowy.dev { + reverse_proxy :${toString config.ports.ente.cast} + } + + embed.ente.mrsnowy.dev { + reverse_proxy :${toString config.ports.ente.embed} + } + + # minio.ente.mrsnowy.dev { + # reverse_proxy :${toString config.ports.ente.minio.api} + # } + + # minio-web.ente.mrsnowy.dev { + # reverse_proxy :${toString config.ports.ente.minio.web} + # } + + headscale.mrsnowy.dev { + reverse_proxy :${toString config.ports.headscale} + } + + *.garage.mrsnowy.dev, garage.mrsnowy.dev { + reverse_proxy :${toString config.ports.garage.web_api} + } + + *.s3.mrsnowy.dev, s3.mrsnowy.dev { + # log { + # output file /var/log/caddy/s3.log + # level DEBUG + # } + + reverse_proxy :${toString config.ports.garage.s3_api} { + flush_interval -1 # low-latency mode + # request_body { + # max_size 5GB # raise for large object uploads + # } + # + + # transport http { + # # compression off + # versions 1.1 + # } + } + } + + http://s4.mrsnowy.dev { + # log { + # output file /var/log/caddy/s4.log + # level DEBUG + # } reverse_proxy :${toString config.ports.garage.s3_api} { flush_interval -1 # low-latency mode diff --git a/hosts/server/services/default.nix b/hosts/server/services/default.nix index 1ada587..c6ae737 100644 --- a/hosts/server/services/default.nix +++ b/hosts/server/services/default.nix @@ -6,5 +6,6 @@ ./garage.nix ./postgres.nix ./broadcastbox.nix + ./tangled.nix ]; } diff --git a/hosts/server/services/postgres.nix b/hosts/server/services/postgres.nix index 37b0015..3cd7cc1 100644 --- a/hosts/server/services/postgres.nix +++ b/hosts/server/services/postgres.nix @@ -17,7 +17,11 @@ port = config.ports.postgres; }; - ensureDatabases = [ "ente_db" ]; + ensureDatabases = [ + "ente_db" + "knotmirror_db" + ]; + ensureUsers = [ { name = "ente"; @@ -25,14 +29,21 @@ login = true; }; } + { + name = "knotmirror"; + ensureClauses = { + login = true; + }; + } ]; authentication = pkgs.lib.mkOverride 10 '' - #type database user auth-method [auth-options] - local all postgres trust + #type database user auth-method [auth-options] + local all postgres trust - #type database user address auth-method [auth-options] - host ente_db ente localhost scram-sha-256 + #type database user address auth-method [auth-options] + host ente_db ente localhost scram-sha-256 + host knotmirror_db knotmirror localhost scram-sha-256 ''; }; diff --git a/hosts/server/services/random.nix b/hosts/server/services/random.nix index 4b024f7..938a5a8 100644 --- a/hosts/server/services/random.nix +++ b/hosts/server/services/random.nix @@ -9,6 +9,7 @@ enable = true; ports = [ 335 + 22 ]; allowSFTP = true; banner = "meow meow\n"; @@ -24,19 +25,28 @@ LogLevel = "VERBOSE"; AllowUsers = [ "snow" - "file-backup" + # "file-backup" + "git" ]; }; extraConfig = '' - Match User file-backup - ChrootDirectory %h - ForceCommand internal-sftp -d /meow -u 700 + # Match User file-backup + # ChrootDirectory %h + # ForceCommand internal-sftp -d /meow -u 700 + # + Match LocalPort 22 User *,!git + RefuseConnection yes + + Match User git + DisableForwarding yes + PermitTTY no + PermitUserRC no ''; }; endlessh-go = { enable = true; - port = 22; + port = 2222; prometheus = { enable = true; port = 2112; @@ -52,13 +62,13 @@ }; }; - syncthing = { - enable = false; - overrideDevices = true; - overrideFolders = false; - guiAddress = "127.0.0.1:${toString config.ports.syncthing}"; - settings.options.urAccepted = -1; - }; + # syncthing = { + # enable = false; + # overrideDevices = true; + # overrideFolders = false; + # guiAddress = "127.0.0.1:${toString config.ports.syncthing}"; + # settings.options.urAccepted = -1; + # }; # ntfy-sh = { # enable = true; diff --git a/hosts/server/services/tangled.nix b/hosts/server/services/tangled.nix new file mode 100644 index 0000000..d6afb5b --- /dev/null +++ b/hosts/server/services/tangled.nix @@ -0,0 +1,93 @@ +{ + config, + # args, + lib, + ... +}: +let + atproto_did = "did:plc:5fbqdlfpahlht7gu4c6zrdpj"; + +in +{ + # todo! probably want to put this all in a systemd container... + services.tangled = { + # appview = { + # enable = true; + # port = config.ports.tangled.appview; + # appviewHost = "tangled.mrsnowy.dev"; + # }; + + # The git server + knot = { + enable = true; + appviewEndpoint = "https://tangled.org"; + gitUser = "git"; + openFirewall = false; + stateDir = "/var/lib/knot"; + + repo.scanPath = "${config.services.tangled.knot.stateDir}/repos"; + + motd = '' + This knot is hosted by Snow! + Federation is cool. + ''; + + knotmirrors = [ + "https://mirror.tangled.mrsnowy.dev" + "https://mirror.tangled.network" # seems to be dead? + ]; + + server = { + listenAddr = "127.0.0.1:${toString config.ports.tangled.knot.outer}"; + internalListenAddr = "127.0.0.1:${toString config.ports.tangled.knot.inner}"; + owner = atproto_did; + hostname = "knot.tangled.mrsnowy.dev"; + }; + }; + + # Index for repositories on the tangled network (i think..) + knotmirror = { + enable = true; + listenAddr = "127.0.0.1:${toString config.ports.tangled.knotmirror.public}"; + adminListenAddr = "127.0.0.1:${toString config.ports.tangled.knotmirror.admin}"; + hostname = "mirror.tangled.mrsnowy.dev"; + dbUrl = "mewewe :3"; # black magic + fullNetwork = false; + tap.port = config.ports.tangled.knotmirror.tap; + }; + + # Spindle is for CI (not really ready yet, requires docker) + # spindle = { + # enable = true; + + # server = { + # listenAddr = "127.0.0.1:${toString config.ports.tangled.spindle}"; + # hostname = "spindle.tangled.mrsnowy.dev"; + # owner = atproto_did; + # maxJobCount = 2; + # queueSize = 5; + # }; + # }; + }; + + services.caddy.extraConfig = lib.mkAfter '' + knot.tangled.mrsnowy.dev { + reverse_proxy :${toString config.ports.tangled.knot.outer} { + header_up Host {host} + } + } + + mirror.tangled.mrsnowy.dev { + reverse_proxy :${toString config.ports.tangled.knotmirror.public} { + header_up Host {host} + } + } + ''; + + # harden these bad boys... man + systemd.services.tap-knotmirror.serviceConfig.DynamicUser = true; + systemd.services.knotmirror.serviceConfig = { + DynamicUser = true; + EnvironmentFile = "/run/secrets/knotmirror_env"; # overwrites MIRROR_DB_URL + }; +} diff --git a/hosts/server/system/network.nix b/hosts/server/system/network.nix index 0f1ad01..1e1e033 100644 --- a/hosts/server/system/network.nix +++ b/hosts/server/system/network.nix @@ -115,6 +115,7 @@ 22 335 665 + 2222 config.ports.garage.s3_api @@ -154,8 +155,10 @@ 2457 # Steam + 25564 27015 27016 + 17777 # icaru # mc 25565 @@ -190,6 +193,7 @@ # Steam 27015 27016 + 17777 # icaru 25565 25564 diff --git a/hosts/server/system/ports.nix b/hosts/server/system/ports.nix index c242f7d..cc2e1a5 100644 --- a/hosts/server/system/ports.nix +++ b/hosts/server/system/ports.nix @@ -33,7 +33,22 @@ rpc = 3901; }; - syncthing = 3020; + # syncthing = 3020; + + tangled = { + # appview = 3020; + knot = { + outer = 3021; + inner = 3022; + }; + knotmirror = { + public = 3023; + admin = 3024; + tap = 3025; + }; + # spindle = 3026; + }; + headscale = 3443; postgres = 5432; incus = 8444; diff --git a/modules/npins/sources.json b/modules/npins/sources.json index 5fb987d..aba74c3 100644 --- a/modules/npins/sources.json +++ b/modules/npins/sources.json @@ -23,9 +23,9 @@ }, "branch": "master", "submodules": false, - "revision": "e90541d0904593bec70fadd6383659ec42cd610b", - "url": "https://github.com/amaanq/helium-flake/archive/e90541d0904593bec70fadd6383659ec42cd610b.tar.gz", - "hash": "sha256-6FDLz9ydI32uoOJa2qsPpaxQ3T0DB/7Lw/Meos6NjRo=" + "revision": "b422c32cbb574728c93e24ce2542806e27993c03", + "url": "https://github.com/amaanq/helium-flake/archive/b422c32cbb574728c93e24ce2542806e27993c03.tar.gz", + "hash": "sha256-ZK0fQvpYf3e+ty62WHbzK+ZcIJLnfZuyQV2x0PWuyCU=" }, "hjem": { "type": "Git", @@ -36,9 +36,9 @@ }, "branch": "main", "submodules": false, - "revision": "d51b2e524794a61762453be5bf7b4fe259150191", - "url": "https://github.com/feel-co/hjem/archive/d51b2e524794a61762453be5bf7b4fe259150191.tar.gz", - "hash": "sha256-hOweDMc/uNFeliSVuNXZ4qa6WC8AbmRV8pNSAD/h4S0=" + "revision": "32bd6d54d805a3eb41efa62a940eeceaf263c4a8", + "url": "https://github.com/feel-co/hjem/archive/32bd6d54d805a3eb41efa62a940eeceaf263c4a8.tar.gz", + "hash": "sha256-W+kpLQ5J/DDaY1nUmvN9aIAfh5ixdyqYM76ZUdcvMBU=" }, "hjem-rum": { "type": "Git", @@ -49,9 +49,9 @@ }, "branch": "main", "submodules": false, - "revision": "3506a77b5cbb35640f7dac595f98b10bdbe07b15", - "url": "https://github.com/snugnug/hjem-rum/archive/3506a77b5cbb35640f7dac595f98b10bdbe07b15.tar.gz", - "hash": "sha256-xM7gYCLOUH2fnPgdst7HcPpEn6GlEOf7nelJVxJZ040=" + "revision": "fdfb0cd3d735116a0356ce5a856059669a27ae96", + "url": "https://github.com/snugnug/hjem-rum/archive/fdfb0cd3d735116a0356ce5a856059669a27ae96.tar.gz", + "hash": "sha256-n+hYOHRF5/DWuyd1su/DCD3iFBZ8Np4l0ss9NNqUSiI=" }, "home-manager": { "type": "Git", @@ -62,9 +62,9 @@ }, "branch": "release-25.11", "submodules": false, - "revision": "cf9686ba26f5ef788226843bc31fda4cf72e373b", - "url": "https://github.com/nix-community/home-manager/archive/cf9686ba26f5ef788226843bc31fda4cf72e373b.tar.gz", - "hash": "sha256-dnHvv5EMUgTzGZmA+3diYjQU2O6BEpGLEOgJ1Qe9LaY=" + "revision": "0d02ec1d0a05f88ef9e74b516842900c41f0f2fe", + "url": "https://github.com/nix-community/home-manager/archive/0d02ec1d0a05f88ef9e74b516842900c41f0f2fe.tar.gz", + "hash": "sha256-KY6HsebJHEe5nHOWP7ur09mb0drGxYSzE3rQxy62rJo=" }, "nix-gaming-edge": { "type": "Git", @@ -75,9 +75,9 @@ }, "branch": "nightly", "submodules": false, - "revision": "3e479e75a18f1458b112ee74ae6c0c5b4b75bcf9", - "url": "https://github.com/powerofthe69/nix-gaming-edge/archive/3e479e75a18f1458b112ee74ae6c0c5b4b75bcf9.tar.gz", - "hash": "sha256-bfjINgmeHk+jWwli/ODZsQFZcR1yZjVXzalR6vvjz9o=" + "revision": "4a86b355eb417057fbcaf8791fa8c9059a0337d2", + "url": "https://github.com/powerofthe69/nix-gaming-edge/archive/4a86b355eb417057fbcaf8791fa8c9059a0337d2.tar.gz", + "hash": "sha256-rlOm9gD6gbfL14UNq16BoNsODfdpJGO0k73T9v6UrtY=" }, "nixpkgs-stable": { "type": "Git", @@ -88,9 +88,9 @@ }, "branch": "nixos-25.11", "submodules": false, - "revision": "4590696c8693fea477850fe379a01544293ca4e2", - "url": "https://github.com/NixOS/nixpkgs/archive/4590696c8693fea477850fe379a01544293ca4e2.tar.gz", - "hash": "sha256-4XfMXU0DjN83o6HWZoKG9PegCvKvIhNUnRUI19vzTcQ=" + "revision": "54170c54449ea4d6725efd30d719c5e505f1c10e", + "url": "https://github.com/NixOS/nixpkgs/archive/54170c54449ea4d6725efd30d719c5e505f1c10e.tar.gz", + "hash": "sha256-t+HZK42pB6N+i5RGbuy7Xluez/VvWbembBdvzsc23Ss=" }, "nixpkgs-unstable": { "type": "Git", @@ -101,9 +101,9 @@ }, "branch": "nixos-unstable", "submodules": false, - "revision": "6c9a78c09ff4d6c21d0319114873508a6ec01655", - "url": "https://github.com/NixOS/nixpkgs/archive/6c9a78c09ff4d6c21d0319114873508a6ec01655.tar.gz", - "hash": "sha256-US5Tda2sKmjrg2lNHQL3jRQ6p96cgfWh3J1QBliQ8Ws=" + "revision": "4c1018dae018162ec878d42fec712642d214fdfa", + "url": "https://github.com/NixOS/nixpkgs/archive/4c1018dae018162ec878d42fec712642d214fdfa.tar.gz", + "hash": "sha256-ar3rofg+awPB8QXDaFJhJ2jJhu+KqN/PRCXeyuXR76E=" }, "sops-nix": { "type": "Git", @@ -114,9 +114,21 @@ }, "branch": "master", "submodules": false, - "revision": "614e256310e0a4f8a9ccae3fa80c11844fba7042", - "url": "https://github.com/Mic92/sops-nix/archive/614e256310e0a4f8a9ccae3fa80c11844fba7042.tar.gz", - "hash": "sha256-fhG4JAcLgjKwt+XHbjs8brpWnyKUfU4LikLm3s0Q/ic=" + "revision": "31ac5fe5d015f76b54058c69fcaebb66a55871a4", + "url": "https://github.com/Mic92/sops-nix/archive/31ac5fe5d015f76b54058c69fcaebb66a55871a4.tar.gz", + "hash": "sha256-VKp9bhVSm0bT6JWctFy06ocqxGGnWHi1NfoE90IgIcY=" + }, + "tangled_core": { + "type": "Git", + "repository": { + "type": "Git", + "url": "https://tangled.org/tangled.org/core" + }, + "branch": "master", + "submodules": false, + "revision": "d404bb7633c163b35e61f6bebfc642444247ac9f", + "url": null, + "hash": "sha256-aYeDY7ruf9MHsI++hpoEHyWIk6jxbItpS5lPRJfwYRE=" }, "wire": { "type": "Git", @@ -140,9 +152,9 @@ }, "branch": "main", "submodules": false, - "revision": "a0f3d47dbd8f8618a1920d5a5ca09b7993415895", - "url": "https://github.com/0xc000022070/zen-browser-flake/archive/a0f3d47dbd8f8618a1920d5a5ca09b7993415895.tar.gz", - "hash": "sha256-gibUM0pSnLxEeuFrYA8T1oEaixk+fjQpqXbYaxcEX/4=" + "revision": "4f2e98c1125ab4be758cd1b51b526ad998e9618f", + "url": "https://github.com/0xc000022070/zen-browser-flake/archive/4f2e98c1125ab4be758cd1b51b526ad998e9618f.tar.gz", + "hash": "sha256-Vwmi3P4LAUmOrE2zc9JpnRrNxNwamDN46hqcXpWTkp0=" } }, "version": 7 diff --git a/modules/sops/vps.nix b/modules/sops/vps.nix index cc94fca..8e5d8d5 100644 --- a/modules/sops/vps.nix +++ b/modules/sops/vps.nix @@ -41,6 +41,13 @@ mode = "0400"; owner = "postgres"; }; + + knotmirror_env = { + format = "dotenv"; + sopsFile = ./vps/knotmirror.env; + + mode = "0400"; + }; }; }; } diff --git a/modules/sops/vps/knotmirror.env b/modules/sops/vps/knotmirror.env new file mode 100644 index 0000000..5b52ff9 --- /dev/null +++ b/modules/sops/vps/knotmirror.env @@ -0,0 +1,11 @@ +#ENC[AES256_GCM,data:7TSD6x8=,iv:7IntObKIbbFiVqADX+SAcEpJRV2sUoS7bcV/ZSyc9l4=,tag:P1JPNntpHXOyQNp9XAztGQ==,type:comment] +MIRROR_DB_URL=ENC[AES256_GCM,data:pL4f5vVwalpl+UhuFG7nJmUP0DFvI/Sp5JWtdFFAKP/RGWG1/LC+QAdcN0frwUeU7MTBWbsBbcwe0qj0WZUdWlHo6n+JPOgA0WKLOn9WVWw=,iv:o8PMGx5QpTozcCWmqH3olL8RLehS200gINtC2uY/mcI=,tag:qtMvtrJqnA+yWktRRIP+hQ==,type:str] +sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBURUNGeVprVG95aWNidHpm\nSHhpUkNFWG5CVGRubEZhYVV3b05NWmJLeEJFCjdzTEhsUElERWhxT3UxT0F0N3FL\nc0pjMjlJRHRYYUtlRTNrdEhaYVA5UkEKLS0tIGowdVpzNlMrNTZ4YVFNNGlTQVh2\nOUhRaElSa1FNakNQUHNtci9hblVOWGsKDxyf9LP1ZSIjKL+NwfPWjnqYR8/FQXgO\n+p3VMWrQjT8gVVlwAbFeQQ3ZCWh90xqNTFL8KdUObaSW7+uKwEcMSQ==\n-----END AGE ENCRYPTED FILE-----\n +sops_age__list_0__map_recipient=age16e3uae0sktxmwzlmcdxwn07jpudtjl0s42hnwx2qsdh9h72gc5ssktkazg +sops_lastmodified=2026-03-27T01:56:48Z +sops_mac=ENC[AES256_GCM,data:40dR0T4w+mc+ErvNdsUQROzEvUuwpqkrQjqIq/0mHoqh4SbDf7P3VfUY+8zbpgTuZVbBZZwZL6BvhG9kXb6dgeFr9GdHtr1TiAZ/CDMt1Yr7ZTDYWugB+bR0nruCoWdeHLNRlCZYu68p4940HX4cFynOBE7BfX4ghC5Rsse2zNs=,iv:xyhpR/O8hyvLQfYifFpHDqFimTUxp2dJ2TP8GE+9svc=,tag:oh6EWOWipCW/voRUDqiymg==,type:str] +sops_pgp__list_0__map_created_at=2026-03-27T01:56:38Z +sops_pgp__list_0__map_enc=-----BEGIN PGP MESSAGE-----\n\nhQIMA09oKgMfawMUAQ//QRqJvfqT2lbUxEwzXlugSzsvDBc3Z5LBDyl9F6K2LeUQ\nHfPsI6tNpCnNNESL49N8qEsu/YWm32UWwDzLlluFCdKQTfvs9mfhU9XUVyQVf8Gh\nfu33iToNf1kvMce2h+AAxFKlTqOnfqinSMR95qGVSHyeqUZjIzlCeXXQ9lfEJY0t\nQX1gVHbsu0WgRAz5jW9X2+nVMmb/QhSML2thZ0LWyeZ4be6p2TrN5XiUaVneaN8F\n174T9KerysfEPR4P/bWs52UNDWVqXPe5PqzBgKlX8lQQyW0dCqbDKIQnZdlXFsKw\nA7f8ytEX7eKnR+LosQhfUJSzMxqOWOvOvPvxDHKaqWm7N3PAui9QL0lrw7F6KJ9F\nj6IbH9GfNoZ6asc5VTRc1kxg3eNnHuikp1qJX7srQLaeqeUZPozS8PjPb9BydPSM\naJIc7GYLOb1m9kTd87gWprtcDBBtmI+YmZCqbx8bGtsQAE6JILEkUh1eO1d5jqfQ\nukcavuq8ozpE0Rcj4Y5OhD1J36LKe6cV3eQ0pPSO1SgcqT3Vkzd1JpcTplzyjw1w\nhmY1VUGfjIFyGeQ9mS146GDwc/+3jJklhcdvStRXW0ZpNKfpEKp5+8NaCvjLUzYj\nlRDJHzF4gLisOroqbph3SZNFOVIfDj6iRrheMAxk2HrYp9ZYUCYSoE3jVtDUDO/S\nXgHOusR+OFMRW9MBQoR1I9w6lrTyvzaCH6PYD3JSUkDdGyLPtibB9AoWLVOaEa6t\nSx+OX5MzkSSRlR3d3S+d9m6QSdShPflmhhdopTjc2UdXosRqewYk1kWtAEV5Dbk=\n=rHrh\n-----END PGP MESSAGE----- +sops_pgp__list_0__map_fp=D40CE1579C09BFD7EF4AB7E631250420834310B5 +sops_unencrypted_suffix=_unencrypted +sops_version=3.12.2 diff --git a/modules/sops/vps/postgres.sql b/modules/sops/vps/postgres.sql index 3385334..f2abc4a 100644 --- a/modules/sops/vps/postgres.sql +++ b/modules/sops/vps/postgres.sql @@ -1,5 +1,5 @@ { - "data": "ENC[AES256_GCM,data:Fdzo5TicNuQkpAM43ok+2GhGr4PEwwzYvzWKi3I92FBn7/Cs5t4BVHe3seAkqVLbpBthZlemrpjzmsa3ZiFCXOqNyTyYui/tdkhSRNwncFd6UUaDcaR+PkK3XIjZvKnqOaeFT6KZYqw8SSP5ajU7JHw4gPR485Bh2hCvvECnVig4obZm8XLeGAYI70btQurjz1F26QiiAXCBpTTOP7/N272pIH56lp26ZcEVJPbzwjZ7dfpAEbxxqbpovw==,iv:YJZvRAL3TW+7LihY7wgN0KLIMNAVub6m3qzKlEV3Fhg=,tag:vLv1V2AY49iJBf5QvEsoFQ==,type:str]", + "data": "ENC[AES256_GCM,data:cOp1hnXVvO9SLGt2L4O1m/6fpHDDFpPy5alF03zMF2QGmj5isfdPhMVu0jFNY+fgg6Zu1f5Yin9N42WhJyB4p/p9czekiqhTH8nMPpdchQqO1QYptrh+YClv3dN4kbmtYl3QRix0uuwamsCRqqtkY9aI1BB02wqO4md4yJE9V/k1ZNxUM3VeXPUEiRtlLrTIm4lVZogM4c2b3rrpumEII1TjSTdvZJeOgdp7Bp0KQXbXAwo8ev8e7JRIzNEaGVInx31iUcLhsUWSNREuSsfijHZWdjSxR1S5VBKTmMKx3SsL5vGsLbS9h8Sb15iHM2/srzIQtLYVmpxy414lK8IseuxyWbOEVe3umNmYlYO/dxL1dHhynEqnFiIDi5vQhWq/7E9Y3+lZFJ3a8yXhPPDErjK616dV+/q/KRsRZ7iolj52zSc3jQmschfWmsawVgtJzieWGXHcO76cdmmdShC9iSatXIGUbTAoYf6wWF63JeEOSkuo,iv:dBpAsf17rqzpoVli0WSUgoD4uJXNXl4vjWbzuNPRxPo=,tag:VrbNg8j4tixR/FrAbMEdmw==,type:str]", "sops": { "age": [ { @@ -7,8 +7,8 @@ "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPdVpaenUrYVpMeEpRZlBl\nTndhYmkvUEcxQWZ5UjZFUHFUcGpqMXdoZ2xFCkFLUmY4YlhRRTdIUmpQTzNPYSsz\nZ2JaZ0JTM3NHNWNwMHdiR2J2M1RRb1kKLS0tIERXbGtkRUlRSnFybExqYlVoQjVz\ndFdNQ0kxU3FMT0Y1ZnRhZkxWZWcrbEEK8hSNNXzhRXLrqEUHsXnPM6p+2ZynT/is\nLT+kR1IhJjuAB0uFjlGDtL19OsQdwb85TV79i2shQZIxwftqVwYoeg==\n-----END AGE ENCRYPTED FILE-----\n" } ], - "lastmodified": "2026-02-03T13:26:20Z", - "mac": "ENC[AES256_GCM,data:NtWhYA2B4hfBHZMEZShWzaeWCGmFCmINV2jhe+fQ03OtPmRG4yVsN/MPOhreRbg69Fu6G81xRnWDa3+o+kFq/qb/oQzzxkfifEJXpD6i24zkF44ezOI6vu5sGVMCSSRo59NZ6lzI7H+IOv8ctlH4bF92O1m8ojmFqJ4dtpVBduQ=,iv:I+s5ukAPu6lpASLypmXO+RBqMIQBvaistcbV2Mi8VL8=,tag:zZ8BXwuMlLv/u+AbNivuuA==,type:str]", + "lastmodified": "2026-03-27T01:12:24Z", + "mac": "ENC[AES256_GCM,data:gr7cD6ZUjgTjpzHCF8TjY2UQaFpBvNRirseL+ZWCuy5DKdC21srAmgNM1i4hGw2wFVCNoYhVnB2HPp3q5zjWlRsWUF/TcgbYAi0sFM4jM16bSjeT8kJDlcDKf/04M99A7UM7235Ks949fy+Gl9ZOYeR9hIXL5Y2ajbHWVpqgevw=,iv:JVZwzJIHoXl0NwNlPP4mNdD+UjMLJpfNdq+D1aDU/TI=,tag:Ed97R1gIoDzLmTM2+8KbzA==,type:str]", "pgp": [ { "created_at": "2026-01-29T17:28:29Z", @@ -17,6 +17,6 @@ } ], "unencrypted_suffix": "_unencrypted", - "version": "3.11.0" + "version": "3.12.2" } }