diff --git a/hosts/marvin/services/paperless.nix b/hosts/marvin/services/paperless.nix index 82d73fee..2ab83489 100644 --- a/hosts/marvin/services/paperless.nix +++ b/hosts/marvin/services/paperless.nix @@ -1,14 +1,26 @@ { self, config, + lib, + pkgs, ... }: let - d = self.lib.data.services.paperless; + d = self.data.services.paperless; + auth = self.data.auth; sec = config.age.secrets; inherit (self.lib.secrets) mkServiceSecrets; in { + dish.oidcClients = [ + { + clientId = "dishNetDocs"; + displayName = "dishNet Docs"; + homepageUrl = "https://${d.extUrl}"; + clientSecretFile = ./secrets/paperless/oidc-secret.age; + redirectUrls = [ "https://${d.extUrl}/accounts/oidc/dishnet/login/callback/" ]; + } + ]; services.paperless = { enable = true; inherit (d) port; @@ -26,12 +38,43 @@ in PAPERLESS_EMAIL_USE_SSL = true; PAPERLESS_APP_TITLE = "dish Docs"; PAPERLESS_TASK_WORKERS = 3; + PAPERLESS_WEBSERVER_WORKERS = 3; + # OIDC + PAPERLESS_APPS = "allauth.socialaccount.providers.openid_connect"; + PAPERLESS_LOGOUT_REDIRECT_URL = auth.endpoints.logout; + PAPERLESS_DISABLE_REGULAR_LOGIN = true; + PAPERLESS_REDIRECT_LOGIN_TO_SSO = true; + PAPERLESS_SOCIAL_AUTO_SIGNUP = true; + PAPERLESS_SOCIALACCOUNT_ALLOW_SIGNUPS = true; + PAPERLESS_SOCIALACCOUNT_PROVIDERS = builtins.toJSON { + openid_connect = { + OAUTH_PKCE_ENABLED = "True"; + APPS = [ + { + provider_id = "dishnet"; + name = "dishNet"; + client_id = "dishNetDocs"; + settings.server_url = auth.wk_url; + } + ]; + }; + }; }; environmentFile = sec.paperless-secrets.path; }; + systemd.services.paperless-web.script = lib.mkBefore '' + oidcSecret=$(< ${sec.paperless-oidc-secret.path}) + export PAPERLESS_SOCIALACCOUNT_PROVIDERS=$( + ${pkgs.jq}/bin/jq <<< "$PAPERLESS_SOCIALACCOUNT_PROVIDERS" \ + --compact-output \ + --arg oidcSecret "$oidcSecret" '.openid_connect.APPS.[0].secret = $oidcSecret' + ) + ''; + age.secrets = mkServiceSecrets "paperless" ./secrets [ "admin-password" "secrets" + "oidc-secret" ]; } diff --git a/hosts/marvin/services/secrets/paperless/admin-password.age b/hosts/marvin/services/secrets/paperless/admin-password.age index 8fb460dd60778ec8d1884c01e6a5d5fa60bde904..943be0fdd0ba70b890f169d5cd5535a1a710ec03 100644 GIT binary patch literal 3257 zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR2_&B;#9H8-=UFfuhYv{VSO@CqxeGA*%m zHA*qfiF9&vPD;uzHp+J~s_=9(OinTN3vo9040DVsFH8$b2`Dslck&Mk%=UDRNJ+~K zNiJ|nO$^8?iK+^$@{hb@NDXohiS$S@3pa`?3eWWOuky$ZbkDIc z4$@DFEb+)p&Cf9i33c)FuqaA1O!3Y)vCK@Z3QzJ0^4E7R^L7d>O7)6LHZ;vK_9*o$ z&JPSo4%auSbk41Gb&hcLDF`rfPw^_L^e%8Q3`#1ftOzs;%Pj~k4e?5HF$gjAGD}bN zOVxG`&kQI^EcfuM&@MI)i^%l~OSW)J4=6J*^)X0s$}h{bNQ*KGFfVtq^f9b*4M;6; zGj=q|@OLS5GYHN|uh1?F@$xDtEKId5^$*XC3Udm`%qw-xN~_8=E>ASqP73!lF-goa z&Grm*_6T!!jSS2Ripur%$w(?nsw}betja3&OD{|-OE*i-Hccyabu$k&OfD@g_N#O% zFECH_ury89PYySBvk3Le3`=s3%+hx*jPNMU&vbWO4$>}j2}vvoch64_&hs%YDRj$lj4bmuEYJ1y^bQUz zkBoE)$v2PGc6ZBmvP`ekF7PmRc23XAw@6KMNy|(satSXB@yyf?3DkEEH4e_q&MwHND)-9EFHQ8ZbTraV)pyCSFwCzCHp$O)GxYTe@--_+DJZVW z@eMb3@s9|MG*2yY&nnKd@XRtz(oS(V@bD`!EeQxq%c)A!b}fo92=h!&c69Qt^eagV zGI4PY^C&Yh_RlFO@~p}Zt+EWQ$Sij^3=c@H$_q~O2rqZdcPlkd&9n%0HS{jeb24zt z_A}7W3a|)q4tLfLbn$WXGVqSj&-XNREKBsVOz|+bOwLS63-wGdNOLaMF09OP(+@T( zHgR(ccJU1HbM_xyG%j&UF3t-~^i9n( z&d-mEDhV|yE_cuH&4|eHs0{Kg^>xZO^(YCtja9(b_z>PcJ?pN%g&ATDa$MfEBA?rit<48atSpw@hJ4l&MPWP z&xtT7Da*=mOmuVdDX;X-DRy+UboKCaD=0E{bqeuyc8x4g4T>rW3aE;#GSUtXiz+a8 zE~yO8F7h(U_cKq=@yHC%4a)KG39robN_F)q=c)_}N)Pn*3@r3FOH56%EGbKiDkz93 zHLFOBGKg>t_swt)E-iL6smM%n#8N3#>3c*t85Ly)hbJbwM;M1!S!P9LrR9~B`g<7Y z`vjI}TV@%Wx;ln>n|o#&IVU?-S)^7a`WUCDr@85SnHHN@d53!Bq?VVs`x=!52A4(# znYd**1qZupSCxlbdZhdKSa|z;<)s=|m?U{;`y`4kpa1(;Nsc(_CwRhj2Gy7`t=CFh4^SeS*B1Qu0Ux)(&c6u1OchNtHH zo0WS-WV?8{S6I53C%dKxnK)OP`4+o)msy6Cq~#|U2LyPeMEI7KYgeZDn`Nh_g!}0G zW*BOR80Ht0Ido@l$!;5MY?#Tq4Cl>6ibxp+CJ2juzW zhgo<9<|QTPmS(3pm1a5_Wg3K6xFjWq85b4>8XFdtlsHCa=jywZmilHH89OJLnnvdO zrlgn@rDTOhdiq3U6eSmU8--dLq#9+12KefSR0R2_CwY35dsTP`Mf#;C6@+@5hL#!! zWGAMkC1&UsWrpTE=M@xY6l8>ZMWkmrdSq4wxVr@gIVOjDR)+e81cZ2Mrxh1un-m&& zMkTtr7no?L2m9nYYMTXmWILrrRfQFJMEPZfnEN;-nU+~bIa`M11cjMfW~BS%L>Z(; z>L;5Ud*qi_mX-PVdzJWkxtnCWcsN&jRag`nWF$xB>3gT8>W8=oS{4Upx%+q(<$8yO zRR!i0MTD9egcyW+xqG=}Tc#Nm7G_xnn;GZ3S@`%^`iJL)C*>x4Yv(ydW;qADyX)tB z7-(xpr55{SB&Fv&C0CTEWPAGr_$KFSXQot!R_5iKn)_vYxfN7oXL*D~Cg&wd-2A5=JK?SXfqNhZmS+75IA>_&S$3n^u%Zm}gXYoA^am zdYX9W`i2`vx)&E`Ib}r}nUoZjx>tGRlY<^8V5O*r5ctL`xWSCRaCh|`d5^uC;M5XCq-0N1p7HTyQP_hn`Q+T zngpd5J3D(ArW%{N`Wh5D8D|(87!`UKMmqYL6?hj$rdaBig}VhiI+-O0<@yCDN0@m8 zggJZqL^mIhaOK zmjyUSBwG5Xh5EP~W)(V>R{0kMg*$}?l;j768@m^lnY)>q1(#Q4glMOlc}5vklxJ5a zyBL|Jq_||3`IHnH=9!v=nM8#qrI~x=C+6puhdG-C1(zC{rdGLnxuypjxf=$imU?=G zhWce1hPrx%lyik9CmQ;=TliN*mYe$rJ2{7EJ8CBydHH*KxfvNn=0+8z<~iz{8V3X> znsDjr>MBGOx;h4@1(um<2m87EruhUr8zx4i=VTN(x@JVC7lnBl278-^n+BAp6>}Z9 z(PJvv)zz$G>T35{>i8CMz3UzK=kYH*@^a2)q3qIqaT=e^S8{N=e|*uQX;RJfbaIbr b!}H79pdueDBpirX%!#s1BboaviFsCTf)Cynos0uDqXLEmV_ac`} zHbdMy9 zf}*f`uE^9X7w??ZfFKj|6pvifpbXat*Fdvui}3Q2z|_1b_jDJpJpEAZ;y~9x6Hoo* z$RMAnkWi1Z^uVIr0u$3vKQ8m&qU2JKs*EJ_z)XwMh!i6qqx6CZ?J~EpApNA=P`C6# zPqT9Ev`m9Y&yvKV)Nnu3tkOcm0w34BK*O?n^YAjR05?~2?Len|*VIg7m&il1eXs?JRdEE>jm{KmSP6 z+=A@l5#^zpTngui}iTihzK;GAEBbOOJ^9 z!je1#OHVGd%FN*WM8{miP``3Vk0gtfWVcYSz`O#(C^Mg+bOQ?`_cH&SKui7964P=M zN7pO^@A8V!5dBOKAHSUPVjpv^Oiu%^ioDRMtl)@3V{?~G$AB=)s9e*CQd76WjPN{P zOA9w+eeY7=a&rS?N3SUDsvv)(5P#2lkBovmqe_D`M=qDdAP>Ld+`OtHR||u5zYu>j zkIdo{1LNexfWrKI?`)H@VwdvlREsoAH^1P@$Q-vk(=vmQ;*8RK?Z}|KtVph+C=Vxn zQ&-P&qmas^aHF8q)MUpf^N`Y#a2NB+@CrkHmy+BJM~n1iw*s&H3~v)ppYp)^%qXXb zisTYg@4{R+F2`^m->fWC1K)`JwCubRuM87cw^V0+rwY%ah~Vs;qAY_LifA~_uP!~@WPdtBbAx0rcaP*$e*=$nlk}2&E?r$+ zg=}qOry}$0Kw~%e$|P@7my%Fpj{?7xTtnlaEE7-jD(6Vg;LMbY%JP&*u4#w5KG>yb zeyw#rD)E12c0gYf!^YK`|NlN^-geZor*>+_a*c2Qe^w~PUO32di9>1r$!mVU`sYqL Ym6G&*{m(aCS+}36SAIX--SO)!0F!%f+W-In diff --git a/hosts/marvin/services/secrets/paperless/oidc-secret.age b/hosts/marvin/services/secrets/paperless/oidc-secret.age new file mode 100644 index 00000000..0c747b1f --- /dev/null +++ b/hosts/marvin/services/secrets/paperless/oidc-secret.age @@ -0,0 +1,7 @@ +age-encryption.org/v1 +-> mlkem768x25519 9iT0Mv+XpzfB0PwEnVBD9CXfbT5IG3R/E8xa72NsygOUUihSGhyfmIj9timPtdixaBIYmTK3kfwvjFy9xI6gFmYxxXVECPNUN57b87djEaL7giIl6WfDW94C3VnM1WOFMejkIQXM44P5gAESTuRO/dk+iW3mGkEDkjuaiGzBI35zFsYp3by3jMYy9wvs67hHJOHxWMi68qaqGUm0zRzSdo4w1l0xFMpJCq4AFIlPzmlYn2JMZ1/hTzbHMn42l3PW9S2iV89DX94K1EsAHiaY/NZ00OHQDW2Es873FQHAgyNPpK8/YFwVdoSvZ8BlXg4nCYkQ0Fcu207D301eMWX31KxtyH43n1P03fAF6dmdnaBlBxqhlvQrvCMok0sk2oIXaFTRZsCXY/CThZi/hD5EruvA6Ukk7a3xaK2nSdGbq6kh0Jae/Fr3VoJr0W/CB8Qk+PHySJlbnjaBz+8Td6iRz7ocNZiQDhKvp/zZj6O6qIuPaoCpmgq+4WrFAHPrCv6O+d+LfMy9cSwtaRmzbOE5DB6nHCyZbOOFRSziZTn9JdtO/Faf7u8I8uuui9K1A1grv5k73VI3NGvt7/Xt21YipnBNB+pX81Ao9aFuw4duBcmrV/0yBU8rMl3egmFgo8LUS6ypuDffQSH2MqpYyNOikMU8NkDbW/b6aPZRjWQI3yBK3J63sXwTjhg5+/5VlDg1j/mfd/5YfJLgEsEkK3BhV/zrrfFCF5/AdW9ZfYNl9xxya04n/aGAQBNZ/dYA7N5lVYP4V/UXN6+RQ+ao4BTINAObUfMtTdhQdLXeU2Ms4ukBbIezWC6YqYTv7+emQKOVjgKSAlOTrqafazr17LgcczBOiphZJmpwTiUGSLcalu7Ah9dc7b+rk/cL77YqqpCAIBZqug+umYcbx5T7jGVkm6yJ+eEAH0gnuiPXPOuiUN6TPXNVGMMjvI6WK3bv/bCfgeHoeKxzQYYIH2Rpnoj27J731thgydCt/dRvjX5SBYJZYJrNsZ74NkLcgxndcRRCr6jcKt5V70iQ5LVq4qST8qAcbpn93WUggevjOWkKAyt5EnXqicT7gl7glzqpAHlsQ8aA/dTvED6SDmPT5QArueSyV4VNVXm1VN2b/8KsCb2BSgJSA8LDo0EzMK01fKiwLzB0lsUnkyhFU45mkekM6raKEA+PHNWjj7PluPtLBIi1IwGuO+ELEHQyAmy5TV6TZXKECe3MbqFg9uf7F8m7ECv/umFA80qB+X40jpV771+I/bAoOVUzPwyoHszw6sq1Gmac9e/eO9bdYzZ6MzPsyAfZjwnruaikiQrLtxxUBauJjfNSiafdPjJeE9hEqLgs5hfIkmgCFGkBtw3GuS1mrvT5PMHNuDJITOGRyQ3ivpbHyu2f2ToeHmfys0I5RpsLSp3mB8IcWq2nqMqsaZwdh+FGxRlxw3uvyEt3vRB2h0iW0BX8QN6WbVAk5XUEgLBE66NU9p7yRVak6XgVQfykXA +oYabZtgg2PkuLeIniXM7yhbJ67S1+isq+QpHi8aUTiY +-> mlkem768x25519 wX2oibUNIWYCxRKyxtdEng9LRO7OnqaavA7VHOU6KCEiVSDDt3/OJCecbQDYonHPllKyA+8aM72V12uNdUPZ0mKKyFaIslu/0OrW6LrJRlRV1aTlsufjLiCyVg87RiZFIVkQ88OsWIpOfqZBCqjsY/a+Ox7oDcnBvHZAzoWc1lfz8kqK8/zKZOkheX6mVCT7wUCenULuLHzHVWSQ2fZaCqkT+3GuYDNh9SThw3m/5kzYqzJnLGuf43Uk+HFl9tNu7AZhOfUoRcvwNusMoufci9FxXl4ePyB5+bU592KgdVKIB1MCIz7odW5iinRYm52EqoqY8jPgM0dsCP6+j9M8b5gsttc3PV53P/7aW4qT+HUyEAHZd9/4TRl1BioezHVD5Q+5Y7CZTXp5xZATyyJHj2vCPQ80Im5pQd4A1I56V4oZk4durcwVg5tgDRSjF+NPO2cMDYp2azSwgO2OlJvl4hPTOg5IeI28JE3K5bl4kal0/E6ayg/dtESRjCIM7sb9maRDfLiI/SNAJaOw/Cb4bpZvUF4WpRvkX3/FDiT3Recjym/CfeGtLiUFdR05PlV+tVQz0lngkz2QHnGNTsNRmGLhSQ5ojOZL7LfT4Ytxn4mlB5esYyZOppNWA11/J8L9jDq9bS+kLWbV9ts47zwKHNLRDSwJ5RQsnDkzSKC961k8BYSa/nvyJFIf3/te+PR+3L85Fy5fdApnELSKSRTg/9IG2+vBRZI2yRlk+nM69cxEtMT44sWgBkTGTv6HSFmji5EFiHlHO08jJA4a1oyBpreSajL11a4YYtiGmYCYXxgx0HOr5h1pHAPsztg7XYOMM+g0l45NRF7U5fg08rGR8cjG9uk6zQoEhJ/S+TJdKcyujhEwIFh0qpKrpn0NJ7+KFmWAJcMWgJMOHnrrQy0uzXwlpCjQ6EtyCL6TdjNgFwa2QnEF0iV8spUbDOsim5KTDZGpd4J8CfYwfZKQLJUSU4vgv+YhRoSmArkXKdTX48Gk0cM52GNIyx8myWbdDI3CgKQr3g9hUQ1LY1WNeu154m4AZ20AHq3KG/SPNhlMXX/DQ1Mj6Yq7TiU7cJprf7G7tXciUTtE55DL0FPSa0gVXUvY1ShyR8UfSsGUjNMkRlvA2AgIpnUYZKKNggIPJTIHso5Mg4SDv5D0lVTQlAYoCYXwM+SP5NPeNfdd7YjNibPV1Na6tlhFDUKNYT0ffRNPihApa20/lloAOqurF8jd04QwzytEKfe//XuP/t8AQM/cepPphIV46vVRr0KHB1181A5+9o7kaYkXftlQyAizCPB/X8DywjW2LYjBsGEZQUFyEvGGjBP0mjcvYmGz2o2tjLYVI9H3mFj08wVLFlkufgTGUN3tOjWEE+ojzJ+fjQqWs6EjDb/1zBH/IcGYbmsnqwvMERE6E5HprfUstPeu3PtkcGTv2jp6Vfwh4tC4mhT3H/vW0KyYClBHhZQ3N+Dg/P/rRFOIFgDbOFi2UYeCaw +ZoE4W7sMH3D08EOQTC8fQEv33IQettW6RhgNq9Gf5VM +--- yabuW6VbhzKfy6HAVyPeaULyuF094KmaIZ64bf7AlsI +.F���!B�#�x~v���'f�O��2�rOq�f.��<Ѫ����l�ήb���nN{�l�Ǥ$+��hO�ʦ�:y2X8VrDh��+2 ���u \ No newline at end of file diff --git a/hosts/marvin/services/secrets/paperless/secrets.age b/hosts/marvin/services/secrets/paperless/secrets.age index c9094074..3e51ea28 100644 --- a/hosts/marvin/services/secrets/paperless/secrets.age +++ b/hosts/marvin/services/secrets/paperless/secrets.age @@ -1,19 +1,8 @@ age-encryption.org/v1 --> ssh-ed25519 iqBxIA P8u58J2nZZbRds95JpFHLOc5lcAf7YF03dPk6L49BT0 -xj8PzYA7W3xanYp8brg6bQ+xuhdOM3J6FcslKNv+YOI --> ssh-rsa fFaiTA -lG8IMuChMKHEo1jAJu6xJ+AnoDZ/RuTVf9DdtDFToFbwNZ15gJkA8+BRm07n2rCS -fmBMLOQpg2n3VHQRlMgONGZwOpB3kRKqJJ6AbUlO7alyL3j/kveZ0SQf8pv7sSpe -EgZEcOzrqpEQIlPtkWg6cjVxLk4TIZ2Vrh1/rRdegw/sGHygAX9YQ5dFo/r6o1Df -QflZOW887PeZPYOuuG/wBrPI/aj1McpcV7A1YbX7kfnoVUWdnydUYADiaHYf6036 -0A8tER8mjPr3poZEeIRPnMa/FjiqPSNR7HzHJzJP9NJMuW0yS2zCz9p1LJWuFfTT -3bk8l+8cN42WbiMV62CCXM7B3aOZ2Bes7W72nSEuhjdj3+TA2B/niT3hYTw+h8hf -ffSEGth2HUO8Ai+sVA/53ZJ/obLPKY6QCKPfZcMO33GuLzIfpzDXe7PKazoKdNah -ycdYQjmT0+xmJ7tw36B3w/RDTKdUK2t7VowCi0miJGmPJ32YbUpJpLvZ4D7DbvuJ -NdNcG79H54op8ltma9548URuRXCCVYGMYwc80fvOUwzR8IgbnWG5dpZR8iDp/2KM -0IztlQ9UMStSBHzt4t+xbk97glS0N4Rv+OGCoYjc8cpAKSjTahxZSnaWQ6NlRYeg -tc71FBe1j+chr6B4ku69CGzQFdt901OjPD8AcKWN0ZA --> ssh-ed25519 wpmdHA sZjjKQPZ11T5XNH6xmeI+MpPN4a6P2IojjHsu1rZ230 -r2VSTyyCfJk7KwqHh3FkP7oyylojwG2QBDldnF3y5iY ---- m2RCaIONWymiVYzS+i59W3pW1SLefIn3TlAEhi1EMNo -*��)eUt^�� ����N�2��(����� ��@_n魘�;�����g#�?sE�������9���/�������It��'N5�������ʔ��j��48� \ No newline at end of file +-> mlkem768x25519 gfbTAuRMcbRDINUJNKt3mnYXESl0zBdTqYKrLMQ90S2eNXWEXo7ZxsBYkR3f0U1sWVMixdQ2b2dOg223hrkt2Vk+gBsDZxyU+8+sER3MCbG/hpY3mHR38L1y+cZ77GfQ0F+WEPxmWemBRx2MG0LmcDYTm7jKm3EKgDY6cU7xE5fBTHpfdrgfKQkEfFR2uENTn/8PMjXT4e+qrX4NN028rfzEuU6axg5YkulnxFUzddzleJF9qqEnvfRaipqHFE6QNr687LXGJ2BJtZEr6ZSmt+YloP3QvrSA3y+r072UlKd9ky1hM5DWw4W5/Wo9GlJGaoPuxU+rAbdXF0w1fiUmdlZ8MvQrYvq9ZdVvnBpRwlfPJlryp9kSbIBX8LordxGuVb+wRcDT53mbsSg+BMmHEqq6kPvl7SQnHuzhJzJuRzd/9yPho+ontj5Vsmj02A+/sfuiF7lSMEThHWGwpK2gQZ8JI4dlRO9FdxACcpIMLFapAlHpyl0MOMIV41kLgjivF3C74W6zjIuw9DE2YXZ/lipvtbKOlEe872LeB+NT3vqJoJPwTfqIt6k2hjQ8t23brgvvwgmgNY/wVIsBJQ+gqwDapwB1gRtSK8hj5bw5f5AD6DoG+9Og52sN1L28L67SWc2+xoICe+kfyeSA60Tmzm7s491YGE4LnbW18aXx1qtEIaIcPNXX7LIQ8CBphgXToY3LEbXdY460/HCOTNVy4AHCwBUwhcQQG5/66vw0kBytljasMYWFvGFmL2+bZlSlfLJzIwUA46cyllYns8eAsFAMiwLQyPa0hR8Bj9b9lER16f5jugMJ1vihT7gCyG7jK2pTMBo1HZEUDuQOS3I3AShVi2QdNVELjQrxGnTn28VgQZtOXP2r3v+2blwGzfbuW3eivWiobJAdycPwsMncn9QDP/54bZpmedW7YlP3ztt17afG68BIJvNrmKitWswCxjsyd/jUPgcpRmr1bCJDKxUCMCYq+5JZAgBYlaEkhqSTQoMUTbaH5GbSfiHa+pmEYEbnZ/b7vLRahvxwm/p+H2F+ar1LCr4mK6QVEX0UUG4Cm6QELk3dhejbu51+PjKpj2mX9utYszqdqxd2iqEQ0xN06unoRWpaFkZRB+TvhuEyu29QiRNGU9t3orbxkGCGGuF9X5nwGu6MyDCIkyKSym2pQNhmzVq4Nzq39bwo4Z/NDrNeIvNWj7pL4n4ir/4Ew6nT5JJT68a/mQRu1YzzhRXOk3xLb88WYPsuRrsXOwzo9LTQnmKlgazRW6/PI1N/3PhBRfJCXyCSla3LW4CPlUVHwOe98vVOc5qyoiYmRZPqgilW6WNEAugCAfcAAICTrK1fdLVSWI6+N9cRGE+uEjfC9mWoIlc/kZxfmcH5ct//kgi9SAnpP0mihoidN9oTME2M9d3vY4TH5UpwUk8cGQVJAXf+ZpbVZQpdbgEeZiYDWqT6VZMLOtjR3rk/t74ZdOZ/40q0HKWZEQ23MrBKaw +LxibXPkToiGJvmgS7OZJAtgH0xr5Lns10dkYS1BeD7Q +-> mlkem768x25519 O38Mt/BK6btXWGUheFWUGoIxUvKysp8v6tFFxsqZ6uA/xvAzVwXbIt1Y70VVjVEAlEmck/B3I6FRizOaRKtRlf8A9gGxnsu5kDvV7ucoerBZKdbrvDDGI3kWTYM+rP67CdlI8CLnzsjSWGwkIS7tvwdYja4jRDol5fIMTzUaE/E9F1/YAfX+1lZ1r7OoDDXeQiW/NizmxPPeGPpvBvwDRiBwJJMCWJvvlShoXWODCtEr4CV16G6iXOKO45BAAM/60CPYkFhQrvQB5bzqwi5GRNRmgHN/Kst1UQN22YASJc3cUkglE9vBlG5MEv8QU1Dn8mfzMUR1k9GD7l+8aHPDX6tZSG97wtXr82wCSL4MPBrg9VCNUednFB4lkx+yi7hxkXk51WtODOrosROFRM2fvA1/o3+pHHeRXbsRvqAj7wv6PHvGD2OV+iMSxtbbwGW7UpM1nW4HNXAVfcAu3J6YoX0dA01nxXSvJa3L7/GeIBo+5sbGihnN2gz7tjjClh0mbaBcnEDNJ3GfGLficCtMUk+PLiEwIPuxhAzr0IXBvwD1BFtQZtpcSlfR7PbSOXt/oMWJX1zfRTenLyT6hSuSzuFldBvhvqUdAKAH6FjJX9p1rKpWDnHQsygYJBNTUZM5MdsO9IzBrZWXsbbHg7zUJ2NRFj1kNcQIAk9xGX5rY7bzk+ruJhnxTDkPeFBKpFQpWr802T/o8vHNHhTTQOKub1yJjcwxqoC5Bpvn/R2NjcY3CZuREDIY6PHJkEKu0vvNgHOD4eZCzgNo2XIXndxApQq5eG+5sOb1IbaZCQhHUSp2KetVWnERoSRA66kM2ofPz9B6tenY+mY04DZRObPbZkycMJkQUjXs5BWzz072ORv1arTavcp7D63eSSO9MLKIfa0BpRmZOWhNENhPSeWJsJHvGMblBIpQt1E71IIdgrfbcubrMkX1FHRvh1Yweiq0pg9F37o4MTCbG60/wDKGheBhVHLjOMa1zGoE14ipyvDT6JQ4MI325Xn23uDCOAup5tMeMQ5eW9vV4kSBvOr+cDWXW/jsLEu3gK8YmaQgZdWPwOqPBr3EDj53JnLqjqi1kcMIwA0q8tC4MGhKVF/IxbDWGf7ghTHM7qrQ8QJ9x14ARCFEF9faa/9TB2mMvgHx9tsbPNpsTfHplts7YRQOKWGzVAlnVNLcnR0GVXDzr6A8xmEqVhxMBRfB6IoDt40rEKO7TdkniypnC3GwpE2x825KB7KAGqj4/f3TzvI9hAD3sOQRKdGyoJxWt2OJeC2EoTb/gJztHSTo192DwhsaO7p4tr5W4LnTtGOQve/x0x/QoGlIyXWCuwI4xqT/nkiGMi5sQB36RsTvmIhoGcUV8Gixadwwv16T/BejrGAH08yj1JMQQnPI7n+V2qpJgxCwFKyl+mwxwU65tLw3YArOyNibhSxd0yjRc7wsTjd+CYzSDkzsFOMFCxz5aii2ohuZf5nsk+IIhWpkB1oqkGaJKw +S9eo88QvlT0vidYElI5zvVf1MujTzRDPsXuOh8h33eQ +--- tvZQjl+IIivgF3IYogFZ921riwhbIttH90jeftwodjU +,� +����$�a?�_L@�M+N`'��Z1�N�;z�5.��NG��N��~7�٫��`<,�׻p�f�MԪч���a�F��g��2�ı� b0�`rҬ�k� \ No newline at end of file diff --git a/hosts/marvin/services/secrets/secrets.nix b/hosts/marvin/services/secrets/secrets.nix index cb256114..71af08e7 100644 --- a/hosts/marvin/services/secrets/secrets.nix +++ b/hosts/marvin/services/secrets/secrets.nix @@ -59,8 +59,9 @@ in "immich/oidc-secret.age".publicKeys = pqKeys; "immich/mail-pw.age".publicKeys = marvinDefault; - "paperless/admin-password.age".publicKeys = marvinDefault; - "paperless/secrets.age".publicKeys = marvinDefault; + "paperless/admin-password.age".publicKeys = pqKeys; + "paperless/oidc-secret.age".publicKeys = pqKeys; + "paperless/secrets.age".publicKeys = pqKeys; "shelfmark/secrets.age".publicKeys = pqKeys; "shelfmark/oidc-secret.age".publicKeys = pqKeys;