Compare commits

...

38 commits

Author SHA1 Message Date
Anish Lakhwara 0e7cacc12b lituus: enable hyperplane wg 2023-05-30 22:24:46 +10:00
Anish Lakhwara 3b1aa44e63 curve: enable libvirtd 2023-05-30 22:24:37 +10:00
Anish Lakhwara 99a14250f0 curve: correct kitty terminal fix 2023-05-30 22:24:26 +10:00
Anish Lakhwara c751f0f6d1 formatting 2023-05-30 22:24:18 +10:00
Anish Lakhwara 5a2f0dc43b curve: remove kitty bell sound config 2023-05-30 22:24:00 +10:00
Anish Lakhwara ba2d0c4917 curve: add ocr and screenshot desktop entries 2023-05-30 22:23:49 +10:00
Anish Lakhwara 8c3924d942 box: add smtp config to grafana, allow access to psql dbs 2023-05-30 22:23:28 +10:00
Anish Lakhwara da8e4b25eb helix: make psql dbs from nix 2023-05-30 22:23:05 +10:00
Anish Lakhwara a6980a1b74 helix: new deployment 2023-05-30 22:22:21 +10:00
Anish Lakhwara 984d29ee2b box: add borg-key from secrets 2023-05-30 22:22:03 +10:00
Anish Lakhwara aa97bc3618 cube: add coaching.lakhwara.com nginx conf 2023-05-30 22:21:49 +10:00
Anish Lakhwara 2b211cc29d add disko (unused) 2023-05-30 22:21:29 +10:00
Anish Lakhwara 7ef8033b53 update secrets for new helix 2023-05-30 22:21:12 +10:00
Anish Lakhwara 9ca6e47078 add lakhwara.com to dnsconfig 2023-05-30 22:20:52 +10:00
Anish Lakhwara ad7bd1ebbb Merge branch 'main' of git.sealight.xyz:aynish/helm 2023-05-29 15:18:51 +10:00
Anish Lakhwara 9012e55951 updated lock? 2023-05-29 15:18:44 +10:00
Anish Lakhwara b3cdb97335 add coaching.lakhwara.com static site (no build) 2023-05-28 20:31:53 +10:00
Anish Lakhwara 52c76af334 clear-vim-trash script 2023-05-23 21:28:49 +10:00
Anish Lakhwara 4dc773f2ce add vimwiki-cli to flake inputs 2023-05-22 21:58:58 +10:00
Anish Lakhwara 9723f79d24 working split dns 2023-05-22 21:58:46 +10:00
Anish Lakhwara 03b1edc941 make kitaab update a user unit, use user path 2023-05-22 21:58:12 +10:00
Anish Lakhwara 16c975db35 Merge branch 'main' of git.sealight.xyz:aynish/helm 2023-05-16 10:48:48 +10:00
Anish Lakhwara 11e36c5082 box: remove autoRollback 2023-05-16 00:22:41 +10:00
Anish Lakhwara fe806757d2 curve: remove mossnet mount 2023-05-16 00:22:19 +10:00
Anish Lakhwara 6fafa22851 box: add photoprism, include photoprism and ulogger in db backup 2023-05-16 00:22:00 +10:00
Anish Lakhwara 8ce0eca9af curve: add howdoi to cli 2023-05-16 00:21:13 +10:00
Anish Lakhwara 71f417b250 box: add photos.mossnet.lan to hosts 2023-05-16 00:20:57 +10:00
Anish Lakhwara d50510a8aa box: disable paperless, have fun run for multi-user target 2023-05-16 00:20:26 +10:00
Anish Lakhwara 90c62bcd39 helix: add email config to gitea 2023-05-16 00:20:01 +10:00
Anish Lakhwara 658ecc4c7b curve: disable k3s 2023-05-16 00:19:52 +10:00
Anish Lakhwara cf2f8b40eb box: add emailer config to grafana 2023-05-16 00:19:38 +10:00
Anish Lakhwara 793604b9de curve: add more mossnet hosts to /etc 2023-05-16 00:19:20 +10:00
Anish Lakhwara 05038f2001 photoprism fix 2023-05-16 00:19:09 +10:00
Anish Lakhwara 55c47ec2aa fix: microbin css issue 2023-05-16 00:18:50 +10:00
Anish Lakhwara f8f8995c30 add nullhex-smtp secret 2023-05-16 00:18:41 +10:00
Anish Lakhwara 66b0a3db70 need to specify we're using the unstable package 2023-05-14 14:43:23 +10:00
Anish Lakhwara e45f12ddf6 add gen-secret alias 2023-05-14 14:42:29 +10:00
Anish Lakhwara a377eb2f69 add photoprism 2023-05-14 14:42:23 +10:00
41 changed files with 606 additions and 107 deletions

View file

@ -4,6 +4,27 @@ var REG_NONE = NewRegistrar('none'); // No registrar.
var DNS_BIND = NewDnsProvider('bind'); // ISC BIND.
var DNS_HEDNS = NewDnsProvider('hedns');
D("lakhwara.com", REG_NONE,
DnsProvider(DNS_HEDNS),
DefaultTTL(86400),
//SOA('@', 'ns1.he.net.', 'hostmaster.he.net.', 2022041702, 86400, 7200, 3600000, 86400, TTL(172800)),
A('anish', '103.16.130.98'),
A('coaching', '103.16.130.98'),
TXT('anish', 'datkey=dat://1a240a14fab2bae9c85ebad29bddc04505aaba24e5fb809c2ccb4cdf71e3a7d5'),
CNAME('fm1._domainkey', 'fm1.lakhwara.com.dkim.fmhosted.com.'),
CNAME('fm2._domainkey', 'fm2.lakhwara.com.dkim.fmhosted.com.'),
CNAME('fm3._domainkey', 'fm3.lakhwara.com.dkim.fmhosted.com.'),
A('@', '103.16.130.98'),
MX('@', 10, 'in1-smtp.messagingengine.com.'),
MX('@', 20, 'in2-smtp.messagingengine.com.'),
//NAMESERVER('ns1.he.net.'),
//NAMESERVER('ns2.he.net.'),
//NAMESERVER('ns3.he.net.'),
//NAMESERVER('ns4.he.net.'),
//NAMESERVER('ns5.he.net.'),
TXT('@', 'v=spf1 include:spf.messagingengine.com ?all')
)
D('sealight.xyz', REG_NONE, DnsProvider(DNS_HEDNS),
DefaultTTL(86400),
//SOA('@', 'ns1.he.net.', 'hostmaster.he.net.', 2022121008, 86400, 7200, 3600000, 172800, TTL(172800)),
@ -13,11 +34,11 @@ D('sealight.xyz', REG_NONE, DnsProvider(DNS_HEDNS),
//NAMESERVER('ns4.he.net.'),
//NAMESERVER('ns5.he.net.'),
// capsul: helix
A('bridge', '69.61.38.225', TTL(300)),
A('rss', '69.61.38.225', TTL(300)),
A('git', '69.61.38.225', TTL(300)),
A('bin', '69.61.38.225', TTL(300)),
A('ci', '69.61.38.225', TTL(300)),
A('bridge', '69.61.2.203', TTL(300)),
A('rss', '69.61.2.203', TTL(300)),
A('git', '69.61.2.203', TTL(300)),
A('bin', '69.61.2.203', TTL(300)),
A('ci', '69.61.2.203', TTL(300)),
// vultr -> nulled: lituus
A('@', '45.77.48.108', TTL(300)),
A('jitsi', '45.77.48.108', TTL(300)),

View file

@ -0,0 +1,22 @@
; lakhwara.com Dumped Sun May 28 22:30:02 2023
;
lakhwara.com. 172800 IN SOA ns1.he.net. hostmaster.he.net. (
2022041702 ;serial
86400 ;refresh
7200 ;retry
3600000 ;expire
86400 ) ;minimum
anish.lakhwara.com. 86400 IN A 103.16.130.98
anish.lakhwara.com. 86400 IN TXT datkey=dat://1a240a14fab2bae9c85ebad29bddc04505aaba24e5fb809c2ccb4cdf71e3a7d5
fm1._domainkey.lakhwara.com. 86400 IN CNAME fm1.lakhwara.com.dkim.fmhosted.com.
fm2._domainkey.lakhwara.com. 86400 IN CNAME fm2.lakhwara.com.dkim.fmhosted.com.
fm3._domainkey.lakhwara.com. 86400 IN CNAME fm3.lakhwara.com.dkim.fmhosted.com.
lakhwara.com. 86400 IN A 103.16.130.98
lakhwara.com. 86400 IN MX 10 in1-smtp.messagingengine.com.
lakhwara.com. 86400 IN MX 20 in2-smtp.messagingengine.com.
lakhwara.com. 86400 IN NS ns1.he.net.
lakhwara.com. 86400 IN NS ns2.he.net.
lakhwara.com. 86400 IN NS ns3.he.net.
lakhwara.com. 86400 IN NS ns4.he.net.
lakhwara.com. 86400 IN NS ns5.he.net.
lakhwara.com. 86400 IN TXT "v=spf1 include:spf.messagingengine.com ?all"

View file

@ -77,11 +77,11 @@
"utils": "utils"
},
"locked": {
"lastModified": 1674127017,
"narHash": "sha256-QO1xF7stu5ZMDLbHN30LFolMAwY6TVlzYvQoUs1RD68=",
"lastModified": 1683779844,
"narHash": "sha256-sIeOU0GsCeQEn5TpqE/jFRN4EGsPsjqVRsPdrzIDABM=",
"owner": "serokell",
"repo": "deploy-rs",
"rev": "8c9ea9605eed20528bf60fae35a2b613b901fd77",
"rev": "c80189917086e43d49eece2bd86f56813500a0eb",
"type": "github"
},
"original": {
@ -122,6 +122,26 @@
"type": "github"
}
},
"disko": {
"inputs": {
"nixpkgs": [
"nixpkgs"
]
},
"locked": {
"lastModified": 1684783210,
"narHash": "sha256-hxRbwwBTu1G1u1EdI9nEo/n4HIsQIfNi+2BQ1nEoj/o=",
"owner": "nix-community",
"repo": "disko",
"rev": "f0b9f374bb42fdcd57baa7d4448ac5d4788226bd",
"type": "github"
},
"original": {
"owner": "nix-community",
"repo": "disko",
"type": "github"
}
},
"eww": {
"inputs": {
"flake-compat": "flake-compat_2",
@ -459,6 +479,7 @@
"agenix": "agenix",
"basant": "basant",
"deploy-rs": "deploy-rs",
"disko": "disko",
"eww": "eww",
"grasp": "grasp",
"hardware": "hardware",
@ -471,7 +492,8 @@
"poonam": "poonam",
"rust-overlay": "rust-overlay",
"tidalcycles": "tidalcycles",
"unstable": "unstable"
"unstable": "unstable",
"vimwikicli": "vimwikicli"
}
},
"rust-overlay": {
@ -655,6 +677,27 @@
"url": "ssh://gitea@git.sealight.xyz/aynish/vimwiki-cli"
}
},
"vimwikicli": {
"inputs": {
"nixpkgs": [
"nixpkgs"
]
},
"locked": {
"lastModified": 1662448409,
"narHash": "sha256-Xd8CuFcEpEQK/TjNBXcp1HqPJCc7LwkMqKa1WiAP1Zc=",
"ref": "main",
"rev": "a73c4695cf116c2e8194a5caa837c2f9e1a7e2fb",
"revCount": 7,
"type": "git",
"url": "ssh://gitea@git.sealight.xyz/aynish/vimwiki-cli"
},
"original": {
"ref": "main",
"type": "git",
"url": "ssh://gitea@git.sealight.xyz/aynish/vimwiki-cli"
}
},
"vowel-src": {
"flake": false,
"locked": {

View file

@ -17,17 +17,23 @@
agenix.inputs.nixpkgs.follows = "nixpkgs";
deploy-rs.url = "github:serokell/deploy-rs";
deploy-rs.inputs.nixpkgs.follows = "nixpkgs";
disko.url = "github:nix-community/disko";
disko.inputs.nixpkgs.follows = "nixpkgs";
# Packages
# My Packages
poonam.url = "git+ssh://gitea@git.sealight.xyz/aynish/kitaab?ref=main";
poonam.inputs.nixpkgs.follows = "nixpkgs";
basant.url = "git+ssh://gitea@git.sealight.xyz/aynish/basant?ref=main";
vimwikicli.url = "git+ssh://gitea@git.sealight.xyz/aynish/vimwiki-cli?ref=main";
basant.inputs.nixpkgs.follows = "nixpkgs";
basant.inputs.poonam.follows = "poonam";
vimwikicli.inputs.nixpkgs.follows = "nixpkgs";
grasp.url = "git+ssh://gitea@git.sealight.xyz/aynish/grasp.git?ref=main";
grasp.inputs.nixpkgs.follows = "nixpkgs";
# Matrix
nix-matrix-appservices.url = "gitlab:coffeetables/nix-matrix-appservices";
# Others
nur.url = "github:nix-community/NUR";
rust-overlay = {
@ -60,6 +66,7 @@
, home-manager
, deploy-rs
, agenix
, disko
, basant
, grasp
, nix-matrix-appservices
@ -68,6 +75,7 @@
, rust-overlay
, eww
, llamacpp
, vimwikicli
, ...
}@inputs:
let
@ -86,6 +94,9 @@
llamaOverlay = final: prev: {
llama = llamacpp.packages.${prev.system}.default;
};
vimwikiOverlay = final: prev: {
vimwiki-cli = vimwikicli.packages.${prev.system}.vimwiki-cli;
};
nixpkgsFor = forAllSystems (system: import nixpkgs {
inherit system;
@ -106,6 +117,8 @@
nur.overlay
nix-matrix-appservices.overlay
unstableOverlay
llamaOverlay
vimwikiOverlay
self.overlays.additions
self.overlays.modifications
];
@ -175,6 +188,7 @@
self.nixosModules.backup
self.nixosModules.wireguard
self.nixosModules.microbin
disko.nixosModules.disko
];
};
@ -222,6 +236,7 @@
self.nixosModules.wallabag
self.nixosModules.gonic
self.nixosModules.ulogger-server
self.nixosModules.photoprism
grasp.nixosModule
home-manager.nixosModules.home-manager
{
@ -249,6 +264,7 @@
deploy.nodes = {
box = {
hostname = "mossnet.lan";
autoRollback = false;
profiles.system = {
user = "root";
path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.box;
@ -256,7 +272,7 @@
};
lituus = {
hostname = "sealight.xyz";
autoRollback = false;
# autoRollback = false;
profiles.system = {
user = "root";
path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.lituus;
@ -264,7 +280,7 @@
};
helix = {
hostname = "git.sealight.xyz";
# autoRollback = false;
autoRollback = false;
profiles.system = {
user = "root";
path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.helix;

View file

@ -6,5 +6,6 @@
../profiles/desktop
../profiles/email
../profiles/cal
../profiles/sync/kitaab
];
}

View file

@ -0,0 +1,5 @@
#!/usr/bin/env bash
working_directory=$(pwd)
vim_directory="${working_directory//\//%}.vim"
trash "$HOME/.local/share/nvim/sessions/${vim_directory}"

View file

@ -58,6 +58,8 @@
fontconfig
pandoc
taskwarrior-tui
python3Packages.howdoi
vimwiki-cli
(pkgs.writeScriptBin "jq-repl" ''
#!/usr/bin/env bash
@ -71,6 +73,7 @@
echo "" \ | fzf --phony --preview-window="up:90%" --print-query --preview "jq --color-output -r {q} $input"
'')
(pkgs.writeScriptBin "clear-vim-trash" (builtins.readFile ./bin/clear-vim-trash.sh))
(pkgs.writeScriptBin "flakify" ''
#!/usr/bin/env zsh
if [ ! -e flake.nix ]; then
@ -212,6 +215,7 @@
kr = "cd /home/anish/kitaab/vimwiki; exa --sort=modified --reverse | fzf --preview 'bat --style=numbers --color=always --terminal-width -1 ./{}'";
icat = "kitty +kitten icat";
yt = "ytfzf -T kitty -t ";
gen-secret = "< /dev/urandom tr -dc _A-Z-a-z-0-9 | head -c\${1:-32};echo;";
# modern cli tools
ls = "exa --icons";
@ -294,7 +298,7 @@
jtl = "journalctl";
# quick ssh
kssh = "kitten +kitty ssh";
kssh = "kitty +kitten ssh";
smm = "ssh 10.0.69.4"; # box over wireguard
sm = "ssh mossnet.lan"; # box regular
sl = "ssh sealight.xyz"; # lituus

View file

@ -33,6 +33,21 @@ in
termpdfpy
];
xdg.desktopEntries = {
ocr = {
name = "OCR image";
exec = "${pkgs.writeScript "ocr" ''
${pkgs.xfce.xfce4-screenshooter}/bin/xfce4-screenshooter -r --save /tmp/ocr-tmp.png
${pkgs.tesseract}/bin/tesseract /tmp/ocr-tmp.png | ${pkgs.xclip}/bin/xclip -sel clip
rm /tmp/ocr-tmp.png
''}";
};
screenshot = {
name = "Screenshot";
exec = "screenshot";
};
};
# set up env
xsession.enable = true;

View file

@ -6,6 +6,7 @@ bold_italic_font auto
open_url_with default
mouse_map left click ungrabbed mouse_click_url_or_select
confirm_os_window_close 0
enable_bell_audio no
-- Allows zen-mode.nvim to increase font size
-- allow_remote_control socket-only
-- listen_on unix:/tmp/kitty

View file

@ -0,0 +1,32 @@
{ pkgs, ... }:
let
name = "kitaab-sync";
# Note this will fail if index.wiki is open in vim while this runs
mkStartScript = name: pkgs.writeShellScript "${name}.sh" ''
set -euo pipefail
PATH=/run/current-system/sw/bin:/etc/profiles/per-user/anish/bin:
cd /home/anish/kitaab
vimwiki tags rebuild
git add -A
git diff-index --quiet HEAD || git commit -m 'syncing kitaab' # if nothing, don't exit 1
git push
exit 0
'';
in
{
systemd.user.services.kitaab-sync = {
Service = {
ExecStart = "${mkStartScript name}";
};
};
systemd.user.timers.kitaab-sync = {
Install = {
WantedBy = [ "timers.target" ];
PartOf = [ "kitaab-sync.service" ];
};
Timer = {
OnCalendar = [ "hourly" ];
};
};
}

View file

@ -24,13 +24,14 @@
../profiles/woodpecker-agent
../profiles/jellyfin
../profiles/ulogger-server
../profiles/photoprism
];
# Backups
age.secrets.borg-password.file = "${self}/secrets/borg-password.age";
services.postgresqlBackup = {
enable = true;
databases = [ "wallabag" ];
databases = [ "wallabag" "photoprism" "ulogger" ];
location = "/var/backup/postgresql";
};
mossnet.backup = {
@ -52,6 +53,7 @@
age.secrets.box-wg.file = "${self}/secrets/box-wg.age";
age.secrets.box-wg.owner = "anish";
age.secrets.borg-key.file = "${self}/secrets/borg-key.age";
mossnet.wg = {
enable = true;
ips = [ "10.0.69.4/24" ];

View file

@ -6,4 +6,11 @@
../profiles/server
../profiles/site
];
services.nginx.enable = true;
services.nginx.virtualHosts."coaching.lakhwara.com" = {
forceSSL = true;
enableACME = true;
locations."/" = { root = "/var/lib/coaching"; index = "/index.html"; };
};
}

View file

@ -6,7 +6,6 @@
../profiles/core
../profiles/bluetooth
../profiles/music
../profiles/sync/kitaab
../profiles/sync/cal
../profiles/wifi
../profiles/desktop
@ -14,6 +13,7 @@
../profiles/syncthing
../profiles/mossnet-hosts
../profiles/kuberenetes
# ../profiles/mount-mossnet
];
# home-manager.users.anish = import ../../home/gui;

View file

@ -1,10 +1,10 @@
{ self, profiles, suites, ... }:
{ self, profiles, suites, pkgs, ... }:
{
imports = [
./configuration.nix
../profiles/core
../profiles/server
../profiles/metrics
# ../profiles/metrics
../profiles/gitea
../profiles/woodpecker-server
../profiles/rss-bridge
@ -19,10 +19,31 @@
extraGroups = [ "wheel" ];
};
age.secrets.helix-wg.file = "${self}/secrets/helix-wg.age";
age.secrets.helix-wg.owner = "anish";
mossnet.wg = {
enable = true;
ips = [ "10.0.69.5/24" ];
privateKeyFile = "/home/anish/wg/wg-priv";
privateKeyFile = "/run/agenix/helix-wg";
};
services.postgresql.package = pkgs.postgresql_11;
services.postgresqlBackup = {
# TODO needs working wireguard to box
enable = false;
databases = [ "gitea" "freshrss" "woodpecker" ];
location = "/mnt/two/postgres";
};
mossnet.backup = {
enable = true;
name = "helix";
paths = [
"/var/lib/gitea"
"/var/lib/freshrss"
"/var/lib/woodpecker"
"/var/lib/microbin"
];
};
}

51
hosts/helix/disko.nix Normal file
View file

@ -0,0 +1,51 @@
{ disks ? [ "/dev/vdb" ], ... }: {
disko.devices = {
disk = {
vdb = {
type = "disk";
device = builtins.elemAt disks 0;
content = {
type = "table";
format = "gpt";
partitions = [
{
name = "ESP";
start = "1MiB";
end = "128MiB";
fs-type = "fat32";
bootable = true;
content = {
type = "filesystem";
format = "vfat";
mountpoint = "/boot";
};
}
{
name = "root";
start = "128MiB";
end = "100%";
content = {
type = "btrfs";
extraArgs = [ "-f" ]; # Override existing partition
subvolumes = {
# Subvolume name is different from mountpoint
"/rootfs" = {
mountpoint = "/";
};
# Mountpoints inferred from subvolume name
"/home" = {
mountOptions = [ "compress=zstd" ];
};
"/nix" = {
mountOptions = [ "compress=zstd" "noatime" ];
};
};
};
}
];
};
};
};
};
}

View file

@ -5,23 +5,27 @@
{
imports =
[
(modulesPath + "/profiles/qemu-guest.nix")
[ (modulesPath + "/profiles/qemu-guest.nix")
];
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "sr_mod" "virtio_blk" ];
boot.initrd.availableKernelModules = [ "ata_piix" "virtio_pci" "floppy" "sr_mod" "virtio_blk" ];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ ];
boot.extraModulePackages = [ ];
fileSystems."/" =
{
device = "/dev/disk/by-uuid/3b8b2c4b-835e-4822-8ac8-0effdc8270d6";
fsType = "btrfs";
{ device = "/dev/disk/by-uuid/7c560634-d545-41cc-b375-42ce3037fd73";
fsType = "ext4";
};
swapDevices = [ ];
nix.settings.max-jobs = lib.mkDefault 1;
nixpkgs.hostPlatform = "x86_64-linux";
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
# (the default) this is the recommended approach. When using systemd-networkd it's
# still possible to use this option, but it's recommended to use it in conjunction
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
networking.useDHCP = lib.mkDefault true;
# networking.interfaces.ens3.useDHCP = lib.mkDefault true;
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
}

View file

@ -4,7 +4,6 @@ in
{
imports = [ ../../users/anish ];
fonts = {
fonts = with pkgs; [ powerline-fonts dejavu_fonts ];
fontconfig.defaultFonts = {

View file

@ -26,7 +26,6 @@ let
"read.mossnet.lan"
"stats.mossnet.lan"
"music.mossnet.lan"
"rss.mossnet.lan"
"tasks.mossnet.lan"
"file.mossnet.lan"
"books.mossnet.lan"
@ -36,6 +35,7 @@ let
"archive.mossnet.lan"
"tracks.mossnet.lan"
"grasp.mossnet.lan"
"photos.mossnet.lan"
];
in
{
@ -44,26 +44,31 @@ in
settings = {
server = {
include = "${adblockLocalZones}";
prefetch = "yes";
# private-address = "10.0.69.0/8";
# private-address = "192.168.1.0/24";
cache-min-ttl = 0;
serve-expired = "yes";
interface = [ "0.0.0.0" ];
access-control = [ "127.0.0.0/24 allow" "192.168.0.0/24 allow" "10.0.69.0/24 allow" ];
access-control = [ "127.0.0.0/8 allow" "192.168.1.0/24 allow" "10.0.69.0/24 allow" ];
access-control-view = "10.0.69.0/24 wireguard";
# so-reuseport = "yes";
tls-upstream = "yes";
domain-insecure = "mossnet.lan";
local-zone = ''"mossnet.lan." redirect'';
local-data = ''"mossnet.lan. IN A ${mossnet}"'';
};
forward-zone = [{
name = ".";
forward-addr = [ "45.90.30.49" "45.90.28.49" "1.1.1.1" "8.8.8.8" ];
forward-addr = [ "45.90.28.0#6939b9.dns.nextdns.io" "1.1.1.1@853#cloudflare-dns.com" ];
# non-tls
# forward-addr = ["45.90.30.49" "45.90.28.49" "1.1.1.1" "8.8.8.8"]
}];
view = {
name = "wireguard";
local-zone = ''"mossnet.lan." redirect'';
local-data = ''"mossnet.lan. IN A ${wg-mossnet}"'';
};
do-not-query-localhost = "no";
# Eventually we'll add DNSSEC / DoT
# so-reuseport: yes
# tls-cert-bundle: /etc/ssl/certs/ca-certificates.crt
# tls-upstream: yes
};
};

View file

@ -2,7 +2,7 @@
{
services.paperless = {
enable = true;
enable = false;
consumptionDirIsPublic = true;
extraConfig.PAPERLESS_AUTO_LOGIN_USERNAME = "admin";
};
@ -18,6 +18,7 @@
path = [
pkgs.fava
];
wantedBy = [ "multi-user.target" ];
before = [ "nginx.service" ];
serviceConfig = {
User = "anish";

View file

@ -17,7 +17,6 @@
services.postgresql = {
enable = true; # Ensure postgresql is enabled
package = pkgs.postgresql_11;
authentication = ''
local freshrss all ident map=freshrss-users
'';
@ -26,8 +25,11 @@
freshrss-users freshrss freshrss
'';
ensureDatabases = [ "freshrss" ];
ensureUsers = [
{ name = "freshrss"; ensurePermissions."DATABASE freshrss" = "ALL PRIVILEGES"; }
];
# TODO
# initialScript # set password for gitea user
# initialScript # set password for freshrss user
};
services.nginx.virtualHosts."rss.sealight.xyz" = {

View file

@ -22,19 +22,21 @@
repository = {
DEFAULT_BRANCH = "main";
};
# TODO
"markup.restructuredtext" = {
ENABLED = true;
FILE_EXTENSIONS = ".rst";
RENDER_COMMAND = "pandoc +RTS -M512M -RTS -f rst";
RENDER_COMMAND = "timeout 30s pandoc +RTS -RTS -f rst";
IS_INPUT_FILE = false;
};
# TODO
mailer = {
ENABLED = false;
ENABLED = true;
MAILER_TYPE = "smtp";
FROM = "ops@sealight.xyz";
SENDMAIL_PATH = "${pkgs.system-sendmail}/bin/sendmail";
SMTP_ADDR = "smtp.nullhex.com";
SMTP_PORT = "465";
USER = "ops@sealight.xyz";
PASSWD = "breed deputy fossil glory"; # TODO how do we pass this from agenix?
IS_TLS_ENABLED = "true";
};
};
};
@ -49,7 +51,7 @@
''
gitea-users gitea gitea
'';
# ensureDatabases = [ "gitea" ];
ensureDatabases = [ "gitea" ];
ensureUsers = [
{ name = "gitea"; ensurePermissions."DATABASE gitea" = "ALL PRIVILEGES"; }
];
@ -71,6 +73,4 @@
};
};
networking.firewall.allowedTCPPorts = [ 80 443 22 ];
security.acme.defaults.email = "anish+acme@lakhwara.com";
security.acme.acceptTerms = true;
}

View file

@ -3,7 +3,7 @@
{
# k3s
networking.firewall.allowedTCPPorts = [ 6443 ];
services.k3s.enable = true;
services.k3s.enable = false;
services.k3s.role = "server";
services.k3s.clusterInit = true;
# services.k3s.extraFlags = toString [
@ -15,6 +15,6 @@
virtualisation.docker.enable = true;
virtualisation.docker.storageDriver = "btrfs";
# or use kvm
#virtualisation.libvrt.enable = true;
users.users.anish.extraGroups = [ "docker" ]; # "libvert"
virtualisation.libvirtd.enable = true;
users.users.anish.extraGroups = [ "docker" "libvert" ]; #
}

View file

@ -1,25 +1,49 @@
{ self, config, pkgs, ... }: {
age.secrets.nullhex-smtp.file = "${self}/secrets/nullhex-smtp.age";
age.secrets.nullhex-smtp.owner = "grafana";
# grafana configuration
services.grafana = {
enable = true;
settings.server = {
settings = {
smtp = {
enabled = true;
password = "$__file{/run/agenix/nullhex-smtp}";
host = "smtp.nullhex.com";
user = "ops@sealight.xyz";
from_address = "ops@sealight.xyz";
};
server = {
domain = "stats.mossnet.lan";
http_port = 2342;
http_addr = "127.0.0.1";
http_port = 2342;
root_url = "http://stats.mossnet.lan/";
};
};
# TODO enable
# provision.alerting.rules.path = "${self}/hosts/profiles/monitoring/alert-rules.yaml";
};
# nginx reverse proxy
services.nginx.recommendedProxySettings = true; # Needed for new grafana versions
services.nginx.virtualHosts.${config.services.grafana.domain} = {
# services.nginx.recommendedProxySettings = true; # Needed for new grafana versions
services.nginx.virtualHosts.${config.services.grafana.settings.server.domain} = {
locations."/" = {
proxyPass = "http://127.0.0.1:${toString config.services.grafana.port}";
proxyPass = "http://127.0.0.1:2342";
proxyWebsockets = true;
};
};
services.postgresql = {
ensureUsers = [{
name = "grafana";
ensurePermissions = {
"DATABASE wallabag" = "SELECT";
"DATABASE ulogger" = "SELECT";
"DATABASE photoprism" = "SELECT";
};
}];
};
services.prometheus = {
enable = true;
port = 9001;

View file

@ -13,6 +13,9 @@
192.168.1.240 books.mossnet.lan
192.168.1.240 archive.mossnet.lan
192.168.1.240 music.mossnet.lan
192.168.1.240 tracks.mossnet.lan
192.168.1.240 grasp.mossnet.lan
192.168.1.240 photos.mossnet.lan
'';
# 10.0.69.4 mossnet.lan
# 10.0.69.4 links.mossnet.lan

View file

@ -0,0 +1,48 @@
{ self, pkgs, config, lib, ... }:
{
services.postgresql = {
enable = true;
ensureDatabases = [ "photoprism" ];
ensureUsers = [{
name = "photoprism";
ensurePermissions = {
"DATABASE photoprism" = "ALL PRIVILEGES";
};
}];
};
services.photoprism = {
enable = true;
package = pkgs.unstable.photoprism;
port = 5152;
originalsPath = "/var/lib/private/photoprism/originals";
address = "0.0.0.0";
settings = {
PHOTOPRISM_ADMIN_USER = "admin";
PHOTOPRISM_ADMIN_PASSWORD = "photoprism"; # initial password, do change it!
PHOTOPRISM_DEFAULT_LOCALE = "en";
PHOTOPRISM_DATABASE_DRIVER = "postgres";
PHOTOPRISM_DATABASE_NAME = "photoprism";
PHOTOPRISM_DATABASE_SERVER = "/run/postgresql/";
PHOTOPRISM_DATABASE_USER = "photoprism";
PHOTOPRISM_SITE_URL = "http://photos.mossnet.lan/";
PHOTOPRISM_SITE_TITLE = "mossnet photos";
};
};
services.nginx.clientMaxBodySize = "500m";
services.nginx.recommendedProxySettings = true;
services.nginx.virtualHosts."photos.mossnet.lan" = {
enableACME = false;
forceSSL = false;
locations."/" = {
extraConfig = ''
proxy_pass http://localhost:5152/;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_buffering off;
proxy_http_version 1.1;
'';
};
};
}

View file

@ -1,27 +0,0 @@
{ pkgs, ... }:
{
systemd.services.kitaab-sync = {
serviceConfig.Type = "oneshot";
path = [
pkgs.git
pkgs.openssh
pkgs.coreutils
];
script = ''
cd /home/anish/kitaab
git add -A
git diff-index --quiet HEAD || git commit -m 'syncing kitaab' # if nothing, don't exit 1
git push
exit 0
'';
serviceConfig = {
User = "anish";
};
};
systemd.timers.kitaab-sync = {
wantedBy = [ "timers.target" ];
partOf = [ "kitaab-sync.service" ];
timerConfig.OnCalendar = [ "hourly" ];
};
}

View file

@ -36,6 +36,11 @@
publicKey = "gcdq86hhEUlqF2chqYB/F8pALyAMNFvwLycxBoHuoDs=";
allowedIPs = [ "10.0.69.5/32" ];
}
{
# hyperplane
publicKey = "";
allowedIPs = [ "10.0.69.6/32" ];
}
];
};
}

View file

@ -52,7 +52,7 @@
"WOODPECKER_DATABASE_DATASOURCE=postgres:///woodpecker?host=/run/postgresql"
"WOODPECKER_DATABASE_DRIVER=postgres"
"WOODPECKER_USER_CREATE=username:aynish,admin:true" # set your admin username
"WOODPECKER_ADMIN=aynish"
];
ExecStart = "${pkgs.woodpecker-server}/bin/woodpecker-server";
User = "woodpecker";

View file

@ -10,4 +10,5 @@
backup = import ./backup.nix;
ulogger-server = import ./ulogger.nix;
microbin = import ./microbin.nix;
photoprism = import ./photoprism.nix; #TODO remove once updated to 23.05, stolen from nixpkgs anyway
}

View file

@ -45,7 +45,7 @@ in
after = [ "remote-fs.target" "network.target" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
ExecStart = "${pkgs.unstable.microbin}/bin/microbin --public-path ${cfg.hostname} --qr --enable-burn-after --private";
ExecStart = "${pkgs.unstable.microbin}/bin/microbin --public-path https://${cfg.hostname}/ --qr --enable-burn-after --private";
Environment = [
"MICROBIN_EDITABLE=true"
"MICROBIN_HIDE_FOOTER=true"

View file

@ -0,0 +1,154 @@
{ config, pkgs, lib, ... }:
let
cfg = config.services.photoprism;
env = {
PHOTOPRISM_ORIGINALS_PATH = cfg.originalsPath;
PHOTOPRISM_STORAGE_PATH = cfg.storagePath;
PHOTOPRISM_IMPORT_PATH = cfg.importPath;
PHOTOPRISM_HTTP_HOST = cfg.address;
PHOTOPRISM_HTTP_PORT = toString cfg.port;
} // (
lib.mapAttrs (_: toString) cfg.settings
);
manage =
let
setupEnv = lib.concatStringsSep "\n" (lib.mapAttrsToList (name: val: "export ${name}=${lib.escapeShellArg val}") env);
in
pkgs.writeShellScript "manage" ''
${setupEnv}
exec ${cfg.package}/bin/photoprism "$@"
'';
in
{
meta.maintainers = with lib.maintainers; [ stunkymonkey ];
options.services.photoprism = {
enable = lib.mkEnableOption (lib.mdDoc "Photoprism web server");
passwordFile = lib.mkOption {
type = lib.types.nullOr lib.types.path;
default = null;
description = lib.mdDoc ''
Admin password file.
'';
};
address = lib.mkOption {
type = lib.types.str;
default = "localhost";
description = lib.mdDoc ''
Web interface address.
'';
};
port = lib.mkOption {
type = lib.types.port;
default = 2342;
description = lib.mdDoc ''
Web interface port.
'';
};
originalsPath = lib.mkOption {
type = lib.types.path;
default = null;
example = "/data/photos";
description = lib.mdDoc ''
Storage path of your original media files (photos and videos).
'';
};
importPath = lib.mkOption {
type = lib.types.str;
default = "import";
description = lib.mdDoc ''
Relative or absolute to the `originalsPath` from where the files should be imported.
'';
};
storagePath = lib.mkOption {
type = lib.types.path;
default = "/var/lib/photoprism";
description = lib.mdDoc ''
Location for sidecar, cache, and database files.
'';
};
package = lib.mkPackageOptionMD pkgs "photoprism" { };
settings = lib.mkOption {
type = lib.types.attrsOf lib.types.str;
default = { };
description = lib.mdDoc ''
See [the getting-started guide](https://docs.photoprism.app/getting-started/config-options/) for available options.
'';
example = {
PHOTOPRISM_DEFAULT_LOCALE = "de";
PHOTOPRISM_ADMIN_USER = "root";
};
};
};
config = lib.mkIf cfg.enable {
systemd.services.photoprism = {
description = "Photoprism server";
serviceConfig = {
Restart = "on-failure";
User = "photoprism";
Group = "photoprism";
DynamicUser = true;
StateDirectory = "photoprism";
WorkingDirectory = "/var/lib/photoprism";
RuntimeDirectory = "photoprism";
LoadCredential = lib.optionalString (cfg.passwordFile != null)
"PHOTOPRISM_ADMIN_PASSWORD:${cfg.passwordFile}";
CapabilityBoundingSet = "";
LockPersonality = true;
PrivateDevices = true;
PrivateUsers = true;
ProtectClock = true;
ProtectControlGroups = true;
ProtectHome = true;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];
RestrictNamespaces = true;
RestrictRealtime = true;
SystemCallArchitectures = "native";
SystemCallFilter = [ "@system-service" "~@privileged @setuid @keyring" ];
UMask = "0066";
} // lib.optionalAttrs (cfg.port < 1024) {
AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
};
wantedBy = [ "multi-user.target" ];
environment = env;
# reminder: easier password configuration will come in https://github.com/photoprism/photoprism/pull/2302
preStart = ''
ln -sf ${manage} photoprism-manage
${lib.optionalString (cfg.passwordFile != null) ''
export PHOTOPRISM_ADMIN_PASSWORD=$(cat "$CREDENTIALS_DIRECTORY/PHOTOPRISM_ADMIN_PASSWORD")
''}
exec ${cfg.package}/bin/photoprism migrations run -f
'';
script = ''
${lib.optionalString (cfg.passwordFile != null) ''
export PHOTOPRISM_ADMIN_PASSWORD=$(cat "$CREDENTIALS_DIRECTORY/PHOTOPRISM_ADMIN_PASSWORD")
''}
exec ${cfg.package}/bin/photoprism start
'';
};
};
}

Binary file not shown.

Binary file not shown.

View file

@ -1,8 +1,10 @@
age-encryption.org/v1
-> ssh-ed25519 kgCrKA wILVHjLHNY2lAAWw6ENwYlRTRq6fWAO4ZHxd/BXDvg0
DCIIBq++JSKzcFOJ51i0USitDOhK9R6NEsCilGlxKtA
-> e-grease F
cN5lygYFvScErf/J4BAEJ5ZkimpxOUj9gj8jGZV6Cl/RMkUThxflOfxz/OOBOK3V
S/NBseDL2dg9XzIUY7k
--- IIXSaSol3agW8SNwdOqxoV8dTkwW1CWxgJ8R3Blr1Sw
Sャ゙ニモーyQェ>lュV,<2C>モR<EFBE93><52>5サS虍HP<48>`゚dニK6ルセ"u懌z)εL゚[゚ムWヒ<57>ハキK
-> ssh-ed25519 6DaCrw 1dgmzBJiOecaCLSJz1nrw3iTF9G00gIQd5hY6HXZKUI
HVkZRyHiKJ2E/Wdgty/uMbPm6lNy9wgaGwe5EJcJ8jY
-> ssh-ed25519 kgCrKA aQiYpgMLe9uSw7NB89mt3Gpa29RqZGHfnZzsOV8DaiM
gcgFyaibNSL5/7ITddnryWFxOuCX22mtGY2e0uL8MEs
-> zWZg=\-grease GP#:NZ \CW2nnR/ /k
bMvg21MLLhnwNVSyNMvMZNT9MzyiT6UqLn3SJcxGtt3Eu9jcMAphAeGy7i+8pQbt
9MnCFZBN4JG+ZunMtSQWodmOqiHFV1vKGsjqQboMsjMo
--- glgRELYTsrSXv/SK/6RDso2FhnvfCT1TB3Ytz/AERPs
Œô97£l Ó•¹b,!.L_M´Ÿ×C[Q…rúôZ<C3B4>škò…› s"Q+ÚC$ÜØ«Ï«ÍŽ<C38D>“"ëè…sRõ[

View file

@ -1,8 +1,9 @@
age-encryption.org/v1
-> ssh-ed25519 kgCrKA /u5qYf6vYBVeJryLq2xvZHXk9LY2A8+ks/XV4C/fixw
HNLXInIHa2d/CZR8/OwwhfLurpEbxiXca8Ip3kp/EWg
-> s9b#/i%D-grease
DtUrN1QNHQyj0mSiV9nAOBpjf1/3yxxV4E4Xxr0oR2kJa/VWvpIYzyReZdRpS5Xs
Qf0Rw1HB9OAMAQ04DuR6FVfGYaGm
--- WszM9cCBr4HW0I+HltsdXj/BCxUDMld4yAVzXVo1HLg
4µEíŕÝľöGT/ĹCÁ°¸<C2B0>ŞBńšrň©ř˘ŁXYëµW<C2B5>ŔfröĹý|e5÷÷}PÄ)
-> ssh-ed25519 kgCrKA QpRQkobE13NxRH81V9tFP+HelBBp5KE2cTyOZIyKsVM
hw3pwAfiQeVRqNwITHCKx8u2/aBtwdB24FJdexUfMyc
-> ssh-ed25519 6DaCrw HjJO4lhmCmsRSD979Jva6UXIMCYqTzmkh7BX+GkbpiI
8SyOm3HR23KfA4pz/fL8dwbvpyXQJRE9ymLMs1lFCBs
-> P32-grease %>7>/d}-
mB3N3P/0E4+1zo1l/cqSmqNqGBaDw2RrH4RC11GfZEmadA
--- 2P5bd82ou+ey3DbL5QHZKQM13N4hqvmzS5D9eWkYw5o
€Â µ®Üf»é2øG­çèÅüqàà²ÁÓ<E280BA>;…f&aæYºG õ•ˆ•ÎBòBüäÍû*Vz÷£lý

10
secrets/helix-wg.age Normal file
View file

@ -0,0 +1,10 @@
age-encryption.org/v1
-> ssh-ed25519 6DaCrw igsyzrecx35FlTKXLg8msiM5mxT90UCBxty8lZwvelY
379UsHnxI+mL+Its00WVznKnDkpGi+SMLFSaHkcCcjE
-> ssh-ed25519 kgCrKA 7kGBgw8di49lYUYNLNq3PgVpoLpIvfDnGZbxipVUXXQ
ZzY77hAJn8GiPwYT88XmYw+Qi/OTmE3pXsVrot6psOE
-> Fgy[uTu-grease
9Oo+QfjC+h8Wlm1UcN1KcEa5G9t8mw9UF0aoafJYQnGBwdJAY1UgDbNVIWb3j5yD
EnIMAQ6RPEQtm9sXnDrY+f5A6vxNdYWMdSNUOcYi2In9Ux+Q9Us4d2A
--- c3Sqf+zgIZpEQ59/pCBoKFCuwAUjPCzAFImZsZ9pqZc
™°ÚÖ+ïƒGù[?<01>ÿ#<23>çk|}¡hn^Ô³lì!€_­eÑ(ô™—ìFèôjÖ ²9•œ¿4OZžH¯Ý²˜žyÞ¬ËYl=®CwÊ4o_

14
secrets/nullhex-smtp.age Normal file
View file

@ -0,0 +1,14 @@
age-encryption.org/v1
-> ssh-ed25519 H6uv4Q k1/9tYh1a2JNaZCXB2RJgRA7hQ7vg0mE7B4a0lVCvW8
y4aGbd1scFAMA6mQZv6lshDFR/7TsCHKC3NuOWmE1Ss
-> ssh-ed25519 K2vF/Q Fqd9YCy61FlWmBiWXAJeJDAKeXtdDO9N5w0L2FBZGB0
lj9yucjMsmBshHtpz6VqRRb/MA4+DKUM9jo1ixY59Dc
-> ssh-ed25519 ntXL8g z+btuETbHoPe31h87MDOGM41vW3lq9xLIE1QU3EnME4
BtQLF81szEiwmGVcxbdF7Ls0mrV9UUJbvZ4N9Zy6dG0
-> ssh-ed25519 kgCrKA HFjfjTV8L6ftCuUh/fD+sGuJK0Ev++r2qyEqr+fTKmM
/m+7SzjOI5nmt/V+hMau9Rfi9RIbbPNPFSuWxUvhkM4
-> bN-grease }R]4T%[p
6yeWs4CF8vqsnJ/l3DX9JKODjBv0gkc66HFmCoGKtDZCtfNWeO82CW6UE50MES5E
lQL5woQJVXLL3HTIsNKbXeigjBZ1/SSksbMBGeeu/+DXkrUHdPo37pz/KcQ
--- La4OQuTEE9G8czWAz8t1EhHNIa6rE7hoq3tckn6GxOo
ý@ù<>.`ø¹¨Å´z8ÔǬ};ÔŠK ¯†<C2AF>G<[ÞdNpr¹ÄòùÞ ½ bßü.¯•¨³Ò

8
secrets/photoprism.age Normal file
View file

@ -0,0 +1,8 @@
age-encryption.org/v1
-> ssh-ed25519 K2vF/Q gbzVy3hrykVeOCwjPo6Ma8tTTemdtiRwAtX96cA2viE
NFSztfWodmZ4TQFBMgx9e1U2ZO37Nt/MKJEYBBrICrA
-> s.pLZ.|-grease %UVo!F YgUB rG`)8.@w
pYerZHERVJx3dldU27I9vIxh5mizU4cW4F1QTRxk646K0abW7H6rqp6Qyr096fLF
c9egbGKMJFNgWoXWaauMaGCAV2D8km5DHSWVoEMZVkskQSprSUWh
--- SANH4pgKXob6sZ/jhnqkgXFC9QzVbI81HqxvwiayK2Y
õÐ4¿ÆÝž• ë LªH²jæœ[§ Șp(löl@™GÊà¸ÍRƒr‰)P¤0Q?àG•®ÂaÜfú€ø»÷<>

View file

@ -5,6 +5,7 @@ let
mossnet = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAA0bsVbdQR6iWNLKIiID57A1+dVXC58Dtf5cSXg6/JF root@box";
lituus = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH2lAb33LH3JNuOfBXt971u0tHe+NURFecQdfjwEj+C+ root@lituus";
helix = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAKrL6IDHNnHmxi0q9nzu87NOyidPm3HpE7klU368lEf root@helix";
helix2 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK2G81z1E51ioJQGLHnTJEjgSdBqLM6mb72Z+0atE6Bf root@helix";
curve = [ system user ];
allUserKeys = [ system user mossnet ];
systemOnly = [ system mossnet lituus helix ];
@ -14,20 +15,23 @@ in
"fastmail.age".publicKeys = allUserKeys;
"mossnet.age".publicKeys = allUserKeys;
"curve-wg.age".publicKeys = curve;
"box-wg.age".publicKeys = [ mossnet ];
"wallabag-password.age".publicKeys = [ mossnet ];
"wallabag-secret.age".publicKeys = [ mossnet ];
"nullhex-smtp.age".publicKeys = systemOnly;
"borg-password.age".publicKeys = systemOnly;
"borg-key.age".publicKeys = systemOnly;
"freshrss-dbpass.age".publicKeys = [ helix ];
"helix-wg.age".publicKeys = [ helix2 helix ];
"freshrss-dbpass.age".publicKeys = [ helix2 helix ];
"woodpecker-server-secrets.age".publicKeys = [ helix2 helix ];
"gitea-dbpass.age".publicKeys = [ helix helix2 ];
"synapse-config.age".publicKeys = [ lituus ];
"synapse-database-password.age".publicKeys = [ lituus ];
"sealight-mod-password.age".publicKeys = [ lituus ];
"telegram-matrix-env.age".publicKeys = [ lituus ];
"wallabag.age".publicKeys = [ mossnet ];
"woodpecker-agent-secret.age".publicKeys = [ mossnet helix ];
"woodpecker-server-secrets.age".publicKeys = [ helix ];
"gitea-dbpass.age".publicKeys = [ helix ];
"woodpecker-agent-secret.age".publicKeys = [ mossnet helix helix2 ];
"box-wg.age".publicKeys = [ mossnet ];
"wallabag-password.age".publicKeys = [ mossnet ];
"wallabag-secret.age".publicKeys = [ mossnet ];
}

Binary file not shown.