greg/nixos
1
0
Fork 1
Code Issues Pull Requests 2 Actions Packages Projects Releases Wiki Activity

Compare commits

base: greg/nixos:0196f1fd077d5981f57372c56df36b621c1e5c97
Branches Tags
greg/nixos:main greg/nixos:auto/update-flake-lock-20260802 greg/nixos:auto/update-flake-lock-20260726 greg/nixos:auto/update-flake-lock-20260719 greg/nixos:auto/update-flake-lock-20260712 greg/nixos:retry/update-flake-lock-20260607 greg/nixos:auto/update-flake-lock-20260607 greg/nixos:auto/update-flake-lock-20260524 greg/nixos:feat/anubis-gitea greg/nixos:auto/update-flake-lock-20260518 greg/nixos:auto/update-flake-lock-20260517 greg/nixos:auto/update-flake-lock-20260510
..
compare: greg/nixos:feat/anubis-gitea
Branches Tags
greg/nixos:main greg/nixos:auto/update-flake-lock-20260802 greg/nixos:auto/update-flake-lock-20260726 greg/nixos:auto/update-flake-lock-20260719 greg/nixos:auto/update-flake-lock-20260712 greg/nixos:retry/update-flake-lock-20260607 greg/nixos:auto/update-flake-lock-20260607 greg/nixos:auto/update-flake-lock-20260524 greg/nixos:feat/anubis-gitea greg/nixos:auto/update-flake-lock-20260518 greg/nixos:auto/update-flake-lock-20260517 greg/nixos:auto/update-flake-lock-20260510
4 Commits
0196f1fd07 .. feat/anubis-gitea
Author SHA1 Message Date
klaatu aa4afea341 chore(gitea/anubis): remove anubis-secret from kustomization
buildbot/nix-eval Build done. (1 warning)
Details
buildbot/nix-build Build done.
Details
2026-05-21 06:05:54 +00:00
klaatu b12731a100 chore(gitea/anubis): remove anubis-secret.yaml, no manual secret needed
buildbot/nix-eval Build done.
Details
2026-05-21 06:05:42 +00:00
klaatu ce2c9c76a7 chore(gitea/anubis): remove ED25519 secret env var, Anubis auto-generates key
buildbot/nix-eval Build done.
Details
2026-05-21 06:05:34 +00:00
root dc083ddf1a feat(gitea): add Anubis anti-crawler sidecar
buildbot/nix-eval Build done. (1 warning)
Details
buildbot/nix-build Build done.
Details 
Anubis (https://anubis.techaro.lol) is a lightweight proof-of-work
challenge that protects web services from AI crawlers and scrapers.

Changes:
- Add Anubis as an extraContainers sidecar in the Gitea HelmRelease
  - Listens on :8080, proxies to Gitea at http://localhost:3000
  - DIFFICULTY=4 (default; tune up to increase challenge strength)
  - SERVE_ROBOTS_TXT=true (Anubis manages robots.txt)
  - OG_PASSTHROUGH=true (OpenGraph bots pass through for link previews)
  - Signs challenges with ED25519 key from 'anubis-key' secret
- Add anubis port (8080) to Gitea service via additionalPorts
- Update Ingress to route to the 'anubis' port instead of 'http'
- Add anubis-secret.yaml placeholder with creation instructions

One-time setup required before applying:
  kubectl create secret generic anubis-key \
    --namespace gitea \
    --from-literal=ED25519_PRIVATE_KEY_HEX=$(openssl rand -hex 32)
 2026-05-20 03:34:42 -05:00
133 changed files with 2388 additions and 1837 deletions
Expand all files Collapse all files
.gitea/workflows/update-zims.yaml
-51
View File
@@ -1,51 +0,0 @@
name: Update zims pin
"on":
schedule:
- cron: "0 2 1 * *" # 0200 on the first of every month
workflow_dispatch:
jobs:
update-flake-lock:
runs-on: nix-latest
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Update flake.lock
run: nix run .#zim-updater -- --output pkgs/zim/blobs.json
- name: Create PR if changed
env:
GITEA_TOKEN: ${{ secrets.KLAATU_TOKEN }}
GITEA_URL: https://src.thehellings.com
REPO: greg/nixos
run: |
if git diff --quiet pkgs/zim/blobs.json; then
echo "blobs.json unchanged, nothing to do"
exit 0
fi
BRANCH="auto/update-zims-$(date +%Y%m%d)"
git config user.email "klaatu@thehellings.com"
git config user.name "klaatu"
git checkout -b "$BRANCH"
git add pkgs/zim/blobs.json
git commit -m "chore: update zim blobs.json $(date +%Y-%m-%d)"
# Push branch using token auth
git remote set-url origin "https://klaatu:${GITEA_TOKEN}@${GITEA_URL#https://}/${REPO}.git"
git push origin "$BRANCH"
# Create PR via Gitea API
curl -s -X POST \
-H "Authorization: token ${GITEA_TOKEN}" \
-H "Content-Type: application/json" \
"${GITEA_URL}/api/v1/repos/${REPO}/pulls" \
-d "{
\"title\": \"chore: update zims $(date +%Y-%m-%d)\",
\"head\": \"$BRANCH\",
\"base\": \"main\",
\"body\": \"Automated monthly zims update.\\n\\nGenerated by Gitea Actions.\",
\"assignees\": [\"greg\"]
}"
ca/intermediate_ca.crt
+12
View File
@@ -0,0 +1,12 @@
-----BEGIN CERTIFICATE-----
MIIByDCCAW+gAwIBAgIRANS+dPEH5Vqug7OWhCMmcx4wCgYIKoZIzj0EAwIwLjER
MA8GA1UEChMISGVsbGluZ3MxGTAXBgNVBAMTEEhlbGxpbmdzIFJvb3QgQ0EwHhcN
MjQwMjIwMjEyNzIxWhcNMzQwMjE3MjEyNzIxWjA2MREwDwYDVQQKEwhIZWxsaW5n
czEhMB8GA1UEAxMYSGVsbGluZ3MgSW50ZXJtZWRpYXRlIENBMFkwEwYHKoZIzj0C
AQYIKoZIzj0DAQcDQgAErZUhPfx5MpNbNVyqHDrIgUGnb6Hitl8hXlpH+kgjBzCi
7I/+TQnl9Tc0VVNOFOYLOfBi7hV3/QudUtLGk0FKeaNmMGQwDgYDVR0PAQH/BAQD
AgEGMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0OBBYEFMZR8LDd+hNy+TmtEHvt
zRzXboh2MB8GA1UdIwQYMBaAFAlH11TwIFGB/K75qZ3e0S+fN3JUMAoGCCqGSM49
BAMCA0cAMEQCIBxHK6r8pMX5hrTwYKRfMmRIt44m0KtNejA2T5t09hs+AiBfvmHb
LfoE4qoC6NgpvXorAbx+O7xkem/9svF0Ob+RsA==
-----END CERTIFICATE-----
ca/root_ca.crt
+11
View File
@@ -0,0 +1,11 @@
-----BEGIN CERTIFICATE-----
MIIBoTCCAUagAwIBAgIRAL/1mvE8+73nRFGsvzaaVSAwCgYIKoZIzj0EAwIwLjER
MA8GA1UEChMISGVsbGluZ3MxGTAXBgNVBAMTEEhlbGxpbmdzIFJvb3QgQ0EwHhcN
MjQwMjIwMjEyNzIwWhcNMzQwMjE3MjEyNzIwWjAuMREwDwYDVQQKEwhIZWxsaW5n
czEZMBcGA1UEAxMQSGVsbGluZ3MgUm9vdCBDQTBZMBMGByqGSM49AgEGCCqGSM49
AwEHA0IABEgNBjlT/7gmzNp9vKJvGPJn9/IizuMGVpucdrN9+J1u1ABkLNRzj5p2
g7s3e/BG+EJnnTf/2tuq3p/wPqmQkdujRTBDMA4GA1UdDwEB/wQEAwIBBjASBgNV
HRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQWBBQJR9dU8CBRgfyu+amd3tEvnzdyVDAK
BggqhkjOPQQDAgNJADBGAiEA/uBclcFCOpkEgAeBAVurktYB82sMdIyyDGHcjlwi
pvkCIQC2kuZ/nXRjibeIebQIVTBskQ1LxlLxnx7zNSjtr3kFfQ==
-----END CERTIFICATE-----
compose/attic.yaml
+54
View File
@@ -0,0 +1,54 @@
services:
attic:
container_name: attic
image: ghcr.io/zhaofengli/attic:latest
command: ["-f", "/attic/server.toml"]
restart: unless-stopped
ports:
- 8080:8080
networks:
attic:
pgattic:
volumes:
- /mnt/all/configs/attic/server.toml:/attic/server.toml
- /mnt/all/containers/attic/data:/attic/storage
env_file:
- stack.env
depends_on:
pgattic:
condition: service_healthy
healthcheck:
test:
[
"CMD-SHELL",
"wget --no-verbose --tries=1 --spider http://attic:8080 || exit 1",
]
interval: 15s
timeout: 10s
retries: 10
start_period: 15s
deploy:
resources:
reservations:
cpus: 1.0
pgattic:
container_name: pgattic
image: postgres:17.6-alpine
restart: unless-stopped
ports: []
networks:
pgattic:
volumes:
- /mnt/all/containers/attic/postgres:/var/lib/postgresql/data
env_file:
- stack.env
healthcheck:
test: ["CMD-SHELL", "pg_isready -U $${POSTGRES_USER} -d $${POSTGRES_DB}"]
interval: 10s
timeout: 5s
retries: 5
networks:
attic:
pgattic:
compose/pinchflat.yaml
+9
View File
@@ -0,0 +1,9 @@
services:
pinchflat:
image: ghcr.io/kieraneglin/pinchflat:latest
ports:
- "8945:8945"
volumes:
- "/mnt/all/configs/pinchflat:/config"
- "/mnt/all/video/yt:/downloads"
restart: unless-stopped
compose/restic.yaml
+19
View File
@@ -0,0 +1,19 @@
# Demo of rest-server with prometheus and grafana
version: "2"
services:
restserver:
image: "restic/rest-server:0.14.0"
volumes:
- /mnt/all/backups:/data
- /mnt/all/configs/certs:/certs
environment:
OPTIONS: >-
--tls
--tls-cert /certs/nas1.shire-zebra.ts.net.crt
--tls-key /certs/nas1.shire-zebra.ts.net.key
--path /data
--prometheus
--debug
ports:
- "30248:8000"
darwin/baseline.nix
+4 -32
View File
@@ -32,38 +32,10 @@ let
};
in
{
environment = {
launchDaemons = {
"limit.maxfiles.plist" = {
enable = true;
text = ''
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>limit.maxfiles</string>
<key>ProgramArguments</key>
<array>
<string>launchctl</string>
<string>limit</string>
<string>maxfiles</string>
<string>524288</string>
<string>524288</string>
</array>
<key>RunAtLoad</key>
<true/>
</dict>
</plist>
'';
};
};
systemPackages = with pkgs; [
agenix
pkgs'.hms
procps # Includes tools like `watch`, `kill`, and `ps`
];
};
environment.systemPackages = with pkgs; [
agenix
pkgs'.hms
];
fonts.packages = with pkgs; [
dejavu_fonts
darwin/hosts/lithic/default.nix
+1 -1
View File
@@ -11,7 +11,6 @@ in
enable = true;
brews = [
"bitwarden-cli"
"colima"
"direnv"
"github-mcp-server"
{
@@ -38,6 +37,7 @@ in
"notion"
"notunes"
"onlyoffice"
"podman-desktop"
"tabby"
"zed"
];
flake.lock
Generated
+87 -136
View File
@@ -31,11 +31,11 @@
"treefmt-nix": "treefmt-nix"
},
"locked": {
"lastModified": 1783833875,
"narHash": "sha256-G+hRtNJ/Nnr6VFMQp2UZdx/ckJDR/RJoK0Fy/yx1/YY=",
"lastModified": 1779096866,
"narHash": "sha256-8HtF1G7OPMXzo+f+0W+7zwzhuBUSk2EMrOS4ZvFw7+I=",
"owner": "nix-community",
"repo": "buildbot-nix",
"rev": "147af587241e2af85399402da60a4f44fdb1e5d7",
"rev": "891f2baba218f4365f0c6ef96ea33f9b277f5ed0",
"type": "github"
},
"original": {
@@ -53,11 +53,11 @@
"stable": "stable"
},
"locked": {
"lastModified": 1783909498,
"narHash": "sha256-T9OfLPLuh1Bf1xojlpWXwooJ6IXapxvb8GM0p3YNy8g=",
"lastModified": 1762034856,
"narHash": "sha256-QVey3iP3UEoiFVXgypyjTvCrsIlA4ecx6Acaz5C8/PQ=",
"owner": "zhaofengli",
"repo": "colmena",
"rev": "76ba0daa542880b730faec81f4e87efcaa63bc57",
"rev": "349b035a5027f23d88eeb3bc41085d7ee29f18ed",
"type": "github"
},
"original": {
@@ -95,11 +95,11 @@
]
},
"locked": {
"lastModified": 1784362797,
"narHash": "sha256-EP9b9b+OXDxHBPefFwMYCIaLq0fn3UkmrbfzbLUT7kQ=",
"lastModified": 1779036909,
"narHash": "sha256-zXcwYQGCT6pzinK+1dBB2ekTVtfxGZAapb3Evdcu4fY=",
"owner": "lnl7",
"repo": "nix-darwin",
"rev": "b4cccbd4bc299c1f71ae185b79c3cf99aa82805c",
"rev": "56c666e108467d87d13508936aade6d567f2a501",
"type": "github"
},
"original": {
@@ -112,11 +112,11 @@
"flake-compat": {
"flake": false,
"locked": {
"lastModified": 1767039857,
"narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
"lastModified": 1650374568,
"narHash": "sha256-Z+s0J8/r907g149rllvwhb4pKi8Wam5ij0st8PwAh+E=",
"owner": "edolstra",
"repo": "flake-compat",
"rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
"rev": "b4a34015c698c7793d592d66adbab377907a2be8",
"type": "github"
},
"original": {
@@ -162,11 +162,11 @@
"nixpkgs-lib": "nixpkgs-lib"
},
"locked": {
"lastModified": 1782949081,
"narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=",
"lastModified": 1778716662,
"narHash": "sha256-m1Yf0wZ8j1OHjTc2UwHwyQRSnNeSgLJOd7q5Y45hzi4=",
"owner": "hercules-ci",
"repo": "flake-parts",
"rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e",
"rev": "f7c1a2d347e4c52d5fb8d10cb4d94b5884e546fb",
"type": "github"
},
"original": {
@@ -183,11 +183,11 @@
]
},
"locked": {
"lastModified": 1782949081,
"narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=",
"lastModified": 1778716662,
"narHash": "sha256-m1Yf0wZ8j1OHjTc2UwHwyQRSnNeSgLJOd7q5Y45hzi4=",
"owner": "hercules-ci",
"repo": "flake-parts",
"rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e",
"rev": "f7c1a2d347e4c52d5fb8d10cb4d94b5884e546fb",
"type": "github"
},
"original": {
@@ -218,15 +218,12 @@
}
},
"flake-utils": {
"inputs": {
"systems": "systems_2"
},
"locked": {
"lastModified": 1731533236,
"narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
"lastModified": 1659877975,
"narHash": "sha256-zllb8aq3YO3h8B/U0/J1WBgAL8EX5yWf5pMj3G0NAmc=",
"owner": "numtide",
"repo": "flake-utils",
"rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
"rev": "c0e246b9b83f637f4681389ecabcb2681b4f3af0",
"type": "github"
},
"original": {
@@ -242,11 +239,11 @@
]
},
"locked": {
"lastModified": 1784407317,
"narHash": "sha256-iZrxHToDJWnvt+5LGAtvuQMTy1NZYlNEKbKaVtBJNcc=",
"lastModified": 1779125151,
"narHash": "sha256-bPHT0oJAHe5a43lkkSGAiCEg/RBqpwv5xsFrcj+Bog8=",
"owner": "nix-community",
"repo": "home-manager",
"rev": "39411a8e12a5526d992e65bc7e3dc9a4414d6713",
"rev": "fab3fd7327a0ac7a1fae5095bf140377704fac7f",
"type": "github"
},
"original": {
@@ -281,14 +278,14 @@
"inputs": {
"flake-compat": "flake-compat_2",
"nixpkgs": "nixpkgs_2",
"systems": "systems_3"
"systems": "systems_2"
},
"locked": {
"lastModified": 1784344393,
"narHash": "sha256-yAo2ZzSIdeBZg7cOKUpQxwflL+DRYN+1DMObZk2lP2Q=",
"lastModified": 1778039471,
"narHash": "sha256-Arjg44jFcpSqOKK05EIxbKIjhfjou/EGF12COFU+9QA=",
"owner": "Infinidoge",
"repo": "nix-minecraft",
"rev": "7297d14c52ec8ef39c6aeff2c1818541fd030473",
"rev": "87611ef4788116de05f851920c5958f0c37d5b05",
"type": "github"
},
"original": {
@@ -303,11 +300,11 @@
"treefmt-nix": "treefmt-nix_2"
},
"locked": {
"lastModified": 1784016977,
"narHash": "sha256-TydDba3YD2u15uS0L+PDs7lMqPopnzWggljTKDqOCSw=",
"lastModified": 1778839878,
"narHash": "sha256-S2nSP6YWUz8I2uRZuAY93FoAAUa9TiZetLzjBv1n5vk=",
"owner": "Mic92",
"repo": "niks3",
"rev": "b306808bf381e7e66e33de1e9446a1be0935f4e3",
"rev": "c29f3641de064545d75f00318cd45bea2b4ea1d0",
"type": "github"
},
"original": {
@@ -324,11 +321,11 @@
]
},
"locked": {
"lastModified": 1737420293,
"narHash": "sha256-F1G5ifvqTpJq7fdkT34e/Jy9VCyzd5XfJ9TO8fHhJWE=",
"lastModified": 1729742964,
"narHash": "sha256-B4mzTcQ0FZHdpeWcpDYPERtyjJd/NIuaQ9+BV1h+MpA=",
"owner": "nix-community",
"repo": "nix-github-actions",
"rev": "f4158fa080ef4503c8f4c820967d946c2af31ec9",
"rev": "e04df33f62cdcf93d73e9a04142464753a16db67",
"type": "github"
},
"original": {
@@ -338,15 +335,12 @@
}
},
"nix-hardware": {
"inputs": {
"nixpkgs": "nixpkgs_4"
},
"locked": {
"lastModified": 1784310968,
"narHash": "sha256-rkSPTePrKqs4dg+i7ZFCq93+HrClac6oSwXX927SVjA=",
"lastModified": 1779099457,
"narHash": "sha256-u73aVD/lUmmT3JV+kPDztl7zPwQKd0eobD1AbJltaGs=",
"owner": "nixos",
"repo": "nixos-hardware",
"rev": "779c32a00155994c86cde8213a8dd4df139d4355",
"rev": "8792fab9d4a6454a9201675f01326f827ce35ead",
"type": "github"
},
"original": {
@@ -357,11 +351,11 @@
},
"nixpkgs": {
"locked": {
"lastModified": 1783224372,
"narHash": "sha256-8i/87eeoqiGE4yOTjwSA3Eh/ziJRQEmd/unYU+K27sk=",
"lastModified": 1750134718,
"narHash": "sha256-v263g4GbxXv87hMXMCpjkIxd/viIF7p3JpJrwgKdNiI=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "d407951447dcd00442e97087bf374aad70c04cea",
"rev": "9e83b64f727c88a7711a2c463a7b16eedb69a84c",
"type": "github"
},
"original": {
@@ -373,11 +367,11 @@
},
"nixpkgs-lib": {
"locked": {
"lastModified": 1782614948,
"narHash": "sha256-ePjCwr1sNm9NYUqywL7QfK3JnlS015msC+eBu2zKlp8=",
"lastModified": 1777168982,
"narHash": "sha256-GOkGPcboWE9BmGCRMLX3worL4EMnsnG8MyKmXNeYuhQ=",
"owner": "nix-community",
"repo": "nixpkgs.lib",
"rev": "db3f255737b94216eb71cce308e2912cf6bc2d7c",
"rev": "f5901329dade4a6ea039af1433fb087bd9c1fe14",
"type": "github"
},
"original": {
@@ -388,11 +382,11 @@
},
"nixpkgs-lib_2": {
"locked": {
"lastModified": 1783821755,
"narHash": "sha256-eMPX9S6MKPyUnaOgeRfrG7OKUiAlc1AlcRinMbSB0WA=",
"lastModified": 1778984393,
"narHash": "sha256-r755Kh5Q0XBTPNuv9rL2rsUJTq8BDhb+lIwRWhl6yYA=",
"owner": "nix-community",
"repo": "nixpkgs.lib",
"rev": "228ab8523d81526e57a6ca342e1a919fb6d246a8",
"rev": "0d14a58ab7aa3f513c58ccc9e47e77ffd92be204",
"type": "github"
},
"original": {
@@ -419,11 +413,11 @@
},
"nixpkgs_3": {
"locked": {
"lastModified": 1783978241,
"narHash": "sha256-7kK0Y/fIV2NTKArkd/eZGaFg+dEmgP8KDRsGK2vB5M4=",
"lastModified": 1778491576,
"narHash": "sha256-9YOHDS9ANGbRmf3DSQ9UCvas3CyYNIBwBkKGQZTLXGY=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "a8b81d3cc8d35af7bc98694696bea61ad4f8fca7",
"rev": "1174f92bf37f1a5914be77e1b44482d6fbc75ecc",
"type": "github"
},
"original": {
@@ -435,40 +429,11 @@
},
"nixpkgs_4": {
"locked": {
"lastModified": 1767892417,
"narHash": "sha256-8bW3q88CEg2u4hSP66Vf4lpbLonHz7hqDNBMcCY7E9U=",
"rev": "3497aa5c9457a9d88d71fa93a4a8368816fbeeba",
"type": "tarball",
"url": "https://releases.nixos.org/nixos/unstable/nixos-26.05pre924538.3497aa5c9457/nixexprs.tar.xz"
},
"original": {
"type": "tarball",
"url": "https://channels.nixos.org/nixos-unstable/nixexprs.tar.xz"
}
},
"nixpkgs_5": {
"locked": {
"lastModified": 1783915482,
"narHash": "sha256-FmieJB8/OUvNxbkboi7+IGfIuSXY3nF/hZQm8kD0r50=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "6cdc7fc76e8bf7fde9fa43a849fcaaa70e230dee",
"type": "github"
},
"original": {
"owner": "NixOS",
"ref": "nixpkgs-unstable",
"repo": "nixpkgs",
"type": "github"
}
},
"nixpkgs_6": {
"locked": {
"lastModified": 1784356753,
"narHash": "sha256-12KrbMiWLcf8m7pCvAtZh1ZrgF85ZXDXvfR/fWTKy84=",
"lastModified": 1778869304,
"narHash": "sha256-30sZNZoA1cqF5JNO9fVX+wgiQYjB7HJqqJ4ztCDeBZE=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "61b7c44c4073f0b827768aff0049561b5110ea5a",
"rev": "d233902339c02a9c334e7e593de68855ad26c4cb",
"type": "github"
},
"original": {
@@ -478,7 +443,7 @@
"type": "github"
}
},
"nixpkgs_7": {
"nixpkgs_5": {
"locked": {
"lastModified": 1777207419,
"narHash": "sha256-V3bmPWAajDiC+1ClDOp55gianW2EyRJSJOyu1RUQibc=",
@@ -496,16 +461,16 @@
},
"nixunstable": {
"locked": {
"lastModified": 1784700541,
"narHash": "sha256-LcCdjhqwjFVrFTNW6tHm3KNYRrD1TA6bYRea30yIIjw=",
"owner": "geri1701",
"lastModified": 1778869304,
"narHash": "sha256-30sZNZoA1cqF5JNO9fVX+wgiQYjB7HJqqJ4ztCDeBZE=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "3c598184d1f70c5d0beeea8b95d01ab0179e4ef7",
"rev": "d233902339c02a9c334e7e593de68855ad26c4cb",
"type": "github"
},
"original": {
"owner": "geri1701",
"ref": "lego-v5-acme-spike",
"owner": "nixos",
"ref": "nixos-unstable",
"repo": "nixpkgs",
"type": "github"
}
@@ -513,15 +478,17 @@
"nixvimunstable": {
"inputs": {
"flake-parts": "flake-parts_2",
"nixpkgs": "nixpkgs_5",
"systems": "systems_4"
"nixpkgs": [
"nixunstable"
],
"systems": "systems_3"
},
"locked": {
"lastModified": 1784057377,
"narHash": "sha256-yycNej5//EsRbV10moBoh+/63vXEwZD1ZFEiRm6C9rQ=",
"lastModified": 1779116047,
"narHash": "sha256-2BnXm4/BvR5B0CH8nxC4CL+y+Z7woqPbPxKO7IMH85U=",
"owner": "nix-community",
"repo": "nixvim",
"rev": "07180a087e4a00720dc0731cbcd8dec796974381",
"rev": "1367315826ebda2bebbf896029f44ac05df523f5",
"type": "github"
},
"original": {
@@ -534,14 +501,14 @@
"nurpkgs": {
"inputs": {
"flake-parts": "flake-parts_3",
"nixpkgs": "nixpkgs_6"
"nixpkgs": "nixpkgs_4"
},
"locked": {
"lastModified": 1784417922,
"narHash": "sha256-19XZ56wJXArMKxjY25pKXkNp/FrYHGoo+HuQtW6teSM=",
"lastModified": 1779124721,
"narHash": "sha256-Z1q8QkuHAdkmXh4SItOzViVVFVLb+tzaEaYCTHI2UKk=",
"owner": "nix-community",
"repo": "NUR",
"rev": "2c806d314605495dd7fd75b5950003a062e2b47a",
"rev": "ad57d8faf36bb02c65c90012cd0289daa0b2d9c4",
"type": "github"
},
"original": {
@@ -571,16 +538,16 @@
},
"stable": {
"locked": {
"lastModified": 1783625654,
"narHash": "sha256-pI1244/PJfTyKhlAr2QYQC55vR6UQdnGA0rJUgtO2IQ=",
"lastModified": 1750133334,
"narHash": "sha256-urV51uWH7fVnhIvsZIELIYalMYsyr2FCalvlRTzqWRw=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "a0230bd8d5cbd13893b2263918d396a2c7dd0407",
"rev": "36ab78dab7da2e4e27911007033713bab534187b",
"type": "github"
},
"original": {
"owner": "NixOS",
"ref": "release-26.05",
"ref": "nixos-25.05",
"repo": "nixpkgs",
"type": "github"
}
@@ -630,22 +597,6 @@
"type": "github"
}
},
"systems_4": {
"locked": {
"lastModified": 1774449309,
"narHash": "sha256-brhZ8DmuGtzkCYHJg4HEd602amKm89Y9ytsFZ5uWD1w=",
"owner": "nix-systems",
"repo": "default",
"rev": "c29398b59d2048c4ab79345812849c9bd15e9150",
"type": "github"
},
"original": {
"owner": "nix-systems",
"ref": "future-26.11",
"repo": "default",
"type": "github"
}
},
"treefmt-nix": {
"inputs": {
"nixpkgs": [
@@ -654,11 +605,11 @@
]
},
"locked": {
"lastModified": 1780220602,
"narHash": "sha256-eynAfOmbmxJnkp7YewvCEbShNnnYJ9gLLqkzsYtBPeM=",
"lastModified": 1775636079,
"narHash": "sha256-pc20NRoMdiar8oPQceQT47UUZMBTiMdUuWrYu2obUP0=",
"owner": "numtide",
"repo": "treefmt-nix",
"rev": "db947814a175b7ca6ded66e21383d938df01c227",
"rev": "790751ff7fd3801feeaf96d7dc416a8d581265ba",
"type": "github"
},
"original": {
@@ -675,11 +626,11 @@
]
},
"locked": {
"lastModified": 1780220602,
"narHash": "sha256-eynAfOmbmxJnkp7YewvCEbShNnnYJ9gLLqkzsYtBPeM=",
"lastModified": 1775636079,
"narHash": "sha256-pc20NRoMdiar8oPQceQT47UUZMBTiMdUuWrYu2obUP0=",
"owner": "numtide",
"repo": "treefmt-nix",
"rev": "db947814a175b7ca6ded66e21383d938df01c227",
"rev": "790751ff7fd3801feeaf96d7dc416a8d581265ba",
"type": "github"
},
"original": {
@@ -690,14 +641,14 @@
},
"vsext": {
"inputs": {
"nixpkgs": "nixpkgs_7"
"nixpkgs": "nixpkgs_5"
},
"locked": {
"lastModified": 1784343266,
"narHash": "sha256-EGkegdTz2n6ESyih8s3dUuPyJQWlYfPp7U41J05g8PY=",
"lastModified": 1779077424,
"narHash": "sha256-2nuxPFMR1R3IlV/OlF65qjs2gGjHhASa7U0+8QX0bJg=",
"owner": "nix-community",
"repo": "nix-vscode-extensions",
"rev": "472a3e862c76c64ac3ad75a24d332cb5cdd5f1bb",
"rev": "b7bde1772cdb20e77381516fbbb5306a621d0965",
"type": "github"
},
"original": {
@@ -714,11 +665,11 @@
]
},
"locked": {
"lastModified": 1784058842,
"narHash": "sha256-3u3tvbCIAid3Mv7RrJx13jusIEQC/HeKYhO/SUSxR3A=",
"lastModified": 1777732699,
"narHash": "sha256-2uX/XtOWZ/oy2rerRynVhqVA//ZXZ3Fo60PikLHEPQc=",
"owner": "nix-community",
"repo": "NixOS-WSL",
"rev": "24c8dc8e0f2170e1a377be24dfadc7d9d21dc1ad",
"rev": "5482f113fd31ebac131d1ebeb2ae90bf0d5e41f5",
"type": "github"
},
"original": {
flake.nix
+7 -8
View File
@@ -27,9 +27,11 @@
niks3.url = "github:Mic92/niks3";
nix-hardware.url = "github:nixos/nixos-hardware";
nixpkgs-lib.url = "github:nix-community/nixpkgs.lib";
nixvimunstable.url = "github:nix-community/nixvim/main";
#nixunstable.url = "github:nixos/nixpkgs/nixos-unstable";
nixunstable.url = "github:geri1701/nixpkgs/lego-v5-acme-spike";
nixvimunstable = {
url = "github:nix-community/nixvim/main";
inputs.nixpkgs.follows = "nixunstable";
};
nixunstable.url = "github:nixos/nixpkgs/nixos-unstable";
nurpkgs.url = "github:nix-community/NUR";
vsext.url = "github:nix-community/nix-vscode-extensions";
wsl = {
@@ -63,10 +65,7 @@
config = {
allowUnfree = true;
allowUnfreePredicate = _: true;
permittedInsecurePackages = [
"ventoy-1.1.05"
"electron-39.8.10"
];
permittedInsecurePackages = [ "ventoy-1.1.05" ];
};
}
);
@@ -101,7 +100,7 @@
{
deployment = {
inherit (v) tags;
targetHost = if (v ? "nebulaIp") then v.nebulaIp else v.ts;
targetHost = v.ts;
targetUser = "greg";
};
}
home/baseline/nushell/functions.nu
+12 -46
View File
@@ -1,5 +1,5 @@
# vim: set filetype=nushell :
let servers = [isaiah jeremiah zeke genesis hosea]
let servers = [isaiah jeremiah zeke genesis]
def par-map [ items: list, c: closure ] {
let results = $items | par-each -k $c
@@ -12,55 +12,15 @@ def --env unlock [] {
}
}
def nebulaIps [] {
open /etc/nixos/network.json | get hosts | items { |h, e| $e.nebulaIp? } | where $it != null | sort
}
def localIps [] {
open /etc/nixos/network.json | get hosts | items { |h, e| $e.ip? } | where $it != null | sort
}
def genNebulaCert [ --ips: string, --name: string ] {
let public = $'~/SynologyDrive/nebula/($name).key.pub' | path expand
let private = $'~/SynologyDrive/nebula/($name).key' | path expand
let cert = $'/etc/nixos/secrets/nebula/($name).crt'
let ca_cert = '~/SynologyDrive/nebula/ca.crt' | path expand
let ca_key = '~/SynologyDrive/nebula/ca.key' | path expand
# Generate public key if there isn't one already
if ( not ($public | path exists) ) {
nebula-cert keygen -out-key $private -out-pub $public
}
# Clear old cert if there is one
if ( $cert | path exists) {
rm $cert
}
# Create and sign certs
(nebula-cert sign
-ca-crt $ca_cert
-ca-key $ca_key
-name $name
-networks $ips
-out-crt $cert
-in-pub $public
)
# Agenix update
cd /etc/nixos/secrets
cat $private | agenix -e $'nebula/($name).key.age'
}
def rebuild [ $target: string = "switch" ] {
def rebuild [] {
if (uname | get operating-system) == "Darwin" {
sudo darwin-rebuild $target
sudo darwin-rebuild switch
} else {
let hostname = uname | get nodename
let build = ^nom build --keep-going $"/etc/nixos#nixosConfigurations.($hostname).config.system.build.toplevel"
if $env.LAST_EXIT_CODE == 0 {
nvd diff /run/current-system result
run0 result/bin/switch-to-configuration $target
run0 result/bin/switch-to-configuration switch
} else {
print "Error during build"
}
@@ -75,8 +35,7 @@ def deploy [ $host: string, $build: string = "" ] {
if $buildhost == "linode" or $buildhost == "genesis" {
$buildhost = "isaiah"
}
colmena apply --on $host
#nixos-rebuild switch --sudo --use-substitutes --target-host $host --build-host $buildhost
nixos-rebuild switch --sudo --use-substitutes --target-host $host --build-host $buildhost
}
def ff [ $file: string ] {
@@ -110,6 +69,13 @@ def dc [ $cmd: string = "sh" ] {
}
}
def claude [ ] {
unlock
$env.GITLAB_TOKEN = ^bw get item 7d3da4e9-5f9a-49d0-8e14-b39c010a4001 | from json | get fields | find claudeapi | get value
#$env.ANTHROPIC_API_KEY = ^bw get item e122fd08-3506-4f21-9c6a-b42b00fe5be1 | from json | get login.password
^claude
}
if ("/usr/local/bin" | path exists) {
$env.PATH = $env.PATH | append "/usr/local/bin"
}
home/baseline/ssh.nix
+25 -26
View File
@@ -13,25 +13,24 @@
includes = [ "config.local" ];
enableDefaultConfig = false;
settings =
matchBlocks =
let
nas = {
User = "admin";
user = "admin";
};
owned = {
User = "greg";
user = "greg";
};
in
{
inherit nas;
"*" = {
DynamicForward = [ "10240" ];
ForwardAgent = "yes";
LogLevel = "error";
ServerAliveInterval = 60;
SetEnv = {
TERM = "xterm-256color";
dynamicForwards = [ { port = 10240; } ];
serverAliveInterval = 60;
extraOptions = {
LogLevel = "error";
SetEnv = "TERM=xterm-256color";
};
};
@@ -42,46 +41,46 @@
"chronicles.thehellings.lan" = lib.hm.dag.entryBefore [ "*.thehellings.lan" ] nas;
gh = {
User = "git";
Hostname = "github.com";
user = "git";
hostname = "github.com";
};
"src" = {
User = "git";
Hostname = "jeremiah.shire-zebra.ts.net";
Port = 32222;
user = "git";
hostname = "jeremiah.shire-zebra.ts.net";
port = 32222;
};
srcpub = {
User = "git";
Hostname = "src.thehellings.com";
Port = 2222;
user = "git";
hostname = "src.thehellings.com";
port = 2222;
};
ivr = {
User = "git";
Hostname = "gitlab.com";
user = "git";
hostname = "gitlab.com";
};
"ivr.thehellings.lan" = lib.hm.dag.entryBefore [ "ivr" ] {
User = "gregory.hellings";
user = "gregory.hellings";
};
"*.thehellings.lan" = owned;
"10.42.*" = owned;
"host.crosswire.org crosswire" = {
Hostname = "host.crosswire.org";
User = "ghellings";
hostname = "host.crosswire.org";
user = "ghellings";
};
fedpeople = {
Hostname = "fedorapeople.org";
User = "greghellings";
hostname = "fedorapeople.org";
user = "greghellings";
};
"src.fedoraproject.org pkgs.fedoraproject.org" = {
User = "greghellings";
user = "greghellings";
};
"127.*" = {
"127.*".extraOptions = {
PubkeyAcceptedAlgorithms = "+ssh-rsa";
HostkeyAlgorithms = "+ssh-rsa";
};
home/baseline/tools.nix
+1
View File
@@ -8,6 +8,7 @@
home.packages =
with pkgs;
[
attic-client
dig
jqp
kubernetes-helm
home/hosts/builder2/default.nix
-1
View File
@@ -1 +0,0 @@
{...}: {}
home/hosts/exodus/default.nix
-4
View File
@@ -23,12 +23,8 @@
mattermost-desktop
minio-client
mumble
nebula
nix-index
adoptopenjdk-icedtea-web
pre-commit
prismlauncher
rclone
restic
restic-browser
tea
home/hosts/gregory.hellings-mbp/default.nix
+3 -9
View File
@@ -1,6 +1,5 @@
{
pkgs,
pkgs',
lib,
username,
...
@@ -21,7 +20,6 @@
claude-code
direnv
home-manager
pkgs'.dockerCompat
python3Packages.ipython
just
glab
@@ -38,22 +36,18 @@
".pip/pip.conf".text = ''
[global]
retries = 1
index-url = https://pypi.python.org/
index-url = https://pypi.python.org/simple
extra-index-url =
https://pypidev.ivrtechnology.com/
https://pypidev.ivrtechnology.com/simple/
'';
".config/uv/uv.toml".text = ''
index-strategy = "unsafe-first-match"
[[index]]
url = "https://pypidev.ivrtechnology.com/"
url = "https://pypidev.ivrtechnology.com/simple/"
name = "pypidev"
ignore-error-codes = [403]
'';
};
sessionVariables = {
BW_GITLAB_ITEM = "7d3da4e9-5f9a-49d0-8e14-b39c010a4001";
BW_ANTHROPIC_ITEM = "e122fd08-3506-4f21-9c6a-b42b00fe5be1";
};
username = username;
homeDirectory = "/Users/${username}";
};
home/hosts/icdm-root/default.nix
+4
View File
@@ -0,0 +1,4 @@
{ ... }:
{
}
home/hosts/lithic/default.nix
+1 -8
View File
@@ -1,6 +1,5 @@
{
pkgs,
pkgs',
lib,
...
}:
@@ -27,17 +26,12 @@ in
ansible
awscli2
cargo
clippy
direnv
docker
docker-compose
docker-buildx
go
home-manager
just
mcp-grafana
nil
nixVersions.stable
podman
poetry
pre-commit
(pulumi.withPackages (
@@ -51,7 +45,6 @@ in
))
python
rustc
rustfmt
terraform
];
};
hosts/default.nix
-1
View File
@@ -30,7 +30,6 @@ let
modules = [
{
nixpkgs.hostPlatform = system;
networking.hostName = name;
}
# Imported ones
top.agenix.nixosModules.default
hosts/unstable/builder2/default.nix
-60
View File
@@ -1,60 +0,0 @@
{
config,
metadata,
modulesPath,
...
}:
{
# Then build nixosConfiguration.<host>.config.system.build.images.proxmox
# SCP that to /var/lib/vz/dumps on the Proxmox host
imports = [ "${modulesPath}/virtualisation/proxmox-image.nix" ];
greg = {
home = true;
nebula.enable = true;
};
networking = {
defaultGateway = metadata.infra.gw;
nameservers = [ metadata.infra.dns ];
interfaces.ens18 = {
useDHCP = false;
ipv4.addresses = [
{
address = metadata.hosts."${config.networking.hostName}".ip;
prefixLength = 16;
}
];
};
};
virtualisation.diskSize = 20480; # Size in mebbibytes for the base disk image
# Use these instead of the above to run an LXC image
# The main reason I wouldn't use these is because Proxmox LXC does
# not seem to be well supported by either Nebula VPN or Tailscale,
# both of which I use for my mesh networking. If there isn't a need
# for the service to run on those networks, then by all means go ahead
# and use LXC!
# imports = [ (modulesPath + "/virtualisation/proxmox-lxc.nix") ];
# proxmoxLXC = {
# manageNetwork = false;
# privileged = true;
# };
# systemd.suppressedSystemUnits = [
# "dev-mqueue.mount"
# "sys-kernel-debug.mount"
# "sys-fs-fuse-connections.mount"
# ];
nix.settings = {
sandbox = false;
};
services = {
fstrim.enable = false; # Let Proxmox host handle fstrim
openssh = {
enable = true;
openFirewall = true;
settings = {
PermitRootLogin = "yes";
PasswordAuthentication = true;
PermitEmptyPasswords = "yes";
};
};
};
}
hosts/unstable/exodus/default.nix
+5 -1
View File
@@ -9,9 +9,13 @@
{
imports = [
./hardware-configuration.nix
top.nix-hardware.nixosModules.framework-intel-core-ultra-series1
top.nix-hardware.nixosModules.framework-11th-gen-intel
];
age.secrets = {
compose-attic.file = ../../../secrets/compose/attic.env.age;
};
boot = {
loader = {
systemd-boot = {
hosts/unstable/genesis/networking.nix
+1 -2
View File
@@ -22,7 +22,6 @@ let
#"1.0.0.1" # Cloudflare
#"149.112.112.112" # Quad 9
metadata.infra.gw # Currently using our UniFi router for DNS as well
"100.100.100.100"
];
in
{
@@ -130,7 +129,7 @@ in
lib.mapAttrs
(domain: net: {
master = true;
file = makeZoneFile (lib'.hostsByNet net (metadata.hosts // metadata.external)) domain;
file = makeZoneFile (lib'.hostsByNet net metadata.hosts) domain;
})
{
"shire-zebra.ts.net" = "tailscale";
hosts/unstable/hosea/arr.nix
+70
View File
@@ -0,0 +1,70 @@
{
lib,
metadata,
pkgs,
...
}:
let
ips = lib.filterAttrs (_k: v: v ? "ip" && v.ip != null) metadata.hosts;
tps = lib.filterAttrs (_k: v: v ? "ts" && v.ts != null) metadata.hosts;
get = field: set: lib.mapAttrsToList (_k: v: v.${field}) set;
getTS = get "ts" tps;
getIP = get "ip" ips;
whitelists = builtins.concatStringsSep "," (
[
"localhost"
"127.0.0.1"
]
++ getTS
++ getIP
);
in
{
services = {
prowlarr = {
enable = true;
dataDir = "/arr/prowlarr";
openFirewall = true;
};
radarr = {
enable = true;
openFirewall = true;
};
transmission = {
enable = true;
openPeerPorts = true;
openRPCPort = true;
package = pkgs.transmission_4;
settings = {
download-dir = "/arr/transmission/downloads";
rpc-bind-address = "0.0.0.0";
rpc-host-whitelist = whitelists;
rpc-host-whitelist-enabled = false;
rpc-whitelist = whitelists;
rpc-whitelist-enabled = false;
watch-dir-enabled = true;
watch-dir = "/arr/transmission/incoming";
};
};
};
systemd.mounts =
let
nfs = name: {
what = "nas1.shire-zebra.ts.net:/mnt/all/${name}";
type = "nfs";
name = "${name}.mount";
where = "/${name}";
requires = [ "tailscaled-autoconnect.service" ];
after = [ "tailscaled-autoconnect.service" ];
wantedBy = [ "multi-user.target" ];
mountConfig.Options = "_netdev,noexec,timeo=50,retrans=5,soft";
};
in
[
(nfs "arr")
(nfs "music")
(nfs "photos")
(nfs "video")
];
}
hosts/unstable/hosea/default.nix
+2 -20
View File
@@ -18,6 +18,7 @@ in
{
imports = [
# Include the results of the hardware scan.
./arr.nix
./hardware-configuration.nix
top.niks3.nixosModules.niks3
];
@@ -185,7 +186,7 @@ in
s3 = {
accessKeyFile = config.age.secrets.niks3-access-key-id.path;
bucket = "niks3";
endpoint = "nas1.shire-zebra.ts.net:30188";
endpoint = "nas1.shire-zebra.ts.net:9000";
secretKeyFile = config.age.secrets.niks3-secret-access-key.path;
useSSL = false;
};
@@ -199,25 +200,6 @@ in
};
};
systemd.mounts =
let
nfs = name: {
what = "nas1.shire-zebra.ts.net:/mnt/all/${name}";
type = "nfs";
name = "${name}.mount";
where = "/${name}";
requires = [ "tailscaled-autoconnect.service" ];
after = [ "tailscaled-autoconnect.service" ];
wantedBy = [ "multi-user.target" ];
mountConfig.Options = "_netdev,noexec,timeo=50,retrans=5,soft";
};
in
[
(nfs "music")
(nfs "photos")
(nfs "video")
];
# After first deploy: create a Grafana service account + API token for Klaatu
# via the Grafana UI, then encrypt it: agenix -e secrets/grafana-api-token.age
age.secrets.grafana-api-token = {
hosts/unstable/icdm-root/boot.nix
+11
View File
@@ -0,0 +1,11 @@
{ ... }:
{
# Bootloader.
boot = {
loader.grub = {
enable = true;
device = "/dev/sda";
};
};
}
hosts/unstable/icdm-root/default.nix
+28
View File
@@ -0,0 +1,28 @@
# Edit this configuration file to define what should be installed on
# your system. Help is available in the configuration.nix(5) man page
# and in the NixOS manual (accessible by running ‘nixos-help’).
{ pkgs, ... }:
{
imports = [
# Include the results of the hardware scan.
./hardware-configuration.nix
./boot.nix
./filesystem.nix
./location.nix
./networking.nix
./wiki.nix
];
# Define a user account. Don't forget to set a password with ‘passwd’.
users.users.greg = {
isNormalUser = true;
description = "Gregory Hellings";
extraGroups = [
"networkmanager"
"wheel"
];
packages = with pkgs; [ ];
};
}
hosts/unstable/icdm-root/filesystem.nix
+13
View File
@@ -0,0 +1,13 @@
{ ... }:
let
in
{
fileSystems."serve" = {
#device = "10.42.1.4:/volume1/icdm-mysql/";
#fsType = "nfs";
device = "/dev/sdb1";
fsType = "auto";
mountPoint = "/srv";
};
}
hosts/unstable/icdm-root/hardware-configuration.nix
+53
View File
@@ -0,0 +1,53 @@
# Do not modify this file! It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{
config,
lib,
modulesPath,
...
}:
{
imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
boot.initrd.availableKernelModules = [
"xhci_pci"
"ehci_pci"
"ahci"
"usbhid"
"usb_storage"
"sd_mod"
];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ "kvm-intel" ];
boot.extraModulePackages = [ ];
fileSystems."/" = {
device = "/dev/disk/by-uuid/dab0d455-e25e-4445-8fa4-5320047d7e7b";
fsType = "btrfs";
options = [ "subvol=@" ];
};
fileSystems."/boot" = {
device = "/dev/disk/by-uuid/5aedbb07-5761-423b-909d-2560405eae32";
fsType = "ext4";
};
fileSystems."/var" = {
device = "/dev/disk/by-uuid/57968536-c29d-417d-997e-85223d1d1f65";
fsType = "btrfs";
};
swapDevices = [ { device = "/dev/disk/by-uuid/09691dce-375a-43c6-8d40-4498d20a6d9a"; } ];
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
# (the default) this is the recommended approach. When using systemd-networkd it's
# still possible to use this option, but it's recommended to use it in conjunction
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
networking.useDHCP = lib.mkDefault true;
# networking.interfaces.eno1.useDHCP = lib.mkDefault true;
# networking.interfaces.wlp2s0.useDHCP = lib.mkDefault true;
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
}
hosts/unstable/icdm-root/location.nix
+15
View File
@@ -0,0 +1,15 @@
{ ... }:
{
# Set your time zone.
time.timeZone = "America/Chicago";
# Select internationalisation properties.
i18n.defaultLocale = "en_US.UTF-8";
# Configure keymap in X11
services.xserver.xkb = {
layout = "us";
variant = "";
};
}
hosts/unstable/icdm-root/networking.nix
+63
View File
@@ -0,0 +1,63 @@
{ ... }:
let
dnsHosts = builtins.concatStringsSep "\n" [ "wiki.icdm.lan 10.42.101.1" ];
in
{
# If we have to do proxying in Bayonnais, we can start to work on that here
# networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
networking = {
hostName = "icdm-root";
useDHCP = false;
defaultGateway = "10.42.1.1";
nameservers = [
"100.100.100.100"
"10.42.1.2"
];
enableIPv6 = false;
interfaces = {
eno1.ipv4.addresses = [
{
address = "10.42.101.1";
prefixLength = 16;
}
{
address = "10.77.1.2";
prefixLength = 16;
}
];
};
# Allow traffic through
firewall = {
enable = true;
allowedTCPPorts = [ 53 ];
allowedUDPPorts = [
53
67
];
};
extraHosts = "${dnsHosts}";
};
services.dnsmasq = {
enable = true;
settings = {
domain = "icdm.lan";
dhcp-range = [ "eno1,10.77.1.10,10.77.1.255,255.255.0.0,12h" ];
dhcp-option = [
"eno1,option:router,10.77.1.1"
"eno1,option:dns-server,10.77.1.2,1.1.1.1"
"eno1,option:domain-search,icdm.lan"
];
expand-hosts = true;
log-dhcp = true;
log-queries = true;
# Upstream servers
server = [
"1.1.1.1"
"8.8.4.4"
];
};
};
}
hosts/unstable/icdm-root/wiki.nix
+17
View File
@@ -0,0 +1,17 @@
{ pkgs, ... }:
let
wikiHost = "wiki.icdm.lan";
kiwixport = 8080;
in
{
services.kiwix-serve = {
enable = true;
port = kiwixport;
library = {
inherit (pkgs) zim;
};
};
greg.proxies."${wikiHost}".target = "http://localhost:${toString kiwixport}";
networking.firewall.allowedTCPPorts = [ 80 ];
}
hosts/unstable/jeremiah/default.nix
+2 -3
View File
@@ -88,7 +88,6 @@ in
priority = 254;
};
nebula.enable = true;
proxies."buildbot.nebula.thehellings.com".target = "http://buildbot.nebula.thehellings.com:8010/";
tailscale = {
enable = true;
tags = [ "home" ];
@@ -143,7 +142,7 @@ in
updateOutputs = false;
};
};
domain = "buildbot.nebula.thehellings.com:8010";
domain = "${config.networking.hostName}.shire-zebra.ts.net";
evalMaxMemorySize = 8192;
evalWorkerCount = 4;
gitea = {
@@ -156,7 +155,7 @@ in
webhookSecretFile = config.age.secrets.gitea-webhookSecret.path;
};
showTrace = true;
#webhookBaseUrl = "http://${config.networking.hostName}.nebula.thehellings.com:8010";
#webhookBaseUrl = "http://${config.networking.hostName}.shire-zebra.ts.net:8010";
workersFile = config.age.secrets.gitea-buildbotWorkersFile.path;
};
worker = {
hosts/unstable/kuma/default.nix
-76
View File
@@ -1,76 +0,0 @@
{
config,
metadata,
modulesPath,
pkgs,
...
}:
{
imports = [ "${modulesPath}/virtualisation/proxmox-image.nix" ];
greg = {
home = true;
nebula.enable = true;
proxies =
let
tgt = {
target = "http://localhost:${config.services.uptime-kuma.settings.PORT}";
genAliases = false;
};
in
{
"kuma.nebula.thehellings.com" = tgt;
"kuma.thehellings.lan" = tgt;
"kuma.shire-zebra.ts.net" = tgt;
};
};
nix.settings = {
sandbox = false;
};
networking = {
defaultGateway = metadata.infra.gw;
nameservers = [ metadata.infra.dns ];
interfaces.ens18 = {
useDHCP = false;
ipv4.addresses = [
{
address = metadata.hosts."${config.networking.hostName}".ip;
prefixLength = 16;
}
];
};
};
proxmox.cloudInit.enable = false;
services = {
fstrim.enable = true;
mysql = {
enable = true;
ensureDatabases = [
config.services.uptime-kuma.settings.UPTIME_KUMA_DB_NAME
];
ensureUsers = [
{
name = config.services.uptime-kuma.settings.UPTIME_KUMA_DB_USERNAME;
ensurePermissions = {
"uptimekuma.*" = "ALL PRIVILEGES";
};
}
];
package = pkgs.mariadb;
};
openssh = {
enable = true;
openFirewall = true;
};
uptime-kuma = {
enable = true;
settings = {
PORT = "3001"; # Default, but this allows us to explicitly use it elsewhere
UPTIME_KUMA_DB_TYPE = "mariadb";
UPTIME_KUMA_DB_SOCKET = "/run/mysqld/mysqld.sock";
UPTIME_KUMA_DB_NAME = "uptimekuma";
UPTIME_KUMA_DB_USERNAME = "uptimekuma";
UPTIME_KUMA_DB_PASSWORD = "uptimekuma";
};
};
};
}
hosts/unstable/linode/default.nix
+14 -283
View File
@@ -1,63 +1,29 @@
{
pkgs,
pkgs',
lib,
config,
...
}:
let
homepage = "127.0.0.1:30080";
nextcloudPort = 8080;
sshPort = 2222;
in
{
imports = [
./git.nix
./hardware-configuration.nix
./podman.nix
./matrix.nix
./nextcloud.nix
./nginx.nix
./postgres.nix
];
age.secrets = {
acme.file = ../../../secrets/acme.age;
nextcloudadmin = {
file = ../../../secrets/nextcloudadmin.age;
owner = "nextcloud";
};
};
environment.systemPackages = with pkgs; [
bind
graphviz
nix-du
pgloader
podman-compose
pkgs'.upgrade-pg-cluster
];
greg = {
backup.jobs = {
nextcloud-bkup = {
src = "/var/lib/nextcloud";
dest = "nextcloud-backup";
pre = lib.getExe (
pkgs.writeShellApplication {
name = "nextcloud-backup-pre";
runtimeInputs = [ config.services.nextcloud.occ ];
text = "nextcloud-occ maintenance:mode --on";
}
);
post = lib.getExe (
pkgs.writeShellApplication {
name = "nextcloud-backup-post";
runtimeInputs = [ config.services.nextcloud.occ ];
text = "nextcloud-occ maintenance:mode --off";
}
);
};
greg-postgresql-backup = {
src = config.services.postgresqlBackup.location;
dest = "linode-postgres";
};
};
gitea-runner = {
enable = true;
extraLabels = [
@@ -71,22 +37,19 @@ in
enable = true;
isLighthouse = true;
};
proxies."immich.thehellings.com" = {
genAliases = false;
target = "http://localhost:${builtins.toString config.services.immich-public-proxy.port}";
ssl = true;
};
tailscale.enable = true;
};
networking = {
domain = "thehellings.com";
firewall.allowedTCPPorts = [
sshPort
80
443
];
hostName = "linode";
nameservers = [
"10.157.0.2"
"100.96.198.104"
];
networkmanager.enable = lib.mkForce false;
hostName = "linode";
domain = "thehellings.com";
nameservers = [ "100.88.91.27" ];
};
programs.ssh.extraConfig = lib.strings.concatStringsSep "\n" [
@@ -97,242 +60,10 @@ in
" UserKnownHostsFile /dev/null"
];
security.acme = {
acceptTerms = true;
defaults = {
dnsPropagationCheck = false;
dnsResolver = "92.123.95.3:53,92.123.94.3:53,92.123.94.2:53,92.123.95.4:53,92.123.95.2:53";
email = "greg.hellings@gmail.com";
extraLegoRunFlags = [ "--ipv4only" ]; # Force IPv4 only
#server = "https://acme-staging-v02.api.letsencrypt.org/directory";
};
certs."thehellings.com" = {
dnsProvider = "linode";
environmentFile = config.age.secrets.acme.path;
extraDomainNames = [
"*.thehellings.com"
];
};
};
services = {
anubis = {
instances = {
git = {
enable = true;
settings = {
BIND = "/run/anubis/anubis-git/anubis.sock";
COOKIE_DOMAIN = "thehellings.com";
SERVE_ROBOTS_TXT = true;
SLOG_LEVEL = "DEBUG";
TARGET = "http://git.k3s.nebula.thehellings.com";
};
};
};
};
haproxy = {
enable = true;
config = ''
global
nbthread 4
maxconn 80
log /dev/log local0
defaults
timeout connect 500s
timeout client 500s
timeout server 1h
listen gitsshd
bind *:${toString sshPort}
timeout client 1h
mode tcp
server git-isaiah isaiah.nebula.thehellings.com:32222
server git-jeremiah jeremiah.nebula.thehellings.com:32222
server git-zeke zeke.nebula.thehellings.com:32222
frontend https
bind *:80
bind *:443 ssl crt ${config.security.acme.certs."thehellings.com".directory}/full.pem
http-request redirect scheme https unless { ssl_fc }
http-request add-header X-Forwarded-Proto https
http-response replace-header ^Set-Cookie:\ (.*) Set-Cookie \1;\ Secure
option http-server-close
option http-keep-alive
#option httplog
#declare capture response len 80
#http-response capture res.hdr(Location) id 0
use_backend git if { hdr(host) -i src.thehellings.com }
use_backend git if { req_ssl_sni -i src.thehellings.com }
use_backend next if { hdr(host) -i next.thehellings.com }
use_backend next if { req_ssl_sni -i next.thehellings.com }
use_backend matrix if { hdr(host) -i matrix.thehellings.com }
use_backend matrix if { req_ssl_sni -i matrix.thehellings.com }
use_backend web if { hdr(host) -i thehellings.com }
use_backend web if { req_ssl_sni -i thehellings.com }
backend git
mode http
balance roundrobin
option accept-unsafe-violations-in-http-response
retries 3
option forwardfor
http-request set-header Host git.k3s.nebula.thehellings.com
server git-isaiah isaiah.nebula.thehellings.com:80
server git-jeremiah jeremiah.nebula.thehellings.com:80
server git-zeke zeke.nebula.thehellings.com:80
backend matrix
mode http
balance roundrobin
option accept-unsafe-violations-in-http-response
retries 3
option forwardfor
http-request set-header Host matrix.k3s.nebula.thehellings.com
server git-isaiah isaiah.nebula.thehellings.com:80
server git-jeremiah jeremiah.nebula.thehellings.com:80
server git-zeke zeke.nebula.thehellings.com:80
backend web
mode http
balance roundrobin
option accept-unsafe-violations-in-http-response
retries 3
option forwardfor
server web-container ${homepage}
backend next
log global
mode http
balance roundrobin
option accept-unsafe-violations-in-http-response
retries 3
option forwardfor
#http-response replace-value Location http://localhost:${builtins.toString nextcloudPort}/(.*) https://next.thehellings.com/\2
server nextcloud 127.0.0.1:${builtins.toString nextcloudPort}
'';
};
immich-public-proxy = {
enable = true;
immichUrl = "https://immich.shire-zebra.ts.net";
};
logrotate = {
enable = true;
settings = {
postgresBackup = {
enable = true;
files = "${config.services.postgresqlBackup.location}/*.gz";
};
postgresLog = {
enable = true;
files = "/var/lib/postgresql/*/log/*.log";
compress = true;
compresscmd = "${pkgs.xz}/bin/xz";
};
};
};
nextcloud = {
enable = true;
package = pkgs.nextcloud33;
appstoreEnable = true;
hostName = "localhost";
https = false;
config = {
adminpassFile = config.age.secrets.nextcloudadmin.path;
adminuser = "greg";
dbhost = "/run/postgresql";
dbtype = "pgsql";
};
settings = {
default_phone_region = "US";
overwriteprotocol = "http";
trusted_domains = [ "next.thehellings.com" ];
trusted_proxies = [
"localhost"
"127.0.0.1"
];
};
};
# Move to :8080 so that we can run haproxy as the primary HTTP service
nginx.virtualHosts."${config.services.nextcloud.hostName}".listen = [
{
addr = "127.0.0.1";
port = nextcloudPort;
}
];
openssh.settings.PasswordAuthentication = false;
postgresql = {
enable = true;
package = pkgs.postgresql_15;
checkConfig = true;
ensureDatabases = [ "nextcloud" ];
#initialScript = pkgs.writeText "create-matrix-db.sql" ''
# CREATE ROLE "matrix-synapse" WITH LOGIN;
# CREATE DATABASE "synapse" WITH OWNER "matrix-synapse" TEMPLATE template0 LC_COLLATE = "C" LC_CTYPE = "C";
# GRANT ALL PRIVILEGES ON DATABASE "synapse" TO "matrix-synapse";
#''; # These are done manually in order to set the LC_COLLATE values properly
ensureUsers = [
{
name = "nextcloud";
ensureDBOwnership = true;
}
];
settings = {
log_connections = true;
log_statement = "all";
logging_collector = true;
log_filename = "postgresql.log";
};
identMap = ''
root root postgres
'';
};
postgresqlBackup = {
enable = true;
databases = [ "nextcloud" ];
};
};
systemd.services = {
haproxy = {
after = [
"nextcloud.service"
"network-online.target"
];
wants = [
"nextcloud.service"
"network-online.target"
];
};
};
users.users.haproxy.extraGroups = [ config.security.acme.certs."thehellings.com".group ];
# Actually serve the content from here
virtualisation.oci-containers = {
backend = "podman";
containers."homepage" = {
image = "src.thehellings.com/greg/homepage:latest";
ports = [ "${homepage}:80" ];
};
};
virtualisation.podman = {
enable = true;
dockerCompat = true;
dockerSocket.enable = true;
};
}
hosts/unstable/linode/git.nix
+122
View File
@@ -0,0 +1,122 @@
{ ... }:
let
srcDomain = "src.thehellings.com";
sshPort = 2222;
in
{
greg.proxies."${srcDomain}" = {
target = "https://gitea.shire-zebra.ts.net";
ssl = true;
genAliases = false;
extraConfig = ''
proxy_ssl_verify off;
proxy_ssl_server_name on;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Ssl on;
client_max_body_size 100000m;
# Ultimate AI Block List v1.7 20250924
# https://perishablepress.com/ultimate-ai-block-list/
if ($http_user_agent ~* "(openai\.com|\.ai|-ai|_ai|ai\.|ai-|ai_|ai=|AddSearchBot|Agentic|AgentQL|Agent\ 3|Agent\ API|AI\ Agent|AI\ Article\ Writer|AI\ Chat|AI\ Content\ Detector|AI\ Detection|AI\ Dungeon|AI\ Journalist|AI\ Legion)") {
return 444;
}
if ($http_user_agent ~* "(AI\ RAG|AI\ Search|AI\ SEO\ Crawler|AI\ Training|AI\ Web|AI\ Writer|AI2|AIBot|aiHitBot|AIMatrix|AISearch|AITraining|Alexa|Alice\ Yandex|AliGenie|AliyunSec|Alpha\ AI|AlphaAI|Amazon|Amelia)") {
return 444;
}
if ($http_user_agent ~* "(AndersPinkBot|AndiBot|Anonymous\ AI|Anthropic|AnyPicker|Anyword|Applebot|Aria\ AI|Aria\ Browse|Articoolo|Ask\ AI|AutoGen|AutoGLM|Automated\ Writer|AutoML|Autonomous\ RAG|AwarioRssBot|AwarioSmartBot|AWS\ Trainium|Azure)") {
return 444;
}
if ($http_user_agent ~* "(BabyAGI|BabyCatAGI|BardBot|Basic\ RAG|Bedrock|Big\ Sur|Bigsur|Botsonic|Brightbot|Browser\ MCP\ Agent|Browser\ Use|Bytebot|ByteDance|Bytespider|CarynAI|CatBoost|CC-Crawler|CCBot|Chai|Character)") {
return 444;
}
if ($http_user_agent ~* "(Charstar\ AI|Chatbot|ChatGLM|Chatsonic|ChatUser|Chinchilla|Claude|ClearScope|Clearview|Cognitive\ AI|Cohere|Common\ Crawl|CommonCrawl|Content\ Harmony|Content\ King|Content\ Optimizer|Content\ Samurai|ContentAtScale|ContentBot|Contentedge)") {
return 444;
}
if ($http_user_agent ~* "(ContentShake|Conversion\ AI|Copilot|CopyAI|Copymatic|Copyscape|CoreWeave|Corrective\ RAG|Cotoyogi|CRAB|Crawl4AI|CrawlQ\ AI|Crawlspace|Crew\ AI|CrewAI|Crushon\ AI|DALL-E|DarkBard|DataFor|DataProvider)") {
return 444;
}
if ($http_user_agent ~* "(Datenbank\ Crawler|DeepAI|Deep\ AI|DeepL|DeepMind|Deep\ Research|DeepResearch|DeepSeek|Devin|Diffbot|Doubao\ AI|DuckAssistBot|DuckDuckGo\ Chat|DuckDuckGo-Enhanced|Echobot|Echobox|Elixir|FacebookBot|FacebookExternalHit|Factset)") {
return 444;
}
if ($http_user_agent ~* "(Falcon|FIRE-1|Firebase|Firecrawl|Flux|Flyriver|Frase\ AI|FriendlyCrawler|Gato|Gemini|Gemma|Gen\ AI|GenAI|Generative|Genspark|Gentoo-chat|Ghostwriter|GigaChat|GLM|GodMode)") {
return 444;
}
if ($http_user_agent ~* "(Goose|GPT|Grammarly|Grendizer|Grok|GT\ Bot|GTBot|GTP|Hemingway\ Editor|Hetzner|Hugging|Hunyuan|Hybrid\ Search\ RAG|Hypotenuse\ AI|iAsk|ICC-Crawler|ImageGen|ImagesiftBot|img2dataset|imgproxy)") {
return 444;
}
if ($http_user_agent ~* "(INK\ Editor|INKforall|Instructor|IntelliSeek|Inferkit|ISSCyberRiskCrawler|Janitor\ AI|Jasper|Jenni\ AI|Julius\ AI|Kafkai|Kaggle|Kangaroo|Keyword\ Density\ AI|Kimi|Knowledge|KomoBot|Kruti|LangChain|Le\ Chat)") {
return 444;
}
if ($http_user_agent ~* "(Lensa|Lightpanda|LinerBot|LLaMA|LLM|Local\ RAG\ Agent|Lovable|Magistral|magpie-crawler|Manus|MarketMuse|Meltwater|Meta-AI|Meta-External|Meta-Webindexer|Meta\ AI|MetaAI|MetaTagBot|Middleware|Midjourney)") {
return 444;
}
if ($http_user_agent ~* "(Mini\ AGI|MiniMax|Mintlify|Mistral|Mixtral|model-training|Monica|Narrative|NeevaBot|netEstate|Neural\ Text|NeuralSEO|NinjaAI|NodeZero|Nova\ Act|NovaAct|OAI-SearchBot|OAI\ SearchBot|OASIS|Olivia)") {
return 444;
}
if ($http_user_agent ~* "(Omgili|Open\ AI|Open\ Interpreter|OpenAGI|OpenAI|OpenBot|OpenPi|OpenRouter|OpenText\ AI|Operator|Outwrite|Page\ Analyzer\ AI|PanguBot|Panscient|Paperlibot|Paraphraser\.io|peer39_crawler|Perflexity|Perplexity|Petal)") {
return 444;
}
if ($http_user_agent ~* "(Phind|PiplBot|PoeBot|PoeSearchBot|ProWritingAid|Proximic|Puppeteer|Python\ AI|Qualified|Quark|QuillBot|Qopywriter|Qwen|RAG\ Agent|RAG\ Azure\ AI|RAG\ Chatbot|RAG\ Database|RAG\ IS|RAG\ Pipeline|RAG\ Search)") {
return 444;
}
if ($http_user_agent ~* "(RAG\ with|RAG-|RAG_|Raptor|React\ Agent|Redis\ AI\ RAG|RobotSpider|Rytr|SaplingAI|SBIntuitionsBot|Scala|Scalenut|Scrap|ScriptBook|Seekr|SEObot|SEO\ Content\ Machine|SEO\ Robot|SemrushBot|Sentibot)") {
return 444;
}
if ($http_user_agent ~* "(Serper|ShapBot|Sidetrade|Simplified\ AI|Sitefinity|Skydancer|SlickWrite|SmartBot|Sonic|Sora|Spider/2|SpiderCreator|Spin\ Rewrite|Spinbot|Stability|StableDiffusionBot|Sudowrite|SummalyBot|Super\ Agent|Superagent)") {
return 444;
}
if ($http_user_agent ~* "(SuperAGI|Surfer\ AI|TerraCotta|Text\ Blaze|TextCortex|Thinkbot|Thordata|TikTokSpider|Timpibot|Tinybird|Together\ AI|Traefik|TurnitinBot|uAgents|VelenPublicWebCrawler|Venus\ Chub\ AI|Vidnami\ AI|Vision\ RAG|WebSurfer|WebText)") {
return 444;
}
if ($http_user_agent ~* "(Webzio|WeChat|Whisper|WordAI|Wordtune|WPBot|Writecream|WriterZen|Writescope|Writesonic|xAI|xBot|YaML|YandexAdditional|YouBot|Zendesk|Zero|Zhipu|Zhuque\ AI|Zimm)") {
return 444;
}
'';
};
#greg.proxies."registry.thehellings.com" = {
#target = "https://gitea.shire-zebra.ts.net:5000";
#ssl = true;
#genAliases = false;
#extraConfig = ''
#proxy_set_header X-Forwarded-Proto https;
#proxy_set_header X-Forwarded-Ssl on;
#client_max_body_size 25000m;
#'';
#};
networking.firewall.allowedTCPPorts = [ sshPort ];
systemd.services = {
haproxy = {
after = [
"network-online.target"
];
wants = [
"network-online.target"
];
};
};
services.haproxy = {
enable = true;
config = ''
global
daemon
maxconn 20
defaults
timeout connect 500s
timeout client 500s
timeout server 1h
listen gitsshd
bind *:${toString sshPort}
timeout client 1h
mode tcp
server git-isaiah isaiah.shire-zebra.ts.net:32222
server git-jeremiah jeremiah.shire-zebra.ts.net:32222
server git-zeke zeke.shire-zebra.ts.net:32222
'';
};
}
hosts/unstable/linode/matrix.nix
+70
View File
@@ -0,0 +1,70 @@
# Registration of new users is disabled for the public, but I can create
# them by the following commands:
# nix run nixpkgs.matrix-synapse
# register_new_matrix_user -k "B9EoPr2WV9hzwc7uL2Sx1JmvCeKDEOGCpB0uginQcQtEH4wzRtkSIdo7lltrjSQa" http://localhost:8448
{ config, ... }:
let
domain = "${config.networking.domain}";
fqdn = "matrix.${domain}";
in
{
greg.proxies."${fqdn}" = {
extraConfig = ''
error_log /var/log/nginx/debug.log debug;
proxy_ssl_verify off;
proxy_ssl_server_name on;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Ssl on;
'';
genAliases = false;
ssl = true;
target = "https://matrix.shire-zebra.ts.net";
};
services.nginx = {
virtualHosts = {
# Server the '.well-known' files to find the Matrix API server
"${domain}" = {
enableACME = true;
forceSSL = true;
# This is needed so that servers contacting hellings.com can find
# the actual application server at matrix.thehellings.com
locations."= /.well-known/matrix/server".extraConfig =
let
server = {
"m.server" = "${fqdn}:443";
};
in
''
add_header Content-Type application/json;
return 200 '${builtins.toJSON server}';
'';
locations."= /.well-known/matrix/client".extraConfig =
let
client = {
"m.homeserver" = {
"base_url" = "https://${fqdn}";
};
"m.identity_server" = {
"base_url" = "https://vector.im";
};
};
in
''
add_header Content-Type application/json;
add_header Access-Control-Allow-Origin *;
return 200 '${builtins.toJSON client}';
'';
};
};
};
# Open networking ports for the server
networking.firewall = {
enable = true;
allowedTCPPorts = [
80
443
];
};
}
hosts/unstable/linode/nextcloud.nix
+58
View File
@@ -0,0 +1,58 @@
{
config,
lib,
pkgs,
...
}:
{
age.secrets.nextcloudadmin = {
file = ../../../secrets/nextcloudadmin.age;
owner = "nextcloud";
};
services.nextcloud = {
enable = true;
package = pkgs.nextcloud33;
appstoreEnable = true;
hostName = "next.${config.networking.domain}";
https = true;
config = {
adminpassFile = config.age.secrets.nextcloudadmin.path;
adminuser = "greg";
dbhost = "/run/postgresql";
dbtype = "pgsql";
};
settings = {
default_phone_region = "US";
overwriteprotocol = "https";
};
};
services.nginx.virtualHosts."next.thehellings.com" = {
forceSSL = true;
enableACME = true;
};
# Otherwise nginx errors looking for the nextcloud sock file
systemd.services.nginx.after = [ "nextcloud.service" ];
greg.backup.jobs.nextcloud-bkup = {
src = "/var/lib/nextcloud";
dest = "nextcloud-backup";
pre = lib.getExe (
pkgs.writeShellApplication {
name = "nextcloud-backup-pre";
runtimeInputs = [ config.services.nextcloud.occ ];
text = "nextcloud-occ maintenance:mode --on";
}
);
post = lib.getExe (
pkgs.writeShellApplication {
name = "nextcloud-backup-post";
runtimeInputs = [ config.services.nextcloud.occ ];
text = "nextcloud-occ maintenance:mode --off";
}
);
};
}
hosts/unstable/linode/nginx.nix
+38
View File
@@ -0,0 +1,38 @@
{ ... }:
let
homepage = "127.0.0.1:30080";
in
{
security.acme = {
acceptTerms = true;
defaults.email = "greg.hellings@gmail.com";
};
services.nginx = {
enable = true;
clientMaxBodySize = "25000m"; # To help with uploading container images
# If there are recommended settings, let's use them!
recommendedGzipSettings = true;
recommendedOptimisation = true;
recommendedProxySettings = true;
recommendedTlsSettings = true;
};
# Actually serve the content from here
virtualisation.podman.enable = true;
virtualisation.oci-containers = {
backend = "podman";
containers."homepage" = {
image = "registry.thehellings.com:443/greg/homepage/gregs-homepage:latest";
ports = [ "${homepage}:80" ];
};
};
greg.proxies = {
"thehellings.com" = {
target = "http://${homepage}/";
ssl = true;
genAliases = false;
};
};
}
hosts/unstable/linode/podman.nix
+13
View File
@@ -0,0 +1,13 @@
{ pkgs, ... }:
{
environment.systemPackages = with pkgs; [
podman-compose
];
virtualisation.podman = {
enable = true;
dockerCompat = true;
dockerSocket.enable = true;
};
}
hosts/unstable/linode/postgres.nix
+63
View File
@@ -0,0 +1,63 @@
{
config,
pkgs,
pkgs',
...
}:
{
environment.systemPackages = [ pkgs'.upgrade-pg-cluster ];
services.postgresql = {
enable = true;
package = pkgs.postgresql_15;
checkConfig = true;
ensureDatabases = [ "nextcloud" ];
#initialScript = pkgs.writeText "create-matrix-db.sql" ''
# CREATE ROLE "matrix-synapse" WITH LOGIN;
# CREATE DATABASE "synapse" WITH OWNER "matrix-synapse" TEMPLATE template0 LC_COLLATE = "C" LC_CTYPE = "C";
# GRANT ALL PRIVILEGES ON DATABASE "synapse" TO "matrix-synapse";
#''; # These are done manually in order to set the LC_COLLATE values properly
ensureUsers = [
{
name = "nextcloud";
ensureDBOwnership = true;
}
];
settings = {
log_connections = true;
log_statement = "all";
logging_collector = true;
log_filename = "postgresql.log";
};
identMap = ''
root root postgres
'';
};
services.postgresqlBackup = {
enable = true;
databases = [ "nextcloud" ];
};
services.logrotate = {
enable = true;
settings = {
postgresBackup = {
enable = true;
files = "${config.services.postgresqlBackup.location}/*.gz";
};
postgresLog = {
enable = true;
files = "/var/lib/postgresql/*/log/*.log";
compress = true;
compresscmd = "${pkgs.xz}/bin/xz";
};
};
};
greg.backup.jobs.greg-postgresql-backup = {
src = config.services.postgresqlBackup.location;
dest = "linode-postgres";
};
}
hosts/unstable/proxmoxtemplate/default.nix
+60
View File
@@ -0,0 +1,60 @@
# Edit this configuration file to define what should be installed on
# your system. Help is available in the configuration.nix(5) man page
# and in the NixOS manual (accessible by running ‘nixos-help’).
{ pkgs, ... }:
{
imports = [
# Include the results of the hardware scan.
./hardware-configuration.nix
];
# Bootloader.
boot.loader = {
systemd-boot.enable = true;
efi.canTouchEfiVariables = true;
};
environment.systemPackages = with pkgs; [
];
greg = {
home = true;
tailscale = {
enable = true;
tags = [ "home" ];
};
};
networking = {
hostName = "proxmoxtemplate"; # Define your hostname.
# defaultGateway = {
# address = " 10.42.1.2";
# interface = "enp6s18";
# };
# interfaces = {
# enp6s18 = {
# ipv4.addresses = [
# {
# address = "10.42.1.8";
# prefixLength = 16;
# }
# ];
# };
# };
nameservers = [ "10.42.1.5" ];
};
services.qemuGuest.enable = true;
system.stateVersion = "24.11"; # Did you read the comment?
# Define a user account. Don't forget to set a password with ‘passwd’.
users.users.greg = {
isNormalUser = true;
description = "Greg Hellings";
extraGroups = [ "wheel" ];
packages = with pkgs; [ ];
};
}
hosts/unstable/proxmoxtemplate/hardware-configuration.nix
+50
View File
@@ -0,0 +1,50 @@
# Do not modify this file! It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{
lib,
modulesPath,
...
}:
{
imports = [
(modulesPath + "/profiles/qemu-guest.nix")
];
boot.initrd.availableKernelModules = [
"uhci_hcd"
"ehci_pci"
"ahci"
"virtio_pci"
"virtio_scsi"
"sd_mod"
"sr_mod"
];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ ];
boot.extraModulePackages = [ ];
fileSystems."/" = {
device = "/dev/disk/by-uuid/507251f1-efe7-448d-8de8-91ee582a9afb";
fsType = "ext4";
};
fileSystems."/boot" = {
device = "/dev/disk/by-uuid/7115-EFA6";
fsType = "vfat";
options = [
"fmask=0077"
"dmask=0077"
];
};
swapDevices = [ ];
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
# (the default) this is the recommended approach. When using systemd-networkd it's
# still possible to use this option, but it's recommended to use it in conjunction
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
networking.useDHCP = lib.mkDefault true;
# networking.interfaces.enp6s18.useDHCP = lib.mkDefault true;
}
manifests/donetick/configmap.yaml
+79
View File
@@ -0,0 +1,79 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: donetick-config
namespace: donetick
data:
# Value pulled from
# https://github.com/donetick/donetick/blob/main/config/selfhosted.yaml
selfhosted.yaml: |-
name: "selfhosted"
is_done_tick_dot_com: false
is_user_creation_disabled: false
telegram:
token: ""
pushover:
token: ""
database:
type: "sqlite"
migration: true
# these are only required for postgres
host: "secret"
port: 5432
user: "secret"
password: "secret"
name: "secret"
jwt:
secret: "This is really a secure JWT secret now!"
session_time: 168h
max_refresh: 168h
server:
port: 2021
read_timeout: 10s
write_timeout: 10s
rate_period: 60s
rate_limit: 300
cors_allow_origins:
- "http://localhost:5173"
- "http://localhost:7926"
# the below are required for the android app to work
- "https://localhost"
- "capacitor://localhost"
serve_frontend: true
logging:
level: "info"
encoding: "json"
development: false
scheduler_jobs:
due_job: 30m
overdue_job: 3h
pre_due_job: 3h
email:
host:
port:
key:
email:
appHost:
oauth2:
client_id:
client_secret:
auth_url:
token_url:
user_info_url:
redirect_url:
name:
# Real-time configuration
realtime:
enabled: true
sse_enabled: true
heartbeat_interval: 60s
connection_timeout: 120s
max_connections: 1000
max_connections_per_user: 5
event_queue_size: 2048
cleanup_interval: 2m
stale_threshold: 5m
enable_compression: true
enable_stats: true
allowed_origins:
- "*"
manifests/donetick/deployment.yaml
+38
View File
@@ -0,0 +1,38 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: donetick
namespace: donetick
spec:
replicas: 1
selector:
matchLabels:
app: donetick
template:
metadata:
labels:
app: donetick
spec:
containers:
- name: donetick
image: donetick/donetick
ports:
- containerPort: 2021
name: http
env:
- name: DT_ENV
value: "selfhosted"
- name: DT_SQLITE_PATH
value: "/data/donetick.db"
volumeMounts:
- name: config
mountPath: /config
- name: data
mountPath: /data
volumes:
- name: config
configMap:
name: donetick-config
- name: data
persistentVolumeClaim:
claimName: donetick-data
manifests/donetick/ingress.yaml
+15
View File
@@ -0,0 +1,15 @@
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: donetick-tailscale
namespace: donetick
spec:
ingressClassName: tailscale
defaultBackend:
service:
name: donetick
port:
number: 2021
tls:
- hosts:
- todo
manifests/donetick/kustomization.yaml
+9
View File
@@ -0,0 +1,9 @@
namespace: donetick
resources:
- namespace.yaml
- configmap.yaml
- pvc.yaml
- deployment.yaml
- service.yaml
- ingress.yaml
manifests/donetick/namespace.yaml
+4
View File
@@ -0,0 +1,4 @@
apiVersion: v1
kind: Namespace
metadata:
name: donetick
manifests/donetick/pvc.yaml
+11
View File
@@ -0,0 +1,11 @@
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: donetick-data
namespace: donetick
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 5Gi
manifests/donetick/service.yaml
+13
View File
@@ -0,0 +1,13 @@
apiVersion: v1
kind: Service
metadata:
name: donetick
namespace: donetick
spec:
selector:
app: donetick
ports:
- name: http
port: 2021
targetPort: 2021
protocol: TCP
manifests/gitea-runner/chart.yaml
+56
View File
@@ -0,0 +1,56 @@
apiVersion: source.toolkit.fluxcd.io/v1
kind: HelmRepository
metadata:
name: gitea
spec:
interval: "24h"
url: https://dl.gitea.com/charts/
---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: gitea-runner
namespace: gitea-runner
spec:
interval: 10m
chart:
spec:
chart: actions
version: "0.0.4"
sourceRef:
kind: HelmRepository
name: gitea
interval: "1h"
values:
rbac:
create: true
serviceAccount:
create: true
gitea:
instanceURL: https://src.thehellings.com
runnerToken:
existingSecret: gitea-runner
existingSecretKey: token
imagePullSecrets:
- name: image-pull-secrets
config:
runner:
labels:
# Ubuntu
- "ubuntu-22.04:docker://ubuntu:22.04"
- "ubuntu-24.04:docker://ubuntu:24.04"
- "ubuntu-24.10:docker://ubuntu:24.10"
# Fedora
- "fedora-41:docker://fedora:41"
- "fedora-42:docker://fedora:42"
# CentOS Stream
- "centos-stream-9:docker://quay.io/centos/centos:stream9"
- "centos-stream-10:docker://quay.io/centos/centos:stream10"
# Nix
- "nix:docker://nixos/nix:latest"
# ci-images (internal registry: src.thehellings.com/greg)
- "ci-builder:docker://src.thehellings.com/greg/builder:latest"
- "ci-vm-test:docker://src.thehellings.com/greg/vm-test:latest"
- "ci-sword:docker://src.thehellings.com/greg/sword-container-builder:latest"
- "ci-bitwarden:docker://src.thehellings.com/greg/bitwarden:latest"
- "ci-immich:docker://src.thehellings.com/greg/immich:latest"
manifests/gitea-runner/kustomization.yaml
+6
View File
@@ -0,0 +1,6 @@
namespace: gitea-runner
resources:
- namespace.yaml
- secrets.yaml
- chart.yaml
manifests/gitea-runner/namespace.yaml
+4
View File
@@ -0,0 +1,4 @@
apiVersion: v1
kind: Namespace
metadata:
name: gitea-runner
manifests/gitea-runner/secrets.yaml
+18
View File
@@ -0,0 +1,18 @@
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
name: gitea-runner
namespace: gitea-runner
spec:
refreshInterval: 1h
secretStoreRef:
name: bitwarden-login
kind: ClusterSecretStore
target:
name: gitea-runner
creationPolicy: Owner
data:
- secretKey: token
remoteRef:
key: 11419680-5338-4f19-bdd9-b422007046af
property: password
manifests/gitea/chart.yaml
+56 -10
View File
@@ -15,7 +15,7 @@ spec:
chart:
spec:
chart: gitea
version: "12.7.0"
version: "12.5.3"
sourceRef:
kind: HelmRepository
name: gitea-repository
@@ -35,7 +35,7 @@ spec:
storageClass: longhorn-default
image:
tag: "1.27.1"
tag: "1.25.5"
replicaCount: 1
@@ -47,6 +47,12 @@ spec:
type: LoadBalancer
port: 32222
nodePort: 32222
# Anubis sidecar port — ingress routes here; Anubis proxies to :3000
additionalPorts:
- name: anubis
port: 8080
targetPort: 8080
protocol: TCP
gitea:
admin:
@@ -66,8 +72,8 @@ spec:
APP_NAME: "Gitea: Greg's Cup of Git"
RUN_MODE: dev
server:
DOMAIN: "shire-zebra.ts.net"
ROOT_URL: "https://gitea.shire-zebra.ts.net"
DOMAIN: "thehellings.com"
ROOT_URL: "https://src.thehellings.com"
SSH_PORT: "2222"
database:
DB_TYPE: postgres
@@ -85,15 +91,15 @@ spec:
DISABLE_REGISTRATION: "true"
storage:
STORAGE_TYPE: minio
MINIO_ENDPOINT: "nas1.shire-zebra.ts.net:30188"
MINIO_ENDPOINT: "nas1.shire-zebra.ts.net:9000"
MINIO_BUCKET: gitea
MINIO_LOCATION: garage
MINIO_LOCATION: us-east-1
# MINIO_ACCESS_KEY_ID: ""
# MINIO_SECRET_ACCESS_KEY: ""
MINIO_USE_SSL: "false"
MINIO_INSECURE_SKIP_VERIFY: "true"
security:
ALLOWED_HOST_LIST: loopback,private,*.shire-zebra.ts.net,*.nebula.thehellings.com
webhook:
ALLOWED_HOST_LIST: loopback,private,*.shire-zebra.ts.net
metrics:
enabled: false
@@ -102,8 +108,8 @@ spec:
persistence:
enabled: true
create: false
claimName: gitea-new
storageClass: longhorn-default
size: "50Gi"
# I will manage my Postgres externally
postgresql:
@@ -119,6 +125,46 @@ spec:
cpu: "100m"
memory: "2Gi"
# Anubis anti-crawler sidecar
# Anubis listens on :8080 and proxies to Gitea at http://localhost:3000
# Ingress is updated to route to the anubis port instead of http
extraContainers:
- name: anubis
image: ghcr.io/techarohq/anubis:latest
imagePullPolicy: Always
env:
- name: BIND
value: ":8080"
- name: DIFFICULTY
value: "4"
- name: METRICS_BIND
value: ":9090"
- name: SERVE_ROBOTS_TXT
value: "true"
- name: TARGET
value: "http://localhost:3000"
- name: OG_PASSTHROUGH
value: "true"
- name: OG_EXPIRY_TIME
value: "24h"
resources:
limits:
cpu: "750m"
memory: "256Mi"
requests:
cpu: "250m"
memory: "256Mi"
securityContext:
runAsUser: 1000
runAsGroup: 1000
runAsNonRoot: true
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
seccompProfile:
type: RuntimeDefault
strategy:
type: RollingUpdate
rollingUpdate:
manifests/gitea/dump-cronjob.yaml
+7 -7
View File
@@ -18,12 +18,12 @@ spec:
volumes:
- name: gitea-data
persistentVolumeClaim:
claimName: gitea-new
claimName: gitea-shared-storage
- name: dump-staging
emptyDir: {}
initContainers:
- name: gitea-dump
image: "gitea/gitea:1.27.1"
image: "gitea/gitea:1.25.4"
command:
- /bin/sh
- "-c"
@@ -51,12 +51,12 @@ spec:
- |
set -e
# Configure mc alias for MinIO
mc alias set nas1 http://nas1.shire-zebra.ts.net:30188 \
mc alias set nas1 http://nas1.shire-zebra.ts.net:9000 \
"${MINIO_ACCESS_KEY}" "${MINIO_SECRET_KEY}"
# Upload dump to backup-gitea bucket
DUMP_FILE=$(ls /dump-staging/gitea-dump-*.zip | head -1)
mc cp "${DUMP_FILE}" "nas1/gitea-backup/$(basename ${DUMP_FILE})"
echo "Uploaded $(basename ${DUMP_FILE}) to gitea-backup"
mc cp "${DUMP_FILE}" "nas1/backup-gitea/$(basename ${DUMP_FILE})"
echo "Uploaded $(basename ${DUMP_FILE}) to backup-gitea"
# Set 30-day lifecycle on the bucket (idempotent)
mc ilm rule add --expire-days 30 nas1/backup-gitea 2>/dev/null || true
volumeMounts:
@@ -69,10 +69,10 @@ spec:
- name: MINIO_ACCESS_KEY
valueFrom:
secretKeyRef:
name: gitea-backup
name: gitea-config
key: minio_key
- name: MINIO_SECRET_KEY
valueFrom:
secretKeyRef:
name: gitea-backup
name: gitea-config
key: minio_secret
manifests/gitea/ingress.yaml
+2 -18
View File
@@ -8,24 +8,8 @@ spec:
service:
name: gitea-release-http
port:
name: http
# Route through Anubis anti-crawler sidecar instead of directly to Gitea
name: anubis
tls:
- hosts:
- gitea
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: gitea-direct
spec:
rules:
- host: git.k3s.nebula.thehellings.com
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: gitea-release-http
port:
name: http
manifests/gitea/secrets.yaml
+13 -31
View File
@@ -1,32 +1,5 @@
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
name: gitea-backup
spec:
target:
name: gitea-backup
deletionPolicy: Delete
template:
type: Opaque
data:
minio_key: "{{ .minio_key }}"
minio_secret: "{{ .minio_secret }}"
secretStoreRef:
name: bitwarden-login
kind: ClusterSecretStore
data:
# MinIO credentials
- secretKey: minio_key
remoteRef:
key: dfb2f0c8-110d-4e96-83a7-b49c001c0897
property: username
- secretKey: minio_secret
remoteRef:
key: dfb2f0c8-110d-4e96-83a7-b49c001c0897
property: password
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
name: gitea-config
spec:
@@ -42,20 +15,29 @@ spec:
storage: |-
MINIO_ACCESS_KEY_ID={{ .minio_nas1_key }}
MINIO_SECRET_ACCESS_KEY={{ .minio_nas1_secret }}
#minio_key: "{{ .minio_nas1_key }}"
#minio_secret: "{{ .minio_nas1_secret }}"
minio_key: "{{ .minio_nas1_key }}"
minio_secret: "{{ .minio_nas1_secret }}"
secretStoreRef:
name: bitwarden-login
kind: ClusterSecretStore
data:
# MinIO credentials
- secretKey: minio_key
remoteRef:
key: dcbcf704-7dce-48d7-bbd1-b3a801875b3d
property: username
- secretKey: minio_secret
remoteRef:
key: dcbcf704-7dce-48d7-bbd1-b3a801875b3d
property: password
# MinIO credentials for NAS1
- secretKey: minio_nas1_key
remoteRef:
key: 33e8e4e0-eb90-484c-9ec9-b3a8018077a3
key: c4c66ab3-2ade-4086-9c0d-b3a80172b1ba
property: username
- secretKey: minio_nas1_secret
remoteRef:
key: 33e8e4e0-eb90-484c-9ec9-b3a8018077a3
key: c4c66ab3-2ade-4086-9c0d-b3a80172b1ba
property: password
# Postgres credentials
- secretKey: dbuser
manifests/helm/longhorn.yaml
+1 -5
View File
@@ -27,7 +27,7 @@ spec:
chart:
spec:
chart: longhorn
version: "1.11.3"
version: "1.11.1"
sourceRef:
kind: HelmRepository
name: longhorn
@@ -141,10 +141,6 @@ spec:
number: 80
- <<: *host
host: longhorn.kubernetes
- <<: *host
host: longhorn.k3s.nebula.thehellings.com
- <<: *host
host: longhorn.k3s.thehellings.lan
---
apiVersion: storage.k8s.io/v1
kind: StorageClass
manifests/immich/backup.yaml
+6 -6
View File
@@ -33,24 +33,24 @@ spec:
access-key: "{{ .minio_key }}"
secret-key: "{{ .minio_secret }}"
rclone.conf: |
[garage]
[nas1minio]
type = s3
provider = Minio
endpoint = http://nas1.shire-zebra.ts.net:30188
endpoint = http://nas1.shire-zebra.ts.net:9000
access_key_id = {{ .minio_key }}
secret_access_key = {{ .minio_secret }}
region = garage
region = us-east-1
secretStoreRef:
name: bitwarden-login
kind: ClusterSecretStore
data:
- secretKey: minio_key
remoteRef:
key: 8fce2750-aa62-4892-b90c-b49c001f494b
key: c4c66ab3-2ade-4086-9c0d-b3a80172b1ba
property: username
- secretKey: minio_secret
remoteRef:
key: 8fce2750-aa62-4892-b90c-b49c001f494b
key: c4c66ab3-2ade-4086-9c0d-b3a80172b1ba
property: password
---
apiVersion: v1
@@ -128,7 +128,7 @@ spec:
--progress \
--transfers 4 \
--checkers 8 \
/staging garage:immich
/staging nas1minio:immich
volumeMounts:
- name: staging
mountPath: /staging
manifests/immich/chart.yaml
+1 -1
View File
@@ -32,7 +32,7 @@ spec:
containers:
main:
image:
tag: v3.1.0
tag: v2.7.5
env:
DB_HOSTNAME: immich-rw
DB_DATABASE_NAME: immich
manifests/immich/ingress.yaml
-2
View File
@@ -22,8 +22,6 @@ spec:
name: immich-server
port:
name: http
- <<: *host
host: immich.k3s.nebula.thehellings.com
---
apiVersion: networking.k8s.io/v1
kind: Ingress
manifests/kustomization.yaml
+3
View File
@@ -10,4 +10,7 @@ resources:
- immich
- monitoring
- pinchflat
- smokeping
- uptimekuma
- donetick
- gitea
manifests/matrix/ingress.yaml
-17
View File
@@ -13,20 +13,3 @@ spec:
tls:
- hosts:
- matrix
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: matrix-direct
spec:
rules:
- host: matrix.k3s.nebula.thehellings.com
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: dendrite
port:
number: 8008
manifests/smokeping/deployment.yaml
+50
View File
@@ -0,0 +1,50 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: smokeping
labels:
app: smokeping
spec:
replicas: 1
strategy:
type: Recreate
selector:
matchLabels:
app: smokeping
template:
metadata:
labels:
app: smokeping
spec:
containers:
- name: smokeping
image: docker.io/linuxserver/smokeping:2.9.0
imagePullPolicy: IfNotPresent
ports:
- name: http
containerPort: 80
protocol: TCP
volumeMounts:
- name: config
mountPath: /config
- name: data
mountPath: /data
env:
- name: PUID
value: "1000"
- name: PGID
value: "1000"
- name: TZ
value: "America/Chicago"
#- name: MASTER_URL
# value: "https://ping.shire-zebra.ts.net"
# SHARED_SECRET if you want to run a cluster
# CACHE_DIR if you need to explicitly state that
restartPolicy: Always
volumes:
- name: config
persistentVolumeClaim:
claimName: smokeping-config
- name: data
persistentVolumeClaim:
claimName: smokeping-data
manifests/smokeping/ingress.yaml
+14
View File
@@ -0,0 +1,14 @@
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: smokeping-tailscale
spec:
ingressClassName: tailscale
defaultBackend:
service:
name: smokeping
port:
name: http
tls:
- hosts:
- ping
manifests/smokeping/kustomization.yaml
+8
View File
@@ -0,0 +1,8 @@
namespace: smokeping
resources:
- namespace.yaml
- pvc.yaml
- deployment.yaml
- service.yaml
- ingress.yaml
manifests/smokeping/namespace.yaml
+4
View File
@@ -0,0 +1,4 @@
apiVersion: v1
kind: Namespace
metadata:
name: smokeping
manifests/smokeping/pvc.yaml
+23
View File
@@ -0,0 +1,23 @@
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: smokeping-config
spec:
accessModes:
- ReadWriteOnce
storageClassName: longhorn-default
resources:
requests:
storage: 1Gi
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: smokeping-data
spec:
accessModes:
- ReadWriteOnce
storageClassName: longhorn-default
resources:
requests:
storage: 25Gi
manifests/smokeping/service.yaml
+15
View File
@@ -0,0 +1,15 @@
apiVersion: v1
kind: Service
metadata:
name: smokeping
labels:
app: smokeping
spec:
type: ClusterIP
ports:
- port: 80
targetPort: http
protocol: TCP
name: http
selector:
app: smokeping
manifests/uptimekuma/chart.yaml
+38
View File
@@ -0,0 +1,38 @@
apiVersion: source.toolkit.fluxcd.io/v1
kind: HelmRepository
metadata:
name: uptime-kuma
namespace: uptime-kuma
spec:
interval: "24h"
url: "https://helm.irsigler.cloud"
---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: uptime-kuma
namespace: uptime-kuma
spec:
interval: 10m
chart:
spec:
chart: uptime-kuma
sourceRef:
kind: HelmRepository
name: uptime-kuma
interval: "1h"
dependsOn:
- name: longhorn
namespace: longhorn-system
- name: mariadb-cluster
namespace: mariadb-operator
values:
volume:
storageClassName: longhorn-default
image:
tag: "2.0.2"
externalDatabase:
enabled: true
hostname: mariadb-cluster.mariadb-operator.svc.cluster.local
database: uptimekuma
existingSecret: uptimekuma-mariadb-password
manifests/uptimekuma/ingress.yaml
+15
View File
@@ -0,0 +1,15 @@
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: uptime-kuma-tailscale
namespace: uptime-kuma
spec:
ingressClassName: tailscale
defaultBackend:
service:
name: uptime-kuma
port:
number: 3001
tls:
- hosts:
- kuma
manifests/uptimekuma/kustomization.yaml
+7
View File
@@ -0,0 +1,7 @@
namespace: uptimekuma
resources:
- namespace.yaml
- secrets.yaml
- chart.yaml
- ingress.yaml
manifests/uptimekuma/namespace.yaml
+4
View File
@@ -0,0 +1,4 @@
apiVersion: v1
kind: Namespace
metadata:
name: uptimekuma
manifests/uptimekuma/secrets.yaml
+27
View File
@@ -0,0 +1,27 @@
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
name: uptimekuma-mariadb-password
spec:
target:
name: uptimekuma-mariadb-password
deletionPolicy: Delete
template:
type: kubernetes.io/basic-auth
data:
username: |-
{{ .username }}
password: |-
{{ .password }}
secretStoreRef:
name: bitwarden-login
kind: ClusterSecretStore
data:
- secretKey: username
remoteRef:
key: 4df95656-9f9c-4916-8e34-b3a200376365
property: username
- secretKey: password
remoteRef:
key: 4df95656-9f9c-4916-8e34-b3a200376365
property: password
modules/hm/gui.nix
-1
View File
@@ -77,7 +77,6 @@ in
programs.firefox = {
enable = true; # (!pkgs.stdenv.hostPlatform.isDarwin);
configPath = if pkgs.stdenv.hostPlatform.isDarwin then "${config.home.homeDirectory}/Library/Application Support/Firefox" else "${config.xdg.configHome}/mozilla/firefox";
package = pkgs.firefox-bin;
policies = {
DisableAppUpdate = true;
modules/hm/gui/bookmarks.nix
+4 -32
View File
@@ -316,26 +316,6 @@
name = "Buildbot";
url = "http://jeremiah.shire-zebra.ts.net:8010/";
}
{
name = "Garage WebUI";
url = "http://nas1.shire-zebra.ts.net:30186/";
}
{
name = "Garage RPC";
url = "http://nas1.shire-zebra.ts.net:30187/";
}
{
name = "Garage S3 API";
url = "http://nas1.shire-zebra.ts.net:30188/";
}
{
name = "Garage S3 Web";
url = "http://nas1.shire-zebra.ts.net:30189/";
}
{
name = "Garage Admin";
url = "http://nas1.shire-zebra.ts.net:30190/";
}
];
}
{
@@ -418,25 +398,17 @@
{
name = "Media";
bookmarks = [
{
name = "Flaresolverr";
url = "http://nas1.shire-zebra.ts.net:30098";
}
{
name = "Prowlarr";
url = "http://nas1.shire-zebra.ts.net:30050/";
url = "https://hosea.shire-zebra.ts.net:9696/";
}
{
name = "Sonarr (TV)";
url = "http://nas1.shire-zebra.ts.net:30113/";
name = "Transmission";
url = "https://hosea.shire-zebra.ts.net:9091/";
}
{
name = "Radarr (Movies)";
url = "http://nas1.shire-zebra.ts.net:30025/";
}
{
name = "Deluge";
url = "http://nas1.shire-zebra.ts.net:30038/";
url = "https://hosea.shire-zebra.ts.net:7878/";
}
];
}
modules/nix-conf.nix
+2 -2
View File
@@ -62,12 +62,12 @@ in
if cfg.cache then
[
#"http://chronicles.shire-zebra.ts.net:9000/binary-cache/"
"http://niks3.nas1.shire-zebra.ts.net:30189/"
"http://nas1.shire-zebra.ts.net:9000/niks3"
#"http://nas1.shire-zebra.ts.net:8080/default"
]
else
[
"http://niks3.nas1.thehellings.lan:30189/"
"http://nas1.thehellings.lan:8080/default"
]
)
++ [
modules/nixos/home.nix
+27
View File
@@ -1,6 +1,7 @@
{
config,
lib,
pkgs,
...
}:
@@ -17,9 +18,35 @@ with lib;
};
config = mkIf cfg {
age.secrets.attic.file = ../../secrets/attic.age;
networking.domain = "thehellings.lan";
time.timeZone = "America/Chicago";
systemd.services.attic-client = {
enable = true;
description = "Attic client watch-store service";
after = [ "network.target" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
Type = "simple";
Restart = "on-failure";
RestartSec = "5s";
};
preStart = ''
set -x
mkdir -p $XDG_CONFIG_HOME/attic
cp ${config.age.secrets.attic.path} $XDG_CONFIG_HOME/attic/config.toml
'';
script = "${pkgs.attic-client}/bin/attic watch-store --ignore-upstream-cache-filter default";
environment = {
XDG_CONFIG_HOME = "/var/lib/attic-client";
};
};
systemd.tmpfiles.rules = [
"d /var/lib/attic-client 0755 root root -"
];
# Open Prometheus exporter ports on LAN-connected hosts only.
# NOT in baseline.nix to avoid exposing these on internet-facing hosts (e.g. linode).
networking.firewall.allowedTCPPorts = [
modules/nixos/kubernetes.nix
+14 -44
View File
@@ -14,9 +14,6 @@ let
url = "https://github.com/fluxcd/flux2/releases/download/v2.7.2/install.yaml";
sha256 = "sha256-Qs1qJmgZm8q9xZsORjT/N/wzpbWVVODXtzDpjnAYMuQ=";
};
keepaliveIp = "10.42.5.1";
nebulaName = "k3s.nebula.thehellings.com";
nebulaIp = "10.157.100.1";
in
{
options.greg = {
@@ -46,13 +43,6 @@ in
};
config = lib.mkIf cfg.enable {
assertions = [
{
assertion = config.greg.nebula.enable;
message = "Configure Nebula for this host, first";
}
];
age.secrets = {
bw_secret.file = ../../secrets/kubernetes/bw_secret.age;
dendrite_key.file = ../../secrets/dendrite_key.age;
@@ -105,9 +95,6 @@ in
"--supervisor-metrics=true"
"--tls-san ${config.networking.hostName}.thehellings.lan"
"--tls-san ${config.networking.hostName}.shire-zebra.ts.net"
"--tls-san ${keepaliveIp}"
"--tls-san ${nebulaName}"
"--tls-san ${nebulaIp}"
];
manifests = {
cert-manager.source = cert-manager;
@@ -123,37 +110,20 @@ in
keepalived = {
enable = true;
openFirewall = true;
vrrpInstances = {
kubernetes = {
interface = cfg.vipInterface;
priority = cfg.priority;
state = if (config.networking.hostName == "isaiah") then "MASTER" else "BACKUP";
virtualIps = [
{
addr = "${keepaliveIp}/16";
dev = cfg.vipInterface;
}
];
virtualRouterId = 77;
extraConfig = ''
advert_int 1
'';
};
k3s-nebula = {
interface = "nebula0";
priority = 1;
state = if (config.networking.hostName == "isaiah") then "MASTER" else "BACKUP";
virtualIps = [
{
addr = "${nebulaIp}/16";
dev = "nebula0";
}
];
virtualRouterId = 78;
extraConfig = ''
advert_int 1
'';
};
vrrpInstances.kubernetes = {
interface = cfg.vipInterface;
priority = cfg.priority;
state = if (config.networking.hostName == "isaiah") then "MASTER" else "BACKUP";
virtualIps = [
{
addr = "10.42.5.1/16";
dev = cfg.vipInterface;
}
];
virtualRouterId = 77;
extraConfig = ''
advert_int 1
'';
};
};
openiscsi = {
network.json
+38 -73
View File
@@ -9,9 +9,12 @@
"tailscale": "100.64.0.0/10"
},
"hosts": {
"builder2": {
"ip": "10.42.1.17",
"system": "x86_64-linux"
"chronicles": {
"ip": "10.42.1.4",
"pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEBecZUva9OnZuXLaBun6/1ITo5f9p0YMLPD+q0egLRS",
"external": true,
"ts": "100.119.228.115",
"aliases": [ "s3" ]
},
"exodus": {
"ip": null,
@@ -28,15 +31,6 @@
"tags": ["router", "server"],
"nebulaIp": "10.157.0.2"
},
"gregory.hellings-mbp": {
"external": true,
"system": "aarch64-darwin",
"user": "gregory.hellings"
},
"gregs-MacBook-Pro-16-inch-Nov-2024": {
"external": true,
"system": "aarch64-darwin"
},
"hosea": {
"ip": "10.42.1.7",
"pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKLIwkTTXA56sUlUjEulXXZRvZy5H4a5ZwgKWLlpkQDz",
@@ -45,6 +39,10 @@
"tags": ["server"],
"nebulaIp": "10.157.0.3"
},
"icdm-root": {
"external": true,
"system": "x86_64-linux"
},
"isaiah": {
"builder": true,
"ip": "10.42.1.6",
@@ -59,12 +57,12 @@
"external": true,
"system": "x86_64-linux"
},
"ivr": {
"gregory.hellings-mbp": {
"external": true,
"system": "aarch64-darwin"
"system": "aarch64-darwin",
"user": "gregory.hellings"
},
"jeremiah": {
"aliases": ["buildbot"],
"builder": true,
"ip": "10.42.1.8",
"pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOjQjXq9WYU2Ki27BR9WwJ4ZruS/lJXbjC1b0Q42Adi0",
@@ -74,12 +72,14 @@
"tags": ["builder", "kube", "server"],
"nebulaIp": "10.157.0.5"
},
"kuma": {
"ip": "10.42.1.19",
"nebulaIp": "10.157.0.8",
"pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIhr+LmYMOk4Hixxew2FiAvL8sycgQvnhK8PBGjfnkJb",
"system": "x86_64-linux",
"tags": ["server"]
"joel": {
"external": true,
"ip": "10.42.0.4",
"ts": null
},
"gregs-MacBook-Pro-16-inch-Nov-2024": {
"external": true,
"system": "aarch64-darwin"
},
"lithic": {
"external": true,
@@ -93,6 +93,10 @@
"tags": ["public", "server"],
"nebulaIp": "10.157.0.1"
},
"ivr": {
"external": true,
"system": "aarch64-darwin"
},
"MacBook-Pro.local": {
"external": true,
"system": "aarch64-darwin"
@@ -101,10 +105,23 @@
"external": true,
"system": "aarch64-darwin"
},
"nas1": {
"external": true,
"ip": "10.42.1.14",
"ts": "100.114.187.61"
},
"nixos": {
"external": true,
"system": "x86_64-linux"
},
"printer": {
"external": true,
"ip": "10.42.1.3"
},
"proxmoxtemplate": {
"external": true,
"system": "x86_64-linux"
},
"wsl": {
"external": true,
"system": "aarch64-linux"
@@ -119,57 +136,5 @@
"tags": ["builder", "kube", "server"],
"nebulaIp": "10.157.0.6"
}
},
"external": {
"chronicles": {
"ip": "10.42.1.4",
"pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEBecZUva9OnZuXLaBun6/1ITo5f9p0YMLPD+q0egLRS",
"ts": "100.119.228.115",
"aliases": ["s3"]
},
"hermes": {
"ip": "10.42.1.18",
"mac": "BC:24:11:E4:72:AB",
"nebulaIp": "10.157.0.8",
"pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILFYyzz/9i5rXprCQj9IL1ulrbQ6E9BOSeOcvf4D/b0G",
"tags": ["server"]
},
"joel": {
"ip": "10.42.0.4"
},
"k3s": {
"aliases": ["*.k3s"],
"ip": "10.42.5.1",
"nebulaIp": "10.157.100.1"
},
"nas1": {
"aliases": ["*.nas1"],
"ip": "10.42.1.14",
"ts": "100.114.187.61"
},
"printer": {
"ip": "10.42.1.3"
},
"pve2": {
"ip": "10.42.1.15"
},
"pve2bmc": {
"ip": "10.42.6.2",
"mac": "00:25:90:4b:34:e8"
},
"pve3": {
"ip": "10.42.1.16"
},
"pve3bmc": {
"ip": "10.42.6.3",
"mac": "00:25:90:4a:dc:2e"
},
"pve4": {
"ip": "10.42.1.17"
},
"pve4bmc": {
"ip": "10.42.6.4",
"mac": "00:25:90:4a:d8:2e"
}
}
}
pkgs/default.nix
-10
View File
@@ -16,15 +16,6 @@ let
adblock_update = c ./adblock_update.nix { };
brew = c ./homebrew.nix { };
create_ssl = c ./create_ssl.nix { };
dockerCompat =
pkgs.runCommand "docker-compat"
{
nativeBuildInputs = [ ];
}
''
mkdir -p $out/bin
ln -s ${pkgs.podman}/bin/podman $out/bin/docker
'';
gcc-tune = c ./gcc-tune.nix { };
#gen-build = c ./gen-build { };
hms = c ./hms { };
@@ -32,7 +23,6 @@ let
inject = c ./inject.nix { };
setup-ssh = c ./setup-ssh { };
upgrade-pg-cluster = c ./upgrade-pg-cluster.nix { };
zim-updater = c ./zim/updater.nix { };
};
x86Linux = {
qemu-hook = c ./qemu-hook.nix { };
pkgs/zim/blobs.json
+28 -28
View File
@@ -2,18 +2,18 @@
"en": {
"gutenberg": {
"name": "gutenberg_en_all",
"version": "2025-11",
"hash": "sha256-AWd8jVVKHKssv9AgrJnryn3Wx0084NE/JmorpgPfryg="
"version": "2023-08",
"hash": "sha256-OXmdHdsLZcW4nCUQsy7sMpUssS8NV7ztkCgS/nsISuw="
},
"phet": {
"name": "phet_en_all",
"version": "2026-05",
"hash": "sha256-zAAq/X5rjQUiYmjMpBtWP5z3J2ZHJMmIxFKnxLAhOlA="
"version": "2025-03",
"hash": "sha256-ARuUzU2o17J2/ZedHc2acXl33dtHCbQJEb72UQUEm1Y="
},
"wikibooks": {
"name": "wikibooks_en_all_maxi",
"version": "2026-04",
"hash": "sha256-wt7Zr+RkfCsFrOudMCYBADacu6IvPQDkZ6Y0VG2j9hA="
"version": "2025-10",
"hash": "sha256-ONBh/ze1Fv2Ffm5b9vDzYS/i2cWSa4pM4MLZnozr2n8="
},
"wikipedia": {
"name": "wikipedia_en_all_maxi",
@@ -22,40 +22,40 @@
},
"wikisource": {
"name": "wikisource_en_all_maxi",
"version": "2026-05",
"hash": "sha256-OA4b+U8mxpcX3fst6hrMyctucYTQOlG/b4qZDiVlcf4="
"version": "2025-11",
"hash": "sha256-p1Jio+PMTZVSLIDIOBeMG3acXJg83CwQM7zIWDUyozM="
},
"wikiversity": {
"name": "wikiversity_en_all_maxi",
"version": "2026-05",
"hash": "sha256-8mZ1CSUcF4QnDIyN0M2KedQ4pcSUCmzHBlOm93MYpCE="
"version": "2025-11",
"hash": "sha256-IG/gAUdc/vHRrIWGHhw8vMJdLWwqrNbfh+SiclQRIAI="
},
"wiktionary": {
"name": "wiktionary_en_all_nopic",
"version": "2026-05",
"hash": "sha256-Dwiz+viVQt0zb077R9KQRgtUtxG9ixA/DeXAkCdD4rM="
"version": "2025-09",
"hash": "sha256-Ghcb60qeGaSJtTKQkJoMx/XucX7Lt1XY145lD3gHlMg="
}
},
"fr": {
"gutenberg": {
"name": "gutenberg_fr_all",
"version": "2026-01",
"hash": "sha256-sGn1TeKwBK0+Er5YOJWq6g0itEm4gIGvKxv/PW0DIao="
"version": "2025-10",
"hash": "sha256-gLHxLXJNwwcxM/mZHtoJ8ojbGQ1fugxgni/+RXccwhU="
},
"phet": {
"name": "phet_fr_all",
"version": "2026-05",
"hash": "sha256-bJmchFnaPcofE/hy3ZcRggMT9osHqXwLbwMLJ+cpF28="
"version": "2025-03",
"hash": "sha256-CSboZNTIowLLhp1u9wkxH8xmu3LvQNx5q493AOYJRIc="
},
"wikibooks": {
"name": "wikibooks_fr_all_maxi",
"version": "2026-07",
"hash": "sha256-csI+E5UFGi42BLGWWHxQhVr5KSihCFc53KGKwo557Ck="
"version": "2025-09",
"hash": "sha256-KHCc/73L5Bd9iZ47SRV6vpI8fVM1v9hk1TpEvTro2uo="
},
"wikipedia": {
"name": "wikipedia_fr_all_maxi",
"version": "2026-05",
"hash": "sha256-YUAbGzYYr+c2RQqGjHIF9XL1kNsxDgRKnHK1H7/PtDE="
"version": "2025-06",
"hash": "sha256-ve7Mbh96/ObNbV/KVNYZpfLN+HdWlJ7C5LItEdVkRH0="
},
"wikisource": {
"name": "wikisource_fr_all_maxi",
@@ -64,25 +64,25 @@
},
"wikiversity": {
"name": "wikiversity_fr_all_maxi",
"version": "2026-05",
"hash": "sha256-nVDHtkWIOJkoiGixnA1zVR1QS58thjc12FJyagK3Ec0="
"version": "2025-09",
"hash": "sha256-55fdtw/cRezq6nkRp6wuwkukBiqsQKdwh9QWVAgFcBI="
},
"wiktionary": {
"name": "wiktionary_fr_all_nopic",
"version": "2026-05",
"hash": "sha256-7UXByW2IIL0hec8RPT39jpg5IEGvRMD47hc4Y4vFkJs="
"version": "2025-11",
"hash": "sha256-P0CJptee5rDzccxyRDBzyRLuuFOcaLsJYi6DkBFUfIc="
}
},
"ht": {
"phet": {
"name": "phet_ht_all",
"version": "2026-05",
"hash": "sha256-GiJ1jllhioyMYidQ7+Lcbdd9JN2yf04ZQgnO8XaGAqY="
"version": "2025-03",
"hash": "sha256-bHrPzE8H7ptrP6r5wPlXSsXNlTiKxJ9KatABC4kwx+s="
},
"wikipedia": {
"name": "wikipedia_ht_all_maxi",
"version": "2026-07",
"hash": "sha256-InS9cMRaIv9ArlKVwKUypz56m4DgSR7Tl6XpSTMzH+o="
"version": "2026-04",
"hash": "sha256-qUX0pKxIyNsWX4V6kNIsP4Z9nc6TDhwdDR0MmpDOQFs="
}
}
}
pkgs/zim/updater.go
+112 -167
View File
@@ -9,7 +9,7 @@ import (
"net/http"
"os"
"os/exec"
"reflect"
"path/filepath"
"regexp"
"sort"
"strings"
@@ -17,144 +17,27 @@ import (
const BASE = "https://download.kiwix.org/zim"
// ///////////////////////////////////////////////////////////////////////////
// //////////////// THE BLOB ITSELF /////////////////////////////////////////
// ///////////////////////////////////////////////////////////////////////////
type Blobs struct {
En Language `json:"en"`
Fr Language `json:"fr"`
Ht Language `json:"ht"`
dirty bool
}
func (b *Blobs) Populate() {
done := make(chan bool)
waitFor := 0
// Launch self-populating efforts
blobType := reflect.Indirect(reflect.ValueOf(b)).Type()
for f := range blobType.Fields() {
if f.IsExported() {
//fmt.Printf("%s:\tBeginning population efforts\n", f.Name)
waitFor += 1
go reflect.Indirect(reflect.ValueOf(b)).
FieldByName(f.Name).
Addr().
Interface().
(*Language).
Populate(strings.ToLower(f.Name), done)
}
}
// Wait until all languages are completed
for d := range done {
waitFor -= 1
if waitFor == 0 {
fmt.Println("Completed waiting for all languages")
close(done)
break
}
b.dirty = b.dirty || d
func getTypes() []string {
return []string{
"phet",
"wikipedia",
"wiktionary",
"wikiversity",
"wikisource",
"wikibooks",
"gutenberg",
"ted",
}
}
/////////////////////////////////////////////////////////////////////////////
//////////////////////// The Language ///////////////////////////////////////
/////////////////////////////////////////////////////////////////////////////
type Language struct {
Gutenberg *Zim `json:"gutenberg,omitempty"`
Phet *Zim `json:"phet,omitempty"`
Ted *Zim `json:"ted,omitempty"`
Wikibooks *Zim `json:"wikibooks,omitempty"`
Wikipedia *Zim `json:"wikipedia,omitempty"`
Wikisource *Zim `json:"wikisource,omitempty"`
Wikiversity *Zim `json:"wikiversity,omitempty"`
Wiktionary *Zim `json:"wiktionary,omitempty"`
dirty bool
}
func (l *Language) Populate(code string, done chan bool) {
childDone := make(chan bool)
waitFor := 0
languageType := reflect.Indirect(reflect.ValueOf(l)).Type()
l.dirty = false
for f := range languageType.Fields() {
if f.IsExported() {
ptrPtrZim := reflect.Indirect(reflect.ValueOf(l)).
FieldByName(f.Name)
if ptrPtrZim.IsValid() && !ptrPtrZim.IsNil() {
waitFor += 1
go reflect.Indirect(ptrPtrZim).
Addr().
Interface().
(*Zim).
Populate(strings.ToLower(f.Name), code, childDone)
} else {
// TODO: Figure out how to set a value over the nil pointer
// of the field, so we can auto-detect when these are available
// in the future
// waitFor += 1
//z := &Zim{Name: f.Name, Version: "1999-01-01", Hash: ""}
//ptrPtrZim.Set(reflect.ValueOf(z))
//go z.Populate(strings.ToLower(f.Name), code, childDone)
}
}
}
// Wait until children are all done
for d := range childDone {
waitFor -= 1
if waitFor == 0 {
close(childDone)
break
}
l.dirty = l.dirty || d
}
//fmt.Printf("%s\tFinished populate\n", code)
done <- l.dirty
}
// ///////////////////////////////////////////////////////////////////////////
// ////////////////////// A Single Zim ///////////////////////////////////////
// ///////////////////////////////////////////////////////////////////////////
type Zim struct {
Name string `json:"name"`
Version string `json:"version"`
Hash string `json:"hash"`
dirty bool
}
func (z *Zim) Populate(category string, language string, done chan bool) {
//fmt.Printf("%s:%s\tBeginning populate for\n", language, category)
// Look for a possible Zim file
links := getLinks(getPage(category))
link, err := getName(links, category, language)
if err != nil {
fmt.Printf("%s:%s\tNo zim found\n", language, category)
done <- false
return
}
//fmt.Printf("%s:%s\tFound link: %s\n", category, language, link)
// Extract name and version
re := regexp.MustCompilePOSIX("^([a-zA-Z_]+)_([0-9-]+)\\.zim$")
match := re.FindStringSubmatch(link)
if len(match) != 3 {
fmt.Printf("%s:%s Matches: %s", language, category, match)
os.Exit(1)
}
// Check if the name and version mismatch
if match[1] == z.Name && match[2] == z.Version {
fmt.Printf("Skipping existing hash: %s\n", link)
done <- false
} else {
z.Name = match[1]
z.Version = match[2]
// Fetch the Zim file, if it differs from what we currently have
z.UpdateHash(category)
done <- true
func getLanguages() []string {
return []string{
"ht",
"en",
"fr",
}
}
// Helper function to fetch the HTML of a given type page
func getPage(t string) string {
page, err := http.Get(fmt.Sprintf("%s/%s/", BASE, t))
if err != nil {
@@ -165,7 +48,6 @@ func getPage(t string) string {
return string(pageBytes)
}
// Helper function to parse out all the links from the page
func getLinks(page string) []string {
ret := []string{}
@@ -178,7 +60,6 @@ func getLinks(page string) []string {
return ret
}
// Helper function to get the most likely link for this particular entry
func getName(links []string, t, lang string) (string, error) {
candidates := []string{}
prefix := fmt.Sprintf("%s_%s_all", t, lang)
@@ -198,39 +79,44 @@ func getName(links []string, t, lang string) (string, error) {
}
}
// Helper function to get the hash value from the resulting link
func (z *Zim) UpdateHash(category string) error {
file := fmt.Sprintf("%s_%s.zim", z.Name, z.Version)
// First fetch the file into our local Nix store
fmt.Printf("Fetching hash: %s\n", file)
cmd := exec.Command("nix-prefetch-url", fmt.Sprintf("%s/%s/%s", BASE, category, file))
func getHash(ch chan result, file, category, language string) {
// TODO: Only call this if the file doesn't already have a hash
// in the existing file
fmt.Printf("Fetching hash for %s\n", file)
cmd := exec.Command( "nix-prefetch-url", fmt.Sprintf("%s/%s/%s", BASE, category, file))
out, err := cmd.Output()
if err != nil {
fmt.Printf("%s: ERROR fetching hash: %v\n", file, err)
fmt.Printf("Error fetching hash for %s (category: %s, language: %s): %v\n", file, category, language, err)
if exitErr, ok := err.(*exec.ExitError); ok {
fmt.Printf("Command stderr: %s\n", string(exitErr.Stderr))
}
return errors.New("Error fetching file")
ch <- result{category, language, ""}
return
}
hash := strings.TrimSpace(string(out))
fmt.Printf("%s: Successfully fetched raw hash\n", file)
fmt.Printf("%s: Hash is: %s\n", file, hash)
fmt.Printf("Successfully fetched hash for %s (category: %s, language: %s)\n", file, category, language)
ch <- result{category, language, hash}
}
// Then, convert the hash to SRI
cmd2 := exec.Command("nix", "hash", "convert", "--to", "sri", hash, "--hash-algo", "sha256")
out2, err2 := cmd2.Output()
if err2 != nil {
fmt.Printf("%s: Error converting hash to SRI: %v\n", file, err)
if exitErr, ok := err.(*exec.ExitError); ok {
fmt.Printf("%s: Command stderr: %s\n", file, string(exitErr.Stderr))
func outputIsValid(o map[string]map[string]Zim) bool {
for a := range o {
for b := range o[a] {
if o[a][b].Hash == "" {
return false
}
}
return errors.New("Error fetching file")
}
z.Hash = strings.TrimSpace(string(out2))
z.dirty = true
fmt.Printf("%s: Successfully convert hash to SRI: %s", file, out2)
return nil
return true
}
type result struct {
category, language, hash string
}
type Zim struct {
Name string `json:"name"`
Version string `json:"version"`
Hash string `json:"hash"`
}
func main() {
@@ -239,31 +125,90 @@ func main() {
// Determine the output file path
var outputPath string
outputPath = *outputFile
if *outputFile != "" {
outputPath = *outputFile
} else {
// Get the directory where updater.go is located
execPath, err := os.Executable()
if err != nil {
// Fallback to current directory if we can't determine executable path
outputPath = "blobs.json"
} else {
dir := filepath.Dir(execPath)
outputPath = filepath.Join(dir, "blobs.json")
}
}
fmt.Println("Writing file to ", outputPath)
// Read existing cache if it exists
var blobs Blobs
cached := make(map[string]map[string]Zim)
if data, err := os.ReadFile(outputPath); err == nil {
if err := json.Unmarshal(data, &blobs); err != nil {
if err := json.Unmarshal(data, &cached); err != nil {
fmt.Printf("Warning: could not parse existing cache file: %v\n", err)
} else {
fmt.Printf("Loaded existing cache from %s\n", outputPath)
}
} else {
fmt.Printf("Error reading file: %s", err)
os.Exit(1)
}
blobs.Populate()
ret, err := json.MarshalIndent(&blobs, "", " ")
output := make(map[string]map[string]Zim)
comms := make(chan result)
pendingHashes := 0
for _, t := range getTypes() {
page := getPage(t)
links := getLinks(page)
for _, lang := range getLanguages() {
if file, err := getName(links, t, lang); err == nil {
if _, ok := output[lang]; !ok {
output[lang] = make(map[string]Zim)
}
// Check if this file already exists in cache with same name
if cachedLang, ok := cached[lang]; ok {
if cachedEntry, ok := cachedLang[t]; ok && cachedEntry.Name == file {
// Reuse cached hash
fmt.Printf("Using cached hash for %s (category: %s, language: %s)\n", file, t, lang)
output[lang][t] = cachedEntry
continue
}
}
// File is new or name has changed, fetch hash
output[lang][t] = Zim{file, ""}
pendingHashes++
go getHash(comms, file, t, lang)
}
}
}
// Only wait for results if we actually spawned goroutines
if pendingHashes > 0 {
hashesReceived := 0
for r := range comms {
if entry, ok := output[r.language][r.category]; ok {
entry.Hash = r.hash
output[r.language][r.category] = entry
}
hashesReceived++
if hashesReceived >= pendingHashes {
close(comms)
break
}
}
}
// Verify all hashes are present
if !outputIsValid(output) {
fmt.Println("Warning: Some hashes are missing from the output")
}
ret, err := json.MarshalIndent(output, "", " ")
if err != nil {
fmt.Printf("Error marshaling JSON: %v\n", err)
os.Exit(1)
}
err = os.WriteFile(outputPath, []byte(fmt.Sprintf("%s\n", ret)), 0644)
err = os.WriteFile(outputPath, ret, 0644)
if err != nil {
fmt.Printf("Error writing to file %s: %v\n", outputPath, err)
os.Exit(1)
secrets/acme.age
BIN
View File
Binary file not shown.
secrets/acme_password.age
+37
View File
@@ -0,0 +1,37 @@
age-encryption.org/v1
-> ssh-ed25519 87huqg LKhlbZI1BygDI8E4kkzhw0/Y1BfWnzekf/URa/Bma30
uT7QzE8DPX8j3us7oNRKwu6hPUFpQosbcMRmMNgS/Gw
-> ssh-ed25519 8UnW5Q dDAJI5EnPMIhs5H21wLT84GWhkROEJRXE1QVp1aOH38
qZJt4Kip5qVZl9QoIFEXgrhtrlQEpbkfLarCgaHugj8
-> ssh-ed25519 UFfTmg kbrSoge204JvRPBszhAfMewPM4oHg0HkF52BNeb9kx8
E4ASRdn0pjF//GiFCjmRlgXRS2wiJxIXDFSjldMtTdQ
-> ssh-ed25519 xNtnoA 7b9/Z/qUEmRnFCiCYzVGJVvxvV8onjZemSg6sllaDyA
bQosZIGbaSsUqFO2JuRpIhm3FJd79JyYS43A9+zr+1w
-> ssh-ed25519 aY2AXA m4gIzzAX8pkBHHzsSykIy24E6Kru/I4uNnjihKH3JHg
S18CWIY5wNcR5PVkCqbjp1FJRrGxco6fdoykQeHhyX0
-> ssh-ed25519 AQhf1g LBmvyUbKRLKtPGIEqt+NwOSrtGwlFt2zqgdmRDHu9n8
zb8OnKRsJBEkH6eJ76mlKvJmtZ8NvVwVS9/0tsZlMUk
-> ssh-ed25519 mOmPfg TuPbRMlX9eRATxSbv6v88TtzGhOKWn5FOkIg4xR6FH0
NLNzJM/9r2jZ70Y2r5Hsc36gcRTSPw40Aabn/H7OE+4
-> ssh-ed25519 YJiRbw bVMyOOgBcFFRNulym46YwKAIPlOkbQhmQAo9kl4dRx8
5W2fIxGXCXbzULOismGg4NxE+VQ8LDEbODlJ0OpFMiI
-> ssh-ed25519 Nl/5yA ydFS0bVjjDzymhQFaBJ3YqDREQDpVO6VzgS2MBtuOUo
tNzj/85BiYe6th2N6A9ZkMSPKduwAIe/qnf2NVJiHOg
-> ssh-ed25519 GdLgCQ wmfT7bCzwnkwEtn2mRnElIM75MmdRw+33MhSegSHJWk
YHrCYB1wF1njNjzpIy3hKZ9l1cj7m5yicLuj71TvKr8
-> ssh-ed25519 tOH/HQ z5/GMQOtkpMWwWdMXqxmf12MM84xkgXL/OLliq3RHh0
mVhBt+uc7z/YkoIAyXTqBgv00cJOrZ0bsBP0lD9S24c
-> ssh-ed25519 FpzvfQ D8N5JQ+3rGdSZIPmzlZqO5VpS90v6r99WMXtyUqCGiw
A2SSvI4H5TRY13R/iOa60bCdc0zR6lUAHJVHfAUR5mQ
-> ssh-ed25519 2UotMw eaM1Kkzw53Oq8lW0BFn3rqWFcTQaTz9jcDsULDg/fwU
3QVYFrhKnvwWDpIdsyTp0amontUXePko8z8PeUub9EE
-> ssh-ed25519 kdPvzQ 08LE8a24S5cvuK9DVWD2ta0GjJMNzUidmgYT4RfhQDA
cRFH8vOr2y1/C9F2wZWV2deUxUpoL34IFRyOBHPYifI
-> ssh-ed25519 onmXpg J5MKGIovNwv4FyTN4ofExlHV8qYzU/J9O3MI4tZYcTo
iagT0Ypo8gTwvGpV66XNuNPedefx2S72q9hyeB2Rz/w
-> ssh-ed25519 CnhD0g se/N4hrYxOiukByYzsIhxToceXNuBO7J7VmM4muJ3Dk
cW+WW8iWjj3eXDqDO8aEON1ZH/+6AXQGAEXkLRbL3AI
-> ssh-ed25519 4ep2UA uyjvubY39oSGeCNsX3/VIdM5CzNBlrnRpkF+YN5MBCo
xiNuksI7olV5Db392Vjz/7uDNDIssGmI9bez6vSOXTk
--- VsGbd8K7JzHe/eoYUeTMwcg/GrY9SXVzNxL4HZ23tKQ
£_÷t/¢ªØËVÎÞ}7J'%?™Á‰Å0“¤¼^õ¿-„ÏÛ„äu4¥ù‹íäóü0!®ÝîËðMÜÅ·
secrets/attic.age
BIN
View File
Binary file not shown.
secrets/ca/intermediate_key.age
BIN
View File
Binary file not shown.
secrets/ca/root_key.age
BIN
View File
Binary file not shown.
secrets/cache-credentials.age
BIN
View File
Binary file not shown.
secrets/cache-private-key.age
BIN
View File
Binary file not shown.
secrets/compose/attic.env.age
BIN
View File
Binary file not shown.
secrets/dendrite.age
+36 -36
View File
@@ -1,37 +1,37 @@
age-encryption.org/v1
-> ssh-ed25519 8UnW5Q MDrURGpcaqY6DVIURK6dJs7xKCGLtFS8+hH0UCRT7G4
qsqMoWCrssVlJ2kP1cvP9+Fj+c07iFvbFs3Cs+RYVLM
-> ssh-ed25519 UFfTmg lTHOOV5/G7IPaYWqrAwM9Nb75//N9O1wMDFSUtyo1gI
kEWctDmQRHNzxMIwONsZo9EEIc/wkPxqX851BO6ohYo
-> ssh-ed25519 xNtnoA lm6OHoKNa8wB1ML5lA/xl13Xp8WUSF2UY89bP8BZP0E
iPDWUaoViQ7faVkUf2V1MQxrklAw8lJ2KXfJZTYN2X4
-> ssh-ed25519 aY2AXA 4E8FsRsfsEKsLNVvBRTAoxghfex8omAQcy8NKzJ17kw
uzZQp9nVfyVH3dz0UinqZjsZ0Kft7tPVSk1EkE6NvA8
-> ssh-ed25519 AQhf1g rgcA2UeG0s75kSpok9+VR4ixNyZUqD+8ye1TJsMMA3Q
rfM5/54WWHrnG1qfex57tGH97lbvKM+J6TGztYOrU+c
-> ssh-ed25519 r/3ipA 7pNJRvOFO5v2nlMPbXP9oad6jp1pPAsByfiEhdCTAWI
Vh+iyg2P6fvNWyCS+V4087zRf+pCIBj0jsPX0DtPp0c
-> ssh-ed25519 mOmPfg 9WuzH4QasTe0NNcIf+XSremq5GuBZoKP+7t4MJNAFA0
5E1Rbupw8IUnTuicTubXWmwkJ2xVg5K4BpkZCsUj5UU
-> ssh-ed25519 YJiRbw msPFM69Tuy/luxASGVA8ey77vqtvXNy7ytf2VxQWNi8
oD5vRs439A/YT5FxkSltl1Qf56NNhiKt17++vlFvwPA
-> ssh-ed25519 Nl/5yA C3zn641k6eFQePbp2q7dwlIu7Iiw2aU5dmSrH2HCai4
v1/XJRKIrIgHWfFtSDaFCvOKtcIR84abUZHPjaxP5bw
-> ssh-ed25519 GdLgCQ ZztOWiw1ao1pvJ9REB/wBuxq00uyO+JAkIWjLUMueSc
zXSv3MauG2E2el+Yv5oocTgDQjQ1fKXLpm6y2OTyIvw
-> ssh-ed25519 tOH/HQ /eEgAf2KH1Zgd4yQf+kzyESkvPI8GKJC0MAJl+8+WD4
H35T+ulGSCrWAuIsZs8ISRJRj2wqpRrOGlaoq9fnN5o
-> ssh-ed25519 FpzvfQ dRq/NtT/TxJ/k9WlaMl/PrLTvPzkhV8LpF/LxjqjGmM
LJN8xxnNF3EcMmXKdLhc70b2Y6n9qS3A5wdFXY6hUjw
-> ssh-ed25519 2UotMw I+kJsu4GAflSfMjzE/8+vp6AZb88OpiCREuxfAnQPis
hRu7IbLMdc3U+NQo1PDhc+O9uyd/wJZyPtfTv9z9TvI
-> ssh-ed25519 kdPvzQ uOLSQFzsGSNg1HsiJLCYi2Lp8pasc7H/jhUBlf6b0zg
KbUOl2WOsc6VuAC33SjEJS3tM3o82A3QO0bA9wd0rbA
-> ssh-ed25519 onmXpg NKdAvcN3TStWYtQeLW1oEn7+shQuuNBndHaQRAU4f1o
vCuDnPc3tayIwDbHJneLQNoENyfA6GRpQi6+OZ34Jjc
-> ssh-ed25519 CnhD0g Co6fy3fm8BUi2qn+xBY1X33N2m40jEM7CJhSQcLokR0
kwrOzTRiVe1aQH/P+ua3xZNgNRZh2pfQrQl2k2Y727Q
-> ssh-ed25519 4ep2UA /f1HxU62FqhDJyJ9fPMKiqJdw1m/UjASKuYhY5Aq8D8
tckIOvPq3Qid9Z5ud2v9syaed/h+3GrackXKZonDYEg
--- FHj/yA6RDV1VYPsi84z5Y3NrbfVUthwdtuRWqiKC57Q
Õ=Â7T÷Ü`6¦K./ ¾¿àO Ö¼‰R•Pá€K…2NYqWÖ¹£®ê0v{±µi'¢žÖVûÆ!+‘|ÎÕ0¿ŽšÆ¼ú´Ìi ½†Ä?Q�Žq¢2Ô5ÖÀéŽ gÜ/c_
-> ssh-ed25519 87huqg CsPCBXcVp7krsPi1k0WbjKFZxUzuZNJkkpOImMDWNns
h6evECCNa5VGBe1dtbVwOBFBPkzwUKPFyVdQsTNMUXo
-> ssh-ed25519 8UnW5Q 1pioLo4kA+RJ6r35H9FNCQ5LZqmYUmxZTVyTdD0o92Q
4r/sOb3IcQElEJnKAgmYeHtubm1Hk/cdiY6gUI1GkHg
-> ssh-ed25519 UFfTmg ruMzDG9lKKSHo2I1L/2wigVZs1Jhi6aTNmrr4zAyEiI
3gsAmzM6fE8RL/fLL63pPIH75P9TW954nw11/JpU77M
-> ssh-ed25519 xNtnoA eTZoJFu1SqUoUGPcdVDw/2wW82xvRiSCnAmQSZPQT2w
Y9Cf+/h80vn2w6G9n+V4uNV7bj3tpOT1KWRKajM7d5k
-> ssh-ed25519 aY2AXA c4MkdSio2FFkulOBKDSAG3Iq71ghRdw8/SQF0B98chY
lvT+m2ey5+HqipuC7MrPQIKu8KrSsLHM0XRK8c0iS8w
-> ssh-ed25519 AQhf1g vLig+8a5jPo3cQhdmQw/C/P1hgzKHiVkVwUTkMBNmTk
N5ROr2EtHpTwti7NByDiR8R3pOQ/STwlIuNeY1pDA20
-> ssh-ed25519 mOmPfg WcbxDQfraXfxkN1+IGaArpIHOmlUlhGjBijQt5ZYSxE
6KHLewxXWwo8fVIuaTuY/T/igsI6CKqEl2tyM/gkn6g
-> ssh-ed25519 YJiRbw IblKWpY9DeDSWDfvlEmNeWSV1lGdz9aHcv2oQVmKQFI
qPcdGcA6Z7YaLL5umR8ZOKzOyNIUJVHRBpV5HyAJeqw
-> ssh-ed25519 Nl/5yA wr0Q96yztc+Rf88q6ooiDHlKqpVdWPkRWApfJsc7uQc
hQZTwZ36mkajMcSbxDsL+TtAezJIY+H+J7VaU1QOqEo
-> ssh-ed25519 GdLgCQ LiwfxrAh9dLjMeo6FglQzvUQ3hfWRAZr2naADkB5/WM
Bn4fnoqTvKPd73qi28NAgAN8AZl4EWcr9e/uhuUwVgI
-> ssh-ed25519 tOH/HQ x35ypXVDI9C1wpquWxDUFYXYHxEsD2NJ0VIDosRONyE
Aa5eZt98GQQZmKlBDzRC9KRyMCy2z1htSAsjKNGCuFw
-> ssh-ed25519 FpzvfQ jlAbIzsWi8eX+PTKn100NaiSoezN1kXzZ3gWUOKfQVg
NQARp2qsxIdSG3OLJyP33A97r6cBRaMSaneT8NBnhDI
-> ssh-ed25519 2UotMw 53sXK937St2F3MzVIhmsjH6WeCSRdkpv4oFa2ZBaelI
lNsjlQzS8Szj0FcAvrQno9rDO17iKDjMN7VwMLvIleE
-> ssh-ed25519 kdPvzQ YdeMlv40jR9bFnXVjPJDpvCnqn091dCKAB60m4Obwgo
vgPAO0evfCXQUX7Tu/G9ERUhLO3KiWXqpxIqATDl5vw
-> ssh-ed25519 onmXpg mrDB6F061SjeYOZuUJVvZP8SzOVrFdpAAEfgPOzp608
AzAEEHK6Q71YxPfiljl7ZCy0b3YBdSBMKORJd7Opkck
-> ssh-ed25519 CnhD0g Ov3v97PyY79WoXUDAdvXEZvTE7ruIgDeXVz3jD5O1HY
+0rSmiqdxP6PgplxLkim4AJtKPcjn7OlkXpcu0BsI4s
-> ssh-ed25519 4ep2UA bDGTw6Msbh9sOp66l1VKGrT53AlrPv+QG2T6ZJv1pDk
WvHFJ3LIlpiuVhHUxY6egKifWNepzIB7Ls2R4Kx1Kng
--- Ec6/6bQEn4GQOedrSzE+Yw1xRjQA34sj29Tr3zLFgZo
NïP¢uGc!Wcݼ¯£ \¼ìæ—K-©;]Ðu¹!,ó$#nŒ¶dZ‹«­¦yž“-kX’BÕÙƒ°·ªc'‡Lò¯Fl�ݪš6L‚n˸n’Ý£f$ƒðÀ´ê
secrets/dendrite_key.age
BIN
View File
Binary file not shown.
secrets/gitea/buildbotWorkersFile.age
+36 -36
View File
@@ -1,37 +1,37 @@
age-encryption.org/v1
-> ssh-ed25519 8UnW5Q /cVdlKHdFUszYMCldfAZVCCHSt15HjcWFtz2TkiXyjY
DWQdhHSYXFTHJG21uhDMlljeSqCKSriFtDW3LptRtK8
-> ssh-ed25519 UFfTmg 4ezUQ1CrfVmPvm/B4twGSqbYgN5aOKe7TfOzJCwzJXQ
MiEugBcdP9lcO/nP1mpuf7lhPXKbUUd9zVu0gmeXasU
-> ssh-ed25519 xNtnoA I/664KfHWJsCcRxQC47dccXgl31HoxnUlt697f5cID4
DwENqVKt4GxU+ynL99K0kIj/qeT+krZvPXZefbij11A
-> ssh-ed25519 aY2AXA 6VlRolPP+GvsEzSNDtY6NtqsV/fCLwkKX2frsVx/e34
tBlkTlDE/iEOhO0zfgto98hiJzS4pEzr29iuZXL9nnM
-> ssh-ed25519 AQhf1g rjIeZ1pT0WmkWTxA27HfHLJRWNOSJXH1hWEFQaTWKk4
4nPriRa628dVznIoL2Wqu7rC0h/34OCNgkrbqfewiZs
-> ssh-ed25519 r/3ipA UsT9khxY0QbCgjsjVq6C8w1sAc14ldHA47QIZ/z2i1M
DHf6CipFevIS+12XXO4hU8uFC9RtpDe8MZoTrdjM264
-> ssh-ed25519 mOmPfg uVhT1cO1hfr9FF1vX01AVMfcuL4Fne8K21llW6MKAgc
QJWSUgpSKCM8MionIw2uFM7sz0zrNhwPZUftDMQWfaU
-> ssh-ed25519 YJiRbw Helxk3oufur9cbJSc5PLN6/LmIRCBQgD7WZqNyd292I
+9IKaKUkrJr/hWSq/+xIzYqbOqnxBBfVfBV6A+TEz/o
-> ssh-ed25519 Nl/5yA QDrpal6sH+qykRk9RbmNJVuQZnq1fU2KD2DfADBQFQM
XLPBHeipZz2TiS28SmQGsPikGyfhvCJCFPaFyMXtFz8
-> ssh-ed25519 GdLgCQ EIEU+UNtsnnIDg9Cz/aUoCuLpgGysnpjMuzeWTHsMCM
+d6a83uoBqes28e0KTjxOulwhVPwdJ4K5dsBXAGSrDI
-> ssh-ed25519 tOH/HQ ttYI97W+nqSunHhEHhaHrGPxIRmhKKyyHDgoFF6R5U4
+sf4VdWrsOTWfi7OUKET/OucniwkvctcyqP3eCqCI7E
-> ssh-ed25519 FpzvfQ hJigNhU18mMxIlIx/NvuZc9bi45PplnROyyDRzEknSk
b0aFC/vUi1CgRO3Dttodv3R/VBI5HJXk5eAb1PXY6rY
-> ssh-ed25519 2UotMw 8IEuY5An4B2NPjSyawKN6YpRlutsOjZdYpmr3Zed6EQ
R2PhWVN+HL+Cpa5UCeZnYDhUCDn+8wbvvHgWDyRWR4A
-> ssh-ed25519 kdPvzQ xBmYNmttCwRBMQCyfvb16p2wuHrHwqtUo98RSRWiUCE
oapGMLXigHx/anDaV2s9SZZosccqP1a8/2t/4yMLodM
-> ssh-ed25519 onmXpg hH0VAFzTN3CezRdY9KhLkYlHnrlvCo/eHlvnuTzVtWQ
vIyTINNw/pHL1gEl7MA4J7GvtL+8/oPjG86uDvET/jk
-> ssh-ed25519 CnhD0g XBpQYVj4CX7Bv64cFxR3YevKKW5Oelt1uFoQCZVR4kQ
prmdbQuuTNMikogdkdhED8g9oWUXPP5u3Jn3qbqq6Pg
-> ssh-ed25519 4ep2UA S2PhUuDTrNBtZDdLUnnl6Ck0jAq+duWdhzAKtRNpuhQ
dsEv7lSU0G6RAUBtqv7zg7nYt9vfTXzqvKjtTCgF0nk
--- mNxL6onhO2/m3dfTuAosml1qIMtfUkNlucKPmG0t0so
ï*Ò\¾©w+=)É2@ú?&M—w^;{‚G*?¹À­÷n/™*ñ‚ð?×óÝ*¬ß1?�Z8(ld:�3óß¾•|ìÀßK½�eû g^Ðä{âFPš€òídCŒIHÔBé¢Mg¡¶Þ®�¿K•" ¤w%ìW1Góǧ<HK␍Fž(àqf�xt¯1„/–
-> ssh-ed25519 87huqg OP0JAd66/SUS9oBMmOAUdDc+zLgKJ90OUrfO5fhf/zk
YUlZvlaZF8o7BBPEYbxDeqiMmOnV3HdUUX3aUdhnPKk
-> ssh-ed25519 8UnW5Q VD5yOGQB6wS7ChQwaLFCEYEF5Yt6bCA7mHrytolI8WU
Jphq2HxVsMJD79yZM1SlxpD5RuJnE05OfuH0aOIGPvk
-> ssh-ed25519 UFfTmg 1s7VkQEbq1L9BCAOVlCQ4NfPfwYjcqItN4PMatuSTjE
EOj0rFqARHPeBRKP0chH5BJcr8lyLCFEBZ6wfAhYbbc
-> ssh-ed25519 xNtnoA CKFIZ8blJvm+vT2xJxBz5xzp4afsIU56Z5gP6cxba3Q
scD+SuipcZkWT2WERFEnjwGdbA9XrXfsmIZ7r8bmM8U
-> ssh-ed25519 aY2AXA f6Mt6J6Iqdex7SP0ngYwFrQFOObwNx/kLp7QVsJkFVE
KtF/G7BBmgg0eonne52KN/hRSfc7muRg+aqllcaGZTU
-> ssh-ed25519 AQhf1g sKGPNRD/rgVQj0/wModKct9dFOr1Nm20GJV44HLn7Es
rr4SInqIn8tUamEBACummSzUvq6TK/Nnz4M2zHY6dRQ
-> ssh-ed25519 mOmPfg sGlYKhIISYka5/5mVBGoCwEUk2j+6tcYRiDBtvKosVI
938SaOYsIjFpJZJAfRV9JWUoCQZ2nm6NGn0AE5RtlM4
-> ssh-ed25519 YJiRbw D58sw+Z+YuSoTg4pZeGOJcFCuRDVqA45R/r9MntQWB4
fpV33ShLgn3XuPxD2EZ3CQ2WdSdqmCQyfVOmMCPl9zs
-> ssh-ed25519 Nl/5yA 7QHmS3lFG+cU8+Ik9iRvaXyf/vBPe7wa9sAYekQKB1c
dHsGrtXNbt0+reajFztW8SlGuz+0PTMsWbtUMcTaF2U
-> ssh-ed25519 GdLgCQ c+IZuoQzLMbn6N44w/SsCGaeL9KxwIe1Yj1iHLj0TQw
KzWUk7/C1xDxZXSu5YKFiwctg0k6Vee6PmudFUPoEq8
-> ssh-ed25519 tOH/HQ 0W8zyXYP6RzIBFfFZl3Z/b5IphG0OUZgJDgjvDC0FG0
WojVazNzk2mlfUCsNnJFC+74nYCEjO1fp0pvsq7FHLA
-> ssh-ed25519 FpzvfQ mMziPqzzRrQDf0cYJS028icRScECfi8aCxPz3Xe/w1I
1TzjHZYunhMmZCPMjam7LpvGtvw40hRuk0IlUUe45f0
-> ssh-ed25519 2UotMw v8kYr544AHHIv1C5HJb47sFYAhLLPANZ0r1nWLjYYmo
Yr8QHe/V0LQJroyJncVabqS8m4YtF8mrMBMIaiZO7r0
-> ssh-ed25519 kdPvzQ 7Uv+ltj/EOX/jseUjGXAryi9r1w6uO39ao3yeH3z0V4
oVp5cJCiDi/Lb6cH708QanulTNI7386GalxHfYiZQWY
-> ssh-ed25519 onmXpg nFhA0zvOJYDK8C7DNNIbJSi56UrjgHaXyhzQH+pNkmY
Mrl7Urw2EJ/SIF+fnf4fqNMJ9QsF1YzKQLRIc4kPNPI
-> ssh-ed25519 CnhD0g slBtQIp3uM2x2NhUz+yt9z+4Y5IoGeohW03j/B0VSUU
yY1IRFJEgtNuKG6nP05XOiwPUZXTFxOgttT1gXBMBcc
-> ssh-ed25519 4ep2UA Xe+tcFe77241jAAyj96ShjVsdCIA2ECNp72rJdefSj0
ruNsQAjf3dGmIxV7qNYPQAPRTWi18UDNOAETfMBAd4s
--- FoB0CBe8heDBXHuPn056QFz6+RTC+AFPyRBewoI0cwo
uú.(\û*0›U݆P€{CˆL9Ö„ÕGèχ±£9�e!‹–5)!¶j¸bÞ‘nmðÅ–b1_¨Ocþ–ÝsW¥¹6«Ðˆ Î†‹šÀ©è ˆŸÉ]tÇSìngç-ž„È`ò‘_ágÇœc‘$ÐH¾&úñwo[lăcßÐrz½u{€öÌ<÷åDƒg�ç>8<#
secrets/gitea/oauthSecret.age
+36 -37
View File
@@ -1,38 +1,37 @@
age-encryption.org/v1
-> ssh-ed25519 8UnW5Q UlSvWFtyzP1itr1QuvrEQYhvw1oMjOgXyR1H8Geyc30
m7GOH/FvAh35dmtU8SrQUcHre3QjrHZ/rvbSzq+DJFI
-> ssh-ed25519 UFfTmg 4ifiDuC+WyaZCJEWLkUogxEFz/3CnwlMbBojSznie1A
qgeDtFVdt2+WGGlYJL43iIdu3+nmtHZJEh5R1PdwL/g
-> ssh-ed25519 xNtnoA g73KMG80Xe8DP3ou9YllkmG4f5RtTu70md3WG6XVkzE
gUylPhlmUwx2y4Ld2ibDFdIQHHPYGkbI9ghT/YBYuME
-> ssh-ed25519 aY2AXA VHCrb4MI+LIY169KZIOqlRoRHl7qeqeweI5/Q6IFq24
hA1eiydZmy+A8FtX8kPP9biAzI7SUPRzaJAMvayBXvE
-> ssh-ed25519 AQhf1g Ht0O8KwIzi4FSjj3Gsx3d6tR9L1VWDssNw4MI0JH0GE
6xWDy+DXY3etU3QSNs+6nS2vQ/zO6tBUcMKlpyCnWlA
-> ssh-ed25519 r/3ipA CkosmEHp1uLBUzMTWkQLLT/2HicXU6QNQhbe2hyK3xo
rHAaWdoqLtK7awKgXixVudFkzvvuJLqW0esFFJRTxOY
-> ssh-ed25519 mOmPfg z/D9xXbXsI2O4kOtHnaB9uqA7pAB6q2mpNzkQInNxRU
ELp9idvf6ytjUlwXcwjDskx/nNxWzZBAu3z/35H2raA
-> ssh-ed25519 YJiRbw PuTysdLGmt/N0K3HirjfBRv1v+rvnfXOl5EOZDyKOWU
XQitNgPuduUQ0/kYD2oKgDaDAkM+eUsRDtJimxulE2E
-> ssh-ed25519 Nl/5yA F8xymke/81LlgOQq4IZtpUL8zAYIZLDU7/hYPbDW+UQ
BL5pks4vXzbM2Obzmb3vEUdYe/dEP5cm6490o1MjpMY
-> ssh-ed25519 GdLgCQ J7fDZ4MEt/A8jhfCM8Qq2++v/bwhpSvykKefrp0R2Dk
E8BrcouvDsBTcAITuhUyENKTR2U3SlyUFgHThBkZ5NU
-> ssh-ed25519 tOH/HQ 5pbs0Qpugt2Z4GnERpgG7V1E+u/PqQZ8jmdhxiGAKmY
B6HXWpicDrESt1NcCrpjTTmWla11zRGInKpe5EqRKK8
-> ssh-ed25519 FpzvfQ ErKw/iWsCByk10H1SRr0771IsOF5kuKZYYynOI4NIhk
DXo1XN6lRhGcbZ0wOn4FKK+k3Qx8jp5jY2GYJ+5S/Oo
-> ssh-ed25519 2UotMw JvfWHcMKFS/FNr6dpLso8xDEmtKrd+bf6W4FSU+9vys
MSHnO/7jZUAo/7FKWOYzaRWbLAC1Sn7JfSyN0Shoo7U
-> ssh-ed25519 kdPvzQ TqAXhvp06kZR6czrD0ZKWRlyqU6kUYoZfP8gakziS2U
ad0/vG0CRQ7sHiHvzedRAkdWarR+vHfgPMAjvXHBk7M
-> ssh-ed25519 onmXpg ndkl5ubOnF20q+1Cd5d8b5Zy6KZ88EjWlmhGzy8+70c
18mzoHrH0VHlDfia5ch2+pLy/EA6PejcVEkV1+cWQnI
-> ssh-ed25519 CnhD0g JJ20jASeobaaiVJvg2m/JYp57UeCs9P0ddDJbE0I5E4
uxGbgcL7CA+Gk8p0jRtc/1uXMM6fflOJKKvCCscsYMw
-> ssh-ed25519 4ep2UA Gt5+6tALjGgyLYln/5GME6/cyX6zBIIoKEbfU3k5XVo
8+jhXYNZqIGP9gxYPTEUAeclc2yOoi1iPc0Wlsb2Fw4
--- C93ywGKoxGqj+uUh7M8VrRr9+6/sl4jbUWvIUlwOack
8ÕXÛêÐÞQŸà¡•$Œ“¬G¹„Ön.
2sÏÞ›n®ê®‘&­›XÙßü«?‡!Ñþ`g7Ó §DÕ‘ôëMìÓæŽi‹ÍŒáé±è*ú 
-> ssh-ed25519 87huqg ua9lzblqM2d0AmRbEj9c6p8LVBxNkYYr/vH5+HFoDEI
Y08ot6KWTZdHXjYUsc2hcKnQlJBtcmE1oD5+OX86J80
-> ssh-ed25519 8UnW5Q QW+RWL8RfOoPfZEb+m2XHNgvlUoLZqPSDjx6riMCXDk
DyJSnhbUWRCMUWlHYnz/jbqBxazGXEaxe6/T6CNtvsc
-> ssh-ed25519 UFfTmg XcNVYggkFQmj591cbFEpz0ishJgp90W1Eu1OWphmj1g
3/GL+Q2euyXgcapUXDt8Mw5Q2+bbk2C2voQgGuTtiUU
-> ssh-ed25519 xNtnoA CYfNyaWgYlM4oe/G2sI99gvldiKY9ScDsi7XPLnDTjU
h07PCdnOUF4o6YggrJ27Cdc/Gb9cu5CE0cZegyqLiKc
-> ssh-ed25519 aY2AXA NxBftj7RM1QeZ5Np3Mt/xsxZ12XMtgHh/foWN2uyyT8
nXUQI/tjhtPSYH6GFDxw5oIQnrLrQHYfNpriXXqH5fg
-> ssh-ed25519 AQhf1g 8BTUwRGn9xPBIO+Ez2viFtp1B0LzWR69Aer0B/OfhS0
uKAkoOTpuyLFnqKPXgTPYBriaNCQZz/hwSLkUKypBwo
-> ssh-ed25519 mOmPfg FNLltRffV5bNxipVpxAOkfviS/RKJfrZ1TBWIVSspHM
ML0HeuZwms//wyIBfXspWQPLh/DSbl5YkcyHHJ4vZ/8
-> ssh-ed25519 YJiRbw rgJDr6qSeN679l+aIfDuhonxcoGw1h5C+nVGS0ce3nE
c5xynEMZNtHuPb3wc9d8QADay6Pgf5dhSw9jLw5jkjw
-> ssh-ed25519 Nl/5yA /5IxJynZ+oP2iBZikH1dePktiwHrjYMSSeEn0wR4ywc
My8esaXF11AgCEOeyNX+JRgLGuMlSPYGHqJIbxG3XWk
-> ssh-ed25519 GdLgCQ zKBABsXQE98vU0BgEj5onnfHs/Ta9qWwMgKKPFI//n4
h0cMTFqCZ3pON8JwZBfJz1E2HPWVEqH9fRc2ry59HaM
-> ssh-ed25519 tOH/HQ oPtW9p3QZzva2unDORMZURJAl7VVbuGF91HCe+wbTzo
9bTm0B3q1tFNVepL20MIU5hWUFK6uUn3781NDqhWkv8
-> ssh-ed25519 FpzvfQ R4ZCZsgf2tlN4h07M6mzgR/lhaZnP7uyUxajO+oC+UE
iJnJWKYrushgkegJPxw7M2aimtQ/dqOB31BHnMaFTm8
-> ssh-ed25519 2UotMw eIow72TygjpYbhJLCqt2vm2X7bu3NjY6MFTOWjl+pgI
2EgimzYzga4FW5c79N3ppEMVvREAmh5wx3lI8gh0/BU
-> ssh-ed25519 kdPvzQ 5XbOccIDpMFKcCaBWFRWWCaUh3p1LBJ0ayolQroZeA4
Jb+n0HeR3gDYizA0kta1TBvEiZryKlDwbuoa2u8PyKM
-> ssh-ed25519 onmXpg PZR1T8ylkM55nGIBYiCroNWNTwBcEA5PZU1YWH3tsWA
LsOHqiryBJkA7b463zyg3IToKy1Teo/miyPfENewGnQ
-> ssh-ed25519 CnhD0g j8T3e67+tDXJFRsX/gC9qqQn6YGFxgAMwWsQ9vlDsGg
KAOrCxfTTo4uB0EjrV6VwAx71hbrNiJuP6G8F9lOr2Q
-> ssh-ed25519 4ep2UA wC0BaXPYM2iRPRBhQlOo2QRM0nX084cDp6brzKWjkzo
wNBztDXiPi6K9q+HJRXsr56/nf6k/aQJQIEpVCjQjQE
--- IsVY/KsFoTGubmdpOdoTI64+O40RJplehy026aS1RJc
]̃R…ÊYávŠ½²1ù\½LœÙkœ”­“¡Q:ÙŸý6 š¶¥b»Ø*ÙI­ÝZ3ýAóQÆ%HÑ4Êða0,ìvÇåÙ÷Ä­Äþ7�ð-
secrets/gitea/oauthToken.age
BIN
View File
Binary file not shown.
secrets/gitea/runner-isaiah-podman.age
+36 -36
View File
@@ -1,37 +1,37 @@
age-encryption.org/v1
-> ssh-ed25519 8UnW5Q E0Cdhbg4mRNzzHLghvg/dgtXcgt/1kuQagBhFjDdfnQ
gEByb0FlQRO3RvqS7uop6kvyHCK8lkkdApI7KKDiLLo
-> ssh-ed25519 UFfTmg eCt3JllYLv+BIRrfHTNvOVY2bOmvU7Vn9dgdSETLxWg
RYr//nOKClYqf6wT2ZfaUdWUvhZwdnAd9KuQRIAog/o
-> ssh-ed25519 xNtnoA ZD2sNDXV39GdAm0H5PDB1glXHjNTwgpmy03B/tX1G3A
v4HNBA77JAAOjgOqIEmgvM9TaTcX1Pgsh4mA8FJbDJ0
-> ssh-ed25519 aY2AXA Pgw8zantkYPSIlEVtApmrv6FANvJMScFlGn7XuVINnQ
F55HvsAjccLCDXwsnLtiCTzqjCykI1LgNvrBPo/9Hhg
-> ssh-ed25519 AQhf1g ocWSVOtSSwziSbHLpfzt9onAo+f20CnD92HDmHuvjms
+RfduLd2K1PXzXbjfBUsvSlErh1a7HcWq1uEmYccwOQ
-> ssh-ed25519 r/3ipA GHKAUd/EJW/fhYqlZcoMJvDN0JnxOSnJ85zaWHCoEj8
VPBMtl/vSBUuQka53xmUtmcZ7Ug09rmVLr0zz4J7qa0
-> ssh-ed25519 mOmPfg H5wv8RYDXisyIbKDEfmy5qYofko73JLPEdwqW527q1o
gzykZnqY4Rxvnol4k24zrcSrX+Rhb5I5ueGSsHM2do0
-> ssh-ed25519 YJiRbw TANfFv+VCX835WeB4xwzE+7bSzOlNcUiiWeTc7ZSVWw
W4IJ3e6KMPEu4LGpPYNedPpd7yYM2WDwpO8cFOKCO8g
-> ssh-ed25519 Nl/5yA 5A04J8hrMgo+Zc1kueTxjEWOiLhXS2Z61Bt1Ykz1+0Y
iGHr1oYbfYjuyrpgMBZSg8O/GGlx4fsBZGI3xb/8010
-> ssh-ed25519 GdLgCQ rqmXK9UWq6h8LYNhwzZv2JVEpO9pTWPOEZ07NEdftB8
Pow3I9bqgjbaWzq+HPoliD2ZWe4xp4YROGQsv9WPxy8
-> ssh-ed25519 tOH/HQ VJSZ0038Bq3VtvV9fG0rpNp33dozSAYUE7ILBG0KjGQ
dSwc/Kf7sC0qah7UKmXgbvKah3CiIABSS9e3SwVnf4g
-> ssh-ed25519 FpzvfQ d3qVUKv1cKsoeuXK0KcDyViMExlsF4z9Zod6T6v5eCM
UyYVI9cPFMr5XRETLWcO/eqSpch7zKJElwuBU8CNGwY
-> ssh-ed25519 2UotMw AiFjRIE+vsMZP1oF7jSlXK2VNRthzXyUuBvbhZIcAV0
xyZ79tTLJ+1QpEVfQ+un5Sz3CTKq0T7wuF/Qka/NBE4
-> ssh-ed25519 kdPvzQ IRv2zsdpO0axmwXMBicAAgN8ebqBPgCmCK177xwU6Qc
v4HbNhr9Ma4f5UIkNqgdXLylmOyg42sa2NOLz9Sisgw
-> ssh-ed25519 onmXpg 4TlZ050M+oJdS88xGgMjSYjIP4tcekkxKYBrs59FVzs
yH8FE7Jg1r/vxNYXYlZ688A3tKdFuner17OvZNTZv0g
-> ssh-ed25519 CnhD0g EkUxGQbJ9/B8KkXYnhSniZUhCIkuauilRhpC+N1HTBk
rf0m3TU0xg9ch/0KEJcE2NGFqW3Aumt1NbnxCtAEjHo
-> ssh-ed25519 4ep2UA /1we2B4B3jY/ADtXPYxNe5bRoRbFHeSDzIR7qu3BA30
f0wku5YBXpggzWRsYs1rs1EHwOjWygyjLIM2xSYo1MY
--- vhT0oAaUS7BzF6k2pSvO08EILvWQcl0h3X8IBtnrUrc
O0T :LÇoV|âžezÔ~Pôòšü­ÔÁ鑯9Qà\ÞÇ¢�p‚ºg'jëf;Õ�jŽ{Ã{લþTE¸dÏ;*› 0¸k€¼O
-> ssh-ed25519 87huqg 0BPWYqZmhRyvis9uvGwUUSW+ele+l8IeF800BDyGSzg
5VjgpSd1sFRNREuv1C3MYCWhDs1a9xiXc/PhvesR22g
-> ssh-ed25519 8UnW5Q PbSyI0V2Yi2zGhgHhi7bFQzN8nGw3YTJaDCltysRJmI
m3o81t3eHybGoyid9mCulXu2TiCXoYZgEJkeMTVOIGE
-> ssh-ed25519 UFfTmg EefXcU4i8wJ7Zxf3tFkjcZhnAuJRl2yvx3+tmUZiJQQ
XSsgWWZvEdyEZMluvbPr5WkGBCPmyQDMejtzwf8DNI4
-> ssh-ed25519 xNtnoA 30K1t7yvl8xp+r3G048X4dTBBt7yuIJpSsirj4TuhT0
TowyK2GWXSO4k1Y/eYA3jrQow1j8Ti3JGNj+KGEHs7s
-> ssh-ed25519 aY2AXA 0CcV1pMMlaQpvuba3YVvOAmGKQbMNn3pciGhUsU9rGg
BBsUSmzFL4nlyHeoDGCplOCNcgCGVXyw8ZcdY1V8UU0
-> ssh-ed25519 AQhf1g w7CyGajIHe+QtVcxd7LkmAfoViCGlETXUzmdfwAnfUg
k3pttObVlS9U+k3AaSmr5RdteuV7KS4FoD+jKP+ohjw
-> ssh-ed25519 mOmPfg TdZUGOwl8iLES+lLOOUS5z2vrmzn0UszNTAsoY0KtQw
jEV5asKniZYCzdbALXyIcF/leiaV1e0Xo50Qq1ni5VM
-> ssh-ed25519 YJiRbw SQsOrXQaFPTKUWSKIjluoWbd5Sg0wP1ZVMOOiVilN04
2Sl9esKTW0hAI2QITOM7tCXmU//86i9qIHqbzmT1LQw
-> ssh-ed25519 Nl/5yA Y+rlhRD1PNIUEZhdfgZTcWe8qY0SQe8V9OavljXjxQ8
oEbfC1+We251iuRBzQOFS0mb0QrPuP1184sqEq6J+As
-> ssh-ed25519 GdLgCQ 7s9Jz+QDMx/VCpauGudchhYmdozHi+Drk1FTJkCZIlQ
JpNnTmbMZuAq1t19usJeaFk/XWIvI/E6O2XYW9xk1lo
-> ssh-ed25519 tOH/HQ bQjSTr7z9m0FnCwcwVNvXb6q7b7N8waWzDz2ext7xQc
fkGOxszYZbvfEgKCf8h1bSFDdhTQudWahW5GaoRvKwU
-> ssh-ed25519 FpzvfQ WA8BXVcevPVZHqAQkcMuPygLD8qqFtNWU3tJYpwHMHo
BMemxjA6UjegYD2DK0wmOc0ULYukqyDsRBAFYDeG7lA
-> ssh-ed25519 2UotMw KYrj8o6902OrxXaJf1RFG8H5HIVeRKwaTBiL/aXbWlU
J3xUYx69EUnyZUbzeN7X/Eh/J2Spva/3hlemM5171j4
-> ssh-ed25519 kdPvzQ 4mJ/cUrhX8UQa9+tStk81pxyJZiKKEv8nA1S3YIWbxc
JAhwjDcn63KA56ArrgCfb8ImF4+gdYb2t37RDHzREC0
-> ssh-ed25519 onmXpg BaBbFKcLHhk2HmvWuC8oCv19H/gGplhQrYI3jhJSiC8
DffAJpgSSISvUe+fGjiV/0ZD7ilpRjVfylbBgmzvwu0
-> ssh-ed25519 CnhD0g 2pIX282qmM1TjcenouThl+EVDe7liSf48Xty52ryjzU
AdRqyALk3xZoG6Q26y3ueB6HgGBvojUfBmVVkI+/GoY
-> ssh-ed25519 4ep2UA xWUwvjYFMJhMtg4hS4D0FOpfs/yPFZkNdVv8xhQgGEE
tBCKF5X+gYNbCik4j9YVXKkPA8BVb/pywmmVPEByUDg
--- 38S1jD1FbeM20/LKFLWepHbatAh6Kyy+wKS+Ptz5qtw
Öþ­c$Kf”æ£ß�r%Vù]U¥�Šä#Þ¡2m’$c …ï÷ áév2Ü< 6LÖƒÏ- nteºPöÄ‘Ô³Ûªðn„¢”Ý+¤�3
secrets/gitea/webhookSecret.age
+36 -37
View File
@@ -1,38 +1,37 @@
age-encryption.org/v1
-> ssh-ed25519 8UnW5Q FRrvjiuNlnu4/DkwfY2K5p3MdQ5bDF3+u+JKrYiHzGw
9dGLw4PT4OapoTW2GnoJ85GEWgO3Aepj7hl0LpPZylk
-> ssh-ed25519 UFfTmg uMTPiCPPoVqt/3SOr+y5oKGTxpFq2UNGrwaRVmnZT1Q
Rn7dRYCGZwYN7sCmAsne6kAuKmD6CFlGXR130ELiJCA
-> ssh-ed25519 xNtnoA FW0dLFehc2yVvpxIDEcVWD1zHspZuvwrn2qgYltdp1Y
1zYm+LF/8lvfEhQVr4cbyDF5CfhPu/fNBYZMQLtTrqw
-> ssh-ed25519 aY2AXA aNRD8OIqKluKhHQZCGkW+kS71vlU2N8K6k590eLO7HM
PZHX6fqbX0U+55MtJ2iSur7TSHFEgQBiAgpXiGlHbuU
-> ssh-ed25519 AQhf1g cIhfdle1UsPx86LETXhB46evMenWtypO4GmL2/oLbXs
ezwVMUSz5KbBymwnZlKuLD7RbNBJigfkb4sOpHAAnBk
-> ssh-ed25519 r/3ipA Gt94r1I1CUMKrGQKBVgq/FLlOa7V3weD6N1rv/dVIV0
UsBIZfHiU17IjzhcKc1kvSEIMIk7I/DizSdBGhXNwqA
-> ssh-ed25519 mOmPfg b3/Gwqh1kik/AuBzcpqsuSuFcK0Pko3hRu32wFB/yks
X9AXKVJ3d0IV7wkV2ZibScIV9En9uJNyUIPIk7WFKb0
-> ssh-ed25519 YJiRbw yDkwCFtGXgS18DwqMCBied8+Jt8u2GBWuFQSrajij1s
eSeFTNbeOT/tDb9iQo/YzThtQeMgNYmEK61o8hjG43k
-> ssh-ed25519 Nl/5yA ee68eLzrRi35az65YmfA/WF9VliRmnlPEbGQAet91nw
2KdTnyBTyJu8q03eH5s4oRyvhTQ6f/qvwrLabvk3C3o
-> ssh-ed25519 GdLgCQ DAlJqI0uIBSrFpPMfl4FkrpjCO5qkzvJU/PBOWFh+XQ
S5tkvMrTrYbOK3U3wWxLn3MuJTfrP8vUIYe6nBpixQo
-> ssh-ed25519 tOH/HQ zQMhFkG/vkqosDn3VvzuKt4xagkUWoqE/DW6AsYtBGE
MGQA/Jxv/YTny5CyqfQBorfwIUVPZFf/hAcUTFrX9vk
-> ssh-ed25519 FpzvfQ d4cgnsFfo5xGDUFyT65HJ6S6vtzLmvB0eugwq6t0nGg
0hEFjipS1Jbp6xycUsZYHzcjQVJ22JlGMUsjPCkDfbI
-> ssh-ed25519 2UotMw C8ukSysPTKrwKCVnqjBzspXLLyJyhn2YCHcr1n0ulRg
NErsgu49C3ElHmpsz4q+zR/0Oj+9jBPnC0BErB/48Fc
-> ssh-ed25519 kdPvzQ oreOkf0nFgkgm5KuEjP28nbbqRZTA/b+bj7SSBmAslc
OrQ99MlWePEk5IVeoC/X4UYLhK10oTLFrS4KqzoVOE0
-> ssh-ed25519 onmXpg v8MQUHZj5sSu2XqiUH+8wcvEJmrGWQqs0e9evQKkzHw
ffZTIoH8stR+ZLhoz8GjvGG61xVbv4+VkHbd25Jyc/w
-> ssh-ed25519 CnhD0g Ja9KftQBH93zJAl8nOMQZXHbXIFIs9W4UqXwYr9gdDI
StRE03gMP6QQ+fCuhE1Q5ptCpBrUxrWINgCrWzwSqxo
-> ssh-ed25519 4ep2UA fbcuNM4FWkTOVSNSJGAwncdkjLN1K2Uv3dxFsnC60VU
uVbHhoO/IXfakiYFJ4yrtReK9uvYLsj4BTILRBqbRgk
--- dYPR49CT7omcJ7jDRNUAoc4t7az/pEg00aqPF00OlA4
„Ï¿Ÿ ðç(C›Ø
I'ð^¿mc¶bßH…¹«Cû�K␍0ýĉwé¯;lú¿P<üH㛬õI¿{àÈ|øª·ý Páy(Oì«81åÐß
-> ssh-ed25519 87huqg iZk0mtBXNJEHptCG6sm5Bre86Ittrbshc7mgBg8lHwA
YgWizpWE1BvU8p4A2nnVM+KEW+pP/VQfeXNyn2C+RkY
-> ssh-ed25519 8UnW5Q rWJlpARVcYaUwReRg3WP0Lo5EK1WHXnDF281NfRCTh0
6JMBB4BVRxh4irXU5jR7NEtGgHUKEnATl05kPLkIJVk
-> ssh-ed25519 UFfTmg r5QfXMP2yX1sT5/NSZOk81uKuUD2gHKCJ00OUfMstxg
9vQme3i/ip6BdyWXSqKf9KtBciD/xWnlTfU5bF9n6KM
-> ssh-ed25519 xNtnoA kiD+2ao6nBdkn3Us43lwCK4FMTWUX83AXZTdNS2ct1k
BQaO2/DuYW42uSRu9XLz8A3N7H1H3LZk8kz1Za12qTk
-> ssh-ed25519 aY2AXA cG0+CVmbBoR3El6TwvwrJhHbuLKpO0FNLMQQuAMU5XA
uedc7XXzPp1q877M4Kb2AfGAafp2unNIB8Hz/15hSbg
-> ssh-ed25519 AQhf1g ZIT944IUaACBEPFVv0/Q3Era9425gfYPDHTKQDFj0TA
nJsuyOXfhNqejnljvd07tiGAH/6cVebb8N9op+yUkaQ
-> ssh-ed25519 mOmPfg O+i/JqV2MSpDtjq2fGYsZk4cGe4mY1IMxfFiVsZX8FE
mqjMKCEPYrP9T5QvrPgrqpuQj90syD5Nly3xcZzlu+s
-> ssh-ed25519 YJiRbw cww2VvvXfFmWdspOqp0fYNizYF5gOJoWo2z0cmc2Q3E
t746Geby8GdPXb4G6PSnYWxAYHhwEygAy2kWOTNlQSE
-> ssh-ed25519 Nl/5yA /sbUMK+/aNe604RdYYGhC76NUAUV0zWC/d/BOFUMdDE
UYGmy1Cq4aZCJ6XghmqJVgCI+Q50NXKzVTbDV0cwCVo
-> ssh-ed25519 GdLgCQ 7DVn9soiWBMSoWH8s0vJh9CxTnOGqwT1kCD2kKJffXo
1S3yC99Gp7im+ntDy5BF6Gbja0qI1iAcbBnUGBOdG2U
-> ssh-ed25519 tOH/HQ HjMJb09INVPg9p6eFWDq0x6aXxtv3e9WHns/b9dRq1w
rol+78bs1kWGNNT9uGgpyhLo8Qg2KFZOZNV40o9ngjI
-> ssh-ed25519 FpzvfQ DYtu2GOhQMVefKgpFzGsUwQE93AABG7o7zlYBx4Sax0
p9aaahOTOcwTwJh887brzzAz0K9eM1Q2okGwS6wcPWA
-> ssh-ed25519 2UotMw XrenSoEXsC9g8pF+nIYu3/mEEE92h9NsjQlMHWf9RVo
c3GnMhYdVXnTZ4zBpp+ZOL47i4iQ7PKKreWCrLz1JC4
-> ssh-ed25519 kdPvzQ wKe++MlxxvHTN1fogMxxO/Ek8ytLnUY4rS3/TGwYun0
yERY9pzUSb7/YSkVPuhX9fJ6SHFZhgBztvx42wRU9i0
-> ssh-ed25519 onmXpg fccql4vrSXq2rmGNJAwNmnXXj/6rMp9rQL2/T19AeAs
41pFfrrmas1ttzD/wpQjJIbzgi27p80hJtuyXhpwE+4
-> ssh-ed25519 CnhD0g cgwxIxMn6IFqHIaFhTrN1ycr9d4B+sSVcLZeiHaVn28
WFaOrcE8RuxatVGWCU+EAYTOZmks9bfKTme7s7VrDpM
-> ssh-ed25519 4ep2UA zStnhLrVw1+BNhOd+LQ1euusmCQnyQx7/ukUSgEs10w
NDzx2fwKDs+of+62Gj9dE3l1+Wh0aVQAfjXPjYFjVc8
--- 63bVjaHZOWE+1hpG5yDQN8vMspyOOfw3NnXLCYSL3eE
Ú![„•j-C3[ä‡æª0µj gÄ Ñ³ª‚È(Lv¹•Õ¬›Øþá2Eý+qæ%ª�ѹP­ÃŒíËÑL�s;3˜ù,³7]\¯–
secrets/gitea/workerPassword.age
+37 -36
View File
@@ -1,37 +1,38 @@
age-encryption.org/v1
-> ssh-ed25519 8UnW5Q mCwgPdwCWzi8QXME7vc1nncnCjUdhXJfHgz5CI2ppWI
rnBpIQ9WYgFs65Rh4eMICoesrg76o46AjmtY9fTbCl4
-> ssh-ed25519 UFfTmg EW1P9WRcH6esoNH098Vj4E+udGzKWYw+HkxaHcRpF3M
t3AsT1kOCeDbpYotmYAFQA5/k0NA9KJ+R1DRnbLX63c
-> ssh-ed25519 xNtnoA shOVkNxHyvKcLRYAAIW1C6UPAGiwxZl0Y7i73DkA3j0
MgFo9Gy+24rWvIkqQKDogakf4q1nE+MTdmXg2nYMNR0
-> ssh-ed25519 aY2AXA dXi7BYpOVSGbbxI5KOQkElq0GQj3vmbU8AA9rzqGIE0
GlpXrUk11XX6zirXrTK3uIhLBwlTKwn4/cyCWjPBVTE
-> ssh-ed25519 AQhf1g qV41Qx3onxW0Z91xCiUwse51OoEU7tBAi9t6MrwF8Fw
rFXGO8JG1HE916LMS8xMLACVqHuQzP/SAgM5Ngi9tLQ
-> ssh-ed25519 r/3ipA u1cHvRRt6JrScsmCY6PtybjU80VuU7NuRwtBW+Omc28
ztXCVbWHTMBY/x6dDdSSPQmTWfLCGNG7xkYBtupKRQ0
-> ssh-ed25519 mOmPfg jCT547k33Dxx8nTS/WVe+Peo1eViKVSjLumucXempBc
X2SCtafedtleUTQoYtKN/85uUnWS3kuY9Bb90xHXXBM
-> ssh-ed25519 YJiRbw j16MQ20JnMktKiREpNRx5qed8jXXKCAq+8b5AvkW0gM
KovMsW55OvGyjSJuAN5M0Ga7ln0TOQoQEQKvCkODJJs
-> ssh-ed25519 Nl/5yA oYGAT0greb0CHjptVKt1vPBhBX1KXsJAVlU4WoV0vjo
SI4ZXY4pHqYEn2AKEX7MpcYT71LsVUGiZQd0LmwGywY
-> ssh-ed25519 GdLgCQ rEB3gHJ+MovVDQsQd3X4pGI03itwoUGeHg7aCQ9oUms
mAVXvwQqslqP4sm7uG9LXfNvD0XtnaB5W37esGyRsgU
-> ssh-ed25519 tOH/HQ XPExYlY9j8DKCZwviAAgSvJ2+xpx3lUBsktfMPwo8U4
v2PV6wtTTQINJ2XfCcA/0OpNkOHr4AER3lG73CJL7J8
-> ssh-ed25519 FpzvfQ RRpPZ5GIdzvRimAXe1ybhxs+lV+SSigyyvEn3qmkOUg
z7QV/M3zO3tnOO3XiabL62w7Uphs9OxARpGbND1tm1I
-> ssh-ed25519 2UotMw JfTnR9wed+1B9Hung4FdV3Zvx8eQ+lrweFiFrhX8B2g
k2KYxpsSoTBaHuXCCl5fBgn/jyi4KDKvg2QShU0Awpc
-> ssh-ed25519 kdPvzQ GrUGPXTVNTMafGGfn2xA5pTIBEnEfSKmDtQ+W/QYpUU
eDNGzwGWhnZ2kLXzDLVWJNvl6F6vZBTFZ16zrh87bxY
-> ssh-ed25519 onmXpg LiArSCT2VCCbEE02Q9n6fsWP1VtYL7OcahnM7CJyywU
LUKTMk2IAFpg7mPpHjBBw8NbpbgpDGnH9FCvjuF9qBw
-> ssh-ed25519 CnhD0g H2M/9h954AS4ROeJFDfOpwU2DsACwQ/20OdGVaeGxxE
tSMsZUT079DdPhW1yvFbk4DBlNd6Lvhk4SAarFjYfpY
-> ssh-ed25519 4ep2UA /FZ8+q7M90Iug7/qUkpmyL3uhUz2WTBSoc2O719JhBs
y0dpaERxrnygXbDhp6v/rIZsoKx7kv/aQI667jt+/t8
--- K04yLmYsJIXBing2v+tijM5K1vOLQy0hWu7TItk3xCM
‡t �Hëw’÷ìgn$c\ÑØG >T¤b Ã,z¿ì|~u§Dhs±KP©íÜ0c‹ªŒ–÷ÙþÔ{™­w`ZªPODmüxOägƒ+FäCH
-> ssh-ed25519 87huqg 9bSltGjltla8XkrCzhfU6yqy/Kb73jHmaaxpgE/mYjc
q+UwMDloa3ud2r09prz5/nsIF98LI9xDqnxW12GPx0k
-> ssh-ed25519 8UnW5Q MjKIEX54pROJm4wMTQFP9vc1uhz/gN81zyy69zQA2A8
B71KLdMEXUgyD1lg1nyJPXnZXxDSKyvRb0BBOMN/y6E
-> ssh-ed25519 UFfTmg fk/DRRcki6qQf/TnwBA+FIgLVdrYdktLR9yf9r/82Uc
PUpzNkavVk/VfO8X+mb2IfKrseA1yJJ6xNnap9W+FUM
-> ssh-ed25519 xNtnoA 8wXxop/HSkpNJe2W+Lq6J1dPLk8P1w75xHKUxUjv918
may0BdqkiYxgaUGxv80Udz+UVCI/+pFgzlCZetEzLoY
-> ssh-ed25519 aY2AXA /GeX9PATA0svXJ2cq7IIoWAx+Jap36OYFFw52mbtZ3A
BEOqSa4F8PVxGkVT4lSsP8FiloINw4mEjtZ+Dq6u9Kw
-> ssh-ed25519 AQhf1g URV4/G7uUPxZNpP09qyS6Tok7KlcfjYCGqEGftwkM3o
+l4j3tVMj8TcCE7KobympPIv3fRlLu7UGnZFeNZP4xY
-> ssh-ed25519 mOmPfg NoIRVRE3P4/nnerdYsAw+S9csK6NB+AhnjYQj7NZZk0
GUuYluAhGcuiIfB6oh9rvfcd1Trhb/Jeyb7FAz4Plcs
-> ssh-ed25519 YJiRbw n3/TMqijUG2LdAsqrq13Jelw4hEenbjMu70YknGrtCE
LCfUQDnpe2a7dD5YOKcteXQ4K8FyZNQ1gZi1GPkuCYs
-> ssh-ed25519 Nl/5yA W0IMc+9Mpjehqib77k1LLeUoKSp8QwJkz0aEfAttMTo
0yrHlLQR3g5JGAuICMYQ8UBQ1SEdkPCiVq/j4PBLm+I
-> ssh-ed25519 GdLgCQ W1evgMNEDrmT5cgqRPK7NsTde8igIIiYbjRPBu38WSw
5gDQVJxEcChyAGak31Qh70eFjOu3z4iLXZejBRXjUwo
-> ssh-ed25519 tOH/HQ iGA0Bf0Moa6UsXC484hFHp+4by41o8QhjsrCtnlnjDw
YELtzO3zBhul4CCPdSaOm5KctPAoU1y27Jgfrs1H7KU
-> ssh-ed25519 FpzvfQ LcehUBu0dDyGfYKqbdfxS7d6aTtYTgpokG+GWHnjtzI
6Rcos5SJmbUXXtMFqge/CRUb4RVYaHrt/H9V9tprBxQ
-> ssh-ed25519 2UotMw Az0wVK6RPjD6Mm5H+gvCZDRuNbHFmuVXRGMKBgL1SAY
hf/DmLzyPoMQIYoV1A7CEifAdKQD8nOy7kWfpiJnuN0
-> ssh-ed25519 kdPvzQ mP9FISgXfkj1Vflxun3bgnlwwqLFhL/RI7knX+Qpml4
ax99X2ePfqnYIsA3knPz19lcEv35pTF3YgEAI7FI/Xo
-> ssh-ed25519 onmXpg 1Hg7Hf+HW28fBH4fMvrNUAd1XwiLOFGDQ7Tscqn7UzM
Cr1Y/Z60BwLm9b7GA94QnlNBwgmUqe8X8ksAZMHcgCk
-> ssh-ed25519 CnhD0g TR6lw5KiTVLkgoErQMMTbgDAhV/Vdka35izHR5SJIjI
EJs5EOZlprrfpQfpJgE4//VI3bAWE/OPV6bNOF7O3s4
-> ssh-ed25519 4ep2UA pSDKM7BZFXY+6BAfJYTar/eZ2eE2U18iFGdfmb7xPzo
0Og+gnsiBQcoCJzLIDSfTLRbnPf9ZqF62HKbtNcknrI
--- 8adV1z73QFaTnpZABU9wkK/QfvnFdsVamSgndB6aGx4
\!Ïç>ín;¥.\¿±¹üÆB�sC Ò#é!)D}ÆPx ï`
O±zø�CÙFB¾tèÞÝnë½vÂßÇxÊŸ÷صÿ @²8+Ê
secrets/grafana-api-token.age
BIN
View File
Binary file not shown.

Some files were not shown because too many files have changed in this diff Show More