From 530268bf8e9cfe3fabd2073e8b8381a7eaad10bb Mon Sep 17 00:00:00 2001 From: Ethan Turkeltaub Date: Fri, 11 Sep 2026 22:11:52 -0400 Subject: [PATCH 1/4] Replace `bastion` with `gateway` (on Hetzner) --- .sops.yaml | 2 + deploy/terraform/.terraform.lock.hcl | 41 ++ deploy/terraform/configuration.tf | 4 + deploy/terraform/dns.tf | 64 ++- deploy/terraform/keys.tf | 5 + deploy/terraform/networking.tf | 12 + deploy/terraform/providers.tf | 5 + deploy/terraform/servers.tf | 45 ++ deploy/terraform/vms.tf | 8 +- hosts/bastion/profiles/authelia/default.nix | 7 - hosts/bastion/profiles/authelia/secrets.yml | 139 +++--- hosts/bastion/profiles/caddy/secrets.yml | 139 +++--- hosts/default.nix | 1 + hosts/gateway/configuration.nix | 26 ++ hosts/gateway/disk-config.nix | 37 ++ hosts/gateway/hardware-configuration.nix | 1 + hosts/gateway/profiles/authelia/default.nix | 403 ++++++++++++++++++ hosts/gateway/profiles/authelia/secrets.yml | 138 ++++++ hosts/gateway/profiles/caddy/default.nix | 351 +++++++++++++++ hosts/gateway/profiles/caddy/secrets.yml | 135 ++++++ hosts/monitor/profiles/authelia/secrets.yml | 139 +++--- hosts/monitor/profiles/grafana/secrets.yml | 139 +++--- .../profiles/healthchecks/secrets.json | 30 +- modules/nixos/deployment/options.nix | 1 + .../profiles/applications/umami/secrets.json | 30 +- .../profiles/backups/restic-rest/secrets.yml | 139 +++--- modules/profiles/backups/restic/secrets.yml | 139 +++--- .../grafana-to-ntfy/secrets.yml | 139 +++--- .../communications/mosquitto/secrets.json | 30 +- .../profiles/communications/ntfy/secrets.json | 30 +- .../communications/postfix/secrets.yml | 139 +++--- .../home-automation/frigate/secrets.json | 30 +- .../home-assistant/secrets.json | 30 +- .../media-management/bazarr/secrets.yml | 139 +++--- .../media-management/immich/secrets.yml | 139 +++--- .../media-management/profilarr/secrets.json | 30 +- .../media-management/prowlarr/secrets.json | 30 +- .../media-management/sabnzbd/secrets.yml | 139 +++--- .../media-management/tracearr/secrets.yml | 139 +++--- .../monitoring/healthchecks/secrets.json | 30 +- modules/profiles/monitoring/loki/secrets.yml | 139 +++--- .../profiles/monitoring/thanos/secrets.yml | 139 +++--- .../networking/speedtest-tracker/secrets.json | 30 +- .../networking/tailscale/secrets.json | 30 +- .../profiles/nix/remote-builders/secrets.yml | 139 +++--- .../profiles/observability/gatus/secrets.json | 30 +- modules/profiles/power/secrets.yml | 139 +++--- modules/profiles/remote-builder/secrets.yml | 139 +++--- modules/profiles/secrets/aws/secrets.json | 30 +- modules/profiles/secrets/radarr/secrets.json | 30 +- modules/profiles/secrets/sonarr/secrets.json | 30 +- .../profiles/security/authelia/secrets.json | 30 +- modules/profiles/security/lldap/secrets.yml | 139 +++--- .../services/attic-watch-store/secrets.yml | 139 +++--- modules/profiles/services/atticd/secrets.yml | 139 +++--- .../services/cachix-watch-store/secrets.json | 30 +- .../profiles/services/karakeep/secrets.json | 30 +- .../profiles/services/miniflux/secrets.yml | 139 +++--- modules/profiles/services/netbox/secrets.json | 30 +- .../profiles/services/opencloud/secrets.json | 30 +- .../profiles/services/paperless/secrets.yml | 139 +++--- .../prometheus-plex-exporter/secrets.json | 30 +- .../prometheus-pve-exporter/secrets.yml | 139 +++--- .../profiles/telemetry/unpoller/secrets.json | 30 +- secrets.json | 37 +- 65 files changed, 3352 insertions(+), 1828 deletions(-) create mode 100644 deploy/terraform/servers.tf create mode 100644 hosts/gateway/configuration.nix create mode 100644 hosts/gateway/disk-config.nix create mode 100644 hosts/gateway/hardware-configuration.nix create mode 100644 hosts/gateway/profiles/authelia/default.nix create mode 100644 hosts/gateway/profiles/authelia/secrets.yml create mode 100644 hosts/gateway/profiles/caddy/default.nix create mode 100644 hosts/gateway/profiles/caddy/secrets.yml diff --git a/.sops.yaml b/.sops.yaml index 25be571a..5305d545 100644 --- a/.sops.yaml +++ b/.sops.yaml @@ -12,6 +12,7 @@ keys: - &host_nut_network age10q5gqw4gwts228ayanvalq7c93peqjdsfqcgevd7qr43u5rhnczs9u2ysj - &host_nut_homelab age1hxynjkmtgcu9lwejchkjfqjp484at589sznqkxk6weucp37p4p7qaj440h - &host_whirlwind age1dtf3ahstj5mhzcqf4d2zc54d5dds69ka32dqpmpsskyaz04dtshq9ryxat + - &host_gateway age1px3aq87zcjgts5guc59fqn64zjkqzukdwce4a0ggza83n3atkcws4h5aww creation_rules: - path_regex: '^.*secrets\.(json|yml)' @@ -30,3 +31,4 @@ creation_rules: - *host_nut_network - *host_nut_homelab - *host_whirlwind + - *host_gateway diff --git a/deploy/terraform/.terraform.lock.hcl b/deploy/terraform/.terraform.lock.hcl index 1c139398..ec1e7d55 100644 --- a/deploy/terraform/.terraform.lock.hcl +++ b/deploy/terraform/.terraform.lock.hcl @@ -82,6 +82,26 @@ provider "registry.terraform.io/hashicorp/local" { ] } +provider "registry.terraform.io/hashicorp/null" { + version = "3.3.2" + hashes = [ + "h1:/Wbz7DHFO92KAqyDBMxGA8nwOJYECM8iLGhR7+wVWhQ=", + "zh:10ec43b8b7b18d5639238c7fb9e111f6a4b038523dd66c7a426bf27b25fa4c08", + "zh:60beb9cc2ad5b871c710860cee75b42850cc6acd43db0d77cb5e00fda7288b55", + "zh:62538582d0a4a2f10ad8a8d9a6c3cd3f05af6c6d91c6641ffc78d4f0e8e69b27", + "zh:64a8f9ce7852d9efc5b464c12306c946366d59f5e2757def97969c9fd64bd1d6", + "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3", + "zh:92a374fb736a52f465283326d0a5bf4f495132eb99be209dfb4c75ec803fe8db", + "zh:98da9c42785d27a50f0604758bcb61a30f6278b9f2acd92bb3b2046e0e71916c", + "zh:b0f7896fae554729cdf4a24ac06359a050cff5817e6cd8597cba8a4ae01a7409", + "zh:bc8179ee35d67c72fb03012e7023b9f9816f033a7ec4109c001dd6d29752e812", + "zh:d23a598f713bfb6098bc003571d7de90b5a33b78f9be240488252fe5f3c2a60d", + "zh:d2855b922ea345dbd89ea287e4c6c4757e38bc0aaffeb2b79aa0b8004f9c53ff", + "zh:d3a60422bc6a2f9244d076c5222c07060c826ef91bdbaf4634cb752b86057473", + "zh:faa01928c25d2a6ecd9c7eb8b88134cb08de55a6b11ca6c703ac0092845344ba", + ] +} + provider "registry.terraform.io/hashicorp/tls" { version = "4.3.0" constraints = "4.3.0" @@ -103,6 +123,27 @@ provider "registry.terraform.io/hashicorp/tls" { ] } +provider "registry.terraform.io/hetznercloud/hcloud" { + version = "1.68.0" + constraints = "1.68.0" + hashes = [ + "h1:2MU8gDe67KjqALpvzzRfWONH2c/8djL+yxTnym9/FjY=", + "zh:0c3c2eb5bad6e2853da46dd83ed9c93c547b79f2abe977d492da9cf9d7236a62", + "zh:0ccae6bb2daee7c30b55672645b31c50920839a8aadac502d187f105352c1b37", + "zh:11559d821030e5f4657b81153419f3c5e4f6389e8cc6f8086db2ebeb7aade6bc", + "zh:164012cca257951da2870e9a0a0eb0be2ebde26fd27e30081c8d7e8729467a6e", + "zh:1fc7fea548dc8a0211ee832b0f1be489301f431cdfb153effd2fda7f63c02073", + "zh:73855025066ec55230559296b5c92d441b1b6dc2ce27a1102ab1e17f60cdcf0e", + "zh:78bfcca5d613f3285c2e326e92865d08e24d0574e29201ce9c1df612aa912a10", + "zh:84d6972ef2d6e03dc416ab34c8e266e0958ff390c7ad87761180706658b31614", + "zh:a04f8e12811e000657151cd6eed5eb80ae1042b8123bfea28343147ceda40f96", + "zh:b825f6500592d30004b6de8547ca1fa7841e16da0571cee8a67782cb84ec65cd", + "zh:d6bc5f6f27453248889e5df967111a187405f1434175a90221853226d47484af", + "zh:e052ad7a40cf1f63588c2b435ce7a9baca5ef0e1f9dcb321a06756eb3d38751a", + "zh:ea1497399246a51f16e3ff4a13dfba4c95a49997c2da7850703a086e211b7435", + ] +} + provider "registry.terraform.io/issyl0/improvmx" { version = "0.7.1" hashes = [ diff --git a/deploy/terraform/configuration.tf b/deploy/terraform/configuration.tf index b361c086..6fc78961 100644 --- a/deploy/terraform/configuration.tf +++ b/deploy/terraform/configuration.tf @@ -70,3 +70,7 @@ provider "porkbun" { api_key = data.sops_file.secrets.data["PORKBUN_API_KEY"] secret_api_key = data.sops_file.secrets.data["PORKBUN_API_SECRET"] } + +provider "hcloud" { + token = data.sops_file.secrets.data["HETZNER_API_TOKEN"] +} diff --git a/deploy/terraform/dns.tf b/deploy/terraform/dns.tf index 874a7a26..e6dce914 100644 --- a/deploy/terraform/dns.tf +++ b/deploy/terraform/dns.tf @@ -18,7 +18,7 @@ resource "aws_route53_record" "root_e10_video" { name = "e10.video" type = "A" ttl = 300 - records = [aws_eip.bastion.public_ip] + records = [hcloud_server.gateway.ipv4_address] } resource "aws_route53_record" "status_e10_video" { @@ -34,7 +34,7 @@ resource "aws_route53_record" "wildcard_e10_video" { name = "*.e10.video" type = "A" ttl = 300 - records = [aws_eip.bastion.public_ip] + records = [hcloud_server.gateway.ipv4_address] } resource "aws_route53_record" "em824837_e10_video" { @@ -81,7 +81,7 @@ resource "aws_route53_record" "root_e10_land" { name = "e10.land" type = "A" ttl = 300 - records = [aws_eip.bastion.public_ip] + records = [hcloud_server.gateway.ipv4_address] } resource "aws_route53_record" "wildcard_e10_land" { @@ -89,7 +89,7 @@ resource "aws_route53_record" "wildcard_e10_land" { name = "*.e10.land" type = "A" ttl = 300 - records = [aws_eip.bastion.public_ip] + records = [hcloud_server.gateway.ipv4_address] } # e10.camp @@ -111,8 +111,8 @@ resource "aws_route53_record" "root_e10_camp" { zone_id = aws_route53_zone.e10_camp.zone_id name = "e10.camp" type = "A" - ttl = 300 - records = [aws_eip.bastion.public_ip] + ttl = 60 + records = [hcloud_server.gateway.ipv4_address] } resource "aws_route53_record" "bastion_e10_camp" { @@ -123,11 +123,19 @@ resource "aws_route53_record" "bastion_e10_camp" { records = [aws_eip.bastion.public_ip] } +resource "aws_route53_record" "gateway_e10_camp" { + zone_id = aws_route53_zone.e10_camp.zone_id + name = "gateway.e10.camp" + type = "A" + ttl = 300 + records = [hcloud_server.gateway.ipv4_address] +} + resource "aws_route53_record" "monitor_e10_camp" { zone_id = aws_route53_zone.e10_camp.zone_id name = "monitor.e10.camp" type = "A" - ttl = 300 + ttl = 60 records = [aws_eip.monitor.public_ip] } @@ -135,7 +143,7 @@ resource "aws_route53_record" "grafana_e10_camp" { zone_id = aws_route53_zone.e10_camp.zone_id name = "grafana.e10.camp" type = "A" - ttl = 300 + ttl = 60 records = [aws_eip.monitor.public_ip] } @@ -143,7 +151,7 @@ resource "aws_route53_record" "status_e10_camp" { zone_id = aws_route53_zone.e10_camp.zone_id name = "status.e10.camp" type = "A" - ttl = 300 + ttl = 60 records = [aws_eip.monitor.public_ip] } @@ -151,7 +159,7 @@ resource "aws_route53_record" "ntfy_e10_camp" { zone_id = aws_route53_zone.e10_camp.zone_id name = "ntfy.e10.camp" type = "A" - ttl = 300 + ttl = 60 records = [aws_eip.monitor.public_ip] } @@ -159,7 +167,7 @@ resource "aws_route53_record" "healthchecks_e10_camp" { zone_id = aws_route53_zone.e10_camp.zone_id name = "healthchecks.e10.camp" type = "A" - ttl = 300 + ttl = 60 records = [aws_eip.monitor.public_ip] } @@ -167,8 +175,8 @@ resource "aws_route53_record" "wildcard_e10_camp" { zone_id = aws_route53_zone.e10_camp.zone_id name = "*.e10.camp" type = "A" - ttl = 300 - records = [aws_eip.bastion.public_ip] + ttl = 60 + records = [hcloud_server.gateway.ipv4_address] } resource "aws_route53_record" "em824837_e10_camp" { @@ -176,7 +184,7 @@ resource "aws_route53_record" "em824837_e10_camp" { name = "em824837.e10.camp" type = "CNAME" records = ["return.smtp2go.net"] - ttl = 300 + ttl = 60 } resource "aws_route53_record" "s824837_domainkey_e10_camp" { @@ -184,7 +192,7 @@ resource "aws_route53_record" "s824837_domainkey_e10_camp" { name = "s824837._domainkey.e10.camp" type = "CNAME" records = ["dkim.smtp2go.net"] - ttl = 300 + ttl = 60 } resource "aws_route53_record" "link_email_e10_camp" { @@ -192,7 +200,7 @@ resource "aws_route53_record" "link_email_e10_camp" { name = "link.email.e10.camp" type = "CNAME" records = ["track.smtp2go.net"] - ttl = 300 + ttl = 60 } resource "aws_route53_record" "auth_monitor_e10_camp" { @@ -200,7 +208,7 @@ resource "aws_route53_record" "auth_monitor_e10_camp" { name = "auth.monitor.e10.camp" type = "A" records = [aws_eip.monitor.public_ip] - ttl = 300 + ttl = 60 } # satan.network @@ -223,7 +231,7 @@ resource "aws_route53_record" "unifi_satan_network" { name = "unifi.satan.network" type = "A" ttl = 300 - records = [aws_eip.bastion.public_ip] + records = [hcloud_server.gateway.ipv4_address] } # e10.network @@ -246,7 +254,7 @@ resource "aws_route53_record" "root_e10_network" { name = "e10.network" type = "A" ttl = 300 - records = [aws_eip.bastion.public_ip] + records = [hcloud_server.gateway.ipv4_address] } resource "aws_route53_record" "wildcard_e10_network" { @@ -254,7 +262,7 @@ resource "aws_route53_record" "wildcard_e10_network" { name = "*.e10.network" type = "A" ttl = 300 - records = [aws_eip.bastion.public_ip] + records = [hcloud_server.gateway.ipv4_address] } # turkeltaub.me @@ -413,6 +421,22 @@ resource "aws_route53_zone" "e10_computer" { name = "e10.computer" } +resource "aws_route53_record" "root_e10_computer" { + zone_id = aws_route53_zone.e10_computer.zone_id + name = "e10.computer" + type = "A" + ttl = 300 + records = [hcloud_server.gateway.ipv4_address] +} + +resource "aws_route53_record" "wildcard_e10_computer" { + zone_id = aws_route53_zone.e10_computer.zone_id + name = "*.e10.computer" + type = "A" + ttl = 300 + records = [hcloud_server.gateway.ipv4_address] +} + resource "porkbun_nameservers" "e10_computer" { domain = "e10.computer" nameservers = sort(aws_route53_zone.e10_computer.name_servers) diff --git a/deploy/terraform/keys.tf b/deploy/terraform/keys.tf index 637e50a5..c796aed8 100644 --- a/deploy/terraform/keys.tf +++ b/deploy/terraform/keys.tf @@ -50,3 +50,8 @@ resource "local_sensitive_file" "rsync_net_public_key" { filename = "${path.module}/../../keys/rsync_net_rsa.pub" file_permission = "0600" } + +resource "hcloud_ssh_key" "deploy" { + name = "deploy" + public_key = file("${path.module}/../../keys/id_rsa.pub") +} diff --git a/deploy/terraform/networking.tf b/deploy/terraform/networking.tf index 4cbd9562..5be63a26 100644 --- a/deploy/terraform/networking.tf +++ b/deploy/terraform/networking.tf @@ -41,3 +41,15 @@ resource "aws_eip" "monitor" { depends_on = [aws_internet_gateway.igw] } + +resource "hcloud_network" "private_network" { + name = "private-network" + ip_range = "172.16.0.0/16" +} + +resource "hcloud_network_subnet" "default_private_network_subnet" { + type = "cloud" + network_id = hcloud_network.private_network.id + network_zone = "us-east" + ip_range = "172.16.1.0/24" +} diff --git a/deploy/terraform/providers.tf b/deploy/terraform/providers.tf index 4d346412..ad8d9f87 100644 --- a/deploy/terraform/providers.tf +++ b/deploy/terraform/providers.tf @@ -41,5 +41,10 @@ terraform { source = "kyswtn/porkbun" version = "0.1.3" } + + hcloud = { + source = "hetznercloud/hcloud" + version = "1.68.0" + } } } diff --git a/deploy/terraform/servers.tf b/deploy/terraform/servers.tf new file mode 100644 index 00000000..d1f6474a --- /dev/null +++ b/deploy/terraform/servers.tf @@ -0,0 +1,45 @@ +resource "hcloud_server" "gateway" { + name = "gateway" + + server_type = "cpx11" + + location = "ash" + + image = "debian-12" + + ssh_keys = [hcloud_ssh_key.deploy.id] + backups = false + + public_net { + ipv4_enabled = true + ipv6_enabled = true + } + + network { + network_id = hcloud_network.private_network.id + ip = "172.16.1.10" + } + + lifecycle { + ignore_changes = [ssh_keys, image] + } + + depends_on = [hcloud_network_subnet.default_private_network_subnet] +} + +module "gateway_install" { + source = "github.com/numtide/nixos-anywhere//terraform/install" + + flake = "${abspath("${path.root}/../..")}#gateway" + + target_host = hcloud_server.gateway.ipv4_address + target_user = "root" + + instance_id = hcloud_server.gateway.id + + ssh_private_key = tls_private_key.deploy_key.private_key_openssh + + phases = ["kexec", "disko", "install", "reboot"] + + build_on_remote = false +} diff --git a/deploy/terraform/vms.tf b/deploy/terraform/vms.tf index 2b2489c2..199a9072 100644 --- a/deploy/terraform/vms.tf +++ b/deploy/terraform/vms.tf @@ -40,9 +40,9 @@ resource "proxmox_virtual_environment_vm" "omnibus" { queues = 4 } - serial_device { - device = "socket" - } + # serial_device { + # device = "socket" + # } agent { enabled = true @@ -136,7 +136,7 @@ resource "proxmox_virtual_environment_vm" "htpc" { file_format = "raw" interface = "scsi0" size = 2048 - ssd = false + ssd = true cache = "writeback" } diff --git a/hosts/bastion/profiles/authelia/default.nix b/hosts/bastion/profiles/authelia/default.nix index ef93e9e7..0cd43281 100644 --- a/hosts/bastion/profiles/authelia/default.nix +++ b/hosts/bastion/profiles/authelia/default.nix @@ -48,9 +48,6 @@ }; identity_providers.oidc = { - # OpenCloud's web UI is a browser-side OIDC client, so it exchanges the - # authorization code from `cloud.e10.camp` via `fetch`. Authelia sends no - # CORS headers on these endpoints unless they are opted in here. cors = { endpoints = [ "authorization" @@ -62,10 +59,6 @@ allowed_origins = [ "https://cloud.e10.camp" ]; }; - # OpenCloud maps roles from the `groups` claim and has no fallback: a user - # in neither group authenticates fine and then gets a 500 with "no roles in - # user claims". Deny them here instead, so they get Authelia's access-denied - # page rather than a broken OpenCloud. Flat `subject` lists are OR'd. authorization_policies = { opencloud = { default_policy = "deny"; diff --git a/hosts/bastion/profiles/authelia/secrets.yml b/hosts/bastion/profiles/authelia/secrets.yml index 0568ac74..399913f9 100644 --- a/hosts/bastion/profiles/authelia/secrets.yml +++ b/hosts/bastion/profiles/authelia/secrets.yml @@ -8,121 +8,130 @@ sops: age: - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArTkNKek9wd05YZTNYZ0F3 - eElVUHM4a1I1aUR3MVRzRXNrOCszYlFTZDNnCnFpWTVsczhQVDg0N1B3bGJsM0xu - VjFzNGFLQ2ljSjRSSThEaTBIU21PWUEKLS0tIFNDL1JEVzZxN2FPejRPUk9YOGJa - dFZGQllEL1NuK1g0eEN5cmpTczhMV0EKI3kDhw5SPp4unxVefrsfE6DfAzpEVMcN - cw0/cL2cdv3wp1Cprk10QUkBIGcW7nNAiGNqmGMI5r5sDzWjFXpJOg== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHRTdHcTlPdmRWSFllVVRG + UnF2cGtMQmxia1VXSHgvMnQvK1gvWkp2SkFzCklSVkd4SzVsOHBWSGlnMTlGdWh1 + U0lyVHJiL0lyQkU2R0ppK2k1S3FFK2cKLS0tIHVJN0lqZEwrTVNXc0UwOEFSK2Fz + RTVvN2FUanpKY2tVb1JlLzFlb2JhUVkKTSB3Y8g8olY/Xt8aC+ik10CQ7b5h/hOI + IDYUZwkWzcAvL6kDgBO4oLETawkFHY+RNaynEESHuAqcJTCB2MDWUA== -----END AGE ENCRYPTED FILE----- recipient: age10539mc6shf02hpa8huyjktdw3nfyavxdg8pt247wwvq4xrv8h5zs8nc0k0 - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjd0JEMkgyd1ozZW45aDFZ - QzliQnRBTTZqMitUYTliYWlqUzdySkh1V20wCmg3OTEvTXZGTnUraTVEeDJLVUM4 - Wm0yNFlVV1cwMS9nSDZNRlhXWlN2WW8KLS0tIEg4US9EeFNZZ0Z0VHF6UGNBQXRO - V09ISUZlTnBCc3pqL1pXNTdLODh4NFUKxzQEs8F8quFLDA/vkmZQoBweOxhi7ep6 - Bvt0pOaGIJq/aXGKTtDQYm/Pzgqar0VEU+EoPdY9XxzsT3kArUmXeg== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2ZHdsR0Q5MC9aREVKcXVS + eGRJVWdCMFZFai8zWEF1dlhWS1NBY3I1UVI0CmR5ZTZaOXFTOUFDYlE0V25PeDJO + ck1QRWM0WGl4eGY5SUZqSDZ1ZGpnNGcKLS0tIFFCQ05BUUU3d0s0SFU2R3RjalJS + VS9tcEErbi83d24rdTJ5N3dwZmRKNkUKZIusjiQ1usXsdY8shYuXp2Wp0dCRHCVM + 48B8YUFIkGtfwsfNbXHLWSTWuToxqXIBeSmCLysgsOmb70a0yjxOmA== -----END AGE ENCRYPTED FILE----- recipient: age1g22ghnrdg858yv6w2ux8hgntj8gkdyjn28axdkmzyx38d4vx6geqj4px9a - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLZGZrcjhnL1g5M1l5MnAw - OFVoT0hHWm5SdWt4WFc2cFFMWjFZVGNvQzFRCklPeVZLTkpaOWxFZml6aFVCRkE5 - SThNSStzUXF2RU9rOTFFemJ5TnhOQVkKLS0tIGluRG1QSGpsYmRlVmNXS3I4U01Z - WnFlSm5Pck5oZm84Kyt0S2tXZHF3VlkKOgJfN1CJIDtYA1mhHyUnLgKaFaeQBVfs - hrc1CxQhGA+CnxZwfIMYGeRmCs57jhbBm+YHYKfx4eiDUvegJ/BIaw== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3S1FTV2Zjdy9CZk5heGN2 + c29abEp4dk5GNUpIL29Oa053NHh3V3plNlFjCkg1Wk83ZGNYRDVkSnhuWVp2M3RN + OEZNdGNWR2hRREgxaG5VdEFGZ2RUcGsKLS0tIGpiWWpkK3ZqZFovcjZpQXFPeEVs + MjNMQ3dveUE5OUZEeUpLazk3QUJsV0kKBS6fzXg2WRnQC74fLMM2dd2gBa4vRLaX + X+WknfFKXNd0GUlwKcd+J+pBJuV9JImTQdP3TiWyfcJKN569TlLulw== -----END AGE ENCRYPTED FILE----- recipient: age1k5nzxq4ej2u9ls97c2dhlz96j2vghv0assz5g0p4npzyc8c8fqlqld72hg - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4N2FyakVUSnNmUEFNL21V - bVZnRWltNGtCN0VpTWtaU3MrQm91cTJyUXhRCnlGTiswL09ENWhTVWRQS09DOStP - b09lOVNReVUxWW93SEJ3SGJVSnpZUnMKLS0tIHNpTTVtNHNuMkdHNlA1alYyeXdh - RkU2RWN0UldEU2ZIYmpHdGkxdEQ3NkUKhYh+qtSRC2we77DnNwvKQ0KF4OJyBErm - upngx6MO3qdPZHEpXiPsW3jobvEqG6YkvZNi5yLeFxF2icklr7aN/Q== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDSEpKbDJUV0UwVWIzUGNX + VnFTNTZsNnFhaHM5dkdiK0dRUFZITVVWajBvCmFWd09JOXdOVmFTaTRFYlA5RjUw + aVpmTWd6MmV1QThUald1N09OMUx0WWcKLS0tIE45RTFRcnNzck1BNUhLNjVzWC9q + cDlQcUx4VW12NzhqWTlaZ1locG45TnMKXP2A26YH2cwNBNAY9Cj161HOQWNp/Vct + 0TCGWUwNzJkZJdpQvqOuXWaSCAE9e8efbZTwfKBjaRltApnMuYqYeA== -----END AGE ENCRYPTED FILE----- recipient: age1gkzp905yqkla54l52m4xkqtxpn0sndkx0vh6qqa8d2tu29x8f35q354gpe - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnVkVlSDBhb2JERUY3blRj - eS85QmZsSy9MeUpQajJSVFJDVm5WTEdUcmw0CnlpaXJJQS9VSHdIdUplTXNxQS84 - UWJudjhRdUMwRUNzYUhOTzR1MGtTNGsKLS0tIGRVRWVwQ1ROckd1WWpTRkJReVhV - anMrNUdvZTdRbXVWNEJVQXhBZE5acHMK77qUayutIxY4syNZXomJOuDZ0Xhrz/dI - +URh7wm0fYpK9Mu4yLJLo1xmkGiRGO/mh+w5d3eImT8OHQ9UtPAt4g== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2NTEwZk1ZUnNXN3dkTUZv + Nm1WdDJsRkxjSGZ4N0NBYnJGT2tTTytTRW5nCnpRcFJjd0pwckx0UXh6Nm9Ddk1G + MXpCOXpqa3FXN0pORkRDL3labERaQ1EKLS0tIHJ3aWpIRTI1QTdGYTU3T2R5ckZK + RW92RTFGKzRnREdTT1ltb3NMbGhiMlkKnaeiOVhh1ntr4AKysyQ9pa9fpez+sJkJ + MyyBIomMdaBcfOfVre7yYhQl323tzBxM0q77jh+gKCN9ykNCprcUfg== -----END AGE ENCRYPTED FILE----- recipient: age1c4d93hmawmx8nt8g2sjrxcngfl7qx7y6vwxpqqg7grrkhjen6fvstljgg9 - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOWDVCVW9ZcndFMFBXa0Fy - Z0g1RnZIY2hxTUVERkJpcWcvS3VqSXROUDBrCkh0NTRIaEVzMDl2a3pmUjNxOXdB - VzI3SU83aDlKUU1KK1NPbzFkNyszcTQKLS0tIEpxajVZdTRSRm1Ca3hkTWNjVExa - ZGIzSWcvTVd5VW1EZkhJdmdHT1lFOVEKT3U9OyTcKuuj75IGgDnX79+DERFmKpaE - BuGCIsnXjRU3p1KfY5GiIh3F3rQZ+YdzLtYuIIf0mNipMPoghChp3A== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJcVJuV1hQOCs0MzhzZTZr + N0o3WFdHNlRFNE4zRHh3QUxqSVVXZU42NTBNCnZsaENzcWRGSTZ4VE1tdlBuZ1hY + aHFBbDQ3ZkdaaUV6ZHFyY0pVR2VKMkEKLS0tIHF1TnFwSVlHVHpOYVhXcjlOWDUx + RjdZTEZ4VTk0Q0tWRENsSGRpN2Z1WTAKPG1Qv7sKc/GwhFkxIBYY9ZaDKvt7knXg + +Fxsv7MpvsmLjGcyi39gop6xTCPz2OYJMuw5PC21/YKMZKr/Sc42uw== -----END AGE ENCRYPTED FILE----- recipient: age15jjykch8km3l8atssu0n9us6d2xg58z0ds9s0djtdh9l954sud5szqxv29 - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOVGhTVDBZejlNV0tlc0pH - ek5HV3M4TXYvVUY2SGRTUC9zZDZnY0g4TVNnCnFRK0NjZkhUNFZ1M1JMcDRFQ3Bt - dVFueDA4TlgveEVaRXRGSWtsVHpGQW8KLS0tIEFtb0hYYmcwUGQ2WFpiZmxlaFVG - eUlueWU1Ly9XOWg2ZlF6SVJRTnpyUm8Ky54Uog8jaM2dn34jKrX3Dw/RsmTIT4t/ - YrmSqZfbLroSBWeaGno/pyXpTRdNMGuT/bkyfZQgYXo058iTLBIMFQ== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3Q1Z0L3hBRUg2Z3NXV1Zs + bFRld2tVQ0J2aVRRUHpyU0xINmlzcVUzQ3pzCktJOG5MMzduZml3cmZGTHBVc1J0 + L0toay9rNytVSFlkbWYydk5uZnhJNnMKLS0tIEo2VWxrTS9GaFcyeTYrRXRtN2Rw + aUhkNmQxcGovYk9XcTZaU0x4TXova1EK6PX7MZBowygoYIc3LTHP/6+1NuQYkdiY + hBRHzVXOI5zLukuaCYthujcVCrJD1rF8Mje1fTZRk0qI146ZWT7hGQ== -----END AGE ENCRYPTED FILE----- recipient: age10jhawn266e3wr6rx0lndkl9a47ewtk6jgh35d2582uu2l7dtn4tqdqc29c - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4YnJoVEhwY0owS3BHM3pF - YWE3Ui91aHJHZ1ZkOHRPMlgyRHFLQnRTam4wCnlGZnJMZ0lIdUNnZXNuWHdCUUFE - R296cmpJVGs2bEdJd1B6azdKZDltWW8KLS0tIHY3c0lObmorM2t4WWprSkhxN2Vx - Nk1EZmI2VWh6ZDdKL2tLMUZzdXFOSncKVnPG8kyr9AVoMdlA7ssIDxAN1XfmxstC - eINv9P0BBD+mbaGh3vm1ziI1EvvFpWnxwI3Z6iOBkCs1G6KdhTLhfg== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDcFpSczF2Z1QxNFZocWlz + Q3dCZ0RwWVJOYXQyRmo1OUVlcGVzNFQvVWpJCm1YaktHRnZpdUdFSVc2Q3hPZkZB + SDgrbHN6NVR1elQ0MGpRQWZJdE5YQWMKLS0tIEJTdXNiTlYyTzQzNkpsemRER1dL + c0svZm1xSVc1eG50SkJvRW5iSzBGN1UK6UKECSIlo0bzTPu1S/QshHWb/Q75OQFP + idzq3J7K4GJ6PEvspzRhKqinCVeuScmk51BXFO2lxRBK2dJ+IFi5OA== -----END AGE ENCRYPTED FILE----- recipient: age1x708x83pjj7urp26pncx67fqz8a3htrf0umw7c00pvmxhl6y95lszjgd6r - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1ZGJxZzBraUwwM2dJa1ky - K2Zubmw1bDlKbDVackh4NEx5M0dtaWtoZDFZCjJJZDVrZGUrRXBtUWVFR1YwL1Js - dWd4TEV1NmMxVlIrU2ZjVW9oNlVhSk0KLS0tIFBSdy91NFBhUHNHVGFwa2NWYW9o - b2N4RitnbEJ6eWR3ZGFMMXBuNjBTd2cK+A+tYDGSrJnbDZOO0RewBWpGxDAGBTk9 - /302dRcccuZnoXkdOcjQXUvjgAlvkR7LlSmCUKql6ncaKGrPBA5VQA== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1L0ZxRmZSbDlnZXNpRTFh + NE1MeTczZDNpSlBaNks1RDNpU0cyNzFhcEVJCm5wWlBMYmdzRGJ5Z1VmOFNxTUlt + Z0hLSThCaS9MV0J3aVMzZ3dQbGVnUzQKLS0tIFErMUUrd2JnRHpOelBRRzRvcTcy + aHpwWDVmVG1HalErSnJ0UVlBYS92MFEKacUGzDA+i5ARNhcKXcuhAEoq1a/Y6n/i + Thsi7uKriOa7pY9V5ogx+EqfcKcytF3loOTAv+cJtL0fAwbwmmCZVQ== -----END AGE ENCRYPTED FILE----- recipient: age12yvljlgg94z8qfwyezz6mtmrpldxvfcqwzsuyfekszu296fg6upseeyc0t - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpRnUyNEZ0QUtCN0dNbVFN - L2kyRFFoSmpXQUdsTzg0b3FkYVRvRi9zM0ZVCkoxRWw2SGhRQUdNU0tROFNNdlRm - VGVZZnBBSGNwQXBQOElyR1pIM1hVcXcKLS0tIDExK2FDNGxQSVI5YWpVQjd3ZVdQ - bGpmeEdmZ0lRUHd1b3Z2dDBQa1ZqRWsKM/XXg4TwRbLD8lLZ/OAzWRlcuZQ1IbBR - meFHGCcv9SCZg9Lh0ESZv7sfpm3hHjFB4oTWpXhLw6ZTm7wH7xX+iA== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPdmNWczAvRi9CemJrcHVE + SmIvY050RXk5WmQzTFpZYmZkdEI2ZTE5cVQwClhOZkk5OEdwcTE4ZGNmMm9oK3or + U3ppZisrTU8zNjlOYVFtZjdYaGVHM0kKLS0tIGFpc0N5Zy9HU0xBZUdmVDN2NnJm + bExka1p6SnFVdmxJd3o4WTFBa1RZZFUK5hFC3KkEuAQKJgb2pX56pcJf2ppb9yjm + 9yXjEgctt52bE4WFLBoge0lMDHimHD94X885u6/X1P6rJH+qywqIqg== -----END AGE ENCRYPTED FILE----- recipient: age10zakwy8z5448vj7ur2h7vn8wfzvt2nxwq4pk4wx6cs34mlg58yasdjhc7l - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGc2JMRzQ5dSswTSs0MjJp - dFJ4Wlc4M2VKeExLRXBJQ01KNlZaeFdWRXhRCm1kSFZSSEdrODJidUxLNk9JU0wx - VXRTRWpwVGhmSHlwR0dTQUR1bEg0OXMKLS0tIHp1a0VNKzV6L1VqRHBzOEthV1BF - S1dXWFZtaElVREMxaERGclFjdjVhUlUKJkCFAXC43g+GCxbwMnZ4sK6dwgv2EjCf - Ufg5P9uv/ReNmmMY4RSl+qlskgkCRyxN1mo5wd/PAMbOMuHIb9LZlA== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQYTFDSkJxYXN2NXRpazZ2 + bmJLdndJcS9URk5rY1AvaHFWTER3ZzNjZXlRCkd1TVVxNVdtVHh0bnp0KzlPOXYr + ajhLK2htVUJwTnZQa3pDdDZQYnZyeDgKLS0tIDBHVDd3aU1FcE9aR1loZGQwU3ls + clliQlRVN0lwTytublZtWFJhNlpSbFEKfXgr15y5pBg0zSmaMKxfwfmGoBCSnf7M + bHaL6YTJEsPJUClpOVPnVDoc9/zZZK+g2zRYwUXkqjhLuI6y7nw0Bw== -----END AGE ENCRYPTED FILE----- recipient: age10q5gqw4gwts228ayanvalq7c93peqjdsfqcgevd7qr43u5rhnczs9u2ysj - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBONDdFRzlqRUlLRFFNbHhM - b29Camg1cmx2RjhuKzdFdUg2aVcyTVNIMURrCnlINXZ4VG81SDdPWVJ3bk13YUZy - c0VyQXA3KzRSakhFUHp5M2FXa21KRGMKLS0tIHZyQ0pwcXhQTFBpWEVXbzllZUZT - Ymp3SDJVclkvTVRIVVNuMURjL203QTgK9RUCoafCWuog9AnzjkTj08t4whM86OWe - OcNGmeuvOqDEPC0oE2/0GmhynOE4ZImoLGb+PE8hneuCD3BS6YDoSQ== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2TXhCN0F0aUtrdWd3bEZG + R29YMTVDcDFGSy9jZlVtQ2RnRjJDNDVRSzJ3CkZZRmEyY3FrcnMyMDJVc3Z3MmZH + eXZWR2h1RVdET0JMUndvdWRDb09NRHMKLS0tIDJMbUdXeEErVjkxelM3OXRpeVlk + V1I5Ly9SM0kwRXhIanlaRHlKeVVDMUkKa0x3VDxG8HAv7tR3My8Of4MEOgRfa/Mc + Ka0RWmMbwsExRAKBDhwMDzY4CN4WzClSNwsMUAy24Y8YS7YL6UEYdQ== -----END AGE ENCRYPTED FILE----- recipient: age1hxynjkmtgcu9lwejchkjfqjp484at589sznqkxk6weucp37p4p7qaj440h - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1VUNXZW9UaXdmRit2Vm1w - akdVemlqTmZuTG5MT1QxUHNDd2gvbTRrdW1ZClBGVnUxNTdicEplUXVkdERzUWEz - Ny9LL0NzTi96TWNwWDNIeUtJNWxSbm8KLS0tIGxFQXhMbTQwUnJhRTVuWXBPUzdJ - V3I1QWpCb0dxZHZRUEtmQVl3OVIrVU0KxWfm+mF3RIz5tyXbtv5lw8HmCkQ5KRcO - wA9MXb8GQFAgw2I1xLx7WhRLAwTSL9Jojn8WLWTNwYbeVhjOnoGM7g== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2QXJTQURUN1duTllRejBz + OTRiSERDbWVzUFo2bU14cXdKSXIwcmpwWFc4CmM2eEs4VjhVM01BaW5aK3ZxQ2JG + Y0hmcVViUnF5V3pxYUVuVk1Od1pXQ0EKLS0tIGpMbG14N2pXcldHZnJGdzBkMHAz + R2RVV1UvTGdheG0yWVlzeldLMHJzOGcK3RN+FRNIo1usuz4xK/XJPPOJVDDBaN14 + qhDaq6dHFv6zWeL/CmvMxHe9LVmy9HaIUYOkmPcWFBmt/zUd+5MPZw== -----END AGE ENCRYPTED FILE----- recipient: age1dtf3ahstj5mhzcqf4d2zc54d5dds69ka32dqpmpsskyaz04dtshq9ryxat + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRNFovRmpsejh2UzVENDRk + S3FGL1UrMHpUQzZTdTBoTktGS1VWeDUrQVV3CkFFQzloOUhybnNOWHdOYTh4WlZB + cDBxelVwYkt1Q1NiVmZzOU5aWTN6U2sKLS0tIDZLWHFhbnhSTzlZelVqcUlYTU5q + M05IZytOYnBRQ1FnWHQrK3ZDelBBYTgK/n727RYMShgi8bqGIEaGqz4S0jFVSsyZ + ROl6ffOfG1UTXvifPkqxykbbGW2zUu4u2DCKSU5uQ45aPuYKIPOXwA== + -----END AGE ENCRYPTED FILE----- + recipient: age1px3aq87zcjgts5guc59fqn64zjkqzukdwce4a0ggza83n3atkcws4h5aww lastmodified: "2025-10-27T14:24:19Z" mac: ENC[AES256_GCM,data:aM+C0y/b8W7LtZoCPt6hBwjhV7zJ5v1dBZvFJvz/3l6gXdhtvI935j9cRzIlYCRagfwIVu18p/LDi+SSIlCBt23Q0mPUc9bTIc6JNTxVQGcqUrfAa14Msgm5amrY9HEsaMOxFX5tndcJMQOsKPXx50CJFb4hwFk7sQy0/9iQNdg=,iv:kQiD7ek9M9wGfGeHNMAWTacboba75jZNd3ZhmE9fVR8=,tag:ZcoF1bAajSGHcN5rvUJ2YA==,type:str] unencrypted_suffix: _unencrypted diff --git a/hosts/bastion/profiles/caddy/secrets.yml b/hosts/bastion/profiles/caddy/secrets.yml index 713d7de2..354aaec3 100644 --- a/hosts/bastion/profiles/caddy/secrets.yml +++ b/hosts/bastion/profiles/caddy/secrets.yml @@ -5,121 +5,130 @@ sops: age: - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4K3BmZTZJMW9qQWQySlEv - VFZ5UjVEdUtUTmxZUWJNVVZieTcxakZLNlhZCjNKT2NVWkVPci9vdktjZUZIQzU0 - RTk3Q290SXJSdWxyYjhHUmtwUUtQcUkKLS0tIEk1S1FqTjU1UVBHSHhuT3lBeGlG - V2Z4MmRDV2s2ZzNSdkt0ZXA4NTBMLzQKTqG85VxlwPoE6ylyNicJkT5CJ+XFHNAa - AtthugM7kezrZtTFIhBVfHbuW1UGJwpBW3I2PLQ/iKxrtQ5EENBh1Q== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzVFBMLzNkNmVyTE9OVTIz + bFJWajhUbjNZVldQL2hKeENJUHBUSHU4bENFClVHYXVka0JQM3hzQVR6S0pacGx2 + SUlBM3k3NkVaMU5ZK0E2MWVHY0UybjgKLS0tIGNHRjJDbE56dWxwKzhTREk2SWpS + SXNvVWdkZTk4YXFuYUI0MjNVbzhDMEEKAOrqRJyk5mw27eUWz5V6yN59MyWRBrSr + zbUDa1J3wTMKA4sjhgJTmDWcMN3yf3kJo5Xyk8TsUBelas/zMQMRqw== -----END AGE ENCRYPTED FILE----- recipient: age10539mc6shf02hpa8huyjktdw3nfyavxdg8pt247wwvq4xrv8h5zs8nc0k0 - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFQWJUNGZwZDFIcVZJZW5a - alM3d0QyTGlJMjluQm4rVlhzTjVDNEw4cENJCmpNNEt3UXUrNE96QW9keHJRYWJE - ZmpFQ3FYVHduMk9tT3V6WDNpd2djRVEKLS0tIFZ2eHRCdDFvNXB2aHdmVkFHaGx1 - VGZsaVQ4TFVVVFZjWXd0YzY4aTZzMkEKMXVbq98KmgSyvpGexkbyShjP0yB1345x - cqjMDXxwMDMUS9SD8upf3c/Zz/Bznkc/xJ7ocrbnaaabdTcb+LgZVw== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWcGUxeWVpRmhRaG1rd1B1 + M3lTaU1pODh0UWZObm8vMXVrU0xjdjhacGswCkhIUGtDOHQrYW5HQlJiQlBPKzh2 + cEtiUlZYTGExTHNxc1dycWhXTW5WT3MKLS0tIFU3cDVlWlpWU3k2eGJzSnl0dzRz + SWNlUHdQL3JhRENtRmtlT3NWSTVnMFEK4i+Kp2y496/ceaZAPalV+gYOXmDf/YND + G+ckpggyisFIun5zfa1CwgH3qRHk5dq8VNhLePdW01olsAY7I/tQYw== -----END AGE ENCRYPTED FILE----- recipient: age1g22ghnrdg858yv6w2ux8hgntj8gkdyjn28axdkmzyx38d4vx6geqj4px9a - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCM1lnYnFLbzBkR29rVFV1 - V2VMQ250U2s5ek5uRWVhTWhZcDg2OGRadGprCldQRjZFcE5GZnJNcXR1UGV0dVJw - RmxWTElqUExPVkVuTzFxNXJYTGRJVDgKLS0tIHphRG8wZllKelBDd053SjJJSU9Z - b1pBa1hsSWNjc3dCWEF6Y2dWaEFnU1kKY0rGntilBl0NDL3pg/WlSkuNPr5XA8vb - bAnr7FpgQuNp9yyyaqgIkvlTWSZ/ZRLUn2woqc0SjVdIRCkddmEFwg== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKbVMvQ21xTGRheHU4bERZ + ZitvMnRuc3VoRStEcUw3UEJYbFZabEhlNmdnCmlTbXB1NnhNZDhRbU42WEd2Vmho + OFMzakdSOFE3cUU0d3Via0tiRXBleE0KLS0tIGQxT1RRTC94VXd0U2djNGE2bGhv + eXR6U3Y3K0RWNWt4UzFwckZJQ2pyMmsKw8iaJAu80N1FEdFReGmL5JcLzhvknAME + 2jDyzswoFtlX5q2dITACuQ6OUwXyuzU00B7ObTYniYeLlh1Q0Bv2tw== -----END AGE ENCRYPTED FILE----- recipient: age1k5nzxq4ej2u9ls97c2dhlz96j2vghv0assz5g0p4npzyc8c8fqlqld72hg - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpSUY5M3l0SnJlanhoWVBG - M2NxbDE1NDJlODFnVWVjREptTVRJSDJndXhVCk01TGN5ckdJbHNHZEg4d2gzNCty - c0NsWXZ3TmZ0U1BaY0diSStKaFVvckUKLS0tIEk2YmFFR05RcndJUXhxZ2xLMTVq - RktzZHJzOXhZcUN1b3M5dUpkbEZuY1EKWs13RiCHFhzkFijgiALup8uSh1D+GpWB - uy8tjmd6FbuFpaICE4mpg8IXRGIHXVMNbGQCYDLLMT80bVPHVW0uyQ== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCQW9HYjhyUStEZldPWEk4 + b0NaTlZGYnZPeFNwK0IxZmhrVEhCWmNrb2hFCktXZDZtQ2FjaU5WY3pmNXBEam9k + dHIxZEl5WU43bUtINGZjdDdXOHZhbzgKLS0tIGZVVEdob1B0M0g3OGdGeXpyNFpJ + N1d4Z1dWQTNUbG1EdmJQTCtPcHRjeEUKMPAgkmpltjSXJxMYtTR0XYQEfGTJniJe + RJHl/gYs+NHUjchj3Ajj4hdBkw4X/Y3C6QTrnNgxCMe0dEShr8VFsw== -----END AGE ENCRYPTED FILE----- recipient: age1gkzp905yqkla54l52m4xkqtxpn0sndkx0vh6qqa8d2tu29x8f35q354gpe - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZeitOQUJ3d0toU292ZGxG - ZGNYN1JiZmhickhGZVpjWUlWYzNrS2ozS1MwCjNuVHBxUk5WWjV6NWhReWFLQVRI - Mi84RkUvdjVFdmtKTUZaakgwUkczQ1EKLS0tIENYZDBWOERmUk9TdUFLb0I4Yjc3 - Qks4eFFDQU9uY0RJalJWblg1VTIvUlEKk6E5N7Cb21L+2DCGcJbIVGfEhmSuqJbB - L88x89a99r/tMGxodNJjLQDYlr1Kc/fDsYcHGr1V/ESvRnwYXNk7MQ== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwby9SYVBUSDBsbnVxcHZt + Y0h6VXB4eEttQm1Xdm1RcEtBWm0ySWdRQno4CjFPdnIreFlwYlhoci9KQzlXcE9T + SXRIREs2YXFSOUpnVDFqNktaaXd1WVEKLS0tIHBzZUtHQnVtVFVtU3hjekJGeEY5 + WWV4V0E3bDBISElXcUNET0ZhZlA0MmsKqAAJOYmNNySqWyGeHv1WttnAVyqleiwg + HplsFvOjY7GowhfVB14vRJnJPKtaiFr32/lVd6tEpmDwYEjL9BTgHg== -----END AGE ENCRYPTED FILE----- recipient: age1c4d93hmawmx8nt8g2sjrxcngfl7qx7y6vwxpqqg7grrkhjen6fvstljgg9 - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1eWpoVzAySGJYbks3cTJC - YjhQbmsxZmVOMGNFNDdRL0ZhaE81QkFSZERJCjIyeUx4em9BVGVsZnV4QTVLTjhk - RFVMOTAzb2JKQmdtS0YyZTJuRGhzVFkKLS0tIExpY240ckpPczd1NXFRWU1qZDJL - WEhqQi9nVXQ1TFBGZXByWDFVNXZtQW8KbmpZ8FJQeZK54yVHLp7ig/iy+uWz711d - iMumf5VkJHGH0uGojRWl9/ehiIHX3KuYj/iXCASZ45SKHBeZgDhNaw== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFVThnUERJb1FjUGhFdDRs + Ujd6TjE0aFFrd1JscDU3OVFMa1hLdmdXUFFvCnRjOWpLdnpwVjlIRnpNNFFkSFAz + S0E3dHYzc1h3V3QrRWVueXVTSHdJdGcKLS0tIEFhak1ZVHphUS84Q1FFQmhKVk9D + NDVYRmNxV1g5b2drU1B0WU5ZUVU0SjgKffEKaW0QHSmqc9oy6puZthHDf0lh8qkU + PkwgEt+3dTDWEFxqE4UJVk0to/Zpa36bHzscArtCLEonxwqCyN3p4w== -----END AGE ENCRYPTED FILE----- recipient: age15jjykch8km3l8atssu0n9us6d2xg58z0ds9s0djtdh9l954sud5szqxv29 - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVQzQ1VTFicGFKcTRjK0Nz - OUEvZlc2cDNhNk5WcTBVM2lHTlRxWG5qQ2djClNCOXM2Nmk3YTl4aFZlODEwb1Jr - YURhOVV2MjQrdGgyV0xkVnVRR0JxMjQKLS0tIFQ2WnEzSjV1Sm5lTjRYWWJUQ3kz - dDd0VXdkZGIwNWhtQWF3N2Z2N0RqcW8Ky351A176Ja6NuvY9nGlRUKBXng8whPJN - 0j0Z8N7/6ezKCXBDJGp+Xd91ZHfTDzUVblnHt9wgJRQGyHz38b7SVA== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKVzE2NTA1ODZsaitmR3g4 + MEtEb0w1QU1xRUZjczZoUVZJL0FCL3U0VWxjCi82eTkrZ0VhN2RNZitHMmN4WFBh + R1pYZHNFdFNsSVVHZ2FJQ3FGdTN3ODQKLS0tIGdIbFplN0l4M0NUYkk1anllNVR3 + L09tTXphM1FqRVVBN1lEQTBtRDJPbUkK41x0UC8JSivPpYcIRpBxKDfxM8Z4vvCr + zqx0Qw49u0y064qeodpapDLH10jA/1V1XVevZ4aiwaTR25LBg2imZA== -----END AGE ENCRYPTED FILE----- recipient: age10jhawn266e3wr6rx0lndkl9a47ewtk6jgh35d2582uu2l7dtn4tqdqc29c - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDYitvU0laamhPbVM2Z0lR - Mzk1amdXNml3SyswTGlmL2lHN25PbllvakdrClBaRW1uQjE4TGpnM05Ya2YxdzF1 - blBLaUVGU1VGWDlxTXdRNDVsQVZvVDAKLS0tIExVOWNaNjMrcVpxMFFtdXBQS0hW - WmFvdjJxS21kVVI4MHFYWTd4S2FTT1kKun2hvYsKy87Qs8keK5rtnIfojE6wFcBZ - jIQ/Y8bioEwhj9yDnfmvvjR9ISuRhXf9D/lREmcI/sp4dJtQxZJhFA== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpMU5CRWE3WFB3bklnV2ZG + NHJROGdvOThKeHoreVFoZTNtU3RMYjlEaWljCjUvbTE4VHpPQTRrUEc5NzNoVGNL + ZU9ZTk9JcDVHKzMxTU94YmtHUUw1VFkKLS0tIGxMZFIxVENZeHNNSWErMUNuVFBJ + OUFJQXpTa3phYVZLVnplelpHaHErdUEKdy9Hw5qg9utH0ULEA2BTGGkVrL5ygDCK + LQ9/HwFHr3FUmls7uFoYTir1y3RLIaV2LCTT1pGlhbav6VIQLCRPJQ== -----END AGE ENCRYPTED FILE----- recipient: age1x708x83pjj7urp26pncx67fqz8a3htrf0umw7c00pvmxhl6y95lszjgd6r - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWN0c4T3lXWVVDWFA2TEsx - akFBRDRiSkZiQndJejVEV0d0NDFDU0NZRkFzCiswWEZ1QnZub0gwNkg3dnJHemll - MHgxT2RKRmFRalhDWFpHS2JHUXhaZm8KLS0tIEIrTTlsS25oa0plSldsOFV6ekFz - bG5nWkhGV05xbUxxTE1HbUw5MktWNTgKi2nqCtZeBGd3xkZB0VgasUZ6aKUKcrxP - KKXRwas9bpNrPJVqoOKSdbwonkP5/XuovMGTSC4KTdj/Zcvkb3LgLg== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwamNvQTRRSEllMTQ3cWFG + aHFMSVVDUDJpZDl6MU9pYk4yTzhReStYaXpjCkcySUdjNGU1RHNuS1pLUzM1QTJP + c2JHQWx2RVpZSzhVN2JCT3VBM3FZZWMKLS0tIG84aWZrcllVZE50V0haamhqeDNi + RzRTdUk1QVUyUGlWeThRaml6WkVYMDgKmTBS475aW+6e3UnU7iY/OmHdPmqbzxr9 + kMr2KwxpGRDOqoF2shRQ/Rykra7KMO2MUYhG9IVDKCMyUuxMybpEdg== -----END AGE ENCRYPTED FILE----- recipient: age12yvljlgg94z8qfwyezz6mtmrpldxvfcqwzsuyfekszu296fg6upseeyc0t - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqN3I3VGJQWktlSkg5NG83 - RWdFRzhKU2V0L0pZVHZUY2p5N3RmQTdrbGdRClYvUzR6Q2dGY0tTS3cxQjVtMTJU - bHBSMVFXbFhaV2ZKU2ZrbnNvaTNvWkEKLS0tIFpYSXV3R0J4M1hmcUQvd2svSVd2 - OXZ5eEs2b3dWNTlObWJsK09uclZpWGcK3AgrqwE+pHdvUxx046N2G8FNRGClxG76 - CPDom/mivyccX1sbWLPmRIs4jco81CKDm1OmloWC+aWj7LlTtDPKrg== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwMFpGVlEwKzR1SEh1UTJ5 + YkVybHNvSXM0VG5jTWNhbjJldFRwcXQySUVZCkFnemdBNDM3d2t4bERidHpRUHRl + WE1zVXpIRUVPVXc5K1Fsa2dxZHVFRW8KLS0tIGVmSDhPQWdWUWNuUDk0WHlLZksx + ZW1sTFBQR2JPL2srVlJmdDBPSmJVY0UKBoGUUrtTIVjiqIvdVBHW/NkNyS1Y3Rxt + vh2CPVuYIp4Rwg7xfP+/a4e9TtiC2zv652PwcMX2vDOPknVbIRayhw== -----END AGE ENCRYPTED FILE----- recipient: age10zakwy8z5448vj7ur2h7vn8wfzvt2nxwq4pk4wx6cs34mlg58yasdjhc7l - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDN3hvZXFMTXU5dXFGNUtE - cy85VU5ya200WXBMR0xnUC92TXRlNEtLYkdrClhNZVY2R0I1Z2NSZW1yNHlEOTRJ - TUtQaVFsUE05ajd3MHIzWU1FQ0NwREEKLS0tIFk2Zkg0TXJhMkcxdkZ5b1BWNlBr - M3JZV0tSWVYzRDhNZEN4Vk5JaW5DbTAKFyyWoiJP94rVDMQN66aEuV96J6PFcRTy - lfi+6h6aYEUppnIC1qtaaAdjvxJcC6XkZUjj5YZ4oltvpeIoITXcFQ== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHNnVkQkdzNG9BRG04TnNK + TzJWYkdaMUpOM2xmQ2tKbTFDdTBkWFV3TFhnCnI1cmdXQlQxNWdrUUp3Z3A1a0h2 + S3N6b1BNVVJacGp5WjBKOWFWd092dFEKLS0tIEs3eUwxYTdNb3NadUNsd3BQazRP + bmJ1cXZvVFUzRml5MmNqYlJ3WFZmUG8Kagt+D+gojXRhpK6JmsHablQKVSFox7Fg + HyIozkuHr9K6DP6eEK0g0ZFKRzqM9ZIt7NmzB+zEOwlsB23pe2gFcg== -----END AGE ENCRYPTED FILE----- recipient: age10q5gqw4gwts228ayanvalq7c93peqjdsfqcgevd7qr43u5rhnczs9u2ysj - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJT2FNVGdWb3A4a0p1U1hz - OVROMURmS0J5YkViYkh1bW9DK3d6UUhQSlJnCk1aSXMvc3JMN0ttc2diRkJiR245 - TWJWNmx1Y3RuMFlUUy9UYjd1bzNVLzgKLS0tIG4zUmNGY1ZoNWRSY3I5eVhhSXdt - Tmw0MWtFb3pnTmdIdTU0UStLMEEyUG8K6IMybYIAolKIwDOY5CUBPcQmqZCUoubT - EE9GHIqGhdX2iDgxEpTO63nXAwD0ibNsgxcFvc62vsD9gXneJ+k8/w== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlTHh3WGlJNVJwYnVXdmJz + Mk5QeEVVcUxSVVlrYkxpZ1lka3IxbSs5L0JZClBaRWZrSEpwTVhSbTluOXA4N0ZN + SFlUeElxbnl4UU5wcURsejRoN0x1SkUKLS0tICs4SmgxMWRUZHk4dzA4MEM4YjZP + UkZaUXBUYnNBRHF4K3diV2s2YTBVckkKbRGgZwzid6GLmSV7cGvf4BXx3yYia2P4 + rT/5w0E9o9F/GSAd5ZSuem/kTdFXcEyzqcGO9BtBpePd/xQbNZyrLg== -----END AGE ENCRYPTED FILE----- recipient: age1hxynjkmtgcu9lwejchkjfqjp484at589sznqkxk6weucp37p4p7qaj440h - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzTnZQNUxpQ1I4NC82dW1o - T2FxTHB3aXl6dXMzWEFWVzB1SFBrMzU2RzBjClJ1dGQ5cUk3bzI5VWxYaVAxSE1i - NGhYMHlxeE9PM3IvN3RiTXVrU3R3RjQKLS0tIERsb1dnbGo0QUF1VEI2Y0Y1Zk9t - NFJNZFViN2pXK0dMWlpXSHp0eEtXSHcKNBLBipdt7QURoJnPYWFIhx6Apbt/Mmgg - Kyt17feYNNDC8SCwspP2raWDBLpwJRLI80A65MhFh5VIEPwjutmx+A== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhWHBPMFhVZnJwd0xoaUdP + Yy9YaDJONE9uejF2NDBLbXRnRkVnazNpaFg0ClFtZFJKQnMzSHI3ZzlJM0ZEWm5i + RFltY3hZaVV4NXYzMDVBdDU4U0NPdmcKLS0tIFNnMWEvRmtZTGZOZU8vQXZyUmdu + NTQ4eU1JYmZRU3pxRnpwWENiQ2pPMFUKLhiW/I+2F/YlJKWEySg7di+RbIDoOG7m + RSnSWDcp9U/8rjizyl+GfASBbgEnpTCdgrmwfmhhUlIC+UigdldQQw== -----END AGE ENCRYPTED FILE----- recipient: age1dtf3ahstj5mhzcqf4d2zc54d5dds69ka32dqpmpsskyaz04dtshq9ryxat + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2STRzazlNY1RqTG9QWXIx + NEljNnFNY3lKa2Nqay9WcVR0UVg0bjlBQ2hRCmJSU2FlWE1QNW1SdkpuMytsb1Mz + aEpBMmVsUnZlMnhRbUE4K0J2bkJiWlEKLS0tIGtpSjVQWlRRSFdaOU8rUm8yWGtk + a2JQcEFtV0N5bUErVXJaN1RIY3B6T0UKvhqXXxvdSKmO1R5CiU73vRmbmHVrC2Qs + QQsb4uJXwoaS6aCFGgnUuu5vMICQlzEpYFep9lLaHEDvdYOxYiG1TQ== + -----END AGE ENCRYPTED FILE----- + recipient: age1px3aq87zcjgts5guc59fqn64zjkqzukdwce4a0ggza83n3atkcws4h5aww lastmodified: "2025-04-06T04:43:38Z" mac: ENC[AES256_GCM,data:/i18G4yrdb9DAXaQgEoGMxoC9Xpp2TtPYZrAaEj56mhy59CIuLGg0RdSiqSJbAdtz3GIUA7kmUyrIzpgxMUBn4C0XrwUzDogpceqtPg9bbI2fbNxDfwRadetEusL2KvFXY+2o1QTtLflrMFMMNGuX12JSocI+ooEa/L8+DL0IoU=,iv:niin5PIx48XS723uqZoPrIIhKRYEK3VnczfPbpgn8z8=,tag:HVorZGVC4OcnDRIt/X12+A==,type:str] unencrypted_suffix: _unencrypted diff --git a/hosts/default.nix b/hosts/default.nix index 1ef146af..5c4c607a 100644 --- a/hosts/default.nix +++ b/hosts/default.nix @@ -126,5 +126,6 @@ in nut-network = mkRaspberryPiHost "nut-network" { }; nut-homelab = mkRaspberryPiHost "nut-homelab" { }; whirlwind = mkHost "whirlwind" { system = "x86_64-linux"; }; + gateway = mkHost "gateway" { system = "x86_64-linux"; }; }; } diff --git a/hosts/gateway/configuration.nix b/hosts/gateway/configuration.nix new file mode 100644 index 00000000..e921ff05 --- /dev/null +++ b/hosts/gateway/configuration.nix @@ -0,0 +1,26 @@ +{ suites, profiles, ... }: { + imports = + with suites; + core + ++ web + ++ (with profiles; [ + security.lldap.default + virtualisation.qemu + ]) + ++ [ + ./profiles/authelia/default.nix + ./profiles/caddy/default.nix + ] + ++ [ + ./disk-config.nix + ./hardware-configuration.nix + ]; + + deployment = { + vmType = "hcloud"; + tags = [ "@external" ]; + targetHost = "5.161.98.131"; + }; + + system.stateVersion = "26.05"; +} diff --git a/hosts/gateway/disk-config.nix b/hosts/gateway/disk-config.nix new file mode 100644 index 00000000..d439fcc7 --- /dev/null +++ b/hosts/gateway/disk-config.nix @@ -0,0 +1,37 @@ +{ + disko.devices = { + disk = { + main = { + type = "disk"; + device = "/dev/sda"; + content = { + type = "gpt"; + partitions = { + boot = { + size = "1M"; + type = "EF02"; + priority = 1; + }; + ESP = { + size = "512M"; + type = "EF00"; + content = { + type = "filesystem"; + format = "vfat"; + mountpoint = "/boot"; + }; + }; + root = { + size = "100%"; + content = { + type = "filesystem"; + format = "ext4"; + mountpoint = "/"; + }; + }; + }; + }; + }; + }; + }; +} diff --git a/hosts/gateway/hardware-configuration.nix b/hosts/gateway/hardware-configuration.nix new file mode 100644 index 00000000..ffcd4415 --- /dev/null +++ b/hosts/gateway/hardware-configuration.nix @@ -0,0 +1 @@ +{ } diff --git a/hosts/gateway/profiles/authelia/default.nix b/hosts/gateway/profiles/authelia/default.nix new file mode 100644 index 00000000..a2cc426c --- /dev/null +++ b/hosts/gateway/profiles/authelia/default.nix @@ -0,0 +1,403 @@ +{ + config, + lib, + profiles, + ... +}: +{ + imports = [ profiles.security.authelia.default ]; + + sops.secrets = + let + secretConfig = { + sopsFile = ./secrets.yml; + format = "yaml"; + owner = config.services.authelia.instances.${config.networking.hostName}.user; + }; + in + { + gateway_authelia_ldap_password = secretConfig; + gateway_authelia_jwt_secret = secretConfig; + gateway_authelia_storage_encryption_key = secretConfig; + gateway_authelia_session_secret = secretConfig; + gateway_authelia_oidc_hmac_secret = secretConfig; + gateway_authelia_issuer_private_key = secretConfig; + }; + + services.authelia.instances.${config.networking.hostName} = { + secrets = { + jwtSecretFile = config.sops.secrets.gateway_authelia_jwt_secret.path; + storageEncryptionKeyFile = config.sops.secrets.gateway_authelia_storage_encryption_key.path; + sessionSecretFile = config.sops.secrets.gateway_authelia_session_secret.path; + + # NOTE: These need to be commented out if there are no OIDC clients present, otherwise Authelia will fail to start + oidcHmacSecretFile = config.sops.secrets.gateway_authelia_oidc_hmac_secret.path; + oidcIssuerPrivateKeyFile = config.sops.secrets.gateway_authelia_issuer_private_key.path; + }; + + environmentVariables.AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PASSWORD_FILE = + config.sops.secrets.gateway_authelia_ldap_password.path; + + settings = { + authentication_backend.ldap = { + address = "ldap://localhost:${toString config.services.lldap.settings.ldap_port}"; + base_dn = "dc=e10,dc=camp"; + users_filter = "(&({username_attribute}={input})(objectClass=person))"; + groups_filter = "(member={dn})"; + user = "uid=authelia,ou=people,dc=e10,dc=camp"; + }; + + identity_providers.oidc = { + cors = { + endpoints = [ + "authorization" + "token" + "revocation" + "introspection" + "userinfo" + ]; + allowed_origins = [ "https://cloud.e10.camp" ]; + }; + + authorization_policies = { + opencloud = { + default_policy = "deny"; + rules = [ + { + policy = "one_factor"; + subject = [ + "group:opencloud_users" + "group:opencloud_admins" + ]; + } + ]; + }; + }; + + claims_policies = { + karakeep.id_token = [ "email" ]; + opencloud.id_token = [ + "email" + "preferred_username" + "name" + "groups" + ]; + legacy.id_token = [ + "email" + "email_verified" + "preferred_username" + "name" + ]; + }; + + clients = [ + { + client_name = "Paperless"; + client_id = "viHFkj_wnehAVrf2U-2cE1~RDKGEO2iawDGTJuOSLKiEt_vKBiADlhSLyjI1LsA8T6DO0Vy8"; + client_secret = "$pbkdf2-sha512$310000$qb7YshuNG.nvIev7OWvSyg$/nWmyxm0xxZG1mbCczkI9.Oi6lbrXd.BbsNXJU91p5nSYJGHTuN2OryQksEMK9ypCst.UYn6.q7HK/2YBstE.A"; + public = false; + authorization_policy = "two_factor"; + require_pkce = true; + pkce_challenge_method = "S256"; + redirect_uris = [ + "https://paperless.e10.camp/accounts/oidc/authelia/login/callback/" + ]; + scopes = [ + "openid" + "profile" + "email" + "groups" + ]; + response_types = [ "code" ]; + grant_types = [ "authorization_code" ]; + access_token_signed_response_alg = "none"; + userinfo_signed_response_alg = "none"; + token_endpoint_auth_method = "client_secret_basic"; + } + { + client_id = "DpimJHTYr-K1ba5dFHj6mlRPXxkQCTN3E3RGljCmVXlGs.AcDdWwG9sysfV~Bv3vq7Z1rEEm"; + client_name = "Immich"; + client_secret = "$pbkdf2-sha512$310000$Fu.EoQ7p6UrQw9Z9mtY6sQ$YTh3csT6xxlXE1YotyWX2HNI0H6wRgq3x0jnkHWu93UYtHUlCRfkeBVKcbplx0sPCwBVVYeyA4gLeByyaL.iZg"; + public = false; + authorization_policy = "two_factor"; + require_pkce = false; + pkce_challenge_method = ""; + redirect_uris = [ + "app.immich:///oauth-callback" + "http://matrix:2283/auth/login" + "http://matrix:2283/user-settings" + "https://immich.e10.camp/api/oauth/mobile-redirect" + "https://immich.e10.camp/auth/login" + "https://immich.e10.camp/user-settings" + ]; + scopes = [ + "openid" + "profile" + "email" + ]; + response_types = [ "code" ]; + grant_types = [ "authorization_code" ]; + access_token_signed_response_alg = "none"; + userinfo_signed_response_alg = "none"; + token_endpoint_auth_method = "client_secret_post"; + } + { + client_id = "gY0aO8QGJT.~UbRntqa72YTm54DSUHr3HeBu4zMBlWwMwlJwLtbhXflUCAczeC-snr9I_5tZ"; + client_name = "Netbox"; + client_secret = "$pbkdf2-sha512$310000$Hn6tjZ1j.w4M3MK7H5rrDQ$cP1amA8.XD5kvnbgS8VOa8bcHaucuYuiS/ohdpt5gyAIHA7rN9expBt2377rkwd7qAUHO0F8YMjVPx0ihHBLKQ"; + public = false; + authorization_policy = "two_factor"; + require_pkce = false; + pkce_challenge_method = ""; + redirect_uris = [ "https://netbox.e10.camp/oauth/complete/oidc/" ]; + scopes = [ + "openid" + "profile" + "email" + ]; + response_types = [ "code" ]; + grant_types = [ "authorization_code" ]; + access_token_signed_response_alg = "none"; + userinfo_signed_response_alg = "none"; + token_endpoint_auth_method = "client_secret_basic"; + } + { + client_id = "4_PUhlKbm03-XaIAR-tBOzaCkf6dQfhgBY-xnrewL5jsOCp0UXPsbSvnaxgLXEp6kKsqjqND"; + client_name = "Karakeep"; + client_secret = "$pbkdf2-sha512$310000$XuC9/i/.AWXy/G4A/aOazw$ZozktGPjpHfhmjEzdhNsjeLMw/XhbRK/ePqRPfzbTA04pEOlFTOon2s.yWYyuQv5wzCp0QUGHz2gkczfZsetyQ"; + public = false; + authorization_policy = "two_factor"; + require_pkce = false; + pkce_challenge_method = ""; + redirect_uris = "https://karakeep.e10.camp/api/auth/callback/custom"; + scopes = [ + "openid" + "profile" + "email" + ]; + response_types = [ "code" ]; + grant_types = [ "authorization_code" ]; + access_token_signed_response_alg = "none"; + userinfo_signed_response_alg = "none"; + token_endpoint_auth_method = "client_secret_basic"; + claims_policy = "karakeep"; + } + { + client_id = "a8Jy2n_CgUOu~nTlLlkgZQV7xJmhq5aW1N0eNePghiFL0Su5jysCJKOpaEpjvRd7yhhz589E"; + client_name = "Profilarr"; + client_secret = "$pbkdf2-sha512$310000$BY/Aff8ySoJwVwoW5D7rrQ$7NFYYLhlaRyMLQzcheulIVtQtC5YP6rbW7mbMOSsGWBaPs.It/O8lBgKQ3uhlP7wkC0fgjBBqHvk8PEXZ1oTLA"; + public = false; + authorization_policy = "two_factor"; + require_pkce = false; + pkce_challenge_method = ""; + redirect_uris = "https://profilarr.e10.camp/auth/oidc/callback"; + scopes = [ + "openid" + "profile" + "email" + ]; + response_types = [ "code" ]; + grant_types = [ "authorization_code" ]; + access_token_signed_response_alg = "none"; + userinfo_signed_response_alg = "none"; + token_endpoint_auth_method = "client_secret_post"; + } + { + client_id = "NE-kA1k.XTEv8Qe6oywlhfJHJVmLHg0474m3zD2nMjTm.ddl9rnK.Toq1WwetMP-BjYq4K0X"; + client_name = "Incus (Dill)"; + public = true; + authorization_policy = "two_factor"; + require_pkce = false; + pkce_challenge_method = ""; + redirect_uris = [ "https://incus.dill.e10.camp/oidc/callback" ]; + audience = [ "https://incus.dill.e10.camp" ]; + scopes = [ + "openid" + "profile" + "email" + "offline_access" + ]; + response_types = [ "code" ]; + grant_types = [ + "authorization_code" + "refresh_token" + ]; + access_token_signed_response_alg = "RS256"; + userinfo_signed_response_alg = "none"; + token_endpoint_auth_method = "none"; + } + { + client_id = "QAGTWBU5gQ5aemug~ORuMe.J~cZWuqCZbRSIw7il_Eo.nWKR3irBuTLde~IitPzQkwEIfGXI"; + client_name = "OpenCloud"; + public = true; + authorization_policy = "opencloud"; + require_pkce = true; + pkce_challenge_method = "S256"; + redirect_uris = [ + "https://cloud.e10.camp/" + "https://cloud.e10.camp/oidc-callback.html" + "https://cloud.e10.camp/oidc-silent-redirect.html" + ]; + scopes = [ + "openid" + "profile" + "email" + "groups" + "offline_access" + ]; + response_types = [ "code" ]; + grant_types = [ + "authorization_code" + "refresh_token" + ]; + access_token_signed_response_alg = "none"; + userinfo_signed_response_alg = "none"; + token_endpoint_auth_method = "none"; + claims_policy = "opencloud"; + } + { + client_id = "OpenCloudDesktop"; + client_name = "OpenCloud (Desktop)"; + public = true; + authorization_policy = "opencloud"; + require_pkce = true; + pkce_challenge_method = "S256"; + redirect_uris = [ + "http://127.0.0.1" + "http://localhost" + ]; + scopes = [ + "openid" + "profile" + "email" + "groups" + "offline_access" + ]; + response_types = [ "code" ]; + grant_types = [ + "authorization_code" + "refresh_token" + ]; + access_token_signed_response_alg = "none"; + userinfo_signed_response_alg = "none"; + token_endpoint_auth_method = "none"; + claims_policy = "opencloud"; + } + { + client_id = "OpenCloudAndroid"; + client_name = "OpenCloud (Android)"; + public = true; + authorization_policy = "opencloud"; + require_pkce = true; + pkce_challenge_method = "S256"; + redirect_uris = [ "oc://android.opencloud.eu" ]; + scopes = [ + "openid" + "profile" + "email" + "groups" + "offline_access" + ]; + response_types = [ "code" ]; + grant_types = [ + "authorization_code" + "refresh_token" + ]; + access_token_signed_response_alg = "none"; + userinfo_signed_response_alg = "none"; + token_endpoint_auth_method = "none"; + claims_policy = "opencloud"; + } + { + client_id = "OpenCloudIOS"; + client_name = "OpenCloud (iOS)"; + public = true; + authorization_policy = "opencloud"; + require_pkce = true; + pkce_challenge_method = "S256"; + redirect_uris = [ "oc://ios.opencloud.eu" ]; + scopes = [ + "openid" + "profile" + "email" + "groups" + "offline_access" + ]; + response_types = [ "code" ]; + grant_types = [ + "authorization_code" + "refresh_token" + ]; + access_token_signed_response_alg = "none"; + userinfo_signed_response_alg = "none"; + token_endpoint_auth_method = "none"; + claims_policy = "opencloud"; + } + ]; + }; + + session.cookies = [ + { + domain = "e10.camp"; + authelia_url = "https://auth.e10.camp"; + expiration = "1y"; + } + ]; + + access_control.rules = lib.mkBefore [ + { + domain = "*.e10.camp"; + policy = "bypass"; + methods = [ "HEAD" ]; + } + { + domain = "*.e10.camp"; + policy = "one_factor"; + subject = [ "group:service" ]; + } + { + domain = "fileflows.e10.camp"; + policy = "bypass"; + resources = [ + "^/manifest.json" + "^/api([/?].*)?$" + ]; + } + { + domain = "fileflows.e10.camp"; + policy = "two_factor"; + } + { + domain = "fileflows.e10.camp"; + policy = "bypass"; + methods = [ "HEAD" ]; + } + { + domain = "pdf.e10.camp"; + policy = "two_factor"; + } + { + domain = "mazanoke.e10.camp"; + policy = "two_factor"; + } + { + domain = "profilarr.e10.camp"; + policy = "two_factor"; + } + { + domain = "incus.dill.e10.camp"; + policy = "two_factor"; + } + { + domain = "stirling-pdf.e10.camp"; + policy = "two_factor"; + } + ]; + }; + }; + + systemd.services."authelia-${config.networking.hostName}" = { + requires = [ "lldap.service" ]; + after = [ "lldap.service" ]; + }; +} diff --git a/hosts/gateway/profiles/authelia/secrets.yml b/hosts/gateway/profiles/authelia/secrets.yml new file mode 100644 index 00000000..350aa4d0 --- /dev/null +++ b/hosts/gateway/profiles/authelia/secrets.yml @@ -0,0 +1,138 @@ +gateway_authelia_ldap_password: ENC[AES256_GCM,data:EzzZo2osavlDOTWX49uWaaxPsw==,iv:PTXxvXeRosZ7wzlhD2jDgLRaX3hBVe84anus11igLBE=,tag:mdkGeoFGZTqN9uM/R/h7Kg==,type:str] +gateway_authelia_jwt_secret: ENC[AES256_GCM,data:LtU5jdy9YvH3+a313cXp6HDn54CsEIJLEDf4H0FFEbNjrx5Xng3mlxHeyn241zcO2k6sje8kRgVx/U1cooevgLs8mXEN3enzHG3PN6q9OdhJ1Xq0TGnmD4STs2uOuLqaAVxlcLq4jzldavbwqC40ax1Td0QrKCOkyXDNhMHlgcM=,iv:pUcPFsslpUD1j5hyOm0jCIWSabYvGPxsobqHQZ4D6bw=,tag:AUoDYBvnD68u+3aOevQ3fQ==,type:str] +gateway_authelia_storage_encryption_key: ENC[AES256_GCM,data:7Mmxkrwemhaj8xWDLYBt+CtHhzTJy2Yb77UYgPaa1qYl27jYxtyE4nTxRABgFfv+nA5mdhimvtpSsTzJqeQ/uOKAGMof6sEP7Y2LnJWPrl+hnF/iAVhbkbvxQJnjkv6OwoDxbRCIndV85GN+qiG9l+WFFr3/aAQJu+x44++xbkc=,iv:QBi1atd8TAjlW8d3MtvBn4Yezdn/mBtPrL5h+j4Gmkg=,tag:jiKOAJBz9dMl6zIMBwgZvw==,type:str] +gateway_authelia_session_secret: ENC[AES256_GCM,data:rkCWnlmtIexmT4xazkzwSj7hU5t42+Aw4L0B7ri0FROPCWMstPmuvlfeRFn27VJqgDPpcLnoWRM0oLgoSHKeJG34my/Aq7urBpt6DjLcdZZq7+7gfaDih5mtxr9CpagbpsRP6SXjHl4SHes5wzUEDZyvYwMV69ePOB4qJbHss7s=,iv:5wS+VEBLsk1tR/1FXAYWeU1djp8kkP6uYIMBXDklcZI=,tag:/UUKTD3bCOvWGshz5nDMnw==,type:str] +gateway_authelia_oidc_hmac_secret: ENC[AES256_GCM,data:e3YyqyuDeedlXsg2AnR5ZvLvIOfbbHa1vcxPzOhX1SsIZna6/52CLsLTfOxGfQQQ3YYWu4DqDRMP9KB/BGV5yLoepcvenvMgPq6hmrbQ49K1xRiRmhpC7JXqaTeZ1qoh5MrdYuuKy8R++KSmfYJhPAZPDtfzoZ+Q1vrZm6j4Jm4=,iv:+2xA8XTM43Ok3stX1LpcPWZzCUSBaSQVxCMeYQy5fAQ=,tag:YkMlcsSUqniioMFYjxAqRw==,type:str] +gateway_authelia_issuer_private_key: ENC[AES256_GCM,data:y4LNPftCk25HPwB9i9s+esYjQT7eiTotmlFZxaijiNIoZfa5VyDRBczp7v1pA3ler6CGnFQnWMum3badIWrpvm+d2LLCOYc1hvA5S13QZKd0gOZnoZ0N9S1Yh0w3Iyea1Ti0Tb9RpCPPeqeqXKW04yWWpm+VMFc3+oxpIvH7Wm0UCs+fB1g2Izs7RKgXymx2EldYxe4Rel/2m3QxnzoorU1jI6PKhDL405YAYFNDVSER1rU/o/2aJ4mrOv5guBIUhqohRZ6pUOzoRgTLA5bylICTmMdDwAzRb7OFpYMQetNpAVc/aSTbljgbFXiVNQ9M9G3BT7rtqPBXdG+mDFGYMlCOGWedYnDTD3M3AsO1guzoBwor4uEXGprUe+u9n7yQd6qVdsSQEa+kJaLlk38uVFbD4miZb4o4fl+fjIqYmX5lJt8RuAte72zWYzdkwNyG4nzfTzUQR0Dm9k50cE1mHhlJOyfOvvUO3rbRE/iMe6WKPw48C1Ks/yOlTFsdQp4pft3XpLk9itl1HwvPEYH6ymWyj5zVzvacEwKHzTP1zQSpwzEoeHTKuHE+aYCnOjELR74FhwO/jCSCSNzUaAhXqmcsaXEyGRQVZ83XjQBKudvNX5maov1Dv67fflzgzH9bioWLH7Yt7OZHNzV2OmL0eeSJ7zXNQ7H/0siaceoiRR4nb5Ie1BqXBd63cnALpQxfDGvDbVX6AFKTM5usErhFNZkcG5/CZJRugraRYmHS1zI6ezt4GqiCMEAKN2+F48xWAnsstlmn2138QezhwAjT1on+pzyREIaOv3qWTBgHbuo3abm8rAfWR84CPCb5/koolJ/AEMMitSh4+bbJN2SWVTH+nd8XEQA+0B52Oye7EiIVSiWTJXQnbF2FKpiYLmgY4JmzWIG0N7syyzhymeA9W+2WQlB9Es+JEzOQLV8jg813ciJPbO9ib70PU+rO+JZYh2IUN5kXQKdfKnhc9Q/6Il05UflBX742JTNPGAGvLuqiRUFJpYk960BlacXZVwVEKuTaU3wdl1v5RORTEg3GUaJ7EkXHJmpYu5P4FmLQQol8omZhrb1cy8LWV2CxwqyI5L4STz9snsq57nVsX8KEbBuT6Lnk7zQIuH2U4n1NIa/HslUgKJorsugGfhJKU5B1aB6WEz81St9CFs4DurWwO6hHlkgnC+ZMW9w6DN2hLM7eef0nMEAjYrvQwnaHMJ8jfOMptg7WuwjJdnCq0HScbyfjLVxAV7hEf7vlWvmOdIdudcc2KItOhfDMQVlfiIrtVG3hLmAw9Y74JxfY0qua1hZJicZhLl25jgxtXB0UY93BdvsV1RAmBDnvb5rqcs377g4hBkDIi84zs6KduRvU49ASW3/fMEvIvge7/hvaia9FdDzc/Bcah9/zuia1EAsVkg6rXkY6sw4fpbCcHA0IIep7kUb9q/Soj/bGpQdniCMB3qXGfqkTuqasLCm3B2aNuJGLOnW0oOTR8XcW/O/spT+RageyufAhd6P+Qnw5fBUL+ecGiJSrbblGeIQiXVd0lmQyTQ1v76GSSBEdWZhUjDiPv7a8n1QbN1fr81RsCOkJNlD5zeblby1g/enAWlNo0LL05ic8Tg0jFxXdOuQGop0MNv8xHskkTICPuNYR5L8OIFdKXK111JuqfrMKCy4ImXJObkCxNOv44GxHw8cDLu5KOhaqUTW+HpIjNuyb8ZABtmEXj4Q1HmnRG8YiM2AyMqb4lFz+V9noeT3h4V4ZY69HZ0mPg41I2dA45/C3BgmZNBpTyMhPL7SCgZqm3zhFtU1el3Vir5sQbXRLnlrcI6wNUd2P6bT0DOCWS4BGW36zn2R7//1tSYIcmQ6JnGDFdy7WuT0Ib5IopRalycOVr8I/dvyZKI31AHKAEfRau0oAh4hcI/yhlf/iifEKrmArAVl5yyMEg7vH7mfjqFZcGGmk9cPU5eawc0BYaqgFGDLIP0/nFD05zn9u2MMbQDLYzr9NHdANgrP54tbvTLxwhLvGHqAyxZC4FRdAbO2VeV0QZKgxMewE92FNrtTm90MUwNI8TQh9Jv012qupB5V8SB0lBtBLpyUyze7hYWG9QiwYEZ9C0mIl0aUCSbKezd1uKdrsM0zia4PrBsMEM7PgGmvO9jz2wlFD5QkEneETHXqF9eEok+/5U70CWnkuGNWvxGC1UaMA03Uc6eUKI2AVJTPlnvQAm9NDiMT5QKuIVA/bCKhBfVwvzpiH4YeGU9rqpqYmRRELHg69wa5rbBmKDBdDZRDev7SD,iv:BfHo6v/mH7TWZtzYH1JwiLZriPzL6w4RNTsAcWDlWXk=,tag:HDc6HivX81AIC2EeDEbKAA==,type:str] +sops: + age: + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHRTdHcTlPdmRWSFllVVRG + UnF2cGtMQmxia1VXSHgvMnQvK1gvWkp2SkFzCklSVkd4SzVsOHBWSGlnMTlGdWh1 + U0lyVHJiL0lyQkU2R0ppK2k1S3FFK2cKLS0tIHVJN0lqZEwrTVNXc0UwOEFSK2Fz + RTVvN2FUanpKY2tVb1JlLzFlb2JhUVkKTSB3Y8g8olY/Xt8aC+ik10CQ7b5h/hOI + IDYUZwkWzcAvL6kDgBO4oLETawkFHY+RNaynEESHuAqcJTCB2MDWUA== + -----END AGE ENCRYPTED FILE----- + recipient: age10539mc6shf02hpa8huyjktdw3nfyavxdg8pt247wwvq4xrv8h5zs8nc0k0 + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2ZHdsR0Q5MC9aREVKcXVS + eGRJVWdCMFZFai8zWEF1dlhWS1NBY3I1UVI0CmR5ZTZaOXFTOUFDYlE0V25PeDJO + ck1QRWM0WGl4eGY5SUZqSDZ1ZGpnNGcKLS0tIFFCQ05BUUU3d0s0SFU2R3RjalJS + VS9tcEErbi83d24rdTJ5N3dwZmRKNkUKZIusjiQ1usXsdY8shYuXp2Wp0dCRHCVM + 48B8YUFIkGtfwsfNbXHLWSTWuToxqXIBeSmCLysgsOmb70a0yjxOmA== + -----END AGE ENCRYPTED FILE----- + recipient: age1g22ghnrdg858yv6w2ux8hgntj8gkdyjn28axdkmzyx38d4vx6geqj4px9a + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3S1FTV2Zjdy9CZk5heGN2 + c29abEp4dk5GNUpIL29Oa053NHh3V3plNlFjCkg1Wk83ZGNYRDVkSnhuWVp2M3RN + OEZNdGNWR2hRREgxaG5VdEFGZ2RUcGsKLS0tIGpiWWpkK3ZqZFovcjZpQXFPeEVs + MjNMQ3dveUE5OUZEeUpLazk3QUJsV0kKBS6fzXg2WRnQC74fLMM2dd2gBa4vRLaX + X+WknfFKXNd0GUlwKcd+J+pBJuV9JImTQdP3TiWyfcJKN569TlLulw== + -----END AGE ENCRYPTED FILE----- + recipient: age1k5nzxq4ej2u9ls97c2dhlz96j2vghv0assz5g0p4npzyc8c8fqlqld72hg + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDSEpKbDJUV0UwVWIzUGNX + VnFTNTZsNnFhaHM5dkdiK0dRUFZITVVWajBvCmFWd09JOXdOVmFTaTRFYlA5RjUw + aVpmTWd6MmV1QThUald1N09OMUx0WWcKLS0tIE45RTFRcnNzck1BNUhLNjVzWC9q + cDlQcUx4VW12NzhqWTlaZ1locG45TnMKXP2A26YH2cwNBNAY9Cj161HOQWNp/Vct + 0TCGWUwNzJkZJdpQvqOuXWaSCAE9e8efbZTwfKBjaRltApnMuYqYeA== + -----END AGE ENCRYPTED FILE----- + recipient: age1gkzp905yqkla54l52m4xkqtxpn0sndkx0vh6qqa8d2tu29x8f35q354gpe + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2NTEwZk1ZUnNXN3dkTUZv + Nm1WdDJsRkxjSGZ4N0NBYnJGT2tTTytTRW5nCnpRcFJjd0pwckx0UXh6Nm9Ddk1G + MXpCOXpqa3FXN0pORkRDL3labERaQ1EKLS0tIHJ3aWpIRTI1QTdGYTU3T2R5ckZK + RW92RTFGKzRnREdTT1ltb3NMbGhiMlkKnaeiOVhh1ntr4AKysyQ9pa9fpez+sJkJ + MyyBIomMdaBcfOfVre7yYhQl323tzBxM0q77jh+gKCN9ykNCprcUfg== + -----END AGE ENCRYPTED FILE----- + recipient: age1c4d93hmawmx8nt8g2sjrxcngfl7qx7y6vwxpqqg7grrkhjen6fvstljgg9 + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJcVJuV1hQOCs0MzhzZTZr + N0o3WFdHNlRFNE4zRHh3QUxqSVVXZU42NTBNCnZsaENzcWRGSTZ4VE1tdlBuZ1hY + aHFBbDQ3ZkdaaUV6ZHFyY0pVR2VKMkEKLS0tIHF1TnFwSVlHVHpOYVhXcjlOWDUx + RjdZTEZ4VTk0Q0tWRENsSGRpN2Z1WTAKPG1Qv7sKc/GwhFkxIBYY9ZaDKvt7knXg + +Fxsv7MpvsmLjGcyi39gop6xTCPz2OYJMuw5PC21/YKMZKr/Sc42uw== + -----END AGE ENCRYPTED FILE----- + recipient: age15jjykch8km3l8atssu0n9us6d2xg58z0ds9s0djtdh9l954sud5szqxv29 + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3Q1Z0L3hBRUg2Z3NXV1Zs + bFRld2tVQ0J2aVRRUHpyU0xINmlzcVUzQ3pzCktJOG5MMzduZml3cmZGTHBVc1J0 + L0toay9rNytVSFlkbWYydk5uZnhJNnMKLS0tIEo2VWxrTS9GaFcyeTYrRXRtN2Rw + aUhkNmQxcGovYk9XcTZaU0x4TXova1EK6PX7MZBowygoYIc3LTHP/6+1NuQYkdiY + hBRHzVXOI5zLukuaCYthujcVCrJD1rF8Mje1fTZRk0qI146ZWT7hGQ== + -----END AGE ENCRYPTED FILE----- + recipient: age10jhawn266e3wr6rx0lndkl9a47ewtk6jgh35d2582uu2l7dtn4tqdqc29c + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDcFpSczF2Z1QxNFZocWlz + Q3dCZ0RwWVJOYXQyRmo1OUVlcGVzNFQvVWpJCm1YaktHRnZpdUdFSVc2Q3hPZkZB + SDgrbHN6NVR1elQ0MGpRQWZJdE5YQWMKLS0tIEJTdXNiTlYyTzQzNkpsemRER1dL + c0svZm1xSVc1eG50SkJvRW5iSzBGN1UK6UKECSIlo0bzTPu1S/QshHWb/Q75OQFP + idzq3J7K4GJ6PEvspzRhKqinCVeuScmk51BXFO2lxRBK2dJ+IFi5OA== + -----END AGE ENCRYPTED FILE----- + recipient: age1x708x83pjj7urp26pncx67fqz8a3htrf0umw7c00pvmxhl6y95lszjgd6r + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1L0ZxRmZSbDlnZXNpRTFh + NE1MeTczZDNpSlBaNks1RDNpU0cyNzFhcEVJCm5wWlBMYmdzRGJ5Z1VmOFNxTUlt + Z0hLSThCaS9MV0J3aVMzZ3dQbGVnUzQKLS0tIFErMUUrd2JnRHpOelBRRzRvcTcy + aHpwWDVmVG1HalErSnJ0UVlBYS92MFEKacUGzDA+i5ARNhcKXcuhAEoq1a/Y6n/i + Thsi7uKriOa7pY9V5ogx+EqfcKcytF3loOTAv+cJtL0fAwbwmmCZVQ== + -----END AGE ENCRYPTED FILE----- + recipient: age12yvljlgg94z8qfwyezz6mtmrpldxvfcqwzsuyfekszu296fg6upseeyc0t + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPdmNWczAvRi9CemJrcHVE + SmIvY050RXk5WmQzTFpZYmZkdEI2ZTE5cVQwClhOZkk5OEdwcTE4ZGNmMm9oK3or + U3ppZisrTU8zNjlOYVFtZjdYaGVHM0kKLS0tIGFpc0N5Zy9HU0xBZUdmVDN2NnJm + bExka1p6SnFVdmxJd3o4WTFBa1RZZFUK5hFC3KkEuAQKJgb2pX56pcJf2ppb9yjm + 9yXjEgctt52bE4WFLBoge0lMDHimHD94X885u6/X1P6rJH+qywqIqg== + -----END AGE ENCRYPTED FILE----- + recipient: age10zakwy8z5448vj7ur2h7vn8wfzvt2nxwq4pk4wx6cs34mlg58yasdjhc7l + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQYTFDSkJxYXN2NXRpazZ2 + bmJLdndJcS9URk5rY1AvaHFWTER3ZzNjZXlRCkd1TVVxNVdtVHh0bnp0KzlPOXYr + ajhLK2htVUJwTnZQa3pDdDZQYnZyeDgKLS0tIDBHVDd3aU1FcE9aR1loZGQwU3ls + clliQlRVN0lwTytublZtWFJhNlpSbFEKfXgr15y5pBg0zSmaMKxfwfmGoBCSnf7M + bHaL6YTJEsPJUClpOVPnVDoc9/zZZK+g2zRYwUXkqjhLuI6y7nw0Bw== + -----END AGE ENCRYPTED FILE----- + recipient: age10q5gqw4gwts228ayanvalq7c93peqjdsfqcgevd7qr43u5rhnczs9u2ysj + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2TXhCN0F0aUtrdWd3bEZG + R29YMTVDcDFGSy9jZlVtQ2RnRjJDNDVRSzJ3CkZZRmEyY3FrcnMyMDJVc3Z3MmZH + eXZWR2h1RVdET0JMUndvdWRDb09NRHMKLS0tIDJMbUdXeEErVjkxelM3OXRpeVlk + V1I5Ly9SM0kwRXhIanlaRHlKeVVDMUkKa0x3VDxG8HAv7tR3My8Of4MEOgRfa/Mc + Ka0RWmMbwsExRAKBDhwMDzY4CN4WzClSNwsMUAy24Y8YS7YL6UEYdQ== + -----END AGE ENCRYPTED FILE----- + recipient: age1hxynjkmtgcu9lwejchkjfqjp484at589sznqkxk6weucp37p4p7qaj440h + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2QXJTQURUN1duTllRejBz + OTRiSERDbWVzUFo2bU14cXdKSXIwcmpwWFc4CmM2eEs4VjhVM01BaW5aK3ZxQ2JG + Y0hmcVViUnF5V3pxYUVuVk1Od1pXQ0EKLS0tIGpMbG14N2pXcldHZnJGdzBkMHAz + R2RVV1UvTGdheG0yWVlzeldLMHJzOGcK3RN+FRNIo1usuz4xK/XJPPOJVDDBaN14 + qhDaq6dHFv6zWeL/CmvMxHe9LVmy9HaIUYOkmPcWFBmt/zUd+5MPZw== + -----END AGE ENCRYPTED FILE----- + recipient: age1dtf3ahstj5mhzcqf4d2zc54d5dds69ka32dqpmpsskyaz04dtshq9ryxat + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRNFovRmpsejh2UzVENDRk + S3FGL1UrMHpUQzZTdTBoTktGS1VWeDUrQVV3CkFFQzloOUhybnNOWHdOYTh4WlZB + cDBxelVwYkt1Q1NiVmZzOU5aWTN6U2sKLS0tIDZLWHFhbnhSTzlZelVqcUlYTU5q + M05IZytOYnBRQ1FnWHQrK3ZDelBBYTgK/n727RYMShgi8bqGIEaGqz4S0jFVSsyZ + ROl6ffOfG1UTXvifPkqxykbbGW2zUu4u2DCKSU5uQ45aPuYKIPOXwA== + -----END AGE ENCRYPTED FILE----- + recipient: age1px3aq87zcjgts5guc59fqn64zjkqzukdwce4a0ggza83n3atkcws4h5aww + lastmodified: "2026-09-12T01:34:26Z" + mac: ENC[AES256_GCM,data:3NOIYVJ2tb+xzs1caHxHTwbLIIWBMyd2838eeYYMqILvYIMGtQ8hHKUhb64+DfWn+h3PCMiA6mGiv2s8lezrbjsYnntmfiHFUExUEmLwNXn9TLaK0o5Gktr1F87hJFHmWHNxBXoKnSmkMjAih1vvgoXokWIGZqfDn4VAzyuQYkM=,iv:w06moz+cvoTk2v/KNJNL1FtIi58tFppvT/OCBgvm1JI=,tag:omPCLgcWLI3Pmjkv5ObO/w==,type:str] + unencrypted_suffix: _unencrypted + version: 3.13.3 diff --git a/hosts/gateway/profiles/caddy/default.nix b/hosts/gateway/profiles/caddy/default.nix new file mode 100644 index 00000000..4c043be6 --- /dev/null +++ b/hosts/gateway/profiles/caddy/default.nix @@ -0,0 +1,351 @@ +{ + config, + hosts, + lib, + profiles, + ... +}: +let + # Parses a port from an address (e.g., `http://foo.bar:4000` -> `4000`) + portFromAddress = + addr: + lib.pipe addr [ + (lib.strings.splitString ":") + lib.lists.last + lib.strings.toInt + ]; +in +{ + imports = [ profiles.secrets.aws.default ]; + + sops.templates = { + e10_video_lego_route53_credentials = { + content = '' + AWS_ACCESS_KEY_ID="${config.sops.placeholder.aws_access_key_id}" + AWS_SECRET_ACCESS_KEY="${config.sops.placeholder.aws_secret_access_key}" + AWS_REGION=us-east-2 + AWS_HOSTED_ZONE_ID=Z01153052TLZPYRX634V + ''; + }; + }; + + services.caddy = { + virtualHosts = { + "e10.camp" = { + logFormat = '' + output file ${config.services.caddy.logDir}/access-e10.camp.log { + roll_size 1GiB + roll_keep 0 + mode 777 + } + ''; + extraConfig = '' + @webfinger { + path /.well-known/webfinger + method GET HEAD + query rel=http://openid.net/specs/connect/1.0/issuer + } + + handle @webfinger { + templates { + mime application/jrd+json + } + + header { + Content-Type application/jrd+json + Access-Control-Allow-Origin * + X-Robots-Tag noindex + } + + respond < Date: Fri, 11 Sep 2026 23:33:03 -0400 Subject: [PATCH 2/4] Migrate `monitor` to Hetzner --- deploy/terraform/dns.tf | 14 ++--- deploy/terraform/servers.tf | 58 +++++++++++++++++++ hosts/default.nix | 2 +- hosts/gateway/configuration.nix | 3 +- hosts/monitor/configuration.nix | 19 +++++- hosts/monitor/disk-config.nix | 47 +++++++++++++++ hosts/monitor/hardware-configuration.nix | 1 + modules/profiles/monitoring/loki/default.nix | 7 +++ .../profiles/observability/gatus/default.nix | 2 +- modules/suites.nix | 4 ++ 10 files changed, 144 insertions(+), 13 deletions(-) create mode 100644 hosts/monitor/disk-config.nix create mode 100644 hosts/monitor/hardware-configuration.nix diff --git a/deploy/terraform/dns.tf b/deploy/terraform/dns.tf index e6dce914..3db0cbfc 100644 --- a/deploy/terraform/dns.tf +++ b/deploy/terraform/dns.tf @@ -26,7 +26,7 @@ resource "aws_route53_record" "status_e10_video" { name = "status.e10.video" type = "A" ttl = 300 - records = [aws_eip.monitor.public_ip] + records = [hcloud_server.monitor.ipv4_address] } resource "aws_route53_record" "wildcard_e10_video" { @@ -136,7 +136,7 @@ resource "aws_route53_record" "monitor_e10_camp" { name = "monitor.e10.camp" type = "A" ttl = 60 - records = [aws_eip.monitor.public_ip] + records = [hcloud_server.monitor.ipv4_address] } resource "aws_route53_record" "grafana_e10_camp" { @@ -144,7 +144,7 @@ resource "aws_route53_record" "grafana_e10_camp" { name = "grafana.e10.camp" type = "A" ttl = 60 - records = [aws_eip.monitor.public_ip] + records = [hcloud_server.monitor.ipv4_address] } resource "aws_route53_record" "status_e10_camp" { @@ -152,7 +152,7 @@ resource "aws_route53_record" "status_e10_camp" { name = "status.e10.camp" type = "A" ttl = 60 - records = [aws_eip.monitor.public_ip] + records = [hcloud_server.monitor.ipv4_address] } resource "aws_route53_record" "ntfy_e10_camp" { @@ -160,7 +160,7 @@ resource "aws_route53_record" "ntfy_e10_camp" { name = "ntfy.e10.camp" type = "A" ttl = 60 - records = [aws_eip.monitor.public_ip] + records = [hcloud_server.monitor.ipv4_address] } resource "aws_route53_record" "healthchecks_e10_camp" { @@ -168,7 +168,7 @@ resource "aws_route53_record" "healthchecks_e10_camp" { name = "healthchecks.e10.camp" type = "A" ttl = 60 - records = [aws_eip.monitor.public_ip] + records = [hcloud_server.monitor.ipv4_address] } resource "aws_route53_record" "wildcard_e10_camp" { @@ -207,7 +207,7 @@ resource "aws_route53_record" "auth_monitor_e10_camp" { zone_id = aws_route53_zone.e10_camp.zone_id name = "auth.monitor.e10.camp" type = "A" - records = [aws_eip.monitor.public_ip] + records = [hcloud_server.monitor.ipv4_address] ttl = 60 } diff --git a/deploy/terraform/servers.tf b/deploy/terraform/servers.tf index d1f6474a..270ec341 100644 --- a/deploy/terraform/servers.tf +++ b/deploy/terraform/servers.tf @@ -1,3 +1,5 @@ +# gateway + resource "hcloud_server" "gateway" { name = "gateway" @@ -43,3 +45,59 @@ module "gateway_install" { build_on_remote = false } + +# monitor + +resource "hcloud_server" "monitor" { + name = "monitor" + + server_type = "cpx31" + + location = "hil" + + image = "debian-12" + + ssh_keys = [hcloud_ssh_key.deploy.id] + backups = false + + public_net { + ipv4_enabled = true + ipv6_enabled = true + } + + lifecycle { + ignore_changes = [ssh_keys, image] + } +} + +resource "hcloud_volume" "monitor" { + name = "monitor-data" + size = 200 + location = "hil" + format = "ext4" +} + +resource "hcloud_volume_attachment" "monitor" { + volume_id = hcloud_volume.monitor.id + server_id = hcloud_server.monitor.id + automount = false +} + +module "monitor_install" { + source = "github.com/numtide/nixos-anywhere//terraform/install" + + flake = "${abspath("${path.root}/../..")}#monitor" + + target_host = hcloud_server.monitor.ipv4_address + target_user = "root" + + instance_id = hcloud_server.monitor.id + + ssh_private_key = tls_private_key.deploy_key.private_key_openssh + + phases = ["kexec", "disko", "install", "reboot"] + + build_on_remote = false + + depends_on = [hcloud_volume_attachment.monitor] +} diff --git a/hosts/default.nix b/hosts/default.nix index 5c4c607a..58cea270 100644 --- a/hosts/default.nix +++ b/hosts/default.nix @@ -114,7 +114,7 @@ let in { flake.nixosConfigurations = { - monitor = mkHost "monitor" { system = "aarch64-linux"; }; + monitor = mkHost "monitor" { system = "x86_64-linux"; }; omnibus = mkHost "omnibus" { system = "x86_64-linux"; }; htpc = mkHost "htpc" { system = "x86_64-linux"; }; matrix = mkHost "matrix" { system = "x86_64-linux"; }; diff --git a/hosts/gateway/configuration.nix b/hosts/gateway/configuration.nix index e921ff05..734d39ef 100644 --- a/hosts/gateway/configuration.nix +++ b/hosts/gateway/configuration.nix @@ -2,10 +2,10 @@ imports = with suites; core + ++ hcloud ++ web ++ (with profiles; [ security.lldap.default - virtualisation.qemu ]) ++ [ ./profiles/authelia/default.nix @@ -19,7 +19,6 @@ deployment = { vmType = "hcloud"; tags = [ "@external" ]; - targetHost = "5.161.98.131"; }; system.stateVersion = "26.05"; diff --git a/hosts/monitor/configuration.nix b/hosts/monitor/configuration.nix index 5b7fd02d..1100568a 100644 --- a/hosts/monitor/configuration.nix +++ b/hosts/monitor/configuration.nix @@ -2,7 +2,7 @@ imports = with suites; core - ++ aws + ++ hcloud ++ web ++ [ profiles.communications.grafana-to-ntfy.default @@ -25,12 +25,27 @@ ./profiles/prometheus-ping-exporter.nix ./profiles/grafana/default.nix ./profiles/healthchecks/default.nix + ] + ++ [ + ./disk-config.nix + ./hardware-configuration.nix ]; + fileSystems."/var/lib" = { + # Determined after the volume is created + device = "/dev/disk/by-id/scsi-0HC_Volume_106852632"; + fsType = "ext4"; + }; + deployment = { - vmType = "aws-ec2"; + vmType = "hcloud"; tags = [ "@external" ]; }; + services.loki.configuration = { + common.ring.instance_interface_names = [ "enp1s0" ]; + ingester.lifecycler.interface_names = [ "enp1s0" ]; + }; + system.stateVersion = "24.05"; } diff --git a/hosts/monitor/disk-config.nix b/hosts/monitor/disk-config.nix new file mode 100644 index 00000000..05c3cd1c --- /dev/null +++ b/hosts/monitor/disk-config.nix @@ -0,0 +1,47 @@ +{ + disko.devices = { + disk = { + main = { + type = "disk"; + + # Pinned by path, not `/dev/sda`: the data volume is attached before + # disko runs, and sd* ordering between the two isn't guaranteed. By-id + # would be unambiguous too, but its serial is per-server and unknowable + # before the server exists. + # + # This path was read off gateway (cpx11, no volume attached); it is + # assumed, not verified, to be identical on cpx31 with a volume. If it + # differs, disko aborts with "device not found" rather than + # repartitioning the wrong disk, which is the point of pinning it. + device = "/dev/disk/by-path/pci-0000:06:00.0-scsi-0:0:0:0"; + content = { + type = "gpt"; + partitions = { + boot = { + size = "1M"; + type = "EF02"; + priority = 1; + }; + ESP = { + size = "512M"; + type = "EF00"; + content = { + type = "filesystem"; + format = "vfat"; + mountpoint = "/boot"; + }; + }; + root = { + size = "100%"; + content = { + type = "filesystem"; + format = "ext4"; + mountpoint = "/"; + }; + }; + }; + }; + }; + }; + }; +} diff --git a/hosts/monitor/hardware-configuration.nix b/hosts/monitor/hardware-configuration.nix new file mode 100644 index 00000000..ffcd4415 --- /dev/null +++ b/hosts/monitor/hardware-configuration.nix @@ -0,0 +1 @@ +{ } diff --git a/modules/profiles/monitoring/loki/default.nix b/modules/profiles/monitoring/loki/default.nix index c7514b58..fc8ae6b4 100644 --- a/modules/profiles/monitoring/loki/default.nix +++ b/modules/profiles/monitoring/loki/default.nix @@ -34,6 +34,13 @@ server = { http_listen_port = 3100; }; + common = { + ring = { + kvstore = { + store = "memberlist"; + }; + }; + }; ingester = { lifecycler = { address = "0.0.0.0"; diff --git a/modules/profiles/observability/gatus/default.nix b/modules/profiles/observability/gatus/default.nix index ba2c0d52..ba89b894 100644 --- a/modules/profiles/observability/gatus/default.nix +++ b/modules/profiles/observability/gatus/default.nix @@ -319,7 +319,7 @@ in interval = "30s"; conditions = [ "[CONNECTED] == true" - "[RESPONSE_TIME] < 50" + "[RESPONSE_TIME] < 80" ]; extraConfig = { dns = { diff --git a/modules/suites.nix b/modules/suites.nix index bf987c29..28d51862 100644 --- a/modules/suites.nix +++ b/modules/suites.nix @@ -66,6 +66,10 @@ profiles.virtualisation.qemu ]; + hcloud = [ + profiles.virtualisation.qemu + ]; + rpi4 = [ profiles.hardware.rpi4 profiles.filesystems.log2ram From 7c4733f32a6851e52c87f1c76484350cd765d12d Mon Sep 17 00:00:00 2001 From: Ethan Turkeltaub Date: Fri, 11 Sep 2026 23:34:03 -0400 Subject: [PATCH 3/4] Update CI --- .github/workflows/hosts.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/hosts.yml b/.github/workflows/hosts.yml index 97bbd0ac..18acfb6f 100644 --- a/.github/workflows/hosts.yml +++ b/.github/workflows/hosts.yml @@ -42,7 +42,6 @@ jobs: matrix: host: - bastion - - monitor - nut-homelab - nut-network buildQEMUImage: @@ -130,8 +129,10 @@ jobs: - controller - dill - fabricator + - gateway - htpc - matrix + - monitor - omnibus - whirlwind name: Build hosts From b4b15eb701e97ae04209518dc49aa445c58dce52 Mon Sep 17 00:00:00 2001 From: Ethan Turkeltaub Date: Sat, 12 Sep 2026 09:27:07 -0400 Subject: [PATCH 4/4] Remove `bastion` host, destroy EC2-adjacent resources on AWS --- .github/workflows/hosts.yml | 1 - .sops.yaml | 2 - deploy/terraform/dns.tf | 8 - deploy/terraform/instances.tf | 35 -- deploy/terraform/monitoring.tf | 73 ---- deploy/terraform/networking.tf | 44 -- deploy/terraform/security.tf | 90 ---- deploy/terraform/servers.tf | 17 +- .../terraform/servers/monitor-extra-files.sh | 19 + hosts/bastion/configuration.nix | 26 -- hosts/bastion/profiles/authelia/default.nix | 403 ------------------ hosts/bastion/profiles/authelia/secrets.yml | 138 ------ hosts/bastion/profiles/caddy/default.nix | 351 --------------- hosts/bastion/profiles/caddy/secrets.yml | 135 ------ hosts/default.nix | 15 +- hosts/gateway/profiles/authelia/secrets.yml | 139 +++--- hosts/gateway/profiles/caddy/secrets.yml | 139 +++--- hosts/monitor/configuration.nix | 6 - hosts/monitor/profiles/authelia/secrets.yml | 139 +++--- .../profiles/grafana/provisioning/caddy.json | 8 +- hosts/monitor/profiles/grafana/secrets.yml | 139 +++--- .../profiles/healthchecks/secrets.json | 30 +- hosts/monitor/profiles/prometheus.nix | 6 +- modules/nixos/services/restic/default.nix | 2 +- .../profiles/applications/umami/secrets.json | 30 +- .../profiles/backups/restic-rest/secrets.yml | 139 +++--- modules/profiles/backups/restic/secrets.yml | 139 +++--- modules/profiles/backups/restic/system.nix | 1 + .../grafana-to-ntfy/secrets.yml | 139 +++--- .../communications/mosquitto/secrets.json | 30 +- .../profiles/communications/ntfy/secrets.json | 30 +- .../communications/postfix/secrets.yml | 139 +++--- .../home-automation/frigate/secrets.json | 30 +- .../home-assistant/secrets.json | 30 +- .../media-management/bazarr/secrets.yml | 139 +++--- .../media-management/immich/secrets.yml | 139 +++--- .../media-management/profilarr/secrets.json | 30 +- .../media-management/prowlarr/secrets.json | 30 +- .../media-management/sabnzbd/secrets.yml | 139 +++--- .../media-management/tracearr/secrets.yml | 139 +++--- .../monitoring/healthchecks/secrets.json | 30 +- modules/profiles/monitoring/loki/secrets.yml | 139 +++--- .../profiles/monitoring/thanos/secrets.yml | 139 +++--- .../networking/speedtest-tracker/secrets.json | 30 +- .../networking/tailscale/secrets.json | 30 +- .../profiles/nix/remote-builders/secrets.yml | 139 +++--- .../profiles/observability/gatus/default.nix | 16 +- .../profiles/observability/gatus/secrets.json | 30 +- modules/profiles/power/secrets.yml | 139 +++--- modules/profiles/remote-builder/secrets.yml | 139 +++--- modules/profiles/secrets/aws/secrets.json | 30 +- modules/profiles/secrets/radarr/secrets.json | 30 +- modules/profiles/secrets/sonarr/secrets.json | 30 +- .../profiles/security/authelia/secrets.json | 30 +- modules/profiles/security/lldap/secrets.yml | 139 +++--- .../services/attic-watch-store/secrets.yml | 139 +++--- modules/profiles/services/atticd/secrets.yml | 139 +++--- .../services/cachix-watch-store/secrets.json | 30 +- .../profiles/services/karakeep/secrets.json | 30 +- .../profiles/services/miniflux/secrets.yml | 139 +++--- modules/profiles/services/netbox/secrets.json | 30 +- .../profiles/services/opencloud/secrets.json | 30 +- .../profiles/services/paperless/secrets.yml | 139 +++--- .../prometheus-plex-exporter/secrets.json | 30 +- .../prometheus-pve-exporter/secrets.yml | 139 +++--- .../profiles/telemetry/unpoller/secrets.json | 30 +- secrets.json | 30 +- 67 files changed, 1839 insertions(+), 3444 deletions(-) delete mode 100644 deploy/terraform/instances.tf delete mode 100644 deploy/terraform/monitoring.tf delete mode 100644 deploy/terraform/security.tf create mode 100755 deploy/terraform/servers/monitor-extra-files.sh delete mode 100644 hosts/bastion/configuration.nix delete mode 100644 hosts/bastion/profiles/authelia/default.nix delete mode 100644 hosts/bastion/profiles/authelia/secrets.yml delete mode 100644 hosts/bastion/profiles/caddy/default.nix delete mode 100644 hosts/bastion/profiles/caddy/secrets.yml diff --git a/.github/workflows/hosts.yml b/.github/workflows/hosts.yml index 18acfb6f..6000328b 100644 --- a/.github/workflows/hosts.yml +++ b/.github/workflows/hosts.yml @@ -41,7 +41,6 @@ jobs: strategy: matrix: host: - - bastion - nut-homelab - nut-network buildQEMUImage: diff --git a/.sops.yaml b/.sops.yaml index 5305d545..4fd38f4a 100644 --- a/.sops.yaml +++ b/.sops.yaml @@ -1,6 +1,5 @@ keys: - &user_ethnt age10539mc6shf02hpa8huyjktdw3nfyavxdg8pt247wwvq4xrv8h5zs8nc0k0 - - &host_bastion age1x708x83pjj7urp26pncx67fqz8a3htrf0umw7c00pvmxhl6y95lszjgd6r - &host_monitor age1g22ghnrdg858yv6w2ux8hgntj8gkdyjn28axdkmzyx38d4vx6geqj4px9a - &host_omnibus age1k5nzxq4ej2u9ls97c2dhlz96j2vghv0assz5g0p4npzyc8c8fqlqld72hg - &host_htpc age1gkzp905yqkla54l52m4xkqtxpn0sndkx0vh6qqa8d2tu29x8f35q354gpe @@ -25,7 +24,6 @@ creation_rules: - *host_matrix - *host_controller - *host_builder - - *host_bastion - *host_dill - *host_fabricator - *host_nut_network diff --git a/deploy/terraform/dns.tf b/deploy/terraform/dns.tf index 3db0cbfc..7ccb8c4e 100644 --- a/deploy/terraform/dns.tf +++ b/deploy/terraform/dns.tf @@ -115,14 +115,6 @@ resource "aws_route53_record" "root_e10_camp" { records = [hcloud_server.gateway.ipv4_address] } -resource "aws_route53_record" "bastion_e10_camp" { - zone_id = aws_route53_zone.e10_camp.zone_id - name = "bastion.e10.camp" - type = "A" - ttl = 300 - records = [aws_eip.bastion.public_ip] -} - resource "aws_route53_record" "gateway_e10_camp" { zone_id = aws_route53_zone.e10_camp.zone_id name = "gateway.e10.camp" diff --git a/deploy/terraform/instances.tf b/deploy/terraform/instances.tf deleted file mode 100644 index 881096cb..00000000 --- a/deploy/terraform/instances.tf +++ /dev/null @@ -1,35 +0,0 @@ -resource "aws_instance" "bastion" { - ami = var.aws_ami_nixos_arm64 - instance_type = "t4g.small" - vpc_security_group_ids = [aws_security_group.common.id, aws_security_group.bastion.id] - key_name = aws_key_pair.deploy_key.key_name - subnet_id = aws_subnet.public_subnet.id - - root_block_device { - volume_size = 64 - volume_type = "gp2" - delete_on_termination = false - } - - tags = { - Name = "bastion" - } -} - -resource "aws_instance" "monitor" { - ami = var.aws_ami_nixos_arm64 - instance_type = "t4g.medium" - vpc_security_group_ids = [aws_security_group.common.id, aws_security_group.monitor.id] - key_name = aws_key_pair.deploy_key.key_name - subnet_id = aws_subnet.public_subnet.id - - root_block_device { - volume_size = 256 - volume_type = "gp2" - delete_on_termination = false - } - - tags = { - Name = "monitor" - } -} diff --git a/deploy/terraform/monitoring.tf b/deploy/terraform/monitoring.tf deleted file mode 100644 index b7da79c6..00000000 --- a/deploy/terraform/monitoring.tf +++ /dev/null @@ -1,73 +0,0 @@ -locals { - aws_instances = { - monitor = aws_instance.monitor, - bastion = aws_instance.bastion - } -} - -resource "aws_sns_topic" "ec2_alerts" { - name = "ec2-alerts" -} - -resource "aws_sns_topic_subscription" "email_notification" { - topic_arn = aws_sns_topic.ec2_alerts.arn - protocol = "email" - endpoint = "e10@turkeltaub.dev" -} - -resource "aws_cloudwatch_metric_alarm" "status_check" { - for_each = local.aws_instances - - alarm_name = "${each.key}-status-check-failed" - comparison_operator = "GreaterThanThreshold" - evaluation_periods = 2 - metric_name = "StatusCheckFailed" - namespace = "AWS/EC2" - period = "60" - statistic = "Maximum" - threshold = "0" - alarm_actions = [aws_sns_topic.ec2_alerts.arn] - ok_actions = [aws_sns_topic.ec2_alerts.arn] - - dimensions = { - InstanceId = each.value.id - } -} - -resource "aws_cloudwatch_metric_alarm" "system_status_check" { - for_each = local.aws_instances - - alarm_name = "${each.key}-system-status-check-failed" - comparison_operator = "GreaterThanThreshold" - evaluation_periods = 2 - metric_name = "StatusCheckFailed_System" - namespace = "AWS/EC2" - period = "60" - statistic = "Maximum" - threshold = "0" - alarm_actions = [aws_sns_topic.ec2_alerts.arn] - ok_actions = [aws_sns_topic.ec2_alerts.arn] - - dimensions = { - InstanceId = each.value.id - } -} - -resource "aws_cloudwatch_metric_alarm" "instance_status_check" { - for_each = local.aws_instances - - alarm_name = "${each.key}-instance-status-check-failed" - comparison_operator = "GreaterThanThreshold" - evaluation_periods = 2 - metric_name = "StatusCheckFailed_System" - namespace = "AWS/EC2" - period = "60" - statistic = "Maximum" - threshold = "0" - alarm_actions = [aws_sns_topic.ec2_alerts.arn] - ok_actions = [aws_sns_topic.ec2_alerts.arn] - - dimensions = { - InstanceId = each.value.id - } -} diff --git a/deploy/terraform/networking.tf b/deploy/terraform/networking.tf index 5be63a26..5c8006b7 100644 --- a/deploy/terraform/networking.tf +++ b/deploy/terraform/networking.tf @@ -1,47 +1,3 @@ -resource "aws_vpc" "vpc" { - cidr_block = "10.0.0.0/16" - enable_dns_support = true - enable_dns_hostnames = true - instance_tenancy = "default" -} - -resource "aws_subnet" "public_subnet" { - vpc_id = aws_vpc.vpc.id - cidr_block = "10.0.1.0/24" - map_public_ip_on_launch = true - availability_zone = var.availability_zone -} - -resource "aws_internet_gateway" "igw" { - vpc_id = aws_vpc.vpc.id -} - -resource "aws_route_table" "public_route_table" { - vpc_id = aws_vpc.vpc.id - - route { - cidr_block = "0.0.0.0/0" - gateway_id = aws_internet_gateway.igw.id - } -} - -resource "aws_route_table_association" "public_route_table_subnet_association" { - subnet_id = aws_subnet.public_subnet.id - route_table_id = aws_route_table.public_route_table.id -} - -resource "aws_eip" "bastion" { - instance = aws_instance.bastion.id - - depends_on = [aws_internet_gateway.igw] -} - -resource "aws_eip" "monitor" { - instance = aws_instance.monitor.id - - depends_on = [aws_internet_gateway.igw] -} - resource "hcloud_network" "private_network" { name = "private-network" ip_range = "172.16.0.0/16" diff --git a/deploy/terraform/security.tf b/deploy/terraform/security.tf deleted file mode 100644 index 24785f79..00000000 --- a/deploy/terraform/security.tf +++ /dev/null @@ -1,90 +0,0 @@ -resource "aws_security_group" "common" { - vpc_id = aws_vpc.vpc.id - - ingress { - description = "Allow ping" - from_port = 8 - to_port = 0 - protocol = "icmp" - cidr_blocks = ["0.0.0.0/0"] - } - - ingress { - description = "Allow SSH" - from_port = 22 - to_port = 22 - protocol = "tcp" - cidr_blocks = ["0.0.0.0/0"] - } - - ingress { - description = "Allow Mosh" - from_port = 60000 - to_port = 61000 - protocol = "udp" - cidr_blocks = ["0.0.0.0/0"] - } - - ingress { - description = "Allow Prometheus Node Exporter" - from_port = 9100 - to_port = 9100 - protocol = "tcp" - cidr_blocks = ["0.0.0.0/0"] - } - - egress { - from_port = 0 - to_port = 0 - protocol = "-1" - cidr_blocks = ["0.0.0.0/0"] - } -} - -resource "aws_security_group" "bastion" { - vpc_id = aws_vpc.vpc.id - - ingress { - description = "Allow HTTP" - from_port = 80 - to_port = 80 - protocol = "tcp" - cidr_blocks = ["0.0.0.0/0"] - } - - ingress { - description = "Allow HTTPS" - from_port = 443 - to_port = 443 - protocol = "tcp" - cidr_blocks = ["0.0.0.0/0"] - } -} - -resource "aws_security_group" "monitor" { - vpc_id = aws_vpc.vpc.id - - ingress { - description = "Allow HTTP" - from_port = 80 - to_port = 80 - protocol = "tcp" - cidr_blocks = ["0.0.0.0/0"] - } - - ingress { - description = "Allow HTTPS" - from_port = 443 - to_port = 443 - protocol = "tcp" - cidr_blocks = ["0.0.0.0/0"] - } - - ingress { - description = "Allow rsyslogd" - from_port = 514 - to_port = 514 - protocol = "udp" - cidr_blocks = ["0.0.0.0/0"] - } -} diff --git a/deploy/terraform/servers.tf b/deploy/terraform/servers.tf index 270ec341..1759a852 100644 --- a/deploy/terraform/servers.tf +++ b/deploy/terraform/servers.tf @@ -51,7 +51,7 @@ module "gateway_install" { resource "hcloud_server" "monitor" { name = "monitor" - server_type = "cpx31" + server_type = "cpx21" location = "hil" @@ -70,19 +70,6 @@ resource "hcloud_server" "monitor" { } } -resource "hcloud_volume" "monitor" { - name = "monitor-data" - size = 200 - location = "hil" - format = "ext4" -} - -resource "hcloud_volume_attachment" "monitor" { - volume_id = hcloud_volume.monitor.id - server_id = hcloud_server.monitor.id - automount = false -} - module "monitor_install" { source = "github.com/numtide/nixos-anywhere//terraform/install" @@ -99,5 +86,5 @@ module "monitor_install" { build_on_remote = false - depends_on = [hcloud_volume_attachment.monitor] + extra_files_script = abspath("${path.root}/servers/monitor-extra-files.sh") } diff --git a/deploy/terraform/servers/monitor-extra-files.sh b/deploy/terraform/servers/monitor-extra-files.sh new file mode 100755 index 00000000..7d3efbb5 --- /dev/null +++ b/deploy/terraform/servers/monitor-extra-files.sh @@ -0,0 +1,19 @@ +#!/usr/bin/env bash + +# Seeds monitor's SSH host key into the freshly installed system + +set -euo pipefail + +SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" +KEY="${SCRIPT_DIR}/../../tmp/monitor_ssh_host_ed25519_key" + +if [[ ! -f ${KEY} ]]; then + echo "host key not found at ${KEY}" >&2 + exit 1 +fi + +mkdir -p etc/ssh + +install -m 0600 "${KEY}" ./etc/ssh/ssh_host_ed25519_key +ssh-keygen -y -f ./etc/ssh/ssh_host_ed25519_key >./etc/ssh/ssh_host_ed25519_key.pub +chmod 0644 ./etc/ssh/ssh_host_ed25519_key.pub diff --git a/hosts/bastion/configuration.nix b/hosts/bastion/configuration.nix deleted file mode 100644 index c697d31c..00000000 --- a/hosts/bastion/configuration.nix +++ /dev/null @@ -1,26 +0,0 @@ -{ - suites, - profiles, - secrets, - ... -}: -{ - imports = - with suites; - core - ++ aws - ++ web - ++ (with profiles; [ security.lldap.default ]) - ++ [ - ./profiles/authelia - ./profiles/caddy - ] - ++ [ secrets.hosts.bastion.configuration ]; - - deployment = { - vmType = "aws-ec2"; - tags = [ "@external" ]; - }; - - system.stateVersion = "25.05"; -} diff --git a/hosts/bastion/profiles/authelia/default.nix b/hosts/bastion/profiles/authelia/default.nix deleted file mode 100644 index 0cd43281..00000000 --- a/hosts/bastion/profiles/authelia/default.nix +++ /dev/null @@ -1,403 +0,0 @@ -{ - config, - lib, - profiles, - ... -}: -{ - imports = [ profiles.security.authelia.default ]; - - sops.secrets = - let - secretConfig = { - sopsFile = ./secrets.yml; - format = "yaml"; - owner = config.services.authelia.instances.${config.networking.hostName}.user; - }; - in - { - bastion_authelia_ldap_password = secretConfig; - bastion_authelia_jwt_secret = secretConfig; - bastion_authelia_storage_encryption_key = secretConfig; - bastion_authelia_session_secret = secretConfig; - bastion_authelia_oidc_hmac_secret = secretConfig; - bastion_authelia_issuer_private_key = secretConfig; - }; - - services.authelia.instances.${config.networking.hostName} = { - secrets = { - jwtSecretFile = config.sops.secrets.bastion_authelia_jwt_secret.path; - storageEncryptionKeyFile = config.sops.secrets.bastion_authelia_storage_encryption_key.path; - sessionSecretFile = config.sops.secrets.bastion_authelia_session_secret.path; - - # NOTE: These need to be commented out if there are no OIDC clients present, otherwise Authelia will fail to start - oidcHmacSecretFile = config.sops.secrets.bastion_authelia_oidc_hmac_secret.path; - oidcIssuerPrivateKeyFile = config.sops.secrets.bastion_authelia_issuer_private_key.path; - }; - - environmentVariables.AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PASSWORD_FILE = - config.sops.secrets.bastion_authelia_ldap_password.path; - - settings = { - authentication_backend.ldap = { - address = "ldap://localhost:${toString config.services.lldap.settings.ldap_port}"; - base_dn = "dc=e10,dc=camp"; - users_filter = "(&({username_attribute}={input})(objectClass=person))"; - groups_filter = "(member={dn})"; - user = "uid=authelia,ou=people,dc=e10,dc=camp"; - }; - - identity_providers.oidc = { - cors = { - endpoints = [ - "authorization" - "token" - "revocation" - "introspection" - "userinfo" - ]; - allowed_origins = [ "https://cloud.e10.camp" ]; - }; - - authorization_policies = { - opencloud = { - default_policy = "deny"; - rules = [ - { - policy = "one_factor"; - subject = [ - "group:opencloud_users" - "group:opencloud_admins" - ]; - } - ]; - }; - }; - - claims_policies = { - karakeep.id_token = [ "email" ]; - opencloud.id_token = [ - "email" - "preferred_username" - "name" - "groups" - ]; - legacy.id_token = [ - "email" - "email_verified" - "preferred_username" - "name" - ]; - }; - - clients = [ - { - client_name = "Paperless"; - client_id = "viHFkj_wnehAVrf2U-2cE1~RDKGEO2iawDGTJuOSLKiEt_vKBiADlhSLyjI1LsA8T6DO0Vy8"; - client_secret = "$pbkdf2-sha512$310000$qb7YshuNG.nvIev7OWvSyg$/nWmyxm0xxZG1mbCczkI9.Oi6lbrXd.BbsNXJU91p5nSYJGHTuN2OryQksEMK9ypCst.UYn6.q7HK/2YBstE.A"; - public = false; - authorization_policy = "two_factor"; - require_pkce = true; - pkce_challenge_method = "S256"; - redirect_uris = [ - "https://paperless.e10.camp/accounts/oidc/authelia/login/callback/" - ]; - scopes = [ - "openid" - "profile" - "email" - "groups" - ]; - response_types = [ "code" ]; - grant_types = [ "authorization_code" ]; - access_token_signed_response_alg = "none"; - userinfo_signed_response_alg = "none"; - token_endpoint_auth_method = "client_secret_basic"; - } - { - client_id = "DpimJHTYr-K1ba5dFHj6mlRPXxkQCTN3E3RGljCmVXlGs.AcDdWwG9sysfV~Bv3vq7Z1rEEm"; - client_name = "Immich"; - client_secret = "$pbkdf2-sha512$310000$Fu.EoQ7p6UrQw9Z9mtY6sQ$YTh3csT6xxlXE1YotyWX2HNI0H6wRgq3x0jnkHWu93UYtHUlCRfkeBVKcbplx0sPCwBVVYeyA4gLeByyaL.iZg"; - public = false; - authorization_policy = "two_factor"; - require_pkce = false; - pkce_challenge_method = ""; - redirect_uris = [ - "app.immich:///oauth-callback" - "http://matrix:2283/auth/login" - "http://matrix:2283/user-settings" - "https://immich.e10.camp/api/oauth/mobile-redirect" - "https://immich.e10.camp/auth/login" - "https://immich.e10.camp/user-settings" - ]; - scopes = [ - "openid" - "profile" - "email" - ]; - response_types = [ "code" ]; - grant_types = [ "authorization_code" ]; - access_token_signed_response_alg = "none"; - userinfo_signed_response_alg = "none"; - token_endpoint_auth_method = "client_secret_post"; - } - { - client_id = "gY0aO8QGJT.~UbRntqa72YTm54DSUHr3HeBu4zMBlWwMwlJwLtbhXflUCAczeC-snr9I_5tZ"; - client_name = "Netbox"; - client_secret = "$pbkdf2-sha512$310000$Hn6tjZ1j.w4M3MK7H5rrDQ$cP1amA8.XD5kvnbgS8VOa8bcHaucuYuiS/ohdpt5gyAIHA7rN9expBt2377rkwd7qAUHO0F8YMjVPx0ihHBLKQ"; - public = false; - authorization_policy = "two_factor"; - require_pkce = false; - pkce_challenge_method = ""; - redirect_uris = [ "https://netbox.e10.camp/oauth/complete/oidc/" ]; - scopes = [ - "openid" - "profile" - "email" - ]; - response_types = [ "code" ]; - grant_types = [ "authorization_code" ]; - access_token_signed_response_alg = "none"; - userinfo_signed_response_alg = "none"; - token_endpoint_auth_method = "client_secret_basic"; - } - { - client_id = "4_PUhlKbm03-XaIAR-tBOzaCkf6dQfhgBY-xnrewL5jsOCp0UXPsbSvnaxgLXEp6kKsqjqND"; - client_name = "Karakeep"; - client_secret = "$pbkdf2-sha512$310000$XuC9/i/.AWXy/G4A/aOazw$ZozktGPjpHfhmjEzdhNsjeLMw/XhbRK/ePqRPfzbTA04pEOlFTOon2s.yWYyuQv5wzCp0QUGHz2gkczfZsetyQ"; - public = false; - authorization_policy = "two_factor"; - require_pkce = false; - pkce_challenge_method = ""; - redirect_uris = "https://karakeep.e10.camp/api/auth/callback/custom"; - scopes = [ - "openid" - "profile" - "email" - ]; - response_types = [ "code" ]; - grant_types = [ "authorization_code" ]; - access_token_signed_response_alg = "none"; - userinfo_signed_response_alg = "none"; - token_endpoint_auth_method = "client_secret_basic"; - claims_policy = "karakeep"; - } - { - client_id = "a8Jy2n_CgUOu~nTlLlkgZQV7xJmhq5aW1N0eNePghiFL0Su5jysCJKOpaEpjvRd7yhhz589E"; - client_name = "Profilarr"; - client_secret = "$pbkdf2-sha512$310000$BY/Aff8ySoJwVwoW5D7rrQ$7NFYYLhlaRyMLQzcheulIVtQtC5YP6rbW7mbMOSsGWBaPs.It/O8lBgKQ3uhlP7wkC0fgjBBqHvk8PEXZ1oTLA"; - public = false; - authorization_policy = "two_factor"; - require_pkce = false; - pkce_challenge_method = ""; - redirect_uris = "https://profilarr.e10.camp/auth/oidc/callback"; - scopes = [ - "openid" - "profile" - "email" - ]; - response_types = [ "code" ]; - grant_types = [ "authorization_code" ]; - access_token_signed_response_alg = "none"; - userinfo_signed_response_alg = "none"; - token_endpoint_auth_method = "client_secret_post"; - } - { - client_id = "NE-kA1k.XTEv8Qe6oywlhfJHJVmLHg0474m3zD2nMjTm.ddl9rnK.Toq1WwetMP-BjYq4K0X"; - client_name = "Incus (Dill)"; - public = true; - authorization_policy = "two_factor"; - require_pkce = false; - pkce_challenge_method = ""; - redirect_uris = [ "https://incus.dill.e10.camp/oidc/callback" ]; - audience = [ "https://incus.dill.e10.camp" ]; - scopes = [ - "openid" - "profile" - "email" - "offline_access" - ]; - response_types = [ "code" ]; - grant_types = [ - "authorization_code" - "refresh_token" - ]; - access_token_signed_response_alg = "RS256"; - userinfo_signed_response_alg = "none"; - token_endpoint_auth_method = "none"; - } - { - client_id = "QAGTWBU5gQ5aemug~ORuMe.J~cZWuqCZbRSIw7il_Eo.nWKR3irBuTLde~IitPzQkwEIfGXI"; - client_name = "OpenCloud"; - public = true; - authorization_policy = "opencloud"; - require_pkce = true; - pkce_challenge_method = "S256"; - redirect_uris = [ - "https://cloud.e10.camp/" - "https://cloud.e10.camp/oidc-callback.html" - "https://cloud.e10.camp/oidc-silent-redirect.html" - ]; - scopes = [ - "openid" - "profile" - "email" - "groups" - "offline_access" - ]; - response_types = [ "code" ]; - grant_types = [ - "authorization_code" - "refresh_token" - ]; - access_token_signed_response_alg = "none"; - userinfo_signed_response_alg = "none"; - token_endpoint_auth_method = "none"; - claims_policy = "opencloud"; - } - { - client_id = "OpenCloudDesktop"; - client_name = "OpenCloud (Desktop)"; - public = true; - authorization_policy = "opencloud"; - require_pkce = true; - pkce_challenge_method = "S256"; - redirect_uris = [ - "http://127.0.0.1" - "http://localhost" - ]; - scopes = [ - "openid" - "profile" - "email" - "groups" - "offline_access" - ]; - response_types = [ "code" ]; - grant_types = [ - "authorization_code" - "refresh_token" - ]; - access_token_signed_response_alg = "none"; - userinfo_signed_response_alg = "none"; - token_endpoint_auth_method = "none"; - claims_policy = "opencloud"; - } - { - client_id = "OpenCloudAndroid"; - client_name = "OpenCloud (Android)"; - public = true; - authorization_policy = "opencloud"; - require_pkce = true; - pkce_challenge_method = "S256"; - redirect_uris = [ "oc://android.opencloud.eu" ]; - scopes = [ - "openid" - "profile" - "email" - "groups" - "offline_access" - ]; - response_types = [ "code" ]; - grant_types = [ - "authorization_code" - "refresh_token" - ]; - access_token_signed_response_alg = "none"; - userinfo_signed_response_alg = "none"; - token_endpoint_auth_method = "none"; - claims_policy = "opencloud"; - } - { - client_id = "OpenCloudIOS"; - client_name = "OpenCloud (iOS)"; - public = true; - authorization_policy = "opencloud"; - require_pkce = true; - pkce_challenge_method = "S256"; - redirect_uris = [ "oc://ios.opencloud.eu" ]; - scopes = [ - "openid" - "profile" - "email" - "groups" - "offline_access" - ]; - response_types = [ "code" ]; - grant_types = [ - "authorization_code" - "refresh_token" - ]; - access_token_signed_response_alg = "none"; - userinfo_signed_response_alg = "none"; - token_endpoint_auth_method = "none"; - claims_policy = "opencloud"; - } - ]; - }; - - session.cookies = [ - { - domain = "e10.camp"; - authelia_url = "https://auth.e10.camp"; - expiration = "1y"; - } - ]; - - access_control.rules = lib.mkBefore [ - { - domain = "*.e10.camp"; - policy = "bypass"; - methods = [ "HEAD" ]; - } - { - domain = "*.e10.camp"; - policy = "one_factor"; - subject = [ "group:service" ]; - } - { - domain = "fileflows.e10.camp"; - policy = "bypass"; - resources = [ - "^/manifest.json" - "^/api([/?].*)?$" - ]; - } - { - domain = "fileflows.e10.camp"; - policy = "two_factor"; - } - { - domain = "fileflows.e10.camp"; - policy = "bypass"; - methods = [ "HEAD" ]; - } - { - domain = "pdf.e10.camp"; - policy = "two_factor"; - } - { - domain = "mazanoke.e10.camp"; - policy = "two_factor"; - } - { - domain = "profilarr.e10.camp"; - policy = "two_factor"; - } - { - domain = "incus.dill.e10.camp"; - policy = "two_factor"; - } - { - domain = "stirling-pdf.e10.camp"; - policy = "two_factor"; - } - ]; - }; - }; - - systemd.services."authelia-${config.networking.hostName}" = { - requires = [ "lldap.service" ]; - after = [ "lldap.service" ]; - }; -} diff --git a/hosts/bastion/profiles/authelia/secrets.yml b/hosts/bastion/profiles/authelia/secrets.yml deleted file mode 100644 index 399913f9..00000000 --- a/hosts/bastion/profiles/authelia/secrets.yml +++ /dev/null @@ -1,138 +0,0 @@ -bastion_authelia_ldap_password: ENC[AES256_GCM,data:kRoi9V5DUYLSQ7C3Br4clthe7A==,iv:S3k1chk92AW44b8/9F7qeDGQh7Gzp6Hp3OxedQgkWuI=,tag:2hstdhwI171ahZnTIEtzIA==,type:str] -bastion_authelia_jwt_secret: ENC[AES256_GCM,data:w9D9E4xc7TeCXEw4JGA9YpdeFglwaHpxHTG+VGAiils0MUwXnacHHgesGh1Ny+RbvN8KLSAMpU8VGpeXKo8V+RZHWHr3fVlfOCMqA39fySdC3yZfgNLxRn+9qksgC6P2HRDV4QOD7pbOA0mqYTKEfgOasgraBmMYMqPrHJR9K1s=,iv:JyA3zWzEw/VQK0v7DCJb/nPGfV/Z7Qm1mTs0WMqHcLc=,tag:GOHbucj1xbf34GTgRa0EmQ==,type:str] -bastion_authelia_storage_encryption_key: ENC[AES256_GCM,data:pc63o/v1TXraww9U2aoN89Qj7a4Vx4fLhGat5UE12mwq3DQVAAFGNl2Ks98XYGEMfplOajbqqae419rFZc0GYJEmE/l3vzAUMntPOpKOR0ZWq+WrxzS1JndCaclMsJTE5KXHuC+RpTv4F6XVmCC/7n8d3RCNvP16h4qnN1uIyRw=,iv:StpJUMUFz7WKFHQ/ose5H3lz/RDJFhhLOJTfFIBCdNA=,tag:0STv+CWAv1w+3zjBbVMVcQ==,type:str] -bastion_authelia_session_secret: ENC[AES256_GCM,data:BesmLiCCYMUnY5BUPEI4fjTNmqw+9J/tCNJ6mTWV8SIOs7RXGlehIA4nVzXbmOR9M+qW7UF6XtHmqr9M9cMoqhlBbcgV0tHRtx4/ibSPUkZK75ingscOb8XZJ/42+pL5HfitQtJokyfpglPfZDgkrxzDjOdoDTAGwQMzk63FPhk=,iv:KZ9XDmCexcDYZ/yWnUqkpb2tKYj44PLZhy62eDXpqRY=,tag:reX39tJCwq1e61HWud6O/w==,type:str] -bastion_authelia_oidc_hmac_secret: ENC[AES256_GCM,data:G+3ykRw8jWITZgmbArmD2hblYtM+RBA1PvQEp/abDihjWgdQrTIC0Hd3b63kPQhiwW8ZlecAxg9GY0/KA+MYZHd0s6T6TxFVvxO5O118CvInqLcQbLvO+qBsM3JRD1t9UPRgCWmvSsTGyoahDxro2ZKcBW33o/gOktDrBg0enMg=,iv:TB7HXLe4vLRO1bSjkQddHLjf58j9ZO0DlYrH2wCdwlU=,tag:o62s6tdXVGC5JuP/FPC9QA==,type:str] -bastion_authelia_issuer_private_key: ENC[AES256_GCM,data:WK5sMH3ObmhX2B2enSVyoreQurpnK9dNVQ8pmROzoCraejd1160xUjwWsAWSwe3jd1PKM+KO5wf7K7FAboLCJbSiM+J4xoAiLDSA8vlcttnBUfNZCo1EDXNAQaxvgPNuZftdcuooy92GCHe3q6hwfnfXHFLXRI/6U0K6MZovKR2rojpjZoJLgVT8J8Mon+LZDFeO1Vv0a0jbbP0JWdjadlaphIlSsJjSFNHuODRhZMoWm/aE1cKEIwLZyu8CiU02/MHzkxU82cJVEnCd2NFVApI7BRo6k/zS8O/lkFa2ye/VG+RAkWPlHudzjvuppaTxWiG4Jz0/002Mbu1KbKI9k5bz4o8SSojOMdSyxOjt5GvbOsKW7aSL91kbZ9MjNLaUwFN5wcvjz4P45rEuo2UUzkkL+h2yooMgJpW/JgMHNbfL3tg9dvYZri0I/eB67MpryCuALRZSpX7EeBBv/U0vIS3G1X+a/xIdKVAlpSekZ0Z0yyTfBLrnQj8biMNsBs9lKX7q4OeI6Q5uG5gydamH/NWcpliFINfY+gRo1ESuLxGKbue1KdHI+hfmILWUAwQ0bdBnr+fy2JK8fS+yDC+yJn6HazElKyj5r41O/eWBrq9QlOOffgWaOZJsNPrhEACGg2QHzlA7sDfhu8rFSe3tTFgn0yjx1IsAZVygtrvNs4FMWVq2XQt9/flwGF+MxjVzbeJbLkd5BUs1uGM4s8ZzI8rDxx3Pq5KOGZ3whUvj3rKc0SfToq/c913hFGyjcm/MKYpdTHkyWGgzEGLuVzMlMNsWsFhXtBPEGFXwj7yg86iC+agcdt0aK2kCQJ4sKb4nSLalX7scXFp7DYloyweVozDmScXJNrgYw2vU6UlqJurQDpCG63JQG4GiIR05qZD3yC7wJgjQFVzuuKa5pslM1WiiNyCpXH1AJYEQP6h66IRTI6oalzuG8HLHQKGbOL3XHVzVb/K+ZWaSoaw4aSnLVoys2kHa0QV/ZaV+2AZr+w6NASqGE29gw8QcjbgvlCXMT/AodDqZ1YvEOhubWeICDyWgI5AWvkGwJlcgMiudj9Cczt8nUi0SoUD86gFFsCBEGs1kcL0P3JIAD3cQfaiBJlqm4caTMEko6TPucwm7+UErweeXWpE2GX+lC/VkA4aUmEgcMC/1iizGWzkXerM+tGF3gs1qQ9x8e2Zr8loZWSsGWwphB4yR83hg2eH4yfu8eqarOQUq6noHaR5k5VDBJI13vF0tA8S11h3EVG77HxQTzuc0NfUrLOJQGNiW/h2Ywlgl2z/M2WKT+uCyhju1nzlVUJduazw995VMAGbnCqndAc5XY0A7tUT6to5bu7Z928BWpO0fvb81i0I09hQEf0haCZtqemiuuja4wnMwv7VO5m7sTlxkQpud0NyGf5J+F1ieuCa7J2Xw34unlsfatpLetrY/JvmxUB5uwMqLAAy5xuMObwIeZdC5hH/3ZK4T0at4b3cMIBQy5uvoGFLWhCxsA+q2fIk2IiyxgH0qh5xyvuqJ6fW+/nSl9jTpCjaXcdx1TM4LlSSKbshdqQcGBpbX0ajc9TmooDrdzh2Y0IO5cfg5si6cXxSr3Ew1P//Da2sKez/WChjZ4AOMQqHA/55w/Kg6rdCo5TCHwFukJOynQHBRNeZnhgmWu2BMSBy2l8/J5bCBpt4EnrD57cuqFdF9QZYnLYaKpWH1zufIab+zFyQvXP1NKLGUT1/nxD3Hbp814HGt5r58K+kR3CCC3SGvZ3vM0OrrmvDjOBYhmzgChEkcc6XMsb8nxXgl1tZCO6G147B2S8QXl+CVmuT2PmzBxwS+Ujou4r0NeurE8VY8q8XLVbFNp3NpauF5VsQYY/rKDkRnhOwgAZ21HxxGEAvA2gXcf2Vcq6nRq+pNa1aKCoFB2pvjXGH7F1UsSEnQgy/F1hq3u/bu4EBcAKuYisiPy+tp5Gum+mj++UpjpSrWGGFKX/3DiDVFKLXrzqFvXi3qB317wQ/CnedMnMmaGqggszchKtRRy6MY99/L7oa/25Xp6SK7V6Ka6KHkdyC4zHfyghEaObVQd4rahFRLhYZspVAdDReZ8OhPIKsOsRFooCSM1TFu0/TEnAea7mQpVj/SnUU8zstY+SRVjuisXNGYOaTrux1qRNDpezZEUVrqpnSVq4qiQ9Ezhzq6/SCQqHlHbfXCQTeixBXh7vgNtrplzfCFpO0g3JMvvrMlqr//uqfplBYXDvK0ScFzh5cG3bEQfS0hhGbzrOSkDcUKpbkCyhjxKQwW,iv:Yl2gpgmkTM89s3gmyFKSoNmtdpdkHSJi+HK0EKbSD5w=,tag:4YkDfnES942M0DPv6IrP4A==,type:str] -sops: - age: - - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHRTdHcTlPdmRWSFllVVRG - UnF2cGtMQmxia1VXSHgvMnQvK1gvWkp2SkFzCklSVkd4SzVsOHBWSGlnMTlGdWh1 - U0lyVHJiL0lyQkU2R0ppK2k1S3FFK2cKLS0tIHVJN0lqZEwrTVNXc0UwOEFSK2Fz - RTVvN2FUanpKY2tVb1JlLzFlb2JhUVkKTSB3Y8g8olY/Xt8aC+ik10CQ7b5h/hOI - IDYUZwkWzcAvL6kDgBO4oLETawkFHY+RNaynEESHuAqcJTCB2MDWUA== - -----END AGE ENCRYPTED FILE----- - recipient: age10539mc6shf02hpa8huyjktdw3nfyavxdg8pt247wwvq4xrv8h5zs8nc0k0 - - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2ZHdsR0Q5MC9aREVKcXVS - eGRJVWdCMFZFai8zWEF1dlhWS1NBY3I1UVI0CmR5ZTZaOXFTOUFDYlE0V25PeDJO - ck1QRWM0WGl4eGY5SUZqSDZ1ZGpnNGcKLS0tIFFCQ05BUUU3d0s0SFU2R3RjalJS - VS9tcEErbi83d24rdTJ5N3dwZmRKNkUKZIusjiQ1usXsdY8shYuXp2Wp0dCRHCVM - 48B8YUFIkGtfwsfNbXHLWSTWuToxqXIBeSmCLysgsOmb70a0yjxOmA== - -----END AGE ENCRYPTED FILE----- - recipient: age1g22ghnrdg858yv6w2ux8hgntj8gkdyjn28axdkmzyx38d4vx6geqj4px9a - - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3S1FTV2Zjdy9CZk5heGN2 - c29abEp4dk5GNUpIL29Oa053NHh3V3plNlFjCkg1Wk83ZGNYRDVkSnhuWVp2M3RN - OEZNdGNWR2hRREgxaG5VdEFGZ2RUcGsKLS0tIGpiWWpkK3ZqZFovcjZpQXFPeEVs - MjNMQ3dveUE5OUZEeUpLazk3QUJsV0kKBS6fzXg2WRnQC74fLMM2dd2gBa4vRLaX - X+WknfFKXNd0GUlwKcd+J+pBJuV9JImTQdP3TiWyfcJKN569TlLulw== - -----END AGE ENCRYPTED FILE----- - recipient: age1k5nzxq4ej2u9ls97c2dhlz96j2vghv0assz5g0p4npzyc8c8fqlqld72hg - - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDSEpKbDJUV0UwVWIzUGNX - VnFTNTZsNnFhaHM5dkdiK0dRUFZITVVWajBvCmFWd09JOXdOVmFTaTRFYlA5RjUw - aVpmTWd6MmV1QThUald1N09OMUx0WWcKLS0tIE45RTFRcnNzck1BNUhLNjVzWC9q - cDlQcUx4VW12NzhqWTlaZ1locG45TnMKXP2A26YH2cwNBNAY9Cj161HOQWNp/Vct - 0TCGWUwNzJkZJdpQvqOuXWaSCAE9e8efbZTwfKBjaRltApnMuYqYeA== - -----END AGE ENCRYPTED FILE----- - recipient: age1gkzp905yqkla54l52m4xkqtxpn0sndkx0vh6qqa8d2tu29x8f35q354gpe - - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2NTEwZk1ZUnNXN3dkTUZv - Nm1WdDJsRkxjSGZ4N0NBYnJGT2tTTytTRW5nCnpRcFJjd0pwckx0UXh6Nm9Ddk1G - MXpCOXpqa3FXN0pORkRDL3labERaQ1EKLS0tIHJ3aWpIRTI1QTdGYTU3T2R5ckZK - RW92RTFGKzRnREdTT1ltb3NMbGhiMlkKnaeiOVhh1ntr4AKysyQ9pa9fpez+sJkJ - MyyBIomMdaBcfOfVre7yYhQl323tzBxM0q77jh+gKCN9ykNCprcUfg== - -----END AGE ENCRYPTED FILE----- - recipient: age1c4d93hmawmx8nt8g2sjrxcngfl7qx7y6vwxpqqg7grrkhjen6fvstljgg9 - - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJcVJuV1hQOCs0MzhzZTZr - N0o3WFdHNlRFNE4zRHh3QUxqSVVXZU42NTBNCnZsaENzcWRGSTZ4VE1tdlBuZ1hY - aHFBbDQ3ZkdaaUV6ZHFyY0pVR2VKMkEKLS0tIHF1TnFwSVlHVHpOYVhXcjlOWDUx - RjdZTEZ4VTk0Q0tWRENsSGRpN2Z1WTAKPG1Qv7sKc/GwhFkxIBYY9ZaDKvt7knXg - +Fxsv7MpvsmLjGcyi39gop6xTCPz2OYJMuw5PC21/YKMZKr/Sc42uw== - -----END AGE ENCRYPTED FILE----- - recipient: age15jjykch8km3l8atssu0n9us6d2xg58z0ds9s0djtdh9l954sud5szqxv29 - - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3Q1Z0L3hBRUg2Z3NXV1Zs - bFRld2tVQ0J2aVRRUHpyU0xINmlzcVUzQ3pzCktJOG5MMzduZml3cmZGTHBVc1J0 - L0toay9rNytVSFlkbWYydk5uZnhJNnMKLS0tIEo2VWxrTS9GaFcyeTYrRXRtN2Rw - aUhkNmQxcGovYk9XcTZaU0x4TXova1EK6PX7MZBowygoYIc3LTHP/6+1NuQYkdiY - hBRHzVXOI5zLukuaCYthujcVCrJD1rF8Mje1fTZRk0qI146ZWT7hGQ== - -----END AGE ENCRYPTED FILE----- - recipient: age10jhawn266e3wr6rx0lndkl9a47ewtk6jgh35d2582uu2l7dtn4tqdqc29c - - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDcFpSczF2Z1QxNFZocWlz - Q3dCZ0RwWVJOYXQyRmo1OUVlcGVzNFQvVWpJCm1YaktHRnZpdUdFSVc2Q3hPZkZB - SDgrbHN6NVR1elQ0MGpRQWZJdE5YQWMKLS0tIEJTdXNiTlYyTzQzNkpsemRER1dL - c0svZm1xSVc1eG50SkJvRW5iSzBGN1UK6UKECSIlo0bzTPu1S/QshHWb/Q75OQFP - idzq3J7K4GJ6PEvspzRhKqinCVeuScmk51BXFO2lxRBK2dJ+IFi5OA== - -----END AGE ENCRYPTED FILE----- - recipient: age1x708x83pjj7urp26pncx67fqz8a3htrf0umw7c00pvmxhl6y95lszjgd6r - - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1L0ZxRmZSbDlnZXNpRTFh - NE1MeTczZDNpSlBaNks1RDNpU0cyNzFhcEVJCm5wWlBMYmdzRGJ5Z1VmOFNxTUlt - Z0hLSThCaS9MV0J3aVMzZ3dQbGVnUzQKLS0tIFErMUUrd2JnRHpOelBRRzRvcTcy - aHpwWDVmVG1HalErSnJ0UVlBYS92MFEKacUGzDA+i5ARNhcKXcuhAEoq1a/Y6n/i - Thsi7uKriOa7pY9V5ogx+EqfcKcytF3loOTAv+cJtL0fAwbwmmCZVQ== - -----END AGE ENCRYPTED FILE----- - recipient: age12yvljlgg94z8qfwyezz6mtmrpldxvfcqwzsuyfekszu296fg6upseeyc0t - - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPdmNWczAvRi9CemJrcHVE - SmIvY050RXk5WmQzTFpZYmZkdEI2ZTE5cVQwClhOZkk5OEdwcTE4ZGNmMm9oK3or - U3ppZisrTU8zNjlOYVFtZjdYaGVHM0kKLS0tIGFpc0N5Zy9HU0xBZUdmVDN2NnJm - bExka1p6SnFVdmxJd3o4WTFBa1RZZFUK5hFC3KkEuAQKJgb2pX56pcJf2ppb9yjm - 9yXjEgctt52bE4WFLBoge0lMDHimHD94X885u6/X1P6rJH+qywqIqg== - -----END AGE ENCRYPTED FILE----- - recipient: age10zakwy8z5448vj7ur2h7vn8wfzvt2nxwq4pk4wx6cs34mlg58yasdjhc7l - - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQYTFDSkJxYXN2NXRpazZ2 - bmJLdndJcS9URk5rY1AvaHFWTER3ZzNjZXlRCkd1TVVxNVdtVHh0bnp0KzlPOXYr - ajhLK2htVUJwTnZQa3pDdDZQYnZyeDgKLS0tIDBHVDd3aU1FcE9aR1loZGQwU3ls - clliQlRVN0lwTytublZtWFJhNlpSbFEKfXgr15y5pBg0zSmaMKxfwfmGoBCSnf7M - bHaL6YTJEsPJUClpOVPnVDoc9/zZZK+g2zRYwUXkqjhLuI6y7nw0Bw== - -----END AGE ENCRYPTED FILE----- - recipient: age10q5gqw4gwts228ayanvalq7c93peqjdsfqcgevd7qr43u5rhnczs9u2ysj - - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2TXhCN0F0aUtrdWd3bEZG - R29YMTVDcDFGSy9jZlVtQ2RnRjJDNDVRSzJ3CkZZRmEyY3FrcnMyMDJVc3Z3MmZH - eXZWR2h1RVdET0JMUndvdWRDb09NRHMKLS0tIDJMbUdXeEErVjkxelM3OXRpeVlk - V1I5Ly9SM0kwRXhIanlaRHlKeVVDMUkKa0x3VDxG8HAv7tR3My8Of4MEOgRfa/Mc - Ka0RWmMbwsExRAKBDhwMDzY4CN4WzClSNwsMUAy24Y8YS7YL6UEYdQ== - -----END AGE ENCRYPTED FILE----- - recipient: age1hxynjkmtgcu9lwejchkjfqjp484at589sznqkxk6weucp37p4p7qaj440h - - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2QXJTQURUN1duTllRejBz - OTRiSERDbWVzUFo2bU14cXdKSXIwcmpwWFc4CmM2eEs4VjhVM01BaW5aK3ZxQ2JG - Y0hmcVViUnF5V3pxYUVuVk1Od1pXQ0EKLS0tIGpMbG14N2pXcldHZnJGdzBkMHAz - R2RVV1UvTGdheG0yWVlzeldLMHJzOGcK3RN+FRNIo1usuz4xK/XJPPOJVDDBaN14 - qhDaq6dHFv6zWeL/CmvMxHe9LVmy9HaIUYOkmPcWFBmt/zUd+5MPZw== - -----END AGE ENCRYPTED FILE----- - recipient: age1dtf3ahstj5mhzcqf4d2zc54d5dds69ka32dqpmpsskyaz04dtshq9ryxat - - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRNFovRmpsejh2UzVENDRk - S3FGL1UrMHpUQzZTdTBoTktGS1VWeDUrQVV3CkFFQzloOUhybnNOWHdOYTh4WlZB - cDBxelVwYkt1Q1NiVmZzOU5aWTN6U2sKLS0tIDZLWHFhbnhSTzlZelVqcUlYTU5q - M05IZytOYnBRQ1FnWHQrK3ZDelBBYTgK/n727RYMShgi8bqGIEaGqz4S0jFVSsyZ - ROl6ffOfG1UTXvifPkqxykbbGW2zUu4u2DCKSU5uQ45aPuYKIPOXwA== - -----END AGE ENCRYPTED FILE----- - recipient: age1px3aq87zcjgts5guc59fqn64zjkqzukdwce4a0ggza83n3atkcws4h5aww - lastmodified: "2025-10-27T14:24:19Z" - mac: ENC[AES256_GCM,data:aM+C0y/b8W7LtZoCPt6hBwjhV7zJ5v1dBZvFJvz/3l6gXdhtvI935j9cRzIlYCRagfwIVu18p/LDi+SSIlCBt23Q0mPUc9bTIc6JNTxVQGcqUrfAa14Msgm5amrY9HEsaMOxFX5tndcJMQOsKPXx50CJFb4hwFk7sQy0/9iQNdg=,iv:kQiD7ek9M9wGfGeHNMAWTacboba75jZNd3ZhmE9fVR8=,tag:ZcoF1bAajSGHcN5rvUJ2YA==,type:str] - unencrypted_suffix: _unencrypted - version: 3.11.0 diff --git a/hosts/bastion/profiles/caddy/default.nix b/hosts/bastion/profiles/caddy/default.nix deleted file mode 100644 index c60adbde..00000000 --- a/hosts/bastion/profiles/caddy/default.nix +++ /dev/null @@ -1,351 +0,0 @@ -{ - config, - hosts, - lib, - profiles, - ... -}: -let - # Parses a port from an address (e.g., `http://foo.bar:4000` -> `4000`) - portFromAddress = - addr: - lib.pipe addr [ - (lib.strings.splitString ":") - lib.lists.last - lib.strings.toInt - ]; -in -{ - imports = [ profiles.secrets.aws.default ]; - - sops.templates = { - e10_video_lego_route53_credentials = { - content = '' - AWS_ACCESS_KEY_ID="${config.sops.placeholder.aws_access_key_id}" - AWS_SECRET_ACCESS_KEY="${config.sops.placeholder.aws_secret_access_key}" - AWS_REGION=us-east-2 - AWS_HOSTED_ZONE_ID=Z01153052TLZPYRX634V - ''; - }; - }; - - services.caddy = { - virtualHosts = { - "e10.camp" = { - logFormat = '' - output file ${config.services.caddy.logDir}/access-e10.camp.log { - roll_size 1GiB - roll_keep 0 - mode 777 - } - ''; - extraConfig = '' - @webfinger { - path /.well-known/webfinger - method GET HEAD - query rel=http://openid.net/specs/connect/1.0/issuer - } - - handle @webfinger { - templates { - mime application/jrd+json - } - - header { - Content-Type application/jrd+json - Access-Control-Allow-Origin * - X-Robots-Tag noindex - } - - respond <