hosts/Zephyrus/hardware-configuration.nix

@@ -39,7 +39,6 @@
 
   # Network & Bluetooth
   networking.networkmanager.enable = true;
-  networking.firewall.checkReversePath = "loose"; # For wireguard
 
   hardware.bluetooth.enable = true;
   hardware.bluetooth.powerOnBoot = true;

secrets/OVHCloud/default.yaml

@@ -22,15 +22,6 @@ gitlab:
     OTP_KEY: ENC[AES256_GCM,data:BphY+ZO26N82iN1782ephpyqYwTt3UmCawX9/1kwvWEo5OebpUOOOQnR03I=,iv:EaHAW/sb1MGfN9ZFeB8t4xxVUtxb5jM7uL06/eGPxck=,tag:Qg+0oBsc0oB1T8NO2Znw5g==,type:str]
     DB_KEY: ENC[AES256_GCM,data:9Yso0CEnpAU/sX2NW8roSz+w/lhfK220f35U8Z3t+GNOi+Zd7Ybb/7kill4=,iv:fsQ86NRJbLYfjFZ/ka6po1o35dagqmiqhfQmUQNzlPg=,tag:LV9Sh+TlYv+kRW0bLWajnw==,type:str]
     JWS_KEY: ENC[AES256_GCM,data:7QGTClTixUmLFuPwkdvaVbPfZhVFpjtnW4/T6W0Lpu2j5Xt1jxijgRSHYRo=,iv:9v5TGU8+SlKzAQtfF/3VBQ4D9asyNcOOa4ElEG7OQdE=,tag:MPWKPJtFfIeo38uCVG1H7w==,type:str]
-musare:
-    APP_SECRET: ENC[AES256_GCM,data:MTwZ7ziFaa6kCdbvNPyFCbNa/aY1kPO3CuLG0UC8S8Pd5QHepIHor3Ab9yw=,iv:8zalEGdQUmCoSZV8B/wmztPFi2upZZ11rU/okhkdk30=,tag:++8A7nyxsAvpqg1azwCWaA==,type:str]
-    YOUTUBE_API_KEY: ENC[AES256_GCM,data:gyBGcdrTnpmnl+NtCO0qZdaUJJ4cGyrJng2us/1ERfmgJAds50eR,iv:0uAqORbl3hC7QYJfJaP/JnaYvHoToxwVKRwElFIhgRI=,tag:NuETLWclphy4dhVnKVh1jw==,type:str]
-    SPOTIFY_CLIENT_ID: ENC[AES256_GCM,data:SecWkp5T77ciTs5gjjUznYbhkFaLNGkiXwiD3uvprEQ=,iv:+Tm9qgTHiklnNsYDCXFV2pm5mDLV2azM2Q1ZWeifnFk=,tag:wkj63YNBx9svSUWoPBCFpQ==,type:str]
-    SPOTIFY_CLIENT_SECRET: ENC[AES256_GCM,data:QY6bXZSimSET8bQteZycUZOpC5lUgDXteBhFEYvtovI=,iv:3BtHH/pPFLqW+MHSgKVwJ/hViEeF4YOWRRFMT+YIibA=,tag:VKsuBBxV7y64vBMVl10PZQ==,type:str]
-    MONGO_USER_USERNAME: ENC[AES256_GCM,data:XKk3rmNJ,iv:x853fsUKFZ5xEKTTFd+r8MQ4yZK1q0x9ocjmngBJ4Wo=,tag:v9xsFbImlrNQb/yAlIWM/w==,type:str]
-    MONGO_USER_PASSWORD: ENC[AES256_GCM,data:QMocFYM0okz4/g0iPm3QoPGtxRc67A==,iv:xZJL5KVJAL0Gv9wkbyStrcJig1gKkHlQnJ8SIKVLeLs=,tag:HdXDA6z8YJzwEQPBt/0rCQ==,type:str]
-    MONGO_ROOT_PASSWORD: ENC[AES256_GCM,data:KrrEa7NVF1J+znK+8aychgmBGgtLHw==,iv:BGsnTPXmQ3moqFRVATRbVDBLl/EFG5DqSwii/9eKdLg=,tag:0hR91iEZcox/xe7M4SmCBg==,type:str]
-    REDIS_PASSWORD: ENC[AES256_GCM,data:8+iq5EiFJWyhvE/AV/qjb/61AHvFdQ==,iv:jv/XVunNDXRB5CjQVxtt+uL5V14p7ol7UuhJOSWcjEs=,tag:Ft/mWv2zmXjSToPogisqtw==,type:str]
 notesnook:
     API_SECRET: ENC[AES256_GCM,data:E2wikU7aAXzuZ1m1javW7SbkCxVSii1zLF2AjFCWbVpyRvVN9le764fU29A=,iv:9R/Hzwdr9shQNYxtSJB18CUiaGq/XfMY2mTlTL5aLHs=,tag:ediIkiZRNOK61xGUO8vKwA==,type:str]
     S3_ACCESS_KEY_ID: ENC[AES256_GCM,data:Pmzvjon0RH2d78hiO0JEa8Lbad2a+mzX+zs=,iv:IyKuX3lWVqJuovkVNi/5eEZbRSL+jsOG5Kd09mEwr6w=,tag:Z2SfFsLpaPMDphhBp/1b0Q==,type:str]
@@ -58,10 +49,6 @@ stalwart-mail:
     ADMIN_SECRET: ENC[AES256_GCM,data:4ytiKxJ55Wm9p6M=,iv:dl1BCtxOu4o+2qC6ZlUw8cluoqDjp16/SN9bhGneRHs=,tag:qEgWrYHQJHDjR2PwK9y8UA==,type:str]
 shadowsocks:
     password: ENC[AES256_GCM,data:IdAvKXKckwvZUetkYSFTIPxd8nrwm13Ngc3KVDSmiW3AE4Rhmjk2VHjdUyQ=,iv:LVeQcL7XIEQyMTsXpXIROGte2+Z9+7FpemfiwhA0Pw0=,tag:qt+8jgN5UqwMeCV+D3stEQ==,type:str]
-umami:
-    APP_SECRET: ENC[AES256_GCM,data:+WnBbgVY+YzMJ8yBeFUEhkqYfs7wamuC/VmgnSybOXnd/H6A+zgimBggFsU=,iv:9tWnwH1ZvvfaHbzhIkrsynnOywD0xkuQKkvYlnrxOy8=,tag:mld2+vqLCesDtSYbN8lECg==,type:str]
-    DB_USER: ENC[AES256_GCM,data:ue5HslI=,iv:kXJSHpbQ4HV9k4ZiouXoOjop7YdnJkhAy3OUh+6s90Y=,tag:KGNNA9gz30bo2nVLAkh4JQ==,type:str]
-    DB_PASS: ENC[AES256_GCM,data:KyVnQAWcLcttImqsyecIIYordN9LR0zg,iv:nTy7COxvg3nVpsMf9g7x+gwKLaonaxC53rIeeCIGqdk=,tag:XbX7qyjQn+6snnTbtLInLQ==,type:str]
 webdav:
     USER_PASSWORD: ENC[AES256_GCM,data:aULehVsCkGpsryQ=,iv:OD6ADWh62tvykGXP9Lmy4f9Iz9QuzyKMnGXGAvOv55s=,tag:ff47alP5Og7XaADzvZEMGA==,type:str]
 wireguard:
@@ -91,8 +78,8 @@ sops:
             MFpMemF4MGg1bmVUeWV5N25LTUtyczQKss0x4zT1kyeRu+qenhrdbcPlU/p+yjVN
             y3j4eGpnwgc2rxSL9vkrrkzx/atUqUkgGU/YstszUrP6XKbJ+9ydpQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-11-07T22:25:47Z"
+    lastmodified: "2024-11-05T13:47:17Z"
-    mac: ENC[AES256_GCM,data:6LynPNzengBoVm5fPtxHuUxbvMy7Vaf6Qd/ikUcu8/Af3oPhxeBTwN0aOje+oqAVuYFsNLCsf1GGCkZ+U1mK+Fr777vSsl/+T5iG7hcjTht+Gtq2sK93qiGB6rdYrHzuJ6G3hHR1Xl/OGW7TsYj9+2PJvV/Hr18qElr3VDBDJD0=,iv:EQe5Q4FDn9Di4L76eIw/wU+44iCeTS7lrJlPfZvLOdM=,tag:sEYyV4+jN8yEKPfYgrSemg==,type:str]
+    mac: ENC[AES256_GCM,data:Lku06chnlLsqvvd5ud/ovY/ymGknyIxcPirvQ2lrc/+7jMa6cGu3Q9piVv/gx6jMhQIuYnNjS5AKoNvNfXRgrpakzET5aNzLtWkaUplNQCAy+yuKkIdmGoMZ+J+l4SyMydKERpZmN+pLWAld8U+CFRaWGoCLHHQ8i60u4Gti7DY=,iv:DVcjFoncW0vPhBEA042DAWxJLnSCfwsJeYQcmhsWrbI=,tag:dL6L5CfrB4ZVMytkGfPSYA==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
     version: 3.9.1

services/default.nix

@@ -2,11 +2,10 @@
   imports = [
     ./authelia
     ./garage
-    ./musare
     ./outline
+    ./penpot
     ./shadowsocks
     ./stalwart-mail
-    ./umami
     ./uptime-kuma
     ./webdav
     ./wireguard

services/musare/default.nix

@@ -1,158 +0,0 @@
-{
-  pkgs,
-  config,
-  ...
-}: let
-  musare = pkgs.fetchFromGitHub {
-    owner = "Musare";
-    repo = "Musare";
-    rev = "v3.11.0";
-    hash = "sha256-RN9H7atiNOr4wqgzfwE/8hUMJ4zpgMBu3dXA37c/lH0=";
-  };
-  musare-backend =
-    pkgs.buildNpmPackage {
-      pname = "musare-backend";
-      version = "4.7.0";
-      nodejs = pkgs.nodejs_18;
-
-      src =
-        musare
-        + "/backend";
-
-      npmDepsHash = "sha256-cxvK2Zp0iOA9qPg8NaCEcOsxmaU1/l/dvnfwUEq2BuE=";
-      dontNpmBuild = true;
-    }
-    + "/lib/node_modules/musare-backend";
-  musare-frontend =
-    pkgs.buildNpmPackage {
-      pname = "musare-frontend";
-      version = "4.7.0";
-
-      src =
-        musare
-        + "/frontend";
-
-      npmDepsHash = "sha256-R1vxio66W/8WN6pFRbwuOv0Z4/V4cnwBqhXlRygj7Js=";
-      npmBuildScript = "prod";
-    }
-    + "/lib/node_modules/musare-frontend/build";
-in {
-  services.caddy.virtualHosts."music.gasdev.fr".extraConfig = ''
-    root * ${musare-frontend}
-    file_server
-
-    @websockets {
-        path /backend/*
-    }
-
-    reverse_proxy @websockets localhost:32483
-
-    handle_path /backend/*  {
-        reverse_proxy localhost:32483
-    }
-  '';
-
-  sops.secrets."musare/APP_SECRET".owner = "root";
-  sops.secrets."musare/YOUTUBE_API_KEY".owner = "root";
-  sops.secrets."musare/SPOTIFY_CLIENT_ID".owner = "root";
-  sops.secrets."musare/SPOTIFY_CLIENT_SECRET".owner = "root";
-  sops.secrets."musare/MONGO_USER_USERNAME".owner = "root";
-  sops.secrets."musare/MONGO_USER_PASSWORD".owner = "root";
-  sops.secrets."musare/MONGO_ROOT_PASSWORD".owner = "root";
-  sops.secrets."musare/REDIS_PASSWORD".owner = "root";
-
-  sops.templates."musare/.env" = {
-    content = ''
-      MONGO_USER_USERNAME=${config.sops.placeholder."musare/MONGO_USER_USERNAME"}
-      MONGO_USER_PASSWORD=${config.sops.placeholder."musare/MONGO_USER_PASSWORD"}
-      MONGO_ROOT_PASSWORD=${config.sops.placeholder."musare/MONGO_ROOT_PASSWORD"}
-      MONGO_INITDB_ROOT_PASSWORD=${config.sops.placeholder."musare/MONGO_ROOT_PASSWORD"}
-      MONGO_INITDB_ROOT_USERNAME=admin
-      MONGO_INITDB_DATABASE=musare
-      REDIS_PASSWORD=meh_not_important
-    '';
-    owner = "root";
-  };
-  sops.templates."musare/config.json" = {
-    content = ''
-      {
-      	"configVersion": 12,
-      	"migration": false,
-      	"secret": "${config.sops.placeholder."musare/APP_SECRET"}",
-      	"port": 8080,
-      	"url": {
-      		"host": "music.gasdev.fr",
-      		"secure": true
-      	},
-      	"apis": {
-      		"youtube": {
-      			"key": "${config.sops.placeholder."musare/YOUTUBE_API_KEY"}"
-      		},
-          "spotify": {
-            "clientId": "${config.sops.placeholder."musare/SPOTIFY_CLIENT_ID"}",
-            "clientSecret": "${config.sops.placeholder."musare/SPOTIFY_CLIENT_SECRET"}"
-          }
-      	}
-      }
-    '';
-  };
-
-  virtualisation.oci-containers.containers = {
-    musare-backend = {
-      image = "localhost/musare:backend";
-      imageFile = pkgs.dockerTools.buildImage {
-        name = "musare";
-        tag = "backend";
-        copyToRoot = pkgs.buildEnv {
-          name = "musare-backend-env";
-          paths = with pkgs; [
-            nodejs_18
-            curl
-            bash
-          ];
-        };
-        config = {
-          Cmd = ["node" "--es-module-specifier-resolution=node" "/opt/app/index.js"];
-        };
-      };
-      autoStart = true;
-      volumes = [
-        "${musare-backend}:/opt/app/"
-        "${config.sops.templates."musare/config.json".path}:/opt/app/config.json"
-      ];
-      ports = [
-        "32483:8080"
-      ];
-      workdir = "/opt/app";
-      environment = {
-        NODE_TLS_REJECT_UNAUTHORIZED = "0";
-      };
-      environmentFiles = [
-        config.sops.templates."musare/.env".path
-      ];
-      dependsOn = ["mongo" "redis"];
-    };
-    mongo = {
-      image = "docker.io/mongo:latest";
-      autoStart = true;
-      volumes = [
-        "${musare}/tools/docker/setup-mongo.sh:/docker-entrypoint-initdb.d/setup-mongo.sh"
-        "musare-mongodb:/data/db"
-      ];
-      environmentFiles = [
-        config.sops.templates."musare/.env".path
-      ];
-    };
-    redis = {
-      image = "docker.io/redis:7";
-      autoStart = true;
-      cmd = ["--notify-keyspace-events" "Ex" "--requirepass" "meh_not_important" "--appendonly" "yes"];
-      volumes = [
-        "musare-redis:/data"
-      ];
-      environmentFiles = [
-        config.sops.templates."musare/.env".path
-      ];
-    };
-  };
-}

services/umami/default.nix

@@ -1,52 +0,0 @@
-{config, ...}: {
-  services.caddy.virtualHosts."analytics.gasdev.fr".extraConfig = ''
-    reverse_proxy http://127.0.0.1:4341
-  '';
-
-  sops.secrets."umami/APP_SECRET".owner = "root";
-  sops.secrets."umami/DB_USER".owner = "root";
-  sops.secrets."umami/DB_PASS".owner = "root";
-
-  sops.templates."umami.env" = {
-    content = ''
-      APP_SECRET=${config.sops.placeholder."umami/APP_SECRET"}
-      DATABASE_URL=postgresql://${config.sops.placeholder."umami/DB_USER"}:${config.sops.placeholder."umami/DB_PASS"}@umami-db:5432/umami
-    '';
-    owner = "root";
-  };
-  sops.templates."umami-db.env" = {
-    content = ''
-      POSTGRES_USER=${config.sops.placeholder."umami/DB_USER"}
-      POSTGRES_PASSWORD=${config.sops.placeholder."umami/DB_PASS"}
-    '';
-    owner = "root";
-  };
-
-  virtualisation.oci-containers.containers = {
-    umami = {
-      image = "ghcr.io/umami-software/umami:postgresql-latest";
-      autoStart = true;
-      ports = ["4341:3000"];
-      dependsOn = ["umami-db"];
-      environment = {
-        DATABASE_TYPE = "postgresql";
-      };
-      environmentFiles = [
-        config.sops.templates."umami.env".path
-      ];
-    };
-    umami-db = {
-      image = "docker.io/postgres:15-alpine";
-      autoStart = true;
-      environment = {
-        POSTGRES_DB = "umami";
-      };
-      environmentFiles = [
-        config.sops.templates."umami-db.env".path
-      ];
-      volumes = [
-        "umami-db-data:/var/lib/postgresql/data"
-      ];
-    };
-  };
-}

services/uptime-kuma/default.nix

@@ -8,11 +8,7 @@
       image = "docker.io/louislam/uptime-kuma:1";
       autoStart = true;
       ports = ["127.0.0.1:3001:3001"];
-      volumes = [
+      volumes = ["uptime-kuma:/app/data"];
-        "uptime-kuma:/app/data"
-        # For container monitoring
-        "/var/run/podman/podman.sock:/var/run/podman/podman.sock"
-      ];
     };
   };
 }