feat(nixos): integrate headplane and enhance configs with new services

nixos/default.nix

@@ -27,6 +27,7 @@
           inputs.nur.modules.nixos.default
           inputs.sops-nix.nixosModules.sops
           inputs.stylix.nixosModules.stylix
+          inputs.headplane.nixosModules.headplane
 
           ./${device.name}/configuration.nix
           ../home/module.nix

nixos/mirai/services/default.nix

@@ -15,11 +15,13 @@
     ./lldap.nix
     ./monitoring.nix
     ./nextcloud.nix
+    # ./paperless.nix
     ./prowlarr.nix
     ./resolved.nix
     ./searxng.nix
     ./tailscale.nix
-    # ./paperless.nix
+    ./headscale.nix
+    ./shitpost.nix
   ];
   services = {
     nix-serve = {

nixos/mirai/services/headscale.nix

@@ -0,0 +1,79 @@
+{config, ...}: {
+  sops = {
+    secrets.headscale-secret = {
+      owner = config.systemd.services.headscale.serviceConfig.User;
+      mode = "0440";
+      restartUnits = ["headscale.service" "authelia-darksailor.service"];
+      key = "authelia/oidc/headscale/client_secret";
+    };
+    secrets.headscale-authelia = {
+      owner = config.systemd.services.authelia-darksailor.serviceConfig.User;
+      mode = "0440";
+      restartUnits = ["headscale.service" "authelia-darksailor.service"];
+      key = "authelia/oidc/headscale/client_secret";
+    };
+  };
+  services = {
+    headscale = {
+      enable = true;
+      port = 8095;
+      settings = {
+        dns = {
+          magic_dns = true;
+          base_domain = "headscale.darksailor.dev";
+          nameservers.global = ["1.1.1.1"];
+        };
+        oidc = {
+          issuer = "https://auth.darksailor.dev";
+          client_id = "headscale";
+          client_secret_path = "${config.sops.secrets.headscale-secret.path}";
+          pkce = {
+            enabled = true;
+            method = "S256";
+          };
+        };
+      };
+    };
+    # headplane = {
+    #   enable = true;
+    #   settings = {
+    #     server.port = 42562;
+    #   };
+    # };
+    caddy = {
+      virtualHosts."headscale.darksailor.dev".extraConfig = ''
+        reverse_proxy localhost:${toString config.services.headplane.settings.server.port}
+      '';
+    };
+    authelia = {
+      instances.darksailor = {
+        settings = {
+          identity_providers = {
+            oidc = {
+              clients = [
+                {
+                  client_name = "HeadScale";
+                  client_id = "headscale";
+                  client_secret = ''{{ secret "${config.sops.secrets.headscale-authelia.path}" }}'';
+                  public = false;
+                  authorization_policy = "one_factor";
+                  require_pkce = true;
+                  pkce_challenge_method = "S256";
+                  redirect_uris = [
+                    "https://headscale.darksailor.dev/oidc/callback"
+                  ];
+                  scopes = ["openid" "email" "profile" "groups"];
+                  response_types = ["code"];
+                  grant_types = ["authorization_code"];
+                  access_token_signed_response_alg = "none";
+                  userinfo_signed_response_alg = "none";
+                  token_endpoint_auth_method = "client_secret_basic";
+                }
+              ];
+            };
+          };
+        };
+      };
+    };
+  };
+}

nixos/mirai/services/shitpost.nix

@@ -0,0 +1,13 @@
+{pkgs, ...}: let
+  src = pkgs.fetchgit {
+    url = "https://git.darksailor.dev/servius/adarkdayinmylife.public";
+    # repo = "adarkdayinmy.life";
+    rev = "68d972f68cab8f68916b94df05b7ab6a7da4a1da";
+    sha256 = "sha256-EVis06rmHq1jJK0FVsbgi7TOru7GtEUpbx0PjU2AKEo=";
+  };
+in {
+  services.caddy.virtualHosts."adarkdayinmy.life".extraConfig = ''
+    root * ${src}/
+    file_server
+  '';
+}

nixos/ryu/ryu.nix

@@ -17,10 +17,12 @@
       enable = true;
       enable32Bit = true;
       extraPackages = with pkgs; [
-        # intel-vaapi-driver
+        vpl-gpu-rt
+        intel-media-driver
         nvidia-vaapi-driver
         # vaapiVdpau
         # libvdpau-va-gl
+        # nvidia-utils
       ];
     };
     nvidia = {
@@ -50,8 +52,6 @@
   boot.loader.systemd-boot.consoleMode = "max";
 
   environment.sessionVariables = {
-    # LIBVA_DRIVER_NAME = "i965";
-    # __EGL_VENDOR_LIBRARY_FILENAMES = "/run/opengl-driver/share/glvnd/egl_vendor.d/50_mesa.json";
     LIBVA_DRIVER_NAME = "nvidia";
     NVD_BACKEND = "direct";
     __GLX_VENDOR_LIBRARY_NAME = "nvidia";

nixos/tsuba/default.nix

@@ -1,5 +1,4 @@
 {
-  nixpkgs,
   devices,
   inputs,
   overlays,