feat: gitea only secure /urer/settings

nixos/mirai/services/gitea.nix

@@ -2,7 +2,8 @@
   lib,
   config,
   ...
-}: {
+}:
+{
   virtualisation.docker.enable = true;
   sops = {
     # secrets."gitea/registration".owner = config.systemd.services.gitea-actions-mirai.serviceConfig.User;
@@ -71,6 +72,9 @@
               {
                 domain = "git.darksailor.dev";
                 policy = "one_factor";
+                resources = [
+                  "/user/settings"
+                ];
               }
             ];
           };

nixos/mirai/services/llama.nix

@@ -3,7 +3,8 @@
   pkgs,
   inputs,
   ...
-}: {
+}:
+{
   sops = {
     secrets."llama/api_key".owner = config.services.caddy.user;
     secrets."llama/user".owner = config.services.caddy.user;
@@ -20,7 +21,7 @@
   };
   services = {
     llama-cpp = {
-      enable = true;
+      enable = false;
       port = 11435;
       model = pkgs.fetchurl {
         url = "https://huggingface.co/lmstudio-community/gpt-oss-20b-GGUF/resolve/main/gpt-oss-20b-MXFP4.gguf";
@@ -30,7 +31,12 @@
     };
     ollama = {
       enable = true;
-      loadModels = ["deepseek-r1:7b" "deepseek-r1:14b" "RobinBially/nomic-embed-text-8k" "qwen3:8b"];
+      loadModels = [
+        "deepseek-r1:7b"
+        "deepseek-r1:14b"
+        "RobinBially/nomic-embed-text-8k"
+        "qwen3:8b"
+      ];
       port = 11434;
       host = "0.0.0.0";
       environmentVariables = {