From 81ea7f695e018549511f0457bf8a642344fa4455 Mon Sep 17 00:00:00 2001
From: servius <servius@darksailor.dev>
Date: Tue, 24 Feb 2026 13:50:59 +0530
Subject: [PATCH] feat: Update cinny to use hashRouter and update caddy reverse
 proxy

---
 nixos/tako/services/matrix/tuwunel.nix | 16 ++++++++++++----
 nixos/tako/services/monitoring.nix     |  4 ++--
 secrets/secrets.yaml                   |  6 +++---
 3 files changed, 17 insertions(+), 9 deletions(-)

diff --git a/nixos/tako/services/matrix/tuwunel.nix b/nixos/tako/services/matrix/tuwunel.nix
index 9a6d5fc0..c1bf9aa6 100644
--- a/nixos/tako/services/matrix/tuwunel.nix
+++ b/nixos/tako/services/matrix/tuwunel.nix
@@ -12,6 +12,10 @@
     defaultHomeserver = 0;
     homeserverList = ["darksailor.dev" "matrix.org"];
     allowCustomHomeservers = false;
+    hashRouter = {
+      enabled = true;
+      basename = "/";
+    };
   };
   cinnyConfigFile = pkgs.writeText "cinny-config.json" cinnyConfig;
 in {
@@ -68,14 +72,18 @@ in {
   };
   services.caddy.virtualHosts = {
     "matrix.${base_domain}".extraConfig = ''
-      reverse_proxy /_matrix/* localhost:${toString port}
+      handle /_matrix/* {
+        reverse_proxy /_matrix/* localhost:${toString port}
+      }
       handle_path /config.json  {
         file_server
         root ${cinnyConfigFile}
       }
-      root * ${pkgs.cinny}
-      try_files {path} / index.html
-      file_server
+      handle {
+          root * ${pkgs.cinny}
+          try_files {path} /index.html
+          file_server
+      }
     '';
     "${base_domain}".extraConfig = ''
       reverse_proxy /.well-known/* localhost:${toString port}
diff --git a/nixos/tako/services/monitoring.nix b/nixos/tako/services/monitoring.nix
index 1735a305..6b61ee4d 100644
--- a/nixos/tako/services/monitoring.nix
+++ b/nixos/tako/services/monitoring.nix
@@ -23,7 +23,7 @@
     caddy = 2019;
   };
 in {
-  sops.secrets."grafana.secretKey" = {
+  sops.secrets."grafana/secret_key" = {
     owner = "grafana";
   };
   # Grafana configuration with Authelia integration
@@ -57,7 +57,7 @@ in {
       security = {
         disable_gravatar = true;
         cookie_secure = true;
-        secret_key = ''$__file{${config.sops.secrets."grafana.secretKey".path}}'';
+        secret_key = ''$__file{${config.sops.secrets."grafana/secret_key".path}}'';
       };
 
       analytics = {
diff --git a/secrets/secrets.yaml b/secrets/secrets.yaml
index 813ccf26..05401ebd 100644
--- a/secrets/secrets.yaml
+++ b/secrets/secrets.yaml
@@ -79,7 +79,7 @@ minecraft:
     modded: ENC[AES256_GCM,data:6itrol9NObR3TczEeOa7wkykgqkpDus0VkHBRpU6VdQ=,iv:F56uYdHozJvkJ+m18aviTWzCrLfW2VcxkbOqpnRiniA=,tag:WLKA+uIJJtlDfMMOn0ak7Q==,type:str]
 grafana:
     adminPassword: ENC[AES256_GCM,data:im6FJVlVUoZg+9W6KmsqtloH4nB6AhXOcia5waRyFKj2DoQlt4jhPH1CFvw=,iv://D6aD/fGl7h4KmtQcQ0TQLWLfKdIs4+EMg2LWjPHvg=,tag:6gHu/V0V0a8GpcgA/hUwXg==,type:str]
-    secretKey: ENC[AES256_GCM,data:LD0x8Fa6SU1+6mwxLkKa/o+ZqeuRIr7o/AKS7EmrDYj0vzrA3/FjViVJNfkOJDch9TbVyjIpk2ZLwxHXOZx7MA==,iv:t6UwZj2JZpMIDsDDeJ4rZah4aBoMIKaoiu9VU2VhViE=,tag:MIz/b8JWYtOpUCcg6gYhJg==,type:str]
+    secret_key: ENC[AES256_GCM,data:QkNTWQyQGgD/zJ0C0nkqTuxJXCx/hqwFH1XrJEGcIB7U3PUNdMpvTYrazgGRUcfEUjMeCIbUgYcamrPJJgaBsA==,iv:RZa79OtDS74JErBk/j5wg/p02Rd4zCXLi4LQGffHLmU=,tag:sbsovzFXj3xmDIF+ACwPgQ==,type:str]
 discord:
     token: ENC[AES256_GCM,data:M6TayHpIa0J1w3zVRKPPU0P/f18UXOpxzU7fjKNCx8YxzSAaQfY52S5XpiqDgjPWfWdSxzG2VVDqu1708Vwofa8IRKwWafam,iv:x0ySoaS68aLRVUcQin096RoeQGRELvNwdFJxezPj/cA=,tag:Omv5uL97y7ZTI8juVJFNug==,type:str]
 lastfm:
@@ -119,7 +119,7 @@ sops:
             VGZKdHpVeFRpQUxtSEkyaEhLMlBJcGsKLb0DvPNZosPBUuiX6qz1s5IO5INQh8CK
             ZtXTVClwMSmaUYhdSB2gKFrKVZHXTJZ4oAL5t/BpC0pOHyr+o96T3Q==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-02-24T07:52:11Z"
-    mac: ENC[AES256_GCM,data:uGtKSAltHbQsaQWiVIRJ80kfYNERl8RO4l+6xp4NPea44FYkiApuiW1RJ1E+Rk4bL0YV+fJ/vb4n2/U6RKuQBYrhyhHsUrCiu1N7CVStCqXispSZSPLFbbUDcGby7bbggs0tDBH9mC6UHeZed5Nu4TKD7dOqBCtNqnECXevIbIQ=,iv:DrkSurXsqHqWf4hs86XJAIIyUIhSXsKL02khZg+hT00=,tag:PtXt9KqElY1K6TMV28s77A==,type:str]
+    lastmodified: "2026-02-24T08:02:58Z"
+    mac: ENC[AES256_GCM,data:JzKh6k1nzp2sTDXFG0/bJbBSksCri2WIcXU0C+cyCg6hHzQMsKc36xSRfyrytW8r6rCooJRlC46nPYvFH9JhG/1uIAx4QU/PAvgzEKvXOQi2xXULajpEeCAdmU8TERl3to9JCTAhCbV7oibzOalC6WbVOfhQvqBYWN2JamwCHwc=,iv:oMmpcadFUZT5mdMQ8BzGoKKdpV2PvtaoXhOsKSYUGII=,tag:cdBim93M98OcSNZsmPQ57A==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.11.0