diff --git a/home/programs/neovim.nix b/home/programs/neovim.nix index ecbf546b..b3f42ad5 100644 --- a/home/programs/neovim.nix +++ b/home/programs/neovim.nix @@ -6,7 +6,7 @@ ... }: { stylix.targets.nixvim.enable = false; - programs = lib.optionalAttrs (device.is "ryu" || device.is "kuro" || device.is "mirai") { + programs = lib.optionalAttrs (device.is "ryu" || device.is "kuro" || device.is "mirai" || device.is "tako") { nixvim = { enable = true; diff --git a/nixos/mirai/configuration.nix b/nixos/mirai/configuration.nix index 91efd983..be1ea087 100644 --- a/nixos/mirai/configuration.nix +++ b/nixos/mirai/configuration.nix @@ -42,7 +42,7 @@ cores = 8; auto-optimise-store = true; extra-experimental-features = "nix-command flakes auto-allocate-uids"; - trusted-users = ["root" device.user "remotebuilder"]; + trusted-users = [device.user "remotebuilder"]; trusted-substituters = [ "https://nix-community.cachix.org" "https://nixos-raspberrypi.cachix.org" diff --git a/nixos/ryu/configuration.nix b/nixos/ryu/configuration.nix index 18f49821..648e5382 100644 --- a/nixos/ryu/configuration.nix +++ b/nixos/ryu/configuration.nix @@ -43,7 +43,7 @@ cores = 24; auto-optimise-store = true; extra-experimental-features = "nix-command flakes auto-allocate-uids"; - trusted-users = ["root" device.user]; + trusted-users = [device.user]; trusted-substituters = [ "https://nix-community.cachix.org" "https://nixos-raspberrypi.cachix.org" diff --git a/nixos/tako/configuration.nix b/nixos/tako/configuration.nix index 0d66bfd8..17b7a8fe 100644 --- a/nixos/tako/configuration.nix +++ b/nixos/tako/configuration.nix @@ -42,7 +42,7 @@ cores = 8; auto-optimise-store = true; extra-experimental-features = "nix-command flakes auto-allocate-uids"; - trusted-users = ["root" device.user "remotebuilder"]; + trusted-users = [device.user "remotebuilder"]; trusted-substituters = [ "https://nix-community.cachix.org" "https://nixos-raspberrypi.cachix.org" diff --git a/nixos/tako/services/authelia.nix b/nixos/tako/services/authelia.nix index 1777c84b..bc1aaab3 100644 --- a/nixos/tako/services/authelia.nix +++ b/nixos/tako/services/authelia.nix @@ -1,4 +1,6 @@ -{config, ...}: { +{config, ...}: let + port = 5555; +in { sops = { secrets = let user = config.systemd.services.authelia-darksailor.serviceConfig.User; @@ -71,7 +73,7 @@ theme = "dark"; notifier.filesystem.filename = "/var/lib/authelia-darksailor/authelia-notifier.log"; server = { - address = "0.0.0.0:5555"; + address = "0.0.0.0:${toString port}"; endpoints.authz = { forward-auth = { implementation = "ForwardAuth"; @@ -96,7 +98,7 @@ }; caddy = { virtualHosts."auth.darksailor.dev".extraConfig = '' - reverse_proxy localhost:5555 { + reverse_proxy localhost:${toString port} { # header_up Host {http.request.header.X-Forwarded-Host} # header_up X-Forwarded-Host {http.request.header.X-Forwarded-Host} # header_up X-Forwarded-Proto {http.request.header.X-Forwarded-Proto} diff --git a/nixos/tako/services/default.nix b/nixos/tako/services/default.nix index 20154df3..74b4fdaf 100644 --- a/nixos/tako/services/default.nix +++ b/nixos/tako/services/default.nix @@ -1,6 +1,5 @@ {...}: { imports = [ - # ./caddy.nix # ./excalidraw.nix # ./fail2ban.nix # ./flaresolverr.nix @@ -17,9 +16,10 @@ # ./headscale.nix # ./shitpost.nix ./atuin.nix - # ./immich.nix - # ./lldap.nix - # ./authelia.nix + ./caddy.nix + ./authelia.nix + ./immich.nix + ./lldap.nix ./openssh.nix ./tailscale.nix ]; diff --git a/nixos/tako/services/immich.nix b/nixos/tako/services/immich.nix index b8516b94..81d81273 100644 --- a/nixos/tako/services/immich.nix +++ b/nixos/tako/services/immich.nix @@ -26,14 +26,14 @@ "clientId": "${config.sops.placeholder."authelia/oidc/immich/client_id"}", "clientSecret": "${config.sops.placeholder."authelia/oidc/immich/client_secret"}", "enabled": true, - "autoLaunch": true, + "autoLaunch": false, "autoRegister": true, "buttonText": "Login with Authelia", "scope": "openid email profile", "issuerUrl": "https://auth.darksailor.dev" }, "passwordLogin" : { - "enabled": false + "enabled": true }, "server": { "externalDomain": "https://photos.darksailor.dev" diff --git a/nixos/tako/services/lldap.nix b/nixos/tako/services/lldap.nix index acd9654f..ce2b823a 100644 --- a/nixos/tako/services/lldap.nix +++ b/nixos/tako/services/lldap.nix @@ -6,6 +6,7 @@ services.lldap = { enable = true; settings = { + force_ldap_user_pass_reset = "always"; ldap_user_dn = "admin"; ldap_base_dn = "dc=darksailor,dc=dev"; ldap_user_email = "admin@darksailor.dev"; @@ -14,10 +15,12 @@ ldap_port = 389; ldap_host = "::"; ldap_user_pass_file = config.sops.secrets."lldap/admin".path; - environmentFile = '' - LLDAP_JWT_SECRET_FILE = ${config.sops.secrets."lldap/jwt".path}; - LLDAP_KEY_SEED_FILE = ${config.sops.secrets."lldap/seed".path}; - ''; + jwt_secret_file = "${config.sops.secrets."lldap/jwt".path}"; + }; + environment = { + LLDAP_JWT_SECRET_FILE = "${config.sops.secrets."lldap/jwt".path}"; + # LLDAP_FORCE_UPDATE_PRIVATE_KEY = "true"; + # LLDAP_KEY_SEED_FILE = "${config.sops.secrets."lldap/seed".path}"; }; }; users.users.lldap = { diff --git a/nixos/tsuba/configuration.nix b/nixos/tsuba/configuration.nix index 78055dc2..bdd29ac0 100644 --- a/nixos/tsuba/configuration.nix +++ b/nixos/tsuba/configuration.nix @@ -41,8 +41,8 @@ distributedBuilds = true; buildMachines = [ ../../builders/tako.nix + ../../builders/mirai.nix ../../builders/shiro.nix - ../../builders/tsuba.nix ]; }; users.users.${device.user} = { diff --git a/secrets/secrets.yaml b/secrets/secrets.yaml index 35915969..1fa25951 100644 --- a/secrets/secrets.yaml +++ b/secrets/secrets.yaml @@ -49,7 +49,7 @@ authelia: jwks: ENC[AES256_GCM,data:1efhdlYmiD/y4kzK0hFfLAmY6rXK0hvZez/tu1cb2hfUhIM/DzNNthKQjH8Cu2TlZwDQpUIrCO7Tr0BbkiREC+VNK4vYgi+GWswnG7VCZS40xRAZhSArNO2uQ4dpf/KAHRSSJa3i7gGOqSG/Pnrl3TRhzkhkfWSRk+7koPWKpYJOKLem+ZLN75yssCsEbYIOHjcXyizNHt6SE2ylqqCjyWnlhlnRQStYaFPWAAABcm96MkSThSyRd6hTAifC/aZiM1IMlLw7wJJk01uwjJytlxBxDiFrdr4Grg0PzOsOAocex9Siw5fzcr7dFpVBoaS7e7nD/sccGSyEysw/t+wvkMou1Ewr5U2Pnew8lPjSrEiiGxuPwmK9kHxD3L6cADxF6xs4bn+Iqa/yy9FWbtGZfBYOxJiRvXgxBPiO7CH4tJyVIbnLfi8K/zCJC9u5vO+WFXiVIzXxAPVUL7VKQQZGxV7989LMdcjzck+B1zFHVQz25siwbpu0FxMxiJsVtBxu1U+QBRfQrwLacX2NAJvqYNZxr+9l43Fh0x8dS5CBheVEy39sXge9jLyS7kIW0FfvgJaHuLL2/GhDGsvfi7zFPOc8Thg+8LP58L8wzPT+LvVoidq/j3K2Ct6udn9JsOnbZT3Gs1RiY+E77H09GbdwIrP0sGVi4ZJe++w+sKNjyzLzceEYGkfa1EiMQhYPHzqUAwqtgmJZo9tY+2jOBJb9ZU+Kj0xtqZsjFpHaGWsRj8XGkPrAFEh6Z6/Ak9/BpYaapPeAO3Wa6tzNVlTCtaX786nSTjfGC7v9O4Uz8XQr0HV3A7wj36Fw3dqERZFKea7BJbiiAiEZtnOsbWVqQXpIUVfCvPhfwuFcOU/ClyM1fGyZXaCIeB62Tkqa+ZlqRQgzzf3bSFUK0PgxE3Ny5pIPzNEINqse+6DeFuF91uY1dLQB4Vizyzv1H+X/OecO9K8kECM1wUy3Fbbyh4tYYxt4VvqFQZ1o4A7Jd04WCIf3hdAHmwvOQW+/8dfnyLa8kqTcQYeI3jfjtRvD6TaZl21K9kFY2VJAexdno9bbozDOus1Ep92ublwonVjfvzbyDURHGF6Cw2OL7xcbHQIMz/ZmkVHMra49NHgWlI6X0slgYDxKKDszHhZ9SHkEXF8pJf+uogbwSwz1glRkEdn1oprbs8GsFoc7HGVvSHRgOWKHwvhZD2tMiSE4cEFZ9/2nSPISQMNGuS7wgnVkalKPW+gF1EWVXczanzKsrpcDtpMdFufMRVusaJBV5Jw62I++cx1AMW2dRTseQyWLchRWtOba6dd9gbNzGi39+njHClHIEUxaxXzxIQLhSgCA9loXRc26ZA6DpwHQR+gtH2OybeFEiH390YoSfFeZuU+f0E2awMdpiEsBL/AniUcboDaBEaDQYpwUawNL+II7rmSn4rTJM64n5z3B88U/vAQh9BQFhf7SDKb05n/ArCibkdy3gbo8rTVH1gGbmW53DTxzuW+AEpFcuueiP3yz1vGzEwKSX+LMkCwFwk6Y/VcqHXW+PdZ88SFUr5WELGPkZxT3AvmduBCifE0KDzKWrN3yy1xwEQDGrYiqeHqeqHpEuk/KpxeAwepqWayGMq6iT4BWUBojNo6quoXkPPodSsotbBFLjyRHoDGm0NZSbgluOUyERrN6M+ELdHqQjeNTS046KB6QnG5s+uTA+uxyonvmPCPBgFAd0q0qfq4T/SISHrPe13Y7nHnATxoMBszvIfKznqFthTBsc3V9C5+g/kcOzcEQpAC6baGe+eq23m/Go3uDa7O84Euxhj9C5NBcidvgmYmRZuY6l2ehnxf1oGoGwHBJEaYEuCk7sc3Wac6u2OvqCIKPxRdi2tUiZ9FwCGLqd8qcLEPtsSaBNk2CVlK9ZkgPzSYH794qpNQDWkyv5SJ4V9zy2LL+s9MHtHNQu6QxALZ8c0GfQetTI5ArkC3cBz/3mRdDMy9k7HpO7b6USoxqGAZ+H4kzJhus9QwjaqJnnB+fJI5O2ek5TVLY9RWXo+W2pCBDjt925BVoChkvkUEg4GtvR+8/yChgYEgYWUPqRV4vMEwQiRoaJamL/E+lRaUx+c0f9ga8+k0JdfxfzoIPUA3/rBGcfO8Y12RF8Ool4hreP409KjdPP0PeeOVKg58MPYNO5O0BdT62nyL+fSvJkw7uPGcOwtOtcxjcBsNhoFv0twrCp8S3cLX45GTNaTw+JHcxsTzG9ibL3bFtVkAAiZHZGMisEjTSGElSGIDk+MoPt68hq4BRioab,iv:gGKyTUigpnqg3Fgd76INrESRT27hJRzYQ3xk8heNkWk=,tag:fVc8rg1Or63X/14neG+8Cw==,type:str] lldap: jwt: ENC[AES256_GCM,data:61dwC1ElOOGaf0CmalzXZnxImEyufKjUUWcNaEcOuv3TEODhQyHK7g==,iv:CVEJVuaCc2gDmSYWHS3fPL8FjbvblF6IladAzGoGb0o=,tag:OMm/OdKjliHjsGqJripLbg==,type:str] - seed: ENC[AES256_GCM,data:zMBZP4GeGkQ4chC9eQ4tG8vTqbxZj4iQMKCj0WQd1qOWVTibpk6VylnFz5ugmeMR,iv:5ZFf/r683AHVlpp7iN9B6nY1b8tD/JSCxRN4vXT1cRM=,tag:MmeGpK9d2GFP3etr9Ouvkg==,type:str] + seed: ENC[AES256_GCM,data:jJPutPkhFVFxLbbQNZznHHiilP/cN2r+/vT4ArQVRQSqPMnkkwgc3LNk4sUTrT9V,iv:LD1IJ1CgtDfYf1gSyyaU+hir0InuDEq0u7ppMmwGJRY=,tag:cK4l4Evr7V9WEUEL7V9jtQ==,type:str] admin: ENC[AES256_GCM,data:6eLFuyt9hBzoAGfaDLi9cwxFj/yq20BDCSzbHzakZLo=,iv:qjczQ/hswAzVVS7gCUapzqhRx1dAE7FhRUvtovlMuY0=,tag:aMBFJy+USOd5Vy2QKjoD6Q==,type:str] users: authelia: ENC[AES256_GCM,data:6zddaWEBqJqfLaSzeANlSfldpw==,iv:jx3P9FThq7+LbwX0LpNK7qll3RJ5ibNfdDybS+KZG6U=,tag:RHNPLdbpkPy2aAcibljxAg==,type:str] @@ -82,7 +82,7 @@ sops: VGZKdHpVeFRpQUxtSEkyaEhLMlBJcGsKLb0DvPNZosPBUuiX6qz1s5IO5INQh8CK ZtXTVClwMSmaUYhdSB2gKFrKVZHXTJZ4oAL5t/BpC0pOHyr+o96T3Q== -----END AGE ENCRYPTED FILE----- - lastmodified: "2025-11-22T15:13:49Z" - mac: ENC[AES256_GCM,data:n8nE2sZE/uIoyQEeZpB1gYztlCZzZYziJcZE55rK73zdKl/3a7qOISMErBBsI/1d2vYx/Ju7aQjyTfnxsNEEIyZB4DMghxSmvubGTUA/cdLY5l2Y9mgMxq4gjpyNGDzEpScGhxhBoDJJvju3FWnsAig6gPJ1AC4nnol4mY+xUwg=,iv:XQ1PAUBXce/B6EteWTpwcBp1btEsvrEzoz5I4LEwk1g=,tag:dLthWuQyhJNOHC9shGXB9w==,type:str] + lastmodified: "2025-11-27T13:28:41Z" + mac: ENC[AES256_GCM,data:KVdCTn6EXEAnj76kUL0d5eaYQJUc1HdfWTlwF+vku5wo2f9aJA2s6uyKXmhhx0e6q8muu10gMVObZzgae0vYZBOhO7GSxlLU9gCi4PaQo2Vz5mC75liCt3geoO9PTShZmLGaEPeuA9DFt/t3ggC2yqXij6uwz0SifvCuKM2QNzw=,iv:FSAa/eJBRDcxY+RLPy9O2PxLDibzRJrLh6+CtQNFtaQ=,tag:iNDr5XvpTJS8pNt9vZgOFw==,type:str] unencrypted_suffix: _unencrypted version: 3.11.0