feat(neovim): enable on tako device

feat(authelia): configure port and reverse proxy
feat(lldap): force password reset and update settings
fix(nixos): remove root from trusted users on ryu and tako
fix(immich): disable auto launch and enable password login
refactor(tako): enable authelia, immich, and lldap services
chore(secrets): update lldap seed and metadata timestamps

home/programs/neovim.nix

@@ -6,7 +6,7 @@
   ...
 }: {
   stylix.targets.nixvim.enable = false;
-  programs = lib.optionalAttrs (device.is "ryu" || device.is "kuro" || device.is "mirai") {
+  programs = lib.optionalAttrs (device.is "ryu" || device.is "kuro" || device.is "mirai" || device.is "tako") {
     nixvim =
       {
         enable = true;

nixos/mirai/configuration.nix

@@ -42,7 +42,7 @@
       cores = 8;
       auto-optimise-store = true;
       extra-experimental-features = "nix-command flakes auto-allocate-uids";
-      trusted-users = ["root" device.user "remotebuilder"];
+      trusted-users = [device.user "remotebuilder"];
       trusted-substituters = [
         "https://nix-community.cachix.org"
         "https://nixos-raspberrypi.cachix.org"

nixos/ryu/configuration.nix

@@ -43,7 +43,7 @@
       cores = 24;
       auto-optimise-store = true;
       extra-experimental-features = "nix-command flakes auto-allocate-uids";
-      trusted-users = ["root" device.user];
+      trusted-users = [device.user];
       trusted-substituters = [
         "https://nix-community.cachix.org"
         "https://nixos-raspberrypi.cachix.org"

nixos/tako/configuration.nix

@@ -42,7 +42,7 @@
       cores = 8;
       auto-optimise-store = true;
       extra-experimental-features = "nix-command flakes auto-allocate-uids";
-      trusted-users = ["root" device.user "remotebuilder"];
+      trusted-users = [device.user "remotebuilder"];
       trusted-substituters = [
         "https://nix-community.cachix.org"
         "https://nixos-raspberrypi.cachix.org"

nixos/tako/services/authelia.nix

@@ -1,4 +1,6 @@
-{config, ...}: {
+{config, ...}: let
+  port = 5555;
+in {
   sops = {
     secrets = let
       user = config.systemd.services.authelia-darksailor.serviceConfig.User;
@@ -71,7 +73,7 @@
           theme = "dark";
           notifier.filesystem.filename = "/var/lib/authelia-darksailor/authelia-notifier.log";
           server = {
-            address = "0.0.0.0:5555";
+            address = "0.0.0.0:${toString port}";
             endpoints.authz = {
               forward-auth = {
                 implementation = "ForwardAuth";
@@ -96,7 +98,7 @@
     };
     caddy = {
       virtualHosts."auth.darksailor.dev".extraConfig = ''
-        reverse_proxy localhost:5555 {
+        reverse_proxy localhost:${toString port} {
             # header_up Host {http.request.header.X-Forwarded-Host}
             # header_up X-Forwarded-Host {http.request.header.X-Forwarded-Host}
             # header_up X-Forwarded-Proto {http.request.header.X-Forwarded-Proto}

nixos/tako/services/default.nix

@@ -1,6 +1,5 @@
 {...}: {
   imports = [
-    # ./caddy.nix
     # ./excalidraw.nix
     # ./fail2ban.nix
     # ./flaresolverr.nix
@@ -17,9 +16,10 @@
     # ./headscale.nix
     # ./shitpost.nix
     ./atuin.nix
-    # ./immich.nix
+    ./caddy.nix
-    # ./lldap.nix
+    ./authelia.nix
-    # ./authelia.nix
+    ./immich.nix
+    ./lldap.nix
     ./openssh.nix
     ./tailscale.nix
   ];

nixos/tako/services/immich.nix

@@ -26,14 +26,14 @@
                 "clientId": "${config.sops.placeholder."authelia/oidc/immich/client_id"}",
                 "clientSecret": "${config.sops.placeholder."authelia/oidc/immich/client_secret"}",
                 "enabled": true,
-                "autoLaunch": true,
+                "autoLaunch": false,
                 "autoRegister": true,
                 "buttonText": "Login with Authelia",
                 "scope": "openid email profile",
                 "issuerUrl": "https://auth.darksailor.dev"
               },
               "passwordLogin" : {
-                "enabled": false
+                "enabled": true
               },
               "server": {
                 "externalDomain": "https://photos.darksailor.dev"

nixos/tako/services/lldap.nix

@@ -6,6 +6,7 @@
   services.lldap = {
     enable = true;
     settings = {
+      force_ldap_user_pass_reset = "always";
       ldap_user_dn = "admin";
       ldap_base_dn = "dc=darksailor,dc=dev";
       ldap_user_email = "admin@darksailor.dev";
@@ -14,10 +15,12 @@
       ldap_port = 389;
       ldap_host = "::";
       ldap_user_pass_file = config.sops.secrets."lldap/admin".path;
-      environmentFile = ''
+      jwt_secret_file = "${config.sops.secrets."lldap/jwt".path}";
-        LLDAP_JWT_SECRET_FILE = ${config.sops.secrets."lldap/jwt".path};
+    };
-        LLDAP_KEY_SEED_FILE = ${config.sops.secrets."lldap/seed".path};
+    environment = {
-      '';
+      LLDAP_JWT_SECRET_FILE = "${config.sops.secrets."lldap/jwt".path}";
+      # LLDAP_FORCE_UPDATE_PRIVATE_KEY = "true";
+      # LLDAP_KEY_SEED_FILE = "${config.sops.secrets."lldap/seed".path}";
     };
   };
   users.users.lldap = {

nixos/tsuba/configuration.nix

@@ -41,8 +41,8 @@
     distributedBuilds = true;
     buildMachines = [
       ../../builders/tako.nix
+      ../../builders/mirai.nix
       ../../builders/shiro.nix
-      ../../builders/tsuba.nix
     ];
   };
   users.users.${device.user} = {

secrets/secrets.yaml

@@ -49,7 +49,7 @@ authelia:
         jwks: ENC[AES256_GCM,data:1efhdlYmiD/y4kzK0hFfLAmY6rXK0hvZez/tu1cb2hfUhIM/DzNNthKQjH8Cu2TlZwDQpUIrCO7Tr0BbkiREC+VNK4vYgi+GWswnG7VCZS40xRAZhSArNO2uQ4dpf/KAHRSSJa3i7gGOqSG/Pnrl3TRhzkhkfWSRk+7koPWKpYJOKLem+ZLN75yssCsEbYIOHjcXyizNHt6SE2ylqqCjyWnlhlnRQStYaFPWAAABcm96MkSThSyRd6hTAifC/aZiM1IMlLw7wJJk01uwjJytlxBxDiFrdr4Grg0PzOsOAocex9Siw5fzcr7dFpVBoaS7e7nD/sccGSyEysw/t+wvkMou1Ewr5U2Pnew8lPjSrEiiGxuPwmK9kHxD3L6cADxF6xs4bn+Iqa/yy9FWbtGZfBYOxJiRvXgxBPiO7CH4tJyVIbnLfi8K/zCJC9u5vO+WFXiVIzXxAPVUL7VKQQZGxV7989LMdcjzck+B1zFHVQz25siwbpu0FxMxiJsVtBxu1U+QBRfQrwLacX2NAJvqYNZxr+9l43Fh0x8dS5CBheVEy39sXge9jLyS7kIW0FfvgJaHuLL2/GhDGsvfi7zFPOc8Thg+8LP58L8wzPT+LvVoidq/j3K2Ct6udn9JsOnbZT3Gs1RiY+E77H09GbdwIrP0sGVi4ZJe++w+sKNjyzLzceEYGkfa1EiMQhYPHzqUAwqtgmJZo9tY+2jOBJb9ZU+Kj0xtqZsjFpHaGWsRj8XGkPrAFEh6Z6/Ak9/BpYaapPeAO3Wa6tzNVlTCtaX786nSTjfGC7v9O4Uz8XQr0HV3A7wj36Fw3dqERZFKea7BJbiiAiEZtnOsbWVqQXpIUVfCvPhfwuFcOU/ClyM1fGyZXaCIeB62Tkqa+ZlqRQgzzf3bSFUK0PgxE3Ny5pIPzNEINqse+6DeFuF91uY1dLQB4Vizyzv1H+X/OecO9K8kECM1wUy3Fbbyh4tYYxt4VvqFQZ1o4A7Jd04WCIf3hdAHmwvOQW+/8dfnyLa8kqTcQYeI3jfjtRvD6TaZl21K9kFY2VJAexdno9bbozDOus1Ep92ublwonVjfvzbyDURHGF6Cw2OL7xcbHQIMz/ZmkVHMra49NHgWlI6X0slgYDxKKDszHhZ9SHkEXF8pJf+uogbwSwz1glRkEdn1oprbs8GsFoc7HGVvSHRgOWKHwvhZD2tMiSE4cEFZ9/2nSPISQMNGuS7wgnVkalKPW+gF1EWVXczanzKsrpcDtpMdFufMRVusaJBV5Jw62I++cx1AMW2dRTseQyWLchRWtOba6dd9gbNzGi39+njHClHIEUxaxXzxIQLhSgCA9loXRc26ZA6DpwHQR+gtH2OybeFEiH390YoSfFeZuU+f0E2awMdpiEsBL/AniUcboDaBEaDQYpwUawNL+II7rmSn4rTJM64n5z3B88U/vAQh9BQFhf7SDKb05n/ArCibkdy3gbo8rTVH1gGbmW53DTxzuW+AEpFcuueiP3yz1vGzEwKSX+LMkCwFwk6Y/VcqHXW+PdZ88SFUr5WELGPkZxT3AvmduBCifE0KDzKWrN3yy1xwEQDGrYiqeHqeqHpEuk/KpxeAwepqWayGMq6iT4BWUBojNo6quoXkPPodSsotbBFLjyRHoDGm0NZSbgluOUyERrN6M+ELdHqQjeNTS046KB6QnG5s+uTA+uxyonvmPCPBgFAd0q0qfq4T/SISHrPe13Y7nHnATxoMBszvIfKznqFthTBsc3V9C5+g/kcOzcEQpAC6baGe+eq23m/Go3uDa7O84Euxhj9C5NBcidvgmYmRZuY6l2ehnxf1oGoGwHBJEaYEuCk7sc3Wac6u2OvqCIKPxRdi2tUiZ9FwCGLqd8qcLEPtsSaBNk2CVlK9ZkgPzSYH794qpNQDWkyv5SJ4V9zy2LL+s9MHtHNQu6QxALZ8c0GfQetTI5ArkC3cBz/3mRdDMy9k7HpO7b6USoxqGAZ+H4kzJhus9QwjaqJnnB+fJI5O2ek5TVLY9RWXo+W2pCBDjt925BVoChkvkUEg4GtvR+8/yChgYEgYWUPqRV4vMEwQiRoaJamL/E+lRaUx+c0f9ga8+k0JdfxfzoIPUA3/rBGcfO8Y12RF8Ool4hreP409KjdPP0PeeOVKg58MPYNO5O0BdT62nyL+fSvJkw7uPGcOwtOtcxjcBsNhoFv0twrCp8S3cLX45GTNaTw+JHcxsTzG9ibL3bFtVkAAiZHZGMisEjTSGElSGIDk+MoPt68hq4BRioab,iv:gGKyTUigpnqg3Fgd76INrESRT27hJRzYQ3xk8heNkWk=,tag:fVc8rg1Or63X/14neG+8Cw==,type:str]
 lldap:
     jwt: ENC[AES256_GCM,data:61dwC1ElOOGaf0CmalzXZnxImEyufKjUUWcNaEcOuv3TEODhQyHK7g==,iv:CVEJVuaCc2gDmSYWHS3fPL8FjbvblF6IladAzGoGb0o=,tag:OMm/OdKjliHjsGqJripLbg==,type:str]
-    seed: ENC[AES256_GCM,data:zMBZP4GeGkQ4chC9eQ4tG8vTqbxZj4iQMKCj0WQd1qOWVTibpk6VylnFz5ugmeMR,iv:5ZFf/r683AHVlpp7iN9B6nY1b8tD/JSCxRN4vXT1cRM=,tag:MmeGpK9d2GFP3etr9Ouvkg==,type:str]
+    seed: ENC[AES256_GCM,data:jJPutPkhFVFxLbbQNZznHHiilP/cN2r+/vT4ArQVRQSqPMnkkwgc3LNk4sUTrT9V,iv:LD1IJ1CgtDfYf1gSyyaU+hir0InuDEq0u7ppMmwGJRY=,tag:cK4l4Evr7V9WEUEL7V9jtQ==,type:str]
     admin: ENC[AES256_GCM,data:6eLFuyt9hBzoAGfaDLi9cwxFj/yq20BDCSzbHzakZLo=,iv:qjczQ/hswAzVVS7gCUapzqhRx1dAE7FhRUvtovlMuY0=,tag:aMBFJy+USOd5Vy2QKjoD6Q==,type:str]
     users:
         authelia: ENC[AES256_GCM,data:6zddaWEBqJqfLaSzeANlSfldpw==,iv:jx3P9FThq7+LbwX0LpNK7qll3RJ5ibNfdDybS+KZG6U=,tag:RHNPLdbpkPy2aAcibljxAg==,type:str]
@@ -82,7 +82,7 @@ sops:
             VGZKdHpVeFRpQUxtSEkyaEhLMlBJcGsKLb0DvPNZosPBUuiX6qz1s5IO5INQh8CK
             ZtXTVClwMSmaUYhdSB2gKFrKVZHXTJZ4oAL5t/BpC0pOHyr+o96T3Q==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-11-22T15:13:49Z"
+    lastmodified: "2025-11-27T13:28:41Z"
-    mac: ENC[AES256_GCM,data:n8nE2sZE/uIoyQEeZpB1gYztlCZzZYziJcZE55rK73zdKl/3a7qOISMErBBsI/1d2vYx/Ju7aQjyTfnxsNEEIyZB4DMghxSmvubGTUA/cdLY5l2Y9mgMxq4gjpyNGDzEpScGhxhBoDJJvju3FWnsAig6gPJ1AC4nnol4mY+xUwg=,iv:XQ1PAUBXce/B6EteWTpwcBp1btEsvrEzoz5I4LEwk1g=,tag:dLthWuQyhJNOHC9shGXB9w==,type:str]
+    mac: ENC[AES256_GCM,data:KVdCTn6EXEAnj76kUL0d5eaYQJUc1HdfWTlwF+vku5wo2f9aJA2s6uyKXmhhx0e6q8muu10gMVObZzgae0vYZBOhO7GSxlLU9gCi4PaQo2Vz5mC75liCt3geoO9PTShZmLGaEPeuA9DFt/t3ggC2yqXij6uwz0SifvCuKM2QNzw=,iv:FSAa/eJBRDcxY+RLPy9O2PxLDibzRJrLh6+CtQNFtaQ=,tag:iNDr5XvpTJS8pNt9vZgOFw==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.11.0