feat: Update cinny to use hashRouter and update caddy reverse proxy

nixos/tako/services/matrix/tuwunel.nix

@@ -12,6 +12,10 @@
     defaultHomeserver = 0;
     homeserverList = ["darksailor.dev" "matrix.org"];
     allowCustomHomeservers = false;
+    hashRouter = {
+      enabled = true;
+      basename = "/";
+    };
   };
   cinnyConfigFile = pkgs.writeText "cinny-config.json" cinnyConfig;
 in {
@@ -68,14 +72,18 @@ in {
   };
   services.caddy.virtualHosts = {
     "matrix.${base_domain}".extraConfig = ''
+      handle /_matrix/* {
         reverse_proxy /_matrix/* localhost:${toString port}
+      }
       handle_path /config.json  {
         file_server
         root ${cinnyConfigFile}
       }
+      handle {
           root * ${pkgs.cinny}
-      try_files {path} / index.html
+          try_files {path} /index.html
           file_server
+      }
     '';
     "${base_domain}".extraConfig = ''
       reverse_proxy /.well-known/* localhost:${toString port}

nixos/tako/services/monitoring.nix

@@ -23,6 +23,9 @@
     caddy = 2019;
   };
 in {
+  sops.secrets."grafana/secret_key" = {
+    owner = "grafana";
+  };
   # Grafana configuration with Authelia integration
   services.grafana = {
     enable = true;
@@ -54,6 +57,7 @@ in {
       security = {
         disable_gravatar = true;
         cookie_secure = true;
+        secret_key = ''$__file{${config.sops.secrets."grafana/secret_key".path}}'';
       };
 
       analytics = {

secrets/secrets.yaml

@@ -79,7 +79,7 @@ minecraft:
     modded: ENC[AES256_GCM,data:6itrol9NObR3TczEeOa7wkykgqkpDus0VkHBRpU6VdQ=,iv:F56uYdHozJvkJ+m18aviTWzCrLfW2VcxkbOqpnRiniA=,tag:WLKA+uIJJtlDfMMOn0ak7Q==,type:str]
 grafana:
     adminPassword: ENC[AES256_GCM,data:im6FJVlVUoZg+9W6KmsqtloH4nB6AhXOcia5waRyFKj2DoQlt4jhPH1CFvw=,iv://D6aD/fGl7h4KmtQcQ0TQLWLfKdIs4+EMg2LWjPHvg=,tag:6gHu/V0V0a8GpcgA/hUwXg==,type:str]
-    secretKey: ENC[AES256_GCM,data:LD0x8Fa6SU1+6mwxLkKa/o+ZqeuRIr7o/AKS7EmrDYj0vzrA3/FjViVJNfkOJDch9TbVyjIpk2ZLwxHXOZx7MA==,iv:t6UwZj2JZpMIDsDDeJ4rZah4aBoMIKaoiu9VU2VhViE=,tag:MIz/b8JWYtOpUCcg6gYhJg==,type:str]
+    secret_key: ENC[AES256_GCM,data:QkNTWQyQGgD/zJ0C0nkqTuxJXCx/hqwFH1XrJEGcIB7U3PUNdMpvTYrazgGRUcfEUjMeCIbUgYcamrPJJgaBsA==,iv:RZa79OtDS74JErBk/j5wg/p02Rd4zCXLi4LQGffHLmU=,tag:sbsovzFXj3xmDIF+ACwPgQ==,type:str]
 discord:
     token: ENC[AES256_GCM,data:M6TayHpIa0J1w3zVRKPPU0P/f18UXOpxzU7fjKNCx8YxzSAaQfY52S5XpiqDgjPWfWdSxzG2VVDqu1708Vwofa8IRKwWafam,iv:x0ySoaS68aLRVUcQin096RoeQGRELvNwdFJxezPj/cA=,tag:Omv5uL97y7ZTI8juVJFNug==,type:str]
 lastfm:
@@ -119,7 +119,7 @@ sops:
             VGZKdHpVeFRpQUxtSEkyaEhLMlBJcGsKLb0DvPNZosPBUuiX6qz1s5IO5INQh8CK
             ZtXTVClwMSmaUYhdSB2gKFrKVZHXTJZ4oAL5t/BpC0pOHyr+o96T3Q==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-02-19T21:23:49Z"
+    lastmodified: "2026-02-24T08:02:58Z"
-    mac: ENC[AES256_GCM,data:Pey0VPpH1lZazbAqHrrwuoEHZL2Pi7uMV/tR8aLGI958JHDxuHZK41YEOsMa+aiOtiJclgRvO8iOb0oDESsVO5hDTCou7/sJe2Epk62lEclTiho+QnjhnEmP2qYcuWfR1PVwk/n/wkPWm+rBsYGH7PpQZeYUznWQaHPZPFNnIPw=,iv:KTe0Quu/MJA17BivQDCTnBi5IAGtq6x0GKaqm4MuUUo=,tag:IPehj8blXzuEr0HN85y4eg==,type:str]
+    mac: ENC[AES256_GCM,data:JzKh6k1nzp2sTDXFG0/bJbBSksCri2WIcXU0C+cyCg6hHzQMsKc36xSRfyrytW8r6rCooJRlC46nPYvFH9JhG/1uIAx4QU/PAvgzEKvXOQi2xXULajpEeCAdmU8TERl3to9JCTAhCbV7oibzOalC6WbVOfhQvqBYWN2JamwCHwc=,iv:oMmpcadFUZT5mdMQ8BzGoKKdpV2PvtaoXhOsKSYUGII=,tag:cdBim93M98OcSNZsmPQ57A==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.11.0