diff --git a/ci/build.sh b/ci/build.sh deleted file mode 100755 index e5c7a26..0000000 --- a/ci/build.sh +++ /dev/null @@ -1,77 +0,0 @@ -#!/usr/bin/env bash - -set -euo pipefail - -APP="$1" - -if [ "$APP" = "hugo-chat" ]; then - REPO="https://github.com/C0RR1T/HugoChat.git" -elif [ "$APP" = "cors" ]; then - REPO="https://github.com/noratrieb-lehre/davinci-cors.git" -else - REPO="https://github.com/Noratrieb/$APP.git" -fi - -echo "Checking out $REPO" -git clone "$REPO" ../app -cd ../app - -CURRENT_COMMIT=$(git rev-parse HEAD | cut -c1-8) -echo "Latest commit of $APP is $CURRENT_COMMIT" - -echo "**Commit: \`$CURRENT_COMMIT\`**" >> "$GITHUB_STEP_SUMMARY" - -if [ "$APP" = "hugo-chat" ]; then - IMAGE_PREFIX="docker.noratrieb.dev/hugo-chat" - SERVER_FULL_NAME="$IMAGE_PREFIX-server:$CURRENT_COMMIT" - CLIENT_FULL_NAME="$IMAGE_PREFIX-client:$CURRENT_COMMIT" - - pushd ./HugoServer - echo "Building server" - docker build . -t "$SERVER_FULL_NAME" - docker push "$SERVER_FULL_NAME" - popd - - pushd ./hugo-client - echo "Building client" - docker build . -t "$CLIENT_FULL_NAME" - docker push "$CLIENT_FULL_NAME" - popd - - exit 0 -fi - -if [ "$APP" = "cors" ]; then - IMAGE_PREFIX="docker.noratrieb.dev/cors-school" - SERVER_FULL_NAME="$IMAGE_PREFIX-server:$CURRENT_COMMIT" - CLIENT_FULL_NAME="$IMAGE_PREFIX-client:$CURRENT_COMMIT" - BOT_FULL_NAME="$IMAGE_PREFIX-bot:$CURRENT_COMMIT" - - pushd ./react-frontend - echo "Building frontend" - docker build -t "$CLIENT_FULL_NAME" . - docker push "$CLIENT_FULL_NAME" - popd - - pushd ./rust - echo "Building server" - docker build -t "$SERVER_FULL_NAME" -f Dockerfile.server . - docker push "$SERVER_FULL_NAME" - - echo "Building bot" - docker build -t "$BOT_FULL_NAME" -f Dockerfile.bot . - docker push "$BOT_FULL_NAME" - popd - - exit 0 -fi - -if [ "$APP" = "dockerolat" ]; then - APP="openolat" -fi - -IMAGE_PREFIX="docker.noratrieb.dev/$APP" -IMAGE_FULL_NAME="$IMAGE_PREFIX:$CURRENT_COMMIT" - -docker build . -t "$IMAGE_FULL_NAME" -docker push "$IMAGE_FULL_NAME" diff --git a/nix/apps/does-it-build/default.nix b/nix/apps/does-it-build/default.nix index 7941ae7..588d0af 100644 --- a/nix/apps/does-it-build/default.nix +++ b/nix/apps/does-it-build/default.nix @@ -1,11 +1,15 @@ -{ pkgs, lib, my-projects-versions, ... }: +{ pkgs, lib, config, my-projects-versions, ... }: let - does-it-build-base = (import (pkgs.fetchFromGitHub my-projects-versions.does-it-build.fetchFromGitHub)) { inherit pkgs; }; + does-it-build-base = (import (pkgs.fetchFromGitHub my-projects-versions.does-it-build.fetchFromGitHub)) { + inherit pkgs; + }; does-it-build = does-it-build-base.overrideAttrs (finalAttrs: previousAttrs: { DOES_IT_BUILD_OVERRIDE_VERSION = my-projects-versions.does-it-build.commit; }); in { + age.secrets.does_it_build_private_key.file = ../../secrets/does_it_build_private_key.age; + services.caddy.virtualHosts = { "does-it-build.noratrieb.dev" = { logFormat = ""; @@ -35,7 +39,32 @@ in User = "does-it-build"; Group = "does-it-build"; ExecStart = "${lib.getExe' (does-it-build) "does-it-build" }"; - Environment = "DB_PATH=/var/lib/does-it-build/db.sqlite"; + Environment = [ + "DB_PATH=/var/lib/does-it-build/db.sqlite" + "GITHUB_SEND_PINGS=1" + "GITHUB_OWNER=Noratrieb" + "GITHUB_REPO=does-it-build-notifications" + "GITHUB_APP_ID=2263995" # https://github.com/settings/apps/does-it-build + ]; + # GITHUB_APP_PRIVATE_KEY=-----BEGIN RSA PRIVATE KEY-----... + EnvironmentFile = [ config.age.secrets.does_it_build_private_key.path ]; + + ProtectHome = true; + StateDirectory = "does-it-build"; + ProtectSystem = "strict"; + PrivateTmp = true; + + RemoveIPC = true; + NoNewPrivileges = true; + PrivateDevices = true; + ProtectClock = true; + ProtectKernelLogs = true; + ProtectControlGroups = true; + ProtectKernelModules = true; + PrivateMounts = true; + RestrictNamespaces = ""; + RestrictSUIDSGID = true; + ProtectHostname = true; }; }; diff --git a/nix/apps/hugo-chat/default.nix b/nix/apps/hugo-chat/default.nix index a62350c..2229650 100644 --- a/nix/apps/hugo-chat/default.nix +++ b/nix/apps/hugo-chat/default.nix @@ -9,6 +9,7 @@ let url = "https://github.com/C0RR1T/HugoChat/releases/download/2024-08-05/hugo-client.tar.xz"; sha256 = "sha256:121ai8q6bm7gp0pl1ajfk0k2nrfg05zid61i20z0j5gpb2qyhsib"; + stripRoot = false; }; in { @@ -61,35 +62,27 @@ in "api.hugo-chat.noratrieb.dev" = let cors = pkgs.writeText "cors" '' - # https://gist.github.com/ryanburnette/d13575c9ced201e73f8169d3a793c1a3 - @cors_preflight{args[0]} method OPTIONS - @cors{args[0]} header Origin {args[0]} - - handle @cors_preflight{args[0]} { - header { - Access-Control-Allow-Origin "{args[0]}" - Access-Control-Allow-Methods "GET, POST, PUT, PATCH, DELETE, OPTIONS" - Access-Control-Allow-Credentials "false" - Access-Control-Allow-Headers "$${args[1]}" - Access-Control-Max-Age "86400" - defer - } - respond "" 204 + @cors_preflight { + method OPTIONS + header Origin * } - handle @cors{args[0]} { + handle @cors_preflight { header { - Access-Control-Allow-Origin "{args[0]}" - Access-Control-Expose-Headers * - defer + Access-Control-Allow-Origin "*" + Access-Control-Allow-Methods "*" + Access-Control-Allow-Headers "content-type" } + respond 204 } + + ''; in { logFormat = ""; extraConfig = '' - import ${cors} https://hugo-chat.noratrieb.dev "DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type" + import ${cors} encode zstd gzip reverse_proxy * localhost:5001 ''; diff --git a/nix/apps/matrix/default.nix b/nix/apps/matrix/default.nix new file mode 100644 index 0000000..0906cd1 --- /dev/null +++ b/nix/apps/matrix/default.nix @@ -0,0 +1,36 @@ +{ pkgs, ... }: { + services.matrix-continuwuity = { + enable = true; + settings = { + global = { + server_name = "noratrieb.dev"; + allow_registration = false; + allow_encryption = true; + allow_federation = true; + trusted_servers = [ "matrix.org" ]; + well_known = { + server = "matrix.noratrieb.dev:443"; + client = "https://matrix.noratrieb.dev"; + support_page = "https://noratrieb.dev"; + }; + }; + }; + }; + environment.systemPackages = [ pkgs.matrix-continuwuity ]; + services.caddy.virtualHosts."matrix.noratrieb.dev" = { + extraConfig = '' + encode zstd gzip + + reverse_proxy * http://localhost:6167 + ''; + }; + services.caddy.virtualHosts."matrix.noratrieb.dev:8448" = { + extraConfig = '' + encode zstd gzip + + reverse_proxy * http://localhost:6167 + ''; + }; + networking.firewall.allowedTCPPorts = [ 8448 ]; + networking.firewall.interfaces.wg0.allowedTCPPorts = [ 6167 ]; +} diff --git a/nix/apps/website/default.nix b/nix/apps/website/default.nix index e61608c..bd5105b 100644 --- a/nix/apps/website/default.nix +++ b/nix/apps/website/default.nix @@ -1,25 +1,39 @@ -{ pkgs, lib, my-projects-versions, ... }: -let - website = import (pkgs.fetchFromGitHub my-projects-versions.website.fetchFromGitHub); - blog = pkgs.fetchFromGitHub my-projects-versions.blog.fetchFromGitHub; - slides = pkgs.fetchFromGitHub my-projects-versions.slides.fetchFromGitHub; - website-build = website { inherit pkgs slides blog; }; -in -{ +{ ... }: { + services.caddy.globalConfig = '' + filesystem garage s3 { + bucket noratrieb.dev + region garage + endpoint http://localhost:3900 + use_path_style + } + ''; services.caddy.virtualHosts = { "noratrieb.dev" = { logFormat = ""; extraConfig = '' encode zstd gzip + + reverse_proxy /.well-known/matrix/* https://matrix.noratrieb.dev { + header_up Host matrix.noratrieb.dev + } + + header -Last-Modified - root * ${import ../../packages/caddy-static-prepare { - name = "website"; - src = website-build; - inherit pkgs lib; - }} + + header /blog/css/* Cache-Control "max-age=31540000, immutable" + header /blog/fonts/* Cache-Control "max-age=31540000, immutable" + + @txt { + path / + not header Accept *text/html* + } + rewrite @txt /index.txt + file_server { - etag_file_extensions .sha256 - precompressed zstd gzip br + fs garage + # TODO: run precompress script + # etag_file_extensions .sha256 + # precompressed zstd gzip br } ''; }; @@ -30,5 +44,12 @@ in reverse_proxy * localhost:3902 ''; }; + "womangling.noratrieb.dev" = { + logFormat = ""; + extraConfig = '' + encode zstd gzip + reverse_proxy * localhost:3902 + ''; + }; }; } diff --git a/nix/apps/widetom/default.nix b/nix/apps/widetom/default.nix index c7372fd..a6e549a 100644 --- a/nix/apps/widetom/default.nix +++ b/nix/apps/widetom/default.nix @@ -4,10 +4,11 @@ let src = pkgs.fetchFromGitHub my-projects-versions.widetom.fetchFromGitHub; pname = "widetom"; version = "0.1.0"; - cargoHash = "sha256-AWbdPcDc+QOW7U/FYbqlIsg+3MwfggKCTCw1z/ZbSEE="; + cargoHash = "sha256-riQA+GviHMqiSvoRKcJhM3MGVEIv6urgYyvBZZd4fCc="; meta = { mainProgram = "widertom"; }; + RUSTFLAGS = "-Cforce-frame-pointers=true"; }; in { @@ -31,6 +32,21 @@ in serviceConfig = { DynamicUser = true; ExecStart = lib.getExe widetom; + PrivateDevices = true; + ProtectHome = true; + ProtectClock = true; + ProtectKernelLogs = true; + ProtectHostname = true; + ProtectKernelTunables = true; + CapabilityBoundingSet = ""; + ProtectProc = "noaccess"; + RestrictNamespaces = true; + MemoryDenyWriteExecute = true; + ProtectControlGroups = true; + ProtectKernelModules = true; + SystemCallArchitectures = ""; + SystemCallFilter = "@system-service"; + RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ]; }; }; diff --git a/nix/deploy/smoke-tests.sh b/nix/deploy/smoke-tests.sh index 84107f9..5054a61 100755 --- a/nix/deploy/smoke-tests.sh +++ b/nix/deploy/smoke-tests.sh @@ -23,10 +23,9 @@ check_dig_answer A "nilstrieb.dev" "161.97.165.1" check_dig_answer NS noratrieb.dev "noratrieb.dev..*3600.*IN.*NS.*ns1.noratrieb.dev." # Mail stuff -check_dig_answer MX noratrieb.dev "mail.protonmail.ch." -check_dig_answer MX noratrieb.dev "mailsec.protonmail.ch." -check_dig_answer TXT noratrieb.dev "protonmail-verification=09106d260e40df267109be219d9c7b2759e808b5" -check_dig_answer TXT noratrieb.dev "v=spf1 include:_spf.protonmail.ch ~all" +check_dig_answer MX noratrieb.dev "mail.tutanota.de." +check_dig_answer TXT noratrieb.dev "t-verify=dae826f2ae9f73a71cc247183616b6c9" +check_dig_answer TXT noratrieb.dev "v=spf1 include:spf.tutanota.de -all" # Check HTTP responses http_hosts=( diff --git a/nix/hive.nix b/nix/hive.nix index f31e3b2..eee6101 100644 --- a/nix/hive.nix +++ b/nix/hive.nix @@ -2,7 +2,7 @@ meta = let nixpkgs-version = builtins.fromJSON (builtins.readFile ./nixpkgs.json); - nixpkgs-path = (fetchTarball "https://github.com/NixOS/nixpkgs/archive/${nixpkgs-version.commit}.tar.gz"); + nixpkgs-path = (fetchTarball "https://github.com/NixOS/nixpkgs/archive/${nixpkgs-version."nixos-25.11".commit}.tar.gz"); in { # Override to pin the Nixpkgs version (recommended). This option @@ -66,7 +66,7 @@ wg = { privateIP = "10.0.0.3"; publicKey = "pdUxG1vhmYraKzIIEFxTRAMhGwGztBL/Ly5icJUV3g0="; - peers = [ "vps1" "vps2" "vps4" "vps5" "dns1" "dns2" ]; + peers = [ "vps1" "vps2" "vps4" "vps5" "dns1" "dns2" "minipc" ]; }; tags = [ "apps" ]; }; @@ -92,6 +92,17 @@ }; tags = [ "apps" ]; }; + minipc = { + publicIPv4 = null; + publicIPv6 = null; + wg = { + privateIP = "10.0.2.1"; + publicKey = "ecYfTot7RrJyNebSZTQ1wciOhvrpNSSbkR15twpSSl4="; + peers = [ "vps3" ]; + noEndpoint = true; + }; + tags = [ "home" ]; + }; }; }; @@ -179,6 +190,7 @@ ./modules/registry ./modules/backup ./modules/restic + ./modules/snowflake-proxy # apps ./apps/website @@ -201,6 +213,10 @@ ./modules/wg-mesh ./modules/caddy ./modules/garage + ./modules/snowflake-proxy + + # apps + ./apps/matrix ]; system.stateVersion = "23.11"; @@ -214,6 +230,7 @@ ./modules/caddy ./modules/garage ./modules/prometheus + ./modules/snowflake-proxy ./apps/website ]; @@ -229,6 +246,7 @@ ./modules/garage ./modules/backup ./modules/restic + ./modules/snowflake-proxy # apps ./apps/website @@ -284,6 +302,7 @@ ./modules/caddy ./modules/wg-mesh ./modules/garage + ./modules/snowflake-proxy ./apps/fakessh ]; @@ -292,4 +311,18 @@ system.stateVersion = "23.11"; }; + minipc = { name, nodes, modulesPath, config, pkgs, lib, ... }: { + imports = [ + ./modules/minipc + ./modules/wg-mesh + ./modules/nas-mount + ./modules/postgres + ./modules/immich + ./modules/tailscale + ./modules/paperless + ./modules/caddy-base + ]; + + system.stateVersion = "25.05"; + }; } diff --git a/nix/modules/caddy-base/default.nix b/nix/modules/caddy-base/default.nix new file mode 100644 index 0000000..a33e7b3 --- /dev/null +++ b/nix/modules/caddy-base/default.nix @@ -0,0 +1,50 @@ +{ pkgs, ... }: +let + caddy = pkgs.caddy.withPlugins { + plugins = [ + "github.com/noratrieb-mirrors/certmagic-s3@v1.1.3" + "github.com/sagikazarmark/caddy-fs-s3@v0.10.0" + "github.com/caddy-dns/rfc2136@v1.0.0" + ]; + hash = "sha256-m5RHlrheqzoGqKQxixq+xTd2hlnCTets9zCT7aFka8g="; + }; +in +{ + environment.systemPackages = [ pkgs.caddy ]; + + networking.firewall.interfaces.wg0.allowedTCPPorts = [ 9010 ]; # metrics + + networking.firewall = { + allowedTCPPorts = [ + 80 # HTTP + 443 # HTTPS + ]; + allowedUDPPorts = [ + 443 # HTTP/3 via QUIC + ]; + }; + + services.caddy = { + enable = true; + package = caddy; + logFormat = '' + output stdout + format json + ''; + globalConfig = '' + auto_https disable_redirects + + servers { + metrics + } + ''; + virtualHosts = { + ":9010" = { + logFormat = "output discard"; + extraConfig = '' + metrics /metrics + ''; + }; + }; + }; +} diff --git a/nix/modules/caddy/default.nix b/nix/modules/caddy/default.nix index bd5f448..bec542b 100644 --- a/nix/modules/caddy/default.nix +++ b/nix/modules/caddy/default.nix @@ -1,39 +1,11 @@ -{ pkgs, config, lib, name, ... }: - -let - caddy = pkgs.caddy.withPlugins { - plugins = [ - "github.com/noratrieb-mirrors/certmagic-s3@v1.1.3" - ]; - hash = "sha256-HdCXbqrrGPZSdHv7bZvGz9T6loVbrfKydTbjTyt5Wt0="; - }; -in -{ - environment.systemPackages = [ caddy ]; - - networking.firewall.interfaces.wg0.allowedTCPPorts = [ 9010 ]; # metrics - - networking.firewall = { - allowedTCPPorts = [ - 80 # HTTP - 443 # HTTPS - ]; - allowedUDPPorts = [ - 443 # HTTP/3 via QUIC - ]; - }; +{ pkgs, config, lib, name, ... }: { + imports = [ ../caddy-base ]; age.secrets.caddy_s3_key_secret.file = ../../secrets/caddy_s3_key_secret.age; - systemd.services.caddy.serviceConfig.EnvironmentFile = config.age.secrets.caddy_s3_key_secret.path; + systemd.services.caddy.serviceConfig.EnvironmentFile = [ config.age.secrets.caddy_s3_key_secret.path ]; systemd.services.caddy.after = [ "garage.service" ]; # the cert store depends on garage services.caddy = { - enable = true; - package = caddy; - logFormat = '' - output stdout - format json - ''; globalConfig = '' email tls@noratrieb.dev auto_https disable_redirects @@ -47,6 +19,17 @@ in insecure true } + acme_dns rfc2136 { + key_name "test" + key_alg "hmac-sha256" + key "" + server "dns1.local:53" + } + + tls { + dns_challenge_override_domain "nilstrieb.dev" + } + servers { metrics } @@ -58,12 +41,6 @@ in respond "This is an HTTPS-only server, silly you. Go to https:// instead." 418 ''; }; - ":9010" = { - logFormat = "output discard"; - extraConfig = '' - metrics /metrics - ''; - }; "${name}.infra.noratrieb.dev" = { logFormat = ""; extraConfig = '' diff --git a/nix/modules/default/default.nix b/nix/modules/default/default.nix index 4138af9..e3b668a 100644 --- a/nix/modules/default/default.nix +++ b/nix/modules/default/default.nix @@ -2,9 +2,12 @@ let pretense = import (pkgs.fetchFromGitHub my-projects-versions.pretense.fetchFromGitHub); quotdd = import (pkgs.fetchFromGitHub my-projects-versions.quotdd.fetchFromGitHub); + networkConfig = networkingConfig."${name}"; in { - deployment.targetHost = "${name}.infra.noratrieb.dev"; + deployment.targetHost = + if networkConfig.publicIPv4 == null + then name else "${name}.infra.noratrieb.dev"; # TODO: ensure that the rust programs have frame pointers @@ -20,6 +23,8 @@ in nixPath = [ "nixpkgs=${nixpkgs-path}" ]; }; + nixpkgs.config.allowUnfree = true; + environment.systemPackages = with pkgs; [ vim wget @@ -27,10 +32,14 @@ in traceroute dnsutils nftables + htop ]; networking.hostName = name; + # Swiss german console tty keyboard layout + console.keyMap = "sg"; + time.timeZone = "Europe/Zurich"; users.users.root.openssh.authorizedKeys.keys = [ ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG0n1ikUG9rYqobh7WpAyXrqZqxQoQ2zNJrFPj12gTpP nilsh@PC-Nils'' ]; @@ -60,6 +69,7 @@ in settings = { PasswordAuthentication = false; + AllowUsers = [ "root" ]; }; }; services.fail2ban = { @@ -79,6 +89,22 @@ in "PRETENSE_PORTS=23,3306,5432,1521" # telnet,mysql,postgres,oracle "PRETENSE_METRICS_PORT=9150" ]; + PrivateDevices = true; + ProtectHome = true; + ProtectClock = true; + ProtectKernelLogs = true; + ProtectHostname = true; + ProtectKernelTunables = true; + CapabilityBoundingSet = "CAP_NET_BIND_SERVICE"; + ProtectProc = "ptraceable"; + RestrictNamespaces = true; + MemoryDenyWriteExecute = true; + ProtectControlGroups = true; + ProtectKernelModules = true; + SystemCallArchitectures = ""; + SystemCallFilter = "@system-service"; + RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ]; + ProtectSystem = "strict"; }; }; systemd.services.quotdd = { @@ -90,6 +116,23 @@ in ExecStart = "${lib.getExe (quotdd {inherit pkgs;})}"; AmbientCapabilities = "CAP_NET_BIND_SERVICE"; Environment = [ ]; + + PrivateDevices = true; + ProtectHome = true; + ProtectClock = true; + ProtectKernelLogs = true; + ProtectHostname = true; + ProtectKernelTunables = true; + CapabilityBoundingSet = "CAP_NET_BIND_SERVICE"; + ProtectProc = "ptraceable"; + RestrictNamespaces = true; + MemoryDenyWriteExecute = true; + ProtectControlGroups = true; + ProtectKernelModules = true; + SystemCallArchitectures = ""; + SystemCallFilter = "@system-service"; + RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ]; + ProtectSystem = "strict"; }; }; networking.firewall.allowedTCPPorts = [ @@ -188,6 +231,22 @@ in }; systemd.services.alloy.serviceConfig = { DynamicUser = lib.mkForce false; + PrivateDevices = true; + ProtectClock = true; + ProtectKernelLogs = true; + PrivateMounts = true; + ProtectControlGroups = true; + ProtectHostname = true; + LockPersonality = true; + ProtectKernelTunables = true; + ProtectSystem = true; + ProtectHome = true; + PrivateTmp = true; + NoNewPrivileges = true; + RestrictNamespaces = ""; + RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" ]; + # TODO: find what's required for /proc/kallsyms (it should be CAP_SYSLOG!) + # CapabilityBoundingSet = "CAP_SYS_PTRACE CAP_BPF CAP_SYSLOG"; }; environment.etc."alloy/config.alloy".text = '' discovery.process "all" { diff --git a/nix/modules/dns/default.nix b/nix/modules/dns/default.nix index 815eed0..7d1c858 100644 --- a/nix/modules/dns/default.nix +++ b/nix/modules/dns/default.nix @@ -1,6 +1,12 @@ -{ pkgs, lib, networkingConfig, ... }: +{ pkgs, lib, networkingConfig, config, ... }: let metricsPort = 9433; in { + age.secrets.knot_dns_rfc2136_key_config = { + file = + ../../secrets/knot_dns_rfc2136_key_config.age; + owner = "knot"; + }; + # get the package for the debugging tools environment.systemPackages = with pkgs; [ knot-dns ]; @@ -21,12 +27,25 @@ let metricsPort = 9433; in services.knot = { enable = true; + keyFiles = [ config.age.secrets.knot_dns_rfc2136_key_config.path ]; settingsFile = pkgs.writeTextFile { name = "knot.conf"; text = '' server: listen: 0.0.0.0@53 listen: ::@53 + + key: + - id: rfc2136-update + algorithm: hmac-sha256 + secret: QRpeYCJLokRWyzT/tWrxaly5Seb5yTkE6/Ub66edWds= + + acl: + - id: update_acl + address: 10.0.0.0/24 + key: rfc2136-update + action: update + update-type: [TXT] zone: - domain: noratrieb.dev @@ -35,6 +54,7 @@ let metricsPort = 9433; in - domain: nilstrieb.dev storage: /var/lib/knot/zones/ file: ${import ./nilstrieb.dev.nix { inherit pkgs lib networkingConfig; }} + acl: update_acl log: - target: syslog any: info diff --git a/nix/modules/dns/nilstrieb.dev.nix b/nix/modules/dns/nilstrieb.dev.nix index 1d0fb7d..c013f4f 100644 --- a/nix/modules/dns/nilstrieb.dev.nix +++ b/nix/modules/dns/nilstrieb.dev.nix @@ -18,7 +18,7 @@ let vps1 // { TTL = hour1; SOA = { - nameServer = "ns1.nilstrieb.dev."; + nameServer = "ns.nilstrieb.dev."; adminEmail = "void@nilstrieb.dev"; serial = 2024072601; }; @@ -34,6 +34,7 @@ let ]; subdomains = { + ns = dns1; ns1 = dns1; ns2 = dns2; diff --git a/nix/modules/dns/noratrieb.dev.nix b/nix/modules/dns/noratrieb.dev.nix index b14b131..808e0b1 100644 --- a/nix/modules/dns/noratrieb.dev.nix +++ b/nix/modules/dns/noratrieb.dev.nix @@ -14,6 +14,10 @@ let A = lib.lists.flatten (map (host: if builtins.hasAttr "A" host then host.A else [ ]) hosts); AAAA = lib.lists.flatten (map (host: if builtins.hasAttr "AAAA" host then host.AAAA else [ ]) hosts); }; + + minipc = { + A = [ (a "100.100.2.1") ]; # tailscale IP + }; in with hostsToDns; # vps{1,3,4} contains root noratrieb.dev @@ -37,13 +41,12 @@ let TXT = [ "protonmail-verification=09106d260e40df267109be219d9c7b2759e808b5" - "v=spf1 include:_spf.protonmail.ch ~all" + "t-verify=dae826f2ae9f73a71cc247183616b6c9" # tuta verification + "v=spf1 include:spf.tutanota.de -all" ]; - MX = [ - (mx.mx 10 "mail.protonmail.ch.") - (mx.mx 20 "mailsec.protonmail.ch.") + (ttl 60 (mx.mx 10 "mail.tutanota.de.")) ]; subdomains = { @@ -51,6 +54,9 @@ let ns1 = dns1; ns2 = dns2; + # --- ACME setup for caddy + _acme-challenge.CNAME = [ (cname "_acme-challenge.nilstrieb.dev.") ]; + # --- website stuff blog = vps1; www = vps1; @@ -60,6 +66,12 @@ let }; }; + womangling = combine [ vps1 vps3 vps4 ]; + + garage = combine [ vps1 vps2 vps3 vps4 ]; + + matrix = vps2; + # --- apps docker = vps1; hugo-chat = vps1 // { @@ -84,18 +96,26 @@ let grafana = vps3; infra.subdomains = hostsToDns; + # --- internal stuff + internal.subdomains = { + immich = minipc; + paperless = minipc; + }; + # --- other verification _discord.TXT = [ "dh=e0f7e99c70c4ce17f7afcce3be8bfda9cd363843" ]; _atproto.TXT = [ "did=did:plc:pqyzoyxk7gfcbxk65mjyncyl" ]; # --- email + _mta-sts.CNAME = [ (cname "mta-sts.tutanota.de.") ]; + mta-sts.CNAME = [ (cname "mta-sts.tutanota.de.") ]; + _domainkey.subdomains = { - protonmail.CNAME = [ (cname "protonmail.domainkey.deenxxi4ieo32na6brazky2h7bt5ezko6vexdbvbzzbtj6oj43kca.domains.proton.ch.") ]; - protonmail2.CNAME = [ (cname "protonmail2.domainkey.deenxxi4ieo32na6brazky2h7bt5ezko6vexdbvbzzbtj6oj43kca.domains.proton.ch.") ]; - protonmail3.CNAME = [ (cname "protonmail3.domainkey.deenxxi4ieo32na6brazky2h7bt5ezko6vexdbvbzzbtj6oj43kca.domains.proton.ch.") ]; + s1.CNAME = [ (cname "s1.domainkey.tutanota.de.") ]; + s2.CNAME = [ (cname "s2.domainkey.tutanota.de.") ]; }; _dmarc.TXT = [ - "v=DMARC1; p=quarantine" + "v=DMARC1; p=quarantine; adkim=s" ]; # retired diff --git a/nix/modules/garage/default.nix b/nix/modules/garage/default.nix index d50d3c5..409dcc6 100644 --- a/nix/modules/garage/default.nix +++ b/nix/modules/garage/default.nix @@ -20,7 +20,7 @@ in }; services.garage = { enable = true; - package = pkgs.garage_2_0_0; + package = pkgs.garage_2; settings = { metadata_dir = "/var/lib/garage/meta"; data_dir = "/var/lib/garage/data"; @@ -53,5 +53,12 @@ in }; environmentFile = config.age.secrets.garage_secrets.path; }; + services.caddy.virtualHosts."garage.noratrieb.dev" = { + logFormat = ""; + extraConfig = '' + encode zstd gzip + reverse_proxy * localhost:3900 + ''; + }; } diff --git a/nix/modules/immich/default.nix b/nix/modules/immich/default.nix new file mode 100644 index 0000000..9d3b52c --- /dev/null +++ b/nix/modules/immich/default.nix @@ -0,0 +1,34 @@ +{ config, pkgs, ... }: { + age.secrets.immich_secrets.file = ../../secrets/immich_secrets.age; + + services.immich = { + enable = true; + mediaLocation = "/mnt/nas/HEY/_Nora/immich"; + secretsFile = config.age.secrets.immich_secrets.path; + host = "0.0.0.0"; + database = { + enableVectors = false; + enableVectorChord = true; + }; + environment = { + IMMICH_TELEMETRY_INCLUDE = "all"; + }; + openFirewall = true; + }; + + services.postgresql = { + ensureDatabases = [ "immich" ]; + ensureUsers = [ + { + name = "immich"; + ensureDBOwnership = true; + } + ]; + authentication = pkgs.lib.mkForce '' + #type database DBuser auth-method + local all all peer + ''; + }; + + networking.firewall.interfaces.wg0.allowedTCPPorts = [ 8081 8082 ]; +} diff --git a/nix/modules/minipc/default.nix b/nix/modules/minipc/default.nix new file mode 100644 index 0000000..39adc61 --- /dev/null +++ b/nix/modules/minipc/default.nix @@ -0,0 +1,8 @@ +{ ... }: { + imports = [ ./hardware-configuration.nix ]; + + networking.networkmanager.enable = true; + + boot.loader.systemd-boot.enable = true; + boot.loader.efi.canTouchEfiVariables = true; +} diff --git a/nix/modules/minipc/hardware-configuration.nix b/nix/modules/minipc/hardware-configuration.nix new file mode 100644 index 0000000..b8476f3 --- /dev/null +++ b/nix/modules/minipc/hardware-configuration.nix @@ -0,0 +1,42 @@ +# Do not modify this file! It was generated by ‘nixos-generate-config’ +# and may be overwritten by future invocations. Please make changes +# to /etc/nixos/configuration.nix instead. +{ config, lib, pkgs, modulesPath, ... }: + +{ + imports = + [ + (modulesPath + "/installer/scan/not-detected.nix") + ]; + + boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usbhid" "usb_storage" "sd_mod" ]; + boot.initrd.kernelModules = [ ]; + boot.kernelModules = [ "kvm-intel" ]; + boot.extraModulePackages = [ ]; + + fileSystems."/" = + { + device = "/dev/disk/by-uuid/9327fdbf-f6d2-41ae-b69f-6dbb97ab388a"; + fsType = "ext4"; + }; + + fileSystems."/boot" = + { + device = "/dev/disk/by-uuid/2A59-D3C9"; + fsType = "vfat"; + options = [ "fmask=0077" "dmask=0077" ]; + }; + + swapDevices = + [{ device = "/dev/disk/by-uuid/db30dd66-fa2a-46a4-b81a-b0fc935db5ac"; }]; + + # Enables DHCP on each ethernet and wireless interface. In case of scripted networking + # (the default) this is the recommended approach. When using systemd-networkd it's + # still possible to use this option, but it's recommended to use it in conjunction + # with explicit per-interface declarations with `networking.interfaces..useDHCP`. + networking.useDHCP = lib.mkDefault true; + # networking.interfaces.enp2s0.useDHCP = lib.mkDefault true; + + nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; + hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; +} diff --git a/nix/modules/nas-mount/default.nix b/nix/modules/nas-mount/default.nix new file mode 100644 index 0000000..0379576 --- /dev/null +++ b/nix/modules/nas-mount/default.nix @@ -0,0 +1,6 @@ +{ ... }: { + fileSystems."/mnt/nas" = { + device = "nas:/volume1/homes"; + fsType = "nfs"; + }; +} diff --git a/nix/modules/paperless/default.nix b/nix/modules/paperless/default.nix new file mode 100644 index 0000000..5cb60cb --- /dev/null +++ b/nix/modules/paperless/default.nix @@ -0,0 +1,24 @@ +{ config, ... }: +let nasDir = "/mnt/nas/HEY/_Nora/paperless"; in { + age.secrets.paperless_env.file = ../../secrets/paperless_env.age; + + services.paperless = { + enable = true; + consumptionDir = "${nasDir}/consume"; + address = "0.0.0.0"; + port = 8010; + environmentFile = config.age.secrets.paperless_env.path; + settings = { + PAPERLESS_TIME_ZONE = "Europe/Zurich"; + PAPERLESS_ADMIN_USER = "nora"; + PAPERLESS_OCR_LANGUAGE = "deu+eng"; + }; + exporter = { + enable = true; + directory = "${nasDir}/export_minipc"; + onCalendar = "02:25:00"; + }; + }; + + networking.firewall.allowedTCPPorts = [ 8010 ]; +} diff --git a/nix/modules/postgres/default.nix b/nix/modules/postgres/default.nix new file mode 100644 index 0000000..79f0e6a --- /dev/null +++ b/nix/modules/postgres/default.nix @@ -0,0 +1,6 @@ +{ pkgs, ... }: { + config.services.postgresql = { + enable = true; + package = pkgs.postgresql_18; + }; +} diff --git a/nix/modules/prometheus/default.nix b/nix/modules/prometheus/default.nix index 334c311..ef04088 100644 --- a/nix/modules/prometheus/default.nix +++ b/nix/modules/prometheus/default.nix @@ -85,6 +85,13 @@ scrape_interval = "1h"; static_configs = [{ targets = [ "localhost:7846" ]; }]; } + { + job_name = "immich"; + static_configs = [ + { targets = [ "minipc.local:8081" ]; labels = { server = "minipc"; }; } + { targets = [ "minipc.local:8082" ]; labels = { server = "minipc"; }; } + ]; + } ]; }; @@ -219,6 +226,7 @@ pyroscope = pkgs.fetchzip { url = "https://github.com/grafana/pyroscope/releases/download/v1.14.0/pyroscope_1.14.0_linux_amd64.tar.gz"; sha256 = "sha256:005539bp2a2kac8ff6vz77g0niav81rggha1bsfx454fw4dyli4y"; + stripRoot = false; }; pyroscopeConfig = { analytics.reporting_enabled = false; diff --git a/nix/modules/snowflake-proxy/default.nix b/nix/modules/snowflake-proxy/default.nix new file mode 100644 index 0000000..acc34c6 --- /dev/null +++ b/nix/modules/snowflake-proxy/default.nix @@ -0,0 +1,3 @@ +{ ... }: { + services.snowflake-proxy.enable = true; +} diff --git a/nix/modules/tailscale/default.nix b/nix/modules/tailscale/default.nix new file mode 100644 index 0000000..9756f48 --- /dev/null +++ b/nix/modules/tailscale/default.nix @@ -0,0 +1,13 @@ +{ ... }: { + networking.nftables.enable = true; + + services.tailscale = { + enable = true; + extraUpFlags = [ "--advertise-exit-node" ]; + useRoutingFeatures = "server"; + }; + + systemd.services.tailscaled.serviceConfig.Environment = [ + "TS_DEBUG_FIREWALL_MODE=nftables" + ]; +} diff --git a/nix/modules/wg-mesh/default.nix b/nix/modules/wg-mesh/default.nix index abb904a..636dc13 100644 --- a/nix/modules/wg-mesh/default.nix +++ b/nix/modules/wg-mesh/default.nix @@ -35,7 +35,9 @@ in let peerConfig = (builtins.getAttr peer networkingConfig).wg; in { inherit (peerConfig) publicKey; - endpoint = "${peer}.infra.noratrieb.dev:${toString listenPort}"; + endpoint = + if !(builtins.hasAttr "noEndpoint" peerConfig) || !peerConfig.noEndpoint + then "${peer}.infra.noratrieb.dev:${toString listenPort}" else null; allowedIPs = [ "${peerConfig.privateIP}/32" ]; # sometimes there's some weirdness....?? persistentKeepalive = 25; diff --git a/nix/my-projects.json b/nix/my-projects.json index d17941d..cfe25d6 100644 --- a/nix/my-projects.json +++ b/nix/my-projects.json @@ -1,31 +1,4 @@ { - "website": { - "commit": "57c4a239da5d17eafde4ade165f3c6706639a9b4", - "fetchFromGitHub": { - "owner": "Noratrieb", - "repo": "website", - "rev": "57c4a239da5d17eafde4ade165f3c6706639a9b4", - "hash": "sha256-or6mCQjbc7tWAzzAKQpznZv+2vWJMhyzqxBPwRE2HKw=" - } - }, - "blog": { - "commit": "ea2758dd10f29e8d66ca3f54d7303f2ac20005d2", - "fetchFromGitHub": { - "owner": "Noratrieb", - "repo": "blog", - "rev": "ea2758dd10f29e8d66ca3f54d7303f2ac20005d2", - "hash": "sha256-LvQ41eJzOvI7mLYDTvlFwGZ2TKrZO26rasydqnEZ/t4=" - } - }, - "slides": { - "commit": "0401f35c22b124b69447655f0c537badae9e223c", - "fetchFromGitHub": { - "owner": "Noratrieb", - "repo": "slides", - "rev": "0401f35c22b124b69447655f0c537badae9e223c", - "hash": "sha256-K1Me4wf/GSfoc1PGWVJygPyTVV8SXienxUrzXkdCrjQ=" - } - }, "pretense": { "commit": "270b01fc1118dfd713c1c41530d1a7d98f04527d", "fetchFromGitHub": { @@ -45,12 +18,12 @@ } }, "does-it-build": { - "commit": "81790825173d87f89656f66f12a123bc99e2f6f1", + "commit": "5518c49d7c6348ba01f286ce031f5322bbd9f786", "fetchFromGitHub": { "owner": "Noratrieb", "repo": "does-it-build", - "rev": "81790825173d87f89656f66f12a123bc99e2f6f1", - "hash": "sha256-MCgGDd7Sg+BiG8L20Bbz8bHMB/Xuc1ztOVwv/b37BnQ=" + "rev": "5518c49d7c6348ba01f286ce031f5322bbd9f786", + "hash": "sha256-nOV0n2THZXG/fC3lgPW2gDeWn7bYIZydCTIkKJ+U898=" } }, "upload.files.noratrieb.dev": { @@ -72,12 +45,12 @@ } }, "widetom": { - "commit": "33d1738799618d72fe2b86896f766cbfea58dc76", + "commit": "387f6ff587b66186332cf5cfba90c966bba0695c", "fetchFromGitHub": { "owner": "Noratrieb", "repo": "widetom", - "rev": "33d1738799618d72fe2b86896f766cbfea58dc76", - "hash": "sha256-lSjlDozwKRLF62jsDaWo+8+rcQdeEgurEnuw00hk3o8=" + "rev": "387f6ff587b66186332cf5cfba90c966bba0695c", + "hash": "sha256-0PCal2czxBlgDh59TM7o94C9PG3a98YYUJ887/BYeEA=" } } } diff --git a/nix/nixpkgs.json b/nix/nixpkgs.json index e63baef..8d760b2 100644 --- a/nix/nixpkgs.json +++ b/nix/nixpkgs.json @@ -1,5 +1,6 @@ { - "channel": "nixos-25.05", - "lastUpdated": "2025-08-03T11:42:11.747Z", - "commit": "59e69648d345d6e8fef86158c555730fa12af9de" + "nixos-25.11": { + "lastUpdated": "2026-05-28T12:57:27.843Z", + "commit": "b77b3de8775677f84492abe84635f87b0e153f0f" + } } diff --git a/nix/secrets/backup_s3_secret.age b/nix/secrets/backup_s3_secret.age index 4dccf37..adb5d54 100644 Binary files a/nix/secrets/backup_s3_secret.age and b/nix/secrets/backup_s3_secret.age differ diff --git a/nix/secrets/caddy_s3_key_secret.age b/nix/secrets/caddy_s3_key_secret.age index 00e655f..d231b80 100644 Binary files a/nix/secrets/caddy_s3_key_secret.age and b/nix/secrets/caddy_s3_key_secret.age differ diff --git a/nix/secrets/docker_registry_password.age b/nix/secrets/docker_registry_password.age index d673c45..21dbaca 100644 --- a/nix/secrets/docker_registry_password.age +++ b/nix/secrets/docker_registry_password.age @@ -1,5 +1,5 @@ age-encryption.org/v1 --> ssh-ed25519 qM6TYg kxQujT+O6ZGlzTONdS/18DUVoxNapwtxitQo8GKr2hc -b7KjCjuvhmWcqNB6BvNruL17Ww6yWkVKjjm/MGd+jlE ---- q3EzroLr8b0T2gKQ4xUR67YOLSwFP1V8UxAnKY0PP24 -l0g1CXqi{Ttg͇߭ەߑEs5hxk- \ No newline at end of file +-> ssh-ed25519 qM6TYg N7lS400e/5mSV3BlhnzThydz/c3DIIOHLNQodTErR08 +vMqHXmSloSrWCxeD4QCH30GSqg1AI+6Dy16atFLNxjs +--- aJ6lQv9jnJHyocy+Kz4jPCtpiIewxoooR0Zsm7CS/pY +j9KyȰ0*ÜbɿY0I3v+D"*/g`o#ص \ No newline at end of file diff --git a/nix/secrets/does_it_build_private_key.age b/nix/secrets/does_it_build_private_key.age new file mode 100644 index 0000000..a1a6080 Binary files /dev/null and b/nix/secrets/does_it_build_private_key.age differ diff --git a/nix/secrets/forgejo_s3_key_secret.age b/nix/secrets/forgejo_s3_key_secret.age index 9e4e8f3..609822d 100644 --- a/nix/secrets/forgejo_s3_key_secret.age +++ b/nix/secrets/forgejo_s3_key_secret.age @@ -1,5 +1,5 @@ age-encryption.org/v1 --> ssh-ed25519 qM6TYg yxVVZ7LOgN9NiKsl1+dN7Rp6Rsf0zlqb25Y6w43styk -gQ5g7TL8+lyGp0SxdcoRg0nTpu1w6WbZZK0ERyqRpkc ---- 5uKpMbkW4zZ035mNXCuty+64IZ360gly/ezxnwtRX/0 -ˁSϸ>q!O߷TCUҺ[*󅬟\w݋tcg? |B;"*dWv/vnqe \ No newline at end of file +-> ssh-ed25519 qM6TYg Ln9ZxoEmhHUMbU4PufH8OYVzEnvFEm+b/SlBfitqEhw +M0n0qe7L9peTLylt0uoTR4gQBcCxfSIm7FAR0mPeG5E +--- BzrHhLTDQ49g2GTkJdmLpdhRBp1rfdekcW+A26jzKys +G6?U'ry@b $MZ`@kv]6_۟Nق $!mVkgA]yW,d';Ȧ핒 ܎ \ No newline at end of file diff --git a/nix/secrets/garage_secrets.age b/nix/secrets/garage_secrets.age index d9d0ee2..ce127e4 100644 --- a/nix/secrets/garage_secrets.age +++ b/nix/secrets/garage_secrets.age @@ -1,14 +1,14 @@ age-encryption.org/v1 --> ssh-ed25519 qM6TYg L6XQVJyw/T2kwH2iOa3dAxwxlAInVTKXek5QHUKsU3g -Mm8VXH3CITbrJTqBcjdMHGm1k7Kztd4irHqWnF0yKWM --> ssh-ed25519 91VHug 2PoHH6c5lVj6hfTH6+2NLzJcpXh20LgYgUHYrpY9Wg4 -iSaKgUoh0eSjeoiZ7mggn7LWV9C9xsM2foZrpJZY/ok --> ssh-ed25519 XzACZQ xyYG90gHM9XHAxIv2cFU/WvZsdLo6prAPQgRKADP0UY -XdiJz1Zmh3S+IvaOCZBqrF8DSWBrrqePjy+ZiEwuaSA --> ssh-ed25519 51bcvA IYyt435x3NPiTKDKCVb8dIK5naOSyU/Wh7dOLQ6SRAM -M0s39vyjDY24Mlb16UHy9lFEseaJxzZhtCvszKxwVSA --> ssh-ed25519 vT7ExA ZBvUjCU8vYFddKgNfnuROuiDnDXhitG6eR6ek4+1R1E -fiyuqamkakZ4t1MosIUqZaR0WEh7XVAwJiwH8lz3bsc ---- zvHNHd6bOMd0f3eIrl1qzyRh6zUe7G8mdrraYGtrnXU -%iFrљ`|)+ώܝSGNP>?E{֦mdadj`ԈVunZֻXU旽}>j_D_; 5Opa; -~4bwZ'70^2+wZ0j;4yTdp1'9 7Zsb.J *(yW _Pg`S^Gr \ No newline at end of file +-> ssh-ed25519 qM6TYg Nl4yCNn9+FiX2uBliOH052tOjnTj4DcFzaIDjD2MVTY +aU848NDVI6MN5JPm9FRha+HJySIEyRRcNaiiBRnxJLY +-> ssh-ed25519 91VHug HfzLsV+15VwIFXz9mYc3dNdlFnb2MdqOMIV3DkxnJmQ +Fr2LDl/Z5Tn9FspwZynbCvK9Let8VWGAr00lf3Uhj14 +-> ssh-ed25519 XzACZQ GWXW5myuKkabbJwdW3OsHl08KBo0wu3dJXXo13xYjR4 +SYu+6yj0om9BHFoJH8wsDPEbQCQy/oAp1jRW9wX6Ys0 +-> ssh-ed25519 51bcvA nenOCUH5VZ2j/u1fv7mD/2hZufU6KWY46UZwzINXSSo +GbQOiKQ6ko7RpuYvmtUnf5wzNrKpR/FHkrYHhRzURDw +-> ssh-ed25519 vT7ExA 8/Cn92m/Qtoo78VSNEYNrC4HqoIKxLyvT7A0R0CpE0U +rehfI6pEM0nAv9AQAFa3g/PTd4uvc8zwWLAVAgoq3NA +--- fHz+V2yXufeCvWNZ4Eu+vAdPYBoDYyuUlXcrTo8O/88 +ru^+=$!1 +rF-NHr+2z>Fiw`ˬ024(3 իH=ay$tV|H I d2_` dr?PM bش%qho"ߗlzs;r{XuE n)'!VZ֘܌u \ No newline at end of file diff --git a/nix/secrets/generic_backup_password.age b/nix/secrets/generic_backup_password.age index c666d43..d009691 100644 --- a/nix/secrets/generic_backup_password.age +++ b/nix/secrets/generic_backup_password.age @@ -1,14 +1,13 @@ age-encryption.org/v1 --> ssh-ed25519 qM6TYg IBVFRlOVLHcuS6xa7UVGA1z9NTBtNwGbt94c/yTB8wE -T+VtsTngND9kAd6DAtksXN4xYs+E8JZSxDeOm+G23tc --> ssh-ed25519 91VHug nUkRwHgpn2i56NNY0VAuG+r3CX1rjt1M0ZVKj+ijwGo -ea8Ry6JIJlPOObY+v2Q5MkdcZqCeDLAOxC583WY38Hg --> ssh-ed25519 XzACZQ 7f+8YcecMvwnOgwxjRMUUUm9Sp4cyKpIZWWMDrrCtzg -Bqhd2kpuTg3Xchme5wHfg4zkuikeM4H9GdOZVUv+HZk --> ssh-ed25519 51bcvA DUk4CsGXhdj4uIqzYpoGmtHs5dnjIBUb0c9zj1DEum4 -hGe3j5Ycn/WVV5wgg+vZuh2KhnamHACkHrDWcVgkSjo --> ssh-ed25519 vT7ExA Zf67OkbMvOpgABZDuXw3U94KqX32VG8nnjo3Xmkbih0 -5K5fnBxkQDaYwuMPhyNU5ZrZLjkgknG7dzMzyuANMuU ---- Jon4j4/xeZqS/6KsWszsVOoVOgJgsPEKxmtC7PcocCA -솳~ -N+jK߬/]Ӡ!䂶.7\k~ ssh-ed25519 qM6TYg Kmd5m9hb9QXzbbrLWC3SLcUfy/B8bEWdJMQ1iMe5MQ8 +A4ZoS84dtX+DMOzPXOMBb402q3o6LBExOda+Rm4hbO0 +-> ssh-ed25519 91VHug rXXXRgZI91mIlLAclodKDk3V14pDyRCv5kg1RCB7AH8 +CzC46ry6tCYkDX4jTW08j7Itqjb0raz2nlmU5/7zLCc +-> ssh-ed25519 XzACZQ KbzLsMTNqcjJ2I+Bx5moRC74Z/QKHrbFVovC5hhm8DY +aAGFH0KBdM+nm4HyZ0X7MPc3+fBbcQrQAcvrK0F7LNM +-> ssh-ed25519 51bcvA qv9cje7I7Sxje9xV0DghaxSxyovB37O3B1Bt6sHp/Bk +2zEnhhy6dIOWMdbQE54xtQKfZjR2vTH+Z4son1/gYr8 +-> ssh-ed25519 vT7ExA voN3ZvXhhqv4V9FpVTd2ViydPgxvjpQpeUcH6jljen4 +sLjK4aWqGSlxxeMKPrIZCjw4tsz95C1R498bFZgBMVk +--- Kfk+aieCFtZiKPE8toWEZwZw06sELpx1FiJCVDyLGcc +uM?C0Z& rSgWp8{*6yqð% \ No newline at end of file diff --git a/nix/secrets/grafana_admin_password.age b/nix/secrets/grafana_admin_password.age index 59a4c17..eecd4fc 100644 Binary files a/nix/secrets/grafana_admin_password.age and b/nix/secrets/grafana_admin_password.age differ diff --git a/nix/secrets/hugochat_db_password.age b/nix/secrets/hugochat_db_password.age index f5e1cd0..0465eba 100644 Binary files a/nix/secrets/hugochat_db_password.age and b/nix/secrets/hugochat_db_password.age differ diff --git a/nix/secrets/immich_secrets.age b/nix/secrets/immich_secrets.age new file mode 100644 index 0000000..cecada9 --- /dev/null +++ b/nix/secrets/immich_secrets.age @@ -0,0 +1,6 @@ +age-encryption.org/v1 +-> ssh-ed25519 yMKb8Q lRux6HhczttLaNglBB4xdx7B4GUhs50ucnyYYYlNLzo +nxSaMiEcscZ62uEA3N4ssHN0Vc/fw0wRsGzUXHk5vyA +--- FpSXOah6uQRaHLOxdGNFF9Pud9NsjYDLhiXzqg5/Sao +x ll w\vS-!V]}g΃[>e;n0n!;L ++ \ No newline at end of file diff --git a/nix/secrets/killua_env.age b/nix/secrets/killua_env.age index 3ac6770..19d8d77 100644 Binary files a/nix/secrets/killua_env.age and b/nix/secrets/killua_env.age differ diff --git a/nix/secrets/knot_dns_rfc2136_key_config.age b/nix/secrets/knot_dns_rfc2136_key_config.age new file mode 100644 index 0000000..48f95c0 Binary files /dev/null and b/nix/secrets/knot_dns_rfc2136_key_config.age differ diff --git a/nix/secrets/knot_dns_rfc2136_key_envvar.age b/nix/secrets/knot_dns_rfc2136_key_envvar.age new file mode 100644 index 0000000..fc3744f --- /dev/null +++ b/nix/secrets/knot_dns_rfc2136_key_envvar.age @@ -0,0 +1,13 @@ +age-encryption.org/v1 +-> ssh-ed25519 qM6TYg QQMDIquZuxMKwx2hl2ST9BMXa61DBdC/cMUutcRIRHw +l7oENezyJwfJHrgNUtFMfOF08BhAYWQOjW8v7VPN/aE +-> ssh-ed25519 91VHug wQBzeFG2xixYU5L8/d81n5FkZMqO3uCSF60Xi80mvnU +nPAgKpJj7WDJ4tbKGnlWAhvAUOyLIyOY3aPofKM0LfY +-> ssh-ed25519 XzACZQ HYj1Omcc8WYq6s9l5hVrjjibg1LFHnkYkXiPolGewws +uhrQ6nmP5fMApIJzUzwXcnlILdPvmlG4QhG1laW6alk +-> ssh-ed25519 51bcvA e2Xng7rC2SkYiDn5BRTIDBxn7vN/F95hI+okWL9TymI +7TJrZQlJsnGMu5jaFQllI1E/+ZGHZjGmaUpuNZSAPDI +-> ssh-ed25519 vT7ExA PSM21ZGF9T9g6rxnsCv3rAio1f5KckTHgivfclDjFFs +rq3M2R/LHYki4nQ68iFoLXH8VVmWyBDD6yv6y4tt5qQ +--- KqTQhyl3ef04vDQ8eu1IvTsEaSMYtQxxBAcIO+WYPr4 +$Jk#_Fr"B}~P@.e܅YSL;Pz &0DiKJ^:Oc'+ \ No newline at end of file diff --git a/nix/secrets/loki_env.age b/nix/secrets/loki_env.age index f55d3a3..1c85165 100644 --- a/nix/secrets/loki_env.age +++ b/nix/secrets/loki_env.age @@ -1,5 +1,5 @@ age-encryption.org/v1 --> ssh-ed25519 XzACZQ SXWsCSPW+iEQiaoW4lLmQCAtw47p2ccK2FIrOePUFEo -d+bSrgW1uewdh+/LOD+6zK4voc89O3ZPMXQ36kl6rfw ---- Te2X1EuZEwoerdfBLxPtcuzWGOzF6dC1biFAebpX5kY -01,kF/QobZz rG*~}LF2Pz!"7ж-7^y?bz7.N{:!)%Y1+P_<w 2eɪ" ssh-ed25519 XzACZQ aRbZOixkF1CtYIoCxgHX1Cw25ozmtV4HWsFIY0sfHAw +y9PvJ4rdceua7Q4GVqz09KZsensKhA8pLMjGyub06xY +--- gCH1ZBj/XvuwrtJcjVXr99OT89N7JOIlHd5xofjwH9o +PcweOKD-Pz8Dub3@H}!E퍽lۛH^klMro\%#Ӹ˦Na,=Fku:![=&0X ssh-ed25519 qM6TYg k3jtd2qoiQCsKZYJliH9ySFuO7CVQQ5Sv2ikFYcaD2c -TSIg6y4C2WaLQJUyNT3HQOj09VmKSkQxlsVlaDc+1tY --> ssh-ed25519 XzACZQ NZhP9TD5nYxBMgO1O3vDOITeh7qxq4vhjG7AppQmRlM -I1JiT8ISWLVUgoCphHSbhYvfssfP55NuBI2jclG3DVQ ---- 6UR3wbSTB/f0s8hP/YHaY9HFDpnLAts0yksKCv7p9BA -ig502LQkL -vÛB$5m #{_8j&+;Z-'ƒWHSыaf?56[t8&Z_/3B_4n \ No newline at end of file +-> ssh-ed25519 qM6TYg sx4kKW1m2RrcVkyxDMdDgh5jcwfrRDAFYa0EJBZKFnI +WPbchNFC7tTqC4DrIw7hUZSNNxE64kkXZdXB6/VFhj4 +-> ssh-ed25519 XzACZQ GXDgzIGU4X6/oOr5hcI7SoorcowGPJHx/0X2+gj+Sk0 +NATuZ7IZ0QwM9/GtaYdLXjBs6X0enhpVgWvGVpyqOO0 +--- xMESjwLO7fJhwd0HnYzypoh3s6YRx86vSdXovvSBoHg +9I{֝ʼؐZd{YrXB= +l] Hܴ`lRΙRw8Qi4*t#͂ƚmȟ+6hS&VἙ';J0] = \ No newline at end of file diff --git a/nix/secrets/openolat_db_password.age b/nix/secrets/openolat_db_password.age index 4073e15..f9a3b40 100644 Binary files a/nix/secrets/openolat_db_password.age and b/nix/secrets/openolat_db_password.age differ diff --git a/nix/secrets/paperless_env.age b/nix/secrets/paperless_env.age new file mode 100644 index 0000000..45894df --- /dev/null +++ b/nix/secrets/paperless_env.age @@ -0,0 +1,5 @@ +age-encryption.org/v1 +-> ssh-ed25519 yMKb8Q IornZ92EjvlpeFh0JuSElL/iH1pEblFxfXp9QrTuelA +Js60AJA93bYHGsTEX8S94B7h37kh7vkWktcvbNJlg5Q +--- OiyTon34BUPU3DCFrMdc9FdDeLB2AquG97fgMQpDbRk +A/nn8)0y? C DV5_C©~Z&Rm8*;*~"[Zٌb2VI4J!,(Z^W%zV6-76Au2M8S5LD[O&C"ZF[ \ No newline at end of file diff --git a/nix/secrets/pyroscope_s3_secret.age b/nix/secrets/pyroscope_s3_secret.age index a2c7dd5..cea6275 100644 Binary files a/nix/secrets/pyroscope_s3_secret.age and b/nix/secrets/pyroscope_s3_secret.age differ diff --git a/nix/secrets/registry_htpasswd.age b/nix/secrets/registry_htpasswd.age index de9e94a..9422a04 100644 --- a/nix/secrets/registry_htpasswd.age +++ b/nix/secrets/registry_htpasswd.age @@ -1,6 +1,5 @@ age-encryption.org/v1 --> ssh-ed25519 qM6TYg amvNJk2G0JJHgGOwAWCtYIJgylqBAYDSXTKNYKwb4mo -aBXr7jN0/VUDTxCGvn+obz3JIU0boKcm4BbwFAidm1o ---- B6s8naj3JiQdjBDdwzY+PqW01QZFgKMpKSOVXHDfbHw -T1QqҔ?)WŐژ4zc"C+ŌHmQ)ԋ#1Hnc^aG.' -$bc \ No newline at end of file +-> ssh-ed25519 qM6TYg vZTE3zklC5ACYvOuHSNPMDJshQPcxmbfen0TygKKW2s +2TMCnx49MiF0AqCFMTmuXC/xKzos66rskkDfdnIdQTU +--- 8JTyQvwrmMPdNLPK4cGGenl5DN2UpoCqUQzdbEvezpQ +!|Gq^D;-B2>"2A)ds\ ӲiE!g66,} PcQx‘0vDV4:ү;m(xs \ No newline at end of file diff --git a/nix/secrets/registry_s3_key_secret.age b/nix/secrets/registry_s3_key_secret.age index fbd3450..11fe1a4 100644 Binary files a/nix/secrets/registry_s3_key_secret.age and b/nix/secrets/registry_s3_key_secret.age differ diff --git a/nix/secrets/restic_backup.age b/nix/secrets/restic_backup.age index 0465e54..da31522 100644 Binary files a/nix/secrets/restic_backup.age and b/nix/secrets/restic_backup.age differ diff --git a/nix/secrets/s3_mc_admin_client.age b/nix/secrets/s3_mc_admin_client.age index 3e366bf..ba1bd52 100644 Binary files a/nix/secrets/s3_mc_admin_client.age and b/nix/secrets/s3_mc_admin_client.age differ diff --git a/nix/secrets/secrets.nix b/nix/secrets/secrets.nix index 8e25b6b..f02c447 100644 --- a/nix/secrets/secrets.nix +++ b/nix/secrets/secrets.nix @@ -6,6 +6,7 @@ let vps3 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHvupo7d9YMZw56qhjB+tZPijxiG1dKChLpkOWZN0Y7C"; vps4 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMpoLgBTWj1BcNxXVdM26jDBZl+BCtUTj20Wv4sZdCHz"; vps5 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBWbIznvWQSqRF1E9Gv9y7JXMy3LZxMAWj6K0Nq91kyZ"; + minipc = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINApZRrvK4RC1SU5m4OLbill7HZYPQtuvh/m/AB4q5dG"; in { "widetom_bot_token.age".publicKeys = [ vps1 ]; @@ -28,6 +29,12 @@ in "pyroscope_s3_secret.age".publicKeys = [ vps3 ]; "restic_backup.age".publicKeys = [ vps1 vps2 vps3 vps4 vps5 ]; "generic_backup_password.age".publicKeys = [ vps1 vps2 vps3 vps4 vps5 ]; + "website_s3_key_write.age".publicKeys = [ vps1 ]; # only used by Noratrieb/website GHA + "does_it_build_private_key.age".publicKeys = [ vps4 ]; + "immich_secrets.age".publicKeys = [ minipc ]; + "paperless_env.age".publicKeys = [ minipc ]; + "knot_dns_rfc2136_key_config.age".publicKeys = [ dns1 dns2 ]; + "knot_dns_rfc2136_key_envvar.age".publicKeys = [ vps1 vps2 vps3 vps4 vps5 ]; "wg_private_dns1.age".publicKeys = [ dns1 ]; "wg_private_dns2.age".publicKeys = [ dns2 ]; "wg_private_vps1.age".publicKeys = [ vps1 ]; @@ -35,4 +42,5 @@ in "wg_private_vps3.age".publicKeys = [ vps3 ]; "wg_private_vps4.age".publicKeys = [ vps4 ]; "wg_private_vps5.age".publicKeys = [ vps5 ]; + "wg_private_minipc.age".publicKeys = [ minipc ]; } diff --git a/nix/secrets/upload_files_s3_secret.age b/nix/secrets/upload_files_s3_secret.age index 3bca9a4..003343f 100644 Binary files a/nix/secrets/upload_files_s3_secret.age and b/nix/secrets/upload_files_s3_secret.age differ diff --git a/nix/secrets/website_s3_key_write.age b/nix/secrets/website_s3_key_write.age new file mode 100644 index 0000000..42f873b Binary files /dev/null and b/nix/secrets/website_s3_key_write.age differ diff --git a/nix/secrets/wg_private_dns1.age b/nix/secrets/wg_private_dns1.age index a54f3eb..59f797a 100644 --- a/nix/secrets/wg_private_dns1.age +++ b/nix/secrets/wg_private_dns1.age @@ -1,5 +1,6 @@ age-encryption.org/v1 --> ssh-ed25519 LZU5Eg o+MPatbYPM3sZq0MCqvvxlvKMQwlbajHURPQ+0g0qm8 -UUurAYkPWXCaow746EV4dAQ+qTJnHIehcorUmanBc+o ---- BV+bxd0OIc3J4uT39al2odyn8ScDpq58SiwnW5pvRj4 -T7W |fJ%"cq{TP~fv,;:免-Ϛ4a -u\L_-VH% \ No newline at end of file +-> ssh-ed25519 LZU5Eg YCaoZYLxmyrcSVXaTqDeC25n7lwuGlTDfWPNxg9etn0 +xSVH1o+ITY39M7X8FNpj5liEW/20HTq0ZRxsoo3U8JQ +--- i8MfM8cVg0SJnNqUYeTQ+dY2FZ6yEhIGkiHgxBzTDYE + +F0eҍY-{sh]ƬfApB^1e0!3s"j@=rRs(+" \ No newline at end of file diff --git a/nix/secrets/wg_private_dns2.age b/nix/secrets/wg_private_dns2.age index 64b2ad2..64d55f0 100644 Binary files a/nix/secrets/wg_private_dns2.age and b/nix/secrets/wg_private_dns2.age differ diff --git a/nix/secrets/wg_private_minipc.age b/nix/secrets/wg_private_minipc.age new file mode 100644 index 0000000..1d0e1be --- /dev/null +++ b/nix/secrets/wg_private_minipc.age @@ -0,0 +1,7 @@ +age-encryption.org/v1 +-> ssh-ed25519 yMKb8Q QdFcYSyIYFlrx1vOfnWaFzULi8AxYIpH1HXLRZzs+iE +3JG+l7U6AXmWe/H9J1B3dFjD+GCNRM4wsNWR0CHU0PM +--- UXqL/EG0JYwnV4Owi0Gy4BnpW7QkgiF4z2P9Qskfq4w +@ +q,YL3)eqaK@]exC +tv-G!}Ji$=* \ No newline at end of file diff --git a/nix/secrets/wg_private_vps1.age b/nix/secrets/wg_private_vps1.age index 6354b7b..5dd33e1 100644 Binary files a/nix/secrets/wg_private_vps1.age and b/nix/secrets/wg_private_vps1.age differ diff --git a/nix/secrets/wg_private_vps2.age b/nix/secrets/wg_private_vps2.age index 4d30264..dbdcbd2 100644 --- a/nix/secrets/wg_private_vps2.age +++ b/nix/secrets/wg_private_vps2.age @@ -1,8 +1,5 @@ age-encryption.org/v1 --> ssh-ed25519 91VHug cjq3el2rlJCWS3VwM5Dt22Ot/PoCdU5wJWTMosYQ6VE -w/IyVNNAObRJxpV162CojPRE8yYbXJj1kaCBoPo3rNk ---- EDM/kgV9ewXhMvrQfHDtPLl7W46VCbZL5ciBO/B+Iu8 - cL>&²=^$m T4& -ƧI) -c -LQi6RS +T@0= \ No newline at end of file +-> ssh-ed25519 91VHug MzqFl7ZTH4laSYXRYPbIiXadl/bqVXPHRM7wD5aLhy8 +Ng19G3jaJJr1s33i0kCHxIUQeTmoISTN+VQQD3rB33I +--- JkYGUYo6Ys48HI9UpXGardgf+k+DC71dxLiXqxMmFEQ +CqC!n ƈ,bA8"MeNьnM[(֡XͤX+~ؓSnKXi8> \ No newline at end of file diff --git a/nix/secrets/wg_private_vps3.age b/nix/secrets/wg_private_vps3.age index a63f54e..f9b5098 100644 Binary files a/nix/secrets/wg_private_vps3.age and b/nix/secrets/wg_private_vps3.age differ diff --git a/nix/secrets/wg_private_vps4.age b/nix/secrets/wg_private_vps4.age index dcf6aaf..0674d3a 100644 --- a/nix/secrets/wg_private_vps4.age +++ b/nix/secrets/wg_private_vps4.age @@ -1,7 +1,5 @@ age-encryption.org/v1 --> ssh-ed25519 51bcvA mVJPirZJQxHgpX6CkMckYTpJk6HYN7CZYlUPPF1mYDM -XVZqovyalftEtV//FQM11Za+YAEMAuBTypcPQz1+G3E ---- 7QAtADWyWr8SY3jLLzKxPsedOLyasfLs4lK3nmhkOi0 -]JXtE)hSF -$2"Ta`Į{:= - \ No newline at end of file +-> ssh-ed25519 51bcvA soCOaoBhsAvjaw29hw6Q9JkrLGbfQEwgszOIl38+CB8 +uj17MiT/crUT+LXF9TEylo131FV1cKQbNXQNWCI1djw +--- MAVo3X1mO0iUC0mEo4wbbDbK19hKxB/zEcfqfR4Bxsw +2}[I,sW/8KDkjzH,(nyߔ8uq.^PrͪCM`)1fy,XOҡ \ No newline at end of file diff --git a/nix/secrets/wg_private_vps5.age b/nix/secrets/wg_private_vps5.age index cbd582e..5bef662 100644 --- a/nix/secrets/wg_private_vps5.age +++ b/nix/secrets/wg_private_vps5.age @@ -1,5 +1,5 @@ age-encryption.org/v1 --> ssh-ed25519 vT7ExA G9mqOZiAvq+ot4OUevoxvNPIkgWgS8KqMY76uGsxeGs -AMEwoZoFc+axirDc5q+FM3e76IedkxblC3vVqUjmPL8 ---- oXGSsFKfJRPvcU1X3zHN7M6vd0IxBpNowyh4sPesq3A -i3cMTN0}r"Зs~OrPFP`Q<%:73 \ No newline at end of file +-> ssh-ed25519 vT7ExA Z8248Zxd0dGjx/YtU3cVKwuKMDRaHQpo6d21bwSOWz0 +/7PxJCz7yfuGuBWioDQMizW9+tL7Ku7JEB2h6aG4vmE +--- xEBearw/OGRugS23zBrNGj5zKY/bNsot+UQOcCEATWA +!p%~)6- Hy*e g pXѷӖk وm4bnx6de \ No newline at end of file diff --git a/nix/secrets/widetom_bot_token.age b/nix/secrets/widetom_bot_token.age index e414467..05e6159 100644 --- a/nix/secrets/widetom_bot_token.age +++ b/nix/secrets/widetom_bot_token.age @@ -1,5 +1,6 @@ age-encryption.org/v1 --> ssh-ed25519 qM6TYg oaTrhtYhEl2Za2fhNt0BgnjXPCkzo1Or9jsLLCnJhzA -Wk99OfMEXXG+cV1LEvC9wf0GeVgT1Z2GA0AtLYCRKD4 ---- 4U4dwN+tJ2LFpIjxEaoZ6HHV5QQU4kr0r0pDXKKcTgE -N]n?!|!:Ml* '?EM@r_ivo:Nilk8S(:֊R/0^xi[xC \ No newline at end of file +-> ssh-ed25519 qM6TYg XJWJcqVabkHFOrbsNTS6+jc/pQ1a4D8lZkObT8BZwiE +DgFVt1+01MNlPm898/qnC0wGbs6eEsLcHpyANA5tpsA +--- VhhquCcml82lpKjXLecBoCz/2CHNl2S9htU2iIWfvyY +~'t/!Fb[k"yfiܨLGg!FqZaA3 +iE`v8<1Fmpx~)gc7R&%U'XDD \ No newline at end of file diff --git a/nix/secrets/widetom_config_toml.age b/nix/secrets/widetom_config_toml.age index 4d13ac2..374e672 100644 Binary files a/nix/secrets/widetom_config_toml.age and b/nix/secrets/widetom_config_toml.age differ diff --git a/nix/update-nixpkgs.mjs b/nix/update-nixpkgs.mjs index fa63e62..4b3c155 100644 --- a/nix/update-nixpkgs.mjs +++ b/nix/update-nixpkgs.mjs @@ -1,23 +1,22 @@ import fs from "node:fs/promises"; const path = `${import.meta.dirname}/nixpkgs.json`; -const nixpkgs = JSON.parse(await fs.readFile(path)); +const channels = JSON.parse(await fs.readFile(path)); -const res = await fetch( - `https://api.github.com/repos/NixOS/nixpkgs/commits/${nixpkgs.channel}` -); - -if (!res.ok) { - throw new Error( - `get commit for ${name}: ${res.status} - ${await res.text()}` +for (const [channel, nixpkgs] of Object.entries(channels)) { + const res = await fetch( + `https://api.github.com/repos/NixOS/nixpkgs/commits/${channel}` ); + if (!res.ok) { + throw new Error( + `get commit for ${channel}: ${res.status} - ${await res.text()}` + ); + } + const body = await res.json(); + if (body.sha !== nixpkgs.commit) { + nixpkgs.commit = body.sha; + nixpkgs.lastUpdated = new Date().toISOString(); + } } -const body = await res.json(); - -if (body.sha !== nixpkgs.commit) { - nixpkgs.commit = body.sha; - nixpkgs.lastUpdated = new Date().toISOString(); - - await fs.writeFile(path, JSON.stringify(nixpkgs, null, 2) + "\n"); -} +await fs.writeFile(path, JSON.stringify(channels, null, 2) + "\n"); diff --git a/secrets-git-crypt/caddy_s3_key_secret b/secrets-git-crypt/caddy_s3_key_secret index 955a6d8..63db25f 100644 Binary files a/secrets-git-crypt/caddy_s3_key_secret and b/secrets-git-crypt/caddy_s3_key_secret differ diff --git a/secrets-git-crypt/does_it_build_private_key b/secrets-git-crypt/does_it_build_private_key new file mode 100644 index 0000000..dca73aa Binary files /dev/null and b/secrets-git-crypt/does_it_build_private_key differ diff --git a/secrets-git-crypt/immich_secrets b/secrets-git-crypt/immich_secrets new file mode 100644 index 0000000..8ad329d Binary files /dev/null and b/secrets-git-crypt/immich_secrets differ diff --git a/secrets-git-crypt/knot_dns_rfc2136_key_config b/secrets-git-crypt/knot_dns_rfc2136_key_config new file mode 100644 index 0000000..61b3a36 Binary files /dev/null and b/secrets-git-crypt/knot_dns_rfc2136_key_config differ diff --git a/secrets-git-crypt/knot_dns_rfc2136_key_envvar b/secrets-git-crypt/knot_dns_rfc2136_key_envvar new file mode 100644 index 0000000..5bb8e79 Binary files /dev/null and b/secrets-git-crypt/knot_dns_rfc2136_key_envvar differ diff --git a/secrets-git-crypt/paperless_env b/secrets-git-crypt/paperless_env new file mode 100644 index 0000000..21295ce Binary files /dev/null and b/secrets-git-crypt/paperless_env differ diff --git a/secrets-git-crypt/website_s3_key_write b/secrets-git-crypt/website_s3_key_write new file mode 100644 index 0000000..3ba1e60 Binary files /dev/null and b/secrets-git-crypt/website_s3_key_write differ diff --git a/secrets-git-crypt/wg_private_minipc b/secrets-git-crypt/wg_private_minipc new file mode 100644 index 0000000..73a8795 Binary files /dev/null and b/secrets-git-crypt/wg_private_minipc differ