diff --git a/caddy.nix b/caddy.nix index dc45810..0318909 100755 --- a/caddy.nix +++ b/caddy.nix @@ -22,23 +22,6 @@ } reverse_proxy 192.168.100.11:80 ''; - - # Nextcloud — served by local nginx - # (Authelia forward-auth disabled for now; re-enable by uncommenting the - # forward_auth block below.) - virtualHosts."nextcloud.srazka.com".extraConfig = '' - # forward_auth 127.0.0.1:9091 { - # uri /api/authz/forward-auth - # copy_headers Remote-User Remote-Groups Remote-Email Remote-Name - # } - reverse_proxy 127.0.0.1:8081 - ''; - - # Forgejo — no Authelia forward-auth, since it would break git over HTTPS - # and the API. Forgejo handles its own logins. - virtualHosts."git.srazka.com".extraConfig = '' - reverse_proxy 127.0.0.1:14921 - ''; }; } diff --git a/configuration.nix b/configuration.nix index ef4e9cf..824aee7 100644 --- a/configuration.nix +++ b/configuration.nix @@ -29,11 +29,12 @@ homeMode = "0755"; extraGroups = [ "wheel" "podman" ]; #sudo openssh.authorizedKeys.keys = [ - "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC6TOSFZ+P0oWTa9U3fX/L9c3btv/lCgzPrwKu621aLDjSbWbaddGhAXQtJvl7GJvs7QN52z+icftK94gdeyTbZyzQtY6JNUVmUs5EHlZlYTkAYSFN/rkn6N7/n9aYRN+vd8r0B4IrP5gTPtGglLD16dfukpOgwtQj/eK6tqZpVlZ7LnKK7UaA6a4OXMYgJZAwdzAOfFGfbO++5q+igBdfNJmh5LtYMI6te8AlJGBSVierzeStEzTVbIys1EsyNrEMzAljHBxxco2L7enNmz4xciRNCQ/za5xPmhf8nOoZTIalBziM52DGH6rFzUEBVsqez1U2U4ajVzdSIudOlku4w63YnClHeGNu9AdHJjR7PbIHwui17aGKM/l/Qv/LOWWo+nfO1hbCl0fGZwVkl8p4yR3WM73OWEHn1f+Uc4cWAUDZ/ZDPE0qyA/HAnSA6dfzY66y2evjRBeekA4zcxgmc7Q/2XfKHDYMEKTNkgdO6UAFoUqW4BiyF36FcS1ccjUok= root@DESKTOP-40EVMS3" # desktop + "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC6TOSFZ+P0oWTa9U3fX/L9c3btv/lCgzPrwKu621aLDjSbWbaddGhAXQtJvl7GJvs7QN52z+icftK94gdeyTbZyzQtY6JNUVmUs5EHlZlYTkAYSFN/rkn6N7/n9aYRN+vd8r0B4IrP5gTPtGglLD16dfukpOgwtQj/eK6tqZpVlZ7LnKK7UaA6a4OXMYgJZAwdzAOfFGfbO++5q+igBdfNJmh5LtYMI6te8AlJGBSVierzeStEzTVbIys1EsyNrEMzAljHBxxco2L7enNmz4xciRNCQ/za5xPmhf8nOoZTIalBziM52DGH6rFzUEBVsqez1U2U4ajVzdSIudOlku4w63YnClHeGNu9AdHJjR7PbIHwui17aGKM/l/Qv/LOWWo+nfO1hbCl0fGZwVkl8p4yR3WM73OWEHn1f+Uc4cWAUDZ/ZDPE0qyA/HAnSA6dfzY66y2evjRBeekA4zcxgmc7Q/2XfKHDYMEKTNkgdO6UAFoUqW4BiyF36FcS1ccjUok= root@DESKTOP-40EVMS3" + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJahgKnADam4PGc9TiANkWGx09uNuS42tllj70UuyzPf u0_a279@localhost" "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPhbz4AlnRrRNvUwlYd5siMTuvgvSwlJ21Tq54OA20ID reudy@DESKTOP-40EVMS3" + "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQD0mitcnuzNWof+RbTIoxDaXonU6yk+i6kpA4lIdI5fE6fzLCOGia5q4t1qen7Lhj1RMuJRqg5R8GeYmAW3tx2Uo3mqnQLJY227xs2FJU5ygn8JW1Uivp6sCJO5yzCHv8JYy9ala+eHlmppmjBo+NnU2mNlPfM5pNKef/srz5jmkeD+73rUim/1KSCZ3yOzSzc1jf7vNkxXAgDREzbmX/sqIrhG2DxjGAaX6SJjh0lh9OF6m1lAkEGq39h3WS7UKAsP3Z2OOSfEKwAefYvijIoWpL5+XGas3p7mhBG9ZDATJVcUHD/tg7XC4QOU8rYTjuP2/ECFS37q4+OCCJlyBRY46AS4ohKDs9iF8z9IjI3G2P6nTOeIySL84kKGI3ufcvBtUpITKWF4rwLE2R4WVG3SOMSCizFJZtpijVOJJulJUYwIyx0khSGpg3cL2LePyJn23FMlaG6w03H0ngdckGxLuvd+H0D12YVa0990hYaquzXPfMsSUy5T9ZievsVu6jU= reudy@Reudy" "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICKwpcTESCEAiQ+/c8bM9Y2b53nCCl3qFI5KRuEkR+Ya jacob@DESKTOP-40EVMS3" - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJahgKnADam4PGc9TiANkWGx09uNuS42tllj70UuyzPf u0_a279@localhost" # termux-phone - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDY+AJwXxv/kv0LvZLWPfjxbG3jsjfrtCyPzhXYGKttK reudy-book@fedora" # surface-fedora + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDY+AJwXxv/kv0LvZLWPfjxbG3jsjfrtCyPzhXYGKttK reudy-book@fedora" ]; }; diff --git a/flake.nix b/flake.nix index 89ee6d6..0003122 100644 --- a/flake.nix +++ b/flake.nix @@ -34,8 +34,6 @@ ./panel.nix ./caddy.nix ./authelia.nix - ./nextcloud.nix - ./forgejo.nix ./containers/hello.nix agenix.nixosModules.default diff --git a/forgejo.nix b/forgejo.nix deleted file mode 100644 index 47846df..0000000 --- a/forgejo.nix +++ /dev/null @@ -1,42 +0,0 @@ -{ config, ... }: -let - domain = "git.srazka.com"; - sshPort = 14922; -in -{ - services.forgejo = { - enable = true; - - # SQLite is plenty for a single-user VPS, same as Nextcloud/Authelia. - database.type = "sqlite3"; - - # Git LFS support for large files. - lfs.enable = true; - - settings = { - server = { - DOMAIN = domain; - ROOT_URL = "https://${domain}/"; - - # Caddy terminates TLS and proxies to this; not reachable from outside. - HTTP_ADDR = "127.0.0.1"; - HTTP_PORT = 14921; - - # Forgejo's built-in SSH server, separate from the system sshd (which - # only allows 'reudy' on 14902). Clone URLs look like: - # ssh://git@git.srazka.com:14922//.git - START_SSH_SERVER = true; - SSH_PORT = sshPort; - SSH_LISTEN_PORT = sshPort; - BUILTIN_SSH_SERVER_USER = "git"; - }; - - # Private instance — create accounts with the admin CLI instead. - service.DISABLE_REGISTRATION = true; - - session.COOKIE_SECURE = true; - }; - }; - - networking.firewall.allowedTCPPorts = [ sshPort ]; -} diff --git a/nextcloud.nix b/nextcloud.nix deleted file mode 100644 index 87a0c1a..0000000 --- a/nextcloud.nix +++ /dev/null @@ -1,53 +0,0 @@ -{ config, pkgs, ... }: - -{ - # Admin password is managed by agenix. - # Create secrets/nextcloud-admin-pass.age and add it to secrets.nix, - # then run: agenix -e secrets/nextcloud-admin-pass.age - age.secrets."nextcloud-admin-pass" = { - file = ./secrets/nextcloud-admin-pass.age; - owner = "nextcloud"; - group = "nextcloud"; - mode = "0400"; - }; - - services.nextcloud = { - enable = true; - package = pkgs.nextcloud33; - - hostName = "nextcloud.srazka.com"; - https = true; - - config = { - adminuser = "admin-reudy"; - adminpassFile = config.age.secrets."nextcloud-admin-pass".path; - dbtype = "sqlite"; - }; - - # Tell Nextcloud it's behind a trusted reverse proxy. - settings = { - trusted_proxies = [ "127.0.0.1" ]; - overwriteprotocol = "https"; - overwritehost = "nextcloud.srazka.com"; - default_phone_region = "NL"; - }; - }; - - # Let Caddy handle TLS termination; nginx only listens on localhost. - # The nextcloud module creates the virtualhost at hostName; we override - # its listen address here. - services.nginx.virtualHosts.${config.services.nextcloud.hostName}.listen = [ - { - addr = "127.0.0.1"; - port = 8081; - } - ]; - - # The cron timer can fire before nextcloud-setup.service has finished on - # first boot, causing a "Not installed" failure. Make the cron service wait - # for setup to complete before it's allowed to run. - systemd.services.nextcloud-cron = { - after = [ "nextcloud-setup.service" ]; - requires = [ "nextcloud-setup.service" ]; - }; -} diff --git a/secrets.nix b/secrets.nix index 4db5017..0141976 100644 --- a/secrets.nix +++ b/secrets.nix @@ -2,8 +2,7 @@ let wsl-desktop = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPhbz4AlnRrRNvUwlYd5siMTuvgvSwlJ21Tq54OA20ID reudy@DESKTOP-40EVMS3"; termux-phone = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJahgKnADam4PGc9TiANkWGx09uNuS42tllj70UuyzPf u0_a279@localhost"; bash-nixos = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPAP6gemgKZVguFi6Diif+dBbMAZQupimeV9OQuUotlw vps-manual"; - reudy-book = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDY+AJwXxv/kv0LvZLWPfjxbG3jsjfrtCyPzhXYGKttK reudy-book@fedora"; - users = [ wsl-desktop termux-phone bash-nixos reudy-book ]; + users = [ wsl-desktop termux-phone bash-nixos ]; nixos-vps = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINjPVQpFlKGbDNqOVvKAFRExKHAAkKSAqKabDSMtJsth"; systems = [ nixos-vps ]; @@ -17,7 +16,4 @@ in "secrets/authelia-session-secret.age".publicKeys = users ++ systems; # The hashed users database (contains bcrypt-hashed passwords) "secrets/authelia-users.age".publicKeys = users ++ systems; - - # Nextcloud admin password (plaintext, read by the nextcloud service) - "secrets/nextcloud-admin-pass.age".publicKeys = users ++ systems; } diff --git a/secrets/authelia-jwt-secret.age b/secrets/authelia-jwt-secret.age index 95f7ef2..57e4a1c 100644 --- a/secrets/authelia-jwt-secret.age +++ b/secrets/authelia-jwt-secret.age @@ -1,14 +1,11 @@ age-encryption.org/v1 --> ssh-ed25519 Ol8kbg 2wJUE7haViW3E1CSSv8dsZjsSXszmDFmn+JU6b2zqQ0 -/mdmCA0JTPrN13ES9J6d1e/NP7o3uzdAVDHuLRLbUEw --> ssh-ed25519 QGvsHg WbbdMC6coHNQswT+iftkGHI8ztioyOWFVFWrnC4BK3I -ECBNNcEt5qhaS2l7YJLzt8nahdMn5JYvzB7giEXLog8 --> ssh-ed25519 yjVKVA sRVRnJy/jj2xMNTtuJJJpvl45EirQZdPNSmm0tQLBjI -McDk7P8kUSkvb/cfzPvpCsNElvK4px4TY3jT+0005Zo --> ssh-ed25519 5jHFSg 8D/T/d4CBLGMy/BOKTrgoRqlYzImChosh6Y5fArwDns -IPIUX25vNg7iZ7fzP3cv/3uj6iW/KR613KoLglTzHYQ --> ssh-ed25519 4XPa+g Qgekfq0nBDZjdx4pe9VlWXrFCcssvwMC+tCnEP142kE -zZEBinsKM0+b7YpEy7CTsj3MKmuKcS9UmoKJWsE44rs ---- j9Tg3Skfil0D+wdP/Sg12ES5hiiBeAVHBHy3boWThCc -ٞl104ظGۦ~ZrE.Β~뗣p@XOh ]PUP-C(y[8Ro1v.7tԖnDy@ ݖ9}s - \ No newline at end of file +-> ssh-ed25519 Ol8kbg zksXMifeU7LyTKz1oQ1Qj+/U8FJUrvuRKqpQIK82TGo +GCsLKn6A2exjSLRLsUmF6+Loa7IGvTLnPG9Jr/A0yM8 +-> ssh-ed25519 QGvsHg MzWMzGsdlyvdAKkXHPesGT+H5C2sCXokpQyIvr4xrHc +LhGNtbBQNVWyz4WAIEYIw8J812me7qBE0xjlWk8N58k +-> ssh-ed25519 yjVKVA 5rTOZYgaA/MMuoFmiLJo2dbuw2ZdRkrJ2fYXHjd0xQI +M0NEgt9CwRQDWQgXSU7Ef4UP2wLoe/RAu1uJxQGH1ws +-> ssh-ed25519 4XPa+g hLGxBVCTB/je9yQrjPNZaJYRqlJrabsFQT8BQzw8d3Q +qpyMa38v48SzATy1vUVzccKPhPcqV6BgnkyiwBDOiEI +--- 6Ft39sS5aV9B5pyMX7yr6FH19M2uW8j3AcN86LsVztg +eÑ?CkgBui";..:GJB/aYab=]U(=|SYfV7GBz7FJGKg__C{nU}n \ No newline at end of file diff --git a/secrets/authelia-session-secret.age b/secrets/authelia-session-secret.age index 2d8fdca..8ee810b 100644 --- a/secrets/authelia-session-secret.age +++ b/secrets/authelia-session-secret.age @@ -1,15 +1,11 @@ age-encryption.org/v1 --> ssh-ed25519 Ol8kbg xZ+5r1uS7FJi7Oi2yg0QJgsKaXT8rk7coxSH0Ky++Fo -0MQFruRiO/Pq5HcxdKI8/QF/oy/3Z5hyak/Y/m1od1I --> ssh-ed25519 QGvsHg 2tNU/yrDrRBV2R2FWbd1zQqXZaigEat8ChrtGo2fHmU -oS9aEWiaMg3jDZ6d6iUjblaEEbKLVkqxxqw4gA/8YO0 --> ssh-ed25519 yjVKVA Dx4Tf4Dhs/kUDC7jhdgZYNxr0pIObGJw/KKJR8luWBc -07ASNQzRlKzRI1Y4v5qdhxOH8g+Xzi2k51KMmApcTuY --> ssh-ed25519 5jHFSg lWVSFCU0xBspN9VYEOcjHvss9HLobGmC6UUh+0Fp7H8 -UH7YQy/pHVYi5N7xiGos6g8cnP5TEhu+QMWju2l63uQ --> ssh-ed25519 4XPa+g yaxH6rX1mhaQ00dvLCyjkbJYWjgsHuciP5AvfZab4U4 -Z2eWdeze/Wv+rEbZys5/dL8OeWhO5OkGsofyae82YwU ---- V+ieHOEeY8PVexEjHETuKFvq4/FSXj4pN0yD7dik7S4 -ɏ g2 Qc&w&?\5%(a)%ݐ% -Gva -_iל} 5M2,'-,/hR{TD$SG-iW2, \ No newline at end of file +-> ssh-ed25519 Ol8kbg PME/VhYsgR6BmtBkayWFiQenodqfOjMGzuLk8UK1RFQ +zprwLWBvcXwc6mvSiOYDYz0UvCi6V7u7Wfmh6eQ2AlY +-> ssh-ed25519 QGvsHg HR7vnqTjsb46efZd00s7cDlhWz4xe+bpvBEOrAY0o0I +2T4h8K93osNlOR+4pqSa42LqjTvnNSiJC532Lh2oZI0 +-> ssh-ed25519 yjVKVA tcXgP7+G6bfLj85Zx8wpGHD5UqtH9LcV56fHdLA2Ak8 +BZTIikJmI0Qu6MYxM8EiGXFu+MSGC2ZGfhqNf4j0jVc +-> ssh-ed25519 4XPa+g PdwyAoUViWkBiQ4l8mUWH7Elw/KdI2Torjgm72pvWzk +XanrDZ2NNiU7bBvz3OQdHRh66WAwT0U81QmEXjX9QT8 +--- OTl/rm+mZy0LF+O7ff8AeseeacGhRGX+NitEMX7nYDA +{vi螾etJx bB03jW_K|EB7^_,"sr G56Qv_!$E:?C+hyեoٛ&GHuX \ No newline at end of file diff --git a/secrets/authelia-storage-key.age b/secrets/authelia-storage-key.age index 6aaeafd..a5101b1 100644 Binary files a/secrets/authelia-storage-key.age and b/secrets/authelia-storage-key.age differ diff --git a/secrets/authelia-users.age b/secrets/authelia-users.age index f35ed5f..87f02ad 100644 Binary files a/secrets/authelia-users.age and b/secrets/authelia-users.age differ diff --git a/secrets/lilsecret.age b/secrets/lilsecret.age index a4b6012..2dbcded 100644 --- a/secrets/lilsecret.age +++ b/secrets/lilsecret.age @@ -1,13 +1,11 @@ age-encryption.org/v1 --> ssh-ed25519 Ol8kbg PUbRX+aA8Sp6ZY6NeQmnYDrzoGhLPsJ9Zy9G7t4TPE0 -FS6YUAGwKNdVXnG8K9t3mlRVnM9gFeX+S1TER3NduPY --> ssh-ed25519 QGvsHg KXB/Y5/J6Q5TcHjT7yUHHVhNuajbzF/Alk17WZuPcho -TqwPN/yO/UTEYPELWl8i3XfhI1o5OwRCQF8whnw0ewI --> ssh-ed25519 yjVKVA y5yDQ5x+399MpZQL6bzExvs5PI2jvhVXgp14zaVOwSQ -XuxM98i+jH8ux6UhB9G8qZqpuLnt9dgwf03QOf4p1lQ --> ssh-ed25519 5jHFSg MIk2APZ9fGRa/+S6ppT/5MpXgOA8ncqz7Nk9xJvwiDg -fJrvR79qZTpEhpsj5q2wqRMHUy4xT4CdoAF6fHNGD2A --> ssh-ed25519 4XPa+g 0BKeQIajOJ1CCGLjS48PDTxEkAGNWeH6Lwp02Q8scwo -bGvrxqmMstH8EahbAUwvbuSViZDinjtW5I+3+/4jw8w ---- rNfyE9cTfN/UbpEkJc7ACmhg/ME/ocVeZll8S+R7Oos -*j<m]+ C\>.:_%FLjqtPign \ No newline at end of file +-> ssh-ed25519 Ol8kbg fWu9AFQRAbjt0HMIdT/I5mk8D03yg9awUBT4I40Pel0 +k68FQ2Hdlle23Fr8trCFYV9Si0VKJWm80CkNBLYa4rI +-> ssh-ed25519 QGvsHg qDDe9753l0rVmMcWXwMqtG49zv29lMVVbnttdFP1l30 +bvbtwFqvkrBZl0usEdvq1n0Y1k1UrGdi6paBCJygNAg +-> ssh-ed25519 yjVKVA FRbiN2Ki8UH4nQC8zLyFXszvw7K6r7BI4dhrgqNbAGI +zXRBQ1e06qFGvDPPqchbIlKs+Rm8+Mz7BmQsx/jobMU +-> ssh-ed25519 4XPa+g Wl+5kuVZDfybb3TA6Rn5bfPS4nS1oLz6m1Oo51UC1Fo +aDR6bXclTpBa6IWa+yDfCWei/hBq+5NpBINSqKgkx24 +--- /vQcwx2JMqdVIM0EVDUfuNWOPiFfXg91WAKvjHrq1xA +z9ڶ7"D|]ޢZwTE`IOv,DRNJ;-AN \ No newline at end of file diff --git a/secrets/nextcloud-admin-pass.age b/secrets/nextcloud-admin-pass.age deleted file mode 100644 index 4040408..0000000 Binary files a/secrets/nextcloud-admin-pass.age and /dev/null differ