bareksa: added 192.168.31.0/24 subnet to exclusion list

home/modules/hyprland/bitwarden.nix

@@ -19,7 +19,7 @@ in
     ];
 
     sops = {
-      secrets."bitwarden/config.json" = {
+      secrets."bitwarden/rbw/config.json" = {
         sopsFile = ../../../secrets/bitwarden.yaml;
         path = "${config.home.homeDirectory}/.config/rbw/config.json";
       };

options/services.nix

@@ -77,5 +77,6 @@ in
         default = config.profile.services.telemetry.enable;
       };
     };
+    technitium.enable = mkEnableOption "technitium";
   };
 }

profiles/homeserver.nix

@@ -71,6 +71,7 @@
       ntfy-sh.enable = true;
       ntfy-sh.client.enable = false;
       couchdb.enable = true;
+      technitium.enable = false;
     };
   };
 }

secrets/bareksa.yaml

@@ -1,6 +1,6 @@
 bareksa:
     mongodb-compass: ENC[AES256_GCM,data:l4zKnbAKQURlNzLS2CDQMCcZCCyZr8MdbJaHYjGtXnNde7zyS/wkPMKpUzvp39qhFZ87w54n85djdIjW9a3cyjx1Z8L800UFrEAZqiX2CNp1YLZSdyIuq+aD36+H9+3ceB35Z2eeHaLTDUUWK4g+WL07kglwx/IV5wBM0K7CO1uEd6iLcHFxUMUYt/N8l05LmXK95VwVXwMKDwsz5uxrPH5Eao8VG9J5Xh7B9tqY9SyLOhr06W8Y3iyvLHZmlpix0dectSoBTNPY4OM2Uv94Qxy96i8Qv0KMwrYQ8M2FcDXrzV+jXq+6dV/E+8xuqGEn5CDqNDZhaEWZ7VKkeY6Tq7INQqm2S020OfJviemlYXURe/j1a8thoeZGDZeMBTGL+0+fB5VVZoN4Yjmy3ezWMhE+zouvkpCX6nWdE6rTwLOoErtBMktjZTI/DcGBN8dprNYpAclXp16RWYYvSHJEeLOCxCjhi5oySqFgtychmJBDO6L0DW3BwRqe5qhK9wSOWpwZUEp4FcVrorgzKJCzfYJYox5ctrd37mXhikp7aB0ADVwFAV7i3/RTKM+C9H26nrIdl6fF1wyrytt2Ge5MPsHutaj1LB2xcyLGebFTis8fyycDchIpF8PYqulyiw+YIrXiF0MZo7N/G91G83rNT3SMuEQpeTHv4H3wuWWHoiSXIoYhCOuJNoyxSZMi3ZTcVQmgSv0oant3Cxz0+/MrjBl0tgkpeFWdugMKuvl3GWO0uMmLppKUkfUa1vxLoxZ/rk/ATfz/jkg0gQcZ01PJij4iJU/EDByKU0lTcyCd7aaLLG9u96sKn4ymxBjkP1Z9bKOaqtybXB1R9X4Jw12UtsjFhNEyClyrRC9xQ9H0vPh8oWzxyKbIW9KId0XxvFMLhKH6TmWrX2+L324xqkRS5VCtS3YhDtLNJXA8gjj9G2LjYf66rI0Tir9YaYSmiiuE8J0rOoKEJjuaLBwQP1PQo9NsTj4fG7mOUqCOPGp66oiWGRtxuC9j2j841gUUvjzkNOJ2Pj077yQNMO5rRBG1l4EoNhaAzZygp0dGp03np2WTDbqpCtBB6GuQcBnzc5pdzTtFndbOfbHzC9VaG/1Y9FfNEK4TaWm0J7ep4VDa3bzKvUYYb9lSwaAIF/pmP3dMDiRgcn3Ck8uQlHyRxvK+eqNqJpObeiKKsvKfKeniqnpJwUvCEf8yczENu25A/3mRYJW6yWCERxZxiPZn6RdOu/bjZ6Y1wO80lxJ5xGKHpWemAyar8aLuOsPpbbsVWFpx8TG29Z50SGh7TNdgHBJJtuY8voMxsrxMceDhWkNDw1/3IP45RjW2FQ0a/xQ/MAgoCdFopOmzj7lc2zdU6Py5O2goznOrnyQdkik4RwCPenBT1p3WLZjSnH7ymc7elq8bQn5zUUHaDK7oQnIYrHtlYSsSuKY+cSjd3v72HbF85XvIal2LzwxgURafWJ0AUU++SNmR2lKT4s3azVywT/gqq6fVEm5Ffu5hdsTGMU5QgYFRfpPrB7IAYQlpVk8VfYmim5/IY0TG1/0Qv4ylWU2chC+Spof04PmCEQy5MnQru/LP2s7MQ/ZlSaHfZgR2NGdryf2Dyu4FTEZSY08Cdj3EthdvC1aAeiz1yuDpunbZPqF1Oop+lCBfZlWTpc06CdA26+0SjY5EUFtazzuQOY0WsO54dcj0CIfAxpQJEQ==,iv:xu/zsGEV2RWyfKtKmEo9yajNO3RMcaxdP/6Sn4sQQtA=,tag:RpfrCMYfEjJKgwjr+AJ4KA==,type:str]
-    openvpn: ENC[AES256_GCM,data:eqkyCsEu0PGPpMbweh+w1mhIDXBIDbxwHj9m91AzztbjyJ+2xWo4wWxa7F+luosddoQfB5nCUiGIKqhcYi8LQHUfnVxD4Dsd3Ysc04eXh9cbx22+LfjPbokAP+QvBXRaJTY15g/JUYstKENMfbCwE7PBUNywme7iFPhqGH+h8kqlgGdtHIoNJjs5HFVe73zTPpEP4805F06EmLAxG/y7r0k/XiVBSCf+uwcaweXVMRnj7IEv/EQ8cvAimfYz3bzeJwqGQG23ExAStdaaIq5tW78LtMq2qmIWDw+sA6v/b8b+gSDLf/tx8glbOs/kcH6NOGq99wN2Ubv1kAFs9SEH0FYZQNmxUxaqrzcCGgo3aJLDzic5KleIpGT0feCtm0tYy3ao/QAcXBOuTc5RJOZo4675eyGsALayKtFHUU7uDLC3s3Dz4Uh5JRlbVRBtL1oJCqNnrkMzBiBNhxQ1zGTQyAxQXE4yIw3IsyZqX6kagAsaaIv1T36X882IoU5YTmr2bsm+Xs3Rd2DMKDWu4a89dD6n6Ufbu7rge5WRP/sz6ZRGP+TuhpAfWgzvYwc23wT5rDazzG/rUJK0vICgQcAduCkKE7RML7Q7N+lMAV2UqLve9JTc6TZfgrfBWaqi8+MYA2pM8aYqqdS2n9kRAwJs1O6Oli3ZLrM/LKARTwG63GV0xVbOd+ie7Pyz6KoqxE+Oebo3q39cBunZEq88ki3SggIIhpdcjAqNyH9GCyzEhTn8uuddZ5ZC0NXj8lQAGVCgwhEDPTERxycOOiBGkcWYmvoOSP/m3CV3tOTatir6cTDKjifrpL3ngTc/T21WXloMk27g790nY/GeJd+yHaoFs2AVNEvvFuOsNuecV3FQOxuajPTaho5+aDQK6iNioG+ivpu5eLYmqsy45X5Lf317dsJzHsxyZmH82OH/HX0qFtvpW57OZg1eAO9oAqJtfPkEnyw3CW5qc38oVN4DgK9mvdnGoXRQjky/1PSNAG1hRjdF4VvLKK3Ls/EgHRzd3Kik+xUwdbzyeQ7cSkhai+lEHNNzOV6eBDbhEYTQFqU7b+U7k9d+xVWrAHQMRYMIswotcS/UuQYIzd9b/qYraUe8ynxLK1Rcz6J5m3lZ1NrX4tfwJRDXuj429P2e2UAaPv8x0lgiQWcmHFPsaTPcPA9n3bzTG81FYrdDy5jJ15+RLWdWHUZc/RKNSmZWzHe/ocqm4Oj1oS9jgB5nn5JGAtVZbEWDUabPPGgDl9c9expbwXOodSHgu/MVXfxqbCKFrhwOxpNFTMeJKe6WFZ9/3TaqmA/lDwXELzmyEFNS19jPM9BriHOKSPwwZ/BhJMxYLFvM2J5UfHiPbNCVH9FvHk/VdfPTmY9XssXmEEGGPNt194os3rxRxVCFLkTMvPYWRx2gMeSNk3qwnHzlsOqCSGJiyGNSavEK07C1AkAOHQBk5VhBDpWtqtLBJneu7zxIIezt6Nr6I8XVr2ceTlJsvZT3WuxpAIbTNNGxgDzRaRIjSdBy6lXjWT4bLn4ZzXLO8XcJ01T7chmeTPDqzymF+3VEWo7Rsk0W7wk5w7JOwjfX2aV5hWq1Vb0zUtiJc9+PtvIq78eMi3KgMZtpukuikSehX6wgozSL0zi1zo8JHYyYIt46kfcW4o1hZ9qE6H4uFca3lwKvLSHx7z3TJe79LEL+4ObXWWowBGZNoSN1cWEw3BNlNrzfMTZw4VcIFzufegits6nGT8WpGqqR3oiH4CcZhyQ6Qx78RYOkAs33GVhdFda2QlsRdFOWmMYTDPfM6ABXgWfO2Nzxj3gjHVACv+0g/rYUCd94TiEDVYcKStjvvPr4r+fj6eUY6EsdtzgwnhMQWNaNRMO8Q3CNzG8plaFk/O/CK8R7FvIdeigEs1O1CwxRcr/80ZVx7/xj/T7p3hvM67nzGvfyRTwEgkl9hnBLZU7sMV12d7DOsanGJOViVrqQ/GgfvP9w637SmtLFDLzZ6WREX3W2edp5JXQMg0hzW25p7sSgpTde21bY607/25VKRVw7ejwOeRebBrqj4lu7Xk2iXY2H0hp0+klxOZp/INl8WfxGIY4W34McTkGdLOonWqdCUoDjUJvbfH5uPCqoghRk+l4Ex5ogjCaGx6GQAMdvg/uEG8DtJx1GSW/SonlhfeNZncmhx7l3zvtt1WziRCo4xAOma0GjdtGhg92zNqGzWYjBtqKL4kXFX31ygwdF+CG5JlAv64B8bTEJeU9UiYb/D9QyQxUmUixjB/DbACA8j6c5VchkAEkdz8p+eexugk2aOb1IkkM0/kcGVeAHJ2J6rzQjQ+5GHwiU1Zh/j44Jy/2L94U6xcrampcB4NBHY/lOOgeSaGGZ9gvskrAW5EGiusiil8V7vdoLGNa2ke1LAv8rawqAlDiIA0XRKi+NV2egeqD7oatnDsQ+FExNaoAAyFmk9To4UWMSuv30X3E08MzETWuXiVAD+adGfAy3Ha9odCwf2GbJji9x2SkDv9lA0AJ+ZlfKOuUU5+GNpbusuRYqGeTXtgorgAtzx1+Fw03xm37FKBw4qEY1UtbNZjhO8rPHCDjgt5zBD54Kct50GbKL1aG6gVlAJN6u0KCFbluF2kEI4NCMoZGe0YdjukmRpHSd+DepHK+mBDoroUPSbuhv6Pk5SrzyeFBGB0ynrnI4gwyf3y3I+c03vV7potWUusNCJz4rv0hgtW4Uup6eoYjJ081x49JkaYFHu0m+bE8R7kJFzcWIgJeUu9lJvmVCRG5bSj0pRlQGrewebt51bvmV5mJ7z0sAI8rgouP09LFom2K4mPWMgOD4mlhKHUdIRQ0/x2zl0Mp9HLWdXu/Ns5fhQSIH7YpvmYJs1OHiCG1iLiDdN24UKl5oN+va3gt03gH2jePRvba8hOltbf7+kRDccI8toLb9IyEmb0RDQg0jB+WssiJupLk4aRrCG/VIuVcVFPRsvWCqJi3FVXKvCB6VhoHs9rnlc3Jlxod9ZjlwEQ7lpVxFun6vFFDqLwQwZHuHr26cKOQIpgL1Q+uj9/WjO9WAIfUp68Ley0W3vQMaljjWhDODJ21SZnU+hHApUMY69MKAL4wuQq002fN+fmrkfeG2qYjbHGnlFYjNp9LP612mANxW636cCkWfH+FABm143Fm+yd+XA/FPBlsAMeuz2w9NLL2Djc6mIDfKETwovXU4daelAsZEmnYFPSpelIfRPBWS5JTVREvkUDyFROKKtzzA53b4k2z7HdN8YRTB/sRIdErRFP+EtpymZXPtBAOh/vbOXRY/H90dHvyTwB7xomMrRpa1hLeJm3vtBTToQL8ZWeCX2R53yIWg0SQe5QMO2VgoslZNhi5RQnJ1GxlOQ1iWxrHI8ViWwqEgyoV1q8JXIE2GfbhwXrWXF8WxdJBZPwmuNVn5xk04,iv:gDpHNdBvCy9AsFsDICMJrjVFU8x8GPG7nImgSYHtatk=,tag:OJf7+u0nIDeITY8deQQ0JA==,type:str]
+    openvpn: ENC[AES256_GCM,data:uV5WsWvPWbNY9c7m/Qf/GcJiOi+jgIA9R+45Zt9gymBvmoCq+9ePGYxpEhiugVjPh/NAQ/sowr/LD3Su8CrokPSlkELtk/f14MIyBNqhrVKqKW3xkLwFj6P6My0W0Odg/2XVe1wsWd82NF4L9RNCqDcEVt0uCv1zKA7PzK5hEswmnsL3fLYoETpWB3AjC49VgrvxN2lnNfgS/s9zagbd+vfz49Y3GtFkqRlke3Jr0Rk2rl5TlKwLV4UE5CiuMsDEPfiA2I3dR069Mmu8HeYEPbmNyPfvQhwhocqiqlu9CvXAzqlGaBmqRovZrNyrpK+poMBWqVrEGWurYPHVBZkCPQc0cF959B5gjGfANoM20t8nTJqV39SyyarWwdH2hrHqLiCSQFaR78977Gnw4RO0C6eSLJBIkG/QvGYjjbltQUcPgSoEfc8xjQp/1Jok/AlVDnvA5MsqTnLPf0QPWdvGEA6msg8r/ZRbQ4VRsBNxgiorO+zJg+cjCG7VGuO/ARvXyrooyiS3lrHEz8o4BY1c/Dkb6tbbrJ+ENJdKIYjswGSOL6QcGQzBWqeAm96e6iFPMMnnPjpKPr8mDlVDsLXeCGx76VuvY8iVkcg7tT+btL5UuzkiDlzwu5He5oS48Zk8tDlA4+vnRyUvr2rdAu4ErWx3wKGSnG4ojKZZQujUWxPCWS2YcyOt2lZ16d7GqX/vYde9HnxnbdN3XPuIlJ+aedW9eljhpK194gTyIBBqjuskuMKN8t4LiI7fl6uZsr+USnYf+HF5dIJEFShJ0ZD6YgCjNjq5V6KADlowys8bRaiSfA3BUKaodJtqaxCDqaGUvabFJPQ6PYSky8+wGAmjrv5gfISpdkSMNEgqh4aPspEDeKUkx0EeoW9rgUhFiliEmbNUWWqRUpoVNL2O3xAgNgZJt+WzrWRnXZIzYQujYvcoi1B0dTxG5WEclhD91kTSmtwx8FpYsOCKds1qHkFxh6ekRMkjqYWMf9lJ/W+A2x9bCqcNubpH4GWLbfSJBNpCKW86JAD16+aqb4sPvUKPvvNTRHAqK0bA1/hlvmlOvdR/kYDE5S148HdFz0FujSPOX9g2UDZVyCxW8xw48Lj+QWlrrgPFzomT/gL09LtnA9KFmk2cGkfnPaMYUKX8xPmg+34tjrFhr/HVJ/P0rqbBTFqJGZel/PiF8RbF9L/R3iIf/x04dxDQxz0gCHsyHtl1MgussbHpxfqV0Nxrc11FwAokJ+vKMbUfsW+OWNmZ2lNNJOPjVsQc+Hq2AlZUi1PIfXx4f6QiWXoYIqhpkMkQUTmXAvvLj/8QTm0dleKvbdOVrOI+nXS98zsU90G/JThBBYXGHMubYsuEaJQEJfk3POsSKpZ47Kj6YHTmPsvn7BUkBAR5mQ0UknuOPKQ7y95cytk7su2HC+Jts6jB0PCoexRvubEQkFiZ//0SPQ79GNYDJRUrY89F1XE0lL5PrqChhGjNtcxcao+MYcEq+u1+0m7/vHqTjf89EHUUxoMubU7S+3aOT4kMZwetpIxLp+uQMrm7vB9BOaobelhPJMb/ehpktjkkii07fHPIA13YbcdNx5xvp4Hkn+4ZGl08c8qt0IfpZ9/qfROqirtn8733khrWfpPvcOOdyunIBtT3dmUHbnknSBtci1zumGbaCCaZPUGLUh36XKnqr+RjI0VKLf9OEKpik2s88nolXQpCiZx0qoErvhWG9stJOWEZMj1EKcsg9RcW1V+PdrV7Nhry03BdItwqk2p/BV45U4Di8sXTw4mminohEpW9k/0Lsv25OoTlvqGK4MQHhJRYgKFqZHbLttq6vBqGJg1rinU97rSZU5iaisI5uDdrx4mam/7SukRIZlr84cNiIeii+FDgbIuruAM43KVdb2SaHDayfHJb9xAjDEOHz1OfVYYwrR2eleIOW96lzua0YOYYX0EAx88DYQ+ulKjLKMtKqGMDOMBSv63WJiPpm7DyiIbQAWsHSKQeYE7gnBNg98ug6TI9570RZybSzdk67ZiaerEkyCDOWg+iPHmFO3TCly/LklpZI0SJxEgQp3M6yAAkLRxNLawRjl0TF5/xNxhH0tZEU2U3fHyiXIiuFJTzgMl2NCVSfu1l+BTUZCDbd3StJuKS2yq5i73XJX0nrg2K7g9u88tsNuZUngaH6njjtrayuycjpB/wZDq00gA6fiuQs74DIGafjG+PlIv2niwhtbkW56S53tKOeZKhuZKW7r8IEYAHDMQByPxBKEuA28N7NjQytsI5fkMQENqySwEejPhJMhOw7i3ODbr+VRKNiq+xYBQrB8PgXkbXCpfNhZWOr0O2ICk4HwqcRaYislnkJ3VZ3TO3e7MpRFOtIv1Ajwz5FsQu+TJReqv7rjuAVM265idFgxpz8JE9wMq21JT3M/RebvQS2mYJYZyy8vZH0HZ92Vv4MljyBlw1uCGfKnl1gdB7jBy8TNygs0YTFGCSVATuPPfn/TOjI3LD3P6jVYIlsii7RSXUOO83PvBTjEk4MaL2qnfHqymRnlQu6QI6FBUgqE1Ak9DoaFRmR5kW5N2MbVfD+gZliPQsFDiJZvdPpSqHkW7pVax+2DjLxY6tX8au5S+HW3zxgw4vczOK8sbd6F0shlYXviFmi5a72ta9wAv4AaevRJxigBmc8WOTivW+uz3XSjl09yDFtNwlEvDt/jzneVNouEOu5Q09ZJKFOba0oSUUKNNWD1XmoPaqV1uSZ2LcaNng+JxLmMtZasHIqW03b18m2Sll1vhqq7GebStkImPwwFN+03QRMZFdaZRNKhHLMfPzOjtyoe1VyWHwJ8gOoN/qjCC8cOMSquck0EDZKhRIMOw56ZHoCVgAmkMpYl4beGfc+C1C30MB1RPD2Hbyh/9yhuQrYW6Fektc2IrGtFVXEEZSzyvhvSM5I6MVfRYggLBp0bk5ZruapVYxdzIVxCogyX8hI3HgvSgXAnIdBKPdW67P9qbg+aty+jnx2cnabdrlW+0Aa2PNVMCYZ1yHqRD1dTQflKuhdkBBhMrNSrRcpUaCnDgOII7z8GPyXzztdJ0W2pcoIzmNVaQwmS3D5Ctas3bVyLV4XMBlhi0KqSass+FQaBd+nMOfYfxKLeCJPw2twR8C0oi2DnP9OkoA1X8eeZ5LRUjpeNoyjbm3++HntUSGJXZ7F4jOiwBWgAdmtcvUds9g1DkbXF2mf11l8AkBtcubwLWh5pDE8JwER7EILzSG/EgrDxH+ePtqxlIiULGzdKONiUuUW7HMnL5hmjOf+lnCizo7Q0lNkkr9SChuCAUa8L0xlDl+LYdHet4Iq61qvBkI4GTfmM9VWiohy7gWPpe/vyIeK313DbbMhtXrWfnwsXtCUs2amZrFbREo+cre5563CH9eHfyvXLzfaSDrHd+aksTQzz/UbaVeKLwEspLSHjAjs9v28KjWJVdHSzxwSzTI7q+teiW6Sd2RCKfLy+QedRDi6Bdq,iv:BPphYLrq+qdZwBYk58wKtCQpMMvyUskNVAH9bWwNao0=,tag:yVmJjmVFz6bcSqPSZo6EOQ==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -16,8 +16,8 @@ sops:
             TlB6MjhXY1VPUkJQS05hdFVGbGlIdUEKhK2RFfuDZUXdDUL/ueJnRP65lAGFVPXg
             zqZdgIU6/CKKRjguw4LC2aO75y2tISRrACvvzjjp0LED6rZQfZspWg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-10-28T07:56:59Z"
+    lastmodified: "2024-10-30T09:10:48Z"
-    mac: ENC[AES256_GCM,data:sY9EySdiDrXVAKKa2OlyDKStL/zMgbZzjU2MYqfjaKMn7YcYhToJqXZVx7xZr2jUR3BzwY0sjjirzTyjsq7uGsR6hbzOBy0LAMYkgup9UbD6T7xIPF4IMoMrku7fzq2fp4atCEKy38fXLr1cI0FIQkHN+vm3onpJ1g2ymtOonwc=,iv:9GZQmhCBydsBOzbPLX2LHfBuDpsvNcBHGZ4PxccaTTk=,tag:AmrkUeJ9u9/l0zBvBOBVyQ==,type:str]
+    mac: ENC[AES256_GCM,data:HsRRHrttuqeh9+PYTQZNWc4g6HZhhyMyBmuQjD5/+FyunC5x1xYLHB/yrtwPBpSbN3KfZA6QMEstxA7YH+DBT1fL2+IL+gKx/tWDzAmQIoB1dA0dufwnuZDPqwhnTRbcMczQUPOzMny6TZh5PY+XyAWjDrmrCE5lYtjw9Jh4RfM=,iv:SlAOXITlkIEg1Hqp4Z5oryfNryp9SkfoerhR7hShY/I=,tag:Wd2EEV47H38otNMCvpYBgg==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
     version: 3.8.1

secrets/bitwarden.yaml

@@ -1,5 +1,8 @@
 bitwarden:
-    config.json: ENC[AES256_GCM,data:oob3Dybuex844TY57FmTL+JVgPS/QQeEVMVeiOYrGaXLpH0OE76rJMiOPw==,iv:aH6Xz+3bPRkK7Il8/g516du4IJ7k71hZMTlF33YARBQ=,tag:LOf9yZDkASMwAq3UvWjv2g==,type:str]
+    rbw:
+        config.json: ENC[AES256_GCM,data:dKdB1aYPKGcC5xmlKMsGzusw5n916uR3TH00oKlbhvlkYaK4JYAze2R1mQ==,iv:fg3FDh/kWQL8ZXtCOYGy0fKkqRXM19h/JnmB626stK4=,tag:+z03/3YZ5vdzQtL+C4WWtg==,type:str]
+    bitwarden-menu:
+        password: ENC[AES256_GCM,data:GpU2KvjenwLcH0CMN9wx7LtRly786KDPoak=,iv:imgghA9ti3VLd7fU0Wx7s3WujHs/GfeKSqEYK0/GQkI=,tag:5DuQjIy2Hr02Q10Tzwt+6Q==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -15,8 +18,8 @@ sops:
             NkhTR0pOd1JxNXhjb3hsWlFyREl5RU0KHFFdDs1BDo/CUeIjV7QGxIfL6nwfuzYE
             +zRqZDbocFnNQ5m6X17O11+xGhRASL7ORweIeVlzCpCyJ27IsaoSIA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-10-28T02:13:49Z"
+    lastmodified: "2024-10-29T04:54:37Z"
-    mac: ENC[AES256_GCM,data:52uwqIj5gXnXlFRuzd9mqvziAGkso+HWwqlD4EcOhXs11dHpgaWsusq27ItwyHwZaN8UUN8frfC9/U4JppOgjiUXpteO78DX/Hc8QZP9Q7Fw5rvd0jpQIWDhXC0LmqIIg0v3lvv1jgWkMHrxBsB5IfJiOlitwX9hG9wn+8H7Qq0=,iv:FvZmiqJmD5bJAM0PV6/uolsMn4r2UC964MUXL17K3o8=,tag:Dy9kVUhtbLrC5ykJsr1Mcg==,type:str]
+    mac: ENC[AES256_GCM,data:jaTnfW+stQNSsbeUIvI3viXYAkw0VJ+oc2IDFrEuU5p3h23gmPoJkaY3fQ+eC9BAtcElvkLAyvIFKD1zOLtWb4brQUWW64xK/sjuYc0xdathbSMtjbNiX6eDciBcSGOqcncJ1FsnYkaYT7u2U5NFUh9G+WjQzET28gIbDKGnDbA=,iv:9X43hNPnQ6CtvIaw+lOtFXu9586Axi+fQvOoudeMYkw=,tag:y7vlNt3lcfoYP0F2SIJHlg==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
     version: 3.8.1

system/podman/pihole.nix

@@ -6,7 +6,7 @@ let
   inherit (lib) mkIf attrsets;
   ip = "10.88.1.1";
   image = "docker.io/pihole/pihole:latest";
-  piholeDNSIPBind = "192.168.100.3";
+  piholeDNSIPBind = "192.168.100.5";
 in
 {
   config = mkIf (podman.enable && pihole.enable) {
@@ -59,7 +59,7 @@ in
       hostname = name;
       environment = {
         TZ = "Asia/Jakarta";
-        PIHOLE_DNS_ = "192.168.100.5";
+        PIHOLE_DNS_ = "192.168.100.3";
         DHCP_ACTIVE = "true";
         DHCP_START = "192.168.100.20";
         DHCP_END = "192.168.100.254";
@@ -70,6 +70,7 @@ in
       ports = [
         "${piholeDNSIPBind}:53:53/udp"
         "67:67/udp"
+        "2000:80/tcp"
       ];
       volumes = [
         "pihole-etc:/etc/pihole"

system/podman/soulseek.nix

@@ -16,44 +16,19 @@ let
   user = config.profile.user;
   uid = toString user.uid;
   gid = toString user.gid;
-  basic_auth = {
-    username = "soulseek/caddy/username";
-    password = "soulseek/caddy/password";
-    template = "soulseek/caddy/basic_auth";
-  };
 in
 {
   config = mkIf (podman.enable && podman.${name}.enable) {
     services.caddy.virtualHosts.${domain}.extraConfig = ''
       @require_auth not remote_ip private_ranges 
 
-      basicauth @require_auth {
+      basic_auth @require_auth {
-        {$SOULSEEK_USERNAME} {$SOULSEEK_PASSWORD}
+        {$AUTH_USERNAME} {$AUTH_PASSWORD}
       }
 
       reverse_proxy ${ip}:6080
     '';
 
-    sops = {
-      secrets =
-        let
-          opts = {
-            sopsFile = ../../secrets/soulseek.yaml;
-          };
-        in
-        {
-          ${basic_auth.username} = opts;
-          ${basic_auth.password} = opts;
-        };
-      templates = {
-        ${basic_auth.template}.content = # sh
-          ''
-            SOULSEEK_USERNAME=${config.sops.placeholder.${basic_auth.username}}
-            SOULSEEK_PASSWORD=${config.sops.placeholder.${basic_auth.password}}
-          '';
-      };
-    };
-
     system.activationScripts."podman-${name}" = ''
       mkdir -p ${rootVolume}/{config,downloads,incomplete}
       chown ${uid}:${gid} ${rootVolume} ${rootVolume}/{config,downloads,incomplete}
@@ -67,9 +42,6 @@ in
         serviceName = "podman-${name}-autorestart";
       in
       {
-        services."caddy".serviceConfig = {
-          EnvironmentFile = [ config.sops.templates.${basic_auth.template}.path ];
-        };
         services.${serviceName} = {
           description = "Podman container ${name} autorestart";
           serviceConfig = {

system/podman/ytptube.nix

@@ -68,36 +68,11 @@ let
 in
 lib.mkMerge [
   (mkIf podman.${name}.enable {
-    sops = {
-      secrets =
-        let
-          opts = { };
-        in
-        {
-          ${basic_auth.username} = opts;
-          ${basic_auth.password} = opts;
-          "ntfy/tokens/homeserver" = {
-            sopsFile = ../../secrets/ntfy.yaml;
-          };
-        };
-      templates = {
-        ${basic_auth.template}.content = # sh
-          ''
-            YTPTUBE_USERNAME=${config.sops.placeholder.${basic_auth.username}}
-            YTPTUBE_PASSWORD=${config.sops.placeholder.${basic_auth.password}}
-          '';
-        "ytptube/webhooks.json" = mkIf config.services.ntfy-sh.enable {
-          content = webhook;
-          path = "/etc/podman/${name}/webhooks.json";
-          owner = config.profile.user.name;
-        };
-      };
-    };
     services.caddy.virtualHosts.${domain}.extraConfig = ''
       @require_auth not remote_ip private_ranges 
 
-      basicauth @require_auth {
+      basic_auth @require_auth {
-        {$YTPTUBE_USERNAME} {$YTPTUBE_PASSWORD}
+        {$AUTH_USERNAME} {$AUTH_PASSWORD}
       }
 
       reverse_proxy ${ip}:8081
@@ -107,10 +82,6 @@ lib.mkMerge [
       chown -R ${uid}:${gid} ${volume} /etc/podman/${name}
     '';
 
-    systemd.services."caddy".serviceConfig = {
-      EnvironmentFile = [ config.sops.templates.${basic_auth.template}.path ];
-    };
-
     systemd.services."podman-${name}".restartTriggers = [ webhook ];
 
     environment.etc."podman/${name}/ytdlp.json" = {

system/services/caddy.nix

@@ -20,6 +20,21 @@ in
       package = unstable.caddy;
     };
 
+    sops = {
+      secrets = {
+        "caddy/basic_auth/username" = { };
+        "caddy/basic_auth/password" = { };
+      };
+      templates."caddy/basic_auth.env".content = ''
+        AUTH_USERNAME=${config.sops.placeholder."caddy/basic_auth/username"}
+        AUTH_PASSWORD=${config.sops.placeholder."caddy/basic_auth/password"}
+      '';
+    };
+
+    systemd.services.caddy.serviceConfig = {
+      EnvironmentFile = [ config.sops.templates."caddy/basic_auth.env".path ];
+    };
+
     services.caddy.globalConfig = # caddy
       ''
         servers {

system/services/default.nix

@@ -19,5 +19,6 @@
     ./wireguard.nix
     ./photoprism.nix
     ./ntfy-sh.nix
+    ./technitium.nix
   ];
 }

system/services/ntfy-sh.nix

@@ -74,7 +74,14 @@ lib.mkMerge [
       ];
       description = "ntfy-sh client";
       serviceConfig = {
-        ExecStart = "${pkgs.ntfy-sh}/bin/ntfy --debug subscribe --config /etc/ntfy/client.yml --from-config";
+        ExecStart = lib.meta.getExe (
+          pkgs.writeShellScriptBin "entrypoint.sh" ''
+            until ${pkgs.unixtools.ping}/bin/ping -c 1 ${domain}; do
+              ${pkgs.coreutils}/bin/sleep 1;
+            done
+            ${pkgs.ntfy-sh}/bin/ntfy --debug subscribe --config /etc/ntfy/client.yml --from-config
+          ''
+        );
         Restart = "on-failure";
         # User = config.profile.user.uid;
         # Group = config.profile.user.gid;

system/services/stubby.nix

@@ -15,7 +15,7 @@ in
     services.stubby = {
       enable = true;
       settings = pkgs.stubby.passthru.settingsExample // {
-        listen_addresses = [ "192.168.100.5" ];
+        listen_addresses = [ "192.168.100.3" ];
         upstream_recursive_servers = [
           {
             address_data = "1.1.1.1";

system/services/technitium.nix

@@ -0,0 +1,23 @@
+{ config, lib, ... }:
+let
+  cfg = config.profile.services.technitium;
+  inherit (lib) mkIf;
+in
+{
+  config = mkIf cfg.enable {
+    services.technitium-dns-server = {
+      enable = true;
+      openFirewall = true;
+    };
+
+    services.caddy.virtualHosts."dns.tigor.web.id".extraConfig = ''
+      @require_auth not remote_ip private_ranges 
+
+      basic_auth @require_auth {
+        {$AUTH_USERNAME} {$AUTH_PASSWORD}
+      }
+
+      reverse_proxy localhost:5380
+    '';
+  };
+}

system/services/telemetry/alloy.nix

@@ -8,6 +8,8 @@
 let
   cfg = config.profile.services.telemetry.alloy;
   webguiListenAddress = "0.0.0.0:5319";
+  otelcolHTTPListenAddress = "192.168.100.5:4318";
+  otelcolGRPCListenAddress = "192.168.100.5:4317";
   domain = "alloy.tigor.web.id";
 in
 {
@@ -22,38 +24,40 @@ in
       extraFlags = [ ''--server.http.listen-addr=${webguiListenAddress}'' ];
       package = unstable.grafana-alloy;
     };
-
-    sops = {
-      secrets =
-        let
-          opts = { };
-        in
-        {
-          "caddy/basic_auth/username" = opts;
-          "caddy/basic_auth/password" = opts;
-        };
-      templates = {
-        "alloy-basic-auth".content = # sh
-          ''
-            ALLOY_USERNAME=${config.sops.placeholder."caddy/basic_auth/username"}
-            ALLOY_PASSWORD=${config.sops.placeholder."caddy/basic_auth/password"}
-          '';
-      };
-    };
-
     services.caddy.virtualHosts.${domain}.extraConfig = ''
       @require_auth not remote_ip private_ranges
 
-      basicauth @require_auth {
+      basic_auth @require_auth {
-        {$ALLOY_USERNAME} {$ALLOY_PASSWORD}
+        {$AUTH_USERNAME} {$AUTH_PASSWORD}
       }
 
       reverse_proxy ${webguiListenAddress}
     '';
 
-    systemd.services.caddy.serviceConfig.EnvironmentFile = [
+    services.caddy.virtualHosts."otelhttp.tigor.web.id".extraConfig = ''
-      config.sops.templates."alloy-basic-auth".path
+      @require_auth not remote_ip private_ranges
-    ];
+
+      basic_auth @require_auth {
+        {$AUTH_USERNAME} {$AUTH_PASSWORD}
+      }
+
+      reverse_proxy ${otelcolHTTPListenAddress}
+    '';
+
+    services.caddy.virtualHosts."otelgrpc.tigor.web.id".extraConfig = ''
+      @require_auth not remote_ip private_ranges
+
+      basic_auth @require_auth {
+        {$AUTH_USERNAME} {$AUTH_PASSWORD}
+      }
+
+      reverse_proxy ${otelcolGRPCListenAddress} {
+        transport http {
+            tls
+            tls_insecure_skip_verify
+        }
+      }
+    '';
 
     systemd.services.alloy.serviceConfig = {
       User = "root";
@@ -62,18 +66,18 @@ in
     environment.etc."alloy/config.alloy".text =
       let
         lokiConfig = config.services.loki.configuration;
-        tempoServer = config.services.tempo.settings.server;
+        tempoProtocols = config.services.tempo.settings.distributor.receivers.otlp.protocols;
         mimirServer = config.services.mimir.configuration.server;
       in
       # hcl
       ''
         otelcol.receiver.otlp "homeserver" {
             grpc {
-                endpoint = "0.0.0.0:5317"
+                endpoint = "${otelcolGRPCListenAddress}"
             }
 
             http {
-                endpoint = "0.0.0.0:5318"
+                endpoint = "${otelcolHTTPListenAddress}"
             }
 
             output {
@@ -156,7 +160,11 @@ in
 
         otelcol.exporter.otlp "tempo" {
             client {
-                endpoint = "${tempoServer.http_listen_address}:${toString tempoServer.http_listen_port}"
+                endpoint = "${tempoProtocols.grpc.endpoint}"
+                tls {
+                      insecure = true
+                      insecure_skip_verify = true
+                }
             }
         }
 

system/services/telemetry/loki.nix

@@ -7,39 +7,10 @@ let
 in
 {
   config = mkIf cfg.enable {
-    sops =
-      let
-        usernameKey = "loki/caddy/basic_auth/username";
-        passwordKey = "loki/caddy/basic_auth/password";
-      in
-      {
-        secrets =
-          let
-            opts = {
-              sopsFile = ../../../secrets/telemetry.yaml;
-              owner = "grafana";
-            };
-          in
-          {
-            ${usernameKey} = opts;
-            ${passwordKey} = opts;
-          };
-        templates = {
-          "loki/caddy/basic_auth".content = # sh
-            ''
-              LOKI_USERNAME=${config.sops.placeholder.${usernameKey}}
-              LOKI_PASSWORD=${config.sops.placeholder.${passwordKey}}
-            '';
-        };
-      };
-
-    systemd.services."caddy".serviceConfig = {
-      EnvironmentFile = [ config.sops.templates."loki/caddy/basic_auth".path ];
-    };
     services.caddy.virtualHosts.${lokiDomain}.extraConfig = # caddy
       ''
-        basicauth {
+        basic_auth {
-          {$LOKI_USERNAME} {$LOKI_PASSWORD}
+          {$AUTH_USERNAME} {$AUTH_PASSWORD}
         }
         reverse_proxy ${server.http_listen_address}:${toString server.http_listen_port}
       '';

system/services/telemetry/mimir.nix

@@ -7,28 +7,6 @@ let
 in
 {
   config = mkIf cfg.enable {
-    sops = {
-      secrets =
-        let
-          opts = { };
-        in
-        {
-          "caddy/basic_auth/username" = opts;
-          "caddy/basic_auth/password" = opts;
-        };
-      templates = {
-        "mimir-basic-auth".content = # sh
-          ''
-            MIMIR_USERNAME=${config.sops.placeholder."caddy/basic_auth/username"}
-            MIMIR_PASSWORD=${config.sops.placeholder."caddy/basic_auth/password"}
-          '';
-      };
-    };
-
-    systemd.services."caddy".serviceConfig = {
-      EnvironmentFile = [ config.sops.templates."mimir-basic-auth".path ];
-    };
-
     services.caddy.virtualHosts.${domain}.extraConfig =
       let
         mimirServerConfig = config.services.mimir.configuration.server;
@@ -37,8 +15,8 @@ in
       ''
         @require_auth not remote_ip private_ranges
 
-        basicauth @require_auth {
+        basic_auth @require_auth {
-          {$ALLOY_USERNAME} {$ALLOY_PASSWORD}
+          {$AUTH_USERNAME} {$AUTH_PASSWORD}
         }
 
         reverse_proxy ${hostAddress}

system/services/telemetry/tempo.nix

@@ -3,55 +3,25 @@ let
   cfg = config.profile.services.telemetry.tempo;
   inherit (lib) mkIf;
   domain = "tempo.tigor.web.id";
-  basic_auth = {
-    username = "tempo/caddy/basic_auth/username";
-    password = "tempo/caddy/basic_auth/password";
-    template = "tempo/caddy/basic_auth";
-  };
   server = config.services.tempo.settings.server;
 in
 {
   config = mkIf cfg.enable {
-    sops = {
-      secrets =
-        let
-          opts = {
-            sopsFile = ../../../secrets/telemetry.yaml;
-            owner = "grafana";
-          };
-        in
-        {
-          ${basic_auth.username} = opts;
-          ${basic_auth.password} = opts;
-        };
-      templates = {
-        ${basic_auth.template}.content = # sh
-          ''
-            TEMPO_USERNAME=${config.sops.placeholder.${basic_auth.username}}
-            TEMPO_PASSWORD=${config.sops.placeholder.${basic_auth.password}}
-          '';
-      };
-    };
-
-    systemd.services."caddy".serviceConfig = {
-      EnvironmentFile = [ config.sops.templates.${basic_auth.template}.path ];
-    };
-
     services.caddy.virtualHosts.${domain}.extraConfig = ''
       @require_auth not remote_ip private_ranges 
 
-      basicauth @require_auth {
+      basic_auth @require_auth {
-          {$TEMPO_USERNAME} {$TEMPO_PASSWORD}
+          {$AUTH_USERNAME} {$AUTH_PASSWORD}
       }
 
       reverse_proxy ${server.http_listen_address}:3200
     '';
 
-    services.tempo = {
+    services.tempo = rec {
       enable = true;
       settings = {
         server = {
-          http_listen_address = "0.0.0.0";
+          http_listen_address = "192.168.100.3";
           http_listen_port = 3200;
           grpc_listen_port = 9096;
         };
@@ -59,7 +29,12 @@ in
           receivers = {
             otlp = {
               protocols = {
-                http = { };
+                http = {
+                  endpoint = "${settings.server.http_listen_address}:4318";
+                };
+                grpc = {
+                  endpoint = "${settings.server.http_listen_address}:4317";
+                };
               };
             };
           };