heuuu plein de trucs en vrais

2026-06-22 11:53:37 +02:00
parent 8c726db73a
commit f5e3ef7c5b
17 changed files with 502 additions and 192 deletions
@@ -49,13 +49,13 @@ in
        access_control = {
          default_policy = "deny";
          rules = [
-            # {
-            #   domain = "radarr.shobu.fr";
-            #   policy = "bypass";
-            # }
+            {
+              domain = "auth.shobu.fr";
+              policy = "bypass";
+            }
            {
              domain = "*.shobu.fr";
-              policy = "one_factor";
+              policy = "two_factor";
            }
          ];
        };
@@ -68,6 +68,75 @@ in
            };
          };
        };
+        identity_providers = {
+          oidc = {
+            hmac_secret = "this_is_a_secret_abc123abc123abc"; # 64+ character secret
+            jwks = [
+              {
+                key = ''
+                  -----BEGIN PRIVATE KEY-----
+                  MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDBGxQpgV074AB1
+                  ee+JiDMxuiVooVuD8RzVISTy0tVNBFS5vydB1g5k072shMdCE8S2M4oTaW7ZG1h0
+                  A+XbgZj+wZFcdHA+lD6QRGSN03FlrRZBMv8BCKzctdgAW1Dtrho31+Nw+3jTrrbO
+                  DiQaH2kzanET0GZJ+cD3AngWYV0KCkq8yws3T8AiK4oNghyv6Amknmbf7sJ+aZ8C
+                  f8WCixiErT/TjEGKRxFTKw3LMrdrbljE8JP+f1sTpDZP6uOtH0YS0iJ4nWHvxKYH
+                  LHLzrx3rO0zBrPiXK3eAtP2baPxS5y26kJcVL5bUSbDdB3NCznZc50OO14huX2s+
+                  GVct0FsLAgMBAAECggEAAUoZTy91wXa5gn8EzQVWzj9YfJDv2Pn4/hjLmRNHFADQ
+                  gmtXfhNJiHte7qqdjB1ag8TgOcHd8oyRFmcgCs3BaL68uwEdtq/hT4FXvF37EKW+
+                  q/PyS38XNMWBIpfD+tmYGJHfzp2HsuPCz5tbSzG5qioZvMNHd4FtRXj6cGntjRAg
+                  uW1Ns2h//BajftwD8RLHOvq7lWLaPWbdbte396KNBdNpceargISf9VEJik/dPWrT
+                  jV5bNAm7chvEfjhLqFCJ/p6j7z4DLFGrhYnh50btfe9FnWRtUYAGxhfaobveDPVe
+                  AI0lFN7IFU6+G6cYHTZAtAviWIutDwK0K9ACYCo1wQKBgQDiWEIdoYvjAh2J9K8f
+                  8YWa660YuvLSYQmvimr7E9FzoFdiUeFqlVCw/SIz7mRuDDCliDFxheekc8+jJB5U
+                  kfR2C2o3llRy+wLVap6X5OmqVAjFuHXxntbK/zwyv4K5uecwtEgDyGdXW2eZDog7
+                  VohuWOD3cTDAkVFu/Mw/02/CqwKBgQDaZ/b1Rfu9QXLvgtf23PpqKb0VG6gOo/Sm
+                  bpGnEBG9sAnsvDHBs85UTxzzr0qWOSguDh5NMxd0/IxKiLDRPvshhod9rWw0T8Qh
+                  jBDYsDLBZlBT1AVKvkeELZx9DW1Iomx6bdtYRX3SkgBKVK43q17J3T37U/UJ36PQ
+                  5e1lBbDJIQKBgQDcEcP222MPTLc7stOy0zl77zlVmi8NrZulOYfapuI28ecEiWgK
+                  ITNbYkMnCtpKxT9nMowgPHmEw7VWgX+b6m0teNvFQDzLrpKKvieEt+UY3qvI0hia
+                  3D0rEg6NqPaJbd8C08ZRJ0CTByQrBJ4gU3pDD9drvnoQQTpUFybfx8waEQKBgQDL
+                  6a1FKuXyuRyaSktgjMiwPe/vuTabFLDigvEyTWqC880QXlUGSN4nEQYy7kJxJ0RA
+                  W6Ym5cDM1M4W+LA9bNQDZRszV6ti2+Z+e8tuxHNe5iuxWI7oTedvnTYx+0tBOYSW
+                  eeME8zyaUP48Z/uQtkt1pT6tXKG3ajoEW+fdHgcEgQKBgCCTnBkASe21/n+D3c02
+                  vGekM3ioWNe9heIWv/7aWmMXb14DBCZMVXNyfOe7gQs2u3OX+IBW8UscGhY2LjVV
+                  5dKLMIWHw8Afccw4isYhequmJeai2Q3SSenWc7lIqOG4FDpwkcjW0VBBaU/p7ZnA
+                  h3JJ7q49hdgOKpF/xZNwmmfI
+                  -----END PRIVATE KEY-----''; # rsa private key
+              }
+            ];
+            claims_policies = {
+              trilium = {
+                id_token = [
+                  "email"
+                  "name"
+                ];
+              };
+            };
+            clients = [
+              {
+                client_id = "trilium";
+                client_name = "Trilium Notes";
+                client_secret = "$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng";
+                public = false;
+                authorization_policy = "two_factor";
+                claims_policy = "trilium";
+                require_pkce = false;
+                pkce_challenge_method = "";
+                redirect_uris = [ "https://trilium.shobu.fr/callback" ];
+                scopes = [
+                  "openid"
+                  "profile"
+                  "email"
+                ];
+                response_types = [ "code" ];
+                grant_types = [ "authorization_code" ];
+                access_token_signed_response_alg = "none";
+                userinfo_signed_response_alg = "none";
+                token_endpoint_auth_method = "client_secret_basic";
+              }
+            ];
+          };
+        };
      };
    };
  };
@@ -17,10 +17,11 @@ in
  imports = [
    ./nginx.nix
    # ./cybercoffee
-    ./ollama.nix
-    ./minecraft.nix
+    # ./ollama.nix
+    # ./minecraft.nix
    ./secrets
    ./authelia.nix
+    ./glances.nix
  ];

  # Use the systemd-boot EFI boot loader.
@@ -39,6 +40,7 @@ in
    firewall = {
      allowedTCPPorts = [
        nodes.sin.config.services.gitea.settings.server.SSH_PORT
+        993 # mail port
      ]
      ++ [
        # minecraft ad hoc server ports
@@ -57,6 +59,16 @@ in
          proto = "tcp";
          destination = "${sin-address}:22";
        }
+        {
+          sourcePort = 993;
+          proto = "tcp";
+          destination = "${sin-address}:993";
+        }
+        {
+          sourcePort = 8086;
+          proto = "tcp";
+          destination = "${sin-address}:8086";
+        }
      ];
    };
  };
@@ -87,13 +99,11 @@ in
  };

  environment.systemPackages = with pkgs; [
-    lunarvim
    wget
    httpie
    tmux
    git
    helix
-    python312
    # lemonade
  ];

@@ -0,0 +1,14 @@
+{ ... }:
+{
+  services.glances = {
+    enable = true;
+    openFirewall = true;
+    # TODO Change secrets
+    extraArgs = [
+      "--webserver"
+      "--disable-webui"
+      "--disable-plugin"
+      "processcount"
+    ];
+  };
+}
@@ -9,10 +9,6 @@ let
    url = "file:///${inputs.testing-grounds.modpack}/pack.toml";
    packHash = "sha256-+taYj4uroLNxM4Nia3n+5P1Y/g6dzE6Iq13TsZgk4mU=";
  };
-  gregpack = pkgs.fetchPackwizModpack {
-    url = "https://raw.githubusercontent.com/GregTechCEu/GregTech-Modern-Community-Pack/refs/heads/main/pack.toml";
-    packHash = "sha256-SE86gP15H/Aug6vTLmMxHuxF2/+iLmCI/wQlON1xasM=";
-  };
 in
 {
  imports = [ inputs.nix-minecraft.nixosModules.minecraft-servers ];
@@ -24,7 +20,7 @@ in
    openFirewall = true;

    servers.testing-grounds = {
-      enable = true;
+      enable = false;

      package = inputs.testing-grounds.packages.x86_64-linux.forge-server;

@@ -2,6 +2,7 @@
  inputs,
  pkgs,
  lib,
+  nodes,
  ...
 }:
 let
@@ -34,7 +35,7 @@ in
            forceSSL = true;

            locations."/" = {
-              proxyPass = "http://${sin-address}:${port}";
+              proxyPass = "http://${sin-address}:${toString port}";
            };
          };
        };
@@ -106,9 +107,10 @@ in
        // mkStarr "lidarr.shobu.fr" "8686"
        // mkStarr "whisparr.shobu.fr" "6969"
        // mkVHost "jellyseerr.shobu.fr" "5055"
-        // mkVHost "transmission.shobu.fr" "9091"
-        // mkVHost "zimablade-admin.shobu.fr" "61208"
-        // (withWebsockets (withAuthelia (mkVHost "trilium.shobu.fr" "12783") "/") "/")
+        // withAuthelia (mkVHost "transmission.shobu.fr" "9091") "/"
+        // withAuthelia (mkVHost "zimablade-admin.shobu.fr" "61208") "/"
+        // withAuthelia (mkVHost "actual.shobu.fr" nodes.sin.config.services.actual.settings.port) "/"
+        // (withWebsockets (mkVHost "trilium.shobu.fr" "12783") "/")
        // {
          "shobu.fr" = {
            enableACME = true;
@@ -165,6 +167,9 @@ in

            locations."/" = {
              proxyPass = "http://${sin-address}:3000";
+              extraConfig = ''
+                client_max_body_size 100M;
+              '';
            };
          };
          "files.shobu.fr" = {