luks

flake.lock

@@ -49,11 +49,11 @@
         "nixpkgs": "nixpkgs_3"
       },
       "locked": {
-        "lastModified": 1768336726,
+        "lastModified": 1767637959,
-        "narHash": "sha256-Os4qn0S0bv7MauXGz16ozyOYZuMrA2FJuXNjDnr5yps=",
+        "narHash": "sha256-+gBU5Cj9QNpHLQ5PHJoWNQft7TMsBM6X+tDQg+/B2P0=",
         "owner": "9001",
         "repo": "copyparty",
-        "rev": "c46cd7f57a8ae3b121866485c91ec078c4dd970e",
+        "rev": "038af507772593b904b5c3efc306f89cbdf2b6fb",
         "type": "github"
       },
       "original": {
@@ -136,6 +136,22 @@
         "type": "github"
       }
     },
+    "flake-compat_3": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1747046372,
+        "narHash": "sha256-CIVLLkVgvHYbgI2UpXvIIBJ12HWgX+fjA8Xf8PUmqCY=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "9100a0f413b0c601e0533d1d94ffd501ce2e7885",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
     "flake-utils": {
       "locked": {
         "lastModified": 1659877975,
@@ -184,6 +200,24 @@
         "type": "github"
       }
     },
+    "flake-utils_4": {
+      "inputs": {
+        "systems": "systems_3"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
     "home-manager": {
       "inputs": {
         "nixpkgs": [
@@ -233,11 +267,31 @@
         "nixpkgs": "nixpkgs_4"
       },
       "locked": {
-        "lastModified": 1767838769,
+        "lastModified": 1767147099,
-        "narHash": "sha256-KCLU6SUU80tEBKIVZsBrSjRYX6kn1eVIYI3fEEqOp24=",
+        "narHash": "sha256-395ehjdAtaqCbKmx+PhKAqnkYLvTtAzq2qzFG9qaGDw=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "4da21f019f6443f513f16af7f220ba4db1cdfc04",
+        "rev": "01f571579edd64433f97c4294137fbc366deef4b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Infinidoge",
+        "repo": "nix-minecraft",
+        "type": "github"
+      }
+    },
+    "nix-minecraft_2": {
+      "inputs": {
+        "flake-compat": "flake-compat_3",
+        "flake-utils": "flake-utils_4",
+        "nixpkgs": "nixpkgs_6"
+      },
+      "locked": {
+        "lastModified": 1767147099,
+        "narHash": "sha256-395ehjdAtaqCbKmx+PhKAqnkYLvTtAzq2qzFG9qaGDw=",
+        "owner": "Infinidoge",
+        "repo": "nix-minecraft",
+        "rev": "01f571579edd64433f97c4294137fbc366deef4b",
         "type": "github"
       },
       "original": {
@@ -326,6 +380,36 @@
       }
     },
     "nixpkgs_6": {
+      "locked": {
+        "lastModified": 1748929857,
+        "narHash": "sha256-lcZQ8RhsmhsK8u7LIFsJhsLh/pzR9yZ8yqpTzyGdj+Q=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "c2a03962b8e24e669fb37b7df10e7c79531ff1a4",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_7": {
+      "locked": {
+        "lastModified": 1767364772,
+        "narHash": "sha256-fFUnEYMla8b7UKjijLnMe+oVFOz6HjijGGNS1l7dYaQ=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "16c7794d0a28b5a37904d55bcca36003b9109aaa",
+        "type": "github"
+      },
+      "original": {
+        "id": "nixpkgs",
+        "type": "indirect"
+      }
+    },
+    "nixpkgs_8": {
       "locked": {
         "lastModified": 1737062831,
         "narHash": "sha256-Tbk1MZbtV2s5aG+iM99U8FqwxU/YNArMcWAv6clcsBc=",
@@ -339,7 +423,7 @@
         "url": "https://flakehub.com/f/NixOS/nixpkgs/0.1.%2A.tar.gz"
       }
     },
-    "nixpkgs_7": {
+    "nixpkgs_9": {
       "locked": {
         "lastModified": 1736549401,
         "narHash": "sha256-ibkQrMHxF/7TqAYcQE+tOnIsSEzXmMegzyBWza6uHKM=",
@@ -355,6 +439,26 @@
         "type": "github"
       }
     },
+    "reclamation": {
+      "inputs": {
+        "nix-minecraft": "nix-minecraft_2",
+        "nixpkgs": "nixpkgs_7",
+        "utils": "utils"
+      },
+      "locked": {
+        "lastModified": 1767786101,
+        "narHash": "sha256-ENlpYr2V5u0/Enq07nIHfzetqmS95aydQYIM6sISVUc=",
+        "ref": "refs/heads/master",
+        "rev": "b71acff364b7b5eb3e1b68915aeb379053b86c94",
+        "revCount": 10,
+        "type": "git",
+        "url": "https://git.shobu.fr/sin_serhao/reclamation"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://git.shobu.fr/sin_serhao/reclamation"
+      }
+    },
     "root": {
       "inputs": {
         "agenix": "agenix",
@@ -363,6 +467,7 @@
         "disko": "disko",
         "nix-minecraft": "nix-minecraft",
         "nixpkgs": "nixpkgs_5",
+        "reclamation": "reclamation",
         "shoblog-front": "shoblog-front",
         "testing-grounds": "testing-grounds",
         "unstable": "unstable"
@@ -370,7 +475,7 @@
     },
     "shoblog-front": {
       "inputs": {
-        "nixpkgs": "nixpkgs_6"
+        "nixpkgs": "nixpkgs_8"
       },
       "locked": {
         "lastModified": 1752594581,
@@ -432,9 +537,39 @@
         "type": "github"
       }
     },
+    "systems_3": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_4": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
     "testing-grounds": {
       "inputs": {
-        "nixpkgs": "nixpkgs_7"
+        "nixpkgs": "nixpkgs_9"
       },
       "locked": {
         "lastModified": 1755527993,
@@ -452,11 +587,11 @@
     },
     "unstable": {
       "locked": {
-        "lastModified": 1768127708,
+        "lastModified": 1767640445,
-        "narHash": "sha256-1Sm77VfZh3mU0F5OqKABNLWxOuDeHIlcFjsXeeiPazs=",
+        "narHash": "sha256-UWYqmD7JFBEDBHWYcqE6s6c77pWdcU/i+bwD6XxMb8A=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "ffbc9f8cbaacfb331b6017d5a5abb21a492c9a38",
+        "rev": "9f0c42f8bc7151b8e7e5840fb3bd454ad850d8c5",
         "type": "github"
       },
       "original": {
@@ -465,6 +600,24 @@
         "repo": "nixpkgs",
         "type": "github"
       }
+    },
+    "utils": {
+      "inputs": {
+        "systems": "systems_4"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
     }
   },
   "root": "root",

flake.nix

@@ -17,7 +17,10 @@
     # sin inputs
     nix-minecraft.url = "github:Infinidoge/nix-minecraft";
     testing-grounds.url = "gitlab:shobu13/testing-grounds";
+    reclamation.url = "git+https://git.shobu.fr/sin_serhao/reclamation";
     shoblog-front.url = "gitlab:shobu13/shoblog";
+    # striped-front.url = "git+ssh://git@gitlab.com/striped1/striped-front";
+    # striped-back.url = "git+ssh://git@gitlab.com/striped1/striped-back";
 
     copyparty.url = "github:9001/copyparty";
 
@@ -41,6 +44,7 @@
       # striped-back,
       nix-minecraft,
       testing-grounds,
+      reclamation,
       copyparty,
       ...
     }:
@@ -63,22 +67,22 @@
     {
       nixosConfigurations = {
         sin = nixpkgs.lib.nixosSystem {
-          system = "x86_64-linux";
+           system = "x86_64-linux";
-
+          
-          modules = [
+           modules = [
-            disko.nixosModules.disko
+              disko.nixosModules.disko
-            agenix.nixosModules.default
+              agenix.nixosModules.default
-            ./hosts/sin/configuration.nix
+              ./hosts/sin/configuration.nix
-            ./hosts/sin/hardware-configuration.nix
+              ./hosts/sin/hardware-configuration.nix
-          ]
+            ]
-          ++ [
+            ++ [
-            # modules
+              # modules
-            ./modules/gitea/sin
+              ./modules/gitea/sin
-          ];
+            ];
-
+            
-          specialArgs = {
+            specialArgs = {
-            inherit inputs;
+             inherit inputs;
-          };
+           };
         };
       };
       colmenaHive = colmena.lib.makeHive {

hosts/sin/configuration.nix

@@ -17,7 +17,6 @@
     ./secrets.nix
     ./coredns
     ./copyparty.nix
-    # ./trilium.nix
   ];
 
   boot.initrd.kernelModules = [ "usb_storage" ];

hosts/sin/copyparty.nix

@@ -27,48 +27,11 @@
       shr = "/shares";
     };
 
-    accounts = {
-      serhao = {
-        passwordFile = config.age.secrets.copyparty-serhao.path;
-      };
-    };
-
     volumes = {
-      "/movies" = {
+      "/media" = {
-        path = "/mnt/mediacenter/media/movies";
-        access = {
-          r = "*";
-        };
-      };
-      "/shows" = {
-        path = "/mnt/mediacenter/media/shows";
-        access = {
-          r = "*";
-        };
-      };
-
-      "/musics" = {
-        path = "/mnt/mediacenter/media/musics";
-        access = {
-          r = "*";
-        };
-      };
-      "/mediacenter" = {
         path = "/mnt/mediacenter/media";
         access = {
-          rw = ["serhao"];
+          r = "*";
-        };
-        flags = {
-          e2d = true;
-        };
-      };
-      "/data" = {
-        path = "/mnt/data";
-        access = {
-          rwd = ["serhao"];
-        };
-        flags = {
-          e2d = true;
         };
       };
     };

hosts/sin/homepage.nix

@@ -122,7 +122,7 @@
               description = "bring back your world to life";
               widget = {
                 type = "minecraft";
-                url = "udp://minecraft.shobu.fr:25665";
+                url = "udp://minecraft.shobu.fr:43001";
               };
             };
           }

hosts/sin/jellyfin.nix

@@ -54,12 +54,6 @@ in
     "transmission"
   ];
 
-  users.users.whisparr.extraGroups = [
-    "jellyfin"
-    "starr"
-    "transmission"
-  ];
-
   users.users.shobu.extraGroups = [
     "jellyfin"
     "starr"
@@ -82,10 +76,6 @@ in
       enable = true;
       openFirewall = true;
       group = "starr";
-      settings = {
-        authentication.AuthenticationMethod = "external";
-        authentication.AuthenticationType = "enabled";
-      };
     };
     radarr = {
       enable = true;
@@ -103,10 +93,7 @@ in
     lidarr = {
       enable = true;
       openFirewall = true;
-    };
+      package = unstable.lidarr;
-    whisparr = {
-      enable = true;
-      openFirewall = true;
     };
 
     jellyseerr = {

hosts/sin/luks-btrfs-raid.nix

@@ -7,7 +7,7 @@
       # and the actual btrfs raid on the second disk, and the name of these entries matters!
       system = {
         type = "disk";
-        device = "/dev/sdb";
+        device = "/dev/mmcblk0";
         content = {
           type = "gpt";
           partitions = {
@@ -42,10 +42,6 @@
                     "/root" = {
                       mountpoint = "/";
                     };
-                    "/nix" = {
-                      mountpoint = "/nix";
-                      mountOptions = [ "compress=zstd:3" ];
-                    };
                   };
                 };
               };
@@ -78,6 +74,10 @@
                       mountpoint = "/mnt/fs";
                       mountOptions = [ "compress=zstd:3" ];
                     };
+                    "/nix" = {
+                      mountpoint = "/nix";
+                      mountOptions = [ "compress=zstd:3" ];
+                    };
 
                     "/data" = {
                       mountpoint = "/mnt/data";

hosts/sin/secrets.nix

@@ -10,22 +10,5 @@
       file = ./secrets/airvpn_wireguard_key_env.age;
       mode = "700";
     };
-    copyparty-serhao = {
-      file = ./secrets/copyparty-serhao.age;
-      mode = "700";
-      owner = "copyparty";
-    };
-    authelia-jwt = {
-      file = ./secrets/authelia-jwt.age;
-      mode = "700";
-    };
-    authelia-encryption = {
-      file = ./secrets/authelia-encryption.age;
-      mode = "700";
-    };
-    authelia-session = {
-      file = ./secrets/authelia-session.age;
-      mode = "700";
-    };
   };
 }

hosts/sin/secrets/authelia-encryption.age

@@ -1,7 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 /uqj4A L95rgX9APIgoMvkplZIYgMQDhKBOsPGOw/maymMhiks
-LNfa/YBCd84iknAMk4wbQps4KMXCvrhPp2d9KkhJWHI
--> ssh-ed25519 NoSl6Q G/y6DUFTyV6Jy6KHo8yc+xxtu3aJtTOF3Ldmxq3FmyE
-FOExj321S/VIPQ/qdvZBcJ930HI/GsjDVjJp9WMSXLA
---- iIpq/CWng+4+kQbvJQb/qgejr/eza94wCkegEJ2dvno
-ÿNôU*1=DÔOˆ£W6]_â©Kà=©*ÊÞký¦_ù˜Ýøɇ™tmË•ãw°

hosts/sin/secrets/authelia-jwt.age

@@ -1,7 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 /uqj4A i6SPCzjkGrPMjhC9NQDdYTk3fzXoD4OSQdhS1togN0A
-Lqus8sROz1O4EepauPwC4RX/qH+SnDiL2H5iZGtAhXo
--> ssh-ed25519 NoSl6Q LxV4a5HiB6qfPjbba75dkVVECzaqrMjksMXHh53JbGQ
-x4POzurz+J2mymT81M+cu69Iv/MeiYt+JvaRteinm5Q
---- OFqooyZ2HPBxP756PqpgJAyVOTkqhJ0LhEQsLJBZUtE
-—>»&Ȇw·\D„Au{õz{CˆÁ~á$‘_ˆ9»¢ZZ<5A>U^„ÎÊL!(lnпÂó‰Üv{fdº 1Ýßl
¢,<2C>|<7C>Ü.¤çH«¤³êVaù¥ÍÓˆ™PêwOo3ž

hosts/sin/secrets/authelia-session.age

@@ -1,7 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 /uqj4A eff535EaT7gEZOacWx9raBJMdd4PPd9+y6Y3eOt1wBI
-5P4aefjWVJ4L11ff+Cg8j3gQ58I+agDPUMFWiCaL/sQ
--> ssh-ed25519 NoSl6Q 3+EZtaiiZQk7JK6zCNo/nUSSRAJzf8nal2X1sFkYmxo
-f5gzpiOtCbYdiV7vOxfZvJPRmRruTbHg6T8g0r5JRgc
---- BBL3wE2eSmHVI4tlhq+5fy84cauw6P6G69nFXuObLKE
-êéæí	@[¡SÓcñ‘<C3B1>SyÉŠ‡<; í†<C3AD>e±Ë茟<C592><C5B8>§(°Æž1\Yj›È¯½½4åõ Ý
ȹ.3>Â[Èq¢Jh8í·šÕVt”øX[Ì~[(#
^‘_5€§<E282AC>

hosts/sin/secrets/copyparty-serhao.age

@@ -1,7 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 BoEq8A O6x9n4kvpqLucX7NuNeD2SsMmvT5n6aVYwo4nQt21H8
-R+4g1QuXtxovyv5Mav+mAhgGjOcGQW4q17FSBtzXZQo
--> ssh-ed25519 NoSl6Q iKPipXfIGWxUobXF/9CSRhc/zKgmKKWWZhDTDgX0jWA
-LB4TFCdbEG0VToYzTWdFedd0duF5PKlCnpBs4nBbLAQ
---- D7VE3Mwgx9ehk5rNuHm62S5ggQBm9wJodZa61jLEVsY
-8ÔîÐÄÒë`S«šéT¯Fª9&(½Ú²Á‡¸=~Ïáš­où».XŽ¶ž7ðV&'Øøå ÒÔ¸‹%ã î

hosts/sin/trilium.nix

@@ -1 +0,0 @@
-{ ... }: { }

hosts/thea/authelia.nix

@@ -1,126 +0,0 @@
-{
-  pkgs,
-  config,
-  lib,
-  ...
-}:
-let
-  cfg = config.services.authelia.instances.main;
-  dataDir = "/var/lib/authelia-${cfg.name}";
-  authelia-snippets = pkgs.callPackage ./lib/autheliaSnippets.nix { inherit pkgs; };
-in
-{
-  services.authelia.instances = {
-    main = {
-      enable = true;
-      secrets = {
-        jwtSecretFile = config.age.secrets.authelia-jwt.path;
-        storageEncryptionKeyFile = config.age.secrets.authelia-encryption.path;
-        sessionSecretFile = config.age.secrets.authelia-session.path;
-      };
-      settings = {
-        theme = "light";
-        log.level = "debug";
-
-        authentication_backend = {
-          file = {
-            path = dataDir + "/users.yml";
-          };
-        };
-        storage = {
-          local = {
-            path = dataDir + "/db.sqlite3";
-          };
-        };
-        session = {
-          cookies = [
-            {
-              domain = "shobu.fr";
-              authelia_url = "https://auth.shobu.fr";
-              default_redirection_url = "https://shobu.fr";
-            }
-          ];
-        };
-        notifier = {
-          filesystem = {
-            filename = "${dataDir}/notification.txt";
-          };
-        };
-        access_control = {
-          default_policy = "deny";
-          rules = [
-            {
-              domain = "radarr.shobu.fr";
-              policy = "bypass";
-            }
-            {
-              domain = "*.shobu.fr";
-              policy = "one_factor";
-            }
-          ];
-        };
-        server = {
-          endpoints = {
-            authz = {
-              auth-request = {
-                implementation = "AuthRequest";
-              };
-            };
-          };
-        };
-      };
-    };
-  };
-
-  # systemd.tmpfiles.rules = lib.mkIf cfg.enable [
-  #   "d '${dataDir}' 0700 ${cfg.user} ${cfg.group} - -"
-  # ];
-
-  age.secrets = {
-    authelia-jwt = {
-      owner = cfg.user;
-      file = ./secrets/authelia-jwt.age;
-      mode = "700";
-    };
-    authelia-encryption = {
-      owner = cfg.user;
-      file = ./secrets/authelia-encryption.age;
-      mode = "700";
-    };
-    authelia-session = {
-      owner = cfg.user;
-      file = ./secrets/authelia-session.age;
-      mode = "700";
-    };
-  };
-
-  services.nginx = {
-    enable = true;
-    recommendedProxySettings = true;
-    recommendedTlsSettings = true;
-
-    virtualHosts."auth.shobu.fr" =
-      let
-        upstream = "http://thea:9091";
-      in
-      {
-        enableACME = true;
-        forceSSL = true;
-
-        locations."/" = {
-          proxyPass = upstream;
-          extraConfig = ''
-            error_log /var/log/nginx/debug_authelia.log debug;
-            include ${authelia-snippets.proxy};
-            set $upstream ${upstream};
-          '';
-        };
-        locations."/api/verify" = {
-          proxyPass = upstream;
-        };
-        locations."/api/authz" = {
-          proxyPass = upstream;
-        };
-      };
-  };
-}

hosts/thea/configuration.nix

@@ -16,11 +16,11 @@ in
 {
   imports = [
     ./nginx.nix
+    # ./striped
     # ./cybercoffee
     ./ollama.nix
     ./minecraft.nix
-    ./secrets
+    ./nix-serve.nix
-    ./authelia.nix
   ];
 
   # Use the systemd-boot EFI boot loader.
@@ -37,14 +37,7 @@ in
     # dhcpcd.extraConfig = "nohook resolv.conf";
 
     firewall = {
-      allowedTCPPorts = [
+      allowedTCPPorts = [ nodes.sin.config.services.gitea.settings.server.SSH_PORT ];
-        nodes.sin.config.services.gitea.settings.server.SSH_PORT
-      ]
-      ++ [
-        # minecraft ad hoc server ports
-        25665
-        25675
-      ];
     };
     nat = {
       enable = true;

hosts/thea/lib/autheliaSnippets.nix

@@ -1,81 +0,0 @@
-{ pkgs }:
-{
-  proxy = pkgs.writeText "proxy.conf" ''
-    ## Headers
-    proxy_set_header Host $host;
-    proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
-    proxy_set_header X-Forwarded-Proto $scheme;
-    proxy_set_header X-Forwarded-Host $http_host;
-    proxy_set_header X-Forwarded-URI $request_uri;
-    proxy_set_header X-Forwarded-Ssl on;
-    proxy_set_header X-Forwarded-For $remote_addr;
-  '';
-  authelia-location = pkgs.writeText "authelia-location.conf" ''
-    set $upstream_authelia http://192.168.1.12:9091/api/authz/auth-request;
-
-    ## Virtual endpoint created by nginx to forward auth requests.
-    location /internal/authelia/authz {
-        ## Essential Proxy Configuration
-        internal;
-        proxy_pass $upstream_authelia;
-
-        ## Headers
-        ## The headers starting with X-* are required.
-        proxy_set_header X-Original-Method $request_method;
-        proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
-        proxy_set_header X-Forwarded-For $remote_addr;
-        proxy_set_header Content-Length "";
-        proxy_set_header Connection "";
-
-        ## Basic Proxy Configuration
-        proxy_pass_request_body off;
-        proxy_next_upstream error timeout invalid_header http_500 http_502 http_503; # Timeout if the real server is dead
-        proxy_redirect http:// $scheme://;
-        proxy_http_version 1.1;
-        proxy_cache_bypass $cookie_session;
-        proxy_no_cache $cookie_session;
-        proxy_buffers 4 32k;
-        client_body_buffer_size 128k;
-
-        ## Advanced Proxy Configuration
-        send_timeout 5m;
-        proxy_read_timeout 240;
-        proxy_send_timeout 240;
-        proxy_connect_timeout 240;
-    }
-  '';
-  authelia-authrequest = pkgs.writeText "authelia-authrequest.conf" ''
-    ## Send a subrequest to Authelia to verify if the user is authenticated and has permission to access the resource.
-    auth_request /internal/authelia/authz;
-
-    ## Save the upstream metadata response headers from Authelia to variables.
-    auth_request_set $user $upstream_http_remote_user;
-    auth_request_set $groups $upstream_http_remote_groups;
-    auth_request_set $name $upstream_http_remote_name;
-    auth_request_set $email $upstream_http_remote_email;
-
-    ## Inject the metadata response headers from the variables into the request made to the backend.
-    proxy_set_header Remote-User $user;
-    proxy_set_header Remote-Groups $groups;
-    proxy_set_header Remote-Email $email;
-    proxy_set_header Remote-Name $name;
-
-    ## Configure the redirection when the authz failure occurs. Lines starting with 'Modern Method' and 'Legacy Method'
-    ## should be commented / uncommented as pairs. The modern method uses the session cookies configuration's authelia_url
-    ## value to determine the redirection URL here. It's much simpler and compatible with the mutli-cookie domain easily.
-
-    ## Modern Method: Set the $redirection_url to the Location header of the response to the Authz endpoint.
-    auth_request_set $redirection_url $upstream_http_location;
-
-    ## Modern Method: When there is a 401 response code from the authz endpoint redirect to the $redirection_url.
-    error_page 401 =302 $redirection_url;
-
-    ## Legacy Method: Set $target_url to the original requested URL.
-    ## This requires http_set_misc module, replace 'set_escape_uri' with 'set' if you don't have this module.
-    # set_escape_uri $target_url $scheme://$http_host$request_uri;
-
-    ## Legacy Method: When there is a 401 response code from the authz endpoint redirect to the portal with the 'rd'
-    ## URL parameter set to $target_url. This requires users update 'auth.shobu.fr/' with their external authelia URL.
-    # error_page 401 =302 https://auth.shobu.fr/?rd=$target_url;
-  '';
-}

hosts/thea/minecraft.nix

@@ -9,10 +9,7 @@ let
     url = "file:///${inputs.testing-grounds.modpack}/pack.toml";
     packHash = "sha256-+taYj4uroLNxM4Nia3n+5P1Y/g6dzE6Iq13TsZgk4mU=";
   };
-  gregpack = pkgs.fetchPackwizModpack {
+  reclamation = inputs.reclamation.packages.${pkgs.stdenv.system};
-    url = "https://raw.githubusercontent.com/GregTechCEu/GregTech-Modern-Community-Pack/refs/heads/main/pack.toml";
-    packHash = "sha256-SE86gP15H/Aug6vTLmMxHuxF2/+iLmCI/wQlON1xasM=";
-  };
 in
 {
   imports = [ inputs.nix-minecraft.nixosModules.minecraft-servers ];
@@ -23,6 +20,28 @@ in
     eula = true;
     openFirewall = true;
 
+    servers.reclamation = {
+      enable = false;
+      package = pkgs.fabricServers.fabric;
+
+      symlinks = {
+        "mods" = "${reclamation.modpack}/mods";
+        "FTBLang" = "${reclamation.modpack}/FTBLang";
+        "defaultconfigs" = "${reclamation.modpack}/defaultconfigs";
+        "ressourcepacks" = "${reclamation.modpack}/ressourcepacks";
+        "config" = "${reclamation.modpack}/config";
+        "kubejs" = "${reclamation.modpack}/kubejs";
+        "patchouli_books" = "${reclamation.modpack}/patchouli_books";
+        "server.dat" = "${reclamation.modpack}/server.dat";
+      };
+
+      serverProperties = {
+        server-port = 43001;
+        motd = "all hail the gorgon v3.14";
+        allow-flight = true;
+      };
+    };
+
     servers.testing-grounds = {
       enable = true;
 
@@ -39,10 +58,4 @@ in
       };
     };
   };
-
-  networking.firewall.allowedTCPPorts = [
-    25865 # autismcraft
-    25665 # reclamation
-    25675 # reclamation
-  ];
 }

hosts/thea/nginx.nix

@@ -1,9 +1,8 @@
-{ inputs, pkgs, ... }:
+{ inputs, ... }:
 let
   # striped-front = inputs.striped-front;
 
   sin-address = "192.168.1.14";
-  authelia-snippets = pkgs.callPackage ./lib/autheliaSnippets.nix { inherit pkgs; };
 in
 {
 
@@ -38,61 +37,16 @@ in
       in
       (
         mkStarr "jellyfin.shobu.fr" "8096"
-        # // mkStarr "radarr.shobu.fr" "7878"
+        // mkStarr "radarr.shobu.fr" "7878"
         // mkStarr "sonarr.shobu.fr" "8989"
         // mkStarr "prowlarr.shobu.fr" "9696"
         // mkStarr "bazarr.shobu.fr" "6767"
-        // mkStarr "lidarr.shobu.fr" "8686"
-        // mkStarr "whisparr.shobu.fr" "6969"
         // mkStarr "jellyseerr.shobu.fr" "5055"
+        // mkStarr "fileshelter.shobu.fr" "5091"
+        // mkStarr "lidarr.shobu.fr" "8686"
         // mkStarr "transmission.shobu.fr" "9091"
         // mkStarr "zimablade-admin.shobu.fr" "61208"
         // {
-          "radarr.shobu.fr" = {
-            enableACME = true;
-            forceSSL = true;
-
-            extraConfig = ''
-              include ${authelia-snippets.authelia-location};
-              error_log /var/log/nginx/debug_radarr.log debug;
-            '';
-
-            locations."/" = {
-              proxyPass = "http://${sin-address}:7878";
-              proxyWebsockets = true;
-              extraConfig = ''
-                include ${authelia-snippets.proxy};
-                include ${authelia-snippets.authelia-authrequest};
-
-                proxy_set_header Upgrade $http_upgrade;
-                proxy_set_header Connection "upgrade";
-
-                # From https://gist.github.com/R0GGER/916183fca41f02df1471a6f455e5869f
-                # HSTS (ngx_http_headers_module is required) (63072000 seconds = 2 years)
-                add_header Strict-Transport-Security "max-age=63072000; preload" always;
-                add_header Referrer-Policy strict-origin-when-cross-origin; 
-                add_header X-Content-Type-Options nosniff;
-                add_header X-XSS-Protection "1; mode=block";
-                add_header X-Frame-Options SAMEORIGIN;
-                add_header Content-Security-Policy upgrade-insecure-requests;
-                add_header Permissions-Policy interest-cohort=();
-                add_header Expect-CT 'enforce; max-age=604800';
-                more_set_headers 'Server: Proxy';
-                more_clear_headers 'X-Powered-By';
-
-                proxy_ssl_server_name on;
-              '';
-            };
-
-            locations."/api" = {
-              proxyPass = "http://${sin-address}:7878";
-              proxyWebsockets = true;
-              extraConfig = ''
-                proxy_ssl_server_name on;
-              '';
-            };
-
-          };
           "shobu.fr" = {
             enableACME = true;
             forceSSL = true;
@@ -154,18 +108,10 @@ in
             enableACME = true;
             forceSSL = true;
 
-            extraConfig = ''
-              # include ${authelia-snippets.authelia-location};
-              # error_log /var/log/nginx/debug_files.log debug;
-            '';
-
             locations."/" = {
               proxyPass = "http://${sin-address}:8086";
               extraConfig = ''
-                # include ${authelia-snippets.proxy};
-                # include ${authelia-snippets.authelia-authrequest};
                 proxy_set_header X-Real-IP $remote_addr;
-                client_max_body_size 100M;
               '';
             };
           };

hosts/thea/secrets/authelia-encryption.age

@@ -1,10 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 /uqj4A 9cZH/SlDpiluz2O3wCxRcBhmt3L5eN24I0HHwiJDWRU
-VVZaJlB4QzxBPcaN3MjCemjptEbqSUMD8VVtKyGezH8
--> ssh-ed25519 70Re8Q ZFEQxmnm+dFKSXcQAc0KxkewCB59J5FyL1Ob/uEEtVg
-fRdEZpIytxjUeSKPieIzvZaAn5Mikjp28HlZhKwzS7M
--> ssh-ed25519 QvCxGg ifsqXBKO0mqE1RuJ44Y7qDJ7lyci8iyz+J1xFgO38jI
-MkhMTZ+RttBFFMkbIaSCSQiExR1gf4OyFWHXIsx+QYQ
---- nnMlLyQjixpBkx+bSU5I364IP3KnZ0qnmMPueBcRHpU
-ë˜<EFBFBD>6TX—ÕÞÌfÁ““É
-®?Z7M<37>T<EFBFBD>Å|ÚQf

hosts/thea/secrets/authelia-session.age

@@ -1,9 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 /uqj4A yxpGM3pJxfnM/5q9+NzdfG2kBjjNex6bdyUeZEBKjnI
-UO6ovn2cFeNi6SbcGpfF71/OAyQccyG+l6aZXubUal8
--> ssh-ed25519 70Re8Q GW40lmeg6Lj7ntZswT0/hWZFpYBWoV3CMq4pdo+Ncgc
-oWTYuM/s3G7EKPWPQpHbXo9Tpzgn7YlYVQHYGn4xKS8
--> ssh-ed25519 QvCxGg pKLpxtuMIa0xPXoaeb4WeQWVEINRE/j4nrxDB1J9BUI
-1azpt5MImTiDSF+Ts9EvUCdWMeVG7lErUHSBQfMiip4
---- IOOR8Us6zlZhJm0V4X3IlbkHSdtR3GLLxEfa4i+lqv0
-ó P¬¥rhé"BFãŽÌŸtÌ€ê¤{¾(öB`q“Óø"AµnN_ ™f*ÏŒºvPpj&{)ìŠØ@‹ÃkF«Ú
]<Aš*Á<>‡<EFBFBD>´WTm”ƪD‡,Ý1E­™”¦³eѨ·O¢š

hosts/thea/secrets/default.nix

@@ -1,3 +0,0 @@
-{ ... }:
-{
-}

modules/gitea/thea/virtualisation.nix

@@ -16,10 +16,6 @@
     };
   };
 
-  environment.systemPackages = with pkgs; [
-    podman-compose
-  ];
-
   virtualisation.oci-containers.containers =
     let
       runner_config = pkgs.writeTextFile {