test

flake.lock

@@ -21,6 +21,22 @@
         "type": "github"
       }
     },
+    "blobs": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1604995301,
+        "narHash": "sha256-wcLzgLec6SGJA8fx1OEN1yV/Py5b+U5iyYpksUY/yLw=",
+        "owner": "simple-nixos-mailserver",
+        "repo": "blobs",
+        "rev": "2cccdf1ca48316f2cfd1c9a0017e8de5a7156265",
+        "type": "gitlab"
+      },
+      "original": {
+        "owner": "simple-nixos-mailserver",
+        "repo": "blobs",
+        "type": "gitlab"
+      }
+    },
     "colmena": {
       "inputs": {
         "flake-compat": "flake-compat",
@@ -49,11 +65,11 @@
         "nixpkgs": "nixpkgs_3"
       },
       "locked": {
-        "lastModified": 1768336726,
-        "narHash": "sha256-Os4qn0S0bv7MauXGz16ozyOYZuMrA2FJuXNjDnr5yps=",
+        "lastModified": 1769889994,
+        "narHash": "sha256-uEn3WcpPHe3sMJMgIJ0XW3f4/+TRzZpNgv4vu5/gjmA=",
         "owner": "9001",
         "repo": "copyparty",
-        "rev": "c46cd7f57a8ae3b121866485c91ec078c4dd970e",
+        "rev": "9b436eb52e5cfe7a0a8e59dd9f1a37351f3a2abd",
         "type": "github"
       },
       "original": {
@@ -91,11 +107,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1766150702,
-        "narHash": "sha256-P0kM+5o+DKnB6raXgFEk3azw8Wqg5FL6wyl9jD+G5a4=",
+        "lastModified": 1769524058,
+        "narHash": "sha256-zygdD6X1PcVNR2PsyK4ptzrVEiAdbMqLos7utrMDEWE=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "916506443ecd0d0b4a0f4cf9d40a3c22ce39b378",
+        "rev": "71a3fc97d80881e91710fe721f1158d3b96ae14d",
         "type": "github"
       },
       "original": {
@@ -136,6 +152,22 @@
         "type": "github"
       }
     },
+    "flake-compat_3": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1761588595,
+        "narHash": "sha256-XKUZz9zewJNUj46b4AJdiRZJAvSZ0Dqj2BNfXvFlJC4=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "f387cd2afec9419c8ee37694406ca490c3f34ee5",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
     "flake-utils": {
       "locked": {
         "lastModified": 1659877975,
@@ -166,21 +198,51 @@
         "type": "github"
       }
     },
-    "flake-utils_3": {
+    "git-hooks": {
       "inputs": {
-        "systems": "systems_2"
+        "flake-compat": [
+          "simple-mailserver",
+          "flake-compat"
+        ],
+        "gitignore": "gitignore",
+        "nixpkgs": [
+          "simple-mailserver",
+          "nixpkgs"
+        ]
       },
       "locked": {
-        "lastModified": 1731533236,
-        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "lastModified": 1763988335,
+        "narHash": "sha256-QlcnByMc8KBjpU37rbq5iP7Cp97HvjRP0ucfdh+M4Qc=",
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "rev": "50b9238891e388c9fdc6a5c49e49c42533a1b5ce",
         "type": "github"
       },
       "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "type": "github"
+      }
+    },
+    "gitignore": {
+      "inputs": {
+        "nixpkgs": [
+          "simple-mailserver",
+          "git-hooks",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1709087332,
+        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
         "type": "github"
       }
     },
@@ -229,15 +291,15 @@
     "nix-minecraft": {
       "inputs": {
         "flake-compat": "flake-compat_2",
-        "flake-utils": "flake-utils_3",
-        "nixpkgs": "nixpkgs_4"
+        "nixpkgs": "nixpkgs_4",
+        "systems": "systems_2"
       },
       "locked": {
-        "lastModified": 1767838769,
-        "narHash": "sha256-KCLU6SUU80tEBKIVZsBrSjRYX6kn1eVIYI3fEEqOp24=",
+        "lastModified": 1770000653,
+        "narHash": "sha256-QO/twGynxjOSUDtxbqJLshc/Q5/wImLH5O6KV2p9eoE=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "4da21f019f6443f513f16af7f220ba4db1cdfc04",
+        "rev": "6a2ddb643aaf7949caa6158e718c5efc3dda7dc1",
         "type": "github"
       },
       "original": {
@@ -295,11 +357,11 @@
     },
     "nixpkgs_4": {
       "locked": {
-        "lastModified": 1748929857,
-        "narHash": "sha256-lcZQ8RhsmhsK8u7LIFsJhsLh/pzR9yZ8yqpTzyGdj+Q=",
+        "lastModified": 1769461804,
+        "narHash": "sha256-msG8SU5WsBUfVVa/9RPLaymvi5bI8edTavbIq3vRlhI=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "c2a03962b8e24e669fb37b7df10e7c79531ff1a4",
+        "rev": "bfc1b8a4574108ceef22f02bafcf6611380c100d",
         "type": "github"
       },
       "original": {
@@ -311,16 +373,16 @@
     },
     "nixpkgs_5": {
       "locked": {
-        "lastModified": 1767313136,
-        "narHash": "sha256-16KkgfdYqjaeRGBaYsNrhPRRENs0qzkQVUooNHtoy2w=",
+        "lastModified": 1770136044,
+        "narHash": "sha256-tlFqNG/uzz2++aAmn4v8J0vAkV3z7XngeIIB3rM3650=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "ac62194c3917d5f474c1a844b6fd6da2db95077d",
+        "rev": "e576e3c9cf9bad747afcddd9e34f51d18c855b4e",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-25.05",
+        "ref": "nixos-25.11",
         "repo": "nixpkgs",
         "type": "github"
       }
@@ -340,6 +402,22 @@
       }
     },
     "nixpkgs_7": {
+      "locked": {
+        "lastModified": 1764374374,
+        "narHash": "sha256-naS7hg/D1yLKSZoENx9gvsPLFiNEOTcqamJSu0OEvCA=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "6a49303095abc094ee77dc243a9e351b642e8e75",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable-small",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_8": {
       "locked": {
         "lastModified": 1736549401,
         "narHash": "sha256-ibkQrMHxF/7TqAYcQE+tOnIsSEzXmMegzyBWza6uHKM=",
@@ -364,6 +442,7 @@
         "nix-minecraft": "nix-minecraft",
         "nixpkgs": "nixpkgs_5",
         "shoblog-front": "shoblog-front",
+        "simple-mailserver": "simple-mailserver",
         "testing-grounds": "testing-grounds",
         "unstable": "unstable"
       }
@@ -386,6 +465,27 @@
         "type": "gitlab"
       }
     },
+    "simple-mailserver": {
+      "inputs": {
+        "blobs": "blobs",
+        "flake-compat": "flake-compat_3",
+        "git-hooks": "git-hooks",
+        "nixpkgs": "nixpkgs_7"
+      },
+      "locked": {
+        "lastModified": 1766321686,
+        "narHash": "sha256-icOWbnD977HXhveirqA10zoqvErczVs3NKx8Bj+ikHY=",
+        "owner": "simple-nixos-mailserver",
+        "repo": "nixos-mailserver",
+        "rev": "7d433bf89882f61621f95082e90a4ab91eb0bdd3",
+        "type": "gitlab"
+      },
+      "original": {
+        "owner": "simple-nixos-mailserver",
+        "repo": "nixos-mailserver",
+        "type": "gitlab"
+      }
+    },
     "stable": {
       "locked": {
         "lastModified": 1750133334,
@@ -434,7 +534,7 @@
     },
     "testing-grounds": {
       "inputs": {
-        "nixpkgs": "nixpkgs_7"
+        "nixpkgs": "nixpkgs_8"
       },
       "locked": {
         "lastModified": 1755527993,
@@ -452,11 +552,11 @@
     },
     "unstable": {
       "locked": {
-        "lastModified": 1768127708,
-        "narHash": "sha256-1Sm77VfZh3mU0F5OqKABNLWxOuDeHIlcFjsXeeiPazs=",
+        "lastModified": 1769789167,
+        "narHash": "sha256-kKB3bqYJU5nzYeIROI82Ef9VtTbu4uA3YydSk/Bioa8=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "ffbc9f8cbaacfb331b6017d5a5abb21a492c9a38",
+        "rev": "62c8382960464ceb98ea593cb8321a2cf8f9e3e5",
         "type": "github"
       },
       "original": {

flake.nix

@@ -3,24 +3,24 @@
 
   # Flake inputs
   inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
     unstable.url = "github:NixOS/nixpkgs/nixos-unstable";
     colmena.url = "github:zhaofengli/colmena";
 
     # commons
     agenix.url = "github:ryantm/agenix";
 
-    # zimablade inputs
+    # sin inputs
     disko.url = "github:nix-community/disko";
     disko.inputs.nixpkgs.follows = "nixpkgs";
+    copyparty.url = "github:9001/copyparty";
+    simple-mailserver.url = "gitlab:simple-nixos-mailserver/nixos-mailserver";
 
-    # sin inputs
+    # thea inputs
     nix-minecraft.url = "github:Infinidoge/nix-minecraft";
     testing-grounds.url = "gitlab:shobu13/testing-grounds";
     shoblog-front.url = "gitlab:shobu13/shoblog";
 
-    copyparty.url = "github:9001/copyparty";
-
   };
 
   # Flake outputs
@@ -61,7 +61,7 @@
         );
     in
     {
-      nixosConfigurations = {
+      nixosConfigurations = rec {
         sin = nixpkgs.lib.nixosSystem {
           system = "x86_64-linux";
 
@@ -80,6 +80,24 @@
             inherit inputs;
           };
         };
+        thea = nixpkgs.lib.nixosSystem {
+            system = "x86_64-linux";
+
+            modules = [
+              agenix.nixosModules.default
+              ./hosts/thea/configuration.nix
+              ./hosts/thea/hardware-configuration.nix
+            ]
+            ++ [
+              # modules
+              ./modules/gitea/thea
+            ];
+
+            specialArgs = {
+              inherit inputs;
+              nodes = {inherit sin;};
+            };
+        };
       };
       colmenaHive = colmena.lib.makeHive {
         meta = {
@@ -111,7 +129,9 @@
               ./modules/gitea/${name}
             ];
 
-            deployment.targetHost = "192.168.1.12";
+            deployment.targetHost = "git.shobu.fr";
+
+            # deployment.targetHost = "192.168.1.12";
           };
 
         sin =
@@ -133,7 +153,10 @@
               ./modules/gitea/${name}
             ];
 
-            deployment.targetHost = "192.168.1.14";
+            deployment.targetHost = "git.shobu.fr";
+            deployment.targetPort = 24658;
+
+            # deployment.targetHost = "192.168.1.14";
             deployment.allowLocalDeployment = true;
           };
       };

hosts/sin/configuration.nix

@@ -17,6 +17,7 @@
     ./secrets.nix
     ./coredns
     ./copyparty.nix
+    ./trilium.nix
   ];
 
   boot.initrd.kernelModules = [ "usb_storage" ];
@@ -43,6 +44,8 @@
 
         3000 # gitea
 
+        config.services.trilium-server.port
+
         53
       ];
 

hosts/sin/jellyfin.nix

@@ -2,19 +2,15 @@
 let
   unstable = import inputs.unstable { system = pkgs.system; };
 in
-{
-  nixpkgs.config.packageOverrides = pkgs: {
-    vaapiIntel = pkgs.vaapiIntel.override { enableHybridCodec = true; };
-  };
+{systemd.services.jellyfin.environment.LIBVA_DRIVER_NAME = "iHD"; # or i965 for older GPUs
+  environment.sessionVariables = { LIBVA_DRIVER_NAME = "iHD"; };
   hardware.graphics = {
     enable = true;
     extraPackages = with pkgs; [
+      intel-ocl # Generic OpenCL support
+
+      # For Broadwell and newer (ca. 2014+), use with LIBVA_DRIVER_NAME=iHD:
       intel-media-driver
-      intel-vaapi-driver
-      vaapiVdpau
-      intel-compute-runtime # OpenCL filter support (hardware tonemapping and subtitle burn-in)
-      vpl-gpu-rt # QSV on 11th gen or newer
-      intel-media-sdk # QSV up to 11th gen
     ];
   };
 
@@ -82,15 +78,27 @@ in
       enable = true;
       openFirewall = true;
       group = "starr";
+      settings = {
+        authentication.AuthenticationMethod = "external";
+        authentication.AuthenticationType = "enabled";
+      };
     };
     radarr = {
       enable = true;
       openFirewall = true;
       group = "starr";
+      settings = {
+        authentication.AuthenticationMethod = "external";
+        authentication.AuthenticationType = "enabled";
+      };
     };
     prowlarr = {
       enable = true;
       openFirewall = true;
+      settings = {
+        authentication.AuthenticationMethod = "external";
+        authentication.AuthenticationType = "enabled";
+      };
     };
     bazarr = {
       enable = true;
@@ -99,10 +107,18 @@ in
     lidarr = {
       enable = true;
       openFirewall = true;
+      settings = {
+        authentication.AuthenticationMethod = "external";
+        authentication.AuthenticationType = "enabled";
+      };
     };
     whisparr = {
       enable = true;
       openFirewall = true;
+      settings = {
+        authentication.AuthenticationMethod = "external";
+        authentication.AuthenticationType = "enabled";
+      };
     };
 
     jellyseerr = {

hosts/sin/mailserver.nix

@@ -0,0 +1,37 @@
+{
+  inputs,
+  config,
+  lib,
+  ...
+}:
+let
+  inherit (lib)
+    mkDefault
+    ;
+in
+{
+  imports = [
+    inputs.simple-mailserver.default
+  ];
+
+  security.acme = {
+    acceptTerms = mkDefault true;
+    certs.${config.mailserver.fqdn} = {
+    };
+  };
+
+  mailserver = {
+    enable = true;
+    stateVersion = 3;
+    fqdn = "mail.shobu.fr";
+    domains = [ "shobu.fr" ];
+
+    x509.useACMEHost = config.mailserver.fqdn;
+
+    loginAccounts = {
+      "auth@shobu.fr" = {
+        password = "$y$j9T$aLAZYUOUrc2jxcNYGy1qt/$B1ZdufZtzJJmnLYIYW11nk1BwIIy1Xkjxb7lx3ge/Z3";
+      };
+    };
+  };
+}

hosts/sin/secrets.nix

@@ -15,5 +15,17 @@
       mode = "700";
       owner = "copyparty";
     };
+    authelia-jwt = {
+      file = ./secrets/authelia-jwt.age;
+      mode = "700";
+    };
+    authelia-encryption = {
+      file = ./secrets/authelia-encryption.age;
+      mode = "700";
+    };
+    authelia-session = {
+      file = ./secrets/authelia-session.age;
+      mode = "700";
+    };
   };
 }

hosts/sin/secrets/authelia-encryption.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 /uqj4A L95rgX9APIgoMvkplZIYgMQDhKBOsPGOw/maymMhiks
+LNfa/YBCd84iknAMk4wbQps4KMXCvrhPp2d9KkhJWHI
+-> ssh-ed25519 NoSl6Q G/y6DUFTyV6Jy6KHo8yc+xxtu3aJtTOF3Ldmxq3FmyE
+FOExj321S/VIPQ/qdvZBcJ930HI/GsjDVjJp9WMSXLA
+--- iIpq/CWng+4+kQbvJQb/qgejr/eza94wCkegEJ2dvno
+ÿNôU*1=DÔOˆ£W6]_â©Kà=©*ÊÞký¦_ù˜Ýøɇ™tmË•ãw°

hosts/sin/secrets/authelia-jwt.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 /uqj4A i6SPCzjkGrPMjhC9NQDdYTk3fzXoD4OSQdhS1togN0A
+Lqus8sROz1O4EepauPwC4RX/qH+SnDiL2H5iZGtAhXo
+-> ssh-ed25519 NoSl6Q LxV4a5HiB6qfPjbba75dkVVECzaqrMjksMXHh53JbGQ
+x4POzurz+J2mymT81M+cu69Iv/MeiYt+JvaRteinm5Q
+--- OFqooyZ2HPBxP756PqpgJAyVOTkqhJ0LhEQsLJBZUtE
+—>»&Ȇw·\D„Au{õz{CˆÁ~á$‘_ˆ9»¢ZZ<5A>U^„ÎÊL!(lnпÂó‰Üv{fdº 1Ýßl
¢,<2C>|<7C>Ü.¤çH«¤³êVaù¥ÍÓˆ™PêwOo3ž

hosts/sin/secrets/authelia-session.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 /uqj4A eff535EaT7gEZOacWx9raBJMdd4PPd9+y6Y3eOt1wBI
+5P4aefjWVJ4L11ff+Cg8j3gQ58I+agDPUMFWiCaL/sQ
+-> ssh-ed25519 NoSl6Q 3+EZtaiiZQk7JK6zCNo/nUSSRAJzf8nal2X1sFkYmxo
+f5gzpiOtCbYdiV7vOxfZvJPRmRruTbHg6T8g0r5JRgc
+--- BBL3wE2eSmHVI4tlhq+5fy84cauw6P6G69nFXuObLKE
+êéæí	@[¡SÓcñ‘<C3B1>SyÉŠ‡<; í†<C3AD>e±Ë茟<C592><C5B8>§(°Æž1\Yj›È¯½½4åõ Ý
ȹ.3>Â[Èq¢Jh8í·šÕVt”øX[Ì~[(#
^‘_5€§<E282AC>

hosts/sin/trilium.nix

@@ -0,0 +1,9 @@
+{ ... }:
+{
+  services.trilium-server = {
+    enable = true;
+    port = 12783;
+    host = "0.0.0.0";
+    noAuthentication = true;
+  };
+}

hosts/thea/authelia.nix

@@ -0,0 +1,126 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}:
+let
+  cfg = config.services.authelia.instances.main;
+  dataDir = "/var/lib/authelia-${cfg.name}";
+  authelia-snippets = pkgs.callPackage ./lib/autheliaSnippets.nix { inherit pkgs; };
+in
+{
+  services.authelia.instances = {
+    main = {
+      enable = true;
+      secrets = {
+        jwtSecretFile = config.age.secrets.authelia-jwt.path;
+        storageEncryptionKeyFile = config.age.secrets.authelia-encryption.path;
+        sessionSecretFile = config.age.secrets.authelia-session.path;
+      };
+      settings = {
+        theme = "light";
+        log.level = "debug";
+
+        authentication_backend = {
+          file = {
+            path = dataDir + "/users.yml";
+          };
+        };
+        storage = {
+          local = {
+            path = dataDir + "/db.sqlite3";
+          };
+        };
+        session = {
+          cookies = [
+            {
+              domain = "shobu.fr";
+              authelia_url = "https://auth.shobu.fr";
+              default_redirection_url = "https://shobu.fr";
+            }
+          ];
+        };
+        notifier = {
+          filesystem = {
+            filename = "${dataDir}/notification.txt";
+          };
+        };
+        access_control = {
+          default_policy = "deny";
+          rules = [
+            # {
+            #   domain = "radarr.shobu.fr";
+            #   policy = "bypass";
+            # }
+            {
+              domain = "*.shobu.fr";
+              policy = "one_factor";
+            }
+          ];
+        };
+        server = {
+          endpoints = {
+            authz = {
+              auth-request = {
+                implementation = "AuthRequest";
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+
+  # systemd.tmpfiles.rules = lib.mkIf cfg.enable [
+  #   "d '${dataDir}' 0700 ${cfg.user} ${cfg.group} - -"
+  # ];
+
+  age.secrets = {
+    authelia-jwt = {
+      owner = cfg.user;
+      file = ./secrets/authelia-jwt.age;
+      mode = "700";
+    };
+    authelia-encryption = {
+      owner = cfg.user;
+      file = ./secrets/authelia-encryption.age;
+      mode = "700";
+    };
+    authelia-session = {
+      owner = cfg.user;
+      file = ./secrets/authelia-session.age;
+      mode = "700";
+    };
+  };
+
+  services.nginx = {
+    enable = true;
+    recommendedProxySettings = true;
+    recommendedTlsSettings = true;
+
+    virtualHosts."auth.shobu.fr" =
+      let
+        upstream = "http://thea:9091";
+      in
+      {
+        enableACME = true;
+        forceSSL = true;
+
+        locations."/" = {
+          proxyPass = upstream;
+          extraConfig = ''
+            error_log /var/log/nginx/debug_authelia.log debug;
+            include ${authelia-snippets.proxy};
+            set $upstream ${upstream};
+          '';
+        };
+        locations."/api/verify" = {
+          proxyPass = upstream;
+        };
+        locations."/api/authz" = {
+          proxyPass = upstream;
+        };
+      };
+  };
+}

hosts/thea/configuration.nix

@@ -16,10 +16,11 @@ in
 {
   imports = [
     ./nginx.nix
-    # ./striped
     # ./cybercoffee
     ./ollama.nix
     ./minecraft.nix
+    ./secrets
+    ./authelia.nix
   ];
 
   # Use the systemd-boot EFI boot loader.

hosts/thea/hardware-configuration.nix

@@ -49,7 +49,7 @@
   };
 
   fileSystems."/boot" = {
-    device = "/dev/disk/by-uuid/D1B9-8019";
+    device = "/dev/disk/by-uuid/2CF4-0109";
     fsType = "vfat";
     options = [
       "fmask=0077"

hosts/thea/lib/autheliaSnippets.nix

@@ -0,0 +1,81 @@
+{ pkgs }:
+{
+  proxy = pkgs.writeText "proxy.conf" ''
+    ## Headers
+    # proxy_set_header Host $host;
+    proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_set_header X-Forwarded-Host $http_host;
+    proxy_set_header X-Forwarded-URI $request_uri;
+    proxy_set_header X-Forwarded-Ssl on;
+    proxy_set_header X-Forwarded-For $remote_addr;
+  '';
+  authelia-location = pkgs.writeText "authelia-location.conf" ''
+    set $upstream_authelia http://192.168.1.12:9091/api/authz/auth-request;
+
+    ## Virtual endpoint created by nginx to forward auth requests.
+    location /internal/authelia/authz {
+        ## Essential Proxy Configuration
+        internal;
+        proxy_pass $upstream_authelia;
+
+        ## Headers
+        ## The headers starting with X-* are required.
+        proxy_set_header X-Original-Method $request_method;
+        proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
+        proxy_set_header X-Forwarded-For $remote_addr;
+        proxy_set_header Content-Length "";
+        proxy_set_header Connection "";
+
+        ## Basic Proxy Configuration
+        proxy_pass_request_body off;
+        proxy_next_upstream error timeout invalid_header http_500 http_502 http_503; # Timeout if the real server is dead
+        proxy_redirect http:// $scheme://;
+        proxy_http_version 1.1;
+        proxy_cache_bypass $cookie_session;
+        proxy_no_cache $cookie_session;
+        proxy_buffers 4 32k;
+        client_body_buffer_size 128k;
+
+        ## Advanced Proxy Configuration
+        send_timeout 5m;
+        proxy_read_timeout 240;
+        proxy_send_timeout 240;
+        proxy_connect_timeout 240;
+    }
+  '';
+  authelia-authrequest = pkgs.writeText "authelia-authrequest.conf" ''
+    ## Send a subrequest to Authelia to verify if the user is authenticated and has permission to access the resource.
+    auth_request /internal/authelia/authz;
+
+    ## Save the upstream metadata response headers from Authelia to variables.
+    auth_request_set $user $upstream_http_remote_user;
+    auth_request_set $groups $upstream_http_remote_groups;
+    auth_request_set $name $upstream_http_remote_name;
+    auth_request_set $email $upstream_http_remote_email;
+
+    ## Inject the metadata response headers from the variables into the request made to the backend.
+    proxy_set_header Remote-User $user;
+    proxy_set_header Remote-Groups $groups;
+    proxy_set_header Remote-Email $email;
+    proxy_set_header Remote-Name $name;
+
+    ## Configure the redirection when the authz failure occurs. Lines starting with 'Modern Method' and 'Legacy Method'
+    ## should be commented / uncommented as pairs. The modern method uses the session cookies configuration's authelia_url
+    ## value to determine the redirection URL here. It's much simpler and compatible with the mutli-cookie domain easily.
+
+    ## Modern Method: Set the $redirection_url to the Location header of the response to the Authz endpoint.
+    auth_request_set $redirection_url $upstream_http_location;
+
+    ## Modern Method: When there is a 401 response code from the authz endpoint redirect to the $redirection_url.
+    error_page 401 =302 $redirection_url;
+
+    ## Legacy Method: Set $target_url to the original requested URL.
+    ## This requires http_set_misc module, replace 'set_escape_uri' with 'set' if you don't have this module.
+    # set_escape_uri $target_url $scheme://$http_host$request_uri;
+
+    ## Legacy Method: When there is a 401 response code from the authz endpoint redirect to the portal with the 'rd'
+    ## URL parameter set to $target_url. This requires users update 'auth.shobu.fr/' with their external authelia URL.
+    # error_page 401 =302 https://auth.shobu.fr/?rd=$target_url;
+  '';
+}

hosts/thea/minecraft.nix

@@ -9,6 +9,10 @@ let
     url = "file:///${inputs.testing-grounds.modpack}/pack.toml";
     packHash = "sha256-+taYj4uroLNxM4Nia3n+5P1Y/g6dzE6Iq13TsZgk4mU=";
   };
+  gregpack = pkgs.fetchPackwizModpack {
+    url = "https://raw.githubusercontent.com/GregTechCEu/GregTech-Modern-Community-Pack/refs/heads/main/pack.toml";
+    packHash = "sha256-SE86gP15H/Aug6vTLmMxHuxF2/+iLmCI/wQlON1xasM=";
+  };
 in
 {
   imports = [ inputs.nix-minecraft.nixosModules.minecraft-servers ];
@@ -35,4 +39,10 @@ in
       };
     };
   };
+
+  networking.firewall.allowedTCPPorts = [
+    25865 # autismcraft
+    25665 # reclamation
+    25675 # reclamation
+  ];
 }

hosts/thea/nginx.nix

@@ -1,8 +1,14 @@
-{ inputs, ... }:
+{
+  inputs,
+  pkgs,
+  lib,
+  ...
+}:
 let
   # striped-front = inputs.striped-front;
 
   sin-address = "192.168.1.14";
+  authelia-snippets = pkgs.callPackage ./lib/autheliaSnippets.nix { inherit pkgs; };
 in
 {
 
@@ -17,36 +23,92 @@ in
     recommendedProxySettings = true;
     recommendedTlsSettings = true;
 
+    typesHashMaxSize = 512;
+    mapHashMaxSize = 512;
+
     virtualHosts =
       let
-        mkStarr = host: port: {
+        mkVHost = host: port: {
           "${host}" = {
             enableACME = true;
             forceSSL = true;
 
             locations."/" = {
               proxyPass = "http://${sin-address}:${port}";
+            };
+          };
+        };
+        mkStarr = host: port: {
+          "${host}" = {
+            enableACME = true;
+            forceSSL = true;
+
+            extraConfig = ''
+              include ${authelia-snippets.authelia-location};
+            '';
+
+            locations."/api" = {
+              proxyPass = "http://${sin-address}:${port}";
               proxyWebsockets = true;
               extraConfig = ''
                 proxy_ssl_server_name on;
+              '';
+            };
+            locations."/" = {
+              proxyPass = "http://${sin-address}:${port}";
+              proxyWebsockets = true;
+              extraConfig = ''
+                include ${authelia-snippets.proxy};
+                include ${authelia-snippets.authelia-authrequest};
+
+                proxy_ssl_server_name on;
                 proxy_read_timeout 4800s;
               '';
             };
           };
         };
+        withAuthelia =
+          vhost: location:
+          (builtins.mapAttrs (
+            name: value:
+            (lib.recursiveUpdate value {
+              extraConfig = (if value ? extraConfig then value.extraConfig else "") + ''
+                include ${authelia-snippets.authelia-location};
+              '';
+              locations."${location}".extraConfig =
+                (
+                  if value.locations."${location}" ? extraConfig then
+                    value.locations."${location}".extraConfig
+                  else
+                    ""
+                )
+                + ''
+                  include ${authelia-snippets.proxy};
+                  include ${authelia-snippets.authelia-authrequest};
+                '';
+            })
+          ) vhost);
+        withWebsockets =
+          vhost: location:
+          (builtins.mapAttrs (
+            name: value:
+            (lib.recursiveUpdate value {
+              locations."${location}".proxyWebsockets = true;
+            })
+          ) vhost);
       in
       (
-        mkStarr "jellyfin.shobu.fr" "8096"
+        (withWebsockets (mkVHost "jellyfin.shobu.fr" "8096") "/")
         // mkStarr "radarr.shobu.fr" "7878"
         // mkStarr "sonarr.shobu.fr" "8989"
         // mkStarr "prowlarr.shobu.fr" "9696"
         // mkStarr "bazarr.shobu.fr" "6767"
-        // mkStarr "jellyseerr.shobu.fr" "5055"
-        // mkStarr "fileshelter.shobu.fr" "5091"
         // mkStarr "lidarr.shobu.fr" "8686"
         // mkStarr "whisparr.shobu.fr" "6969"
-        // mkStarr "transmission.shobu.fr" "9091"
-        // mkStarr "zimablade-admin.shobu.fr" "61208"
+        // mkVHost "jellyseerr.shobu.fr" "5055"
+        // mkVHost "transmission.shobu.fr" "9091"
+        // mkVHost "zimablade-admin.shobu.fr" "61208"
+        // (withWebsockets (withAuthelia (mkVHost "trilium.shobu.fr" "12783") "/") "/")
         // {
           "shobu.fr" = {
             enableACME = true;
@@ -109,10 +171,18 @@ in
             enableACME = true;
             forceSSL = true;
 
+            extraConfig = ''
+              # include ${authelia-snippets.authelia-location};
+              # error_log /var/log/nginx/debug_files.log debug;
+            '';
+
             locations."/" = {
               proxyPass = "http://${sin-address}:8086";
               extraConfig = ''
+                # include ${authelia-snippets.proxy};
+                # include ${authelia-snippets.authelia-authrequest};
                 proxy_set_header X-Real-IP $remote_addr;
+                client_max_body_size 100M;
               '';
             };
           };

hosts/thea/secrets/authelia-encryption.age

@@ -0,0 +1,10 @@
+age-encryption.org/v1
+-> ssh-ed25519 /uqj4A 9cZH/SlDpiluz2O3wCxRcBhmt3L5eN24I0HHwiJDWRU
+VVZaJlB4QzxBPcaN3MjCemjptEbqSUMD8VVtKyGezH8
+-> ssh-ed25519 70Re8Q ZFEQxmnm+dFKSXcQAc0KxkewCB59J5FyL1Ob/uEEtVg
+fRdEZpIytxjUeSKPieIzvZaAn5Mikjp28HlZhKwzS7M
+-> ssh-ed25519 QvCxGg ifsqXBKO0mqE1RuJ44Y7qDJ7lyci8iyz+J1xFgO38jI
+MkhMTZ+RttBFFMkbIaSCSQiExR1gf4OyFWHXIsx+QYQ
+--- nnMlLyQjixpBkx+bSU5I364IP3KnZ0qnmMPueBcRHpU
+ë˜<EFBFBD>6TX—ÕÞÌfÁ““É
+®?Z7M<37>T<EFBFBD>Å|ÚQf

hosts/thea/secrets/authelia-session.age

@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> ssh-ed25519 /uqj4A yxpGM3pJxfnM/5q9+NzdfG2kBjjNex6bdyUeZEBKjnI
+UO6ovn2cFeNi6SbcGpfF71/OAyQccyG+l6aZXubUal8
+-> ssh-ed25519 70Re8Q GW40lmeg6Lj7ntZswT0/hWZFpYBWoV3CMq4pdo+Ncgc
+oWTYuM/s3G7EKPWPQpHbXo9Tpzgn7YlYVQHYGn4xKS8
+-> ssh-ed25519 QvCxGg pKLpxtuMIa0xPXoaeb4WeQWVEINRE/j4nrxDB1J9BUI
+1azpt5MImTiDSF+Ts9EvUCdWMeVG7lErUHSBQfMiip4
+--- IOOR8Us6zlZhJm0V4X3IlbkHSdtR3GLLxEfa4i+lqv0
+ó P¬¥rhé"BFãŽÌŸtÌ€ê¤{¾(öB`q“Óø"AµnN_ ™f*ÏŒºvPpj&{)ìŠØ@‹ÃkF«Ú
]<Aš*Á<>‡<EFBFBD>´WTm”ƪD‡,Ý1E­™”¦³eѨ·O¢š

hosts/thea/secrets/default.nix

@@ -0,0 +1,3 @@
+{ ... }:
+{
+}

modules/gitea/thea/virtualisation.nix

@@ -16,6 +16,10 @@
     };
   };
 
+  environment.systemPackages = with pkgs; [
+    podman-compose
+  ];
+
   virtualisation.oci-containers.containers =
     let
       runner_config = pkgs.writeTextFile {