heuuu plein de trucs en vrais

flake.lock

@@ -8,11 +8,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1762618334,
-        "narHash": "sha256-wyT7Pl6tMFbFrs8Lk/TlEs81N6L+VSybPfiIgzU8lbQ=",
+        "lastModified": 1770165109,
+        "narHash": "sha256-9VnK6Oqai65puVJ4WYtCTvlJeXxMzAp/69HhQuTdl/I=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "fcdea223397448d35d9b31f798479227e80183f6",
+        "rev": "b027ee29d959fda4b60b57566d64c98a202e0feb",
         "type": "github"
       },
       "original": {
@@ -21,6 +21,22 @@
         "type": "github"
       }
     },
+    "blobs": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1604995301,
+        "narHash": "sha256-wcLzgLec6SGJA8fx1OEN1yV/Py5b+U5iyYpksUY/yLw=",
+        "owner": "simple-nixos-mailserver",
+        "repo": "blobs",
+        "rev": "2cccdf1ca48316f2cfd1c9a0017e8de5a7156265",
+        "type": "gitlab"
+      },
+      "original": {
+        "owner": "simple-nixos-mailserver",
+        "repo": "blobs",
+        "type": "gitlab"
+      }
+    },
     "colmena": {
       "inputs": {
         "flake-compat": "flake-compat",
@@ -49,11 +65,11 @@
         "nixpkgs": "nixpkgs_3"
       },
       "locked": {
-        "lastModified": 1767637959,
-        "narHash": "sha256-+gBU5Cj9QNpHLQ5PHJoWNQft7TMsBM6X+tDQg+/B2P0=",
+        "lastModified": 1779822991,
+        "narHash": "sha256-r6e4eHEyQJEDhT6gkW3B9+OgB0pZebw2+du4bvN3vww=",
         "owner": "9001",
         "repo": "copyparty",
-        "rev": "038af507772593b904b5c3efc306f89cbdf2b6fb",
+        "rev": "6e75faa62349a59f4df328a4939ba8626d89ee1a",
         "type": "github"
       },
       "original": {
@@ -91,11 +107,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1766150702,
-        "narHash": "sha256-P0kM+5o+DKnB6raXgFEk3azw8Wqg5FL6wyl9jD+G5a4=",
+        "lastModified": 1780290312,
+        "narHash": "sha256-eTAlX0CwgB84Ts3GaBd944A3DRXVMzgA0EqroZBISUo=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "916506443ecd0d0b4a0f4cf9d40a3c22ce39b378",
+        "rev": "115e5211780054d8a890b41f0b7734cafad54dfe",
         "type": "github"
       },
       "original": {
@@ -139,15 +155,15 @@
     "flake-compat_3": {
       "flake": false,
       "locked": {
-        "lastModified": 1747046372,
-        "narHash": "sha256-CIVLLkVgvHYbgI2UpXvIIBJ12HWgX+fjA8Xf8PUmqCY=",
-        "owner": "edolstra",
+        "lastModified": 1767039857,
+        "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
+        "owner": "NixOS",
         "repo": "flake-compat",
-        "rev": "9100a0f413b0c601e0533d1d94ffd501ce2e7885",
+        "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
         "type": "github"
       },
       "original": {
-        "owner": "edolstra",
+        "owner": "NixOS",
         "repo": "flake-compat",
         "type": "github"
       }
@@ -182,39 +198,51 @@
         "type": "github"
       }
     },
-    "flake-utils_3": {
+    "git-hooks": {
       "inputs": {
-        "systems": "systems_2"
+        "flake-compat": [
+          "simple-mailserver",
+          "flake-compat"
+        ],
+        "gitignore": "gitignore",
+        "nixpkgs": [
+          "simple-mailserver",
+          "nixpkgs"
+        ]
       },
       "locked": {
-        "lastModified": 1731533236,
-        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "lastModified": 1778507602,
+        "narHash": "sha256-kTwur1wV+01SdqskVMSo6JMEpg71ps3HpbFY2GsflKs=",
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "rev": "61ab0e80d9c7ab14c256b5b453d8b3fb0189ba0a",
         "type": "github"
       },
       "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
         "type": "github"
       }
     },
-    "flake-utils_4": {
+    "gitignore": {
       "inputs": {
-        "systems": "systems_3"
+        "nixpkgs": [
+          "simple-mailserver",
+          "git-hooks",
+          "nixpkgs"
+        ]
       },
       "locked": {
-        "lastModified": 1731533236,
-        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "lastModified": 1709087332,
+        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
         "type": "github"
       },
       "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
         "type": "github"
       }
     },
@@ -263,35 +291,15 @@
     "nix-minecraft": {
       "inputs": {
         "flake-compat": "flake-compat_2",
-        "flake-utils": "flake-utils_3",
-        "nixpkgs": "nixpkgs_4"
+        "nixpkgs": "nixpkgs_4",
+        "systems": "systems_2"
       },
       "locked": {
-        "lastModified": 1767147099,
-        "narHash": "sha256-395ehjdAtaqCbKmx+PhKAqnkYLvTtAzq2qzFG9qaGDw=",
+        "lastModified": 1780375694,
+        "narHash": "sha256-TznzgYVONg28KiSFB2rVdf/eLVIMtEQOxKt13Kzyrp8=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "01f571579edd64433f97c4294137fbc366deef4b",
-        "type": "github"
-      },
-      "original": {
-        "owner": "Infinidoge",
-        "repo": "nix-minecraft",
-        "type": "github"
-      }
-    },
-    "nix-minecraft_2": {
-      "inputs": {
-        "flake-compat": "flake-compat_3",
-        "flake-utils": "flake-utils_4",
-        "nixpkgs": "nixpkgs_6"
-      },
-      "locked": {
-        "lastModified": 1767147099,
-        "narHash": "sha256-395ehjdAtaqCbKmx+PhKAqnkYLvTtAzq2qzFG9qaGDw=",
-        "owner": "Infinidoge",
-        "repo": "nix-minecraft",
-        "rev": "01f571579edd64433f97c4294137fbc366deef4b",
+        "rev": "e6f8bec35104ca5955efe73742da58d2823684f7",
         "type": "github"
       },
       "original": {
@@ -316,6 +324,22 @@
         "type": "github"
       }
     },
+    "nixpkgs-2505": {
+      "locked": {
+        "lastModified": 1767313136,
+        "narHash": "sha256-16KkgfdYqjaeRGBaYsNrhPRRENs0qzkQVUooNHtoy2w=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "ac62194c3917d5f474c1a844b6fd6da2db95077d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-25.05",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
     "nixpkgs_2": {
       "locked": {
         "lastModified": 1750134718,
@@ -349,11 +373,11 @@
     },
     "nixpkgs_4": {
       "locked": {
-        "lastModified": 1748929857,
-        "narHash": "sha256-lcZQ8RhsmhsK8u7LIFsJhsLh/pzR9yZ8yqpTzyGdj+Q=",
+        "lastModified": 1769461804,
+        "narHash": "sha256-msG8SU5WsBUfVVa/9RPLaymvi5bI8edTavbIq3vRlhI=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "c2a03962b8e24e669fb37b7df10e7c79531ff1a4",
+        "rev": "bfc1b8a4574108ceef22f02bafcf6611380c100d",
         "type": "github"
       },
       "original": {
@@ -365,51 +389,21 @@
     },
     "nixpkgs_5": {
       "locked": {
-        "lastModified": 1767313136,
-        "narHash": "sha256-16KkgfdYqjaeRGBaYsNrhPRRENs0qzkQVUooNHtoy2w=",
+        "lastModified": 1780203844,
+        "narHash": "sha256-K5sT4jTpGs15ADhviMKNBH38REpPf5Q6mM1+N6cArVE=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "ac62194c3917d5f474c1a844b6fd6da2db95077d",
+        "rev": "b51242d7d43689db2f3be91bd05d5b24fbb469c4",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-25.05",
+        "ref": "nixos-26.05",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
     "nixpkgs_6": {
-      "locked": {
-        "lastModified": 1748929857,
-        "narHash": "sha256-lcZQ8RhsmhsK8u7LIFsJhsLh/pzR9yZ8yqpTzyGdj+Q=",
-        "owner": "nixos",
-        "repo": "nixpkgs",
-        "rev": "c2a03962b8e24e669fb37b7df10e7c79531ff1a4",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nixos",
-        "ref": "nixos-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_7": {
-      "locked": {
-        "lastModified": 1767364772,
-        "narHash": "sha256-fFUnEYMla8b7UKjijLnMe+oVFOz6HjijGGNS1l7dYaQ=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "16c7794d0a28b5a37904d55bcca36003b9109aaa",
-        "type": "github"
-      },
-      "original": {
-        "id": "nixpkgs",
-        "type": "indirect"
-      }
-    },
-    "nixpkgs_8": {
       "locked": {
         "lastModified": 1737062831,
         "narHash": "sha256-Tbk1MZbtV2s5aG+iM99U8FqwxU/YNArMcWAv6clcsBc=",
@@ -423,7 +417,23 @@
         "url": "https://flakehub.com/f/NixOS/nixpkgs/0.1.%2A.tar.gz"
       }
     },
-    "nixpkgs_9": {
+    "nixpkgs_7": {
+      "locked": {
+        "lastModified": 1779630130,
+        "narHash": "sha256-RWn/gMXEy+p6yL5lKh51Z/w6RHC+5Px18Tarkuva99Y=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "68ac0b94b449482d8a90f3e3791d61a8ee186f07",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable-small",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_8": {
       "locked": {
         "lastModified": 1736549401,
         "narHash": "sha256-ibkQrMHxF/7TqAYcQE+tOnIsSEzXmMegzyBWza6uHKM=",
@@ -439,26 +449,6 @@
         "type": "github"
       }
     },
-    "reclamation": {
-      "inputs": {
-        "nix-minecraft": "nix-minecraft_2",
-        "nixpkgs": "nixpkgs_7",
-        "utils": "utils"
-      },
-      "locked": {
-        "lastModified": 1767786101,
-        "narHash": "sha256-ENlpYr2V5u0/Enq07nIHfzetqmS95aydQYIM6sISVUc=",
-        "ref": "refs/heads/master",
-        "rev": "b71acff364b7b5eb3e1b68915aeb379053b86c94",
-        "revCount": 10,
-        "type": "git",
-        "url": "https://git.shobu.fr/sin_serhao/reclamation"
-      },
-      "original": {
-        "type": "git",
-        "url": "https://git.shobu.fr/sin_serhao/reclamation"
-      }
-    },
     "root": {
       "inputs": {
         "agenix": "agenix",
@@ -467,15 +457,16 @@
         "disko": "disko",
         "nix-minecraft": "nix-minecraft",
         "nixpkgs": "nixpkgs_5",
-        "reclamation": "reclamation",
+        "nixpkgs-2505": "nixpkgs-2505",
         "shoblog-front": "shoblog-front",
+        "simple-mailserver": "simple-mailserver",
         "testing-grounds": "testing-grounds",
         "unstable": "unstable"
       }
     },
     "shoblog-front": {
       "inputs": {
-        "nixpkgs": "nixpkgs_8"
+        "nixpkgs": "nixpkgs_6"
       },
       "locked": {
         "lastModified": 1752594581,
@@ -491,6 +482,27 @@
         "type": "gitlab"
       }
     },
+    "simple-mailserver": {
+      "inputs": {
+        "blobs": "blobs",
+        "flake-compat": "flake-compat_3",
+        "git-hooks": "git-hooks",
+        "nixpkgs": "nixpkgs_7"
+      },
+      "locked": {
+        "lastModified": 1780340963,
+        "narHash": "sha256-rQCWOQXN0/sQxwP7T2Y3hsC1KYxLQgul6l9LPbQdqi4=",
+        "owner": "simple-nixos-mailserver",
+        "repo": "nixos-mailserver",
+        "rev": "a61228e6918a9d673c3faf48ab23e92a55822012",
+        "type": "gitlab"
+      },
+      "original": {
+        "owner": "simple-nixos-mailserver",
+        "repo": "nixos-mailserver",
+        "type": "gitlab"
+      }
+    },
     "stable": {
       "locked": {
         "lastModified": 1750133334,
@@ -537,39 +549,9 @@
         "type": "github"
       }
     },
-    "systems_3": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    },
-    "systems_4": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    },
     "testing-grounds": {
       "inputs": {
-        "nixpkgs": "nixpkgs_9"
+        "nixpkgs": "nixpkgs_8"
       },
       "locked": {
         "lastModified": 1755527993,
@@ -587,37 +569,18 @@
     },
     "unstable": {
       "locked": {
-        "lastModified": 1767640445,
-        "narHash": "sha256-UWYqmD7JFBEDBHWYcqE6s6c77pWdcU/i+bwD6XxMb8A=",
+        "lastModified": 1780651739,
+        "narHash": "sha256-3VfA5BcsITQmorkCW/6ZF9usmLTkFTAfTj4QT7DG338=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "9f0c42f8bc7151b8e7e5840fb3bd454ad850d8c5",
+        "rev": "e91830af5eb4b2394ddd405998dec32f0ef18a51",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-unstable",
         "repo": "nixpkgs",
         "type": "github"
       }
-    },
-    "utils": {
-      "inputs": {
-        "systems": "systems_4"
-      },
-      "locked": {
-        "lastModified": 1731533236,
-        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
     }
   },
   "root": "root",

flake.nix

@@ -3,26 +3,24 @@
 
   # Flake inputs
   inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05";
-    unstable.url = "github:NixOS/nixpkgs/nixos-unstable";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05";
+    nixpkgs-2505.url = "github:nixos/nixpkgs/nixos-25.05";
+    unstable.url = "github:NixOS/nixpkgs";
     colmena.url = "github:zhaofengli/colmena";
 
     # commons
     agenix.url = "github:ryantm/agenix";
 
-    # zimablade inputs
+    # sin inputs
     disko.url = "github:nix-community/disko";
     disko.inputs.nixpkgs.follows = "nixpkgs";
+    copyparty.url = "github:9001/copyparty";
+    simple-mailserver.url = "gitlab:simple-nixos-mailserver/nixos-mailserver";
 
-    # sin inputs
+    # thea inputs
     nix-minecraft.url = "github:Infinidoge/nix-minecraft";
     testing-grounds.url = "gitlab:shobu13/testing-grounds";
-    reclamation.url = "git+https://git.shobu.fr/sin_serhao/reclamation";
     shoblog-front.url = "gitlab:shobu13/shoblog";
-    # striped-front.url = "git+ssh://git@gitlab.com/striped1/striped-front";
-    # striped-back.url = "git+ssh://git@gitlab.com/striped1/striped-back";
-
-    copyparty.url = "github:9001/copyparty";
 
   };
 
@@ -44,7 +42,6 @@
       # striped-back,
       nix-minecraft,
       testing-grounds,
-      reclamation,
       copyparty,
       ...
     }:
@@ -65,24 +62,42 @@
         );
     in
     {
-      nixosConfigurations = {
+      nixosConfigurations = rec {
         sin = nixpkgs.lib.nixosSystem {
-           system = "x86_64-linux";
-          
-           modules = [
-              disko.nixosModules.disko
-              agenix.nixosModules.default
-              ./hosts/sin/configuration.nix
-              ./hosts/sin/hardware-configuration.nix
-            ]
-            ++ [
-              # modules
-              ./modules/gitea/sin
-            ];
-            
-            specialArgs = {
-             inherit inputs;
-           };
+          system = "x86_64-linux";
+
+          modules = [
+            disko.nixosModules.disko
+            agenix.nixosModules.default
+            ./hosts/sin/configuration.nix
+            ./hosts/sin/hardware-configuration.nix
+          ]
+          ++ [
+            # modules
+            ./modules/gitea/sin
+          ];
+
+          specialArgs = {
+            inherit inputs;
+          };
+        };
+        thea = nixpkgs.lib.nixosSystem {
+          system = "x86_64-linux";
+
+          modules = [
+            agenix.nixosModules.default
+            ./hosts/thea/configuration.nix
+            ./hosts/thea/hardware-configuration.nix
+          ]
+          ++ [
+            # modules
+            ./modules/gitea/thea
+          ];
+
+          specialArgs = {
+            inherit inputs;
+            nodes = { inherit sin; };
+          };
         };
       };
       colmenaHive = colmena.lib.makeHive {
@@ -115,7 +130,9 @@
               ./modules/gitea/${name}
             ];
 
-            deployment.targetHost = "192.168.1.12";
+            deployment.targetHost = "git.shobu.fr";
+
+            # deployment.targetHost = "192.168.1.12";
           };
 
         sin =
@@ -137,7 +154,10 @@
               ./modules/gitea/${name}
             ];
 
-            deployment.targetHost = "192.168.1.14";
+            deployment.targetHost = "git.shobu.fr";
+            deployment.targetPort = 24658;
+
+            # deployment.targetHost = "192.168.1.14";
             deployment.allowLocalDeployment = true;
           };
       };
@@ -156,7 +176,7 @@
             env = { };
 
             # Add any shell logic you want executed any time the environment is activated
-            shellHook = '''';
+            shellHook = "";
           };
         }
       );

hosts/sin/actual.nix

@@ -0,0 +1,12 @@
+{ inputs, pkgs, ... }:
+let
+  unstable = import inputs.unstable { system = pkgs.stdenv.system; };
+in
+{
+  services.actual = {
+    package = unstable.actual-server;
+    enable = true;
+    openFirewall = true;
+    settings.port = 3001;
+  };
+}

hosts/sin/configuration.nix

@@ -17,6 +17,8 @@
     ./secrets.nix
     ./coredns
     ./copyparty.nix
+    ./trilium.nix
+    ./actual.nix
   ];
 
   boot.initrd.kernelModules = [ "usb_storage" ];
@@ -43,6 +45,8 @@
 
         3000 # gitea
 
+        config.services.trilium-server.port
+
         53
       ];
 

hosts/sin/copyparty.nix

@@ -15,8 +15,8 @@
 
     settings = {
       p = [ 8086 ];
-      e2dsa = true;
-      e2ts = true;
+      e2dsa = true; # files indexing
+      e2ts = true; # multimedia indexing
       z = true;
       qr = true;
       xff-hdr = "X-Real-IP";
@@ -25,15 +25,85 @@
       http-only = true;
       og = true;
       shr = "/shares";
+      ansi = true; # color in log messages
+      re-maxage = 60 * 60 * 12; # reindex every 12h
+
+      # idp-h-usr = "remote-user";
+      # idp-h-grp = "remote-group";
+      # idp-login = "https://auth.shobu.fr/?rd=https://files.shobu.fr";
+      # idp-logout = "https://auth.shobu.fr/";
+    };
+
+    accounts = {
+      serhao = {
+        passwordFile = config.age.secrets.copyparty-serhao.path;
+      };
     };
 
     volumes = {
-      "/media" = {
-        path = "/mnt/mediacenter/media";
+      "/movies" = {
+        path = "/mnt/mediacenter/media/movies";
         access = {
           r = "*";
         };
       };
+      "/shows" = {
+        path = "/mnt/mediacenter/media/shows";
+        access = {
+          r = "*";
+        };
+      };
+
+      "/musics" = {
+        path = "/mnt/mediacenter/media/musics";
+        access = {
+          r = "*";
+        };
+      };
+      "/mediacenter" = {
+        path = "/mnt/mediacenter/";
+        access = {
+          rw = [ "serhao" ];
+        };
+        flags = {
+          e2d = true;
+        };
+      };
+      "/data" = {
+        path = "/mnt/data";
+        access = {
+          rwd = [ "serhao" ];
+        };
+        flags = {
+          e2d = true;
+        };
+      };
+      "/dump" = {
+        path = "/mnt/data/dump";
+        access = {
+          rw = "*";
+          rwd = [ "serhao" ];
+        };
+        flags = {
+          lifetime = 86400;
+          df = "100g";
+          vmaxb = "10g";
+        };
+      };
+      "/dump/quick" = {
+        path = "/mnt/data/dump/quick";
+        access = {
+          rw = "*";
+          rwd = [ "serhao" ];
+        };
+        flags = {
+          e2ds = true;
+          pk = "gz,9";
+          lifetime = 300;
+          df = "100g";
+          vmaxb = "10g";
+        };
+      };
     };
   };
 

hosts/sin/glances.nix

@@ -4,6 +4,11 @@
     enable = true;
     openFirewall = true;
     # TODO Change secrets
-    extraArgs = [ "--webserver" ];
+    extraArgs = [
+      "--webserver"
+      "--disable-webui"
+      "--disable-plugin"
+      "processcount"
+    ];
   };
 }

hosts/sin/homepage.nix

@@ -12,7 +12,6 @@
       headerStyle = "boxed";
 
       providers = {
-        "finnhub" = "cuvq5e9r01qub8tv03g0cuvq5e9r01qub8tv03gg";
       };
 
       layout = [
@@ -38,6 +37,20 @@
             header = false;
           };
         }
+        {
+          "admin" = {
+            tab = "Admin";
+            header = false;
+            sin = {
+              style = "row";
+              columns = 3;
+            };
+            thea = {
+              style = "row";
+              columns = 3;
+            };
+          };
+        }
       ];
     };
 
@@ -56,9 +69,7 @@
       }
       {
         glances = {
-          url = "https://zimablade-admin.shobu.fr";
-          user = "shobu";
-          password = "shobu";
+          url = "http://sin.home:61208";
           version = 4;
           disk = [
             "/"
@@ -122,7 +133,7 @@
               description = "bring back your world to life";
               widget = {
                 type = "minecraft";
-                url = "udp://minecraft.shobu.fr:43001";
+                url = "udp://minecraft.shobu.fr:25665";
               };
             };
           }
@@ -154,7 +165,7 @@
                   widget = {
                     type = "jellyseerr";
                     url = "https://jellyseerr.shobu.fr";
-                    key = "MTczNzkyNzMxMzgwODk4N2FlZWJkLTQ0N2QtNGU0MS1iOWE1LTJmZmE3OTI4ZGQ5OQ==";
+                    key = "MTc0OTMzOTE2MDMwODgxNzdlYjNlLTU4N2ItNDc0Mi1iZTY4LTM3NzVhMWZiMDUzZg==";
                   };
                 };
               }
@@ -227,7 +238,7 @@
                   href = "https://transmission.shobu.fr";
                   widget = {
                     type = "transmission";
-                    url = "https://transmission.shobu.fr";
+                    url = "http://sin.home:9091";
                   };
                 };
               }
@@ -235,6 +246,152 @@
           }
         ];
       }
+      {
+        "admin" = [
+          (
+            let
+              name = "sin";
+              address = "http://sin.home:61208";
+            in
+            {
+              "${name}" = [
+                {
+                  "info" = {
+                    widget = {
+                      type = "glances";
+                      url = address;
+                      version = 4;
+                      metric = "info";
+                    };
+                  };
+                }
+                {
+                  "main storage" = {
+                    widget = {
+                      type = "glances";
+                      url = address;
+                      version = 4;
+                      metric = "fs:/mnt/fs";
+                    };
+                  };
+                }
+                {
+                  "system storage" = {
+                    widget = {
+                      type = "glances";
+                      url = address;
+                      version = 4;
+                      metric = "fs:/";
+                    };
+                  };
+                }
+                {
+                  "memory" = {
+                    widget = {
+                      type = "glances";
+                      url = address;
+                      version = 4;
+                      metric = "memory";
+                    };
+                  };
+                }
+                {
+                  "cpu" = {
+                    widget = {
+                      type = "glances";
+                      url = address;
+                      version = 4;
+                      metric = "cpu";
+                    };
+                  };
+                }
+                {
+                  "network" = {
+                    widget = {
+                      type = "glances";
+                      url = address;
+                      version = 4;
+                      metric = "network:enp2s0";
+                    };
+                  };
+                }
+              ];
+            }
+          )
+
+          (
+            let
+              name = "thea";
+              address = "http://thea.home:61208";
+            in
+            {
+              "${name}" = [
+                {
+                  "info" = {
+                    widget = {
+                      type = "glances";
+                      url = address;
+                      version = 4;
+                      metric = "info";
+                    };
+                  };
+                }
+                {
+                  "main storage" = {
+                    widget = {
+                      type = "glances";
+                      url = address;
+                      version = 4;
+                      metric = "fs:/mnt/fs";
+                    };
+                  };
+                }
+                {
+                  "system storage" = {
+                    widget = {
+                      type = "glances";
+                      url = address;
+                      version = 4;
+                      metric = "fs:/";
+                    };
+                  };
+                }
+                {
+                  "memory" = {
+                    widget = {
+                      type = "glances";
+                      url = address;
+                      version = 4;
+                      metric = "memory";
+                    };
+                  };
+                }
+                {
+                  "cpu" = {
+                    widget = {
+                      type = "glances";
+                      url = address;
+                      version = 4;
+                      metric = "cpu";
+                    };
+                  };
+                }
+                {
+                  "network" = {
+                    widget = {
+                      type = "glances";
+                      url = address;
+                      version = 4;
+                      metric = "network:enp2s0";
+                    };
+                  };
+                }
+              ];
+            }
+          )
+
+        ];
+      }
     ];
   };
 }

hosts/sin/jellyfin.nix

@@ -1,26 +1,44 @@
-{ pkgs, inputs, ... }:
+{
+  pkgs,
+  inputs,
+  ...
+}:
 let
-  unstable = import inputs.unstable { system = pkgs.system; };
+  nixpkgs-2505 = import inputs.nixpkgs-2505 {
+    system = pkgs.stdenv.system;
+    config.allowUnfree = true;
+    config.permittedInsecurePackages = [ "intel-media-sdk-23.2.2" ];
+  };
 in
 {
-  nixpkgs.config.packageOverrides = pkgs: {
-    vaapiIntel = pkgs.vaapiIntel.override { enableHybridCodec = true; };
+  systemd.services.jellyfin.environment = {
+    LIBVA_DRIVER_NAME = "iHD"; # or i965 for older GPUs
+    NEOReadDebugKeys = "1";
+    OverrideGpuAddressSpace = "48";
+  };
+  environment.sessionVariables = {
+    LIBVA_DRIVER_NAME = "iHD";
+    NEOReadDebugKeys = "1";
+    OverrideGpuAddressSpace = "48";
   };
   hardware.graphics = {
     enable = true;
     extraPackages = with pkgs; [
+      intel-ocl # Generic OpenCL support
+
+      intel-compute-runtime-legacy1
       intel-media-driver
-      intel-vaapi-driver
-      vaapiVdpau
-      intel-compute-runtime # OpenCL filter support (hardware tonemapping and subtitle burn-in)
-      vpl-gpu-rt # QSV on 11th gen or newer
-      intel-media-sdk # QSV up to 11th gen
+      nixpkgs-2505.intel-media-sdk
     ];
   };
 
+  hardware.enableRedistributableFirmware = true;
+  boot.kernelParams = [ "i915.enable_guc=3" ];
+
   nixpkgs.config.permittedInsecurePackages = [
-    "dotnet-sdk-6.0.428"
-    "aspnetcore-runtime-6.0.36"
+    # "dotnet-sdk-6.0.428"
+    # "aspnetcore-runtime-6.0.36"
+    "intel-media-sdk-23.2.2"
   ];
 
   users.users."starr" = {
@@ -54,6 +72,12 @@ in
     "transmission"
   ];
 
+  users.users.whisparr.extraGroups = [
+    "jellyfin"
+    "starr"
+    "transmission"
+  ];
+
   users.users.shobu.extraGroups = [
     "jellyfin"
     "starr"
@@ -61,47 +85,81 @@ in
     "radarr"
     "sonarr"
   ];
+  users.users.jellyfin.extraGroups = [
+    "render"
+    "video"
+  ];
 
   users.groups = {
-    starr = { };
-  };
-
-  services = {
-    jellyfin = {
-      enable = true;
-      openFirewall = true;
-    };
-
-    sonarr = {
-      enable = true;
-      openFirewall = true;
-      group = "starr";
-    };
-    radarr = {
-      enable = true;
-      openFirewall = true;
-      group = "starr";
-    };
-    prowlarr = {
-      enable = true;
-      openFirewall = true;
-    };
-    bazarr = {
-      enable = true;
-      openFirewall = true;
-    };
-    lidarr = {
-      enable = true;
-      openFirewall = true;
-      package = unstable.lidarr;
-    };
-
-    jellyseerr = {
-      enable = true;
-      openFirewall = true;
+    starr = {
+      gid = 990;
     };
   };
 
+  services =
+    let
+      mkEnvFile =
+        name:
+        (pkgs.writeText "${name}.env" ''
+          ${name}__AUTH__ENABLED=false
+          ${name}__AUTH__METHOD=External
+        '');
+    in
+    {
+      jellyfin = {
+        enable = true;
+        openFirewall = true;
+      };
+
+      sonarr = {
+        enable = true;
+        openFirewall = true;
+        group = "starr";
+        environmentFiles = [
+          (mkEnvFile "SONARR")
+        ];
+      };
+      radarr = {
+        enable = true;
+        openFirewall = true;
+        group = "starr";
+        environmentFiles = [
+          (mkEnvFile "RADARR")
+        ];
+      };
+      prowlarr = {
+        enable = true;
+        openFirewall = true;
+        environmentFiles = [
+          (mkEnvFile "PROWLARR")
+        ];
+      };
+      bazarr = {
+        enable = true;
+        openFirewall = true;
+        group = "starr";
+      };
+      lidarr = {
+        enable = true;
+        openFirewall = true;
+        environmentFiles = [
+          (mkEnvFile "LIDARR")
+        ];
+      };
+      whisparr = {
+        enable = true;
+        openFirewall = true;
+        environmentFiles = [
+          (mkEnvFile "WHISPARR")
+        ];
+      };
+
+      jellyseerr = {
+        enable = true;
+        openFirewall = true;
+      };
+    };
+
   environment.systemPackages = [
     pkgs.jellyfin
     pkgs.jellyfin-web

hosts/sin/luks-btrfs-raid.nix

@@ -7,7 +7,7 @@
       # and the actual btrfs raid on the second disk, and the name of these entries matters!
       system = {
         type = "disk";
-        device = "/dev/mmcblk0";
+        device = "/dev/sdb";
         content = {
           type = "gpt";
           partitions = {
@@ -42,6 +42,10 @@
                     "/root" = {
                       mountpoint = "/";
                     };
+                    "/nix" = {
+                      mountpoint = "/nix";
+                      mountOptions = [ "compress=zstd:3" ];
+                    };
                   };
                 };
               };
@@ -50,31 +54,9 @@
         };
       };
 
-      # data1 = {
-      #   type = "disk";
-      #   device = "/dev/sda";
-      #   content = {
-      #     type = "gpt";
-      #     partitions = {
-      #       crypt_p1 = {
-      #         size = "100%";
-      #         content = {
-      #           type = "luks";
-      #           name = "p_data1"; # device-mapper name when decrypted
-      #           # Remove settings.keyFile if you want to use interactive password entry
-      #           settings = {
-      #             allowDiscards = true;
-      #             keyFile = "/dev/disk/by-uuid/2021-07-11-12-33-27-00";
-      #             keyFileSize = 4096;
-      #           };
-      #         };
-      #       };
-      #     };
-      #   };
-      # };
       data = {
         type = "disk";
-        device = "/dev/sdc";
+        device = "/dev/sda";
         content = {
           type = "gpt";
           partitions = {
@@ -83,27 +65,6 @@
               content = {
                 type = "luks";
                 name = "p_data";
-                settings = {
-                  allowDiscards = true;
-                  keyFile = "/dev/disk/by-uuid/2021-07-11-12-33-27-00";
-                  keyFileSize = 4096;
-                };
-              };
-            };
-          };
-        };
-      };
-      data1 = {
-        type = "disk";
-        device = "/dev/sdb";
-        content = {
-          type = "gpt";
-          partitions = {
-            crypt_p = {
-              size = "100%";
-              content = {
-                type = "luks";
-                name = "p_data1";
                 # Remove settings.keyFile if you want to use interactive password entry
                 settings = {
                   allowDiscards = true;
@@ -112,19 +73,11 @@
                 };
                 content = {
                   type = "btrfs";
-                  extraArgs = [
-                    "-d raid0"
-                    "/dev/mapper/p_data3" # Use decrypted mapped device, same name as defined in disk1
-                  ];
                   subvolumes = {
                     "/" = {
                       mountpoint = "/mnt/fs";
                       mountOptions = [ "compress=zstd:3" ];
                     };
-                    "/nix" = {
-                      mountpoint = "/nix";
-                      mountOptions = [ "compress=zstd:3" ];
-                    };
 
                     "/data" = {
                       mountpoint = "/mnt/data";

hosts/sin/secrets.nix

@@ -10,5 +10,22 @@
       file = ./secrets/airvpn_wireguard_key_env.age;
       mode = "700";
     };
+    copyparty-serhao = {
+      file = ./secrets/copyparty-serhao.age;
+      mode = "700";
+      owner = "copyparty";
+    };
+    authelia-jwt = {
+      file = ./secrets/authelia-jwt.age;
+      mode = "700";
+    };
+    authelia-encryption = {
+      file = ./secrets/authelia-encryption.age;
+      mode = "700";
+    };
+    authelia-session = {
+      file = ./secrets/authelia-session.age;
+      mode = "700";
+    };
   };
 }

hosts/sin/secrets/authelia-encryption.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 /uqj4A L95rgX9APIgoMvkplZIYgMQDhKBOsPGOw/maymMhiks
+LNfa/YBCd84iknAMk4wbQps4KMXCvrhPp2d9KkhJWHI
+-> ssh-ed25519 NoSl6Q G/y6DUFTyV6Jy6KHo8yc+xxtu3aJtTOF3Ldmxq3FmyE
+FOExj321S/VIPQ/qdvZBcJ930HI/GsjDVjJp9WMSXLA
+--- iIpq/CWng+4+kQbvJQb/qgejr/eza94wCkegEJ2dvno
+ÿNôU*1=DÔOˆ£W6]_â©Kà=©*ÊÞký¦_ù˜Ýøɇ™tmË•ãw°␍æŒkˆoj^ÅUCì•ÿš£¸ðcÂ&ð=µµ‹m#ÁÅí¤>œJp<|ìx«dØ]ñ×ú¦&$

hosts/sin/secrets/authelia-jwt.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 /uqj4A i6SPCzjkGrPMjhC9NQDdYTk3fzXoD4OSQdhS1togN0A
+Lqus8sROz1O4EepauPwC4RX/qH+SnDiL2H5iZGtAhXo
+-> ssh-ed25519 NoSl6Q LxV4a5HiB6qfPjbba75dkVVECzaqrMjksMXHh53JbGQ
+x4POzurz+J2mymT81M+cu69Iv/MeiYt+JvaRteinm5Q
+--- OFqooyZ2HPBxP756PqpgJAyVOTkqhJ0LhEQsLJBZUtE
+—>»&Ȇw·\D„Au{õz{CˆÁ~á$‘_ˆ9»¢ZZ�U^„ÎÊL!(lnпÂó‰Üv{fdº 1Ýßl
¢,�|�Ü.¤çH«¤³êVaù¥ÍÓˆ™PêwOo3ž

hosts/sin/secrets/authelia-session.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 /uqj4A eff535EaT7gEZOacWx9raBJMdd4PPd9+y6Y3eOt1wBI
+5P4aefjWVJ4L11ff+Cg8j3gQ58I+agDPUMFWiCaL/sQ
+-> ssh-ed25519 NoSl6Q 3+EZtaiiZQk7JK6zCNo/nUSSRAJzf8nal2X1sFkYmxo
+f5gzpiOtCbYdiV7vOxfZvJPRmRruTbHg6T8g0r5JRgc
+--- BBL3wE2eSmHVI4tlhq+5fy84cauw6P6G69nFXuObLKE
+êéæí	@[¡SÓcñ‘�SyÉŠ‡<; í†�e±Ë茟��§(°Æž1\Yj›È¯½½4åõ Ý
ȹ.3>Â[Èq¢Jh8í·šÕVt”øX[Ì~[(#
^‘_5€§�

hosts/sin/secrets/copyparty-serhao.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 BoEq8A O6x9n4kvpqLucX7NuNeD2SsMmvT5n6aVYwo4nQt21H8
+R+4g1QuXtxovyv5Mav+mAhgGjOcGQW4q17FSBtzXZQo
+-> ssh-ed25519 NoSl6Q iKPipXfIGWxUobXF/9CSRhc/zKgmKKWWZhDTDgX0jWA
+LB4TFCdbEG0VToYzTWdFedd0duF5PKlCnpBs4nBbLAQ
+--- D7VE3Mwgx9ehk5rNuHm62S5ggQBm9wJodZa61jLEVsY
+8ÔîÐÄÒë`S«šéT¯Fª9&(½Ú²Á‡¸=~Ïáš­où».XŽ¶ž7ðV&'Øøå ÒÔ¸‹%ã î

hosts/sin/transmission.nix

@@ -86,7 +86,7 @@
           ];
           environment = {
             PUID = toString config.users.users.transmission.uid;
-            GUID = toString config.users.groups.transmission.gid;
+            PGID = toString config.users.groups.starr.gid;
             PEERPORT = peerport;
           };
         };

hosts/sin/trilium.nix

@@ -0,0 +1,10 @@
+{ ... }:
+{
+  services.trilium-server = {
+    enable = true;
+    port = 12783;
+    host = "0.0.0.0";
+    # noAuthentication = true;
+    environmentFile = "/secrets/trilium.env";
+  };
+}

hosts/thea/authelia.nix

@@ -0,0 +1,195 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}:
+let
+  cfg = config.services.authelia.instances.main;
+  dataDir = "/var/lib/authelia-${cfg.name}";
+  authelia-snippets = pkgs.callPackage ./lib/autheliaSnippets.nix { inherit pkgs; };
+in
+{
+  services.authelia.instances = {
+    main = {
+      enable = true;
+      secrets = {
+        jwtSecretFile = config.age.secrets.authelia-jwt.path;
+        storageEncryptionKeyFile = config.age.secrets.authelia-encryption.path;
+        sessionSecretFile = config.age.secrets.authelia-session.path;
+      };
+      settings = {
+        theme = "light";
+        log.level = "debug";
+
+        authentication_backend = {
+          file = {
+            path = dataDir + "/users.yml";
+          };
+        };
+        storage = {
+          local = {
+            path = dataDir + "/db.sqlite3";
+          };
+        };
+        session = {
+          cookies = [
+            {
+              domain = "shobu.fr";
+              authelia_url = "https://auth.shobu.fr";
+              default_redirection_url = "https://shobu.fr";
+            }
+          ];
+        };
+        notifier = {
+          filesystem = {
+            filename = "${dataDir}/notification.txt";
+          };
+        };
+        access_control = {
+          default_policy = "deny";
+          rules = [
+            {
+              domain = "auth.shobu.fr";
+              policy = "bypass";
+            }
+            {
+              domain = "*.shobu.fr";
+              policy = "two_factor";
+            }
+          ];
+        };
+        server = {
+          endpoints = {
+            authz = {
+              auth-request = {
+                implementation = "AuthRequest";
+              };
+            };
+          };
+        };
+        identity_providers = {
+          oidc = {
+            hmac_secret = "this_is_a_secret_abc123abc123abc"; # 64+ character secret
+            jwks = [
+              {
+                key = ''
+                  -----BEGIN PRIVATE KEY-----
+                  MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDBGxQpgV074AB1
+                  ee+JiDMxuiVooVuD8RzVISTy0tVNBFS5vydB1g5k072shMdCE8S2M4oTaW7ZG1h0
+                  A+XbgZj+wZFcdHA+lD6QRGSN03FlrRZBMv8BCKzctdgAW1Dtrho31+Nw+3jTrrbO
+                  DiQaH2kzanET0GZJ+cD3AngWYV0KCkq8yws3T8AiK4oNghyv6Amknmbf7sJ+aZ8C
+                  f8WCixiErT/TjEGKRxFTKw3LMrdrbljE8JP+f1sTpDZP6uOtH0YS0iJ4nWHvxKYH
+                  LHLzrx3rO0zBrPiXK3eAtP2baPxS5y26kJcVL5bUSbDdB3NCznZc50OO14huX2s+
+                  GVct0FsLAgMBAAECggEAAUoZTy91wXa5gn8EzQVWzj9YfJDv2Pn4/hjLmRNHFADQ
+                  gmtXfhNJiHte7qqdjB1ag8TgOcHd8oyRFmcgCs3BaL68uwEdtq/hT4FXvF37EKW+
+                  q/PyS38XNMWBIpfD+tmYGJHfzp2HsuPCz5tbSzG5qioZvMNHd4FtRXj6cGntjRAg
+                  uW1Ns2h//BajftwD8RLHOvq7lWLaPWbdbte396KNBdNpceargISf9VEJik/dPWrT
+                  jV5bNAm7chvEfjhLqFCJ/p6j7z4DLFGrhYnh50btfe9FnWRtUYAGxhfaobveDPVe
+                  AI0lFN7IFU6+G6cYHTZAtAviWIutDwK0K9ACYCo1wQKBgQDiWEIdoYvjAh2J9K8f
+                  8YWa660YuvLSYQmvimr7E9FzoFdiUeFqlVCw/SIz7mRuDDCliDFxheekc8+jJB5U
+                  kfR2C2o3llRy+wLVap6X5OmqVAjFuHXxntbK/zwyv4K5uecwtEgDyGdXW2eZDog7
+                  VohuWOD3cTDAkVFu/Mw/02/CqwKBgQDaZ/b1Rfu9QXLvgtf23PpqKb0VG6gOo/Sm
+                  bpGnEBG9sAnsvDHBs85UTxzzr0qWOSguDh5NMxd0/IxKiLDRPvshhod9rWw0T8Qh
+                  jBDYsDLBZlBT1AVKvkeELZx9DW1Iomx6bdtYRX3SkgBKVK43q17J3T37U/UJ36PQ
+                  5e1lBbDJIQKBgQDcEcP222MPTLc7stOy0zl77zlVmi8NrZulOYfapuI28ecEiWgK
+                  ITNbYkMnCtpKxT9nMowgPHmEw7VWgX+b6m0teNvFQDzLrpKKvieEt+UY3qvI0hia
+                  3D0rEg6NqPaJbd8C08ZRJ0CTByQrBJ4gU3pDD9drvnoQQTpUFybfx8waEQKBgQDL
+                  6a1FKuXyuRyaSktgjMiwPe/vuTabFLDigvEyTWqC880QXlUGSN4nEQYy7kJxJ0RA
+                  W6Ym5cDM1M4W+LA9bNQDZRszV6ti2+Z+e8tuxHNe5iuxWI7oTedvnTYx+0tBOYSW
+                  eeME8zyaUP48Z/uQtkt1pT6tXKG3ajoEW+fdHgcEgQKBgCCTnBkASe21/n+D3c02
+                  vGekM3ioWNe9heIWv/7aWmMXb14DBCZMVXNyfOe7gQs2u3OX+IBW8UscGhY2LjVV
+                  5dKLMIWHw8Afccw4isYhequmJeai2Q3SSenWc7lIqOG4FDpwkcjW0VBBaU/p7ZnA
+                  h3JJ7q49hdgOKpF/xZNwmmfI
+                  -----END PRIVATE KEY-----''; # rsa private key
+              }
+            ];
+            claims_policies = {
+              trilium = {
+                id_token = [
+                  "email"
+                  "name"
+                ];
+              };
+            };
+            clients = [
+              {
+                client_id = "trilium";
+                client_name = "Trilium Notes";
+                client_secret = "$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng";
+                public = false;
+                authorization_policy = "two_factor";
+                claims_policy = "trilium";
+                require_pkce = false;
+                pkce_challenge_method = "";
+                redirect_uris = [ "https://trilium.shobu.fr/callback" ];
+                scopes = [
+                  "openid"
+                  "profile"
+                  "email"
+                ];
+                response_types = [ "code" ];
+                grant_types = [ "authorization_code" ];
+                access_token_signed_response_alg = "none";
+                userinfo_signed_response_alg = "none";
+                token_endpoint_auth_method = "client_secret_basic";
+              }
+            ];
+          };
+        };
+      };
+    };
+  };
+
+  # systemd.tmpfiles.rules = lib.mkIf cfg.enable [
+  #   "d '${dataDir}' 0700 ${cfg.user} ${cfg.group} - -"
+  # ];
+
+  age.secrets = {
+    authelia-jwt = {
+      owner = cfg.user;
+      file = ./secrets/authelia-jwt.age;
+      mode = "700";
+    };
+    authelia-encryption = {
+      owner = cfg.user;
+      file = ./secrets/authelia-encryption.age;
+      mode = "700";
+    };
+    authelia-session = {
+      owner = cfg.user;
+      file = ./secrets/authelia-session.age;
+      mode = "700";
+    };
+  };
+
+  services.nginx = {
+    enable = true;
+    recommendedProxySettings = true;
+    recommendedTlsSettings = true;
+
+    virtualHosts."auth.shobu.fr" =
+      let
+        upstream = "http://thea:9091";
+      in
+      {
+        enableACME = true;
+        forceSSL = true;
+
+        locations."/" = {
+          proxyPass = upstream;
+          extraConfig = ''
+            error_log /var/log/nginx/debug_authelia.log debug;
+            include ${authelia-snippets.proxy};
+            set $upstream ${upstream};
+          '';
+        };
+        locations."/api/verify" = {
+          proxyPass = upstream;
+        };
+        locations."/api/authz" = {
+          proxyPass = upstream;
+        };
+      };
+  };
+}

hosts/thea/configuration.nix

@@ -16,11 +16,12 @@ in
 {
   imports = [
     ./nginx.nix
-    # ./striped
     # ./cybercoffee
-    ./ollama.nix
-    ./minecraft.nix
-    ./nix-serve.nix
+    # ./ollama.nix
+    # ./minecraft.nix
+    ./secrets
+    ./authelia.nix
+    ./glances.nix
   ];
 
   # Use the systemd-boot EFI boot loader.
@@ -37,7 +38,15 @@ in
     # dhcpcd.extraConfig = "nohook resolv.conf";
 
     firewall = {
-      allowedTCPPorts = [ nodes.sin.config.services.gitea.settings.server.SSH_PORT ];
+      allowedTCPPorts = [
+        nodes.sin.config.services.gitea.settings.server.SSH_PORT
+        993 # mail port
+      ]
+      ++ [
+        # minecraft ad hoc server ports
+        25665
+        25675
+      ];
     };
     nat = {
       enable = true;
@@ -50,6 +59,16 @@ in
           proto = "tcp";
           destination = "${sin-address}:22";
         }
+        {
+          sourcePort = 993;
+          proto = "tcp";
+          destination = "${sin-address}:993";
+        }
+        {
+          sourcePort = 8086;
+          proto = "tcp";
+          destination = "${sin-address}:8086";
+        }
       ];
     };
   };
@@ -80,13 +99,11 @@ in
   };
 
   environment.systemPackages = with pkgs; [
-    lunarvim
     wget
     httpie
     tmux
     git
     helix
-    python312
     # lemonade
   ];
 

hosts/thea/glances.nix

@@ -0,0 +1,14 @@
+{ ... }:
+{
+  services.glances = {
+    enable = true;
+    openFirewall = true;
+    # TODO Change secrets
+    extraArgs = [
+      "--webserver"
+      "--disable-webui"
+      "--disable-plugin"
+      "processcount"
+    ];
+  };
+}

hosts/thea/hardware-configuration.nix

@@ -49,7 +49,7 @@
   };
 
   fileSystems."/boot" = {
-    device = "/dev/disk/by-uuid/D1B9-8019";
+    device = "/dev/disk/by-uuid/2CF4-0109";
     fsType = "vfat";
     options = [
       "fmask=0077"

hosts/thea/lib/autheliaSnippets.nix

@@ -0,0 +1,81 @@
+{ pkgs }:
+{
+  proxy = pkgs.writeText "proxy.conf" ''
+    ## Headers
+    # proxy_set_header Host $host;
+    proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_set_header X-Forwarded-Host $http_host;
+    proxy_set_header X-Forwarded-URI $request_uri;
+    proxy_set_header X-Forwarded-Ssl on;
+    proxy_set_header X-Forwarded-For $remote_addr;
+  '';
+  authelia-location = pkgs.writeText "authelia-location.conf" ''
+    set $upstream_authelia http://192.168.1.12:9091/api/authz/auth-request;
+
+    ## Virtual endpoint created by nginx to forward auth requests.
+    location /internal/authelia/authz {
+        ## Essential Proxy Configuration
+        internal;
+        proxy_pass $upstream_authelia;
+
+        ## Headers
+        ## The headers starting with X-* are required.
+        proxy_set_header X-Original-Method $request_method;
+        proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
+        proxy_set_header X-Forwarded-For $remote_addr;
+        proxy_set_header Content-Length "";
+        proxy_set_header Connection "";
+
+        ## Basic Proxy Configuration
+        proxy_pass_request_body off;
+        proxy_next_upstream error timeout invalid_header http_500 http_502 http_503; # Timeout if the real server is dead
+        proxy_redirect http:// $scheme://;
+        proxy_http_version 1.1;
+        proxy_cache_bypass $cookie_session;
+        proxy_no_cache $cookie_session;
+        proxy_buffers 4 32k;
+        client_body_buffer_size 128k;
+
+        ## Advanced Proxy Configuration
+        send_timeout 5m;
+        proxy_read_timeout 240;
+        proxy_send_timeout 240;
+        proxy_connect_timeout 240;
+    }
+  '';
+  authelia-authrequest = pkgs.writeText "authelia-authrequest.conf" ''
+    ## Send a subrequest to Authelia to verify if the user is authenticated and has permission to access the resource.
+    auth_request /internal/authelia/authz;
+
+    ## Save the upstream metadata response headers from Authelia to variables.
+    auth_request_set $user $upstream_http_remote_user;
+    auth_request_set $groups $upstream_http_remote_groups;
+    auth_request_set $name $upstream_http_remote_name;
+    auth_request_set $email $upstream_http_remote_email;
+
+    ## Inject the metadata response headers from the variables into the request made to the backend.
+    proxy_set_header Remote-User $user;
+    proxy_set_header Remote-Groups $groups;
+    proxy_set_header Remote-Email $email;
+    proxy_set_header Remote-Name $name;
+
+    ## Configure the redirection when the authz failure occurs. Lines starting with 'Modern Method' and 'Legacy Method'
+    ## should be commented / uncommented as pairs. The modern method uses the session cookies configuration's authelia_url
+    ## value to determine the redirection URL here. It's much simpler and compatible with the mutli-cookie domain easily.
+
+    ## Modern Method: Set the $redirection_url to the Location header of the response to the Authz endpoint.
+    auth_request_set $redirection_url $upstream_http_location;
+
+    ## Modern Method: When there is a 401 response code from the authz endpoint redirect to the $redirection_url.
+    error_page 401 =302 $redirection_url;
+
+    ## Legacy Method: Set $target_url to the original requested URL.
+    ## This requires http_set_misc module, replace 'set_escape_uri' with 'set' if you don't have this module.
+    # set_escape_uri $target_url $scheme://$http_host$request_uri;
+
+    ## Legacy Method: When there is a 401 response code from the authz endpoint redirect to the portal with the 'rd'
+    ## URL parameter set to $target_url. This requires users update 'auth.shobu.fr/' with their external authelia URL.
+    # error_page 401 =302 https://auth.shobu.fr/?rd=$target_url;
+  '';
+}

hosts/thea/minecraft.nix

@@ -9,7 +9,6 @@ let
     url = "file:///${inputs.testing-grounds.modpack}/pack.toml";
     packHash = "sha256-+taYj4uroLNxM4Nia3n+5P1Y/g6dzE6Iq13TsZgk4mU=";
   };
-  reclamation = inputs.reclamation.packages.${pkgs.stdenv.system};
 in
 {
   imports = [ inputs.nix-minecraft.nixosModules.minecraft-servers ];
@@ -20,30 +19,8 @@ in
     eula = true;
     openFirewall = true;
 
-    servers.reclamation = {
-      enable = false;
-      package = pkgs.fabricServers.fabric;
-
-      symlinks = {
-        "mods" = "${reclamation.modpack}/mods";
-        "FTBLang" = "${reclamation.modpack}/FTBLang";
-        "defaultconfigs" = "${reclamation.modpack}/defaultconfigs";
-        "ressourcepacks" = "${reclamation.modpack}/ressourcepacks";
-        "config" = "${reclamation.modpack}/config";
-        "kubejs" = "${reclamation.modpack}/kubejs";
-        "patchouli_books" = "${reclamation.modpack}/patchouli_books";
-        "server.dat" = "${reclamation.modpack}/server.dat";
-      };
-
-      serverProperties = {
-        server-port = 43001;
-        motd = "all hail the gorgon v3.14";
-        allow-flight = true;
-      };
-    };
-
     servers.testing-grounds = {
-      enable = true;
+      enable = false;
 
       package = inputs.testing-grounds.packages.x86_64-linux.forge-server;
 
@@ -58,4 +35,10 @@ in
       };
     };
   };
+
+  networking.firewall.allowedTCPPorts = [
+    25865 # autismcraft
+    25665 # reclamation
+    25675 # reclamation
+  ];
 }

hosts/thea/nginx.nix

@@ -1,8 +1,15 @@
-{ inputs, ... }:
+{
+  inputs,
+  pkgs,
+  lib,
+  nodes,
+  ...
+}:
 let
   # striped-front = inputs.striped-front;
 
   sin-address = "192.168.1.14";
+  authelia-snippets = pkgs.callPackage ./lib/autheliaSnippets.nix { inherit pkgs; };
 in
 {
 
@@ -17,35 +24,93 @@ in
     recommendedProxySettings = true;
     recommendedTlsSettings = true;
 
+    typesHashMaxSize = 512;
+    mapHashMaxSize = 512;
+
     virtualHosts =
       let
-        mkStarr = host: port: {
+        mkVHost = host: port: {
           "${host}" = {
             enableACME = true;
             forceSSL = true;
 
             locations."/" = {
+              proxyPass = "http://${sin-address}:${toString port}";
+            };
+          };
+        };
+        mkStarr = host: port: {
+          "${host}" = {
+            enableACME = true;
+            forceSSL = true;
+
+            extraConfig = ''
+              include ${authelia-snippets.authelia-location};
+            '';
+
+            locations."/api" = {
               proxyPass = "http://${sin-address}:${port}";
               proxyWebsockets = true;
               extraConfig = ''
                 proxy_ssl_server_name on;
+              '';
+            };
+            locations."/" = {
+              proxyPass = "http://${sin-address}:${port}";
+              proxyWebsockets = true;
+              extraConfig = ''
+                include ${authelia-snippets.proxy};
+                include ${authelia-snippets.authelia-authrequest};
+
+                proxy_ssl_server_name on;
                 proxy_read_timeout 4800s;
               '';
             };
           };
         };
+        withAuthelia =
+          vhost: location:
+          (builtins.mapAttrs (
+            name: value:
+            (lib.recursiveUpdate value {
+              extraConfig = (if value ? extraConfig then value.extraConfig else "") + ''
+                include ${authelia-snippets.authelia-location};
+              '';
+              locations."${location}".extraConfig =
+                (
+                  if value.locations."${location}" ? extraConfig then
+                    value.locations."${location}".extraConfig
+                  else
+                    ""
+                )
+                + ''
+                  include ${authelia-snippets.proxy};
+                  include ${authelia-snippets.authelia-authrequest};
+                '';
+            })
+          ) vhost);
+        withWebsockets =
+          vhost: location:
+          (builtins.mapAttrs (
+            name: value:
+            (lib.recursiveUpdate value {
+              locations."${location}".proxyWebsockets = true;
+            })
+          ) vhost);
       in
       (
-        mkStarr "jellyfin.shobu.fr" "8096"
+        (withWebsockets (mkVHost "jellyfin.shobu.fr" "8096") "/")
         // mkStarr "radarr.shobu.fr" "7878"
         // mkStarr "sonarr.shobu.fr" "8989"
         // mkStarr "prowlarr.shobu.fr" "9696"
         // mkStarr "bazarr.shobu.fr" "6767"
-        // mkStarr "jellyseerr.shobu.fr" "5055"
-        // mkStarr "fileshelter.shobu.fr" "5091"
         // mkStarr "lidarr.shobu.fr" "8686"
-        // mkStarr "transmission.shobu.fr" "9091"
-        // mkStarr "zimablade-admin.shobu.fr" "61208"
+        // mkStarr "whisparr.shobu.fr" "6969"
+        // mkVHost "jellyseerr.shobu.fr" "5055"
+        // withAuthelia (mkVHost "transmission.shobu.fr" "9091") "/"
+        // withAuthelia (mkVHost "zimablade-admin.shobu.fr" "61208") "/"
+        // withAuthelia (mkVHost "actual.shobu.fr" nodes.sin.config.services.actual.settings.port) "/"
+        // (withWebsockets (mkVHost "trilium.shobu.fr" "12783") "/")
         // {
           "shobu.fr" = {
             enableACME = true;
@@ -102,16 +167,27 @@ in
 
             locations."/" = {
               proxyPass = "http://${sin-address}:3000";
+              extraConfig = ''
+                client_max_body_size 100M;
+              '';
             };
           };
           "files.shobu.fr" = {
             enableACME = true;
             forceSSL = true;
 
+            extraConfig = ''
+              # include ${authelia-snippets.authelia-location};
+              # error_log /var/log/nginx/debug_files.log debug;
+            '';
+
             locations."/" = {
               proxyPass = "http://${sin-address}:8086";
               extraConfig = ''
+                # include ${authelia-snippets.proxy};
+                # include ${authelia-snippets.authelia-authrequest};
                 proxy_set_header X-Real-IP $remote_addr;
+                client_max_body_size 100M;
               '';
             };
           };

hosts/thea/secrets/authelia-encryption.age

@@ -0,0 +1,10 @@
+age-encryption.org/v1
+-> ssh-ed25519 /uqj4A 9cZH/SlDpiluz2O3wCxRcBhmt3L5eN24I0HHwiJDWRU
+VVZaJlB4QzxBPcaN3MjCemjptEbqSUMD8VVtKyGezH8
+-> ssh-ed25519 70Re8Q ZFEQxmnm+dFKSXcQAc0KxkewCB59J5FyL1Ob/uEEtVg
+fRdEZpIytxjUeSKPieIzvZaAn5Mikjp28HlZhKwzS7M
+-> ssh-ed25519 QvCxGg ifsqXBKO0mqE1RuJ44Y7qDJ7lyci8iyz+J1xFgO38jI
+MkhMTZ+RttBFFMkbIaSCSQiExR1gf4OyFWHXIsx+QYQ
+--- nnMlLyQjixpBkx+bSU5I364IP3KnZ0qnmMPueBcRHpU
+ë˜�6TX—ÕÞÌfÁ““É
+®?Z7M�T�Å|ÚQf␍¢ÊËpå¹]0 Ê»¡ñwº´£� ‹ŸÇnå”!÷R{‘æ{kò:3)ÁÚøuQ±ìßkX¸1‹h•¬=æ=½

hosts/thea/secrets/authelia-session.age

@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> ssh-ed25519 /uqj4A yxpGM3pJxfnM/5q9+NzdfG2kBjjNex6bdyUeZEBKjnI
+UO6ovn2cFeNi6SbcGpfF71/OAyQccyG+l6aZXubUal8
+-> ssh-ed25519 70Re8Q GW40lmeg6Lj7ntZswT0/hWZFpYBWoV3CMq4pdo+Ncgc
+oWTYuM/s3G7EKPWPQpHbXo9Tpzgn7YlYVQHYGn4xKS8
+-> ssh-ed25519 QvCxGg pKLpxtuMIa0xPXoaeb4WeQWVEINRE/j4nrxDB1J9BUI
+1azpt5MImTiDSF+Ts9EvUCdWMeVG7lErUHSBQfMiip4
+--- IOOR8Us6zlZhJm0V4X3IlbkHSdtR3GLLxEfa4i+lqv0
+ó P¬¥rhé"BFãŽÌŸtÌ€ê¤{¾(öB`q“Óø"AµnN_ ™f*ÏŒºvPpj&{)ìŠØ@‹ÃkF«Ú
]<Aš*Á�‡�´WTm”ƪD‡,Ý1E­™”¦³eѨ·O¢š

hosts/thea/secrets/default.nix

@@ -0,0 +1,3 @@
+{ ... }:
+{
+}

modules/gitea/thea/default.nix

@@ -1,12 +1,9 @@
 {
   nodes,
-  inputs,
-  pkgs,
   ...
 }:
 let
   sin-address = "192.168.1.14";
-  unstable = import inputs.unstable { system = pkgs.system; };
 in
 {
   imports = [
@@ -19,9 +16,6 @@ in
       destination = "${sin-address}:22";
     }
   ];
-
-  services.gitea-actions-runner.package = unstable.gitea-actions-runner;
-
   # services.gitea-actions-runner.instances = {
   #   "gitea.shobu.fr-runner" = {
   #     enable = true;

modules/gitea/thea/virtualisation.nix

@@ -1,4 +1,4 @@
-{ nodes, pkgs, ... }:
+{  nodes, pkgs, ... }:
 {
   systemd.sockets.podman.socketConfig.Symlinks = [
     "/run/docker.sock"
@@ -16,6 +16,10 @@
     };
   };
 
+  environment.systemPackages = with pkgs; [
+    podman-compose
+  ];
+
   virtualisation.oci-containers.containers =
     let
       runner_config = pkgs.writeTextFile {