reactivate authelia module

use correct docker version

.gitea/workflows/deploy.yaml

@@ -5,6 +5,9 @@ on:
 
 jobs:
   deploy:
+    container:
+      volumes:
+        - /nix/store:/var/nix/hosted-store
     permissions:
       contents: read
       id-token: write
@@ -12,25 +15,23 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v4
-      - uses: DeterminateSystems/nix-installer-action@main
-      - name: Restore and save Nix store
-        uses: nix-community/cache-nix-action@v6
+      - name: setup
+        env:
+          CACHE_PRIVKEY: ${{secrets.CACHE_PRIVKEY}}
+        shell: bash
+        run: |
+          mkdir -p /var/secrets/
+          echo "$CACHE_PRIVKEY" >> /var/secrets/cache_privkey
+          mkdir -p /etc/nix
+          cp ./scripts/upload-to-cache.sh /etc/nix/
+          chmod +x /etc/nix/upload-to-cache.sh
+      - uses: cachix/install-nix-action@v31
         with:
-          # restore and save a cache using this key
-          primary-key: nix-${{ runner.os }}-${{ hashFiles('**/*.nix', '**/flake.lock') }}
-          # if there's no cache hit, restore a cache by this prefix
-          restore-prefixes-first-match: nix-${{ runner.os }}-
-          # collect garbage until the Nix store size (in bytes) is at most this number
-          # before trying to save a new cache
-          # 1G = 1073741824
-          gc-max-store-size-linux: 1G
-          # do purge caches
-          purge: true
-          # purge all versions of the cache
-          purge-prefixes: nix-${{ runner.os }}-
-          # created more than this number of seconds ago
-          purge-created: 60000
-          purge-primary-key: never
+          extra_nix_config: |
+            extra-trusted-public-keys = localhost:TiRpr2LzamX/MCKBUmFlZ8inWz94QWGL88fMEHg9Kgc=
+            extra-substituters = "local?store=/var/nix/hosted-store&priority=20"
+            secret-key-files = /var/secrets/cache_privkey
+            post-build-hook = /etc/nix/upload-to-cache.sh
       - name: Install SSH key
         uses: shimataro/ssh-key-action@v2
         with:

flake.lock

@@ -49,11 +49,11 @@
         "nixpkgs": "nixpkgs_3"
       },
       "locked": {
-        "lastModified": 1762095388,
-        "narHash": "sha256-7Q8LtcvKWHbP8znARRTOY2tpU5WoV6FHwp5TZJOI8Us=",
+        "lastModified": 1768336726,
+        "narHash": "sha256-Os4qn0S0bv7MauXGz16ozyOYZuMrA2FJuXNjDnr5yps=",
         "owner": "9001",
         "repo": "copyparty",
-        "rev": "ac085b8149ff50e03d260128596dd130ed1c7cae",
+        "rev": "c46cd7f57a8ae3b121866485c91ec078c4dd970e",
         "type": "github"
       },
       "original": {
@@ -91,11 +91,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1762276996,
-        "narHash": "sha256-TtcPgPmp2f0FAnc+DMEw4ardEgv1SGNR3/WFGH0N19M=",
+        "lastModified": 1766150702,
+        "narHash": "sha256-P0kM+5o+DKnB6raXgFEk3azw8Wqg5FL6wyl9jD+G5a4=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "af087d076d3860760b3323f6b583f4d828c1ac17",
+        "rev": "916506443ecd0d0b4a0f4cf9d40a3c22ce39b378",
         "type": "github"
       },
       "original": {
@@ -233,11 +233,11 @@
         "nixpkgs": "nixpkgs_4"
       },
       "locked": {
-        "lastModified": 1762826586,
-        "narHash": "sha256-KlPcXOxxyv+KNcf7yNFQ4DGVFbOpITqHfvMcAUYrL7E=",
+        "lastModified": 1767838769,
+        "narHash": "sha256-KCLU6SUU80tEBKIVZsBrSjRYX6kn1eVIYI3fEEqOp24=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "1a4fa22ec6e9f2ece24fca273352463b75f6f7c0",
+        "rev": "4da21f019f6443f513f16af7f220ba4db1cdfc04",
         "type": "github"
       },
       "original": {
@@ -311,11 +311,11 @@
     },
     "nixpkgs_5": {
       "locked": {
-        "lastModified": 1762756533,
-        "narHash": "sha256-HiRDeUOD1VLklHeOmaKDzf+8Hb7vSWPVFcWwaTrpm+U=",
+        "lastModified": 1767313136,
+        "narHash": "sha256-16KkgfdYqjaeRGBaYsNrhPRRENs0qzkQVUooNHtoy2w=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "c2448301fb856e351aab33e64c33a3fc8bcf637d",
+        "rev": "ac62194c3917d5f474c1a844b6fd6da2db95077d",
         "type": "github"
       },
       "original": {
@@ -452,11 +452,11 @@
     },
     "unstable": {
       "locked": {
-        "lastModified": 1762596750,
-        "narHash": "sha256-rXXuz51Bq7DHBlfIjN7jO8Bu3du5TV+3DSADBX7/9YQ=",
+        "lastModified": 1768127708,
+        "narHash": "sha256-1Sm77VfZh3mU0F5OqKABNLWxOuDeHIlcFjsXeeiPazs=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "b6a8526db03f735b89dd5ff348f53f752e7ddc8e",
+        "rev": "ffbc9f8cbaacfb331b6017d5a5abb21a492c9a38",
         "type": "github"
       },
       "original": {

flake.nix

@@ -18,15 +18,14 @@
     nix-minecraft.url = "github:Infinidoge/nix-minecraft";
     testing-grounds.url = "gitlab:shobu13/testing-grounds";
     shoblog-front.url = "gitlab:shobu13/shoblog";
-    # striped-front.url = "git+ssh://git@gitlab.com/striped1/striped-front";
-    # striped-back.url = "git+ssh://git@gitlab.com/striped1/striped-back";
 
     copyparty.url = "github:9001/copyparty";
 
   };
 
   # Flake outputs
-  outputs = inputs@{
+  outputs =
+    inputs@{
       self,
 
       nixpkgs,
@@ -52,11 +51,36 @@
       ];
 
       # Helper to provide system-specific attributes
-      forEachSupportedSystem = f: inputs.nixpkgs.lib.genAttrs supportedSystems (system: f {
+      forEachSupportedSystem =
+        f:
+        inputs.nixpkgs.lib.genAttrs supportedSystems (
+          system:
+          f {
             pkgs = import inputs.nixpkgs { inherit system; };
-      });
+          }
+        );
     in
     {
+      nixosConfigurations = {
+        sin = nixpkgs.lib.nixosSystem {
+          system = "x86_64-linux";
+
+          modules = [
+            disko.nixosModules.disko
+            agenix.nixosModules.default
+            ./hosts/sin/configuration.nix
+            ./hosts/sin/hardware-configuration.nix
+          ]
+          ++ [
+            # modules
+            ./modules/gitea/sin
+          ];
+
+          specialArgs = {
+            inherit inputs;
+          };
+        };
+      };
       colmenaHive = colmena.lib.makeHive {
         meta = {
           nixpkgs = import nixpkgs {
@@ -69,11 +93,20 @@
           };
         };
 
-        thea = {name, nodes, pkgs, ...}: {
+        thea =
+          {
+            name,
+            nodes,
+            pkgs,
+            ...
+          }:
+          {
             imports = [
+              agenix.nixosModules.default
               ./hosts/${name}/configuration.nix
               ./hosts/${name}/hardware-configuration.nix
-          ] ++ [
+            ]
+            ++ [
               # modules
               ./modules/gitea/${name}
             ];
@@ -81,37 +114,54 @@
             deployment.targetHost = "192.168.1.12";
           };
 
-        sin = {name, nodes, pkgs, ...}: {
+        sin =
+          {
+            name,
+            nodes,
+            pkgs,
+            ...
+          }:
+          {
             imports = [
               disko.nixosModules.disko
               agenix.nixosModules.default
               ./hosts/${name}/configuration.nix
               ./hosts/${name}/hardware-configuration.nix
-          ] ++ [
+            ]
+            ++ [
               # modules
               ./modules/gitea/${name}
             ];
 
             deployment.targetHost = "192.168.1.14";
+            deployment.allowLocalDeployment = true;
           };
       };
-      devShells = forEachSupportedSystem ({ pkgs }: {
+      devShells = forEachSupportedSystem (
+        { pkgs }:
+        {
           default = pkgs.mkShell {
             # The Nix packages provided in the environment
             # Add any you need here
-          packages = with pkgs; [ colmena.packages.${pkgs.system}.colmena ];
+            packages = with pkgs; [
+              colmena.packages.${pkgs.stdenv.system}.colmena
+              agenix.packages.${pkgs.stdenv.system}.agenix
+            ];
 
             # Set any environment variables for your dev shell
             env = { };
 
             # Add any shell logic you want executed any time the environment is activated
-          shellHook = ''
-          '';
-        };
-      });
-
-      packages = forEachSupportedSystem ({pkgs}: {
-        inherit (colmena.packages."${pkgs.system}") colmena;
-      });
+            shellHook = '''';
+          };
+        }
+      );
+
+      packages = forEachSupportedSystem (
+        { pkgs }:
+        {
+          inherit (colmena.packages."${pkgs.system}") colmena;
+        }
+      );
     };
 }

hosts/sin/configuration.nix

@@ -2,6 +2,7 @@
   modulesPath,
   lib,
   pkgs,
+  config,
   ...
 }:
 {
@@ -16,6 +17,7 @@
     ./secrets.nix
     ./coredns
     ./copyparty.nix
+    # ./trilium.nix
   ];
 
   boot.initrd.kernelModules = [ "usb_storage" ];
@@ -51,18 +53,25 @@
 
   time.timeZone = "Europe/Paris";
 
-  nix.settings.experimental-features = [ "nix-command" "flakes" ];
+  nix.settings.experimental-features = [
+    "nix-command"
+    "flakes"
+  ];
   nixpkgs.config.allowUnfree = true;
 
   users.users = {
     zimablade = {
       isNormalUser = true;
       extraGroups = [ "wheel" ];
-      openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKsu+4S+BHmypQTq2IR9y+ihvbF7sXbBznKtIjVAeHJ1 shobu@nixos" ];
+      openssh.authorizedKeys.keys = [
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKsu+4S+BHmypQTq2IR9y+ihvbF7sXbBznKtIjVAeHJ1 shobu@nixos"
+      ];
     };
     shobu = {
       isNormalUser = true;
-      openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKsu+4S+BHmypQTq2IR9y+ihvbF7sXbBznKtIjVAeHJ1 shobu@nixos" ];
+      openssh.authorizedKeys.keys = [
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKsu+4S+BHmypQTq2IR9y+ihvbF7sXbBznKtIjVAeHJ1 shobu@nixos"
+      ];
     };
   };
 
@@ -71,10 +80,12 @@
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKsu+4S+BHmypQTq2IR9y+ihvbF7sXbBznKtIjVAeHJ1 shobu@nixos"
   ];
 
-  environment.systemPackages = map lib.lowPrio [
+  environment.systemPackages =
+    map lib.lowPrio [
       pkgs.curl
       pkgs.gitMinimal
-  ] ++ (with pkgs; [
+    ]
+    ++ (with pkgs; [
       helix
       httpie
       btop

hosts/sin/copyparty.nix

@@ -1,29 +1,76 @@
-{inputs, pkgs, ...}: {
+{
+  inputs,
+  pkgs,
+  config,
+  ...
+}:
+{
   imports = [ inputs.copyparty.nixosModules.default ];
   nixpkgs.overlays = [ inputs.copyparty.overlays.default ];
   environment.systemPackages = [ pkgs.copyparty ];
   services.copyparty = {
     enable = true;
 
+    group = "starr";
+
     settings = {
       p = [ 8086 ];
       e2dsa = true;
       e2ts = true;
       z = true;
       qr = true;
+      xff-hdr = "X-Real-IP";
       xff-src = "lan";
+      rproxy = 1;
       http-only = true;
       og = true;
       shr = "/shares";
     };
 
+    accounts = {
+      serhao = {
+        passwordFile = config.age.secrets.copyparty-serhao.path;
+      };
+    };
+
     volumes = {
-      "/media" = {
-        path = "/mnt/mediacenter/media";
+      "/movies" = {
+        path = "/mnt/mediacenter/media/movies";
         access = {
           r = "*";
         };
       };
+      "/shows" = {
+        path = "/mnt/mediacenter/media/shows";
+        access = {
+          r = "*";
+        };
+      };
+
+      "/musics" = {
+        path = "/mnt/mediacenter/media/musics";
+        access = {
+          r = "*";
+        };
+      };
+      "/mediacenter" = {
+        path = "/mnt/mediacenter/media";
+        access = {
+          rw = ["serhao"];
+        };
+        flags = {
+          e2d = true;
+        };
+      };
+      "/data" = {
+        path = "/mnt/data";
+        access = {
+          rwd = ["serhao"];
+        };
+        flags = {
+          e2d = true;
+        };
+      };
     };
   };
 

hosts/sin/coredns/default.nix

@@ -1,4 +1,5 @@
-{...}: {
+{ ... }:
+{
   services.coredns = {
     enable = false;
     config = ''

hosts/sin/flake.nix

@@ -14,7 +14,15 @@
   };
 
   # Flake outputs
-    outputs = inputs@{ self, nixpkgs, disko, unstable, agenix, ... }:
+  outputs =
+    inputs@{
+      self,
+      nixpkgs,
+      disko,
+      unstable,
+      agenix,
+      ...
+    }:
     let
       # The systems supported for this flake
       supportedSystems = [
@@ -22,9 +30,14 @@
       ];
 
       # Helper to provide system-specific attributes
-      forEachSupportedSystem = f: nixpkgs.lib.genAttrs supportedSystems (system: f {
+      forEachSupportedSystem =
+        f:
+        nixpkgs.lib.genAttrs supportedSystems (
+          system:
+          f {
             pkgs = import nixpkgs { inherit system; };
-      });
+          }
+        );
     in
     {
       nixosConfigurations.zimablade = nixpkgs.lib.nixosSystem {
@@ -40,15 +53,21 @@
         };
       };
 
-      devShells = forEachSupportedSystem ({ pkgs }: {
+      devShells = forEachSupportedSystem (
+        { pkgs }:
+        {
           default = pkgs.mkShell {
             # The Nix packages provided in the environment
             # Add any you need here
-          packages = with pkgs; [ pkgs.disko nixos-anywhere ];
+            packages = with pkgs; [
+              pkgs.disko
+              nixos-anywhere
+            ];
 
             # Add any shell logic you want executed any time the environment is activated
             shellHook = '''';
           };
-      });
+        }
+      );
     };
 }

hosts/sin/glances.nix

@@ -1,4 +1,5 @@
-{...}: {
+{ ... }:
+{
   services.glances = {
     enable = true;
     openFirewall = true;

hosts/sin/hardware-configuration.nix

@@ -1,14 +1,27 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
 
 {
-  imports =
-    [ (modulesPath + "/installer/scan/not-detected.nix")
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
   ];
 
-  boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "usb_storage" "usbhid" "sd_mod" "sdhci_pci" ];
+  boot.initrd.availableKernelModules = [
+    "ahci"
+    "xhci_pci"
+    "usb_storage"
+    "usbhid"
+    "sd_mod"
+    "sdhci_pci"
+  ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ "kvm-intel" ];
   boot.extraModulePackages = [ ];

hosts/sin/homepage.nix

@@ -117,6 +117,15 @@
               };
             };
           }
+          {
+            "reclamation" = {
+              description = "bring back your world to life";
+              widget = {
+                type = "minecraft";
+                url = "udp://minecraft.shobu.fr:25665";
+              };
+            };
+          }
         ];
       }
       {

hosts/sin/jellyfin.nix

@@ -1,6 +1,8 @@
-{pkgs, inputs, ...}: let
+{ pkgs, inputs, ... }:
+let
   unstable = import inputs.unstable { system = pkgs.system; };
-in {
+in
+{
   nixpkgs.config.packageOverrides = pkgs: {
     vaapiIntel = pkgs.vaapiIntel.override { enableHybridCodec = true; };
   };
@@ -27,13 +29,44 @@ in {
     extraGroups = [ "jellyfin" ];
   };
 
-  users.users.sonarr.extraGroups = ["jellyfin" "radarr" "transmission" "starr"];
-  users.users.radarr.extraGroups = ["jellyfin" "sonarr" "transmission" "starr"];
-  users.users.bazarr.extraGroups = ["jellyfin" "sonarr" "transmission" "starr" "radarr"];
-  users.users.lidarr.extraGroups = ["jellyfin" "starr" "transmission"];
+  users.users.sonarr.extraGroups = [
+    "jellyfin"
+    "radarr"
+    "transmission"
+    "starr"
+  ];
+  users.users.radarr.extraGroups = [
+    "jellyfin"
+    "sonarr"
+    "transmission"
+    "starr"
+  ];
+  users.users.bazarr.extraGroups = [
+    "jellyfin"
+    "sonarr"
+    "transmission"
+    "starr"
+    "radarr"
+  ];
+  users.users.lidarr.extraGroups = [
+    "jellyfin"
+    "starr"
+    "transmission"
+  ];
 
-  users.users.shobu.extraGroups = [ "jellyfin" "starr" "transmission" "radarr" "sonarr" ];
+  users.users.whisparr.extraGroups = [
+    "jellyfin"
+    "starr"
+    "transmission"
+  ];
 
+  users.users.shobu.extraGroups = [
+    "jellyfin"
+    "starr"
+    "transmission"
+    "radarr"
+    "sonarr"
+  ];
 
   users.groups = {
     starr = { };
@@ -49,6 +82,9 @@ in {
       enable = true;
       openFirewall = true;
       group = "starr";
+      settings = {
+        authentication.AuthenticationMethod = "external";
+      };
     };
     radarr = {
       enable = true;
@@ -66,7 +102,10 @@ in {
     lidarr = {
       enable = true;
       openFirewall = true;
-      package = unstable.lidarr;
+    };
+    whisparr = {
+      enable = true;
+      openFirewall = true;
     };
 
     jellyseerr = {

hosts/sin/luks-btrfs-raid.nix

@@ -1,4 +1,5 @@
-{...}: {
+{ ... }:
+{
   disko.devices = {
     disk = {
       # Devices will be mounted and formatted in alphabetical order, and btrfs can only mount raids
@@ -6,7 +7,7 @@
       # and the actual btrfs raid on the second disk, and the name of these entries matters!
       system = {
         type = "disk";
-        device = "/dev/mmcblk0";
+        device = "/dev/sdb";
         content = {
           type = "gpt";
           partitions = {
@@ -41,6 +42,10 @@
                     "/root" = {
                       mountpoint = "/";
                     };
+                    "/nix" = {
+                      mountpoint = "/nix";
+                      mountOptions = [ "compress=zstd:3" ];
+                    };
                   };
                 };
               };
@@ -49,39 +54,17 @@
         };
       };
 
-      data1 = {
+      data = {
         type = "disk";
         device = "/dev/sda";
         content = {
           type = "gpt";
           partitions = {
-            crypt_p1 = {
+            crypt_p = {
               size = "100%";
               content = {
                 type = "luks";
-                name = "p_data1"; # device-mapper name when decrypted
-                # Remove settings.keyFile if you want to use interactive password entry
-                settings = {
-                  allowDiscards = true;
-                  keyFile = "/dev/disk/by-uuid/2021-07-11-12-33-27-00";
-                  keyFileSize = 4096;
-                };
-              };
-            };
-          };
-        };
-      };
-      data2 = {
-        type = "disk";
-        device = "/dev/sdb";
-        content = {
-          type = "gpt";
-          partitions = {
-            crypt_p2 = {
-              size = "100%";
-              content = {
-                type = "luks";
-                name = "p_data2";
+                name = "p_data";
                 # Remove settings.keyFile if you want to use interactive password entry
                 settings = {
                   allowDiscards = true;
@@ -90,19 +73,11 @@
                 };
                 content = {
                   type = "btrfs";
-                  extraArgs = [
-                    "-d raid0"
-                    "/dev/mapper/p_data1" # Use decrypted mapped device, same name as defined in disk1
-                  ];
                   subvolumes = {
                     "/" = {
                       mountpoint = "/mnt/fs";
                       mountOptions = [ "compress=zstd:3" ];
                     };
-                    "/nix" = {
-                      mountpoint = "/nix";
-                      mountOptions = [ "compress=zstd:3" ];
-                    }; 
 
                     "/data" = {
                       mountpoint = "/mnt/data";

hosts/sin/matrix.nix

@@ -26,7 +26,10 @@
     '';
   };
 
-  networking.firewall.allowedTCPPorts = [ 8008 8448 ];
+  networking.firewall.allowedTCPPorts = [
+    8008
+    8448
+  ];
 
   services.matrix-synapse = {
     enable = true;
@@ -45,7 +48,10 @@
           x_forwarded = true;
           resources = [
             {
-              names = [ "client" "federation" ];
+              names = [
+                "client"
+                "federation"
+              ];
               compress = true;
             }
           ];

hosts/sin/ollama.nix

@@ -0,0 +1,21 @@
+{ inputs, ... }:
+{
+  # virtualisation.docker = {
+  #   enable = true;
+  #   storageDriver = "btrfs";
+  # };
+
+  services.ollama = {
+    enable = true;
+    openFirewall = true;
+    loadModels = [ ];
+    acceleration = "cuda";
+  };
+
+  services.open-webui = {
+    enable = true;
+    openFirewall = true;
+    host = "0.0.0.0";
+    port = 8050;
+  };
+}

hosts/sin/secrets.nix

@@ -1,4 +1,5 @@
-{...}: {
+{ ... }:
+{
   age.secrets = {
     # captcha = {
     #   file = ./secrets/matrix_captcha.age;
@@ -9,5 +10,22 @@
       file = ./secrets/airvpn_wireguard_key_env.age;
       mode = "700";
     };
+    copyparty-serhao = {
+      file = ./secrets/copyparty-serhao.age;
+      mode = "700";
+      owner = "copyparty";
+    };
+    authelia-jwt = {
+      file = ./secrets/authelia-jwt.age;
+      mode = "700";
+    };
+    authelia-encryption = {
+      file = ./secrets/authelia-encryption.age;
+      mode = "700";
+    };
+    authelia-session = {
+      file = ./secrets/authelia-session.age;
+      mode = "700";
+    };
   };
 }

hosts/sin/secrets/authelia-encryption.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 /uqj4A L95rgX9APIgoMvkplZIYgMQDhKBOsPGOw/maymMhiks
+LNfa/YBCd84iknAMk4wbQps4KMXCvrhPp2d9KkhJWHI
+-> ssh-ed25519 NoSl6Q G/y6DUFTyV6Jy6KHo8yc+xxtu3aJtTOF3Ldmxq3FmyE
+FOExj321S/VIPQ/qdvZBcJ930HI/GsjDVjJp9WMSXLA
+--- iIpq/CWng+4+kQbvJQb/qgejr/eza94wCkegEJ2dvno
+ÿNôU*1=DÔOˆ£W6]_â©Kà=©*ÊÞký¦_ù˜Ýøɇ™tmË•ãw°

hosts/sin/secrets/authelia-jwt.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 /uqj4A i6SPCzjkGrPMjhC9NQDdYTk3fzXoD4OSQdhS1togN0A
+Lqus8sROz1O4EepauPwC4RX/qH+SnDiL2H5iZGtAhXo
+-> ssh-ed25519 NoSl6Q LxV4a5HiB6qfPjbba75dkVVECzaqrMjksMXHh53JbGQ
+x4POzurz+J2mymT81M+cu69Iv/MeiYt+JvaRteinm5Q
+--- OFqooyZ2HPBxP756PqpgJAyVOTkqhJ0LhEQsLJBZUtE
+—>»&Ȇw·\D„Au{õz{CˆÁ~á$‘_ˆ9»¢ZZ<5A>U^„ÎÊL!(lnпÂó‰Üv{fdº 1Ýßl
¢,<2C>|<7C>Ü.¤çH«¤³êVaù¥ÍÓˆ™PêwOo3ž

hosts/sin/secrets/authelia-session.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 /uqj4A eff535EaT7gEZOacWx9raBJMdd4PPd9+y6Y3eOt1wBI
+5P4aefjWVJ4L11ff+Cg8j3gQ58I+agDPUMFWiCaL/sQ
+-> ssh-ed25519 NoSl6Q 3+EZtaiiZQk7JK6zCNo/nUSSRAJzf8nal2X1sFkYmxo
+f5gzpiOtCbYdiV7vOxfZvJPRmRruTbHg6T8g0r5JRgc
+--- BBL3wE2eSmHVI4tlhq+5fy84cauw6P6G69nFXuObLKE
+êéæí	@[¡SÓcñ‘<C3B1>SyÉŠ‡<; í†<C3AD>e±Ë茟<C592><C5B8>§(°Æž1\Yj›È¯½½4åõ Ý
ȹ.3>Â[Èq¢Jh8í·šÕVt”øX[Ì~[(#
^‘_5€§<E282AC>

hosts/sin/secrets/copyparty-serhao.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 BoEq8A O6x9n4kvpqLucX7NuNeD2SsMmvT5n6aVYwo4nQt21H8
+R+4g1QuXtxovyv5Mav+mAhgGjOcGQW4q17FSBtzXZQo
+-> ssh-ed25519 NoSl6Q iKPipXfIGWxUobXF/9CSRhc/zKgmKKWWZhDTDgX0jWA
+LB4TFCdbEG0VToYzTWdFedd0duF5PKlCnpBs4nBbLAQ
+--- D7VE3Mwgx9ehk5rNuHm62S5ggQBm9wJodZa61jLEVsY
+8ÔîÐÄÒë`S«šéT¯Fª9&(½Ú²Á‡¸=~Ïáš­où».XŽ¶ž7ðV&'Øøå ÒÔ¸‹%ã î

hosts/sin/transmission.nix

@@ -1,4 +1,10 @@
-{config, ...}: {
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+{
 
   users.users."starr" = {
     extraGroups = [ "transmission" ];
@@ -14,9 +20,28 @@
     transmission.gid = 989;
   };
 
-  virtualisation.oci-containers = let
+  # systemd.services = {
+  #   docker-transmission-network = {
+  #     after = [
+  #       "network.target"
+  #       "docker-gluetun.service"
+  #       "docker-transmission.service"
+  #     ];
+  #     wantedBy = [
+  #       "docker-gluetun.service"
+  #       "docker-transmission.service"
+  #     ];
+  #     serviceConfig = {
+  #       ExecStart = "${lib.getExe pkgs.docker} network create docker-transmission; exit 0";
+  #     };
+  #   };
+  # };
+
+  virtualisation.oci-containers =
+    let
       peerport = "63369";
-  in {
+    in
+    {
       backend = "docker";
       containers = {
         gluetun = {
@@ -36,6 +61,7 @@
           extraOptions = [
             "--cap-add=NET_ADMIN"
             "--device=/dev/net/tun"
+            # "--network=docker-transmission"
           ];
           ports = [
             "13277:13277"

hosts/sin/trilium.nix

@@ -0,0 +1 @@
+{ ... }: { }

hosts/thea/authelia.nix

@@ -0,0 +1,122 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}:
+let
+  cfg = config.services.authelia.instances.main;
+  dataDir = "/var/lib/authelia-${cfg.name}";
+  authelia-snippets = pkgs.callPackage ./lib/autheliaSnippets.nix { inherit pkgs; };
+in
+{
+  services.authelia.instances = {
+    main = {
+      enable = true;
+      secrets = {
+        jwtSecretFile = config.age.secrets.authelia-jwt.path;
+        storageEncryptionKeyFile = config.age.secrets.authelia-encryption.path;
+        sessionSecretFile = config.age.secrets.authelia-session.path;
+      };
+      settings = {
+        theme = "light";
+        log.level = "debug";
+
+        authentication_backend = {
+          file = {
+            path = dataDir + "/users.yml";
+          };
+        };
+        storage = {
+          local = {
+            path = dataDir + "/db.sqlite3";
+          };
+        };
+        session = {
+          cookies = [
+            {
+              domain = "shobu.fr";
+              authelia_url = "https://auth.shobu.fr";
+              default_redirection_url = "https://shobu.fr";
+            }
+          ];
+        };
+        notifier = {
+          filesystem = {
+            filename = "${dataDir}/notification.txt";
+          };
+        };
+        access_control = {
+          default_policy = "deny";
+          rules = [
+            {
+              domain = "*.shobu.fr";
+              policy = "one_factor";
+            }
+          ];
+        };
+        server = {
+          endpoints = {
+            authz = {
+              auth-request = {
+                implementation = "AuthRequest";
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+
+  # systemd.tmpfiles.rules = lib.mkIf cfg.enable [
+  #   "d '${dataDir}' 0700 ${cfg.user} ${cfg.group} - -"
+  # ];
+
+  age.secrets = {
+    authelia-jwt = {
+      owner = cfg.user;
+      file = ./secrets/authelia-jwt.age;
+      mode = "700";
+    };
+    authelia-encryption = {
+      owner = cfg.user;
+      file = ./secrets/authelia-encryption.age;
+      mode = "700";
+    };
+    authelia-session = {
+      owner = cfg.user;
+      file = ./secrets/authelia-session.age;
+      mode = "700";
+    };
+  };
+
+  services.nginx = {
+    enable = true;
+    recommendedProxySettings = true;
+    recommendedTlsSettings = true;
+
+    virtualHosts."auth.shobu.fr" =
+      let
+        upstream = "http://thea:9091";
+      in
+      {
+        enableACME = true;
+        forceSSL = true;
+
+        locations."/" = {
+          proxyPass = upstream;
+          extraConfig = ''
+            error_log /var/log/nginx/debug_authelia.log debug;
+            include ${authelia-snippets.proxy};
+            set $upstream ${upstream};
+          '';
+        };
+        locations."/api/verify" = {
+          proxyPass = upstream;
+        };
+        locations."/api/authz" = {
+          proxyPass = upstream;
+        };
+      };
+  };
+}

hosts/thea/configuration.nix

@@ -2,19 +2,25 @@
 # your system. Help is available in the configuration.nix(5) man page, on
 # https://search.nixos.org/options and in the NixOS manual (`nixos-help`).
 
-{ config, lib, pkgs, nodes, ... }:let
+{
+  config,
+  lib,
+  pkgs,
+  nodes,
+  ...
+}:
+let
   sin-address = "192.168.1.14";
 in
 
 {
-  imports =
-    [
+  imports = [
     ./nginx.nix
-      # ./striped
     # ./cybercoffee
     ./ollama.nix
     ./minecraft.nix
-      # ./shares.nix
+    ./secrets
+    ./authelia.nix
   ];
 
   # Use the systemd-boot EFI boot loader.
@@ -31,24 +37,36 @@ in
     # dhcpcd.extraConfig = "nohook resolv.conf";
 
     firewall = {
-      allowedTCPPorts = [ nodes.sin.config.services.gitea.settings.server.SSH_PORT ];
+      allowedTCPPorts = [
+        nodes.sin.config.services.gitea.settings.server.SSH_PORT
+      ]
+      ++ [
+        # minecraft ad hoc server ports
+        25665
+        25675
+      ];
     };
     nat = {
       enable = true;
       internalInterfaces = [ "enp1s0" ];
       externalInterface = "enp1s0";
-      forwardPorts = [ {
+      forwardPorts = [
+        {
           # TODO refactor this in the gitea/n100 module
           sourcePort = nodes.sin.config.services.gitea.settings.server.SSH_PORT;
           proto = "tcp";
           destination = "${sin-address}:22";
-      } ];
+        }
+      ];
     };
   };
 
   time.timeZone = "Europe/Paris";
 
-  nix.settings.experimental-features = [ "nix-command" "flakes" ];
+  nix.settings.experimental-features = [
+    "nix-command"
+    "flakes"
+  ];
   nixpkgs.config.allowUnfree = true;
 
   users.users.n100 = {
@@ -57,14 +75,17 @@ in
     packages = with pkgs; [
     ];
 
-    openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKsu+4S+BHmypQTq2IR9y+ihvbF7sXbBznKtIjVAeHJ1 shobu@nixos" ];
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKsu+4S+BHmypQTq2IR9y+ihvbF7sXbBznKtIjVAeHJ1 shobu@nixos"
+    ];
   };
 
   users.users.root = {
-    openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKsu+4S+BHmypQTq2IR9y+ihvbF7sXbBznKtIjVAeHJ1 shobu@nixos" ];
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKsu+4S+BHmypQTq2IR9y+ihvbF7sXbBznKtIjVAeHJ1 shobu@nixos"
+    ];
   };
 
-
   environment.systemPackages = with pkgs; [
     lunarvim
     wget
@@ -112,4 +133,3 @@ in
   system.stateVersion = "24.11"; # Did you read the comment?
 
 }
-

hosts/thea/cybercoffee/halflife.nix

@@ -1,2 +1 @@
-
 { ... }: { }

hosts/thea/flake.nix

@@ -12,7 +12,8 @@
   };
 
   # Flake outputs
-  outputs = inputs@{
+  outputs =
+    inputs@{
       self,
       nixpkgs,
       nix-minecraft,

hosts/thea/hardware-configuration.nix

@@ -1,46 +1,60 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
 
 {
-  imports =
-    [ (modulesPath + "/installer/scan/not-detected.nix")
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
   ];
 
-  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "sd_mod" "sdhci_pci" ];
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "ahci"
+    "sd_mod"
+    "sdhci_pci"
+  ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ "kvm-intel" ];
   boot.extraModulePackages = [ ];
 
-  fileSystems."/" =
-    { device = "/dev/disk/by-uuid/09c733e4-b0df-4416-977b-50d9feb225fc";
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/09c733e4-b0df-4416-977b-50d9feb225fc";
     fsType = "btrfs";
     options = [ "subvol=root" ];
   };
 
-  fileSystems."/nix" =
-    { device = "/dev/disk/by-uuid/09c733e4-b0df-4416-977b-50d9feb225fc";
+  fileSystems."/nix" = {
+    device = "/dev/disk/by-uuid/09c733e4-b0df-4416-977b-50d9feb225fc";
     fsType = "btrfs";
     options = [ "subvol=nix" ];
   };
 
-  fileSystems."/home" =
-    { device = "/dev/disk/by-uuid/09c733e4-b0df-4416-977b-50d9feb225fc";
+  fileSystems."/home" = {
+    device = "/dev/disk/by-uuid/09c733e4-b0df-4416-977b-50d9feb225fc";
     fsType = "btrfs";
     options = [ "subvol=home" ];
   };
 
-  fileSystems."/swap" =
-    { device = "/dev/disk/by-uuid/09c733e4-b0df-4416-977b-50d9feb225fc";
+  fileSystems."/swap" = {
+    device = "/dev/disk/by-uuid/09c733e4-b0df-4416-977b-50d9feb225fc";
     fsType = "btrfs";
     options = [ "subvol=swap" ];
   };
 
-  fileSystems."/boot" =
-    { device = "/dev/disk/by-uuid/D1B9-8019";
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/D1B9-8019";
     fsType = "vfat";
-      options = [ "fmask=0077" "dmask=0077" ];
+    options = [
+      "fmask=0077"
+      "dmask=0077"
+    ];
   };
 
   swapDevices = [ ];

hosts/thea/lib/autheliaSnippets.nix

@@ -0,0 +1,81 @@
+{ pkgs }:
+{
+  proxy = pkgs.writeText "proxy.conf" ''
+    ## Headers
+    proxy_set_header Host $host;
+    proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_set_header X-Forwarded-Host $http_host;
+    proxy_set_header X-Forwarded-URI $request_uri;
+    proxy_set_header X-Forwarded-Ssl on;
+    proxy_set_header X-Forwarded-For $remote_addr;
+  '';
+  authelia-location = pkgs.writeText "authelia-location.conf" ''
+    set $upstream_authelia http://192.168.1.12:9091/api/authz/auth-request;
+
+    ## Virtual endpoint created by nginx to forward auth requests.
+    location /internal/authelia/authz {
+        ## Essential Proxy Configuration
+        internal;
+        proxy_pass $upstream_authelia;
+
+        ## Headers
+        ## The headers starting with X-* are required.
+        proxy_set_header X-Original-Method $request_method;
+        proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
+        proxy_set_header X-Forwarded-For $remote_addr;
+        proxy_set_header Content-Length "";
+        proxy_set_header Connection "";
+
+        ## Basic Proxy Configuration
+        proxy_pass_request_body off;
+        proxy_next_upstream error timeout invalid_header http_500 http_502 http_503; # Timeout if the real server is dead
+        proxy_redirect http:// $scheme://;
+        proxy_http_version 1.1;
+        proxy_cache_bypass $cookie_session;
+        proxy_no_cache $cookie_session;
+        proxy_buffers 4 32k;
+        client_body_buffer_size 128k;
+
+        ## Advanced Proxy Configuration
+        send_timeout 5m;
+        proxy_read_timeout 240;
+        proxy_send_timeout 240;
+        proxy_connect_timeout 240;
+    }
+  '';
+  authelia-authrequest = pkgs.writeText "authelia-authrequest.conf" ''
+    ## Send a subrequest to Authelia to verify if the user is authenticated and has permission to access the resource.
+    auth_request /internal/authelia/authz;
+
+    ## Save the upstream metadata response headers from Authelia to variables.
+    auth_request_set $user $upstream_http_remote_user;
+    auth_request_set $groups $upstream_http_remote_groups;
+    auth_request_set $name $upstream_http_remote_name;
+    auth_request_set $email $upstream_http_remote_email;
+
+    ## Inject the metadata response headers from the variables into the request made to the backend.
+    proxy_set_header Remote-User $user;
+    proxy_set_header Remote-Groups $groups;
+    proxy_set_header Remote-Email $email;
+    proxy_set_header Remote-Name $name;
+
+    ## Configure the redirection when the authz failure occurs. Lines starting with 'Modern Method' and 'Legacy Method'
+    ## should be commented / uncommented as pairs. The modern method uses the session cookies configuration's authelia_url
+    ## value to determine the redirection URL here. It's much simpler and compatible with the mutli-cookie domain easily.
+
+    ## Modern Method: Set the $redirection_url to the Location header of the response to the Authz endpoint.
+    auth_request_set $redirection_url $upstream_http_location;
+
+    ## Modern Method: When there is a 401 response code from the authz endpoint redirect to the $redirection_url.
+    error_page 401 =302 $redirection_url;
+
+    ## Legacy Method: Set $target_url to the original requested URL.
+    ## This requires http_set_misc module, replace 'set_escape_uri' with 'set' if you don't have this module.
+    # set_escape_uri $target_url $scheme://$http_host$request_uri;
+
+    ## Legacy Method: When there is a 401 response code from the authz endpoint redirect to the portal with the 'rd'
+    ## URL parameter set to $target_url. This requires users update 'auth.shobu.fr/' with their external authelia URL.
+    # error_page 401 =302 https://auth.shobu.fr/?rd=$target_url;
+  '';
+}

hosts/thea/minecraft.nix

@@ -1,9 +1,18 @@
-{pkgs, inputs, ...}:
+{
+  pkgs,
+  inputs,
+  lib,
+  ...
+}:
 let
   modpack = pkgs.fetchPackwizModpack {
     url = "file:///${inputs.testing-grounds.modpack}/pack.toml";
     packHash = "sha256-+taYj4uroLNxM4Nia3n+5P1Y/g6dzE6Iq13TsZgk4mU=";
   };
+  gregpack = pkgs.fetchPackwizModpack {
+    url = "https://raw.githubusercontent.com/GregTechCEu/GregTech-Modern-Community-Pack/refs/heads/main/pack.toml";
+    packHash = "sha256-SE86gP15H/Aug6vTLmMxHuxF2/+iLmCI/wQlON1xasM=";
+  };
 in
 {
   imports = [ inputs.nix-minecraft.nixosModules.minecraft-servers ];
@@ -30,4 +39,10 @@ in
       };
     };
   };
+
+  networking.firewall.allowedTCPPorts = [
+    25865 # autismcraft
+    25665 # reclamation
+    25675 # reclamation
+  ];
 }

hosts/thea/nginx.nix

@@ -1,11 +1,17 @@
-{inputs, ...}:
+{ inputs, pkgs, ... }:
 let
   # striped-front = inputs.striped-front;
 
   sin-address = "192.168.1.14";
-in {
+  authelia-snippets = pkgs.callPackage ./lib/autheliaSnippets.nix { inherit pkgs; };
+in
+{
 
-  networking.firewall.allowedTCPPorts = [ 80 443 8448 ];
+  networking.firewall.allowedTCPPorts = [
+    80
+    443
+    8448
+  ];
 
   services.nginx = {
     enable = true;
@@ -32,16 +38,44 @@ in {
       in
       (
         mkStarr "jellyfin.shobu.fr" "8096"
-      // mkStarr "radarr.shobu.fr" "7878"
+        # // mkStarr "radarr.shobu.fr" "7878"
         // mkStarr "sonarr.shobu.fr" "8989"
         // mkStarr "prowlarr.shobu.fr" "9696"
         // mkStarr "bazarr.shobu.fr" "6767"
-      // mkStarr "jellyseerr.shobu.fr" "5055"
-      // mkStarr "fileshelter.shobu.fr" "5091"
         // mkStarr "lidarr.shobu.fr" "8686"
+        // mkStarr "whisparr.shobu.fr" "6969"
+        // mkStarr "jellyseerr.shobu.fr" "5055"
         // mkStarr "transmission.shobu.fr" "9091"
         // mkStarr "zimablade-admin.shobu.fr" "61208"
         // {
+          "radarr.shobu.fr" = {
+            enableACME = true;
+            forceSSL = true;
+
+            extraConfig = ''
+              include ${authelia-snippets.authelia-location};
+              error_log /var/log/nginx/debug_radarr.log debug;
+            '';
+
+            locations."/" = {
+              proxyPass = "http://${sin-address}:7878";
+              proxyWebsockets = true;
+              extraConfig = ''
+                include ${authelia-snippets.proxy};
+                include ${authelia-snippets.authelia-authrequest};
+                proxy_ssl_server_name on;
+              '';
+            };
+
+            locations."/api" = {
+              proxyPass = "http://${sin-address}:7878";
+              proxyWebsockets = true;
+              extraConfig = ''
+                proxy_ssl_server_name on;
+              '';
+            };
+
+          };
           "shobu.fr" = {
             enableACME = true;
             forceSSL = true;
@@ -105,6 +139,10 @@ in {
 
             locations."/" = {
               proxyPass = "http://${sin-address}:8086";
+              extraConfig = ''
+                proxy_set_header X-Real-IP $remote_addr;
+                client_max_body_size 100M;
+              '';
             };
           };
           # "matrix.shobu.fr" = {

hosts/thea/ollama.nix

@@ -1,4 +1,5 @@
-{inputs, ...}: {
+{ inputs, ... }:
+{
   # virtualisation.docker = {
   #   enable = true;
   #   storageDriver = "btrfs";

hosts/thea/secrets/authelia-encryption.age

@@ -0,0 +1,10 @@
+age-encryption.org/v1
+-> ssh-ed25519 /uqj4A 9cZH/SlDpiluz2O3wCxRcBhmt3L5eN24I0HHwiJDWRU
+VVZaJlB4QzxBPcaN3MjCemjptEbqSUMD8VVtKyGezH8
+-> ssh-ed25519 70Re8Q ZFEQxmnm+dFKSXcQAc0KxkewCB59J5FyL1Ob/uEEtVg
+fRdEZpIytxjUeSKPieIzvZaAn5Mikjp28HlZhKwzS7M
+-> ssh-ed25519 QvCxGg ifsqXBKO0mqE1RuJ44Y7qDJ7lyci8iyz+J1xFgO38jI
+MkhMTZ+RttBFFMkbIaSCSQiExR1gf4OyFWHXIsx+QYQ
+--- nnMlLyQjixpBkx+bSU5I364IP3KnZ0qnmMPueBcRHpU
+ë˜<EFBFBD>6TX—ÕÞÌfÁ““É
+®?Z7M<37>T<EFBFBD>Å|ÚQf

hosts/thea/secrets/authelia-session.age

@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> ssh-ed25519 /uqj4A yxpGM3pJxfnM/5q9+NzdfG2kBjjNex6bdyUeZEBKjnI
+UO6ovn2cFeNi6SbcGpfF71/OAyQccyG+l6aZXubUal8
+-> ssh-ed25519 70Re8Q GW40lmeg6Lj7ntZswT0/hWZFpYBWoV3CMq4pdo+Ncgc
+oWTYuM/s3G7EKPWPQpHbXo9Tpzgn7YlYVQHYGn4xKS8
+-> ssh-ed25519 QvCxGg pKLpxtuMIa0xPXoaeb4WeQWVEINRE/j4nrxDB1J9BUI
+1azpt5MImTiDSF+Ts9EvUCdWMeVG7lErUHSBQfMiip4
+--- IOOR8Us6zlZhJm0V4X3IlbkHSdtR3GLLxEfa4i+lqv0
+ó P¬¥rhé"BFãŽÌŸtÌ€ê¤{¾(öB`q“Óø"AµnN_ ™f*ÏŒºvPpj&{)ìŠØ@‹ÃkF«Ú
]<Aš*Á<>‡<EFBFBD>´WTm”ƪD‡,Ý1E­™”¦³eѨ·O¢š

hosts/thea/secrets/default.nix

@@ -0,0 +1,3 @@
+{ ... }:
+{
+}

hosts/thea/shares.nix

@@ -1,4 +1,5 @@
-{...}: let
+{ ... }:
+let
   sin-address = "192.168.1.14";
 in
 {

hosts/thea/striped/back.nix

@@ -1,7 +1,8 @@
 { inputs, ... }:
 let
   striped-back = inputs.striped-back;
-in {
+in
+{
   imports = [
     striped-back.nixosModules.default
   ];

hosts/thea/striped/default.nix

@@ -1,4 +1,5 @@
-{striped-back, striped-front, ...}:{
+{ striped-back, striped-front, ... }:
+{
   imports = [
     ./back.nix
   ];

modules/gitea/sin/default.nix

@@ -1,6 +1,8 @@
-{lib, ...}: let
+{ lib, ... }:
+let
   ssh_port = 24658;
-in {
+in
+{
   services = {
     gitea = {
       enable = true;

modules/gitea/thea/virtualisation.nix

@@ -16,6 +16,10 @@
     };
   };
 
+  environment.systemPackages = with pkgs; [
+    podman-compose
+  ];
+
   virtualisation.oci-containers.containers =
     let
       runner_config = pkgs.writeTextFile {
@@ -23,6 +27,8 @@
         text = ''
           container:
             network: "host"
+            valid_volumes:
+              - "/var/nix/hosted-store"
         '';
       };
     in

scripts/upload-to-cache.sh

@@ -0,0 +1,11 @@
+#!/bin/sh
+set -eu
+set -f
+
+if ! nix --version; then
+  exit 0
+fi
+
+export IFS=' '
+echo "Uploading paths" $OUT_PATHS
+exec nix copy --to "ssh://root@localhost" $OUT_PATHS