diff --git a/hosts/rx4/secrets/secrets.yaml b/hosts/rx4/secrets/secrets.yaml index 51b3768..0aa47f7 100644 --- a/hosts/rx4/secrets/secrets.yaml +++ b/hosts/rx4/secrets/secrets.yaml @@ -1,5 +1,5 @@ tailscale: - auth-key: ENC[AES256_GCM,data:T4w4IbcQRPYEqAWLE0QhZGG7gx50TN8YPvGvtselFKJruOyW3fTQABQ7vbxJeEw8,iv:/STVNXjA4RHdIXtOn8kq0oke+GS3dD14/RxOdbBRZLQ=,tag:8UNhM6PIPq0LoVO9sYiJQw==,type:str] + personal-key: ENC[AES256_GCM,data:jrB00ICoOe9nlZh51T3Nhp00SnLx4prswMQNx7JMQXd69X/wC/Tkjo3AZgWGjXvg,iv:VWHLJT0+pvWV0nxSX/mlV4R6OzUF+lcZAtmxBZkqQqg=,tag:2GbTw2gdY7cK4biDg3854w==,type:str] alditalk: username: ENC[AES256_GCM,data:QFcW1IIEbALNeagT8Q==,iv:nXDJUPMZc95YSCabTouYqT0Rw5FIlGH/VzizzDr5vmI=,tag:aOqN1bI8lm3dEd1bIEtSew==,type:str] password: ENC[AES256_GCM,data:JP2I4nYQnKpCKL6qyXHc0kVu5Sc=,iv:QsjmGhLHS7FHsWirpYaRrSNvbo1SjjYtzG8F8GeBS6s=,tag:prjUsIG+tk69GKmq2knasw==,type:str] @@ -39,7 +39,7 @@ sops: NE5yK3ZaOG5PdXNSUnlIUmFSSmRFancKk57hCmo79HvI3hzzgQvgOK7oK5/dcQR8 f3R4OGF5+212VXEHR/hAEbKzV7CY4y6HhFyrGZ9bUKm1RrxtnVqUyA== -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-04-03T11:36:39Z" - mac: ENC[AES256_GCM,data:mIufcQyHd6sWnUCF/G8aRE10uwnntRXGz5R+fK6TbZSBJrRznTBaa4tVLtGo4wSghn4eBRfxecebuxSy0C2CQjBCkMbrjh4I2sYzAb5f8ghG4cQZgccuI7MCfQZ6JAEaa0BY7HJUZzlR9H+6iuDVuWwOO3OKzj0lWUlpDA6aC/M=,iv:qMSu9tYYkoirM2WHx7St/ztWSYxm8/gSosnCZYazNgU=,tag:NuUDG8fpAlBEbvKSq7/5bQ==,type:str] + lastmodified: "2026-05-02T17:10:11Z" + mac: ENC[AES256_GCM,data:uf5TqZaevyUUjW6pM6K8c4CZFFdwTXFGIaHmYr5Q4XFR1uW3kBsVLeQKxq26duLuQ4UiZkUpW27a/PW797Z+iIpBdqbnoQ35q7RnOW+GpnAv8TaRW1PpqQ+JR3/R0LMXsi3cMt7ioG2ad1bIHztiNz+SmePiv3Yt9WxQ7PIqBdY=,iv:dAzuyKSo0OW+j02AH0chCdLBm7Wv6PZgqZrEWhEVnxQ=,tag:k6EKWHHY4fwTd03d4TVcNg==,type:str] unencrypted_suffix: _unencrypted version: 3.12.1 diff --git a/hosts/sid/secrets/secrets.yaml b/hosts/sid/secrets/secrets.yaml index 372dccc..8fb0e4a 100644 --- a/hosts/sid/secrets/secrets.yaml +++ b/hosts/sid/secrets/secrets.yaml @@ -21,7 +21,7 @@ headplane: livekit: key: ENC[AES256_GCM,data:QgD9fg6KvY/fGVdYVT9Oks/NkXm26oZaBUiVNpPCm0pvtVbzoiTv5BY9Krk=,iv:ayYBfr8s2MSD1EU809K6XGlP6dLcQVJC5vmscpqb2I4=,tag:juYtwZfUa7IV1Qcc+HnYnA==,type:str] tailscale: - auth-key: ENC[AES256_GCM,data:BhCC0J0DmVaNAQmPo8I1a+0iBTUsZxBhXQlds2SIT5O/Daf2HGYsaGRg3IhVQmoK,iv:ws9B1V0JyfGyamTmc/pMOkMli1kcgKv6xLwXx6XB+r8=,tag:5KmqglMES7XlotIgQX2sdg==,type:str] + personal-key: ENC[AES256_GCM,data:YhUV1uSCXTE40xf4H9G1enxSll+pWSapbEifkK7rlBluDm+fIb3DtDXcWL+qyc9L,iv:tGzcTZQJm9OLAp9JhrL1pCqACKPFlO0qX0s5o0YT9MY=,tag:K34qSZajZ2XwmJeW1NAYNQ==,type:str] netdata: stream: rx4: @@ -55,7 +55,7 @@ sops: RzhnczA0S1pxcXZncGpWVHNYQW96L28K+ytH3PPyg4+wibpAQhp02RiSfZ83EDRB UJ8UV1d+51D0e2A1sI95r2AzDj4jfwUnI+LYDPC/qEpsu5LFLGVyeg== -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-04-18T20:48:28Z" - mac: ENC[AES256_GCM,data:RDhfanP4bN68/gVivoDxxOI4r/Pdov4qI/dldmC+RBHg1kzwJsneLxEHS2KEQhtXwR8y22WJ62pIgLA7WZHdCSIqL6cbJ4V8ImQmlJHYVnaGrkgFdbzUFi8B15jRwHTywhC3+CdxoeppzGFFCUnHDbPWVfDaVXmgHeHRPJoQHck=,iv:+pAAtvwPJz0PRIeywt9GhQL8P57cCy6hhOgoUGjIexc=,tag:d7h2XdPmkdnJd9j65llFsw==,type:str] + lastmodified: "2026-05-02T17:10:22Z" + mac: ENC[AES256_GCM,data:f4KQ26/zvg2nLLeW5qVeI8uH2GmPpJUKohNu68nEiIjP5AT53zjBaGoLOTGl9+oVRomSOGZtLGkJGaExB6tLMon5HN6xkQbugqvq08UkZ7FnR1Sa8/OtTr/+eexPNzF8VSdZE2TZCboUSQODV8+0Cy5T918g5kedxnT62SyY4As=,iv:P4TnpJvHwnZPl7kRNjv9d1WLZP9J0sg6R3KbdDMJqyc=,tag:ylYOcg6825jT29lWUaFRYA==,type:str] unencrypted_suffix: _unencrypted version: 3.12.1 diff --git a/hosts/sid/services/nginx.nix b/hosts/sid/services/nginx.nix index 2619671..ca44b46 100644 --- a/hosts/sid/services/nginx.nix +++ b/hosts/sid/services/nginx.nix @@ -19,11 +19,12 @@ in enable = true; openFirewall = true; forceSSL = ssl; - virtualHosts."${constants.ca-fqdn}" = { - locations."/.well-known/acme-challenge/" = { - root = "/var/lib/acme/acme-challenge"; - }; - }; + # virtualHosts."*" = { + # forceSSL = false; + # locations."/.well-known/acme-challenge/" = { + # root = "/var/lib/acme/acme-challenge"; + # }; + # }; virtualHosts."${constants.services.docs.fqdn}" = mkVirtualHost { inherit ssl; address = constants.hosts.rx4.ip; @@ -60,18 +61,15 @@ in address = constants.hosts.rx4.ip; port = constants.services.rsshub-oci.port; }; - virtualHosts."${constants.services.vaultwarden.fqdn}" = { - useACMEHost = "sid-internal"; - forceSSL = ssl; - locations = { - "/" = { - proxyPass = "http://${constants.hosts.rx4.ip}:${toString constants.services.vaultwarden.port}"; - }; - "/.well-known/acme-challenge/" = { - root = "/var/lib/acme/acme-challenge"; - }; - }; - }; + # virtualHosts."${constants.services.vaultwarden.fqdn}" = { + # useACMEHost = "sid-internal"; + # forceSSL = ssl; + # locations = { + # "/" = { + # proxyPass = "http://${constants.hosts.rx4.ip}:${toString constants.services.vaultwarden.port}"; + # }; + # }; + # }; # virtualHosts."${constants.services.webdav.fqdn}" = mkVirtualHost { # inherit ssl; # address = constants.hosts.rx4.ip; diff --git a/hosts/sid/services/step-ca.nix b/hosts/sid/services/step-ca.nix index 685c07b..1f3ec53 100644 --- a/hosts/sid/services/step-ca.nix +++ b/hosts/sid/services/step-ca.nix @@ -75,18 +75,18 @@ in "d /var/lib/acme/acme-challenge 0755 acme nginx" ]; - security.acme = { - certs."sid-internal" = { - domain = constants.intranet; - extraDomainNames = [ - # constants.services.netdata.fqdn - constants.services.vaultwarden.fqdn - # constants.services.webdav.fqdn - ]; - server = "https://${constants.ca-fqdn}:${toString cfg.port}/acme/acme/directory"; - group = "nginx"; - }; - }; + # security.acme = { + # certs."sid-internal" = { + # domain = constants.services.vaultwarden.fqdn; + # # extraDomainNames = [ + # # constants.services.netdata.fqdn + # # constants.services.vaultwarden.fqdn + # # constants.services.webdav.fqdn + # # ]; + # server = "https://${constants.ca-fqdn}:${toString cfg.port}/acme/acme/directory"; + # group = "nginx"; + # }; + # }; sops = let diff --git a/hosts/vde/secrets/secrets.yaml b/hosts/vde/secrets/secrets.yaml index 73ebd46..594a47e 100644 --- a/hosts/vde/secrets/secrets.yaml +++ b/hosts/vde/secrets/secrets.yaml @@ -1,5 +1,5 @@ tailscale: - auth-key: ENC[AES256_GCM,data:Fz1XGaQXERn+3EymtWyq9oYqoX0KrcPJelda+addeX+vhqEAxRe5jRdzK8W6329b,iv:HNlz5f7dscDXsPoKZjSiIl2NZOouEJZyzU3kaiX1NUw=,tag:DdIxWKeZ9kfHUkh0/l1sEw==,type:str] + personal-key: ENC[AES256_GCM,data:SwTmCDexL/ka3z4f2oZrUF8hqi4H5v1yBAsIOVyxZMfLTUNFOJCrApzPmULegKJ1,iv:aldDceyZfCMH+ke+cKaqJRV95qR2vuMlUMs5BpzkxAs=,tag:lgfizsBnYWfIGnQbRxOmnw==,type:str] sops: age: - recipient: age19yeqvv28fgrtk6jsh3xyaf0lch86kna6rcz4dwe962yyyyevu30sx474xy @@ -20,7 +20,7 @@ sops: RjlIQWVIcTY0aUlhelorMDRycVZnOEkK69ZCxeh8IL2LcsjgkBgbIbC6XnDJ8zwd yCuPYXkYOxeitToIbhHQS4TbgF61/tJqIixqoIe3vG+o112UspGkoQ== -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-01-12T20:15:19Z" - mac: ENC[AES256_GCM,data:sDbfLjm6ZqkVUMNbB6ikMSlMiXd9Ukf2K8HdAF66JwPB+KQI/rqIRKiSaOEKJ8p1AvpEr86ENlCEZNeslQJAdlqbGy6+VOcbSAz2bfhhXfThaAEgYT9CmXAsJL8lWMI5N2Ti0kiepjk+nMG1bbFyPecHm4AqadMRC/RHprAK4fc=,iv:2UPmmBNATuXvk+LbF9Lwi7Cgi0OFMHr96ONG6bpBDpY=,tag:i5If1ui4XHeuE7BjUEHUCA==,type:str] + lastmodified: "2026-05-02T17:10:03Z" + mac: ENC[AES256_GCM,data:EiIdKqsP93FN/X6V0kRc+kL6+Nu/BxYBi9Z6g7vUm2rAnimfasTvDamjKXC3bEJDWFpmoGfmYKRERGL+Cr26Kzcoue9NtP2jP9Vnb6De8LcZu1PQufs304adgaHBb1Eb5LtjC6J6EyZLK45OGqcscZjHK4vKxFimpeOXcd6EG+4=,iv:myMH3ubkxg+iNrEifQOSTzRWzEHsg04rZmH2pgxOz7o=,tag:CjrwtgPFfgXN88hR/s9OsA==,type:str] unencrypted_suffix: _unencrypted - version: 3.11.0 + version: 3.12.1 diff --git a/modules/nixos/tailscale/default.nix b/modules/nixos/tailscale/default.nix index 9d2b4f1..884847a 100644 --- a/modules/nixos/tailscale/default.nix +++ b/modules/nixos/tailscale/default.nix @@ -13,15 +13,8 @@ enableSSH = true; acceptDNS = false; # use coredns }; - work = { - loginServer = "https://headscale.cryodev.xyz"; - enableSSH = true; - acceptDNS = true; - authKeyFile = config.sops.secrets."tailscale/work-key".path; - }; }; }; sops.secrets."tailscale/personal-key" = { }; - sops.secrets."tailscale/work-key" = { }; }