sid/sid.ovh
1
0
Fork 0
Code Issues 3 Pull requests 2 Projects Releases Packages Wiki Activity Actions

new tailscale api
All checks were successful
Flake check / flake-check (pull_request) Successful in 17s
Details
Build hosts / build-hosts (pull_request) Successful in 27s
Details

Browse source
This commit is contained in:
sid 2026-05-02 19:18:17 +02:00
parent 8e3a2a703f
commit 8e279de754
6 changed files with 37 additions and 46 deletions
Download patch file Download diff file Expand all files Collapse all files

6
hosts/sid/secrets/secrets.yaml
View file

@ -21,7 +21,7 @@ headplane:
livekit:
key: ENC[AES256_GCM,data:QgD9fg6KvY/fGVdYVT9Oks/NkXm26oZaBUiVNpPCm0pvtVbzoiTv5BY9Krk=,iv:ayYBfr8s2MSD1EU809K6XGlP6dLcQVJC5vmscpqb2I4=,tag:juYtwZfUa7IV1Qcc+HnYnA==,type:str]
tailscale:
auth-key: ENC[AES256_GCM,data:BhCC0J0DmVaNAQmPo8I1a+0iBTUsZxBhXQlds2SIT5O/Daf2HGYsaGRg3IhVQmoK,iv:ws9B1V0JyfGyamTmc/pMOkMli1kcgKv6xLwXx6XB+r8=,tag:5KmqglMES7XlotIgQX2sdg==,type:str]
personal-key: ENC[AES256_GCM,data:YhUV1uSCXTE40xf4H9G1enxSll+pWSapbEifkK7rlBluDm+fIb3DtDXcWL+qyc9L,iv:tGzcTZQJm9OLAp9JhrL1pCqACKPFlO0qX0s5o0YT9MY=,tag:K34qSZajZ2XwmJeW1NAYNQ==,type:str]
netdata:
stream:
rx4:
@ -55,7 +55,7 @@ sops:
RzhnczA0S1pxcXZncGpWVHNYQW96L28K+ytH3PPyg4+wibpAQhp02RiSfZ83EDRB
UJ8UV1d+51D0e2A1sI95r2AzDj4jfwUnI+LYDPC/qEpsu5LFLGVyeg==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2026-04-18T20:48:28Z"
mac: ENC[AES256_GCM,data:RDhfanP4bN68/gVivoDxxOI4r/Pdov4qI/dldmC+RBHg1kzwJsneLxEHS2KEQhtXwR8y22WJ62pIgLA7WZHdCSIqL6cbJ4V8ImQmlJHYVnaGrkgFdbzUFi8B15jRwHTywhC3+CdxoeppzGFFCUnHDbPWVfDaVXmgHeHRPJoQHck=,iv:+pAAtvwPJz0PRIeywt9GhQL8P57cCy6hhOgoUGjIexc=,tag:d7h2XdPmkdnJd9j65llFsw==,type:str]
lastmodified: "2026-05-02T17:10:22Z"
mac: ENC[AES256_GCM,data:f4KQ26/zvg2nLLeW5qVeI8uH2GmPpJUKohNu68nEiIjP5AT53zjBaGoLOTGl9+oVRomSOGZtLGkJGaExB6tLMon5HN6xkQbugqvq08UkZ7FnR1Sa8/OtTr/+eexPNzF8VSdZE2TZCboUSQODV8+0Cy5T918g5kedxnT62SyY4As=,iv:P4TnpJvHwnZPl7kRNjv9d1WLZP9J0sg6R3KbdDMJqyc=,tag:ylYOcg6825jT29lWUaFRYA==,type:str]
unencrypted_suffix: _unencrypted
version: 3.12.1

32
hosts/sid/services/nginx.nix
View file

@ -19,11 +19,12 @@ in
enable = true;
openFirewall = true;
forceSSL = ssl;
virtualHosts."${constants.ca-fqdn}" = {
locations."/.well-known/acme-challenge/" = {
root = "/var/lib/acme/acme-challenge";
};
};
# virtualHosts."*" = {
# forceSSL = false;
# locations."/.well-known/acme-challenge/" = {
# root = "/var/lib/acme/acme-challenge";
# };
# };
virtualHosts."${constants.services.docs.fqdn}" = mkVirtualHost {
inherit ssl;
address = constants.hosts.rx4.ip;
@ -60,18 +61,15 @@ in
address = constants.hosts.rx4.ip;
port = constants.services.rsshub-oci.port;
};
virtualHosts."${constants.services.vaultwarden.fqdn}" = {
useACMEHost = "sid-internal";
forceSSL = ssl;
locations = {
"/" = {
proxyPass = "http://${constants.hosts.rx4.ip}:${toString constants.services.vaultwarden.port}";
};
"/.well-known/acme-challenge/" = {
root = "/var/lib/acme/acme-challenge";
};
};
};
# virtualHosts."${constants.services.vaultwarden.fqdn}" = {
# useACMEHost = "sid-internal";
# forceSSL = ssl;
# locations = {
# "/" = {
# proxyPass = "http://${constants.hosts.rx4.ip}:${toString constants.services.vaultwarden.port}";
# };
# };
# };
# virtualHosts."${constants.services.webdav.fqdn}" = mkVirtualHost {
# inherit ssl;
# address = constants.hosts.rx4.ip;

24
hosts/sid/services/step-ca.nix
View file

@ -75,18 +75,18 @@ in
"d /var/lib/acme/acme-challenge 0755 acme nginx"
];
security.acme = {
certs."sid-internal" = {
domain = constants.intranet;
extraDomainNames = [
# constants.services.netdata.fqdn
constants.services.vaultwarden.fqdn
# constants.services.webdav.fqdn
];
server = "https://${constants.ca-fqdn}:${toString cfg.port}/acme/acme/directory";
group = "nginx";
};
};
# security.acme = {
# certs."sid-internal" = {
# domain = constants.services.vaultwarden.fqdn;
# # extraDomainNames = [
# # constants.services.netdata.fqdn
# # constants.services.vaultwarden.fqdn
# # constants.services.webdav.fqdn
# # ];
# server = "https://${constants.ca-fqdn}:${toString cfg.port}/acme/acme/directory";
# group = "nginx";
# };
# };
sops =
let