From 5f9a78dc9240c7d87d1d5553f14ae0a9c39b0efc Mon Sep 17 00:00:00 2001 From: Jordan Ashurst Date: Mon, 14 Sep 2026 05:59:52 -0700 Subject: [PATCH 1/3] Adding subdomains to Caddy --- configuration.nix | 25 ++++++++++++++++--------- 1 file changed, 16 insertions(+), 9 deletions(-) diff --git a/configuration.nix b/configuration.nix index 53b6f08..1af398b 100644 --- a/configuration.nix +++ b/configuration.nix @@ -277,6 +277,7 @@ keepassxc sops age + unzip ]; # Some programs need SUID wrappers, can be configured further or are @@ -294,10 +295,10 @@ services.caddy = { enable = true; environmentFile = config.sops.templates."caddy.env".path; - globalConfig = '' - acme_ca https://acme.zerossl.com/v2/DV90 - email {$ACME_EMAIL}; - ''; + # globalConfig = '' + # acme_ca https://acme.zerossl.com/v2/DV90 + # email {$ACME_EMAIL}; + # ''; #tls ${config.sops.secrets.zerossl_cert.path} ${config.sops.secrets.zerossl_private_key.path} virtualHosts."centraldogma.site:".extraConfig = '' @@ -316,12 +317,18 @@ reverse_proxy /radarr/* 127.0.0.1:7878 ''; - - virtualHosts."blog.centraldogma.dedyn.io:".extraConfig = '' - root * /srv/root/ - file_server - encode zstd gzip + virtualHosts."jellyfin.centraldogma.site:".extraConfig = '' + redir /jellyfin /jellyfin/ + reverse_proxy /jellyfin/* 127.0.0.1:8096 ''; + virtualHosts."git.centraldogma.site:".extraConfig = '' + reverse_proxy /* 127.0.0.1:3000 + ''; + # virtualHosts."blog.centraldogma.dedyn.io:".extraConfig = '' + # root * /srv/root/ + # file_server + # encode zstd gzip + # ''; }; services.flaresolverr = { enable = true; From 181a18fe4d9acd9969a9ac07c506220c753e97ec Mon Sep 17 00:00:00 2001 From: Jordan Ashurst Date: Mon, 14 Sep 2026 06:08:15 -0700 Subject: [PATCH 2/3] Adding sops support to home-manager --- flake.lock | 12 ++++++------ flake.nix | 4 ++++ home.nix | 9 +++++++++ 3 files changed, 19 insertions(+), 6 deletions(-) diff --git a/flake.lock b/flake.lock index 6a02f65..e155dc2 100644 --- a/flake.lock +++ b/flake.lock @@ -86,11 +86,11 @@ ] }, "locked": { - "lastModified": 1789352311, - "narHash": "sha256-E9hlcRNSRQ1vb+UicOusX/ucroGlBAz/pYhCBorLOn4=", + "lastModified": 1789386765, + "narHash": "sha256-4hyLFBhzQC7+qPMELWc7J/sbdA6ckXZxXU9CYRsGhsc=", "owner": "nix-community", "repo": "home-manager", - "rev": "cfcda3f99334c8459fa4cd46cce87502e0b48f0a", + "rev": "87c391f49a34660de6010f35bb50fb1bf811be9f", "type": "github" }, "original": { @@ -136,11 +136,11 @@ }, "nixpkgs_2": { "locked": { - "lastModified": 1789149629, - "narHash": "sha256-H6GwaZzZf+4npqv0tph94w9tZddSjFjmQrVsW0z78uk=", + "lastModified": 1789286504, + "narHash": "sha256-eiEK7cKZORNEvX0GeF3RtNEF/JXhgf2RqSp3230q13E=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "eaad089433ca2bb662274377d33df3d0e51ef28b", + "rev": "ef34387ddd751e1ab8857adf4676492d32eb24ec", "type": "github" }, "original": { diff --git a/flake.nix b/flake.nix index 7b32dd1..7b3daec 100644 --- a/flake.nix +++ b/flake.nix @@ -50,6 +50,10 @@ inherit inputs; }; + home-manager.sharedModules = [ + inputs.sops-nix.homeManagerModules.sops + ]; + home-manager.users.mask = ./home.nix; } diff --git a/home.nix b/home.nix index 54e1ce4..70337a8 100644 --- a/home.nix +++ b/home.nix @@ -125,4 +125,13 @@ }; programs.home-manager.enable = true; + + sops = { + age.keyFile = "/home/mask/.config/sops/age/keys.txt"; + defaultSopsFile = ./secrets/secrets.yaml; + secrets = { + "github/token" = {}; + "gitlab/token" = {}; + }; + }; } From 050930a2ce01c9b51ed1a90d79b599d9409a61d8 Mon Sep 17 00:00:00 2001 From: Jordan Ashurst Date: Mon, 14 Sep 2026 16:36:03 -0700 Subject: [PATCH 3/3] Adding new secrets --- configuration.nix | 4 ++-- home.nix | 2 ++ secrets/secrets.yaml | 5 +++-- 3 files changed, 7 insertions(+), 4 deletions(-) diff --git a/configuration.nix b/configuration.nix index 1af398b..6469729 100644 --- a/configuration.nix +++ b/configuration.nix @@ -225,8 +225,8 @@ ddclient telegram-desktop btop - ungoogled-chromium - opencode + # ungoogled-chromium + # opencode doas lan-mouse stylua diff --git a/home.nix b/home.nix index 70337a8..1537820 100644 --- a/home.nix +++ b/home.nix @@ -82,6 +82,8 @@ SOPS_EDITOR = "nvim"; EDITOR = "nvim"; VISUAL = "nvim"; + TEST = "test"; + TEST_A = "testa"; }; # Let Home Manager install and manage itself. diff --git a/secrets/secrets.yaml b/secrets/secrets.yaml index 13b692a..84b4704 100644 --- a/secrets/secrets.yaml +++ b/secrets/secrets.yaml @@ -22,6 +22,7 @@ postgres: pgmasterpass: ENC[AES256_GCM,data:KYlzLRIV9jkbtbb8O8EiTXXYP+cPwYkV+WEse1T+grd5kPpl/xxAqAOIc44UcfQ8+FJMFpBe,iv:kWHbvoeLznuESsvKx5ADrPGGxVYVRMlRL3XUjr92+fU=,tag:dK2gii+lxVM7+Y++1eR5ZA==,type:str] pgmasterpass: ENC[AES256_GCM,data:s3KOZiag7h3iFYxBxXnhyYQ6ZG9jdav4uM9bQHgXdpYZW4yircOgoI1YiuciDoF1RhdOjbNh,iv:KzblpETo/wQtYUJUALAyvPRDlbuxXPiGOBhgJpVJd/8=,tag:Z5f7UhWNtn060UUm+/owqg==,type:str] gitea: + database: ENC[AES256_GCM,data:AiYQyrsmFVlWSYO+YFFgrCSTGTn3nl2tH+YcXlQKsLGJeNtTt1WV0/VvNuo=,iv:XZhZi183po9Mp8hAvSpti5qWec5+Rwu+UFPEUplZv0I=,tag:IFT/oP9Unwk+RE9sBLjJGg==,type:str] password: ENC[AES256_GCM,data:6GKcqsdLXaHVJODuuz2sZSZDn/0U1vT9NTfeuNlhwGO6MrQ9QYaOlpU3AI8=,iv:TL1EQnLXgXeenp0CqNAOajq4g66Spl1JLgPP3i4OpQc=,tag:9jPCAGR6zxKl0tzMeXWsGA==,type:str] caddy: acme_email: ENC[AES256_GCM,data:TpXEvreBkq2gqpq3OTokke/Zues=,iv:iO8jIMEzBpk5DOksQqnT87Nq8vFTG28qELvfIscOqWc=,tag:poK3Kl1bkePLetSF5DPb9A==,type:str] @@ -49,7 +50,7 @@ sops: OXJfnqQIRsiwQJFNLDjB4hNZ5r9iupVj66BAbadO3pwlHWOFt6+PaQ== -----END AGE ENCRYPTED FILE----- recipient: age1xgfxwt7488dkpksgjawc53ewsc4p94jy6kdvnpd5r0jv5a5yr9tqzxy8x2 - lastmodified: "2026-09-14T02:31:14Z" - mac: ENC[AES256_GCM,data:P+9OCeLiwRCEfDcxVfK8ryFgfLy8oxR3KG02rhFmuQ2QqGKxuVQv5lHSB7QX8pzwM6+t7iAz666dk5+6Ztj48v+WruXwkV+gC1sM+NhfFmP5El0ItCozyvzu8/+pgcMFtsBoJ9DSgK8vQzAvPbKm1MjFSbLvqCuq753HsjYKiz0=,iv:oMKTX/1zXx3JgjLJEVYA7ROQYg3ueFvzj+bMdKPFq8Y=,tag:/y9zg6YtNjgqmYnydDE5gQ==,type:str] + lastmodified: "2026-09-14T10:21:43Z" + mac: ENC[AES256_GCM,data:rCIlQV0lfuJl+E0t4Y5IvOFxToL4+47IfMzIm7V7eq3aoj13nv8g+2k2yZncV22shjJppasvyis7u6KtFsvDNkmc+VdduiuB3vBKNkBOr3IRwtOhvzqIHyvTeN9xsy/cGmrASr661jnM8aruMOMoevsyF1LMO/f15QzS/grUOlc=,iv:dZnCqRSXMeDvv/f4vekEqu9hPvl62Vzid0HZfXTRs2k=,tag:ie90n1/kQGNZB98/5cNaRQ==,type:str] unencrypted_suffix: _unencrypted version: 3.13.3