imnyang/nix-flakes
Watch
1
0
Fork
You've already forked nix-flakes
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

wow

Browse source
This commit is contained in:
암냥 2026-08-17 11:28:53 +09:00
commit f6dbcc2b4f
No known key found for this signature in database
20 changed files with 540 additions and 26 deletions
Download patch file Download diff file Expand all files Collapse all files

5
hosts/server/hikari/hako/.sops.yaml
View file

@ -1,5 +0,0 @@
creation_rules:
- path_regex: secrets/.*\.ya?ml$
age:
- age1mgels4hjl7l07gcnt72g86kvhrvd82fha9kuvlp46mpks7unrpmqvy959u # mizuki
- age1dcvh6q9953es9fvt8rq8rdgcktlt64asn2tf2y3vmyz0gntxzynqg2xgzk # hako

8
hosts/server/hikari/hako/configuration.nix
View file

@ -5,7 +5,13 @@
"${inputs.self}/modules/mizukios/base"
"${inputs.self}/modules/mizukios/features/system/boot.nix"
"${inputs.self}/modules/mizukios/features/remote/ssh.nix"
"${inputs.self}/modules/mizukios/features/management/docker.nix"
"${inputs.self}/modules/mizukios/features/management/podman.nix"
./services/quadlet/authentik.nix
./services/quadlet/conduit.nix
./services/quadlet/paste.nix
./services/quadlet/thetree.nix
./services/quadlet/today.nix
];
# 1. 크론 설정

3
hosts/server/hikari/hako/default.nix
View file

@ -3,12 +3,13 @@
overlays,
}:
let
inherit (inputs) nixpkgs home-manager sops-nix;
inherit (inputs) nixpkgs home-manager quadlet-nix sops-nix;
in
nixpkgs.lib.nixosSystem {
system = "x86_64-linux";
modules = [
sops-nix.nixosModules.sops
quadlet-nix.nixosModules.quadlet
./services/forgejo.nix
./services/immich.nix
./services/attic.nix

12
hosts/server/hikari/hako/secrets/authentik-outpost.env Normal file
View file

@ -0,0 +1,12 @@
AUTHENTIK_HOST=ENC[AES256_GCM,data:yUgg+bAeIIj916hA+eStQc4lrZ8ZeJk9Uw==,iv:ZXM2qLNp0eviZSk1yL8vQQiLvC6/jaHk4EWVJIYSuEM=,tag:jbqe8Xab9CtTRSS16LuTEg==,type:str]
AUTHENTIK_INSECURE=ENC[AES256_GCM,data:eEgsKwQ=,iv:2Kp/Xr0qZ3dJ6cRkBcQM/HWrAVOP3fQcQSLvOSKZb9c=,tag:EfFM1jOIlikrY87dnQlq7A==,type:str]
AUTHENTIK_TOKEN=ENC[AES256_GCM,data:xoJ0J1/sLk0BfB6l1aDdqo0E3TvuBTT1JEGPrpCsvja4QksLLoZQZeG50/WHgJe1gGzX6tvskadVuKXy,iv:abTCkYCEHXmWc3aqIr3F1eP9lLlw8SWhufGQb072yzE=,tag:AdWvCacAUdXU7umfBFmgJw==,type:str]
AUTHENTIK_HOST_BROWSER=
sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCeUdwS2ZOMlZKbGRWeFli\nNkUyTVB3c2VDYjVmQlp5MnlkbEtvODVFUERjCmJZdCtySStGZThHMkRHVWcvU1VV\nTUJkSkt0aGpQTmlBa29Ic1ZTYzA3ZjgKLS0tIGFnUUxpZC9MZnZyU0w3M0VqWWhj\nU1Erc2g5cUNUREYvVGtaNG8rRUYxY1EKQRlrUTIWLfnMkgZ27XFPedWKHAi0HEnK\ngemL19l7zHgHXzo2t/8YW21KwX2W5WWUCLsdnfU96nKxVvbHcN7FSA==\n-----END AGE ENCRYPTED FILE-----\n
sops_age__list_0__map_recipient=age1mgels4hjl7l07gcnt72g86kvhrvd82fha9kuvlp46mpks7unrpmqvy959u
sops_age__list_1__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvSFNwbDZSai9VNUpOUUkx\nQUo3d2hBT0J0NmRRN1c5VGdNaXhBSUNhK3pjCnhuNFJaWEVZMGI3d2ppaUpXcWVX\nc0srTEUxVFVORVh1MlU4RFBXMTF0ZmcKLS0tIEV3U2l5MEM4eVNjdlVVeVozL2p6\nZFZkdlRDVThTdTV2SnZSRFlFSHQ5OVUKm+TDlgFE/KX5KuxDy2s2RduQQ/JT7IR5\n9vqU9BJ5afKJIsv6NZ37HaPOgW5S1gVDU8P98FhnWsUGbtQfsh8D+Q==\n-----END AGE ENCRYPTED FILE-----\n
sops_age__list_1__map_recipient=age1dcvh6q9953es9fvt8rq8rdgcktlt64asn2tf2y3vmyz0gntxzynqg2xgzk
sops_lastmodified=2026-08-17T01:59:24Z
sops_mac=ENC[AES256_GCM,data:/ehlFYglLqvUbc3n3Nje8xnFN2v6e8ObiLD4KdwwF52tuwsMqBAwCIf5O1+kGj/xMuZfbbnNBx2VrVPhRpOEC9EkgkzEk8GrPjJkJN0gi2FCA94yW8UvG1VwZa62ZXS0w2K6JW7wPcBx3e29Udlpfh2SJzhRcByZwotuhPOPur8=,iv:nZasw07aRLbT1WNX2d4Ip3J3/bM4jX+qz1wIYjOD19k=,tag:cmlZ5I66IazDgPLwD87oUA==,type:str]
sops_unencrypted_suffix=_unencrypted
sops_version=3.13.3

26
hosts/server/hikari/hako/secrets/authentik.env Normal file
View file

@ -0,0 +1,26 @@
AUTHENTIK_EMAIL__FROM=ENC[AES256_GCM,data:ztZzXvZbLcOhQmGiOq4PfktSZHyX8ygf,iv:w0Md8L3xdHh3K7dLAJEWQCXoZOmB+ZyoW4YwKkuj+go=,tag:LrtXbZcXnoB/r1y38XN6tg==,type:str]
AUTHENTIK_EMAIL__HOST=ENC[AES256_GCM,data:EYD9VpSCwr3GEKOqYGZy,iv:EKkY9QpbKEpRrko/f+Kl5y5yIjJ6Z9R9vbJvQ8EIKuY=,tag:U+7Id4rX96l7QduVnyQPfQ==,type:str]
AUTHENTIK_EMAIL__PASSWORD=ENC[AES256_GCM,data:9PRmRr3N2Z3kONaxPz8lv+kjnqza4fjZfdy3j/cBfVtru9Cw,iv:TBoCrIyYIwTcrdLDVDDDxqy478XrBJVlB2CSqhfmJTs=,tag:wxrdpk29YVV/02FO9WsQVA==,type:str]
AUTHENTIK_EMAIL__PORT=ENC[AES256_GCM,data:5ybh,iv:3CWTT64j3rt89zEA/5MCYk9uFpKPFieRG2k0dmrq91M=,tag:bErEqiNgo2aAZ32Ynd7FFA==,type:str]
AUTHENTIK_EMAIL__TIMEOUT=ENC[AES256_GCM,data:j8k=,iv:li1xGuroVnFX+RLkOPhXY8/w+iMCnxjQWBg2IHkTyuA=,tag:N5cZbmOeXXwJWS9C2LZqBw==,type:str]
AUTHENTIK_EMAIL__USERNAME=ENC[AES256_GCM,data:bBe7qMBe,iv:d64LO9OWVk+TLXFQXkMvpWvtD1HEb3vmmSTNfwWmMl8=,tag:MPRfKPq5YsI9lJqCAkNbkg==,type:str]
AUTHENTIK_EMAIL__USE_SSL=ENC[AES256_GCM,data:C6P2xLY=,iv:I/PrUK+1XqDroJFKradSRLxnzTGWOLqDIQ9oNvYEBWo=,tag:TClGmBLfZTaiGVrb8S5q2A==,type:str]
AUTHENTIK_EMAIL__USE_TLS=ENC[AES256_GCM,data:U48xoA==,iv:kAtJzyo2gyBeTNsAGU1N20OWPqvDo7bJ4aZcdOh36lA=,tag:3hbbD5A5g/sf4jKA2iER0A==,type:str]
AUTHENTIK_POSTGRESQL__HOST=ENC[AES256_GCM,data:In00j7rHc55qhg==,iv:3PhMeMocXNYWhWJ7H645J4wxYE6mbDVVX0CYSaLC6ak=,tag:3eU96XwKjbejBwY4voMBqg==,type:str]
AUTHENTIK_POSTGRESQL__NAME=ENC[AES256_GCM,data:Awt0aqC39q4z,iv:tEsDR/Ob+QCQWHpl3i3JBD2zTOiassYccM5SeBFEwQY=,tag:L31RsW8vIIx3E6vs6hxw2g==,type:str]
AUTHENTIK_POSTGRESQL__PASSWORD=ENC[AES256_GCM,data:zvCJ+sZvdKE1T1sxallu20Nf0hrHW4bCMCYOcXW640lewEWUyqfCSTwF78073BrQ,iv:xD1wVNh7hbi1nwd58HakhpnhgDtYWVeOu7eCXCq2MZ0=,tag:Nkd5LI+mhQOB5wtK+FFfPg==,type:str]
AUTHENTIK_POSTGRESQL__USER=ENC[AES256_GCM,data:7hba0480F7aQ,iv:52+8YiRWMWl7H7ys4+DRHmwGpw2p/1gE1ukz4U7vdx8=,tag:sTjRphyDYlDDIAbt47r2eQ==,type:str]
AUTHENTIK_SECRET_KEY=ENC[AES256_GCM,data:IrJJI/Ub3XBesOhXHoc96wmm/IGIm6d/D01wlUezDskx7Vh8IfesT+Fh8/WolNYwwz8rETX62X3dJO1LYyor+rdFYevypWyRT3+xYIyVwcE=,iv:1NyLqh24cFFYsyv/4BS0vrnCcdATxxBDWTvMPVcR4pM=,tag:rmOvgtVQ86OIOBDrfVRzqA==,type:str]
AUTHENTIK_TAG=ENC[AES256_GCM,data:GMUoiK5rLUI=,iv:iwyUmbOTDml21YJgcq726fXgMWPaww6w0g2cm03UqLo=,tag:v2BsFORunIJ8gDHlkN6I6w==,type:str]
PG_PASS=ENC[AES256_GCM,data:gU8z73EJZSXH1BlHbbHvPJRwumsqBa0OFUE3qQQJAG8wMeF+zN6t8x1cbPrh9fkl,iv:3kOktFZ30Q1+Wt/+fkbzn4+Kle+NCjuk0IoF7GcgV6c=,tag:ynMFDVt/sNjBNJWZW8oKLA==,type:str]
POSTGRES_DB=ENC[AES256_GCM,data:Zzs43EeWaOcY,iv:FA2SCdFDJ7FZX3DzH+THS+MPcphBCkkFiSCxQePPCs8=,tag:T4XPkyiq88luQ/MK7V632Q==,type:str]
POSTGRES_PASSWORD=ENC[AES256_GCM,data:SAokyWw701A/N9fTEho6XC8j6jqpxl1+QSqNlvb0UNwS4AucWx/gLUUPqMzu2ka1,iv:yUEzSAMvClp4b3hd/+8h06BqJOAyYeYZfFcvNj3NDXU=,tag:Z71qYOB+NtJp/qYA23xHPw==,type:str]
POSTGRES_USER=ENC[AES256_GCM,data:VKfGBBrEkt05,iv:md5E8nhqsIouSsMRsvMxjQlgsVlqgq/IYOCXYlxboMA=,tag:NASdI6cjZMbdhJozkk5H2A==,type:str]
sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBocnpXUWJaYU15VkpaYk95\neUVPRlhCL0ZCbmpFeld0MllYTk8zQ1FOcjFFClowMzQvQ0UrcVhXNEV0QVVtdkl3\nQVFkVnZES3diaUZtbVJ4SkdBQWpPU3MKLS0tIGY4ajhmcU9HMDhLTVNCenE4QnBZ\nbDdvd2tnb0FpY2dlQXBWMXhLUnJnRU0KGIp06WFevm3tfT80oL7Qt4KEgfj38i3Y\n09jGG/Rq9N4GCFxcYTulc32CzdLf8dJYYOaPFFSnK69zWwor8K/jig==\n-----END AGE ENCRYPTED FILE-----\n
sops_age__list_0__map_recipient=age1mgels4hjl7l07gcnt72g86kvhrvd82fha9kuvlp46mpks7unrpmqvy959u
sops_age__list_1__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkTVVWOFo5UC9saWx5cUVU\nM05PeHVaTlhqSGtWYUxWRzVwVDlGVzVHZVFrClBvL3hiWXdMV01Jd0p0aXNNaUdu\nYnFTeTJ0VC9tc2VrZlV0OHlScHcreHcKLS0tIGxseDVMdS9MZWJFM0pYcWRFWVdv\nSFlTa0tQd1dYS0w0TEgrOVltNkFqMFUKERnmSyf2988fHahx0RP6IQ2cwDQVajih\n2Zz1JWPk4tTYOBvKckwHUN1bQKfj5dY/gzmSQE/jTO2fPESzWCpvIg==\n-----END AGE ENCRYPTED FILE-----\n
sops_age__list_1__map_recipient=age1dcvh6q9953es9fvt8rq8rdgcktlt64asn2tf2y3vmyz0gntxzynqg2xgzk
sops_lastmodified=2026-08-17T01:59:24Z
sops_mac=ENC[AES256_GCM,data:bYCMJoh+6Pw2eh1asz44AohPPzK5LUi9wSCKJRSSup3WP2PeqmQVPVSUj0dYkcEQaaq3aAWPqsUwadAcZJEYSKSFgZh7ULEiwFjaTosZF8Td+l/kA69vmsmfpgZfkoqnm3vklBx11v6PA6qzqIm2ZsCTxBkqTj8YqiQhI/M/bJ4=,iv:YmoSB593yLhXSrw9INAL9bK9awcVsQFSO1KRMPUAX2A=,tag:N6senwYE+ZTsneX8vkJr5g==,type:str]
sops_unencrypted_suffix=_unencrypted
sops_version=3.13.3

28
hosts/server/hikari/hako/secrets/thetree-app.env Normal file
View file

@ -0,0 +1,28 @@
IP_HEADER=ENC[AES256_GCM,data:EK3oOq+LzOcpuODaeDTT+A==,iv:uk4HMTcT95peTzkOtw3PaA/2hrDGnaG9EsDLVwre+uM=,tag:17KeffHeh3RuaJ24R8RKhg==,type:str]
MEILISEARCH_HOST=ENC[AES256_GCM,data:WxieHJeHmy1Nhv0ROsdtj3sd,iv:xaFQxuiFy27M5qMuSMEDUIOoLlF0JcwL7HPJKdNgQJ0=,tag:9M/K8Q2Wi9FQKWinFcwVrA==,type:str]
MEILISEARCH_INDEX=ENC[AES256_GCM,data:3TyUUrt7tdyhumKLqNjjLA==,iv:F9UDbxkrKFQjwcXPziRkYVNyrU1s1ji9F7M7Tn3c1n4=,tag:mgplPdaCGdb4ZaNNED+clQ==,type:str]
MEILISEARCH_KEY=ENC[AES256_GCM,data:cCnEGD067tNgXr7F,iv:rrxXtkFLNOhTjk3+8CbII8zOPZHHpbyi/ZP22OGYnm0=,tag:eIsrFlSNOUFk3Unzt/iEsw==,type:str]
MONGODB_DATABASE=ENC[AES256_GCM,data:kMT96+iDXw==,iv:lphroCnw0/9dOmhTjIzUvWYx5Z/8FSgFmDQ6ZYRv/Yw=,tag:sOiHWCJypwgYTUFowiN4Ng==,type:str]
MONGODB_HOST=ENC[AES256_GCM,data:3Rw=,iv:Xp04OpVpk3DBpkWTOgHVJhftDO2cwgfRFDHTaXPds9g=,tag:caBt9/+4lB6QD3HrT0NC3A==,type:str]
MONGODB_PASSWORD=ENC[AES256_GCM,data:OHUg70BKvHA8H3gA,iv:bOAr4svmSw+rU6Li69tNFdaiKSJ7vHDAhbv9MHu+YM8=,tag:+jD0U8jQRRwJgM0TAEwfGQ==,type:str]
MONGODB_PORT=ENC[AES256_GCM,data:7ajlJ7g=,iv:YCiDtzPowO3GvWXXS9yLLzEbZyEAlR2onR4RouEKWag=,tag:pM0rZnaMUewDBzbCrs8EkA==,type:str]
MONGODB_USER=ENC[AES256_GCM,data:kgtphQ==,iv:RwXg7og25Sxr4DdYUa8ErTrpKVKVLcd90SgMePU2uKc=,tag:GDgiSrwDDPM9WeQu1wQgkw==,type:str]
REDIS_HOST=ENC[AES256_GCM,data:oQHNGMY=,iv:eajh6/j1yFyGwwrkfv3F+fCHt22w6sXn3tj3x5tqaR4=,tag:N2KU/9iRoAfP31kzy4HsIw==,type:str]
REDIS_PORT=ENC[AES256_GCM,data:MLOj3A==,iv:9NLCn7/Fn6rA45WbzOeg08vEmjM9LaKY7YdgGWunwwQ=,tag:RSJ581nTgJk668PrirfNVw==,type:str]
S3_ACCESS_KEY_ID=ENC[AES256_GCM,data:rJnnIw==,iv:Jx5idrDvD3BZW240ZMIOyGgSqt2D472Md+EIiUFPJ3o=,tag:LZ378K4XNHizv0zD/BsHXQ==,type:str]
S3_BUCKET_NAME=ENC[AES256_GCM,data:umt3yeFmFA==,iv:Fb4CwpNJZRAQSNFCzaBtZGIFsu89y+dFk8OCjn0l8SQ=,tag:La9hWV3w5jQGKGtLwThPfA==,type:str]
S3_ENDPOINT=ENC[AES256_GCM,data:2bSRa7QycaZfUaMomjBueDMC,iv:3OTeNVJXGsfS3rBbnci9QsQzGqKV9ZxQaT69QkdUDjE=,tag:12YljTJ133fUwrmKSSa9Ig==,type:str]
S3_FORCE_PATH_STYLE=ENC[AES256_GCM,data:IirymA==,iv:cM34lRvDPLD3TI1w6wkvhjvtfceTEfAu1pkEyzs0uT4=,tag:wSNIFBTHjbHudIIvz+m/qA==,type:str]
S3_PUBLIC_HOST=ENC[AES256_GCM,data:6LPl/Hadsu4X06WOzBmm/HERx9EQfdqgcNhQeCe/RQ==,iv:MJiwYU+mBwdr/ItOrS4MaZEQMzQSb8UxcOCmaxpPkcg=,tag:7Pzy4+sNdmLdqubIMffjmA==,type:str]
S3_REGION=ENC[AES256_GCM,data:DV/guQ==,iv:wPEyL4Hj7xhS3mT/0iu2QopxjW2wwyplexp2Il6EO/4=,tag:J/VFjyFcroy9kawRSK5Gsw==,type:str]
S3_SECRET_ACCESS_KEY=ENC[AES256_GCM,data:5GI6DU6Nhn3irIqW,iv:emXKNt5WpjsdUbCmW1873kDw0sbSUmmPA96yOfQFpQw=,tag:vl9WibybsEw1TnaYi4tZxw==,type:str]
SESSION_SECRET=ENC[AES256_GCM,data:rlIWNmjQ,iv:yapndXjFJ8dLF9jMbVvX9oYr5Y0UbOaQWZlj840PjmE=,tag:FAeW9HJFiR0U4Dckb5I8Iw==,type:str]
USE_REDIS=ENC[AES256_GCM,data:FY4zlA==,iv:z2Ufv6eO2iyDWlk0RljxEYiaGBSfQDZ+NhtDPqvdreQ=,tag:Woif9DU963NcnVXbrE8Qkg==,type:str]
sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5VXE4UzEzaGF0d2xSanFP\neGFFK21FcHprdTBpaWw4VzdiY1dCWEhDeXdRCllBa2FUSGt1UTlieit1UktRU0xI\ndkIxRDMwbU9NRFA2UlBzdEFSYmxHbXMKLS0tIGRTZlVJNXZlYXVPTDRRSmJ3ZDNr\nMVNyRlVVM3hYNlBtR0pZNFQxNEZnRzQKq7MgIc4OfrU4l5Cpsfv5SZMSVH0x7PmG\noO29TQMS9e91D3qX8EJKxMHOqrWNwbkdziPU4mQtxeVjUFxl9W15Wg==\n-----END AGE ENCRYPTED FILE-----\n
sops_age__list_0__map_recipient=age1mgels4hjl7l07gcnt72g86kvhrvd82fha9kuvlp46mpks7unrpmqvy959u
sops_age__list_1__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRbTFaYkdTdTc3bXVYSUhB\naTlveENMR3h4OXRuWmJGY1ZvcDdJdjZWSEZrCmgzY3h3R2hOdFBoT0ZFTlVPTEVr\ndExYcXlCT2NWMUdvS3h2WVRUZGVvMncKLS0tIEtmQWlrZDQ2Nk84MmhKTXd0QUY2\nQmFYdFdLaG84WDBna2lnRTBSY0hiWE0KuoSexW7lNmPZ3bKTLTntsD5V9J14jvgC\nXIMOEgaNE/jxBfmigB7dRPB551XhaC9B2izpLEDbuVJGWyG/o3PB+Q==\n-----END AGE ENCRYPTED FILE-----\n
sops_age__list_1__map_recipient=age1dcvh6q9953es9fvt8rq8rdgcktlt64asn2tf2y3vmyz0gntxzynqg2xgzk
sops_lastmodified=2026-08-17T01:59:25Z
sops_mac=ENC[AES256_GCM,data:loIKy94OC/3m9B2k8T9UBhVVDKp9gufxYQRBEfb0kIR2/sDjGxCnlOr8qzcY4G6AAzCmvFk+H9ZZRNjS80+OWOAFoDD/eefn707l3l17GDyuuRip85omTz+tCw2SYv0hVcyxLIULrP7++Mkhp9MDWMGWWduRKJHGmHTClZcb9P0=,iv:tNuEDQENCazqMLLx4KhogS3knHMthoSMkz+YqQIIaEM=,tag:qctsco7xDpOkv/Ip1wj5Pg==,type:str]
sops_unencrypted_suffix=_unencrypted
sops_version=3.13.3

10
hosts/server/hikari/hako/secrets/thetree-database.env Normal file
View file

@ -0,0 +1,10 @@
MONGO_INITDB_ROOT_USERNAME=ENC[AES256_GCM,data:H/nJIg==,iv:OlVSlKzu6ouVLH6K1quT9GoRw0A7cR8OrZw3Uy6Kkyc=,tag:Vvhl8XK1hu5cguFzMxPAsQ==,type:str]
MONGO_INITDB_ROOT_PASSWORD=ENC[AES256_GCM,data:TRKNVCM6v0f/BNtI,iv:zQymHHdU48HXkcy5ITTxrKpBnedUGpArpVDKHRnps6g=,tag:A5zbXaXGJzb94r6xOWlpdg==,type:str]
sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAycEVYMmVxT2UwaDVlaVBy\nck9kanhCNnFtTlpwc2RhWklKYjVhYlFCOVZjCnBhSHI4SCtFUDNQZW90UG5Ia1JN\nRDdpY0NiNTdVbnVwN0I5RkNTS3QyanMKLS0tIFVYOSttWkVRaWtmQUFDd0VOd0t0\nUytzUUZ0Kys2Z0d2SWVKeXBpTzRMancKDq3e6W2wyt59PJMMquwkamLRdjPnhrmD\n4atSUauXI+VXrLmGiV9tePIazSi1+F2Z4sB+K5vxKHaLX0oqCOnJMw==\n-----END AGE ENCRYPTED FILE-----\n
sops_age__list_0__map_recipient=age1mgels4hjl7l07gcnt72g86kvhrvd82fha9kuvlp46mpks7unrpmqvy959u
sops_age__list_1__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSaG5xK3dXZlRyc3BPWnJI\nWS9ZSWlWWVdiY3IyNmlZdFprR3RaQ1F4a0VrCnVWN01HQzFGSU1Cb25vNk9tNng1\nSGNsWXVJcFRnd2NEY1BlTG1XTUVxOFkKLS0tIFkxUE1hZUdqNUxjdG43QU43Njdr\nOVFjYjNzenFkTmNOQnoybGg0ZFM1Z3MKRoFKQnHYuABbkBIp68JbYaLDJU9q6uYe\nELjS0/hBTEavqwSK2sc0iaDXiKsL2IE+mnXY9urbh9TcjYzoD+aVvg==\n-----END AGE ENCRYPTED FILE-----\n
sops_age__list_1__map_recipient=age1dcvh6q9953es9fvt8rq8rdgcktlt64asn2tf2y3vmyz0gntxzynqg2xgzk
sops_lastmodified=2026-08-17T01:59:25Z
sops_mac=ENC[AES256_GCM,data:UsHLSHRyDATrxVVWGc1neMgU36AckAk0fg6em1LkdeqKrl80tlMk0GTKUg1U8mFb23gpFG4mhRejEPocMFU7d7gdcw+dWlqlnT7MuD64UX8KcOUmhDWrCXllM+qX2uWl8vRKRGfKKpKMIKmRTthv9Rn2iF0f0sNPacLhVdDlQEc=,iv:LC5AOvrmjCljmBpVkROshwFGM50k6vpL74gJOMb/vjQ=,tag:1seW4prwReucVggO25fvyg==,type:str]
sops_unencrypted_suffix=_unencrypted
sops_version=3.13.3

21
hosts/server/hikari/hako/secrets/thetree-rustfs.env Normal file
View file

@ -0,0 +1,21 @@
RUSTFS_ACCESS_KEY=ENC[AES256_GCM,data:UQKtrg==,iv:SpD8HNgMymX/YwWEFG9ZNsOleMsBg6Al8hZpa6lqSrE=,tag:rXM6qDOvntVNDNFTWi7UkA==,type:str]
RUSTFS_ADDRESS=ENC[AES256_GCM,data:l2hBc9O5o/lJvLcI,iv:AOFAo6fSLN+zhNvjqnww8F0tRHL9uyAR8SkS/gfq+bA=,tag:vilnxFl+5B+uQihWjHxnnw==,type:str]
RUSTFS_CONSOLE_ADDRESS=ENC[AES256_GCM,data:o2rBeMcoXcc6KEWw,iv:5byh58ptKXQdNdpMoW5dgUMzhxZpFxfUv8CfYhqjHjs=,tag:v2ctSxB9DPNvKMCdYM/Fzw==,type:str]
RUSTFS_CONSOLE_CORS_ALLOWED_ORIGINS=ENC[AES256_GCM,data:xg==,iv:LkAe+DVHv4rPa9Bs59apJWhg9dbKAxQqUwBlxhDlAqU=,tag:moHOlYTVzYiOpUiO/6ledg==,type:str]
RUSTFS_CONSOLE_ENABLE=ENC[AES256_GCM,data:MUJSPA==,iv:UKHW1Uv0vieEX/oHCKtI07Mfvr8V/65QV2FFkwceZJg=,tag:sOsy5BNgsr8/0zFOr5oh8g==,type:str]
RUSTFS_CORS_ALLOWED_ORIGINS=ENC[AES256_GCM,data:6w==,iv:bJN6FRo7hVEGkjHd0TwjFHdsRPafE4+PYmPBHZrwuRE=,tag:VYURsklO3J9RrqxUs2+kwg==,type:str]
RUSTFS_EXTERNAL_ADDRESS=ENC[AES256_GCM,data:Ordg2lk=,iv:7mxszXW5tDMyjfTk+zNiCBTr8AJeIeyxW9HLqQ1LUCM=,tag:Gxt+82GiGYcZGUTTWvT7xQ==,type:str]
RUSTFS_LOG_LEVEL=ENC[AES256_GCM,data:25MW2MM=,iv:nTuRp41AQ7Xaqr672dMMmMin1i8i3N2EHB0ZGyig3Pw=,tag:D3qyBeQok8STMhKKjIupfg==,type:str]
RUSTFS_OBS_ENVIRONMENT=ENC[AES256_GCM,data:JT4Bn4G7S30uKA==,iv:phk2LQVaPd2eEHF2oGrZTw3Ps2ewI0YsPIIqOFSYCQg=,tag:JUwj7mAAS8nDE9zW+mTuoQ==,type:str]
RUSTFS_OBS_LOG_DIRECTORY=ENC[AES256_GCM,data:PBeP6cw=,iv:+rOsbjqiH9dDanrfrJPqDEI0MxWxPohi4vaRUzqMt54=,tag:mhBUBWO2wcqr4rquVwGjIw==,type:str]
RUSTFS_OBS_LOGGER_LEVEL=ENC[AES256_GCM,data:keNBmw==,iv:4+qBwyhy4fQMaCjrQMYcht7IAaUagoMaIMRJnlxAu/o=,tag:vqtYOYt8u1CpKXMb0EEZfQ==,type:str]
RUSTFS_SECRET_KEY=ENC[AES256_GCM,data:byjm6fFowopFUDIw,iv:2iU2zUYOWPu755i7UZp370z0k6c4uHPYKDXv5szRERA=,tag:oWoVJRop9qVBOcTHfyQS1A==,type:str]
RUSTFS_VOLUMES=ENC[AES256_GCM,data:+lQei7gyHLwYMefh,iv:CQHAH0ZY07meUldrv8z2+m3qu/+0u0THRvG6DtzHAzY=,tag:NJLVo40wLYfYN9+SnX6r7A==,type:str]
sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqN3lGVTJMMm53T3RpZ3Ev\naEVZT3R4Um5RME45QW1VYnhmb01BMjRiZzNzCjJ3Z2pYcE01aTYwUzVnaEh4Mm9X\nRjY2c3kweVBTKzRhbWJPWmNnRUJsVjQKLS0tIFYxdHZvMmoxYTI2aVVyNGVwSnNP\ncVdKOHlQTWc0SnpkNUNLWExvenpJbXcKTkomT3Ayz/O0xZbePyHmgrt7BKWJ0TiH\nn+Kl3IUWQ6ejGJUSqwYVb2Pe6KmBHK6Nmy+EBZ6QbgUmqr9HM1OZYw==\n-----END AGE ENCRYPTED FILE-----\n
sops_age__list_0__map_recipient=age1mgels4hjl7l07gcnt72g86kvhrvd82fha9kuvlp46mpks7unrpmqvy959u
sops_age__list_1__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvQnRyNnNyczJGMXkzUG1P\nUEJPWWp1U2VBM3c2dFU4NGZtUzNPb1VoTlg4Cml4Rnh2T2I3WjMrSU5YWEc5NlFp\naFVBZ3pnN2wyaTc3dzlzN1JzNkJ2VjAKLS0tIGtORGxOMTBUblFFL1BmU3QyNDNx\nWXJuTi9OUTdoWmx3d0krbnBHWmpNWEEKP9eLqA1Xe9ZSr3KnzxHco+5ew12DzrvN\npYVODurxW5XMT62NnUpjThqUKmqwF5c/2Iff2g1nf0FTNTFM6TBNTA==\n-----END AGE ENCRYPTED FILE-----\n
sops_age__list_1__map_recipient=age1dcvh6q9953es9fvt8rq8rdgcktlt64asn2tf2y3vmyz0gntxzynqg2xgzk
sops_lastmodified=2026-08-17T02:23:05Z
sops_mac=ENC[AES256_GCM,data:mfETaHkKsZhpt4OhdvO9ob62IGzOIRu+bhs/xaIbTJQWYKLD8r7Fapj67w4hNhHn1snFcUfc3HM750yeAbu3q9NIxTWfg/UCDvSf+KzUJJEgN2Olg18Mkr+Bc4zmImR88ponu3Y/SYb6UXnGkQ66Tp09+vXga2+1NYlRLODyepY=,iv:Z2h77vj2Su4aZXL+B9RVH2ERcb7YVF94mtH3gkK6PSg=,tag:HfsxlqQakZJdNC9gCJEugQ==,type:str]
sops_unencrypted_suffix=_unencrypted
sops_version=3.13.3

11
hosts/server/hikari/hako/secrets/thetree-search.env Normal file
View file

@ -0,0 +1,11 @@
MEILI_HTTP_ADDR=ENC[AES256_GCM,data:fqLxCeSXXb6kBEai,iv:g/1BtlBKsO45co9suuRik7GhmE01rRFlYzwBhN3N3SI=,tag:tMOHMcoDVha/GK+CriYV3w==,type:str]
MEILI_MASTER_KEY=ENC[AES256_GCM,data:zszgRidx6DigCWNC,iv:Cr8ReGg4BtSNpLIzDARkeFfI5h/0CLccS5kjKknBlxM=,tag:koDswb8LWu0I/Gr3KlGGpg==,type:str]
MEILI_SERVER_PROVIDER=ENC[AES256_GCM,data:KKt4dEvr,iv:k3x40qvlRZTjPzSk0d51l18Nid8K0DCYWVCvQxuzFv8=,tag:AQ8yLNQm1wyWztX7L7dH0g==,type:str]
sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrcUdHamVMZVp2cVlDMU9x\ncEhBeElpTDdiM0ttUURueEkrdGd0bmtGc2hBCkwxSWRVS1YwLzJYT1FxYTFrN2hy\nWXU0djBqRkZqdGZBSEhoL1RjRTB3NEkKLS0tIDU5R3hzN3FIeXFNQzkydVIrYlQ3\nbzZPUWptbkFJWnMyb05ocnNaakpRWk0KDxY560uIdvyofDaCM55A3YonDukEg1U1\nHwiSoTCJ32k/4NUZRzT8/dU0E1KLWg+qDMYHMfYMyoxfUXNHQw5t1w==\n-----END AGE ENCRYPTED FILE-----\n
sops_age__list_0__map_recipient=age1mgels4hjl7l07gcnt72g86kvhrvd82fha9kuvlp46mpks7unrpmqvy959u
sops_age__list_1__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQVzBqN25KU0ZjSFZLSjFw\nUWpER1lyNDd2eVU0OHBxckdLVlRvS2VDcVhRCitCRmwzY1VkUFhxVWFRWHpHNkVW\nNTNJK2RUM1ladDRVWTVDVmRWYmwyOUkKLS0tIHJuNExZRnlCSXlUeVI2czNlYkE3\nblAyaG80Z3JFME9TQWN6MW8xUHlWM0kK59jTNCU+a5kCtxAFGXJZPmuHIt4MTrqj\n9P5X6bxkDj5lInXah//z2XawnFwvqZ+VwIaLUqYWQ4BYq1eN3Y+pDg==\n-----END AGE ENCRYPTED FILE-----\n
sops_age__list_1__map_recipient=age1dcvh6q9953es9fvt8rq8rdgcktlt64asn2tf2y3vmyz0gntxzynqg2xgzk
sops_lastmodified=2026-08-17T01:59:25Z
sops_mac=ENC[AES256_GCM,data:OvE2PZUUDw+4msvnVIULxoEyFI9FZapIqPEHBITZPnRC2QTezYUIpqOVrz0/LM0NYeISNtgW0DtSAe7sLs53kzxCSYDrSBje2Jj8oJ+S7walUAJxXamcfBzIt08jodIfLvqa904lnbn7dUzEki3I6t2dAZf32Auvqwocm1S0B5o=,iv:2IklUA4O6OPPrn9dn9a02/zxxYavLJoz2oqoyMHu8Og=,tag:zjNM72ULAx8uTJM3MYViTA==,type:str]
sops_unencrypted_suffix=_unencrypted
sops_version=3.13.3

12
hosts/server/hikari/hako/secrets/today-webhook.env Normal file
View file

@ -0,0 +1,12 @@
DISCORD_WEBHOOK_SANGJEONG_URL=ENC[AES256_GCM,data:u6xZAQ7Rox8PGUlGH/605O+fp2EWfqMEtFL5Qv1aUNwlsmFLb7xMHN9Dymz3no5jBSavO+fAc2tnPejScqh4cwcH42bDz0GFOWd2hQeYuNQ0Ij6Bwj2r3IqeOzJLf8Q4UsFV8v8ZEbDHpoYGvWyrdl/wl7qaahfJGA==,iv:prlMszhPEDqDyLTZNyviVCRwjAMeiDrQGVJQhcqQJGo=,tag:McmNjjc3g0fTmpPlm7FOSg==,type:str]
DISCORD_WEBHOOK_SUNRIN_URL=ENC[AES256_GCM,data:k3FN4fAwiFyF472OkZedTbk3Dxkzk615MeoolxckQSkO4oeLYY8/eApcG7vfr8CKH4i6RJ0pqVosJ/Sdkca/lv5uXGqm6HD6unbtCIqJO33hzg8aBa2K+IJ6QFo4EXf66HiAHcViChbc6X0D4dX+O2E5I/nzcL7m5w==,iv:8fHmhs0SDSZDKRm30UbrAPeZ0KzLM5OEy6/7y9K8GqA=,tag:Lk5TkHmS/c3TQy7bNlxL+A==,type:str]
GOOGLE_API_KEY=ENC[AES256_GCM,data:x3DtwqaYye9gkzp544CMy7Y9lREln5Kv2EG8cYfyRIS4+0B+dtGK,iv:E9z7rV72NYusQpMg1307HsG5qlXs1fqhApHBwpH/zXM=,tag:lP93fqx6+4L39+2cqGmJlA==,type:str]
NEIS_API_KEY=ENC[AES256_GCM,data:757969b06QRqw1lo08GhKmX4XpH6/qRC9zAVzD//DGs=,iv:K1FRD3elIrfbTy4575rkBX0FHrsN6OWLtvOceTNlQqI=,tag:8kVjsoDtgsh7S6vHeZJuXw==,type:str]
sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoN2FxOWV6bTl3aHRqSHJ3\nRHcvSjZhdnliVVRxK2d6WVhSb1ZoR3NuZmswCld1M2ZBRkViRklnQUpML2Z0UzR4\nTjY1VXROREVpKzk0RmJPbG9VZVB0Zm8KLS0tIGtSL2NaZWJqaUM3c3ZGOUpKbWtz\nOUZnaXphUVgzcHJqUytHSi9CSFRVZ00KDQB4HCEjvgBccOSylxWZan/mVLb4EMVd\ndghAokTR1MdxSdmaCS+JkBczfZRizfkVIkjx6A86H326Qs4aRD0zVQ==\n-----END AGE ENCRYPTED FILE-----\n
sops_age__list_0__map_recipient=age1mgels4hjl7l07gcnt72g86kvhrvd82fha9kuvlp46mpks7unrpmqvy959u
sops_age__list_1__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkRWtGdmRLTWx5Sm5TRmxp\ndkVvYk9zUjZ0VjBMOFl5QXY0MUMzY3czYUVZCnpOUGNteFh1dUlueUk5RFJaVTNP\ndDQ4QWlxVjZ6SEhxeXIvZm5EL2hoY1kKLS0tIFNPdENlRXo0dDJ5L2dqaDc4Z1ZV\nV21kSzlKUW52UHUybG5sb0dtMm4vdUUKpLJVFWsPUQ5WTAnUPsazsjyJe4GfMdsR\nIbSlIfYbkjebykG9sI38/MbQHWZrMpCMM/bN+5FmUW/GOv8L07ZKZQ==\n-----END AGE ENCRYPTED FILE-----\n
sops_age__list_1__map_recipient=age1dcvh6q9953es9fvt8rq8rdgcktlt64asn2tf2y3vmyz0gntxzynqg2xgzk
sops_lastmodified=2026-08-17T01:59:25Z
sops_mac=ENC[AES256_GCM,data:3j/OTABYqER6/o5cNNZtAh4BDmD4AnVEiOohlXfdUafxg2rDbfewqZhai8jbBUi4t6G4jZflJp7388N2xFe85wrma7aRcOiT/n0jS/MQwkgCcCMqQVZ83+lSvpqB65PCf60pFA7s6v3ihTmDqE8tIJ8heTG0sncY9fCnQtF5JZc=,iv:CR8wVeEDCn6P69G3g5pIh/17wlBihEkQe4KVxsaIe7E=,tag:xfXAIYBA798bY3saCxyqKQ==,type:str]
sops_unencrypted_suffix=_unencrypted
sops_version=3.13.3

123
hosts/server/hikari/hako/services/quadlet/authentik.nix Normal file
View file

@ -0,0 +1,123 @@
{ config, ... }:
let
inherit (config.virtualisation.quadlet) containers networks;
authentikEnv = config.sops.secrets."containers/authentik.env".path;
outpostEnv = config.sops.secrets."containers/authentik-outpost.env".path;
in
{
sops.secrets = {
"containers/authentik.env" = {
sopsFile = ../../secrets/authentik.env;
format = "dotenv";
key = "";
mode = "0400";
restartUnits = [
"authentik-db.service"
"authentik-server.service"
"authentik-worker.service"
];
};
"containers/authentik-outpost.env" = {
sopsFile = ../../secrets/authentik-outpost.env;
format = "dotenv";
key = "";
mode = "0400";
restartUnits = [ "authentik-outpost-ldap.service" ];
};
};
virtualisation.quadlet = {
networks.authentik = { };
containers = {
authentik-db = {
containerConfig = {
image = "docker.io/library/postgres:16-alpine";
networks = [ networks.authentik.ref ];
networkAliases = [ "postgresql" ];
volumes = [
"/home/imnyang/Docker/authentik/postgres_data:/var/lib/postgresql/data:Z"
];
environmentFiles = [ authentikEnv ];
healthCmd = "pg_isready -d authentik -U authentik";
healthInterval = "30s";
healthRetries = 5;
healthStartPeriod = "20s";
healthTimeout = "5s";
};
serviceConfig.Restart = "always";
};
authentik-server = {
containerConfig = {
image = "ghcr.io/goauthentik/server:2026.5.0";
exec = "server";
networks = [ networks.authentik.ref ];
publishPorts = [
"9080:9000"
"9443:9443"
];
volumes = [
"/home/imnyang/Docker/authentik/media:/media:Z"
"/home/imnyang/Docker/authentik/custom-templates:/templates:Z"
];
environmentFiles = [ authentikEnv ];
};
unitConfig = {
Requires = [ containers."authentik-db".ref ];
After = [ containers."authentik-db".ref ];
};
serviceConfig.Restart = "always";
};
authentik-worker = {
containerConfig = {
image = "ghcr.io/goauthentik/server:2026.5.0";
exec = "worker";
user = "root";
networks = [ networks.authentik.ref ];
volumes = [
"/home/imnyang/Docker/authentik/certs:/certs:Z"
"/home/imnyang/Docker/authentik/media:/media:Z"
"/home/imnyang/Docker/authentik/custom-templates:/templates:Z"
"/var/run/docker.sock:/var/run/docker.sock"
];
environmentFiles = [ authentikEnv ];
};
unitConfig = {
Requires = [ containers."authentik-db".ref ];
After = [ containers."authentik-db".ref ];
};
serviceConfig.Restart = "always";
};
authentik-outpost-ldap = {
containerConfig = {
image = "ghcr.io/goauthentik/ldap:2026.5.0";
entrypoint = [ "/ldap" ];
user = "1000";
networks = [ networks.authentik.ref ];
publishPorts = [
"389:3389"
"636:6636"
];
environmentFiles = [ outpostEnv ];
};
unitConfig = {
Requires = [ containers."authentik-server".ref ];
After = [ containers."authentik-server".ref ];
};
serviceConfig.Restart = "always";
};
};
};
}

36
hosts/server/hikari/hako/services/quadlet/conduit.nix Normal file
View file

@ -0,0 +1,36 @@
{ config, ... }:
let
inherit (config.virtualisation.quadlet) networks;
in
{
virtualisation.quadlet = {
networks.conduit = { };
containers.conduit = {
containerConfig = {
image = "docker.io/matrixconduit/matrix-conduit:latest";
networks = [ networks.conduit.ref ];
publishPorts = [ "6167:6167" ];
volumes = [
"/home/imnyang/Docker/conduit/db:/var/lib/matrix-conduit:Z"
];
environments = {
CONDUIT_ADDRESS = "0.0.0.0";
CONDUIT_ALLOW_CHECK_FOR_UPDATES = "true";
CONDUIT_ALLOW_FEDERATION = "true";
CONDUIT_ALLOW_REGISTRATION = "true";
CONDUIT_CONFIG = "";
CONDUIT_DATABASE_BACKEND = "rocksdb";
CONDUIT_DATABASE_PATH = "/var/lib/matrix-conduit/";
CONDUIT_MAX_REQUEST_SIZE = "20000000";
CONDUIT_PORT = "6167";
CONDUIT_SERVER_NAME = "mizuki.guru";
CONDUIT_TRUSTED_SERVERS = "[\"matrix.org\"]";
};
};
serviceConfig.Restart = "always";
};
};
}

25
hosts/server/hikari/hako/services/quadlet/paste.nix Normal file
View file

@ -0,0 +1,25 @@
{ config, ... }:
let
inherit (config.virtualisation.quadlet) networks;
in
{
virtualisation.quadlet = {
networks.paste = { };
containers.paste = {
containerConfig = {
image = "git.mizuki.guru/imnyang/paste:latest";
networks = [ networks.paste.ref ];
publishPorts = [ "11108:8000" ];
volumes = [
"/home/imnyang/Docker/paste.mizuki.guru/uploads:/app/uploads:Z"
"/home/imnyang/Docker/paste.mizuki.guru/config.toml:/app/config.toml:Z"
];
environments.ROCKET_ADDRESS = "0.0.0.0";
};
serviceConfig.Restart = "always";
};
};
}

152
hosts/server/hikari/hako/services/quadlet/thetree.nix Normal file
View file

@ -0,0 +1,152 @@
{ config, ... }:
let
inherit (config.virtualisation.quadlet) containers networks;
appEnv = config.sops.secrets."containers/thetree-app.env".path;
databaseEnv = config.sops.secrets."containers/thetree-database.env".path;
searchEnv = config.sops.secrets."containers/thetree-search.env".path;
rustfsEnv = config.sops.secrets."containers/thetree-rustfs.env".path;
in
{
sops.secrets = {
"containers/thetree-app.env" = {
sopsFile = ../../secrets/thetree-app.env;
format = "dotenv";
key = "";
mode = "0400";
restartUnits = [ "thetree-app.service" ];
};
"containers/thetree-database.env" = {
sopsFile = ../../secrets/thetree-database.env;
format = "dotenv";
key = "";
mode = "0400";
restartUnits = [ "thetree-database.service" ];
};
"containers/thetree-search.env" = {
sopsFile = ../../secrets/thetree-search.env;
format = "dotenv";
key = "";
mode = "0400";
restartUnits = [ "thetree-search.service" ];
};
"containers/thetree-rustfs.env" = {
sopsFile = ../../secrets/thetree-rustfs.env;
format = "dotenv";
key = "";
mode = "0400";
restartUnits = [ "thetree-rustfs.service" ];
};
};
virtualisation.quadlet = {
networks.thetree = { };
containers = {
thetree-database = {
containerConfig = {
image = "docker.io/library/mongo:latest";
networks = [ networks.thetree.ref ];
networkAliases = [ "db" ];
volumes = [
"/home/imnyang/Docker/thetree/db:/data/db:Z"
];
environmentFiles = [ databaseEnv ];
};
serviceConfig.Restart = "always";
};
thetree-redis = {
containerConfig = {
image = "docker.io/library/redis:latest";
networks = [ networks.thetree.ref ];
networkAliases = [ "redis" ];
volumes = [
"/home/imnyang/Docker/thetree/redis:/data:Z"
];
};
serviceConfig.Restart = "always";
};
thetree-search = {
containerConfig = {
image = "docker.io/getmeili/meilisearch:v1.23";
networks = [ networks.thetree.ref ];
networkAliases = [ "search" ];
volumes = [
"/home/imnyang/Docker/thetree/meili_data:/meili_data:Z"
];
environmentFiles = [ searchEnv ];
};
serviceConfig.Restart = "always";
};
thetree-rustfs = {
containerConfig = {
image = "docker.io/rustfs/rustfs:latest";
networks = [ networks.thetree.ref ];
networkAliases = [
"rustfs"
"thetree.rustfs"
];
publishPorts = [
"9000:9000"
"9001:9001"
];
podmanArgs = [ "--security-opt=no-new-privileges:true" ];
volumes = [
"/home/imnyang/Docker/thetree/rustfs/data:/data:Z"
"/home/imnyang/Docker/thetree/rustfs/logs:/app/logs:Z"
"/home/imnyang/Docker/thetree/rustfs/certs:/opt/tls:Z"
];
environmentFiles = [ rustfsEnv ];
};
serviceConfig.Restart = "always";
};
thetree-app = {
containerConfig = {
image = "ghcr.io/wjdgustn/thetree:master";
networks = [ networks.thetree.ref ];
publishPorts = [ "51337:3000" ];
addHosts = [ "host.docker.internal:host-gateway" ];
volumes = [
"/home/imnyang/Docker/thetree/skins:/usr/src/app/skins:Z"
"/home/imnyang/Docker/thetree/customStatic:/usr/src/app/customStatic:Z"
"/home/imnyang/Docker/thetree/plugins:/usr/src/app/plugins:Z"
"/home/imnyang/Docker/thetree/cache:/usr/src/app/cache:Z"
"/home/imnyang/Docker/thetree/frontend:/usr/src/app/frontend:Z"
"/home/imnyang/Docker/thetree/config:/usr/src/app/config:Z"
"/etc/timezone:/etc/timezone:ro"
"/etc/localtime:/etc/localtime:ro"
];
environmentFiles = [ appEnv ];
};
unitConfig = {
Requires = [
containers."thetree-database".ref
containers."thetree-redis".ref
containers."thetree-search".ref
containers."thetree-rustfs".ref
];
After = [
containers."thetree-database".ref
containers."thetree-redis".ref
containers."thetree-search".ref
containers."thetree-rustfs".ref
];
};
serviceConfig.Restart = "always";
};
};
};
}

50
hosts/server/hikari/hako/services/quadlet/today.nix Normal file
View file

@ -0,0 +1,50 @@
{ config, ... }:
let
inherit (config.virtualisation.quadlet) builds;
webhookEnv = config.sops.secrets."containers/today-webhook.env".path;
in
{
sops.secrets."containers/today-webhook.env" = {
sopsFile = ../../secrets/today-webhook.env;
format = "dotenv";
key = "";
mode = "0400";
restartUnits = [ "today-webhook.service" ];
};
virtualisation.quadlet = {
builds = {
today-isangjeong.buildConfig = {
file = "/home/imnyang/Docker/today.isangjeong/Dockerfile";
workdir = "/home/imnyang/Docker/today.isangjeong";
tag = "localhost/today-isangjeong";
};
};
containers = {
today-isangjeong = {
containerConfig = {
image = builds.today-isangjeong.ref;
volumes = [
"/home/imnyang/Docker/today.isangjeong/logs:/code/app/temp/logs:Z"
];
};
serviceConfig.Restart = "always";
};
today-webhook = {
containerConfig = {
image = "git.mizuki.guru/imnyang/today.webhook:latest";
volumes = [
"/home/imnyang/Docker/today.webhook/logs:/code/app/temp/logs:Z"
];
environmentFiles = [ webhookEnv ];
};
serviceConfig.Restart = "always";
};
};
};
}