darman/homelab
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity
61 Commits 2 Branches 0 Tags
d9e6b6b697379c96c72a17dc14864e80cd20e82e
Commit Graph
8 Commits
Author SHA1 Message Date
darmanandClaude Opus 4.8 d9e6b6b697 headplane: point OIDC at the real Authentik app; rotate tailnet keys 
The Authentik provider and application now exist (slug "headplane", which
is what makes the issuer .../application/o/headplane/), so the client ID
is a real value rather than a placeholder, and the client secret and
headscale API key are in sops.

The tailscale pre-auth keys for neptun and jupiter are rotated because
the tailnet was recreated from scratch: the old headscale database went
with the VPS's OS disk, so every key issued against it is meaningless to
the new control server.

Note the headscale API key defaults to a 90d expiry. When it lapses
headplane stops listing nodes with no obvious cause -- `headscale apikeys
list` shows the date.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-07-20 19:41:40 +02:00
darmanandClaude Sonnet 5 69a63dc615 Add *arr media stack + Gitea to jupiter 
- sabnzbd, prowlarr, sonarr, radarr, clonarr, seerr, cinephage, mediamanager
  services, wired into jupiter with LAN Caddy vhosts.
- Gitea: migrated the old ZimaOS docker instance's data (sqlite db, 4 repos,
  no LFS objects) into the NixOS module's default stateDir layout. HTTP via
  Caddy; git SSH on its own built-in server at :2222 (not :222 - the unpriv
  gitea user can't bind <1024).
- mediamanager-nix flake input for the mediamanager service.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
 2026-07-19 21:27:50 +02:00
erik 25c6982cea feat(audiobookshelf): bind 0.0.0.0 so it's reachable over tailscale (VPS proxy) 2026-07-13 00:26:16 +02:00
erik 5dddc9d2fb feat: tailscale via headscale (vpn.mgaction.town) + fix audiobookshelf extraGroups syntax 
- services.tailscale auto-registers with headscale using a sops pre-auth key
- trust tailscale0 so LAN services are reachable over the tailnet
- fix missing semicolon on audiobookshelf extraGroups
 2026-07-13 00:17:41 +02:00
erik 5239f1ce71 chore: set real samba + darman secrets; edit_secrets zeditor support 2026-07-12 21:35:58 +02:00
erikandClaude Opus 4.8 dd6c4829ad feat: darman login password via sops (hashedPasswordFile) 
- add darman_password (sha-512 hash) to secrets/jupiter.yaml
- neededForUsers so it lands in /run/secrets-for-users before user setup
- real host uses hashedPasswordFile; VM keeps its test initialPassword

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-07-12 21:22:00 +02:00
erikandClaude Opus 4.8 f9358375b5 feat: sops decrypts via pre-generated SSH host key (works on boot #1) 
- pre-generate jupiter SSH host key off-repo (~/.config/homelab/jupiter)
- derive age recipient via ssh-to-age, add to .sops.yaml, re-encrypt secret
- secrets.nix: sops.age.sshKeyPaths = host key (drop separate keyFile)
- gitignore private-key patterns
- README: ship host key via nixos-anywhere --extra-files; secret decrypts boot #1

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-07-12 20:48:33 +02:00
erikandClaude Opus 4.8 10387fdbee feat: sops-nix for samba password secret 
- add sops-nix input + module (jupiter only, not the VM)
- secrets/jupiter.yaml: age-encrypted samba_password (safe to commit)
- .sops.yaml: encryption rule for admin age key
- secrets.nix: decrypt samba_password to /run/secrets on the host
- provisioning oneshot reads sops secret (host) or plaintext (VM), single value
- .sops private key stays off-repo (~/.config, /var/lib/sops-nix on host)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-07-12 20:16:17 +02:00