darmanandClaude Sonnet 5
5507dfac0a
Headscale is the tailnet control server every host's services/tailscale.nix already points at (--login-server=https://vpn.mgaction.town). MagicDNS base_domain "hosts.mgaction.town" matches the "jupiter.hosts.mgaction.town" names already used in this repo's Caddy vhosts. Headplane is its web UI, running as headscale's own user (native process integration, no container). No OIDC wired up - log in with a headscale API key generated on the box. Both proxied through Caddy; headscale's vhost needs flush_interval -1 since its node-update endpoint is a long-poll. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
43 lines
1.7 KiB
Nix
43 lines
1.7 KiB
Nix
{ config, ... }:
|
|
|
|
# sops-nix wiring for neptun (netcup VPS). Encrypted values in ../../secrets/neptun.yaml,
|
|
# decrypted with the VPS's own SSH host key (recipient in ../../.sops.yaml).
|
|
# The host key is pre-generated on the laptop and shipped at install
|
|
# (nixos-anywhere --extra-files -> /etc/ssh/ssh_host_ed25519_key).
|
|
{
|
|
sops.defaultSopsFile = ../../secrets/neptun.yaml;
|
|
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
|
|
|
sops.secrets.tailscale_authkey = { };
|
|
|
|
# darman's console password (own hash = distinct from jupiter/mercury).
|
|
sops.secrets.darman_password.neededForUsers = true;
|
|
users.users.darman.hashedPasswordFile = config.sops.secrets.darman_password.path;
|
|
|
|
# Zitadel: masterKeyFile takes a path natively (no store leak). The admin
|
|
# bootstrap password is different — services.zitadel.steps would render it
|
|
# into a world-readable store path, so render a FirstInstance steps file
|
|
# from the secret instead and point extraStepsPaths at it (see
|
|
# services/zitadel.nix and the pihole.env template on mercury for the same
|
|
# pattern).
|
|
sops.secrets.zitadel_master_key = { };
|
|
sops.secrets.zitadel_admin_password = { };
|
|
sops.templates."zitadel-first-instance.yaml".content = ''
|
|
FirstInstance:
|
|
Org:
|
|
Name: mgaction
|
|
Human:
|
|
UserName: admin
|
|
FirstName: Admin
|
|
LastName: Admin
|
|
Email:
|
|
Address: erik.simon.me@gmail.com
|
|
Verified: true
|
|
Password: ${config.sops.placeholder.zitadel_admin_password}
|
|
PasswordChangeRequired: false
|
|
'';
|
|
|
|
# Headplane: cookie_secret_path takes a path natively (no store leak).
|
|
sops.secrets.headplane_cookie_secret = { };
|
|
}
|