Merge pull request 'Lock file maintenance' (#294) from renovate/lock-file-maintenance into main

.gitea/workflows/build.yml

@@ -12,13 +12,13 @@ jobs:
   build-nixos:
     runs-on: ubuntu-latest
     steps: 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       
       - name: "Install Nix ❄️"
         uses: cachix/install-nix-action@v31
 
     #  - uses: DeterminateSystems/nix-installer-action@v4
-      - uses: DeterminateSystems/magic-nix-cache-action@v13
+      - uses: DeterminateSystems/magic-nix-cache-action@v14
       - uses: DeterminateSystems/flake-checker-action@v12
 
       - name: "Install Cachix ❄️"

.gitea/workflows/update.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: Install nix
         uses: DeterminateSystems/nix-installer-action@v22
         with:

flake.lock

@@ -45,11 +45,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1775037210,
+        "lastModified": 1783395956,
-        "narHash": "sha256-KM2WYj6EA7M/FVZVCl3rqWY+TFV5QzSyyGE2gQxeODU=",
+        "narHash": "sha256-AAbexQvDoK+6GFJdhY6kqjA+6ECKRkidgWxkn4gMwAA=",
         "owner": "lnl7",
         "repo": "nix-darwin",
-        "rev": "06648f4902343228ce2de79f291dd5a58ee12146",
+        "rev": "d5bd9cd77aea4c0a8f49e7fd85545671a208ed15",
         "type": "github"
       },
       "original": {
@@ -102,12 +102,15 @@
       }
     },
     "hardware": {
+      "inputs": {
+        "nixpkgs": "nixpkgs"
+      },
       "locked": {
-        "lastModified": 1776983936,
+        "lastModified": 1783792734,
-        "narHash": "sha256-ZOQyNqSvJ8UdrrqU1p7vaFcdL53idK+LOM8oRWEWh6o=",
+        "narHash": "sha256-50rvY9GdFvpYDcMLcD/4cWSi0hVxArT5wsGlVsHy8eY=",
         "owner": "nixos",
         "repo": "nixos-hardware",
-        "rev": "2096f3f411ce46e88a79ae4eafcfc9df8ed41c61",
+        "rev": "8efb4337e857949f4cfac86d12ef1066f417f31f",
         "type": "github"
       },
       "original": {
@@ -139,11 +142,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1777771528,
+        "lastModified": 1779506708,
-        "narHash": "sha256-YycygK6n7KeW1YCobdFJcORWzkmrvNcp6xT+IovA0d4=",
+        "narHash": "sha256-QOD/CNm196nCJRheux/URi4/HE66fthdOMqCJoPP1Y0=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "0585fbf645640973e3398863bbaf3bd1ddce4a51",
+        "rev": "3ee51fbdac8c8bdfe1e7e1fcaba6520a563f394f",
         "type": "github"
       },
       "original": {
@@ -174,11 +177,11 @@
     },
     "nixUnstable": {
       "locked": {
-        "lastModified": 1777641297,
+        "lastModified": 1783791668,
-        "narHash": "sha256-WNGcmeOZ8Tr9dq6ztCspYbzWFswr2mPebM9LpsfGxPk=",
+        "narHash": "sha256-zbcZ1dmBTPfJ7Mlqh/yLEPGpgJnwuv4Xr1xucy2WqMA=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "c6d65881c5624c9cae5ea6cedef24699b0c0a4c0",
+        "rev": "716c7a2664ca8325617b8a7fbb609273f2c4cae7",
         "type": "github"
       },
       "original": {
@@ -190,18 +193,15 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1777428379,
+        "lastModified": 1767892417,
-        "narHash": "sha256-ypxFOeDz+CqADEQNL72haqGjvZQdBR5Vc7pyx2JDttI=",
+        "narHash": "sha256-8bW3q88CEg2u4hSP66Vf4lpbLonHz7hqDNBMcCY7E9U=",
-        "owner": "nixos",
+        "rev": "3497aa5c9457a9d88d71fa93a4a8368816fbeeba",
-        "repo": "nixpkgs",
+        "type": "tarball",
-        "rev": "755f5aa91337890c432639c60b6064bb7fe67769",
+        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.05pre924538.3497aa5c9457/nixexprs.tar.xz"
-        "type": "github"
       },
       "original": {
-        "owner": "nixos",
+        "type": "tarball",
-        "ref": "nixos-25.11",
+        "url": "https://channels.nixos.org/nixos-unstable/nixexprs.tar.xz"
-        "repo": "nixpkgs",
-        "type": "github"
       }
     },
     "nixpkgs-lib": {
@@ -221,11 +221,27 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1777578337,
+        "lastModified": 1782847189,
-        "narHash": "sha256-Ad49moKWeXtKBJNy2ebiTQUEgdLyvGmTeykAQ9xM+Z4=",
+        "narHash": "sha256-twXPFqFsrrY5r28Zh7Homgcp2gUMBgQ6WDS98Q/3xFI=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "15f4ee454b1dce334612fa6843b3e05cf546efab",
+        "rev": "b6018f87da91d19d0ab4cf979885689b469cdd41",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-25.11",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_3": {
+      "locked": {
+        "lastModified": 1783522502,
+        "narHash": "sha256-iffAls3iaNTyJC2faYcUXSI+Gp02cDjYl+MygxKl2GI=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "0bb7ec54c8483066ec9d7720e780a5caa71f8612",
         "type": "github"
       },
       "original": {
@@ -238,14 +254,14 @@
     "nur": {
       "inputs": {
         "flake-parts": "flake-parts_2",
-        "nixpkgs": "nixpkgs_2"
+        "nixpkgs": "nixpkgs_3"
       },
       "locked": {
-        "lastModified": 1777763626,
+        "lastModified": 1783812717,
-        "narHash": "sha256-UFwZDbdMezNnxZwikhDR4EWiCPUiEmPXHmqLOrcG34g=",
+        "narHash": "sha256-/ShoG1aG4RN+002Y69CQk0HJ8U/DRw5PHGJcgqB/rLQ=",
         "owner": "nix-community",
         "repo": "nur",
-        "rev": "3873764e5896bd6da6cf0df17172849ea51ac5eb",
+        "rev": "f677cb4b829c9df339277c6e80200b1c98320463",
         "type": "github"
       },
       "original": {
@@ -262,7 +278,7 @@
         "home-manager": "home-manager",
         "nix-colors": "nix-colors",
         "nixUnstable": "nixUnstable",
-        "nixpkgs": "nixpkgs",
+        "nixpkgs": "nixpkgs_2",
         "nur": "nur",
         "sops-nix": "sops-nix"
       }
@@ -274,11 +290,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1777338324,
+        "lastModified": 1783174389,
-        "narHash": "sha256-bc+ZZCmOTNq86/svGnw0tVpH7vJaLYvGLLKFYP08Q8E=",
+        "narHash": "sha256-aCWC8ngycU7OdJrU2+Je3qf+1a2ykuBvpPhZT/9tXMc=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "8eaee5c45428b28b8c47a83e4c09dccec5f279b5",
+        "rev": "f1406619a3884cd5c47992a70b8b35c9c0fcb4c9",
         "type": "github"
       },
       "original": {

modules/nixos/system/network/base/default.nix

@@ -7,12 +7,11 @@
     firewall = { 
       enable = true;
       allowedUDPPorts = 
-        (if (config.syscfg.server != false && config.syscfg.server.wireguard) then [ 1515 ] else [ ]) ++ 
+        (if config.syscfg.server ? wireguard then [ 1515 ] else [ ]) ++ 
-        (if (config.syscfg.server != false && config.syscfg.server.web) then [ 80 443 22 ] else [ ]) ++ 
         [ ];
 
       allowedTCPPorts = 
-        (if (config.syscfg.server != false && config.syscfg.server.web) then [ 80 443 22 ] else [ ]) ++ 
+        (if config.syscfg.server ? web       then [ 80 443 22 ] else [ ]) ++ 
         [ ];
     };
   };

modules/server/containers/builder.nix

@@ -1,34 +0,0 @@
-{ config, lib, serverCfg }:
-let 
-  builder =
-  { image, secret ? ""
-  , subdomain ? "", ip ? "", port ? 0
-  , extraEnv ? { }, extraLabels ? { }, extraOptions ? [ ]
-  , overrides ? { }
-  }:
-  let base = {
-    inherit image;
-
-    environmentFiles = if secret !="" then [ config.sops.secrets."${lib.toUpper secret}".path ] else [];
-    environment = {} // extraEnv;
-
-    labels = if subdomain!="" then ({
-      "traefik.enable" = "true";
-      "traefik.http.routers.${subdomain}.entrypoints" = "web-secure";
-      "traefik.http.routers.${subdomain}.rule" = "Host(`${subdomain}.${serverCfg.hostDomain}`)";
-      "traefik.http.routers.${subdomain}.tls" = "true";
-    } // lib.optionalAttrs (port != 0) {
-      "traefik.http.services.${subdomain}.loadbalancer.server.port" = toString port;
-    }) else {
-      "traefik.enable" = "false";
-    } // extraLabels;
-
-    extraOptions = extraOptions ++ [
-      "--add-host=host.containers.internal:host-gateway"
-    ] ++ lib.optional (ip != "") "--ip=${ip}";
-  };
-  in lib.recursiveUpdate base overrides;
-in {
-  mkContainer = builder;
-  host = "host.containers.internal"; 
-}

modules/server/containers/default.nix

@@ -1,10 +1,9 @@
 { config, pkgs, lib, ... }:
 let
-  serverCfg = config.syscfg.server;
+  cfg = config.syscfg.server.containers;
-  builder = import ./builder.nix { inherit config lib serverCfg; };
+  enabledConfigs = lib.filterAttrs (name: c: c.enable) cfg;
-  enabledConfigs = lib.filterAttrs (name: c: c.enable) serverCfg.containers;
   containerSetsList = lib.mapAttrsToList (name: containerCfg:
-  let defs = import (./defs + "/${name}.nix") {inherit config pkgs lib containerCfg builder;};
+  let defs = import (./defs + "/${name}.nix") {inherit config pkgs lib containerCfg;};
   in{
     containers = lib.mapAttrs' (cName: cValue: 
       lib.nameValuePair "${name}-${cName}" cValue

modules/server/containers/defs/authentik.nix

@@ -1,6 +1,5 @@
-{ config, containerCfg, pkgs, lib, builder, ... }:
+{ config, containerCfg, pkgs, lib, ... }:
 let 
-version = "2026.2.2";
 serverCfg = config.syscfg.server;
 in {
   paths = [{
@@ -14,57 +13,66 @@ in {
   }];
 
   containers = {
-    server = builder.mkContainer {
+
-      subdomain = containerCfg.subdomain;
+    server = {
-      image = "ghcr.io/goauthentik/server:${version}";
+      image = "ghcr.io/goauthentik/server:latest";
-      port = containerCfg.port;
+      volumes = [
-      ip = containerCfg.ip;
+        "${serverCfg.dataPath}/authentik/media:/media"
-      secret = "authentik";
+        "${serverCfg.dataPath}/authentik/templates:/templates"
-      extraEnv = {
+      ];
-        "AUTHENTIK_REDIS__HOST" = builder.host;
+      environmentFiles = [
-        "AUTHENTIK_POSTGRESQL__HOST" = builder.host;
+        config.sops.secrets."AUTHENTIK".path
+      ];
+      environment = {
+        "AUTHENTIK_REDIS__HOST" = "host.containers.internal";
+        "AUTHENTIK_POSTGRESQL__HOST" = "host.containers.internal";
         "AUTHENTIK_POSTGRESQL__USER" = "authentik_user";
         "AUTHENTIK_POSTGRESQL__NAME" = "authentik_db";
-        "AUTHENTIK_EMAIL__HOST" = serverCfg.mailDomain;
+        "AUTHENTIK_EMAIL__HOST" = "${serverCfg.mailDomain}";
         "AUTHENTIK_EMAIL__PORT" = "587";
         "AUTHENTIK_EMAIL__USERNAME" = "noreply@${serverCfg.hostDomain}";
         "AUTHENTIK_EMAIL__USE_TLS" = "true";
         "AUTHENTIK_EMAIL__USE_SSL" = "false";
         "AUTHENTIK_EMAIL__TIMEOUT" = "10";
         "AUTHENTIK_EMAIL__FROM" = "sso@noreply.${serverCfg.hostDomain}";
-        "AUTHENTIK_DISABLE_UPDATE_CHECK" = "true";
-        "AUTHENTIK_POSTGRESQL__SSLMODE" = "disable";
       };
-      overrides = {
+      labels = {
+        "traefik.enable" = "true";
+        "traefik.http.routers.sso.entrypoints" = "web-secure";
+        "traefik.http.routers.sso.rule" = "Host(`sso.${serverCfg.hostDomain}`)";
+        "traefik.http.routers.sso.tls" = "true";
+        "traefik.http.services.sso.loadbalancer.server.port" = "${toString containerCfg.port}";
+      };
       cmd = [ "server" ];
-        ports = if containerCfg.pubPort != 0 && containerCfg.port != 0 then [ "${toString containerCfg.pubPort}:${toString containerCfg.port}" ] else [];
+      extraOptions = [
-        volumes = [
+        "--add-host=host.containers.internal:host-gateway"
-          "${serverCfg.dataPath}/authentik/media:/media"
+        "--ip=${containerCfg.ip}"
-          "${serverCfg.dataPath}/authentik/templates:/templates"
+      ];
+      ports = [
+        "9999:${toString containerCfg.port}"
       ];
-      };
     };
 
-    worker = builder.mkContainer {
+    worker = {
-      image = "ghcr.io/goauthentik/server:${version}";
+      image = "ghcr.io/goauthentik/server:latest";
-      secret = "authentik";
-      extraEnv = {
-        "AUTHENTIK_REDIS__HOST" = builder.host;
-        "AUTHENTIK_POSTGRESQL__HOST" = builder.host;
-        "AUTHENTIK_POSTGRESQL__USER" = "authentik_user";
-        "AUTHENTIK_POSTGRESQL__NAME" = "authentik_db";
-        "AUTHENTIK_DISABLE_UPDATE_CHECK" = "true";
-        "AUTHENTIK_POSTGRESQL__SSLMODE" = "disable";
-      };
-      # extraOptions = [ "--user=:994" ]; #PODMAN GROUP FOR SOCKET ACCESS
-      overrides = {
-        cmd = [ "worker" ];
       volumes = [
         "${serverCfg.dataPath}/authentik/media:/media"
         "${serverCfg.dataPath}/authentik/templates:/templates"
-          # "/var/run/podman/podman.sock:/var/run/docker.sock" #PODMAN GROUP FOR SOCKET ACCESS
+        "/var/run/docker.sock:/var/run/docker.sock"
       ];
+      environmentFiles = [
+        config.sops.secrets."AUTHENTIK".path
+      ];
+      environment = {
+        "AUTHENTIK_REDIS__HOST" = "host.containers.internal";
+        "AUTHENTIK_POSTGRESQL__HOST" = "host.containers.internal";
+        "AUTHENTIK_POSTGRESQL__USER" = "authentik_user";
+        "AUTHENTIK_POSTGRESQL__NAME" = "authentik_db";
       };
+      extraOptions = [
+        "--add-host=host.containers.internal:host-gateway"
+      ];
+      cmd = [ "worker" ];
     };
   };
 }

modules/server/database/default.nix

@@ -62,6 +62,7 @@ in {
           
           if [ -f "${config.sops.secrets."${lib.toUpper name}".path}" ]; then
             PASS=$(grep "^DB_PASSWORD=" "${config.sops.secrets."${lib.toUpper name}".path}" | cut -d'=' -f2-)
+            echo $PASS
             if $PSQL -tAc "ALTER USER ${name}_user WITH PASSWORD '$PASS';" ; then
                 echo "✅ Successfully set password for ${name}_user"
             else

modules/server/default.nix

@@ -1,3 +1,3 @@
 { config, pkgs, lib, ... }:{
-  imports = [ ./containers ./database ./nftables ./nginx ./openssh ./sops ];
+  imports = [ ./containers ./database ./nftables ./openssh ./sops ];
 }

modules/server/nftables/default.nix

@@ -1,13 +1,7 @@
-{ config, lib, ... }:
-let
- cfg = config.syscfg.server;
 
-  DBlistNames = config.syscfg.server.db;
+
-  DBcontainerNames = lib.mapAttrsToList 
+{ config, lib, ... }:{
-    (name: cfg: name) 
+  config = lib.mkIf (config.syscfg.server.nftables.enable) {
-    (lib.filterAttrs (name: cfg: cfg.db or false) config.syscfg.server.containers);
-  DBallApps = lib.unique (DBlistNames ++ DBcontainerNames);
-in{
     boot.kernel.sysctl = {
       "net.ipv4.ip_forward" = 1;
       "net.ipv6.conf.all.forwarding" = 1;
@@ -17,20 +11,11 @@ in{
     networking.nftables.ruleset = ''
       table inet filter {
         chain input {
-          type filter hook input priority filter; policy drop;
+          type filter hook input priority filter; policy accept;
-          ct state established,related accept
+          tcp dport {5432, 6379} ip saddr { 10.0.0.0/8 169.254.0.0/16 } accept
-          iifname "lo" accept
-          tcp dport {422, 22} accept
-          ${if builtins.length DBallApps > 0 then ''tcp dport {5432, 6379} ip saddr { 10.0.0.0/8, 169.254.0.0/16 } accept'' else ""}
-          ${if cfg.web then ''tcp dport {80, 443} accept
-          udp dport {80, 443} accept'' else ""}
-          ${if cfg.wireguard then ''tcp dport {1515} accept
-          udp dport {1515} accept'' else ""}
-          
           
         }
       }
-      ${if cfg.nftables.enable then ''
       table inet nat {
         chain prerouting {
           type nat hook prerouting priority dstnat; policy accept;
@@ -56,6 +41,7 @@ in{
           type nat hook postrouting priority srcnat; policy accept;
           oifname { ${lib.concatMapStringsSep ", " (iface: ''"${iface}"'') config.syscfg.server.nftables.ifs} } masquerade
         }
-      }'' else ""}
+      }
     '';
+  };
 }

modules/server/nginx/default.nix

@@ -1,133 +0,0 @@
-{ config, lib, pkgs, ... }:
-let
-  cfg = config.syscfg.server;
-  containers = cfg.containers; 
-  faviconOverride = {
-    " ~* /favicon\.(ico|png|svg|jpg)$" = {
-      extraConfig = ''
-        add_header Content-Type image/svg+xml;
-        return 200 '<svg xmlns="http://www.w3.org/2000/svg" id="Layer_1" data-name="Layer 1" viewBox="0 0 50 50"><defs><style>.cls-1{fill:#fd4b2d;}</style></defs><path class="cls-1" d="M30.83,5A23.23,23.23,0,0,0,10.41,67.13h10.8C26,63,32.94,61.8,38,67.13H49.39C44.93,61.09,38.24,55,30.83,55Z"/><path class="cls-1" d="M46.25,28.11c-14.89,31.15-41,4.6-25-11H10.41c-8.47,14.76,3.24,34.68,20.42,34.23,13.28,0,24.24-19.72,24.24-23.21,0-1.54-2.14-6.25-5.68-11H38A40.52,40.52,0,0,1,46.25,78.11Zm.4-.91Z"/></svg>';
-      '';
-      # proxyPass = "http://127.0.0.1:9000";
-    };
-  };
-  # Function to convert your container config into an NGINX vhost
-  mkVhost = container: {
-    forceSSL = true;
-    # quic = true;
-    # http3 = true;
-    useACMEHost = "${cfg.hostDomain}";
-    locations = faviconOverride // {
-      "/" = {
-        proxyPass = "http://${container.ip}:${toString container.port}";
-        proxyWebsockets = true; # Recommended for modern apps
-      };
-    };
-  };
-  
-in {
-  config = lib.mkIf ( config.syscfg.server.web) {
-    security.acme = {
-      acceptTerms = true;
-      defaults.email = "admin@domain.org";
-
-      certs."${cfg.hostDomain}" = {
-        domain = "*.${cfg.hostDomain}";
-        extraDomainNames = [ "${cfg.hostDomain}" ]; # Adds the root too
-        dnsProvider = "infomaniak";
-        credentialsFile = config.sops.secrets."INFOMANIAK_API_KEY".path; # File containing your API token (e.g. CLOUDFLARE_DNS_API_TOKEN=...)
-        group = "nginx"; 
-      };
-    };
-
-    services.nginx = {
-      enable = true;
-      recommendedProxySettings = true;
-      recommendedTlsSettings = true;
-      recommendedGzipSettings = true;
-
-      # appendHttpConfig = ''
-      #   add_header Alt-Svc 'h3=":443"; ma=86400';
-      # '';
-      commonHttpConfig = ''
-        proxy_buffer_size 32k;
-        proxy_buffers 8 16k;
-        proxy_busy_buffers_size 48k;
-        port_in_redirect off;
-      '';
-
-      virtualHosts = {
-        "_" = {
-          default = true;
-          forceSSL = true;
-          # quic = true;
-          # http3 = true;
-          useACMEHost = "${cfg.hostDomain}";
-          
-          locations = {
-            "/" = {
-              extraConfig = ''
-              return 404;
-              '';
-            };
-          };
-        };
-        "sec.${cfg.hostDomain}" = {
-          forceSSL = true;
-          # quic = true;
-          # http3 = true;
-          useACMEHost = "${cfg.hostDomain}";
-          
-          locations = {
-            "/" = {
-              extraConfig = ''
-                proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
-                proxy_set_header X-Original-URI $scheme://$http_host$request_uri;
-                auth_request     /outpost.goauthentik.io/auth/nginx;
-                error_page       401 = @goauthentik_proxy_signin;
-                auth_request_set $auth_cookie $upstream_http_set_cookie;
-                add_header       Set-Cookie $auth_cookie;
-                
-                auth_request_set $authentik_username $upstream_http_x_authentik_username;
-                auth_request_set $authentik_groups $upstream_http_x_authentik_groups;
-                auth_request_set $authentik_entitlements $upstream_http_x_authentik_entitlements;
-                auth_request_set $authentik_email $upstream_http_x_authentik_email;
-                auth_request_set $authentik_name $upstream_http_x_authentik_name;
-                auth_request_set $authentik_uid $upstream_http_x_authentik_uid;
-
-                proxy_set_header X-authentik-username $authentik_username;
-                proxy_set_header X-authentik-groups $authentik_groups;
-                proxy_set_header X-authentik-entitlements $authentik_entitlements;
-                proxy_set_header X-authentik-email $authentik_email;
-                proxy_set_header X-authentik-name $authentik_name;
-                proxy_set_header X-authentik-uid $authentik_uid;
-              '';
-            };
-
-            "/outpost.goauthentik.io" = {
-              proxyPass = "http://${config.syscfg.server.containers.authentik.ip}:${toString config.syscfg.server.containers.authentik.port}/outpost.goauthentik.io";
-              extraConfig = ''
-                proxy_set_header        Host $host;
-                proxy_set_header        X-Original-URL $scheme://$http_host$request_uri;
-                proxy_set_header        X-Original-URI $scheme://$http_host$request_uri;
-                add_header              Set-Cookie $auth_cookie;
-                auth_request_set        $auth_cookie $upstream_http_set_cookie;
-                proxy_pass_request_body off;
-                proxy_set_header        Content-Length "";
-              '';
-            };
-          };
-          extraConfig = ''
-            location @goauthentik_proxy_signin {
-                internal;
-                add_header Set-Cookie $auth_cookie;
-                return 302 https://${cfg.containers.authentik.subdomain}.${cfg.hostDomain}/outpost.goauthentik.io/start?rd=$scheme://$http_host$request_uri;
-            }
-          '';
-        };
-      } //lib.mapAttrs' (name: v: 
-        lib.nameValuePair "${v.subdomain}.${cfg.hostDomain}" (mkVhost v)
-      ) containers;
-    };
-  };
-}

modules/server/sops/server.yaml

@@ -1,6 +1,5 @@
-INFOMANIAK_API_KEY: ENC[AES256_GCM,data:LFAT94Wr/rggjpIkFa2RINJTSRIcrFAfgtZzI75hyGUK/sHuIgNtsvBJnztwKcUG99mC9hRjj8NoRtBHDM9JU+VNWi1rJVCq3jQg5kuU1Dk/js5lJRpqBJOfeigxfxkU+JiDcujNK7Q/,iv:DEvTTcdEvbmHsSx+qX+QDm1ISR5y7L4fKKLXjUFCopE=,tag:46uXjEHmnzH1P9Kb5z8j8g==,type:str]
+INFOMANIAK_API_KEY: ENC[AES256_GCM,data:QhjQoCMxogXAPtvUbf/EWkqsFAndn73LBuTqj5essjruekynH287D/CYN/cwfcnDqZoh6Z4A9p08uUmXzqmTiralAhsCoc+Ljb/monmsruc=,iv:8rMGNc9398jnFXZm34fOht6fMNDAcDZ68B1jwoQPn2Q=,tag:ZlQnPaxkCktpwiC6HzmFVg==,type:str]
-AUTHENTIK: ENC[AES256_GCM,data:2A9hFi6aq46CHqu51iHMuvaBBSBseR+0Qy7a1q7356j0z4uzTR2fPaLITXsrGZavFWiPEsDwZuFPsG8p4CHWdEmPoXtOFB6AnX8RS7mKPMFGJiAkOUyxcoErlh6NWw0EfV3r6GSNl5Rhubv19mWOwSnPSUSNROgJUrfJR5AiZKZqeX/85IjGUNx8xAXmfcZnb/pPX1ir45f/2+HW/9qg3+cNSG2xi8mzEfw9X1Nt+lvvIj+PJm9PrvY15pl68O/qMQK4LhCwnJ8kRitR5kk3R0eCEz6Ix46+7ELbFKP8g22ksHalzsKdwQozmzlspD0horDolJK04ZR4Bay9+Ovq2hqcMb9Nbbv+WkxUg7VnAmP18tBJ2mwk/p8DMfZ3/lSIffBR/cKXU2Nz4ZctH5ShCy7ul+wk32waKu75xsBv7l3Ka2RYUJLLmTk6NeU1ol/lfVqusLy7kuDdawG0fgCpjd0gJQCv0l+zA75psj1ZfAJxTEY6Fa1INic82/05yhz3YAss2pI2uTFD296Tb2a4cw13fL9kwbs=,iv:u7o7aC7NHyl0myD24ibBZWcw10xYm9+KDo/scvBU42E=,tag:hgMT4f8MRBu8DNLcZxcbgQ==,type:str]
+AUTHENTIK: ENC[AES256_GCM,data:jNcqbLEMbaQ7mmn4dK4LFguecDDxrBsQZaqfQeQ+iGel6mD4jAC6rNdGC8H8NepRWmc0ZjNC6Fe4EaGllbjq/50SqlB47DtyuuCwOZFP6fiU4sD13B7t0Fg/7xMomqnRnJ+3UyVzt6PgEzzQNoPPpHxVGpR+TJnROhflcmCKi/JdAR6dspNqJEbrjp4LVk28Rp9Od6lbsOGphRb79z/DKA1QYRPuE7QU7Edzqqy09g5nKjGxIxjWNEYPt0WiD3537eBICfWm5krs8jxyf6TSiGasHSgSDyJSbnoNkPzSf9A5Jwtulu1jFgjvY/v+qhs9649USp1MzogSAfDZBNC4irge/lb5EPPIQ31EC/Dybza9dX/h6cR/KyQm5GsxBBJzm33rzC/4aCCRlcsAl5eO4JZn4MZta4yHss2UQHQ48i15OSdBwwTbTt240UbrIIje0hfOM6R+Uk3VOY/+VtBV/D+0ks2SUEKMvWgqJDhDh4FVqeR0a9dpLhOAvaWryAAETjlHljOrcF3Q3WooZbBDvLyMMtsHIeF1JDqwghI3,iv:8RdNbsnVVu4awW6yrpLGxAtM7o6uN5vgZIotmT6osW8=,tag:rNaCeG6STXINm42x1b2jcw==,type:str]
-_: ENC[AES256_GCM,data:wX0EGbxH4aNXsyVYkTifC6MMlqDlDNiTxj6GVHz3SrNtjfBeye8nsObCknQahaT98RLUIeQh4lFXyZjcSB9jwcacIu5GNFNRHN4BhCE8T8Ui/YZqb7Pd8A87hfCd+bRmROc4Hm4=,iv:28kfp8uVbbBkmEe8qPZESXZuciNYXpV4BQAl5tFRung=,tag:FqKvCH4Zzf/D8uffC1j8nQ==,type:str]
 sops:
     age:
         - recipient: age1sxzuhh2fcd4pmaz4mdqq95t683d32ft22w9t2r7pk258u0s8wymsqdj7lg
@@ -21,8 +20,8 @@ sops:
             S1NaTVFTL0FCdm1EQmRsUnlhclZNZlEKEgIe60qkvY8+UocjQU+WM2dTL/1y3Kqk
             d4RrlLP9NSozwVsPYI4ntygvMSApbT4v0YvoO7gV90lkGWEvW1YDfA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-05-07T23:18:58Z"
+    lastmodified: "2026-05-06T01:10:20Z"
-    mac: ENC[AES256_GCM,data:zuxxX9DECskSquiKWqPkaIQiIdgNSKsKJMF1k3Vk+ATrVgwMw+KHV9B6hQkNfKRhjLO7oEOcYdOJW/xeUytAVJKgUGBAVqrWrDuPHBOfD+PE5OTdaiNz29fUCnBF11SZ2Sec2J9ZbUY7lVQeFBFpjWyE5ObF7ySVV17C5w1GajM=,iv:4dSiYJDKw2NofbhwVQ8tGr1GTCB37DSbyKCPtIgV2B8=,tag:UED5v+rgxo44H5YwU05pBw==,type:str]
+    mac: ENC[AES256_GCM,data:O4RLfEE6z0uDRpZdL47Or+z/PTeJ+zgzXN9kJS6Nebs9Uhw0XUJUPGhAocLokiMin5sQcpxXG5Q8oc2rAkq2GDbtna4u26dtNkd2Q/vtly6DqUaIRXXt3TL5cfJwMNa76fp+ERKLwGbBG+/BFWajzYJtcE257I8t3X4UmAdqYmE=,iv:uYLh8LnGobf7t3Ur7drEiA6n3Vv0e0yhlja6Uww8jiU=,tag:ZK3OCCsiMPtKl28lrGKtqQ==,type:str]
     pgp:
         - created_at: "2026-05-05T23:46:27Z"
           enc: |-

modules/shared/syscfg/default.nix

@@ -107,10 +107,8 @@ let
         options = {
           enable = mkOption { type = types.bool;default = false; };
           db = mkOption { type = types.bool;default = false; };
-          ip = mkOption { type = types.nullOr types.str; default = null;};
+          ip = mkOption { type = types.str; };
-          subdomain = mkOption { type = types.nullOr types.str; default=null;};
+          port = mkOption { type = types.port; };
-          port = mkOption { type = types.port; default = 0; };
-          pubPort = mkOption { type = types.port; default = 0; };
           extraParam = mkOption { type = types.str; default = ""; };
         };
       });

systems/sandbox/cfg.nix

@@ -35,7 +35,6 @@
         authentik = {
           enable = true;
           db = true;
-          subdomain = "sso";
           ip = "10.88.0.125";
           port = 9000 ;
         };