tmp ignore

test
fix
2026-05-10 11:56:13 +02:00 · 2026-05-10 11:55:53 +02:00 · 2026-05-10 11:54:37 +02:00 · 2026-05-10 11:52:32 +02:00 · 2026-05-10 11:50:34 +02:00 · 2026-05-10 11:49:18 +02:00
25 changed files with 744 additions and 389 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -2,3 +2,4 @@ result
 age-key.txt
 .decrypted~common.yaml
 .decrypted*
+.tmp
--- a/flake.nix
+++ b/flake.nix
@@ -17,19 +17,11 @@
      inputs.nixpkgs.follows = "nixpkgs";
    };

-    # hyprland = {
-    #   url = "github:hyprwm/Hyprland";
-    #   inputs.nixpkgs.follows = "nixpkgs";
-    # };
    sops-nix = {
      url = "github:Mic92/sops-nix";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    nix-colors.url = "github:misterio77/nix-colors";
-
-    arion.url = "github:hercules-ci/arion";
-    arion.inputs.nixpkgs.follows = "nixpkgs";
-
  };

  outputs = inputs:
--- a/generator.nix
+++ b/generator.nix
@@ -13,7 +13,6 @@
          ./modules/nixos
          syscfg
          ./systems/${host}
-          inputs.arion.nixosModules.arion
          inputs.sops-nix.nixosModules.sops
          inputs.home-manager.nixosModules.home-manager
          {
--- a/modules/nixos/system/hw/virt/default.nix
+++ b/modules/nixos/system/hw/virt/default.nix
@@ -18,5 +18,6 @@
        };
      };
    };
+    virtualisation.containers.registries.search = [ "quay.io" "docker.io" "ghcr.io" ];
  };
 }
--- a/modules/nixos/system/network/base/default.nix
+++ b/modules/nixos/system/network/base/default.nix
@@ -7,11 +7,13 @@
    firewall = { 
      enable = true;
      allowedUDPPorts = 
-        (if config.syscfg.server ? wireguard then [ 1515 ] else [ ]) ++ 
+        (if (config.syscfg.server != false && config.syscfg.server.wireguard) then [ 1515 ] else [ ]) ++ 
+        (if (config.syscfg.server != false && config.syscfg.server.web) then [ 80 443 22 ] else [ ]) ++ 
        [ ];

      allowedTCPPorts = 
-        (if config.syscfg.server ? web       then [ 80 443 22 ] else [ ]) ++ 
+        (if (config.syscfg.server != false && config.syscfg.server.web) then [ 80 443 22 ] else [ ]) ++ 
+        (if (config.syscfg.server != false) then [ 5432 6379 ] else [ ]) ++ 
        [ ];
    };
  };
--- a/modules/server/containers/builder.nix
+++ b/modules/server/containers/builder.nix
@@ -0,0 +1,37 @@
+{ config, lib, serverCfg }:
+let 
+  builder =
+  { image ? null, imageStream ? null
+  , secret ? null
+  , subdomain ? null, ip ? null, port ? 0
+  , extraEnv ? { }, extraLabels ? { }, extraOptions ? [ ]
+  , overrides ? { }
+  }:
+  let base = {
+    image = if imageStream != null then "${imageStream.imageName}:${imageStream.imageTag}" 
+            else image;
+    imageStream = imageStream;
+
+    environmentFiles = if secret!=null then [ config.sops.secrets."${lib.toUpper secret}".path ] else [];
+    environment = {} // extraEnv;
+
+    labels = (if subdomain!=null then ({
+      "traefik.enable" = "true";
+      "traefik.http.routers.${subdomain}.entrypoints" = "web-secure";
+      "traefik.http.routers.${subdomain}.rule" = "Host(`${subdomain}.${serverCfg.hostDomain}`)";
+      "traefik.http.routers.${subdomain}.tls" = "true";
+    } // lib.optionalAttrs (port!=null) {
+      "traefik.http.services.${subdomain}.loadbalancer.server.port" = toString port;
+    }) else {
+      "traefik.enable" = "false";
+    }) // extraLabels;
+
+    extraOptions = extraOptions ++ [
+      "--add-host=host.containers.internal:host-gateway"
+    ] ++ lib.optional (ip!=null) "--ip=${ip}";
+  };
+  in lib.recursiveUpdate base overrides;
+in {
+  mkContainer = builder;
+  host = "host.containers.internal"; 
+}
--- a/modules/server/containers/default.nix
+++ b/modules/server/containers/default.nix
@@ -1,14 +1,23 @@
 { config, pkgs, lib, ... }:
 let
-  cfg = config.syscfg.server.containers;
-  enabledConfigs = lib.filterAttrs (name: c: c.enable) cfg;
+  serverCfg = config.syscfg.server;
+  builder = import ./builder.nix { inherit config lib serverCfg; };
+  enabledConfigs = lib.filterAttrs (name: c: c.enable) serverCfg.containers;
  containerSetsList = lib.mapAttrsToList (name: containerCfg:
-    import (./defs + "/${name}.nix") {
-      inherit config pkgs lib  containerCfg;
-    }
-  ) enabledConfigs;
+  let defs = import (./defs + "/${name}.nix") {inherit config pkgs lib containerCfg builder name;};
+  in{
+    name = name;
+    containers = lib.mapAttrs' (cName: cValue: 
+      lib.nameValuePair "${name}-${cName}" cValue
+    ) defs.containers;
+    paths = defs.paths or [];
+    setup = defs.setup or null;
+    cron = defs.cron or [];
+  }
+) enabledConfigs;
  mergedContainers = lib.attrsets.mergeAttrsList  (lib.map(e: e.containers) containerSetsList);
-  allPathConfigs = lib.flatten (lib.map (e: e.paths or []) containerSetsList);
+  allPathConfigs = lib.flatten (lib.map (e: e.paths) containerSetsList);
+  allCronsConfigs = lib.flatten (lib.map (e: e.cron or []) containerSetsList);
 in
 {
  config = lib.mkIf ( enabledConfigs != {} ) {
@@ -17,24 +26,49 @@ in
      backend = "podman";
      containers = mergedContainers;
    };
-
-    systemd.services.podman-gc = {
-      description = "Podman garbage collection";
-      serviceConfig.Type = "oneshot";
-      script = ''
-        ${pkgs.podman}/bin/podman container prune -f
-        ${pkgs.podman}/bin/podman image prune -f
-      '';
-      startAt = "weekly";
-    };
    
    system.activationScripts.container-setup-dirs = {
      deps = [ "users" "groups" ];
      text = lib.concatStringsSep "\n" (map (cfg: ''
-        mkdir -p "${cfg.path}"
-        chown ${cfg.owner} "${cfg.path}"
-        chmod ${cfg.mode} "${cfg.path}"
+        ${pkgs.coreutils}/bin/mkdir -p "${cfg.path}"
+        ${pkgs.coreutils}/bin/chown ${cfg.owner} "${cfg.path}"
+        ${pkgs.coreutils}/bin/chmod ${cfg.mode} "${cfg.path}"
      '') allPathConfigs);
    };
+
+    systemd.services = {
+      podman-gc = {
+        description = "Podman garbage collection";
+        serviceConfig.Type = "oneshot";
+        script = ''
+          ${pkgs.podman}/bin/podman container prune -f
+          ${pkgs.podman}/bin/podman image prune -f
+        '';
+        startAt = "weekly";
+      };
+    } // lib.listToAttrs (lib.concatMap (containerSet: 
+      if containerSet.setup != null then [{
+        name = "${containerSet.name}-setup";
+        value = {
+          description = "Run ${containerSet.name} setup";
+          after = [ "podman-${containerSet.name}-${containerSet.setup.trigger}.service" ];
+          wants = [ "podman-${containerSet.name}-${containerSet.setup.trigger}.service" ];
+          wantedBy = [ "multi-user.target" ];
+          serviceConfig = {
+            Type = "oneshot";
+            TimeoutStartSec = "30s";
+            ExecStart = "${containerSet.setup.script}";
+            RemainAfterExit = true;
+            User = "root";
+          };
+        };
+      }] else []
+    ) containerSetsList);
+
+    services.cron = {
+      enable = true;
+      systemCronJobs = allCronsConfigs;
+    };
+
  };
 }
--- a/modules/server/containers/defs/authentik.nix
+++ b/modules/server/containers/defs/authentik.nix
@@ -1,84 +1,70 @@
-{ config, containerCfg, pkgs, lib, ... }:
+{ config, containerCfg, pkgs, lib, builder, name, ... }:
 let 
+version = "2026.2.2";
 serverCfg = config.syscfg.server;
 in {
  paths = [{
-    path="${serverCfg.dataPath}/authentik/media";
+    path="${serverCfg.configPath}/authentik/media";
    owner = "1000:1000";
    mode = "0755";
  }{
-    path="${serverCfg.dataPath}/authentik/templates";
+    path="${serverCfg.configPath}/authentik/templates";
    owner = "1000:1000";
    mode = "0755";
  }];

  containers = {
-
-    auth_server = {
-      image = "ghcr.io/goauthentik/server:latest";
-      hostname = "auth_server";
-      volumes = [
-        "${serverCfg.dataPath}/authentik/media:/media"
-        "${serverCfg.dataPath}/authentik/templates:/templates"
-      ];
-      environmentFiles = [
-        config.sops.secrets."AUTHENTIK".path
-      ];
-      environment = {
-        "AUTHENTIK_REDIS__HOST" = "host.containers.internal";
-        "AUTHENTIK_POSTGRESQL__HOST" = "host.containers.internal";
+    server = builder.mkContainer {
+      subdomain = containerCfg.subdomain;
+      image = "ghcr.io/goauthentik/server:${version}";
+      port = containerCfg.port;
+      ip = containerCfg.ip;
+      secret = name;
+      extraEnv = {
+        "AUTHENTIK_REDIS__HOST" = builder.host;
+        "AUTHENTIK_POSTGRESQL__HOST" = builder.host;
        "AUTHENTIK_POSTGRESQL__USER" = "authentik_user";
        "AUTHENTIK_POSTGRESQL__NAME" = "authentik_db";
-        "AUTHENTIK_EMAIL__HOST" = "${serverCfg.mailDomain}";
+        "AUTHENTIK_EMAIL__HOST" = serverCfg.mailDomain;
        "AUTHENTIK_EMAIL__PORT" = "587";
        "AUTHENTIK_EMAIL__USERNAME" = "noreply@${serverCfg.hostDomain}";
        "AUTHENTIK_EMAIL__USE_TLS" = "true";
        "AUTHENTIK_EMAIL__USE_SSL" = "false";
        "AUTHENTIK_EMAIL__TIMEOUT" = "10";
        "AUTHENTIK_EMAIL__FROM" = "sso@noreply.${serverCfg.hostDomain}";
+        "AUTHENTIK_DISABLE_UPDATE_CHECK" = "true";
+        "AUTHENTIK_POSTGRESQL__SSLMODE" = "disable";
      };
-      labels = {
-        "traefik.enable" = "true";
-        "traefik.http.routers.sso.entrypoints" = "web-secure";
-        "traefik.http.routers.sso.rule" = "Host(`sso.${serverCfg.hostDomain}`)";
-        "traefik.http.routers.sso.tls" = "true";
-        "traefik.http.services.sso.loadbalancer.server.port" = "${toString containerCfg.port}";
+      overrides = {
+        cmd = [ "server" ];
+        ports = if containerCfg.pubPort!=null && containerCfg.port!=null then [ "${toString containerCfg.pubPort}:${toString containerCfg.port}" ] else [];
+        volumes = [
+          "${serverCfg.configPath}/authentik/media:/media"
+          "${serverCfg.configPath}/authentik/templates:/templates"
+        ];
      };
-      cmd = [ "server" ];
-      extraOptions = [
-        "--add-host=host.containers.internal:host-gateway"
-        "--replace"
-        "--rm"
-        "--ip=${containerCfg.ip}"
-      ];
-      ports = [
-        "9999:${toString containerCfg.port}"
-      ];
    };

-    auth_worker = {
-      image = "ghcr.io/goauthentik/server:latest";
-      hostname = "auth_worker";
-      volumes = [
-        "${serverCfg.dataPath}/authentik/media:/media"
-        "${serverCfg.dataPath}/authentik/templates:/templates"
-        "/var/run/docker.sock:/var/run/docker.sock"
-      ];
-      environmentFiles = [
-        config.sops.secrets."AUTHENTIK".path
-      ];
-      environment = {
-        "AUTHENTIK_REDIS__HOST" = "host.containers.internal";
-        "AUTHENTIK_POSTGRESQL__HOST" = "host.containers.internal";
+    worker = builder.mkContainer {
+      image = "ghcr.io/goauthentik/server:${version}";
+      secret = "authentik";
+      extraEnv = {
+        "AUTHENTIK_REDIS__HOST" = builder.host;
+        "AUTHENTIK_POSTGRESQL__HOST" = builder.host;
        "AUTHENTIK_POSTGRESQL__USER" = "authentik_user";
        "AUTHENTIK_POSTGRESQL__NAME" = "authentik_db";
+        "AUTHENTIK_DISABLE_UPDATE_CHECK" = "true";
+        "AUTHENTIK_POSTGRESQL__SSLMODE" = "disable";
+      };
+      # extraOptions = [ "--user=:994" ]; #PODMAN GROUP FOR SOCKET ACCESS
+      overrides = {
+        cmd = [ "worker" ];
+        volumes = [
+          "${serverCfg.configPath}/authentik/media:/media"
+          "${serverCfg.configPath}/authentik/templates:/templates"
+          # "/var/run/podman/podman.sock:/var/run/docker.sock" #PODMAN GROUP FOR SOCKET ACCESS
+        ];
      };
-      extraOptions = [
-        "--add-host=host.containers.internal:host-gateway"
-        "--replace"
-        "--rm"
-      ];
-      cmd = [ "worker" ];
    };
  };
 }
--- a/modules/server/containers/defs/cloud.nix
+++ b/modules/server/containers/defs/cloud.nix
@@ -1,152 +0,0 @@
-{ config, pkgs, lib, ... }:
-let serverCfg = config.syscfg.server;
-in {
-  project.name = "cloud";
-
-  networks = {
-    internal = {
-      name = lib.mkForce "internal";
-      internal = true;
-    };
-    external = {
-      name = lib.mkForce "external";
-      internal = false;
-    };
-  };
-
-  services = {
-
-    cloud_nextcloud.service = {
-      image = "nextcloud:27";
-      container_name = "cloud";
-      restart = "unless-stopped";
-      networks = [ "external" ];
-      volumes = [
-        "${serverCfg.configPath}/data/nextcloud:/var/www/html"
-        "${serverCfg.dataPath}/data/music:/media/music"
-        "${serverCfg.dataPath}/data/video:/media/video"
-        "${serverCfg.dataPath}/data/photo:/media/photo"
-      ];
-      tmpfs = [ "/tmp" ];
-      labels = {
-        "traefik.enable" = "true";
-        "traefik.http.routers.nextcloud.entrypoints" = "web-secure";
-        "traefik.http.routers.nextcloud.rule" =
-          "Host(`cloud.${serverCfg.hostDomain}`)";
-        "traefik.http.routers.nextcloud.tls" = "true";
-        "traefik.http.routers.nextcloud.middlewares" =
-          "sts_headers,nextcloud-caldav";
-
-        "traefik.http.middlewares.nextcloud-caldav.redirectregex.permanent" =
-          "true";
-        "traefik.http.middlewares.nextcloud-caldav.redirectregex.regex" =
-          "^https://(.*)/.well-known/(card|cal)dav";
-        "traefik.http.middlewares.nextcloud-caldav.redirectregex.replacement" =
-          "https://$\${1}/remote.php/dav/";
-        "traefik.http.middlewares.sts_headers.headers.stsSeconds" = "15552000";
-        "traefik.http.middlewares.sts_headers.headers.stsIncludeSubdomains" =
-          "true";
-      };
-    };
-
-    cloud_office.service = {
-      image = "collabora/code:latest";
-      container_name = "cloud_office";
-      restart = "unless-stopped";
-      networks = [ "external" ];
-      volumes = [ ];
-      environment = {
-        username = "COLLABORA_USER";
-        password = "COLLABORA_PASSWORD";
-        aliasgroup1 = "https://cloud.${serverCfg.hostDomain}";
-        server_name = "office.${serverCfg.hostDomain}";
-        VIRTUAL_HOST = "office.${serverCfg.hostDomain}";
-        VIRTUAL_PORT = "9980";
-        VIRTUAL_PROTO = "http";
-        DONT_GEN_SSL_CERT = "true";
-        RESOLVE_TO_PROXY_IP = "true";
-        NETWORK_ACCESS = "internal";
-        extra_params = "--o:ssl.enable=false --o:ssl.termination=true";
-        dictionaries = "en fr de jp";
-      };
-      labels = {
-        "traefik.enable" = "true";
-        "traefik.http.routers.collabora.entrypoints" = "web-secure";
-        "traefik.http.routers.collabora.rule" =
-          "Host(`office.${serverCfg.hostDomain}`)";
-        "traefik.http.routers.collabora.tls" = "true";
-      };
-    };
-
-    cloud_etherpad.service = {
-      image = "etherpad/etherpad:latest";
-      container_name = "etherpad";
-      restart = "unless-stopped";
-      networks = [ "external" ];
-      volumes = [
-        "${serverCfg.dataPath}/ether/etherpad/data:/opt/etherpad-lite/var"
-        "${serverCfg.dataPath}/ether/etherpad/APIKEY.txt:/opt/etherpad-lite/APIKEY.txt"
-      ];
-      environment = {
-        NODE_ENV = "production";
-        TITLE = "Helcel-Pad";
-        DB_TYPE = "mysql";
-        DB_HOST = serverCfg.dbHost;
-        DB_PORT = serverCfg.dbPort;
-        DB_NAME = "etherpad";
-        DB_USER = "ETHERPAD_DB_USER";
-        DB_PASS = "ETHERPAD_DB_PASSWORD";
-        DB_CHARSET = "utf8mb4";
-        DEFAULT_PAD_TEXT = "P A D";
-        PAD_OPTIONS_SHOW_LINE_NUMBERS = "true";
-        PAD_OPTIONS_USE_MONOSPACE_FONT = "true";
-        ADMIN_PASSWORD = "ETHERPAD_ADMIN_PASSWORD";
-        SKIN_VARIANTS = "super-dark-toolbar light-editor dark-background";
-      };
-      labels = {
-        "traefik.enable" = "true";
-        "traefik.http.routers.etherpad.entrypoints" = "web-secure";
-        "traefik.http.routers.etherpad.rule" =
-          "Host(`pad.${serverCfg.hostDomain}`)";
-        "traefik.http.routers.etherpad.tls" = "true";
-      };
-    };
-
-    cloud_ethercalc.service = {
-      image = "audreyt/ethercalc:latest";
-      container_name = "ethercalc";
-      restart = "unless-stopped";
-      networks = [ "external" "internal" ];
-      volumes = [
-        "${serverCfg.dataPath}/ether/etherpad/data:/opt/etherpad-lite/var"
-        "${serverCfg.dataPath}/ether/etherpad/APIKEY.txt:/opt/etherpad-lite/APIKEY.txt"
-      ];
-      environment = {
-        NODE_ENV = "production";
-        TITLE = "Helcel-Calc";
-        REDIS_PORT_6379_TCP_ADDR = "ethercalc-redis";
-        REDIS_PORT_6379_TCP_PORT = "6379";
-        ADMIN_PASSWORD = "ETHERPAD_ADMIN_PASSWORD";
-        SKIN_VARIANTS = "super-dark-toolbar light-editor dark-background";
-      };
-      labels = {
-        "traefik.enable" = "true";
-        "traefik.http.routers.ethercalc.entrypoints" = "web-secure";
-        "traefik.http.routers.ethercalc.rule" =
-          "Host(`calc.${serverCfg.hostDomain}`)";
-        "traefik.http.routers.ethercalc.tls" = "true";
-      };
-    };
-
-    cloud_redis.service = {
-      image = "redis:latest";
-      container_name = "ethercalc-redis";
-      restart = "unless-stopped";
-      networks = [ "internal" ];
-      volumes = [ "${serverCfg.dataPath}/ether/ethercalc/redis:/data" ];
-      environment = { };
-      labels = { "traefik.enable" = "false"; };
-    };
-
-  };
-}
--- a/modules/server/containers/defs/collabora.nix
+++ b/modules/server/containers/defs/collabora.nix
@@ -0,0 +1,33 @@
+{ config, containerCfg, pkgs, lib, builder, name, ... }:
+let 
+version = "latest";
+serverCfg = config.syscfg.server;
+in {
+  containers = {
+    server = builder.mkContainer {
+      subdomain = containerCfg.subdomain;
+      image = "collabora/code:${version}";
+      port = containerCfg.port;
+      ip = containerCfg.ip;
+      secret = name;
+      extraEnv = {
+        "aliasgroup1" = "https://${serverCfg.containers.nextcloud.subdomain}.${serverCfg.hostDomain}";
+        "server_name" = "${containerCfg.subdomain}.${serverCfg.hostDomain}";
+        "VIRTUAL_HOST" = "${containerCfg.subdomain}.${serverCfg.hostDomain}";
+        "VIRTUAL_PORT" = "${toString containerCfg.port}";
+        "VIRTUAL_PROTO" = "http";
+        "DONT_GEN_SSL_CERT" = "true";
+        "RESOLVE_TO_PROXY_IP" = "true";
+        "extra_params" = "--o:ssl.enable=false --o:ssl.termination=true";
+        "dictionaries" = "en fr de jp no";
+      };
+      
+      overrides = {
+        volumes = [
+          "${pkgs.noto-fonts}/share/fonts/noto:/opt/collaboraoffice/share/fonts/truetype/noto:ro"
+          "${pkgs.ibm-plex}/share/fonts/opentype:/opt/collaboraoffice/share/fonts/opentype/plex:ro"
+        ];
+      };
+    };
+  };
+}
--- a/modules/server/containers/defs/etherpad.nix
+++ b/modules/server/containers/defs/etherpad.nix
@@ -0,0 +1,138 @@
+{ config, containerCfg, pkgs, lib, builder, name,... }:
+let 
+  serverCfg = config.syscfg.server;
+  etherpad_exe = pkgs.etherpad-lite;/*.override {
+    plugins = [ pkgs.nodePackages.ep_proxy_auth ]; # Ensure this is in your nixpkgs
+  };*/
+  settings = pkgs.writeTextDir"etc/etherpad/settings.json" (builtins.toJSON {
+    title= "\${TITLE:Etherpad}";
+    showRecentPads = "\${SHOW_RECENT_PADS:true}";
+    favicon = "\${FAVICON:null}";
+    publicURL = "\${PUBLIC_URL:null}";
+    skinName = "\${SKIN_NAME:colibris}";
+    skinVariants = "\${SKIN_VARIANTS:super-light-toolbar super-light-editor light-background}";
+    ip = "\${IP:0.0.0.0}";
+    port = "\${PORT:9001}";
+    showSettingsInAdminPage = "\${SHOW_SETTINGS_IN_ADMIN_PAGE:true}";
+    enableMetrics = "\${ENABLE_METRICS:true}";
+    updates.tier = "off";
+    cleanup.enabled = false;
+    gdprAuthorErasure.enabled = "\${GDPR_AUTHOR_ERASURE_ENABLED:false}";
+    authenticationMethod = "\${AUTHENTICATION_METHOD:sso}";
+    enableDarkMode = "\${ENABLE_DARK_MODE:true}";
+    enablePadWideSettings = "\${ENABLE_PAD_WIDE_SETTINGS:true}";
+    dbType = "\${DB_TYPE:dirty}";
+    dbSettings = {
+      host =       "\${DB_HOST:undefined}";
+      port =       "\${DB_PORT:undefined}";
+      database =   "\${DB_NAME:undefined}";
+      user =       "\${DB_USER:undefined}";
+      password =   "\${DB_PASS:undefined}";
+      charset =    "\${DB_CHARSET:undefined}";
+      filename =   "\${DB_FILENAME:var/dirty.db}";
+      collection = "\${DB_COLLECTION:undefined}";
+      url =        "\${DB_URL:undefined}";
+    };
+    defaultPadText = "\${DEFAULT_PAD_TEXT:P A D}";
+    padOptions = {
+      noColors =         "\${PAD_OPTIONS_NO_COLORS:false}";
+      showControls =     "\${PAD_OPTIONS_SHOW_CONTROLS:true}";
+      showChat =         "\${PAD_OPTIONS_SHOW_CHAT:true}";
+      showLineNumbers =  "\${PAD_OPTIONS_SHOW_LINE_NUMBERS:true}";
+      useMonospaceFont = "\${PAD_OPTIONS_USE_MONOSPACE_FONT:false}";
+      userName =         "\${PAD_OPTIONS_USER_NAME:null}";
+      userColor =        "\${PAD_OPTIONS_USER_COLOR:null}";
+      rtl =              "\${PAD_OPTIONS_RTL:false}";
+      alwaysShowChat =   "\${PAD_OPTIONS_ALWAYS_SHOW_CHAT:false}";
+      chatAndUsers =     "\${PAD_OPTIONS_CHAT_AND_USERS:false}";
+      lang =             "\${PAD_OPTIONS_LANG:null}";
+      fadeInactiveAuthorColors = "\${PAD_OPTIONS_FADE_INACTIVE_AUTHOR_COLORS:true}";
+      enforceReadableAuthorColors = "\${PAD_OPTIONS_ENFORCE_READABLE_AUTHOR_COLORS:true}";
+    };
+
+    requireSession = "\${REQUIRE_SESSION:false}";
+    editOnly = "\${EDIT_ONLY:false}";
+    minify = "\${MINIFY:true}";
+    requireAuthentication = "\${REQUIRE_AUTHENTICATION:false}";
+    requireAuthorization = "\${REQUIRE_AUTHORIZATION:false}";
+    trustProxy = "\${TRUST_PROXY:true}";
+    ep_headerauth.username_header = "X-authentik-username";
+    users.admin = {
+      password = "\${ADMIN_PASSWORD:null}";
+      is_admin = true;
+    };
+    socketTransportProtocols = ["websocket" "polling"];
+    socketIo.maxHttpBufferSize = "\${SOCKETIO_MAX_HTTP_BUFFER_SIZE:1000000}";
+    indentationOnNewLine = true;
+
+    loglevel = "\${LOGLEVEL:INFO}";
+    lowerCasePadIds = "\${LOWER_CASE_PAD_IDS:true}";
+  });
+  image = pkgs.dockerTools.streamLayeredImage {
+    name = "etherpad";
+    tag = etherpad_exe.version;
+    contents = with pkgs;[cacert tzdata bash coreutils curl settings ];
+    fakeRootCommands = ''
+      mkdir -p ./var/lib/etherpad
+      chown -R 1000:1000 ./var/lib/etherpad
+      mkdir -p ./tmp
+      chmod 1777 ./tmp
+    '';
+    config = {
+      Cmd = [ "${etherpad_exe}/bin/etherpad-lite" "--settings" "/etc/etherpad/settings.json" ];
+      User = "1000:1000";
+      WorkingDir = "/var/lib/etherpad";
+      ExposedPorts = { "${toString containerCfg.port}/tcp" = {}; };
+      Env = [
+        "NODE_ENV=production"
+        "HOME=/opt/etherpad-lite/var"
+        "DB_FILENAME=/opt/etherpad-lite/var/dirty.db"
+      ];
+
+    };
+  };
+in {
+  paths = [{
+    path="${serverCfg.configPath}/etherpad/data";
+    owner = "1000:1000";
+    mode = "0755";
+  }{
+    path="${serverCfg.configPath}/etherpad/APIKEY.txt";
+    owner = "1000:1000";
+    mode = "0755";
+    backup = true;
+  }];
+
+  containers = {
+    server = builder.mkContainer {
+      subdomain = containerCfg.subdomain;
+      imageStream = image;
+      port = containerCfg.port;
+      ip = containerCfg.ip;
+      secret = name;
+      extraEnv = {
+        TITLE = "Pad";
+        PORT = toString containerCfg.port;
+        DB_TYPE = "postgres";
+        DB_HOST = builder.host;
+        DB_NAME = "etherpad_db";
+        DB_USER = "etherpad_user";
+        TRUST_PROXY = "true";
+        DB_CHARSET = "utf8mb4";
+        DEFAULT_PAD_TEXT = "";
+        PAD_OPTIONS_SHOW_LINE_NUMBERS = "true";
+        PAD_OPTIONS_USE_MONOSPACE_FONT = "true";
+        SKIN_VARIANTS = "super-dark-toolbar light-editor dark-background";
+      };
+      extraLabels = {
+        "traefik.http.routers.${containerCfg.subdomain}.middlewares" = "authentik";
+      };
+      overrides = {
+        volumes = [
+          "${serverCfg.configPath}/etherpad/data:/opt/etherpad-lite/var"
+          "${serverCfg.configPath}/etherpad/APIKEY.txt:/opt/etherpad-lite/APIKEY.txt"
+        ];
+      };
+    };
+  };
+}
--- a/modules/server/containers/defs/nextcloud.nix
+++ b/modules/server/containers/defs/nextcloud.nix
@@ -0,0 +1,159 @@
+{ config, containerCfg, pkgs, lib, builder, name,... }:
+let 
+version = "31";
+serverCfg = config.syscfg.server;
+in {
+  paths = [{
+    path="${serverCfg.dataPath}/nextcloud/www";
+    owner = "33:33";
+    mode = "0755";
+  }{
+    path="${serverCfg.dataPath}/nextcloud/data";
+    owner = "33:33";
+    mode = "0755";
+    backup = true;
+  }];
+
+  containers = {
+    server = builder.mkContainer {
+      subdomain = containerCfg.subdomain;
+      image = "nextcloud:${version}";
+      port = containerCfg.port;
+      ip = containerCfg.ip;
+      secret = name;
+      extraEnv = {
+        REDIS_HOST = builder.host;
+        POSTGRES_HOST = builder.host;
+        POSTGRES_USER = "nextcloud_user";
+        POSTGRES_DB = "nextcloud_db";
+        AUTHENTIK_POSTGRESQL__SSLMODE = "disable";
+        "NEXTCLOUD_TRUSTED_DOMAINS " = "${containerCfg.subdomain}.${serverCfg.hostDomain}";
+        "SMTP_HOST" = serverCfg.mailServer;
+        "SMTP_NAME" = "mail_user";
+        "SMTP_PASSWORD" = "mail_password";
+        "MAIL_FROM_ADDRESS" = "${containerCfg.subdomain}@${serverCfg.hostDomain}";
+        "MAIL_DOMAIN" = serverCfg.mailDomain;
+        "TRUSTED_PROXIES" = "10.10.0.0/16 192.168.0.0/16";
+      };
+      extraLabels = {
+        "traefik.http.routers.${containerCfg.subdomain}.middlewares" = "sts_headers,${containerCfg.subdomain}-caldav";
+        "traefik.http.middlewares.${containerCfg.subdomain}-caldav.redirectregex.permanent" = "true";
+        "traefik.http.middlewares.${containerCfg.subdomain}-caldav.redirectregex.regex" = "https://(.*)/.well-known/(?:card|cal)dav";
+        "traefik.http.middlewares.${containerCfg.subdomain}-caldav.redirectregex.replacement" = "https://$1/remote.php/dav";
+        "traefik.http.middlewares.sts_headers.headers.stsSeconds" = "15552000";
+        "traefik.http.middlewares.sts_headers.headers.stsIncludeSubdomains" = "true";
+      };
+      extraOptions = [
+        "--tmpfs=/tmp:rw,noexec,nosuid,size=256m"
+      ];
+      overrides = {
+        ports = if containerCfg.pubPort!=null && containerCfg.port!=null then [ "${toString containerCfg.pubPort}:${toString containerCfg.port}" ] else [];
+        volumes = [
+          "${serverCfg.dataPath}/nextcloud/www:/var/www/html"
+          "${serverCfg.dataPath}/nextcloud/data:/var/www/html/data"
+        ];
+      };
+    };
+  };
+
+  setup = {
+    trigger="server";
+    script = pkgs.writeShellScript "setup" ''
+      # Define the command wrapper
+      OCC="${pkgs.podman}/bin/podman --events-backend=none exec -u www-data nextcloud-server php occ"
+
+      echo "Waiting for Nextcloud container to start..."
+      until $OCC status > /dev/null 2>&1; do
+        sleep 2
+      done
+
+      INSTALLED=0 #$($OCC status --output=json | grep -o '"installed":true')
+      if [ -z "$INSTALLED" ]; then
+        echo "Nextcloud not found. Running first-time setup..."
+        
+        # $OCC maintenance:install \
+        #   --admin-user "admin" \
+        #   --admin-pass "adminpassword"
+
+        echo "Applying Settings..."
+        
+        $OCC config:system:set default_phone_region --value="CH"
+        $OCC config:system:set overwriteprotocol --value="https"
+        $OCC config:app:set core backgroundjobs_mode --value="cron"
+        $OCC config:system:set maintenance_window_start --type=integer --value=1
+        $OCC config:system:set default_language --value="en"
+        $OCC config:system:set default_locale --value="en_CH"
+
+        echo "Applying Apps..."
+        $OCC app:disable activity
+        $OCC app:disable app_api
+        $OCC app:disable comments
+        $OCC app:disable firstrunwizard
+        $OCC config:system:set show_first_run_wizard --type=bool --value=false
+        $OCC app:disable nextcloud_announcements
+        $OCC app:disable oauth2
+        $OCC app:disable recommendations
+        $OCC app:disable sharebymail
+        $OCC app:disable support
+        $OCC app:disable updatenotification
+        $OCC app:disable user_status
+
+        $OCC app:install calendar || true
+        $OCC app:install calendar || true
+        $OCC app:install contacts || true
+        $OCC app:install camerarawpreviews || true
+        $OCC app:install cospend || true
+        $OCC app:install deck || true
+        $OCC app:install files_markdown || true
+        $OCC app:install forms || true
+        $OCC app:install groupfolders || true
+        $OCC app:install ownpad || true
+        $OCC app:install previewgenerator || true
+        $OCC app:install richdocuments || true
+        # $OCC app:install side_menu || true 
+        $OCC app:install spreed || true
+        # $OCC app:install user_saml || true
+
+        echo "Applying Apps Settings..."
+        ${lib.optionalString (serverCfg.containers ? ethercalc) ''
+        $OCC config:app:set ownpad ownpad_ethercalc_enable --value="yes"
+        $OCC config:app:set ownpad ownpad_ethercalc_host --value="https:\/\/${serverCfg.containers.ethercalc.subdomain}.${serverCfg.hostDomain}"
+        ''}
+        ${lib.optionalString (serverCfg.containers ? etherpad) ''
+        $OCC config:app:set ownpad ownpad_etherpad_enable --value="yes"
+        $OCC config:app:set ownpad ownpad_etherpad_host --value="https:\/\/${serverCfg.containers.etherpad.subdomain}.${serverCfg.hostDomain}"
+        ''}
+        ${lib.optionalString (serverCfg.containers ? collabora) ''
+        $OCC config:app:set richdocuments wopi_url --value="https://${serverCfg.containers.collabora.subdomain}.${serverCfg.hostDomain}/"
+        $OCC config:app:set richdocuments public_wopi_url --value="https://${serverCfg.containers.collabora.subdomain}.${serverCfg.hostDomain}"
+        ''}
+        # configure side_menu ...
+        # configure user_saml (HOW ?)
+
+        $OCC config:system:set enabledPreviewProviders --value='["OC\\Preview\\Movie", "OC\\Preview\\PNG", "OC\\Preview\\JPEG", "OC\\Preview\\GIF", "OC\\Preview\\HEIC", "OC\\Preview\\RAW"]' --type=json
+
+        echo "Applying Theme..."
+        $OCC config:app:set theming url --value="https://${containerCfg.subdomain}.${serverCfg.hostDomain}"
+        ${lib.optionalString (containerCfg.extra ? name) ''$OCC config:app:set theming name --value="${containerCfg.extra.name}"''}
+        ${lib.optionalString (containerCfg.extra ? slogan) ''$OCC config:app:set theming slogan --value="${containerCfg.extra.slogan}"''}
+        $OCC config:app:set theming color --value="${serverCfg.colorScheme.palette}"
+
+        #$OCC theming:config logo {serverCfg.colorScheme.logo}
+        #$OCC theming:config logoheader {serverCfg.colorScheme.logo}
+        #$OCC theming:config background {serverCfg.colorScheme.bg}
+            
+      else
+          echo "Nextcloud is already installed. Skipping setup."
+      fi
+
+      echo "Maintenance..."
+      $OCC app:update --all
+      $OCC maintenance:repair --include-expensive --no-interaction
+      $OCC db:add-missing-indices --no-interaction
+
+      echo "Completed Setup"
+    '';
+  };
+
+  cron = [ "*/5 * * * *  root  ${pkgs.podman}/bin/podman --events-backend=none exec -u www-data nextcloud-server php -f /var/www/html/cron.php" ];
+}
--- a/modules/server/containers/defs/sample.nix
+++ b/modules/server/containers/defs/sample.nix
@@ -1,30 +0,0 @@
-{ config, pkgs, lib, ... }:
-let serverCfg = config.syscfg.server;
-in {
-  project.name = "name";
-
-  networks = {
-    internal = {
-      name = lib.mkForce "internal";
-      internal = true;
-    };
-    external = {
-      name = lib.mkForce "external";
-      internal = false;
-    };
-  };
-
-  services = {
-
-    NAME.service = {
-      image = "NAME:latest";
-      container_name = "NAME";
-      restart = "unless-stopped";
-      networks = [ "internal" ];
-      volumes = [ ];
-      environment = { };
-      labels = { "traefik.enable" = "false"; };
-    };
-
-  };
-}
--- a/modules/server/containers/defs/traefik.nix
+++ b/modules/server/containers/defs/traefik.nix
@@ -1,81 +1,75 @@
-{ config, pkgs, ... }: {
-  project.name = "traefik";
-
-  networks = {
-    internal = {
-      name = lib.mkForce "internal";
-      internal = true;
-    };
-    external = {
-      name = lib.mkForce "external";
-      internal = false;
+{ config, containerCfg, pkgs, lib, builder, name,... }:
+let 
+  serverCfg = config.syscfg.server;
+  image = pkgs.dockerTools.streamLayeredImage {
+    name = "traefik";
+    tag = pkgs.traefik.version;
+    contents = with pkgs;[ cacert tzdata ];
+    config = {
+      Entrypoint = [ "${pkgs.traefik}/bin/traefik" ];
+      WorkingDir = "/";
    };
  };
+in {
+  paths = [{
+    path="${serverCfg.configPath}/traefik";
+    owner = "1000:1000";
+    mode = "0755";
+  }];

-  services = {
+  containers = {
+    server = builder.mkContainer {
+      imageStream = image;
+      subdomain = containerCfg.subdomain;
+      ip = containerCfg.ip;
+      port = 8080;
+      secret = name;
+      extraLabels = {
+        "traefik.http.routers.${containerCfg.subdomain}.priority" = "10";
+        "traefik.http.routers.${containerCfg.subdomain}.service" = "api@internal";
+        "traefik.http.routers.${containerCfg.subdomain}.middlewares" = "authentik";

-    traefik.service = {
-      image = "traefik:latest";
-      container_name = "traefik";
-      restart = "unless-stopped";
-      networks = [ "internal" "external" ];
-      command = [
-        "--api"
-        "--providers.docker=true"
-        "--entrypoints.web.address=:80"
-        "--entrypoints.web-secure.address=:443"
-      ];
-      port = [ "443" "80" ];
-      volumes = [
-        "/var/run/docker.sock:/var/run/docker.sock:ro"
-        "${serverCfg.configPath}/traefik/traefik.yaml:/etc/traefik/traefik.yaml"
-        "${serverCfg.configPath}/traefik/access.log:/etc/traefik/access.log"
-        "${serverCfg.configPath}/traefik/acme.json:/acme.json"
-      ];
-      environment = {
-        "INFOMANIAK_ACCESS_TOKEN" = config.sops.secrets.INFOMANIAK_API_KEY.path;
+        "traefik.http.routers.${containerCfg.subdomain}.tls.certresolver" = "default";
+        "traefik.http.routers.${containerCfg.subdomain}.tls.domains[0].main" = "${serverCfg.hostDomain}";
+        "traefik.http.routers.${containerCfg.subdomain}.tls.domains[0].sans" = "*.${serverCfg.hostDomain}";
+        
+        "traefik.http.middlewares.authentik.forwardauth.maxResponseBodySize" = "10485760";
+        "traefik.http.middlewares.authentik.forwardauth.address" = "http://authentik-server:9000/outpost.goauthentik.io/auth/traefik";
+        "traefik.http.middlewares.authentik.forwardauth.trustForwardHeader" = "true";
+        "traefik.http.middlewares.authentik.forwardauth.authResponseHeaders" = "X-authentik-username,X-authentik-groups,X-authentik-email,X-authentik-name,X-authentik-uid,X-authentik-jwt,X-authentik-meta-jwks,X-authentik-meta-outpost,X-authentik-meta-provider,X-authentik-meta-app,X-authentik-meta-version";
      };
-      labels = { "traefik.enable" = "false"; };
-    };
-
-    matomo.service = {
-      image = "matomo:latest";
-      container_name = "matomo";
-      restart = "unless-stopped";
-      networks = [ "external" ];
-      volumes = [
-        "/etc/localtime:/etc/localtime:ro"
-        "${serverCfg.configPath}/matomo:/var/www/html/config:rw"
-        "${serverCfg.configPath}/traefik/access.log:/var/log/taccess.log:ro"
-      ];
-      environment = { };
-      labels = {
-        "traefik.http.routers.matomo.rule" =
-          "Host(`matomo.${serverCfg.hostDomain}`)";
-        "traefik.http.routers.matomo.entrypoints" = "web-secure";
-        "traefik.http.routers.matomo.tls" = "true";
+      extraEnv = { };
+      overrides = {
+        cmd = [ 
+          "--api"
+          "--log.level=INFO"
+          "--providers.docker=true"
+          "--global.checknewversion=false"
+          "--global.sendanonymoususage=false"
+          "--api.insecure=true"
+          "--api.dashboard=true"
+          "--providers.docker.exposedByDefault=false"
+          "--entrypoints.web.address=:80"
+          "--entrypoints.web-secure.address=:443"
+          "--entrypoints.web.http.redirections.entrypoint.to=web-secure"
+          "--entrypoints.web.http.redirections.entrypoint.scheme=https"
+          "--entrypoints.web-secure.transport.respondingtimeouts.readtimeout=0s"
+          "--entrypoints.web-secure.proxyprotocol.trustedips=127.0.0.1/32,192.168.1.1/16,10.10.0.0/16"
+          "--certificatesresolvers.default.acme.email=acme@${serverCfg.hostDomain}"
+          "--certificatesresolvers.default.acme.tlschallenge=false"
+          "--certificatesresolvers.default.acme.httpchallenge=false"
+          "--certificatesresolvers.default.acme.dnschallenge=true"
+          "--certificatesresolvers.default.acme.dnschallenge.provider=${containerCfg.extra.provider}"
+          "--certificatesresolvers.default.acme.storage=/custom/acme.json"
+        ];
+        ports = [ "443:443" "80:80" ];
+        volumes = [
+          "/var/run/podman/podman.sock:/var/run/docker.sock"
+          # "${serverCfg.configPath}/traefik/access.log:/etc/traefik/access.log"
+          "${serverCfg.configPath}/traefik:/custom"
+        ];
      };
    };
-
-    searx.service = {
-      image = "searxng/searxng:latest";
-      container_name = "searx";
-      restart = "unless-stopped";
-      networks = [ "external" ];
-      volumes = [ "/etc/localtime:/etc/localtime:ro" ];
-      environment = {
-        "BASE_URL" = "https://searx.${serverCfg.hostDomain}";
-        "AUTOCOMPLETE" = "true";
-        "INSTANCE_NAME" = "searx${serverCfg.shortName}";
-      };
-      labels = {
-        "traefik.http.routers.matomo.rule" =
-          "Host(`searx.${serverCfg.hostDomain}`)";
-        "traefik.http.routers.matomo.entrypoints" = "web-secure";
-        "traefik.http.routers.matomo.tls" = "true";
-      };
-    };
-
  };
 }

--- a/modules/server/database/default.nix
+++ b/modules/server/database/default.nix
@@ -62,7 +62,6 @@ in {
          
          if [ -f "${config.sops.secrets."${lib.toUpper name}".path}" ]; then
            PASS=$(grep "^DB_PASSWORD=" "${config.sops.secrets."${lib.toUpper name}".path}" | cut -d'=' -f2-)
-            echo $PASS
            if $PSQL -tAc "ALTER USER ${name}_user WITH PASSWORD '$PASS';" ; then
                echo "✅ Successfully set password for ${name}_user"
            else
--- a/modules/server/nftables/default.nix
+++ b/modules/server/nftables/default.nix
@@ -1,7 +1,8 @@
-
-
-{ config, lib, ... }:{
-  config = lib.mkIf (config.syscfg.server.nftables.enable) {
+{ config, lib, ... }:
+let
+ cfg = config.syscfg.server;
+in {
+  config = lib.mkIf (cfg.ipfw.enable) {
    boot.kernel.sysctl = {
      "net.ipv4.ip_forward" = 1;
      "net.ipv6.conf.all.forwarding" = 1;
@@ -9,13 +10,6 @@

    networking.nftables.enable = true;
    networking.nftables.ruleset = ''
-      table inet filter {
-        chain input {
-          type filter hook input priority filter; policy accept;
-          tcp dport {5432, 6379} ip saddr { 10.0.0.0/8 169.254.0.0/16 } accept
-          
-        }
-      }
      table inet nat {
        chain prerouting {
          type nat hook prerouting priority dstnat; policy accept;
@@ -34,12 +28,12 @@
                iifname "${srcInt}" tcp dport ${srcPort} counter dnat ip6 to [${dstAddr6}]:${dstPort}
                iifname "${srcInt}" udp dport ${srcPort} counter dnat ip6 to [${dstAddr6}]:${dstPort}
            ''
-          ) config.syscfg.server.nftables.ports}
+          ) cfg.ipfw.ports}
        }
        
        chain postrouting {
          type nat hook postrouting priority srcnat; policy accept;
-          oifname { ${lib.concatMapStringsSep ", " (iface: ''"${iface}"'') config.syscfg.server.nftables.ifs} } masquerade
+          oifname { ${lib.concatMapStringsSep ", " (iface: ''"${iface}"'') cfg.ipfw.ifs} } masquerade
        }
      }
    '';
--- a/modules/server/nginx/default.nix
+++ b/modules/server/nginx/default.nix
@@ -0,0 +1,130 @@
+{ config, lib, pkgs, ... }:
+let
+  cfg = config.syscfg.server;
+  containers = cfg.containers; 
+  faviconOverride = {
+    " ~* /favicon\.(ico|png|svg|jpg)$" = {
+      extraConfig = ''
+        add_header Content-Type image/svg+xml;
+        return 200 '<svg xmlns="http://www.w3.org/2000/svg" id="Layer_1" data-name="Layer 1" viewBox="0 0 50 50"><defs><style>.cls-1{fill:#fd4b2d;}</style></defs><path class="cls-1" d="M30.83,5A23.23,23.23,0,0,0,10.41,67.13h10.8C26,63,32.94,61.8,38,67.13H49.39C44.93,61.09,38.24,55,30.83,55Z"/><path class="cls-1" d="M46.25,28.11c-14.89,31.15-41,4.6-25-11H10.41c-8.47,14.76,3.24,34.68,20.42,34.23,13.28,0,24.24-19.72,24.24-23.21,0-1.54-2.14-6.25-5.68-11H38A40.52,40.52,0,0,1,46.25,78.11Zm.4-.91Z"/></svg>';
+      '';
+      # proxyPass = "http://127.0.0.1:9000";
+    };
+  };
+  # Function to convert your container config into an NGINX vhost
+  mkVhost = container: {
+    forceSSL = true;
+    # quic = true;
+    # http3 = true;
+    useACMEHost = "${cfg.hostDomain}";
+    locations = faviconOverride // {
+      "/" = {
+        proxyPass = "http://${container.ip}:${toString container.port}";
+        proxyWebsockets = true; # Recommended for modern apps
+      };
+    };
+  };
+  
+in {
+  config = lib.mkIf ( config.syscfg.server.web) {
+    security.acme = {
+      acceptTerms = true;
+      defaults.email = "admin@domain.org";
+
+      certs."${cfg.hostDomain}" = {
+        domain = "*.${cfg.hostDomain}";
+        extraDomainNames = [ "${cfg.hostDomain}" ]; # Adds the root too
+        dnsProvider = "infomaniak";
+        credentialsFile = config.sops.secrets."INFOMANIAK_API_KEY".path; # File containing your API token (e.g. CLOUDFLARE_DNS_API_TOKEN=...)
+        group = "nginx"; 
+      };
+    };
+
+    services.nginx = {
+      enable = true;
+      recommendedProxySettings = true;
+      recommendedTlsSettings = true;
+      recommendedGzipSettings = true;
+
+      # appendHttpConfig = ''
+      #   add_header Alt-Svc 'h3=":443"; ma=86400';
+      # '';
+      commonHttpConfig = ''
+        proxy_buffer_size 32k;
+        proxy_buffers 8 16k;
+        proxy_busy_buffers_size 48k;
+      '';
+
+      virtualHosts = {
+        "_" = {
+          default = true;
+          forceSSL = true;
+          # quic = true;
+          # http3 = true;
+          useACMEHost = "${cfg.hostDomain}";
+          
+          locations = {
+            "/" = {
+              extraConfig = ''
+              return 404;
+              '';
+            };
+          };
+        };
+        "sec.${cfg.hostDomain}" = {
+          forceSSL = true;
+          useACMEHost = "${cfg.hostDomain}";
+          
+          locations = {
+            "/" = {
+              proxyWebsockets = true;
+              proxyPass= "http://${cfg.containers.authentik.subdomain}.${cfg.hostDomain}";
+
+              extraConfig = ''
+                auth_request     /outpost.goauthentik.io/auth/nginx;
+                error_page       401 = @goauthentik_proxy_signin;
+                auth_request_set $auth_cookie $upstream_http_set_cookie;
+                add_header       Set-Cookie $auth_cookie;
+                
+                auth_request_set $authentik_username $upstream_http_x_authentik_username;
+                auth_request_set $authentik_groups $upstream_http_x_authentik_groups;
+                auth_request_set $authentik_entitlements $upstream_http_x_authentik_entitlements;
+                auth_request_set $authentik_email $upstream_http_x_authentik_email;
+                auth_request_set $authentik_name $upstream_http_x_authentik_name;
+                auth_request_set $authentik_uid $upstream_http_x_authentik_uid;
+
+                proxy_set_header X-authentik-username $authentik_username;
+                proxy_set_header X-authentik-groups $authentik_groups;
+                proxy_set_header X-authentik-entitlements $authentik_entitlements;
+                proxy_set_header X-authentik-email $authentik_email;
+                proxy_set_header X-authentik-name $authentik_name;
+                proxy_set_header X-authentik-uid $authentik_uid;
+              '';
+            };
+
+            "/outpost.goauthentik.io" = {
+              proxyWebsockets = true;
+              proxyPass = "http://${config.syscfg.server.containers.authentik.ip}:${toString config.syscfg.server.containers.authentik.port}/outpost.goauthentik.io";
+              extraConfig = ''
+                proxy_set_header        X-Original-URL $scheme://$http_host$request_uri;
+                add_header              Set-Cookie $auth_cookie;
+                auth_request_set        $auth_cookie $upstream_http_set_cookie;
+                proxy_pass_request_body off;
+                proxy_set_header        Content-Length "";
+              '';
+            };
+          };
+          extraConfig = ''
+            location @goauthentik_proxy_signin {
+                internal;
+                add_header Set-Cookie $auth_cookie;
+                return 302 https://${cfg.containers.authentik.subdomain}.${cfg.hostDomain}/outpost.goauthentik.io/start?rd=$scheme://$http_host$request_uri;
+            }
+          '';
+        };
+      } //lib.mapAttrs' (name: v: 
+        lib.nameValuePair "${v.subdomain}.${cfg.hostDomain}" (mkVhost v)
+      ) containers;
+    };
+  };
+}
--- a/modules/server/sops/default.nix
+++ b/modules/server/sops/default.nix
@@ -1,16 +1,15 @@
 { config, lib, pkgs, ... }:
 let
- listNames = config.syscfg.server.db;
+  listNames = config.syscfg.server.db;
  containerNames = lib.mapAttrsToList (name: cfg: name) 
-    (lib.filterAttrs (name: cfg: cfg.db or false) config.syscfg.server.containers);
+    (lib.filterAttrs (name: cfg: ((cfg.db or false) || (cfg.sops or false))) config.syscfg.server.containers);
  allApps = lib.unique (listNames ++ containerNames);
 in{
-  config = lib.mkIf (config.syscfg.server.sops) {
    sops.secrets = {
-      INFOMANIAK_API_KEY = { sopsFile = ./server.yaml; };
-    } // (lib.genAttrs (map (name: "${lib.toUpper name}") allApps) (name: {
+      CUSTOM = { sopsFile = ./server.yaml; };
+    } // (lib.genAttrs (map (name: lib.toUpper name) allApps) (name: {
      owner = "postgres";
+      mode = "0644";
      sopsFile = ./server.yaml;
    }));
-  };
 }
--- a/modules/server/sops/example.server.yaml
+++ b/modules/server/sops/example.server.yaml
@@ -0,0 +1,13 @@
+INFOMANIAK_API_KEY: abc
+AUTHENTIK: |
+  DB_PASSWORD=abc
+  AUTHENTIK_POSTGRESQL__PASSWORD=abc
+  AUTHENTIK_POSTGRESQL__SSLMODE=disable
+  AUTHENTIK_SECRET_KEY=abc
+NEXTCLOUD: |
+  DB_PASSWORD=abc
+  POSTGRES_PASSWORD=abc
+ETHERPAD: |
+  DB_PASSWORD=abc
+  ETHERPAD_DB_PASSWORD=abc
+  ETHERPAD_ADMIN_PASSWORD=abc
--- a/modules/server/sops/server.yaml
+++ b/modules/server/sops/server.yaml
@@ -1,5 +1,9 @@
-INFOMANIAK_API_KEY: ENC[AES256_GCM,data:QhjQoCMxogXAPtvUbf/EWkqsFAndn73LBuTqj5essjruekynH287D/CYN/cwfcnDqZoh6Z4A9p08uUmXzqmTiralAhsCoc+Ljb/monmsruc=,iv:8rMGNc9398jnFXZm34fOht6fMNDAcDZ68B1jwoQPn2Q=,tag:ZlQnPaxkCktpwiC6HzmFVg==,type:str]
-AUTHENTIK: ENC[AES256_GCM,data:jNcqbLEMbaQ7mmn4dK4LFguecDDxrBsQZaqfQeQ+iGel6mD4jAC6rNdGC8H8NepRWmc0ZjNC6Fe4EaGllbjq/50SqlB47DtyuuCwOZFP6fiU4sD13B7t0Fg/7xMomqnRnJ+3UyVzt6PgEzzQNoPPpHxVGpR+TJnROhflcmCKi/JdAR6dspNqJEbrjp4LVk28Rp9Od6lbsOGphRb79z/DKA1QYRPuE7QU7Edzqqy09g5nKjGxIxjWNEYPt0WiD3537eBICfWm5krs8jxyf6TSiGasHSgSDyJSbnoNkPzSf9A5Jwtulu1jFgjvY/v+qhs9649USp1MzogSAfDZBNC4irge/lb5EPPIQ31EC/Dybza9dX/h6cR/KyQm5GsxBBJzm33rzC/4aCCRlcsAl5eO4JZn4MZta4yHss2UQHQ48i15OSdBwwTbTt240UbrIIje0hfOM6R+Uk3VOY/+VtBV/D+0ks2SUEKMvWgqJDhDh4FVqeR0a9dpLhOAvaWryAAETjlHljOrcF3Q3WooZbBDvLyMMtsHIeF1JDqwghI3,iv:8RdNbsnVVu4awW6yrpLGxAtM7o6uN5vgZIotmT6osW8=,tag:rNaCeG6STXINm42x1b2jcw==,type:str]
+CUSTOM: ENC[AES256_GCM,data:HYYOJP3ZzRWS,iv:BVwIJzfHzOxbKTrcA0yajCfIJkEjRXcztk3naqiqf6g=,tag:feuz1VIj0QWX7PpQRFO6iw==,type:str]
+TRAEFIK: ENC[AES256_GCM,data:Ei+/OL7xwNaOEg3rSaz95N78nvp51lC63XCplNzeD+bBMGcK9G7HoyQxfpaJ7S0MkuMW0ZXT2nJ4GES40GoJCZIrnEiSBm2tpjDfNjlS/rFwxx0wVfM1nsEuBf3pL5dqiCNa9+Lad2Cd,iv:d1MH0ive+E8xuUK0CIOXZeEigHJKVGlFaq0iH4KSbZA=,tag:VTARuNeotr2I0+fdOk+iqA==,type:str]
+AUTHENTIK: ENC[AES256_GCM,data:dZ+Kf85ZjaZ82coYNeNOXe5zfD2M9rEeOB6jDNoaKmo3jMABhnha+iBvYJTI2NltkGzymPJQI+JV8F6GdT1l6cqcR8p0nNjQjS1BMk0rR7n8RCp6MazUTJuIjbEq6zEUrA4SXquw5gZDEp4FLo010PhoLaLinHg8OoqzjDsTxdcKevbQWmZeefDBrwXWpz6BlkRIQA3KazVb0w7l1jDTIkozUIWbvtvtk5ccGjzx3b+wCC36QYFcHHtPvFZwMDHzFPVBd90hWc/BwFfvCExONmH0S7GLFTp7I5NsBnWpT0AHUHHc5PlSR2dUy9H2DZ3IkORdNVzOaqESbYKymuWTQBDQuyI9IJdt4Cac0CV9i6p8rFXL6fQyQKZ9djHX8orpyCUeJXqFs8I6et+IzpTeZcmdv/76Q9tomBBi4k4PRMXpeff8Bn02bOSb7RSaj5NVeWxIhZkh3sEXUeva5/yrAYT30mrLpbwzWoCaKrPCPLIcFxvNrYxPUo6kVVz1jSlBurvcKefbreJGqA==,iv:Hj7aBfDLSqRBzueN8b9F9TutpjMESFloqrnirSmnH9U=,tag:1ikt1JvuhIZCx68nh/VzMA==,type:str]
+NEXTCLOUD: ENC[AES256_GCM,data:IWitzubILQ5SrGdO3UQZboisqAECt5lXOqHVg4yAKxedG7ZLOgVp6jPV+4VVDC13KEkxIsiYjjNvjqnOXCdYWQIC13YZ+o2IBDI9PgavBB3nmjfi0Q7BVki6C8qCtbM5H9uFlQ3h7rkPyEbE3pHa3dY5uwgdtmvw3qKf2UAZGIJCU7dKamjuTCucGitOEG434jFQik9duHZs7EV3AZrkLXqOfdvftvdpciDb/4/K7h/4uEYSXJ94Lf0b16/NRUcR,iv:1UvcbqC3hJEHU9t6Z+N226DTJEcgM315ynYkxPKpYSM=,tag:FGkXlUw+7LRu1/cpMys7OA==,type:str]
+COLLABORA: ENC[AES256_GCM,data:tY4LLma/7Ut9J/6C3GRyjRn30CAP76hT573++cLqGj7/BSb8uEkU0sJ/CUmSEJvxLqnoFgjc+XWe+NJSiNMWKYfnHvf1DglMntkJB+BgvnbYvHAYOHOAJO6Jp7YhrYvXdy+HoT4DNaQbcDhYuYI=,iv:uPxznygpX6gtmJ7dZ/WrbxyuMjup0wtbBPS7xYinrwI=,tag:rdqrSIokAbkRzP4FLxqYLw==,type:str]
+ETHERPAD: ENC[AES256_GCM,data:8fDVvn6B8WNd8JxaxFBVNQrVY/wxmiqdMLfJu2cCqJgelDOtlyE7egicrIb6XCdRYHkU/EU59OOJcU7AFuextpQDxp6rnPsLIHfh2s2Km6bANIZk3pNEQXYH8A6rIg4Ozq0w8JLtncl6KmQZ0cO4w2tqR2oH/SubadFtz72Lnh+pZl8BM/YbhL3SBocFFGsZiHWjcFRA9m9ndWOM1lvvUjz6+oEHRmuzTdabuwQwTC0ZgXbCriK1mVHPrF+VqmDRPuEYRvlB25UPVaC4zE6i,iv:mThrVc5RLEwdmFQa4P81DUx7gVlvH+W82Z7gtLx4qyE=,tag:p8RLfMFdKgekR4SKr6f8Iw==,type:str]
 sops:
    age:
        - recipient: age1sxzuhh2fcd4pmaz4mdqq95t683d32ft22w9t2r7pk258u0s8wymsqdj7lg
@@ -20,8 +24,8 @@ sops:
            S1NaTVFTL0FCdm1EQmRsUnlhclZNZlEKEgIe60qkvY8+UocjQU+WM2dTL/1y3Kqk
            d4RrlLP9NSozwVsPYI4ntygvMSApbT4v0YvoO7gV90lkGWEvW1YDfA==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-05-06T01:10:20Z"
-    mac: ENC[AES256_GCM,data:O4RLfEE6z0uDRpZdL47Or+z/PTeJ+zgzXN9kJS6Nebs9Uhw0XUJUPGhAocLokiMin5sQcpxXG5Q8oc2rAkq2GDbtna4u26dtNkd2Q/vtly6DqUaIRXXt3TL5cfJwMNa76fp+ERKLwGbBG+/BFWajzYJtcE257I8t3X4UmAdqYmE=,iv:uYLh8LnGobf7t3Ur7drEiA6n3Vv0e0yhlja6Uww8jiU=,tag:ZK3OCCsiMPtKl28lrGKtqQ==,type:str]
+    lastmodified: "2026-05-09T10:54:06Z"
+    mac: ENC[AES256_GCM,data:7isR8oE5Zmx2lwSWaabGVTpWhkNkiHueSn0iVzPiGu8gReeJVlb21n2OO2JduSHMMH1pc+LNrugpRvwlGKK1OlaGPe6nYtEki2jkgn2hwnD7Q/6kTz8GoqGzWyWUbG/Y+1KsMoQb9KgfcKcOh4JLJAyNw+mgeKeD+nhWVTJY8ww=,iv:9k/HQFhM5VKi7PUkLSqk8o5TUg9e/OCs9MdeqZYpKm0=,tag:ZQJBJ60+IYufctZYMa3Oug==,type:str]
    pgp:
        - created_at: "2026-05-05T23:46:27Z"
          enc: |-
--- a/modules/shared/colors/default.nix
+++ b/modules/shared/colors/default.nix
@@ -1,4 +1,4 @@
-{ config, ... }: {
+{ ... }: {
  imports = [ ./sorahiro.nix ];

  colorScheme.palette.border-radius = "#8";
--- a/modules/shared/colors/sorahiro.nix
+++ b/modules/shared/colors/sorahiro.nix
@@ -1,4 +1,4 @@
-{ nix-colors, ... }: 
+{ ... }: 
 let use_pastelle = true;
 in{
  # usage:  a = "#${config.colorScheme.palette.base00}";
--- a/modules/shared/syscfg/default.nix
+++ b/modules/shared/syscfg/default.nix
@@ -82,18 +82,9 @@ let
  };
  serverOpt = with lib; {
    hostDomain = mkOption { type = types.str; };
-    shortName = mkOption { type = types.str; };
    mailDomain = mkOption { type = types.str; };
    mailServer = mkOption { type = types.str; };

-    dbHost = mkOption {
-      type = types.str;
-      default = "localhost";
-    };
-    dbPort = mkOption {
-      type = types.str;
-      default = "3306";
-    };
    configPath = mkOption {
      type = types.str;
      default = "/media/config";
@@ -102,22 +93,32 @@ let
      type = types.str;
      default = "/media/data";
    };
+
+    colorScheme = mkOption {
+      type = types.submodule {
+        options = {
+          slug = mkOption { type = types.str; };
+          name = mkOption { type = types.str; };
+          palette = mkOption { type = types.attrs; default = {}; };
+        };
+      };
+      default = (import ../colors {}).colorScheme;
+    };
    containers  = mkOption {
      type = types.attrsOf (types.submodule {
        options = {
          enable = mkOption { type = types.bool;default = false; };
          db = mkOption { type = types.bool;default = false; };
-          ip = mkOption { type = types.str; };
-          port = mkOption { type = types.port; };
-          extraParam = mkOption { type = types.str; default = ""; };
+          sops = mkOption { type = types.bool;default = false; };
+          ip = mkOption { type = types.nullOr types.str; default = null;};
+          subdomain = mkOption { type = types.nullOr types.str; default=null;};
+          port = mkOption { type = types.nullOr types.port; default = null; };
+          pubPort = mkOption { type = types.nullOr types.port; default = null; };
+          extra = mkOption { type = types.attrs; default = {}; };
        };
      });
      default = {};
    };
-    sops = mkOption {
-      type = types.bool;
-      default = false;
-    };
    openssh = mkOption {
      type = types.bool;
      default = false;
@@ -130,7 +131,7 @@ let
      type = types.bool;
      default = false;
    };
-    nftables = {
+    ipfw = {
      enable = mkOption {
        type = types.bool;
        default = false;
--- a/systems/gateway/cfg.nix
+++ b/systems/gateway/cfg.nix
@@ -29,7 +29,7 @@
      openssh = true;
      wireguard = true;
      web = true;
-      nftables = {
+      ipfw = {
        enable = true;
        ifs = ["ens3" "wg0" ];
        ports = [
--- a/systems/sandbox/cfg.nix
+++ b/systems/sandbox/cfg.nix
@@ -21,22 +21,43 @@
    server = {
      openssh = true;
      web = true;
-      sops = true;

      hostDomain = "test.helcel.net";
-      shortName = "testcel";
      mailDomain = "test@helcel";
      mailServer = "infomaniak.ch";
-
-      dbHost = "localhost";
      
      containers = {
-        #cloud = {enable = true;};
+
+        traefik = {
+          enable = true;
+          sops = true;
+          subdomain = "traefik";
+          extra={provider="infomaniak";};
+        };
        authentik = {
          enable = true;
          db = true;
-          ip = "10.88.0.125";
-          port = 9000 ;
+          subdomain = "sso";
+          port = 9000;
+          pubPort = 9999;
+        };
+        nextcloud = {
+          enable = true;
+          db = true;
+          subdomain = "cloud";
+          port = 80;
+        };
+        collabora = {
+          enable = true;
+          sops = true;
+          subdomain = "office";
+          port = 9980;
+        };
+        etherpad = {
+          enable = true;
+          db = true;
+          subdomain = "pad";
+          port = 8080;
        };
      };
    };
Author	SHA1	Message	Date
soraefir	90f8387192	tmp ignore	2026-05-10 11:56:13 +02:00
soraefir	25604d6c14	test	2026-05-10 11:55:53 +02:00
soraefir	51d60de5c0	fix	2026-05-10 11:54:37 +02:00
soraefir	5e8cd65785	fix	2026-05-10 11:52:32 +02:00
soraefir	fa5845808b	fix	2026-05-10 11:50:34 +02:00
soraefir	28c17d9bb6	colors	2026-05-10 11:49:18 +02:00
soraefir	89d2f9a48e	typo2	2026-05-10 11:42:53 +02:00
soraefir	e58d323ea0	typo	2026-05-10 11:41:59 +02:00
soraefir	7465b6b24c	script omprovement	2026-05-10 11:38:19 +02:00
soraefir	59c6b68501	Add cron	2026-05-09 19:40:22 +02:00
soraefir	9273387170	Script improvements	2026-05-09 19:35:05 +02:00
soraefir	55a08673f0	fix caldav	2026-05-09 19:25:06 +02:00
soraefir	5dbb95603d	silence script verbosity	2026-05-09 19:20:35 +02:00
soraefir	d60f8dd56f	improve script	2026-05-09 19:18:27 +02:00
soraefir	7d35cb319f	Fix	2026-05-09 19:12:36 +02:00
soraefir	8d4caac83b	group for nextcloud	2026-05-09 18:47:38 +02:00
soraefir	ad2b492b51	Fix service	2026-05-09 18:42:22 +02:00
soraefir	4b68accf2f	fix nextcloud	2026-05-09 17:52:39 +02:00
soraefir	0d9c8a2974	fix	2026-05-09 17:51:06 +02:00
soraefir	63d2dddd1e	setup scripts	2026-05-09 17:50:23 +02:00
soraefir	55d678df19	bump nextcloud	2026-05-09 13:33:56 +02:00
soraefir	88a4ab069e	registries	2026-05-09 13:28:48 +02:00
soraefir	c54ed4a712	Admin user	2026-05-09 12:54:13 +02:00
soraefir	3db4517a3b	temps	2026-05-09 12:43:16 +02:00
soraefir	f3dfe561ad	add plugin	2026-05-09 12:38:04 +02:00
soraefir	b58da2b2e1	port fix	2026-05-09 12:12:42 +02:00
soraefir	28fa63919f	Fix env	2026-05-09 12:09:27 +02:00
soraefir	cb7e29bfe0	container settings	2026-05-09 11:58:38 +02:00
soraefir	ea58be6fdc	fix typo	2026-05-09 11:57:21 +02:00
soraefir	da51e61c05	escape	2026-05-09 11:56:42 +02:00
soraefir	1ca61b70d2	fix env	2026-05-09 11:53:29 +02:00
soraefir	eafafe876f	postgres	2026-05-09 11:03:58 +02:00
soraefir	21adca1fbc	tmp perm	2026-05-09 10:50:25 +02:00
soraefir	57efc58bc2	Fix user etherpad	2026-05-09 10:46:04 +02:00
soraefir	cd5deea849	etherpad	2026-05-09 10:45:16 +02:00
soraefir	9f5f8751e5	fix ddos	2026-05-09 10:32:18 +02:00
soraefir	f02adc6d93	fix	2026-05-09 10:24:13 +02:00
soraefir	b2f6d8cc9e	Fix	2026-05-09 10:19:21 +02:00
soraefir	c18ac097fa	test	2026-05-09 10:17:27 +02:00
soraefir	1fc9017e7e	fix	2026-05-09 10:12:01 +02:00
soraefir	8ff90e54b8	fix	2026-05-09 10:11:21 +02:00
soraefir	fba3a24f16	custom image	2026-05-09 10:09:51 +02:00
soraefir	fcb97828f4	test custom img	2026-05-09 10:04:47 +02:00
soraefir	e04382742f	cleanup traefik	2026-05-09 10:03:09 +02:00
soraefir	48b40d819b	fix typo	2026-05-09 09:56:28 +02:00
soraefir	8b75968f11	fix tls	2026-05-09 09:55:30 +02:00
soraefir	dda8409329	cert	2026-05-09 09:46:18 +02:00
soraefir	9a0b5171b1	fix dns	2026-05-09 09:42:33 +02:00
soraefir	9abb5b2f26	logs	2026-05-09 09:35:41 +02:00
soraefir	8362599b54	traefik	2026-05-09 09:34:07 +02:00
soraefir	c1b9c12281	fix	2026-05-09 09:26:40 +02:00
soraefir	e4dcb0bd39	api port	2026-05-09 00:20:27 +02:00
soraefir	a31991c507	typo	2026-05-08 23:58:53 +02:00
soraefir	e1651cba2a	traefik docker	2026-05-08 23:57:19 +02:00
soraefir	bb5ecbba73	acme	2026-05-08 23:54:20 +02:00
soraefir	0c79617647	test acme	2026-05-08 23:48:37 +02:00
soraefir	a3bc8b80c5	fix acme	2026-05-08 23:39:48 +02:00
soraefir	55fcf8b71a	fix	2026-05-08 23:32:25 +02:00
soraefir	5aabd9acce	Fix	2026-05-08 23:31:56 +02:00
soraefir	e652c12bf2	fix traefik	2026-05-08 23:30:04 +02:00
soraefir	4c684cf9b1	Fix portfw traefik	2026-05-08 23:18:43 +02:00
soraefir	0c60bbbaa8	rm deprecated	2026-05-08 23:14:51 +02:00
soraefir	097334b483	fix statfs	2026-05-08 23:10:52 +02:00
soraefir	bfd099d201	container registry	2026-05-08 23:05:25 +02:00
soraefir	1fe6e43046	sops	2026-05-08 22:56:05 +02:00
soraefir	23b8ad480e	fix subdomain	2026-05-08 22:55:21 +02:00
soraefir	3d1fc2a2c9	traefik	2026-05-08 22:53:41 +02:00
soraefir	aacca16eb2	fix tmpfs	2026-05-08 21:05:08 +02:00
soraefir	5de459c347	fix nulls	2026-05-08 21:01:46 +02:00
soraefir	d898116ff4	fix nulls	2026-05-08 20:59:40 +02:00
soraefir	e2b688c836	fix sops	2026-05-08 20:54:54 +02:00
soraefir	b5d57bf9c8	test	2026-05-08 20:52:08 +02:00
soraefir	236f9dbdc3	Sops	2026-05-08 20:50:13 +02:00
soraefir	9696ca9a6d	ipfw	2026-05-08 20:47:00 +02:00
soraefir	df523c48e5	rename and fix	2026-05-08 20:46:23 +02:00
soraefir	4d398d5596	sops	2026-05-08 20:36:26 +02:00
soraefir	5045291097	sops	2026-05-08 20:35:43 +02:00
soraefir	2dc1632a40	sops	2026-05-08 20:32:37 +02:00
soraefir	744a2b8563	Secrets	2026-05-08 20:31:12 +02:00
soraefir	b722d349af	fix cloud	2026-05-08 20:28:22 +02:00
soraefir	7438905618	WIP	2026-05-08 20:25:51 +02:00
soraefir	908c144c73	add cloud	2026-05-08 20:25:14 +02:00
soraefir	6d353df19f	fix collabora	2026-05-08 20:23:40 +02:00
soraefir	7194d91b1c	WIP	2026-05-08 20:22:04 +02:00
soraefir	d3c301db36	Fix	2026-05-08 02:52:56 +02:00
soraefir	135d48d78c	test	2026-05-08 02:47:19 +02:00
soraefir	d4292cd46d	test	2026-05-08 02:45:33 +02:00
soraefir	4a4d3e3604	typo	2026-05-08 02:37:06 +02:00
soraefir	d076538901	test	2026-05-08 02:35:32 +02:00
soraefir	8fedaf18cd	firewall?	2026-05-08 02:20:28 +02:00
soraefir	4c1f9f0e78	nft	2026-05-08 02:17:10 +02:00
soraefir	1a8eb085df	fix db ?	2026-05-08 02:13:44 +02:00
soraefir	8a619d9fc6	env	2026-05-08 02:00:10 +02:00
soraefir	a76f920297	Fix	2026-05-08 01:58:37 +02:00
soraefir	fe93cb708e	accept podman traffic	2026-05-08 01:49:31 +02:00
soraefir	cb29056296	Sops	2026-05-08 01:37:57 +02:00
soraefir	4bc68eeeaf	more fix	2026-05-08 01:34:17 +02:00
soraefir	9cf9937cb7	wg nft	2026-05-08 01:26:53 +02:00
soraefir	593514c100	fix ssh	2026-05-08 01:21:56 +02:00
soraefir	6ad9a0b34c	Env	2026-05-08 01:19:04 +02:00
soraefir	65e3568072	Db	2026-05-08 01:18:02 +02:00
soraefir	c55b06cca9	fix nft	2026-05-08 01:15:56 +02:00
soraefir	40dba4b959	Fix nftable	2026-05-08 01:15:27 +02:00
soraefir	bc8a9d42f9	Fix nftable	2026-05-08 01:09:51 +02:00
soraefir	cd5a1aeed4	temp fix	2026-05-08 01:08:59 +02:00
soraefir	0f2081486d	Wops	2026-05-08 01:08:07 +02:00
soraefir	1c022d7642	Fix secret	2026-05-08 00:53:00 +02:00
soraefir	379f6befb3	fix	2026-05-08 00:44:13 +02:00
soraefir	868d2ce116	fix	2026-05-08 00:29:12 +02:00
soraefir	94fdfa2b33	Test acme	2026-05-08 00:17:46 +02:00
soraefir	a73ad174ea	Fix	2026-05-08 00:14:41 +02:00
soraefir	fba5a79ce6	Fix parenthesis	2026-05-08 00:12:17 +02:00
soraefir	e8c9fc52fb	Update	2026-05-08 00:06:21 +02:00
soraefir	8092bac6b7	nginx	2026-05-07 00:03:43 +02:00
soraefir	7d80478e83	more fixes authentik	2026-05-06 23:47:09 +02:00
soraefir	2cab462db5	Fix authentik worker	2026-05-06 23:45:21 +02:00
soraefir	0bb796fbe8	Fix cfg	2026-05-06 23:42:29 +02:00
soraefir	1f2cc94a0a	Fix builder	2026-05-06 23:39:28 +02:00
soraefir	3caf507905	Fix attempt	2026-05-06 23:35:03 +02:00
soraefir	27a5566ac6	Rename file	2026-05-06 23:31:12 +02:00
soraefir	b439888fa8	Fix naming	2026-05-06 23:30:08 +02:00
soraefir	093497367a	container builder	2026-05-06 23:28:49 +02:00
soraefir	1c0cfd1afe	change podman building	2026-05-06 22:59:11 +02:00