+1

hosts/cm4-node-2.nix

reviewed

··· 6 6 ../modules/mumble.nix 7 7 ../modules/tasks-md.nix 8 8 ../modules/rustical.nix 9 9 + ../modules/screego.nix 9 10 ]; 10 11 11 12 system.stateVersion = "23.11";

+3

modules/caddy.nix

reviewed

··· 121 121 reverse_proxy cm4-node-2:8080 122 122 } 123 123 ''; 124 124 + "screen.goo.garden".extraConfig = '' 125 125 + reverse_proxy cm4-node-2:5050 126 126 + ''; 124 127 "cal.goo.garden".extraConfig = '' 125 128 reverse_proxy cm4-node-2:4000 126 129 '';

+5 -5

modules/mumble.nix

reviewed

··· 6 6 openFirewall = true; 7 7 hostName = ""; # binds all 8 8 port = 64738; 9 9 - environmentFile = config.sops.secrets."mumble.env".path; 9 9 + environmentFile = config.sops.templates."mumble.env".path; 10 10 11 11 registerHostname = "mumble.goo.garden"; 12 12 registerName = "📞 mumble.goo.garden"; ··· 23 23 group = config.services.murmur.group; 24 24 }; 25 25 26 26 - sops.secrets."mumble.env" = { 27 27 - sopsFile = ../secrets/mumble.env; 28 28 - format = "dotenv"; 29 29 - }; 26 26 + sops.templates."mumble.env".content = '' 27 27 + MUMBLE_PASSWORD=${config.sops.placeholder.mumble-password} 28 28 + ''; 29 29 + sops.secrets.mumble-password = { }; 30 30 }

+24

modules/screego.nix

reviewed

··· 1 1 + { config, ... }: 2 2 + { 3 3 + services.screego = { 4 4 + enable = true; 5 5 + openFirewall = true; 6 6 + environmentFile = config.sops.templates."screego.env".path; 7 7 + settings = { 8 8 + SCREEGO_SERVER_ADDRESS = "0.0.0.0:5050"; 9 9 + SCREEGO_TURN_ADDRESS = "0.0.0.0:3478"; 10 10 + SCREEGO_EXTERNAL_IP = "dns:screen.goo.garden"; 11 11 + SCREEGO_TRUST_PROXY_HEADERS = "true"; 12 12 + SCREEGO_AUTH_MODE = "none"; 13 13 + SCREEGO_SERVER_TLS = "false"; 14 14 + SCREEGO_TURN_PORT_RANGE = "50000:55000"; 15 15 + }; 16 16 + }; 17 17 + 18 18 + networking.firewall.allowedTCPPorts = [ 5050 ]; 19 19 + 20 20 + sops.templates."screego.env".content = '' 21 21 + SCREEGO_SECRET=${config.sops.placeholder.screego-secret} 22 22 + ''; 23 23 + sops.secrets.screego-secret = { }; 24 24 + }

-15

secrets/mumble.env

reviewed

··· 1 1 - MUMBLE_PASSWORD=ENC[AES256_GCM,data:uqUYN1jNGw==,iv:cE40sGxWl+PenP5LDICKcSAfIBCtWs5aYbM47QDFLiU=,tag:JR+RfJOQxcr+MlNvdmIfmg==,type:str] 2 2 - sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4TzNvUFBjMkJ6TEJHV1Rw\nV1VJeUdCKzRpTXdPM0h2U1BVbGRvb2haRmx3CjNKcUtxZkRTYkZqR05CUjB4cDVV\nTFBWcVJWc2wxZXllOHBucTF1T1pNKzQKLS0tIGlFcFBpS3lLeVVTdWNsR0kzTzZ6\nR2d1ZGdZb0doWlBabzA1ZGJzVVlyakUKl7You0hzodZ7DuXn7/rzTrukXyHJly17\nX9GSRDpXH/Xxwdb6Pt8A65sR2ZmhirZUx5LEnLuw2d8BmZvgCpwvPQ==\n-----END AGE ENCRYPTED FILE-----\n 3 3 - sops_age__list_0__map_recipient=age1ukx4wxssue9d5y72tt7wk0nqg86wjhcnsy80ky0kkwf5m8p72a7su87kf3 4 4 - sops_age__list_1__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0SlQ1Q0J5V0l0YWVsL2xr\nQ20zbmNvSWYwcElZYldBZkJRcUo0R09BRWg0ClM5TDUzWmkyQndIVllWZEhveTVO\nTVZyMCt2WjRKL3pad0VJdU9OMU03T28KLS0tIFJ1WmFJUWpRbGg5bVNWOVNaZ3A0\nVm55WlZtd1NkbDhZQm9Ld1I3bDF5U1UKNEqDlYOyzJmHh+nfyXmkTbYD7Nf7T/lI\ncco1XtA/gkzxPGJPMpZfWuwpjHEAMAo2O1X10KAdQPDx5oPUSFZ3mg==\n-----END AGE ENCRYPTED FILE-----\n 5 5 - sops_age__list_1__map_recipient=age1hnzrlvwx7ej6yyg8uvuwmx0vln37n554ksp6ryarne2qhqm2ggxqta3sra 6 6 - sops_age__list_2__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0SDFEcmkzd0FHckZIcnJX\ncDJwLzRPNTd0dVdxTEdBZ1JwS2piMDcvQjNNCjZtVHJ1TldTRjZLM2lEMXRJVGQw\naFdtbFczdkQ0V3JUM3BlYnRSek1HZFEKLS0tIE1DSXRscTA3ZVp5VnNCNTc0UDMx\nZGlqZHhFS0FacVZyNmhjQlNtRVNkemsKH25jA5HDWrdku8v795+U6BTXahkjVziU\nwB7stqynhcXVWY+BsoQJlmcv+KZWa43DNta8YS4Ku3zRFYaLWQT+Pg==\n-----END AGE ENCRYPTED FILE-----\n 7 7 - sops_age__list_2__map_recipient=age1yk9d90hd37thd3w56urke49jdat6yehfj6dsh3m77y3edpy0pppsp5s7wj 8 8 - sops_age__list_3__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzTEM0QWZwVTZxWXBxdGFK\nNElJWUpsOVNPUmNhK2ZtVnFiQzZxdFlRbGtRCjBJaXQvQ09nckluYVJoem1oVldy\naktEbkV5ME5LRUZSR2gvd3A0QThOQ0UKLS0tIG9NODExU29mOXlnbDdlMkdzVFZ2\nTDN4S0FNLzRGTkNZS243NCtYMitnZXcKxGAtM+QeHf7Hc2s879OnYTqigsfGizU/\nZViaAudCr23rHSMmJ0u01B4MLNcntObMC9Agj7I8pkQJ2ZiHO9Z83g==\n-----END AGE ENCRYPTED FILE-----\n 9 9 - sops_age__list_3__map_recipient=age1xauhmsda9c9gvv07xu6efp2wl5z7g2q60rz6ypdzn40r5r6apulq6sc5uf 10 10 - sops_age__list_4__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFWjJWeC9vSDJwRVBxc052\nUVZxakZuaUl4aHhpRXZ0dE8ycElOdjc0eENZClNLY29kbHhocG1XcENZY0ZaYnZW\nRVVKR0JMNW5KVEhGRnZpN1pjbGxFLzgKLS0tIHNWZTZtODhWei9kclpxUUhTTFNW\nQ3NOR3FJQUxSbWc0TFBpd1BwMWdGQlkKIBffg9T9XJeFpGQEm6QGSdFD2pJEbQ13\nN0kRKHrX3Hq6/4ML0zOzYbwQ+Mlg2tNMi4L8MIFXcWyw3d8vsEEXqQ==\n-----END AGE ENCRYPTED FILE-----\n 11 11 - sops_age__list_4__map_recipient=age12czqnvj6mmwtu47a7uneyrenkapsffptenznn4ye87a09z8aff7szyc8sp 12 12 - sops_lastmodified=2026-02-11T15:57:26Z 13 13 - sops_mac=ENC[AES256_GCM,data:wtwCA9S9XfquG4hQwxDbkknSg2YiHUwV/uBruDFLl041oAeIpqrZQfUZCEuR4C8Ht8j0d4QJoda3VbyVMpSSXXry42GMROthnljWki6VEB8Po8Jn8CtWKae79t4rR1X3w7mIETeEO6DM+E7pkm3cEEOwp7YNpjiWOEBK5DUcUJM=,iv:BeXgqqhn18rvb6LxrGAGrjspPNSq9dYs3wtJzDzQdOM=,tag:KUNsD8Y+yrENLXrCBbA0iw==,type:str] 14 14 - sops_unencrypted_suffix=_unencrypted 15 15 - sops_version=3.11.0

+4 -2

secrets/secrets.yaml

reviewed

··· 17 17 tasks-oidc-client-secret: ENC[AES256_GCM,data:uX/G+TdE2nAeQ5jbd6YUkdwigxxJMVQODlpgL330hhk=,iv:72sKHzrij9BOSYfh9TEHxS899CulH6pNzTmCMegZEac=,tag:fa5r9UV7clsbXxpC/AfTIg==,type:str] 18 18 rustical-oidc-client-id: ENC[AES256_GCM,data:dDA1SCH1/rOHqPNvoXX6GFRVE4zXhmq4EES2OnP0i6NK1WAI,iv:aZquya/FnGm3zXbvyxVvUfYRYN5yPvYtagfVYy4n1RU=,tag:w+usKIfoFqxacpIzFbMGpA==,type:str] 19 19 rustical-oidc-client-secret: ENC[AES256_GCM,data:savr1jjsi+cO6Rotx3zydTVl5qMiieOJ1Ue3+/IFBRQ=,iv:d3h/fuIfA2w3gnT0pCVSixaR1PbvfwwX/Pb3u+sDodc=,tag:YZgogP9Howbt2P7MVThegQ==,type:str] 20 20 + screego-secret: ENC[AES256_GCM,data:25elrR88LTQFJz1T6Hj1qDwNnaFnAFxTKwiVZYxVQ66wGI70m22WCexOIVLsxz1xtSEgX0JGTVPSx7qU7ZE4yw==,iv:VV4PpBihmQRJ7CVMIL7jRIAQbwpW5/c6vJftUNp/9hM=,tag:stfLGZ8veoNChnei7U+2/A==,type:str] 21 21 + mumble-password: ENC[AES256_GCM,data:/GA5G4CEVQ==,iv:Ri70GW9Ln7vv3Nf0CSNW0PwypLUNvh+kvJjUqu393ig=,tag:NY+u/RxcKudlaZStgnGVTw==,type:str] 20 22 backup-repository: ENC[AES256_GCM,data:v6tUjTwVsym8i52jcapjSRXPIjX2xNFY+bZRkHnVsp4AebcksHzHEDX6N4BF3OuQ2KepOfHngMn61Mk=,iv:HPV+8aCPpvFnytja6RUA7hJdtz2BMI1zsH01w1J9r2w=,tag:znMIFmrcsKTIq2TowhAV0w==,type:str] 21 23 backup-identity: ENC[AES256_GCM,data:8TJP7vSWJAj56AcczQhMRoQqahxM4EGzPm+wk1apMD+L3pybXh/4LPp0DNcGugOb3RPTyjki6jZArDgiirS+ltbldaNQPZaZ4cFrtiJVt8D/iQlsgM9tR8oC7bcR4KV+UoVeeXJN0fWqy5U+IzJ87ZRKKyb9i8WKhPuWFIftb4KqZRyada7jhl/SzwuoIcw9BagMJPLv6BaUmNp1j5fOHvo7RseImiIqsbVo37NTqMMQf7PKM5gsMU6bbeAMjtdeC2RNVG21eop8JlO5uYVyjGxyl5wfU+PwMSRc+XNpgeVEv9mjdo6dkG3QC2poHZ77ot4py6HzQPUZjwLyFsr0ccC4e6e0PNOBtTPtku/LnXHsV45LB9Q3X7t9VSYCTtlJul2W8huZuCRnv7crvIUW21ZMTWiwMbqNEqDUJTBcPLDi42Ea4CvA+I6ODJP8n5g7GTHW0ggy6FtjVXH5DzhzJJULQ27kq97EWi43bSRv0N+N5C1viM+j+hs6tM5eQ15niRVB,iv:YpRoGlD8YFxZ+RChb6T4Eh665AMTTeTJXRFR0xa7l3k=,tag:FWOVonF+SYbbgQoopa2lhA==,type:str] 22 24 sops: ··· 66 68 ajA5bDZCY1BnblVYRGQ1QTE2S2I4M2cKSIGmFBP6sqiiM+cvTMQuZHit9fN5Vffk 67 69 1pWz8xSen/tqoywqipRf3LqzFb2K7Bx15vwazHbm6LJJa+ZQaruVMg== 68 70 -----END AGE ENCRYPTED FILE----- 69 69 - lastmodified: "2026-03-25T10:02:53Z" 70 70 - mac: ENC[AES256_GCM,data:batDKpB04krYBjyVMCzff5DbcLmSHaBI7qWnawfXNUn+IEZBAc5kPgyTBAgVvD8SxBm9D+I67fSUcRa/JD3Vug2ARIEHLLi7sBBHwRGAlhGzUWzFcJnLfI7PSydimYDfndUKWDAnuM0N8+4iCSRlzx810Js6ttwTWiHkipra8Fc=,iv:G/hUqjl8bp6IzSBLs/zw6Mqh0tywRn3WvEB3XL7BCZ4=,tag:0+IE13XEn/Lw6Nz0h5RcvA==,type:str] 71 71 + lastmodified: "2026-03-26T16:11:20Z" 72 72 + mac: ENC[AES256_GCM,data:A1v72Mes2XAkrg7ETBLS7KeGyav/QF8K2iXo0MKitNfaUg6mlt85vPfUIoBqVZZf+Ds3xfmaEmvEYEqDTpoam+jsKBcfPi3kYSjc8KNJpblHvpw9q6VtxV1Ke8LYJ+NW+b5ewLmaUZhdFgKI7bCykmHDrocPeevoEe0Iv9qsRJ0=,iv:S/M7sPTWPwrXHIfsEoyRQ7RTU5zzG7+A8iIAmJweFlQ=,tag:Ax/Qs3YqrBBtGkg7VhiguQ==,type:str] 71 73 unencrypted_suffix: _unencrypted 72 74 version: 3.12.2