+1

hosts/cm4-node-1.nix

reviewed

··· 8 8 ../modules/dyndns.nix 9 9 ../modules/beszel/hub.nix 10 10 ../modules/uptime-kuma.nix 11 11 + ../modules/pocket-id.nix 11 12 ]; 12 13 13 14 system.stateVersion = "23.11";

+3

modules/caddy.nix

reviewed

··· 45 45 "beszel.goo.garden".extraConfig = '' 46 46 reverse_proxy localhost:${toString config.services.beszel.hub.port} 47 47 ''; 48 48 + "id.goo.garden".extraConfig = '' 49 49 + reverse_proxy localhost:1411 50 50 + ''; 48 51 "nas.goo.garden".extraConfig = '' 49 52 reverse_proxy 10.0.0.2:5000 50 53 '';

+20

modules/pocket-id.nix

reviewed

··· 1 1 + { config, pkgs-unstable, ... }: 2 2 + { 3 3 + disabledModules = [ "services/security/pocket-id.nix" ]; 4 4 + imports = [ "${pkgs-unstable.path}/nixos/modules/services/security/pocket-id.nix" ]; 5 5 + 6 6 + services.pocket-id = { 7 7 + enable = true; 8 8 + package = pkgs-unstable.pocket-id; 9 9 + settings = { 10 10 + APP_URL = "https://id.goo.garden"; 11 11 + TRUST_PROXY = true; 12 12 + ANALYTICS_DISABLED = true; 13 13 + }; 14 14 + credentials = { 15 15 + ENCRYPTION_KEY = config.sops.secrets.pocket-id-encryption-key.path; 16 16 + }; 17 17 + }; 18 18 + 19 19 + sops.secrets.pocket-id-encryption-key = { }; 20 20 + }

+3 -2

secrets/secrets.yaml

reviewed

··· 5 5 beszel-token-rk1-node-1: ENC[AES256_GCM,data:N9Iz7jsvLUGTQekT2cyJPMFgAvo2vBLMr5X7XEkQ+sJbhnug,iv:ZLPftzHbd/WwbwL1C2RYw30wkusngKZOR+bJHcE7868=,tag:8J7fLPKzBJh/p4GV56bWLg==,type:str] 6 6 beszel-token-rk1-node-2: ENC[AES256_GCM,data:tlGM9qUbBgx8/EF+dWIobe8tDCVFIsRR+oBVCXLDMwoNGKXS,iv:GMvHGRxOKmH8wvkvFR+CoF3xa2qYJ0kvpUKPQngxZCE=,tag:76BlIpA7WXL5L7Gjyjh/og==,type:str] 7 7 restic-password: ENC[AES256_GCM,data:JnJpfpHbVVrnwmOcTQAr1JG+l/6IBC5Jpahw0tlK/VKORL2EQzQEYNLURxPbfwReKrUpsZf3x7B9,iv:iidvEALfAQEGwrHlHL4pXP4ICkhM49v1a3vP480RJ+k=,tag:LZOwGksaXS2ok9pZtO+XuA==,type:str] 8 8 + pocket-id-encryption-key: ENC[AES256_GCM,data:GotMtKCXugB+qNvMPRoLHLNFfb60+ngX+ykfInbK1QmRv8SME1+gEjFb08XzodzuydlAKqdR/0svIZPw88YA4g==,iv:7ub4AxT6Dnrr/aE5Wvuyp5hWk8D+zNUMG+P6bYLWGVM=,tag:SlKYIB59TX4lEedgUWBHFw==,type:str] 8 9 kitchenowl-jwt-secret: ENC[AES256_GCM,data:legJFjeCURS2aiVBm5rY9Yz4/9cje22zMn6nRbLfliHSI3Bj2viVvsSCvOnvR+VxCcoJYwPhJPmaMGlCf5LV6g==,iv:vbygH1lPayQeoyemFNLqxJy6N24VvxC4qzj0UKceF9Q=,tag:QPO0/0G9xfpLUg6rjtiEKQ==,type:str] 9 10 kitchenowl-db-password: ENC[AES256_GCM,data:dLbd7ikyUqudXHpdohzwoSGdR4XwrDJpiV5Zxvfvm+kyDgLyoNFeIR2riMxAwSXgoOwNxpsNe9Zhtm6sdsVwTg==,iv:KlVfJwJDGxqzCq3e+208vhtTxA736s6mbweF9Dbjzq8=,tag:AvDPlFZk+7UpeuIL0RAhEA==,type:str] 10 11 backup-repository: ENC[AES256_GCM,data:v6tUjTwVsym8i52jcapjSRXPIjX2xNFY+bZRkHnVsp4AebcksHzHEDX6N4BF3OuQ2KepOfHngMn61Mk=,iv:HPV+8aCPpvFnytja6RUA7hJdtz2BMI1zsH01w1J9r2w=,tag:znMIFmrcsKTIq2TowhAV0w==,type:str] ··· 56 57 ajA5bDZCY1BnblVYRGQ1QTE2S2I4M2cKSIGmFBP6sqiiM+cvTMQuZHit9fN5Vffk 57 58 1pWz8xSen/tqoywqipRf3LqzFb2K7Bx15vwazHbm6LJJa+ZQaruVMg== 58 59 -----END AGE ENCRYPTED FILE----- 59 59 - lastmodified: "2026-03-23T10:51:48Z" 60 60 - mac: ENC[AES256_GCM,data:Dgpc/7RkezriEN46rQEM3Ke0K+9kyEzwYvYLUAddM+i7fzrIO2OjWho5+RGhoEVAfOoTdcNAc9C0AptCVnaKiXvCWi80y0//JmtYaaAIbYzoP9RUyntSVPCSfvGMaz9O8QnAeMtx1i8ROb0geKrH2HXNDR6K8Lc7/JhWx7Du+fc=,iv:NKL3rnFeGdYAu8sOihko8du9MU4+KRUQxTDPVxT/5f4=,tag:n4yerMzzQqIOOMaC/5j95A==,type:str] 60 60 + lastmodified: "2026-03-23T21:37:21Z" 61 61 + mac: ENC[AES256_GCM,data:tILV9atrmApL7LjUaMrLuLpLzPg6hVG1nKdOTa+2G7pWoxSSFHoWgYonhqe40T5ThDhm0lp2m4w4Eg1qbEAnvB8fJm36rf6GyrJ9WbRbTIF6EZxyYoTk+ooE5JewIkZR4Q9+116sQmvBuwS65L6UjPo7xW9avW98GBLAzgIUonw=,iv:tYvwF9NBtFCXr3+acTES4RSyV4Vu6+HJlXoTrpdjNCQ=,tag:Iv4qczCUyUJJfUOnz0QYlg==,type:str] 61 62 unencrypted_suffix: _unencrypted 62 63 version: 3.12.1