🏡 my personal home lab
screego adjustements and deployrs cache
+31
-8
+22
-4
flake.nix
+22
-4
flake.nix
···
33
33
let
34
34
inherit (nixpkgs) lib;
35
35
36
+
# build system
37
+
system = "x86_64-linux";
38
+
# deploy system
39
+
targetSystem = "aarch64-linux";
40
+
41
+
deployPkgs = import nixpkgs {
42
+
system = targetSystem;
43
+
overlays = [
44
+
deploy-rs.overlays.default
45
+
(self: super: {
46
+
deploy-rs = {
47
+
inherit (nixpkgs.legacyPackages.${targetSystem}) deploy-rs;
48
+
lib = super.deploy-rs.lib;
49
+
};
50
+
})
51
+
];
52
+
};
53
+
36
54
hosts = {
37
55
cm4-node-1 = {
38
56
ipv4 = "10.0.0.11";
···
88
106
profiles.system = {
89
107
sshUser = "root";
90
108
user = "root";
91
-
path = deploy-rs.lib.aarch64-linux.activate.nixos self.nixosConfigurations.${name};
109
+
path = deployPkgs.deploy-rs.lib.activate.nixos self.nixosConfigurations.${name};
92
110
};
93
111
};
94
112
in
···
97
115
98
116
deploy.nodes = lib.mapAttrs mkDeploy hosts;
99
117
100
-
packages.x86_64-linux = {
101
-
default = deploy-rs.packages.x86_64-linux.deploy-rs;
102
-
sops = nixpkgs.legacyPackages.x86_64-linux.sops;
118
+
packages.${system} = {
119
+
default = nixpkgs.legacyPackages.${system}.deploy-rs;
120
+
sops = nixpkgs.legacyPackages.${system}.sops;
103
121
};
104
122
105
123
checks = builtins.mapAttrs (system: deployLib: deployLib.deployChecks self.deploy) deploy-rs.lib;
+6
-2
modules/screego.nix
+6
-2
modules/screego.nix
···
9
9
SCREEGO_TURN_ADDRESS = "0.0.0.0:3478";
10
10
SCREEGO_EXTERNAL_IP = "dns:screen.goo.garden";
11
11
SCREEGO_TRUST_PROXY_HEADERS = "true";
12
-
SCREEGO_AUTH_MODE = "none";
12
+
SCREEGO_AUTH_MODE = "turn";
13
13
SCREEGO_SERVER_TLS = "false";
14
-
SCREEGO_TURN_PORT_RANGE = "50000:55000";
14
+
SCREEGO_TURN_PORT_RANGE = "52000:55000";
15
+
SCREEGO_USERS_FILE = config.sops.secrets.screego-users.path;
15
16
};
16
17
};
17
18
···
21
22
SCREEGO_SECRET=${config.sops.placeholder.screego-secret}
22
23
'';
23
24
sops.secrets.screego-secret = { };
25
+
sops.secrets.screego-users = {
26
+
mode = "0444";
27
+
};
24
28
}
+3
-2
secrets/secrets.yaml
+3
-2
secrets/secrets.yaml
···
18
18
rustical-oidc-client-id: ENC[AES256_GCM,data:dDA1SCH1/rOHqPNvoXX6GFRVE4zXhmq4EES2OnP0i6NK1WAI,iv:aZquya/FnGm3zXbvyxVvUfYRYN5yPvYtagfVYy4n1RU=,tag:w+usKIfoFqxacpIzFbMGpA==,type:str]
19
19
rustical-oidc-client-secret: ENC[AES256_GCM,data:savr1jjsi+cO6Rotx3zydTVl5qMiieOJ1Ue3+/IFBRQ=,iv:d3h/fuIfA2w3gnT0pCVSixaR1PbvfwwX/Pb3u+sDodc=,tag:YZgogP9Howbt2P7MVThegQ==,type:str]
20
20
screego-secret: ENC[AES256_GCM,data:25elrR88LTQFJz1T6Hj1qDwNnaFnAFxTKwiVZYxVQ66wGI70m22WCexOIVLsxz1xtSEgX0JGTVPSx7qU7ZE4yw==,iv:VV4PpBihmQRJ7CVMIL7jRIAQbwpW5/c6vJftUNp/9hM=,tag:stfLGZ8veoNChnei7U+2/A==,type:str]
21
+
screego-users: ENC[AES256_GCM,data:hoQPaoy3q+gY67IJRPg3MZdomx4I34hHP/aN3slMF+yC46gML7e1gkCrXWSeJYMlxKFAtYEQAh1ShwrBk0OEfow=,iv:f+aQ1qoOg254NqFInQfTGV0lCnLUwBNHZztW05YuahU=,tag:SvLRDnHcag4gDvnYSjZwqw==,type:str]
21
22
mumble-password: ENC[AES256_GCM,data:/GA5G4CEVQ==,iv:Ri70GW9Ln7vv3Nf0CSNW0PwypLUNvh+kvJjUqu393ig=,tag:NY+u/RxcKudlaZStgnGVTw==,type:str]
22
23
backup-repository: ENC[AES256_GCM,data:v6tUjTwVsym8i52jcapjSRXPIjX2xNFY+bZRkHnVsp4AebcksHzHEDX6N4BF3OuQ2KepOfHngMn61Mk=,iv:HPV+8aCPpvFnytja6RUA7hJdtz2BMI1zsH01w1J9r2w=,tag:znMIFmrcsKTIq2TowhAV0w==,type:str]
23
24
backup-identity: ENC[AES256_GCM,data:8TJP7vSWJAj56AcczQhMRoQqahxM4EGzPm+wk1apMD+L3pybXh/4LPp0DNcGugOb3RPTyjki6jZArDgiirS+ltbldaNQPZaZ4cFrtiJVt8D/iQlsgM9tR8oC7bcR4KV+UoVeeXJN0fWqy5U+IzJ87ZRKKyb9i8WKhPuWFIftb4KqZRyada7jhl/SzwuoIcw9BagMJPLv6BaUmNp1j5fOHvo7RseImiIqsbVo37NTqMMQf7PKM5gsMU6bbeAMjtdeC2RNVG21eop8JlO5uYVyjGxyl5wfU+PwMSRc+XNpgeVEv9mjdo6dkG3QC2poHZ77ot4py6HzQPUZjwLyFsr0ccC4e6e0PNOBtTPtku/LnXHsV45LB9Q3X7t9VSYCTtlJul2W8huZuCRnv7crvIUW21ZMTWiwMbqNEqDUJTBcPLDi42Ea4CvA+I6ODJP8n5g7GTHW0ggy6FtjVXH5DzhzJJULQ27kq97EWi43bSRv0N+N5C1viM+j+hs6tM5eQ15niRVB,iv:YpRoGlD8YFxZ+RChb6T4Eh665AMTTeTJXRFR0xa7l3k=,tag:FWOVonF+SYbbgQoopa2lhA==,type:str]
···
68
69
ajA5bDZCY1BnblVYRGQ1QTE2S2I4M2cKSIGmFBP6sqiiM+cvTMQuZHit9fN5Vffk
69
70
1pWz8xSen/tqoywqipRf3LqzFb2K7Bx15vwazHbm6LJJa+ZQaruVMg==
70
71
-----END AGE ENCRYPTED FILE-----
71
-
lastmodified: "2026-03-26T16:11:20Z"
72
-
mac: ENC[AES256_GCM,data:A1v72Mes2XAkrg7ETBLS7KeGyav/QF8K2iXo0MKitNfaUg6mlt85vPfUIoBqVZZf+Ds3xfmaEmvEYEqDTpoam+jsKBcfPi3kYSjc8KNJpblHvpw9q6VtxV1Ke8LYJ+NW+b5ewLmaUZhdFgKI7bCykmHDrocPeevoEe0Iv9qsRJ0=,iv:S/M7sPTWPwrXHIfsEoyRQ7RTU5zzG7+A8iIAmJweFlQ=,tag:Ax/Qs3YqrBBtGkg7VhiguQ==,type:str]
72
+
lastmodified: "2026-03-26T17:55:47Z"
73
+
mac: ENC[AES256_GCM,data:jxF/CaHhmr0X1OpseOOj/zIIcb0F/JzVZfplY7Lax4XIfT5Id6Vsve1SEPoR2VTYAqPjPIIxjfZOSihNkR4u15BI8FJjLvDSdJjJUzm3m8gmR46xLRIbX9QITAyyIuPrH75DNzJuq7tZS+Y182QPUC6ELHaTtTEH2A0a5mor+mg=,iv:bSK48upLzLrp4pXLV0X4XGtLHjzV7/H0JM3fBJJbwpE=,tag:gsvfIEzCclyyAD3Rg55c0A==,type:str]
73
74
unencrypted_suffix: _unencrypted
74
75
version: 3.12.2