+1

hosts/rk1-node-1.nix

reviewed

··· 9 9 ../modules/tangled-knot.nix 10 10 ../modules/tangled-spindle.nix 11 11 ../modules/garage.nix 12 12 + ../modules/cardian.nix 12 13 ]; 13 14 14 15 system.stateVersion = "25.11";

+23

modules/cardian.nix

reviewed

··· 1 1 + { config, ... }: 2 2 + { 3 3 + virtualisation.oci-containers.containers.cardian = { 4 4 + image = "ghcr.io/okkdev/cardian:7.4.6"; 5 5 + environmentFiles = [ config.sops.templates."cardian.env".path ]; 6 6 + volumes = [ 7 7 + "/var/lib/cardian:/db" 8 8 + ]; 9 9 + }; 10 10 + 11 11 + sops.templates."cardian.env".content = '' 12 12 + CARDIAN_TOKEN=${config.sops.placeholder.cardian-token} 13 13 + BONK_URL=${config.sops.placeholder.cardian-bonk-url} 14 14 + SENTRY_URL=${config.sops.placeholder.cardian-sentry-url} 15 15 + ''; 16 16 + sops.secrets.cardian-token = { }; 17 17 + sops.secrets.cardian-bonk-url = { }; 18 18 + sops.secrets.cardian-sentry-url = { }; 19 19 + 20 20 + systemd.tmpfiles.rules = [ 21 21 + "d /var/lib/cardian 0750 root root -" 22 22 + ]; 23 23 + }

+5 -2

secrets/secrets.yaml

reviewed

··· 42 42 vaultwarden-admin-token: ENC[AES256_GCM,data:sm4B+1koFQSwkjOx1ub+vh9msg0ktdyjrIWKqPwQD3Nz1TNFq6ZZJsqJ1ZbzlosL+FJFRpJqKIxH1fCqU9siChvAf5U2XSisPq1qwwaPnqinEySULTlRNaul1PAzf4T9to3/q6As72ZSREGxT88u722bEc3LlA==,iv:+H9n1e9bsuB2rqDeaT6G3RW7aze84tnU3ljCL+x2t0U=,tag:5N+GE/l/GmEqCRtEf0mNeg==,type:str] 43 43 vaultwarden-oidc-client-id: ENC[AES256_GCM,data:qC+/znFvYK7+k1XAZ5PMrCah5NvQRVFJOokPqVXDiDLolMmc,iv:IS5V7XvpyB6+fs9plNliDUkwUJ8o9J8EExa2/rEZjf4=,tag:H2hc2UYsnRvw/ZxpPi62hg==,type:str] 44 44 vaultwarden-oidc-client-secret: ENC[AES256_GCM,data:8768G1aahatoGO/p93uze0p+bH/qh5dSv0Fmoyk+fRM=,iv:Aa6TLX2+P+v68Lt15Lbln1Y/m+Cd52BB5O6rstNpOys=,tag:B1B2Srp51kYGDXZnPCuxhQ==,type:str] 45 45 + cardian-token: ENC[AES256_GCM,data:yA/Bx36ljsPr6PCcxox4rvUVJyXukwcm1qP/1qecYYDBhobmpbQCRvjh3OQKnHSfZqna6te24lcAzhmU6AmfsJpaLcI9Kg==,iv:njXyuhrEY4BbtYl8HFpx2/YBOmBOpGzyBpfn0On0A2A=,tag:rrcs3lG3AteQFzk0pScEiQ==,type:str] 46 46 + cardian-bonk-url: ENC[AES256_GCM,data:NM0ECFLnIcU3g29zPDlmdUgbHVt8jpE8ZHb1R3dBF+xoVJb73nNu0IdSp/kAkJC8yguLsBei0dWAHRqL1UaOqwbDlbGnZA==,iv:O+/Z2RYBWyg1ehsZWRLtadF8iFE6vb7caSCMJySWpmY=,tag:Zye0Wk0dQsy5IcSuE2GB5Q==,type:str] 47 47 + cardian-sentry-url: ENC[AES256_GCM,data:rBHw0gs8hOE5lU6B2QoU8CUF/hWyBC4pKA8gXqX1hjyDoDOzEh0GGEB2BaDdQ+BphLR6kSBZPe1QTc1ZnSUiZIK5RAC2Q6GK3xBUUgyrBTILrcNQOpt+pXAxjtQ=,iv:1WKvXbbVexG8KxtLkWjn6VwnUvDr64sgaFG3f2bVgZ8=,tag:jrkn7mb6rUiwh98Ic/3iSg==,type:str] 45 48 mumble-password: ENC[AES256_GCM,data:/GA5G4CEVQ==,iv:Ri70GW9Ln7vv3Nf0CSNW0PwypLUNvh+kvJjUqu393ig=,tag:NY+u/RxcKudlaZStgnGVTw==,type:str] 46 49 backup-repository: ENC[AES256_GCM,data:v6tUjTwVsym8i52jcapjSRXPIjX2xNFY+bZRkHnVsp4AebcksHzHEDX6N4BF3OuQ2KepOfHngMn61Mk=,iv:HPV+8aCPpvFnytja6RUA7hJdtz2BMI1zsH01w1J9r2w=,tag:znMIFmrcsKTIq2TowhAV0w==,type:str] 47 50 backup-identity: ENC[AES256_GCM,data:8TJP7vSWJAj56AcczQhMRoQqahxM4EGzPm+wk1apMD+L3pybXh/4LPp0DNcGugOb3RPTyjki6jZArDgiirS+ltbldaNQPZaZ4cFrtiJVt8D/iQlsgM9tR8oC7bcR4KV+UoVeeXJN0fWqy5U+IzJ87ZRKKyb9i8WKhPuWFIftb4KqZRyada7jhl/SzwuoIcw9BagMJPLv6BaUmNp1j5fOHvo7RseImiIqsbVo37NTqMMQf7PKM5gsMU6bbeAMjtdeC2RNVG21eop8JlO5uYVyjGxyl5wfU+PwMSRc+XNpgeVEv9mjdo6dkG3QC2poHZ77ot4py6HzQPUZjwLyFsr0ccC4e6e0PNOBtTPtku/LnXHsV45LB9Q3X7t9VSYCTtlJul2W8huZuCRnv7crvIUW21ZMTWiwMbqNEqDUJTBcPLDi42Ea4CvA+I6ODJP8n5g7GTHW0ggy6FtjVXH5DzhzJJULQ27kq97EWi43bSRv0N+N5C1viM+j+hs6tM5eQ15niRVB,iv:YpRoGlD8YFxZ+RChb6T4Eh665AMTTeTJXRFR0xa7l3k=,tag:FWOVonF+SYbbgQoopa2lhA==,type:str] ··· 92 95 ajA5bDZCY1BnblVYRGQ1QTE2S2I4M2cKSIGmFBP6sqiiM+cvTMQuZHit9fN5Vffk 93 96 1pWz8xSen/tqoywqipRf3LqzFb2K7Bx15vwazHbm6LJJa+ZQaruVMg== 94 97 -----END AGE ENCRYPTED FILE----- 95 95 - lastmodified: "2026-04-07T22:18:18Z" 96 96 - mac: ENC[AES256_GCM,data:eHfEGx5iWl4DJNFbtRpkJFEY/C0arAgQIZADl9a326KSYHX6NRmKkdsMLRbyuGYppatusNMdCkv/YlbKzHF1ljKXYp18EPwINRPwzO/XQKiFGs+vflT6/BvfHiZLhuqvthpmcXq1yXzbOfzubUIQAWBolO9AQdizzRgepQwoKu8=,iv:jRMHiagNb/N7g+54TOrzms5z1vZNMDiLnGvQwcXctM8=,tag:HqA5Qy2yqO6HDxZZlmPFww==,type:str] 98 98 + lastmodified: "2026-04-13T13:29:23Z" 99 99 + mac: ENC[AES256_GCM,data:Ljpbrtr14XFA1ZJQLn9pXEwqREOKoVntPSflqfdguCwsIgx5dDAL/q/c+Uj3i3jZCAPQOmtCPRueGkwP+lWhRXUUOpQYHXW7n8yHs6VqUTbHBHCJVgKq6ppX8Rb7W3GjuiiUMw1869SIJ9bjKsGk2nOypoAoC5mqC04wd0yR9+w=,iv:yGJqbJb6D4/qst+LrrN1vMV3T8qdauYCejP1FU4HSeE=,tag:j3gkCkdvFyjICDILh+ZRBw==,type:str] 97 100 unencrypted_suffix: _unencrypted 98 101 version: 3.12.2