+1

hosts/cm4-node-2.nix

reviewed

··· 9 9 ../modules/tasks-md.nix 10 10 ../modules/rustical.nix 11 11 ../modules/screego.nix 12 12 + ../modules/ntfy.nix 12 13 ]; 13 14 14 15 system.stateVersion = "23.11";

+3

modules/caddy.nix

reviewed

··· 178 178 reverse_proxy rk1-node-1:3909 179 179 } 180 180 ''; 181 181 + "ntfy.goo.garden" = vhost '' 182 182 + reverse_proxy cm4-node-2:2586 183 183 + ''; 181 184 "probe.outerwilds.space" = vhost '' 182 185 reverse_proxy cm4-node-2:3001 183 186 '';

+21

modules/ntfy.nix

reviewed

··· 1 1 + { config, ... }: 2 2 + { 3 3 + services.ntfy-sh = { 4 4 + enable = true; 5 5 + environmentFile = config.sops.templates."ntfy.env".path; 6 6 + settings = { 7 7 + listen-http = ":2586"; 8 8 + base-url = "https://ntfy.goo.garden"; 9 9 + behind-proxy = true; 10 10 + auth-file = "/var/lib/ntfy-sh/user.db"; 11 11 + auth-default-access = "deny-all"; 12 12 + }; 13 13 + }; 14 14 + 15 15 + sops.templates."ntfy.env".content = '' 16 16 + NTFY_AUTH_USERS=${config.sops.placeholder.ntfy-auth-users} 17 17 + ''; 18 18 + sops.secrets.ntfy-auth-users = { }; 19 19 + 20 20 + networking.firewall.allowedTCPPorts = [ 2586 ]; 21 21 + }

+3 -2

secrets/secrets.yaml

reviewed

··· 45 45 cardian-token: ENC[AES256_GCM,data:yA/Bx36ljsPr6PCcxox4rvUVJyXukwcm1qP/1qecYYDBhobmpbQCRvjh3OQKnHSfZqna6te24lcAzhmU6AmfsJpaLcI9Kg==,iv:njXyuhrEY4BbtYl8HFpx2/YBOmBOpGzyBpfn0On0A2A=,tag:rrcs3lG3AteQFzk0pScEiQ==,type:str] 46 46 cardian-bonk-url: ENC[AES256_GCM,data:NM0ECFLnIcU3g29zPDlmdUgbHVt8jpE8ZHb1R3dBF+xoVJb73nNu0IdSp/kAkJC8yguLsBei0dWAHRqL1UaOqwbDlbGnZA==,iv:O+/Z2RYBWyg1ehsZWRLtadF8iFE6vb7caSCMJySWpmY=,tag:Zye0Wk0dQsy5IcSuE2GB5Q==,type:str] 47 47 cardian-sentry-url: ENC[AES256_GCM,data:rBHw0gs8hOE5lU6B2QoU8CUF/hWyBC4pKA8gXqX1hjyDoDOzEh0GGEB2BaDdQ+BphLR6kSBZPe1QTc1ZnSUiZIK5RAC2Q6GK3xBUUgyrBTILrcNQOpt+pXAxjtQ=,iv:1WKvXbbVexG8KxtLkWjn6VwnUvDr64sgaFG3f2bVgZ8=,tag:jrkn7mb6rUiwh98Ic/3iSg==,type:str] 48 48 + ntfy-auth-users: ENC[AES256_GCM,data:0BDtabnXuVbBeYdqGQmydocmZeHpg2Bc36AskoMb7crpxB+XWEKzQnHlqWNB4zoVAe5YQSbeWoqtgxHGJdHKxHUWj3uG3w==,iv:LXfj/LDbMcqvMfpbJnX6obLEUrO7UYaBDNS77OVijUo=,tag:KU9VEk58h1rG2MyjDFJQYA==,type:str] 48 49 mumble-password: ENC[AES256_GCM,data:/GA5G4CEVQ==,iv:Ri70GW9Ln7vv3Nf0CSNW0PwypLUNvh+kvJjUqu393ig=,tag:NY+u/RxcKudlaZStgnGVTw==,type:str] 49 50 backup-repository: ENC[AES256_GCM,data:v6tUjTwVsym8i52jcapjSRXPIjX2xNFY+bZRkHnVsp4AebcksHzHEDX6N4BF3OuQ2KepOfHngMn61Mk=,iv:HPV+8aCPpvFnytja6RUA7hJdtz2BMI1zsH01w1J9r2w=,tag:znMIFmrcsKTIq2TowhAV0w==,type:str] 50 51 backup-identity: ENC[AES256_GCM,data:8TJP7vSWJAj56AcczQhMRoQqahxM4EGzPm+wk1apMD+L3pybXh/4LPp0DNcGugOb3RPTyjki6jZArDgiirS+ltbldaNQPZaZ4cFrtiJVt8D/iQlsgM9tR8oC7bcR4KV+UoVeeXJN0fWqy5U+IzJ87ZRKKyb9i8WKhPuWFIftb4KqZRyada7jhl/SzwuoIcw9BagMJPLv6BaUmNp1j5fOHvo7RseImiIqsbVo37NTqMMQf7PKM5gsMU6bbeAMjtdeC2RNVG21eop8JlO5uYVyjGxyl5wfU+PwMSRc+XNpgeVEv9mjdo6dkG3QC2poHZ77ot4py6HzQPUZjwLyFsr0ccC4e6e0PNOBtTPtku/LnXHsV45LB9Q3X7t9VSYCTtlJul2W8huZuCRnv7crvIUW21ZMTWiwMbqNEqDUJTBcPLDi42Ea4CvA+I6ODJP8n5g7GTHW0ggy6FtjVXH5DzhzJJULQ27kq97EWi43bSRv0N+N5C1viM+j+hs6tM5eQ15niRVB,iv:YpRoGlD8YFxZ+RChb6T4Eh665AMTTeTJXRFR0xa7l3k=,tag:FWOVonF+SYbbgQoopa2lhA==,type:str] ··· 95 96 ajA5bDZCY1BnblVYRGQ1QTE2S2I4M2cKSIGmFBP6sqiiM+cvTMQuZHit9fN5Vffk 96 97 1pWz8xSen/tqoywqipRf3LqzFb2K7Bx15vwazHbm6LJJa+ZQaruVMg== 97 98 -----END AGE ENCRYPTED FILE----- 98 98 - lastmodified: "2026-04-13T13:29:23Z" 99 99 - mac: ENC[AES256_GCM,data:Ljpbrtr14XFA1ZJQLn9pXEwqREOKoVntPSflqfdguCwsIgx5dDAL/q/c+Uj3i3jZCAPQOmtCPRueGkwP+lWhRXUUOpQYHXW7n8yHs6VqUTbHBHCJVgKq6ppX8Rb7W3GjuiiUMw1869SIJ9bjKsGk2nOypoAoC5mqC04wd0yR9+w=,iv:yGJqbJb6D4/qst+LrrN1vMV3T8qdauYCejP1FU4HSeE=,tag:j3gkCkdvFyjICDILh+ZRBw==,type:str] 99 99 + lastmodified: "2026-04-16T19:37:29Z" 100 100 + mac: ENC[AES256_GCM,data:++EY/RF5dwbBF54rkxt1ZOp6EyVij1xmnboVnrXzaPrnMS+fpd8DbC06Z2O6weDBSu0Elki57nTUYlm9e9OSMzioI3HKVYdsu4kw6Q+q9hQx7XbB1I8KPyN2aLMMVmqzp8pA2lEW2Pjso03v0loojz+WKFON8NiZj1sc+tAVjMM=,iv:VFUKbik3vIWkV9eiFHVGQCLA8ZT+2tTDF/Jg02wQqHM=,tag:GG6Pi5tpzMMbtb/Nqhvu/w==,type:str] 100 101 unencrypted_suffix: _unencrypted 101 102 version: 3.12.2