🏡 my personal home lab
add fusion
+45
-2
+1
hosts/rk1-node-2.nix
+1
hosts/rk1-node-2.nix
+4
modules/caddy.nix
+4
modules/caddy.nix
···
41
41
42
42
vhost = extraConfig: {
43
43
inherit extraConfig;
44
+
# no logs on disk
44
45
logFormat = "output discard";
45
46
};
46
47
in
···
139
140
'';
140
141
"home.goo.garden" = vhost ''
141
142
reverse_proxy rk1-node-2:8123
143
+
'';
144
+
"rss.goo.garden" = vhost ''
145
+
reverse_proxy rk1-node-2:8080
142
146
'';
143
147
"knot.goo.garden" = vhost ''
144
148
reverse_proxy rk1-node-1:5555
+36
modules/fusion.nix
+36
modules/fusion.nix
···
1
+
{
2
+
config,
3
+
...
4
+
}:
5
+
{
6
+
virtualisation.oci-containers = {
7
+
backend = "podman";
8
+
containers = {
9
+
fusion = {
10
+
image = "ghcr.io/0x2e/fusion:latest";
11
+
ports = [ "8080:8080" ];
12
+
environmentFiles = [ config.sops.templates."fusion.env".path ];
13
+
volumes = [
14
+
"/var/lib/fusion:/data"
15
+
];
16
+
};
17
+
};
18
+
};
19
+
20
+
sops.templates."fusion.env".content = ''
21
+
FUSION_OIDC_ISSUER=https://id.goo.garden
22
+
FUSION_OIDC_CLIENT_ID=${config.sops.placeholder.fusion-oidc-client-id}
23
+
FUSION_OIDC_CLIENT_SECRET=${config.sops.placeholder.fusion-oidc-client-secret}
24
+
FUSION_OIDC_REDIRECT_URI=https://rss.goo.garden/api/oidc/callback
25
+
FUSION_TRUSTED_PROXIES=10.0.0.0/24,2a02:168:7353::/64
26
+
FUSION_ALLOW_EMPTY_PASSWORD=true
27
+
'';
28
+
sops.secrets.fusion-oidc-client-id = { };
29
+
sops.secrets.fusion-oidc-client-secret = { };
30
+
31
+
systemd.tmpfiles.rules = [
32
+
"d /var/lib/fusion 0750 root root -"
33
+
];
34
+
35
+
networking.firewall.allowedTCPPorts = [ 8080 ];
36
+
}
+4
-2
secrets/secrets.yaml
+4
-2
secrets/secrets.yaml
···
26
26
pds-jwt-secret: ENC[AES256_GCM,data:wjlsFmthpVGJqhX0hoYCi0fEXvXT/AU9tlMKaJsx8NEd8a/gSNbha9Iw53bZIylLvH6C5u6OGHgD67HanzJcMA==,iv:bkbnVlijTGXF5WQcOYl74SYFDJiZ2PMlyMsI5Em685k=,tag:QYVPajVhYl/f+/O7jrIHFA==,type:str]
27
27
pds-dpop-secret: ENC[AES256_GCM,data:6Z7WFE8ws4OI/golktA9QPRKRN3sA//Rlgv5kQQCS38NeLky2kVKUNd7h4DNYCpaBxtJ/EKrYdZxWISzUyO/rA==,iv:Y0Bt8RPt+8qkTdAVXF26EFolbMRrIxnDF4gXSXVUq1o=,tag:ckWfRpZc2OHO2AyZ3Plr8g==,type:str]
28
28
pds-master-key: ENC[AES256_GCM,data:jLDqeb5NHwy7CeWbaee4QA6P8QjAVzrNXUwtY4DPd2f5bFx02MTMGLlVXjqwWLcSyRnLDYzQqAhb7WCbRvInPQ==,iv:90D4Vs8+iIbPyvp62ntuX3BlL62euwLQB1DxAsAcewI=,tag:wrpby5KkdHHuF4tVR4A1Lw==,type:str]
29
+
fusion-oidc-client-id: ENC[AES256_GCM,data:6JJKTPi5nkroITCAIcjhPSeSOTGzf2ZIWq9zkOJlcQCK7rd7,iv:NMNgT5msJFT701JszhF9LtS24RDm74K4B/mRuIRIbMk=,tag:qwOq4QKyvO/3HtFrD9lkNw==,type:str]
30
+
fusion-oidc-client-secret: ENC[AES256_GCM,data:7VpmdfEGOVjmAlZHuQm549ZxbmEXFj1XAgWqTEungo8=,iv:N2It67esygSzGwO9tQrZlX4HW4V5o9x6kASovDFRF+g=,tag:kxkPxVZTUs776qmx8OGP6A==,type:str]
29
31
mumble-password: ENC[AES256_GCM,data:/GA5G4CEVQ==,iv:Ri70GW9Ln7vv3Nf0CSNW0PwypLUNvh+kvJjUqu393ig=,tag:NY+u/RxcKudlaZStgnGVTw==,type:str]
30
32
backup-repository: ENC[AES256_GCM,data:v6tUjTwVsym8i52jcapjSRXPIjX2xNFY+bZRkHnVsp4AebcksHzHEDX6N4BF3OuQ2KepOfHngMn61Mk=,iv:HPV+8aCPpvFnytja6RUA7hJdtz2BMI1zsH01w1J9r2w=,tag:znMIFmrcsKTIq2TowhAV0w==,type:str]
31
33
backup-identity: ENC[AES256_GCM,data:8TJP7vSWJAj56AcczQhMRoQqahxM4EGzPm+wk1apMD+L3pybXh/4LPp0DNcGugOb3RPTyjki6jZArDgiirS+ltbldaNQPZaZ4cFrtiJVt8D/iQlsgM9tR8oC7bcR4KV+UoVeeXJN0fWqy5U+IzJ87ZRKKyb9i8WKhPuWFIftb4KqZRyada7jhl/SzwuoIcw9BagMJPLv6BaUmNp1j5fOHvo7RseImiIqsbVo37NTqMMQf7PKM5gsMU6bbeAMjtdeC2RNVG21eop8JlO5uYVyjGxyl5wfU+PwMSRc+XNpgeVEv9mjdo6dkG3QC2poHZ77ot4py6HzQPUZjwLyFsr0ccC4e6e0PNOBtTPtku/LnXHsV45LB9Q3X7t9VSYCTtlJul2W8huZuCRnv7crvIUW21ZMTWiwMbqNEqDUJTBcPLDi42Ea4CvA+I6ODJP8n5g7GTHW0ggy6FtjVXH5DzhzJJULQ27kq97EWi43bSRv0N+N5C1viM+j+hs6tM5eQ15niRVB,iv:YpRoGlD8YFxZ+RChb6T4Eh665AMTTeTJXRFR0xa7l3k=,tag:FWOVonF+SYbbgQoopa2lhA==,type:str]
···
76
78
ajA5bDZCY1BnblVYRGQ1QTE2S2I4M2cKSIGmFBP6sqiiM+cvTMQuZHit9fN5Vffk
77
79
1pWz8xSen/tqoywqipRf3LqzFb2K7Bx15vwazHbm6LJJa+ZQaruVMg==
78
80
-----END AGE ENCRYPTED FILE-----
79
-
lastmodified: "2026-04-01T12:55:56Z"
80
-
mac: ENC[AES256_GCM,data:4loi+YgMHZ9Jbp7EyVCtma6kpJh83Rg3Eqg2CAuWSn4LtSXHoHsW+HCeSFZwYKMPDrxN/FMv+z6w27j636fUdYplNZtk0ibQWFBsHIKGLSdHAMR09VO9a5D0nf93MNhr8BMYD9o+xVHrF8cMofplPt7EJyhzcZLmwpmyVQKfeyQ=,iv:YctgEsAHWnpn6cgSN2DzzUbX4Mgy5ajewDx33tZxVvE=,tag:7qF1Lf2WRlB90DXP6jw+Zw==,type:str]
81
+
lastmodified: "2026-04-02T17:45:28Z"
82
+
mac: ENC[AES256_GCM,data:+woZIqYy3LZzpw+a7J/dR8PRAUja9kuqCUgqRgbN4MdnaauT8zBW77bxBIJk238+a04yhXiZS+StdPZdPbnM6Co5f1plmO6ONg6lCflnVDDDyAuUTow5NMnlNueldCbPuz6jFWc69nv4rytQhEgmDguG2UZczAewPh3oxHB73AU=,iv:WOzYfFIUpXpWtvnHl1/bNWcLOt3WcWXO85aaqkGIc98=,tag:NxZqeV94XSkCxdHTtHDItg==,type:str]
81
83
unencrypted_suffix: _unencrypted
82
84
version: 3.12.2