From b4327b27403ac1535d93a1674c9f6604573ea501 Mon Sep 17 00:00:00 2001 From: DerGrumpf Date: Wed, 6 May 2026 12:43:02 +0200 Subject: [PATCH] WIP: Unfree problems --- flake.lock | 120 ++++++------- flake.nix | 2 + home/default.nix | 6 +- home/neovim/default.nix | 7 +- nixos/roles/matrix/clients.nix | 175 +++++++++++++++++++ nixos/roles/matrix/default.nix | 26 +-- nixos/roles/matrix/livekit.nix | 22 ++- nixos/roles/matrix/lk-jwt.nix | 28 +-- nixos/roles/matrix/synapse.nix | 91 +++++++--- nixos/roles/nginx.nix | 303 +-------------------------------- secrets/secrets.yaml | 7 +- 11 files changed, 348 insertions(+), 439 deletions(-) create mode 100644 nixos/roles/matrix/clients.nix diff --git a/flake.lock b/flake.lock index 3605138..3ba6cfd 100644 --- a/flake.lock +++ b/flake.lock @@ -20,11 +20,11 @@ ] }, "locked": { - "lastModified": 1776876344, - "narHash": "sha256-Ubqb/agkuMJK+k19gjQgHux/eOYRc1sRGoOZOho8+VY=", + "lastModified": 1777499565, + "narHash": "sha256-nU55VWk99Pn1QzQDDjFISocC4SgDZ3Xp+zb6ji3JclM=", "owner": "hyprwm", "repo": "aquamarine", - "rev": "648a13d0ee1e03a843b3e145b8ece15393058701", + "rev": "813c1e8981893c11e118b19c125d6bc282f51765", "type": "github" }, "original": { @@ -57,11 +57,11 @@ ] }, "locked": { - "lastModified": 1777024856, - "narHash": "sha256-OQ+yIcRMXo4UaHyX+W5DCgBvJ5dZo/3kFGWPJiuR6x8=", + "lastModified": 1777734189, + "narHash": "sha256-kbIhdhDPaTP6gxAPkcRYeB+cqPFDpTM/bnw+m+26vkI=", "owner": "catppuccin", "repo": "nix", - "rev": "f41cc1cf13647e482b7317396f749840ef715e16", + "rev": "e68cf5deaf1a7afed2e548835dba2ae99f5a3ccb", "type": "github" }, "original": { @@ -77,11 +77,11 @@ ] }, "locked": { - "lastModified": 1775037210, - "narHash": "sha256-KM2WYj6EA7M/FVZVCl3rqWY+TFV5QzSyyGE2gQxeODU=", + "lastModified": 1777780666, + "narHash": "sha256-8wURyQMdDkGUarSTKOGdCuFfYiwa3HbzwscUfn3STDE=", "owner": "lnl7", "repo": "nix-darwin", - "rev": "06648f4902343228ce2de79f291dd5a58ee12146", + "rev": "8c62fba0854ba15c8917aed18894dbccb48a3777", "type": "github" }, "original": { @@ -125,11 +125,11 @@ "nixpkgs-lib": "nixpkgs-lib" }, "locked": { - "lastModified": 1775087534, - "narHash": "sha256-91qqW8lhL7TLwgQWijoGBbiD4t7/q75KTi8NxjVmSmA=", + "lastModified": 1777678872, + "narHash": "sha256-EPIFsulyon7Z1vLQq5Fk64GR8L7cQsT+IPhcsukVbgk=", "owner": "hercules-ci", "repo": "flake-parts", - "rev": "3107b77cd68437b9a76194f0f7f9c55f2329ca5b", + "rev": "5250617bffd85403b14dbf43c3870e7f255d2c16", "type": "github" }, "original": { @@ -146,11 +146,11 @@ ] }, "locked": { - "lastModified": 1775087534, - "narHash": "sha256-91qqW8lhL7TLwgQWijoGBbiD4t7/q75KTi8NxjVmSmA=", + "lastModified": 1777932387, + "narHash": "sha256-nUYVPiqrzr36ThiQOAr5MKeGHDBSDM3OFWkz0uDjOvc=", "owner": "hercules-ci", "repo": "flake-parts", - "rev": "3107b77cd68437b9a76194f0f7f9c55f2329ca5b", + "rev": "71a3a77326609675e9f8b51084cf23d5d1945899", "type": "github" }, "original": { @@ -188,11 +188,11 @@ ] }, "locked": { - "lastModified": 1777258755, - "narHash": "sha256-EC07KwADRE2LdIk7vEDyAaD3I0ZUq24T9jQF9L0iEPk=", + "lastModified": 1778009629, + "narHash": "sha256-nUoQtf4Zq7DRYJrfv904hjrxjAlWVP6a1pNNFKx3FCg=", "owner": "nix-community", "repo": "home-manager", - "rev": "7f8bbc93d63401e41368d6ddc46a4f631610fa90", + "rev": "00ed86e58bb6979a7921859fd1615d19382eac5c", "type": "github" }, "original": { @@ -301,11 +301,11 @@ "xdph": "xdph" }, "locked": { - "lastModified": 1777248628, - "narHash": "sha256-3RoogdcCOknnzMCNw4MxQBHlAL0qXZw/Jk1fN4Hm8jE=", + "lastModified": 1777995176, + "narHash": "sha256-iq9W7sFoKFNFt0UAxRnnLVkbvNT+nJWsZQFNcWh/fCU=", "owner": "hyprwm", "repo": "Hyprland", - "rev": "80763b13ff9b8abb94654d9f5ca635003c0b5d84", + "rev": "a531c2ed6bb4cd4eb2c6cb51838cb07a37226377", "type": "github" }, "original": { @@ -377,11 +377,11 @@ ] }, "locked": { - "lastModified": 1777220105, - "narHash": "sha256-M9JZK+8GVKAIVdQpcCG/49zBF3ylxO8zxW+hVjM5QpE=", + "lastModified": 1777937752, + "narHash": "sha256-QDc78DC6xhWKpPJzsPEJBBFYpTb+g4kO6+ydRYLU4f4=", "owner": "hyprwm", "repo": "hyprland-plugins", - "rev": "dbe221941a5095e1b381ac460a152cf173b108b8", + "rev": "b6e080577daf6575b95e6733dd2e2aef714bcf10", "type": "github" }, "original": { @@ -457,11 +457,11 @@ ] }, "locked": { - "lastModified": 1776426736, - "narHash": "sha256-rl7i4aY+9p8LysJp7o8uRWahCkpFznCgGHXszlTw7b0=", + "lastModified": 1777320127, + "narHash": "sha256-Qu+Wf2Bp5qUjyn2YpZNq8a7JyzTGowhT1knrwE38a9U=", "owner": "hyprwm", "repo": "hyprlang", - "rev": "7833ff33b2e82d3406337b5dcf0d1cec595d83e9", + "rev": "090117506ddc3d7f26e650ff344d378c2ec329cc", "type": "github" }, "original": { @@ -561,11 +561,11 @@ ] }, "locked": { - "lastModified": 1777148223, - "narHash": "sha256-PTf7kRFFzCW6rIYxLH2fWfVJmj86FSYe3k6L8B+IM9o=", + "lastModified": 1777492286, + "narHash": "sha256-PwuoEJQcjSKJNP5T55qhfDwIP0tw5zxEhfu8GDfKfeg=", "owner": "hyprwm", "repo": "hyprutils", - "rev": "fa3992be2dfebe4ab06d753c6ca59bea298e798f", + "rev": "ec5c0c709706bad5b82f667fd8758eae442577ce", "type": "github" }, "original": { @@ -586,11 +586,11 @@ ] }, "locked": { - "lastModified": 1777148232, - "narHash": "sha256-Uv0WZLhu89SafuSOmYDA7akrPt4wBRmsa1ucasO5aXg=", + "lastModified": 1777159683, + "narHash": "sha256-Jxixw6wZphUp+nHYxOKUYSckL17QMBx2d5Zp0rJHr1g=", "owner": "hyprwm", "repo": "hyprwayland-scanner", - "rev": "fec9cf1abcc1011e46f0a0986f46bf93c6bf8b92", + "rev": "b8632713a6beaf28b56f2a7b0ab2fb7088dbb404", "type": "github" }, "original": { @@ -615,11 +615,11 @@ ] }, "locked": { - "lastModified": 1776728575, - "narHash": "sha256-z9eGphrArEBpl1O/GCH0wlY6z4K9vA6yWh2gAS6qytU=", + "lastModified": 1777388329, + "narHash": "sha256-40YxVGF2rA9iH3D7am5fy4EOSBbMgpJtJ9yhl0Cx+qI=", "owner": "hyprwm", "repo": "hyprwire", - "rev": "f3a80888783702a39691b684d099e16b83ed4702", + "rev": "04be2897e05f9b271d532b5ae56ca088d2eeac02", "type": "github" }, "original": { @@ -656,11 +656,11 @@ "nixpkgs-nixcord": "nixpkgs-nixcord" }, "locked": { - "lastModified": 1777280836, - "narHash": "sha256-rID/Tj1mZLoJsATAmN+YtmPCFAafXxq+gEP1EkPWtpY=", + "lastModified": 1778058822, + "narHash": "sha256-iWK6mx+b9UeIrLCRC3tQMluI9TU093Q/q78/8LW7IHk=", "owner": "kaylorben", "repo": "nixcord", - "rev": "93fac7ee93c449e94beac2750983a5fcf7785493", + "rev": "a88a9e39026c8456c9cbb130a794a37c358ef07d", "type": "github" }, "original": { @@ -707,11 +707,11 @@ }, "nixpkgs": { "locked": { - "lastModified": 1776877367, - "narHash": "sha256-EHq1/OX139R1RvBzOJ0aMRT3xnWyqtHBRUBuO1gFzjI=", + "lastModified": 1777954456, + "narHash": "sha256-hGdgeU2Nk87RAuZyYjyDjFL6LK7dAZN5RE9+hrDTkDU=", "owner": "nixos", "repo": "nixpkgs", - "rev": "0726a0ecb6d4e08f6adced58726b95db924cef57", + "rev": "549bd84d6279f9852cae6225e372cc67fb91a4c1", "type": "github" }, "original": { @@ -723,11 +723,11 @@ }, "nixpkgs-lib": { "locked": { - "lastModified": 1774748309, - "narHash": "sha256-+U7gF3qxzwD5TZuANzZPeJTZRHS29OFQgkQ2kiTJBIQ=", + "lastModified": 1777168982, + "narHash": "sha256-GOkGPcboWE9BmGCRMLX3worL4EMnsnG8MyKmXNeYuhQ=", "owner": "nix-community", "repo": "nixpkgs.lib", - "rev": "333c4e0545a6da976206c74db8773a1645b5870a", + "rev": "f5901329dade4a6ea039af1433fb087bd9c1fe14", "type": "github" }, "original": { @@ -738,11 +738,11 @@ }, "nixpkgs-nixcord": { "locked": { - "lastModified": 1776734388, - "narHash": "sha256-vl3dkhlE5gzsItuHoEMVe+DlonsK+0836LIRDnm6MXQ=", + "lastModified": 1777428379, + "narHash": "sha256-ypxFOeDz+CqADEQNL72haqGjvZQdBR5Vc7pyx2JDttI=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "10e7ad5bbcb421fe07e3a4ad53a634b0cd57ffac", + "rev": "755f5aa91337890c432639c60b6064bb7fe67769", "type": "github" }, "original": { @@ -761,11 +761,11 @@ "systems": "systems_3" }, "locked": { - "lastModified": 1777236345, - "narHash": "sha256-ALOqlq7bE30lsX4rA76hXeQ2aLLEpb44hS+D1+jWS88=", + "lastModified": 1777991353, + "narHash": "sha256-DFwjggMV+nzCZpwK6Obxj9F+P59rbLVowGqHETfctBk=", "owner": "nix-community", "repo": "nixvim", - "rev": "a67d9cd6ff725a763afe88727aac73208ded3bf4", + "rev": "7986a276960b4dfaed9bb2c3c438b5ba71ae08f1", "type": "github" }, "original": { @@ -821,11 +821,11 @@ ] }, "locked": { - "lastModified": 1776771786, - "narHash": "sha256-DRFGPfFV6hbrfO9a1PH1FkCi7qR5FgjSqsQGGvk1rdI=", + "lastModified": 1777944972, + "narHash": "sha256-VfGRo1qTBKOe3s2gOv8LSoA6Fk19PvBlwQ1ECN0Evn8=", "owner": "Mic92", "repo": "sops-nix", - "rev": "bef289e2248991f7afeb95965c82fbcd8ff72598", + "rev": "c591bf665727040c6cc5cb409079acb22dcce33c", "type": "github" }, "original": { @@ -842,11 +842,11 @@ "systems": "systems_4" }, "locked": { - "lastModified": 1777183994, - "narHash": "sha256-zahis/vVFOsWv/HeyHbU13jxnrCC+ppIg49xG+viWxg=", + "lastModified": 1777789800, + "narHash": "sha256-XHCvLGu/bEEZRzXVKFu1i+2YB102Nr00n8e7xrzsfVs=", "owner": "Gerg-L", "repo": "spicetify-nix", - "rev": "501256c3e670ca1679501ce3839ea805df00d8ba", + "rev": "d0e921cc48aab6137d203a3eab19601dc2bdc0c3", "type": "github" }, "original": { @@ -943,11 +943,11 @@ ] }, "locked": { - "lastModified": 1777035886, - "narHash": "sha256-m1TNuBoSXUBSKhD9UVMkU90M0wFTPTfvIOOltO8IM8A=", + "lastModified": 1777585783, + "narHash": "sha256-JTeWRy42VElroJ0rVdZuVXSoTLsx+NzQfGPKMbtn3SU=", "owner": "hyprwm", "repo": "xdg-desktop-portal-hyprland", - "rev": "ecfcdcc781f48821d83e1e2a0e30d7beca0eeb5e", + "rev": "fa50d6fbaff8f42c61071b87b034a90d82a33558", "type": "github" }, "original": { diff --git a/flake.nix b/flake.nix index e7e5033..be3e29e 100644 --- a/flake.nix +++ b/flake.nix @@ -121,6 +121,8 @@ extraSpecialArgs = sharedSpecialArgs; users.${primaryUser} = import ./home; backupFileExtension = "backup"; + useGlobalPkgs = true; + useUserPackages = true; }; } ]; diff --git a/home/default.nix b/home/default.nix index 5bb48f9..fa0cfd6 100644 --- a/home/default.nix +++ b/home/default.nix @@ -35,7 +35,11 @@ ]; nixpkgs.config.allowUnfree = true; - + nixpkgs.config.allowUnfreePredicate = + pkg: + builtins.elem (lib.getName pkg) [ + "wezterm.nvim" + ]; home = { username = primaryUser; stateVersion = "26.05"; diff --git a/home/neovim/default.nix b/home/neovim/default.nix index f20bf93..0ea8afe 100644 --- a/home/neovim/default.nix +++ b/home/neovim/default.nix @@ -1,4 +1,5 @@ -{ pkgs, inputs, ... }: { +{ pkgs, inputs, ... }: +{ imports = [ inputs.nixvim.homeModules.nixvim ./treesitter.nix @@ -11,8 +12,8 @@ ./telescope.nix ./catppuccin.nix ./alpha.nix - ./avante.nix - ./openscad.nix + #./avante.nix + #./openscad.nix ./molten.nix ./which-key.nix ]; diff --git a/nixos/roles/matrix/clients.nix b/nixos/roles/matrix/clients.nix new file mode 100644 index 0000000..a7ff4c7 --- /dev/null +++ b/nixos/roles/matrix/clients.nix @@ -0,0 +1,175 @@ +{ pkgs, lib, ... }: +let + flavours = [ + { + name = "Latte"; + slug = "latte"; + is_dark = false; + } + { + name = "Frappé"; + slug = "frappe"; + is_dark = true; + } + { + name = "Macchiato"; + slug = "macchiato"; + is_dark = true; + } + { + name = "Mocha"; + slug = "mocha"; + is_dark = true; + } + ]; + accents = [ + "rosewater" + "flamingo" + "pink" + "mauve" + "red" + "maroon" + "peach" + "yellow" + "green" + "teal" + "sky" + "sapphire" + "blue" + "lavender" + ]; + themeHashes = { + "latte/rosewater" = "0l1m4bhaxdam07rfqag6pjbzhdpyi5w3i14vp6rq7aj59pildw3a"; + "latte/flamingo" = "1m8hh2l87xv2rfgpnnl5vzddmam0n82h25fwadb37blgab08vhsr"; + "latte/pink" = "0ambrc42mvg0vdspfmnl31ka1nsxpdyv1p3nh045822y02q20wwh"; + "latte/mauve" = "1nnn2w6nsr24a45jy497c2vhi8v64bwg99fj2dyhpfsn89c63lhn"; + "latte/red" = "14lmw4c4llfz6zqvfymkc6k3msxcml2gwq9rhwsixdpc5mjjbn8n"; + "latte/maroon" = "0ydpng9451mpn7hv5ag1ck8hryx8pdvrml3zksvzm2fiwzzjkpcf"; + "latte/peach" = "1fn5804wv9z9iv65ikyv015b01a7c546rsaaks2a2sq2c37n75l0"; + "latte/yellow" = "0hzgiyhqmwgp3h3v1y23sx3x5qp712sw106472lbnxbywqlavcza"; + "latte/green" = "194kxv6d9hc4nixy16hy9nvf32qs3v214nr2r2qf2z9l89rk5pnp"; + "latte/teal" = "12n25d38zpqxsskglymhmza972klg2hj3c23v2nb3jfj82llw6v4"; + "latte/sky" = "0yghds3xpmbhkbcj2jkh8df82j6vrn9q1z0s2129nca7l5g5f9w2"; + "latte/sapphire" = "18dl1srxp3xccvvy56za6kp05n68d918l0wrxga11746g9sib7r3"; + "latte/blue" = "1zv9nap21d80flvd1jwmjph05jgykxngv5kqbhk95mvqh962ygnf"; + "latte/lavender" = "03j4fwbscip1qm6px1qxkha0c5csq2wwvzg9vwjkc2ja48v1mp9k"; + "frappe/rosewater" = "032qbgj32mvgpankl9777x2lxk18451kglsxg5215k8zrwcg9y95"; + "frappe/flamingo" = "1grhgynn8q7isv18981km5k8ll72ihsjw2ciy8widl6wikv29j8p"; + "frappe/pink" = "0h33g721bph8ihd6lmbc7szxy4dq85ng1cgg5cxjb5y2m7wpdbsy"; + "frappe/mauve" = "121jmznc9q3p7crsy9p2khw8xnzvz4lxms26g1h5wqa67wqvalc4"; + "frappe/red" = "07wm4h1giyy6a5nlh0d3qdarfsp6ikyr5nmg94n13lj4q03d0cn0"; + "frappe/maroon" = "08vg70nr918n4ffi1wnbba4xrx5ak5vfgq7m5ik0rpkb2wdb4x6k"; + "frappe/peach" = "1cg753w2dxs0sx97d8y0g62s8aw3w6b9hrll0lsrw3bc1bvm23fl"; + "frappe/yellow" = "0g43g2if1pcm25i261zfw43bawqqdlgg2f6q2bqhyqvafk9yb3dy"; + "frappe/green" = "1n71mndzds3zldb271g8hdw1yn29s68svzvh8ckjcsz4sb9h1i74"; + "frappe/teal" = "0b6m9cibfwf8csh1pk5i76xi3wx3v2aqwgffzsidw8nwc7c1a3wk"; + "frappe/sky" = "1l4d44399ixshlc9fdsx7iqwxm6kdkp6k4z3z6bdyyx6adw3z4q5"; + "frappe/sapphire" = "03fa9rnclvs5ljd0lzz15vnkzpqpbrhfppg3zwfchs9fvak0n3ni"; + "frappe/blue" = "0r4jjn3pab77w1aanlv3143ch60400q44mdzaqmcjbcr6l2knmjh"; + "frappe/lavender" = "1mrkaz72w6j9hh4dpxwgd6ks5wsnq9ydgy6f9gms4jx1611aab96"; + "macchiato/rosewater" = "001akfnhlvwaiz5faahl4qi0qp6as6ilvkbja6bjy9f5iasr4ygp"; + "macchiato/flamingo" = "06xq3pbx4cb3pyblx2vydr4bp0ylm7866d66agg5wg5qnr356wb3"; + "macchiato/pink" = "1hb32dj0n3wx4f1wxa4n7fib2mazghwsg2ljycza9macfn2n87qn"; + "macchiato/mauve" = "1yrnp162blizc10fz2n6ls1x0di1sdjk53vpsl7mifrkcr1k2nq7"; + "macchiato/red" = "1g9s39q7459lk830vhdrfqkbzz88p3fp8k98a2ygj2hz8sycpryq"; + "macchiato/maroon" = "0ad7rx8sbkygvsgywhpjvvzmyflyhz7jlm13dr7cxj3801rxhl6d"; + "macchiato/peach" = "1m5m6afcl8s1ghn2b9n1d20fhsygnhgn0205nhpxh4bih3kg8c8m"; + "macchiato/yellow" = "0zcc26d28jaq71mz8nqssz8p0hylczirjwjxr2dkha1133vjmvy5"; + "macchiato/green" = "055xdb5jilp5fq3a1g8773rv52zr68fp4l3hs56yj6dy3bq3q22v"; + "macchiato/teal" = "1sfci2g2nvmj0v72gnxqbj0k8053qz0rl6iphfxs3pgpi1b0rczq"; + "macchiato/sky" = "0vhfmdliy8cbb0vqq3v26isvcz4sxzq0xrb4p5a6gibvxaqi6bf3"; + "macchiato/sapphire" = "1744jiv57aqz4qi52n92nrx0s1rhylgg08qqc31jr2clk9h6bw18"; + "macchiato/blue" = "1arp8r2g8ivs1xipq39d3l6cvx0zrr1vwv9yac5j33d6c93wbb2i"; + "macchiato/lavender" = "0kak1f574c07gqjfafg3w5avrci584iqxjkmvrl2pv1879g84nn3"; + "mocha/rosewater" = "0p3ck9crskrhk1za6knaznjlj464mx4sdkkadna6k2152m3czjpz"; + "mocha/flamingo" = "04xx1mky230saqxxqin2fph8cnnz1jhmvb9qd9f5yc3pai3q5wdw"; + "mocha/pink" = "1cj9zdd72vcc45ziav625yq6hrp1zw21f7xsic0ip065xcqzdl3p"; + "mocha/mauve" = "1wb0ibmdv6vn07bk570pikm43qdxj3n2zsqr5sip17ay05j5l6dm"; + "mocha/red" = "1mnzrk57ar2cphyi2ry2lg5ilmb26gm4pr7ixch2ls0hk8ilp9p9"; + "mocha/maroon" = "1mcpwz3yrg3kk0hkqv5nykxj07bm70403yyl8r60pqlh74dnhkbf"; + "mocha/peach" = "0jglpcs41rfqxcm45mvnbdqhma0bv4h07nc7c3nrwz3g3h2djmzr"; + "mocha/yellow" = "0jqkvcjiwid1zdvrj2ikqf5winm08qyd51nfsawfdspbfhqnzmis"; + "mocha/green" = "0bg0014a77yx7f2r6n4mxm7rqgdnymqq7cq6bvpgkfk2z1gyr38l"; + "mocha/teal" = "0kzvi3gfirpcxdhgsilm51lk3j1z6lavb7160chgd9jhzk0xg97c"; + "mocha/sky" = "057nmp2aywdxzrkmzi65bh2mvf1a9cnri0g0jdyzdnrn7f8bbsiw"; + "mocha/sapphire" = "0nfklzb0a7mxv6nzav7m2g0y9plm72vwadm06445myv3k9j3ffmj"; + "mocha/blue" = "06ay46x2aq1q5ghz2zhzhn6qyqkrrf4p9j59qywnxh1jvv728ns8"; + "mocha/lavender" = "0iip063f6km17998c7ak0lb3kq6iskyi3xv2phn618mhslnxhwm5"; + }; + + catppuccinThemes = lib.concatMap ( + flavour: + map ( + accent: + builtins.fromJSON ( + builtins.readFile ( + pkgs.fetchurl { + url = "https://element.catppuccin.com/${flavour.slug}/${accent}.json"; + sha256 = themeHashes."${flavour.slug}/${accent}"; + } + ) + ) + ) accents + ) flavours; + + elementConfig = builtins.toFile "element-config.json" ( + builtins.toJSON { + default_server_config = { + "m.homeserver" = { + base_url = "https://matrix.cyperpunk.de"; + server_name = "cyperpunk.de"; + }; + }; + setting_defaults = { + custom_themes = catppuccinThemes; + feature_custom_themes = true; + }; + } + ); + + elementWebConfigured = pkgs.element-web.overrideAttrs (old: { + postInstall = (old.postInstall or "") + '' + cp ${elementConfig} $out/config.json + ''; + }); + +in +{ + services.nginx.virtualHosts = { + "cinny.cyperpunk.de" = { + forceSSL = true; + enableACME = true; + root = "${pkgs.cinny}"; + }; + + "element.cyperpunk.de" = { + forceSSL = true; + enableACME = true; + root = "${elementWebConfigured}"; + }; + + "fluffy.cyperpunk.de" = { + forceSSL = true; + enableACME = true; + locations."/" = { + proxyPass = "http://127.0.0.1:8082"; + proxyWebsockets = true; + }; + }; + }; + + virtualisation.oci-containers.containers.fluffychat = { + image = "ghcr.io/krille-chan/fluffychat:latest"; + ports = [ "127.0.0.1:8082:80" ]; + volumes = [ + "${ + builtins.toFile "fluffychat-config.json" ( + builtins.toJSON { + default_homeserver = "matrix.cyperpunk.de"; + preset_homeserver = "matrix.cyperpunk.de"; + } + ) + }:/app/config.json:ro" + ]; + }; +} diff --git a/nixos/roles/matrix/default.nix b/nixos/roles/matrix/default.nix index 7111612..b9b7641 100644 --- a/nixos/roles/matrix/default.nix +++ b/nixos/roles/matrix/default.nix @@ -4,28 +4,8 @@ { imports = [ ./synapse.nix - ./lk-jwt.nix - ./livekit.nix + #./lk-jwt.nix + #./livekit.nix + ./clients.nix ]; - - #networking.firewall = { - # allowedTCPPorts = [ - # 8008 # Matrix Synapse - # 8009 # Cinny - # 8010 # Element - # 8011 # Synapse Admin - # 8012 # FluffyChat - # 8448 # Matrix federation - # 3478 # TURN (coturn) - # ]; - # allowedUDPPorts = [ - # 3478 # TURN (coturn) - # ]; - # allowedUDPPortRanges = [ - # { - # from = 49152; - # to = 65535; # TURN relay ports (coturn) - # } - # ]; - #}; } diff --git a/nixos/roles/matrix/livekit.nix b/nixos/roles/matrix/livekit.nix index db5f9e5..d5d2752 100644 --- a/nixos/roles/matrix/livekit.nix +++ b/nixos/roles/matrix/livekit.nix @@ -1,22 +1,23 @@ { config, lib, ... }: { - sops.secrets.livekit_key_sfu = { }; + # Shared key file — same secret used by lk-jwt-service (see lk-jwt.nix) + sops.secrets.livekit_key = { }; services.livekit = { enable = true; openFirewall = true; - keyFile = config.sops.secrets.livekit_key_sfu.path; + keyFile = config.sops.secrets.livekit_key.path; settings = { rtc = { tcp_port = 7881; - #udp_port = 7882; port_range_start = 50000; port_range_end = 60000; use_external_ip = true; node_ip = "178.254.8.35"; }; room = { - auto_create = true; + # Must be false — rooms are created by the JWT service on demand + auto_create = false; enabled_codecs = [ { mime = "video/VP8"; } { mime = "video/VP9"; } @@ -27,7 +28,17 @@ }; }; }; - networking.firewall.allowedTCPPorts = [ 7881 ]; + + networking.firewall = { + allowedTCPPorts = [ 7881 ]; + # WebRTC media relay — must be open or calls connect then immediately drop + allowedUDPPortRanges = [ + { + from = 50000; + to = 60000; + } + ]; + }; systemd.services.livekit.serviceConfig = { PrivateUsers = lib.mkForce false; @@ -50,5 +61,4 @@ }; groups.livekit = { }; }; - } diff --git a/nixos/roles/matrix/lk-jwt.nix b/nixos/roles/matrix/lk-jwt.nix index fbf2fbd..8bcc280 100644 --- a/nixos/roles/matrix/lk-jwt.nix +++ b/nixos/roles/matrix/lk-jwt.nix @@ -1,25 +1,25 @@ -{ config, lib, ... }: +{ config, ... }: let domain = "cyperpunk.de"; - synapseUrl = "http://localhost:8008"; + synapseUrl = "http://127.0.0.1:8008"; + # Internal LiveKit address — JWT service must NOT go through the TLS proxy. + # Using the public wss:// URL caused token rejection because nginx re-wraps + # the connection and the JWT service couldn't verify the livekit instance. + livekitInternalUrl = "ws://127.0.0.1:7880"; in { - sops.secrets.livekit_key_jwt = { }; - - networking.firewall.allowedTCPPorts = [ 18080 ]; + # Same secret as livekit.nix — both services must share the same key pair + sops.secrets.livekit_key = { }; services.lk-jwt-service = { enable = true; - keyFile = config.sops.secrets.livekit_key_jwt.path; - livekitUrl = "wss://cyperpunk.de/livekit/sfu"; + port = 18080; + keyFile = config.sops.secrets.livekit_key.path; + livekitUrl = livekitInternalUrl; }; - systemd.services.lk-jwt-service = { - environment = { - LIVEKIT_FULL_ACCESS_HOMESERVERS = domain; - MATRIX_BASE_URL = synapseUrl; - LIVEKIT_JWT_BIND = lib.mkForce ":18080"; - LIVEKIT_INSECURE_SKIP_VERIFY_TLS = "YES_I_KNOW_WHAT_I_AM_DOING"; - }; + systemd.services.lk-jwt-service.environment = { + LIVEKIT_FULL_ACCESS_HOMESERVERS = domain; + MATRIX_BASE_URL = synapseUrl; }; } diff --git a/nixos/roles/matrix/synapse.nix b/nixos/roles/matrix/synapse.nix index a81e282..271cf93 100644 --- a/nixos/roles/matrix/synapse.nix +++ b/nixos/roles/matrix/synapse.nix @@ -3,13 +3,30 @@ pkgs, ... }: +let + wellKnownMatrix = { + "= /.well-known/matrix/client" = { + extraConfig = '' + default_type application/json; + add_header Access-Control-Allow-Origin *; + return 200 '{"m.homeserver":{"base_url":"https://matrix.cyperpunk.de"}}'; + ''; + }; + "= /.well-known/matrix/server" = { + extraConfig = '' + default_type application/json; + add_header Access-Control-Allow-Origin *; + return 200 '{"m.server":"matrix.cyperpunk.de:443"}'; + ''; + }; + }; + + synapseAdmin = pkgs.ketesa.withConfig { + restrictBaseUrl = [ "https://matrix.cyperpunk.de" ]; + loginFlows = [ "password" ]; + }; +in { - - networking.firewall.allowedTCPPorts = [ - 8008 # Matrix Synapse - 8448 # Matrix federation - ]; - sops.secrets = { matrix_macaroon_secret = { }; matrix_registration_secret = { @@ -24,24 +41,28 @@ settings = { server_name = "cyperpunk.de"; public_baseurl = "https://matrix.cyperpunk.de"; - enable_registration = false; # TODO: disable - enable_registration_without_verification = false; + enable_registration = false; trusted_key_servers = [ { server_name = "matrix.org"; } ]; suppress_key_server_warning = true; registration_shared_secret_path = config.sops.secrets.matrix_registration_secret.path; macaroon_secret_key = "$__file{${config.sops.secrets.matrix_macaroon_secret.path}}"; - experimental_features = { - "msc3266_enabled" = true; - "msc3779_enabled" = true; - "msc3401_enabled" = true; - "msc4143_enabled" = true; - "msc4195_enabled" = true; - "msc4222_enabled" = true; - }; + + #experimental_features = { + # msc3266_enabled = true; + # msc3779_enabled = true; + # msc3401_enabled = true; + # msc4143_enabled = true; + # msc4195_enabled = true; + # msc4222_enabled = true; + #}; + listeners = [ { port = 8008; - bind_addresses = [ "0.0.0.0" ]; + bind_addresses = [ + "127.0.0.1" + "::1" + ]; type = "http"; tls = false; x_forwarded = true; @@ -52,7 +73,7 @@ "federation" "openid" ]; - compress = false; + compress = true; } ]; } @@ -64,19 +85,35 @@ resources = [ ]; } ]; - matrix_rtc = { - enabled = true; - transports = [ - { - type = "livekit"; - livekit_service_url = "https://cyperpunk.de/livekit/jwt/"; - } - ]; - }; enable_metrics = true; }; }; + nginx.virtualHosts = { + # Matrix homeserver + "cyperpunk.de" = { + forceSSL = true; + enableACME = true; + serverAliases = [ "matrix.cyperpunk.de" ]; + http2 = true; + locations = wellKnownMatrix // { + "/_matrix".proxyPass = "http://127.0.0.1:8008"; + "/_synapse/client".proxyPass = "http://127.0.0.1:8008"; + "/metrics" = { + proxyPass = "http://127.0.0.1:9009"; + extraConfig = '' + allow 127.0.0.1; + deny all; + ''; + }; + "/admin/" = { + root = "${synapseAdmin}"; + tryFiles = "$uri $uri/ /index.html"; + }; + }; + }; + }; + postgresql = { enable = true; initialScript = pkgs.writeText "synapse-init.sql" '' diff --git a/nixos/roles/nginx.nix b/nixos/roles/nginx.nix index 639af87..ece3997 100644 --- a/nixos/roles/nginx.nix +++ b/nixos/roles/nginx.nix @@ -1,4 +1,4 @@ -{ pkgs, lib, ... }: +_: let upstream = "100.109.179.25"; @@ -19,210 +19,6 @@ let proxyWebsockets = true; }; }; - - matrixConfig = '' - client_max_body_size 50M; - proxy_set_header X-Forwarded-For $remote_addr; - proxy_set_header X-Forwarded-Proto $scheme; - proxy_set_header Host $host; - ''; - - wellKnownMatrix = { - "/.well-known/matrix/client" = { - extraConfig = '' - default_type application/json; - add_header Access-Control-Allow-Origin *; - return 200 '{ - "m.homeserver":{ - "base_url":"https://matrix.cyperpunk.de" - }, - "org.matrix.msc4143.rtc_foci":[ - { - "type":"livekit", - "livekit_service_url":"https://cyperpunk.de/livekit/jwt/" - } - ] - }'; - ''; - }; - "/.well-known/matrix/server" = { - extraConfig = '' - default_type application/json; - add_header Access-Control-Allow-Origin *; - return 200 '{"m.server":"matrix.cyperpunk.de:443"}'; - ''; - }; - }; - - flavours = [ - { - name = "Latte"; - slug = "latte"; - is_dark = false; - } - { - name = "Frappé"; - slug = "frappe"; - is_dark = true; - } - { - name = "Macchiato"; - slug = "macchiato"; - is_dark = true; - } - { - name = "Mocha"; - slug = "mocha"; - is_dark = true; - } - ]; - accents = [ - "rosewater" - "flamingo" - "pink" - "mauve" - "red" - "maroon" - "peach" - "yellow" - "green" - "teal" - "sky" - "sapphire" - "blue" - "lavender" - ]; - themeHashes = { - "latte/rosewater" = "0l1m4bhaxdam07rfqag6pjbzhdpyi5w3i14vp6rq7aj59pildw3a"; - "latte/flamingo" = "1m8hh2l87xv2rfgpnnl5vzddmam0n82h25fwadb37blgab08vhsr"; - "latte/pink" = "0ambrc42mvg0vdspfmnl31ka1nsxpdyv1p3nh045822y02q20wwh"; - "latte/mauve" = "1nnn2w6nsr24a45jy497c2vhi8v64bwg99fj2dyhpfsn89c63lhn"; - "latte/red" = "14lmw4c4llfz6zqvfymkc6k3msxcml2gwq9rhwsixdpc5mjjbn8n"; - "latte/maroon" = "0ydpng9451mpn7hv5ag1ck8hryx8pdvrml3zksvzm2fiwzzjkpcf"; - "latte/peach" = "1fn5804wv9z9iv65ikyv015b01a7c546rsaaks2a2sq2c37n75l0"; - "latte/yellow" = "0hzgiyhqmwgp3h3v1y23sx3x5qp712sw106472lbnxbywqlavcza"; - "latte/green" = "194kxv6d9hc4nixy16hy9nvf32qs3v214nr2r2qf2z9l89rk5pnp"; - "latte/teal" = "12n25d38zpqxsskglymhmza972klg2hj3c23v2nb3jfj82llw6v4"; - "latte/sky" = "0yghds3xpmbhkbcj2jkh8df82j6vrn9q1z0s2129nca7l5g5f9w2"; - "latte/sapphire" = "18dl1srxp3xccvvy56za6kp05n68d918l0wrxga11746g9sib7r3"; - "latte/blue" = "1zv9nap21d80flvd1jwmjph05jgykxngv5kqbhk95mvqh962ygnf"; - "latte/lavender" = "03j4fwbscip1qm6px1qxkha0c5csq2wwvzg9vwjkc2ja48v1mp9k"; - "frappe/rosewater" = "032qbgj32mvgpankl9777x2lxk18451kglsxg5215k8zrwcg9y95"; - "frappe/flamingo" = "1grhgynn8q7isv18981km5k8ll72ihsjw2ciy8widl6wikv29j8p"; - "frappe/pink" = "0h33g721bph8ihd6lmbc7szxy4dq85ng1cgg5cxjb5y2m7wpdbsy"; - "frappe/mauve" = "121jmznc9q3p7crsy9p2khw8xnzvz4lxms26g1h5wqa67wqvalc4"; - "frappe/red" = "07wm4h1giyy6a5nlh0d3qdarfsp6ikyr5nmg94n13lj4q03d0cn0"; - "frappe/maroon" = "08vg70nr918n4ffi1wnbba4xrx5ak5vfgq7m5ik0rpkb2wdb4x6k"; - "frappe/peach" = "1cg753w2dxs0sx97d8y0g62s8aw3w6b9hrll0lsrw3bc1bvm23fl"; - "frappe/yellow" = "0g43g2if1pcm25i261zfw43bawqqdlgg2f6q2bqhyqvafk9yb3dy"; - "frappe/green" = "1n71mndzds3zldb271g8hdw1yn29s68svzvh8ckjcsz4sb9h1i74"; - "frappe/teal" = "0b6m9cibfwf8csh1pk5i76xi3wx3v2aqwgffzsidw8nwc7c1a3wk"; - "frappe/sky" = "1l4d44399ixshlc9fdsx7iqwxm6kdkp6k4z3z6bdyyx6adw3z4q5"; - "frappe/sapphire" = "03fa9rnclvs5ljd0lzz15vnkzpqpbrhfppg3zwfchs9fvak0n3ni"; - "frappe/blue" = "0r4jjn3pab77w1aanlv3143ch60400q44mdzaqmcjbcr6l2knmjh"; - "frappe/lavender" = "1mrkaz72w6j9hh4dpxwgd6ks5wsnq9ydgy6f9gms4jx1611aab96"; - "macchiato/rosewater" = "001akfnhlvwaiz5faahl4qi0qp6as6ilvkbja6bjy9f5iasr4ygp"; - "macchiato/flamingo" = "06xq3pbx4cb3pyblx2vydr4bp0ylm7866d66agg5wg5qnr356wb3"; - "macchiato/pink" = "1hb32dj0n3wx4f1wxa4n7fib2mazghwsg2ljycza9macfn2n87qn"; - "macchiato/mauve" = "1yrnp162blizc10fz2n6ls1x0di1sdjk53vpsl7mifrkcr1k2nq7"; - "macchiato/red" = "1g9s39q7459lk830vhdrfqkbzz88p3fp8k98a2ygj2hz8sycpryq"; - "macchiato/maroon" = "0ad7rx8sbkygvsgywhpjvvzmyflyhz7jlm13dr7cxj3801rxhl6d"; - "macchiato/peach" = "1m5m6afcl8s1ghn2b9n1d20fhsygnhgn0205nhpxh4bih3kg8c8m"; - "macchiato/yellow" = "0zcc26d28jaq71mz8nqssz8p0hylczirjwjxr2dkha1133vjmvy5"; - "macchiato/green" = "055xdb5jilp5fq3a1g8773rv52zr68fp4l3hs56yj6dy3bq3q22v"; - "macchiato/teal" = "1sfci2g2nvmj0v72gnxqbj0k8053qz0rl6iphfxs3pgpi1b0rczq"; - "macchiato/sky" = "0vhfmdliy8cbb0vqq3v26isvcz4sxzq0xrb4p5a6gibvxaqi6bf3"; - "macchiato/sapphire" = "1744jiv57aqz4qi52n92nrx0s1rhylgg08qqc31jr2clk9h6bw18"; - "macchiato/blue" = "1arp8r2g8ivs1xipq39d3l6cvx0zrr1vwv9yac5j33d6c93wbb2i"; - "macchiato/lavender" = "0kak1f574c07gqjfafg3w5avrci584iqxjkmvrl2pv1879g84nn3"; - "mocha/rosewater" = "0p3ck9crskrhk1za6knaznjlj464mx4sdkkadna6k2152m3czjpz"; - "mocha/flamingo" = "04xx1mky230saqxxqin2fph8cnnz1jhmvb9qd9f5yc3pai3q5wdw"; - "mocha/pink" = "1cj9zdd72vcc45ziav625yq6hrp1zw21f7xsic0ip065xcqzdl3p"; - "mocha/mauve" = "1wb0ibmdv6vn07bk570pikm43qdxj3n2zsqr5sip17ay05j5l6dm"; - "mocha/red" = "1mnzrk57ar2cphyi2ry2lg5ilmb26gm4pr7ixch2ls0hk8ilp9p9"; - "mocha/maroon" = "1mcpwz3yrg3kk0hkqv5nykxj07bm70403yyl8r60pqlh74dnhkbf"; - "mocha/peach" = "0jglpcs41rfqxcm45mvnbdqhma0bv4h07nc7c3nrwz3g3h2djmzr"; - "mocha/yellow" = "0jqkvcjiwid1zdvrj2ikqf5winm08qyd51nfsawfdspbfhqnzmis"; - "mocha/green" = "0bg0014a77yx7f2r6n4mxm7rqgdnymqq7cq6bvpgkfk2z1gyr38l"; - "mocha/teal" = "0kzvi3gfirpcxdhgsilm51lk3j1z6lavb7160chgd9jhzk0xg97c"; - "mocha/sky" = "057nmp2aywdxzrkmzi65bh2mvf1a9cnri0g0jdyzdnrn7f8bbsiw"; - "mocha/sapphire" = "0nfklzb0a7mxv6nzav7m2g0y9plm72vwadm06445myv3k9j3ffmj"; - "mocha/blue" = "06ay46x2aq1q5ghz2zhzhn6qyqkrrf4p9j59qywnxh1jvv728ns8"; - "mocha/lavender" = "0iip063f6km17998c7ak0lb3kq6iskyi3xv2phn618mhslnxhwm5"; - }; - catppuccinThemes = lib.concatMap ( - flavour: - map ( - accent: - builtins.fromJSON ( - builtins.readFile ( - pkgs.fetchurl { - url = "https://element.catppuccin.com/${flavour.slug}/${accent}.json"; - sha256 = themeHashes."${flavour.slug}/${accent}"; - } - ) - ) - ) accents - ) flavours; - - elementConfig = builtins.toFile "element-config.json" ( - builtins.toJSON { - default_server_config = { - "m.homeserver" = { - base_url = "https://matrix.cyperpunk.de"; - server_name = "cyperpunk.de"; - }; - }; - jitsi.preferred_domain = "jitsi.cyperpunk.de"; - element_call = { - url = "https://element-call.cyperpunk.de"; - use_exclusively = true; - participant_limit = 8; - brand = "Cyperpunk Call"; - encryption = "None"; - }; - livekit.livekit_service_url = "https://cyperpunk.de/livekit/jwt/"; - setting_defaults = { - custom_themes = catppuccinThemes; - feature_custom_themes = true; - }; - features = { - feature_group_calls = true; - feature_disable_call_per_sender_encryption = true; - feature_sliding_sync = true; - }; - } - ); - - elementWebConfigured = pkgs.element-web.overrideAttrs (old: { - postInstall = (old.postInstall or "") + '' - cp ${elementConfig} $out/config.json - ''; - }); - - synapseAdmin = pkgs.ketesa.withConfig { - restrictBaseUrl = [ "https://matrix.cyperpunk.de" ]; - loginFlows = [ "password" ]; - }; - - elementCallConfigured = pkgs.element-call.overrideAttrs (old: { - postInstall = (old.postInstall or "") + '' - cp ${ - builtins.toFile "element-call-config.json" ( - builtins.toJSON { - default_server_config = { - "m.homeserver" = { - base_url = "https://matrix.cyperpunk.de"; - server_name = "cyperpunk.de"; - }; - }; - livekit_service_url = "https://cyperpunk.de/livekit/jwt/"; - e2ee.default = false; - } - ) - } $out/config.json - ''; - }); in { networking.firewall.allowedTCPPorts = [ @@ -243,7 +39,7 @@ in recommendedGzipSettings = true; virtualHosts = { - # controller services + # controller services (proxied to upstream tailscale node) "git.cyperpunk.de" = mkProxy 9000; "search.cyperpunk.de" = mkProxy 11080; "file.cyperpunk.de" = mkProxy 10000; @@ -265,101 +61,6 @@ in }; }; }; - - # local static clients - "cinny.cyperpunk.de" = { - forceSSL = true; - enableACME = true; - root = "${pkgs.cinny}"; - }; - - "element.cyperpunk.de" = { - forceSSL = true; - enableACME = true; - root = "${elementWebConfigured}"; - }; - - "element-call.cyperpunk.de" = { - forceSSL = true; - enableACME = true; - root = "${elementCallConfigured}"; - extraConfig = '' - add_header Cross-Origin-Opener-Policy "same-origin"; - add_header Cross-Origin-Embedder-Policy "require-corp"; - add_header Cross-Origin-Resource-Policy "cross-origin"; - ''; - }; - - "fluffy.cyperpunk.de" = { - forceSSL = true; - enableACME = true; - locations."/" = { - proxyPass = "http://127.0.0.1:8082"; - proxyWebsockets = true; - }; - }; - - "admin.cyperpunk.de" = { - forceSSL = true; - enableACME = true; - root = "${synapseAdmin}"; - }; - - # matrix + livekit - "cyperpunk.de" = { - forceSSL = true; - enableACME = true; - serverAliases = [ "matrix.cyperpunk.de" ]; - http2 = true; - extraConfig = matrixConfig; - locations = wellKnownMatrix // { - "/" = { - proxyPass = "http://127.0.0.1:8008"; - proxyWebsockets = true; - }; - "^~ /livekit/jwt/" = { - priority = 400; - proxyPass = "http://127.0.0.1:18080/"; - }; - "^~ /livekit/sfu/" = { - priority = 400; - proxyPass = "http://127.0.0.1:7880/"; - proxyWebsockets = true; - extraConfig = '' - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; - proxy_read_timeout 86400s; - proxy_send_timeout 86400s; - ''; - }; - "/_matrix/client/unstable/org.matrix.msc4143/rtc/transports" = { - extraConfig = '' - default_type application/json; - add_header Access-Control-Allow-Origin *; - add_header Access-Control-Allow-Headers "Authorization, Content-Type"; - add_header Access-Control-Allow-Methods "GET, OPTIONS"; - return 200 '{"rtc_transports":[{"type":"livekit","livekit_service_url":"https://cyperpunk.de/livekit/jwt/"}]}'; - ''; - }; - }; - }; }; }; - - virtualisation.oci-containers.containers.fluffychat = { - image = "ghcr.io/krille-chan/fluffychat:latest"; - ports = [ "127.0.0.1:8082:80" ]; - volumes = [ - "${ - builtins.toFile "fluffychat-config.json" ( - builtins.toJSON { - default_homeserver = "matrix.cyperpunk.de"; - preset_homeserver = "matrix.cyperpunk.de"; - } - ) - }:/app/config.json:ro" - ]; - }; } diff --git a/secrets/secrets.yaml b/secrets/secrets.yaml index bec4e10..57869eb 100644 --- a/secrets/secrets.yaml +++ b/secrets/secrets.yaml @@ -8,8 +8,7 @@ vaultwarden_admin_token: ENC[AES256_GCM,data:yoBs4CaIEJXB5b3PEwTpXFgxpX39hR9A4r9 flame_phil_password: ENC[AES256_GCM,data:Xy2ixMeRlnzC2gjKGrjfSbz/ee4=,iv:WFuBS8jn7WYRxEDG3XBzCMnm4eNkHQpSs5+GUwq/dcg=,tag:1zzj0eB9/4KrmYAqcxJMlg==,type:str] flame_calvin_password: ENC[AES256_GCM,data:P5ppyqTjAJ1TL4hXtx5WyoS9a+g=,iv:sq98P3Oqud2FXfqsD76YS/p5NEF2xlN0MfG+ukCB9B0=,tag:AeKnu4Hg4xQ3tII0y6oNpQ==,type:str] paperless_admin: ENC[AES256_GCM,data:sVvlMQ3dDE2XsDfpwpCTbzPCEKdUMNTFtRXDIuBbgyf1gd6oiJzE23Ytc57plNUGg5h5aEtgxZ7NXeuK5vrhQw==,iv:x+QNAzY9k9t23UYlM9GcAke0urEA5jlV0VzHaBQkm7M=,tag:D/bMtjuwrX6pquZfJLwdkQ==,type:str] -livekit_key_sfu: ENC[AES256_GCM,data:3pRAN0Vz134mg/omkSRlC9OAvToQg42aZbXj7TurYYOLUMnW6sWk+eexyIcYAAjCSP5GRES4WySuN/qjGeUDBKr8OYAxTXjR/w==,iv:NYhcfiKlXT3v5R4djkhHusMMRYgc3bCM66VD0G2MyME=,tag:8341ntSCmteTn+6AM0xu8g==,type:str] -livekit_key_jwt: ENC[AES256_GCM,data:9cBMJ0AyyWaoUZsXmnGvIL7EPIO8l16TQRBC6iK6h1TQAriOTPicfcE40Itf7cmiplZFtK6z7DhkgggRpG88HT7ZCvcXP0P69A==,iv:GiZb/8Vz4tiLG8kpF93kiFkmmA/KdgWr0ILARsL15oo=,tag:SZxzfFSk125q9sqlRbsxdw==,type:str] +livekit_key: ENC[AES256_GCM,data:CXsX4ZePcfIwqjk0EuFQFh6ozS68KOej2csG8pFvZ3K5MMIcm9ezD65+pUJmwvDqRqH0kmFMTE5PCJMN6kPfOGAlJ8d1iiLBJg==,iv:jQkmc8v7bQ2Y+CaBzEKR3HfTbXTsvPGM756xnac5qek=,tag:oKzRniBg55LYz3iebNjoAg==,type:str] gitea: dbPassword: ENC[AES256_GCM,data:S6VvRgkdYk1AzXljyQEEq68UJ9zrFy6+INBMIAspXNcqcM6o+es19o0mcXA=,iv:/pHYpkZZq+9Md+75uSCb2YXfSvaDzUh6mMfH53wb7eg=,tag:ZnbyCQwrK2JnbO5HFqgJYw==,type:str] internalToken: ENC[AES256_GCM,data:7N8TkPNb1YdCk2uAcCvVd2pKRVOf85//DYxAvz0UCg1E8ccEI5630xVyKafDFiSTM4ER7xiYelartzXL0jLWSf3QNOjSHUP8TIAz4bJRAZUJPxO917bURSLGGe7WEOfONzqy3Ts5QhrJ,iv:DiIs1ytlwLvqD/Ejep6m2fmpSqdFZkxBcgLNt6+29jY=,tag:8jsEcOkH0p+1mP9cnVjiDQ==,type:str] @@ -28,7 +27,7 @@ sops: N3I5dzUwc3JtYzczMUhyT04vSHlZamMKT+FzYcDLmlEFYxm/XoBpJb8XaZzBH1v9 6fuez+zApathZfl14w41kAUojPWBznnxDqYtNvzVVLXwnpp3BMx+7w== -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-04-30T12:21:26Z" - mac: ENC[AES256_GCM,data:sta1qQugWsGS0+g8stmyxHtKOiba6QiVyGfV5krJ688wrW1Ox38RW1cYf9+9Z04hXVQukYguR/k/y7v49oQxoefH5+7zlt/BxzadvPC5f55RsDREC7U4FKcpEEb2Pt1PtscQ3Trx/nDy3x5S8zJ1Uy1QTvSsEccQ+FYel6pcsgQ=,iv:r8spgHthtKoJjlHIpNGpVde1WFVI0xwbE1yJ4W6nHl8=,tag:qXnmmFRDISV3LTmlSlHgvA==,type:str] + lastmodified: "2026-05-05T10:30:02Z" + mac: ENC[AES256_GCM,data:4fBPLtCVtGZ02sAkEGNZF9bDSobiMHd2WBVd2dXv47B9qdlMROvaEj00+nm+TrVWnCZqKatwMWLBPwYV9/Ie5juQUCiyvUpIS2iebve01sbSZ0trN4QHXAZ6MAG9paFs8g5W2683msp/VDKFTDeYrZHvKbowY7E+EKceWQx5enA=,iv:v+VvMsZAR746UNRdtFj76GRyZwh4RMpUyNZdXI2WtTE=,tag:ucnXpGEWt6vs7kty4gw3eg==,type:str] unencrypted_suffix: _unencrypted version: 3.12.2