feat(homepage): Add module

.gitignore

@@ -1 +0,0 @@
-.idea

.sops.yaml

@@ -1,10 +0,0 @@
-keys:
-  - &tdpeuter_Tibo-NixFatDesk age1fva6s64s884z0q2w7de024sp69ucvqu0pg9shrhhqsn3ewlpjfpsh6md7y
-  - &tdpeuter_Tibo-NixTop age1qzutny0mqpcccqw6myyfntu6wcskruu9ghzvt6r4te7afkqwnguq05ex37
-
-creation_rules:
-  - path_regex: secrets/[^/]+\.(yaml|json|env|ini)$
-    key_groups:
-    - age:
-        - *tdpeuter_Tibo-NixFatDesk
-        - *tdpeuter_Tibo-NixTop

flake.lock

@@ -20,11 +20,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1760524057,
+        "lastModified": 1735291276,
-        "narHash": "sha256-EVAqOteLBFmd7pKkb0+FIUyzTF61VKi7YmvP1tw4nEw=",
+        "narHash": "sha256-NYVcA06+blsLG6wpAbSPTCyLvxD/92Hy4vlY9WxFI1M=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "544961dfcce86422ba200ed9a0b00dd4b1486ec5",
+        "rev": "634fd46801442d760e09493a794c4f15db2d0cbb",
         "type": "github"
       },
       "original": {
@@ -37,30 +37,9 @@
       "inputs": {
         "flake-utils": "flake-utils",
         "nixpkgs": "nixpkgs",
-        "sops-nix": "sops-nix",
         "utils": "utils"
       }
     },
-    "sops-nix": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1760393368,
-        "narHash": "sha256-8mN3kqyqa2PKY0wwZ2UmMEYMcxvNTwLaOrrDsw6Qi4E=",
-        "owner": "Mic92",
-        "repo": "sops-nix",
-        "rev": "ab8d56e85b8be14cff9d93735951e30c3e86a437",
-        "type": "github"
-      },
-      "original": {
-        "owner": "Mic92",
-        "repo": "sops-nix",
-        "type": "github"
-      }
-    },
     "systems": {
       "locked": {
         "lastModified": 1681028828,
@@ -83,11 +62,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1738591040,
+        "lastModified": 1722363685,
-        "narHash": "sha256-4WNeriUToshQ/L5J+dTSWC5OJIwT39SEP7V7oylndi8=",
+        "narHash": "sha256-XCf2PIAT6lH7BwytgioPmVf/wkzXjSKScC4KzcZgb64=",
         "owner": "gytis-ivaskevicius",
         "repo": "flake-utils-plus",
-        "rev": "afcb15b845e74ac5e998358709b2b5fe42a948d1",
+        "rev": "6b10f51ff73a66bb29f3bc8151a59d217713f496",
         "type": "github"
       },
       "original": {

flake.nix

@@ -5,10 +5,6 @@
     nixpkgs.url = "nixpkgs/nixos-unstable";
 
     flake-utils.url = "github:numtide/flake-utils";
-    sops-nix = {
-      url = "github:Mic92/sops-nix";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
     utils = {
       url = "github:gytis-ivaskevicius/flake-utils-plus";
       inputs.flake-utils.follows = "flake-utils";
@@ -17,11 +13,11 @@
 
   outputs = inputs@{
     self, nixpkgs,
-    flake-utils, sops-nix, utils,
+    flake-utils, utils,
     ...
   }:
   let
-    system = utils.lib.system.x86_64-linux;
+    system = "x86_64-linux";
   in
   utils.lib.mkFlake {
     inherit self inputs;
@@ -32,30 +28,22 @@
       modules = [
         ./modules
         ./users
-
-        sops-nix.nixosModules.sops
       ];
     };
 
     hosts = {
-      # Physical hosts
       Niko.modules        = [ ./hosts/Niko          ];
 
-      # Virtual machines
-
-      # Single-service
       Ingress.modules       = [ ./hosts/Ingress       ];
       Gitea.modules         = [ ./hosts/Gitea         ];
       Vaultwarden.modules   = [ ./hosts/Vaultwarden   ];
 
-      # Production multi-service
       Binnenpost.modules    = [ ./hosts/Binnenpost    ];
       Production.modules    = [ ./hosts/Production    ];
       ProductionGPU.modules = [ ./hosts/ProductionGPU ];
       ProductionArr.modules = [ ./hosts/ProductionArr ];
       ACE.modules           = [ ./hosts/ACE           ];
 
-      # Others
       Template.modules      = [ ./hosts/Template      ];
       Development.modules   = [ ./hosts/Development   ];
       Testing.modules       = [ ./hosts/Testing       ];

hosts/Binnenpost/default.nix

@@ -16,7 +16,6 @@
       apps = {
         speedtest.enable = true;
         technitiumDNS.enable = true;
-        traefik.enable = true;
       };
       virtualisation.guest.enable = true;
     };
@@ -77,14 +76,6 @@
       };
     };
 
-    virtualisation.oci-containers.containers.traefik.labels = {
-      "traefik.http.routers.roxanne.rule" = "Host(`roxanne.depeuter.dev`)";
-      "traefik.http.services.roxanne.loadbalancer.server.url" = "https://192.168.0.13:8006";
-
-      "traefik.http.routers.hugo.rule" = "Host(`hugo.depeuter.dev`)";
-      "traefik.http.services.hugo.loadbalancer.server.url" = "https://192.168.0.11:444";
-    };
-
     system.stateVersion = "24.05";
   };
 }

hosts/Gitea/default.nix

@@ -5,13 +5,6 @@
     homelab = {
       apps.gitea.enable = true;
       virtualisation.guest.enable = true;
-
-      users.admin = {
-        enable = true;
-        authorizedKeys = [
-          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFrp6aM62Bf7bj1YM5AlAWuNrANU3N5e8+LtbbpmZPKS"
-        ];
-      };
     };
 
     networking = {

hosts/Ingress/default.nix

@@ -59,7 +59,6 @@ prefixLength = 24;
         };
         "cloud.depeuter.dev" = { };
         "git.depeuter.dev"   = { };
-        "home.depeuter.dev"  = { };
         "jelly.depeuter.dev" = { };
         "vault.depeuter.dev" = { };
       };
@@ -137,27 +136,10 @@ prefixLength = 24;
               proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
             '';
           };
-          "calendar.depeuter.dev" = {
+          "calendar.depeuter.dev".locations."/".return = "301 https://cloud.depeuter.dev/apps/calendar";
-            useACMEHost = "depeuter.dev";
-            locations."/".return = "301 https://cloud.depeuter.dev/apps/calendar";
-          };
           "tasks.depeuter.dev".locations."/".return = "301 https://cloud.depeuter.dev/apps/tasks";
           "notes.depeuter.dev".locations."/".return = "301 https://cloud.depeuter.dev/apps/notes";
 
-          "home.depeuter.dev" = {
-            enableACME = true;
-            forceSSL = true;
-            locations."/" = {
-              proxyPass = "http://192.168.0.21:8123";
-              extraConfig = ''
-                proxy_http_version 1.1;
-                proxy_set_header Upgrade $http_upgrade;
-                proxy_set_header Connection "Upgrade";
-                proxy_set_header Host $host;
-              '';
-            };
-          };
-
           "jelly.depeuter.dev" = {
             enableACME = true;
             forceSSL = true;
@@ -194,7 +176,7 @@ prefixLength = 24;
               };
             };
             extraConfig = ''
-              client_max_body_size 512M;
+              client_max_body_size 20M;
 
               # Security / XSS Mitigation Headers
               # NOTE: X-Frame-Options may cause issues with the webOS app
@@ -224,7 +206,7 @@ prefixLength = 24;
               proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
               proxy_set_header X-Forwarded-Proto $scheme;
 
-              client_max_body_size 10G;
+              client_max_body_size 512M;
               keepalive_timeout 600s;
               proxy_buffers 4 256k;     # Number and size of buffers for reading response
               proxy_buffer_size 256k;  # Buffer for the first part of the response
@@ -238,18 +220,10 @@ prefixLength = 24;
             enableACME = true;
             forceSSL = true;
             locations = {
-              "/" = {
+              "/".proxyPass = "http://192.168.0.22:10102";
-                proxyPass = "http://192.168.0.22:10102";
-                proxyWebSockets = true;
-              };
               "~ ^/admin".return = 403;
             };
           };
-          "rss.depeuter.dev" = {
-            enableACME = true;
-            forceSSL = true;
-            locations."/".proxyPass = "http://192.168.92:${toString config.homelab.apps.freshrss.port}";
-          };
         };
       };
     };

hosts/Niko/default.nix

@@ -7,10 +7,7 @@
   ];
 
   homelab = {
-    apps = {
+    apps.technitiumDNS.enable = true;
-      technitiumDNS.enable = true;
-      traefik.enable = true;
-    };
     users.deploy.enable = true;
   };
 
@@ -37,11 +34,12 @@
   hardware = {
     enableRedistributableFirmware = true;
     enableAllFirmware = true;
-    graphics.enable = true;
+    pulseaudio.enable = true;
+    opengl.enable = true;
   };
 
   # Select internationalisation properties.
-  i18n.defaultLocale = "en_GB.UTF-8";
+  i18n.defaultLocale = "en_GB.utf8";
 
   networking = {
     hostName = "Niko";
@@ -81,8 +79,6 @@
       user = config.users.users.jellyfin-mpv-shim.name;
     };
 
-    pulseaudio.enable = true;
-
     tailscale = {
       enable = true;
       useRoutingFeatures = "server";
@@ -98,6 +94,8 @@
     # resolved.enable = true;
   };
 
+  sound.enable = true;
+
   # Define a user account. Don't forget to set a password with 'passwd'.
   users.users.jellyfin-mpv-shim = {
     description = "Jellyfin MPV Shim User";
@@ -116,4 +114,67 @@
   systemd.services."cage-tty1".serviceConfig.Restart = "always";
 
   system.stateVersion = "24.05";
+
+  virtualisation = {
+    # Enable Android emulator
+    # waydroid.enable = true;
+
+    docker = {
+      enable = true;
+      autoPrune.enable = true;
+    };
+
+    oci-containers = {
+      backend = "docker";
+      containers = {
+        reverse-proxy = {
+          hostname = "traefik";
+          image = "traefik:v3.0";
+          cmd = [
+            "--api.insecure=true"
+            # Add Docker provider
+            "--providers.docker=true"
+            "--providers.docker.exposedByDefault=false"
+            # Add web entrypoint
+            "--entrypoints.web.address=:80/tcp"
+            "--entrypoints.web.http.redirections.entrypoint.to=websecure"
+            "--entrypoints.web.http.redirections.entrypoint.scheme=https"
+            # Add websecure entrypoint
+            "--entrypoints.websecure.address=:443/tcp"
+            "--entrypoints.websecure.http.tls=true"
+            "--entrypoints.websecure.http.tls.certResolver=letsencrypt"
+            "--entrypoints.websecure.http.tls.domains[0].main=depeuter.dev"
+            "--entrypoints.websecure.http.tls.domains[0].sans=*.depeuter.dev"
+            "--entrypoints.websecure.http.tls.domains[1].sans=*.niko.depeuter.dev"
+            # Certificates
+            "--certificatesresolvers.letsencrypt.acme.dnschallenge=true"
+            "--certificatesresolvers.letsencrypt.acme.dnschallenge.provider=cloudflare"
+            "--certificatesresolvers.letsencrypt.acme.email=tibo.depeuter@telenet.be"
+            "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
+          ];
+          ports = [
+            "80:80/tcp"
+            "443:443/tcp"
+            # "8080:8080/tcp" # The Web UI (enabled by --api.insecure=true)
+          ];
+          environment = {
+            # TODO Hide this!
+            "CLOUDFLARE_DNS_API_TOKEN" = "6Vz64Op_a6Ls1ljGeBxFoOVfQ-yB-svRbf6OyPv2";
+          };
+          environmentFiles = [
+          ];
+          volumes = [
+            "/var/run/docker.sock:/var/run/docker.sock:ro" # So that Traefik can listen to the Docker events
+            "letsencrypt:/letsencrypt"
+          ];
+          labels = {
+            "traefik.enable" = "true";
+            "traefik.http.routers.traefik.rule" = "Host(`traefik.niko.depeuter.dev`)";
+            "traefik.http.services.traefik.loadbalancer.server.port" = "8080";
+          };
+          autoStart = true;
+        };
+      };
+    };
+  };
 }

hosts/ProductionGPU/default.nix

@@ -17,7 +17,7 @@
 
       defaultGateway = {
         address = "192.168.0.1";
-        interface = "ens18";
+        interface = "enp6s18";
       };
 
       # Open ports in the firewall.
@@ -25,7 +25,7 @@
         enable = true;
       };
 
-      interfaces.ens18 = {
+      interfaces.enp6s18 = {
         ipv4.addresses = [
           {
             address = "192.168.0.94";
@@ -40,7 +40,7 @@
       ];
     };
 
-    system.stateVersion = "24.11";
+    system.stateVersion = "unstable";
 
     ### Nvidia GPU support ###
 
@@ -64,7 +64,7 @@
     };
 
     hardware = {
-      graphics = {
+      opengl = {
         enable = true;
         # driSupport = true;
         # driSupport32Bit = true;

hosts/Testing/default.nix

@@ -3,10 +3,7 @@
 {
   config = {
     homelab = {
-      apps = {
+      apps.freshrss.enable = true;
-        freshrss.enable = true;
-        traefik.enable = true;
-      };
       virtualisation.guest.enable = true;
     };
 

hosts/Vaultwarden/default.nix

@@ -9,13 +9,6 @@
         name = "Hugo's Vault";
       };
       virtualisation.guest.enable = true;
-
-      users.admin = {
-        enable = true;
-        authorizedKeys = [
-          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJnihoyozOCnm6T9OzL2xoMeMZckBYR2w43us68ABA93"
-        ];
-      };
     };
 
     networking = {

modules/apps/arr/default.nix

@@ -12,16 +12,7 @@ let
   PGID = toString config.users.groups.media.gid;
   UMASK = "002";
 in {
-  options.homelab.apps.arr = let
+  options.homelab.apps.arr = {
-    mkAppOption = appName: {
-      enable = lib.mkEnableOption "${appName} using Docker";
-      exposePorts = lib.mkOption {
-        type = lib.types.bool;
-        description = "Expose ${appName} port";
-        default = cfg.exposePorts;
-      };
-    };
-  in {
     enable = lib.mkEnableOption "Arr Stack using Docker";
     exposePorts = lib.mkOption {
       type = lib.types.bool;
@@ -30,11 +21,46 @@ in {
       default = ! config.homelab.apps.traefik.enable;
     };
 
-    bazarr = mkAppOption "Bazarr";
+    bazarr = {
-    prowlarr = mkAppOption "Prowlarr";
+      enable = lib.mkEnableOption "Bazarr using Docker";
-    qbittorrent = mkAppOption "qBittorrent";
+      exposePorts = lib.mkOption {
-    radarr = mkAppOption "Radarr";
+        type = lib.types.bool;
-    sonarr = mkAppOption "Sonarr";
+        description = "Expose Bazarr port";
+        default = cfg.exposePorts;
+      };
+    };
+    prowlarr = {
+      enable = lib.mkEnableOption "Prowlarr using Docker";
+      exposePorts = lib.mkOption {
+        type = lib.types.bool;
+        description = "Expose Prowlarr port";
+        default = cfg.exposePorts;
+      };
+    };
+    qbittorrent = {
+      enable = lib.mkEnableOption "qBittorrent using Docker";
+      exposePorts = lib.mkOption {
+        type = lib.types.bool;
+        description = "Expose qBittorrent port";
+        default = cfg.exposePorts;
+      };
+    };
+    radarr = {
+      enable = lib.mkEnableOption "Radarr using Docker";
+      exposePorts = lib.mkOption {
+        type = lib.types.bool;
+        description = "Expose Radarr port";
+        default = cfg.exposePorts;
+      };
+    };
+    sonarr = {
+      enable = lib.mkEnableOption "Sonarr using Docker";
+      exposePorts = lib.mkOption {
+        type = lib.types.bool;
+        description = "Expose Sonarr port";
+        default = cfg.exposePorts;
+      };
+    };
   };
 
   config = {
@@ -61,9 +87,9 @@ in {
       virtualisation.containers.enable = lib.mkIf inUse true;
     };
 
-    fileSystems = let
+    fileSystems = lib.mkIf inUse {
-      mkFileSystem = device: {
+      "/srv/bazarr-backup" = lib.mkIf cfg.bazarr.enable {
-        inherit device;
+        device = "192.168.0.11:/mnt/BIG/BACKUP/BAZARR";
         fsType = "nfs";
         options = [
           "rw"
@@ -76,14 +102,75 @@ in {
         ];
       };
 
-      hugoBackup = "192.168.0.11:/mnt/BIG/BACKUP";
+      "/srv/prowlarr-backup" = lib.mkIf cfg.prowlarr.enable {
-    in lib.mkIf inUse {
+        device = "192.168.0.11:/mnt/BIG/BACKUP/PROWLARR";
-      "/srv/bazarr-backup" = lib.mkIf cfg.bazarr.enable (mkFileSystem "${hugoBackup}/BAZARR");
+        fsType = "nfs";
-      "/srv/prowlarr-backup" = lib.mkIf cfg.bazarr.enable (mkFileSystem "${hugoBackup}/PROWLARR");
+        options = [
-      "/srv/qbittorrent" = lib.mkIf cfg.qbittorrent.enable (mkFileSystem "192.168.0.11:/mnt/SMALL/CONFIG/QBITTORRENT");
+          "rw"
-      "/srv/radarr-backup" = lib.mkIf cfg.radarr.enable (mkFileSystem "${hugoBackup}/RADARR");
+          "auto"
-      "/srv/sonarr-backup" = lib.mkIf cfg.sonarr.enable (mkFileSystem "${hugoBackup}/SONARR");
+          "nfsvers=4.2"
-      "/srv/torrent" = mkFileSystem "192.168.0.11:/mnt/SMALL/MEDIA/TORRENT";
+          "rsize=1048576" "wsize=1048576"
+          "hard"
+          "timeo=600" "retrans=2"
+          "_netdev" "nosuid" "tcp"
+        ];
+      };
+
+      "/srv/qbittorrent" = lib.mkIf cfg.qbittorrent.enable {
+        device = "192.168.0.11:/mnt/SMALL/CONFIG/QBITTORRENT";
+        fsType = "nfs";
+        options = [
+          "rw"
+          "auto"
+          "nfsvers=4.2"
+          "rsize=1048576" "wsize=1048576"
+          "hard"
+          "timeo=600" "retrans=2"
+          "_netdev" "nosuid" "tcp"
+        ];
+      };
+
+      "/srv/radarr-backup" = lib.mkIf cfg.radarr.enable {
+        device = "192.168.0.11:/mnt/BIG/BACKUP/RADARR";
+        fsType = "nfs";
+        options = [
+          "rw"
+          "auto"
+          "nfsvers=4.2"
+          "rsize=1048576" "wsize=1048576"
+          "hard"
+          "timeo=600" "retrans=2"
+          "_netdev" "nosuid" "tcp"
+        ];
+      };
+
+      "/srv/sonarr-backup" = lib.mkIf cfg.sonarr.enable {
+        device = "192.168.0.11:/mnt/BIG/BACKUP/SONARR";
+        fsType = "nfs";
+        options = [
+          "rw"
+          "auto"
+          "nfsvers=4.2"
+          "rsize=1048576" "wsize=1048576"
+          "hard"
+          "timeo=600" "retrans=2"
+          "_netdev" "nosuid" "tcp"
+        ];
+      };
+
+      "/srv/torrent" = {
+        device = "192.168.0.11:/mnt/SMALL/MEDIA/TORRENT";
+        fsType = "nfs";
+        options = [
+          "rw"
+          "auto"
+          "nfsvers=4.2"
+          "rsize=1048576" "wsize=1048576"
+          "hard"
+          "timeo=600" "retrans=2"
+          "_netdev" "nosuid" "tcp"
+        ];
+      };
     };
 
     # Make sure the Docker network exists.
@@ -108,24 +195,45 @@ in {
     };
 
     # Create a user for each app.
-    users.users = let
+    users.users = {
-      mkUser = uid: {
+      bazarr = lib.mkIf cfg.bazarr.enable {
-        uid = lib.mkForce uid;
+        uid = lib.mkForce 3003;
         isSystemUser = true;
         group = config.users.groups.media.name;
         home = "/var/empty";
         shell = null;
       };
-    in {
+      prowlarr = lib.mkIf cfg.prowlarr.enable {
-      bazarr = lib.mkIf cfg.bazarr.enable (mkUser 3003);
+        uid = lib.mkForce 3004;
-      prowlarr = lib.mkIf cfg.prowlarr.enable (mkUser 3004);
+        isSystemUser = true;
-      qbittorrent = lib.mkIf cfg.qbittorrent.enable (mkUser 3005) // {
+        group = config.users.groups.media.name;
+        home = "/var/empty";
+        shell = null;
+      };
+      qbittorrent = lib.mkIf cfg.qbittorrent.enable {
+        uid = lib.mkForce 3005;
+        isSystemUser = true;
+        group = config.users.groups.media.name;
         extraGroups = [
           config.users.groups.apps.name
         ];
+        home = "/var/empty";
+        shell = null;
+      };
+      radarr = lib.mkIf cfg.radarr.enable {
+        uid = lib.mkForce 3006;
+        isSystemUser = true;
+        group = config.users.groups.media.name;
+        home = "/var/empty";
+        shell = null;
+      };
+      sonarr = lib.mkIf cfg.sonarr.enable {
+        uid = lib.mkForce 3007;
+        isSystemUser = true;
+        group = config.users.groups.media.name;
+        home = "/var/empty";
+        shell = null;
       };
-      radarr = lib.mkIf cfg.radarr.enable (mkUser 3006);
-      sonarr = lib.mkIf cfg.sonarr.enable (mkUser 3007);
     };
 
     virtualisation.oci-containers.containers = let

modules/apps/freshrss/default.nix

@@ -27,7 +27,7 @@ in {
         "rw"
         "auto"
         "nfsvers=4.2"
-        "async" "soft" "timeo=600"
+        "sync" "hard" "timeo=600"
         "retrans=2"
         "_netdev"
         "nosuid"
@@ -53,41 +53,24 @@ in {
 
     virtualisation.oci-containers.containers.freshrss = {
       hostname = "freshrss";
-      image = "freshrss/freshrss:1.25.0";
+      image = "freshrss/freshrss:1.24.0";
       autoStart = true;
       user = "0:33";
       ports = [
-        "${toString port}:80/tcp"
+        "${toString port}:${toString port}/tcp"
       ];
       extraOptions = [
         "--network=${networkName}"
       ];
       environment = {
         TZ = config.time.timeZone;
-        CRON_MIN = "3,18,33,48"; # Alternatively, configure cron inside container.
+        CRON_TIME = "3,18,33,48"; # Alternatively, configure cron inside container.
-        SERVER_DNS = "rss.depeuter.dev";
+        LISTEN = "0.0.0.0:${toString port}";
-        TRUSTED_PROXY = "172.16.0.1/12 192.168.0.1/16";
       };
       volumes = [
         "/srv/freshrss/www/freshrss/data:/var/www/FreshRSS/data"
         "/srv/freshrss/www/freshrss/extensions:/var/www/FreshRSS/extensions"
       ];
-      labels = {
-        "traefik.enable" = "true";
-      
-        "traefik.http.middlewares.freshrssM1.compress" = "true";
-        "traefik.http.middlewares.freshrssM2.headers.browserXssFilter" = "true";
-        "traefik.http.middlewares.freshrssM2.headers.forceSTSHeader" = "true";
-        "traefik.http.middlewares.freshrssM2.headers.frameDeny" = "true";
-        "traefik.http.middlewares.freshrssM2.headers.referrerPolicy" = "no-referrer-when-downgrade";
-        "traefik.http.middlewares.freshrssM2.headers.stsSeconds" = "31536000";
-        "traefik.http.routers.freshrss.entryPoints" = "websecure";
-        "traefik.http.routers.freshrss.tls" = "true";
-
-        "traefik.http.services.freshrss.loadbalancer.server.port" = "80";
-        "traefik.http.routers.freshrss.middlewares" = "freshrssM1,freshrssM2";
-        "traefik.http.routers.freshrss.rule" = "Host(`rss.depeuter.dev`)";
-      };
     };
   };
 }

modules/apps/gitea/default.nix

@@ -124,7 +124,7 @@ in {
 
       gitea = {
         hostname = "gitea";
-        image = "codeberg.org/forgejo/forgejo:11.0.1-rootless";
+        image = "codeberg.org/forgejo/forgejo:8.0.3-rootless";
         autoStart = true;
         user = "${toString UID}:${toString GID}";
         ports = [
@@ -576,7 +576,7 @@ in {
           #FORGEJO__picture__AVATAR_RENDERED_SIZE_FACTOR = "2";
           # Maximum allowed file size for uploaded avatars.
           # This is to limit the amount of RAM used when resizing the image.
-          FORGEJO__picture__AVATAR_MAX_FILE_SIZE = "1048576";
+          #FORGEJO__picture__AVATAR_MAX_FILE_SIZE = "1048576";
           # If the uploaded file is not larger than this byte size, the image will be used as is, without resizing/converting.
           #FORGEJO__picture__AVATAR_MAX_ORIGIN_SIZE = "262144";
           # Chinese users can choose "duoshuo"

modules/apps/homepage/default.nix

@@ -0,0 +1,59 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.homelab.apps.homepage-dashboard;
+
+  networkName = "homepage";
+in {
+  options.homelab.apps.homepage-dashboard = {
+    enable = lib.mkEnableOption "homepage";
+    port = lib.mkOption {
+      type = lib.types.int;
+      default = 8082;
+      description = "Homepage port";
+    };
+  };
+
+  config = let
+    inherit (config.homelab.apps.homepage-dashboard) port;
+  in lib.mkIf cfg.enable {
+    services.homepage-dashboard = {
+      enable = true;
+      package = pkgs.homepage-dashboard;
+
+      listenPort = port;
+
+      bookmarks = [
+        { Office = [
+          { "Zoho Mail" = [
+            { href = "https://mail.zoho.eu";
+              icon = "zohomail";
+            }
+          ];}
+        ];}
+        { Network = [
+          { Cloudflare = [
+            { href = "https://dash.cloudflare.com";
+              icon = "cloudflare";
+            }
+          ];}
+          { TransIP = [
+            { href = "https://www.transip.eu/cp/";
+              icon = "https://www.transip.eu/cache-60c9b25f/img/transip-new/favicons/favicon.png";
+            }
+          ];}
+          { "Telenet Modem" = [
+            { href = "https://www2.telenet.be/residential/nl/mijn-telenet/je-thuisnetwerk#/mainnavitem=hgw/mainnavitemid=item-1/subnavitem=modem_general";
+              icon = "https://static.telenet.be/assets/favicon/favicon.ico";
+            }
+          ];}
+          { Pulsetic = [
+            { href = "https://status.depeuter.dev";
+              icon = "https://pulsetic.com/favicon-196x196.png";
+            }
+          ];}
+        ];}
+      ];
+    };
+  };
+}

modules/default.nix

@@ -1,7 +1,6 @@
 {
   imports = [
     ./apps
-    ./fileSystems
     ./services
     ./virtualisation
 

secrets/secrets.yaml

@@ -1,19 +0,0 @@
-users:
-    admin:
-        authorized_keys:
-            NixOS: ENC[AES256_GCM,data:sj2hkUkWp628KuXp+AnncLdawHpxb9fH1ZHnIisP0x9Tght9+/X2sWHpuMSeqi2i/R8B+Wgte66QkuwAOB0j+oB9N+66EhehmWZlK5hD/22p,iv:z18U+LvAQgPDfBBewE3lJmWZd0NGCPwJIe/h3tupuZc=,tag:ZJar3spO66JbDXygdTHh2w==,type:str]
-sops:
-    age:
-        - recipient: age1qzutny0mqpcccqw6myyfntu6wcskruu9ghzvt6r4te7afkqwnguq05ex37
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjUSt2REk2Mmd0bk9ubjJk
-            dXFiY2JNR1dyZW9qTUdzaWZhY3c3amVwQzA0CkZHNVpZVjhsWXhVQVNaR0xONzhh
-            Y0lQaWNaNmpYYVdrRnZIZUhvUFUzcWMKLS0tIDAvSmF0VmpxcnZEQStXUjNCUE5Z
-            RnA2Lzk2WHFxOEh6dHN0aGhVSVpLTW8KA7IOvGDMBtgo4pe0Sw3Lol243xCDAJ4i
-            PhcJFiUObVRFZN7ISlULnOlTO3pT9jWvvmC5rDZWId3PQ8qjPvnOUg==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-10-04T17:33:22Z"
-    mac: ENC[AES256_GCM,data:I7I7uDFEWfw9+4KROtjHMVhaxYrVK5QmLfFZShSajF0A2Zxu9lg+fDGiMHk40JC5zD31P70QS/ipye1mBGQbCbLEA7uBUhNzZ7G1g58cIXF6vSGmt0fovm0MVSxEJ44r05fx6uT4OJu5BYVxYSlG84gTj9rCFXxxcBJMrh+6yaI=,iv:c1vudsp9bg0Pc2ddRyvWn6Tf0LhqNuEjxG9D4PpHqxs=,tag:K/1PSHhrTdsNPcPmRv/2Ew==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.10.2

users/admin/default.nix

@@ -3,30 +3,24 @@
 let
   cfg = config.homelab.users.admin;
 in {
-  options.homelab.users.admin = {
+  options.homelab.users.admin.enable = lib.mkEnableOption "user System Administrator";
-    enable = lib.mkEnableOption "user System Administrator";
-    authorizedKeys = lib.mkOption {
-      type = lib.types.listOf lib.types.str;
-      default = [
-        # HomeLab > NixOS > admin > ssh
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGWIOOEqTy8cWKpENVbzD4p7bsQgQb/Dgpzk8i0dZ00T"
-      ];
-    };
-  };
 
   config = lib.mkIf cfg.enable {
     nix.settings.trusted-users = [
-      config.users.users.gh0st.name
+      config.users.users.admin.name
     ];
 
-    users.users.gh0st = {
+    users.users.admin = {
       description = "System Administrator";
       isNormalUser = true;
       extraGroups = [
         config.users.groups.wheel.name # Enable 'sudo' for the user.
       ];
       initialPassword = "ChangeMe";
-      openssh.authorizedKeys.keys = cfg.authorizedKeys;
+      openssh.authorizedKeys.keys = [
+        # TODO ChangeMe
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPrG+ldRBdCeHEXrsy/qHXIJYg8xQXVuiUR0DxhFjYNg"
+      ];
       packages = with pkgs; [
         curl
         git

users/backup/default.nix

@@ -13,8 +13,13 @@ in {
         "docker" # Allow access to the docker socket.
       ];
       openssh.authorizedKeys.keys = [
+        # TODO ChangeMe
+
+        # Tibo-NixFat
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPrG+ldRBdCeHEXrsy/qHXIJYg8xQXVuiUR0DxhFjYNg"
+
         # Hugo
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICms6vjhE9kOlqV5GBPGInwUHAfCSVHLI2Gtzee0VXPh"
+        "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDAxR813vqq5zbu1NHrIybu5Imlu3k0rDCGxHiuGEhPoVV9c5FpnKNGLCi3ctm15ZcVBX4HcponYsKRBsCzM2pI4uXjxhHkLzbss5LttFuSzv5v/QHfLW1bvyJEMBEPxguGqAydAeWrBFdI9uHBEXeb325uKxMKBZHYvvpyAQ115c1wKy1bL8BfR0LTkhsFqexRvI86q59AVrAU/KFf6RXO0T9QA6H/vyWLlIPc7Ta+tSWwQ68bMmS5Pwn8q58tOAOAd6Lpt4TqUDJSppPjLEPKyKC6ShwMdEjwmwpEG0hxfsvaU8XERyQbSbEE9sLHRA2LoEdtMx3J8nzX3AwYUNspsqIv6NQZksnVqJ8OfL45ngUFcSJ6kBsUvCZfzEUGUTJ6Js0v84NOIXxNG/ZfPsk6ArXm3dvj2TYeK8llO6wpJnMMyztmmiODWoj9tepZSij44IgVM5wdWYIK/RZoYTsCQbmvJFfB8jhyJnf/7F19Vo5+LwhmCOsQh/KEK0F1DVc= admin@Hugo"
       ];
     };
   };