chore(ssh): Update keys

Flake lock file updates:

• Updated input 'nixpkgs':
    'github:NixOS/nixpkgs/7df7ff7d8e00218376575f0acdcc5d66741351ee?narHash=sha256-gTrEEp5gEspIcCOx9PD8kMaF1iEmfBcTbO0Jag2QhQs%3D' (2025-10-02)
  → 'github:NixOS/nixpkgs/544961dfcce86422ba200ed9a0b00dd4b1486ec5?narHash=sha256-EVAqOteLBFmd7pKkb0%2BFIUyzTF61VKi7YmvP1tw4nEw%3D' (2025-10-15)
• Updated input 'sops-nix':
    'github:Mic92/sops-nix/9fcfabe085281dd793589bdc770a2e577a3caa5d?narHash=sha256-f9QC2KKiNReZDG2yyKAtDZh0rSK2Xp1wkPzKbHeQVRU%3D' (2025-09-29)
  → 'github:Mic92/sops-nix/ab8d56e85b8be14cff9d93735951e30c3e86a437?narHash=sha256-8mN3kqyqa2PKY0wwZ2UmMEYMcxvNTwLaOrrDsw6Qi4E%3D' (2025-10-13)

.gitignore

@@ -0,0 +1 @@
+.idea

.sops.yaml

@@ -0,0 +1,10 @@
+keys:
+  - &tdpeuter_Tibo-NixFatDesk age1fva6s64s884z0q2w7de024sp69ucvqu0pg9shrhhqsn3ewlpjfpsh6md7y
+  - &tdpeuter_Tibo-NixTop age1qzutny0mqpcccqw6myyfntu6wcskruu9ghzvt6r4te7afkqwnguq05ex37
+
+creation_rules:
+  - path_regex: secrets/[^/]+\.(yaml|json|env|ini)$
+    key_groups:
+    - age:
+        - *tdpeuter_Tibo-NixFatDesk
+        - *tdpeuter_Tibo-NixTop

flake.lock

@@ -20,11 +20,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1735291276,
-        "narHash": "sha256-NYVcA06+blsLG6wpAbSPTCyLvxD/92Hy4vlY9WxFI1M=",
+        "lastModified": 1760524057,
+        "narHash": "sha256-EVAqOteLBFmd7pKkb0+FIUyzTF61VKi7YmvP1tw4nEw=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "634fd46801442d760e09493a794c4f15db2d0cbb",
+        "rev": "544961dfcce86422ba200ed9a0b00dd4b1486ec5",
         "type": "github"
       },
       "original": {
@@ -37,9 +37,30 @@
       "inputs": {
         "flake-utils": "flake-utils",
         "nixpkgs": "nixpkgs",
+        "sops-nix": "sops-nix",
         "utils": "utils"
       }
     },
+    "sops-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1760393368,
+        "narHash": "sha256-8mN3kqyqa2PKY0wwZ2UmMEYMcxvNTwLaOrrDsw6Qi4E=",
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "rev": "ab8d56e85b8be14cff9d93735951e30c3e86a437",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "type": "github"
+      }
+    },
     "systems": {
       "locked": {
         "lastModified": 1681028828,
@@ -62,11 +83,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1722363685,
-        "narHash": "sha256-XCf2PIAT6lH7BwytgioPmVf/wkzXjSKScC4KzcZgb64=",
+        "lastModified": 1738591040,
+        "narHash": "sha256-4WNeriUToshQ/L5J+dTSWC5OJIwT39SEP7V7oylndi8=",
         "owner": "gytis-ivaskevicius",
         "repo": "flake-utils-plus",
-        "rev": "6b10f51ff73a66bb29f3bc8151a59d217713f496",
+        "rev": "afcb15b845e74ac5e998358709b2b5fe42a948d1",
         "type": "github"
       },
       "original": {

flake.nix

@@ -5,6 +5,10 @@
     nixpkgs.url = "nixpkgs/nixos-unstable";
 
     flake-utils.url = "github:numtide/flake-utils";
+    sops-nix = {
+      url = "github:Mic92/sops-nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
     utils = {
       url = "github:gytis-ivaskevicius/flake-utils-plus";
       inputs.flake-utils.follows = "flake-utils";
@@ -13,11 +17,11 @@
 
   outputs = inputs@{
     self, nixpkgs,
-    flake-utils, utils,
+    flake-utils, sops-nix, utils,
     ...
   }:
   let
-    system = "x86_64-linux";
+    system = utils.lib.system.x86_64-linux;
   in
   utils.lib.mkFlake {
     inherit self inputs;
@@ -28,22 +32,30 @@
       modules = [
         ./modules
         ./users
+
+        sops-nix.nixosModules.sops
       ];
     };
 
     hosts = {
-      Niko.modules        = [ ./hosts/Niko          ];
+      # Physical hosts
+      Niko.modules          = [ ./hosts/Niko          ];
 
+      # Virtual machines
+
+      # Single-service
       Ingress.modules       = [ ./hosts/Ingress       ];
       Gitea.modules         = [ ./hosts/Gitea         ];
       Vaultwarden.modules   = [ ./hosts/Vaultwarden   ];
 
+      # Production multi-service
       Binnenpost.modules    = [ ./hosts/Binnenpost    ];
       Production.modules    = [ ./hosts/Production    ];
       ProductionGPU.modules = [ ./hosts/ProductionGPU ];
       ProductionArr.modules = [ ./hosts/ProductionArr ];
       ACE.modules           = [ ./hosts/ACE           ];
 
+      # Others
       Template.modules      = [ ./hosts/Template      ];
       Development.modules   = [ ./hosts/Development   ];
       Testing.modules       = [ ./hosts/Testing       ];

hosts/Binnenpost/default.nix

@@ -16,6 +16,7 @@
       apps = {
         speedtest.enable = true;
         technitiumDNS.enable = true;
+        traefik.enable = true;
       };
       virtualisation.guest.enable = true;
     };
@@ -76,6 +77,14 @@
       };
     };
 
+    virtualisation.oci-containers.containers.traefik.labels = {
+      "traefik.http.routers.roxanne.rule" = "Host(`roxanne.depeuter.dev`)";
+      "traefik.http.services.roxanne.loadbalancer.server.url" = "https://192.168.0.13:8006";
+
+      "traefik.http.routers.hugo.rule" = "Host(`hugo.depeuter.dev`)";
+      "traefik.http.services.hugo.loadbalancer.server.url" = "https://192.168.0.11:444";
+    };
+
     system.stateVersion = "24.05";
   };
 }

hosts/Gitea/default.nix

@@ -5,6 +5,13 @@
     homelab = {
       apps.gitea.enable = true;
       virtualisation.guest.enable = true;
+
+      users.admin = {
+        enable = true;
+        authorizedKeys = [
+          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFrp6aM62Bf7bj1YM5AlAWuNrANU3N5e8+LtbbpmZPKS"
+        ];
+      };
     };
 
     networking = {

hosts/Ingress/default.nix

@@ -59,6 +59,7 @@ prefixLength = 24;
         };
         "cloud.depeuter.dev" = { };
         "git.depeuter.dev"   = { };
+        "home.depeuter.dev"  = { };
         "jelly.depeuter.dev" = { };
         "vault.depeuter.dev" = { };
       };
@@ -136,10 +137,27 @@ prefixLength = 24;
               proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
             '';
           };
-          "calendar.depeuter.dev".locations."/".return = "301 https://cloud.depeuter.dev/apps/calendar";
+          "calendar.depeuter.dev" = {
+            useACMEHost = "depeuter.dev";
+            locations."/".return = "301 https://cloud.depeuter.dev/apps/calendar";
+          };
           "tasks.depeuter.dev".locations."/".return = "301 https://cloud.depeuter.dev/apps/tasks";
           "notes.depeuter.dev".locations."/".return = "301 https://cloud.depeuter.dev/apps/notes";
 
+          "home.depeuter.dev" = {
+            enableACME = true;
+            forceSSL = true;
+            locations."/" = {
+              proxyPass = "http://192.168.0.21:8123";
+              extraConfig = ''
+                proxy_http_version 1.1;
+                proxy_set_header Upgrade $http_upgrade;
+                proxy_set_header Connection "Upgrade";
+                proxy_set_header Host $host;
+              '';
+            };
+          };
+
           "jelly.depeuter.dev" = {
             enableACME = true;
             forceSSL = true;
@@ -176,7 +194,7 @@ prefixLength = 24;
               };
             };
             extraConfig = ''
-              client_max_body_size 20M;
+              client_max_body_size 512M;
 
               # Security / XSS Mitigation Headers
               # NOTE: X-Frame-Options may cause issues with the webOS app
@@ -206,7 +224,7 @@ prefixLength = 24;
               proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
               proxy_set_header X-Forwarded-Proto $scheme;
 
-              client_max_body_size 512M;
+              client_max_body_size 10G;
               keepalive_timeout 600s;
               proxy_buffers 4 256k;     # Number and size of buffers for reading response
               proxy_buffer_size 256k;  # Buffer for the first part of the response
@@ -220,10 +238,18 @@ prefixLength = 24;
             enableACME = true;
             forceSSL = true;
             locations = {
-              "/".proxyPass = "http://192.168.0.22:10102";
+              "/" = {
+                proxyPass = "http://192.168.0.22:10102";
+                proxyWebSockets = true;
+              };
               "~ ^/admin".return = 403;
             };
           };
+          "rss.depeuter.dev" = {
+            enableACME = true;
+            forceSSL = true;
+            locations."/".proxyPass = "http://192.168.92:${toString config.homelab.apps.freshrss.port}";
+          };
         };
       };
     };

hosts/Niko/default.nix

@@ -7,7 +7,10 @@
   ];
 
   homelab = {
-    apps.technitiumDNS.enable = true;
+    apps = {
+      technitiumDNS.enable = true;
+      traefik.enable = true;
+    };
     users.deploy.enable = true;
   };
 
@@ -34,12 +37,11 @@
   hardware = {
     enableRedistributableFirmware = true;
     enableAllFirmware = true;
-    pulseaudio.enable = true;
-    opengl.enable = true;
+    graphics.enable = true;
   };
 
   # Select internationalisation properties.
-  i18n.defaultLocale = "en_GB.utf8";
+  i18n.defaultLocale = "en_GB.UTF-8";
 
   networking = {
     hostName = "Niko";
@@ -79,6 +81,8 @@
       user = config.users.users.jellyfin-mpv-shim.name;
     };
 
+    pulseaudio.enable = true;
+
     tailscale = {
       enable = true;
       useRoutingFeatures = "server";
@@ -94,8 +98,6 @@
     # resolved.enable = true;
   };
 
-  sound.enable = true;
-
   # Define a user account. Don't forget to set a password with 'passwd'.
   users.users.jellyfin-mpv-shim = {
     description = "Jellyfin MPV Shim User";
@@ -114,67 +116,4 @@
   systemd.services."cage-tty1".serviceConfig.Restart = "always";
 
   system.stateVersion = "24.05";
-
-  virtualisation = {
-    # Enable Android emulator
-    # waydroid.enable = true;
-
-    docker = {
-      enable = true;
-      autoPrune.enable = true;
-    };
-
-    oci-containers = {
-      backend = "docker";
-      containers = {
-        reverse-proxy = {
-          hostname = "traefik";
-          image = "traefik:v3.0";
-          cmd = [
-            "--api.insecure=true"
-            # Add Docker provider
-            "--providers.docker=true"
-            "--providers.docker.exposedByDefault=false"
-            # Add web entrypoint
-            "--entrypoints.web.address=:80/tcp"
-            "--entrypoints.web.http.redirections.entrypoint.to=websecure"
-            "--entrypoints.web.http.redirections.entrypoint.scheme=https"
-            # Add websecure entrypoint
-            "--entrypoints.websecure.address=:443/tcp"
-            "--entrypoints.websecure.http.tls=true"
-            "--entrypoints.websecure.http.tls.certResolver=letsencrypt"
-            "--entrypoints.websecure.http.tls.domains[0].main=depeuter.dev"
-            "--entrypoints.websecure.http.tls.domains[0].sans=*.depeuter.dev"
-            "--entrypoints.websecure.http.tls.domains[1].sans=*.niko.depeuter.dev"
-            # Certificates
-            "--certificatesresolvers.letsencrypt.acme.dnschallenge=true"
-            "--certificatesresolvers.letsencrypt.acme.dnschallenge.provider=cloudflare"
-            "--certificatesresolvers.letsencrypt.acme.email=tibo.depeuter@telenet.be"
-            "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
-          ];
-          ports = [
-            "80:80/tcp"
-            "443:443/tcp"
-            # "8080:8080/tcp" # The Web UI (enabled by --api.insecure=true)
-          ];
-          environment = {
-            # TODO Hide this!
-            "CLOUDFLARE_DNS_API_TOKEN" = "6Vz64Op_a6Ls1ljGeBxFoOVfQ-yB-svRbf6OyPv2";
-          };
-          environmentFiles = [
-          ];
-          volumes = [
-            "/var/run/docker.sock:/var/run/docker.sock:ro" # So that Traefik can listen to the Docker events
-            "letsencrypt:/letsencrypt"
-          ];
-          labels = {
-            "traefik.enable" = "true";
-            "traefik.http.routers.traefik.rule" = "Host(`traefik.niko.depeuter.dev`)";
-            "traefik.http.services.traefik.loadbalancer.server.port" = "8080";
-          };
-          autoStart = true;
-        };
-      };
-    };
-  };
 }

hosts/ProductionGPU/default.nix

@@ -17,7 +17,7 @@
 
       defaultGateway = {
         address = "192.168.0.1";
-        interface = "enp6s18";
+        interface = "ens18";
       };
 
       # Open ports in the firewall.
@@ -25,7 +25,7 @@
         enable = true;
       };
 
-      interfaces.enp6s18 = {
+      interfaces.ens18 = {
         ipv4.addresses = [
           {
             address = "192.168.0.94";
@@ -40,7 +40,7 @@
       ];
     };
 
-    system.stateVersion = "unstable";
+    system.stateVersion = "24.11";
 
     ### Nvidia GPU support ###
 
@@ -64,7 +64,7 @@
     };
 
     hardware = {
-      opengl = {
+      graphics = {
         enable = true;
         # driSupport = true;
         # driSupport32Bit = true;

hosts/Testing/default.nix

@@ -3,7 +3,10 @@
 {
   config = {
     homelab = {
-      apps.freshrss.enable = true;
+      apps = {
+        freshrss.enable = true;
+        traefik.enable = true;
+      };
       virtualisation.guest.enable = true;
     };
 

hosts/Vaultwarden/default.nix

@@ -9,6 +9,13 @@
         name = "Hugo's Vault";
       };
       virtualisation.guest.enable = true;
+
+      users.admin = {
+        enable = true;
+        authorizedKeys = [
+          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJnihoyozOCnm6T9OzL2xoMeMZckBYR2w43us68ABA93"
+        ];
+      };
     };
 
     networking = {

modules/apps/arr/default.nix

@@ -12,7 +12,16 @@ let
   PGID = toString config.users.groups.media.gid;
   UMASK = "002";
 in {
-  options.homelab.apps.arr = {
+  options.homelab.apps.arr = let
+    mkAppOption = appName: {
+      enable = lib.mkEnableOption "${appName} using Docker";
+      exposePorts = lib.mkOption {
+        type = lib.types.bool;
+        description = "Expose ${appName} port";
+        default = cfg.exposePorts;
+      };
+    };
+  in {
     enable = lib.mkEnableOption "Arr Stack using Docker";
     exposePorts = lib.mkOption {
       type = lib.types.bool;
@@ -21,46 +30,11 @@ in {
       default = ! config.homelab.apps.traefik.enable;
     };
 
-    bazarr = {
-      enable = lib.mkEnableOption "Bazarr using Docker";
-      exposePorts = lib.mkOption {
-        type = lib.types.bool;
-        description = "Expose Bazarr port";
-        default = cfg.exposePorts;
-      };
-    };
-    prowlarr = {
-      enable = lib.mkEnableOption "Prowlarr using Docker";
-      exposePorts = lib.mkOption {
-        type = lib.types.bool;
-        description = "Expose Prowlarr port";
-        default = cfg.exposePorts;
-      };
-    };
-    qbittorrent = {
-      enable = lib.mkEnableOption "qBittorrent using Docker";
-      exposePorts = lib.mkOption {
-        type = lib.types.bool;
-        description = "Expose qBittorrent port";
-        default = cfg.exposePorts;
-      };
-    };
-    radarr = {
-      enable = lib.mkEnableOption "Radarr using Docker";
-      exposePorts = lib.mkOption {
-        type = lib.types.bool;
-        description = "Expose Radarr port";
-        default = cfg.exposePorts;
-      };
-    };
-    sonarr = {
-      enable = lib.mkEnableOption "Sonarr using Docker";
-      exposePorts = lib.mkOption {
-        type = lib.types.bool;
-        description = "Expose Sonarr port";
-        default = cfg.exposePorts;
-      };
-    };
+    bazarr = mkAppOption "Bazarr";
+    prowlarr = mkAppOption "Prowlarr";
+    qbittorrent = mkAppOption "qBittorrent";
+    radarr = mkAppOption "Radarr";
+    sonarr = mkAppOption "Sonarr";
   };
 
   config = {
@@ -87,9 +61,9 @@ in {
       virtualisation.containers.enable = lib.mkIf inUse true;
     };
 
-    fileSystems = lib.mkIf inUse {
-      "/srv/bazarr-backup" = lib.mkIf cfg.bazarr.enable {
-        device = "192.168.0.11:/mnt/BIG/BACKUP/BAZARR";
+    fileSystems = let
+      mkFileSystem = device: {
+        inherit device;
         fsType = "nfs";
         options = [
           "rw"
@@ -102,75 +76,14 @@ in {
         ];
       };
 
-      "/srv/prowlarr-backup" = lib.mkIf cfg.prowlarr.enable {
-        device = "192.168.0.11:/mnt/BIG/BACKUP/PROWLARR";
-        fsType = "nfs";
-        options = [
-          "rw"
-          "auto"
-          "nfsvers=4.2"
-          "rsize=1048576" "wsize=1048576"
-          "hard"
-          "timeo=600" "retrans=2"
-          "_netdev" "nosuid" "tcp"
-        ];
-      };
-
-      "/srv/qbittorrent" = lib.mkIf cfg.qbittorrent.enable {
-        device = "192.168.0.11:/mnt/SMALL/CONFIG/QBITTORRENT";
-        fsType = "nfs";
-        options = [
-          "rw"
-          "auto"
-          "nfsvers=4.2"
-          "rsize=1048576" "wsize=1048576"
-          "hard"
-          "timeo=600" "retrans=2"
-          "_netdev" "nosuid" "tcp"
-        ];
-      };
-
-      "/srv/radarr-backup" = lib.mkIf cfg.radarr.enable {
-        device = "192.168.0.11:/mnt/BIG/BACKUP/RADARR";
-        fsType = "nfs";
-        options = [
-          "rw"
-          "auto"
-          "nfsvers=4.2"
-          "rsize=1048576" "wsize=1048576"
-          "hard"
-          "timeo=600" "retrans=2"
-          "_netdev" "nosuid" "tcp"
-        ];
-      };
-
-      "/srv/sonarr-backup" = lib.mkIf cfg.sonarr.enable {
-        device = "192.168.0.11:/mnt/BIG/BACKUP/SONARR";
-        fsType = "nfs";
-        options = [
-          "rw"
-          "auto"
-          "nfsvers=4.2"
-          "rsize=1048576" "wsize=1048576"
-          "hard"
-          "timeo=600" "retrans=2"
-          "_netdev" "nosuid" "tcp"
-        ];
-      };
-
-      "/srv/torrent" = {
-        device = "192.168.0.11:/mnt/SMALL/MEDIA/TORRENT";
-        fsType = "nfs";
-        options = [
-          "rw"
-          "auto"
-          "nfsvers=4.2"
-          "rsize=1048576" "wsize=1048576"
-          "hard"
-          "timeo=600" "retrans=2"
-          "_netdev" "nosuid" "tcp"
-        ];
-      };
+      hugoBackup = "192.168.0.11:/mnt/BIG/BACKUP";
+    in lib.mkIf inUse {
+      "/srv/bazarr-backup" = lib.mkIf cfg.bazarr.enable (mkFileSystem "${hugoBackup}/BAZARR");
+      "/srv/prowlarr-backup" = lib.mkIf cfg.bazarr.enable (mkFileSystem "${hugoBackup}/PROWLARR");
+      "/srv/qbittorrent" = lib.mkIf cfg.qbittorrent.enable (mkFileSystem "192.168.0.11:/mnt/SMALL/CONFIG/QBITTORRENT");
+      "/srv/radarr-backup" = lib.mkIf cfg.radarr.enable (mkFileSystem "${hugoBackup}/RADARR");
+      "/srv/sonarr-backup" = lib.mkIf cfg.sonarr.enable (mkFileSystem "${hugoBackup}/SONARR");
+      "/srv/torrent" = mkFileSystem "192.168.0.11:/mnt/SMALL/MEDIA/TORRENT";
     };
 
     # Make sure the Docker network exists.
@@ -195,45 +108,24 @@ in {
     };
 
     # Create a user for each app.
-    users.users = {
-      bazarr = lib.mkIf cfg.bazarr.enable {
-        uid = lib.mkForce 3003;
+    users.users = let
+      mkUser = uid: {
+        uid = lib.mkForce uid;
         isSystemUser = true;
         group = config.users.groups.media.name;
         home = "/var/empty";
         shell = null;
       };
-      prowlarr = lib.mkIf cfg.prowlarr.enable {
-        uid = lib.mkForce 3004;
-        isSystemUser = true;
-        group = config.users.groups.media.name;
-        home = "/var/empty";
-        shell = null;
-      };
-      qbittorrent = lib.mkIf cfg.qbittorrent.enable {
-        uid = lib.mkForce 3005;
-        isSystemUser = true;
-        group = config.users.groups.media.name;
+    in {
+      bazarr = lib.mkIf cfg.bazarr.enable (mkUser 3003);
+      prowlarr = lib.mkIf cfg.prowlarr.enable (mkUser 3004);
+      qbittorrent = lib.mkIf cfg.qbittorrent.enable (mkUser 3005) // {
         extraGroups = [
           config.users.groups.apps.name
         ];
-        home = "/var/empty";
-        shell = null;
-      };
-      radarr = lib.mkIf cfg.radarr.enable {
-        uid = lib.mkForce 3006;
-        isSystemUser = true;
-        group = config.users.groups.media.name;
-        home = "/var/empty";
-        shell = null;
-      };
-      sonarr = lib.mkIf cfg.sonarr.enable {
-        uid = lib.mkForce 3007;
-        isSystemUser = true;
-        group = config.users.groups.media.name;
-        home = "/var/empty";
-        shell = null;
       };
+      radarr = lib.mkIf cfg.radarr.enable (mkUser 3006);
+      sonarr = lib.mkIf cfg.sonarr.enable (mkUser 3007);
     };
 
     virtualisation.oci-containers.containers = let

modules/apps/freshrss/default.nix

@@ -27,7 +27,7 @@ in {
         "rw"
         "auto"
         "nfsvers=4.2"
-        "sync" "hard" "timeo=600"
+        "async" "soft" "timeo=600"
         "retrans=2"
         "_netdev"
         "nosuid"
@@ -53,24 +53,41 @@ in {
 
     virtualisation.oci-containers.containers.freshrss = {
       hostname = "freshrss";
-      image = "freshrss/freshrss:1.24.0";
+      image = "freshrss/freshrss:1.25.0";
       autoStart = true;
       user = "0:33";
       ports = [
-        "${toString port}:${toString port}/tcp"
+        "${toString port}:80/tcp"
       ];
       extraOptions = [
         "--network=${networkName}"
       ];
       environment = {
         TZ = config.time.timeZone;
-        CRON_TIME = "3,18,33,48"; # Alternatively, configure cron inside container.
-        LISTEN = "0.0.0.0:${toString port}";
+        CRON_MIN = "3,18,33,48"; # Alternatively, configure cron inside container.
+        SERVER_DNS = "rss.depeuter.dev";
+        TRUSTED_PROXY = "172.16.0.1/12 192.168.0.1/16";
       };
       volumes = [
         "/srv/freshrss/www/freshrss/data:/var/www/FreshRSS/data"
         "/srv/freshrss/www/freshrss/extensions:/var/www/FreshRSS/extensions"
       ];
+      labels = {
+        "traefik.enable" = "true";
+      
+        "traefik.http.middlewares.freshrssM1.compress" = "true";
+        "traefik.http.middlewares.freshrssM2.headers.browserXssFilter" = "true";
+        "traefik.http.middlewares.freshrssM2.headers.forceSTSHeader" = "true";
+        "traefik.http.middlewares.freshrssM2.headers.frameDeny" = "true";
+        "traefik.http.middlewares.freshrssM2.headers.referrerPolicy" = "no-referrer-when-downgrade";
+        "traefik.http.middlewares.freshrssM2.headers.stsSeconds" = "31536000";
+        "traefik.http.routers.freshrss.entryPoints" = "websecure";
+        "traefik.http.routers.freshrss.tls" = "true";
+
+        "traefik.http.services.freshrss.loadbalancer.server.port" = "80";
+        "traefik.http.routers.freshrss.middlewares" = "freshrssM1,freshrssM2";
+        "traefik.http.routers.freshrss.rule" = "Host(`rss.depeuter.dev`)";
+      };
     };
   };
 }

modules/apps/gitea/default.nix

@@ -124,7 +124,7 @@ in {
 
       gitea = {
         hostname = "gitea";
-        image = "codeberg.org/forgejo/forgejo:8.0.3-rootless";
+        image = "codeberg.org/forgejo/forgejo:11.0.1-rootless";
         autoStart = true;
         user = "${toString UID}:${toString GID}";
         ports = [
@@ -576,7 +576,7 @@ in {
           #FORGEJO__picture__AVATAR_RENDERED_SIZE_FACTOR = "2";
           # Maximum allowed file size for uploaded avatars.
           # This is to limit the amount of RAM used when resizing the image.
-          #FORGEJO__picture__AVATAR_MAX_FILE_SIZE = "1048576";
+          FORGEJO__picture__AVATAR_MAX_FILE_SIZE = "1048576";
           # If the uploaded file is not larger than this byte size, the image will be used as is, without resizing/converting.
           #FORGEJO__picture__AVATAR_MAX_ORIGIN_SIZE = "262144";
           # Chinese users can choose "duoshuo"

modules/apps/penpot/default.nix

@@ -1,220 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-let
-  cfg = config.homelab.apps.penpot;
-
-  networkName = "penpot";
-  UID = config.users.users.apps.uid;
-  GID = config.users.groups.apps.gid;
-
-  version = "2.5.4";
-
-  srvPath = "/srv/penpot";
-  assetsPath = "/opt/data/assets";
-
-  PENPOT_FLAGS = "enable-smtp enable-prepl-server disable-secure-session-cookies disable-onboarding disable-registration";
-  # Max body size (30MiB); Used for plain requests, should never be
-  # greater than multi-part size
-  PENPOT_HTTP_SERVER_MAX_BODY_SIZE = "31457280";
-  # Max multipart body size (350MiB)
-  PENPOT_HTTP_SERVER_MAX_MULTIPART_BODY_SIZE = "367001600";
-
-  dbName = "penpot";
-  dbUser = "penpot";
-  dbPass = "penpot";
-
-  docker = config.virtualisation.oci-containers.containers;
-in {
-  options.homelab.apps.penpot.enable = lib.mkEnableOption "Penpot using Docker";
-
-  config = lib.mkIf cfg.enable {
-    homelab = {
-      users.apps.enable = true;
-      virtualisation.containers.enable = true;
-    };
-
-    fileSystems."${srvPath}" = {
-      device = "192.168.0.11:/mnt/SMALL/CONFIG/PENPOT";
-      fsType = "nfs";
-      options = [
-        "rw"
-        "nfsvers=4.2"
-        "sync" "hard" "timeo=600"
-        "retrans=2"
-        "_netdev"
-        "nosuid" "tcp"
-      ];
-    };
-
-    # Make sure the Docker network exists.
-    systemd.services."docker-${networkName}-create-network" = lib.mkIf cfg.enable {
-      description = "Create Docker network for ${networkName}";
-      requiredBy = [
-        "docker-penpot-frontend.service"
-        "docker-penpot-backend.service"
-        "docker-penpot-exporter.service"
-        "docker-penpot-postgres.service"
-        "docker-penpot-redis.service"
-      ];
-      serviceConfig = {
-        Type = "oneshot";
-        RemainAfterExit = true;
-      };
-      script = ''
-        if ! ${pkgs.docker}/bin/docker network ls | grep -q ${networkName}; then
-          ${pkgs.docker}/bin/docker network create ${networkName}
-        fi
-      '';
-    };
-
-    virtualisation.oci-containers.containers = let
-      frontendPort = 8080;
-      redisUri = "redis://${docker.penpot-redis.hostname}/0";
-    in {
-      penpot-frontend = {
-        hostname = "penpot-frontend";
-        image = "penpotapp/frontend:${version}";
-        # user = "${toString UID}:${toString GID}";
-        user = "0:${toString GID}";
-        ports = [
-          # "9001:${toString frontendPort}/tcp"
-        ];
-        extraOptions = [
-          "--network=${networkName}"
-        ];
-        environment = {
-          inherit PENPOT_FLAGS;
-          inherit PENPOT_HTTP_SERVER_MAX_BODY_SIZE;
-          inherit PENPOT_HTTP_SERVER_MAX_MULTIPART_BODY_SIZE;
-        };
-        volumes = [
-          "${srvPath}:${assetsPath}"
-        ];
-        dependsOn = [
-          docker.penpot-backend.hostname
-          docker.penpot-exporter.hostname
-        ];
-        labels = {
-          "traefik.enable" = "true";
-          "traefik.http.routers.penpot.rule" = "Host(`penpot.depeuter.dev`)";
-          "traefik.http.services.penpot.loadbalancer.server.port" = toString frontendPort;
-          "traefik.tls.options.default.minVersion" = "VersionTLS13";
-        };
-        autoStart = true;
-      };
-      penpot-backend = {
-        hostname = "penpot-backend";
-        image = "penpotapp/backend:latest";
-        # user = "${toString UID}:${toString GID}";
-        user = "0:${toString GID}";
-        extraOptions = [
-          "--network=${networkName}"
-        ];
-        environmentFiles = [
-          /home/admin/.penpot.secret
-        ];
-        environment = {
-          inherit PENPOT_FLAGS;
-          inherit PENPOT_HTTP_SERVER_MAX_BODY_SIZE;
-          inherit PENPOT_HTTP_SERVER_MAX_MULTIPART_BODY_SIZE;
-
-          PENPOT_PUBLIC_URI = "https://penpot.depeuter.dev";
-
-          ## Database connection parameters. Don't touch them unless you are using custom
-          ## postgresql connection parameters.
-
-          PENPOT_DATABASE_URI = "postgresql://${docker.penpot-postgres.hostname}/${dbName}";
-          PENPOT_DATABASE_USERNAME = dbUser;
-          PENPOT_DATABASE_PASSWORD = dbPass;
-
-          ## Redis is used for the websockets notifications. Don't touch unless the redis
-          ## container has different parameters or different name.
-
-          PENPOT_REDIS_URI = redisUri;
-
-          ## Default configuration for assets storage: using filesystem based with all files
-          ## stored in a docker volume.
-
-          PENPOT_ASSETS_STORAGE_BACKEND = "assets-fs";
-          PENPOT_STORAGE_ASSETS_FS_DIRECTORY = assetsPath;
-
-          ## Telemetry. When enabled, a periodical process will send anonymous data about this
-          ## instance. Telemetry data will enable us to learn how the application is used,
-          ## based on real scenarios. If you want to help us, please leave it enabled. You can
-          ## audit what data we send with the code available on github.
-
-          PENPOT_TELEMETRY_ENABLED = "false";
-          PENPOT_TELEMETRY_REFERER = "compose";
-
-          # PENPOT_SMTP_HOST = "smtp.gmail.com";
-          # PENPOT_SMTP_PORT = "465";
-          # PENPOT_SMTP_USERNAME: "kmtl.hugo@gmail.com";
-          # PENPOT_SMTP_PASSWORD: <password>
-          # PENPOT_SMTP_TLS: true
-        };
-        volumes = [
-          "${srvPath}:${assetsPath}"
-        ];
-        dependsOn = [
-          docker.penpot-postgres.hostname
-          docker.penpot-redis.hostname
-        ];
-        autoStart = true;
-      };
-      penpot-exporter = {
-        hostname = "penpot-exporter";
-        image = "penpotapp/exporter:latest";
-        extraOptions = [
-          "--network=${networkName}"
-        ];
-        environment = {
-          # Don't touch it; this uses an internal docker network to
-          # communicate with the frontend.
-          PENPOT_PUBLIC_URI = "http://${docker.penpot-frontend.hostname}:${toString frontendPort}";
-
-          ## Redis is used for the websockets notifications.
-          PENPOT_REDIS_URI = redisUri;
-        };
-        dependsOn = [
-          docker.penpot-redis.hostname
-        ];
-        autoStart = true;
-      };
-      penpot-postgres = {
-        hostname = "penpot-postgres";
-        image = "postgres:15";
-        extraOptions = [
-          "--network=${networkName}"
-          "--health-cmd='pg_isready -U ${dbUser}'"
-          "--health-interval=2s"
-          "--health-retries=5"
-          "--health-timeout=10s"
-          "--health-start-period=2s"
-        ];
-        environment = {
-          POSTGRES_INITDB_ARGS = "--data-checksums";
-          POSTGRES_DB = dbName;
-          POSTGRES_USER = dbUser;
-          POSTGRES_PASSWORD = dbPass;
-        };
-        volumes = [
-          "penpot_postgres_v15:/var/lib/postgresql/data"
-        ];
-        autoStart = true;
-      };
-      penpot-redis = {
-        hostname = "penpot-redis";
-        image = "redis:7.2";
-        extraOptions = [
-          "--network=${networkName}"
-          "--health-cmd='redis-cli ping | grep PONG'"
-          "--health-interval=1s"
-          "--health-retries=5"
-          "--health-timeout=3s"
-          "--health-start-period=3s"
-        ];
-        autoStart = true;
-      };
-    };
-  };
-}

modules/default.nix

@@ -1,6 +1,7 @@
 {
   imports = [
     ./apps
+    ./fileSystems
     ./services
     ./virtualisation
 

secrets/secrets.yaml

@@ -0,0 +1,19 @@
+users:
+    admin:
+        authorized_keys:
+            NixOS: ENC[AES256_GCM,data:sj2hkUkWp628KuXp+AnncLdawHpxb9fH1ZHnIisP0x9Tght9+/X2sWHpuMSeqi2i/R8B+Wgte66QkuwAOB0j+oB9N+66EhehmWZlK5hD/22p,iv:z18U+LvAQgPDfBBewE3lJmWZd0NGCPwJIe/h3tupuZc=,tag:ZJar3spO66JbDXygdTHh2w==,type:str]
+sops:
+    age:
+        - recipient: age1qzutny0mqpcccqw6myyfntu6wcskruu9ghzvt6r4te7afkqwnguq05ex37
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjUSt2REk2Mmd0bk9ubjJk
+            dXFiY2JNR1dyZW9qTUdzaWZhY3c3amVwQzA0CkZHNVpZVjhsWXhVQVNaR0xONzhh
+            Y0lQaWNaNmpYYVdrRnZIZUhvUFUzcWMKLS0tIDAvSmF0VmpxcnZEQStXUjNCUE5Z
+            RnA2Lzk2WHFxOEh6dHN0aGhVSVpLTW8KA7IOvGDMBtgo4pe0Sw3Lol243xCDAJ4i
+            PhcJFiUObVRFZN7ISlULnOlTO3pT9jWvvmC5rDZWId3PQ8qjPvnOUg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-10-04T17:33:22Z"
+    mac: ENC[AES256_GCM,data:I7I7uDFEWfw9+4KROtjHMVhaxYrVK5QmLfFZShSajF0A2Zxu9lg+fDGiMHk40JC5zD31P70QS/ipye1mBGQbCbLEA7uBUhNzZ7G1g58cIXF6vSGmt0fovm0MVSxEJ44r05fx6uT4OJu5BYVxYSlG84gTj9rCFXxxcBJMrh+6yaI=,iv:c1vudsp9bg0Pc2ddRyvWn6Tf0LhqNuEjxG9D4PpHqxs=,tag:K/1PSHhrTdsNPcPmRv/2Ew==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.10.2

users/admin/default.nix

@@ -3,24 +3,30 @@
 let
   cfg = config.homelab.users.admin;
 in {
-  options.homelab.users.admin.enable = lib.mkEnableOption "user System Administrator";
+  options.homelab.users.admin = {
+    enable = lib.mkEnableOption "user System Administrator";
+    authorizedKeys = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [
+        # HomeLab > NixOS > admin > ssh
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGWIOOEqTy8cWKpENVbzD4p7bsQgQb/Dgpzk8i0dZ00T"
+      ];
+    };
+  };
 
   config = lib.mkIf cfg.enable {
     nix.settings.trusted-users = [
-      config.users.users.admin.name
+      config.users.users.gh0st.name
     ];
 
-    users.users.admin = {
+    users.users.gh0st = {
       description = "System Administrator";
       isNormalUser = true;
       extraGroups = [
         config.users.groups.wheel.name # Enable 'sudo' for the user.
       ];
       initialPassword = "ChangeMe";
-      openssh.authorizedKeys.keys = [
-        # TODO ChangeMe
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPrG+ldRBdCeHEXrsy/qHXIJYg8xQXVuiUR0DxhFjYNg"
-      ];
+      openssh.authorizedKeys.keys = cfg.authorizedKeys;
       packages = with pkgs; [
         curl
         git

users/backup/default.nix

@@ -13,13 +13,8 @@ in {
         "docker" # Allow access to the docker socket.
       ];
       openssh.authorizedKeys.keys = [
-        # TODO ChangeMe
-
-        # Tibo-NixFat
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPrG+ldRBdCeHEXrsy/qHXIJYg8xQXVuiUR0DxhFjYNg"
-
         # Hugo
-        "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDAxR813vqq5zbu1NHrIybu5Imlu3k0rDCGxHiuGEhPoVV9c5FpnKNGLCi3ctm15ZcVBX4HcponYsKRBsCzM2pI4uXjxhHkLzbss5LttFuSzv5v/QHfLW1bvyJEMBEPxguGqAydAeWrBFdI9uHBEXeb325uKxMKBZHYvvpyAQ115c1wKy1bL8BfR0LTkhsFqexRvI86q59AVrAU/KFf6RXO0T9QA6H/vyWLlIPc7Ta+tSWwQ68bMmS5Pwn8q58tOAOAd6Lpt4TqUDJSppPjLEPKyKC6ShwMdEjwmwpEG0hxfsvaU8XERyQbSbEE9sLHRA2LoEdtMx3J8nzX3AwYUNspsqIv6NQZksnVqJ8OfL45ngUFcSJ6kBsUvCZfzEUGUTJ6Js0v84NOIXxNG/ZfPsk6ArXm3dvj2TYeK8llO6wpJnMMyztmmiODWoj9tepZSij44IgVM5wdWYIK/RZoYTsCQbmvJFfB8jhyJnf/7F19Vo5+LwhmCOsQh/KEK0F1DVc= admin@Hugo"
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICms6vjhE9kOlqV5GBPGInwUHAfCSVHLI2Gtzee0VXPh"
       ];
     };
   };