Merge branch 'main' into working

hosts/kima/modules.nix

@@ -216,7 +216,7 @@
         flags = "--performance";
       };
       tailscale = {
-        enable = false;
+        enable = true;
       };
       udisks = {
         enable = true;

hosts/sobotka/modules.nix

@@ -214,7 +214,7 @@
         flags = "--performance";
       };
       tailscale = {
-        enable = false;
+        enable = true;
       };
       udisks = {
         enable = true;

hosts/sobotka/server.nix

@@ -1,5 +1,4 @@
-{ config, ... }:
+{config, ...}: {
-{
   server = {
     enable = true;
     email = "adam@cnst.dev";
@@ -44,10 +43,6 @@
     };
     jellyfin = {
       enable = true;
-      cloudflared = {
-        tunnelId = "234811e2-bc86-44b2-9abd-493686e25704";
-        credentialsFile = config.age.secrets.jellyfinCloudflared.path;
-      };
     };
     uptime-kuma = {
       enable = true;
@@ -94,7 +89,7 @@
       gluetun.enable = true;
       qbittorrent = {
         enable = true;
-        port = 8387;
+        port = 8080;
       };
       slskd = {
         enable = true;

modules/server/authentik/default.nix

@@ -4,13 +4,11 @@
   pkgs,
   self,
   ...
-}:
+}: let
-let
   unit = "authentik";
   cfg = config.server.${unit};
   srv = config.server;
-in
+in {
-{
   options.server.${unit} = {
     enable = lib.mkEnableOption {
       description = "Enable ${unit}";
@@ -55,9 +53,11 @@ in
     age.secrets = {
       authentikEnv = {
         file = "${self}/secrets/authentikEnv.age";
+        owner = "authentik";
       };
       authentikCloudflared = {
         file = "${self}/secrets/authentikCloudflared.age";
+        owner = "authentik";
       };
     };
 
@@ -99,23 +99,22 @@ in
             middlewares = {
               authentik = {
                 forwardAuth = {
-                  # tls.insecureSkipVerify = true;
+                  tls.insecureSkipVerify = true;
                   address = "https://localhost:9443/outpost.goauthentik.io/auth/traefik";
                   trustForwardHeader = true;
                   authResponseHeaders = [
                     "X-authentik-username"
                     "X-authentik-groups"
                     "X-authentik-email"
-                    # "X-authentik-name"
+                    "X-authentik-name"
-                    # "X-authentik-uid"
+                    "X-authentik-uid"
                     "X-authentik-jwt"
-                    # "X-authentik-meta-jwks"
+                    "X-authentik-meta-jwks"
-                    # "X-authentik-meta-outpost"
+                    "X-authentik-meta-outpost"
-                    # "X-authentik-meta-provider"
+                    "X-authentik-meta-provider"
-                    # "X-authentik-meta-app"
+                    "X-authentik-meta-app"
-                    # "X-authentik-meta-version"
+                    "X-authentik-meta-version"
                   ];
-                  timeout = "10s";
                 };
               };
             };
@@ -130,7 +129,7 @@ in
 
             routers = {
               auth = {
-                entryPoints = [ "websecure" ];
+                entryPoints = ["websecure"];
                 rule = "Host(`${cfg.url}`) || HostRegexp(`{subdomain:[a-z0-9]+}.${srv.www.url}`) && PathPrefix(`/outpost.goauthentik.io/`)";
                 service = "auth";
                 tls.certResolver = "letsencrypt";

modules/server/www/default.nix

@@ -4,18 +4,11 @@
   pkgs,
   self,
   ...
-}:
+}: let
-let
+  inherit (lib) mkOption mkEnableOption mkIf types;
-  inherit (lib)
-    mkOption
-    mkEnableOption
-    mkIf
-    types
-    ;
   cfg = config.server.www;
   srv = config.server;
-in
+in {
-{
   options.server.www = {
     enable = mkEnableOption {
       description = "Enable personal website";
@@ -124,14 +117,14 @@ in
 
     services.traefik.dynamicConfigOptions.http = {
       routers.webfinger = {
-        entryPoints = [ "websecure" ];
+        entryPoints = ["websecure"];
         rule = "Host(`${cfg.url}`) && Path(`/.well-known/webfinger`)";
         service = "webfinger";
         tls.certResolver = "letsencrypt";
       };
 
       services.webfinger.loadBalancer.servers = [
-        { url = "http://127.0.0.1:8283"; }
+        {url = "http://127.0.0.1:8283";}
       ];
     };
   };

users/cnst/modules/kimamod.nix

@@ -11,7 +11,7 @@
         enable = true;
       };
       chromium = {
-        enable = false;
+        enable = true;
       };
       discord = {
         enable = true;