diff --git a/flake.lock b/flake.lock index e8b964d..db076f0 100755 --- a/flake.lock +++ b/flake.lock @@ -125,28 +125,6 @@ "type": "github" } }, - "filesorter": { - "inputs": { - "flake-parts": "flake-parts", - "nixpkgs": [ - "nixpkgs" - ], - "treefmt-nix": "treefmt-nix" - }, - "locked": { - "lastModified": 1759453916, - "narHash": "sha256-Bl2flsWHfKPtbj6N/xNHrRNhWv8jxOuKBEzBoLplI3M=", - "ref": "refs/heads/main", - "rev": "079b099b8f3e35df796bdc89e65e5971aa235a43", - "revCount": 24, - "type": "git", - "url": "ssh://git@gitlab.com/uprootnutrition/filesorter.git" - }, - "original": { - "type": "git", - "url": "ssh://git@gitlab.com/uprootnutrition/filesorter.git" - } - }, "flake-compat": { "flake": false, "locked": { @@ -210,24 +188,6 @@ } }, "flake-parts": { - "inputs": { - "nixpkgs-lib": "nixpkgs-lib" - }, - "locked": { - "lastModified": 1759362264, - "narHash": "sha256-wfG0S7pltlYyZTM+qqlhJ7GMw2fTF4mLKCIVhLii/4M=", - "owner": "hercules-ci", - "repo": "flake-parts", - "rev": "758cf7296bee11f1706a574c77d072b8a7baa881", - "type": "github" - }, - "original": { - "owner": "hercules-ci", - "repo": "flake-parts", - "type": "github" - } - }, - "flake-parts_2": { "inputs": { "nixpkgs-lib": [ "nixpkgs" @@ -247,9 +207,9 @@ "type": "github" } }, - "flake-parts_3": { + "flake-parts_2": { "inputs": { - "nixpkgs-lib": "nixpkgs-lib_2" + "nixpkgs-lib": "nixpkgs-lib" }, "locked": { "lastModified": 1756770412, @@ -265,9 +225,9 @@ "type": "github" } }, - "flake-parts_4": { + "flake-parts_3": { "inputs": { - "nixpkgs-lib": "nixpkgs-lib_3" + "nixpkgs-lib": "nixpkgs-lib_2" }, "locked": { "lastModified": 1754091436, @@ -283,7 +243,7 @@ "type": "github" } }, - "flake-parts_5": { + "flake-parts_4": { "inputs": { "nixpkgs-lib": [ "nur", @@ -304,27 +264,9 @@ "type": "github" } }, - "flake-parts_6": { + "flake-parts_5": { "inputs": { - "nixpkgs-lib": "nixpkgs-lib_4" - }, - "locked": { - "lastModified": 1759362264, - "narHash": "sha256-wfG0S7pltlYyZTM+qqlhJ7GMw2fTF4mLKCIVhLii/4M=", - "owner": "hercules-ci", - "repo": "flake-parts", - "rev": "758cf7296bee11f1706a574c77d072b8a7baa881", - "type": "github" - }, - "original": { - "owner": "hercules-ci", - "repo": "flake-parts", - "type": "github" - } - }, - "flake-parts_7": { - "inputs": { - "nixpkgs-lib": "nixpkgs-lib_5" + "nixpkgs-lib": "nixpkgs-lib_3" }, "locked": { "lastModified": 1759362264, @@ -861,11 +803,11 @@ }, "linkpage": { "inputs": { - "flake-parts": "flake-parts_3", + "flake-parts": "flake-parts_2", "mkElmDerivation": "mkElmDerivation", - "nixpkgs": "nixpkgs_3", + "nixpkgs": "nixpkgs_2", "nixpkgs-stable": "nixpkgs-stable", - "treefmt-nix": "treefmt-nix_2" + "treefmt-nix": "treefmt-nix" }, "locked": { "lastModified": 1762929110, @@ -944,7 +886,7 @@ "inputs": { "elm-spa": "elm-spa", "elm-watch": "elm-watch", - "nixpkgs": "nixpkgs_2" + "nixpkgs": "nixpkgs" }, "locked": { "lastModified": 1762652710, @@ -964,7 +906,7 @@ "inputs": { "elm-spa": "elm-spa_2", "elm-watch": "elm-watch_2", - "nixpkgs": "nixpkgs_6" + "nixpkgs": "nixpkgs_5" }, "locked": { "lastModified": 1759023814, @@ -1041,7 +983,7 @@ "nixcord": { "inputs": { "flake-compat": "flake-compat_2", - "flake-parts": "flake-parts_4", + "flake-parts": "flake-parts_3", "nixpkgs": [ "nixpkgs" ] @@ -1062,11 +1004,11 @@ }, "nixpkgs": { "locked": { - "lastModified": 1754340878, - "narHash": "sha256-lgmUyVQL9tSnvvIvBp7x1euhkkCho7n3TMzgjdvgPoU=", + "lastModified": 1696757521, + "narHash": "sha256-cfgtLNCBLFx2qOzRLI6DHfqTdfWI+UbvsKYa3b3fvaA=", "owner": "nixos", "repo": "nixpkgs", - "rev": "cab778239e705082fe97bb4990e0d24c50924c04", + "rev": "2646b294a146df2781b1ca49092450e8a32814e1", "type": "github" }, "original": { @@ -1092,21 +1034,6 @@ } }, "nixpkgs-lib_2": { - "locked": { - "lastModified": 1754788789, - "narHash": "sha256-x2rJ+Ovzq0sCMpgfgGaaqgBSwY+LST+WbZ6TytnT9Rk=", - "owner": "nix-community", - "repo": "nixpkgs.lib", - "rev": "a73b9c743612e4244d865a2fdee11865283c04e6", - "type": "github" - }, - "original": { - "owner": "nix-community", - "repo": "nixpkgs.lib", - "type": "github" - } - }, - "nixpkgs-lib_3": { "locked": { "lastModified": 1753579242, "narHash": "sha256-zvaMGVn14/Zz8hnp4VWT9xVnhc8vuL3TStRqwk22biA=", @@ -1121,22 +1048,7 @@ "type": "github" } }, - "nixpkgs-lib_4": { - "locked": { - "lastModified": 1754788789, - "narHash": "sha256-x2rJ+Ovzq0sCMpgfgGaaqgBSwY+LST+WbZ6TytnT9Rk=", - "owner": "nix-community", - "repo": "nixpkgs.lib", - "rev": "a73b9c743612e4244d865a2fdee11865283c04e6", - "type": "github" - }, - "original": { - "owner": "nix-community", - "repo": "nixpkgs.lib", - "type": "github" - } - }, - "nixpkgs-lib_5": { + "nixpkgs-lib_3": { "locked": { "lastModified": 1754788789, "narHash": "sha256-x2rJ+Ovzq0sCMpgfgGaaqgBSwY+LST+WbZ6TytnT9Rk=", @@ -1216,22 +1128,6 @@ } }, "nixpkgs_2": { - "locked": { - "lastModified": 1696757521, - "narHash": "sha256-cfgtLNCBLFx2qOzRLI6DHfqTdfWI+UbvsKYa3b3fvaA=", - "owner": "nixos", - "repo": "nixpkgs", - "rev": "2646b294a146df2781b1ca49092450e8a32814e1", - "type": "github" - }, - "original": { - "owner": "nixos", - "ref": "nixpkgs-unstable", - "repo": "nixpkgs", - "type": "github" - } - }, - "nixpkgs_3": { "locked": { "lastModified": 1758690382, "narHash": "sha256-NY3kSorgqE5LMm1LqNwGne3ZLMF2/ILgLpFr1fS4X3o=", @@ -1247,7 +1143,7 @@ "type": "github" } }, - "nixpkgs_4": { + "nixpkgs_3": { "locked": { "lastModified": 1754340878, "narHash": "sha256-lgmUyVQL9tSnvvIvBp7x1euhkkCho7n3TMzgjdvgPoU=", @@ -1263,7 +1159,7 @@ "type": "github" } }, - "nixpkgs_5": { + "nixpkgs_4": { "locked": { "lastModified": 1761907660, "narHash": "sha256-kJ8lIZsiPOmbkJypG+B5sReDXSD1KGu2VEPNqhRa/ew=", @@ -1279,7 +1175,7 @@ "type": "github" } }, - "nixpkgs_6": { + "nixpkgs_5": { "locked": { "lastModified": 1696757521, "narHash": "sha256-cfgtLNCBLFx2qOzRLI6DHfqTdfWI+UbvsKYa3b3fvaA=", @@ -1295,7 +1191,7 @@ "type": "github" } }, - "nixpkgs_7": { + "nixpkgs_6": { "locked": { "lastModified": 1759036355, "narHash": "sha256-0m27AKv6ka+q270dw48KflE0LwQYrO7Fm4/2//KCVWg=", @@ -1311,23 +1207,7 @@ "type": "github" } }, - "nixpkgs_8": { - "locked": { - "lastModified": 1754340878, - "narHash": "sha256-lgmUyVQL9tSnvvIvBp7x1euhkkCho7n3TMzgjdvgPoU=", - "owner": "nixos", - "repo": "nixpkgs", - "rev": "cab778239e705082fe97bb4990e0d24c50924c04", - "type": "github" - }, - "original": { - "owner": "nixos", - "ref": "nixpkgs-unstable", - "repo": "nixpkgs", - "type": "github" - } - }, - "nixpkgs_9": { + "nixpkgs_7": { "locked": { "lastModified": 1754340878, "narHash": "sha256-lgmUyVQL9tSnvvIvBp7x1euhkkCho7n3TMzgjdvgPoU=", @@ -1423,7 +1303,7 @@ }, "nur": { "inputs": { - "flake-parts": "flake-parts_5", + "flake-parts": "flake-parts_4", "nixpkgs": [ "nixpkgs" ] @@ -1512,8 +1392,7 @@ }, "root": { "inputs": { - "filesorter": "filesorter", - "flake-parts": "flake-parts_2", + "flake-parts": "flake-parts", "home-manager": "home-manager", "hyprland": "hyprland", "hyprland-portal": "hyprland-portal", @@ -1524,18 +1403,17 @@ "microvm": "microvm", "niri": "niri", "nixcord": "nixcord", - "nixpkgs": "nixpkgs_5", + "nixpkgs": "nixpkgs_4", "nixpkgs-stable": "nixpkgs-stable_3", "nur": "nur", "plasma-manager": "plasma-manager", "pre-commit-hooks-nix": "pre-commit-hooks-nix", "sops-nix": "sops-nix", "systems": "systems_5", - "treefmt-nix": "treefmt-nix_3", + "treefmt-nix": "treefmt-nix_2", "upRootNutrition": "upRootNutrition", "waybar": "waybar", - "wpaperd": "wpaperd", - "zookeeper": "zookeeper" + "wpaperd": "wpaperd" } }, "rust-overlay": { @@ -1687,7 +1565,7 @@ }, "treefmt-nix": { "inputs": { - "nixpkgs": "nixpkgs" + "nixpkgs": "nixpkgs_3" }, "locked": { "lastModified": 1758728421, @@ -1704,24 +1582,6 @@ } }, "treefmt-nix_2": { - "inputs": { - "nixpkgs": "nixpkgs_4" - }, - "locked": { - "lastModified": 1758728421, - "narHash": "sha256-ySNJ008muQAds2JemiyrWYbwbG+V7S5wg3ZVKGHSFu8=", - "owner": "numtide", - "repo": "treefmt-nix", - "rev": "5eda4ee8121f97b218f7cc73f5172098d458f1d1", - "type": "github" - }, - "original": { - "owner": "numtide", - "repo": "treefmt-nix", - "type": "github" - } - }, - "treefmt-nix_3": { "inputs": { "nixpkgs": [ "nixpkgs" @@ -1741,9 +1601,9 @@ "type": "github" } }, - "treefmt-nix_4": { + "treefmt-nix_3": { "inputs": { - "nixpkgs": "nixpkgs_8" + "nixpkgs": "nixpkgs_7" }, "locked": { "lastModified": 1758728421, @@ -1759,31 +1619,13 @@ "type": "github" } }, - "treefmt-nix_5": { - "inputs": { - "nixpkgs": "nixpkgs_9" - }, - "locked": { - "lastModified": 1760120816, - "narHash": "sha256-gq9rdocpmRZCwLS5vsHozwB6b5nrOBDNc2kkEaTXHfg=", - "owner": "numtide", - "repo": "treefmt-nix", - "rev": "761ae7aff00907b607125b2f57338b74177697ed", - "type": "github" - }, - "original": { - "owner": "numtide", - "repo": "treefmt-nix", - "type": "github" - } - }, "upRootNutrition": { "inputs": { - "flake-parts": "flake-parts_6", + "flake-parts": "flake-parts_5", "mkElmDerivation": "mkElmDerivation_2", - "nixpkgs": "nixpkgs_7", + "nixpkgs": "nixpkgs_6", "nixpkgs-stable": "nixpkgs-stable_4", - "treefmt-nix": "treefmt-nix_4" + "treefmt-nix": "treefmt-nix_3" }, "locked": { "lastModified": 1761538643, @@ -1915,28 +1757,6 @@ "repo": "xwayland-satellite", "type": "github" } - }, - "zookeeper": { - "inputs": { - "flake-parts": "flake-parts_7", - "nixpkgs": [ - "nixpkgs" - ], - "treefmt-nix": "treefmt-nix_5" - }, - "locked": { - "lastModified": 1763275059, - "narHash": "sha256-ovKjevjjHhWqkq8iP3nvnoRwOQGX2hVGthykrDwR7LY=", - "ref": "refs/heads/main", - "rev": "940000066b81f4c7cb277f4f23ab4a0e32b8ce77", - "revCount": 9, - "type": "git", - "url": "ssh://git@gitlab.com/uprootnutrition/zookeeper.git" - }, - "original": { - "type": "git", - "url": "ssh://git@gitlab.com/uprootnutrition/zookeeper.git" - } } }, "root": "root", diff --git a/flake.nix b/flake.nix index 715241b..534371a 100755 --- a/flake.nix +++ b/flake.nix @@ -78,14 +78,14 @@ linkpage = { url = "git+ssh://git@gitlab.com/uprootnutrition/linkpage.git"; }; - filesorter = { - url = "git+ssh://git@gitlab.com/uprootnutrition/filesorter.git"; - inputs.nixpkgs.follows = "nixpkgs"; - }; - zookeeper = { - url = "git+ssh://git@gitlab.com/uprootnutrition/zookeeper.git"; - inputs.nixpkgs.follows = "nixpkgs"; - }; + # filesorter = { + # url = "git+ssh://git@gitlab.com/uprootnutrition/filesorter.git"; + # inputs.nixpkgs.follows = "nixpkgs"; + # }; + # zookeeper = { + # url = "git+ssh://git@gitlab.com/uprootnutrition/zookeeper.git"; + # inputs.nixpkgs.follows = "nixpkgs"; + # }; }; outputs = inputs: @@ -146,6 +146,8 @@ config.nixosModules.ceres config.nixosModules.core config.nixosModules.mantle + # inputs.filesorter.nixosModules.default + # inputs.zookeeper.nixosModules.default inputs.home-manager.nixosModules.home-manager inputs.impermanence.nixosModules.impermanence # inputs.lix-module.nixosModules.default diff --git a/modules/config/instances/config/comfyui.nix b/modules/config/instances/config/comfyui.nix index a14bee8..5da7fd5 100755 --- a/modules/config/instances/config/comfyui.nix +++ b/modules/config/instances/config/comfyui.nix @@ -1,38 +1,41 @@ { moduleFunctions }: let inherit (moduleFunctions.instancesFunctions) - varPath - mntPath + domain0 + servicePath + sslPath + sopsPath ; + label = "ComfyUI"; name = "comfyui"; + subdomain = "comfyui"; + domain = "${subdomain}.${domain0}"; in { label = label; name = name; short = label; + sops = { + path0 = "${sopsPath}/${name}"; + }; + domains = { + url0 = domain; + }; + subdomain = subdomain; tags = [ name "comfy" "ui" ]; + paths = { + path0 = "${servicePath}/${label}"; + }; ports = { port0 = 8188; }; - interface = { - id = "vm-comfy"; - mac = "02:00:00:00:54:24"; - idUser = "vmuser-comfy"; - macUser = "02:00:00:00:00:24"; - ip = "192.168.50.214"; - gate = "192.168.50.1"; - ssh = 2304; + ssl = { + cert = "${sslPath}/${domain}/fullchain.pem"; + key = "${sslPath}/${domain}/key.pem"; }; - varPaths = { - path0 = "${varPath}/${name}"; - }; - mntPaths = { - path0 = "${mntPath}/${name}"; - }; - } diff --git a/modules/config/instances/config/opencloud.nix b/modules/config/instances/config/opencloud.nix index b98bf6b..530313f 100755 --- a/modules/config/instances/config/opencloud.nix +++ b/modules/config/instances/config/opencloud.nix @@ -2,55 +2,43 @@ let inherit (moduleFunctions.instancesFunctions) domain0 + servicePath sslPath - varPath - mntPath - secretPath + sopsPath ; + label = "OpenCloud"; name = "opencloud"; - short = "cloud"; - domain = "${short}.${domain0}"; - secrets = "${secretPath}/${name}"; - ssl = "${sslPath}/${name}.${domain0}"; + subdomain = "cloud"; + domain = "${subdomain}.${domain0}"; in { label = label; name = name; short = "Cloud"; + email = { + address0 = "noreply@${domain0}"; + }; + sops = { + path0 = "${sopsPath}/${name}"; + }; domains = { url0 = domain; }; - subdomain = short; + subdomain = subdomain; tags = [ name "opencloud" "cloud" ]; + paths = { + path0 = "${servicePath}/${label}"; + }; ports = { port0 = 9200; }; - interface = { - id = "vm-${short}"; - mac = "02:00:00:00:56:06"; - idUser = "vmuser-${short}"; - macUser = "02:00:00:00:00:06"; - ip = "192.168.50.116"; - gate = "192.168.50.1"; - ssh = 2206; - }; ssl = { - path = ssl; - cert = "${ssl}/fullchain.pem"; - key = "${ssl}/key.pem"; - }; - varPaths = { - path0 = "${varPath}/${name}"; - }; - mntPaths = { - path0 = "${mntPath}/${name}"; - }; - secretPaths = { - path0 = secrets; + cert = "${sslPath}/${subdomain}.${domain0}/fullchain.pem"; + key = "${sslPath}/${subdomain}.${domain0}/key.pem"; }; } diff --git a/modules/config/instances/config/zookeeper.nix b/modules/config/instances/config/zookeeper.nix deleted file mode 100755 index 0aa5985..0000000 --- a/modules/config/instances/config/zookeeper.nix +++ /dev/null @@ -1,30 +0,0 @@ -{ moduleFunctions }: -let - inherit (moduleFunctions.instancesFunctions) - varPath - mntPath - ; - label = "Zookeeper"; - name = "zookeeper"; -in - -{ - label = label; - name = name; - interface = { - id = "vm-boonbot"; - mac = "02:00:00:00:53:23"; - idUser = "vmuser-boonbot"; - macUser = "02:00:00:00:00:23"; - ip = "192.168.50.213"; - gate = "192.168.50.1"; - ssh = 2303; - }; - varPaths = { - path0 = "${varPath}/${name}"; - }; - mntPaths = { - path0 = "${mntPath}/${name}"; - }; - -} diff --git a/modules/nixos/default.nix b/modules/nixos/default.nix index 06252cc..598a124 100755 --- a/modules/nixos/default.nix +++ b/modules/nixos/default.nix @@ -51,7 +51,7 @@ in acme # audiobookshelf caddy - comfyui + # comfyui # filesorter # firefly-iii forgejo @@ -63,7 +63,6 @@ in midnight # minecraft # ollamaCeres - ceresOpenCloud # postgresCeres projectSite # prompter @@ -71,7 +70,7 @@ in # searx vaultwarden website - zookeeper + # zookeeper ; }; }; diff --git a/modules/nixos/guests/comfyui/default.nix b/modules/nixos/guests/comfyui/default.nix deleted file mode 100644 index f6993ce..0000000 --- a/modules/nixos/guests/comfyui/default.nix +++ /dev/null @@ -1,239 +0,0 @@ -{ - flake, - ... -}: -let - inherit (flake.config.people) user0; - inherit (flake.config.services) instances; - serviceCfg = instances.comfyui; - hostCfg = instances.web; -in -{ - microvm.vms = { - ${serviceCfg.name} = { - autostart = true; - restartIfChanged = true; - config = { - system.stateVersion = "24.05"; - time.timeZone = "America/Winnipeg"; - users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys; - - imports = [ - flake.inputs.filesorter.nixosModules.default - ]; - - services = { - filesorter.enable = true; - caddy = { - enable = true; - virtualHosts = { - ":80" = { - extraConfig = '' - # Main reverse proxy with WebSocket support - reverse_proxy ${hostCfg.localhost.address1}:${toString serviceCfg.ports.port0} { - header_up Host {host} - header_up X-Real-IP {remote} - header_up X-Forwarded-For {remote} - header_up X-Forwarded-Proto {scheme} - - # WebSocket support - critical for ComfyUI real-time updates - header_up Connection {>Connection} - header_up Upgrade {>Upgrade} - - # Longer timeouts for generation tasks - transport http { - read_timeout 300s - write_timeout 300s - } - } - - # Security headers - header { - Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" - X-Frame-Options "DENY" - X-Content-Type-Options "nosniff" - X-XSS-Protection "1; mode=block" - Referrer-Policy "strict-origin-when-cross-origin" - -Server - } - - # Logging - log { - output file /var/log/caddy/comfyui-access.log - format json - } - ''; - }; - }; - }; - openssh = { - enable = true; - settings = { - PasswordAuthentication = false; - PermitRootLogin = "prohibit-password"; - }; - }; - }; - - virtualisation = { - docker = { - enable = true; - autoPrune = { - enable = true; - dates = "weekly"; - }; - }; - oci-containers = { - backend = "docker"; - containers.comfyui = { - image = "yanwk/comfyui-boot:cu126-slim"; - autoStart = true; - - ports = [ - "${hostCfg.localhost.address1}:${builtins.toString serviceCfg.ports.port0}:8188" - ]; - - volumes = [ - "${serviceCfg.varPaths.path0}:/root" - "${serviceCfg.varPaths.path0}/models:/root/models" - "${serviceCfg.varPaths.path0}/custom_nodes:/root/custom_nodes" - "${serviceCfg.varPaths.path0}/output:/root/output" - "${serviceCfg.varPaths.path0}/input:/root/input" - "${serviceCfg.varPaths.path0}/user:/root/user" - # Mount the device nodes into the container - "/dev/nvidia0:/dev/nvidia0" - "/dev/nvidiactl:/dev/nvidiactl" - "/dev/nvidia-uvm:/dev/nvidia-uvm" - "/dev/nvidia-modeset:/dev/nvidia-modeset" - ]; - - environment = { - CLI_ARGS = "--listen 0.0.0.0 --port 8188 --preview-method auto --dont-print-server"; - NVIDIA_VISIBLE_DEVICES = "all"; - NVIDIA_DRIVER_CAPABILITIES = "compute,utility,graphics"; - }; - - extraOptions = [ - "--privileged" - "--device=/dev/nvidia0" - "--device=/dev/nvidiactl" - "--device=/dev/nvidia-uvm" - "--device=/dev/nvidia-modeset" - "--memory=32g" - "--memory-swap=32g" - "--shm-size=16g" - "--security-opt=no-new-privileges:true" - "--network=bridge" - "--health-cmd=curl -f http://localhost:8188/ || exit 1" - "--health-interval=30s" - "--health-timeout=10s" - "--health-retries=3" - ]; - }; - }; - }; - - users.users.caddy.extraGroups = [ serviceCfg.name ]; - - networking.firewall.allowedTCPPorts = [ - 22 - 80 - ]; - - systemd = { - services.docker-comfyui = { - after = [ - "network-online.target" - "docker.service" - ]; - wants = [ "network-online.target" ]; - requires = [ "docker.service" ]; - }; - network = { - enable = true; - networks."20-lan" = { - matchConfig.Name = "enp0s5"; - addresses = [ { Address = "${serviceCfg.interface.ip}/24"; } ]; - routes = [ - { - Destination = "${hostCfg.localhost.address1}/0"; - Gateway = serviceCfg.interface.gate; - } - ]; - dns = [ - "1.1.1.1" - "8.8.8.8" - ]; - }; - }; - tmpfiles.rules = [ - "Z ${serviceCfg.varPaths.path0} 0755 ${serviceCfg.name} ${serviceCfg.name} -" - "d /var/lib/docker/tmp/ 755 docker docker -" - "d /var/log/caddy 755 caddy caddy -" - ]; - }; - - boot.kernel.sysctl = { - "kernel.shmmax" = 68719476736; - "kernel.shmall" = 4194304; - "vm.swappiness" = 1; - "vm.dirty_ratio" = 15; - "vm.dirty_background_ratio" = 5; - }; - - microvm = { - vcpu = 6; - mem = 8192; - hypervisor = "qemu"; - interfaces = [ - { - type = "tap"; - id = serviceCfg.interface.id; - mac = serviceCfg.interface.mac; - } - { - type = "user"; - id = serviceCfg.interface.idUser; - mac = serviceCfg.interface.macUser; - } - ]; - - forwardPorts = [ - { - from = "host"; - host.port = serviceCfg.interface.ssh; - guest.port = 22; - } - ]; - - shares = [ - { - mountPoint = "/nix/.ro-store"; - proto = "virtiofs"; - source = "/nix/store"; - tag = "read_only_nix_store"; - } - { - mountPoint = "/var/lib/${serviceCfg.name}"; - proto = "virtiofs"; - source = "${serviceCfg.mntPaths.path0}/data"; - tag = "${serviceCfg.name}_data"; - } - { - mountPoint = "/var/lib/docker"; - proto = "virtiofs"; - source = "${serviceCfg.mntPaths.path0}/docker"; # Store on host - tag = "docker_data"; - } - ]; - }; - }; - }; - }; - - systemd.tmpfiles.rules = [ - "d ${serviceCfg.mntPaths.path0}/data 0751 microvm wheel - -" - "d ${serviceCfg.mntPaths.path0}/docker 0751 microvm wheel - -" - - ]; -} diff --git a/modules/nixos/guests/opencloud/ceresOpenCloud/default.nix b/modules/nixos/guests/opencloud/ceresOpenCloud/default.nix deleted file mode 100755 index ec5cbd2..0000000 --- a/modules/nixos/guests/opencloud/ceresOpenCloud/default.nix +++ /dev/null @@ -1,171 +0,0 @@ -{ - config, - flake, - pkgs, - ... -}: -let - inherit (flake.config.people) user0; - inherit (flake.config.services) instances; - serviceCfg = instances.opencloud; - hostCfg = instances.web; - dns = instances.web.dns.provider1; - localhost = instances.web.localhost.address1; - host = "${serviceCfg.subdomain}.${flake.inputs.linkpage.secrets.domains.projectsite}"; - dnsPath = "dns/${dns}"; -in -{ - microvm.vms = { - projectcloud = { - autostart = true; - restartIfChanged = true; - config = { - system.stateVersion = "24.05"; - time.timeZone = "America/Winnipeg"; - users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys; - services = { - opencloud = { - enable = true; - url = "https://${host}"; - port = serviceCfg.ports.port0; - address = localhost; - stateDir = "/var/lib/${serviceCfg.name}"; - environmentFile = "/run/secrets/projectenv"; - }; - - openssh = { - enable = true; - settings = { - PasswordAuthentication = false; - PermitRootLogin = "prohibit-password"; - }; - }; - }; - - networking.firewall.allowedTCPPorts = [ - 22 # SSH - 587 # SMTP - serviceCfg.ports.port0 - ]; - - systemd = { - services = { - opencloud = { - path = [ pkgs.inotify-tools ]; - }; - }; - network = { - enable = true; - networks."20-lan" = { - matchConfig.Name = "enp0s5"; - addresses = [ - { Address = "${serviceCfg.interface.ip}/24"; } - ]; - routes = [ - { - Destination = "${hostCfg.localhost.address1}/0"; - Gateway = serviceCfg.interface.gate; - } - ]; - dns = [ - "1.1.1.1" - "8.8.8.8" - ]; - }; - }; - - tmpfiles.rules = [ - "Z ${serviceCfg.varPaths.path0} 0755 ${serviceCfg.name} ${serviceCfg.name} -" - ]; - - }; - - systemd.services.systemd-networkd.wantedBy = [ "multi-user.target" ]; - - microvm = { - vcpu = 4; - mem = 4096; - hypervisor = "qemu"; - interfaces = [ - { - type = "tap"; - id = serviceCfg.interface.id; - mac = serviceCfg.interface.mac; - } - { - type = "user"; - id = serviceCfg.interface.idUser; - mac = serviceCfg.interface.macUser; - } - ]; - forwardPorts = [ - { - from = "host"; - host.port = serviceCfg.interface.ssh; - guest.port = 22; - } - ]; - shares = [ - { - mountPoint = "/nix/.ro-store"; - proto = "virtiofs"; - source = "/nix/store"; - tag = "read_only_nix_store"; - } - { - mountPoint = "/var/lib/${serviceCfg.name}"; - proto = "virtiofs"; - source = serviceCfg.mntPaths.path0; - tag = "${serviceCfg.name}_data"; - } - { - mountPoint = "/run/secrets"; - proto = "virtiofs"; - source = "/run/secrets/${serviceCfg.name}"; - tag = "host_secrets"; - } - ]; - }; - }; - }; - }; - - security.acme.certs."${host}" = { - dnsProvider = dns; - environmentFile = config.sops.secrets.${dnsPath}.path; - group = "caddy"; - }; - - services.caddy.virtualHosts = { - "${host}" = { - extraConfig = '' - reverse_proxy ${serviceCfg.interface.ip}:${toString serviceCfg.ports.port0} { - header_up X-Real-IP {remote_host} - } - - redir /.well-known/carddav /remote.php/dav/ 301 - redir /.well-known/caldav /remote.php/dav/ 301 - - tls /var/lib/acme/${host}/fullchain.pem /var/lib/acme/${host}/key.pem - ''; - }; - }; - - users.users.caddy.extraGroups = [ "acme" ]; - - systemd = { - tmpfiles.rules = [ - "d ${serviceCfg.mntPaths.path0} 0751 microvm wheel - -" - "d ${serviceCfg.mntPaths.path0}/storage 0755 opencloud opencloud - -" - "d ${serviceCfg.mntPaths.path0}/storage/users 2775 opencloud wheel - -" - ]; - }; - - sops.secrets = { - "${serviceCfg.name}/projectenv" = { - owner = "root"; - mode = "0600"; - }; - }; - -} diff --git a/modules/nixos/guests/opencloud/default.nix b/modules/nixos/guests/opencloud/default.nix deleted file mode 100755 index da65bd2..0000000 --- a/modules/nixos/guests/opencloud/default.nix +++ /dev/null @@ -1,11 +0,0 @@ -let - importList = - let - content = builtins.readDir ./.; - dirContent = builtins.filter (n: content.${n} == "directory") (builtins.attrNames content); - in - map (name: ./. + "/${name}") dirContent; -in -{ - imports = importList; -} diff --git a/modules/nixos/guests/opencloud/erisOpenCloud/default.nix b/modules/nixos/guests/opencloud/erisOpenCloud/default.nix deleted file mode 100755 index aaa6bf6..0000000 --- a/modules/nixos/guests/opencloud/erisOpenCloud/default.nix +++ /dev/null @@ -1,163 +0,0 @@ -{ - config, - flake, - pkgs, - ... -}: -let - inherit (flake.config.people) user0; - inherit (flake.config.services) instances; - serviceCfg = instances.vaultwarden; - hostCfg = instances.web; - dns = instances.web.dns.provider1; - localhost = instances.web.localhost.address1; - host = "${serviceCfg.subdomain}.${flake.inputs.linkpage.secrets.domains.projectsite}"; - dnsPath = "dns/${dns}"; -in -{ - microvm.vms = { - projectcloud = { - autostart = true; - restartIfChanged = true; - config = { - environment.systemPackages = with pkgs; [ - inotify-tools - ]; - system.stateVersion = "24.05"; - time.timeZone = "America/Winnipeg"; - users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys; - services = { - opencloud = { - enable = true; - url = "https://${host}"; - port = serviceCfg.ports.port0; - address = localhost; - stateDir = "/var/lib/${serviceCfg.name}"; - environmentFile = "/run/secrets/projectenv"; - }; - - openssh = { - enable = true; - settings = { - PasswordAuthentication = false; - PermitRootLogin = "prohibit-password"; - }; - }; - }; - - networking.firewall.allowedTCPPorts = [ - 22 # SSH - 587 # SMTP - serviceCfg.ports.port0 - ]; - - systemd = { - network = { - enable = true; - networks."20-lan" = { - matchConfig.Name = "enp0s5"; - addresses = [ - { Address = "${serviceCfg.interface.ip}/24"; } - ]; - routes = [ - { - Destination = "${hostCfg.localhost.address1}/0"; - Gateway = serviceCfg.interface.gate; - } - ]; - dns = [ - "1.1.1.1" - "8.8.8.8" - ]; - }; - }; - - tmpfiles.rules = [ - "Z ${serviceCfg.varPaths.path0} 0755 ${serviceCfg.name} ${serviceCfg.name} -" - ]; - - }; - - systemd.services.systemd-networkd.wantedBy = [ "multi-user.target" ]; - - microvm = { - vcpu = 4; - mem = 4096; - hypervisor = "qemu"; - interfaces = [ - { - type = "tap"; - id = serviceCfg.interface.id; - mac = serviceCfg.interface.mac; - } - { - type = "user"; - id = serviceCfg.interface.idUser; - mac = serviceCfg.interface.macUser; - } - ]; - forwardPorts = [ - { - from = "host"; - host.port = serviceCfg.interface.ssh; - guest.port = 22; - } - ]; - shares = [ - { - mountPoint = "/nix/.ro-store"; - proto = "virtiofs"; - source = "/nix/store"; - tag = "read_only_nix_store"; - } - { - mountPoint = "/var/lib/${serviceCfg.name}"; - proto = "virtiofs"; - source = serviceCfg.mntPaths.path0; - tag = "${serviceCfg.name}_data"; - } - { - mountPoint = "/run/secrets"; - proto = "virtiofs"; - source = "/run/secrets/${serviceCfg.name}"; - tag = "host_secrets"; - } - ]; - }; - }; - }; - }; - - security.acme.certs."${host}" = { - dnsProvider = dns; - environmentFile = config.sops.secrets.${dnsPath}.path; - group = "caddy"; - }; - - services.caddy.virtualHosts = { - "${host}" = { - extraConfig = '' - reverse_proxy ${serviceCfg.interface.ip}:${toString serviceCfg.ports.port0} { - - redir /.well-known/carddav /remote.php/dav/ 301 - redir /.well-known/caldav /remote.php/dav/ 301 - - tls ${serviceCfg.ssl.cert} ${serviceCfg.ssl.key} - ''; - }; - }; - - users.users.caddy.extraGroups = [ "acme" ]; - - systemd.tmpfiles.rules = [ - "d ${serviceCfg.mntPaths.path0} 0751 microvm wheel - -" - ]; - - sops.secrets = { - "${serviceCfg.name}/projectenv" = { - owner = "root"; - mode = "0600"; - }; - }; - -} diff --git a/modules/nixos/guests/zookeeper/default.nix b/modules/nixos/guests/zookeeper/default.nix deleted file mode 100755 index 6da2a07..0000000 --- a/modules/nixos/guests/zookeeper/default.nix +++ /dev/null @@ -1,128 +0,0 @@ -{ - flake, - ... -}: -let - inherit (flake.config.people) user0; - inherit (flake.config.services) instances; - serviceCfg = instances.zookeeper; - hostCfg = instances.web; -in -{ - microvm.vms = { - zookeeper = { - autostart = true; - restartIfChanged = true; - config = { - system.stateVersion = "24.05"; - time.timeZone = "America/Winnipeg"; - imports = [ - flake.inputs.zookeeper.nixosModules.default - ]; - users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys; - services = { - zookeeperbot.enable = true; - openssh = { - enable = true; - settings = { - PasswordAuthentication = false; - PermitRootLogin = "prohibit-password"; - }; - }; - }; - - networking.firewall.allowedTCPPorts = [ - 22 - ]; - - systemd = { - network = { - enable = true; - networks."20-lan" = { - matchConfig.Name = "enp0s5"; - addresses = [ - { Address = "${serviceCfg.interface.ip}/24"; } - ]; - routes = [ - { - Destination = "${hostCfg.localhost.address1}/0"; - Gateway = serviceCfg.interface.gate; - } - ]; - dns = [ - "1.1.1.1" - "8.8.8.8" - ]; - }; - }; - - tmpfiles.rules = [ - "Z ${serviceCfg.varPaths.path0} 0755 ${serviceCfg.name} ${serviceCfg.name} -" - ]; - - }; - - systemd.services.systemd-networkd.wantedBy = [ "multi-user.target" ]; - - microvm = { - vcpu = 2; - mem = 3072; - hypervisor = "qemu"; - interfaces = [ - { - type = "tap"; - id = serviceCfg.interface.id; - mac = serviceCfg.interface.mac; - } - { - type = "user"; - id = serviceCfg.interface.idUser; - mac = serviceCfg.interface.macUser; - } - ]; - forwardPorts = [ - { - from = "host"; - host.port = serviceCfg.interface.ssh; - guest.port = 22; - } - ]; - shares = [ - { - mountPoint = "/nix/.ro-store"; - proto = "virtiofs"; - source = "/nix/store"; - tag = "read_only_nix_store"; - } - { - mountPoint = "/var/lib/${serviceCfg.name}"; - proto = "virtiofs"; - source = serviceCfg.mntPaths.path0; - tag = "${serviceCfg.name}_data"; - } - { - mountPoint = "/run/secrets"; - proto = "virtiofs"; - source = "/run/secrets/${serviceCfg.name}"; - tag = "host_secrets"; - } - ]; - }; - }; - }; - }; - - systemd = { - tmpfiles.rules = [ - "d ${serviceCfg.mntPaths.path0} 0751 microvm wheel - -" - ]; - }; - - sops.secrets = { - "${serviceCfg.name}/env" = { - owner = "root"; - mode = "0600"; - }; - }; - -} diff --git a/modules/nixos/services/comfyui/default.nix b/modules/nixos/services/comfyui/default.nix new file mode 100755 index 0000000..76a3dd6 --- /dev/null +++ b/modules/nixos/services/comfyui/default.nix @@ -0,0 +1,148 @@ +{ + config, + pkgs, + flake, + ... +}: +let + inherit (flake.config.services.instances) comfyui web; + service = comfyui; + localhost = web.localhost.address1; + host = service.domains.url0; +in +{ + # Enable Docker (nvidia-container-toolkit will auto-enable via graphics.nix) + virtualisation.docker = { + enable = true; + enableNvidia = true; + autoPrune = { + enable = true; + dates = "weekly"; + }; + }; + + # hardware.nvidia-container-toolkit.enable = true; + + # Create ComfyUI Docker container + virtualisation.oci-containers = { + backend = "docker"; + containers.comfyui = { + image = "yanwk/comfyui-boot:cu126-slim"; + autoStart = true; + + ports = [ + "${localhost}:${toString service.ports.port0}:8188" + ]; + + volumes = [ + # Main data directory + "${service.paths.path0}:/root" + # Specific subdirectories for better control + "${service.paths.path0}/models:/root/models" + "${service.paths.path0}/custom_nodes:/root/custom_nodes" + "${service.paths.path0}/output:/root/output" + "${service.paths.path0}/input:/root/input" + "${service.paths.path0}/user:/root/user" + ]; + + environment = { + CLI_ARGS = "--listen 0.0.0.0 --port 8188 --preview-method auto --dont-print-server"; + NVIDIA_VISIBLE_DEVICES = "0"; + NVIDIA_DRIVER_CAPABILITIES = "compute,utility,graphics"; + }; + + extraOptions = [ + "--runtime=nvidia" + "--gpus=device=0" + # Memory limits to prevent OOM + "--memory=32g" + "--memory-swap=32g" + "--shm-size=16g" + # Security + "--security-opt=no-new-privileges:true" + # Network + "--network=bridge" + # Health check + "--health-cmd=curl -f http://localhost:8188/ || exit 1" + "--health-interval=30s" + "--health-timeout=10s" + "--health-retries=3" + ]; + }; + }; + + # Caddy reverse proxy with WebSocket support + services.caddy = { + virtualHosts = { + "${host}" = { + extraConfig = '' + basicauth { + {$CADDY_AUTH_USER} {$CADDY_AUTH_PASSWORD_HASH} + } + + # Main reverse proxy with WebSocket support + reverse_proxy ${localhost}:${toString service.ports.port0} { + header_up Host {host} + header_up X-Real-IP {remote} + header_up X-Forwarded-For {remote} + header_up X-Forwarded-Proto {scheme} + + # WebSocket support - critical for ComfyUI real-time updates + header_up Connection {>Connection} + header_up Upgrade {>Upgrade} + + # Longer timeouts for generation tasks + transport http { + read_timeout 300s + write_timeout 300s + } + } + + tls ${service.ssl.cert} ${service.ssl.key} + + # Security headers + header { + Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" + X-Frame-Options "DENY" + X-Content-Type-Options "nosniff" + X-XSS-Protection "1; mode=block" + Referrer-Policy "strict-origin-when-cross-origin" + -Server + } + + # Logging + log { + output file /var/log/caddy/comfyui-access.log + format json + } + ''; + }; + }; + }; + + # Setup directories with proper permissions + systemd.tmpfiles.rules = [ + "d ${service.paths.path0} 755 root root -" + "Z ${service.sops.path0} 755 caddy caddy -" + "d /var/log/caddy 755 caddy caddy -" + ]; + + # Kernel tuning for AI workloads + boot.kernel.sysctl = { + "kernel.shmmax" = 68719476736; + "kernel.shmall" = 4194304; + "vm.swappiness" = 1; + "vm.dirty_ratio" = 15; + "vm.dirty_background_ratio" = 5; + }; + + # Ensure Docker service waits for network + systemd.services.docker-comfyui = { + after = [ + "network-online.target" + "docker.service" + ]; + wants = [ "network-online.target" ]; + requires = [ "docker.service" ]; + }; +} diff --git a/modules/nixos/services/filesorter/default.nix b/modules/nixos/services/filesorter/default.nix new file mode 100755 index 0000000..034fcc6 --- /dev/null +++ b/modules/nixos/services/filesorter/default.nix @@ -0,0 +1,5 @@ +{ + services.filesorter = { + enable = true; + }; +} diff --git a/modules/nixos/services/opencloud/default.nix b/modules/nixos/services/opencloud/default.nix new file mode 100755 index 0000000..a56126d --- /dev/null +++ b/modules/nixos/services/opencloud/default.nix @@ -0,0 +1,91 @@ +{ + config, + flake, + pkgs, + ... +}: +let + inherit (flake.config.services.instances) opencloud web caddy; + inherit (flake.config.machines.devices) eris; + service = opencloud; + localhost = web.localhost.address1; + host = service.domains.url0; +in +{ + + environment.systemPackages = with pkgs; [ + inotify-tools + ]; + + services = { + opencloud = { + enable = true; + url = "https://${host}"; + port = service.ports.port0; + address = localhost; + stateDir = "/var/lib/${service.name}"; + environmentFile = config.sops.secrets."${service.name}/env".path; + }; + + caddy = { + virtualHosts = { + ":${host}" = { + extraConfig = '' + redir /.well-known/carddav /remote.php/dav/ 301 + redir /.well-known/caldav /remote.php/dav/ 301 + + reverse_proxy ${localhost}:${toString service.ports.port0} + + tls ${service.ssl.cert} ${service.ssl.key} + ''; + }; + }; + }; + }; + + sops = + let + sopsPath = secret: { + path = "${service.sops.path0}/${service.name}-${secret}"; + owner = service.name; + mode = "600"; + }; + in + { + secrets = builtins.listToAttrs ( + map + (secret: { + name = "${service.name}/${secret}"; + value = sopsPath secret; + }) + [ + "env" + ] + ); + }; + + fileSystems."/var/lib/${service.name}" = { + device = service.paths.path0; + fsType = "none"; + options = [ + "bind" + ]; + depends = [ + eris.storage0.mount + ]; + }; + + systemd.tmpfiles.rules = [ + "Z ${service.paths.path0} 755 ${service.name} ${service.name} -" + "Z ${service.sops.path0} 755 ${service.name} ${service.name} -" + ]; + + networking = { + firewall = { + allowedTCPPorts = [ + service.ports.port0 + caddy.ports.port4 + ]; + }; + }; +} diff --git a/modules/nixos/services/zookeeper/default.nix b/modules/nixos/services/zookeeper/default.nix new file mode 100755 index 0000000..7f75c20 --- /dev/null +++ b/modules/nixos/services/zookeeper/default.nix @@ -0,0 +1,3 @@ +{ + services.zookeeperbot.enable = true; +} diff --git a/modules/nixos/sops/default.nix b/modules/nixos/sops/default.nix index 891fdd9..95bdbb4 100755 --- a/modules/nixos/sops/default.nix +++ b/modules/nixos/sops/default.nix @@ -23,6 +23,11 @@ in path = "/home/${user0}/.ssh/known_hosts"; owner = user0; }; + "discord-token" = { + path = "/etc/zookeeper/.env"; + owner = user0; + }; + # "claude-api-key" = { # path = "/home/${user0}/.config/zed/claude-api-key"; # owner = user0; diff --git a/profiles/user0/files/misc/justfile.nix b/profiles/user0/files/misc/justfile.nix index a6997e2..7b2629e 100755 --- a/profiles/user0/files/misc/justfile.nix +++ b/profiles/user0/files/misc/justfile.nix @@ -10,15 +10,15 @@ let hostname = config.networking.hostName; dotPath = "~/projects/dotfiles"; mkLocalRebuild = type: '' - ${type}-rebuild: + rebuild-${type}: nixos-rebuild ${type} --sudo --flake ${dotPath}#${hostname} --show-trace ''; mkRemoteRebuild = name: ip: '' - ${name}-rebuild: + rebuild-${name}: nixos-rebuild switch --flake ${dotPath}#${name} --target-host ${ip} --sudo --ask-sudo-password --show-trace ''; mkSshCommands = name: ip: '' - ${name}-ssh: + ${name}: ssh ${ip} ''; mkMicrVMSshCommands = name: ssh: '' @@ -33,6 +33,7 @@ let (command devices.mars.name devices.mars.ip.address0) (command devices.deimos.name devices.deimos.ip.address0) (command devices.phobos.name devices.phobos.ip.address0) + (command devices.lamdagibson.name devices.lamdagibson.ip.address0) ]; instanceRecords = command: diff --git a/secrets/secrets.yaml b/secrets/secrets.yaml index 9ff8d1b..e3b2413 100755 --- a/secrets/secrets.yaml +++ b/secrets/secrets.yaml @@ -19,8 +19,7 @@ peertube-secret: ENC[AES256_GCM,data:Of4UsWGTXd+uzHE4XkxQOLKBbDd0sQHWQrLgxmn8C9b forgejo: database: ENC[AES256_GCM,data:KhwJNJdICaZpnouDecDQM/ShL60nzqzPuyTCO7reilJc,iv:LQord5Bkfhuq/13DqEk51EB+qtunWpJ+g5fFXbhXV90=,tag:TG/fsyXerdy+MEnsjBbuBg==,type:str] smtp: ENC[AES256_GCM,data:rL1loo/yKrIPmZVpa6S8ka9lX2bwkgCNYRCZ1Np07ANp,iv:Si2sqBNlVQzi8rlfp8WQFUoyu4xJGfPYc9N6V6jrry4=,tag:SdPIRaiiIaHe1DnOxp1Y0Q==,type:str] -zookeeper: - env: ENC[AES256_GCM,data:CEEUmzRxvyeXSQfwUkmZq46HQNkv3I+wMzkBoUpAlh3D5O3L5kCeoDksDWuQrVTeQfIwKj18LDeeG+2Bz5XOVPTyXm/Ap+m2Jw==,iv:6eX7ocY5PiQaJ0KBDiKxhx0UguuQWcIbiZSYHY2hHjU=,tag:6vXg2fzRyfuJd5G3yNeUNA==,type:str] +discord-token: ENC[AES256_GCM,data:KnG6hy6X4WmOyHm7B/P0wfp99zZMWd/T+qnwx2z0QvgAtJSswG+5r1YQug8G8xbCF2gV1YfKIqcklNhnwW9x/JW4+IWN3Kib,iv:Rmeh5PKvl0DZJbZ+8xXpLRZZmZJw900b1LkHP7ldM0U=,tag:CgEMcuFpWpL/oAW3Ozc7Ww==,type:str] minecraft-pass: ENC[AES256_GCM,data:0natV6dEpItFp5zsUKqgVMZLLmqRLBEf,iv:Bc7RTXnpdec0wn25Rb7SkVTf5BjXzq3YCXcjwrC7V9k=,tag:Og5qN94G6pHdpIk6YDg1ZA==,type:str] vaultwarden: env: ENC[AES256_GCM,data:1MzIqnV/PCGNNqKVwhxZfmV92vRQsn3OxuvCXUtKyCmoA2xxD91U3EmMikTqM3EOHYAMHbF66YgQC5JjivbIF06OCeXMMLpGuN8ibCUQq7M6PQ34/LDMZnqynmC3/U0FJglSU7o1KA0=,iv:novSYG6j0l17xogdE5WiS2gNPNAVKeX9lgxe5EohBHk=,tag:w43z7a/MzObvVTQh8AiSTA==,type:str] @@ -43,7 +42,7 @@ wireguard-deimos-private: ENC[AES256_GCM,data:A/LbG/kTjT0xa93Y31RXfM6D9ibHHjuaZ0 wireguard-deimos-public: ENC[AES256_GCM,data:ZhcnUafVzrPtEP19TgnsEl6Edwjxbkeb2N+Rg7V1O7zArhcc+Owk/l6iHU4=,iv:UcKBnz/4sGyLM/lQJo7e3G0qWAWlTtRNl5K1e3oT1sw=,tag:BbjZcjl98X9aoCTD+hfhgg==,type:str] glance-jellyfin: ENC[AES256_GCM,data:ozdDKgAWkA88J2j8RtiOP/aQPAt/neUOSlAZF20g510=,iv:x+VhYlnA9F/VPrzVcma4/oPelCc8kjWoTZvOs4L9Uqo=,tag:crdSDjr8Y5GH/JAF6t8Yeg==,type:str] opencloud: - projectenv: ENC[AES256_GCM,data:+XCd3xScfxCN1Zl5L+4RAOjpmMPhVLSBtqH2nkEUpXhssy5EU82qAanNmqwiIJ1VrYXYovuu3XOwRKY3Ub1nsR5h1S0KUCwav2zmFKVopxF/5jVNIk6qR8Ggz/fAa1YQSW+SAnrtRGvP0Q1SERlCgnH4isVxNvWPyWCZKIgiX2Enu7hVwsJXKLYDomRWt47zzXNUzw50aFn7xPtXE/AYbMPBa+FweCrCfkaQ6i6jPvkdc6VBYTqIanD0908wB2SJA+1xvY7bYgRVB17/4a/9DuUN5J4xU84TOW7EFkvC/hWhlhC58GqQrOFyAgTP4YJHKGbLVKPlc4fcNMh5+pENpPG2fRDElCaLoJcYe6sYhaCDSegpDR/U9bgzKirnCu/hmdG+NQ3sGK/C89JL2kZT+tVT1u5JWnKGOGvLGQm73QUmnssDZVd8ubNsnd57W7siqAXY3+DN46yLrGgmTfHTRi4x2DKF8VCD9jXOxWsyoLvKYDyz09H9dI72xlCtSmcrFAt7bY7uEAWutrPCf3Kh/gq6oFUAPBEwfqhgnpgGA1vyA6o4zhxl4Rqye5YZMx2uNkxdA4wmk9KB/e7BVR/P04TSXoAV931OX7bnlw3XjSw5NTPEPnpmwZ3VPRGGkz171RiQQp+CkwUr35+DdwFrGazuv3wlwAhM19h9SRn8jikrw6PPGVehYp8mB/FhpNgqV0nM2DfjaBqE3yMfDzXH5b92t4Q=,iv:6mlHq6yh03x/FbZNu+A9QBoV6ALX1rRWuL13ItJWriI=,tag:tK6Ek2fzgPPWT8WCeU1Frw==,type:str] + env: ENC[AES256_GCM,data:rrPJwlFwSG01T6Dv4Sg+XAiVHc2hHGiAtFRBuafCwPPNNFnMWKgUGPCecobVegbbPtQ6xbFOoaJOm0dJXKAfm0vvgWhBn6EeozalXfVqhAIRw1qAttJRmZE1TVK6l+Auo9nRerLtk8ULFkYUulRNtHcHpy4Qzd9K7d9v/NoU/nl1nCIiGQ55xh8SBWRp8Wiy+Dmiz6kvyoN6xAdv799Rhs4uJrp5HrHLes6dJev8iBLRaJ2RaQ9kiQ8BDksKxMQJmvQx0MTC/Jq/0jJdKD71FJOlDN6ml4WMoxXl/15HZcdp1sMACL0whq3QWMGkaPRne/iF8n8VgALiohCKuiWxpebxk4onLgQFCY51s5ywDQT6krr13KyA77GsW2d4xdG3nb4/Hs8g6kqeycvnNSsDiVcrN2DXCs2F/ZBeOrewhVyWQGdcblGMK6c9j8pMr4/abyfF/59cn4zT2Gxb/BlRtg8nD3mBxyXM0mBg18qRF/2nuDIDkGaVDYywXAVa2CzdytLlDl1LYojas/TD1HZUoPmxs8kd7d6hFOwaNRl3Bsz2eFwu7naIdELy0xyD7YAt8kiEGN793qYpbEAA43vsz0uk1/vEF/nCvRBs8ZyFtY7rQX+vbOTvPsHT7mcFHoDzMkL8+HMXSzFbI9FMecF2dA==,iv:0vfYQzmiHEa//24MFQYm7z/Fi1AHcG+Laumy07ZDy9k=,tag:VW0MeVAGKOXRgFwASyUtmQ==,type:str] caddy: prompter-auth: ENC[AES256_GCM,data:uEj6gruCfcIRoCQY9eNcOka+PAIIhAlKnI+ehZ88aZo90tINcxZ7ZvKqlTJr4rt5o+EO7rvRJcYH/s8/+piszFyxSa64Rtq5KdAjfHnRm0QM8q/2JIHnZsQC3fPz1S177WPs/c3Eydh4VeVe,iv:ZOru4ABFgIy9DoTlMl3InSf8zM1ERNpbRNLN6vy97Jc=,tag:5v3w7kvFQCEPBjchE8K0cw==,type:str] comfyui-auth: ENC[AES256_GCM,data:YkHxbW/0zTmnrggXKl2jNO4OnBaepmCwB3ZC6d8MPIKf8snWJzAvTq5+X5ABzziwKaypHRTcS6vuNntxKrrD8DS7hX9DqVCZc5WeFHI6S5VzHh3SprW2MF4E8nm4Hj+VHoKGmRSSOU1cfX3J,iv:v0Pid0BCY2QsMNaahBvJd4WWZD115JDLHlOCQvPiaGU=,tag:gpsAgt052NoOyIa9WqJXyg==,type:str] @@ -64,7 +63,7 @@ sops: bXBOa1VSakoyaWxpODJEOU11QUZCaUEK8Ch9Ten3DdrPHF1DTH2qei85AlHUOaLD aNfzakake7ej+MxJYdKEU0bcWofNMKzIlZa2uM10KZSENDP8d8qlig== -----END AGE ENCRYPTED FILE----- - lastmodified: "2025-11-16T06:36:18Z" - mac: ENC[AES256_GCM,data:KuEUXAKdm15YCrw3+sXxjKPY/sDgmc/FjHI8uc0BpRNb/1OWv0jGbPU9FbOJENRzqTPHLMeh3NEb/YKHFF/iYtdXih+0x+/vbdEi22djot8vM/bI6PdcSO3W94MH9FpGmiMTpy/qTi7Ukj6q8lFJUovApqv8SdftO/hcfzkB9UQ=,iv:7GhoGWwyP3LxxhMc9pqhZhxD7tfavkX0EtxCDnNG10c=,tag:ua77G4zx5shd24gU/RpjUQ==,type:str] + lastmodified: "2025-11-14T01:30:25Z" + mac: ENC[AES256_GCM,data:EFM/NnmsmUGD0UwaYuuidviMHLvIDpAyhd3y65HpiU+A6hhMnybBiH57Mne0zrdAGIC2fWRFz+HoZ4vW1ghkwjWUcdUq4P14c6DGpsrHczHbpU4rOfg+lirOh0v3gC4NRB5DAO9uIoJ4rCugEDCb37fqURkgDH9e677Odl2/Yps=,iv:mJOghTqDx74rwSrEtPvF06meUSZ2kEi4TFb2eVFwMf0=,tag:cL0FpqUU9ZsSnRLGk/hcuA==,type:str] unencrypted_suffix: _unencrypted version: 3.11.0