commit 450392686db117ca71ce35796b554fc32067d80d · sapphic.moe/flake

+14

secrets/lanyard.age

···

       1
       +
       -----BEGIN AGE ENCRYPTED FILE-----

     

       2
       +
       YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGN2U2dKQSBlVkxp

     

       3
       +
       NHBSMlhsT1dPaW5MNWQrRGlRMjAvbzY3N1BPQ1pIM3hVSFhhVDNZCmVpOGFNL0o5

     

       4
       +
       MlA4T3BxaUxTczluSzJ4MjRrd09hUUp4UzROV1RGaFpsZzgKLT4gc3NoLWVkMjU1

     

       5
       +
       MTkgMUNUOTd3IHBPYVUrQjlBaHNJT05Hb3c5c2lBbTdxWVFRZWlBSlZ6SFAreWYr

     

       6
       +
       aldtV1kKNEdoY3JDMGVZSGxPQkplc2U2WTAxRVpZM1ZtR0JCT0xPMzZvdTlJNklI

     

       7
       +
       RQotPiBzc2gtZWQyNTUxOSBlUDNUdFEgejIzOUJyaWZJZTVJdUhEWVBmS3g2aXdU

     

       8
       +
       bjFwWUZ0L2Y3SnhUdFNVSmdodwozc003WTBTbGhTaFJJVTl5ZkFLK0FOclFGbnBI

     

       9
       +
       cWtBODM0SUhmc2FOblNFCi0+IFx8LWdyZWFzZSAlSmJuQWNOICNdaHcmY1ogPkhW

     

       10
       +
       ZnpFIC4KeEJoeEFkVmhVNUxJMnJpTUh5OHFxdwotLS0gTjA2dnZoRXNodnNCaXZp

     

       11
       +
       WnMxeTFaQjRFSG5KTkF0Q3NxQ2IxQUxoY1ZmbwoaKD7OaIbKPTw7UEnX5oXODIWa

     

       12
       +
       ktt7tXFbV9T7rHQEyNV/DCi61yxHJzuKG8f+go12O10zLgVPNnW9m7XgU25O5ER6

     

       13
       +
       ittiuprOeSSdRQJ5lCkD8BC7G9NCrASh9dQ4SXcfbKqpm91qAhywxXW+hoVxAnLJ

     

       14
       +
       -----END AGE ENCRYPTED FILE-----

+1

secrets/secrets.nix

···

       13
        
         "bluesky-pds.age".publicKeys = keys;

     

       14
        
         "caddy.age".publicKeys = keys;

     

       15
        
         "glance.age".publicKeys = keys;

     

       0
        
       
     

       16
        
       }

···

       13
        
         "bluesky-pds.age".publicKeys = keys;

     

       14
        
         "caddy.age".publicKeys = keys;

     

       15
        
         "glance.age".publicKeys = keys;

     

       16
       +
         "lanyard.age".publicKeys = keys;

     

       17
        
       }

+1

services/default.nix

···

       3
        
           ./caddy

     

       4
        
           ./glance

     

       5
        
           ./bluesky-pds

     

       0
        
       
     

       6
        
         ];

     

       7
        
       }

···

       3
        
           ./caddy

     

       4
        
           ./glance

     

       5
        
           ./bluesky-pds

     

       6
       +
           ./lanyard

     

       7
        
         ];

     

       8
        
       }

+32

services/lanyard/default.nix

···

       1
       +
       { config, ... }:

     

       2
       +
       

     

       3
       +
       {

     

       4
       +
         # Redis service (new style)

     

       5
       +
         services.redis.servers."lanyard".enable = true;

     

       6
       +
       

     

       7
       +
         # Age secret for Discord bot token

     

       8
       +
         age.secrets.lanyard = {

     

       9
       +
           file = ../../secrets/lanyard.age;

     

       10
       +
           mode = "600";

     

       11
       +
         };

     

       12
       +
       

     

       13
       +
         # Lanyard Docker container

     

       14
       +
         virtualisation.oci-containers.containers.lanyard = {

     

       15
       +
           image = "phineas/lanyard:latest";

     

       16
       +
           ports = [ "4001:4001" ];

     

       17
       +
           environment = {

     

       18
       +
             REDIS_HOST = "localhost";

     

       19
       +
           };

     

       20
       +
           environmentFiles = [ config.age.secrets.lanyard.path ];

     

       21
       +
           extraOptions = [ "--restart=always" ];

     

       22
       +
         };

     

       23
       +
       

     

       24
       +
         services.caddy.virtualHosts."lanyard.sappho.systems" = {

     

       25
       +
           listenAddresses = [ "::" ];

     

       26
       +
           extraConfig = ''

     

       27
       +
             import common

     

       28
       +
             import tls_cloudflare

     

       29
       +
             reverse_proxy http://127.0.0.1:4001

     

       30
       +
           '';

     

       31
       +
         };

     

       32
       +
       }