superconfig/configs/dns/ at 7fdf54cbea81440d352d66eafd61429d2c388e76 · hermes.pds.lassul.us/superconfig · Tangled

hermes.pds.lassul.us / superconfig

forked from lass.pds.lassul.us/superconfig

0

This repository has no description

0

superconfig / configs / dns

2 files

at 7fdf54cbea81440d352d66eafd61429d2c388e76

Hermes configs.services.paperless: init on neoprism 2d ago

configs.crit: public https://<id>.review.lassul.us per review The crit wrapper writes a fresh random 10-char id per daemon port into /var/lib/crit-routes; a path unit turns that into an nginx map on coaxmetal:7720 (retiolum only). neoprism proxies *.review.lassul.us there with a wildcard cert obtained via DNS-01 (RFC2136) against a delegated _acme-challenge.review.lassul.us zone on knot, so ids never hit CT logs.

1 week ago

configs.services.paperless: init on neoprism Paperless-ngx at https://paperless.lassul.us, behind nginx with ACME (client_max_body_size 100M for phone photo uploads). OCR in German and English; the nixpkgs module builds tesseract with the languages from PAPERLESS_OCR_LANGUAGE. Data stays at the module's default /var/lib/paperless (static paperless user, no DynamicUser) with SQLite. Login via Zitadel (id.lassul.us): lass.zitadel project "paperless" with access = "declarative", so only users granted on the project (by verified email) can log in. allauth's openid_connect provider keys social accounts by uid_field, set explicitly to the token's sub. paperless' environmentFile is a single env file and the client secret has to sit inside the PAPERLESS_SOCIALACCOUNT_PROVIDERS JSON, so the paperless-oidc-env oneshot builds it from zitadel-reconcile's env file into /run/paperless-oidc, keeping the secret out of the store. The regular login form is disabled; DRF token and basic auth do not go through allauth's pre_authenticate, so API tokens keep working. The admin password comes from the paperless-admin vars generator via the module's passwordFile (LoadCredential). Backups: /var/lib/paperless plus a consistent .backup of its WAL-mode SQLite database (the live db files are excluded). Mailbox scan@lassul.us with a vars-generated password (mailserver-scan) for paperless' IMAP mail fetching, configured later in paperless' database. DNS: paperless CNAME neoprism like the other neoprism services; Gatus checks the login page.

2 days ago