superconfig/machines/neoprism/ at b42e0694714f62c07f2e2ea0e4521aa716087c15 · lass.pds.lassul.us/superconfig · Tangled

lass.pds.lassul.us / superconfig

0

This repository has no description

0

superconfig / machines / neoprism

1 folder 5 files

at b42e0694714f62c07f2e2ea0e4521aa716087c15

Hermes configs.services.paperless: init on neoprism 2d ago

Update facts/secrets for service mycelium in machine neoprism

2 years ago

configs.services.paperless: init on neoprism Paperless-ngx at https://paperless.lassul.us, behind nginx with ACME (client_max_body_size 100M for phone photo uploads). OCR in German and English; the nixpkgs module builds tesseract with the languages from PAPERLESS_OCR_LANGUAGE. Data stays at the module's default /var/lib/paperless (static paperless user, no DynamicUser) with SQLite. Login via Zitadel (id.lassul.us): lass.zitadel project "paperless" with access = "declarative", so only users granted on the project (by verified email) can log in. allauth's openid_connect provider keys social accounts by uid_field, set explicitly to the token's sub. paperless' environmentFile is a single env file and the client secret has to sit inside the PAPERLESS_SOCIALACCOUNT_PROVIDERS JSON, so the paperless-oidc-env oneshot builds it from zitadel-reconcile's env file into /run/paperless-oidc, keeping the secret out of the store. The regular login form is disabled; DRF token and basic auth do not go through allauth's pre_authenticate, so API tokens keep working. The admin password comes from the paperless-admin vars generator via the module's passwordFile (LoadCredential). Backups: /var/lib/paperless plus a consistent .backup of its WAL-mode SQLite database (the live db files are excluded). Mailbox scan@lassul.us with a vars-generated password (mailserver-scan) for paperless' IMAP mail fetching, configured later in paperless' database. DNS: paperless CNAME neoprism like the other neoprism services; Gatus checks the login page.

2 days ago

configs.services.paperless: init on neoprism Paperless-ngx at https://paperless.lassul.us, behind nginx with ACME (client_max_body_size 100M for phone photo uploads). OCR in German and English; the nixpkgs module builds tesseract with the languages from PAPERLESS_OCR_LANGUAGE. Data stays at the module's default /var/lib/paperless (static paperless user, no DynamicUser) with SQLite. Login via Zitadel (id.lassul.us): lass.zitadel project "paperless" with access = "declarative", so only users granted on the project (by verified email) can log in. allauth's openid_connect provider keys social accounts by uid_field, set explicitly to the token's sub. paperless' environmentFile is a single env file and the client secret has to sit inside the PAPERLESS_SOCIALACCOUNT_PROVIDERS JSON, so the paperless-oidc-env oneshot builds it from zitadel-reconcile's env file into /run/paperless-oidc, keeping the secret out of the store. The regular login form is disabled; DRF token and basic auth do not go through allauth's pre_authenticate, so API tokens keep working. The admin password comes from the paperless-admin vars generator via the module's passwordFile (LoadCredential). Backups: /var/lib/paperless plus a consistent .backup of its WAL-mode SQLite database (the live db files are excluded). Mailbox scan@lassul.us with a vars-generated password (mailserver-scan) for paperless' IMAP mail fetching, configured later in paperless' database. DNS: paperless CNAME neoprism like the other neoprism services; Gatus checks the login page.

2 days ago

radicle: run a public allow-all seed on neoprism (radicle.lassul.us, 80G quota) Extend 2configs/radicle.nix into a public seed: allow-all seeding (scope=all), listen 0.0.0.0:8776 + externalAddresses radicle.lassul.us:8776, radicle-httpd behind an nginx vhost (radicle.lassul.us, ACME). Drop the tor proxy + onion preferred seeds. Move the config off xerxes onto neoprism, and put the node state on tank at /var/lib/radicle with an 80G ZFS quota (radicle has no built-in byte quota; the dataset bounds it).

2 months ago

machines.neoprism: add facter.json

2 years ago

configs.kartei: drop krebs.users The option only fed lassul.us/ssh.pub, lassul.us/gpg.pub and makefu's key for the download user. ssh.pub now lists every key lass logs in with on neoprism, gpg.pub serves keys/pgp/yubi_pgp.pgp, and makefu's key is read from kartei directly.

1 week ago