zaphyra's git: nixfiles

nixos/zpha/websites: add `gomuks.zpha.de`

diff --git a/machines/leucas.nix b/machines/leucas.nix
@@ -65,6 +65,8 @@
       services = {
         keyd.enable = true;
       };
+
+      websites."gomuks.zpha.de".enable = true;
     };
   };
 

diff --git a/nixosModules/zpha/websites/gomuks.zpha.de.nix b/nixosModules/zpha/websites/gomuks.zpha.de.nix
@@ -0,0 +1,47 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+
+  options.zpha.websites."gomuks.zpha.de".enable = lib.mkEnableOption "";
+
+  config = lib.mkIf config.zpha.websites."gomuks.zpha.de".enable {
+    dns.zones."zpha.de".subdomains."gomuks".CNAME = [ "${config.networking.fqdn}." ];
+    networking.hosts."::1" = [ "gomuks.zpha.de" ];
+
+    common.configure.persist.system.dirs = [ "/var/lib/private/gomuks-zaphyra" ];
+
+    sops.secrets."gomuks/username" = { };
+    sops.secrets."gomuks/password" = { };
+
+    systemd.services.gomuks-zaphyra.serviceConfig.LoadCredential = [
+      "WEB_USERNAME:${config.sops.secrets."gomuks/username".path}"
+      "WEB_PASSWORD:${config.sops.secrets."gomuks/password".path}"
+    ];
+
+    services = {
+      gomuks.zaphyra = {
+        package = pkgs.unstable.gomuks-web;
+        settings = {
+          web.listen_address = "[::1]:29325";
+          web.username = "\${WEB_USERNAME}";
+          web.password_hash = "\${WEB_PASSWORD}";
+        };
+      };
+      nginx.virtualHosts."gomuks.zpha.de" = {
+        useACMEHost = config.networking.fqdn;
+        forceSSL = true;
+        kTLS = true;
+        locations."/" = {
+          proxyPass = "http://${config.services.gomuks.zaphyra.settings.web.listen_address}";
+          proxyWebsockets = true;
+        };
+      };
+    };
+  };
+
+}

diff --git a/secrets/leucas.yaml b/secrets/leucas.yaml
@@ -1,12 +1,14 @@
 wgPrivateKey: ENC[AES256_GCM,data:Hvp9TnEnuijffncHVU9LMNlNL5jsrdnDkFlDbEDPjpfGeZ6jCvx1O/BUGxQ=,iv:FWBUEtNfotGbZRoZj1xOvkiv3NsUouTRLRJy9F+v2nI=,tag:krdGEw5i7wysSD+i1ZMlVg==,type:str]
 acmeTSIGKey: ENC[AES256_GCM,data:9DaTH5dlV4aMIPI083ptjqcPUYpiGu6L47TsMFwyQtVviJcMvhdAQPSL3oMt19jGVSt3hyt4hwSnH2bFbQBvTA==,iv:F8UXkZFr53BjCxSfRmR2ja1AmBovjuF9Kh++atJxQNY=,tag:Ps3iVHcAi/Efe0hvTaLEmQ==,type:str]
+gomuks:
+    username: ENC[AES256_GCM,data:BWlCOgouOg==,iv:dbSCaR9KcSlgw9UmXJoBzyOSNUhrzp6V8Rw8JNj2Aos=,tag:3S34P/jw6syZyOtSTpL8Tg==,type:str]
+    password: ENC[AES256_GCM,data:7EMmFz4dHlN/yMXZvMvPopzRVSYghtfBbkIYk9VQjvrRLAAdAWyrseTReUYnfdkqE9LYQ3vM+RL5Wbiq,iv:wDcxsn5qrJz/W23PYi28s4zTbv08CUaWpqOHEkX5imA=,tag:s8U4evC86MC/bqIic1rUAw==,type:str]
 syncthing:
     cert: ENC[AES256_GCM,data:8HLutfobxqw9AsICdcUzZpOWyBaUaKEbJWxWiR5pDGpnrhNPcsbdpm0sqLNrj0HdHhMdQP6kEnYdiC7GwgEXKQq986mwT//ETD4mfNf/LVHEJKmP6PhUfOSg3BqIOyj4Eh+euySv2anqbbtFn6zCJisVs/a4Jd6jw4ZCfzN9ksAqXmJSllhJe/QGX+7r12rq74vM9z0NzUCKjfJB1bnydKCAmK+PJQg1l+sbOQsjah1IF5Ekcae75rTVs/St1FI85edKuzEjy0Jpe1nTJZh1D9utfdnXh/6Pmwpw0Nb5Sudpp6+98/chn0pH3Ytka9LAuL2AMi3Ku4OtuWQ8tOKdf0l1atUmaW6q4FcxyGXfPnGLZUOKqYBQNBWPDfJV0vqcxLLPgqYIw7VaeIGXnl99qqNgYs65XNnzCWLL7G8r/vOS5iVEMIFzpcD4FxYP4QWnCW0SSWnaHHHy8JuELJdPPLuRjfCr5PJ9AMJJvg6gB/ZxSaz2hduUwC076hLnCkPxNc+OY5oRC7ksp4qVLJE865bWLeVg9PaLlEfDtBlCydxnv84iSAr7FyUZ8qVnhvWZyJcsxVK/putoiY2QPq2Joitvh+VafE4dCjaGfzaJ9y2gKUJOc//AZpbnN1x38puiX+sAuwo7MohOysIyjWLpqvN3E3UZXyC6CJbPX5NNYoHIGAWDVmArm88vv0l6vLkE7u4HE8atK+Q6/iaYoAIb0wxZuVDeV6lNarqMjjDrd63D2DfP9+eQd9NDT9+QPO3CUrZnvfWxDv3qdR2koX1hXjUoSSmRpCIjuMagBTxEnd+yrxG2D6yb0hA+Ph+3Oh/Vaej5+WT9+HP2F2r3m51wLRFwxWAWw+Ug08idMxykh4eX+XflWPtnqRUqt+HyYMUkadN33MTjKYGzqu9e0cRM6LgnoUsII7xdwquOc+mYAwclE2axF/maj6KmJesOUuWu/K+Gvni6TOVKwgPzhDgHthsekYVZd99iwCiugDmAmALCVV9xhtrg034R874dy58hfV36HHUlmB0BDJtDn+vqSbSsTHAqMB+uIh8=,iv:EleAtg+ncqhC8sZu41h8otk2SXNMDW59XtKx0CozbHA=,tag:MqEfsb5T9H7F8uJaqcw7yQ==,type:str]
     key: ENC[AES256_GCM,data:XJNe9tsiItbqJ+GyTUm5lvWW+K0DYTt8gYySPcr6+O4vp2RGf3ApxW/ET0ULjVeKaBO2Io7E4Rd9JZh1T3lcHWR3NyWCTCQf+qpp9P2PT0fZfr8t5KoCh9NiSuWAm2iCOkbe4kWtZAnXJXX2snZD8TS31wozjL59SkU5x+o/MY2Peq0gAwkpCYBdgMkfdCldyF34baGzXFythxf22KUNKbvrizNbYyXGryLuqzs9m5GEFlDUQefZavfskKTfLEDz9ELGcqJfuhdHRO/gfVjXTnGeWA3mQgVCCUV074PADSSPcBLgG9LML7VawtLrCakkdXCUYCbrtGITjd28lyPZuOABm989R1y/RqYb5u6shFY+s/iBK2Mf+f7vng2DjydU,iv:WC11PUN5aiu2sPQGJFD5B1ZWWS3ivvIXlbqA67rhmjA=,tag:7pDKQhjQTGPo5LOlIvDSPQ==,type:str]
 sops:
     age:
-        - recipient: age1enkp0mlswl30s4h7z4qvyha4cmc2n2exs0v97276q5mx0jc86ggs7g2dyq
-          enc: |
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzSlJ1ak55T0I1QWFwaE5p
             T2hBWk0vZnJpcTYxUDYrMkxjaHlEQkE4Z0VJCkdLdlFLRVZxLzV0NkQvenVVd1Fj

@@ -14,8 +16,9 @@ sops:
             QXJ3NDVQeDVJd21uS3BuSU9qYlhyTmcKkzYPbErSC6wHKmu99a2/3TTvGeoXNBs0
             yZeF6s+yy0CzUZaEXvMwGnXGBlngXLoFik0KIGD/TLiMR7DADsVu3Q==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-05-18T18:09:07Z"
-    mac: ENC[AES256_GCM,data:BUJ/cI4aMYmnWt1KWaGpkxue9xP8USCuGyir/PCoZipGMHDlWIUKFNxC4BlOaH5qYIkXucpRoAsCHFBvHdSk92QSuL2H+N8cfMvSZ6PH6r8yGilj/18WUvbrrDwh/G5rNMZ8ykUkZbeKbSBcnDMGHeH1x8cY3We06j4jJzReIdU=,iv:WYnOSA/SEI/fMD7EWJHycQjSsC8Rw9L1WVST/DGxiF4=,tag:i88Kid9GVXwB4K49ulva3w==,type:str]
+          recipient: age1enkp0mlswl30s4h7z4qvyha4cmc2n2exs0v97276q5mx0jc86ggs7g2dyq
+    lastmodified: "2026-06-18T08:19:04Z"
+    mac: ENC[AES256_GCM,data:UMz5N5ENcMIWEUzGkYKIro9zSuMvl6A5eyqifrLVNdfwdGhwTC5bO52ZOJKMf6JWcUWBX462mFYN85OHiSbZuQV/l2Qr5ZydQRkO51GUlScLhQBgrgy6YGq8SjZZnF3K24F141yQNRV7qRtII5o5uBPr/U+5hDUcAUaqIWfwcC0=,iv:NC9FnmCH0+E/jbYzN2D9qWJPii9K4T3X0xliz/pjNvs=,tag:ILLXFq2I16MmtXDpocQu1Q==,type:str]
     pgp:
         - created_at: "2026-05-05T14:16:22Z"
           enc: |-

@@ -29,4 +32,4 @@ sops:
             -----END PGP MESSAGE-----
           fp: BFE6386C8D66BCD4DAE14FC895F0FE7CD7E6A022
     unencrypted_suffix: _unencrypted
-    version: 3.12.1
+    version: 3.13.1