zaphyra's git: nixfiles

nixos/zpha/websites: add `assets.noncd.de`

diff --git a/machines/cuvier.nix b/machines/cuvier.nix
@@ -158,6 +158,7 @@
           "music.zaphyra.eu".enable = true;
           "memories.zaphyra.eu".enable = true;
           "links.zaphyra.eu".enable = true;
+          "assets.noncd.de".enable = true;
         };
         configure = {
           netcupTunnel.enable = true;

@@ -183,6 +184,7 @@
               cuvier-things = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG9ME2e9a2BbFgTxVY5OSL0VupYxZ10SjcLeO27qBBIF";
               cuvier-gotosocial = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOvl23IonsUnU5nDVMjNp0W56HcT1TTuXRvFrkOay0iM";
               cuvier-immich = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA8a7B0GzYf1J1Of8iwSMFQUON6CWCwnJW94K3uX95ij";
+              cuvier-datendrehscheibe = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGYAC/RckXsNgICzcssc6gTiE4YJYjbVIvk4TUIlW2uC";
               isodon-gotosocial = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID85l2Im1ff0JGp8vH8IngnjKB3K/cFiur/grPxWJbUE";
               isodon-navidrome = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMv54uqcNCmcbYWzA1mGPeKrh29E2+/sr08caX3jihQc";
               cautus-gotosocial = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIADOmcKGelaxzS9oObFMOdfUdm/PWS6Og9IJFZlLrsvm";

diff --git a/nixosModules/zpha/configure/dnsServer.nix b/nixosModules/zpha/configure/dnsServer.nix
@@ -93,6 +93,14 @@ in
               ;
           };
 
+          "assets.noncd.de" = {
+            inherit
+              SOA
+              NS
+              CAA
+              ;
+          };
+
           "katja.wtf" = {
             inherit SOA NS CAA;
           };

diff --git a/nixosModules/zpha/websites/assets.noncd.de.nix b/nixosModules/zpha/websites/assets.noncd.de.nix
@@ -0,0 +1,203 @@
+{
+  machineConfig,
+  config,
+  lib,
+  utils,
+  pkgs,
+  ...
+}:
+
+{
+
+  options.zpha.websites."assets.noncd.de".enable = lib.mkEnableOption "";
+
+  config = lib.mkIf config.zpha.websites."assets.noncd.de".enable (
+    let
+      filebrowserSettings = {
+        server = {
+          listen = "[::1]";
+          port = 1312;
+
+          database = "/var/lib/datendrehscheibe/database.sqlite";
+          cacheDir = "/var/cache/datendrehscheibe";
+
+          disableUpdateCheck = true;
+          externalUrl = "https://assets.noncd.de";
+
+          sources = [
+            {
+              path = "${config.users.users.datendrehscheibe.home}";
+              config.defaultEnabled = false;
+            }
+            {
+              path = "${config.users.users.datendrehscheibe.home}/etc";
+              config.defaultEnabled = true;
+            }
+            {
+              path = "${config.users.users.datendrehscheibe.home}/Sounds";
+              config.defaultEnabled = true;
+            }
+            {
+              path = "${config.users.users.datendrehscheibe.home}/Bahnvorschriften";
+              config.defaultEnabled = true;
+            }
+            {
+              path = "${config.users.users.datendrehscheibe.home}/Designvorgaben";
+              config.defaultEnabled = true;
+            }
+            {
+              path = "${config.users.users.datendrehscheibe.home}/Regelzeichnungen";
+              config.defaultEnabled = true;
+            }
+            {
+              path = "${config.users.users.datendrehscheibe.home}/Serviceeinrichtungen";
+              config.defaultEnabled = true;
+            }
+            {
+              path = "${config.users.users.datendrehscheibe.home}/Kursbücher";
+              config.defaultEnabled = true;
+            }
+            {
+              path = "${config.users.users.datendrehscheibe.home}/Technische Unterlagen";
+              config.defaultEnabled = true;
+            }
+            {
+              path = "${config.users.users.datendrehscheibe.home}/Fonts";
+              config.defaultEnabled = true;
+            }
+            {
+              path = "${config.users.users.datendrehscheibe.home}/Source-Code";
+              config.defaultEnabled = true;
+            }
+          ];
+        };
+
+        frontend = {
+          name = "assets.noncd.de";
+          # disableNavButtons = true;
+          disableDefaultLinks = true;
+        };
+
+        auth = {
+          adminUsername = "zaphyra";
+          methods.password = {
+            enabled = true;
+            minLength = 8;
+          };
+        };
+
+        userDefaults = {
+          stickySidebar = true;
+          singleClick = true;
+          viewMode = "list";
+        };
+      };
+
+    in
+    {
+      dns.zones."assets.noncd.de".AAAA = [ machineConfig.networking.ip6Address ];
+
+      sops.secrets = {
+        "restic/datendrehscheibe/repositoryPassword" = { };
+        "restic/datendrehscheibe/sshPrivateKey" = { };
+      };
+
+      common = {
+        configure.persist.system.dirs = lib.singleton {
+          directory = "/var/lib/datendrehscheibe";
+          mode = "700";
+          user = config.systemd.services.datendrehscheibe-filebrowser.serviceConfig.User;
+          group = config.systemd.services.datendrehscheibe-filebrowser.serviceConfig.Group;
+        };
+        services.resticBackup.datendrehscheibe = {
+          enable = true;
+          targets = [
+            "restic-target.fc9f.de"
+          ];
+          sshKeyFile = config.sops.secrets."restic/datendrehscheibe/sshPrivateKey".path;
+          passwordFile = config.sops.secrets."restic/datendrehscheibe/repositoryPassword".path;
+          user = config.systemd.services.datendrehscheibe-filebrowser.serviceConfig.User;
+          paths = [ "/mnt/datendrehscheibe" ];
+        };
+
+      };
+
+      fileSystems."/mnt/datendrehscheibe" = {
+        device = "/dev/mapper/data";
+        fsType = "btrfs";
+        options = [
+          "subvol=datendrehscheibe"
+          "compress=zstd"
+          "discard=async"
+        ];
+      };
+
+      users = {
+        groups.datendrehscheibe.gid = 1312;
+        users.datendrehscheibe = {
+          isNormalUser = true;
+          uid = 1312;
+          home = "/mnt/datendrehscheibe";
+          group = "datendrehscheibe";
+          extraGroups = [ "ssh" ];
+        };
+      };
+
+      systemd.services.datendrehscheibe-filebrowser = {
+        after = [ "network.target" ];
+        description = "FileBrowser";
+        wantedBy = [ "multi-user.target" ];
+        serviceConfig = {
+          User = "datendrehscheibe";
+          Group = "datendrehscheibe";
+          UMask = "0077";
+
+          StateDirectory = "datendrehscheibe";
+          CacheDirectory = "datendrehscheibe";
+          WorkingDirectory = config.users.users.datendrehscheibe.home;
+
+          ExecStart =
+            let
+              args = [
+                (lib.getExe pkgs.filebrowser-quantum)
+                "-c"
+                ((pkgs.formats.yaml { }).generate "filebrowser-config.yaml" filebrowserSettings)
+              ];
+            in
+            utils.escapeSystemdExecArgs args;
+
+          NoNewPrivileges = true;
+          PrivateDevices = true;
+          ProtectKernelTunables = true;
+          ProtectKernelModules = true;
+          ProtectControlGroups = true;
+          MemoryDenyWriteExecute = true;
+          LockPersonality = true;
+          DevicePolicy = "closed";
+          RestrictNamespaces = true;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+          RestrictAddressFamilies = [
+            "AF_UNIX"
+            "AF_INET"
+            "AF_INET6"
+          ];
+        };
+      };
+
+      services.nginx.virtualHosts."assets.noncd.de" = {
+        useACMEHost = config.networking.fqdn;
+        forceSSL = true;
+        kTLS = true;
+        locations."/" = {
+          proxyPass = "http://${toString filebrowserSettings.server.listen}:${toString filebrowserSettings.server.port}";
+          proxyWebsockets = true;
+          extraConfig = ''
+            client_max_body_size 50M;
+          '';
+        };
+      };
+    }
+  );
+
+}

diff --git a/secrets/cuvier.yaml b/secrets/cuvier.yaml
@@ -22,6 +22,9 @@ restic:
     immich:
         repositoryPassword: ENC[AES256_GCM,data:iF466mRAzG0k4lLFlKowIR6Hy2NjaFh6QJwsOeHZtHGJ7C0lxEIuPRPUiJ0Yrz7fYtGC/Em90TX3+t0f6IWANw==,iv:891vHDFzYz6/wI3LaAgfCKbLnKvoj929MSa/CvFP6TA=,tag:/JNiC/OVM29EPCS43tCfhg==,type:str]
         sshPrivateKey: ENC[AES256_GCM,data:GvejdgJYWXm5Za+OhPpIoUujtDGHy+F6L86L8YNQUxP+38X0dMHnXAKWhnhOZZ+iO+ny6pjKYY+qhAZAEOAP1xmPHkVOHm4pcXIoL4TZuhmYUzf334uon4krgZ7kS2Cw4C0xMzQOyT4NV/0HmvsptiJt2bQNdgpFgzgDgi0EnqrmuPxvo/TUDviz+g3Z2zZhsupgBS83pdvAQxUPEWPcFR1+mIoEcmNXEY2qjmFNPi3IrXOTQ3Xo8RhouKqpnt0IvlpVSjMCDGVtYkIwdD+0pj3QNe7+eVMq9zG+FHptI59wj6UiJOUIsoSxvEqqN2DWIwq00pDnDJyp/NnAvZB4C7A+L7O4nxqwH4f2eYwlIWaouSs3Hz5PPfqduOL+Oi5whb1MmHslpGe+kK6AvHbowzy456ZYC3MnOFNuXNZMjPB0Vwdtk/BKNWZv86GWZbqTsBT+lxtHivG8le036EvMEANrBP+hDt93sZlntosxHqRNAmS2rm3RmToCkpGFs6QZaazyDyf2UZWTnYYDWnLE,iv:eBawBIa+Wdj9c/cUK66J5kQ2AzCoqlBXM8brzAHlD+s=,tag:egrihMdDqBpL/rIq2Yl2Hw==,type:str]
+    datendrehscheibe:
+        repositoryPassword: ENC[AES256_GCM,data:sBF8x85rQC0IrWWpTVqGekdlz1KZHinmBYwVL4xl+syiGHkDrT+BTGfaUunR/90e2e0vgTZgmJ3G696fospN+Q==,iv:4GgDGOlu+4fwS/ga4W1sTiAyrH6tZM0Y6y721B4/X0g=,tag:sW7s55CJClDXu7rSWMvHSQ==,type:str]
+        sshPrivateKey: ENC[AES256_GCM,data:p3DzrTxtB4HKo1mjGUevd22EaEWrwQryZtXpw2mJ83YFQYL4OfQYJJrX0FSvKSjShM2zlq/0wEgthdY+nBwIiGjGOgR8TBwrWtyzxWvDC8MK/6C5CR/6nlVufPN+BHind11ivj/jm9qlmOevPldmVpA63VFOGEiJ5oyHRYmtDPT6Czz8TcTvzUZNMifG9DgLjwDuAi/8WwZHV4sJwKLbYWLwKmjO3KMRtvTkMw+lZcl03qco2nrs/1agImka8We6nNK74ewKDCcFQYfUVoRzyxXdIZPthcCeoAM4njjNsenZJfeEwjpVlszv63JPUU9Q1Lssir14AFEpL0jdSzZ5cgzwGJ2EQbs+ZY+dJncXARDzPcMO7m97ctMpp347dC+MbIWyTMedMAFdLmREFbwlom1BT1W8a5U1Ck69p1Tf5zLpnlhrFtdteW2Fuk+hEqS7ApyyuOpFfHTu+zlR+iy8KKj3biEpbjKZUl1YJst6NbJDIEdArNk5n/C2rV3KyEKE0lFo,iv:54kGeQ4UPhy9xpkv2HeTgH1YJbckZZEs/A46q0X2fFM=,tag:G6psWbUbJ0U3i9i7TOtiaA==,type:str]
     syncthing:
         zaphyra-documents:
             repositoryPassword: ENC[AES256_GCM,data:1Gh32TQG8KAYeyD0v7GJ7cRCRfeEqIwcN9yMOWqcrNi7ZnW1KHcnY/EiAeqimKLUjxslgwp4wchReJJ3/rRdCA==,iv:HJMmcpXzYgU8dukMXUkxvktjndGzGj4PaDNzMMUJJVo=,tag:jTSTrRK02VIKwmUHpxyonQ==,type:str]

@@ -46,8 +49,7 @@ restic:
             sshPrivateKey: ENC[AES256_GCM,data:8bZXSDMHfNN2+1/CGNArqA8RkzHbbG6MJhz7l4KG2PEqFxkDl0qyCfCSk7Joq8r19cvz3AJZd/UqkRv/ga2vQg5oxsi+u8dCzZmdUCczWPIErcd48DIHQvOYDSigN76dMCF9idyX9StEoqUPpfIxIfA50KLGOtVdlLQqOKDIXSq4Zu5UVfG2zOUHCexgoNsT6QHsBnSWTXTzbsgdG3dobRaeXIn8aEBqmHrZ18bBHpQcf/xhEFRr9kjzL5lkTxR2zrcja7wvXFQ9q8/zh07y7aXosFnpYcMWp/ysmSgk2xo+PTYm3aFQHLUjuWJswJDOXpnjWVvwlpJYaneYU2fo/RFHPpih51o3W5xL7FOYNXqfo587KIgATtkfFj6Sy0GZraN+PQZOPeIM73Qdzyu6PBx4Nyr4z/aG3jsLYbczziFI8zAoRiRBsfs+TPWflZWFTkKCOiHjT5jczI8JmETdXibBfKwMV3nbaJhjUhramWyMyLXd4v0c4tIBOND/tLRFSOOyZ6kJVOq4xN+2wKk=,iv:F1owr/igSXCS6QEUHLv9pVLcoc7kHghcvWpNu5cS2XA=,tag:d3VeiGO5DQnsTGNFx1Xb6w==,type:str]
 sops:
     age:
-        - recipient: age1wztgmu7rm4yvdr0x8xucwfmnf0sruafwjx2ttl9cvg54epn0qysqqnr5n3
-          enc: |
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvUThET2FpV3BjcS9jdHZC
             WjZWeDlZOGErb3FHK09TMXBuUENyQXRrTEVvClFINUo3dCttSGkrNnZMQnZNcEc2

@@ -55,8 +57,9 @@ sops:
             VnpNTCt3OUltYmRuVWtzN3lxdmhGdzQKhKCLyIW2Hb++BiBQiF3WaRUd5KmYkjea
             ZdPTn4IM6RaZJrmIJ9sViciFqUZfJ4EwKDnPUjwB82leJ167OHfxxw==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-05-16T17:25:04Z"
-    mac: ENC[AES256_GCM,data:SGvyoQcP/T9glulzRSWH75bpF/IKqB32pB4qdquk3ADdj9tqxbIGSBbabjxOAvVmARq3cRoDyAYYQ659r/VxvuL+u0NSiGw3O4T3w5k7Nl1uc64c4FI3ee7ePQceEld9mU+x7Wvoq7Rr9Y2ltHh5uje2VeAW3IyXdLaOxbLkzE4=,iv:df/Ox4pNObbVw2mAfhUSLVkhnA4aIUh1jzIIz1YYuCU=,tag:7hduOgc1ee3aDbPV9aOGRQ==,type:str]
+          recipient: age1wztgmu7rm4yvdr0x8xucwfmnf0sruafwjx2ttl9cvg54epn0qysqqnr5n3
+    lastmodified: "2026-06-15T13:43:48Z"
+    mac: ENC[AES256_GCM,data:U5KfkI9PT25rDN6/b7ncoV8us2+hy5HDDfqkilnRXxZmS/87XwkO6QmLu6QKW7n7w46nexLLqbKEbbJRTb0k9aulqPGGx5hDIxhpalR02Z7jfemYWq0XSr88dfz7QA0KQF43MedTbVdNI3KssNmzbpmRMuRH5MqkNj22TRiCj6I=,iv:DLTSovlTeY42VGyw+g7jBgYtrLlwPwyMNmcLtgj53yg=,tag:w07PBWu3ULqyjsDcqMQ4aw==,type:str]
     pgp:
         - created_at: "2026-02-11T11:23:03Z"
           enc: |-

@@ -70,4 +73,4 @@ sops:
             -----END PGP MESSAGE-----
           fp: BFE6386C8D66BCD4DAE14FC895F0FE7CD7E6A022
     unencrypted_suffix: _unencrypted
-    version: 3.12.1
+    version: 3.13.1