ddns: update script

hosts/gerg-desktop/secrets.yaml

@@ -8,8 +8,6 @@ store_key: ENC[AES256_GCM,data:2XioKwoH0V5QuedXl4w2IFrT2qOQWF0kbchYTMhyL9BaUqYHh
 github_token: ENC[AES256_GCM,data:nIWnOvoO8jcoPvKIF4TDdMZxO5H+mAEjLOfQpPmIh0gUSHjadFCwdI0FpMN3D/+8zUXVuAWd2FfCdzKIxGApGqlXAn3aajkUeBK8rYF554COuxa4B43SjRlfvanCZyfsbxzFxoO1RDlzHUMUSzYgFE8wdvj804luIA==,iv:OcRPCZP3KIKv+OuS28jIEp5zQyFw/41gMMdPBVj5N9w=,tag:t+oJDxqwyFU92kDh0ot+6w==,type:str]
 gerg_ssl_key: ENC[AES256_GCM,data:pFcpNaMidtLjmVopk6hkDQy4RB8m1Wg0lJpBE04vBlXsCEQ0kP3ZHVN5gT+meu+8DVh0MXag7CNArjWOBQQme+br2J2cCfayHSPiOo2aZP1ZEhmm/aLD3PCK/Goo4Qnp38ypyqrRp7H1I5wzFeiE97oI3jk3CbSgBCjAiD4N7FOKWbXurhBsU3Qulbeyup8eQS7NYdF0aY4a10nLiRrhyefIXpTMhiKBA5dwSfa0VGNOnPvjri4hvA3+nGqDkQBav2t3zb+K3bonx7hYbzW4kzNYPviMTirKPBSad4V4E/+GtZ6N1dpZhE0ADrGsN1ycFnbXG5sic0311cM1xiOZLlSpWC5uLHq257MxwG+pTS22Gc43qhUupTbygPiBihoQFo1BQKSSELwUBymf6iZ1MmEp3b/CDZoZ4eHCFMKsrvdn9gA9Di/tz1wBRZmFPczBmUYxOBMR2QRtct+RhRYPs3+J4GKO9doZ/2uxlMUlo8logD/3KnbvhYQDcpdO0vsOoecVlDRl73RDkNR1NUwuSHubRQKU+ucp6ZCW+uL/1fcXs5PrdjhLsgh2t/vNjZT9Lr3upnkITxQiA5BIx8lNbe2SHYOKnW78KdVJTyJhcNXtu4uS+34me+x4iVNqmW6QbpmImbQHetUAdJMqzT2wE3ha8WV2jyjpYSkRWCjbYBJtT4ScBRPVYXZZJiE0iBBxgRZ4x1tFtl0nGhITQZxWo9Wlkp+5TcLfL5rX/NSSXAkYvBVZQoftgi3/aO73sS8hGm61o2DbD4Q2MLm1fe9nP8oNtzIdtT79xMEj1Dow7Hz/xRwIVHynVKfclVusx4aI3gZs4tWLJIGTUFK5zlFn1aLg2lOOhN5wXU1VaQ9vClO8wEINcw4zLWzjfoDq6NkK6o1se3TzjmC+aYaEGt+vYxiTI14nAtRx8IBB7iyBNp0SgMcgIHl3UuzNGMz4suVDne28G4BOmY6+FkA/wgaYbr5ShY8d+FyaHecX+ohfPBvPDm4wZwRNfaIdFcrvJ3JpqGEGgDEY3mE6eUeRe4VvfMEkkJeCpstHObC9wmkQ/gMOUsk8Q4A1nrZ/BHQxeltn6pYaZT0escjO7IITE4vT0y8/Q2nwMRKp+cDLTyO5yl/4SanPN3N6cYs6ze6jp2zo/9ue9t6YoX0TfpOr99sHinwFmlxSbXeisevZhGYFiVHQjNMaN8w/5/8t/FKrbcwmMQ3LgtGXCfP+5rwvIHVFq4+ItkGoWzw2sDio5vOa5cbYDmV4nq/OJzVbjaIdNGpagHMKK/Lbe/Xr/+GuZxJ7wS5x4ViZtCUDUCtqmFb3foxANM3REZTn+TIYjkKCXklEjVsbcOKRH6dKGQqYQKkeDZyOSiA6DsNwMvqM92oDmnpsSAFTTSxUGic1mnKBEZDqMDA7gfYZLDZM2SL4e9yyj27jv/PDGTL2UEfLfRTkiLcUL3THU3ak9HHymROwp8yWtJ3divDawyghZJEUY/m+WW0wP+SI0ckKEl3sB8fCK6DCAPASK2WVfJ9VzZKDIr7caFHnP+hXndLg40r4IQmClwYcCyO7EZRu4W4GLtCR5tdt2ef9ys0S98/d+Wh3ZQnDOJWQk7AL9FgEDxpXvbN4rOVCWG5HpGIM7RdgCXSluvdfiqv9uL69DsjMbJIFU9OXPm0CPRifKybQNCWbCrwxgGmp7dlSbk7Y7vyz7QAwiBzjiBAPUUipbssq4bJlyT2KJdjKpd4HYVHv0yMWOlmIGxV55XbS/ieItUxjSG+JNODZhclerlR/axaWxZJ1aKleFKbnAZ0F4ugzv05p+HSlRg9h8KHbaXfaFkyO7NLyyk47YMCcTGLXVmIFsPMUcECBqZV/l5vcswcRqwSygT7TR9lewchn1Csido5+ndrr/42kzdFccTfBdt75/WJAdkrS2+vhRH7X8PR1KLD6InSvFFYxDBgTuaJGwwiF2tMvKypyp0Zk2nPp+h1vIWxQQKTe6SVoLzPejMQToqDfiq0g0JK8CiIVne3mOTXQTHT8n+7YgQp73XAJaR2HmTQNa8XcmdCtJ6tCqNGygMSicK1siBcTN/xB2JGLNC4zviK4aFgmeODNdE99nCccU799IbSQrhyMEwmjP2+hSwz9fumwhJfLMge/eG7BqKuaA03402+JVNuAphmSTPXGpu/nf2YHdZ2mMqoqzoAtAmuQ+EcUipvjkSLfEWPp0FczubIVGT5jvnndLCzpIIRio9y/HpRJszdEDfGcDHM1pftxI08q8oVxW1R7SGjibVia38G6ZCJaMX4FdHZlIQ3dsC+A5T4rgxozOfzUTPczGdiMf1+6AqXrVYFvsvn/IwTG8mbTlFmYSWjyr34YfCoHEteeqgGzXd+eTOX46OgbBcOx/6dXe7enoN2fq3Obsp6sSDroRm4SwIve1umO8uAgU6dsqIjGwz+BtvdWs09KyJyvujmx62egpZH54yztnhLSX4Tz9M9CECZiLDm1zMXIFIAyb7LkuajAxeM0mkuYf64BTQXbxB5NjxvXO/DGPGfpGn94YNRzBE2qtBJVN+0j5UnA86tJqFKb9oa1bwALzH2sGmjKXg5aLbbbzvx+10Vz1gqx9OaZU6eG/3zUDnhKcUaWjWjEAFZpFNigadPpOMOK4NViE65zbfkfiabDzIlNaR6sRNDL+7MNZC5a1092Y00FSm2oUlRiKmRlEAHypCzcRNuCZfJ5cYXKkOZAcQT0p2unM72BtpNlQq35xG4QE+q6JA7gfi1Xx/g3kki7YwuNMbdyh61stikqC68RhN6ICtmKfGQiycVJwn78CL1AsGtcAFHhYqmv8mRTuan7fA7DnmLKDewghHA01CKczakhhr8p5PcLLtzzO41Au/lV34qlqUPU5DBCg5EnvZaZh2toxA6W3TfKwkPsb/B4QYW8CPRHSBUq3SjkHbgjR+P6HLOGsmuG4Kpg2RlNfFSdhTyhc3yP92lC5ZFZuY73C+TkD5RQ6dvytQfBtlhF7MXbgK5qpnypDAMAOCwT8t+aITNOwDads8XoiZRfZ5d3g669d2auZKmjfoEXvlqvaUhou97xFNOrMXmToDQk0GTjWPhClbEoPISZA30mEnWbRtyZS83igBruZ9OP/5xoanmp36rUMMr2MYxHw3vkOeUtnFHJNARTBFAsRV/jZxgEE64yP0IXc/VJgHUGpHaKsy29tf+TvhEwQ3f4BxVr6ltkZiv1r4PSxdTrA74dz88MJWUDYI8Q4mjBthWDwyi0bZ4+tXuEzX6bHBZHOJLA/23b0cKePLk3YpF0QnnPBzU61W8piv+7/4Xa50z9puEK5240EqhjQaLpyPSV3ee1wh2t9B3bV3z/p0zmYxFLhpMTLAVpEWGfcu8c/nX1ErlTh1peTzzxXZZm6uf9leB9zCiP5d9AS0vmhOR7EB82Lj3TtEJzZ31We+ntUgYynjbjtaYMvKB73WeFWzVRYqMKqNgPYj8C214gJZXtiLYKdw188nSTp8BprDd1mdiT0Gb0nKc7sgZLatJ3AGtky3pSYH8chQMEO1sAzob1U5DDLvFI5JGZwBosKqJicOGn/Gy8Dd8UqDc75+xHkYY21K7/XZP3rwaIQatCk2N+7lbPY1DoFwua+1q7ySIJiRRl/0z+emrN+wCtyCeNarpTbEjpf0sRLFa/OX0NjyMrpFE2QZyv179E2oyShIeLRVHQlxCJZiBt+1YCx0QIz//mCU5TAg7fDVZShr6viAMzY8vh4YaSmgf6QomNIB6NDmS2+Boyusvz6eL1g0/RER+nb1Riiel1FzL7olII/RlhCNt+5zBdnDyAhzWE90QsYJWW/s9HK0EITcp7zpr4ukJvzCo2Sj9rIfohnLjc9fvDNpI7YuUEfAPY23kMApF4Uvfsd7uM/hit5kNVxlkJrZYSojOelK1535ClKiVtlIPed/N/jbz8CztUWIryck16KCT+oZGYTodw1OZlQnmgHF6SOo/5EG+85rwIpSwNqyLsf45RiLpVfAWqF6AdFH0Yhy5ht1p/vO5xXUGyNp0qgZG6tT2/BfTUB5Q5WhW0COfzelL5X92orWJKM8PeeAQtJ9tteLTwgJWk1Ld3wjKkY1lKzclyY/u/XUurjXaWflFXUKc77q7yRxwucsiIVRcJYcHxbCeB/5yj3+zL4hK6QsY1cwbbSPSeBibvOW2Aj9bKCrCm6DDf18rhXFlrRhlt5tOIjHveVBBy2qjTZWjcypuFZE2Yhhltb2BSf7mes+D9CO62wDBF6K9EcbwWWcvWjS20BbvCFkxKkmDfsP/lmU+c6j5hvAdWA4/SK5eXzMN/VVQ5S9oc1Ahc15PKGs9mjncNBm20ddicB2kNKGPqF4MMLJUeHDE=,iv:fq1npi+bC2O1OqsizTAgK6qRf8MG98ACyydnGGNptwQ=,tag:kBR6cPmS7uvWlRo1CLQG3Q==,type:str]
 gerg_ssl_cert: ENC[AES256_GCM,data:55drf/NNtx1cTvGLGeISskau3dzXIFl0+KdyNWoy1078bHqiwni/0rQrtpZ8xCCnNs/xRBREWMcgPfMHbGScANaSQofhelleH7OVB6r5LXQdQQ/UA8mLhIasiifaCLzjsG/Y9Ab5vQV1NPJpJ5eI7//tsyeuBhR8AsZQpLxtA3DMzhT3imAzqLVMy0Gc5i/SsnxOeK1NfZf5qiC11ThXahvbp0RLxSsehCVnwZtjLka7/BaFqVqN8R4FkpPvyD7ONYLbIDpPjoKM452NOGsonGYIO9qyoqh0TLXfNnYNlm67TpvRxXZ6WdUSLfpiekdFUhL+/Rv6f/abTcmSqtRb8kEsCA7/CYPL7e0iIuMnwFuM44mks8M9pbXZmm51eaoB6jLSD/fuHv1xIlv25vYlmbfxaXMkNN6L9SLUJ2buFjufvTFjcf4rxZqvHdCBP3gblaUJw1a8MNhlD+naEff4up5eYkdvzxdoBAZRcsstUNEUlKS0HdOmUGv7M6iGBz3rimW9KXXhF2tTzTaL2H5k4WlGID55pswKG4X3Xcr6V/r4dNzOp3LSh5MB3oxqx8aHGqFO53PUzeXFX8m08sHA8cXiC/y9nEhpGzVYbSbmjSqPgA1M4tqwOqEDNdXYzAOE/UM0Fnvsxi5DjOc4XM+GJzRP+VIWBh2vxJl8ro5Bb9llnA9gZCQJ40fwPfUupX+ZZcO9gdPoa6sd9zrPtpFiR960FyIw6AdY8nKAxippm5cG2ALYqPfOUfWUOPxGBH3sdRhkuP1wG5zo/P7bXSMVKf/OH7RUF1PyH2EnhLn5+nxvP0IWZj+GO+qvBAaqZa6rXGtB/FAPky+leSLlamfq6eL9C+dWEVGDwX9KYRsgAT+XnvaZ3IsOJoDdp3ZUNVuT61OdQniXArrpDUf57AmhddkqaNu1sedmerMc0Ikm1kVEmqiSmZ70bZQtG9qbZ8bVqvTwjRs93W+HE6BpLHtysK5x+XPqcmK5OjF+8ABPGjOck8LdWgpHERcxPgcNAyf8c23fnaQuTqPbsJ6w++Mb6llHjt82tdL65BTWuqS9MFQxkkOI3ic6eYHOL0AalkLlBHS64e8KWhtVwxJMLVaO8Azhs09aRsDrnLz52YtvUI0sGxT3rqV8GWgKARqIQf3X5LvP2Q/50ov35zufnMCYG0o0d9wp4PB0wBTTXn2Rqw3uF8ANRZ4slcmUzxS3LGTPfF0Le+X4aPvziYehFSTGiKieH7MO3rV1fPvkpn1S89k6F4eR3KjhkMZ528NGD48kgXeFkSedDOuPkVv+5j7jkFPVAMW3v2eXVHf9i69rxvb9+7S52UuRZhOPVeB2Pj6CLCYGc5gguIctqN2uCW2F1mwZN7FdlDov3BrqHEGUn5Au4r20x7/oKdSHicLmmf5AiVuHJanQQ4Nt3EBSaZwFBbJAr4UMYoXJN9p8EuuZ+88Xdm+X9gyIMcrLEEf95EB5zFCxDhbd02A+R4Ou/dhxK1r0Ma2s74FJX8/joo+ybx2yrpVGztnH22mSAgzQ8ZTTrbHItdM7X7vUKDWeqpglzZpEIfiXRvZtQzj1U1/wAvcyzJyfMtWfj00jSkw0BABbKSf/sdutowmmEvKrxeihDwY4X8Z4Y237ipZDaDKS3+YRS3DfKyXBcQT/7UGAqanJaEzQrNWr1WXucVrsimxMcbhUgcvrughXWGk+bQ9ZtZUwuUE1rblFRG7vDQ2GzDaVq+dtYUHMiwJasrdnLT0Bf2CM9ShsH9/e9XeWOL96vlCSG0Ao4icq09D+0Flx4yjRGDsrSCMsecjuirRmvICsdo9eDVrSwvE35ijcBenTQje8Pjhl2bwoobt6qkGlc2sOu21wnq2JHXMvE5sPIRKLvDGbb6mhjt5fywIlHrxWAVl9vmzK4w0qciyjyvRTdXc1hk+toANC2WrcG95QIytK4ODSLB21+37HWi4/EA4PtCL4Bk4DpnvqutxN5eZLJd6aTAOy1kN2Uz68QNbzQ9ZoW4pmWA0uG4G2zis3IQSG2JJp+VPkm+8C6A122XfN7S8yr4HrKA/ZW/6W6HHH13IGqxQyrjkJm7eGNBebA02eXkG+b4mjTRhpZxPRFR6ggj1umouwQPffc4qFrIsXci+1qN35FfkiZaM6s5Jg952h2tj/y7YUJ+uVEIvJblvHpv9yWxVwtcX6hYPPNzJWIZcLrMLaIzKJS3S3b0t4fBpJAyM/u00izJ79fiyCnUQ4beLLhAiGg0S0Zihpcjqdr9+5DiBGAmE3GRNsGHWVtr54z4EeGlT8vPfc4yUK021K6dj7YtysP9OxtW6rKRGv3GF3l2tCn3i+9EbdUTtY9cu8aQ5Nuvr6luLAWwJJWGcWECE17I9DJ2HYWnbuZm3uKFBjNAE4cM2mMeEvFrgIT5j0k0CQB5PmjsOZsTI9NLEynn733UE+d7ycKx8Eq8zdqFbcE1vfGVNy/j9lHfRtgJtNKAlSmNBHBXn9qHDSGqqU4oc8J4yugpnWOhoJoVyTTnI1bfWNgEDVk+DIz98SYY2uh3JGI6lw5TNrO5g+WFjVCcS3w2mJ82KOQCo5BHgHafuuy8QGdNBReoKhuH553g9/7bD/qS6NIguDfSiLtFybpItsthRbx3qFX3w6iRBA2EjlpZPuSkgxgZua19Eefgz/UrcQAjGRCI2pXIDeeqsPhMHfNGmw3PpxK+K1,iv:VHH48PmpIsrWOtTqHmmT+q7CE+HmsEX9+DaXmGXreFE=,tag:s+zhy9blkNBUZDD8cJJnyg==,type:str]
-nixfu_ssl_key: ENC[AES256_GCM,data:gwMbdsu2mlcZvCFrh6G/SQoIJLcUNyMkInw73+gUqR1EJH/kShqQGkQluE1lEoXobnh6wK5Rqz9yN4EJwWw/u4W6gYnXKOIHlb13faJHpRwTu1RPMmiJdJcCfjmW7sx+Yao1WjPq9h5Wr6CQjsACU4KPpIp0FWkVr5I6gGX91gkXyQgksGOKUcLQJYJDKLYbvTBnSA68Yoho4Tv5USG+GuxE1NQn3mc3cysA8V9sSZiR54cx2zK+u5l+MeC1Kcxh2KU9CER+B43jOonYxPj5EID0ZTv8aovkRcxkTTBzSdUvwCiUUx6IEectW0xtMeHxXrdDXwsxyuVCNPfmtgsqt5jIIJmEy985zLFjXNddG1CBgGTqxGamsMZ+McXCSb9ZD0wiMp9KVa6+ohLnc8PLIiN2qGFg1X2PNYzTTyesM6qja/9cV6A1raoQWhZOFfjEbsLmVtTI99QuBUtVJP6Q5lHeELIVm9ALc2W13P4/4waeCo2lQbI0hmU9FcL5hd3oiot0/DotnlqXhi6a9Qa2OSwBgpTHzZIihAPkMnxSskgymcK6CAX6es9m1v+526XG4gRAcSZ0nQWLRnF3++2g7jNCU/ivAdu1exzQRw6Y3UaluyaY46i67V53zVtddgsQlyRAxtCouJNFFCJp5KJ8+6J6ohF4wuN2L8ABR/DrrZ+piiAfgwnrOevGxRwKyKOzL+SjSLwM/ybxhgSDcM0LffMcs8FdUHgV7Qtr4lBvhluFGKza4N5ZYTe5bJLnm2poIKiXjsUPKSJmuipmYzPbRwOm8Y329J418MXNQNhDr8DV/BzOyzzWSWM//B2FMLTgJrn69VWrsdGGUKv/j5dwRRU1iYpO5Of83JiIJzHbWL35iQ0RsfC/O+oTrjYGNw3Bc3XyIogCW054u6kDjxBDTcG+26kSPujUz1D7DxJ4hZwMnr84/CkR5qmktgn1rpH4caz3bUjJjmrO4jeLYQP3eTEXnahTU2N81SjzCekvYsiIB/nq3oVtxnSFlEiAu5KiqswqBv0j8XOABbPu4elyUi09ekYz2ZQ2DtBLz+I5r6seDykIVL9zWmBEJHawGAC1yRAI4CWe28cCTOnpkt2keewBmZG1QwbINvEc21Q0NutGdZ3s27RHkGnsoda8tk5DipF8k5dyxmLy8jzFmHAwNB7m1UG5IYhFy95+C8ihfQF2tJfmO6VEDHuAviSdso/+wgYVsfp1MbtK9w+ACQvEbO90yRDBQ9VBg326C87kk9pXLal7l94JkBMR7cbLTAKH60ApYpLPVIZDvaHV2jxSrXypK6hdyTjpVnpyyC3SQXo1bn/Ixtd/tfA2fP5/IPB7xdNYEYu7lJWa7sY91BjhnnxRPkfCINt491MIXGqTO6LpGc/hJBukQI7rTr+mxJK5ajkvBpgDg7O+5sS/kmCbcFSAFw/T85n+WDo6QMQbrZqgrqmT6PaRtCLVWAIVX5UBDNUvXf6gUX/8WnSdQZtOPfkTBu3JEyDCkF/ETI+OZDnXVnOXKmYT7SMVHbPWxsTtmBuH1FZYi1aw7wyj/M7IC3k1ytm2YfOtRgO+xUi402gWS09fdENVWQ4fyRkNmwFvi9lBBvi9W2gCFWe53X2GO4Z3MQnKAtVCi0Rv8Xwh+hu8MijMwrs3CSSDAX1C3MAYQ9enzSXPeMQuZ84MQi4P664saNBd3gPRHQT52yH3tobpIwIZ8xUnHJ/Q6Rw6HRMtAqE8XWIxBGf7b0qqYkfwquE1uwiCVuq/j/af6qX3aNro1GyRymcPJN0Ko9JNOSn39SQxCqKawPHaFv7HX3JjEI299KNMGlD7lu8RKorD/+gIoz/7BTe1kmoUZDVPrgzudRvFAOrOATCoV/+FC48OQYoa24CITQx5ymJ1zTLE9d4M8vwNiOCpcVPyjabn8kt8rJmajjSidPAY+OX6lHpNbjcORZmjExZNMO5qApIqdl4WW9/pVq/pZSUwM31WbM0/JpJdws1LX5Ao+G2m/CO2fJqQS53mXMHfF85UWkJ1BuO5Be4Z54AWDDp4ZJzNfnQS/Ee84peTEExJ9mFvWYSlPLtzFOeUvI22RAcUJpQ/2vo8pI8S8h3BYCfSRyRW7ISYBCcRCpw/AkLWkgvOvXDYNj8xvPAtzftiP1GkMwjJSpbX3QGOYgO31KTy8lh836ePrJWsZa1MPD9nxyhajxs4MwKm2384UMtqu53mTtx7s2MchhiqrJoRUJW0Brq/oZM/WhhKHSjWssYrwLx5bymhg//Oa9PBP30j,iv:BbD2i/35D8p0/eEQ6RuM5nsDnQV+x2nTLU890LSju38=,tag:to2mYPiNkdYBHsgG7NJDbQ==,type:str]
-nixfu_ssl_cert: ENC[AES256_GCM,data:i+fL0beNDGWJ7jwSzwR6vSQ+/HyluQfYu8/OItacDu17lyxTqeZTBkBfSsfpL1QNUnGzDwIunIfQcme0J0gzLQa3Ly+qjWLBQwVL3uyxw9MImXwtXZpGiSq5mH4ofeurP/o3DB+MUwHrny6A82UX0e9zIdHiFD0RxSMCHfxopob9WORmMftp3uK3+Q3VuWU1GKI6dNkYn0X17EB3Fa+oGPcB1azG4+WI/pYxBjISuL1u6WeYCXzLgDZVOr5PHMEUKnMEH3jUf1eCxhiGpTrY6cDKSiCVHQiKO6XlKSf3dH65LAk1FaCKKe/EUX5gbeW/IU5Eq16d60EtlnNesGJy+l5ry1OVSbxsJre0mHi19KfOR4gdOwlEGIOYbyCyt4c1Q6160VF+nun+vPMLTt7NDVLfhbbTxH0Dn4pqKqVaAFc9dYeuBVI1J31A7oWGD1THy//9JIrnYdDau/U4//vO9TuOoQiys+c4vR1nv4E9rCFdYgzbOHIboXAo5xzvHpgG7D+h0fl4g16pqGu+f2S74vAR9du0pl3H7VWMv3gPn4JmHG77lg8yutuKXFojRzX8J9aOcqOyPlEwPhwfx9p2/bggJbD9nthrxTZK9Uixf1vWudDHRPfskv9XxcFB1ljVcSZBqnAQvxQMX0ti9+VM/tWiArWgS3OGCxHesLSAmBPm1xXxDQnoBoaE1834kMYAAvbK68UgUnOpjYKuqdIss7ViVLhsMkJiQu0Jxat1TM1VXdWqqV5EzEPWMuzlu0fFVD0Uf7LRhZlTNkxCl1w/zRI5O499G6QopWvIiom/AXLn8hrBjsRdpE2FOWkwAE3uaUIwQ6GmYPnVP4WQN6IEjsUz9ZA88vkwdU0ft1jbBlreAyeIX/iv7KzJL2ODZprAGPLbN1jJvgkmq27efnE8xmsP2gYiYGR0WGNuZl4VYxr/kw2Aw42bKz+WIdfewfib/8nHdAjigH9avPg8uLDxT2OndVlQeg2HN0/qmf2OGAsZaVb2nfOiIY1nB7L2KayMfdSIrYp8l4M54oibMFWFjlVq6sK/+Cecf9c8dj/TXtJVLvGOMbyEbg1JN/7Jcx24ZNoIaiCNBXl28jSkCoP2leiRsMaPUdr5OlyxJtw/piuYTSYztf2Dl4agIhBXZbjIAMsNE2R6RjtLLT3hXn9+AZDtG32Z6Cx79WcU4YH/b9CmR7i57E6sc2aHwp08056xyZnT6S2B+HJxyxr9ADkDaElxPk4aB4Kt3sK4h2U/TXZvxwrfw6GBEc92bDYkTNCFr7Mo+DdcFuOe0Gz5Wz7xTt7dvWxRBUCrOJ9RLcV5CKNl4CYNG2TNah/fIewFDnrRHIrQOKeNtfMb0cTsY4Mv25V3/uyXjDp3TlQRdFi8JaJmZy6dXUMuIu02ruLqt8HvxJSnGzQCieZluXGwzRn7NMITxEncfPIspFuU7t2dCdW29X5nJDzALrYVZFxGgD+Y8V4ATiGgwqA2M2On1x0RFMHy/9f2fK5CLJrcNJPycVugVAhYcALqfLzAb3T5BMVU8/TvbgOrOU9G872CNQpELDCPHbbIfY6Mget0XOQe5/747V8KIxoqOcYyUm6d+kDBcr4N+jXpbYzh1/bCHFjNKVCknnxGiTx/kUnJ9DMiCf2t+6Ml6rEI0lOyIeKta4FMv3fU9+PxlWJ7WA08NDBZd/NcJjoD1unLishyfpwfP2LhCfvf+g+REjwc0xFPzkhpyKJyXRNAQeQJvjv7Ez+A2x2JBcf2o8/iL+5FmZM6uDQigLYzd+/6E/kFJbQCjUusl50KHGLqyu4bf+7+F+GUWIxa8xh6pFl8JSYDfX986Zy2NvBgWn+Z3yKGdz1Qe9UWfOhJGlswnDnkpBO/NdkCYFUrT0Nrry+JNW4+I/0Ul/blTdahR9A5YKBEe4+L8P3N4Vq3ob9DqKfggauPZMFcPSsT08BqbNs/i1ycFPf4xNuirG4sPlr5BY5sER+6UcIMgeyR8Yj4f8YhmHQaw9mpwNu6dYdwa6d7bDn6OKR/e2/OUt6+2MPx+TT2uIrTUJk1DZ1uEYDpbZ8UiQU03RPJwksU04wwIGsoeIO7RV/LE+E1bkftemLuJFc7r4gDKNNDtGZ7ExJle3/h6phxM6jp8d1ROKxHkAnUkIIOTtF91XK72UPIs9sUv8ntz2qGEHAuPhIsLHoUGRjr71c7Keo/X2gSbhT9OWzK1oNwoBmoxQ==,iv:lWS91xOUh6q3dqcKAhJLW1mvqZVZ0221IPezbpPBR6Y=,tag:kpJiMPC/XwStx+xHk2VDhQ==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -25,8 +23,8 @@ sops:
             dGhDRXRTWE9xSGtxQU80RVpuL1A5MkEKxAxC/wDkq+6hM8eXkWd/RBDNIUtGYnPy
             MvVxB6dkj+S11oRcMpdFqiM9jSzz/gYecB2tfuDgj+UX/VAzSkvPxA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-12-12T02:54:09Z"
+    lastmodified: "2024-12-12T23:25:07Z"
-    mac: ENC[AES256_GCM,data:35sEYE7m/B2M0hZIQuVLIBtYxMcCzwSqf+airqCevcOF1TR/2TaMIuBlFYYx/EhYF+St/iIrXezk/3N8L88Vhsxkz9KZzURFK+0WijAafa7gObWGrFbacQVaLQJpsYawvWsFIhK6BwLByGyzwn8VPZJvrI7Y3XwWCd/E9/sJ/WE=,iv:IaZZf/iGDK6YUTLq9Q3H8dEeQAsXTGPFxyEczOtyWgc=,tag:/T/Hikiiip3w+DVfdFPd9Q==,type:str]
+    mac: ENC[AES256_GCM,data:5qyOCYaKi42Yeqgoiu/csmWbDN4KlQHgtuz9GoW1UNoUNMPgBfIXSE5gtOjMT4j7qQ4JC7zIfIG8UZ7S/HgrnDemjlr5z5U2Ub+eVoV38Ve+i2V0O91RPQZ5lyRdCKTNSlLvob4W8uMJAtUeI3Zemv2DB/P7RMtMuz2kZmPwpD8=,iv:wZfTu3Ss7nb60fok5CbB99NXpcqPRSfAUhuliK5bTnY=,tag:pj3fYSSHFhdY9oXK4CUh0Q==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
     version: 3.9.2

hosts/gerg-desktop/services/ddns_script.sh

@@ -53,6 +53,4 @@ func () {
 func "*.gerg-l.com" "8f76f071c5edbc0f947a5c5f9c5df9f8"
 func "gerg-l.com" "8f76f071c5edbc0f947a5c5f9c5df9f8" "false"
 func "ipv6.gerg-l.com" "8f76f071c5edbc0f947a5c5f9c5df9f8" "false"
-func "*.nix-fu.com" "cc2df9163c3730f58b866409ac5a108c"
-func "nix-fu.com" "cc2df9163c3730f58b866409ac5a108c"
 

hosts/gerg-desktop/services/forgejo.nix

@@ -34,4 +34,7 @@
       createDatabase = true;
     };
   };
+
+  local.nginx.proxyVhosts."git.gerg-l.com" =
+    "http://unix:${config.services.forgejo.settings.server.HTTP_ADDR}";
 }

hosts/gerg-desktop/services/immich.nix

@@ -14,4 +14,7 @@
     port = 2283;
     host = "0.0.0.0";
   };
+
+  local.nginx.proxyVhosts."photos.gerg-l.com" =
+    "http://localhost:${toString config.services.immich.port}";
 }

hosts/gerg-desktop/services/miniflux.nix

@@ -1,88 +1,22 @@
 {
   config,
   lib,
-  pkgs,
 }:
 {
   sops.secrets.minifluxenv = { };
 
-  systemd.services = {
+  services.miniflux = {
-    miniflux = {
+    enable = true;
-      enable = true;
+    config = {
-
+      BASE_URL = "https://flux.gerg-l.com";
-      description = "Miniflux service";
+      LISTEN_ADDR = "/run/miniflux/miniflux.sock";
-      wantedBy = [ "multi-user.target" ];
-      requires = [ "miniflux-dbsetup.service" ];
-      after = [
-        "network.target"
-        "postgresql.service"
-        "miniflux-dbsetup.service"
-      ];
-
-      serviceConfig = {
-        ExecStart = lib.getExe pkgs.miniflux;
-        User = "miniflux";
-        RuntimeDirectory = "miniflux";
-        RuntimeDirectoryMode = "0770";
-        EnvironmentFile = config.sops.secrets.minifluxenv.path;
-        # Hardening
-        CapabilityBoundingSet = [ "" ];
-        DeviceAllow = [ "" ];
-        LockPersonality = true;
-        MemoryDenyWriteExecute = true;
-        PrivateDevices = true;
-        PrivateUsers = true;
-        ProcSubset = "pid";
-        ProtectClock = true;
-        ProtectControlGroups = true;
-        ProtectHome = true;
-        ProtectHostname = true;
-        ProtectKernelLogs = true;
-        ProtectKernelModules = true;
-        ProtectKernelTunables = true;
-        ProtectProc = "invisible";
-        RestrictAddressFamilies = [
-          "AF_INET"
-          "AF_INET6"
-          "AF_UNIX"
-        ];
-        RestrictNamespaces = true;
-        RestrictRealtime = true;
-        RestrictSUIDSGID = true;
-        SystemCallArchitectures = "native";
-        SystemCallFilter = [
-          "@system-service"
-          "~@privileged"
-        ];
-        UMask = "0077";
-      };
-
-      environment = {
-        BASE_URL = "https://flux.gerg-l.com";
-        LISTEN_ADDR = "/run/miniflux/miniflux.sock";
-        DATABASE_URL = "user=miniflux host=/run/postgresql dbname=miniflux";
-        RUN_MIGRATIONS = "1";
-        CREATE_ADMIN = "1";
-      };
-    };
-    miniflux-dbsetup = {
-      description = "Miniflux database setup";
-      requires = [ "postgresql.service" ];
-      after = [
-        "network.target"
-        "postgresql.service"
-      ];
-      serviceConfig = {
-        ExecStart = "${lib.getExe' config.services.postgresql.package "psql"} 'miniflux' -c 'CREATE EXTENSION IF NOT EXISTS hstore'";
-        Type = "oneshot";
-        User = config.services.postgresql.superUser;
-      };
     };
+    adminCredentialsFile = config.sops.secrets.minifluxenv.path;
+    createDatabaseLocally = true;
   };
+
   users = {
-    groups.miniflux = {
+    groups.miniflux.gid = 377;
-      gid = 377;
-    };
     users = {
       miniflux = {
         group = "miniflux";
@@ -93,4 +27,12 @@
       ${config.services.nginx.user}.extraGroups = [ "miniflux" ];
     };
   };
+
+  systemd.services.miniflux.serviceConfig = {
+    RuntimeDirectoryMode = lib.mkForce "0770";
+    DynamicUser = lib.mkForce false;
+  };
+
+  local.nginx.proxyVhosts."flux.gerg-l.com" =
+    "http://unix:${config.services.miniflux.config.LISTEN_ADDR}";
 }

hosts/gerg-desktop/services/nginx.nix

@@ -1,98 +1,64 @@
 { config, lib }:
 {
-  sops.secrets =
+  options.local.nginx = {
-    lib.genAttrs
+    proxyVhosts = lib.mkOption {
-      [
+      type = lib.types.attrsOf lib.types.str;
-        "nixfu_ssl_cert"
+    };
-        "nixfu_ssl_key"
+    defaultVhosts = lib.mkOption {
-        "gerg_ssl_key"
+      type = lib.types.attrs;
-        "gerg_ssl_cert"
-      ]
-      (_: {
-        owner = config.services.nginx.user;
-        inherit (config.services.nginx) group;
-      });
-
-  security.acme = {
-    acceptTerms = true;
-    certs."gerg-l.com" = {
-      email = "GregLeyda@proton.me";
-      webroot = "/var/lib/acme/acme-challenge";
-      extraDomainNames = [
-        "search.gerg-l.com"
-        "git.gerg-l.com"
-        "flux.gerg-l.com"
-        "cache.gerg-l.com"
-        "photos.gerg-l.com"
-      ];
     };
   };
 
-  systemd.tmpfiles.rules = [ "L+ /var/lib/acme - - - - /persist/services/acme" ];
+  config = {
-
+    local.nginx.defaultVhosts =
-  users.users.${config.services.nginx.user}.extraGroups = [ "acme" ];
+      {
-
+        "_" = {
-  services.nginx = {
+          default = true;
-    enable = true;
+          locations."/".return = "404";
-    recommendedZstdSettings = true;
-    recommendedGzipSettings = true;
-    recommendedOptimisation = true;
-    recommendedProxySettings = true;
-    recommendedTlsSettings = true;
-    virtualHosts = {
-      "_" = {
-        default = true;
-        forceSSL = true;
-        useACMEHost = "gerg-l.com";
-
-        locations."/".return = "404";
-      };
-      "search.gerg-l.com" = {
-        forceSSL = true;
-        useACMEHost = "gerg-l.com";
-
-        locations."/".extraConfig = "uwsgi_pass unix:${config.services.searx.uwsgiConfig.socket};";
-        extraConfig = "access_log off;";
-      };
-      "git.gerg-l.com" = {
-        forceSSL = true;
-        useACMEHost = "gerg-l.com";
-
-        locations."/".proxyPass = "http://unix:${config.services.forgejo.settings.server.HTTP_ADDR}";
-      };
-      "flux.gerg-l.com" = {
-        forceSSL = true;
-        useACMEHost = "gerg-l.com";
-
-        locations."/".proxyPass = "http://unix:${config.systemd.services.miniflux.environment.LISTEN_ADDR}";
-      };
-      "cache.gerg-l.com" = {
-        forceSSL = true;
-        useACMEHost = "gerg-l.com";
-
-        locations."/" = {
-          proxyPass = "http://unix:/run/nix-serve/nix-serve.sock";
-          extraConfig = ''
-            zstd on;
-            zstd_types "*";
-            client_max_body_size 50000M;
-          '';
         };
-      };
+      }
-      "photos.gerg-l.com" = {
+      // (builtins.mapAttrs (_: v: {
-        forceSSL = true;
+        locations."/".proxyPass = v;
-        useACMEHost = "gerg-l.com";
+      }) config.local.nginx.proxyVhosts);
-        locations."/".proxyPass = "http://localhost:${toString config.services.immich.port}";
+
-        extraConfig = ''
+    sops.secrets = {
-          zstd on;
+      gerg_ssl_key.owner = config.services.nginx.user;
-          zstd_types "*";
+      gerg_ssl_cert.owner = config.services.nginx.user;
-          client_max_body_size 50000M;
+    };
-        '';
+
+    security.acme = {
+      acceptTerms = true;
+      certs."gerg-l.com" = {
+        email = "GregLeyda@proton.me";
+        webroot = "/var/lib/acme/acme-challenge";
       };
     };
+
+    systemd.tmpfiles.rules = [ "L+ /var/lib/acme - - - - /persist/services/acme" ];
+
+    users.users.${config.services.nginx.user}.extraGroups = [ "acme" ];
+
+    services.nginx = {
+      enable = true;
+      recommendedZstdSettings = true;
+      recommendedGzipSettings = true;
+      recommendedOptimisation = true;
+      recommendedProxySettings = true;
+      recommendedTlsSettings = true;
+      # For immich
+      clientMaxBodySize = "50000M";
+      virtualHosts = builtins.mapAttrs (
+        _: v:
+        {
+          forceSSL = true;
+          useACMEHost = "gerg-l.com";
+        }
+        // v
+      ) config.local.nginx.defaultVhosts;
+    };
+    networking.firewall.allowedTCPPorts = [
+      80
+      443
+    ];
   };
-  networking.firewall.allowedTCPPorts = [
-    80
-    443
-  ];
 }

hosts/gerg-desktop/services/nix-serve.nix

@@ -72,4 +72,6 @@
     };
   };
   systemd.tmpfiles.rules = [ "d /run/nix-serve - nix-serve nix-serve - -" ];
+
+  local.nginx.proxyVhosts."cache.gerg-l.com" = "http://unix:/run/nix-serve/nix-serve.sock";
 }

hosts/gerg-desktop/services/postgresql.nix

@@ -4,15 +4,6 @@
     enable = true;
     package = pkgs.postgresql_16;
     dataDir = "/persist/services/postgresql";
-
-    ensureDatabases = [ "miniflux" ];
-    ensureUsers = [
-      {
-        name = "miniflux";
-        ensureDBOwnership = true;
-      }
-    ];
-
     settings.unix_socket_permissions = "0770";
   };
 }

hosts/gerg-desktop/services/searxng.nix

@@ -35,4 +35,9 @@
       ui.theme_args.simple_style = "dark";
     };
   };
+
+  local.nginx.defaultVhosts."search.gerg-l.com" = {
+    locations."/".extraConfig = "uwsgi_pass unix:${config.services.searx.uwsgiConfig.socket};";
+    extraConfig = "access_log off;";
+  };
 }