hippocampus: dawarich

machines/hippocampus/secrets/pass.yaml

@@ -1,6 +1,6 @@
-nextcloud:
-    adminPass: ENC[AES256_GCM,data:D2SAD/Somvw8abIm0KX4fWRfuQ==,iv:Y7K14yZZFcu97KVBd0219hwnGY4LEX2DNxxulSegr/8=,tag:aRJAlz1xvQxWodcE2bZLdQ==,type:str]
-    s3secret: ENC[AES256_GCM,data:lIVuiZMh376MSuu13UPCu49Q64bVbk+WM/CUEIGzV0Q=,iv:J2vHalppWEupWK07zXsMoiH6avmpsgg0Cqcc7EkZVV4=,tag:pxKwiaH5SZa8Vh71gLGQWw==,type:str]
+nextMAUTRIX_DISCORD_APPSERVICE_HS_TOKEN";MAUTRIX_DISCORD_APPSERVICE_HS_TOKEN";cloud:
+    adminPass: ENC[AES256_GCM,data:DG4gCZFFsaeQc787USuo5iuR4g==,iv:ixHanTjUi1bqmzRpCYTleTIuVnIq+FLafpBBAZ8QIak=,tag:dzG49AID1mZaa+ttYDIssg==,type:str]
+    s3secret: ENC[AES256_GCM,data:QqZrfM9rwntwXW4IEVWJIsPnk6ldkblwR1S+mKDvCes=,iv:2/tN593c5omCIVTOgP8ruyZ41tTECgltPveJJDUdPGs=,tag:43cBpZJCfjArUv4L6zlPYQ==,type:str]
 jellyfin-pia: ENC[AES256_GCM,data:hOgUAr47FMd2QgzgXBeqv41Paqy6zn6tyWVDbF1JtqcTog/zZC4=,iv:opnxrycFszAhuMARcP48gKF6eL1ERNgWS68wO+s4CIM=,tag:fqimxKdTAh55ANKD3bp46w==,type:str]
 ddclient: ENC[AES256_GCM,data:a31MKnoEZXrj/s8z3+MP9jhQ5/sBjljZphXBJsWj5GU=,iv:YHKCartadDQa59aUf9Fw/KgdgMgsqsVLDAIh/KeqehQ=,tag:hUaUqjcX75xw6eC9axtQmw==,type:str]
 anki: ENC[AES256_GCM,data:hUBKr/s1DDorlmbHDUvHtVSumw==,iv:Ekjt6dsncinHhM+dV/mxOjErBQpgKtPOVbmwGRy9XOE=,tag:zvfV9z3QROgsk4eznmxqDw==,type:str]
@@ -19,6 +19,7 @@ tuwunelreg: ENC[AES256_GCM,data:5NJL1W6iVEwLwAUGlmCOHgVzV+9aLMrp8OXu8uVUw3SpCR5f
 coturn-secret: ENC[AES256_GCM,data:9lPM14VVk/VlmYPy4XgIaKDQgRKcoaCaszcaETCBQMmMIGSuq+G2aHqa8dtXf6Tg/Llcza+VROZYBuC9bsFwoEDtcbhFoE9S7OKrJ8bWDDI1AGTwP3j9tgExvmd0HMyqkNrb3l1cPj4/CLcSlZxxWcYVWZL2sSzKpqhKNXGeYCM=,iv:zckUJK+F95lVKZz/XoD4nmuC14FiIU1gIxe5U4abvrg=,tag:nSPxlCMS4QXBvkb6jn4EQg==,type:str]
 lk-jwt: ENC[AES256_GCM,data:6EXQbXUWsXzYwHU+KYh8FfVKoMScrbX/ITx/x128UdU1r0PmqEZ39TewmDUSlNlMsaWYRffNd8lmfF3sPZDOZzL/jNJNaTSqUKy8cPX8XF+LJqq08ZDWihvgKjcyHy6BORpe07fGp6v/otJW9XE9qujJ2QC/0MA+dJpckpfibaswfWwkL2BfmDfcq2H8Tudohg==,iv:Rm5uWOKGBKlnivGkxWokpG1YR1dxeTV+cVrDZ/3i8yE=,tag:bSeOZ7SEelDIeSGTdzRVng==,type:str]
 dawarich_smtp: ENC[AES256_GCM,data:v4VU5XGGR2rLfQZsMvbXCA==,iv:jD3EFKab7/oxxqX6O1Mfz5tA/xUOGEaBtMsHnENouBQ=,tag:JWyrensx9v97blQv49jsLQ==,type:str]
+mautrix-discord: ENC[AES256_GCM,data:jtdu+ubeuxHC/oMUbS5mIIExLkzj3EkZ8uiXmOGHfu0+AkEb0KHrptbQtsp8p09TI9IneBPZ1H5z8HLKLRkIiN928HQnihqudNJ37U8n5PZ20ln+lB6VR0ZOcuZBRJqquY7SOuhVj4za0wfe8YN47JS7yIp1txR8CGDNZI2s0STWcwQMFsxkDveY1oQfcimR+OLxcOZWYzPfWvx8vi0ryabMpsuIdDDHQ3gdv+jgVYeEGvgVBsICSsI7zNUeiSQfrCord2JjhQUiJ6U0QVKY3w50orK7hdQzk0wZ/G2pi0fBAyu7PLfVcUNbePppijMhKcmM6/8wIPgICVdj7otOLniSi3SwB+825aB4wSkGYXgf3oB5ab7RIjS0vh3LWVBaZ9otsHTxfsgUi12fgOiTbcjja4oIhm3f8FJ+tcZEg2kutMcrF1kUkOcdQ2CLlAcmkyKVH0nv7vIUA031N94KSQDqPQbUAy/LnQBkxGSk+gaPOKFZf4HaT3Tci0OpLr7Nv9axOZUjU99ILu2SEWfow9hoc0mJ0PknkNxfNyENWe88TWjrLVp1H7SKLAz9VHIwiEUaGQAqw1sYj+RO4JurqosFzaLpHEVf6CRGvAAXGpA2gE4pEUAlI610SQBtefeACg8c/sZCdNP9DG4lMXV36hRHE+uGXI/8,iv:Hc8EX6tniQTKgnORWjHATPy7yMuZWCpnxTsGepCGRTY=,tag:p7lhMYNfeROslkOe3H2EgA==,type:str]
 sops:
     age:
         - recipient: age1crymppz88etsdjpckmtdhr397x5xg5wv8jt6tcj23gt2snq73pzs04fuve
@@ -30,7 +31,7 @@ sops:
             RVUzMlFya3Z0amdTUTJ5YjFRck5kZzQKoWZzExqzPRpQPL4CdqBalc1/dYtjBH6J
             LGR0oImfOWlIJwcaJLv/fc470UvXHHwIji9v/pbV7xMkgMjlJthaYg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-02-16T00:04:12Z"
-    mac: ENC[AES256_GCM,data:W17ieIGhzDXcjT8xJn72K0274QN9FcMOXdB4YWeSAyxSwRmwUkuF9NzbAWZ8rH/Yva8mUgOh+OC1x4xavHI5UGBsSoUk+q9vevRd13qVE328o3JW0ZRsi3PunpmmzEYoz//z3UUxpepgcBKGTui8Fj1z5tOoNtXfEtxnHv/JY0w=,iv:8TSc+cMa+bbFqoPObnBE5KUhysmZnr1iTksc4tvUcDw=,tag:6LxuWGLQv7fSpJN0spuQ5Q==,type:str]
+    lastmodified: "2026-03-22T00:05:43Z"
+    mac: ENC[AES256_GCM,data:KUpPJG0GoY60af9+XhfNIfiIiIfKAnC7fBhqVM4EK5WsxTwjuQq3Skp76hUZgOVtn7K0pun4Mu2zla6Rs8YpzipVf5nxyDnf+0kCjcsUBWnoMKzIBD3UjHC+hEuiZ9jGRyFQWhw8hd6kEibJ0C0f8q+lsB3Qw1EkpCI/dcvWbPI=,iv:3gz0TIj3HhtWIKOmJz27t5bvWnPbVASINr5/pi/3ZTs=,tag:u3JM6kBsB59IjfJfZ/652w==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.11.0

machines/hippocampus/servers/public/dawarich.nix

@@ -27,11 +27,11 @@
     ${config.services.dawarich.localDomain} = {
       extraConfig = ''
         reverse_proxy localhost:${toString config.services.dawarich.webPort}
-	encode brotli {
-          match {
-	    content_type text/css text/plain text/xml text/x-component text/javascript application/x-javascript application/javascript application/json application/manifest+json application/vnd.api+json application/xml application/xhtml+xml application/rss+xml application/atom+xml application/vnd.ms-fontobject application/x-font-ttf application/x-font-opentype application/x-font-truetype image/svg+xml image/x-icon image/vnd.microsoft.icon font/ttf font/eot font/otf font/opentype
-	  }
-	}
+#	encode brotli {
+#          match {
+#	    content_type text/css text/plain text/xml text/x-component text/javascript application/x-javascript application/javascript application/json application/manifest+json application/vnd.api+json application/xml application/xhtml+xml application/rss+xml application/atom+xml application/vnd.ms-fontobject application/x-font-ttf application/x-font-opentype application/x-font-truetype image/svg+xml image/x-icon image/vnd.microsoft.icon font/ttf font/eot font/otf font/opentype
+#	  }
+#	}
       '';
     };
   };  

machines/hippocampus/servers/public/dawarich/sources.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.1.0",
-  "hash": "sha256-oL1XLBaSYCeP+Fn+6BlGMEgCTkwZhT1VZNamrcRXrgI=",
+  "version": "1.2.0",
+  "hash": "sha256-6NlqeiG+kjpSVpg8JFvqZPvCoigzjIcF1Ru/AdMwShg=",
   "npmHash": "sha256-doBsDBsO7npHs/jyeg4xWzdauWoK6dPe8z+97IP2zxI="
 }

machines/hippocampus/servers/public/dawarich/update.sh

@@ -0,0 +1,40 @@
+#!/usr/bin/env nix-shell
+#! nix-shell -i bash -p bundix curl jq nix-update nix-prefetch-github prefetch-npm-deps gnused
+set -e
+set -o pipefail
+
+OWNER="Freika"
+REPO="dawarich"
+
+old_version=$(nix-instantiate --eval -A 'dawarich.version' default.nix | tr -d '"')
+version=$(curl -s ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} "https://api.github.com/repos/$OWNER/$REPO/releases/latest" | jq -r ".tag_name")
+
+echo "Updating to $version"
+
+if [[ "$old_version" == "$version" ]]; then
+    echo "Already up to date!"
+    exit 0
+fi
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" &>/dev/null && pwd)"
+
+echo "Fetching source code $REVISION"
+JSON=$(nix-prefetch-github "$OWNER" "$REPO" --rev "refs/tags/$version" 2>/dev/null)
+HASH=$(echo "$JSON" | jq -r .hash)
+
+cat > "$SCRIPT_DIR/sources.json" << EOF
+{
+  "version": "$version",
+  "hash": "$HASH",
+  "npmHash": "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="
+}
+EOF
+
+SOURCE_DIR="$(nix-build --no-out-link -A dawarich.src)"
+
+echo "Creating gemset.nix"
+bundix --lockfile="$SOURCE_DIR/Gemfile.lock" --gemfile="$SOURCE_DIR/Gemfile" --gemset="$SCRIPT_DIR/gemset.nix"
+nixfmt "$SCRIPT_DIR/gemset.nix"
+
+NPM_HASH="$(prefetch-npm-deps "$SOURCE_DIR/package-lock.json" 2>/dev/null)"
+sed -i "s;sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=;$NPM_HASH;g" "$SCRIPT_DIR/sources.json"

machines/hippocampus/servers/public/matrix/server.nix

@@ -30,6 +30,9 @@
           client = "https://glia.club";
           server = "glia.club:443";
         };
+
+        # TODO: Configure more in detail/for safety:
+        url_preview_domain_contains_allowlist = ["*"];
       };
     };
   };