From e3d3e338b61eff701941343bb7c19eb41ffc0b69 Mon Sep 17 00:00:00 2001 From: Truxnell <19149206+truxnell@users.noreply.github.com> Date: Thu, 18 Apr 2024 21:38:42 +1000 Subject: [PATCH] feat: warning for adguard schema mismatch (#109) * feat: warning for adguard schema mismatch * Auto lint/format --------- Co-authored-by: Truxnell <9149206+truxnell@users.noreply.github.com> Co-authored-by: truxnell --- .gitleaksignore | 1 + nixos/hosts/durandal/default.nix | 1 + .../nixos/containers/arr/lidarr/default.nix | 2 +- .../nixos/containers/arr/prowlarr/default.nix | 2 +- .../nixos/containers/arr/radarr/default.nix | 2 +- .../nixos/containers/arr/readarr/default.nix | 2 +- .../nixos/containers/arr/sonarr/default.nix | 2 +- .../nixos/containers/backrest/default.nix | 2 +- nixos/modules/nixos/containers/default.nix | 1 + .../nixos/containers/gatus/default.nix | 4 +- .../nixos/containers/homepage/default.nix | 17 +- .../modules/nixos/containers/plex/default.nix | 2 +- .../nixos/containers/qbittorrent/default.nix | 2 +- .../nixos/containers/sabnzbd/default.nix | 2 +- .../nixos/containers/searxng/default.nix | 59 ++++ .../nixos/containers/whoogle/default.nix | 59 ++++ .../nixos/services/adguardhome/default.nix | 334 ++++++++++-------- .../services/adguardhome/secrets.sops.yaml | 74 ++-- 18 files changed, 361 insertions(+), 207 deletions(-) create mode 100644 .gitleaksignore create mode 100644 nixos/modules/nixos/containers/searxng/default.nix create mode 100644 nixos/modules/nixos/containers/whoogle/default.nix diff --git a/.gitleaksignore b/.gitleaksignore new file mode 100644 index 0000000..f69457e --- /dev/null +++ b/.gitleaksignore @@ -0,0 +1 @@ +nixos/modules/nixos/services/adguardhome/default.nix:hashicorp-tf-password:47 diff --git a/nixos/hosts/durandal/default.nix b/nixos/hosts/durandal/default.nix index a64912a..9f36ae1 100644 --- a/nixos/hosts/durandal/default.nix +++ b/nixos/hosts/durandal/default.nix @@ -19,6 +19,7 @@ plex.enable = true; tautulli.enable = true; syncthing.enable = true; + whoogle.enable = true; }; diff --git a/nixos/modules/nixos/containers/arr/lidarr/default.nix b/nixos/modules/nixos/containers/arr/lidarr/default.nix index 5737bc3..a73edbf 100644 --- a/nixos/modules/nixos/containers/arr/lidarr/default.nix +++ b/nixos/modules/nixos/containers/arr/lidarr/default.nix @@ -63,7 +63,7 @@ in mySystem.services.homepage.media-services = mkIf cfg.addToHomepage [ { Lidarr = { - icon = "${app}.png"; + icon = "${app}.svg"; href = "https://${app}.${config.mySystem.domain}"; description = "Music management"; diff --git a/nixos/modules/nixos/containers/arr/prowlarr/default.nix b/nixos/modules/nixos/containers/arr/prowlarr/default.nix index 9325778..2f5ef5a 100644 --- a/nixos/modules/nixos/containers/arr/prowlarr/default.nix +++ b/nixos/modules/nixos/containers/arr/prowlarr/default.nix @@ -60,7 +60,7 @@ in mySystem.services.homepage.media-services = mkIf cfg.addToHomepage [ { Prowlarr = { - icon = "${app}.png"; + icon = "${app}.svg"; href = "https://${app}.${config.mySystem.domain}"; description = "Content locator"; diff --git a/nixos/modules/nixos/containers/arr/radarr/default.nix b/nixos/modules/nixos/containers/arr/radarr/default.nix index 29c97cb..56281db 100644 --- a/nixos/modules/nixos/containers/arr/radarr/default.nix +++ b/nixos/modules/nixos/containers/arr/radarr/default.nix @@ -62,7 +62,7 @@ in mySystem.services.homepage.media-services = mkIf cfg.addToHomepage [ { Radarr = { - icon = "${app}.png"; + icon = "${app}.svg"; href = "https://${app}.${config.mySystem.domain}"; description = "Movie management"; diff --git a/nixos/modules/nixos/containers/arr/readarr/default.nix b/nixos/modules/nixos/containers/arr/readarr/default.nix index c548291..da7803a 100644 --- a/nixos/modules/nixos/containers/arr/readarr/default.nix +++ b/nixos/modules/nixos/containers/arr/readarr/default.nix @@ -61,7 +61,7 @@ in mySystem.services.homepage.media-services = mkIf cfg.addToHomepage [ { Readar = { - icon = "${app}.png"; + icon = "${app}.svg"; href = "https://${app}.${config.mySystem.domain}"; description = "Book management"; diff --git a/nixos/modules/nixos/containers/arr/sonarr/default.nix b/nixos/modules/nixos/containers/arr/sonarr/default.nix index 10fc304..80f4a04 100644 --- a/nixos/modules/nixos/containers/arr/sonarr/default.nix +++ b/nixos/modules/nixos/containers/arr/sonarr/default.nix @@ -64,7 +64,7 @@ in mySystem.services.homepage.media-services = mkIf cfg.addToHomepage [ { Sonarr = { - icon = "${app}.png"; + icon = "${app}.svg"; href = "https://${app}.${config.mySystem.domain}"; description = "TV show management"; diff --git a/nixos/modules/nixos/containers/backrest/default.nix b/nixos/modules/nixos/containers/backrest/default.nix index b3efc3b..bad0d73 100644 --- a/nixos/modules/nixos/containers/backrest/default.nix +++ b/nixos/modules/nixos/containers/backrest/default.nix @@ -54,7 +54,7 @@ in mySystem.services.homepage.infrastructure-services = mkIf cfg.addToHomepage [ { Backrest = { - icon = "${app}.png"; + icon = "${app}.svg"; href = "https://${app}.${config.mySystem.domain}"; description = "Local restic backup browser"; diff --git a/nixos/modules/nixos/containers/default.nix b/nixos/modules/nixos/containers/default.nix index 4111806..d7cd4e4 100644 --- a/nixos/modules/nixos/containers/default.nix +++ b/nixos/modules/nixos/containers/default.nix @@ -8,5 +8,6 @@ ./plex ./tautulli ./backrest + ./whoogle ]; } diff --git a/nixos/modules/nixos/containers/gatus/default.nix b/nixos/modules/nixos/containers/gatus/default.nix index 76c383b..e20f8c4 100644 --- a/nixos/modules/nixos/containers/gatus/default.nix +++ b/nixos/modules/nixos/containers/gatus/default.nix @@ -68,7 +68,7 @@ let - ] ++ builtins.concatMap (cfg: (cfg.config.mySystem.services.gatus.monitors)) + ] ++ builtins.concatMap (cfg: cfg.config.mySystem.services.gatus.monitors) (builtins.attrValues self.nixosConfigurations); configAlerting = { @@ -140,7 +140,7 @@ in mySystem.services.homepage.infrastructure-services = mkIf cfg.addToHomepage [ { "Gatus Internal" = { - icon = "${app}.png"; + icon = "${app}.svg"; href = "https://${app}.${config.mySystem.domain}"; description = "Internal Infrastructure Monitoring"; container = "${app}"; diff --git a/nixos/modules/nixos/containers/homepage/default.nix b/nixos/modules/nixos/containers/homepage/default.nix index 1c7b333..a69d454 100644 --- a/nixos/modules/nixos/containers/homepage/default.nix +++ b/nixos/modules/nixos/containers/homepage/default.nix @@ -159,15 +159,15 @@ let services = [ { - Infrastructure = builtins.concatMap (cfg: (cfg.config.mySystem.services.homepage.infrastructure-services)) + Infrastructure = builtins.concatMap (cfg: cfg.config.mySystem.services.homepage.infrastructure-services) (builtins.attrValues self.nixosConfigurations) ++ extraInfrastructure; } { - Home = builtins.concatMap (cfg: (cfg.config.mySystem.services.homepage.home-services)) + Home = builtins.concatMap (cfg: cfg.config.mySystem.services.homepage.home-services) (builtins.attrValues self.nixosConfigurations) ++ extraHome; } { - Media = builtins.concatMap (cfg: (cfg.config.mySystem.services.homepage.media-services)) + Media = builtins.concatMap (cfg: cfg.config.mySystem.services.homepage.media-services) (builtins.attrValues self.nixosConfigurations); } ]; @@ -199,7 +199,7 @@ in # homepage secrets # ensure you dont have whitespace around your ='s! - # ex: HOMEPAGE_VAR_CLOUDFLARE_TUNNEL_API="supersecretlol" + # ex: HOMEPAGE_VAR_CLOUDFLARE_TUNNEL_API=supersecretlol sops.secrets."services/homepage/env" = { # configure secret for forwarding rules sopsFile = ./secrets.sops.yaml; @@ -244,6 +244,13 @@ in group = "kah"; restartUnits = [ "podman-${app}.service" ]; }; + sops.secrets."services/adguardhome/env" = { + sopsFile = ../../services/adguardhome/secrets.sops.yaml; + owner = "kah"; + group = "kah"; + restartUnits = [ "podman-${app}.service" ]; + }; + virtualisation.oci-containers.containers.${app} = { image = "${image}"; @@ -265,6 +272,8 @@ in config.sops.secrets."services/readarr/env".path config.sops.secrets."services/lidarr/env".path config.sops.secrets."services/prowlarr/env".path + config.sops.secrets."services/adguardhome/env".path + ]; # labels = { diff --git a/nixos/modules/nixos/containers/plex/default.nix b/nixos/modules/nixos/containers/plex/default.nix index cf3e1ae..5954acb 100644 --- a/nixos/modules/nixos/containers/plex/default.nix +++ b/nixos/modules/nixos/containers/plex/default.nix @@ -55,7 +55,7 @@ in mySystem.services.homepage.media-services = mkIf cfg.addToHomepage [ { Plex = { - icon = "${app}.png"; + icon = "${app}.svg"; href = "https://${app}.${config.mySystem.domain}"; description = "Media streaming service"; diff --git a/nixos/modules/nixos/containers/qbittorrent/default.nix b/nixos/modules/nixos/containers/qbittorrent/default.nix index 877d498..9ada6d7 100644 --- a/nixos/modules/nixos/containers/qbittorrent/default.nix +++ b/nixos/modules/nixos/containers/qbittorrent/default.nix @@ -60,7 +60,7 @@ in mySystem.services.homepage.media-services = mkIf cfg.addToHomepage [ { Qbittorrent = { - icon = "${app}.png"; + icon = "${app}.svg"; href = "https://${app}.${config.mySystem.domain}"; description = "Torrent Downloader"; diff --git a/nixos/modules/nixos/containers/sabnzbd/default.nix b/nixos/modules/nixos/containers/sabnzbd/default.nix index 4d50fc1..b866817 100644 --- a/nixos/modules/nixos/containers/sabnzbd/default.nix +++ b/nixos/modules/nixos/containers/sabnzbd/default.nix @@ -47,7 +47,7 @@ in mySystem.services.homepage.media-services = mkIf cfg.addToHomepage [ { Sabnzbd = { - icon = "${app}.png"; + icon = "${app}.svg"; href = "https://${app}.${config.mySystem.domain}"; description = "Usenet Downloader"; container = "${app}"; diff --git a/nixos/modules/nixos/containers/searxng/default.nix b/nixos/modules/nixos/containers/searxng/default.nix new file mode 100644 index 0000000..48fbff6 --- /dev/null +++ b/nixos/modules/nixos/containers/searxng/default.nix @@ -0,0 +1,59 @@ +{ lib +, config +, pkgs +, ... +}: +with lib; +let + app = "searxng"; + image = "ghcr.io/benbusby/whoogle-search:0.8.4@sha256:93977c3aec8a039df94745a6e960d1b590a897e451b874c90ce484fbdbc3630f"; + user = "568"; #string + group = "568"; #string + port = 5000; #int + cfg = config.mySystem.services.${app}; + appFolder = "containers/${app}"; + persistentFolder = "${config.mySystem.persistentFolder}/${appFolder}"; +in +{ + options.mySystem.services.${app} = + { + enable = mkEnableOption "${app}"; + addToHomepage = mkEnableOption "Add ${app} to homepage" // { default = true; }; + }; + + config = mkIf cfg.enable { + + virtualisation.oci-containers.containers.${app} = { + image = "${image}"; + user = "${user}:${group}"; + ports = [ (builtins.toString port) ]; # expose port + labels = config.lib.mySystem.mkTraefikLabels { + name = app; + inherit port; + }; + }; + + mySystem.services.homepage.home-services = mkIf cfg.addToHomepage [ + { + Whoogle = { + icon = "whooglesearch.png"; + href = "https://${app}.${config.mySystem.domain}"; + + description = "Google frontend"; + container = "${app}"; + }; + } + ]; + + mySystem.services.gatus.monitors = [{ + + name = app; + group = "media"; + url = "https://${app}.${config.mySystem.domain}"; + interval = "1m"; + conditions = [ "[CONNECTED] == true" "[STATUS] == 200" "[RESPONSE_TIME] < 50" ]; + }]; + + + }; +} diff --git a/nixos/modules/nixos/containers/whoogle/default.nix b/nixos/modules/nixos/containers/whoogle/default.nix new file mode 100644 index 0000000..1da1e70 --- /dev/null +++ b/nixos/modules/nixos/containers/whoogle/default.nix @@ -0,0 +1,59 @@ +{ lib +, config +, pkgs +, ... +}: +with lib; +let + app = "whoogle"; + image = "ghcr.io/benbusby/whoogle-search:0.8.4@sha256:93977c3aec8a039df94745a6e960d1b590a897e451b874c90ce484fbdbc3630f"; + user = "568"; #string + group = "568"; #string + port = 5000; #int + cfg = config.mySystem.services.${app}; + appFolder = "containers/${app}"; + persistentFolder = "${config.mySystem.persistentFolder}/${appFolder}"; +in +{ + options.mySystem.services.${app} = + { + enable = mkEnableOption "${app}"; + addToHomepage = mkEnableOption "Add ${app} to homepage" // { default = true; }; + }; + + config = mkIf cfg.enable { + + virtualisation.oci-containers.containers.${app} = { + image = "${image}"; + user = "${user}:${group}"; + ports = [ (builtins.toString port) ]; # expose port + labels = config.lib.mySystem.mkTraefikLabels { + name = app; + inherit port; + }; + }; + + mySystem.services.homepage.home-services = mkIf cfg.addToHomepage [ + { + Whoogle = { + icon = "whooglesearch.png"; + href = "https://${app}.${config.mySystem.domain}"; + + description = "Google frontend"; + container = "${app}"; + }; + } + ]; + + mySystem.services.gatus.monitors = [{ + + name = app; + group = "media"; + url = "https://${app}.${config.mySystem.domain}"; + interval = "1m"; + conditions = [ "[CONNECTED] == true" "[STATUS] == 200" "[RESPONSE_TIME] < 50" ]; + }]; + + + }; +} diff --git a/nixos/modules/nixos/services/adguardhome/default.nix b/nixos/modules/nixos/services/adguardhome/default.nix index 14018e6..f0c965f 100644 --- a/nixos/modules/nixos/services/adguardhome/default.nix +++ b/nixos/modules/nixos/services/adguardhome/default.nix @@ -7,9 +7,10 @@ with lib; let cfg = config.mySystem.services.adguardhome; app = "adguard-home"; - yaml_schema_version=23; + yaml_schema_version = 24; port = 53; port_webui = 3000; + adguardUser = "adguardhome"; in { options.mySystem.services.adguardhome = { @@ -20,184 +21,209 @@ in }; }; - config = mkIf cfg.enable { + config = mkIf cfg.enable { - # Warn if backups are disable and machine isnt a dev box - warnings = mkIf (yaml_schema_version != pkgs.adguardhome.schema_version) [ "WARNING: Adguard upstream YAML schema is version ${builtins.toString pkgs.adguardhome.schema_version}, this config is set to ${builtins.toString config.services.adguardhome.settings.schema_version}"]; + # Warn if backups are disable and machine isnt a dev box + warnings = mkIf (yaml_schema_version != pkgs.adguardhome.schema_version) [ "WARNING: Adguard upstream YAML schema is version ${builtins.toString pkgs.adguardhome.schema_version}, this config is set to ${builtins.toString config.services.adguardhome.settings.schema_version}" ]; - sops.secrets = { - "system/networking/bind/trux.dev".sopsFile = ./secrets.sops.yaml; - "system/networking/bind/trux.dev".restartUnits = [ "bind.service" ]; + sops.secrets."services/adguardhome/password" = { + sopsFile = ./secrets.sops.yaml; + owner = adguardUser; + restartUnits = [ "adguardhome.service" ]; }; - services.adguardhome = { - enable = true; + services.adguardhome = { + enable = true; - mutableSettings = false; - settings = { - bind_host = "0.0.0.0"; - bind_port = port_webui; - schema_version=yaml_schema_version; # Just to be cautious, defualt is pkgs.adguardhome.schema_version. + mutableSettings = false; + settings = { + bind_host = "0.0.0.0"; + bind_port = port_webui; + schema_version = yaml_schema_version; # Just to be cautious, defualt is pkgs.adguardhome.schema_version. - auth_attempts = 3; - block_auth_min = 3600; + users = [{ + name = "admin"; + password = "ADGUARDPASS"; # placeholder + }]; - dns = { - # dns server bind deets - bind_host = "127.0.0.1"; - port = port; + auth_attempts = 3; + block_auth_min = 3600; - # bootstrap DNS - used for resolving upstream dns deets - bootstrap_dns = [ - # quad9 - "9.9.9.10" - "149.112.112.10" - "2620:fe::10" - "2620:fe::fe:10" + dns = { + # dns server bind deets + bind_host = "127.0.0.1"; + inherit port; - # cloudflare - "1.1.1.1" - "2606:4700:4700::1111" - ]; + # bootstrap DNS - used for resolving upstream dns deets + bootstrap_dns = [ + # quad9 + "9.9.9.10" + "149.112.112.10" + "2620:fe::10" + "2620:fe::fe:10" - # upstream DNS - upstream_dns = [ - # split brain dns - forward to local powerdns - "[/trux.dev/]127.0.0.1:5353" - "[/natallan.com/]127.0.0.1:5353" + # cloudflare + "1.1.1.1" + "2606:4700:4700::1111" + ]; - # resolve fqdn for local ip's - "[/l.voltaicforge.com/]10.8.10.1" + # upstream DNS + upstream_dns = [ + # split brain dns - forward to local powerdns + "[/trux.dev/]127.0.0.1:5353" + "[/natallan.com/]127.0.0.1:5353" - # reverse dns setup - "[/in-addr.arpa/]10.8.10.1" # reverse dns lookup to UDMP - "[/ip6.arpa/]10.8.10.1" # reverse dns lookup to UDMP - - # primary dns - quad9 - "https://dns10.quad9.net/dns-query" - - ]; - upstream_mode = "load_balance"; - - # fallback dns - cloudflare and mullvad - fallback_dns = [ - "https://dns.cloudflare.com/dns-query" - "https://doh.mullvad.net/dns-query" - ]; - - # resolving local addresses - local_ptr_upstreams = [ "10.8.10.1" ]; # UDMP router - use_private_ptr_resolvers = true; - - # security - enable_dnssec = true; - - # local cache settings - cache_size = 100000000; # 100MB - unnessecary but hey - cache_ttl_min = 60; - cache_optimistic = true; - - theme = "auto"; - }; - - - filters = [ - { - # AdGuard Base filter, Social media filter, Spyware filter, Mobile ads filter, EasyList and EasyPrivacy - enabled = true; - id = 1; - name = "AdGuard DNS filter"; - url = "https://adguardteam.github.io/AdGuardSDNSFilter/Filters/filter.txt"; - } - { - # AdAway default blocklist - enabled = true; - id = 2; - name = "AdAway Default Blocklist"; - url = "https://adaway.org/hosts.txt"; - } - { - # Big OSID - enabled = true; - id = 3; - name = "Big OSID"; - url = "https://big.oisd.nl"; - } - { - # 1Hosts Lite - enabled = true; - id = 4; - name = "1Hosts Lite"; - url = "https://o0.pages.dev/Lite/adblock.txt"; - } - { - # HAGEZI Multi Pro - enabled = true; - id = 4; - name = "hagezi multi pro"; - url = "https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/adblock/pro.txt"; - } + # resolve fqdn for local ip's + "[/l.voltaicforge.com/]10.8.10.1" + # reverse dns setup + "[/in-addr.arpa/]10.8.10.1" # reverse dns lookup to UDMP + "[/ip6.arpa/]10.8.10.1" # reverse dns lookup to UDMP + # primary dns - quad9 + "https://dns10.quad9.net/dns-query" ]; + upstream_mode = "load_balance"; + + # fallback dns - cloudflare and mullvad + fallback_dns = [ + "https://dns.cloudflare.com/dns-query" + "https://doh.mullvad.net/dns-query" + ]; + + # resolving local addresses + local_ptr_upstreams = [ "10.8.10.1" ]; # UDMP router + use_private_ptr_resolvers = true; + + # security + enable_dnssec = true; + + # local cache settings + cache_size = 100000000; # 100MB - unnessecary but hey + cache_ttl_min = 60; + cache_optimistic = true; + + theme = "auto"; }; + + + filters = [ + { + # AdGuard Base filter, Social media filter, Spyware filter, Mobile ads filter, EasyList and EasyPrivacy + enabled = true; + id = 1; + name = "AdGuard DNS filter"; + url = "https://adguardteam.github.io/AdGuardSDNSFilter/Filters/filter.txt"; + } + { + # AdAway default blocklist + enabled = true; + id = 2; + name = "AdAway Default Blocklist"; + url = "https://adaway.org/hosts.txt"; + } + { + # Big OSID + enabled = true; + id = 3; + name = "Big OSID"; + url = "https://big.oisd.nl"; + } + { + # 1Hosts Lite + enabled = true; + id = 4; + name = "1Hosts Lite"; + url = "https://o0.pages.dev/Lite/adblock.txt"; + } + { + # HAGEZI Multi Pro + enabled = true; + id = 4; + name = "hagezi multi pro"; + url = "https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/adblock/pro.txt"; + } + + + + ]; }; + }; - networking.firewall = mkIf cfg.openFirewall { + # add user, needed to access the secret + users.users.${adguardUser} = { + isSystemUser = true; + group = adguardUser; + }; + users.groups.${adguardUser} = { }; - allowedTCPPorts = [ port port_webui ]; - allowedUDPPorts = [ port port_webui ]; - }; + # insert password before service starts + # password in sops is unencrypted, so we bcrypt it + # and insert it as per config requirements + systemd.services.adguardhome = { + preStart = lib.mkAfter '' + HASH=$(cat ${config.sops.secrets."services/adguardhome/password".path} | ${pkgs.apacheHttpd}/bin/htpasswd -niB "" | cut -c 2-) + ${pkgs.gnused}/bin/sed -i "s,ADGUARDPASS,$HASH," "$STATE_DIRECTORY/AdGuardHome.yaml" + ''; + serviceConfig.User = adguardUser; + }; - mySystem.services.gatus.monitors = [ - { - name = "${config.networking.hostName} external dns"; - group = "dns"; - url = "${config.networking.hostName}.${config.mySystem.internalDomain}:${builtins.toString port}"; - dns = { - query-name = "cloudflare.com"; - query-type = "A"; - }; - interval = "1m"; - alerts = [{ type = "pushover"; }]; - conditions = [ "[DNS_RCODE] == NOERROR" ]; - } - { - name = "${config.networking.hostName} internal dns"; - group = "dns"; - url = "${config.networking.hostName}.${config.mySystem.internalDomain}:${builtins.toString port}"; - dns = { - query-name = "unifi.${config.mySystem.internalDomain}"; - query-type = "A"; - }; - interval = "1m"; - alerts = [{ type = "pushover"; }]; - conditions = [ "[DNS_RCODE] == NOERROR" ]; - } - ]; - - mySystem.services.homepage.infrastructure-services = mkIf cfg.addToHomepage [ - { - "Adguard ${config.networking.hostName}" = { - icon = "${app}.svg"; - href = "http://${config.networking.hostName}.${config.mySystem.internalDomain}:${builtins.toString port_webui}"; - description = "DNS Ad blocking"; - container = "Infrastructure"; - widget = - { - type = "adguard"; - url = "http://${config.networking.hostName}.${config.mySystem.internalDomain}:${builtins.toString port_webui}"; - # username = ""; - # password = ""; - }; - }; - } - ]; + networking.firewall = mkIf cfg.openFirewall { + allowedTCPPorts = [ port port_webui ]; + allowedUDPPorts = [ port port_webui ]; }; + mySystem.services.gatus.monitors = [ + { + name = "${config.networking.hostName} external dns"; + group = "dns"; + url = "${config.networking.hostName}.${config.mySystem.internalDomain}:${builtins.toString port}"; + dns = { + query-name = "cloudflare.com"; + query-type = "A"; + }; + interval = "1m"; + alerts = [{ type = "pushover"; }]; + conditions = [ "[DNS_RCODE] == NOERROR" ]; + } + { + name = "${config.networking.hostName} internal dns"; + group = "dns"; + url = "${config.networking.hostName}.${config.mySystem.internalDomain}:${builtins.toString port}"; + dns = { + query-name = "unifi.${config.mySystem.internalDomain}"; + query-type = "A"; + }; + interval = "1m"; + alerts = [{ type = "pushover"; }]; + conditions = [ "[DNS_RCODE] == NOERROR" ]; + } + ]; + + mySystem.services.homepage.infrastructure-services = mkIf cfg.addToHomepage [ + { + "Adguard ${config.networking.hostName}" = { + icon = "${app}.svg"; + href = "http://${config.networking.hostName}.${config.mySystem.internalDomain}:${builtins.toString port_webui}"; + description = "DNS Ad blocking"; + container = "Infrastructure"; + widget = + { + type = "adguard"; + url = "http://${config.networking.hostName}.${config.mySystem.internalDomain}:${builtins.toString port_webui}"; + username = "admin"; + password = "{{HOMEPAGE_VAR_ADGUARDHOME_PASS}}"; + }; + }; + } + ]; + + + }; + } diff --git a/nixos/modules/nixos/services/adguardhome/secrets.sops.yaml b/nixos/modules/nixos/services/adguardhome/secrets.sops.yaml index f6b6744..b24d3ab 100644 --- a/nixos/modules/nixos/services/adguardhome/secrets.sops.yaml +++ b/nixos/modules/nixos/services/adguardhome/secrets.sops.yaml @@ -1,9 +1,7 @@ -system: - networking: - bind: - key: ENC[AES256_GCM,data:43QoyVqdwHO6eSgjbjgl28FSlD2xaoNxWpnc5D7g7jj6HaMwkz0tAnmg+g1fxEj1m826wxxqtgBjbMaDPj/hHtqYrgXsIvPShBSUDAyjoLcNFcsr0BhFVQ/ZWCCiI95SScbMTBJVcegf,iv:/R/7Qb+xPQXjYaQbF3NLeA63XAvdctayO5G8pE9bCE4=,tag:roNy7HNjWrIwZjy3BDAedw==,type:str] - trux.dev: ENC[AES256_GCM,data:vpbUHK8vWPlKvRdsKKI6oonri8HkwhxXMHuEpFYxtUPjX7/FduMkt08YYBAsjemiYfsV4NoKLmUlbP6nO3yiEY4HObkzM5DYOvMHE1YiFVg8YtAmW46fCAP7kSqz4my5GZ8CBA7/jJNy/Mc2sPsrE/N9IAmsl5nMJTOzaVm2b8QW/WZmHONGRkL3o8lqdhZpETmOJfII0lLd5VBiZRNeDOsldr4RZs4e8TyWRxGoO8/HaRdocGj0wvyKpnUmqwz6SbM1JXzT2zbZBsDNXr7chLdfTVptPwy2dgZzpZtZHi0ZZH7X656Ai4nkuyS/wPu4Zr8uXbvCAoR7K1FPc2fOxPJLrZeciWrauhTRg424NWz3esL0OEnol0LF0LWKQfC/eIlA7rN/MR0eAUvRuWWZtzwGlU+cUUXD+XJcKoos68Do9E1vXhO2OOcA1P0Hsp0+tmEi/7qMwyyikwPhQ6+NmyU9Il3hwkfbpVyA3WvfqeOnL/vAGs42BQFxgbPGmrNTzOVuvDblslodPngbvr3dwukSI5VBhpdPnKfTtJPKqgXGbiIJHhHYCeFXoY3GNx6qAshTqq2/xGiZuZ7mqqHO6aSJr+EQrZGrKiUE5EXn1GE88oK0QWXZyJQoQjygS+Xx1a22wcKv3ZDq/3ueUHR6heLrfGXPoZ7Rjiovb7HOZUNKVNk6laJcGzMMBKyLwoLLdyuWVBGqxjAdEC4umHVT/LBPQ2b+ubqAo2dIMBsqb2x19rLTWyUAEU1fy70C/Pco1P/Y8TkQ/Z9KtutRydIkDp2b0OL2CRBKJw48K7xjjfX5mVMrVTkOsV2RzYiTgf/kjaMFkck4mFZwWoJySnp1vc8WZ93VVy5LfjoTpIWugwy7qnpJ1jq57/o5V3LS90AW92lCa7x7djbIS3YIY0izNCJciLJoKJ6iPCulmP0zq41QV5Ms//uJD7g5667tqDtN7yyqEa02I72VHKiNRQeKpFDlivruQsdQAL3MyCf6in8wwFTac7mL4ZUYb5nsb9xv9vbZqNYl2OBNu28IZrI17vOI4AgaQ9pUV13u4vIJ6hBfSGOzoA1N7uurBS3XIqr3drs8Oc3pWgujP06ok6wRXLGxUuOtBRwM8RE+hmTxKsE4o1Q8fMbpfMfYZsL5i17gDcvuzoP65G/hZNFGNURUuh+kUzbay21igVp6SCMqDSCGdyX9C6l68SIc3K6vkvrJv2mSQnYm80ynhc+zGuGCEvfcbXcPut/OjwHc+6IEXqDbKERv3h+okQtdf3ELq0b0dZwZFO3n1PccbX3pPgQE+Mhv+36JcD0PGqOh5KbZo2vQybfElsP+ipRjvQHNLs7NRiL7JAveavbdczXY1lTdasXJtAHZaZk5LMR3wtF2+8mTTl8wI5Bzrad3iY+WsKBFu2ClyCdYY34X8W/69Nn6xx0LZ0E1gH6uaL5YCKlS/cizR2WOPa6b7litell84p5OkCtvltzQdCxloRWhCa89UASa2SX/wmobuHm9PFHVWHI3rKFoLBtUOrEdIK4f3JAxdaE2lQp6HF6rDoEj4QWF/XqrC2hDb6vneXCZwqvemtwWHTQItPo4/Lz5s2rIi/YSSPxfYTP1w+QNQX751ln7S7g+u7gyE1VH7T6UBsFI/jFnOykdqSOjPNjI6P4w1d1xaObXnlVAkDjNTZAwJqu/zdRA2p9eY93SOB1ppDLxrDufLUIdp2lh4N5R1MeJjq/pFSEWP8yw9av+z719cTKVLLkv0g4z8ynhwZhgd0j5xKEBY5NlSVrt12lP+Pu9qa+srPr1yUFKvkFyMZny3g5o8Cm3vX4LY+QfnVlmXWKzOUR+ZcT8t2mNLUdydGm9X1JGkSw8VkIMGrrZJLYZFl5TSppf1VOhMgY6FnVgY8Ofri+SjaQsUtEtBFfMcTniCHVqviVwQ1T29/PqV9aFagIrynHGdKsZU0FpeBjv42YKLk7gOTVdGfoFcQ7JfbpZnyLGZ/OlVUNO2vsTsrijMloRZQCnQVMgece+9IFDsbI8++HEbhnE6vHslkdfJe6qmMuDhluTSvFsSQK+GoM1ur7ZK8Q26OJzDoROHZg0xdPs8RY/lMv9CCDOcvAx916Ut50GicVgt2pLn2hN1qYVLxZVRhW06+YgjRzKJdBG6i6DCVJDBD9gyukdTUC1md5ifKdnXznDltS1wiHmyDpomaW7FD0shgEehAS8HF5QeqksFPoLyYe1DYjhulwZa9RWTzA8OQaXqfatiXR4fFiS+iWhCT7qwkk2qti6MUlImNV36ZPanjyuv/VP/u1zg8s1S9L+tXxAHoSestkJ0+Q8CoiGnPOyTbQEPNKstEbgjl5gUrmYP54l9gKnI++HKNkwKW1FAnpWjCi0G6VaNcxNfLheEZqBq+kzbzxcYEFG3Uwf8fwcZlp+EDQg40O7R0uDcsteSTtmc6ktrfSw6iFXcVTUW6YFJ6lsbzbjL4z1NFBZIvBCerVXLEY5UWMDS6BsLT4DvEynf4PwSWDnHrkJ5XgyDE5siutkTPgK4qWVy8DIASAUwu+lczKGY9ygKfaRyYVKripEcrpxs8Wq/5z1jgMU4HYH1asiV32sX/gAYK+2mduJY/aBiHWzmcIjsKHWtJPYLqeoPy7f0DmQrMs78L3uYYqyv8JBN27ilxAHYqxjETOZNE9uapnaJH2brKCPFQMYq5LnU2CfRZkvfuwVFejGgDhhRmgyIwpYTo7I9vLa7cxtSI54kRwJ96JPnxVbhI127v6CrrQlhQHJTpGkZtavIFNATctdPP9CWk19K2puzonVHeyfp9TajiaerKZPCPTDdoOFrMUJc9bX7wKIhCZl/xdg7FuzhRTcU8L2hPulmNEXMKRg3MfMgRAaIXvus9Rl0HGmggCg9TNt4SBSt3Wd/hxbNMf14B9Hvf5Jycb8pj5pekk/kw5G8ujU70QLiSBeyerMQodZNfHUxpdm8pi2x4DHjUW3nTWKWAheVO+qOpx7CiWJT751qcPpZz4/hEcT3srPhRA1Bb9br19drklKI4xbvD2S1ZohAN7D1rTKfkfVHNf+j0IHvNHQ8gyyQTIdsysUbv5/a4C1a5KSpFhefKQq+kxJJLmbj42FUJojMSRpOn5rTIKQtTzhiAMg1mfEdui+pZmM1s/H9q8Sbg71x/6/6wjou2/qq8xjxxVk0xJmnlMBxsQ745VQR+TIBIr5Hc0GHm05LnZBlKw0ej3gyUtAtTke6zmSXezU4yPQ6qo8XpTYNXxeFvJMRe0YEpTgEYXvAaaxuU154/nqqLlySNpnXf/s2WFdDCdf6Q5ZaPotzoaICanl1J4fxMNG4Kk5wZ31+9281A3rPJBENFxznj/UK7i4Odir9oCLfNeUyGVbr2VV6Iig3i+RBBwgyQ==,iv:MEA1aXQR/4LFrVOrJmWWwXkbT3FWR8Hp2c4kiw4yv7Y=,tag:FufABt/+oXZCXXw55hvuwA==,type:str] - natallan.com: ENC[AES256_GCM,data:nsivV8P1dSHSN/ty7tvBciKz/9xslQFohHh8fYkgoMy2dRoywaxT4+S3/tl499KP1mepw6E0z8SC3vnj5XzT4kFPEcSoUk6OpZTaqNWlwIU7PsaPys41uK9wszkj4W0J1BdbExC9hn4IkwXJ7iRlMqwSlTc2VlNiu+nhiuixvSdsYWqzGpXFzWzd0oPphq/PmJCM2ZQMbVKTnFSer9oeQBRxJ6lj4XYxO6HxT2XNPkXBnx8dr7vgLSANN8GwdnYHbIZ9XWDhaVw+VY21pXyF0I9tnbuZ5oherqTO9cbZ6NGpYeschs3ep9tpoC7QLnJwbOncfCcCvbKxjbdfRzJ+8Mjv16jAmDyFjQII9tvW7NtJtV1zWM59l62u2d7NAHuaEYE2Gr+UES4+DDKw5n6SoYAgHw6k9jMmrtSUKI8TRaBDBTrbuvnhbZOaYF0kLV2De5HWs2wvR7W58tWkmKejI2xYinpkXjtdF8zESdPjgDImnDobQX03GF7HY7tdbZ0ZtdWMI7fud66Db8TumXN3bbQAx9nOFTaNba49jKjVybwVMeOVKrYbbh3X9SpM+REh6fDN0a4iEgrP4I8YF+PqeAxVFlmHWe8JAICLR3JhU75mVYve3u27XGxX3DhGzvIM/JiifcpOg3Lg1rn1RhWt3Zq+H9ygo4N9Sigk/pT7pBhlm548uibYi7/TFe1I5CXkGGQ+I47CKUJzK934EqN9zZ80qDdQS0AN7cI8hXCXgc7+nVBNc/5cu3y9ubKF7xWyhL3RgwdSbCnthG2EQ7GEMZnhDRdazYtdmZhoJw6MyL/AFVZgbHfAyg==,iv:TLCkT60LTZ2m3gYCz4YQ/XYhvbdZJApoW3OekEVjULI=,tag:ZlxHEZQa/pUwjQF3HdqYdw==,type:str] +services: + adguardhome: + password: ENC[AES256_GCM,data:B8Tzow8IEAY=,iv:6ehyutNPuVndybuegNNjd++Zjgms7T2/tzdaCeUUW+0=,tag:ovktD+jFUcVU3++Lr6brZA==,type:str] + env: ENC[AES256_GCM,data:Pi2NGVtup1ziNLIZnFepJoZJuowq76QOxdN9auWcuJKKH/JXVXg=,iv:HSo+XJSlUw2XlYUyzKCKo2k5LZB2GmaciYDNiKyGynI=,tag:QFtlphbEu7cmsTMd39FzPQ==,type:str] sops: kms: [] gcp_kms: [] @@ -13,59 +11,59 @@ sops: - recipient: age1lj5vmr02qkudvv2xedfj5tq8x93gllgpr6tzylwdlt7lud4tfv5qfqsd5u enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6cW5zMXc2Skc0S0lvWXF2 - NE0za1kyOU5GY0Z0QW9hTDVuTWRPd2pTcTBjClhOT0xrYUo4Y2Rtd0dyQU9MeWtq - dHZMWGZhbWtTOUVPMDlhWUdhVEhIZVEKLS0tIG12Ujh6WEVNeUdvVmtuYmZJdVJG - bWZxWXU5TzlYNDZnY1Fua3RGUEJnNUkKMC/png4A565h/S3B2ZVce7LJi1SMDS5n - aYx/nrPTktIe8bCvwF300tNZoZolXONR4awJ9e88uw84t8GYjlNNPw== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvZzdsam82ZUpibS9pRm81 + L0Z2QkJjcEo5ZHd0RVRuUHdTT2pyaHJ4aTNnCnNvSEhLekJqSmdrT3B3T29NZTJC + K3J2bFcxYUFmN2hYeUwzTERvWmllNDQKLS0tIER0NStqSXpJRUtHOGZ5Q0xlUmZ4 + ZE9oWTZ0Q2doYU5KdVJrbkdkZThBYW8K9XgNQz7VOEsC9Y2tfKMgEt4qpYJ9ZwRf + plu7eSHnYIiBoP8Sav/HOD5BR49k8zlo+1spWOw874NiTFpY/WWUFw== -----END AGE ENCRYPTED FILE----- - recipient: age17edew3aahg3t5nte5g0a505sn96vnj8g8gqse8q06ccrrn2n3uysyshu2c enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGVmkxam5MVW1FSEo4QjB4 - c0VKUDJIVDI1WkFOYmJ2TEcrWGlqQVFGQm1RClBxSjRjSGd3SkRIbUc4OUdhT0F2 - WVJoUlR0amdOcTE4YUMwR1JjTGlBRUkKLS0tIHZFKy9XWnVoQUJLTzZGclp6Y0tQ - cUVoQk9JMEpRNUNQbjcxbnFiUDNmbFUKIBJcq8uJCIhdMv5e79K66Qrxlg88K/Gb - MT1h2v6h5uiYm6JaspSqz9Hqx9YfRocl/kJmVy/QdeIGPVzm24dnIQ== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuVmx1UGdpckZNelh0NGVJ + bXk3QjZvOW9sSWNIN0k3akNRQ3hYb1JVUWdjCmQ3ZGYxR2w5dzFRaWJoODlSb2Ru + cGYxR1paZ1Y2UDZ3aWdLSGMyWnlJdzgKLS0tIDJUdmlERzA5M29neXl1UldsWVJN + azd4aVlza0ZTUktXR0plLyttdEp0V0EKc69XRDnGe+6r1Tig9C0E8dM1MO2PYrsj + Onn2HvnCYdlkoLQvip20SgMg8F4WArRlyAfSIwogX3IeyJ24YBU5hg== -----END AGE ENCRYPTED FILE----- - recipient: age1u4tht685sqg6dkmjyer96r93pl425u6353md6fphpd84jh3jwcusvm7mgk enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1Sy85ZVA3WGVhVWlSZmhy - VDBDK2dZYmR6djlQYkhhQ25zeWdxM1JpMEg0Ck5hZm12ZmtkQmJLUmdMNm94WnZL - NnY1eG1neEpLSEVkRGhkY2FHUFhTWVkKLS0tIGVpNlZrRGtqRFR1OVc3enpRUVQ2 - N2swa1BIellpbjBUbmsyc2NnYmphOU0Kx/4I/zjyi3GlYMgcNIb7sYufLfvJ9Xny - HeR7r03YuHu5dOQ1T8iFigXUhy/2DkdW8kWtKlpuT0qg35dKqjCi/w== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArdDFCYWFkZmFIMXYwWFcy + TU5hRkJwUXMrK0VyQzdoZlB5ZFNuVHRWRW5JCnBkUGEvd2lRdWFHd2dVeFk0WUFv + UHFiTDdYdFJSZmZrUG9xajUrWWRSMTgKLS0tIEgyd2tSN2Z3VGhVdzgyZTFYT1Zp + eXQ0bTNDQXBRT2Y3aTdLWng0ZlZRVFUK6fcztm9ITbHjc4H0nN6nvTyx1oBeOgHg + IGXZBNgD82wz0fne0teriUAz+cgvdFBKhhTaoZO4u9pMnschAfziWw== -----END AGE ENCRYPTED FILE----- - recipient: age1cp6vegrmqfkuj8nmt2u3z0sur7n0f7e9x9zmdv4zygp8j2pnucpsdkgagc enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyVjBXb2EzM3U0MDRnRGV6 - YWJieTFHaXFFOEhFdjJNU2x3VVlSOEpBNFFjCkpNZWpxa3ZRRFVabXd5enFqenZY - aXpqOC90YXB2aTR5K1FFQ2dnNXVCZlUKLS0tIGkvTmpLeFNGdWpaRU9CaGtLcWgr - d09aV285U3YrNjY2VVpFaGtFS1B3bUUKRL1dsEHuWbEjRaKqd2F6xrhC7htNo0hw - fItd7J3gccRP5jUTzJ0QZBJvsj9wCAQU1iJfv14zcO6TzOB5B4jW7w== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtTzRZMTd6bmppKzk4cG1Q + dStuSDNrMExFUUlpRkJLNWRTU2lZNEJmYmlvCjVhTzFiejJMTWlZbGIveGd2cnpy + clRzZHlwcWFJaVIzc2k1bUJBc2tTMEUKLS0tIGdPMGxhQ3lvankrTFEwS2ZWdXRy + dlg0bHRMaXN0aDc1S3ByNm1oQW5Sbk0Kz+FJWtBnjY9IdvajBUS72n0p6NEZ/jEZ + 3N96r8Ufz8cReN5fK+atGkPVmsdz+Z9UeYhdPDgYPdnhsjTj6+JYDg== -----END AGE ENCRYPTED FILE----- - recipient: age1j2r8mypw44uvqhfs53424h6fu2rkr5m7asl7rl3zn3xzva9m3dcqpa97gw enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2WE5LVEFIdVFXT3I1Znk1 - NmJzWWZHQ05GclNuMFUvZE9PazdFYmZVWmlNClpHVVB1bFhUU3phUjlhQTBDTENq - QkNFMTc3VTU1SkxtK0x3SnFzYm90aTgKLS0tIHJHc3NXekM4Ly9SSEFydFZrTk9l - MVUxcEpUemlmWmRvQThUdTdkQ2svNHcK0WyOuWbv+eyYWLFsKBl+K+/n9QCfehqQ - 0hC0SY2Nf+9YHMDXrSse44NPs/ucOPlYRFV/HbPNvfEF62K7Gt79lA== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYT0V6Mm5MRVpyMGdtcmFj + VjdPdkREU0h2NDJ5VXBvcDV5V3libmJ6Z2dJCmJsRlpneUV1M21WaGsreDdOMmI2 + dEVsSXpoNm5SL3BIWi9MckhVZ2E1ckUKLS0tIG1jRFFtQmFXU0VLak1rNTBTQWNG + UGNreUc3YUFwbjA0K0pFaDFYK25mWHMKP5t/WUbTg4VhdPc/FOmQtxdTRyIfYdOQ + 2aZfUTy0sL0I57ROJCNF/du/XUjZfFxNusiZ4SaIRfcyfzBe5eybnQ== -----END AGE ENCRYPTED FILE----- - recipient: age1jpeh4s553taxkyxhzlshzqjfrtvmmp5lw0hmpgn3mdnmgzku332qe082dl enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3SHFQQUIzQXlqZFFnTWNt - YVJIb0MzTFM2NENpNFFiaHFmaU95K3VLNGdZCkFyMEFHZjhZclJMTE4yRWNJQnJR - T25yTWZQOFE5L011M3FnMUxPb3hPbVEKLS0tIElzYlpHUEQwejlDNTFmK3R1dU0r - RzJ5UGIvUUluZXNzRzlXRWl5aGdmaUUKObqo2Wj62ZcK0qMcsttRHphWTgkPOTz4 - NkvAvOaSX2wJHRhH9SHGhkPwEhsgdmaagsVpwpLPrOCRlWI/bd1Qhg== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpM3lmdnBhb1NTbFpDajlq + QkxqbVJjZW1yajAwNUovUHBSNDBMYUxaUEdvClBQeEZZcmU2Y0Q4MnRYVkxucDh5 + ZVYyOFh0cEpwVWszZjAvNFdLR0s1N3cKLS0tIEllM012ZDUyWU5RNHB3NG1kSGlj + Tzh3YVpNUmRDenVYU2lHVHR2dmV4SkUK5DXnp3tpXNVyyhuS0YX02JbrFDcAJdDy + VOCBDMPqeSRU9ok+6xC2RUXAdXCW7N72gm22GKVdH3e6Fjp32d6P/w== -----END AGE ENCRYPTED FILE----- - lastmodified: "2024-04-16T06:30:13Z" - mac: ENC[AES256_GCM,data:PsD5hu5nyjPY9/bgLTiTReqoT+hwlJx8A5pOkCTcPNQs63So4GM5mDDTuWG8u1WlBOEdKEDqVefVMtCiwOsC6xIVM8AHCGOcad2j4qQbHR+2lc8nMZE8R7ceJc2ZeLBPlD5/BQ2R5XiQ+NXu0qypHjYkVwnkI62nPSXALSd9btg=,iv:cy7slD5dcfTEeObWraswcghwhgAe1RylU4aafXezEYU=,tag:/nSCQJDYfrWpfpfdkigV7w==,type:str] + lastmodified: "2024-04-17T12:00:13Z" + mac: ENC[AES256_GCM,data:93mY9BXAlztekg8BZgvtz6wTS9msDfoxjFVqudZILN0nUSJLBmLH/MlT0dr1NCZaAgHuRERU2pTDEqVn8KhZaiK5h0RTQmQ0UgVH4MGqi3ItmKccO8nAxtcgX4/VNyMj7yACho+p3Bw/MBHX+l7fjXxJV0erOvWG1bqV7xXEUFI=,iv:70EEdkLFu2VobB4EiJGtE4xNV0x9+PYw2eAJOEaYAL0=,tag:RAa418cx46lyAmx+77/cDA==,type:str] pgp: [] unencrypted_suffix: _unencrypted version: 3.8.1