feat: warning for adguard schema mismatch (#109)

* feat: warning for adguard schema mismatch * Auto lint/format --------- Co-authored-by: Truxnell <9149206+truxnell@users.noreply.github.com> Co-authored-by: truxnell <truxnell@users.noreply.github.com>
2024-04-18 21:38:42 +10:00 · 2024-04-18 21:38:42 +10:00 · e3d3e338b6
commit e3d3e338b6
parent 9f7a144459
18 changed files with 361 additions and 207 deletions
--- a/.gitleaksignore
+++ b/.gitleaksignore
@ -0,0 +1 @@
+nixos/modules/nixos/services/adguardhome/default.nix:hashicorp-tf-password:47
--- a/nixos/hosts/durandal/default.nix
+++ b/nixos/hosts/durandal/default.nix
@ -19,6 +19,7 @@
    plex.enable = true;
    tautulli.enable = true;
    syncthing.enable = true;
+    whoogle.enable = true;


  };
--- a/nixos/modules/nixos/containers/arr/lidarr/default.nix
+++ b/nixos/modules/nixos/containers/arr/lidarr/default.nix
@ -63,7 +63,7 @@ in
    mySystem.services.homepage.media-services = mkIf cfg.addToHomepage [
      {
        Lidarr = {
-          icon = "${app}.png";
+          icon = "${app}.svg";
          href = "https://${app}.${config.mySystem.domain}";

          description = "Music management";
--- a/nixos/modules/nixos/containers/arr/prowlarr/default.nix
+++ b/nixos/modules/nixos/containers/arr/prowlarr/default.nix
@ -60,7 +60,7 @@ in
    mySystem.services.homepage.media-services = mkIf cfg.addToHomepage [
      {
        Prowlarr = {
-          icon = "${app}.png";
+          icon = "${app}.svg";
          href = "https://${app}.${config.mySystem.domain}";

          description = "Content locator";
--- a/nixos/modules/nixos/containers/arr/radarr/default.nix
+++ b/nixos/modules/nixos/containers/arr/radarr/default.nix
@ -62,7 +62,7 @@ in
    mySystem.services.homepage.media-services = mkIf cfg.addToHomepage [
      {
        Radarr = {
-          icon = "${app}.png";
+          icon = "${app}.svg";
          href = "https://${app}.${config.mySystem.domain}";

          description = "Movie management";
--- a/nixos/modules/nixos/containers/arr/readarr/default.nix
+++ b/nixos/modules/nixos/containers/arr/readarr/default.nix
@ -61,7 +61,7 @@ in
    mySystem.services.homepage.media-services = mkIf cfg.addToHomepage [
      {
        Readar = {
-          icon = "${app}.png";
+          icon = "${app}.svg";
          href = "https://${app}.${config.mySystem.domain}";

          description = "Book management";
--- a/nixos/modules/nixos/containers/arr/sonarr/default.nix
+++ b/nixos/modules/nixos/containers/arr/sonarr/default.nix
@ -64,7 +64,7 @@ in
    mySystem.services.homepage.media-services = mkIf cfg.addToHomepage [
      {
        Sonarr = {
-          icon = "${app}.png";
+          icon = "${app}.svg";
          href = "https://${app}.${config.mySystem.domain}";

          description = "TV show management";
--- a/nixos/modules/nixos/containers/backrest/default.nix
+++ b/nixos/modules/nixos/containers/backrest/default.nix
@ -54,7 +54,7 @@ in
    mySystem.services.homepage.infrastructure-services = mkIf cfg.addToHomepage [
      {
        Backrest = {
-          icon = "${app}.png";
+          icon = "${app}.svg";
          href = "https://${app}.${config.mySystem.domain}";

          description = "Local restic backup browser";
--- a/nixos/modules/nixos/containers/default.nix
+++ b/nixos/modules/nixos/containers/default.nix
@ -8,5 +8,6 @@
    ./plex
    ./tautulli
    ./backrest
+    ./whoogle
  ];
 }
--- a/nixos/modules/nixos/containers/gatus/default.nix
+++ b/nixos/modules/nixos/containers/gatus/default.nix
@ -68,7 +68,7 @@ let



-  ] ++ builtins.concatMap (cfg: (cfg.config.mySystem.services.gatus.monitors))
+  ] ++ builtins.concatMap (cfg: cfg.config.mySystem.services.gatus.monitors)
    (builtins.attrValues self.nixosConfigurations);

  configAlerting = {
@ -140,7 +140,7 @@ in
    mySystem.services.homepage.infrastructure-services = mkIf cfg.addToHomepage [
      {
        "Gatus Internal" = {
-          icon = "${app}.png";
+          icon = "${app}.svg";
          href = "https://${app}.${config.mySystem.domain}";
          description = "Internal Infrastructure Monitoring";
          container = "${app}";
--- a/nixos/modules/nixos/containers/homepage/default.nix
+++ b/nixos/modules/nixos/containers/homepage/default.nix
@ -159,15 +159,15 @@ let

  services = [
    {
-      Infrastructure = builtins.concatMap (cfg: (cfg.config.mySystem.services.homepage.infrastructure-services))
+      Infrastructure = builtins.concatMap (cfg: cfg.config.mySystem.services.homepage.infrastructure-services)
        (builtins.attrValues self.nixosConfigurations) ++ extraInfrastructure;
    }
    {
-      Home = builtins.concatMap (cfg: (cfg.config.mySystem.services.homepage.home-services))
+      Home = builtins.concatMap (cfg: cfg.config.mySystem.services.homepage.home-services)
        (builtins.attrValues self.nixosConfigurations) ++ extraHome;
    }
    {
-      Media = builtins.concatMap (cfg: (cfg.config.mySystem.services.homepage.media-services))
+      Media = builtins.concatMap (cfg: cfg.config.mySystem.services.homepage.media-services)
        (builtins.attrValues self.nixosConfigurations);
    }
  ];
@ -199,7 +199,7 @@ in

    # homepage secrets
    # ensure you dont have whitespace around your ='s!
-    # ex: HOMEPAGE_VAR_CLOUDFLARE_TUNNEL_API="supersecretlol"
+    # ex: HOMEPAGE_VAR_CLOUDFLARE_TUNNEL_API=supersecretlol
    sops.secrets."services/homepage/env" = {
      # configure secret for forwarding rules
      sopsFile = ./secrets.sops.yaml;
@ -244,6 +244,13 @@ in
      group = "kah";
      restartUnits = [ "podman-${app}.service" ];
    };
+    sops.secrets."services/adguardhome/env" = {
+      sopsFile = ../../services/adguardhome/secrets.sops.yaml;
+      owner = "kah";
+      group = "kah";
+      restartUnits = [ "podman-${app}.service" ];
+    };
+

    virtualisation.oci-containers.containers.${app} = {
      image = "${image}";
@ -265,6 +272,8 @@ in
        config.sops.secrets."services/readarr/env".path
        config.sops.secrets."services/lidarr/env".path
        config.sops.secrets."services/prowlarr/env".path
+        config.sops.secrets."services/adguardhome/env".path
+
      ];

      # labels = {
--- a/nixos/modules/nixos/containers/plex/default.nix
+++ b/nixos/modules/nixos/containers/plex/default.nix
@ -55,7 +55,7 @@ in
    mySystem.services.homepage.media-services = mkIf cfg.addToHomepage [
      {
        Plex = {
-          icon = "${app}.png";
+          icon = "${app}.svg";
          href = "https://${app}.${config.mySystem.domain}";

          description = "Media streaming service";
--- a/nixos/modules/nixos/containers/qbittorrent/default.nix
+++ b/nixos/modules/nixos/containers/qbittorrent/default.nix
@ -60,7 +60,7 @@ in
    mySystem.services.homepage.media-services = mkIf cfg.addToHomepage [
      {
        Qbittorrent = {
-          icon = "${app}.png";
+          icon = "${app}.svg";
          href = "https://${app}.${config.mySystem.domain}";

          description = "Torrent Downloader";
--- a/nixos/modules/nixos/containers/sabnzbd/default.nix
+++ b/nixos/modules/nixos/containers/sabnzbd/default.nix
@ -47,7 +47,7 @@ in
    mySystem.services.homepage.media-services = mkIf cfg.addToHomepage [
      {
        Sabnzbd = {
-          icon = "${app}.png";
+          icon = "${app}.svg";
          href = "https://${app}.${config.mySystem.domain}";
          description = "Usenet Downloader";
          container = "${app}";
--- a/nixos/modules/nixos/containers/searxng/default.nix
+++ b/nixos/modules/nixos/containers/searxng/default.nix
@ -0,0 +1,59 @@
+{ lib
+, config
+, pkgs
+, ...
+}:
+with lib;
+let
+  app = "searxng";
+  image = "ghcr.io/benbusby/whoogle-search:0.8.4@sha256:93977c3aec8a039df94745a6e960d1b590a897e451b874c90ce484fbdbc3630f";
+  user = "568"; #string
+  group = "568"; #string
+  port = 5000; #int
+  cfg = config.mySystem.services.${app};
+  appFolder = "containers/${app}";
+  persistentFolder = "${config.mySystem.persistentFolder}/${appFolder}";
+in
+{
+  options.mySystem.services.${app} =
+    {
+      enable = mkEnableOption "${app}";
+      addToHomepage = mkEnableOption "Add ${app} to homepage" // { default = true; };
+    };
+
+  config = mkIf cfg.enable {
+
+    virtualisation.oci-containers.containers.${app} = {
+      image = "${image}";
+      user = "${user}:${group}";
+      ports = [ (builtins.toString port) ]; # expose port
+      labels = config.lib.mySystem.mkTraefikLabels {
+        name = app;
+        inherit port;
+      };
+    };
+
+    mySystem.services.homepage.home-services = mkIf cfg.addToHomepage [
+      {
+        Whoogle = {
+          icon = "whooglesearch.png";
+          href = "https://${app}.${config.mySystem.domain}";
+
+          description = "Google frontend";
+          container = "${app}";
+        };
+      }
+    ];
+
+    mySystem.services.gatus.monitors = [{
+
+      name = app;
+      group = "media";
+      url = "https://${app}.${config.mySystem.domain}";
+      interval = "1m";
+      conditions = [ "[CONNECTED] == true" "[STATUS] == 200" "[RESPONSE_TIME] < 50" ];
+    }];
+
+
+  };
+}
--- a/nixos/modules/nixos/containers/whoogle/default.nix
+++ b/nixos/modules/nixos/containers/whoogle/default.nix
@ -0,0 +1,59 @@
+{ lib
+, config
+, pkgs
+, ...
+}:
+with lib;
+let
+  app = "whoogle";
+  image = "ghcr.io/benbusby/whoogle-search:0.8.4@sha256:93977c3aec8a039df94745a6e960d1b590a897e451b874c90ce484fbdbc3630f";
+  user = "568"; #string
+  group = "568"; #string
+  port = 5000; #int
+  cfg = config.mySystem.services.${app};
+  appFolder = "containers/${app}";
+  persistentFolder = "${config.mySystem.persistentFolder}/${appFolder}";
+in
+{
+  options.mySystem.services.${app} =
+    {
+      enable = mkEnableOption "${app}";
+      addToHomepage = mkEnableOption "Add ${app} to homepage" // { default = true; };
+    };
+
+  config = mkIf cfg.enable {
+
+    virtualisation.oci-containers.containers.${app} = {
+      image = "${image}";
+      user = "${user}:${group}";
+      ports = [ (builtins.toString port) ]; # expose port
+      labels = config.lib.mySystem.mkTraefikLabels {
+        name = app;
+        inherit port;
+      };
+    };
+
+    mySystem.services.homepage.home-services = mkIf cfg.addToHomepage [
+      {
+        Whoogle = {
+          icon = "whooglesearch.png";
+          href = "https://${app}.${config.mySystem.domain}";
+
+          description = "Google frontend";
+          container = "${app}";
+        };
+      }
+    ];
+
+    mySystem.services.gatus.monitors = [{
+
+      name = app;
+      group = "media";
+      url = "https://${app}.${config.mySystem.domain}";
+      interval = "1m";
+      conditions = [ "[CONNECTED] == true" "[STATUS] == 200" "[RESPONSE_TIME] < 50" ];
+    }];
+
+
+  };
+}
--- a/nixos/modules/nixos/services/adguardhome/default.nix
+++ b/nixos/modules/nixos/services/adguardhome/default.nix
@ -7,9 +7,10 @@ with lib;
 let
  cfg = config.mySystem.services.adguardhome;
  app = "adguard-home";
-  yaml_schema_version=23;
+  yaml_schema_version = 24;
  port = 53;
  port_webui = 3000;
+  adguardUser = "adguardhome";
 in
 {
  options.mySystem.services.adguardhome = {
@ -26,9 +27,10 @@ in
    # Warn if backups are disable and machine isnt a dev box
    warnings = mkIf (yaml_schema_version != pkgs.adguardhome.schema_version) [ "WARNING: Adguard upstream YAML schema is version ${builtins.toString pkgs.adguardhome.schema_version}, this config is set to ${builtins.toString config.services.adguardhome.settings.schema_version}" ];

-    sops.secrets = {
-      "system/networking/bind/trux.dev".sopsFile = ./secrets.sops.yaml;
-      "system/networking/bind/trux.dev".restartUnits = [ "bind.service" ];
+    sops.secrets."services/adguardhome/password" = {
+      sopsFile = ./secrets.sops.yaml;
+      owner = adguardUser;
+      restartUnits = [ "adguardhome.service" ];
    };

    services.adguardhome = {
@ -40,13 +42,18 @@ in
        bind_port = port_webui;
        schema_version = yaml_schema_version; # Just to be cautious, defualt is pkgs.adguardhome.schema_version.

+        users = [{
+          name = "admin";
+          password = "ADGUARDPASS"; # placeholder
+        }];
+
        auth_attempts = 3;
        block_auth_min = 3600;

        dns = {
          # dns server bind deets
          bind_host = "127.0.0.1";
-            port = port;
+          inherit port;

          # bootstrap DNS - used for resolving upstream dns deets
          bootstrap_dns = [
@ -145,6 +152,25 @@ in
      };
    };

+    # add user, needed to access the secret
+    users.users.${adguardUser} = {
+      isSystemUser = true;
+      group = adguardUser;
+    };
+    users.groups.${adguardUser} = { };
+
+
+    # insert password before service starts
+    # password in sops is unencrypted, so we bcrypt it
+    # and insert it as per config requirements
+    systemd.services.adguardhome = {
+      preStart = lib.mkAfter ''
+        HASH=$(cat ${config.sops.secrets."services/adguardhome/password".path} | ${pkgs.apacheHttpd}/bin/htpasswd -niB "" | cut -c 2-)
+        ${pkgs.gnused}/bin/sed -i "s,ADGUARDPASS,$HASH," "$STATE_DIRECTORY/AdGuardHome.yaml"
+      '';
+      serviceConfig.User = adguardUser;
+    };
+
    networking.firewall = mkIf cfg.openFirewall {

      allowedTCPPorts = [ port port_webui ];
@ -190,8 +216,8 @@ in
            {
              type = "adguard";
              url = "http://${config.networking.hostName}.${config.mySystem.internalDomain}:${builtins.toString port_webui}";
-                # username = "";
-                # password = "";
+              username = "admin";
+              password = "{{HOMEPAGE_VAR_ADGUARDHOME_PASS}}";
            };
        };
      }
--- a/nixos/modules/nixos/services/adguardhome/secrets.sops.yaml
+++ b/nixos/modules/nixos/services/adguardhome/secrets.sops.yaml
@ -1,9 +1,7 @@
-system:
-    networking:
-        bind:
-            key: ENC[AES256_GCM,data:43QoyVqdwHO6eSgjbjgl28FSlD2xaoNxWpnc5D7g7jj6HaMwkz0tAnmg+g1fxEj1m826wxxqtgBjbMaDPj/hHtqYrgXsIvPShBSUDAyjoLcNFcsr0BhFVQ/ZWCCiI95SScbMTBJVcegf,iv:/R/7Qb+xPQXjYaQbF3NLeA63XAvdctayO5G8pE9bCE4=,tag:roNy7HNjWrIwZjy3BDAedw==,type:str]
-            trux.dev: ENC[AES256_GCM,data:vpbUHK8vWPlKvRdsKKI6oonri8HkwhxXMHuEpFYxtUPjX7/FduMkt08YYBAsjemiYfsV4NoKLmUlbP6nO3yiEY4HObkzM5DYOvMHE1YiFVg8YtAmW46fCAP7kSqz4my5GZ8CBA7/jJNy/Mc2sPsrE/N9IAmsl5nMJTOzaVm2b8QW/WZmHONGRkL3o8lqdhZpETmOJfII0lLd5VBiZRNeDOsldr4RZs4e8TyWRxGoO8/HaRdocGj0wvyKpnUmqwz6SbM1JXzT2zbZBsDNXr7chLdfTVptPwy2dgZzpZtZHi0ZZH7X656Ai4nkuyS/wPu4Zr8uXbvCAoR7K1FPc2fOxPJLrZeciWrauhTRg424NWz3esL0OEnol0LF0LWKQfC/eIlA7rN/MR0eAUvRuWWZtzwGlU+cUUXD+XJcKoos68Do9E1vXhO2OOcA1P0Hsp0+tmEi/7qMwyyikwPhQ6+NmyU9Il3hwkfbpVyA3WvfqeOnL/vAGs42BQFxgbPGmrNTzOVuvDblslodPngbvr3dwukSI5VBhpdPnKfTtJPKqgXGbiIJHhHYCeFXoY3GNx6qAshTqq2/xGiZuZ7mqqHO6aSJr+EQrZGrKiUE5EXn1GE88oK0QWXZyJQoQjygS+Xx1a22wcKv3ZDq/3ueUHR6heLrfGXPoZ7Rjiovb7HOZUNKVNk6laJcGzMMBKyLwoLLdyuWVBGqxjAdEC4umHVT/LBPQ2b+ubqAo2dIMBsqb2x19rLTWyUAEU1fy70C/Pco1P/Y8TkQ/Z9KtutRydIkDp2b0OL2CRBKJw48K7xjjfX5mVMrVTkOsV2RzYiTgf/kjaMFkck4mFZwWoJySnp1vc8WZ93VVy5LfjoTpIWugwy7qnpJ1jq57/o5V3LS90AW92lCa7x7djbIS3YIY0izNCJciLJoKJ6iPCulmP0zq41QV5Ms//uJD7g5667tqDtN7yyqEa02I72VHKiNRQeKpFDlivruQsdQAL3MyCf6in8wwFTac7mL4ZUYb5nsb9xv9vbZqNYl2OBNu28IZrI17vOI4AgaQ9pUV13u4vIJ6hBfSGOzoA1N7uurBS3XIqr3drs8Oc3pWgujP06ok6wRXLGxUuOtBRwM8RE+hmTxKsE4o1Q8fMbpfMfYZsL5i17gDcvuzoP65G/hZNFGNURUuh+kUzbay21igVp6SCMqDSCGdyX9C6l68SIc3K6vkvrJv2mSQnYm80ynhc+zGuGCEvfcbXcPut/OjwHc+6IEXqDbKERv3h+okQtdf3ELq0b0dZwZFO3n1PccbX3pPgQE+Mhv+36JcD0PGqOh5KbZo2vQybfElsP+ipRjvQHNLs7NRiL7JAveavbdczXY1lTdasXJtAHZaZk5LMR3wtF2+8mTTl8wI5Bzrad3iY+WsKBFu2ClyCdYY34X8W/69Nn6xx0LZ0E1gH6uaL5YCKlS/cizR2WOPa6b7litell84p5OkCtvltzQdCxloRWhCa89UASa2SX/wmobuHm9PFHVWHI3rKFoLBtUOrEdIK4f3JAxdaE2lQp6HF6rDoEj4QWF/XqrC2hDb6vneXCZwqvemtwWHTQItPo4/Lz5s2rIi/YSSPxfYTP1w+QNQX751ln7S7g+u7gyE1VH7T6UBsFI/jFnOykdqSOjPNjI6P4w1d1xaObXnlVAkDjNTZAwJqu/zdRA2p9eY93SOB1ppDLxrDufLUIdp2lh4N5R1MeJjq/pFSEWP8yw9av+z719cTKVLLkv0g4z8ynhwZhgd0j5xKEBY5NlSVrt12lP+Pu9qa+srPr1yUFKvkFyMZny3g5o8Cm3vX4LY+QfnVlmXWKzOUR+ZcT8t2mNLUdydGm9X1JGkSw8VkIMGrrZJLYZFl5TSppf1VOhMgY6FnVgY8Ofri+SjaQsUtEtBFfMcTniCHVqviVwQ1T29/PqV9aFagIrynHGdKsZU0FpeBjv42YKLk7gOTVdGfoFcQ7JfbpZnyLGZ/OlVUNO2vsTsrijMloRZQCnQVMgece+9IFDsbI8++HEbhnE6vHslkdfJe6qmMuDhluTSvFsSQK+GoM1ur7ZK8Q26OJzDoROHZg0xdPs8RY/lMv9CCDOcvAx916Ut50GicVgt2pLn2hN1qYVLxZVRhW06+YgjRzKJdBG6i6DCVJDBD9gyukdTUC1md5ifKdnXznDltS1wiHmyDpomaW7FD0shgEehAS8HF5QeqksFPoLyYe1DYjhulwZa9RWTzA8OQaXqfatiXR4fFiS+iWhCT7qwkk2qti6MUlImNV36ZPanjyuv/VP/u1zg8s1S9L+tXxAHoSestkJ0+Q8CoiGnPOyTbQEPNKstEbgjl5gUrmYP54l9gKnI++HKNkwKW1FAnpWjCi0G6VaNcxNfLheEZqBq+kzbzxcYEFG3Uwf8fwcZlp+EDQg40O7R0uDcsteSTtmc6ktrfSw6iFXcVTUW6YFJ6lsbzbjL4z1NFBZIvBCerVXLEY5UWMDS6BsLT4DvEynf4PwSWDnHrkJ5XgyDE5siutkTPgK4qWVy8DIASAUwu+lczKGY9ygKfaRyYVKripEcrpxs8Wq/5z1jgMU4HYH1asiV32sX/gAYK+2mduJY/aBiHWzmcIjsKHWtJPYLqeoPy7f0DmQrMs78L3uYYqyv8JBN27ilxAHYqxjETOZNE9uapnaJH2brKCPFQMYq5LnU2CfRZkvfuwVFejGgDhhRmgyIwpYTo7I9vLa7cxtSI54kRwJ96JPnxVbhI127v6CrrQlhQHJTpGkZtavIFNATctdPP9CWk19K2puzonVHeyfp9TajiaerKZPCPTDdoOFrMUJc9bX7wKIhCZl/xdg7FuzhRTcU8L2hPulmNEXMKRg3MfMgRAaIXvus9Rl0HGmggCg9TNt4SBSt3Wd/hxbNMf14B9Hvf5Jycb8pj5pekk/kw5G8ujU70QLiSBeyerMQodZNfHUxpdm8pi2x4DHjUW3nTWKWAheVO+qOpx7CiWJT751qcPpZz4/hEcT3srPhRA1Bb9br19drklKI4xbvD2S1ZohAN7D1rTKfkfVHNf+j0IHvNHQ8gyyQTIdsysUbv5/a4C1a5KSpFhefKQq+kxJJLmbj42FUJojMSRpOn5rTIKQtTzhiAMg1mfEdui+pZmM1s/H9q8Sbg71x/6/6wjou2/qq8xjxxVk0xJmnlMBxsQ745VQR+TIBIr5Hc0GHm05LnZBlKw0ej3gyUtAtTke6zmSXezU4yPQ6qo8XpTYNXxeFvJMRe0YEpTgEYXvAaaxuU154/nqqLlySNpnXf/s2WFdDCdf6Q5ZaPotzoaICanl1J4fxMNG4Kk5wZ31+9281A3rPJBENFxznj/UK7i4Odir9oCLfNeUyGVbr2VV6Iig3i+RBBwgyQ==,iv:MEA1aXQR/4LFrVOrJmWWwXkbT3FWR8Hp2c4kiw4yv7Y=,tag:FufABt/+oXZCXXw55hvuwA==,type:str]
-            natallan.com: ENC[AES256_GCM,data:nsivV8P1dSHSN/ty7tvBciKz/9xslQFohHh8fYkgoMy2dRoywaxT4+S3/tl499KP1mepw6E0z8SC3vnj5XzT4kFPEcSoUk6OpZTaqNWlwIU7PsaPys41uK9wszkj4W0J1BdbExC9hn4IkwXJ7iRlMqwSlTc2VlNiu+nhiuixvSdsYWqzGpXFzWzd0oPphq/PmJCM2ZQMbVKTnFSer9oeQBRxJ6lj4XYxO6HxT2XNPkXBnx8dr7vgLSANN8GwdnYHbIZ9XWDhaVw+VY21pXyF0I9tnbuZ5oherqTO9cbZ6NGpYeschs3ep9tpoC7QLnJwbOncfCcCvbKxjbdfRzJ+8Mjv16jAmDyFjQII9tvW7NtJtV1zWM59l62u2d7NAHuaEYE2Gr+UES4+DDKw5n6SoYAgHw6k9jMmrtSUKI8TRaBDBTrbuvnhbZOaYF0kLV2De5HWs2wvR7W58tWkmKejI2xYinpkXjtdF8zESdPjgDImnDobQX03GF7HY7tdbZ0ZtdWMI7fud66Db8TumXN3bbQAx9nOFTaNba49jKjVybwVMeOVKrYbbh3X9SpM+REh6fDN0a4iEgrP4I8YF+PqeAxVFlmHWe8JAICLR3JhU75mVYve3u27XGxX3DhGzvIM/JiifcpOg3Lg1rn1RhWt3Zq+H9ygo4N9Sigk/pT7pBhlm548uibYi7/TFe1I5CXkGGQ+I47CKUJzK934EqN9zZ80qDdQS0AN7cI8hXCXgc7+nVBNc/5cu3y9ubKF7xWyhL3RgwdSbCnthG2EQ7GEMZnhDRdazYtdmZhoJw6MyL/AFVZgbHfAyg==,iv:TLCkT60LTZ2m3gYCz4YQ/XYhvbdZJApoW3OekEVjULI=,tag:ZlxHEZQa/pUwjQF3HdqYdw==,type:str]
+services:
+    adguardhome:
+        password: ENC[AES256_GCM,data:B8Tzow8IEAY=,iv:6ehyutNPuVndybuegNNjd++Zjgms7T2/tzdaCeUUW+0=,tag:ovktD+jFUcVU3++Lr6brZA==,type:str]
+        env: ENC[AES256_GCM,data:Pi2NGVtup1ziNLIZnFepJoZJuowq76QOxdN9auWcuJKKH/JXVXg=,iv:HSo+XJSlUw2XlYUyzKCKo2k5LZB2GmaciYDNiKyGynI=,tag:QFtlphbEu7cmsTMd39FzPQ==,type:str]
 sops:
    kms: []
    gcp_kms: []
@ -13,59 +11,59 @@ sops:
        - recipient: age1lj5vmr02qkudvv2xedfj5tq8x93gllgpr6tzylwdlt7lud4tfv5qfqsd5u
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6cW5zMXc2Skc0S0lvWXF2
-            NE0za1kyOU5GY0Z0QW9hTDVuTWRPd2pTcTBjClhOT0xrYUo4Y2Rtd0dyQU9MeWtq
-            dHZMWGZhbWtTOUVPMDlhWUdhVEhIZVEKLS0tIG12Ujh6WEVNeUdvVmtuYmZJdVJG
-            bWZxWXU5TzlYNDZnY1Fua3RGUEJnNUkKMC/png4A565h/S3B2ZVce7LJi1SMDS5n
-            aYx/nrPTktIe8bCvwF300tNZoZolXONR4awJ9e88uw84t8GYjlNNPw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvZzdsam82ZUpibS9pRm81
+            L0Z2QkJjcEo5ZHd0RVRuUHdTT2pyaHJ4aTNnCnNvSEhLekJqSmdrT3B3T29NZTJC
+            K3J2bFcxYUFmN2hYeUwzTERvWmllNDQKLS0tIER0NStqSXpJRUtHOGZ5Q0xlUmZ4
+            ZE9oWTZ0Q2doYU5KdVJrbkdkZThBYW8K9XgNQz7VOEsC9Y2tfKMgEt4qpYJ9ZwRf
+            plu7eSHnYIiBoP8Sav/HOD5BR49k8zlo+1spWOw874NiTFpY/WWUFw==
            -----END AGE ENCRYPTED FILE-----
        - recipient: age17edew3aahg3t5nte5g0a505sn96vnj8g8gqse8q06ccrrn2n3uysyshu2c
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGVmkxam5MVW1FSEo4QjB4
-            c0VKUDJIVDI1WkFOYmJ2TEcrWGlqQVFGQm1RClBxSjRjSGd3SkRIbUc4OUdhT0F2
-            WVJoUlR0amdOcTE4YUMwR1JjTGlBRUkKLS0tIHZFKy9XWnVoQUJLTzZGclp6Y0tQ
-            cUVoQk9JMEpRNUNQbjcxbnFiUDNmbFUKIBJcq8uJCIhdMv5e79K66Qrxlg88K/Gb
-            MT1h2v6h5uiYm6JaspSqz9Hqx9YfRocl/kJmVy/QdeIGPVzm24dnIQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuVmx1UGdpckZNelh0NGVJ
+            bXk3QjZvOW9sSWNIN0k3akNRQ3hYb1JVUWdjCmQ3ZGYxR2w5dzFRaWJoODlSb2Ru
+            cGYxR1paZ1Y2UDZ3aWdLSGMyWnlJdzgKLS0tIDJUdmlERzA5M29neXl1UldsWVJN
+            azd4aVlza0ZTUktXR0plLyttdEp0V0EKc69XRDnGe+6r1Tig9C0E8dM1MO2PYrsj
+            Onn2HvnCYdlkoLQvip20SgMg8F4WArRlyAfSIwogX3IeyJ24YBU5hg==
            -----END AGE ENCRYPTED FILE-----
        - recipient: age1u4tht685sqg6dkmjyer96r93pl425u6353md6fphpd84jh3jwcusvm7mgk
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1Sy85ZVA3WGVhVWlSZmhy
-            VDBDK2dZYmR6djlQYkhhQ25zeWdxM1JpMEg0Ck5hZm12ZmtkQmJLUmdMNm94WnZL
-            NnY1eG1neEpLSEVkRGhkY2FHUFhTWVkKLS0tIGVpNlZrRGtqRFR1OVc3enpRUVQ2
-            N2swa1BIellpbjBUbmsyc2NnYmphOU0Kx/4I/zjyi3GlYMgcNIb7sYufLfvJ9Xny
-            HeR7r03YuHu5dOQ1T8iFigXUhy/2DkdW8kWtKlpuT0qg35dKqjCi/w==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArdDFCYWFkZmFIMXYwWFcy
+            TU5hRkJwUXMrK0VyQzdoZlB5ZFNuVHRWRW5JCnBkUGEvd2lRdWFHd2dVeFk0WUFv
+            UHFiTDdYdFJSZmZrUG9xajUrWWRSMTgKLS0tIEgyd2tSN2Z3VGhVdzgyZTFYT1Zp
+            eXQ0bTNDQXBRT2Y3aTdLWng0ZlZRVFUK6fcztm9ITbHjc4H0nN6nvTyx1oBeOgHg
+            IGXZBNgD82wz0fne0teriUAz+cgvdFBKhhTaoZO4u9pMnschAfziWw==
            -----END AGE ENCRYPTED FILE-----
        - recipient: age1cp6vegrmqfkuj8nmt2u3z0sur7n0f7e9x9zmdv4zygp8j2pnucpsdkgagc
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyVjBXb2EzM3U0MDRnRGV6
-            YWJieTFHaXFFOEhFdjJNU2x3VVlSOEpBNFFjCkpNZWpxa3ZRRFVabXd5enFqenZY
-            aXpqOC90YXB2aTR5K1FFQ2dnNXVCZlUKLS0tIGkvTmpLeFNGdWpaRU9CaGtLcWgr
-            d09aV285U3YrNjY2VVpFaGtFS1B3bUUKRL1dsEHuWbEjRaKqd2F6xrhC7htNo0hw
-            fItd7J3gccRP5jUTzJ0QZBJvsj9wCAQU1iJfv14zcO6TzOB5B4jW7w==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtTzRZMTd6bmppKzk4cG1Q
+            dStuSDNrMExFUUlpRkJLNWRTU2lZNEJmYmlvCjVhTzFiejJMTWlZbGIveGd2cnpy
+            clRzZHlwcWFJaVIzc2k1bUJBc2tTMEUKLS0tIGdPMGxhQ3lvankrTFEwS2ZWdXRy
+            dlg0bHRMaXN0aDc1S3ByNm1oQW5Sbk0Kz+FJWtBnjY9IdvajBUS72n0p6NEZ/jEZ
+            3N96r8Ufz8cReN5fK+atGkPVmsdz+Z9UeYhdPDgYPdnhsjTj6+JYDg==
            -----END AGE ENCRYPTED FILE-----
        - recipient: age1j2r8mypw44uvqhfs53424h6fu2rkr5m7asl7rl3zn3xzva9m3dcqpa97gw
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2WE5LVEFIdVFXT3I1Znk1
-            NmJzWWZHQ05GclNuMFUvZE9PazdFYmZVWmlNClpHVVB1bFhUU3phUjlhQTBDTENq
-            QkNFMTc3VTU1SkxtK0x3SnFzYm90aTgKLS0tIHJHc3NXekM4Ly9SSEFydFZrTk9l
-            MVUxcEpUemlmWmRvQThUdTdkQ2svNHcK0WyOuWbv+eyYWLFsKBl+K+/n9QCfehqQ
-            0hC0SY2Nf+9YHMDXrSse44NPs/ucOPlYRFV/HbPNvfEF62K7Gt79lA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYT0V6Mm5MRVpyMGdtcmFj
+            VjdPdkREU0h2NDJ5VXBvcDV5V3libmJ6Z2dJCmJsRlpneUV1M21WaGsreDdOMmI2
+            dEVsSXpoNm5SL3BIWi9MckhVZ2E1ckUKLS0tIG1jRFFtQmFXU0VLak1rNTBTQWNG
+            UGNreUc3YUFwbjA0K0pFaDFYK25mWHMKP5t/WUbTg4VhdPc/FOmQtxdTRyIfYdOQ
+            2aZfUTy0sL0I57ROJCNF/du/XUjZfFxNusiZ4SaIRfcyfzBe5eybnQ==
            -----END AGE ENCRYPTED FILE-----
        - recipient: age1jpeh4s553taxkyxhzlshzqjfrtvmmp5lw0hmpgn3mdnmgzku332qe082dl
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3SHFQQUIzQXlqZFFnTWNt
-            YVJIb0MzTFM2NENpNFFiaHFmaU95K3VLNGdZCkFyMEFHZjhZclJMTE4yRWNJQnJR
-            T25yTWZQOFE5L011M3FnMUxPb3hPbVEKLS0tIElzYlpHUEQwejlDNTFmK3R1dU0r
-            RzJ5UGIvUUluZXNzRzlXRWl5aGdmaUUKObqo2Wj62ZcK0qMcsttRHphWTgkPOTz4
-            NkvAvOaSX2wJHRhH9SHGhkPwEhsgdmaagsVpwpLPrOCRlWI/bd1Qhg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpM3lmdnBhb1NTbFpDajlq
+            QkxqbVJjZW1yajAwNUovUHBSNDBMYUxaUEdvClBQeEZZcmU2Y0Q4MnRYVkxucDh5
+            ZVYyOFh0cEpwVWszZjAvNFdLR0s1N3cKLS0tIEllM012ZDUyWU5RNHB3NG1kSGlj
+            Tzh3YVpNUmRDenVYU2lHVHR2dmV4SkUK5DXnp3tpXNVyyhuS0YX02JbrFDcAJdDy
+            VOCBDMPqeSRU9ok+6xC2RUXAdXCW7N72gm22GKVdH3e6Fjp32d6P/w==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-04-16T06:30:13Z"
-    mac: ENC[AES256_GCM,data:PsD5hu5nyjPY9/bgLTiTReqoT+hwlJx8A5pOkCTcPNQs63So4GM5mDDTuWG8u1WlBOEdKEDqVefVMtCiwOsC6xIVM8AHCGOcad2j4qQbHR+2lc8nMZE8R7ceJc2ZeLBPlD5/BQ2R5XiQ+NXu0qypHjYkVwnkI62nPSXALSd9btg=,iv:cy7slD5dcfTEeObWraswcghwhgAe1RylU4aafXezEYU=,tag:/nSCQJDYfrWpfpfdkigV7w==,type:str]
+    lastmodified: "2024-04-17T12:00:13Z"
+    mac: ENC[AES256_GCM,data:93mY9BXAlztekg8BZgvtz6wTS9msDfoxjFVqudZILN0nUSJLBmLH/MlT0dr1NCZaAgHuRERU2pTDEqVn8KhZaiK5h0RTQmQ0UgVH4MGqi3ItmKccO8nAxtcgX4/VNyMj7yACho+p3Bw/MBHX+l7fjXxJV0erOvWG1bqV7xXEUFI=,iv:70EEdkLFu2VobB4EiJGtE4xNV0x9+PYw2eAJOEaYAL0=,tag:RAa418cx46lyAmx+77/cDA==,type:str]
    pgp: []
    unencrypted_suffix: _unencrypted
    version: 3.8.1
				`@ -0,0 +1 @@`
				`nixos/modules/nixos/services/adguardhome/default.nix:hashicorp-tf-password:47`