Merge pull request 'Dev' (#2) from dev into master

Reviewed-on: #2

modules/core/packages/dev.nix

@@ -5,7 +5,6 @@
     neovim
     git
     tree-sitter
-    yamlfmt
     gcc
 
     # lua

modules/core/zsh/.zshrc

@@ -17,7 +17,7 @@ alias gs='git status'
 
 alias hermes='docker exec -it -u hermes hermes-agent /data/current-package/bin/hermes'
 
-alias hermes-age='cd /etc/rice-flakes/modules/hermes/secrets && sudo EDITOR=nvim agenix -e hermes-env.age -i /etc/ssh/ssh_host_ed25519_key'
+alias hermes-age='cd /etc/rice-flakes/modules/hermes/secrets && sudo EDITOR=nvim agenix -e ./hermes-env.age -i /etc/ssh/ssh_host_ed25519_key'
 
 ga() {
   if [[ -z "$1" ]]; then

modules/hermes/hermes.nix

@@ -44,8 +44,8 @@
       };
 
       delegation = {
-        model = "us.anthropic.claude-sonnet-5";
+        model = "openai/gpt-5.6-luna";
-        provider = "bedrock";
+        provider = "nous";
       };
 
       discord = {

modules/k3s/k3s.nix

@@ -1,25 +1,22 @@
 {
-  networking.firewall.allowedTCPPorts = [
+  networking.firewall.allowedTCPPorts = [ 6443 80 443 33073 ];
-    6443
-    80
-    443
-    8969
-    33073
-  ];
   networking.firewall.allowedUDPPorts = [ 3479 ];
 
   services.k3s = {
     enable = true;
     role = "server";
     extraFlags = "--write-kubeconfig-mode 644";
+    manifests = {
+      traefik-namespace    = { source = ./traefik/namespace.yaml; };
+      traefik-rbac         = { source = ./traefik/rbac.yaml; };
+      traefik-pvc          = { source = ./traefik/pvc.yaml; };
+      traefik-deployment   = { source = ./traefik/deployment.yaml; };
+      traefik-service      = { source = ./traefik/service.yaml; };
+      netbird-namespace    = { source = ./netbird/namespace.yaml; };
+      netbird-config       = { source = ./netbird/config.yaml; };
+      netbird-server       = { source = ./netbird/server.yaml; };
+      netbird-dashboard    = { source = ./netbird/dashboard.yaml; };
+      netbird-ingress      = { source = ./netbird/ingress.yaml; };
     };
-
-  fileSystems."/var/lib/rancher/k3s/server/manifests/apps" = {
-    device = "/home/poslop/k3s/apps";
-    fsType = "none";
-    options = [
-      "bind"
-      "ro"
-    ];
   };
 }

modules/k3s/netbird/config.yaml

@@ -0,0 +1,45 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: netbird-server-config
+  namespace: netbird
+data:
+  config.yaml: |
+    server:
+      listenAddress: ":80"
+      exposedAddress: "https://netbird.archfox.org:443"
+      metricsPort: 9090
+      healthcheckAddress: ":9000"
+      logLevel: "info"
+      logFile: "console"
+      stunPorts:
+        - 3479
+      tls:
+        certFile: ""
+        keyFile: ""
+        letsencrypt:
+          enabled: false
+          dataDir: ""
+          domains: []
+          email: ""
+          awsRoute53: false
+      authSecret: "182c13eec94ba6ef89ce8f3e33b4694b051fe4b0bf6d2c9188f738d1c000b6d7"
+      dataDir: "/var/lib/netbird/"
+      disableAnonymousMetrics: false
+      disableGeoliteUpdate: false
+      auth:
+        issuer: "https://netbird.archfox.org/oauth2"
+        localAuthDisabled: false
+        signKeyRefreshEnabled: true
+        dashboardRedirectURIs:
+          - "https://netbird.archfox.org/nb-auth"
+          - "https://netbird.archfox.org/nb-silent-auth"
+        cliRedirectURIs:
+          - "http://localhost:53000/"
+      store:
+        engine: "sqlite"
+        dsn: ""
+        encryptionKey: ""
+      reverseProxy:
+        trustedHTTPProxies:
+          - "10.0.1.45/32"

modules/k3s/netbird/dashboard.yaml

@@ -0,0 +1,56 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dashboard
+  namespace: netbird
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: dashboard
+  template:
+    metadata:
+      labels:
+        app: dashboard
+    spec:
+      containers:
+        - name: dashboard
+          image: netbirdio/dashboard:latest
+          ports:
+            - containerPort: 80
+          env:
+            - name: NETBIRD_MGMT_API_ENDPOINT
+              value: "https://netbird.archfox.org"
+            - name: NETBIRD_MGMT_GRPC_API_ENDPOINT
+              value: "https://netbird.archfox.org"
+            - name: AUTH_AUDIENCE
+              value: "netbird-dashboard"
+            - name: AUTH_CLIENT_ID
+              value: "netbird-dashboard"
+            - name: AUTH_CLIENT_SECRET
+              value: ""
+            - name: AUTH_AUTHORITY
+              value: "https://netbird.archfox.org/oauth2"
+            - name: USE_AUTH0
+              value: "false"
+            - name: AUTH_SUPPORTED_SCOPES
+              value: "openid profile email groups"
+            - name: AUTH_REDIRECT_URI
+              value: "/nb-auth"
+            - name: AUTH_SILENT_REDIRECT_URI
+              value: "/nb-silent-auth"
+            - name: LETSENCRYPT_DOMAIN
+              value: "none"
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: dashboard
+  namespace: netbird
+spec:
+  selector:
+    app: dashboard
+  ports:
+    - name: http
+      port: 80
+      targetPort: 80

modules/k3s/netbird/ingress.yaml

@@ -0,0 +1,26 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: netbird
+  namespace: netbird
+spec:
+  entryPoints:
+    - web
+  routes:
+    - match: Host(`netbird.archfox.org`) && (PathPrefix(`/management.ManagementService/`) || PathPrefix(`/signalexchange.SignalExchange/`) || PathPrefix(`/management.ProxyService/`))
+      kind: Rule
+      services:
+        - name: netbird-server
+          port: 80
+          scheme: h2c
+    - match: Host(`netbird.archfox.org`) && (PathPrefix(`/relay`) || PathPrefix(`/ws-proxy/`) || PathPrefix(`/api`) || PathPrefix(`/oauth2`))
+      kind: Rule
+      services:
+        - name: netbird-server
+          port: 80
+    - match: Host(`netbird.archfox.org`)
+      kind: Rule
+      priority: 1
+      services:
+        - name: dashboard
+          port: 80

modules/k3s/netbird/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: netbird

modules/k3s/netbird/server.yaml

@@ -0,0 +1,74 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: netbird-server
+  namespace: netbird
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: netbird-server
+  template:
+    metadata:
+      labels:
+        app: netbird-server
+    spec:
+      containers:
+        - name: netbird-server
+          image: netbirdio/netbird-server:latest
+          args: ["--config", "/etc/netbird/config.yaml"]
+          ports:
+            - containerPort: 80
+            - containerPort: 3479
+              protocol: UDP
+            - containerPort: 33073
+          env:
+            - name: NETBIRD_STORE_ENCRYPTION_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: netbird-encryption
+                  key: encryptionKey
+          volumeMounts:
+            - name: config
+              mountPath: /etc/netbird
+            - name: data
+              mountPath: /var/lib/netbird
+      volumes:
+        - name: config
+          configMap:
+            name: netbird-server-config
+        - name: data
+          persistentVolumeClaim:
+            claimName: netbird-data
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: netbird-data
+  namespace: netbird
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 2Gi
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: netbird-server
+  namespace: netbird
+spec:
+  selector:
+    app: netbird-server
+  ports:
+    - name: http
+      port: 80
+      targetPort: 80
+    - name: grpc-compat
+      port: 33073
+      targetPort: 33073
+    - name: stun
+      port: 3479
+      targetPort: 3479
+      protocol: UDP

modules/k3s/traefik/deployment.yaml

@@ -0,0 +1,35 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: traefik
+  namespace: traefik
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: traefik
+  template:
+    metadata:
+      labels:
+        app: traefik
+    spec:
+      serviceAccountName: traefik
+      containers:
+        - name: traefik
+          image: traefik:v3.4
+          args:
+            - --log.level=INFO
+            - --api.dashboard=true
+            - --entrypoints.web.address=:80
+            - --providers.kubernetescrd=true
+            - --providers.kubernetesingress=true
+          ports:
+            - name: web
+              containerPort: 80
+          volumeMounts:
+            - name: acme-storage
+              mountPath: /data
+      volumes:
+        - name: acme-storage
+          persistentVolumeClaim:
+            claimName: traefik-acme

modules/k3s/traefik/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: traefik

modules/k3s/traefik/pvc.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: traefik-acme
+  namespace: traefik
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 128Mi

modules/k3s/traefik/rbac.yaml

@@ -0,0 +1,41 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: traefik
+  namespace: traefik
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: traefik
+rules:
+  - apiGroups: [""]
+    resources: ["services", "endpoints", "secrets", "configmaps", "nodes", "namespaces", "pods"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["discovery.k8s.io"]
+    resources: ["endpointslices"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["extensions", "networking.k8s.io"]
+    resources: ["ingresses", "ingressclasses"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["extensions", "networking.k8s.io"]
+    resources: ["ingresses/status"]
+    verbs: ["update"]
+  - apiGroups: ["traefik.io"]
+    resources: ["ingressroutes", "ingressroutetcps", "ingressrouteudps", "middlewares",
+                "middlewaretcps", "tlsoptions", "tlsstores", "traefikservices",
+                "serverstransports", "serverstransporttcps"]
+    verbs: ["get", "list", "watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: traefik
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: traefik
+subjects:
+  - kind: ServiceAccount
+    name: traefik
+    namespace: traefik

modules/k3s/traefik/service.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: traefik
+  namespace: traefik
+spec:
+  type: LoadBalancer
+  selector:
+    app: traefik
+  ports:
+    - name: web
+      port: 80
+      targetPort: 80
+    - name: websecure
+      port: 443
+      targetPort: 443