Added pingvin and vaultwarden

modules/home/containers/caddy.nix

@@ -66,6 +66,23 @@ in {
         handle @uptime-kuma {
           reverse_proxy uptime-kuma:3001
         }
+
+        @pingvin-share host share.tbmrs.nl
+        handle @pingvin-share {
+          reverse_proxy pingvin-share:3000
+        }
+      }
+
+      *.local.tbmrs.nl {
+        tls {
+          dns transip xeovalyte /etc/caddy/acme_key
+          resolvers 1.1.1.1
+        }
+
+        @vaultwarden
+        handle @vaultwarden {
+          reverse_proxy vaultwarden:80
+        }
       }
     '';
   };

modules/home/containers/homepage.nix

@@ -81,6 +81,15 @@ in {
               container = "immich-server";
             };    
           }
+          {
+            "Pingvin" = {
+              href = "https://share.tbmrs.nl";
+              description = "File sharing";
+              icon = "pingvin-share";
+              server = "podman";
+              container = "pingvin-share";
+            };    
+          }
         ];
       }
     ];

modules/home/containers/pingvin-share.nix

@@ -0,0 +1,69 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.settings.containers.pingvin-share;
+in {
+  options = {
+    settings.containers.pingvin-share.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = ''
+        Enable Pingvin share container
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    settings.services.sops.enable = true;
+  
+    services.podman.containers.pingvin-share = {
+      image = "ghcr.io/stonith404/pingvin-share";
+      network = "proxy";
+      volumes = [
+        "%h/containers/pingvin-share/data:/opt/app/backend/data" 
+        # "%h/containers/pingvin-share/config.yaml:/opt/app/config.yaml" 
+        "${config.sops.templates."container-pingvin.yaml".path}:/opt/app/config.yaml" 
+      ];
+      environment = {
+        TRUST_PROXY = true;
+      };
+      userNS = "keep-id";
+      extraConfig = {
+        Unit = {
+          After = [
+            "sops-nix.service"
+          ];
+        };
+      };
+    };
+
+    sops.templates = {
+      "container-pingvin.yaml" = {
+        content = /*yaml*/ ''
+          general:
+            secureCookies: "true"
+            appUrl: https://share.tbmrs.nl
+            showHomePage: "false"
+          share:
+            allowRegistration: "true"
+            maxSize: "10000000000"
+          oauth:
+            disablePassword: "false"
+            oidc-enabled: "true"
+            oidc-discoveryUri: "https://auth.tbmrs.nl/oauth2/openid/pingvin/.well-known/openid-configuration"
+            oidc-clientId: pingvin
+            oidc-clientSecret: "${config.sops.placeholder."containers/pingvin-share/oidc-secret"}"
+          initUser:
+            enabled: "true"
+            username: "admin"
+            email: "admin@example.com"
+            password: "my-secure-password"
+            isAdmin: true
+            ldapDN: ""
+        '';
+      };
+    };
+  };
+}

modules/home/containers/vaultwarden.nix

@@ -0,0 +1,30 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.settings.containers.vaultwarden;
+in {
+  options = {
+    settings.containers.vaultwarden.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = ''
+        Enable Vaultwarden container
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    services.podman.containers.vaultwarden = {
+      image = "ghcr.io/dani-garcia/vaultwarden:latest";
+      network = "proxy";
+      volumes = [
+        "%h/containers/vaultwarden/data:/data" 
+      ];
+      environment = {
+        DOMAIN = "https://vault.local.tbmrs.nl";
+      };
+    };
+  };
+}

modules/home/default.nix

@@ -16,6 +16,7 @@
 
     ./services/nextcloud.nix
     ./services/podman.nix
+    ./services/sops.nix
 
     ./theming/fonts.nix
     ./theming/stylix.nix
@@ -31,5 +32,7 @@
     ./containers/immich.nix
     ./containers/homepage.nix
     ./containers/uptime-kuma.nix
+    ./containers/pingvin-share.nix
+    ./containers/vaultwarden.nix
   ];
 }

modules/home/services/sops.nix

@@ -0,0 +1,38 @@
+{ lib, config, inputs, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.settings.services.sops;
+in {
+  options = {
+    settings.services.sops.enable = lib.mkOption {
+      type = lib.types.bool;
+      description = ''
+        Enable sops secret management
+      '';
+      default = false;
+    };
+  };
+
+  imports = [
+    inputs.sops-nix.homeManagerModules.sops
+  ];
+
+  config = mkIf cfg.enable {
+    home.packages = with pkgs; [
+      sops
+      age
+    ];
+
+    sops = {
+      age.keyFile = "/home/${config.home.username}/.config/sops/age/keys.txt"; # must have no password!
+
+      defaultSopsFile = ../../../secrets/secrets.yaml;
+
+      secrets = {
+        "containers/pingvin-share/oidc-secret" = { };
+      };
+    };
+  };
+}