feat: move off of cloudflared for public internet access to acme and httpd

infra/cloudflare/main.tf

@@ -1,7 +1,7 @@
 terraform {
   backend "pg" {
     schema_name = "yumeami_cloudflare"
-    conn_str    = "postgres://shiori:5600/terraform?sslmode=disable"
+    conn_str    = "postgres://tsuki:5600/terraform?sslmode=disable"
   }
 
   required_providers {
@@ -25,15 +25,6 @@ resource "cloudflare_zone" "main" {
   }
 }
 
-resource "cloudflare_dns_record" "wildcard_tunnel" {
-  zone_id = cloudflare_zone.main.id
-  name    = "*"
-  type    = "CNAME"
-  content = "${cloudflare_zero_trust_tunnel_cloudflared.yumeami.id}.cfargotunnel.com"
-  proxied = true
-  ttl     = 1
-}
-
 resource "cloudflare_dns_record" "root_github" {
   zone_id = cloudflare_zone.main.id
   name    = "cpatino.com"
@@ -52,11 +43,6 @@ resource "cloudflare_dns_record" "www_github" {
   ttl     = 1
 }
 
-resource "cloudflare_zero_trust_tunnel_cloudflared" "yumeami" {
-  account_id = var.cloudflare_account_id
-  name       = "yumeami"
-}
-
 resource "cloudflare_zero_trust_access_policy" "account_ingress" {
   account_id = var.cloudflare_account_id
   name       = "account ingress"

modules/nixos/services/networking/acme/default.nix

@@ -0,0 +1,44 @@
+{
+  config,
+  lib,
+  namespace,
+  ...
+}: let
+  inherit (lib) mkIf;
+  inherit (lib.${namespace}) getAttrByNamespace;
+  inherit (config.networking) hostName;
+
+  cfg = getAttrByNamespace config "${namespace}.services.networking";
+in {
+  config = mkIf (builtins.elem hostName cfg.gateways) {
+    security.acme = {
+      acceptTerms = true;
+      defaults = {
+        email = "c4patino@gmail.com";
+
+        dnsProvider = "cloudflare";
+        credentialFiles = let
+          inherit (config.sops) secrets;
+        in {
+          CF_DNS_API_TOKEN_FILE = secrets."cloudflare/acme-token".path;
+          CF_ZONE_API_TOKEN_FILE = secrets."cloudflare/acme-token".path;
+        };
+      };
+      certs = {
+        "wildcard_cpatino_com" = {
+          domain = "*.cpatino.com";
+        };
+      };
+    };
+
+    users.users.wwwrun.extraGroups = ["acme"];
+
+    sops.secrets = {
+      "cloudflare/acme-token" = {};
+    };
+
+    ${namespace}.services.storage.impermanence.folders = [
+      "/var/lib/acme"
+    ];
+  };
+}

modules/nixos/services/networking/httpd/default.nix

@@ -6,7 +6,7 @@
   ...
 }: let
   inherit (lib) mkIf mkEnableOption mapAttrsToList listToAttrs replaceStrings mkMerge concatStringsSep filterAttrs;
-  inherit (lib.${namespace}) getAttrByNamespace mkOptionsWithNamespace readJsonOrEmpty getIn resolveHostIP flattenHostServices;
+  inherit (lib.${namespace}) getAttrByNamespace mkOptionsWithNamespace resolveHostIP flattenHostServices;
   inherit (config.networking) hostName;
 
   base = "${namespace}.services.networking.httpd";
@@ -17,8 +17,6 @@
   networkServices = networkingCfg.network-services;
   networkServicesFlat = flattenHostServices networkServices;
 
-  crypt = "${inputs.self}/secrets/crypt";
-
   mkLocalhostConfig = name: service: let
     p = toString service.port;
   in ''
@@ -31,6 +29,7 @@
   mkVirtualHost = {
     domain,
     useSSL,
+    enableAcme ? false,
     injectHoneypot ? false,
   }: host: name: service: let
     inherit (config.sops) secrets;
@@ -40,11 +39,20 @@
     certs = replaceStrings ["*" "."] ["wildcard" "_"] domain;
     sslConfig =
       if useSSL
-      then {
+      then
-        forceSSL = true;
+        {
-        sslServerCert = secrets."ssl/${certs}/cert".path;
+          forceSSL = true;
-        sslServerKey = secrets."ssl/${certs}/key".path;
+        }
-      }
+        // (
+          if enableAcme
+          then {
+            useACMEHost = certs;
+          }
+          else {
+            sslServerCert = secrets."ssl/${certs}/cert".path;
+            sslServerKey = secrets."ssl/${certs}/key".path;
+          }
+        )
       else {};
 
     miasma = networkServicesFlat.miasma;
@@ -126,7 +134,6 @@ in {
       virtualHosts = mkMerge [
         {
           "_default_" = {
-            acmeRoot = null;
             documentRoot = "/var/empty";
 
             servedDirs = [
@@ -144,32 +151,6 @@ in {
           };
         }
 
-        {
-          "_default_" = let
-            inherit (config.sops) secrets;
-          in {
-            acmeRoot = null;
-            documentRoot = "/var/empty";
-
-            servedDirs = [
-              {
-                dir = "/var/www/error";
-                urlPath = "/";
-              }
-            ];
-
-            extraConfig = ''
-              RewriteEngine On
-              RewriteCond %{REQUEST_URI} !^/(400|401|403|404|500)\.html$
-              RewriteRule ^ - [L,R=404]
-            '';
-
-            forceSSL = true;
-            sslServerCert = secrets."ssl/wildcard_cpatino_com/cert".path;
-            sslServerKey = secrets."ssl/wildcard_cpatino_com/key".path;
-          };
-        }
-
         {
           "localhost" = let
             localhostProxyConfig =
@@ -218,6 +199,7 @@ in {
             (mkVirtualHost {
               domain = "*.cpatino.com";
               useSSL = true;
+              enableAcme = true;
               injectHoneypot = true;
             })
             svc.host
@@ -228,19 +210,6 @@ in {
       ];
     };
 
-    security.acme = {
-      acceptTerms = true;
-      defaults.email = "c4patino@gmail.com";
-      defaults = {
-        dnsProvider = "cloudflare";
-        dnsProviderConfig = let
-          secrets = readJsonOrEmpty "${crypt}/secrets.json";
-        in {
-          CF_Token = getIn secrets "cloudflare";
-        };
-      };
-    };
-
     networking.firewall.allowedTCPPorts = [80 443];
 
     systemd.tmpfiles.rules = [
@@ -251,19 +220,6 @@ in {
       inherit (config.networking) hostName;
       inherit (config.users.users) wwwrun;
 
-      global =
-        [
-          "ssl/wildcard_cpatino_com/cert"
-          "ssl/wildcard_cpatino_com/key"
-        ]
-        |> map (name: {
-          inherit name;
-          value = {
-            owner = wwwrun.name;
-            group = wwwrun.group;
-          };
-        });
-
       hostSpecific =
         [
           "ssl/wildcard_yumeami_sh/cert"
@@ -278,6 +234,6 @@ in {
           };
         });
     in
-      listToAttrs (global ++ hostSpecific);
+      listToAttrs hostSpecific;
   };
 }

secrets/sops/secrets.yaml

@@ -4,6 +4,7 @@ cachix:
 cloudflare:
     token: ENC[AES256_GCM,data:6vBKpp4Y8pzRJTcaKE8foyPHc3JCP5cli/hSF0ozY2oKXo84SGyB8w==,iv:iKXWtg5cSBb8YJJUtln/c+KaHy5rDQP//mYxytv0kjU=,tag:v/Kl7gpvwT9OVkymCDLKOA==,type:str]
     ddclient-token: ENC[AES256_GCM,data:xyi81eQDqE+wYMMs/uqQmWDP+3Ino6jfWU4I5WsqczsT2Qj5lseQ4RN1HjX4busrgIrRZ4M=,iv:sn3ZOw94Haq4GuNOw8I5xWQzbE0W7uHJ9+ugE0Gbil0=,tag:A5y4GPLrO+wVmX6h/7UKww==,type:str]
+    acme-token: ENC[AES256_GCM,data:mnsTQSlI7d43mFLybL2pEh0rGS5AcUYV+YXqyILLVTpjbB6qGAJ33me2VoEiaMdxvc/8qsE=,iv:Y1+Z8sG5b8mrYjzGhoKSABJQ3RJkGnbdqDLKzGGZZF8=,tag:bVl299pygUKPtaLzigdAXA==,type:str]
     tunnel:
         certificate: ENC[AES256_GCM,data:z+TulSaF38bztUk9GNW8s56e64siBOKsaDGV5YFX64eXiJ8qfiAR2uhFSchi0TFjKDs3Lrx68Lk8LI8n3Ta1AuZowpskMoC/vqyzK8nFlYp0KTDkKI0W2leoyJqxvlgqL8y+dPBjibq6WZvZfLCPEvwx6XggqKNSqc3dw8lVy0TEHnXdzbBQ6WarYlEb93rNu9UY5u5eRET01efpVKFXgwaMuBshYRVhEUci0ejO4LWahYXOd0taBWR5zfe9AmWATILq6fvdFVu5eRY2fzcMORvDAACr79E8cMyJdIhLmbSndQvMttAS/xOvRiiLJSf+0Dj3bEPTexfI8oSL688B15zwU+EYu+tpTV4=,iv:Fsdtl3TyDda+ewQW0VnVhScRAqeuH+ypAl/USMSGrt8=,tag:O72uBGHqZRN+byhDPCepCQ==,type:str]
         credentials: ENC[AES256_GCM,data:X/GQzuIwpIWeAab4twWJd+RjgAzm/S6d+u6Rfnvk/Xwg7+DwNzDpNjm7H8xYeD6sNABIBkq51JFbfldzSYwM3IuoqD/C470Yu5IZrL1Vbv8oR9XWNh5MqLpuVJ30nTbUzG062T7xAZ/uFhLZIovgcAvyBhltlh1Fgq0PaZh9jCAJxGZwTtv/m2qXwntQiE7as2pyk4eTBeVC0V+2ud3aALhLZd5BWvL01INMx0O33NIQPgKO9JKLi1InuuE1bolK8Q==,iv:3bPfPvM+EGnlsllsshHqTv2Aaa3s4vP5Zlx0oYCgm3c=,tag:qLH9tgK/eGoOPuGAaPTU8A==,type:str]
@@ -42,9 +43,6 @@ ssl:
         cert: ENC[AES256_GCM,data:r2WsRpqrF5GqXQtPzeSbdtvDgL+c5JXiN5qhKjGUS2OYmljGkxg06F54CV0SGegzt2n4kqUcctL5E3+11uSyTKjWR3+3owoXk/38gVD5cv9rSFFI46ryAO+yWA+AgB6mJMewEUbaGmxucj2irrojiwMJ+v/aHIjMx2PvYRPXWkNtYHFfVs59fZYMnOt/dNgUOWgw0LOmTNzHa2T0uMib61Ky8uiDtklCyPXW+Mvf2+SsgUXuwyZLXFhPlFttPrY5jYqwJdKXr0WXq2+ie4PPicApXff6M9KPIXRy94X8zew6t3ECI7LI33qqhGDJq0epvTaXxfUD30aKwvnUKmM2VApDM6zcczPIAyM6ZkvCRNrSYmyy5rtk9zIsteaHXiUXP2jqpfWNfYImALNtmP1tYqd7FupFbW1fEhSDOt2SJO4/+nVsREN64vA1Cf9WiSCVSn+Ff2/VlqgapBTFLiymJ6Y5JlA74HRPRRsGoG1p9iil8FB000qtSkygXLwdsEgO6Dws6gwuxSFQNWUxUn9qusYoAz9ElTLxxyeIywhkjJz+8zEDrquEeTee7rZa8a75pFJsBVTqFCZqAOmPvuLVctFmau+CCsCqdbwHgTM/gzYlMDGz1ZE059Rd61uxpMZRuLxfy0Dkt6LCC0lDEP3oNlYzldaP30vMMBK5mMDxvsIwoGjvRfZNgCYx/dMpEKT0Nsg+EYJB9rxMV5yhMMjthNsPy96I0Uh+Mi2qe57tVgJkzJzOZsA3/DE7IzuX0HGK9tp360I0FjH0BXB8jZsrnAItNtXmgD7ULENOpxAU2flxrLhBFoUaOlyVzdoam6MT/2nD/X0lz4vEwaijtJ3u/k+zEpalMlVj1+7KPc+9wYY2n1kLW3I7hgPkhy0Jua/5OBa3YjwA2bT4fnu+KdNvWizCDALbOi2/sUSw5L9RfROoi+3haiGprFHJDT9gq9hak9MJGCBxM5p0SlPgNJfEl7W1E0puhgaQ+KZuTeOEa+pQJrfvxXiT5cZoinD2DT6ONAx7l5hisPDv55vPEbe+lo8VBiOu5w6PIrZIzSmlhIL8pJEy3IpvpsTNUIp3TEhpqlOHDVpz0734hZywdhUnJZS9wH+R4Vf/CD9pESzOLH08IlRP5oAB0ERjgUH0+suwbhCtAbMamQ7J7FrmoRJxV/d96RqPM4oxS1QF2WVN32V2DBuyb+Q7FQY6FGj0iK05n5sSMxqz2Gm1MQrsLmcF5jaSvJHDs3FVIvdU82pYNpyQVmBct9MyYz5pFGu2uKeAAQ/Pbqs60hrmhdH5WC/bxk5pWvBzbMbjTKk6aJ7yDRxqiu+pbmpanyD6me/ccNw8gUrequ4Mj7rGT5IBCKbwonEacZ9+05Noi9tus5tX0U7dfRS6SZNP0ac2SjFs9yL9x9kwW1ZPj3rZ6Ew9MCqjfHO+F1ikvS82L0F+tHT6KrkUUd+sGi93ik0x+D+Uscg4atl5utg9I+D3G5/RT/IVBTR7Gx/ED6NkknuukaN9uqq+bEPSt92NQW6t15pSGQS2TN902d8I1kAMo+0FNgl0k5d0Ibr5Vk57w6J4MeqM+4mWCxXEw7oGhMNOslhWsuEII/Qe/V/l6LP0SNHAQayG6+HVRuu8SY9FkVgRY50q9Wl/3k1+iTuzhClof6UwT9CG9RS3nBEuSLdxhsjdp6p6mSYI59w6X8SuP721Y08M4vmZ3fIQVgWDHgYaAacsANVw/vEw4AafBTgE1BDLeS6f/3yEZEvbNU+nDhcvsg7cqOSqf0GmPAA71c5iqPOA1oXMgPT5LNYBwqt7wO2XI+tflsr5vIMu9tZ3Jq+YUI4Yf6pAQ4okAyoQuzW1wwDVGL6qaG/RRXYrV2aJrFRK2s4ah08SNN/pQqOuyUrDWvLTn24/tFyBPGVb1Dt3G2XgR8Kb1vKVx6x+Agic0ozy1NplyfrG9IVsWR3JqpGdTbxERlySmhtvnaQy3h3Y2oVB8dtOl9Ij4nrZjvUaGA9sZ7qhvM7La98mXFffGNoUuDlNkqYS8j7WinfeeUA34tr66EmsGhgKaXeGn85JtmtONnczkJ4rwC3GBQ1WfxXUXHByoceCw+rk1jamE55I4veuEtZuOBWKYjzfT4IqSJrW89IBCER+dBZDBI++eUefLVFKgKN2RDnPNYkSp88iamshu5Z5q9m9TmyjfRegN7ykJ0fyCJeDu85/xiWVhTuxrFH8+czSVIy20DWV9wvNW1E3oVBsyfGURWEl4dP+kfptKpdp82yMmP77kzR1A7klwcmBEZ+IBpPFfHwtjILIAQtepJQ7LjH0+wJgKQOyWQ8qmTnahfxeTYGSOotlL2qDS+8s8exlLmgD1pYeM1JzrOuk3kl2fCb70HxFTDtZR79nHnsAby89bhHiXcYLweMRTRVdgsbMbS0QjmKQCvQmtrLvhunRj2Bj6wiBmmPC3Rv3/IaweYpuUfadmA==,iv:9OCqtSgnIeLLNbgc/AsgEMwvPgefFsYD+fvk6ATIWhk=,tag:qiWNVuQFulwTzPoz6LOtXw==,type:str]
         key: ENC[AES256_GCM,data:Cu/W21k9/qS/NhUGS3nT8wpe8pxCulO39tn/G5+t0QBWykAuvAkXTyf97s7dR2eBcuFGfUkdOMuXuWtjf/n7nOGaaM5JAb69o4um9PmkX0xlRcO574+V3u+PueZnyYYJB76YA2Pse2DCFpzlUHkvME5bZXR7N1g6jKZFKGDtybjOlm1YuTmF6pOsPVSR9KWWi1GHnAliAF4YF8C2oO1bverlbxxeiqHH3DUYV1W9B6v2jEpkPci/hpaJrwSSlhKs17cCbQ8JRwFdMcdEIjARUvGGKImPpl3RATt8TU1p8toXrWQoCo81FMPkGX7QAKcoPr9g6evfSLqZGGi9wkdMHllrooa0lB+Pe3fSYc7FR9l5saTsRsrtWrobd8mjG8CUVDJYgB85SsM9cYYQfdUqYb64rTjsOxDvXGPphNSpKjNpQbkNpq4LblgYIyiuWSO7cNHsmYzmfivMqaUNHaWGUEZ2rGM+0Ehh0y70D3XIhIJsF9rApG/CLaLO3oOoDdysBH4LpySos8JYvfzgdcYwBeeVuksMR+BLsu/96AAY9mNUMeDjD9hhOXLMqZG/GCju76xPyu5Rq49G2I4iPZLyagMw8FEfAbZgVjYfVlc29c027RpTkY9lwoNzmtCy/7Sfn2IywsoZ5irCfxrZYLYzeLMcM05xuvNV+Lf4mXv+siIDKmHHkeeNTr5QSjFOVXWqxMygUZrN06v40JDruNoBasEoQgZZl9kY3AZQNLxdVrmA1E1l+ovn43SyzXXUGR6w1jhR7bVdIcB+20WN77GLkCMnDapFnPKrNLkWAdvzkQEnqxhmeiCJX3en2L46xY2bMEUlu1pbaCSTkXP4ul+NC+68JWBiVadYAzhvrEu6YF62TI+Yff5ZHIuENQBOTRjDz1cODbbZcKkE8FeIM1mI8Pq5l7IjZOIdzPj54BqdUoJhBIccmsDay31wkArsj+iZmePzjpfrC8zSHLd+2WDnuA7V+AzpgiMBFkI0c69bVhqrxBjcG7ylD/H3Ho6SkEsHeHx08f/UFiXVy1H6Q6ctkR5AbIUbWMEcPYJmg12DCnbvXLaJzDDWoPylwIHniZXilgzrh6jd3XcTgXPmkN+1EwYWlmDRoO4E0Ft/hsytBwkOWIHsbRkfXWaQ5p6SsKUruLb7xWPewR2WyWtREjbNMPqRY9fivc82UBAJipoc5dwZ21uGD0eX8m9p2eD0mNpqoErfKNBKoCBPhd2Drp2Bc5Spf+GKt5s3GNHaJeYwF7tzHwqixiJrRFaNhXkJqpOqG13Nl/BWufVn7k0u+euB5w2r1xEnpz0VHW9++wOB+bbktA6N9fS5wDiN7fivPbxlWhxMw+MsxuLMQjVTw82uu/L4yFPOZ6NSTStsQgyYCWN1205vnWuF7y4t4u+Da4X1F1LWM7c5iN72GVeUVTbmzA4g82+RVYga1kfvMjXT0DC36eeLUMw248eSO6a+aGiRFETurc8eEFeptrnK6HzP0WOWh8A1mWElcVNoxPyUMO/0oW2vPsTgGthK9FUU2LXg0V9D1p+NQ1mTlhChibZf52VzG2RSQaVupKLl22lddgIYS8mIdMbe5rYN9iqT8geLzpbmY8ITCx3S5/LsUqnVBiJx2QcCwyfcgjBRBJYwEE+A+ruDOKDsmWgDWXGXWNhCUktaJZmpD20LEhuAe0JATD7zurLZx2Mc9LCY5KWwza5FJa957appJor+P01SLyindciV1Bu2gym13UuZB0AvRDWOT/IYIKVtC8080Y9WdSIx2Rf4K863cank0Z+EjiuvNGaAdkFVOrVgvGJqwAAiD0ZitY7tIYvfsE5T4k+hWvyXReyPx1ygwqFWBX8gTZKpL0RIkFD7xXLzFcXD5FlCw1Zonbx/bmbjuEH5IqZEj5NeC8CdaTFSl8wN4QUrWJ69xZh1VlJYxV3uWJxfOVG5NAjA/6UhF07Rxfmv31YEMNgE1Am+K/rCNOk/Sb24e5FmIL+D7Z05vHBQaIf8WPYiuYqks3an00RGWxjlQd2jbP9R+rbXJ0OhQLMLyxtemxeEFwSpUjlvCfLGQZZ+ZM1Y43ri9fuBupCNsB/Klsvz3N7E8UMZ5BKhAaOAhLFjRMU/2O8vgtDGpk2O/iche5cW+Bw738ueFlFmHRzF+ItCLdNGzcSLi5btL67DBo9zkx85AwKS26Tnn8iEwIZE5Jeae+xBjFRg+I+RdDE503QRS259DEcfL2194jiWkY/IbS2p/RMq+qSD4ZtcwR9QgO33a15mgFXkuQg2z6tCh9HVfVq3Kae8vEwEtyqUKQTO8hO17MkGf6Q436e31jMOXrCUZXbha/byxTsdKytevTMUIDcqubtzC1UnTdb3USb/gm9d+J0Ult42B1yVtohHw6f2BkVBs7epWZNoiLmlteFjvlQqqRxA4mZl2QR1Yc8SdfYzIMJH70tv38y/X4GG5Hw9mm+l006EYyi5yGZAO4qRlhgLbwU/s9CHceihCxqSWUWL8wiEVnsT3QrGH+jNBOekZi4cOAXvT1AK7Qjmg2F3Dq2FT2qiWuDXXTr3MbuuzDV2oDJtWtDwQXwKswKnOKEx6q2r0z3g6RjrNeuk18JZGJvD/jgeCW/+F4arfCKHdz7gX0J7WSnGXYF43gd10jJq4V3SJE2ts7p3dbrWnuhnuDK/58iDygUda5hyGQ4cw4x06JS2JJkVkco+7N8aUE7NL7xtkiLY8GyL9AD0/28xFfSyzEKuUUNFCScMSLhwrCB8T1+4dgn6LZUT9ly57FQNG6xk1ppIRFrrfA45MIlu6pDzQFeitCvlWbYcmflacStVhzseomLuDifk2FuZYKPItcWk6Qk6y+gbbSlPZpmWuO3lztulQkNCl0V/mfEsnZsCn91D07Y9KKqreBbPJiDeGeAyAeIP5Gv55H7IeMy3mwMgJF2O4aEMCCrnuunHS/mSz0LyIC3vZYV2Chg08QtSF6QsnfK2TqAGaiVAWsT55D0LUeyeROWx5yYsHSGVyy4uS/qDUIAfp+FwYdO31J2YtIy2XaH9A9CBi8G9S3GFkAjTKO9BotI2PIVwk6MwZfyedpWgVoOsi6kzGLc1bUoABksLsBBUKsc6xQdJKbsZEAtYELhNnSd8hz4PCL2622/cNVCRmv1FhK+4+6s2X5v3usXyllu6tVy0TTraHeDm8BOeydYwNjyPBNUMUCG78+CHkQyTg3bLi2Bsqm8F8LNs7Iyt4BSZbpxC6qEJyNWaI3G4Mfx+ELUr4xqYaj677sruHOo9i9z5ZTqIyYPuYKZYshiIK/XOZCPBIWh1+Qwk0vcsL+D0tNwdl7mSLGMDWNLFzPXAV/iHfWfUBpaYD9WwiNWc8Zy1EdeaGTVUQ6l9kMrQmFTfmGz6VvjQiUJ8zWnDQQ76LqECK87mzTj4njXIE/cGSoj5w8qgPFcZmdAiv93kPOdqSoJBFobhOPbszkLn6hRnBk/C5wOtvmqcLBVpeMTjoZNlgwOpjwjKJSysn6uMgiGW87APwCEPxT5c1CiwVpTIXuX3SfF4M+vCvkNLpLWS+lS+o4UBDrXulAUfU758n32qpzMbzPdksE3RmcKHKKhAgn0Uxga+BWt7S1h42vVKr6YibldoFBKlM/Fdssqh1bXvWAeITPDb2kwRQFX5Ao/lM59PstFmEakf9g+ISPO5/SbDnYMPYVdMdoUqbvauZrIqdCoFP0eKEhqMw59fjpsxEH3GFsbeh3spPWqsNCqxvNFP1rlNSEteUcA00V1C8KiEvkqU1gTXqADM3kk419EyIz1fq0Se5BGYnJ32aJHlT4WNWsIeD5EFcT350Ljd65enjsvmstZzK27/Ne7OnhSLkXytvJw2bhC+K/rR+6kK8R9flP4YskUvMb7OSNUdaKrsp4chrcq2RzjAhOCuCsD3DIKjVsdxe0d+qcQ/7PkSccXOKohYFly2QcboDt2fHYQl8pDo7rqXaiowvnKDk2/Db4L/WXTupWsWN/Cd5ceed8F5L7VnGfsFHri8baBZv3dSMN2IRsKP01CszWDKxhnyc3tVf3WCcl5/M0yGPOVYan6ezGt07O/2QyFSHz8SZpwP1okUu+F1oaReQ3jy95/B6xWrCl7oLrp+w3/XDQkTJ1CRAxSG9OHBoGQWGHq0rvZTzhC62ppW5jUM6Y8CRaLL1OBt3CrPyXVbzZO9pPumXiDB/qAMMKKGY+m+odxqAwv9d7otoBX6yEDUO/Z1dh/BO94KfYHnsMI9A3vH02h6mOL35ifnPMNd78I2WHqDiPqhTZdYCnrDULaYogB4KbWAneXdfZJxFhzVbzc5D1lRlDSGlDTtFKtC9NC3JCRiKvXtxIQTbPjlY6cHt8zNLaLx8y4iIHE=,iv:rqDXOwCDz/w94s2/ucQG2ueErBtTxSTkp1PTMfvg7hI=,tag:yOyayH7q1PD6va4AuKp01w==,type:str]
         srl: ENC[AES256_GCM,data:FI+mzQ8KsMUHoEnOoP1mmfTPuAv/yRg6Aj1DqaW541VN+GEIWw7QIg==,iv:83U0OIdNJytITTv1Aay1w8MH4h7rjG5ggUFKQfWs05U=,tag:tDAt5axQ5tFmV99wROUQtQ==,type:str]
-    wildcard_cpatino_com:
-        cert: ENC[AES256_GCM,data:qWJkhKWjeiDxN02fvqm8xtUelcnzTKihMKmtaEr5l92OXO0NS4RzyfQuFrenyP/y+5gLWMDSQ94+3ZU4DSxaBkckYQ4yIrsUMhVyxhlg2JipIni8Zh8CLlsDd9+iAkRMwRDi1BwJ1loKHje/lkiziTB1MfndVRa62NW4CUeXOY1/hb7mcRR+yah93kY0pN7BqlmC4cqMe0aRZtPMgwMaEFKW8JKrAMh9mqMaoLG4R+ZY3fnQURTAK3HDapn7F5ZfapttmSNTADbr1e/VaBdqgvCogha1PmgcQUQSgwmrYotGC8RzrSjTKyx1TDkE9zBKeapgIEyA0hbzyjfUeW3YZHWl7dV1OvbyYDW4GYP9fy3Xqs5Iv7p3nUUXVzVcespC80hUWT7m1c3GN9H8DdR+jI2YmHK+YY9SdtTD1on2YQ6YV0Aep7IV9kUWqy21Bkv9aFb7azh17Ui/qAtL2VpSHizoQZXO798vfOuwB6aruBYBxDOHUmdjhvgcGHxaql6aqjvnP7rtp22FhNH1WhbcKkfSj13ZMxAbVaoUNqLthXITbglzILPhNejKQ62DrOxTpifdphRhLa3DgAmjgWUOgNwn8kisz19DzfO0gSSIzYRSMKm7rTJuXSeoczORBLEvigxCD4VRkvCDWc11GBXf7r4OpzgQbaW+BuDkHWIdpN2xRWUTo61BFziyYIHfZA+rHBaifVKi9l8Dt3IBZBK8lw5c5PaioTKPvU4/tcbSLl/Gms4ZHStjPoQ5D7/yf3lgYQovlD/RcJsvePqBuis5dQqhEn7UXiauWeDdF8Cw8NAT9MvbKAN885HmOSFuDWiJi+omGHYYznnjw8ZDETekYqbWSCIdprEl7ZXHwOUJGYYQE7GHYBMX5Ka6Uq+oC0lyvLr1zFTG2dTM20d0V8NnDxoInsuc/LkgU2L/xzJU7RN3I2p22DLTpVe+/nVPvlZZzarZ90pxXeudR8zt/uowA8qT6j4ce7qBbXBHMt7yySx3MLUCrx/d+2dVGoqWCrKpHfXMyuwuujF5M3QcbFjsGkPzKRIAkC10S/plKoJMcjf48b5LNvVwX20ptRB8KBjkFyXI7uAHQDbSVutakBM6xHFv8x8UaXGlD5mgBYGrDjPmuP5Z7EyHvdYLyF17W1JrmwH3aM/0R04w18kaCPB72468rFOENI80VgFsGjH4qNXIZ2bWvjY8kCPjxYKK9XkwByzEsFID6Co+NXXFcUlhd9AcBBaZFJdy8shrDwYBoDiBfpKPm8Czpv8Snyuc/0PA0LZ5cVfJYnv/v/atgYnorzc+NKZJFK/R/CpL5iN8b8QXCI3MGnN1w81isOcrdz8Ea/B4mg/E97sz+Ioce5ClTBEk6AoHibBmzOaODBOB5QkI8lmVLX6kmy1rgHs6auaLIu5K7LU1N1sOLEk+znVHf4FaqIeLwjVRo9LyM0kgBFAPVy+i96WaViOEms5dofKKMU5wC7E77XTHjFI3IuLYR29/1/emXffS6z4M8l0tkxpkOvzu3nDcjn9dejKHMfB7QLp3vjJkljam4V/mJJnNE7P9AAsce/Kv8ErsO+hOdvCj9DwQpooa1ye+jZoOv7wFnEEMw7KcrZ4vbia5/f/8UqhGaNsSTZJ13qpFiKHiFGsix333lPJGxEmVGH4Vaw0lLKbP2asT4B6eX+yJokQFNHVEaSPUWCA+4sSpRd47inn+zdmPzmwMDnhnIfGFz1jmOXoxuISBkSvUFgD/aiGBOLWHpztlIhWSuG99M2fWawKAMcg0l52NP9WGkSWJp+ad8GJ+k84zvc6NQQECWwLYBjsQ1B7I6MrkngGBVsezRWIBdO2fpQu6rDiqNvInu+NvpQPprvvg+2uM5hGHyvmUcJlVvz0V27oCR57PIHZQVhnLSehg8uHWHLKlOolZe7UmGxuepP0KER/5wtovkbqq8Wb7UtVhbdvsTFXlNwqMSxJGhuPn6ct4iUfMzevR9N5l0fXY/OZdde9IlS2YCM5u980vwkx+,iv:B2PiVy+1dlhYM796TR/7St9MVmDqY3wT3bUIGytaVlY=,tag:aYOwUFHOORPYKW2x9yanwQ==,type:str]
-        key: ENC[AES256_GCM,data:gu2CMuEranhSeHwz5B/Z5GY07bilynnS0KkbPyyzRlHJUYrnWSIQ7ZkLk1O80il23HnlMSRsptobpTi2bpG1KoCysU0sQWFKtplpdHP661cC45bdjFIElY4jZ5wbhqSy5ZQrY9DBkHCLH7kMFicRxkuHBitt7JAlIM+XeZ9HBfimUgKAACiK8jf+4B3sAl85jqWsLU7Ql5RDM4N5l6mpOzdqEDpY3UDgIE53yfDY77N/fHptS8qh9xnREZ+4BIamAZYyKXafHxIfDZaq9X+Fq3iO/gViysoxdoGOwvBYEBWL8djGsCo5lqiic9P3H11ryZleAsJpncpcirjZ5liRKNHgODbyUaSUE3VeuimLJrW8wDKgMeZN8/KxLKKzbK5CqKCj+xTq1lPn0l1FOPPNkMsOR++UxepQY4JEWlF7aMvHzdEqLJO61zY5dOM2V1iXFEB88QSXBK2URFMfvUTmdLaMq5SSjaQlwTWiiEtTPNabXz0peqTeAjMBRzrJ74NH5mgmwUxjSUfdvhJ+Jht+dU4X0fJ7hUmrceM//bHnA3zH2hSDnS+RcQ/SRbISLqn62XqsxRZeleQ6+xWurt/YUvgG+n3xUMn/HAlUoygyWuDQhqO43dniTT3lcZ2jhZzf2md3weKZ8PpH3K3h2ybFCbtPbNu/+Yd+5WSzRAIODrq4L9RdYFNUQdoWTvSCdEsR4JBXS4Twm8Jxymu9IN9CbopYobXIqmWR4pd4FQV2YRkSzBxueRjd+6ydasT8UOziCOQFpSVwftkN9FkiqAcslDrsY0x9yIjoQ+MjpMjGD2Sj4wwt9Ivi+dK1xCRfMU4GXpI3m2Xznmve2ClMVOTkiazFszIMTTNg4UzgIxnf3KmuyLHYrF8HSXTw2ILGz9vPIBr1fyrMi/9PLcBf6X3HLVGZJ1udsMcEBZNX5PbNT1fzX3vl0/bL6vHiMKa8NEXfSxrGJvKuWO9s9ZgnJizryUyukPRzaIKri96+T62/h4oXHv1B83Ux7U8+JM/lsGsXc7soeCOZK4Thr5gGMwCuspqnvhlTQB0yd20MWtWziv+EMWz9UYXyTCJstYGzcwZzFGsl1a5MzMJoiv6EeIEMiGnWTaDJsMPFIVP/t8v7lYjqXJthyMomLWDz/fHSxnXR3kqokJ/rY/5X0jcJeHCodNXR8YKGhxUu5d68nihOhmys7i4y921DoLun+rLOYuY3awbQKRy/Mp0YgaO625H/iT99EKyaro+OszQIfmHr5orvxF7C2yvaR/xxMc4NVa4SJtoHQJ0tTp3Y5Dp8smqgXROMrdHJWPU9k8PLEHJF3aM7kgXBslgh2VQ3Ggy3lWFNLqbgE6F2U0jQaEpnNGqwZ87ZfmgRc+u+kRZ4XaG+oGfT6RH0Y9TfYPuQU1dYLEQuMCgB8JizRmdUPeEVBy3LngLYQpWdPZYhf5uRPiXSEPh3mkwpQvPQcrHgrtkl82vXXsZ8TOxO78iczbsSa6/rBjz5JU20NqlnEKbhte8HXSDdtdy2nQF4M3M4p8mnJUdQ2M/ee0HN6ztQTyIjFZwWB2Nkw4MgpAIJNzq1hJAy3coE6R1w6QHvuOxwE8Z8Ap8BW5UemPYsp69QXIKW8dkZ2dwQ/N5I9EqpVY5zGEfDQ28/E7r+JAT4HjMghnHPMZ37UkylPcLhJJms650qc6RcAQIWGCD9d3No0pwOM1QvUkx4NFD2sDmLsC8H60ofP1Msv9QFRboREx6qAZ5JLdCTLjY9yytA0TSb+y4YXRTLQm019c2o56g3XG+O91vopbOahmp2erWMsvQDBMH1M6PW0BWwPNWJuvoIJD7UGfTCmBMrUDLL3ssUbTp9aVNU9SxpWh9sq73CIxaieKsPbMfJ71gDo/7y3oLoOr4J3DjR3v20t3v3UNNLYjqsFoy0BoRI0fqu469NTZ7Y/ub0Quk9ZR5gfkNPscLLbfMiU5GMj9xnnvdWLq5lq2UyvEZIaBXPkNgNnvDxfCzqnn8mVSv4rX+OYNjIBSo64xsdsVVtFFg8GnmFOweFrDb/ClfiaF/5SAMWaEzdCCKPKKl4BisYriEZ+QlSFT4Qj/fjTsubdhm7xTKg1NX3F4JD1v+vL1/Tjw+NwPHLQ5Nm+qshUw2ijh6KWv2bTObLXtqJJUNEMKmJnz+KpDox1uMOPBf6t9jK53Z72QDJmPIHF9qpRcFUP1l+ePRECkDqqcy3AEmylneZfuNt+v7D4grwmgeK+C3jsx6jePM6I04ccThkscJh3N7SMqPV+H8O,iv:Fj1UGfV9dVJzYeTHr4fkx5hSglgMlqTemMQ4x7u6SUo=,tag:zIYqY31qrOr687pJyxvaCg==,type:str]
 tailscale:
     api:
         actions: ENC[AES256_GCM,data:LyCLb66bl11oE+zz/1ALWULkEl7Tu5zwmYisFy+gm0ySl2K0Uyt6dSHn85jBzu9pHZ0EOBJOLhqvGqI+,iv:Npmxns2Eae4F0ABci8GFIUQg2g1Rs1Glxi59f/zhmY0=,tag:G0FE03cJPyuhYCvjlMSiUQ==,type:str]
@@ -126,7 +124,7 @@ sops:
             ELRrzVwsb0xYXdWgzaiIRoj2ouMAzaMe9P3DcFlXrW169z/6e9+wRQ==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1uvdnhvu83fafnvvkfwx5e3jt7qfqppytqu0rnhwtc3ruyatrxsgqwzjvjz
-    lastmodified: "2026-05-31T17:03:42Z"
+    lastmodified: "2026-05-31T18:36:05Z"
-    mac: ENC[AES256_GCM,data:xO+PUmk7YLcNZW8mJ+c1kohPqEduljq7jg4gURtonjuYPgiDwQA0E+G46flZsjWhfg6RIu0YfXCCfMwtrsBiR63jlRfKk/MbSi8zBkwb8/+I7bmbraJMGGFbFr5NHk/LQ1cSFBgFs3XicqvzcZQZKI/Zxnmo9U1fHMP91YrzP4k=,iv:7OlZoh6Riut8D20/xKg0i89Qkttr/hjOdDUMJM2IbvI=,tag:IwbTJFq/etbImq5qk2Na2Q==,type:str]
+    mac: ENC[AES256_GCM,data:JtFifOJ22cKFRyGHC670tZZ0gKbbN4XI7Ah6HZKJL+Vt4hsZlxKCbfTVYu+kXnJRJBkExY/pVIijmwNroJc5w8fbLO8CDpRH77L02HGQrRJ0iVQsPDho4xNdI9CEekyRbj1f7QHl90CCIyE6rc/o0hLYdlbTr/Ebf+Yh900GN28=,iv:ZksAX7nTxQuUYrMsZH6R4zmsPBCpjEw24xrNVj0gKIY=,tag:0s2TQgdp5GLS9Jz6zufNWA==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.13.1

systems/x86_64-linux/tsuki/default.nix

@@ -33,7 +33,6 @@ in {
       };
 
       networking = {
-        cloudflared = enabled;
         httpd = enabled;
       };