nixos/services/hostling: init

flake.lock

···
         "type": "github"
       }
     },
+    "hostling": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1769186374,
+        "narHash": "sha256-oNRJ2nYYsE+AI9lLUOK4HOwDOwOLtwDmHkWuQKFs+3Y=",
+        "owner": "BatteredBunny",
+        "repo": "hostling",
+        "rev": "72496221490e0e2af8d9c4796fc33db524c7bdae",
+        "type": "github"
+      },
+      "original": {
+        "owner": "BatteredBunny",
+        "repo": "hostling",
+        "type": "github"
+      }
+    },
     "izlix": {
       "inputs": {
         "nixpkgs": [
···
         "flake-parts": "flake-parts",
         "home-manager": "home-manager",
         "homebrew": "homebrew",
+        "hostling": "hostling",
         "izlix": "izlix",
         "izvim": "izvim",
         "lanzaboote": "lanzaboote",

flake.nix

···
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
+    hostling = {
+      type = "github";
+      owner = "BatteredBunny";
+      repo = "hostling";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
     ### misc
     # declarative theme management
     catppuccin = {

modules/nixos/services/default.nix

···
     ./cloudflared.nix
     ./forgejo.nix
     ./glance.nix
+    ./hostling.nix
     ./immich.nix
     ./jellyfin.nix
     ./kanidm.nix

modules/nixos/services/hostling.nix

···
+{
+  lib,
+  self,
+  config,
+  inputs,
+  ...
+}:
+let
+  inherit (lib) mkIf;
+  inherit (self.lib) mkServiceOption mkSecret;
+
+  cfg = config.garden.services.hostling;
+in
+{
+  options.garden.services.hostling = mkServiceOption "hostling" {
+    port = 3025;
+    host = "127.0.0.1";
+    domain = "cdn.${config.networking.domain}";
+  };
+
+  imports = [ inputs.hostling.nixosModules.default ];
+
+  config = mkIf cfg.enable {
+    sops.secrets.hostling = mkSecret {
+      file = "hostling";
+      key = "env";
+    };
+
+    services = {
+      hostling = {
+        enable = true;
+        createDbLocally = true;
+
+        environmentFile = config.sops.secrets.hostling.path;
+
+        settings = {
+          inherit (cfg) port;
+          behind_reverse_proxy = true;
+          trusted_proxy = cfg.host;
+          public_url = "https://${cfg.domain}";
+
+          s3 = {
+            bucket = "isa-cdn";
+            region = "europe-1";
+            endpoint = "in64u.upcloudobjects.com";
+            proxyfiles = true;
+          };
+        };
+      };
+
+      nginx.virtualHosts.${cfg.domain} = {
+        locations."/".proxyPass = "http://${cfg.host}:${toString cfg.port}";
+      };
+    };
+  };
+}

modules/nixos/services/kanidm.nix

···
         group = "kanidm";
         mode = "440";
       };
+      kanidm-oauth2-hostling = mkSecret {
+        file = "kanidm";
+        key = "oauth2-hostling";
+        owner = "kanidm";
+        group = "kanidm";
+        mode = "440";
+      };
     };
 
     services = {
···
               "linkwarden.access"
               "wakapi.access"
               "immich.access"
+              "hostling.access"
             ];
           };
 
···
             "wakapi.access" = { };
 
             "immich.access" = { };
+
+            "hostling.access" = { };
           };
 
           systems.oauth2 = {
···
                 "profile"
               ];
             };
+
+            hostling = {
+              displayName = "hostling";
+              originUrl = "https://${cfg'.hostling.domain}/api/auth/login/openid-connect/callback";
+              originLanding = "https://${cfg'.hostling.domain}/";
+              basicSecretFile = config.sops.secrets.kanidm-oauth2-hostling.path;
+              allowInsecureClientDisablePkce = true;
+              preferShortUsername = true;
+              scopeMaps."hostling.access" = [
+                "openid"
+                "email"
+                "profile"
+              ];
+            };
+
           };
         };
       };

secrets/services/hostling.yaml

···
+env: ENC[AES256_GCM,data:4LMQbgriQJ1wBY1FUQ25RJYWGYGw2nnTCi/T8KXIE3a1HpMGhWUqlEfTe723FMms59szDlxnE1RsXLe2hRbruJg33c25gXDLP/40he8x3S4uXRtBK84XOjcg8ZRCXw/DaFguyb1KeKpJFmTPnZDJ8BAVCk8aoTw/6K1lFrTCxyH7Sna058TXCTLDrpxyCX+CbAs7XG4exvJ3Ur0ZAeeQpD+Tu6tbF0mAIDGm7taNagMAxgk+iTdfaw8hjtEagVOg3bRdOYMNOEju26OnOXr7HOrozBecJAyoO/zMpKUnjDP21Hv4pVnNlk3fR+Uc0F61bzhoLH4b9oLKWVl0m/jktwH+/DrxE6IHGgSEdOuWilnHxl5q9u4kI3hQGZYegjpwxSDfSxgXEfSw0pL0NZeji/vLXtjQLKtYPBWqjIT8enrWowwJSnbDOhY=,iv:5XMDR1wcrSy6bUx57xl/vz68J87zs7OmrhV18e6dTOE=,tag:8lEn2Aa93wqfuPmGrqQNGg==,type:str]
+sops:
+    age:
+        - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMQDiHbMSinj8twL9cTgPOfI6OMexrTZyHX27T8gnMj2
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDk1NDQzZyBZeGFC
+            amtmZ08yakNxT09IVzIvNG9jVEc2TG5Kek4xZWRJOHdIV3pFN2xnCjF0K2xaNXVl
+            UGxsNUNkbUZpeE96b0g0emJKTkVaVmFqV3grSklLSjNjVkkKLS0tIGpCYzVZOGIw
+            V3gySU1SeEp5eEh5Wmg4a3MyUS9ORW5sc3VkZ1krQ2Y4T28KdfskDVaCNGOK9TKy
+            IRt9vhNPcZJu5lqCti7mE6T44Q1Y/3jcK94FgHq8Tf1hz9CJj7nf4xyZaSVUvsRW
+            j0z54Q==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAomF8O3ZqZBpLRlAkS1+FwRllSMrREHtndw07trrfcA
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IENXL2NhQSA0SVNI
+            YVBMVXoxNDJKL3BCb3N4NnhMTXNqdUhrUDdjMTdTcEsxbVpGL1FFCjRjb0w3cWph
+            TG5uZ285SWthR0wvbjhCMnJmdlRERnlxWGJCaXlnbHJOL1EKLS0tIGVSRnBrb1lD
+            N1FIUDZSQnRjMXdKdW1iL3VUZElleWg3NlI1R0JFLzlVMWsKt821rKpZNqkDzWUU
+            CAOjfknx45+l47V4JegWlUJYgrc/oZHW6VhNAEVab/7p16kT0cxR2qQEpu8hHCkq
+            Nn9v8Q==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKV3N2r1cX3kZMHxuJYaFsjWJRtik/2b/KZ5ru38IqAT
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFh6aDdpUSBnVUFH
+            Zms2ZEVneGJOa3RGZjVrQnBjT0lkTFFYMFRBUjQrNmw1cDcyRGdZCjEzT292cktv
+            NmJ0TDlNM2JLMGJZSm9lNFd0Q1dRdmp0R016ejVTTUV6ZE0KLS0tIDl5U3dMVkRo
+            WG9XUnpxUXpFTWxjdDVXdHJreUVyelV6NzhMaG5nTHU5dzAKWojiW3Hs/1rG/1+u
+            ELxAcE7Yfykk2KIE3bny2YBEN9Q7GS/WmoPtg8EvBBATDrghm4Z2ChkmNp0HUrmF
+            xDy5ow==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN2pZDnEwnOsrf9aPUVkBigeFwAirWPVGliSs5AgcEFr
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFZTUGdBUSBVT2Y3
+            WitySGRUcnRjLytsNCtsdEo0eG1DRFRUUnl0bUg2OUxaR2E5SUdnClNmK3hRTHM1
+            aFc3OEgxVGxjSzJsbmFUU1JISHFodFNGbUVEZFUrQUl6Wm8KLS0tIExHZW9sYVVj
+            VEVBTERwWFozUXU5SnZ4RDNEcWE5RTl2bGhEa0lzbnJCNVkKjZTky9WeA0hPUSaR
+            gEva9lMUWpD7WwEEwWW6qqacBH9KS/4aXDpKRWoLKBDWTz8jASIQTp1Kbh8bnY++
+            9MZmeQ==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICOXg0Qq1bdnrYp+KL6tfLZsMf3KHFfpaP2GMjwmpug2
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGRaVG9vQSBPQWlU
+            U2dLVFBuRnhzMm4wYWJMajA3ak01RVVBNUd0K1dtRFliZ21jVTB3CndTQnpMQUhh
+            ekxFUmJpalF4LzI0b2g2bTZ2WkJlNTJDVVRzZE5LaU9LeXMKLS0tIHRjZUpiU0tO
+            elphbHlhN2dDQnV4Zy9NZ1IrSXpsTDNGMFgyY0V4TUZaak0KzZZjFFiLvsQkJ5/f
+            F+D9gggE782NUNtlLDMw+jDQoZ4hwWOLtVMs6u4HhIV8YlUXNUvbv4eH8kFvXnRj
+            amJUYg==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFecrTXoINyGQkeOLQetR5BC6s9VlJHlCbY02WY5FAnJ
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDgrRFVnUSBpQ0p5
+            R2Z3STFLT1lEU3Q4YTBGUVBmb1g5YXNLMDVLZm5IVG9Sa1RRUUJvClo2Q3Y0ZUw2
+            by9NWXhqYTFaaHZYVWVZVXhNZUZzektwNEJQNnVCckhPcEUKLS0tIDBFMTF1aktt
+            N2Z3dDQra3ZLeEUvdnVXWjVnSFgzb0c0ZVZGa0hIRzlCQ1EKwqtG+us9kyK2aHNq
+            1UgDizAWi/HjJXfMQ71dZ31KFPIht6xZbNmLsl897kdngRqaX0PirGdyvhB/zsN8
+            LjUbqA==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIErl+4GkgJOoaUUOU9gblWJ6FpIls/adHx0YpOUXXxJA
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IEptYzFtUSBmOFI2
+            d2dIbTkwYnlpVmF4UFR5Z1FTcXJRMVNra2Qxc2JCVXNmbWx6N1JvClBSVUhFMUlB
+            Y1gzTWlMMGNGN2IwakxHY2grMG5idUpmMjZyam9UUE9QR0EKLS0tIEU2Z1c1UVQr
+            R0dTVGVGd0FEWXA4cGpUUmNnZUM3R0Y4NTBlS0VDQlJ3U1UKe6mLYY8N1rucWqrg
+            kKJ4mLSM4ttM34bmK05pGh4Sz+kVf+hB9+TgWSmZE85TAtyVDljz25TuNMkT4Rr2
+            2hgY5w==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-01-22T20:56:44Z"
+    mac: ENC[AES256_GCM,data:n59xb1htiLiHcCasgE1c7sRjt5N1iRNl6NC4gPe4WaOsRQN5iKt90ndj1gBpek2gUG1IstbRshV1gGm5JmbL0wRPN1mWW7lelMhjo9Y2BLOZbFPCN1kA1fP0AHLwUryEGv44SEYEBMApwHYsig6ZSka9MTAFVnQnWdA7YT0M7Hg=,iv:T1saLQp2RYFrwivnfqpxfJ3PtXXkxkwFskX5tgdMMEU=,tag:SBx8FhkwIOStsvI3qDtpSw==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.11.0

secrets/services/kanidm.yaml

···
 oauth2-linkwarden: ENC[AES256_GCM,data:9Qva6+boTYp+2H4FoP6uO8uphGuMRq845pFRKaFaSZ9BAPyJndHgqVpSAxbXS6MT,iv:mMQdW5rBddSOa+O6Al0M2/6tP8ECHpQfqzxKx3UO22s=,tag:52F1oJjEHfG8IoKWr00nRA==,type:str]
 oauth2-wakapi: ENC[AES256_GCM,data:2qJ1Cn9wnrpepf8O53PuUtaZueLd6mC8WRIEoRcTH8W0ZALBOsrVA5rgu++373XO,iv:KJ8FThCGmbSfUmIhtisCOowSWpDd6qW5vNmfrGHWe54=,tag:Xs3oNOin3mAvvJBHfdRc8w==,type:str]
 oauth2-immich: ENC[AES256_GCM,data:6Or046zQXUWUytAYXG6hnvCn7E0MTq+9vsqrfGxsbzVYFENblsUoGiKwoQUfBB1V,iv:LtduTwFIZsPAbxeR6GEteND28yz2/UvGwohNhMTnYxk=,tag:mUTgZSrg2F5a/WeGoWRyGA==,type:str]
+oauth2-hostling: ENC[AES256_GCM,data:DAE8jDuqGvqf6xAUUEJH+E58y7JbH2Uqn2rY+dBrM2uZJ76BL43Z9y9ZK0jES9o2,iv:cOTXVNRUfO/on0EAe4zWLCHtfqY/6T+zfshvccwZVs0=,tag:YfKi+t5ynGvvYIM3bHweDg==,type:str]
 sops:
     age:
         - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMQDiHbMSinj8twL9cTgPOfI6OMexrTZyHX27T8gnMj2
···
             W8XAE4/Jgr2rWQWhfXQGNY1nQIib6RNJuvuoqnisRru34jhEb+uK7gPZN65ZpFFY
             Ecy6rA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-12-17T22:10:38Z"
-    mac: ENC[AES256_GCM,data:fIXWKRMGrk3LqLpXOhd7fMb9Jkpay+DTFAZL/J2NItuXD/alI/wLtLb3NVphRhXHv4ZbjqXW9lbNgXomfHN2cFKYajKw8RoVql4QOpjrcWCK3FVTS+YRB3YiecxepVcv0hLg5thV8X6bSgrNmgeZKb3lPaNFmWV9wlfCVA2t/zc=,iv:OLGmXhTmZp3yWGD5uz5iazem/jT+Ckh58l+PsWq6NYY=,tag:SkIVU7Pme07g6STVQVhjPA==,type:str]
+    lastmodified: "2026-01-22T20:00:33Z"
+    mac: ENC[AES256_GCM,data:GD45/UxVFbss72OYXiWh5kK2MEVExDqNgXRQydKzQ36/nj/cNFZlQd3FVVHOkvFPuTZfwt2nv8o3JM6YYdeSTRtGF+Bg2kpHmZo2gwFMBbTCMweZoEqgKl9zaRkjqstn5Eqo3SdLuP9mkEzarYCflHyrIVbEaOfDj8PYMsrTKUI=,iv:68KK4Lr0XDBAC0hfu5v0cf+1Dkro7z/t8YKyGGrL9OM=,tag:Ja5t0T+ogShAgP4awJ552w==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.11.0

systems/minerva/default.nix

···
       blahaj.enable = true;
       kanidm.enable = true;
       mailserver.enable = true;
+      hostling.enable = true;
 
       # web
       nginx.enable = true;