Implement agenix, fixup for new ISP

coredns/packetlost.dev.hosts

···
 192.168.1.3 plex.packetlost.dev
 192.168.1.3 jellyfin.packetlost.dev
 192.168.1.3 nats.packetlost.dev
-fe80::9ab7:85ff:fe1e:dfe8 plex.packetlost.dev
-fe80::9ab7:85ff:fe1e:dfe8 jellyfin.packetlost.dev
-fe80::9ab7:85ff:fe1e:dfe8 nats.packetlost.dev
-# Old edge proxy was 192.168.1.15
 
 # LAN Hosts
 192.168.1.3 misaki.packetlost.dev misaki
 192.168.1.3 cache.packetlost.dev cache
-#fe80::9ab7:85ff:fe1e:dfe8 misaki.packetlost.dev misaki
 192.168.1.5 komoe.packetlost.dev komoe
 192.168.1.6 rainbow.packetlost.dev rainbow
 192.168.1.10 ichika.packetlost.dev ichika

flake.lock

···
 {
   "nodes": {
+    "agenix": {
+      "inputs": {
+        "darwin": "darwin",
+        "home-manager": "home-manager",
+        "nixpkgs": "nixpkgs",
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1762618334,
+        "narHash": "sha256-wyT7Pl6tMFbFrs8Lk/TlEs81N6L+VSybPfiIgzU8lbQ=",
+        "owner": "ryantm",
+        "repo": "agenix",
+        "rev": "fcdea223397448d35d9b31f798479227e80183f6",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ryantm",
+        "repo": "agenix",
+        "type": "github"
+      }
+    },
+    "darwin": {
+      "inputs": {
+        "nixpkgs": [
+          "agenix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1744478979,
+        "narHash": "sha256-dyN+teG9G82G+m+PX/aSAagkC+vUv0SgUw3XkPhQodQ=",
+        "owner": "lnl7",
+        "repo": "nix-darwin",
+        "rev": "43975d782b418ebf4969e9ccba82466728c2851b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "lnl7",
+        "ref": "master",
+        "repo": "nix-darwin",
+        "type": "github"
+      }
+    },
     "determinate-nixd-aarch64-darwin": {
       "flake": false,
       "locked": {
···
     "home-manager": {
       "inputs": {
         "nixpkgs": [
+          "agenix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1745494811,
+        "narHash": "sha256-YZCh2o9Ua1n9uCvrvi5pRxtuVNml8X2a03qIFfRKpFs=",
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "rev": "abfad3d2958c9e6300a883bd443512c55dfeb1be",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "type": "github"
+      }
+    },
+    "home-manager_2": {
+      "inputs": {
+        "nixpkgs": [
           "nixpkgs"
         ]
       },
···
       "inputs": {
         "flake-parts": "flake-parts",
         "git-hooks-nix": "git-hooks-nix",
-        "nixpkgs": "nixpkgs",
+        "nixpkgs": "nixpkgs_2",
         "nixpkgs-23-11": "nixpkgs-23-11",
         "nixpkgs-regression": "nixpkgs-regression"
       },
···
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1761597516,
-        "narHash": "sha256-wxX7u6D2rpkJLWkZ2E932SIvDJW8+ON/0Yy8+a5vsDU=",
-        "rev": "daf6dc47aa4b44791372d6139ab7b25269184d55",
-        "revCount": 811874,
-        "type": "tarball",
-        "url": "https://api.flakehub.com/f/pinned/NixOS/nixpkgs/0.2505.811874%2Brev-daf6dc47aa4b44791372d6139ab7b25269184d55/019a3494-3498-707e-9086-1fb81badc7fe/source.tar.gz"
+        "lastModified": 1754028485,
+        "narHash": "sha256-IiiXB3BDTi6UqzAZcf2S797hWEPCRZOwyNThJIYhUfk=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "59e69648d345d6e8fef86158c555730fa12af9de",
+        "type": "github"
       },
       "original": {
-        "type": "tarball",
-        "url": "https://flakehub.com/f/NixOS/nixpkgs/0.2505"
+        "owner": "NixOS",
+        "ref": "nixos-25.05",
+        "repo": "nixpkgs",
+        "type": "github"
       }
     },
     "nixpkgs-23-11": {
···
     },
     "nixpkgs_2": {
       "locked": {
+        "lastModified": 1761597516,
+        "narHash": "sha256-wxX7u6D2rpkJLWkZ2E932SIvDJW8+ON/0Yy8+a5vsDU=",
+        "rev": "daf6dc47aa4b44791372d6139ab7b25269184d55",
+        "revCount": 811874,
+        "type": "tarball",
+        "url": "https://api.flakehub.com/f/pinned/NixOS/nixpkgs/0.2505.811874%2Brev-daf6dc47aa4b44791372d6139ab7b25269184d55/019a3494-3498-707e-9086-1fb81badc7fe/source.tar.gz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://flakehub.com/f/NixOS/nixpkgs/0.2505"
+      }
+    },
+    "nixpkgs_3": {
+      "locked": {
         "lastModified": 1764494334,
         "narHash": "sha256-x2xCEXUlU4Ap56+t5HaoReOQ/bV/bIQ5rzTn/m+V3HQ=",
         "owner": "nixos",
···
         "type": "github"
       }
     },
-    "nixpkgs_3": {
+    "nixpkgs_4": {
       "locked": {
         "lastModified": 1759417375,
         "narHash": "sha256-O7eHcgkQXJNygY6AypkF9tFhsoDQjpNEojw3eFs73Ow=",
···
       "inputs": {
         "flake-compat": "flake-compat_2",
         "gitignore": "gitignore",
-        "nixpkgs": "nixpkgs_3"
+        "nixpkgs": "nixpkgs_4"
       },
       "locked": {
         "lastModified": 1763988335,
···
     },
     "root": {
       "inputs": {
+        "agenix": "agenix",
         "determinite": "determinite",
-        "home-manager": "home-manager",
-        "nixpkgs": "nixpkgs_2",
+        "home-manager": "home-manager_2",
+        "nixpkgs": "nixpkgs_3",
         "nixpkgs-unstable": "nixpkgs-unstable",
         "pre-commit-hooks": "pre-commit-hooks"
+      }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
       }
     }
   },

flake.nix

···
       inputs.nixpkgs.follows = "nixpkgs";
     };
     pre-commit-hooks.url = "github:cachix/git-hooks.nix";
+    agenix.url = "github:ryantm/agenix";
   };
 
   outputs =
···
     , determinite
     , home-manager
     , pre-commit-hooks
+    , agenix
     , ...
     }@inputs:
     let
···
           (final: prev: {
             # Override the version of Plex installed to be the latest
             plexRaw = prev.plexRaw.overrideAttrs rec {
-              version = "1.43.0.10346-fc911a729";
+              version = "1.43.0.10389-8be686aa6";
               src = final.fetchurl {
                 url = "https://downloads.plex.tv/plex-media-server-new/${version}/debian/plexmediaserver_${version}_amd64.deb";
-                sha256 = "jfQ11luQoafUYb5sGpvE7jPiErGt2HXVLwn70M/Hqyc=";
+                sha256 = "0HjB8Ggekwl5dKwM1Kh51Ic25t3V6veKbuzM7czrpeg=";
               };
             };
             ## Override the json object that contains verions and hashes for Immich
···
     {
       nixosConfigurations.${name} = inputs.nixpkgs.lib.nixosSystem {
         inherit system;
-        specialArgs = { inherit unstable; };
+        specialArgs = { inherit unstable inputs; };
         modules = [
           determinite.nixosModules.default
           ./configuration.nix
+          agenix.nixosModules.default
           home-manager.nixosModules.home-manager
           {
             home-manager.useGlobalPkgs = true;

packages.nix

···
-{ pkgs, lib, ... }:
+{ pkgs, lib, inputs, ... }:
 let # bash script to let dbus know about important env variables and
   # propagate them to relevent services run at the end of sway config
   # see
···
     vis
     rc
     ncdu
+    inputs.agenix.packages."${system}".agenix
 
     # ZFS / filesystem stuff
     zfs

secrets/porkbun-api-key.age

···
+age-encryption.org/v1
+-> ssh-ed25519 e6zq8g CdLTZ6uXiJB+xaD+I5NVHD5OxLSH+yAz99j04GiKukU
+kQTUR4yK23wHV9QGMlmTmIlMh63nP49g1NrS+sJKfBY
+--- H6/xHryPPKmAWW/bDXUN4YBXMKrsFpUAveKxWsT0SH0
+�E����,�ήS��P)A.������9O\�����2n��U�!���X�a���l�Z�4*(G�[��>�Zl�
+:QՅ���������o����$=��& ڍ�w�t^�<<E�0p�8��:����G�̉����J#�QR�����p�򘐞�kA,�=!��5�KK��0o��nQ��)�\\�ĘN�����wQ�҉

secrets/secrets.nix

···
+let
+  noah = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDQFlX3hhXxsqAUYLvF+IX1YWQ+k22OHlqMOjgyNBe9e noah@misaki";
+  misaki = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO+Rcf4Lr+JPWGKQol6eAml6SMgERkGJWgN7y1qYUUvX root@nixos";
+  #users = [noah];
+in
+{
+  "porkbun-api-key.age".publicKeys = [ noah misaki ];
+}

services.nix

···
 , lib
 , pkgs
 , unstable
-, system
 , ...
 }:
-let
-  #unstable = import unstable {
-  #  inherit system;
-  #  config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [
-  #    "plexmediaserver"
-  #    "teamspeak-server"
-  #  ];
-  #  overlays = [
-  #    (final: prev: {
-  #      # Override the version of Plex installed to be the latest
-  #      plexRaw = prev.plexRaw.overrideAttrs rec {
-  #        version = "1.43.0.10346-fc911a729";
-  #        src = final.fetchurl {
-  #          url = "https://downloads.plex.tv/plex-media-server-new/${version}/debian/plexmediaserver_${version}_amd64.deb";
-  #          sha256 = "jfQ11luQoafUYb5sGpvE7jPiErGt2HXVLwn70M/Hqyc=";
-  #        };
-  #      };
-  #      ## Override the json object that contains verions and hashes for Immich
-  #      #immich = prev.immich.override { sourcesJSON = ./overrides/immich-sources.json; };
-  #      ## Fix errors wit numpy version failing to resolve in the immich ML package
-  #      #immich-machine-learning = prev.immich-machine-learning.overrideAttrs
-  #      #  (finalAttrs: prevAttrs: {
-  #      #    pythonRelaxDeps = prevAttrs.pythonRelaxDeps ++ [ "numpy" ];
-  #      #  });
-  #    })
-  #  ];
-  #};
-  #age = import <agenix/modules/age.nix> { };
-in
 {
 
   services.zfs = {
···
     settings = builtins.fromJSON (builtins.readFile /home/noah/.step/config/ca.json);
   };
 
+  age.secrets.acme = {
+    file = ./secrets/porkbun-api-key.age;
+    owner = "root";
+    group = "acme";
+  };
+
+  # TODO: re-enable this once Agenix is set up
   security.acme = {
     acceptTerms = true;
     defaults.email = "[e-mail]";
     certs."plex.packetlost.dev" = {
+      dnsProvider = "porkbun";
       group = "httpd";
+      environmentFile = config.age.secrets.acme.path;
     };
     certs."img.ngp.computer" = {
       group = "httpd";
+      dnsProvider = "porkbun";
+      environmentFile = config.age.secrets.acme.path;
+    };
+    certs."photos.ngp.computer" = {
+      group = "httpd";
+      dnsProvider = "porkbun";
+      environmentFile = config.age.secrets.acme.path;
+    };
+    certs."jellyfin.packetlost.dev" = {
+      group = "httpd";
+      dnsProvider = "porkbun";
+      environmentFile = config.age.secrets.acme.path;
     };
   };
 
···
       #  wantedBy = [ "multi-user.target" ];
       #};
       "update-downstream-src" = {
-        path = with pkgs; [ rc coreutils git openssh ];
+        path = with pkgs; [
+          rc
+          coreutils
+          git
+          openssh
+        ];
         script = "exec ${./scripts/update-src}";
         serviceConfig = {
           Type = "oneshot";
···
     accelerationDevices = [ "/dev/dri/renderD128" ];
     mediaLocation = "/srv/shokuhou/pictures/immich";
   };
-  users.users.immich.extraGroups = [ "video" "render" "nas" ];
+  users.users.immich.extraGroups = [
+    "video"
+    "render"
+    "nas"
+  ];
 
   # Nginx Reverse SSL Proxy
   services.nginx = {
···
         "http://${config.services.nix-serve.bindAddress}:${toString config.services.nix-serve.port}";
     };
     virtualHosts."photos.ngp.computer" = {
-      enableACME = true;
+      enableACME = false;
+      useACMEHost = "photos.ngp.computer";
+      acmeRoot = null;
       forceSSL = true;
       locations."/" = {
         proxyPass = "http://[::1]:${toString config.services.immich.port}";
···
     };
     virtualHosts."img.ngp.computer" = {
       forceSSL = true;
-      enableACME = true;
+      enableACME = false;
+      useACMEHost = "img.ngp.computer";
+      acmeRoot = null;
       root = "/srv/shokuhou/pictures/public";
       extraConfig = ''
         sendfile on;
···
     };
     virtualHosts."jellyfin.packetlost.dev" = {
       forceSSL = true;
-      enableACME = true;
+      enableACME = false;
+      useACMEHost = "jellyfin.packetlost.dev";
+      acmeRoot = null;
       http2 = true;
       locations."/" = {
         proxyPass = "http://localhost:8096/";
···
     virtualHosts."plex.packetlost.dev" = {
       # Since we want a secure connection, we force SSL
       forceSSL = true;
-      enableACME = true;
+      enableACME = false;
+      useACMEHost = "plex.packetlost.dev";
+      acmeRoot = null;
 
       # http2 can more performant for streaming: https://blog.cloudflare.com/introducing-http2/
       http2 = true;