soupglasses / phenix Goto Github PK

Currently, the system follows an annoying pattern where dependencies are declared as comments suffixing the import.

Implement a more general module system which can handle the requirements on base modules and possibly also be portable between multiple hosts.

Currently, the nixos configurations are not properly backed up. Use restic and pgbackrest to back up relevant important data such that we can properly recover services if a server or host corrupts.

Currently, the source of truth for user accounts is stored under OpenLDAP. Figure out a method such that users can interact with this database, and possibly use SSO like features with it.

Current plan is to use Canaille for this. However Keycloak and Authelia are also strong contenders.

For OpenLDAP, write a script or find a method to initialize users through an automated fashion.

Current required users for building:

• cn=auth,ou=system,dc=byte,dc=surf with password from sops ldap/auth-password
• cn=ttrss,ou=system,dc=byte,dc=surf with password from sops ttrss/ldap-password
• TODO: cn=jellyfin,ou=system,dc=byte,dc=surf with password from sops jellyfin/ldap-password

Use something akin to the design of https://github.com/Infinisil/nixus to allow NixOS's module system to span across multiple host configurations.

Main problem points is that Nixus is not designed for Flake use, so this will require work on our end to enable such a system to work correctly. Deployment is still up in the air.

Currently, a use of root, sudo and trusted-users configuration inside nix is applied to bypass signature verification of built derivations and nix archives (NARs).

Figure out an effective method to generate and apply these. Use sops to avoid having multiple/loose keys.

This has been a forever problem, at least for a year. Where after i fix jellyfin, it will quickly find a way to break itself again within months. This has happened again and i fear its a very niche issue.