1{den, ...}: {
 2  den.hosts.mobius = {
 3    settings = {
 4      services.webserver.external = false;
 5      services.webserver.caddy.tailscaleUseHttps = true;
 6
 7      services.forgejo = {
 8        domain = "git.net.trin.one";
 9      };
10      services.forgejo.runner = {
11        instances.internal = {
12          name = "runner-internal";
13          servers = {
14            gateOfInfinity = {
15              url = "https://git.net.trin.one";
16              uuid = "53fa1df5-f0dd-423c-91a7-afee2488f253";
17              tokenFileAged = ./forgejo-runner-goi-token.age;
18            };
19          };
20          labels = [
21            "ubuntu-latest:docker://ghcr.io/catthehacker/ubuntu:act-latest"
22            "nixos-latest:docker://git.net.trin.one/hpcesia/nix-act-image:latest-x86_64-linux"
23          ];
24          extraSettings = {
25            container.network = "host";
26          };
27        };
28      };
29      services.navidrome = {
30        domain = "navidrome.net.trin.one";
31      };
32      services.woodpecker.agent.agents = {
33        codeberg = {
34          server = "grpc.ci.codeberg.org:443";
35          secretFileAged = ./woodpecker-agent-codeberg-token.age;
36          labels = {
37            tier = "high";
38          };
39        };
40      };
41    };
42  };
43
44  den.aspects.mobius = {
45    includes = with den.aspects; [
46      services.webserver
47      services.tailscale-nginx-auth
48
49      services.forgejo
50      services.forgejo.runner
51      services.navidrome
52      services.woodpecker.agent
53
54      {
55        nixos = {
56          config,
57          pkgs,
58          ...
59        }: {
60          # TODO: Remove this workaround if Headscale land it's tailscale cert support.
61          # See: https://github.com/juanfont/headscale/issues/2527
62          services.caddy = {
63            package = pkgs.caddy.withPlugins {
64              plugins = [
65                "github.com/caddy-dns/cloudflare@v0.2.4"
66              ];
67              hash = "sha256-hEHgAG0F0ozHRAPuxEqLyTATBrE+pajeXDiSNwniorg=";
68            };
69            virtualHosts.headscale = {
70              hostName = "*.net.trin.one";
71              extraConfig = ''
72                tls {
73                  dns cloudflare {env.CF_API_TOKEN}
74                  resolvers 1.1.1.1 1.0.0.1
75                }
76                abort
77              '';
78            };
79          };
80
81          systemd.services.caddy.serviceConfig.EnvironmentFile = [config.vaultix.templates.caddy-headscale-env.path];
82
83          vaultix.secrets.headscale-subnet-tls-cf-token.file = ./tailscale-cloudflare-token.age;
84          vaultix.templates.caddy-headscale-env = {
85            content = ''
86              CF_API_TOKEN=${config.vaultix.placeholder.headscale-subnet-tls-cf-token}
87            '';
88            owner = config.services.caddy.user;
89            group = config.services.caddy.group;
90            mode = "0400";
91          };
92        };
93      }
94    ];
95  };
96}