1{den, ...}: {
  2  den.hosts.mobius = {
  3    settings = {
  4      services.webserver.external = false;
  5      services.webserver.caddy.tailscaleUseHttps = true;
  6
  7      services.forgejo.runner = {
  8        instances = {
  9          internal = {
 10            name = "runner-internal";
 11            servers = {
 12              gateOfInfinity = {
 13                url = "https://git.net.trin.one";
 14                uuid = "53fa1df5-f0dd-423c-91a7-afee2488f253";
 15                tokenFileAged = ./forgejo-runner-goi-token.age;
 16              };
 17            };
 18            labels = [
 19              "ubuntu-latest:docker://ghcr.io/catthehacker/ubuntu:act-latest"
 20              "nixos-latest:docker://git.net.trin.one/hpcesia/nix-act-image:latest-x86_64-linux"
 21            ];
 22            extraSettings = {
 23              container.network = "host";
 24            };
 25          };
 26          codeberg = {
 27            name = "runner-codeberg";
 28            servers = {
 29              codeberge = {
 30                url = "https://codeberg.org";
 31                uuid = "ba3966e6-ad25-4de2-89ec-4b96b9e1965f";
 32                tokenFileAged = ./forgejo-runner-codeberg-token.age;
 33              };
 34            };
 35            labels = [
 36              "nixos-latest:docker://git.net.trin.one/hpcesia/nix-act-image:latest-x86_64-linux"
 37            ];
 38          };
 39        };
 40      };
 41      services.forgejo.server = {
 42        domain = "git.net.trin.one";
 43      };
 44
 45      services.navidrome = {
 46        domain = "navidrome.net.trin.one";
 47      };
 48
 49      services.woodpecker.agent.agents = {
 50        codeberg = {
 51          server = "grpc.ci.codeberg.org:443";
 52          secretFileAged = ./woodpecker-agent-codeberg-token.age;
 53          labels = {
 54            tier = "high";
 55          };
 56        };
 57      };
 58    };
 59  };
 60
 61  den.aspects.mobius = {
 62    includes = with den.aspects; [
 63      services.webserver
 64      services.tailscale-nginx-auth
 65
 66      services.forgejo.runner
 67      services.forgejo.server
 68      services.navidrome
 69      services.woodpecker.agent
 70
 71      {
 72        nixos = {
 73          config,
 74          pkgs,
 75          ...
 76        }: {
 77          # TODO: Remove this workaround if Headscale land it's tailscale cert support.
 78          # See: https://github.com/juanfont/headscale/issues/2527
 79          services.caddy = {
 80            package = pkgs.caddy.withPlugins {
 81              plugins = [
 82                "github.com/caddy-dns/cloudflare@v0.2.4"
 83              ];
 84              hash = "sha256-hEHgAG0F0ozHRAPuxEqLyTATBrE+pajeXDiSNwniorg=";
 85            };
 86            virtualHosts.headscale = {
 87              hostName = "*.net.trin.one";
 88              extraConfig = ''
 89                tls {
 90                  dns cloudflare {env.CF_API_TOKEN}
 91                  resolvers 1.1.1.1 1.0.0.1
 92                }
 93                abort
 94              '';
 95            };
 96          };
 97
 98          systemd.services.caddy.serviceConfig.EnvironmentFile = [config.vaultix.templates.caddy-headscale-env.path];
 99
100          vaultix.secrets.headscale-subnet-tls-cf-token.file = ./tailscale-cloudflare-token.age;
101          vaultix.templates.caddy-headscale-env = {
102            content = ''
103              CF_API_TOKEN=${config.vaultix.placeholder.headscale-subnet-tls-cf-token}
104            '';
105            owner = config.services.caddy.user;
106            group = config.services.caddy.group;
107            mode = "0400";
108          };
109        };
110      }
111    ];
112  };
113}