Commit dcdc535

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 7JvPpg T/yS21H3OD2QN8Jkkrkrh++4KFBFlJdeB3o5LP/QMWA
+/XPaJ6pufRxGk0p+niwCdOpkZWcqHzTlw4ROB83aI30
+-> zlj2-grease y;NgQx
+s5TZd2F963pLQrLJx42/Lua8Pc9PCvPp/zvG3OiUGJ893lc
+--- nLb0UrQIFIp4lVn0Tf3fWGhA4wZXbv1iHggmQNoxhhU
+��q{F�TW;?r��!Ҥ�t]��qo�_ؐ�\VKnH뻺Ijv���`sF��5ƌ���Ӳ7cR��|�{R{2Sb��!�C��	p
\ No newline at end of file

@@ -24,6 +24,10 @@
         };
       };
 
+      services.ntfy-sh = {
+        domain = "ntfy.hpcesia.com";
+      };
+
       services.vaultwarden = {
         domain = "vault.hpcesia.com";
       };
@@ -42,6 +46,7 @@
     services.goatcounter
     services.headplane
     services.headscale
+    services.ntfy-sh
     services.vaultwarden
     services.wakapi
   ];

@@ -0,0 +1,84 @@
+{lib, ...}: {
+  den.aspects.services.ntfy-sh = {
+    settings.host = {
+      domain = lib.mkOption {
+        type = lib.types.str;
+      };
+      address = lib.mkOption {
+        type = lib.types.str;
+        default = "127.0.0.1";
+      };
+      port = lib.mkOption {
+        type = lib.types.port;
+        default = 5492;
+      };
+    };
+
+    persist = {
+      directories = [
+        {
+          directory = "/var/lib/ntfy-sh";
+          user = "ntfy-sh";
+          group = "ntfy-sh";
+          mode = "0700";
+        }
+      ];
+    };
+
+    reverseProxy = {host, ...}: let
+      cfg = host.settings.services.ntfy-sh;
+    in {
+      ${cfg.domain} = {
+        port = cfg.port;
+      };
+    };
+
+    nixos = {
+      host,
+      config,
+      ...
+    }: let
+      cfg = host.settings.services.ntfy-sh;
+    in {
+      services.ntfy-sh = {
+        enable = true;
+        environmentFile = config.vaultix.templates.ntfy-sh-env.path;
+        settings = {
+          listen-http = "${cfg.address}:${toString cfg.port}";
+          base-url = "https://${cfg.domain}";
+          auth-file = "/var/lib/ntfy-sh/user.db";
+          auth-default-access = "deny-all";
+          auth-access = [
+            "*:up*:wo"
+          ];
+        };
+      };
+
+      systemd.services.ntfy-sh.serviceConfig.DynamicUser = lib.mkForce false;
+
+      vaultix.secrets = {
+        ntfy-sh-passwd-hpcesia.file = ./passwd-hpcesia.age;
+      };
+
+      vaultix.templates.ntfy-sh-env = {
+        content = let
+          authUsersEnv =
+            lib.concatMapAttrsStringSep ","
+            (user: {
+              passwd,
+              role,
+            }: "${user}:${passwd}:${role}")
+            authUsers;
+          authUsers = {
+            hpcesia = {
+              passwd = config.vaultix.placeholder.ntfy-sh-passwd-hpcesia;
+              role = "admin";
+            };
+          };
+        in ''
+          NTFY_AUTH_USERS=${authUsersEnv}
+        '';
+      };
+    };
+  };
+}

@@ -0,0 +1,8 @@
+age-encryption.org/v1
+-> piv-p256 xCEwtQ As0KrGwRe606NmO5TORcLEs3EQtO63Je2tWtK/D3kgsn
+gpYgvBVdeaj3Lhqbg6W5/TO5oddQfQb/+iFYHf1B3UI
+-> #mUtR-grease %Jh}r=N o1.BL4n gB[E9u+
+Hl5CQzHi/Hp1n0ipWInqxNuPHCL2SOdRtvAXHSXm8k0CeJVDeLaF0Rw0zkykah2W
+t3++jIMGEig
+--- uGtsFJSg9IiryxWyG+6ZGGx8lk4EMl6aOhBbWRovkRo
+����Y�ܰC��
�֏)_�w(���
���Þq��?
�#V�T����;W/�-N��	\qP:t���k�f6��4U4��SZe�EL8
\ No newline at end of file