Remove Actual, add Karakeep and Home Assistant

Justfile

@@ -64,7 +64,7 @@ terraform *args:
     terraform -chdir=./deploy/terraform/ {{ args }}
 
 edit-secret file:
-    EDITOR="code --wait" sops {{ file }}
+    EDITOR="zeditor --wait" sops {{ file }}
 
 push-result-to-cache:
     cachix push e10 result

hosts/bastion/profiles/authelia/default.nix

@@ -47,8 +47,11 @@
       };
 
       identity_providers.oidc = {
-        claims_policies.legacy.id_token =
-          [ "email" "email_verified" "preferred_username" "name" ];
+        claims_policies = {
+          karakeep.id_token = [ "email" ];
+          legacy.id_token =
+            [ "email" "email_verified" "preferred_username" "name" ];
+        };
 
         clients = [
           {
@@ -129,31 +132,31 @@
           }
           {
             client_id =
-              "pV6drSFL4uNhslIfnTxi~oDMhqTIVVWM~307jSrBE9CNPuuwqMRDwYnW0PG6tYYL5HqCpFJu";
-            client_name = "Actual Budget";
+              "4_PUhlKbm03-XaIAR-tBOzaCkf6dQfhgBY-xnrewL5jsOCp0UXPsbSvnaxgLXEp6kKsqjqND";
+            client_name = "Karakeep";
             client_secret =
-              "$pbkdf2-sha512$310000$78au487f6p.HXge7fFeMcQ$FXpI9224tVfyMNkyLj3sqtP.gWUUN./gJemo3l0KcwjVseC0Wlqe50LsYtm6lBBzRXuBxAa/Jhw2q3EaIGMd3A";
+              "$pbkdf2-sha512$310000$XuC9/i/.AWXy/G4A/aOazw$ZozktGPjpHfhmjEzdhNsjeLMw/XhbRK/ePqRPfzbTA04pEOlFTOon2s.yWYyuQv5wzCp0QUGHz2gkczfZsetyQ";
             public = false;
             authorization_policy = "two_factor";
             require_pkce = false;
             pkce_challenge_method = "";
-            redirect_uris = [ "https://actual.e10.camp/openid/callback" ];
-            scopes = [ "openid" "profile" "groups" "email" ];
+            redirect_uris =
+              "https://karakeep.e10.camp/api/auth/callback/custom";
+            scopes = [ "openid" "profile" "email" ];
             response_types = [ "code" ];
             grant_types = [ "authorization_code" ];
             access_token_signed_response_alg = "none";
             userinfo_signed_response_alg = "none";
             token_endpoint_auth_method = "client_secret_basic";
+            claims_policy = "karakeep";
           }
         ];
       };
 
       session.cookies = [{
         domain = "e10.camp";
         authelia_url = "https://auth.e10.camp";
-        inactivity = "1M";
-        expiration = "3M";
-        remember_me = "1y";
+        expiration = "1y";
       }];
 
       access_control.rules = lib.mkBefore [
@@ -189,15 +192,6 @@
           domain = "pdf.e10.camp";
           policy = "two_factor";
         }
-        {
-          domain = "bazarr.e10.camp";
-          policy = "bypass";
-          resources = [ "^/api([/?].*)?$" ];
-        }
-        {
-          domain = "bazarr.e10.camp";
-          policy = "two_factor";
-        }
         {
           domain = "mazanoke.e10.camp";
           policy = "two_factor";

hosts/bastion/profiles/caddy/default.nix

@@ -101,7 +101,6 @@
       "bazarr.e10.camp" = {
         host = hosts.htpc;
         port = hosts.htpc.config.services.bazarr.listenPort;
-        protected = true;
       };
 
       "profilarr.e10.camp" = {
@@ -261,11 +260,6 @@
         inherit (hosts.controller.config.services.termix) port;
       };
 
-      "actual.e10.camp" = {
-        host = hosts.matrix;
-        inherit (hosts.matrix.config.services.actual.settings) port;
-      };
-
       "bichon.e10.camp" = {
         host = hosts.matrix;
         inherit (hosts.matrix.config.services.bichon) port;
@@ -283,6 +277,16 @@
         '';
       };
 
+      "karakeep.e10.camp" = {
+        host = hosts.matrix;
+        port = hosts.matrix.config.services.karakeep.extraEnvironment.PORT;
+      };
+
+      "hass.e10.camp" = {
+        host = hosts.matrix;
+        port = 8123;
+      };
+
       "e10.video" = {
         host = hosts.htpc;
         inherit (hosts.htpc.config.services.plex) port;

hosts/matrix/configuration.nix

@@ -9,20 +9,21 @@
       profiles.media-management.immich.default
       profiles.networking.printing
       profiles.power.tripp-lite-smart1500lcd
-      profiles.services.actual.default
       profiles.services.attic-watch-store.default
       profiles.services.bichon
       profiles.services.bentopdf
       profiles.services.changedetection-io
       profiles.services.e10-land
       profiles.services.glance.default
+      profiles.services.home-assistant.default
       profiles.services.mazanoke
       profiles.services.miniflux.default
       profiles.services.netbox.default
       profiles.services.paperless.default
       profiles.telemetry.prometheus-nut-exporter
       profiles.virtualisation.docker
       profiles.web-servers.caddy
+      profiles.services.karakeep.default
     ] ++ [ ./hardware-configuration.nix ./disk-config.nix ];
 
   boot.loader.grub.devices =

modules/nixos/services/eufy-security-ws/default.nix

@@ -0,0 +1,78 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let cfg = config.services.eufy-security-ws;
+in {
+  options.services.eufy-security-ws = {
+    enable = mkEnableOption "Enable Eufy";
+
+    dataDir = mkOption {
+      type = types.path;
+      default = "/var/lib/eufy-security-ws";
+    };
+
+    host = mkOption {
+      type = types.str;
+      default = "localhost";
+    };
+
+    port = mkOption {
+      type = types.port;
+      default = 3000;
+    };
+
+    configurationFile = mkOption { type = types.path; };
+
+    openFirewall = mkOption {
+      type = types.bool;
+      default = false;
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.tmpfiles.settings."10-eufy-security-ws" = {
+      ${cfg.dataDir} = {
+        "d" = {
+          user = "eufy-security";
+          group = "eufy-security";
+          mode = "0700";
+        };
+      };
+    };
+
+    systemd.services.eufy-security-ws = {
+      enable = true;
+      description = "eufy-security-ws";
+      wants = [ "network-online.target" ];
+      after = [ "network-online.target" ];
+      wantedBy = [ "multi-user.target" ];
+      reloadTriggers = [ cfg.configurationFile ];
+      serviceConfig = {
+        ExecStart = ''
+          ${pkgs.eufy-security-ws}/bin/eufy-security-server \
+            --config ${cfg.configurationFile} \
+            --host ${cfg.host} \
+            --port ${toString cfg.port}
+        '';
+        ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
+        WorkingDirectory = "/var/lib/eufy-security-ws";
+        User = "eufy-security";
+        Group = "eufy-security";
+        Restart = "on-failure";
+        RestartForceExitStatus = "100";
+        SuccessExitStatus = "100";
+      };
+    };
+
+    users = {
+      users.eufy-security = {
+        isSystemUser = true;
+        group = "eufy-security";
+      };
+      groups.eufy-security = { };
+    };
+
+    networking.firewall.allowedTCPPorts = optional cfg.openFirewall cfg.port;
+  };
+}

modules/overlays/default.nix

@@ -21,7 +21,8 @@
       inherit (nixpkgs-master) thanos;
 
       inherit (self'.packages)
-        bentopdf fileflows mongodb-ce-6_0; # caddy-with-plugins;
+        bentopdf fileflows mongodb-ce-6_0
+        eufy-security-ws; # caddy-with-plugins;
     };
   };
 }

modules/packages/default.nix

@@ -4,6 +4,7 @@ _: {
       bentopdf = pkgs.callPackage ./bentopdf { };
       fileflows = pkgs.callPackage ./fileflows { };
       mongodb-ce-6_0 = pkgs.callPackage ./mongodb-ce-6_0 { };
+      eufy-security-ws = pkgs.callPackage ./eufy-security-ws { };
     };
   };
 }

modules/packages/eufy-security-ws/default.nix

@@ -0,0 +1,21 @@
+{ buildNpmPackage, fetchFromGitHub, lib, }:
+buildNpmPackage rec {
+  pname = "eufy-security-ws";
+  version = "1.9.7";
+
+  src = fetchFromGitHub {
+    owner = "bropat";
+    repo = "eufy-security-ws";
+    tag = version;
+    hash = "sha256-K9xSJ8W0doxgfXzvg+w32SgFfWuPPyrEUCq3BUE+0wQ=";
+  };
+
+  npmDepsHash = "sha256-/ck+R4cKFb0+CxmrjR+4riHmgdy0m8FUQvarn66QinA=";
+
+  meta = {
+    description =
+      "Small server wrapper around eufy-security-client library to access it via a WebSocket";
+    homepage = "https://github.com/bropat/eufy-security-ws";
+    license = lib.licenses.mit;
+  };
+}

modules/profiles/observability/gatus/default.nix

@@ -182,7 +182,6 @@ in { config, lib, ... }: {
             name = "Bazarr";
             url = "https://bazarr.e10.camp";
             group = "HTPC";
-            protected = true;
           })
           (mkEndpoint {
             name = "SABnzbd";
@@ -297,13 +296,18 @@ in { config, lib, ... }: {
             protected = true;
           })
           (mkEndpoint {
-            name = "Actual Budget";
-            url = "https://actual.e10.camp";
+            name = "Bichon";
+            url = "https://bichon.e10.camp";
             group = "Matrix";
           })
           (mkEndpoint {
-            name = "Bichon";
-            url = "https://bichon.e10.camp";
+            name = "Karakeep";
+            url = "https://karakeep.e10.camp";
+            group = "Matrix";
+          })
+          (mkEndpoint {
+            name = "Home Assistant";
+            url = "https://hass.e10.camp";
             group = "Matrix";
           })
         ];