Update flake.lock

chore: adds discord and gitnuro flatpaks
chore: remove old stuff
2025-10-30 16:22:07 +01:00 · 2025-10-30 16:22:03 +01:00 · 2025-10-30 16:21:17 +01:00 · 2025-10-28 08:36:44 +01:00 · 2025-10-28 08:36:26 +01:00 · 2025-10-26 00:24:17 +00:00
7 changed files with 321 additions and 46 deletions
--- a/README.md
+++ b/README.md
@@ -41,15 +41,6 @@ Run the `dotf update` command, although the setup script did most of the work so
 dotf update
 ```

-### 5. Decrypt secrets
-
-Either using 1Password or by manualling providing the decryption key you should decrypt the secrets.
-Various configurations depend on the secrets to be decrypted such as the SSH keys, yubikey pam configuration and more.
-
-```bash
-dotf secrets decrypt
-```
-
 ### 6. Profit

 You should now have a fully setup system with all the configurations applied.
--- a/ansible/group_vars/servers.yml
+++ b/ansible/group_vars/servers.yml
@@ -2,30 +2,81 @@
 flatpaks: false
 install_ui_apps: false

+# European countries for EU-specific access control
+eu_countries_codes:
+    - AL # Albania
+    - AD # Andorra
+    - AM # Armenia
+    - AT # Austria
+    - AZ # Azerbaijan
+    # - BY # Belarus (Belarus is disabled due to geopolitical reasons)
+    - BE # Belgium
+    - BA # Bosnia and Herzegovina
+    - BG # Bulgaria
+    - HR # Croatia
+    - CY # Cyprus
+    - CZ # Czech Republic
+    - DK # Denmark
+    - EE # Estonia
+    - FI # Finland
+    - FR # France
+    - GE # Georgia
+    - DE # Germany
+    - GR # Greece
+    - HU # Hungary
+    - IS # Iceland
+    - IE # Ireland
+    - IT # Italy
+    - XK # Kosovo
+    - LV # Latvia
+    - LI # Liechtenstein
+    - LT # Lithuania
+    - LU # Luxembourg
+    - MK # North Macedonia
+    - MT # Malta
+    - MD # Moldova
+    - MC # Monaco
+    - ME # Montenegro
+    - NL # Netherlands
+    - NO # Norway
+    - PL # Poland
+    - PT # Portugal
+    - RO # Romania
+    # - RU # Russia (Russia is disabled due to geopolitical reasons)
+    - SM # San Marino
+    - RS # Serbia
+    - SK # Slovakia
+    - SI # Slovenia
+    - ES # Spain
+    - SE # Sweden
+    - CH # Switzerland
+    - TR # Turkey
+    - UA # Ukraine
+    - GB # United Kingdom
+    - VA # Vatican City
+
+# Trusted non-EU countries for extended access control
+trusted_countries_codes:
+    - US # United States
+    - AU # Australia
+    - NZ # New Zealand
+    - JP # Japan
+
 # Countries that are allowed to access the server Caddy reverse proxy
 allowed_countries_codes:
-  - US # United States
-  - CA # Canada
-  - GB # United Kingdom
-  - DE # Germany
-  - FR # France
-  - ES # Spain
-  - IT # Italy
-  - NL # Netherlands
-  - AU # Australia
-  - NZ # New Zealand
-  - JP # Japan
-  - KR # South Korea
-  - SK # Slovakia
-  - FI # Finland
-  - DK # Denmark
-  - SG # Singapore
-  - AT # Austria
-  - CH # Switzerland
-
-# IP ranges for blocked countries (generated automatically)
-# This will be populated by the country blocking script
-blocked_countries: []
+    - US # United States
+    - GB # United Kingdom
+    - DE # Germany
+    - FR # France
+    - IT # Italy
+    - NL # Netherlands
+    - JP # Japan
+    - KR # South Korea
+    - CH # Switzerland
+    - AU # Australia (Added for UpDown.io to monitor server uptime)
+    - CA # Canada (Added for UpDown.io to monitor server uptime)
+    - FI # Finland (Added for UpDown.io to monitor server uptime)
+    - SG # Singapore (Added for UpDown.io to monitor server uptime)

 # Enable/disable country blocking globally
 enable_country_blocking: true
--- a/ansible/tasks/servers/services/caddy/Caddyfile.j2
+++ b/ansible/tasks/servers/services/caddy/Caddyfile.j2
@@ -28,22 +28,74 @@
 }
 {% endif %}

-# European country allow list - allows all European countries
+# European country allow list - allows all European countries only
+{% if eu_countries_codes | default([]) | length > 0 %}
 (eu_country_allow) {
-    @allowed_local {
+    @eu_allowed_local {
        remote_ip 127.0.0.1 ::1 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 157.180.41.167 2a01:4f9:c013:1a13::1
    }
-    @not_allowed_countries {
+    @eu_not_allowed_countries {
        not remote_ip 127.0.0.1 ::1 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 157.180.41.167 2a01:4f9:c013:1a13::1
        not {
            maxmind_geolocation {
                db_path "/etc/caddy/geoip/GeoLite2-Country.mmdb"
-                allow_countries AL AD AM AT AZ BY BE BA BG HR CY CZ DK EE FI FR GE DE GR HU IS IE IT XK LV LI LT LU MK MT MD MC ME NL NO PL PT RO SM RS SK SI ES SE CH TR UA GB VA
+                allow_countries {{ eu_countries_codes | join(' ') }}
            }
        }
    }
-    respond @not_allowed_countries "Access denied" 403
+    respond @eu_not_allowed_countries "Access denied" 403
 }
+{% else %}
+(eu_country_allow) {
+    # EU country allow list disabled
+}
+{% endif %}
+
+# Trusted country allow list - allows US, Australia, New Zealand, and Japan
+{% if trusted_countries_codes | default([]) | length > 0 %}
+(trusted_country_allow) {
+    @trusted_allowed_local {
+        remote_ip 127.0.0.1 ::1 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 157.180.41.167 2a01:4f9:c013:1a13::1
+    }
+    @trusted_not_allowed_countries {
+        not remote_ip 127.0.0.1 ::1 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 157.180.41.167 2a01:4f9:c013:1a13::1
+        not {
+            maxmind_geolocation {
+                db_path "/etc/caddy/geoip/GeoLite2-Country.mmdb"
+                allow_countries {{ trusted_countries_codes | join(' ') }}
+            }
+        }
+    }
+    respond @trusted_not_allowed_countries "Access denied" 403
+}
+{% else %}
+(trusted_country_allow) {
+    # Trusted country allow list disabled
+}
+{% endif %}
+
+# Sathub country allow list - combines EU and trusted countries
+{% if eu_countries_codes | default([]) | length > 0 and trusted_countries_codes | default([]) | length > 0 %}
+(sathub_country_allow) {
+    @sathub_allowed_local {
+        remote_ip 127.0.0.1 ::1 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 157.180.41.167 2a01:4f9:c013:1a13::1
+    }
+    @sathub_not_allowed_countries {
+        not remote_ip 127.0.0.1 ::1 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 157.180.41.167 2a01:4f9:c013:1a13::1
+        not {
+            maxmind_geolocation {
+                db_path "/etc/caddy/geoip/GeoLite2-Country.mmdb"
+                allow_countries {{ (eu_countries_codes + trusted_countries_codes) | join(' ') }}
+            }
+        }
+    }
+    respond @sathub_not_allowed_countries "Access denied" 403
+}
+{% else %}
+(sathub_country_allow) {
+    # Sathub country allow list disabled
+}
+{% endif %}

 {% if inventory_hostname == 'mennos-server' %}
 git.mvl.sh {
@@ -89,7 +141,7 @@ beszel.vleeuwen.me {
 }

 sathub.de {
-   import eu_country_allow
+   import sathub_country_allow

   handle {
       reverse_proxy sathub-frontend:4173
@@ -110,13 +162,13 @@ sathub.de {
 }

 api.sathub.de {
-   import eu_country_allow
+   import sathub_country_allow
   reverse_proxy sathub-backend:4001
   tls {{ caddy_email }}
 }

 sathub.nl {
-   import eu_country_allow
+   import sathub_country_allow
   redir https://sathub.de{uri}
   tls {{ caddy_email }}
 }
--- a/ansible/tasks/workstations/flatpaks.yml
+++ b/ansible/tasks/workstations/flatpaks.yml
@@ -41,12 +41,13 @@
      # Multimedia
      - com.plexamp.Plexamp
      - tv.plex.PlexDesktop
+      - com.spotify.Client

      # Messaging
      - com.rtosta.zapzap
      - org.telegram.desktop
      - org.signal.Signal
-      - com.spotify.Client
+      - com.discordapp.Discord

      # 3D Printing
      - com.bambulab.BambuStudio
@@ -74,6 +75,7 @@
      - io.github.bytezz.IPLookup
      - org.gaphor.Gaphor
      - io.dbeaver.DBeaverCommunity
+      - com.jetpackduba.Gitnuro

 - name: Define system desired Flatpak remotes
  ansible.builtin.set_fact:
--- a/ansible/tasks/workstations/vicinae.yml
+++ b/ansible/tasks/workstations/vicinae.yml
@@ -0,0 +1,175 @@
+---
+- name: Install Vicinae
+  block:
+    - name: Set Vicinae version
+      ansible.builtin.set_fact:
+        vicinae_version: "v0.15.6"
+        vicinae_appimage_commit: "13865b4c5"
+
+    - name: Set architecture-specific variables
+      ansible.builtin.set_fact:
+        vicinae_arch: "{{ 'x86_64' if ansible_architecture == 'x86_64' else ansible_architecture }}"
+
+    - name: Ensure /opt/vicinae directory exists
+      ansible.builtin.file:
+        path: "/opt/vicinae"
+        state: directory
+        mode: "0755"
+      become: true
+
+    - name: Download Vicinae AppImage
+      ansible.builtin.get_url:
+        url: "https://github.com/vicinaehq/vicinae/releases/download/{{ vicinae_version }}/Vicinae-{{ vicinae_appimage_commit }}-{{ vicinae_arch }}.AppImage"
+        dest: "/opt/vicinae/vicinae.AppImage"
+        mode: "0755"
+      become: true
+
+    - name: Remove old Vicinae binary if exists
+      ansible.builtin.file:
+        path: "/usr/local/bin/vicinae"
+        state: absent
+      become: true
+
+    - name: Create symlink to Vicinae AppImage
+      ansible.builtin.file:
+        src: "/opt/vicinae/vicinae.AppImage"
+        dest: "/usr/local/bin/vicinae"
+        state: link
+      become: true
+
+    - name: Create temporary directory for Vicinae assets download
+      ansible.builtin.tempfile:
+        state: directory
+        suffix: vicinae
+      register: vicinae_temp_dir
+
+    - name: Download Vicinae tarball for assets
+      ansible.builtin.get_url:
+        url: "https://github.com/vicinaehq/vicinae/releases/download/{{ vicinae_version }}/vicinae-linux-{{ vicinae_arch }}-{{ vicinae_version }}.tar.gz"
+        dest: "{{ vicinae_temp_dir.path }}/vicinae.tar.gz"
+        mode: "0644"
+
+    - name: Extract Vicinae tarball
+      ansible.builtin.unarchive:
+        src: "{{ vicinae_temp_dir.path }}/vicinae.tar.gz"
+        dest: "{{ vicinae_temp_dir.path }}"
+        remote_src: true
+
+    - name: Ensure systemd user directory exists
+      ansible.builtin.file:
+        path: "/usr/lib/systemd/user"
+        state: directory
+        mode: "0755"
+      become: true
+
+    - name: Copy systemd user service
+      ansible.builtin.copy:
+        src: "{{ vicinae_temp_dir.path }}/lib/systemd/user/vicinae.service"
+        dest: "/usr/lib/systemd/user/vicinae.service"
+        mode: "0644"
+        remote_src: true
+      become: true
+
+    - name: Update systemd service to use AppImage
+      ansible.builtin.replace:
+        path: "/usr/lib/systemd/user/vicinae.service"
+        regexp: "ExecStart=.*"
+        replace: "ExecStart=/usr/local/bin/vicinae"
+      become: true
+
+    - name: Ensure applications directory exists
+      ansible.builtin.file:
+        path: "/usr/share/applications"
+        state: directory
+        mode: "0755"
+      become: true
+
+    - name: Copy desktop files
+      ansible.builtin.copy:
+        src: "{{ vicinae_temp_dir.path }}/share/applications/{{ item }}"
+        dest: "/usr/share/applications/{{ item }}"
+        mode: "0644"
+        remote_src: true
+      become: true
+      loop:
+        - vicinae.desktop
+        - vicinae-url-handler.desktop
+
+    - name: Update desktop files to use AppImage
+      ansible.builtin.replace:
+        path: "/usr/share/applications/{{ item }}"
+        regexp: "Exec=.*vicinae"
+        replace: "Exec=/usr/local/bin/vicinae"
+      become: true
+      loop:
+        - vicinae.desktop
+        - vicinae-url-handler.desktop
+
+    - name: Ensure Vicinae share directory exists
+      ansible.builtin.file:
+        path: "/usr/share/vicinae"
+        state: directory
+        mode: "0755"
+      become: true
+
+    - name: Copy Vicinae themes directory
+      ansible.builtin.copy:
+        src: "{{ vicinae_temp_dir.path }}/share/vicinae/themes/"
+        dest: "/usr/share/vicinae/themes/"
+        mode: "0644"
+        remote_src: true
+      become: true
+
+    - name: Ensure hicolor icons directory exists
+      ansible.builtin.file:
+        path: "/usr/share/icons/hicolor/512x512/apps"
+        state: directory
+        mode: "0755"
+      become: true
+
+    - name: Copy Vicinae icon
+      ansible.builtin.copy:
+        src: "{{ vicinae_temp_dir.path }}/share/icons/hicolor/512x512/apps/vicinae.png"
+        dest: "/usr/share/icons/hicolor/512x512/apps/vicinae.png"
+        mode: "0644"
+        remote_src: true
+      become: true
+
+    - name: Update desktop database
+      ansible.builtin.command:
+        cmd: update-desktop-database /usr/share/applications
+      become: true
+      changed_when: false
+
+    - name: Update icon cache
+      ansible.builtin.command:
+        cmd: gtk-update-icon-cache /usr/share/icons/hicolor
+      become: true
+      changed_when: false
+      failed_when: false
+
+    - name: Clean up temporary directory
+      ansible.builtin.file:
+        path: "{{ vicinae_temp_dir.path }}"
+        state: absent
+
+    - name: Verify Vicinae installation
+      ansible.builtin.command:
+        cmd: /usr/local/bin/vicinae --version
+      register: vicinae_version_check
+      changed_when: false
+      failed_when: false
+
+    - name: Display installation result
+      ansible.builtin.debug:
+        msg: |
+          {% if vicinae_version_check.rc == 0 %}
+          ✓ Vicinae AppImage installed successfully with all themes and assets!
+          Version: {{ vicinae_version_check.stdout }}
+          {% else %}
+          ✗ Vicinae installation completed but version check failed.
+          This may be normal if --version flag is not supported.
+          Try running: vicinae
+          {% endif %}
+  tags:
+    - vicinae
--- a/ansible/tasks/workstations/workstation.yml
+++ b/ansible/tasks/workstations/workstation.yml
@@ -42,6 +42,10 @@
      ansible.builtin.import_tasks: tasks/workstations/autostart.yml
      when: "'microsoft-standard-WSL2' not in ansible_kernel"

+    - name: Include Vicinae tasks
+      ansible.builtin.import_tasks: tasks/workstations/vicinae.yml
+      when: "'microsoft-standard-WSL2' not in ansible_kernel"
+
    - name: Ensure workstation common packages are installed
      ansible.builtin.package:
        name:
--- a/flake.lock
+++ b/flake.lock
@@ -41,11 +41,11 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1761173472,
-        "narHash": "sha256-m9W0dYXflzeGgKNravKJvTMR4Qqa2MVD11AwlGMufeE=",
+        "lastModified": 1761597516,
+        "narHash": "sha256-wxX7u6D2rpkJLWkZ2E932SIvDJW8+ON/0Yy8+a5vsDU=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "c8aa8cc00a5cb57fada0851a038d35c08a36a2bb",
+        "rev": "daf6dc47aa4b44791372d6139ab7b25269184d55",
        "type": "github"
      },
      "original": {
@@ -77,11 +77,11 @@
        "nixpkgs": "nixpkgs_2"
      },
      "locked": {
-        "lastModified": 1760894497,
-        "narHash": "sha256-u2unItzVvUe3Y2opdJrISGtHSmQLVnDOIfhWvSBrw74=",
+        "lastModified": 1761503988,
+        "narHash": "sha256-MlMZXCTtPeXq/cDtJcL2XM8wCN33XOT9V2dB3PLV6f0=",
        "owner": "brizzbuzz",
        "repo": "opnix",
-        "rev": "92974503378ca6ec6206b74cd3a78377a5796cbb",
+        "rev": "48fdb078b5a1cd0b20b501fccf6be2d1279d6fe6",
        "type": "github"
      },
      "original": {
Author	SHA1	Message	Date
Menno van Leeuwen	fd6e7d7a86	Update flake.lock All checks were successful Ansible Lint Check / check-ansible (push) Successful in 5s Details Nix Format Check / check-format (push) Successful in 41s Details Python Lint Check / check-python (push) Successful in 7s Details	2025-10-30 16:22:07 +01:00
Menno van Leeuwen	b23536ecc7	chore: adds discord and gitnuro flatpaks Some checks failed Ansible Lint Check / check-ansible (push) Has been cancelled Details Nix Format Check / check-format (push) Has been cancelled Details Python Lint Check / check-python (push) Has been cancelled Details	2025-10-30 16:22:03 +01:00
Menno van Leeuwen	14e9c8d51c	chore: remove old stuff Some checks failed Ansible Lint Check / check-ansible (push) Successful in 7s Details Python Lint Check / check-python (push) Has been cancelled Details Nix Format Check / check-format (push) Has been cancelled Details	2025-10-30 16:21:17 +01:00
Menno van Leeuwen	c1c98fa007	Merge branch 'master' of ssh://git.mvl.sh/vleeuwenmenno/dotfiles All checks were successful Ansible Lint Check / check-ansible (push) Successful in 6s Details Nix Format Check / check-format (push) Successful in 43s Details Python Lint Check / check-python (push) Successful in 8s Details	2025-10-28 08:36:44 +01:00
Menno van Leeuwen	9c6e6fdf47	Add Vicinae installation and assets Ansible task Include Vicinae setup in workstation playbook for non-WSL2 systems Update flake.lock to newer nixpkgs revision	2025-10-28 08:36:26 +01:00
Menno van Leeuwen	a11376fe96	Add monitoring countries to allowed_countries_codes list All checks were successful Ansible Lint Check / check-ansible (push) Successful in 4s Details Nix Format Check / check-format (push) Successful in 41s Details Python Lint Check / check-python (push) Successful in 7s Details	2025-10-26 00:24:17 +00:00
Menno van Leeuwen	e14dd1d224	Add EU and trusted country lists for Caddy access control All checks were successful Ansible Lint Check / check-ansible (push) Successful in 7s Details Nix Format Check / check-format (push) Successful in 54s Details Python Lint Check / check-python (push) Successful in 21s Details Define separate lists for EU and trusted countries in group vars. Update Caddyfile template to support EU, trusted, and combined allow lists. Switch Sathub domains to use combined country allow list.	2025-10-26 00:21:27 +00:00