navidrome

2025-12-04 00:21:41 +01:00 · 2025-12-04 00:21:41 +01:00 · 28dc0896b9
commit 28dc0896b9
parent 1408470a53
16 changed files with 969 additions and 171 deletions
--- a/instances/nemesis/configuration.nix
+++ b/instances/nemesis/configuration.nix
@ -9,6 +9,8 @@
  nixpkgs.system = "x86_64-linux";
  imports = [
    ./hardware-configuration.nix
+    ./services/traccar.nix
+    ./services/navidrome.nix
    # ./services/attic.nix
    # ./services/immich.nix
    # ./services/jellyfin.nix
@ -63,6 +65,7 @@
  networking.nat.internalInterfaces = [ "ve-+" ];
  networking.nat.externalInterface = "enp1s0f1"; # TODO: changeme

+  services.traefik.staticConfigOptions.entryPoints.websecure.proxyProtocol.trustedIPs = ["10.0.0.1"];
  services.traefik.dynamicConfigOptions.http.routers.simpleproxy-oldds9-router.rule =
    lib.mkForce "HostRegexp(`^.+\.hailsatan\.eu$`)";
  # services.traefik.dynamicConfigOptions.http.routers.simpleproxy-oldds9-router.tls.options = "old";
@ -94,6 +97,13 @@
    sopsFile = ./secrets/dyndns.yaml;
  };

+  xyno.services.kanidm = {
+    enable = true;
+    setupTraefik = true;
+  };
+  xyno.services.oauth2Proxy.enable = true;
+  xyno.services.postgres.enable = true;
+
  xyno.presets.cli.enable = true;
  xyno.presets.server.enable = true;
  xyno.impermanence.enable = true;
--- a/instances/nemesis/default.nix
+++ b/instances/nemesis/default.nix
@ -6,6 +6,6 @@
  };
  # xyno.services.wireguard.pubKey = "aZvSeAhKG3B5I2My5IqQoSlntMzbCHM6OU92WEScohc=";
  deployment = {
-    targetHost = "10.0.0.2";
+    targetHost = "nemesis.xyno.systems";
  };
 }
--- a/instances/nemesis/hardware-configuration.nix
+++ b/instances/nemesis/hardware-configuration.nix
@ -87,7 +87,7 @@
  zramSwap.enable = true;
  zramSwap.writebackDevice = "/dev/zvol/spool/nemesis/zswap";

-  fileSystems."/persistent/var/lib/postgres" = {
+  fileSystems."/persistent/var/lib/postgresql" = {
    # has things of https://wiki.archlinux.org/title/ZFS#Databases set
    device = "spool/nemesis/postgres";
    fsType = "zfs";
--- a/instances/nemesis/secrets/dyndns.yaml
+++ b/instances/nemesis/secrets/dyndns.yaml
@ -1,38 +1,56 @@
-dyndns: ENC[AES256_GCM,data:yDDTTBimaFcd/MG+eSbYmOHq/Ij0fAoz0zDY+C4bv7ZNn1yAA6C8DE3fXnvAvWhatLLSbRGDxHRRm7JuAHOfGGisN9cXwL+fkB7rZMVZemaL2wrOAQxyzHDEeZnZHRwsVGYhAmTsbUCVLi4CyzjRHGbCLZtZ8b+DzT0644uTi9IQovcLrWun62KMt7yjFS+Wb85XItMrIk4gJRCOhllrAXKY/z0idgv8GCNRDsDsmKL8arfcWzo2+bU/Uqhqt1Md6++jySPNPxwwcORYUudqQM63N0g47jSnmbXJ11XRRq6ZBQJaHhx25YOj2WiDH1382Kn71hnnObWS8HcXI3pwAg51mQ7Wlu+Mlt/3iZjOS1ble4IrQGItLVQUqWjyKSLvTbPfe6P/AuQ9VFGLZ7VGhVUAuyum727bx7jg1oQmqETrkL9BwaW/2FsBCVfKobgBOM6s/XMO07dOrzkO14BxOgM7zcILkz0J3IClXDOnK+Qtqe9d0E4JiSItk1hlL+PI256dGt3J2oHHAZTNOhCn1f3/t1nwkDaPM379LhVHVGhGNFtPkwp1itAQPe/zY6apHCOrcd4sti7QjVssW+ekWjMGqIC0D41aw5oRUhE0pGSwVzVTwrxqc/IiLag8UxjFpBEWO9826I5qD3LQhH+sAfsrcBp9SeRrrt5icNbqLhKDxeB2,iv:Bj9aQZ8X1j5tV+iRPwFQ9NvNaxtlaRn6u60qqzHmWmw=,tag:gDKAPd8FEomSwyiT3yy2iw==,type:str]
+dyndns: ENC[AES256_GCM,data:E+yFHhfpyB3kFb59Nokjr4kIBpgRVZPLZzpHjwp9Ixd9b4rr8Fky0yz4b+/5MlXsSKsR4zfhUi/4yudeYVrSwMWeLibKHeAtoWYTlnEjhBn30wvlEA08M3zmvfMRvGB0Ur2bmax5OzCQbh2v0NKB+4mrIN9SVhBIR89Y5DLm7sd7KIJJxTruo2d+ODphAzFFNtuuyg4s3iq2+Y5H/zwrpgT4Td39h1ys+hfk4ght/OAseTZfda4qCdHhT0S4+aoCkhiyPUxr80KtuHhmt6UvpsazSDJmZyKyVJ3PpYcfS1VfBqAIdNc2enxxquNBRwppd3V8pXjIZKzPRTySFnLpgPIJBhnFkozJm44jaOttoSFrbrF1+7/iL/ssNWpHQvtr0Ke5jS1EPb6k0MZZnJxhGKUiZWzDL/Xb7FJex8pE5gTTK+24VD13mvIW2qCrtXybTydnid/76SzYpdz407mHgBsQUorA,iv:WGbR31NhtayYfdn89diNlOwWkUOulYmBVs9qqZSNieo=,tag:yvqJ6Ok2i0GC5ZSFYWySsg==,type:str]
 sops:
-    lastmodified: "2025-11-24T15:13:32Z"
-    mac: ENC[AES256_GCM,data:f+3n2Xc7jU+qW+vHk98BTgwLwVHTXzWHMjLwNr3Y3Pp8VIQf8d8iF8QwhDFPWN1uqsxsb/XD48CXbd5AwxuVcgcSM7FIHkjfIn0pHRk0jTAkXTxjWIwg9pqnGAZ5B/fA8XAvcyPpE299gMYzU2soAL11DZtrEVVXJWN2sD5IlL8=,iv:Uykx2R6xO/KW1XP0Nm8GyaoepmdU96AfGQQhLz6BlNQ=,tag:bqe0gZF6WhQg55NhWyNC5A==,type:str]
+    lastmodified: "2025-12-01T18:59:41Z"
+    mac: ENC[AES256_GCM,data:DGjRJWTAl2q58KDAcCxk30gvsin8C7/yBvw5qt+gGcHgJr4ggdVU1afW2Hn+qkexuSK0vLZP6tPJo6reiwyEAZNREPXnU21DUm83lMybu/zRdLFenA03ffPgJ4V+a6m9Ya/CmJzz/vaUxxtyeqCgynUI24otI/+ta0Hh1LQCbC4=,iv:t7NbX7mMMh2r2b0FLrmssxlFJSd9TTGAb7kjoYeKnzc=,tag:MKvgoxYoOj5TT/EzD8hKzw==,type:str]
    pgp:
        - created_at: "2025-11-24T13:05:23Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----

-            hL4DAAAAAAAAAAASBAMEDMeIdplYrk7VppUFRCTcB7Pv+xnVKSLhhSoN6kqbHXqA
-            YYv8o4AbT9bf1+L9wywA+Eg55tj8aocse/tdRQWTymy4+8grb/sm0oZQT22T51JP
-            mWxhWIX+sliCqHnS/W2tuVLyDzAiJ/Tg19kOc576OH1z6f2HMIM7yvADoKupfqIw
-            rbwo0G8CdZCW1hzutCnC2mD4Op2BxK1b26oZdNA06y+BMHHefyDTl/wXwiNQKWiq
-            0l4BoaYNx2ma5ZTSBk7YNeIXikwM3XtZnUZU+V17EgClNbxhmTRc0h7fmeprjYcW
-            zETvhSIm+JFTR0mdQsrDvTs7kt+PnaYptoM0CHaYCHTq48pyYKL3Gm0NtCAHuFc3
-            =UlnU
+            hL4DAAAAAAAAAAASBAMEIEXAYYvAspPhhSKpflgdFds2UrMJYMBl1TyKwMsTxQd/
+            Chj1aQqRRdrQ0tF3Mkd13EEDJwU3kgJWrrh8uB5ukU+yYuig5kS5Gl51eW5H+FlD
+            YFYJFsvJBIqbpNzpI7zitD4OvBZ6UCmwul+X9ibYVZRJjrZ6e4zSPmOk9D4Srecw
+            Pz9nn6NnUA5PXd627Kt4JFBQ1OiLon/ZMBTKhk/vHuUKdYYJNQleJFnpWCU3lNN2
+            0l4BTf26neMgV1qi34Nb86n3Jk8zqC/pMOgtoN2IrY45kR5lUDqGHTemKHw3JdmO
+            9oiuqPnlGJktOxdAk+8jHxDrVwRsth+2f+U0cLkMNGTBcY8g1OPWk65ObwIpZ1rZ
+            =NWw0
            -----END PGP MESSAGE-----
          fp: 0D98D5964AC8BB1CA034CE4EC456133700066642
        - created_at: "2025-11-24T15:13:16Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----

-            hQGMAwAAAAAAAAAAAQv/SQPw9p1r4Sg9zYTyX1n3n6xJzhr+hEGLwwGhcmJh8mup
-            D9n+aaZU4WK2Huha8Jd1bNqNo3J9UpqQMIaexfd64HoVdDHCxBzfThiMvgwpQ30a
-            kTQqC0DGkLaFM5W8IVOremwjhLzrTBesu8ny8CasQYJ0tZ+QFU51OvxD4q0r9OLT
-            BcCGqDsKZ3HDr7OIi4FsqdZRfxinJ+zteK93uxA+fB8Hkxok2g7Z2A5Nv2cOo54X
-            NJxwsCN4l2Hs8MaVMTC+KGASn87m+Q1xwcVD7ujPmGGjMYb84j2sBn0DP3mNQh7y
-            89jz6HPbq9goF++Sp172bwswmJwZLVCWkgvzQo+szfCqGnq6LTlG9JaVswkkSz7N
-            z9kvF6L2dg7N2XlkLLP9UnxMkNxUrA615LvSn/z9AA7Dp6ay7TCsOeSWrz5m7+PF
-            VVfTp4PN3y7hsZXvWWk1eqsOaThI5GY7N7W6aQlNmvhibjw7FJEF4Iv4FBJsOD23
-            vYv+38yn377hnimtzoVt0lgBFtO8QhedShEvVjROUNjjEE2WB2jpP5/wZVIsrefs
-            tl87MAyLedE/Zs5MByubb0buC2jifQnkxsA1QSvbZB2/NTi/SLSPeCMdFrVkYdcG
-            hP8cp1HkI81F
-            =iDKg
+            hQGMAwAAAAAAAAAAAQv9EPOBFyrp+Zysk3SaNiYaQl928f0pe84uSO9Fm4VPqKtC
+            xjov8740j38gvQIXpI2zADMlemLGzftbJPfBarSFVlukYoQkjs0SXQD0ukXsiCw2
+            eLpEyOx57BFQMRwiNeh6gSkS6WeHAJNiQj1rY11MvyAsDIup8su5XPEw5DWjr3R0
+            JdY029HuF6wqpmtgZnaFn6vmPYWYdtnYsxjqOJSPx+rXbWagiDgYy3DAOc7ltyIs
+            bZoAsjVwQW/tl3hjWhKFeOSfsd9vdUX1TacKqqNZy4mLeEHZOYANeeLkOb+T1T4r
+            Cexau6H3xZqc87T4S1ZBpEyWawIJHmIalFDoj466mUMOTJth7LxW7vfAdMpwbl1K
+            HHbTK7vyYxLeo/e5rw646eVmbyPeFf3gF/IXRWB8qoL4g/atGbbQ+WJ86mLgMDg9
+            9AqgVhSbVLoaWooqjh40tJ53raNm5HsO8ozfrJ9hx7Dq3QmCivpA14Q7UD6Yu1nT
+            RxY6Ng7ykHGGIx3LacV70lgBoinGEzvbxe2Se7B+FOlEL+zFywRt8yFwqc0SXY6o
+            qLriyhU2p05gvV45oR3pm9336VtwKu1lsN+Z9guKDZmKSgfIxZ22NulsA7E2zV8Z
+            MacEdQskbB7J
+            =zk6P
            -----END PGP MESSAGE-----
          fp: b730b2bf54eb792a14bfd3e68c14c08894376c5f
+        - created_at: "2025-11-29T08:16:39Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQGMAwAAAAAAAAAAAQv+OaIQywQwV7AS4gi4GjVHFVyhk7Wd3/5fLlMt9UeB56gt
+            l5+4VVkIzslwiuu9NF5KfvuXr4OQG3cOnb7KRgU5UEUEQtaDrMLFO/TwbBzVTC40
+            YNHOya0Ow3MRcEegnM3ox5vL4nHLQwevL0jY8TUxa1xfcTvSj8qOQ9zzzkxzR3L6
+            XvD6+dL9pHh1gtU6vlmPIm1PLsWalp0LJAOij3FQdzaxWpDRc0U+Wwr4lt5LiYS2
+            jOFc5OZFeIOqMfzul5GCy933eu+V+Ch8PXa5/6PtWxFHx5bvF2pclubguRLziux1
+            koeCxBpK3coHT1NX5AEmbtCEieFY9bMy6JTiih4I8eM2nkPjWyqByGh2mFuzjf4V
+            OBGyHUZHK+KpDkRkwSS/6GqX3n89KMsf6aZwM35CkBvdG3PamyO8eVmE36OTGe4g
+            1oj12rIjIj4dKtQ68vRgexvlH1Qq3GBHfsJRF5lRi4dKtPPLjU2P1fJWFcjszIEe
+            q2QEcpDbCPYelI7mhwzT0lgBND6Yxso3tpW/Il/uRKao/9H+DgIYaIIRBml/cqaq
+            VqDnFIYodxuW73R8n5GlfctY+gya9ZiGlK5uJwlghRE8gCVUjFrDnFS+uiVC6QI6
+            SepzVJKOMUB8
+            =7yY4
+            -----END PGP MESSAGE-----
+          fp: fada7e7be28e186e463ad745a38d17f36849d8a7
    unencrypted_suffix: _unencrypted
    version: 3.11.0
--- a/instances/nemesis/secrets/kanidm.yaml
+++ b/instances/nemesis/secrets/kanidm.yaml
@ -0,0 +1,80 @@
+oauth2Proxy:
+    cookieSecret: ENC[AES256_GCM,data:CA6VBdPT3tuit4eWfBi1ycau4kErwAMfLwJ0maYr+/8Th8q51ZFHaWOcCA8=,iv:HSWCUEgVTkB9tKfzZWXUzH/sCoVZztzwbr1ZUwZBLBs=,tag:qOdClvQl2Cgn3lHXXA/o1Q==,type:str]
+kanidm:
+    adminPassword: ENC[AES256_GCM,data:JQHTQHwXKMgbc0SRdkhMjKjZBznuIbHdcR4TXsmikKWX+5T4VOSqo4CwlXj0XQSV,iv:ruCMDfPlwcAUXdRypB0lNSH1UuV9ryS4vLSleVHnWwc=,tag:V4phitbR0tk6jUrdyFlZWQ==,type:str]
+    idmAdminPassword: ENC[AES256_GCM,data:D128I5u5pTP6xgSiP+EIZWJmbkXDfHHLh7Bw8wAiMxYPpjGG3EDsdG+8CwOUP8jZ,iv:5h/UZ7BHviKYIY0zpTo/seFHvMcGucDLeey9bc+GDlo=,tag:DSelYBlzIN94K7tOI3QtDA==,type:str]
+sops:
+    lastmodified: "2025-12-03T21:25:56Z"
+    mac: ENC[AES256_GCM,data:R3cxPrzR5tT0CMNvrtBWDCE8RTvPj9tPslkGhubfOREQBR+qIw7e84uSrswo2+KJkc+AL7CPzVSgsdcSjalNxIqLlL2Gg1y/BKgE6UDB5GDT49+cfCL68hFYkZ+4Cl6bKdLpOuuhsR92NwQk171bx+KCgjE2KUBRFDjOllo+V7M=,iv:LdeRN1jnLNKL3pXVVEQ3BzI3csJSRil5gkQOnxyLi+U=,tag:Ti9Ryuc4kyeuKDwRelQI2A==,type:str]
+    pgp:
+        - created_at: "2025-11-29T10:45:57Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hL4DAAAAAAAAAAASBAMEYHWKHKXoJ9J5HDHfY9FhItdcvUdWz57Wl79xKzH94s42
+            B7k57At1H6mW3BOrbnDNgNyBs6dHIG1jTA+4yITgIAcn/bl9JRbMOjmDZZzzevJi
+            4yQdnm8C6mxQhbUNDpWJ4He6+m7vMZx8uq0S6dq0a5aAE/7ph7Z4gvIbBjZIA6gw
+            z/GwpL9SyZjSyTW8Z9XPLebonCp1lhD0tsVHk9GKoL46UWlYzq87XSyJOo4AHGAO
+            0l4BWq3e7iDmzdxwtCoIC7PKHPmigUielz1qDdCGAIMQsAhaJqOa24gCUW7cklgk
+            A18EVlSyfeqGaqr//cuGqm8TnrG9cfLtMgnjUv3UQfBWVOh5P8ccKTbl4SUY2BfQ
+            =JRop
+            -----END PGP MESSAGE-----
+          fp: 0D98D5964AC8BB1CA034CE4EC456133700066642
+        - created_at: "2025-11-29T10:45:57Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQGMAwAAAAAAAAAAAQv9GuE7hANGXNsAGi3e1oB4c2y9jpvi3RkEifcxBg19yf9n
+            L9t3Av1Ym2H/Bc5Sw5++qrF7Jy3Aujt1T8ytayxzVsuLesgkuDzjtot0JgUsRSWK
+            r2dXDoo9gaftX434fGViamHTX2wHBo9VEwqe/c2NjwLeIx/O6u4FwJmUAgzGy1pp
+            I5TSpYMky4coLbFpDX7AuUuPymI6lGNad6JoeOoTP2gb5Kt2Ycr7ZqzOp2kaPxua
+            yw5HuoiXLkzxywuWh+IIbqanyN8qxbjvEOS4ZJHegECZhDS27kocwiXhUlcT1NC1
+            1pFW7EJaVMzikSBy06LiPWsYjNmQIR9o8uoeP//XMcq34N0036IxVaOWs8Qnls97
+            TJM6lCov4c0XcNrfop15hWNK2gxSzNwxWkmG5PUHwfRi9JGvL6Ng/EHbJS+6F3Nx
+            z7H2jAIdzc9StMd411SJrZSpDk1wpnecroUWYdO5OIKJu70J5FvNSaKripEECy1x
+            wBrqY5RLmi/qYsfyCupg0lgBPGUyJbV2XLt1Qcf4eStzy5ZYi8gnn02T0EWvCspf
+            0tKMs7hbLm6FwK7vG7Cmc1LQCm73oW09cZCrLurd9JtiRftfww9pBEc85MfPUBIt
+            PYAWvU26TshG
+            =vU9m
+            -----END PGP MESSAGE-----
+          fp: fada7e7be28e186e463ad745a38d17f36849d8a7
+        - created_at: "2025-11-29T10:45:57Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQGMAwAAAAAAAAAAAQwAnX5FoTN8ft2sFXRotgVGt2he9RJMiq0orduWeTXZPLK8
+            mvyYOcrQ71fOIm9sIg6hJfabeR2GjBsm09XIXJ71zLl0lWgb8SvcYmbgaJJ+svfY
+            pPrW+ZninOUZgwkJ8L1gM3ZWOJlx+92NKtdxifIY98SMKacT+aVe7vNTrQVwmRn9
+            cZZQd8B75zN7IV99bJCG2BYvSt+p8gZ1vm3GxhowctbSgCl6knHDHJlpXE7SyLHv
+            ReHjfCFetJQd/XqLL4vZifrlpGKyGPP5pYnEQT5bbsJr9exBeZQ7PsAB0OG+KpOB
+            r4IvB78XGJlbHTnqlP6GKAKek6NSldlEq5tCsKo5wl3Jg2/SgxSbOhbb5YmOqwcq
+            S+JJhbfjRGSJMMXLOP9QtLQU5qktwip5g+ZxgKDrcgQvUPUsbV3PEW9l/0WoCf1Q
+            7e+mBJ+TRJVOjS9hC1mr/C6kkJJurdpH3PvUSncSk4s0+bkw66nLwmc3QLpI6DV7
+            BLJVkOUQzUWaB6k6NVkE0lgBbVYeyaOS3JcoFHrYex6bDHjliD/SH+xjc8wyJR8s
+            wz5CwfFPqudE9ZYvilJ3lN2AtJrRBaxtR5dgrG2fUx9OB6FSOoRVOpmnFC3YUt6a
+            FNZYBn5X10t/
+            =Mj7y
+            -----END PGP MESSAGE-----
+          fp: b730b2bf54eb792a14bfd3e68c14c08894376c5f
+        - created_at: "2025-11-29T10:45:57Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMAwAAAAAAAAAAAQ//a9QFgxhKeW4xcFeERaCiO5nb07wS8BxENBw57RDTp52F
+            0kzEdp+HnkVujYMC5cjKlz3x6ZT+CFcVT8HZTwTjlrtCdO/R1OGeO0NcC/tRQNvV
+            LUgaV9mCzYAbfJG1skdz9EMZZ3W9qPBgKXbX7vGhPirwXyAUUEfQsWon8eOymrd6
+            FoapcdLo9ymTnar14WH0kM7B0i4Kqv6+NKquc0OiL8eSufL4wubJrXZZkOdtnXCD
+            omwFtYmF+IgQAzaCBWLGY3sOW9nD27Y9F1vToOpKQvxE+IT3VGTZN02Xy2J4lhnJ
+            IE2SmaeY29g2QWIRePCrehpaRNCjlmTS7j7SRT2K9bOVcbiwljUidwkC58323EmC
+            UlacFRSY5Cfeav2VL188ywh4vihnUpWJoncHKvcUEEeLykbQcdpy2Zwl6u6UB+2g
+            oDmhk1pFV4ejJlRe1BpLHiBcnA5/OFsWxMGQp57mZ2vyGWYQgtsQZ71JVENq7nSt
+            TKi6OPhRTZX2Wk8lcZMjm+5XeNrGMSUEYwCPRza+5C0f3LzSfjmmGDLxwaQmCaYI
+            ZjKSuj14N9VQNJJ8Yxn9uni1acKs+q1XM1b3gJUT2gpFbOjh1BjtAGrat1f4mKk9
+            0PwxBA7cZkdmgJ0t/oNja8ElpOMLMTbI7yYOLY3hD64CtFKWWwpxbD7bK65neRTS
+            WAE9cEyjhq3TOKNdKaIP5N6a6Sq+98N9xE7/3/lVYncFZ1zV4+9l8Gyjr4rsSSV+
+            68gg9t6FUPIHyNHdrvmqLLQP+paA9RMb7yOMkULB8zBKJrZMXnu+wsI=
+            =Du56
+            -----END PGP MESSAGE-----
+          fp: 4019fd893bba15618c2f93a38ef418ce360bc418
+    unencrypted_suffix: _unencrypted
+    version: 3.11.0
--- a/instances/nemesis/services/navidrome.nix
+++ b/instances/nemesis/services/navidrome.nix
@ -0,0 +1,48 @@
+{
+  config,
+  ...
+}:
+let
+  host = "music.xyno.systems";
+  internalIp = "127.0.0.5";
+in
+{
+  services.kanidm.provision = {
+    groups = {
+      navidrome_users.members = [ "application_admins" ];
+    };
+  };
+  xyno.services.oauth2Proxy.hosts."${host}" = {
+    allowedGroups = [ "navidrome_users" ];
+  };
+  xyno.services.traefik.simpleProxy = {
+    navidrome = {
+      inherit host;
+      inherit (config.xyno.services.oauth2Proxy.hosts.${host}) middlewares;
+      internal = "http://${internalIp}:4533";
+    };
+    navidrome-subsonic = {
+      inherit host;
+      rule = "Host(`${host}`)  && PathPrefix(`/rest/`) && !Query(`c`, `NavidromeUI`)";
+      internal = "http://${internalIp}:4533";
+    };
+  };
+
+  services.navidrome = {
+    enable = true;
+    settings = {
+      Address = internalIp;
+      MusicFolder = "/data/media/beets/music";
+      ReverseProxyWhitelist = "127.0.0.1/32";
+      BaseUrl = "https://${host}";
+      Prometheus = {
+        Enabled = false; # TODO
+      };
+      ReverseProxyUserHeader = "X-Auth-Request-Preferred-Username";
+      Scanner = {
+        Schedule = "45 0 * * *"; # daily at 0:45
+      };
+    };
+  };
+  xyno.impermanence.directories = [ "/var/lib/navidrome" ];
+}
--- a/instances/nemesis/services/traccar.nix
+++ b/instances/nemesis/services/traccar.nix
@ -0,0 +1,93 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+{
+  xyno.services.traefik.simpleProxy.traccar = {
+    host = "track.66642.bot";
+    internal = "http://127.0.0.4:8082";
+  };
+  services.kanidm.provision = {
+    groups = {
+      traccar_users.members = [ "traccar_admins" ];
+      traccar_admins.members = [ "application_admins" ];
+    };
+    systems.oauth2.traccar = {
+      displayName = "Traccar";
+      originUrl = "https://track.66642.bot/api/session/openid/callback";
+      originLanding = "https://track.66642.bot/login";
+      imageFile = "${pkgs.traccar}/web/logo.svg";
+      # public = true;
+      scopeMaps."traccar_users" = [
+        "openid"
+        "profile"
+        "email"
+        "groups"
+      ];
+      allowInsecureClientDisablePkce = true;
+    };
+  };
+  xyno.services.kanidm.templates."traccar" = {
+    text = p: ''
+      OPENID_CLIENT_ID=${p.clientId}
+      OPENID_CLIENT_SECRET=${p.basicSecret}
+      DATABASE_URL='jdbc:postgresql://localhost/traccar?socketFactory=org.newsclub.net.unix.AFUNIXSocketFactory$FactoryArg&amp;socketFactoryArg=/run/postgresql/.s.PGSQL.5432'
+    '';
+    wantedBy = [ "traccar.service" ];
+  };
+  systemd.services.traccar.serviceConfig.ExecStart =
+    lib.mkForce "${pkgs.openjdk}/bin/java -cp './tracker-server.jar:./lib/*:${pkgs.junixsocket-common}/share/java/junixsocket-common-${pkgs.junixsocket-common.version}.jar:${pkgs.junixsocket-native-common}/share/java/junixsocket-native-common-${pkgs.junixsocket-common.version}.jar' org.traccar.Main  /var/lib/traccar/config.xml"; # forgive it for what it has done
+  services.traccar = {
+    enable = true;
+    environmentFile = config.xyno.services.kanidm.templates.traccar.path;
+    settings = {
+      database.driver = "org.postgresql.Driver";
+      database.url = "$DATABASE_URL";
+      database.user = "traccar";
+      mail.debug = "true"; # log mail content instead of sending email
+      openid.adminGroup = "traccar_admins@idm.xyno.systems";
+      openid.allowGroup = "traccar_users@idm.xyno.systems";
+      openid.clientId = "$OPENID_CLIENT_ID";
+      openid.clientSecret = "$OPENID_CLIENT_SECRET";
+      openid.force = "true";
+      openid.issuerUrl = "https://idm.xyno.systems/oauth2/openid/traccar";
+      web.address = "127.0.0.4";
+      web.url = "https://track.66642.bot";
+    };
+  };
+  systemd.services.postgresql-install-timescale-in-traccar = {
+    after = [
+      "postgresql.service"
+      "postgresql-setup.service"
+    ];
+    requires = [
+      "postgresql.service"
+      "postgresql-setup.service"
+    ];
+    requiredBy = [ "traccar.service" ];
+
+    serviceConfig = {
+      User = "postgres";
+      Group = "postgres";
+      Type = "oneshot";
+      RemainAfterExit = true;
+    };
+
+    path = [ config.services.postgresql.finalPackage ];
+    environment.PGPORT = builtins.toString config.services.postgresql.settings.port;
+    script = ''
+      psql -d traccar -tAc "CREATE EXTENSION IF NOT EXISTS timescaledb;"
+    '';
+
+  };
+  services.postgresql.settings.shared_preload_libraries = [ "timescaledb" ];
+  services.postgresql.ensureDatabases = [ "traccar" ];
+  services.postgresql.ensureUsers = [
+    {
+      name = "traccar";
+      ensureDBOwnership = true;
+    }
+  ];
+}