From d9aecb96c7969e48d0ea9e7b3f32be8b3af01fb1 Mon Sep 17 00:00:00 2001
From: Lucy Hochkamp <git@xyno.systems>
Date: Fri, 26 Sep 2025 18:08:28 +0200
Subject: [PATCH] meow

---
 hosts/ds9/default.nix   |   6 ++++++
 hosts/ds9/grist.nix     |  34 ++++++++++++++++++++++++++++++++++
 secrets/ds9GristEnv.age | Bin 0 -> 1312 bytes
 secrets/secrets.nix     |   1 +
 4 files changed, 41 insertions(+)
 create mode 100644 hosts/ds9/grist.nix
 create mode 100644 secrets/ds9GristEnv.age

diff --git a/hosts/ds9/default.nix b/hosts/ds9/default.nix
index 9059fcf2..ea6962ff 100644
--- a/hosts/ds9/default.nix
+++ b/hosts/ds9/default.nix
@@ -15,6 +15,7 @@ in
 
     ./containers.nix
     ./backup.nix
+    ./grist.nix
     # ./plex.nix
     ./samba.nix
     ./paperless.nix
@@ -287,6 +288,11 @@ in
           import podmanRedirWithAuth http://archivebox:8000 
         }
       }
+      @grist host grist.hailsatan.eu
+      handle @grist {
+          import podmanRedir http://grist:8484
+        
+      }
       @snipe-it host snipe-it.hailsatan.eu
       handle @snipe-it {
         root * ${pkgs.snipe-it}/share/php/snipe-it/public
diff --git a/hosts/ds9/grist.nix b/hosts/ds9/grist.nix
new file mode 100644
index 00000000..6ab4ede5
--- /dev/null
+++ b/hosts/ds9/grist.nix
@@ -0,0 +1,34 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}:
+{
+  ragon.agenix.secrets.ds9GristEnv = { };
+  virtualisation.quadlet = {
+    containers.grist = {
+      containerConfig = {
+        image = "docker.io/gristlabs/grist-oss";
+        networks = [
+          "podman"
+          "db-net"
+        ];
+        volumes = [
+          "grist:/persist"
+        ];
+        environments = {
+          GRIST_SANDBOX_FLAVOR = "gvisor";
+          APP_HOME_URL = "https://grist.hailsatan.eu";
+          GRIST_FORCE_LOGIN = "true";
+          GRIST_TELEMETRY_LEVEL = "off";
+          GRIST_ALLOW_AUTOMATIC_VERSION_CHECKING = "false";
+        };
+        addCapabilities = [ "SYS_PTRACE" ];
+        environmentFiles = [
+          config.age.secrets.ds9GristEnv.path
+        ];
+      };
+    };
+  };
+}
diff --git a/secrets/ds9GristEnv.age b/secrets/ds9GristEnv.age
new file mode 100644
index 0000000000000000000000000000000000000000..b559970a4486203f8328636889af68690d14fcea
GIT binary patch
literal 1312
zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCUlOp2&TD_2NME%)*$
zbN5R3PRcYd3d{@%$}9^Bb*^v=G<7pKh$t_PC@3sSbSaNA&gTj@^fU;rOpNq5EHv;a
zcP;laE>1B|a@Vgg^DNPK_t1~3vdpXW@UJLM%15`YG~FXSyj;P#$lKH+JgGb|AkewY
zBgiGyG&DHfy{z0bEVIfqC0D;HDK#=P)v}^0+?6ZH#W>x`qe4G3J;~4C)ZNgnFu=Xg
zyC^uvztF(IEU2u^q%0sO*B~n+JsaJ&&``^uU`K`Gf(q{nlM3zf44)KFue{{aK+6h0
zv-D)|>_E%nVpo@p4DTpQQ`7A9a9=Ldd_VJWkK9PZaG#WlDBmPwcVDyY?22O7FvpBy
zOQ(wB@bqFg7jH+e;AC{$g1kJ9og5WPjC=wD^UVU20uwExJjznMOp@{fg507CA`J{e
z(gV|slOl~Hvoc*>jgq;{Jj~4#gVNn|QzAXQ^^=NSTnzFJLXFdWgR_crvwW+}oSch7
zJc2B=gH6zFi^wbU@-A0MtMDwy2}`du&T=#JOfksH&hn0Qt8#JnHcRpi*Uu`>C<!a{
z^e~U`anI%oGcqZ2DRXlUF|7zG&DA#v@d`F5^Gxz^N-K7($a6N)E_N+<ay7^^^NK{b
z&D_t&)Gu8jy)e>JJ3q71+tb~#D#Ww6&@{)$xgtEmU0XZCE7h?mvRpgS+afT^Kiq^X
z(IX-t#3Luv)vVAZvZ^vHDbzbGKhiuj*tN*KD90o{MBgO8q}(FSv%&)1Hq+po9HT%5
zCnr<i@*HE!#H^BFX9FXBBa5`eRIiLAA1^~~r$9$nvmhf2zfcP^=S)wog35~E+{nV>
zicq)I^a5{BvoOC3=llp4qa>H8%2JEKA~V;BOqWvE3{yugU0q!TZ-3X)NGJ2~P*0PL
z95dHoKmDxGBu8g$w`_}m!aO%ePuKKZKQE8)Fl|?^&mw(AA@3&HtvQ(Z!(`>28IyF?
zC#`z#a;vIlqKWDw!H{ngr)*i6p>bSf;-<Q8S^q!B)?YjGWCepjroEf>tU2;(dAt1?
zeW$tHPOQ0cM8(42=2!`PYpUu0y)3CQEH#oRS5zK%3GjTM`!A;X?7?DocLvQG^H;%t
zmIYlC{p=ukUi|#zE0aV1PfFnqcwDq<>B&^7rx%<9*RI>IG+(^O;!f0!P?Oh(V<jWs
zZDuhvd~}J&b)M0=k7u^&`P9C@Gi7N@m5R^)j{cs>$5h=eu}xURyx_&DhYpO&4m?d;
zR%-qJQ}g5ezPc$3KNv;dyr=hKQ>C)PyoY&<HthEf2<krH!**icZQbepr`N}qTr$=<
z%C|u7$wU9=|9zS5lD~bN?!W3_u(fb@$DTUfKO65)n_K<p-Yos9K+pJ`t}k3wM%TWw
zKK`8|UM_lcTgcqQyS)wlQ;nRI*nbt=ex<hZ)3?%s{YHhCz57nB*|u+Qg3sdz@xd_$
z=iF;At`>EA-x(5q_H9&!`=-_#d4Uq4^XBBTRVf>GCLXR}O6;|;`{aAVT3*asT5HMK
z!jHF>2pm3<{ae9*s?{m?wHL!~m?_B2eJ{P^?Qg*s@0eN)m-zep96jk4ZGQCRk}0a$
PliWT<uw6^b^=1PA-=6iI

literal 0
HcmV?d00001

diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index 16fcea48..ea8211ec 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -19,6 +19,7 @@ in
   "ds9SyncoidHealthCheckUrl.age".publicKeys = pubkeys.ragon.host "ds9";
   "ds9DynDns.age".publicKeys = pubkeys.ragon.host "ds9";
   "ds9SnipeIt.age".publicKeys = pubkeys.ragon.host "ds9";
+  "ds9GristEnv.age".publicKeys = pubkeys.ragon.host "ds9";
   "ds9PostgresEnv.age".publicKeys = pubkeys.ragon.host "ds9";
   "ds9ImmichEnv.age".publicKeys = pubkeys.ragon.host "ds9";
   "ds9AuthentikEnv.age".publicKeys = pubkeys.ragon.host "ds9";