update flake and more pocketid

.direnv/flake-profile

@@ -1 +1 @@
-flake-profile-11-link
+flake-profile-12-link

.direnv/flake-profile-11-link

@@ -1 +0,0 @@
-/nix/store/0r147knri9hgvgkbnqqwgmqbrsfr90w0-nix-shell-env

.direnv/flake-profile-12-link

@@ -0,0 +1 @@
+/nix/store/bkrxrlbnvzf087ch5lrbs6y00s4qy4i9-nix-shell-env

fili/services/auth/default.nix

@@ -1,8 +1,6 @@
 _: {
   imports = [
-    ./kanidm.nix
     ./oauth2-proxy.nix
-
     ./pocketid.nix
   ];
 }

fili/services/auth/kanidm.nix

@@ -1,46 +0,0 @@
-{ pkgs, config, ... }:
-let
-  lib = pkgs.lib;
-  domain = "auth.donsz.nl";
-  port = 3013;
-  backupsDir = "/var/lib/kanidm/backup";
-in
-{
-  services.kanidm.enableServer = true;
-  services.kanidm.package = pkgs.kanidm_1_6;
-  services.kanidm.serverSettings = {
-    tls_chain = "/var/lib/acme/${domain}/fullchain.pem";
-    tls_key = "/var/lib/acme/${domain}/key.pem";
-    bindaddress = "[::1]:${toString port}";
-    ldapbindaddress = "[::1]:3636";
-    inherit domain;
-    origin = "https://${domain}";
-    trust_x_forward_for = true;
-
-    online_backup = {
-      path = backupsDir;
-      schedule = "0 0 * * *";
-    };
-  };
-
-  systemd.services.kanidm = {
-    preStart = lib.mkBefore ''
-      mkdir -p "${backupsDir}"
-    '';
-    serviceConfig = {
-      SupplementaryGroups = [ config.security.acme.certs.${domain}.group ];
-    };
-  };
-
-  environment.systemPackages = [ pkgs.kanidm ];
-
-  services.nginx.virtualHosts.${domain} = {
-    forceSSL = true;
-    http2 = true;
-    enableACME = true;
-
-    locations."/" = {
-      proxyPass = "https://[::1]:${toString port}";
-    };
-  };
-}

fili/services/auth/pocketid.nix

@@ -5,7 +5,7 @@
     sopsFile = ../../../secrets/pocketid.env;
   };
 
-  services.nginx.virtualHosts."auth2.donsz.nl" = {
+  services.nginx.virtualHosts."auth.donsz.nl" = {
     forceSSL = true;
     enableACME = true;
     extraConfig = ''
@@ -24,8 +24,9 @@
       PORT = 1411;
 
       TRUST_PROXY = true;
-      APP_URL = "https://auth2.donsz.nl";
+      APP_URL = "https://auth.donsz.nl";
-      ALLOW_USER_SIGNUPS = "disabled";
+      ALLOW_USER_SIGNUPS = "withToken";
+
       UI_CONFIG_DISABLED = true;
       ALLOW_OWN_ACCOUNT_EDIT = true;
       DB_PROVIDER = "postgres";
@@ -47,6 +48,10 @@
       EMAIL_LOGIN_NOTIFICATION_ENABLED = true;
       EMAIL_API_KEY_EXPIRATION_ENABLED = true;
       EMAIL_ONE_TIME_ACCESS_AS_ADMIN_ENABLED = true;
+
+      ACCENT_COLOR = "#c66995";
+
+      LOG_LEVEL = "debug";
     };
   };
 }

fili/services/forgejo.nix

@@ -64,8 +64,9 @@ in
         HTTP_PORT = 13121;
       };
       service = {
-        DISABLE_REGISTRATION = true;
+        DISABLE_REGISTRATION = false;
         ALLOW_ONLY_EXTERNAL_REGISTRATION = true;
+
         SHOW_REGISTRATION_BUTTON = false;
         ENABLE_PASSWORD_SIGNIN_FORM = false;
       };

fili/services/media/jellyfin.nix

@@ -126,7 +126,7 @@ in
     extraPackages = with pkgs; [
       intel-ocl
       intel-media-driver
-      intel-media-sdk
+      # intel-media-sdk
     ];
   };
 

fili/services/nginx.nix

@@ -19,5 +19,4 @@
 
   security.acme.defaults.email = "jana@donsz.nl";
   security.acme.acceptTerms = true;
-  security.acme.preliminarySelfsigned = true;
 }

flake.lock

@@ -9,11 +9,11 @@
         "stable": "stable"
       },
       "locked": {
-        "lastModified": 1755272288,
+        "lastModified": 1762034856,
-        "narHash": "sha256-ypTPb2eKcOBbOoyvPV0j4ZOXs4kayo73/2KI456QnE0=",
+        "narHash": "sha256-QVey3iP3UEoiFVXgypyjTvCrsIlA4ecx6Acaz5C8/PQ=",
         "owner": "zhaofengli",
         "repo": "colmena",
-        "rev": "5bf4ce6a24adba74a5184f4a9bef01d545a09473",
+        "rev": "349b035a5027f23d88eeb3bc41085d7ee29f18ed",
         "type": "github"
       },
       "original": {
@@ -290,11 +290,11 @@
         "nixpkgs-mozilla": "nixpkgs-mozilla"
       },
       "locked": {
-        "lastModified": 1767125309,
+        "lastModified": 1767285863,
-        "narHash": "sha256-/L20TewrRZfUTYPEeLG1UBducFeM7N/UVvcLb2Deypg=",
+        "narHash": "sha256-IZcAGuoAVgbke0Xtc6yQE+AItfFhyxjONlE9H0brHaE=",
         "ref": "refs/heads/main",
-        "rev": "603f69dbfc8d7acc91b6043420155f1f0660bb66",
+        "rev": "179aca580debf2434028172c9f939884d82a2b4d",
-        "revCount": 52,
+        "revCount": 55,
         "type": "git",
         "url": "ssh://forgejo@git.donsz.nl/jana/money.is.fckn.gay.git"
       },
@@ -426,11 +426,11 @@
     },
     "nixpkgs_11": {
       "locked": {
-        "lastModified": 1703499205,
+        "lastModified": 1766840161,
-        "narHash": "sha256-lF9rK5mSUfIZJgZxC3ge40tp1gmyyOXZ+lRY3P8bfbg=",
+        "narHash": "sha256-Ss/LHpJJsng8vz1Pe33RSGIWUOcqM1fjrehjUkdrWio=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "e1fa12d4f6c6fe19ccb59cac54b5b3f25e160870",
+        "rev": "3edc4a30ed3903fdf6f90c837f961fa6b49582d1",
         "type": "github"
       },
       "original": {
@@ -660,11 +660,11 @@
         "nixpkgs": "nixpkgs_11"
       },
       "locked": {
-        "lastModified": 1758425756,
+        "lastModified": 1766894905,
-        "narHash": "sha256-L3N8zV6wsViXiD8i3WFyrvjDdz76g3tXKEdZ4FkgQ+Y=",
+        "narHash": "sha256-pn8AxxfajqyR/Dmr1wnZYdUXHgM3u6z9x0Z1Ijmz2UQ=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "e0fdaea3c31646e252a60b42d0ed8eafdb289762",
+        "rev": "61b39c7b657081c2adc91b75dd3ad8a91d6f07a7",
         "type": "github"
       },
       "original": {
@@ -799,11 +799,11 @@
     },
     "vpn-confinement": {
       "locked": {
-        "lastModified": 1749672087,
+        "lastModified": 1765634578,
-        "narHash": "sha256-j8LG0s0QcvNkZZLcItl78lvTZemvsScir0dG3Ii4B1c=",
+        "narHash": "sha256-Fujb9sn1cj+u/bzfo2RbQkcAvJ7Ch1pimJzFie4ptb4=",
         "owner": "Maroka-chan",
         "repo": "VPN-Confinement",
-        "rev": "880b3bd2c864dce4f6afc79f6580ca699294c011",
+        "rev": "f2989e1e3cb06c7185939e9ddc368f88b998616a",
         "type": "github"
       },
       "original": {