nrabulinski/settei
1
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

Compare commits

base: nrabulinski:4ae04f6c6d89d1621d9281fbd3b9d98918c857da
Branches Tags
nrabulinski:main
nrabulinski:bootstrap
nrabulinski:experiments/nilla
...
compare: nrabulinski:21f781a55af394b4b2e04d10d0b3f7bee2275993
Branches Tags
nrabulinski:main
nrabulinski:bootstrap
nrabulinski:experiments/nilla

7 commits
4ae04f6c6d ... 21f781a55a

Author SHA1 Message Date
Nikodem Rabuliński
21f781a55a
fixup! services/forgejo: forgejo but make it COOL
Some checks failed
/ check (pull_request) Failing after 1m44s
Details
2025-03-22 00:53:16 +01:00
Nikodem Rabuliński
9b58ee55bc
services/forgejo: enable git hooks
All checks were successful
/ check (pull_request) Successful in 1m55s
Details
2025-03-22 00:31:30 +01:00
Nikodem Rabuliński
88a3875340
services/forgejo: use latest instead of lts 2025-03-22 00:31:15 +01:00
Nikodem Rabuliński
9169f05ff5
services/forgejo: forgejo but make it COOL 2025-03-22 00:30:42 +01:00
Nikodem Rabuliński
ae66e9fd21
modules/system/containers: enable nat for container interfaces
All checks were successful
/ check (pull_request) Successful in 44s
Details
2025-03-21 23:56:53 +01:00
Nikodem Rabuliński
1a62c97de4
services/forgejo: move from hosts/kazuki 2025-03-21 23:56:53 +01:00
Nikodem Rabuliński
33d2682245
services/kanidm: init 2025-03-21 23:56:51 +01:00
16 changed files with 212 additions and 63 deletions
Download patch file Download diff file Expand all files Collapse all files

BIN
assets/forgejo/apple-touch-icon.png Normal file
View file

Binary file not shown.
Side by side

After

Width:  |  Height:  |  Size: 8 KiB

BIN
assets/forgejo/avatar_default.png Normal file
View file

Binary file not shown.
Side by side

After

Width:  |  Height:  |  Size: 8.9 KiB

BIN
assets/forgejo/favicon.png Normal file
View file

Binary file not shown.
Side by side

After

Width:  |  Height:  |  Size: 8 KiB

1
assets/forgejo/favicon.svg Normal file
View file

@ -0,0 +1 @@
<svg xmlns="http://www.w3.org/2000/svg" xml:space="preserve" viewBox="0 0 133.976 165.76" width="32" height="32"><path d="M149.575 234.069q-1.811-19.766-14.887-37.117l-3.95-2.915q11.298-2.198 20.018-8.145l2.017 2.236q9.435.498 18.673-2.59c-1.959-4.581-5.162-9.942-9.113-15.187 6.358-5.113 10.84-9.91 12.947-15.288q-10.332-.87-17.08.648l4.084-3.329c9.155-4.31 12.227-16.306 12.515-36.033.26-17.767-1.208-32.111-7.701-43.184q-34.73 24.96-35.481 42.674-13.548-18.255-35.253-18.564c.448 5.884 2.21 12.1 5.565 17.243-2.604.285-4.894 1.216-7.86 2.41-12.155-13.611-23.672-29.375-34.413-47.007-8.04 23.269-11.333 40.023-11.455 50.284-.185 15.523 2.061 27.432 8.313 35.773l3.09 3.727-16.712-1.928c2.54 8.707 7.805 10.6 12.388 14.2-3.162 5.672-6.712 11.419-5.2 16.186 4.853 1.053 10.244.317 15.543-.116q12.885 6.631 30.68 9.057c-3.912.199-8.615.27-18.7-1.928q1.927 7.567 10.869 12.33-5.961 4.674-7.947 10.518 5.58-.468 10.226-1.169-3.624 8.152-4.909 17.239" style="fill:#fff;stroke:none;stroke-width:1.5875;stroke-linecap:round;stroke-linejoin:round;stroke-dasharray:none" transform="translate(-42.098 -69.127)"/><path d="M85.842 234.094q1.285-9.087 4.909-17.239-4.646.701-10.226 1.17 1.986-5.845 7.947-10.52-8.94-4.761-10.87-12.33c10.086 2.2 14.79 2.128 18.7 1.929q-17.793-2.425-30.679-9.058c-5.3.434-10.69 1.17-15.543.117-1.512-4.767 2.038-10.514 5.2-16.186-4.583-3.6-9.848-5.493-12.388-14.2l16.713 1.928" style="display:inline;fill:none;stroke:#000;stroke-width:1.5875;stroke-linecap:round;stroke-linejoin:round;stroke-dasharray:none" transform="translate(-42.098 -69.127)"/><path d="M56.514 155.978c-6.252-8.341-8.498-20.25-8.313-35.773.122-10.261 3.416-27.015 11.455-50.284q16.11 26.448 34.068 46.565" style="fill:none;stroke:#000;stroke-width:1.5875;stroke-linecap:round;stroke-linejoin:round;stroke-dasharray:none" transform="translate(-42.098 -69.127)"/><path d="M108.93 122.454q-13.354 2.18-23.374.049c8.248-6.37 12.822-8.004 18.865-8.135" style="fill:none;stroke:#000;stroke-width:1.5875;stroke-linecap:round;stroke-linejoin:round;stroke-dasharray:none" transform="translate(-42.098 -69.127)"/><path d="M102.706 115.642c-3.863-5.34-5.86-12.045-6.342-18.367q21.705.31 35.253 18.563.752-17.712 35.48-42.673c6.494 11.073 7.962 25.417 7.702 43.184-.288 19.727-3.36 31.724-12.515 36.033M158.2 155.71q6.748-1.518 17.08-.647c-2.108 5.378-6.59 10.175-12.947 15.288 3.95 5.245 7.154 10.606 9.113 15.187q-9.237 3.087-18.673 2.59M130.738 194.037q11.298-2.198 20.018-8.145M149.575 234.069q-1.811-19.766-14.887-37.117M65.55 146.77l29.869-1.53M70.019 170.273q-4.53-9.216 1.71-23.82" style="fill:none;stroke:#000;stroke-width:1.5875;stroke-linecap:round;stroke-linejoin:round;stroke-dasharray:none" transform="translate(-42.098 -69.127)"/><path d="M82.462 145.904c-1.913 14.213.121 23.042 6.417 23.03 6.855-.014 8.935-9.064 6.54-23.694" style="fill:#000;stroke:#000;stroke-width:1.5875;stroke-linecap:round;stroke-linejoin:round;stroke-dasharray:none" transform="translate(-42.098 -69.127)"/><path d="M122.796 145.382q13.86-3.124 28.79-1.607" style="fill:none;stroke:#000;stroke-width:1.5875;stroke-linecap:round;stroke-linejoin:round;stroke-dasharray:none" transform="translate(-42.098 -69.127)"/><path d="M143.816 143.298c5.18 5.875 5.983 14.532 4.825 24.09" style="fill:none;stroke:#000;stroke-width:1.5875;stroke-linecap:round;stroke-linejoin:round;stroke-dasharray:none" transform="translate(-42.098 -69.127)"/><path d="M122.796 145.382c-1.413 14.984.295 21.028 5.401 21.024 11.093-.008 5.742-13.933 6.606-22.844" style="fill:#000;stroke:#000;stroke-width:1.5875;stroke-linecap:round;stroke-linejoin:round;stroke-dasharray:none" transform="translate(-42.098 -69.127)"/><path d="M100.913 170.17a31 31 0 0 1 7.467-.58" style="fill:none;stroke:#000;stroke-width:1.5875;stroke-linecap:round;stroke-linejoin:round;stroke-dasharray:none" transform="translate(-42.098 -69.127)"/><path d="M94.877 182.466c3.607 2.981 6.483 2.176 12.251-2.727 6.426 1.76 13.671 4.519 16.185-1.43" style="display:inline;fill:none;stroke:#000;stroke-width:1.5875;stroke-linecap:round;stroke-linejoin:round;stroke-dasharray:none" transform="translate(-42.098 -69.127)"/><path d="M60.71 175.474q2.569-2.85 6.355-2.742c-.29 2.933-.746 3.68-1.211 5.237-.775 2.588 6.18-1.728 9.088-3.278M140.128 175.257l4.115-3.76c.165 2.014-.146 5.294.486 6.06 2.44-.926 4.167-3.563 6.223-5.411" style="fill:none;stroke:#c41818;stroke-width:1.5875;stroke-linecap:round;stroke-linejoin:round;stroke-dasharray:none;stroke-opacity:1" transform="translate(-42.098 -69.127)"/></svg>
Side by side

After

Width:  |  Height:  |  Size: 4.4 KiB

BIN
assets/forgejo/logo.png Normal file
View file

Binary file not shown.
Side by side

After

Width:  |  Height:  |  Size: 27 KiB

1
assets/forgejo/logo.svg Normal file
View file

@ -0,0 +1 @@
<svg xmlns="http://www.w3.org/2000/svg" xml:space="preserve" viewBox="0 0 133.976 165.76" width="32" height="32"><path d="M149.575 234.069q-1.811-19.766-14.887-37.117l-3.95-2.915q11.298-2.198 20.018-8.145l2.017 2.236q9.435.498 18.673-2.59c-1.959-4.581-5.162-9.942-9.113-15.187 6.358-5.113 10.84-9.91 12.947-15.288q-10.332-.87-17.08.648l4.084-3.329c9.155-4.31 12.227-16.306 12.515-36.033.26-17.767-1.208-32.111-7.701-43.184q-34.73 24.96-35.481 42.674-13.548-18.255-35.253-18.564c.448 5.884 2.21 12.1 5.565 17.243-2.604.285-4.894 1.216-7.86 2.41-12.155-13.611-23.672-29.375-34.413-47.007-8.04 23.269-11.333 40.023-11.455 50.284-.185 15.523 2.061 27.432 8.313 35.773l3.09 3.727-16.712-1.928c2.54 8.707 7.805 10.6 12.388 14.2-3.162 5.672-6.712 11.419-5.2 16.186 4.853 1.053 10.244.317 15.543-.116q12.885 6.631 30.68 9.057c-3.912.199-8.615.27-18.7-1.928q1.927 7.567 10.869 12.33-5.961 4.674-7.947 10.518 5.58-.468 10.226-1.169-3.624 8.152-4.909 17.239" style="fill:#fff;stroke:none;stroke-width:1.5875;stroke-linecap:round;stroke-linejoin:round;stroke-dasharray:none" transform="translate(-42.098 -69.127)"/><path d="M85.842 234.094q1.285-9.087 4.909-17.239-4.646.701-10.226 1.17 1.986-5.845 7.947-10.52-8.94-4.761-10.87-12.33c10.086 2.2 14.79 2.128 18.7 1.929q-17.793-2.425-30.679-9.058c-5.3.434-10.69 1.17-15.543.117-1.512-4.767 2.038-10.514 5.2-16.186-4.583-3.6-9.848-5.493-12.388-14.2l16.713 1.928" style="display:inline;fill:none;stroke:#000;stroke-width:1.5875;stroke-linecap:round;stroke-linejoin:round;stroke-dasharray:none" transform="translate(-42.098 -69.127)"/><path d="M56.514 155.978c-6.252-8.341-8.498-20.25-8.313-35.773.122-10.261 3.416-27.015 11.455-50.284q16.11 26.448 34.068 46.565" style="fill:none;stroke:#000;stroke-width:1.5875;stroke-linecap:round;stroke-linejoin:round;stroke-dasharray:none" transform="translate(-42.098 -69.127)"/><path d="M108.93 122.454q-13.354 2.18-23.374.049c8.248-6.37 12.822-8.004 18.865-8.135" style="fill:none;stroke:#000;stroke-width:1.5875;stroke-linecap:round;stroke-linejoin:round;stroke-dasharray:none" transform="translate(-42.098 -69.127)"/><path d="M102.706 115.642c-3.863-5.34-5.86-12.045-6.342-18.367q21.705.31 35.253 18.563.752-17.712 35.48-42.673c6.494 11.073 7.962 25.417 7.702 43.184-.288 19.727-3.36 31.724-12.515 36.033M158.2 155.71q6.748-1.518 17.08-.647c-2.108 5.378-6.59 10.175-12.947 15.288 3.95 5.245 7.154 10.606 9.113 15.187q-9.237 3.087-18.673 2.59M130.738 194.037q11.298-2.198 20.018-8.145M149.575 234.069q-1.811-19.766-14.887-37.117M65.55 146.77l29.869-1.53M70.019 170.273q-4.53-9.216 1.71-23.82" style="fill:none;stroke:#000;stroke-width:1.5875;stroke-linecap:round;stroke-linejoin:round;stroke-dasharray:none" transform="translate(-42.098 -69.127)"/><path d="M82.462 145.904c-1.913 14.213.121 23.042 6.417 23.03 6.855-.014 8.935-9.064 6.54-23.694" style="fill:#000;stroke:#000;stroke-width:1.5875;stroke-linecap:round;stroke-linejoin:round;stroke-dasharray:none" transform="translate(-42.098 -69.127)"/><path d="M122.796 145.382q13.86-3.124 28.79-1.607" style="fill:none;stroke:#000;stroke-width:1.5875;stroke-linecap:round;stroke-linejoin:round;stroke-dasharray:none" transform="translate(-42.098 -69.127)"/><path d="M143.816 143.298c5.18 5.875 5.983 14.532 4.825 24.09" style="fill:none;stroke:#000;stroke-width:1.5875;stroke-linecap:round;stroke-linejoin:round;stroke-dasharray:none" transform="translate(-42.098 -69.127)"/><path d="M122.796 145.382c-1.413 14.984.295 21.028 5.401 21.024 11.093-.008 5.742-13.933 6.606-22.844" style="fill:#000;stroke:#000;stroke-width:1.5875;stroke-linecap:round;stroke-linejoin:round;stroke-dasharray:none" transform="translate(-42.098 -69.127)"/><path d="M100.913 170.17a31 31 0 0 1 7.467-.58" style="fill:none;stroke:#000;stroke-width:1.5875;stroke-linecap:round;stroke-linejoin:round;stroke-dasharray:none" transform="translate(-42.098 -69.127)"/><path d="M94.877 182.466c3.607 2.981 6.483 2.176 12.251-2.727 6.426 1.76 13.671 4.519 16.185-1.43" style="display:inline;fill:none;stroke:#000;stroke-width:1.5875;stroke-linecap:round;stroke-linejoin:round;stroke-dasharray:none" transform="translate(-42.098 -69.127)"/><path d="M60.71 175.474q2.569-2.85 6.355-2.742c-.29 2.933-.746 3.68-1.211 5.237-.775 2.588 6.18-1.728 9.088-3.278M140.128 175.257l4.115-3.76c.165 2.014-.146 5.294.486 6.06 2.44-.926 4.167-3.563 6.223-5.411" style="fill:none;stroke:#c41818;stroke-width:1.5875;stroke-linecap:round;stroke-linejoin:round;stroke-dasharray:none;stroke-opacity:1" transform="translate(-42.098 -69.127)"/></svg>
Side by side

After

Width:  |  Height:  |  Size: 4.4 KiB

3
flake.nix
View file

@ -65,6 +65,9 @@
# racket
"*.rkt"
"**/rashrc"
# custom assets
"*.png"
];
settings.on-unmatched = "fatal";
};

1
hosts/kazuki/default.nix
View file

@ -15,7 +15,6 @@
./storage.nix
./ntfy.nix
./zitadel.nix
./forgejo.nix
./prometheus.nix
];

62
hosts/kazuki/forgejo.nix
View file

@ -1,62 +0,0 @@
{ config, ... }:
{
age.secrets.rab-lol-cf = {
file = ../../secrets/rab-lol-cf.age;
owner = config.services.nginx.user;
};
services.forgejo = {
enable = true;
settings = {
server = {
DOMAIN = "git.rab.lol";
ROOT_URL = "https://git.rab.lol/";
};
oauth2_client = {
REGISTER_EMAIL_CONFIRM = false;
ENABLE_AUTO_REGISTRATION = true;
ACCOUNT_LINKING = "auto";
UPDATE_AVATAR = true;
};
service = {
DISABLE_REGISTRATION = false;
ALLOW_ONLY_INTERNAL_REGISTRATION = false;
ALLOW_ONLY_EXTERNAL_REGISTRATION = true;
};
federation.ENABLED = true;
};
repositoryRoot = "/storage-box/forgejo/repos";
lfs = {
enable = true;
contentDir = "/storage-box/forgejo/lfs";
};
};
services.nginx = {
enable = true;
recommendedProxySettings = true;
recommendedGzipSettings = true;
recommendedOptimisation = true;
recommendedTlsSettings = true;
virtualHosts."git.rab.lol" = {
forceSSL = true;
enableACME = true;
acmeRoot = null;
locations."/" = {
proxyPass = "http://127.0.0.1:3000";
extraConfig = ''
proxy_set_header Connection $http_connection;
proxy_set_header Upgrade $http_upgrade;
'';
};
};
};
users.users.nginx.extraGroups = [ "acme" ];
security.acme.acceptTerms = true;
security.acme.certs."git.rab.lol" = {
dnsProvider = "cloudflare";
credentialsFile = config.age.secrets.rab-lol-cf.path;
email = "nikodem@rabulinski.com";
};
}

11
modules/system/containers.nix
View file

@ -85,6 +85,12 @@ let
services.openssh.hostKeys = [ ];
system.stateVersion = lib.mkDefault config.system.stateVersion;
networking.useHostResolvConf = false;
networking.nameservers = [
"1.1.1.1"
"1.0.0.1"
];
};
bindMounts = {
@ -95,6 +101,11 @@ let
privateNetwork = lib.mkForce true;
}
) config.settei.containers;
networking.nat = lib.mkIf (config.settei.containers != { }) {
enable = true;
internalInterfaces = [ "ve-+" ];
};
};
darwinConfig = lib.optionalAttrs (!isLinux) {

7
secrets/kanidm-admin-pass.age Normal file
View file

@ -0,0 +1,7 @@
age-encryption.org/v1
-> ssh-ed25519 84j9mw W4+Z4WjOyUl4mWPqVykNWRhf2/8qfVOSM7QCFPNMZTA
0ndQjslMwjQqguN25nBQtCchpCLhoD/vrxh1yNVeTNw
-> ssh-ed25519 GKhvwg H8XcFJDZTA3IzxmK6wbB+PVM2gCZ4ysAPjL5j0LgeE0
kehTMRIVOZ5ubtO7w8WF+gU3sjYXMQtd5hH+wcv3uSE
--- 72ntrRbWq8pdkk/GrsVupTttfY9t+w3l+2KQbQyNn/I
iydìû$vVl TK$4G[€â· ©âMI[™#t—¹ °ôz:‰ñÍÙr9~½ESÃA»6Œ}×µ

8
secrets/kanidm-idm-admin-pass.age Normal file
View file

@ -0,0 +1,8 @@
age-encryption.org/v1
-> ssh-ed25519 84j9mw 8zYeVXx36dpC8TxMdoM1GdERoNNj902KwTF4h/r4inM
n3mYra0BeM4gWsZ7Roilu14o/GajX1iWw0fcy0q31yc
-> ssh-ed25519 GKhvwg cqd7YmVpbxqZxaVluHDZ8Yw0gNfJCKMmoWa4mEoXym8
Gbcj+PJaqyPRRGX4olr7mmJ5IoEGlQaogYbj7i9E/98
--- LoQPWI+m8s3NjalUh0+xdW54c8lgddBmhPoIiPbmR8I
‘ê¢èÒ–Æœ܉ ÈY
ž9˜ä­Å!4<>šÞ2DV³£P²·‘9¡N<C2A1>]G;ÎÏ?ˆÐ‰S± '

8
secrets/secrets.nix
View file

@ -97,4 +97,12 @@ in
keys.system.ude
keys.other.bootstrap
];
"kanidm-admin-pass.age".publicKeys = [
keys.system.kazuki
keys.other.bootstrap
];
"kanidm-idm-admin-pass.age".publicKeys = [
keys.system.kazuki
keys.other.bootstrap
];
}

2
services/default.nix
View file

@ -2,5 +2,7 @@
imports = [
./attic.nix
./forgejo-runner.nix
./kanidm.nix
./forgejo.nix
];
}

86
services/forgejo.nix Normal file
View file

@ -0,0 +1,86 @@
{
services.forgejo = {
host = "kazuki";
ports = [ 3000 ];
config =
{ config, pkgs, ... }:
{
age.secrets.rab-lol-cf = {
file = ../secrets/rab-lol-cf.age;
owner = config.services.nginx.user;
};
services.forgejo = {
enable = true;
package = pkgs.forgejo;
settings = {
server = {
DOMAIN = "git.rab.lol";
ROOT_URL = "https://git.rab.lol/";
};
security = {
DISABLE_GIT_HOOKS = false;
};
oauth2_client = {
REGISTER_EMAIL_CONFIRM = false;
ENABLE_AUTO_REGISTRATION = true;
ACCOUNT_LINKING = "auto";
UPDATE_AVATAR = true;
};
service = {
DISABLE_REGISTRATION = false;
ALLOW_ONLY_INTERNAL_REGISTRATION = false;
ALLOW_ONLY_EXTERNAL_REGISTRATION = true;
};
federation.ENABLED = true;
};
repositoryRoot = "/storage-box/forgejo/repos";
lfs = {
enable = true;
contentDir = "/storage-box/forgejo/lfs";
};
};
systemd.tmpfiles.rules =
let
cfg = config.services.forgejo;
imgDir = pkgs.runCommand "forgejo-img-dir" {} ''
cp -R ${../assets/forgejo} "$out"
'';
in
[
"d '${cfg.customDir}/public' 0750 ${cfg.user} ${cfg.group} - -"
"d '${cfg.customDir}/public/assets' 0750 ${cfg.user} ${cfg.group} - -"
"L+ '${cfg.customDir}/public/assets/img' - - - - ${imgDir}"
];
services.nginx = {
enable = true;
recommendedProxySettings = true;
recommendedGzipSettings = true;
recommendedOptimisation = true;
recommendedTlsSettings = true;
virtualHosts."git.rab.lol" = {
forceSSL = true;
enableACME = true;
acmeRoot = null;
locations."/" = {
proxyPass = "http://127.0.0.1:3000";
extraConfig = ''
proxy_set_header Connection $http_connection;
proxy_set_header Upgrade $http_upgrade;
'';
};
};
};
users.users.nginx.extraGroups = [ "acme" ];
security.acme.acceptTerms = true;
security.acme.certs."git.rab.lol" = {
dnsProvider = "cloudflare";
credentialsFile = config.age.secrets.rab-lol-cf.path;
email = "nikodem@rabulinski.com";
};
};
};
}

85
services/kanidm.nix Normal file
View file

@ -0,0 +1,85 @@
{
services.kanidm =
let
port = 8443;
domain = "auth.rabulinski.com";
in
{
host = "kazuki";
ports = [ port ];
config =
{ config, pkgs, ... }:
let
cert = config.security.acme.certs.${domain};
in
{
age.secrets.rabulinski-com-cf = {
file = ../secrets/rabulinski-com-cf.age;
owner = config.services.nginx.user;
};
age.secrets.kanidm-admin-pass = {
file = ../secrets/kanidm-admin-pass.age;
owner = "kanidm";
};
age.secrets.kanidm-idm-admin-pass = {
file = ../secrets/kanidm-idm-admin-pass.age;
owner = "kanidm";
};
services.kanidm = {
enableServer = true;
package = pkgs.kanidmWithSecretProvisioning;
serverSettings = {
bindaddress = "127.0.0.1:${toString port}";
inherit domain;
origin = "https://${domain}";
trust_x_forward_for = true;
tls_chain = "${cert.directory}/fullchain.pem";
tls_key = "${cert.directory}/key.pem";
};
provision = {
enable = true;
idmAdminPasswordFile = config.age.secrets.kanidm-idm-admin-pass.path;
adminPasswordFile = config.age.secrets.kanidm-admin-pass.path;
};
};
systemd.services.kanidm.serviceConfig = {
SupplementaryGroups = [ cert.group ];
};
users.users.nginx.extraGroups = [ "acme" ];
networking.firewall.allowedTCPPorts = [
80
443
];
services.nginx = {
enable = true;
recommendedProxySettings = true;
recommendedGzipSettings = true;
recommendedOptimisation = true;
recommendedTlsSettings = true;
virtualHosts."auth.rabulinski.com" = {
forceSSL = true;
enableACME = true;
acmeRoot = null;
locations."/" = {
proxyPass = "https://localhost:${toString port}";
proxyWebsockets = true;
extraConfig = ''
proxy_ssl_verify off;
proxy_ssl_name ${domain};
'';
};
};
};
security.acme.certs.${domain} = {
dnsProvider = "cloudflare";
credentialsFile = config.age.secrets.rabulinski-com-cf.path;
reloadServices = [ "kanidm" ];
};
};
};
}