Replace the Podman container and manual YAML templating with the native NixOS module for better system integration and simpler declarative configuration.
AdGuard Home needs write access to working directory.
Config file remains read-only via :ro mount.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Enable crowdsec-firewall-bouncer by default
- Auto-registers bouncer with local CrowdSec API
- Blocks malicious IPs at iptables/nftables level
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Remove LAPI server config causing null coercion error.
Detection-only mode for now; bouncer can be added later.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Remove redundant vaultwarden_admin_token from configuration.nix
(already declared in module)
- Remove unused pkgs parameter from vaultwarden module
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add native NixOS Vaultwarden service module
- Supports WebSocket for real-time sync notifications
- Integrates with nginx via extraLocations for /notifications/hub
- Configurable signup, invitations, and SMTP settings
- Uses SOPS for admin token secret management
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Enable web_search tool with Brave provider
- Add openclaw_brave_api_key secret to SOPS configuration
- Add BRAVE_API_KEY to openclaw.env template
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Move openclaw config to separate json file
- Reference file directly in podman module
- Remove problematic builtins.toJSON with nested arrays
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Use official ghcr.io/openclaw/openclaw image
- configure via JSON config file
- containerized for better isolation
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Systemd service running OpenClaw gateway
- Configurable via sops secrets
- Runs on localhost:18789
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Remove complex rootless container setup that was causing
dependency issues with user-runtime-dir services.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Create modules/ directory with reusable NixOS modules
- Add system module for main user configuration
- Add podman module for rootless container support
- Add nginx module with automatic Let's Encrypt SSL
- Add searxng module with Anubis AI firewall protection
- Configure SearXNG at search.ashisgreat.xyz
- Enable nginx reverse proxy with HTTPS
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
