- Enable crowdsec-firewall-bouncer by default
- Auto-registers bouncer with local CrowdSec API
- Blocks malicious IPs at iptables/nftables level
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Remove LAPI server config causing null coercion error.
Detection-only mode for now; bouncer can be added later.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Remove redundant vaultwarden_admin_token from configuration.nix
(already declared in module)
- Remove unused pkgs parameter from vaultwarden module
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add native NixOS Vaultwarden service module
- Supports WebSocket for real-time sync notifications
- Integrates with nginx via extraLocations for /notifications/hub
- Configurable signup, invitations, and SMTP settings
- Uses SOPS for admin token secret management
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Enable web_search tool with Brave provider
- Add openclaw_brave_api_key secret to SOPS configuration
- Add BRAVE_API_KEY to openclaw.env template
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Move openclaw config to separate json file
- Reference file directly in podman module
- Remove problematic builtins.toJSON with nested arrays
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Use official ghcr.io/openclaw/openclaw image
- configure via JSON config file
- containerized for better isolation
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Systemd service running OpenClaw gateway
- Configurable via sops secrets
- Runs on localhost:18789
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Remove complex rootless container setup that was causing
dependency issues with user-runtime-dir services.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Create modules/ directory with reusable NixOS modules
- Add system module for main user configuration
- Add podman module for rootless container support
- Add nginx module with automatic Let's Encrypt SSL
- Add searxng module with Anubis AI firewall protection
- Configure SearXNG at search.ashisgreat.xyz
- Enable nginx reverse proxy with HTTPS
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
