- Enable DNS-over-TLS (DoT) on port 853 using Nginx's ACME certificates
- Fix an issue where the native NixOS module dropped SOPS client IDs
- Use sops.templates and yq to inject ClientIDs dynamically before start
- Enable allow_unencrypted_doh to fix Nginx proxying DoH correctly
Replace the Podman container and manual YAML templating with the native NixOS module for better system integration and simpler declarative configuration.
AdGuard Home needs write access to working directory.
Config file remains read-only via :ro mount.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Enable crowdsec-firewall-bouncer by default
- Auto-registers bouncer with local CrowdSec API
- Blocks malicious IPs at iptables/nftables level
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Remove LAPI server config causing null coercion error.
Detection-only mode for now; bouncer can be added later.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Remove redundant vaultwarden_admin_token from configuration.nix
(already declared in module)
- Remove unused pkgs parameter from vaultwarden module
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add native NixOS Vaultwarden service module
- Supports WebSocket for real-time sync notifications
- Integrates with nginx via extraLocations for /notifications/hub
- Configurable signup, invitations, and SMTP settings
- Uses SOPS for admin token secret management
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Enable web_search tool with Brave provider
- Add openclaw_brave_api_key secret to SOPS configuration
- Add BRAVE_API_KEY to openclaw.env template
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Move openclaw config to separate json file
- Reference file directly in podman module
- Remove problematic builtins.toJSON with nested arrays
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Use official ghcr.io/openclaw/openclaw image
- configure via JSON config file
- containerized for better isolation
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
