Hybrid cloud cluster monorepo with Ansible, K8s, NixOS, and Terraform.
cute.haus
ansible
terraform
nix
k8s
snowpoint: drop navidrome
Aly Raffauf
(Jun 11, 2026, 11:55 AM EDT)
fc55e5dd
d95a207b
+2
-52
+2
-44
nix/hosts/snowpoint.nix
+2
-44
nix/hosts/snowpoint.nix
···
7
7
flake.nixosConfigurations.snowpoint = inputs.nixpkgs.lib.nixosSystem {
8
8
modules = with config.flake.modules.nixos; [
9
9
alloy
10
-
b2-mounts
11
10
backups
12
11
base
13
12
cachefilesd
···
48
47
system.stateVersion = "25.11";
49
48
50
49
sops.secrets = {
51
-
navidrome = {
52
-
sopsFile = ../../secrets/navidrome.yaml;
53
-
key = "env";
54
-
};
55
50
syncthingCert = {
56
51
sopsFile = ../../secrets/syncthing.yaml;
57
52
key = "snowpoint_cert";
58
53
};
54
+
59
55
syncthingKey = {
60
56
sopsFile = ../../secrets/syncthing.yaml;
61
57
key = "snowpoint_key";
62
58
};
63
59
};
64
60
65
-
services = {
66
-
qemuGuest.enable = true;
67
-
68
-
navidrome = {
69
-
enable = true;
70
-
environmentFile = config.sops.secrets.navidrome.path;
71
-
72
-
settings = {
73
-
Address = "0.0.0.0";
74
-
DefaultTheme = "Auto";
75
-
EnableUserEditing = false;
76
-
MusicFolder = "/mnt/Media/Music";
77
-
Port = 4533;
78
-
SubsonicArtistParticipations = true;
79
-
UIWelcomeMessage = "Welcome to Navidrome @ ${config.networking.hostName}";
80
-
81
-
# SSO via traefik-forward-auth in the cluster (auth.cute.haus).
82
-
# TrustedSources is checked against the immediate TCP source — the
83
-
# traefik pod inside the k3s pod CIDR — not against X-Forwarded-For.
84
-
# Subsonic mobile clients hit caddy directly from the tailnet and
85
-
# don't send the header; they fall back to local username/password.
86
-
ExtAuth = {
87
-
UserHeader = "X-Forwarded-User";
88
-
TrustedSources = builtins.concatStringsSep "," [
89
-
"100.64.0.0/10"
90
-
"10.42.0.0/16"
91
-
];
92
-
};
93
-
};
94
-
};
95
-
};
96
-
97
-
systemd.services.navidrome.serviceConfig = {
98
-
Restart = "on-failure";
99
-
RestartSec = "30s";
100
-
};
61
+
services.qemuGuest.enable = true;
101
62
myDisko.installDrive = "/dev/vda";
102
-
103
63
system.autoUpgrade.dates = "03:30";
104
-
105
-
myB2Mounts.cacheDir = "/mnt/Backblaze/.rclone-cache";
106
64
107
65
myK3s = {
108
66
role = "agent";
-8
nix/overlays.nix
-8
nix/overlays.nix
···
1
1
{
2
2
flake.overlays = {
3
3
default = _final: prev: {
4
-
navidrome = prev.navidrome.overrideAttrs (old: {
5
-
env =
6
-
(old.env or {})
7
-
// {
8
-
CGO_CFLAGS_ALLOW = ".*--define-prefix.*";
9
-
};
10
-
});
11
-
12
4
qbittorrent-nox = prev.qbittorrent-nox.overrideAttrs (_old: rec {
13
5
version = "5.2.1";
14
6