autopush setup

3 files changed, 66 insertions, 23 deletions

diff --git a/adonis/autopush/default.nix b/adonis/autopush/default.nix
new file mode 100644
index 0000000..4a6b85e
--- /dev/null
+++ b/adonis/autopush/default.nix
@@ -0,0 +1,60 @@
+{
+  config,
+  pkgs,
+  ...
+}: let
+  domain = "push.${config.customOps.domain.fqdn}";
+  port = 2586;
+  redisPort = 6369;
+  endpointPort = 443;
+  autopush = pkgs.autopush-rs;
+in {
+  sops.secrets = {
+    "autopush/autoconnect" = {
+      owner = "autopush";
+    };
+    "autopush/autoendpoint" = {
+      owner = "autopush";
+    };
+  };
+  users.users."autopush" = {
+    group = "autopush";
+    useDefaultShell = true;
+  };
+  environment.systemPackages = [autopush];
+  services.redis.servers."autopush" = {
+    enable = true;
+    port = redisPort;
+  };
+  systemd.services = {
+    autopush-autoconnect = {
+      environment = {
+        AUTOCONNECT__DB_DSN = "redis://127.0.0.1:${redisPort}";
+        AUTOCONNECT__ENDPOINT_SCHEME = "https";
+        AUTOCONNECT__ENDPOINT_HOSTNAME = "update.${domain}";
+        AUTOCONNECT__ENDPOINT_PORT = endpointPort;
+        AUTOCONNECT__ROUTER_HOSTNAME = "127.0.0.1";
+      };
+      wantedBy = ["multi-user.target"];
+      unitConfig.ConditionUser = "autopush";
+      serviceConfig = {
+        EnvironmentFile = config.sops.secrets."autopush/autoconnect".path;
+        ExecStart = "${autopush}/bin/autoconnect";
+      };
+    };
+    autopush-autoendpoint = {
+      environment = {
+        AUTOEND__DB_DSN = "redis://127.0.0.1:${redisPort}";
+        AUTOEND__HOST = "0.0.0.0";
+        AUTOEND__PORT = port;
+        AUTOEND__ENDPOINT_URL = "https://update.${domain}";
+      };
+      wantedBy = ["multi-user.target"];
+      unitConfig.ConditionUser = "autopush";
+      serviceConfig = {
+        EnvironmentFile = config.sops.secrets."autopush/autoendpoint".path;
+        ExecStart = "${autopush}/bin/autoendpoint";
+      };
+    };
+  };
+}
diff --git a/adonis/ntfy/default.nix b/adonis/ntfy/default.nix
deleted file mode 100644
index 9f97e86..0000000
--- a/adonis/ntfy/default.nix
+++ /dev/null
@@ -1,20 +0,0 @@
-{config, ...}: let
-  ntfyDomain = "push.${config.customOps.domain.fqdn}";
-  listen = "127.0.0.1:2586";
-in {
-  services.ntfy-sh = {
-    enable = true;
-    settings = {
-      base-url = "https://${ntfyDomain}";
-      behind-proxy = true;
-      auth-access = ["*:up*:write-only"];
-      listen-http = listen;
-    };
-  };
-
-  services.nginx.virtualHosts.${ntfyDomain} = {
-    forceSSL = true;
-    enableACME = true;
-    locations."/".proxyPass = "http://${listen}";
-  };
-}
diff --git a/secrets.yaml b/secrets.yaml
index 4b04d04..d7ec3e6 100644
--- a/secrets.yaml
+++ b/secrets.yaml
@@ -8,6 +8,9 @@ msci:
     sshkey: ENC[AES256_GCM,data:b4xHoTnmkCYghRylcV2U63Sh/l7sM2YQ76GgHFxHp2HKxo3slRQkgEe6GSgEXD0vYHGoXDCBo7x4Vhvf58nvKOOveHtg+l4w+ypFQ+5DRIl4gLnHBEyIMFm3IXlwKnSV+qAxODKFWkbv9yIatWpJa2K8uXJ5+VbQ2tdDoWi4C51cuhDA7mRydxT4xcKdOFN6ajufFIeYeu867Pr8qUy53j8rYCsBaCIphtv/UW7r1noWKz7P8tt6pU+hpht7BrKu6sUq6lDG7GHnlQjp7Ypj7OQhm1isHHp/5uSabcJ+nkW6MOw39QUDgUEdtka1KN1FTdLaYnzr4OYXKmbvBATEgamgVwYVEbPWgc/0aIDgzn9hQhRII3x/VsoWKB4+TnMaUgvbRJ1ZU9FztMqeX4+gzvXta7ANwzESUvS8ce/kwMKbEAPvbc11YcAYdnxZEoPZ1qVQ3W72WZM6jBd45aDH8wOUxhVAJnw7pPx0xLqb68lFnT+tS2yavHRTUFovdCO3fBu6hl5P2pRe5S2kmkVG,iv:MvmVhJPFMegABugWuXUS3iNU5R26ZaaQARdXeye5Bzs=,tag:59ZGDZSQ+3RovxsgngQy7A==,type:str]
     gpgkey: ENC[AES256_GCM,data:9H3NfqjWiH7N1W6/4jQcfH8ML69V3Pt+8M1KyLvo2ITvX892x/ymvHS6df8JQ2NGzoPia/oZ9cFiDhku8mCX8rcH5o2Dn7CefEMeXpr5MpiZQj83Kz02a5VowbJcEx71ByIdosQl6y1qWFSomjv4xpdlJ1qI7eY168crjkBn/O/P12zDBC+rw6qiGWRsIKufHn+kLcVaw/Z5n0Gt0H2OvtKioyAcZGn1LIWWyzRCIe3UHUtI/6X4AKGuKDGr6kJQfe0xfSRIc1lancjpcvlHIIpJ5QCdbr2jj4Mx26tfgEHidCNAZQH0tckQUvnQGlrGo2eQwAG7CF1W0c1LAXq9N26yhvZRkrAfbGb1nOLJ8njYJR1UEre40TnPcP7sPn8j1z1XvBmPSF5fsTXL9+qvbvT2PBBrXrP6408oHHVLFUm9g50hoYVvf4ZxVXG65pxpN+wyB03vQTvPT/O27Y1ZWfanODWfdUfcSgkYMLS/AysnUmT3Mzbzn1WHBfvwLF1nNY1vC0tRdgfpvXs9XxT/YVPK5WvM1MDSfPvLDyR0BpwfM045bt24ieWU+zSNL9rb16A+F6sjj9JVvEEaRoxV+vP5kGmCx7+jr780RI6GGHXlPn1l1LNnRL3htycSxB6/XBi1sAcM01Ft4b6mOYnCHpFXRLpT82YlL0VqM2ysGDSiC3ROxktowcY5gc1ncvRldn1SpeTKlDTiNwWYDx2YcZrIZICNaSumZRavPiE3hIQiPlGixbj3LvknzV8HwaFXXFO7/50s5E7KFcMbpKEA2sRQVGggyy1gt8YKaW+twk+TKMRoVTqHHSmiPja1HIHbL/qfWx3zABoADeLL5d197yZmm8tzmZd3kbxSg4INtiBYcVqumoTKjcsDM0FkubisLVmUgiDJA1LztH2t/Q8XWipi+JFSmau27n+1g7o3Ev9JLAaVhVz/CXqJkyKXPTolHOO6BNQ2aKHc4yV6IkeXHFUHaq7SX/qApPchW+YPikkdbaSguBQ5j0hpoguj+0VZc02IxMVNUlhHcT0ivNHbtg==,iv:WIiNQzwBB5NShl3kmES0klcsvx5hDk1y/o1TMCscb8E=,tag:U41TaRxxrWgnK3FJfMEXsw==,type:str]
     gpgpwd: ENC[AES256_GCM,data:Mawtj2lOmKRk1jUtSWUb+oFoHTC/dXPkEi3iYiqaNoAms7GSKOPMikdzg0WUBtvTmQ==,iv:qZg4PBCv8Q6YtRygTsnLu/D9VzK4nVRgPET7qbII4xc=,tag:Ux6syzVGySLIwPcfJtDriA==,type:str]
+autopush:
+    autoconnect: ENC[AES256_GCM,data:P9EnkjFbVUECpsfkhkF+YpajpExCRGd+6c2ON+R6BdqTc+2wKE9zjtlWJyG9jZFIWbc0FaJ006+CQbArQDzX/gYeddI=,iv:FNGy8JOPOE3Yhph8ybYeO7PO2xVAB6hi1on110r/qoU=,tag:lV4QdQnO4EqNY6HMZnkU7g==,type:str]
+    autoendpoint: ENC[AES256_GCM,data:6d7kbLY0Wc76JYVh13ppTrvYc2c7pxU3z/X1N2PGzprgfjbUigR0roi7N6SGQjU4vn5VSiP1NayfIHhJXSPJMg==,iv:g/ghu/1nV2nYDCWVICRA8/57qApgTBBRH4aBR7vh45g=,tag:lte4DUVK4KzBHnExBmkcww==,type:str]
 sops:
     age:
         - enc: |
@@ -37,7 +40,7 @@ sops:
             AjeKUiRMROq4PMJYmWXDjToBlvdOFq9oYNl+1mNlcQTMbEkCoqIfrw==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1ra6vn99y233pxrlpcwpuwl7vc8ma5y4ucg5jlkfylh6kudsxzehqznqmet
-    lastmodified: "2026-06-22T21:20:27Z"
-    mac: ENC[AES256_GCM,data:LdF9oiBmbwnCUeIZOF25h11k/V8t4etJovKHlwMzNgMVbj1ZFxYwCkv8iTjVluYZM4rq1DPcNuDM2guAda08XUiIODoJWtvoHTvvX5pEQ6a0BAspFOJUJ4oFnNmABh1WJ0gUnN85s1QYpqB0r3UtT2ZyeFoYtfmkFW5Ujv2z+yg=,iv:vSKE2jTSvzlbqytD2qtjWBznI7HQBhpCycRQl5/PE3M=,tag:O8AC6W6Jzf1W7svdZUs88A==,type:str]
+    lastmodified: "2026-07-11T12:45:22Z"
+    mac: ENC[AES256_GCM,data:tJLIfF68J9w8dnBBByIXT6E2atOfslw9eskAVXoibxL8ht9kG/4JASBbdWKUtGmCtTa/1HKHO3wV9Ts2LF73s5kHp5omwqHbEBPzm2zgtbcHSLCsbDAqKyVhjfezazVNRgBLg2v4Qyw7gsDZPE1w+Df63yWkbHm3l0/ICqf3/TI=,iv:gCvag91E7JgVkCKlDd5RrbEf1WF/m3v3ClesA48i7zc=,tag:XXLSiJGnalytJ5TqEb/uiA==,type:str]
     unencrypted_suffix: _unencrypted
-    version: 3.13.1
+    version: 3.13.2