From 466bd8a7fab4bdefd34dcf4e3b85d65aaccee15a Mon Sep 17 00:00:00 2001 From: aaccardo Date: Mon, 17 Aug 2026 21:02:40 +0200 Subject: [PATCH 1/2] fix: tandoor email support Signed-off-by: aaccardo --- modules/homelab/services/tandoor/README.md | 9 +++++---- modules/homelab/services/tandoor/default.nix | 21 ++++++++++++++++---- 2 files changed, 22 insertions(+), 8 deletions(-) diff --git a/modules/homelab/services/tandoor/README.md b/modules/homelab/services/tandoor/README.md index 5ea37349..69b802c5 100644 --- a/modules/homelab/services/tandoor/README.md +++ b/modules/homelab/services/tandoor/README.md @@ -21,10 +21,11 @@ This creates the following containers on a `tandoor` bridge network: ## 1Password Secrets Required -- `op://Homelab/Tandoor/Authentication/secret key` - Django SECRET_KEY -- `op://Homelab/Tandoor/Database/password` - PostgreSQL password -- `op://Homelab/Tandoor/Authentication/OIDC client secret` - OIDC client secret (if OIDC is enabled) -- `op://Homelab/Backup/Tandoor/password` - Backup encryption key +- `op://HomeLab/Tandoor/Authentication/secret key` - Django SECRET_KEY +- `op://HomeLab/Tandoor/Database/password` - PostgreSQL password +- `op://HomeLab/Tandoor/Authentication/OIDC client secret` - OIDC client secret (if OIDC is enabled) +- `op://HomeLab/Tandoor/Resend/api key` - Resend API key for SMTP +- `op://HomeLab/Backup/Tandoor/password` - Backup encryption key ## OIDC Authentication diff --git a/modules/homelab/services/tandoor/default.nix b/modules/homelab/services/tandoor/default.nix index 69ad652c..de8683e9 100644 --- a/modules/homelab/services/tandoor/default.nix +++ b/modules/homelab/services/tandoor/default.nix @@ -12,6 +12,7 @@ let tandoorDataDir = "/var/lib/data/tandoor"; hosts = config.flake.meta.reverse-proxy.hosts; + domain = config.flake.meta.reverse-proxy.domain; reverseProxyPort = config.flake.meta.reverse-proxy.ports.tandoor; tandoorImage = "ghcr.io/tandoorrecipes/recipes:2.6.13"; tandoorPort = 8080; @@ -113,25 +114,31 @@ in }; tandoorSecretKey = { path = "/run/secrets/tandoor/secret_key"; - reference = "op://Homelab/Tandoor/Authentication/secret key"; + reference = "op://HomeLab/Tandoor/Authentication/secret key"; owner = tandoorUser; group = tandoorGroup; }; tandoorDbPassword = { path = "/run/secrets/tandoor/db_password"; - reference = "op://Homelab/Tandoor/Database/password"; + reference = "op://HomeLab/Tandoor/Database/password"; owner = tandoorUser; group = tandoorGroup; }; tandoorOidcClientSecret = { path = "/run/secrets/tandoor/oidc_client_secret"; - reference = "op://Homelab/Tandoor/Authentication/OIDC client secret"; + reference = "op://HomeLab/Tandoor/Authentication/OIDC client secret"; + owner = tandoorUser; + group = tandoorGroup; + }; + tandoorResendApiKey = { + path = "/run/secrets/tandoor/resend_api_key"; + reference = "op://HomeLab/Tandoor/Resend/api key"; owner = tandoorUser; group = tandoorGroup; }; backupTandoorEncryptionKey = { path = "/run/secrets/tandoor/backup_encryption_key"; - reference = "op://Homelab/Backup/Tandoor/password"; + reference = "op://HomeLab/Backup/Tandoor/password"; owner = tandoorUser; group = tandoorGroup; }; @@ -240,6 +247,11 @@ in environment = { ALLOWED_HOSTS = ".localhost,127.0.0.1,[::1],${hosts.recipes}"; DB_ENGINE = "django.db.backends.postgresql"; + DEFAULT_FROM_EMAIL = "tandoor@${domain}"; + EMAIL_HOST = "smtp.resend.com"; + EMAIL_HOST_USER = "resend"; + EMAIL_PORT = 587; + EMAIL_USE_TLS = 1; HIDE_LOGIN_FORM = 1; POSTGRES_HOST = "db"; POSTGRES_DB = tandoorDbName; @@ -251,6 +263,7 @@ in }; secrets = { + EMAIL_HOST_PASSWORD = osConfig.services.onepassword-secrets.secretPaths.tandoorResendApiKey; FDC_API_KEY = osConfig.services.onepassword-secrets.secretPaths.tandoorFDCApiKey; SECRET_KEY = osConfig.services.onepassword-secrets.secretPaths.tandoorSecretKey; POSTGRES_PASSWORD = osConfig.services.onepassword-secrets.secretPaths.tandoorDbPassword; From 674ba44f6dad4d74e727f1ba3b4b537c041bf456 Mon Sep 17 00:00:00 2001 From: aaccardo Date: Tue, 25 Aug 2026 13:46:09 +0200 Subject: [PATCH 2/2] fix: disable authelia auth for mobile apps Signed-off-by: aaccardo --- modules/homelab/services/dawarich/default.nix | 1 - modules/homelab/services/immich/default.nix | 1 - modules/homelab/services/tandoor/default.nix | 1 - 3 files changed, 3 deletions(-) diff --git a/modules/homelab/services/dawarich/default.nix b/modules/homelab/services/dawarich/default.nix index b9a8e79d..91ad582b 100644 --- a/modules/homelab/services/dawarich/default.nix +++ b/modules/homelab/services/dawarich/default.nix @@ -152,7 +152,6 @@ in services.caddy.virtualHosts."${hosts.timeline}" = { extraConfig = '' - import auth_protected import reverse_proxy_common reverse_proxy localhost:${toString reverseProxyPort} ''; diff --git a/modules/homelab/services/immich/default.nix b/modules/homelab/services/immich/default.nix index f1b18d7f..25984fa0 100644 --- a/modules/homelab/services/immich/default.nix +++ b/modules/homelab/services/immich/default.nix @@ -178,7 +178,6 @@ in services.caddy.virtualHosts."${hosts.immich}" = { extraConfig = '' - import auth_protected import reverse_proxy_common request_body { diff --git a/modules/homelab/services/tandoor/default.nix b/modules/homelab/services/tandoor/default.nix index de8683e9..58ad36c2 100644 --- a/modules/homelab/services/tandoor/default.nix +++ b/modules/homelab/services/tandoor/default.nix @@ -153,7 +153,6 @@ in services.caddy.virtualHosts."${hosts.recipes}" = { extraConfig = '' - import auth_protected import reverse_proxy_common reverse_proxy localhost:${toString reverseProxyPort} '';