10 files changed, 193 insertions, 4 deletions

diff --git a/hosts/surtr/changedetection-io.nix b/hosts/surtr/changedetection-io.nix
new file mode 100644
index 00000000..bfdedee1
--- /dev/null
+++ b/hosts/surtr/changedetection-io.nix
@@ -0,0 +1,66 @@
+{ config, ... }:
+
+{
+  config = {
+    security.acme.rfc2136Domains = {
+      "changedetection.yggdrasil.li" = {
+        restartUnits = ["nginx.service"];
+      };
+    };
+
+    services.nginx = {
+      upstreams."changedetection-io" = {
+        servers = {
+          "[2a03:4000:52:ada:4:1::]:5001" = {};
+        };
+        extraConfig = ''
+          keepalive 8;
+        '';
+      };
+      virtualHosts = {
+        "changedetection.yggdrasil.li" = {
+          kTLS = true;
+          http3 = true;
+          forceSSL = true;
+          sslCertificate = "/run/credentials/nginx.service/changedetection.yggdrasil.li.pem";
+          sslCertificateKey = "/run/credentials/nginx.service/changedetection.yggdrasil.li.key.pem";
+          sslTrustedCertificate = "/run/credentials/nginx.service/changedetection.yggdrasil.li.chain.pem";
+          extraConfig = ''
+            charset utf-8;
+          '';
+
+          locations = {
+            "/".extraConfig = ''
+              proxy_pass http://changedetection-io;
+
+              proxy_http_version 1.1;
+              proxy_set_header Upgrade $http_upgrade;
+              proxy_set_header Connection "upgrade";
+
+              proxy_redirect off;
+              proxy_set_header Host $host;
+              proxy_set_header X-Real-IP $remote_addr;
+              proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+              proxy_set_header X-Forwarded-Host $server_name;
+              proxy_set_header X-Forwarded-Proto $scheme;
+
+              client_max_body_size 0;
+              proxy_request_buffering off;
+              proxy_buffering off;
+            '';
+          };
+        };
+      };
+    };
+
+    systemd.services.nginx = {
+      serviceConfig = {
+        LoadCredential = [
+          "changedetection.yggdrasil.li.key.pem:${config.security.acme.certs."changedetection.yggdrasil.li".directory}/key.pem"
+          "changedetection.yggdrasil.li.pem:${config.security.acme.certs."changedetection.yggdrasil.li".directory}/fullchain.pem"
+          "changedetection.yggdrasil.li.chain.pem:${config.security.acme.certs."changedetection.yggdrasil.li".directory}/chain.pem"
+        ];
+      };
+    };
+  };
+}
diff --git a/hosts/surtr/default.nix b/hosts/surtr/default.nix
index 1c66df2b..4a9bd6fe 100644
--- a/hosts/surtr/default.nix
+++ b/hosts/surtr/default.nix
@@ -8,6 +8,7 @@ with lib;
     ./zfs.nix ./dns ./tls ./http ./bifrost ./matrix ./postgresql
     ./prometheus ./email ./vpn ./borg.nix ./etebase ./immich.nix
     ./paperless.nix ./hledger.nix ./audiobookshelf.nix ./kimai.nix
+    ./changedetection-io.nix
   ];
 
   config = {
diff --git a/hosts/surtr/dns/default.nix b/hosts/surtr/dns/default.nix
index 8aca2b97..96599901 100644
--- a/hosts/surtr/dns/default.nix
+++ b/hosts/surtr/dns/default.nix
@@ -157,7 +157,7 @@ in {
         ${concatMapStringsSep "\n" mkZone [
           { domain = "yggdrasil.li";
             addACLs = { "yggdrasil.li" = ["ymir_acme_acl"]; };
-            acmeDomains = ["surtr.yggdrasil.li" "yggdrasil.li" "etesync.yggdrasil.li" "immich.yggdrasil.li" "app.etesync.yggdrasil.li" "paperless.yggdrasil.li" "hledger.yggdrasil.li" "audiobookshelf.yggdrasil.li" "kimai.yggdrasil.li"];
+            acmeDomains = ["surtr.yggdrasil.li" "yggdrasil.li" "etesync.yggdrasil.li" "immich.yggdrasil.li" "app.etesync.yggdrasil.li" "paperless.yggdrasil.li" "hledger.yggdrasil.li" "audiobookshelf.yggdrasil.li" "kimai.yggdrasil.li" "changedetection.yggdrasil.li"];
           }
           { domain = "nights.email";
             addACLs = { "nights.email" = ["ymir_acme_acl"]; };
diff --git a/hosts/surtr/dns/keys/changedetection.yggdrasil.li_acme b/hosts/surtr/dns/keys/changedetection.yggdrasil.li_acme
new file mode 100644
index 00000000..dcc7f85b
--- /dev/null
+++ b/hosts/surtr/dns/keys/changedetection.yggdrasil.li_acme
@@ -0,0 +1,18 @@
+{
+        "data": "ENC[AES256_GCM,data:QWZAer8xKZvAGl3HxaIdsOT1n3os4EDyQoZOU3YzwDpPfweVRhhBfyAg7M6rMRj8K8ffkkRWatDmgyHV1R43GfNyb1sLjqdqPysYXxC8KlP22WlT+1xstQ2q1KYmeN6VEKF0q+QOMMPRvwQbSQ0eC4mXcE+WgQSTVywjab9hQuc8vin69RbFxbhepxYLXT1rzQpLlxFmUNZBcLpSqsHkSDa2B0d4j2kIvSl2BuUgb3QJwgyNS5pGbnfyVfmus7p5+/pVFCe5EwTVjwgpn/cpIB0mu1Bbt9r0EvCkYXI6wKcLDVbfdV7KsA==,iv:wjHpcClpybzCIi3JhxgXTd5nW9y223pJn2rBde/2cy8=,tag:etfnmj+HhIKeZMGjxE5jiw==,type:str]",
+        "sops": {
+                "age": [
+                        {
+                                "recipient": "age1rmmhetcmllq0ahl5qznlr0eya2zdxwl9h6y5wnl97d2wtyx5t99sm2u866",
+                                "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlWkk2Z0FUNlNoaFVaSFEr\nSE54eUpHaTNzTTdjaytJemtQUW1mWjJNUGhzCkU1OGlNb3pidVFKalVCZUhBODNi\nMjcxR0xLUDRwYkZ5V2I1Q3Z6Y2pmRWMKLS0tIGNzaGNiTEMvdEhBMDRZY2pDQzNu\nWkpkcVNYVjJZQS9QRHEyOUx6RVpQVjAKKGjVrfeovCIml2hExydC9Cd7PyungtpJ\nCdXfrvzP/OtoBSiEDQGC2VafwKkZ98dQqVRnfVApDoxdVQ8vIrxmKQ==\n-----END AGE ENCRYPTED FILE-----\n"
+                        },
+                        {
+                                "recipient": "age19a7j77w267z04zls7m28a8hj4a0g5af6ltye2d5wypg33c3l89csd4r9zq",
+                                "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTbUNBV1NYZEtKaDlzUVBF\nU2IrZ3dSWS9keVE1ak9qWkppc1hOY3JpMjEwCmNUbVJJMFNObmptVGQ0K1ovanVm\nc1dzN0VRVThyVWxPWTFLbldPQnE3Z2sKLS0tIEdWRENRRFROSm5SQ04yTG1wZWJ2\nNDMxK1ArYmdiQWJZV0d2TElZcFZLNVEKtmVrSIOcP4Ek1WW85f2/dNVYQMz9XqZ3\n0J04kqvkHZuM8PiBDg2l2rSh0xhHz3xb1iBhAddLXEjeEfy6o9HKyg==\n-----END AGE ENCRYPTED FILE-----\n"
+                        }
+                ],
+                "lastmodified": "2025-12-08T12:46:12Z",
+                "mac": "ENC[AES256_GCM,data:waY6IDfabZ8B8069liXh7RXjgUTpOdr4U9VQK5xYRujAlI//Ea5lM2ODHJ7PrAkZsK0TGB9ezN8SA5QpxYZwOcpxg45jNbTALxZsZMEzrtCy4wSiBdiLvRoTXvwMZsnsaQEGk2ij2rEqNEOYYBFapBoIz2w5kbEZrrhVRHSkNME=,iv:tpU++qliONinepku/gdPJQ/h2NdyNw3GY+RV+6UM07U=,tag:yieMw3BOC134zAIqb1Fvjg==,type:str]",
+                "version": "3.11.0"
+        }
+}
diff --git a/hosts/surtr/dns/zones/li.yggdrasil.soa b/hosts/surtr/dns/zones/li.yggdrasil.soa
index 500194ae..5234576f 100644
--- a/hosts/surtr/dns/zones/li.yggdrasil.soa
+++ b/hosts/surtr/dns/zones/li.yggdrasil.soa
@@ -1,7 +1,7 @@
 $ORIGIN yggdrasil.li.
 $TTL 3600
 @ IN SOA ns.yggdrasil.li. hostmaster.yggdrasil.li (
-  2025060700 ; serial
+  2025120800 ; serial
   10800      ; refresh
   3600       ; retry
   604800     ; expire
@@ -109,6 +109,14 @@ _acme-challenge.kimai	IN	NS	ns.yggdrasil.li.
 
 kimai                   IN      HTTPS   1 . alpn="h2,h3" ipv4hint="202.61.241.61" ipv6hint="2a03:4000:52:ada::"
 
+changedetection                 IN      A       202.61.241.61
+changedetection                 IN      AAAA    2a03:4000:52:ada::
+changedetection                 IN      MX      0 surtr.yggdrasil.li
+changedetection                 IN      TXT     "v=spf1 redirect=surtr.yggdrasil.li"
+_acme-challenge.changedetection IN      NS      ns.yggdrasil.li.
+
+changedetection                 IN      HTTPS   1 . alpn="h2,h3" ipv4hint="202.61.241.61" ipv6hint="2a03:4000:52:ada::"
+
 vidhar                  IN      AAAA    2a03:4000:52:ada:4:1::
 vidhar                  IN      MX      0 ymir.yggdrasil.li
 vidhar                  IN      TXT     "v=spf1 redirect=yggdrasil.li"
diff --git a/hosts/surtr/tls/tsig_keys/changedetection.yggdrasil.li b/hosts/surtr/tls/tsig_keys/changedetection.yggdrasil.li
new file mode 100644
index 00000000..ac332fe5
--- /dev/null
+++ b/hosts/surtr/tls/tsig_keys/changedetection.yggdrasil.li
@@ -0,0 +1,18 @@
+{
+        "data": "ENC[AES256_GCM,data:OD12OI11EpjWIGtCGzSIeFXIht1tM7YrEbo3XqcxD0XFaZ3CrELJgru9gtN/,iv:SXPNed6CUWCUDomJbx1kOjvxTBoHrgb6tKw9Jb/Qa0M=,tag:RiueVMBSdAF96d6190bwfg==,type:str]",
+        "sops": {
+                "age": [
+                        {
+                                "recipient": "age1rmmhetcmllq0ahl5qznlr0eya2zdxwl9h6y5wnl97d2wtyx5t99sm2u866",
+                                "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwR3FGdks2TUtkSUJLcG1v\nbXZmWFZNVmc3a0x5d2tPNmpJVDJPQmIyNkFNClAwNzI0aHE5SFdaQ0RoZnE0ZEx5\nL3IzQTRpd0g4cHJSUHlrbGtRK283SEkKLS0tIDdLVzE0SFgvS0l1eDd5SHVQQ1By\nNmZ1M0cxSnNxTE5OdHBLZ2FFRWhXdUkKTykJ2kRJPrcPwuw3ufNaCJ6pOuvtDUcl\noHizOV+Yco7nhKtINE93mD4xIiER0i5h7lpKOTUGgjzhjJP2DR7ifw==\n-----END AGE ENCRYPTED FILE-----\n"
+                        },
+                        {
+                                "recipient": "age19a7j77w267z04zls7m28a8hj4a0g5af6ltye2d5wypg33c3l89csd4r9zq",
+                                "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxNVRmMVIvVVZ4SkVMUC9o\nOVMxekNiZTRJWTExMHU5Q3lOaVFkbnhGT3lrCmM3ZjNSV056WjlTeEZzdHpKL1Fl\nbFF4R1phSitzWlY2dFJuRDFvK09LWm8KLS0tIEZINU5KallPdnZsZEh6WUxJYW1K\ncEV0ZkJVK2JiZ1ZtSTZRQUtiaGFBTEkKC6DQLWqY4WrRCSRrWAqlvjw6lp0Y+XGo\nrwxWMwyEocizMR6i//a5P8RBPnvzAEHbXMobI4mSDyfIdezWUX/QNA==\n-----END AGE ENCRYPTED FILE-----\n"
+                        }
+                ],
+                "lastmodified": "2025-12-08T12:46:13Z",
+                "mac": "ENC[AES256_GCM,data:FLdO6Bz74+aTd9ns8ysbcrNdwogJvnm/sRRTLntf5zAH16MyI+QbsBo2LORWr5O3t24+EfmZBhMsfj/AXvqkcMFjPwIhALQpPjjT2JfAsLFtSUqZRjBNKYkfoLlTUKb083RgDjEUIVGgsZzJLCyFtfZP0NXicTUsUz9mRZCYwYU=,iv:sSPuuoE3qgt+Qhh76rZtSCBnHYLK3AN7IljUDkr14AE=,tag:56rYSDonQwfKjNR5fBgQiA==,type:str]",
+                "version": "3.11.0"
+        }
+}
diff --git a/hosts/vidhar/changedetection-io/changedetection-io_env b/hosts/vidhar/changedetection-io/changedetection-io_env
new file mode 100644
index 00000000..626c6f0e
--- /dev/null
+++ b/hosts/vidhar/changedetection-io/changedetection-io_env
@@ -0,0 +1,19 @@
+{
+        "data": "ENC[AES256_GCM,data:blHQ1oSNZfw7Xpkconzv7ft18WVSkINjoqnZAfKWsaTszMfYzZWNJ1uQ17UnfTmGJqvzaBBsToiOxzxUQBztamFY+CWXy3AqqqwgI5rOo14AiuvpCj7NvOA/7WVgq6RUoBaE9ao=,iv:RWvPBN5mIVzP2QQzNvU8ciTzRDBVhAk8Qu+6QuNO8/E=,tag:Q3jnhD+aZ7Qr8oUsdyRnLA==,type:str]",
+        "sops": {
+                "age": [
+                        {
+                                "recipient": "age1rmmhetcmllq0ahl5qznlr0eya2zdxwl9h6y5wnl97d2wtyx5t99sm2u866",
+                                "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1UUhJUmpoZTloWXRpVk1Y\nb3FYTEI4T0V6RGlyL3NoK3JXMEJKeUwraFEwCjBTZTBwUUVUbkt4Y1N6ajZiN2dF\nd2pHTFA0dHFYMjVFZnZhdnhrdW11Z2sKLS0tIFA2NllMUFk0ZENGblhMaXpiVmo4\nelZTRWdsVFIyRmRGTURTRmg4cWdsWVUKMY10ZEzhcZAC95W35e3To/DXkCptZeNG\nkmVVtP0VzE3AM2oA+W957MRX81PHKb27We6OmxGrIYITsz4Atjj+Vg==\n-----END AGE ENCRYPTED FILE-----\n"
+                        },
+                        {
+                                "recipient": "age1qffdqvy9arld9zd5a5cylt0n98xhcns5shxhrhwjq5g4qa844ejselaa4l",
+                                "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtcVFmN3JHdE5HamYzSUlX\nVXBTM1QxZG9RU2V4SlphWUw4QTJoMDJ3QzNVCkhVbUZELzZ3eDZ3aWIxMDFqTUh4\nWncwUUs3dFBUOTVjUmZYL21CNnhSZ1EKLS0tIDJXRUpmVHBxUmRLWnpZOHNQaWdK\ndEF2Z00xUmJBczM2TmZ3N2Y2RmxFaW8KYVV1Q6gxC4TR5VzytLY3zo7O0QsXAYEc\nW9kifMY8dy7zDt1X8BNAO94nLqTDPFJ68uhra3QG5e4z6WHyoF5iLg==\n-----END AGE ENCRYPTED FILE-----\n"
+                        }
+                ],
+                "lastmodified": "2025-12-08T15:07:34Z",
+                "mac": "ENC[AES256_GCM,data:jQeuCBHj3ZKxYhRrADE4qskvcKzTcVV6lhAT8o1mxbb8RSdCsrAKnEC8o74TmMP7D5rup3jx73YoOPC71yDJLm+TXiIIHQWlPpiNRCrkBUcioJQbmQmiioRbKkojzb5q4ike2UOMcBUlv1q/ztlOk+av0nW607JV5/gDxuGE0tA=,iv:fOtYfrb3ubb3PU99p2l8sseja45r1ZMzIJG9Uhqn/xc=,tag:F3KFy1oIbVUBMwzNALbz5g==,type:str]",
+                "unencrypted_suffix": "_unencrypted",
+                "version": "3.11.0"
+        }
+}
diff --git a/hosts/vidhar/changedetection-io/default.nix b/hosts/vidhar/changedetection-io/default.nix
new file mode 100644
index 00000000..c6812747
--- /dev/null
+++ b/hosts/vidhar/changedetection-io/default.nix
@@ -0,0 +1,50 @@
+{ config, pkgs, ... }:
+
+{
+  config = {
+    services.changedetection-io = {
+      enable = true;
+      behindProxy = true;
+      # playwrightSupport = true;
+      baseURL = "https://changedetection.yggdrasil.li";
+      listenAddress = "2a03:4000:52:ada:4:1::";
+      port = 5001;
+      environmentFile = config.sops.secrets."changedetection-io_env".path;
+    };
+
+    sops.secrets."changedetection-io_env" = {
+      format = "binary";
+      sopsFile = ./changedetection-io_env;
+    };
+
+    systemd.services.changedetection-io = {
+      path = with pkgs; [
+        poppler-utils
+      ];
+      serviceConfig = {
+        Environment = [
+          "PLAYWRIGHT_DRIVER_URL=ws://10.88.0.5:3000"
+          "DISABLE_VERSION_CHECK=true"
+          "MINIMUM_SECONDS_RECHECK_TIME=0"
+        ];
+      };
+    };
+
+    virtualisation.oci-containers.containers = {
+      changedetection-io-playwright = {
+        image = "dgtlmoon/sockpuppetbrowser";
+        pull = "newer";
+        environment = {
+          SCREEN_WIDTH = "1920";
+          SCREEN_HEIGHT = "1024";
+          SCREEN_DEPTH = "16";
+          MAX_CONCURRENT_CHROME_PROCESSES = "10";
+          STATS_REFRESH_SECONDS = "600";
+        };
+        extraOptions = [
+          "--ip=10.88.0.5"
+        ];
+      };
+    };
+  };
+}
diff --git a/hosts/vidhar/default.nix b/hosts/vidhar/default.nix
index 1c60ed22..c54d57cd 100644
--- a/hosts/vidhar/default.nix
+++ b/hosts/vidhar/default.nix
@@ -4,7 +4,7 @@ with lib;
 
 {
   imports = with flake.nixosModules.systemProfiles; [
-    ./zfs.nix ./network ./samba.nix ./dns ./prometheus ./borg ./pgbackrest ./postgresql.nix ./immich.nix ./paperless ./hledger ./audiobookshelf ./kimai
+    ./zfs.nix ./network ./samba.nix ./dns ./prometheus ./borg ./pgbackrest ./postgresql.nix ./immich.nix ./paperless ./hledger ./audiobookshelf ./kimai ./changedetection-io
     tmpfs-root zfs
     initrd-all-crypto-modules default-locale openssh rebuild-machines
     build-server
@@ -387,6 +387,8 @@ with lib;
 
     environment.systemPackages = with pkgs; [iotop vmtouch];
 
+    virtualisation.oci-containers.backend = "podman";
+
     systemd.sysusers.enable = false;
     system.stateVersion = "21.05";
   };
diff --git a/hosts/vidhar/network/ruleset.nft b/hosts/vidhar/network/ruleset.nft
index dd750394..44b6b7a9 100644
--- a/hosts/vidhar/network/ruleset.nft
+++ b/hosts/vidhar/network/ruleset.nft
@@ -61,6 +61,7 @@ table inet filter {
   counter fw-lan {}
   counter fw-ppp {}
   counter fw-kimai {}
+  counter fw-podman {}
 
   counter fw-cups {}
 
@@ -97,6 +98,7 @@ table inet filter {
   counter hledger-rx {}
   counter audiobookshelf-rx {}
   counter kimai-rx {}
+  counter changedetection-rx {}
 
   counter established-rx {}
 
@@ -130,6 +132,7 @@ table inet filter {
   counter hledger-tx {}
   counter audiobookshelf-tx {}
   counter kimai-tx {}
+  counter changedetection-tx {}
 
   counter tx {}
 
@@ -154,9 +157,11 @@ table inet filter {
     oifname { lan, @pppInterface@, bifrost } meta l4proto $icmp_protos jump forward_icmp_accept
     iifname lan oifname { @pppInterface@, bifrost } counter name fw-lan accept
     iifname ve-kimai oifname @pppInterface@ counter name fw-kimai accept
+    iifname podman0 ip saddr 10.88.0.5 oifname @pppInterface@ counter name fw-podman accept
 
     iifname @pppInterface@ oifname lan ct state { established, related } counter name fw-ppp accept
     iifname @pppInterface@ oifname ve-kimai ct state { established, related } counter name fw-kimai accept
+    iifname @pppInterface@ oifname podman0 ip daddr 10.88.0.5 ct state { established, related } counter name fw-podman accept
 
     iifname bifrost oifname ve-kimai tcp dport 80 ip6 saddr $bifrost_surtr ip6 daddr 2a03:4000:52:ada:6::2 counter name kimai-rx accept
     iifname ve-kimai oifname bifrost tcp sport 80 ip6 saddr 2a03:4000:52:ada:6::2 ip6 daddr $bifrost_surtr counter name kimai-tx accept
@@ -187,7 +192,7 @@ table inet filter {
     iifname { lan, mgmt, @pppInterface@, yggdrasil, bifrost } tcp dport 22 counter name ssh-rx accept
     iifname { lan, mgmt, @pppInterface@, yggdrasil, bifrost } udp dport 60000-61000 counter name mosh-rx accept
 
-    iifname { lan, mgmt, wifibh, yggdrasil } meta l4proto { tcp, udp } th dport 53 counter name dns-rx accept
+    iifname { lan, mgmt, wifibh, yggdrasil, podman0 } meta l4proto { tcp, udp } th dport 53 counter name dns-rx accept
 
     iifname { lan, yggdrasil } tcp dport 2049 counter name nfs-rx accept
 
@@ -214,6 +219,7 @@ table inet filter {
     iifname bifrost tcp dport 28981 ip6 saddr $bifrost_surtr counter name paperless-rx accept
     iifname bifrost tcp dport 5000 ip6 saddr $bifrost_surtr counter name hledger-rx accept
     iifname bifrost tcp dport 28982 ip6 saddr $bifrost_surtr counter name audiobookshelf-rx accept
+    iifname bifrost tcp dport 5001 ip6 saddr $bifrost_surtr counter name changedetection-rx accept
 
     ct state { established, related } counter name established-rx accept
 
@@ -266,6 +272,7 @@ table inet filter {
     iifname bifrost tcp sport 28981 ip6 daddr $bifrost_surtr counter name paperless-tx accept
     iifname bifrost tcp sport 5000 ip6 daddr $bifrost_surtr counter name hledger-tx accept
     iifname bifrost tcp sport 28982 ip6 daddr $bifrost_surtr counter name audiobookshelf-tx accept
+    iifname bifrost tcp sport 5001 ip6 daddr $bifrost_surtr counter name changedetection-tx accept
 
 
     counter name tx