everything is working now

16 files changed, 206 insertions, 139 deletions

diff --git a/hosts.toml b/hosts.toml
index dec8335..eca9ce4 100644
--- a/hosts.toml
+++ b/hosts.toml
@@ -8,12 +8,25 @@ wg_ip = "10.100.0.5"
 [hosts.ganymede]
 hostnames = ["ganymede", "192.168.50.2", "williamsfam.us.com"]
 user_pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFeAsRh11Jyv+7Fm4WhzV4XN0LMYQS1/yMbvT+pvFDcd collin@ganymede"
-# host_pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINlr+53UmlGVP1blkdNl6NFqn1w2umFJyjH1EVUPKIy9"
 host_pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL9ogXwOPZbAyAq9ecuzJGeRXobWrT9I7icHeEKnpzwB"
 
 wg_pubkey = "7BdBTJ/FQUOPjSU+Q1Ieg9VqMd2y8BCMqk61I5rMAnY="
 wg_ip = "10.100.0.1"
 
+caddy-root-ca = '''
+-----BEGIN CERTIFICATE-----
+MIIBmzCCAUGgAwIBAgIUZOdBpjHNZvJ8XKdFgVYi19a101owCgYIKoZIzj0EAwIw
+GzEZMBcGA1UEAwwQR2FueW1lZGUgSG9tZSBDQTAeFw0yNjA4MjIxMjExMDRaFw0z
+NjA4MTkxMjExMDRaMBsxGTAXBgNVBAMMEEdhbnltZWRlIEhvbWUgQ0EwWTATBgcq
+hkjOPQIBBggqhkjOPQMBBwNCAATme8gCEPAnxmilt/aqZpVClp7J5+3Y++ZSmXqp
+ibnTWa7RNhk/GzXZ8Ks0ez1Pc/lTLAYoIbQk6/Gjk4wg7ipbo2MwYTAfBgNVHSME
+GDAWgBSapoWPxw4f0+lBQwNHuRtiXiPDbDAPBgNVHRMBAf8EBTADAQH/MA4GA1Ud
+DwEB/wQEAwIBBjAdBgNVHQ4EFgQUmqaFj8cOH9PpQUMDR7kbYl4jw2wwCgYIKoZI
+zj0EAwIDSAAwRQIhAKD1PjqoVnPdrlLKl6/rr4WG74gG8ND/QpwAdPxon2fnAiBJ
+WR/WOxlBMpXQqxF7rttr/+zLAUx1wotKugI8FbdrQA==
+-----END CERTIFICATE-----
+'''
+
 [hosts.terra]
 user_pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINKwMBLWWxpf4jZN3R3iQ7XEAOMq0KAOE/6YN4iTBuJx collin@terra"
 
diff --git a/hosts/ganymede/caddy.nix b/hosts/ganymede/caddy.nix
index 06ca720..961b3b2 100644
--- a/hosts/ganymede/caddy.nix
+++ b/hosts/ganymede/caddy.nix
@@ -1,8 +1,12 @@
 {
   pkgs,
   lib,
+  hosts,
+  config,
   ...
 }: {
+  users.users."caddy".extraGroups = ["fileserver"];
+
   services.caddy = {
     package = lib.mkForce (pkgs.caddy.withPlugins {
       plugins = [
@@ -17,30 +21,63 @@
         api_key {env.PORKBUN_API_KEY}
         api_secret_key {env.PORKBUN_API_SECRET_KEY}
       }
+
+      pki {
+        ca local {
+          name "Ganymede Home CA"
+
+          root {
+              format pem_file
+              cert ${pkgs.writeText "caddy-root-ca.crt" hosts.ganymede.caddy-root-ca}
+              key ${config.collinux.secrets.caddy-root-ca-key.path}
+          }
+        }
+      }
     '';
 
     virtualHosts = {
-      "lindsey.williamsfam.us.com".extraConfig = ''
-        redir https://williams-ryan-lindsey.blogspot.com permanent
-      '';
+      "jta.williamsfam.us.com" = {
+        logFormat = lib.mkForce ''
+          output file /var/log/caddy/access-williamsfam.us.com.log
+        '';
+        extraConfig = ''
+          root * /media/public/www/jta
 
-      "daniel.williamsfam.us.com".extraConfig = ''
-        root * /media/public/www/daniel
-        file_server
-      '';
+          @hidden path */.*
+          respond @hidden "Not Found" 404
 
-      "williamsfam.us.com".extraConfig = ''
-        root * /media/public/www/root
-        file_server
-      '';
+          file_server
+        '';
+      };
+      "lindsey.williamsfam.us.com" = {
+        logFormat = lib.mkForce ''
+          output file /var/log/caddy/access-williamsfam.us.com.log
+        '';
+        extraConfig = ''
+          redir https://williams-ryan-lindsey.blogspot.com permanent
+        '';
+      };
+      "daniel.williamsfam.us.com" = {
+        logFormat = lib.mkForce ''
+          output file /var/log/caddy/access-williamsfam.us.com.log
+        '';
+        extraConfig = ''
+          root * /media/public/www/daniel
+          file_server
+        '';
+      };
+      "williamsfam.us.com" = {
+        logFormat = lib.mkForce ''
+          output file /var/log/caddy/access-williamsfam.us.com.log
+        '';
+        extraConfig = ''
+          root * /media/public/www/root
+          file_server
+        '';
+      };
     };
   };
 
-  # merge logs from subdomains
-  services.caddy.virtualHosts."jta.williamsfam.us.com".logFormat = lib.mkForce ''
-    output file /var/log/caddy/access-williamsfam.us.com.log
-  '';
-
   collinux.services.glance.homelabServices."website" = {
     url = "https://williamsfam.us.com";
     icon = "mdi:web";
diff --git a/hosts/ganymede/config.nix b/hosts/ganymede/config.nix
index 8964666..f1804e9 100644
--- a/hosts/ganymede/config.nix
+++ b/hosts/ganymede/config.nix
@@ -9,6 +9,10 @@
       };
 
       "caddy-env".file = ./secrets/caddy-env.age;
+      "caddy-root-ca-key" = {
+        file = ./secrets/caddy-root-ca.key.age;
+        owner = "caddy";
+      };
 
       "wireguard-privkey" = {
         file = ./secrets/wg-privkey.age;
@@ -33,31 +37,18 @@
       minecraft.enable = true; # :19132
       ngircd.enable = true; # :6667
 
-      jta = {
-        enable = true;
-        port = 8072;
-      };
-      goaccess = {
-        enable = true;
-        port = 7890;
-      };
-      btopweb = {
-        enable = true;
-        port = 8017;
-      };
+      goaccess.enable = true;
+      btopweb.enable = true;
       qbittorrent = {
         enable = true;
         port = 8076;
       };
       cgit.enable = true;
+      filebrowser.enable = true;
       glance = {
         enable = true;
         port = 8081;
       };
-      filebrowser = {
-        enable = true;
-        port = 8082;
-      };
 
       caddy = {
         enable = true;
diff --git a/hosts/ganymede/nixos.nix b/hosts/ganymede/nixos.nix
index 314b72a..bbed85c 100644
--- a/hosts/ganymede/nixos.nix
+++ b/hosts/ganymede/nixos.nix
@@ -1,4 +1,8 @@
-{inputs, ...}: {
+{
+  inputs,
+  hosts,
+  ...
+}: {
   imports = [
     inputs.disko.nixosModules.disko
     inputs.nixos-facter-modules.nixosModules.facter
@@ -9,7 +13,13 @@
     ./wireguard.nix
   ];
 
+  security.pki.certificates = [
+    hosts.ganymede.caddy-root-ca
+  ];
+
   facter.reportPath = ./facter.json;
 
+  users.users."collin".extraGroups = ["fileserver"];
+
   services.fail2ban.enable = true;
 }
diff --git a/hosts/ganymede/secrets/caddy-root-ca.key.age b/hosts/ganymede/secrets/caddy-root-ca.key.age
new file mode 100644
index 0000000..0de6b0a
--- /dev/null
+++ b/hosts/ganymede/secrets/caddy-root-ca.key.age
@@ -0,0 +1,17 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGF6QmlsZyBsT0lQ
+disvMDdLU1F6aEI4MFltME84cSsweHcwNG90MTJlbGdnSHlMOFFrCjAxM1VJeXVH
+WUdrc052blNxRWQ2Z3N1VUlJYllERjR1SVhGQjlPenhuZ0kKLT4gc3NoLWVkMjU1
+MTkgWkVyTFRnIDhxUTJrYWkrcWdjSk4wRzE4NHNrSytVTEZYdC9jc3VlWU1OamFP
+UXJMQjQKR2NacHlxV3pOV2hKY3EvbTFCNEVBZ1VyTDJpUUlROUJoZHVuN3h0UUhj
+NAotPiBVeS1ncmVhc2UgZyh7T2JZOyUgdUdVCjcyckRMVVhVU2hyUHpKWEYvekJo
+M3c3aWN4WUtKcnQvREllUlpVTTk1UGpOUCtLT1Q0bWdDa0NKUWxBSDAyUjcKbUNN
+OVY0cTJNQU81eG5ZR3cvNW96MmRCMTlJaDFPUEF2SHNxN2hZCi0tLSBSQ1k5QWN3
+TytEOHZkSkdFd3JXb3ZIYXEvVXVFRXNoN0RmOTkwNWQ2bmNFCvPEuEjBR6lEvAPW
+yCqkobzKfnaNhFMP4bvG39yx79V9gi0pE2viz1DuSTkMPiM0xMBtMo2PlAPbE4kt
+eYB28dCmU3t6+L/xF0XxZfbTJb8lkH5d4lTd42ysEhH2Z4vOREkcwE8vYs02PfG7
+8HYtVR97nVbl5wu4aIn9xa43LvhzIL+h2Gqw5tjieLcpOiHPx0Aq9HtFeFQHmgli
+UYoKNLyB8ech1Nuhp2CWhfU5U0Rvvak0o2PuXQ2tUR+uq5ZgesQVTHXcXar/HDGV
+D5GFJseS4YByZfARNsVmDQFXg9rRiimesmjIkhlsY4DCC5UL0i4kELFUshPxj21K
+4y0UWPh4Pa+t
+-----END AGE ENCRYPTED FILE-----
diff --git a/hosts/mercury/nixos.nix b/hosts/mercury/nixos.nix
index 02d4b96..87c0495 100644
--- a/hosts/mercury/nixos.nix
+++ b/hosts/mercury/nixos.nix
@@ -1,4 +1,8 @@
-{inputs, ...}: {
+{
+  inputs,
+  hosts,
+  ...
+}: {
   imports = [
     ./disks.nix
     ./battery.nix
@@ -22,19 +26,7 @@
   programs.kdeconnect.enable = true;
 
   security.pki.certificates = [
-    ''
-      -----BEGIN CERTIFICATE-----
-      MIIBozCCAUmgAwIBAgIQbfaguvgtbo/JBep9INWMFjAKBggqhkjOPQQDAjAwMS4w
-      LAYDVQQDEyVDYWRkeSBMb2NhbCBBdXRob3JpdHkgLSAyMDI1IEVDQyBSb290MB4X
-      DTI1MTIyMzIzMTExMFoXDTM1MTEwMTIzMTExMFowMDEuMCwGA1UEAxMlQ2FkZHkg
-      TG9jYWwgQXV0aG9yaXR5IC0gMjAyNSBFQ0MgUm9vdDBZMBMGByqGSM49AgEGCCqG
-      SM49AwEHA0IABNWAL+OmSvNI1twW7CjWtVTj9PH86ejV52Tl/VKtTqacbAgS+TdU
-      aaekC0skEI1BNc76lsD84yRydvci1om1vv2jRTBDMA4GA1UdDwEB/wQEAwIBBjAS
-      BgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQWBBShYvNluMWdF4EwkTWJgcBe8Foe
-      XzAKBggqhkjOPQQDAgNIADBFAiEAkoloryXWPdw50LtidCzi9lZDScU2Uofpp8ie
-      uc1PJgQCIBy3BQIcEh9ChGJ1cIrop43zMA4C9O8HwytFX11YpZnF
-      -----END CERTIFICATE-----
-    ''
+    hosts.ganymede.caddy-root-ca
   ];
 
   # get perl out of my closure
diff --git a/modules/desktop/nixos/programs/firefox.nix b/modules/desktop/nixos/programs/firefox.nix
index 30a74b4..a0fe4de 100644
--- a/modules/desktop/nixos/programs/firefox.nix
+++ b/modules/desktop/nixos/programs/firefox.nix
@@ -20,15 +20,12 @@ in
         DisablePocket = true;
         NoDefaultBookmarks = true;
 
+        Certificates.ImportEnterpriseRoots = true;
+
         OverrideFirstRunPage = "";
         OverridePostUpdatePage = "";
 
         SearchEngines.Default = "DuckDuckGo";
-        # Homepage = {
-        #   URL = "https://home.ganymede";
-        #   Locked = true;
-        #   StartPage = "homepage-locked";
-        # };
 
         AIControls = let
           opt = Value: {
diff --git a/modules/services/nixos/btopweb.nix b/modules/services/nixos/btopweb.nix
index 75498a9..9c78295 100644
--- a/modules/services/nixos/btopweb.nix
+++ b/modules/services/nixos/btopweb.nix
@@ -21,6 +21,7 @@ in {
       isSystemUser = true;
       group = "btopweb";
     };
+    users.users.caddy.extraGroups = ["btopweb"];
 
     systemd.services."btopweb" = {
       description = "Host btop on a website";
@@ -31,15 +32,27 @@ in {
 
       serviceConfig = {
         User = "btopweb";
+        Group = "btopweb";
         Type = "simple";
 
-        ExecStart = ''${lib.getExe pkgs.ttyd} -W -i 127.0.0.1 -p ${toString cfg.port} -t renderType=canvas -t fontSize=16 ${pkgs.btop}/bin/btop -c ${btopSettings}'';
+        RuntimeDirectory = "btopweb";
+        RuntimeDirectoryMode = "0770";
+        UMask = "0007";
+
+        ExecStart = ''
+          ${lib.getExe pkgs.ttyd} \
+            -W \
+            -i /run/btopweb/ttyd.sock \
+            -t renderType=canvas \
+            -t fontSize=16 \
+            ${pkgs.btop}/bin/btop -c ${btopSettings}
+        '';
       };
     };
 
     services.caddy.virtualHosts."btop.ganymede".extraConfig = ''
       tls internal
-      reverse_proxy 127.0.0.1:${toString cfg.port}
+      reverse_proxy unix//run/btopweb/ttyd.sock
     '';
 
     collinux.services.glance.homelabServices."btop" = {
diff --git a/modules/services/nixos/caddy.nix b/modules/services/nixos/caddy.nix
index 4b41c76..02aeca3 100644
--- a/modules/services/nixos/caddy.nix
+++ b/modules/services/nixos/caddy.nix
@@ -7,7 +7,6 @@
   cfg = config.collinux.services.caddy;
 in
   lib.mkIf cfg.enable {
-    users.users."caddy".extraGroups = ["fileserver"];
     networking.firewall.allowedTCPPorts = [80 443];
     environment.systemPackages = [pkgs.nss.tools]; # required for caddy https stuff
 
diff --git a/modules/services/nixos/default.nix b/modules/services/nixos/default.nix
index fa74cf6..9aea299 100644
--- a/modules/services/nixos/default.nix
+++ b/modules/services/nixos/default.nix
@@ -15,4 +15,6 @@
     ./ngircd.nix
     ./qbittorrent.nix
   ];
+
+  users.groups."fileserver" = {};
 }
diff --git a/modules/services/nixos/filebrowser.nix b/modules/services/nixos/filebrowser.nix
index df0d536..9791f8d 100644
--- a/modules/services/nixos/filebrowser.nix
+++ b/modules/services/nixos/filebrowser.nix
@@ -13,6 +13,7 @@ in
       group = "dufs";
       extraGroups = ["fileserver"];
     };
+    users.users.caddy.extraGroups = ["dufs"];
 
     systemd.services."dufs" = {
       description = "dufs file server";
@@ -22,15 +23,14 @@ in
       wantedBy = ["multi-user.target"];
 
       serviceConfig = {
-        # ExecStart = "${pkgs.dufs}/bin/dufs /media --port ${toString cfg.port}";
         ExecStart = "${lib.getExe pkgs.dufs} /media --bind /run/dufs/dufs.sock";
 
-        RuntimeDirectory = "dufs"; # /run/dufs
+        RuntimeDirectory = "dufs";
 
         User = "dufs";
         Group = "dufs";
+        UMask = "0007";
 
-        # Hardening
         ProtectSystem = "strict";
         ProtectHome = true;
         PrivateTmp = true;
@@ -47,6 +47,6 @@ in
 
     collinux.services.glance.homelabServices."files" = {
       url = "https://files.ganymede";
-      icon = "si:folder";
+      icon = "mdi:folder";
     };
   }
diff --git a/modules/services/nixos/glance.nix b/modules/services/nixos/glance.nix
index 38e5e1d..8d305a5 100644
--- a/modules/services/nixos/glance.nix
+++ b/modules/services/nixos/glance.nix
@@ -6,8 +6,6 @@
 }: let
   cfg = config.collinux.services.glance;
 
-  pure = x: [x];
-
   servicesLinks = builtins.attrValues cfg.homelabServices;
 
   settings = {
@@ -19,76 +17,73 @@
     };
 
     branding.hide-footer = true;
-    pages = pure {
-      name = "Dashboard";
-      width = "slim";
-      hide-desktop-navigation = true;
-      center-vertically = true;
-      columns = pure {
-        size = "full";
-        widgets = [
+    pages = [
+      {
+        name = "Dashboard";
+        width = "slim";
+        hide-desktop-navigation = true;
+        center-vertically = true;
+        columns = [
           {
-            type = "search";
-            autofocus = true;
-            search-engine = "duckduckgo";
-            bangs = [
-              {
-                title = "GitHub";
-                shortcut = "gh";
-                url = "https://github.com/search?q={QUERY}&type=repositories";
-              }
+            size = "full";
+            widgets = [
               {
-                title = "I'm Feeling Lucky";
-                shortcut = "!";
-                url = "https://www.google.com/search?q={QUERY}&btnI=&sourceid=navclient&gfns=1";
+                type = "search";
+                autofocus = true;
+                search-engine = "duckduckgo";
+                bangs = [
+                  {
+                    title = "GitHub";
+                    shortcut = "gh";
+                    url = "https://github.com/search?q={QUERY}&type=repositories";
+                  }
+                  {
+                    title = "I'm Feeling Lucky";
+                    shortcut = "!";
+                    url = "https://www.google.com/search?q={QUERY}&btnI=&sourceid=navclient&gfns=1";
+                  }
+                  {
+                    title = "YouTube Music";
+                    shortcut = "ytm";
+                    url = "https://music.youtube.com/search?q={QUERY}";
+                  }
+                  {
+                    title = "Google AI Mode";
+                    shortcut = "ai";
+                    url = "https://www.google.com/search?udm=50&q={QUERY}";
+                  }
+                ];
               }
               {
-                title = "YouTube Music";
-                shortcut = "ytm";
-                url = "https://music.youtube.com/search?q={QUERY}";
+                type = "server-stats";
+                servers = [
+                  {
+                    type = "local";
+                    name = "ganymede";
+                    hide-mountpoints-by-default = true;
+                    mountpoints = {
+                      "/".hide = false;
+                      "/media".hide = false;
+                    };
+                  }
+                ];
               }
               {
-                title = "Google AI Mode";
-                shortcut = "ai";
-                url = "https://www.google.com/search?udm=50&q={QUERY}";
+                type = "monitor";
+                cache = "1m";
+                title = "Services";
+                sites = servicesLinks;
               }
             ];
           }
-          {
-            type = "server-stats";
-            servers = pure {
-              type = "local";
-              name = "Ganymede";
-              hide-mountpoints-by-default = true;
-              mountpoints = {
-                "/".hide = false;
-                "/media".hide = false;
-              };
-            };
-          }
-          {
-            type = "monitor";
-            cache = "1m";
-            title = "Services";
-            sites = servicesLinks;
-          }
         ];
-      };
-    };
+      }
+    ];
   };
 
   settingsFile = (pkgs.formats.yaml {}).generate "config.yml" settings;
 in {
   config = lib.mkIf cfg.enable {
-    users.groups."glance" = {};
-    users.users."glance" = {
-      isSystemUser = true;
-      group = "glance";
-
-      home = "/var/lib/glance";
-      createHome = true;
-    };
-
     systemd.services."glance" = {
       restartIfChanged = true;
       wants = ["network-online.target"];
@@ -96,12 +91,12 @@ in {
       wantedBy = ["multi-user.target"];
 
       serviceConfig = {
-        User = "glance";
         Type = "simple";
 
-        ReadWritePaths = "/var/lib/glance";
-        WorkingDirectory = "/var/lib/glance";
-        ExecStart = "${pkgs.glance}/bin/glance -config ${settingsFile}";
+        DynamicUser = true;
+        StateDirectory = "glance";
+
+        ExecStart = "${lib.getExe pkgs.glance} -config ${settingsFile}";
 
         NoNewPrivileges = true;
         PrivateTmp = true;
diff --git a/modules/services/nixos/goaccess.nix b/modules/services/nixos/goaccess.nix
index 288428d..f0b6c34 100644
--- a/modules/services/nixos/goaccess.nix
+++ b/modules/services/nixos/goaccess.nix
@@ -14,12 +14,11 @@
     log-file = "/var/log/caddy/access-williamsfam.us.com.log";
     geoip-database = inputs.geolite-db;
 
-    ws-url = "wss://stats.ganymede:443/ws";
-    port = cfg.port;
-    addr = "127.0.0.1";
+    ws-url = "wss://stats.ganymede:443/ws"; # url that the frontend uses to fetch data
+    unix-socket = "/run/goaccess/goaccess.sock";
 
     real-time-html = "true";
-    output = "/var/www/goaccess/index.html";
+    output = "/var/lib/goaccess/index.html";
     external-assets = "true";
     all-static-files = "false";
     html-report-title = "stats@ganymede";
@@ -44,6 +43,7 @@ in {
       group = "goaccess";
       extraGroups = ["caddy"]; # to read caddy log files
     };
+    users.users.caddy.extraGroups = ["goaccess"];
 
     systemd.services."goaccess" = {
       description = "GoAccess Real-Time Log Analyzer";
@@ -56,9 +56,14 @@ in {
         User = "goaccess";
         Type = "simple";
 
-        ReadWritePaths = "/var/www/goaccess";
-        WorkingDirectory = "/var/www/goaccess";
-        ExecStart = "${pkgs.goaccess}/bin/goaccess -p ${settingsFile}";
+        RuntimeDirectory = "goaccess";
+        RuntimeDirectoryMode = "0770";
+        UMask = "0007";
+
+        StateDirectory = "goaccess";
+        StateDirectoryMode = "0750"; # caddy must read this dir
+
+        ExecStart = "${lib.getExe pkgs.goaccess} -p ${settingsFile}";
 
         NoNewPrivileges = true;
         PrivateTmp = true;
@@ -70,15 +75,13 @@ in {
       };
     };
 
-    systemd.tmpfiles.rules = ["d /var/www/goaccess/ 755 goaccess goaccess"];
-
     services.caddy.virtualHosts."stats.ganymede".extraConfig = ''
       tls internal
 
-      root * /var/www/goaccess
+      root * /var/lib/goaccess
       file_server
 
-      reverse_proxy /ws 127.0.0.1:${toString cfg.port}
+      reverse_proxy /ws unix//run/goaccess/goaccess.sock
     '';
 
     collinux.services.glance.homelabServices."stats" = {
diff --git a/modules/services/nixos/qbittorrent.nix b/modules/services/nixos/qbittorrent.nix
index fe2831a..c7bfe95 100644
--- a/modules/services/nixos/qbittorrent.nix
+++ b/modules/services/nixos/qbittorrent.nix
@@ -6,10 +6,7 @@
   cfg = config.collinux.services.qbittorrent;
 in {
   config = lib.mkIf cfg.enable {
-    users.users."qbittorrent" = {
-      uid = 985;
-      extraGroups = ["fileserver"]; # torrent files go to /media/library
-    };
+    users.users."qbittorrent" = {};
 
     networking.firewall = {
       allowedTCPPorts = [49252];
diff --git a/modules/services/options.nix b/modules/services/options.nix
index 0e033be..38baf9e 100644
--- a/modules/services/options.nix
+++ b/modules/services/options.nix
@@ -20,12 +20,12 @@ in {
 
     jta = basicService {desc = "personal project";};
     ganyupload = basicService {desc = "anonymous file uploads";};
-    btopweb = basicService {desc = "btop accessable in a browser tab";};
+    btopweb.enable = mkEnableOption "btop accessable in a browser tab";
 
     forgejo = basicService {desc = "Self-hosted git forge";};
     qbittorrent = basicService {desc = "webui for qBittorrent";};
-    goaccess = basicService {desc = "webserver stats from caddy logs";};
-    filebrowser = basicService {desc = "dufs file browser";};
+    goaccess.enable = mkEnableOption "webserver stats from caddy logs";
+    filebrowser.enable = mkEnableOption "dufs file browser";
     cgit.enable = mkEnableOption "cgit git webui";
 
     glance =
diff --git a/secrets.nix b/secrets.nix
index 461dbb7..3b2e6f4 100644
--- a/secrets.nix
+++ b/secrets.nix
@@ -4,6 +4,7 @@ in {
   "modules/terminal/nixos/github-ssh-key.age".publicKeys = [mercury.host_pubkey ganymede.host_pubkey];
 
   "hosts/ganymede/secrets/caddy-env.age".publicKeys = [mercury.host_pubkey ganymede.host_pubkey];
+  "hosts/ganymede/secrets/caddy-root-ca.key.age".publicKeys = [mercury.host_pubkey ganymede.host_pubkey];
   "hosts/ganymede/secrets/williams-psk.age".publicKeys = [mercury.host_pubkey ganymede.host_pubkey];
 
   "hosts/mercury/secrets/wg-privkey.age".publicKeys = [mercury.host_pubkey];