adding ddns with cloudflare

hosts/nixos/vaniville/configuration.nix

@@ -12,7 +12,7 @@ in
       ../../../users/blake
       ../../../modules/system
       #../../../modules/holocron
-      #../../../modules/homelab
+      ../../../modules/homelab
     ];
 
   home-manager.users.blake.imports = [
@@ -22,6 +22,9 @@ in
   system = {
     tailscale.enable = false;
   };
+  homelab = {
+    ddns.enable = true;
+  };
 
   services.tailscale = {
     enable = true;

modules/homelab/ddns/default.nix

@@ -0,0 +1,36 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}: let
+  cfg = config.homelab.ddns;
+  token = config.sops.secrets."cloudflare/api_token".path;
+in {
+  options.homelab.ddns = {
+    enable = lib.mkEnableOption "enables ddns with cloudflare";
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.cloudflare-ddns = {
+      enable = true;
+      credentialsFile = token;
+      domains = [
+        "mc.recoil.pro"
+        "superflat.recoil.pro"
+        "skyblock.recoil.pro"
+        "git.blakedheld.xyz"
+      ];
+    };
+
+    # network config
+
+    # declare authkey secrets
+    sops.secrets = {
+      "cloudflare/api_token" = {
+        owner = "root";
+        group = "cloudflare-ddns"
+      };
+    };
+  };
+}

modules/homelab/default.nix

@@ -64,6 +64,7 @@ in
     ./home/mosquitto
     ./uptime-kuma
     ./tailscale
+    ./ddns
   ];
 
   config = lib.mkIf cfg.enable {

secrets/secrets.yaml

@@ -6,6 +6,9 @@ klefki_auth_map: ENC[AES256_GCM,data:u8OBLtT/,iv:THW21BDyhyFIjcwixsAnaAODofxbuQZ
 tailscale_authkey: ENC[AES256_GCM,data:SqBbzV43arnLJZX0bnCZZGqO3jAKXBPZvIe6lqtf8L8RtqVNPvhxzeHR3Nki5LoSd7f3Za01puBAwpZY2QQ=,iv:f3jNCmrQrWsD2cvB6Ji8H0Ez/kpZ+4K9NIEhGfKU/N4=,tag:ej1gW8fBhAd9j53G7g8/HA==,type:str]
 #ENC[AES256_GCM,data:bEbCic+ZDAA5ieNedCbiVbJrse17,iv:UwRYlis6NPB/RUcv+YnPxrGdbIcF4hrNiZt19YvWZNQ=,tag:m6PVlzPNnahX7X7KzMUj7A==,type:comment]
 borg_passwd: ENC[AES256_GCM,data:XOMJtr+DRs7xn5Iclc49iTzK9cFJyc/fSXJjhdKa9jdN,iv:YB8z7zNYjh6NpSxQb1TfPxAYUdzThdVfNZIe6tO5grA=,tag:bO6kZ3cLJDL4IQoWmGvRdg==,type:str]
+#ENC[AES256_GCM,data:NbXyRroLF2uxHjROnBg9OLQ=,iv:W9Nse9yamov3rflDKBeISO+miQkjH7QfBUZdsDmDM4I=,tag:/RmH3JyriXFxf0hEh9/iRQ==,type:comment]
+cloudflare:
+    api_token: ENC[AES256_GCM,data:U6R/LUfh+0i7ylqgoSaacV8zwoT+sl1d/ek9E/zeYUlZbSyUF+WGJQ==,iv:w1hqIfUYCemq/7Oc3nyxIFNomR4wen+rFstNDXkjlS8=,tag:WMWsi1j2YNXfVgt1Lw/bwQ==,type:str]
 #ENC[AES256_GCM,data:ztRwuY0mTMDmwV5HqVR7Dmc+dCWcrVRtWZGEL1abE/WUcA==,iv:mmaWfHRiENJUGNhyUBFo1z7PdzVPH1OUZrVhkce6KV0=,tag:GKEvT0qkzTtimQXDueKPdw==,type:comment]
 holocron_creds: ENC[AES256_GCM,data:2QXtXrN5w0UFn70GZOsYFPdtPwjLcuUdtkEam5aZ83N6LEDqPWJi,iv:kUS9pq5CX19vqHumc6QjY+Xpd4N+Ge7oCcQYtMFh+WM=,tag:IUA1ZVThF91EdHrwmS624g==,type:str]
 #ENC[AES256_GCM,data:VdbMrwGKUKNJHw==,iv:OLwBh6KQXR/H8eRgp/hH8k3QfIkK/ydL735kx/dpc8E=,tag:N+v+ym6RMbvW4IckbiLK8Q==,type:comment]
@@ -66,7 +69,7 @@ sops:
             U0tmdFBuZnJES3piOTZNV0VKQmQ0eVUKCWRQ/flLzmpC64WyLoipklZBmrkpYiUg
             PRu+itNolpPTHm96pe+P93g2iP0wgekG0cX21wkiU2xaLF3dY2FEIA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-04-24T17:25:42Z"
-    mac: ENC[AES256_GCM,data:Zz0oJdyy2xxOiG01kmmxhV87TDlXMONN1RKRTIwQkG+eNOLNx4WcIYC4Vi4MYkFEbeKH//tt2S5pSp1hle7n37DEAeBYduYcOWANvDM2zEFDXtRJkzC62dt+xu50katWYZdJEaTdSsgAjybt9uQAQgzBDAvNpg8BBVqeqNJ6/y0=,iv:GbIhW8REo6L2+dad5u+JhEVp2C2Dxh+tRMjPglB+PoI=,tag:cKSmsjL+rtkd8ihj6TxfzQ==,type:str]
+    lastmodified: "2026-04-24T20:37:31Z"
+    mac: ENC[AES256_GCM,data:42SLBYbKdUjXuCM7Ixn58WGFKCZMMcVGEDipAIqY3zDw++s8rNQpQVu3sN+2GhfPWw260uttfHbbs/li5JUtTwG1IP3nDW9UsWy5NE7BOKBwma/geRCDoovIfBkIKKt0jdS9ifI5twUeoVf4Pg0XqwaK73+IHHE3kngOQm3CS1M=,iv:MWX4Ccc1s2o7w1u9chjYDDBNrV8JB/FeTxeBk54Xue0=,tag:83TkRHAsnKurxiF+SrhqOQ==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.12.1