From 231dc6e1b35d79c72e39229d08f5dca3911e4507 Mon Sep 17 00:00:00 2001
From: Pyjacpp <pyjacpp@crans.org>
Date: Mon, 27 Jul 2026 15:59:10 +0200
Subject: [PATCH 1/3] =?UTF-8?q?anubis:=20partage=20secret=20pour=20=C3=A9v?=
 =?UTF-8?q?iter=20les=20check=20intempestif?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 modules/services/reverseproxy.nix      |  2 ++
 secrets/reverseproxy/anubis-secret.age | 33 ++++++++++++++++++++++++++
 2 files changed, 35 insertions(+)
 create mode 100644 secrets/reverseproxy/anubis-secret.age

diff --git a/modules/services/reverseproxy.nix b/modules/services/reverseproxy.nix
index f66ce0f..6086350 100644
--- a/modules/services/reverseproxy.nix
+++ b/modules/services/reverseproxy.nix
@@ -173,6 +173,8 @@ in
               COOKIE_DOMAIN = "crans.${mainTld}";
               REDIRECT_DOMAINS = "${vhostName}.crans.${mainTld}";
               SOCKET_MODE = "0660";
+              # Secret partagé entre les instances
+              ED25519_PRIVATE_KEY_HEX_FILE = "${../../../secrets/reverseproxy/anubis-secret.age}";
               # OpenGraph config
               OG_PASSTHROUGH = vhostConfig.anubisOpenGraph;
               OG_EXPIRY_TIME = "24h";
diff --git a/secrets/reverseproxy/anubis-secret.age b/secrets/reverseproxy/anubis-secret.age
new file mode 100644
index 0000000..578c302
--- /dev/null
+++ b/secrets/reverseproxy/anubis-secret.age
@@ -0,0 +1,33 @@
+age-encryption.org/v1
+-> ssh-ed25519 GCcVXA qD1f4YdP88JvuPLS6H416O0LF+rKN/gJ+gPf0lFWIRs
+B0LuHjXX0UiHHTwY7v1HqP4VF5/5yn0d/gNW4zUOC5w
+-> piv-p256 ewCc3w A8Wnjz7tLNpV/m5bUzuq/MBTHn+jQiaCSUb4vFvGDH7N
+gNBEsgdHogaz3OSJBelB39bGrOBt8+hkNXpAYcFcy28
+-> piv-p256 6CL/Pw AoJBcpyhK+hpZOfHOBUHh0Kivvn6YJ4xepo7IWppbMuJ
+f1fwsu8okH7F+6nSHowxHpTdtjU72lvd6FmwFIMmV8E
+-> ssh-ed25519 eOAUSg 0bH2dDdNzKapr54HKndKJpKO5iTQtbhY957NIJQcvBo
+LYVsTuKNsE4JlBxbf2e+Qo9ZjRxnz6saEHEjyfCcAjc
+-> ssh-rsa REaZBA
+Pho7O15lWd5/2Uy1OQmA/JzE0wmOji6IPKGj03nK9aYSQjsTTc30YhNCrkddglGX
+MCClDyGDlQ0mCwHKVfpFeeSC9VQWQDDYk90dM4MF//6hHPqU/zn8dR25NyxDgyyi
+DVrCFB+S09LsKI4isbDoCru6fWXfdN4Fj8I44c64dBpIVh4XhSzUtmlzmge//35C
+y6EvAjVIhVTbbgnQ5CJFgnRlSPaN5BHDq76aJ3c+8Ajkjowa2YcYu7w8asi7PsIs
+WH6J2qMIPvPdxOEKczGc401ysUfz9fNFKs0Xx4spduwv8I3Sv4ImURDkYmCl/k7J
+rwRXbUGr8JzZu093cmkjVxDrSfb9VhqlZVJD7uc2VSTk8ntwStLWafSuE03bIN2L
+on0t/4/wXtvFtwlGoDe9QGYAJpPYWM0ZUPMZfpddOz9vYvL1+6nUcDroLMvCIItI
+blwJZ0970K/Je99SmI3+6mUEAw8nJ/pBFaF/LmTJecypLEalLNsu2IALyCMIdTa0
+
+-> ssh-ed25519 J/iReg fpgi4t31rVl+KvOYd0Ph0Nd2gInJAZXNhQC5ekpv0kI
+lznh3YwmqVr05vjWxf1HKRWAFZGXbypAYygjUe+ELlk
+-> ssh-ed25519 GNhSGw 2cVptD/h5NWcYsjPPwQcP/b9tjJPDbhjDKh2hKhA5GM
+JZvQvXkb1RRw+NHnJ+HMV5tlwiBnLf4+cwm6J2hZD9Y
+-> ssh-ed25519 eXMAtA axP3hHgfgWJScGLIGpYgu0iYW1qZRQzMK9XjIeszrnc
+rBzAqSVoRqj/drZSOlxSIZLgZZU/wqGML1gKCEHtcy4
+-> ssh-ed25519 5hXocQ b3kjoM+FfQ434V7X8FdpIHVFjTn4sc+psj+9jyRljxU
+l5rna7ap0ydVXPCSr4qrPnu2MV2n7XwoSh/T87OkuMU
+-> ssh-ed25519 bRHVVA 92Rj1gMmueSHWzxsKWVs+7nF4JzuekhfaB2u5AWnazk
+yg4qa9lyHsGCOXWOTm7/XH9F8JzvRLjzsxyXe88oXnE
+-> ssh-ed25519 HgW9eA mpIFRqMXj08JuyYLf6Hx4p9fOLbxXZquSMAjh0e/lSU
+h1kvwnu+mLOeRfVFUXgE9IDo/MQ+4gtkYwrF3JWQfwY
+--- MCDm2NH5NWgwnFYQ+zJ4obfdxWpiv3BGohnIJ1bRkco
+_ֹ`��F���vF3[;��197%�4�90M�[�Ip�:�s|��C�R�6,C���;�[�;<����b(�fq�g8�p�p�
�Dk p/�w�ҿ$9�\
\ No newline at end of file

From 12fe631737bedf7f9a779acecb477db52cd94c07 Mon Sep 17 00:00:00 2001
From: Pyjacpp <pyjacpp@crans.org>
Date: Mon, 27 Jul 2026 16:31:42 +0200
Subject: [PATCH 2/3] =?UTF-8?q?anubis:=E2=80=AFyavait=20un=20../=20de=20tr?=
 =?UTF-8?q?op=E2=80=A6?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 modules/services/reverseproxy.nix | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/modules/services/reverseproxy.nix b/modules/services/reverseproxy.nix
index 6086350..8dd4dfa 100644
--- a/modules/services/reverseproxy.nix
+++ b/modules/services/reverseproxy.nix
@@ -158,6 +158,11 @@ in
       };
     };
 
+    age.secrets.anubis-secret = {
+      file = ../../secrets/reverseproxy/anubis-secret.age;
+      owner = "anubis";
+    };
+
     services = mkIf cfg.enable {
       anubis = {
         defaultOptions.group = "nginx";
@@ -174,7 +179,7 @@ in
               REDIRECT_DOMAINS = "${vhostName}.crans.${mainTld}";
               SOCKET_MODE = "0660";
               # Secret partagé entre les instances
-              ED25519_PRIVATE_KEY_HEX_FILE = "${../../../secrets/reverseproxy/anubis-secret.age}";
+              ED25519_PRIVATE_KEY_HEX_FILE = config.age.secrets.anubis-secret.path;
               # OpenGraph config
               OG_PASSTHROUGH = vhostConfig.anubisOpenGraph;
               OG_EXPIRY_TIME = "24h";

From f49423d26ccdb6ee5ce4344a92180dfa1f1ca848 Mon Sep 17 00:00:00 2001
From: Pyjacpp <pyjacpp@crans.org>
Date: Fri, 14 Aug 2026 18:01:11 +0200
Subject: [PATCH 3/3] =?UTF-8?q?anubis=E2=80=AF:=20s=C3=A9paration=20cookie?=
 =?UTF-8?q?s?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 modules/services/reverseproxy.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/modules/services/reverseproxy.nix b/modules/services/reverseproxy.nix
index 8dd4dfa..41a5a85 100644
--- a/modules/services/reverseproxy.nix
+++ b/modules/services/reverseproxy.nix
@@ -175,7 +175,10 @@ in
               BIND_NETWORK = "unix";
               METRICS_BIND = "/run/anubis/anubis-${vhostName}/anubis-${vhostName}-metrics.sock";
               TARGET = "unix:///run/nginx/nginx-${vhostName}.sock";
-              COOKIE_DOMAIN = "crans.${mainTld}";
+              COOKIE_DOMAIN = "${vhostName}.crans.${mainTld}";
+              # TODO: db pour mettre en commun les token.
+              # Transitoirement on les sépare
+              COOKIE_PREFIX = "anubis-${vhostName}";
               REDIRECT_DOMAINS = "${vhostName}.crans.${mainTld}";
               SOCKET_MODE = "0660";
               # Secret partagé entre les instances