System/Servenix: Disable arcane service, enable arcane-agent service

system/servenix/default.nix

@@ -22,7 +22,7 @@
     # ../services/statespaces.nix
 
     # General services
-    ../services/arcane.nix
+    ../services/arcane-agent.nix
     ../services/authelia.nix
     ../services/bazarr.nix
     ../services/fileflows.nix
@@ -113,8 +113,7 @@
       "paperless-nextcloud-sync-password"
       "ntfy-auth-users"
       "ntfy-auth-tokens"
-      "arcane-encryption-key"
+      "arcane-agent-key"
-      "arcane-jwt-secret"
     ];
   };
 

system/services/arcane-agent.nix

@@ -0,0 +1,55 @@
+{
+  mylib,
+  config,
+  lib,
+  pkgs,
+  ...
+}: let
+  arcaneVersion = "v2.3.0";
+in {
+  # If we need to pass secrets to containers we can't use plain env variables.
+  sops.templates."arcane-agent_secrets.env".content = ''
+    AGENT_TOKEN=${config.sops.placeholder.agent-token}
+  '';
+
+  virtualisation.oci-containers.containers = {
+    arcane-agent = {
+      image = "ghcr.io/getarcaneapp/arcane-headless:${arcaneVersion}";
+      autoStart = true;
+
+      login = mylib.containers.mkDockerLogin config;
+
+      dependsOn = [];
+
+      ports = [
+        "3553:3553"
+      ];
+
+      volumes = [
+        "/var/run/docker.sock:/var/run/docker.sock"
+
+        "arcane-agent_data:/app/data"
+      ];
+
+      environment = {
+        MANAGER_API_URL = "https://arcane.think.chriphost.de";
+        AGENT_MODE = true;
+        EDGE_TRANSPORT = "poll";
+
+        PUID = "1000";
+        PGID = "1000";
+        TZ = "Europe/Berlin";
+      };
+
+      environmentFiles = [
+        config.sops.templates."arcane-agent_secrets.env".path
+      ];
+
+      extraOptions = [
+        # "--privileged"
+        # "--device=nvidia.com/gpu=all"
+        "--net=behind-nginx"
+      ];
+    };
+  };
+}

system/systemmodules/sops-nix/secrets.yaml

@@ -21,12 +21,13 @@ kopia-user-password: ENC[AES256_GCM,data:jPWeru4e2w9qzA==,iv:WpZS3Qmx8v12v3q1Lq1
 paperless-nextcloud-sync-password: ENC[AES256_GCM,data:pfLg3OVBqLsM4R7mSgLQEachj9gMkexPjBMSyzU=,iv:XBe1cdwlTjPfQW70NIEjD8CikK58iGErI9ZTlLWtCA4=,tag:qO35GdjljgS3/z5/1fCOFg==,type:str]
 ntfy-auth-users: ENC[AES256_GCM,data:IHnJJgUL9RqkEAoJ2Q9Oo0RkfgLXG7vih5NFPrPNBoIzMafdLXxHqNOAd1oRaOUd6AKmWdQ3uKAZINj7oGZEKMsMxUEv1WW6IXUuPnDeJe5EthINWCuaW2Z64PJl+uqgnWr4wDi7QT0zwjb/oL3gYfjH1xtfMadTzkWbmnxQ9jlP/nXe9JR1/oCrHv3dio5uU017cA==,iv:JmWnu25ZB/qqI2RsgHQ0bcat69V7p5MJ6cf5eFcSsns=,tag:6Z2LseCav/qyLh2nn+7uuw==,type:str]
 ntfy-auth-tokens: ENC[AES256_GCM,data:C23r9djvEukUgDDloFGm52spwcW1DB5Jcwt9kxghLjL3vNiQ9HzGrvlSl5oEppoNa23BF0+t,iv:O9LepUKGbyXTHMvwn1avdJEhcMgtr2Sb1imIJ8ALMYY=,tag:o3g6f7YZL2VfgfeymzJK1g==,type:str]
-arcane-encryption-key: ENC[AES256_GCM,data:4H2kaQwIV5m0FVv+3IlNaw85V00r8W4SQ5cOSOskljtaUkFUteHzamj9KH7NxdKY+pxFkrvwIOIAhNYQTMRBSQ==,iv:FDx8IYu7B7jENtGnFiS7U7W2pDIwz9ibfuCNL0UBX6c=,tag:WSm/SwCs8sSynXeXi3+muw==,type:str]
+arcane-agent-key: ENC[AES256_GCM,data:RXSk/5GkRli5Qx5hvRfCRlJMGFu5tOuYXblLJlD8T+Z6SzCa3CX8tqbtwmcoROVbfKvmUj8MqU+XHcKCNlInUPszNKE=,iv:+kVHm38ABy2+N3u4zZGxUo/OfUJEAxaZcKfO7g9K+8o=,tag:3JzcmxC7+L0ClVG9Tzm4XQ==,type:str]
-arcane-jwt-secret: ENC[AES256_GCM,data:BMC/Hju/FkHxXjdZrVr9xjiqs9Uny/w/k14K+b+DYgPOlPYMH+YSZQ/3/yyw5j52FNcm+lDG2drTaO0NfBKJsQ==,iv:gHU78Fw1L6Igp+Jewq5xqW39tSGvGh/HREcd+HX/nO4=,tag:KTL21t2kKWsB3zm7x+T0SA==,type:str]
 #
 #ENC[AES256_GCM,data:Gdh/hjCaOuAE,iv:XjPXn3SskpUPUkDIEDl5701/g9QhuS83fACMaoPMiIM=,tag:Q7s8xZG/GsOtQrasekBnkQ==,type:comment]
 #
 wireguard-vps-private-key: ENC[AES256_GCM,data:B6IWYuzKV9YZ+G9GIjOsXVEVugwMY14PrwmYyHsFAJEb1OJRXMg8+zeFnqs=,iv:2QroGA10UVSmNIBHFSTeCgMBD3VjtiUnng3pkR/mPVQ=,tag:FGlCrmdccgsObyut6E5ggA==,type:str]
+arcane-encryption-key: ENC[AES256_GCM,data:4H2kaQwIV5m0FVv+3IlNaw85V00r8W4SQ5cOSOskljtaUkFUteHzamj9KH7NxdKY+pxFkrvwIOIAhNYQTMRBSQ==,iv:FDx8IYu7B7jENtGnFiS7U7W2pDIwz9ibfuCNL0UBX6c=,tag:WSm/SwCs8sSynXeXi3+muw==,type:str]
+arcane-jwt-secret: ENC[AES256_GCM,data:BMC/Hju/FkHxXjdZrVr9xjiqs9Uny/w/k14K+b+DYgPOlPYMH+YSZQ/3/yyw5j52FNcm+lDG2drTaO0NfBKJsQ==,iv:gHU78Fw1L6Igp+Jewq5xqW39tSGvGh/HREcd+HX/nO4=,tag:KTL21t2kKWsB3zm7x+T0SA==,type:str]
 sops:
     age:
         - enc: |
@@ -38,7 +39,7 @@ sops:
             FAbbvZZ/EdIk/njLEcayFN7B4ftTcD/f4XJZiyosilZnIkk76bMOHA==
             -----END AGE ENCRYPTED FILE-----
           recipient: age14ph8vrj657e7s35d60xehzuq46t9zd6pzcm6pw4jragzrvf6xs9s77usnm
-    lastmodified: "2026-07-02T14:10:41Z"
+    lastmodified: "2026-07-02T14:40:19Z"
-    mac: ENC[AES256_GCM,data:Vz3yNBRZCBbbYEfydArDGHYyHMFipe3n1i9o8hg/uo5Vuj09SCBj8kdemVW9O6mlAWBsQ4BVqG18xi0/HEAmN37N9FGSyPecak+3h/OvveNeJUFl5sfiGDQH4aln9ytJ1+PkgVHP/cBjHVZv20IpgzVW5z3jb/qYGBaWpx2qIPQ=,iv:OUf5gwnSGVuvEZSNJp+pzd3kHGLSodRa5HAvo3pOlMk=,tag:6CRpctUHyuIkAQIAUBrfMg==,type:str]
+    mac: ENC[AES256_GCM,data:fmXO/2rCtwv+0igDxvHe9L/A6CsRa0HgC+SilqsscEk1yD9fqn8TTGAG4q+QOTiSiEwVmhs73+5aQh1446IOMq/VtUULIsTjSksrjneS0ephY/6H+o9/5iIVaXU6FbRVqZ1GGmw47uGTOHYTzNFnGztCPsj9sZ9Y592kkixJS/o=,iv:+1hInMVTKZ4SzghAOwoU0+PVR0GKaWl7aSy/YBkUDzI=,tag:0voUqidM1xCKhi4q/0fL6A==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.13.1

system/thinknix/default.nix

@@ -16,6 +16,7 @@
 
     # General services
     ../services/adguard.nix
+    ../services/arcane.nix
     ../services/nginx-proxy-manager.nix
     # ../services/portainer.nix
     # ../services/pulse.nix
@@ -59,15 +60,20 @@
       allowedTCPPorts = [
         53 # DNS
         80 # HTTP
+
+        3553 # Arcane
       ];
       allowedUDPPorts = [
         53 # DNS
         67 # DHCP
+
+        3553 # Arcane
       ];
     };
 
     sops-nix.secrets.${username} = [
-      # "wireguard-vps-private-key"
+      "arcane-encryption-key"
+      "arcane-jwt-secret"
     ];
   };