sagittarius: add priv blog section

4 files changed, 45 insertions, 2 deletions

diff --git a/.sops.yaml b/.sops.yaml
index 6d61077..239b481 100644
--- a/.sops.yaml
+++ b/.sops.yaml
@@ -4,7 +4,7 @@ keys:
   - &machine_sagittarius age1jmpdssn7555g0pht7zwqq2dvrvzxyu65w6cf2su8pp2fz0zvaykq0jgern
   - &machine_underworld age1sffhunmeqmeey29lnvuds59mn74jfpctd3wm0t6svca0fztgvd4qnretc6
 creation_rules:
-  - path_regex: secrets/[^/]+\.(yaml|json|env|ini)$
+  - path_regex: secrets/[^/]+\.(yaml|json|env|ini|txt)$
     key_groups:
       - age:
           - *admin_miran
diff --git a/hosts/sagittarius/sops.nix b/hosts/sagittarius/sops.nix
index 04b3f20..8d6f1da 100644
--- a/hosts/sagittarius/sops.nix
+++ b/hosts/sagittarius/sops.nix
@@ -13,6 +13,10 @@
         sopsFile = ../../secrets/porkbun.env;
         format = "dotenv";
       };
+      "priv-blog-auth-file" = {
+        sopsFile = ../../secrets/priv.sorre.xyz.htpasswd.txt;
+        format = "binary";
+      };
     };
   };
 }
diff --git a/hosts/sagittarius/web/blog.nix b/hosts/sagittarius/web/blog.nix
index 671674f..d69ea20 100644
--- a/hosts/sagittarius/web/blog.nix
+++ b/hosts/sagittarius/web/blog.nix
@@ -1,4 +1,9 @@
-{ inputs, pkgs, ... }:
+{
+  inputs,
+  pkgs,
+  config,
+  ...
+}:
 {
   imports = [ ./acme.nix ];
   networking.firewall.allowedTCPPorts = [
@@ -14,5 +19,12 @@
       forceSSL = true;
       root = inputs.sorre-website.packages.${pkgs.system}.default;
     };
+
+    virtualHosts."priv.sorre.xyz" = {
+      enableACME = true;
+      forceSSL = true;
+      root = "/var/www/priv";
+      basicAuthFile = config.sops.secrets."priv-blog-auth-file".path;
+    };
   };
 }
diff --git a/secrets/priv.sorre.xyz.htpasswd.txt b/secrets/priv.sorre.xyz.htpasswd.txt
new file mode 100644
index 0000000..3e47f3d
--- /dev/null
+++ b/secrets/priv.sorre.xyz.htpasswd.txt
@@ -0,0 +1,27 @@
+{
+	"data": "ENC[AES256_GCM,data:XsMhAKvjhBcT7nWYgR7GZV+4DtLeuEnaaeL02nNp33OEqtAC2PsYQM0=,iv:WTAVeKdngeKCUw5gqHv8pZhrkY0GhCXafZ8M3+NpECs=,tag:zXEs9jkmtZuzRHFkPpnRBQ==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1l088h7umwuxp0sw8wk0stfup0empdnldczxvrhueu7n0vxd0c57q9zvwsk",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDZ2JYRHVQY0FlNzNtRnRL\nYld1QS9QeE9yenh6SjNLWHhWME1vMkZWSXlFClFyOWlxOXBWZEM1S25GOWlPeE1B\nZzZHbWFydm9yZTJFS0I1Z0hWTFNJRUkKLS0tIERmNFdCZndvNXhyMzRyT21NaHdq\neUtiNnIvVGF0UVZwVXQ1U2xmVnpxU3MKn8jUi+pDMRVllKKv8zCsSzAi/XilG7wn\njMyVkILW+0vPzvLcsdxsV8Pgdwp006cxySOrS1OzPcyZO5mDhwDOmw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1xzqshnlstewfha28sqjp4lf97mm43axyrhga0vkjmt5zx6eydqhsvlsasc",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1eWF4NnhEZGhFZ0lYNmVa\nSVhlSEJBNFFLS0h1bGZFcU1iSjJCZnVENWo0CmxIeXVOUzZRdUVaOVI4bnZLM2JG\nbTlsYlczREJjSjk4VFprdGlXRFVZNXcKLS0tIDNvNlFNSGFGUldhdkdpSGg0ODAv\nWU9Qc0J4cG56ZFk3c3VTZFhaS2RUUFUKnNdWRi4VAX1bAZBq8HhvIVJWQnz9J5Ef\nDL2eF7IjbTGmNUBbdtCOJsjm17TfvE4zV4Ced8rxhzeEOxJIHmdh5w==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1jmpdssn7555g0pht7zwqq2dvrvzxyu65w6cf2su8pp2fz0zvaykq0jgern",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0dllvNkNIcjcyQTVvUFlK\nV09xcXNxcHJHdFNBekw0T0QyNFptSnQ0TGxjCkZKWlBTUTkxYkNBZWNLT21QVGwx\nT1VaelkrY2pCYmhabExvTWlybXgwdk0KLS0tIE1lVmplVld5Y2hFblFLTkVmRFpm\nbnpxTmF6YnBJL2I2QTZxRlFKTmFkT3cK5SnkTI4FjSj+3uJghVECtAwzJqwIgkY8\n60y4sKd5/TDH5AyOAph8yNUWEpl2AJDRm5UzpGIpqmgDkIzGqJkzxg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sffhunmeqmeey29lnvuds59mn74jfpctd3wm0t6svca0fztgvd4qnretc6",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtUmFBZHYxeVF3YmorYUpi\nREdPWVRGWGZoeEJuNzd5MGViT1JUWkRCeEFRCnpKVFU5ZHdSeUREM2doV2w2QndX\nYlFRKzVoMGR2OWNEWEM5eTdzSEVGUjQKLS0tIFVHcWMvbUpBb3dQVE9pckhhbVo0\nU1FtaVJtY011RTM3VEYwNStSeWlmcHcKw7a/GbbAkcmrTcBNFlc/6qRTNOUWwoQd\n1V8T20JNgCqrwr5ZS/msf2FxqrktCq5QFSf4gGmpXJMItKOSzk35yQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-04-17T14:57:49Z",
+		"mac": "ENC[AES256_GCM,data:5/1w9rHqLcsP/FBQ8WrBLtnFu1SrxaWsm+4q0dxz8GB+R2UOJ31rCIpuUxhSD8tGXC7ffbG0zr7lpq3Du7qJjbHKVx3XVC7l9TT370CqY+qavoKEVfxEgl1ZyVpqSoy0XoKMu4o4Y3AjkE5Xo+/jYs4OIq7tCLDKLytPA0JUaJU=,iv:f15cOf3FdDWLs/3/3kUUvOJ1nQJKv+0oMw9eb9/T40k=,tag:e9LNqynA0lUq1bu5T+hZiw==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.12.2"
+	}
+}