ethnt · ethnt · Feb 13, 2026 · Feb 13, 2026
diff --git a/hosts/bastion/profiles/caddy/default.nix b/hosts/bastion/profiles/caddy/default.nix
@@ -284,7 +284,13 @@
 
       "hass.e10.camp" = {
         host = hosts.controller;
-        port = 8123;
+        port =
+          hosts.controller.config.services.home-assistant.config.http.server_port;
+      };
+
+      "frigate.e10.camp" = {
+        host = hosts.htpc;
+        port = 8971;
       };
 
       "e10.video" = {

diff --git a/hosts/controller/configuration.nix b/hosts/controller/configuration.nix
@@ -2,6 +2,7 @@
   imports = with suites;
     core ++ local ++ proxmox-vm ++ [
       profiles.communications.mosquitto.default
+      profiles.hardware.bluetooth
       profiles.home-automation.home-assistant.default
       profiles.networking.blocky.default
       profiles.networking.speedtest-tracker

diff --git a/hosts/monitor/profiles/authelia/default.nix b/hosts/monitor/profiles/authelia/default.nix
@@ -20,7 +20,7 @@
       monitor_authelia_users_gatus_password_hash = secretConfig;
     };
 
-    templates.monitor_authelia_users_file = {
+    templates."authelia/users.yml" = {
       content = lib.generators.toYAML { } {
         users = {
           admin = {
@@ -73,7 +73,7 @@
 
     settings = {
       authentication_backend.file = {
-        inherit (config.sops.templates.monitor_authelia_users_file) path;
+        inherit (config.sops.templates."authelia/users.yml") path;
         watch = false;
         password = {
           algorithm = "argon2";

diff --git a/hosts/monitor/profiles/prometheus.nix b/hosts/monitor/profiles/prometheus.nix
@@ -420,5 +420,11 @@
       }];
       scrape_interval = "30s";
     }
+    {
+      job_name = "frigate";
+      metrics_path = "/api/metrics";
+      static_configs = [{ targets = [ "htpc:5000" ]; }];
+      scrape_interval = "15s";
+    }
   ];
 }
diff --git a/modules/nixos/services/tracearr/default.nix b/modules/nixos/services/tracearr/default.nix
@@ -111,8 +111,12 @@ in {
         ensureDBOwnership = true;
       }];
     } // mkIf cfg.database.enableTimescaleDB {
-      extensions = ps: with ps; [ timescaledb ];
+      extensions = ps: with ps; [ timescaledb timescaledb_toolkit ];
       settings = { shared_preload_libraries = [ "timescaledb" ]; };
+      initialScriptText = lib.mkAfter ''
+        CREATE EXTENSION IF NOT EXISTS timescaledb;
+        CREATE EXTENSION IF NOT EXISTS timescaledb_toolkit;
+      '';
     };
 
     services.redis = mkIf cfg.redis.createLocally {

diff --git a/modules/packages/tracearr/default.nix b/modules/packages/tracearr/default.nix
@@ -2,7 +2,7 @@
 , fetchFromGitHub, turbo, }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "tracearr";
-  version = "1.4.12";
+  version = "1.4.17";
 
   src = fetchFromGitHub {
     owner = "connorgallopo";

diff --git a/modules/profiles/communications/mosquitto/secrets.json b/modules/profiles/communications/mosquitto/secrets.json
diff --git a/modules/profiles/home-automation/frigate/default.nix b/modules/profiles/home-automation/frigate/default.nix
@@ -1,5 +1,3 @@
-# TODO: MQTT for events from camera
-
 { config, hosts, pkgs, ... }:
 let
   cameraAddress = "192.168.1.102";
@@ -75,15 +73,13 @@ in {
       frigate_tapo_sha256.sopsFile = ./secrets.json;
     };
 
-    templates = {
-      "frigate/environment_file" = {
-        content = ''
-          FRIGATE_MQTT_PASSWORD=${config.sops.placeholder.frigate_mqtt_password}
-          FRIGATE_KITCHEN_PASSWORD=${config.sops.placeholder.frigate_kitchen_password}
-          FRIGATE_TAPO_SHA256=${config.sops.placeholder.frigate_tapo_sha256}
-        '';
-        mode = "0777";
-      };
+    templates."frigate/environment_file" = {
+      content = ''
+        FRIGATE_MQTT_PASSWORD=${config.sops.placeholder.frigate_mqtt_password}
+        FRIGATE_KITCHEN_PASSWORD=${config.sops.placeholder.frigate_kitchen_password}
+        FRIGATE_TAPO_SHA256=${config.sops.placeholder.frigate_tapo_sha256}
+      '';
+      mode = "0777";
     };
   };
 

diff --git a/modules/profiles/home-automation/home-assistant/default.nix b/modules/profiles/home-automation/home-assistant/default.nix
@@ -9,18 +9,16 @@
       hass_oauth_secret.sopsFile = ./secrets.json;
     };
 
-    templates = {
-      hass_secrets = {
-        content = ''
-          latitude: ${config.sops.placeholder.hass_latitude}
-          longitude: ${config.sops.placeholder.hass_longitude}
-          elevation: ${config.sops.placeholder.hass_elevation}
+    templates."hass/secrets.yaml" = {
+      content = ''
+        latitude: ${config.sops.placeholder.hass_latitude}
+        longitude: ${config.sops.placeholder.hass_longitude}
+        elevation: ${config.sops.placeholder.hass_elevation}
 
-          oauth_secret: ${config.sops.placeholder.hass_oauth_secret}
-        '';
-        path = "/var/lib/hass/secrets.yaml";
-        mode = "0777";
-      };
+        oauth_secret: ${config.sops.placeholder.hass_oauth_secret}
+      '';
+      path = "/var/lib/hass/secrets.yaml";
+      mode = "0777";
     };
   };
 
@@ -47,16 +45,20 @@
       "brother"
       "ecobee"
       "google_translate"
+      "homeassistant_hardware"
+      "homeassistant_sky_connect"
       "homekit_controller"
       "hue"
       "ipp"
       "isal"
+      "matter"
       "met"
       "mqtt"
       "opower"
       "radio_browser"
       "sonos"
       "tplink"
+      "zha"
     ];
 
     extraPackages = python3Packages:
@@ -69,8 +71,8 @@
         pyqrcode
       ];
 
-    customComponents = [
-      pkgs.home-assistant-custom-components.frigate
+    customComponents = with pkgs.home-assistant-custom-components; [
+      frigate
       (pkgs.callPackage ./components/ha_nationalgrid.nix {
         aionatgrid =
           pkgs.python3Packages.callPackage ./packages/aionatgrid.nix { };

diff --git a/modules/profiles/media-management/bazarr/default.nix b/modules/profiles/media-management/bazarr/default.nix
@@ -42,7 +42,7 @@
       };
     };
 
-    templates."bazarr-config.yml" = {
+    templates."bazarr/config.yml" = {
       content = lib.generators.toYAML { } {
         addic7ed = {
           cookies = "";

diff --git a/modules/profiles/media-management/declutarr/default.nix b/modules/profiles/media-management/declutarr/default.nix
@@ -1,5 +1,5 @@
 { config, lib, ... }: {
-  sops.templates.declutarr_config = {
+  sops.templates."declutarr/config.yml" = {
     content = lib.generators.toYAML { } {
       general = {
         log_level = "INFO";
@@ -58,6 +58,6 @@
 
   services.declutarr = {
     enable = true;
-    configFile = config.sops.templates.declutarr_config.path;
+    configFile = config.sops.templates."declutarr/config.yml".path;
   };
 }
diff --git a/modules/profiles/media-management/immich/default.nix b/modules/profiles/media-management/immich/default.nix
@@ -7,7 +7,7 @@
       };
     };
 
-    templates."immich-config.json" = {
+    templates."immich/config.json" = {
       content = builtins.toJSON {
         server = { externalDomain = "https://immich.e10.camp"; };
         oauth = {
@@ -42,7 +42,7 @@
     mediaLocation = "/mnt/files/services/immich";
     environment = {
       TZ = "America/New_York";
-      IMMICH_CONFIG_FILE = config.sops.templates."immich-config.json".path;
+      IMMICH_CONFIG_FILE = config.sops.templates."immich/config.json".path;
     };
   };
 

diff --git a/modules/profiles/media-management/radarr/default.nix b/modules/profiles/media-management/radarr/default.nix
@@ -7,7 +7,7 @@
       format = "yaml";
     };
 
-    templates."radarr-config.xml" = {
+    templates."radarr/config.xml" = {
       content = flake.lib.generators.toXML {
         rootName = "Config";
         xmlns = { };

diff --git a/modules/profiles/media-management/sabnzbd/default.nix b/modules/profiles/media-management/sabnzbd/default.nix
@@ -77,7 +77,7 @@
       };
     };
 
-    templates."sabnzbd-config.ini" = {
+    templates."sabnzbd/config.ini" = {
       content = flake.lib.generators.toINI {
         globalSection = {
           __version__ = 19;
@@ -562,7 +562,7 @@
               required = 0;
               optional = 0;
               retention = 0;
-              expire_date = "2026-01-30";
+              expire_date = "2027-05-13";
               quota = "";
               usage_at_start = 0;
               priority = 0;
@@ -644,7 +644,7 @@
   services.sabnzbd = {
     enable = true;
     openFirewall = true;
-    configFile = config.sops.templates."sabnzbd-config.ini".path;
+    configFile = config.sops.templates."sabnzbd/config.ini".path;
   };
 
   systemd.services.sabnzbd.serviceConfig.ExecStart = lib.mkOverride 10 "${

diff --git a/modules/profiles/media-management/sonarr/default.nix b/modules/profiles/media-management/sonarr/default.nix
@@ -7,7 +7,7 @@
       format = "yaml";
     };
 
-    templates."sonarr-config.xml" = {
+    templates."sonarr/config.xml" = {
       content = flake.lib.generators.toXML {
         rootName = "Config";
         xmlns = { };

diff --git a/modules/profiles/media-management/tracearr/default.nix b/modules/profiles/media-management/tracearr/default.nix
@@ -17,7 +17,7 @@
       };
     };
 
-    templates.tracearr_environment_file = {
+    templates."tracearr/environment_file" = {
       content = ''
         MAXMIND_LICENSE_KEY=${config.sops.placeholder.maxmind_license_key}
         JWT_SECRET=${config.sops.placeholder.tracearr_jwt_secret}
@@ -31,6 +31,6 @@
   services.tracearr = {
     enable = true;
     openFirewall = true;
-    environmentFile = config.sops.templates.tracearr_environment_file.path;
+    environmentFile = config.sops.templates."tracearr/environment_file".path;
   };
 }
diff --git a/modules/profiles/monitoring/loki/default.nix b/modules/profiles/monitoring/loki/default.nix
@@ -12,7 +12,7 @@
       };
     };
 
-    templates.loki_environment_file = {
+    templates."loki/environment_file" = {
       content = ''
         AWS_ACCESS_KEY_ID=${config.sops.placeholder.loki_aws_access_key_id}
         AWS_SECRET_ACCESS_KEY=${config.sops.placeholder.loki_aws_secret_access_key}
@@ -121,7 +121,7 @@
 
   systemd.services.loki = {
     serviceConfig.EnvironmentFile =
-      config.sops.templates.loki_environment_file.path;
+      config.sops.templates."loki/environment_file".path;
     wants = [ "sops-nix.service" ];
     after = [ "sops-nix.service" ];
   };

diff --git a/modules/profiles/monitoring/thanos/default.nix b/modules/profiles/monitoring/thanos/default.nix
@@ -24,7 +24,7 @@
       };
     };
 
-    templates.thanos_sidecar_object_storage_configuration = {
+    templates."thanos/sidecar_object_storage_configuration.json" = {
       content = builtins.toJSON {
         type = "S3";
         config = {
@@ -53,15 +53,15 @@
       http.port = 19190;
       grpc.port = 10900;
       objstore.config-file =
-        config.sops.templates.thanos_sidecar_object_storage_configuration.path;
+        config.sops.templates."thanos/sidecar_object_storage_configuration.json".path;
     };
 
     store = {
       enable = true;
       http.port = 19191;
       grpc.port = 10901;
       objstore.config-file =
-        config.sops.templates.thanos_sidecar_object_storage_configuration.path;
+        config.sops.templates."thanos/sidecar_object_storage_configuration.json".path;
     };
 
     query = {
@@ -78,7 +78,7 @@
       enable = true;
       http.port = 19193;
       objstore.config-file =
-        config.sops.templates.thanos_sidecar_object_storage_configuration.path;
+        config.sops.templates."thanos/sidecar_object_storage_configuration.json".path;
     };
   };
 

diff --git a/modules/profiles/observability/gatus/default.nix b/modules/profiles/observability/gatus/default.nix
@@ -10,7 +10,7 @@ in { config, lib, ... }: {
       gatus_ntfy_token.sopsFile = ./secrets.json;
     };
 
-    templates.gatus_environment_file = {
+    templates."gatus/environment_file" = {
       content = ''
         GATUS_LOG_LEVEL=warn
 
@@ -25,7 +25,7 @@ in { config, lib, ... }: {
   services.gatus = {
     enable = true;
     openFirewall = true;
-    environmentFile = config.sops.templates.gatus_environment_file.path;
+    environmentFile = config.sops.templates."gatus/environment_file".path;
     settings = {
       metrics = true;
       storage = {
@@ -221,7 +221,7 @@ in { config, lib, ... }: {
           })
           (mkEndpoint {
             name = "Frigate";
-            url = "http://htpc:5000";
+            url = "https://frigate.e10.camp";
             group = "HTPC";
           })
         ];

diff --git a/modules/profiles/services/glance/default.nix b/modules/profiles/services/glance/default.nix
@@ -5,7 +5,7 @@
       glance_authelia_basic_auth_password = { sopsFile = ./secrets.json; };
     };
 
-    templates.glance_environment_file = {
+    templates."glance/environment_file" = {
       content = ''
         AUTHELIA_BASIC_AUTH_USERNAME=${config.sops.placeholder.glance_authelia_basic_auth_username}
         AUTHELIA_BASIC_AUTH_PASSWORD=${config.sops.placeholder.glance_authelia_basic_auth_password}
@@ -16,7 +16,7 @@
 
   services.glance = {
     enable = true;
-    environmentFile = config.sops.templates.glance_environment_file.path;
+    environmentFile = config.sops.templates."glance/environment_file".path;
     settings = {
       server = {
         host = "0.0.0.0";
@@ -87,7 +87,7 @@
                   })
                   (mkSite {
                     title = "Frigate";
-                    url = "http://htpc:5000";
+                    url = "https://frigate.e10.camp";
                     icon = "di:frigate";
                   })
                   (mkSite {