✨ [pi4] Add DDClient service

hosts/pi4/ddclient.nix

@@ -0,0 +1,21 @@
+# /nix/store/<hash>/ddclient.conf
+{ config, common, ... }:
+let
+  domain = common.domain;
+  cloudflarePasswordKey = "cloudflare/api-token";
+in
+{
+  services.ddclient = {
+    enable = true;
+    protocol = "cloudflare";
+    username = "emberal+cloudflare@pm.me";
+    passwordFile = config.sops.secrets.${cloudflarePasswordKey}.path;
+    zone = domain;
+    domains = [
+      domain
+      "*.${domain}"
+    ];
+  };
+
+  sops.secrets.${cloudflarePasswordKey} = { };
+}

hosts/pi4/default.nix

@@ -6,6 +6,7 @@
     ./actual.nix
     ./boot.nix
     ./caddy.nix
+    ./ddclient.nix
     ./forgejo.nix
     ./hardware.nix
     ./headscale.nix

shared/secrets/secrets.yaml

@@ -1,3 +1,5 @@
+cloudflare:
+    api-token: ENC[AES256_GCM,data:UfTphnoN4REAue0bP5JKPfgvq36Jlxndl7dD46BKwg7ygW2Mj4mm4w==,iv:vS223ZAqACt1ZHJHCeztCVm+BghMhVYJfTuvBlySf+o=,tag:mxf6jL7/ItsxPOHb7S5upQ==,type:str]
 forgejo:
     admin-pass: ENC[AES256_GCM,data:RGTOw0Yo5rJGEVLGsQgyk9Wc,iv:SuN770eAgFIVd4pJ6vmPIvVCMqTW/2sBUYUbqym2cHo=,tag:YlyNR/fFchdBwzCuIsWGMA==,type:str]
     #ENC[AES256_GCM,data:oMpYBQ30sdCTtgxEZvYxTd9oi9QM0bYp5NisMdQHYT/nF2k=,iv:H9/g7XttJScVXV38+yHdbgWNFDhBYyudjK5BKHTt5wo=,tag:FNfkKfkKWDBUAXiGXkDchw==,type:comment]
@@ -36,7 +38,7 @@ sops:
             SGdNMnVlQlNEeVJkWmZEM1FRT2JJMGMKbZ/znJM6tFhzhHariRXMLgH/4CRZZKrb
             YtmSdeL/Pd5YIecCpjDHDn4vQ0TBAmLaX+zVbNbRKmMZoY7777ywfA==
             -----END AGE ENCRYPTED FILE-----
-  lastmodified: "2025-06-23T17:39:10Z"
-  mac: ENC[AES256_GCM,data:+6X13vyCteJKZFo6RMI4rCo/gizcJO828xTL/gspgZemHcnqaf1P6nIntE5flin7IsfkxqoH8k25Xqzp6TLddsw8oYGA7fyDX7l28wFoxASTaZu2KChqGeRsEuVjuQGIAHKbB/4aI003NPT48l+uePOMNwUzlBrRnRYE5MMgQRI=,iv:UefKr2KL0+py7soUGjS0Onql/cAO+mXpvzJKJjtRppU=,tag:qcvB7rrdDRC3EfgjonM6uw==,type:str]
+    lastmodified: "2025-08-26T18:46:06Z"
+    mac: ENC[AES256_GCM,data:uMwyVVzU4KFzJqMzOIZHtCbgGq7Em2KogTDZbfU/CRcl6HGF8/+wKwUp4mYLAFwPXfOoKvSaBTDUYCy76wirWxXz8Vb3JxlfkjR+dvwT7DM1SYVzP4CV6TZlOBDrht6gCG+yaLJkc77AzT7crAW5V4IB/ZaRpBOGrNhIZeS/o+E=,iv:YTOySOIEaojbSm4GmJC8NBMFMD3cuC+u0CMu/5/1wS4=,tag:qdzCZuJpIiKN3dQIDboJjA==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.10.2