Fix: Use nix flake check for hooks, simplify module, remove apps

modules/cloudflare-dns/README.md

@@ -0,0 +1,67 @@
+# Cloudflare DNS Module
+
+Declarative DNS management for Cloudflare using `flarectl`.
+
+## Usage
+
+Add to your host configuration:
+```nix
+{
+  imports = [
+    ../../modules/cloudflare-dns
+  ];
+
+  cloudflare-dns = {
+    enable = true;
+    apiToken = "YOUR_CLOUDFLARE_API_TOKEN";
+    zoneId = "YOUR_ZONE_ID";
+
+    records = [
+      {
+        name = "uptime";
+        type = "A";
+        content = "YOUR_SERVER_IP";
+        proxied = true;
+      }
+      {
+        name = "monitoring";
+        type = "CNAME";
+        content = "uptime.example.com";
+        proxied = true;
+      }
+    ];
+  };
+}
+```
+
+## Getting Your API Token
+
+1. Go to https://dash.cloudflare.com/profile/api-tokens
+2. Click "Create Token"
+3. Use "Edit zone DNS" template
+4. Select your zone (domain)
+5. Copy the token
+
+## Getting Your Zone ID
+
+1. Go to https://dash.cloudflare.com
+2. Click on your domain
+3. Look for "Zone ID" on the right sidebar
+4. Copy the ID
+
+## Options
+
+- `apiToken` - Cloudflare API token (required)
+- `zoneId` - Cloudflare zone ID (required)
+- `records` - List of DNS records to manage
+  - `name` - Record name (e.g., "uptime" for uptime.example.com)
+  - `type` - Record type (A, AAAA, CNAME, etc., default: A)
+  - `content` - Record content (IP address, hostname, etc.)
+  - `proxied` - Use Cloudflare proxy (default: true)
+  - `ttl` - TTL value (1 = auto, default: 1)
+
+## Usage Notes
+
+- Records are updated on system activation
+- Use `sudo systemctl start cloudflare-dns-update` to manually update
+- API token should be stored securely (consider using sops-nix)

modules/cloudflare-dns/default.nix

@@ -0,0 +1,92 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.cloudflare-dns;
+in
+{
+  options.cloudflare-dns = {
+    enable = lib.mkEnableOption "Cloudflare DNS management via flarectl";
+
+    apiToken = lib.mkOption {
+      type = lib.types.str;
+      description = "Cloudflare API token";
+    };
+
+    zoneId = lib.mkOption {
+      type = lib.types.str;
+      description = "Cloudflare zone ID (from your domain's Cloudflare page)";
+    };
+
+    records = lib.mkOption {
+      type = lib.types.listOf (
+        lib.types.submodule {
+          options = {
+            name = lib.mkOption {
+              type = lib.types.str;
+              description = "DNS record name (e.g., 'uptime' for uptime.example.com)";
+            };
+            type = lib.mkOption {
+              type = lib.types.str;
+              default = "A";
+              description = "DNS record type (A, AAAA, CNAME, etc.)";
+            };
+            content = lib.mkOption {
+              type = lib.types.str;
+              description = "DNS record content (IP address, hostname, etc.)";
+            };
+            proxied = lib.mkOption {
+              type = lib.types.bool;
+              default = true;
+              description = "Use Cloudflare proxy (orange cloud)";
+            };
+            ttl = lib.mkOption {
+              type = lib.types.int;
+              default = 1;
+              description = "TTL (1 = auto)";
+            };
+          };
+        }
+      );
+      default = [ ];
+      description = "List of DNS records to manage";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ pkgs.flarectl ];
+
+    systemd.services.cloudflare-dns-update = {
+      description = "Update Cloudflare DNS records";
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        Type = "oneshot";
+        Environment = [ "CF_API_TOKEN=${cfg.apiToken}" ];
+      };
+      script = ''
+        ${lib.concatMapStringsSep "\n" (record: ''
+          echo "Updating DNS record: ${record.name} (${record.type}) -> ${record.content}"
+          ${pkgs.flarectl}/bin/flarectl \
+            --zone ${cfg.zoneId} \
+            add \
+            --name ${record.name} \
+            --type ${record.type} \
+            --content ${record.content} \
+            --proxied ${toString record.proxied} \
+            --ttl ${toString record.ttl} || \
+          ${pkgs.flarectl}/bin/flarectl \
+            --zone ${cfg.zoneId} \
+            update \
+            --id $(${pkgs.flarectl}/bin/flarectl --zone ${cfg.zoneId} --name ${record.name} --type ${record.type} | grep -oP '(?<=ID:\s)\S+' | head -1) \
+            --content ${record.content} \
+            --proxied ${toString record.proxied} \
+            --ttl ${toString record.ttl}
+        '') cfg.records}
+      '';
+    };
+  };
+}