Sets up Wargame VODs for public access.

secrets/mcp.yaml

@@ -33,6 +33,7 @@ wargame-vods:
     db:
         password: ENC[AES256_GCM,data:4Vl2Jd80bu3gVKDN7gINo8rbui6x3zxPvYEHf6GBiJDQdmRt8od/5yw4S/8=,iv:ZLdp3j0+8vLluNssXlV52XIJMczhai+6zcHsRwDwGPM=,tag:rjbp9cFbj3EFxnUZQO/QYg==,type:str]
     admin-token: ENC[AES256_GCM,data:xxec5YDtWW7VpV+POtfhfhHG45ebCdNuD6PyHExyp0H9Ef/edTCgJtnPYWM=,iv:bLidEo0L1vP8IRtcdZ4Bcw4chHErCUHH31xQS7cFk3g=,tag:AJ9fb6xo8w41FOWu2fHHgQ==,type:str]
+    youtube-api-key: ENC[AES256_GCM,data:9W6+QK52mlTPh55ZqHXq020IpPbwbr9+Qzqhi6u96NrnRJEEVr+Z,iv:s3g2kGg2xPWD6/BuQxJ7Eqbm5HpatQbkF6PxuKufxro=,tag:1vvC8STNTX3+e5hLQTJglQ==,type:str]
 sops:
     age:
         - enc: |
@@ -62,7 +63,7 @@ sops:
             dvKJPDYvGb/8JXSkZNkLlWvHEVnsAJ1mJFb1idenYzeQvJlsX07rYA==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1jrk4h7x4qzhr6z5m4d099mlfyjc4n5n9s52r4gfsdz0slnqlqa9sss735v
-    lastmodified: "2026-08-14T23:11:14Z"
-    mac: ENC[AES256_GCM,data:nto4tN0VUAG8cjssn9jINYQ+lwmZHSkAquFD1WUx6cRz4L7U0eFBukkhX9P9n3jWFBuFdm/VnF8asRaIZNuWa5X/LBjPZ6rqqcm+sm8tn9SLGiF0QOMOoTXDQCaJYmbwfa1iyj3Dvs2UqXpUZG3I0SM+dTKoSNjRIRx04zkSgak=,iv:J0XOwqjX74DCs+wGn3V1kbvrPhLwrHywWRJoccuCceY=,tag:jfxWSf1xD72ll1itPy2Dxw==,type:str]
+    lastmodified: "2026-08-17T01:55:47Z"
+    mac: ENC[AES256_GCM,data:uR1BHCZi0O0KQUwVauev4CmUwAvj7xABsnQR+3FRfTJK3mcnm2TR+GabQ9F8YyTDo86fK8pYLl4iki766LUy78QJBFMXCKmB7shx5kWIDKWcSU2xlkrPbXSZmQr0Hh5x46YaZbd9UO8xabUdy3p3Vu282V192HWFXsGBQ3T1mvY=,iv:lp2ca+4vd7lIjibaTBBxy/3NmdWenaZrE2dWZzrfrBM=,tag:cJWZT7BgdVJXjwJh/4USuw==,type:str]
     unencrypted_suffix: _unencrypted
-    version: 3.13.1
+    version: 3.13.2

system/hosts/mcp/containers/blazestar.net/wargame-vods.nix

@@ -1,14 +1,16 @@
-{ config, pkgs, ... }:
+{ config, ... }:
 let
   inherit (import ../lib.nix config) blazestar;
   db_password = "wargame-vods/db/password";
   admin_token = "wargame-vods/admin-token";
+  youtube_api_key = "wargame-vods/youtube-api-key";
 in
 {
   sops = {
     secrets = {
       "${db_password}" = { };
       "${admin_token}" = { };
+      "${youtube_api_key}" = { };
     };
     templates."wargame-vods.env" = {
       mode = "0400";
@@ -21,8 +23,11 @@ in
         PGDATABASE=wargame-vods
         STATIC_DIR=/app/static
         PORT=8081
-        SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt
+        SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt
+        CORS_ORIGINS=https://vods.blazestar.net
+        YOUTUBE_API_KEY=${config.sops.placeholder."${youtube_api_key}"}
       '';
+      restartUnits = [ "podman-wargame-vods.service" ];
     };
   };
   virtualisation.web-containers.containers.wargame-vods = {
@@ -30,6 +35,7 @@ in
     hostname = "vods";
     domain = blazestar;
     port = 8081;
+    public = true;
     volumes = [ ];
     dependsOn = [ "db" ];
     environmentFiles = [