From 6ac55fe4a2f1454ffc70f372997b727904838738 Mon Sep 17 00:00:00 2001 From: June Date: Sat, 4 Apr 2026 17:21:39 +0200 Subject: [PATCH 01/34] fix ports in redirects --- config/hosts/public-web-static/virtualHosts/docs.c3voc.de.nix | 2 ++ .../public-web-static/virtualHosts/staging.docs.c3voc.de.nix | 2 ++ 2 files changed, 4 insertions(+) diff --git a/config/hosts/public-web-static/virtualHosts/docs.c3voc.de.nix b/config/hosts/public-web-static/virtualHosts/docs.c3voc.de.nix index a91edc1..5c257da 100644 --- a/config/hosts/public-web-static/virtualHosts/docs.c3voc.de.nix +++ b/config/hosts/public-web-static/virtualHosts/docs.c3voc.de.nix @@ -42,6 +42,8 @@ in { # Then tell the realip_module to get the addreses from the proxy protocol # header. real_ip_header proxy_protocol; + + port_in_redirect off; ''; }; }; diff --git a/config/hosts/public-web-static/virtualHosts/staging.docs.c3voc.de.nix b/config/hosts/public-web-static/virtualHosts/staging.docs.c3voc.de.nix index 5b3d387..2170f8c 100644 --- a/config/hosts/public-web-static/virtualHosts/staging.docs.c3voc.de.nix +++ b/config/hosts/public-web-static/virtualHosts/staging.docs.c3voc.de.nix @@ -48,6 +48,8 @@ in { # Then tell the realip_module to get the addreses from the proxy protocol # header. real_ip_header proxy_protocol; + + port_in_redirect off; ''; }; }; From d1ef492f93f18809a80266ab9e9a33af465caf5d Mon Sep 17 00:00:00 2001 From: June Date: Sat, 11 Apr 2026 20:44:22 +0200 Subject: [PATCH 02/34] establish c3dog.de and staging as their own websites --- .../virtualHosts/c3dog.de.nix | 11 +++- .../virtualHosts/default.nix | 1 + .../virtualHosts/staging.c3dog.de.nix | 60 +++++++++++++++++++ 3 files changed, 71 insertions(+), 1 deletion(-) create mode 100644 config/hosts/public-web-static/virtualHosts/staging.c3dog.de.nix diff --git a/config/hosts/public-web-static/virtualHosts/c3dog.de.nix b/config/hosts/public-web-static/virtualHosts/c3dog.de.nix index 3589418..16fedd5 100644 --- a/config/hosts/public-web-static/virtualHosts/c3dog.de.nix +++ b/config/hosts/public-web-static/virtualHosts/c3dog.de.nix @@ -3,7 +3,7 @@ let domain = "c3dog.de"; dataDir = "/var/www/${domain}"; - deployUser = "c3cat-website-deploy"; + deployUser = "c3dog-website-deploy"; in { security.acme.certs."${domain}".extraDomainNames = [ "www.${domain}" ]; @@ -83,4 +83,13 @@ in { systemd.tmpfiles.rules = [ "d ${dataDir} 0755 ${deployUser} ${deployUser}" ]; + + users.users."${deployUser}" = { + isNormalUser = true; + group = "${deployUser}"; + openssh.authorizedKeys.keys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB7iXsVArl4SbDczb4U3zGkZCiVO/lfn12gkOEOnKmEX deploy key for c3dog.de" + ]; + }; + users.groups."${deployUser}" = { }; } diff --git a/config/hosts/public-web-static/virtualHosts/default.nix b/config/hosts/public-web-static/virtualHosts/default.nix index dfac565..404ca35 100644 --- a/config/hosts/public-web-static/virtualHosts/default.nix +++ b/config/hosts/public-web-static/virtualHosts/default.nix @@ -15,6 +15,7 @@ ./hamburg.ccc.de.nix ./spaceapi.hamburg.ccc.de.nix ./staging.c3cat.de.nix + ./staging.c3dog.de.nix ./staging.cryptoparty-hamburg.de.nix ./staging.docs.c3voc.de.nix ./staging.hacker.tours.nix diff --git a/config/hosts/public-web-static/virtualHosts/staging.c3dog.de.nix b/config/hosts/public-web-static/virtualHosts/staging.c3dog.de.nix new file mode 100644 index 0000000..d69ad2b --- /dev/null +++ b/config/hosts/public-web-static/virtualHosts/staging.c3dog.de.nix @@ -0,0 +1,60 @@ +{ pkgs, ... }: + +let + domain = "staging.c3dog.de"; + dataDir = "/var/www/${domain}"; + deployUser = "c3dog-website-deploy"; +in { + services.nginx.virtualHosts = { + "acme-${domain}" = { + enableACME = true; + serverName = "${domain}"; + + listen = [ + { + addr = "0.0.0.0"; + port = 31820; + } + ]; + }; + + "${domain}" = { + forceSSL = true; + useACMEHost = "${domain}"; + + listen = [ + { + addr = "0.0.0.0"; + port = 8443; + ssl = true; + proxyProtocol = true; + } + ]; + + root = "${dataDir}"; + + # Disallow *, since this is staging and doesn't need to be in any search + # results. + locations."/robots.txt" = { + return = "200 \"User-agent: *\\nDisallow: *\\n\""; + }; + + extraConfig = '' + # Make use of the ngx_http_realip_module to set the $remote_addr and + # $remote_port to the client address and client port, when using proxy + # protocol. + # First set our proxy protocol proxy as trusted. + set_real_ip_from 172.31.17.140; + # Then tell the realip_module to get the addreses from the proxy protocol + # header. + real_ip_header proxy_protocol; + ''; + }; + }; + + systemd.tmpfiles.rules = [ + "d ${dataDir} 0755 ${deployUser} ${deployUser}" + ]; + + # c3dog deploy user already defined in c3dog.de.nix. +} From fe27dba7fd05eead48988013be453aafb63d07c2 Mon Sep 17 00:00:00 2001 From: June Date: Mon, 27 Apr 2026 18:41:38 +0200 Subject: [PATCH 03/34] flake.lock: Update MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Flake lock file updates: • Updated input 'nixpkgs': 'github:nixos/nixpkgs/bcd464ccd2a1a7cd09aa2f8d4ffba83b761b1d0e' (2026-04-01) → 'github:nixos/nixpkgs/a4bf06618f0b5ee50f14ed8f0da77d34ecc19160' (2026-04-25) • Updated input 'nixpkgs-unstable': 'github:nixos/nixpkgs/8d8c1fa5b412c223ffa47410867813290cdedfef' (2026-04-02) → 'github:nixos/nixpkgs/01fbdeef22b76df85ea168fbfe1bfd9e63681b30' (2026-04-23) • Updated input 'sops-nix': 'github:Mic92/sops-nix/8f093d0d2f08f37317778bd94db5951d6cce6c46' (2026-04-03) → 'github:Mic92/sops-nix/bef289e2248991f7afeb95965c82fbcd8ff72598' (2026-04-21) --- flake.lock | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/flake.lock b/flake.lock index 8f672b0..ed279ac 100644 --- a/flake.lock +++ b/flake.lock @@ -19,11 +19,11 @@ }, "nixpkgs": { "locked": { - "lastModified": 1775002709, - "narHash": "sha256-d3Yx83vSrN+2z/loBh4mJpyRqr9aAJqlke4TkpFmRJA=", + "lastModified": 1777077449, + "narHash": "sha256-AIiMJiqvGrN4HyLEbKAoCSRRYn0rnlW5VbKNIMIYqm4=", "owner": "nixos", "repo": "nixpkgs", - "rev": "bcd464ccd2a1a7cd09aa2f8d4ffba83b761b1d0e", + "rev": "a4bf06618f0b5ee50f14ed8f0da77d34ecc19160", "type": "github" }, "original": { @@ -35,11 +35,11 @@ }, "nixpkgs-unstable": { "locked": { - "lastModified": 1775126147, - "narHash": "sha256-J0dZU4atgcfo4QvM9D92uQ0Oe1eLTxBVXjJzdEMQpD0=", + "lastModified": 1776949667, + "narHash": "sha256-GMSVw35Q+294GlrTUKlx087E31z7KurReQ1YHSKp5iw=", "owner": "nixos", "repo": "nixpkgs", - "rev": "8d8c1fa5b412c223ffa47410867813290cdedfef", + "rev": "01fbdeef22b76df85ea168fbfe1bfd9e63681b30", "type": "github" }, "original": { @@ -64,11 +64,11 @@ ] }, "locked": { - "lastModified": 1775188331, - "narHash": "sha256-/0BoSi0Dg0ON7IW0oscM12WSPBaMSCn36XTt0lHZoy8=", + "lastModified": 1776771786, + "narHash": "sha256-DRFGPfFV6hbrfO9a1PH1FkCi7qR5FgjSqsQGGvk1rdI=", "owner": "Mic92", "repo": "sops-nix", - "rev": "8f093d0d2f08f37317778bd94db5951d6cce6c46", + "rev": "bef289e2248991f7afeb95965c82fbcd8ff72598", "type": "github" }, "original": { From dd2f3178db2cdc5728e31387e35cd2496ea101ae Mon Sep 17 00:00:00 2001 From: June Date: Tue, 28 Apr 2026 23:30:00 +0200 Subject: [PATCH 04/34] public-web-static(host): move to new network and to v6 --- .../hosts/public-web-static/configuration.nix | 5 +- config/hosts/public-web-static/networking.nix | 8 +-- .../branding-resources.hamburg.ccc.de.nix | 10 ++++ .../virtualHosts/c3cat.de.nix | 16 ++++++ .../virtualHosts/c3dog.de.nix | 16 ++++++ .../virtualHosts/cpu.ccc.de.nix | 30 ++++++++-- .../virtualHosts/cryptoparty-hamburg.de.nix | 16 ++++++ .../virtualHosts/diday.org.nix | 16 ++++++ .../virtualHosts/docs.c3voc.de.nix | 10 ++++ .../element-admin.hamburg.ccc.de.nix | 10 ++++ .../virtualHosts/element.hamburg.ccc.de.nix | 10 ++++ .../virtualHosts/hacker.tours.nix | 12 +++- .../hackertours.hamburg.ccc.de.nix | 10 ++++ .../virtualHosts/hamburg.ccc.de.nix | 10 ++++ .../virtualHosts/historic-easterhegg/eh03.nix | 56 +++++++++++++------ .../virtualHosts/historic-easterhegg/eh05.nix | 56 +++++++++++++------ .../virtualHosts/historic-easterhegg/eh07.nix | 56 +++++++++++++------ .../virtualHosts/historic-easterhegg/eh09.nix | 56 +++++++++++++------ .../virtualHosts/historic-easterhegg/eh11.nix | 56 +++++++++++++------ .../virtualHosts/historic-easterhegg/eh20.nix | 54 ++++++++++++------ .../virtualHosts/spaceapi.hamburg.ccc.de.nix | 10 ++++ .../virtualHosts/staging.c3cat.de.nix | 10 ++++ .../virtualHosts/staging.c3dog.de.nix | 10 ++++ .../staging.cryptoparty-hamburg.de.nix | 16 ++++++ .../virtualHosts/staging.diday.org.nix | 6 ++ .../virtualHosts/staging.docs.c3voc.de.nix | 10 ++++ .../virtualHosts/staging.hacker.tours.nix | 10 ++++ .../staging.hackertours.hamburg.ccc.de.nix | 10 ++++ .../virtualHosts/staging.hamburg.ccc.de.nix | 10 ++++ .../virtualHosts/www.hamburg.ccc.de.nix | 10 ++++ deployment_configuration.json | 3 - 31 files changed, 502 insertions(+), 116 deletions(-) diff --git a/config/hosts/public-web-static/configuration.nix b/config/hosts/public-web-static/configuration.nix index 9e2aebc..a8e5f29 100644 --- a/config/hosts/public-web-static/configuration.nix +++ b/config/hosts/public-web-static/configuration.nix @@ -1,7 +1,10 @@ { ... }: { - networking.hostName = "public-web-static"; + networking = { + hostName = "public-web-static"; + domain = "hosts.hamburg.ccc.de"; + }; system.stateVersion = "23.05"; } diff --git a/config/hosts/public-web-static/networking.nix b/config/hosts/public-web-static/networking.nix index cb22d40..2758338 100644 --- a/config/hosts/public-web-static/networking.nix +++ b/config/hosts/public-web-static/networking.nix @@ -3,14 +3,14 @@ { networking = { interfaces.net0 = { - ipv4.addresses = [ + ipv6.addresses = [ { - address = "172.31.17.151"; - prefixLength = 25; + address = "2a00:14b0:42:102::17"; + prefixLength = 64; } ]; }; - defaultGateway = "172.31.17.129"; + defaultGateway6 = "2a00:14b0:42:102::1"; nameservers = [ "212.12.50.158" "192.76.134.90" ]; search = [ "hamburg.ccc.de" ]; }; diff --git a/config/hosts/public-web-static/virtualHosts/branding-resources.hamburg.ccc.de.nix b/config/hosts/public-web-static/virtualHosts/branding-resources.hamburg.ccc.de.nix index a28f77c..edeca47 100644 --- a/config/hosts/public-web-static/virtualHosts/branding-resources.hamburg.ccc.de.nix +++ b/config/hosts/public-web-static/virtualHosts/branding-resources.hamburg.ccc.de.nix @@ -14,6 +14,10 @@ in serverName = "branding-resources.hamburg.ccc.de"; listen = [ + { + addr = "[::]"; + port = 31820; + } { addr = "0.0.0.0"; port = 31820; @@ -26,6 +30,12 @@ in useACMEHost = "branding-resources.hamburg.ccc.de"; listen = [ + { + addr = "[::]"; + port = 8443; + ssl = true; + proxyProtocol = true; + } { addr = "0.0.0.0"; port = 8443; diff --git a/config/hosts/public-web-static/virtualHosts/c3cat.de.nix b/config/hosts/public-web-static/virtualHosts/c3cat.de.nix index 95f9b59..54b7462 100644 --- a/config/hosts/public-web-static/virtualHosts/c3cat.de.nix +++ b/config/hosts/public-web-static/virtualHosts/c3cat.de.nix @@ -16,6 +16,10 @@ in { ]; listen = [ + { + addr = "[::]"; + port = 31820; + } { addr = "0.0.0.0"; port = 31820; @@ -28,6 +32,12 @@ in { useACMEHost = "${domain}"; listen = [ + { + addr = "[::]"; + port = 8443; + ssl = true; + proxyProtocol = true; + } { addr = "0.0.0.0"; port = 8443; @@ -61,6 +71,12 @@ in { useACMEHost = "${domain}"; listen = [ + { + addr = "[::]"; + port = 8443; + ssl = true; + proxyProtocol = true; + } { addr = "0.0.0.0"; port = 8443; diff --git a/config/hosts/public-web-static/virtualHosts/c3dog.de.nix b/config/hosts/public-web-static/virtualHosts/c3dog.de.nix index 16fedd5..dcca75a 100644 --- a/config/hosts/public-web-static/virtualHosts/c3dog.de.nix +++ b/config/hosts/public-web-static/virtualHosts/c3dog.de.nix @@ -16,6 +16,10 @@ in { ]; listen = [ + { + addr = "[::]"; + port = 31820; + } { addr = "0.0.0.0"; port = 31820; @@ -28,6 +32,12 @@ in { useACMEHost = "${domain}"; listen = [ + { + addr = "[::]"; + port = 8443; + ssl = true; + proxyProtocol = true; + } { addr = "0.0.0.0"; port = 8443; @@ -57,6 +67,12 @@ in { useACMEHost = "${domain}"; listen = [ + { + addr = "[::]"; + port = 8443; + ssl = true; + proxyProtocol = true; + } { addr = "0.0.0.0"; port = 8443; diff --git a/config/hosts/public-web-static/virtualHosts/cpu.ccc.de.nix b/config/hosts/public-web-static/virtualHosts/cpu.ccc.de.nix index d2e779a..79f6fb4 100644 --- a/config/hosts/public-web-static/virtualHosts/cpu.ccc.de.nix +++ b/config/hosts/public-web-static/virtualHosts/cpu.ccc.de.nix @@ -17,6 +17,10 @@ in serverName = "${domain}"; listen = [ + { + addr = "[::]"; + port = 31820; + } { addr = "0.0.0.0"; port = 31820; @@ -30,6 +34,12 @@ in useACMEHost = "${domain}"; listen = [ + { + addr = "[::]"; + port = 8443; + ssl = true; + proxyProtocol = true; + } { addr = "0.0.0.0"; port = 8443; @@ -81,12 +91,20 @@ in "local.ccc.de" ]; - listen = [{ - addr = "0.0.0.0"; - port = 8443; - ssl = true; - proxyProtocol = true; - }]; + listen = [ + { + addr = "[::]"; + port = 8443; + ssl = true; + proxyProtocol = true; + } + { + addr = "0.0.0.0"; + port = 8443; + ssl = true; + proxyProtocol = true; + } + ]; locations."/".return = "302 https://cpu.ccc.de"; diff --git a/config/hosts/public-web-static/virtualHosts/cryptoparty-hamburg.de.nix b/config/hosts/public-web-static/virtualHosts/cryptoparty-hamburg.de.nix index 37d95b9..59934eb 100644 --- a/config/hosts/public-web-static/virtualHosts/cryptoparty-hamburg.de.nix +++ b/config/hosts/public-web-static/virtualHosts/cryptoparty-hamburg.de.nix @@ -16,6 +16,10 @@ in serverName = "${domain}"; listen = [ + { + addr = "[::]"; + port = 31820; + } { addr = "0.0.0.0"; port = 31820; @@ -28,6 +32,12 @@ in useACMEHost = "${domain}"; listen = [ + { + addr = "[::]"; + port = 8443; + ssl = true; + proxyProtocol = true; + } { addr = "0.0.0.0"; port = 8443; @@ -55,6 +65,12 @@ in useACMEHost = "${domain}"; listen = [ + { + addr = "[::]"; + port = 8443; + ssl = true; + proxyProtocol = true; + } { addr = "0.0.0.0"; port = 8443; diff --git a/config/hosts/public-web-static/virtualHosts/diday.org.nix b/config/hosts/public-web-static/virtualHosts/diday.org.nix index 547c797..42117bf 100644 --- a/config/hosts/public-web-static/virtualHosts/diday.org.nix +++ b/config/hosts/public-web-static/virtualHosts/diday.org.nix @@ -16,6 +16,10 @@ in serverName = "${domain}"; listen = [ + { + addr = "[::]"; + port = 31820; + } { addr = "0.0.0.0"; port = 31820; @@ -28,6 +32,12 @@ in useACMEHost = "${domain}"; listen = [ + { + addr = "[::]"; + port = 8443; + ssl = true; + proxyProtocol = true; + } { addr = "0.0.0.0"; port = 8443; @@ -50,6 +60,12 @@ in useACMEHost = "${domain}"; listen = [ + { + addr = "[::]"; + port = 8443; + ssl = true; + proxyProtocol = true; + } { addr = "0.0.0.0"; port = 8443; diff --git a/config/hosts/public-web-static/virtualHosts/docs.c3voc.de.nix b/config/hosts/public-web-static/virtualHosts/docs.c3voc.de.nix index 5c257da..956baf4 100644 --- a/config/hosts/public-web-static/virtualHosts/docs.c3voc.de.nix +++ b/config/hosts/public-web-static/virtualHosts/docs.c3voc.de.nix @@ -11,6 +11,10 @@ in { serverName = "${domain}"; listen = [ + { + addr = "[::]"; + port = 31820; + } { addr = "0.0.0.0"; port = 31820; @@ -23,6 +27,12 @@ in { useACMEHost = "${domain}"; listen = [ + { + addr = "[::]"; + port = 8443; + ssl = true; + proxyProtocol = true; + } { addr = "0.0.0.0"; port = 8443; diff --git a/config/hosts/public-web-static/virtualHosts/element-admin.hamburg.ccc.de.nix b/config/hosts/public-web-static/virtualHosts/element-admin.hamburg.ccc.de.nix index 670b191..f30e9a7 100644 --- a/config/hosts/public-web-static/virtualHosts/element-admin.hamburg.ccc.de.nix +++ b/config/hosts/public-web-static/virtualHosts/element-admin.hamburg.ccc.de.nix @@ -40,6 +40,10 @@ in serverName = "element-admin.hamburg.ccc.de"; listen = [ + { + addr = "[::]"; + port = 31820; + } { addr = "0.0.0.0"; port = 31820; @@ -52,6 +56,12 @@ in useACMEHost = "element-admin.hamburg.ccc.de"; listen = [ + { + addr = "[::]"; + port = 8443; + ssl = true; + proxyProtocol = true; + } { addr = "0.0.0.0"; port = 8443; diff --git a/config/hosts/public-web-static/virtualHosts/element.hamburg.ccc.de.nix b/config/hosts/public-web-static/virtualHosts/element.hamburg.ccc.de.nix index 360fb76..b8a014f 100644 --- a/config/hosts/public-web-static/virtualHosts/element.hamburg.ccc.de.nix +++ b/config/hosts/public-web-static/virtualHosts/element.hamburg.ccc.de.nix @@ -24,6 +24,10 @@ in serverName = "element.hamburg.ccc.de"; listen = [ + { + addr = "[::]"; + port = 31820; + } { addr = "0.0.0.0"; port = 31820; @@ -36,6 +40,12 @@ in useACMEHost = "element.hamburg.ccc.de"; listen = [ + { + addr = "[::]"; + port = 8443; + ssl = true; + proxyProtocol = true; + } { addr = "0.0.0.0"; port = 8443; diff --git a/config/hosts/public-web-static/virtualHosts/hacker.tours.nix b/config/hosts/public-web-static/virtualHosts/hacker.tours.nix index 20bb644..dd6fc90 100644 --- a/config/hosts/public-web-static/virtualHosts/hacker.tours.nix +++ b/config/hosts/public-web-static/virtualHosts/hacker.tours.nix @@ -12,6 +12,10 @@ in serverName = "${domain}"; listen = [ + { + addr = "[::]"; + port = 31820; + } { addr = "0.0.0.0"; port = 31820; @@ -22,12 +26,18 @@ in "${domain}" = { forceSSL = true; useACMEHost = "${domain}"; - + locations."/shop" = { return = "302 https://tickets.hamburg.ccc.de"; }; listen = [ + { + addr = "[::]"; + port = 8443; + ssl = true; + proxyProtocol = true; + } { addr = "0.0.0.0"; port = 8443; diff --git a/config/hosts/public-web-static/virtualHosts/hackertours.hamburg.ccc.de.nix b/config/hosts/public-web-static/virtualHosts/hackertours.hamburg.ccc.de.nix index eeb7778..269aa92 100644 --- a/config/hosts/public-web-static/virtualHosts/hackertours.hamburg.ccc.de.nix +++ b/config/hosts/public-web-static/virtualHosts/hackertours.hamburg.ccc.de.nix @@ -12,6 +12,10 @@ in serverName = "${domain}"; listen = [ + { + addr = "[::]"; + port = 31820; + } { addr = "0.0.0.0"; port = 31820; @@ -24,6 +28,12 @@ in useACMEHost = "${domain}"; listen = [ + { + addr = "[::]"; + port = 8443; + ssl = true; + proxyProtocol = true; + } { addr = "0.0.0.0"; port = 8443; diff --git a/config/hosts/public-web-static/virtualHosts/hamburg.ccc.de.nix b/config/hosts/public-web-static/virtualHosts/hamburg.ccc.de.nix index 1c967c9..abbf5aa 100644 --- a/config/hosts/public-web-static/virtualHosts/hamburg.ccc.de.nix +++ b/config/hosts/public-web-static/virtualHosts/hamburg.ccc.de.nix @@ -7,6 +7,10 @@ serverName = "hamburg.ccc.de"; listen = [ + { + addr = "[::]"; + port = 31820; + } { addr = "0.0.0.0"; port = 31820; @@ -20,6 +24,12 @@ default = true; listen = [ + { + addr = "[::]"; + port = 8443; + ssl = true; + proxyProtocol = true; + } { addr = "0.0.0.0"; port = 8443; diff --git a/config/hosts/public-web-static/virtualHosts/historic-easterhegg/eh03.nix b/config/hosts/public-web-static/virtualHosts/historic-easterhegg/eh03.nix index 2c5dd86..bb8bd6e 100644 --- a/config/hosts/public-web-static/virtualHosts/historic-easterhegg/eh03.nix +++ b/config/hosts/public-web-static/virtualHosts/historic-easterhegg/eh03.nix @@ -25,10 +25,16 @@ in "easterhegg2003.hamburg.ccc.de" "www.easterhegg2003.hamburg.ccc.de" ]; - listen = [{ - addr = "0.0.0.0"; - port = 31820; - }]; + listen = [ + { + addr = "[::]"; + port = 31820; + } + { + addr = "0.0.0.0"; + port = 31820; + } + ]; }; "easterhegg2003.hamburg.ccc.de" = { @@ -40,12 +46,20 @@ in "www.easterhegg2003.hamburg.ccc.de" ]; - listen = [{ - addr = "0.0.0.0"; - port = 8443; - ssl = true; - proxyProtocol = true; - }]; + listen = [ + { + addr = "[::]"; + port = 8443; + ssl = true; + proxyProtocol = true; + } + { + addr = "0.0.0.0"; + port = 8443; + ssl = true; + proxyProtocol = true; + } + ]; locations."/".return = "302 https://eh03.easterhegg.eu"; @@ -65,18 +79,26 @@ in forceSSL = true; useACMEHost = "eh03.easterhegg.eu"; - listen = [{ - addr = "0.0.0.0"; - port = 8443; - ssl = true; - proxyProtocol = true; - }]; + listen = [ + { + addr = "[::]"; + port = 8443; + ssl = true; + proxyProtocol = true; + } + { + addr = "0.0.0.0"; + port = 8443; + ssl = true; + proxyProtocol = true; + } + ]; locations."/" = { index = "index.html"; root = eh03; extraConfig = '' - # Set default_type to html + # Set default_type to html default_type text/html; # Enable SSI ssi on; diff --git a/config/hosts/public-web-static/virtualHosts/historic-easterhegg/eh05.nix b/config/hosts/public-web-static/virtualHosts/historic-easterhegg/eh05.nix index 37cb893..a6b6f80 100644 --- a/config/hosts/public-web-static/virtualHosts/historic-easterhegg/eh05.nix +++ b/config/hosts/public-web-static/virtualHosts/historic-easterhegg/eh05.nix @@ -25,10 +25,16 @@ in "easterhegg2005.hamburg.ccc.de" "www.easterhegg2005.hamburg.ccc.de" ]; - listen = [{ - addr = "0.0.0.0"; - port = 31820; - }]; + listen = [ + { + addr = "[::]"; + port = 31820; + } + { + addr = "0.0.0.0"; + port = 31820; + } + ]; }; "easterhegg2005.hamburg.ccc.de" = { @@ -40,12 +46,20 @@ in "www.easterhegg2005.hamburg.ccc.de" ]; - listen = [{ - addr = "0.0.0.0"; - port = 8443; - ssl = true; - proxyProtocol = true; - }]; + listen = [ + { + addr = "[::]"; + port = 8443; + ssl = true; + proxyProtocol = true; + } + { + addr = "0.0.0.0"; + port = 8443; + ssl = true; + proxyProtocol = true; + } + ]; locations."/".return = "302 https://eh05.easterhegg.eu"; @@ -65,18 +79,26 @@ in forceSSL = true; useACMEHost = "eh05.easterhegg.eu"; - listen = [{ - addr = "0.0.0.0"; - port = 8443; - ssl = true; - proxyProtocol = true; - }]; + listen = [ + { + addr = "[::]"; + port = 8443; + ssl = true; + proxyProtocol = true; + } + { + addr = "0.0.0.0"; + port = 8443; + ssl = true; + proxyProtocol = true; + } + ]; locations."/" = { index = "index.shtml"; root = eh05; extraConfig = '' - # Set default_type to html + # Set default_type to html default_type text/html; # Enable SSI ssi on; diff --git a/config/hosts/public-web-static/virtualHosts/historic-easterhegg/eh07.nix b/config/hosts/public-web-static/virtualHosts/historic-easterhegg/eh07.nix index ebfa712..80a404b 100644 --- a/config/hosts/public-web-static/virtualHosts/historic-easterhegg/eh07.nix +++ b/config/hosts/public-web-static/virtualHosts/historic-easterhegg/eh07.nix @@ -29,10 +29,16 @@ in "easterhegg2007.hamburg.ccc.de" "www.easterhegg2007.hamburg.ccc.de" ]; - listen = [{ - addr = "0.0.0.0"; - port = 31820; - }]; + listen = [ + { + addr = "[::]"; + port = 31820; + } + { + addr = "0.0.0.0"; + port = 31820; + } + ]; }; "easterhegg2007.hamburg.ccc.de" = { @@ -46,12 +52,20 @@ in "www.easterhegg2007.hamburg.ccc.de" ]; - listen = [{ - addr = "0.0.0.0"; - port = 8443; - ssl = true; - proxyProtocol = true; - }]; + listen = [ + { + addr = "[::]"; + port = 8443; + ssl = true; + proxyProtocol = true; + } + { + addr = "0.0.0.0"; + port = 8443; + ssl = true; + proxyProtocol = true; + } + ]; locations."/".return = "302 https://eh07.easterhegg.eu"; @@ -71,18 +85,26 @@ in forceSSL = true; useACMEHost = "eh07.easterhegg.eu"; - listen = [{ - addr = "0.0.0.0"; - port = 8443; - ssl = true; - proxyProtocol = true; - }]; + listen = [ + { + addr = "[::]"; + port = 8443; + ssl = true; + proxyProtocol = true; + } + { + addr = "0.0.0.0"; + port = 8443; + ssl = true; + proxyProtocol = true; + } + ]; locations."/" = { index = "index.shtml"; root = eh07; extraConfig = '' - # Set default_type to html + # Set default_type to html default_type text/html; # Enable SSI ssi on; diff --git a/config/hosts/public-web-static/virtualHosts/historic-easterhegg/eh09.nix b/config/hosts/public-web-static/virtualHosts/historic-easterhegg/eh09.nix index ea274af..f2720f4 100644 --- a/config/hosts/public-web-static/virtualHosts/historic-easterhegg/eh09.nix +++ b/config/hosts/public-web-static/virtualHosts/historic-easterhegg/eh09.nix @@ -29,10 +29,16 @@ in "easterhegg2009.hamburg.ccc.de" "www.easterhegg2009.hamburg.ccc.de" ]; - listen = [{ - addr = "0.0.0.0"; - port = 31820; - }]; + listen = [ + { + addr = "[::]"; + port = 31820; + } + { + addr = "0.0.0.0"; + port = 31820; + } + ]; }; "easterhegg2009.hamburg.ccc.de" = { @@ -46,12 +52,20 @@ in "www.easterhegg2009.hamburg.ccc.de" ]; - listen = [{ - addr = "0.0.0.0"; - port = 8443; - ssl = true; - proxyProtocol = true; - }]; + listen = [ + { + addr = "[::]"; + port = 8443; + ssl = true; + proxyProtocol = true; + } + { + addr = "0.0.0.0"; + port = 8443; + ssl = true; + proxyProtocol = true; + } + ]; locations."/".return = "302 https://eh09.easterhegg.eu"; @@ -71,18 +85,26 @@ in forceSSL = true; useACMEHost = "eh09.easterhegg.eu"; - listen = [{ - addr = "0.0.0.0"; - port = 8443; - ssl = true; - proxyProtocol = true; - }]; + listen = [ + { + addr = "[::]"; + port = 8443; + ssl = true; + proxyProtocol = true; + } + { + addr = "0.0.0.0"; + port = 8443; + ssl = true; + proxyProtocol = true; + } + ]; locations."/" = { index = "index.shtml"; root = eh09; extraConfig = '' - # Set default_type to html + # Set default_type to html default_type text/html; # Enable SSI ssi on; diff --git a/config/hosts/public-web-static/virtualHosts/historic-easterhegg/eh11.nix b/config/hosts/public-web-static/virtualHosts/historic-easterhegg/eh11.nix index 39d7fad..e44d0f5 100644 --- a/config/hosts/public-web-static/virtualHosts/historic-easterhegg/eh11.nix +++ b/config/hosts/public-web-static/virtualHosts/historic-easterhegg/eh11.nix @@ -29,10 +29,16 @@ in "easterhegg2011.hamburg.ccc.de" "www.easterhegg2011.hamburg.ccc.de" ]; - listen = [{ - addr = "0.0.0.0"; - port = 31820; - }]; + listen = [ + { + addr = "[::]"; + port = 31820; + } + { + addr = "0.0.0.0"; + port = 31820; + } + ]; }; "easterhegg2011.hamburg.ccc.de" = { @@ -46,12 +52,20 @@ in "www.easterhegg2011.hamburg.ccc.de" ]; - listen = [{ - addr = "0.0.0.0"; - port = 8443; - ssl = true; - proxyProtocol = true; - }]; + listen = [ + { + addr = "[::]"; + port = 8443; + ssl = true; + proxyProtocol = true; + } + { + addr = "0.0.0.0"; + port = 8443; + ssl = true; + proxyProtocol = true; + } + ]; locations."/".return = "302 https://eh11.easterhegg.eu"; @@ -71,18 +85,26 @@ in forceSSL = true; useACMEHost = "eh11.easterhegg.eu"; - listen = [{ - addr = "0.0.0.0"; - port = 8443; - ssl = true; - proxyProtocol = true; - }]; + listen = [ + { + addr = "[::]"; + port = 8443; + ssl = true; + proxyProtocol = true; + } + { + addr = "0.0.0.0"; + port = 8443; + ssl = true; + proxyProtocol = true; + } + ]; locations."/" = { index = "index.shtml"; root = eh11; extraConfig = '' - # Set default_type to html + # Set default_type to html default_type text/html; # Enable SSI ssi on; diff --git a/config/hosts/public-web-static/virtualHosts/historic-easterhegg/eh20.nix b/config/hosts/public-web-static/virtualHosts/historic-easterhegg/eh20.nix index afc93c1..c72a72b 100644 --- a/config/hosts/public-web-static/virtualHosts/historic-easterhegg/eh20.nix +++ b/config/hosts/public-web-static/virtualHosts/historic-easterhegg/eh20.nix @@ -21,10 +21,16 @@ in "www.eh20.easterhegg.eu" "eh20.hamburg.ccc.de" ]; - listen = [{ - addr = "0.0.0.0"; - port = 31820; - }]; + listen = [ + { + addr = "[::]"; + port = 31820; + } + { + addr = "0.0.0.0"; + port = 31820; + } + ]; }; "www.eh20.easterhegg.eu" = { @@ -34,12 +40,20 @@ in "eh20.hamburg.ccc.de" ]; - listen = [{ - addr = "0.0.0.0"; - port = 8443; - ssl = true; - proxyProtocol = true; - }]; + listen = [ + { + addr = "[::]"; + port = 8443; + ssl = true; + proxyProtocol = true; + } + { + addr = "0.0.0.0"; + port = 8443; + ssl = true; + proxyProtocol = true; + } + ]; locations."/".return = "302 https://eh20.easterhegg.eu"; @@ -59,12 +73,20 @@ in forceSSL = true; useACMEHost = "eh20.easterhegg.eu"; - listen = [{ - addr = "0.0.0.0"; - port = 8443; - ssl = true; - proxyProtocol = true; - }]; + listen = [ + { + addr = "[::]"; + port = 8443; + ssl = true; + proxyProtocol = true; + } + { + addr = "0.0.0.0"; + port = 8443; + ssl = true; + proxyProtocol = true; + } + ]; locations."/" = { index = "start.html"; diff --git a/config/hosts/public-web-static/virtualHosts/spaceapi.hamburg.ccc.de.nix b/config/hosts/public-web-static/virtualHosts/spaceapi.hamburg.ccc.de.nix index 7852639..105c0e5 100644 --- a/config/hosts/public-web-static/virtualHosts/spaceapi.hamburg.ccc.de.nix +++ b/config/hosts/public-web-static/virtualHosts/spaceapi.hamburg.ccc.de.nix @@ -7,6 +7,10 @@ serverName = "spaceapi.hamburg.ccc.de"; listen = [ + { + addr = "[::]"; + port = 31820; + } { addr = "0.0.0.0"; port = 31820; @@ -19,6 +23,12 @@ useACMEHost = "spaceapi.hamburg.ccc.de"; listen = [ + { + addr = "[::]"; + port = 8443; + ssl = true; + proxyProtocol = true; + } { addr = "0.0.0.0"; port = 8443; diff --git a/config/hosts/public-web-static/virtualHosts/staging.c3cat.de.nix b/config/hosts/public-web-static/virtualHosts/staging.c3cat.de.nix index c91d283..3f9f7a3 100644 --- a/config/hosts/public-web-static/virtualHosts/staging.c3cat.de.nix +++ b/config/hosts/public-web-static/virtualHosts/staging.c3cat.de.nix @@ -11,6 +11,10 @@ in { serverName = "${domain}"; listen = [ + { + addr = "[::]"; + port = 31820; + } { addr = "0.0.0.0"; port = 31820; @@ -23,6 +27,12 @@ in { useACMEHost = "${domain}"; listen = [ + { + addr = "[::]"; + port = 8443; + ssl = true; + proxyProtocol = true; + } { addr = "0.0.0.0"; port = 8443; diff --git a/config/hosts/public-web-static/virtualHosts/staging.c3dog.de.nix b/config/hosts/public-web-static/virtualHosts/staging.c3dog.de.nix index d69ad2b..697ac69 100644 --- a/config/hosts/public-web-static/virtualHosts/staging.c3dog.de.nix +++ b/config/hosts/public-web-static/virtualHosts/staging.c3dog.de.nix @@ -11,6 +11,10 @@ in { serverName = "${domain}"; listen = [ + { + addr = "[::]"; + port = 31820; + } { addr = "0.0.0.0"; port = 31820; @@ -23,6 +27,12 @@ in { useACMEHost = "${domain}"; listen = [ + { + addr = "[::]"; + port = 8443; + ssl = true; + proxyProtocol = true; + } { addr = "0.0.0.0"; port = 8443; diff --git a/config/hosts/public-web-static/virtualHosts/staging.cryptoparty-hamburg.de.nix b/config/hosts/public-web-static/virtualHosts/staging.cryptoparty-hamburg.de.nix index 6733dad..21ef153 100644 --- a/config/hosts/public-web-static/virtualHosts/staging.cryptoparty-hamburg.de.nix +++ b/config/hosts/public-web-static/virtualHosts/staging.cryptoparty-hamburg.de.nix @@ -16,6 +16,10 @@ in serverName = "${domain}"; listen = [ + { + addr = "[::]"; + port = 31820; + } { addr = "0.0.0.0"; port = 31820; @@ -28,6 +32,12 @@ in useACMEHost = "${domain}"; listen = [ + { + addr = "[::]"; + port = 8443; + ssl = true; + proxyProtocol = true; + } { addr = "0.0.0.0"; port = 8443; @@ -55,6 +65,12 @@ in useACMEHost = "${domain}"; listen = [ + { + addr = "[::]"; + port = 8443; + ssl = true; + proxyProtocol = true; + } { addr = "0.0.0.0"; port = 8443; diff --git a/config/hosts/public-web-static/virtualHosts/staging.diday.org.nix b/config/hosts/public-web-static/virtualHosts/staging.diday.org.nix index b165348..7ff72b8 100644 --- a/config/hosts/public-web-static/virtualHosts/staging.diday.org.nix +++ b/config/hosts/public-web-static/virtualHosts/staging.diday.org.nix @@ -21,6 +21,12 @@ in forceSSL = true; listen = [ + { + addr = "[::]"; + port = 8443; + ssl = true; + proxyProtocol = true; + } { addr = "0.0.0.0"; port = 8443; diff --git a/config/hosts/public-web-static/virtualHosts/staging.docs.c3voc.de.nix b/config/hosts/public-web-static/virtualHosts/staging.docs.c3voc.de.nix index 2170f8c..b70af70 100644 --- a/config/hosts/public-web-static/virtualHosts/staging.docs.c3voc.de.nix +++ b/config/hosts/public-web-static/virtualHosts/staging.docs.c3voc.de.nix @@ -11,6 +11,10 @@ in { serverName = "${domain}"; listen = [ + { + addr = "[::]"; + port = 31820; + } { addr = "0.0.0.0"; port = 31820; @@ -23,6 +27,12 @@ in { useACMEHost = "${domain}"; listen = [ + { + addr = "[::]"; + port = 8443; + ssl = true; + proxyProtocol = true; + } { addr = "0.0.0.0"; port = 8443; diff --git a/config/hosts/public-web-static/virtualHosts/staging.hacker.tours.nix b/config/hosts/public-web-static/virtualHosts/staging.hacker.tours.nix index 14ede9b..7e44a84 100644 --- a/config/hosts/public-web-static/virtualHosts/staging.hacker.tours.nix +++ b/config/hosts/public-web-static/virtualHosts/staging.hacker.tours.nix @@ -12,6 +12,10 @@ in serverName = "${domain}"; listen = [ + { + addr = "[::]"; + port = 31820; + } { addr = "0.0.0.0"; port = 31820; @@ -24,6 +28,12 @@ in useACMEHost = "${domain}"; listen = [ + { + addr = "[::]"; + port = 8443; + ssl = true; + proxyProtocol = true; + } { addr = "0.0.0.0"; port = 8443; diff --git a/config/hosts/public-web-static/virtualHosts/staging.hackertours.hamburg.ccc.de.nix b/config/hosts/public-web-static/virtualHosts/staging.hackertours.hamburg.ccc.de.nix index 79ca38c..0c7cd28 100644 --- a/config/hosts/public-web-static/virtualHosts/staging.hackertours.hamburg.ccc.de.nix +++ b/config/hosts/public-web-static/virtualHosts/staging.hackertours.hamburg.ccc.de.nix @@ -12,6 +12,10 @@ in serverName = "${domain}"; listen = [ + { + addr = "[::]"; + port = 31820; + } { addr = "0.0.0.0"; port = 31820; @@ -24,6 +28,12 @@ in useACMEHost = "${domain}"; listen = [ + { + addr = "[::]"; + port = 8443; + ssl = true; + proxyProtocol = true; + } { addr = "0.0.0.0"; port = 8443; diff --git a/config/hosts/public-web-static/virtualHosts/staging.hamburg.ccc.de.nix b/config/hosts/public-web-static/virtualHosts/staging.hamburg.ccc.de.nix index f7e0752..624b632 100644 --- a/config/hosts/public-web-static/virtualHosts/staging.hamburg.ccc.de.nix +++ b/config/hosts/public-web-static/virtualHosts/staging.hamburg.ccc.de.nix @@ -7,6 +7,10 @@ serverName = "staging.hamburg.ccc.de"; listen = [ + { + addr = "[::]"; + port = 31820; + } { addr = "0.0.0.0"; port = 31820; @@ -19,6 +23,12 @@ useACMEHost = "staging.hamburg.ccc.de"; listen = [ + { + addr = "[::]"; + port = 8443; + ssl = true; + proxyProtocol = true; + } { addr = "0.0.0.0"; port = 8443; diff --git a/config/hosts/public-web-static/virtualHosts/www.hamburg.ccc.de.nix b/config/hosts/public-web-static/virtualHosts/www.hamburg.ccc.de.nix index a29fbd2..4f241f1 100644 --- a/config/hosts/public-web-static/virtualHosts/www.hamburg.ccc.de.nix +++ b/config/hosts/public-web-static/virtualHosts/www.hamburg.ccc.de.nix @@ -7,6 +7,10 @@ serverName = "www.hamburg.ccc.de"; listen = [ + { + addr = "[::]"; + port = 31820; + } { addr = "0.0.0.0"; port = 31820; @@ -19,6 +23,12 @@ useACMEHost = "www.hamburg.ccc.de"; listen = [ + { + addr = "[::]"; + port = 8443; + ssl = true; + proxyProtocol = true; + } { addr = "0.0.0.0"; port = 8443; diff --git a/deployment_configuration.json b/deployment_configuration.json index 3ae44cc..9a768bf 100644 --- a/deployment_configuration.json +++ b/deployment_configuration.json @@ -6,9 +6,6 @@ "matrix": { "targetHostname": "matrix-intern.hamburg.ccc.de" }, - "public-web-static": { - "targetHostname": "public-web-static-intern.hamburg.ccc.de" - }, "git": { "targetHostname": "git.hamburg.ccc.de" }, From e0b593289d1019dcd91ea0b3fa69d2ff4928cd97 Mon Sep 17 00:00:00 2001 From: June Date: Wed, 29 Apr 2026 03:08:20 +0200 Subject: [PATCH 05/34] forgejo-actions-runner(host): enable IPv6 support in Docker Enable the relevant config option and move to new network with an explicit IPv6, because otherwise there's no default v6 route and v6 in the Docker containers doesn't work. --- config/hosts/forgejo-actions-runner/configuration.nix | 5 ++++- config/hosts/forgejo-actions-runner/docker.nix | 3 +++ config/hosts/forgejo-actions-runner/networking.nix | 8 ++++---- deployment_configuration.json | 3 --- 4 files changed, 11 insertions(+), 8 deletions(-) diff --git a/config/hosts/forgejo-actions-runner/configuration.nix b/config/hosts/forgejo-actions-runner/configuration.nix index d2a52da..713e795 100644 --- a/config/hosts/forgejo-actions-runner/configuration.nix +++ b/config/hosts/forgejo-actions-runner/configuration.nix @@ -1,7 +1,10 @@ { config, pkgs, ... }: { - networking.hostName = "forgejo-actions-runner"; + networking = { + hostName = "forgejo-actions-runner"; + domain = "hosts.hamburg.ccc.de"; + }; system.stateVersion = "23.11"; } diff --git a/config/hosts/forgejo-actions-runner/docker.nix b/config/hosts/forgejo-actions-runner/docker.nix index b626e9f..043f272 100644 --- a/config/hosts/forgejo-actions-runner/docker.nix +++ b/config/hosts/forgejo-actions-runner/docker.nix @@ -9,5 +9,8 @@ enable = true; dates = "weekly"; }; + daemon.settings = { + ipv6 = true; + }; }; } diff --git a/config/hosts/forgejo-actions-runner/networking.nix b/config/hosts/forgejo-actions-runner/networking.nix index 71aa47a..0c09eda 100644 --- a/config/hosts/forgejo-actions-runner/networking.nix +++ b/config/hosts/forgejo-actions-runner/networking.nix @@ -5,14 +5,14 @@ let in { networking = { interfaces.net0 = { - ipv4.addresses = [ + ipv6.addresses = [ { - address = "172.31.17.155"; - prefixLength = 25; + address = "2a00:14b0:42:102::18"; + prefixLength = 64; } ]; }; - defaultGateway = "172.31.17.129"; + defaultGateway6 = "2a00:14b0:42:102::1"; nameservers = [ "212.12.50.158" "192.76.134.90" ]; search = [ "hamburg.ccc.de" ]; }; diff --git a/deployment_configuration.json b/deployment_configuration.json index 9a768bf..eddd7b0 100644 --- a/deployment_configuration.json +++ b/deployment_configuration.json @@ -9,9 +9,6 @@ "git": { "targetHostname": "git.hamburg.ccc.de" }, - "forgejo-actions-runner": { - "targetHostname": "forgejo-actions-runner-intern.hamburg.ccc.de" - }, "woodpecker": { "targetHostname": "woodpecker-intern.hamburg.ccc.de" }, From b74304319a2c246d71b6aed91d86e35f057522af Mon Sep 17 00:00:00 2001 From: June Date: Wed, 29 Apr 2026 03:34:04 +0200 Subject: [PATCH 06/34] forgejo-actions-runner(host): also enable IPv6 support in runner config --- .../hosts/forgejo-actions-runner/forgejo-actions-runner.nix | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/config/hosts/forgejo-actions-runner/forgejo-actions-runner.nix b/config/hosts/forgejo-actions-runner/forgejo-actions-runner.nix index d5a93c1..2efeefe 100644 --- a/config/hosts/forgejo-actions-runner/forgejo-actions-runner.nix +++ b/config/hosts/forgejo-actions-runner/forgejo-actions-runner.nix @@ -15,6 +15,9 @@ tokenFile = "/run/secrets/forgejo_actions_runner_registration_token"; labels = [ "docker:docker://node:current-bookworm" ]; settings = { + container = { + enable_ipv6 = true; + }; cache = { proxy_port = 45540; }; @@ -35,6 +38,9 @@ "alpine-latest:docker://node:current-alpine" ]; settings = { + container = { + enable_ipv6 = true; + }; cache = { proxy_port = 45541; }; From e3b638b10fc790adbed3247b67703a35050bffd2 Mon Sep 17 00:00:00 2001 From: lilly Date: Thu, 30 Apr 2026 01:12:23 +0200 Subject: [PATCH 07/34] remove basic-auth from diday.org --- config/hosts/public-web-static/virtualHosts/diday.org.nix | 8 -------- .../public-web-static/virtualHosts/staging.diday.org.nix | 4 ---- 2 files changed, 12 deletions(-) diff --git a/config/hosts/public-web-static/virtualHosts/diday.org.nix b/config/hosts/public-web-static/virtualHosts/diday.org.nix index 42117bf..d9f3b31 100644 --- a/config/hosts/public-web-static/virtualHosts/diday.org.nix +++ b/config/hosts/public-web-static/virtualHosts/diday.org.nix @@ -46,10 +46,6 @@ in } ]; - basicAuth = { - "preview" = "liebe"; - }; - extraConfig = '' return 301 https://diday.org; ''; @@ -74,10 +70,6 @@ in } ]; - basicAuth = { - "preview" = "liebe"; - }; - root = "${dataDir}"; extraConfig = '' diff --git a/config/hosts/public-web-static/virtualHosts/staging.diday.org.nix b/config/hosts/public-web-static/virtualHosts/staging.diday.org.nix index 7ff72b8..c6afb80 100644 --- a/config/hosts/public-web-static/virtualHosts/staging.diday.org.nix +++ b/config/hosts/public-web-static/virtualHosts/staging.diday.org.nix @@ -35,10 +35,6 @@ in } ]; - basicAuth = { - "preview" = "liebe"; - }; - extraConfig = '' # Make use of the ngx_http_realip_module to set the $remote_addr and # $remote_port to the client address and client port, when using proxy From 1abba8aece739678ba0e4fec382bd1345a5fe4e5 Mon Sep 17 00:00:00 2001 From: June Date: Thu, 14 May 2026 00:06:32 +0200 Subject: [PATCH 08/34] public-web-static(host): update element-web and element-admin element-web: 1.12.0 -> 1.12.18 element-admin: 0.1.10 -> 0.1.11 --- .../virtualHosts/element-admin.hamburg.ccc.de.nix | 6 +++--- .../virtualHosts/element.hamburg.ccc.de.nix | 4 ++-- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/config/hosts/public-web-static/virtualHosts/element-admin.hamburg.ccc.de.nix b/config/hosts/public-web-static/virtualHosts/element-admin.hamburg.ccc.de.nix index f30e9a7..8ee4336 100644 --- a/config/hosts/public-web-static/virtualHosts/element-admin.hamburg.ccc.de.nix +++ b/config/hosts/public-web-static/virtualHosts/element-admin.hamburg.ccc.de.nix @@ -1,14 +1,14 @@ { config, pkgs, ... }: let - elementAdminVersion = "0.1.10"; + elementAdminVersion = "0.1.11"; elementAdmin = pkgs.stdenv.mkDerivation (finalAttrs: { pname = "element-admin"; version = elementAdminVersion; src = pkgs.fetchzip { url = "https://github.com/element-hq/element-admin/archive/refs/tags/v${elementAdminVersion}.zip"; - sha256 = "sha256-dh7tmzAaTfKB9FuOVhLHpOIsTZK1qMvNq16HeObHOqI="; + sha256 = "sha256-tSUTDPspQJjvP1KN4nUr4LYyjNQFj4pKMMA8JmavIxo="; }; nativeBuildInputs = [ @@ -19,7 +19,7 @@ let pnpmDeps = pkgs.pnpm.fetchDeps { inherit (finalAttrs) pname version src; fetcherVersion = 2; - hash = "sha256-S/MdfUv6q+PaAKWYHxVY80BcpL81dOfpPVhNxEPQVE4="; + hash = "sha256-Hf4PWey5bczSNbc3QQ9z9X3OVUZ7VHXw7BHGQqJWPac="; }; buildPhase = '' diff --git a/config/hosts/public-web-static/virtualHosts/element.hamburg.ccc.de.nix b/config/hosts/public-web-static/virtualHosts/element.hamburg.ccc.de.nix index b8a014f..f781dc0 100644 --- a/config/hosts/public-web-static/virtualHosts/element.hamburg.ccc.de.nix +++ b/config/hosts/public-web-static/virtualHosts/element.hamburg.ccc.de.nix @@ -1,10 +1,10 @@ { pkgs, ... }: let - elementWebVersion = "1.12.0"; + elementWebVersion = "1.12.18"; element-web = pkgs.fetchzip { url = "https://github.com/element-hq/element-web/releases/download/v${elementWebVersion}/element-v${elementWebVersion}.tar.gz"; - sha256 = "sha256-2kXQFUhLYyEKuXYw+n94JGlTN2VJHRpjmu78u8gdaro="; + sha256 = "sha256-RvPJg28hgOgFs0GFZ9EPypQkUPkAns0alXYJeNst4Bk="; }; elementSecurityHeaders = '' # Configuration best practices From cd7a0054a7e62c387fa16ecff3ff31dba0f48025 Mon Sep 17 00:00:00 2001 From: June Date: Thu, 14 May 2026 00:08:13 +0200 Subject: [PATCH 09/34] flake.lock: Update MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Flake lock file updates: • Updated input 'nixpkgs': 'github:nixos/nixpkgs/a4bf06618f0b5ee50f14ed8f0da77d34ecc19160' (2026-04-25) → 'github:nixos/nixpkgs/8fd9daa3db09ced9700431c5b7ad0e8ba199b575' (2026-05-10) • Updated input 'nixpkgs-unstable': 'github:nixos/nixpkgs/01fbdeef22b76df85ea168fbfe1bfd9e63681b30' (2026-04-23) → 'github:nixos/nixpkgs/eef00dfd8a712b34af845f9350bac681b1228bd1' (2026-05-13) • Updated input 'sops-nix': 'github:Mic92/sops-nix/bef289e2248991f7afeb95965c82fbcd8ff72598' (2026-04-21) → 'github:Mic92/sops-nix/c591bf665727040c6cc5cb409079acb22dcce33c' (2026-05-05) --- flake.lock | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/flake.lock b/flake.lock index ed279ac..b2142ed 100644 --- a/flake.lock +++ b/flake.lock @@ -19,11 +19,11 @@ }, "nixpkgs": { "locked": { - "lastModified": 1777077449, - "narHash": "sha256-AIiMJiqvGrN4HyLEbKAoCSRRYn0rnlW5VbKNIMIYqm4=", + "lastModified": 1778430510, + "narHash": "sha256-Ti+ZBvW6yrWWAg2szExVTwCd4qOJ3KlVr1tFHfyfi8Q=", "owner": "nixos", "repo": "nixpkgs", - "rev": "a4bf06618f0b5ee50f14ed8f0da77d34ecc19160", + "rev": "8fd9daa3db09ced9700431c5b7ad0e8ba199b575", "type": "github" }, "original": { @@ -35,11 +35,11 @@ }, "nixpkgs-unstable": { "locked": { - "lastModified": 1776949667, - "narHash": "sha256-GMSVw35Q+294GlrTUKlx087E31z7KurReQ1YHSKp5iw=", + "lastModified": 1778672786, + "narHash": "sha256-Blg88K1jwG+P0Mr27+rKMFCufdrWkV3wWh9AdYtz0FQ=", "owner": "nixos", "repo": "nixpkgs", - "rev": "01fbdeef22b76df85ea168fbfe1bfd9e63681b30", + "rev": "eef00dfd8a712b34af845f9350bac681b1228bd1", "type": "github" }, "original": { @@ -64,11 +64,11 @@ ] }, "locked": { - "lastModified": 1776771786, - "narHash": "sha256-DRFGPfFV6hbrfO9a1PH1FkCi7qR5FgjSqsQGGvk1rdI=", + "lastModified": 1777944972, + "narHash": "sha256-VfGRo1qTBKOe3s2gOv8LSoA6Fk19PvBlwQ1ECN0Evn8=", "owner": "Mic92", "repo": "sops-nix", - "rev": "bef289e2248991f7afeb95965c82fbcd8ff72598", + "rev": "c591bf665727040c6cc5cb409079acb22dcce33c", "type": "github" }, "original": { From c458aa2f17b0e760c588d8af812b13baf35961d5 Mon Sep 17 00:00:00 2001 From: chris Date: Fri, 15 May 2026 17:58:16 +0200 Subject: [PATCH 10/34] Remove woodpecker host Long live forgejo actions --- config/hosts/woodpecker/configuration.nix | 7 - config/hosts/woodpecker/default.nix | 11 -- config/hosts/woodpecker/networking.nix | 22 --- config/hosts/woodpecker/secrets.yaml | 149 ------------------ config/hosts/woodpecker/sops.nix | 7 - .../woodpecker/woodpecker-agent/default.nix | 8 - .../woodpecker/woodpecker-agent/docker.nix | 12 -- .../woodpecker-agent/woodpecker-agent.nix | 29 ---- .../woodpecker/woodpecker-server/default.nix | 9 -- .../woodpecker/woodpecker-server/nginx.nix | 57 ------- .../woodpecker-server/postgresql.nix | 18 --- .../woodpecker-server/woodpecker-server.nix | 44 ------ flake.nix | 11 -- 13 files changed, 384 deletions(-) delete mode 100644 config/hosts/woodpecker/configuration.nix delete mode 100644 config/hosts/woodpecker/default.nix delete mode 100644 config/hosts/woodpecker/networking.nix delete mode 100644 config/hosts/woodpecker/secrets.yaml delete mode 100644 config/hosts/woodpecker/sops.nix delete mode 100644 config/hosts/woodpecker/woodpecker-agent/default.nix delete mode 100644 config/hosts/woodpecker/woodpecker-agent/docker.nix delete mode 100644 config/hosts/woodpecker/woodpecker-agent/woodpecker-agent.nix delete mode 100644 config/hosts/woodpecker/woodpecker-server/default.nix delete mode 100644 config/hosts/woodpecker/woodpecker-server/nginx.nix delete mode 100644 config/hosts/woodpecker/woodpecker-server/postgresql.nix delete mode 100644 config/hosts/woodpecker/woodpecker-server/woodpecker-server.nix diff --git a/config/hosts/woodpecker/configuration.nix b/config/hosts/woodpecker/configuration.nix deleted file mode 100644 index 45e228e..0000000 --- a/config/hosts/woodpecker/configuration.nix +++ /dev/null @@ -1,7 +0,0 @@ -{ config, pkgs, ... }: - -{ - networking.hostName = "woodpecker"; - - system.stateVersion = "24.05"; -} diff --git a/config/hosts/woodpecker/default.nix b/config/hosts/woodpecker/default.nix deleted file mode 100644 index 1db0c8c..0000000 --- a/config/hosts/woodpecker/default.nix +++ /dev/null @@ -1,11 +0,0 @@ -{ config, pkgs, ... }: - -{ - imports = [ - ./woodpecker-agent - ./woodpecker-server - ./configuration.nix - ./networking.nix - ./sops.nix - ]; -} diff --git a/config/hosts/woodpecker/networking.nix b/config/hosts/woodpecker/networking.nix deleted file mode 100644 index 3301812..0000000 --- a/config/hosts/woodpecker/networking.nix +++ /dev/null @@ -1,22 +0,0 @@ -{ ... }: - -{ - networking = { - interfaces.net0 = { - ipv4.addresses = [ - { - address = "172.31.17.160"; - prefixLength = 25; - } - ]; - }; - defaultGateway = "172.31.17.129"; - nameservers = [ "212.12.50.158" "192.76.134.90" ]; - search = [ "hamburg.ccc.de" ]; - }; - - systemd.network.links."10-net0" = { - matchConfig.MACAddress = "BC:24:11:5F:A9:B7"; - linkConfig.Name = "net0"; - }; -} diff --git a/config/hosts/woodpecker/secrets.yaml b/config/hosts/woodpecker/secrets.yaml deleted file mode 100644 index 5fae897..0000000 --- a/config/hosts/woodpecker/secrets.yaml +++ /dev/null @@ -1,149 +0,0 @@ -woodpecker_server_environment_file: ENC[AES256_GCM,data:68Wu0UOHBAGZHSJ0x4wbeDLm626jpumv9w6A65FNKsmzYp6P4/c4g1MF1agQd7l9nKMTRrgyJyfoEZYFQRX6lYSmcsQLfn++uh1JpFoClT5p/5hBkiDq4owUFU+NGUiyl6yjYlEiaxLwC4ZdyISHeEYpbrvGyIXLsFgdrQ0rVX3cCRwIMxFcyCG6d3MZVoqAw1A=,iv:y/+X02aRPBOoR57P9s7y/SijvXVLuiBBfFYqeJLvQEU=,tag:DNwK+M6s3moglkMkrWccyA==,type:str] -woodpecker_agent_environment_file: ENC[AES256_GCM,data:rwp6TYYFJ/IZH+3pGhPxjdZMLoyPMr/W1RXm4IkUGn+SmIjHZcdFZ8nEhvOfnkfrXNPc2MR+X6NXUmVOcBjSCbcBjh9sC653UpKimt9I3/Ec,iv:X9JH7dmTayw8BaEsXYil3PrykCdd+/ANGHVfEyRvc7A=,tag:/ErkX1WnruanNgTTBUT6LA==,type:str] -sops: - age: - - recipient: age19h7xtfmt3py3ydgl8d8fgh8uakxqxjr74flrxev3pgmvvx94kvtq5d932d - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWdUhjQUJIS2QvWk1Yc3pR - M1daYlRubnlsQk9tcytBNWdYMUU4bG1DVHhZCnVKK00ySDdBZFhzRXlaQ2xVaTBh - bVVVNzRraUpHSFFuRStzWFprUGRoMGcKLS0tIEVBUWh4STBIaGdTelFKcnB0TkNR - SEd1VTZQZWlkYXVKcVRPbVA1U3VWbFUKnuaPGc29kKE86nh+xEto0Jb6BQ0uH3pr - Q1QPgfiOCYGkuUewy3LlGnLTuMxHBBWAjg4zgaYPHU2F/HCS5DB5nw== - -----END AGE ENCRYPTED FILE----- - - recipient: age1klxtcr23hers0lh4f5zdd53tyrtg0jud35rhydstyjq9fjymf9hsn2a8ch - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArdVJNK1ljNWwrTy9qc1p1 - N1MweERxdkNXZVZITWRRdGFQRHRQeTNFTTI4CjFkSVJQMFBKY2tRWE1DeXdMOUZY - Qm5oYTU1azFzVEpYZUptcTVhRCsxL28KLS0tIEI0czljekgvQlc1SlVGSUpGb1N3 - NytOaE5nQ3E4bFhCQ1ZDU3MyM3p5cmcK3LGva0vDjitqOBqBo6jHqRBaH8T8cOim - IF8ygc0i/dbaec59ZcCMhS0n8yv0lVHO2WiUwPaKTh5hkti9LhKlaA== - -----END AGE ENCRYPTED FILE----- - lastmodified: "2024-06-22T15:55:25Z" - mac: ENC[AES256_GCM,data:UmDbmxSRj8YfCkKEelQNMJ8mzbu5aQdB9yOr9JfUh5TB9r5Z5ttZ1wgJDJqHNtsII3JGXUvbgHbsmbPikkrj4Ege1rrgr4UttN1rtgeaAKlZIlqb9pOnV4//GJL8jbxCgFp2h2O80G05nAXG54DaY//4Y5hfTyPzgyDlGQ6jlhg=,iv:5e8lpFfGAJh8lTFcY4MlZG7PgnzM0UycsU0tB2KN+zQ=,tag:4xUEHg04wjDbhc9MOItzuQ==,type:str] - pgp: - - created_at: "2026-02-17T22:22:03Z" - enc: |- - -----BEGIN PGP MESSAGE----- - - hQIMAz5uSgHG2iMJAQ/+NzRul1VZa2BLnjCsdUP7YErHvLsJqc/KwEFgGX8yN1Bg - VOHgm0MBYC14KtMu0Zb+Cm6ypqyaa4j+MXNVWLDTOLt1aLibashBmyPbwHNr0XwO - 6tr9qYAPixaoWFeiCtATKLUzWzQ68eDv9JHNNQvKGNjet9E1yOIxWHj6RxyV/EeZ - 50nf+7AO7cFkqRGFxrGKAYchzetajNPLtbS2htFCc3Vt9m38jusafvYdjeG+HQHe - 6INzdNqvM7vhfWJlIiTPCXGKvx0NhLg6sVvcXpq5mKbMAhja80KyUdl772L8Kr6P - ZYvmj+Ey8+GM+opGGxcaSBmgw3ZLRIZ1tks3LlRf/UiAZD5MqJoRL1DEJMtHzYnp - IqxOEiuMLAL1/TxG4KhJfT5Gs9Kf3Cnr6djhhsYg3GYXSQdhiyaBDaLpu68nEIRN - JSdA/7pCjxhvlgFl9XvPaMzQD5GZNlVapJPn1c9Ambi9cs4kB8nds+Xx4KgIN3li - 85flJnEtQWRI2DL8qJgoYJ1cXevkPVzKLFnQEHfLuozIzfPl1Wq1Sb3EQk9YZer9 - yfVHRngBBhmfNMtFy9gq8FLod0Odas3KQDAa7ndPMMx6oL5DoNeI3DpuYW4eQIZK - EbT5iHLMrTXHb2XKTHfXdjl6ttED+12GAby69jdGXjt6UVAM6b0UorWfSLLoqabS - XgG1w128eegSl4tqdYO/KDL30c9J1K8LqaJmg+9eFAi9Da/zmPAck+DlS7XUkeiX - OqZiOXLul0N2Qe/tWkpJD8F3HV+K6Xt0MSx8VsmeliicG4Rpme1Xysau+7kht3U= - =KUjN - -----END PGP MESSAGE----- - fp: 18DFCE01456DAB52EA38A6584EDC64F35FA1D6A5 - - created_at: "2026-02-17T22:22:03Z" - enc: |- - -----BEGIN PGP MESSAGE----- - - hQIMAw5vwmoEJHQ1ARAAxH+TtzvFlUZfD3U7BNRr9SyWVxnkR3U2zvvDG5A3I28K - fI1U1am6Z+gSvYdId38hiMPxDmDIMl2wCYCXd17q+PSycsJ1Bbzy1zaht6KcpSJb - s9jmNmf+5mazSRZ/COBy4mMq+2mam4/vu+xS85IsgxyxK9ygnCurmzMqn3lxatm0 - ICxvoLMAamA+tAfxtw+a5lEMok7pHdKndZmrKvxO7nLXM0292sJ3VHp5Uy9k487W - PznpjM1st/f/0gTu1mgb8rnUkSszw1odBeQ+xw2JvcDHE6Ow7PpCk83oTWXil6c4 - bEsrtvaFLWXN9/gssnayoMWHb/TCHKVe4AGrMevFkRdEFDRV5FRZGqzuGDP++X10 - KYyMN0/Wo/XU7Rn3+7HmKvz0qeaAI/IRTrhdXUDtQQ13/waxGrJEquwS5Xuwea6l - LlA6hwnAERSVrVkMQ60ITOD6n7lvAPA7jD/HhI3P2Xy4mDFW9ZnfnWi0xI9pRCsk - w+ZnQ1Ckacv0gJUirvsVSdUYHwvEvpFEVSsZsv5QbNsaWi5jn5XDH0eqlXQE80aO - o3vPFTNCHNixspiaIO4V8etyv6nSh7BxwDvIH4nZVxr8HmxILs0Occw9anvA81md - roF3pyb+ZFRIwcBh72VSdAm1D/n4h14lnmMj+19HEA3zvbPnZQejtGFMY1Oe2VTS - XgHMI0aRJANXczMA7LSg9vxDYvWXE2KR526oBsC1E7otCNGkxj3hhmng25K3tmIU - E2AAaAIk/RukMnydb93XGciPquCZsWlmpwlTGXCqoqiNBilvIE1lXH6rhym78ko= - =nRW4 - -----END PGP MESSAGE----- - fp: 87AB00D45D37C9E9167B5A5A333448678B60E505 - - created_at: "2026-02-17T22:22:03Z" - enc: |- - -----BEGIN PGP MESSAGE----- - - hF4DerEtaFuTeewSAQdAPWizx2khKtlshnLwE5PRszAdTvTlsEEiWVV5xJx3PnAw - 9Gj2lZZX4F0AXoKInElg2N02FXpIo24ZZUPXGqpswfSv93NFNNK+FWwqUCRZhuCM - 0l4Blkyy4PthGwIAtXqZ8GGxjoDGBLIAE/zrY9tdNB5XAnkiy7J82kora0dphpkq - Llb1Jgh0+ZK8RQzaf5wcgWf867MhJLhv0N+qLsFVutGpqFy1W/1vaLQ5au5Ty2Tw - =460I - -----END PGP MESSAGE----- - fp: 057870A2C72CD82566A3EC983695F4FCBCAE4912 - - created_at: "2026-02-17T22:22:03Z" - enc: |- - -----BEGIN PGP MESSAGE----- - - hQIMAxjNhCKPP69fAQ//Rzcsq0Yay/3g/MzqHI1izkSWsdycz3LE6qM4qhX4f7wZ - 4Ymzu2jbSq43IavCjGPOLIKVJ4nlnPd7rcprYNV5DOcGAkXG5x7PbnVta3SPI300 - CXnSGQB1KHUCCYZN1BkL9ZSQyTx0ex19mnsSEtZh8NB97cCZx9zMowdHKd5ySu/O - +CMFkQ6Uoh2FxBtqM1y1YbDiuDJnAlAQSKlDIVdCdMssutWRs9Nf6eiLtcmb4U5l - sNyKQnPrr3vjkaTbVdBKQjjMSa8Z/1Tf95GxNhzrUGm2APLKVYdHkMVlQwcr/ZfH - jGiZqxgBmrtNe3EypdKCDnlPvlxs8mnO5whxzDZW2NFV3piMmOmvLI/Po1ASi/t1 - PW9h05Foh2764Jfp74BkRTvhBfi465wKkON0VOckwWBkl/n7w7POfHCXdK1/AnGj - 9ywj6P4zg50vKiTMkZStq6YKXAEkVcN6YzhVVDFwDwAE1VKFCMKlmwuYT1FuKXBp - 7maF578qVyb0lXP9jaX10Y9dhC4vU2rJB3vtRhxjqeMEe/WOyhEyalrC9phPfBKS - wVKzdd3vvaNGfQSAwseFAn1upvELFwccPw1aRIqqLhzWTY2m48yyW2aEN6+7SqkR - dOBJpZDE4NxOhbQl0rllZdeLUznIgeOKM2iNg/3kM7cWcsLZRm3+l1ZuiCEy5XPS - XgHbwfJlyZYoQyKCntbdA/5VRS/5s0oPJIjuofoBZb35fIqtYPIpUeNccpklXYsO - atiSRwJeiluCFUag0uV3nq0zltOlqdS6piEVqU6xiGLAZe04jkaMBxL6VQQHYU0= - =811X - -----END PGP MESSAGE----- - fp: F38C9D4228FC6F674E322D9C3326D914EB9B8F55 - - created_at: "2026-02-17T22:22:03Z" - enc: |- - -----BEGIN PGP MESSAGE----- - - hQIMA1Hthzn+T1OoAQ/9EvULxQSjfO/V600iqRhsQsuuHWY5IfVN+XBCmzmeUX2a - 8qFN8L5gk3pYEoIu4khSCSeIpVyOdX1XeWMMNB15C/pAvgi7emH0y8UxAvCLfW5L - CzP3qLQsbpKUGntPlHaye/G16M/+m4QPc6Y7qwEtUThOei9haPhIU06Tb61IpfLk - AKticUro4ap3Xt/fjDH0NHZsGG33V6LprTt+8LaEcpcwZK/yOWdG4wTV4j6X8LbA - ueCmKunAr1skJrd+hVuwP2e8UkasYgo33pcupsS5jcyXJT9Kf3p/nqOJ3QGlwOtP - lf0DUifdd/QrEXWcMBu+zc9HgtUzpyU3KAoVrxo4JQLaoRlq3kwk3mOOFA0Fzd16 - neuJL2wp/RPuL47StHwA9HxQP+3znXkNxmt9yXGzeyeOBpK4O9qoQ9y7Rbd/FR2u - wEl5uAjhhH2xmAUnIKp5Y1UAFSLqZEaiJjjCHMHycaTpCucjEcChpaBGDAXYS1h+ - x/r6R46UgIzMvjpd2vy+C1aQg0p1Z6P65ifOkdAYIghpSkp+F6SUHHkL3w/kRRjE - dBF8YWFm/yl9P9qenakC5NsAA+bR4ZpNWpv32sYuVjIuoV20GdS7UIVQnvos8bBK - NfqoFmz4n8Eo1jLRcCJ376ow7bSEhRIJlJxdq7bFjZ/3Wtk9vt9dG6XV7wLdJwXS - XgGRxjv94TYLFowYA8/uu9fWxvf2i2lLqctjrvbZkW0Rdn2Ym5GXjg6St3Diug6r - y87PJPSN7CYE4jzCDPaSnGcBvwDHrQsLHLAmenfrAi2Jnweg/THpm9UAftoC7AY= - =Fxot - -----END PGP MESSAGE----- - fp: 5DA93D5C9D7320E1BD3522C79C78172B3551C9FD - - created_at: "2026-02-17T22:22:03Z" - enc: |- - -----BEGIN PGP MESSAGE----- - - hQIMA46L6MuPqfJqARAAnZq75P7GPcuBCBLUOVPK8w1IBxd4XzoEWW3+T80bFTZE - ZjPAvfiGcOqIfc8CPzpS1drviWiRkuEV4EKCuDmX9GReI0SUlvaoiddUA9V62f4b - akBrzqR0nNnWWvjph4/5PRAQO+xO4wQy2r9thCw4oej3QgvKtLRRRY35TkGqlS0t - ej4d80KaqGGsfIPQ5L9f+lqarrKvYx3DMK6CujN13Kot44Uom4L5TeIdPSAW14jS - 13fa/I1Irq56ME9kNctsuAkRkhrW+KchFJqkYXSS82SbXUDDNcVA7knXSzxVR+iU - NJXb8bQO4Ymi8sWPWKHW/GXUkReiTLl8MkLi+mCwL7qo5fMQcBg/KWo0hReQYCj3 - G9DZPs3xWYFcwcmrSV86LSqjMt5g8ZKjPm6ODQcZVA/ZsGlmdTkjsWNn6WRZI55m - 8kkg7BoRMq7p6b15tW4e/w2rr/bTmGQ9dV03KIpmBG6+OUzwgfB2/w2dGmB7Vor6 - JMzvt+1I/PSHsCC/7GurTurAP63x8NO/9HYX2Qg0qzsOusnTKrCoo4lX/tA5YfIt - OKr6zqy8s5Dv/lGUhofkJrhHr/QTRHFVrFtPNn4yfSzo+8uhomHGsmxBGOOiY83L - 3zwYm+9BlzO/ve7PIvs54hIHQaKsP9Ktsgq/+dM7PVlIb5qfwGNvgoS2QXFqCF/S - XgHWy41J0zTGoyEpooGkheVKvgEPvv6YIlm9oTucYP03AkKWxBr9MTNq/+JcLRvw - Zey10uVJnYPUuH2b9f8N8lNBZlkQCBq/AEu0MsygsK8bcVfQL1Qs58xh1uA7gL8= - =wduB - -----END PGP MESSAGE----- - fp: 8996B62CBD159DCADD3B6DC08BB33A8ABCF7BC4A - - created_at: "2026-02-17T22:22:03Z" - enc: |- - -----BEGIN PGP MESSAGE----- - - hF4DQrf1tCqiJxoSAQdA4Y8j9A4ECAds0oJlP50Td1HpYIhywjXKi+pT7CTPXQ8w - 95+hUucTE8WQO/9u4HV2Y2nuyQPwmaYK0iGbNV3YxgI3Zdtf1T680hQxT4y55E1/ - 0l4B+70h9ojiHZkpVKVmFFZdY+tS/jQIFIRxqTW1AAfDf+chO3sUxbRe2qZhOXoY - b/QKU11wFpmOZmzznurOoxkqdNgGNcFm9+Ntb4ZSLSYzx7wrjzmWsaTdFd+coO1j - =V+rP - -----END PGP MESSAGE----- - fp: B71138A6A8964A3C3B8899857B4F70C356765BAB - unencrypted_suffix: _unencrypted - version: 3.8.1 diff --git a/config/hosts/woodpecker/sops.nix b/config/hosts/woodpecker/sops.nix deleted file mode 100644 index b4548ed..0000000 --- a/config/hosts/woodpecker/sops.nix +++ /dev/null @@ -1,7 +0,0 @@ -{ ... }: - -{ - sops = { - defaultSopsFile = ./secrets.yaml; - }; -} diff --git a/config/hosts/woodpecker/woodpecker-agent/default.nix b/config/hosts/woodpecker/woodpecker-agent/default.nix deleted file mode 100644 index 279d2bb..0000000 --- a/config/hosts/woodpecker/woodpecker-agent/default.nix +++ /dev/null @@ -1,8 +0,0 @@ -{ config, pkgs, ... }: - -{ - imports = [ - ./docker.nix - ./woodpecker-agent.nix - ]; -} diff --git a/config/hosts/woodpecker/woodpecker-agent/docker.nix b/config/hosts/woodpecker/woodpecker-agent/docker.nix deleted file mode 100644 index af13f4c..0000000 --- a/config/hosts/woodpecker/woodpecker-agent/docker.nix +++ /dev/null @@ -1,12 +0,0 @@ -# Sources for this configuration: -# - https://woodpecker-ci.org/docs/administration/deployment/nixos -# - https://woodpecker-ci.org/docs/administration/backends/docker -# - https://nixos.wiki/wiki/Docker - -{ config, pkgs, ... }: - -{ - virtualisation.docker = { - enable = true; - }; -} diff --git a/config/hosts/woodpecker/woodpecker-agent/woodpecker-agent.nix b/config/hosts/woodpecker/woodpecker-agent/woodpecker-agent.nix deleted file mode 100644 index 8c6847b..0000000 --- a/config/hosts/woodpecker/woodpecker-agent/woodpecker-agent.nix +++ /dev/null @@ -1,29 +0,0 @@ -# Sources for this configuration: -# - https://woodpecker-ci.org/docs/administration/deployment/nixos -# - https://woodpecker-ci.org/docs/administration/agent-config -# - https://woodpecker-ci.org/docs/administration/backends/docker - -{ config, pkgs, ... }: - -{ - services.woodpecker-agents.agents."docker" = { - enable = true; - package = pkgs.woodpecker-agent; - extraGroups = [ "docker" ]; - environment = { - WOODPECKER_SERVER = "localhost${config.services.woodpecker-server.environment.WOODPECKER_GRPC_ADDR}"; - WOODPECKER_MAX_WORKFLOWS = "4"; - WOODPECKER_BACKEND = "docker"; - # Set via enviornmentFile: - # WOODPECKER_AGENT_SECRET - }; - environmentFile = [ "/run/secrets/woodpecker_agent_environment_file" ]; - }; - - sops.secrets."woodpecker_agent_environment_file" = { - mode = "0440"; - owner = "root"; - group = "root"; - restartUnits = [ "woodpecker-agent-docker.service" ]; - }; -} diff --git a/config/hosts/woodpecker/woodpecker-server/default.nix b/config/hosts/woodpecker/woodpecker-server/default.nix deleted file mode 100644 index a713746..0000000 --- a/config/hosts/woodpecker/woodpecker-server/default.nix +++ /dev/null @@ -1,9 +0,0 @@ -{ config, pkgs, ... }: - -{ - imports = [ - ./nginx.nix - ./postgresql.nix - ./woodpecker-server.nix - ]; -} diff --git a/config/hosts/woodpecker/woodpecker-server/nginx.nix b/config/hosts/woodpecker/woodpecker-server/nginx.nix deleted file mode 100644 index 962183c..0000000 --- a/config/hosts/woodpecker/woodpecker-server/nginx.nix +++ /dev/null @@ -1,57 +0,0 @@ -# Sources for this configuration: -# - https://woodpecker-ci.org/docs/administration/deployment/nixos -# - https://woodpecker-ci.org/docs/administration/proxy - -{ config, pkgs, ... }: - -{ - services.nginx = { - enable = true; - - virtualHosts."acme-woodpecker.hamburg.ccc.de" = { - default = true; - enableACME = true; - serverName = "woodpecker.hamburg.ccc.de"; - - listen = [ - { - addr = "0.0.0.0"; - port = 31820; - } - ]; - }; - - virtualHosts."woodpecker.hamburg.ccc.de" = { - default = true; - forceSSL = true; - useACMEHost = "woodpecker.hamburg.ccc.de"; - - listen = [ - { - addr = "0.0.0.0"; - port = 8443; - ssl = true; - proxyProtocol = true; - } - ]; - - locations."/" = { - proxyPass = "http://localhost${config.services.woodpecker-server.environment.WOODPECKER_SERVER_ADDR}"; - }; - - extraConfig = '' - # Make use of the ngx_http_realip_module to set the $remote_addr and - # $remote_port to the client address and client port, when using proxy - # protocol. - # First set our proxy protocol proxy as trusted. - set_real_ip_from 172.31.17.140; - # Then tell the realip_module to get the addreses from the proxy protocol - # header. - real_ip_header proxy_protocol; - ''; - }; - }; - - networking.firewall.allowedTCPPorts = [ 8443 31820 ]; - networking.firewall.allowedUDPPorts = [ 8443 ]; -} diff --git a/config/hosts/woodpecker/woodpecker-server/postgresql.nix b/config/hosts/woodpecker/woodpecker-server/postgresql.nix deleted file mode 100644 index e715650..0000000 --- a/config/hosts/woodpecker/woodpecker-server/postgresql.nix +++ /dev/null @@ -1,18 +0,0 @@ -# Sources for this configuration: -# - https://github.com/NixOS/nixpkgs/blob/dce84c46d780b20c064d5dfb10d0686e0584a198/nixos/modules/services/web-apps/nextcloud.nix#L1069 - -{ config, pkgs, ... }: - -{ - services.postgresql = { - enable = true; - package = pkgs.postgresql_15; - ensureDatabases = [ "woodpecker-server" ]; - ensureUsers = [ - { - name = "woodpecker-server"; - ensureDBOwnership = true; - } - ]; - }; -} diff --git a/config/hosts/woodpecker/woodpecker-server/woodpecker-server.nix b/config/hosts/woodpecker/woodpecker-server/woodpecker-server.nix deleted file mode 100644 index 1836b73..0000000 --- a/config/hosts/woodpecker/woodpecker-server/woodpecker-server.nix +++ /dev/null @@ -1,44 +0,0 @@ -# Sources for this configuration: -# - https://woodpecker-ci.org/docs/administration/deployment/nixos -# - https://woodpecker-ci.org/docs/administration/server-config -# - https://woodpecker-ci.org/docs/administration/database -# - https://woodpecker-ci.org/docs/administration/forges/forgejo -# - https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-CONNSTRING - -{ config, pkgs, ... }: - -{ - services.woodpecker-server = { - enable = true; - package = pkgs.woodpecker-server; - environment = { - WOODPECKER_HOST = "https://woodpecker.hamburg.ccc.de"; - WOODPECKER_SERVER_ADDR = ":8001"; - WOODPECKER_GRPC_ADDR = ":9000"; - WOODPECKER_ADMIN = "june"; - WOODPECKER_OPEN = "true"; - WOODPECKER_ORGS = "CCCHH"; - WOODPECKER_DATABASE_DRIVER = "postgres"; - WOODPECKER_DATABASE_DATASOURCE = "postgresql://woodpecker-server@/woodpecker-server?host=/run/postgresql"; - WOODPECKER_FORGEJO = "true"; - WOODPECKER_FORGEJO_URL = "https://git.hamburg.ccc.de"; - WOODPECKER_LIMIT_MEM = "6442450944"; # 6GB - # Set via enviornmentFile: - # WOODPECKER_FORGEJO_CLIENT - # WOODPECKER_FORGEJO_SECRET - }; - environmentFile = [ "/run/secrets/woodpecker_server_environment_file" ]; - }; - - systemd.services.woodpecker-server.serviceConfig = { - User = "woodpecker-server"; - Group = "woodpecker-server"; - }; - - sops.secrets."woodpecker_server_environment_file" = { - mode = "0440"; - owner = "root"; - group = "root"; - restartUnits = [ "woodpecker-server.service" ]; - }; -} diff --git a/flake.nix b/flake.nix index 3b28ef2..f16409b 100644 --- a/flake.nix +++ b/flake.nix @@ -159,17 +159,6 @@ ]; }; - woodpecker = nixpkgs.lib.nixosSystem { - inherit system specialArgs; - modules = [ - self.nixosModules.common - self.nixosModules.proxmox-vm - sops-nix.nixosModules.sops - self.nixosModules.prometheus-exporter - ./config/hosts/woodpecker - ]; - }; - penpot = nixpkgs.lib.nixosSystem { inherit system specialArgs; modules = [ From 9258f15343f2a5f27e763e7d24fc902d456c58eb Mon Sep 17 00:00:00 2001 From: June Date: Mon, 18 May 2026 22:04:57 +0200 Subject: [PATCH 11/34] deploy infra-docs and infra-docs staging on public-web-static --- .../virtualHosts/default.nix | 2 + .../infra-docs.hamburg.ccc.de.nix | 73 +++++++++++++++++++ .../staging.infra-docs.hamburg.ccc.de.nix | 72 ++++++++++++++++++ 3 files changed, 147 insertions(+) create mode 100644 config/hosts/public-web-static/virtualHosts/infra-docs.hamburg.ccc.de.nix create mode 100644 config/hosts/public-web-static/virtualHosts/staging.infra-docs.hamburg.ccc.de.nix diff --git a/config/hosts/public-web-static/virtualHosts/default.nix b/config/hosts/public-web-static/virtualHosts/default.nix index 404ca35..d1c1355 100644 --- a/config/hosts/public-web-static/virtualHosts/default.nix +++ b/config/hosts/public-web-static/virtualHosts/default.nix @@ -13,6 +13,7 @@ ./hacker.tours.nix ./hackertours.hamburg.ccc.de.nix ./hamburg.ccc.de.nix + ./infra-docs.hamburg.ccc.de.nix ./spaceapi.hamburg.ccc.de.nix ./staging.c3cat.de.nix ./staging.c3dog.de.nix @@ -21,6 +22,7 @@ ./staging.hacker.tours.nix ./staging.hackertours.hamburg.ccc.de.nix ./staging.hamburg.ccc.de.nix + ./staging.infra-docs.hamburg.ccc.de.nix ./www.hamburg.ccc.de.nix ./diday.org.nix ./staging.diday.org.nix diff --git a/config/hosts/public-web-static/virtualHosts/infra-docs.hamburg.ccc.de.nix b/config/hosts/public-web-static/virtualHosts/infra-docs.hamburg.ccc.de.nix new file mode 100644 index 0000000..5bb565d --- /dev/null +++ b/config/hosts/public-web-static/virtualHosts/infra-docs.hamburg.ccc.de.nix @@ -0,0 +1,73 @@ +{ pkgs, ... }: + +let + domain = "infra-docs.hamburg.ccc.de"; + dataDir = "/var/www/${domain}"; + deployUser = "infra-docs-deploy"; +in { + services.nginx.virtualHosts = { + "acme-${domain}" = { + enableACME = true; + serverName = "${domain}"; + + listen = [ + { + addr = "[::]"; + port = 31820; + } + { + addr = "0.0.0.0"; + port = 31820; + } + ]; + }; + + "${domain}" = { + forceSSL = true; + useACMEHost = "${domain}"; + + listen = [ + { + addr = "[::]"; + port = 8443; + ssl = true; + proxyProtocol = true; + } + { + addr = "0.0.0.0"; + port = 8443; + ssl = true; + proxyProtocol = true; + } + ]; + + root = "${dataDir}"; + + extraConfig = '' + # Make use of the ngx_http_realip_module to set the $remote_addr and + # $remote_port to the client address and client port, when using proxy + # protocol. + # First set our proxy protocol proxy as trusted. + set_real_ip_from 172.31.17.140; + # Then tell the realip_module to get the addreses from the proxy protocol + # header. + real_ip_header proxy_protocol; + + port_in_redirect off; + ''; + }; + }; + + systemd.tmpfiles.rules = [ + "d ${dataDir} 0755 ${deployUser} ${deployUser}" + ]; + + users.users."${deployUser}" = { + isNormalUser = true; + group = "${deployUser}"; + openssh.authorizedKeys.keys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINfwfy9f3R/tDOiUeG5DA9oIGDDEAP270MqFG3V1P11L deploy key for infra-docs" + ]; + }; + users.groups."${deployUser}" = { }; +} diff --git a/config/hosts/public-web-static/virtualHosts/staging.infra-docs.hamburg.ccc.de.nix b/config/hosts/public-web-static/virtualHosts/staging.infra-docs.hamburg.ccc.de.nix new file mode 100644 index 0000000..7ed3d69 --- /dev/null +++ b/config/hosts/public-web-static/virtualHosts/staging.infra-docs.hamburg.ccc.de.nix @@ -0,0 +1,72 @@ +{ pkgs, ... }: + +let + domain = "staging.infra-docs.hamburg.ccc.de"; + dataDir = "/var/www/${domain}"; + deployUser = "infra-docs-deploy"; +in { + services.nginx.virtualHosts = { + "acme-${domain}" = { + enableACME = true; + serverName = "${domain}"; + + listen = [ + { + addr = "[::]"; + port = 31820; + } + { + addr = "0.0.0.0"; + port = 31820; + } + ]; + }; + + "${domain}" = { + forceSSL = true; + useACMEHost = "${domain}"; + + listen = [ + { + addr = "[::]"; + port = 8443; + ssl = true; + proxyProtocol = true; + } + { + addr = "0.0.0.0"; + port = 8443; + ssl = true; + proxyProtocol = true; + } + ]; + + root = "${dataDir}"; + + # Disallow *, since this is staging and doesn't need to be in any search + # results. + locations."/robots.txt" = { + return = "200 \"User-agent: *\\nDisallow: *\\n\""; + }; + + extraConfig = '' + # Make use of the ngx_http_realip_module to set the $remote_addr and + # $remote_port to the client address and client port, when using proxy + # protocol. + # First set our proxy protocol proxy as trusted. + set_real_ip_from 172.31.17.140; + # Then tell the realip_module to get the addreses from the proxy protocol + # header. + real_ip_header proxy_protocol; + + port_in_redirect off; + ''; + }; + }; + + systemd.tmpfiles.rules = [ + "d ${dataDir} 0755 ${deployUser} ${deployUser}" + ]; + + # infra-docs deploy user already defined in infra-docs.hamburg.ccc.de.nix. +} From 9d3945e1892caaaaee65337a0e3c0d5996c73e5c Mon Sep 17 00:00:00 2001 From: June Date: Mon, 25 May 2026 02:30:12 +0200 Subject: [PATCH 12/34] hamburg.ccc.de: redirect old no olympia url to new one for compatibility --- .../public-web-static/virtualHosts/hamburg.ccc.de.nix | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/config/hosts/public-web-static/virtualHosts/hamburg.ccc.de.nix b/config/hosts/public-web-static/virtualHosts/hamburg.ccc.de.nix index abbf5aa..8b2177c 100644 --- a/config/hosts/public-web-static/virtualHosts/hamburg.ccc.de.nix +++ b/config/hosts/public-web-static/virtualHosts/hamburg.ccc.de.nix @@ -99,6 +99,14 @@ return = "302 https://cloud.hamburg.ccc.de/apps/calendar/embed/QJAdExziSnNJEz5g"; }; + # Redirects for blog post edits. + locations."/blog/2026/05/23/der-ccchh-sagt-nein-zu-olympia-in-hamburg" = { + return = "302 https://hamburg.ccc.de/blog/2026/05/31/der-ccchh-sagt-nein-zu-olympia-in-hamburg/"; + }; + locations."/blog/2026/05/23/der-ccchh-sagt-nein-zu-olympia-in-hamburg/" = { + return = "302 https://hamburg.ccc.de/blog/2026/05/31/der-ccchh-sagt-nein-zu-olympia-in-hamburg/"; + }; + extraConfig = '' # Make use of the ngx_http_realip_module to set the $remote_addr and # $remote_port to the client address and client port, when using proxy From 9a9f1c774c59d29259224e5f3e842767e8d8cbc7 Mon Sep 17 00:00:00 2001 From: June Date: Wed, 27 May 2026 18:52:21 +0200 Subject: [PATCH 13/34] diday.org: remove (not-working) did.hamburg.ccc.de extra domain name --- .../virtualHosts/diday.org.nix | 28 ------------------- 1 file changed, 28 deletions(-) diff --git a/config/hosts/public-web-static/virtualHosts/diday.org.nix b/config/hosts/public-web-static/virtualHosts/diday.org.nix index d9f3b31..3aff479 100644 --- a/config/hosts/public-web-static/virtualHosts/diday.org.nix +++ b/config/hosts/public-web-static/virtualHosts/diday.org.nix @@ -6,10 +6,6 @@ let deployUser = "diday-website-deploy"; in { - security.acme.certs."${domain}".extraDomainNames = [ - "did.hamburg.ccc.de" - ]; - services.nginx.virtualHosts = { "acme-${domain}" = { enableACME = true; @@ -27,30 +23,6 @@ in ]; }; - "did.hamburg.ccc.de" = { - forceSSL = true; - useACMEHost = "${domain}"; - - listen = [ - { - addr = "[::]"; - port = 8443; - ssl = true; - proxyProtocol = true; - } - { - addr = "0.0.0.0"; - port = 8443; - ssl = true; - proxyProtocol = true; - } - ]; - - extraConfig = '' - return 301 https://diday.org; - ''; - }; - "${domain}" = { forceSSL = true; useACMEHost = "${domain}"; From 121dd0a1ec96947e2a97c7bb7ebdb63f51d514c2 Mon Sep 17 00:00:00 2001 From: lilly Date: Tue, 9 Jun 2026 21:42:26 +0200 Subject: [PATCH 14/34] add ueberwachungs-frei kundgebung site --- .../virtualHosts/default.nix | 1 + .../ueberwachungsfrei-kundgebung.nix | 77 +++++++++++++++++++ 2 files changed, 78 insertions(+) create mode 100644 config/hosts/public-web-static/virtualHosts/ueberwachungsfrei-kundgebung.nix diff --git a/config/hosts/public-web-static/virtualHosts/default.nix b/config/hosts/public-web-static/virtualHosts/default.nix index d1c1355..61008d2 100644 --- a/config/hosts/public-web-static/virtualHosts/default.nix +++ b/config/hosts/public-web-static/virtualHosts/default.nix @@ -27,5 +27,6 @@ ./diday.org.nix ./staging.diday.org.nix ./historic-easterhegg + ./ueberwachungsfrei-kundgebung.nix ]; } diff --git a/config/hosts/public-web-static/virtualHosts/ueberwachungsfrei-kundgebung.nix b/config/hosts/public-web-static/virtualHosts/ueberwachungsfrei-kundgebung.nix new file mode 100644 index 0000000..ddc5182 --- /dev/null +++ b/config/hosts/public-web-static/virtualHosts/ueberwachungsfrei-kundgebung.nix @@ -0,0 +1,77 @@ +{ pkgs, ... }: + +let + domain = "ueberwachungsfrei-kundgebung.hamburg.ccc.de"; + dataDir = "/var/www/${domain}"; + deployUser = "ueberwachungsfrei-deploy"; +in { + # TODO: Add proper domain once that is available + security.acme.certs."${domain}".extraDomainNames = [ ]; + + services.nginx.virtualHosts = { + "acme-${domain}" = { + enableACME = true; + serverName = "${domain}"; + serverAliases = [ + # TODO: Add proper domains here too + ]; + + listen = [ + { + addr = "[::]"; + port = 31820; + } + { + addr = "0.0.0.0"; + port = 31820; + } + ]; + }; + + "${domain}" = { + forceSSL = true; + useACMEHost = "${domain}"; + + listen = [ + { + addr = "[::]"; + port = 8443; + ssl = true; + proxyProtocol = true; + } + { + addr = "0.0.0.0"; + port = 8443; + ssl = true; + proxyProtocol = true; + } + ]; + + root = "${dataDir}"; + + extraConfig = '' + # Make use of the ngx_http_realip_module to set the $remote_addr and + # $remote_port to the client address and client port, when using proxy + # protocol. + # First set our proxy protocol proxy as trusted. + set_real_ip_from 172.31.17.140; + # Then tell the realip_module to get the addreses from the proxy protocol + # header. + real_ip_header proxy_protocol; + ''; + }; + }; + + systemd.tmpfiles.rules = [ + "d ${dataDir} 0755 ${deployUser} ${deployUser}" + ]; + + users.users."${deployUser}" = { + isNormalUser = true; + group = "${deployUser}"; + openssh.authorizedKeys.keys = [ + # TODO: Maybe add a deploy key if we want CI/CD + ]; + }; + users.groups."${deployUser}" = { }; +} From 0f22b1158ecbac1c6977e7729addaf637b2b34da Mon Sep 17 00:00:00 2001 From: lilly Date: Thu, 11 Jun 2026 14:45:19 +0200 Subject: [PATCH 15/34] move ueberwachungsfrei kundgebung page to own domain --- .../virtualHosts/ueberwachungsfrei-kundgebung.nix | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/config/hosts/public-web-static/virtualHosts/ueberwachungsfrei-kundgebung.nix b/config/hosts/public-web-static/virtualHosts/ueberwachungsfrei-kundgebung.nix index ddc5182..ce87788 100644 --- a/config/hosts/public-web-static/virtualHosts/ueberwachungsfrei-kundgebung.nix +++ b/config/hosts/public-web-static/virtualHosts/ueberwachungsfrei-kundgebung.nix @@ -1,19 +1,20 @@ { pkgs, ... }: let - domain = "ueberwachungsfrei-kundgebung.hamburg.ccc.de"; + domain = "ueberwachungsfrei.eu"; dataDir = "/var/www/${domain}"; deployUser = "ueberwachungsfrei-deploy"; in { - # TODO: Add proper domain once that is available - security.acme.certs."${domain}".extraDomainNames = [ ]; + security.acme.certs."${domain}".extraDomainNames = [ + "xn--berwachungsfrei-yvb.eu" + ]; services.nginx.virtualHosts = { "acme-${domain}" = { enableACME = true; serverName = "${domain}"; serverAliases = [ - # TODO: Add proper domains here too + "xn--berwachungsfrei-yvb.eu" ]; listen = [ @@ -31,6 +32,10 @@ in { "${domain}" = { forceSSL = true; useACMEHost = "${domain}"; + serverAliases = [ + "überwachungsfrei.eu" + "xn--berwachungsfrei-yvb.eu" + ]; listen = [ { From 8d41dcf7ca3e4e4bccce9c3045bc95f6ff6e2b70 Mon Sep 17 00:00:00 2001 From: June Date: Fri, 3 Jul 2026 04:10:27 +0200 Subject: [PATCH 16/34] remove forgejo-actions-runner (replaced by ansible-infra host) --- .../forgejo-actions-runner/configuration.nix | 10 -- .../hosts/forgejo-actions-runner/default.nix | 11 -- .../hosts/forgejo-actions-runner/docker.nix | 16 -- .../forgejo-actions-runner.nix | 66 -------- .../forgejo-actions-runner/networking.nix | 27 ---- .../hosts/forgejo-actions-runner/secrets.yaml | 149 ------------------ config/hosts/forgejo-actions-runner/sops.nix | 7 - flake.nix | 14 -- 8 files changed, 300 deletions(-) delete mode 100644 config/hosts/forgejo-actions-runner/configuration.nix delete mode 100644 config/hosts/forgejo-actions-runner/default.nix delete mode 100644 config/hosts/forgejo-actions-runner/docker.nix delete mode 100644 config/hosts/forgejo-actions-runner/forgejo-actions-runner.nix delete mode 100644 config/hosts/forgejo-actions-runner/networking.nix delete mode 100644 config/hosts/forgejo-actions-runner/secrets.yaml delete mode 100644 config/hosts/forgejo-actions-runner/sops.nix diff --git a/config/hosts/forgejo-actions-runner/configuration.nix b/config/hosts/forgejo-actions-runner/configuration.nix deleted file mode 100644 index 713e795..0000000 --- a/config/hosts/forgejo-actions-runner/configuration.nix +++ /dev/null @@ -1,10 +0,0 @@ -{ config, pkgs, ... }: - -{ - networking = { - hostName = "forgejo-actions-runner"; - domain = "hosts.hamburg.ccc.de"; - }; - - system.stateVersion = "23.11"; -} diff --git a/config/hosts/forgejo-actions-runner/default.nix b/config/hosts/forgejo-actions-runner/default.nix deleted file mode 100644 index f5a8ddd..0000000 --- a/config/hosts/forgejo-actions-runner/default.nix +++ /dev/null @@ -1,11 +0,0 @@ -{ ... }: - -{ - imports = [ - ./configuration.nix - ./docker.nix - ./forgejo-actions-runner.nix - ./networking.nix - ./sops.nix - ]; -} diff --git a/config/hosts/forgejo-actions-runner/docker.nix b/config/hosts/forgejo-actions-runner/docker.nix deleted file mode 100644 index 043f272..0000000 --- a/config/hosts/forgejo-actions-runner/docker.nix +++ /dev/null @@ -1,16 +0,0 @@ -# Sources for this configuration: -# - https://nixos.wiki/wiki/Docker -{ config, pkgs, ... }: - -{ - virtualisation.docker = { - enable = true; - autoPrune = { - enable = true; - dates = "weekly"; - }; - daemon.settings = { - ipv6 = true; - }; - }; -} diff --git a/config/hosts/forgejo-actions-runner/forgejo-actions-runner.nix b/config/hosts/forgejo-actions-runner/forgejo-actions-runner.nix deleted file mode 100644 index 2efeefe..0000000 --- a/config/hosts/forgejo-actions-runner/forgejo-actions-runner.nix +++ /dev/null @@ -1,66 +0,0 @@ -# Sources for this configuration: -# - https://forgejo.org/docs/latest/admin/actions/ -# - https://forgejo.org/docs/latest/user/actions/ -# - https://docs.gitea.com/next/usage/actions/act-runner - -{ config, pkgs, ... }: - -{ - services.gitea-actions-runner = { - package = pkgs.forgejo-runner; - instances.ccchh-forgejo-global-docker = { - enable = true; - name = "Global Docker Forgejo Actions Runner"; - url = "https://git.hamburg.ccc.de/"; - tokenFile = "/run/secrets/forgejo_actions_runner_registration_token"; - labels = [ "docker:docker://node:current-bookworm" ]; - settings = { - container = { - enable_ipv6 = true; - }; - cache = { - proxy_port = 45540; - }; - runner = { - capacity = 4; - }; - }; - }; - - instances.ccchh-codeberg-org-diday = { - enable = true; - name = "ccchh runner for codeberg.org/di-day"; - url = "https://codeberg.org/"; - tokenFile = "/run/secrets/codeberg_org_diday_runner_registration_token"; - labels = [ - "docker:docker://node:current-bookworm" - "debian-latest:docker://node:current-bookworm" - "alpine-latest:docker://node:current-alpine" - ]; - settings = { - container = { - enable_ipv6 = true; - }; - cache = { - proxy_port = 45541; - }; - runner = { - capacity = 4; - }; - }; - }; - }; - - sops.secrets."forgejo_actions_runner_registration_token" = { - mode = "0440"; - owner = "root"; - group = "root"; - restartUnits = [ "gitea-runner-ccchh\\x2dforgejo\\x2dglobal\\x2ddocker.service" ]; - }; - sops.secrets."codeberg_org_diday_runner_registration_token" = { - mode = "0440"; - owner = "root"; - group = "root"; - restartUnits = [ "gitea-runner-ccchh\\x2dcodeberg\\x2dorg\\x2ddiday.service" ]; - }; -} diff --git a/config/hosts/forgejo-actions-runner/networking.nix b/config/hosts/forgejo-actions-runner/networking.nix deleted file mode 100644 index 0c09eda..0000000 --- a/config/hosts/forgejo-actions-runner/networking.nix +++ /dev/null @@ -1,27 +0,0 @@ -{ lib, config, ... }: -let - runnerInstances = lib.attrValues config.services.gitea-actions-runner.instances; - runnerCachePorts = lib.map (i: i.settings.cache.proxy_port) runnerInstances; -in { - networking = { - interfaces.net0 = { - ipv6.addresses = [ - { - address = "2a00:14b0:42:102::18"; - prefixLength = 64; - } - ]; - }; - defaultGateway6 = "2a00:14b0:42:102::1"; - nameservers = [ "212.12.50.158" "192.76.134.90" ]; - search = [ "hamburg.ccc.de" ]; - }; - - systemd.network.links."10-net0" = { - matchConfig.MACAddress = "1E:E0:4E:D0:DA:BE"; - linkConfig.Name = "net0"; - }; - - # open ports for runner cache proxy so that we can use the cache action - networking.firewall.allowedTCPPorts = runnerCachePorts; -} diff --git a/config/hosts/forgejo-actions-runner/secrets.yaml b/config/hosts/forgejo-actions-runner/secrets.yaml deleted file mode 100644 index 79df4d5..0000000 --- a/config/hosts/forgejo-actions-runner/secrets.yaml +++ /dev/null @@ -1,149 +0,0 @@ -forgejo_actions_runner_registration_token: ENC[AES256_GCM,data:gAR2ffrffeuuaOwO6mWcif2e6csKIVoLqrux19iBlrTkFHgo/IlHVL0eSUGqnw==,iv:i12yx/quwT9kj6fPECszo/iG9cVhKX+7dAA6/N09URc=,tag:eO+mWhumgvWzQxYqiRUXbA==,type:str] -codeberg_org_diday_runner_registration_token: ENC[AES256_GCM,data:thTsLo/eXVPbXt4b8ldae+kGnOR4GbYKOqr1hVJgaL7wZ5GgqWSPcOuhow96Jw==,iv:Fzi+DsKj+4PrwQGEosUntm9l7s78NwzhkmF6e/sfF+s=,tag:oa7mnbGR0J5xi9ruCgRJtQ==,type:str] -sops: - age: - - recipient: age19h7xtfmt3py3ydgl8d8fgh8uakxqxjr74flrxev3pgmvvx94kvtq5d932d - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjZEpMZkt6OU5nMEtYcHc0 - OGdsVDZBcE5nK2ZLbDhaWEVMM2lJcllLVnlzCmNUTXpaVHBLMjlILzJwdDFLMVky - ZXdEVmE3aTFMZDJnQ2tqWGRMb1NnZUkKLS0tIDhGWGpoYWNtL24wRnVRejQ5ZkVN - YjZFMTh3OTNkOUE0SmZTQXpKSmdGWlEK+Xb6blAdiWoKvffLEQagu5tFpWALJaXm - F65M+RNNkJ/YsSJGAWFJepw3ncCMFbmQgGXw5XnyqTlYFhrQ8x5qJg== - -----END AGE ENCRYPTED FILE----- - - recipient: age10xz2l7ghul7023awcydf4q3wurmszy2tafnadlarj0tvm7kl033sjw5f8t - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQblJIdFAwOFRqbWEvQzVF - ODVpQ04xTVpxTERGU3BOMjV4KytBU21neEYwCmoraHhlNjhDelAzR0VxcVNlekhT - QkI5ckd1dVFjMHBoTVFTQjlzbTdnTzgKLS0tIGlTY1p0bWxrQWoyM0RwSmx1aDhy - TklLZWM0cDBKaGJJM2tQQWRLZXhFYU0Ko7cyvzMvwlGCCP3UAX1+5uTI4srhZ5l9 - DPaHySiC+rLy+8R9UqEuTKbP4/Aw4NZ/UcfjNnVkqqqNJIODmLoOhg== - -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-02-18T09:51:37Z" - mac: ENC[AES256_GCM,data:4fWsE3U6WxRqlKHKC4ipE+RQ7MPjiZZcTFMSblxty7JjJHAdKUHbthFB+R8gIWxZEjX5WG+IPgUP+AcCLSI9fdcXMqIFMuDun2hiktwqxzLPGYAoCXdTBAd1uCUagvB/rFty6y8umD4J5ITgEGba9pvGdUcng9WVRV+LGDftS1g=,iv:tD9tlcylQWapNCARxPXrKofZXf2BHTt2c4PQqFNj6X8=,tag:pQ8lOqJEFCcCcJot3BYTmQ==,type:str] - pgp: - - created_at: "2026-02-17T22:21:57Z" - enc: |- - -----BEGIN PGP MESSAGE----- - - hQIMAz5uSgHG2iMJAQ/7BFboCbCEG1DY5Twf+1cRSAmXs8CSrnoJcmyxrF9daqTB - GAqItZcym6I7YbtYMb33jTZDAMFcexvJ+V7+WVBK/v/TISzinJ3m5BafE0DrgsB5 - HQT8tsFzxIdu/KsUp0C5VQg6gsb2u2T7aFG0wTS4vas2FjcsoJRKNWTv7a1sNWYZ - dFRxeyklWEX14kCHeKIxO7+Qe3NVV+6MuwYR8X3YJaAyLtVMIdBp/poE+7Gcsa58 - rOewheWW/FROTxLZIk3sren6z7M0ZrOz5res2evRDMI9noN3pYMnkNCL/XIvRf9U - GqFSruzDoC0a2JcEvSmthSmEHA6wXeOY/EuzXKLoW4luZDsSXshFgBxK0qqGvzbd - jIXXYvBWPCMYWRMSqQenLkjfhOQXuSXcywGfKpuQblUL8RiflIqia2o68Vbd9Hq4 - x9Od+qkauMHZUzsKQoym9pkbrEWpjckg6FevZ1W4o5Qhe9i+JMmE2KIvoYH8tK9F - 5KQ87jktx4i9df9TJy3n/xbbrWXpo76y5Aoa2LaiD9Nc6lo7sFs3Pegq4wKmYSIh - 6uaZxa5sto/5kywHrJQGqEyh/fDdNmsh5FlDW7gfFEm9Ti2KSE3m9IvIwppFD4j0 - xFkHiwHvNn/WMLciVh9qG8auGyxjoXnRRx61QHF31RIYprxWgDoyH/rVz95IuxzS - XgEIJk7MnHv9tYCy/lOjbgqLAUGO0+xuO+IfmsvtiD4nfrnaEJAh0+SW3wuCKzaF - tx1ZHCYH9j3s50Q624pUgtzDad5QV5IIEgCRyr0NvEvrXvG6U0aXkOEbOcFSZsk= - =v3FY - -----END PGP MESSAGE----- - fp: 18DFCE01456DAB52EA38A6584EDC64F35FA1D6A5 - - created_at: "2026-02-17T22:21:57Z" - enc: |- - -----BEGIN PGP MESSAGE----- - - hQIMAw5vwmoEJHQ1AQ/9H+Kn4rF7yUsIdTp5rYhG6EkYkJ/jCeUBJvaOuA95b8HM - 6csTXj+ttVcFvbU1hQVbOsd7J8Wpmuj/TqMrpFvu/0EYUW5n04y1YI8kpNXDMrFF - X/0gk+I+w2eF2X3gJQasVY39DNx56KSRJ0BwGYw287rdeKh8cbiFw64r0rs6zX5j - 2nqrWgSqxXtWcjhC7Y4Rq8ysWv7dEF2E9Tt2cHYVjn5cs9Vb52PWUA0TxzBzUUqa - M1YWat3fwLah6qEs6/9c89LB66SbgH088lEzQHtRIXdOZ9tPOu7/E3iNqYExuIKB - eMV0bdW0/tZlnWxAwXrL4rptxjGDqB+Ynv36IeLKZ86ljqSPqaQA7ihCVXnMo2TW - IfdlbOtAJiE3IliQf8C1Ajyn32epePBAUyw8o0k2D6UyNyvk8fe0z9++H6Uz+Z7G - oLRrxzOHjh6oWK9WBwJQhZ9dnb1n1UYZfvCDwFZBTmUkhIs6UQllIiF5ZjMy4/cc - E3FEouu/6VPPjq9d8pGEFcjOvXkLtUErhXP+A8Xvl/fHmtfM0/o1e6gPnMmxGn4k - 0yXvU+pNO/ID6fc6qMs0nBZRAKGraaeH+wTjpm1exUhhNB2yJviySnElJFyq9vtr - AfacrbuW//JQ+19rSKViV9xStRG//xfW7EpknOh3juB7WfnyOXqdfZqT2zQwrvjS - XgEoHXmbR7aiDvBCc4CGTmBhWD4An+p3m3m7iSOp27kBqJ3+YSKdVA7mdIo0tpTn - 9p5Pgz6GHBA5eMwZCb/z3Y7+20PuuEb4/tEBAniw9/Rp0sDJ+9C+V1SdHtbYq8k= - =kkQW - -----END PGP MESSAGE----- - fp: 87AB00D45D37C9E9167B5A5A333448678B60E505 - - created_at: "2026-02-17T22:21:57Z" - enc: |- - -----BEGIN PGP MESSAGE----- - - hF4DerEtaFuTeewSAQdAdgME/v0CVfcRZ1zr9SRZksN7vDHDk63g+5k5a/FOvmow - 0l/6kH1l7p4aOKaAGFbMHzDzljuACB1a4IOJypRA2DokYWRUgqBKwvcHplgXr4l0 - 0l4B2vxPl9W1kcbAg4m+V4PlvXTBGhPUglljtjWy80TisUL1zCXpl3PEvmrypZs7 - NM47K09RsDiicwTKjxd0Oii2Evz8riLFIth8IWOKXPHoKhiYwN891g1qLSvsrDzE - =6B/b - -----END PGP MESSAGE----- - fp: 057870A2C72CD82566A3EC983695F4FCBCAE4912 - - created_at: "2026-02-17T22:21:57Z" - enc: |- - -----BEGIN PGP MESSAGE----- - - hQIMAxjNhCKPP69fARAAjz8RObyKYVAmNwiBsNVNGt0qSIexSYpsMR5SyuBMKShJ - NSD4yA6B7Tj+h/ik4VyggOT+9Qfr7zFvFyEHYFXI7k/r+Noyw4uscqr9gNnz0t9N - rx4/ZNowsW/3dL+Gab3hjDKObHF41Y1lzojNwcieU8qZmssHZMjIIzyAUePL210f - 2i87hix9PkK6kKuisORDShnFifEOEPOcijXFL4kH9DilVoZ0Ut5fJoiA+QkQQpaa - uHd+Q7F6u9jZrzRLN1SJkb76ElxQAvJYcgTN2s3+c4002DkKVdwCW0qyPlF9wOxT - xTngl46NyZ1MH3ByW2xeOgaDYUcBt8qUF4gTMmIaDTIZ+K5XWGu3hmCzNZHD5Nxi - bhVKJ8jGENUhM/IfT8CjppRIg5wwU0K/EQE/QQHhIykpz9NaIjikDCxcraBa9DkA - rgjp74W9vgR3pBwXJIAsylOZZHy+35rca/JvWWxm2tdeao2WxTA9jdsNdsUOhNyz - 3xQGGM63ZSUcV0ZgCyhEYeKBzCyRWpFX+GQHboZDp7IaYK68qYZgxnQtoSwl3lJR - Qc1IaADnncIDyGEIDTciLbjbDx7TId4wrpRWUPxVY2FVY+hV+oRNaoYMuT2jiDVw - PimQ5iVUhl/ThHWPLqok6d3ypROZtVS6EUFzd4ASUrYRYB5Twvoujr7Yg7jSZV/S - XgFcxQ31/i/Vi9owjwX7u0/eclU/3XE2/MqUCcoMntnq2dCN/IpF3rROit5Tzs+W - BT7i57cpGh9ZXf1dbNSyRwydp/C8tjnwDqf3RJ5hj4fmlK6zLJqtPFPdusOO4SU= - =z1tc - -----END PGP MESSAGE----- - fp: F38C9D4228FC6F674E322D9C3326D914EB9B8F55 - - created_at: "2026-02-17T22:21:57Z" - enc: |- - -----BEGIN PGP MESSAGE----- - - hQIMA1Hthzn+T1OoAQ/+K1+QTZ8N3Ha0nErrRWClBu5Cxec5/eb2Q/n4dfNGkrxx - xBk0thoGAyoYpifSqhXbVi/MA8+tzHdtPlKJFCn5NETrnEdu84+sJQE4zfDljLiX - fXZZ/+YQ0P3VosR2NI3W1r/hJWs4oJ9oPz4FfMlfPK+/UOOdQEtGkx9rjYaus9Ax - VI6s5qvYM6XD5rkLxTqZZhEa+CjLtSjD5WqNbCT/8fX5ErnU06jW6jXvRNQSq1Mt - hpqMIBygUE39K2apEuphE9RRD3bS1M2VjCB882yVSM2QZyepilRBjS5ryyQhKK/9 - Q0mdIw9mxhdgaCzoglN2k1c6WjddZ409osdnYcMtsH4+NlHDtNfSFLIk6JrxAXIQ - bNR8gtr4D85LoQki/RvEweUd4M40DneIO1dTK4/WG71Lcle3B6p0ynDMjmXq1coY - Qn0c4KAh1RIX/eEJGS23Wle/XZbp89yaFFEF667+HmwL0CY6I5pcVEn/iuXLoNHI - 93y/9h7mhB8ZGICPbF7nXBfQQTrxjfc9vZq0PVdjlXPIMRjZcbZOzlKByYLsQIW0 - UtzLScfFyKsogcUGJIlGrcQyAmLb3dr7i1elVWlanggCXdKnecBRbSkEfK7SmwiN - t8hRaaM06P3kRbTHWxt+4sjTQWofo+C76qsMZYHFpI0TTOP/jwnn/h3E9dQxdaHS - XgHzVEsJkQiQ51w7pPP1LcKkCxQv1KA9QC+LAFGhmWXnQ1m8E3whao2S07UjlTVw - XMAtuOVT2r09dYGgpcEaMiK2Hb9UNg/ma9o29fSm+2rLuxw3qSldgNNx/s8hyzc= - =0kev - -----END PGP MESSAGE----- - fp: 5DA93D5C9D7320E1BD3522C79C78172B3551C9FD - - created_at: "2026-02-17T22:21:57Z" - enc: |- - -----BEGIN PGP MESSAGE----- - - hQIMA46L6MuPqfJqAQ//ZYw2qRn+YhiEoBpbUsW95NJpZJFizwssh1dC/Lda5qFs - 55G1Jls9FHHQ+LmRnE6wyx26bbpQ257FNzCsxsfwAuiznx31j1yHc6LZbuJ3+DsJ - slRaad13RdLyGgo2psaXbBMEgr22FAFDm+S98aYnyv8yvtOZvutEljGm9yhHLGKy - XnFf8LwvvqdT4RolfxiPncGsd9hbFYZh7/zcJTSzfYSnHI30Ly5Na74vSaamuIwR - oPnSxlf8jIX5RUzssjyOHGLQLd327fKuveVxX9CUK/PGWLgQYuTL5PWZwQGhzgSY - E+2EerpGLVJzSQB0TUU5xGwOQkDlPveSSUg0IoDlivMnrphWUFd+bcIMbipVXolf - qpiJeO1t0YW1WAQBzkQ3J+uXgX0dJqWfzfMsbn3j4/WZq5ZlEX6x+ovHv6Z7ZXTz - 6lcF6Gn0dH/omhkqduK3bLwBWAkmh7gWNssEXdPQWGWA8j3WM+IPZKIegpecflKN - pv7jOyD95othMUul/iiH/E3aSbCggN5maoZHG2Cp1TGXkGOLFCNs143LGTVligOU - yD8n0uAQ8e50J7YwytSi2g0pzFkZyriLmrZqKFt9UUOfANivrO9p8J0Bo9wEHjY0 - OdKKu8ASgjYk0t4VHGeZF3GPSaGE/k7LaUb9+5t02sxypxeVqQXpvjU/D8c/0wPS - XgGQs2bjszJIyRwcTmUHD8YAvuxf0MkyKCKpJSsnbJ4XmgkI+gGQpg0GLQROXjZ4 - 8GqLzKb+3d3QDUPQmh+z5Ur1nFcVS214wycICWSTsIUyam59+4rVxV1i33DcAs4= - =BJfi - -----END PGP MESSAGE----- - fp: 8996B62CBD159DCADD3B6DC08BB33A8ABCF7BC4A - - created_at: "2026-02-17T22:21:57Z" - enc: |- - -----BEGIN PGP MESSAGE----- - - hF4DQrf1tCqiJxoSAQdA7rerN+IVKpzyAdXVuAN19+CIjQ6DnHatGr92/YhAEiQw - J913tdR+Yb/FdPWQrn0NR2eTUuKm/Es0NRvJY/YEnhQble+3qYvxFP6dI+vm1cmz - 0l4BNxMhGqyOmsDFf58yrJmrHdnapBOmiqCkJBTc9gAQH534di0Ps+grV04jzkXW - DUO/sIPANPpvqqCJNt1uekKNH2J57OMaagnBTivMBTq0HAuRN1RhcrjGof9ttCj1 - =desh - -----END PGP MESSAGE----- - fp: B71138A6A8964A3C3B8899857B4F70C356765BAB - unencrypted_suffix: _unencrypted - version: 3.11.0 diff --git a/config/hosts/forgejo-actions-runner/sops.nix b/config/hosts/forgejo-actions-runner/sops.nix deleted file mode 100644 index b4548ed..0000000 --- a/config/hosts/forgejo-actions-runner/sops.nix +++ /dev/null @@ -1,7 +0,0 @@ -{ ... }: - -{ - sops = { - defaultSopsFile = ./secrets.yaml; - }; -} diff --git a/flake.nix b/flake.nix index f16409b..886024b 100644 --- a/flake.nix +++ b/flake.nix @@ -127,20 +127,6 @@ ]; }; - forgejo-actions-runner = nixpkgs.lib.nixosSystem { - inherit system; - modules = [ - self.nixosModules.common - self.nixosModules.proxmox-vm - sops-nix.nixosModules.sops - self.nixosModules.prometheus-exporter - ./config/hosts/forgejo-actions-runner - ]; - specialArgs = { - inherit authorizedKeysRepo; - }; - }; - ptouch-print-server = nixpkgs.lib.nixosSystem { inherit system specialArgs; modules = [ From 61cf87f12bf7cdedf1b628df9f48e96137c23f70 Mon Sep 17 00:00:00 2001 From: June Date: Thu, 9 Jul 2026 21:14:09 +0200 Subject: [PATCH 17/34] deploy didays.de and didays.de staging on public-web-static --- .../virtualHosts/default.nix | 2 + .../virtualHosts/didays.de.nix | 73 +++++++++++++++++++ .../virtualHosts/staging.didays.de.nix | 72 ++++++++++++++++++ 3 files changed, 147 insertions(+) create mode 100644 config/hosts/public-web-static/virtualHosts/didays.de.nix create mode 100644 config/hosts/public-web-static/virtualHosts/staging.didays.de.nix diff --git a/config/hosts/public-web-static/virtualHosts/default.nix b/config/hosts/public-web-static/virtualHosts/default.nix index 61008d2..de252b3 100644 --- a/config/hosts/public-web-static/virtualHosts/default.nix +++ b/config/hosts/public-web-static/virtualHosts/default.nix @@ -28,5 +28,7 @@ ./staging.diday.org.nix ./historic-easterhegg ./ueberwachungsfrei-kundgebung.nix + ./didays.de.nix + ./staging.didays.de.nix ]; } diff --git a/config/hosts/public-web-static/virtualHosts/didays.de.nix b/config/hosts/public-web-static/virtualHosts/didays.de.nix new file mode 100644 index 0000000..6874e4f --- /dev/null +++ b/config/hosts/public-web-static/virtualHosts/didays.de.nix @@ -0,0 +1,73 @@ +{ pkgs, ... }: + +let + domain = "didays.de"; + dataDir = "/var/www/${domain}"; + deployUser = "didays-deploy"; +in { + services.nginx.virtualHosts = { + "acme-${domain}" = { + enableACME = true; + serverName = "${domain}"; + + listen = [ + { + addr = "[::]"; + port = 31820; + } + { + addr = "0.0.0.0"; + port = 31820; + } + ]; + }; + + "${domain}" = { + forceSSL = true; + useACMEHost = "${domain}"; + + listen = [ + { + addr = "[::]"; + port = 8443; + ssl = true; + proxyProtocol = true; + } + { + addr = "0.0.0.0"; + port = 8443; + ssl = true; + proxyProtocol = true; + } + ]; + + root = "${dataDir}"; + + extraConfig = '' + # Make use of the ngx_http_realip_module to set the $remote_addr and + # $remote_port to the client address and client port, when using proxy + # protocol. + # First set our proxy protocol proxy as trusted. + set_real_ip_from 172.31.17.140; + # Then tell the realip_module to get the addreses from the proxy protocol + # header. + real_ip_header proxy_protocol; + + port_in_redirect off; + ''; + }; + }; + + systemd.tmpfiles.rules = [ + "d ${dataDir} 0755 ${deployUser} ${deployUser}" + ]; + + users.users."${deployUser}" = { + isNormalUser = true; + group = "${deployUser}"; + openssh.authorizedKeys.keys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBEcEfs6qiUwjlqsHwzS1WvaVQOPEhRRup5RE+K1wZ72 deploy key for didays" + ]; + }; + users.groups."${deployUser}" = { }; +} diff --git a/config/hosts/public-web-static/virtualHosts/staging.didays.de.nix b/config/hosts/public-web-static/virtualHosts/staging.didays.de.nix new file mode 100644 index 0000000..82d84a9 --- /dev/null +++ b/config/hosts/public-web-static/virtualHosts/staging.didays.de.nix @@ -0,0 +1,72 @@ +{ pkgs, ... }: + +let + domain = "staging.didays.de"; + dataDir = "/var/www/${domain}"; + deployUser = "didays-deploy"; +in { + services.nginx.virtualHosts = { + "acme-${domain}" = { + enableACME = true; + serverName = "${domain}"; + + listen = [ + { + addr = "[::]"; + port = 31820; + } + { + addr = "0.0.0.0"; + port = 31820; + } + ]; + }; + + "${domain}" = { + forceSSL = true; + useACMEHost = "${domain}"; + + listen = [ + { + addr = "[::]"; + port = 8443; + ssl = true; + proxyProtocol = true; + } + { + addr = "0.0.0.0"; + port = 8443; + ssl = true; + proxyProtocol = true; + } + ]; + + root = "${dataDir}"; + + # Disallow *, since this is staging and doesn't need to be in any search + # results. + locations."/robots.txt" = { + return = "200 \"User-agent: *\\nDisallow: *\\n\""; + }; + + extraConfig = '' + # Make use of the ngx_http_realip_module to set the $remote_addr and + # $remote_port to the client address and client port, when using proxy + # protocol. + # First set our proxy protocol proxy as trusted. + set_real_ip_from 172.31.17.140; + # Then tell the realip_module to get the addreses from the proxy protocol + # header. + real_ip_header proxy_protocol; + + port_in_redirect off; + ''; + }; + }; + + systemd.tmpfiles.rules = [ + "d ${dataDir} 0755 ${deployUser} ${deployUser}" + ]; + + # didays deploy user already defined in didays.de.nix. +} From 876fdbc4dd747c6830a1b535085928e7399056cf Mon Sep 17 00:00:00 2001 From: lilly Date: Tue, 11 Aug 2026 15:24:37 +0200 Subject: [PATCH 18/34] rename "dooris-hauptraum" credentials to "dooris" in spaceapid --- config/hosts/public-web-static/secrets.yaml | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/config/hosts/public-web-static/secrets.yaml b/config/hosts/public-web-static/secrets.yaml index e1f1a5b..20d09f1 100644 --- a/config/hosts/public-web-static/secrets.yaml +++ b/config/hosts/public-web-static/secrets.yaml @@ -1,10 +1,9 @@ -spaceapid_config_ccchh_credentials: ENC[AES256_GCM,data:5IClrKKMO/AztQuGabrnoRFItYNeEmVWGeafomVO94pL1RKzL1sCxBxnmzvJFPb/8Y+6FXMh+Mim4DP8B2RaJMLpmqCv+76N/5+527SZ6gn9i2Klg6q0kD9RzJv40qHq/NYLCa24tpcZDt7eB0EOgqLsKUmtX2LrQjjnN3NzjAevJGKQ5ypnb7xygjft2KrpvlR1hMnZ0XpSLDTNR1AmImxE24JtDaJKzwXbptr2IZvm1UFkNslxdqHPjN+N8+MSSLhqHy/FdcY2ADvsTX1jtjnjkb+9E30QOeCiFPKSmWtSGiQ9sPcQna1yr717Vk0EiNSAWDQ2fMZyJUgBXG6w3wiZbxfJmxvshLPs5KguF9NHER+Seps1QiE0p16c0IS/0Y24UYrK2GyUIcSReGufjxUFGTJHFSsNANac34H/RTs7BkoZ,iv:8WzTRaXVeH5GKmigMVTLVBnhy6nXZnTZHLAYHcqDs2s=,tag:jTdgz0gmruMWWDBQ3h70vw==,type:str] +spaceapid_config_ccchh_credentials: ENC[AES256_GCM,data:0fOL/gFCazBqRG2QuuRiUN/xQsfAFY+5xx5Y9PUIRMn7yh+kZjC3zrjOKyP/98x1cqwBjXTSJX9IZCiNTDS4drjhCleKTX7zsL3KluWhZwS0bey8iUYLjhaXuH2gE5h7kk18S6acpBF75JAdwmfP5Tw+ewggIt3AHtDoDWLxSHbRYsHACeyb5BC7ftAOSpqhqQTBP756XfUe+dPrvsECD6YzYRgU4JGaKKm69M97yoeghvkLgKYSxN4urelZTLGhe1tqgA6eCSznRV7+lWHcKfocjqCsbruxB4711/p7FlFD/miohT78SFe+scTLM0o7t2o2Kz4n05gJHp+1X3mp5bfyZaRceyceWkwEgxg58zjlhA3oC9CJjNAa3fPFolMVHzZJMGPVnn0t0OPTsr7VxoIJewOm/zlPxN0=,iv:5Dep+oBqAnvKiowbRbRkMGrpTEbTEbzv0tVXz6lKVdU=,tag:qOkqNCkvWrmXZ6bAtBkjSw==,type:str] staging.diday.org: lego.env: ENC[AES256_GCM,data:FHCHBrjapNGSAtUnDTMZfeAZJqZV65d8COBJF8lzZmNBiw0jXyrmJ6rnUbYmnPN54T+1e8V0dzkdqmYX708tpFWagOPPQ9Ko+D+lV5yJ4hj/lhunuPSetWC/5dGBfN6CbA==,iv:WZ8CWu40ToF2mbpSUR6pDdUa6jcWPIUsWhVaGGBwx1E=,tag:8CohD3CwcUm2LzAJ8Lfimg==,type:str] sops: age: - - recipient: age19h7xtfmt3py3ydgl8d8fgh8uakxqxjr74flrxev3pgmvvx94kvtq5d932d - enc: | + - enc: | -----BEGIN AGE ENCRYPTED FILE----- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOaEZqOHRMMko4S1loUXdm aTlsS1RDNHdjdkZWSG1aR0d4Vmh4dVVZQWo0CmJUbm9hZzJqaDBOMTVObG9HWFF1 @@ -12,8 +11,8 @@ sops: OUJkei9zWmhyazc5T2FVbElFRG9RaFkKu4lZrg8UWVVk75eY8HBdLIT4BNw2UcyV +7X2L7ltv2z31T4cKnnZrsyeG6fBGCLvuI5EQBd09OCZEUZ4u7qPOA== -----END AGE ENCRYPTED FILE----- - - recipient: age19s7r8sf7j6zk24x9vumawgxpd2q8epyv7p9qsjntw7v9s3v045mqhmsfp0 - enc: | + recipient: age19h7xtfmt3py3ydgl8d8fgh8uakxqxjr74flrxev3pgmvvx94kvtq5d932d + - enc: | -----BEGIN AGE ENCRYPTED FILE----- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzMkdGQ0tpSUlWQ25ERTMy QXhNdUYzdlBPUXR0V0NyOHpZbDY5RVd1ZXg0Cm40TjQvMXVGamM1akMzRUFuc3NO @@ -21,8 +20,9 @@ sops: ZE9rN3R4aHRXR0dBc2oxcEYrL1lxZncKuVocF84+ge1gyzfNjIxhwNgd8+kJIpxh yREbS2mrQ2zvSMtw9OoA0KJSpoHZfIiCwn2uYkQDPiGB/721JmA12Q== -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-02-27T20:40:06Z" - mac: ENC[AES256_GCM,data:Nsburro0nSV8CLZsxLaFrwsE5EIz8qQOlclNynbRT03XkfaPN2Pup8UWg9QL34KGcGUweqtytxZvLWjwfJYEsIkLqi4ZfrpXpEfBowq5aNbWHzDJDW5QqZKaUPmMQxiPVm1EhXmyvfVdFEueOhfFLbuNUSvNWaFk/7l2utTeLrs=,iv:dSJDVYGdaunvRqj+EkPGy3qxR9suV0s2Mm26silX24M=,tag:hqA+4FpP2PwatRMnZUcUqw==,type:str] + recipient: age19s7r8sf7j6zk24x9vumawgxpd2q8epyv7p9qsjntw7v9s3v045mqhmsfp0 + lastmodified: "2026-08-11T13:23:00Z" + mac: ENC[AES256_GCM,data:jZ9G+EcoGBfWv3uYVkk6DF3HJxHpxMYZQW/4BQd4V/YrluZp5dg4Bw/coRb3ka8n1EBLj+hxPSJyCtXwRlW1sMUvl4mbKpMTe5dtd67lpDMXbQ/3AA53cD/52Mlvv76Ywff7kjx4XhbBCnYEdBfMABcVLPd/rgmKtMKRtaYLjmQ=,iv:yPwKgsg2JgqB3QT7GG2+UlPlP+REOjlo/FKYwgmctZw=,tag:944RbdkitJ37aEmcrX7iQQ==,type:str] pgp: - created_at: "2026-02-17T22:22:02Z" enc: |- @@ -147,4 +147,4 @@ sops: -----END PGP MESSAGE----- fp: B71138A6A8964A3C3B8899857B4F70C356765BAB unencrypted_suffix: _unencrypted - version: 3.11.0 + version: 3.13.3 From b167ee51b9e230fd8b86bcb915306c1918f3e610 Mon Sep 17 00:00:00 2001 From: lilly Date: Tue, 11 Aug 2026 15:59:13 +0200 Subject: [PATCH 19/34] fix permission mistake in spaceapid config --- .../hosts/public-web-static/spaceapid-config/ccchh-dynamic.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/hosts/public-web-static/spaceapid-config/ccchh-dynamic.json b/config/hosts/public-web-static/spaceapid-config/ccchh-dynamic.json index 2b1309f..fbadbf2 100644 --- a/config/hosts/public-web-static/spaceapid-config/ccchh-dynamic.json +++ b/config/hosts/public-web-static/spaceapid-config/ccchh-dynamic.json @@ -77,7 +77,7 @@ "state": { "open": { "allowed_credentials": [ - "dooris-hauptraum" + "dooris" ] } } From 309c763d158102bb68f4b82c8c8a93d018b87480 Mon Sep 17 00:00:00 2001 From: lilly Date: Tue, 11 Aug 2026 21:20:43 +0200 Subject: [PATCH 20/34] update git to nixos 26.05 --- flake.lock | 37 +++++++++++++++++++++++++++---------- flake.nix | 5 +++-- 2 files changed, 30 insertions(+), 12 deletions(-) diff --git a/flake.lock b/flake.lock index b2142ed..21a71d5 100644 --- a/flake.lock +++ b/flake.lock @@ -19,11 +19,11 @@ }, "nixpkgs": { "locked": { - "lastModified": 1778430510, - "narHash": "sha256-Ti+ZBvW6yrWWAg2szExVTwCd4qOJ3KlVr1tFHfyfi8Q=", + "lastModified": 1782847189, + "narHash": "sha256-twXPFqFsrrY5r28Zh7Homgcp2gUMBgQ6WDS98Q/3xFI=", "owner": "nixos", "repo": "nixpkgs", - "rev": "8fd9daa3db09ced9700431c5b7ad0e8ba199b575", + "rev": "b6018f87da91d19d0ab4cf979885689b469cdd41", "type": "github" }, "original": { @@ -33,13 +33,29 @@ "type": "github" } }, - "nixpkgs-unstable": { + "nixpkgs-2605": { "locked": { - "lastModified": 1778672786, - "narHash": "sha256-Blg88K1jwG+P0Mr27+rKMFCufdrWkV3wWh9AdYtz0FQ=", + "lastModified": 1786313170, + "narHash": "sha256-9BG7OgUWdu0ONDO5X2q6+K4bsuBITkX/3W4nNJu1Ito=", "owner": "nixos", "repo": "nixpkgs", - "rev": "eef00dfd8a712b34af845f9350bac681b1228bd1", + "rev": "fcb8fcd6bf2d0adecae5bd491afaaaf8311b758d", + "type": "github" + }, + "original": { + "owner": "nixos", + "ref": "nixos-26.05", + "repo": "nixpkgs", + "type": "github" + } + }, + "nixpkgs-unstable": { + "locked": { + "lastModified": 1786348146, + "narHash": "sha256-we5zDEFfn8TgzeWKjKDMIjeQZ59omEPl23NIF+13/ys=", + "owner": "nixos", + "repo": "nixpkgs", + "rev": "d482ef84049d9b7276b83a06e4e4d76983830097", "type": "github" }, "original": { @@ -53,6 +69,7 @@ "inputs": { "authorizedKeysRepo": "authorizedKeysRepo", "nixpkgs": "nixpkgs", + "nixpkgs-2605": "nixpkgs-2605", "nixpkgs-unstable": "nixpkgs-unstable", "sops-nix": "sops-nix" } @@ -64,11 +81,11 @@ ] }, "locked": { - "lastModified": 1777944972, - "narHash": "sha256-VfGRo1qTBKOe3s2gOv8LSoA6Fk19PvBlwQ1ECN0Evn8=", + "lastModified": 1786375908, + "narHash": "sha256-G7qDAT98nywA4EFmJCwIRO5wKvDlBBN3BWpsOnjAto8=", "owner": "Mic92", "repo": "sops-nix", - "rev": "c591bf665727040c6cc5cb409079acb22dcce33c", + "rev": "d1337e05ba0a8e88a75d2c0e1595d82f3b3e2ac4", "type": "github" }, "original": { diff --git a/flake.nix b/flake.nix index 886024b..f802368 100644 --- a/flake.nix +++ b/flake.nix @@ -7,6 +7,7 @@ # https://github.com/NixOS/nixpkgs nixpkgs.url = "github:nixos/nixpkgs/nixos-25.11"; nixpkgs-unstable.url = "github:nixos/nixpkgs/nixpkgs-unstable"; + nixpkgs-2605.url = "github:nixos/nixpkgs?ref=nixos-26.05"; # # Add nixos-generators as an input. # # See here: https://github.com/nix-community/nixos-generators#using-in-a-flake @@ -28,7 +29,7 @@ }; }; - outputs = { self, nixpkgs, nixpkgs-unstable, sops-nix, authorizedKeysRepo, ... }: + outputs = { self, nixpkgs, nixpkgs-unstable, nixpkgs-2605, sops-nix, authorizedKeysRepo, ... }: let specialArgs = { inherit authorizedKeysRepo; @@ -116,7 +117,7 @@ ]; }; - git = nixpkgs.lib.nixosSystem { + git = nixpkgs-2605.lib.nixosSystem { inherit system specialArgs; modules = [ self.nixosModules.common From 8e8b465eca5553860b75dec33d8f6140780100ae Mon Sep 17 00:00:00 2001 From: chris Date: Fri, 14 Aug 2026 21:31:10 +0200 Subject: [PATCH 21/34] flake.lock: Update MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Flake lock file updates: • Updated input 'nixpkgs-2605': 'github:nixos/nixpkgs/fcb8fcd6bf2d0adecae5bd491afaaaf8311b758d' (2026-08-09) → 'github:nixos/nixpkgs/9f78f44a87948854445dae0b6bf82b2e87e4efb5' (2026-08-12) • Updated input 'nixpkgs-unstable': 'github:nixos/nixpkgs/d482ef84049d9b7276b83a06e4e4d76983830097' (2026-08-10) → 'github:nixos/nixpkgs/6b5e5b7a6631f065bf6908986990b37d845f847f' (2026-08-13) • Updated input 'sops-nix': 'github:Mic92/sops-nix/d1337e05ba0a8e88a75d2c0e1595d82f3b3e2ac4' (2026-08-10) → 'github:Mic92/sops-nix/a8627b21b9107c5711c96b84f32a9a4b3d45295f' (2026-08-13) --- flake.lock | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/flake.lock b/flake.lock index 21a71d5..76cad77 100644 --- a/flake.lock +++ b/flake.lock @@ -35,11 +35,11 @@ }, "nixpkgs-2605": { "locked": { - "lastModified": 1786313170, - "narHash": "sha256-9BG7OgUWdu0ONDO5X2q6+K4bsuBITkX/3W4nNJu1Ito=", + "lastModified": 1786535285, + "narHash": "sha256-rG5HKMAgAhMgydvKGtco6rqTxRq4EDZQCx9USLvVqYw=", "owner": "nixos", "repo": "nixpkgs", - "rev": "fcb8fcd6bf2d0adecae5bd491afaaaf8311b758d", + "rev": "9f78f44a87948854445dae0b6bf82b2e87e4efb5", "type": "github" }, "original": { @@ -51,11 +51,11 @@ }, "nixpkgs-unstable": { "locked": { - "lastModified": 1786348146, - "narHash": "sha256-we5zDEFfn8TgzeWKjKDMIjeQZ59omEPl23NIF+13/ys=", + "lastModified": 1786593342, + "narHash": "sha256-smTKQXMLLStzc8zJevMCckbk3My7SvbbLmPYZUJJKW4=", "owner": "nixos", "repo": "nixpkgs", - "rev": "d482ef84049d9b7276b83a06e4e4d76983830097", + "rev": "6b5e5b7a6631f065bf6908986990b37d845f847f", "type": "github" }, "original": { @@ -81,11 +81,11 @@ ] }, "locked": { - "lastModified": 1786375908, - "narHash": "sha256-G7qDAT98nywA4EFmJCwIRO5wKvDlBBN3BWpsOnjAto8=", + "lastModified": 1786629091, + "narHash": "sha256-gkig4nPi1CWc4Z50GBsjE4ygSE7hMpl/TwID2an2Cck=", "owner": "Mic92", "repo": "sops-nix", - "rev": "d1337e05ba0a8e88a75d2c0e1595d82f3b3e2ac4", + "rev": "a8627b21b9107c5711c96b84f32a9a4b3d45295f", "type": "github" }, "original": { From ed89e6263c06f8a1564354974e19c1753ede666b Mon Sep 17 00:00:00 2001 From: chris Date: Fri, 14 Aug 2026 21:59:03 +0200 Subject: [PATCH 22/34] git: fix git disable download function --- config/hosts/git/forgejo.nix | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/config/hosts/git/forgejo.nix b/config/hosts/git/forgejo.nix index 89f83c9..9938832 100644 --- a/config/hosts/git/forgejo.nix +++ b/config/hosts/git/forgejo.nix @@ -60,6 +60,9 @@ repo = { DEFAULT_REPO_UNITS = "repo.code,repo.issues,repo.pulls"; }; + repository = { + DISABLE_DOWNLOAD_SOURCE_ARCHIVES = true; + }; actions = { ENABLED = true; ARTIFACT_RETENTION_DAYS = 30; @@ -84,6 +87,12 @@ REPO_INDEXER_TYPE = "elasticsearch"; REPO_INDEXER_CONN_STR = "http://127.0.0.1:9200"; }; + "cron.archive_cleanup" = { + ENABLED = true; + RUN_AT_START = true; + SCHEDULE = "@every 1h"; + OLDER_THAN = "2h"; + }; }; }; From ef759b4c0c90a5d92ea1f61b093b81bd81bc082d Mon Sep 17 00:00:00 2001 From: lilly Date: Wed, 2 Sep 2026 14:59:05 +0200 Subject: [PATCH 23/34] increase matrix request-uri max size --- config/hosts/matrix/nginx.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/config/hosts/matrix/nginx.nix b/config/hosts/matrix/nginx.nix index 5a4f716..88c8e11 100644 --- a/config/hosts/matrix/nginx.nix +++ b/config/hosts/matrix/nginx.nix @@ -92,6 +92,8 @@ # Then tell the realip_module to get the addreses from the proxy protocol # header. real_ip_header proxy_protocol; + # increase header buffer size because mjolnir sometimes uses very large URIs which nginx would normally block + large_client_header_buffers 4 16k; ''; }; From 8e59a85c6ecba4984c0982d91f474c87546fc4eb Mon Sep 17 00:00:00 2001 From: lilly Date: Fri, 18 Sep 2026 11:11:24 +0200 Subject: [PATCH 24/34] update nixo2605 flake input --- flake.lock | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/flake.lock b/flake.lock index 76cad77..7cb0c64 100644 --- a/flake.lock +++ b/flake.lock @@ -35,11 +35,11 @@ }, "nixpkgs-2605": { "locked": { - "lastModified": 1786535285, - "narHash": "sha256-rG5HKMAgAhMgydvKGtco6rqTxRq4EDZQCx9USLvVqYw=", + "lastModified": 1789542786, + "narHash": "sha256-ajQuqcxnj6RYnwCjA/9FTCnrdR2+BDzstE8UembXf60=", "owner": "nixos", "repo": "nixpkgs", - "rev": "9f78f44a87948854445dae0b6bf82b2e87e4efb5", + "rev": "4c7870105e7f1fdf9c48688c8d7efc21abf0688a", "type": "github" }, "original": { From 5cc6f16e485273bd54449fbacda96326e4560690 Mon Sep 17 00:00:00 2001 From: lilly Date: Sun, 20 Sep 2026 00:10:23 +0200 Subject: [PATCH 25/34] update nixpkgs-26.05 flake input --- flake.lock | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/flake.lock b/flake.lock index 7cb0c64..d3c87ea 100644 --- a/flake.lock +++ b/flake.lock @@ -35,11 +35,11 @@ }, "nixpkgs-2605": { "locked": { - "lastModified": 1789542786, - "narHash": "sha256-ajQuqcxnj6RYnwCjA/9FTCnrdR2+BDzstE8UembXf60=", + "lastModified": 1789749394, + "narHash": "sha256-cFTsMQz8Hzn8MT49oaeLSHg62tE86NykugCWkeM2ypk=", "owner": "nixos", "repo": "nixpkgs", - "rev": "4c7870105e7f1fdf9c48688c8d7efc21abf0688a", + "rev": "cf9d2fb3e50fa1cd5114c47505ea9177f7ff5f49", "type": "github" }, "original": { From 9fad3ac91d88588a97e8835f3bad4cef7eb32ca2 Mon Sep 17 00:00:00 2001 From: lilly Date: Sun, 20 Sep 2026 00:16:28 +0200 Subject: [PATCH 26/34] remove obsolete hosts from config --- config/hosts/audio-hauptraum-kueche/audio.nix | 14 ---- .../audio-hauptraum-kueche/configuration.nix | 9 --- .../hosts/audio-hauptraum-kueche/default.nix | 8 -- .../audio-hauptraum-kueche/networking.nix | 21 ------ config/hosts/audio-hauptraum-tafel/audio.nix | 14 ---- .../audio-hauptraum-tafel/configuration.nix | 9 --- .../hosts/audio-hauptraum-tafel/default.nix | 8 -- .../audio-hauptraum-tafel/networking.nix | 21 ------ config/hosts/esphome/configuration.nix | 9 --- config/hosts/esphome/default.nix | 9 --- config/hosts/esphome/esphome.nix | 7 -- config/hosts/esphome/networking.nix | 29 -------- config/hosts/esphome/nginx.nix | 73 ------------------- flake.nix | 28 ------- 14 files changed, 259 deletions(-) delete mode 100644 config/hosts/audio-hauptraum-kueche/audio.nix delete mode 100644 config/hosts/audio-hauptraum-kueche/configuration.nix delete mode 100644 config/hosts/audio-hauptraum-kueche/default.nix delete mode 100644 config/hosts/audio-hauptraum-kueche/networking.nix delete mode 100644 config/hosts/audio-hauptraum-tafel/audio.nix delete mode 100644 config/hosts/audio-hauptraum-tafel/configuration.nix delete mode 100644 config/hosts/audio-hauptraum-tafel/default.nix delete mode 100644 config/hosts/audio-hauptraum-tafel/networking.nix delete mode 100644 config/hosts/esphome/configuration.nix delete mode 100644 config/hosts/esphome/default.nix delete mode 100644 config/hosts/esphome/esphome.nix delete mode 100644 config/hosts/esphome/networking.nix delete mode 100644 config/hosts/esphome/nginx.nix diff --git a/config/hosts/audio-hauptraum-kueche/audio.nix b/config/hosts/audio-hauptraum-kueche/audio.nix deleted file mode 100644 index 2a75d8a..0000000 --- a/config/hosts/audio-hauptraum-kueche/audio.nix +++ /dev/null @@ -1,14 +0,0 @@ -{ pkgs, ... }: -{ - imports = [ - ../../../modules/services/audio - ]; - - ccchh.services.audio = { - enable = true; - name = "Audio Hauptraum Küche"; - }; - services.mpd.musicDirectory = "smb://beamer:beamer@beamer.z9.ccchh.net/music"; - - users.users.chaos.extraGroups = [ "pipewire" ]; -} diff --git a/config/hosts/audio-hauptraum-kueche/configuration.nix b/config/hosts/audio-hauptraum-kueche/configuration.nix deleted file mode 100644 index 93a6b53..0000000 --- a/config/hosts/audio-hauptraum-kueche/configuration.nix +++ /dev/null @@ -1,9 +0,0 @@ -{ pkgs, ... }: -{ - networking = { - hostName = "audio-hauptraum-kueche"; - domain = "z9.ccchh.net"; - }; - - system.stateVersion = "23.05"; -} diff --git a/config/hosts/audio-hauptraum-kueche/default.nix b/config/hosts/audio-hauptraum-kueche/default.nix deleted file mode 100644 index a271e8e..0000000 --- a/config/hosts/audio-hauptraum-kueche/default.nix +++ /dev/null @@ -1,8 +0,0 @@ -{ ... }: -{ - imports = [ - ./audio.nix - ./configuration.nix - ./networking.nix - ]; -} diff --git a/config/hosts/audio-hauptraum-kueche/networking.nix b/config/hosts/audio-hauptraum-kueche/networking.nix deleted file mode 100644 index 6e1e7d8..0000000 --- a/config/hosts/audio-hauptraum-kueche/networking.nix +++ /dev/null @@ -1,21 +0,0 @@ -{ ... }: - -{ - networking = { - interfaces.net0 = { - ipv4.addresses = [ - { - address = "172.31.200.14"; - prefixLength = 23; - } - ]; - }; - defaultGateway = "172.31.200.1"; - nameservers = [ "172.31.200.1" ]; - }; - - systemd.network.links."10-net0" = { - matchConfig.MACAddress = "1E:EF:2D:92:81:DA"; - linkConfig.Name = "net0"; - }; -} diff --git a/config/hosts/audio-hauptraum-tafel/audio.nix b/config/hosts/audio-hauptraum-tafel/audio.nix deleted file mode 100644 index f090fd9..0000000 --- a/config/hosts/audio-hauptraum-tafel/audio.nix +++ /dev/null @@ -1,14 +0,0 @@ -{ pkgs, ... }: -{ - imports = [ - ../../../modules/services/audio - ]; - - ccchh.services.audio = { - enable = true; - name = "Audio Hauptraum Tafel"; - }; - services.mpd.musicDirectory = "smb://beamer:beamer@beamer.z9.ccchh.net/music"; - - users.users.chaos.extraGroups = [ "pipewire" ]; -} diff --git a/config/hosts/audio-hauptraum-tafel/configuration.nix b/config/hosts/audio-hauptraum-tafel/configuration.nix deleted file mode 100644 index 2f14d0c..0000000 --- a/config/hosts/audio-hauptraum-tafel/configuration.nix +++ /dev/null @@ -1,9 +0,0 @@ -{ pkgs, ... }: -{ - networking = { - hostName = "audio-hauptraum-tafel"; - domain = "z9.ccchh.net"; - }; - - system.stateVersion = "23.05"; -} diff --git a/config/hosts/audio-hauptraum-tafel/default.nix b/config/hosts/audio-hauptraum-tafel/default.nix deleted file mode 100644 index a271e8e..0000000 --- a/config/hosts/audio-hauptraum-tafel/default.nix +++ /dev/null @@ -1,8 +0,0 @@ -{ ... }: -{ - imports = [ - ./audio.nix - ./configuration.nix - ./networking.nix - ]; -} diff --git a/config/hosts/audio-hauptraum-tafel/networking.nix b/config/hosts/audio-hauptraum-tafel/networking.nix deleted file mode 100644 index e357d38..0000000 --- a/config/hosts/audio-hauptraum-tafel/networking.nix +++ /dev/null @@ -1,21 +0,0 @@ -{ ... }: - -{ - networking = { - interfaces.net0 = { - ipv4.addresses = [ - { - address = "172.31.200.15"; - prefixLength = 23; - } - ]; - }; - defaultGateway = "172.31.200.1"; - nameservers = [ "172.31.200.1" ]; - }; - - systemd.network.links."10-net0" = { - matchConfig.MACAddress = "D2:10:33:B1:72:C3"; - linkConfig.Name = "net0"; - }; -} diff --git a/config/hosts/esphome/configuration.nix b/config/hosts/esphome/configuration.nix deleted file mode 100644 index 0ef1dce..0000000 --- a/config/hosts/esphome/configuration.nix +++ /dev/null @@ -1,9 +0,0 @@ -{ ... }: -{ - networking = { - hostName = "esphome"; - domain = "z9.ccchh.net"; - }; - - system.stateVersion = "23.05"; -} diff --git a/config/hosts/esphome/default.nix b/config/hosts/esphome/default.nix deleted file mode 100644 index 8d5150d..0000000 --- a/config/hosts/esphome/default.nix +++ /dev/null @@ -1,9 +0,0 @@ -{ ... }: -{ - imports = [ - ./configuration.nix - ./esphome.nix - ./networking.nix - ./nginx.nix - ]; -} diff --git a/config/hosts/esphome/esphome.nix b/config/hosts/esphome/esphome.nix deleted file mode 100644 index e41c771..0000000 --- a/config/hosts/esphome/esphome.nix +++ /dev/null @@ -1,7 +0,0 @@ -{ ... }: -{ - services.esphome = { - enable = true; - openFirewall = true; - }; -} diff --git a/config/hosts/esphome/networking.nix b/config/hosts/esphome/networking.nix deleted file mode 100644 index 8a84112..0000000 --- a/config/hosts/esphome/networking.nix +++ /dev/null @@ -1,29 +0,0 @@ -{ ... }: - -{ - networking = { - interfaces.net0 = { - ipv4.addresses = [ - { - address = "10.31.208.24"; - prefixLength = 23; - } - ]; - ipv6.addresses = [ - { - address = "2a07:c481:1:d0::66"; - prefixLength = 64; - } - ]; - }; - defaultGateway = "10.31.208.1"; - defaultGateway6 = "2a07:c481:1:d0::1"; - nameservers = [ "10.31.208.1" "2a07:c481:1:d0::1" ]; - search = [ "z9.ccchh.net" ]; - }; - - systemd.network.links."10-net0" = { - matchConfig.MACAddress = "7E:3C:F0:77:8A:F4"; - linkConfig.Name = "net0"; - }; -} diff --git a/config/hosts/esphome/nginx.nix b/config/hosts/esphome/nginx.nix deleted file mode 100644 index 2b154f0..0000000 --- a/config/hosts/esphome/nginx.nix +++ /dev/null @@ -1,73 +0,0 @@ -{ config, ... }: - -{ - services.nginx = { - enable = true; - - virtualHosts = { - "esphome.ccchh.net" = { - forceSSL = true; - enableACME = true; - serverName = "esphome.ccchh.net"; - - listen = [ - { - addr = "0.0.0.0"; - port = 80; - } - { - addr = "[::]"; - port = 80; - } - { - addr = "0.0.0.0"; - port = 443; - ssl = true; - } - { - addr = "[::]"; - port = 443; - ssl = true; - } - ]; - - locations."/" = { - proxyPass = "http://${config.services.esphome.address}:${builtins.toString config.services.esphome.port}"; - proxyWebsockets = true; - }; - }; - "esphome.z9.ccchh.net" = { - forceSSL = true; - useACMEHost = "esphome.ccchh.net"; - serverName = "esphome.z9.ccchh.net"; - - listen = [ - { - addr = "0.0.0.0"; - port = 80; - } - { - addr = "[::]"; - port = 80; - } - { - addr = "0.0.0.0"; - port = 443; - ssl = true; - } - { - addr = "[::]"; - port = 443; - ssl = true; - } - ]; - - globalRedirect = "esphome.ccchh.net"; - redirectCode = 307; - }; - }; - }; - security.acme.certs."esphome.ccchh.net".extraDomainNames = [ "esphome.z9.ccchh.net" ]; - - networking.firewall.allowedTCPPorts = [ 80 443 ]; -} diff --git a/flake.nix b/flake.nix index f802368..f75f2d4 100644 --- a/flake.nix +++ b/flake.nix @@ -67,34 +67,6 @@ }; }; nixosConfigurations = { - audio-hauptraum-kueche = nixpkgs.lib.nixosSystem { - inherit system specialArgs; - modules = [ - self.nixosModules.common - self.nixosModules.proxmox-vm - ./config/hosts/audio-hauptraum-kueche - ]; - }; - - audio-hauptraum-tafel = nixpkgs.lib.nixosSystem { - inherit system specialArgs; - modules = [ - self.nixosModules.common - self.nixosModules.proxmox-vm - ./config/hosts/audio-hauptraum-tafel - { nixpkgs.overlays = [ self.overlays.librespotFixOverlay ]; } - ]; - }; - - esphome = nixpkgs.lib.nixosSystem { - inherit system specialArgs; - modules = [ - self.nixosModules.common - self.nixosModules.proxmox-vm - ./config/hosts/esphome - ]; - }; - matrix = nixpkgs.lib.nixosSystem { inherit system specialArgs; modules = [ From 03e37aad723b36f6e4bd66a5d2da684fc6b6fd35 Mon Sep 17 00:00:00 2001 From: June Date: Mon, 21 Sep 2026 21:37:58 +0200 Subject: [PATCH 27/34] public-web-static: add configuration for bildungsurlaub.hamburg.ccc.de --- .../bildungsurlaub.hamburg.ccc.de.nix | 74 +++++++++++++++++++ .../virtualHosts/default.nix | 1 + 2 files changed, 75 insertions(+) create mode 100644 config/hosts/public-web-static/virtualHosts/bildungsurlaub.hamburg.ccc.de.nix diff --git a/config/hosts/public-web-static/virtualHosts/bildungsurlaub.hamburg.ccc.de.nix b/config/hosts/public-web-static/virtualHosts/bildungsurlaub.hamburg.ccc.de.nix new file mode 100644 index 0000000..34d7e18 --- /dev/null +++ b/config/hosts/public-web-static/virtualHosts/bildungsurlaub.hamburg.ccc.de.nix @@ -0,0 +1,74 @@ +{ ... }: + +let + domain = "bildungsurlaub.hamburg.ccc.de"; + dataDir = "/var/www/${domain}"; + deployUser = "bildungsurlaub-website-deploy"; +in +{ + services.nginx.virtualHosts = { + "acme-${domain}" = { + enableACME = true; + serverName = "${domain}"; + + listen = [ + { + addr = "[::]"; + port = 31820; + } + { + addr = "0.0.0.0"; + port = 31820; + } + ]; + }; + + "${domain}" = { + forceSSL = true; + useACMEHost = "${domain}"; + + listen = [ + { + addr = "[::]"; + port = 8443; + ssl = true; + proxyProtocol = true; + } + { + addr = "0.0.0.0"; + port = 8443; + ssl = true; + proxyProtocol = true; + } + ]; + + root = "${dataDir}"; + + extraConfig = '' + # Make use of the ngx_http_realip_module to set the $remote_addr and + # $remote_port to the client address and client port, when using proxy + # protocol. + # First set our proxy protocol proxy as trusted. + set_real_ip_from 172.31.17.140; + # Then tell the realip_module to get the addreses from the proxy protocol + # header. + real_ip_header proxy_protocol; + + port_in_redirect off; + ''; + }; + }; + + systemd.tmpfiles.rules = [ + "d ${dataDir} 0755 ${deployUser} ${deployUser}" + ]; + + users.users."${deployUser}" = { + isNormalUser = true; + group = "${deployUser}"; + openssh.authorizedKeys.keys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINDVK+4GeUtFGzRNrcoHagjB+/4z3GyrtHuIDQP54j4i mailto:dante@briefhaus.de" + ]; + }; + users.groups."${deployUser}" = { }; +} diff --git a/config/hosts/public-web-static/virtualHosts/default.nix b/config/hosts/public-web-static/virtualHosts/default.nix index de252b3..99bcefb 100644 --- a/config/hosts/public-web-static/virtualHosts/default.nix +++ b/config/hosts/public-web-static/virtualHosts/default.nix @@ -2,6 +2,7 @@ { imports = [ + ./bildungsurlaub.hamburg.ccc.de.nix ./branding-resources.hamburg.ccc.de.nix ./c3cat.de.nix ./c3dog.de.nix From c11128ea4da26e7d5ed12c66daadaf2956e0a692 Mon Sep 17 00:00:00 2001 From: June Date: Thu, 24 Sep 2026 20:45:22 +0200 Subject: [PATCH 28/34] synchronize admin keys with ansible-infra and use SOPS merge Synchronize admin keys in .sops.yaml with ansible-infra and make use of SOPS merge feature for organization. --- .sops.yaml | 129 ++++------ config/hosts/git/secrets.yaml | 257 ++++++++++++-------- config/hosts/matrix/secrets.yaml | 257 ++++++++++++-------- config/hosts/penpot/secrets.yaml | 257 ++++++++++++-------- config/hosts/public-web-static/secrets.yaml | 249 +++++++++++-------- 5 files changed, 635 insertions(+), 514 deletions(-) diff --git a/.sops.yaml b/.sops.yaml index e1991ef..fed4693 100644 --- a/.sops.yaml +++ b/.sops.yaml @@ -1,109 +1,66 @@ keys: - - &admin_gpg_jtbx 18DFCE01456DAB52EA38A6584EDC64F35FA1D6A5 - - &admin_gpg_yuri 87AB00D45D37C9E9167B5A5A333448678B60E505 - - &admin_gpg_june 057870A2C72CD82566A3EC983695F4FCBCAE4912 - - &admin_gpg_haegar F38C9D4228FC6F674E322D9C3326D914EB9B8F55 - - &admin_gpg_dario 5DA93D5C9D7320E1BD3522C79C78172B3551C9FD - - &admin_gpg_echtnurich 8996B62CBD159DCADD3B6DC08BB33A8ABCF7BC4A - - &admin_gpg_c6ristian B71138A6A8964A3C3B8899857B4F70C356765BAB - - &admin_gpg_dante 3D70F61E07F64EC4E4EF417BEFCD9D20F58784EF - - &admin_age_lilly age19h7xtfmt3py3ydgl8d8fgh8uakxqxjr74flrxev3pgmvvx94kvtq5d932d - - &host_age_git age18zaq9xg9nhqyl8g7mvrqhsx4qstay5l9cekq2g80vx4920pswdfqpeafd7 - - &host_age_forgejo_actions_runner age10xz2l7ghul7023awcydf4q3wurmszy2tafnadlarj0tvm7kl033sjw5f8t - - &host_age_matrix age1f7ams0n2zy994pzt0u30h8tex6xdcernj59t4d70z4kjsyzrr3wsy87xzk - - &host_age_public_web_static age19s7r8sf7j6zk24x9vumawgxpd2q8epyv7p9qsjntw7v9s3v045mqhmsfp0 - - &host_age_woodpecker age1klxtcr23hers0lh4f5zdd53tyrtg0jud35rhydstyjq9fjymf9hsn2a8ch - - &host_age_penpot age10ku5rphtsf2lcxg78za7f2dad5cx5x9urgkce0d7tyqwq2enva9sqf7g8r + admins: &admin_keys + pgp: &admin_pgp_keys + - &admin_pgp_djerun EF643F59E008414882232C78FFA8331EEB7D6B70 + - &admin_pgp_stb 21C9579E6503CA815A68ABD8541F9408A813C8B7 + - &admin_pgp_fi 9633412309CCB83BFA39BA5F2FEF746201D7FCFE + - &admin_pgp_june 057870A2C72CD82566A3EC983695F4FCBCAE4912 + - &admin_pgp_haegar F38C9D4228FC6F674E322D9C3326D914EB9B8F55 + # - &admin_pgp_dario 5DA93D5C9D7320E1BD3522C79C78172B3551C9FD # expired + - &admin_pgp_echtnurich 8996B62CBD159DCADD3B6DC08BB33A8ABCF7BC4A + - &admin_pgp_c6ristian B71138A6A8964A3C3B8899857B4F70C356765BAB + - &admin_pgp_lilly D2E9C0807BF681F5E164DAFC5EE1B61CD90954CD + - &admin_pgp_langoor 878FEA3CB6A6F6E7CD80ECBE28506E3585F9F533 + - &admin_pgp_bitwhisker 41FFAF3D519CF5C039FBD8414BCC213729AF0E49 + age: &admin_age_keys + - &admin_age_jtbx ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIBQgnQAq6FUSDK8bxtYPjx3oRCAKG+xy9J3Gas2ztJk + - &admin_age_lilly age19h7xtfmt3py3ydgl8d8fgh8uakxqxjr74flrxev3pgmvvx94kvtq5d932d + hosts: + - &host_age_git age18zaq9xg9nhqyl8g7mvrqhsx4qstay5l9cekq2g80vx4920pswdfqpeafd7 + - &host_age_forgejo_actions_runner age10xz2l7ghul7023awcydf4q3wurmszy2tafnadlarj0tvm7kl033sjw5f8t + - &host_age_matrix age1f7ams0n2zy994pzt0u30h8tex6xdcernj59t4d70z4kjsyzrr3wsy87xzk + - &host_age_public_web_static age19s7r8sf7j6zk24x9vumawgxpd2q8epyv7p9qsjntw7v9s3v045mqhmsfp0 + - &host_age_woodpecker age1klxtcr23hers0lh4f5zdd53tyrtg0jud35rhydstyjq9fjymf9hsn2a8ch + - &host_age_penpot age10ku5rphtsf2lcxg78za7f2dad5cx5x9urgkce0d7tyqwq2enva9sqf7g8r creation_rules: - path_regex: config/hosts/git/.* key_groups: - - pgp: - - *admin_gpg_jtbx - - *admin_gpg_yuri - - *admin_gpg_june - - *admin_gpg_haegar - - *admin_gpg_dario - - *admin_gpg_echtnurich - - *admin_gpg_c6ristian - age: - - *admin_age_lilly + - age: - *host_age_git + merge: + - *admin_keys - path_regex: config/hosts/forgejo-actions-runner/.* key_groups: - - pgp: - - *admin_gpg_jtbx - - *admin_gpg_yuri - - *admin_gpg_june - - *admin_gpg_haegar - - *admin_gpg_dario - - *admin_gpg_echtnurich - - *admin_gpg_c6ristian - age: - - *admin_age_lilly + - age: - *host_age_forgejo_actions_runner + merge: + - *admin_keys - path_regex: config/hosts/matrix/.* key_groups: - - pgp: - - *admin_gpg_jtbx - - *admin_gpg_yuri - - *admin_gpg_june - - *admin_gpg_haegar - - *admin_gpg_dario - - *admin_gpg_echtnurich - - *admin_gpg_c6ristian - age: - - *admin_age_lilly + - age: - *host_age_matrix + merge: + - *admin_keys - path_regex: config/hosts/public-web-static/.* key_groups: - - pgp: - - *admin_gpg_jtbx - - *admin_gpg_yuri - - *admin_gpg_june - - *admin_gpg_haegar - - *admin_gpg_dario - - *admin_gpg_echtnurich - - *admin_gpg_c6ristian - age: - - *admin_age_lilly + - age: - *host_age_public_web_static + merge: + - *admin_keys - path_regex: config/hosts/woodpecker/.* key_groups: - - pgp: - - *admin_gpg_jtbx - - *admin_gpg_yuri - - *admin_gpg_june - - *admin_gpg_haegar - - *admin_gpg_dario - - *admin_gpg_echtnurich - - *admin_gpg_c6ristian - age: - - *admin_age_lilly + - age: - *host_age_woodpecker + merge: + - *admin_keys - path_regex: config/hosts/penpot/.* key_groups: - - pgp: - - *admin_gpg_jtbx - - *admin_gpg_yuri - - *admin_gpg_june - - *admin_gpg_haegar - - *admin_gpg_dario - - *admin_gpg_echtnurich - - *admin_gpg_c6ristian - age: - - *admin_age_lilly - - *host_age_penpot - - key_groups: - - pgp: - - *admin_gpg_jtbx - - *admin_gpg_yuri - - *admin_gpg_june - - *admin_gpg_haegar - - *admin_gpg_dario - - *admin_gpg_echtnurich - - *admin_gpg_c6ristian - age: - - *admin_age_lilly + - *host_age_penpot + merge: + - *admin_keys + - key_groups: + - *admin_keys stores: yaml: indent: 2 diff --git a/config/hosts/git/secrets.yaml b/config/hosts/git/secrets.yaml index 12b484b..cd59ae4 100644 --- a/config/hosts/git/secrets.yaml +++ b/config/hosts/git/secrets.yaml @@ -1,148 +1,189 @@ forgejo_git_smtp_password: ENC[AES256_GCM,data:ZRj5GpQKRlTxdu5CfbJirRGAKPCLAIG1F0V5USz5m5D49V3lu5uLomxHapmEwb0yYoE7e7ZLYK4VQUoQgpUnSw==,iv:K7+9E2gi8cdYu0lX/HgWitLxnxARywIwh5glEL0uOsM=,tag:s9UC8e+E5E3vM6cTKW7Vqw==,type:str] sops: age: - - recipient: age19h7xtfmt3py3ydgl8d8fgh8uakxqxjr74flrxev3pgmvvx94kvtq5d932d - enc: | + - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpeGkrV2d0clRqTnNVa25P - VUJTQ1I0YUtSYmRwVWIzaEUycjFkbUQ4NXpZCmNnbTVTdGp3R1VET0k1Z05ySHg3 - M2NWaVNiMnB5RllFb1FzOVRRNkk1c0EKLS0tIHBQL01BMjZNMkFBZU43SE5Yc2RV - SEtGVldxa0l5c2t0d0Z1ME5SNlFPYlEK75G9DZxOUGIAEVtUo6BDFZ3NGB6/cfm7 - 0leD7YW7g4mJ+raI/9wVb41BmGdFrYzr0xSjj/1vjJ2aTJEB7pBiTA== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IHFyYkk3dyBjVGcy + OUFGWFFKR3FsS0xKaFhFS2x0MnRqVGkvMnBBZlpYcFlJTDJROEZRCjlXWjNPcWJn + WGdMV0xGdHl3NWp0R0t6aVhGMDRCSXgzTzZQazRaUERUWkUKLS0tIDE5Y0JTRHVP + MlVZZ2VlMUplOFZnZWVqUFdQVDRwazUrVjh5MzZVdlJVbVkKsBYGKnzC9Z8GlaOC + VB74f99y6HOPrkzAkKd110LjprWqxKsburuoDCYpgzMndB7PMm1hBVruevq07nWh + SzvLTA== -----END AGE ENCRYPTED FILE----- - - recipient: age18zaq9xg9nhqyl8g7mvrqhsx4qstay5l9cekq2g80vx4920pswdfqpeafd7 - enc: | + recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIBQgnQAq6FUSDK8bxtYPjx3oRCAKG+xy9J3Gas2ztJk + - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTR21UUEdiZHVKOVBXZlVn - bW8xMGlSbElYQmxQN2IrTzlIeU11WSthSlRVCitIU3ozV0ZDUnhTTk9TRjR3V2Jh - ZDVvcjMzMjhkUmlKSjI5Z09nV3VzSTAKLS0tIDZNQldPcFFWeTJZVWhUMDNKWTVp - VmJxSU1Wa3orQ2tTNEFWdUdKM0RhQmsKfQm3qBSSY/7Pt98HNgXp+THAkOSRRrDF - 8QE6EboB4EJql1hcu2ZHgCGqLNpW/YO5lD3IHt0ujNI0Pd4uYIL1tw== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCSWNLaS9DVldhVkRzajI0 + T2hMK2Jra3RFb0pPSG1IRGRQWmdoZW1sWDNvCnF4Wkw1VnZ2T3V4M0k2NGFackN0 + VTFNTHNod1FMaWhTa09YMGp6Ti91ajQKLS0tIDljRlMxeEFWeG05OXE3WWhxRTM2 + RUR2OERWRUdCMFFLUXBVZSsxT0hSbjAKGjlEHm+ChKOMkQwgIwO6MgRoUT9UXnC6 + 59sQVAchvSwe8WmlCWRBgdkYz4k99yQQPYD0BboLTdYrNmtDHrSk3A== -----END AGE ENCRYPTED FILE----- + recipient: age19h7xtfmt3py3ydgl8d8fgh8uakxqxjr74flrxev3pgmvvx94kvtq5d932d + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNckxwRktHSEw5Vkx6OUJ6 + bkFkS29tWGpLeHRKRVRYQ09MajhTMDE4ZVRFCkZVVi9IdXZ0Umd1b3kvVFNveHdi + Mk5COXBnd1M4eUNJVy9GS1pSbmJVK28KLS0tIHRIbTdFa2VWNXRRMXRFU1BrbWpu + My9hRGlNdGMxc0FnZ2IwSDNhSlh2WDAKQWwCXl9zvdnkc3octm82cNuGrYKkloym + XvmpvKU2//cKihkOhECYVjYVtyLNarbHh1kWIBtaduQzmkfyIX8Ksg== + -----END AGE ENCRYPTED FILE----- + recipient: age18zaq9xg9nhqyl8g7mvrqhsx4qstay5l9cekq2g80vx4920pswdfqpeafd7 lastmodified: "2024-05-25T14:17:29Z" mac: ENC[AES256_GCM,data:JeqYsVtogbB4oMWNEpLsF6zxsgUoAt7UzRUL2JzxDUtXDUndW/AxJxVxQaipYvblA3q2MzRyQN+j9khavlL02DR/ANtZFLQmH3OREV7M9eHmeeCa4Lm5D7gFYmqWkULJ7yEJsKz5AaiJTWlWgCcBITB901H3Z12dsz2a1+4WrUc=,iv:5Xm5Rjw8PS7hkTcRD1kj5XS5uiOgsPwXYeaMqUReB7E=,tag:2Y5R1/Why1TQd+ZYTF0qDA==,type:str] pgp: - - created_at: "2026-02-17T22:21:58Z" + - created_at: "2026-09-24T18:45:14Z" enc: |- -----BEGIN PGP MESSAGE----- - hQIMAz5uSgHG2iMJAQ//aGNw4mAzDqvpfu1FOQwoU6q3C7RlL77VIy6xw93BsahP - c8yIEoTOiDa1wtsLKHMaqxNADsxuQBmx4lQYQZ786SUFMVndfJzU6tf59SnOF+5U - /FztmZQsDEzKzKWESIEQMMavEAanr8DEGpACOITZAe61mTJAn8vcc92jMYhmnsHh - zlhS+ryg+j6VRp5i/s1Yocec/iYR9GlUKn3FVHrVDA0TBxOHJ8KjneN7CG0XFuBg - YmRpokZJrLxLntSyMZVSfksuOK8ORlYYpsGvKZNyzA726WjrYg8bJNN10iZHIbwR - PBmDvvP7SWDcJ1/YuzHE2vwJwbRupE3RLQoFRtmANi5QE0mzyMZPz7IF7d/TrXSV - fW3Hb/73SI+QjgdMtHJCtsxBh7rbGTJMP14TJzmETP7eCwLF+92goz/ruhG+HWFf - vc2g/SLAzUjoiX3MjuPjaLZTfgqhC2b/OnZ+MbFMbpgBtXlNhOkDSb75g/gOaB14 - 9CHmQoJt2JeeCCVkH+YQeq6oK9S5lD2WUhigFxdFaHjE6fmKkwxIBMwPwZ7QY7Ep - ljxJuSfMvl3XkZxpxD1+Ep9C1ZIvDXmvdhXx7H/3SaUtefCHO6Ab46ibtKa8wh2w - 4gzPinJJdDYJfzylNDVMZxJ/P9y8XcYSSDGasG7QOGVNm4T2MrLjFaFhrU7lN9TS - XgHr8/8XgnlBIupmjeJTpLpcF0u5zeKIOiKkJBRQR1aUmzmi76lJVStuEJzfymXl - baOviVQywJOe3bVilDmUuVc71FVICnKgwdAvvgG15nOfOUBagLhM0IrgRrGmGSM= - =+Oww + hQIMAxK/JaB2/SdtAQ/9EfLg6PqyYMXdh3DoucKjcXCo7srGv9cK3iVmG0VOUf1f + OcKzUh1AIQOtcIxXoNf2On0g6PB99Pgoz24gjoZ7kt7b7WI5Uhu+/Dbu42kMRxou + 3uJpaCucm3XLM/wSOjf7oU+GLORs64JL1+XLaNvn5DUsc+TpiOJa9Nsizagrs/wW + V81IdAxCMci7bllTwzimBTnLNx5Uao1yYrqJBfQxjoD+3d0gNsNI9uhQgmcA4Eoe + sVey0yKgbtY8oRjX7fYCRZyEX8UzGuclUsUxfHND2fvI8uSKfOzkpG5Vy9egd6xJ + cSRwlWTvaQJ3TqMwhKXqyIc9gC3BDmIBYvxsbq27ehq1JE+eYjIqJX1FuHTMXDku + hMuW2A3vLk7jwdRc2R38kW6wEHtjup6FOVYGqUKjd7VYJbE7vgihKdwIV0UFjyns + 1IoZhLbFIw5v06jpPrblqyiOFeFk0JQlIJgP5fEpskWvG29aKd7lY08wnwiDZNwN + o7lddU4jgKsyic+SuvzdvznBkxA8Lazaj9RWvlJBfKWrX484zV2ZSZq3z6SsmjCY + ZLfFZx59AeWgcp054wwICDC2FrYJMPQd7AQ9uVRsEaWE1+ygfZGwGp5R3f0rLMhw + dwzcML37/dL0gAnDQEy+7EWjVvci8g7f/MHFlrFSuXewWy5QiaBaYyoCw41j76XU + aAEJAhB3FdKu5/mY0ZvI/RpKR6ZqfXq8h9EcBOQVChWR/ilq3b4xoXCm5TdYf120 + 6jd7rcy6GUZlL+Zu9K1y0hPCLEsgMswZDklssFMSgep4UXB+SeUNYIQ+PwU8Wmlu + sA5E6bX0FBiM + =IPl2 -----END PGP MESSAGE----- - fp: 18DFCE01456DAB52EA38A6584EDC64F35FA1D6A5 - - created_at: "2026-02-17T22:21:58Z" + fp: EF643F59E008414882232C78FFA8331EEB7D6B70 + - created_at: "2026-09-24T18:45:14Z" enc: |- -----BEGIN PGP MESSAGE----- - hQIMAw5vwmoEJHQ1AQ//VsCz5H85LzK29rlmzv1BZaZb6tj86PsO0TydE6+re29Y - i7uu7i54BbjhyC9C2m2J2dzfDsIZyt80n7/1/QooWw4+/h+CD1aFYFb/fiwV6/oq - IAwdnoEio96r6LZcA1t4MSuAcRlrVMrG+OPh0QdCE0uFNiaDcmD6m0XiKL17m6Mk - F9xoYe5e+QMQdq/IcRLVfnlOWMn9qkqixbe4s6YfwttPV9Zx9fDRNz7qf9JiOdbT - sDbnbCDUVyHaRwQ5KMiJOsv0+vVKmDLqlHuFp+21k8/CSAOHzqD+4x9+JMNG5tja - g7Oh2n62UAsCHAr1BPiiWdRpBpIpEbF2/aKjdnlTKaR+niIg4EllkL4XYiFfz3+j - E+IT439U4eqj6AZyblrNgjL2BKUOvR2sQ/PvKA/JHuHCO8C7md0ID1BGlusuN8qX - AZh73AXe5vrrK16k/BX6Pbq0XOAPv8IKa115ZTmfKNH1Iy/LKiwRZT7/QYvYF+Dx - 4RZJkRZgR5gQ4iDytyKUOeMLZyhEQCmHYL4jGvFVa95eNHM87PqI7Eh97tGyO9V6 - FchBk5MTWXnqyXbaC+NEhFduNOh7lNDGNkjjv9PnYdOAgyFY0x4dkKK7bA0Bnzvj - cSiQyCsnF2epK1t5vmbu74vOIfJrXsvp/JwilqEaIiYLywOuVstKFmDyBWnqblnS - XgEhibKGUk2lqS9CmIAzcTsK0GSRkQaI88NljE2zQfORQcEKQ8HziKFf4NrDRYf+ - heln/SYu+bas1gZQBtQRippUbje9xe8uCUez9tgTwbpxYywcq90LvAUZ9F8lVQM= - =cFEl + hQEMA1QflAioE8i3AQf/dhnhiHriQyiB4bDrEbNV44BY0Ani7NUpXyNIw6iTZUhc + yg0WKTUNTFgJYH3R5wH0U5m5FXtevgonaflDESf1ImjP9qtYMOvCRUMaVqzSv+CM + gpz9EPDF5m71c4W5fqm3lfVMH2JVUD2g+YKt7bbIi/igj+XhDPD21wBFHcwCivBx + Mu3Lqg5nZc4YEN+nUDjVbsy/DLl3Cuo6QdCTvcrhXfxY7RxxwR/iVIakXf08W1cC + RKJy+fY2KVtPhluRE6kVrMLswHxdDtbaRDV2ejTRILvPX9mrddZInTR9OJackWde + kOvU2YSJQvFE6w/o+CGiMzDLcqQiWwbVD2RcV84fW9JeAQPi0uFkNrKqFt2ojnkI + stmMB5h33kht2R9b0KbdPhf1LJk0Jn3asdiDcj2rVL3FiWMN+W/UBPkKXK4fBCX7 + Rrp3XbDUjC9kJGJw5fJIV+qSfzgDgbZDv6Qjkni5OQ== + =HiA3 -----END PGP MESSAGE----- - fp: 87AB00D45D37C9E9167B5A5A333448678B60E505 - - created_at: "2026-02-17T22:21:58Z" + fp: 21C9579E6503CA815A68ABD8541F9408A813C8B7 + - created_at: "2026-09-24T18:45:14Z" enc: |- -----BEGIN PGP MESSAGE----- - hF4DerEtaFuTeewSAQdAo/PITsPBAKUdwzsLGOegBkKgjkMyuBM9ghjsu+rSl3Yw - AmuZrtFRAB1ue+eAkEHRUbw4VzxlTVib717P9JEnKED+MXhoQaJiHT9q6qH1SFMk - 0l4B8FmPdQMGgXuLVGmJuGqcSLiLlFnBR+GXSbMT5mv3JxfTJhdslAss3eaWIeg+ - 3hfMVA27mVcxxmenCpi0tSFMXQqh3mSGtb/p93fFz2bi5uFga+CfmyuJTPClJIyb - =tRXn + hF4DsZXvxFXTXoQSAQdASh7Vr4o7modBjS8E7kdLj1imFou3r3D51w26rNst/Eww + tS2tX+fG/wdJIY1xb7vaYQ+oP6WClenuglpRUI+bln+Vfcf9e4b5e15WZ2CDEP2h + 0l4BAXQ9tKsmD52Z8Q5TB3xJUOrLrNR9898tFIXIzvPnQm+1YF3HU6IXvVjlKYXf + oBubJ0nVdAAiJRCdzL2IZ/3SWKgut10DaS2nQeaWOBXPpmg0u4s5bMRRp4zzDqoX + =bai/ + -----END PGP MESSAGE----- + fp: 9633412309CCB83BFA39BA5F2FEF746201D7FCFE + - created_at: "2026-09-24T18:45:14Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hF4DerEtaFuTeewSAQdAgOu0hnPTPyFdJmVNMenRqyg5ENORjwTAmqqXKvNRvEMw + 58ZnLC//bIy66k0zqYE8UbZqynrfcbtZwXLrQ2jVuWfA5Q0FtOyvTFgINtC6Tuhu + 0l4B4yanK5Cux74O368HnxofZJCvQa9XGT1lc4NGQ4O7BycwnXDN2fL5Lm0pWxmk + +ZXZaKChtMUsoCBRuqE81DkRAGaqz684L8ntrH7tK3THOPN1hIyJ3kpz6EXRarA4 + =4pXC -----END PGP MESSAGE----- fp: 057870A2C72CD82566A3EC983695F4FCBCAE4912 - - created_at: "2026-02-17T22:21:58Z" + - created_at: "2026-09-24T18:45:14Z" enc: |- -----BEGIN PGP MESSAGE----- - hQIMAxjNhCKPP69fAQ/8D7Ili77aorhPn6Eg3+9wpxkhd1KU0a0fZh5O8aV0qQk/ - oAvq3+NZYULpMzPb2utLvFKFmKS2d4odbdTV8BhE6rWukRR7Kv5YZYksVjOobCTj - +uhpSA3BSccC5PNNYODRgUF+2sQkzis8raF/El7f+/Ec/owB5qnrWd7Tja4uW5Qt - 5r5q4nH9tb1HtIalrpI8tRcpZ+0JOzdHm2w65eCEirF+12gTSX1QP71KtjkjlKGy - +20ofHdjXpkUT4E9SsVVHpRK70IrPCqi7iv6dwKzUGhfckHDfGCoPEwk6/0WZsjX - r8EU50QxJIJxXkSBIcNVjvw3NviliJiwtPHR35noyYkXJXWlS/FVauxF44sSVvO4 - T2uTCdMhmKp1on518/bUcYWtINAy5w74hOZ+qojo2g5bAAu4mQ7bFwCK8bs08bL8 - beASn5XYkTr/a/oE5kdj1+EB2/VdZZED7w57NiiOEYXoHXNuHAd1DTCeoPz4VvqM - TrY+Cjal7YBg9GAGm4L8ZtqpfqmU5NQnmEYHhzXZhOjhrMtu8QyvlM2KichKnSfW - /AcADQSYwR6O+pLui9tXwUPNGEYQGHx8Wlmjvq6hvfcD+IlyzK5iM9Jg03nerQCf - 1IlEmyNLVt5kQqdtNh8V7kskgPrDsKuQ1kQta5Vq5btbCbIOlIEuzuv9RWXgNerS - XgGH29dML0Fta1z0/LKkWSA/U4V+jUviQDNpbQ2t/WaGQAAK2Mhj34WT55BFcVCe - CvqsHQ28CjAKKaLZ77Wyy03zFHEZ5HwdmJhpXAJFzUdM8jNBQDqc99iNlerFHxA= - =BLfs + hQIMAxjNhCKPP69fAQ/9HQOeNYf4HOV9AN0yYK34mBx9z+jH+4zJ6SiFvjhcXpad + qk48SouK4d1nOt4WmY4aZ4gmk47Fnqstd2JvHaTldTA3tS3yGCQ4VWH9xE31f85R + bAPnBqEJVUoQeYveERVDC71BpeRutlL5bbUxV0+8Vw+6l222dIsPjDNBi/PsGSQ9 + RmrqSBdPdi3cZcQ6ARrLA36tBbjTDBR2IrtLYTrXtS66jn46gFYaY+B+AvVwGL1M + +W9QEyW74mn6J/mPxqUCZFnMHUCXe63isHrMCQ2TEEiwXZgDMB4hO3C2jLnTOmOz + XrbATm2/gTczFhbPmxiqhJH/HTVi88tlK8Amxg31WSUC5PlsQ4gQiFNDcK7KROG9 + vEzQiqol/2xQuddMigqYB+reOx8V8a86a0U27imnCflGw1qBTvB63JN8qGeq7rG8 + 0/keQV3jaQWsxv6OK2YjgD5rAfapFghuyCm/Cu2SRm5Tz3jAwwwwBO+jCjcJIbGS + 1YHQzLUUtafOOyWFckfnHHKs7NnzVt52RbAoC7qlcpUPnmL40EAncQFUgzPpsrrm + Xzn7DredGQH04PPv26XLVoPS19Q3o/j9GTPNoUxskevhOv01bbc5epzdMOEuSva6 + paRqhiaXsciNi0vHSvE4MrGtGrFpVyKQYnPFQoVyjGkAvMfwGSptVc7hNWD1yR/S + XgH5S0QbIxWmuXxy2Q50JBhTmG+MPczgE6El4XVqf4MetsyK0NkooLMr0xFLGhe/ + 6uJTu6OBOrRXW6GXbtuBVpY7bjjz2Oo5wfSRMxGSjFCp+1W5XJrvbhyuZq5Pg+s= + =SYMN -----END PGP MESSAGE----- fp: F38C9D4228FC6F674E322D9C3326D914EB9B8F55 - - created_at: "2026-02-17T22:21:58Z" + - created_at: "2026-09-24T18:45:14Z" enc: |- -----BEGIN PGP MESSAGE----- - hQIMA1Hthzn+T1OoAQ/9GiQ8HBWqxVKFiWt1Rpltpjqp2wJG+TSP/6RZNcJxn/Z0 - n6+SYdeeIIBr/cavORPlaY19bMD3NQMgqhNFiLo2q/ZXTm9QF1YJPRFpzEVovia8 - bF6K022kdEQYFirKNXPtyYsqbZ0hHiJG5cTlacfd2k2Nbx6QTWq0f3Ksm49zzdJh - or1hCoPHTqnuRwiBQtkwx+4jo0SAAe0xO2Cs5jCcNt8j7KYwmRKmH1Qgtclsb3cq - vqhh2WQLXD3HoVJxnjcyIElkCPCDpWtLYT+ZEqiWbiSkLwzsBHjtavgSAs3b8ZV1 - v7zq76ofB0YKN2LRbcpdygvFseqNBpU6uukcScpwhIsfj0DrHZQ9sufl/JIFF97S - 27pf/9hyJLmjTclaUfTREtPb8icyhwOE+d/Atw0sZxOKY4+hV4WF9pbDGiUOgZqi - a7E3qY+Iywk7jDgmU1eQGkY+G3PPXHbdhYr8v+Ig2lbp4uU1H+ab+d6r4C83pJzD - PrDXcletKkA4APwq/duyzox6CoxCpoBcFUtz7rHcYi78EfdFi4oMWVYimAlQCdng - JqeDXAArdoz1rj/yDwlFYybnHtXb65T01wF53brPtOkAVq6tE11hxe9dCiD6klk4 - SI5j9VE8wUEV0lf73AFW+gectZzkr5+7/QKe0IG2G5DkftK/J1nHA4ERFw7w0R7S - XgHrnYShza9Jovn/qGjZrvZFf6Pcs/KK92CpSBi1oMl7Lhll4R0tH+uG4b8pWuXF - uLSpKPsnhnxkfVczNRIFeDZ51ZuyjmYSrpt+YZnDGf7H853ROAC83gej00E4Mcg= - =SVTV - -----END PGP MESSAGE----- - fp: 5DA93D5C9D7320E1BD3522C79C78172B3551C9FD - - created_at: "2026-02-17T22:21:58Z" - enc: |- - -----BEGIN PGP MESSAGE----- - - hQIMA46L6MuPqfJqAQ//czgS1KbONIAv+/0g6iwcMPmBld0BDwJw3G0jlJCuSW6g - nSa1bq87WQzXUL/iM5XzURGzuMY5picYy/QTu/fi/XNG04lZpN7ZzATEkSwwyNzC - JsAei0QKAWPRRFTKSnsoL8QEhKD7asJmgfBDFhj0iYxClBQIXOSjQlAAfeK9o+Xw - oM7EfRSY9zUtJAziZs9LpkQKu7eJlq+n6IGGH9Jy1h0hKcxRuSujgz7MepNvLFc9 - wJO9LGieAgynZgOsvVLHN8N0v/PKew5LXnbDo6I35z4ASG76n+zlFDwYp3RDkU4q - Is9LqLJUAxPtIa2NLGRuFOO7fOg9IhhdRHdhylah1boM7+ElACDDbbt+v9d5qu/L - /GBZIn1pgSe0hlxfa2eAKZCS1cYlpBIKen768hJncKuTzV5LGDguJcQMKaBmbFOH - tCfvNFzWmWZBc/h8xkBpm0Hp9c2XFwcvzTL9BmaOgGzjUbZM8DSwFE+vlg/O7Ggv - lyoi78OEWktVLYUXxSBq3XhVxncOgNifL9w9bIb4lTJLjMVYmughFntHwSZH/8eq - nLw6sPQrINcjIMJEw/LUCnO4kmzrvCgqY5GtDvyV62c8k5nWXhpkl938EX7DZOCe - q5ZKMUfu0cUvyIQWIZly8ZsPDkPz6XQJGu3pifXs3vIiARUJY4qv0iAKRD2u85rS - XgFf4gDAoga+9rJD9Gj4Vhyjps7YmU94588/CeHesl1/Zy9+neRTrHMoo+KqUpC+ - O+CTgW85eVnRT9mgDlLDsFqZElZZWkdn1yJfD9NlhMvswsn/NkbB2yT06HbeKAI= - =Uh/J + hQIMA46L6MuPqfJqAQ/7Bp2P2LHPjISMYoaOOyO2tTSOx1OSN7OwLK6JGEDtrAdF + RS1tCcCSKw1tiwxyKj3KoigovAGiqHuqQo08ycRpyYj3mRERIL6r9FpsfpNg2WIX + 9I0tBjLG0oLvTd5G+e4eWqf/psa2imtJ8XccMVw/eFsEzCRH3QmqaZP6k6CSRjG1 + BVWzhV7o7QL1OO3RDTnVf2oLoOg1FiR62rnd/YWNlE2p6AIANAJpUy09YfnS1BZd + Zw1A2UDEqyFRiUSgqRYAuXykFpsfoAAgVxVOXYQCLhO9P8+8Kxav9jjWGhjX0uOw + 3B8ahrbHO8GyQ0alBvE1rTyKuX0JEcrlbuFyQj4NsUiZe4wWlbpuzrPhOLw4s+d/ + lyyR8u20mqBLv47e1GA/WxTtn5L+6ADs/8CXd6YlZ6eXFEU6X++Jb3MubYOuDqda + b3Gv3RSHUEnktdSXy3vPhgZ/jJDIpiXfEYlpu8Jew52uRoQzfHTlhGJZXs7LxqMV + YA8kA6FK+3RkkhcHBhC+ALczUHybZ0q6t95EDqzH85KmAfS3DdMWWm0k/XziL52c + 7cbUsYuSPD//9l+wC3WA23U+yKbpDShlFQnfgzf3mUilVLiHHwBs37ZFf1rqIA57 + 3kI5Kyl/2yl1snSLxL1ScC3ZQ1QUy1888ogQk2tBfo9lAA712AYxRW3q2lYGW+nS + XgEBiAX/zlU1quBXmF5gfcDckxPe7KSsfXKz6/1IbPK6iLEPzvGb/1043Lk1bFlH + ln6ZtWbByzqX8gGejgIqfxq1P4NhKSSTz9UuCc1fRAIBLOo8SEJw8edy3kcca3w= + =ZoJ9 -----END PGP MESSAGE----- fp: 8996B62CBD159DCADD3B6DC08BB33A8ABCF7BC4A - - created_at: "2026-02-17T22:21:58Z" + - created_at: "2026-09-24T18:45:14Z" enc: |- -----BEGIN PGP MESSAGE----- - hF4DQrf1tCqiJxoSAQdAYl5yJyayyLJfKcs7YoVj5SorGPw8k+39iR3k3bCbSwww - PKSvjI7m1dLxzGqsYIfavX4sYqP1az/ljDxKKgMI5fX2FUGcWT6/MXF0HTLxDPLR - 0l4BbD2ZIYnL39K7vGc0OY4qi/BkPh1xKY5XMBe1tBsTqTHNboIpW5vKYO/lS7bu - PXyFZTolOiZfefybYoD1DEoPgNUCCnnqq+TM6g1eOtTQ4IsoUH3IjZS/QjPy/jsE - =uSMN + hF4DQrf1tCqiJxoSAQdADbNfYR8kdZ9ihwwU0TSBhIV0vYKiXaV6IiheL+zD83cw + w90e0B9v+zlt07CsPKHP6I0U68Hn446U3sV1rxSB84pHsqb/+f0DJLxwvdOWTXcq + 0l4Bzhs4ptFhwWXoftKe60afPoXLoXP4ZwrKJRMNVf+4L/WPJisZyjQTAC7nHN5d + i5c7JVXGIyXVRzg1jNUcjddM1XdBACgpsEwAA6dNUmAOMFoISQckyudXKvIpoGAB + =UDDM -----END PGP MESSAGE----- fp: B71138A6A8964A3C3B8899857B4F70C356765BAB + - created_at: "2026-09-24T18:45:14Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hF4DzAGzViGx4qcSAQdA6Cv+6xrYUOxW2bAlrtomuNBZ/jfPE8aZMboKwHgQ9QEw + DNyPe+JNiI613UlHzi6vZWQyMtno3KX6i29iR9/HfdlFoaXKccqxHXWQjunzjp4V + 0lgBQv1YU0LU6XQfiF2LfdN0KD+A0HbGVq4OKJruMACT7hSHoSwPdz5PnENX08Q7 + 6y5bN8rCj1RNkMVFZtnsWZJ39nx389sJqSDOJ0Krj0RNgPQtxn/vNeHz + =AWTw + -----END PGP MESSAGE----- + fp: D2E9C0807BF681F5E164DAFC5EE1B61CD90954CD + - created_at: "2026-09-24T18:45:14Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQIMA2pVdGTIrZI+ARAAqTQx/Uik2MtmgCTPg+xe3WBzut8tKKFPAChJYrNSXPyB + cimTNFrXQa5kF7SuaEE4YZ1TGxflReaAGjss+IqbKoKLDkyP3anPCrUEbwwDkOmo + 67lXbp0oDkHGVrnutFCDqHp6JnEEpa5W6TrCfSrw1UlDfGAAPIf1rxsJk6v2MbtN + 9J5YIjEkK86Y+8w8J7BFjbjwn0SPxUDawJVUHRmvnV3Ym3z0KxKkAcFHudELGl69 + PkKt4/ffu49ncmt6PIoLSD5YghVUUVhn7/K6EhbZG7O4XL2TNVqf4D8ub5wwI0/q + ktsH2EDBEXlF5jxACm1Xx6NQTt7iWdVRM1tuDcCpU6I7dWqQdVrAx0LKGTTtKcWy + hL4fhLOo557kNyHXxZTitx/VZ8dPdgNr6hJoMdKz9hVRqQj8Bl0YCYQX7PUg+7GL + FLeForgaE0ipurT+i3p4YmL0cdBRzOeM6igGPrf1F6Bjjggpu/HOj8wb/VRkIkrS + m8RbuBEhpx1M39rcg/XC7CCzgpZmGwVOFE72c58663Ry9fR5ral/hXBGEwEP795v + 3ThMg1mnzThwvcHt8JkPJPQ9StNasQkhcUKLQu5Ss4xT4DhgG3ZzuB/QInLsCKU4 + Zqw+J7D1gbwFanYtxoaxToXB40VwN/DnVLloMlDOFOiDzfmMbLqGY5ci8q9LCtzU + aAEJAhCbXAV++AGUpQ74BgqBbI8D3gN62YMzEePCY5u4a9v/HeIBwFfXSsl6Su6v + 5CziGqIgep0IWa9Xu089nKSuvcl3MjWyi3GkIl2DfMf//meXErrqTU2IReo7irMd + woZlOnP3qhNP + =zo9d + -----END PGP MESSAGE----- + fp: 878FEA3CB6A6F6E7CD80ECBE28506E3585F9F533 + - created_at: "2026-09-24T18:45:14Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hF4DKKbvh61jX5USAQdAu0Tsmv9Nee0P7wCNvoDNm1iREinyjbMVlE2k/gP63CMw + uuXlFMAVbrHOEg2cHnRRYVCPvHRlM4sCHZrQmxfyerM7Nw6UL6qRdwFMaWWqYRSU + 1GgBCQIQ+rjuiQtM/CYPGM5PwV1lg5B1nazt2tzHIMGpYswKcNtJ7HmjLuqQmVr8 + Kycbj/C2PPtQmcTQxF2iOtVc6l6eZs3sq3eVKU6jz/GW41Vfr4wY4WTsuurDgy10 + lSonRrLKPLMwmw== + =T6Nd + -----END PGP MESSAGE----- + fp: 41FFAF3D519CF5C039FBD8414BCC213729AF0E49 unencrypted_suffix: _unencrypted version: 3.8.1 diff --git a/config/hosts/matrix/secrets.yaml b/config/hosts/matrix/secrets.yaml index dd8daef..a377da4 100644 --- a/config/hosts/matrix/secrets.yaml +++ b/config/hosts/matrix/secrets.yaml @@ -4,148 +4,189 @@ mas_secrets_config: ENC[AES256_GCM,data:lgfGW/zkJ3sdmXehzEMGiBUjIvcjnSma+BjBshxA mas_matrix_config: ENC[AES256_GCM,data:W7tyChbHM+LWYJYuuWSXL1wg8hKFA6UWHjVFOBQMSnFgguwcE7cg5LSnt1Sr/6TaPQP7+2y0sma0fyKlJ+zcUc1k2OPbJLjsrdjNjz7eMSlzmDESRLo3TBSyNjAKjlgWkEftMZRrrwFmA/cR0PdPchTLfBJnvP2vcLpDPEdoitrQFKk=,iv:FvkXV9emW7l1q1KRk2CP2Ec2pIZfBJ6JlpcIx37mVcg=,tag:p/NaElAD08dSPAWOA/Htvg==,type:str] sops: age: - - recipient: age19h7xtfmt3py3ydgl8d8fgh8uakxqxjr74flrxev3pgmvvx94kvtq5d932d - enc: | + - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwTHIvZ0ZPRTdrc2VmY3F4 - T1NqMWU3NzdKSEdqQy9OOWwyaUErWG56MEdJCmpFUmphd2lhUEluT2NrSjE3YWJO - OVRHVk1YTWQzdmgyM3dmMWtCeUgrT0kKLS0tIEZSWlZGVWpUWHQ0aUY2VkdWb005 - Um1hd2FCUzliUjlvY3JGVTJtV2NxWkUKYShPlhmFB3f/8fSdJKue61LR7NqSW3bq - JsmPKkofk3bzMbkUGm9fWey273nOLG3SNcx+ANDCxJUhOQ8KutaOVA== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IHFyYkk3dyBFRnla + R1FMdGJDd2R6ZFc3cHZwd1RNV3VKQ1JYVzFwZDNvTXI0Mlpia1hvClJzUkZLQk5t + Rm02M3R5c1drU2RjMFVYNFNrall3RjJzeStlcm8vRXVQOEkKLS0tIFpPZGZXWVlQ + VjZNTTFRRC83dUxvb0w2MGFhN3N5TGVkTEpwSmFENGo5M0EKN1rpNbPZQ6USeNT/ + 1k8zXsk7EhYDuuH3ySECZvJ4jZjcZaNhLXgv3gI6NfZR16tLmoZk574yTaCt3xgL + f9SYtA== -----END AGE ENCRYPTED FILE----- - - recipient: age1f7ams0n2zy994pzt0u30h8tex6xdcernj59t4d70z4kjsyzrr3wsy87xzk - enc: | + recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIBQgnQAq6FUSDK8bxtYPjx3oRCAKG+xy9J3Gas2ztJk + - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwcFdrdlhNYlVmYmhoMU9Y - aWZxVVVmOTRHNkJWSVpGSytQOGNSOWZ2NmwwCkdENlRPdnk3WDFRMFM5Z0xEMFVT - NVBJWXo3L1lRNTc5eko5dHdyMjEwajAKLS0tIHQvZkticURkNFp3MlkvazlzN1N1 - R282OFVBVXZPcGNWQllXRS9HTXhobUkKpyfxx4gEcWFX//ntF/pWc7HNmeRIlF4K - DxjEnRn+PJol8kpBqttXPSYr5EydboA2O2Fv4EmQc7l3VQKdncrlOQ== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwQVFMYk1pZGw5US91UnRV + MGtPQW5WTi9wZzdQZWx0clBKcFF1RHc4cGhBClVjWk1na1BpSmE3YmtyVXIzaGNI + TlUxdEZHS1dGV3RHSU9YaWxpQjFmRmMKLS0tIFR0TzNZTXdCOXZrNVVVRnd4bml0 + MGp5RUJjWFVwbjA4Y2xacmtEVTlpSE0KXx9x2FVSl+4/sWyOzX50Kk/NI4NBRbdu + kvJuOmile3PgxeZrG+KL7cEps6oJpBfKMmBev02Z9rMXJBN1kuDcDQ== -----END AGE ENCRYPTED FILE----- + recipient: age19h7xtfmt3py3ydgl8d8fgh8uakxqxjr74flrxev3pgmvvx94kvtq5d932d + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnSE5ZOTBOWDRoRC90cG9B + S2Y5VmhjTnJvYzdVRkdoTGhzRGxnOGRXdUdnClNFZjFmdkxPOHROSjdET3VuRmNP + cjNLSnZycStBK28xVDVDOG9YaUE1Sk0KLS0tIG9KL29iUXIwVmY2VGpiU0Nkemdy + UzVQNlMyM2piMHN2MW5adzlJVXppT2MKzkvjVN63AOQnHe5iMKh3uHeTBGUuBkXi + bDyk/IEwE8QLK9sLWtxXSb9zX8b25rR4F9zePXvfyTRSf2P9QPCoZg== + -----END AGE ENCRYPTED FILE----- + recipient: age1f7ams0n2zy994pzt0u30h8tex6xdcernj59t4d70z4kjsyzrr3wsy87xzk lastmodified: "2025-10-12T02:48:54Z" mac: ENC[AES256_GCM,data:xmxSQJ75JwsMPzPIGUgmtijRre7HnU3wpCvaPJo+XVXsC3wRnSwhRGc38DWxKIljx9HAKGMXV+n0iT3+bnTkeUNYGaUMROs82cyfqxfCd9pn6Qi9ytUb/Oec+oignDlojg8sMKZJGyUguN9sdSRootgSe3/Z4Di/IxhXhW3cDZ4=,iv:cLtqVhLcFxrlzFim+jgVpFlmJaRzmm4zdPkRCKOd6CE=,tag:MnZrm5lwYH/7YEjG+vCIKA==,type:str] pgp: - - created_at: "2026-02-17T22:22:00Z" + - created_at: "2026-09-24T18:45:14Z" enc: |- -----BEGIN PGP MESSAGE----- - hQIMAz5uSgHG2iMJARAAsLBqwVkmgFjAHkgg1Js4o1G0wxf4wSmWfBqGGlQYzuZo - Wn/RojGmly81Vx3GYc9qC9+H+1UKdOGOHeAeBftaverwJdpAay/DdAKaZ5FJxI0b - OgiACiQxaaSTVLAPIZYw8xCKkVItoR6i1M4d0GGwr26hFNUgj4fSdVR2348KFNmZ - tKZIDipjS7WMbAW1etMdY0oPRAxQfhxRVp7lW/Z2bJYbmnug8FGaj5EwzRrSqGrI - li907EswOElX7YijnjrJ2I2B3Et3sHkwxq9jSEZX89EBHJbwy+fFWD81oKugDkwv - HP6a6qMhYBmp9D+hGcHAyyHYXmdQa6HXSv7PJvicHTAQ0iLodPEFz+Z9gblHV1Y9 - xq0ciM0N8NbTmGl6JOfeg4dB1CzH9N9TH6q/+Yp+ZZnMJfzjx+dV89VCPvt8KAH2 - +fj5Ru3gwGD6NpvNP0aDIAIygzlJE0Q1b8AtMXzHNKfA8jlGqGalkNM5/Q0+rJAA - IleUVMXJz07o8QvrDZKTq+FYq6qbcPFGjvV7c9mBcW6/I6rT59OLiX/eJHbfvUAE - SrLpGDi7kOOiWlFmALLG7+pj7XNxxNlmeG+UBWa0ZEMW6onc5HufjpS6FkPeSfAQ - dXSHq2wamtt1o6B3TsBmZAliZ7b/DbFKTl8ErE/XnWGLNAMqJD6pCDtJSwvDpC7S - XgE11hisql+hIYGrjXrHe9DeNtgZlKd6sYQKGhaMtA/GeH933XVXjA3NsN3GyXDG - MzJjKPkRAGCfRu2VfLv6hnqjzREgsiBpS+XLitZezW2/MtkEVvYN9BwWbe+MUsA= - =v4J/ + hQIMAxK/JaB2/SdtAQ//Q6+QM2pzG9Oh9n7H+phGfX35VAvwl7qZ4FGDBMdZfRZz + seVfBexuL4o8qnVV33WAS4Oh9fUSK0mUHY4DlSc/IhZ7YQt22XbOj90qBj+EDaOj + qJ5lulRaN+azlt4NomkyM4nrXs+M6bFLby4wWQLrLN5Eu9tqK7CK5Z3UVtYTkML0 + QMwRP0IH7hdKT3NhVpFL0sXDa5yq86EW3Kxk8LSyepIYR/6qkM1MTDj3br4xjBT7 + p4WotIJdjYHuuHvTfbVEN6g7uZE+Tk1Ss3m5rxhdwCbNlmSqnwqx/AXcTE3NsuoW + ziIxcY7x9ACrV6rcIgQLTBMebwh6BedlqjTZfrJMkPz1n0SHqpL0Liz+Vq8phgeo + o0EUPDvFKIcbDJQpIKRb+iSy9WzeSON8GQPd06WFxD3IwHFoAWFdImb1FERwGIym + vEy14JGXSGDScUwrgjeDW9APoM7oWPtjXVPHnIcSQpt7cgn4Nse5BoYBQZZt+7VQ + HhYIIByIxMBYG6K/3ckhHVc3MtJEmjftE+dSXYkC4jyJtwX63fTEw6D4soiUf00t + 8oGSwXtecsHQEmeKx360Jk989KXqpbo0i+LO2WjU4foJ1X4MaSllwITz/ZcnQHRz + utjKN0d2VUf9K2DP5CI/GKdMffF8bYodmfT7H3zv64bfGMggOujnhjoqK8wgEDDU + aAEJAhBcl/7ziJ325FIQRF3Nl1RDv3mrlcuuXMMbU/MqpQ33lLcsERYe/L+92QcD + OphOuQ3ReqkrzwxjglT2V5ylXUPfZnwM/0Z48a/xp7/zNfMRD8yfAEGr+bkpequ0 + Zvx0zXHY8AwV + =HV9I -----END PGP MESSAGE----- - fp: 18DFCE01456DAB52EA38A6584EDC64F35FA1D6A5 - - created_at: "2026-02-17T22:22:00Z" + fp: EF643F59E008414882232C78FFA8331EEB7D6B70 + - created_at: "2026-09-24T18:45:14Z" enc: |- -----BEGIN PGP MESSAGE----- - hQIMAw5vwmoEJHQ1ARAAuY3IZqvQw2evpOBN/A+15eqpxK7uS8YCzxxQC9Bjn4LB - kwO1b7eh/Q3mTYAG4Xl5tix0Q9uOFM5epftk165xCUu9p388V4Hgx/pGvn4ODhwH - AqIRdXiv4rOp3uN22ZLQPQE9hdLIg8AUK2s87R/vUaB79vZttY76N5ucBDRB5KGC - tPQvggsMi6vCXs59o75nlUbMtVTRZMvERwf+0bv809vGLX81QaZUItcGZyOvpM2t - qhRjYZCI4g7ZDLact0nJA79msJqrjSBsMifmvcfUFoaWps7P1S3DuvBzd6tt2dzU - LKwS/e0BLluawwla9FdoPXy8Dd57zPFVnO0FmsDYtC8qZGQl4BiUtQqvmDxrVmV8 - VvcBMdyyLWyYbCvWLqpxpAN40whis2zGkfN3llK5G6SAhIqhX/KnlOLmIj3HN0pm - HuAls9/y5pebxgBFrPdhYRvsxehQRGmffjr3WW2Co5o6y7Mazss4KLO8FiRvfbRa - OIBEkx+V2CokjRnNnCaOFgBbpzinabfW64eP/6F4pTcYerRVp/EEgioa6iYA5kJE - vPjc6QRh15hdjLKpdGXOFS8JLMlk9mrTECmuQZNb0Uo2BJtbxbOqCMSdX0woF6/M - zRNZJfTvRtaiUFCCXOyU3RhMtqMK+Qwbw57DMDklh2qHsAR1UpS6k9RtYN3j3PDS - XgEgaPSPrGE0E68ydgguomvtl/kVS/P5GGSo9DQ0YhXMPyBV/MIkMD3mIpNmbEbn - nDNtvDvOjCdmfEotALsWs5VeRTqO9J/GcpPxC/+b0gTIvAjnWj3ptTsz11Jnf1E= - =Wkdq + hQEMA1QflAioE8i3AQf9E6bfKP4QNL5Hq+MyTeDnz3ij6V71SCL4gxk2Ar7iQF6u + Or5g2w1eJBt6h/DSvtXhlFaqzlXuItMeUFi48a4D82beM/46lrWVKFJtKrinE6ZS + ornW8TVNhGmo3T04l12efnL6ii/AyOnrGGiHo+69s9b3Yc5+Pjue+BjBHi2a6/qf + rccJzbMe5EsjLNSkEi+zr3QPXRKzl4BzTD6yDCI2ulIHcQguh9B4jWZxwx+P5zk8 + 8cTjbv5ZjtTa3IjuWnEaU6JEu/rSCTYKi1Oj4jrnCQ0tQvu6yvRpfnBdIAu+82yO + L5TLG7nC+iAiC7wN6V3FgdNH7DUGFKTNDMZm7llVU9JeAUD+yhTNHpwqebzZ+xWQ + hnAe4ytJJugK1pJ5QHFX61+12fe8aLjsHyJt+oMKpLi8SCIZjmMgf+cmAE6YBiK/ + 2/VxgewGn2gm55SqKJg8aeHt+k6yMNoAZu19dNA00A== + =4XbJ -----END PGP MESSAGE----- - fp: 87AB00D45D37C9E9167B5A5A333448678B60E505 - - created_at: "2026-02-17T22:22:00Z" + fp: 21C9579E6503CA815A68ABD8541F9408A813C8B7 + - created_at: "2026-09-24T18:45:14Z" enc: |- -----BEGIN PGP MESSAGE----- - hF4DerEtaFuTeewSAQdAWCQaHsUsVRZ81mhzxREzdj0xMReLH38JmXu515OSFSUw - 76iHcTSqMeclrg1Uio4xhGTctSMhAv2t4yic/ocP6EYNsM4yQUsBLtM+xm7Bu2Qu - 0l4BXcl9T+kQ+xICQySM1g6g+sHxrKCgtzNB22vG/jqeQatdh19OOWlibCXhicTl - Bv4qKPSBGBdk9KYwAN9fstUfmbGX21E5DXJlFGhfdnvWIh8biw/0aJ4floOk1st+ - =dh/i + hF4DsZXvxFXTXoQSAQdA0lS2szzIAtKwWDwVp0WWJd4mfd8P2zQc3dk6+HwglCEw + O4R0tpsmNImmeMss/lRhswvTeFGh3aa5ISCgftJ//nDM+Jvq1QGZOxCKxa8vQHh9 + 0l4Bg2qErfMMhR2iG3gk8oAbL2WRydX+cIR8OwrKDu7rjyfW1JlY9Zhqf97ZfuwZ + e0wVEQVnb4EsFX4VVMetTbQcD6TgtVpV9U49LZe8YqmN26hdfK/A1ZR+hNLAoTWV + =Drsm + -----END PGP MESSAGE----- + fp: 9633412309CCB83BFA39BA5F2FEF746201D7FCFE + - created_at: "2026-09-24T18:45:14Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hF4DerEtaFuTeewSAQdABZzQhnIdn0EuEhxi1Ch2zQbHXPVLivQdgvQe8qumNU4w + y3OYzClKRaQNdzS/0OaiXyDRS5+IAbYTQUokxcjlayQYQDmseiaHYAjqP/OiLbSs + 0l4Ba8x5iq9YvPaaEWqXHsFUlJpmQoY7vW1kmz+yECCxx2TFjxL8n9fHPTMe1Jg1 + OgaZMrQjc3NWcRcpYPvWmB8cPEm7PZEx+pg4KCpaoG0a3YmSDr5xk6wwjgJ6ULo6 + =islN -----END PGP MESSAGE----- fp: 057870A2C72CD82566A3EC983695F4FCBCAE4912 - - created_at: "2026-02-17T22:22:00Z" + - created_at: "2026-09-24T18:45:14Z" enc: |- -----BEGIN PGP MESSAGE----- - hQIMAxjNhCKPP69fAQ//VnKyJB+ogP2eCVpjvzkXs8ip5xe1aYj06M/cIw8I8Awf - aVVBo3DTYGrX1ke+E0WbTvwbd37T/M2RyYHlFQclIfnZCfa12gSrg+5ggInZGRl2 - D/d3Zxdz8HjML5DpXGQ3dLGi1SbWn048gmdx2V34JLWvxu5XpOMv1RBBLcDIoqVS - HWGa+/tXAbyT9xwZJAOEVErlrTWXKyCYPLsTL89x8E5jqPijJoDTFle2G8+uv70J - /Gn2Cs957jFocPrZEqIDVwkf0jgQllkTELTNq08dm4wqCHbScxLgUxUyCSobeCk8 - yedGAJ6tFrXywUb3fEoKcnGF/5TG+3XatJC1aefsnsBxAkDT8PX0nTlBxhHwu3RO - IEBtlU5icVKenRPM3mFEkmEIR3B3+zONLGJ+8PqbZ6OCZuImxHgVat8FI+vXE509 - 1Dd/l54an5jskXpqreDJEDfeZpeUYkMMxjHdg8x+ilZlxMHoi+NeF9ocEfTrLA2y - U0bUguEmqW7thA+J6bcoJNHlXsd077+97mN1l8paBctsllVwzZYoQp64ICAx7PPY - N9GvWBuupnbrWxMS0nnMpF0oPKnN4tknflrC3ZacPtscRo7BISy0RHhvJG3SZ212 - eRCM/maYnV8omAaIMuFfbuv45yPKkLq1MPE9NID3wGHkJqmIpm2ggwA0A6g/h+fS - XgHmJuXEV6v9lxtaRD4iFsbLL3+hqfVfQ9W2IPbARNbOKIYplgJu0tWw96y6fnIf - R1h+z00a84R27N3NmuV96Vyg4TvWKTAmWZzmZYIM/QfzQtMszwQ9PWOUZeHGVXs= - =TcqO + hQIMAxjNhCKPP69fAQ//SCCveu3FVKIJep3wW86VLVl0Cd1h+rK0JtrkPe2cfLO3 + zXy4dBlo8+fkXokrnB0hhYRLwlrBLC/m/nptuxuj9hbjQE84TUb2cbd/7s5KAx0G + H5qXxYbSqy5TTAoMS7XoJDlYsBE0aQWrOAbJ53AmykByUEpmCutmlnMowvwjn9eq + vAO2gl3ZXEInxo39R6NxEdcV5sZmPcKt3QJi4pSH9mk60LaEGS7L0QL/fqClH5jb + VEh4HUmnA9i2pkZSsMzotyKr8VCKjqCI3bP+GTSI1n+RaMXxWxL1HLEqTOYdTx5a + OBTfk9Z0kbnevOfr3Zm2qU/VlnPDWPKdx2+4NP9Q+bHsx7O3r8HQmgOGS6kODTtx + whWaiQBpNCalrD9ntFqCZ2pz9wKzqO00SDUFEVDu+1puk2FX8RgxdoScw9Pgq5Ua + d+44fOcEtsD9e76p03IhHY7/ridJfd8F+gPqqPoQyPP5Q75tlaCnI18J6hYVQc1U + 8OgxwMvHVFXCYlpGMFTj79zLKWxH5zFzGN+uO/SbzL5xpsL78aZP0fkoJa+TR9Zg + 2fnWnSIFVoloROubrgutaTQH3yW9Pj5m8n12wXjvwJ3NofO7kTkH/xq1xtBZBKLd + rEmpf7Xr24d+pOKRh2c8cA++l4If805ohgSsTTezHPoG/MaW/Rmt4RmrWcSUOvHS + XgHlyoKANKEtnnKz7LFhyW/tP9tl2tMs4dJdGukuPEZa0AjyxvoELNNiCQg2angd + N7j2MPHesHeXEL3f4/FX26G8E8PiAw/OA6fc1JEQDvBeYSWDJDPQAYznM5EHBm4= + =/MB8 -----END PGP MESSAGE----- fp: F38C9D4228FC6F674E322D9C3326D914EB9B8F55 - - created_at: "2026-02-17T22:22:00Z" + - created_at: "2026-09-24T18:45:14Z" enc: |- -----BEGIN PGP MESSAGE----- - hQIMA1Hthzn+T1OoARAAmnSREMlYFwDLJ/9LoUAO2NqrylMZhIPvwU7HQleKe7u2 - cdhGZKXbPCMLlWgCM6Z7wpVFeUT2OPI0vkDIL6NNlJ/l09j6CunNfWY/4qKc9YzS - J4I0tfY/cvnDRQrpPcg7rIgM+ukxpOcxmfc02NGqK8EMyZurFNmrmJLdob8nsoIl - ZlyPHMEw2KuSzDsX688OzO9HozcHAJVlG5Aw1lD4TCq4Fq9HTPRnmq+oem0gteDT - VZ2Np+Q5zc1NYXU36lmkBSHPAc7KDIplkc7eC1g8w56xk8mMrrEwz/qUhgIYNQ1L - wicf9nVHxaIiPdUpjznL0yGJS2BEbFfQPV9p1dkKX+X+3rBJiVXvGWzlIT1v5AhA - ixXNMYjwpQ6hgytw372q2FltXAcwSggBcmIIgq9DNHP9YtCmI0v3jfu2ZY7HVJNJ - MIJlozlrUrzKjmjhNUXjAjct/N8rKkBtjwruKWWaPERFs0OT7oHPjVphTHo1UDd3 - OhYBZ72cjYCDZyNYk1z79OiGey83o9JAFZv3yWx+LDVJ9l94dGkO43ONXOE50aSE - VSvZlDL12IRg47b6gm+a3DtP7+8mFMaHhvCxNiOpkoFZJQVtZdoFXtwdf1ZAOUXa - sx9tdnWLLGEAR6d9MFXEYyJx4ykfp+Ew8+/eo213ZL4ns3ASGw0wGw78SQebUn/S - XgHeLtKQqx5qhIRcFz78GMZZUkMyljFVddUz3rMy4npPRQoGkyJYiY/pQI55rcHV - 8ShFKDpZurafdf1kEk045SqFzwWvubet+k3VpkxPAlFBlLwstpvz1CQpRqhwZCk= - =HQM8 - -----END PGP MESSAGE----- - fp: 5DA93D5C9D7320E1BD3522C79C78172B3551C9FD - - created_at: "2026-02-17T22:22:00Z" - enc: |- - -----BEGIN PGP MESSAGE----- - - hQIMA46L6MuPqfJqARAAq1tt3Yc0tQ3alerxjWUNSBzpa3Nq5W1bhZ8d+qMDWm8f - SsIBYUMNbPHvWOA6tLIzeMBIoBFneQwWW7fw5vpGzaATURTaMiu+Ws8Q2h7JhYaH - cTO/0QLTNtrwCMJOWkofgauf/3eQCwz+QNBByULSMESyyxYqaY/Sp5Vkfp9ddNUc - dy6YOKWGwxpUU3OrKvSeO08aIXL1dpw2bVaroOW34xf1MPBX/hEV4ix1bfkPUrDj - Oc+kXlCLrJSf5TqQhiYYOijRWCNmy31b6ww03mb5OKOHbs4zGAs6Wa1KFxy3b5C6 - AV/v+JWHMOBvbU4jhhrIsPXUzp3AyZfTmFbOFn8LHQmlB4wS/poEU5qczJbzVsyU - OlZE8OVsdLDn7KvjoUDk4PClxLMk8LjQWDdoB9XxxmCV6jtou1GB8BPecoa2zknT - BSzC9JDGmoKnXk53YiPe59YNTs9Gxk9OeuCovmygaQbKXeKNe4eg+3UH6Kd6Illz - osSutJjTJC6dkq8oV/7YkMgDodNyrVE6QqrY/F/FOMfqzftMfRg5S+B3NFg8r5JA - sgxxzGYTEpWv0PlK2nuWo8M4tWoso06loMBfRR2ViNmOtCvu+TDHJLAFim+yJOk0 - vzGifrUzvCRysvfXLj09gWPCoG8mNWLWD0xV/XiKLzE2cONRXMbuFeqqBdxkDZ7S - XgGdbwGy/jDBXe3422JPimFUhUKxTuFlcinjL5BhBUnaU9nKtvKj58eKoyfjPPfy - NpbR/flIJrQyoHpe+DSbkB1x88mOINYy8STh88MPAdvnEMqiYMH7RBL8hEfN/JE= - =zAn4 + hQIMA46L6MuPqfJqARAAkx1/qDlCyaYOTWLMBeXs1KwkYlMZWHGsFKwlGnOOx57N + Jv4rzRGsz2kEfBTl2zyEjKU7f7PR8zMuzHLxcfhYFI+2x1ju9TR7k64Isad3mpPT + gCt3NqJy9qp5075mJtVjY4bG50hXydPOsnw/d4aO1Mv8DWdOGC2Y3AmXgtqL45jf + 296piqaS0outzMK0vc2X5/1jBcHywdSIHlHsJcFV4O46YIi9G00hVIgI0KMJbUNP + RXWn6sX/rGJ7rhTXGl9/P3Qktxyu7q21KYKj81blpeCb+K86N0XfCYcLY562CZ2d + hz24REsYK2emtsDplVPxzzKulYF56FZoWC4xdrxic94jf4EQHCZMksyDAg3hwJZ6 + 7nceELAgMtJUfR/pPAncBsLsSh4JEk0z0fBmYm+0i1KLTaMUTNLZ2RxaMkMnqRid + Uw/N9jMknV4wIlQDt17Hx4cU8/vfidFlFg4KMCMACnBiEtnCNctmIcZIeclkM2b5 + ZQpoAWFJcp3OwsLvYQeDnhTahdoLYsWxF1+3j63Kb6ZYDSMQyYAWswdlY5DlIHoY + vhVdtsj0ZgKwcT4rfIfDBAYFDeCtxfSPl3r/TuHaK9IeBg2AJxPCeDAuFNsdKMqT + eH2XPK7gzusvPl0ftgmAs5awOMq1/cDUr4LZl3ktHxtY7m7UT0hGQg65xrxmwOTS + XgFkAkiGb3z08d4PVb1pEQjO8vu4Xi4czLq62eQgt3zt0TATFAGBKdRuzkSiUyG9 + Q83yQijtAhNQBcW7Yncde89A/dStODUXDZPso50mHscKG64Xlu4zSIXzAesIw00= + =jn8U -----END PGP MESSAGE----- fp: 8996B62CBD159DCADD3B6DC08BB33A8ABCF7BC4A - - created_at: "2026-02-17T22:22:00Z" + - created_at: "2026-09-24T18:45:14Z" enc: |- -----BEGIN PGP MESSAGE----- - hF4DQrf1tCqiJxoSAQdAE/M7osrxnQX/N0eV4PzXqrzXLtblLY+Gr0znYJSpPiMw - Pw6O4Nw6u8JkVgZCo7/lG+Y86bsI412vnZxiq3pERlxQVHgNea3ArfbM7y0fH/pb - 0l4BQkt6yleg738hV8XY1hbJG2xruiw1p+Ts71v2qaFpSazOyz0RPrIIcWelJjkP - P5IV9g83IZMv3AWEGnUByACe8VpWJlFJ578tYtJIfnhsrDryCBubQ0gPsXGqTPPI - =mE/U + hF4DQrf1tCqiJxoSAQdARbiTXH7f2RfRmA2r0AlLBuf2O0Tm4+R5K9uSIyjuMAcw + KQM9BhxvwcMq8b1gueFxc9KPRqGWErgBlJm/cSDeiTRqKQDQQy5TqzieEzHSwJGH + 0l4BBsKJzalQmXj2SRET+OTURGDYcZRtdtS5kM2x8/XH6aTjl77VLzt3o1P6A0LY + mwXmwEdy2lbpGxlST66OjJmprMbkvRAeG2C8cwxxLD9F+Xijif3fsD8XFT1m92Tm + =9w44 -----END PGP MESSAGE----- fp: B71138A6A8964A3C3B8899857B4F70C356765BAB + - created_at: "2026-09-24T18:45:14Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hF4DzAGzViGx4qcSAQdAKaXe5ffZGu85ZTuLCuAcJjIVbS4jpoxc0bP2zghVyhIw + S1FO7nwMyn4gngmJw+6aHUVZ9K2eGctVMI1xeRnk+gv/kw/TT+bKC+5lJbcTrVPl + 0lgBwW13D1CnpukBbBIF/Sn8YV/58EZ1ORXf8dk47kPyHao4ATOetwxVpHTFN2ha + L1tiR9F2+EvgRgX2uyXStzIJ9bRVeWFZwc6pTMo6Hy4wWXd+MSvG0JFj + =MnQQ + -----END PGP MESSAGE----- + fp: D2E9C0807BF681F5E164DAFC5EE1B61CD90954CD + - created_at: "2026-09-24T18:45:14Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQIMA2pVdGTIrZI+AQ/8DnoVmNOeanDM1qupjs+5aRQx/J0WK9rAaaNWEQoWZCF6 + y40rD/IeQVJtr6fWrfaFSLEM+i7rpWt3drXEnlDTrZLxlsPlg16covAMq9D1NM52 + V8bz5MUfU3dV1Z+1Ov3OpatPvH97912cgRu3USvx+5rNQB8SEA+p3tmyIGhRXYD2 + ZdwcegqY6K79OXsttuF+Z7o4Sm59I9/itezzXwwOPTwHANPn5nC4Yoj5DPrC3Lyx + DfNlrUKneR4Vx/6iZoZxKQ7xp3bUlj+/GijP9jwvl3oxsK5FX05CO0WHh+ivkQkB + T8G0Jmkjag71jhD1uN7sh+LS0wVbT4G2d6f63gGnlLgJYumGA3LGE6momrpLn24A + MtdIDwMXP6HzpiPc4nl48z8xk+sOTrKQNS1AcZg0ghS9QQSN2BNQjOulc3h6Oako + jKUHmGJwK1tc/yz10VleK6Ato4MkfZtgDY9OKPDDjm6qHyMLpNnafHUxJW7xvfTM + n6HS3KijQT9ZG/Wnfe40SbTeZ/bVaHm7Kd8JF5j4ey64iUIPOPgzZ5o6vONhail4 + iVJ3W54XQqinzx6EQ0hEVdB8DDR0XcV9SZbKOrmBnB470SbCCcENX7Jl4CK0pL0P + 6SokTWOwPX3ZVojKxtxWhcJ4vEfK7rl8oNTOuTRcX4ia6bE3br1PaCWR6cixN1DU + aAEJAhD0SxSeK+U4ccQYvtK3owFgaTDjiV6puGGiSlTLXUHK+xebeEL2XBBRBpTl + rb93QHfA8c7AIjIsTvrQuzM8bKHVDSVTluTmERPmW0RtV8OKnbi9Cqu/Q6pEcsJZ + 7kbc0pvzIRa8 + =bi8F + -----END PGP MESSAGE----- + fp: 878FEA3CB6A6F6E7CD80ECBE28506E3585F9F533 + - created_at: "2026-09-24T18:45:14Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hF4DKKbvh61jX5USAQdAkOSps7psNS8n56p8oRw5FwPJzpwy/mzRP1vmzp53xmsw + gI2gka7Asv9ujumXLQSP5mlvaLp4G2NZrjUNO3k2f1sURpwYishBl35ae2H2Vc2s + 1GgBCQIQneuitb5Kil+z5ukQNZQphYUNBvxAiQ/TW1e7LcyC5ZhOsiUDXS84AlWt + I3Fc74QuCjUAW0PLejiB8jqt6qs7DHvFO6ismBZgUSU4ABQwN55DV/E7yTiL767n + cB5aUeyqO1Ukvw== + =Hn0x + -----END PGP MESSAGE----- + fp: 41FFAF3D519CF5C039FBD8414BCC213729AF0E49 unencrypted_suffix: _unencrypted version: 3.10.2 diff --git a/config/hosts/penpot/secrets.yaml b/config/hosts/penpot/secrets.yaml index e3d6894..06b761e 100644 --- a/config/hosts/penpot/secrets.yaml +++ b/config/hosts/penpot/secrets.yaml @@ -2,148 +2,189 @@ penpot_backend_environment_file: ENC[AES256_GCM,data:+MJbbAjzslBIYlQ9xe0VzM8ON2U penpot_postgres_environment_file: ENC[AES256_GCM,data:VT36kHkRH8ghnU1oyPpAQZW2LR8GNmG1cQXVjU4f+rGy9hViTivd7qxzMusisy7IcWfVaQuXFvUCT+pCMD/fhSAQZOY/1Rs8LBXJtsuPButOG9Q=,iv:pUjAkvvHjsnzn0xRRmdZXatOgLm9dx8Ggt7lEfiQllQ=,tag:FZRqlcxQWu/FgnJfoukIcA==,type:str] sops: age: - - recipient: age19h7xtfmt3py3ydgl8d8fgh8uakxqxjr74flrxev3pgmvvx94kvtq5d932d - enc: | + - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBicGt5U2pkOVoyeEVrWUxP - RG42SVYxMmhjM1lvaXp2a2Zwd3FNL3l2bUZjClpibFhCT1JtNWp6akpIQ1V6YW5L - SzBHd1lPais3eDQ4OEtiYi8yeGVZK1EKLS0tIE5TeTB1MjFmVVh1TUYwZ05YZWor - aUNxU0xKVTNScEl3YXEvZmlVcHh5cjgKTwC4QsYGq/6Z90oxfYakHM0Uiym1KaTP - UcigMqnMlz3z94/cIHZKF+jFFRITq44SiOg8/yAMmR+MPtbTZ5ZnSA== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IHFyYkk3dyA5bkFY + VHVYS0RZSG10RGhTT1dpQnprcVhFVy9KVlVDS3dDWjQzaVRxTm40CmhUUldsMjll + STl1ZU5xRjJJQ0FNVkxCR0VSVGM4bVpkUmVVSUhtU2ZHVGMKLS0tIGgxQTRlZ1ZR + R2tjL2R3OUFTdDFEMnNiWi9IYzlZTVFCMFhxekxsVnVkaUUKSLpxdEHOe5+IRByq + vrH244bPEoZ2aHoVK4PxSSljWsvRSvtpYdH6NVdVTUIfkzlv3MuGQovQrt32G8OO + IakrQA== -----END AGE ENCRYPTED FILE----- - - recipient: age10ku5rphtsf2lcxg78za7f2dad5cx5x9urgkce0d7tyqwq2enva9sqf7g8r - enc: | + recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIBQgnQAq6FUSDK8bxtYPjx3oRCAKG+xy9J3Gas2ztJk + - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1bVFvQ0xKMzdKY0MrekRp - NDJ1TGpFb0RJQWJZSys1ZUE1N2JYUDhRUzNJCmw4N3FKRVZ2M3FtdFlBZGZscVBj - NGdWUDlPZHI5ZFErY000VlFsVUtLYjQKLS0tIGo4YmZWRHF5RVpuZzBKQXhrdDN2 - UllmcTIrNXJjcnNSS29BMWlSNkhOL2cKaPzeAO5y8SiU/Oupf3hVbhm5qlz08Z16 - vaGXmMv/NjhSM2Xevk8BYuU9CH9rIVqNDiQXBKeIVD6VhdtoJV2pgA== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4aDNod1EwdEV2UGp1Mm9I + bGwxNEFMZ3FPVmR1V1k4L1IvZU0yZFlzR1RzCk9rRmRZNlM3R214QTB6VjN2SjJY + aHFhcWs2WGZ1UHlSSmxxeFNSM2NOR00KLS0tIGZ5VGY2SUN0MmxhQ3pYam4wWlF1 + bmlhK3Y5SWsrcXBManhDWjRVcFNLNUUKKQzCBmLytcDdcHIfGmB0iymInigSeKQ8 + UM+qEHMCLxmYA393OBJOAiaZIS5ECjH/cBqQ9o3eRYV9ul8nbX7Pdg== -----END AGE ENCRYPTED FILE----- + recipient: age19h7xtfmt3py3ydgl8d8fgh8uakxqxjr74flrxev3pgmvvx94kvtq5d932d + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4ZzhhRnYyMVZCdzNNZlVO + NlQrSkx0SFExQlNxQjZPclpZWTM0cXVwWmxnCnFEcFJqV21MaWF0Tm1kRE5uMWdO + T2NCRXBlSjFJN1R6SVhoYlJPQ1lrNlkKLS0tIHd6YzU2WHZKWmN3UHBCYzgwNVdz + V1QrNWFsbURzMGJ3enR6TnZCTEtaSFEKT3xVkvQtdAuoZSIpaMWR3txp3ofZox9B + 9PjOz+iUSnCMFF39Of9LMk+vcnXWSkwAvANxZF7u9naqRyzmuQ0q+g== + -----END AGE ENCRYPTED FILE----- + recipient: age10ku5rphtsf2lcxg78za7f2dad5cx5x9urgkce0d7tyqwq2enva9sqf7g8r lastmodified: "2024-08-10T15:40:27Z" mac: ENC[AES256_GCM,data:hxVxH/BBwYcvbtOH4aOUnI9NnbCfAGnnwE3VQBJBJliOWo9WHm/hx4Eol4vaS+AA2t6AUU7UmzjofX2wSTbqQliDCFCSgbpMofDXP7tmlat+M9Du91fQmfOibzCd84tkqS+TRTFCFX83LmQ7/Bb2mHl77uGVAFYyHX9+IPPEUMw=,iv:w2Rdl2+o7bZRQsOogU6U5DK1UuHn+bL4Ouh3XbByYHA=,tag:6sqJal6+kzk0stP6vK6oOw==,type:str] pgp: - - created_at: "2026-02-17T22:22:01Z" + - created_at: "2026-09-24T18:45:13Z" enc: |- -----BEGIN PGP MESSAGE----- - hQIMAz5uSgHG2iMJARAAynwvOJFE4hlU6Cr/HwoXK5TqrsdZbJjsK0dBhMJjZCXo - mQiGbeCmq6ut9LpSL399eXSuZ7MGzk39JBQ54PXUeB/3K02E43tIAzPIrJGXVW9n - Z9QvdAk5B772WgjjTMN82GeQ7xGTp/KJ8MjNvob4umpqYVvkX7CN8glvldHoeqbH - oBwviYU2YEnNgqWYCby0OvwT2Ouky8QEXiKwlI0fUfGd3EHtnLCwegouAUUBKCqb - 2SMPLpSFeJuZiGxTsS889CJWMQxXdfqVDS3aedt7SJP8TyqdDlIIJ+fJ5Vt429vN - Af/drBfpViLVHXHh3MQNF5kQXgLt+LSecuj9ubZHXLNm34nw0ldtjf1nqAcsMDRY - gM3FQSuBZUU3vpbisFHzF63tiotwdjQf2BR5r9McnSKyHNHvd0m6DN9l9W5xNlKC - Sdf+cuQOdtsYFxeGrkl7j3uvxsjEyfPJ7lokfRm3vC43GY6MoBBjVqUIe1i4ynUj - nLwtps6AkiTyhkDUXomCqKNiZNAGwW0VI2lMgnva/atWNI15VuD3gOU8TrAfBRcU - vpD82HhBGvyYgcqvn8WWwkd508OQsAHlQlZbp+ZFjbPgzqriSBCv1Z6C74Yhw1Gg - vmfcCCRw70Vmz0zXC4iWJxxFH4SUla7YVOCdwrKhF/6thJSfgQ85bsFkSzUcvV7S - XgHhXgm71Ah6fFzrkOTo58+8RJBwXYGhcOvotq0owzuski4RtdLKWTtC4cT0oMlR - hbziNLYPYo7aogsZ+FxYlkQ4YTleKJUkrUuwBPYqYKZsbCG0un0R5yQrf4/hlfo= - =ekfn + hQIMAxK/JaB2/SdtAQ//SgjrK7PsMLCHFc7edKoH4mUncr/7YVostmtuP4VXHdyJ + s2/pmvkthcPOcAgmQmdxZtOQcaMgwe0RP0SOP8k5D5xwosFuzVAXS13BRiL+/tRX + bn4SdU0y40Mlz7D1YazTwERSMcl8GyQBig6rQFmcXlyjYyZ6T7udix1hzadSuLTB + TAZuKGTQQ4MIspuck4ECE3IZjxX1WJdLP6tKbm9lUxyHGoaoNjUbZdesZ8r5+i28 + YDYOfejBHRVpAuC8UeeqK2tI14DvbZJxOHvwUPKCjUEBGx9K6OvXqNb183aa/dvP + /64Q1o1tg2NcYUIYTAz7EXf0cElcLs+Obob1aWwm9szcPBGz9A4eBcYJOLIBmAJH + Xdz16XGbekG+3Qo7DtMLPgFgLqNiZH0+zrB1fREhoLcR1abuNr4JQcLWo3wNjjks + 65rLrBgIZqm/DLxXiNeThlfINXD+hmGoq7Q+b+yVNorb+OKJ2UI05CWFwtNd7KGn + YD/BPAGhlU2XHuAMW1gXQa8YRM8zgqidPtiQ/f1JVtqQ5K1q6hrLdsqffTGzgiTd + h7sJYSbWZdTtdMBrxkCMwiQwysax7uCLMABBtYhs3suDUqw3I+1ydws5lC2XAKMt + 3IynlfvpoQ0Fc4738cz1anWBqcxA+pow6I9X62AzMgWET+mPXvO4KnsYF3yVX3vU + aAEJAhAUrWFLx4f8WE2SKJA+lKRvwWpTajCuq4ZFX8nruhRThFxQg4ED7qO4JOYf + 6rV6z9RMqYEOzwFRro1n9X/GZqVK3dRrdr7TA6sw0TO0N/Ml0G9IkUh0WenG4j0y + JuaulVZtAmNZ + =tU0x -----END PGP MESSAGE----- - fp: 18DFCE01456DAB52EA38A6584EDC64F35FA1D6A5 - - created_at: "2026-02-17T22:22:01Z" + fp: EF643F59E008414882232C78FFA8331EEB7D6B70 + - created_at: "2026-09-24T18:45:13Z" enc: |- -----BEGIN PGP MESSAGE----- - hQIMAw5vwmoEJHQ1AQ//Rl2w61XcbW6YhwDThbwbcpaKzZegAzKnKa2Q25U2UfNP - jhqwqay/PUbJyt/G/9ukVNZ1ujTu4ffbzlV6wD4TJ6baLn1NL1Xkjz8rqoIlXy9/ - ZqpyEZxyQAsaP0hBgE3x4UZdD6jh/NRUUlrnPRFVqXxHSCL5XHmHdjCaY58OgB6H - /5LFGjYdxFomGEozR5fpgBuA50B4ylh1Crw+xiT6VPB50/mWRw7GSO4f6iwB/2eR - VeGrK7nqHf6dFS/mTDUxw2jrSoyjDMTgAPHwl1qJ+Pug8fmp0cIdLf3ZGBlulsL2 - 9DHCvXNeNGmk72Ag6DWh1vxLBOGYAzar4hXSxu216ppJh9ym+3SZRmEYhP33VBRp - JbufVtrRwK3wU3+o88DXZ0Z58Pt+IlH652qxHqJlC7H2F/gX7B5zjH+Uz+1IeEK8 - YudPIH3Vo+saCSpKg0RLqHiNXE9ia/wvnWNzw4U5GGikle8LNnzy2TMnwq8I92GP - RUVzWH3vFOWMSt+ilrA4nhjeVlzMBMGBvmQiJypAUAj+fm/xEJTkasa0a+GVpZtH - zHMwTFV/A/7rtXFrtcjTjDLBdlVMqSNM3FYHnKKlZLYUQbqhQNaINdxjrx2C/19w - +WLI08wqrPMZSa5iA1q60LLC3WkiTka1K5N+8fT6HxH/OuuiBJJyxMWsoIcSpYTS - XgG3jf+BR/9y8kDxqiGCwwU7fzRGXGvCH5i7CJzwrWtc3FmTNb7ct3k+tMbEcrNc - frd6gvm0u8+I5CFmHsdZFrDy55afTOoT4DErO7vmUGRKh4JfgKxsn8lzzfLcYjc= - =hjjX + hQEMA1QflAioE8i3AQf+NcXza72u7+UVEhmerS7UVgOJp+/V0yM7SKrIoCcYsGeJ + xpMkPL+HPJPdb1n1DkLvdtE+reLmJluqE8zUKVmt5F8zoOWzryl9heIPTKGUn2Ob + 3Q3Ii//IDevt8QlJw8ER8LV+b9TTQr8uJM7ae7BOf0q8n8MO181qKBe9vh7mnC58 + Gw9eonMJbYGvlbRSdt/YSjhdE3zPvhGhyUdku3ZSzJluvz8gl81LAGSnTyi56uOg + L7KJ3MUtfoKvqmBKcrKAV+lRcr/ObIYAkNSgi1oo+/57VVQey9Iupt0bm7u8u1vf + aaIMdHimhheyiaHBrQPFA2lXTUEOBuzjP8tBxqAjndJeAYybqQmA7n5eIrlQWhfG + +neYXvtAI6GS2o7PG9g7NATw5rbTykN5DQ+4Lz7vSTuEnzQgGFUmLeGGW4WB4SER + y731AiChF7QDwV+nemn/Pz1i0P773V6p6PnxQF6Oww== + =TLNn -----END PGP MESSAGE----- - fp: 87AB00D45D37C9E9167B5A5A333448678B60E505 - - created_at: "2026-02-17T22:22:01Z" + fp: 21C9579E6503CA815A68ABD8541F9408A813C8B7 + - created_at: "2026-09-24T18:45:13Z" enc: |- -----BEGIN PGP MESSAGE----- - hF4DerEtaFuTeewSAQdAhOSneDEqtquUzQxEuKsOmmBWObvr4JDzmoijutbNFS8w - dixZ92+6rfNthVHhzDQghzyU8dYNqQiwfcrXNWpJ4fJRE1g8nTuQApvxTF4lC4Vm - 0l4B/YhYp2JGWdw1dllA9cD/HMAzKJ4zHSL7dCcfP6k0b6CUYm1GuO/VT6Bx7ygC - gfLuQKGFRPomTHNan4S1rhW0q2zvQNGIFMTDo3eR6Uyb2UVDTIdbaICsuaEKssEc - =JN/I + hF4DsZXvxFXTXoQSAQdA5PHvt52vHAENUHn6Igvmx6laghevAa0f1EscWfaGBVIw + 1JGnlPt8Mb4LpOWGVKS3rtFN05ZM6EFAinITwK7x4Ihu9hjh6faeUHRX7aRg5qms + 0l4BQYV/F7hM9fqVvNxIjygrRYHOXnct9R7b8x/xcKNsIZPBbE5t8dwQ9OX0u+6s + TyjVZPcRod2AZkZcbFQTg/8mnF8Q8j2ruSysc7miJEgWkIZuL3aOgC9kyJL5xJpt + =j9u3 + -----END PGP MESSAGE----- + fp: 9633412309CCB83BFA39BA5F2FEF746201D7FCFE + - created_at: "2026-09-24T18:45:13Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hF4DerEtaFuTeewSAQdAPQd7h/JhnmXCse1qFMR1bTvwMWy3lKRQpdlhO+tovgQw + Vv8ZtRs/Gxkr3lWGMOvVGgWzi1glx5H2vmJpZFLhn2Vk74h3UynTBnYBl3x8fGiN + 0l4BjeDWq1JSA4LwxbVcvMD3iWWKrg1DCSK8jLwD9j/vwOoN9BBvTj+8QSV9eMAj + qmU7GvieILjsGFupiaGR20gVzvmFRHzzpDkbOBiDbpXOf8V/u2jNMdbWcdwhD5HR + =1Mjc -----END PGP MESSAGE----- fp: 057870A2C72CD82566A3EC983695F4FCBCAE4912 - - created_at: "2026-02-17T22:22:01Z" + - created_at: "2026-09-24T18:45:13Z" enc: |- -----BEGIN PGP MESSAGE----- - hQIMAxjNhCKPP69fAQ/9GhlagbbuK9o7QroUgY9gcimdxp1PTK4HOsjRgnf56PNm - vTpP3We62o3+ohIX7yGKbpNKbnf3n5Ecx3ItJbBRniUDr3G2AnnxpynJJWmZGsn3 - HOsgQqqYtUeSgf6KIhaeebP9drM2p2qPYmGfa+9DBb+Li6FESOlzOmZeiUoaZUlF - lHys0cTsBE2iYepR34NYwv7qrkt8tkCz1nrKraAmhiNWFoUFWVN617p2NQICpsFD - Wk5m9gJtWlgQHvSHvqEgu6PBArOFclBcY+bb/XC0srWlAVixwr60iDy1IRRuKz6r - 9OukM9Ng1V0bZhkGyjB4ti+RmQKiP9SPAupxmCe5n+ZkweJ7gb/nE9lodNJv8IkK - 3o9h653H1hCbWKeKlaAggCfopAyEn1mU+7l37AWUGh3sh5jz7aFrdXYcAIuum88/ - Zpa0ALYIABoevjJwV6NyFtAsQpt7YQ3/0wJe/BC/6XQ7QI44DlUYraIaA+CLT9gp - C4h2olOPtCXHfNRM4VK4pOJ0gwQVTI40snlCNzq9TfZPjC63MxzinRLs8PUVvM3r - CXYTwxkOI3IFdvoTIefdVjoOxvGR0tUyYTagtJ0nihh4ymKlxPS2F2FNAm/oDQvm - kx1AjAci8YuYZbS+DSFpi5djN2nxoQRfiFhm08ruBRnX0SI1EYLMShO/AO5fJrTS - XgF86MBuDd9XX2E1OLWamMpgobsAHLgUd/kny8Nz1+VFRmME+FKicrOOvm3RVPWW - D5NGxvlHPMfeE/xqPv4Oog1qkvUdDQoNSc1D6h8uh07XW77mJr0kwnmhk/zDsmA= - =Tlzo + hQIMAxjNhCKPP69fARAAk8jXUa+jL/emHUaYCV3MkYu+CK/s2Mtu4W9R7Vl89iwi + mJbtdWZ+xkCcYBjO8dE8ZtKpRftjjjket44nMC5Wvk3hd6W8axCEhOV3sWMuGLfC + IwxUwxDBDFmBNptpPoBj481NrOadtnqG7wAJMeNOMbqiwTycapTB66l0Kyi6efCd + sIL6jU3oXRNxDISN8R7+n9U19+06iG0oNKH82fBwHEa9Mk+h+5W6nJwuP0etEJ6u + 5OjvPyUrdiusHi3Qi+xSrlG8v1h5wVef1IyYKnmpq9HwPtUqVaGMbPR05KRQy3rV + mJeHLkNCHNB9qSW5LI/1rAiNbAyYMz5oYVmmoQ2srXL9FB9r8B+Q8QEtT+ySBAUJ + B1wNf56wWeizs6XMfgPQ5kZlVSeSPJ5Oct3IqxdAAHInI2piTmhgQ74hHqLNm3Ps + SIWgWy+sv/K+uAXLnecKCnBCptlpbyrFVFMXEp5VR+Et4qDmxT+jhRx74RmiQXM+ + iwHlO0JOa1kOmhqYaCGC+ekp+3DlYDVpP4EJdeONurOkF3g7kxNgZ+OVJFbV5DEL + Pe+cXW7LHPgITdk8OTCs7VYPoiFMJVqBTR67hg19ctJxCFezVfMuHuK0T8/uM2hs + LhVlrh0ydXXUdYN+GZ+AfE4ZmYu7A6inzOsRg+F/5MTCHGn4zBsHHoDLyTpZnOzS + XgGIiY07kgIxTgIkoyxH4nB26uhhym8VJv32P0r2FuLDdbXe62jNSwjbsnCFLdqn + B4AK3U1/DVbyKfidCZ3ba0EkwEftobFUY75YUz73Kd65ivwuDuu384tWKAu7q7E= + =4ou+ -----END PGP MESSAGE----- fp: F38C9D4228FC6F674E322D9C3326D914EB9B8F55 - - created_at: "2026-02-17T22:22:01Z" + - created_at: "2026-09-24T18:45:13Z" enc: |- -----BEGIN PGP MESSAGE----- - hQIMA1Hthzn+T1OoARAAlUaspaXyF0VUY+9YYAZNTO9FcqybRLNMCNfYqxjOc9EY - CtHqfMOaA2fYO3Jz5cY3u85ilKovHNpUTQN2AL5B/DnMthQy8ooGrvabeZ4qYeuq - EgKDgzsFw5BS2eS1t6A5cl7OS/tSMnN83Mmy5zYT0eBApkW0uwucv5paNvi4v0XS - nxkfpjLx6Bh4lZ1S4elhkkoC3NQp9oi/xQD3xQue6i0hAw1fKjHXHcluN7gBYfQ3 - dgCuPC9NGdNJ3O6k8zn5b01wyLKISt0noYy6XQfZkac/7YKJmfYjaDjwr3G5GPJN - 5qDvb/NER/wcPMPiH2avFFPxy8MetG44OS7F2sqUumwxPAKCgrLuGvX5zNf2FdSO - hYPaOveWxGfoAP4IkoGlnp7+DdcWplWE/zyA8vk49JH/cac74+tUkI0AOflJVU2y - EGJ2egD2ThL64+V3Ezml5QQnVFwgWWM46w1X6fhx1wWD+o9mZovj2RF2WkGa2dp6 - vP5PXDvTioFt40v5sYjN/19sfeuT+QVExdRZ8yBLgPj430CtF2TvCNNP56h1GB4+ - oId9LNlhjSLl23dcA80C3OKLJhFMFC3EhJDXqyrUFXf4rUF/rN/Bd/ig0oq/d2+7 - LE7xJE0TYQw83ReW4Amcy4rkLOub64JiNEpEBqZk246MkZoH2IT6gh8sKJ/DHdPS - XgGcprhx/8L/jM4qS0nGaFvkMnOWqZfv0By/CHCl1KPx9p+6m+a5oyA6NUUbYZsZ - 6BF0Yk2CEdlM8WjUilQWIYBJtpXqGRu+z4KkaosyNmAem0gImPxQQA2bBdVTQwQ= - =PMud - -----END PGP MESSAGE----- - fp: 5DA93D5C9D7320E1BD3522C79C78172B3551C9FD - - created_at: "2026-02-17T22:22:01Z" - enc: |- - -----BEGIN PGP MESSAGE----- - - hQIMA46L6MuPqfJqAQ/+NWPka8B/F/sZkJ2cVtVLywIPhHNIroBiyA5n/8TOjWjF - Q9zII52FLTjOrNozJb6Vf09iNTBqPGnde5vW/98aa4v6XaGL/rpHG0TS7uR7Y26Q - DQbYlxZIMwdlhkrb6OHgTeocl1q/XDruLqUaEpqxDjRrtwvFqtEPIMkIvJQp5g9U - qBUqL0gZz71hx7M4V/cxCitMY2bmINueF5TIF44THHGu8QbZaoAt7vXzkxvn9/Jj - jkQYCw128bBWWOTgZ8Nen+s5QuV0jRsczZGkwg7KNSkYi+XszxgcamXIPkKeGhcA - kTyKDNotOeKyui5Mh/MVGSQDi/njWua8ZiPUarORef53ndRY5hkd2dQVjZm1kZvY - Hfi7Nxd8Uxl7ru2m4W8+MXGPRCnm7jFFaVtcwKdGyIASyTtJBHG/wbXDVfsfQVSc - /YLuS10B37gd3innwndPTockCHsuOMHIbNeM8RD41OJSV3opEQlf+DCxTQTxQMZg - n+J61eflGMfkMHSU8yj/7b9NX2IFka2w3GO/hicZ2l2GrM7fNUqT+ynaO1lC1xNX - ALReI0DQUdRd2VHn3cBoduT2j/DM6RaVH89nf7Euj+mzHGSR0DFNxHFXyoHAJJmF - 8J08ATp68JkbahHs7swa9Kh3Z4//LILHYcdDiiJNP5NJRG65OlIcTro08NzPg5HS - XgHKbiW3ZXCowpDempWr7UawruY3O1SSvgC3YsHlslrm6RD0uINCKxJL7YjBjIqD - u4M70/rHNiGJefJ2xACNQgdTzPl6s1LpG3c8ANEBLVE4irqFTE6mgfErOMb2Qzo= - =JZf1 + hQIMA46L6MuPqfJqAQ//eoAuBD/ctbrnLBh+Cd+EY8Thp1TQ9JRAeqB+qiBltjPd + 78FJ8DpZ39cB2SODZT0RRE4gKan1lTsbVtCdxAfdXnS1jumeqsXQYyWECJ/fvgHU + PDhDPsykBGxmjUc8Buy+6Bu4azqko5adPc9zjLKc9kaTJcqZBcIVohtzGZ/Upzkw + Uoi48AoxJ95Z6cqyFXpEuHo+eR8veqWbFEDzcuIkAkKZ+4fFNk3Y6v0xMx0NaZnp + kTGu5LhNZ81ZbPbKMRhyMfF+YLhPiaI5UipSC2WmB3MQv0vCcV62pTMgL/u7we+D + lkoD+AkzUjpz1qcYl8suMi7LxqmaSmMlLorYgChZSgeGAeGFOSYzzFgN/6DFCYXL + 1Q7KRbP6IYcE56DQN6triya7vPHlHUA/UjeV/BPcn0KIqtNBXalxWCBjFYMMEZI1 + tlcfxGmw0KIIglMWHDzZhln2+zrtD7anP2lwatnj8f9UmOIdGz87RjiFndHlargu + rHa1qIfsoxXUqgXwSfv9ryoJOzBJiQvb5jjlI9JWQXs0GN96DuM8oSnPzXAr5W3O + CLx/LbyiSPvyGwqWPRqi5LaVKSiUhhivhzyMplvgqWwiLLhi83RsW1v9YrexXipH + zt5j8g68JMUmKjRhNV3Bf4pGJILYkejRPYTGt/q67w+2PL9GhjZ9hLF0kqrsavTS + XgHohCE2wuJbs+Bp+yZo3aYX/jtLFDj8XP5JL7yTizQL138x1VOoHWYYrBQGfepD + KSbKPOx9A9sa9vllmAobtkKCnJ/PpbzNXNXfnhf2RtAmnDO+sr/dyOWG4QUw1i0= + =oFbn -----END PGP MESSAGE----- fp: 8996B62CBD159DCADD3B6DC08BB33A8ABCF7BC4A - - created_at: "2026-02-17T22:22:01Z" + - created_at: "2026-09-24T18:45:13Z" enc: |- -----BEGIN PGP MESSAGE----- - hF4DQrf1tCqiJxoSAQdApX/THvWws8d2Tijx5RrGIh+CYcqDI0T30rttyxT8Mw0w - /7TkFc4D2eSqXQW57YWEACwd47NGyMlW96JEeMDCqwNdGQQLaSseoYrS1hxI9oVB - 0l4B0/igsdF1GICTtToMkS8aWwVHXQLu2AO0wNyKjXAyLtsDposdx+UtLM0y0v6X - HfXqQmyHEK0QNr17oqyTKiHQ6rnuX00W42vwxDCGs9RuLvI2qCWeNzC6C6j62vkI - =8osW + hF4DQrf1tCqiJxoSAQdAvop8KmNgXpYYqwazWQAnnexQEb9260lwUnUhLuXhkUUw + lpxjpO60ndYRYbfP6iAF4uhYkvyok2SW0j081KnylXw0sdDmUg+XEiR2Nk/4yAQj + 0l4BCyZVmG0J4PZl2O65RbNRwUUSKF0aYZAhAWJNG6oa8XB30w1CHJAwlFduaWZY + 8nrjbfk69JTEpWcgUtMz6V7Hvk+CNBuU5k4v6Q35IDo8nhgEYrXr/WseReRmZTqF + =E4hb -----END PGP MESSAGE----- fp: B71138A6A8964A3C3B8899857B4F70C356765BAB + - created_at: "2026-09-24T18:45:13Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hF4DzAGzViGx4qcSAQdAooo6HDOKpzbacvbYg1RFHnySAmxrIJlVy3ac1J5KuUQw + ZJf51XOm109+vBBCKiAHPZNmniqtWWmLn1pxQY/mCt0VPI8/EP9ROU689GWh4SLD + 0lgBbsQ9zuFjf4UaTA4xE1lfaGaxv85/SpETMSjDyt3ivA5ksmdMhyUbP1F6fNgC + Ts/k5fa6F4uoQJzqr+lpwOfjeSCUk2wPEgybJvpglB1fzOQfXsEx7ztk + =hc8L + -----END PGP MESSAGE----- + fp: D2E9C0807BF681F5E164DAFC5EE1B61CD90954CD + - created_at: "2026-09-24T18:45:13Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQIMA2pVdGTIrZI+AQ//QmrsWkhKLY+67XPFY+LZkcHW0yNq29o9WXTGPnnGKAHm + EsWOnKsa9K7cCfSu4nzMZHvN2UhXG2mi68I9vvNlfW9ax6KlSXU9rkUiBhGgsXV9 + 0kurZYB/X+H52xvfKP51SibVHlK1g6Z54SqYAX/vksga9u9PlJUpqOSFSxBq5pAW + L8BW0RMePHOvWiO0wPT1QmqPQe4slr89BCSYqa3c0vQQnZAtIoMDRh4NWEMQmjkz + UJzHAB4GDRQwzBpEe+Pki4mC1654oRpQ4DaZpxvbmRxDSUOcDT0dAFvlmn0iKZmr + mEzit8cXxu3QWL0uR6WFH/FtfOsKN4fNlqeh2RSERrQ0ZDALVp2Fn3xQ/E3dl6FD + sO3PjS3Z64gAGFgw0CLy2bfZPGBDZa/zxtGTCmQzEHyUbz2DIK5UCFC2Qs144mDL + AUgzikiZyoQGA4kvexABt7Jagh7+4r+nAZrekcFuQAu5Fz1PyhIA+SAf+O8xOwTW + no7/J9NZSPI11s6OJ7HVslSxuma+I1THGisf8rKGfPO7VF1+ewY5C0y8rEkCLq/Y + GR+j4AYDgHTaIk0L6o2TPWenZ5rK8c9kLpYhze2viVzPYL+6oj7FO9AYB7reCowf + +bvTKK9UoCoEEX6zTWs1nbZlxkRwqs2J3euE6m19q2EGc/ijVTdJ71xX7ulC+E3U + aAEJAhC3tEvKSEPLJGotzVoE4x8rDadfmO40ftkgjX+ns2pNrXIZHHOlJ9zfE9OJ + N9appSBaKK23x3enmyaYSqiGtJcCgZGuTIdji+p26PIkp5Oo+iVXTGLSUKWjJQaZ + q7GQcwKy8P6c + =ed7v + -----END PGP MESSAGE----- + fp: 878FEA3CB6A6F6E7CD80ECBE28506E3585F9F533 + - created_at: "2026-09-24T18:45:13Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hF4DKKbvh61jX5USAQdAYWZcr5AzRrNuWb5veea8xJyk/PYu1bAOc6Vb+oMR51ow + sJ0M3kZyyhflPYAhJGEI+FDZ4oFedDc6xn33aZk89UAf7xhaqI7sDzH5I6rY9z0Q + 1GgBCQIQTNhtZO3DR+u94P/quyFD/duU6be8XX74/q9tIMPzo26vCrc/gI3naaf0 + FrRfeOaLwMcfZBkAx8H8TwoPC5b27+mORi7MabMJLFpD50/CBqCkGhNpoC6xNHp2 + RiVakEKXn8Gn4Q== + =dFiK + -----END PGP MESSAGE----- + fp: 41FFAF3D519CF5C039FBD8414BCC213729AF0E49 unencrypted_suffix: _unencrypted version: 3.8.1 diff --git a/config/hosts/public-web-static/secrets.yaml b/config/hosts/public-web-static/secrets.yaml index 20d09f1..502c923 100644 --- a/config/hosts/public-web-static/secrets.yaml +++ b/config/hosts/public-web-static/secrets.yaml @@ -5,146 +5,187 @@ sops: age: - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOaEZqOHRMMko4S1loUXdm - aTlsS1RDNHdjdkZWSG1aR0d4Vmh4dVVZQWo0CmJUbm9hZzJqaDBOMTVObG9HWFF1 - RDlCcmdvR1RGbzBKQytZK1lSem82SWcKLS0tIEZUdFpldVJpT2RlVThjREVqcUV6 - OUJkei9zWmhyazc5T2FVbElFRG9RaFkKu4lZrg8UWVVk75eY8HBdLIT4BNw2UcyV - +7X2L7ltv2z31T4cKnnZrsyeG6fBGCLvuI5EQBd09OCZEUZ4u7qPOA== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IHFyYkk3dyA1WDl0 + ZlFpYzlHOEYyUU00S29rYUFzMEN0WnJQRFg2V1hJNDl1Um1aOWhNCkorNWYxYVpF + WHYxb2w2MU1BUTg0SHpMMWVvdFhCT2FiaVAxelFxV1JGaDAKLS0tIEJZeDE4M3NB + NWR5b21NdzJqTVNuN1VZL2dtbktSMGE5MEtvT0Q2MWV1ejQK4QUXZDapOKiK212R + zFljy+YMiv2UwNmYPQVMs1faUR0Kanz+9Ga+vlasYVeFrh820RJGYuHf/a0gX+yN + 0y06Xg== + -----END AGE ENCRYPTED FILE----- + recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIBQgnQAq6FUSDK8bxtYPjx3oRCAKG+xy9J3Gas2ztJk + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIb0s1Q1FBZXRUbnl6MkFY + TlpGL25sazg2b1Z2aG5YY1R2amo1T2k0NXc4Ck1oNG9kUWl2aThKOTN3TVJxOHdh + UTlMcHhiY0Ywb2Q5czk2S3FsUHBwWm8KLS0tIGNNK2FiTnRlTElLallBY2ZvS3RC + VTlTdGQwMExTVHFkTkNvZ0UvTTVGRzgKYjtzcd6PzGw+UODLP/N6GEwV79evdBbV + zP0kZuW44qlXSWny5jPFsd4QdjvOqxrszawVdd0gGwSnkBhi9iaLmQ== -----END AGE ENCRYPTED FILE----- recipient: age19h7xtfmt3py3ydgl8d8fgh8uakxqxjr74flrxev3pgmvvx94kvtq5d932d - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzMkdGQ0tpSUlWQ25ERTMy - QXhNdUYzdlBPUXR0V0NyOHpZbDY5RVd1ZXg0Cm40TjQvMXVGamM1akMzRUFuc3NO - K3lJYnpVQ1I3QjlRZUJkUm9QK0NuRFEKLS0tIFNuY2NXU002bnlvVHZKRCtoc1NS - ZE9rN3R4aHRXR0dBc2oxcEYrL1lxZncKuVocF84+ge1gyzfNjIxhwNgd8+kJIpxh - yREbS2mrQ2zvSMtw9OoA0KJSpoHZfIiCwn2uYkQDPiGB/721JmA12Q== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjWkdPdCtoazZqVEZCRE56 + a3FidCt3NzY4MlpCQ21CRTh0eHVqQmNYUjJVCnhMSUVnVE5xZm56OEtkdWsxNEZx + WXZtYVgvOUd3U1FncUZhV05DTjg4b0EKLS0tIERDOFpRa1RoakJqbDFwUGVORnRN + ZXJJSnErWVBuSmx0eHdmUVdCd3VzSU0K9D2NbKWKGsBXCq1Le1Th3K5Vhd8xKyg4 + y249KtohVeG4ohBYDkUgo9BBHdD0emldWY0vdtZoFWL4pNjVmPxt/Q== -----END AGE ENCRYPTED FILE----- recipient: age19s7r8sf7j6zk24x9vumawgxpd2q8epyv7p9qsjntw7v9s3v045mqhmsfp0 lastmodified: "2026-08-11T13:23:00Z" mac: ENC[AES256_GCM,data:jZ9G+EcoGBfWv3uYVkk6DF3HJxHpxMYZQW/4BQd4V/YrluZp5dg4Bw/coRb3ka8n1EBLj+hxPSJyCtXwRlW1sMUvl4mbKpMTe5dtd67lpDMXbQ/3AA53cD/52Mlvv76Ywff7kjx4XhbBCnYEdBfMABcVLPd/rgmKtMKRtaYLjmQ=,iv:yPwKgsg2JgqB3QT7GG2+UlPlP+REOjlo/FKYwgmctZw=,tag:944RbdkitJ37aEmcrX7iQQ==,type:str] pgp: - - created_at: "2026-02-17T22:22:02Z" + - created_at: "2026-09-24T18:45:14Z" enc: |- -----BEGIN PGP MESSAGE----- - hQIMAz5uSgHG2iMJAQ//QUk96h2C0nYHnswgF7hInFG+w+HC0v6sCTzwacAOCwMG - a4otLktg51S/iBqP0VYNCQSfBc0iX2YhHrrROHTRGrxMecVWi8hw3q6MMkBjw49x - wHpSdao/2fSzwB7j6llJNAkpR1RTZkmOimyaWAkH8Er+MNF6xClPuxN3IrPvU/C8 - Ru1uZCXvG0jh48NzvXk7rK/KRhPWlcYkgPWAEWQdeNMyxW9Ha0lQhSOhC/lNOLMJ - Q2pZ0zQxeQqNApe4nSs7AE9OGd1U/DNXAAriEtmXRHstPodHLqSjSfO749KLZuQA - ruSMz3tf+FFJspyY7DSleIiiJvu5A5SnU4aaFcrqfhDKNAsFfziG6ze2aq0YHf38 - 1KxvKvtQP+qT+8pKMFPe7Wz4oFEcHBjxFLyJZ7DwRDkzdMvdAQLLL/kcP4fKxFPx - tNDfJX45CM91soY9N6zHYk3MZ8WXCdcGjP+/XFit3GGeJCV3qNjy1mTalPZbVUE1 - uqNgqwG7IZaPup+3TEtIuGb3r0YNy4kWlJcaQ2bz5pPtDpbzcf9Fr+jxTod2LIky - X25qzKmAwus6aWheEyPQ5AHZVT5l2Sgdf/uBBJjh7yt/Y1OY/EtbS05fE6VVdiUq - oFq3DQ8L+MGyUTfQqIxpremwdq7pNp+XxdF8v1O6H5t0ByqcQt0UjsDWpv0T+k3S - XgEMQqbP81OTPCSwL2ePrbj92C97zkScyAyur1lrducU0UPGulQ9k51gIm/1nV4C - 04NrhKIlCqNHqx3DY8oHk/rnFrV/Ulrxqq5Hc1FRZCEJIbyV4e+uQQggWSxuqVM= - =uorx + hQIMAxK/JaB2/SdtAQ/+I78vHU6uDl+1aPkKC2ExESx1kjMWffeIJzCkOT1j2iMr + qFBPHUwpWzGxJvtaVFYfYOE81+SuiBf4WT5YmzNhXta9Sl7wxof76MkdSEpbOpZy + 8t7L+Zlbj1GLawlZClBIL28Gyus1yj2uEmUrr0CbC/aII64K0b7Y7cfh7O7FY54O + JDYgY0uCJVbGvcLpOJ7NN6olk2qmMqlrORauh37O5nLtZALaZVUKr24PL9aKUtjt + j7/gpEiqBWHvRywrUavJ+7YR2n6k7oRUZwuLdIjdSmuxCiro61xd9LPf5cf1Lyl5 + K87Qog0SssuX9H+mRMyne09MjQHQjMLZbeRnrIf49LPJM+Zjp5cdh3GfKYQcHJRp + dhkrEwniG7RLZjZuhFIvtbn63iumgMvxDr4XQ2tYjL1F4K5Sr8rPTcj3lY7qiWTG + zrkgbgZp3A7mgwX5STAdioRoSEhyzSUiSVp2sKGL9n3hvEagMn/x+9JPwmkECeDi + YQ6Rh9+o4AxVx4jHkp+ZXDmLsZtz4/yi+1uH5Y7Uw15UfEweBR9Lkk47ISZz+jBk + 6AWuvqFQjGP5YqCronT+JnS3rNd1A6FG45mY1FWx4yrlvwInIIG1FG5AbCTljYzt + Htw+a1Y0rGNK/NWy82bI6NzlFOaYjP+MRfWhGcUJ9S6K1BwfsLMmescAM/fqe5jU + aAEJAhBE8lQwLFmUsaSlZxFY6e5VhJZZe6rV76H2dKDzmFrnzJMTRHLfS/7Jio8w + V+s07XIn3nUWlEAYw0s/fTyeZt+4C3BbGHpWqR0mfXyfQ1IrVUIyniPoQES6klxb + 0vqnk3MdG775 + =gkyj -----END PGP MESSAGE----- - fp: 18DFCE01456DAB52EA38A6584EDC64F35FA1D6A5 - - created_at: "2026-02-17T22:22:02Z" + fp: EF643F59E008414882232C78FFA8331EEB7D6B70 + - created_at: "2026-09-24T18:45:14Z" enc: |- -----BEGIN PGP MESSAGE----- - hQIMAw5vwmoEJHQ1ARAApCd7a+rHgICU4yfYOorWORysVsifvZpAGVTJJGWfeRdR - CQiqubBzEMN2Y9q2WnjYqmk5j909VCxSXO8zWpFjJZwLtA9eaAMftja2/1pLtGQd - AUPUIuTWxKjrP/aoL8tC+I7W2TVsU6Q2GSYqm6OZ0WLDP5kR8YQRSOKzVSDsDkOt - jphtni6zQpE8XLlJRhyPiLX+96Y5geDYj8KD19DBl6vSMFudMhI2WK5imak5PERk - y07w3lJ0/FXGLAdR/I2l8aaynkQ53Ft4IEXNoDtf89nO/8L13AImOZtpoIv1nfVr - QMS1jKys9bfo5lIcJ9bIJQ7hMQwV8AZQziBDDZQjDclZxcxC353zx8sjWjUWzUeY - 229b0bn6yutQ6hu9eIU0gxepyvNz9lAN6EHKb2cgp/UJb4IXnn3/ktmPq/wOlVIz - 5xOH0ue/BaIWmp1xjC3oKLbJeTw8zvRyzk8jGFDhmhDRUwMoLiPvR9XkQ7cpGGYy - wkb/URVBXLGT2u7wWVPZL0zUJ7zO1wCZ27lBwLgSAvVNSE87Ldsj3roxtr9nOQif - /qmCxHkDbhfhWMFl3PbCYY3hkS/ANQPhGyiBaU26x8o/0Vgajq43OLU0KO1+Wxbr - xvfKVN4m58iPHsMXbgvyEipFu+eoiNvEA68+pCRXrS0om2oE913XNEalVJ6F5f/S - XgGxibFQj6MyvJChwsuFx9YmdH8/nnb0eb9hmZuXctFNZCdlVrv3fhEwBoA6FnrA - RoCdOB5Djl0jHSk66Jto1uwfDYdcPZR+1tgRT9xVeK4PtM+c0Q1Y8dv3wjAnqr8= - =lzNQ + hQEMA1QflAioE8i3AQf+OPoy4ml8rFHFjRCdFHGoGFNdLn0d+nwf3Jt1bS5PwhUz + jDpKNgHairYl7wRSvMEJKz+M+EM9PzfRbLYZT8hKZ5CPagnSc51Dv3pb3RKoE2UF + 3bwDp6ztZptn7r7WWRGEbyloQxhwT+1dZuyZ6T0awO/cuwtzQCgaDEEI0ilQczVe + TWELdjZ9cGZW+voEDYyfPoLxlnZUHkwWjUGeTfsIYbsBk+tYxaOSPPwtpN4/Kuf9 + cxR12W9ey26dkVa2k7L/PyDlUNnybahxxI/a+0V0z9kxgAby0l9OQp48YVDhTlM+ + Td60+jiEN/AUPBlSoyD0m6SALO3SLtxhYYkzBoElOdJeARGMbckAndk39/vq0XeM + VGmEcdPSY8epRUW41AZZ93Hw1gK4mU5O0WM8s1q2QjwVbNsb2U9Kl8NfeKYKSmv9 + TbWxmDijHZP1WBouD2Nnt2fubN1f7Hn2z7iB3Lz4JQ== + =x3ci -----END PGP MESSAGE----- - fp: 87AB00D45D37C9E9167B5A5A333448678B60E505 - - created_at: "2026-02-17T22:22:02Z" + fp: 21C9579E6503CA815A68ABD8541F9408A813C8B7 + - created_at: "2026-09-24T18:45:14Z" enc: |- -----BEGIN PGP MESSAGE----- - hF4DerEtaFuTeewSAQdAMGn63OSW8nVLoTMXbLnQdYJuP0cD0exmbpSakMw9PlAw - MTJF0o46wKf+3F84IOf35LwWwMuMGEyz3pvcRXVa1OfPAFk53PMo1P9TyWRoHrgW - 0l4BNK3KuE4zB7YNpu8sYtJ4a94qKzTOgUTPdBNOQyZR60BOVyGFDRLo3hHk0opV - eP1e3BxevL3rj1b2WoCewT8lNO+y8+x8bu8JY0WMBVrwjSqYlWENbtuG4eFhNGrN - =3yKD + hF4DsZXvxFXTXoQSAQdA1kqcsYnmxzdJRFqlJ7YsBnT2jEdBjcYuKc1xbOZnbm8w + giLt/oK2mtHsZzTBHtK56H+Luv6CpXx62EG8VXvyo4vBQGO2i6AUCaUwHL27O6MV + 0l4BqOQW86N4vNQgQZazWcNw38VRCYNh5RaAWQZfu2bmRy+3vYkbbio7k7Gihxbh + 1otYyLG6WvKahU4eSSiGiPAAIsjdkz7qdrsh/SOEL2y0E+NEsm4toJgg2+krpNMU + =EhAh + -----END PGP MESSAGE----- + fp: 9633412309CCB83BFA39BA5F2FEF746201D7FCFE + - created_at: "2026-09-24T18:45:14Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hF4DerEtaFuTeewSAQdA3vmV3GVLiANIRhtHyZBO9v6zKiDj2xAnQzHIjPFnYhIw + YctBRQvccnLZfUnTFl+H0g/tyxcFe71UY01EWGXfIVn3jk1urYHme4FjKUlfmWs+ + 0l4B0GVgPEN/g4MR46yt3u9GRe7gR79DqzOiwFEGI1Ay24GKynwcx4zADbpBTrTs + 1lm2EXF4cm2jIHFls7NUuDNIABkH3VhXc6Tq3o11Ypn7PRS3mPZ88mz4dgxNLmmw + =DmZZ -----END PGP MESSAGE----- fp: 057870A2C72CD82566A3EC983695F4FCBCAE4912 - - created_at: "2026-02-17T22:22:02Z" + - created_at: "2026-09-24T18:45:14Z" enc: |- -----BEGIN PGP MESSAGE----- - hQIMAxjNhCKPP69fARAAhwsKIIhLW9DXZlOfg7a+6crdjzTv3EH+8dCcSk5JiRGG - QnFQX+14DCLTX9kmEilDXWwawKbIdabqkF/+LbGyRjd7IrcNe5a+ggzkry9cDPb0 - VKts7T3Ti3BFcgNis8ku/W9l17Fm4ngdHA1F47ttByjDcfuAZURtnf1Ta2Lx8XwV - w3Cc09xtsKo98Bfrhel4iI0WZjj9+U3pHE4WeKm7bieLEpwtoxfdmPkGLGaGP8I4 - 4lIKJG78DTbrbsEP8FpWTTy6gp9N3Q7ZAjpZnuolZp7uZp1I4t+Z2SuHPrsLNwS+ - fxjOJnigl8hwPHGm030xq2/tcsxyfNGD13Z8ZG85KBa4+ziN900WZe6AELtMFCsY - HTCEe6b1oe+rBIWsxNNswkakb0w12hZlkZP59/4iahHYaTIPKfmkZTtNKFxeGW8U - 3/81nLtEUVn9EOjIL5uHO1zSeAxBBDZb5P6aajdVpKMa4HFFk18nbE8UnPYOoAHm - IJ+xwBs3FBN6nEfjMoq0P6RaszocK4lcTJ9a/8WqWHouG5s2Zvz3sgxBcWd0VQSJ - Eu2HUVPYn/R+87X5ExZ7n4Pv8z4obz+c9oPtjsJJd2sy8laKK1u1gEF94SLovNcJ - Xe/CaW0lpbJtglF4DwqI02WyjUJ4w1p7fgnVO1gzLRPRIbQc4Q/LtEv/rxMRUsbS - XgH6WzB8yoRztIy+0ZFPlcyvGwU+ZniK18rGPnj9FBMC5IWG/zn7Hqro1K0wxMB2 - HPwiJkwy+ckIgskVYOdT6b3K9qDSZ6sXe4gMmTNLu95enc4HcaINHt4pUvePX54= - =n02T + hQIMAxjNhCKPP69fARAAhQPx9gAYKVe4lkpymsf2a2QRwHCthvYICrrXqCwKJNxI + Bgb/qhVIxE0T/hutQWtsEZVfFl1v1/5Z+Sw1wUwIjJgxRq4UdAkIQasD+PIi9plz + iVYPD3J7GkhAZp8R22YXcC/Du65qyw9zaJCIwo87oEBdxS19p6/Pqo1OQhF/9AIN + sbEQHGOYuZuZzfUUIJbdptD7AOejVtVpZCSfvRtRpouJjQXiJIXkWxEjVLFkS08y + mXv2VEip8rlyE/B/IlxszQ3I2IUjAKTOBdIzBGaHJcsn2rZXsAs3OjwSxBNSKdbj + tuEQQ6Bl/YXv60bJir++ElEbWn+sLdjfsXigjfL88h2CZt47qtq7Mfo1MMkOf/3A + XDPN4ht45wG7uvykJK2gzuj1wmiWt7+uK+5/FnaDMItwr5Gk6TJRCTXH7AvD1GN6 + jnw2qiaap3SAvdMMpAtX7CGG/iWDVnI1dceY3WmNTsk8541WVv7gPkaQKIgspYk+ + DV4MO/bzlXKs5UOEe57vZqrQd6gUUUJlwb8wdg+6EtmAZgvywT+EhQXzDnSYyDem + ujgqmlCa/wS7K+CbfQNb4AXhBxAL0I8KPihPSDVt3Rb7bd33029QB88ySellPd0e + 75ETK3pAm8zVPdho+Om3RAptJxj+7UmDfyu51Q7n4GektTpRL+/mOSIusS96jarS + XgG3XYOWC1D3S9y5VC78YakMZ8tI6Mhpv7XweBhXEBqYAvhpb5BQdnq4wqldck/u + UJ8jdvdl8lWV3qP8VBH/MRfTSiz0GLF71SallSmJoaeBoIX54n9qpQwKu5oU9aE= + =nyzO -----END PGP MESSAGE----- fp: F38C9D4228FC6F674E322D9C3326D914EB9B8F55 - - created_at: "2026-02-17T22:22:02Z" + - created_at: "2026-09-24T18:45:14Z" enc: |- -----BEGIN PGP MESSAGE----- - hQIMA1Hthzn+T1OoARAAvH00112Z82i6jX1U2jeHDSBkyNT8L2tgCO3pwKpbvP/i - qiq1FWod53sA4l9OlrrshJttmBLjra53fOjhEo/qITb/YQ0gB4/EOHgc/AVkF4Cz - kj0bvUaCwR9vhqla7exG+O10i+OpWXPIeGT0BZUo37XUZ/wPFztR4/GP5qhiC6ZF - q7aZVwCaMKE9YQiAJHGqKPUmsAaEbxQIzZKEkyn9/GMy1YAgMtmfVoZgp8FmiG0k - L6OwMv9BU7gS/4DY82KuF/rtJMGjjio8tLa9Bu/VsHhdREvvXDBjyl78g4wtTUSc - S2JRIdM061scpIoy8sn1VFVbaMP0zgrsU7JvBO9/hLmS6M4Dp5a43OP+hNdWg3X2 - VxtzhGKLlOn6ycO96lMZflz0YA07SM3pw/EFhWszv/GTQCciGUojv1Gi2u94OQQl - YwbePXWF10IUWK4KqMBHUd6H/oyk4wahS3FDBlB5xdUiO61fH1o72ejQvy/d03mB - e4X3ThvpSg6lWJdXvRi3t4Nnk1deGU6NM1CRvZGsASkLulhsVYDsH3vW4NAatUyk - 6g3I5HzJilgLj0CLEyO9dA8m/15Uq8jC2WmBMxqp667QFUuPkKnm1ZUl/vX7Vra+ - yazYNtesU1eAP42IMA78irER+kOpi6AbQL7L8SXTcm+rQvhccNZz2/SO5eDDrHzS - XgErn65EfHWhgyLmkUPt6JPiGSoRgsEyEDn2EF3sxJVkCuwp4eVenSrzhtKTR5To - TIY/KGISC2AXccYlDMOicVE8j2K8NrvM6k/lNYhkaiUfhxqiOrFLK8Ku8YU9oPQ= - =JgVW - -----END PGP MESSAGE----- - fp: 5DA93D5C9D7320E1BD3522C79C78172B3551C9FD - - created_at: "2026-02-17T22:22:02Z" - enc: |- - -----BEGIN PGP MESSAGE----- - - hQIMA46L6MuPqfJqARAAuPJGCikiP9NTaQJ60FgpC1MHVwBet0RdK86Q3TLHtrfN - ib6ZDZCczv1L/nijEA9sznTHuATnUtd75TrHH1DCKVzFs9fqZx6y7hvnfeJZz85M - iIVybAJwk2Q8xoEf+6IVzFVXwic1RnPCNN1ZYsrfFIWpyRIj6VgP3D9lX10Np/y1 - x4QyxO7+gDG/vcNRkFXgnG+i4bekQwC/4vJ9jX3XEpXbTTPBqhW2OnMPX/T/mMmo - ll9NdBq+dw8OZ9zRCOtht5/HOI0uyP2pa/ooX/nfYiGZHzkIfENl1GID3LD3wHGl - qic1aSx0YkW19fZMQ9cTkoHXzrQDyv3QaSPFljgP3ibSh64k1Tp/lcc5Gn13qIMq - ORh2AeLlBwVSzlvr9FjulLzOJhoo04ZxHbi3OG6Exq9AOk61zGHe6xSa6sA0FoAS - SXAouLls4lqrF1RJhUMOJbX6Iwr+52z3JYgUmYqW1FP2iNnwU8Kfs/lW/3zn7IIH - oYimV6F7+5pqW85r7XMukEZB3LSFVviH7l/4pcxXbGCnfStACENngmd0Rkim6Bog - JYEF17naHgnXHJYsZkVGSnlxDfmaJYjK2YKQA1sFtQw0YenUDaewyPDeoCjAsf+O - QwzfLwJhPCZKRvsCAaP6Xj3DaisofI9fJWGKf8GwfbSFkISBY/RYLh4nTTauwlfS - XgFNQ+YXPmD5bCIO7KD9W+6MOVgyAu8Hyr7eMabydbzkMQ+OfeZCOQ535r6/lpzN - 3s/9QYu0lYN104ZbZTfu9ZrLnp9ULxw75H019o40YyXE5rx1Qhf9K/Ml1LZgdZg= - =Y9gd + hQIMA46L6MuPqfJqARAAn4eH4JuZ2bvb3tQTqxjHrLiZwWUXfq9c/d5Do22n+pq5 + 02kIo1cBkjnFFhQE1cvRk1qyj7Pl554GP7KDktgqhu/MV8H8DEYfTv84jErN/HXv + VQMu5tnTEYiwDXobuoM1zJCTWR/eWKw1TL9TyQ37OswMU/dDyJdf85/4wHrBWDUT + OadL6l7jk9H3dH21wPNkuNxaNC0EosRHjWIpUW5LmocOz+Ba63a6Qml11vZQIHk0 + iAbzbr7SPzsQYNaxEFcEoYfr42lw9aaJDF3Tn91BaLzZjHJ0MebTm+dckLianUIy + /YtyjnfA1KARx87fK9MUVg6WkUXO9K+iaep2fVxRSqSfZCnX92+JOqcsUKlSvIeF + XyFKYrrKIBqYpWisdaRbocU57Oh1gGYiI/CPvF37V6GpEN6TMTmrjtWdadvLGU84 + hH86AAK3ORCLqWc0EBqD/gPDuPQpLCjJz5jPP1QgtAXF6jvxIajW8NvJhHPSFLka + Uz6C8YiADYx/1D3VJ3CtpoJ4ZSa/xgKJJrsLEpooLOcimDTaOCgXI7fsY8wXIcTo + Tdf1w7G/JyTAjTpUFikjfAtwzm5pKkzJ96r7V6E10NKGOIx9Q5x/+Hz79jjuaVi8 + tL99kD71lCJ/OEXfLs92ZUAi8xBVS4/mpiIxek/HyfZvjGjgFWjVZ2gpzPNHi67S + XgFHmRGdj5HnJS1KRwevPrDI9SRlBneu03ivBo5jvaOaFTbKfMywRtb1bubtsIJ6 + b13sbGx3wK9ylKRi/u7Wo81BQGvABDYYbaSTm2R6A86ig6uUKSmp062pMNVkdwM= + =nYuV -----END PGP MESSAGE----- fp: 8996B62CBD159DCADD3B6DC08BB33A8ABCF7BC4A - - created_at: "2026-02-17T22:22:02Z" + - created_at: "2026-09-24T18:45:14Z" enc: |- -----BEGIN PGP MESSAGE----- - hF4DQrf1tCqiJxoSAQdACJe1cOwJNh+yCqthzmRCGIO0eKIAdYjrJHDxsuhVB1ow - 5wFPVzDJ1ERhKaur4wEPRwIe1FLznKHF4bR7F6+yIqgWiUhtMpGsrrezq0vS48C8 - 0l4BwPMgJVgLgfGRH8hZUcM3MYpSQcVKay13eOeTD8kH2rHOY5bq+79l69Z25qXf - 46O7DP5sQ51DLGu6t6UBiifyFWZD+WEbkoa5knvyzziYBoQM5hEeUWj9KSHKBaBD - =zi1G + hF4DQrf1tCqiJxoSAQdABycjGTy8xEbkDILJSQ1QpSF555mzDxcrNLvfj1/Y7j8w + Q0sqz8AbRMYmHcfoJsSgqNPzX7fQadT6LrAx7NLDWPEaR03ovdl2g/bHMeTL6q2y + 0l4Bk8IdSl9frBBKr2UOKbhNHuTVaPRqyEjjI5mVyHY+0LHQPIn6yfIGk1fNgmYS + xH/pghg5dZdGNQz4FkxKBA7P0CjCz1T5qMaUizPhZTjff25CqPLXORbpGQhc1W+G + =QKYi -----END PGP MESSAGE----- fp: B71138A6A8964A3C3B8899857B4F70C356765BAB + - created_at: "2026-09-24T18:45:14Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hF4DzAGzViGx4qcSAQdAOYA8y/QEaYJpj81erxGtnRou4WzmHWblGFwHFBM4NTEw + UJGnJ5F4XHDU1kiHwGJkmVdNAaTZILQjfPZGPH/lDLeG4bXQmpht/mwekh4UbPg+ + 0lgBxGWdLSjhz4uE+LpfdRhpyrrcdJ3v7t/R5vd1EfrjY5CiuzbIg4H+b65D/wtJ + B+p7J+gdxHp6BOqYFS4Pyku2xajIddlPjhE9f6BHu6HmN+H0hczjFWYN + =o8gE + -----END PGP MESSAGE----- + fp: D2E9C0807BF681F5E164DAFC5EE1B61CD90954CD + - created_at: "2026-09-24T18:45:14Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQIMA2pVdGTIrZI+ARAAvNGqj9o1CZWPRA92ARJoeyP2oVJXUyZTuv+m5nWufee8 + BL2RcMCeMbXGCzMm++Sr+NwEQVGeJdKON7A1au4DgZskr4+V88/dl/d0YRJRTW8Q + Wff/gqXzwP0lotS8GFtMIRuwHhlHRBOPEtC2W/TomNwUU73N7yDYZZNXtUefKD3+ + U7m9ITAf/VRGE9VzO0AgfpEVTuy1goye6qLt5jauk+NL4mcL5Rc7Mge4e0QHWyZF + EWAjXPdN9YvL4VrI3tLrpRpScgKrGX8OFdn8XwR6Uhy0N9YUnyWDYEkmEulbA+T0 + W/1KvlJ6UAGqPCEcQwf4mWkxBVWpvfTnCtU7WUwUF3R/iN/C1oT8O7cRfELj3vPH + dQzo2Bkk2D1g2cJvz/scG5BDWnxSNBf8s6s4Lk5pyFDq/wIITeKTyuQzCwrMgxlq + jsWx5yKGtKD33c+nJVdtQia9sE90I2bvzK5Ms7PzJo/ePZMWxseG7myMlKxMlnAn + vJ2bovyuaN5GQHK8FQQqMlIdiX15mujc20xBjM4TUByCX4Bf5aGp9LQUz2go4q47 + 1LX4M/N3gLrLQ48BVI6MTOa0iu2M62WcHyBUBVxoi9MqGxXuqgw4koBq2NPdRDgO + VFlGg7DxFkSS16HAUoH+Rr7NLcOjf/verp8fZ8B3Dv1ekbNncGEcGzpBg/MzdHnU + aAEJAhBrzWp0dIWUI2gBHC7cGIXc4J1BvLafNT5elcwONUJaPTsbdIvC7cvSALkf + OSN9DfEJDfnTUHZfuh3kB/pmOjeqMwBmYDWWHxakqs/H06wbeWzIb5tonSDHmtA+ + m6QDMQ+4VlN8 + =EKZZ + -----END PGP MESSAGE----- + fp: 878FEA3CB6A6F6E7CD80ECBE28506E3585F9F533 + - created_at: "2026-09-24T18:45:14Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hF4DKKbvh61jX5USAQdAq3pzRuhl99Jshep49dS0lyNKi06ZEvGd/TELQM56oQgw + wMGmqictTPhYqvOUaQxtFZkuZcYmC+G0Az4j7COZuJa2PxrfubPMTqztPn8s2fhH + 1GgBCQIQw5Q4dUgUHxpGTDnXOue14UHm6vYtiHnl0nFDv0b9mLWRSvYLdUZ+jbDL + MlMl1ntxLS1Kko+UTNR2kKC5JQAPcWT2P1zlqb5if7/H5eHwNpsBXTB+WrXXEfkQ + tdXY71KRXL569Q== + =PnlM + -----END PGP MESSAGE----- + fp: 41FFAF3D519CF5C039FBD8414BCC213729AF0E49 unencrypted_suffix: _unencrypted version: 3.13.3 From 726dab1ccfc3cd55333995253518881531c40986 Mon Sep 17 00:00:00 2001 From: June Date: Mon, 28 Sep 2026 21:41:17 +0200 Subject: [PATCH 29/34] public-web-static: add configuration for www.didays.de redirect --- .../virtualHosts/didays.de.nix | 40 +++++++++++++++++++ 1 file changed, 40 insertions(+) diff --git a/config/hosts/public-web-static/virtualHosts/didays.de.nix b/config/hosts/public-web-static/virtualHosts/didays.de.nix index 6874e4f..ab3cc7b 100644 --- a/config/hosts/public-web-static/virtualHosts/didays.de.nix +++ b/config/hosts/public-web-static/virtualHosts/didays.de.nix @@ -5,10 +5,15 @@ let dataDir = "/var/www/${domain}"; deployUser = "didays-deploy"; in { + security.acme.certs."${domain}".extraDomainNames = [ "www.${domain}" ]; + services.nginx.virtualHosts = { "acme-${domain}" = { enableACME = true; serverName = "${domain}"; + serverAliases = [ + "www.${domain}" + ]; listen = [ { @@ -22,6 +27,41 @@ in { ]; }; + "www.${domain}" = { + forceSSL = true; + useACMEHost = "${domain}"; + + listen = [ + { + addr = "[::]"; + port = 8443; + ssl = true; + proxyProtocol = true; + } + { + addr = "0.0.0.0"; + port = 8443; + ssl = true; + proxyProtocol = true; + } + ]; + + locations."/" = { + return = "302 https://didays.de$request_uri"; + }; + + extraConfig = '' + # Make use of the ngx_http_realip_module to set the $remote_addr and + # $remote_port to the client address and client port, when using proxy + # protocol. + # First set our proxy protocol proxy as trusted. + set_real_ip_from 172.31.17.140; + # Then tell the realip_module to get the addreses from the proxy protocol + # header. + real_ip_header proxy_protocol; + ''; + }; + "${domain}" = { forceSSL = true; useACMEHost = "${domain}"; From 58ed5acb9593c04e3213cc88742f7612b83dafc1 Mon Sep 17 00:00:00 2001 From: June Date: Tue, 29 Sep 2026 01:39:51 +0200 Subject: [PATCH 30/34] Upgrade to NixOS 26.05 (for all hosts) --- .../element-admin.hamburg.ccc.de.nix | 4 ++-- flake.lock | 23 +++---------------- flake.nix | 7 +++--- 3 files changed, 8 insertions(+), 26 deletions(-) diff --git a/config/hosts/public-web-static/virtualHosts/element-admin.hamburg.ccc.de.nix b/config/hosts/public-web-static/virtualHosts/element-admin.hamburg.ccc.de.nix index 8ee4336..95ceeb7 100644 --- a/config/hosts/public-web-static/virtualHosts/element-admin.hamburg.ccc.de.nix +++ b/config/hosts/public-web-static/virtualHosts/element-admin.hamburg.ccc.de.nix @@ -18,8 +18,8 @@ let pnpmDeps = pkgs.pnpm.fetchDeps { inherit (finalAttrs) pname version src; - fetcherVersion = 2; - hash = "sha256-Hf4PWey5bczSNbc3QQ9z9X3OVUZ7VHXw7BHGQqJWPac="; + fetcherVersion = 4; + hash = "sha256-wUAzyx9QsdW2kT2tBX6HeZz20c0Hbz1HZjscb4NCz9E="; }; buildPhase = '' diff --git a/flake.lock b/flake.lock index d3c87ea..04f7d9d 100644 --- a/flake.lock +++ b/flake.lock @@ -19,27 +19,11 @@ }, "nixpkgs": { "locked": { - "lastModified": 1782847189, - "narHash": "sha256-twXPFqFsrrY5r28Zh7Homgcp2gUMBgQ6WDS98Q/3xFI=", + "lastModified": 1790533781, + "narHash": "sha256-F+b8u43BVF5DlM0pz7JQSbtbwKy5PrHIT5zQUekXsD0=", "owner": "nixos", "repo": "nixpkgs", - "rev": "b6018f87da91d19d0ab4cf979885689b469cdd41", - "type": "github" - }, - "original": { - "owner": "nixos", - "ref": "nixos-25.11", - "repo": "nixpkgs", - "type": "github" - } - }, - "nixpkgs-2605": { - "locked": { - "lastModified": 1789749394, - "narHash": "sha256-cFTsMQz8Hzn8MT49oaeLSHg62tE86NykugCWkeM2ypk=", - "owner": "nixos", - "repo": "nixpkgs", - "rev": "cf9d2fb3e50fa1cd5114c47505ea9177f7ff5f49", + "rev": "cf5e76507c6e23b59f7e0ffcc7baa2a39ddd8442", "type": "github" }, "original": { @@ -69,7 +53,6 @@ "inputs": { "authorizedKeysRepo": "authorizedKeysRepo", "nixpkgs": "nixpkgs", - "nixpkgs-2605": "nixpkgs-2605", "nixpkgs-unstable": "nixpkgs-unstable", "sops-nix": "sops-nix" } diff --git a/flake.nix b/flake.nix index f75f2d4..238204e 100644 --- a/flake.nix +++ b/flake.nix @@ -5,9 +5,8 @@ # Use the NixOS small channels for nixpkgs. # https://nixos.org/manual/nixos/stable/#sec-upgrading # https://github.com/NixOS/nixpkgs - nixpkgs.url = "github:nixos/nixpkgs/nixos-25.11"; + nixpkgs.url = "github:nixos/nixpkgs/nixos-26.05"; nixpkgs-unstable.url = "github:nixos/nixpkgs/nixpkgs-unstable"; - nixpkgs-2605.url = "github:nixos/nixpkgs?ref=nixos-26.05"; # # Add nixos-generators as an input. # # See here: https://github.com/nix-community/nixos-generators#using-in-a-flake @@ -29,7 +28,7 @@ }; }; - outputs = { self, nixpkgs, nixpkgs-unstable, nixpkgs-2605, sops-nix, authorizedKeysRepo, ... }: + outputs = { self, nixpkgs, nixpkgs-unstable, sops-nix, authorizedKeysRepo, ... }: let specialArgs = { inherit authorizedKeysRepo; @@ -89,7 +88,7 @@ ]; }; - git = nixpkgs-2605.lib.nixosSystem { + git = nixpkgs.lib.nixosSystem { inherit system specialArgs; modules = [ self.nixosModules.common From 47fcc72214384208d858f6eb20f6277085873680 Mon Sep 17 00:00:00 2001 From: June Date: Tue, 29 Sep 2026 01:41:10 +0200 Subject: [PATCH 31/34] flake.lock: Update MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Flake lock file updates: • Updated input 'nixpkgs-unstable': 'github:nixos/nixpkgs/6b5e5b7a6631f065bf6908986990b37d845f847f?narHash=sha256-smTKQXMLLStzc8zJevMCckbk3My7SvbbLmPYZUJJKW4%3D' (2026-08-13) → 'github:nixos/nixpkgs/419fe0f449b3fbe3bdd53d9840288db4509ec32e?narHash=sha256-Avcz96Q%2B8OkfUIUXipBBVsQn19L622BtKP7mk6M%2Buls%3D' (2026-09-28) • Updated input 'sops-nix': 'github:Mic92/sops-nix/a8627b21b9107c5711c96b84f32a9a4b3d45295f?narHash=sha256-gkig4nPi1CWc4Z50GBsjE4ygSE7hMpl/TwID2an2Cck%3D' (2026-08-13) → 'github:Mic92/sops-nix/5efb5a6f4f5ab192817d28557dd4d650fa14d866?narHash=sha256-rs9meAYxW3zzrh43yaW7htrqCD%2BX9%2BpupDPHN86fumI%3D' (2026-09-27) --- flake.lock | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/flake.lock b/flake.lock index 04f7d9d..00c7882 100644 --- a/flake.lock +++ b/flake.lock @@ -35,11 +35,11 @@ }, "nixpkgs-unstable": { "locked": { - "lastModified": 1786593342, - "narHash": "sha256-smTKQXMLLStzc8zJevMCckbk3My7SvbbLmPYZUJJKW4=", + "lastModified": 1790570722, + "narHash": "sha256-Avcz96Q+8OkfUIUXipBBVsQn19L622BtKP7mk6M+uls=", "owner": "nixos", "repo": "nixpkgs", - "rev": "6b5e5b7a6631f065bf6908986990b37d845f847f", + "rev": "419fe0f449b3fbe3bdd53d9840288db4509ec32e", "type": "github" }, "original": { @@ -64,11 +64,11 @@ ] }, "locked": { - "lastModified": 1786629091, - "narHash": "sha256-gkig4nPi1CWc4Z50GBsjE4ygSE7hMpl/TwID2an2Cck=", + "lastModified": 1790498116, + "narHash": "sha256-rs9meAYxW3zzrh43yaW7htrqCD+X9+pupDPHN86fumI=", "owner": "Mic92", "repo": "sops-nix", - "rev": "a8627b21b9107c5711c96b84f32a9a4b3d45295f", + "rev": "5efb5a6f4f5ab192817d28557dd4d650fa14d866", "type": "github" }, "original": { From 19508405c18bc0b64dcfdd4e0fb6aef37f5bcfa7 Mon Sep 17 00:00:00 2001 From: June Date: Tue, 29 Sep 2026 01:51:02 +0200 Subject: [PATCH 32/34] ptouch-print-server(host): make forcecommand-lpr-wrapper build again Make forcecommand-lpr-wrapper, and therefore the host, build again. --- config/hosts/ptouch-print-server/printing.nix | 3 +++ 1 file changed, 3 insertions(+) diff --git a/config/hosts/ptouch-print-server/printing.nix b/config/hosts/ptouch-print-server/printing.nix index 23cacca..ab5c58b 100644 --- a/config/hosts/ptouch-print-server/printing.nix +++ b/config/hosts/ptouch-print-server/printing.nix @@ -53,6 +53,9 @@ let name = "forcecommand-lpr-wrapper"; src = ./forcecommand-lpr-wrapper; + pyproject = true; + build-system = [ pkgs.python3Packages.setuptools ]; + propagatedBuildInputs = [ pkgs.cups ]; From 9d5fd9da7f6c1bbeeb8c9c581a0bf1401f31c19a Mon Sep 17 00:00:00 2001 From: June Date: Tue, 29 Sep 2026 02:02:05 +0200 Subject: [PATCH 33/34] public-web-static(host): update element-web and element-admin element-web: 1.12.18 -> 1.12.29 element-admin: 0.1.11 -> 0.1.14 --- .../virtualHosts/element-admin.hamburg.ccc.de.nix | 6 +++--- .../virtualHosts/element.hamburg.ccc.de.nix | 4 ++-- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/config/hosts/public-web-static/virtualHosts/element-admin.hamburg.ccc.de.nix b/config/hosts/public-web-static/virtualHosts/element-admin.hamburg.ccc.de.nix index 95ceeb7..14f8e6f 100644 --- a/config/hosts/public-web-static/virtualHosts/element-admin.hamburg.ccc.de.nix +++ b/config/hosts/public-web-static/virtualHosts/element-admin.hamburg.ccc.de.nix @@ -1,14 +1,14 @@ { config, pkgs, ... }: let - elementAdminVersion = "0.1.11"; + elementAdminVersion = "0.1.14"; elementAdmin = pkgs.stdenv.mkDerivation (finalAttrs: { pname = "element-admin"; version = elementAdminVersion; src = pkgs.fetchzip { url = "https://github.com/element-hq/element-admin/archive/refs/tags/v${elementAdminVersion}.zip"; - sha256 = "sha256-tSUTDPspQJjvP1KN4nUr4LYyjNQFj4pKMMA8JmavIxo="; + sha256 = "sha256-ncQjl2V+WhHeLSpPlj0yQ/yyr+RrEizep0pWD0nfECw="; }; nativeBuildInputs = [ @@ -19,7 +19,7 @@ let pnpmDeps = pkgs.pnpm.fetchDeps { inherit (finalAttrs) pname version src; fetcherVersion = 4; - hash = "sha256-wUAzyx9QsdW2kT2tBX6HeZz20c0Hbz1HZjscb4NCz9E="; + hash = "sha256-YMYSJybWCLZuPs8fa4YNFgoQYdjfTQRlCOni7MaYjbQ="; }; buildPhase = '' diff --git a/config/hosts/public-web-static/virtualHosts/element.hamburg.ccc.de.nix b/config/hosts/public-web-static/virtualHosts/element.hamburg.ccc.de.nix index f781dc0..c976780 100644 --- a/config/hosts/public-web-static/virtualHosts/element.hamburg.ccc.de.nix +++ b/config/hosts/public-web-static/virtualHosts/element.hamburg.ccc.de.nix @@ -1,10 +1,10 @@ { pkgs, ... }: let - elementWebVersion = "1.12.18"; + elementWebVersion = "1.12.29"; element-web = pkgs.fetchzip { url = "https://github.com/element-hq/element-web/releases/download/v${elementWebVersion}/element-v${elementWebVersion}.tar.gz"; - sha256 = "sha256-RvPJg28hgOgFs0GFZ9EPypQkUPkAns0alXYJeNst4Bk="; + sha256 = "sha256-lyRg9vGW5TyU/ynl+qJcYHlmgAMO9GJbg7BuZ6Jym60="; }; elementSecurityHeaders = '' # Configuration best practices From 0dbf7fd348bfca68ca86c5f7d16e0bdb5f79c92f Mon Sep 17 00:00:00 2001 From: June Date: Tue, 29 Sep 2026 02:47:52 +0200 Subject: [PATCH 34/34] public-web-static(host): switch to spaceapid v0.2.0-rc1 and SpaceAPI v15 Switch to spaceapid v0.2.0-rc1 and support SpaceAPI v15. Add additional location information and links to our projects. --- .../spaceapid-config/ccchh-response.json | 22 ++++++++++++++++--- config/hosts/public-web-static/spaceapid.nix | 4 ++-- 2 files changed, 21 insertions(+), 5 deletions(-) diff --git a/config/hosts/public-web-static/spaceapid-config/ccchh-response.json b/config/hosts/public-web-static/spaceapid-config/ccchh-response.json index b49b2da..f597464 100644 --- a/config/hosts/public-web-static/spaceapid-config/ccchh-response.json +++ b/config/hosts/public-web-static/spaceapid-config/ccchh-response.json @@ -1,7 +1,8 @@ { - "response": { + "static": { "api_compatibility": [ - "14" + "14", + "15" ], "space": "CCCHH", "logo": "https://hamburg.ccc.de/images/logo.svg", @@ -10,7 +11,18 @@ "location": { "address": "Zeiseweg 9, 22765 Hamburg, Germany", "lon": 9.9445899999999998, - "lat": 53.55836 + "lat": 53.55836, + "timezone": "Europe/Berlin", + "country_code": "DE", + "hint": "1337 an der Türsprechstelle. Sollte das nicht funktionieren, dann +49 40 23830150 oder +49 221 596191008 anrufen. Siehe https://hamburg.ccc.de/#kontakt für detaillierte Informationen.", + "areas": [ + { + "name": "Hauptraum" + }, + { + "name": "Nebenraum" + } + ] }, "contact": { "phone": "+49 40 23830150", @@ -29,6 +41,10 @@ "url": "webcal://cloud.hamburg.ccc.de/remote.php/dav/public-calendars/QJAdExziSnNJEz5g/?export" } }, + "projects": [ + "https://wiki.hamburg.ccc.de/club:projekte:start", + "https://git.hamburg.ccc.de/CCCHH" + ], "links": [ { "name": "Wiki", diff --git a/config/hosts/public-web-static/spaceapid.nix b/config/hosts/public-web-static/spaceapid.nix index 3f1f8fe..6d94892 100644 --- a/config/hosts/public-web-static/spaceapid.nix +++ b/config/hosts/public-web-static/spaceapid.nix @@ -1,11 +1,11 @@ { pkgs, ... }: let - version = "v0.1.0"; + version = "v0.2.0-rc1"; spaceapidSrc = pkgs.fetchgit { url = "https://git.hamburg.ccc.de/CCCHH/spaceapid.git"; rev = version; - hash = "sha256-2SDhliltzyydPPZdNn/htDydiK/SHQcYyG/dQ0EyFrY="; + hash = "sha256-pmfcPYB1amfx1MQgVwcpnNRl+iYn7zFuRQY0jkv8VXo="; }; spaceapid = pkgs.buildGoModule rec { pname = "spaceapid";