add yate service for autostart

introduce /etc/yate, clone/reset on service start

Fix config via git

make yate systemd service

create yate service user

recreate the full config everytime

decolour the log because of blob data

make sure source is available before deleting config

change yate-config repo

fix yate deploy key

fix yate-config not pulling

.editorconfig

@@ -1,23 +0,0 @@
-root = true
-
-[*]
-end_of_line = lf
-insert_final_newline = true
-indent_style = space
-charset = utf-8
-
-[*.nix]
-indent_size = 2
-trim_trailing_whitespace = true
-
-[*.md]
-indent_size = 2
-trim_trailing_whitespace = false
-
-[*.json]
-indent_size = 2
-trim_trailing_whitespace = true
-
-[*.yaml]
-indent_size = 2
-trim_trailing_whitespace = true

.sops.yaml

@@ -16,9 +16,6 @@ keys:
   - &host_age_netbox age13fqs76z2vl5l84dvmmlqjj5xkfsfe85xls8uueul7re9j3ksjs0sw2xc9e
   - &host_age_public_web_static age19s7r8sf7j6zk24x9vumawgxpd2q8epyv7p9qsjntw7v9s3v045mqhmsfp0
   - &host_age_yate age1kxzl00cfa5v926cvtcp0l3fncwh6fgmk8jvpf4swkl4vh3hv9e5qyqsrnt
-  - &host_age_mjolnir age1ej52kwuj8xraxdq685eejj4dmxpfmpgt4d8jka98rtpal6xcueqq9a6wae
-  - &host_age_woodpecker age1klxtcr23hers0lh4f5zdd53tyrtg0jud35rhydstyjq9fjymf9hsn2a8ch
-  - &host_age_penpot age10ku5rphtsf2lcxg78za7f2dad5cx5x9urgkce0d7tyqwq2enva9sqf7g8r
 creation_rules:
   - path_regex: config/hosts/git/.*
     key_groups:
@@ -100,54 +97,6 @@ creation_rules:
           - *admin_gpg_dante
         age:
           - *host_age_public_web_static
-  - path_regex: config/hosts/mjolnir/.*
-    key_groups:
-      - pgp:
-          - *admin_gpg_djerun
-          - *admin_gpg_stb
-          - *admin_gpg_jtbx
-          - *admin_gpg_yuri
-          - *admin_gpg_june
-          - *admin_gpg_haegar
-          - *admin_gpg_dario
-          - *admin_gpg_echtnurich
-          - *admin_gpg_max
-          - *admin_gpg_c6ristian
-          - *admin_gpg_dante
-        age:
-          - *host_age_mjolnir
-  - path_regex: config/hosts/woodpecker/.*
-    key_groups:
-      - pgp:
-          - *admin_gpg_djerun
-          - *admin_gpg_stb
-          - *admin_gpg_jtbx
-          - *admin_gpg_yuri
-          - *admin_gpg_june
-          - *admin_gpg_haegar
-          - *admin_gpg_dario
-          - *admin_gpg_echtnurich
-          - *admin_gpg_max
-          - *admin_gpg_c6ristian
-          - *admin_gpg_dante
-        age:
-          - *host_age_woodpecker
-  - path_regex: config/hosts/penpot/.*
-    key_groups:
-      - pgp:
-          - *admin_gpg_djerun
-          - *admin_gpg_stb
-          - *admin_gpg_jtbx
-          - *admin_gpg_yuri
-          - *admin_gpg_june
-          - *admin_gpg_haegar
-          - *admin_gpg_dario
-          - *admin_gpg_echtnurich
-          - *admin_gpg_max
-          - *admin_gpg_c6ristian
-          - *admin_gpg_dante
-        age:
-          - *host_age_penpot
   - path_regex: config/hosts/yate/.*
     key_groups:
       - pgp:

LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) CCCHH
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.

README.md

@@ -18,62 +18,3 @@ infra-rebuild switch git matrix
 By default infra-rebuild tries to use the FQDN from the nixosConfiguration of the host for deployment.
 However to override individual parts of the deployment target, a [`deployment_configuration.json`](./deployment_configuration.json) can be used.
 This is exactly what we're doing to set the default deployment user to `colmena-deploy` and have custom target hostnames for Chaosknoten hosts, since they don't have an FQDN defined in their nixosConfiguration.
-
-## Setting up secrets with sops-nix for a host
-
-1. Convert the hosts SSH host public key to an age public key.
-   This can be done by connecting to the host and running:
-   ```
-   cat /etc/ssh/ssh_host_ed25519_key.pub | ssh-to-age
-   ``` 
-2. Add the resulting age public key to the `.sops.yaml` as a YAML anchor in keys.
-   It should be named something like: `host_age_hostname`
-3. Add a new creation rule for the hosts config directory.
-   It should probably have all admin keys and the hosts age key. \
-   You can use existing creation rules as a reference.
-4. Create a file containing the relevant secrets in the hosts config directory.
-   This can be accomplished with a command similar to this:
-   ```
-   sops config/hosts/hostname/secrets.yaml
-   ```
-   Note: Nested keys don't seem to be compatible with sops-nix.
-5. Add the following entry to the modules of the hosts `nixosConfiguration`:
-   ```nix
-   sops-nix.nixosModules.sops
-   ```
-6. Create a `sops.nix` in the hosts config directory containing the following content to include the `secrets.yaml`:
-   ```nix
-   { ... }:
-
-   {
-     sops = {
-       defaultSopsFile = ./secrets.yaml;
-     };
-   }
-   ```
-7. Make sure the `sops.nix` gets imported. For example in the `default.nix`.
-8. To use a secret stored under e.g. `forgejo_git_smtp_password`, you can then do something like the following:
-   ```nix
-   sops.secrets."forgejo_git_smtp_password" = {
-     mode = "0440";
-     owner = "forgejo";
-     group = "forgejo";
-     restartUnits = [ "forgejo.service" ];
-   };
-   ```
-   This secret would then be available under `/run/secrets/forgejo_git_smtp_password` on the host.
-
-## Build NixOS Proxmox VE Template
-
-Build a new NixOS Proxmox VE Template for the thinkcccore's:
-```shell
-nix build .#proxmox-nixos-template
-```
-Build a new NixOS Proxmox VE Template for the chaosknoten:
-```shell
-nix build .#proxmox-chaosknoten-nixos-template
-```
-
-## License
-
-This CCCHH nix-infra repository is licensed under the [MIT License](./LICENSE).

config/common/admin-environment.nix

@@ -13,7 +13,6 @@
     git
     curl
     rsync
-    ssh-to-age
     usbutils
     nix-tree
     # For kitty terminfo.

config/common/default-state-version.nix

@@ -13,5 +13,5 @@
   # this value at the release version of the first install of this system.
   # Before changing this value read the documentation for this option
   # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
-  system.stateVersion = lib.mkDefault "24.05";
+  system.stateVersion = lib.mkDefault "23.05";
 }

config/common/users.nix

@@ -6,9 +6,14 @@
 # - https://git.grzb.de/yuri/nix-infra/-/blob/342a2f732da042d04e579d98e9f834418b7ebf25/users/colmena-deploy/default.nix
 # - https://nixos.org/manual/nix/stable/command-ref/conf-file.html?highlight=nix.conf#available-settings
 
-{ config, pkgs, lib, authorizedKeysRepo, ... }:
+{ config, pkgs, lib, ... }:
 
 let
+  authorizedKeysRepo = builtins.fetchGit {
+    url = "forgejo@git.hamburg.ccc.de:CCCHH/infrastructure-authorized-keys.git";
+    ref = "trunk";
+    rev = "da9d3ead9d97ce0fef7538638326264957e2f1b4";
+  };
   authorizedKeys = builtins.filter (item: item != "") (lib.strings.splitString "\n" (builtins.readFile "${authorizedKeysRepo}/authorized_keys"));
 in
 {

config/extra/prometheus-exporter.nix

@@ -1,8 +0,0 @@
-{ ... }:
-
-{
-  services.prometheus.exporters.node = {
-    enable = true;
-    openFirewall = true;
-  };
-}

config/hosts/audio-hauptraum-kueche/networking.nix

@@ -1,4 +1,4 @@
-{ ... }:
+{ config, pkgs, ... }:
 
 {
   networking = {
@@ -11,9 +11,10 @@
       ];
     };
     defaultGateway = "10.31.210.1";
-    nameservers = [ "10.31.210.1" ];
+    nameservers = [
+      "10.31.210.1"
+    ];
   };
-
   systemd.network.links."10-net0" = {
     matchConfig.MACAddress = "1E:EF:2D:92:81:DA";
     linkConfig.Name = "net0";

config/hosts/audio-hauptraum-tafel/networking.nix

@@ -1,4 +1,4 @@
-{ ... }:
+{ config, pkgs, ... }:
 
 {
   networking = {
@@ -11,9 +11,10 @@
       ];
     };
     defaultGateway = "10.31.210.1";
-    nameservers = [ "10.31.210.1" ];
+    nameservers = [
+      "10.31.210.1"
+    ];
   };
-
   systemd.network.links."10-net0" = {
     matchConfig.MACAddress = "D2:10:33:B1:72:C3";
     linkConfig.Name = "net0";

config/hosts/eh22-wiki/dokuwiki.nix

@@ -21,8 +21,7 @@ let
   app = "dokuwiki";
   domain = "eh22.easterhegg.eu";
   dataDir = "/srv/www/${domain}";
-in
+in {
-{
   systemd.tmpfiles.rules = [
     "d ${dataDir} 0755 ${app} ${app}"
   ];
@@ -58,16 +57,16 @@ in
       ; Checked with NixOS 23.11 on 2024-05-02.
       extension = ${pkgs.phpExtensions.bz2}/lib/php/extensions/bz2.so
     '';
-    settings = {
+    extraConfig = ''
-      "listen.owner" = "${config.services.nginx.user}";
+      listen.owner = ${config.services.nginx.user};
-      "listen.group" = "${config.services.nginx.group}";
+      listen.group = ${config.services.nginx.group};
-      "pm" = "dynamic";
+      pm = dynamic
-      "pm.max_children" = 32;
+      pm.max_children = 32
-      "pm.start_servers" = 2;
+      pm.start_servers = 2
-      "pm.min_spare_servers" = 2;
+      pm.min_spare_servers = 2
-      "pm.max_spare_servers" = 4;
+      pm.max_spare_servers = 4
-      "pm.max_requests" = 500;
+      pm.max_requests = 500
-    };
+    '';
   };
 
   services.nginx = {

config/hosts/eh22-wiki/networking.nix

@@ -1,8 +1,10 @@
+# Sources for this configuration:
+# - https://nixos.wiki/wiki/Networking
+
 { ... }:
 
 {
-  networking = {
+  networking.interfaces.net0 = {
-    interfaces.net0 = {
     ipv4.addresses = [
       {
         address = "172.31.17.159";
@@ -10,10 +12,9 @@
       }
     ];
   };
-    defaultGateway = "172.31.17.129";
+  networking.defaultGateway = "172.31.17.129";
-    nameservers = [ "212.12.50.158" "192.76.134.90" ];
+  networking.nameservers = [ "212.12.50.158" "192.76.134.90" ];
-    search = [ "hamburg.ccc.de" ];
+  networking.search = [ "hamburg.ccc.de" ];
-  };
 
   systemd.network.links."10-net0" = {
     matchConfig.MACAddress = "BC:24:11:37:F0:AB";

config/hosts/esphome/default.nix

@@ -3,7 +3,6 @@
   imports = [
     ./configuration.nix
     ./esphome.nix
-    ./networking.nix
     ./nginx.nix
   ];
 }

config/hosts/esphome/networking.nix

@@ -1,29 +0,0 @@
-{ ... }:
-
-{
-  networking = {
-    interfaces.net0 = {
-      ipv4.addresses = [
-        {
-          address = "10.31.208.24";
-          prefixLength = 23;
-        }
-      ];
-      ipv6.addresses = [
-        {
-          address = "2a07:c480:0:1d0::66";
-          prefixLength = 64;
-        }
-      ];
-    };
-    defaultGateway = "10.31.208.1";
-    defaultGateway6 = "2a07:c480:0:1d0::1";
-    nameservers = [ "10.31.208.1" "2a07:c480:0:1d0::1" ];
-    search = [ "z9.ccchh.net" ];
-  };
-
-  systemd.network.links."10-net0" = {
-    matchConfig.MACAddress = "7E:3C:F0:77:8A:F4";
-    linkConfig.Name = "net0";
-  };
-}

config/hosts/esphome/nginx.nix

@@ -1,34 +1,35 @@
 { config, ... }:
-
 {
   services.nginx = {
     enable = true;
 
     virtualHosts = {
-      "esphome.ccchh.net" = {
+      "acme-esphome.ccchh.net" = {
-        forceSSL = true;
         enableACME = true;
         serverName = "esphome.ccchh.net";
 
+        listen = [
+          {
+            addr = "0.0.0.0";
+            port = 31820;
+          }
+        ];
+      };
+
+      "esphome.ccchh.net" = {
+        forceSSL = true;
+        useACMEHost = "esphome.ccchh.net";
+
         listen = [
           {
             addr = "0.0.0.0";
             port = 80;
           }
-          {
-            addr = "[::]";
-            port = 80;
-          }
           {
             addr = "0.0.0.0";
             port = 443;
             ssl = true;
           }
-          {
-            addr = "[::]";
-            port = 443;
-            ssl = true;
-          }
         ];
 
         locations."/" = {
@@ -36,38 +37,9 @@
           proxyWebsockets = true;
         };
       };
-      "esphome.z9.ccchh.net" = {
-        forceSSL = true;
-        useACMEHost = "esphome.ccchh.net";
-        serverName = "esphome.z9.ccchh.net";
 
-        listen = [
-          {
-            addr = "0.0.0.0";
-            port = 80;
-          }
-          {
-            addr = "[::]";
-            port = 80;
-          }
-          {
-            addr = "0.0.0.0";
-            port = 443;
-            ssl = true;
-          }
-          {
-            addr = "[::]";
-            port = 443;
-            ssl = true;
-          }
-        ];
-
-        globalRedirect = "esphome.ccchh.net";
-        redirectCode = 307;
     };
   };
-  };
-  security.acme.certs."esphome.ccchh.net".extraDomainNames = [ "esphome.z9.ccchh.net" ];
 
-  networking.firewall.allowedTCPPorts = [ 80 443 ];
+  networking.firewall.allowedTCPPorts = [ 80 443 31820 ];
 }

config/hosts/forgejo-actions-runner/networking.nix

@@ -1,8 +1,7 @@
-{ ... }:
+{ config, pkgs, ... }:
 
 {
-  networking = {
+  networking.interfaces.net0 = {
-    interfaces.net0 = {
     ipv4.addresses = [
       {
         address = "172.31.17.155";
@@ -10,10 +9,9 @@
       }
     ];
   };
-    defaultGateway = "172.31.17.129";
+  networking.defaultGateway = "172.31.17.129";
-    nameservers = [ "212.12.50.158" "192.76.134.90" ];
+  networking.nameservers = [ "212.12.50.158" "192.76.134.90" ];
-    search = [ "hamburg.ccc.de" ];
+  networking.search = [ "hamburg.ccc.de" ];
-  };
 
   systemd.network.links."10-net0" = {
     matchConfig.MACAddress = "1E:E0:4E:D0:DA:BE";

config/hosts/git/forgejo.nix

@@ -12,6 +12,7 @@
 {
   services.forgejo = {
     enable = true;
+    package = pkgs-unstable.forgejo;
     database.type = "postgres";
     mailerPasswordFile = "/run/secrets/forgejo_git_smtp_password";
 
@@ -45,9 +46,6 @@
         DEFAULT_USER_VISIBILITY = "limited";
         DEFAULT_KEEP_EMAIL_PRIVATE = true;
         ENABLE_BASIC_AUTHENTICATION = false;
-        ENABLE_NOTIFY_MAIL = true;
-        AUTO_WATCH_NEW_REPOS = false;
-        AUTO_WATCH_ON_CHANGES = false;
       };
       repo = {
         DEFAULT_REPO_UNITS = "repo.code,repo.issues,repo.pulls";

config/hosts/git/networking.nix

@@ -4,18 +4,19 @@
 { ... }:
 
 {
-  networking = {
+  networking.interfaces.net0 = {
-    interfaces.net0 = {
     ipv4.addresses = [
       {
         address = "212.12.51.136";
         prefixLength = 28;
       }
-        {
-          address = "172.31.17.154";
-          prefixLength = 25;
-        }
     ];
+  };
+  networking.defaultGateway = "212.12.51.129";
+  networking.nameservers = [ "212.12.50.158" "192.76.134.90" ];
+  networking.search = [ "hamburg.ccc.de" ];
+
+  networking.interfaces.net0 = {
     ipv6.addresses = [
       {
         address = "2a00:14b0:f000:23:51:136::1";
@@ -23,11 +24,7 @@
       }
     ];
   };
-    defaultGateway = "212.12.51.129";
+  networking.defaultGateway6 = "2a00:14b0:f000:23::1";
-    defaultGateway6 = "2a00:14b0:f000:23::1";
-    nameservers = [ "212.12.50.158" "192.76.134.90" ];
-    search = [ "hamburg.ccc.de" ];
-  };
 
   systemd.network.links."10-net0" = {
     matchConfig.MACAddress = "92:7B:E6:12:A4:FA";

config/hosts/git/nginx.nix

@@ -34,10 +34,6 @@
         return = "200 \"User-agent: *\\nDisallow: /*/*/archive/\\n\"";
       };
     };
-
-    # Disable checking of client request body size to make container registry
-    # image uploads work.
-    clientMaxBodySize = "0";
   };
 
   networking.firewall.allowedTCPPorts = [ 80 443 ];

config/hosts/hydra/configuration.nix

@@ -1,9 +0,0 @@
-{ ... }:
-
-{
-  networking = {
-    hostName = "hydra";
-  };
-
-  system.stateVersion = "24.05";
-}

config/hosts/hydra/default.nix

@@ -1,11 +0,0 @@
-{ ... }:
-
-{
-  imports = [
-    ./configuration.nix
-    ./hydra.nix
-    ./networking.nix
-    ./nginx.nix
-    ./nix.nix
-  ];
-}

config/hosts/hydra/hydra.nix

@@ -1,15 +0,0 @@
-{ ... }:
-
-{
-  services.hydra = {
-    enable = true;
-    listenHost = "localhost";
-    port = 3000;
-    hydraURL = "https://hydra.hamburg.ccc.de/";
-    # E-Mail configuration requires some work/investigation still.
-    notificationSender = "no-reply@hydra.hamburg.ccc.de";
-    useSubstitutes = true;
-    minimumDiskFree = 8;
-    minimumDiskFreeEvaluator = 2;
-  };
-}

config/hosts/hydra/networking.nix

@@ -1,22 +0,0 @@
-{ ... }:
-
-{
-  networking = {
-    interfaces.net0 = {
-      ipv4.addresses = [
-        {
-          address = "172.31.17.163";
-          prefixLength = 25;
-        }
-      ];
-    };
-    defaultGateway = "172.31.17.129";
-    nameservers = [ "212.12.50.158" "192.76.134.90" ];
-    search = [ "hamburg.ccc.de" ];
-  };
-
-  systemd.network.links."10-net0" = {
-    matchConfig.MACAddress = "BC:24:11:45:7C:D6";
-    linkConfig.Name = "net0";
-  };
-}

config/hosts/hydra/nginx.nix

@@ -1,58 +0,0 @@
-{ config, pkgs, ... }:
-
-let
-  domain = "hydra.hamburg.ccc.de";
-in
-{
-  services.nginx = {
-    enable = true;
-
-    virtualHosts = {
-      "acme-${domain}" = {
-        default = true;
-        enableACME = true;
-        serverName = "${domain}";
-
-        listen = [
-          {
-            addr = "0.0.0.0";
-            port = 31820;
-          }
-        ];
-      };
-
-      "${domain}" = {
-        default = true;
-        forceSSL = true;
-        useACMEHost = "${domain}";
-
-        listen = [
-          {
-            addr = "0.0.0.0";
-            port = 8443;
-            ssl = true;
-            proxyProtocol = true;
-          }
-        ];
-
-        locations."/" = {
-          proxyPass = "http://${config.services.hydra.listenHost}:${builtins.toString config.services.hydra.port}";
-        };
-
-        extraConfig = ''
-          # Make use of the ngx_http_realip_module to set the $remote_addr and
-          # $remote_port to the client address and client port, when using proxy
-          # protocol.
-          # First set our proxy protocol proxy as trusted.
-          set_real_ip_from 172.31.17.140;
-          # Then tell the realip_module to get the addreses from the proxy protocol
-          # header.
-          real_ip_header proxy_protocol;
-        '';
-      };
-    };
-  };
-
-  networking.firewall.allowedTCPPorts = [ 8443 31820 ];
-  networking.firewall.allowedUDPPorts = [ 8443 ];
-}

config/hosts/hydra/nix.nix

@@ -1,10 +0,0 @@
-{ ... }:
-
-{
-  # Allow Hydra to fetch flake inputs.
-  nix.settings.allowed-uris = [
-    "github:"
-    "https://github.com/"
-    "https://git.hamburg.ccc.de/"
-  ];
-}

config/hosts/matrix/networking.nix

@@ -1,8 +1,7 @@
 { ... }:
 
 {
-  networking = {
+  networking.interfaces.net0 = {
-    interfaces.net0 = {
     ipv4.addresses = [
       {
         address = "172.31.17.150";
@@ -10,10 +9,9 @@
       }
     ];
   };
-    defaultGateway = "172.31.17.129";
+  networking.defaultGateway = "172.31.17.129";
-    nameservers = [ "212.12.50.158" "192.76.134.90" ];
+  networking.nameservers = [ "212.12.50.158" "192.76.134.90" ];
-    search = [ "hamburg.ccc.de" ];
+  networking.search = [ "hamburg.ccc.de" ];
-  };
 
   systemd.network.links."10-net0" = {
     matchConfig.MACAddress = "2A:A5:80:C3:8E:32";

config/hosts/mjolnir/configuration.nix

@@ -1,9 +0,0 @@
-{ ... }:
-
-{
-  networking = {
-    hostName = "mjolnir";
-  };
-
-  system.stateVersion = "24.05";
-}

config/hosts/mjolnir/default.nix

@@ -1,10 +0,0 @@
-{ ... }:
-
-{
-  imports = [
-    ./configuration.nix
-    ./mjolnir.nix
-    ./networking.nix
-    ./sops.nix
-  ];
-}

config/hosts/mjolnir/mjolnir.nix

@@ -1,36 +0,0 @@
-# Sources for this configuration:
-# - https://github.com/matrix-org/mjolnir/blob/main/docs/setup.md
-# - https://github.com/matrix-org/mjolnir/blob/main/config/default.yaml
-
-{ ... }:
-
-{
-  # Allow deprecated, apparently somewhat insecure libolm to be able to update
-  # the moderation bot.
-  # The security issues aren't real world exploitable apparently:
-  # https://matrix.org/blog/2024/08/libolm-deprecation/
-  nixpkgs.config.permittedInsecurePackages = [ "olm-3.2.16" ];
-  services.mjolnir = {
-    enable = true;
-    homeserverUrl = "https://matrix.hamburg.ccc.de";
-    managementRoom = "#moderation-management:hamburg.ccc.de";
-    settings = {
-      verboseLogging = false;
-    };
-    pantalaimon = {
-      enable = true;
-      username = "moderation";
-      passwordFile = "/run/secrets/matrix_moderation_user_password";
-      options = {
-        ssl = true;
-      };
-    };
-  };
-
-  sops.secrets."matrix_moderation_user_password" = {
-    mode = "0440";
-    owner = "mjolnir";
-    group = "mjolnir";
-    restartUnits = [ "mjolnir.service" ];
-  };
-}

config/hosts/mjolnir/networking.nix

@@ -1,22 +0,0 @@
-{ ... }:
-
-{
-  networking = {
-    interfaces.net0 = {
-      ipv4.addresses = [
-        {
-          address = "172.31.17.161";
-          prefixLength = 25;
-        }
-      ];
-    };
-    defaultGateway = "172.31.17.129";
-    nameservers = [ "212.12.50.158" "192.76.134.90" ];
-    search = [ "hamburg.ccc.de" ];
-  };
-
-  systemd.network.links."10-net0" = {
-    matchConfig.MACAddress = "BC:24:11:C9:F8:C5";
-    linkConfig.Name = "net0";
-  };
-}

config/hosts/mjolnir/secrets.yaml

@@ -1,233 +0,0 @@
-matrix_moderation_user_password: ENC[AES256_GCM,data:NXJrbRh0A+NQh6Jy9iVAfYhsGR1BSOSuk1LjmArSiVF6jnuJAP9f750cRP7bu7Ai8xgxTlhjAtv9ck6SqlJ6Vw==,iv:IN/siIPCFKE+Nfl/aogYRYAHVgEGhMtTbmEZKZWQYgM=,tag:xxlnl5GU+uusSeh1OvoU1g==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age1ej52kwuj8xraxdq685eejj4dmxpfmpgt4d8jka98rtpal6xcueqq9a6wae
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZTEhUMThoY3Nuc253NnBX
-            ZkplNmRzOGZFNWlQNDVpL08yRk5VTHZDUkZNCnIxMUJoUHJBYlJpbUViMW9GUmhR
-            V1F6SWh2NjRGWk9RWjMycGZYZXFZbkkKLS0tIE5MNk0xekwxY0NYYm9mc1ZGZFlH
-            NDN2dUpuQWFFMTZQRzFIS0ZieTRzQm8KUDRpPJwcWwePKMp6KQMnQLhqqyvuhgQh
-            rXpKW5fjxyT0Sh2u3FM2ET/9U0TUfpBVYBJojAJBFs1ntI8kFmqSYg==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-06-20T20:02:16Z"
-    mac: ENC[AES256_GCM,data:5BhSo3YpF3QNqgGnx6YnymaEQB6pchMhokaJqk4rHg22xhbUAzOhWg4BQepT7vrCQlfOZIq4o//dGO+NQxqliiyyywrSYm3CBWD4xfZ9cdfinHC7Pc9lj6Dd4uPNxRjgTRNFuMyC+ATIABI2mHKpg+T2bxSalroIlvNr4vXWZo4=,iv:yPHJZ5PvI5zJlQIMRdbJ6eKGe1xN+teKF5GluD2pyK8=,tag:s4hO9RCdkHDsQ1W+KfXq7A==,type:str]
-    pgp:
-        - created_at: "2024-06-20T20:01:32Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAxK/JaB2/SdtAQ//Y/GVthqtuK7bY8Ne5CNfn/CD1RUTdX1+KwX1zy3YsgUC
-            CGxhoFFy1UoXR3QB4Hxnk8R/vaFVHezCWKWY45MAuPtwM1VGwjVsuknrJnSs8k7/
-            jrzVO9xXgTd26H6DLmPVfH1hKB0/lh84hwVgF5rlPS/P7l92LL0hDIIwZz3dB0kU
-            d6jLa1Fajqd4MSdLWbZRBPcioC5v1Ip/SXYAJp7IGLDgXm5MN+MnAdybAFsl1K5p
-            dCUmGqK5IjyPVP564TqL0ZEIXMxSSwex47in3cTYPaOO0L8P3kbKDNWxZQLaqZkn
-            4RZC4/aBqlfD2STxMez/ksi6kCcPuC7UPRzuq4oH3kOcJHxwIN8Df+DZYA4PJKsl
-            T9QDL1EylHBhsPIZCoxpmnGl3j+hVmONj2V1awlCaOagbgDlClEUEMyw7QCVVbtK
-            CW4DOgVnnTxcUaLHep8BgHxKkYjIDIbDMmg315h2ekT86gGgZavL8IiFTWSLzSrK
-            XChIjUdjpKZhanmSWpj4w8ZpdGOOjernL2EBWtSC23AibBZmQe9OB/QzMpLTdCvV
-            9t9mMoSayP61oJylBtOKhDnEW0Xib0U7tqzwpaow2V+CU2dr27qie1jh5GqMaoJR
-            qpu1KT3Z9eqpF3Dl8aI3dEovbmvDMVXErU3pmFu2zRJtm6TOXp4NNOYWCetUfxPU
-            aAEJAhCFerTI/ow/LWkCQ78cCMFjgKrYabA3lHu11Mr/PiHirwJ/vCmsUMiOhdRw
-            49lsyqJlO3IA79yW4exG5tYXvPgeJMTdz36fseUEKsewfrPEqMUa2T4onet2+GN6
-            GALPdepytjg+
-            =v+qv
-            -----END PGP MESSAGE-----
-          fp: EF643F59E008414882232C78FFA8331EEB7D6B70
-        - created_at: "2024-06-20T20:01:32Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQILA6EyPtWBEI+2AQ/2L7fbbhBH3BfgD7IbgtVn+nEhNJw5tWR2+0z1k72TIr9j
-            rPAvV6NQY8oVV2+uNLa4fMl+ueqYTFd3/E4IsRXkmexjx+vos27LjDNSu6w0OPJU
-            BSq5TFqZWYIPiWaivQz4+rt+vbxvpv4Lh3FAXlV9YubprJ4GRrlwyheve/l3F0BN
-            3vCDLsfXijZjxaptb9nf7WiT9vvWrY0sD4g71ARZdWi7Lb+TgCxzbQMue+4VC0Zu
-            y/AWIymVo13BD+apoYltVYYvkn7yz3REzsx3NN4bkJyoCAevr6UeO2fGvlT7b7eG
-            F7CN/TusFlOqWV9M0VbiOGLfL7Q9tGAG3xDAyFh+yMQNadp0M3m9UiYUlHps5DRT
-            CVsIPnPUr3V/oycRm3s+UeVyBg3rpdzWyNtETOjNY/AqVmRQ0toqZOm//ZOg609U
-            6+EX1Oc/GosfNoHWJuFmfKJRhPpy2gXZX2rQuLWaVJUXzzKM5sbLnycCV03S24PU
-            Fi7Z5lIu334QTLG8PV6agO5UprZb946qPmW+b/QnUol23XXcgh1GIgMV+lEK8+83
-            UPT0aUkdtOTaKbWUg5xokx+0Ni9syJ4Nl7naQq57qOGiecMnBbeE3TYxaNOcjTBh
-            CY0/hdcrZYH6VPeDye4yghSDF9WCaNUvzZNePGzdqKK3F9O/NmBSiYd/cToyDdJe
-            AZMZCKxSw0/HyBqTRd3wC/VhC9uO2I4HWE3LuqBPUXYFWc4W1buJs+P8pFjqT5rZ
-            puHPH8IxIeIiVNO5SFhdL8ecSu/nawakvih65aMGSa102e6B2HfP6tD4SmarmA==
-            =tr5G
-            -----END PGP MESSAGE-----
-          fp: F155144FC925A1BEA1F8A2C59A2A4CD59BFDC5EC
-        - created_at: "2024-06-20T20:01:32Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAz5uSgHG2iMJARAA02rGmKxyQkvxoXM1i2dLOiH6Gw/pUcdDxYSwKfdkNU3X
-            zc0He4FNG8CAURVq5jARD066VecamkBmlr+rwFJlaeqDPEiITfkz7DEGO8pPxKG0
-            GBnFVA9r/+OU351yLjHYB+72jvw1ey0PPHvKg6/sKjovssYvQLipUcktH33kPqVQ
-            yJzuQWFMWA7Jn/wTa/TP/53o0e//Kw9df69J3BSmnw9F6rKHGsIXLBmyR9HpQsLR
-            KAuClMzjPqHszCICND7vUDEzUvCcOVyizZAcRzWfDi/llwKGUanvEGUVXvyDXw/E
-            Q/FyR+VJXCzRlhsFTTuavjy6nhDsRf/N8N0Vsd9euDXOPQ4wuPAgpvdi58CPBmzP
-            8jU3xpFSXStYBIMt5u7t+UJT4IwdbjnClyIrSuyaV/7N5UQdYTv0fBy1mRrYLBAj
-            VhlRDa1y79n22Kg8mvDqJ16rC3VypkkQ6DaPvyDwlrG8iRLG/xi3Zz8HHnXxAGAm
-            SzliIolwEDHJZHI9ZE3YzpFJkB6UyOpXS1zMsDycupFvQ4jd2fQ0C7w5OaJHCkeQ
-            3zTKgtufjJGo7R2Nf0bTWTfi85GU3jpMsOHCEcChgBVXcO32ZZ/zzmqtXa/u3m5v
-            sjUstyBXEmG9eyIaiEtRAMAblwRsJPMszLaCUuBpzQw+mm9uTCsIaf5Xdud7GFzS
-            XgH+whlmbv/UeUC7bo65uxrG8SgTVAaPZpcQ2dP3rXYs45zYmYGKJaZuW+Hrl+nZ
-            pd6zT6rb6R8TMmXkNA1TjhvZ/A+ONlza1fH0dmsh7U9oqINXNFJU7Qm2r7imFvg=
-            =ZIDr
-            -----END PGP MESSAGE-----
-          fp: 18DFCE01456DAB52EA38A6584EDC64F35FA1D6A5
-        - created_at: "2024-06-20T20:01:32Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAw5vwmoEJHQ1AQ//f51KkC9oViW/0EA0TLdWgXa76ZXMeu4b3UhWaQvYDT9+
-            8wuWE+slGEWsRnFZ+pgWZoV3HIv2p+xisX2lmBvepOufaRh6cyNpQaZNl0kFtpBo
-            ShQ66SmkorunYyM+OIh3ceI4PC7ca4KsRKB8nWkA935NWssFN9zMlkVW6GjqzTft
-            2JVJFL8GRlhIRMhJwSzp8zZ3XiYD0sB/2y+ffCMAOSCnDVcDjANyiSds6MPxfPy0
-            /kaNTXuUI7H50tHQP6vzJ3q1mRpAhUTIxubnmBTdvAQz/kaD0qPt55z+Q0xSXsLa
-            yfb+Zd2g/2o+IFiCrwqcki5yX49Ol89l69JRyIWe1T2VtqBSUVIiiYreX5OnmWPQ
-            OjJ1mAn9tpIlVSHzlaONtmJEmAJ+n55rP0itBMs1CrIBiQleLaCbSWqp6q3RfaJr
-            gpXnfHQpsU7cKEDQeyvxmH8qgrSR9AVh/knyGOJy8LnJQ93aQpr3xr/2MiFPYiKz
-            dcSrxHesrfx2Zl7bNB5OZ7VZTWFSunZQUnOn3F3+7yaaT9ePsvWsyTKBOSGUiA7s
-            VMxT5+P8QM6UOC8KxJj/q1eAVrWvN7vYbCA25+SzbdTtr1RweOVHzNgqZH5/Q2ZY
-            fguwHlCGg5Q7UKYKBk4QJFg6oClDgzBYCFL76K4aymtR7rxKl4sJxWoug84oP6DS
-            XgEZvNS3xsY8Pxm0bAmor93Q08Mii1svnNZ74Eqmbo9GxBjHReIGKDDZ08SaPhbc
-            NJxAP2C2sRUda2R4GvsNYmXHzGYfFTrfe+AXqEV42ZSD9vHDJMCiX9JrY/r4uSM=
-            =+F4l
-            -----END PGP MESSAGE-----
-          fp: 87AB00D45D37C9E9167B5A5A333448678B60E505
-        - created_at: "2024-06-20T20:01:32Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA4HMJd/cQYrVARAAq/cP9y/7kxSXDFOD/xhI/3RjGzIN5dyHlfrmEQWJ8J7z
-            ov0VfBCJp6gFht37dGWuLtWi1qqWRgN+9hiBnkj2zONoph0SRGP9uNfadBSzYSD4
-            wvlOFrWeM9cswnk4i0q8Go+qdCC6U0g1szjirdifF7I9KdqKpOFwXzjnzsPTF42o
-            9oFCP32esOYv++DfTBgrSv8/STublJYABcs+lzjvURqBsFvdz7PBphH66++yxt7v
-            bTTmu8O9WHC8/5QTfUzOBAfgyu4CwF3YLRZd81ERtzO/udNYgGO3bifofCfpv+nY
-            MMyCbGxoiAfBWcAHhka+8nMnBj0as+ln220O99N6zH1rTmqqDxRQkEiYek1MqEU1
-            f319u3KqB6STWmZvjlwQ5AhwSLCLT2VpIJX4CpMClWlLb3E2rpZ+B1uBRMQQ3fMe
-            jSynatL2vXn3rKWzxIEIxA/BkVKQ8zXgOT9JyqyCZdHTvjEmWuQitILi7wKWJb7/
-            qhTGEBoQbjIKP2Bpso286RKhS3erE0wqLeXXFb7e6bkEEHXa/jVHCZk8/qDcAAIB
-            3eIb5SNnLxQwo07JlWdDPzCvqeC4fx5AWxXmHsKWI+91PA0jdNjcEPt2sxwAEQYq
-            LWBW6BL22Hqo/VOBXhM1T5mFKomqySLSrxTYeWXtJLZwh0aHbm6RyGGMjHpCiU3S
-            XgE8EQeKefLHoTixb1Rl/amIvtOUUcTtdqlyat9hhIdMl/7ZMesmNuD1ZsEzdCJd
-            20/DgHzFE7WvZKrjt73GDETUjwLHZSl5fydQMgcNFgzU2mdV6nYNhF18gE/af74=
-            =UA8K
-            -----END PGP MESSAGE-----
-          fp: 91213ABAA73B0B73D3C02B5B4E5F372D17BBE67C
-        - created_at: "2024-06-20T20:01:32Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAxjNhCKPP69fAQ//RVzQX4Ua5XZHTIe7ffYiqMxy/KoJdbCxpgjbdD0sx2ou
-            zCB13t13UkLjLo5GkTE7kRGtyKOdhQ/7NUA7tOZ+rwWOq3NehOTLfU0wMkgT7tOh
-            byWwNHrY9VHz3ndFnya5nNcnrqILA1rEn32PnioNyWcU6832jyUWvtRqwF+JRrKr
-            yRJMvz4T8vmLwrxqarB1uqU0OVHXy8bq8d9/pVrAmk6+C/H5FINFlApD0dKYftd2
-            phoTSA5WG8j1e0v5p4+r9cRHlYXFMinMMkpzD/JMyNB1WVZ9aGQxU7WiuYzuv1bh
-            PKN/LEgfh3ypI8W960NHv/OMRjVs/VxA+G3ml3Lw6acRnaLr++MhF2G7ZBTx8rgi
-            fjyF6m4XtacwIKYZ7SNt9eQewGI8VU30o8np33qb9KeOt7v8PrMH1G3X+bTLnJGw
-            VjxjvaBaePmPplYYS7xaPuUnzFNabDXTE8XCQpdJMy26ef77gaWr6TQwXbRlZXrx
-            S60EecMLwUj+daR0PkVBkCDxXkW8+0uPkt6EEn5rmPdMXoh4DUw+4A14t7yyUU50
-            j3M9tv6DuYs/KhgZYfLe+6hVD7fY4lAs5Ge6QGLA/TljAatE3zpSZQK+b7C4HKJS
-            3eRpcAt6CJFhXaCBwl4+gigrg3voX1ykh62oqY/4ecKbAiiVXLIrcflv9kx2Ht7S
-            XgEDhoIRIvXoOUy6j/qjp/OFxwu5y6MpBX4vHxlpL36daL2yShMkCYyY3ajea4eX
-            9k7B9fpRu3sjbDTNr1heffI+5n/HKc8j9a52hzu5eF0e+v+vKY32uk1jlUhZdj4=
-            =R/pX
-            -----END PGP MESSAGE-----
-          fp: F38C9D4228FC6F674E322D9C3326D914EB9B8F55
-        - created_at: "2024-06-20T20:01:32Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA1Hthzn+T1OoAQ/+OHZshi2zBfbVQ91WKLqei7bT4CZGiPxQsl7aogv8JkyL
-            D8p+VgIReMvq4F5QFaIsA8yqMSnjxfIi5bFd9SKjuhOKvuQjyh1rSsFb0t8ESuYi
-            fHBnVw4tDNfTEGQa9YhNJPTq60TwR4P2xYFEgc//AQqfs9XH0cTbvkFS9dkug092
-            u4yJfB2aZEJa0Eh0AenUYzP13bFH0sJwL1hQop1v9gF44JeKHpRNd0Yixlp0Yucs
-            Ccww+WaNFVQ4+zvyW7MnI8/D27/SQGRXXqQE6sOQlsg5SUzF2vIpYbIeuu1NR5WK
-            v1ZB0DlWVuOshIB7M9WUCZcAS5cMAWKc1vvZ/K0l+6tNskZvGE4p/lv1bmZ5zfc3
-            gT/2L6ENuoKW7RoF071SsG9Xn7VJync+iNTtg0m7Je7HRAZAGGc8vfIkrTXAmoIE
-            QkGuog0R+EZxq9L1WMbppV/bnbBxiutFxwWOGTxzsn+DksVrVLvyI/EbHJvcEwzN
-            hISPFmAiCEKzGAGfaO24F5Xcs+U6AgumS5V5kwY6zA/kZpJEdQm38rcC12ZpXR9C
-            oHGs9ACtgf+g8H3/Ks5DL48FTbYuZADamVA5+pV97B7xCS8TxYChuFNPLwU2s52G
-            liiZV9NevlFlbsXFZS/EWgR8b0aH9Nhjl5TAPOajBOu0Nm/83XEP9nbbbjJjGRHS
-            XgHop/OMkJRuZZ35JQjUS6dIBzSivqplpr51wHbyilxbvOHdvuu6w9kqGY9VhuVt
-            nCszg+IQ0SM8YFuu1M5UPO4txYQTHx8zO5SD/d8kh5HEu9fmTNyJXblRcyAzYZc=
-            =TxDz
-            -----END PGP MESSAGE-----
-          fp: 5DA93D5C9D7320E1BD3522C79C78172B3551C9FD
-        - created_at: "2024-06-20T20:01:32Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA46L6MuPqfJqAQ//co7jg6v5QUB7eHXJPMLxsgtbC/VYp7C7QqXQda5qhohW
-            t0F9lysBybhIGoYuvfZGzNMYqqkVpFxzlOO2vFlcYFsQhjCpJrHBWYT4XOmIBR64
-            6Az/iKqNLS+cG+rFIIuc8BqRk3r4lrM32dCqz0a+3qRkdmbff4yKuzg8FTPlv1RI
-            O9SzRqfptcKDXItnQF+8CAziqcGyy4jL2wnl1Q2I2Pksr+Zw1eZVbFfHmCpG7A5C
-            TVihozz51jeXlggDp9/NPJOQDsmV+KdpvNx2Eqj6PQ6aGWtyYv5YZG3X/eRKW90+
-            qUOJxwpW5KGcROnuvQt1AggcXquOTLHFyJ85M8tpJcl+JYVZsIeNDo+LO8sbrCTA
-            cjp/YSLOms+GullbGAwrJh4TYtwJE9sEKr9OAFUvd+AxVFWj08BqMe1eN5YBbwwB
-            vNurVdvjE8jaTCmZgPPOIP5KXSrsG8bA02YlZ4MnzodYidIhTudJ8VB4NYCtNgOL
-            G/x7h/KA5KYgDWEtr21z2oy0QkGijtrcNa02GpslirjufZ6TPGCbJjAeEsPbYBm7
-            mDXm5+PzZpb1pbcSVNlVG5Ry73JrZxBpYCPGnxLs5yAmWOlNa/xcgDHBU+iXyVg0
-            Wm8pHRAVNfbvL7NB8yeaxSDoTSE7/BsisL6tUHoV+bdlpVsTF26bQZBc/zhxiZrS
-            XgGJ8ChRZbpi2qUzP4nA2jPkYtQ4cquA+ftDx4i+ZqVNtAhVSnTiBZoYu/21+BUB
-            oxDa5m2vD0s0t0fGfmmIvpLZKZIF7NcwnCdNVQve/D3qNNa4T3YnXb8JTGH0PYc=
-            =mu1s
-            -----END PGP MESSAGE-----
-          fp: 8996B62CBD159DCADD3B6DC08BB33A8ABCF7BC4A
-        - created_at: "2024-06-20T20:01:32Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA4EEKdYEzV0pAQ/8D4mAcC6vsHLkSryz1yIYoBqqtJnG62pITFEbafhVLR6V
-            nWAw/zP9DqNj15MsrM67xaQxlMVgkVM7QTchgp0CjXsyZ/gWPgDl0NaC92Uj93Ov
-            Gi2OpkfHQFaAW6JsAFl5NrF0ZBw/flx8X0l2klIxBV+ztpkLADEtXWsoGsmz5L4m
-            n41icEp9+nb9nwy7p+Je0s4jZCBB0sVlbkX9i4IpMOgEhA0HcWemc940VJp3UyRg
-            LkOs5C0J4Y4qjS12248y16gV/IhNaJ4PCPgVwSj1Xzz6VXauQosmWhnUbnqJbi3F
-            KWEV0IJJO+dlj5VShzFDnkN2bM1GeyQx1S+FkNp+Mmm6JNrUK+CZL8fUYka06O0V
-            DD/sg1Pyq8VawNG5RxwAWA5F1F1SIrJzF0T4HyIN1UFRCjWC466sdrBTQLtx472k
-            NdBCvabHS/bx5miPKF5iglJYzz4biUdevc3EU7q4hwgMYM2oep3m2EsaTbKWzjnY
-            PLB4d0bCsRlya0YfHaFX5f3xSNb/FzBcUlTHzX2asyB2DolMug1VqS3jCEkWGbk/
-            vfNfR5yRuwkwNlJRqHbGIfH7fYEgwSTW+VW2iUdY7Dra7xjgTzqZgLi5W8QwKJqq
-            1V5H4KlRQNYwloVJzQZCwoPcY+tBfTZ4LsDKtjyJzFY9vdTGGGqb9lAG7YBUdubS
-            XgE72UuZvbPQZuI7uVKMEORGVssQjwZFhs4InR/Ixe03a7hb8fdRHfu/ueS/3KQx
-            mRXVino/iVQ6M936mtibfeH9TpBpjqH8sBKNHv2hgnoap9QpkrVn1yWqrOcpht8=
-            =+sXL
-            -----END PGP MESSAGE-----
-          fp: 9DFA033E3DAEBAD7FDD71B056C7AAA54BE05F7BA
-        - created_at: "2024-06-20T20:01:32Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hF4DQrf1tCqiJxoSAQdA/tIZCvQv0E4dHN5jBHsAGclKEeLFhyf4lIQx+xa+uwQw
-            /VGCdNT8U13EawRC66KLXRrRgsNPpwUg15wAoTzQ8gW/tLpgvL5nsEYPfaowYwBD
-            0l4BmNV4o4J+NHF7Tk1af2kx0pp6kF9eJynn6irr336tGzY004lZfZlqwgeOk+qN
-            93XcSfdAOlIktfex1q1oTPrSpGIv32zsLPoRNVa50dO+IKu1tmYAxi9N9sQgbWa4
-            =rnF9
-            -----END PGP MESSAGE-----
-          fp: B71138A6A8964A3C3B8899857B4F70C356765BAB
-        - created_at: "2024-06-20T20:01:32Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAzdAjw8ldn6CAQ/9HNG41mTgq8VavF9DBX7+upnsmoDtwblck18l3rurJ1mo
-            k2ki7tWwIxRyLLHtsUxJ9S55cmXuhhPJK8Kzc32SnY5irDkqK/4JZnDvofg+z68B
-            8pQOunN1BQp50k8vd4Mha43re8s24iqrM+fj59uHM2YYsQYt9TCR/NvUopOdi6l2
-            8OnKI2KdRvYhtzzCY3wmQKhG7p0hc8y8pP/0DmPW5IGQ6OP4zO+Qnc4EbVnA9Uhr
-            tZ4sTNn0o80kfvILKANkAm81v86KdSRXdd3+1IpH1c7rTqm9o+DEm8nKnwWOF63O
-            P0klsYLlfqiZyQ0AyS67RHPTw/y57mAyWVFbABDLtXQQHWcIkADMLKTJLpnhKkRn
-            Cp94EXBBBwViAUBUzzskE4lgKXncl1h5ogLum8btU+cLky0qa8Hzie5QqszlErf8
-            fci0AEHV8u+Kf5EARf1FiY6K2aVnFOJchdeL98qllwRu6f8zz7+bfLq1UXcGBlQS
-            JnbAlXiL4vEBxQyW5awYYzpaMUTW1ejjujZUitdaUeIQJdv/IJvHe9y6/F0uukdt
-            AMrDI7E+JKa6hLPe4g6H1hUzh6GcaHuNU9z2NSDfzxcOHkqALsCDLVDxsjPhahCc
-            UZkSn8ebyqv7/jpTgWnsls0Fx8XqvKKJNoqXfK81oIvWlJsEwqSaBczkq9HQbO7S
-            XgH2N8XPOJWmqDc+xS26eERNJ8ZlhYaODWwatgqt2si6EdBpVRZL4PXsOrOlI8Xi
-            Uaag1/Uljqbk5mN18+CtSfSt0ded79d44B9zAbc70hgvkRrpcotDBnO8YQ9MxB0=
-            =O0Sg
-            -----END PGP MESSAGE-----
-          fp: 3D70F61E07F64EC4E4EF417BEFCD9D20F58784EF
-    unencrypted_suffix: _unencrypted
-    version: 3.8.1

config/hosts/mjolnir/sops.nix

@@ -1,7 +0,0 @@
-{ ... }:
-
-{
-  sops = {
-    defaultSopsFile = ./secrets.yaml;
-  };
-}

config/hosts/mqtt/configuration.nix

@@ -1,10 +0,0 @@
-{ ... }:
-
-{
-  networking = {
-    hostName = "mqtt";
-    domain = "z9.ccchh.net";
-  };
-
-  system.stateVersion = "23.11";
-}

config/hosts/mqtt/default.nix

@@ -1,9 +0,0 @@
-{ pkgs, ... }:
-
-{
-  imports = [
-    ./configuration.nix
-    ./networking.nix
-    ./mosquitto.nix
-  ];
-}

config/hosts/mqtt/mosquitto.nix

@@ -1,33 +0,0 @@
-# Sources for this configuration:
-# - https://search.nixos.org/options?sort=relevance&type=packages&query=services.mosquitto
-# - https://mosquitto.org/man/mosquitto-conf-5.html
-# - https://winkekatze24.de
-{ ... }:
-
-{
-  services.mosquitto = {
-    enable = true;
-    persistence = true;
-
-    # set config for all listeners
-    listeners = [{
-      settings.allow_anonymous = true;
-      omitPasswordAuth = true;
-      acl = [ "topic readwrite #" ];
-    }];
-
-    bridges.winkekatz = {
-      addresses = [
-        { address = "mqtt.winkekatze24.de"; }
-      ];
-      topics = [
-        "winkekatze/allcats/eye/set in 2"
-        "winkekatze/allcats in 2"
-        "+/status out 2 winkekatze/ \"\""
-        "+/connected out 2 winkekatze/ \"\""
-      ];
-    };
-  };
-
-  networking.firewall.allowedTCPPorts = [ 1883 ];
-}

config/hosts/mqtt/networking.nix

@@ -1,21 +0,0 @@
-{ ... }:
-
-{
-  networking = {
-    interfaces.net0 = {
-      ipv4.addresses = [
-        {
-          address = "10.31.208.14";
-          prefixLength = 23;
-        }
-      ];
-    };
-    defaultGateway = "10.31.208.1";
-    nameservers = [ "10.31.210.1" ];
-  };
-
-  systemd.network.links."10-net0" = {
-    matchConfig.MACAddress = "BC:24:11:48:85:73";
-    linkConfig.Name = "net0";
-  };
-}

config/hosts/netbox/netbox.nix

@@ -11,19 +11,9 @@
     enable = true;
     package = pkgs.netbox;
     secretKeyFile = "/run/secrets/netbox_secret_key";
-    keycloakClientSecret = "/run/secrets/netbox_keycloak_secret";
     settings = {
       ALLOWED_HOSTS = [ "netbox.hamburg.ccc.de" ];
       SESSION_COOKIE_SECURE = true;
-      # CCCHH ID (Keycloak) integration.
-      # https://github.com/python-social-auth/social-core/blob/0925304a9e437f8b729862687d3a808c7fb88a95/social_core/backends/keycloak.py#L7
-      # https://python-social-auth.readthedocs.io/en/latest/backends/keycloak.html
-      REMOTE_AUTH_BACKEND = "social_core.backends.keycloak.KeycloakOAuth2";
-      SOCIAL_AUTH_KEYCLOAK_KEY = "netbox";
-      # SOCIAL_AUTH_KEYCLOAK_SECRET set via keycloakClientSecret option.
-      SOCIAL_AUTH_KEYCLOAK_PUBLIC_KEY = "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAi/Shi+b2OyYNGVFPsa6qf9SesEpRl5U5rpwgmt8H7NawMvwpPUYVW9o46QW0ulYcDmysT3BzpP3tagO/SFNoOjZdYe0D9nJ7vEp8KHbzR09KCfkyQIi0wLssKnDotVHL5JeUY+iKk+gjiwF9FSFSHPBqsST7hXVAut9LkOvs2aDod9AzbTH/uYbt4wfUm5l/1Ii8D+K7YcsFGUIqxv4XS/ylKqObqN4M2dac69iIwapoh6reaBQEm66vrOzJ+3yi4DZuPrkShJqi2hddtoyZihyCkF+eJJKEI5LrBf1KZB3Ec2YUrqk93ZGUGs/XY6R87QSfR3hJ82B1wnF+c2pw+QIDAQAB";
-      SOCIAL_AUTH_KEYCLOAK_AUTHORIZATION_URL = "https://id.hamburg.ccc.de/realms/ccchh/protocol/openid-connect/auth";
-      SOCIAL_AUTH_KEYCLOAK_ACCESS_TOKEN_URL = "https://id.hamburg.ccc.de/realms/ccchh/protocol/openid-connect/token";
     };
   };
 
@@ -31,12 +21,6 @@
     mode = "0440";
     owner = "netbox";
     group = "netbox";
-    restartUnits = [ "netbox.service" "netbox-rq.service" ];
+    restartUnits = [ "netbox.service" ];
-  };
-  sops.secrets."netbox_keycloak_secret" = {
-    mode = "0440";
-    owner = "netbox";
-    group = "netbox";
-    restartUnits = [ "netbox.service" "netbox-rq.service" ];
   };
 }

config/hosts/netbox/networking.nix

@@ -1,8 +1,13 @@
-{ ... }:
+# Networking configuration for the host.
+# Sources for this configuration:
+# - https://nixos.org/manual/nixos/stable/#sec-networking
+# - https://nixos.wiki/wiki/Systemd-networkd
+# - https://wiki.archlinux.org/title/Systemd-networkd
+
+{ config, pkgs, ... }:
 
 {
-  networking = {
+  networking.interfaces.net0 = {
-    interfaces.net0 = {
     ipv4.addresses = [
       {
         address = "172.31.17.149";
@@ -10,10 +15,9 @@
       }
     ];
   };
-    defaultGateway = "172.31.17.129";
+  networking.defaultGateway = "172.31.17.129";
-    nameservers = [ "212.12.50.158" "192.76.134.90" ];
+  networking.nameservers = [ "212.12.50.158" "192.76.134.90" ];
-    search = [ "hamburg.ccc.de" ];
+  networking.search = [ "hamburg.ccc.de" ];
-  };
 
   systemd.network.links."10-net0" = {
     matchConfig.MACAddress = "62:ED:44:20:7C:C1";

config/hosts/netbox/secrets.yaml

@@ -1,5 +1,4 @@
 netbox_secret_key: ENC[AES256_GCM,data:7cVGSlrCo3MEjeLjfeZrL0VZi3+yZqsC3qI+rx+xadic78H0egWCCNaYEHIgtilgFjw=,iv:gnearzPduWcrVLU/FuzS05eNPZ5srX0hqZyElq+19ek=,tag:9MKgFb4eVYE6a5ncx9sgpw==,type:str]
-netbox_keycloak_secret: ENC[AES256_GCM,data:WLPCwl6KmHhyGwpqchZUmTr0XwA1T9asAEXNOSQMfGU=,iv:fsO+Ho18Uz6+y2iohbve1bUKhCR/c2zNrbODR2Jrh3Q=,tag:MWeh7GhdyUJnSzrndA3l3Q==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -15,8 +14,8 @@ sops:
             V1lQK3YzTWI5ZGdyeGtFQ0E3QXQ3YnMK8sBStC8xBKwpeWkF/HrryWi0hZA69nuw
             a73HiZuED8KEp5OPME3yC6Ode71uEEaE/av2zp7WUYbCqVpWnwcjSg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-10-08T23:54:23Z"
+    lastmodified: "2024-05-26T01:07:35Z"
-    mac: ENC[AES256_GCM,data:6KwBwJ1uTuOaCTcBs9sgvX+E/bV37ylJmDqYupa3545ba5Y3VMuF2Hx72zzRYPmh5/DmwzDxc/f7TZUheO5jwwwMGGNCYuX2c+nkzLgtovT/yCXTo8vPHNf03fQRHlOq28ztQIG8Ug1s/t4XkA+iuqPdbvyNKLbsJfJBqg4SF44=,iv:SUXPFtW3/pSTBnjAh77G6pJTucHy4VEhUVkELiMJ4JU=,tag:SfLCwPpJuvL7RrIRmN5PGg==,type:str]
+    mac: ENC[AES256_GCM,data:0zWNPrUqpuC/qXOaTE8ayrTbnZdg9VA2NqxSNnV0bogqxVkg8zhbx8OKYfNQ0DswjxKNEnKsqjp62gA678VfRfGHJU5ZoHfAC7kBbrkDy+pMzS6LRwT+7n0C1AbaaG7hienGJQsx2gUUYqu7OSQuS722lXAw65deFvZGtL6lt8E=,iv:mOLkzF5pJFazmH9XX94Hjd04FcgSh0hY4juEO3vKNBc=,tag:lSk0lnVONQCmuO0KmxlL0Q==,type:str]
     pgp:
         - created_at: "2024-05-26T01:07:22Z"
           enc: |-

config/hosts/nix-box-june/networking.nix

@@ -1,8 +1,9 @@
-{ ... }:
+# Networking configuration for the host.
+
+{ config, pkgs, ... }:
 
 {
-  networking = {
+  networking.interfaces.net0 = {
-    interfaces.net0 = {
     ipv4.addresses = [
       {
         address = "172.31.17.158";
@@ -10,10 +11,9 @@
       }
     ];
   };
-    defaultGateway = "172.31.17.129";
+  networking.defaultGateway = "172.31.17.129";
-    nameservers = [ "212.12.50.158" "192.76.134.90" ];
+  networking.nameservers = [ "212.12.50.158" "192.76.134.90" ];
-    search = [ "hamburg.ccc.de" ];
+  networking.search = [ "hamburg.ccc.de" ];
-  };
 
   systemd.network.links."10-net0" = {
     matchConfig.MACAddress = "BC:24:11:6A:33:5F";

config/hosts/penpot/configuration.nix

@@ -1,7 +0,0 @@
-{ config, pkgs, ... }:
-
-{
-  networking.hostName = "penpot";
-
-  system.stateVersion = "24.05";
-}

config/hosts/penpot/default.nix

@@ -1,11 +0,0 @@
-{ config, pkgs, ... }:
-
-{
-  imports = [
-    ./configuration.nix
-    ./networking.nix
-    ./nginx.nix
-    ./penpot.nix
-    ./sops.nix
-  ];
-}

config/hosts/penpot/networking.nix

@@ -1,20 +0,0 @@
-{ ... }:
-
-{
-  networking.interfaces.net0 = {
-    ipv4.addresses = [
-      {
-        address = "172.31.17.162";
-        prefixLength = 25;
-      }
-    ];
-  };
-  networking.defaultGateway = "172.31.17.129";
-  networking.nameservers = [ "212.12.50.158" "192.76.134.90" ];
-  networking.search = [ "hamburg.ccc.de" ];
-
-  systemd.network.links."10-net0" = {
-    matchConfig.MACAddress = "BC:24:11:26:1C:8A";
-    linkConfig.Name = "net0";
-  };
-}

config/hosts/penpot/nginx.nix

@@ -1,63 +0,0 @@
-{ config, pkgs, ... }:
-
-let
-  domain = "design.hamburg.ccc.de";
-in
-{
-  services.nginx = {
-    enable = true;
-
-    virtualHosts = {
-      "acme-${domain}" = {
-        default = true;
-        enableACME = true;
-        serverName = "${domain}";
-
-        listen = [
-          {
-            addr = "0.0.0.0";
-            port = 31820;
-          }
-        ];
-      };
-
-      "${domain}" = {
-        default = true;
-        forceSSL = true;
-        useACMEHost = "${domain}";
-
-        listen = [
-          {
-            addr = "0.0.0.0";
-            port = 8443;
-            ssl = true;
-            proxyProtocol = true;
-          }
-        ];
-
-        locations."/" = {
-          proxyPass = "http://127.0.0.1:9001";
-        };
-
-        locations."/ws/notifications" = {
-          proxyPass = "http://127.0.0.1:9001";
-          proxyWebsockets = true;
-        };
-
-        extraConfig = ''
-          # Make use of the ngx_http_realip_module to set the $remote_addr and
-          # $remote_port to the client address and client port, when using proxy
-          # protocol.
-          # First set our proxy protocol proxy as trusted.
-          set_real_ip_from 172.31.17.140;
-          # Then tell the realip_module to get the addreses from the proxy protocol
-          # header.
-          real_ip_header proxy_protocol;
-        '';
-      };
-    };
-  };
-
-  networking.firewall.allowedTCPPorts = [ 8443 31820 ];
-  networking.firewall.allowedUDPPorts = [ 8443 ];
-}

config/hosts/penpot/penpot.nix

@@ -1,198 +0,0 @@
-# Sources used for this configuration:
-# - https://github.com/penpot/penpot/blob/2.1.0/docker/images/docker-compose.yaml
-# - https://raw.githubusercontent.com/penpot/penpot/2.1.0/docker/images/docker-compose.yaml
-# - https://help.penpot.app/technical-guide/configuration/
-# - https://medium.com/@social.iodols/managing-docker-containers-in-nixos-fbda0f666dd1
-# - https://madison-technologies.com/take-your-nixos-container-config-and-shove-it/
-
-{ config, pkgs, ... }:
-
-let
-  # Flags for both frontend and backend.
-  # https://help.penpot.app/technical-guide/configuration/#common
-  # https://github.com/penpot/penpot/commit/ea7ad2aaa096f8d190d740f693f22f3ed1f05088
-  commonPenpotFlags = "disable-registration enable-oidc-registration disable-login-with-password enable-login-with-oidc";
-  penpotVersion = "2.1.3";
-in
-{
-  virtualisation.docker.enable = true;
-  virtualisation.oci-containers = {
-    backend = "docker";
-    containers = {
-      "penpot-frontend" = {
-        autoStart = true;
-        image = "docker.io/penpotapp/frontend:${penpotVersion}";
-        extraOptions = [ "--network=penpot" ];
-        ports = [ "9001:80" ];
-        volumes = [ "penpot_assets:/opt/data/assets" ];
-        dependsOn = [
-          "penpot-backend"
-          "penpot-exporter"
-        ];
-        environment = {
-          # https://help.penpot.app/technical-guide/configuration/#frontend
-          # https://github.com/penpot/penpot/blob/develop/docker/images/docker-compose.yaml#L78
-
-          PENPOT_FLAGS = "${commonPenpotFlags} disable-onboarding";
-        };
-      };
-
-      "penpot-backend" = {
-        autoStart = true;
-        image = "docker.io/penpotapp/backend:${penpotVersion}";
-        extraOptions = [ "--network=penpot" ];
-        volumes = [ "penpot_assets:/opt/data/assets" ];
-        dependsOn = [
-          "penpot-postgres"
-          "penpot-redis"
-        ];
-        environment = {
-          # https://help.penpot.app/technical-guide/configuration/#backend
-          # https://github.com/penpot/penpot/blob/develop/docker/images/docker-compose.yaml#L112
-
-          PENPOT_FLAGS = "${commonPenpotFlags} enable-smtp";
-
-          # PENPOT_SECRET_KEY st via environmentFile.
-          PENPOT_TELEMETRY_ENABLED = "false";
-
-          # OpenID Connect configuration.
-          # https://help.penpot.app/technical-guide/configuration/#openid-connect
-          PENPOT_OIDC_CLIENT_ID = "penpot";
-          PENPOT_OIDC_BASE_URI = "https://id.hamburg.ccc.de/realms/ccchh/";
-          # PENPOT_OIDC_CLIENT_SECRET set via environmentFile.
-          PENPOT_OIDC_ROLES = "user";
-          PENPOT_OIDC_ROLES_ATTR = "roles";
-
-          # Database configuration.
-          # https://help.penpot.app/technical-guide/configuration/#database
-          PENPOT_DATABASE_USERNAME = "penpot";
-          # PENPOT_DATABASE_PASSWORD set via environmentFile.
-          PENPOT_DATABASE_URI = "postgresql://penpot-postgres/penpot";
-
-          # Email configuration.
-          # https://help.penpot.app/technical-guide/configuration/#email-(smtp)
-          PENPOT_SMTP_HOST = "cow.hamburg.ccc.de";
-          PENPOT_SMTP_PORT = "465";
-          PENPOT_SMTP_USERNAME = "no-reply@design.hamburg.ccc.de";
-          # PENPOT_SMTP_PASSWORD set via environmentFile.
-          PENPOT_SMTP_SSL = "true";
-          PENPOT_SMTP_DEFAULT_REPLY_TO = "Penpot <no-reply@design.hamburg.ccc.de>";
-          PENPOT_SMTP_DEFAULT_FROM = "Penpot <no-reply@design.hamburg.ccc.de>";
-
-          # Storage
-          # https://help.penpot.app/technical-guide/configuration/#storage
-          PENPOT_ASSETS_STORAGE_BACKEND = "assets-fs";
-          PENPOT_STORAGE_ASSETS_FS_DIRECTORY = "/opt/data/assets";
-
-          # Redis
-          # https://help.penpot.app/technical-guide/configuration/#redis
-          PENPOT_REDIS_URI = "redis://penpot-redis/0";
-
-          PENPOT_PUBLIC_URI = "https://design.hamburg.ccc.de";
-        };
-        environmentFiles = [ "/run/secrets/penpot_backend_environment_file" ];
-      };
-
-      "penpot-exporter" = {
-        autoStart = true;
-        image = "docker.io/penpotapp/exporter:${penpotVersion}";
-        extraOptions = [ "--network=penpot" ];
-        environment = {
-          # https://help.penpot.app/technical-guide/configuration/#exporter
-          # https://github.com/penpot/penpot/blob/develop/docker/images/docker-compose.yaml#L221
-          PENPOT_PUBLIC_URI = "http://penpot-frontend";
-          PENPOT_REDIS_URI = "redis://penpot-redis/0";
-        };
-      };
-
-      "penpot-postgres" = {
-        autoStart = true;
-        image = "docker.io/library/postgres:15";
-        extraOptions = [ "--stop-signal=SIGINT" "--network=penpot" ];
-        volumes = [ "penpot_postgres_v15:/var/lib/postgresql/data" ];
-        environment = {
-          # https://github.com/penpot/penpot/blob/develop/docker/images/docker-compose.yaml#L240
-
-          POSTGRES_INITDB_ARGS = "--data-checksums";
-          POSTGRES_DB = "penpot";
-          POSTGRES_USER = "penpot";
-          # POSTGRES_PASSWORD set via environmentFile.
-        };
-        environmentFiles = [ "/run/secrets/penpot_postgres_environment_file" ];
-      };
-
-      "penpot-redis" = {
-        autoStart = true;
-        image = "docker.io/library/redis:7";
-        extraOptions = [ "--network=penpot" ];
-      };
-    };
-  };
-
-  # Docker networks.
-  systemd.services."docker-network-penpot" = {
-    serviceConfig = {
-      Type = "oneshot";
-      RemainAfterExit = true;
-      ExecStop = "${pkgs.docker}/bin/docker network rm -f penpot";
-    };
-    script = "${pkgs.docker}/bin/docker network inspect penpot || ${pkgs.docker}/bin/docker network create penpot";
-    requiredBy = [
-      "docker-penpot-frontend.service"
-      "docker-penpot-backend.service"
-      "docker-penpot-exporter.service"
-      "docker-penpot-postgres.service"
-      "docker-penpot-redis.service"
-    ];
-    before = [
-      "docker-penpot-frontend.service"
-      "docker-penpot-backend.service"
-      "docker-penpot-exporter.service"
-      "docker-penpot-postgres.service"
-      "docker-penpot-redis.service"
-    ];
-  };
-
-  # Pull docker images prior to starting container services, so that a container
-  # service isn't considered up, if it actually is still just pulling the
-  # relevant image.
-  systemd.services."docker-images-penpot" = {
-    serviceConfig = {
-      Type = "oneshot";
-      RemainAfterExit = true;
-    };
-    script = ''
-      ${pkgs.docker}/bin/docker pull ${config.virtualisation.oci-containers.containers."penpot-frontend".image}
-      ${pkgs.docker}/bin/docker pull ${config.virtualisation.oci-containers.containers."penpot-backend".image}
-      ${pkgs.docker}/bin/docker pull ${config.virtualisation.oci-containers.containers."penpot-exporter".image}
-      ${pkgs.docker}/bin/docker pull ${config.virtualisation.oci-containers.containers."penpot-postgres".image}
-      ${pkgs.docker}/bin/docker pull ${config.virtualisation.oci-containers.containers."penpot-redis".image}
-    '';
-    requiredBy = [
-      "docker-penpot-frontend.service"
-      "docker-penpot-backend.service"
-      "docker-penpot-exporter.service"
-      "docker-penpot-postgres.service"
-      "docker-penpot-redis.service"
-    ];
-    before = [
-      "docker-penpot-frontend.service"
-      "docker-penpot-backend.service"
-      "docker-penpot-exporter.service"
-      "docker-penpot-postgres.service"
-      "docker-penpot-redis.service"
-    ];
-  };
-
-  sops.secrets."penpot_backend_environment_file" = {
-    mode = "0440";
-    owner = "root";
-    group = "root";
-  };
-
-  sops.secrets."penpot_postgres_environment_file" = {
-    mode = "0440";
-    owner = "root";
-    group = "root";
-  };
-}

config/hosts/penpot/secrets.yaml

@@ -1,234 +0,0 @@
-penpot_backend_environment_file: ENC[AES256_GCM,data:+MJbbAjzslBIYlQ9xe0VzM8ON2U5dktJGGHmoUu0HW0mvU4pRYrQXlWdW85RXAyYU9yOiL6TNAHOWUQyqOdo23whuer2jL/Qe17DEhapE4b9W9JqBX7H0VZZKHS70AgGZdWmbj/bWAROg/qGPVKjZLhgKxoVTVbvAIJEXUDAbGfvHlY3BP67yUTXvbmtd/Rdhn6i1HafY7YHFNAW8SkikglW6wR5igEZMFAefMOMgq7aYmNXOr1bImjCPEko0DvumJZM4YMjmb3Wc97wL7OMP9G/V0k9fRclhOj9+lNpeeCKL+VL3Bgo8vqgrB+WIi4a0EwerT8srx351txrU+ITxoHciRQtOpeXVHWL1snW9o7xCoOcil0NS93D9GhW+Hd75Is/xHN08UHmahF1r71nbDK4CmSiUzZzFLl1oWkSTU/31zBUnllHOt5nDMKT42xiniAJcQ==,iv:vtIlNGIh9+e9W+OebTac+UUQp9glBIolC6KQwQMzDn4=,tag:kBBTu7LVp+3xJ/MstLyomw==,type:str]
-penpot_postgres_environment_file: ENC[AES256_GCM,data:VT36kHkRH8ghnU1oyPpAQZW2LR8GNmG1cQXVjU4f+rGy9hViTivd7qxzMusisy7IcWfVaQuXFvUCT+pCMD/fhSAQZOY/1Rs8LBXJtsuPButOG9Q=,iv:pUjAkvvHjsnzn0xRRmdZXatOgLm9dx8Ggt7lEfiQllQ=,tag:FZRqlcxQWu/FgnJfoukIcA==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age10ku5rphtsf2lcxg78za7f2dad5cx5x9urgkce0d7tyqwq2enva9sqf7g8r
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiZVA5WE9JcDBOQVdPbGkz
-            SnNkWEJvaUtGaWVOajd6SzJ6aGNxSXZQaVhnCmgwT01kNFRZa09Gd1o2ZURyZUJQ
-            N0dwK21vUmk1N1duOVNtV2wrVmlyNDQKLS0tIEJtUENHdXhGcXhRRjM5VkhpdEVG
-            Z3UzOGFFUDhwUndoQWtCdHlMenZETW8KI0FjoFG4E1fhOxYiCIxY2BnLOmGcpoyK
-            EbDdNFQEMngwppEm9r1KzG/1cGMoIij2qpmK4Jz1Hzgk/6dZwvGxzw==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-08-10T15:40:27Z"
-    mac: ENC[AES256_GCM,data:hxVxH/BBwYcvbtOH4aOUnI9NnbCfAGnnwE3VQBJBJliOWo9WHm/hx4Eol4vaS+AA2t6AUU7UmzjofX2wSTbqQliDCFCSgbpMofDXP7tmlat+M9Du91fQmfOibzCd84tkqS+TRTFCFX83LmQ7/Bb2mHl77uGVAFYyHX9+IPPEUMw=,iv:w2Rdl2+o7bZRQsOogU6U5DK1UuHn+bL4Ouh3XbByYHA=,tag:6sqJal6+kzk0stP6vK6oOw==,type:str]
-    pgp:
-        - created_at: "2024-08-09T01:28:41Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAxK/JaB2/SdtAQ/+JKe4fsuAKMJr6kuDt5vjv+hrXamWEwRLBfYPHHZHEUeK
-            AQBs9fG9Ni7Qpelv8RIbxWyophgt2TCEqP2d+7EcGTgDZkdLxx5s2LJuCh+tEZwT
-            bm0sPt+8eYY077MxA1ZtlBgkslMugvdnJaDckGc8xRPldUa7gRp0j3yaLULRxjA6
-            T0nyALAqAaDa2uHgB7mTB3pXJYk4GxZpYbVc+wxAWXEDRLR/bpT18ywAcA6iSerd
-            KGDzWKjgOr1TTJqUxsguqDjnVp1c+xRPirC9uENGqW8mxI7h1+4B//dJvuXV/cYh
-            LKi0aDUTnma78mo2v9faUSJl23LkIehWZwbVG/+Mpkk3yxscLV124Vbwj56IFCzI
-            AiJ7m2QVxY5eXoVLodw6Po2S62gkwg7H5Aw3J4pppNuIAIr/8mJBpJoBy6poTsG3
-            QhbQdEdsF5ikoLu/OV/H7mp86zJt42Q+74xGjKYx/qvLq6SDmDA03kqk9N71URyu
-            FRTEDysEkeAzreFFkxn3Q+K/cXvtv/2Knte1lmDTfpmhg4cFwsLPLPH37A2veaxJ
-            JTyWDLHgrJ8NFgii3gLrwj+XLOZOwmCY0puJKtdAnPaaQiLfyqYfeLVlt7Se4MMJ
-            8XaFWcaQHBxL9nRZnx7WkE9LfHIG0e+414hT0F/aER+8iKboIbt6rdEHpEMGDWnU
-            aAEJAhD/TpW7E+yYjFVi/xSQ3kCAruHcm6x4BDTE7by0VeTLiRFW+culxiInOYiD
-            kdp+dATm5f7IrQp/qemL02/Me5yqURZlZrDHra7AiCI+MVBJiCRIY/x6xZSew7PX
-            HC+p9sB+PBFL
-            =1qbt
-            -----END PGP MESSAGE-----
-          fp: EF643F59E008414882232C78FFA8331EEB7D6B70
-        - created_at: "2024-08-09T01:28:41Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA6EyPtWBEI+2AQ/+Ijn18W+K2je/hpolpY6HmQMTTRpQJZ8YtJ5G35o5WoVP
-            hH+znQMrBBAtnTWeFBeIuIzk4CHjPS0yfnsE4/rP7/lSa177A2xaeiCb74F6k/Es
-            MtDE/TApSlNdPFruN5nkd2I8jAWh1k37nS+/NUhszReR39NNmgA+aCSc2OK04aAz
-            dpPXmaJ+d3zMr7eFoL2NyhNI3A/ZdVP3UmZCp12juckDRl8oeei4PBlw2T6ODJP4
-            tY08I9EyK/5K4auhYJyvayl1RWwRuShFV732ZjztkawLw152W0Rrg75Qoukhs9mr
-            TdyF0zcnVxAcOV4e5wRe13dDV6Ue7zeWFc9bb577thGzUm2Oue0u+oisty16qt9K
-            0vw0tVSDtT/suodG8HpvSwGQ+/xcV7w8XCH8Yx28N9iO49VZCB1ZYXQBxTHVDl2b
-            J/8AivaK4OOFvPWNr4u6oLaO9nz1aaX6Qsap5zn0Qa2Ls2SSBwWk2Fp/f1dq3KOy
-            /jGR89ocuEuImVacr2G6zxPnbukfa4S8q/FUUDbswQUqmWMcDDq3dOQ1fFPRd7vy
-            5a9u3P8LFW+ZPPHop3kgozgZ9pBGDOlw3nkjGjFl39lE33E+049gLE6I6+1+umG0
-            EWkNI9y8X+HmHMthVuYapq23Ix09H6Wa452hZmEUxNgp33M8Zx+l3s6D7o7jfrjS
-            XgElPJuUWyGKPoUY9mFaINyVqjOJGEtEOYRP7jvCpFWDq/xQ8jbJvvv7qBy8+i0b
-            cpqRrMJrvMB2PSLeD6cNWymrNhKilLLFOcG9yaIEudDhiuv3L4/ub08QMroDmo8=
-            =80AM
-            -----END PGP MESSAGE-----
-          fp: F155144FC925A1BEA1F8A2C59A2A4CD59BFDC5EC
-        - created_at: "2024-08-09T01:28:41Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAz5uSgHG2iMJAQ//Vv7IVqc9ReeFgo8RWbYpl1W5atAHerZuUh0oYc4otGpb
-            UseJ2JInyykcUeQWlOGvTK+eauBVNET0E/6jylCoWb8lzffhSMJ4FFpvpsoYjPG9
-            Q8s3r8soOCYB0xscfhinZwJg5to+I2MSd8mppWIp4UCQhxv7MqQpbqEzNTfVP7YO
-            QEUZ/lesVovLvxMzKc2YVWyZFSW2G6HK3LTaJIg8gy5ym/crlUB+awd2ZDePGk6F
-            Y7DcKwL1EpCL+hoPWGF9PclYKrOBIZVznYQuwHAqG+Bxr9Ln/NmS/OoCrJDMN6gG
-            2YMZ3Q7GQ82zZESxYA7g+ef9/lGCm7DIkt80or72x7eS6/OP7c1bjGFgKLQNyHFU
-            Th6cOy/TzK8Sq2g1mWB2zyV3xk6mb9C0ETAFD5vvPGVC3Sb4549Y+epe1T3ZLFTA
-            t09nUIpTC05PEdGsWs5Z5MDp8ZCsPZpipbVrWENesNOfaFYG+p7aM0LjgTqZcadD
-            B/Foejayc3XYI0T/NoP43mAZ2nEOw2Bz9lBpwz0PeTfzyrhz9XlJ7Dw462XTFA3i
-            voTHA5+DzGNPf6zC1fH9GcESmpC2nqXit8ZV+Y7Zb9/cAsx3E05S8ayxdBZUrOtJ
-            JSWGOAfPuzGXgL6Ht3iKcmCxQ/pSi1aH0h+bYqlrxTvP9IMyNCrxmP6+YsXCv8XS
-            XgE0NjzRMClq4/HhQ5X0ANGHWxbZJLAbm8yfgK5rnnmvi53RNJhRUHDnNca93brF
-            n27gnVLKM+2FdwRjwNIznkbZV/iNM6zIfRWwmJs9gHRuX/J/XWzD1KjDsn2rmiQ=
-            =bAYZ
-            -----END PGP MESSAGE-----
-          fp: 18DFCE01456DAB52EA38A6584EDC64F35FA1D6A5
-        - created_at: "2024-08-09T01:28:41Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAw5vwmoEJHQ1ARAAkdXjf9h4iyYtKPwR9V8hgIfpt3s3zMduuJN3u76ZHdfE
-            87t5K8eL2yIVN2DeOqtXRG28Broy3LLwMlLOJhxVxS5LAOEjT4ScZyb9H7MLnDsp
-            boW210SLkeQ5vTW9hgjAU9V6wbemxoiNPYTcBUsuirI8a+jpnALLY0jeOILBEmHQ
-            c+wbeo+VnlTQkTKCFI7TwlG1JnRnv3DMATVkOjC2PXmXPNkhr04Ivvf0+yBELY/1
-            hLirTfk/W6vFodPaoaRaeWjGJOo+FbqKLxr2xYzVu6SkF+i4CvDPb1x0t/laTpPA
-            qC6KJ1wyVwG4k7ZBLgRcf5Scn1zgGFzZexUAhdIYp0tKPycphUQxEMOI8/OeBP1V
-            68gBcilvv42zs+ed2RUK4j1e9YklxazZgaUhPfdrBrw/HiDJ8ILaq6LQQZSNrxZx
-            koAV/qw8ylU7vkciyA8bGLOiWc/Ub9vkRSuEi5TMOhmT7bVZ+W/26bWgDcAMmCpa
-            13H1uLXLuHnfDavdesh+RAxRgEavPTMz+HFbqhvkv8sy0RPCodyJv69J7dsS7a2C
-            71Ub7jyZIQyRtTGGZH5EjMQVStBMccE2KrJRzZCKbCmQDofKb4M67caaHBnVrs7D
-            vyx8V7JQGkNOWIgWFb23dtCtRiMzFaRk31mihFmFF2tSgg6XMqNmTp0pc3zQBarS
-            XgFZKRlYE7H1tMUCDwyKB7G3r1jsxBlUSbH1J6XjUBWKkTD4iMHI/4YStvghLjm2
-            0qqgKH/Njd9xBXc3x4Ut7kh8tFMMa07xF7/V0Pgwq+7J7EgckEfKHKA5vcQt17Q=
-            =23io
-            -----END PGP MESSAGE-----
-          fp: 87AB00D45D37C9E9167B5A5A333448678B60E505
-        - created_at: "2024-08-09T01:28:41Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA4HMJd/cQYrVAQ//RH/jOrYE9MD9IjkUfsQZ79rjEwDdtmsXs+gS/XUr0MpI
-            f/aDyw/vfvD7ZgY86yqp68x0OQLIyRIx9O05FNB3giVN4YFvZpFblLotpMzCFa2d
-            5xKLIQ1oviDSnE0kKpNM+QKITKjCxyke7MgW/laXvF0zMaVdPj0qo3Zn07MUKULs
-            btxZgPhzwWLjveZGn+72QiBGTF0ce49TWoh6y/l7PDsXhojau2KP556hI3rp/nC0
-            PunbLVRntpz+bOoyOk+xvKen+8b/Vwp+GYA2NBDbZSEY9H3YF5ugZBR/jUc8da7D
-            9EBA35udmQVKtD2XZrIyfhETC1eqLXORo0JKld5oC03JPkqvV+QpMF+8JBjXe1Cy
-            qI4pBmdhTJYFoJHpvMH7eC4CWgZZRMD5mB2nk1hYd9oIiYUPABfdeGxKiFnC8zHH
-            cEY3jgGzetZTxnpk2mxZvFMMwFqyOJA2PnwMTv3IraARkFrLxGzUIG4uOjo+l2fp
-            igOKsw9p46RR1gkuKF4u3yB3/1RloDyqGCU1/n4BCWy5/UkjSQpWKShZt3qMd2G2
-            A6si2zgSHIQ+ubR7MPB3Q3U/Rnw7pSbTbdDc73pZ2SPZfUuJplPSDUvXICGlj8cO
-            jO8s926qp4X9C4mi5um6EX5nLG+pfuKowIBdB2HWmxu2idwyrmNdlIgAcWcteazS
-            XgF9W6THXau4lEmrBqWEiC0K/9NA0cDJqRdvj6wqZ/OIAo86q3yRlm8yY8U7D00j
-            wNS8WSHq+EX0K9LpwQiHAJoxNXABEx/DbRqVeuLn2FaCocZigbvu3k/pePuOsK0=
-            =ZLl2
-            -----END PGP MESSAGE-----
-          fp: 91213ABAA73B0B73D3C02B5B4E5F372D17BBE67C
-        - created_at: "2024-08-09T01:28:41Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAxjNhCKPP69fAQ//dCKpiens8kqp+I9HtwP2CQOVMLLAle1VYB7pJ5pfcyzI
-            /3tAmwcxBmg+jhkFiqheBQYV2yNmBMHc5ulx+MxSDKd9mzCTavlGlE+intPjON8k
-            sis68RnU5OFsnGVXSmJji1vN37cCY4jHkf2vYzz6HJ6FLPrda/W3ZfXI+ZnOCao5
-            wGYrqPcYUj+7gnN1S42HM492oqeCNLcENDvegf8AxtBEgfp7UQ0V3ZC0wZEYhz0V
-            p9bdivFoEZ3Zo0sJTWKj3Df3IA5T6c4dbSPj8r7IZ5iNDguKAjvegXujco7pow51
-            fNNJB02hnYHLMRAbeRqaWyJ7qUQSWbQEgb8NuonspnXnajKc/OddgoTN91gTRgMb
-            op2T3HOFv3lKZPA/xIeDZpIm6GqOW6eJLjqiLP39VGvvNRYg+zxhNg/ZBVkFuSAf
-            U5uDPUyIAr10zdm7NqJKL8wKRbQzBg5OYovrXqSl96+KNenJqbMNv1N7kfSF6FuF
-            x8joEDXIaBSwINE4oXD5SN7Z5L2SuuMJ2nvuXFmmXKerRlrBiGsBzUVMt1bGqKEU
-            KoAAwbInZ9SprSxqJ1EkSVXpNGnFFNlbBB1j2u9BoGygOkVM4ZxIS19DBDLG0Tls
-            Fq6GI5d3axcf7t024UmwcU9yaP1BzrV0bDvDg3X+Azuo5JqpT3pSUvqv+Sy1C3nS
-            XgHK1C7XTOfcvmcxJ1f++xELwRkgNo1OqSG3cIZ8i1tKZFKTyYCiNHa/ajSr+wER
-            4phM7Tdr6ubjLkqvDkMeXvtiGyUoAvbtLC0wqSaE8sEZ28eFGEAaECV/uOW81X0=
-            =0jv9
-            -----END PGP MESSAGE-----
-          fp: F38C9D4228FC6F674E322D9C3326D914EB9B8F55
-        - created_at: "2024-08-09T01:28:41Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA1Hthzn+T1OoAQ/9GTEI65w8icqppqTuvQD50vaR+lCY1NjWT0HekgvNuCLV
-            4gL1cYv7tJ5UU6jOnREoScamWnUTYf/sLINIfa+FgvH+apswQeQCFrdCb8/61/Xc
-            3hsJ8gwmguP1zJabKFI6/Yo3vPPa+kpj0Am6M7dUUxEKw4Lqy6Hc32O6ULNJOvdo
-            56oqr6KoemrpU0TzqkKTpgAZaQjFfVzPWfC8moUL1pvxrHm7rqDPiYcl7fZP3JFD
-            gQMZokH205u1elxiFxuQGtW8jbeBqCZUm1UorEgD2EJYEPfyphIaHaQnCpW8zXkI
-            gt9QT3cqJpGJAobCPbh6vKPtbGPEqZOzOaCMFl07pkOSGPAVGMVfV+FdsfszPYY6
-            Rqsk7zlCFv/iNFWKpkdfI66JLvhmgNwXRv+rkYzH3QrQikjLmAeTzyL69SPujgDK
-            qXBRZiAPwEDScr2Qcum36jDVrT3jRfC1opzwpRxM2ompJ0F6caBPNVjY10BScl7Y
-            RWVmkFrPL9MdEelFLscG17K+y5S/50sLcU+sGbMkmPsmizA0boK5XBXJz3cTadYy
-            Asr2b4aWTqBS5iW1vbWIGJVrUUk3U1S4fFaSvsL3I6O0E+sOB3eEEpQZqpF9Genr
-            hCE8GVE5yQWb3YYK0ZA7j4u+dwA+QfRIuQuMWFoRKp8oqEitjjix3je2R3u8/ILS
-            XgFcAp8Jh+VbnQg/pq92u3dX6afGv6nENpMVPn73yob+sfE5xUFEfEzE1E1WCWdR
-            HiLZVOgpVOYmo2s8/UW60hLNBULpqyf6ZTQsr7IqaGw4g+Ew116cwDawywRSJMg=
-            =T0nI
-            -----END PGP MESSAGE-----
-          fp: 5DA93D5C9D7320E1BD3522C79C78172B3551C9FD
-        - created_at: "2024-08-09T01:28:41Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA46L6MuPqfJqARAApsnPRzTCIkbKT6jaVHixgP6wyCjfVmvgb0NnMrN2Ygup
-            pafb6GNWoFq9WdiSqwFIJPZlZxJFiIgSxplDI63Wj1MgfvQBEnKUQvnvR+UtnB22
-            bGr9mIrq/wKgslhPLFB0qT81RK/GqJKvRNpI3trGmB1pBnDdb5jiFeDHStv41XrP
-            hezAvmDGBKlM74fehu0pKOanIspyvFAjs31NULSHGJGzBxyM6OGcg/XLt9ea6bI5
-            jHwu3+M/7nixjtaIdCtEFPv/Mdimq9p64+c6AvbEVikUH/omRebRFIRrJCotYENT
-            ak6/2F+Fze2cof6pJPaq1KTF7LQHi1ZaQ/N+YNDsMJIYYuX3lVg/ClEjeo5k1HJ4
-            Jc+ul2KF/dAh8UsJPIdhJDlxIPdnof7xBLax1xmOQTHpqsfhZe5BP/0KMeeXzG6s
-            TlozMaCY0ok4JiQmiJcs+TjHX+uiiih6Wi756v7qwpCk5u3/BM+veHB/slD5Xezn
-            KmuHzwcbaP1n5JlOtv1PLAPfqX9EDsAVr2xhYTBISZiIKXyfagUWzPNX6toYtBfV
-            cQ/m9nfc5/STna7XGucnKkYFG5U2a+olIqCcbbNkN4NcW5ly0M5g1VW3oh02NO8r
-            A/4aU8ECj+79XXx0XCuVojnkGdTT3SQex7bkV2stBpuc5xfESbuOMWXgK0qZrYrS
-            XgEfX0ySVVrCxhtJgsQvZl0zrOwIttomV6hlQgo+n23HNPwjEf4nf1p2sje0uPvb
-            bPC7u5y1eDdy5E0XyWkAg4hxPLg7yOj7ET84Bg9S3NE8cE0nM50qL0N6aCAb4II=
-            =Is94
-            -----END PGP MESSAGE-----
-          fp: 8996B62CBD159DCADD3B6DC08BB33A8ABCF7BC4A
-        - created_at: "2024-08-09T01:28:41Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA4EEKdYEzV0pAQ/7Bx/s7WlB9TE30vyqVWw6H4DoZS8s03Z21tDAtrUEK+k5
-            QtMPvAIE0SG4lXersM3L6VMmhvPQlwZf+zSzBnO0J5vacvMG8dch4/ZH7YTM0VX6
-            T0Ix9ScamEI8J5Fr1LAeBoqtTa8n1/3N2ILBVPRTTX5Wu4lSUw/voeePXAYxSSMv
-            9vzrxJNcRgzbd/8Fbo3i2vzn4GvrP1JzsprLrUMVFaek5khD0hRDJMM0IhBWFRRh
-            L241zX/IBZDQVz0x1QVUBFmkoUjyNn94CTezTmGvqCXfkLRmcKzTZXd0dhORBPFa
-            LygVSLdor0v5ru70rMds6YN5WvqbmG7KUY8M3gcVXutvID58vw6ZE83T8ZAYj9S5
-            r9hXegeb2e03tCvSrHmQFf37+298/E8/kBrBQgoevnHmm3p0yN3ZbrWLIRhbx2iF
-            NzL5s17PnGzmuSigoZERsN2Flx2fzUbtwVDP3AyLVpQ7NoqTZkJTcGQuvkYawnEa
-            3RxUQySR+a7bED38wJ6zEpVg10ye7c8mVkzQnda1Qp3lnPZxz+1qg1n25I9hjNO6
-            X1E8gtXx2EcwaoWcPO0W/sNBwE09SCM68KWSykwOLvZb5tq/HnhrwSisps5sAg9V
-            Z1c0OCwgJvYoTY46rqk7scN9YkE16LDCtAzgppZerli179E/f/7O3d59CA1mCEXS
-            XgHbdM2nxaBPCPgXXNRVq13R8JXiOokuxUZofwl6FaG8A6yc9z5F4Ygr/KKDeT0i
-            YMBezxQtQ5uKY0jIx5g2r6aSdly3QPNKiFS/rxDCrmtaBqw+OvhvLrnCn6IaRVY=
-            =XAoN
-            -----END PGP MESSAGE-----
-          fp: 9DFA033E3DAEBAD7FDD71B056C7AAA54BE05F7BA
-        - created_at: "2024-08-09T01:28:41Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hF4DQrf1tCqiJxoSAQdAFvRDMKG3Vjs98kRqcs4ep+bYoUcBHbMA7WgzI7CcaGQw
-            FjdmSwvWaHJZQGEbGk4uDHKPHqXRD3HnD9d75Azu2HXnCA29aU2c0zn0PziIi7Aa
-            0l4BbcavPKNBkZpJNgW0uII7xMYJWJ/9vStTxXG/WzNia6nk/Cv7PMJW7EwIeUga
-            +PWB4yGfPXgqJGnJj0H1EdCVPrM/+f19GcFxNKKzkGaKTyVTW9NxntlsFl1vbmRx
-            =YRc6
-            -----END PGP MESSAGE-----
-          fp: B71138A6A8964A3C3B8899857B4F70C356765BAB
-        - created_at: "2024-08-09T01:28:41Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAzdAjw8ldn6CAQ/5ARLA8sAZHMwNhHJycVof+ZergR58hXCBjbIy5zgyAwYU
-            IJ5OwhTpWqniZjt0b9pvlzU4JO1k73B1WrF7mAYEOKET32GPVatrQ64yInQbORSZ
-            zNQgX3aQ8tEtyBsKAWqwqRjOaP6Plee6G0RCksJBAkjIZik0diTOBwi+ZhgYSRLE
-            G1NAETqMKkLleYQbUWCFNveJOd/7pfhE4xhAEaSxL3dgXNPV2TOngvjCqMXvz0K2
-            hEz6OYC8idpmAJv+S+HOaZbKV+giCopsPyFnbeu8jf1UpbsBRbHPnLOO6lLby2gf
-            2P9MhwSeMjjCZFX/ys8vHQ2jUwXK8jfW3xfVie4hVJgh6vO+uHcomjnk2b+34SRk
-            7ttoozLbMFxwrcP9trV0TgT2uzjFCe4fHccpY1VLTCX/O0eYtlhDhur0Wojp1z9v
-            h5mcqySEtJfHXJbTXkgMA2+QSyUaTTfvZ6oJqX3yAoq5eIzC0CcF+IMa6NS1XkY0
-            TNd3FEhwe7TvKGCy/3bJx6jMUnhT71r6KW/w7RVIHgdp1hfUS9JBhxVB+agQVyRv
-            +HBmvWHqUdwnFzotGRzLU1g6soWa+fRVQQ80qAi1U8e+u9IX3EG0KoIXLjpkvXxK
-            y520NcOdN4wR0xILPP/+47QDN+kM6lunm/EMgrff4YDE8J83qMhH2IP5s/tV023S
-            XgH1hiB0U4SYt0Rp6OGDV+CjBCFaCkPPlync/SVuXddfLC1owGlY9L3jwu7j2PR7
-            jy2jPPTWrOvT0wZKEh4k501LRb0n6LGqW6gDTgOnZKNg2iQ6jybv2HeyyExYllg=
-            =1o5H
-            -----END PGP MESSAGE-----
-          fp: 3D70F61E07F64EC4E4EF417BEFCD9D20F58784EF
-    unencrypted_suffix: _unencrypted
-    version: 3.8.1

config/hosts/penpot/sops.nix

@@ -1,7 +0,0 @@
-{ ... }:
-
-{
-  sops = {
-    defaultSopsFile = ./secrets.yaml;
-  };
-}

config/hosts/ptouch-print-server/networking.nix

@@ -11,7 +11,9 @@
       ];
     };
     defaultGateway = "10.31.208.1";
-    nameservers = [ "10.31.208.1" ];
+    nameservers = [
+      "10.31.208.1"
+    ];
   };
 
   systemd.network.links."10-net0" = {

config/hosts/ptouch-print-server/printing.nix

@@ -90,7 +90,9 @@ in
   # pam_deny.so # deny (order 12400)" for pam.d/sshd, so enable
   # PasswordAuthentication to have it not do that.
   services.openssh.settings.PasswordAuthentication = lib.mkForce true;
-  security.pam.services.sshd.allowNullPassword = true;
+  # The following doesn't need to be set in order for empty passwords to work
+  # apparently:
+  # security.pam.services.sshd.allowNullPassword = true;
   services.openssh.extraConfig = ''
     Match User print
       PubkeyAuthentication no

config/hosts/public-reverse-proxy/nginx.nix

@@ -9,7 +9,6 @@
   services.nginx.streamConfig = ''
     map $ssl_preread_server_name $address {
         status.ccchh.net 10.31.206.15:8443;
-        status.hamburg.ccc.de 10.31.206.15:8443;
     }
 
     # Listen on port 443 as a reverse proxy and use PROXY Protocol for the

config/hosts/public-web-static/networking.nix

@@ -1,8 +1,7 @@
 { ... }:
 
 {
-  networking = {
+  networking.interfaces.net0 = {
-    interfaces.net0 = {
     ipv4.addresses = [
       {
         address = "172.31.17.151";
@@ -10,10 +9,9 @@
       }
     ];
   };
-    defaultGateway = "172.31.17.129";
+  networking.defaultGateway = "172.31.17.129";
-    nameservers = [ "212.12.50.158" "192.76.134.90" ];
+  networking.nameservers = [ "212.12.50.158" "192.76.134.90" ];
-    search = [ "hamburg.ccc.de" ];
+  networking.search = [ "hamburg.ccc.de" ];
-  };
 
   systemd.network.links."10-net0" = {
     matchConfig.MACAddress = "86:72:08:F6:C0:D6";

config/hosts/public-web-static/spaceapid-config/ccchh-dynamic.json

@@ -2,6 +2,26 @@
   "dynamic": {
     "sensors": {
       "temperature": [
+        {
+          "sensor_data": {
+            "unit": "°C",
+            "location": "Hauptraum",
+            "description": "Sensor im Hauptraum"
+          },
+          "allowed_credentials": [
+            "club-assistant"
+          ]
+        },
+        {
+          "sensor_data": {
+            "unit": "°C",
+            "location": "Loetschlauch",
+            "description": "Sensor im Lötschlauch (Teil der Werkstatt)"
+          },
+          "allowed_credentials": [
+            "club-assistant"
+          ]
+        },
         {
           "sensor_data": {
             "unit": "°C",
@@ -14,6 +34,26 @@
         }
       ],
       "humidity": [
+        {
+          "sensor_data": {
+            "unit": "%",
+            "location": "Hauptraum",
+            "description": "Sensor im Hauptraum"
+          },
+          "allowed_credentials": [
+            "club-assistant"
+          ]
+        },
+        {
+          "sensor_data": {
+            "unit": "%",
+            "location": "Loetschlauch",
+            "description": "Sensor im Lötschlauch (Teil der Werkstatt)"
+          },
+          "allowed_credentials": [
+            "club-assistant"
+          ]
+        },
         {
           "sensor_data": {
             "unit": "%",
@@ -25,13 +65,12 @@
           ]
         }
       ],
-      "ext_3d_printer_busy_state": [
+      "CO2": [
         {
           "sensor_data": {
-            "unit": "bool",
+            "unit": "ppm",
-            "location": "Loetschlauch",
+            "location": "Hauptraum",
-            "name": "mk4",
+            "description": "Sensor im Hauptraum (Typ: SCD41)"
-            "description": "Prusa mk4 busy state"
           },
           "allowed_credentials": [
             "club-assistant"
@@ -39,34 +78,9 @@
         },
         {
           "sensor_data": {
-            "unit": "bool",
+            "unit": "ppm",
             "location": "Loetschlauch",
-            "name": "mk3.5",
+            "description": "Sensor im Lötschlauch (Teil der Werkstatt, Typ: SCD41)"
-            "description": "Prusa mk3.5 busy state"
-          },
-          "allowed_credentials": [
-            "club-assistant"
-          ]
-        }
-      ],
-      "ext_3d_printer_minutes_remaining": [
-        {
-          "sensor_data": {
-            "unit": "minutes_remaining",
-            "location": "Loetschlauch",
-            "name": "mk4",
-            "description": "Prusa mk4 minutes remaining"
-          },
-          "allowed_credentials": [
-            "club-assistant"
-          ]
-        },
-        {
-          "sensor_data": {
-            "unit": "minutes_remaining",
-            "location": "Loetschlauch",
-            "name": "mk3.5",
-            "description": "Prusa mk3.5 minutes remaining"
           },
           "allowed_credentials": [
             "club-assistant"

config/hosts/public-web-static/spaceapid.nix

@@ -1,20 +1,19 @@
 { pkgs, ... }:
 
 let
-  version = "v0.1.0";
+  spaceapidSrc = builtins.fetchGit {
-  spaceapidSrc = pkgs.fetchgit {
     url = "https://git.hamburg.ccc.de/CCCHH/spaceapid.git";
-    rev = version;
+    ref = "main";
-    hash = "sha256-2SDhliltzyydPPZdNn/htDydiK/SHQcYyG/dQ0EyFrY=";
+    rev = "17753f535c68157e80f30f50deb488133cc98258";
   };
   spaceapid = pkgs.buildGoModule rec {
     pname = "spaceapid";
-    inherit version;
+    version = "main";
 
     src = spaceapidSrc;
 
     ldflags = [
-      "-X main.version=${version}"
+      "-X main.version=${version}-${spaceapidSrc.rev}"
     ];
 
     # Since spaceapid doesn't have any dependencies, we can set this to null and

config/hosts/public-web-static/virtualHosts/c3cat.de.nix

@@ -1,19 +1,10 @@
 { pkgs, ... }:
 
-let
+{
-  domain = "c3cat.de";
-  dataDir = "/var/www/${domain}";
-  deployUser = "c3cat-website-deploy";
-in {
-  security.acme.certs."${domain}".extraDomainNames = [ "www.${domain}" ];
-
   services.nginx.virtualHosts = {
-    "acme-${domain}" = {
+    "acme-c3cat.de" = {
       enableACME = true;
-      serverName = "${domain}";
+      serverName = "c3cat.de";
-      serverAliases = [
-        "www.${domain}"
-      ];
 
       listen = [
         {
@@ -23,9 +14,9 @@ in {
       ];
     };
 
-    "$www.${domain}" = {
+    "c3cat.de" = {
       forceSSL = true;
-      useACMEHost = "${domain}";
+      useACMEHost = "c3cat.de";
 
       listen = [
         {
@@ -37,7 +28,7 @@ in {
       ];
 
       locations."/" = {
-        return = "302 https://c3cat.de$request_uri";
+        return = "302 https://wiki.hamburg.ccc.de/club:c3cat:start";
       };
 
       extraConfig = ''
@@ -51,45 +42,5 @@ in {
         real_ip_header proxy_protocol;
       '';
     };
-
+  };
-    "${domain}" = {
-      forceSSL = true;
-      useACMEHost = "${domain}";
-
-      listen = [
-        {
-          addr = "0.0.0.0";
-          port = 8443;
-          ssl = true;
-          proxyProtocol = true;
-        }
-      ];
-
-      root = "${dataDir}";
-
-      extraConfig = ''
-        # Make use of the ngx_http_realip_module to set the $remote_addr and
-        # $remote_port to the client address and client port, when using proxy
-        # protocol.
-        # First set our proxy protocol proxy as trusted.
-        set_real_ip_from 172.31.17.140;
-        # Then tell the realip_module to get the addreses from the proxy protocol
-        # header.
-        real_ip_header proxy_protocol;
-      '';
-    };
-  };
-
-  systemd.tmpfiles.rules = [
-    "d ${dataDir} 0755 ${deployUser} ${deployUser}"
-  ];
-
-  users.users."${deployUser}" = {
-    isNormalUser = true;
-    group = "${deployUser}";
-    openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcZJzQO4RYinJm6YDUgCELe8OJA/DYOss+8xp7TtxM0 deploy key for c3cat.de"
-    ];
-  };
-  users.groups."${deployUser}" = { };
 }

config/hosts/public-web-static/virtualHosts/default.nix

@@ -5,13 +5,8 @@
     ./branding-resources.hamburg.ccc.de.nix
     ./c3cat.de.nix
     ./element.hamburg.ccc.de.nix
-    ./hacker.tours.nix
-    ./hackertours.hamburg.ccc.de.nix
     ./hamburg.ccc.de.nix
     ./spaceapi.hamburg.ccc.de.nix
-    ./staging.c3cat.de.nix
-    ./staging.hacker.tours.nix
-    ./staging.hackertours.hamburg.ccc.de.nix
     ./staging.hamburg.ccc.de.nix
     ./www.hamburg.ccc.de.nix
     ./historic-easterhegg

config/hosts/public-web-static/virtualHosts/element.hamburg.ccc.de.nix

@@ -1,10 +1,10 @@
 { pkgs, ... }:
 
 let
-  elementWebVersion = "1.11.84";
+  elementWebVersion = "1.11.59";
   element-web = pkgs.fetchzip {
     url = "https://github.com/vector-im/element-web/releases/download/v${elementWebVersion}/element-v${elementWebVersion}.tar.gz";
-    sha256 = "sha256-z2qaKKyUq2S/r3xUUU3ym0FgFbiQr6bcltuKvUMPbH4=";
+    sha256 = "sha256-iVTd5zWUJh9wkbKMh+5hq0ucQaLLY29w1xCLxDIdQ18=";
   };
   elementSecurityHeaders = ''
     # Configuration best practices

config/hosts/public-web-static/virtualHosts/hacker.tours.nix

@@ -1,64 +0,0 @@
-{ pkgs, ... }:
-
-let
-  domain = "hacker.tours";
-  dataDir = "/var/www/${domain}";
-  deployUser = "hackertours-website-deploy";
-in
-{
-  services.nginx.virtualHosts = {
-    "acme-${domain}" = {
-      enableACME = true;
-      serverName = "${domain}";
-
-      listen = [
-        {
-          addr = "0.0.0.0";
-          port = 31820;
-        }
-      ];
-    };
-
-    "${domain}" = {
-      forceSSL = true;
-      useACMEHost = "${domain}";
-
-      listen = [
-        {
-          addr = "0.0.0.0";
-          port = 8443;
-          ssl = true;
-          proxyProtocol = true;
-        }
-      ];
-
-      root = "${dataDir}";
-
-      extraConfig = ''
-        # Make use of the ngx_http_realip_module to set the $remote_addr and
-        # $remote_port to the client address and client port, when using proxy
-        # protocol.
-        # First set our proxy protocol proxy as trusted.
-        set_real_ip_from 172.31.17.140;
-        # Then tell the realip_module to get the addreses from the proxy protocol
-        # header.
-        real_ip_header proxy_protocol;
-
-        error_page 404 /404.html;
-      '';
-    };
-  };
-
-  systemd.tmpfiles.rules = [
-    "d ${dataDir} 0755 ${deployUser} ${deployUser}"
-  ];
-
-  users.users."${deployUser}" = {
-    isNormalUser = true;
-    group = "${deployUser}";
-    openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOrDTANfPMkcf+V7zkypzaeX2fxkfStPHmZKqC29xyqy deploy key for hacker.tours"
-    ];
-  };
-  users.groups."${deployUser}" = { };
-}

config/hosts/public-web-static/virtualHosts/hackertours.hamburg.ccc.de.nix

@@ -1,69 +0,0 @@
-{ pkgs, ... }:
-
-let
-  domain = "hackertours.hamburg.ccc.de";
-  dataDir = "/var/www/${domain}";
-  deployUser = "ht-ccchh-website-deploy";
-in
-{
-  services.nginx.virtualHosts = {
-    "acme-${domain}" = {
-      enableACME = true;
-      serverName = "${domain}";
-
-      listen = [
-        {
-          addr = "0.0.0.0";
-          port = 31820;
-        }
-      ];
-    };
-
-    "${domain}" = {
-      forceSSL = true;
-      useACMEHost = "${domain}";
-
-      listen = [
-        {
-          addr = "0.0.0.0";
-          port = 8443;
-          ssl = true;
-          proxyProtocol = true;
-        }
-      ];
-
-      root = "${dataDir}";
-
-      extraConfig = ''
-        # Make use of the ngx_http_realip_module to set the $remote_addr and
-        # $remote_port to the client address and client port, when using proxy
-        # protocol.
-        # First set our proxy protocol proxy as trusted.
-        set_real_ip_from 172.31.17.140;
-        # Then tell the realip_module to get the addreses from the proxy protocol
-        # header.
-        real_ip_header proxy_protocol;
-
-        error_page 404 /404.html;
-
-        port_in_redirect off;
-
-        rewrite ^/(de|en)/tours$ /$1/37c3 redirect;
-        rewrite ^/(de|en)/tours/(.*)$ /$1/37c3/$2 redirect;
-      '';
-    };
-  };
-
-  systemd.tmpfiles.rules = [
-    "d ${dataDir} 0755 ${deployUser} ${deployUser}"
-  ];
-
-  users.users."${deployUser}" = {
-    isNormalUser = true;
-    group = "${deployUser}";
-    openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILxMnllgRD6W85IQ0WrVJSwr7dKM8PLNK4pmGaJRu0OR deploy key for hackertours.hamburg.ccc.de"
-    ];
-  };
-  users.groups."${deployUser}" = { };
-}

config/hosts/public-web-static/virtualHosts/hamburg.ccc.de.nix

@@ -94,8 +94,6 @@
         real_ip_header proxy_protocol;
 
         error_page 404 /404.html;
-
-        port_in_redirect off;
       '';
     };
   };

config/hosts/public-web-static/virtualHosts/historic-easterhegg/default.nix

@@ -7,6 +7,5 @@
     ./eh07.nix
     ./eh09.nix
     ./eh11.nix
-    ./eh20.nix
   ];
 }

config/hosts/public-web-static/virtualHosts/historic-easterhegg/eh20.nix

@@ -1,91 +0,0 @@
-{ pkgs, ... }:
-
-let
-  eh20 = pkgs.fetchgit {
-    url = "https://git.hamburg.ccc.de/CCCHH/easterhegg-eh20-website.git";
-    rev = "026932ef2f1fb85c99269e0fb547589a25d3687c";
-    hash = "sha256-YYxHhPYIioJgyHXNieoX6ibasHcNw/AFk+qCNSOxke4=";
-  };
-in
-{
-  security.acme.certs."eh20.easterhegg.eu".extraDomainNames = [
-    "www.eh20.easterhegg.eu"
-    "eh20.hamburg.ccc.de"
-  ];
-
-  services.nginx.virtualHosts = {
-    "acme-eh20.easterhegg.eu" = {
-      enableACME = true;
-      serverName = "eh20.easterhegg.eu";
-      serverAliases = [
-        "www.eh20.easterhegg.eu"
-        "eh20.hamburg.ccc.de"
-      ];
-      listen = [{
-        addr = "0.0.0.0";
-        port = 31820;
-      }];
-    };
-
-    "www.eh20.easterhegg.eu" = {
-      forceSSL = true;
-      useACMEHost = "eh20.easterhegg.eu";
-      serverAliases = [
-        "eh20.hamburg.ccc.de"
-      ];
-
-      listen = [{
-        addr = "0.0.0.0";
-        port = 8443;
-        ssl = true;
-        proxyProtocol = true;
-      }];
-
-      locations."/".return = "302 https://eh20.easterhegg.eu";
-
-      extraConfig = ''
-        # Make use of the ngx_http_realip_module to set the $remote_addr and
-        # $remote_port to the client address and client port, when using proxy
-        # protocol.
-        # First set our proxy protocol proxy as trusted.
-        set_real_ip_from 172.31.17.140;
-        # Then tell the realip_module to get the addreses from the proxy protocol
-        # header.
-        real_ip_header proxy_protocol;
-      '';
-    };
-
-    "eh20.easterhegg.eu" = {
-      forceSSL = true;
-      useACMEHost = "eh20.easterhegg.eu";
-
-      listen = [{
-        addr = "0.0.0.0";
-        port = 8443;
-        ssl = true;
-        proxyProtocol = true;
-      }];
-
-      locations."/" = {
-        index = "start.html";
-        root = "${eh20}/wiki_siteexport";
-      };
-
-      # redirect doku.php?id=$pagename to /$pagename.html
-      locations."/doku.php" = {
-        return = "301 $scheme://$host/$arg_id.html";
-      };
-
-      extraConfig = ''
-        # Make use of the ngx_http_realip_module to set the $remote_addr and
-        # $remote_port to the client address and client port, when using proxy
-        # protocol.
-        # First set our proxy protocol proxy as trusted.
-        set_real_ip_from 172.31.17.140;
-        # Then tell the realip_module to get the addreses from the proxy protocol
-        # header.
-        real_ip_header proxy_protocol;
-      '';
-    };
-  };
-}

config/hosts/public-web-static/virtualHosts/staging.c3cat.de.nix

@@ -1,60 +0,0 @@
-{ pkgs, ... }:
-
-let
-  domain = "staging.c3cat.de";
-  dataDir = "/var/www/${domain}";
-  deployUser = "c3cat-website-deploy";
-in {
-  services.nginx.virtualHosts = {
-    "acme-${domain}" = {
-      enableACME = true;
-      serverName = "${domain}";
-
-      listen = [
-        {
-          addr = "0.0.0.0";
-          port = 31820;
-        }
-      ];
-    };
-
-    "${domain}" = {
-      forceSSL = true;
-      useACMEHost = "${domain}";
-
-      listen = [
-        {
-          addr = "0.0.0.0";
-          port = 8443;
-          ssl = true;
-          proxyProtocol = true;
-        }
-      ];
-
-      root = "${dataDir}";
-
-      # Disallow *, since this is staging and doesn't need to be in any search
-      # results.
-      locations."/robots.txt" = {
-        return = "200 \"User-agent: *\\nDisallow: *\\n\"";
-      };
-
-      extraConfig = ''
-        # Make use of the ngx_http_realip_module to set the $remote_addr and
-        # $remote_port to the client address and client port, when using proxy
-        # protocol.
-        # First set our proxy protocol proxy as trusted.
-        set_real_ip_from 172.31.17.140;
-        # Then tell the realip_module to get the addreses from the proxy protocol
-        # header.
-        real_ip_header proxy_protocol;
-      '';
-    };
-  };
-
-  systemd.tmpfiles.rules = [
-    "d ${dataDir} 0755 ${deployUser} ${deployUser}"
-  ];
-
-  # c3cat deploy user already defined in c3cat.de.nix.
-}

config/hosts/public-web-static/virtualHosts/staging.hacker.tours.nix

@@ -1,61 +0,0 @@
-{ pkgs, ... }:
-
-let
-  domain = "staging.hacker.tours";
-  dataDir = "/var/www/${domain}";
-  deployUser = "hackertours-website-deploy";
-in
-{
-  services.nginx.virtualHosts = {
-    "acme-${domain}" = {
-      enableACME = true;
-      serverName = "${domain}";
-
-      listen = [
-        {
-          addr = "0.0.0.0";
-          port = 31820;
-        }
-      ];
-    };
-
-    "${domain}" = {
-      forceSSL = true;
-      useACMEHost = "${domain}";
-
-      listen = [
-        {
-          addr = "0.0.0.0";
-          port = 8443;
-          ssl = true;
-          proxyProtocol = true;
-        }
-      ];
-
-      root = "${dataDir}";
-
-      # Disallow *, since this is staging and doesn't need to be in any search
-      # results.
-      locations."/robots.txt" = {
-        return = "200 \"User-agent: *\\nDisallow: *\\n\"";
-      };
-
-      extraConfig = ''
-        # Make use of the ngx_http_realip_module to set the $remote_addr and
-        # $remote_port to the client address and client port, when using proxy
-        # protocol.
-        # First set our proxy protocol proxy as trusted.
-        set_real_ip_from 172.31.17.140;
-        # Then tell the realip_module to get the addreses from the proxy protocol
-        # header.
-        real_ip_header proxy_protocol;
-      '';
-    };
-  };
-
-  systemd.tmpfiles.rules = [
-    "d ${dataDir} 0755 ${deployUser} ${deployUser}"
-  ];
-
-  # Hackertours deploy user already defined in hacker.tours.nix.
-}

config/hosts/public-web-static/virtualHosts/staging.hackertours.hamburg.ccc.de.nix

@@ -1,63 +0,0 @@
-{ pkgs, ... }:
-
-let
-  domain = "staging.hackertours.hamburg.ccc.de";
-  dataDir = "/var/www/${domain}";
-  deployUser = "ht-ccchh-website-deploy";
-in
-{
-  services.nginx.virtualHosts = {
-    "acme-${domain}" = {
-      enableACME = true;
-      serverName = "${domain}";
-
-      listen = [
-        {
-          addr = "0.0.0.0";
-          port = 31820;
-        }
-      ];
-    };
-
-    "${domain}" = {
-      forceSSL = true;
-      useACMEHost = "${domain}";
-
-      listen = [
-        {
-          addr = "0.0.0.0";
-          port = 8443;
-          ssl = true;
-          proxyProtocol = true;
-        }
-      ];
-
-      root = "${dataDir}";
-
-      # Disallow *, since this is staging and doesn't need to be in any search
-      # results.
-      locations."/robots.txt" = {
-        return = "200 \"User-agent: *\\nDisallow: *\\n\"";
-      };
-
-      extraConfig = ''
-        # Make use of the ngx_http_realip_module to set the $remote_addr and
-        # $remote_port to the client address and client port, when using proxy
-        # protocol.
-        # First set our proxy protocol proxy as trusted.
-        set_real_ip_from 172.31.17.140;
-        # Then tell the realip_module to get the addreses from the proxy protocol
-        # header.
-        real_ip_header proxy_protocol;
-
-        error_page 404 /404.html;
-      '';
-    };
-  };
-
-  systemd.tmpfiles.rules = [
-    "d ${dataDir} 0755 ${deployUser} ${deployUser}"
-  ];
-
-  # Hackertours CCCHH deploy user already defined in hackertours.hamburg.ccc.de.nix.
-}

config/hosts/public-web-static/virtualHosts/staging.hamburg.ccc.de.nix

@@ -44,8 +44,6 @@
         # Then tell the realip_module to get the addreses from the proxy protocol
         # header.
         real_ip_header proxy_protocol;
-
-        port_in_redirect off;
       '';
     };
   };

config/hosts/status/configuration.nix

@@ -1,10 +0,0 @@
-{ ... }:
-
-{
-  networking = {
-    hostName = "status";
-    domain = "z9.ccchh.net";
-  };
-
-  system.stateVersion = "24.05";
-}

config/hosts/status/default.nix

@@ -1,10 +0,0 @@
-{ ... }:
-
-{
-  imports = [
-    ./configuration.nix
-    ./networking.nix
-    ./nginx.nix
-    ./uptime-kuma.nix
-  ];
-}

config/hosts/status/networking.nix

@@ -1,29 +0,0 @@
-{ ... }:
-
-{
-  networking = {
-    interfaces.net0 = {
-      ipv4.addresses = [
-        {
-          address = "10.31.206.15";
-          prefixLength = 23;
-        }
-      ];
-      ipv6.addresses = [
-        {
-          address = "2a07:c480:0:1ce::f";
-          prefixLength = 64;
-        }
-      ];
-    };
-    defaultGateway = "10.31.206.1";
-    defaultGateway6 = "2a07:c480:0:1ce::1";
-    nameservers = [ "10.31.206.1" "2a07:c480:0:1ce::1" ];
-    search = [ "z9.ccchh.net" ];
-  };
-
-  systemd.network.links."10-net0" = {
-    matchConfig.MACAddress = "BC:24:11:79:D3:E1";
-    linkConfig.Name = "net0";
-  };
-}

config/hosts/status/nginx.nix

@@ -1,149 +0,0 @@
-# Sources for this configuration:
-# - https://github.com/louislam/uptime-kuma/wiki/Reverse-Proxy
-
-{ config, ... }:
-
-{
-  services.nginx = {
-    enable = true;
-
-    virtualHosts = {
-      "status.hamburg.ccc.de" = {
-        forceSSL = true;
-        enableACME = true;
-        serverName = "status.hamburg.ccc.de";
-
-        listen = [
-          {
-            addr = "[::]";
-            port = 80;
-          }
-          {
-            addr = "[::]";
-            port = 443;
-            ssl = true;
-          }
-        ];
-
-        locations."/" = {
-          proxyPass = "http://localhost:3001";
-          proxyWebsockets = true;
-        };
-      };
-      "status-proxyprotocol.hamburg.ccc.de" = {
-        forceSSL = true;
-        useACMEHost = "status.hamburg.ccc.de";
-        serverName = "status.hamburg.ccc.de";
-
-        listen = [
-          {
-            addr = "0.0.0.0";
-            port = 8443;
-            ssl = true;
-            proxyProtocol = true;
-          }
-        ];
-
-        locations."/" = {
-          proxyPass = "http://localhost:3001";
-          proxyWebsockets = true;
-        };
-
-        extraConfig = ''
-          # Make use of the ngx_http_realip_module to set the $remote_addr and
-          # $remote_port to the client address and client port, when using proxy
-          # protocol.
-          # First set our proxy protocol proxy as trusted.
-          set_real_ip_from 10.31.206.11;
-          # Then tell the realip_module to get the addreses from the proxy protocol
-          # header.
-          real_ip_header proxy_protocol;
-        '';
-      };
-      "status.ccchh.net" = {
-        forceSSL = true;
-        useACMEHost = "status.hamburg.ccc.de";
-        serverName = "status.ccchh.net";
-
-        listen = [
-          {
-            addr = "[::]";
-            port = 80;
-          }
-          {
-            addr = "[::]";
-            port = 443;
-            ssl = true;
-          }
-        ];
-
-        globalRedirect = "status.hamburg.ccc.de";
-        redirectCode = 307;
-      };
-      "status-proxyprotocol.ccchh.net" = {
-        forceSSL = true;
-        useACMEHost = "status.hamburg.ccc.de";
-        serverName = "status.ccchh.net";
-
-        listen = [
-          {
-            addr = "0.0.0.0";
-            port = 8443;
-            ssl = true;
-            proxyProtocol = true;
-          }
-        ];
-
-        globalRedirect = "status.hamburg.ccc.de";
-        redirectCode = 307;
-
-        extraConfig = ''
-          # Make use of the ngx_http_realip_module to set the $remote_addr and
-          # $remote_port to the client address and client port, when using proxy
-          # protocol.
-          # First set our proxy protocol proxy as trusted.
-          set_real_ip_from 10.31.206.11;
-          # Then tell the realip_module to get the addreses from the proxy protocol
-          # header.
-          real_ip_header proxy_protocol;
-        '';
-      };
-      "status.z9.ccchh.net" = {
-        forceSSL = true;
-        useACMEHost = "status.hamburg.ccc.de";
-        serverName = "status.z9.ccchh.net";
-
-        listen = [
-          {
-            addr = "0.0.0.0";
-            port = 80;
-          }
-          {
-            addr = "[::]";
-            port = 80;
-          }
-          {
-            addr = "0.0.0.0";
-            port = 443;
-            ssl = true;
-          }
-          {
-            addr = "[::]";
-            port = 443;
-            ssl = true;
-          }
-        ];
-
-        globalRedirect = "status.hamburg.ccc.de";
-        redirectCode = 307;
-      };
-    };
-  };
-
-  security.acme.certs."status.hamburg.ccc.de".extraDomainNames = [
-    "status.ccchh.net"
-    "status.z9.ccchh.net"
-  ];
-
-  networking.firewall.allowedTCPPorts = [ 80 443 8443 ];
-}

config/hosts/status/uptime-kuma.nix

@@ -1,7 +0,0 @@
-{ ... }:
-
-{
-  services.uptime-kuma = {
-    enable = true;
-  };
-}

config/hosts/woodpecker/configuration.nix

@@ -1,7 +0,0 @@
-{ config, pkgs, ... }:
-
-{
-  networking.hostName = "woodpecker";
-
-  system.stateVersion = "24.05";
-}

config/hosts/woodpecker/default.nix

@@ -1,11 +0,0 @@
-{ config, pkgs, ... }:
-
-{
-  imports = [
-    ./woodpecker-agent
-    ./woodpecker-server
-    ./configuration.nix
-    ./networking.nix
-    ./sops.nix
-  ];
-}

config/hosts/woodpecker/networking.nix

@@ -1,22 +0,0 @@
-{ ... }:
-
-{
-  networking = {
-    interfaces.net0 = {
-      ipv4.addresses = [
-        {
-          address = "172.31.17.160";
-          prefixLength = 25;
-        }
-      ];
-    };
-    defaultGateway = "172.31.17.129";
-    nameservers = [ "212.12.50.158" "192.76.134.90" ];
-    search = [ "hamburg.ccc.de" ];
-  };
-
-  systemd.network.links."10-net0" = {
-    matchConfig.MACAddress = "BC:24:11:5F:A9:B7";
-    linkConfig.Name = "net0";
-  };
-}

config/hosts/woodpecker/secrets.yaml

@@ -1,234 +0,0 @@
-woodpecker_server_environment_file: ENC[AES256_GCM,data:68Wu0UOHBAGZHSJ0x4wbeDLm626jpumv9w6A65FNKsmzYp6P4/c4g1MF1agQd7l9nKMTRrgyJyfoEZYFQRX6lYSmcsQLfn++uh1JpFoClT5p/5hBkiDq4owUFU+NGUiyl6yjYlEiaxLwC4ZdyISHeEYpbrvGyIXLsFgdrQ0rVX3cCRwIMxFcyCG6d3MZVoqAw1A=,iv:y/+X02aRPBOoR57P9s7y/SijvXVLuiBBfFYqeJLvQEU=,tag:DNwK+M6s3moglkMkrWccyA==,type:str]
-woodpecker_agent_environment_file: ENC[AES256_GCM,data:rwp6TYYFJ/IZH+3pGhPxjdZMLoyPMr/W1RXm4IkUGn+SmIjHZcdFZ8nEhvOfnkfrXNPc2MR+X6NXUmVOcBjSCbcBjh9sC653UpKimt9I3/Ec,iv:X9JH7dmTayw8BaEsXYil3PrykCdd+/ANGHVfEyRvc7A=,tag:/ErkX1WnruanNgTTBUT6LA==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age1klxtcr23hers0lh4f5zdd53tyrtg0jud35rhydstyjq9fjymf9hsn2a8ch
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRQlN5NmlaUjR5dGJ3Y3BP
-            bW4rWm1KaVFsbytwZDQ1QjV1d1VEOEZlSTJ3Cmgxc1BmMnBmWjRyNmNDWmpWcnJt
-            Q3lBZUFOY3FtREFUYmhJNCtKcTUxY0kKLS0tIHhKbVVBYjN4WHRzdERNbkRQeHlS
-            UExiNFNCdkQ4YTNMdEdoWTdxOFZOZVEKZZbNpbyH31z5tyXeINqoNyqy8zvS3mp0
-            YFq6P8kO8CaqUG7KH6yWV0Vq4DryQ9vMcQBnboZOfPf9pZUvhacE/Q==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-06-22T15:55:25Z"
-    mac: ENC[AES256_GCM,data:UmDbmxSRj8YfCkKEelQNMJ8mzbu5aQdB9yOr9JfUh5TB9r5Z5ttZ1wgJDJqHNtsII3JGXUvbgHbsmbPikkrj4Ege1rrgr4UttN1rtgeaAKlZIlqb9pOnV4//GJL8jbxCgFp2h2O80G05nAXG54DaY//4Y5hfTyPzgyDlGQ6jlhg=,iv:5e8lpFfGAJh8lTFcY4MlZG7PgnzM0UycsU0tB2KN+zQ=,tag:4xUEHg04wjDbhc9MOItzuQ==,type:str]
-    pgp:
-        - created_at: "2024-06-21T22:42:59Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAxK/JaB2/SdtAQ//QR84p3zGjW2CtPcPxlmdYui5nx8FV3MHog4R24s4RKNK
-            y4n9993z8m3y2at4yIWDi4LBKrhm/6mSLBHfoxnuiptoaSXSWXfaXebXkYiinkyP
-            GMvwegN6KkRZh4stJMD7W0g7w/trkNEAvPDoInqCnvT4NomrKIV+ZrZuCBLd1tXn
-            JRd2tsH8yYzoZr/PJBBDTZtke/nbosb6drjgG6ow/eHyF++HxKNTWfjCiWn4AWSb
-            c/E1VWsigYdBs8XSTbBkfSLr/b5FcXYb8tyy4gpGe9zOrxc7cW5diK5+x4bM8FHz
-            85ShPA5S3PXXEnuifuk/ZK8+CEYWUS3MXUhuEFUo7F3Pt/Eb+5CtfTX6kvMe1xe9
-            iqFAsRce/qm9Evns4ygZ4+LoI2ro2HFwgQ2fu1gi7PyZsDyW5eRL5P+vfxPUOxYY
-            z9cXXo+U1NEzWMDEBWt4mgoW9URye6O3k+WLQmYbQIhDkftUYmvRrPYQvP282m4k
-            NMucRIRUMkx7rpRQQP8yU6AlgZ1LsOmruV4XJYVxsTpSZq7YgTQP4kd3wMgBhwOV
-            j3hGc9gI9Sq06SdyU0C8PuUHt+mZGkVnYIOTw6BXHgY1tK8X5XnWK4NJXL9bR0pY
-            kfzDWLjD0hiiM3QYqieTbnDUiVTDGyf7Cop+EifYvy7um+CPjlYLLkDkEsWcy/HU
-            aAEJAhDEzP5eiU1e01GSNbWL49ghD7DqZiYdo0F/BGMk6jQloM1HUDnkhgBhVSZo
-            TjNPV3UFBxeRnT5DvouD6uJ8SDs42ARdb4F80vJVHknt0yBvGWfCQsXqKwuRDd1j
-            zkj4zG7btJRv
-            =sgSP
-            -----END PGP MESSAGE-----
-          fp: EF643F59E008414882232C78FFA8331EEB7D6B70
-        - created_at: "2024-06-21T22:42:59Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA6EyPtWBEI+2AQ//V6IIW3Hr3xuQWOWitDGn1bo+x95jePPpXNayKGJuaSMf
-            00gaOyMpqP5hRd3lEQRyqHgPtmszlGrxq2y77CxnnZMbE6n+axwQQLoMzROBGyGF
-            iqe6hNbNFZPjWv5BTAl3iOHWrw3x/TpgcNmSBDfctU+CZlMWzCMuXJw1bK57wQd4
-            B6xcoBxidK55Ubc7GQ8mlAEuZ89fYorTRBfv2rBgUh8ZAAsUmn1jEz7HsQMMd2a8
-            5V4TzicdzXO2cZ+0DqU8Xqt5U9C0IjGgZRPzDYkh7slkbyYomAIfCq+zN5ieecz9
-            Mp8vvuMYfT66P+heNRZ7w/sgmGlarcmNKlOcXlakVYm5qVddPMx6M5Ovl4O5sABz
-            V4O4NRehYx0XFbjzXr59LCzpusS9xQoh49288dLTFudOInHUYq6ss0TbGfFJMDYU
-            mjHokzdG3ds8C9/lMR82X9rbyZDchUytHUwX4eGxUDMmhydFpgJko0bbozPbE2ll
-            NTlWegCc1yrkSGn6U9EYKtibitJnIMdas5HapcErMH2vYILsJOl9ifG1GIsuWe1+
-            ipPyZy7jqP7p18WCcDnUhgaGdQ67UjSLqX2zz0SZDcfI46SUeyeSelFVpTlmKriS
-            4bW6hC1FSe+bLkPZ0y5aRLgL5ipK6jdlZepAj/DNXdKAtchLHcddF3rKdBdzsxrS
-            XgFvvZPgj1JleYr+q/+ju4k1d4cE0HnQZIBnkAfKXZHwSPCw1d9vbeLipuRTJrEH
-            2CpOjtiXl3S2ZcCS1ama9lgAqPBOOoH7jgHvoCzqfkBsi3/QlIpQs+C8ro4hXE8=
-            =KZWk
-            -----END PGP MESSAGE-----
-          fp: F155144FC925A1BEA1F8A2C59A2A4CD59BFDC5EC
-        - created_at: "2024-06-21T22:42:59Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAz5uSgHG2iMJARAA5+vcORn/YX2bHcAno9KCUGTzeiCP/DOoSePMdsCAmABj
-            P8XoYJOyZoZgW3qgvtKZ4pLGB26FuJXC2y6Z3yyQ4Xj2PeBj1og9xM8p7GnF6T6n
-            7wqALwJOamyer3A+OXx2Gc8kZ0ObqgBbbn5QTPnHzsRljC3Irgk+ZZE8ZRshoPmu
-            6TEuMW0NT5INmijtPAxer/eaAor3KKxMTf+sqqr/VGNopAyFUCGZynlnjcei6X+T
-            tVKh6zqr/eaTlnhoP2kr4u+wKcHvLV8an8sfsyIGL90O11LNcX8Sf4EyPDYSXOe7
-            AXTFcvfw9+ALu3cbTVPN0aI2e8fCir2S00F8x28Ffc2xDSrXjWEDCXLuRNVXz5KA
-            Mjq4afyQN6mtVZ6ZmtvaLQoG8D2f2sGzvrsBjaXwxPLHKPpUFZVBiiP0C08yokUR
-            7FrYaOjnvQVALLxGJMAhMf02g2dYDFxMw18cY2a+bLrYUVd9EMbuFwCJNzmU0of7
-            EpSvXrA0wTKddk+vL3JoJgIrOxz2IQbaC24NiCUzbyakhT+qDX/oXXILxL2x0GfR
-            RaTL1inkTQO//ooAjlPeMA3OIDQo5CdoV4VlvSUgagYfDvMfDCAO04Xxvezh1uvz
-            //4Jz13+LFoUgbtVUYiT4oqWyfTKOV0D8ILYWKZJtjJt4TeYpEfbQFEzIYyF3OHS
-            XgE7aGyB0ArPBovSr55eQGmW+FaeG1VtH7TRLU367FyQmGep5O2SUxQXqFFiWyDy
-            bseIYdRqNsmlgdXBnADdkVCFJtF4C/VA2DOk+wOO8XtQoMQ8zrIl+0Viq1s66OY=
-            =xc00
-            -----END PGP MESSAGE-----
-          fp: 18DFCE01456DAB52EA38A6584EDC64F35FA1D6A5
-        - created_at: "2024-06-21T22:42:59Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAw5vwmoEJHQ1AQ//abtgoFEWd+zbeSbiwey8nCNQUSklHV9kbLuBK8+ipX/Q
-            qjweWnnPVN6ODhgfXm93k1tSqeJjYqjqfxVsAEUiXC61UhvS6JBZuVUt4nRUWHk2
-            cdu3eKlBx7Nhm6th1gZ+Wf7PcryT5fmJQP5a8VEM/nUuRjnAmG7RuSiWbNzBbTDx
-            4jh4GTvlFkupxZvLsXYf2T+7qn0eHymdQI8+5WSHQH6kApBvINYoq1m55it5ilEp
-            M0tYNFMzi10OjKVbNRQXuKhROzzYGtW8qWGtc33WBB5rvkRVelSDmleTbRywWjE0
-            rNo7vj97SbmGdCHydzcEwPIBOd11ZgFWpamX/36ALeKCxgHgc3HsnjIkDsEffpoN
-            SFHAhyYqXTDRqq5/HuBQBDBJLVVcIbqlJo3us47gI3rhojjSayzTBd5TnGOZt5N0
-            rFOqoZ1i3vf3C5sjKivTzCJ/P3yFgD271hQjv49jSqXgSF8ZIvzaDr0xLiy+XnZ+
-            EsUyqxZBKWy246BtyZ4qBvRjVKbezpxQFh6MzxccY+toUaG2v2I5muvFJRHe7qEA
-            fT6XDl7W6aQ/RBL/Ij9OWYvCMWS27mzkLQi0uBH5gyA1t6Bg9O6+CjGpK6Mmd8fx
-            1Q2Ml5ClzLnEq94FX3f2hpqLdSlwREPoBYULeJNr+WhayDvfRjuh5+MvN+wjbs/S
-            XgGYwgGCrFmzXN1mWElNGc3+3sMEpiuvJp6Z1nRfr17YvIPUrtCU7zVHWR1lWFKU
-            gjJacBX/Qw9Kly+5jADM0UorWkZxaby+q+j8rN43nPatjDlDRI+BrNta0l0ulOA=
-            =2cbn
-            -----END PGP MESSAGE-----
-          fp: 87AB00D45D37C9E9167B5A5A333448678B60E505
-        - created_at: "2024-06-21T22:42:59Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA4HMJd/cQYrVARAAu8l79uJlVLz++foLhk83zrPSZsX+1TQduJl06Kx2VrJ+
-            dZX/0okzpHmHeZGhGH+e1Gv7MpyM4UxAGwE03NIk32p43LF/biad0zc4TB8yr9r6
-            N3Sr/ZbaB0oYC/K4r1Sj8W1XWmuYZB8lc1dyfwhf96KIXGutvG22O5XI0pOA9yHL
-            x4AWt8OHYsaWCt941M6pbFtBsJEl/TaKgYF7YNITvsfj/oG7cPESKLOkcJdmhN1r
-            ADpJRcs6rVvMLWxUBjZICqZvDlwnXK5gCu30MmLs/oQbFmHjBRB01Ird+Mb5e6l4
-            vrYC+zO3RG3dZ+VXJD0rBn+56nDMtiKISJCy4I4Vz/ekwx94cIci+BlD9/3YYix7
-            HVgR6flBgInZEvaBxyj2e0G5i2gKvYTfea5+6bwPpszLUaYba/YLQQ2mSXcwWPsV
-            ipuNSjJ8swK2OpOFTfzs7Ua1OZChCOhhduxiKCwASYrbncfexObsQfeobj3wrwXH
-            N4M+h5ghm+y7UFKDW+gfN79WGfltWiMdy9vZNwwEYF0NE8jkwPfIt2dLvyU73MFU
-            NivYWp6kUj+gbLkb3gLClAi4CyYqNQyBjbKEbt+470UIMZ44WWMEJy7bMwAVzLBk
-            VxBHphqSuP04pgb5a+PHPApCZC6KEntnW1zX+DKrCn3/+NhoD6COhCvetWxq4f7S
-            XgFop4XZPWYJb6ypqkFLbkHIg7tCbr/xae4HABncVj0BaS1Z7TBdMiGi8SQvHti5
-            70rNGZIpQe/59DmBrLT06VdQRY5rt20bDoN+DaUrE2tc0k5h+uwI71TG4//Db2A=
-            =m4ec
-            -----END PGP MESSAGE-----
-          fp: 91213ABAA73B0B73D3C02B5B4E5F372D17BBE67C
-        - created_at: "2024-06-21T22:42:59Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAxjNhCKPP69fAQ//Tz2g90bOkkY942MaLO5/k8MFMf4QEDMZAiw9tVZ39Rqf
-            udMTcGyOX6zLzr+xxNX3gwn8X+bl0yw4Tg/FiyOzl9RjMZDxvzUaj1gYZI9kKPne
-            aEmAYcP2mv+ITUDnApZonDZE5hUnLGAyfEZMU6ExF9XkU94dXFdU4nd+gF5XHzou
-            STiNryBYaxWP1WMkW4SlZqdJiCfrkI0Z7iTF86QtXN5S8qLSIyjP3hIv5QxJg5Xo
-            NwK5IXQhV/0ZHp1Wl8Xys2iUw3iuwPga7sBrMHdJ0PHVBg3Wg/bG7YtrfEAfUbcr
-            UHt9rNGFZluuqNctvcvkSUjv5DISCgl8lSSbzC8DK/vT9o0DQYWvySNpVwXO3tqs
-            9aCxKc8trCXrd9qePnO259Ni0ALRjyh/GHZipzhZo/mgyUWc5nAdTLM49MsmAKHc
-            PnBBSntXnVHfFoFvgyBAmyISVuH/L5j8mezQ/37AevcTfuWemjDRGWIiIJZ73CyF
-            tG6ida5En9QouMO18gKBBzfR/2s6tt60bEp4bE3j2rRgEhwblBfl1NtGSw2WGVVZ
-            bU8KormLDT8aurMIp/Rd1pzAxDpEhDa13TV1IfRECOQvY35aBC59upt+XLwJ83ch
-            Zgi5cRGtSoj1G9OziQGCtJjGqkZoFy7Htou6AyFUEln+2Px0EKGJC3yCUcOF0orS
-            XgEtK2wEJNnJ84LctjrRM4ZSeb/8nycfWiR9riJi1lq6J+WSeiGME3cvhgObDTtG
-            EwuAjG6vhwUdr3aovsENQhvHnQWID844CeBtB9jMHbFJy41vbt0rC0JJG/6RoRg=
-            =5Ijl
-            -----END PGP MESSAGE-----
-          fp: F38C9D4228FC6F674E322D9C3326D914EB9B8F55
-        - created_at: "2024-06-21T22:42:59Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA1Hthzn+T1OoAQ//dwisvTFgYUCFICbaNZ+8jttF4lTQ2fjdP6UHb0evav84
-            PUYpqUfmMF1BUvxDx0rwzzP1OaSKuesxAG46i1Nha1Tq/LOURtzZtXPW4+xSHWge
-            ifbcbGTBkACviKkRuVUqaQBAbzDnFIHtcQy7nbILmzM0aRwm1IC1WzKpPRBgzAy0
-            o/UE4geZjPuNqkix4mcLz8sXvKMz11FE3QpZ44JqiRhmAITTDVo2ymhbvA6R2C1w
-            AL0tjJwKRb0qfoBegyPbuUW399l3CCtEE7voW8AxZ3Y6EGO8DQ1i/MkR81zymFep
-            PUDVYDmhqmh38Z79v5iKqnruzS+rOaitzMRqsUfOJfa4UoFkjO6tYdi5cOY8T4cD
-            w0rgCpvWriaGKGHDuRIdu031GFyf26+SvOWEbiOhMv+h18Hj5P7uT+Is+VuEhHEo
-            i7EYTqzsRwyIfybNkb0mBVluvXb4CpZRdRq5AzC49qu4IezvKoAT99KG1yf7XJvI
-            Ijc/ZITFqCBxE7REA4JBDuivPHfML4CgxG+5PiBJ3JDdaP+xRuoVQQv5E55Y4YwF
-            NM+NTNcvsTv2vKXJ8mmWLBn9xMxN32gmDyy7jW0elW46AQidIL6C+W2Zhxn6GNvc
-            2faDhNQ3yV0A9mIsgQjdWeQemqhsiVU6Sg4Mmattm/b6plGCM1DIcJgMV2RRAobS
-            XgGt7zD15Ju4S+fQqL7MVGGD3y5v0C5eLx78MScygpNQKS0vfTfTE2+wRCzCjZAG
-            /6HU85E6ru1VeXc0TwQBrpX3Wi2ga/momalsCGoh3oHBd+jRqzwpRxojKLy65qU=
-            =g4RA
-            -----END PGP MESSAGE-----
-          fp: 5DA93D5C9D7320E1BD3522C79C78172B3551C9FD
-        - created_at: "2024-06-21T22:42:59Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA46L6MuPqfJqARAAmTOXbn+qa0wgjSvK3juGqVemxKvaD2zFG57ivYdC1Jdn
-            PIVi5aBCvZ8KY/0W9k83LVcGUY1f8eRkCU8ohJU+rmRbiTvT0qo1hfLzxrqaNbke
-            gN+YsYW8bgXioF6nHVWI158GvqNfmvRl4WyJzBQ41cAyMpdGXiIzUoCba3Y6f+1N
-            muljMhgvEtWUddf4zheZX89xV+aLa9Mga6aQbwRcL451UcKxmE2nk4+00rMn7R7R
-            vmsC677/RrKkI7RxubzCVFFlzaH+ZZ1Ott6ozKUWs2vCcB6vTzwwvmrJwmr760lC
-            pozfNp/+WzLZOkA3rO2qAvIUc1DxYA6CgukrAAObCbvmcgMeLtVR29wwWs01qxI+
-            cTxmH+btbiM0PL8+/sW2KlC19hfMmeryiJXxbUN30a3fMDJz1wVor54DsaqG9kIJ
-            zIxGsQ6t8fzfaVfeQwoxODnTWqUClWCY4is251O4Gxw3C0oPWZvzoPvxljaPrYYY
-            SE3dcktWmGoOxLj56lLfceKq0qAtYmJD4Q5k2GDYYU+8dwp95UTf0lbRwauMBROT
-            OMe4r/emH4Z1LiG2/HLoM4QuV5VVQGSAqoE3c42YjjS9uh/aOtmeNNLehwS93F5E
-            J/bXNY6VnHcALRGMZF60g5OxM3QUioNkGqcCWGjSaRPcKhwaXvvIaTCdz8apnBHS
-            XgHeuszpU9/O1nCsNPF2vQUjcNxz+KsL39RwHCVJBVJskxd4HcJQUM7uArV1Fjbk
-            fl4nQuueBrZ4tXzimRK2QOjgy8F2n/Kxpjlr4rXn+Pi9jyhx0Jq4Blu3wrR4LAg=
-            =4Xvm
-            -----END PGP MESSAGE-----
-          fp: 8996B62CBD159DCADD3B6DC08BB33A8ABCF7BC4A
-        - created_at: "2024-06-21T22:42:59Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA4EEKdYEzV0pAQ//fo1yfBspyD2O84d8UCHWoUJTNYql2p26H/vC2BsVzAmL
-            6nylQACeslISLlXbrW+ILPOFZ5x21THOFcJdvCGAQAkY+jC7Ry3D2gwsZi/RLFpP
-            wbEgbzk9hcimmvuHW/NJtrqvXiTJy7GH7el5Zwqe6rtUkTW5IUtaOmZjn2fQBVoq
-            9mMT86vOYlqgIISG1o5x4pciRd+fb3JPiPeJiLcyUBEXYqg2THlyYwwp2paFomYf
-            a6Ls/pVT9ICSblFlnfILOexDpqhxcPH+V2nwlbSlOETq3ACcVIgufIRndTkGhDzi
-            HS3GlD5nIb/ep12Gj+qOgKZBsbUdNIAVojNY2qlK2yQJpE5B1aDjmkAZUkk/LqF3
-            76ZRBDzigU0jfYKh2iGDY3F8cWDsRqjqcTjVB9KF32+1SeUAO4NqDnDpMZgBh2i5
-            rvDOJCJfTgo7DfPqWPyeFM58sow9EEglygASA/XTaDV+CmLzRlqxwlJwpbRrz3OV
-            Mp1gewfGASLPS4xh6gtROac9DAuokmN5VgNg2g+emN8lUNJ/7V7u30TvCEfGP0j0
-            1Sd6RrNn/ZDMJtOoE8gDua6njbOi9Zk/RN4Y4NKWcmiNZxz/Xi/8XU7F0yk0yEL1
-            DUxYsCEHImib+lAESQ0fF4VMXx3DSXq2/Yt5z782ZvgNrGoGw3B9qVA5FyG5Bt3S
-            XgGgfz/6fGZ0DEtTv3B8Rhqbm6TvwPFgIg+3WuQRXxf3rjjoX1AN0jcuz8OIIfGk
-            o1GuRG0/sYg7P32ysgQMvS1F+rX2PR/myHsz4YMM10soG7OduHgXmiJ0eUq8EtM=
-            =WLCQ
-            -----END PGP MESSAGE-----
-          fp: 9DFA033E3DAEBAD7FDD71B056C7AAA54BE05F7BA
-        - created_at: "2024-06-21T22:42:59Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hF4DQrf1tCqiJxoSAQdAUMjy8rV2Zy5nmeMOBsANIUVyhAvVBUF1yunc+EgVeVQw
-            yd4hPHMnQSkasXmcMDS0y2gwixgTOeQbG5PaOr0FA7eGEItLlqwSxz3+GnuD/gEw
-            0l4BFrUbimEX+/tfI8aymapMVYXFXWe4dUZw9foKN5HqkpPKhusozd9bqPPNKggZ
-            09tvIJViKP/QufK0WyLYZGWrG+leogDX39GBtAU1SOllFqtq2G0X1qH+s88GVpaO
-            =hxWV
-            -----END PGP MESSAGE-----
-          fp: B71138A6A8964A3C3B8899857B4F70C356765BAB
-        - created_at: "2024-06-21T22:42:59Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAzdAjw8ldn6CAQ//SK6MVXhRsRxYV8jL9HrVTovc84kNFr24nbHHi5z6fuCA
-            6ZjPr5Btx5Xxi716mEmdDBUSGfeJOOSt6hw4fCqj5ehnCeMLr9GvmJdZx9s2n88m
-            h4Fzd1XF67NMbSAYMPrXpk5dlxBNsgmsAWTaEet9gqGWWYsrZHWPvae7z+GaJJzz
-            h3dix5oVV3tM2OVP9hFhRtu9tv9a0sj5Eu6mz8UsDFwEPynlSDPKUQA0jFTXJnYo
-            yT8UTPSZAUlwnU88JPIhHKCmU8nqUIgDURVNgK4BsuoKSAZ27ueSHr/4IzBiavVD
-            6V1b1Ttt8usKFp21OCqfNuoiIeEipUdLMFSTjSXqOp38QTaqoDaCsAPc6j3HCvlV
-            vMm1lbSKK+Llpk9WOmqvHQriL50lQGYpa2X/jS8FtlotKFm0uGJoJXZ5Ujc4Wmy9
-            J79/cXLULGFCxdPsoxmd8wJFqz0eiVPHIBFB2Y8Tan+Mg44WeBuY8sAWGzYPp+kB
-            sEOIQ5I9N1Gt+58i1hDTRlqO4I8ihusqKeRemJa954rlzz8YTmZL+JAD5gsMtzuH
-            gMjnfBnNJKw3UmnHMMQm348CRB6SuF6rmjc7Xk1qsnie87HtYbM3dJYh7ixddr/a
-            kTHy66zDX4j3e/y2JdEPQw8/WhhdGnyj6eDioQLNFfvApI7doi5C+XDCR08YxJnS
-            XgG0kP/bfDBkwzzHkr3khuvdtmUEmsxGbR/3abyjLfvM+g3HM6Eqq0uDwuGgYinR
-            DYfWUZTas5uWrgxAWYbBCbhPcevu7CsyJFsBtG4ExTXPSsP2c79+LwtmJjbLQqo=
-            =9C2P
-            -----END PGP MESSAGE-----
-          fp: 3D70F61E07F64EC4E4EF417BEFCD9D20F58784EF
-    unencrypted_suffix: _unencrypted
-    version: 3.8.1

config/hosts/woodpecker/sops.nix

@@ -1,7 +0,0 @@
-{ ... }:
-
-{
-  sops = {
-    defaultSopsFile = ./secrets.yaml;
-  };
-}

config/hosts/woodpecker/woodpecker-agent/default.nix

@@ -1,8 +0,0 @@
-{ config, pkgs, ... }:
-
-{
-  imports = [
-    ./docker.nix
-    ./woodpecker-agent.nix
-  ];
-}

config/hosts/woodpecker/woodpecker-agent/docker.nix

@@ -1,12 +0,0 @@
-# Sources for this configuration:
-# - https://woodpecker-ci.org/docs/administration/deployment/nixos
-# - https://woodpecker-ci.org/docs/administration/backends/docker
-# - https://nixos.wiki/wiki/Docker
-
-{ config, pkgs, ... }:
-
-{
-  virtualisation.docker = {
-    enable = true;
-  };
-}

config/hosts/woodpecker/woodpecker-agent/woodpecker-agent.nix

@@ -1,29 +0,0 @@
-# Sources for this configuration:
-# - https://woodpecker-ci.org/docs/administration/deployment/nixos
-# - https://woodpecker-ci.org/docs/administration/agent-config
-# - https://woodpecker-ci.org/docs/administration/backends/docker
-
-{ config, pkgs, ... }:
-
-{
-  services.woodpecker-agents.agents."docker" = {
-    enable = true;
-    package = pkgs.woodpecker-agent;
-    extraGroups = [ "docker" ];
-    environment = {
-      WOODPECKER_SERVER = "localhost${config.services.woodpecker-server.environment.WOODPECKER_GRPC_ADDR}";
-      WOODPECKER_MAX_WORKFLOWS = "4";
-      WOODPECKER_BACKEND = "docker";
-      # Set via enviornmentFile:
-      # WOODPECKER_AGENT_SECRET
-    };
-    environmentFile = [ "/run/secrets/woodpecker_agent_environment_file" ];
-  };
-
-  sops.secrets."woodpecker_agent_environment_file" = {
-    mode = "0440";
-    owner = "root";
-    group = "root";
-    restartUnits = [ "woodpecker-agent-docker.service" ];
-  };
-}

config/hosts/woodpecker/woodpecker-server/default.nix

@@ -1,9 +0,0 @@
-{ config, pkgs, ... }:
-
-{
-  imports = [
-    ./nginx.nix
-    ./postgresql.nix
-    ./woodpecker-server.nix
-  ];
-}

config/hosts/woodpecker/woodpecker-server/nginx.nix

@@ -1,57 +0,0 @@
-# Sources for this configuration:
-# - https://woodpecker-ci.org/docs/administration/deployment/nixos
-# - https://woodpecker-ci.org/docs/administration/proxy
-
-{ config, pkgs, ... }:
-
-{
-  services.nginx = {
-    enable = true;
-
-    virtualHosts."acme-woodpecker.hamburg.ccc.de" = {
-      default = true;
-      enableACME = true;
-      serverName = "woodpecker.hamburg.ccc.de";
-
-      listen = [
-        {
-          addr = "0.0.0.0";
-          port = 31820;
-        }
-      ];
-    };
-
-    virtualHosts."woodpecker.hamburg.ccc.de" = {
-      default = true;
-      forceSSL = true;
-      useACMEHost = "woodpecker.hamburg.ccc.de";
-
-      listen = [
-        {
-          addr = "0.0.0.0";
-          port = 8443;
-          ssl = true;
-          proxyProtocol = true;
-        }
-      ];
-
-      locations."/" = {
-        proxyPass = "http://localhost${config.services.woodpecker-server.environment.WOODPECKER_SERVER_ADDR}";
-      };
-
-      extraConfig = ''
-        # Make use of the ngx_http_realip_module to set the $remote_addr and
-        # $remote_port to the client address and client port, when using proxy
-        # protocol.
-        # First set our proxy protocol proxy as trusted.
-        set_real_ip_from 172.31.17.140;
-        # Then tell the realip_module to get the addreses from the proxy protocol
-        # header.
-        real_ip_header proxy_protocol;
-      '';
-    };
-  };
-
-  networking.firewall.allowedTCPPorts = [ 8443 31820 ];
-  networking.firewall.allowedUDPPorts = [ 8443 ];
-}

config/hosts/woodpecker/woodpecker-server/postgresql.nix

@@ -1,18 +0,0 @@
-# Sources for this configuration:
-# - https://github.com/NixOS/nixpkgs/blob/dce84c46d780b20c064d5dfb10d0686e0584a198/nixos/modules/services/web-apps/nextcloud.nix#L1069
-
-{ config, pkgs, ... }:
-
-{
-  services.postgresql = {
-    enable = true;
-    package = pkgs.postgresql_15;
-    ensureDatabases = [ "woodpecker-server" ];
-    ensureUsers = [
-      {
-        name = "woodpecker-server";
-        ensureDBOwnership = true;
-      }
-    ];
-  };
-}

config/hosts/woodpecker/woodpecker-server/woodpecker-server.nix

@@ -1,43 +0,0 @@
-# Sources for this configuration:
-# - https://woodpecker-ci.org/docs/administration/deployment/nixos
-# - https://woodpecker-ci.org/docs/administration/server-config
-# - https://woodpecker-ci.org/docs/administration/database
-# - https://woodpecker-ci.org/docs/administration/forges/forgejo
-# - https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-CONNSTRING
-
-{ config, pkgs, ... }:
-
-{
-  services.woodpecker-server = {
-    enable = true;
-    package = pkgs.woodpecker-server;
-    environment = {
-      WOODPECKER_HOST = "https://woodpecker.hamburg.ccc.de";
-      WOODPECKER_SERVER_ADDR = ":8001";
-      WOODPECKER_GRPC_ADDR = ":9000";
-      WOODPECKER_ADMIN = "june";
-      WOODPECKER_OPEN = "true";
-      WOODPECKER_ORGS = "CCCHH";
-      WOODPECKER_DATABASE_DRIVER = "postgres";
-      WOODPECKER_DATABASE_DATASOURCE = "postgresql://woodpecker-server@/woodpecker-server?host=/run/postgresql";
-      WOODPECKER_FORGEJO = "true";
-      WOODPECKER_FORGEJO_URL = "https://git.hamburg.ccc.de";
-      # Set via enviornmentFile:
-      # WOODPECKER_FORGEJO_CLIENT
-      # WOODPECKER_FORGEJO_SECRET
-    };
-    environmentFile = [ "/run/secrets/woodpecker_server_environment_file" ];
-  };
-
-  systemd.services.woodpecker-server.serviceConfig = {
-    User = "woodpecker-server";
-    Group = "woodpecker-server";
-  };
-
-  sops.secrets."woodpecker_server_environment_file" = {
-    mode = "0440";
-    owner = "root";
-    group = "root";
-    restartUnits = [ "woodpecker-server.service" ];
-  };
-}

config/hosts/yate/networking.nix

@@ -1,4 +1,4 @@
-{ ... }:
+{ config, pkgs, ... }:
 
 {
   networking = {

deployment_configuration.json

@@ -23,18 +23,6 @@
     },
     "nix-box-june": {
       "targetHostname": "nix-box-june-intern.hamburg.ccc.de"
-    },
-    "mjolnir": {
-      "targetHostname": "mjolnir-intern.hamburg.ccc.de"
-    },
-    "woodpecker": {
-      "targetHostname": "woodpecker-intern.hamburg.ccc.de"
-    },
-    "penpot": {
-      "targetHostname": "penpot-intern.hamburg.ccc.de"
-    },
-    "hydra": {
-      "targetHostname": "hydra-intern.hamburg.ccc.de"
     }
   }
 }

flake.lock

@@ -1,26 +1,12 @@
 {
   "nodes": {
-    "authorizedKeysRepo": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1731276342,
-        "narHash": "sha256-plTYjM6zPzoBE/dp6EUrk9mCqmab278p8FqBCTX8Grc=",
-        "rev": "686a6af22f6696f0c0595c56f463c078550049fc",
-        "type": "tarball",
-        "url": "https://git.hamburg.ccc.de/api/v1/repos/CCCHH/infrastructure-authorized-keys/archive/686a6af22f6696f0c0595c56f463c078550049fc.tar.gz?rev=686a6af22f6696f0c0595c56f463c078550049fc"
-      },
-      "original": {
-        "type": "tarball",
-        "url": "https://git.hamburg.ccc.de/CCCHH/infrastructure-authorized-keys/archive/686a6af22f6696f0c0595c56f463c078550049fc.tar.gz"
-      }
-    },
     "nixlib": {
       "locked": {
-        "lastModified": 1731200463,
+        "lastModified": 1712450863,
-        "narHash": "sha256-qDaAweJjdFbVExqs8aG27urUgcgKufkIngHW3Rzustg=",
+        "narHash": "sha256-K6IkdtMtq9xktmYPj0uaYc8NsIqHuaAoRBaMgu9Fvrw=",
         "owner": "nix-community",
         "repo": "nixpkgs.lib",
-        "rev": "e04234d263750db01c78a412690363dc2226e68a",
+        "rev": "3c62b6a12571c9a7f65ab037173ee153d539905f",
         "type": "github"
       },
       "original": {
@@ -32,14 +18,16 @@
     "nixos-generators": {
       "inputs": {
         "nixlib": "nixlib",
-        "nixpkgs": "nixpkgs"
+        "nixpkgs": [
+          "nixpkgs"
+        ]
       },
       "locked": {
-        "lastModified": 1731546190,
+        "lastModified": 1716210724,
-        "narHash": "sha256-kJix8nLyFIJ3EC7VtoXK/85C4ZN2dC5oWoS8+ErehqI=",
+        "narHash": "sha256-iqQa3omRcHGpWb1ds75jS9ruA5R39FTmAkeR3J+ve1w=",
         "owner": "nix-community",
         "repo": "nixos-generators",
-        "rev": "06ffce1a8d95e95c06a4bcfa117dd960b14a7101",
+        "rev": "d14b286322c7f4f897ca4b1726ce38cb68596c94",
         "type": "github"
       },
       "original": {
@@ -50,41 +38,57 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1731245184,
+        "lastModified": 1716408408,
-        "narHash": "sha256-vmLS8+x+gHRv1yzj3n+GTAEObwmhxmkkukB2DwtJRdU=",
+        "narHash": "sha256-e4pjcLqe1Dexz7enk/+ui0aVdcoSiWnrTGjk7KLtAPw=",
-        "owner": "NixOS",
+        "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "aebe249544837ce42588aa4b2e7972222ba12e8f",
+        "rev": "dff68ababdd2c2616d03f26546ba632f5f09d3c6",
         "type": "github"
       },
       "original": {
-        "owner": "NixOS",
+        "owner": "nixos",
-        "ref": "nixpkgs-unstable",
+        "ref": "nixos-23.11-small",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
-    "nixpkgs_2": {
+    "nixpkgs-stable": {
       "locked": {
-        "lastModified": 1731842749,
+        "lastModified": 1716061101,
-        "narHash": "sha256-aNc8irVBH7sM5cGDvqdOueg8S+fGakf0rEMRGfGwWZw=",
+        "narHash": "sha256-H0eCta7ahEgloGIwE/ihkyGstOGu+kQwAiHvwVoXaA0=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "e7cc61784ddf51c81487637b3031a6dd2d6673a2",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "release-23.11",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs-unstable": {
+      "locked": {
+        "lastModified": 1716479278,
+        "narHash": "sha256-2eh7rYxQOntkUjFXtlPH7lBuUDd4isu/YHRjNJW7u1Q=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "bf6132dc791dbdff8b6894c3a85eb27ad8255682",
+        "rev": "2ee89d5a0167a8aa0f2a5615d2b8aefb1f299cd4",
         "type": "github"
       },
       "original": {
         "owner": "nixos",
-        "ref": "nixos-24.05-small",
+        "ref": "nixos-unstable-small",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
     "root": {
       "inputs": {
-        "authorizedKeysRepo": "authorizedKeysRepo",
         "nixos-generators": "nixos-generators",
-        "nixpkgs": "nixpkgs_2",
+        "nixpkgs": "nixpkgs",
+        "nixpkgs-unstable": "nixpkgs-unstable",
         "sops-nix": "sops-nix"
       }
     },
@@ -92,14 +96,15 @@
       "inputs": {
         "nixpkgs": [
           "nixpkgs"
-        ]
+        ],
+        "nixpkgs-stable": "nixpkgs-stable"
       },
       "locked": {
-        "lastModified": 1731862312,
+        "lastModified": 1716400300,
-        "narHash": "sha256-NVUTFxKrJp/hjehlF1IvkPnlRYg/O9HFVutbxOM8zNM=",
+        "narHash": "sha256-0lMkIk9h3AzOHs1dCL9RXvvN4PM8VBKb+cyGsqOKa4c=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "472741cf3fee089241ac9ea705bb2b9e0bfa2978",
+        "rev": "b549832718b8946e875c016a4785d204fcfc2e53",
         "type": "github"
       },
       "original": {

flake.nix

@@ -5,13 +5,14 @@
     # Use the NixOS small channels for nixpkgs.
     # https://nixos.org/manual/nixos/stable/#sec-upgrading
     # https://github.com/NixOS/nixpkgs
-    nixpkgs.url = "github:nixos/nixpkgs/nixos-24.05-small";
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-23.11-small";
+    nixpkgs-unstable.url = "github:nixos/nixpkgs/nixos-unstable-small";
 
     # Add nixos-generators as an input.
     # See here: https://github.com/nix-community/nixos-generators#using-in-a-flake
     nixos-generators = {
       url = "github:nix-community/nixos-generators";
-      #inputs.nixpkgs.follows = "nixpkgs";
+      inputs.nixpkgs.follows = "nixpkgs";
     };
 
     # Add sops-nix as an input for secret management.
@@ -20,261 +21,206 @@
       url = "github:Mic92/sops-nix";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-
-    authorizedKeysRepo = {
-      url = "https://git.hamburg.ccc.de/CCCHH/infrastructure-authorized-keys/archive/686a6af22f6696f0c0595c56f463c078550049fc.tar.gz";
-      flake = false;
-    };
   };
 
-  outputs = { self, nixpkgs, nixos-generators, sops-nix, authorizedKeysRepo, ... }:
+  outputs = { nixpkgs, nixpkgs-unstable, nixos-generators, sops-nix, ... }:
     let
-      specialArgs = {
-        inherit authorizedKeysRepo;
-      };
       system = "x86_64-linux";
-    in
+      # Shairport Sync 4.3.1 (with nqptp 1.2.4) with metadata, MQTT and AirPlay 2 support.
-    {
+      shairportSync431ExtendedNixpkgsUnstableOverlay = final: prev: {
-      overlays = {
-        shairportSyncAirplay2 = final: prev: {
         shairport-sync = (prev.shairport-sync.override { enableMetadata = true; enableAirplay2 = true; }).overrideAttrs (finalAttr: previousAttr: {
           # See: https://github.com/mikebrady/shairport-sync/blob/e78a88b64adfe7b5f88fd6faedf55c57445bb240/CONFIGURATION%20FLAGS.md
           configureFlags = previousAttr.configureFlags ++ [ "--with-mqtt-client" ];
           buildInputs = previousAttr.buildInputs ++ [ final.mosquitto ];
+          # Use specific Shairport Sync and nqptp versions, since with those the
+          # following error doesn't happen:
+          # fatal error: The nqptp service on this system, which is required for
+          # Shairport Sync to operate, does not seem to be initialised.
+          #
+          # Also use a more recent dev version to fix Pipewire stuttering issue.
+          # See:
+          # https://github.com/mikebrady/shairport-sync/issues/1736
+          # https://github.com/mikebrady/shairport-sync/blob/a65ec2d7f1f380bbae196d7f8f1cd6a88ef5777b/RELEASENOTES-DEVELOPMENT.md#version-432-dev-51-g98679bbb
+          src = final.fetchFromGitHub {
+            owner = "mikebrady";
+            repo = finalAttr.pname;
+            rev = "98679bbb54f5aaeda859e34aa28425647b8d179e";
+            hash = "sha256-k0kcgtWk2xlG34lP0ryEaqdskYMNM68YnIRLwFR3jaY=";
+          };
+        });
+        nqptp = prev.nqptp.overrideAttrs (finalAttr: previousAttr: {
+          # See Shairport Sync version note.
+          src = final.fetchFromGitHub {
+            owner = "mikebrady";
+            repo = finalAttr.pname;
+            rev = "1.2.4";
+            hash = "sha256-roTNcr3v2kzE6vQ5plAVtlw1+2yJplltOYsGGibtoZo=";
+          };
+          # Custom install phase to avoid setcap.
+          # See:
+          # https://github.com/mikebrady/nqptp/blob/1.2.4/Makefile.am#L23
+          installPhase = ''
+            mkdir -p $out/bin
+            cp nqptp $out/bin/
+          '';
         });
       };
-      };
+      pkgs-unstable = nixpkgs-unstable.legacyPackages."x86_64-linux";
-      nixosModules = {
+    in
-        common = ./config/common;
+    {
-        proxmox-vm = ./config/proxmox-vm;
-        prometheus-exporter = ./config/extra/prometheus-exporter.nix;
-      };
       nixosConfigurations = {
-        audio-hauptraum-kueche = nixpkgs.lib.nixosSystem {
+        audio-hauptraum-kueche = nixpkgs-unstable.lib.nixosSystem {
-          inherit system specialArgs;
+          inherit system;
           modules = [
-            self.nixosModules.common
+            ./config/common
-            self.nixosModules.proxmox-vm
+            ./config/proxmox-vm
-            { nixpkgs.overlays = [ self.overlays.shairportSyncAirplay2 ]; }
+            { nixpkgs.overlays = [ shairportSync431ExtendedNixpkgsUnstableOverlay ]; }
             ./config/hosts/audio-hauptraum-kueche
           ];
         };
 
-        audio-hauptraum-tafel = nixpkgs.lib.nixosSystem {
+        audio-hauptraum-tafel = nixpkgs-unstable.lib.nixosSystem {
-          inherit system specialArgs;
+          inherit system;
           modules = [
-            self.nixosModules.common
+            ./config/common
-            self.nixosModules.proxmox-vm
+            ./config/proxmox-vm
-            { nixpkgs.overlays = [ self.overlays.shairportSyncAirplay2 ]; }
+            { nixpkgs.overlays = [ shairportSync431ExtendedNixpkgsUnstableOverlay ]; }
             ./config/hosts/audio-hauptraum-tafel
           ];
         };
 
         esphome = nixpkgs.lib.nixosSystem {
-          inherit system specialArgs;
+          inherit system;
           modules = [
-            self.nixosModules.common
+            ./config/common
-            self.nixosModules.proxmox-vm
+            ./config/proxmox-vm
             ./config/hosts/esphome
           ];
         };
 
         public-reverse-proxy = nixpkgs.lib.nixosSystem {
-          inherit system specialArgs;
+          inherit system;
           modules = [
-            self.nixosModules.common
+            ./config/common
-            self.nixosModules.proxmox-vm
+            ./config/proxmox-vm
             ./config/hosts/public-reverse-proxy
           ];
         };
 
         netbox = nixpkgs.lib.nixosSystem {
-          inherit system specialArgs;
+          inherit system;
           modules = [
-            self.nixosModules.common
+            ./config/common
-            self.nixosModules.proxmox-vm
+            ./config/proxmox-vm
             sops-nix.nixosModules.sops
-            self.nixosModules.prometheus-exporter
             ./config/hosts/netbox
           ];
         };
 
         matrix = nixpkgs.lib.nixosSystem {
-          inherit system specialArgs;
+          inherit system;
           modules = [
-            self.nixosModules.common
+            ./config/common
-            self.nixosModules.proxmox-vm
+            ./config/proxmox-vm
             sops-nix.nixosModules.sops
-            self.nixosModules.prometheus-exporter
             ./config/hosts/matrix
           ];
         };
 
         public-web-static = nixpkgs.lib.nixosSystem {
-          inherit system specialArgs;
+          inherit system;
           modules = [
-            self.nixosModules.common
+            ./config/common
-            self.nixosModules.proxmox-vm
+            ./config/proxmox-vm
             sops-nix.nixosModules.sops
-            self.nixosModules.prometheus-exporter
             ./config/hosts/public-web-static
           ];
         };
 
         git = nixpkgs.lib.nixosSystem {
-          inherit system specialArgs;
+          inherit system;
           modules = [
-            self.nixosModules.common
+            ./config/common
-            self.nixosModules.proxmox-vm
+            ./config/proxmox-vm
             sops-nix.nixosModules.sops
-            self.nixosModules.prometheus-exporter
             ./config/hosts/git
           ];
+          specialArgs = {
+            inherit pkgs-unstable;
+          };
         };
 
         forgejo-actions-runner = nixpkgs.lib.nixosSystem {
-          inherit system specialArgs;
+          inherit system;
           modules = [
-            self.nixosModules.common
+            ./config/common
-            self.nixosModules.proxmox-vm
+            ./config/proxmox-vm
             sops-nix.nixosModules.sops
-            self.nixosModules.prometheus-exporter
             ./config/hosts/forgejo-actions-runner
           ];
         };
 
         ptouch-print-server = nixpkgs.lib.nixosSystem {
-          inherit system specialArgs;
+          inherit system;
           modules = [
-            self.nixosModules.common
+            ./config/common
-            self.nixosModules.proxmox-vm
+            ./config/proxmox-vm
             ./config/hosts/ptouch-print-server
           ];
         };
 
         eh22-wiki = nixpkgs.lib.nixosSystem {
-          inherit system specialArgs;
+          inherit system;
           modules = [
-            self.nixosModules.common
+            ./config/common
-            self.nixosModules.proxmox-vm
+            ./config/proxmox-vm
-            self.nixosModules.prometheus-exporter
             ./config/hosts/eh22-wiki
           ];
         };
 
         nix-box-june = nixpkgs.lib.nixosSystem {
-          inherit system specialArgs;
+          inherit system;
           modules = [
-            self.nixosModules.common
+            ./config/common
-            self.nixosModules.proxmox-vm
+            ./config/proxmox-vm
-            self.nixosModules.prometheus-exporter
             ./config/hosts/nix-box-june
           ];
         };
 
         yate = nixpkgs.lib.nixosSystem {
-          inherit system specialArgs;
+          inherit system;
           modules = [
-            self.nixosModules.common
+            ./config/common
-            self.nixosModules.proxmox-vm
+            ./config/proxmox-vm
             sops-nix.nixosModules.sops
             ./config/hosts/yate
           ];
         };
-
-        mqtt = nixpkgs.lib.nixosSystem {
-          inherit system specialArgs;
-          modules = [
-            self.nixosModules.common
-            self.nixosModules.proxmox-vm
-            ./config/hosts/mqtt
-          ];
-        };
-
-        mjolnir = nixpkgs.lib.nixosSystem {
-          inherit system specialArgs;
-          modules = [
-            self.nixosModules.common
-            self.nixosModules.proxmox-vm
-            sops-nix.nixosModules.sops
-            self.nixosModules.prometheus-exporter
-            ./config/hosts/mjolnir
-          ];
-        };
-
-        woodpecker = nixpkgs.lib.nixosSystem {
-          inherit system specialArgs;
-          modules = [
-            self.nixosModules.common
-            self.nixosModules.proxmox-vm
-            sops-nix.nixosModules.sops
-            self.nixosModules.prometheus-exporter
-            ./config/hosts/woodpecker
-          ];
-        };
-
-        status = nixpkgs.lib.nixosSystem {
-          inherit system specialArgs;
-          modules = [
-            self.nixosModules.common
-            self.nixosModules.proxmox-vm
-            sops-nix.nixosModules.sops
-            ./config/hosts/status
-          ];
-        };
-
-        penpot = nixpkgs.lib.nixosSystem {
-          inherit system specialArgs;
-          modules = [
-            self.nixosModules.common
-            self.nixosModules.proxmox-vm
-            sops-nix.nixosModules.sops
-            self.nixosModules.prometheus-exporter
-            ./config/hosts/penpot
-          ];
-        };
-
-        hydra = nixpkgs.lib.nixosSystem {
-          inherit system specialArgs;
-          modules = [
-            self.nixosModules.common
-            self.nixosModules.proxmox-vm
-            self.nixosModules.prometheus-exporter
-            ./config/hosts/hydra
-          ];
-        };
       };
 
       packages.x86_64-linux = {
         proxmox-nixos-template = nixos-generators.nixosGenerate {
-          inherit specialArgs;
           system = "x86_64-linux";
           modules = [
             ./config/nixos-generators/proxmox.nix
-            self.nixosModules.common
+            ./config/common
-            self.nixosModules.proxmox-vm
+            ./config/proxmox-vm
           ];
           format = "proxmox";
         };
 
         proxmox-chaosknoten-nixos-template = nixos-generators.nixosGenerate {
-          inherit specialArgs;
           system = "x86_64-linux";
           modules = [
             ./config/nixos-generators/proxmox-chaosknoten.nix
             ./config/proxmox-chaosknoten-additional-initial-config.nix
-            self.nixosModules.common
+            ./config/common
-            self.nixosModules.proxmox-vm
+            ./config/proxmox-vm
           ];
           format = "proxmox";
         };
       };
 
       formatter.x86_64-linux = nixpkgs.legacyPackages.x86_64-linux.nixpkgs-fmt;
-
-      hydraJobs = {
-        inherit (self) packages;
-        nixosConfigurations = builtins.mapAttrs (name: value: value.config.system.build.toplevel) self.nixosConfigurations;
-      };
     };
 }

modules/services/audio/default.nix

@@ -12,6 +12,7 @@ in
   imports = [
     ./librespot.nix
     ./mpd.nix
+    ./networking.nix
     ./pipewire.nix
     ./shairport-sync.nix
   ];

modules/services/audio/librespot.nix

@@ -23,7 +23,7 @@ in
         After = [ "network-online.target" "pipewire.service" ];
       };
       serviceConfig = {
-        ExecStart = "${pkgs.librespot}/bin/librespot --name '${config.ccchh.services.audio.name}' --device-type speaker --bitrate 320 --enable-volume-normalisation --disable-audio-cache --disable-credential-cache";
+        ExecStart = "${pkgs.librespot}/bin/librespot --name '${config.ccchh.services.audio.name}' --device-type speaker --bitrate 320 --enable-volume-normalisation --disable-audio-cache --disable-credential-cache --quiet";
         User = "librespot";
         Group = "librespot";
       };
@@ -34,7 +34,7 @@ in
       users.librespot = {
         isSystemUser = true;
         group = "librespot";
-        extraGroups = [ "pipewire" "audio" ];
+        extraGroups = [ "pipewire" ];
       };
       groups.librespot = { };
     };

modules/services/audio/networking.nix

@@ -0,0 +1,16 @@
+{ config, pkgs, lib, ... }:
+
+with lib;
+
+let
+
+  cfg = config.ccchh.services.audio;
+
+in
+
+{
+  config = mkIf cfg.enable {
+    # Disable IPv6, since Shairport-Sync doesn't work with IPv6. Unclear why.
+    networking.enableIPv6 = false;
+  };
+}

modules/services/audio/shairport-sync.nix

@@ -20,7 +20,7 @@ in
       arguments = "-o pw -v";
     };
 
-    users.users.shairport.extraGroups = [ "pipewire" "audio" ];
+    users.users.shairport.extraGroups = [ "pipewire" ];
 
     environment.etc.shairport-sync-config = {
       enable = true;