add yate service for autostart

introduce /etc/yate, clone/reset on service start

Fix config via git

make yate systemd service

create yate service user

recreate the full config everytime

decolour the log because of blob data

make sure source is available before deleting config

change yate-config repo

fix yate deploy key

fix yate-config not pulling

.editorconfig

@@ -1,23 +0,0 @@
-root = true
-
-[*]
-end_of_line = lf
-insert_final_newline = true
-indent_style = space
-charset = utf-8
-
-[*.nix]
-indent_size = 2
-trim_trailing_whitespace = true
-
-[*.md]
-indent_size = 2
-trim_trailing_whitespace = false
-
-[*.json]
-indent_size = 2
-trim_trailing_whitespace = true
-
-[*.yaml]
-indent_size = 2
-trim_trailing_whitespace = true

.sops.yaml

@@ -15,9 +15,7 @@ keys:
   - &host_age_matrix age1f7ams0n2zy994pzt0u30h8tex6xdcernj59t4d70z4kjsyzrr3wsy87xzk
   - &host_age_netbox age13fqs76z2vl5l84dvmmlqjj5xkfsfe85xls8uueul7re9j3ksjs0sw2xc9e
   - &host_age_public_web_static age19s7r8sf7j6zk24x9vumawgxpd2q8epyv7p9qsjntw7v9s3v045mqhmsfp0
-  - &host_age_mjolnir age1ej52kwuj8xraxdq685eejj4dmxpfmpgt4d8jka98rtpal6xcueqq9a6wae
+  - &host_age_yate age1kxzl00cfa5v926cvtcp0l3fncwh6fgmk8jvpf4swkl4vh3hv9e5qyqsrnt
-  - &host_age_woodpecker age1klxtcr23hers0lh4f5zdd53tyrtg0jud35rhydstyjq9fjymf9hsn2a8ch
-  - &host_age_penpot age10ku5rphtsf2lcxg78za7f2dad5cx5x9urgkce0d7tyqwq2enva9sqf7g8r
 creation_rules:
   - path_regex: config/hosts/git/.*
     key_groups:
@@ -99,7 +97,7 @@ creation_rules:
           - *admin_gpg_dante
         age:
           - *host_age_public_web_static
-  - path_regex: config/hosts/mjolnir/.*
+  - path_regex: config/hosts/yate/.*
     key_groups:
       - pgp:
           - *admin_gpg_djerun
@@ -114,39 +112,7 @@ creation_rules:
           - *admin_gpg_c6ristian
           - *admin_gpg_dante
         age:
-          - *host_age_mjolnir
+          - *host_age_yate
-  - path_regex: config/hosts/woodpecker/.*
-    key_groups:
-      - pgp:
-          - *admin_gpg_djerun
-          - *admin_gpg_stb
-          - *admin_gpg_jtbx
-          - *admin_gpg_yuri
-          - *admin_gpg_june
-          - *admin_gpg_haegar
-          - *admin_gpg_dario
-          - *admin_gpg_echtnurich
-          - *admin_gpg_max
-          - *admin_gpg_c6ristian
-          - *admin_gpg_dante
-        age:
-          - *host_age_woodpecker
-  - path_regex: config/hosts/penpot/.*
-    key_groups:
-      - pgp:
-          - *admin_gpg_djerun
-          - *admin_gpg_stb
-          - *admin_gpg_jtbx
-          - *admin_gpg_yuri
-          - *admin_gpg_june
-          - *admin_gpg_haegar
-          - *admin_gpg_dario
-          - *admin_gpg_echtnurich
-          - *admin_gpg_max
-          - *admin_gpg_c6ristian
-          - *admin_gpg_dante
-        age:
-          - *host_age_penpot
   - key_groups:
       - pgp:
           - *admin_gpg_djerun

LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) CCCHH
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.

README.md

@@ -18,62 +18,3 @@ infra-rebuild switch git matrix
 By default infra-rebuild tries to use the FQDN from the nixosConfiguration of the host for deployment.
 However to override individual parts of the deployment target, a [`deployment_configuration.json`](./deployment_configuration.json) can be used.
 This is exactly what we're doing to set the default deployment user to `colmena-deploy` and have custom target hostnames for Chaosknoten hosts, since they don't have an FQDN defined in their nixosConfiguration.
-
-## Setting up secrets with sops-nix for a host
-
-1. Convert the hosts SSH host public key to an age public key.
-   This can be done by connecting to the host and running:
-   ```
-   cat /etc/ssh/ssh_host_ed25519_key.pub | ssh-to-age
-   ``` 
-2. Add the resulting age public key to the `.sops.yaml` as a YAML anchor in keys.
-   It should be named something like: `host_age_hostname`
-3. Add a new creation rule for the hosts config directory.
-   It should probably have all admin keys and the hosts age key. \
-   You can use existing creation rules as a reference.
-4. Create a file containing the relevant secrets in the hosts config directory.
-   This can be accomplished with a command similar to this:
-   ```
-   sops config/hosts/hostname/secrets.yaml
-   ```
-   Note: Nested keys don't seem to be compatible with sops-nix.
-5. Add the following entry to the modules of the hosts `nixosConfiguration`:
-   ```nix
-   sops-nix.nixosModules.sops
-   ```
-6. Create a `sops.nix` in the hosts config directory containing the following content to include the `secrets.yaml`:
-   ```nix
-   { ... }:
-
-   {
-     sops = {
-       defaultSopsFile = ./secrets.yaml;
-     };
-   }
-   ```
-7. Make sure the `sops.nix` gets imported. For example in the `default.nix`.
-8. To use a secret stored under e.g. `forgejo_git_smtp_password`, you can then do something like the following:
-   ```nix
-   sops.secrets."forgejo_git_smtp_password" = {
-     mode = "0440";
-     owner = "forgejo";
-     group = "forgejo";
-     restartUnits = [ "forgejo.service" ];
-   };
-   ```
-   This secret would then be available under `/run/secrets/forgejo_git_smtp_password` on the host.
-
-## Build NixOS Proxmox VE Template
-
-Build a new NixOS Proxmox VE Template for the thinkcccore's:
-```shell
-nix build .#proxmox-nixos-template
-```
-Build a new NixOS Proxmox VE Template for the chaosknoten:
-```shell
-nix build .#proxmox-chaosknoten-nixos-template
-```
-
-## License
-
-This CCCHH nix-infra repository is licensed under the [MIT License](./LICENSE).

config/common/admin-environment.nix

@@ -13,7 +13,6 @@
     git
     curl
     rsync
-    ssh-to-age
     usbutils
     nix-tree
     # For kitty terminfo.

config/common/default-state-version.nix

@@ -13,5 +13,5 @@
   # this value at the release version of the first install of this system.
   # Before changing this value read the documentation for this option
   # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
-  system.stateVersion = lib.mkDefault "24.05";
+  system.stateVersion = lib.mkDefault "23.05";
 }

config/common/users.nix

@@ -6,9 +6,14 @@
 # - https://git.grzb.de/yuri/nix-infra/-/blob/342a2f732da042d04e579d98e9f834418b7ebf25/users/colmena-deploy/default.nix
 # - https://nixos.org/manual/nix/stable/command-ref/conf-file.html?highlight=nix.conf#available-settings
 
-{ config, pkgs, lib, authorizedKeysRepo, ... }:
+{ config, pkgs, lib, ... }:
 
 let
+  authorizedKeysRepo = builtins.fetchGit {
+    url = "forgejo@git.hamburg.ccc.de:CCCHH/infrastructure-authorized-keys.git";
+    ref = "trunk";
+    rev = "da9d3ead9d97ce0fef7538638326264957e2f1b4";
+  };
   authorizedKeys = builtins.filter (item: item != "") (lib.strings.splitString "\n" (builtins.readFile "${authorizedKeysRepo}/authorized_keys"));
 in
 {

config/extra/prometheus-exporter.nix

@@ -1,8 +0,0 @@
-{ ... }:
-
-{
-  services.prometheus.exporters.node = {
-    enable = true;
-    openFirewall = true;
-  };
-}

config/hosts/audio-hauptraum-kueche/networking.nix

@@ -1,4 +1,4 @@
-{ ... }:
+{ config, pkgs, ... }:
 
 {
   networking = {
@@ -11,9 +11,10 @@
       ];
     };
     defaultGateway = "10.31.210.1";
-    nameservers = [ "10.31.210.1" ];
+    nameservers = [
+      "10.31.210.1"
+    ];
   };
-
   systemd.network.links."10-net0" = {
     matchConfig.MACAddress = "1E:EF:2D:92:81:DA";
     linkConfig.Name = "net0";

config/hosts/audio-hauptraum-tafel/networking.nix

@@ -1,4 +1,4 @@
-{ ... }:
+{ config, pkgs, ... }:
 
 {
   networking = {
@@ -11,9 +11,10 @@
       ];
     };
     defaultGateway = "10.31.210.1";
-    nameservers = [ "10.31.210.1" ];
+    nameservers = [
+      "10.31.210.1"
+    ];
   };
-
   systemd.network.links."10-net0" = {
     matchConfig.MACAddress = "D2:10:33:B1:72:C3";
     linkConfig.Name = "net0";

config/hosts/eh22-wiki/dokuwiki.nix

@@ -21,8 +21,7 @@ let
   app = "dokuwiki";
   domain = "eh22.easterhegg.eu";
   dataDir = "/srv/www/${domain}";
-in
+in {
-{
   systemd.tmpfiles.rules = [
     "d ${dataDir} 0755 ${app} ${app}"
   ];
@@ -58,16 +57,16 @@ in
       ; Checked with NixOS 23.11 on 2024-05-02.
       extension = ${pkgs.phpExtensions.bz2}/lib/php/extensions/bz2.so
     '';
-    settings = {
+    extraConfig = ''
-      "listen.owner" = "${config.services.nginx.user}";
+      listen.owner = ${config.services.nginx.user};
-      "listen.group" = "${config.services.nginx.group}";
+      listen.group = ${config.services.nginx.group};
-      "pm" = "dynamic";
+      pm = dynamic
-      "pm.max_children" = 32;
+      pm.max_children = 32
-      "pm.start_servers" = 2;
+      pm.start_servers = 2
-      "pm.min_spare_servers" = 2;
+      pm.min_spare_servers = 2
-      "pm.max_spare_servers" = 4;
+      pm.max_spare_servers = 4
-      "pm.max_requests" = 500;
+      pm.max_requests = 500
-    };
+    '';
   };
 
   services.nginx = {
@@ -77,7 +76,7 @@ in
       default = true;
       enableACME = true;
       serverName = "${domain}";
-
+      
       listen = [
         {
           addr = "0.0.0.0";

config/hosts/eh22-wiki/networking.nix

@@ -1,19 +1,20 @@
+# Sources for this configuration:
+# - https://nixos.wiki/wiki/Networking
+
 { ... }:
 
 {
-  networking = {
+  networking.interfaces.net0 = {
-    interfaces.net0 = {
+    ipv4.addresses = [
-      ipv4.addresses = [
+      {
-        {
+        address = "172.31.17.159";
-          address = "172.31.17.159";
+        prefixLength = 25;
-          prefixLength = 25;
+      }
-        }
+    ];
-      ];
-    };
-    defaultGateway = "172.31.17.129";
-    nameservers = [ "212.12.50.158" "192.76.134.90" ];
-    search = [ "hamburg.ccc.de" ];
   };
+  networking.defaultGateway = "172.31.17.129";
+  networking.nameservers = [ "212.12.50.158" "192.76.134.90" ];
+  networking.search = [ "hamburg.ccc.de" ];
 
   systemd.network.links."10-net0" = {
     matchConfig.MACAddress = "BC:24:11:37:F0:AB";

config/hosts/esphome/default.nix

@@ -3,7 +3,6 @@
   imports = [
     ./configuration.nix
     ./esphome.nix
-    ./networking.nix
     ./nginx.nix
   ];
 }

config/hosts/esphome/networking.nix

@@ -1,29 +0,0 @@
-{ ... }:
-
-{
-  networking = {
-    interfaces.net0 = {
-      ipv4.addresses = [
-        {
-          address = "10.31.208.24";
-          prefixLength = 23;
-        }
-      ];
-      ipv6.addresses = [
-        {
-          address = "2a07:c480:0:1d0::66";
-          prefixLength = 64;
-        }
-      ];
-    };
-    defaultGateway = "10.31.208.1";
-    defaultGateway6 = "2a07:c480:0:1d0::1";
-    nameservers = [ "10.31.208.1" "2a07:c480:0:1d0::1" ];
-    search = [ "z9.ccchh.net" ];
-  };
-
-  systemd.network.links."10-net0" = {
-    matchConfig.MACAddress = "7E:3C:F0:77:8A:F4";
-    linkConfig.Name = "net0";
-  };
-}

config/hosts/esphome/nginx.nix

@@ -1,34 +1,35 @@
 { config, ... }:
-
 {
   services.nginx = {
     enable = true;
 
     virtualHosts = {
-      "esphome.ccchh.net" = {
+      "acme-esphome.ccchh.net" = {
-        forceSSL = true;
         enableACME = true;
         serverName = "esphome.ccchh.net";
 
+        listen = [
+          {
+            addr = "0.0.0.0";
+            port = 31820;
+          }
+        ];
+      };
+
+      "esphome.ccchh.net" = {
+        forceSSL = true;
+        useACMEHost = "esphome.ccchh.net";
+
         listen = [
           {
             addr = "0.0.0.0";
             port = 80;
           }
-          {
-            addr = "[::]";
-            port = 80;
-          }
           {
             addr = "0.0.0.0";
             port = 443;
             ssl = true;
           }
-          {
-            addr = "[::]";
-            port = 443;
-            ssl = true;
-          }
         ];
 
         locations."/" = {
@@ -36,38 +37,9 @@
           proxyWebsockets = true;
         };
       };
-      "esphome.z9.ccchh.net" = {
-        forceSSL = true;
-        useACMEHost = "esphome.ccchh.net";
-        serverName = "esphome.z9.ccchh.net";
 
-        listen = [
-          {
-            addr = "0.0.0.0";
-            port = 80;
-          }
-          {
-            addr = "[::]";
-            port = 80;
-          }
-          {
-            addr = "0.0.0.0";
-            port = 443;
-            ssl = true;
-          }
-          {
-            addr = "[::]";
-            port = 443;
-            ssl = true;
-          }
-        ];
-
-        globalRedirect = "esphome.ccchh.net";
-        redirectCode = 307;
-      };
     };
   };
-  security.acme.certs."esphome.ccchh.net".extraDomainNames = [ "esphome.z9.ccchh.net" ];
 
-  networking.firewall.allowedTCPPorts = [ 80 443 ];
+  networking.firewall.allowedTCPPorts = [ 80 443 31820 ];
 }

config/hosts/forgejo-actions-runner/networking.nix

@@ -1,19 +1,17 @@
-{ ... }:
+{ config, pkgs, ... }:
 
 {
-  networking = {
+  networking.interfaces.net0 = {
-    interfaces.net0 = {
+    ipv4.addresses = [
-      ipv4.addresses = [
+      {
-        {
+        address = "172.31.17.155";
-          address = "172.31.17.155";
+        prefixLength = 25;
-          prefixLength = 25;
+      }
-        }
+    ];
-      ];
-    };
-    defaultGateway = "172.31.17.129";
-    nameservers = [ "212.12.50.158" "192.76.134.90" ];
-    search = [ "hamburg.ccc.de" ];
   };
+  networking.defaultGateway = "172.31.17.129";
+  networking.nameservers = [ "212.12.50.158" "192.76.134.90" ];
+  networking.search = [ "hamburg.ccc.de" ];
 
   systemd.network.links."10-net0" = {
     matchConfig.MACAddress = "1E:E0:4E:D0:DA:BE";

config/hosts/git/forgejo.nix

@@ -12,6 +12,7 @@
 {
   services.forgejo = {
     enable = true;
+    package = pkgs-unstable.forgejo;
     database.type = "postgres";
     mailerPasswordFile = "/run/secrets/forgejo_git_smtp_password";
 
@@ -45,9 +46,6 @@
         DEFAULT_USER_VISIBILITY = "limited";
         DEFAULT_KEEP_EMAIL_PRIVATE = true;
         ENABLE_BASIC_AUTHENTICATION = false;
-        ENABLE_NOTIFY_MAIL = true;
-        AUTO_WATCH_NEW_REPOS = false;
-        AUTO_WATCH_ON_CHANGES = false;
       };
       repo = {
         DEFAULT_REPO_UNITS = "repo.code,repo.issues,repo.pulls";

config/hosts/git/networking.nix

@@ -4,30 +4,27 @@
 { ... }:
 
 {
-  networking = {
+  networking.interfaces.net0 = {
-    interfaces.net0 = {
+    ipv4.addresses = [
-      ipv4.addresses = [
+      {
-        {
+        address = "212.12.51.136";
-          address = "212.12.51.136";
+        prefixLength = 28;
-          prefixLength = 28;
+      }
-        }
+    ];
-        {
-          address = "172.31.17.154";
-          prefixLength = 25;
-        }
-      ];
-      ipv6.addresses = [
-        {
-          address = "2a00:14b0:f000:23:51:136::1";
-          prefixLength = 64;
-        }
-      ];
-    };
-    defaultGateway = "212.12.51.129";
-    defaultGateway6 = "2a00:14b0:f000:23::1";
-    nameservers = [ "212.12.50.158" "192.76.134.90" ];
-    search = [ "hamburg.ccc.de" ];
   };
+  networking.defaultGateway = "212.12.51.129";
+  networking.nameservers = [ "212.12.50.158" "192.76.134.90" ];
+  networking.search = [ "hamburg.ccc.de" ];
+
+  networking.interfaces.net0 = {
+    ipv6.addresses = [
+      {
+        address = "2a00:14b0:f000:23:51:136::1";
+        prefixLength = 64;
+      }
+    ];
+  };
+  networking.defaultGateway6 = "2a00:14b0:f000:23::1";
 
   systemd.network.links."10-net0" = {
     matchConfig.MACAddress = "92:7B:E6:12:A4:FA";

config/hosts/git/nginx.nix

@@ -34,10 +34,6 @@
         return = "200 \"User-agent: *\\nDisallow: /*/*/archive/\\n\"";
       };
     };
-
-    # Disable checking of client request body size to make container registry
-    # image uploads work.
-    clientMaxBodySize = "0";
   };
 
   networking.firewall.allowedTCPPorts = [ 80 443 ];

config/hosts/hydra/configuration.nix

@@ -1,9 +0,0 @@
-{ ... }:
-
-{
-  networking = {
-    hostName = "hydra";
-  };
-
-  system.stateVersion = "24.05";
-}

config/hosts/hydra/default.nix

@@ -1,11 +0,0 @@
-{ ... }:
-
-{
-  imports = [
-    ./configuration.nix
-    ./hydra.nix
-    ./networking.nix
-    ./nginx.nix
-    ./nix.nix
-  ];
-}

config/hosts/hydra/hydra.nix

@@ -1,15 +0,0 @@
-{ ... }:
-
-{
-  services.hydra = {
-    enable = true;
-    listenHost = "localhost";
-    port = 3000;
-    hydraURL = "https://hydra.hamburg.ccc.de/";
-    # E-Mail configuration requires some work/investigation still.
-    notificationSender = "no-reply@hydra.hamburg.ccc.de";
-    useSubstitutes = true;
-    minimumDiskFree = 8;
-    minimumDiskFreeEvaluator = 2;
-  };
-}

config/hosts/hydra/networking.nix

@@ -1,22 +0,0 @@
-{ ... }:
-
-{
-  networking = {
-    interfaces.net0 = {
-      ipv4.addresses = [
-        {
-          address = "172.31.17.163";
-          prefixLength = 25;
-        }
-      ];
-    };
-    defaultGateway = "172.31.17.129";
-    nameservers = [ "212.12.50.158" "192.76.134.90" ];
-    search = [ "hamburg.ccc.de" ];
-  };
-
-  systemd.network.links."10-net0" = {
-    matchConfig.MACAddress = "BC:24:11:45:7C:D6";
-    linkConfig.Name = "net0";
-  };
-}

config/hosts/hydra/nginx.nix

@@ -1,58 +0,0 @@
-{ config, pkgs, ... }:
-
-let
-  domain = "hydra.hamburg.ccc.de";
-in
-{
-  services.nginx = {
-    enable = true;
-
-    virtualHosts = {
-      "acme-${domain}" = {
-        default = true;
-        enableACME = true;
-        serverName = "${domain}";
-
-        listen = [
-          {
-            addr = "0.0.0.0";
-            port = 31820;
-          }
-        ];
-      };
-
-      "${domain}" = {
-        default = true;
-        forceSSL = true;
-        useACMEHost = "${domain}";
-
-        listen = [
-          {
-            addr = "0.0.0.0";
-            port = 8443;
-            ssl = true;
-            proxyProtocol = true;
-          }
-        ];
-
-        locations."/" = {
-          proxyPass = "http://${config.services.hydra.listenHost}:${builtins.toString config.services.hydra.port}";
-        };
-
-        extraConfig = ''
-          # Make use of the ngx_http_realip_module to set the $remote_addr and
-          # $remote_port to the client address and client port, when using proxy
-          # protocol.
-          # First set our proxy protocol proxy as trusted.
-          set_real_ip_from 172.31.17.140;
-          # Then tell the realip_module to get the addreses from the proxy protocol
-          # header.
-          real_ip_header proxy_protocol;
-        '';
-      };
-    };
-  };
-
-  networking.firewall.allowedTCPPorts = [ 8443 31820 ];
-  networking.firewall.allowedUDPPorts = [ 8443 ];
-}

config/hosts/hydra/nix.nix

@@ -1,10 +0,0 @@
-{ ... }:
-
-{
-  # Allow Hydra to fetch flake inputs.
-  nix.settings.allowed-uris = [
-    "github:"
-    "https://github.com/"
-    "https://git.hamburg.ccc.de/"
-  ];
-}

config/hosts/matrix/networking.nix

@@ -1,19 +1,17 @@
 { ... }:
 
 {
-  networking = {
+  networking.interfaces.net0 = {
-    interfaces.net0 = {
+    ipv4.addresses = [
-      ipv4.addresses = [
+      {
-        {
+        address = "172.31.17.150";
-          address = "172.31.17.150";
+        prefixLength = 25;
-          prefixLength = 25;
+      }
-        }
+    ];
-      ];
-    };
-    defaultGateway = "172.31.17.129";
-    nameservers = [ "212.12.50.158" "192.76.134.90" ];
-    search = [ "hamburg.ccc.de" ];
   };
+  networking.defaultGateway = "172.31.17.129";
+  networking.nameservers = [ "212.12.50.158" "192.76.134.90" ];
+  networking.search = [ "hamburg.ccc.de" ];
 
   systemd.network.links."10-net0" = {
     matchConfig.MACAddress = "2A:A5:80:C3:8E:32";

config/hosts/mjolnir/configuration.nix

@@ -1,9 +0,0 @@
-{ ... }:
-
-{
-  networking = {
-    hostName = "mjolnir";
-  };
-
-  system.stateVersion = "24.05";
-}

config/hosts/mjolnir/default.nix

@@ -1,10 +0,0 @@
-{ ... }:
-
-{
-  imports = [
-    ./configuration.nix
-    ./mjolnir.nix
-    ./networking.nix
-    ./sops.nix
-  ];
-}

config/hosts/mjolnir/mjolnir.nix

@@ -1,36 +0,0 @@
-# Sources for this configuration:
-# - https://github.com/matrix-org/mjolnir/blob/main/docs/setup.md
-# - https://github.com/matrix-org/mjolnir/blob/main/config/default.yaml
-
-{ ... }:
-
-{
-  # Allow deprecated, apparently somewhat insecure libolm to be able to update
-  # the moderation bot.
-  # The security issues aren't real world exploitable apparently:
-  # https://matrix.org/blog/2024/08/libolm-deprecation/
-  nixpkgs.config.permittedInsecurePackages = [ "olm-3.2.16" ];
-  services.mjolnir = {
-    enable = true;
-    homeserverUrl = "https://matrix.hamburg.ccc.de";
-    managementRoom = "#moderation-management:hamburg.ccc.de";
-    settings = {
-      verboseLogging = false;
-    };
-    pantalaimon = {
-      enable = true;
-      username = "moderation";
-      passwordFile = "/run/secrets/matrix_moderation_user_password";
-      options = {
-        ssl = true;
-      };
-    };
-  };
-
-  sops.secrets."matrix_moderation_user_password" = {
-    mode = "0440";
-    owner = "mjolnir";
-    group = "mjolnir";
-    restartUnits = [ "mjolnir.service" ];
-  };
-}

config/hosts/mjolnir/networking.nix

@@ -1,22 +0,0 @@
-{ ... }:
-
-{
-  networking = {
-    interfaces.net0 = {
-      ipv4.addresses = [
-        {
-          address = "172.31.17.161";
-          prefixLength = 25;
-        }
-      ];
-    };
-    defaultGateway = "172.31.17.129";
-    nameservers = [ "212.12.50.158" "192.76.134.90" ];
-    search = [ "hamburg.ccc.de" ];
-  };
-
-  systemd.network.links."10-net0" = {
-    matchConfig.MACAddress = "BC:24:11:C9:F8:C5";
-    linkConfig.Name = "net0";
-  };
-}

config/hosts/mjolnir/secrets.yaml

@@ -1,233 +0,0 @@
-matrix_moderation_user_password: ENC[AES256_GCM,data:NXJrbRh0A+NQh6Jy9iVAfYhsGR1BSOSuk1LjmArSiVF6jnuJAP9f750cRP7bu7Ai8xgxTlhjAtv9ck6SqlJ6Vw==,iv:IN/siIPCFKE+Nfl/aogYRYAHVgEGhMtTbmEZKZWQYgM=,tag:xxlnl5GU+uusSeh1OvoU1g==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age1ej52kwuj8xraxdq685eejj4dmxpfmpgt4d8jka98rtpal6xcueqq9a6wae
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZTEhUMThoY3Nuc253NnBX
-            ZkplNmRzOGZFNWlQNDVpL08yRk5VTHZDUkZNCnIxMUJoUHJBYlJpbUViMW9GUmhR
-            V1F6SWh2NjRGWk9RWjMycGZYZXFZbkkKLS0tIE5MNk0xekwxY0NYYm9mc1ZGZFlH
-            NDN2dUpuQWFFMTZQRzFIS0ZieTRzQm8KUDRpPJwcWwePKMp6KQMnQLhqqyvuhgQh
-            rXpKW5fjxyT0Sh2u3FM2ET/9U0TUfpBVYBJojAJBFs1ntI8kFmqSYg==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-06-20T20:02:16Z"
-    mac: ENC[AES256_GCM,data:5BhSo3YpF3QNqgGnx6YnymaEQB6pchMhokaJqk4rHg22xhbUAzOhWg4BQepT7vrCQlfOZIq4o//dGO+NQxqliiyyywrSYm3CBWD4xfZ9cdfinHC7Pc9lj6Dd4uPNxRjgTRNFuMyC+ATIABI2mHKpg+T2bxSalroIlvNr4vXWZo4=,iv:yPHJZ5PvI5zJlQIMRdbJ6eKGe1xN+teKF5GluD2pyK8=,tag:s4hO9RCdkHDsQ1W+KfXq7A==,type:str]
-    pgp:
-        - created_at: "2024-06-20T20:01:32Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAxK/JaB2/SdtAQ//Y/GVthqtuK7bY8Ne5CNfn/CD1RUTdX1+KwX1zy3YsgUC
-            CGxhoFFy1UoXR3QB4Hxnk8R/vaFVHezCWKWY45MAuPtwM1VGwjVsuknrJnSs8k7/
-            jrzVO9xXgTd26H6DLmPVfH1hKB0/lh84hwVgF5rlPS/P7l92LL0hDIIwZz3dB0kU
-            d6jLa1Fajqd4MSdLWbZRBPcioC5v1Ip/SXYAJp7IGLDgXm5MN+MnAdybAFsl1K5p
-            dCUmGqK5IjyPVP564TqL0ZEIXMxSSwex47in3cTYPaOO0L8P3kbKDNWxZQLaqZkn
-            4RZC4/aBqlfD2STxMez/ksi6kCcPuC7UPRzuq4oH3kOcJHxwIN8Df+DZYA4PJKsl
-            T9QDL1EylHBhsPIZCoxpmnGl3j+hVmONj2V1awlCaOagbgDlClEUEMyw7QCVVbtK
-            CW4DOgVnnTxcUaLHep8BgHxKkYjIDIbDMmg315h2ekT86gGgZavL8IiFTWSLzSrK
-            XChIjUdjpKZhanmSWpj4w8ZpdGOOjernL2EBWtSC23AibBZmQe9OB/QzMpLTdCvV
-            9t9mMoSayP61oJylBtOKhDnEW0Xib0U7tqzwpaow2V+CU2dr27qie1jh5GqMaoJR
-            qpu1KT3Z9eqpF3Dl8aI3dEovbmvDMVXErU3pmFu2zRJtm6TOXp4NNOYWCetUfxPU
-            aAEJAhCFerTI/ow/LWkCQ78cCMFjgKrYabA3lHu11Mr/PiHirwJ/vCmsUMiOhdRw
-            49lsyqJlO3IA79yW4exG5tYXvPgeJMTdz36fseUEKsewfrPEqMUa2T4onet2+GN6
-            GALPdepytjg+
-            =v+qv
-            -----END PGP MESSAGE-----
-          fp: EF643F59E008414882232C78FFA8331EEB7D6B70
-        - created_at: "2024-06-20T20:01:32Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQILA6EyPtWBEI+2AQ/2L7fbbhBH3BfgD7IbgtVn+nEhNJw5tWR2+0z1k72TIr9j
-            rPAvV6NQY8oVV2+uNLa4fMl+ueqYTFd3/E4IsRXkmexjx+vos27LjDNSu6w0OPJU
-            BSq5TFqZWYIPiWaivQz4+rt+vbxvpv4Lh3FAXlV9YubprJ4GRrlwyheve/l3F0BN
-            3vCDLsfXijZjxaptb9nf7WiT9vvWrY0sD4g71ARZdWi7Lb+TgCxzbQMue+4VC0Zu
-            y/AWIymVo13BD+apoYltVYYvkn7yz3REzsx3NN4bkJyoCAevr6UeO2fGvlT7b7eG
-            F7CN/TusFlOqWV9M0VbiOGLfL7Q9tGAG3xDAyFh+yMQNadp0M3m9UiYUlHps5DRT
-            CVsIPnPUr3V/oycRm3s+UeVyBg3rpdzWyNtETOjNY/AqVmRQ0toqZOm//ZOg609U
-            6+EX1Oc/GosfNoHWJuFmfKJRhPpy2gXZX2rQuLWaVJUXzzKM5sbLnycCV03S24PU
-            Fi7Z5lIu334QTLG8PV6agO5UprZb946qPmW+b/QnUol23XXcgh1GIgMV+lEK8+83
-            UPT0aUkdtOTaKbWUg5xokx+0Ni9syJ4Nl7naQq57qOGiecMnBbeE3TYxaNOcjTBh
-            CY0/hdcrZYH6VPeDye4yghSDF9WCaNUvzZNePGzdqKK3F9O/NmBSiYd/cToyDdJe
-            AZMZCKxSw0/HyBqTRd3wC/VhC9uO2I4HWE3LuqBPUXYFWc4W1buJs+P8pFjqT5rZ
-            puHPH8IxIeIiVNO5SFhdL8ecSu/nawakvih65aMGSa102e6B2HfP6tD4SmarmA==
-            =tr5G
-            -----END PGP MESSAGE-----
-          fp: F155144FC925A1BEA1F8A2C59A2A4CD59BFDC5EC
-        - created_at: "2024-06-20T20:01:32Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAz5uSgHG2iMJARAA02rGmKxyQkvxoXM1i2dLOiH6Gw/pUcdDxYSwKfdkNU3X
-            zc0He4FNG8CAURVq5jARD066VecamkBmlr+rwFJlaeqDPEiITfkz7DEGO8pPxKG0
-            GBnFVA9r/+OU351yLjHYB+72jvw1ey0PPHvKg6/sKjovssYvQLipUcktH33kPqVQ
-            yJzuQWFMWA7Jn/wTa/TP/53o0e//Kw9df69J3BSmnw9F6rKHGsIXLBmyR9HpQsLR
-            KAuClMzjPqHszCICND7vUDEzUvCcOVyizZAcRzWfDi/llwKGUanvEGUVXvyDXw/E
-            Q/FyR+VJXCzRlhsFTTuavjy6nhDsRf/N8N0Vsd9euDXOPQ4wuPAgpvdi58CPBmzP
-            8jU3xpFSXStYBIMt5u7t+UJT4IwdbjnClyIrSuyaV/7N5UQdYTv0fBy1mRrYLBAj
-            VhlRDa1y79n22Kg8mvDqJ16rC3VypkkQ6DaPvyDwlrG8iRLG/xi3Zz8HHnXxAGAm
-            SzliIolwEDHJZHI9ZE3YzpFJkB6UyOpXS1zMsDycupFvQ4jd2fQ0C7w5OaJHCkeQ
-            3zTKgtufjJGo7R2Nf0bTWTfi85GU3jpMsOHCEcChgBVXcO32ZZ/zzmqtXa/u3m5v
-            sjUstyBXEmG9eyIaiEtRAMAblwRsJPMszLaCUuBpzQw+mm9uTCsIaf5Xdud7GFzS
-            XgH+whlmbv/UeUC7bo65uxrG8SgTVAaPZpcQ2dP3rXYs45zYmYGKJaZuW+Hrl+nZ
-            pd6zT6rb6R8TMmXkNA1TjhvZ/A+ONlza1fH0dmsh7U9oqINXNFJU7Qm2r7imFvg=
-            =ZIDr
-            -----END PGP MESSAGE-----
-          fp: 18DFCE01456DAB52EA38A6584EDC64F35FA1D6A5
-        - created_at: "2024-06-20T20:01:32Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAw5vwmoEJHQ1AQ//f51KkC9oViW/0EA0TLdWgXa76ZXMeu4b3UhWaQvYDT9+
-            8wuWE+slGEWsRnFZ+pgWZoV3HIv2p+xisX2lmBvepOufaRh6cyNpQaZNl0kFtpBo
-            ShQ66SmkorunYyM+OIh3ceI4PC7ca4KsRKB8nWkA935NWssFN9zMlkVW6GjqzTft
-            2JVJFL8GRlhIRMhJwSzp8zZ3XiYD0sB/2y+ffCMAOSCnDVcDjANyiSds6MPxfPy0
-            /kaNTXuUI7H50tHQP6vzJ3q1mRpAhUTIxubnmBTdvAQz/kaD0qPt55z+Q0xSXsLa
-            yfb+Zd2g/2o+IFiCrwqcki5yX49Ol89l69JRyIWe1T2VtqBSUVIiiYreX5OnmWPQ
-            OjJ1mAn9tpIlVSHzlaONtmJEmAJ+n55rP0itBMs1CrIBiQleLaCbSWqp6q3RfaJr
-            gpXnfHQpsU7cKEDQeyvxmH8qgrSR9AVh/knyGOJy8LnJQ93aQpr3xr/2MiFPYiKz
-            dcSrxHesrfx2Zl7bNB5OZ7VZTWFSunZQUnOn3F3+7yaaT9ePsvWsyTKBOSGUiA7s
-            VMxT5+P8QM6UOC8KxJj/q1eAVrWvN7vYbCA25+SzbdTtr1RweOVHzNgqZH5/Q2ZY
-            fguwHlCGg5Q7UKYKBk4QJFg6oClDgzBYCFL76K4aymtR7rxKl4sJxWoug84oP6DS
-            XgEZvNS3xsY8Pxm0bAmor93Q08Mii1svnNZ74Eqmbo9GxBjHReIGKDDZ08SaPhbc
-            NJxAP2C2sRUda2R4GvsNYmXHzGYfFTrfe+AXqEV42ZSD9vHDJMCiX9JrY/r4uSM=
-            =+F4l
-            -----END PGP MESSAGE-----
-          fp: 87AB00D45D37C9E9167B5A5A333448678B60E505
-        - created_at: "2024-06-20T20:01:32Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA4HMJd/cQYrVARAAq/cP9y/7kxSXDFOD/xhI/3RjGzIN5dyHlfrmEQWJ8J7z
-            ov0VfBCJp6gFht37dGWuLtWi1qqWRgN+9hiBnkj2zONoph0SRGP9uNfadBSzYSD4
-            wvlOFrWeM9cswnk4i0q8Go+qdCC6U0g1szjirdifF7I9KdqKpOFwXzjnzsPTF42o
-            9oFCP32esOYv++DfTBgrSv8/STublJYABcs+lzjvURqBsFvdz7PBphH66++yxt7v
-            bTTmu8O9WHC8/5QTfUzOBAfgyu4CwF3YLRZd81ERtzO/udNYgGO3bifofCfpv+nY
-            MMyCbGxoiAfBWcAHhka+8nMnBj0as+ln220O99N6zH1rTmqqDxRQkEiYek1MqEU1
-            f319u3KqB6STWmZvjlwQ5AhwSLCLT2VpIJX4CpMClWlLb3E2rpZ+B1uBRMQQ3fMe
-            jSynatL2vXn3rKWzxIEIxA/BkVKQ8zXgOT9JyqyCZdHTvjEmWuQitILi7wKWJb7/
-            qhTGEBoQbjIKP2Bpso286RKhS3erE0wqLeXXFb7e6bkEEHXa/jVHCZk8/qDcAAIB
-            3eIb5SNnLxQwo07JlWdDPzCvqeC4fx5AWxXmHsKWI+91PA0jdNjcEPt2sxwAEQYq
-            LWBW6BL22Hqo/VOBXhM1T5mFKomqySLSrxTYeWXtJLZwh0aHbm6RyGGMjHpCiU3S
-            XgE8EQeKefLHoTixb1Rl/amIvtOUUcTtdqlyat9hhIdMl/7ZMesmNuD1ZsEzdCJd
-            20/DgHzFE7WvZKrjt73GDETUjwLHZSl5fydQMgcNFgzU2mdV6nYNhF18gE/af74=
-            =UA8K
-            -----END PGP MESSAGE-----
-          fp: 91213ABAA73B0B73D3C02B5B4E5F372D17BBE67C
-        - created_at: "2024-06-20T20:01:32Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAxjNhCKPP69fAQ//RVzQX4Ua5XZHTIe7ffYiqMxy/KoJdbCxpgjbdD0sx2ou
-            zCB13t13UkLjLo5GkTE7kRGtyKOdhQ/7NUA7tOZ+rwWOq3NehOTLfU0wMkgT7tOh
-            byWwNHrY9VHz3ndFnya5nNcnrqILA1rEn32PnioNyWcU6832jyUWvtRqwF+JRrKr
-            yRJMvz4T8vmLwrxqarB1uqU0OVHXy8bq8d9/pVrAmk6+C/H5FINFlApD0dKYftd2
-            phoTSA5WG8j1e0v5p4+r9cRHlYXFMinMMkpzD/JMyNB1WVZ9aGQxU7WiuYzuv1bh
-            PKN/LEgfh3ypI8W960NHv/OMRjVs/VxA+G3ml3Lw6acRnaLr++MhF2G7ZBTx8rgi
-            fjyF6m4XtacwIKYZ7SNt9eQewGI8VU30o8np33qb9KeOt7v8PrMH1G3X+bTLnJGw
-            VjxjvaBaePmPplYYS7xaPuUnzFNabDXTE8XCQpdJMy26ef77gaWr6TQwXbRlZXrx
-            S60EecMLwUj+daR0PkVBkCDxXkW8+0uPkt6EEn5rmPdMXoh4DUw+4A14t7yyUU50
-            j3M9tv6DuYs/KhgZYfLe+6hVD7fY4lAs5Ge6QGLA/TljAatE3zpSZQK+b7C4HKJS
-            3eRpcAt6CJFhXaCBwl4+gigrg3voX1ykh62oqY/4ecKbAiiVXLIrcflv9kx2Ht7S
-            XgEDhoIRIvXoOUy6j/qjp/OFxwu5y6MpBX4vHxlpL36daL2yShMkCYyY3ajea4eX
-            9k7B9fpRu3sjbDTNr1heffI+5n/HKc8j9a52hzu5eF0e+v+vKY32uk1jlUhZdj4=
-            =R/pX
-            -----END PGP MESSAGE-----
-          fp: F38C9D4228FC6F674E322D9C3326D914EB9B8F55
-        - created_at: "2024-06-20T20:01:32Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA1Hthzn+T1OoAQ/+OHZshi2zBfbVQ91WKLqei7bT4CZGiPxQsl7aogv8JkyL
-            D8p+VgIReMvq4F5QFaIsA8yqMSnjxfIi5bFd9SKjuhOKvuQjyh1rSsFb0t8ESuYi
-            fHBnVw4tDNfTEGQa9YhNJPTq60TwR4P2xYFEgc//AQqfs9XH0cTbvkFS9dkug092
-            u4yJfB2aZEJa0Eh0AenUYzP13bFH0sJwL1hQop1v9gF44JeKHpRNd0Yixlp0Yucs
-            Ccww+WaNFVQ4+zvyW7MnI8/D27/SQGRXXqQE6sOQlsg5SUzF2vIpYbIeuu1NR5WK
-            v1ZB0DlWVuOshIB7M9WUCZcAS5cMAWKc1vvZ/K0l+6tNskZvGE4p/lv1bmZ5zfc3
-            gT/2L6ENuoKW7RoF071SsG9Xn7VJync+iNTtg0m7Je7HRAZAGGc8vfIkrTXAmoIE
-            QkGuog0R+EZxq9L1WMbppV/bnbBxiutFxwWOGTxzsn+DksVrVLvyI/EbHJvcEwzN
-            hISPFmAiCEKzGAGfaO24F5Xcs+U6AgumS5V5kwY6zA/kZpJEdQm38rcC12ZpXR9C
-            oHGs9ACtgf+g8H3/Ks5DL48FTbYuZADamVA5+pV97B7xCS8TxYChuFNPLwU2s52G
-            liiZV9NevlFlbsXFZS/EWgR8b0aH9Nhjl5TAPOajBOu0Nm/83XEP9nbbbjJjGRHS
-            XgHop/OMkJRuZZ35JQjUS6dIBzSivqplpr51wHbyilxbvOHdvuu6w9kqGY9VhuVt
-            nCszg+IQ0SM8YFuu1M5UPO4txYQTHx8zO5SD/d8kh5HEu9fmTNyJXblRcyAzYZc=
-            =TxDz
-            -----END PGP MESSAGE-----
-          fp: 5DA93D5C9D7320E1BD3522C79C78172B3551C9FD
-        - created_at: "2024-06-20T20:01:32Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA46L6MuPqfJqAQ//co7jg6v5QUB7eHXJPMLxsgtbC/VYp7C7QqXQda5qhohW
-            t0F9lysBybhIGoYuvfZGzNMYqqkVpFxzlOO2vFlcYFsQhjCpJrHBWYT4XOmIBR64
-            6Az/iKqNLS+cG+rFIIuc8BqRk3r4lrM32dCqz0a+3qRkdmbff4yKuzg8FTPlv1RI
-            O9SzRqfptcKDXItnQF+8CAziqcGyy4jL2wnl1Q2I2Pksr+Zw1eZVbFfHmCpG7A5C
-            TVihozz51jeXlggDp9/NPJOQDsmV+KdpvNx2Eqj6PQ6aGWtyYv5YZG3X/eRKW90+
-            qUOJxwpW5KGcROnuvQt1AggcXquOTLHFyJ85M8tpJcl+JYVZsIeNDo+LO8sbrCTA
-            cjp/YSLOms+GullbGAwrJh4TYtwJE9sEKr9OAFUvd+AxVFWj08BqMe1eN5YBbwwB
-            vNurVdvjE8jaTCmZgPPOIP5KXSrsG8bA02YlZ4MnzodYidIhTudJ8VB4NYCtNgOL
-            G/x7h/KA5KYgDWEtr21z2oy0QkGijtrcNa02GpslirjufZ6TPGCbJjAeEsPbYBm7
-            mDXm5+PzZpb1pbcSVNlVG5Ry73JrZxBpYCPGnxLs5yAmWOlNa/xcgDHBU+iXyVg0
-            Wm8pHRAVNfbvL7NB8yeaxSDoTSE7/BsisL6tUHoV+bdlpVsTF26bQZBc/zhxiZrS
-            XgGJ8ChRZbpi2qUzP4nA2jPkYtQ4cquA+ftDx4i+ZqVNtAhVSnTiBZoYu/21+BUB
-            oxDa5m2vD0s0t0fGfmmIvpLZKZIF7NcwnCdNVQve/D3qNNa4T3YnXb8JTGH0PYc=
-            =mu1s
-            -----END PGP MESSAGE-----
-          fp: 8996B62CBD159DCADD3B6DC08BB33A8ABCF7BC4A
-        - created_at: "2024-06-20T20:01:32Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA4EEKdYEzV0pAQ/8D4mAcC6vsHLkSryz1yIYoBqqtJnG62pITFEbafhVLR6V
-            nWAw/zP9DqNj15MsrM67xaQxlMVgkVM7QTchgp0CjXsyZ/gWPgDl0NaC92Uj93Ov
-            Gi2OpkfHQFaAW6JsAFl5NrF0ZBw/flx8X0l2klIxBV+ztpkLADEtXWsoGsmz5L4m
-            n41icEp9+nb9nwy7p+Je0s4jZCBB0sVlbkX9i4IpMOgEhA0HcWemc940VJp3UyRg
-            LkOs5C0J4Y4qjS12248y16gV/IhNaJ4PCPgVwSj1Xzz6VXauQosmWhnUbnqJbi3F
-            KWEV0IJJO+dlj5VShzFDnkN2bM1GeyQx1S+FkNp+Mmm6JNrUK+CZL8fUYka06O0V
-            DD/sg1Pyq8VawNG5RxwAWA5F1F1SIrJzF0T4HyIN1UFRCjWC466sdrBTQLtx472k
-            NdBCvabHS/bx5miPKF5iglJYzz4biUdevc3EU7q4hwgMYM2oep3m2EsaTbKWzjnY
-            PLB4d0bCsRlya0YfHaFX5f3xSNb/FzBcUlTHzX2asyB2DolMug1VqS3jCEkWGbk/
-            vfNfR5yRuwkwNlJRqHbGIfH7fYEgwSTW+VW2iUdY7Dra7xjgTzqZgLi5W8QwKJqq
-            1V5H4KlRQNYwloVJzQZCwoPcY+tBfTZ4LsDKtjyJzFY9vdTGGGqb9lAG7YBUdubS
-            XgE72UuZvbPQZuI7uVKMEORGVssQjwZFhs4InR/Ixe03a7hb8fdRHfu/ueS/3KQx
-            mRXVino/iVQ6M936mtibfeH9TpBpjqH8sBKNHv2hgnoap9QpkrVn1yWqrOcpht8=
-            =+sXL
-            -----END PGP MESSAGE-----
-          fp: 9DFA033E3DAEBAD7FDD71B056C7AAA54BE05F7BA
-        - created_at: "2024-06-20T20:01:32Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hF4DQrf1tCqiJxoSAQdA/tIZCvQv0E4dHN5jBHsAGclKEeLFhyf4lIQx+xa+uwQw
-            /VGCdNT8U13EawRC66KLXRrRgsNPpwUg15wAoTzQ8gW/tLpgvL5nsEYPfaowYwBD
-            0l4BmNV4o4J+NHF7Tk1af2kx0pp6kF9eJynn6irr336tGzY004lZfZlqwgeOk+qN
-            93XcSfdAOlIktfex1q1oTPrSpGIv32zsLPoRNVa50dO+IKu1tmYAxi9N9sQgbWa4
-            =rnF9
-            -----END PGP MESSAGE-----
-          fp: B71138A6A8964A3C3B8899857B4F70C356765BAB
-        - created_at: "2024-06-20T20:01:32Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAzdAjw8ldn6CAQ/9HNG41mTgq8VavF9DBX7+upnsmoDtwblck18l3rurJ1mo
-            k2ki7tWwIxRyLLHtsUxJ9S55cmXuhhPJK8Kzc32SnY5irDkqK/4JZnDvofg+z68B
-            8pQOunN1BQp50k8vd4Mha43re8s24iqrM+fj59uHM2YYsQYt9TCR/NvUopOdi6l2
-            8OnKI2KdRvYhtzzCY3wmQKhG7p0hc8y8pP/0DmPW5IGQ6OP4zO+Qnc4EbVnA9Uhr
-            tZ4sTNn0o80kfvILKANkAm81v86KdSRXdd3+1IpH1c7rTqm9o+DEm8nKnwWOF63O
-            P0klsYLlfqiZyQ0AyS67RHPTw/y57mAyWVFbABDLtXQQHWcIkADMLKTJLpnhKkRn
-            Cp94EXBBBwViAUBUzzskE4lgKXncl1h5ogLum8btU+cLky0qa8Hzie5QqszlErf8
-            fci0AEHV8u+Kf5EARf1FiY6K2aVnFOJchdeL98qllwRu6f8zz7+bfLq1UXcGBlQS
-            JnbAlXiL4vEBxQyW5awYYzpaMUTW1ejjujZUitdaUeIQJdv/IJvHe9y6/F0uukdt
-            AMrDI7E+JKa6hLPe4g6H1hUzh6GcaHuNU9z2NSDfzxcOHkqALsCDLVDxsjPhahCc
-            UZkSn8ebyqv7/jpTgWnsls0Fx8XqvKKJNoqXfK81oIvWlJsEwqSaBczkq9HQbO7S
-            XgH2N8XPOJWmqDc+xS26eERNJ8ZlhYaODWwatgqt2si6EdBpVRZL4PXsOrOlI8Xi
-            Uaag1/Uljqbk5mN18+CtSfSt0ded79d44B9zAbc70hgvkRrpcotDBnO8YQ9MxB0=
-            =O0Sg
-            -----END PGP MESSAGE-----
-          fp: 3D70F61E07F64EC4E4EF417BEFCD9D20F58784EF
-    unencrypted_suffix: _unencrypted
-    version: 3.8.1

config/hosts/mjolnir/sops.nix

@@ -1,7 +0,0 @@
-{ ... }:
-
-{
-  sops = {
-    defaultSopsFile = ./secrets.yaml;
-  };
-}

config/hosts/mqtt/configuration.nix

@@ -1,10 +0,0 @@
-{ ... }:
-
-{
-  networking = {
-    hostName = "mqtt";
-    domain = "z9.ccchh.net";
-  };
-
-  system.stateVersion = "23.11";
-}

config/hosts/mqtt/default.nix

@@ -1,9 +0,0 @@
-{ pkgs, ... }:
-
-{
-  imports = [
-    ./configuration.nix
-    ./networking.nix
-    ./mosquitto.nix
-  ];
-}

config/hosts/mqtt/mosquitto.nix

@@ -1,33 +0,0 @@
-# Sources for this configuration:
-# - https://search.nixos.org/options?sort=relevance&type=packages&query=services.mosquitto
-# - https://mosquitto.org/man/mosquitto-conf-5.html
-# - https://winkekatze24.de
-{ ... }:
-
-{
-  services.mosquitto = {
-    enable = true;
-    persistence = true;
-
-    # set config for all listeners
-    listeners = [{
-      settings.allow_anonymous = true;
-      omitPasswordAuth = true;
-      acl = [ "topic readwrite #" ];
-    }];
-
-    bridges.winkekatz = {
-      addresses = [
-        { address = "mqtt.winkekatze24.de"; }
-      ];
-      topics = [
-        "winkekatze/allcats/eye/set in 2"
-        "winkekatze/allcats in 2"
-        "+/status out 2 winkekatze/ \"\""
-        "+/connected out 2 winkekatze/ \"\""
-      ];
-    };
-  };
-
-  networking.firewall.allowedTCPPorts = [ 1883 ];
-}

config/hosts/mqtt/networking.nix

@@ -1,21 +0,0 @@
-{ ... }:
-
-{
-  networking = {
-    interfaces.net0 = {
-      ipv4.addresses = [
-        {
-          address = "10.31.208.14";
-          prefixLength = 23;
-        }
-      ];
-    };
-    defaultGateway = "10.31.208.1";
-    nameservers = [ "10.31.210.1" ];
-  };
-
-  systemd.network.links."10-net0" = {
-    matchConfig.MACAddress = "BC:24:11:48:85:73";
-    linkConfig.Name = "net0";
-  };
-}

config/hosts/netbox/netbox.nix

@@ -11,19 +11,9 @@
     enable = true;
     package = pkgs.netbox;
     secretKeyFile = "/run/secrets/netbox_secret_key";
-    keycloakClientSecret = "/run/secrets/netbox_keycloak_secret";
     settings = {
       ALLOWED_HOSTS = [ "netbox.hamburg.ccc.de" ];
       SESSION_COOKIE_SECURE = true;
-      # CCCHH ID (Keycloak) integration.
-      # https://github.com/python-social-auth/social-core/blob/0925304a9e437f8b729862687d3a808c7fb88a95/social_core/backends/keycloak.py#L7
-      # https://python-social-auth.readthedocs.io/en/latest/backends/keycloak.html
-      REMOTE_AUTH_BACKEND = "social_core.backends.keycloak.KeycloakOAuth2";
-      SOCIAL_AUTH_KEYCLOAK_KEY = "netbox";
-      # SOCIAL_AUTH_KEYCLOAK_SECRET set via keycloakClientSecret option.
-      SOCIAL_AUTH_KEYCLOAK_PUBLIC_KEY = "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAi/Shi+b2OyYNGVFPsa6qf9SesEpRl5U5rpwgmt8H7NawMvwpPUYVW9o46QW0ulYcDmysT3BzpP3tagO/SFNoOjZdYe0D9nJ7vEp8KHbzR09KCfkyQIi0wLssKnDotVHL5JeUY+iKk+gjiwF9FSFSHPBqsST7hXVAut9LkOvs2aDod9AzbTH/uYbt4wfUm5l/1Ii8D+K7YcsFGUIqxv4XS/ylKqObqN4M2dac69iIwapoh6reaBQEm66vrOzJ+3yi4DZuPrkShJqi2hddtoyZihyCkF+eJJKEI5LrBf1KZB3Ec2YUrqk93ZGUGs/XY6R87QSfR3hJ82B1wnF+c2pw+QIDAQAB";
-      SOCIAL_AUTH_KEYCLOAK_AUTHORIZATION_URL = "https://id.hamburg.ccc.de/realms/ccchh/protocol/openid-connect/auth";
-      SOCIAL_AUTH_KEYCLOAK_ACCESS_TOKEN_URL = "https://id.hamburg.ccc.de/realms/ccchh/protocol/openid-connect/token";
     };
   };
 
@@ -31,12 +21,6 @@
     mode = "0440";
     owner = "netbox";
     group = "netbox";
-    restartUnits = [ "netbox.service" "netbox-rq.service" ];
+    restartUnits = [ "netbox.service" ];
-  };
-  sops.secrets."netbox_keycloak_secret" = {
-    mode = "0440";
-    owner = "netbox";
-    group = "netbox";
-    restartUnits = [ "netbox.service" "netbox-rq.service" ];
   };
 }

config/hosts/netbox/networking.nix

@@ -1,19 +1,23 @@
-{ ... }:
+# Networking configuration for the host.
+# Sources for this configuration:
+# - https://nixos.org/manual/nixos/stable/#sec-networking
+# - https://nixos.wiki/wiki/Systemd-networkd
+# - https://wiki.archlinux.org/title/Systemd-networkd
+
+{ config, pkgs, ... }:
 
 {
-  networking = {
+  networking.interfaces.net0 = {
-    interfaces.net0 = {
+    ipv4.addresses = [
-      ipv4.addresses = [
+      {
-        {
+        address = "172.31.17.149";
-          address = "172.31.17.149";
+        prefixLength = 25;
-          prefixLength = 25;
+      }
-        }
+    ];
-      ];
-    };
-    defaultGateway = "172.31.17.129";
-    nameservers = [ "212.12.50.158" "192.76.134.90" ];
-    search = [ "hamburg.ccc.de" ];
   };
+  networking.defaultGateway = "172.31.17.129";
+  networking.nameservers = [ "212.12.50.158" "192.76.134.90" ];
+  networking.search = [ "hamburg.ccc.de" ];
 
   systemd.network.links."10-net0" = {
     matchConfig.MACAddress = "62:ED:44:20:7C:C1";

config/hosts/netbox/secrets.yaml

@@ -1,5 +1,4 @@
 netbox_secret_key: ENC[AES256_GCM,data:7cVGSlrCo3MEjeLjfeZrL0VZi3+yZqsC3qI+rx+xadic78H0egWCCNaYEHIgtilgFjw=,iv:gnearzPduWcrVLU/FuzS05eNPZ5srX0hqZyElq+19ek=,tag:9MKgFb4eVYE6a5ncx9sgpw==,type:str]
-netbox_keycloak_secret: ENC[AES256_GCM,data:WLPCwl6KmHhyGwpqchZUmTr0XwA1T9asAEXNOSQMfGU=,iv:fsO+Ho18Uz6+y2iohbve1bUKhCR/c2zNrbODR2Jrh3Q=,tag:MWeh7GhdyUJnSzrndA3l3Q==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -15,8 +14,8 @@ sops:
             V1lQK3YzTWI5ZGdyeGtFQ0E3QXQ3YnMK8sBStC8xBKwpeWkF/HrryWi0hZA69nuw
             a73HiZuED8KEp5OPME3yC6Ode71uEEaE/av2zp7WUYbCqVpWnwcjSg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-10-08T23:54:23Z"
+    lastmodified: "2024-05-26T01:07:35Z"
-    mac: ENC[AES256_GCM,data:6KwBwJ1uTuOaCTcBs9sgvX+E/bV37ylJmDqYupa3545ba5Y3VMuF2Hx72zzRYPmh5/DmwzDxc/f7TZUheO5jwwwMGGNCYuX2c+nkzLgtovT/yCXTo8vPHNf03fQRHlOq28ztQIG8Ug1s/t4XkA+iuqPdbvyNKLbsJfJBqg4SF44=,iv:SUXPFtW3/pSTBnjAh77G6pJTucHy4VEhUVkELiMJ4JU=,tag:SfLCwPpJuvL7RrIRmN5PGg==,type:str]
+    mac: ENC[AES256_GCM,data:0zWNPrUqpuC/qXOaTE8ayrTbnZdg9VA2NqxSNnV0bogqxVkg8zhbx8OKYfNQ0DswjxKNEnKsqjp62gA678VfRfGHJU5ZoHfAC7kBbrkDy+pMzS6LRwT+7n0C1AbaaG7hienGJQsx2gUUYqu7OSQuS722lXAw65deFvZGtL6lt8E=,iv:mOLkzF5pJFazmH9XX94Hjd04FcgSh0hY4juEO3vKNBc=,tag:lSk0lnVONQCmuO0KmxlL0Q==,type:str]
     pgp:
         - created_at: "2024-05-26T01:07:22Z"
           enc: |-

config/hosts/nix-box-june/networking.nix

@@ -1,19 +1,19 @@
-{ ... }:
+# Networking configuration for the host.
+
+{ config, pkgs, ... }:
 
 {
-  networking = {
+  networking.interfaces.net0 = {
-    interfaces.net0 = {
+    ipv4.addresses = [
-      ipv4.addresses = [
+      {
-        {
+        address = "172.31.17.158";
-          address = "172.31.17.158";
+        prefixLength = 25;
-          prefixLength = 25;
+      }
-        }
+    ];
-      ];
-    };
-    defaultGateway = "172.31.17.129";
-    nameservers = [ "212.12.50.158" "192.76.134.90" ];
-    search = [ "hamburg.ccc.de" ];
   };
+  networking.defaultGateway = "172.31.17.129";
+  networking.nameservers = [ "212.12.50.158" "192.76.134.90" ];
+  networking.search = [ "hamburg.ccc.de" ];
 
   systemd.network.links."10-net0" = {
     matchConfig.MACAddress = "BC:24:11:6A:33:5F";

config/hosts/nix-box-june/users.nix

@@ -26,7 +26,7 @@
     };
     yuri = {
       isNormalUser = true;
-      openssh.authorizedKeys.keys = [
+      openssh.authorizedKeys.keys = [ 
         "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDdk3FLQRoCWxdOxg4kHcPqAu3QQOs/rY9na2Al2ilGl yuri@violet"
         "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJEvM35w+UaSpDTuaG5pGPgfHcfwscr+wSZN9Z5Jle82 yuri@kiara"
       ];

config/hosts/penpot/configuration.nix

@@ -1,7 +0,0 @@
-{ config, pkgs, ... }:
-
-{
-  networking.hostName = "penpot";
-
-  system.stateVersion = "24.05";
-}

config/hosts/penpot/default.nix

@@ -1,11 +0,0 @@
-{ config, pkgs, ... }:
-
-{
-  imports = [
-    ./configuration.nix
-    ./networking.nix
-    ./nginx.nix
-    ./penpot.nix
-    ./sops.nix
-  ];
-}

config/hosts/penpot/networking.nix

@@ -1,20 +0,0 @@
-{ ... }:
-
-{
-  networking.interfaces.net0 = {
-    ipv4.addresses = [
-      {
-        address = "172.31.17.162";
-        prefixLength = 25;
-      }
-    ];
-  };
-  networking.defaultGateway = "172.31.17.129";
-  networking.nameservers = [ "212.12.50.158" "192.76.134.90" ];
-  networking.search = [ "hamburg.ccc.de" ];
-
-  systemd.network.links."10-net0" = {
-    matchConfig.MACAddress = "BC:24:11:26:1C:8A";
-    linkConfig.Name = "net0";
-  };
-}

config/hosts/penpot/nginx.nix

@@ -1,63 +0,0 @@
-{ config, pkgs, ... }:
-
-let
-  domain = "design.hamburg.ccc.de";
-in
-{
-  services.nginx = {
-    enable = true;
-
-    virtualHosts = {
-      "acme-${domain}" = {
-        default = true;
-        enableACME = true;
-        serverName = "${domain}";
-
-        listen = [
-          {
-            addr = "0.0.0.0";
-            port = 31820;
-          }
-        ];
-      };
-
-      "${domain}" = {
-        default = true;
-        forceSSL = true;
-        useACMEHost = "${domain}";
-
-        listen = [
-          {
-            addr = "0.0.0.0";
-            port = 8443;
-            ssl = true;
-            proxyProtocol = true;
-          }
-        ];
-
-        locations."/" = {
-          proxyPass = "http://127.0.0.1:9001";
-        };
-
-        locations."/ws/notifications" = {
-          proxyPass = "http://127.0.0.1:9001";
-          proxyWebsockets = true;
-        };
-
-        extraConfig = ''
-          # Make use of the ngx_http_realip_module to set the $remote_addr and
-          # $remote_port to the client address and client port, when using proxy
-          # protocol.
-          # First set our proxy protocol proxy as trusted.
-          set_real_ip_from 172.31.17.140;
-          # Then tell the realip_module to get the addreses from the proxy protocol
-          # header.
-          real_ip_header proxy_protocol;
-        '';
-      };
-    };
-  };
-
-  networking.firewall.allowedTCPPorts = [ 8443 31820 ];
-  networking.firewall.allowedUDPPorts = [ 8443 ];
-}

config/hosts/penpot/penpot.nix

@@ -1,198 +0,0 @@
-# Sources used for this configuration:
-# - https://github.com/penpot/penpot/blob/2.1.0/docker/images/docker-compose.yaml
-# - https://raw.githubusercontent.com/penpot/penpot/2.1.0/docker/images/docker-compose.yaml
-# - https://help.penpot.app/technical-guide/configuration/
-# - https://medium.com/@social.iodols/managing-docker-containers-in-nixos-fbda0f666dd1
-# - https://madison-technologies.com/take-your-nixos-container-config-and-shove-it/
-
-{ config, pkgs, ... }:
-
-let
-  # Flags for both frontend and backend.
-  # https://help.penpot.app/technical-guide/configuration/#common
-  # https://github.com/penpot/penpot/commit/ea7ad2aaa096f8d190d740f693f22f3ed1f05088
-  commonPenpotFlags = "disable-registration enable-oidc-registration disable-login-with-password enable-login-with-oidc";
-  penpotVersion = "2.1.3";
-in
-{
-  virtualisation.docker.enable = true;
-  virtualisation.oci-containers = {
-    backend = "docker";
-    containers = {
-      "penpot-frontend" = {
-        autoStart = true;
-        image = "docker.io/penpotapp/frontend:${penpotVersion}";
-        extraOptions = [ "--network=penpot" ];
-        ports = [ "9001:80" ];
-        volumes = [ "penpot_assets:/opt/data/assets" ];
-        dependsOn = [
-          "penpot-backend"
-          "penpot-exporter"
-        ];
-        environment = {
-          # https://help.penpot.app/technical-guide/configuration/#frontend
-          # https://github.com/penpot/penpot/blob/develop/docker/images/docker-compose.yaml#L78
-
-          PENPOT_FLAGS = "${commonPenpotFlags} disable-onboarding";
-        };
-      };
-
-      "penpot-backend" = {
-        autoStart = true;
-        image = "docker.io/penpotapp/backend:${penpotVersion}";
-        extraOptions = [ "--network=penpot" ];
-        volumes = [ "penpot_assets:/opt/data/assets" ];
-        dependsOn = [
-          "penpot-postgres"
-          "penpot-redis"
-        ];
-        environment = {
-          # https://help.penpot.app/technical-guide/configuration/#backend
-          # https://github.com/penpot/penpot/blob/develop/docker/images/docker-compose.yaml#L112
-
-          PENPOT_FLAGS = "${commonPenpotFlags} enable-smtp";
-
-          # PENPOT_SECRET_KEY st via environmentFile.
-          PENPOT_TELEMETRY_ENABLED = "false";
-
-          # OpenID Connect configuration.
-          # https://help.penpot.app/technical-guide/configuration/#openid-connect
-          PENPOT_OIDC_CLIENT_ID = "penpot";
-          PENPOT_OIDC_BASE_URI = "https://id.hamburg.ccc.de/realms/ccchh/";
-          # PENPOT_OIDC_CLIENT_SECRET set via environmentFile.
-          PENPOT_OIDC_ROLES = "user";
-          PENPOT_OIDC_ROLES_ATTR = "roles";
-
-          # Database configuration.
-          # https://help.penpot.app/technical-guide/configuration/#database
-          PENPOT_DATABASE_USERNAME = "penpot";
-          # PENPOT_DATABASE_PASSWORD set via environmentFile.
-          PENPOT_DATABASE_URI = "postgresql://penpot-postgres/penpot";
-
-          # Email configuration.
-          # https://help.penpot.app/technical-guide/configuration/#email-(smtp)
-          PENPOT_SMTP_HOST = "cow.hamburg.ccc.de";
-          PENPOT_SMTP_PORT = "465";
-          PENPOT_SMTP_USERNAME = "no-reply@design.hamburg.ccc.de";
-          # PENPOT_SMTP_PASSWORD set via environmentFile.
-          PENPOT_SMTP_SSL = "true";
-          PENPOT_SMTP_DEFAULT_REPLY_TO = "Penpot <no-reply@design.hamburg.ccc.de>";
-          PENPOT_SMTP_DEFAULT_FROM = "Penpot <no-reply@design.hamburg.ccc.de>";
-
-          # Storage
-          # https://help.penpot.app/technical-guide/configuration/#storage
-          PENPOT_ASSETS_STORAGE_BACKEND = "assets-fs";
-          PENPOT_STORAGE_ASSETS_FS_DIRECTORY = "/opt/data/assets";
-
-          # Redis
-          # https://help.penpot.app/technical-guide/configuration/#redis
-          PENPOT_REDIS_URI = "redis://penpot-redis/0";
-
-          PENPOT_PUBLIC_URI = "https://design.hamburg.ccc.de";
-        };
-        environmentFiles = [ "/run/secrets/penpot_backend_environment_file" ];
-      };
-
-      "penpot-exporter" = {
-        autoStart = true;
-        image = "docker.io/penpotapp/exporter:${penpotVersion}";
-        extraOptions = [ "--network=penpot" ];
-        environment = {
-          # https://help.penpot.app/technical-guide/configuration/#exporter
-          # https://github.com/penpot/penpot/blob/develop/docker/images/docker-compose.yaml#L221
-          PENPOT_PUBLIC_URI = "http://penpot-frontend";
-          PENPOT_REDIS_URI = "redis://penpot-redis/0";
-        };
-      };
-
-      "penpot-postgres" = {
-        autoStart = true;
-        image = "docker.io/library/postgres:15";
-        extraOptions = [ "--stop-signal=SIGINT" "--network=penpot" ];
-        volumes = [ "penpot_postgres_v15:/var/lib/postgresql/data" ];
-        environment = {
-          # https://github.com/penpot/penpot/blob/develop/docker/images/docker-compose.yaml#L240
-
-          POSTGRES_INITDB_ARGS = "--data-checksums";
-          POSTGRES_DB = "penpot";
-          POSTGRES_USER = "penpot";
-          # POSTGRES_PASSWORD set via environmentFile.
-        };
-        environmentFiles = [ "/run/secrets/penpot_postgres_environment_file" ];
-      };
-
-      "penpot-redis" = {
-        autoStart = true;
-        image = "docker.io/library/redis:7";
-        extraOptions = [ "--network=penpot" ];
-      };
-    };
-  };
-
-  # Docker networks.
-  systemd.services."docker-network-penpot" = {
-    serviceConfig = {
-      Type = "oneshot";
-      RemainAfterExit = true;
-      ExecStop = "${pkgs.docker}/bin/docker network rm -f penpot";
-    };
-    script = "${pkgs.docker}/bin/docker network inspect penpot || ${pkgs.docker}/bin/docker network create penpot";
-    requiredBy = [
-      "docker-penpot-frontend.service"
-      "docker-penpot-backend.service"
-      "docker-penpot-exporter.service"
-      "docker-penpot-postgres.service"
-      "docker-penpot-redis.service"
-    ];
-    before = [
-      "docker-penpot-frontend.service"
-      "docker-penpot-backend.service"
-      "docker-penpot-exporter.service"
-      "docker-penpot-postgres.service"
-      "docker-penpot-redis.service"
-    ];
-  };
-
-  # Pull docker images prior to starting container services, so that a container
-  # service isn't considered up, if it actually is still just pulling the
-  # relevant image.
-  systemd.services."docker-images-penpot" = {
-    serviceConfig = {
-      Type = "oneshot";
-      RemainAfterExit = true;
-    };
-    script = ''
-      ${pkgs.docker}/bin/docker pull ${config.virtualisation.oci-containers.containers."penpot-frontend".image}
-      ${pkgs.docker}/bin/docker pull ${config.virtualisation.oci-containers.containers."penpot-backend".image}
-      ${pkgs.docker}/bin/docker pull ${config.virtualisation.oci-containers.containers."penpot-exporter".image}
-      ${pkgs.docker}/bin/docker pull ${config.virtualisation.oci-containers.containers."penpot-postgres".image}
-      ${pkgs.docker}/bin/docker pull ${config.virtualisation.oci-containers.containers."penpot-redis".image}
-    '';
-    requiredBy = [
-      "docker-penpot-frontend.service"
-      "docker-penpot-backend.service"
-      "docker-penpot-exporter.service"
-      "docker-penpot-postgres.service"
-      "docker-penpot-redis.service"
-    ];
-    before = [
-      "docker-penpot-frontend.service"
-      "docker-penpot-backend.service"
-      "docker-penpot-exporter.service"
-      "docker-penpot-postgres.service"
-      "docker-penpot-redis.service"
-    ];
-  };
-
-  sops.secrets."penpot_backend_environment_file" = {
-    mode = "0440";
-    owner = "root";
-    group = "root";
-  };
-
-  sops.secrets."penpot_postgres_environment_file" = {
-    mode = "0440";
-    owner = "root";
-    group = "root";
-  };
-}

config/hosts/penpot/secrets.yaml

@@ -1,234 +0,0 @@
-penpot_backend_environment_file: ENC[AES256_GCM,data:+MJbbAjzslBIYlQ9xe0VzM8ON2U5dktJGGHmoUu0HW0mvU4pRYrQXlWdW85RXAyYU9yOiL6TNAHOWUQyqOdo23whuer2jL/Qe17DEhapE4b9W9JqBX7H0VZZKHS70AgGZdWmbj/bWAROg/qGPVKjZLhgKxoVTVbvAIJEXUDAbGfvHlY3BP67yUTXvbmtd/Rdhn6i1HafY7YHFNAW8SkikglW6wR5igEZMFAefMOMgq7aYmNXOr1bImjCPEko0DvumJZM4YMjmb3Wc97wL7OMP9G/V0k9fRclhOj9+lNpeeCKL+VL3Bgo8vqgrB+WIi4a0EwerT8srx351txrU+ITxoHciRQtOpeXVHWL1snW9o7xCoOcil0NS93D9GhW+Hd75Is/xHN08UHmahF1r71nbDK4CmSiUzZzFLl1oWkSTU/31zBUnllHOt5nDMKT42xiniAJcQ==,iv:vtIlNGIh9+e9W+OebTac+UUQp9glBIolC6KQwQMzDn4=,tag:kBBTu7LVp+3xJ/MstLyomw==,type:str]
-penpot_postgres_environment_file: ENC[AES256_GCM,data:VT36kHkRH8ghnU1oyPpAQZW2LR8GNmG1cQXVjU4f+rGy9hViTivd7qxzMusisy7IcWfVaQuXFvUCT+pCMD/fhSAQZOY/1Rs8LBXJtsuPButOG9Q=,iv:pUjAkvvHjsnzn0xRRmdZXatOgLm9dx8Ggt7lEfiQllQ=,tag:FZRqlcxQWu/FgnJfoukIcA==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age10ku5rphtsf2lcxg78za7f2dad5cx5x9urgkce0d7tyqwq2enva9sqf7g8r
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiZVA5WE9JcDBOQVdPbGkz
-            SnNkWEJvaUtGaWVOajd6SzJ6aGNxSXZQaVhnCmgwT01kNFRZa09Gd1o2ZURyZUJQ
-            N0dwK21vUmk1N1duOVNtV2wrVmlyNDQKLS0tIEJtUENHdXhGcXhRRjM5VkhpdEVG
-            Z3UzOGFFUDhwUndoQWtCdHlMenZETW8KI0FjoFG4E1fhOxYiCIxY2BnLOmGcpoyK
-            EbDdNFQEMngwppEm9r1KzG/1cGMoIij2qpmK4Jz1Hzgk/6dZwvGxzw==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-08-10T15:40:27Z"
-    mac: ENC[AES256_GCM,data:hxVxH/BBwYcvbtOH4aOUnI9NnbCfAGnnwE3VQBJBJliOWo9WHm/hx4Eol4vaS+AA2t6AUU7UmzjofX2wSTbqQliDCFCSgbpMofDXP7tmlat+M9Du91fQmfOibzCd84tkqS+TRTFCFX83LmQ7/Bb2mHl77uGVAFYyHX9+IPPEUMw=,iv:w2Rdl2+o7bZRQsOogU6U5DK1UuHn+bL4Ouh3XbByYHA=,tag:6sqJal6+kzk0stP6vK6oOw==,type:str]
-    pgp:
-        - created_at: "2024-08-09T01:28:41Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAxK/JaB2/SdtAQ/+JKe4fsuAKMJr6kuDt5vjv+hrXamWEwRLBfYPHHZHEUeK
-            AQBs9fG9Ni7Qpelv8RIbxWyophgt2TCEqP2d+7EcGTgDZkdLxx5s2LJuCh+tEZwT
-            bm0sPt+8eYY077MxA1ZtlBgkslMugvdnJaDckGc8xRPldUa7gRp0j3yaLULRxjA6
-            T0nyALAqAaDa2uHgB7mTB3pXJYk4GxZpYbVc+wxAWXEDRLR/bpT18ywAcA6iSerd
-            KGDzWKjgOr1TTJqUxsguqDjnVp1c+xRPirC9uENGqW8mxI7h1+4B//dJvuXV/cYh
-            LKi0aDUTnma78mo2v9faUSJl23LkIehWZwbVG/+Mpkk3yxscLV124Vbwj56IFCzI
-            AiJ7m2QVxY5eXoVLodw6Po2S62gkwg7H5Aw3J4pppNuIAIr/8mJBpJoBy6poTsG3
-            QhbQdEdsF5ikoLu/OV/H7mp86zJt42Q+74xGjKYx/qvLq6SDmDA03kqk9N71URyu
-            FRTEDysEkeAzreFFkxn3Q+K/cXvtv/2Knte1lmDTfpmhg4cFwsLPLPH37A2veaxJ
-            JTyWDLHgrJ8NFgii3gLrwj+XLOZOwmCY0puJKtdAnPaaQiLfyqYfeLVlt7Se4MMJ
-            8XaFWcaQHBxL9nRZnx7WkE9LfHIG0e+414hT0F/aER+8iKboIbt6rdEHpEMGDWnU
-            aAEJAhD/TpW7E+yYjFVi/xSQ3kCAruHcm6x4BDTE7by0VeTLiRFW+culxiInOYiD
-            kdp+dATm5f7IrQp/qemL02/Me5yqURZlZrDHra7AiCI+MVBJiCRIY/x6xZSew7PX
-            HC+p9sB+PBFL
-            =1qbt
-            -----END PGP MESSAGE-----
-          fp: EF643F59E008414882232C78FFA8331EEB7D6B70
-        - created_at: "2024-08-09T01:28:41Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA6EyPtWBEI+2AQ/+Ijn18W+K2je/hpolpY6HmQMTTRpQJZ8YtJ5G35o5WoVP
-            hH+znQMrBBAtnTWeFBeIuIzk4CHjPS0yfnsE4/rP7/lSa177A2xaeiCb74F6k/Es
-            MtDE/TApSlNdPFruN5nkd2I8jAWh1k37nS+/NUhszReR39NNmgA+aCSc2OK04aAz
-            dpPXmaJ+d3zMr7eFoL2NyhNI3A/ZdVP3UmZCp12juckDRl8oeei4PBlw2T6ODJP4
-            tY08I9EyK/5K4auhYJyvayl1RWwRuShFV732ZjztkawLw152W0Rrg75Qoukhs9mr
-            TdyF0zcnVxAcOV4e5wRe13dDV6Ue7zeWFc9bb577thGzUm2Oue0u+oisty16qt9K
-            0vw0tVSDtT/suodG8HpvSwGQ+/xcV7w8XCH8Yx28N9iO49VZCB1ZYXQBxTHVDl2b
-            J/8AivaK4OOFvPWNr4u6oLaO9nz1aaX6Qsap5zn0Qa2Ls2SSBwWk2Fp/f1dq3KOy
-            /jGR89ocuEuImVacr2G6zxPnbukfa4S8q/FUUDbswQUqmWMcDDq3dOQ1fFPRd7vy
-            5a9u3P8LFW+ZPPHop3kgozgZ9pBGDOlw3nkjGjFl39lE33E+049gLE6I6+1+umG0
-            EWkNI9y8X+HmHMthVuYapq23Ix09H6Wa452hZmEUxNgp33M8Zx+l3s6D7o7jfrjS
-            XgElPJuUWyGKPoUY9mFaINyVqjOJGEtEOYRP7jvCpFWDq/xQ8jbJvvv7qBy8+i0b
-            cpqRrMJrvMB2PSLeD6cNWymrNhKilLLFOcG9yaIEudDhiuv3L4/ub08QMroDmo8=
-            =80AM
-            -----END PGP MESSAGE-----
-          fp: F155144FC925A1BEA1F8A2C59A2A4CD59BFDC5EC
-        - created_at: "2024-08-09T01:28:41Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAz5uSgHG2iMJAQ//Vv7IVqc9ReeFgo8RWbYpl1W5atAHerZuUh0oYc4otGpb
-            UseJ2JInyykcUeQWlOGvTK+eauBVNET0E/6jylCoWb8lzffhSMJ4FFpvpsoYjPG9
-            Q8s3r8soOCYB0xscfhinZwJg5to+I2MSd8mppWIp4UCQhxv7MqQpbqEzNTfVP7YO
-            QEUZ/lesVovLvxMzKc2YVWyZFSW2G6HK3LTaJIg8gy5ym/crlUB+awd2ZDePGk6F
-            Y7DcKwL1EpCL+hoPWGF9PclYKrOBIZVznYQuwHAqG+Bxr9Ln/NmS/OoCrJDMN6gG
-            2YMZ3Q7GQ82zZESxYA7g+ef9/lGCm7DIkt80or72x7eS6/OP7c1bjGFgKLQNyHFU
-            Th6cOy/TzK8Sq2g1mWB2zyV3xk6mb9C0ETAFD5vvPGVC3Sb4549Y+epe1T3ZLFTA
-            t09nUIpTC05PEdGsWs5Z5MDp8ZCsPZpipbVrWENesNOfaFYG+p7aM0LjgTqZcadD
-            B/Foejayc3XYI0T/NoP43mAZ2nEOw2Bz9lBpwz0PeTfzyrhz9XlJ7Dw462XTFA3i
-            voTHA5+DzGNPf6zC1fH9GcESmpC2nqXit8ZV+Y7Zb9/cAsx3E05S8ayxdBZUrOtJ
-            JSWGOAfPuzGXgL6Ht3iKcmCxQ/pSi1aH0h+bYqlrxTvP9IMyNCrxmP6+YsXCv8XS
-            XgE0NjzRMClq4/HhQ5X0ANGHWxbZJLAbm8yfgK5rnnmvi53RNJhRUHDnNca93brF
-            n27gnVLKM+2FdwRjwNIznkbZV/iNM6zIfRWwmJs9gHRuX/J/XWzD1KjDsn2rmiQ=
-            =bAYZ
-            -----END PGP MESSAGE-----
-          fp: 18DFCE01456DAB52EA38A6584EDC64F35FA1D6A5
-        - created_at: "2024-08-09T01:28:41Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAw5vwmoEJHQ1ARAAkdXjf9h4iyYtKPwR9V8hgIfpt3s3zMduuJN3u76ZHdfE
-            87t5K8eL2yIVN2DeOqtXRG28Broy3LLwMlLOJhxVxS5LAOEjT4ScZyb9H7MLnDsp
-            boW210SLkeQ5vTW9hgjAU9V6wbemxoiNPYTcBUsuirI8a+jpnALLY0jeOILBEmHQ
-            c+wbeo+VnlTQkTKCFI7TwlG1JnRnv3DMATVkOjC2PXmXPNkhr04Ivvf0+yBELY/1
-            hLirTfk/W6vFodPaoaRaeWjGJOo+FbqKLxr2xYzVu6SkF+i4CvDPb1x0t/laTpPA
-            qC6KJ1wyVwG4k7ZBLgRcf5Scn1zgGFzZexUAhdIYp0tKPycphUQxEMOI8/OeBP1V
-            68gBcilvv42zs+ed2RUK4j1e9YklxazZgaUhPfdrBrw/HiDJ8ILaq6LQQZSNrxZx
-            koAV/qw8ylU7vkciyA8bGLOiWc/Ub9vkRSuEi5TMOhmT7bVZ+W/26bWgDcAMmCpa
-            13H1uLXLuHnfDavdesh+RAxRgEavPTMz+HFbqhvkv8sy0RPCodyJv69J7dsS7a2C
-            71Ub7jyZIQyRtTGGZH5EjMQVStBMccE2KrJRzZCKbCmQDofKb4M67caaHBnVrs7D
-            vyx8V7JQGkNOWIgWFb23dtCtRiMzFaRk31mihFmFF2tSgg6XMqNmTp0pc3zQBarS
-            XgFZKRlYE7H1tMUCDwyKB7G3r1jsxBlUSbH1J6XjUBWKkTD4iMHI/4YStvghLjm2
-            0qqgKH/Njd9xBXc3x4Ut7kh8tFMMa07xF7/V0Pgwq+7J7EgckEfKHKA5vcQt17Q=
-            =23io
-            -----END PGP MESSAGE-----
-          fp: 87AB00D45D37C9E9167B5A5A333448678B60E505
-        - created_at: "2024-08-09T01:28:41Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA4HMJd/cQYrVAQ//RH/jOrYE9MD9IjkUfsQZ79rjEwDdtmsXs+gS/XUr0MpI
-            f/aDyw/vfvD7ZgY86yqp68x0OQLIyRIx9O05FNB3giVN4YFvZpFblLotpMzCFa2d
-            5xKLIQ1oviDSnE0kKpNM+QKITKjCxyke7MgW/laXvF0zMaVdPj0qo3Zn07MUKULs
-            btxZgPhzwWLjveZGn+72QiBGTF0ce49TWoh6y/l7PDsXhojau2KP556hI3rp/nC0
-            PunbLVRntpz+bOoyOk+xvKen+8b/Vwp+GYA2NBDbZSEY9H3YF5ugZBR/jUc8da7D
-            9EBA35udmQVKtD2XZrIyfhETC1eqLXORo0JKld5oC03JPkqvV+QpMF+8JBjXe1Cy
-            qI4pBmdhTJYFoJHpvMH7eC4CWgZZRMD5mB2nk1hYd9oIiYUPABfdeGxKiFnC8zHH
-            cEY3jgGzetZTxnpk2mxZvFMMwFqyOJA2PnwMTv3IraARkFrLxGzUIG4uOjo+l2fp
-            igOKsw9p46RR1gkuKF4u3yB3/1RloDyqGCU1/n4BCWy5/UkjSQpWKShZt3qMd2G2
-            A6si2zgSHIQ+ubR7MPB3Q3U/Rnw7pSbTbdDc73pZ2SPZfUuJplPSDUvXICGlj8cO
-            jO8s926qp4X9C4mi5um6EX5nLG+pfuKowIBdB2HWmxu2idwyrmNdlIgAcWcteazS
-            XgF9W6THXau4lEmrBqWEiC0K/9NA0cDJqRdvj6wqZ/OIAo86q3yRlm8yY8U7D00j
-            wNS8WSHq+EX0K9LpwQiHAJoxNXABEx/DbRqVeuLn2FaCocZigbvu3k/pePuOsK0=
-            =ZLl2
-            -----END PGP MESSAGE-----
-          fp: 91213ABAA73B0B73D3C02B5B4E5F372D17BBE67C
-        - created_at: "2024-08-09T01:28:41Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAxjNhCKPP69fAQ//dCKpiens8kqp+I9HtwP2CQOVMLLAle1VYB7pJ5pfcyzI
-            /3tAmwcxBmg+jhkFiqheBQYV2yNmBMHc5ulx+MxSDKd9mzCTavlGlE+intPjON8k
-            sis68RnU5OFsnGVXSmJji1vN37cCY4jHkf2vYzz6HJ6FLPrda/W3ZfXI+ZnOCao5
-            wGYrqPcYUj+7gnN1S42HM492oqeCNLcENDvegf8AxtBEgfp7UQ0V3ZC0wZEYhz0V
-            p9bdivFoEZ3Zo0sJTWKj3Df3IA5T6c4dbSPj8r7IZ5iNDguKAjvegXujco7pow51
-            fNNJB02hnYHLMRAbeRqaWyJ7qUQSWbQEgb8NuonspnXnajKc/OddgoTN91gTRgMb
-            op2T3HOFv3lKZPA/xIeDZpIm6GqOW6eJLjqiLP39VGvvNRYg+zxhNg/ZBVkFuSAf
-            U5uDPUyIAr10zdm7NqJKL8wKRbQzBg5OYovrXqSl96+KNenJqbMNv1N7kfSF6FuF
-            x8joEDXIaBSwINE4oXD5SN7Z5L2SuuMJ2nvuXFmmXKerRlrBiGsBzUVMt1bGqKEU
-            KoAAwbInZ9SprSxqJ1EkSVXpNGnFFNlbBB1j2u9BoGygOkVM4ZxIS19DBDLG0Tls
-            Fq6GI5d3axcf7t024UmwcU9yaP1BzrV0bDvDg3X+Azuo5JqpT3pSUvqv+Sy1C3nS
-            XgHK1C7XTOfcvmcxJ1f++xELwRkgNo1OqSG3cIZ8i1tKZFKTyYCiNHa/ajSr+wER
-            4phM7Tdr6ubjLkqvDkMeXvtiGyUoAvbtLC0wqSaE8sEZ28eFGEAaECV/uOW81X0=
-            =0jv9
-            -----END PGP MESSAGE-----
-          fp: F38C9D4228FC6F674E322D9C3326D914EB9B8F55
-        - created_at: "2024-08-09T01:28:41Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA1Hthzn+T1OoAQ/9GTEI65w8icqppqTuvQD50vaR+lCY1NjWT0HekgvNuCLV
-            4gL1cYv7tJ5UU6jOnREoScamWnUTYf/sLINIfa+FgvH+apswQeQCFrdCb8/61/Xc
-            3hsJ8gwmguP1zJabKFI6/Yo3vPPa+kpj0Am6M7dUUxEKw4Lqy6Hc32O6ULNJOvdo
-            56oqr6KoemrpU0TzqkKTpgAZaQjFfVzPWfC8moUL1pvxrHm7rqDPiYcl7fZP3JFD
-            gQMZokH205u1elxiFxuQGtW8jbeBqCZUm1UorEgD2EJYEPfyphIaHaQnCpW8zXkI
-            gt9QT3cqJpGJAobCPbh6vKPtbGPEqZOzOaCMFl07pkOSGPAVGMVfV+FdsfszPYY6
-            Rqsk7zlCFv/iNFWKpkdfI66JLvhmgNwXRv+rkYzH3QrQikjLmAeTzyL69SPujgDK
-            qXBRZiAPwEDScr2Qcum36jDVrT3jRfC1opzwpRxM2ompJ0F6caBPNVjY10BScl7Y
-            RWVmkFrPL9MdEelFLscG17K+y5S/50sLcU+sGbMkmPsmizA0boK5XBXJz3cTadYy
-            Asr2b4aWTqBS5iW1vbWIGJVrUUk3U1S4fFaSvsL3I6O0E+sOB3eEEpQZqpF9Genr
-            hCE8GVE5yQWb3YYK0ZA7j4u+dwA+QfRIuQuMWFoRKp8oqEitjjix3je2R3u8/ILS
-            XgFcAp8Jh+VbnQg/pq92u3dX6afGv6nENpMVPn73yob+sfE5xUFEfEzE1E1WCWdR
-            HiLZVOgpVOYmo2s8/UW60hLNBULpqyf6ZTQsr7IqaGw4g+Ew116cwDawywRSJMg=
-            =T0nI
-            -----END PGP MESSAGE-----
-          fp: 5DA93D5C9D7320E1BD3522C79C78172B3551C9FD
-        - created_at: "2024-08-09T01:28:41Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA46L6MuPqfJqARAApsnPRzTCIkbKT6jaVHixgP6wyCjfVmvgb0NnMrN2Ygup
-            pafb6GNWoFq9WdiSqwFIJPZlZxJFiIgSxplDI63Wj1MgfvQBEnKUQvnvR+UtnB22
-            bGr9mIrq/wKgslhPLFB0qT81RK/GqJKvRNpI3trGmB1pBnDdb5jiFeDHStv41XrP
-            hezAvmDGBKlM74fehu0pKOanIspyvFAjs31NULSHGJGzBxyM6OGcg/XLt9ea6bI5
-            jHwu3+M/7nixjtaIdCtEFPv/Mdimq9p64+c6AvbEVikUH/omRebRFIRrJCotYENT
-            ak6/2F+Fze2cof6pJPaq1KTF7LQHi1ZaQ/N+YNDsMJIYYuX3lVg/ClEjeo5k1HJ4
-            Jc+ul2KF/dAh8UsJPIdhJDlxIPdnof7xBLax1xmOQTHpqsfhZe5BP/0KMeeXzG6s
-            TlozMaCY0ok4JiQmiJcs+TjHX+uiiih6Wi756v7qwpCk5u3/BM+veHB/slD5Xezn
-            KmuHzwcbaP1n5JlOtv1PLAPfqX9EDsAVr2xhYTBISZiIKXyfagUWzPNX6toYtBfV
-            cQ/m9nfc5/STna7XGucnKkYFG5U2a+olIqCcbbNkN4NcW5ly0M5g1VW3oh02NO8r
-            A/4aU8ECj+79XXx0XCuVojnkGdTT3SQex7bkV2stBpuc5xfESbuOMWXgK0qZrYrS
-            XgEfX0ySVVrCxhtJgsQvZl0zrOwIttomV6hlQgo+n23HNPwjEf4nf1p2sje0uPvb
-            bPC7u5y1eDdy5E0XyWkAg4hxPLg7yOj7ET84Bg9S3NE8cE0nM50qL0N6aCAb4II=
-            =Is94
-            -----END PGP MESSAGE-----
-          fp: 8996B62CBD159DCADD3B6DC08BB33A8ABCF7BC4A
-        - created_at: "2024-08-09T01:28:41Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA4EEKdYEzV0pAQ/7Bx/s7WlB9TE30vyqVWw6H4DoZS8s03Z21tDAtrUEK+k5
-            QtMPvAIE0SG4lXersM3L6VMmhvPQlwZf+zSzBnO0J5vacvMG8dch4/ZH7YTM0VX6
-            T0Ix9ScamEI8J5Fr1LAeBoqtTa8n1/3N2ILBVPRTTX5Wu4lSUw/voeePXAYxSSMv
-            9vzrxJNcRgzbd/8Fbo3i2vzn4GvrP1JzsprLrUMVFaek5khD0hRDJMM0IhBWFRRh
-            L241zX/IBZDQVz0x1QVUBFmkoUjyNn94CTezTmGvqCXfkLRmcKzTZXd0dhORBPFa
-            LygVSLdor0v5ru70rMds6YN5WvqbmG7KUY8M3gcVXutvID58vw6ZE83T8ZAYj9S5
-            r9hXegeb2e03tCvSrHmQFf37+298/E8/kBrBQgoevnHmm3p0yN3ZbrWLIRhbx2iF
-            NzL5s17PnGzmuSigoZERsN2Flx2fzUbtwVDP3AyLVpQ7NoqTZkJTcGQuvkYawnEa
-            3RxUQySR+a7bED38wJ6zEpVg10ye7c8mVkzQnda1Qp3lnPZxz+1qg1n25I9hjNO6
-            X1E8gtXx2EcwaoWcPO0W/sNBwE09SCM68KWSykwOLvZb5tq/HnhrwSisps5sAg9V
-            Z1c0OCwgJvYoTY46rqk7scN9YkE16LDCtAzgppZerli179E/f/7O3d59CA1mCEXS
-            XgHbdM2nxaBPCPgXXNRVq13R8JXiOokuxUZofwl6FaG8A6yc9z5F4Ygr/KKDeT0i
-            YMBezxQtQ5uKY0jIx5g2r6aSdly3QPNKiFS/rxDCrmtaBqw+OvhvLrnCn6IaRVY=
-            =XAoN
-            -----END PGP MESSAGE-----
-          fp: 9DFA033E3DAEBAD7FDD71B056C7AAA54BE05F7BA
-        - created_at: "2024-08-09T01:28:41Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hF4DQrf1tCqiJxoSAQdAFvRDMKG3Vjs98kRqcs4ep+bYoUcBHbMA7WgzI7CcaGQw
-            FjdmSwvWaHJZQGEbGk4uDHKPHqXRD3HnD9d75Azu2HXnCA29aU2c0zn0PziIi7Aa
-            0l4BbcavPKNBkZpJNgW0uII7xMYJWJ/9vStTxXG/WzNia6nk/Cv7PMJW7EwIeUga
-            +PWB4yGfPXgqJGnJj0H1EdCVPrM/+f19GcFxNKKzkGaKTyVTW9NxntlsFl1vbmRx
-            =YRc6
-            -----END PGP MESSAGE-----
-          fp: B71138A6A8964A3C3B8899857B4F70C356765BAB
-        - created_at: "2024-08-09T01:28:41Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAzdAjw8ldn6CAQ/5ARLA8sAZHMwNhHJycVof+ZergR58hXCBjbIy5zgyAwYU
-            IJ5OwhTpWqniZjt0b9pvlzU4JO1k73B1WrF7mAYEOKET32GPVatrQ64yInQbORSZ
-            zNQgX3aQ8tEtyBsKAWqwqRjOaP6Plee6G0RCksJBAkjIZik0diTOBwi+ZhgYSRLE
-            G1NAETqMKkLleYQbUWCFNveJOd/7pfhE4xhAEaSxL3dgXNPV2TOngvjCqMXvz0K2
-            hEz6OYC8idpmAJv+S+HOaZbKV+giCopsPyFnbeu8jf1UpbsBRbHPnLOO6lLby2gf
-            2P9MhwSeMjjCZFX/ys8vHQ2jUwXK8jfW3xfVie4hVJgh6vO+uHcomjnk2b+34SRk
-            7ttoozLbMFxwrcP9trV0TgT2uzjFCe4fHccpY1VLTCX/O0eYtlhDhur0Wojp1z9v
-            h5mcqySEtJfHXJbTXkgMA2+QSyUaTTfvZ6oJqX3yAoq5eIzC0CcF+IMa6NS1XkY0
-            TNd3FEhwe7TvKGCy/3bJx6jMUnhT71r6KW/w7RVIHgdp1hfUS9JBhxVB+agQVyRv
-            +HBmvWHqUdwnFzotGRzLU1g6soWa+fRVQQ80qAi1U8e+u9IX3EG0KoIXLjpkvXxK
-            y520NcOdN4wR0xILPP/+47QDN+kM6lunm/EMgrff4YDE8J83qMhH2IP5s/tV023S
-            XgH1hiB0U4SYt0Rp6OGDV+CjBCFaCkPPlync/SVuXddfLC1owGlY9L3jwu7j2PR7
-            jy2jPPTWrOvT0wZKEh4k501LRb0n6LGqW6gDTgOnZKNg2iQ6jybv2HeyyExYllg=
-            =1o5H
-            -----END PGP MESSAGE-----
-          fp: 3D70F61E07F64EC4E4EF417BEFCD9D20F58784EF
-    unencrypted_suffix: _unencrypted
-    version: 3.8.1

config/hosts/penpot/sops.nix

@@ -1,7 +0,0 @@
-{ ... }:
-
-{
-  sops = {
-    defaultSopsFile = ./secrets.yaml;
-  };
-}

config/hosts/ptouch-print-server/networking.nix

@@ -11,7 +11,9 @@
       ];
     };
     defaultGateway = "10.31.208.1";
-    nameservers = [ "10.31.208.1" ];
+    nameservers = [
+      "10.31.208.1"
+    ];
   };
 
   systemd.network.links."10-net0" = {

config/hosts/ptouch-print-server/printing.nix

@@ -90,7 +90,9 @@ in
   # pam_deny.so # deny (order 12400)" for pam.d/sshd, so enable
   # PasswordAuthentication to have it not do that.
   services.openssh.settings.PasswordAuthentication = lib.mkForce true;
-  security.pam.services.sshd.allowNullPassword = true;
+  # The following doesn't need to be set in order for empty passwords to work
+  # apparently:
+  # security.pam.services.sshd.allowNullPassword = true;
   services.openssh.extraConfig = ''
     Match User print
       PubkeyAuthentication no

config/hosts/public-reverse-proxy/nginx.nix

@@ -9,7 +9,6 @@
   services.nginx.streamConfig = ''
     map $ssl_preread_server_name $address {
         status.ccchh.net 10.31.206.15:8443;
-        status.hamburg.ccc.de 10.31.206.15:8443;
     }
 
     # Listen on port 443 as a reverse proxy and use PROXY Protocol for the

config/hosts/public-web-static/networking.nix

@@ -1,19 +1,17 @@
 { ... }:
 
 {
-  networking = {
+  networking.interfaces.net0 = {
-    interfaces.net0 = {
+    ipv4.addresses = [
-      ipv4.addresses = [
+      {
-        {
+        address = "172.31.17.151";
-          address = "172.31.17.151";
+        prefixLength = 25;
-          prefixLength = 25;
+      }
-        }
+    ];
-      ];
-    };
-    defaultGateway = "172.31.17.129";
-    nameservers = [ "212.12.50.158" "192.76.134.90" ];
-    search = [ "hamburg.ccc.de" ];
   };
+  networking.defaultGateway = "172.31.17.129";
+  networking.nameservers = [ "212.12.50.158" "192.76.134.90" ];
+  networking.search = [ "hamburg.ccc.de" ];
 
   systemd.network.links."10-net0" = {
     matchConfig.MACAddress = "86:72:08:F6:C0:D6";

config/hosts/public-web-static/spaceapid-config/ccchh-dynamic.json

@@ -2,6 +2,26 @@
   "dynamic": {
     "sensors": {
       "temperature": [
+        {
+          "sensor_data": {
+            "unit": "°C",
+            "location": "Hauptraum",
+            "description": "Sensor im Hauptraum"
+          },
+          "allowed_credentials": [
+            "club-assistant"
+          ]
+        },
+        {
+          "sensor_data": {
+            "unit": "°C",
+            "location": "Loetschlauch",
+            "description": "Sensor im Lötschlauch (Teil der Werkstatt)"
+          },
+          "allowed_credentials": [
+            "club-assistant"
+          ]
+        },
         {
           "sensor_data": {
             "unit": "°C",
@@ -14,6 +34,26 @@
         }
       ],
       "humidity": [
+        {
+          "sensor_data": {
+            "unit": "%",
+            "location": "Hauptraum",
+            "description": "Sensor im Hauptraum"
+          },
+          "allowed_credentials": [
+            "club-assistant"
+          ]
+        },
+        {
+          "sensor_data": {
+            "unit": "%",
+            "location": "Loetschlauch",
+            "description": "Sensor im Lötschlauch (Teil der Werkstatt)"
+          },
+          "allowed_credentials": [
+            "club-assistant"
+          ]
+        },
         {
           "sensor_data": {
             "unit": "%",
@@ -25,13 +65,12 @@
           ]
         }
       ],
-      "ext_3d_printer_busy_state": [
+      "CO2": [
         {
           "sensor_data": {
-            "unit": "bool",
+            "unit": "ppm",
-            "location": "Loetschlauch",
+            "location": "Hauptraum",
-            "name": "mk4",
+            "description": "Sensor im Hauptraum (Typ: SCD41)"
-            "description": "Prusa mk4 busy state"
           },
           "allowed_credentials": [
             "club-assistant"
@@ -39,34 +78,9 @@
         },
         {
           "sensor_data": {
-            "unit": "bool",
+            "unit": "ppm",
             "location": "Loetschlauch",
-            "name": "mk3.5",
+            "description": "Sensor im Lötschlauch (Teil der Werkstatt, Typ: SCD41)"
-            "description": "Prusa mk3.5 busy state"
-          },
-          "allowed_credentials": [
-            "club-assistant"
-          ]
-        }
-      ],
-      "ext_3d_printer_minutes_remaining": [
-        {
-          "sensor_data": {
-            "unit": "minutes_remaining",
-            "location": "Loetschlauch",
-            "name": "mk4",
-            "description": "Prusa mk4 minutes remaining"
-          },
-          "allowed_credentials": [
-            "club-assistant"
-          ]
-        },
-        {
-          "sensor_data": {
-            "unit": "minutes_remaining",
-            "location": "Loetschlauch",
-            "name": "mk3.5",
-            "description": "Prusa mk3.5 minutes remaining"
           },
           "allowed_credentials": [
             "club-assistant"

config/hosts/public-web-static/spaceapid.nix

@@ -1,20 +1,19 @@
 { pkgs, ... }:
 
 let
-  version = "v0.1.0";
+  spaceapidSrc = builtins.fetchGit {
-  spaceapidSrc = pkgs.fetchgit {
     url = "https://git.hamburg.ccc.de/CCCHH/spaceapid.git";
-    rev = version;
+    ref = "main";
-    hash = "sha256-2SDhliltzyydPPZdNn/htDydiK/SHQcYyG/dQ0EyFrY=";
+    rev = "17753f535c68157e80f30f50deb488133cc98258";
   };
   spaceapid = pkgs.buildGoModule rec {
     pname = "spaceapid";
-    inherit version;
+    version = "main";
 
     src = spaceapidSrc;
 
     ldflags = [
-      "-X main.version=${version}"
+      "-X main.version=${version}-${spaceapidSrc.rev}"
     ];
 
     # Since spaceapid doesn't have any dependencies, we can set this to null and

config/hosts/public-web-static/virtualHosts/c3cat.de.nix

@@ -1,19 +1,10 @@
 { pkgs, ... }:
 
-let
+{
-  domain = "c3cat.de";
-  dataDir = "/var/www/${domain}";
-  deployUser = "c3cat-website-deploy";
-in {
-  security.acme.certs."${domain}".extraDomainNames = [ "www.${domain}" ];
-
   services.nginx.virtualHosts = {
-    "acme-${domain}" = {
+    "acme-c3cat.de" = {
       enableACME = true;
-      serverName = "${domain}";
+      serverName = "c3cat.de";
-      serverAliases = [
-        "www.${domain}"
-      ];
 
       listen = [
         {
@@ -23,9 +14,9 @@ in {
       ];
     };
 
-    "$www.${domain}" = {
+    "c3cat.de" = {
       forceSSL = true;
-      useACMEHost = "${domain}";
+      useACMEHost = "c3cat.de";
 
       listen = [
         {
@@ -37,7 +28,7 @@ in {
       ];
 
       locations."/" = {
-        return = "302 https://c3cat.de$request_uri";
+        return = "302 https://wiki.hamburg.ccc.de/club:c3cat:start";
       };
 
       extraConfig = ''
@@ -51,45 +42,5 @@ in {
         real_ip_header proxy_protocol;
       '';
     };
-
-    "${domain}" = {
-      forceSSL = true;
-      useACMEHost = "${domain}";
-
-      listen = [
-        {
-          addr = "0.0.0.0";
-          port = 8443;
-          ssl = true;
-          proxyProtocol = true;
-        }
-      ];
-
-      root = "${dataDir}";
-
-      extraConfig = ''
-        # Make use of the ngx_http_realip_module to set the $remote_addr and
-        # $remote_port to the client address and client port, when using proxy
-        # protocol.
-        # First set our proxy protocol proxy as trusted.
-        set_real_ip_from 172.31.17.140;
-        # Then tell the realip_module to get the addreses from the proxy protocol
-        # header.
-        real_ip_header proxy_protocol;
-      '';
-    };
   };
-
-  systemd.tmpfiles.rules = [
-    "d ${dataDir} 0755 ${deployUser} ${deployUser}"
-  ];
-
-  users.users."${deployUser}" = {
-    isNormalUser = true;
-    group = "${deployUser}";
-    openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcZJzQO4RYinJm6YDUgCELe8OJA/DYOss+8xp7TtxM0 deploy key for c3cat.de"
-    ];
-  };
-  users.groups."${deployUser}" = { };
 }

config/hosts/public-web-static/virtualHosts/default.nix

@@ -5,13 +5,8 @@
     ./branding-resources.hamburg.ccc.de.nix
     ./c3cat.de.nix
     ./element.hamburg.ccc.de.nix
-    ./hacker.tours.nix
-    ./hackertours.hamburg.ccc.de.nix
     ./hamburg.ccc.de.nix
     ./spaceapi.hamburg.ccc.de.nix
-    ./staging.c3cat.de.nix
-    ./staging.hacker.tours.nix
-    ./staging.hackertours.hamburg.ccc.de.nix
     ./staging.hamburg.ccc.de.nix
     ./www.hamburg.ccc.de.nix
     ./historic-easterhegg

config/hosts/public-web-static/virtualHosts/element.hamburg.ccc.de.nix

@@ -1,10 +1,10 @@
 { pkgs, ... }:
 
 let
-  elementWebVersion = "1.11.84";
+  elementWebVersion = "1.11.59";
   element-web = pkgs.fetchzip {
     url = "https://github.com/vector-im/element-web/releases/download/v${elementWebVersion}/element-v${elementWebVersion}.tar.gz";
-    sha256 = "sha256-z2qaKKyUq2S/r3xUUU3ym0FgFbiQr6bcltuKvUMPbH4=";
+    sha256 = "sha256-iVTd5zWUJh9wkbKMh+5hq0ucQaLLY29w1xCLxDIdQ18=";
   };
   elementSecurityHeaders = ''
     # Configuration best practices

config/hosts/public-web-static/virtualHosts/hacker.tours.nix

@@ -1,64 +0,0 @@
-{ pkgs, ... }:
-
-let
-  domain = "hacker.tours";
-  dataDir = "/var/www/${domain}";
-  deployUser = "hackertours-website-deploy";
-in
-{
-  services.nginx.virtualHosts = {
-    "acme-${domain}" = {
-      enableACME = true;
-      serverName = "${domain}";
-
-      listen = [
-        {
-          addr = "0.0.0.0";
-          port = 31820;
-        }
-      ];
-    };
-
-    "${domain}" = {
-      forceSSL = true;
-      useACMEHost = "${domain}";
-
-      listen = [
-        {
-          addr = "0.0.0.0";
-          port = 8443;
-          ssl = true;
-          proxyProtocol = true;
-        }
-      ];
-
-      root = "${dataDir}";
-
-      extraConfig = ''
-        # Make use of the ngx_http_realip_module to set the $remote_addr and
-        # $remote_port to the client address and client port, when using proxy
-        # protocol.
-        # First set our proxy protocol proxy as trusted.
-        set_real_ip_from 172.31.17.140;
-        # Then tell the realip_module to get the addreses from the proxy protocol
-        # header.
-        real_ip_header proxy_protocol;
-
-        error_page 404 /404.html;
-      '';
-    };
-  };
-
-  systemd.tmpfiles.rules = [
-    "d ${dataDir} 0755 ${deployUser} ${deployUser}"
-  ];
-
-  users.users."${deployUser}" = {
-    isNormalUser = true;
-    group = "${deployUser}";
-    openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOrDTANfPMkcf+V7zkypzaeX2fxkfStPHmZKqC29xyqy deploy key for hacker.tours"
-    ];
-  };
-  users.groups."${deployUser}" = { };
-}

config/hosts/public-web-static/virtualHosts/hackertours.hamburg.ccc.de.nix

@@ -1,69 +0,0 @@
-{ pkgs, ... }:
-
-let
-  domain = "hackertours.hamburg.ccc.de";
-  dataDir = "/var/www/${domain}";
-  deployUser = "ht-ccchh-website-deploy";
-in
-{
-  services.nginx.virtualHosts = {
-    "acme-${domain}" = {
-      enableACME = true;
-      serverName = "${domain}";
-
-      listen = [
-        {
-          addr = "0.0.0.0";
-          port = 31820;
-        }
-      ];
-    };
-
-    "${domain}" = {
-      forceSSL = true;
-      useACMEHost = "${domain}";
-
-      listen = [
-        {
-          addr = "0.0.0.0";
-          port = 8443;
-          ssl = true;
-          proxyProtocol = true;
-        }
-      ];
-
-      root = "${dataDir}";
-
-      extraConfig = ''
-        # Make use of the ngx_http_realip_module to set the $remote_addr and
-        # $remote_port to the client address and client port, when using proxy
-        # protocol.
-        # First set our proxy protocol proxy as trusted.
-        set_real_ip_from 172.31.17.140;
-        # Then tell the realip_module to get the addreses from the proxy protocol
-        # header.
-        real_ip_header proxy_protocol;
-
-        error_page 404 /404.html;
-
-        port_in_redirect off;
-
-        rewrite ^/(de|en)/tours$ /$1/37c3 redirect;
-        rewrite ^/(de|en)/tours/(.*)$ /$1/37c3/$2 redirect;
-      '';
-    };
-  };
-
-  systemd.tmpfiles.rules = [
-    "d ${dataDir} 0755 ${deployUser} ${deployUser}"
-  ];
-
-  users.users."${deployUser}" = {
-    isNormalUser = true;
-    group = "${deployUser}";
-    openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILxMnllgRD6W85IQ0WrVJSwr7dKM8PLNK4pmGaJRu0OR deploy key for hackertours.hamburg.ccc.de"
-    ];
-  };
-  users.groups."${deployUser}" = { };
-}

config/hosts/public-web-static/virtualHosts/hamburg.ccc.de.nix

@@ -94,8 +94,6 @@
         real_ip_header proxy_protocol;
 
         error_page 404 /404.html;
-
-        port_in_redirect off;
       '';
     };
   };

config/hosts/public-web-static/virtualHosts/historic-easterhegg/default.nix

@@ -1,4 +1,4 @@
-{ ... }:
+{...}:
 
 {
   imports = [
@@ -7,6 +7,5 @@
     ./eh07.nix
     ./eh09.nix
     ./eh11.nix
-    ./eh20.nix
   ];
-}
+}

config/hosts/public-web-static/virtualHosts/historic-easterhegg/eh03.nix

@@ -6,7 +6,7 @@ let
     rev = "74977c56486cd060566bf06678a936e801952f9e";
     hash = "sha256-ded/NO+Jex2Sa4yWAIRpqANsv8i0vKmJSkM5r9KxaVk=";
   };
-in
+in 
 {
   security.acme.certs."eh03.easterhegg.eu".extraDomainNames = [
     "eh2003.hamburg.ccc.de"
@@ -48,7 +48,7 @@ in
       }];
 
       locations."/".return = "302 https://eh03.easterhegg.eu";
-
+      
       extraConfig = ''
         # Make use of the ngx_http_realip_module to set the $remote_addr and
         # $remote_port to the client address and client port, when using proxy

config/hosts/public-web-static/virtualHosts/historic-easterhegg/eh05.nix

@@ -48,7 +48,7 @@ in
       }];
 
       locations."/".return = "302 https://eh05.easterhegg.eu";
-
+      
       extraConfig = ''
         # Make use of the ngx_http_realip_module to set the $remote_addr and
         # $remote_port to the client address and client port, when using proxy
@@ -60,7 +60,7 @@ in
         real_ip_header proxy_protocol;
       '';
     };
-
+    
     "eh05.easterhegg.eu" = {
       forceSSL = true;
       useACMEHost = "eh05.easterhegg.eu";
@@ -71,7 +71,7 @@ in
         ssl = true;
         proxyProtocol = true;
       }];
-
+      
       locations."/" = {
         index = "index.shtml";
         root = eh05;
@@ -80,7 +80,7 @@ in
           default_type text/html;
           # Enable SSI
           ssi on;
-        '';
+        ''; 
       };
 
       extraConfig = ''

config/hosts/public-web-static/virtualHosts/historic-easterhegg/eh07.nix

@@ -54,7 +54,7 @@ in
       }];
 
       locations."/".return = "302 https://eh07.easterhegg.eu";
-
+      
       extraConfig = ''
         # Make use of the ngx_http_realip_module to set the $remote_addr and
         # $remote_port to the client address and client port, when using proxy
@@ -86,7 +86,7 @@ in
           default_type text/html;
           # Enable SSI
           ssi on;
-        '';
+        ''; 
       };
 
       extraConfig = ''

config/hosts/public-web-static/virtualHosts/historic-easterhegg/eh09.nix

@@ -54,7 +54,7 @@ in
       }];
 
       locations."/".return = "302 https://eh09.easterhegg.eu";
-
+      
       extraConfig = ''
         # Make use of the ngx_http_realip_module to set the $remote_addr and
         # $remote_port to the client address and client port, when using proxy
@@ -86,7 +86,7 @@ in
           default_type text/html;
           # Enable SSI
           ssi on;
-        '';
+        ''; 
       };
       extraConfig = ''
         # Make use of the ngx_http_realip_module to set the $remote_addr and

config/hosts/public-web-static/virtualHosts/historic-easterhegg/eh11.nix

@@ -54,7 +54,7 @@ in
       }];
 
       locations."/".return = "302 https://eh11.easterhegg.eu";
-
+      
       extraConfig = ''
         # Make use of the ngx_http_realip_module to set the $remote_addr and
         # $remote_port to the client address and client port, when using proxy
@@ -86,7 +86,7 @@ in
           default_type text/html;
           # Enable SSI
           ssi on;
-        '';
+        ''; 
       };
 
       extraConfig = ''

config/hosts/public-web-static/virtualHosts/historic-easterhegg/eh20.nix

@@ -1,91 +0,0 @@
-{ pkgs, ... }:
-
-let
-  eh20 = pkgs.fetchgit {
-    url = "https://git.hamburg.ccc.de/CCCHH/easterhegg-eh20-website.git";
-    rev = "026932ef2f1fb85c99269e0fb547589a25d3687c";
-    hash = "sha256-YYxHhPYIioJgyHXNieoX6ibasHcNw/AFk+qCNSOxke4=";
-  };
-in
-{
-  security.acme.certs."eh20.easterhegg.eu".extraDomainNames = [
-    "www.eh20.easterhegg.eu"
-    "eh20.hamburg.ccc.de"
-  ];
-
-  services.nginx.virtualHosts = {
-    "acme-eh20.easterhegg.eu" = {
-      enableACME = true;
-      serverName = "eh20.easterhegg.eu";
-      serverAliases = [
-        "www.eh20.easterhegg.eu"
-        "eh20.hamburg.ccc.de"
-      ];
-      listen = [{
-        addr = "0.0.0.0";
-        port = 31820;
-      }];
-    };
-
-    "www.eh20.easterhegg.eu" = {
-      forceSSL = true;
-      useACMEHost = "eh20.easterhegg.eu";
-      serverAliases = [
-        "eh20.hamburg.ccc.de"
-      ];
-
-      listen = [{
-        addr = "0.0.0.0";
-        port = 8443;
-        ssl = true;
-        proxyProtocol = true;
-      }];
-
-      locations."/".return = "302 https://eh20.easterhegg.eu";
-
-      extraConfig = ''
-        # Make use of the ngx_http_realip_module to set the $remote_addr and
-        # $remote_port to the client address and client port, when using proxy
-        # protocol.
-        # First set our proxy protocol proxy as trusted.
-        set_real_ip_from 172.31.17.140;
-        # Then tell the realip_module to get the addreses from the proxy protocol
-        # header.
-        real_ip_header proxy_protocol;
-      '';
-    };
-
-    "eh20.easterhegg.eu" = {
-      forceSSL = true;
-      useACMEHost = "eh20.easterhegg.eu";
-
-      listen = [{
-        addr = "0.0.0.0";
-        port = 8443;
-        ssl = true;
-        proxyProtocol = true;
-      }];
-
-      locations."/" = {
-        index = "start.html";
-        root = "${eh20}/wiki_siteexport";
-      };
-
-      # redirect doku.php?id=$pagename to /$pagename.html
-      locations."/doku.php" = {
-        return = "301 $scheme://$host/$arg_id.html";
-      };
-
-      extraConfig = ''
-        # Make use of the ngx_http_realip_module to set the $remote_addr and
-        # $remote_port to the client address and client port, when using proxy
-        # protocol.
-        # First set our proxy protocol proxy as trusted.
-        set_real_ip_from 172.31.17.140;
-        # Then tell the realip_module to get the addreses from the proxy protocol
-        # header.
-        real_ip_header proxy_protocol;
-      '';
-    };
-  };
-}

config/hosts/public-web-static/virtualHosts/staging.c3cat.de.nix

@@ -1,60 +0,0 @@
-{ pkgs, ... }:
-
-let
-  domain = "staging.c3cat.de";
-  dataDir = "/var/www/${domain}";
-  deployUser = "c3cat-website-deploy";
-in {
-  services.nginx.virtualHosts = {
-    "acme-${domain}" = {
-      enableACME = true;
-      serverName = "${domain}";
-
-      listen = [
-        {
-          addr = "0.0.0.0";
-          port = 31820;
-        }
-      ];
-    };
-
-    "${domain}" = {
-      forceSSL = true;
-      useACMEHost = "${domain}";
-
-      listen = [
-        {
-          addr = "0.0.0.0";
-          port = 8443;
-          ssl = true;
-          proxyProtocol = true;
-        }
-      ];
-
-      root = "${dataDir}";
-
-      # Disallow *, since this is staging and doesn't need to be in any search
-      # results.
-      locations."/robots.txt" = {
-        return = "200 \"User-agent: *\\nDisallow: *\\n\"";
-      };
-
-      extraConfig = ''
-        # Make use of the ngx_http_realip_module to set the $remote_addr and
-        # $remote_port to the client address and client port, when using proxy
-        # protocol.
-        # First set our proxy protocol proxy as trusted.
-        set_real_ip_from 172.31.17.140;
-        # Then tell the realip_module to get the addreses from the proxy protocol
-        # header.
-        real_ip_header proxy_protocol;
-      '';
-    };
-  };
-
-  systemd.tmpfiles.rules = [
-    "d ${dataDir} 0755 ${deployUser} ${deployUser}"
-  ];
-
-  # c3cat deploy user already defined in c3cat.de.nix.
-}

config/hosts/public-web-static/virtualHosts/staging.hacker.tours.nix

@@ -1,61 +0,0 @@
-{ pkgs, ... }:
-
-let
-  domain = "staging.hacker.tours";
-  dataDir = "/var/www/${domain}";
-  deployUser = "hackertours-website-deploy";
-in
-{
-  services.nginx.virtualHosts = {
-    "acme-${domain}" = {
-      enableACME = true;
-      serverName = "${domain}";
-
-      listen = [
-        {
-          addr = "0.0.0.0";
-          port = 31820;
-        }
-      ];
-    };
-
-    "${domain}" = {
-      forceSSL = true;
-      useACMEHost = "${domain}";
-
-      listen = [
-        {
-          addr = "0.0.0.0";
-          port = 8443;
-          ssl = true;
-          proxyProtocol = true;
-        }
-      ];
-
-      root = "${dataDir}";
-
-      # Disallow *, since this is staging and doesn't need to be in any search
-      # results.
-      locations."/robots.txt" = {
-        return = "200 \"User-agent: *\\nDisallow: *\\n\"";
-      };
-
-      extraConfig = ''
-        # Make use of the ngx_http_realip_module to set the $remote_addr and
-        # $remote_port to the client address and client port, when using proxy
-        # protocol.
-        # First set our proxy protocol proxy as trusted.
-        set_real_ip_from 172.31.17.140;
-        # Then tell the realip_module to get the addreses from the proxy protocol
-        # header.
-        real_ip_header proxy_protocol;
-      '';
-    };
-  };
-
-  systemd.tmpfiles.rules = [
-    "d ${dataDir} 0755 ${deployUser} ${deployUser}"
-  ];
-
-  # Hackertours deploy user already defined in hacker.tours.nix.
-}

config/hosts/public-web-static/virtualHosts/staging.hackertours.hamburg.ccc.de.nix

@@ -1,63 +0,0 @@
-{ pkgs, ... }:
-
-let
-  domain = "staging.hackertours.hamburg.ccc.de";
-  dataDir = "/var/www/${domain}";
-  deployUser = "ht-ccchh-website-deploy";
-in
-{
-  services.nginx.virtualHosts = {
-    "acme-${domain}" = {
-      enableACME = true;
-      serverName = "${domain}";
-
-      listen = [
-        {
-          addr = "0.0.0.0";
-          port = 31820;
-        }
-      ];
-    };
-
-    "${domain}" = {
-      forceSSL = true;
-      useACMEHost = "${domain}";
-
-      listen = [
-        {
-          addr = "0.0.0.0";
-          port = 8443;
-          ssl = true;
-          proxyProtocol = true;
-        }
-      ];
-
-      root = "${dataDir}";
-
-      # Disallow *, since this is staging and doesn't need to be in any search
-      # results.
-      locations."/robots.txt" = {
-        return = "200 \"User-agent: *\\nDisallow: *\\n\"";
-      };
-
-      extraConfig = ''
-        # Make use of the ngx_http_realip_module to set the $remote_addr and
-        # $remote_port to the client address and client port, when using proxy
-        # protocol.
-        # First set our proxy protocol proxy as trusted.
-        set_real_ip_from 172.31.17.140;
-        # Then tell the realip_module to get the addreses from the proxy protocol
-        # header.
-        real_ip_header proxy_protocol;
-
-        error_page 404 /404.html;
-      '';
-    };
-  };
-
-  systemd.tmpfiles.rules = [
-    "d ${dataDir} 0755 ${deployUser} ${deployUser}"
-  ];
-
-  # Hackertours CCCHH deploy user already defined in hackertours.hamburg.ccc.de.nix.
-}

config/hosts/public-web-static/virtualHosts/staging.hamburg.ccc.de.nix

@@ -44,8 +44,6 @@
         # Then tell the realip_module to get the addreses from the proxy protocol
         # header.
         real_ip_header proxy_protocol;
-
-        port_in_redirect off;
       '';
     };
   };

config/hosts/status/configuration.nix

@@ -1,10 +0,0 @@
-{ ... }:
-
-{
-  networking = {
-    hostName = "status";
-    domain = "z9.ccchh.net";
-  };
-
-  system.stateVersion = "24.05";
-}

config/hosts/status/default.nix

@@ -1,10 +0,0 @@
-{ ... }:
-
-{
-  imports = [
-    ./configuration.nix
-    ./networking.nix
-    ./nginx.nix
-    ./uptime-kuma.nix
-  ];
-}

config/hosts/status/networking.nix

@@ -1,29 +0,0 @@
-{ ... }:
-
-{
-  networking = {
-    interfaces.net0 = {
-      ipv4.addresses = [
-        {
-          address = "10.31.206.15";
-          prefixLength = 23;
-        }
-      ];
-      ipv6.addresses = [
-        {
-          address = "2a07:c480:0:1ce::f";
-          prefixLength = 64;
-        }
-      ];
-    };
-    defaultGateway = "10.31.206.1";
-    defaultGateway6 = "2a07:c480:0:1ce::1";
-    nameservers = [ "10.31.206.1" "2a07:c480:0:1ce::1" ];
-    search = [ "z9.ccchh.net" ];
-  };
-
-  systemd.network.links."10-net0" = {
-    matchConfig.MACAddress = "BC:24:11:79:D3:E1";
-    linkConfig.Name = "net0";
-  };
-}

config/hosts/status/nginx.nix

@@ -1,149 +0,0 @@
-# Sources for this configuration:
-# - https://github.com/louislam/uptime-kuma/wiki/Reverse-Proxy
-
-{ config, ... }:
-
-{
-  services.nginx = {
-    enable = true;
-
-    virtualHosts = {
-      "status.hamburg.ccc.de" = {
-        forceSSL = true;
-        enableACME = true;
-        serverName = "status.hamburg.ccc.de";
-
-        listen = [
-          {
-            addr = "[::]";
-            port = 80;
-          }
-          {
-            addr = "[::]";
-            port = 443;
-            ssl = true;
-          }
-        ];
-
-        locations."/" = {
-          proxyPass = "http://localhost:3001";
-          proxyWebsockets = true;
-        };
-      };
-      "status-proxyprotocol.hamburg.ccc.de" = {
-        forceSSL = true;
-        useACMEHost = "status.hamburg.ccc.de";
-        serverName = "status.hamburg.ccc.de";
-
-        listen = [
-          {
-            addr = "0.0.0.0";
-            port = 8443;
-            ssl = true;
-            proxyProtocol = true;
-          }
-        ];
-
-        locations."/" = {
-          proxyPass = "http://localhost:3001";
-          proxyWebsockets = true;
-        };
-
-        extraConfig = ''
-          # Make use of the ngx_http_realip_module to set the $remote_addr and
-          # $remote_port to the client address and client port, when using proxy
-          # protocol.
-          # First set our proxy protocol proxy as trusted.
-          set_real_ip_from 10.31.206.11;
-          # Then tell the realip_module to get the addreses from the proxy protocol
-          # header.
-          real_ip_header proxy_protocol;
-        '';
-      };
-      "status.ccchh.net" = {
-        forceSSL = true;
-        useACMEHost = "status.hamburg.ccc.de";
-        serverName = "status.ccchh.net";
-
-        listen = [
-          {
-            addr = "[::]";
-            port = 80;
-          }
-          {
-            addr = "[::]";
-            port = 443;
-            ssl = true;
-          }
-        ];
-
-        globalRedirect = "status.hamburg.ccc.de";
-        redirectCode = 307;
-      };
-      "status-proxyprotocol.ccchh.net" = {
-        forceSSL = true;
-        useACMEHost = "status.hamburg.ccc.de";
-        serverName = "status.ccchh.net";
-
-        listen = [
-          {
-            addr = "0.0.0.0";
-            port = 8443;
-            ssl = true;
-            proxyProtocol = true;
-          }
-        ];
-
-        globalRedirect = "status.hamburg.ccc.de";
-        redirectCode = 307;
-
-        extraConfig = ''
-          # Make use of the ngx_http_realip_module to set the $remote_addr and
-          # $remote_port to the client address and client port, when using proxy
-          # protocol.
-          # First set our proxy protocol proxy as trusted.
-          set_real_ip_from 10.31.206.11;
-          # Then tell the realip_module to get the addreses from the proxy protocol
-          # header.
-          real_ip_header proxy_protocol;
-        '';
-      };
-      "status.z9.ccchh.net" = {
-        forceSSL = true;
-        useACMEHost = "status.hamburg.ccc.de";
-        serverName = "status.z9.ccchh.net";
-
-        listen = [
-          {
-            addr = "0.0.0.0";
-            port = 80;
-          }
-          {
-            addr = "[::]";
-            port = 80;
-          }
-          {
-            addr = "0.0.0.0";
-            port = 443;
-            ssl = true;
-          }
-          {
-            addr = "[::]";
-            port = 443;
-            ssl = true;
-          }
-        ];
-
-        globalRedirect = "status.hamburg.ccc.de";
-        redirectCode = 307;
-      };
-    };
-  };
-
-  security.acme.certs."status.hamburg.ccc.de".extraDomainNames = [
-    "status.ccchh.net"
-    "status.z9.ccchh.net"
-  ];
-
-  networking.firewall.allowedTCPPorts = [ 80 443 8443 ];
-}

config/hosts/status/uptime-kuma.nix

@@ -1,7 +0,0 @@
-{ ... }:
-
-{
-  services.uptime-kuma = {
-    enable = true;
-  };
-}

config/hosts/woodpecker/configuration.nix

@@ -1,7 +0,0 @@
-{ config, pkgs, ... }:
-
-{
-  networking.hostName = "woodpecker";
-
-  system.stateVersion = "24.05";
-}

config/hosts/woodpecker/default.nix

@@ -1,11 +0,0 @@
-{ config, pkgs, ... }:
-
-{
-  imports = [
-    ./woodpecker-agent
-    ./woodpecker-server
-    ./configuration.nix
-    ./networking.nix
-    ./sops.nix
-  ];
-}

config/hosts/woodpecker/networking.nix

@@ -1,22 +0,0 @@
-{ ... }:
-
-{
-  networking = {
-    interfaces.net0 = {
-      ipv4.addresses = [
-        {
-          address = "172.31.17.160";
-          prefixLength = 25;
-        }
-      ];
-    };
-    defaultGateway = "172.31.17.129";
-    nameservers = [ "212.12.50.158" "192.76.134.90" ];
-    search = [ "hamburg.ccc.de" ];
-  };
-
-  systemd.network.links."10-net0" = {
-    matchConfig.MACAddress = "BC:24:11:5F:A9:B7";
-    linkConfig.Name = "net0";
-  };
-}

config/hosts/woodpecker/secrets.yaml

@@ -1,234 +0,0 @@
-woodpecker_server_environment_file: ENC[AES256_GCM,data:68Wu0UOHBAGZHSJ0x4wbeDLm626jpumv9w6A65FNKsmzYp6P4/c4g1MF1agQd7l9nKMTRrgyJyfoEZYFQRX6lYSmcsQLfn++uh1JpFoClT5p/5hBkiDq4owUFU+NGUiyl6yjYlEiaxLwC4ZdyISHeEYpbrvGyIXLsFgdrQ0rVX3cCRwIMxFcyCG6d3MZVoqAw1A=,iv:y/+X02aRPBOoR57P9s7y/SijvXVLuiBBfFYqeJLvQEU=,tag:DNwK+M6s3moglkMkrWccyA==,type:str]
-woodpecker_agent_environment_file: ENC[AES256_GCM,data:rwp6TYYFJ/IZH+3pGhPxjdZMLoyPMr/W1RXm4IkUGn+SmIjHZcdFZ8nEhvOfnkfrXNPc2MR+X6NXUmVOcBjSCbcBjh9sC653UpKimt9I3/Ec,iv:X9JH7dmTayw8BaEsXYil3PrykCdd+/ANGHVfEyRvc7A=,tag:/ErkX1WnruanNgTTBUT6LA==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age1klxtcr23hers0lh4f5zdd53tyrtg0jud35rhydstyjq9fjymf9hsn2a8ch
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRQlN5NmlaUjR5dGJ3Y3BP
-            bW4rWm1KaVFsbytwZDQ1QjV1d1VEOEZlSTJ3Cmgxc1BmMnBmWjRyNmNDWmpWcnJt
-            Q3lBZUFOY3FtREFUYmhJNCtKcTUxY0kKLS0tIHhKbVVBYjN4WHRzdERNbkRQeHlS
-            UExiNFNCdkQ4YTNMdEdoWTdxOFZOZVEKZZbNpbyH31z5tyXeINqoNyqy8zvS3mp0
-            YFq6P8kO8CaqUG7KH6yWV0Vq4DryQ9vMcQBnboZOfPf9pZUvhacE/Q==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-06-22T15:55:25Z"
-    mac: ENC[AES256_GCM,data:UmDbmxSRj8YfCkKEelQNMJ8mzbu5aQdB9yOr9JfUh5TB9r5Z5ttZ1wgJDJqHNtsII3JGXUvbgHbsmbPikkrj4Ege1rrgr4UttN1rtgeaAKlZIlqb9pOnV4//GJL8jbxCgFp2h2O80G05nAXG54DaY//4Y5hfTyPzgyDlGQ6jlhg=,iv:5e8lpFfGAJh8lTFcY4MlZG7PgnzM0UycsU0tB2KN+zQ=,tag:4xUEHg04wjDbhc9MOItzuQ==,type:str]
-    pgp:
-        - created_at: "2024-06-21T22:42:59Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAxK/JaB2/SdtAQ//QR84p3zGjW2CtPcPxlmdYui5nx8FV3MHog4R24s4RKNK
-            y4n9993z8m3y2at4yIWDi4LBKrhm/6mSLBHfoxnuiptoaSXSWXfaXebXkYiinkyP
-            GMvwegN6KkRZh4stJMD7W0g7w/trkNEAvPDoInqCnvT4NomrKIV+ZrZuCBLd1tXn
-            JRd2tsH8yYzoZr/PJBBDTZtke/nbosb6drjgG6ow/eHyF++HxKNTWfjCiWn4AWSb
-            c/E1VWsigYdBs8XSTbBkfSLr/b5FcXYb8tyy4gpGe9zOrxc7cW5diK5+x4bM8FHz
-            85ShPA5S3PXXEnuifuk/ZK8+CEYWUS3MXUhuEFUo7F3Pt/Eb+5CtfTX6kvMe1xe9
-            iqFAsRce/qm9Evns4ygZ4+LoI2ro2HFwgQ2fu1gi7PyZsDyW5eRL5P+vfxPUOxYY
-            z9cXXo+U1NEzWMDEBWt4mgoW9URye6O3k+WLQmYbQIhDkftUYmvRrPYQvP282m4k
-            NMucRIRUMkx7rpRQQP8yU6AlgZ1LsOmruV4XJYVxsTpSZq7YgTQP4kd3wMgBhwOV
-            j3hGc9gI9Sq06SdyU0C8PuUHt+mZGkVnYIOTw6BXHgY1tK8X5XnWK4NJXL9bR0pY
-            kfzDWLjD0hiiM3QYqieTbnDUiVTDGyf7Cop+EifYvy7um+CPjlYLLkDkEsWcy/HU
-            aAEJAhDEzP5eiU1e01GSNbWL49ghD7DqZiYdo0F/BGMk6jQloM1HUDnkhgBhVSZo
-            TjNPV3UFBxeRnT5DvouD6uJ8SDs42ARdb4F80vJVHknt0yBvGWfCQsXqKwuRDd1j
-            zkj4zG7btJRv
-            =sgSP
-            -----END PGP MESSAGE-----
-          fp: EF643F59E008414882232C78FFA8331EEB7D6B70
-        - created_at: "2024-06-21T22:42:59Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA6EyPtWBEI+2AQ//V6IIW3Hr3xuQWOWitDGn1bo+x95jePPpXNayKGJuaSMf
-            00gaOyMpqP5hRd3lEQRyqHgPtmszlGrxq2y77CxnnZMbE6n+axwQQLoMzROBGyGF
-            iqe6hNbNFZPjWv5BTAl3iOHWrw3x/TpgcNmSBDfctU+CZlMWzCMuXJw1bK57wQd4
-            B6xcoBxidK55Ubc7GQ8mlAEuZ89fYorTRBfv2rBgUh8ZAAsUmn1jEz7HsQMMd2a8
-            5V4TzicdzXO2cZ+0DqU8Xqt5U9C0IjGgZRPzDYkh7slkbyYomAIfCq+zN5ieecz9
-            Mp8vvuMYfT66P+heNRZ7w/sgmGlarcmNKlOcXlakVYm5qVddPMx6M5Ovl4O5sABz
-            V4O4NRehYx0XFbjzXr59LCzpusS9xQoh49288dLTFudOInHUYq6ss0TbGfFJMDYU
-            mjHokzdG3ds8C9/lMR82X9rbyZDchUytHUwX4eGxUDMmhydFpgJko0bbozPbE2ll
-            NTlWegCc1yrkSGn6U9EYKtibitJnIMdas5HapcErMH2vYILsJOl9ifG1GIsuWe1+
-            ipPyZy7jqP7p18WCcDnUhgaGdQ67UjSLqX2zz0SZDcfI46SUeyeSelFVpTlmKriS
-            4bW6hC1FSe+bLkPZ0y5aRLgL5ipK6jdlZepAj/DNXdKAtchLHcddF3rKdBdzsxrS
-            XgFvvZPgj1JleYr+q/+ju4k1d4cE0HnQZIBnkAfKXZHwSPCw1d9vbeLipuRTJrEH
-            2CpOjtiXl3S2ZcCS1ama9lgAqPBOOoH7jgHvoCzqfkBsi3/QlIpQs+C8ro4hXE8=
-            =KZWk
-            -----END PGP MESSAGE-----
-          fp: F155144FC925A1BEA1F8A2C59A2A4CD59BFDC5EC
-        - created_at: "2024-06-21T22:42:59Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAz5uSgHG2iMJARAA5+vcORn/YX2bHcAno9KCUGTzeiCP/DOoSePMdsCAmABj
-            P8XoYJOyZoZgW3qgvtKZ4pLGB26FuJXC2y6Z3yyQ4Xj2PeBj1og9xM8p7GnF6T6n
-            7wqALwJOamyer3A+OXx2Gc8kZ0ObqgBbbn5QTPnHzsRljC3Irgk+ZZE8ZRshoPmu
-            6TEuMW0NT5INmijtPAxer/eaAor3KKxMTf+sqqr/VGNopAyFUCGZynlnjcei6X+T
-            tVKh6zqr/eaTlnhoP2kr4u+wKcHvLV8an8sfsyIGL90O11LNcX8Sf4EyPDYSXOe7
-            AXTFcvfw9+ALu3cbTVPN0aI2e8fCir2S00F8x28Ffc2xDSrXjWEDCXLuRNVXz5KA
-            Mjq4afyQN6mtVZ6ZmtvaLQoG8D2f2sGzvrsBjaXwxPLHKPpUFZVBiiP0C08yokUR
-            7FrYaOjnvQVALLxGJMAhMf02g2dYDFxMw18cY2a+bLrYUVd9EMbuFwCJNzmU0of7
-            EpSvXrA0wTKddk+vL3JoJgIrOxz2IQbaC24NiCUzbyakhT+qDX/oXXILxL2x0GfR
-            RaTL1inkTQO//ooAjlPeMA3OIDQo5CdoV4VlvSUgagYfDvMfDCAO04Xxvezh1uvz
-            //4Jz13+LFoUgbtVUYiT4oqWyfTKOV0D8ILYWKZJtjJt4TeYpEfbQFEzIYyF3OHS
-            XgE7aGyB0ArPBovSr55eQGmW+FaeG1VtH7TRLU367FyQmGep5O2SUxQXqFFiWyDy
-            bseIYdRqNsmlgdXBnADdkVCFJtF4C/VA2DOk+wOO8XtQoMQ8zrIl+0Viq1s66OY=
-            =xc00
-            -----END PGP MESSAGE-----
-          fp: 18DFCE01456DAB52EA38A6584EDC64F35FA1D6A5
-        - created_at: "2024-06-21T22:42:59Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAw5vwmoEJHQ1AQ//abtgoFEWd+zbeSbiwey8nCNQUSklHV9kbLuBK8+ipX/Q
-            qjweWnnPVN6ODhgfXm93k1tSqeJjYqjqfxVsAEUiXC61UhvS6JBZuVUt4nRUWHk2
-            cdu3eKlBx7Nhm6th1gZ+Wf7PcryT5fmJQP5a8VEM/nUuRjnAmG7RuSiWbNzBbTDx
-            4jh4GTvlFkupxZvLsXYf2T+7qn0eHymdQI8+5WSHQH6kApBvINYoq1m55it5ilEp
-            M0tYNFMzi10OjKVbNRQXuKhROzzYGtW8qWGtc33WBB5rvkRVelSDmleTbRywWjE0
-            rNo7vj97SbmGdCHydzcEwPIBOd11ZgFWpamX/36ALeKCxgHgc3HsnjIkDsEffpoN
-            SFHAhyYqXTDRqq5/HuBQBDBJLVVcIbqlJo3us47gI3rhojjSayzTBd5TnGOZt5N0
-            rFOqoZ1i3vf3C5sjKivTzCJ/P3yFgD271hQjv49jSqXgSF8ZIvzaDr0xLiy+XnZ+
-            EsUyqxZBKWy246BtyZ4qBvRjVKbezpxQFh6MzxccY+toUaG2v2I5muvFJRHe7qEA
-            fT6XDl7W6aQ/RBL/Ij9OWYvCMWS27mzkLQi0uBH5gyA1t6Bg9O6+CjGpK6Mmd8fx
-            1Q2Ml5ClzLnEq94FX3f2hpqLdSlwREPoBYULeJNr+WhayDvfRjuh5+MvN+wjbs/S
-            XgGYwgGCrFmzXN1mWElNGc3+3sMEpiuvJp6Z1nRfr17YvIPUrtCU7zVHWR1lWFKU
-            gjJacBX/Qw9Kly+5jADM0UorWkZxaby+q+j8rN43nPatjDlDRI+BrNta0l0ulOA=
-            =2cbn
-            -----END PGP MESSAGE-----
-          fp: 87AB00D45D37C9E9167B5A5A333448678B60E505
-        - created_at: "2024-06-21T22:42:59Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA4HMJd/cQYrVARAAu8l79uJlVLz++foLhk83zrPSZsX+1TQduJl06Kx2VrJ+
-            dZX/0okzpHmHeZGhGH+e1Gv7MpyM4UxAGwE03NIk32p43LF/biad0zc4TB8yr9r6
-            N3Sr/ZbaB0oYC/K4r1Sj8W1XWmuYZB8lc1dyfwhf96KIXGutvG22O5XI0pOA9yHL
-            x4AWt8OHYsaWCt941M6pbFtBsJEl/TaKgYF7YNITvsfj/oG7cPESKLOkcJdmhN1r
-            ADpJRcs6rVvMLWxUBjZICqZvDlwnXK5gCu30MmLs/oQbFmHjBRB01Ird+Mb5e6l4
-            vrYC+zO3RG3dZ+VXJD0rBn+56nDMtiKISJCy4I4Vz/ekwx94cIci+BlD9/3YYix7
-            HVgR6flBgInZEvaBxyj2e0G5i2gKvYTfea5+6bwPpszLUaYba/YLQQ2mSXcwWPsV
-            ipuNSjJ8swK2OpOFTfzs7Ua1OZChCOhhduxiKCwASYrbncfexObsQfeobj3wrwXH
-            N4M+h5ghm+y7UFKDW+gfN79WGfltWiMdy9vZNwwEYF0NE8jkwPfIt2dLvyU73MFU
-            NivYWp6kUj+gbLkb3gLClAi4CyYqNQyBjbKEbt+470UIMZ44WWMEJy7bMwAVzLBk
-            VxBHphqSuP04pgb5a+PHPApCZC6KEntnW1zX+DKrCn3/+NhoD6COhCvetWxq4f7S
-            XgFop4XZPWYJb6ypqkFLbkHIg7tCbr/xae4HABncVj0BaS1Z7TBdMiGi8SQvHti5
-            70rNGZIpQe/59DmBrLT06VdQRY5rt20bDoN+DaUrE2tc0k5h+uwI71TG4//Db2A=
-            =m4ec
-            -----END PGP MESSAGE-----
-          fp: 91213ABAA73B0B73D3C02B5B4E5F372D17BBE67C
-        - created_at: "2024-06-21T22:42:59Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAxjNhCKPP69fAQ//Tz2g90bOkkY942MaLO5/k8MFMf4QEDMZAiw9tVZ39Rqf
-            udMTcGyOX6zLzr+xxNX3gwn8X+bl0yw4Tg/FiyOzl9RjMZDxvzUaj1gYZI9kKPne
-            aEmAYcP2mv+ITUDnApZonDZE5hUnLGAyfEZMU6ExF9XkU94dXFdU4nd+gF5XHzou
-            STiNryBYaxWP1WMkW4SlZqdJiCfrkI0Z7iTF86QtXN5S8qLSIyjP3hIv5QxJg5Xo
-            NwK5IXQhV/0ZHp1Wl8Xys2iUw3iuwPga7sBrMHdJ0PHVBg3Wg/bG7YtrfEAfUbcr
-            UHt9rNGFZluuqNctvcvkSUjv5DISCgl8lSSbzC8DK/vT9o0DQYWvySNpVwXO3tqs
-            9aCxKc8trCXrd9qePnO259Ni0ALRjyh/GHZipzhZo/mgyUWc5nAdTLM49MsmAKHc
-            PnBBSntXnVHfFoFvgyBAmyISVuH/L5j8mezQ/37AevcTfuWemjDRGWIiIJZ73CyF
-            tG6ida5En9QouMO18gKBBzfR/2s6tt60bEp4bE3j2rRgEhwblBfl1NtGSw2WGVVZ
-            bU8KormLDT8aurMIp/Rd1pzAxDpEhDa13TV1IfRECOQvY35aBC59upt+XLwJ83ch
-            Zgi5cRGtSoj1G9OziQGCtJjGqkZoFy7Htou6AyFUEln+2Px0EKGJC3yCUcOF0orS
-            XgEtK2wEJNnJ84LctjrRM4ZSeb/8nycfWiR9riJi1lq6J+WSeiGME3cvhgObDTtG
-            EwuAjG6vhwUdr3aovsENQhvHnQWID844CeBtB9jMHbFJy41vbt0rC0JJG/6RoRg=
-            =5Ijl
-            -----END PGP MESSAGE-----
-          fp: F38C9D4228FC6F674E322D9C3326D914EB9B8F55
-        - created_at: "2024-06-21T22:42:59Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA1Hthzn+T1OoAQ//dwisvTFgYUCFICbaNZ+8jttF4lTQ2fjdP6UHb0evav84
-            PUYpqUfmMF1BUvxDx0rwzzP1OaSKuesxAG46i1Nha1Tq/LOURtzZtXPW4+xSHWge
-            ifbcbGTBkACviKkRuVUqaQBAbzDnFIHtcQy7nbILmzM0aRwm1IC1WzKpPRBgzAy0
-            o/UE4geZjPuNqkix4mcLz8sXvKMz11FE3QpZ44JqiRhmAITTDVo2ymhbvA6R2C1w
-            AL0tjJwKRb0qfoBegyPbuUW399l3CCtEE7voW8AxZ3Y6EGO8DQ1i/MkR81zymFep
-            PUDVYDmhqmh38Z79v5iKqnruzS+rOaitzMRqsUfOJfa4UoFkjO6tYdi5cOY8T4cD
-            w0rgCpvWriaGKGHDuRIdu031GFyf26+SvOWEbiOhMv+h18Hj5P7uT+Is+VuEhHEo
-            i7EYTqzsRwyIfybNkb0mBVluvXb4CpZRdRq5AzC49qu4IezvKoAT99KG1yf7XJvI
-            Ijc/ZITFqCBxE7REA4JBDuivPHfML4CgxG+5PiBJ3JDdaP+xRuoVQQv5E55Y4YwF
-            NM+NTNcvsTv2vKXJ8mmWLBn9xMxN32gmDyy7jW0elW46AQidIL6C+W2Zhxn6GNvc
-            2faDhNQ3yV0A9mIsgQjdWeQemqhsiVU6Sg4Mmattm/b6plGCM1DIcJgMV2RRAobS
-            XgGt7zD15Ju4S+fQqL7MVGGD3y5v0C5eLx78MScygpNQKS0vfTfTE2+wRCzCjZAG
-            /6HU85E6ru1VeXc0TwQBrpX3Wi2ga/momalsCGoh3oHBd+jRqzwpRxojKLy65qU=
-            =g4RA
-            -----END PGP MESSAGE-----
-          fp: 5DA93D5C9D7320E1BD3522C79C78172B3551C9FD
-        - created_at: "2024-06-21T22:42:59Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA46L6MuPqfJqARAAmTOXbn+qa0wgjSvK3juGqVemxKvaD2zFG57ivYdC1Jdn
-            PIVi5aBCvZ8KY/0W9k83LVcGUY1f8eRkCU8ohJU+rmRbiTvT0qo1hfLzxrqaNbke
-            gN+YsYW8bgXioF6nHVWI158GvqNfmvRl4WyJzBQ41cAyMpdGXiIzUoCba3Y6f+1N
-            muljMhgvEtWUddf4zheZX89xV+aLa9Mga6aQbwRcL451UcKxmE2nk4+00rMn7R7R
-            vmsC677/RrKkI7RxubzCVFFlzaH+ZZ1Ott6ozKUWs2vCcB6vTzwwvmrJwmr760lC
-            pozfNp/+WzLZOkA3rO2qAvIUc1DxYA6CgukrAAObCbvmcgMeLtVR29wwWs01qxI+
-            cTxmH+btbiM0PL8+/sW2KlC19hfMmeryiJXxbUN30a3fMDJz1wVor54DsaqG9kIJ
-            zIxGsQ6t8fzfaVfeQwoxODnTWqUClWCY4is251O4Gxw3C0oPWZvzoPvxljaPrYYY
-            SE3dcktWmGoOxLj56lLfceKq0qAtYmJD4Q5k2GDYYU+8dwp95UTf0lbRwauMBROT
-            OMe4r/emH4Z1LiG2/HLoM4QuV5VVQGSAqoE3c42YjjS9uh/aOtmeNNLehwS93F5E
-            J/bXNY6VnHcALRGMZF60g5OxM3QUioNkGqcCWGjSaRPcKhwaXvvIaTCdz8apnBHS
-            XgHeuszpU9/O1nCsNPF2vQUjcNxz+KsL39RwHCVJBVJskxd4HcJQUM7uArV1Fjbk
-            fl4nQuueBrZ4tXzimRK2QOjgy8F2n/Kxpjlr4rXn+Pi9jyhx0Jq4Blu3wrR4LAg=
-            =4Xvm
-            -----END PGP MESSAGE-----
-          fp: 8996B62CBD159DCADD3B6DC08BB33A8ABCF7BC4A
-        - created_at: "2024-06-21T22:42:59Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA4EEKdYEzV0pAQ//fo1yfBspyD2O84d8UCHWoUJTNYql2p26H/vC2BsVzAmL
-            6nylQACeslISLlXbrW+ILPOFZ5x21THOFcJdvCGAQAkY+jC7Ry3D2gwsZi/RLFpP
-            wbEgbzk9hcimmvuHW/NJtrqvXiTJy7GH7el5Zwqe6rtUkTW5IUtaOmZjn2fQBVoq
-            9mMT86vOYlqgIISG1o5x4pciRd+fb3JPiPeJiLcyUBEXYqg2THlyYwwp2paFomYf
-            a6Ls/pVT9ICSblFlnfILOexDpqhxcPH+V2nwlbSlOETq3ACcVIgufIRndTkGhDzi
-            HS3GlD5nIb/ep12Gj+qOgKZBsbUdNIAVojNY2qlK2yQJpE5B1aDjmkAZUkk/LqF3
-            76ZRBDzigU0jfYKh2iGDY3F8cWDsRqjqcTjVB9KF32+1SeUAO4NqDnDpMZgBh2i5
-            rvDOJCJfTgo7DfPqWPyeFM58sow9EEglygASA/XTaDV+CmLzRlqxwlJwpbRrz3OV
-            Mp1gewfGASLPS4xh6gtROac9DAuokmN5VgNg2g+emN8lUNJ/7V7u30TvCEfGP0j0
-            1Sd6RrNn/ZDMJtOoE8gDua6njbOi9Zk/RN4Y4NKWcmiNZxz/Xi/8XU7F0yk0yEL1
-            DUxYsCEHImib+lAESQ0fF4VMXx3DSXq2/Yt5z782ZvgNrGoGw3B9qVA5FyG5Bt3S
-            XgGgfz/6fGZ0DEtTv3B8Rhqbm6TvwPFgIg+3WuQRXxf3rjjoX1AN0jcuz8OIIfGk
-            o1GuRG0/sYg7P32ysgQMvS1F+rX2PR/myHsz4YMM10soG7OduHgXmiJ0eUq8EtM=
-            =WLCQ
-            -----END PGP MESSAGE-----
-          fp: 9DFA033E3DAEBAD7FDD71B056C7AAA54BE05F7BA
-        - created_at: "2024-06-21T22:42:59Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hF4DQrf1tCqiJxoSAQdAUMjy8rV2Zy5nmeMOBsANIUVyhAvVBUF1yunc+EgVeVQw
-            yd4hPHMnQSkasXmcMDS0y2gwixgTOeQbG5PaOr0FA7eGEItLlqwSxz3+GnuD/gEw
-            0l4BFrUbimEX+/tfI8aymapMVYXFXWe4dUZw9foKN5HqkpPKhusozd9bqPPNKggZ
-            09tvIJViKP/QufK0WyLYZGWrG+leogDX39GBtAU1SOllFqtq2G0X1qH+s88GVpaO
-            =hxWV
-            -----END PGP MESSAGE-----
-          fp: B71138A6A8964A3C3B8899857B4F70C356765BAB
-        - created_at: "2024-06-21T22:42:59Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAzdAjw8ldn6CAQ//SK6MVXhRsRxYV8jL9HrVTovc84kNFr24nbHHi5z6fuCA
-            6ZjPr5Btx5Xxi716mEmdDBUSGfeJOOSt6hw4fCqj5ehnCeMLr9GvmJdZx9s2n88m
-            h4Fzd1XF67NMbSAYMPrXpk5dlxBNsgmsAWTaEet9gqGWWYsrZHWPvae7z+GaJJzz
-            h3dix5oVV3tM2OVP9hFhRtu9tv9a0sj5Eu6mz8UsDFwEPynlSDPKUQA0jFTXJnYo
-            yT8UTPSZAUlwnU88JPIhHKCmU8nqUIgDURVNgK4BsuoKSAZ27ueSHr/4IzBiavVD
-            6V1b1Ttt8usKFp21OCqfNuoiIeEipUdLMFSTjSXqOp38QTaqoDaCsAPc6j3HCvlV
-            vMm1lbSKK+Llpk9WOmqvHQriL50lQGYpa2X/jS8FtlotKFm0uGJoJXZ5Ujc4Wmy9
-            J79/cXLULGFCxdPsoxmd8wJFqz0eiVPHIBFB2Y8Tan+Mg44WeBuY8sAWGzYPp+kB
-            sEOIQ5I9N1Gt+58i1hDTRlqO4I8ihusqKeRemJa954rlzz8YTmZL+JAD5gsMtzuH
-            gMjnfBnNJKw3UmnHMMQm348CRB6SuF6rmjc7Xk1qsnie87HtYbM3dJYh7ixddr/a
-            kTHy66zDX4j3e/y2JdEPQw8/WhhdGnyj6eDioQLNFfvApI7doi5C+XDCR08YxJnS
-            XgG0kP/bfDBkwzzHkr3khuvdtmUEmsxGbR/3abyjLfvM+g3HM6Eqq0uDwuGgYinR
-            DYfWUZTas5uWrgxAWYbBCbhPcevu7CsyJFsBtG4ExTXPSsP2c79+LwtmJjbLQqo=
-            =9C2P
-            -----END PGP MESSAGE-----
-          fp: 3D70F61E07F64EC4E4EF417BEFCD9D20F58784EF
-    unencrypted_suffix: _unencrypted
-    version: 3.8.1

config/hosts/woodpecker/woodpecker-agent/default.nix

@@ -1,8 +0,0 @@
-{ config, pkgs, ... }:
-
-{
-  imports = [
-    ./docker.nix
-    ./woodpecker-agent.nix
-  ];
-}

config/hosts/woodpecker/woodpecker-agent/docker.nix

@@ -1,12 +0,0 @@
-# Sources for this configuration:
-# - https://woodpecker-ci.org/docs/administration/deployment/nixos
-# - https://woodpecker-ci.org/docs/administration/backends/docker
-# - https://nixos.wiki/wiki/Docker
-
-{ config, pkgs, ... }:
-
-{
-  virtualisation.docker = {
-    enable = true;
-  };
-}

config/hosts/woodpecker/woodpecker-agent/woodpecker-agent.nix

@@ -1,29 +0,0 @@
-# Sources for this configuration:
-# - https://woodpecker-ci.org/docs/administration/deployment/nixos
-# - https://woodpecker-ci.org/docs/administration/agent-config
-# - https://woodpecker-ci.org/docs/administration/backends/docker
-
-{ config, pkgs, ... }:
-
-{
-  services.woodpecker-agents.agents."docker" = {
-    enable = true;
-    package = pkgs.woodpecker-agent;
-    extraGroups = [ "docker" ];
-    environment = {
-      WOODPECKER_SERVER = "localhost${config.services.woodpecker-server.environment.WOODPECKER_GRPC_ADDR}";
-      WOODPECKER_MAX_WORKFLOWS = "4";
-      WOODPECKER_BACKEND = "docker";
-      # Set via enviornmentFile:
-      # WOODPECKER_AGENT_SECRET
-    };
-    environmentFile = [ "/run/secrets/woodpecker_agent_environment_file" ];
-  };
-
-  sops.secrets."woodpecker_agent_environment_file" = {
-    mode = "0440";
-    owner = "root";
-    group = "root";
-    restartUnits = [ "woodpecker-agent-docker.service" ];
-  };
-}

config/hosts/woodpecker/woodpecker-server/default.nix

@@ -1,9 +0,0 @@
-{ config, pkgs, ... }:
-
-{
-  imports = [
-    ./nginx.nix
-    ./postgresql.nix
-    ./woodpecker-server.nix
-  ];
-}

config/hosts/woodpecker/woodpecker-server/nginx.nix

@@ -1,57 +0,0 @@
-# Sources for this configuration:
-# - https://woodpecker-ci.org/docs/administration/deployment/nixos
-# - https://woodpecker-ci.org/docs/administration/proxy
-
-{ config, pkgs, ... }:
-
-{
-  services.nginx = {
-    enable = true;
-
-    virtualHosts."acme-woodpecker.hamburg.ccc.de" = {
-      default = true;
-      enableACME = true;
-      serverName = "woodpecker.hamburg.ccc.de";
-
-      listen = [
-        {
-          addr = "0.0.0.0";
-          port = 31820;
-        }
-      ];
-    };
-
-    virtualHosts."woodpecker.hamburg.ccc.de" = {
-      default = true;
-      forceSSL = true;
-      useACMEHost = "woodpecker.hamburg.ccc.de";
-
-      listen = [
-        {
-          addr = "0.0.0.0";
-          port = 8443;
-          ssl = true;
-          proxyProtocol = true;
-        }
-      ];
-
-      locations."/" = {
-        proxyPass = "http://localhost${config.services.woodpecker-server.environment.WOODPECKER_SERVER_ADDR}";
-      };
-
-      extraConfig = ''
-        # Make use of the ngx_http_realip_module to set the $remote_addr and
-        # $remote_port to the client address and client port, when using proxy
-        # protocol.
-        # First set our proxy protocol proxy as trusted.
-        set_real_ip_from 172.31.17.140;
-        # Then tell the realip_module to get the addreses from the proxy protocol
-        # header.
-        real_ip_header proxy_protocol;
-      '';
-    };
-  };
-
-  networking.firewall.allowedTCPPorts = [ 8443 31820 ];
-  networking.firewall.allowedUDPPorts = [ 8443 ];
-}

config/hosts/woodpecker/woodpecker-server/postgresql.nix

@@ -1,18 +0,0 @@
-# Sources for this configuration:
-# - https://github.com/NixOS/nixpkgs/blob/dce84c46d780b20c064d5dfb10d0686e0584a198/nixos/modules/services/web-apps/nextcloud.nix#L1069
-
-{ config, pkgs, ... }:
-
-{
-  services.postgresql = {
-    enable = true;
-    package = pkgs.postgresql_15;
-    ensureDatabases = [ "woodpecker-server" ];
-    ensureUsers = [
-      {
-        name = "woodpecker-server";
-        ensureDBOwnership = true;
-      }
-    ];
-  };
-}

config/hosts/woodpecker/woodpecker-server/woodpecker-server.nix

@@ -1,44 +0,0 @@
-# Sources for this configuration:
-# - https://woodpecker-ci.org/docs/administration/deployment/nixos
-# - https://woodpecker-ci.org/docs/administration/server-config
-# - https://woodpecker-ci.org/docs/administration/database
-# - https://woodpecker-ci.org/docs/administration/forges/forgejo
-# - https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-CONNSTRING
-
-{ config, pkgs, ... }:
-
-{
-  services.woodpecker-server = {
-    enable = true;
-    package = pkgs.woodpecker-server;
-    environment = {
-      WOODPECKER_HOST = "https://woodpecker.hamburg.ccc.de";
-      WOODPECKER_SERVER_ADDR = ":8001";
-      WOODPECKER_GRPC_ADDR = ":9000";
-      WOODPECKER_ADMIN = "june";
-      WOODPECKER_OPEN = "true";
-      WOODPECKER_ORGS = "CCCHH";
-      WOODPECKER_DATABASE_DRIVER = "postgres";
-      WOODPECKER_DATABASE_DATASOURCE = "postgresql://woodpecker-server@/woodpecker-server?host=/run/postgresql";
-      WOODPECKER_FORGEJO = "true";
-      WOODPECKER_FORGEJO_URL = "https://git.hamburg.ccc.de";
-      WOODPECKER_LIMIT_MEM = "6442450944"; # 6GB
-      # Set via enviornmentFile:
-      # WOODPECKER_FORGEJO_CLIENT
-      # WOODPECKER_FORGEJO_SECRET
-    };
-    environmentFile = [ "/run/secrets/woodpecker_server_environment_file" ];
-  };
-
-  systemd.services.woodpecker-server.serviceConfig = {
-    User = "woodpecker-server";
-    Group = "woodpecker-server";
-  };
-
-  sops.secrets."woodpecker_server_environment_file" = {
-    mode = "0440";
-    owner = "root";
-    group = "root";
-    restartUnits = [ "woodpecker-server.service" ];
-  };
-}

config/hosts/yate/configuration.nix

@@ -6,5 +6,7 @@
     domain = "z9.ccchh.net";
   };
 
+#  users.users.chaos.password = "yes";
+
   system.stateVersion = "23.11";
 }

config/hosts/yate/default.nix

@@ -6,5 +6,6 @@
     ./networking.nix
     ./yate.nix
     ./service.nix
+    ./sops.nix
   ];
 }

config/hosts/yate/networking.nix

@@ -1,4 +1,4 @@
-{ ... }:
+{ config, pkgs, ... }:
 
 {
   networking = {

config/hosts/yate/secrets.yaml

@@ -0,0 +1,233 @@
+git_clone_key: ENC[AES256_GCM,data:Wss8NtyYXOmQ8fYbqKfbGQ+5l+ifNznis9OJ4p2HRPsExOFvgHH60t+D/gsOPTiwL0fEQKQn008Zo7VpIEhKIQM0fW3cd3ED3Tk8QX4hDRxyLl/lql5MlhTm4UMY58rNMBXgA88oR1lozgAa39KMH0MRUoSzrhvecwnAHO+RjZGXBN5zYIorqBVEk5h+1wUGSlV1TroZX9u0cWt11eH59AgKY/oP5mOrgA++E623Oc/DnTxlLbR//lFHW1JPiBSUFMP1ck6fg4PwnADYITgr1B1zdJz1J6jNC+n6S9bKDPnH5bvqmpvJIRmimxR4/R182RkIC+TBhD850cD1y9KSZa0Lh3DZ3LPrqGtZ6MHvpCgY/wPiTUANv6CJPcOAoskaaW57EiFl0ev3Jc3A+XFM6yqQOmmvNXx0hYz6ltlvtsltOcmz5TWooijwTaPS5UEwltYalrT9RNmC/ODkBRkSvuLEBWYwnu8aeo2f/+IxciG0PldDJED2ud6HSkDEXHcPCwodScpnk032Jrc+0qtI,iv:tCo4f5u/y/ZrAfT1N+eUNLy5pKAg/U0xa3cNQmzUgFs=,tag:03HK65hWjYnVzz+7C+HmsA==,type:str]
+sops:
+  kms: []
+  gcp_kms: []
+  azure_kv: []
+  hc_vault: []
+  age:
+    - recipient: age1kxzl00cfa5v926cvtcp0l3fncwh6fgmk8jvpf4swkl4vh3hv9e5qyqsrnt
+      enc: |
+        -----BEGIN AGE ENCRYPTED FILE-----
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4Rmg0UXBXcWcyRTV6ZGlP
+        TDY1RFBVaTlVQnJVV3NnU1ZTeEJzb2xsZXdJCnVFSGF0UjQ1OUpxcVNVb2F4K3Uw
+        KzZRYWtTaTJFd29zcmJENTRLMmZsUVkKLS0tIEdGaHRaOWFyeTMzSit4WFh1UGVS
+        bkRxanFoekdaQzZnSkFjNmhwNE1EdkUK5scD+5qe0QJvsgPHTrGQ4KrQLC8EHex1
+        xpImRJ0Y0R3e6p/WLwYbF236Ju2Z4f2Zg2Zw9/ErdM1McBJ8ll6yrw==
+        -----END AGE ENCRYPTED FILE-----
+  lastmodified: "2024-09-08T18:35:07Z"
+  mac: ENC[AES256_GCM,data:tyrfhBaTKnp1lqSPfkErk1UFoI7v/1az+zl9g3XoZ5Apo3CRixdLUldM9sYXqQT5WNrgO2NyZHqvyQOnFZiJuNhlYFSQbgwFFm3gz45BV8Do7QAhAG7+Q6q/Gz9VAqePQJlmzbfeL5iqJC2jhrcGIutO2cI22QULLkBzVVDg1/w=,iv:ayLonGC1F3vp6bh4pcAps6BvMzrG/yT2rPGAcUQ1Geg=,tag:1fIaRIFrzDTSP+oIUHABgQ==,type:str]
+  pgp:
+    - created_at: "2024-08-05T20:33:02Z"
+      enc: |-
+        -----BEGIN PGP MESSAGE-----
+
+        hQIMAxK/JaB2/SdtAQ/8Dx0hTc0zZkd9+RXuKOXU8ZkKF54lcxfDTMH0rD2bKPhg
+        do/+I4VOSJxfyTvzFNjVXywSCEsws2+RyS73jF4048o4DrNQNG4P70GqXAqjDbQL
+        r+WCKT0if85JYPo/ho8nSRumo44BlbN2+Ftc5Z90UshW63VPU4Xm1Woqm8TOvs/0
+        cyhsigShwJGymnIEY4PwdT6fd/gkVVaoC9nCrkkSbaQZa1rXHud8+jLK+4TXebKl
+        Qk2G2cVivWBioT4wGjhZvQ6lLK4mlaqxiZF3aRYcUs1Hwgq1ZolbgiGPWG4xisFa
+        JgsqYRnmGnTM/33l57Cy8CpVHfprrapUXh2X2Ly/pBRQn+ns2zk1wkpTUHbwmyQi
+        ETLvw68PXbayoDNunMqZl2RWPjPnotNVeG5i2s+pwaEoDKAWcud2NPUWFb+gyftk
+        YNxMdp1CpXXOHpU4Ty+HHXAU/uLVVzLT91RLJAn+Y6rRyevg4UBSB/Y+lc5IMTfa
+        QPPLRPV6/P4LIWDlOdg/S3Q7ZwryNAogU/Hyuuz2xyS8LK7S7M0+BgVBrOkowazy
+        aGemt/BmQkyPQDpJTPxtdzsK1vvplol7uJnNou1h0krrgHlAzb++3i8+V4Z18dBg
+        GSeWIdSm+OD1HPDyD1054wEUAgPfRh0TZma+vDirH4RDH0tMubRGOLl17nV+/v7U
+        ZgEJAhCYgHEjsPDIpUoHopF1vkhxmhv6YqILLzDftbbmDQUqncs/mgnFCJPNnKVJ
+        ldwNj2kuAd2L5VRI0E9k0ZVzg/Aqb8B2wSTiJmQGWI3b0tNfGuC65fe7p8ceJ5vZ
+        et8Y1DEjVg==
+        =u7aP
+        -----END PGP MESSAGE-----
+      fp: EF643F59E008414882232C78FFA8331EEB7D6B70
+    - created_at: "2024-08-05T20:33:02Z"
+      enc: |-
+        -----BEGIN PGP MESSAGE-----
+
+        hQIMA6EyPtWBEI+2ARAAsrHbA58mnccH/oWDgoEqwJx+ZkeSWo6Arc0nMhU/Qh+9
+        Nl/pKdKm3LsIwkKTRVGDxI4vFRo42LFZE47nyfa70G7GiM1uJnEOx6vLTN0HpL6S
+        YQi8Dbb/+WA7QnGDfaEiozGQzsPMAgSVAE3A0rlcLBqQwiGsfhHr1RwEggfXqMG4
+        twxWIbKI/8T088b1IFs7fOKxzEB6na7+HoNaG22jlvRY0irMfgti8xeflWmZIKf2
+        uY6gM2rCOtCSi8vZEhJiXb5SG1NbyMmVHsz0ZXHwwGsiDACFqISqfR921B0Cuftx
+        Nj2pIwKbGyOOsFjlbC3ZGUMplLzYpRMx8LetLMrksWSpzypWdeI166gjF4MncUlQ
+        gl5hM7gL/+6k86yxIqTeexVoU24NRcsYCnQKZAK5T2fxQxX0BXppWxju6Jq1erRU
+        JZsggrbxELMJfcyrDC1cH/zgAM1kqOi32ZaGiO3U1WA5fxhJPUy5kxoQXSISL7Ng
+        mrnnMKIWK7eClQb47a/lYWEIqw1UjJhCPmKVHlcSmiH8FATfr5KjHeFlK8Zou5Ji
+        yMbVS7s2P9MeEzdnNC8PSFwjM9K7qXuWJYvDQtUracfxgO3X0r7Z+5g62WmLVDcp
+        E26DzDyTrU6Vf6WANOg/V7C7paOasnpcaU62/C65BBtGH23mgEfkJSkBYJWCea7S
+        XAHLeksa73OaeO28kTspM4G/Nlh65lr2p92gmcpbqkARvw8dIOUrAqPMRjJHabZq
+        vLbFx/uqXDPfALVXNWKGZp3vObGPLImQ1EfjVCYzOlkXXnfVdE+ih9+HIYhX
+        =advR
+        -----END PGP MESSAGE-----
+      fp: F155144FC925A1BEA1F8A2C59A2A4CD59BFDC5EC
+    - created_at: "2024-08-05T20:33:02Z"
+      enc: |-
+        -----BEGIN PGP MESSAGE-----
+
+        hQIMAz5uSgHG2iMJAQ//c9NMv/m/qGaJR+2jeu5VAbPwqIfBbrAEiV2s6TlzJRLz
+        7yEo9l/wh2WV+1Ew9dM5Pe8cgezjNaXgCeV8EEMu6dzOb1N++3TQJ7ET10DaOVec
+        ofEwDUYj8UHmV0VmhOPWLpceAod5wk4Xm4rlJTFjQ6TKN8U0dBoGS1cxHWwWw8oa
+        RebdNmpfSgkj0ohbeD9owxQ7JhqGlOPo1JCz7YI6c6bwQ1wuOC/XqnJt4F5ny8ty
+        y/qj1m9KrL5nRRc06qxNtmYODMuS+OeScfcI4grX7wMTUrqaFkCVHcboi5ZD6DzE
+        L49PT51/KK/lOlgKjSDfGgRRj9a9UO+7IXnMG0/5kDzRRBJDBzZH/5rujP8ffz+8
+        glxGBiBhsLroHbwn3a4BlDHpnuqCKa/7CmSyfGCNPp0TuMPvCVWf6muXA86wo5fQ
+        B/qKjvJV15qWJXdKDYyWJAg2B78/dROYbX142R9wPitP8zyj8b3jrzIcoIViAvkl
+        L3ZnnhqZxzkKcfc2rBsdadBEquz9+oGj6rKARyhFkT92in6zZO19fBZqTH5y/QYl
+        o0bDAbdQKJf36Eqh8G102z2x/Keo7gK/PWwwOi5YrFlgDVk4oBqAHWRgBiEvjSaO
+        Z7Ork1eeBUuZLAofzMoNNDaZS0KBfEgE3gczGpcRjjIwTDSIXM8NVtz7aXwZjUTS
+        XAG89qkxjGjlnJcRrE6izhiNbepWaOYYWb57VB5jL0TciQJHR7nbOGQh0T+tNKcb
+        fKyxZOL8IdGpoqxsRCuaPE5cEwc17XKuu53CfZo9t6hjh8SwRKWGnk7dkYhy
+        =vqhH
+        -----END PGP MESSAGE-----
+      fp: 18DFCE01456DAB52EA38A6584EDC64F35FA1D6A5
+    - created_at: "2024-08-05T20:33:02Z"
+      enc: |-
+        -----BEGIN PGP MESSAGE-----
+
+        hQIMAw5vwmoEJHQ1ARAArape3cqNbLeWh0YdcG9fBcuzyrTGntyD6ccl9Wwc4aTd
+        +uNMhCl7758tETPPK4qneAYNSnbnFQcgKj0ATkVMhMuT58g15GMEyXvhUsIukpQ7
+        Ca5t+aVh1fmb1pvcWPd4MUUQzt8KKN99+0KfyWzvdsb2jUBKICG3TQvTWXT93+g4
+        LjG6TCW+wv06nTquaCEaR4IdEPJRfZEspUXDhi2Wr/AjXIlvfN/yhs2AyTjde5un
+        kha2iy85o2NikCYoIaqFvFaEDOGjdcT4g/jaErxXn8sSxOQo9aV/r5Ksm/mXyEI2
+        cSrbMfBXwrlrHNZ5VCbYZLbNjIbwFdBV04buZldDT4GYmBW/PG71NeKDrXrgnTOn
+        3fBkXmhFb3gLppMv2v2TY96lGk3Obbfnry1lsgLLW+SvustNe1en3mXSVciCbuEh
+        7bsb4AkJyJXSUFh8jQ1LWxcE9jsI6eIj9eb/tw0QmC0y8Q2fqOV927B8d7Pl2dyU
+        K0aryOwn+80ce7sBd/9JRL6SOHB2nK8BpmRO2blAmhrGEjX8kif9hFrXHLU2+7sb
+        QC0ccFjoleqhTgsnOXCHwfm0ggejvZhS3GLjABgXBp2LVVYuWZXVhCQuRLsUV2v3
+        Wf4fPWaGWw8tTTaW198H0NWfd/FSogzWQcsgknVWM9YS/zzqcQNYsSObwh2q2V/S
+        XAFWrPxSexFSi0XiXK7ahhnp7OTIMtw9dy3e0HQ/7F8guhvhwoTcK6bLY2967wyj
+        IPh1r+J6g090fN2QXm0oHTSJbhl+fy4bOkXVt/ATyPh6b0yRaxMgSGXWeh3C
+        =hGXq
+        -----END PGP MESSAGE-----
+      fp: 87AB00D45D37C9E9167B5A5A333448678B60E505
+    - created_at: "2024-08-05T20:33:02Z"
+      enc: |-
+        -----BEGIN PGP MESSAGE-----
+
+        hQIMA4HMJd/cQYrVARAAwAzM+dgsD/WBFbCFIXhDdsLmmWZMeVLD1AlLTmu/GfGg
+        YvHhW4giEaqEzUsQOuxmyND7eQd3fBKf1GcwFLXE9xrR6YD5yh7s898mnCpBi2Xi
+        LBPMz7nN/j7mfetPklsTazbbaoSB9hVx8AK7jzS7zvzgEGIm8Yeilx/v8OqbT1xQ
+        +07soWjVvqM526a24KSdRBTgvXPJvqIPt0IEZzFWtAppectcRBiZJHX4huU5wOuG
+        SEk0vgwCwrt3cades+dbh59cSqUc65qGhDti0tnygnSKgepOkQsFOqoZ/WvgE+io
+        5fNEI4g2/D+gmSelCCcQE0MFe+Uzc1FpsWwZiHnbGfnA55GO0dvoOUAsJQtwCLSq
+        1Lw8bpywgfIfU4QMYmZAaYsHDly4VTwluFe1WnExzf/nMxRQQmqIlg2pTmNZ6tJ1
+        1A9Rc6mg83//2fNWRw+JBtOJUCePw5nyJ0jTOQZd7Dl0ZzwlsgH8g/Y/Flg1kFll
+        CXGcJ1TMjTjzD4+Fl3UE+BqpzBjwQodzHqX3LEJ9uJ2guw0zbWzuMs10aTEoW/1U
+        pVGexkrcaduykd5TQmMO8yG6rW2KEKJlh68lxZslUAiG0ASTuSpY5A8leS5OZZgF
+        EQjs903r1epwJgBwnQGhijpTrmqiThvdE0BJ9r1jmxUy75KzWh/SZDmpCwDfsELS
+        XAEceOrsLsaYRqisM5D1zvNneEoGKv3GoS4cs4iuqHPyy2ZueHWK24HmAmrghRQ7
+        uLCmS0SmU5CY5gmVRkrKhY/0wtKWqJ10cK17Z/dQtRz6g3qmFM4JBfMy4BL9
+        =vZLC
+        -----END PGP MESSAGE-----
+      fp: 91213ABAA73B0B73D3C02B5B4E5F372D17BBE67C
+    - created_at: "2024-08-05T20:33:02Z"
+      enc: |-
+        -----BEGIN PGP MESSAGE-----
+
+        hQIMAxjNhCKPP69fARAApzEcBIVknhmysQc02ufbjFzKweB4jsCvGoPXSooMzs4x
+        p4keH/xaVXF1/nn+bzMHJt1/LV1/5LlyHtQNcZ30hUrziOy4LCnyfNgb5WP3VMP3
+        XW6ZcBiEIcUHZ1Ikl/cUNCpKazVRD6o6oKmFCwXKgE9a/l5XX/j3vizQ22vwfgfa
+        oziQPhMadfne8hXAJIB7fOn45ZLFNgLqYWW4Jh4L1DJflziNR8kx3NQJLWDmSqqB
+        SpuFBkm7DaLCkj/TpvAQs5xSI69kLlDfcaEPI4noAdhJh+jwGVLNmKyekKsYfrDS
+        5cQUVD3Hmn4WnpR2jLJAlwcFaEZt0muiLIxZmAxfSzJhld8G4GOcoAllfG9ze+QG
+        oJ3G6jWtJeoCZR5zbdk+lNcQ+iHD6bzrkN+54menxu2XGHkFKQ1es/g+cU0AI3yZ
+        XXgnlwNtC75TzZHwSA0kjmqcgr5XVcoLOr5XJWasQOyIXpjcHbfonnMV4NE5A/Jo
+        IEMLUdjLBWmjW1xeWo1CJ8hELbpfNaQf8YBzEuo5Yqvs7s0fKl8ea18jwtwYP9qc
+        2CbD+7GpxuK/06gMTt7LExcqt39PVGmeFAtZHNtNBMnZ6Ek5cbWqhjPOCy2MFVaa
+        XTH3UxD1YISZC+NZtSYLDWrTwzY3EYCttAxHzg1iFC8STaM/OR6beD0OPcPj+QLS
+        XAH6NdHQcUSsFJ0KR4dfOrOnuLDzX2xLsgXJvDhRVbpYwSdeG40j5oGiNpam+z8/
+        fDboI4SNzB7Mb4j196kSHWK90sKFsxGkoDGZM/QZh4QA2v0yke1sqkUwkK4I
+        =SLD4
+        -----END PGP MESSAGE-----
+      fp: F38C9D4228FC6F674E322D9C3326D914EB9B8F55
+    - created_at: "2024-08-05T20:33:02Z"
+      enc: |-
+        -----BEGIN PGP MESSAGE-----
+
+        hQIMA1Hthzn+T1OoAQ/+LSHRuYFtIKdxABivqoxvbirPS9Vyo+lYNXMRt9eK5oYp
+        8ei+fyJgsyxXIIlsW2Dg/ZrM8O4aTxkuX1Eg0BhvuWWGBx71S7IGYX+6eSqrZWb+
+        0zLSwKHmk3avGae/IkpKyEdFnGpHKhnILfpKEXVRWHQo5hjxFzUwzNr5N+wJcq19
+        sVuCsu4WSt75Ab5bTjl/AYrfYegkK5zXo2I+njIcSYqleQ6vlQ10LUiPg8QhPXqB
+        NvC8DVglMHN+dFDrnn5huTsd23nIJn6HRbLkqgPCezT8JUgjvEsO0tOdnM8jwRnI
+        K79HH53p3fbxSut+/P+u1X0gMTOT7KeLfY8URho5HQnnmymXbRxuWoQea9/Z3qIX
+        4tfYkcMQA3+rxXANgsfT1yHEs8NjomUxi0SmSCeqtH333iMJJwEwWgLiIKFAA6t9
+        SffF9liWeG88VEeAF5dM+7uQ7XrTsAlcdHdNoQCpprx3Hx331rFt1DOj3Md2moF0
+        TUqdNsZ7wCA9zlVPwtjkILMGEdz8ZN62an0R/h2ZM9Y/wuZcl1M6wWI9eyjx2Qva
+        7/Xk6LMklmNICifOZZ5Tmw1xSyxOIW8VNp7IiKXZBAjb8NiUveNUos0gjMxNQ3PR
+        oWv8LY3vfYiKE7AJhzrEim1PX36OcRYpB+0BAou//9PGI59tHp/Fupi2lWx7Qv3S
+        XAEJRUzfnCPB56PdLkNFbJAj2v11zD8zBIZqpuGh/f3fE7V0klGy/Dx9yHyAhw0t
+        LeXMrYUYO3zjLc4yh7qdrGPBdWUQg8BzWwIJERdHS90zQwmcTkkaX5en3GII
+        =MQ9C
+        -----END PGP MESSAGE-----
+      fp: 5DA93D5C9D7320E1BD3522C79C78172B3551C9FD
+    - created_at: "2024-08-05T20:33:02Z"
+      enc: |-
+        -----BEGIN PGP MESSAGE-----
+
+        hQIMA46L6MuPqfJqARAApQx98KdexUMI0KY65hv0IRvBRFouPwpTsd4VpzTsbkYF
+        XDBhxWVXkI9iLS8O6siQygVDDMfIDs5SadVoOicWyOpHR5sjOaW9qHA4w399w8Fe
+        5XoPyfUuQvVywfHMhQiznHNPj5+SgcehwUL1i1+qD3h8RZxbgGkvYKinlkkbxzh/
+        Tk4lYjcoNvb/10XRWDEy5KxMB2qc2BFEWZk6DrXe9ZUd0IzYh+tA07rUZVu8TRAc
+        abx6/0lvgIK45frzYJb17yL/9mCbAUVzSlR/+5LZ+qm73Ax4nsGcGA8nfDVGw/di
+        +BbbpBHdCs7/1XEHfrKzuUXOAd0V1HjeQSS6zzcwsfFLMevYMyTLmiTwo6SEoWSk
+        nN599ZqPutG94MVtvaKqDY47ABSOr0BZIUn4jdus34GTgDjX3TVTx8KPzemIbUv7
+        BQcd654NKQN0poyZegrksnJVfs6OeSULLylufj6vyFNlKbjNR+D1sHhiyKcmyrQf
+        T0jDnPgZIzeVbNSdrDywrme+CykRSoFs60GgGYt6p/Omuh7Vp6we05jzY8lUJL76
+        VsGqqyCn3JLZb6iWFe+P7JT1VXsl8xsrmn5BKoSMeXqaXctYKuJ2E20gc90a8UXm
+        jhnHYeG2QHW1LBgv1yeqCpUIfHxNRr+gJ3cHQLNUuchC3vubf3sBXhHzYXyzyXrS
+        XAFwRah/o35ETWbRhFsw+SzJGTgsyUqKAtWGmfTRPsbVvbam63IEsbTSLOdMahmY
+        6uSgIbsZTobna90eVPFM8w3JIx7+Mq0YtdaLgRqpHJtPC7oVgN+RnKbgEEqQ
+        =uyf4
+        -----END PGP MESSAGE-----
+      fp: 8996B62CBD159DCADD3B6DC08BB33A8ABCF7BC4A
+    - created_at: "2024-08-05T20:33:02Z"
+      enc: |-
+        -----BEGIN PGP MESSAGE-----
+
+        hQIMA4EEKdYEzV0pAQ//QZwerhHFVjR/LahlgmnO/HyiR+wbvNzHEya/rVwuu+st
+        V8hNgBFp9N1Y9uh/GFIzZd5ETz7yq0FawRptlt5k0CqVYfsDBIB3ewxukJeyjdj2
+        8E84l9SSdmV5uqWK+MV+uY57C8BBcgWtUpjOTNrGkAqtEd5YrSZwcgtKGVLI2Dd/
+        i2I1RYdYP/VTusBtpqPk+IrpJf8jEYcEhl+S0wnG+kh/rhyCCrtda49SgRbuJE2d
+        V9JJlASkC6H6DRn6dVcO2BUZss3ZQB+OF9vfo7tnnuU8Mw1C2JWPy9oPiNat5UGE
+        zVJZf//m0xBfQVFWFDs95lvqzsBcAAg02tTsclPTtgz9buW5Pph3/OUiq4o/ZWOz
+        TMSXGD+Fi/mbP7jJZndtiadMtfOQC1dGC86A5H01aQliWruIMb0Wp55+Zr2Rw39p
+        FlhFSfCzyQHgA+uMa45XFaHCaS9pllWoT3QO3csP5ZyeUM8pLvnxwnLB2BTgg+yF
+        aV3BP0nzbHAUuaDeb/WtRINKRcKHCqrPPAEvb6X0OU51NvzmaWJphpdrvi3/4sEO
+        5+zDlqSZetaBa9WB1iCeD/u8wNNunCXageLxBucesv1uH5PvF51A/aJvXf1jRCym
+        NjSUQw2aSX35nWc9MIcUnO5mB8H4N5BF2FBx8Nq2XnrVgVPqqe1Sc2Ph4tE54QzS
+        XAG1bzAX3lHh77xsUuy/Nk3VE3kzJhaxpyz0rPIn6NQ9lVcy4hiyecKL3Jk3Ffcn
+        kxeKnjym5E4e3f8cMxWQlc+xtwga5QAD2dU2X9fPj6UxGEbh+gDqLv8wtzMr
+        =7R+0
+        -----END PGP MESSAGE-----
+      fp: 9DFA033E3DAEBAD7FDD71B056C7AAA54BE05F7BA
+    - created_at: "2024-08-05T20:33:02Z"
+      enc: |-
+        -----BEGIN PGP MESSAGE-----
+
+        hF4DQrf1tCqiJxoSAQdA4XhPBK5WnPVo84ZrCUe92HZSEKtH88GLktniZCmAczcw
+        cO5WYiy9D4z/aieGuMTBGg5xRk7eAMZVTbMDV+KXKLVlDwoxKybKSbT+fvhNGJ13
+        0lwBd0RFKYGq4YO+/nUxHZo3hG6qmv3/K06fta/D4p/C5wYefNZVcAj5VqatP3Zi
+        I/ktqdDszkc98/bf4fHoQmSxP25Wp65jJBEYeMZgX75M/wguGeIBfEgZB5bgww==
+        =0G+m
+        -----END PGP MESSAGE-----
+      fp: B71138A6A8964A3C3B8899857B4F70C356765BAB
+    - created_at: "2024-08-05T20:33:02Z"
+      enc: |-
+        -----BEGIN PGP MESSAGE-----
+
+        hQIMAzdAjw8ldn6CAQ//Vu9YJvMsevJAd4RJwJ5HMdB3xy3dbDG98qZb8Zoj0+qX
+        KT/VsR9YoOLeszmzI6BtB2PQhLeavMR2/SFJTGunxaSCvHcd/q7dnC+WAmUVun8l
+        MVRkIRh1I+tX1KQBqFt1IzsUm5kwJD4iThn4OWyDlS3WCDFlOLUC1iZVtdqxptzy
+        p4mzM4NmR/Z8r8aA+dYdTlzDHyUhVnvYCDaRTIyr2qzd6kUHmo9PMRvqUNQkNA3k
+        YOwLt8VR0nZIAx7YOGwSp4E32tk09o7Z+dUIYqXO71c5TxXsOoeEbVn7gj+7KQVs
+        yDNMF7he54zjModPJkSa4MjwTC2NKzLClux0aE9dW5Zv2eSiTEIlaAwhJjH0wt8O
+        oMJ5A8Y39GmNoAkadQ5NLP6WwTaUFYLacT56/AdAvsodQf7zlF399wXZlQufAgLv
+        3WAvL+LQKpg8TwH74pJe4te4BjnqWvYx+jkRYbRxSXD2iwqrWXk57XysizgjAAre
+        FJe42BeL2uyP/cMTcNFcd+W2DztUkNR54FHSYY8mqev81BYX92ExsfEugsBzUaDF
+        3QBnZIZZInCQKnXIIaj5+rV8XXbMKnyTNBQCxfUk92OOrUhikvYhwfPev2ejUzQm
+        k8RgIG9ZBWDENGX9ojmTH+ec2gWmLvKGyhrKjWvNMzzblHfuxjdSizoQ1FflYEPS
+        XAE9Cu/L0lwQEU8vRRPPF9kRHLoJygxdOYoD4+SggCkPJxtyiCTNWJeOBwbSnGyh
+        B8GnNJwNn7H8vh40se/uo2311O8NcuvdLLiBw9DxCTCcPHqS4e5hF98oiSnI
+        =ZgbM
+        -----END PGP MESSAGE-----
+      fp: 3D70F61E07F64EC4E4EF417BEFCD9D20F58784EF
+  unencrypted_suffix: _unencrypted
+  version: 3.9.0

config/hosts/yate/service.nix

@@ -1,21 +1,48 @@
 { config, pkgs, ... }:
 
 {
+#  systemd.managerEnvironment = {
+#    SYSTEMD_LOG_LEVEL = "debug";
+#  };
+
+  
+
+  sops.secrets."git_clone_key" = {
+    mode = "0600";
+    owner = "yate";
+    group = "yate-config";
+    restartUnits = [ "yate.service" ];
+};
+
   systemd.services.yate = {
     enable = true;
     description = "Yate telehony engine";
     unitConfig = {
-      Type = "simple";
+      After= "network-online.target";
-      After = "network.target";
     };
     serviceConfig = {
-      ExecStart = "${pkgs.yate}/bin/yate -c /yate -e /yate/share -Do";
+      ExecStart = "${pkgs.yate}/bin/yate -c /etc/yate -e /etc/yate/share";
-      Type = "simple";
+      Type="simple";
-      Restart = "always";
+      Restart="always";
+      User="yate";
+      Group="yate-config";
+      StateDirectory = "yate";
+      StateDirectoryMode = "0775";
       # ...
     };
     wantedBy = [ "default.target" ];
-    requiredBy = [ "network.target" ];
+    requires = [ "network-online.target" ]; 
+    preStart = "echo \"\n\" >> /run/secrets/git_clone_key
+                sleep 5
+                SSH_SUCCESS=1
+                ${pkgs.openssh}/bin/ssh -q -i /run/secrets/git_clone_key forgejo@git.hamburg.ccc.de 2> /var/lib/yate/SSH_CHECK_LOG  || SSH_SUCCESS=0
+                if [ $SSH_SUCCESS = 1 ]; then
+                rm -rf /var/lib/yate/*
+                rm -rf /var/lib/yate/.*
+                env GIT_SSH_COMMAND=\"${pkgs.openssh}/bin/ssh -i /run/secrets/git_clone_key\" ${pkgs.git}/bin/git clone forgejo@git.hamburg.ccc.de:CCCHH/yate-config.git /var/lib/yate
+                ${pkgs.git}/bin/git -C /var/lib/yate config --add safe.directory \"/var/lib/yate\"
+                fi";
+
     # ...
   };
 }

config/hosts/yate/sops.nix

@@ -4,4 +4,4 @@
   sops = {
     defaultSopsFile = ./secrets.yaml;
   };
-}
+}

config/hosts/yate/yate.nix

@@ -10,4 +10,19 @@
 
   # Just disable it for now.
   networking.firewall.enable = false;
+
+  users.users.yate = {
+    description = "yate service user";
+    group = "yate-config";
+    isNormalUser = true;
+  };
+
+
+  users.groups.yate-config = {};
+  users.groups.yate-config.members = [ "colmema-deploy" "chaos" "root" "yate"];
+
+  environment.etc.yate.user = "yate";
+  environment.etc.yate.group = "yate-config";
+  environment.etc.yate.mode = "symlink";
+  environment.etc.yate.source = "/var/lib/yate";
 }

deployment_configuration.json

@@ -23,18 +23,6 @@
     },
     "nix-box-june": {
       "targetHostname": "nix-box-june-intern.hamburg.ccc.de"
-    },
-    "mjolnir": {
-      "targetHostname": "mjolnir-intern.hamburg.ccc.de"
-    },
-    "woodpecker": {
-      "targetHostname": "woodpecker-intern.hamburg.ccc.de"
-    },
-    "penpot": {
-      "targetHostname": "penpot-intern.hamburg.ccc.de"
-    },
-    "hydra": {
-      "targetHostname": "hydra-intern.hamburg.ccc.de"
     }
   }
 }

flake.lock

@@ -1,26 +1,12 @@
 {
   "nodes": {
-    "authorizedKeysRepo": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1731276342,
-        "narHash": "sha256-plTYjM6zPzoBE/dp6EUrk9mCqmab278p8FqBCTX8Grc=",
-        "rev": "686a6af22f6696f0c0595c56f463c078550049fc",
-        "type": "tarball",
-        "url": "https://git.hamburg.ccc.de/api/v1/repos/CCCHH/infrastructure-authorized-keys/archive/686a6af22f6696f0c0595c56f463c078550049fc.tar.gz?rev=686a6af22f6696f0c0595c56f463c078550049fc"
-      },
-      "original": {
-        "type": "tarball",
-        "url": "https://git.hamburg.ccc.de/CCCHH/infrastructure-authorized-keys/archive/686a6af22f6696f0c0595c56f463c078550049fc.tar.gz"
-      }
-    },
     "nixlib": {
       "locked": {
-        "lastModified": 1731200463,
+        "lastModified": 1712450863,
-        "narHash": "sha256-qDaAweJjdFbVExqs8aG27urUgcgKufkIngHW3Rzustg=",
+        "narHash": "sha256-K6IkdtMtq9xktmYPj0uaYc8NsIqHuaAoRBaMgu9Fvrw=",
         "owner": "nix-community",
         "repo": "nixpkgs.lib",
-        "rev": "e04234d263750db01c78a412690363dc2226e68a",
+        "rev": "3c62b6a12571c9a7f65ab037173ee153d539905f",
         "type": "github"
       },
       "original": {
@@ -32,14 +18,16 @@
     "nixos-generators": {
       "inputs": {
         "nixlib": "nixlib",
-        "nixpkgs": "nixpkgs"
+        "nixpkgs": [
+          "nixpkgs"
+        ]
       },
       "locked": {
-        "lastModified": 1731546190,
+        "lastModified": 1716210724,
-        "narHash": "sha256-kJix8nLyFIJ3EC7VtoXK/85C4ZN2dC5oWoS8+ErehqI=",
+        "narHash": "sha256-iqQa3omRcHGpWb1ds75jS9ruA5R39FTmAkeR3J+ve1w=",
         "owner": "nix-community",
         "repo": "nixos-generators",
-        "rev": "06ffce1a8d95e95c06a4bcfa117dd960b14a7101",
+        "rev": "d14b286322c7f4f897ca4b1726ce38cb68596c94",
         "type": "github"
       },
       "original": {
@@ -50,41 +38,57 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1731245184,
+        "lastModified": 1716408408,
-        "narHash": "sha256-vmLS8+x+gHRv1yzj3n+GTAEObwmhxmkkukB2DwtJRdU=",
+        "narHash": "sha256-e4pjcLqe1Dexz7enk/+ui0aVdcoSiWnrTGjk7KLtAPw=",
-        "owner": "NixOS",
+        "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "aebe249544837ce42588aa4b2e7972222ba12e8f",
+        "rev": "dff68ababdd2c2616d03f26546ba632f5f09d3c6",
         "type": "github"
       },
       "original": {
-        "owner": "NixOS",
+        "owner": "nixos",
-        "ref": "nixpkgs-unstable",
+        "ref": "nixos-23.11-small",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
-    "nixpkgs_2": {
+    "nixpkgs-stable": {
       "locked": {
-        "lastModified": 1731842749,
+        "lastModified": 1716061101,
-        "narHash": "sha256-aNc8irVBH7sM5cGDvqdOueg8S+fGakf0rEMRGfGwWZw=",
+        "narHash": "sha256-H0eCta7ahEgloGIwE/ihkyGstOGu+kQwAiHvwVoXaA0=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "e7cc61784ddf51c81487637b3031a6dd2d6673a2",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "release-23.11",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs-unstable": {
+      "locked": {
+        "lastModified": 1716479278,
+        "narHash": "sha256-2eh7rYxQOntkUjFXtlPH7lBuUDd4isu/YHRjNJW7u1Q=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "bf6132dc791dbdff8b6894c3a85eb27ad8255682",
+        "rev": "2ee89d5a0167a8aa0f2a5615d2b8aefb1f299cd4",
         "type": "github"
       },
       "original": {
         "owner": "nixos",
-        "ref": "nixos-24.05-small",
+        "ref": "nixos-unstable-small",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
     "root": {
       "inputs": {
-        "authorizedKeysRepo": "authorizedKeysRepo",
         "nixos-generators": "nixos-generators",
-        "nixpkgs": "nixpkgs_2",
+        "nixpkgs": "nixpkgs",
+        "nixpkgs-unstable": "nixpkgs-unstable",
         "sops-nix": "sops-nix"
       }
     },
@@ -92,14 +96,15 @@
       "inputs": {
         "nixpkgs": [
           "nixpkgs"
-        ]
+        ],
+        "nixpkgs-stable": "nixpkgs-stable"
       },
       "locked": {
-        "lastModified": 1731862312,
+        "lastModified": 1716400300,
-        "narHash": "sha256-NVUTFxKrJp/hjehlF1IvkPnlRYg/O9HFVutbxOM8zNM=",
+        "narHash": "sha256-0lMkIk9h3AzOHs1dCL9RXvvN4PM8VBKb+cyGsqOKa4c=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "472741cf3fee089241ac9ea705bb2b9e0bfa2978",
+        "rev": "b549832718b8946e875c016a4785d204fcfc2e53",
         "type": "github"
       },
       "original": {

flake.nix

@@ -5,13 +5,14 @@
     # Use the NixOS small channels for nixpkgs.
     # https://nixos.org/manual/nixos/stable/#sec-upgrading
     # https://github.com/NixOS/nixpkgs
-    nixpkgs.url = "github:nixos/nixpkgs/nixos-24.05-small";
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-23.11-small";
+    nixpkgs-unstable.url = "github:nixos/nixpkgs/nixos-unstable-small";
 
     # Add nixos-generators as an input.
     # See here: https://github.com/nix-community/nixos-generators#using-in-a-flake
     nixos-generators = {
       url = "github:nix-community/nixos-generators";
-      #inputs.nixpkgs.follows = "nixpkgs";
+      inputs.nixpkgs.follows = "nixpkgs";
     };
 
     # Add sops-nix as an input for secret management.
@@ -20,260 +21,206 @@
       url = "github:Mic92/sops-nix";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-
-    authorizedKeysRepo = {
-      url = "https://git.hamburg.ccc.de/CCCHH/infrastructure-authorized-keys/archive/686a6af22f6696f0c0595c56f463c078550049fc.tar.gz";
-      flake = false;
-    };
   };
 
-  outputs = { self, nixpkgs, nixos-generators, sops-nix, authorizedKeysRepo, ... }:
+  outputs = { nixpkgs, nixpkgs-unstable, nixos-generators, sops-nix, ... }:
     let
-      specialArgs = {
-        inherit authorizedKeysRepo;
-      };
       system = "x86_64-linux";
+      # Shairport Sync 4.3.1 (with nqptp 1.2.4) with metadata, MQTT and AirPlay 2 support.
+      shairportSync431ExtendedNixpkgsUnstableOverlay = final: prev: {
+        shairport-sync = (prev.shairport-sync.override { enableMetadata = true; enableAirplay2 = true; }).overrideAttrs (finalAttr: previousAttr: {
+          # See: https://github.com/mikebrady/shairport-sync/blob/e78a88b64adfe7b5f88fd6faedf55c57445bb240/CONFIGURATION%20FLAGS.md
+          configureFlags = previousAttr.configureFlags ++ [ "--with-mqtt-client" ];
+          buildInputs = previousAttr.buildInputs ++ [ final.mosquitto ];
+          # Use specific Shairport Sync and nqptp versions, since with those the
+          # following error doesn't happen:
+          # fatal error: The nqptp service on this system, which is required for
+          # Shairport Sync to operate, does not seem to be initialised.
+          #
+          # Also use a more recent dev version to fix Pipewire stuttering issue.
+          # See:
+          # https://github.com/mikebrady/shairport-sync/issues/1736
+          # https://github.com/mikebrady/shairport-sync/blob/a65ec2d7f1f380bbae196d7f8f1cd6a88ef5777b/RELEASENOTES-DEVELOPMENT.md#version-432-dev-51-g98679bbb
+          src = final.fetchFromGitHub {
+            owner = "mikebrady";
+            repo = finalAttr.pname;
+            rev = "98679bbb54f5aaeda859e34aa28425647b8d179e";
+            hash = "sha256-k0kcgtWk2xlG34lP0ryEaqdskYMNM68YnIRLwFR3jaY=";
+          };
+        });
+        nqptp = prev.nqptp.overrideAttrs (finalAttr: previousAttr: {
+          # See Shairport Sync version note.
+          src = final.fetchFromGitHub {
+            owner = "mikebrady";
+            repo = finalAttr.pname;
+            rev = "1.2.4";
+            hash = "sha256-roTNcr3v2kzE6vQ5plAVtlw1+2yJplltOYsGGibtoZo=";
+          };
+          # Custom install phase to avoid setcap.
+          # See:
+          # https://github.com/mikebrady/nqptp/blob/1.2.4/Makefile.am#L23
+          installPhase = ''
+            mkdir -p $out/bin
+            cp nqptp $out/bin/
+          '';
+        });
+      };
+      pkgs-unstable = nixpkgs-unstable.legacyPackages."x86_64-linux";
     in
     {
-      overlays = {
-        shairportSyncAirplay2 = final: prev: {
-          shairport-sync = (prev.shairport-sync.override { enableMetadata = true; enableAirplay2 = true; }).overrideAttrs (finalAttr: previousAttr: {
-            # See: https://github.com/mikebrady/shairport-sync/blob/e78a88b64adfe7b5f88fd6faedf55c57445bb240/CONFIGURATION%20FLAGS.md
-            configureFlags = previousAttr.configureFlags ++ [ "--with-mqtt-client" ];
-            buildInputs = previousAttr.buildInputs ++ [ final.mosquitto ];
-          });
-        };
-      };
-      nixosModules = {
-        common = ./config/common;
-        proxmox-vm = ./config/proxmox-vm;
-        prometheus-exporter = ./config/extra/prometheus-exporter.nix;
-      };
       nixosConfigurations = {
-        audio-hauptraum-kueche = nixpkgs.lib.nixosSystem {
+        audio-hauptraum-kueche = nixpkgs-unstable.lib.nixosSystem {
-          inherit system specialArgs;
+          inherit system;
           modules = [
-            self.nixosModules.common
+            ./config/common
-            self.nixosModules.proxmox-vm
+            ./config/proxmox-vm
-            { nixpkgs.overlays = [ self.overlays.shairportSyncAirplay2 ]; }
+            { nixpkgs.overlays = [ shairportSync431ExtendedNixpkgsUnstableOverlay ]; }
             ./config/hosts/audio-hauptraum-kueche
           ];
         };
 
-        audio-hauptraum-tafel = nixpkgs.lib.nixosSystem {
+        audio-hauptraum-tafel = nixpkgs-unstable.lib.nixosSystem {
-          inherit system specialArgs;
+          inherit system;
           modules = [
-            self.nixosModules.common
+            ./config/common
-            self.nixosModules.proxmox-vm
+            ./config/proxmox-vm
-            { nixpkgs.overlays = [ self.overlays.shairportSyncAirplay2 ]; }
+            { nixpkgs.overlays = [ shairportSync431ExtendedNixpkgsUnstableOverlay ]; }
             ./config/hosts/audio-hauptraum-tafel
           ];
         };
 
         esphome = nixpkgs.lib.nixosSystem {
-          inherit system specialArgs;
+          inherit system;
           modules = [
-            self.nixosModules.common
+            ./config/common
-            self.nixosModules.proxmox-vm
+            ./config/proxmox-vm
             ./config/hosts/esphome
           ];
         };
 
         public-reverse-proxy = nixpkgs.lib.nixosSystem {
-          inherit system specialArgs;
+          inherit system;
           modules = [
-            self.nixosModules.common
+            ./config/common
-            self.nixosModules.proxmox-vm
+            ./config/proxmox-vm
             ./config/hosts/public-reverse-proxy
           ];
         };
 
         netbox = nixpkgs.lib.nixosSystem {
-          inherit system specialArgs;
+          inherit system;
           modules = [
-            self.nixosModules.common
+            ./config/common
-            self.nixosModules.proxmox-vm
+            ./config/proxmox-vm
             sops-nix.nixosModules.sops
-            self.nixosModules.prometheus-exporter
             ./config/hosts/netbox
           ];
         };
 
         matrix = nixpkgs.lib.nixosSystem {
-          inherit system specialArgs;
+          inherit system;
           modules = [
-            self.nixosModules.common
+            ./config/common
-            self.nixosModules.proxmox-vm
+            ./config/proxmox-vm
             sops-nix.nixosModules.sops
-            self.nixosModules.prometheus-exporter
             ./config/hosts/matrix
           ];
         };
 
         public-web-static = nixpkgs.lib.nixosSystem {
-          inherit system specialArgs;
+          inherit system;
           modules = [
-            self.nixosModules.common
+            ./config/common
-            self.nixosModules.proxmox-vm
+            ./config/proxmox-vm
             sops-nix.nixosModules.sops
-            self.nixosModules.prometheus-exporter
             ./config/hosts/public-web-static
           ];
         };
 
         git = nixpkgs.lib.nixosSystem {
-          inherit system specialArgs;
+          inherit system;
           modules = [
-            self.nixosModules.common
+            ./config/common
-            self.nixosModules.proxmox-vm
+            ./config/proxmox-vm
             sops-nix.nixosModules.sops
-            self.nixosModules.prometheus-exporter
             ./config/hosts/git
           ];
+          specialArgs = {
+            inherit pkgs-unstable;
+          };
         };
 
         forgejo-actions-runner = nixpkgs.lib.nixosSystem {
-          inherit system specialArgs;
+          inherit system;
           modules = [
-            self.nixosModules.common
+            ./config/common
-            self.nixosModules.proxmox-vm
+            ./config/proxmox-vm
             sops-nix.nixosModules.sops
-            self.nixosModules.prometheus-exporter
             ./config/hosts/forgejo-actions-runner
           ];
         };
 
         ptouch-print-server = nixpkgs.lib.nixosSystem {
-          inherit system specialArgs;
+          inherit system;
           modules = [
-            self.nixosModules.common
+            ./config/common
-            self.nixosModules.proxmox-vm
+            ./config/proxmox-vm
             ./config/hosts/ptouch-print-server
           ];
         };
 
         eh22-wiki = nixpkgs.lib.nixosSystem {
-          inherit system specialArgs;
+          inherit system;
           modules = [
-            self.nixosModules.common
+            ./config/common
-            self.nixosModules.proxmox-vm
+            ./config/proxmox-vm
-            self.nixosModules.prometheus-exporter
             ./config/hosts/eh22-wiki
           ];
         };
 
         nix-box-june = nixpkgs.lib.nixosSystem {
-          inherit system specialArgs;
+          inherit system;
           modules = [
-            self.nixosModules.common
+            ./config/common
-            self.nixosModules.proxmox-vm
+            ./config/proxmox-vm
-            self.nixosModules.prometheus-exporter
             ./config/hosts/nix-box-june
           ];
         };
 
         yate = nixpkgs.lib.nixosSystem {
-          inherit system specialArgs;
+          inherit system;
           modules = [
-            self.nixosModules.common
+            ./config/common
-            self.nixosModules.proxmox-vm
+            ./config/proxmox-vm
+            sops-nix.nixosModules.sops
             ./config/hosts/yate
           ];
         };
-
-        mqtt = nixpkgs.lib.nixosSystem {
-          inherit system specialArgs;
-          modules = [
-            self.nixosModules.common
-            self.nixosModules.proxmox-vm
-            ./config/hosts/mqtt
-          ];
-        };
-
-        mjolnir = nixpkgs.lib.nixosSystem {
-          inherit system specialArgs;
-          modules = [
-            self.nixosModules.common
-            self.nixosModules.proxmox-vm
-            sops-nix.nixosModules.sops
-            self.nixosModules.prometheus-exporter
-            ./config/hosts/mjolnir
-          ];
-        };
-
-        woodpecker = nixpkgs.lib.nixosSystem {
-          inherit system specialArgs;
-          modules = [
-            self.nixosModules.common
-            self.nixosModules.proxmox-vm
-            sops-nix.nixosModules.sops
-            self.nixosModules.prometheus-exporter
-            ./config/hosts/woodpecker
-          ];
-        };
-
-        status = nixpkgs.lib.nixosSystem {
-          inherit system specialArgs;
-          modules = [
-            self.nixosModules.common
-            self.nixosModules.proxmox-vm
-            sops-nix.nixosModules.sops
-            ./config/hosts/status
-          ];
-        };
-
-        penpot = nixpkgs.lib.nixosSystem {
-          inherit system specialArgs;
-          modules = [
-            self.nixosModules.common
-            self.nixosModules.proxmox-vm
-            sops-nix.nixosModules.sops
-            self.nixosModules.prometheus-exporter
-            ./config/hosts/penpot
-          ];
-        };
-
-        hydra = nixpkgs.lib.nixosSystem {
-          inherit system specialArgs;
-          modules = [
-            self.nixosModules.common
-            self.nixosModules.proxmox-vm
-            self.nixosModules.prometheus-exporter
-            ./config/hosts/hydra
-          ];
-        };
       };
 
       packages.x86_64-linux = {
         proxmox-nixos-template = nixos-generators.nixosGenerate {
-          inherit specialArgs;
           system = "x86_64-linux";
           modules = [
             ./config/nixos-generators/proxmox.nix
-            self.nixosModules.common
+            ./config/common
-            self.nixosModules.proxmox-vm
+            ./config/proxmox-vm
           ];
           format = "proxmox";
         };
 
         proxmox-chaosknoten-nixos-template = nixos-generators.nixosGenerate {
-          inherit specialArgs;
           system = "x86_64-linux";
           modules = [
             ./config/nixos-generators/proxmox-chaosknoten.nix
             ./config/proxmox-chaosknoten-additional-initial-config.nix
-            self.nixosModules.common
+            ./config/common
-            self.nixosModules.proxmox-vm
+            ./config/proxmox-vm
           ];
           format = "proxmox";
         };
       };
 
       formatter.x86_64-linux = nixpkgs.legacyPackages.x86_64-linux.nixpkgs-fmt;
-
-      hydraJobs = {
-        inherit (self) packages;
-        nixosConfigurations = builtins.mapAttrs (name: value: value.config.system.build.toplevel) self.nixosConfigurations;
-      };
     };
 }

modules/services/audio/default.nix

@@ -12,6 +12,7 @@ in
   imports = [
     ./librespot.nix
     ./mpd.nix
+    ./networking.nix
     ./pipewire.nix
     ./shairport-sync.nix
   ];

modules/services/audio/librespot.nix

@@ -23,7 +23,7 @@ in
         After = [ "network-online.target" "pipewire.service" ];
       };
       serviceConfig = {
-        ExecStart = "${pkgs.librespot}/bin/librespot --name '${config.ccchh.services.audio.name}' --device-type speaker --bitrate 320 --enable-volume-normalisation --disable-audio-cache --disable-credential-cache";
+        ExecStart = "${pkgs.librespot}/bin/librespot --name '${config.ccchh.services.audio.name}' --device-type speaker --bitrate 320 --enable-volume-normalisation --disable-audio-cache --disable-credential-cache --quiet";
         User = "librespot";
         Group = "librespot";
       };
@@ -34,7 +34,7 @@ in
       users.librespot = {
         isSystemUser = true;
         group = "librespot";
-        extraGroups = [ "pipewire" "audio" ];
+        extraGroups = [ "pipewire" ];
       };
       groups.librespot = { };
     };

modules/services/audio/networking.nix

@@ -0,0 +1,16 @@
+{ config, pkgs, lib, ... }:
+
+with lib;
+
+let
+
+  cfg = config.ccchh.services.audio;
+
+in
+
+{
+  config = mkIf cfg.enable {
+    # Disable IPv6, since Shairport-Sync doesn't work with IPv6. Unclear why.
+    networking.enableIPv6 = false;
+  };
+}