Lets just look how its going to be with lix

.sops.yaml

@@ -1,66 +1,165 @@
 keys:
-  admins: &admin_keys
-    pgp: &admin_pgp_keys
-      - &admin_pgp_djerun EF643F59E008414882232C78FFA8331EEB7D6B70
-      - &admin_pgp_stb 21C9579E6503CA815A68ABD8541F9408A813C8B7
-      - &admin_pgp_fi 9633412309CCB83BFA39BA5F2FEF746201D7FCFE
-      - &admin_pgp_june 057870A2C72CD82566A3EC983695F4FCBCAE4912
-      - &admin_pgp_haegar F38C9D4228FC6F674E322D9C3326D914EB9B8F55
-      # - &admin_pgp_dario 5DA93D5C9D7320E1BD3522C79C78172B3551C9FD # expired
-      - &admin_pgp_echtnurich 8996B62CBD159DCADD3B6DC08BB33A8ABCF7BC4A
-      - &admin_pgp_c6ristian B71138A6A8964A3C3B8899857B4F70C356765BAB
-      - &admin_pgp_lilly D2E9C0807BF681F5E164DAFC5EE1B61CD90954CD
-      - &admin_pgp_langoor 878FEA3CB6A6F6E7CD80ECBE28506E3585F9F533
-      - &admin_pgp_bitwhisker 41FFAF3D519CF5C039FBD8414BCC213729AF0E49
-    age: &admin_age_keys
-      - &admin_age_jtbx ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIBQgnQAq6FUSDK8bxtYPjx3oRCAKG+xy9J3Gas2ztJk
-      - &admin_age_lilly age19h7xtfmt3py3ydgl8d8fgh8uakxqxjr74flrxev3pgmvvx94kvtq5d932d
-  hosts:
-    - &host_age_git age18zaq9xg9nhqyl8g7mvrqhsx4qstay5l9cekq2g80vx4920pswdfqpeafd7
-    - &host_age_forgejo_actions_runner age10xz2l7ghul7023awcydf4q3wurmszy2tafnadlarj0tvm7kl033sjw5f8t
-    - &host_age_matrix age1f7ams0n2zy994pzt0u30h8tex6xdcernj59t4d70z4kjsyzrr3wsy87xzk
-    - &host_age_public_web_static age19s7r8sf7j6zk24x9vumawgxpd2q8epyv7p9qsjntw7v9s3v045mqhmsfp0
-    - &host_age_woodpecker age1klxtcr23hers0lh4f5zdd53tyrtg0jud35rhydstyjq9fjymf9hsn2a8ch
-    - &host_age_penpot age10ku5rphtsf2lcxg78za7f2dad5cx5x9urgkce0d7tyqwq2enva9sqf7g8r
+  - &admin_gpg_djerun EF643F59E008414882232C78FFA8331EEB7D6B70
+  - &admin_gpg_stb F155144FC925A1BEA1F8A2C59A2A4CD59BFDC5EC
+  - &admin_gpg_jtbx 18DFCE01456DAB52EA38A6584EDC64F35FA1D6A5
+  - &admin_gpg_yuri 87AB00D45D37C9E9167B5A5A333448678B60E505
+  - &admin_gpg_june 91213ABAA73B0B73D3C02B5B4E5F372D17BBE67C
+  - &admin_gpg_haegar F38C9D4228FC6F674E322D9C3326D914EB9B8F55
+  - &admin_gpg_dario 5DA93D5C9D7320E1BD3522C79C78172B3551C9FD
+  - &admin_gpg_echtnurich 8996B62CBD159DCADD3B6DC08BB33A8ABCF7BC4A
+  - &admin_gpg_max 9DFA033E3DAEBAD7FDD71B056C7AAA54BE05F7BA
+  - &admin_gpg_c6ristian B71138A6A8964A3C3B8899857B4F70C356765BAB
+  - &admin_gpg_dante 3D70F61E07F64EC4E4EF417BEFCD9D20F58784EF
+  - &host_age_git age18zaq9xg9nhqyl8g7mvrqhsx4qstay5l9cekq2g80vx4920pswdfqpeafd7
+  - &host_age_forgejo_actions_runner age10xz2l7ghul7023awcydf4q3wurmszy2tafnadlarj0tvm7kl033sjw5f8t
+  - &host_age_matrix age1f7ams0n2zy994pzt0u30h8tex6xdcernj59t4d70z4kjsyzrr3wsy87xzk
+  - &host_age_netbox age13fqs76z2vl5l84dvmmlqjj5xkfsfe85xls8uueul7re9j3ksjs0sw2xc9e
+  - &host_age_public_web_static age19s7r8sf7j6zk24x9vumawgxpd2q8epyv7p9qsjntw7v9s3v045mqhmsfp0
+  - &host_age_mjolnir age1ej52kwuj8xraxdq685eejj4dmxpfmpgt4d8jka98rtpal6xcueqq9a6wae
+  - &host_age_woodpecker age1klxtcr23hers0lh4f5zdd53tyrtg0jud35rhydstyjq9fjymf9hsn2a8ch
+  - &host_age_penpot age10ku5rphtsf2lcxg78za7f2dad5cx5x9urgkce0d7tyqwq2enva9sqf7g8r
 creation_rules:
   - path_regex: config/hosts/git/.*
     key_groups:
-      - age:
+      - pgp:
+          - *admin_gpg_djerun
+          - *admin_gpg_stb
+          - *admin_gpg_jtbx
+          - *admin_gpg_yuri
+          - *admin_gpg_june
+          - *admin_gpg_haegar
+          - *admin_gpg_dario
+          - *admin_gpg_echtnurich
+          - *admin_gpg_max
+          - *admin_gpg_c6ristian
+          - *admin_gpg_dante
+        age:
           - *host_age_git
-        merge:
-          - *admin_keys
   - path_regex: config/hosts/forgejo-actions-runner/.*
     key_groups:
-      - age:
+      - pgp:
+          - *admin_gpg_djerun
+          - *admin_gpg_stb
+          - *admin_gpg_jtbx
+          - *admin_gpg_yuri
+          - *admin_gpg_june
+          - *admin_gpg_haegar
+          - *admin_gpg_dario
+          - *admin_gpg_echtnurich
+          - *admin_gpg_max
+          - *admin_gpg_c6ristian
+          - *admin_gpg_dante
+        age:
           - *host_age_forgejo_actions_runner
-        merge:
-          - *admin_keys
   - path_regex: config/hosts/matrix/.*
     key_groups:
-      - age:
+      - pgp:
+          - *admin_gpg_djerun
+          - *admin_gpg_stb
+          - *admin_gpg_jtbx
+          - *admin_gpg_yuri
+          - *admin_gpg_june
+          - *admin_gpg_haegar
+          - *admin_gpg_dario
+          - *admin_gpg_echtnurich
+          - *admin_gpg_max
+          - *admin_gpg_c6ristian
+          - *admin_gpg_dante
+        age:
           - *host_age_matrix
-        merge:
-          - *admin_keys
+  - path_regex: config/hosts/netbox/.*
+    key_groups:
+      - pgp:
+          - *admin_gpg_djerun
+          - *admin_gpg_stb
+          - *admin_gpg_jtbx
+          - *admin_gpg_yuri
+          - *admin_gpg_june
+          - *admin_gpg_haegar
+          - *admin_gpg_dario
+          - *admin_gpg_echtnurich
+          - *admin_gpg_max
+          - *admin_gpg_c6ristian
+          - *admin_gpg_dante
+        age:
+          - *host_age_netbox
   - path_regex: config/hosts/public-web-static/.*
     key_groups:
-      - age:
+      - pgp:
+          - *admin_gpg_djerun
+          - *admin_gpg_stb
+          - *admin_gpg_jtbx
+          - *admin_gpg_yuri
+          - *admin_gpg_june
+          - *admin_gpg_haegar
+          - *admin_gpg_dario
+          - *admin_gpg_echtnurich
+          - *admin_gpg_max
+          - *admin_gpg_c6ristian
+          - *admin_gpg_dante
+        age:
           - *host_age_public_web_static
-        merge:
-          - *admin_keys
+  - path_regex: config/hosts/mjolnir/.*
+    key_groups:
+      - pgp:
+          - *admin_gpg_djerun
+          - *admin_gpg_stb
+          - *admin_gpg_jtbx
+          - *admin_gpg_yuri
+          - *admin_gpg_june
+          - *admin_gpg_haegar
+          - *admin_gpg_dario
+          - *admin_gpg_echtnurich
+          - *admin_gpg_max
+          - *admin_gpg_c6ristian
+          - *admin_gpg_dante
+        age:
+          - *host_age_mjolnir
   - path_regex: config/hosts/woodpecker/.*
     key_groups:
-      - age:
+      - pgp:
+          - *admin_gpg_djerun
+          - *admin_gpg_stb
+          - *admin_gpg_jtbx
+          - *admin_gpg_yuri
+          - *admin_gpg_june
+          - *admin_gpg_haegar
+          - *admin_gpg_dario
+          - *admin_gpg_echtnurich
+          - *admin_gpg_max
+          - *admin_gpg_c6ristian
+          - *admin_gpg_dante
+        age:
           - *host_age_woodpecker
-        merge:
-          - *admin_keys
   - path_regex: config/hosts/penpot/.*
     key_groups:
-      - age:
+      - pgp:
+          - *admin_gpg_djerun
+          - *admin_gpg_stb
+          - *admin_gpg_jtbx
+          - *admin_gpg_yuri
+          - *admin_gpg_june
+          - *admin_gpg_haegar
+          - *admin_gpg_dario
+          - *admin_gpg_echtnurich
+          - *admin_gpg_max
+          - *admin_gpg_c6ristian
+          - *admin_gpg_dante
+        age:
           - *host_age_penpot
-        merge:
-          - *admin_keys
   - key_groups:
-      - *admin_keys
+      - pgp:
+          - *admin_gpg_djerun
+          - *admin_gpg_stb
+          - *admin_gpg_jtbx
+          - *admin_gpg_yuri
+          - *admin_gpg_june
+          - *admin_gpg_haegar
+          - *admin_gpg_dario
+          - *admin_gpg_echtnurich
+          - *admin_gpg_max
+          - *admin_gpg_c6ristian
+          - *admin_gpg_dante
 stores:
   yaml:
     indent: 2

.woodpecker/flake-check.yaml

@@ -0,0 +1,11 @@
+when:
+  - event: pull_request
+  - event: push
+    path:
+      - '.woodpecker/**'
+
+steps:
+  - name: "Run nix flake check"
+    image: ghcr.io/lix-project/lix:latest
+    commands:
+      - nix --extra-experimental-features 'nix-command flakes' flake check

README.md

@@ -76,5 +76,4 @@ nix build .#proxmox-chaosknoten-nixos-template
 
 ## License
 
-This CCCHH nix-infra repository is licensed under the [MIT License](./LICENSE).  
-[`librespot_PR1528_conflicts_resolved.patch`](patches/librespot_PR1528_conflicts_resolved.patch) is a modified version of [librespot PR 1528](https://github.com/librespot-org/librespot/pull/1528) and is licensed under the [MIT license](https://github.com/librespot-org/librespot/blob/dev/LICENSE).
+This CCCHH nix-infra repository is licensed under the [MIT License](./LICENSE).

config/common/ssh.nix

@@ -20,7 +20,6 @@
         "ecdh-sha2-nistp384"
         "ecdh-sha2-nistp256"
         "diffie-hellman-group-exchange-sha256"
-        "mlkem768x25519-sha256"
       ];
       # Macs seem reasonable as the default of NixOS 23.05 is a subset of the Mozilla Modern guideline as of 2023-09-09.
       # Ciphers seem reasonable as the default of NixOS 23.05 matches the Mozilla Modern guideline as of 2023-09-09.

config/hosts/audio-hauptraum-kueche/audio.nix

@@ -0,0 +1,14 @@
+{ pkgs, ... }:
+{
+  imports = [
+    ../../../modules/services/audio
+  ];
+
+  ccchh.services.audio = {
+    enable = true;
+    name = "Audio Hauptraum Küche";
+  };
+  services.mpd.musicDirectory = "smb://beamer:beamer@beamer.z9.ccchh.net/music";
+
+  users.users.chaos.extraGroups = [ "pipewire" ];
+}

config/hosts/audio-hauptraum-kueche/configuration.nix

@@ -0,0 +1,9 @@
+{ pkgs, ... }:
+{
+  networking = {
+    hostName = "audio-hauptraum-kueche";
+    domain = "z9.ccchh.net";
+  };
+
+  system.stateVersion = "23.05";
+}

config/hosts/audio-hauptraum-kueche/default.nix

@@ -0,0 +1,8 @@
+{ ... }:
+{
+  imports = [
+    ./audio.nix
+    ./configuration.nix
+    ./networking.nix
+  ];
+}

config/hosts/audio-hauptraum-kueche/networking.nix

@@ -0,0 +1,21 @@
+{ ... }:
+
+{
+  networking = {
+    interfaces.net0 = {
+      ipv4.addresses = [
+        {
+          address = "10.31.210.10";
+          prefixLength = 23;
+        }
+      ];
+    };
+    defaultGateway = "10.31.210.1";
+    nameservers = [ "10.31.210.1" ];
+  };
+
+  systemd.network.links."10-net0" = {
+    matchConfig.MACAddress = "1E:EF:2D:92:81:DA";
+    linkConfig.Name = "net0";
+  };
+}

config/hosts/audio-hauptraum-tafel/audio.nix

@@ -0,0 +1,14 @@
+{ pkgs, ... }:
+{
+  imports = [
+    ../../../modules/services/audio
+  ];
+
+  ccchh.services.audio = {
+    enable = true;
+    name = "Audio Hauptraum Tafel";
+  };
+  services.mpd.musicDirectory = "smb://beamer:beamer@beamer.z9.ccchh.net/music";
+
+  users.users.chaos.extraGroups = [ "pipewire" ];
+}

config/hosts/audio-hauptraum-tafel/configuration.nix

@@ -0,0 +1,9 @@
+{ pkgs, ... }:
+{
+  networking = {
+    hostName = "audio-hauptraum-tafel";
+    domain = "z9.ccchh.net";
+  };
+
+  system.stateVersion = "23.05";
+}

config/hosts/audio-hauptraum-tafel/default.nix

@@ -0,0 +1,8 @@
+{ ... }:
+{
+  imports = [
+    ./audio.nix
+    ./configuration.nix
+    ./networking.nix
+  ];
+}

config/hosts/audio-hauptraum-tafel/networking.nix

@@ -0,0 +1,21 @@
+{ ... }:
+
+{
+  networking = {
+    interfaces.net0 = {
+      ipv4.addresses = [
+        {
+          address = "10.31.210.13";
+          prefixLength = 23;
+        }
+      ];
+    };
+    defaultGateway = "10.31.210.1";
+    nameservers = [ "10.31.210.1" ];
+  };
+
+  systemd.network.links."10-net0" = {
+    matchConfig.MACAddress = "D2:10:33:B1:72:C3";
+    linkConfig.Name = "net0";
+  };
+}

config/hosts/eh22-wiki/configuration.nix

@@ -0,0 +1,7 @@
+{ ... }:
+
+{
+  networking.hostName = "eh22-wiki";
+
+  system.stateVersion = "23.11";
+}

config/hosts/eh22-wiki/default.nix

@@ -0,0 +1,9 @@
+{ config, pkgs, ... }:
+
+{
+  imports = [
+    ./configuration.nix
+    ./dokuwiki.nix
+    ./networking.nix
+  ];
+}

config/hosts/eh22-wiki/dokuwiki.nix

@@ -0,0 +1,166 @@
+# Sources for this configuration:
+# - https://www.dokuwiki.org/dokuwiki
+# - https://www.dokuwiki.org/install
+# - https://www.dokuwiki.org/requirements
+# - https://www.dokuwiki.org/install:php
+# - https://www.dokuwiki.org/security
+# - https://www.dokuwiki.org/config:xsendfile
+# - https://www.dokuwiki.org/install:nginx
+# - https://www.dokuwiki.org/faq:uploadsize
+# - https://nixos.wiki/wiki/Phpfpm
+# - https://wiki.archlinux.org/title/Nginx#FastCGI
+# - https://github.com/NixOS/nixpkgs/blob/84c0cb1471eee15e77ed97e7ae1e8cdae8835c61/nixos/modules/services/web-apps/dokuwiki.nix
+# - https://git.hamburg.ccc.de/CCCHH/ansible-infra/src/commit/81c8bfe16b311d5bf4635947fa02dfb65aea7f91/playbooks/files/chaosknoten/configs/wiki/nginx/wiki.hamburg.ccc.de.conf
+# - https://www.php.net/manual/en/install.fpm.php
+# - https://www.php.net/manual/en/install.fpm.configuration.php
+
+{ config, pkgs, ... }:
+
+let
+  # This is also used for user and group names.
+  app = "dokuwiki";
+  domain = "eh22.easterhegg.eu";
+  dataDir = "/srv/www/${domain}";
+in
+{
+  systemd.tmpfiles.rules = [
+    "d ${dataDir} 0755 ${app} ${app}"
+  ];
+
+  services.phpfpm.pools."${app}" = {
+    user = "${app}";
+    group = "${app}";
+    phpOptions = ''
+      short_open_tag = Off
+      open_basedir =
+      output_buffering = Off
+      output_handler =
+      zlib.output_compression = Off
+      implicit_flush = Off
+      allow_call_time_pass_reference = Off
+      max_execution_time = 30
+      max_input_time = 60
+      max_input_vars = 10000
+      memory_limit = 128M
+      error_reporting = E_ALL & ~E_NOTICE
+      display_errors = Off
+      display_startup_errors = Off
+      log_errors = On
+      ; error_log should be handled by NixOS.
+      variables_order = "EGPCS"
+      register_argc_argv = Off
+      file_uploads = On
+      upload_max_filesize = 20M
+      post_max_size = 20M
+      session.use_cookies = 1
+      ; Checked the default NixOS PHP extensions and the only one missing from
+      ; DokuWikis list of PHP extensions was bz2, so add that.
+      ; Checked with NixOS 23.11 on 2024-05-02.
+      extension = ${pkgs.phpExtensions.bz2}/lib/php/extensions/bz2.so
+    '';
+    settings = {
+      "listen.owner" = "${config.services.nginx.user}";
+      "listen.group" = "${config.services.nginx.group}";
+      "pm" = "dynamic";
+      "pm.max_children" = 32;
+      "pm.start_servers" = 2;
+      "pm.min_spare_servers" = 2;
+      "pm.max_spare_servers" = 4;
+      "pm.max_requests" = 500;
+    };
+  };
+
+  services.nginx = {
+    enable = true;
+
+    virtualHosts."acme-${domain}" = {
+      default = true;
+      enableACME = true;
+      serverName = "${domain}";
+
+      listen = [
+        {
+          addr = "0.0.0.0";
+          port = 31820;
+        }
+      ];
+    };
+
+    virtualHosts."${domain}" = {
+      default = true;
+      forceSSL = true;
+      useACMEHost = "${domain}";
+
+      listen = [
+        {
+          addr = "0.0.0.0";
+          port = 8443;
+          ssl = true;
+          proxyProtocol = true;
+        }
+      ];
+
+      root = "${dataDir}";
+
+      locations = {
+        "~ /(conf|bin|inc|vendor)/" = {
+          extraConfig = "deny all;";
+        };
+
+        "~ /install.php" = {
+          extraConfig = "deny all;";
+        };
+
+        "~ ^/data/" = {
+          extraConfig = "internal;";
+        };
+
+        "~ ^/lib.*\.(js|css|gif|png|ico|jpg|jpeg)$" = {
+          extraConfig = "expires 31d;";
+        };
+
+        "/" = {
+          index = "doku.php";
+          extraConfig = "try_files $uri $uri/ @dokuwiki;";
+        };
+
+        "@dokuwiki" = {
+          extraConfig = ''
+            # Rewrites "doku.php/" out of the URLs if the userwrite setting is
+            # set to .htaccess in the DokuWiki config page.
+            rewrite ^/_media/(.*) /lib/exe/fetch.php?media=$1 last;
+            rewrite ^/_detail/(.*) /lib/exe/detail.php?media=$1 last;
+            rewrite ^/_export/([^/]+)/(.*) /doku.php?do=export_$1&id=$2 last;
+            rewrite ^/(.*) /doku.php?id=$1&$args last;
+          '';
+        };
+
+        "~ \\.php$" = {
+          extraConfig = ''
+            try_files $uri $uri/ /doku.php;
+            include ${config.services.nginx.package}/conf/fastcgi_params;
+            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+            fastcgi_param REDIRECT_STATUS 200;
+            fastcgi_pass unix:${config.services.phpfpm.pools."${app}".socket};
+          '';
+        };
+      };
+
+      extraConfig = ''
+        # Set maximum file upload size to 20MB (same as upload_max_filesize and
+        # post_max_size in the phpOptions).
+        client_max_body_size 20M;
+        client_body_buffer_size 128k;
+      '';
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = [ 8443 31820 ];
+  networking.firewall.allowedUDPPorts = [ 8443 ];
+
+  users.users."${app}" = {
+    isSystemUser = true;
+    group = "${app}";
+  };
+  users.groups."${app}" = { };
+}

config/hosts/eh22-wiki/networking.nix

@@ -0,0 +1,22 @@
+{ ... }:
+
+{
+  networking = {
+    interfaces.net0 = {
+      ipv4.addresses = [
+        {
+          address = "172.31.17.159";
+          prefixLength = 25;
+        }
+      ];
+    };
+    defaultGateway = "172.31.17.129";
+    nameservers = [ "212.12.50.158" "192.76.134.90" ];
+    search = [ "hamburg.ccc.de" ];
+  };
+
+  systemd.network.links."10-net0" = {
+    matchConfig.MACAddress = "BC:24:11:37:F0:AB";
+    linkConfig.Name = "net0";
+  };
+}

config/hosts/esphome/configuration.nix

@@ -0,0 +1,9 @@
+{ ... }:
+{
+  networking = {
+    hostName = "esphome";
+    domain = "z9.ccchh.net";
+  };
+
+  system.stateVersion = "23.05";
+}

config/hosts/esphome/default.nix

@@ -0,0 +1,9 @@
+{ ... }:
+{
+  imports = [
+    ./configuration.nix
+    ./esphome.nix
+    ./networking.nix
+    ./nginx.nix
+  ];
+}

config/hosts/esphome/esphome.nix

@@ -0,0 +1,7 @@
+{ ... }:
+{
+  services.esphome = {
+    enable = true;
+    openFirewall = true;
+  };
+}

config/hosts/esphome/networking.nix

@@ -0,0 +1,29 @@
+{ ... }:
+
+{
+  networking = {
+    interfaces.net0 = {
+      ipv4.addresses = [
+        {
+          address = "10.31.208.24";
+          prefixLength = 23;
+        }
+      ];
+      ipv6.addresses = [
+        {
+          address = "2a07:c480:0:1d0::66";
+          prefixLength = 64;
+        }
+      ];
+    };
+    defaultGateway = "10.31.208.1";
+    defaultGateway6 = "2a07:c480:0:1d0::1";
+    nameservers = [ "10.31.208.1" "2a07:c480:0:1d0::1" ];
+    search = [ "z9.ccchh.net" ];
+  };
+
+  systemd.network.links."10-net0" = {
+    matchConfig.MACAddress = "7E:3C:F0:77:8A:F4";
+    linkConfig.Name = "net0";
+  };
+}