config/hosts/forgejo-actions-runner/configuration.nix

@@ -0,0 +1,7 @@
+{ config, pkgs, ... }:
+
+{
+  networking.hostName = "forgejo-actions-runner";
+
+  system.stateVersion = "23.11";
+}

config/hosts/forgejo-actions-runner/default.nix

@@ -0,0 +1,11 @@
+{ ... }:
+
+{
+  imports = [
+    ./configuration.nix
+    ./docker.nix
+    ./forgejo-actions-runner.nix
+    ./networking.nix
+    ./sops.nix
+  ];
+}

config/hosts/forgejo-actions-runner/docker.nix

@@ -0,0 +1,13 @@
+# Sources for this configuration:
+# - https://nixos.wiki/wiki/Docker
+{ config, pkgs, ... }:
+
+{
+  virtualisation.docker = {
+    enable = true;
+    autoPrune = {
+      enable = true;
+      dates = "weekly";
+    };
+  };
+}

config/hosts/forgejo-actions-runner/forgejo-actions-runner.nix

@@ -0,0 +1,60 @@
+# Sources for this configuration:
+# - https://forgejo.org/docs/latest/admin/actions/
+# - https://forgejo.org/docs/latest/user/actions/
+# - https://docs.gitea.com/next/usage/actions/act-runner
+
+{ config, pkgs, ... }:
+
+{
+  services.gitea-actions-runner = {
+    package = pkgs.forgejo-runner;
+    instances.ccchh-forgejo-global-docker = {
+      enable = true;
+      name = "Global Docker Forgejo Actions Runner";
+      url = "https://git.hamburg.ccc.de/";
+      tokenFile = "/run/secrets/forgejo_actions_runner_registration_token";
+      labels = [ "docker:docker://node:current-bookworm" ];
+      settings = {
+        cache = {
+          proxy_port = 45540;
+        };
+        runner = {
+          capacity = 4;
+        };
+      };
+    };
+
+    instances.ccchh-codeberg-org-diday = {
+      enable = true;
+      name = "ccchh runner for codeberg.org/di-day";
+      url = "https://codeberg.org/";
+      tokenFile = "/run/secrets/codeberg_org_diday_runner_registration_token";
+      labels = [
+        "docker:docker://node:current-bookworm"
+        "debian-latest:docker://node:current-bookworm"
+        "alpine-latest:docker://node:current-alpine"
+      ];
+      settings = {
+        cache = {
+          proxy_port = 45541;
+        };
+        runner = {
+          capacity = 4;
+        };
+      };
+    };
+  };
+
+  sops.secrets."forgejo_actions_runner_registration_token" = {
+    mode = "0440";
+    owner = "root";
+    group = "root";
+    restartUnits = [ "gitea-runner-ccchh\\x2dforgejo\\x2dglobal\\x2ddocker.service" ];
+  };
+  sops.secrets."codeberg_org_diday_runner_registration_token" = {
+    mode = "0440";
+    owner = "root";
+    group = "root";
+    restartUnits = [ "gitea-runner-ccchh\\x2dcodeberg\\x2dorg\\x2ddiday.service" ];
+  };
+}

config/hosts/forgejo-actions-runner/networking.nix

@@ -0,0 +1,27 @@
+{ lib, config, ... }:
+let
+  runnerInstances = lib.attrValues config.services.gitea-actions-runner.instances;
+  runnerCachePorts = lib.map (i: i.settings.cache.proxy_port) runnerInstances;
+in {
+  networking = {
+    interfaces.net0 = {
+      ipv4.addresses = [
+        {
+          address = "172.31.17.155";
+          prefixLength = 25;
+        }
+      ];
+    };
+    defaultGateway = "172.31.17.129";
+    nameservers = [ "212.12.50.158" "192.76.134.90" ];
+    search = [ "hamburg.ccc.de" ];
+  };
+
+  systemd.network.links."10-net0" = {
+    matchConfig.MACAddress = "1E:E0:4E:D0:DA:BE";
+    linkConfig.Name = "net0";
+  };
+
+  # open ports for runner cache proxy so that we can use the cache action
+  networking.firewall.allowedTCPPorts = runnerCachePorts;
+}

config/hosts/forgejo-actions-runner/secrets.yaml

@@ -0,0 +1,149 @@
+forgejo_actions_runner_registration_token: ENC[AES256_GCM,data:gAR2ffrffeuuaOwO6mWcif2e6csKIVoLqrux19iBlrTkFHgo/IlHVL0eSUGqnw==,iv:i12yx/quwT9kj6fPECszo/iG9cVhKX+7dAA6/N09URc=,tag:eO+mWhumgvWzQxYqiRUXbA==,type:str]
+codeberg_org_diday_runner_registration_token: ENC[AES256_GCM,data:thTsLo/eXVPbXt4b8ldae+kGnOR4GbYKOqr1hVJgaL7wZ5GgqWSPcOuhow96Jw==,iv:Fzi+DsKj+4PrwQGEosUntm9l7s78NwzhkmF6e/sfF+s=,tag:oa7mnbGR0J5xi9ruCgRJtQ==,type:str]
+sops:
+  age:
+    - recipient: age19h7xtfmt3py3ydgl8d8fgh8uakxqxjr74flrxev3pgmvvx94kvtq5d932d
+      enc: |
+        -----BEGIN AGE ENCRYPTED FILE-----
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjZEpMZkt6OU5nMEtYcHc0
+        OGdsVDZBcE5nK2ZLbDhaWEVMM2lJcllLVnlzCmNUTXpaVHBLMjlILzJwdDFLMVky
+        ZXdEVmE3aTFMZDJnQ2tqWGRMb1NnZUkKLS0tIDhGWGpoYWNtL24wRnVRejQ5ZkVN
+        YjZFMTh3OTNkOUE0SmZTQXpKSmdGWlEK+Xb6blAdiWoKvffLEQagu5tFpWALJaXm
+        F65M+RNNkJ/YsSJGAWFJepw3ncCMFbmQgGXw5XnyqTlYFhrQ8x5qJg==
+        -----END AGE ENCRYPTED FILE-----
+    - recipient: age10xz2l7ghul7023awcydf4q3wurmszy2tafnadlarj0tvm7kl033sjw5f8t
+      enc: |
+        -----BEGIN AGE ENCRYPTED FILE-----
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQblJIdFAwOFRqbWEvQzVF
+        ODVpQ04xTVpxTERGU3BOMjV4KytBU21neEYwCmoraHhlNjhDelAzR0VxcVNlekhT
+        QkI5ckd1dVFjMHBoTVFTQjlzbTdnTzgKLS0tIGlTY1p0bWxrQWoyM0RwSmx1aDhy
+        TklLZWM0cDBKaGJJM2tQQWRLZXhFYU0Ko7cyvzMvwlGCCP3UAX1+5uTI4srhZ5l9
+        DPaHySiC+rLy+8R9UqEuTKbP4/Aw4NZ/UcfjNnVkqqqNJIODmLoOhg==
+        -----END AGE ENCRYPTED FILE-----
+  lastmodified: "2026-02-18T09:51:37Z"
+  mac: ENC[AES256_GCM,data:4fWsE3U6WxRqlKHKC4ipE+RQ7MPjiZZcTFMSblxty7JjJHAdKUHbthFB+R8gIWxZEjX5WG+IPgUP+AcCLSI9fdcXMqIFMuDun2hiktwqxzLPGYAoCXdTBAd1uCUagvB/rFty6y8umD4J5ITgEGba9pvGdUcng9WVRV+LGDftS1g=,iv:tD9tlcylQWapNCARxPXrKofZXf2BHTt2c4PQqFNj6X8=,tag:pQ8lOqJEFCcCcJot3BYTmQ==,type:str]
+  pgp:
+    - created_at: "2026-02-17T22:21:57Z"
+      enc: |-
+        -----BEGIN PGP MESSAGE-----
+
+        hQIMAz5uSgHG2iMJAQ/7BFboCbCEG1DY5Twf+1cRSAmXs8CSrnoJcmyxrF9daqTB
+        GAqItZcym6I7YbtYMb33jTZDAMFcexvJ+V7+WVBK/v/TISzinJ3m5BafE0DrgsB5
+        HQT8tsFzxIdu/KsUp0C5VQg6gsb2u2T7aFG0wTS4vas2FjcsoJRKNWTv7a1sNWYZ
+        dFRxeyklWEX14kCHeKIxO7+Qe3NVV+6MuwYR8X3YJaAyLtVMIdBp/poE+7Gcsa58
+        rOewheWW/FROTxLZIk3sren6z7M0ZrOz5res2evRDMI9noN3pYMnkNCL/XIvRf9U
+        GqFSruzDoC0a2JcEvSmthSmEHA6wXeOY/EuzXKLoW4luZDsSXshFgBxK0qqGvzbd
+        jIXXYvBWPCMYWRMSqQenLkjfhOQXuSXcywGfKpuQblUL8RiflIqia2o68Vbd9Hq4
+        x9Od+qkauMHZUzsKQoym9pkbrEWpjckg6FevZ1W4o5Qhe9i+JMmE2KIvoYH8tK9F
+        5KQ87jktx4i9df9TJy3n/xbbrWXpo76y5Aoa2LaiD9Nc6lo7sFs3Pegq4wKmYSIh
+        6uaZxa5sto/5kywHrJQGqEyh/fDdNmsh5FlDW7gfFEm9Ti2KSE3m9IvIwppFD4j0
+        xFkHiwHvNn/WMLciVh9qG8auGyxjoXnRRx61QHF31RIYprxWgDoyH/rVz95IuxzS
+        XgEIJk7MnHv9tYCy/lOjbgqLAUGO0+xuO+IfmsvtiD4nfrnaEJAh0+SW3wuCKzaF
+        tx1ZHCYH9j3s50Q624pUgtzDad5QV5IIEgCRyr0NvEvrXvG6U0aXkOEbOcFSZsk=
+        =v3FY
+        -----END PGP MESSAGE-----
+      fp: 18DFCE01456DAB52EA38A6584EDC64F35FA1D6A5
+    - created_at: "2026-02-17T22:21:57Z"
+      enc: |-
+        -----BEGIN PGP MESSAGE-----
+
+        hQIMAw5vwmoEJHQ1AQ/9H+Kn4rF7yUsIdTp5rYhG6EkYkJ/jCeUBJvaOuA95b8HM
+        6csTXj+ttVcFvbU1hQVbOsd7J8Wpmuj/TqMrpFvu/0EYUW5n04y1YI8kpNXDMrFF
+        X/0gk+I+w2eF2X3gJQasVY39DNx56KSRJ0BwGYw287rdeKh8cbiFw64r0rs6zX5j
+        2nqrWgSqxXtWcjhC7Y4Rq8ysWv7dEF2E9Tt2cHYVjn5cs9Vb52PWUA0TxzBzUUqa
+        M1YWat3fwLah6qEs6/9c89LB66SbgH088lEzQHtRIXdOZ9tPOu7/E3iNqYExuIKB
+        eMV0bdW0/tZlnWxAwXrL4rptxjGDqB+Ynv36IeLKZ86ljqSPqaQA7ihCVXnMo2TW
+        IfdlbOtAJiE3IliQf8C1Ajyn32epePBAUyw8o0k2D6UyNyvk8fe0z9++H6Uz+Z7G
+        oLRrxzOHjh6oWK9WBwJQhZ9dnb1n1UYZfvCDwFZBTmUkhIs6UQllIiF5ZjMy4/cc
+        E3FEouu/6VPPjq9d8pGEFcjOvXkLtUErhXP+A8Xvl/fHmtfM0/o1e6gPnMmxGn4k
+        0yXvU+pNO/ID6fc6qMs0nBZRAKGraaeH+wTjpm1exUhhNB2yJviySnElJFyq9vtr
+        AfacrbuW//JQ+19rSKViV9xStRG//xfW7EpknOh3juB7WfnyOXqdfZqT2zQwrvjS
+        XgEoHXmbR7aiDvBCc4CGTmBhWD4An+p3m3m7iSOp27kBqJ3+YSKdVA7mdIo0tpTn
+        9p5Pgz6GHBA5eMwZCb/z3Y7+20PuuEb4/tEBAniw9/Rp0sDJ+9C+V1SdHtbYq8k=
+        =kkQW
+        -----END PGP MESSAGE-----
+      fp: 87AB00D45D37C9E9167B5A5A333448678B60E505
+    - created_at: "2026-02-17T22:21:57Z"
+      enc: |-
+        -----BEGIN PGP MESSAGE-----
+
+        hF4DerEtaFuTeewSAQdAdgME/v0CVfcRZ1zr9SRZksN7vDHDk63g+5k5a/FOvmow
+        0l/6kH1l7p4aOKaAGFbMHzDzljuACB1a4IOJypRA2DokYWRUgqBKwvcHplgXr4l0
+        0l4B2vxPl9W1kcbAg4m+V4PlvXTBGhPUglljtjWy80TisUL1zCXpl3PEvmrypZs7
+        NM47K09RsDiicwTKjxd0Oii2Evz8riLFIth8IWOKXPHoKhiYwN891g1qLSvsrDzE
+        =6B/b
+        -----END PGP MESSAGE-----
+      fp: 057870A2C72CD82566A3EC983695F4FCBCAE4912
+    - created_at: "2026-02-17T22:21:57Z"
+      enc: |-
+        -----BEGIN PGP MESSAGE-----
+
+        hQIMAxjNhCKPP69fARAAjz8RObyKYVAmNwiBsNVNGt0qSIexSYpsMR5SyuBMKShJ
+        NSD4yA6B7Tj+h/ik4VyggOT+9Qfr7zFvFyEHYFXI7k/r+Noyw4uscqr9gNnz0t9N
+        rx4/ZNowsW/3dL+Gab3hjDKObHF41Y1lzojNwcieU8qZmssHZMjIIzyAUePL210f
+        2i87hix9PkK6kKuisORDShnFifEOEPOcijXFL4kH9DilVoZ0Ut5fJoiA+QkQQpaa
+        uHd+Q7F6u9jZrzRLN1SJkb76ElxQAvJYcgTN2s3+c4002DkKVdwCW0qyPlF9wOxT
+        xTngl46NyZ1MH3ByW2xeOgaDYUcBt8qUF4gTMmIaDTIZ+K5XWGu3hmCzNZHD5Nxi
+        bhVKJ8jGENUhM/IfT8CjppRIg5wwU0K/EQE/QQHhIykpz9NaIjikDCxcraBa9DkA
+        rgjp74W9vgR3pBwXJIAsylOZZHy+35rca/JvWWxm2tdeao2WxTA9jdsNdsUOhNyz
+        3xQGGM63ZSUcV0ZgCyhEYeKBzCyRWpFX+GQHboZDp7IaYK68qYZgxnQtoSwl3lJR
+        Qc1IaADnncIDyGEIDTciLbjbDx7TId4wrpRWUPxVY2FVY+hV+oRNaoYMuT2jiDVw
+        PimQ5iVUhl/ThHWPLqok6d3ypROZtVS6EUFzd4ASUrYRYB5Twvoujr7Yg7jSZV/S
+        XgFcxQ31/i/Vi9owjwX7u0/eclU/3XE2/MqUCcoMntnq2dCN/IpF3rROit5Tzs+W
+        BT7i57cpGh9ZXf1dbNSyRwydp/C8tjnwDqf3RJ5hj4fmlK6zLJqtPFPdusOO4SU=
+        =z1tc
+        -----END PGP MESSAGE-----
+      fp: F38C9D4228FC6F674E322D9C3326D914EB9B8F55
+    - created_at: "2026-02-17T22:21:57Z"
+      enc: |-
+        -----BEGIN PGP MESSAGE-----
+
+        hQIMA1Hthzn+T1OoAQ/+K1+QTZ8N3Ha0nErrRWClBu5Cxec5/eb2Q/n4dfNGkrxx
+        xBk0thoGAyoYpifSqhXbVi/MA8+tzHdtPlKJFCn5NETrnEdu84+sJQE4zfDljLiX
+        fXZZ/+YQ0P3VosR2NI3W1r/hJWs4oJ9oPz4FfMlfPK+/UOOdQEtGkx9rjYaus9Ax
+        VI6s5qvYM6XD5rkLxTqZZhEa+CjLtSjD5WqNbCT/8fX5ErnU06jW6jXvRNQSq1Mt
+        hpqMIBygUE39K2apEuphE9RRD3bS1M2VjCB882yVSM2QZyepilRBjS5ryyQhKK/9
+        Q0mdIw9mxhdgaCzoglN2k1c6WjddZ409osdnYcMtsH4+NlHDtNfSFLIk6JrxAXIQ
+        bNR8gtr4D85LoQki/RvEweUd4M40DneIO1dTK4/WG71Lcle3B6p0ynDMjmXq1coY
+        Qn0c4KAh1RIX/eEJGS23Wle/XZbp89yaFFEF667+HmwL0CY6I5pcVEn/iuXLoNHI
+        93y/9h7mhB8ZGICPbF7nXBfQQTrxjfc9vZq0PVdjlXPIMRjZcbZOzlKByYLsQIW0
+        UtzLScfFyKsogcUGJIlGrcQyAmLb3dr7i1elVWlanggCXdKnecBRbSkEfK7SmwiN
+        t8hRaaM06P3kRbTHWxt+4sjTQWofo+C76qsMZYHFpI0TTOP/jwnn/h3E9dQxdaHS
+        XgHzVEsJkQiQ51w7pPP1LcKkCxQv1KA9QC+LAFGhmWXnQ1m8E3whao2S07UjlTVw
+        XMAtuOVT2r09dYGgpcEaMiK2Hb9UNg/ma9o29fSm+2rLuxw3qSldgNNx/s8hyzc=
+        =0kev
+        -----END PGP MESSAGE-----
+      fp: 5DA93D5C9D7320E1BD3522C79C78172B3551C9FD
+    - created_at: "2026-02-17T22:21:57Z"
+      enc: |-
+        -----BEGIN PGP MESSAGE-----
+
+        hQIMA46L6MuPqfJqAQ//ZYw2qRn+YhiEoBpbUsW95NJpZJFizwssh1dC/Lda5qFs
+        55G1Jls9FHHQ+LmRnE6wyx26bbpQ257FNzCsxsfwAuiznx31j1yHc6LZbuJ3+DsJ
+        slRaad13RdLyGgo2psaXbBMEgr22FAFDm+S98aYnyv8yvtOZvutEljGm9yhHLGKy
+        XnFf8LwvvqdT4RolfxiPncGsd9hbFYZh7/zcJTSzfYSnHI30Ly5Na74vSaamuIwR
+        oPnSxlf8jIX5RUzssjyOHGLQLd327fKuveVxX9CUK/PGWLgQYuTL5PWZwQGhzgSY
+        E+2EerpGLVJzSQB0TUU5xGwOQkDlPveSSUg0IoDlivMnrphWUFd+bcIMbipVXolf
+        qpiJeO1t0YW1WAQBzkQ3J+uXgX0dJqWfzfMsbn3j4/WZq5ZlEX6x+ovHv6Z7ZXTz
+        6lcF6Gn0dH/omhkqduK3bLwBWAkmh7gWNssEXdPQWGWA8j3WM+IPZKIegpecflKN
+        pv7jOyD95othMUul/iiH/E3aSbCggN5maoZHG2Cp1TGXkGOLFCNs143LGTVligOU
+        yD8n0uAQ8e50J7YwytSi2g0pzFkZyriLmrZqKFt9UUOfANivrO9p8J0Bo9wEHjY0
+        OdKKu8ASgjYk0t4VHGeZF3GPSaGE/k7LaUb9+5t02sxypxeVqQXpvjU/D8c/0wPS
+        XgGQs2bjszJIyRwcTmUHD8YAvuxf0MkyKCKpJSsnbJ4XmgkI+gGQpg0GLQROXjZ4
+        8GqLzKb+3d3QDUPQmh+z5Ur1nFcVS214wycICWSTsIUyam59+4rVxV1i33DcAs4=
+        =BJfi
+        -----END PGP MESSAGE-----
+      fp: 8996B62CBD159DCADD3B6DC08BB33A8ABCF7BC4A
+    - created_at: "2026-02-17T22:21:57Z"
+      enc: |-
+        -----BEGIN PGP MESSAGE-----
+
+        hF4DQrf1tCqiJxoSAQdA7rerN+IVKpzyAdXVuAN19+CIjQ6DnHatGr92/YhAEiQw
+        J913tdR+Yb/FdPWQrn0NR2eTUuKm/Es0NRvJY/YEnhQble+3qYvxFP6dI+vm1cmz
+        0l4BNxMhGqyOmsDFf58yrJmrHdnapBOmiqCkJBTc9gAQH534di0Ps+grV04jzkXW
+        DUO/sIPANPpvqqCJNt1uekKNH2J57OMaagnBTivMBTq0HAuRN1RhcrjGof9ttCj1
+        =desh
+        -----END PGP MESSAGE-----
+      fp: B71138A6A8964A3C3B8899857B4F70C356765BAB
+  unencrypted_suffix: _unencrypted
+  version: 3.11.0

config/hosts/forgejo-actions-runner/sops.nix

@@ -0,0 +1,7 @@
+{ ... }:
+
+{
+  sops = {
+    defaultSopsFile = ./secrets.yaml;
+  };
+}

config/hosts/git/forgejo.nix

@@ -60,9 +60,6 @@
       repo = {
         DEFAULT_REPO_UNITS = "repo.code,repo.issues,repo.pulls";
       };
-      repository = {
-        DISABLE_DOWNLOAD_SOURCE_ARCHIVES = true;
-      };
       actions = {
         ENABLED = true;
         ARTIFACT_RETENTION_DAYS = 30;
@@ -87,12 +84,6 @@
         REPO_INDEXER_TYPE = "elasticsearch";
         REPO_INDEXER_CONN_STR = "http://127.0.0.1:9200";
       };
-      "cron.archive_cleanup" = {
-          ENABLED = true;
-          RUN_AT_START = true;
-          SCHEDULE = "@every 1h";
-          OLDER_THAN = "2h";
-      };
     };
   };
 

config/hosts/public-web-static/configuration.nix

@@ -1,10 +1,7 @@
 { ... }:
 
 {
-  networking = {
+  networking.hostName = "public-web-static";
-    hostName = "public-web-static";
-    domain = "hosts.hamburg.ccc.de";
-  };
 
   system.stateVersion = "23.05";
 }

config/hosts/public-web-static/networking.nix

@@ -3,14 +3,14 @@
 {
   networking = {
     interfaces.net0 = {
-      ipv6.addresses = [
+      ipv4.addresses = [
         {
-          address = "2a00:14b0:42:102::17";
+          address = "172.31.17.151";
-          prefixLength = 64;
+          prefixLength = 25;
         }
       ];
     };
-    defaultGateway6 = "2a00:14b0:42:102::1";
+    defaultGateway = "172.31.17.129";
     nameservers = [ "212.12.50.158" "192.76.134.90" ];
     search = [ "hamburg.ccc.de" ];
   };

config/hosts/public-web-static/secrets.yaml

@@ -1,9 +1,10 @@
-spaceapid_config_ccchh_credentials: ENC[AES256_GCM,data:0fOL/gFCazBqRG2QuuRiUN/xQsfAFY+5xx5Y9PUIRMn7yh+kZjC3zrjOKyP/98x1cqwBjXTSJX9IZCiNTDS4drjhCleKTX7zsL3KluWhZwS0bey8iUYLjhaXuH2gE5h7kk18S6acpBF75JAdwmfP5Tw+ewggIt3AHtDoDWLxSHbRYsHACeyb5BC7ftAOSpqhqQTBP756XfUe+dPrvsECD6YzYRgU4JGaKKm69M97yoeghvkLgKYSxN4urelZTLGhe1tqgA6eCSznRV7+lWHcKfocjqCsbruxB4711/p7FlFD/miohT78SFe+scTLM0o7t2o2Kz4n05gJHp+1X3mp5bfyZaRceyceWkwEgxg58zjlhA3oC9CJjNAa3fPFolMVHzZJMGPVnn0t0OPTsr7VxoIJewOm/zlPxN0=,iv:5Dep+oBqAnvKiowbRbRkMGrpTEbTEbzv0tVXz6lKVdU=,tag:qOkqNCkvWrmXZ6bAtBkjSw==,type:str]
+spaceapid_config_ccchh_credentials: ENC[AES256_GCM,data:5IClrKKMO/AztQuGabrnoRFItYNeEmVWGeafomVO94pL1RKzL1sCxBxnmzvJFPb/8Y+6FXMh+Mim4DP8B2RaJMLpmqCv+76N/5+527SZ6gn9i2Klg6q0kD9RzJv40qHq/NYLCa24tpcZDt7eB0EOgqLsKUmtX2LrQjjnN3NzjAevJGKQ5ypnb7xygjft2KrpvlR1hMnZ0XpSLDTNR1AmImxE24JtDaJKzwXbptr2IZvm1UFkNslxdqHPjN+N8+MSSLhqHy/FdcY2ADvsTX1jtjnjkb+9E30QOeCiFPKSmWtSGiQ9sPcQna1yr717Vk0EiNSAWDQ2fMZyJUgBXG6w3wiZbxfJmxvshLPs5KguF9NHER+Seps1QiE0p16c0IS/0Y24UYrK2GyUIcSReGufjxUFGTJHFSsNANac34H/RTs7BkoZ,iv:8WzTRaXVeH5GKmigMVTLVBnhy6nXZnTZHLAYHcqDs2s=,tag:jTdgz0gmruMWWDBQ3h70vw==,type:str]
 staging.diday.org:
   lego.env: ENC[AES256_GCM,data:FHCHBrjapNGSAtUnDTMZfeAZJqZV65d8COBJF8lzZmNBiw0jXyrmJ6rnUbYmnPN54T+1e8V0dzkdqmYX708tpFWagOPPQ9Ko+D+lV5yJ4hj/lhunuPSetWC/5dGBfN6CbA==,iv:WZ8CWu40ToF2mbpSUR6pDdUa6jcWPIUsWhVaGGBwx1E=,tag:8CohD3CwcUm2LzAJ8Lfimg==,type:str]
 sops:
   age:
-    - enc: |
+    - recipient: age19h7xtfmt3py3ydgl8d8fgh8uakxqxjr74flrxev3pgmvvx94kvtq5d932d
+      enc: |
         -----BEGIN AGE ENCRYPTED FILE-----
         YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOaEZqOHRMMko4S1loUXdm
         aTlsS1RDNHdjdkZWSG1aR0d4Vmh4dVVZQWo0CmJUbm9hZzJqaDBOMTVObG9HWFF1
@@ -11,8 +12,8 @@ sops:
         OUJkei9zWmhyazc5T2FVbElFRG9RaFkKu4lZrg8UWVVk75eY8HBdLIT4BNw2UcyV
         +7X2L7ltv2z31T4cKnnZrsyeG6fBGCLvuI5EQBd09OCZEUZ4u7qPOA==
         -----END AGE ENCRYPTED FILE-----
-      recipient: age19h7xtfmt3py3ydgl8d8fgh8uakxqxjr74flrxev3pgmvvx94kvtq5d932d
+    - recipient: age19s7r8sf7j6zk24x9vumawgxpd2q8epyv7p9qsjntw7v9s3v045mqhmsfp0
-    - enc: |
+      enc: |
         -----BEGIN AGE ENCRYPTED FILE-----
         YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzMkdGQ0tpSUlWQ25ERTMy
         QXhNdUYzdlBPUXR0V0NyOHpZbDY5RVd1ZXg0Cm40TjQvMXVGamM1akMzRUFuc3NO
@@ -20,9 +21,8 @@ sops:
         ZE9rN3R4aHRXR0dBc2oxcEYrL1lxZncKuVocF84+ge1gyzfNjIxhwNgd8+kJIpxh
         yREbS2mrQ2zvSMtw9OoA0KJSpoHZfIiCwn2uYkQDPiGB/721JmA12Q==
         -----END AGE ENCRYPTED FILE-----
-      recipient: age19s7r8sf7j6zk24x9vumawgxpd2q8epyv7p9qsjntw7v9s3v045mqhmsfp0
+  lastmodified: "2026-02-27T20:40:06Z"
-  lastmodified: "2026-08-11T13:23:00Z"
+  mac: ENC[AES256_GCM,data:Nsburro0nSV8CLZsxLaFrwsE5EIz8qQOlclNynbRT03XkfaPN2Pup8UWg9QL34KGcGUweqtytxZvLWjwfJYEsIkLqi4ZfrpXpEfBowq5aNbWHzDJDW5QqZKaUPmMQxiPVm1EhXmyvfVdFEueOhfFLbuNUSvNWaFk/7l2utTeLrs=,iv:dSJDVYGdaunvRqj+EkPGy3qxR9suV0s2Mm26silX24M=,tag:hqA+4FpP2PwatRMnZUcUqw==,type:str]
-  mac: ENC[AES256_GCM,data:jZ9G+EcoGBfWv3uYVkk6DF3HJxHpxMYZQW/4BQd4V/YrluZp5dg4Bw/coRb3ka8n1EBLj+hxPSJyCtXwRlW1sMUvl4mbKpMTe5dtd67lpDMXbQ/3AA53cD/52Mlvv76Ywff7kjx4XhbBCnYEdBfMABcVLPd/rgmKtMKRtaYLjmQ=,iv:yPwKgsg2JgqB3QT7GG2+UlPlP+REOjlo/FKYwgmctZw=,tag:944RbdkitJ37aEmcrX7iQQ==,type:str]
   pgp:
     - created_at: "2026-02-17T22:22:02Z"
       enc: |-
@@ -147,4 +147,4 @@ sops:
         -----END PGP MESSAGE-----
       fp: B71138A6A8964A3C3B8899857B4F70C356765BAB
   unencrypted_suffix: _unencrypted
-  version: 3.13.3
+  version: 3.11.0

config/hosts/public-web-static/spaceapid-config/ccchh-dynamic.json

@@ -77,7 +77,7 @@
     "state": {
       "open": {
         "allowed_credentials": [
-          "dooris"
+          "dooris-hauptraum"
         ]
       }
     }

config/hosts/public-web-static/virtualHosts/branding-resources.hamburg.ccc.de.nix

@@ -14,10 +14,6 @@ in
       serverName = "branding-resources.hamburg.ccc.de";
 
       listen = [
-        {
-          addr = "[::]";
-          port = 31820;
-        }
         {
           addr = "0.0.0.0";
           port = 31820;
@@ -30,12 +26,6 @@ in
       useACMEHost = "branding-resources.hamburg.ccc.de";
 
       listen = [
-        {
-          addr = "[::]";
-          port = 8443;
-          ssl = true;
-          proxyProtocol = true;
-        }
         {
           addr = "0.0.0.0";
           port = 8443;

config/hosts/public-web-static/virtualHosts/c3cat.de.nix

@@ -16,10 +16,6 @@ in {
       ];
 
       listen = [
-        {
-          addr = "[::]";
-          port = 31820;
-        }
         {
           addr = "0.0.0.0";
           port = 31820;
@@ -32,12 +28,6 @@ in {
       useACMEHost = "${domain}";
 
       listen = [
-        {
-          addr = "[::]";
-          port = 8443;
-          ssl = true;
-          proxyProtocol = true;
-        }
         {
           addr = "0.0.0.0";
           port = 8443;
@@ -71,12 +61,6 @@ in {
       useACMEHost = "${domain}";
 
       listen = [
-        {
-          addr = "[::]";
-          port = 8443;
-          ssl = true;
-          proxyProtocol = true;
-        }
         {
           addr = "0.0.0.0";
           port = 8443;

config/hosts/public-web-static/virtualHosts/c3dog.de.nix

@@ -3,7 +3,7 @@
 let
   domain = "c3dog.de";
   dataDir = "/var/www/${domain}";
-  deployUser = "c3dog-website-deploy";
+  deployUser = "c3cat-website-deploy";
 in {
   security.acme.certs."${domain}".extraDomainNames = [ "www.${domain}" ];
 
@@ -16,10 +16,6 @@ in {
       ];
 
       listen = [
-        {
-          addr = "[::]";
-          port = 31820;
-        }
         {
           addr = "0.0.0.0";
           port = 31820;
@@ -32,12 +28,6 @@ in {
       useACMEHost = "${domain}";
 
       listen = [
-        {
-          addr = "[::]";
-          port = 8443;
-          ssl = true;
-          proxyProtocol = true;
-        }
         {
           addr = "0.0.0.0";
           port = 8443;
@@ -67,12 +57,6 @@ in {
       useACMEHost = "${domain}";
 
       listen = [
-        {
-          addr = "[::]";
-          port = 8443;
-          ssl = true;
-          proxyProtocol = true;
-        }
         {
           addr = "0.0.0.0";
           port = 8443;
@@ -99,13 +83,4 @@ in {
   systemd.tmpfiles.rules = [
     "d ${dataDir} 0755 ${deployUser} ${deployUser}"
   ];
-
-  users.users."${deployUser}" = {
-    isNormalUser = true;
-    group = "${deployUser}";
-    openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB7iXsVArl4SbDczb4U3zGkZCiVO/lfn12gkOEOnKmEX deploy key for c3dog.de"
-    ];
-  };
-  users.groups."${deployUser}" = { };
 }

config/hosts/public-web-static/virtualHosts/cpu.ccc.de.nix

@@ -17,10 +17,6 @@ in
       serverName = "${domain}";
 
       listen = [
-        {
-          addr = "[::]";
-          port = 31820;
-        }
         {
           addr = "0.0.0.0";
           port = 31820;
@@ -34,12 +30,6 @@ in
       useACMEHost = "${domain}";
 
       listen = [
-        {
-          addr = "[::]";
-          port = 8443;
-          ssl = true;
-          proxyProtocol = true;
-        }
         {
           addr = "0.0.0.0";
           port = 8443;
@@ -91,20 +81,12 @@ in
         "local.ccc.de"
       ];
 
-      listen = [
+      listen = [{
-        {
+        addr = "0.0.0.0";
-          addr = "[::]";
+        port = 8443;
-          port = 8443;
+        ssl = true;
-          ssl = true;
+        proxyProtocol = true;
-          proxyProtocol = true;
+      }];
-        }
-        {
-          addr = "0.0.0.0";
-          port = 8443;
-          ssl = true;
-          proxyProtocol = true;
-        }
-      ];
 
       locations."/".return = "302 https://cpu.ccc.de";
 

config/hosts/public-web-static/virtualHosts/cryptoparty-hamburg.de.nix

@@ -16,10 +16,6 @@ in
       serverName = "${domain}";
 
       listen = [
-        {
-          addr = "[::]";
-          port = 31820;
-        }
         {
           addr = "0.0.0.0";
           port = 31820;
@@ -32,12 +28,6 @@ in
       useACMEHost = "${domain}";
 
       listen = [
-        {
-          addr = "[::]";
-          port = 8443;
-          ssl = true;
-          proxyProtocol = true;
-        }
         {
           addr = "0.0.0.0";
           port = 8443;
@@ -65,12 +55,6 @@ in
       useACMEHost = "${domain}";
 
       listen = [
-        {
-          addr = "[::]";
-          port = 8443;
-          ssl = true;
-          proxyProtocol = true;
-        }
         {
           addr = "0.0.0.0";
           port = 8443;

config/hosts/public-web-static/virtualHosts/default.nix

@@ -13,22 +13,16 @@
     ./hacker.tours.nix
     ./hackertours.hamburg.ccc.de.nix
     ./hamburg.ccc.de.nix
-    ./infra-docs.hamburg.ccc.de.nix
     ./spaceapi.hamburg.ccc.de.nix
     ./staging.c3cat.de.nix
-    ./staging.c3dog.de.nix
     ./staging.cryptoparty-hamburg.de.nix
     ./staging.docs.c3voc.de.nix
     ./staging.hacker.tours.nix
     ./staging.hackertours.hamburg.ccc.de.nix
     ./staging.hamburg.ccc.de.nix
-    ./staging.infra-docs.hamburg.ccc.de.nix
     ./www.hamburg.ccc.de.nix
     ./diday.org.nix
     ./staging.diday.org.nix
     ./historic-easterhegg
-    ./ueberwachungsfrei-kundgebung.nix
-    ./didays.de.nix
-    ./staging.didays.de.nix
   ];
 }

config/hosts/public-web-static/virtualHosts/diday.org.nix

@@ -6,16 +6,16 @@ let
   deployUser = "diday-website-deploy";
 in
 {
+  security.acme.certs."${domain}".extraDomainNames = [
+    "did.hamburg.ccc.de"
+  ];
+
   services.nginx.virtualHosts = {
     "acme-${domain}" = {
       enableACME = true;
       serverName = "${domain}";
 
       listen = [
-        {
-          addr = "[::]";
-          port = 31820;
-        }
         {
           addr = "0.0.0.0";
           port = 31820;
@@ -23,17 +23,33 @@ in
       ];
     };
 
+    "did.hamburg.ccc.de" = {
+      forceSSL = true;
+      useACMEHost = "${domain}";
+
+      listen = [
+        {
+          addr = "0.0.0.0";
+          port = 8443;
+          ssl = true;
+          proxyProtocol = true;
+        }
+      ];
+
+      basicAuth = {
+        "preview" = "liebe";
+      };
+
+      extraConfig = ''
+        return 301 https://diday.org;
+      '';
+    };
+
     "${domain}" = {
       forceSSL = true;
       useACMEHost = "${domain}";
 
       listen = [
-        {
-          addr = "[::]";
-          port = 8443;
-          ssl = true;
-          proxyProtocol = true;
-        }
         {
           addr = "0.0.0.0";
           port = 8443;
@@ -42,6 +58,10 @@ in
         }
       ];
 
+      basicAuth = {
+        "preview" = "liebe";
+      };
+
       root = "${dataDir}";
 
       extraConfig = ''

config/hosts/public-web-static/virtualHosts/didays.de.nix

@@ -1,73 +0,0 @@
-{ pkgs, ... }:
-
-let
-  domain = "didays.de";
-  dataDir = "/var/www/${domain}";
-  deployUser = "didays-deploy";
-in {
-  services.nginx.virtualHosts = {
-    "acme-${domain}" = {
-      enableACME = true;
-      serverName = "${domain}";
-
-      listen = [
-        {
-          addr = "[::]";
-          port = 31820;
-        }
-        {
-          addr = "0.0.0.0";
-          port = 31820;
-        }
-      ];
-    };
-
-    "${domain}" = {
-      forceSSL = true;
-      useACMEHost = "${domain}";
-
-      listen = [
-        {
-          addr = "[::]";
-          port = 8443;
-          ssl = true;
-          proxyProtocol = true;
-        }
-        {
-          addr = "0.0.0.0";
-          port = 8443;
-          ssl = true;
-          proxyProtocol = true;
-        }
-      ];
-
-      root = "${dataDir}";
-
-      extraConfig = ''
-        # Make use of the ngx_http_realip_module to set the $remote_addr and
-        # $remote_port to the client address and client port, when using proxy
-        # protocol.
-        # First set our proxy protocol proxy as trusted.
-        set_real_ip_from 172.31.17.140;
-        # Then tell the realip_module to get the addreses from the proxy protocol
-        # header.
-        real_ip_header proxy_protocol;
-
-        port_in_redirect off;
-      '';
-    };
-  };
-
-  systemd.tmpfiles.rules = [
-    "d ${dataDir} 0755 ${deployUser} ${deployUser}"
-  ];
-
-  users.users."${deployUser}" = {
-    isNormalUser = true;
-    group = "${deployUser}";
-    openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBEcEfs6qiUwjlqsHwzS1WvaVQOPEhRRup5RE+K1wZ72 deploy key for didays"
-    ];
-  };
-  users.groups."${deployUser}" = { };
-}

config/hosts/public-web-static/virtualHosts/docs.c3voc.de.nix

@@ -11,10 +11,6 @@ in {
       serverName = "${domain}";
 
       listen = [
-        {
-          addr = "[::]";
-          port = 31820;
-        }
         {
           addr = "0.0.0.0";
           port = 31820;
@@ -27,12 +23,6 @@ in {
       useACMEHost = "${domain}";
 
       listen = [
-        {
-          addr = "[::]";
-          port = 8443;
-          ssl = true;
-          proxyProtocol = true;
-        }
         {
           addr = "0.0.0.0";
           port = 8443;
@@ -52,8 +42,6 @@ in {
         # Then tell the realip_module to get the addreses from the proxy protocol
         # header.
         real_ip_header proxy_protocol;
-
-        port_in_redirect off;
       '';
     };
   };

config/hosts/public-web-static/virtualHosts/element-admin.hamburg.ccc.de.nix

@@ -1,14 +1,14 @@
 { config, pkgs, ... }:
 
 let
-  elementAdminVersion = "0.1.11";
+  elementAdminVersion = "0.1.10";
   elementAdmin = pkgs.stdenv.mkDerivation (finalAttrs: {
     pname = "element-admin";
     version = elementAdminVersion;
 
     src = pkgs.fetchzip {
       url = "https://github.com/element-hq/element-admin/archive/refs/tags/v${elementAdminVersion}.zip";
-      sha256 = "sha256-tSUTDPspQJjvP1KN4nUr4LYyjNQFj4pKMMA8JmavIxo=";
+      sha256 = "sha256-dh7tmzAaTfKB9FuOVhLHpOIsTZK1qMvNq16HeObHOqI=";
     };
 
     nativeBuildInputs = [
@@ -19,7 +19,7 @@ let
     pnpmDeps = pkgs.pnpm.fetchDeps {
       inherit (finalAttrs) pname version src;
       fetcherVersion = 2;
-      hash = "sha256-Hf4PWey5bczSNbc3QQ9z9X3OVUZ7VHXw7BHGQqJWPac=";
+      hash = "sha256-S/MdfUv6q+PaAKWYHxVY80BcpL81dOfpPVhNxEPQVE4=";
     };
 
     buildPhase = ''
@@ -40,10 +40,6 @@ in
       serverName = "element-admin.hamburg.ccc.de";
 
       listen = [
-        {
-          addr = "[::]";
-          port = 31820;
-        }
         {
           addr = "0.0.0.0";
           port = 31820;
@@ -56,12 +52,6 @@ in
       useACMEHost = "element-admin.hamburg.ccc.de";
 
       listen = [
-        {
-          addr = "[::]";
-          port = 8443;
-          ssl = true;
-          proxyProtocol = true;
-        }
         {
           addr = "0.0.0.0";
           port = 8443;

config/hosts/public-web-static/virtualHosts/element.hamburg.ccc.de.nix

@@ -1,10 +1,10 @@
 { pkgs, ... }:
 
 let
-  elementWebVersion = "1.12.18";
+  elementWebVersion = "1.12.0";
   element-web = pkgs.fetchzip {
     url = "https://github.com/element-hq/element-web/releases/download/v${elementWebVersion}/element-v${elementWebVersion}.tar.gz";
-    sha256 = "sha256-RvPJg28hgOgFs0GFZ9EPypQkUPkAns0alXYJeNst4Bk=";
+    sha256 = "sha256-2kXQFUhLYyEKuXYw+n94JGlTN2VJHRpjmu78u8gdaro=";
   };
   elementSecurityHeaders = ''
     # Configuration best practices
@@ -24,10 +24,6 @@ in
       serverName = "element.hamburg.ccc.de";
 
       listen = [
-        {
-          addr = "[::]";
-          port = 31820;
-        }
         {
           addr = "0.0.0.0";
           port = 31820;
@@ -40,12 +36,6 @@ in
       useACMEHost = "element.hamburg.ccc.de";
 
       listen = [
-        {
-          addr = "[::]";
-          port = 8443;
-          ssl = true;
-          proxyProtocol = true;
-        }
         {
           addr = "0.0.0.0";
           port = 8443;

config/hosts/public-web-static/virtualHosts/hacker.tours.nix

@@ -12,10 +12,6 @@ in
       serverName = "${domain}";
 
       listen = [
-        {
-          addr = "[::]";
-          port = 31820;
-        }
         {
           addr = "0.0.0.0";
           port = 31820;
@@ -26,18 +22,12 @@ in
     "${domain}" = {
       forceSSL = true;
       useACMEHost = "${domain}";
-
+      
       locations."/shop" = {
         return = "302 https://tickets.hamburg.ccc.de";
       };
 
       listen = [
-        {
-          addr = "[::]";
-          port = 8443;
-          ssl = true;
-          proxyProtocol = true;
-        }
         {
           addr = "0.0.0.0";
           port = 8443;

config/hosts/public-web-static/virtualHosts/hackertours.hamburg.ccc.de.nix

@@ -12,10 +12,6 @@ in
       serverName = "${domain}";
 
       listen = [
-        {
-          addr = "[::]";
-          port = 31820;
-        }
         {
           addr = "0.0.0.0";
           port = 31820;
@@ -28,12 +24,6 @@ in
       useACMEHost = "${domain}";
 
       listen = [
-        {
-          addr = "[::]";
-          port = 8443;
-          ssl = true;
-          proxyProtocol = true;
-        }
         {
           addr = "0.0.0.0";
           port = 8443;

config/hosts/public-web-static/virtualHosts/hamburg.ccc.de.nix

@@ -7,10 +7,6 @@
       serverName = "hamburg.ccc.de";
 
       listen = [
-        {
-          addr = "[::]";
-          port = 31820;
-        }
         {
           addr = "0.0.0.0";
           port = 31820;
@@ -24,12 +20,6 @@
       default = true;
 
       listen = [
-        {
-          addr = "[::]";
-          port = 8443;
-          ssl = true;
-          proxyProtocol = true;
-        }
         {
           addr = "0.0.0.0";
           port = 8443;
@@ -99,14 +89,6 @@
         return = "302 https://cloud.hamburg.ccc.de/apps/calendar/embed/QJAdExziSnNJEz5g";
       };
 
-      # Redirects for blog post edits.
-      locations."/blog/2026/05/23/der-ccchh-sagt-nein-zu-olympia-in-hamburg" = {
-        return = "302 https://hamburg.ccc.de/blog/2026/05/31/der-ccchh-sagt-nein-zu-olympia-in-hamburg/";
-      };
-      locations."/blog/2026/05/23/der-ccchh-sagt-nein-zu-olympia-in-hamburg/" = {
-        return = "302 https://hamburg.ccc.de/blog/2026/05/31/der-ccchh-sagt-nein-zu-olympia-in-hamburg/";
-      };
-
       extraConfig = ''
         # Make use of the ngx_http_realip_module to set the $remote_addr and
         # $remote_port to the client address and client port, when using proxy

config/hosts/public-web-static/virtualHosts/historic-easterhegg/eh03.nix

@@ -25,16 +25,10 @@ in
         "easterhegg2003.hamburg.ccc.de"
         "www.easterhegg2003.hamburg.ccc.de"
       ];
-      listen = [
+      listen = [{
-        {
+        addr = "0.0.0.0";
-          addr = "[::]";
+        port = 31820;
-          port = 31820;
+      }];
-        }
-        {
-          addr = "0.0.0.0";
-          port = 31820;
-        }
-      ];
     };
 
     "easterhegg2003.hamburg.ccc.de" = {
@@ -46,20 +40,12 @@ in
         "www.easterhegg2003.hamburg.ccc.de"
       ];
 
-      listen = [
+      listen = [{
-        {
+        addr = "0.0.0.0";
-          addr = "[::]";
+        port = 8443;
-          port = 8443;
+        ssl = true;
-          ssl = true;
+        proxyProtocol = true;
-          proxyProtocol = true;
+      }];
-        }
-        {
-          addr = "0.0.0.0";
-          port = 8443;
-          ssl = true;
-          proxyProtocol = true;
-        }
-      ];
 
       locations."/".return = "302 https://eh03.easterhegg.eu";
 
@@ -79,26 +65,18 @@ in
       forceSSL = true;
       useACMEHost = "eh03.easterhegg.eu";
 
-      listen = [
+      listen = [{
-        {
+        addr = "0.0.0.0";
-          addr = "[::]";
+        port = 8443;
-          port = 8443;
+        ssl = true;
-          ssl = true;
+        proxyProtocol = true;
-          proxyProtocol = true;
+      }];
-        }
-        {
-          addr = "0.0.0.0";
-          port = 8443;
-          ssl = true;
-          proxyProtocol = true;
-        }
-      ];
 
       locations."/" = {
         index = "index.html";
         root = eh03;
         extraConfig = ''
-          # Set default_type to html
+          # Set default_type to html 
           default_type text/html;
           # Enable SSI
           ssi on;

config/hosts/public-web-static/virtualHosts/historic-easterhegg/eh05.nix

@@ -25,16 +25,10 @@ in
         "easterhegg2005.hamburg.ccc.de"
         "www.easterhegg2005.hamburg.ccc.de"
       ];
-      listen = [
+      listen = [{
-        {
+        addr = "0.0.0.0";
-          addr = "[::]";
+        port = 31820;
-          port = 31820;
+      }];
-        }
-        {
-          addr = "0.0.0.0";
-          port = 31820;
-        }
-      ];
     };
 
     "easterhegg2005.hamburg.ccc.de" = {
@@ -46,20 +40,12 @@ in
         "www.easterhegg2005.hamburg.ccc.de"
       ];
 
-      listen = [
+      listen = [{
-        {
+        addr = "0.0.0.0";
-          addr = "[::]";
+        port = 8443;
-          port = 8443;
+        ssl = true;
-          ssl = true;
+        proxyProtocol = true;
-          proxyProtocol = true;
+      }];
-        }
-        {
-          addr = "0.0.0.0";
-          port = 8443;
-          ssl = true;
-          proxyProtocol = true;
-        }
-      ];
 
       locations."/".return = "302 https://eh05.easterhegg.eu";
 
@@ -79,26 +65,18 @@ in
       forceSSL = true;
       useACMEHost = "eh05.easterhegg.eu";
 
-      listen = [
+      listen = [{
-        {
+        addr = "0.0.0.0";
-          addr = "[::]";
+        port = 8443;
-          port = 8443;
+        ssl = true;
-          ssl = true;
+        proxyProtocol = true;
-          proxyProtocol = true;
+      }];
-        }
-        {
-          addr = "0.0.0.0";
-          port = 8443;
-          ssl = true;
-          proxyProtocol = true;
-        }
-      ];
 
       locations."/" = {
         index = "index.shtml";
         root = eh05;
         extraConfig = ''
-          # Set default_type to html
+          # Set default_type to html 
           default_type text/html;
           # Enable SSI
           ssi on;

config/hosts/public-web-static/virtualHosts/historic-easterhegg/eh07.nix

@@ -29,16 +29,10 @@ in
         "easterhegg2007.hamburg.ccc.de"
         "www.easterhegg2007.hamburg.ccc.de"
       ];
-      listen = [
+      listen = [{
-        {
+        addr = "0.0.0.0";
-          addr = "[::]";
+        port = 31820;
-          port = 31820;
+      }];
-        }
-        {
-          addr = "0.0.0.0";
-          port = 31820;
-        }
-      ];
     };
 
     "easterhegg2007.hamburg.ccc.de" = {
@@ -52,20 +46,12 @@ in
         "www.easterhegg2007.hamburg.ccc.de"
       ];
 
-      listen = [
+      listen = [{
-        {
+        addr = "0.0.0.0";
-          addr = "[::]";
+        port = 8443;
-          port = 8443;
+        ssl = true;
-          ssl = true;
+        proxyProtocol = true;
-          proxyProtocol = true;
+      }];
-        }
-        {
-          addr = "0.0.0.0";
-          port = 8443;
-          ssl = true;
-          proxyProtocol = true;
-        }
-      ];
 
       locations."/".return = "302 https://eh07.easterhegg.eu";
 
@@ -85,26 +71,18 @@ in
       forceSSL = true;
       useACMEHost = "eh07.easterhegg.eu";
 
-      listen = [
+      listen = [{
-        {
+        addr = "0.0.0.0";
-          addr = "[::]";
+        port = 8443;
-          port = 8443;
+        ssl = true;
-          ssl = true;
+        proxyProtocol = true;
-          proxyProtocol = true;
+      }];
-        }
-        {
-          addr = "0.0.0.0";
-          port = 8443;
-          ssl = true;
-          proxyProtocol = true;
-        }
-      ];
 
       locations."/" = {
         index = "index.shtml";
         root = eh07;
         extraConfig = ''
-          # Set default_type to html
+          # Set default_type to html 
           default_type text/html;
           # Enable SSI
           ssi on;

config/hosts/public-web-static/virtualHosts/historic-easterhegg/eh09.nix

@@ -29,16 +29,10 @@ in
         "easterhegg2009.hamburg.ccc.de"
         "www.easterhegg2009.hamburg.ccc.de"
       ];
-      listen = [
+      listen = [{
-        {
+        addr = "0.0.0.0";
-          addr = "[::]";
+        port = 31820;
-          port = 31820;
+      }];
-        }
-        {
-          addr = "0.0.0.0";
-          port = 31820;
-        }
-      ];
     };
 
     "easterhegg2009.hamburg.ccc.de" = {
@@ -52,20 +46,12 @@ in
         "www.easterhegg2009.hamburg.ccc.de"
       ];
 
-      listen = [
+      listen = [{
-        {
+        addr = "0.0.0.0";
-          addr = "[::]";
+        port = 8443;
-          port = 8443;
+        ssl = true;
-          ssl = true;
+        proxyProtocol = true;
-          proxyProtocol = true;
+      }];
-        }
-        {
-          addr = "0.0.0.0";
-          port = 8443;
-          ssl = true;
-          proxyProtocol = true;
-        }
-      ];
 
       locations."/".return = "302 https://eh09.easterhegg.eu";
 
@@ -85,26 +71,18 @@ in
       forceSSL = true;
       useACMEHost = "eh09.easterhegg.eu";
 
-      listen = [
+      listen = [{
-        {
+        addr = "0.0.0.0";
-          addr = "[::]";
+        port = 8443;
-          port = 8443;
+        ssl = true;
-          ssl = true;
+        proxyProtocol = true;
-          proxyProtocol = true;
+      }];
-        }
-        {
-          addr = "0.0.0.0";
-          port = 8443;
-          ssl = true;
-          proxyProtocol = true;
-        }
-      ];
 
       locations."/" = {
         index = "index.shtml";
         root = eh09;
         extraConfig = ''
-          # Set default_type to html
+          # Set default_type to html 
           default_type text/html;
           # Enable SSI
           ssi on;

config/hosts/public-web-static/virtualHosts/historic-easterhegg/eh11.nix

@@ -29,16 +29,10 @@ in
         "easterhegg2011.hamburg.ccc.de"
         "www.easterhegg2011.hamburg.ccc.de"
       ];
-      listen = [
+      listen = [{
-        {
+        addr = "0.0.0.0";
-          addr = "[::]";
+        port = 31820;
-          port = 31820;
+      }];
-        }
-        {
-          addr = "0.0.0.0";
-          port = 31820;
-        }
-      ];
     };
 
     "easterhegg2011.hamburg.ccc.de" = {
@@ -52,20 +46,12 @@ in
         "www.easterhegg2011.hamburg.ccc.de"
       ];
 
-      listen = [
+      listen = [{
-        {
+        addr = "0.0.0.0";
-          addr = "[::]";
+        port = 8443;
-          port = 8443;
+        ssl = true;
-          ssl = true;
+        proxyProtocol = true;
-          proxyProtocol = true;
+      }];
-        }
-        {
-          addr = "0.0.0.0";
-          port = 8443;
-          ssl = true;
-          proxyProtocol = true;
-        }
-      ];
 
       locations."/".return = "302 https://eh11.easterhegg.eu";
 
@@ -85,26 +71,18 @@ in
       forceSSL = true;
       useACMEHost = "eh11.easterhegg.eu";
 
-      listen = [
+      listen = [{
-        {
+        addr = "0.0.0.0";
-          addr = "[::]";
+        port = 8443;
-          port = 8443;
+        ssl = true;
-          ssl = true;
+        proxyProtocol = true;
-          proxyProtocol = true;
+      }];
-        }
-        {
-          addr = "0.0.0.0";
-          port = 8443;
-          ssl = true;
-          proxyProtocol = true;
-        }
-      ];
 
       locations."/" = {
         index = "index.shtml";
         root = eh11;
         extraConfig = ''
-          # Set default_type to html
+          # Set default_type to html 
           default_type text/html;
           # Enable SSI
           ssi on;

config/hosts/public-web-static/virtualHosts/historic-easterhegg/eh20.nix

@@ -21,16 +21,10 @@ in
         "www.eh20.easterhegg.eu"
         "eh20.hamburg.ccc.de"
       ];
-      listen = [
+      listen = [{
-        {
+        addr = "0.0.0.0";
-          addr = "[::]";
+        port = 31820;
-          port = 31820;
+      }];
-        }
-        {
-          addr = "0.0.0.0";
-          port = 31820;
-        }
-      ];
     };
 
     "www.eh20.easterhegg.eu" = {
@@ -40,20 +34,12 @@ in
         "eh20.hamburg.ccc.de"
       ];
 
-      listen = [
+      listen = [{
-        {
+        addr = "0.0.0.0";
-          addr = "[::]";
+        port = 8443;
-          port = 8443;
+        ssl = true;
-          ssl = true;
+        proxyProtocol = true;
-          proxyProtocol = true;
+      }];
-        }
-        {
-          addr = "0.0.0.0";
-          port = 8443;
-          ssl = true;
-          proxyProtocol = true;
-        }
-      ];
 
       locations."/".return = "302 https://eh20.easterhegg.eu";
 
@@ -73,20 +59,12 @@ in
       forceSSL = true;
       useACMEHost = "eh20.easterhegg.eu";
 
-      listen = [
+      listen = [{
-        {
+        addr = "0.0.0.0";
-          addr = "[::]";
+        port = 8443;
-          port = 8443;
+        ssl = true;
-          ssl = true;
+        proxyProtocol = true;
-          proxyProtocol = true;
+      }];
-        }
-        {
-          addr = "0.0.0.0";
-          port = 8443;
-          ssl = true;
-          proxyProtocol = true;
-        }
-      ];
 
       locations."/" = {
         index = "start.html";

config/hosts/public-web-static/virtualHosts/infra-docs.hamburg.ccc.de.nix

@@ -1,73 +0,0 @@
-{ pkgs, ... }:
-
-let
-  domain = "infra-docs.hamburg.ccc.de";
-  dataDir = "/var/www/${domain}";
-  deployUser = "infra-docs-deploy";
-in {
-  services.nginx.virtualHosts = {
-    "acme-${domain}" = {
-      enableACME = true;
-      serverName = "${domain}";
-
-      listen = [
-        {
-          addr = "[::]";
-          port = 31820;
-        }
-        {
-          addr = "0.0.0.0";
-          port = 31820;
-        }
-      ];
-    };
-
-    "${domain}" = {
-      forceSSL = true;
-      useACMEHost = "${domain}";
-
-      listen = [
-        {
-          addr = "[::]";
-          port = 8443;
-          ssl = true;
-          proxyProtocol = true;
-        }
-        {
-          addr = "0.0.0.0";
-          port = 8443;
-          ssl = true;
-          proxyProtocol = true;
-        }
-      ];
-
-      root = "${dataDir}";
-
-      extraConfig = ''
-        # Make use of the ngx_http_realip_module to set the $remote_addr and
-        # $remote_port to the client address and client port, when using proxy
-        # protocol.
-        # First set our proxy protocol proxy as trusted.
-        set_real_ip_from 172.31.17.140;
-        # Then tell the realip_module to get the addreses from the proxy protocol
-        # header.
-        real_ip_header proxy_protocol;
-
-        port_in_redirect off;
-      '';
-    };
-  };
-
-  systemd.tmpfiles.rules = [
-    "d ${dataDir} 0755 ${deployUser} ${deployUser}"
-  ];
-
-  users.users."${deployUser}" = {
-    isNormalUser = true;
-    group = "${deployUser}";
-    openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINfwfy9f3R/tDOiUeG5DA9oIGDDEAP270MqFG3V1P11L deploy key for infra-docs"
-    ];
-  };
-  users.groups."${deployUser}" = { };
-}

config/hosts/public-web-static/virtualHosts/spaceapi.hamburg.ccc.de.nix

@@ -7,10 +7,6 @@
       serverName = "spaceapi.hamburg.ccc.de";
 
       listen = [
-        {
-          addr = "[::]";
-          port = 31820;
-        }
         {
           addr = "0.0.0.0";
           port = 31820;
@@ -23,12 +19,6 @@
       useACMEHost = "spaceapi.hamburg.ccc.de";
 
       listen = [
-        {
-          addr = "[::]";
-          port = 8443;
-          ssl = true;
-          proxyProtocol = true;
-        }
         {
           addr = "0.0.0.0";
           port = 8443;

config/hosts/public-web-static/virtualHosts/staging.c3cat.de.nix

@@ -11,10 +11,6 @@ in {
       serverName = "${domain}";
 
       listen = [
-        {
-          addr = "[::]";
-          port = 31820;
-        }
         {
           addr = "0.0.0.0";
           port = 31820;
@@ -27,12 +23,6 @@ in {
       useACMEHost = "${domain}";
 
       listen = [
-        {
-          addr = "[::]";
-          port = 8443;
-          ssl = true;
-          proxyProtocol = true;
-        }
         {
           addr = "0.0.0.0";
           port = 8443;

config/hosts/public-web-static/virtualHosts/staging.c3dog.de.nix

@@ -1,70 +0,0 @@
-{ pkgs, ... }:
-
-let
-  domain = "staging.c3dog.de";
-  dataDir = "/var/www/${domain}";
-  deployUser = "c3dog-website-deploy";
-in {
-  services.nginx.virtualHosts = {
-    "acme-${domain}" = {
-      enableACME = true;
-      serverName = "${domain}";
-
-      listen = [
-        {
-          addr = "[::]";
-          port = 31820;
-        }
-        {
-          addr = "0.0.0.0";
-          port = 31820;
-        }
-      ];
-    };
-
-    "${domain}" = {
-      forceSSL = true;
-      useACMEHost = "${domain}";
-
-      listen = [
-        {
-          addr = "[::]";
-          port = 8443;
-          ssl = true;
-          proxyProtocol = true;
-        }
-        {
-          addr = "0.0.0.0";
-          port = 8443;
-          ssl = true;
-          proxyProtocol = true;
-        }
-      ];
-
-      root = "${dataDir}";
-
-      # Disallow *, since this is staging and doesn't need to be in any search
-      # results.
-      locations."/robots.txt" = {
-        return = "200 \"User-agent: *\\nDisallow: *\\n\"";
-      };
-
-      extraConfig = ''
-        # Make use of the ngx_http_realip_module to set the $remote_addr and
-        # $remote_port to the client address and client port, when using proxy
-        # protocol.
-        # First set our proxy protocol proxy as trusted.
-        set_real_ip_from 172.31.17.140;
-        # Then tell the realip_module to get the addreses from the proxy protocol
-        # header.
-        real_ip_header proxy_protocol;
-      '';
-    };
-  };
-
-  systemd.tmpfiles.rules = [
-    "d ${dataDir} 0755 ${deployUser} ${deployUser}"
-  ];
-
-  # c3dog deploy user already defined in c3dog.de.nix.
-}

config/hosts/public-web-static/virtualHosts/staging.cryptoparty-hamburg.de.nix

@@ -16,10 +16,6 @@ in
       serverName = "${domain}";
 
       listen = [
-        {
-          addr = "[::]";
-          port = 31820;
-        }
         {
           addr = "0.0.0.0";
           port = 31820;
@@ -32,12 +28,6 @@ in
       useACMEHost = "${domain}";
 
       listen = [
-        {
-          addr = "[::]";
-          port = 8443;
-          ssl = true;
-          proxyProtocol = true;
-        }
         {
           addr = "0.0.0.0";
           port = 8443;
@@ -65,12 +55,6 @@ in
       useACMEHost = "${domain}";
 
       listen = [
-        {
-          addr = "[::]";
-          port = 8443;
-          ssl = true;
-          proxyProtocol = true;
-        }
         {
           addr = "0.0.0.0";
           port = 8443;

config/hosts/public-web-static/virtualHosts/staging.diday.org.nix

@@ -21,12 +21,6 @@ in
       forceSSL = true;
 
       listen = [
-        {
-          addr = "[::]";
-          port = 8443;
-          ssl = true;
-          proxyProtocol = true;
-        }
         {
           addr = "0.0.0.0";
           port = 8443;
@@ -35,6 +29,10 @@ in
         }
       ];
 
+      basicAuth = {
+        "preview" = "liebe";
+      };
+
       extraConfig = ''
         # Make use of the ngx_http_realip_module to set the $remote_addr and
         # $remote_port to the client address and client port, when using proxy

config/hosts/public-web-static/virtualHosts/staging.didays.de.nix

@@ -1,72 +0,0 @@
-{ pkgs, ... }:
-
-let
-  domain = "staging.didays.de";
-  dataDir = "/var/www/${domain}";
-  deployUser = "didays-deploy";
-in {
-  services.nginx.virtualHosts = {
-    "acme-${domain}" = {
-      enableACME = true;
-      serverName = "${domain}";
-
-      listen = [
-        {
-          addr = "[::]";
-          port = 31820;
-        }
-        {
-          addr = "0.0.0.0";
-          port = 31820;
-        }
-      ];
-    };
-
-    "${domain}" = {
-      forceSSL = true;
-      useACMEHost = "${domain}";
-
-      listen = [
-        {
-          addr = "[::]";
-          port = 8443;
-          ssl = true;
-          proxyProtocol = true;
-        }
-        {
-          addr = "0.0.0.0";
-          port = 8443;
-          ssl = true;
-          proxyProtocol = true;
-        }
-      ];
-
-      root = "${dataDir}";
-
-      # Disallow *, since this is staging and doesn't need to be in any search
-      # results.
-      locations."/robots.txt" = {
-        return = "200 \"User-agent: *\\nDisallow: *\\n\"";
-      };
-
-      extraConfig = ''
-        # Make use of the ngx_http_realip_module to set the $remote_addr and
-        # $remote_port to the client address and client port, when using proxy
-        # protocol.
-        # First set our proxy protocol proxy as trusted.
-        set_real_ip_from 172.31.17.140;
-        # Then tell the realip_module to get the addreses from the proxy protocol
-        # header.
-        real_ip_header proxy_protocol;
-
-        port_in_redirect off;
-      '';
-    };
-  };
-
-  systemd.tmpfiles.rules = [
-    "d ${dataDir} 0755 ${deployUser} ${deployUser}"
-  ];
-
-  # didays deploy user already defined in didays.de.nix.
-}

config/hosts/public-web-static/virtualHosts/staging.docs.c3voc.de.nix

@@ -11,10 +11,6 @@ in {
       serverName = "${domain}";
 
       listen = [
-        {
-          addr = "[::]";
-          port = 31820;
-        }
         {
           addr = "0.0.0.0";
           port = 31820;
@@ -27,12 +23,6 @@ in {
       useACMEHost = "${domain}";
 
       listen = [
-        {
-          addr = "[::]";
-          port = 8443;
-          ssl = true;
-          proxyProtocol = true;
-        }
         {
           addr = "0.0.0.0";
           port = 8443;
@@ -58,8 +48,6 @@ in {
         # Then tell the realip_module to get the addreses from the proxy protocol
         # header.
         real_ip_header proxy_protocol;
-
-        port_in_redirect off;
       '';
     };
   };

config/hosts/public-web-static/virtualHosts/staging.hacker.tours.nix

@@ -12,10 +12,6 @@ in
       serverName = "${domain}";
 
       listen = [
-        {
-          addr = "[::]";
-          port = 31820;
-        }
         {
           addr = "0.0.0.0";
           port = 31820;
@@ -28,12 +24,6 @@ in
       useACMEHost = "${domain}";
 
       listen = [
-        {
-          addr = "[::]";
-          port = 8443;
-          ssl = true;
-          proxyProtocol = true;
-        }
         {
           addr = "0.0.0.0";
           port = 8443;

config/hosts/public-web-static/virtualHosts/staging.hackertours.hamburg.ccc.de.nix

@@ -12,10 +12,6 @@ in
       serverName = "${domain}";
 
       listen = [
-        {
-          addr = "[::]";
-          port = 31820;
-        }
         {
           addr = "0.0.0.0";
           port = 31820;
@@ -28,12 +24,6 @@ in
       useACMEHost = "${domain}";
 
       listen = [
-        {
-          addr = "[::]";
-          port = 8443;
-          ssl = true;
-          proxyProtocol = true;
-        }
         {
           addr = "0.0.0.0";
           port = 8443;

config/hosts/public-web-static/virtualHosts/staging.hamburg.ccc.de.nix

@@ -7,10 +7,6 @@
       serverName = "staging.hamburg.ccc.de";
 
       listen = [
-        {
-          addr = "[::]";
-          port = 31820;
-        }
         {
           addr = "0.0.0.0";
           port = 31820;
@@ -23,12 +19,6 @@
       useACMEHost = "staging.hamburg.ccc.de";
 
       listen = [
-        {
-          addr = "[::]";
-          port = 8443;
-          ssl = true;
-          proxyProtocol = true;
-        }
         {
           addr = "0.0.0.0";
           port = 8443;

config/hosts/public-web-static/virtualHosts/staging.infra-docs.hamburg.ccc.de.nix

@@ -1,72 +0,0 @@
-{ pkgs, ... }:
-
-let
-  domain = "staging.infra-docs.hamburg.ccc.de";
-  dataDir = "/var/www/${domain}";
-  deployUser = "infra-docs-deploy";
-in {
-  services.nginx.virtualHosts = {
-    "acme-${domain}" = {
-      enableACME = true;
-      serverName = "${domain}";
-
-      listen = [
-        {
-          addr = "[::]";
-          port = 31820;
-        }
-        {
-          addr = "0.0.0.0";
-          port = 31820;
-        }
-      ];
-    };
-
-    "${domain}" = {
-      forceSSL = true;
-      useACMEHost = "${domain}";
-
-      listen = [
-        {
-          addr = "[::]";
-          port = 8443;
-          ssl = true;
-          proxyProtocol = true;
-        }
-        {
-          addr = "0.0.0.0";
-          port = 8443;
-          ssl = true;
-          proxyProtocol = true;
-        }
-      ];
-
-      root = "${dataDir}";
-
-      # Disallow *, since this is staging and doesn't need to be in any search
-      # results.
-      locations."/robots.txt" = {
-        return = "200 \"User-agent: *\\nDisallow: *\\n\"";
-      };
-
-      extraConfig = ''
-        # Make use of the ngx_http_realip_module to set the $remote_addr and
-        # $remote_port to the client address and client port, when using proxy
-        # protocol.
-        # First set our proxy protocol proxy as trusted.
-        set_real_ip_from 172.31.17.140;
-        # Then tell the realip_module to get the addreses from the proxy protocol
-        # header.
-        real_ip_header proxy_protocol;
-
-        port_in_redirect off;
-      '';
-    };
-  };
-
-  systemd.tmpfiles.rules = [
-    "d ${dataDir} 0755 ${deployUser} ${deployUser}"
-  ];
-
-  # infra-docs deploy user already defined in infra-docs.hamburg.ccc.de.nix.
-}

config/hosts/public-web-static/virtualHosts/ueberwachungsfrei-kundgebung.nix

@@ -1,82 +0,0 @@
-{ pkgs, ... }:
-
-let
-  domain = "ueberwachungsfrei.eu";
-  dataDir = "/var/www/${domain}";
-  deployUser = "ueberwachungsfrei-deploy";
-in {
-  security.acme.certs."${domain}".extraDomainNames = [
-    "xn--berwachungsfrei-yvb.eu"
-  ];
-
-  services.nginx.virtualHosts = {
-    "acme-${domain}" = {
-      enableACME = true;
-      serverName = "${domain}";
-      serverAliases = [
-        "xn--berwachungsfrei-yvb.eu"
-      ];
-
-      listen = [
-        {
-          addr = "[::]";
-          port = 31820;
-        }
-        {
-          addr = "0.0.0.0";
-          port = 31820;
-        }
-      ];
-    };
-
-    "${domain}" = {
-      forceSSL = true;
-      useACMEHost = "${domain}";
-      serverAliases = [
-        "überwachungsfrei.eu"
-        "xn--berwachungsfrei-yvb.eu"
-      ];
-
-      listen = [
-        {
-          addr = "[::]";
-          port = 8443;
-          ssl = true;
-          proxyProtocol = true;
-        }
-        {
-          addr = "0.0.0.0";
-          port = 8443;
-          ssl = true;
-          proxyProtocol = true;
-        }
-      ];
-
-      root = "${dataDir}";
-
-      extraConfig = ''
-        # Make use of the ngx_http_realip_module to set the $remote_addr and
-        # $remote_port to the client address and client port, when using proxy
-        # protocol.
-        # First set our proxy protocol proxy as trusted.
-        set_real_ip_from 172.31.17.140;
-        # Then tell the realip_module to get the addreses from the proxy protocol
-        # header.
-        real_ip_header proxy_protocol;
-      '';
-    };
-  };
-
-  systemd.tmpfiles.rules = [
-    "d ${dataDir} 0755 ${deployUser} ${deployUser}"
-  ];
-
-  users.users."${deployUser}" = {
-    isNormalUser = true;
-    group = "${deployUser}";
-    openssh.authorizedKeys.keys = [
-      # TODO: Maybe add a deploy key if we want CI/CD
-    ];
-  };
-  users.groups."${deployUser}" = { };
-}

config/hosts/public-web-static/virtualHosts/www.hamburg.ccc.de.nix

@@ -7,10 +7,6 @@
       serverName = "www.hamburg.ccc.de";
 
       listen = [
-        {
-          addr = "[::]";
-          port = 31820;
-        }
         {
           addr = "0.0.0.0";
           port = 31820;
@@ -23,12 +19,6 @@
       useACMEHost = "www.hamburg.ccc.de";
 
       listen = [
-        {
-          addr = "[::]";
-          port = 8443;
-          ssl = true;
-          proxyProtocol = true;
-        }
         {
           addr = "0.0.0.0";
           port = 8443;

config/hosts/woodpecker/configuration.nix

@@ -0,0 +1,7 @@
+{ config, pkgs, ... }:
+
+{
+  networking.hostName = "woodpecker";
+
+  system.stateVersion = "24.05";
+}

config/hosts/woodpecker/default.nix

@@ -0,0 +1,11 @@
+{ config, pkgs, ... }:
+
+{
+  imports = [
+    ./woodpecker-agent
+    ./woodpecker-server
+    ./configuration.nix
+    ./networking.nix
+    ./sops.nix
+  ];
+}

config/hosts/woodpecker/networking.nix

@@ -0,0 +1,22 @@
+{ ... }:
+
+{
+  networking = {
+    interfaces.net0 = {
+      ipv4.addresses = [
+        {
+          address = "172.31.17.160";
+          prefixLength = 25;
+        }
+      ];
+    };
+    defaultGateway = "172.31.17.129";
+    nameservers = [ "212.12.50.158" "192.76.134.90" ];
+    search = [ "hamburg.ccc.de" ];
+  };
+
+  systemd.network.links."10-net0" = {
+    matchConfig.MACAddress = "BC:24:11:5F:A9:B7";
+    linkConfig.Name = "net0";
+  };
+}

config/hosts/woodpecker/secrets.yaml

@@ -0,0 +1,149 @@
+woodpecker_server_environment_file: ENC[AES256_GCM,data:68Wu0UOHBAGZHSJ0x4wbeDLm626jpumv9w6A65FNKsmzYp6P4/c4g1MF1agQd7l9nKMTRrgyJyfoEZYFQRX6lYSmcsQLfn++uh1JpFoClT5p/5hBkiDq4owUFU+NGUiyl6yjYlEiaxLwC4ZdyISHeEYpbrvGyIXLsFgdrQ0rVX3cCRwIMxFcyCG6d3MZVoqAw1A=,iv:y/+X02aRPBOoR57P9s7y/SijvXVLuiBBfFYqeJLvQEU=,tag:DNwK+M6s3moglkMkrWccyA==,type:str]
+woodpecker_agent_environment_file: ENC[AES256_GCM,data:rwp6TYYFJ/IZH+3pGhPxjdZMLoyPMr/W1RXm4IkUGn+SmIjHZcdFZ8nEhvOfnkfrXNPc2MR+X6NXUmVOcBjSCbcBjh9sC653UpKimt9I3/Ec,iv:X9JH7dmTayw8BaEsXYil3PrykCdd+/ANGHVfEyRvc7A=,tag:/ErkX1WnruanNgTTBUT6LA==,type:str]
+sops:
+  age:
+    - recipient: age19h7xtfmt3py3ydgl8d8fgh8uakxqxjr74flrxev3pgmvvx94kvtq5d932d
+      enc: |
+        -----BEGIN AGE ENCRYPTED FILE-----
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWdUhjQUJIS2QvWk1Yc3pR
+        M1daYlRubnlsQk9tcytBNWdYMUU4bG1DVHhZCnVKK00ySDdBZFhzRXlaQ2xVaTBh
+        bVVVNzRraUpHSFFuRStzWFprUGRoMGcKLS0tIEVBUWh4STBIaGdTelFKcnB0TkNR
+        SEd1VTZQZWlkYXVKcVRPbVA1U3VWbFUKnuaPGc29kKE86nh+xEto0Jb6BQ0uH3pr
+        Q1QPgfiOCYGkuUewy3LlGnLTuMxHBBWAjg4zgaYPHU2F/HCS5DB5nw==
+        -----END AGE ENCRYPTED FILE-----
+    - recipient: age1klxtcr23hers0lh4f5zdd53tyrtg0jud35rhydstyjq9fjymf9hsn2a8ch
+      enc: |
+        -----BEGIN AGE ENCRYPTED FILE-----
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArdVJNK1ljNWwrTy9qc1p1
+        N1MweERxdkNXZVZITWRRdGFQRHRQeTNFTTI4CjFkSVJQMFBKY2tRWE1DeXdMOUZY
+        Qm5oYTU1azFzVEpYZUptcTVhRCsxL28KLS0tIEI0czljekgvQlc1SlVGSUpGb1N3
+        NytOaE5nQ3E4bFhCQ1ZDU3MyM3p5cmcK3LGva0vDjitqOBqBo6jHqRBaH8T8cOim
+        IF8ygc0i/dbaec59ZcCMhS0n8yv0lVHO2WiUwPaKTh5hkti9LhKlaA==
+        -----END AGE ENCRYPTED FILE-----
+  lastmodified: "2024-06-22T15:55:25Z"
+  mac: ENC[AES256_GCM,data:UmDbmxSRj8YfCkKEelQNMJ8mzbu5aQdB9yOr9JfUh5TB9r5Z5ttZ1wgJDJqHNtsII3JGXUvbgHbsmbPikkrj4Ege1rrgr4UttN1rtgeaAKlZIlqb9pOnV4//GJL8jbxCgFp2h2O80G05nAXG54DaY//4Y5hfTyPzgyDlGQ6jlhg=,iv:5e8lpFfGAJh8lTFcY4MlZG7PgnzM0UycsU0tB2KN+zQ=,tag:4xUEHg04wjDbhc9MOItzuQ==,type:str]
+  pgp:
+    - created_at: "2026-02-17T22:22:03Z"
+      enc: |-
+        -----BEGIN PGP MESSAGE-----
+
+        hQIMAz5uSgHG2iMJAQ/+NzRul1VZa2BLnjCsdUP7YErHvLsJqc/KwEFgGX8yN1Bg
+        VOHgm0MBYC14KtMu0Zb+Cm6ypqyaa4j+MXNVWLDTOLt1aLibashBmyPbwHNr0XwO
+        6tr9qYAPixaoWFeiCtATKLUzWzQ68eDv9JHNNQvKGNjet9E1yOIxWHj6RxyV/EeZ
+        50nf+7AO7cFkqRGFxrGKAYchzetajNPLtbS2htFCc3Vt9m38jusafvYdjeG+HQHe
+        6INzdNqvM7vhfWJlIiTPCXGKvx0NhLg6sVvcXpq5mKbMAhja80KyUdl772L8Kr6P
+        ZYvmj+Ey8+GM+opGGxcaSBmgw3ZLRIZ1tks3LlRf/UiAZD5MqJoRL1DEJMtHzYnp
+        IqxOEiuMLAL1/TxG4KhJfT5Gs9Kf3Cnr6djhhsYg3GYXSQdhiyaBDaLpu68nEIRN
+        JSdA/7pCjxhvlgFl9XvPaMzQD5GZNlVapJPn1c9Ambi9cs4kB8nds+Xx4KgIN3li
+        85flJnEtQWRI2DL8qJgoYJ1cXevkPVzKLFnQEHfLuozIzfPl1Wq1Sb3EQk9YZer9
+        yfVHRngBBhmfNMtFy9gq8FLod0Odas3KQDAa7ndPMMx6oL5DoNeI3DpuYW4eQIZK
+        EbT5iHLMrTXHb2XKTHfXdjl6ttED+12GAby69jdGXjt6UVAM6b0UorWfSLLoqabS
+        XgG1w128eegSl4tqdYO/KDL30c9J1K8LqaJmg+9eFAi9Da/zmPAck+DlS7XUkeiX
+        OqZiOXLul0N2Qe/tWkpJD8F3HV+K6Xt0MSx8VsmeliicG4Rpme1Xysau+7kht3U=
+        =KUjN
+        -----END PGP MESSAGE-----
+      fp: 18DFCE01456DAB52EA38A6584EDC64F35FA1D6A5
+    - created_at: "2026-02-17T22:22:03Z"
+      enc: |-
+        -----BEGIN PGP MESSAGE-----
+
+        hQIMAw5vwmoEJHQ1ARAAxH+TtzvFlUZfD3U7BNRr9SyWVxnkR3U2zvvDG5A3I28K
+        fI1U1am6Z+gSvYdId38hiMPxDmDIMl2wCYCXd17q+PSycsJ1Bbzy1zaht6KcpSJb
+        s9jmNmf+5mazSRZ/COBy4mMq+2mam4/vu+xS85IsgxyxK9ygnCurmzMqn3lxatm0
+        ICxvoLMAamA+tAfxtw+a5lEMok7pHdKndZmrKvxO7nLXM0292sJ3VHp5Uy9k487W
+        PznpjM1st/f/0gTu1mgb8rnUkSszw1odBeQ+xw2JvcDHE6Ow7PpCk83oTWXil6c4
+        bEsrtvaFLWXN9/gssnayoMWHb/TCHKVe4AGrMevFkRdEFDRV5FRZGqzuGDP++X10
+        KYyMN0/Wo/XU7Rn3+7HmKvz0qeaAI/IRTrhdXUDtQQ13/waxGrJEquwS5Xuwea6l
+        LlA6hwnAERSVrVkMQ60ITOD6n7lvAPA7jD/HhI3P2Xy4mDFW9ZnfnWi0xI9pRCsk
+        w+ZnQ1Ckacv0gJUirvsVSdUYHwvEvpFEVSsZsv5QbNsaWi5jn5XDH0eqlXQE80aO
+        o3vPFTNCHNixspiaIO4V8etyv6nSh7BxwDvIH4nZVxr8HmxILs0Occw9anvA81md
+        roF3pyb+ZFRIwcBh72VSdAm1D/n4h14lnmMj+19HEA3zvbPnZQejtGFMY1Oe2VTS
+        XgHMI0aRJANXczMA7LSg9vxDYvWXE2KR526oBsC1E7otCNGkxj3hhmng25K3tmIU
+        E2AAaAIk/RukMnydb93XGciPquCZsWlmpwlTGXCqoqiNBilvIE1lXH6rhym78ko=
+        =nRW4
+        -----END PGP MESSAGE-----
+      fp: 87AB00D45D37C9E9167B5A5A333448678B60E505
+    - created_at: "2026-02-17T22:22:03Z"
+      enc: |-
+        -----BEGIN PGP MESSAGE-----
+
+        hF4DerEtaFuTeewSAQdAPWizx2khKtlshnLwE5PRszAdTvTlsEEiWVV5xJx3PnAw
+        9Gj2lZZX4F0AXoKInElg2N02FXpIo24ZZUPXGqpswfSv93NFNNK+FWwqUCRZhuCM
+        0l4Blkyy4PthGwIAtXqZ8GGxjoDGBLIAE/zrY9tdNB5XAnkiy7J82kora0dphpkq
+        Llb1Jgh0+ZK8RQzaf5wcgWf867MhJLhv0N+qLsFVutGpqFy1W/1vaLQ5au5Ty2Tw
+        =460I
+        -----END PGP MESSAGE-----
+      fp: 057870A2C72CD82566A3EC983695F4FCBCAE4912
+    - created_at: "2026-02-17T22:22:03Z"
+      enc: |-
+        -----BEGIN PGP MESSAGE-----
+
+        hQIMAxjNhCKPP69fAQ//Rzcsq0Yay/3g/MzqHI1izkSWsdycz3LE6qM4qhX4f7wZ
+        4Ymzu2jbSq43IavCjGPOLIKVJ4nlnPd7rcprYNV5DOcGAkXG5x7PbnVta3SPI300
+        CXnSGQB1KHUCCYZN1BkL9ZSQyTx0ex19mnsSEtZh8NB97cCZx9zMowdHKd5ySu/O
+        +CMFkQ6Uoh2FxBtqM1y1YbDiuDJnAlAQSKlDIVdCdMssutWRs9Nf6eiLtcmb4U5l
+        sNyKQnPrr3vjkaTbVdBKQjjMSa8Z/1Tf95GxNhzrUGm2APLKVYdHkMVlQwcr/ZfH
+        jGiZqxgBmrtNe3EypdKCDnlPvlxs8mnO5whxzDZW2NFV3piMmOmvLI/Po1ASi/t1
+        PW9h05Foh2764Jfp74BkRTvhBfi465wKkON0VOckwWBkl/n7w7POfHCXdK1/AnGj
+        9ywj6P4zg50vKiTMkZStq6YKXAEkVcN6YzhVVDFwDwAE1VKFCMKlmwuYT1FuKXBp
+        7maF578qVyb0lXP9jaX10Y9dhC4vU2rJB3vtRhxjqeMEe/WOyhEyalrC9phPfBKS
+        wVKzdd3vvaNGfQSAwseFAn1upvELFwccPw1aRIqqLhzWTY2m48yyW2aEN6+7SqkR
+        dOBJpZDE4NxOhbQl0rllZdeLUznIgeOKM2iNg/3kM7cWcsLZRm3+l1ZuiCEy5XPS
+        XgHbwfJlyZYoQyKCntbdA/5VRS/5s0oPJIjuofoBZb35fIqtYPIpUeNccpklXYsO
+        atiSRwJeiluCFUag0uV3nq0zltOlqdS6piEVqU6xiGLAZe04jkaMBxL6VQQHYU0=
+        =811X
+        -----END PGP MESSAGE-----
+      fp: F38C9D4228FC6F674E322D9C3326D914EB9B8F55
+    - created_at: "2026-02-17T22:22:03Z"
+      enc: |-
+        -----BEGIN PGP MESSAGE-----
+
+        hQIMA1Hthzn+T1OoAQ/9EvULxQSjfO/V600iqRhsQsuuHWY5IfVN+XBCmzmeUX2a
+        8qFN8L5gk3pYEoIu4khSCSeIpVyOdX1XeWMMNB15C/pAvgi7emH0y8UxAvCLfW5L
+        CzP3qLQsbpKUGntPlHaye/G16M/+m4QPc6Y7qwEtUThOei9haPhIU06Tb61IpfLk
+        AKticUro4ap3Xt/fjDH0NHZsGG33V6LprTt+8LaEcpcwZK/yOWdG4wTV4j6X8LbA
+        ueCmKunAr1skJrd+hVuwP2e8UkasYgo33pcupsS5jcyXJT9Kf3p/nqOJ3QGlwOtP
+        lf0DUifdd/QrEXWcMBu+zc9HgtUzpyU3KAoVrxo4JQLaoRlq3kwk3mOOFA0Fzd16
+        neuJL2wp/RPuL47StHwA9HxQP+3znXkNxmt9yXGzeyeOBpK4O9qoQ9y7Rbd/FR2u
+        wEl5uAjhhH2xmAUnIKp5Y1UAFSLqZEaiJjjCHMHycaTpCucjEcChpaBGDAXYS1h+
+        x/r6R46UgIzMvjpd2vy+C1aQg0p1Z6P65ifOkdAYIghpSkp+F6SUHHkL3w/kRRjE
+        dBF8YWFm/yl9P9qenakC5NsAA+bR4ZpNWpv32sYuVjIuoV20GdS7UIVQnvos8bBK
+        NfqoFmz4n8Eo1jLRcCJ376ow7bSEhRIJlJxdq7bFjZ/3Wtk9vt9dG6XV7wLdJwXS
+        XgGRxjv94TYLFowYA8/uu9fWxvf2i2lLqctjrvbZkW0Rdn2Ym5GXjg6St3Diug6r
+        y87PJPSN7CYE4jzCDPaSnGcBvwDHrQsLHLAmenfrAi2Jnweg/THpm9UAftoC7AY=
+        =Fxot
+        -----END PGP MESSAGE-----
+      fp: 5DA93D5C9D7320E1BD3522C79C78172B3551C9FD
+    - created_at: "2026-02-17T22:22:03Z"
+      enc: |-
+        -----BEGIN PGP MESSAGE-----
+
+        hQIMA46L6MuPqfJqARAAnZq75P7GPcuBCBLUOVPK8w1IBxd4XzoEWW3+T80bFTZE
+        ZjPAvfiGcOqIfc8CPzpS1drviWiRkuEV4EKCuDmX9GReI0SUlvaoiddUA9V62f4b
+        akBrzqR0nNnWWvjph4/5PRAQO+xO4wQy2r9thCw4oej3QgvKtLRRRY35TkGqlS0t
+        ej4d80KaqGGsfIPQ5L9f+lqarrKvYx3DMK6CujN13Kot44Uom4L5TeIdPSAW14jS
+        13fa/I1Irq56ME9kNctsuAkRkhrW+KchFJqkYXSS82SbXUDDNcVA7knXSzxVR+iU
+        NJXb8bQO4Ymi8sWPWKHW/GXUkReiTLl8MkLi+mCwL7qo5fMQcBg/KWo0hReQYCj3
+        G9DZPs3xWYFcwcmrSV86LSqjMt5g8ZKjPm6ODQcZVA/ZsGlmdTkjsWNn6WRZI55m
+        8kkg7BoRMq7p6b15tW4e/w2rr/bTmGQ9dV03KIpmBG6+OUzwgfB2/w2dGmB7Vor6
+        JMzvt+1I/PSHsCC/7GurTurAP63x8NO/9HYX2Qg0qzsOusnTKrCoo4lX/tA5YfIt
+        OKr6zqy8s5Dv/lGUhofkJrhHr/QTRHFVrFtPNn4yfSzo+8uhomHGsmxBGOOiY83L
+        3zwYm+9BlzO/ve7PIvs54hIHQaKsP9Ktsgq/+dM7PVlIb5qfwGNvgoS2QXFqCF/S
+        XgHWy41J0zTGoyEpooGkheVKvgEPvv6YIlm9oTucYP03AkKWxBr9MTNq/+JcLRvw
+        Zey10uVJnYPUuH2b9f8N8lNBZlkQCBq/AEu0MsygsK8bcVfQL1Qs58xh1uA7gL8=
+        =wduB
+        -----END PGP MESSAGE-----
+      fp: 8996B62CBD159DCADD3B6DC08BB33A8ABCF7BC4A
+    - created_at: "2026-02-17T22:22:03Z"
+      enc: |-
+        -----BEGIN PGP MESSAGE-----
+
+        hF4DQrf1tCqiJxoSAQdA4Y8j9A4ECAds0oJlP50Td1HpYIhywjXKi+pT7CTPXQ8w
+        95+hUucTE8WQO/9u4HV2Y2nuyQPwmaYK0iGbNV3YxgI3Zdtf1T680hQxT4y55E1/
+        0l4B+70h9ojiHZkpVKVmFFZdY+tS/jQIFIRxqTW1AAfDf+chO3sUxbRe2qZhOXoY
+        b/QKU11wFpmOZmzznurOoxkqdNgGNcFm9+Ntb4ZSLSYzx7wrjzmWsaTdFd+coO1j
+        =V+rP
+        -----END PGP MESSAGE-----
+      fp: B71138A6A8964A3C3B8899857B4F70C356765BAB
+  unencrypted_suffix: _unencrypted
+  version: 3.8.1

config/hosts/woodpecker/sops.nix

@@ -0,0 +1,7 @@
+{ ... }:
+
+{
+  sops = {
+    defaultSopsFile = ./secrets.yaml;
+  };
+}

config/hosts/woodpecker/woodpecker-agent/default.nix

@@ -0,0 +1,8 @@
+{ config, pkgs, ... }:
+
+{
+  imports = [
+    ./docker.nix
+    ./woodpecker-agent.nix
+  ];
+}

config/hosts/woodpecker/woodpecker-agent/docker.nix

@@ -0,0 +1,12 @@
+# Sources for this configuration:
+# - https://woodpecker-ci.org/docs/administration/deployment/nixos
+# - https://woodpecker-ci.org/docs/administration/backends/docker
+# - https://nixos.wiki/wiki/Docker
+
+{ config, pkgs, ... }:
+
+{
+  virtualisation.docker = {
+    enable = true;
+  };
+}

config/hosts/woodpecker/woodpecker-agent/woodpecker-agent.nix

@@ -0,0 +1,29 @@
+# Sources for this configuration:
+# - https://woodpecker-ci.org/docs/administration/deployment/nixos
+# - https://woodpecker-ci.org/docs/administration/agent-config
+# - https://woodpecker-ci.org/docs/administration/backends/docker
+
+{ config, pkgs, ... }:
+
+{
+  services.woodpecker-agents.agents."docker" = {
+    enable = true;
+    package = pkgs.woodpecker-agent;
+    extraGroups = [ "docker" ];
+    environment = {
+      WOODPECKER_SERVER = "localhost${config.services.woodpecker-server.environment.WOODPECKER_GRPC_ADDR}";
+      WOODPECKER_MAX_WORKFLOWS = "4";
+      WOODPECKER_BACKEND = "docker";
+      # Set via enviornmentFile:
+      # WOODPECKER_AGENT_SECRET
+    };
+    environmentFile = [ "/run/secrets/woodpecker_agent_environment_file" ];
+  };
+
+  sops.secrets."woodpecker_agent_environment_file" = {
+    mode = "0440";
+    owner = "root";
+    group = "root";
+    restartUnits = [ "woodpecker-agent-docker.service" ];
+  };
+}

config/hosts/woodpecker/woodpecker-server/default.nix

@@ -0,0 +1,9 @@
+{ config, pkgs, ... }:
+
+{
+  imports = [
+    ./nginx.nix
+    ./postgresql.nix
+    ./woodpecker-server.nix
+  ];
+}

config/hosts/woodpecker/woodpecker-server/nginx.nix

@@ -0,0 +1,57 @@
+# Sources for this configuration:
+# - https://woodpecker-ci.org/docs/administration/deployment/nixos
+# - https://woodpecker-ci.org/docs/administration/proxy
+
+{ config, pkgs, ... }:
+
+{
+  services.nginx = {
+    enable = true;
+
+    virtualHosts."acme-woodpecker.hamburg.ccc.de" = {
+      default = true;
+      enableACME = true;
+      serverName = "woodpecker.hamburg.ccc.de";
+
+      listen = [
+        {
+          addr = "0.0.0.0";
+          port = 31820;
+        }
+      ];
+    };
+
+    virtualHosts."woodpecker.hamburg.ccc.de" = {
+      default = true;
+      forceSSL = true;
+      useACMEHost = "woodpecker.hamburg.ccc.de";
+
+      listen = [
+        {
+          addr = "0.0.0.0";
+          port = 8443;
+          ssl = true;
+          proxyProtocol = true;
+        }
+      ];
+
+      locations."/" = {
+        proxyPass = "http://localhost${config.services.woodpecker-server.environment.WOODPECKER_SERVER_ADDR}";
+      };
+
+      extraConfig = ''
+        # Make use of the ngx_http_realip_module to set the $remote_addr and
+        # $remote_port to the client address and client port, when using proxy
+        # protocol.
+        # First set our proxy protocol proxy as trusted.
+        set_real_ip_from 172.31.17.140;
+        # Then tell the realip_module to get the addreses from the proxy protocol
+        # header.
+        real_ip_header proxy_protocol;
+      '';
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = [ 8443 31820 ];
+  networking.firewall.allowedUDPPorts = [ 8443 ];
+}

config/hosts/woodpecker/woodpecker-server/postgresql.nix

@@ -0,0 +1,18 @@
+# Sources for this configuration:
+# - https://github.com/NixOS/nixpkgs/blob/dce84c46d780b20c064d5dfb10d0686e0584a198/nixos/modules/services/web-apps/nextcloud.nix#L1069
+
+{ config, pkgs, ... }:
+
+{
+  services.postgresql = {
+    enable = true;
+    package = pkgs.postgresql_15;
+    ensureDatabases = [ "woodpecker-server" ];
+    ensureUsers = [
+      {
+        name = "woodpecker-server";
+        ensureDBOwnership = true;
+      }
+    ];
+  };
+}

config/hosts/woodpecker/woodpecker-server/woodpecker-server.nix

@@ -0,0 +1,44 @@
+# Sources for this configuration:
+# - https://woodpecker-ci.org/docs/administration/deployment/nixos
+# - https://woodpecker-ci.org/docs/administration/server-config
+# - https://woodpecker-ci.org/docs/administration/database
+# - https://woodpecker-ci.org/docs/administration/forges/forgejo
+# - https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-CONNSTRING
+
+{ config, pkgs, ... }:
+
+{
+  services.woodpecker-server = {
+    enable = true;
+    package = pkgs.woodpecker-server;
+    environment = {
+      WOODPECKER_HOST = "https://woodpecker.hamburg.ccc.de";
+      WOODPECKER_SERVER_ADDR = ":8001";
+      WOODPECKER_GRPC_ADDR = ":9000";
+      WOODPECKER_ADMIN = "june";
+      WOODPECKER_OPEN = "true";
+      WOODPECKER_ORGS = "CCCHH";
+      WOODPECKER_DATABASE_DRIVER = "postgres";
+      WOODPECKER_DATABASE_DATASOURCE = "postgresql://woodpecker-server@/woodpecker-server?host=/run/postgresql";
+      WOODPECKER_FORGEJO = "true";
+      WOODPECKER_FORGEJO_URL = "https://git.hamburg.ccc.de";
+      WOODPECKER_LIMIT_MEM = "6442450944"; # 6GB
+      # Set via enviornmentFile:
+      # WOODPECKER_FORGEJO_CLIENT
+      # WOODPECKER_FORGEJO_SECRET
+    };
+    environmentFile = [ "/run/secrets/woodpecker_server_environment_file" ];
+  };
+
+  systemd.services.woodpecker-server.serviceConfig = {
+    User = "woodpecker-server";
+    Group = "woodpecker-server";
+  };
+
+  sops.secrets."woodpecker_server_environment_file" = {
+    mode = "0440";
+    owner = "root";
+    group = "root";
+    restartUnits = [ "woodpecker-server.service" ];
+  };
+}

deployment_configuration.json

@@ -6,9 +6,15 @@
     "matrix": {
       "targetHostname": "matrix-intern.hamburg.ccc.de"
     },
+    "public-web-static": {
+      "targetHostname": "public-web-static-intern.hamburg.ccc.de"
+    },
     "git": {
       "targetHostname": "git.hamburg.ccc.de"
     },
+    "forgejo-actions-runner": {
+      "targetHostname": "forgejo-actions-runner-intern.hamburg.ccc.de"
+    },
     "woodpecker": {
       "targetHostname": "woodpecker-intern.hamburg.ccc.de"
     },

flake.lock

@@ -19,11 +19,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1782847189,
+        "lastModified": 1775002709,
-        "narHash": "sha256-twXPFqFsrrY5r28Zh7Homgcp2gUMBgQ6WDS98Q/3xFI=",
+        "narHash": "sha256-d3Yx83vSrN+2z/loBh4mJpyRqr9aAJqlke4TkpFmRJA=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "b6018f87da91d19d0ab4cf979885689b469cdd41",
+        "rev": "bcd464ccd2a1a7cd09aa2f8d4ffba83b761b1d0e",
         "type": "github"
       },
       "original": {
@@ -33,29 +33,13 @@
         "type": "github"
       }
     },
-    "nixpkgs-2605": {
-      "locked": {
-        "lastModified": 1786535285,
-        "narHash": "sha256-rG5HKMAgAhMgydvKGtco6rqTxRq4EDZQCx9USLvVqYw=",
-        "owner": "nixos",
-        "repo": "nixpkgs",
-        "rev": "9f78f44a87948854445dae0b6bf82b2e87e4efb5",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nixos",
-        "ref": "nixos-26.05",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1786593342,
+        "lastModified": 1775126147,
-        "narHash": "sha256-smTKQXMLLStzc8zJevMCckbk3My7SvbbLmPYZUJJKW4=",
+        "narHash": "sha256-J0dZU4atgcfo4QvM9D92uQ0Oe1eLTxBVXjJzdEMQpD0=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "6b5e5b7a6631f065bf6908986990b37d845f847f",
+        "rev": "8d8c1fa5b412c223ffa47410867813290cdedfef",
         "type": "github"
       },
       "original": {
@@ -69,7 +53,6 @@
       "inputs": {
         "authorizedKeysRepo": "authorizedKeysRepo",
         "nixpkgs": "nixpkgs",
-        "nixpkgs-2605": "nixpkgs-2605",
         "nixpkgs-unstable": "nixpkgs-unstable",
         "sops-nix": "sops-nix"
       }
@@ -81,11 +64,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1786629091,
+        "lastModified": 1775188331,
-        "narHash": "sha256-gkig4nPi1CWc4Z50GBsjE4ygSE7hMpl/TwID2an2Cck=",
+        "narHash": "sha256-/0BoSi0Dg0ON7IW0oscM12WSPBaMSCn36XTt0lHZoy8=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "a8627b21b9107c5711c96b84f32a9a4b3d45295f",
+        "rev": "8f093d0d2f08f37317778bd94db5951d6cce6c46",
         "type": "github"
       },
       "original": {

flake.nix

@@ -7,7 +7,6 @@
     # https://github.com/NixOS/nixpkgs
     nixpkgs.url = "github:nixos/nixpkgs/nixos-25.11";
     nixpkgs-unstable.url = "github:nixos/nixpkgs/nixpkgs-unstable";
-    nixpkgs-2605.url = "github:nixos/nixpkgs?ref=nixos-26.05";
 
     # # Add nixos-generators as an input.
     # # See here: https://github.com/nix-community/nixos-generators#using-in-a-flake
@@ -29,7 +28,7 @@
     };
   };
 
-  outputs = { self, nixpkgs, nixpkgs-unstable, nixpkgs-2605, sops-nix, authorizedKeysRepo, ... }:
+  outputs = { self, nixpkgs, nixpkgs-unstable, sops-nix, authorizedKeysRepo, ... }:
     let
       specialArgs = {
         inherit authorizedKeysRepo;
@@ -117,7 +116,7 @@
           ];
         };
 
-        git = nixpkgs-2605.lib.nixosSystem {
+        git = nixpkgs.lib.nixosSystem {
           inherit system specialArgs;
           modules = [
             self.nixosModules.common
@@ -128,6 +127,20 @@
           ];
         };
 
+        forgejo-actions-runner = nixpkgs.lib.nixosSystem {
+          inherit system;
+          modules = [
+            self.nixosModules.common
+            self.nixosModules.proxmox-vm
+            sops-nix.nixosModules.sops
+            self.nixosModules.prometheus-exporter
+            ./config/hosts/forgejo-actions-runner
+          ];
+          specialArgs = {
+            inherit authorizedKeysRepo;
+          };
+        };
+
         ptouch-print-server = nixpkgs.lib.nixosSystem {
           inherit system specialArgs;
           modules = [
@@ -146,6 +159,17 @@
           ];
         };
 
+        woodpecker = nixpkgs.lib.nixosSystem {
+          inherit system specialArgs;
+          modules = [
+            self.nixosModules.common
+            self.nixosModules.proxmox-vm
+            sops-nix.nixosModules.sops
+            self.nixosModules.prometheus-exporter
+            ./config/hosts/woodpecker
+          ];
+        };
+
         penpot = nixpkgs.lib.nixosSystem {
           inherit system specialArgs;
           modules = [