add required nixConfig option

2024-11-12 22:36:51 +01:00
26 changed files with 221 additions and 357 deletions
--- a/21
+++ b/21
@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) CCCHH
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
--- a/README.md
+++ b/README.md
@ -73,7 +73,3 @@ Build a new NixOS Proxmox VE Template for the chaosknoten:
 ```shell
 nix build .#proxmox-chaosknoten-nixos-template
 ```
-
-## License
-
-This CCCHH nix-infra repository is licensed under the [MIT License](./LICENSE).
--- a/config/common/users.nix
+++ b/config/common/users.nix
@ -6,9 +6,14 @@
 # - https://git.grzb.de/yuri/nix-infra/-/blob/342a2f732da042d04e579d98e9f834418b7ebf25/users/colmena-deploy/default.nix
 # - https://nixos.org/manual/nix/stable/command-ref/conf-file.html?highlight=nix.conf#available-settings

-{ config, pkgs, lib, authorizedKeysRepo, ... }:
+{ config, pkgs, lib, ... }:

 let
+  authorizedKeysRepo = pkgs.fetchgit {
+    url = "https://git.hamburg.ccc.de/CCCHH/infrastructure-authorized-keys";
+    rev = "686a6af22f6696f0c0595c56f463c078550049fc";
+    hash = "sha256-plTYjM6zPzoBE/dp6EUrk9mCqmab278p8FqBCTX8Grc=";
+  };
  authorizedKeys = builtins.filter (item: item != "") (lib.strings.splitString "\n" (builtins.readFile "${authorizedKeysRepo}/authorized_keys"));
 in
 {
--- a/config/hosts/eh22-wiki/dokuwiki.nix
+++ b/config/hosts/eh22-wiki/dokuwiki.nix
@ -21,8 +21,7 @@ let
  app = "dokuwiki";
  domain = "eh22.easterhegg.eu";
  dataDir = "/srv/www/${domain}";
-in
-{
+in {
  systemd.tmpfiles.rules = [
    "d ${dataDir} 0755 ${app} ${app}"
  ];
--- a/config/hosts/mqtt/mosquitto.nix
+++ b/config/hosts/mqtt/mosquitto.nix
@ -10,11 +10,11 @@
        persistence = true;

        # set config for all listeners
-    listeners = [{
+        listeners = [ {
            settings.allow_anonymous = true;
            omitPasswordAuth = true;
-      acl = [ "topic readwrite #" ];
-    }];
+            acl = ["topic readwrite #"];
+        } ];

        bridges.winkekatz = {
            addresses = [
--- a/config/hosts/public-web-static/virtualHosts/c3cat.de.nix
+++ b/config/hosts/public-web-static/virtualHosts/c3cat.de.nix
@ -1,19 +1,10 @@
 { pkgs, ... }:

-let
-  domain = "c3cat.de";
-  dataDir = "/var/www/${domain}";
-  deployUser = "c3cat-website-deploy";
-in {
-  security.acme.certs."${domain}".extraDomainNames = [ "www.${domain}" ];
-
+{
  services.nginx.virtualHosts = {
-    "acme-${domain}" = {
+    "acme-c3cat.de" = {
      enableACME = true;
-      serverName = "${domain}";
-      serverAliases = [
-        "www.${domain}"
-      ];
+      serverName = "c3cat.de";

      listen = [
        {
@ -23,9 +14,9 @@ in {
      ];
    };

-    "$www.${domain}" = {
+    "c3cat.de" = {
      forceSSL = true;
-      useACMEHost = "${domain}";
+      useACMEHost = "c3cat.de";

      listen = [
        {
@ -37,7 +28,7 @@ in {
      ];

      locations."/" = {
-        return = "302 https://c3cat.de$request_uri";
+        return = "302 https://wiki.hamburg.ccc.de/club:c3cat:start";
      };

      extraConfig = ''
@ -51,45 +42,5 @@ in {
        real_ip_header proxy_protocol;
      '';
    };
-
-    "${domain}" = {
-      forceSSL = true;
-      useACMEHost = "${domain}";
-
-      listen = [
-        {
-          addr = "0.0.0.0";
-          port = 8443;
-          ssl = true;
-          proxyProtocol = true;
-        }
-      ];
-
-      root = "${dataDir}";
-
-      extraConfig = ''
-        # Make use of the ngx_http_realip_module to set the $remote_addr and
-        # $remote_port to the client address and client port, when using proxy
-        # protocol.
-        # First set our proxy protocol proxy as trusted.
-        set_real_ip_from 172.31.17.140;
-        # Then tell the realip_module to get the addreses from the proxy protocol
-        # header.
-        real_ip_header proxy_protocol;
-      '';
  };
-  };
-
-  systemd.tmpfiles.rules = [
-    "d ${dataDir} 0755 ${deployUser} ${deployUser}"
-  ];
-
-  users.users."${deployUser}" = {
-    isNormalUser = true;
-    group = "${deployUser}";
-    openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcZJzQO4RYinJm6YDUgCELe8OJA/DYOss+8xp7TtxM0 deploy key for c3cat.de"
-    ];
-  };
-  users.groups."${deployUser}" = { };
 }
--- a/config/hosts/public-web-static/virtualHosts/default.nix
+++ b/config/hosts/public-web-static/virtualHosts/default.nix
@ -9,7 +9,6 @@
    ./hackertours.hamburg.ccc.de.nix
    ./hamburg.ccc.de.nix
    ./spaceapi.hamburg.ccc.de.nix
-    ./staging.c3cat.de.nix
    ./staging.hacker.tours.nix
    ./staging.hackertours.hamburg.ccc.de.nix
    ./staging.hamburg.ccc.de.nix
--- a/config/hosts/public-web-static/virtualHosts/hacker.tours.nix
+++ b/config/hosts/public-web-static/virtualHosts/hacker.tours.nix
@ -4,8 +4,7 @@ let
  domain = "hacker.tours";
  dataDir = "/var/www/${domain}";
  deployUser = "hackertours-website-deploy";
-in
-{
+in {
  services.nginx.virtualHosts = {
    "acme-${domain}" = {
      enableACME = true;
--- a/config/hosts/public-web-static/virtualHosts/hackertours.hamburg.ccc.de.nix
+++ b/config/hosts/public-web-static/virtualHosts/hackertours.hamburg.ccc.de.nix
@ -4,8 +4,7 @@ let
  domain = "hackertours.hamburg.ccc.de";
  dataDir = "/var/www/${domain}";
  deployUser = "ht-ccchh-website-deploy";
-in
-{
+in {
  services.nginx.virtualHosts = {
    "acme-${domain}" = {
      enableACME = true;
--- a/config/hosts/public-web-static/virtualHosts/historic-easterhegg/default.nix
+++ b/config/hosts/public-web-static/virtualHosts/historic-easterhegg/default.nix
@ -1,4 +1,4 @@
-{ ... }:
+{...}:

 {
  imports = [
--- a/config/hosts/public-web-static/virtualHosts/staging.c3cat.de.nix
+++ b/config/hosts/public-web-static/virtualHosts/staging.c3cat.de.nix
@ -1,60 +0,0 @@
-{ pkgs, ... }:
-
-let
-  domain = "staging.c3cat.de";
-  dataDir = "/var/www/${domain}";
-  deployUser = "c3cat-website-deploy";
-in {
-  services.nginx.virtualHosts = {
-    "acme-${domain}" = {
-      enableACME = true;
-      serverName = "${domain}";
-
-      listen = [
-        {
-          addr = "0.0.0.0";
-          port = 31820;
-        }
-      ];
-    };
-
-    "${domain}" = {
-      forceSSL = true;
-      useACMEHost = "${domain}";
-
-      listen = [
-        {
-          addr = "0.0.0.0";
-          port = 8443;
-          ssl = true;
-          proxyProtocol = true;
-        }
-      ];
-
-      root = "${dataDir}";
-
-      # Disallow *, since this is staging and doesn't need to be in any search
-      # results.
-      locations."/robots.txt" = {
-        return = "200 \"User-agent: *\\nDisallow: *\\n\"";
-      };
-
-      extraConfig = ''
-        # Make use of the ngx_http_realip_module to set the $remote_addr and
-        # $remote_port to the client address and client port, when using proxy
-        # protocol.
-        # First set our proxy protocol proxy as trusted.
-        set_real_ip_from 172.31.17.140;
-        # Then tell the realip_module to get the addreses from the proxy protocol
-        # header.
-        real_ip_header proxy_protocol;
-      '';
-    };
-  };
-
-  systemd.tmpfiles.rules = [
-    "d ${dataDir} 0755 ${deployUser} ${deployUser}"
-  ];
-
-  # c3cat deploy user already defined in c3cat.de.nix.
-}
--- a/config/hosts/public-web-static/virtualHosts/staging.hacker.tours.nix
+++ b/config/hosts/public-web-static/virtualHosts/staging.hacker.tours.nix
@ -4,8 +4,7 @@ let
  domain = "staging.hacker.tours";
  dataDir = "/var/www/${domain}";
  deployUser = "hackertours-website-deploy";
-in
-{
+in {
  services.nginx.virtualHosts = {
    "acme-${domain}" = {
      enableACME = true;
--- a/config/hosts/public-web-static/virtualHosts/staging.hackertours.hamburg.ccc.de.nix
+++ b/config/hosts/public-web-static/virtualHosts/staging.hackertours.hamburg.ccc.de.nix
@ -4,8 +4,7 @@ let
  domain = "staging.hackertours.hamburg.ccc.de";
  dataDir = "/var/www/${domain}";
  deployUser = "ht-ccchh-website-deploy";
-in
-{
+in {
  services.nginx.virtualHosts = {
    "acme-${domain}" = {
      enableACME = true;
--- a/config/hosts/woodpecker/woodpecker-agent/woodpecker-agent.nix
+++ b/config/hosts/woodpecker/woodpecker-agent/woodpecker-agent.nix
@ -3,12 +3,13 @@
 # - https://woodpecker-ci.org/docs/administration/agent-config
 # - https://woodpecker-ci.org/docs/administration/backends/docker

-{ config, pkgs, ... }:
+{ config, pkgs, pkgs-unstable, ... }:

 {
  services.woodpecker-agents.agents."docker" = {
    enable = true;
-    package = pkgs.woodpecker-agent;
+    # Since we use woodpecker-server from unstable, use the agent from unstable as well.
+    package = pkgs-unstable.woodpecker-agent;
    extraGroups = [ "docker" ];
    environment = {
      WOODPECKER_SERVER = "localhost${config.services.woodpecker-server.environment.WOODPECKER_GRPC_ADDR}";
--- a/config/hosts/woodpecker/woodpecker-server/woodpecker-server.nix
+++ b/config/hosts/woodpecker/woodpecker-server/woodpecker-server.nix
@ -5,12 +5,14 @@
 # - https://woodpecker-ci.org/docs/administration/forges/forgejo
 # - https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-CONNSTRING

-{ config, pkgs, ... }:
+{ config, pkgs, pkgs-unstable, ... }:

 {
  services.woodpecker-server = {
    enable = true;
-    package = pkgs.woodpecker-server;
+    # Use package from unstable to get at least version 2.6.0 for native Forgejo support.
+    # https://github.com/woodpecker-ci/woodpecker/releases/tag/v2.6.0
+    package = pkgs-unstable.woodpecker-server;
    environment = {
      WOODPECKER_HOST = "https://woodpecker.hamburg.ccc.de";
      WOODPECKER_SERVER_ADDR = ":8001";
@ -22,7 +24,6 @@
      WOODPECKER_DATABASE_DATASOURCE = "postgresql://woodpecker-server@/woodpecker-server?host=/run/postgresql";
      WOODPECKER_FORGEJO = "true";
      WOODPECKER_FORGEJO_URL = "https://git.hamburg.ccc.de";
-      WOODPECKER_LIMIT_MEM = "6442450944"; # 6GB
      # Set via enviornmentFile:
      # WOODPECKER_FORGEJO_CLIENT
      # WOODPECKER_FORGEJO_SECRET
--- a/config/hosts/yate/service.nix
+++ b/config/hosts/yate/service.nix
@ -6,12 +6,12 @@
    description = "Yate telehony engine";
    unitConfig = {
      Type = "simple";
-      After = "network.target";
+      After="network.target";
    };
    serviceConfig = {
      ExecStart = "${pkgs.yate}/bin/yate -c /yate -e /yate/share -Do";
-      Type = "simple";
-      Restart = "always";
+      Type="simple";
+      Restart="always";
      # ...
    };
    wantedBy = [ "default.target" ];
--- a/flake.lock
+++ b/flake.lock
@ -1,26 +1,12 @@
 {
  "nodes": {
-    "authorizedKeysRepo": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1731276342,
-        "narHash": "sha256-plTYjM6zPzoBE/dp6EUrk9mCqmab278p8FqBCTX8Grc=",
-        "rev": "686a6af22f6696f0c0595c56f463c078550049fc",
-        "type": "tarball",
-        "url": "https://git.hamburg.ccc.de/api/v1/repos/CCCHH/infrastructure-authorized-keys/archive/686a6af22f6696f0c0595c56f463c078550049fc.tar.gz?rev=686a6af22f6696f0c0595c56f463c078550049fc"
-      },
-      "original": {
-        "type": "tarball",
-        "url": "https://git.hamburg.ccc.de/CCCHH/infrastructure-authorized-keys/archive/686a6af22f6696f0c0595c56f463c078550049fc.tar.gz"
-      }
-    },
    "nixlib": {
      "locked": {
-        "lastModified": 1731200463,
-        "narHash": "sha256-qDaAweJjdFbVExqs8aG27urUgcgKufkIngHW3Rzustg=",
+        "lastModified": 1729386149,
+        "narHash": "sha256-hUP9oxmnOmNnKcDOf5Y55HQ+NnoT0+bLWHLQWLLw9Ks=",
        "owner": "nix-community",
        "repo": "nixpkgs.lib",
-        "rev": "e04234d263750db01c78a412690363dc2226e68a",
+        "rev": "cce4521b6df014e79a7b7afc58c703ed683c916e",
        "type": "github"
      },
      "original": {
@ -32,14 +18,16 @@
    "nixos-generators": {
      "inputs": {
        "nixlib": "nixlib",
-        "nixpkgs": "nixpkgs"
+        "nixpkgs": [
+          "nixpkgs"
+        ]
      },
      "locked": {
-        "lastModified": 1731546190,
-        "narHash": "sha256-kJix8nLyFIJ3EC7VtoXK/85C4ZN2dC5oWoS8+ErehqI=",
+        "lastModified": 1729472750,
+        "narHash": "sha256-s93LPHi5BN7I2xSGNAFWiYb8WRsPvT1LE9ZjZBrpFlg=",
        "owner": "nix-community",
        "repo": "nixos-generators",
-        "rev": "06ffce1a8d95e95c06a4bcfa117dd960b14a7101",
+        "rev": "7c60ba4bc8d6aa2ba3e5b0f6ceb9fc07bc261565",
        "type": "github"
      },
      "original": {
@ -50,27 +38,11 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1731245184,
-        "narHash": "sha256-vmLS8+x+gHRv1yzj3n+GTAEObwmhxmkkukB2DwtJRdU=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "aebe249544837ce42588aa4b2e7972222ba12e8f",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixpkgs-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_2": {
-      "locked": {
-        "lastModified": 1731842749,
-        "narHash": "sha256-aNc8irVBH7sM5cGDvqdOueg8S+fGakf0rEMRGfGwWZw=",
+        "lastModified": 1731133565,
+        "narHash": "sha256-tCErjTdCUWK06LzkcvwUM+3pyrrmdf8e0VDBBTgqznE=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "bf6132dc791dbdff8b6894c3a85eb27ad8255682",
+        "rev": "11f65b4b0405cff5b54c813626bddcf5435d7ad2",
        "type": "github"
      },
      "original": {
@ -80,11 +52,43 @@
        "type": "github"
      }
    },
+    "nixpkgs-stable": {
+      "locked": {
+        "lastModified": 1730602179,
+        "narHash": "sha256-efgLzQAWSzJuCLiCaQUCDu4NudNlHdg2NzGLX5GYaEY=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "3c2f1c4ca372622cb2f9de8016c9a0b1cbd0f37c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "release-24.05",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs-unstable": {
+      "locked": {
+        "lastModified": 1731265036,
+        "narHash": "sha256-e5I+glVZwQvLT6WIeMFi0Mk+N/jkYauZ31ir2NRZcf8=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "8aed22ecd71e5b67e5299efae8b9dc580dec711c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-unstable-small",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
    "root": {
      "inputs": {
-        "authorizedKeysRepo": "authorizedKeysRepo",
        "nixos-generators": "nixos-generators",
-        "nixpkgs": "nixpkgs_2",
+        "nixpkgs": "nixpkgs",
+        "nixpkgs-unstable": "nixpkgs-unstable",
        "sops-nix": "sops-nix"
      }
    },
@ -92,14 +96,15 @@
      "inputs": {
        "nixpkgs": [
          "nixpkgs"
-        ]
+        ],
+        "nixpkgs-stable": "nixpkgs-stable"
      },
      "locked": {
-        "lastModified": 1731862312,
-        "narHash": "sha256-NVUTFxKrJp/hjehlF1IvkPnlRYg/O9HFVutbxOM8zNM=",
+        "lastModified": 1731213149,
+        "narHash": "sha256-jR8i6nFLmSmm0cIoeRQ8Q4EBARa3oGaAtEER/OMMxus=",
        "owner": "Mic92",
        "repo": "sops-nix",
-        "rev": "472741cf3fee089241ac9ea705bb2b9e0bfa2978",
+        "rev": "f1675e3b0e1e663a4af49be67ecbc9e749f85eb7",
        "type": "github"
      },
      "original": {
--- a/flake.nix
+++ b/flake.nix
@ -1,17 +1,22 @@
 {
  description = "CCCHH Nix Infrastructure";

+  nixConfig = {
+    allow-import-from-derivation = true;
+  };
+
  inputs = {
    # Use the NixOS small channels for nixpkgs.
    # https://nixos.org/manual/nixos/stable/#sec-upgrading
    # https://github.com/NixOS/nixpkgs
    nixpkgs.url = "github:nixos/nixpkgs/nixos-24.05-small";
+    nixpkgs-unstable.url = "github:nixos/nixpkgs/nixos-unstable-small";

    # Add nixos-generators as an input.
    # See here: https://github.com/nix-community/nixos-generators#using-in-a-flake
    nixos-generators = {
      url = "github:nix-community/nixos-generators";
-      #inputs.nixpkgs.follows = "nixpkgs";
+      inputs.nixpkgs.follows = "nixpkgs";
    };

    # Add sops-nix as an input for secret management.
@ -20,225 +25,214 @@
      url = "github:Mic92/sops-nix";
      inputs.nixpkgs.follows = "nixpkgs";
    };
-
-    authorizedKeysRepo = {
-      url = "https://git.hamburg.ccc.de/CCCHH/infrastructure-authorized-keys/archive/686a6af22f6696f0c0595c56f463c078550049fc.tar.gz";
-      flake = false;
-    };
  };

-  outputs = { self, nixpkgs, nixos-generators, sops-nix, authorizedKeysRepo, ... }:
+  outputs = { self, nixpkgs, nixpkgs-unstable, nixos-generators, sops-nix, ... }:
    let
-      specialArgs = {
-        inherit authorizedKeysRepo;
-      };
      system = "x86_64-linux";
-    in
-    {
-      overlays = {
-        shairportSyncAirplay2 = final: prev: {
+      shairportSync431ExtendedNixpkgsUnstableOverlay = final: prev: {
        shairport-sync = (prev.shairport-sync.override { enableMetadata = true; enableAirplay2 = true; }).overrideAttrs (finalAttr: previousAttr: {
          # See: https://github.com/mikebrady/shairport-sync/blob/e78a88b64adfe7b5f88fd6faedf55c57445bb240/CONFIGURATION%20FLAGS.md
          configureFlags = previousAttr.configureFlags ++ [ "--with-mqtt-client" ];
          buildInputs = previousAttr.buildInputs ++ [ final.mosquitto ];
        });
      };
-      };
-      nixosModules = {
-        common = ./config/common;
-        proxmox-vm = ./config/proxmox-vm;
-        prometheus-exporter = ./config/extra/prometheus-exporter.nix;
-      };
+      pkgs-unstable = nixpkgs-unstable.legacyPackages."x86_64-linux";
+    in
+    {
      nixosConfigurations = {
        audio-hauptraum-kueche = nixpkgs.lib.nixosSystem {
-          inherit system specialArgs;
+          inherit system;
          modules = [
-            self.nixosModules.common
-            self.nixosModules.proxmox-vm
-            { nixpkgs.overlays = [ self.overlays.shairportSyncAirplay2 ]; }
+            ./config/common
+            ./config/proxmox-vm
+            { nixpkgs.overlays = [ shairportSync431ExtendedNixpkgsUnstableOverlay ]; }
            ./config/hosts/audio-hauptraum-kueche
          ];
        };

        audio-hauptraum-tafel = nixpkgs.lib.nixosSystem {
-          inherit system specialArgs;
+          inherit system;
          modules = [
-            self.nixosModules.common
-            self.nixosModules.proxmox-vm
-            { nixpkgs.overlays = [ self.overlays.shairportSyncAirplay2 ]; }
+            ./config/common
+            ./config/proxmox-vm
+            { nixpkgs.overlays = [ shairportSync431ExtendedNixpkgsUnstableOverlay ]; }
            ./config/hosts/audio-hauptraum-tafel
          ];
        };

        esphome = nixpkgs.lib.nixosSystem {
-          inherit system specialArgs;
+          inherit system;
          modules = [
-            self.nixosModules.common
-            self.nixosModules.proxmox-vm
+            ./config/common
+            ./config/proxmox-vm
            ./config/hosts/esphome
          ];
        };

        public-reverse-proxy = nixpkgs.lib.nixosSystem {
-          inherit system specialArgs;
+          inherit system;
          modules = [
-            self.nixosModules.common
-            self.nixosModules.proxmox-vm
+            ./config/common
+            ./config/proxmox-vm
            ./config/hosts/public-reverse-proxy
          ];
        };

        netbox = nixpkgs.lib.nixosSystem {
-          inherit system specialArgs;
+          inherit system;
          modules = [
-            self.nixosModules.common
-            self.nixosModules.proxmox-vm
+            ./config/common
+            ./config/proxmox-vm
            sops-nix.nixosModules.sops
-            self.nixosModules.prometheus-exporter
+            ./config/extra/prometheus-exporter.nix
            ./config/hosts/netbox
          ];
        };

        matrix = nixpkgs.lib.nixosSystem {
-          inherit system specialArgs;
+          inherit system;
          modules = [
-            self.nixosModules.common
-            self.nixosModules.proxmox-vm
+            ./config/common
+            ./config/proxmox-vm
            sops-nix.nixosModules.sops
-            self.nixosModules.prometheus-exporter
+            ./config/extra/prometheus-exporter.nix
            ./config/hosts/matrix
          ];
        };

        public-web-static = nixpkgs.lib.nixosSystem {
-          inherit system specialArgs;
+          inherit system;
          modules = [
-            self.nixosModules.common
-            self.nixosModules.proxmox-vm
+            ./config/common
+            ./config/proxmox-vm
            sops-nix.nixosModules.sops
-            self.nixosModules.prometheus-exporter
+            ./config/extra/prometheus-exporter.nix
            ./config/hosts/public-web-static
          ];
        };

        git = nixpkgs.lib.nixosSystem {
-          inherit system specialArgs;
+          inherit system;
          modules = [
-            self.nixosModules.common
-            self.nixosModules.proxmox-vm
+            ./config/common
+            ./config/proxmox-vm
            sops-nix.nixosModules.sops
-            self.nixosModules.prometheus-exporter
+            ./config/extra/prometheus-exporter.nix
            ./config/hosts/git
          ];
        };

        forgejo-actions-runner = nixpkgs.lib.nixosSystem {
-          inherit system specialArgs;
+          inherit system;
          modules = [
-            self.nixosModules.common
-            self.nixosModules.proxmox-vm
+            ./config/common
+            ./config/proxmox-vm
            sops-nix.nixosModules.sops
-            self.nixosModules.prometheus-exporter
+            ./config/extra/prometheus-exporter.nix
            ./config/hosts/forgejo-actions-runner
          ];
        };

        ptouch-print-server = nixpkgs.lib.nixosSystem {
-          inherit system specialArgs;
+          inherit system;
          modules = [
-            self.nixosModules.common
-            self.nixosModules.proxmox-vm
+            ./config/common
+            ./config/proxmox-vm
            ./config/hosts/ptouch-print-server
          ];
        };

        eh22-wiki = nixpkgs.lib.nixosSystem {
-          inherit system specialArgs;
+          inherit system;
          modules = [
-            self.nixosModules.common
-            self.nixosModules.proxmox-vm
-            self.nixosModules.prometheus-exporter
+            ./config/common
+            ./config/proxmox-vm
+            ./config/extra/prometheus-exporter.nix
            ./config/hosts/eh22-wiki
          ];
        };

        nix-box-june = nixpkgs.lib.nixosSystem {
-          inherit system specialArgs;
+          inherit system;
          modules = [
-            self.nixosModules.common
-            self.nixosModules.proxmox-vm
-            self.nixosModules.prometheus-exporter
+            ./config/common
+            ./config/proxmox-vm
+            ./config/extra/prometheus-exporter.nix
            ./config/hosts/nix-box-june
          ];
        };

        yate = nixpkgs.lib.nixosSystem {
-          inherit system specialArgs;
+          inherit system;
          modules = [
-            self.nixosModules.common
-            self.nixosModules.proxmox-vm
+            ./config/common
+            ./config/proxmox-vm
            ./config/hosts/yate
          ];
        };

        mqtt = nixpkgs.lib.nixosSystem {
-          inherit system specialArgs;
+          inherit system;
          modules = [
-            self.nixosModules.common
-            self.nixosModules.proxmox-vm
+            ./config/common
+            ./config/proxmox-vm
            ./config/hosts/mqtt
          ];
        };

        mjolnir = nixpkgs.lib.nixosSystem {
-          inherit system specialArgs;
+          inherit system;
          modules = [
-            self.nixosModules.common
-            self.nixosModules.proxmox-vm
+            ./config/common
+            ./config/proxmox-vm
            sops-nix.nixosModules.sops
-            self.nixosModules.prometheus-exporter
+            ./config/extra/prometheus-exporter.nix
            ./config/hosts/mjolnir
          ];
        };

        woodpecker = nixpkgs.lib.nixosSystem {
-          inherit system specialArgs;
+          inherit system;
          modules = [
-            self.nixosModules.common
-            self.nixosModules.proxmox-vm
+            ./config/common
+            ./config/proxmox-vm
            sops-nix.nixosModules.sops
-            self.nixosModules.prometheus-exporter
+            ./config/extra/prometheus-exporter.nix
            ./config/hosts/woodpecker
          ];
+          specialArgs = {
+            inherit pkgs-unstable;
+          };
        };

        status = nixpkgs.lib.nixosSystem {
-          inherit system specialArgs;
+          inherit system;
          modules = [
-            self.nixosModules.common
-            self.nixosModules.proxmox-vm
+            ./config/common
+            ./config/proxmox-vm
            sops-nix.nixosModules.sops
            ./config/hosts/status
          ];
        };

        penpot = nixpkgs.lib.nixosSystem {
-          inherit system specialArgs;
+          inherit system;
          modules = [
-            self.nixosModules.common
-            self.nixosModules.proxmox-vm
+            ./config/common
+            ./config/proxmox-vm
            sops-nix.nixosModules.sops
-            self.nixosModules.prometheus-exporter
+            ./config/extra/prometheus-exporter.nix
            ./config/hosts/penpot
          ];
        };

        hydra = nixpkgs.lib.nixosSystem {
-          inherit system specialArgs;
+          inherit system;
          modules = [
-            self.nixosModules.common
-            self.nixosModules.proxmox-vm
-            self.nixosModules.prometheus-exporter
+            ./config/common
+            ./config/proxmox-vm
+            ./config/extra/prometheus-exporter.nix
            ./config/hosts/hydra
          ];
        };
@ -246,24 +240,22 @@

      packages.x86_64-linux = {
        proxmox-nixos-template = nixos-generators.nixosGenerate {
-          inherit specialArgs;
          system = "x86_64-linux";
          modules = [
            ./config/nixos-generators/proxmox.nix
-            self.nixosModules.common
-            self.nixosModules.proxmox-vm
+            ./config/common
+            ./config/proxmox-vm
          ];
          format = "proxmox";
        };

        proxmox-chaosknoten-nixos-template = nixos-generators.nixosGenerate {
-          inherit specialArgs;
          system = "x86_64-linux";
          modules = [
            ./config/nixos-generators/proxmox-chaosknoten.nix
            ./config/proxmox-chaosknoten-additional-initial-config.nix
-            self.nixosModules.common
-            self.nixosModules.proxmox-vm
+            ./config/common
+            ./config/proxmox-vm
          ];
          format = "proxmox";
        };