WIP

Reviewed-on: https://git.pvv.ntnu.no/Drift/pvv-nixos-config/pulls/64
Reviewed-by: Oystein Kristoffer Tveit <oysteikt@pvv.ntnu.no>

.gitignore

@@ -1,3 +1,4 @@
 result*
 /configuration.nix
 /.direnv/
+*.qcow2

base.nix

@@ -139,4 +139,12 @@
     acceptTerms = true;
     defaults.email = "drift@pvv.ntnu.no";
   };
+  # Let's not spam LetsEncrypt in `nixos-rebuild build-vm` mode:
+  virtualisation.vmVariant = {
+    security.acme.defaults.server = "https://127.0.0.1";
+    security.acme.preliminarySelfsigned = true;
+
+    users.users.root.initialPassword = "root";
+  };
+
 }

flake.lock

@@ -1,5 +1,26 @@
 {
   "nodes": {
+    "dibbler": {
+      "inputs": {
+        "flake-utils": "flake-utils",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1693682284,
+        "narHash": "sha256-FvVCkHH80YyUiqQlnGNr49rZRBniihF6YRpytguEkFQ=",
+        "ref": "refs/heads/master",
+        "rev": "8a6a0c12ba37e239684d2de1be12fd73903cfb2c",
+        "revCount": 193,
+        "type": "git",
+        "url": "https://git.pvv.ntnu.no/Projects/dibbler.git"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://git.pvv.ntnu.no/Projects/dibbler.git"
+      }
+    },
     "disko": {
       "inputs": {
         "nixpkgs": [
@@ -22,7 +43,7 @@
     },
     "fix-python": {
       "inputs": {
-        "flake-utils": "flake-utils",
+        "flake-utils": "flake-utils_2",
         "nixpkgs": [
           "grzegorz",
           "nixpkgs"
@@ -46,6 +67,24 @@
       "inputs": {
         "systems": "systems"
       },
+      "locked": {
+        "lastModified": 1692799911,
+        "narHash": "sha256-3eihraek4qL744EvQXsK1Ha6C3CR7nnT8X2qWap4RNk=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "f9e7cf818399d17d347f847525c5a5a8032e4e44",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_2": {
+      "inputs": {
+        "systems": "systems_2"
+      },
       "locked": {
         "lastModified": 1689068808,
         "narHash": "sha256-6ixXo3wt24N/melDWjq70UuHQLxGV8jZvooRanIHXw0=",
@@ -194,11 +233,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1693136143,
+        "lastModified": 1723850344,
-        "narHash": "sha256-amHprjftc3y/bg8yf4hITCLa+ez5HIi0yGfR7TU6UIc=",
+        "narHash": "sha256-aT37O9l9eclWEnqxASVNBL1dKwDHZUOqdbA4VO9DJvw=",
         "ref": "refs/heads/main",
-        "rev": "a32894b305f042d561500f5799226afd1faf5abb",
+        "rev": "38b66677ab8c01aee10cd59e745af9ce3ea88092",
-        "revCount": 9,
+        "revCount": 19,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Projects/calendar-bot.git"
       },
@@ -229,6 +268,7 @@
     },
     "root": {
       "inputs": {
+        "dibbler": "dibbler",
         "disko": "disko",
         "grzegorz": "grzegorz",
         "grzegorz-clients": "grzegorz-clients",
@@ -276,6 +316,21 @@
         "repo": "default",
         "type": "github"
       }
+    },
+    "systems_2": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
     }
   },
   "root": "root",

flake.nix

@@ -17,6 +17,9 @@
     pvv-calendar-bot.url = "git+https://git.pvv.ntnu.no/Projects/calendar-bot.git";
     pvv-calendar-bot.inputs.nixpkgs.follows = "nixpkgs";
 
+    dibbler.url = "git+https://git.pvv.ntnu.no/Projects/dibbler.git";
+    dibbler.inputs.nixpkgs.follows = "nixpkgs";
+
     matrix-next.url = "github:dali99/nixos-matrix-modules/v0.6.0";
     matrix-next.inputs.nixpkgs.follows = "nixpkgs";
 
@@ -124,6 +127,13 @@
         ];
       };
       buskerud = stableNixosConfig "buskerud" { };
+      skrott = stableNixosConfig "skrott" {
+        system = "aarch64-linux";
+        modules = [
+          (nixpkgs + "/nixos/modules/installer/sd-card/sd-image-aarch64.nix")
+          inputs.dibbler.nixosModules.default
+        ];
+      };
     };
 
     nixosModules = {
@@ -147,6 +157,7 @@
 
         simplesamlphp = pkgs.callPackage ./packages/simplesamlphp { };
 
+        skrot = self.nixosConfigurations.skrott.config.system.build.sdImage;
       } //
       (nixlib.pipe null [
         (_: pkgs.callPackage ./packages/mediawiki-extensions { })

hosts/bekkalokk/services/gitea/default.nix

@@ -6,8 +6,7 @@ let
 in {
   imports = [
     ./ci.nix
-    ./import-users
+    ./import-users.nix
-    ./web-secret-provider
   ];
 
   sops.secrets = {

hosts/bekkalokk/services/gitea/web-secret-provider/default.nix

@@ -1,153 +0,0 @@
-{ config, pkgs, lib, ... }:
-let
-  organizations = [
-    "Drift"
-    "Projects"
-    "Kurs"
-  ];
-
-  cfg = config.services.gitea;
-
-  program = pkgs.writers.writePython3 "gitea-web-secret-provider" {
-    libraries = with pkgs.python3Packages; [ requests ];
-    flakeIgnore = [
-      "E501" # Line over 80 chars lol
-      "E201" # "whitespace after {"
-      "E202" # "whitespace after }"
-      "E251" # unexpected spaces around keyword / parameter equals
-      "W391" # Newline at end of file
-    ];
-    makeWrapperArgs = [
-      "--prefix PATH : ${(lib.makeBinPath [ pkgs.openssh ])}"
-    ];
-  } (lib.pipe ./gitea-web-secret-provider.py [
-    builtins.readFile
-    (lib.splitString "\n")
-    (lib.drop 2)
-    lib.concatLines
-  ]);
-
-  commonHardening = {
-    NoNewPrivileges = true;
-    PrivateTmp = true;
-    PrivateDevices = true;
-    ProtectSystem = true;
-    ProtectHome = true;
-    ProtectControlGroups = true;
-    ProtectKernelModules = true;
-    ProtectKernelTunables = true;
-    RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
-    RestrictRealtime = true;
-    RestrictSUIDSGID = true;
-    MemoryDenyWriteExecute = true;
-    LockPersonality = true;
-  };
-in
-{
-  sops.secrets."gitea/web-secret-provider/token" = {
-    owner = "gitea";
-    group = "gitea";
-    restartUnits = [
-      "gitea-web-secret-provider@"
-    ] ++ (map (org: "gitea-web-secret-provider@${org}") organizations);
-  };
-
-  systemd.tmpfiles.settings."10-gitea-web-secret-provider"."/var/lib/gitea-web/authorized_keys.d".d = {
-    user = "gitea";
-    group = "gitea";
-    mode = "700";
-  };
-
-  systemd.slices.system-giteaweb = {
-    description = "Gitea web directories";
-    wantedBy = [ "multi-user.target" ];
-  };
-
-  # https://www.freedesktop.org/software/systemd/man/latest/systemd.unit.html#Specifiers
-  # %i - instance name (after the @)
-  # %d - secrets directory
-  # %S - /var/lib
-  systemd.services = {
-    "gitea-web-secret-provider@" = {
-      description = "Ensure all repos in %i has an SSH key to push web content";
-      requires = [ "gitea.service" "network.target" ];
-      serviceConfig = {
-        Slice = "system-giteaweb.slice";
-        Type = "oneshot";
-        ExecStart = let
-          args = lib.cli.toGNUCommandLineShell { } {
-            org = "%i";
-            token-path = "%d/token";
-            api-url = "${cfg.settings.server.ROOT_URL}api/v1";
-            key-dir = "%S/%i/keys";
-            authorized-keys-path = "%S/gitea-web/authorized_keys.d/%i";
-            rrsync-path = "${pkgs.rrsync}/bin/rrsync";
-            web-dir = "%S/gitea-web/web";
-          };
-        in "${program} ${args}";
-        User = "gitea";
-        Group = "gitea";
-        StateDirectory = "%i";
-        LoadCredential = [
-          "token:${config.sops.secrets."gitea/web-secret-provider/token".path}"
-        ];
-      } // commonHardening;
-    };
-
-    "gitea-web-chown@" = {
-      description = "Ensure all gitea-web content is owned by the gitea user";
-      serviceConfig = {
-        Slice = "system-giteaweb.slice";
-        Type = "oneshot";
-        ExecStart = "${pkgs.coreutils}/bin/chown -R gitea:gitea '%S/gitea-web'";
-
-        StateDirectory = "%i";
-
-        LoadCredential = [
-          "token:${config.sops.secrets."gitea/web-secret-provider/token".path}"
-        ];
-
-        PrivateNetwork = true;
-      } // commonHardening;
-    };
-  };
-
-  systemd.timers = {
-    "gitea-web-secret-provider@" = {
-      description = "Ensure all repos in %i has an SSH key to push web content";
-      timerConfig = {
-        RandomizedDelaySec = "1h";
-        Persistent = true;
-        Unit = "gitea-web-secret-provider@%i.service";
-        OnCalendar = "daily";
-      };
-    };
-
-    "gitea-web-chown@" = {
-      description = "Ensure all gitea-web content is owned by the gitea user";
-      timerConfig = {
-        RandomizedDelaySec = "10m";
-        Persistent = true;
-        Unit = "gitea-web-chown@%i.service";
-        OnCalendar = "hourly";
-      };
-    };
-  };
-
-  systemd.targets.timers.wants = lib.mapCartesianProduct ({ timer, org }: "${timer}@${org}.timer") {
-    timer = [
-      "gitea-web-secret-provider"
-      "gitea-web-chown"
-    ];
-    org = organizations;
-  };
-
-  services.openssh.authorizedKeysFiles = map (org: "/var/lib/gitea-web/authorized_keys.d/${org}") organizations;
-
-  services.nginx.virtualHosts."pages.pvv.ntnu.no" = {
-    kTLS = true;
-    forceSSL = true;
-    enableACME = true;
-    root = "/var/lib/gitea-web/web";
-  };
-}

hosts/bekkalokk/services/gitea/web-secret-provider/gitea-web-secret-provider.py

@@ -1,107 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i python3 -p "python3.withPackages(ps: with ps; [ requests ])" openssh
-
-import argparse
-import hashlib
-import os
-import requests
-import subprocess
-from pathlib import Path
-
-
-def parse_args():
-    parser = argparse.ArgumentParser(description="Generate SSH keys for Gitea repositories and add them as secrets")
-    parser.add_argument("--org", required=True, help="The organization to generate keys for")
-    parser.add_argument("--token-path", metavar='PATH', required=True, help="Path to a file containing the Gitea API token")
-    parser.add_argument("--api-url", metavar='URL', help="The URL of the Gitea API", default="https://git.pvv.ntnu.no/api/v1")
-    parser.add_argument("--key-dir", metavar='PATH', help="The directory to store the generated keys in", default="/run/gitea-web-secret-provider")
-    parser.add_argument("--authorized-keys-path", metavar='PATH', help="The path to the resulting authorized_keys file", default="/etc/ssh/authorized_keys.d/gitea-web-secret-provider")
-    parser.add_argument("--rrsync-path", metavar='PATH', help="The path to the rrsync binary", default="/run/current-system/sw/bin/rrsync")
-    parser.add_argument("--web-dir", metavar='PATH', help="The directory to sync the repositories to", default="/var/www")
-    parser.add_argument("--force", action="store_true", help="Overwrite existing keys")
-    return parser.parse_args()
-
-
-def add_secret(args, token, repo, name, secret):
-    result = requests.put(
-        f"{args.api_url}/repos/{args.org}/{repo}/actions/secrets/{name}",
-        json = { 'data': secret },
-        headers = { 'Authorization': 'token ' + token },
-    )
-    if result.status_code not in (201, 204):
-        raise Exception(f"Failed to add secret: {result.json()}")
-
-
-def get_org_repo_list(args, token):
-    result = requests.get(
-        f"{args.api_url}/orgs/{args.org}/repos",
-        headers = { 'Authorization': 'token ' + token },
-    )
-    return [repo["name"] for repo in result.json()]
-
-
-def generate_ssh_key(args, repository: str):
-    keyname = hashlib.sha256(args.org.encode() + repository.encode()).hexdigest()
-
-    if not os.path.exists(os.path.join(args.key_dir, keyname)) or args.force:
-        subprocess.run(
-            [
-                "ssh-keygen",
-                *("-t", "ed25519"),
-                *("-b", "4096"),
-                *("-f", os.path.join(args.key_dir, keyname)),
-                *("-N", ""),
-                *("-C", f"{args.org}/{repository}"),
-            ],
-            check=True,
-            stdin=subprocess.DEVNULL,
-            stdout=subprocess.DEVNULL,
-            stderr=subprocess.DEVNULL
-        )
-        print(f"Generated SSH key for `{args.org}/{repository}`")
-
-    with open(os.path.join(args.key_dir, keyname), "r") as f:
-        private_key = f.read()
-
-    with open(os.path.join(args.key_dir, keyname + ".pub"), "r") as f:
-        public_key = f.read()
-
-    return private_key, public_key
-
-
-def generate_authorized_keys(args, repo_public_keys: list[tuple[str, str]]):
-    result = ""
-    for repo, public_key in repo_public_keys:
-        result += f"""
-            command="{args.rrsync_path} -wo {args.web_dir}/{args.org}/{repo}",restrict,no-agent-forwarding,no-port-forwarding,no-pty,no-X11-forwarding {public_key}
-        """.strip() + "\n"
-
-    with open(args.authorized_keys_path, "w") as f:
-        f.write(result)
-
-
-def main():
-    args = parse_args()
-
-    with open(args.token_path, "r") as f:
-        token = f.read().strip()
-
-    os.makedirs(args.key_dir, 0o700, exist_ok=True)
-    os.makedirs(Path(args.authorized_keys_path).parent, 0o700, exist_ok=True)
-
-    repos = get_org_repo_list(args, token)
-    print(f'Found {len(repos)} repositories in `{args.org}`')
-
-    repo_public_keys = []
-    for repo in repos:
-        print(f"Locating key for `{args.org}/{repo}`")
-        private_key, public_key = generate_ssh_key(args, repo)
-        add_secret(args, token, repo, "WEB_SYNC_SSH_KEY", private_key)
-        repo_public_keys.append((repo, public_key))
-
-    generate_authorized_keys(args, repo_public_keys)
-    print(f"Wrote authorized_keys file to `{args.authorized_keys_path}`")
-
-
-if __name__ == "__main__":
-    main()

hosts/bicep/configuration.nix

@@ -12,8 +12,7 @@
     ./services/mysql.nix
     ./services/postgres.nix
     ./services/mysql.nix
-    # TODO: fix the calendar bot
+    ./services/calendar-bot.nix
-    # ./services/calendar-bot.nix
 
     ./services/matrix
   ];

hosts/bicep/services/calendar-bot.nix

@@ -2,11 +2,19 @@
 let
   cfg = config.services.pvv-calendar-bot;
 in {
-  sops.secrets."calendar-bot/matrix_token" = {
+  sops.secrets = {
-    sopsFile = ../../../secrets/bicep/bicep.yaml;
+    "calendar-bot/matrix_token" = {
-    key = "calendar-bot/matrix_token";
+      sopsFile = ../../../secrets/bicep/bicep.yaml;
-    owner = cfg.user;
+      key = "calendar-bot/matrix_token";
-    group = cfg.group;
+      owner = cfg.user;
+      group = cfg.group;
+    };
+    "calendar-bot/mysql_password" = {
+      sopsFile = ../../../secrets/bicep/bicep.yaml;
+      key = "calendar-bot/mysql_password";
+      owner = cfg.user;
+      group = cfg.group;
+    };
   };
 
   services.pvv-calendar-bot = {
@@ -18,6 +26,11 @@ in {
         user = "@bot_calendar:pvv.ntnu.no";
         channel = "!gkNLUIhYVpEyLatcRz:pvv.ntnu.no";
       };
+      database = {
+        host = "mysql.pvv.ntnu.no";
+        user = "calendar-bot";
+        passwordFile = config.sops.secrets."calendar-bot/mysql_password".path;
+      };
       secretsFile = config.sops.secrets."calendar-bot/matrix_token".path;
       onCalendar = "*-*-* 09:00:00";
     };

hosts/skrott/configuration.nix

@@ -0,0 +1,10 @@
+{ lib, values, ... }: {
+  system.stateVersion = "22.05";
+
+  systemd.network.networks."30-all" = values.defaultNetworkConfig // {
+    matchConfig.Name = "eth0";
+    address = with values.hosts.skrott; [ (ipv4 + "/25") (ipv6 + "/64") ];
+  };
+
+  networking.hostName = lib.mkForce "skrot";
+}

justfile

@@ -10,6 +10,10 @@ check:
 build-machine machine=`just _a_machine`:
   {{nom}} build .#nixosConfigurations.{{ machine }}.config.system.build.toplevel
 
+run-vm machine=`just _a_machine`:
+  nixos-rebuild build-vm --flake .#{{ machine }}
+  QEMU_NET_OPTS="hostfwd=tcp::8080-:80,hostfwd=tcp::8081-:443,hostfwd=tcp::2222-:22" ./result/bin/run-*-vm
+
 @update-inputs:
   nix eval .#inputs --apply builtins.attrNames --json \
     | jq '.[]' -r \

secrets/bekkalokk/bekkalokk.yaml

@@ -1,6 +1,4 @@
 gitea:
-    web-secret-provider:
-        token: ENC[AES256_GCM,data:pHmBKxrNcLifl4sjR44AGEElfdachja35Tl/InsqvBWturaeTv4R0w==,iv:emBWfXQs2VNqtpDp5iA5swNC+24AWDYYXo6nvN+Fwx4=,tag:lkhSVSs6IqhHpfDPOX0wQA==,type:str]
     password: ENC[AES256_GCM,data:hlNzdU1ope0t50/3aztyLeXjMHd2vFPpwURX+Iu8f49DOqgSnEMtV+KtLA==,iv:qljRnSnchL5cFmaUAfCH9GQYQxcy5cyWejgk1x6bFgI=,tag:tIhboFU5kZsj5oAQR3hLbw==,type:str]
     database: ENC[AES256_GCM,data:UlS33IdCEyeSvT6ngpmnkBWHuSEqsB//DT+3b7C+UwbD8UXWJlsLf1X8/w==,iv:mPRW5ldyZaHP+y/0vC2JGSLZmlkhgmkvXPk4LazkSDs=,tag:gGk6Z/nbPvzE1zG+tJC8Sw==,type:str]
     email-password: ENC[AES256_GCM,data:KRwC+aL1aPvJuXt91Oq1ttATMnFTnuUy,iv:ats8TygB/2pORkaTZzPOLufZ9UmvVAKoRcWNvYF1z6w=,tag:Do0fA+4cZ3+l7JJyu8hjBg==,type:str]
@@ -92,8 +90,8 @@ sops:
             UHpLRkdQTnhkeGlWVG9VS1hkWktyckEKAdwnA9URLYZ50lMtXrU9Q09d0L3Zfsyr
             4UsvjjdnFtsXwEZ9ZzOQrpiN0Oz24s3csw5KckDni6kslaloJZsLGg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-08-13T19:49:24Z"
+    lastmodified: "2024-05-26T02:07:41Z"
-    mac: ENC[AES256_GCM,data:AeJ53D+8A8mHYRmVHdqhcS1ZTbqVe5gQqJsJjMk4T/ZlNX8/V4M9mqAW2FB9m/JSdj234gDu+PBHcW70ZrCqeVsoUW/ETVgUX3W2gBmBgYJiRETp8I7/eks/5YEV6vIIxQsZNP/9dZTNX4T2wD74ELl23NSTXA/6k2tyzBlTMYo=,iv:DABafHvw+5w0PHCKqLgpwmQnv0uHOTyj+s8gdnHFTZ4=,tag:SNZ7W+6zdyuuv2AB9ir8eg==,type:str]
+    mac: ENC[AES256_GCM,data:CRaJefV1zcJc6eyzyjTLgd0+Wv46VT8o4iz2YAGU+c2b/Cr97Tj290LoEO6UXTI3uFwVfzii2yZ2l+4FK3nVVriD4Cx1O/9qWcnLa5gfK30U0zof6AsJx8qtGu1t6oiPlGUCF7sT0BW9Wp8cPumrY6cZp9QbhmIDV0o0aJNUNN4=,iv:8OSYV1eG6kYlJD4ovZZhcD1GaYnmy7vHPa/+7egM1nE=,tag:OPI13rpDh2l1ViFj8TBFWg==,type:str]
     pgp:
         - created_at: "2024-08-04T00:03:28Z"
           enc: |-
@@ -116,4 +114,4 @@ sops:
             -----END PGP MESSAGE-----
           fp: F7D37890228A907440E1FD4846B9228E814A2AAC
     unencrypted_suffix: _unencrypted
-    version: 3.9.0
+    version: 3.8.1

secrets/bicep/bicep.yaml

@@ -1,5 +1,6 @@
 calendar-bot:
     matrix_token: ENC[AES256_GCM,data:zJv9sw6pEzb9hxKT682wsD87HC9iejbps2wl2Z5QW1XZUSBHdcqyg1pxd+jFKTeKGQ==,iv:zDbvF1H98NsECjCtGXS+Y9HIhXowzz9HF9mltqnArog=,tag:/ftcOSQ13ElkVJBxYIMUGQ==,type:str]
+    mysql_password: ENC[AES256_GCM,data:Gqag8yOgPH3ntoT5TmaqJWv1j+si2qIyz5Ryfw5E2A==,iv:kQDcxnPfwJQcFovI4f87UDt18F8ah3z5xeY86KmdCyY=,tag:A1sCSNXJziAmtUWohqwJgg==,type:str]
 mysql:
     password: ENC[AES256_GCM,data:KqEe0TVdeMIzPKsmFg9x0X9xWijnOk306ycyXTm2Tpqo/O0F,iv:Y+hlQ8n1ZIP9ncXBzd2kCSs/DWVTWhiEluFVwZFKRCA=,tag:xlaUk0Wftk62LpYE5pKNQw==,type:str]
 sops:
@@ -62,8 +63,8 @@ sops:
             cTh5bnJ3WW90aXRCSUp6NHFYeU1tZ0kK4afdtJwGNu6wLRI0fuu+mBVeqVeB0rgX
             0q5hwyzjiRnHnyjF38CmcGgydSfDRmF6P+WIMbCwXC6LwfRhAmBGPg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-09-05T23:28:56Z"
+    lastmodified: "2024-08-15T21:18:33Z"
-    mac: ENC[AES256_GCM,data:pCWTkmCQgBOqhejK2sCLQ3H8bRXmXlToQxYmOG0IWDo2eGiZOLuIkZ1/1grYgfxAGiD4ysJod0nJuvo+eAsMeYAy6QJVtrOqO2d9V2NEdzLckXyYvwyJyZoFbNC5EW9471V0m4jLRSh5821ckNo/wtWFR11wfO15tI3MqtD1rtA=,iv:QDnckPl0LegaH0b7V4WAtmVXaL4LN+k3uKHQI2dkW7E=,tag:mScUQBR0ZHl1pi/YztrvFg==,type:str]
+    mac: ENC[AES256_GCM,data:uR5HgeDAYqoqB9kk1V6p0T30+v6WpQJi4+qIeCDRnoUPnQKUVR10hvBhICck+E+Uh8p+tGhM6Uf3YrAJAV0ZCUiNJjtwDJQQLUDT53vdOAXN4xADCQqNuhgVwVMaruoTheEiwOswRuhFeEwy0gBj3Ze2pu47lueHYclmEzumLeQ=,iv:t0UyXN2YaR2m7M/pV2wTLJG5wVfqTIUs7wSQMmyeTVw=,tag:O7dIffzrDAXz3kGx5uazhw==,type:str]
     pgp:
         - created_at: "2024-08-04T00:03:40Z"
           enc: |-
@@ -86,4 +87,4 @@ sops:
             -----END PGP MESSAGE-----
           fp: F7D37890228A907440E1FD4846B9228E814A2AAC
     unencrypted_suffix: _unencrypted
-    version: 3.7.3
+    version: 3.9.0

values.nix

@@ -63,6 +63,10 @@ in rec {
       ipv4 = pvv-ipv4 231;
       ipv6 = pvv-ipv6 231;
     };
+    skrott = {
+      ipv4 = pvv-ipv4 235;
+      ipv6 = pvv-ipv6 235;
+    };
   };
 
   defaultNetworkConfig = {