kvernberg: disable SMART

base/services/openssh.nix

@@ -10,12 +10,5 @@
       Match All
     '';
     settings.PermitRootLogin = "yes";
-
   };
-    users.users."root".openssh.authorizedKeys.keys = [
+}
-      "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCqVt4LCe0YIttr9swFxjkjn37ZDY9JxwVC+2gvfSINDJorOCtqPjDOTD2fTS1Gz08QCwpnLWq2kyvRchu6WgriAbSACpbZZBgxRaF/FVh3oiMVFGnNKGnv6/fdo/vZtu8mUVuqtmTrgLYpZdbR4oD3XiBlDKs7Cv5hPqt95lnP6MNFvE8mICCfd1PwhsABd2IQ5laz3u77/RXhNFJL0Kf2/+6gk9awcLuwHrPdvq7c3BxRHbc9UMRQENyjyQPa7aLe+uJBFLKP51I8VBuDpDacuibQx7nMt6N2UJ2KWI0JxRMHuJNq4S5jidR82aOw9gzGbTv30SKNLMqsZ0xj4LtdqCXDiZF6Lr09PsJYsvnBUFWa14HGcThKDtgwQwBryNViYmfv//0h9+RLZiU0ab+NEwSs7Zh5iAD+vhx64QqNX3tR7Le4SWXh8W0eShU9N78qYdSkiC3Ui7htxeqOocXM/P4AwbnHsLELIvkHdvgchCPvl8ygZa4WJTEWv16+ICskJcAKWGuqjvXAFuwjJJmPp9xLW9O0DFfQhMELiGamQR9wK07yYQVr34iah6qZO7cwhSKyEPFrVPIaNtfDhsjED639F7vmktf26SWNJHWfW0wOHILjI6TgqUvy0JDd8W8w0CHlAfz6Fs2l99NNgNF8dB3vBASbxS0hu/y0PVu/xQ== openstack-sleipner"
-
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICCbgJ0Uwh9VSVhfId7l9i5/jk4CvAK5rbkiab8R+moF root@sleipner"
-    ];
-}
-

flake.lock

@@ -7,11 +7,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1729281548,
+        "lastModified": 1725242307,
-        "narHash": "sha256-MuojlSnwAJAwfhgmW8ZtZrwm2Sko4fqubCvReqbUzYw=",
+        "narHash": "sha256-a2iTMBngegEZvaNAzzxq5Gc5Vp3UWoGUqWtK11Txbic=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "a6a3179ddf396dfc28a078e2f169354d0c137125",
+        "rev": "96073e6423623d4a8027e9739d2af86d6422ea7a",
         "type": "github"
       },
       "original": {
@@ -20,25 +20,64 @@
         "type": "github"
       }
     },
-    "greg-ng": {
+    "fix-python": {
       "inputs": {
+        "flake-utils": "flake-utils",
         "nixpkgs": [
+          "grzegorz",
           "nixpkgs"
-        ],
+        ]
-        "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1730249639,
+        "lastModified": 1725463969,
-        "narHash": "sha256-G3URSlqCcb+GIvGyki+HHrDM5ZanX/dP9BtppD/SdfI=",
+        "narHash": "sha256-d3c1TAlIN1PtK+oQP1wO6XbDfmR4SUp/C/4s7G46ARo=",
-        "ref": "refs/heads/main",
+        "owner": "GuillaumeDesforges",
-        "rev": "80e0447bcb79adad4f459ada5610f3eae987b4e3",
+        "repo": "fix-python",
-        "revCount": 34,
+        "rev": "2926402234c3f99aa8e4608c51d9ffa73ea403c0",
+        "type": "github"
+      },
+      "original": {
+        "owner": "GuillaumeDesforges",
+        "repo": "fix-python",
+        "type": "github"
+      }
+    },
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1689068808,
+        "narHash": "sha256-6ixXo3wt24N/melDWjq70UuHQLxGV8jZvooRanIHXw0=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "919d646de7be200f3bf08cb76ae1f09402b6f9b4",
+        "type": "github"
+      },
+      "original": {
+        "id": "flake-utils",
+        "type": "indirect"
+      }
+    },
+    "grzegorz": {
+      "inputs": {
+        "fix-python": "fix-python",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1726861911,
+        "narHash": "sha256-pXPmVp4AgszzJXlLjj8r9NxoDvxoV4USGaiMwqCyb4M=",
+        "ref": "refs/heads/master",
+        "rev": "d10db19d7df5c5c2cd2dcb878376d5d681f6c2f2",
+        "revCount": 94,
         "type": "git",
-        "url": "https://git.pvv.ntnu.no/Projects/greg-ng.git"
+        "url": "https://git.pvv.ntnu.no/Projects/grzegorz.git"
       },
       "original": {
         "type": "git",
-        "url": "https://git.pvv.ntnu.no/Projects/greg-ng.git"
+        "url": "https://git.pvv.ntnu.no/Projects/grzegorz.git"
       }
     },
     "grzegorz-clients": {
@@ -119,11 +158,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1729307008,
+        "lastModified": 1725198597,
-        "narHash": "sha256-QUvb6epgKi9pCu9CttRQW4y5NqJ+snKr1FZpG/x3Wtc=",
+        "narHash": "sha256-w3sjCEbnc242ByJ18uebzgjFZY3QU7dZhmLwPsJIZJs=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "a9b86fc2290b69375c5542b622088eb6eca2a7c3",
+        "rev": "3524b030c839db4ea4ba16737789c6fb8a1769c6",
         "type": "github"
       },
       "original": {
@@ -135,11 +174,11 @@
     },
     "nixpkgs-stable": {
       "locked": {
-        "lastModified": 1728156290,
+        "lastModified": 1721524707,
-        "narHash": "sha256-uogSvuAp+1BYtdu6UWuObjHqSbBohpyARXDWqgI12Ss=",
+        "narHash": "sha256-5NctRsoE54N86nWd0psae70YSLfrOek3Kv1e8KoXe/0=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "17ae88b569bb15590549ff478bab6494dde4a907",
+        "rev": "556533a23879fc7e5f98dd2e0b31a6911a213171",
         "type": "github"
       },
       "original": {
@@ -151,11 +190,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1729308112,
+        "lastModified": 1725183711,
-        "narHash": "sha256-Ap+cPeiluam2KFZO+OWuFTl/IkIJfyGYGMgkT2pVCRY=",
+        "narHash": "sha256-gkjg8FfjL92azt3gzZUm1+v+U4y+wbQE630uIf4Aybo=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "61253596816c4cd65e2a0f474cbc0ac0c6e0f7cf",
+        "rev": "a2c345850e5e1d96c62e7fa8ca6c9d77ebad1c37",
         "type": "github"
       },
       "original": {
@@ -208,7 +247,7 @@
     "root": {
       "inputs": {
         "disko": "disko",
-        "greg-ng": "greg-ng",
+        "grzegorz": "grzegorz",
         "grzegorz-clients": "grzegorz-clients",
         "matrix-next": "matrix-next",
         "minecraft-data": "minecraft-data",
@@ -220,27 +259,6 @@
         "sops-nix": "sops-nix"
       }
     },
-    "rust-overlay": {
-      "inputs": {
-        "nixpkgs": [
-          "greg-ng",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1729391507,
-        "narHash": "sha256-as0I9xieJUHf7kiK2a9znDsVZQTFWhM1pLivII43Gi0=",
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "rev": "784981a9feeba406de38c1c9a3decf966d853cca",
-        "type": "github"
-      },
-      "original": {
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "type": "github"
-      }
-    },
     "sops-nix": {
       "inputs": {
         "nixpkgs": [
@@ -249,11 +267,11 @@
         "nixpkgs-stable": "nixpkgs-stable"
       },
       "locked": {
-        "lastModified": 1728345710,
+        "lastModified": 1725201042,
-        "narHash": "sha256-lpunY1+bf90ts+sA2/FgxVNIegPDKCpEoWwOPu4ITTQ=",
+        "narHash": "sha256-lj5pxOwidP0W//E7IvyhbhXrnEUW99I07+QpERnzTS4=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "06535d0e3d0201e6a8080dd32dbfde339b94f01b",
+        "rev": "5db5921e40ae382d6716dce591ea23b0a39d96f7",
         "type": "github"
       },
       "original": {
@@ -261,6 +279,21 @@
         "repo": "sops-nix",
         "type": "github"
       }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
     }
   },
   "root": "root",

flake.nix

@@ -23,8 +23,8 @@
     nix-gitea-themes.url = "git+https://git.pvv.ntnu.no/oysteikt/nix-gitea-themes.git";
     nix-gitea-themes.inputs.nixpkgs.follows = "nixpkgs";
 
-    greg-ng.url = "git+https://git.pvv.ntnu.no/Projects/greg-ng.git";
+    grzegorz.url = "git+https://git.pvv.ntnu.no/Projects/grzegorz.git";
-    greg-ng.inputs.nixpkgs.follows = "nixpkgs";
+    grzegorz.inputs.nixpkgs.follows = "nixpkgs";
     grzegorz-clients.url = "git+https://git.pvv.ntnu.no/Projects/grzegorz-clients.git";
     grzegorz-clients.inputs.nixpkgs.follows = "nixpkgs";
 
@@ -57,7 +57,7 @@
         rec {
           system = "x86_64-linux";
           specialArgs = {
-            inherit unstablePkgs inputs;
+            inherit nixpkgs-unstable inputs;
             values = import ./values.nix;
           };
 
@@ -116,20 +116,14 @@
 
       brzeczyszczykiewicz = stableNixosConfig "brzeczyszczykiewicz" {
         modules = [
+          inputs.grzegorz.nixosModules.grzegorz-kiosk
           inputs.grzegorz-clients.nixosModules.grzegorz-webui
-          inputs.greg-ng.nixosModules.default
-        ];
-        overlays = [
-          inputs.greg-ng.overlays.default
         ];
       };
       georg = stableNixosConfig "georg" {
         modules = [
+          inputs.grzegorz.nixosModules.grzegorz-kiosk
           inputs.grzegorz-clients.nixosModules.grzegorz-webui
-          inputs.greg-ng.nixosModules.default
-        ];
-        overlays = [
-          inputs.greg-ng.overlays.default
         ];
       };
       kvernberg = stableNixosConfig "kvernberg" {

hosts/bekkalokk/configuration.nix

@@ -16,7 +16,6 @@
     ./services/vaultwarden.nix
     ./services/webmail
     ./services/website
-    ./services/well-known
   ];
 
   sops.defaultSopsFile = ../../secrets/bekkalokk/bekkalokk.yaml;

hosts/bekkalokk/services/gitea/default.nix

@@ -104,30 +104,6 @@ in {
         ENABLE_FEDERATED_AVATAR = false;
       };
       actions.ENABLED = true;
-      ui = {
-        REACTIONS = lib.concatStringsSep "," [
-          "+1"
-          "-1"
-          "laugh"
-          "confused"
-          "heart"
-          "hooray"
-          "rocket"
-          "eyes"
-          "100"
-          "anger"
-          "astonished"
-          "no_good"
-          "ok_hand"
-          "pensive"
-          "pizza"
-          "point_up"
-          "sob"
-          "skull"
-          "upside_down_face"
-          "shrug"
-        ];
-      };
       "ui.meta".DESCRIPTION = "Bokstavelig talt programvareverkstedet";
     };
   };

hosts/bekkalokk/services/webmail/roundcube.nix

@@ -6,11 +6,6 @@ let
   domain = "webmail.pvv.ntnu.no";
 in
 {
-  sops.secrets."roundcube/postgres_password" = {
-    owner = "nginx";
-    group = "nginx";
-  };
-
   services.roundcube = {
     enable = true;
 
@@ -25,11 +20,6 @@ in
     maxAttachmentSize = 20;
     hostName = "roundcubeplaceholder.example.com";
 
-    database = {
-      host = "postgres.pvv.ntnu.no";
-      passwordFile = config.sops.secrets."roundcube/postgres_password".path;
-    };
-
     extraConfig = ''
       $config['enable_installer'] = false;
       $config['default_host'] = "ssl://imap.pvv.ntnu.no";

hosts/bekkalokk/services/website/default.nix

@@ -116,6 +116,16 @@ in {
       "/drift".return = "301 https://wiki.pvv.ntnu.no/wiki/Drift";
       "/diverse/abuse.php".return = "301 https://wiki.pvv.ntnu.no/wiki/CERT/Abuse";
       "/nerds/".return = "301 https://wiki.pvv.ntnu.no/wiki/Nerdepizza";
+
+      # Proxy the matrix well-known files
+      # Host has be set before proxy_pass
+      # The header must be set so nginx on the other side routes it to the right place
+      "^~ /.well-known/matrix/" = {
+        extraConfig = ''
+          proxy_set_header Host matrix.pvv.ntnu.no;
+          proxy_pass https://matrix.pvv.ntnu.no/.well-known/matrix/;
+        '';
+      };
     };
   };
 }

hosts/bekkalokk/services/website/fetch-gallery.nix

@@ -62,33 +62,6 @@ in {
       WorkingDirectory = galleryDir;
       User = config.services.pvv-nettsiden.user;
       Group = config.services.pvv-nettsiden.group;
-
-      AmbientCapabilities = [ "" ];
-      CapabilityBoundingSet = [ "" ];
-      DeviceAllow = [ "" ];
-      LockPersonality = true;
-      MemoryDenyWriteExecute = true;
-      NoNewPrivileges = true; # disable for third party rotate scripts
-      PrivateDevices = true;
-      PrivateNetwork = true; # disable for mail delivery
-      PrivateTmp = true;
-      ProtectClock = true;
-      ProtectControlGroups = true;
-      ProtectHome = true; # disable for userdir logs
-      ProtectHostname = true;
-      ProtectKernelLogs = true;
-      ProtectKernelModules = true;
-      ProtectKernelTunables = true;
-      ProtectProc = "invisible";
-      ProtectSystem = "full";
-      RestrictNamespaces = true;
-      RestrictRealtime = true;
-      RestrictSUIDSGID = true; # disable for creating setgid directories
-      SocketBindDeny = [ "any" ];
-      SystemCallArchitectures = "native";
-      SystemCallFilter = [
-        "@system-service"
-      ];
     };
   };
 }

hosts/bekkalokk/services/well-known/default.nix

@@ -1,18 +0,0 @@
-{ ... }:
-{
-  services.nginx.virtualHosts."www.pvv.ntnu.no".locations = {
-    "^~ /.well-known/" = {
-      alias = (toString ./root) + "/";
-    };
-
-    # Proxy the matrix well-known files
-    # Host has be set before proxy_pass
-    # The header must be set so nginx on the other side routes it to the right place
-    "^~ /.well-known/matrix/" = {
-      extraConfig = ''
-        proxy_set_header Host matrix.pvv.ntnu.no;
-        proxy_pass https://matrix.pvv.ntnu.no/.well-known/matrix/;
-      '';
-    };
-  };
-}

hosts/bekkalokk/services/well-known/root/autoconfig/mail/config-v1.1.xml

@@ -1,31 +0,0 @@
-<?xml version="1.0"?>
-<clientConfig version="1.1">
-  <emailProvider id="pvv.ntnu.no">
-    <domain>pvv.ntnu.no</domain>
-    <domain>pvv.org</domain>
-
-    <displayName>Programvareverkstedet</displayName>
-
-    <incomingServer type="imap">
-      <hostname>imap.pvv.ntnu.no</hostname>
-      <port>993</port>
-      <socketType>SSL</socketType>
-      <username>%EMAILLOCALPART%</username>
-      <authentication>password-cleartext</authentication>
-    </incomingServer>
-
-    <outgoingServer type="smtp">
-      <hostname>smtp.pvv.ntnu.no</hostname>
-      <port>587</port>
-      <socketType>STARTTLS</socketType>
-      <username>%EMAILLOCALPART%</username>
-      <authentication>password-cleartext</authentication>
-      <useGlobalPreferredServer>true</useGlobalPreferredServer>
-    </outgoingServer>
-
-    <documentation url="https://www.pvv.ntnu.no/pvv/Drift/Mail/IMAP_POP3">
-       <descr lang="en">Setup programvareverkstedet email user with IMAP or POP3</descr>
-       <descr lang="nb">Sett opp programvareverkstedet email bruker med IMAP eller POP3</descr>
-    </documentation>
-  </emailProvider>
-</clientConfig>

hosts/bekkalokk/services/well-known/root/security.txt

@@ -1,12 +0,0 @@
-Contact: mailto:drift@pvv.ntnu.no
-Contact: mailto:cert@pvv.ntnu.no
-# drift@pvv.ntnu.no is read by more people and have a quicker reaction time,
-# but cert@pvv.ntnu.no can be used for more severe issues.
-
-Preferred-Languages: no, en
-
-Expires: 2032-12-31T23:59:59.000Z
-# This file was last updated 2024-09-14.
-
-# You can find a wikipage for our security policies at:
-# https://wiki.pvv.ntnu.no/wiki/CERT

hosts/bicep/services/matrix/default.nix

@@ -10,7 +10,6 @@
     ./mjolnir.nix
 
     ./discord.nix
-    ./hookshot
   ];
 
 

hosts/bicep/services/matrix/discord.nix

@@ -6,42 +6,15 @@ in
 {
   users.groups.keys-matrix-registrations = { };
 
-  sops.secrets."matrix/discord/as_token" = {
+  sops.secrets."matrix/registrations/mx-puppet-discord" = {
     sopsFile = ../../../../secrets/bicep/matrix.yaml;
-    key = "discord/as_token";
+    key = "registrations/mx-puppet-discord";
-  };
-  sops.secrets."matrix/discord/hs_token" = {
-    sopsFile = ../../../../secrets/bicep/matrix.yaml;
-    key = "discord/hs_token";
-  };
-
-  sops.templates."discord-registration.yaml" = {
     owner = config.users.users.matrix-synapse.name;
     group = config.users.groups.keys-matrix-registrations.name;
-    content = ''
-      as_token: "${config.sops.placeholder."matrix/discord/as_token"}"
-      hs_token: "${config.sops.placeholder."matrix/discord/hs_token"}"
-      id: discord-puppet
-      namespaces:
-        users:
-          - exclusive: true
-            regex: '@_discordpuppet_.*'
-        rooms: []
-        aliases:
-          - exclusive: true
-            regex: '#_discordpuppet_.*'
-      protocols: []
-      rate_limited: false
-      sender_localpart: _discordpuppet_bot
-      url: 'http://localhost:8434'
-      de.sorunome.msc2409.push_ephemeral: true
-    '';
   };
 
   systemd.services.mx-puppet-discord = {
-    serviceConfig.SupplementaryGroups = [
+    serviceConfig.SupplementaryGroups = [ config.users.groups.keys-matrix-registrations.name ];
-      config.users.groups.keys-matrix-registrations.name
-    ];
   };
 
 
@@ -56,16 +29,11 @@ in
     relay.whitelist = [ ".*" ];
     selfService.whitelist = [ "@danio:pvv\\.ntnu\\.no" "@dandellion:dodsorf\\.as" ];
   };
-  services.mx-puppet-discord.serviceDependencies = [
+  services.mx-puppet-discord.serviceDependencies = [ "matrix-synapse.target" "nginx.service" ];
-    "matrix-synapse.target"
-    "nginx.service"
-  ];
 
 
   services.matrix-synapse-next.settings = {
-    app_service_config_files = [
+    app_service_config_files = [ config.sops.secrets."matrix/registrations/mx-puppet-discord".path ];
-      config.sops.templates."discord-registration.yaml".path
-    ];
     use_appservice_legacy_authorization = true;
   };
 

hosts/bicep/services/matrix/hookshot/default.nix

@@ -1,139 +0,0 @@
-{ config, lib, unstablePkgs, inputs, ... }:
-
-let
-  cfg = config.services.matrix-hookshot;
-  webhookListenAddress = "127.0.0.1";
-  webhookListenPort = 8435;
-in
-{
-  imports = [
-    ./module.nix
-  ];
-
-  sops.secrets."matrix/hookshot/as_token" = {
-    sopsFile = ../../../../../secrets/bicep/matrix.yaml;
-    key = "hookshot/as_token";
-  };
-  sops.secrets."matrix/hookshot/hs_token" = {
-    sopsFile = ../../../../../secrets/bicep/matrix.yaml;
-    key = "hookshot/hs_token";
-  };
-
-  sops.templates."hookshot-registration.yaml" = {
-    owner = config.users.users.matrix-synapse.name;
-    group = config.users.groups.keys-matrix-registrations.name;
-    content = ''
-      id: matrix-hookshot
-      as_token: "${config.sops.placeholder."matrix/hookshot/as_token"}"
-      hs_token: "${config.sops.placeholder."matrix/hookshot/hs_token"}"
-      namespaces:
-        rooms: []
-        users:
-          - regex: "@_webhooks_.*:pvv.ntnu.no"
-            exclusive: true
-          - regex: "@bot_feeds:pvv.ntnu.no"
-            exclusive: true
-        aliases: []
-
-      sender_localpart: hookshot
-      url: "http://${cfg.settings.bridge.bindAddress}:${toString cfg.settings.bridge.port}"
-      rate_limited: false
-
-      # If enabling encryption
-      de.sorunome.msc2409.push_ephemeral: true
-      push_ephemeral: true
-      org.matrix.msc3202: true
-    '';
-  };
-
-  systemd.services.matrix-hookshot = {
-    serviceConfig.SupplementaryGroups = [
-      config.users.groups.keys-matrix-registrations.name
-    ];
-  };
-
-  services.matrix-hookshot = {
-    enable = true;
-    package = unstablePkgs.matrix-hookshot;
-    registrationFile = config.sops.templates."hookshot-registration.yaml".path;
-    settings = {
-      bridge = {
-        bindAddress = "127.0.0.1";
-        domain = "pvv.ntnu.no";
-        url = "https://matrix.pvv.ntnu.no";
-        mediaUrl = "https://matrix.pvv.ntnu.no";
-        port = 9993;
-      };
-      listeners = [
-        {
-          bindAddress = webhookListenAddress;
-          port = webhookListenPort;
-          resources = [
-            "webhooks"
-            # "metrics"
-            # "provisioning"
-            "widgets"
-          ];
-        }
-      ];
-      generic = {
-        enabled = true;
-        outbound = true;
-        urlPrefix = "https://hookshot.pvv.ntnu.no/webhook/";
-        userIdPrefix = "_webhooks_";
-        allowJsTransformationFunctions = false;
-        waitForComplete = false;
-      };
-      feeds = {
-        enabled = true;
-        pollIntervalSeconds = 600;
-      };
-      
-      serviceBots = [
-        { localpart = "bot_feeds";
-          displayname = "Aya";
-          avatar = ./feeds.png;
-          prefix = "!aya";
-          service = "feeds";
-        }
-      ];
-
-      permissions = [
-        # Users of the PVV Server
-        { actor = "pvv.ntnu.no";
-          services = [ { service = "*"; level = "commands"; } ];
-        }
-        # Members of Medlem space (for people with their own hs)
-        { actor = "!pZOTJQinWyyTWaeOgK:pvv.ntnu.no";
-          services = [ { service = "*"; level = "commands"; } ];
-        }
-        # Members of Drift
-        { actor = "!eYgeufLrninXxQpYml:pvv.ntnu.no";
-          services = [ { service = "*"; level = "admin"; } ];
-        }
-        # Dan bootstrap
-        { actor = "@dandellion:dodsorf.as";
-          services = [ { service = "*"; level = "admin"; } ];
-        }
-      ];
-    };
-  };
-
-  services.matrix-hookshot.serviceDependencies = [
-    "matrix-synapse.target"
-    "nginx.service"
-  ];
-
-  services.matrix-synapse-next.settings = {
-    app_service_config_files = [
-      config.sops.templates."hookshot-registration.yaml".path
-    ];
-  };
-
-  services.nginx.virtualHosts."hookshot.pvv.ntnu.no" = {
-    enableACME = true;
-    locations."/" = {
-      proxyPass = "http://${webhookListenAddress}:${toString webhookListenPort}";
-    };
-  };
-}

hosts/bicep/services/matrix/hookshot/module.nix

@@ -1,127 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}:
-let
-  cfg = config.services.matrix-hookshot;
-  settingsFormat = pkgs.formats.yaml { };
-  configFile = settingsFormat.generate "matrix-hookshot-config.yml" cfg.settings;
-in
-{
-  options = {
-    services.matrix-hookshot = {
-      enable = lib.mkEnableOption "matrix-hookshot, a bridge between Matrix and project management services";
-
-      package = lib.mkPackageOption pkgs "matrix-hookshot" { };
-
-      registrationFile = lib.mkOption {
-        type = lib.types.path;
-        description = ''
-          Appservice registration file.
-          As it contains secret tokens, you may not want to add this to the publicly readable Nix store.
-        '';
-        example = lib.literalExpression ''
-          pkgs.writeText "matrix-hookshot-registration" \'\'
-            id: matrix-hookshot
-            as_token: aaaaaaaaaa
-            hs_token: aaaaaaaaaa
-            namespaces:
-              rooms: []
-              users:
-                - regex: "@_webhooks_.*:foobar"
-                  exclusive: true
-
-            sender_localpart: hookshot
-            url: "http://localhost:9993"
-            rate_limited: false
-            \'\'
-        '';
-      };
-
-      settings = lib.mkOption {
-        description = ''
-          {file}`config.yml` configuration as a Nix attribute set.
-
-          For details please see the [documentation](https://matrix-org.github.io/matrix-hookshot/latest/setup/sample-configuration.html).
-        '';
-        example = {
-          bridge = {
-            domain = "example.com";
-            url = "http://localhost:8008";
-            mediaUrl = "https://example.com";
-            port = 9993;
-            bindAddress = "127.0.0.1";
-          };
-          listeners = [
-            {
-              port = 9000;
-              bindAddress = "0.0.0.0";
-              resources = [ "webhooks" ];
-            }
-            {
-              port = 9001;
-              bindAddress = "localhost";
-              resources = [
-                "metrics"
-                "provisioning"
-              ];
-            }
-          ];
-        };
-        default = { };
-        type = lib.types.submodule {
-          freeformType = settingsFormat.type;
-          options = {
-            passFile = lib.mkOption {
-              type = lib.types.path;
-              default = "/var/lib/matrix-hookshot/passkey.pem";
-              description = ''
-                A passkey used to encrypt tokens stored inside the bridge.
-                File will be generated if not found.
-              '';
-            };
-          };
-        };
-      };
-
-      serviceDependencies = lib.mkOption {
-        type = with lib.types; listOf str;
-        default = lib.optional config.services.matrix-synapse.enable config.services.matrix-synapse.serviceUnit;
-        defaultText = lib.literalExpression ''
-          lib.optional config.services.matrix-synapse.enable config.services.matrix-synapse.serviceUnit
-        '';
-        description = ''
-          List of Systemd services to require and wait for when starting the application service,
-          such as the Matrix homeserver if it's running on the same host.
-        '';
-      };
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    systemd.services.matrix-hookshot = {
-      description = "a bridge between Matrix and multiple project management services";
-
-      wantedBy = [ "multi-user.target" ];
-      wants = [ "network-online.target" ] ++ cfg.serviceDependencies;
-      after = [ "network-online.target" ] ++ cfg.serviceDependencies;
-
-      preStart = ''
-        if [ ! -f '${cfg.settings.passFile}' ]; then
-          mkdir -p $(dirname '${cfg.settings.passFile}')
-          ${pkgs.openssl}/bin/openssl genpkey -out '${cfg.settings.passFile}' -outform PEM -algorithm RSA -pkeyopt rsa_keygen_bits:4096
-        fi
-      '';
-
-      serviceConfig = {
-        Type = "simple";
-        Restart = "always";
-        ExecStart = "${cfg.package}/bin/matrix-hookshot ${configFile} ${cfg.registrationFile}";
-      };
-    };
-  };
-
-  meta.maintainers = with lib.maintainers; [ flandweber ];
-}

hosts/ildkule/hardware-configuration.nix

@@ -3,14 +3,7 @@
   imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
   boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "xen_blkfront" "vmw_pvscsi" ];
   boot.initrd.kernelModules = [ "nvme" ];
-  fileSystems."/" = {
+  fileSystems."/" = { device = "/dev/vda1"; fsType = "ext4"; };
-    device = "/dev/disk/by-uuid/e35eb4ce-aac3-4f91-8383-6e7cd8bbf942";
-    fsType = "ext4";
-  };
-  fileSystems."/data" = {
-    device = "/dev/disk/by-uuid/0a4c1234-02d3-4b53-aeca-d95c4c8d534b";
-    fsType = "ext4";
-  };
 
   networking.useDHCP = lib.mkDefault true;
 }

hosts/ildkule/services/monitoring/loki.nix

@@ -2,7 +2,6 @@
 
 let
   cfg = config.services.loki;
-  stateDir = "/data/monitoring/loki";
 in {
   services.loki = {
     enable = true;
@@ -17,7 +16,7 @@ in {
       ingester = {
         wal = {
           enabled = true;
-          dir = "${stateDir}/wal";
+          dir = "/var/lib/loki/wal";
         };
         lifecycler = {
           address = "127.0.0.1";
@@ -49,12 +48,12 @@ in {
 
       storage_config = {
         boltdb_shipper = {
-          active_index_directory = "${stateDir}/boltdb-shipper-index";
+          active_index_directory = "/var/lib/loki/boltdb-shipper-index";
-          cache_location = "${stateDir}/boltdb-shipper-cache";
+          cache_location = "/var/lib/loki/boltdb-shipper-cache";
           cache_ttl = "24h";
         };
         filesystem = {
-          directory = "${stateDir}/chunks";
+          directory = "/var/lib/loki/chunks";
         };
       };
 
@@ -65,14 +64,14 @@ in {
       };
 
       compactor = {
-        working_directory = "${stateDir}/compactor";
+        working_directory = "/var/lib/loki/compactor";
       };
 
       # ruler = {
       #   storage = {
       #     type = "local";
       #     local = {
-      #       directory = "${stateDir}/rules";
+      #       directory = "/var/lib/loki/rules";
       #     };
       #   };
       #   rule_path = "/etc/loki/rules";

hosts/ildkule/services/monitoring/prometheus/default.nix

@@ -1,6 +1,4 @@
-{ config, ... }: let
+{ config, ... }: {
-  stateDir = "/data/monitoring/prometheus";
-in {
   imports = [
     ./gitea.nix
     ./matrix-synapse.nix
@@ -12,15 +10,9 @@ in {
 
   services.prometheus = {
     enable = true;
-
     listenAddress = "127.0.0.1";
     port = 9001;
 
     ruleFiles = [ rules/synapse-v2.rules ];
   };
-
-  fileSystems."/var/lib/prometheus2" = {
-    device = stateDir;
-    options = [ "bind" ];
-  };
 }

hosts/ildkule/services/monitoring/uptime-kuma.nix

@@ -2,7 +2,6 @@
 let
   cfg = config.services.uptime-kuma;
   domain = "status.pvv.ntnu.no";
-  stateDir = "/data/monitoring/uptime-kuma";
 in {
   services.uptime-kuma = {
     enable = true;
@@ -18,9 +17,4 @@ in {
     kTLS = true;
     locations."/".proxyPass = "http://${cfg.settings.HOST}:${cfg.settings.PORT}";
   };
-
-  fileSystems."/var/lib/uptime-kuma" = {
-    device = stateDir;
-    options = [ "bind" ];
-  };
 }

hosts/kvernberg/services/pvvvvvv/modules/libeufin/bank.nix

@@ -1,93 +0,0 @@
-{
-  lib,
-  config,
-  options,
-  ...
-}:
-{
-  imports = [ (import ./common.nix "bank") ];
-
-  options.services.libeufin.bank = {
-    initialAccounts = lib.mkOption {
-      type = lib.types.listOf lib.types.attrs;
-      description = ''
-        Accounts to enable before the bank service starts.
-
-        This is mainly needed for the nexus currency conversion
-        since the exchange's bank account is expected to be already
-        registered.
-
-        Don't forget to change the account passwords afterwards.
-      '';
-      default = [ ];
-    };
-
-    settings = lib.mkOption {
-      description = ''
-        Configuration options for the libeufin bank system config file.
-
-        For a list of all possible options, please see the man page [`libeufin-bank.conf(5)`](https://docs.taler.net/manpages/libeufin-bank.conf.5.html)
-      '';
-      type = lib.types.submodule {
-        inherit (options.services.libeufin.settings.type.nestedTypes) freeformType;
-        options = {
-          libeufin-bank = {
-            CURRENCY = lib.mkOption {
-              type = lib.types.str;
-              description = ''
-                The currency under which the libeufin-bank should operate.
-
-                This defaults to the GNU taler module's currency for convenience
-                but if you run libeufin-bank separately from taler, you must set
-                this yourself.
-              '';
-            };
-            PORT = lib.mkOption {
-              type = lib.types.port;
-              default = 8082;
-              description = ''
-                The port on which libeufin-bank should listen.
-              '';
-            };
-            SUGGESTED_WITHDRAWAL_EXCHANGE = lib.mkOption {
-              type = lib.types.str;
-              default = "https://exchange.demo.taler.net/";
-              description = ''
-                Exchange that is suggested to wallets when withdrawing.
-
-                Note that, in order for withdrawals to work, your libeufin-bank
-                must be able to communicate with and send money etc. to the bank
-                at which the exchange used for withdrawals has its bank account.
-
-                If you also have your own bank and taler exchange network, you
-                probably want to set one of your exchange's url here instead of
-                the demo exchange.
-
-                This setting must always be set in order for the Android app to
-                not crash during the withdrawal process but the exchange to be
-                used can always be changed in the app.
-              '';
-            };
-          };
-          libeufin-bankdb-postgres = {
-            CONFIG = lib.mkOption {
-              type = lib.types.str;
-              description = ''
-                The database connection string for the libeufin-bank database.
-              '';
-            };
-          };
-        };
-      };
-    };
-  };
-
-  config = {
-    services.libeufin.bank.settings.libeufin-bank.CURRENCY = lib.mkIf (
-      config.services.taler.enable && (config.services.taler.settings.taler ? CURRENCY)
-    ) config.services.taler.settings.taler.CURRENCY;
-
-    services.libeufin.bank.settings.libeufin-bankdb-postgres.CONFIG = lib.mkIf config.services.libeufin.bank.createLocalDatabase "postgresql:///libeufin-bank";
-  };
-}
-

hosts/kvernberg/services/pvvvvvv/modules/libeufin/common.nix

@@ -1,156 +0,0 @@
-# TODO: create a common module generator for Taler and Libeufin?
-libeufinComponent:
-{
-  lib,
-  pkgs,
-  config,
-  ...
-}:
-{
-  options.services.libeufin.${libeufinComponent} = {
-    enable = lib.mkEnableOption "libeufin core banking system and web interface";
-    package = lib.mkPackageOption pkgs "libeufin" { };
-    debug = lib.mkEnableOption "debug logging";
-    createLocalDatabase = lib.mkEnableOption "automatic creation of a local postgres database";
-    openFirewall = lib.mkOption {
-      type = lib.types.bool;
-      default = false;
-      description = "Whether to open ports in the firewall";
-    };
-  };
-
-  config =
-    let
-      cfgMain = config.services.libeufin;
-      cfg = cfgMain.${libeufinComponent};
-
-      serviceName = "libeufin-${libeufinComponent}";
-
-      isNexus = libeufinComponent == "nexus";
-
-      # get database name from config
-      # TODO: should this always be the same db? In which case, should this be an option directly under `services.libeufin`?
-      dbName =
-        lib.removePrefix "postgresql:///"
-          cfg.settings."libeufin-${libeufinComponent}db-postgres".CONFIG;
-
-      bankPort = cfg.settings."${if isNexus then "nexus-httpd" else "libeufin-bank"}".PORT;
-    in
-    lib.mkIf cfg.enable {
-      services.libeufin.settings = cfg.settings;
-
-      # TODO add system-libeufin.slice?
-      systemd.services = {
-        # Main service
-        "${serviceName}" = {
-          serviceConfig = {
-            DynamicUser = true;
-            ExecStart =
-              let
-                args = lib.cli.toGNUCommandLineShell { } {
-                  c = cfgMain.configFile;
-                  L = if cfg.debug then "debug" else null;
-                };
-              in
-              "${lib.getExe' cfg.package "libeufin-${libeufinComponent}"} serve ${args}";
-            Restart = "on-failure";
-            RestartSec = "10s";
-          };
-          requires = [ "libeufin-dbinit.service" ];
-          after = [ "libeufin-dbinit.service" ];
-          wantedBy = [ "multi-user.target" ];
-        };
-
-        # Database Initialisation
-        libeufin-dbinit =
-          let
-            dbScript = pkgs.writers.writeText "libeufin-db-permissions.sql" ''
-              GRANT SELECT,INSERT,UPDATE,DELETE ON ALL TABLES IN SCHEMA libeufin_bank TO "${serviceName}";
-              GRANT SELECT,INSERT,UPDATE,DELETE ON ALL TABLES IN SCHEMA libeufin_nexus TO "${serviceName}";
-              GRANT USAGE ON SCHEMA libeufin_bank TO "${serviceName}";
-              GRANT USAGE ON SCHEMA libeufin_nexus TO "${serviceName}";
-            '';
-
-            # Accounts to be created after the bank database initialization.
-            #
-            # For example, if the bank's currency conversion is enabled, it's
-            # required that the exchange account is registered before the
-            # service starts.
-            initialAccountRegistration = lib.concatMapStringsSep "\n" (
-              account:
-              let
-                args = lib.cli.toGNUCommandLineShell { } {
-                  c = cfgMain.configFile;
-                  inherit (account) username password name;
-                  payto_uri = "payto://x-taler-bank/bank:${toString bankPort}/${account.username}?receiver-name=${account.name}";
-                  exchange = lib.toLower account.username == "exchange";
-                };
-              in
-              "${lib.getExe' cfg.package "libeufin-bank"} create-account ${args}"
-            ) cfg.initialAccounts;
-
-            args = lib.cli.toGNUCommandLineShell { } {
-              c = cfgMain.configFile;
-              L = if cfg.debug then "debug" else null;
-            };
-          in
-          {
-            path = [ config.services.postgresql.package ];
-            serviceConfig = {
-              Type = "oneshot";
-              DynamicUser = true;
-              StateDirectory = "libeufin-dbinit";
-              StateDirectoryMode = "0750";
-              User = dbName;
-            };
-            script = lib.optionalString cfg.enable ''
-              ${lib.getExe' cfg.package "libeufin-${libeufinComponent}"} dbinit ${args}
-            '';
-            # Grant DB permissions after schemas have been created
-            postStart =
-              ''
-                psql -U "${dbName}" -f "${dbScript}"
-              ''
-              + lib.optionalString ((!isNexus) && (cfg.initialAccounts != [ ])) ''
-                # only register initial accounts once
-                if [ ! -e /var/lib/libeufin-dbinit/init ]; then
-                  ${initialAccountRegistration}
-                  touch /var/lib/libeufin-dbinit/init
-                  echo "Bank initialisation complete"
-                fi
-              '';
-            requires = lib.optionals cfg.createLocalDatabase [ "postgresql.service" ];
-            after = [ "network.target" ] ++ lib.optionals cfg.createLocalDatabase [ "postgresql.service" ];
-          };
-      };
-
-      networking.firewall = lib.mkIf cfg.openFirewall {
-        allowedTCPPorts = [
-          bankPort
-        ];
-      };
-
-      environment.systemPackages = [ cfg.package ];
-
-      services.postgresql = lib.mkIf cfg.createLocalDatabase {
-        enable = true;
-        ensureDatabases = [ dbName ];
-        ensureUsers = [
-          { name = serviceName; }
-          {
-            name = dbName;
-            ensureDBOwnership = true;
-          }
-        ];
-      };
-
-      assertions = [
-        {
-          assertion =
-            cfg.createLocalDatabase || (cfg.settings."libeufin-${libeufinComponent}db-postgres" ? CONFIG);
-          message = "Libeufin ${libeufinComponent} database is not configured.";
-        }
-      ];
-
-    };
-}

hosts/kvernberg/services/pvvvvvv/modules/libeufin/module.nix

@@ -1,29 +0,0 @@
-{
-  lib,
-  pkgs,
-  config,
-  ...
-}:
-
-let
-  cfg = config.services.libeufin;
-  settingsFormat = pkgs.formats.ini { };
-in
-
-{
-  options.services.libeufin = {
-    configFile = lib.mkOption {
-      internal = true;
-      default = settingsFormat.generate "generated-libeufin.conf" cfg.settings;
-    };
-    settings = lib.mkOption {
-      description = "Global configuration options for the libeufin bank system config file.";
-      type = lib.types.submodule { freeformType = settingsFormat.type; };
-      default = { };
-    };
-  };
-
-  config = lib.mkIf (cfg.bank.enable || cfg.nexus.enable) {
-    environment.etc."libeufin/libeufin.conf".source = cfg.configFile;
-  };
-}

hosts/kvernberg/services/pvvvvvv/modules/libeufin/nexus.nix

@@ -1,127 +0,0 @@
-{
-  lib,
-  config,
-  options,
-  ...
-}:
-{
-  imports = [ (import ./common.nix "nexus") ];
-
-  options.services.libeufin.nexus.settings = lib.mkOption {
-    description = ''
-      Configuration options for the libeufin nexus config file.
-      For a list of all possible options, please see the man page [`libeufin-nexus.conf(5)`](https://docs.taler.net/manpages/libeufin-nexus.conf.5.html)
-    '';
-    type = lib.types.submodule {
-      inherit (options.services.libeufin.settings.type.nestedTypes) freeformType;
-      options = {
-        nexus-ebics = {
-          # Mandatory configuration values
-          # https://docs.taler.net/libeufin/nexus-manual.html#setting-up-the-ebics-subscriber
-          # https://docs.taler.net/libeufin/setup-ebics-at-postfinance.html
-          CURRENCY = lib.mkOption {
-            description = "Name of the fiat currency.";
-            type = lib.types.nonEmptyStr;
-            example = "CHF";
-          };
-          HOST_BASE_URL = lib.mkOption {
-            description = "URL of the EBICS server.";
-            type = lib.types.nonEmptyStr;
-            example = "https://ebics.postfinance.ch/ebics/ebics.aspx";
-          };
-          BANK_DIALECT = lib.mkOption {
-            description = ''
-              Name of the following combination: EBICS version and ISO20022
-              recommendations that Nexus would honor in the communication with the
-              bank.
-              Currently only the "postfinance" or "gls" value is supported.
-            '';
-            type = lib.types.enum [
-              "postfinance"
-              "gls"
-            ];
-            example = "postfinance";
-          };
-          HOST_ID = lib.mkOption {
-            description = "Name of the EBICS host.";
-            type = lib.types.nonEmptyStr;
-            example = "PFEBICS";
-          };
-          USER_ID = lib.mkOption {
-            description = ''
-              User ID of the EBICS subscriber.
-              This value must be assigned by the bank after having activated a new EBICS subscriber.
-            '';
-            type = lib.types.nonEmptyStr;
-            example = "PFC00563";
-          };
-          PARTNER_ID = lib.mkOption {
-            description = ''
-              Partner ID of the EBICS subscriber.
-              This value must be assigned by the bank after having activated a new EBICS subscriber.
-            '';
-            type = lib.types.nonEmptyStr;
-            example = "PFC00563";
-          };
-          IBAN = lib.mkOption {
-            description = "IBAN of the bank account that is associated with the EBICS subscriber.";
-            type = lib.types.nonEmptyStr;
-            example = "CH7789144474425692816";
-          };
-          BIC = lib.mkOption {
-            description = "BIC of the bank account that is associated with the EBICS subscriber.";
-            type = lib.types.nonEmptyStr;
-            example = "POFICHBEXXX";
-          };
-          NAME = lib.mkOption {
-            description = "Legal entity that is associated with the EBICS subscriber.";
-            type = lib.types.nonEmptyStr;
-            example = "John Smith S.A.";
-          };
-          BANK_PUBLIC_KEYS_FILE = lib.mkOption {
-            type = lib.types.path;
-            default = "/var/lib/libeufin-nexus/bank-ebics-keys.json";
-            description = ''
-              Filesystem location where Nexus should store the bank public keys.
-            '';
-          };
-          CLIENT_PRIVATE_KEYS_FILE = lib.mkOption {
-            type = lib.types.path;
-            default = "/var/lib/libeufin-nexus/client-ebics-keys.json";
-            description = ''
-              Filesystem location where Nexus should store the subscriber private keys.
-            '';
-          };
-        };
-        nexus-httpd = {
-          PORT = lib.mkOption {
-            type = lib.types.port;
-            default = 8084;
-            description = ''
-              The port on which libeufin-bank should listen.
-            '';
-          };
-        };
-        libeufin-nexusdb-postgres = {
-          CONFIG = lib.mkOption {
-            type = lib.types.str;
-            description = ''
-              The database connection string for the libeufin-nexus database.
-            '';
-          };
-        };
-      };
-    };
-  };
-
-  config =
-    let
-      cfgMain = config.services.libeufin;
-      cfg = config.services.libeufin.nexus;
-    in
-    lib.mkIf cfg.enable {
-      services.libeufin.nexus.settings.libeufin-nexusdb-postgres.CONFIG = lib.mkIf (
-        cfgMain.bank.enable && cfgMain.bank.createLocalDatabase
-      ) "postgresql:///libeufin-bank";
-    };
-}

hosts/kvernberg/services/pvvvvvv/modules/module-list.nix

@@ -1,10 +0,0 @@
-{
-  imports = [
-    ./libeufin/bank.nix
-    ./libeufin/module.nix
-    ./libeufin/nexus.nix
-    ./taler/exchange.nix
-    ./taler/merchant.nix
-    ./taler/module.nix
-  ];
-}

hosts/kvernberg/services/pvvvvvv/modules/taler/common.nix

@@ -1,117 +0,0 @@
-# TODO: create a common module generator for Taler and Libeufin?
-{
-  talerComponent ? "",
-  servicesDB ? [ ],
-  servicesNoDB ? [ ],
-  ...
-}:
-{
-  lib,
-  pkgs,
-  config,
-  ...
-}:
-let
-  cfg = cfgTaler.${talerComponent};
-  cfgTaler = config.services.taler;
-  settingsFormat = pkgs.formats.ini { };
-
-  services = servicesDB ++ servicesNoDB;
-
-  dbName = "taler-${talerComponent}-httpd";
-  groupName = "taler-${talerComponent}-services";
-
-  inherit (cfgTaler) runtimeDir;
-in
-{
-  options = {
-    services.taler.${talerComponent} = {
-      enable = lib.mkEnableOption "the GNU Taler ${talerComponent}";
-      package = lib.mkPackageOption pkgs "taler-${talerComponent}" { };
-      # TODO: make option accept multiple debugging levels?
-      debug = lib.mkEnableOption "debug logging";
-      openFirewall = lib.mkOption {
-        type = lib.types.bool;
-        default = false;
-        description = "Whether to open ports in the firewall";
-      };
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    services.taler.enable = cfg.enable;
-
-    systemd.services = lib.mergeAttrsList [
-      # Main services
-      (lib.genAttrs (map (n: "taler-${talerComponent}-${n}") services) (name: {
-        serviceConfig = {
-          DynamicUser = true;
-          User = name;
-          Group = groupName;
-          ExecStart = toString [
-            (lib.getExe' cfg.package name)
-            "-c /etc/taler/taler.conf"
-            (lib.optionalString cfg.debug " -L debug")
-          ];
-          RuntimeDirectory = name;
-          StateDirectory = name;
-          CacheDirectory = name;
-          ReadWritePaths = [ runtimeDir ];
-          Restart = "always";
-          RestartSec = "10s";
-        };
-        requires = [ "taler-${talerComponent}-dbinit.service" ];
-        after = [ "taler-${talerComponent}-dbinit.service" ];
-        wantedBy = [ "multi-user.target" ]; # TODO slice?
-      }))
-      # Database Initialisation
-      {
-        "taler-${talerComponent}-dbinit" = {
-          path = [ config.services.postgresql.package ];
-          serviceConfig = {
-            Type = "oneshot";
-            DynamicUser = true;
-            User = dbName;
-            Restart = "on-failure";
-            RestartSec = "5s";
-          };
-          requires = [ "postgresql.service" ];
-          after = [ "postgresql.service" ];
-        };
-      }
-    ];
-
-    users.groups.${groupName} = { };
-    systemd.tmpfiles.settings = {
-      "10-taler-${talerComponent}" = {
-        "${runtimeDir}" = {
-          d = {
-            group = groupName;
-            user = "nobody";
-            mode = "070";
-          };
-        };
-      };
-    };
-
-    networking.firewall = lib.mkIf cfg.openFirewall {
-      allowedTCPPorts = [ cfg.settings."${talerComponent}".PORT ];
-    };
-
-    environment.systemPackages = [ cfg.package ];
-
-    services.taler.includes = [ "/etc/taler/conf.d/${talerComponent}.conf" ];
-    environment.etc."taler/conf.d/${talerComponent}.conf".source = settingsFormat.generate "generated-taler.conf" cfg.settings;
-
-    services.postgresql = {
-      enable = true;
-      ensureDatabases = [ dbName ];
-      ensureUsers = map (service: { name = "taler-${talerComponent}-${service}"; }) servicesDB ++ [
-        {
-          name = dbName;
-          ensureDBOwnership = true;
-        }
-      ];
-    };
-  };
-}

hosts/kvernberg/services/pvvvvvv/modules/taler/exchange.nix

@@ -1,143 +0,0 @@
-{
-  lib,
-  config,
-  options,
-  pkgs,
-  ...
-}:
-
-let
-  cfg = cfgTaler.exchange;
-  cfgTaler = config.services.taler;
-
-  talerComponent = "exchange";
-
-  # https://docs.taler.net/taler-exchange-manual.html#services-users-groups-and-file-system-hierarchy
-  servicesDB = [
-    "httpd"
-    "aggregator"
-    "closer"
-    "wirewatch"
-  ];
-
-  servicesNoDB = [
-    "secmod-cs"
-    "secmod-eddsa"
-    "secmod-rsa"
-  ];
-in
-
-{
-  imports = [
-    (import ./common.nix { inherit talerComponent servicesDB servicesNoDB; })
-  ];
-
-  options.services.taler.exchange = {
-    settings = lib.mkOption {
-      description = ''
-        Configuration options for the taler exchange config file.
-        For a list of all possible options, please see the man page [`taler.conf(5)`](https://docs.taler.net/manpages/taler.conf.5.html#exchange-options)
-      '';
-      type = lib.types.submodule {
-        inherit (options.services.taler.settings.type.nestedTypes) freeformType;
-        options = {
-          # TODO: do we want this to be a sub-attribute or only define the exchange set of options here
-          exchange = {
-            AML_THRESHOLD = lib.mkOption {
-              type = lib.types.str;
-              default = "${cfgTaler.settings.taler.CURRENCY}:1000000";
-              defaultText = "1000000 in {option}`CURRENCY`";
-              description = "Monthly transaction volume until an account is considered suspicious and flagged for AML review.";
-            };
-            DB = lib.mkOption {
-              type = lib.types.str;
-              internal = true;
-              default = "postgres";
-            };
-            MASTER_PUBLIC_KEY = lib.mkOption {
-              type = lib.types.str;
-              default = throw ''
-                You must provide `MASTER_PUBLIC_KEY` with the public part of your master key.
-                This will be used by the auditor service to get information about the exchange.
-                For more information, see https://docs.taler.net/taler-auditor-manual.html#initial-configuration
-                To generate this key, you must run `taler-exchange-offline setup`. It will print the public key.
-              '';
-              defaultText = "None, you must set this yourself.";
-              description = "Used by the exchange to verify information signed by the offline system.";
-            };
-            PORT = lib.mkOption {
-              type = lib.types.port;
-              default = 8081;
-              description = "Port on which the HTTP server listens.";
-            };
-          };
-          exchangedb-postgres = {
-            CONFIG = lib.mkOption {
-              type = lib.types.str;
-              internal = true;
-              default = "postgres:///taler-exchange-httpd";
-              description = "Database connection URI.";
-            };
-          };
-        };
-      };
-      default = { };
-    };
-    denominationConfig = lib.mkOption {
-      type = lib.types.lines;
-      defaultText = "None, you must set this yourself.";
-      example = ''
-        [COIN-KUDOS-n1-t1718140083]
-        VALUE = KUDOS:0.1
-        DURATION_WITHDRAW = 7 days
-        DURATION_SPEND = 2 years
-        DURATION_LEGAL = 6 years
-        FEE_WITHDRAW = KUDOS:0
-        FEE_DEPOSIT = KUDOS:0.1
-        FEE_REFRESH = KUDOS:0
-        FEE_REFUND = KUDOS:0
-        RSA_KEYSIZE = 2048
-        CIPHER = RSA
-      '';
-      description = ''
-        This option configures the cash denomination for the coins that the exchange offers.
-        For more information, consult the [upstream docs](https://docs.taler.net/taler-exchange-manual.html#coins-denomination-keys).
-        You can either write these manually or you can use the `taler-harness deployment gen-coin-config`
-        command to generate it.
-        Warning: Do not modify existing denominations after deployment.
-        Please see the upstream docs for how to safely do that.
-      '';
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    services.taler.includes = [
-      (pkgs.writers.writeText "exchange-denominations.conf" cfg.denominationConfig)
-    ];
-
-    systemd.services.taler-exchange-wirewatch = {
-      requires = [ "taler-exchange-httpd.service" ];
-      after = [ "taler-exchange-httpd.service" ];
-    };
-
-    # Taken from https://docs.taler.net/taler-exchange-manual.html#exchange-database-setup
-    # TODO: Why does aggregator need DELETE?
-    systemd.services."taler-${talerComponent}-dbinit".script =
-      let
-        deletePerm = name: lib.optionalString (name == "aggregator") ",DELETE";
-        dbScript = pkgs.writers.writeText "taler-exchange-db-permissions.sql" (
-          lib.pipe servicesDB [
-            (map (name: ''
-              GRANT SELECT,INSERT,UPDATE${deletePerm name} ON ALL TABLES IN SCHEMA exchange TO "taler-exchange-${name}";
-              GRANT USAGE ON SCHEMA exchange TO "taler-exchange-${name}";
-            ''))
-            lib.concatStrings
-          ]
-        );
-      in
-      ''
-        ${lib.getExe' cfg.package "taler-exchange-dbinit"}
-        psql -U taler-exchange-httpd -f ${dbScript}
-      '';
-  };
-}

hosts/kvernberg/services/pvvvvvv/modules/taler/merchant.nix

@@ -1,108 +0,0 @@
-{
-  lib,
-  config,
-  options,
-  pkgs,
-  ...
-}:
-let
-  cfg = cfgTaler.merchant;
-  cfgTaler = config.services.taler;
-
-  talerComponent = "merchant";
-
-  # https://docs.taler.net/taler-merchant-manual.html#launching-the-backend
-  servicesDB = [
-    "httpd"
-    "webhook"
-    "wirewatch"
-    "depositcheck"
-    "exchange"
-  ];
-in
-{
-  imports = [
-    (import ./common.nix { inherit talerComponent servicesDB; })
-  ];
-
-  options.services.taler.merchant = {
-    settings = lib.mkOption {
-      description = ''
-        Configuration options for the taler merchant config file.
-        For a list of all possible options, please see the man page [`taler.conf(5)`](https://docs.taler.net/manpages/taler.conf.5.html#merchant-options)
-      '';
-      type = lib.types.submodule {
-        inherit (options.services.taler.settings.type.nestedTypes) freeformType;
-        options = {
-          # TODO: do we want this to be a sub-attribute or only define the merchant set of options here
-          merchant = {
-            DB = lib.mkOption {
-              type = lib.types.str;
-              internal = true;
-              default = "postgres";
-              description = "Plugin to use for the database.";
-            };
-            PORT = lib.mkOption {
-              type = lib.types.port;
-              default = 8083;
-              description = "Port on which the HTTP server listens.";
-            };
-            SERVE = lib.mkOption {
-              type = lib.types.str;
-              default = "tcp";
-              description = ''
-                Whether the HTTP server should listen on a UNIX domain socket ("unix") or on a TCP socket ("tcp").
-              '';
-            };
-            LEGAL_PRESERVATION = lib.mkOption {
-              type = lib.types.str;
-              internal = true;
-              default = "10 years";
-              description = "How long to keep data in the database for tax audits after the transaction has completed.";
-            };
-          };
-          merchantdb-postgres = {
-            CONFIG = lib.mkOption {
-              type = lib.types.str;
-              internal = true;
-              default = "postgres:///taler-${talerComponent}-httpd";
-              description = "Database connection URI.";
-            };
-            SQL_DIR = lib.mkOption {
-              type = lib.types.str;
-              internal = true;
-              default = "${cfg.package}/share/taler/sql/merchant/";
-              description = "The location for the SQL files to setup the database tables.";
-            };
-          };
-        };
-      };
-      default = { };
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    systemd.services.taler-merchant-depositcheck = {
-      # taler-merchant-depositcheck needs its executable is in the PATH
-      # NOTE: couldn't use `lib.getExe` to only get that single executable
-      path = [ cfg.package ];
-    };
-
-    systemd.services."taler-${talerComponent}-dbinit".script =
-      let
-        # NOTE: not documented, but is necessary
-        dbScript = pkgs.writers.writeText "taler-merchant-db-permissions.sql" (
-          lib.concatStrings (
-            map (name: ''
-              GRANT SELECT,INSERT,UPDATE,DELETE ON ALL TABLES IN SCHEMA merchant TO "taler-merchant-${name}";
-              GRANT USAGE ON SCHEMA merchant TO "taler-merchant-${name}";
-            '') servicesDB
-          )
-        );
-      in
-      ''
-        ${lib.getExe' cfg.package "taler-merchant-dbinit"}
-        psql -U taler-${talerComponent}-httpd -f ${dbScript}
-      '';
-  };
-}

hosts/kvernberg/services/pvvvvvv/modules/taler/module.nix

@@ -1,89 +0,0 @@
-{
-  lib,
-  pkgs,
-  config,
-  ...
-}:
-
-let
-  cfg = config.services.taler;
-  settingsFormat = pkgs.formats.ini { };
-in
-
-{
-  # TODO turn this into a generic taler-like service thingy?
-  options.services.taler = {
-    enable = lib.mkEnableOption "the GNU Taler system" // lib.mkOption { internal = true; };
-    includes = lib.mkOption {
-      type = lib.types.listOf lib.types.path;
-      default = [ ];
-      description = ''
-        Files to include into the config file using Taler's `@inline@` directive.
-        This allows including arbitrary INI files, including imperatively managed ones.
-      '';
-    };
-    settings = lib.mkOption {
-      description = ''
-        Global configuration options for the taler config file.
-        For a list of all possible options, please see the man page [`taler.conf(5)`](https://docs.taler.net/manpages/taler.conf.5.html)
-      '';
-      type = lib.types.submodule {
-        freeformType = settingsFormat.type;
-        options = {
-          taler = {
-            CURRENCY = lib.mkOption {
-              type = lib.types.nonEmptyStr;
-              description = ''
-                The currency which taler services will operate with. This cannot be changed later.
-              '';
-            };
-            CURRENCY_ROUND_UNIT = lib.mkOption {
-              type = lib.types.str;
-              default = "${cfg.settings.taler.CURRENCY}:0.01";
-              defaultText = lib.literalExpression ''
-                "''${config.services.taler.settings.taler.CURRENCY}:0.01"
-              '';
-              description = ''
-                Smallest amount in this currency that can be transferred using the underlying RTGS.
-                You should probably not touch this.
-              '';
-            };
-          };
-        };
-      };
-      default = { };
-    };
-    runtimeDir = lib.mkOption {
-      type = lib.types.str;
-      default = "/run/taler-system-runtime/";
-      description = ''
-        Runtime directory shared between the taler services.
-        Crypto helpers put their sockets here for instance and the httpd
-        connects to them.
-      '';
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    services.taler.settings.PATHS = {
-      TALER_DATA_HOME = "\${STATE_DIRECTORY}/";
-      TALER_CACHE_HOME = "\${CACHE_DIRECTORY}/";
-      TALER_RUNTIME_DIR = cfg.runtimeDir;
-    };
-
-    environment.etc."taler/taler.conf".source =
-      let
-        includes = pkgs.writers.writeText "includes.conf" (
-          lib.concatStringsSep "\n" (map (include: "@inline@ ${include}") cfg.includes)
-        );
-        generatedConfig = settingsFormat.generate "generated-taler.conf" cfg.settings;
-      in
-      pkgs.runCommand "taler.conf" { } ''
-        cat ${includes} > $out
-        echo >> $out
-        echo >> $out
-        cat ${generatedConfig} >> $out
-      '';
-
-  };
-}

modules/grzegorz.nix

@@ -1,26 +1,31 @@
 {config, lib, pkgs, ...}:
 let
-  grg = config.services.greg-ng;
+  grg = config.services.grzegorz;
   grgw = config.services.grzegorz-webui;
 in {
-  services.greg-ng = {
+  services.pipewire.enable = true;
-    enable = true;
+  services.pipewire.alsa.enable = true;
-    settings.host = "localhost";
+  services.pipewire.alsa.support32Bit = true;
-    settings.port = 31337;
+  services.pipewire.pulse.enable = true;
-    enableSway = true;
+
-    enablePipewire = true;
+  users.users.pvv = {
+    isNormalUser = true;
+    description = "pvv";
   };
 
-  services.grzegorz-webui = {
+  services.grzegorz.enable = true;
-    enable = true;
+  services.grzegorz.listenAddr = "localhost";
-    listenAddr = "localhost";
+  services.grzegorz.listenPort = 31337;
-    listenPort = 42069;
+
-    listenWebsocketPort = 42042;
+  services.grzegorz-webui.enable = true;
-    hostName = "${config.networking.fqdn}";
+  services.grzegorz-webui.listenAddr = "localhost";
-    apiBase = "http://${grg.settings.host}:${toString grg.settings.port}/api";
+  services.grzegorz-webui.listenPort = 42069;
-  };
+  services.grzegorz-webui.listenWebsocketPort = 42042;
+  services.grzegorz-webui.hostName = "${config.networking.fqdn}";
+  services.grzegorz-webui.apiBase = "http://${toString grg.listenAddr}:${toString grg.listenPort}/api";
 
   services.nginx.enable = true;
+
   services.nginx.virtualHosts."${config.networking.fqdn}" = {
     forceSSL = true;
     enableACME = true;
@@ -35,19 +40,20 @@ in {
     '';
 
     locations."/" = {
-      proxyPass = "http://${grgw.listenAddr}:${toString grgw.listenPort}";
+      proxyPass = "http://localhost:${builtins.toString config.services.grzegorz-webui.listenPort}";
     };
     # https://github.com/rawpython/remi/issues/216
     locations."/websocket" = {
-      proxyPass = "http://${grgw.listenAddr}:${toString grgw.listenWebsocketPort}";
+      proxyPass = "http://localhost:${builtins.toString config.services.grzegorz-webui.listenWebsocketPort}";
       proxyWebsockets = true;
     };
     locations."/api" = {
-      proxyPass = "http://${grg.settings.host}:${toString grg.settings.port}";
+      proxyPass = "http://localhost:${builtins.toString config.services.grzegorz.listenPort}";
     };
     locations."/docs" = {
-      proxyPass = "http://${grg.settings.host}:${toString grg.settings.port}";
+      proxyPass = "http://localhost:${builtins.toString config.services.grzegorz.listenPort}";
     };
   };
+
 }
 

secrets/bekkalokk/bekkalokk.yaml

@@ -18,8 +18,6 @@ mediawiki:
         postgres_password: ENC[AES256_GCM,data:FzykBVtJbA+Bey1GE5VqnSuv2GeobH1j,iv:wayQH3+y0FYFkr3JjmulI53SADk0Ikur/2mUS5kFrTk=,tag:d+nQ/se2bDA5aaQfBicnPQ==,type:str]
         cookie_salt: ENC[AES256_GCM,data:BioRPAvL4F9ORBJDFdqHot81RhVpAOf32v1ah3pvOLq8E88bxGyKFQZxAwpIL3UkWQIsWMnEerm5MEMYL1C2OQ==,iv:yMVqiPTQ8hO1IVAax6PIkD0V9YTOEunwDTtnGcmy6Kc=,tag:Z4+bZF4olLlkx7YpXeQiUw==,type:str]
         admin_password: ENC[AES256_GCM,data:4eUXvcO7NLOWke9XShfKzj+x3FvqPONa,iv:3iZ+BTBTZ7yMJ0HT14cEMebKZattWUcYEevRsl/6WOk=,tag:CU0iDhPP2ndztdX5U5A4cw==,type:str]
-roundcube:
-    postgres_password: ENC[AES256_GCM,data:fGHmq6r/ZCeIseHL8/gmm5DfWQYorI3OJq1TW0EHvh7rHL62M4TE+Lrlrmq8AIlmGLSWtO8AQzOP3toxidL6xWX3pcwLxtTefa1gom2oQf6ZL4TbAZLidHksdiro6pWtpMOO66bb8O9eXvZmns4=,iv:Irnb2/bgx8WilDyRLleWfo6HHafZ+vlDEwxIcgm1f18=,tag:eTNBUELmLwO7DsQN9CLX7Q==,type:str]
 idp:
     cookie_salt: ENC[AES256_GCM,data:cyV6HDCPHKQIa8T1+rFBFh6EuHtG5B508lg6uFYENK7qVpYuiTUIokdVQhY8SRLs2mECx/ampgnUHxCRB/Cc/A==,iv:QRrRUhzRQrLkmg38rrYtCEfF8U4/7ZHZUDSEq++BlbI=,tag:fLqFSLd+CKqJvmCh1fx8vg==,type:str]
     admin_password: ENC[AES256_GCM,data:Vf33Oenk6x6BIij1uW8RQDjTPcKhUVYA,iv:RNeyCNpTAYdBPrZwE3Y6CCjoAML/3XUvjfJCrr06IEU=,tag:zVOrx1oXnEyr/VwFCFaCDQ==,type:str]
@@ -97,8 +95,8 @@ sops:
             UHpLRkdQTnhkeGlWVG9VS1hkWktyckEKAdwnA9URLYZ50lMtXrU9Q09d0L3Zfsyr
             4UsvjjdnFtsXwEZ9ZzOQrpiN0Oz24s3csw5KckDni6kslaloJZsLGg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-10-12T21:56:27Z"
+    lastmodified: "2024-09-01T01:33:50Z"
-    mac: ENC[AES256_GCM,data:bZ1BbVC6D+B6SFze2ReeCUcQamK/O14zH3YxCjWBwMC++w3niIiEx4Bq7Ulci5yuMld0luVsfUzHoqFN/+zvZbV2rGVk8lVRiTrpFoSZ78aUUgeHG9ROLXsR7T7rVhLWbl86y1G5LcKws7G55V0wAh6f58WjYYzwR8fnBmfW1Ko=,iv:7xtMdtXQB9uZirE/CkUSmeu0qnG++R7DUR7zn/Bo0lM=,tag:DH/BJPpAp//quDqKNXyHcg==,type:str]
+    mac: ENC[AES256_GCM,data:PkcOD9hJWD5tILO9PuZkOgIoujt4q2qtHBB9KF8ikrNKo0yw24Jf1ceI5/+BHCxhdi8sF4qQM/zty61zqwNaBsvrsLUkdWDwUDsuJQa1KKZiCEZPqYBc+qGIQ5wNPsU2zJ0c8+wU8H0LtGqKOH9GmaQtTdm0Rt2IcexV823uTjQ=,iv:GYTI85OgqnN8iUc6OOXO7Sz2XIthWJtz8zwMuWutEYs=,tag:2rhfhjXXzZLzoVlkINo0ZQ==,type:str]
     pgp:
         - created_at: "2024-08-04T00:03:28Z"
           enc: |-
@@ -121,4 +119,4 @@ sops:
             -----END PGP MESSAGE-----
           fp: F7D37890228A907440E1FD4846B9228E814A2AAC
     unencrypted_suffix: _unencrypted
-    version: 3.9.1
+    version: 3.9.0

secrets/bicep/matrix.yaml

@@ -6,12 +6,8 @@ coturn:
     static-auth-secret: ENC[AES256_GCM,data:y5cG/LyrorkDH+8YrgcV7DY=,iv:ca90q2J3+NOy51mUBy4TMKfYMgWL4hxWDdsKIuxRBgU=,tag:hpFCns1lpi07paHyGB7tGQ==,type:str]
 mjolnir:
     access_token: ENC[AES256_GCM,data:ERFqZjK7MRD0xWt91FNCIxP1YC6Qj54QgnckHlCTtcQVLWaM1h2h9lHS+K8=,iv:1d7vmFkXAPcsmumzlmOT31amdrKLWtL5sJiS8G9g+LE=,tag:2l0vWzJ6P12ofuBdf5CCWw==,type:str]
-discord:
+registrations:
-    as_token: ENC[AES256_GCM,data:cnPZjBbODZUA1p0kLNeWpKh1oGkDPxDw/g7163XnoRCIgpqk,iv:Uu4L36uDPMBgzdXE2Lt9U0qrBSl3Xuufh1313BD8B/U=,tag:nTm6s7IGd4vNzZ95mfxDpA==,type:str]
+    mx-puppet-discord: ENC[AES256_GCM,data:FleyXxgOmc05nTP6M2DBJlacufN3p/05eZm4kB8+K4ci0k24o3zli988wlM/kyeZmxu4pgQlJ3lNLte4uip2hBXHWG5t5Ldzmr7bNCUD+r7nM+I1lfNkrDROPZ54bHysmn9O5CHpEa16rSo6RJgncIPqsLJxTwjC7qZlkOpzqvMhkq/MHCVOpvg0M/6AUR+AlSZoggujBMoXLznQNQapN13foEsbuo/QxjszM/ObGmhYMVyaS+TDBXzQLA8Yuj50Q/gZCIINWZ4G2qmgsGxxNR4I+usUQml/jxCtIXS4zn/ettXfL9G4Fdm2F9u1v11DehtTGa5xoxDq94M9rIxOqeJpvgEQEyyKAyFUIrlINfGl7tAj4Zu7+9Z8JTRAnppjM1q8iInwn/Z2L9KgB0YFi/Go1whgXly+TH6hpreo7m5klXV/ff/aV3ghOgFCGA8nBrZFqE8Uw268q9tV1s1dxCb6TbpGf19V5c9MD6BsCIVeoq+j9I/I8iZpzg2Reb4IlHhMDwbwsL2w2ks30wiZ9XO/CFrXDY4uBlI=,iv:3vvkGvldS8Raibg6tzlV8VY1O9NCLxSuNX/lwi1QgiA=,tag:D/noIsE3xlOiYM6Pk+cc8Q==,type:str]
-    hs_token: ENC[AES256_GCM,data:UzcaNsJtJPKvFT4gQDNfat0nmyJzmQ6OcSI73pANibzOVrWl,iv:ujgRM2jb1rbeloPB4UPLBEvQ7uue4a+bHiqsZAHIqtk=,tag:uIfuaTWSTeVvpQx5o28HPA==,type:str]
-hookshot:
-    as_token: ENC[AES256_GCM,data:L4vEw5r4RhcgritOeDTLHN5E/dM=,iv:pC8BLzxf6NaVAGsotoq6chOceBVdMLvrsQn1LGw9H9w=,tag:SI3CDFHAvgQZEvf/oms3EA==,type:str]
-    hs_token: ENC[AES256_GCM,data:2ufSJfYzzAB5IO+edwKSra5d/+M=,iv:cmTycGzNL+IeRRKZGbkhTtiksYTtbxED0k0B5haFw7k=,tag:FmWe5sGi9rlapUeAE6lKvg==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -72,8 +68,8 @@ sops:
             WEh5NFN6SFF1TlltdWFWTGw4MHRHUkUKrKIvC87xjEmwxPQhH8dN+ZuaJTCgPY28
             pR62KxmoKFICLTHPpYP3euiAx5M9BWvgvCnA/US/5klpk8MtlreNFA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-10-13T23:30:01Z"
+    lastmodified: "2024-09-27T04:34:10Z"
-    mac: ENC[AES256_GCM,data:vdsAZmg7gPqzeucBhLhPemtRVkcxRecIdB6PXZ4paU+Uv5UorBKcTZ3jseN2cLi6ot3ycTIm+UI6uhlCy87vAJVynVJhuJS+ICFRS2+DfoVyuttLjZQGC2sr3+dEBHxIH7sZJSo9PIzbIWw3qHrpOPAZj0//1pFyp/k15k3vidM=,iv:jWtV+WAPt08lgdrVvtXOl35rDB4QflkZWuGBW1+ESyw=,tag:YxSHncZZOAW5uDxXtb/krw==,type:str]
+    mac: ENC[AES256_GCM,data:FACb/Ow4s6dqjghAphCa1ZwIwX7+CRhIudQ9UlDtxB+4Bdpa/T0l73oaMa5lmmyCEyuVM3HXOFcm4I/urLtvaN+QQoqRYnUHKkdNYFhayGpeckZUNu7JWsFsQWk0kfKZEDqHIBoee7xBVzrVtRJeKVWv+JPlch4NVOakm3MitZA=,iv:rvve5MRDpDD/FblN8KaQ2PvxsYZSQPSw5oDfyko/Nvs=,tag:vuB0jYmO6AiNtZuSJ3ipBQ==,type:str]
     pgp:
         - created_at: "2024-08-04T00:03:46Z"
           enc: |-

users/alfhj.nix

@@ -1,13 +0,0 @@
-{pkgs, ...}:
-
-{
-  users.users.alfhj = {
-    isNormalUser = true;
-    extraGroups = [ "wheel" ];
-    shell = pkgs.zsh;
-    openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMCAYE0U3sFizm/NSbKCs0jEhZ1mpAWPcijFevejiFL1 alfhj"
-    ];
-  };
-}
-

users/danio.nix

@@ -3,7 +3,7 @@
 {
   users.users.danio = {
     isNormalUser = true;
-    extraGroups = [ "drift" "nix-builder-users" "wheel" ];
+    extraGroups = [ "drift" "nix-builder-users" ];
     shell = pkgs.zsh;
 
     openssh.authorizedKeys.keys = [