Maybe this sets up the exchange idk....

No more ../../../../../../

.sops.yaml

@@ -13,6 +13,7 @@ keys:
   - &host_ildkule age1x28hmzvuv6f2n66c0jtqcca3h9rput8d7j5uek6jcpx8n9egd52sqpejq0
   - &host_bekkalokk age12nj59tguy9wg882updc2vjdusx5srnxmjyfaqve4zx6jnnsaw3qsyjq6zd
   - &host_bicep age1sl43gc9cw939z5tgha2lpwf0xxxgcnlw7w4xem4sqgmt2pt264vq0dmwx2
+  - &host_kvernberg age19rlntxt0m27waa0n288g9wgpksa6ndlzz8eneeqya7w3zd7may0sqzhcvz
 
 creation_rules:
   # Global secrets
@@ -78,3 +79,9 @@ creation_rules:
       - *user_pederbs_bjarte
       pgp:
       - *user_oysteikt
+  
+  - path_regex: secrets/kvernberg/[^/]+$
+    key_groups:
+      - age:
+          - *host_kvernberg
+          - *user_danio

base/default.nix

@@ -1,9 +1,9 @@
-{ pkgs, lib, ... }:
+{ pkgs, lib, fp, ... }:
 
 {
   imports = [
-    ../users
+    (fp /users)
-    ../modules/snakeoil-certs.nix
+    (fp /modules/snakeoil-certs.nix)
 
     ./networking.nix
     ./nix.nix

base/services/auto-upgrade.nix

@@ -7,7 +7,7 @@
       # --update-input is deprecated since nix 2.22, and removed in lix 2.90
       # https://git.lix.systems/lix-project/lix/issues/400
       "--refresh"
-      "--override-input" "nixpkgs" "github:nixos/nixpkgs/nixos-24.05-small"
+      "--override-input" "nixpkgs" "github:NixOS/nixpkgs/refs/pull/332699/merge"
       "--override-input" "nixpkgs-unstable" "github:nixos/nixpkgs/nixos-unstable-small"
       "--no-write-lock-file"
     ];

base/services/logrotate.nix

@@ -31,7 +31,6 @@
       ProtectSystem = "full";
       RestrictNamespaces = true;
       RestrictRealtime = true;
-      RestrictSUIDSGID = true; # disable for creating setgid directories
       SocketBindDeny = [ "any" ];
       SystemCallArchitectures = "native";
       SystemCallFilter = [
@@ -39,4 +38,4 @@
       ];
     };
   };
-}
+}

flake.lock

@@ -7,11 +7,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1729281548,
+        "lastModified": 1731746438,
-        "narHash": "sha256-MuojlSnwAJAwfhgmW8ZtZrwm2Sko4fqubCvReqbUzYw=",
+        "narHash": "sha256-f3SSp1axoOk0NAI7oFdRzbxG2XPBSIXC+/DaAXnvS1A=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "a6a3179ddf396dfc28a078e2f169354d0c137125",
+        "rev": "cb64993826fa7a477490be6ccb38ba1fa1e18fa8",
         "type": "github"
       },
       "original": {
@@ -119,27 +119,27 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1729307008,
+        "lastModified": 1731779898,
-        "narHash": "sha256-QUvb6epgKi9pCu9CttRQW4y5NqJ+snKr1FZpG/x3Wtc=",
+        "narHash": "sha256-oxxCrYZM0WNRoaokDyVXcPIlTc8Z2yX4QjKbgXGI3IM=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "a9b86fc2290b69375c5542b622088eb6eca2a7c3",
+        "rev": "9972661139e27eed0237df4dde34839e09028cd5",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-24.05-small",
+        "ref": "refs/pull/332699/merge",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
     "nixpkgs-stable": {
       "locked": {
-        "lastModified": 1728156290,
+        "lastModified": 1730602179,
-        "narHash": "sha256-uogSvuAp+1BYtdu6UWuObjHqSbBohpyARXDWqgI12Ss=",
+        "narHash": "sha256-efgLzQAWSzJuCLiCaQUCDu4NudNlHdg2NzGLX5GYaEY=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "17ae88b569bb15590549ff478bab6494dde4a907",
+        "rev": "3c2f1c4ca372622cb2f9de8016c9a0b1cbd0f37c",
         "type": "github"
       },
       "original": {
@@ -151,11 +151,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1729308112,
+        "lastModified": 1731745710,
-        "narHash": "sha256-Ap+cPeiluam2KFZO+OWuFTl/IkIJfyGYGMgkT2pVCRY=",
+        "narHash": "sha256-SVeiClbgqL071JpAspOu0gCkPSAL51kSIRwo4C/pghA=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "61253596816c4cd65e2a0f474cbc0ac0c6e0f7cf",
+        "rev": "dfaa4cb76c2d450d8f396bb6b9f43cede3ade129",
         "type": "github"
       },
       "original": {
@@ -249,11 +249,11 @@
         "nixpkgs-stable": "nixpkgs-stable"
       },
       "locked": {
-        "lastModified": 1728345710,
+        "lastModified": 1731748189,
-        "narHash": "sha256-lpunY1+bf90ts+sA2/FgxVNIegPDKCpEoWwOPu4ITTQ=",
+        "narHash": "sha256-Zd/Uukvpcu26M6YGhpbsgqm6LUSLz+Q8mDZ5LOEGdiE=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "06535d0e3d0201e6a8080dd32dbfde339b94f01b",
+        "rev": "d2bd7f433b28db6bc7ae03d5eca43564da0af054",
         "type": "github"
       },
       "original": {

flake.nix

@@ -2,7 +2,7 @@
   description = "PVV System flake";
 
   inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.05-small"; # remember to also update the url in base/services/auto-upgrade.nix
+    nixpkgs.url = "github:NixOS/nixpkgs/refs/pull/332699/merge"; # remember to also update the url in base/services/auto-upgrade.nix
     nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixos-unstable-small";
 
     sops-nix.url = "github:Mic92/sops-nix";
@@ -59,6 +59,7 @@
           specialArgs = {
             inherit unstablePkgs inputs;
             values = import ./values.nix;
+            fp = path: ./${path};
           };
 
           modules = [

hosts/bekkalokk/configuration.nix

@@ -1,10 +1,10 @@
-{ pkgs, values, ... }:
+{ fp, pkgs, values, ... }:
 {
   imports = [
     ./hardware-configuration.nix
 
-    ../../base
+    (fp /base)
-    ../../misc/metrics-exporters.nix
+    (fp /misc/metrics-exporters.nix)
 
     ./services/bluemap/default.nix
     ./services/gitea/default.nix
@@ -19,7 +19,7 @@
     ./services/well-known
   ];
 
-  sops.defaultSopsFile = ../../secrets/bekkalokk/bekkalokk.yaml;
+  sops.defaultSopsFile = fp /secrets/bekkalokk/bekkalokk.yaml;
   sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
   sops.age.keyFile = "/var/lib/sops-nix/key.txt";
   sops.age.generateKey = true;

hosts/bekkalokk/services/gitea/default.nix

@@ -1,4 +1,4 @@
-{ config, values, pkgs, lib, ... }:
+{ config, values, fp, pkgs, lib, ... }:
 let
   cfg = config.services.gitea;
   domain = "git.pvv.ntnu.no";
@@ -173,8 +173,8 @@ in {
     };
 
     script = let
-      logo-svg = ../../../../assets/logo_blue_regular.svg;
+      logo-svg = fp /assets/logo_blue_regular.svg;
-      logo-png = ../../../../assets/logo_blue_regular.png;
+      logo-png = fp /assets/logo_blue_regular.png;
       extraLinks = pkgs.writeText "gitea-extra-links.tmpl" ''
         <a class="item" href="https://www.pvv.ntnu.no/">PVV</a>
         <a class="item" href="https://wiki.pvv.ntnu.no/">Wiki</a>

hosts/bekkalokk/services/mediawiki/default.nix

@@ -1,4 +1,4 @@
-{ pkgs, lib, config, values, pkgs-unstable, ... }: let
+{ pkgs, lib, fp, config, values, pkgs-unstable, ... }: let
   cfg = config.services.mediawiki;
 
   # "mediawiki"
@@ -210,8 +210,8 @@ in {
         '';
       };
 
-      "= /PNG/PVV-logo.svg".alias = ../../../../assets/logo_blue_regular.svg;
+      "= /PNG/PVV-logo.svg".alias = fp /assets/logo_blue_regular.svg;
-      "= /PNG/PVV-logo.png".alias = ../../../../assets/logo_blue_regular.png;
+      "= /PNG/PVV-logo.png".alias = fp /assets/logo_blue_regular.png;
       "= /favicon.ico".alias = pkgs.runCommandLocal "mediawiki-favicon.ico" {
         buildInputs = with pkgs; [ imagemagick ];
       } ''
@@ -219,7 +219,7 @@ in {
           -resize x64 \
           -gravity center \
           -crop 64x64+0+0 \
-          ${../../../../assets/logo_blue_regular.png} \
+          ${fp /assets/logo_blue_regular.png} \
           -flatten \
           -colors 256 \
           -background transparent \

hosts/bekkalokk/services/webmail/snappymail.nix

@@ -1,8 +1,8 @@
-{ config, lib, pkgs, ... }:
+{ config, lib, fp, pkgs, ... }:
 let
   cfg = config.services.snappymail;
 in {
-  imports = [ ../../../../modules/snappymail.nix ];
+  imports = [ (fp /modules/snappymail.nix) ];
 
   services.snappymail = {
     enable = true;

hosts/bicep/configuration.nix

@@ -1,10 +1,10 @@
-{ pkgs, values, ... }:
+{ fp, pkgs, values, ... }:
 {
   imports = [
     ./hardware-configuration.nix
 
-    ../../base
+    (fp /base)
-    ../../misc/metrics-exporters.nix
+    (fp /misc/metrics-exporters.nix)
     ./services/nginx
 
     ./services/mysql.nix
@@ -15,7 +15,7 @@
     ./services/matrix
   ];
 
-  sops.defaultSopsFile = ../../secrets/bicep/bicep.yaml;
+  sops.defaultSopsFile = fp /secrets/bicep/bicep.yaml;
   sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
   sops.age.keyFile = "/var/lib/sops-nix/key.txt";
   sops.age.generateKey = true;

hosts/bicep/services/calendar-bot.nix

@@ -1,16 +1,16 @@
-{ config, lib, pkgs, ... }:
+{ config, fp, lib, pkgs, ... }:
 let
   cfg = config.services.pvv-calendar-bot;
 in {
   sops.secrets = {
     "calendar-bot/matrix_token" = {
-      sopsFile = ../../../secrets/bicep/bicep.yaml;
+      sopsFile = fp /secrets/bicep/bicep.yaml;
       key = "calendar-bot/matrix_token";
       owner = cfg.user;
       group = cfg.group;
     };
     "calendar-bot/mysql_password" = {
-      sopsFile = ../../../secrets/bicep/bicep.yaml;
+      sopsFile = fp /secrets/bicep/bicep.yaml;
       key = "calendar-bot/mysql_password";
       owner = cfg.user;
       group = cfg.group;

hosts/bicep/services/matrix/coturn.nix

@@ -1,14 +1,14 @@
-{ config, lib, pkgs, secrets, values, ... }:
+{ config, lib, fp, pkgs, secrets, values, ... }:
 
 {
   sops.secrets."matrix/synapse/turnconfig" = {
-    sopsFile = ../../../../secrets/bicep/matrix.yaml;
+    sopsFile = fp /secrets/bicep/matrix.yaml;
     key = "synapse/turnconfig";
     owner = config.users.users.matrix-synapse.name;
     group = config.users.users.matrix-synapse.group;
   };
   sops.secrets."matrix/coturn/static-auth-secret" = {
-    sopsFile = ../../../../secrets/bicep/matrix.yaml;
+    sopsFile = fp /secrets/bicep/matrix.yaml;
     key = "coturn/static-auth-secret";
     owner = config.users.users.turnserver.name;
     group = config.users.users.turnserver.group;

hosts/bicep/services/matrix/discord.nix

@@ -1,4 +1,4 @@
-{ config, lib, ... }:
+{ config, lib, fp, ... }:
 
 let
   cfg = config.services.mx-puppet-discord;
@@ -7,11 +7,11 @@ in
   users.groups.keys-matrix-registrations = { };
 
   sops.secrets."matrix/discord/as_token" = {
-    sopsFile = ../../../../secrets/bicep/matrix.yaml;
+    sopsFile = fp /secrets/bicep/matrix.yaml;
     key = "discord/as_token";
   };
   sops.secrets."matrix/discord/hs_token" = {
-    sopsFile = ../../../../secrets/bicep/matrix.yaml;
+    sopsFile = fp /secrets/bicep/matrix.yaml;
     key = "discord/hs_token";
   };
 

hosts/bicep/services/matrix/hookshot/default.nix

@@ -1,4 +1,4 @@
-{ config, lib, unstablePkgs, inputs, ... }:
+{ config, lib, fp, unstablePkgs, inputs, ... }:
 
 let
   cfg = config.services.matrix-hookshot;
@@ -11,11 +11,11 @@ in
   ];
 
   sops.secrets."matrix/hookshot/as_token" = {
-    sopsFile = ../../../../../secrets/bicep/matrix.yaml;
+    sopsFile = fp /secrets/bicep/matrix.yaml;
     key = "hookshot/as_token";
   };
   sops.secrets."matrix/hookshot/hs_token" = {
-    sopsFile = ../../../../../secrets/bicep/matrix.yaml;
+    sopsFile = fp /secrets/bicep/matrix.yaml;
     key = "hookshot/hs_token";
   };
 

hosts/bicep/services/matrix/mjolnir.nix

@@ -1,8 +1,8 @@
-{ config, lib, ... }:
+{ config, lib, fp, ... }:
 
 {
   sops.secrets."matrix/mjolnir/access_token" = {
-    sopsFile = ../../../../secrets/bicep/matrix.yaml;
+    sopsFile = fp /secrets/bicep/matrix.yaml;
     key = "mjolnir/access_token";
     owner = config.users.users.mjolnir.name;
     group = config.users.users.mjolnir.group;

hosts/bicep/services/matrix/synapse.nix

@@ -1,4 +1,4 @@
-{ config, lib, pkgs, values, inputs, ... }:
+{ config, lib, fp, pkgs, values, inputs, ... }:
 
 let
   cfg = config.services.matrix-synapse-next;
@@ -10,13 +10,13 @@ let
 in {
   sops.secrets."matrix/synapse/signing_key" = {
     key = "synapse/signing_key";
-    sopsFile = ../../../../secrets/bicep/matrix.yaml;
+    sopsFile = fp /secrets/bicep/matrix.yaml;
     owner = config.users.users.matrix-synapse.name;
     group = config.users.users.matrix-synapse.group;
   };
 
   sops.secrets."matrix/synapse/user_registration" = {
-    sopsFile = ../../../../secrets/bicep/matrix.yaml;
+    sopsFile = fp /secrets/bicep/matrix.yaml;
     key = "synapse/signing_key";
     owner = config.users.users.matrix-synapse.name;
     group = config.users.users.matrix-synapse.group;

hosts/bob/configuration.nix

@@ -1,16 +1,16 @@
-{ config, pkgs, values, ... }:
+{ config, fp, pkgs, values, ... }:
 {
   imports = [
       # Include the results of the hardware scan.
       ./hardware-configuration.nix
-      ../../base
+      (fp /base)
-      ../../misc/metrics-exporters.nix
+      (fp /misc/metrics-exporters.nix)
       ./disks.nix
 
-      ../../misc/builder.nix
+      (fp /misc/builder.nix)
     ];
 
-  sops.defaultSopsFile = ../../secrets/bob/bob.yaml;
+  sops.defaultSopsFile = fp /secrets/bob/bob.yaml;
   sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
   sops.age.keyFile = "/var/lib/sops-nix/key.txt";
   sops.age.generateKey = true;

hosts/brzeczyszczykiewicz/configuration.nix

@@ -1,10 +1,10 @@
-{ config, pkgs, values, ... }:
+{ config, fp, pkgs, values, ... }:
 {
   imports = [
       # Include the results of the hardware scan.
       ./hardware-configuration.nix
-      ../../base
+      (fp /base)
-      ../../misc/metrics-exporters.nix
+      (fp /misc/metrics-exporters.nix)
 
       ./services/grzegorz.nix
     ];

hosts/brzeczyszczykiewicz/services/grzegorz.nix

@@ -1,6 +1,6 @@
-{ config, ... }:
+{ config, fp, ... }:
 {
-  imports = [ ../../../modules/grzegorz.nix ];
+  imports = [ (fp /modules/grzegorz.nix) ];
 
   services.nginx.virtualHosts."${config.networking.fqdn}" = {
     serverAliases = [

hosts/georg/configuration.nix

@@ -1,12 +1,12 @@
-{ config, pkgs, values, ... }:
+{ config, fp, pkgs, values, ... }:
 {
   imports = [
       # Include the results of the hardware scan.
       ./hardware-configuration.nix
-      ../../base
+      (fp /base)
-      ../../misc/metrics-exporters.nix
+      (fp /misc/metrics-exporters.nix)
 
-      ../../modules/grzegorz.nix
+      (fp /modules/grzegorz.nix)
     ];
 
   boot.loader.systemd-boot.enable = true;

hosts/ildkule/configuration.nix

@@ -1,16 +1,16 @@
-{ config, pkgs, lib, values, ... }:
+{ config, fp, pkgs, lib, values, ... }:
 {
   imports = [
       # Include the results of the hardware scan.
       ./hardware-configuration.nix
-      ../../base
+      (fp /base)
-      ../../misc/metrics-exporters.nix
+      (fp /misc/metrics-exporters.nix)
 
       ./services/monitoring
       ./services/nginx
     ];
 
-  sops.defaultSopsFile = ../../secrets/ildkule/ildkule.yaml;
+  sops.defaultSopsFile = fp /secrets/ildkule/ildkule.yaml;
   sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
   sops.age.keyFile = "/var/lib/sops-nix/key.txt";
   sops.age.generateKey = true;

hosts/kvernberg/configuration.nix

@@ -1,15 +1,15 @@
-{ config, pkgs, values, ... }:
+{ config, fp, pkgs, values, ... }:
 {
   imports = [
     # Include the results of the hardware scan.
     ./hardware-configuration.nix
-    ../../base
+    (fp /base)
-    ../../misc/metrics-exporters.nix
+    (fp /misc/metrics-exporters.nix)
 
     ./disks.nix
   ];
 
-  sops.defaultSopsFile = ../../secrets/kvernberg/kvernberg.yaml;
+  sops.defaultSopsFile = fp /secrets/kvernberg/kvernberg.yaml;
   sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
   sops.age.keyFile = "/var/lib/sops-nix/key.txt";
   sops.age.generateKey = true;

hosts/kvernberg/services/pvvvvvv/default.nix

@@ -0,0 +1,11 @@
+{
+  imports = [
+    ./exchange.nix
+  ];
+
+  services.taler = {
+    settings = {
+      taler.CURRENCY = "SCHPENN";
+    };
+  };
+}

hosts/kvernberg/services/pvvvvvv/exchange.nix

@@ -0,0 +1,40 @@
+{ config, lib, fp, pkgs, ... }:
+let
+  cfg = config.services.taler;
+  inherit (cfg.settings) CURRENCY;
+
+  sops.secrets.exchange-offline-master = {
+    format = "binary";
+    sopsFile = fp /secrets/kvernberg/exhange-offline-master.priv;
+  };
+
+{
+  
+  services.taler.exchange = {
+    enable = true;
+    debug = true;
+    openFirwall = true;
+    denominationConfig = ''
+      [COIN-${CURRENCY}-k1-1-0]
+      VALUE = ${CURRENCY}:1
+      DURATION_WITHDRAW = 7 days
+      DURATION_SPEND = 1 years
+      DURATION_LEGAL = 3 years
+      FEE_WITHDRAW = ${CURRENCY}:0
+      FEE_DEPOSIT = ${CURRENCY}:0
+      FEE_REFRESH = ${CURRENCY}:0
+      FEE_REFUND = ${CURRENCY}:0
+      RSA_KEYSIZE = 2048
+      CIPHER = RSA
+    '';
+    settings = {
+      exchange = {
+        MASTER_PUBLIC_KEY = "J331T37C8E58P9CVE686P1JFH11DWSRJ3RE4GVDTXKES9M24ERZG";
+        BASE_URL = "http://kvernberg.pvv.ntnu.no:8081/";
+      };
+      exchange-offline = {
+        MASTER_PRIV_FILE = config.sops.secrets.exchange-offline-master.path;
+      };
+    };
+  };
+}

hosts/kvernberg/services/pvvvvvv/modules/libeufin/bank.nix

@@ -1,93 +0,0 @@
-{
-  lib,
-  config,
-  options,
-  ...
-}:
-{
-  imports = [ (import ./common.nix "bank") ];
-
-  options.services.libeufin.bank = {
-    initialAccounts = lib.mkOption {
-      type = lib.types.listOf lib.types.attrs;
-      description = ''
-        Accounts to enable before the bank service starts.
-
-        This is mainly needed for the nexus currency conversion
-        since the exchange's bank account is expected to be already
-        registered.
-
-        Don't forget to change the account passwords afterwards.
-      '';
-      default = [ ];
-    };
-
-    settings = lib.mkOption {
-      description = ''
-        Configuration options for the libeufin bank system config file.
-
-        For a list of all possible options, please see the man page [`libeufin-bank.conf(5)`](https://docs.taler.net/manpages/libeufin-bank.conf.5.html)
-      '';
-      type = lib.types.submodule {
-        inherit (options.services.libeufin.settings.type.nestedTypes) freeformType;
-        options = {
-          libeufin-bank = {
-            CURRENCY = lib.mkOption {
-              type = lib.types.str;
-              description = ''
-                The currency under which the libeufin-bank should operate.
-
-                This defaults to the GNU taler module's currency for convenience
-                but if you run libeufin-bank separately from taler, you must set
-                this yourself.
-              '';
-            };
-            PORT = lib.mkOption {
-              type = lib.types.port;
-              default = 8082;
-              description = ''
-                The port on which libeufin-bank should listen.
-              '';
-            };
-            SUGGESTED_WITHDRAWAL_EXCHANGE = lib.mkOption {
-              type = lib.types.str;
-              default = "https://exchange.demo.taler.net/";
-              description = ''
-                Exchange that is suggested to wallets when withdrawing.
-
-                Note that, in order for withdrawals to work, your libeufin-bank
-                must be able to communicate with and send money etc. to the bank
-                at which the exchange used for withdrawals has its bank account.
-
-                If you also have your own bank and taler exchange network, you
-                probably want to set one of your exchange's url here instead of
-                the demo exchange.
-
-                This setting must always be set in order for the Android app to
-                not crash during the withdrawal process but the exchange to be
-                used can always be changed in the app.
-              '';
-            };
-          };
-          libeufin-bankdb-postgres = {
-            CONFIG = lib.mkOption {
-              type = lib.types.str;
-              description = ''
-                The database connection string for the libeufin-bank database.
-              '';
-            };
-          };
-        };
-      };
-    };
-  };
-
-  config = {
-    services.libeufin.bank.settings.libeufin-bank.CURRENCY = lib.mkIf (
-      config.services.taler.enable && (config.services.taler.settings.taler ? CURRENCY)
-    ) config.services.taler.settings.taler.CURRENCY;
-
-    services.libeufin.bank.settings.libeufin-bankdb-postgres.CONFIG = lib.mkIf config.services.libeufin.bank.createLocalDatabase "postgresql:///libeufin-bank";
-  };
-}
-

hosts/kvernberg/services/pvvvvvv/modules/libeufin/common.nix

@@ -1,156 +0,0 @@
-# TODO: create a common module generator for Taler and Libeufin?
-libeufinComponent:
-{
-  lib,
-  pkgs,
-  config,
-  ...
-}:
-{
-  options.services.libeufin.${libeufinComponent} = {
-    enable = lib.mkEnableOption "libeufin core banking system and web interface";
-    package = lib.mkPackageOption pkgs "libeufin" { };
-    debug = lib.mkEnableOption "debug logging";
-    createLocalDatabase = lib.mkEnableOption "automatic creation of a local postgres database";
-    openFirewall = lib.mkOption {
-      type = lib.types.bool;
-      default = false;
-      description = "Whether to open ports in the firewall";
-    };
-  };
-
-  config =
-    let
-      cfgMain = config.services.libeufin;
-      cfg = cfgMain.${libeufinComponent};
-
-      serviceName = "libeufin-${libeufinComponent}";
-
-      isNexus = libeufinComponent == "nexus";
-
-      # get database name from config
-      # TODO: should this always be the same db? In which case, should this be an option directly under `services.libeufin`?
-      dbName =
-        lib.removePrefix "postgresql:///"
-          cfg.settings."libeufin-${libeufinComponent}db-postgres".CONFIG;
-
-      bankPort = cfg.settings."${if isNexus then "nexus-httpd" else "libeufin-bank"}".PORT;
-    in
-    lib.mkIf cfg.enable {
-      services.libeufin.settings = cfg.settings;
-
-      # TODO add system-libeufin.slice?
-      systemd.services = {
-        # Main service
-        "${serviceName}" = {
-          serviceConfig = {
-            DynamicUser = true;
-            ExecStart =
-              let
-                args = lib.cli.toGNUCommandLineShell { } {
-                  c = cfgMain.configFile;
-                  L = if cfg.debug then "debug" else null;
-                };
-              in
-              "${lib.getExe' cfg.package "libeufin-${libeufinComponent}"} serve ${args}";
-            Restart = "on-failure";
-            RestartSec = "10s";
-          };
-          requires = [ "libeufin-dbinit.service" ];
-          after = [ "libeufin-dbinit.service" ];
-          wantedBy = [ "multi-user.target" ];
-        };
-
-        # Database Initialisation
-        libeufin-dbinit =
-          let
-            dbScript = pkgs.writers.writeText "libeufin-db-permissions.sql" ''
-              GRANT SELECT,INSERT,UPDATE,DELETE ON ALL TABLES IN SCHEMA libeufin_bank TO "${serviceName}";
-              GRANT SELECT,INSERT,UPDATE,DELETE ON ALL TABLES IN SCHEMA libeufin_nexus TO "${serviceName}";
-              GRANT USAGE ON SCHEMA libeufin_bank TO "${serviceName}";
-              GRANT USAGE ON SCHEMA libeufin_nexus TO "${serviceName}";
-            '';
-
-            # Accounts to be created after the bank database initialization.
-            #
-            # For example, if the bank's currency conversion is enabled, it's
-            # required that the exchange account is registered before the
-            # service starts.
-            initialAccountRegistration = lib.concatMapStringsSep "\n" (
-              account:
-              let
-                args = lib.cli.toGNUCommandLineShell { } {
-                  c = cfgMain.configFile;
-                  inherit (account) username password name;
-                  payto_uri = "payto://x-taler-bank/bank:${toString bankPort}/${account.username}?receiver-name=${account.name}";
-                  exchange = lib.toLower account.username == "exchange";
-                };
-              in
-              "${lib.getExe' cfg.package "libeufin-bank"} create-account ${args}"
-            ) cfg.initialAccounts;
-
-            args = lib.cli.toGNUCommandLineShell { } {
-              c = cfgMain.configFile;
-              L = if cfg.debug then "debug" else null;
-            };
-          in
-          {
-            path = [ config.services.postgresql.package ];
-            serviceConfig = {
-              Type = "oneshot";
-              DynamicUser = true;
-              StateDirectory = "libeufin-dbinit";
-              StateDirectoryMode = "0750";
-              User = dbName;
-            };
-            script = lib.optionalString cfg.enable ''
-              ${lib.getExe' cfg.package "libeufin-${libeufinComponent}"} dbinit ${args}
-            '';
-            # Grant DB permissions after schemas have been created
-            postStart =
-              ''
-                psql -U "${dbName}" -f "${dbScript}"
-              ''
-              + lib.optionalString ((!isNexus) && (cfg.initialAccounts != [ ])) ''
-                # only register initial accounts once
-                if [ ! -e /var/lib/libeufin-dbinit/init ]; then
-                  ${initialAccountRegistration}
-                  touch /var/lib/libeufin-dbinit/init
-                  echo "Bank initialisation complete"
-                fi
-              '';
-            requires = lib.optionals cfg.createLocalDatabase [ "postgresql.service" ];
-            after = [ "network.target" ] ++ lib.optionals cfg.createLocalDatabase [ "postgresql.service" ];
-          };
-      };
-
-      networking.firewall = lib.mkIf cfg.openFirewall {
-        allowedTCPPorts = [
-          bankPort
-        ];
-      };
-
-      environment.systemPackages = [ cfg.package ];
-
-      services.postgresql = lib.mkIf cfg.createLocalDatabase {
-        enable = true;
-        ensureDatabases = [ dbName ];
-        ensureUsers = [
-          { name = serviceName; }
-          {
-            name = dbName;
-            ensureDBOwnership = true;
-          }
-        ];
-      };
-
-      assertions = [
-        {
-          assertion =
-            cfg.createLocalDatabase || (cfg.settings."libeufin-${libeufinComponent}db-postgres" ? CONFIG);
-          message = "Libeufin ${libeufinComponent} database is not configured.";
-        }
-      ];
-
-    };
-}

hosts/kvernberg/services/pvvvvvv/modules/libeufin/module.nix

@@ -1,29 +0,0 @@
-{
-  lib,
-  pkgs,
-  config,
-  ...
-}:
-
-let
-  cfg = config.services.libeufin;
-  settingsFormat = pkgs.formats.ini { };
-in
-
-{
-  options.services.libeufin = {
-    configFile = lib.mkOption {
-      internal = true;
-      default = settingsFormat.generate "generated-libeufin.conf" cfg.settings;
-    };
-    settings = lib.mkOption {
-      description = "Global configuration options for the libeufin bank system config file.";
-      type = lib.types.submodule { freeformType = settingsFormat.type; };
-      default = { };
-    };
-  };
-
-  config = lib.mkIf (cfg.bank.enable || cfg.nexus.enable) {
-    environment.etc."libeufin/libeufin.conf".source = cfg.configFile;
-  };
-}

hosts/kvernberg/services/pvvvvvv/modules/libeufin/nexus.nix

@@ -1,127 +0,0 @@
-{
-  lib,
-  config,
-  options,
-  ...
-}:
-{
-  imports = [ (import ./common.nix "nexus") ];
-
-  options.services.libeufin.nexus.settings = lib.mkOption {
-    description = ''
-      Configuration options for the libeufin nexus config file.
-      For a list of all possible options, please see the man page [`libeufin-nexus.conf(5)`](https://docs.taler.net/manpages/libeufin-nexus.conf.5.html)
-    '';
-    type = lib.types.submodule {
-      inherit (options.services.libeufin.settings.type.nestedTypes) freeformType;
-      options = {
-        nexus-ebics = {
-          # Mandatory configuration values
-          # https://docs.taler.net/libeufin/nexus-manual.html#setting-up-the-ebics-subscriber
-          # https://docs.taler.net/libeufin/setup-ebics-at-postfinance.html
-          CURRENCY = lib.mkOption {
-            description = "Name of the fiat currency.";
-            type = lib.types.nonEmptyStr;
-            example = "CHF";
-          };
-          HOST_BASE_URL = lib.mkOption {
-            description = "URL of the EBICS server.";
-            type = lib.types.nonEmptyStr;
-            example = "https://ebics.postfinance.ch/ebics/ebics.aspx";
-          };
-          BANK_DIALECT = lib.mkOption {
-            description = ''
-              Name of the following combination: EBICS version and ISO20022
-              recommendations that Nexus would honor in the communication with the
-              bank.
-              Currently only the "postfinance" or "gls" value is supported.
-            '';
-            type = lib.types.enum [
-              "postfinance"
-              "gls"
-            ];
-            example = "postfinance";
-          };
-          HOST_ID = lib.mkOption {
-            description = "Name of the EBICS host.";
-            type = lib.types.nonEmptyStr;
-            example = "PFEBICS";
-          };
-          USER_ID = lib.mkOption {
-            description = ''
-              User ID of the EBICS subscriber.
-              This value must be assigned by the bank after having activated a new EBICS subscriber.
-            '';
-            type = lib.types.nonEmptyStr;
-            example = "PFC00563";
-          };
-          PARTNER_ID = lib.mkOption {
-            description = ''
-              Partner ID of the EBICS subscriber.
-              This value must be assigned by the bank after having activated a new EBICS subscriber.
-            '';
-            type = lib.types.nonEmptyStr;
-            example = "PFC00563";
-          };
-          IBAN = lib.mkOption {
-            description = "IBAN of the bank account that is associated with the EBICS subscriber.";
-            type = lib.types.nonEmptyStr;
-            example = "CH7789144474425692816";
-          };
-          BIC = lib.mkOption {
-            description = "BIC of the bank account that is associated with the EBICS subscriber.";
-            type = lib.types.nonEmptyStr;
-            example = "POFICHBEXXX";
-          };
-          NAME = lib.mkOption {
-            description = "Legal entity that is associated with the EBICS subscriber.";
-            type = lib.types.nonEmptyStr;
-            example = "John Smith S.A.";
-          };
-          BANK_PUBLIC_KEYS_FILE = lib.mkOption {
-            type = lib.types.path;
-            default = "/var/lib/libeufin-nexus/bank-ebics-keys.json";
-            description = ''
-              Filesystem location where Nexus should store the bank public keys.
-            '';
-          };
-          CLIENT_PRIVATE_KEYS_FILE = lib.mkOption {
-            type = lib.types.path;
-            default = "/var/lib/libeufin-nexus/client-ebics-keys.json";
-            description = ''
-              Filesystem location where Nexus should store the subscriber private keys.
-            '';
-          };
-        };
-        nexus-httpd = {
-          PORT = lib.mkOption {
-            type = lib.types.port;
-            default = 8084;
-            description = ''
-              The port on which libeufin-bank should listen.
-            '';
-          };
-        };
-        libeufin-nexusdb-postgres = {
-          CONFIG = lib.mkOption {
-            type = lib.types.str;
-            description = ''
-              The database connection string for the libeufin-nexus database.
-            '';
-          };
-        };
-      };
-    };
-  };
-
-  config =
-    let
-      cfgMain = config.services.libeufin;
-      cfg = config.services.libeufin.nexus;
-    in
-    lib.mkIf cfg.enable {
-      services.libeufin.nexus.settings.libeufin-nexusdb-postgres.CONFIG = lib.mkIf (
-        cfgMain.bank.enable && cfgMain.bank.createLocalDatabase
-      ) "postgresql:///libeufin-bank";
-    };
-}

hosts/kvernberg/services/pvvvvvv/modules/module-list.nix

@@ -1,10 +0,0 @@
-{
-  imports = [
-    ./libeufin/bank.nix
-    ./libeufin/module.nix
-    ./libeufin/nexus.nix
-    ./taler/exchange.nix
-    ./taler/merchant.nix
-    ./taler/module.nix
-  ];
-}

hosts/kvernberg/services/pvvvvvv/modules/taler/common.nix

@@ -1,117 +0,0 @@
-# TODO: create a common module generator for Taler and Libeufin?
-{
-  talerComponent ? "",
-  servicesDB ? [ ],
-  servicesNoDB ? [ ],
-  ...
-}:
-{
-  lib,
-  pkgs,
-  config,
-  ...
-}:
-let
-  cfg = cfgTaler.${talerComponent};
-  cfgTaler = config.services.taler;
-  settingsFormat = pkgs.formats.ini { };
-
-  services = servicesDB ++ servicesNoDB;
-
-  dbName = "taler-${talerComponent}-httpd";
-  groupName = "taler-${talerComponent}-services";
-
-  inherit (cfgTaler) runtimeDir;
-in
-{
-  options = {
-    services.taler.${talerComponent} = {
-      enable = lib.mkEnableOption "the GNU Taler ${talerComponent}";
-      package = lib.mkPackageOption pkgs "taler-${talerComponent}" { };
-      # TODO: make option accept multiple debugging levels?
-      debug = lib.mkEnableOption "debug logging";
-      openFirewall = lib.mkOption {
-        type = lib.types.bool;
-        default = false;
-        description = "Whether to open ports in the firewall";
-      };
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    services.taler.enable = cfg.enable;
-
-    systemd.services = lib.mergeAttrsList [
-      # Main services
-      (lib.genAttrs (map (n: "taler-${talerComponent}-${n}") services) (name: {
-        serviceConfig = {
-          DynamicUser = true;
-          User = name;
-          Group = groupName;
-          ExecStart = toString [
-            (lib.getExe' cfg.package name)
-            "-c /etc/taler/taler.conf"
-            (lib.optionalString cfg.debug " -L debug")
-          ];
-          RuntimeDirectory = name;
-          StateDirectory = name;
-          CacheDirectory = name;
-          ReadWritePaths = [ runtimeDir ];
-          Restart = "always";
-          RestartSec = "10s";
-        };
-        requires = [ "taler-${talerComponent}-dbinit.service" ];
-        after = [ "taler-${talerComponent}-dbinit.service" ];
-        wantedBy = [ "multi-user.target" ]; # TODO slice?
-      }))
-      # Database Initialisation
-      {
-        "taler-${talerComponent}-dbinit" = {
-          path = [ config.services.postgresql.package ];
-          serviceConfig = {
-            Type = "oneshot";
-            DynamicUser = true;
-            User = dbName;
-            Restart = "on-failure";
-            RestartSec = "5s";
-          };
-          requires = [ "postgresql.service" ];
-          after = [ "postgresql.service" ];
-        };
-      }
-    ];
-
-    users.groups.${groupName} = { };
-    systemd.tmpfiles.settings = {
-      "10-taler-${talerComponent}" = {
-        "${runtimeDir}" = {
-          d = {
-            group = groupName;
-            user = "nobody";
-            mode = "070";
-          };
-        };
-      };
-    };
-
-    networking.firewall = lib.mkIf cfg.openFirewall {
-      allowedTCPPorts = [ cfg.settings."${talerComponent}".PORT ];
-    };
-
-    environment.systemPackages = [ cfg.package ];
-
-    services.taler.includes = [ "/etc/taler/conf.d/${talerComponent}.conf" ];
-    environment.etc."taler/conf.d/${talerComponent}.conf".source = settingsFormat.generate "generated-taler.conf" cfg.settings;
-
-    services.postgresql = {
-      enable = true;
-      ensureDatabases = [ dbName ];
-      ensureUsers = map (service: { name = "taler-${talerComponent}-${service}"; }) servicesDB ++ [
-        {
-          name = dbName;
-          ensureDBOwnership = true;
-        }
-      ];
-    };
-  };
-}

hosts/kvernberg/services/pvvvvvv/modules/taler/exchange.nix

@@ -1,143 +0,0 @@
-{
-  lib,
-  config,
-  options,
-  pkgs,
-  ...
-}:
-
-let
-  cfg = cfgTaler.exchange;
-  cfgTaler = config.services.taler;
-
-  talerComponent = "exchange";
-
-  # https://docs.taler.net/taler-exchange-manual.html#services-users-groups-and-file-system-hierarchy
-  servicesDB = [
-    "httpd"
-    "aggregator"
-    "closer"
-    "wirewatch"
-  ];
-
-  servicesNoDB = [
-    "secmod-cs"
-    "secmod-eddsa"
-    "secmod-rsa"
-  ];
-in
-
-{
-  imports = [
-    (import ./common.nix { inherit talerComponent servicesDB servicesNoDB; })
-  ];
-
-  options.services.taler.exchange = {
-    settings = lib.mkOption {
-      description = ''
-        Configuration options for the taler exchange config file.
-        For a list of all possible options, please see the man page [`taler.conf(5)`](https://docs.taler.net/manpages/taler.conf.5.html#exchange-options)
-      '';
-      type = lib.types.submodule {
-        inherit (options.services.taler.settings.type.nestedTypes) freeformType;
-        options = {
-          # TODO: do we want this to be a sub-attribute or only define the exchange set of options here
-          exchange = {
-            AML_THRESHOLD = lib.mkOption {
-              type = lib.types.str;
-              default = "${cfgTaler.settings.taler.CURRENCY}:1000000";
-              defaultText = "1000000 in {option}`CURRENCY`";
-              description = "Monthly transaction volume until an account is considered suspicious and flagged for AML review.";
-            };
-            DB = lib.mkOption {
-              type = lib.types.str;
-              internal = true;
-              default = "postgres";
-            };
-            MASTER_PUBLIC_KEY = lib.mkOption {
-              type = lib.types.str;
-              default = throw ''
-                You must provide `MASTER_PUBLIC_KEY` with the public part of your master key.
-                This will be used by the auditor service to get information about the exchange.
-                For more information, see https://docs.taler.net/taler-auditor-manual.html#initial-configuration
-                To generate this key, you must run `taler-exchange-offline setup`. It will print the public key.
-              '';
-              defaultText = "None, you must set this yourself.";
-              description = "Used by the exchange to verify information signed by the offline system.";
-            };
-            PORT = lib.mkOption {
-              type = lib.types.port;
-              default = 8081;
-              description = "Port on which the HTTP server listens.";
-            };
-          };
-          exchangedb-postgres = {
-            CONFIG = lib.mkOption {
-              type = lib.types.str;
-              internal = true;
-              default = "postgres:///taler-exchange-httpd";
-              description = "Database connection URI.";
-            };
-          };
-        };
-      };
-      default = { };
-    };
-    denominationConfig = lib.mkOption {
-      type = lib.types.lines;
-      defaultText = "None, you must set this yourself.";
-      example = ''
-        [COIN-KUDOS-n1-t1718140083]
-        VALUE = KUDOS:0.1
-        DURATION_WITHDRAW = 7 days
-        DURATION_SPEND = 2 years
-        DURATION_LEGAL = 6 years
-        FEE_WITHDRAW = KUDOS:0
-        FEE_DEPOSIT = KUDOS:0.1
-        FEE_REFRESH = KUDOS:0
-        FEE_REFUND = KUDOS:0
-        RSA_KEYSIZE = 2048
-        CIPHER = RSA
-      '';
-      description = ''
-        This option configures the cash denomination for the coins that the exchange offers.
-        For more information, consult the [upstream docs](https://docs.taler.net/taler-exchange-manual.html#coins-denomination-keys).
-        You can either write these manually or you can use the `taler-harness deployment gen-coin-config`
-        command to generate it.
-        Warning: Do not modify existing denominations after deployment.
-        Please see the upstream docs for how to safely do that.
-      '';
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    services.taler.includes = [
-      (pkgs.writers.writeText "exchange-denominations.conf" cfg.denominationConfig)
-    ];
-
-    systemd.services.taler-exchange-wirewatch = {
-      requires = [ "taler-exchange-httpd.service" ];
-      after = [ "taler-exchange-httpd.service" ];
-    };
-
-    # Taken from https://docs.taler.net/taler-exchange-manual.html#exchange-database-setup
-    # TODO: Why does aggregator need DELETE?
-    systemd.services."taler-${talerComponent}-dbinit".script =
-      let
-        deletePerm = name: lib.optionalString (name == "aggregator") ",DELETE";
-        dbScript = pkgs.writers.writeText "taler-exchange-db-permissions.sql" (
-          lib.pipe servicesDB [
-            (map (name: ''
-              GRANT SELECT,INSERT,UPDATE${deletePerm name} ON ALL TABLES IN SCHEMA exchange TO "taler-exchange-${name}";
-              GRANT USAGE ON SCHEMA exchange TO "taler-exchange-${name}";
-            ''))
-            lib.concatStrings
-          ]
-        );
-      in
-      ''
-        ${lib.getExe' cfg.package "taler-exchange-dbinit"}
-        psql -U taler-exchange-httpd -f ${dbScript}
-      '';
-  };
-}

hosts/kvernberg/services/pvvvvvv/modules/taler/merchant.nix

@@ -1,108 +0,0 @@
-{
-  lib,
-  config,
-  options,
-  pkgs,
-  ...
-}:
-let
-  cfg = cfgTaler.merchant;
-  cfgTaler = config.services.taler;
-
-  talerComponent = "merchant";
-
-  # https://docs.taler.net/taler-merchant-manual.html#launching-the-backend
-  servicesDB = [
-    "httpd"
-    "webhook"
-    "wirewatch"
-    "depositcheck"
-    "exchange"
-  ];
-in
-{
-  imports = [
-    (import ./common.nix { inherit talerComponent servicesDB; })
-  ];
-
-  options.services.taler.merchant = {
-    settings = lib.mkOption {
-      description = ''
-        Configuration options for the taler merchant config file.
-        For a list of all possible options, please see the man page [`taler.conf(5)`](https://docs.taler.net/manpages/taler.conf.5.html#merchant-options)
-      '';
-      type = lib.types.submodule {
-        inherit (options.services.taler.settings.type.nestedTypes) freeformType;
-        options = {
-          # TODO: do we want this to be a sub-attribute or only define the merchant set of options here
-          merchant = {
-            DB = lib.mkOption {
-              type = lib.types.str;
-              internal = true;
-              default = "postgres";
-              description = "Plugin to use for the database.";
-            };
-            PORT = lib.mkOption {
-              type = lib.types.port;
-              default = 8083;
-              description = "Port on which the HTTP server listens.";
-            };
-            SERVE = lib.mkOption {
-              type = lib.types.str;
-              default = "tcp";
-              description = ''
-                Whether the HTTP server should listen on a UNIX domain socket ("unix") or on a TCP socket ("tcp").
-              '';
-            };
-            LEGAL_PRESERVATION = lib.mkOption {
-              type = lib.types.str;
-              internal = true;
-              default = "10 years";
-              description = "How long to keep data in the database for tax audits after the transaction has completed.";
-            };
-          };
-          merchantdb-postgres = {
-            CONFIG = lib.mkOption {
-              type = lib.types.str;
-              internal = true;
-              default = "postgres:///taler-${talerComponent}-httpd";
-              description = "Database connection URI.";
-            };
-            SQL_DIR = lib.mkOption {
-              type = lib.types.str;
-              internal = true;
-              default = "${cfg.package}/share/taler/sql/merchant/";
-              description = "The location for the SQL files to setup the database tables.";
-            };
-          };
-        };
-      };
-      default = { };
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    systemd.services.taler-merchant-depositcheck = {
-      # taler-merchant-depositcheck needs its executable is in the PATH
-      # NOTE: couldn't use `lib.getExe` to only get that single executable
-      path = [ cfg.package ];
-    };
-
-    systemd.services."taler-${talerComponent}-dbinit".script =
-      let
-        # NOTE: not documented, but is necessary
-        dbScript = pkgs.writers.writeText "taler-merchant-db-permissions.sql" (
-          lib.concatStrings (
-            map (name: ''
-              GRANT SELECT,INSERT,UPDATE,DELETE ON ALL TABLES IN SCHEMA merchant TO "taler-merchant-${name}";
-              GRANT USAGE ON SCHEMA merchant TO "taler-merchant-${name}";
-            '') servicesDB
-          )
-        );
-      in
-      ''
-        ${lib.getExe' cfg.package "taler-merchant-dbinit"}
-        psql -U taler-${talerComponent}-httpd -f ${dbScript}
-      '';
-  };
-}

hosts/kvernberg/services/pvvvvvv/modules/taler/module.nix

@@ -1,89 +0,0 @@
-{
-  lib,
-  pkgs,
-  config,
-  ...
-}:
-
-let
-  cfg = config.services.taler;
-  settingsFormat = pkgs.formats.ini { };
-in
-
-{
-  # TODO turn this into a generic taler-like service thingy?
-  options.services.taler = {
-    enable = lib.mkEnableOption "the GNU Taler system" // lib.mkOption { internal = true; };
-    includes = lib.mkOption {
-      type = lib.types.listOf lib.types.path;
-      default = [ ];
-      description = ''
-        Files to include into the config file using Taler's `@inline@` directive.
-        This allows including arbitrary INI files, including imperatively managed ones.
-      '';
-    };
-    settings = lib.mkOption {
-      description = ''
-        Global configuration options for the taler config file.
-        For a list of all possible options, please see the man page [`taler.conf(5)`](https://docs.taler.net/manpages/taler.conf.5.html)
-      '';
-      type = lib.types.submodule {
-        freeformType = settingsFormat.type;
-        options = {
-          taler = {
-            CURRENCY = lib.mkOption {
-              type = lib.types.nonEmptyStr;
-              description = ''
-                The currency which taler services will operate with. This cannot be changed later.
-              '';
-            };
-            CURRENCY_ROUND_UNIT = lib.mkOption {
-              type = lib.types.str;
-              default = "${cfg.settings.taler.CURRENCY}:0.01";
-              defaultText = lib.literalExpression ''
-                "''${config.services.taler.settings.taler.CURRENCY}:0.01"
-              '';
-              description = ''
-                Smallest amount in this currency that can be transferred using the underlying RTGS.
-                You should probably not touch this.
-              '';
-            };
-          };
-        };
-      };
-      default = { };
-    };
-    runtimeDir = lib.mkOption {
-      type = lib.types.str;
-      default = "/run/taler-system-runtime/";
-      description = ''
-        Runtime directory shared between the taler services.
-        Crypto helpers put their sockets here for instance and the httpd
-        connects to them.
-      '';
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    services.taler.settings.PATHS = {
-      TALER_DATA_HOME = "\${STATE_DIRECTORY}/";
-      TALER_CACHE_HOME = "\${CACHE_DIRECTORY}/";
-      TALER_RUNTIME_DIR = cfg.runtimeDir;
-    };
-
-    environment.etc."taler/taler.conf".source =
-      let
-        includes = pkgs.writers.writeText "includes.conf" (
-          lib.concatStringsSep "\n" (map (include: "@inline@ ${include}") cfg.includes)
-        );
-        generatedConfig = settingsFormat.generate "generated-taler.conf" cfg.settings;
-      in
-      pkgs.runCommand "taler.conf" { } ''
-        cat ${includes} > $out
-        echo >> $out
-        echo >> $out
-        cat ${generatedConfig} >> $out
-      '';
-
-  };
-}

hosts/shark/configuration.nix

@@ -1,13 +1,13 @@
-{ config, pkgs, values, ... }:
+{ config, fp, pkgs, values, ... }:
 {
   imports = [
       # Include the results of the hardware scan.
       ./hardware-configuration.nix
-      ../../base
+      (fp /base)
-      ../../misc/metrics-exporters.nix
+      (fp /misc/metrics-exporters.nix)
     ];
 
-  sops.defaultSopsFile = ../../secrets/shark/shark.yaml;
+  sops.defaultSopsFile = fp /secrets/shark/shark.yaml;
   sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
   sops.age.keyFile = "/var/lib/sops-nix/key.txt";
   sops.age.generateKey = true;

secrets/kvernberg/exhange-offline-master.priv

@@ -0,0 +1,24 @@
+{
+	"data": "ENC[AES256_GCM,data:dhVo1B+ZG1B6s0bTLgph4ipPmi0mveaObbJAffDQbpY=,iv:P5plvu4DQYa99cQZQ6B/gEFcSffu3lTY3+Z80Cfoj94=,tag:4xcqCbn6fFSmCbYmmEgQEg==,type:str]",
+	"sops": {
+		"kms": null,
+		"gcp_kms": null,
+		"azure_kv": null,
+		"hc_vault": null,
+		"age": [
+			{
+				"recipient": "age19rlntxt0m27waa0n288g9wgpksa6ndlzz8eneeqya7w3zd7may0sqzhcvz",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5MzVHSE15Nk9MODQxc2g0\nbHlqNmFKclBYbUNKQTNUOGo0VThiaEZTVzJFCmU2YkYwMXlyeHM3ZzAxOWZpa3k4\nUUJLanVFbkNMa25RcGZmOTBsVmtzazQKLS0tIE1sTTBqT3VJMDFOYXl0T1JvcDRV\nRFpsZGNOZzFzMFc3YzcxeXdIK1d6QUUKzy0n7DJsOmrNvU03Tn6Zcj/l/kAylzzP\nhNnFLXfStdKl3A/qrzBPhTVbYD73yFkZuQ+bDr7/IMsHAmDsztuA9g==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17tagmpwqjk3mdy45rfesrfey6h863x8wfq38wh33tkrlrywxducs0k6tpq",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnbEdBWjdEbmtNYWJHQnFj\nSU1yb0NYVG4xVlZkYTdUWUpDcGdmbFF6U1NrCjBlWFZkcC9FMVJLYUtDNlBTUWcw\nNHBwWFNESDBQQmJNb3NDN2tDekM4eUUKLS0tICtMVGc1L2JFQ1BqKzM3eWFPRmRQ\nWXlQUWpvdUdOUlZ1OFhtS0ErL0JKSlUKzxLKbsnXvEqnR2HVsTxNqmM7YPjWfCjG\nZ4Bf046NdseomkNuTvWuPzjzPTe4GvjudMYc4ODchkIMOo6hXyf5kw==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2024-11-17T01:12:23Z",
+		"mac": "ENC[AES256_GCM,data:aXIM/pmgVmfNSa+PwpfK6Efh/kCWXUqZNcKLkyhRwl++vaIBQUIQgQjv09hWHOF77V3ZjRQjh2E1uNe2baBLEmrDT5Au+7VABW+j49KX/vKMd+1l4w47l3DukOVnoo50bsOQFtH+amSl2P2imxpO15sjVDu9/nUeu2qXrtbIUh8=,iv:BQVs3P9p86uzTH2BfuSOxycpE6di4ZIwSz7OTZdcQPg=,tag:mT4Ek8dDbVINGp4Odt62zw==,type:str]",
+		"pgp": null,
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.9.1"
+	}
+}