WIP: grevling/tuba: init

It's still part of the simulation tho

.sops.yaml

@@ -13,6 +13,7 @@ keys:
   - &host_ildkule age1x28hmzvuv6f2n66c0jtqcca3h9rput8d7j5uek6jcpx8n9egd52sqpejq0
   - &host_bekkalokk age12nj59tguy9wg882updc2vjdusx5srnxmjyfaqve4zx6jnnsaw3qsyjq6zd
   - &host_bicep age1sl43gc9cw939z5tgha2lpwf0xxxgcnlw7w4xem4sqgmt2pt264vq0dmwx2
+  - &host_ustetind age1hffjafs4slznksefmtqrlj7rdaqgzqncn4un938rhr053237ry8s3rs0v8
 
 creation_rules:
   # Global secrets
@@ -78,3 +79,15 @@ creation_rules:
       - *user_pederbs_bjarte
       pgp:
       - *user_oysteikt
+
+  - path_regex: secrets/ustetind/[^/]+\.yaml$
+    key_groups:
+    - age:
+      - *host_ustetind
+      - *user_danio
+      - *user_felixalb
+      - *user_pederbs_sopp
+      - *user_pederbs_nord
+      - *user_pederbs_bjarte
+      pgp:
+      - *user_oysteikt

base/default.nix

@@ -1,9 +1,9 @@
-{ pkgs, lib, ... }:
+{ pkgs, lib, fp, ... }:
 
 {
   imports = [
-    ../users
+    (fp /users)
-    ../modules/snakeoil-certs.nix
+    (fp /modules/snakeoil-certs.nix)
 
     ./networking.nix
     ./nix.nix

base/services/auto-upgrade.nix

@@ -2,7 +2,7 @@
 {
   system.autoUpgrade = {
     enable = true;
-    flake = "git+https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git?ref=pvvvvv";
+    flake = "git+https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git";
     flags = [
       # --update-input is deprecated since nix 2.22, and removed in lix 2.90
       # https://git.lix.systems/lix-project/lix/issues/400

base/services/smartd.nix

@@ -1,8 +1,20 @@
 { config, pkgs, lib, ... }:
 {
-  services.smartd.enable = lib.mkDefault true;
+  services.smartd = {
+    enable = lib.mkDefault true;
+    notifications = {
+      mail = {
+        enable = true;
+        sender = "root@pvv.ntnu.no";
+        recipient = "root@pvv.ntnu.no";
+      };
+      wall.enable = false;
+    };
+  };
 
   environment.systemPackages = lib.optionals config.services.smartd.enable (with pkgs; [
     smartmontools
   ]);
-}
+
+  systemd.services.smartd.unitConfig.ConditionVirtualization = "no";
+}

flake.lock

@@ -7,11 +7,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1729281548,
+        "lastModified": 1731746438,
-        "narHash": "sha256-MuojlSnwAJAwfhgmW8ZtZrwm2Sko4fqubCvReqbUzYw=",
+        "narHash": "sha256-f3SSp1axoOk0NAI7oFdRzbxG2XPBSIXC+/DaAXnvS1A=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "a6a3179ddf396dfc28a078e2f169354d0c137125",
+        "rev": "cb64993826fa7a477490be6ccb38ba1fa1e18fa8",
         "type": "github"
       },
       "original": {
@@ -119,11 +119,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1729307008,
+        "lastModified": 1731663789,
-        "narHash": "sha256-QUvb6epgKi9pCu9CttRQW4y5NqJ+snKr1FZpG/x3Wtc=",
+        "narHash": "sha256-x07g4NcqGP6mQn6AISXJaks9sQYDjZmTMBlKIvajvyc=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "a9b86fc2290b69375c5542b622088eb6eca2a7c3",
+        "rev": "035d434d48f4375ac5d3a620954cf5fda7dd7c36",
         "type": "github"
       },
       "original": {
@@ -135,11 +135,11 @@
     },
     "nixpkgs-stable": {
       "locked": {
-        "lastModified": 1728156290,
+        "lastModified": 1730602179,
-        "narHash": "sha256-uogSvuAp+1BYtdu6UWuObjHqSbBohpyARXDWqgI12Ss=",
+        "narHash": "sha256-efgLzQAWSzJuCLiCaQUCDu4NudNlHdg2NzGLX5GYaEY=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "17ae88b569bb15590549ff478bab6494dde4a907",
+        "rev": "3c2f1c4ca372622cb2f9de8016c9a0b1cbd0f37c",
         "type": "github"
       },
       "original": {
@@ -151,11 +151,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1729308112,
+        "lastModified": 1731745710,
-        "narHash": "sha256-Ap+cPeiluam2KFZO+OWuFTl/IkIJfyGYGMgkT2pVCRY=",
+        "narHash": "sha256-SVeiClbgqL071JpAspOu0gCkPSAL51kSIRwo4C/pghA=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "61253596816c4cd65e2a0f474cbc0ac0c6e0f7cf",
+        "rev": "dfaa4cb76c2d450d8f396bb6b9f43cede3ade129",
         "type": "github"
       },
       "original": {
@@ -249,11 +249,11 @@
         "nixpkgs-stable": "nixpkgs-stable"
       },
       "locked": {
-        "lastModified": 1728345710,
+        "lastModified": 1731748189,
-        "narHash": "sha256-lpunY1+bf90ts+sA2/FgxVNIegPDKCpEoWwOPu4ITTQ=",
+        "narHash": "sha256-Zd/Uukvpcu26M6YGhpbsgqm6LUSLz+Q8mDZ5LOEGdiE=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "06535d0e3d0201e6a8080dd32dbfde339b94f01b",
+        "rev": "d2bd7f433b28db6bc7ae03d5eca43564da0af054",
         "type": "github"
       },
       "original": {

flake.nix

@@ -33,13 +33,13 @@
 
   outputs = { self, nixpkgs, nixpkgs-unstable, sops-nix, disko, ... }@inputs:
   let
-    nixlib = nixpkgs.lib;
+    inherit (nixpkgs) lib;
     systems = [
       "x86_64-linux"
       "aarch64-linux"
       "aarch64-darwin"
     ];
-    forAllSystems = f: nixlib.genAttrs systems f;
+    forAllSystems = f: lib.genAttrs systems f;
     allMachines = builtins.attrNames self.nixosConfigurations;
     importantMachines = [
       "bekkalokk"
@@ -49,16 +49,17 @@
       "ildkule"
     ];
   in {
-    inherit inputs;
+    inputs = lib.mapAttrs (_: src: src.outPath) inputs;
 
     nixosConfigurations = let
       unstablePkgs = nixpkgs-unstable.legacyPackages.x86_64-linux;
-      nixosConfig = nixpkgs: name: config: nixpkgs.lib.nixosSystem (nixpkgs.lib.recursiveUpdate
+      nixosConfig = nixpkgs: name: config: lib.nixosSystem (lib.recursiveUpdate
         rec {
           system = "x86_64-linux";
           specialArgs = {
             inherit unstablePkgs inputs;
             values = import ./values.nix;
+            fp = path: ./${path};
           };
 
           modules = [
@@ -114,6 +115,12 @@
       #ildkule-unstable = unstableNixosConfig "ildkule" { };
       shark = stableNixosConfig "shark" { };
 
+      ustetind = stableNixosConfig "ustetind" {
+        modules = [
+         "${nixpkgs}/nixos/modules/virtualisation/lxc-container.nix"
+        ];
+      };
+
       brzeczyszczykiewicz = stableNixosConfig "brzeczyszczykiewicz" {
         modules = [
           inputs.grzegorz-clients.nixosModules.grzegorz-webui
@@ -132,10 +139,18 @@
           inputs.greg-ng.overlays.default
         ];
       };
-      kvernberg = stableNixosConfig "kvernberg" {
+
+      grevling = stableNixosConfig "grevling" {
         modules = [
-          disko.nixosModules.disko
+          ./hosts/grevling/configuration.nix
-          { disko.devices.disk.disk1.device = "/dev/sda"; }
+          sops-nix.nixosModules.sops
+        ];
+      };
+
+      tuba = stableNixosConfig "grevling" {
+        modules = [
+          ./hosts/tuba/configuration.nix
+          sops-nix.nixosModules.sops
         ];
       };
     };
@@ -155,19 +170,19 @@
       in rec {
         default = important-machines;
         important-machines = pkgs.linkFarm "important-machines"
-          (nixlib.getAttrs importantMachines self.packages.x86_64-linux);
+          (lib.getAttrs importantMachines self.packages.x86_64-linux);
         all-machines = pkgs.linkFarm "all-machines"
-          (nixlib.getAttrs allMachines self.packages.x86_64-linux);
+          (lib.getAttrs allMachines self.packages.x86_64-linux);
 
         simplesamlphp = pkgs.callPackage ./packages/simplesamlphp { };
 
       } //
-      (nixlib.pipe null [
+      (lib.pipe null [
         (_: pkgs.callPackage ./packages/mediawiki-extensions { })
-        (nixlib.flip builtins.removeAttrs ["override" "overrideDerivation"])
+        (lib.flip builtins.removeAttrs ["override" "overrideDerivation"])
-        (nixlib.mapAttrs' (name: nixlib.nameValuePair "mediawiki-${name}"))
+        (lib.mapAttrs' (name: lib.nameValuePair "mediawiki-${name}"))
       ])
-      // nixlib.genAttrs allMachines
+      // lib.genAttrs allMachines
         (machine: self.nixosConfigurations.${machine}.config.system.build.toplevel);
     };
   };

hosts/bekkalokk/configuration.nix

@@ -1,10 +1,10 @@
-{ pkgs, values, ... }:
+{ fp, pkgs, values, ... }:
 {
   imports = [
     ./hardware-configuration.nix
 
-    ../../base
+    (fp /base)
-    ../../misc/metrics-exporters.nix
+    (fp /misc/metrics-exporters.nix)
 
     ./services/bluemap/default.nix
     ./services/gitea/default.nix
@@ -19,7 +19,7 @@
     ./services/well-known
   ];
 
-  sops.defaultSopsFile = ../../secrets/bekkalokk/bekkalokk.yaml;
+  sops.defaultSopsFile = fp /secrets/bekkalokk/bekkalokk.yaml;
   sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
   sops.age.keyFile = "/var/lib/sops-nix/key.txt";
   sops.age.generateKey = true;

hosts/bekkalokk/services/gitea/default.nix

@@ -1,11 +1,11 @@
-{ config, values, pkgs, lib, ... }:
+{ config, values, fp, pkgs, lib, ... }:
 let
   cfg = config.services.gitea;
   domain = "git.pvv.ntnu.no";
   sshPort  = 2222;
 in {
   imports = [
-    ./ci.nix
+    ./gpg.nix
     ./import-users
     ./web-secret-provider
   ];
@@ -173,8 +173,8 @@ in {
     };
 
     script = let
-      logo-svg = ../../../../assets/logo_blue_regular.svg;
+      logo-svg = fp /assets/logo_blue_regular.svg;
-      logo-png = ../../../../assets/logo_blue_regular.png;
+      logo-png = fp /assets/logo_blue_regular.png;
       extraLinks = pkgs.writeText "gitea-extra-links.tmpl" ''
         <a class="item" href="https://www.pvv.ntnu.no/">PVV</a>
         <a class="item" href="https://wiki.pvv.ntnu.no/">Wiki</a>

hosts/bekkalokk/services/gitea/gpg.nix

@@ -0,0 +1,38 @@
+{ config, pkgs, lib, ... }:
+let
+  cfg = config.services.gitea;
+  GNUPGHOME = "${config.users.users.gitea.home}/gnupg";
+in
+{
+  sops.secrets."gitea/gpg-signing-key" = {
+    owner = cfg.user;
+    inherit (cfg) group;
+  };
+
+  systemd.services.gitea.environment = { inherit GNUPGHOME; };
+
+  systemd.tmpfiles.settings."20-gitea-gnugpg".${GNUPGHOME}.d = {
+    inherit (cfg) user group;
+    mode = "700";
+  };
+
+  systemd.services.gitea-ensure-gnupg-homedir = {
+    description = "Import gpg key for gitea";
+    environment = { inherit GNUPGHOME; };
+    serviceConfig = {
+      Type = "oneshot";
+      User = cfg.user;
+      PrivateNetwork = true;
+    };
+    script = ''
+      ${lib.getExe pkgs.gnupg} --import ${config.sops.secrets."gitea/gpg-signing-key".path}
+    '';
+  };
+
+  services.gitea.settings."repository.signing" = {
+    SIGNING_KEY = "0549C43374D2253C";
+    SIGNING_NAME = "PVV Git";
+    SIGNING_EMAIL = "gitea@git.pvv.ntnu.no";
+    INITIAL_COMMIT = "always";
+  };
+}

hosts/bekkalokk/services/mediawiki/default.nix

@@ -1,4 +1,4 @@
-{ pkgs, lib, config, values, pkgs-unstable, ... }: let
+{ pkgs, lib, fp, config, values, pkgs-unstable, ... }: let
   cfg = config.services.mediawiki;
 
   # "mediawiki"
@@ -210,8 +210,8 @@ in {
         '';
       };
 
-      "= /PNG/PVV-logo.svg".alias = ../../../../assets/logo_blue_regular.svg;
+      "= /PNG/PVV-logo.svg".alias = fp /assets/logo_blue_regular.svg;
-      "= /PNG/PVV-logo.png".alias = ../../../../assets/logo_blue_regular.png;
+      "= /PNG/PVV-logo.png".alias = fp /assets/logo_blue_regular.png;
       "= /favicon.ico".alias = pkgs.runCommandLocal "mediawiki-favicon.ico" {
         buildInputs = with pkgs; [ imagemagick ];
       } ''
@@ -219,7 +219,7 @@ in {
           -resize x64 \
           -gravity center \
           -crop 64x64+0+0 \
-          ${../../../../assets/logo_blue_regular.png} \
+          ${fp /assets/logo_blue_regular.png} \
           -flatten \
           -colors 256 \
           -background transparent \

hosts/bekkalokk/services/webmail/snappymail.nix

@@ -1,8 +1,8 @@
-{ config, lib, pkgs, ... }:
+{ config, lib, fp, pkgs, ... }:
 let
   cfg = config.services.snappymail;
 in {
-  imports = [ ../../../../modules/snappymail.nix ];
+  imports = [ (fp /modules/snappymail.nix) ];
 
   services.snappymail = {
     enable = true;

hosts/bicep/configuration.nix

@@ -1,10 +1,10 @@
-{ pkgs, values, ... }:
+{ fp, pkgs, values, ... }:
 {
   imports = [
     ./hardware-configuration.nix
 
-    ../../base
+    (fp /base)
-    ../../misc/metrics-exporters.nix
+    (fp /misc/metrics-exporters.nix)
     ./services/nginx
 
     ./services/mysql.nix
@@ -15,7 +15,7 @@
     ./services/matrix
   ];
 
-  sops.defaultSopsFile = ../../secrets/bicep/bicep.yaml;
+  sops.defaultSopsFile = fp /secrets/bicep/bicep.yaml;
   sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
   sops.age.keyFile = "/var/lib/sops-nix/key.txt";
   sops.age.generateKey = true;

hosts/bicep/services/calendar-bot.nix

@@ -1,16 +1,16 @@
-{ config, lib, pkgs, ... }:
+{ config, fp, lib, pkgs, ... }:
 let
   cfg = config.services.pvv-calendar-bot;
 in {
   sops.secrets = {
     "calendar-bot/matrix_token" = {
-      sopsFile = ../../../secrets/bicep/bicep.yaml;
+      sopsFile = fp /secrets/bicep/bicep.yaml;
       key = "calendar-bot/matrix_token";
       owner = cfg.user;
       group = cfg.group;
     };
     "calendar-bot/mysql_password" = {
-      sopsFile = ../../../secrets/bicep/bicep.yaml;
+      sopsFile = fp /secrets/bicep/bicep.yaml;
       key = "calendar-bot/mysql_password";
       owner = cfg.user;
       group = cfg.group;

hosts/bicep/services/matrix/coturn.nix

@@ -1,14 +1,14 @@
-{ config, lib, pkgs, secrets, values, ... }:
+{ config, lib, fp, pkgs, secrets, values, ... }:
 
 {
   sops.secrets."matrix/synapse/turnconfig" = {
-    sopsFile = ../../../../secrets/bicep/matrix.yaml;
+    sopsFile = fp /secrets/bicep/matrix.yaml;
     key = "synapse/turnconfig";
     owner = config.users.users.matrix-synapse.name;
     group = config.users.users.matrix-synapse.group;
   };
   sops.secrets."matrix/coturn/static-auth-secret" = {
-    sopsFile = ../../../../secrets/bicep/matrix.yaml;
+    sopsFile = fp /secrets/bicep/matrix.yaml;
     key = "coturn/static-auth-secret";
     owner = config.users.users.turnserver.name;
     group = config.users.users.turnserver.group;

hosts/bicep/services/matrix/discord.nix

@@ -1,4 +1,4 @@
-{ config, lib, ... }:
+{ config, lib, fp, ... }:
 
 let
   cfg = config.services.mx-puppet-discord;
@@ -7,11 +7,11 @@ in
   users.groups.keys-matrix-registrations = { };
 
   sops.secrets."matrix/discord/as_token" = {
-    sopsFile = ../../../../secrets/bicep/matrix.yaml;
+    sopsFile = fp /secrets/bicep/matrix.yaml;
     key = "discord/as_token";
   };
   sops.secrets."matrix/discord/hs_token" = {
-    sopsFile = ../../../../secrets/bicep/matrix.yaml;
+    sopsFile = fp /secrets/bicep/matrix.yaml;
     key = "discord/hs_token";
   };
 

hosts/bicep/services/matrix/hookshot/default.nix

@@ -1,4 +1,4 @@
-{ config, lib, unstablePkgs, inputs, ... }:
+{ config, lib, fp, unstablePkgs, inputs, ... }:
 
 let
   cfg = config.services.matrix-hookshot;
@@ -11,11 +11,11 @@ in
   ];
 
   sops.secrets."matrix/hookshot/as_token" = {
-    sopsFile = ../../../../../secrets/bicep/matrix.yaml;
+    sopsFile = fp /secrets/bicep/matrix.yaml;
     key = "hookshot/as_token";
   };
   sops.secrets."matrix/hookshot/hs_token" = {
-    sopsFile = ../../../../../secrets/bicep/matrix.yaml;
+    sopsFile = fp /secrets/bicep/matrix.yaml;
     key = "hookshot/hs_token";
   };
 

hosts/bicep/services/matrix/mjolnir.nix

@@ -1,8 +1,8 @@
-{ config, lib, ... }:
+{ config, lib, fp, ... }:
 
 {
   sops.secrets."matrix/mjolnir/access_token" = {
-    sopsFile = ../../../../secrets/bicep/matrix.yaml;
+    sopsFile = fp /secrets/bicep/matrix.yaml;
     key = "mjolnir/access_token";
     owner = config.users.users.mjolnir.name;
     group = config.users.users.mjolnir.group;

hosts/bicep/services/matrix/synapse.nix

@@ -1,4 +1,4 @@
-{ config, lib, pkgs, values, inputs, ... }:
+{ config, lib, fp, pkgs, values, inputs, ... }:
 
 let
   cfg = config.services.matrix-synapse-next;
@@ -10,13 +10,13 @@ let
 in {
   sops.secrets."matrix/synapse/signing_key" = {
     key = "synapse/signing_key";
-    sopsFile = ../../../../secrets/bicep/matrix.yaml;
+    sopsFile = fp /secrets/bicep/matrix.yaml;
     owner = config.users.users.matrix-synapse.name;
     group = config.users.users.matrix-synapse.group;
   };
 
   sops.secrets."matrix/synapse/user_registration" = {
-    sopsFile = ../../../../secrets/bicep/matrix.yaml;
+    sopsFile = fp /secrets/bicep/matrix.yaml;
     key = "synapse/signing_key";
     owner = config.users.users.matrix-synapse.name;
     group = config.users.users.matrix-synapse.group;

hosts/bob/configuration.nix

@@ -1,16 +1,16 @@
-{ config, pkgs, values, ... }:
+{ config, fp, pkgs, values, ... }:
 {
   imports = [
       # Include the results of the hardware scan.
       ./hardware-configuration.nix
-      ../../base
+      (fp /base)
-      ../../misc/metrics-exporters.nix
+      (fp /misc/metrics-exporters.nix)
       ./disks.nix
 
-      ../../misc/builder.nix
+      (fp /misc/builder.nix)
     ];
 
-  sops.defaultSopsFile = ../../secrets/bob/bob.yaml;
+  sops.defaultSopsFile = fp /secrets/bob/bob.yaml;
   sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
   sops.age.keyFile = "/var/lib/sops-nix/key.txt";
   sops.age.generateKey = true;

hosts/brzeczyszczykiewicz/configuration.nix

@@ -1,10 +1,10 @@
-{ config, pkgs, values, ... }:
+{ config, fp, pkgs, values, ... }:
 {
   imports = [
       # Include the results of the hardware scan.
       ./hardware-configuration.nix
-      ../../base
+      (fp /base)
-      ../../misc/metrics-exporters.nix
+      (fp /misc/metrics-exporters.nix)
 
       ./services/grzegorz.nix
     ];

hosts/brzeczyszczykiewicz/services/grzegorz.nix

@@ -1,6 +1,6 @@
-{ config, ... }:
+{ config, fp, ... }:
 {
-  imports = [ ../../../modules/grzegorz.nix ];
+  imports = [ (fp /modules/grzegorz.nix) ];
 
   services.nginx.virtualHosts."${config.networking.fqdn}" = {
     serverAliases = [

hosts/georg/configuration.nix

@@ -1,12 +1,12 @@
-{ config, pkgs, values, ... }:
+{ config, fp, pkgs, values, ... }:
 {
   imports = [
       # Include the results of the hardware scan.
       ./hardware-configuration.nix
-      ../../base
+      (fp /base)
-      ../../misc/metrics-exporters.nix
+      (fp /misc/metrics-exporters.nix)
 
-      ../../modules/grzegorz.nix
+      (fp /modules/grzegorz.nix)
     ];
 
   boot.loader.systemd-boot.enable = true;

hosts/grevling/configuration.nix

@@ -0,0 +1,36 @@
+{ config, pkgs, values, ... }:
+{
+  imports = [
+      # Include the results of the hardware scan.
+      ./hardware-configuration.nix
+      ../../base.nix
+      ../../misc/metrics-exporters.nix
+
+      ./services/openvpn
+    ];
+
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  networking.hostName = "grevling";
+
+  # systemd.network.networks."30-eno1" = values.defaultNetworkConfig // {
+  #   matchConfig.Name = "eno1";
+  #   address = with values.hosts.georg; [ (ipv4 + "/25") (ipv6 + "/64") ];
+  # };
+
+  # List packages installed in system profile
+  environment.systemPackages = with pkgs; [
+  ];
+
+  # List services that you want to enable:
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "23.05"; # Did you read the comment?
+
+}

hosts/grevling/hardware-configuration.nix

@@ -5,22 +5,36 @@
 
 {
   imports =
-    [ (modulesPath + "/profiles/qemu-guest.nix")
+    [ (modulesPath + "/installer/scan/not-detected.nix")
     ];
 
-  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
+  boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" ];
   boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
   boot.extraModulePackages = [ ];
 
-  swapDevices = [ ];
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/33825f0d-5a63-40fc-83db-bfa1ebb72ba0";
+      fsType = "ext4";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/145E-7362";
+      fsType = "vfat";
+    };
+
+  swapDevices =
+    [ { device = "/dev/disk/by-uuid/7ed27e21-3247-44cd-8bcc-5d4a2efebf57"; }
+    ];
 
   # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
   # (the default) this is the recommended approach. When using systemd-networkd it's
   # still possible to use this option, but it's recommended to use it in conjunction
   # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
   networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.ens18.useDHCP = lib.mkDefault true;
+  # networking.interfaces.eno1.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp2s2.useDHCP = lib.mkDefault true;
 
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }

hosts/grevling/services/openvpn/default.nix

@@ -0,0 +1,77 @@
+{ pkgs, lib, values, ... }:
+{
+  services.openvpn.servers."ov-tunnel" = {
+    config = let
+      conf = {
+        # TODO: use aliases
+        local = "129.241.210.191";
+        port = 1194;
+        proto = "udp";
+        dev = "tap";
+
+        # TODO: set up
+        ca = "";
+        cert = "";
+        key = "";
+        dh = "";
+
+        # Maintain a record of client <-> virtual IP address
+        # associations in this file.  If OpenVPN goes down or
+        # is restarted, reconnecting clients can be assigned
+        # the same virtual IP address from the pool that was
+        # previously assigned.
+        ifconfig-pool-persist = ./ipp.txt;
+
+        server-bridge = builtins.concatStringsSep " " [
+          "129.241.210.129"
+          "255.255.255.128"
+          "129.241.210.253"
+          "129.241.210.254"
+        ];
+
+        keepalive = "10 120";
+        cipher = "none";
+
+        user = "nobody";
+        group = "nobody";
+
+        status = "/var/log/openvpn-status.log";
+
+        client-config-dir = pkgs.writeTextDir "tuba" ''
+          # Sett IP-adr. for tap0 til tubas PVV-adr.
+          ifconfig-push ${values.services.tuba-tap} 255.255.255.128
+          # Hvordan skal man faa dette til aa funke, tro?
+          #ifconfig-ipv6-push 2001:700:300:1900::xxx/64
+          
+          # La tuba bruke std. PVV-gateway til all trafikk (unntatt
+          # VPN-tunnellen).
+          push "redirect-gateway"
+        '';
+
+        persist-key = true;
+        persist-tun = true;
+
+        verb = 5;
+
+        explicit-exit-notify = 1;
+      };
+    in lib.pipe conf [
+      (lib.filterAttrs (_: value: !(builtins.isNull value || value == false)))
+      (builtins.mapAttrs (_: value:
+        if builtins.isList value then builtins.concatStringsSep " " (map toString value)
+        else if value == true then value
+        else if builtins.any (f: f value) [
+          builtins.isString
+          builtins.isInt
+          builtins.isFloat
+          lib.isPath
+          lib.isDerivation
+        ] then toString value
+        else throw "Unknown value in grevling openvpn config, deading now\n${value}"
+      ))
+      (lib.mapAttrsToList (name: value: if value == true then name else "${name} ${value}"))
+      (builtins.concatStringsSep "\n")
+      (x: x + "\n\n")
+    ];
+  };
+}

hosts/ildkule/configuration.nix

@@ -1,16 +1,16 @@
-{ config, pkgs, lib, values, ... }:
+{ config, fp, pkgs, lib, values, ... }:
 {
   imports = [
       # Include the results of the hardware scan.
       ./hardware-configuration.nix
-      ../../base
+      (fp /base)
-      ../../misc/metrics-exporters.nix
+      (fp /misc/metrics-exporters.nix)
 
       ./services/monitoring
       ./services/nginx
     ];
 
-  sops.defaultSopsFile = ../../secrets/ildkule/ildkule.yaml;
+  sops.defaultSopsFile = fp /secrets/ildkule/ildkule.yaml;
   sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
   sops.age.keyFile = "/var/lib/sops-nix/key.txt";
   sops.age.generateKey = true;

hosts/kvernberg/configuration.nix

@@ -1,43 +0,0 @@
-{ config, pkgs, values, ... }:
-{
-  imports = [
-    # Include the results of the hardware scan.
-    ./hardware-configuration.nix
-    ../../base
-    ../../misc/metrics-exporters.nix
-
-    ./disks.nix
-  ];
-
-  sops.defaultSopsFile = ../../secrets/kvernberg/kvernberg.yaml;
-  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
-  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
-  sops.age.generateKey = true;
-
-  boot.loader.systemd-boot.enable = true;
-  boot.loader.efi.canTouchEfiVariables = true;
- 
-  networking.hostName = "kvernberg"; # Define your hostname.
-
-  systemd.network.networks."30-all" = values.defaultNetworkConfig // {
-    matchConfig.Name = "en*";
-    address = with values.hosts.kvernberg; [ (ipv4 + "/25") (ipv6 + "/64") ];
-  };
-
-  # List packages installed in system profile
-  environment.systemPackages = with pkgs; [
-    
-  ];
-
-  # No devices with SMART
-  services.smartd.enable = false;
-
-  # This value determines the NixOS release from which the default
-  # settings for stateful data, like file locations and database versions
-  # on your system were taken. It‘s perfectly fine and recommended to leave
-  # this value at the release version of the first install of this system.
-  # Before changing this value read the documentation for this option
-  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
-  system.stateVersion = "24.05"; # Did you read the comment?
-
-}

hosts/kvernberg/disks.nix

@@ -1,39 +0,0 @@
-# Example to create a bios compatible gpt partition
-{ lib, ... }:
-{
-  disko.devices = {
-    disk.disk1 = {
-      device = lib.mkDefault "/dev/sda";
-      type = "disk";
-      content = {
-        type = "gpt";
-        partitions = {
-          boot = {
-            name = "boot";
-            size = "1M";
-            type = "EF02";
-          };
-          esp = {
-            name = "ESP";
-            size = "500M";
-            type = "EF00";
-            content = {
-              type = "filesystem";
-              format = "vfat";
-              mountpoint = "/boot";
-            };
-          };
-          root = {
-            name = "root";
-            size = "100%";
-            content = {
-              type = "filesystem";
-              format = "ext4";
-              mountpoint = "/";
-            };
-          };
-        };
-      };
-    };
-  };
-}

hosts/kvernberg/services/pvvvvvv/modules/libeufin/bank.nix

@@ -1,93 +0,0 @@
-{
-  lib,
-  config,
-  options,
-  ...
-}:
-{
-  imports = [ (import ./common.nix "bank") ];
-
-  options.services.libeufin.bank = {
-    initialAccounts = lib.mkOption {
-      type = lib.types.listOf lib.types.attrs;
-      description = ''
-        Accounts to enable before the bank service starts.
-
-        This is mainly needed for the nexus currency conversion
-        since the exchange's bank account is expected to be already
-        registered.
-
-        Don't forget to change the account passwords afterwards.
-      '';
-      default = [ ];
-    };
-
-    settings = lib.mkOption {
-      description = ''
-        Configuration options for the libeufin bank system config file.
-
-        For a list of all possible options, please see the man page [`libeufin-bank.conf(5)`](https://docs.taler.net/manpages/libeufin-bank.conf.5.html)
-      '';
-      type = lib.types.submodule {
-        inherit (options.services.libeufin.settings.type.nestedTypes) freeformType;
-        options = {
-          libeufin-bank = {
-            CURRENCY = lib.mkOption {
-              type = lib.types.str;
-              description = ''
-                The currency under which the libeufin-bank should operate.
-
-                This defaults to the GNU taler module's currency for convenience
-                but if you run libeufin-bank separately from taler, you must set
-                this yourself.
-              '';
-            };
-            PORT = lib.mkOption {
-              type = lib.types.port;
-              default = 8082;
-              description = ''
-                The port on which libeufin-bank should listen.
-              '';
-            };
-            SUGGESTED_WITHDRAWAL_EXCHANGE = lib.mkOption {
-              type = lib.types.str;
-              default = "https://exchange.demo.taler.net/";
-              description = ''
-                Exchange that is suggested to wallets when withdrawing.
-
-                Note that, in order for withdrawals to work, your libeufin-bank
-                must be able to communicate with and send money etc. to the bank
-                at which the exchange used for withdrawals has its bank account.
-
-                If you also have your own bank and taler exchange network, you
-                probably want to set one of your exchange's url here instead of
-                the demo exchange.
-
-                This setting must always be set in order for the Android app to
-                not crash during the withdrawal process but the exchange to be
-                used can always be changed in the app.
-              '';
-            };
-          };
-          libeufin-bankdb-postgres = {
-            CONFIG = lib.mkOption {
-              type = lib.types.str;
-              description = ''
-                The database connection string for the libeufin-bank database.
-              '';
-            };
-          };
-        };
-      };
-    };
-  };
-
-  config = {
-    services.libeufin.bank.settings.libeufin-bank.CURRENCY = lib.mkIf (
-      config.services.taler.enable && (config.services.taler.settings.taler ? CURRENCY)
-    ) config.services.taler.settings.taler.CURRENCY;
-
-    services.libeufin.bank.settings.libeufin-bankdb-postgres.CONFIG = lib.mkIf config.services.libeufin.bank.createLocalDatabase "postgresql:///libeufin-bank";
-  };
-}
-

hosts/kvernberg/services/pvvvvvv/modules/libeufin/common.nix

@@ -1,156 +0,0 @@
-# TODO: create a common module generator for Taler and Libeufin?
-libeufinComponent:
-{
-  lib,
-  pkgs,
-  config,
-  ...
-}:
-{
-  options.services.libeufin.${libeufinComponent} = {
-    enable = lib.mkEnableOption "libeufin core banking system and web interface";
-    package = lib.mkPackageOption pkgs "libeufin" { };
-    debug = lib.mkEnableOption "debug logging";
-    createLocalDatabase = lib.mkEnableOption "automatic creation of a local postgres database";
-    openFirewall = lib.mkOption {
-      type = lib.types.bool;
-      default = false;
-      description = "Whether to open ports in the firewall";
-    };
-  };
-
-  config =
-    let
-      cfgMain = config.services.libeufin;
-      cfg = cfgMain.${libeufinComponent};
-
-      serviceName = "libeufin-${libeufinComponent}";
-
-      isNexus = libeufinComponent == "nexus";
-
-      # get database name from config
-      # TODO: should this always be the same db? In which case, should this be an option directly under `services.libeufin`?
-      dbName =
-        lib.removePrefix "postgresql:///"
-          cfg.settings."libeufin-${libeufinComponent}db-postgres".CONFIG;
-
-      bankPort = cfg.settings."${if isNexus then "nexus-httpd" else "libeufin-bank"}".PORT;
-    in
-    lib.mkIf cfg.enable {
-      services.libeufin.settings = cfg.settings;
-
-      # TODO add system-libeufin.slice?
-      systemd.services = {
-        # Main service
-        "${serviceName}" = {
-          serviceConfig = {
-            DynamicUser = true;
-            ExecStart =
-              let
-                args = lib.cli.toGNUCommandLineShell { } {
-                  c = cfgMain.configFile;
-                  L = if cfg.debug then "debug" else null;
-                };
-              in
-              "${lib.getExe' cfg.package "libeufin-${libeufinComponent}"} serve ${args}";
-            Restart = "on-failure";
-            RestartSec = "10s";
-          };
-          requires = [ "libeufin-dbinit.service" ];
-          after = [ "libeufin-dbinit.service" ];
-          wantedBy = [ "multi-user.target" ];
-        };
-
-        # Database Initialisation
-        libeufin-dbinit =
-          let
-            dbScript = pkgs.writers.writeText "libeufin-db-permissions.sql" ''
-              GRANT SELECT,INSERT,UPDATE,DELETE ON ALL TABLES IN SCHEMA libeufin_bank TO "${serviceName}";
-              GRANT SELECT,INSERT,UPDATE,DELETE ON ALL TABLES IN SCHEMA libeufin_nexus TO "${serviceName}";
-              GRANT USAGE ON SCHEMA libeufin_bank TO "${serviceName}";
-              GRANT USAGE ON SCHEMA libeufin_nexus TO "${serviceName}";
-            '';
-
-            # Accounts to be created after the bank database initialization.
-            #
-            # For example, if the bank's currency conversion is enabled, it's
-            # required that the exchange account is registered before the
-            # service starts.
-            initialAccountRegistration = lib.concatMapStringsSep "\n" (
-              account:
-              let
-                args = lib.cli.toGNUCommandLineShell { } {
-                  c = cfgMain.configFile;
-                  inherit (account) username password name;
-                  payto_uri = "payto://x-taler-bank/bank:${toString bankPort}/${account.username}?receiver-name=${account.name}";
-                  exchange = lib.toLower account.username == "exchange";
-                };
-              in
-              "${lib.getExe' cfg.package "libeufin-bank"} create-account ${args}"
-            ) cfg.initialAccounts;
-
-            args = lib.cli.toGNUCommandLineShell { } {
-              c = cfgMain.configFile;
-              L = if cfg.debug then "debug" else null;
-            };
-          in
-          {
-            path = [ config.services.postgresql.package ];
-            serviceConfig = {
-              Type = "oneshot";
-              DynamicUser = true;
-              StateDirectory = "libeufin-dbinit";
-              StateDirectoryMode = "0750";
-              User = dbName;
-            };
-            script = lib.optionalString cfg.enable ''
-              ${lib.getExe' cfg.package "libeufin-${libeufinComponent}"} dbinit ${args}
-            '';
-            # Grant DB permissions after schemas have been created
-            postStart =
-              ''
-                psql -U "${dbName}" -f "${dbScript}"
-              ''
-              + lib.optionalString ((!isNexus) && (cfg.initialAccounts != [ ])) ''
-                # only register initial accounts once
-                if [ ! -e /var/lib/libeufin-dbinit/init ]; then
-                  ${initialAccountRegistration}
-                  touch /var/lib/libeufin-dbinit/init
-                  echo "Bank initialisation complete"
-                fi
-              '';
-            requires = lib.optionals cfg.createLocalDatabase [ "postgresql.service" ];
-            after = [ "network.target" ] ++ lib.optionals cfg.createLocalDatabase [ "postgresql.service" ];
-          };
-      };
-
-      networking.firewall = lib.mkIf cfg.openFirewall {
-        allowedTCPPorts = [
-          bankPort
-        ];
-      };
-
-      environment.systemPackages = [ cfg.package ];
-
-      services.postgresql = lib.mkIf cfg.createLocalDatabase {
-        enable = true;
-        ensureDatabases = [ dbName ];
-        ensureUsers = [
-          { name = serviceName; }
-          {
-            name = dbName;
-            ensureDBOwnership = true;
-          }
-        ];
-      };
-
-      assertions = [
-        {
-          assertion =
-            cfg.createLocalDatabase || (cfg.settings."libeufin-${libeufinComponent}db-postgres" ? CONFIG);
-          message = "Libeufin ${libeufinComponent} database is not configured.";
-        }
-      ];
-
-    };
-}

hosts/kvernberg/services/pvvvvvv/modules/libeufin/module.nix

@@ -1,29 +0,0 @@
-{
-  lib,
-  pkgs,
-  config,
-  ...
-}:
-
-let
-  cfg = config.services.libeufin;
-  settingsFormat = pkgs.formats.ini { };
-in
-
-{
-  options.services.libeufin = {
-    configFile = lib.mkOption {
-      internal = true;
-      default = settingsFormat.generate "generated-libeufin.conf" cfg.settings;
-    };
-    settings = lib.mkOption {
-      description = "Global configuration options for the libeufin bank system config file.";
-      type = lib.types.submodule { freeformType = settingsFormat.type; };
-      default = { };
-    };
-  };
-
-  config = lib.mkIf (cfg.bank.enable || cfg.nexus.enable) {
-    environment.etc."libeufin/libeufin.conf".source = cfg.configFile;
-  };
-}

hosts/kvernberg/services/pvvvvvv/modules/libeufin/nexus.nix

@@ -1,127 +0,0 @@
-{
-  lib,
-  config,
-  options,
-  ...
-}:
-{
-  imports = [ (import ./common.nix "nexus") ];
-
-  options.services.libeufin.nexus.settings = lib.mkOption {
-    description = ''
-      Configuration options for the libeufin nexus config file.
-      For a list of all possible options, please see the man page [`libeufin-nexus.conf(5)`](https://docs.taler.net/manpages/libeufin-nexus.conf.5.html)
-    '';
-    type = lib.types.submodule {
-      inherit (options.services.libeufin.settings.type.nestedTypes) freeformType;
-      options = {
-        nexus-ebics = {
-          # Mandatory configuration values
-          # https://docs.taler.net/libeufin/nexus-manual.html#setting-up-the-ebics-subscriber
-          # https://docs.taler.net/libeufin/setup-ebics-at-postfinance.html
-          CURRENCY = lib.mkOption {
-            description = "Name of the fiat currency.";
-            type = lib.types.nonEmptyStr;
-            example = "CHF";
-          };
-          HOST_BASE_URL = lib.mkOption {
-            description = "URL of the EBICS server.";
-            type = lib.types.nonEmptyStr;
-            example = "https://ebics.postfinance.ch/ebics/ebics.aspx";
-          };
-          BANK_DIALECT = lib.mkOption {
-            description = ''
-              Name of the following combination: EBICS version and ISO20022
-              recommendations that Nexus would honor in the communication with the
-              bank.
-              Currently only the "postfinance" or "gls" value is supported.
-            '';
-            type = lib.types.enum [
-              "postfinance"
-              "gls"
-            ];
-            example = "postfinance";
-          };
-          HOST_ID = lib.mkOption {
-            description = "Name of the EBICS host.";
-            type = lib.types.nonEmptyStr;
-            example = "PFEBICS";
-          };
-          USER_ID = lib.mkOption {
-            description = ''
-              User ID of the EBICS subscriber.
-              This value must be assigned by the bank after having activated a new EBICS subscriber.
-            '';
-            type = lib.types.nonEmptyStr;
-            example = "PFC00563";
-          };
-          PARTNER_ID = lib.mkOption {
-            description = ''
-              Partner ID of the EBICS subscriber.
-              This value must be assigned by the bank after having activated a new EBICS subscriber.
-            '';
-            type = lib.types.nonEmptyStr;
-            example = "PFC00563";
-          };
-          IBAN = lib.mkOption {
-            description = "IBAN of the bank account that is associated with the EBICS subscriber.";
-            type = lib.types.nonEmptyStr;
-            example = "CH7789144474425692816";
-          };
-          BIC = lib.mkOption {
-            description = "BIC of the bank account that is associated with the EBICS subscriber.";
-            type = lib.types.nonEmptyStr;
-            example = "POFICHBEXXX";
-          };
-          NAME = lib.mkOption {
-            description = "Legal entity that is associated with the EBICS subscriber.";
-            type = lib.types.nonEmptyStr;
-            example = "John Smith S.A.";
-          };
-          BANK_PUBLIC_KEYS_FILE = lib.mkOption {
-            type = lib.types.path;
-            default = "/var/lib/libeufin-nexus/bank-ebics-keys.json";
-            description = ''
-              Filesystem location where Nexus should store the bank public keys.
-            '';
-          };
-          CLIENT_PRIVATE_KEYS_FILE = lib.mkOption {
-            type = lib.types.path;
-            default = "/var/lib/libeufin-nexus/client-ebics-keys.json";
-            description = ''
-              Filesystem location where Nexus should store the subscriber private keys.
-            '';
-          };
-        };
-        nexus-httpd = {
-          PORT = lib.mkOption {
-            type = lib.types.port;
-            default = 8084;
-            description = ''
-              The port on which libeufin-bank should listen.
-            '';
-          };
-        };
-        libeufin-nexusdb-postgres = {
-          CONFIG = lib.mkOption {
-            type = lib.types.str;
-            description = ''
-              The database connection string for the libeufin-nexus database.
-            '';
-          };
-        };
-      };
-    };
-  };
-
-  config =
-    let
-      cfgMain = config.services.libeufin;
-      cfg = config.services.libeufin.nexus;
-    in
-    lib.mkIf cfg.enable {
-      services.libeufin.nexus.settings.libeufin-nexusdb-postgres.CONFIG = lib.mkIf (
-        cfgMain.bank.enable && cfgMain.bank.createLocalDatabase
-      ) "postgresql:///libeufin-bank";
-    };
-}

hosts/kvernberg/services/pvvvvvv/modules/module-list.nix

@@ -1,10 +0,0 @@
-{
-  imports = [
-    ./libeufin/bank.nix
-    ./libeufin/module.nix
-    ./libeufin/nexus.nix
-    ./taler/exchange.nix
-    ./taler/merchant.nix
-    ./taler/module.nix
-  ];
-}

hosts/kvernberg/services/pvvvvvv/modules/taler/common.nix

@@ -1,117 +0,0 @@
-# TODO: create a common module generator for Taler and Libeufin?
-{
-  talerComponent ? "",
-  servicesDB ? [ ],
-  servicesNoDB ? [ ],
-  ...
-}:
-{
-  lib,
-  pkgs,
-  config,
-  ...
-}:
-let
-  cfg = cfgTaler.${talerComponent};
-  cfgTaler = config.services.taler;
-  settingsFormat = pkgs.formats.ini { };
-
-  services = servicesDB ++ servicesNoDB;
-
-  dbName = "taler-${talerComponent}-httpd";
-  groupName = "taler-${talerComponent}-services";
-
-  inherit (cfgTaler) runtimeDir;
-in
-{
-  options = {
-    services.taler.${talerComponent} = {
-      enable = lib.mkEnableOption "the GNU Taler ${talerComponent}";
-      package = lib.mkPackageOption pkgs "taler-${talerComponent}" { };
-      # TODO: make option accept multiple debugging levels?
-      debug = lib.mkEnableOption "debug logging";
-      openFirewall = lib.mkOption {
-        type = lib.types.bool;
-        default = false;
-        description = "Whether to open ports in the firewall";
-      };
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    services.taler.enable = cfg.enable;
-
-    systemd.services = lib.mergeAttrsList [
-      # Main services
-      (lib.genAttrs (map (n: "taler-${talerComponent}-${n}") services) (name: {
-        serviceConfig = {
-          DynamicUser = true;
-          User = name;
-          Group = groupName;
-          ExecStart = toString [
-            (lib.getExe' cfg.package name)
-            "-c /etc/taler/taler.conf"
-            (lib.optionalString cfg.debug " -L debug")
-          ];
-          RuntimeDirectory = name;
-          StateDirectory = name;
-          CacheDirectory = name;
-          ReadWritePaths = [ runtimeDir ];
-          Restart = "always";
-          RestartSec = "10s";
-        };
-        requires = [ "taler-${talerComponent}-dbinit.service" ];
-        after = [ "taler-${talerComponent}-dbinit.service" ];
-        wantedBy = [ "multi-user.target" ]; # TODO slice?
-      }))
-      # Database Initialisation
-      {
-        "taler-${talerComponent}-dbinit" = {
-          path = [ config.services.postgresql.package ];
-          serviceConfig = {
-            Type = "oneshot";
-            DynamicUser = true;
-            User = dbName;
-            Restart = "on-failure";
-            RestartSec = "5s";
-          };
-          requires = [ "postgresql.service" ];
-          after = [ "postgresql.service" ];
-        };
-      }
-    ];
-
-    users.groups.${groupName} = { };
-    systemd.tmpfiles.settings = {
-      "10-taler-${talerComponent}" = {
-        "${runtimeDir}" = {
-          d = {
-            group = groupName;
-            user = "nobody";
-            mode = "070";
-          };
-        };
-      };
-    };
-
-    networking.firewall = lib.mkIf cfg.openFirewall {
-      allowedTCPPorts = [ cfg.settings."${talerComponent}".PORT ];
-    };
-
-    environment.systemPackages = [ cfg.package ];
-
-    services.taler.includes = [ "/etc/taler/conf.d/${talerComponent}.conf" ];
-    environment.etc."taler/conf.d/${talerComponent}.conf".source = settingsFormat.generate "generated-taler.conf" cfg.settings;
-
-    services.postgresql = {
-      enable = true;
-      ensureDatabases = [ dbName ];
-      ensureUsers = map (service: { name = "taler-${talerComponent}-${service}"; }) servicesDB ++ [
-        {
-          name = dbName;
-          ensureDBOwnership = true;
-        }
-      ];
-    };
-  };
-}

hosts/kvernberg/services/pvvvvvv/modules/taler/exchange.nix

@@ -1,143 +0,0 @@
-{
-  lib,
-  config,
-  options,
-  pkgs,
-  ...
-}:
-
-let
-  cfg = cfgTaler.exchange;
-  cfgTaler = config.services.taler;
-
-  talerComponent = "exchange";
-
-  # https://docs.taler.net/taler-exchange-manual.html#services-users-groups-and-file-system-hierarchy
-  servicesDB = [
-    "httpd"
-    "aggregator"
-    "closer"
-    "wirewatch"
-  ];
-
-  servicesNoDB = [
-    "secmod-cs"
-    "secmod-eddsa"
-    "secmod-rsa"
-  ];
-in
-
-{
-  imports = [
-    (import ./common.nix { inherit talerComponent servicesDB servicesNoDB; })
-  ];
-
-  options.services.taler.exchange = {
-    settings = lib.mkOption {
-      description = ''
-        Configuration options for the taler exchange config file.
-        For a list of all possible options, please see the man page [`taler.conf(5)`](https://docs.taler.net/manpages/taler.conf.5.html#exchange-options)
-      '';
-      type = lib.types.submodule {
-        inherit (options.services.taler.settings.type.nestedTypes) freeformType;
-        options = {
-          # TODO: do we want this to be a sub-attribute or only define the exchange set of options here
-          exchange = {
-            AML_THRESHOLD = lib.mkOption {
-              type = lib.types.str;
-              default = "${cfgTaler.settings.taler.CURRENCY}:1000000";
-              defaultText = "1000000 in {option}`CURRENCY`";
-              description = "Monthly transaction volume until an account is considered suspicious and flagged for AML review.";
-            };
-            DB = lib.mkOption {
-              type = lib.types.str;
-              internal = true;
-              default = "postgres";
-            };
-            MASTER_PUBLIC_KEY = lib.mkOption {
-              type = lib.types.str;
-              default = throw ''
-                You must provide `MASTER_PUBLIC_KEY` with the public part of your master key.
-                This will be used by the auditor service to get information about the exchange.
-                For more information, see https://docs.taler.net/taler-auditor-manual.html#initial-configuration
-                To generate this key, you must run `taler-exchange-offline setup`. It will print the public key.
-              '';
-              defaultText = "None, you must set this yourself.";
-              description = "Used by the exchange to verify information signed by the offline system.";
-            };
-            PORT = lib.mkOption {
-              type = lib.types.port;
-              default = 8081;
-              description = "Port on which the HTTP server listens.";
-            };
-          };
-          exchangedb-postgres = {
-            CONFIG = lib.mkOption {
-              type = lib.types.str;
-              internal = true;
-              default = "postgres:///taler-exchange-httpd";
-              description = "Database connection URI.";
-            };
-          };
-        };
-      };
-      default = { };
-    };
-    denominationConfig = lib.mkOption {
-      type = lib.types.lines;
-      defaultText = "None, you must set this yourself.";
-      example = ''
-        [COIN-KUDOS-n1-t1718140083]
-        VALUE = KUDOS:0.1
-        DURATION_WITHDRAW = 7 days
-        DURATION_SPEND = 2 years
-        DURATION_LEGAL = 6 years
-        FEE_WITHDRAW = KUDOS:0
-        FEE_DEPOSIT = KUDOS:0.1
-        FEE_REFRESH = KUDOS:0
-        FEE_REFUND = KUDOS:0
-        RSA_KEYSIZE = 2048
-        CIPHER = RSA
-      '';
-      description = ''
-        This option configures the cash denomination for the coins that the exchange offers.
-        For more information, consult the [upstream docs](https://docs.taler.net/taler-exchange-manual.html#coins-denomination-keys).
-        You can either write these manually or you can use the `taler-harness deployment gen-coin-config`
-        command to generate it.
-        Warning: Do not modify existing denominations after deployment.
-        Please see the upstream docs for how to safely do that.
-      '';
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    services.taler.includes = [
-      (pkgs.writers.writeText "exchange-denominations.conf" cfg.denominationConfig)
-    ];
-
-    systemd.services.taler-exchange-wirewatch = {
-      requires = [ "taler-exchange-httpd.service" ];
-      after = [ "taler-exchange-httpd.service" ];
-    };
-
-    # Taken from https://docs.taler.net/taler-exchange-manual.html#exchange-database-setup
-    # TODO: Why does aggregator need DELETE?
-    systemd.services."taler-${talerComponent}-dbinit".script =
-      let
-        deletePerm = name: lib.optionalString (name == "aggregator") ",DELETE";
-        dbScript = pkgs.writers.writeText "taler-exchange-db-permissions.sql" (
-          lib.pipe servicesDB [
-            (map (name: ''
-              GRANT SELECT,INSERT,UPDATE${deletePerm name} ON ALL TABLES IN SCHEMA exchange TO "taler-exchange-${name}";
-              GRANT USAGE ON SCHEMA exchange TO "taler-exchange-${name}";
-            ''))
-            lib.concatStrings
-          ]
-        );
-      in
-      ''
-        ${lib.getExe' cfg.package "taler-exchange-dbinit"}
-        psql -U taler-exchange-httpd -f ${dbScript}
-      '';
-  };
-}

hosts/kvernberg/services/pvvvvvv/modules/taler/merchant.nix

@@ -1,108 +0,0 @@
-{
-  lib,
-  config,
-  options,
-  pkgs,
-  ...
-}:
-let
-  cfg = cfgTaler.merchant;
-  cfgTaler = config.services.taler;
-
-  talerComponent = "merchant";
-
-  # https://docs.taler.net/taler-merchant-manual.html#launching-the-backend
-  servicesDB = [
-    "httpd"
-    "webhook"
-    "wirewatch"
-    "depositcheck"
-    "exchange"
-  ];
-in
-{
-  imports = [
-    (import ./common.nix { inherit talerComponent servicesDB; })
-  ];
-
-  options.services.taler.merchant = {
-    settings = lib.mkOption {
-      description = ''
-        Configuration options for the taler merchant config file.
-        For a list of all possible options, please see the man page [`taler.conf(5)`](https://docs.taler.net/manpages/taler.conf.5.html#merchant-options)
-      '';
-      type = lib.types.submodule {
-        inherit (options.services.taler.settings.type.nestedTypes) freeformType;
-        options = {
-          # TODO: do we want this to be a sub-attribute or only define the merchant set of options here
-          merchant = {
-            DB = lib.mkOption {
-              type = lib.types.str;
-              internal = true;
-              default = "postgres";
-              description = "Plugin to use for the database.";
-            };
-            PORT = lib.mkOption {
-              type = lib.types.port;
-              default = 8083;
-              description = "Port on which the HTTP server listens.";
-            };
-            SERVE = lib.mkOption {
-              type = lib.types.str;
-              default = "tcp";
-              description = ''
-                Whether the HTTP server should listen on a UNIX domain socket ("unix") or on a TCP socket ("tcp").
-              '';
-            };
-            LEGAL_PRESERVATION = lib.mkOption {
-              type = lib.types.str;
-              internal = true;
-              default = "10 years";
-              description = "How long to keep data in the database for tax audits after the transaction has completed.";
-            };
-          };
-          merchantdb-postgres = {
-            CONFIG = lib.mkOption {
-              type = lib.types.str;
-              internal = true;
-              default = "postgres:///taler-${talerComponent}-httpd";
-              description = "Database connection URI.";
-            };
-            SQL_DIR = lib.mkOption {
-              type = lib.types.str;
-              internal = true;
-              default = "${cfg.package}/share/taler/sql/merchant/";
-              description = "The location for the SQL files to setup the database tables.";
-            };
-          };
-        };
-      };
-      default = { };
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    systemd.services.taler-merchant-depositcheck = {
-      # taler-merchant-depositcheck needs its executable is in the PATH
-      # NOTE: couldn't use `lib.getExe` to only get that single executable
-      path = [ cfg.package ];
-    };
-
-    systemd.services."taler-${talerComponent}-dbinit".script =
-      let
-        # NOTE: not documented, but is necessary
-        dbScript = pkgs.writers.writeText "taler-merchant-db-permissions.sql" (
-          lib.concatStrings (
-            map (name: ''
-              GRANT SELECT,INSERT,UPDATE,DELETE ON ALL TABLES IN SCHEMA merchant TO "taler-merchant-${name}";
-              GRANT USAGE ON SCHEMA merchant TO "taler-merchant-${name}";
-            '') servicesDB
-          )
-        );
-      in
-      ''
-        ${lib.getExe' cfg.package "taler-merchant-dbinit"}
-        psql -U taler-${talerComponent}-httpd -f ${dbScript}
-      '';
-  };
-}

hosts/kvernberg/services/pvvvvvv/modules/taler/module.nix

@@ -1,89 +0,0 @@
-{
-  lib,
-  pkgs,
-  config,
-  ...
-}:
-
-let
-  cfg = config.services.taler;
-  settingsFormat = pkgs.formats.ini { };
-in
-
-{
-  # TODO turn this into a generic taler-like service thingy?
-  options.services.taler = {
-    enable = lib.mkEnableOption "the GNU Taler system" // lib.mkOption { internal = true; };
-    includes = lib.mkOption {
-      type = lib.types.listOf lib.types.path;
-      default = [ ];
-      description = ''
-        Files to include into the config file using Taler's `@inline@` directive.
-        This allows including arbitrary INI files, including imperatively managed ones.
-      '';
-    };
-    settings = lib.mkOption {
-      description = ''
-        Global configuration options for the taler config file.
-        For a list of all possible options, please see the man page [`taler.conf(5)`](https://docs.taler.net/manpages/taler.conf.5.html)
-      '';
-      type = lib.types.submodule {
-        freeformType = settingsFormat.type;
-        options = {
-          taler = {
-            CURRENCY = lib.mkOption {
-              type = lib.types.nonEmptyStr;
-              description = ''
-                The currency which taler services will operate with. This cannot be changed later.
-              '';
-            };
-            CURRENCY_ROUND_UNIT = lib.mkOption {
-              type = lib.types.str;
-              default = "${cfg.settings.taler.CURRENCY}:0.01";
-              defaultText = lib.literalExpression ''
-                "''${config.services.taler.settings.taler.CURRENCY}:0.01"
-              '';
-              description = ''
-                Smallest amount in this currency that can be transferred using the underlying RTGS.
-                You should probably not touch this.
-              '';
-            };
-          };
-        };
-      };
-      default = { };
-    };
-    runtimeDir = lib.mkOption {
-      type = lib.types.str;
-      default = "/run/taler-system-runtime/";
-      description = ''
-        Runtime directory shared between the taler services.
-        Crypto helpers put their sockets here for instance and the httpd
-        connects to them.
-      '';
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    services.taler.settings.PATHS = {
-      TALER_DATA_HOME = "\${STATE_DIRECTORY}/";
-      TALER_CACHE_HOME = "\${CACHE_DIRECTORY}/";
-      TALER_RUNTIME_DIR = cfg.runtimeDir;
-    };
-
-    environment.etc."taler/taler.conf".source =
-      let
-        includes = pkgs.writers.writeText "includes.conf" (
-          lib.concatStringsSep "\n" (map (include: "@inline@ ${include}") cfg.includes)
-        );
-        generatedConfig = settingsFormat.generate "generated-taler.conf" cfg.settings;
-      in
-      pkgs.runCommand "taler.conf" { } ''
-        cat ${includes} > $out
-        echo >> $out
-        echo >> $out
-        cat ${generatedConfig} >> $out
-      '';
-
-  };
-}

hosts/shark/configuration.nix

@@ -1,13 +1,13 @@
-{ config, pkgs, values, ... }:
+{ config, fp, pkgs, values, ... }:
 {
   imports = [
       # Include the results of the hardware scan.
       ./hardware-configuration.nix
-      ../../base
+      (fp /base)
-      ../../misc/metrics-exporters.nix
+      (fp /misc/metrics-exporters.nix)
     ];
 
-  sops.defaultSopsFile = ../../secrets/shark/shark.yaml;
+  sops.defaultSopsFile = fp /secrets/shark/shark.yaml;
   sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
   sops.age.keyFile = "/var/lib/sops-nix/key.txt";
   sops.age.generateKey = true;

hosts/tuba/configuration.nix

@@ -0,0 +1,36 @@
+{ config, pkgs, values, ... }:
+{
+  imports = [
+      # Include the results of the hardware scan.
+      ./hardware-configuration.nix
+      ../../base.nix
+      ../../misc/metrics-exporters.nix
+
+      ./services/openvpn
+    ];
+
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  networking.hostName = "tuba";
+
+  # systemd.network.networks."30-eno1" = values.defaultNetworkConfig // {
+  #   matchConfig.Name = "eno1";
+  #   address = with values.hosts.georg; [ (ipv4 + "/25") (ipv6 + "/64") ];
+  # };
+
+  # List packages installed in system profile
+  environment.systemPackages = with pkgs; [
+  ];
+
+  # List services that you want to enable:
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "23.05"; # Did you read the comment?
+
+}

hosts/tuba/hardware-configuration.nix

@@ -0,0 +1,40 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/33825f0d-5a63-40fc-83db-bfa1ebb72ba0";
+      fsType = "ext4";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/145E-7362";
+      fsType = "vfat";
+    };
+
+  swapDevices =
+    [ { device = "/dev/disk/by-uuid/7ed27e21-3247-44cd-8bcc-5d4a2efebf57"; }
+    ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.eno1.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp2s2.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/tuba/services/openvpn/default.nix

@@ -0,0 +1,54 @@
+{ lib, values, ... }:
+{
+  services.openvpn.servers."ov-tunnel" = {
+    config = let
+      conf = {
+        # TODO: use aliases
+        client = true;
+        dev = "tap";
+        proto = "udp";
+        remote = "129.241.210.191 1194";
+
+        resolv-retry = "infinite";
+        nobind = true;
+
+        # # TODO: set up
+        ca = "";
+        cert = "";
+        key = "";
+        remote-cert-tls = "server";
+        cipher = "none";
+
+        user = "nobody";
+        group = "nobody";
+
+        status = "/var/log/openvpn-status.log";
+
+        persist-key = true;
+        persist-tun = true;
+
+        verb = 5;
+
+        # script-security = 2;
+        # up = "systemctl restart rwhod";
+      };
+    in lib.pipe conf [
+      (lib.filterAttrs (_: value: !(builtins.isNull value || value == false)))
+      (builtins.mapAttrs (_: value:
+        if builtins.isList value then builtins.concatStringsSep " " (map toString value)
+        else if value == true then value
+        else if builtins.any (f: f value) [
+          builtins.isString
+          builtins.isInt
+          builtins.isFloat
+          lib.isPath
+          lib.isDerivation
+        ] then toString value
+        else throw "Unknown value in tuba openvpn config, deading now\n${value}"
+      ))
+      (lib.mapAttrsToList (name: value: if value == true then name else "${name} ${value}"))
+      (builtins.concatStringsSep "\n")
+      (x: x + "\n\n")
+    ];
+  };
+}

hosts/ustetind/configuration.nix

@@ -0,0 +1,44 @@
+{ config, fp, pkgs, lib, values, ... }:
+
+{
+  imports = [
+    (fp /base)
+    (fp /misc/metrics-exporters.nix)
+
+    ./services/gitea-runners.nix
+  ];
+
+  sops.defaultSopsFile = fp /secrets/ustetind/ustetind.yaml;
+  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
+  sops.age.generateKey = true;
+
+  networking.hostName = "ustetind";
+
+  networking.useHostResolvConf = lib.mkForce false;
+
+  systemd.network.networks = {
+    "30-lxc-eth" = values.defaultNetworkConfig // {
+      matchConfig = {
+        Type = "ether";
+        Kind = "veth";
+        Name = [
+          "eth*"
+        ];
+      };
+      address = with values.hosts.ustetind; [ (ipv4 + "/25") (ipv6 + "/64") ];
+    };
+    "40-podman-veth" = values.defaultNetworkConfig // {
+      matchConfig = {
+        Type = "ether";
+        Kind = "veth";
+        Name = [
+          "veth*"
+        ];
+      };
+      DHCP = "yes";
+    };
+  };
+
+  system.stateVersion = "24.11";
+}

hosts/ustetind/services/gitea-runners.nix

@@ -27,5 +27,15 @@ lib.mkMerge [
   (mkRunner "alpha")
   (mkRunner "beta")
   (mkRunner "epsilon")
-  { virtualisation.podman.enable = true; }
+  {
+    virtualisation.podman = {
+      enable = true;
+      defaultNetwork.settings.dns_enabled = true;
+      autoPrune.enable = true;
+    };
+
+    networking.dhcpcd.IPv6rs = false;
+
+    networking.firewall.interfaces."podman+".allowedUDPPorts = [53 5353];
+  }
 ]

secrets/bekkalokk/bekkalokk.yaml

@@ -5,12 +5,9 @@ gitea:
     database: ENC[AES256_GCM,data:UlS33IdCEyeSvT6ngpmnkBWHuSEqsB//DT+3b7C+UwbD8UXWJlsLf1X8/w==,iv:mPRW5ldyZaHP+y/0vC2JGSLZmlkhgmkvXPk4LazkSDs=,tag:gGk6Z/nbPvzE1zG+tJC8Sw==,type:str]
     email-password: ENC[AES256_GCM,data:KRwC+aL1aPvJuXt91Oq1ttATMnFTnuUy,iv:ats8TygB/2pORkaTZzPOLufZ9UmvVAKoRcWNvYF1z6w=,tag:Do0fA+4cZ3+l7JJyu8hjBg==,type:str]
     passwd-ssh-key: ENC[AES256_GCM,data:L0lF0wvpayss1NU9m3A45cH0bCMQzODTFVrq6EPd1JHx54wIcoaRBYLmxXKXASzBlCg9zlwXMUIk3OQcS3kdzMKL0iqcSL2iicAcKjFIHyrWLqXgwV5pRSP/tRPcVw8KW8gz0bh33EgESs5ReddZ3VZ0Cy1s2YupMRQvBXr89k1+Hv70OWB6P06hvxhv/zKcMGI1N/dWLroMgrQuT9imw4+/Q1RqwzTYeEU+eUn24AM9GjcBg4qf3OI+6g0nXUat/upIYE28iF5J3lbUSmDSmirBLc8xgHLdOyyJPTObWYWYxlSL78T7IqiMm9lI3rtBlpJDDcn/YxZpVqN5bg2154GISNK+uR0TVSLdJ+drdGHIfIX3G78XSxf2L9rbJyRn8MQlgStfdBIQicLavQKVMrmj+XQfvEMez23WbPLjH4oViBQFI+GrOHOGy/f16cz8Sn4n+69OcsOeTxs3tKYdfq6r1XLYSJ/fe/zvxBpaZiyGXljsuyEdIyBL2A8D6uSXe3Nd3/DAdBtceFfIdN1olCdutixzVWgxaJnrel161z5A/4w=,iv:Uy46yY3jFYSvpxrgCHxRMUksnWfhf5DViLMvCXVMMl4=,tag:wFEJ5+icFrOKkc56gY0A5g==,type:str]
+    gpg-signing-key: ENC[AES256_GCM,data:y/g1rpsEgiGEJ9BGii6te166ABpg1jgsyYMT1Ji5njLbT8/juBBMc7BFEM5BcIxKpQGijymsB+Htl8CZAN4Bl3FHSRyrnXGuMCnveJfw1qTVjMa6soriHv7EdTDFPCp3TYMbs1OgY/bhGJIvp8e4hCVd4F3x8eAlFmiwHhkxr62qQNHjH7SRNIyUNibf/TTttOeEcercxOy7FeUE99D+CWG4pnJNEYyRHDdddalgpSJyZIJvPpXoKmeCDk3futnxiZ15Vr7bDS5u4dqnE+no7DKoZ5fvk38f/77JH3w/Qom7NCYSG6L+unJ3r3RKuuGMRDjdz09TPZ4APpmrlyOElfGMmm134g6mdhgXmwNCo65Z7VOd1OKFA/uyZm2b7XsT3tCgRalE8gBa0R3MBMi3JK+5KUdS6ZUvYXDt8D8C68ldM3K9E7lyeeHn775rV6L4JIXcj/NL1O23sXtjeVuUPQmsUesgYlllRaiTSTfY7K+yOIG3wqqCuCDSAeILQICkvod4iw4xdVMQzd8eQtbD6bCjOzHwvBcu+rOSN6ti+xOQ7bJ9+6xhCgJJsiADkp2q09cUu8mDbUh+YJxfu+oZhPomOJVDMSqfS4qNXcVM9mbak/L9KPR4b83GqTpmXHnDMlGe4BHGXrkIUKPsBQ5TmdckXbpRDBQFrnjVvFT+Gfx3xwHxWc9fbxcFID2wp69EzQrGC77bDPCFxBT5vAVwffGYUezPQEo25bKRpCWxTFTpiIQfACrwzZc/O9cmwDgrYN7bTZyrrp8cbyBtllZGYmXxLDkDOzIqzpLG3b0yJC2jSnw0f1DkU6M2mD/j9FRTVW1MVymyLPiZQ7T9QyZ3MekHEEY1QqmyiJMIOekSzC5+3Us6Nl32MeBrIry6NuV8ewIQF5bcZEHtSmZ0k/wBtK0fpFHUuc/vETFuRUiQw/InhN5W8iH78vFvflxBfg61Qp7PzEx0k0axwEc6VAKbEg/uFNL+fhUKKt7sYiEBmwg2Vsj3pyZgdmjPZEsOQ86+psaxv+2feH94wog47jDHFRrc4iRC5w7kZ6UJXHfZt9lkBbwl4qNwiOLlPnUUcR+CpTBpPoKD9ulidQGfcYY49+iE+PM5dAI2CtisKpLQiwmrvjOzB1a/rC9QnH679frgH5Ebb57WRL4uSAVNRdIvIGzAF5MNwQOu+cxKoiW6ZmuNJSb547XUB1UO,iv:aKzrgAV30sLfPEpgdQ26ZzdM3+gYtoSpZ9mNyqCqf/M=,tag:vjywN4qxh2zsCE3RPG6Yrw==,type:str]
     ssh-known-hosts: ENC[AES256_GCM,data:zlRLoelQeumMxGqPmgMTB69X1RVWXIs2jWwc67lk0wrdNOHUs5UzV5TUA1JnQ43RslBU92+js7DkyvE5enGzw7zZE5F1ZYdGv/eCgvkTMC9BoLfzHzP6OzayPLYEt3xJ5PRocN8JUAD55cuu4LgsuebuydHPi2oWOfpbSUBKSeCh6dvk5Pp1XRDprPS5SzGLW8Xjq98QlzmfGv50meI9CDJZVF9Wq/72gkyfgtb3YVdr,iv:AF06TBitHegfWk6w07CdkHklh4ripQCmA45vswDQgss=,tag:zKh7WVXMJN2o9ZIwIkby3Q==,type:str]
     import-user-env: ENC[AES256_GCM,data:wArFwTd0ZoB4VXHPpichfnmykxGxN8y2EQsMgOPHv7zsm6A+m2rG9BWDGskQPr5Ns9o=,iv:gPUzYFSNoALJb1N0dsbNlgHIb7+xG7E9ANpmVNZURQ0=,tag:JghfRy2OcDFWKS9zX1XJ9A==,type:str]
-    runners:
-        alpha: ENC[AES256_GCM,data:gARxCufePz+EMVwEwRsL2iZUfh9HUowWqtb7Juz3fImeeAdbt+k3DvL/Nwgegg==,iv:3fEaWd7v7uLGTy2J7EFQGfN0ztI0uCOJRz5Mw8V5UOU=,tag:Aa6LwWeW2hfDz1SqEhUJpA==,type:str]
-        beta: ENC[AES256_GCM,data:DVjS78IKWiWgf+PuijCZKx4ZaEJGhQr7vl+lc7QOg1JlA4p9Kux/tOD8+f2+jA==,iv:tk3Xk7lKWNdZ035+QVIhxXy2iJbHwunI4jRFM4It46E=,tag:9Mr6o//svYEyYhSvzkOXMg==,type:str]
-        epsilon: ENC[AES256_GCM,data:JMnZVBdiy+5oPyXgDpfYvy7qLzIEfHy09fQSBDpNG4zDXTil2pSKBKxk09h5xg==,iv:/8oXKJW6+sMBjDt51MqVAWjQPM5nk02Lv5QqbZsZ5ms=,tag:+Rx7ursfVWc0EcExCLgLhQ==,type:str]
 mediawiki:
     password: ENC[AES256_GCM,data:HsBuA1E7187roGnKuFPfPDYxA16GFjAUucgUtrdUFmcOzmTNiFH+NWY2ZQ==,iv:vDYUmmZftcrkDtJxNYKAJSx9j+AQcmQarC62QRHR4IM=,tag:3TKjNrGRivFWoK3djC748g==,type:str]
     postgres_password: ENC[AES256_GCM,data:XIOmrOVXWvMMcPJtmovhdyZvLlhmrsrwjuMMkdEY1NIXWjevj5XEkp6Cpw==,iv:KMPTRzu3H/ewfEhc/O0q3o230QNkABfPYF/D1SYL2R8=,tag:sFZiFPHWxwzD9HndPmH3pQ==,type:str]
@@ -97,8 +94,8 @@ sops:
             UHpLRkdQTnhkeGlWVG9VS1hkWktyckEKAdwnA9URLYZ50lMtXrU9Q09d0L3Zfsyr
             4UsvjjdnFtsXwEZ9ZzOQrpiN0Oz24s3csw5KckDni6kslaloJZsLGg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-10-12T21:56:27Z"
+    lastmodified: "2024-12-09T21:18:23Z"
-    mac: ENC[AES256_GCM,data:bZ1BbVC6D+B6SFze2ReeCUcQamK/O14zH3YxCjWBwMC++w3niIiEx4Bq7Ulci5yuMld0luVsfUzHoqFN/+zvZbV2rGVk8lVRiTrpFoSZ78aUUgeHG9ROLXsR7T7rVhLWbl86y1G5LcKws7G55V0wAh6f58WjYYzwR8fnBmfW1Ko=,iv:7xtMdtXQB9uZirE/CkUSmeu0qnG++R7DUR7zn/Bo0lM=,tag:DH/BJPpAp//quDqKNXyHcg==,type:str]
+    mac: ENC[AES256_GCM,data:scdduZPcJZgeT9LarRgxVr/obYsGrJAbMoLGJPPPp19qxOJMTdvYfMz8bxPjCikB4MacEgVZmcnKIn5aCzHJAnCI/7F2wm1DDtW9ZI5qbhDJKSSld+m2leOSPfR8VY/0qj6UNgGnwkwx7dfcAlv8cP2Sp3o1M2oyQxeXPr5FWEg=,iv:JEAwkCewMp0ERmYU62kZkbl7+FET1ZeRr6xeEwt6ioM=,tag:jxvli935X3JyZYe7fFbnLg==,type:str]
     pgp:
         - created_at: "2024-08-04T00:03:28Z"
           enc: |-

secrets/ustetind/ustetind.yaml

@@ -0,0 +1,90 @@
+gitea:
+    runners:
+        alpha: ENC[AES256_GCM,data:aAFv+/ygC7oxGT3qnoEf+AZL3Nk1yOq3HupL9l0j8P913GefPKqlBt/mbuRVug==,iv:usXElENwbOHxUdoqHScK7PjeZavXUwoxpQWEMjxU2u4=,tag:E8OzZ9pmxIru7Glgh7v0lg==,type:str]
+        beta: ENC[AES256_GCM,data:riRSBDzX9DAxKl2UCds1ANddl3ij+byAgigOafJ5RjWl8cNVlowK21klBiKTxw==,iv:clijEUKX9o52p5A94eEW0f8qGGhFpy/LFe+uQG/iQLg=,tag:PchXbsZMnW//O7brEAEeWw==,type:str]
+        epsilon: ENC[AES256_GCM,data:lUt8uaqh9eC1IdIUfiw3dzxcDErSWaiT9lzg4ONf/QZeXj7Do7Es0GXBFd41Hw==,iv:hPm5Lez5ISHIlw1+i4z/oBsh4H5ZXPVYnXXSGq1eal0=,tag:/KcmPw30622tN9ruMUwfUw==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1hffjafs4slznksefmtqrlj7rdaqgzqncn4un938rhr053237ry8s3rs0v8
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIYVl6ZnI5TkhxK0JKNnlL
+            WE5YZUZ2T1JEbCtvSVUxemZ1QUs4R2pjMWc0ClJ0cnU0c0d5bU5jWU1aVGd6WE45
+            Wm9OT0xPaTJ3Y2kxMU5RTHdRKy81b2sKLS0tIEx4SkFoV240VUJieWFlc3hRWU1Y
+            SWlwZnNOT3paRHRsTC9CQUp5SlBvTncKdcMI8pWtsfBpgeUagOmZUXIC6svkfmwE
+            QF3GpWZgeVvo8e2oT2kBjerCDlUlzd0jJ8aK+B56xifTm7ii3oCAIA==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age17tagmpwqjk3mdy45rfesrfey6h863x8wfq38wh33tkrlrywxducs0k6tpq
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3QVBaQWlSZk43dEtHVWF1
+            WmFBcmx3eFUvU2lrd0RCUGx3a2hDWHEzTUR3Cm9BclM3OU9SUnpySDZJZHRudmtO
+            Ulp5OEZvZmMyRGJvQXJnUDVLdVRJUVkKLS0tIHE3M3MycE9pU1huYUREN3luWEZV
+            WlNuN3BWeHhqL1dEOUJBSVNTaVJ3eTgKb5MRfeaay22PI9V5hni5mhnb0QF8PG8H
+            bKWbc2SwdMNolrxhUiiIhdppEtXGHqLyBel786tuOdtEwVcy+m/rtA==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1mrnldl334l2nszuta6ywvewng0fswv2dz9l5g4qcwe3nj4yxf92qjskdx6
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQaDB6enozMFpqcWxFdU93
+            MEg5RTRzZExzWGppenlBTlZZRlpqWDBPT0UwCnhOaXI5R3Jrd0hWY0xqc1VXaDJZ
+            TUxwSTZDcHd0bnZPR2N2d0JVTUJONnMKLS0tIENzOW9PM0tQSndVNmF1bTZ4anpw
+            b1RzL0NEOWg0dGZUa0Jpd3hiTlRGSm8KleRV5c/Xoe0B1VtnR3y0sgXpmhMS8pKl
+            TWaAQTRlM9X2Pk5M/J/bu369ncmw/kycJKjK6W1yluaGwBNuEP+K4Q==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1hmpdk4h69wxpwqk9tkud39f66hprhehxtzhgw97r6dvr7v0mx5jscsuhkn
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0N1JvRVE0Y0xOMERMVXdB
+            enZiNk1DZTJTUnluRVBIWm9WNmFPc21rU0FZCjBIeHErSHgveFFFdk9ybWwrRXZG
+            WGpVcHliUW9Qb3dLb2Q0aWlrZmpiVm8KLS0tIG0wcXJVK2dMeG9NUTFQSzVtY2RG
+            UE1FS3MvSXlxdEtJVWxJVDRFSkRmQkkK/2z7Lu6LVd6RLZAXKs+JsPc+1kcqFAET
+            0zlTTTU0goTBLuXZ7uxFVZtqc1Nmoarf5Ksm/zcZ2B80P5ox9CzcWQ==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1wrssr4z4g6vl3fd3qme5cewchmmhm0j2xe6wf2meu4r6ycn37anse98mfs
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4SFpKcVBTTlp3SXhVaGQy
+            QVVEV3h6dTZVcmx6aFc1eHF4UzJPbXQ2RnhvCkZiOEYydWhCYUtwcUdieGpBeTZh
+            Z3dYVno5bFNkOUszNHBJNTdQWS9jUTQKLS0tIEhPVEdLK0RaclVvdklFNUJCcHNi
+            OXVobVJCTjhQZ2RTQ21xK2dUY0h5RGcKcPBgD5FIWuyQBhmPt5aqrWgEG1tzhtr0
+            gVyLxgtMFGeeShjdpivgcWI/GZZlhWJilJOoZo7f6TknvCIIKsrUSA==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1zhxul786an743u0fascv4wtc5xduu7qfy803lfs539yzhgmlq5ds2lznt5
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYWlhiS1dxekZGZkRCQU9O
+            SktHRHRXL2VhNUJSRVhBeEM5UEZ1R0pFdXdrCnZQOUZaYitpSlJ0aXFpZXFrRFJj
+            MmZiLytvekZtVXYzamJDakc1RjdIREEKLS0tICtiOTZMRGZuWEdHTmZwRjZ2dUNT
+            aU4xWjVYYlNvSmYxajVGdzk5dTQ4WG8Klq12bSegsW29xp4qteuCB5Tzis6EhVCk
+            53jqtYe5UG9MjFVQYiSi2jJz5/dxfqSINMZ/Y/EB5LxbwgbFws8Yuw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-12-09T21:17:40Z"
+    mac: ENC[AES256_GCM,data:HensJbPU1Kx9aQNUhdtFkX/6qdxj7yby6GeSruOT+HYEtoq0py/zvMtdCqmfjc4AOptYlXdgK7w30P976dG1esjlYwF07qtVvAbUqvExkksuV4zp81VKHMXUOAyiQK79kLe3rx6cvEdUDbOjZOsxN02eRrcanN+7rJS6f7vNN88=,iv:PlePCik6JcOtVBQhhOj9khhp2LwwfXBwAGpzu4ywhTA=,tag:Clz+xX1Cffs8Zpv2LdsGVA==,type:str]
+    pgp:
+        - created_at: "2024-12-09T21:17:27Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA0av/duuklWYARAAv2XS2jzoymOzpRHquUbYpUtbIeKXhPS8i9uk2zBvSKnr
+            b/jZCpvtkCcSz1UFm+HzSn/i1eNkj9ghObisifvqY6JbO0DIa1jFlx1TfE9pj8dE
+            rrNTsYfxNwdGOvklPBHm3vKY5qPiGlE71TaKkJcO79vE5jxwhUqzWI9SWAZY3cFw
+            IVJN44DT0I4ctTlwPM9eAYYodL8QP8OMXHJ/mjI4SPODRsvrOyy6rpip40Q+dU/N
+            DwRupzrRlxJ8BDSh/x6J/AryZSwkmChX9cYyGaDknJ3ONQ0XLhVUtLkAvPWtWeow
+            6NVHmUOJ39ockT1clhYy2P5rQTraZESuI7vaSS9zVIuScBnJwbSRZ5xgxSD6Fj+C
+            Y/JyogXa8FtyG6xeMgIwW7t/m/rbXL5OkP4w8D+CJs+4I55WXz054XOZ937EisVH
+            XAlNBIHixjQVckbb+sS7rEmegfoC+rvOXA0irpwXFiapAbMGUePCwQHdSBMP8orC
+            Tb3E8kqHATN40b8CpUBcPw6HCQKmbhe8o+R8NG6TZh6JH7kSztl2+SIIuMzhDflr
+            1AphY047Ku2RANaWfo+xyVZMWgAQcnoaUOeYaHJ9nZ7f2klJ3fnRtdXJn1gcO3i3
+            NZVRjjYHJgzCVCIZJa1b1TMGep84naF7NmRkNlS4wyv6MXGqSpHHZUGUBAQOCMPS
+            XAEqjZt8va0LKtsPsBOTGQDuzTar+2069fu6TjS07mJM2sTp/G8bGBnvjc0TIplZ
+            M5FOiCilI9yX7vQ0O3LUKJW5zELWnW2d+3okpGjgkr0BFERtM7BMCp6nxR6+
+            =rEY5
+            -----END PGP MESSAGE-----
+          fp: F7D37890228A907440E1FD4846B9228E814A2AAC
+    unencrypted_suffix: _unencrypted
+    version: 3.8.1

users/frero.nix

@@ -0,0 +1,11 @@
+{ pkgs, ... }:
+{
+  users.users.frero = {
+    isNormalUser = true;
+    extraGroups = [ "wheel" "drift" "nix-builder-users" ];
+    shell = pkgs.zsh;
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII09JbtSUMurvmHpJ7TmUQctXpNVhjFYhoJ3+1ZITmMx"
+    ];
+  };
+}

values.nix

@@ -21,6 +21,12 @@ in rec {
       ipv4 = pvv-ipv4 213;
       ipv6 = pvv-ipv6 213;
     };
+    grevling-tap = {
+      ipv4 = pvv-ipv4 251;
+    };
+    tuba-tap = {
+      ipv4 = pvv-ipv4 252;
+    };
   };
 
   hosts = {
@@ -60,9 +66,17 @@ in rec {
       ipv4 = pvv-ipv4 204;
       ipv6 = pvv-ipv6 "1:4f"; # Wtf øystein og daniel why
     };
-    kvernberg = {
+    ustetind = {
-      ipv4 = pvv-ipv4 206;
+      ipv4 = pvv-ipv4 234;
-      ipv6 = pvv-ipv6 "1:206";
+      ipv6 = pvv-ipv6 234;
+    };
+    grevling = {
+      ipv4 = pvv-ipv4 198;
+      ipv6 = pvv-ipv6 198;
+    };
+    tuba = {
+      ipv4 = pvv-ipv4 199;
+      ipv6 = pvv-ipv6 199;
     };
   };