kommode/gitea: add developer experience label

.mailmap

@@ -23,9 +23,3 @@ Adrian Gunnar Lauterer <adriangl@pvv.ntnu.no> Adrian Gunnar Lauterer <adrian@lau
 
 Fredrik Robertsen <frero@pvv.ntnu.no> frero <frero@pvv.ntnu.no>
 Fredrik Robertsen <frero@pvv.ntnu.no> fredrikr79 <fredrikrobertsen7@gmail.com>
-Fredrik Robertsen <frero@pvv.ntnu.no> fredrik <fredrikr79@pm.me>
-
-Vegard Bieker Matthey <vegardbm@pvv.ntnu.no> Vegard Matthey <VegardMatthey@protonmail.com>
-Vegard Bieker Matthey <vegardbm@pvv.ntnu.no> Vegard Bieker Matthey <VegardMatthey@protonmail.com>
-
-Albert Bayazidi <albertba@pvv.ntnu.no> Albert <albert.bayazidi@gmail.com>

.sops.yaml

@@ -7,7 +7,6 @@ keys:
   - &user_pederbs_bjarte age1zhxul786an743u0fascv4wtc5xduu7qfy803lfs539yzhgmlq5ds2lznt5
   - &user_pederbs_nord age1wrssr4z4g6vl3fd3qme5cewchmmhm0j2xe6wf2meu4r6ycn37anse98mfs
   - &user_pederbs_sopp age1hmpdk4h69wxpwqk9tkud39f66hprhehxtzhgw97r6dvr7v0mx5jscsuhkn
-  - &user_vegardbm age1sqs7urnzsdy64efmd0zukzv3gs5pnjksuxd7nqmdwdy5l0nqnunq6hyune
 
   # Hosts
   - &host_bakke age1syted6kt48sumjjucggh6r3uca4x2ppp4mfungf3lamkt2le05csc99633
@@ -20,9 +19,7 @@ keys:
   - &host_lupine-3 age1j2u876z8hu87q5npfxzzpfgllyw8ypj66d7cgelmzmnrf3xud34qzkntp9
   - &host_lupine-4 age1t8zlawqkmhye737pn8yx0z3p9cl947d9ktv2cajdc6hnvn52d3fsc59s2k
   - &host_lupine-5 age199zkqq4jp4yc3d0hx2q0ksxdtp42xhmjsqwyngh8tswuck34ke3smrfyqu
-  - &host_skrott age1lpkju2e053aaddpgsr4ef83epclf4c9tp4m98d35ft2fswr8p4tq2ua0mf
   - &host_ustetind age1hffjafs4slznksefmtqrlj7rdaqgzqncn4un938rhr053237ry8s3rs0v8
-  - &host_skrot age1hzkvnktkr8t5gvtq0ccw69e44z5z6wf00n3xhk3hj24emf07je5s6q2evr
 
 creation_rules:
   # Global secrets
@@ -35,7 +32,6 @@ creation_rules:
       - *user_pederbs_sopp
       - *user_pederbs_nord
       - *user_pederbs_bjarte
-      - *user_vegardbm
       pgp:
       - *user_oysteikt
 
@@ -50,7 +46,6 @@ creation_rules:
       - *user_pederbs_sopp
       - *user_pederbs_nord
       - *user_pederbs_bjarte
-      - *user_vegardbm
       pgp:
       - *user_oysteikt
 
@@ -63,7 +58,6 @@ creation_rules:
       - *user_pederbs_sopp
       - *user_pederbs_nord
       - *user_pederbs_bjarte
-      - *user_vegardbm
       pgp:
       - *user_oysteikt
 
@@ -76,7 +70,6 @@ creation_rules:
       - *user_pederbs_sopp
       - *user_pederbs_nord
       - *user_pederbs_bjarte
-      - *user_vegardbm
       pgp:
       - *user_oysteikt
 
@@ -89,7 +82,6 @@ creation_rules:
       - *user_pederbs_sopp
       - *user_pederbs_nord
       - *user_pederbs_bjarte
-      - *user_vegardbm
       pgp:
       - *user_oysteikt
 
@@ -102,7 +94,6 @@ creation_rules:
       - *user_pederbs_sopp
       - *user_pederbs_nord
       - *user_pederbs_bjarte
-      - *user_vegardbm
       pgp:
       - *user_oysteikt
 
@@ -119,7 +110,6 @@ creation_rules:
       - *user_pederbs_sopp
       - *user_pederbs_nord
       - *user_pederbs_bjarte
-      - *user_vegardbm
       pgp:
       - *user_oysteikt
 
@@ -132,31 +122,16 @@ creation_rules:
       - *user_pederbs_sopp
       - *user_pederbs_nord
       - *user_pederbs_bjarte
-      - *user_vegardbm
       pgp:
       - *user_oysteikt
 
   - path_regex: secrets/skrott/[^/]+\.yaml$
     key_groups:
     - age:
-      - *host_skrott
       - *user_danio
       - *user_felixalb
       - *user_pederbs_sopp
       - *user_pederbs_nord
       - *user_pederbs_bjarte
-      - *user_vegardbm
-      pgp:
-      - *user_oysteikt
-  - path_regex: secrets/skrot/[^/]+\.yaml$
-    key_groups:
-    - age:
-      - *host_skrot
-      - *user_danio
-      - *user_felixalb
-      - *user_pederbs_sopp
-      - *user_pederbs_nord
-      - *user_pederbs_bjarte
-      - *user_vegardbm
       pgp:
       - *user_oysteikt

README.md

@@ -4,33 +4,7 @@ This repository contains the NixOS configurations for Programvareverkstedet's se
 In addition to machine configurations, it also contains a bunch of shared modules, packages, and
 more.
 
-> [!WARNING]
+## Machines
-> Please read [Development - working on the PVV machines](./docs/development.md) before making
-> any changes, and [Secret management and `sops-nix`](./docs/secret-management.md) before adding
-> any credentials such as passwords, API tokens, etc. to the configuration.
-
-## Deploying to machines
-
-> [!WARNING]
-> Be careful to think about state when testing changes against the machines. Sometimes, a certain change
-> can lead to irreversible changes to the data stored on the machine. An example would be a set of database
-> migrations applied when testing a newer version of a service. Unless that service also comes with downwards
-> migrations, you can not go back to the previous version without losing data.
-
-To deploy the changes to a machine, you should first SSH into the machine, and clone the pvv-nixos-config
-repository unless you have already done so. After that, checkout the branch you want to deploy from, and rebuild:
-
-```bash
-# Run this while in the pvv-nixos-config directory
-sudo nixos-rebuild switch --update-input nixpkgs --update-input nixpkgs-unstable --no-write-lock-file --refresh --flake .# --upgrade
-```
-
-This will rebuild the NixOS system on the current branch and switch the system configuration to reflect the new changes.
-
-Note that unless you eventually merge the current changes into `main`, the machine will rebuild itself automatically and
-revert the changes on the next nightly rebuild (tends to happen when everybody is asleep).
-
-## Machine overview
 
 | Name                       | Type     | Description                                               |
 |----------------------------|----------|-----------------------------------------------------------|
@@ -43,7 +17,6 @@ revert the changes on the next nightly rebuild (tends to happen when everybody i
 | [kommode][kom]             | Virtual  | Gitea + Gitea pages                                       |
 | [lupine][lup]              | Physical | Gitea CI/CD runners                                       |
 |  shark                     | Virtual  | Test host for authentication, absolutely horrendous       |
-| [skrot/skrott][skr]        | Physical | Kiosk, snacks and soda                                    |
 | [wenche][wen]              | Virtual  | Nix-builders, general purpose compute                     |
 
 ## Documentation
@@ -60,5 +33,4 @@ revert the changes on the next nightly rebuild (tends to happen when everybody i
 [ild]: https://wiki.pvv.ntnu.no/wiki/Maskiner/ildkule
 [kom]: https://wiki.pvv.ntnu.no/wiki/Maskiner/kommode
 [lup]: https://wiki.pvv.ntnu.no/wiki/Maskiner/lupine
-[skr]: https://wiki.pvv.ntnu.no/wiki/Maskiner/Skrott
 [wen]: https://wiki.pvv.ntnu.no/wiki/Maskiner/wenche

base/default.nix

@@ -10,23 +10,19 @@
     (fp /users)
     (fp /modules/snakeoil-certs.nix)
 
-    ./flake-input-exporter.nix
     ./networking.nix
     ./nix.nix
-    ./programs.nix
-    ./sops.nix
     ./vm.nix
+    ./flake-input-exporter.nix
 
     ./services/acme.nix
     ./services/auto-upgrade.nix
     ./services/dbus.nix
     ./services/fwupd.nix
     ./services/irqbalance.nix
-    ./services/journald-upload.nix
     ./services/logrotate.nix
     ./services/nginx.nix
     ./services/openssh.nix
-    ./services/polkit.nix
     ./services/postfix.nix
     ./services/prometheus-node-exporter.nix
     ./services/prometheus-systemd-exporter.nix
@@ -42,9 +38,6 @@
   boot.tmp.cleanOnBoot = lib.mkDefault true;
   boot.kernelPackages = lib.mkDefault pkgs.linuxPackages_latest;
 
-  boot.loader.systemd-boot.enable = lib.mkDefault true;
-  boot.loader.efi.canTouchEfiVariables = lib.mkDefault true;
-
   time.timeZone = "Europe/Oslo";
 
   i18n.defaultLocale = "en_US.UTF-8";
@@ -53,8 +46,21 @@
     keyMap = "no";
   };
 
-  # Don't install the /lib/ld-linux.so.2 stub
+  environment.systemPackages = with pkgs; [
-  environment.ldso32 = null;
+    file
+    git
+    gnupg
+    htop
+    nano
+    ripgrep
+    rsync
+    screen
+    tmux
+    vim
+    wget
+
+    kitty.terminfo
+  ];
 
   # .bash_profile already works, but lets also use .bashrc like literally every other distro
   # https://man.archlinux.org/man/core/bash/bash.1.en#INVOCATION
@@ -68,6 +74,8 @@
     fi
   '';
 
+  programs.zsh.enable = true;
+
   # security.lockKernelModules = true;
   security.protectKernelImage = true;
   security.sudo.execWheelOnly = true;
@@ -75,14 +83,6 @@
     Defaults lecture = never
   '';
 
-  # These are servers, sleep is for the weak
-  systemd.sleep.extraConfig = lib.mkDefault ''
-    AllowSuspend=no
-    AllowHibernation=no
-  '';
-
-  # users.mutableUsers = lib.mkDefault false;
-
   users.groups."drift".name = "drift";
 
   # Trusted users on the nix builder machines

base/nix.nix

@@ -1,9 +1,4 @@
-{
+{ lib, config, inputs, ... }:
-  lib,
-  config,
-  inputs,
-  ...
-}:
 {
   nix = {
     gc = {
@@ -16,17 +11,12 @@
       allow-dirty = true;
       auto-allocate-uids = true;
       builders-use-substitutes = true;
-      experimental-features = [
+      experimental-features = [ "nix-command" "flakes" "auto-allocate-uids" ];
-        "nix-command"
-        "flakes"
-        "auto-allocate-uids"
-      ];
       log-lines = 50;
       use-xdg-base-directories = true;
     };
 
-    /*
+    /* This makes commandline tools like
-      This makes commandline tools like
     ** nix run nixpkgs#hello
     ** and nix-shell -p hello
     ** use the same channel the system
@@ -47,9 +37,4 @@
       "unstable=${inputs.nixpkgs-unstable}"
     ];
   };
-
-  # Make builds to be more likely killed than important services.
-  # 100 is the default for user slices and 500 is systemd-coredumpd@
-  # We rather want a build to be killed than our precious user sessions as builds can be easily restarted.
-  systemd.services.nix-daemon.serviceConfig.OOMScoreAdjust = lib.mkDefault 250;
 }

base/programs.nix

@@ -1,68 +0,0 @@
-{ pkgs, lib, ... }:
-{
-  # We don't need fonts on headless machines
-  fonts.fontconfig.enable = lib.mkDefault false;
-
-  # Extra packags for better terminal emulator compatibility in SSH sessions
-  environment.enableAllTerminfo = true;
-
-  environment.systemPackages = with pkgs; [
-    # Debug dns outside resolvectl
-    dig
-
-    # Debug and find files
-    file
-
-    # Process json data
-    jq
-
-    # Check computer specs
-    lshw
-
-    # Check who is keeping open files
-    lsof
-
-    # Scan for open ports with netstat
-    net-tools
-
-    # Grep for files quickly
-    ripgrep
-
-    # Copy files over the network
-    rsync
-
-    # Access various state, often in /var/lib
-    sqlite-interactive
-
-    # Debug software which won't debug itself
-    strace
-
-    # Download files from the internet
-    wget
-  ];
-
-  # Clone/push nix config and friends
-  programs.git.enable = true;
-
-  # Gitea gpg, oysteikt sops, etc.
-  programs.gnupg.agent.enable = true;
-
-  # Monitor the wellbeing of the machines
-  programs.htop.enable = true;
-
-  # Keep sessions running during work over SSH
-  programs.tmux.enable = true;
-
-  # Same reasoning as tmux
-  programs.screen.enable = true;
-
-  # Edit files on the system without resorting to joe(1)
-  programs.nano.enable = true;
-  # Same reasoning as nano
-  programs.vim.enable = true;
-  # Same reasoning as vim
-  programs.neovim.enable = true;
-
-  # Some people like this shell for some reason
-  programs.zsh.enable = true;
-}

base/services/acme.nix

@@ -2,12 +2,14 @@
 {
   security.acme = {
     acceptTerms = true;
-    defaults.email = "acme-drift@pvv.ntnu.no";
+    defaults.email = "drift@pvv.ntnu.no";
   };
 
   # Let's not spam LetsEncrypt in `nixos-rebuild build-vm` mode:
   virtualisation.vmVariant = {
     security.acme.defaults.server = "https://127.0.0.1";
+    security.acme.preliminarySelfsigned = true;
+
     users.users.root.initialPassword = "root";
   };
 }

base/services/auto-upgrade.nix

@@ -1,10 +1,4 @@
-{
+{ config, inputs, pkgs, lib, ... }:
-  config,
-  inputs,
-  pkgs,
-  lib,
-  ...
-}:
 
 let
   inputUrls = lib.mapAttrs (input: value: value.url) (import "${inputs.self}/flake.nix").inputs;
@@ -15,40 +9,30 @@ in
     enable = true;
     flake = "git+https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git";
     flags = [
-      "-L"
-
       "--refresh"
       "--no-write-lock-file"
       # --update-input is deprecated since nix 2.22, and removed in lix 2.90
       # as such we instead use --override-input combined with --refresh
       # https://git.lix.systems/lix-project/lix/issues/400
-    ]
+    ] ++ (lib.pipe inputUrls [
-    ++ (lib.pipe inputUrls [
       (lib.intersectAttrs {
         nixpkgs = { };
         nixpkgs-unstable = { };
       })
-      (lib.mapAttrsToList (
+      (lib.mapAttrsToList (input: url: ["--override-input" input url]))
-        input: url: [
-          "--override-input"
-          input
-          url
-        ]
-      ))
       lib.concatLists
     ]);
   };
 
   # workaround for https://github.com/NixOS/nix/issues/6895
   # via https://git.lix.systems/lix-project/lix/issues/400
-  environment.etc =
+  environment.etc = lib.mkIf (!config.virtualisation.isVmVariant) {
-    lib.mkIf (!config.virtualisation.isVmVariant && config.system.autoUpgrade.enable)
+    "current-system-flake-inputs.json".source
-      {
+      = pkgs.writers.writeJSON "flake-inputs.json" (
-        "current-system-flake-inputs.json".source = pkgs.writers.writeJSON "flake-inputs.json" (
+        lib.flip lib.mapAttrs inputs (name: input:
-          lib.flip lib.mapAttrs inputs (
-            name: input:
           # inputs.*.sourceInfo sans outPath, since writeJSON will otherwise serialize sourceInfo like a derivation
-            lib.removeAttrs (input.sourceInfo or { }) [ "outPath" ] // { store-path = input.outPath; } # comment this line if you don't want to retain a store reference to the flake inputs
+          lib.removeAttrs (input.sourceInfo or {}) [ "outPath" ]
+            // { store-path = input.outPath; } # comment this line if you don't want to retain a store reference to the flake inputs
         )
       );
   };

base/services/journald-upload.nix

@@ -1,29 +0,0 @@
-{
-  config,
-  lib,
-  values,
-  ...
-}:
-let
-  cfg = config.services.journald.upload;
-in
-{
-  services.journald.upload = {
-    enable = lib.mkDefault true;
-    settings.Upload = {
-      # URL = "https://journald.pvv.ntnu.no:${toString config.services.journald.remote.port}";
-      URL = "https://${values.hosts.ildkule.ipv4}:${toString config.services.journald.remote.port}";
-      ServerKeyFile = "-";
-      ServerCertificateFile = "-";
-      TrustedCertificateFile = "-";
-    };
-  };
-
-  systemd.services."systemd-journal-upload".serviceConfig = lib.mkIf cfg.enable {
-    IPAddressDeny = "any";
-    IPAddressAllow = [
-      values.hosts.ildkule.ipv4
-      values.hosts.ildkule.ipv6
-    ];
-  };
-}

base/services/logrotate.nix

@@ -1,10 +1,7 @@
 { ... }:
 {
   systemd.services.logrotate = {
-    documentation = [
+    documentation = [ "man:logrotate(8)" "man:logrotate.conf(5)" ];
-      "man:logrotate(8)"
-      "man:logrotate.conf(5)"
-    ];
     unitConfig.RequiresMountsFor = "/var/log";
     serviceConfig.ReadWritePaths = [ "/var/log" ];
   };

base/services/nginx.nix

@@ -11,10 +11,7 @@
     };
   };
 
-  networking.firewall.allowedTCPPorts = lib.mkIf config.services.nginx.enable [
+  networking.firewall.allowedTCPPorts = lib.mkIf config.services.nginx.enable [ 80 443 ];
-    80
-    443
-  ];
 
   services.nginx = {
     recommendedTlsSettings = true;
@@ -42,8 +39,7 @@
     SystemCallFilter = lib.mkForce null;
   };
 
-  services.nginx.virtualHosts = lib.mkIf config.services.nginx.enable {
+  services.nginx.virtualHosts."_" = lib.mkIf config.services.nginx.enable {
-    "_" = {
     listen = [
       {
         addr = "0.0.0.0";
@@ -68,12 +64,4 @@
     addSSL = true;
     extraConfig = "return 444;";
   };
-
-    ${config.networking.fqdn} = {
-      sslCertificate = lib.mkDefault "/etc/certs/nginx.crt";
-      sslCertificateKey = lib.mkDefault "/etc/certs/nginx.key";
-      addSSL = lib.mkDefault true;
-      extraConfig = lib.mkDefault "return 444;";
-    };
-  };
 }

base/services/openssh.nix

@@ -18,3 +18,4 @@
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICCbgJ0Uwh9VSVhfId7l9i5/jk4CvAK5rbkiab8R+moF root@sleipner"
     ];
 }
+

base/services/polkit.nix

@@ -1,15 +0,0 @@
-{ config, lib, ... }:
-let
-  cfg = config.security.polkit;
-in
-{
-  security.polkit.enable = true;
-
-  environment.etc."polkit-1/rules.d/9-nixos-overrides.rules".text = lib.mkIf cfg.enable ''
-    polkit.addAdminRule(function(action, subject) {
-        if(subject.isInGroup("wheel")) {
-            return ["unix-user:"+subject.user];
-        }
-    });
-  '';
-}

base/services/postfix.nix

@@ -1,9 +1,4 @@
-{
+{ config, pkgs, lib, ... }:
-  config,
-  pkgs,
-  lib,
-  ...
-}:
 let
   cfg = config.services.postfix;
 in

base/services/prometheus-node-exporter.nix

@@ -1,9 +1,4 @@
-{
+{ config, lib, values, ... }:
-  config,
-  lib,
-  values,
-  ...
-}:
 let
   cfg = config.services.prometheus.exporters.node;
 in

base/services/prometheus-systemd-exporter.nix

@@ -1,9 +1,4 @@
-{
+{ config, lib, values, ... }:
-  config,
-  lib,
-  values,
-  ...
-}:
 let
   cfg = config.services.prometheus.exporters.systemd;
 in

base/services/promtail.nix

@@ -1,9 +1,4 @@
-{
+{ config, lib, values, ... }:
-  config,
-  lib,
-  values,
-  ...
-}:
 let
   cfg = config.services.prometheus.exporters.node;
 in
@@ -15,13 +10,10 @@ in
         http_listen_port = 28183;
         grpc_listen_port = 0;
       };
-      clients = [
+      clients = [{
-        {
         url = "http://ildkule.pvv.ntnu.no:3100/loki/api/v1/push";
-        }
+      }];
-      ];
+      scrape_configs = [{
-      scrape_configs = [
-        {
         job_name = "systemd-journal";
         journal = {
           max_age = "12h";
@@ -40,8 +32,7 @@ in
             target_label = "level";
           }
         ];
-        }
+      }];
-      ];
     };
   };
 }

base/services/smartd.nix

@@ -1,14 +1,7 @@
-{
+{ config, pkgs, lib, ... }:
-  config,
-  pkgs,
-  lib,
-  ...
-}:
 {
   services.smartd = {
-    # NOTE: qemu guests tend not to have SMART-reporting disks. Please override for the
+    enable = lib.mkDefault true;
-    #       hosts with disk passthrough.
-    enable = lib.mkDefault (!config.services.qemuGuest.enable);
     notifications = {
       mail = {
         enable = true;
@@ -19,12 +12,9 @@
     };
   };
 
-  environment.systemPackages = lib.optionals config.services.smartd.enable (
+  environment.systemPackages = lib.optionals config.services.smartd.enable (with pkgs; [
-    with pkgs;
-    [
     smartmontools
-    ]
+  ]);
-  );
 
   systemd.services.smartd.unitConfig.ConditionVirtualization = "no";
 }

base/services/uptimed.nix

@@ -1,9 +1,4 @@
-{
+{ config, pkgs, lib, ... }:
-  config,
-  pkgs,
-  lib,
-  ...
-}:
 let
   cfg = config.services.uptimed;
 in
@@ -20,19 +15,16 @@ in
     services.uptimed = {
       enable = true;
 
-      settings =
+      settings = let
-        let
         stateDir = "/var/lib/uptimed";
-        in
+      in {
-        {
         PIDFILE = "${stateDir}/pid";
         SENDMAIL = lib.mkDefault "${pkgs.system-sendmail}/bin/sendmail -t";
       };
     };
 
     systemd.services.uptimed = lib.mkIf (cfg.enable) {
-      serviceConfig =
+      serviceConfig = let
-        let
         uptimed = pkgs.uptimed.overrideAttrs (prev: {
           postPatch = ''
              substituteInPlace Makefile.am \
@@ -42,23 +34,23 @@ in
           '';
         });
 
-        in
+      in {
-        {
         Type = "notify";
 
         ExecStart = lib.mkForce "${uptimed}/sbin/uptimed -f";
 
-          BindReadOnlyPaths =
+        BindReadOnlyPaths = let
-            let
           configFile = lib.pipe cfg.settings [
-                (lib.mapAttrsToList (
+            (lib.mapAttrsToList
-                  k: v: if builtins.isList v then lib.mapConcatStringsSep "\n" (v': "${k}=${v'}") v else "${k}=${v}"
+              (k: v:
-                ))
+                if builtins.isList v
+                  then lib.mapConcatStringsSep "\n" (v': "${k}=${v'}") v
+                  else "${k}=${v}")
+            )
             (lib.concatStringsSep "\n")
             (pkgs.writeText "uptimed.conf")
           ];
-            in
+        in [
-            [
           "${configFile}:/var/lib/uptimed/uptimed.conf"
         ];
       };

base/sops.nix

@@ -1,19 +0,0 @@
-{
-  config,
-  fp,
-  lib,
-  ...
-}:
-{
-  sops.defaultSopsFile =
-    let
-      secretsFilePath = fp /secrets/${config.networking.hostName}/${config.networking.hostName}.yaml;
-    in
-    lib.mkIf (builtins.pathExists secretsFilePath) secretsFilePath;
-
-  sops.age = lib.mkIf (config.sops.defaultSopsFile != null) {
-    sshKeyPaths = lib.mkDefault [ "/etc/ssh/ssh_host_ed25519_key" ];
-    keyFile = "/var/lib/sops-nix/key.txt";
-    generateKey = true;
-  };
-}

base/vm.nix

@@ -11,6 +11,5 @@
   };
   config.virtualisation.vmVariant = {
     virtualisation.isVmVariant = true;
-    virtualisation.graphics = false;
   };
 }

docs/development.md

@@ -156,6 +156,27 @@ nix build .#
 > built some of the machines recently. Be prepared to wait for up to an hour to build all machines from scratch
 > if this is the first time.
 
+### Deploying to machines
+
+> [!WARNING]
+> Be careful to think about state when testing changes against the machines. Sometimes, a certain change
+> can lead to irreversible changes to the data stored on the machine. An example would be a set of database
+> migrations applied when testing a newer version of a service. Unless that service also comes with downwards
+> migrations, you can not go back to the previous version without losing data.
+
+To deploy the changes to a machine, you should first SSH into the machine, and clone the pvv-nixos-config
+repository unless you have already done so. After that, checkout the branch you want to deploy from, and rebuild:
+
+```bash
+# Run this while in the pvv-nixos-config directory
+sudo nixos-rebuild switch --update-input nixpkgs --update-input nixpkgs-unstable --no-write-lock-file --refresh --flake .# --upgrade
+```
+
+This will rebuild the NixOS system on the current branch and switch the system configuration to reflect the new changes.
+
+Note that unless you eventually merge the current changes into `main`, the machine will rebuild itself automatically and
+revert the changes on the next nightly rebuild (tends to happen when everybody is asleep).
+
 ### Forcefully reset to `main`
 
 If you ever want to reset a machine to the `main` branch, you can do so by running:

docs/secret-management.md

@@ -151,7 +151,7 @@ is up to date, you can do the following:
 
 ```console
 # Fetch gpg (unless you have it already)
-nix shell nixpkgs#gnupg
+nix-shell -p gpg
 
 # Import oysteikts key to the gpg keychain
 gpg --import ./keys/oysteikt.pub

flake.lock

@@ -1,17 +1,39 @@
 {
   "nodes": {
+    "devshell": {
+      "inputs": {
+        "nixpkgs": [
+          "nix-topology",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1764011051,
+        "narHash": "sha256-M7SZyPZiqZUR/EiiBJnmyUbOi5oE/03tCeFrTiUZchI=",
+        "owner": "numtide",
+        "repo": "devshell",
+        "rev": "17ed8d9744ebe70424659b0ef74ad6d41fc87071",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "devshell",
+        "type": "github"
+      }
+    },
     "dibbler": {
       "inputs": {
+        "flake-utils": "flake-utils",
         "nixpkgs": [
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1771267058,
+        "lastModified": 1767906875,
-        "narHash": "sha256-EEL4SmD1b3BPJPsSJJ4wDTXWMumJqbR+BLzhJJG0skE=",
+        "narHash": "sha256-S88Qh7TJwuTkMQqAdXmF3JMkuV2e5GHTdom02QrtdIs=",
         "ref": "main",
-        "rev": "e3962d02c78b9c7b4d18148d931a9a4bf22e7902",
+        "rev": "b86962ef0e15d1a7de445172d4acea454b119a91",
-        "revCount": 254,
+        "revCount": 220,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Projects/dibbler.git"
       },
@@ -42,21 +64,54 @@
         "type": "github"
       }
     },
-    "flake-parts": {
+    "flake-compat": {
-      "inputs": {
+      "flake": false,
-        "nixpkgs-lib": "nixpkgs-lib"
-      },
       "locked": {
-        "lastModified": 1765835352,
+        "lastModified": 1761588595,
-        "narHash": "sha256-XswHlK/Qtjasvhd1nOa1e8MgZ8GS//jBoTqWtrS1Giw=",
+        "narHash": "sha256-XKUZz9zewJNUj46b4AJdiRZJAvSZ0Dqj2BNfXvFlJC4=",
-        "owner": "hercules-ci",
+        "owner": "edolstra",
-        "repo": "flake-parts",
+        "repo": "flake-compat",
-        "rev": "a34fae9c08a15ad73f295041fec82323541400a9",
+        "rev": "f387cd2afec9419c8ee37694406ca490c3f34ee5",
         "type": "github"
       },
       "original": {
-        "owner": "hercules-ci",
+        "owner": "edolstra",
-        "repo": "flake-parts",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "id": "flake-utils",
+        "type": "indirect"
+      }
+    },
+    "flake-utils_2": {
+      "inputs": {
+        "systems": "systems_2"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
         "type": "github"
       }
     },
@@ -81,6 +136,28 @@
         "url": "https://git.pvv.ntnu.no/Grzegorz/gergle.git"
       }
     },
+    "gitignore": {
+      "inputs": {
+        "nixpkgs": [
+          "nix-topology",
+          "pre-commit-hooks",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1709087332,
+        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "type": "github"
+      }
+    },
     "greg-ng": {
       "inputs": {
         "nixpkgs": [
@@ -174,11 +251,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1769500363,
+        "lastModified": 1767906653,
-        "narHash": "sha256-vFxmdsLBPdTy5j2bf54gbTQi1XnWbZDmeR/BBh8MFrw=",
+        "narHash": "sha256-KMiVvnlkRpW4/MVloLURfjv3bvjcae0X9skext2jKVE=",
         "ref": "main",
-        "rev": "2618e434e40e109eaab6a0693313c7e0de7324a3",
+        "rev": "584fd6379c905a6370484c5b5ba0623b4fcb778f",
-        "revCount": 47,
+        "revCount": 27,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Projects/minecraft-kartverket.git"
       },
@@ -195,11 +272,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1770960722,
+        "lastModified": 1767906352,
-        "narHash": "sha256-IdhPsWFZUKSJh/nLjGLJvGM5d5Uta+k1FlVYPxTZi0E=",
+        "narHash": "sha256-wYsH9MMAPFG3XTL+3DwI39XMG0F2fTmn/5lt265a3Es=",
         "ref": "main",
-        "rev": "c2e4aca7e1ba27cd09eeaeab47010d32a11841b2",
+        "rev": "d054c5d064b8ed6d53a0adb0cf6c0a72febe212e",
-        "revCount": 15,
+        "revCount": 13,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Drift/nix-gitea-themes.git"
       },
@@ -211,17 +288,19 @@
     },
     "nix-topology": {
       "inputs": {
-        "flake-parts": "flake-parts",
+        "devshell": "devshell",
+        "flake-utils": "flake-utils_2",
         "nixpkgs": [
           "nixpkgs"
-        ]
+        ],
+        "pre-commit-hooks": "pre-commit-hooks"
       },
       "locked": {
-        "lastModified": 1769018862,
+        "lastModified": 1767888340,
-        "narHash": "sha256-x3eMpPQhZwEDunyaUos084Hx41XwYTi2uHY4Yc4YNlk=",
+        "narHash": "sha256-CccRg4d8TpOUGz2HefBZLNYtGrcAyCMa7GVJHcUd8W4=",
         "owner": "oddlama",
         "repo": "nix-topology",
-        "rev": "a15cac71d3399a4c2d1a3482ae62040a3a0aa07f",
+        "rev": "416ff06f72e810c554761e3f5dbf33b4f331e73e",
         "type": "github"
       },
       "original": {
@@ -233,45 +312,53 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1769724120,
+        "lastModified": 1767871818,
-        "narHash": "sha256-oQBM04hQk1kotfv4qmIG1tHmuwODd1+hqRJE5TELeCE=",
+        "narHash": "sha256-SOIHRu1sk+dW5f5DNTN5xYoeuZCyGIlKqxZ8RRj4lCM=",
-        "rev": "8ec59ed5093c2a742d7744e9ecf58f358aa4a87d",
+        "rev": "6eb8dee465373971d4495d92e23c2f0979384f76",
         "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/25.11-small/nixos-25.11.4961.8ec59ed5093c/nixexprs.tar.xz"
+        "url": "https://releases.nixos.org/nixos/25.11-small/nixos-25.11.3412.6eb8dee46537/nixexprs.tar.xz"
       },
       "original": {
         "type": "tarball",
         "url": "https://nixos.org/channels/nixos-25.11-small/nixexprs.tar.xz"
       }
     },
-    "nixpkgs-lib": {
-      "locked": {
-        "lastModified": 1765674936,
-        "narHash": "sha256-k00uTP4JNfmejrCLJOwdObYC9jHRrr/5M/a/8L2EIdo=",
-        "owner": "nix-community",
-        "repo": "nixpkgs.lib",
-        "rev": "2075416fcb47225d9b68ac469a5c4801a9c4dd85",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "nixpkgs.lib",
-        "type": "github"
-      }
-    },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1769813739,
+        "lastModified": 1767870855,
-        "narHash": "sha256-RmNWW1DQczvDwBHu11P0hGwJZxbngdoymVu7qkwq/2M=",
+        "narHash": "sha256-SmrGFE9SdHFz60YbSCF7TtZ+GV8nIiYiI8fTEDyUouc=",
-        "rev": "16a3cae5c2487b1afa240e5f2c1811f172419558",
+        "rev": "719f19e8e447a52152aee8061c7a2951f9254f14",
         "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/unstable-small/nixos-26.05pre937548.16a3cae5c248/nixexprs.tar.xz"
+        "url": "https://releases.nixos.org/nixos/unstable-small/nixos-26.05pre924399.719f19e8e447/nixexprs.tar.xz"
       },
       "original": {
         "type": "tarball",
         "url": "https://nixos.org/channels/nixos-unstable-small/nixexprs.tar.xz"
       }
     },
+    "pre-commit-hooks": {
+      "inputs": {
+        "flake-compat": "flake-compat",
+        "gitignore": "gitignore",
+        "nixpkgs": [
+          "nix-topology",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1765911976,
+        "narHash": "sha256-t3T/xm8zstHRLx+pIHxVpQTiySbKqcQbK+r+01XVKc0=",
+        "owner": "cachix",
+        "repo": "pre-commit-hooks.nix",
+        "rev": "b68b780b69702a090c8bb1b973bab13756cc7a27",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cachix",
+        "repo": "pre-commit-hooks.nix",
+        "type": "github"
+      }
+    },
     "pvv-calendar-bot": {
       "inputs": {
         "nixpkgs": [
@@ -300,11 +387,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1769009806,
+        "lastModified": 1768264048,
-        "narHash": "sha256-52xTtAOc9B+MBRMRZ8HI6ybNsRLMlHHLh+qwAbaJjRY=",
+        "narHash": "sha256-U+G116W7MW3J+jsOmHHDEqgrTtEB2Kl3Z2+Gx2aKmN0=",
         "ref": "main",
-        "rev": "aa8adfc6a4d5b6222752e2d15d4a6d3b3b85252e",
+        "rev": "1766cc23d65e30fe8197f1736afe839de609480e",
-        "revCount": 575,
+        "revCount": 540,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Projects/nettsiden.git"
       },
@@ -314,27 +401,6 @@
         "url": "https://git.pvv.ntnu.no/Projects/nettsiden.git"
       }
     },
-    "qotd": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1768684204,
-        "narHash": "sha256-TErBiXxTRPUtZ/Mw8a5p+KCeGCFXa0o8fzwGoo75//Y=",
-        "ref": "main",
-        "rev": "a86f361bb8cfac3845b96d49fcbb2faea669844f",
-        "revCount": 11,
-        "type": "git",
-        "url": "https://git.pvv.ntnu.no/Projects/qotd.git"
-      },
-      "original": {
-        "ref": "main",
-        "type": "git",
-        "url": "https://git.pvv.ntnu.no/Projects/qotd.git"
-      }
-    },
     "root": {
       "inputs": {
         "dibbler": "dibbler",
@@ -351,7 +417,6 @@
         "nixpkgs-unstable": "nixpkgs-unstable",
         "pvv-calendar-bot": "pvv-calendar-bot",
         "pvv-nettsiden": "pvv-nettsiden",
-        "qotd": "qotd",
         "roowho2": "roowho2",
         "sops-nix": "sops-nix"
       }
@@ -364,11 +429,11 @@
         "rust-overlay": "rust-overlay_3"
       },
       "locked": {
-        "lastModified": 1769834595,
+        "lastModified": 1767903580,
-        "narHash": "sha256-P1jrO7BxHyIKDuOXHuUb7bi4H2TuYnACW5eqf1gG47g=",
+        "narHash": "sha256-UtulIUyFv6HcU5BUcQONtyG29XPTOBMsJ4N0nJGNOUk=",
         "ref": "main",
-        "rev": "def4eec2d59a69b4638b3f25d6d713b703b2fa56",
+        "rev": "dd23346bda46629788b08aba2e8af3b3f13335af",
-        "revCount": 49,
+        "revCount": 38,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Projects/roowho2.git"
       },
@@ -428,11 +493,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1769309768,
+        "lastModified": 1767322002,
-        "narHash": "sha256-AbOIlNO+JoqRJkK1VrnDXhxuX6CrdtIu2hSuy4pxi3g=",
+        "narHash": "sha256-yHKXXw2OWfIFsyTjduB4EyFwR0SYYF0hK8xI9z4NIn0=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "140c9dc582cb73ada2d63a2180524fcaa744fad5",
+        "rev": "03c6e38661c02a27ca006a284813afdc461e9f7e",
         "type": "github"
       },
       "original": {
@@ -448,11 +513,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1769469829,
+        "lastModified": 1767826491,
-        "narHash": "sha256-wFcr32ZqspCxk4+FvIxIL0AZktRs6DuF8oOsLt59YBU=",
+        "narHash": "sha256-WSBENPotD2MIhZwolL6GC9npqgaS5fkM7j07V2i/Ur8=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "c5eebd4eb2e3372fe12a8d70a248a6ee9dd02eff",
+        "rev": "ea3adcb6d2a000d9a69d0e23cad1f2cacb3a9fbe",
         "type": "github"
       },
       "original": {
@@ -461,6 +526,36 @@
         "repo": "sops-nix",
         "type": "github"
       }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_2": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
     }
   },
   "root": "root",

flake.nix

@@ -44,20 +44,9 @@
 
     minecraft-kartverket.url = "git+https://git.pvv.ntnu.no/Projects/minecraft-kartverket.git?ref=main";
     minecraft-kartverket.inputs.nixpkgs.follows = "nixpkgs";
-
-    qotd.url = "git+https://git.pvv.ntnu.no/Projects/qotd.git?ref=main";
-    qotd.inputs.nixpkgs.follows = "nixpkgs";
   };
 
-  outputs =
+  outputs = { self, nixpkgs, nixpkgs-unstable, sops-nix, disko, ... }@inputs:
-    {
-      self,
-      nixpkgs,
-      nixpkgs-unstable,
-      sops-nix,
-      disko,
-      ...
-    }@inputs:
   let
     inherit (nixpkgs) lib;
     systems = [
@@ -74,102 +63,79 @@
       "georg"
       "ildkule"
     ];
-    in
+  in {
-    {
     inputs = lib.mapAttrs (_: src: src.outPath) inputs;
 
-      pkgs = forAllSystems (
+    pkgs = forAllSystems (system:
-        system:
       import nixpkgs {
         inherit system;
-          config.allowUnfreePredicate =
+        config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg)
-            pkg:
+          [
-            builtins.elem (lib.getName pkg) [
             "nvidia-x11"
             "nvidia-settings"
           ];
-        }
+      });
-      );
+
+    nixosConfigurations = let
+      unstablePkgs = nixpkgs-unstable.legacyPackages.x86_64-linux;
 
-      nixosConfigurations =
-        let
       nixosConfig =
-            nixpkgs: name: configurationPath:
+        nixpkgs:
+        name:
+        configurationPath:
         extraArgs@{
-              localSystem ? "x86_64-linux", # buildPlatform
+          system ? "x86_64-linux",
-              crossSystem ? "x86_64-linux", # hostPlatform
           specialArgs ? { },
           modules ? [ ],
           overlays ? [ ],
           enableDefaults ? true,
           ...
         }:
-            let
+        lib.nixosSystem (lib.recursiveUpdate
-              commonPkgsConfig = {
+        {
-                inherit localSystem crossSystem;
+          inherit system;
-                config.allowUnfreePredicate =
+
-                  pkg:
+          specialArgs = {
-                  builtins.elem (lib.getName pkg) [
+            inherit unstablePkgs inputs;
+            values = import ./values.nix;
+            fp = path: ./${path};
+          } // specialArgs;
+
+          modules = [
+            configurationPath
+          ] ++ (lib.optionals enableDefaults [
+            sops-nix.nixosModules.sops
+            inputs.roowho2.nixosModules.default
+          ]) ++ modules;
+
+          pkgs = import nixpkgs {
+            inherit system;
+            config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg)
+              [
                 "nvidia-x11"
                 "nvidia-settings"
               ];
-                overlays =
+            overlays = (lib.optionals enableDefaults [
-                  (lib.optionals enableDefaults [
               # Global overlays go here
               inputs.roowho2.overlays.default
-                  ])
+            ]) ++ overlays;
-                  ++ overlays;
           };
-
-              pkgs = import nixpkgs commonPkgsConfig;
-              unstablePkgs = import nixpkgs-unstable commonPkgsConfig;
-            in
-            lib.nixosSystem (
-              lib.recursiveUpdate
-                {
-                  system = crossSystem;
-
-                  inherit pkgs;
-
-                  specialArgs = {
-                    inherit inputs unstablePkgs;
-                    values = import ./values.nix;
-                    fp = path: ./${path};
         }
-                  // specialArgs;
+        (builtins.removeAttrs extraArgs [
-
+          "system"
-                  modules = [
-                    {
-                      networking.hostName = lib.mkDefault name;
-                    }
-                    configurationPath
-                  ]
-                  ++ (lib.optionals enableDefaults [
-                    sops-nix.nixosModules.sops
-                    inputs.roowho2.nixosModules.default
-                    self.nixosModules.rsync-pull-targets
-                  ])
-                  ++ modules;
-                }
-                (
-                  builtins.removeAttrs extraArgs [
-                    "localSystem"
-                    "crossSystem"
           "modules"
           "overlays"
           "specialArgs"
           "enableDefaults"
-                  ]
+        ])
-                )
       );
 
-          stableNixosConfig =
+      stableNixosConfig = name: extraArgs:
-            name: extraArgs: nixosConfig nixpkgs name ./hosts/${name}/configuration.nix extraArgs;
+          nixosConfig nixpkgs name ./hosts/${name}/configuration.nix extraArgs;
-        in
+    in {
-        {
       bakke = stableNixosConfig "bakke" {
         modules = [
-              inputs.disko.nixosModules.disko
+          disko.nixosModules.disko
         ];
       };
       bicep = stableNixosConfig "bicep" {
@@ -191,32 +157,22 @@
       bekkalokk = stableNixosConfig "bekkalokk" {
         overlays = [
           (final: prev: {
+            heimdal = unstablePkgs.heimdal;
             mediawiki-extensions = final.callPackage ./packages/mediawiki-extensions { };
             simplesamlphp = final.callPackage ./packages/simplesamlphp { };
             bluemap = final.callPackage ./packages/bluemap.nix { };
           })
           inputs.pvv-nettsiden.overlays.default
-              inputs.qotd.overlays.default
         ];
         modules = [
           inputs.pvv-nettsiden.nixosModules.default
           self.nixosModules.bluemap
-              inputs.qotd.nixosModules.default
         ];
       };
       ildkule = stableNixosConfig "ildkule" { };
       #ildkule-unstable = unstableNixosConfig "ildkule" { };
-          skrot = stableNixosConfig "skrot" {
-            modules = [
-              inputs.disko.nixosModules.disko
-              inputs.dibbler.nixosModules.default
-            ];
-            overlays = [ inputs.dibbler.overlays.default ];
-          };
       shark = stableNixosConfig "shark" { };
       wenche = stableNixosConfig "wenche" { };
-          temmie = stableNixosConfig "temmie" { };
-          gluttony = stableNixosConfig "gluttony" { };
 
       kommode = stableNixosConfig "kommode" {
         overlays = [
@@ -224,7 +180,6 @@
         ];
         modules = [
           inputs.nix-gitea-themes.nixosModules.default
-              inputs.disko.nixosModules.disko
         ];
       };
 
@@ -256,90 +211,39 @@
           inputs.gergle.overlays.default
         ];
       };
-        }
+      skrott = stableNixosConfig "skrott" {
-        // (
+        system = "aarch64-linux";
-          let
-            skrottConfig = {
         modules = [
           (nixpkgs + "/nixos/modules/installer/sd-card/sd-image-aarch64.nix")
           inputs.dibbler.nixosModules.default
         ];
         overlays = [
           inputs.dibbler.overlays.default
-                (final: prev: {
-                  # NOTE: Yeetus (these break crosscompile ¯\_(ツ)_/¯)
-                  atool = prev.emptyDirectory;
-                  micro = prev.emptyDirectory;
-                  ncdu = prev.emptyDirectory;
-                })
         ];
       };
-          in
-          {
-            skrott = self.nixosConfigurations.skrott-native;
-            skrott-native = stableNixosConfig "skrott" (
-              skrottConfig
-              // {
-                localSystem = "aarch64-linux";
-                crossSystem = "aarch64-linux";
     }
-            );
+    //
-            skrott-cross = stableNixosConfig "skrott" (
+    (let
-              skrottConfig
-              // {
-                localSystem = "x86_64-linux";
-                crossSystem = "aarch64-linux";
-              }
-            );
-            skrott-x86_64 = stableNixosConfig "skrott" (
-              skrottConfig
-              // {
-                localSystem = "x86_64-linux";
-                crossSystem = "x86_64-linux";
-              }
-            );
-          }
-        )
-        // (
-          let
       machineNames = map (i: "lupine-${toString i}") (lib.range 1 5);
-            stableLupineNixosConfig =
+      stableLupineNixosConfig = name: extraArgs:
-              name: extraArgs: nixosConfig nixpkgs name ./hosts/lupine/configuration.nix extraArgs;
+          nixosConfig nixpkgs name ./hosts/lupine/configuration.nix extraArgs;
-          in
+    in lib.genAttrs machineNames (name: stableLupineNixosConfig name {
-          lib.genAttrs machineNames (
-            name:
-            stableLupineNixosConfig name {
       modules = [{ networking.hostName = name; }];
       specialArgs.lupineName = name;
-            }
+    }));
-          )
-        );
 
     nixosModules = {
       bluemap = ./modules/bluemap.nix;
-        gickup = ./modules/gickup;
-        matrix-ooye = ./modules/matrix-ooye.nix;
-        robots-txt = ./modules/robots-txt.nix;
-        rsync-pull-targets = ./modules/rsync-pull-targets.nix;
       snakeoil-certs = ./modules/snakeoil-certs.nix;
       snappymail = ./modules/snappymail.nix;
+      robots-txt = ./modules/robots-txt.nix;
+      gickup = ./modules/gickup;
+      matrix-ooye = ./modules/matrix-ooye.nix;
     };
 
     devShells = forAllSystems (system: {
-        default =
+      default = nixpkgs-unstable.legacyPackages.${system}.callPackage ./shell.nix { };
-          let
+      cuda = let
-            pkgs = import nixpkgs-unstable {
-              inherit system;
-              overlays = [
-                (final: prev: {
-                  inherit (inputs.disko.packages.${system}) disko;
-                })
-              ];
-            };
-          in
-          pkgs.callPackage ./shell.nix { };
-        cuda =
-          let
         cuda-pkgs = import nixpkgs-unstable {
           inherit system;
           config = {
@@ -347,63 +251,51 @@
             cudaSupport = true;
           };
         };
-          in
+      in cuda-pkgs.callPackage ./shells/cuda.nix { };
-          cuda-pkgs.callPackage ./shells/cuda.nix { };
     });
 
     packages = {
-        "x86_64-linux" =
+      "x86_64-linux" = let
-          let
+        pkgs = nixpkgs.legacyPackages."x86_64-linux";
-            system = "x86_64-linux";
+      in rec {
-            pkgs = nixpkgs.legacyPackages.${system};
-          in
-          rec {
         default = important-machines;
-            important-machines = pkgs.linkFarm "important-machines" (
+        important-machines = pkgs.linkFarm "important-machines"
-              lib.getAttrs importantMachines self.packages.${system}
+          (lib.getAttrs importantMachines self.packages.x86_64-linux);
-            );
+        all-machines = pkgs.linkFarm "all-machines"
-            all-machines = pkgs.linkFarm "all-machines" (lib.getAttrs allMachines self.packages.${system});
+          (lib.getAttrs allMachines self.packages.x86_64-linux);
 
         simplesamlphp = pkgs.callPackage ./packages/simplesamlphp { };
 
         bluemap = pkgs.callPackage ./packages/bluemap.nix { };
 
-            out-of-your-element = pkgs.callPackage ./packages/ooye/package.nix { };
+        out-of-your-element = pkgs.callPackage ./packages/out-of-your-element.nix { };
       }
       //
       # Mediawiki extensions
       (lib.pipe null [
         (_: pkgs.callPackage ./packages/mediawiki-extensions { })
-              (lib.flip builtins.removeAttrs [
+        (lib.flip builtins.removeAttrs ["override" "overrideDerivation"])
-                "override"
-                "overrideDerivation"
-              ])
         (lib.mapAttrs' (name: lib.nameValuePair "mediawiki-${name}"))
       ])
       //
       # Machines
-            lib.genAttrs allMachines (machine: self.nixosConfigurations.${machine}.config.system.build.toplevel)
+      lib.genAttrs allMachines
+        (machine: self.nixosConfigurations.${machine}.config.system.build.toplevel)
       //
       # Skrott is exception
       {
-              skrott = self.packages.${system}.skrott-native-sd;
+        skrott = self.nixosConfigurations.skrott.config.system.build.sdImage;
-              skrott-native = self.nixosConfigurations.skrott-native.config.system.build.toplevel;
-              skrott-native-sd = self.nixosConfigurations.skrott-native.config.system.build.sdImage;
-              skrott-cross = self.nixosConfigurations.skrott-cross.config.system.build.toplevel;
-              skrott-cross-sd = self.nixosConfigurations.skrott-cross.config.system.build.sdImage;
-              skrott-x86_64 = self.nixosConfigurations.skrott-x86_64.config.system.build.toplevel;
       }
       //
       # Nix-topology
-            (
+      (let
-              let
         topology' = import inputs.nix-topology {
           pkgs = import nixpkgs {
-                    inherit system;
+            system = "x86_64-linux";
             overlays = [
               inputs.nix-topology.overlays.default
               (final: prev: {
-                        inherit (nixpkgs-unstable.legacyPackages.${system}) super-tiny-icons;
+                inherit (nixpkgs-unstable.legacyPackages.x86_64-linux) super-tiny-icons;
               })
             ];
           };
@@ -415,9 +307,7 @@
           modules = [
             ./topology
             {
-                      nixosConfigurations = lib.mapAttrs (
+              nixosConfigurations = lib.mapAttrs (_name: nixosCfg: nixosCfg.extendModules {
-                        _name: nixosCfg:
-                        nixosCfg.extendModules {
                 modules = [
                   inputs.nix-topology.nixosModules.default
                   ./topology/service-extractors/greg-ng.nix
@@ -425,27 +315,21 @@
                   ./topology/service-extractors/mysql.nix
                   ./topology/service-extractors/gitea-runners.nix
                 ];
-                        }
+              }) self.nixosConfigurations;
-                      ) self.nixosConfigurations;
             }
           ];
         };
-              in
+      in {
-              {
         topology = topology'.config.output;
-                topology-png =
+        topology-png = pkgs.runCommand "pvv-config-topology-png" {
-                  pkgs.runCommand "pvv-config-topology-png"
-                    {
           nativeBuildInputs = [ pkgs.writableTmpDirAsHomeHook ];
-                    }
+        } ''
-                    ''
           mkdir -p "$out"
           for file in '${topology'.config.output}'/*.svg; do
             ${lib.getExe pkgs.imagemagick} -density 300 -background none "$file" "$out"/"$(basename "''${file%.svg}.png")"
           done
         '';
-              }
+      });
-            );
     };
   };
 }

hosts/bakke/configuration.nix

@@ -1,9 +1,4 @@
-{
+{ config, pkgs, values, ... }:
-  config,
-  pkgs,
-  values,
-  ...
-}:
 {
   imports = [
       ./hardware-configuration.nix
@@ -11,16 +6,20 @@
       ./filesystems.nix
     ];
 
+  sops.defaultSopsFile = ../../secrets/bakke/bakke.yaml;
+  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
+  sops.age.generateKey = true;
+
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  networking.hostName = "bakke";
   networking.hostId = "99609ffc";
   systemd.network.networks."30-enp2s0" = values.defaultNetworkConfig // {
     matchConfig.Name = "enp2s0";
-    address = with values.hosts.bakke; [
+    address = with values.hosts.bakke; [ (ipv4 + "/25") (ipv6 + "/64") ];
-      (ipv4 + "/25")
-      (ipv6 + "/64")
-    ];
   };
 
-  # Don't change (even during upgrades) unless you know what you are doing.
-  # See https://search.nixos.org/options?show=system.stateVersion
   system.stateVersion = "24.05";
 }

hosts/bakke/filesystems.nix

@@ -1,17 +1,17 @@
-{ pkgs, ... }:
+{ config, pkgs, lib, ... }:
 {
   # Boot drives:
   boot.swraid.enable = true;
 
   # ZFS Data pool:
+  environment.systemPackages = with pkgs; [ zfs ];
   boot = {
     zfs = {
       extraPools = [ "tank" ];
       requestEncryptionCredentials = false;
     };
-    supportedFilesystems.zfs = true;
+    supportedFilesystems = [ "zfs" ];
-    # Use stable linux packages, these work with zfs
+    kernelPackages = config.boot.zfs.package.latestCompatibleLinuxPackages;
-    kernelPackages = pkgs.linuxPackages;
   };
   services.zfs.autoScrub = {
     enable = true;

hosts/bakke/hardware-configuration.nix

@@ -1,58 +1,40 @@
-# Do not modify this file!  It was generated by 'nixos-generate-config'
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{
+{ config, lib, pkgs, modulesPath, ... }:
-  config,
-  lib,
-  pkgs,
-  modulesPath,
-  ...
-}:
 
 {
-  imports = [
+  imports =
-    (modulesPath + "/installer/scan/not-detected.nix")
+    [ (modulesPath + "/installer/scan/not-detected.nix")
     ];
 
-  boot.initrd.availableKernelModules = [
+  boot.initrd.availableKernelModules = [ "ehci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
-    "ehci_pci"
-    "ahci"
-    "usbhid"
-    "usb_storage"
-    "sd_mod"
-  ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ "kvm-intel" ];
   boot.extraModulePackages = [ ];
 
-  fileSystems."/" = {
+  fileSystems."/" =
-    device = "/dev/disk/by-uuid/0f63c3d2-fc12-4ed5-a5a5-141bfd67a571";
+    { device = "/dev/disk/by-uuid/0f63c3d2-fc12-4ed5-a5a5-141bfd67a571";
       fsType = "btrfs";
       options = [ "subvol=root" ];
     };
 
-  fileSystems."/home" = {
+  fileSystems."/home" =
-    device = "/dev/disk/by-uuid/0f63c3d2-fc12-4ed5-a5a5-141bfd67a571";
+    { device = "/dev/disk/by-uuid/0f63c3d2-fc12-4ed5-a5a5-141bfd67a571";
       fsType = "btrfs";
       options = [ "subvol=home" ];
     };
 
-  fileSystems."/nix" = {
+  fileSystems."/nix" =
-    device = "/dev/disk/by-uuid/0f63c3d2-fc12-4ed5-a5a5-141bfd67a571";
+    { device = "/dev/disk/by-uuid/0f63c3d2-fc12-4ed5-a5a5-141bfd67a571";
       fsType = "btrfs";
-    options = [
+      options = [ "subvol=nix" "noatime" ];
-      "subvol=nix"
-      "noatime"
-    ];
     };
 
-  fileSystems."/boot" = {
+  fileSystems."/boot" =
-    device = "/dev/sdc2";
+    { device = "/dev/sdc2";
       fsType = "vfat";
-    options = [
+      options = [ "fmask=0022" "dmask=0022" ];
-      "fmask=0022"
-      "dmask=0022"
-    ];
     };
 
   swapDevices = [ ];

hosts/bekkalokk/configuration.nix

@@ -1,9 +1,4 @@
-{
+{ fp, pkgs, values, ... }:
-  fp,
-  pkgs,
-  values,
-  ...
-}:
 {
   imports = [
     ./hardware-configuration.nix
@@ -21,20 +16,26 @@
     ./services/webmail
     ./services/website
     ./services/well-known
-    ./services/qotd
   ];
 
+  sops.defaultSopsFile = fp /secrets/bekkalokk/bekkalokk.yaml;
+  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
+  sops.age.generateKey = true;
+
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  networking.hostName = "bekkalokk";
+
   systemd.network.networks."30-enp2s0" = values.defaultNetworkConfig // {
     matchConfig.Name = "enp2s0";
-    address = with values.hosts.bekkalokk; [
+    address = with values.hosts.bekkalokk; [ (ipv4 + "/25") (ipv6 + "/64") ];
-      (ipv4 + "/25")
-      (ipv6 + "/64")
-    ];
   };
 
   services.btrfs.autoScrub.enable = true;
 
-  # Don't change (even during upgrades) unless you know what you are doing.
+  # Do not change, even during upgrades.
   # See https://search.nixos.org/options?show=system.stateVersion
-  system.stateVersion = "25.11";
+  system.stateVersion = "22.11";
 }

hosts/bekkalokk/hardware-configuration.nix

@@ -1,42 +1,30 @@
-# Do not modify this file!  It was generated by 'nixos-generate-config'
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{
+{ config, lib, pkgs, modulesPath, ... }:
-  config,
-  lib,
-  pkgs,
-  modulesPath,
-  ...
-}:
 
 {
-  imports = [
+  imports =
-    (modulesPath + "/installer/scan/not-detected.nix")
+    [ (modulesPath + "/installer/scan/not-detected.nix")
     ];
 
-  boot.initrd.availableKernelModules = [
+  boot.initrd.availableKernelModules = [ "ehci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
-    "ehci_pci"
-    "ahci"
-    "usbhid"
-    "usb_storage"
-    "sd_mod"
-  ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ "kvm-intel" ];
   boot.extraModulePackages = [ ];
 
-  fileSystems."/" = {
+  fileSystems."/" =
-    device = "/dev/sda1";
+    { device = "/dev/sda1";
       fsType = "btrfs";
     };
 
-  fileSystems."/boot" = {
+  fileSystems."/boot" =
-    device = "/dev/disk/by-uuid/CE63-3B9B";
+    { device = "/dev/disk/by-uuid/CE63-3B9B";
       fsType = "vfat";
     };
 
-  swapDevices = [
+  swapDevices =
-    { device = "/dev/disk/by-uuid/2df10c7b-0dec-45c6-a728-533f7da7f4b9"; }
+    [ { device = "/dev/disk/by-uuid/2df10c7b-0dec-45c6-a728-533f7da7f4b9"; }
     ];
 
   # Enables DHCP on each ethernet and wireless interface. In case of scripted networking

hosts/bekkalokk/services/bluemap.nix

@@ -1,15 +1,8 @@
-{
+{ config, lib, pkgs, inputs, ... }:
-  config,
-  lib,
-  pkgs,
-  inputs,
-  ...
-}:
 let
   vanillaSurvival = "/var/lib/bluemap/vanilla_survival_world";
   format = pkgs.formats.hocon { };
-in
+in {
-{
   # NOTE: our versino of the module gets added in flake.nix
   disabledModules = [ "services/web-apps/bluemap.nix" ];
 
@@ -24,13 +17,10 @@ in
 
     host = "minecraft.pvv.ntnu.no";
 
-    maps =
+    maps = let
-      let
       inherit (inputs.minecraft-kartverket.packages.${pkgs.stdenv.hostPlatform.system}) bluemap-export;
-      in
+    in {
-      {
       "verden" = {
-          extraHoconMarkersFile = "${bluemap-export}/overworld.hocon";
         settings = {
           world = vanillaSurvival;
           dimension = "minecraft:overworld";
@@ -42,10 +32,12 @@ in
           };
           ambient-light = 0.1;
           cave-detection-ocean-floor = -5;
+          marker-sets = {
+            _includes = [ (format.lib.mkInclude "${bluemap-export}/overworld.hocon") ];
+          };
         };
       };
       "underverden" = {
-          extraHoconMarkersFile = "${bluemap-export}/nether.hocon";
         settings = {
           world = vanillaSurvival;
           dimension = "minecraft:the_nether";
@@ -62,15 +54,15 @@ in
           remove-caves-below-y = -10000;
           cave-detection-ocean-floor = -5;
           cave-detection-uses-block-light = true;
-            render-mask = [
+          render-mask = [{
-              {
             max-y = 90;
-              }
+          }];
-            ];
+          marker-sets = {
+            _includes = [ (format.lib.mkInclude "${bluemap-export}/nether.hocon") ];
+          };
         };
       };
       "enden" = {
-          extraHoconMarkersFile = "${bluemap-export}/the-end.hocon";
         settings = {
           world = vanillaSurvival;
           dimension = "minecraft:the_end";
@@ -86,6 +78,9 @@ in
           ambient-light = 0.6;
           remove-caves-below-y = -10000;
           cave-detection-ocean-floor = -5;
+          marker-sets = {
+            _includes = [ (format.lib.mkInclude "${bluemap-export}/the-end.hocon") ];
+          };
         };
       };
     };
@@ -94,8 +89,7 @@ in
   systemd.services."render-bluemap-maps" = {
     serviceConfig = {
       StateDirectory = [ "bluemap/world" ];
-      ExecStartPre =
+      ExecStartPre = let
-        let
         rsyncArgs = lib.cli.toCommandLineShellGNU { } {
           archive = true;
           compress = true;
@@ -104,8 +98,7 @@ in
           no-group = true;
           rsh = "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=%d/ssh-known-hosts -i %d/sshkey";
         };
-        in
+      in "${lib.getExe pkgs.rsync} ${rsyncArgs} root@innovation.pvv.ntnu.no:/ ${vanillaSurvival}";
-        "${lib.getExe pkgs.rsync} ${rsyncArgs} root@innovation.pvv.ntnu.no:/ ${vanillaSurvival}";
       LoadCredential = [
         "sshkey:${config.sops.secrets."bluemap/ssh-key".path}"
         "ssh-known-hosts:${config.sops.secrets."bluemap/ssh-known-hosts".path}"

hosts/bekkalokk/services/idp-simplesamlphp/default.nix

@@ -1,16 +1,8 @@
-{
+{ config, pkgs, lib, ... }:
-  config,
-  pkgs,
-  lib,
-  ...
-}:
 let
   pwAuthScript = pkgs.writeShellApplication {
     name = "pwauth";
-    runtimeInputs = with pkgs; [
+    runtimeInputs = with pkgs; [ coreutils heimdal ];
-      coreutils
-      heimdal
-    ];
     text = ''
       read -r user1
       user2="$(echo -n "$user1" | tr -c -d '0123456789abcdefghijklmnopqrstuvwxyz')"
@@ -93,20 +85,14 @@ let
 
         substituteInPlace "$out" \
           --replace-warn '$SAML_COOKIE_SECURE' 'true' \
-          --replace-warn '$SAML_COOKIE_SALT' 'file_get_contents("${
+          --replace-warn '$SAML_COOKIE_SALT' 'file_get_contents("${config.sops.secrets."idp/cookie_salt".path}")' \
-            config.sops.secrets."idp/cookie_salt".path
-          }")' \
           --replace-warn '$SAML_ADMIN_NAME' '"Drift"' \
           --replace-warn '$SAML_ADMIN_EMAIL' '"drift@pvv.ntnu.no"' \
-          --replace-warn '$SAML_ADMIN_PASSWORD' 'file_get_contents("${
+          --replace-warn '$SAML_ADMIN_PASSWORD' 'file_get_contents("${config.sops.secrets."idp/admin_password".path}")' \
-            config.sops.secrets."idp/admin_password".path
-          }")' \
           --replace-warn '$SAML_TRUSTED_DOMAINS' 'array( "idp.pvv.ntnu.no" )' \
           --replace-warn '$SAML_DATABASE_DSN' '"pgsql:host=postgres.pvv.ntnu.no;port=5432;dbname=idp"' \
           --replace-warn '$SAML_DATABASE_USERNAME' '"idp"' \
-          --replace-warn '$SAML_DATABASE_PASSWORD' 'file_get_contents("${
+          --replace-warn '$SAML_DATABASE_PASSWORD' 'file_get_contents("${config.sops.secrets."idp/postgres_password".path}")' \
-            config.sops.secrets."idp/postgres_password".path
-          }")' \
           --replace-warn '$CACHE_DIRECTORY' '/var/cache/idp'
       '';
 
@@ -172,12 +158,10 @@ in
     services.phpfpm.pools.idp = {
       user = "idp";
       group = "idp";
-      settings =
+      settings = let
-        let
         listenUser = config.services.nginx.user;
         listenGroup = config.services.nginx.group;
-        in
+      in {
-        {
         "pm" = "dynamic";
         "pm.max_children" = 32;
         "pm.max_requests" = 500;

hosts/bekkalokk/services/kerberos.nix

@@ -1,9 +1,4 @@
-{
+{ config, pkgs, lib, ... }:
-  config,
-  pkgs,
-  lib,
-  ...
-}:
 {
   security.krb5 = {
     enable = true;

hosts/bekkalokk/services/mediawiki/default.nix

@@ -1,12 +1,4 @@
-{
+{ pkgs, lib, fp, config, values, pkgs-unstable, ... }: let
-  pkgs,
-  lib,
-  fp,
-  config,
-  values,
-  ...
-}:
-let
   cfg = config.services.mediawiki;
 
   # "mediawiki"
@@ -17,9 +9,7 @@ let
 
   simplesamlphp = pkgs.simplesamlphp.override {
     extra_files = {
-      "metadata/saml20-idp-remote.php" = pkgs.writeText "mediawiki-saml20-idp-remote.php" (
+      "metadata/saml20-idp-remote.php" = pkgs.writeText "mediawiki-saml20-idp-remote.php" (import ../idp-simplesamlphp/metadata.php.nix);
-        import ../idp-simplesamlphp/metadata.php.nix
-      );
 
       "config/authsources.php" = ./simplesaml-authsources.php;
 
@@ -28,67 +18,36 @@ let
 
         substituteInPlace "$out" \
           --replace-warn '$SAML_COOKIE_SECURE' 'true' \
-          --replace-warn '$SAML_COOKIE_SALT' 'file_get_contents("${
+          --replace-warn '$SAML_COOKIE_SALT' 'file_get_contents("${config.sops.secrets."mediawiki/simplesamlphp/cookie_salt".path}")' \
-            config.sops.secrets."mediawiki/simplesamlphp/cookie_salt".path
-          }")' \
           --replace-warn '$SAML_ADMIN_NAME' '"Drift"' \
           --replace-warn '$SAML_ADMIN_EMAIL' '"drift@pvv.ntnu.no"' \
-          --replace-warn '$SAML_ADMIN_PASSWORD' 'file_get_contents("${
+          --replace-warn '$SAML_ADMIN_PASSWORD' 'file_get_contents("${config.sops.secrets."mediawiki/simplesamlphp/admin_password".path}")' \
-            config.sops.secrets."mediawiki/simplesamlphp/admin_password".path
-          }")' \
           --replace-warn '$SAML_TRUSTED_DOMAINS' 'array( "wiki.pvv.ntnu.no" )' \
           --replace-warn '$SAML_DATABASE_DSN' '"pgsql:host=postgres.pvv.ntnu.no;port=5432;dbname=mediawiki_simplesamlphp"' \
           --replace-warn '$SAML_DATABASE_USERNAME' '"mediawiki_simplesamlphp"' \
-          --replace-warn '$SAML_DATABASE_PASSWORD' 'file_get_contents("${
+          --replace-warn '$SAML_DATABASE_PASSWORD' 'file_get_contents("${config.sops.secrets."mediawiki/simplesamlphp/postgres_password".path}")' \
-            config.sops.secrets."mediawiki/simplesamlphp/postgres_password".path
-          }")' \
           --replace-warn '$CACHE_DIRECTORY' '/var/cache/mediawiki/idp'
       '';
     };
   };
-in
+in {
-{
   services.idp.sp-remote-metadata = [ "https://wiki.pvv.ntnu.no/simplesaml/" ];
 
-  sops.secrets =
+  sops.secrets = lib.pipe [
-    lib.pipe
-      [
-        "mediawiki/secret-key"
     "mediawiki/password"
     "mediawiki/postgres_password"
     "mediawiki/simplesamlphp/postgres_password"
     "mediawiki/simplesamlphp/cookie_salt"
     "mediawiki/simplesamlphp/admin_password"
-      ]
+  ] [
-      [
+    (map (key: lib.nameValuePair key {
-        (map (
-          key:
-          lib.nameValuePair key {
       owner = user;
       group = group;
       restartUnits = [ "phpfpm-mediawiki.service" ];
-          }
+    }))
-        ))
     lib.listToAttrs
   ];
 
-  services.rsync-pull-targets = {
-    enable = true;
-    locations.${cfg.uploadsDir} = {
-      user = "root";
-      rrsyncArgs.ro = true;
-      authorizedKeysAttrs = [
-        "restrict"
-        "from=\"principal.pvv.ntnu.no,${values.hosts.principal.ipv6},${values.hosts.principal.ipv4}\""
-        "no-agent-forwarding"
-        "no-port-forwarding"
-        "no-pty"
-        "no-X11-forwarding"
-      ];
-      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICHFHa3Iq1oKPhbKCAIHgOoWOTkLmIc7yqxeTbut7ig/ mediawiki rsync backup";
-    };
-  };
-
   services.mediawiki = {
     enable = true;
     name = "Programvareverkstedet";
@@ -185,24 +144,6 @@ in
       $wgDBserver = "${toString cfg.database.host}";
       $wgAllowCopyUploads = true;
 
-      # Files
-      $wgFileExtensions = [
-        'bmp',
-        'gif',
-        'jpeg',
-        'jpg',
-        'mp3',
-        'odg',
-        'odp',
-        'ods',
-        'odt',
-        'pdf',
-        'png',
-        'tiff',
-        'webm',
-        'webp',
-      ];
-
       # Misc program paths
       $wgFFmpegLocation = '${pkgs.ffmpeg}/bin/ffmpeg';
       $wgExiftool = '${pkgs.exiftool}/bin/exiftool';
@@ -238,17 +179,15 @@ in
 
   # Cache directory for simplesamlphp
   # systemd.services.phpfpm-mediawiki.serviceConfig.CacheDirectory = "mediawiki/simplesamlphp";
-  systemd.tmpfiles.settings."10-mediawiki"."/var/cache/mediawiki/simplesamlphp".d =
+  systemd.tmpfiles.settings."10-mediawiki"."/var/cache/mediawiki/simplesamlphp".d = {
-    lib.mkIf cfg.enable
-      {
     user = "mediawiki";
     group = "mediawiki";
     mode = "0770";
   };
 
-  users.groups.mediawiki.members = lib.mkIf cfg.enable [ "nginx" ];
+  users.groups.mediawiki.members = [ "nginx" ];
 
-  services.nginx.virtualHosts."wiki.pvv.ntnu.no" = lib.mkIf cfg.enable {
+  services.nginx.virtualHosts."wiki.pvv.ntnu.no" = {
     kTLS = true;
     forceSSL = true;
     enableACME = true;
@@ -278,12 +217,9 @@ in
 
       "= /PNG/PVV-logo.svg".alias = fp /assets/logo_blue_regular.svg;
       "= /PNG/PVV-logo.png".alias = fp /assets/logo_blue_regular.png;
-      "= /favicon.ico".alias =
+      "= /favicon.ico".alias = pkgs.runCommandLocal "mediawiki-favicon.ico" {
-        pkgs.runCommandLocal "mediawiki-favicon.ico"
-          {
         buildInputs = with pkgs; [ imagemagick ];
-          }
+      } ''
-          ''
         magick \
           ${fp /assets/logo_blue_regular.png} \
           -resize x64 \
@@ -297,26 +233,4 @@ in
     };
 
   };
-
-  systemd.services.mediawiki-init = lib.mkIf cfg.enable {
-    after = [ "sops-install-secrets.service" ];
-    serviceConfig = {
-      BindReadOnlyPaths = [
-        "/run/credentials/mediawiki-init.service/secret-key:/var/lib/mediawiki/secret.key"
-      ];
-      LoadCredential = [ "secret-key:${config.sops.secrets."mediawiki/secret-key".path}" ];
-      UMask = lib.mkForce "0007";
-    };
-  };
-
-  systemd.services.phpfpm-mediawiki = lib.mkIf cfg.enable {
-    after = [ "sops-install-secrets.service" ];
-    serviceConfig = {
-      BindReadOnlyPaths = [
-        "/run/credentials/phpfpm-mediawiki.service/secret-key:/var/lib/mediawiki/secret.key"
-      ];
-      LoadCredential = [ "secret-key:${config.sops.secrets."mediawiki/secret-key".path}" ];
-      UMask = lib.mkForce "0007";
-    };
-  };
 }

hosts/bekkalokk/services/phpfpm.nix

@@ -11,8 +11,7 @@ in
 {
   # Source: https://www.pierreblazquez.com/2023/06/17/how-to-harden-apache-php-fpm-daemons-using-systemd/
   systemd.services = lib.genAttrs pools (_: {
-    serviceConfig =
+    serviceConfig = let
-      let
       caps = [
         "CAP_NET_BIND_SERVICE"
         "CAP_SETGID"
@@ -22,8 +21,7 @@ in
         "CAP_IPC_LOCK"
         "CAP_DAC_OVERRIDE"
       ];
-      in
+    in {
-      {
       AmbientCapabilities = caps;
       CapabilityBoundingSet = caps;
       DeviceAllow = [ "" ];

hosts/bekkalokk/services/qotd/default.nix

@@ -1,6 +0,0 @@
-{
-  services.qotd = {
-    enable = true;
-    quotes = builtins.fromJSON (builtins.readFile ./quotes.json);
-  };
-}

hosts/bekkalokk/services/qotd/quotes.json

@@ -1 +0,0 @@
-["quote 1", "quote 2"]

hosts/bekkalokk/services/vaultwarden.nix

@@ -1,18 +1,11 @@
-{
+{ config, pkgs, lib, ... }:
-  config,
-  pkgs,
-  lib,
-  values,
-  ...
-}:
 let
   cfg = config.services.vaultwarden;
   domain = "pw.pvv.ntnu.no";
   address = "127.0.1.2";
   port = 3011;
   wsPort = 3012;
-in
+in {
-{
   sops.secrets."vaultwarden/environ" = {
     owner = "vaultwarden";
     group = "vaultwarden";
@@ -106,21 +99,4 @@ in
       ];
     };
   };
-
-  services.rsync-pull-targets = {
-    enable = true;
-    locations."/var/lib/vaultwarden" = {
-      user = "root";
-      rrsyncArgs.ro = true;
-      authorizedKeysAttrs = [
-        "restrict"
-        "from=\"principal.pvv.ntnu.no,${values.hosts.principal.ipv6},${values.hosts.principal.ipv4}\""
-        "no-agent-forwarding"
-        "no-port-forwarding"
-        "no-pty"
-        "no-X11-forwarding"
-      ];
-      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB2cDaW52gBtLVaNqoGijvN2ZAVkAWlII5AXUzT3Dswj vaultwarden rsync backup";
-    };
-  };
 }

hosts/bekkalokk/services/webmail/default.nix

@@ -1,10 +1,4 @@
-{
+{ config, values, pkgs, lib, ... }:
-  config,
-  values,
-  pkgs,
-  lib,
-  ...
-}:
 {
   imports = [
     ./roundcube.nix

hosts/bekkalokk/services/webmail/roundcube.nix

@@ -1,9 +1,4 @@
-{
+{ config, pkgs, lib, ... }:
-  config,
-  pkgs,
-  lib,
-  ...
-}:
 
 with lib;
 let
@@ -19,24 +14,14 @@ in
   services.roundcube = {
     enable = true;
 
-    package = pkgs.roundcube.withPlugins (
+    package = pkgs.roundcube.withPlugins (plugins: with plugins; [
-      plugins: with plugins; [
       persistent_login
       thunderbird_labels
       contextmenu
       custom_from
-      ]
+    ]);
-    );
 
-    dicts = with pkgs.aspellDicts; [
+    dicts = with pkgs.aspellDicts; [ en en-computers nb nn fr de it ];
-      en
-      en-computers
-      nb
-      nn
-      fr
-      de
-      it
-    ];
     maxAttachmentSize = 20;
     hostName = "roundcubeplaceholder.example.com";
 
@@ -69,8 +54,7 @@ in
         ln -s ${cfg.package} $out/roundcube
       '';
       extraConfig = ''
-        location ~ ^/roundcube/(${
+        location ~ ^/roundcube/(${builtins.concatStringsSep "|" [
-          builtins.concatStringsSep "|" [
         # https://wiki.archlinux.org/title/Roundcube
         "README"
         "INSTALL"
@@ -84,8 +68,7 @@ in
         "config"
         "temp"
         "logs"
-          ]
+        ]})/? {
-        })/? {
           deny all;
         }
 

hosts/bekkalokk/services/webmail/snappymail.nix

@@ -1,15 +1,7 @@
-{
+{ config, lib, fp, pkgs, ... }:
-  config,
-  lib,
-  fp,
-  pkgs,
-  values,
-  ...
-}:
 let
   cfg = config.services.snappymail;
-in
+in {
-{
   imports = [ (fp /modules/snappymail.nix) ];
 
   services.snappymail = {
@@ -22,21 +14,5 @@ in
     enableACME = true;
     kTLS = true;
   };
-
-  services.rsync-pull-targets = {
-    enable = true;
-    locations.${cfg.dataDir} = {
-      user = "root";
-      rrsyncArgs.ro = true;
-      authorizedKeysAttrs = [
-        "restrict"
-        "from=\"principal.pvv.ntnu.no,${values.hosts.principal.ipv6},${values.hosts.principal.ipv4}\""
-        "no-agent-forwarding"
-        "no-port-forwarding"
-        "no-pty"
-        "no-X11-forwarding"
-      ];
-      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJENMnuNsHEeA91oX+cj7Qpex2defSXP/lxznxCAqV03 snappymail rsync backup";
-    };
-  };
 }
+

hosts/bekkalokk/services/website/default.nix

@@ -1,27 +1,18 @@
-{
+{ pkgs, lib, config, ... }:
-  pkgs,
-  lib,
-  config,
-  ...
-}:
 let
   format = pkgs.formats.php { };
   cfg = config.services.pvv-nettsiden;
-in
+in {
-{
   imports = [
     ./fetch-gallery.nix
   ];
 
-  sops.secrets =
+  sops.secrets = lib.genAttrs [
-    lib.genAttrs
-      [
     "nettsiden/door_secret"
     "nettsiden/mysql_password"
     "nettsiden/simplesamlphp/admin_password"
     "nettsiden/simplesamlphp/cookie_salt"
-      ]
+  ] (_: {
-      (_: {
     owner = config.services.phpfpm.pools.pvv-nettsiden.user;
     group = config.services.phpfpm.pools.pvv-nettsiden.group;
     restartUnits = [ "phpfpm-pvv-nettsiden.service" ];
@@ -44,10 +35,8 @@ in
 
     package = pkgs.pvv-nettsiden.override {
       extra_files = {
-        "${pkgs.pvv-nettsiden.passthru.simplesamlphpPath}/metadata/saml20-idp-remote.php" =
+        "${pkgs.pvv-nettsiden.passthru.simplesamlphpPath}/metadata/saml20-idp-remote.php" = pkgs.writeText "pvv-nettsiden-saml20-idp-remote.php" (import ../idp-simplesamlphp/metadata.php.nix);
-          pkgs.writeText "pvv-nettsiden-saml20-idp-remote.php" (import ../idp-simplesamlphp/metadata.php.nix);
+        "${pkgs.pvv-nettsiden.passthru.simplesamlphpPath}/config/authsources.php" = pkgs.writeText "pvv-nettsiden-authsources.php" ''
-        "${pkgs.pvv-nettsiden.passthru.simplesamlphpPath}/config/authsources.php" =
-          pkgs.writeText "pvv-nettsiden-authsources.php" ''
           <?php
           $config = array(
               'admin' => array(
@@ -65,12 +54,9 @@ in
 
     domainName = "www.pvv.ntnu.no";
 
-    settings =
+    settings = let
-      let
+      includeFromSops = path: format.lib.mkRaw "file_get_contents('${config.sops.secrets."nettsiden/${path}".path}')";
-        includeFromSops =
+    in {
-          path: format.lib.mkRaw "file_get_contents('${config.sops.secrets."nettsiden/${path}".path}')";
-      in
-      {
       DOOR_SECRET = includeFromSops "door_secret";
 
       DB = {

hosts/bekkalokk/services/website/fetch-gallery.nix

@@ -1,37 +1,15 @@
-{
+{ pkgs, lib, config, ... }:
-  pkgs,
-  lib,
-  config,
-  values,
-  ...
-}:
 let
   galleryDir = config.services.pvv-nettsiden.settings.GALLERY.DIR;
   transferDir = "${config.services.pvv-nettsiden.settings.GALLERY.DIR}-transfer";
-in
+in {
-{
   users.users.${config.services.pvv-nettsiden.user} = {
-    # NOTE: the user unfortunately needs a registered shell for rrsync to function...
-    #       is there anything we can do to remove this?
     useDefaultShell = true;
-  };
 
     # This is pushed from microbel:/var/www/www-gallery/build-gallery.sh
-  services.rsync-pull-targets = {
+    openssh.authorizedKeys.keys = [
-    enable = true;
+    ''command="${pkgs.rrsync}/bin/rrsync -wo ${transferDir}",restrict,no-agent-forwarding,no-port-forwarding,no-pty,no-X11-forwarding ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIjHhC2dikhWs/gG+m7qP1eSohWzTehn4ToNzDSOImyR gallery-publish''
-    locations.${transferDir} = {
-      user = config.services.pvv-nettsiden.user;
-      rrsyncArgs.wo = true;
-      authorizedKeysAttrs = [
-        "restrict"
-        "from=\"microbel.pvv.ntnu.no,${values.hosts.microbel.ipv6},${values.hosts.microbel.ipv4}\""
-        "no-agent-forwarding"
-        "no-port-forwarding"
-        "no-pty"
-        "no-X11-forwarding"
     ];
-      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIjHhC2dikhWs/gG+m7qP1eSohWzTehn4ToNzDSOImyR gallery-publish";
-    };
   };
 
   systemd.paths.pvv-nettsiden-gallery-update = {
@@ -44,20 +22,14 @@ in
   };
 
   systemd.services.pvv-nettsiden-gallery-update = {
-    path = with pkgs; [
+    path = with pkgs; [ imagemagick gnutar gzip ];
-      imagemagick
-      gnutar
-      gzip
-    ];
 
     script = ''
-      tar ${
+      tar ${lib.cli.toGNUCommandLineShell {} {
-        lib.cli.toGNUCommandLineShell { } {
         extract = true;
         file = "${transferDir}/gallery.tar.gz";
         directory = ".";
-        }
+      }}
-      }
 
       # Delete files and directories that exists in the gallery that don't exist in the tarball
       filesToRemove=$(uniq -u <(sort <(find . -not -path "./.thumbnails*") <(tar -tf ${transferDir}/gallery.tar.gz | sed 's|/$||')))

hosts/bekkalokk/services/well-known/default.nix

@@ -1,15 +1,6 @@
-{ lib, ... }:
+{ ... }:
 {
-  services.nginx.virtualHosts =
+  services.nginx.virtualHosts."www.pvv.ntnu.no".locations = {
-    lib.genAttrs
-      [
-        "pvv.ntnu.no"
-        "www.pvv.ntnu.no"
-        "pvv.org"
-        "www.pvv.org"
-      ]
-      (_: {
-        locations = {
     "^~ /.well-known/" = {
       alias = (toString ./root) + "/";
     };
@@ -24,5 +15,4 @@
       '';
     };
   };
-      });
 }

hosts/bekkalokk/services/well-known/root/security.txt

@@ -6,11 +6,7 @@ Contact: mailto:cert@pvv.ntnu.no
 Preferred-Languages: no, en
 
 Expires: 2032-12-31T23:59:59.000Z
-# This file was last updated 2026-02-27.
+# This file was last updated 2024-09-14.
 
 # You can find a wikipage for our security policies at:
 # https://wiki.pvv.ntnu.no/wiki/CERT
-
-# Please note that we are a student organization, and unfortunately we do not
-# have a bug bounty program or offer monetary compensation for disclosure of
-# security vulnerabilities.

hosts/bicep/configuration.nix

@@ -1,9 +1,4 @@
-{
+{ fp, pkgs, values, ... }:
-  fp,
-  pkgs,
-  values,
-  ...
-}:
 {
   imports = [
     ./hardware-configuration.nix
@@ -14,34 +9,44 @@
     ./services/calendar-bot.nix
     #./services/git-mirrors
     ./services/minecraft-heatmap.nix
-    ./services/mysql
+    ./services/mysql.nix
-    ./services/postgresql
+    ./services/postgres.nix
 
     ./services/matrix
   ];
 
+  sops.defaultSopsFile = fp /secrets/bicep/bicep.yaml;
+  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
+  sops.age.generateKey = true;
+
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  networking.hostName = "bicep";
+
   #systemd.network.networks."30-enp6s0f0" = values.defaultNetworkConfig // {
   systemd.network.networks."30-ens18" = values.defaultNetworkConfig // {
     #matchConfig.Name = "enp6s0f0";
     matchConfig.Name = "ens18";
-    address =
+    address = with values.hosts.bicep; [ (ipv4 + "/25") (ipv6 + "/64") ]
-      with values.hosts.bicep;
+      ++ (with values.services.turn; [ (ipv4 + "/25") (ipv6 + "/64") ]);
-      [
-        (ipv4 + "/25")
-        (ipv6 + "/64")
-      ]
-      ++ (with values.services.turn; [
-        (ipv4 + "/25")
-        (ipv6 + "/64")
-      ]);
   };
   systemd.network.wait-online = {
     anyInterface = true;
   };
 
+  # There are no smart devices
+  services.smartd.enable = false;
+
+  # we are a vm now
   services.qemuGuest.enable = true;
 
-  # Don't change (even during upgrades) unless you know what you are doing.
+  # Enable the OpenSSH daemon.
+  services.openssh.enable = true;
+  services.sshguard.enable = true;
+
+  # Do not change, even during upgrades.
   # See https://search.nixos.org/options?show=system.stateVersion
-  system.stateVersion = "25.11";
+  system.stateVersion = "22.11";
 }

hosts/bicep/hardware-configuration.nix

@@ -1,48 +1,33 @@
-# Do not modify this file!  It was generated by 'nixos-generate-config'
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{
+{ config, lib, pkgs, modulesPath, ... }:
-  config,
-  lib,
-  pkgs,
-  modulesPath,
-  ...
-}:
 
 {
-  imports = [
+  imports =
-    (modulesPath + "/profiles/qemu-guest.nix")
+    [ (modulesPath + "/profiles/qemu-guest.nix")
     ];
 
-  boot.initrd.availableKernelModules = [
+  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "ahci" "sd_mod" "sr_mod" ];
-    "ata_piix"
-    "uhci_hcd"
-    "ahci"
-    "sd_mod"
-    "sr_mod"
-  ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ ];
   boot.extraModulePackages = [ ];
 
-  fileSystems."/" = {
+  fileSystems."/" =
-    device = "/dev/disk/by-uuid/20e06202-7a09-47cc-8ef6-5e7afe19453a";
+    { device = "/dev/disk/by-uuid/20e06202-7a09-47cc-8ef6-5e7afe19453a";
       fsType = "ext4";
     };
 
   # temp data disk, only 128gb not enough until we can add another disk to the system.
-  fileSystems."/data" = {
+  fileSystems."/data" =
-    device = "/dev/disk/by-uuid/c81af266-0781-4084-b8eb-c2587cbcf1ba";
+    { device = "/dev/disk/by-uuid/c81af266-0781-4084-b8eb-c2587cbcf1ba";
       fsType = "ext4";
     };
 
-  fileSystems."/boot" = {
+  fileSystems."/boot" =
-    device = "/dev/disk/by-uuid/198B-E363";
+    { device = "/dev/disk/by-uuid/198B-E363";
       fsType = "vfat";
-    options = [
+      options = [ "fmask=0022" "dmask=0022" ];
-      "fmask=0022"
-      "dmask=0022"
-    ];
     };
 
   swapDevices = [ ];

hosts/bicep/services/calendar-bot.nix

@@ -1,14 +1,7 @@
-{
+{ config, fp, lib, pkgs, ... }:
-  config,
-  fp,
-  lib,
-  pkgs,
-  ...
-}:
 let
   cfg = config.services.pvv-calendar-bot;
-in
+in {
-{
   sops.secrets = {
     "calendar-bot/matrix_token" = {
       sopsFile = fp /secrets/bicep/bicep.yaml;

hosts/bicep/services/git-mirrors/default.nix

@@ -1,10 +1,4 @@
-{
+{ config, pkgs, lib, fp, ... }:
-  config,
-  pkgs,
-  lib,
-  fp,
-  ...
-}:
 let
   cfg = config.services.gickup;
 in
@@ -26,16 +20,14 @@ in
       lfs = false;
     };
 
-    instances =
+    instances = let
-      let
       defaultGithubConfig = {
         settings.token_file = config.sops.secrets."gickup/github-token".path;
       };
       defaultGitlabConfig = {
         # settings.token_file = ...
       };
-      in
+    in {
-      {
       "github:Git-Mediawiki/Git-Mediawiki" = defaultGithubConfig;
       "github:NixOS/nixpkgs" = defaultGithubConfig;
       "github:go-gitea/gitea" = defaultGithubConfig;
@@ -66,17 +58,14 @@ in
     };
   };
 
-  services.cgit =
+  services.cgit = let
-    let
     domain = "mirrors.pvv.ntnu.no";
-    in
+  in {
-    {
     ${domain} = {
       enable = true;
       package = pkgs.callPackage (fp /packages/cgit.nix) { };
       group = "gickup";
       scanPath = "${cfg.dataDir}/linktree";
-        gitHttpBackend.checkExportOkFiles = false;
       settings = {
         enable-commit-graph = true;
         enable-follow-links = true;
@@ -96,18 +85,13 @@ in
     forceSSL = true;
     enableACME = true;
 
-    locations."= /PVV-logo.png".alias =
+    locations."= /PVV-logo.png".alias = let
-      let
+      small-pvv-logo = pkgs.runCommandLocal "pvv-logo-96x96" {
-        small-pvv-logo =
-          pkgs.runCommandLocal "pvv-logo-96x96"
-            {
         nativeBuildInputs = [ pkgs.imagemagick ];
-            }
+      } ''
-            ''
         magick '${fp /assets/logo_blue_regular.svg}' -resize 96x96 PNG:"$out"
       '';
-      in
+    in toString small-pvv-logo;
-      toString small-pvv-logo;
   };
 
   systemd.services."fcgiwrap-cgit-mirrors.pvv.ntnu.no" = {

hosts/bicep/services/matrix/coturn.nix

@@ -1,14 +1,13 @@
-{
+{ config, lib, fp, pkgs, secrets, values, ... }:
-  config,
-  lib,
-  fp,
-  pkgs,
-  secrets,
-  values,
-  ...
-}:
 
 {
+  sops.secrets."matrix/synapse/turnconfig" = {
+    sopsFile = fp /secrets/bicep/matrix.yaml;
+    key = "synapse/turnconfig";
+    owner = config.users.users.matrix-synapse.name;
+    group = config.users.users.matrix-synapse.group;
+    restartUnits = [ "coturn.service" ];
+  };
   sops.secrets."matrix/coturn/static-auth-secret" = {
     sopsFile = fp /secrets/bicep/matrix.yaml;
     key = "coturn/static-auth-secret";
@@ -17,18 +16,9 @@
     restartUnits = [ "coturn.service" ];
   };
 
-  sops.templates."matrix-synapse-turnconfig" = {
-    owner = config.users.users.matrix-synapse.name;
-    group = config.users.users.matrix-synapse.group;
-    content = ''
-      turn_shared_secret: ${config.sops.placeholder."matrix/coturn/static-auth-secret"}
-    '';
-    restartUnits = [ "matrix-synapse.target" ];
-  };
-
   services.matrix-synapse-next = {
     extraConfigFiles = [
-      config.sops.templates."matrix-synapse-turnconfig".path
+      config.sops.secrets."matrix/synapse/turnconfig".path
     ];
 
     settings = {
@@ -135,30 +125,17 @@
   };
 
   networking.firewall = {
-    interfaces.enp6s0f0 =
+    interfaces.enp6s0f0 = let
-      let
+      range = with config.services.coturn; [ {
-        range = with config.services.coturn; [
-          {
       from = min-port;
       to = max-port;
-          }
+    } ];
-        ];
     in
     {
       allowedUDPPortRanges = range;
-        allowedUDPPorts = [
+      allowedUDPPorts = [ 443 3478 3479 5349 ];
-          443
-          3478
-          3479
-          5349
-        ];
       allowedTCPPortRanges = range;
-        allowedTCPPorts = [
+      allowedTCPPorts = [ 443 3478 3479 5349 ];
-          443
-          3478
-          3479
-          5349
-        ];
     };
   };
 

hosts/bicep/services/matrix/default.nix

@@ -1,17 +1,19 @@
 { config, ... }:
+
 {
+
   imports = [
-    ./synapse-admin.nix
-    ./synapse-auto-compressor.nix
     ./synapse.nix
+    ./synapse-admin.nix
     ./element.nix
     ./coturn.nix
-    ./livekit.nix
     ./mjolnir.nix
-    ./well-known.nix
 
     # ./discord.nix
     ./out-of-your-element.nix
     ./hookshot
   ];
+
+
+
 }

hosts/bicep/services/matrix/discord.nix

@@ -1,9 +1,4 @@
-{
+{ config, lib, fp, ... }:
-  config,
-  lib,
-  fp,
-  ...
-}:
 
 let
   cfg = config.services.mx-puppet-discord;
@@ -49,6 +44,7 @@ in
     ];
   };
 
+
   services.mx-puppet-discord.enable = false;
   services.mx-puppet-discord.settings = {
     bridge = {
@@ -56,21 +52,16 @@ in
       domain = "pvv.ntnu.no";
       homeserverUrl = "https://matrix.pvv.ntnu.no";
     };
-    provisioning.whitelist = [
+    provisioning.whitelist = [ "@dandellion:dodsorf\\.as" "@danio:pvv\\.ntnu\\.no"];
-      "@dandellion:dodsorf\\.as"
-      "@danio:pvv\\.ntnu\\.no"
-    ];
     relay.whitelist = [ ".*" ];
-    selfService.whitelist = [
+    selfService.whitelist = [ "@danio:pvv\\.ntnu\\.no" "@dandellion:dodsorf\\.as" ];
-      "@danio:pvv\\.ntnu\\.no"
-      "@dandellion:dodsorf\\.as"
-    ];
   };
   services.mx-puppet-discord.serviceDependencies = [
     "matrix-synapse.target"
     "nginx.service"
   ];
 
+
   services.matrix-synapse-next.settings = {
     app_service_config_files = [
       config.sops.templates."discord-registration.yaml".path

hosts/bicep/services/matrix/element.nix

@@ -1,20 +1,7 @@
-{
+{ config, lib, pkgs, ... }:
-  config,
-  lib,
-  pkgs,
-  ...
-}:
 let
   synapse-cfg = config.services.matrix-synapse-next;
-in
+in {
-{
-  services.pvv-matrix-well-known.client = {
-    "m.homeserver" = {
-      base_url = "https://matrix.pvv.ntnu.no";
-      server_name = "pvv.ntnu.no";
-    };
-  };
-
   services.nginx.virtualHosts."chat.pvv.ntnu.no" = {
     enableACME = true;
     forceSSL = true;
@@ -22,10 +9,10 @@ in
 
     root = pkgs.element-web.override {
       conf = {
-        # Tries to look up well-known first, else uses bundled config.
+        default_server_config."m.homeserver" = {
-        default_server_name = "matrix.pvv.ntnu.no";
+          base_url = "https://matrix.pvv.ntnu.no";
-        default_server_config = config.services.pvv-matrix-well-known.client;
+          server_name = "pvv.ntnu.no";
-
+        };
         disable_3pid_login = true;
 #        integrations_ui_url = "https://dimension.dodsorf.as/riot";
 #        integrations_rest_url = "https://dimension.dodsorf.as/api/v1/scalar";
@@ -43,7 +30,6 @@ in
           # element call group calls
           feature_group_calls = true;
         };
-        default_country_code = "NO";
         default_theme = "dark";
         # Servers in this list should provide some sort of valuable scoping
         # matrix.org is not useful compared to matrixrooms.info,

hosts/bicep/services/matrix/hookshot/default.nix

@@ -1,11 +1,4 @@
-{
+{ config, lib, fp, unstablePkgs, inputs, ... }:
-  config,
-  lib,
-  fp,
-  unstablePkgs,
-  inputs,
-  ...
-}:
 
 let
   cfg = config.services.matrix-hookshot;
@@ -21,10 +14,6 @@ in
     sopsFile = fp /secrets/bicep/matrix.yaml;
     key = "hookshot/hs_token";
   };
-  sops.secrets."matrix/hookshot/passkey" = {
-    sopsFile = fp /secrets/bicep/matrix.yaml;
-    key = "hookshot/passkey";
-  };
 
   sops.templates."hookshot-registration.yaml" = {
     owner = config.users.users.matrix-synapse.name;
@@ -55,14 +44,9 @@ in
   };
 
   systemd.services.matrix-hookshot = {
-    serviceConfig = {
+    serviceConfig.SupplementaryGroups = [
-      SupplementaryGroups = [
       config.users.groups.keys-matrix-registrations.name
     ];
-      LoadCredential = [
-        "passkey.pem:${config.sops.secrets."matrix/hookshot/passkey".path}"
-      ];
-    };
   };
 
   services.matrix-hookshot = {
@@ -70,8 +54,6 @@ in
     package = unstablePkgs.matrix-hookshot;
     registrationFile = config.sops.templates."hookshot-registration.yaml".path;
     settings = {
-      passFile = "/run/credentials/matrix-hookshot.service/passkey.pem";
-
       bridge = {
         bindAddress = "127.0.0.1";
         domain = "pvv.ntnu.no";
@@ -79,7 +61,6 @@ in
         mediaUrl = "https://matrix.pvv.ntnu.no";
         port = 9993;
       };
-
       listeners = [
         {
           bindAddress = webhookListenAddress;
@@ -92,7 +73,6 @@ in
           ];
         }
       ];
-
       generic = {
         enabled = true;
         outbound = true;
@@ -107,8 +87,7 @@ in
       };
 
       serviceBots = [
-        {
+        { localpart = "bot_feeds";
-          localpart = "bot_feeds";
           displayname = "Aya";
           avatar = ./feeds.png;
           prefix = "!aya";
@@ -123,44 +102,20 @@ in
 
       permissions = [
         # Users of the PVV Server
-        {
+        { actor = "pvv.ntnu.no";
-          actor = "pvv.ntnu.no";
+          services = [ { service = "*"; level = "commands"; } ];
-          services = [
-            {
-              service = "*";
-              level = "commands";
-            }
-          ];
         }
         # Members of Medlem space (for people with their own hs)
-        {
+        { actor = "!pZOTJQinWyyTWaeOgK:pvv.ntnu.no";
-          actor = "!pZOTJQinWyyTWaeOgK:pvv.ntnu.no";
+          services = [ { service = "*"; level = "commands"; } ];
-          services = [
-            {
-              service = "*";
-              level = "commands";
-            }
-          ];
         }
         # Members of Drift
-        {
+        { actor = "!eYgeufLrninXxQpYml:pvv.ntnu.no";
-          actor = "!eYgeufLrninXxQpYml:pvv.ntnu.no";
+          services = [ { service = "*"; level = "admin"; } ];
-          services = [
-            {
-              service = "*";
-              level = "admin";
-            }
-          ];
         }
         # Dan bootstrap
-        {
+        { actor = "@dandellion:dodsorf.as";
-          actor = "@dandellion:dodsorf.as";
+          services = [ { service = "*"; level = "admin"; } ];
-          services = [
-            {
-              service = "*";
-              level = "admin";
-            }
-          ];
         }
       ];
     };

hosts/bicep/services/matrix/livekit.nix

@@ -1,79 +0,0 @@
-{
-  config,
-  lib,
-  fp,
-  ...
-}:
-let
-  synapseConfig = config.services.matrix-synapse-next;
-  matrixDomain = "matrix.pvv.ntnu.no";
-  cfg = config.services.livekit;
-in
-{
-  sops.secrets."matrix/livekit/keyfile/lk-jwt-service" = {
-    sopsFile = fp /secrets/bicep/matrix.yaml;
-    key = "livekit/keyfile/lk-jwt-service";
-  };
-  sops.templates."matrix-livekit-keyfile" = {
-    restartUnits = [
-      "livekit.service"
-      "lk-jwt-service.service"
-    ];
-    content = ''
-      lk-jwt-service: ${config.sops.placeholder."matrix/livekit/keyfile/lk-jwt-service"}
-    '';
-  };
-
-  services.pvv-matrix-well-known.client = lib.mkIf cfg.enable {
-    "org.matrix.msc4143.rtc_foci" = [
-      {
-        type = "livekit";
-        livekit_service_url = "https://${matrixDomain}/livekit/jwt";
-      }
-    ];
-  };
-
-  services.livekit = {
-    enable = true;
-    openFirewall = true;
-    keyFile = config.sops.templates."matrix-livekit-keyfile".path;
-
-    # NOTE: needed for ingress/egress workers
-    # redis.createLocally = true;
-
-    # settings.room.auto_create = false;
-  };
-
-  services.lk-jwt-service = lib.mkIf cfg.enable {
-    enable = true;
-    livekitUrl = "wss://${matrixDomain}/livekit/sfu";
-    keyFile = config.sops.templates."matrix-livekit-keyfile".path;
-  };
-
-  systemd.services.lk-jwt-service.environment.LIVEKIT_FULL_ACCESS_HOMESERVERS = lib.mkIf cfg.enable (
-    builtins.concatStringsSep "," [
-      "pvv.ntnu.no"
-      "dodsorf.as"
-    ]
-  );
-
-  services.nginx.virtualHosts.${matrixDomain} = lib.mkIf cfg.enable {
-    locations."^~ /livekit/jwt/" = {
-      proxyPass = "http://localhost:${toString config.services.lk-jwt-service.port}/";
-    };
-
-    # TODO: load balance to multiple livekit ingress/egress workers
-    locations."^~ /livekit/sfu/" = {
-      proxyPass = "http://localhost:${toString config.services.livekit.settings.port}/";
-      proxyWebsockets = true;
-      extraConfig = ''
-        proxy_send_timeout 120;
-        proxy_read_timeout 120;
-        proxy_buffering off;
-        proxy_set_header Accept-Encoding gzip;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection "upgrade";
-      '';
-    };
-  };
-}

hosts/bicep/services/matrix/mjolnir.nix

@@ -1,9 +1,4 @@
-{
+{ config, lib, fp, ... }:
-  config,
-  lib,
-  fp,
-  ...
-}:
 
 {
   sops.secrets."matrix/mjolnir/access_token" = {

hosts/bicep/services/matrix/out-of-your-element.nix

@@ -1,11 +1,4 @@
-{
+{ config, pkgs, fp, ... }:
-  config,
-  pkgs,
-  lib,
-  values,
-  fp,
-  ...
-}:
 let
   cfg = config.services.matrix-ooye;
 in
@@ -35,23 +28,6 @@ in
     };
   };
 
-  services.rsync-pull-targets = lib.mkIf cfg.enable {
-    enable = true;
-    locations."/var/lib/private/matrix-ooye" = {
-      user = "root";
-      rrsyncArgs.ro = true;
-      authorizedKeysAttrs = [
-        "restrict"
-        "from=\"principal.pvv.ntnu.no,${values.hosts.principal.ipv6},${values.hosts.principal.ipv4}\""
-        "no-agent-forwarding"
-        "no-port-forwarding"
-        "no-pty"
-        "no-X11-forwarding"
-      ];
-      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE5koYfor5+kKB30Dugj3dAWvmj8h/akQQ2XYDvLobFL matrix_ooye rsync backup";
-    };
-  };
-
   services.matrix-ooye = {
     enable = true;
     homeserver = "https://matrix.pvv.ntnu.no";

hosts/bicep/services/matrix/smtp-authenticator/default.nix

@@ -1,9 +1,4 @@
-{
+{ lib, buildPythonPackage, fetchFromGitHub, setuptools }:
-  lib,
-  buildPythonPackage,
-  fetchFromGitHub,
-  setuptools,
-}:
 
 buildPythonPackage rec {
   pname = "matrix-synapse-smtp-auth";

hosts/bicep/services/matrix/synapse-admin.nix

@@ -1,9 +1,5 @@
-{
+{ config, lib, pkgs, ... }:
-  config,
+
-  lib,
-  pkgs,
-  ...
-}:
 
 # This service requires you to have access to endpoints not available over the internet
 # Use an ssh proxy or similar to access this dashboard.

hosts/bicep/services/matrix/synapse-auto-compressor.nix

@@ -1,61 +0,0 @@
-{
-  config,
-  lib,
-  utils,
-  ...
-}:
-let
-  cfg = config.services.synapse-auto-compressor;
-in
-{
-  services.synapse-auto-compressor = {
-    # enable = true;
-    postgresUrl = "postgresql://matrix-synapse@/synapse?host=/run/postgresql";
-  };
-
-  # NOTE: nixpkgs has some broken asserts, vendored the entire unit
-  systemd.services.synapse-auto-compressor = {
-    description = "synapse-auto-compressor";
-    requires = [
-      "postgresql.target"
-    ];
-    inherit (cfg) startAt;
-    serviceConfig = {
-      Type = "oneshot";
-      DynamicUser = true;
-      User = "matrix-synapse";
-      PrivateTmp = true;
-      ExecStart = utils.escapeSystemdExecArgs [
-        "${cfg.package}/bin/synapse_auto_compressor"
-        "-p"
-        cfg.postgresUrl
-        "-c"
-        cfg.settings.chunk_size
-        "-n"
-        cfg.settings.chunks_to_compress
-        "-l"
-        (lib.concatStringsSep "," (map toString cfg.settings.levels))
-      ];
-      LockPersonality = true;
-      MemoryDenyWriteExecute = true;
-      NoNewPrivileges = true;
-      PrivateDevices = true;
-      PrivateMounts = true;
-      PrivateUsers = true;
-      RemoveIPC = true;
-      RestrictNamespaces = true;
-      RestrictRealtime = true;
-      RestrictSUIDSGID = true;
-      ProcSubset = "pid";
-      ProtectProc = "invisible";
-      ProtectSystem = "strict";
-      ProtectHome = true;
-      ProtectHostname = true;
-      ProtectClock = true;
-      ProtectKernelTunables = true;
-      ProtectKernelModules = true;
-      ProtectKernelLogs = true;
-      ProtectControlGroups = true;
-    };
-  };
-}

hosts/bicep/services/matrix/synapse.nix

@@ -1,23 +1,13 @@
-{
+{ config, lib, fp, pkgs, values, inputs, ... }:
-  config,
-  lib,
-  fp,
-  pkgs,
-  values,
-  inputs,
-  ...
-}:
 
 let
   cfg = config.services.matrix-synapse-next;
 
   matrix-lib = inputs.matrix-next.lib;
 
-  imap0Attrs =
+  imap0Attrs = with lib; f: set:
-    with lib;
+    listToAttrs (imap0 (i: attr: nameValuePair attr (f i attr set.${attr})) (attrNames set));
-    f: set: listToAttrs (imap0 (i: attr: nameValuePair attr (f i attr set.${attr})) (attrNames set));
+in {
-in
-{
   sops.secrets."matrix/synapse/signing_key" = {
     key = "synapse/signing_key";
     sopsFile = fp /secrets/bicep/matrix.yaml;
@@ -25,35 +15,11 @@ in
     group = config.users.users.matrix-synapse.group;
   };
 
-  sops.secrets."matrix/synapse/user_registration/registration_shared_secret" = {
+  sops.secrets."matrix/synapse/user_registration" = {
     sopsFile = fp /secrets/bicep/matrix.yaml;
-    key = "synapse/user_registration/registration_shared_secret";
+    key = "synapse/signing_key";
-  };
-  sops.templates."matrix-synapse-user-registration" = {
     owner = config.users.users.matrix-synapse.name;
     group = config.users.users.matrix-synapse.group;
-    content = ''
-      registration_shared_secret: ${
-        config.sops.placeholder."matrix/synapse/user_registration/registration_shared_secret"
-      }
-    '';
-  };
-
-  services.rsync-pull-targets = {
-    enable = true;
-    locations.${cfg.settings.media_store_path} = {
-      user = "root";
-      rrsyncArgs.ro = true;
-      authorizedKeysAttrs = [
-        "restrict"
-        "from=\"principal.pvv.ntnu.no,${values.hosts.principal.ipv6},${values.hosts.principal.ipv4}\""
-        "no-agent-forwarding"
-        "no-port-forwarding"
-        "no-pty"
-        "no-X11-forwarding"
-      ];
-      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIASnjI9b3j4ZS3BL/D1ggHfws1BkE8iS0v0cGpEmbG+k matrix_media_store rsync backup";
-    };
   };
 
   services.matrix-synapse-next = {
@@ -117,45 +83,18 @@ in
       mau_stats_only = true;
 
       enable_registration = false;
-      registration_shared_secret_path = config.sops.templates."matrix-synapse-user-registration".path;
+      registration_shared_secret_path = config.sops.secrets."matrix/synapse/user_registration".path;
 
       password_config.enabled = true;
 
       modules = [
-        {
+        { module = "smtp_auth_provider.SMTPAuthProvider";
-          module = "smtp_auth_provider.SMTPAuthProvider";
           config = {
             smtp_host = "smtp.pvv.ntnu.no";
           };
         }
       ];
 
-      experimental_features = {
-        # MSC3266: Room summary API. Used for knocking over federation
-        msc3266_enabled = true;
-        # MSC4222 needed for syncv2 state_after. This allow clients to
-        # correctly track the state of the room.
-        msc4222_enabled = true;
-      };
-
-      # The maximum allowed duration by which sent events can be delayed, as
-      # per MSC4140.
-      max_event_delay_duration = "24h";
-
-      rc_message = {
-        # This needs to match at least e2ee key sharing frequency plus a bit of headroom
-        # Note key sharing events are bursty
-        per_second = 0.5;
-        burst_count = 30;
-      };
-
-      rc_delayed_event_mgmt = {
-        # This needs to match at least the heart-beat frequency plus a bit of headroom
-        # Currently the heart-beat is every 5 seconds which translates into a rate of 0.2s
-        per_second = 1;
-        burst_count = 20;
-      };
-
       trusted_key_servers = [
         { server_name = "matrix.org"; }
         { server_name = "dodsorf.as"; }
@@ -193,12 +132,21 @@ in
 
   services.redis.servers."".enable = true;
 
-  services.pvv-matrix-well-known.server."m.server" = "matrix.pvv.ntnu.no:443";
-
   services.nginx.virtualHosts."matrix.pvv.ntnu.no" = lib.mkMerge [
   {
     kTLS = true;
   }
+  {
+    locations."/.well-known/matrix/server" = {
+      return = ''
+        200 '{"m.server": "matrix.pvv.ntnu.no:443"}'
+      '';
+      extraConfig = ''
+        default_type application/json;
+        add_header Access-Control-Allow-Origin *;
+      '';
+    };
+  }
   {
     locations."/_synapse/admin" = {
       proxyPass = "http://$synapse_backend";
@@ -212,30 +160,22 @@ in
     };
   }
   {
-      locations =
+    locations = let
-        let
       connectionInfo = w: matrix-lib.workerConnectionResource "metrics" w;
-          socketAddress =
+      socketAddress = w: let c = connectionInfo w; in "${c.host}:${toString c.port}";
-            w:
-            let
-              c = connectionInfo w;
-            in
-            "${c.host}:${toString c.port}";
 
       metricsPath = w: "/metrics/${w.type}/${toString w.index}";
       proxyPath = w: "http://${socketAddress w}/_synapse/metrics";
-        in
+    in lib.mapAttrs' (n: v: lib.nameValuePair
-        lib.mapAttrs' (
+      (metricsPath v) {
-          n: v:
-          lib.nameValuePair (metricsPath v) {
         proxyPass = proxyPath v;
         extraConfig = ''
           allow ${values.hosts.ildkule.ipv4};
           allow ${values.hosts.ildkule.ipv6};
           deny all;
         '';
-          }
+      })
-        ) cfg.workers.instances;
+      cfg.workers.instances;
   }
   {
     locations."/metrics/master/1" = {
@@ -247,28 +187,18 @@ in
       '';
     };
 
-      locations."/metrics/" =
+    locations."/metrics/" = let
-        let
+      endpoints = lib.pipe cfg.workers.instances [
-          endpoints =
-            lib.pipe cfg.workers.instances [
         (lib.mapAttrsToList (_: v: v))
         (map (w: "${w.type}/${toString w.index}"))
         (map (w: "matrix.pvv.ntnu.no/metrics/${w}"))
-            ]
+      ] ++ [ "matrix.pvv.ntnu.no/metrics/master/1" ];
-            ++ [ "matrix.pvv.ntnu.no/metrics/master/1" ];
+    in {
-        in
+      alias = pkgs.writeTextDir "/config.json"
-        {
+        (builtins.toJSON [
-          alias =
+          { targets = endpoints;
-            pkgs.writeTextDir "/config.json" (
-              builtins.toJSON [
-                {
-                  targets = endpoints;
             labels = { };
-                }
+          }]) + "/";
-              ]
-            )
-            + "/";
     };
-    }
+  }];
-  ];
 }

hosts/bicep/services/matrix/well-known.nix

@@ -1,49 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}:
-let
-  cfg = config.services.pvv-matrix-well-known;
-  format = pkgs.formats.json { };
-  matrixDomain = "matrix.pvv.ntnu.no";
-in
-{
-  options.services.pvv-matrix-well-known = {
-    client = lib.mkOption {
-      type = lib.types.submodule { freeformType = format.type; };
-      default = { };
-      example = {
-        "m.homeserver".base_url = "https://${matrixDomain}/";
-      };
-    };
-
-    server = lib.mkOption {
-      type = lib.types.submodule { freeformType = format.type; };
-      default = { };
-      example = {
-        "m.server" = "https://${matrixDomain}/";
-      };
-    };
-  };
-
-  config = {
-    services.nginx.virtualHosts.${matrixDomain} = {
-      locations."= /.well-known/matrix/client" = lib.mkIf (cfg.client != { }) {
-        alias = format.generate "nginx-well-known-matrix-server.json" cfg.client;
-        extraConfig = ''
-          default_type application/json;
-          add_header Access-Control-Allow-Origin *;
-        '';
-      };
-      locations."= /.well-known/matrix/server" = lib.mkIf (cfg.server != { }) {
-        alias = format.generate "nginx-well-known-matrix-server.json" cfg.server;
-        extraConfig = ''
-          default_type application/json;
-          add_header Access-Control-Allow-Origin *;
-        '';
-      };
-    };
-  };
-}

hosts/bicep/services/minecraft-heatmap.nix

@@ -1,9 +1,4 @@
-{
+{ config, lib, pkgs, ... }:
-  config,
-  lib,
-  pkgs,
-  ...
-}:
 let
   cfg = config.services.minecraft-heatmap;
 in
@@ -27,20 +22,18 @@ in
     };
   };
 
-  systemd.services.minecraft-heatmap-ingest-logs = lib.mkIf cfg.enable {
+  systemd.services.minecraft-heatmap-ingest-logs = {
     serviceConfig.LoadCredential = [
       "sshkey:${config.sops.secrets."minecraft-heatmap/ssh-key/private".path}"
     ];
 
-    preStart =
+    preStart = let
-      let
       knownHostsFile = pkgs.writeText "minecraft-heatmap-known-hosts" ''
         innovation.pvv.ntnu.no ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE9O/y5uqcLKCodg2Q+XfZPH/AoUIyBlDhigImU+4+Kn
         innovation.pvv.ntnu.no ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQClR9GvWeVPZHudlnFXhGHUX5sGX9nscsOsotnlQ4uVuGsgvRifsVsuDULlAFXwoV1tYp4vnyXlsVtMddpLI5ANOIDcZ4fgDxpfSQmtHKssNpDcfMhFJbfRVyacipjA4osxTxvLox/yjtVt+URjTHUA1MWzEwc26KfiOvWO5tCBTan7doN/4KOyT05GwBxwzUAwUmoGTacIITck2Y9qp4+xFYqehbXqPdBb15hFyd38OCQhtU1hWV2Yi18+hJ4nyjc/g5pr6mW09ULlFghe/BaTUXrTisYC6bMcJZsTDwsvld9581KPvoNZOTQhZPTEQCZZ1h54fe0ZHuveVB3TIHovZyjoUuaf4uiFOjJVaKRB+Ig+Il6r7tMUn9CyHtus/Nd86E0TFBzoKxM0OFu88oaUlDtZVrUJL5En1lGoimajebb1JPxllFN5hqIT+gVyMY6nRzkcfS7ieny/U4rzXY2rfz98selftgh3LsBywwADv65i+mPw1A/1QdND1R6fV4U=
         innovation.pvv.ntnu.no ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBNjl3HfsDqmALWCL9uhz9k93RAD2565ndBqUh4N/rvI7MCwEJ6iRCdDev0YzB1Fpg24oriyYoxZRP24ifC2sQf8=
       '';
-      in
+    in ''
-      ''
       mkdir -p '${cfg.minecraftLogsDir}'
       "${lib.getExe pkgs.rsync}" \
       --archive \

hosts/bicep/services/mysql.nix

@@ -0,0 +1,55 @@
+{ pkgs, lib, config, values, ... }:
+{
+  sops.secrets."mysql/password" = {
+    owner = "mysql";
+    group = "mysql";
+  };
+
+  users.mysql.passwordFile = config.sops.secrets."mysql/password".path;
+
+  services.mysql = {
+    enable = true;
+    dataDir = "/data/mysql";
+    package = pkgs.mariadb;
+    settings = {
+      mysqld = {
+        # PVV allows a lot of connections at the same time
+        max_connect_errors = 10000;
+        bind-address = values.services.mysql.ipv4;
+        skip-networking = 0;
+
+        # This was needed in order to be able to use all of the old users
+        # during migration from knakelibrak to bicep in Sep. 2023
+        secure_auth = 0;
+      };
+    };
+
+    # Note: This user also has MAX_USER_CONNECTIONS set to 3, and
+    #       a password which can be found in /secrets/ildkule/ildkule.yaml
+    #       We have also changed both the host and auth plugin of this user
+    #       to be 'ildkule.pvv.ntnu.no' and 'mysql_native_password' respectively.
+    ensureUsers = [{
+      name = "prometheus_mysqld_exporter";
+      ensurePermissions = {
+        "*.*" = "PROCESS, REPLICATION CLIENT, SELECT, SLAVE MONITOR";
+      };
+    }];
+  };
+
+  services.mysqlBackup = {
+    enable = true;
+    location = "/var/lib/mysql/backups";
+  };
+
+  networking.firewall.allowedTCPPorts = [ 3306 ];
+
+  systemd.services.mysql.serviceConfig = {
+    IPAddressDeny = "any";
+    IPAddressAllow = [
+      values.ipv4-space
+      values.ipv6-space
+      values.hosts.ildkule.ipv4
+      values.hosts.ildkule.ipv6
+    ];
+  };
+}

hosts/bicep/services/mysql/backup.nix

@@ -1,91 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  values,
-  ...
-}:
-let
-  cfg = config.services.mysql;
-  backupDir = "/data/mysql-backups";
-in
-{
-  # services.mysqlBackup = lib.mkIf cfg.enable {
-  #   enable = true;
-  #   location = "/var/lib/mysql-backups";
-  # };
-
-  systemd.tmpfiles.settings."10-mysql-backups".${backupDir}.d = {
-    user = "mysql";
-    group = "mysql";
-    mode = "700";
-  };
-
-  services.rsync-pull-targets = lib.mkIf cfg.enable {
-    enable = true;
-    locations.${backupDir} = {
-      user = "root";
-      rrsyncArgs.ro = true;
-      authorizedKeysAttrs = [
-        "restrict"
-        "from=\"principal.pvv.ntnu.no,${values.hosts.principal.ipv6},${values.hosts.principal.ipv4}\""
-        "no-agent-forwarding"
-        "no-port-forwarding"
-        "no-pty"
-        "no-X11-forwarding"
-      ];
-      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJgj55/7Cnj4cYMJ5sIkl+OwcGeBe039kXJTOf2wvo9j mysql rsync backup";
-    };
-  };
-
-  # NOTE: instead of having the upstream nixpkgs postgres backup unit trigger
-  #       another unit, it was easier to just make one ourselves.
-  systemd.services."backup-mysql" = lib.mkIf cfg.enable {
-    description = "Backup MySQL data";
-    requires = [ "mysql.service" ];
-
-    path = with pkgs; [
-      cfg.package
-      coreutils
-      zstd
-    ];
-
-    script =
-      let
-        rotations = 2;
-      in
-      ''
-        set -euo pipefail
-
-        OUT_FILE="$STATE_DIRECTORY/mysql-dump-$(date --iso-8601).sql.zst"
-
-        mysqldump --all-databases | zstd --compress -9 --rsyncable -o "$OUT_FILE"
-
-        # NOTE: this needs to be a hardlink for rrsync to allow sending it
-        rm "$STATE_DIRECTORY/mysql-dump-latest.sql.zst" ||:
-        ln -T "$OUT_FILE" "$STATE_DIRECTORY/mysql-dump-latest.sql.zst"
-
-        while [ "$(find "$STATE_DIRECTORY" -type f -printf '.' | wc -c)" -gt ${toString (rotations + 1)} ]; do
-          rm "$(find "$STATE_DIRECTORY" -type f -printf '%T+ %p\n' | sort | head -n 1 | cut -d' ' -f2)"
-        done
-      '';
-
-    serviceConfig = {
-      Type = "oneshot";
-      User = "mysql";
-      Group = "mysql";
-      UMask = "0077";
-
-      Nice = 19;
-      IOSchedulingClass = "best-effort";
-      IOSchedulingPriority = 7;
-
-      StateDirectory = [ "mysql-backups" ];
-      BindPaths = [ "${backupDir}:/var/lib/mysql-backups" ];
-
-      # TODO: hardening
-    };
-
-    startAt = "*-*-* 02:15:00";
-  };
-}

hosts/bicep/services/mysql/default.nix

@@ -1,82 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  values,
-  ...
-}:
-let
-  cfg = config.services.mysql;
-  dataDir = "/data/mysql";
-in
-{
-  imports = [ ./backup.nix ];
-
-  sops.secrets."mysql/password" = {
-    owner = "mysql";
-    group = "mysql";
-  };
-
-  users.mysql.passwordFile = config.sops.secrets."mysql/password".path;
-
-  services.mysql = {
-    enable = true;
-    package = pkgs.mariadb_118;
-    settings = {
-      mysqld = {
-        # PVV allows a lot of connections at the same time
-        max_connect_errors = 10000;
-        bind-address = values.services.mysql.ipv4;
-        skip-networking = 0;
-
-        # This was needed in order to be able to use all of the old users
-        # during migration from knakelibrak to bicep in Sep. 2023
-        secure_auth = 0;
-
-        slow-query-log = 1;
-        slow-query-log-file = "/var/log/mysql/mysql-slow.log";
-      };
-    };
-
-    # Note: This user also has MAX_USER_CONNECTIONS set to 3, and
-    #       a password which can be found in /secrets/ildkule/ildkule.yaml
-    #       We have also changed both the host and auth plugin of this user
-    #       to be 'ildkule.pvv.ntnu.no' and 'mysql_native_password' respectively.
-    ensureUsers = [
-      {
-        name = "prometheus_mysqld_exporter";
-        ensurePermissions = {
-          "*.*" = "PROCESS, REPLICATION CLIENT, SELECT, SLAVE MONITOR";
-        };
-      }
-    ];
-  };
-
-  networking.firewall.allowedTCPPorts = lib.mkIf cfg.enable [ 3306 ];
-
-  systemd.tmpfiles.settings."10-mysql".${dataDir}.d = lib.mkIf cfg.enable {
-    inherit (cfg) user group;
-    mode = "0700";
-  };
-
-  systemd.services.mysql = lib.mkIf cfg.enable {
-    after = [
-      "systemd-tmpfiles-setup.service"
-      "systemd-tmpfiles-resetup.service"
-    ];
-
-    serviceConfig = {
-      BindPaths = [ "${dataDir}:${cfg.dataDir}" ];
-
-      LogsDirectory = "mysql";
-
-      IPAddressDeny = "any";
-      IPAddressAllow = [
-        values.ipv4-space
-        values.ipv6-space
-        values.hosts.ildkule.ipv4
-        values.hosts.ildkule.ipv6
-      ];
-    };
-  };
-}

hosts/bicep/services/postgres.nix

@@ -1,19 +1,8 @@
+{ config, pkgs, values, ... }:
 {
-  config,
-  lib,
-  pkgs,
-  values,
-  ...
-}:
-let
-  cfg = config.services.postgresql;
-in
-{
-  imports = [ ./backup.nix ];
-
   services.postgresql = {
     enable = true;
-    package = pkgs.postgresql_18;
+    package = pkgs.postgresql_15;
     enableTCPIP = true;
 
     authentication = ''
@@ -85,13 +74,13 @@ in
     };
   };
 
-  systemd.tmpfiles.settings."10-postgresql"."/data/postgresql".d = lib.mkIf cfg.enable {
+  systemd.tmpfiles.settings."10-postgresql"."/data/postgresql".d = {
     user = config.systemd.services.postgresql.serviceConfig.User;
     group = config.systemd.services.postgresql.serviceConfig.Group;
     mode = "0700";
   };
 
-  systemd.services.postgresql-setup = lib.mkIf cfg.enable {
+  systemd.services.postgresql-setup = {
     after = [
       "systemd-tmpfiles-setup.service"
       "systemd-tmpfiles-resetup.service"
@@ -106,7 +95,7 @@ in
     };
   };
 
-  systemd.services.postgresql = lib.mkIf cfg.enable {
+  systemd.services.postgresql = {
     after = [
       "systemd-tmpfiles-setup.service"
       "systemd-tmpfiles-resetup.service"
@@ -121,12 +110,18 @@ in
     };
   };
 
-  environment.snakeoil-certs."/etc/certs/postgres" = lib.mkIf cfg.enable {
+  environment.snakeoil-certs."/etc/certs/postgres" = {
     owner = "postgres";
     group = "postgres";
     subject = "/C=NO/O=Programvareverkstedet/CN=postgres.pvv.ntnu.no/emailAddress=drift@pvv.ntnu.no";
   };
 
-  networking.firewall.allowedTCPPorts = lib.mkIf cfg.enable [ 5432 ];
+  networking.firewall.allowedTCPPorts = [ 5432 ];
-  networking.firewall.allowedUDPPorts = lib.mkIf cfg.enable [ 5432 ];
+  networking.firewall.allowedUDPPorts = [ 5432 ];
+
+  services.postgresqlBackup = {
+    enable = true;
+    location = "/var/lib/postgres/backups";
+    backupAll = true;
+  };
 }

hosts/bicep/services/postgresql/backup.nix

@@ -1,92 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  values,
-  ...
-}:
-let
-  cfg = config.services.postgresql;
-  backupDir = "/data/postgresql-backups";
-in
-{
-  # services.postgresqlBackup = lib.mkIf cfg.enable {
-  #   enable = true;
-  #   location = "/var/lib/postgresql-backups";
-  #   backupAll = true;
-  # };
-
-  systemd.tmpfiles.settings."10-postgresql-backups".${backupDir}.d = {
-    user = "postgres";
-    group = "postgres";
-    mode = "700";
-  };
-
-  services.rsync-pull-targets = lib.mkIf cfg.enable {
-    enable = true;
-    locations.${backupDir} = {
-      user = "root";
-      rrsyncArgs.ro = true;
-      authorizedKeysAttrs = [
-        "restrict"
-        "from=\"principal.pvv.ntnu.no,${values.hosts.principal.ipv6},${values.hosts.principal.ipv4}\""
-        "no-agent-forwarding"
-        "no-port-forwarding"
-        "no-pty"
-        "no-X11-forwarding"
-      ];
-      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGvO7QX7QmwSiGLXEsaxPIOpAqnJP3M+qqQRe5dzf8gJ postgresql rsync backup";
-    };
-  };
-
-  # NOTE: instead of having the upstream nixpkgs postgres backup unit trigger
-  #       another unit, it was easier to just make one ourselves
-  systemd.services."backup-postgresql" = {
-    description = "Backup PostgreSQL data";
-    requires = [ "postgresql.service" ];
-
-    path = with pkgs; [
-      coreutils
-      zstd
-      cfg.package
-    ];
-
-    script =
-      let
-        rotations = 2;
-      in
-      ''
-        set -euo pipefail
-
-        OUT_FILE="$STATE_DIRECTORY/postgresql-dump-$(date --iso-8601).sql.zst"
-
-        pg_dumpall -U postgres | zstd --compress -9 --rsyncable -o "$OUT_FILE"
-
-        # NOTE: this needs to be a hardlink for rrsync to allow sending it
-        rm "$STATE_DIRECTORY/postgresql-dump-latest.sql.zst" ||:
-        ln -T "$OUT_FILE" "$STATE_DIRECTORY/postgresql-dump-latest.sql.zst"
-
-        while [ "$(find "$STATE_DIRECTORY" -type f -printf '.' | wc -c)" -gt ${toString (rotations + 1)} ]; do
-          rm "$(find "$STATE_DIRECTORY" -type f -printf '%T+ %p\n' | sort | head -n 1 | cut -d' ' -f2)"
-        done
-      '';
-
-    serviceConfig = {
-      Type = "oneshot";
-      User = "postgres";
-      Group = "postgres";
-      UMask = "0077";
-
-      Nice = 19;
-      IOSchedulingClass = "best-effort";
-      IOSchedulingPriority = 7;
-
-      StateDirectory = [ "postgresql-backups" ];
-      BindPaths = [ "${backupDir}:/var/lib/postgresql-backups" ];
-
-      # TODO: hardening
-    };
-
-    startAt = "*-*-* 01:15:00";
-  };
-}

hosts/bikkje/configuration.nix

@@ -1,10 +1,4 @@
-{
+{ config, pkgs, values, ... }:
-  lib,
-  config,
-  pkgs,
-  values,
-  ...
-}:
 {
     networking.nat = {
     enable = true;
@@ -16,9 +10,7 @@
 
   containers.bikkje = {
     autoStart = true;
-    config =
+    config = { config, pkgs, ... }: {
-      { config, pkgs, ... }:
-      {
       #import packages
       packages = with pkgs; [
           alpine
@@ -33,63 +25,20 @@
       ];
 
       networking = {
-          hostName = "bikkje";
         firewall = {
           enable = true;
           # Allow SSH and HTTP and ports for email and irc
-            allowedTCPPorts = [
+          allowedTCPPorts = [ 80 22 194 994 6665 6666 6667 6668 6669 6697 995 993 25 465 587 110 143 993 995 ];
-              80
+          allowedUDPPorts = [ 80 22 194 994 6665 6666 6667 6668 6669 6697 995 993 25 465 587 110 143 993 995 ];
-              22
-              194
-              994
-              6665
-              6666
-              6667
-              6668
-              6669
-              6697
-              995
-              993
-              25
-              465
-              587
-              110
-              143
-              993
-              995
-            ];
-            allowedUDPPorts = [
-              80
-              22
-              194
-              994
-              6665
-              6666
-              6667
-              6668
-              6669
-              6697
-              995
-              993
-              25
-              465
-              587
-              110
-              143
-              993
-              995
-            ];
         };
         # Use systemd-resolved inside the container
         # Workaround for bug https://github.com/NixOS/nixpkgs/issues/162686
-          useHostResolvConf = lib.mkForce false;
+        useHostResolvConf = mkForce false;
       };
 
-        services.resolved.enable = true;
-
-        # Don't change (even during upgrades) unless you know what you are doing.
-        # See https://search.nixos.org/options?show=system.stateVersion
       system.stateVersion = "23.11";
+      services.resolved.enable = true;
     };
   };
-}
+
+};

hosts/brzeczyszczykiewicz/configuration.nix

@@ -1,10 +1,4 @@
-{
+{ config, fp, pkgs, values, ... }:
-  config,
-  fp,
-  pkgs,
-  values,
-  ...
-}:
 {
   imports = [
       # Include the results of the hardware scan.
@@ -14,17 +8,28 @@
       ./services/grzegorz.nix
     ];
 
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  networking.hostName = "brzeczyszczykiewicz";
+
   systemd.network.networks."30-eno1" = values.defaultNetworkConfig // {
     matchConfig.Name = "eno1";
-    address = with values.hosts.brzeczyszczykiewicz; [
+    address = with values.hosts.brzeczyszczykiewicz; [ (ipv4 + "/25") (ipv6 + "/64") ];
-      (ipv4 + "/25")
-      (ipv6 + "/64")
-    ];
   };
 
-  fonts.fontconfig.enable = true;
+  # List packages installed in system profile
+  environment.systemPackages = with pkgs; [
+  ];
+
+  # List services that you want to enable:
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "23.05"; # Did you read the comment?
 
-  # Don't change (even during upgrades) unless you know what you are doing.
-  # See https://search.nixos.org/options?show=system.stateVersion
-  system.stateVersion = "25.11";
 }

hosts/brzeczyszczykiewicz/hardware-configuration.nix

@@ -1,44 +1,30 @@
-# Do not modify this file!  It was generated by 'nixos-generate-config'
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{
+{ config, lib, pkgs, modulesPath, ... }:
-  config,
-  lib,
-  pkgs,
-  modulesPath,
-  ...
-}:
 
 {
-  imports = [
+  imports =
-    (modulesPath + "/installer/scan/not-detected.nix")
+    [ (modulesPath + "/installer/scan/not-detected.nix")
     ];
 
-  boot.initrd.availableKernelModules = [
+  boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" "sr_mod" ];
-    "xhci_pci"
-    "ehci_pci"
-    "ahci"
-    "usbhid"
-    "usb_storage"
-    "sd_mod"
-    "sr_mod"
-  ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ "kvm-intel" ];
   boot.extraModulePackages = [ ];
 
-  fileSystems."/" = {
+  fileSystems."/" =
-    device = "/dev/disk/by-uuid/4e8667f8-55de-4103-8369-b94665f42204";
+    { device = "/dev/disk/by-uuid/4e8667f8-55de-4103-8369-b94665f42204";
       fsType = "ext4";
     };
 
-  fileSystems."/boot" = {
+  fileSystems."/boot" =
-    device = "/dev/disk/by-uuid/82E3-3D03";
+    { device = "/dev/disk/by-uuid/82E3-3D03";
       fsType = "vfat";
     };
 
-  swapDevices = [
+  swapDevices =
-    { device = "/dev/disk/by-uuid/d0bf9a21-44bc-44a3-ae55-8f0971875883"; }
+    [ { device = "/dev/disk/by-uuid/d0bf9a21-44bc-44a3-ae55-8f0971875883"; }
     ];
 
   # Enables DHCP on each ethernet and wireless interface. In case of scripted networking

hosts/georg/configuration.nix

@@ -1,10 +1,4 @@
-{
+{ config, fp, pkgs, values, ... }:
-  config,
-  fp,
-  pkgs,
-  values,
-  ...
-}:
 {
   imports = [
       # Include the results of the hardware scan.
@@ -14,14 +8,24 @@
       (fp /modules/grzegorz.nix)
     ];
 
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  networking.hostName = "georg";
+
   systemd.network.networks."30-eno1" = values.defaultNetworkConfig // {
     matchConfig.Name = "eno1";
-    address = with values.hosts.georg; [
+    address = with values.hosts.georg; [ (ipv4 + "/25") (ipv6 + "/64") ];
-      (ipv4 + "/25")
-      (ipv6 + "/64")
-    ];
   };
 
+  # List packages installed in system profile
+  environment.systemPackages = with pkgs; [
+  ];
+
+  # List services that you want to enable:
+
+
+
   services.spotifyd = {
     enable = true;
     settings.global = {
@@ -37,9 +41,15 @@
     5353 # spotifyd is its own mDNS service wtf
   ];
 
-  fonts.fontconfig.enable = true;
 
-  # Don't change (even during upgrades) unless you know what you are doing.
+
-  # See https://search.nixos.org/options?show=system.stateVersion
+
-  system.stateVersion = "25.11";
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "23.05"; # Did you read the comment?
+
 }

hosts/georg/hardware-configuration.nix

@@ -1,43 +1,30 @@
-# Do not modify this file!  It was generated by 'nixos-generate-config'
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{
+{ config, lib, pkgs, modulesPath, ... }:
-  config,
-  lib,
-  pkgs,
-  modulesPath,
-  ...
-}:
 
 {
-  imports = [
+  imports =
-    (modulesPath + "/installer/scan/not-detected.nix")
+    [ (modulesPath + "/installer/scan/not-detected.nix")
     ];
 
-  boot.initrd.availableKernelModules = [
+  boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" ];
-    "xhci_pci"
-    "ehci_pci"
-    "ahci"
-    "usb_storage"
-    "usbhid"
-    "sd_mod"
-  ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ "kvm-intel" ];
   boot.extraModulePackages = [ ];
 
-  fileSystems."/" = {
+  fileSystems."/" =
-    device = "/dev/disk/by-uuid/33825f0d-5a63-40fc-83db-bfa1ebb72ba0";
+    { device = "/dev/disk/by-uuid/33825f0d-5a63-40fc-83db-bfa1ebb72ba0";
       fsType = "ext4";
     };
 
-  fileSystems."/boot" = {
+  fileSystems."/boot" =
-    device = "/dev/disk/by-uuid/145E-7362";
+    { device = "/dev/disk/by-uuid/145E-7362";
       fsType = "vfat";
     };
 
-  swapDevices = [
+  swapDevices =
-    { device = "/dev/disk/by-uuid/7ed27e21-3247-44cd-8bcc-5d4a2efebf57"; }
+    [ { device = "/dev/disk/by-uuid/7ed27e21-3247-44cd-8bcc-5d4a2efebf57"; }
     ];
 
   # Enables DHCP on each ethernet and wireless interface. In case of scripted networking

hosts/gluttony/configuration.nix

@@ -1,60 +0,0 @@
-{
-  fp,
-  lib,
-  values,
-  ...
-}:
-{
-  imports = [
-    ./hardware-configuration.nix
-    (fp /base)
-  ];
-
-  systemd.network.enable = lib.mkForce false;
-  boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
-
-  boot.loader = {
-    systemd-boot.enable = false; # no uefi support on this device
-    grub.device = "/dev/sda";
-    grub.enable = true;
-  };
-  boot.tmp.cleanOnBoot = true;
-
-  networking =
-    let
-      hostConf = values.hosts.gluttony;
-    in
-    {
-      tempAddresses = "disabled";
-      useDHCP = false;
-
-      search = values.defaultNetworkConfig.domains;
-      nameservers = values.defaultNetworkConfig.dns;
-      defaultGateway.address = hostConf.ipv4_internal_gw;
-
-      interfaces."ens3" = {
-        ipv4.addresses = [
-          {
-            address = hostConf.ipv4;
-            prefixLength = 32;
-          }
-          {
-            address = hostConf.ipv4_internal;
-            prefixLength = 24;
-          }
-        ];
-        ipv6.addresses = [
-          {
-            address = hostConf.ipv6;
-            prefixLength = 64;
-          }
-        ];
-      };
-    };
-
-  services.qemuGuest.enable = true;
-
-  # Don't change (even during upgrades) unless you know what you are doing.
-  # See https://search.nixos.org/options?show=system.stateVersion
-  system.stateVersion = "25.11";
-}

hosts/gluttony/hardware-configuration.nix

@@ -1,50 +0,0 @@
-# Do not modify this file!  It was generated by 'nixos-generate-config'
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{
-  config,
-  lib,
-  pkgs,
-  modulesPath,
-  ...
-}:
-
-{
-  imports = [
-    (modulesPath + "/profiles/qemu-guest.nix")
-  ];
-
-  boot.initrd.availableKernelModules = [
-    "ata_piix"
-    "uhci_hcd"
-    "virtio_pci"
-    "virtio_scsi"
-    "sd_mod"
-  ];
-  boot.initrd.kernelModules = [ "dm-snapshot" ];
-  boot.kernelModules = [ ];
-  boot.extraModulePackages = [ ];
-
-  fileSystems."/" = {
-    device = "/dev/mapper/pool-root";
-    fsType = "ext4";
-  };
-
-  fileSystems."/boot" = {
-    device = "/dev/disk/by-uuid/933A-3005";
-    fsType = "vfat";
-    options = [
-      "fmask=0077"
-      "dmask=0077"
-    ];
-  };
-
-  swapDevices = [
-    {
-      device = "/var/lib/swapfile";
-      size = 8 * 1024;
-    }
-  ];
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-}

hosts/ildkule/configuration.nix

@@ -1,11 +1,4 @@
-{
+{ config, fp, pkgs, lib, values, ... }:
-  config,
-  fp,
-  pkgs,
-  lib,
-  values,
-  ...
-}:
 {
   imports = [
       # Include the results of the hardware scan.
@@ -14,21 +7,23 @@
 
       ./services/monitoring
       ./services/nginx
-    ./services/journald-remote.nix
     ];
 
-  boot.loader.systemd-boot.enable = false;
+  sops.defaultSopsFile = fp /secrets/ildkule/ildkule.yaml;
+  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
+  sops.age.generateKey = true;
+
   boot.loader.grub.device = "/dev/vda";
   boot.tmp.cleanOnBoot = true;
   zramSwap.enable = true;
 
   # Openstack Neutron and systemd-networkd are not best friends, use something else:
   systemd.network.enable = lib.mkForce false;
-  networking =
+  networking = let
-    let
     hostConf = values.hosts.ildkule;
-    in
+  in {
-    {
+    hostName = "ildkule";
     tempAddresses = "disabled";
     useDHCP = lib.mkForce true;
 
@@ -38,27 +33,22 @@
 
     interfaces."ens4" = {
       ipv4.addresses = [
-          {
+        { address = hostConf.ipv4;          prefixLength = 32; }
-            address = hostConf.ipv4;
+        { address = hostConf.ipv4_internal; prefixLength = 24; }
-            prefixLength = 32;
-          }
-          {
-            address = hostConf.ipv4_internal;
-            prefixLength = 24;
-          }
       ];
       ipv6.addresses = [
-          {
+        { address = hostConf.ipv6;          prefixLength = 64; }
-            address = hostConf.ipv6;
-            prefixLength = 64;
-          }
       ];
     };
   };
 
-  services.qemuGuest.enable = true;
+  # List packages installed in system profile
+  environment.systemPackages = with pkgs; [
+  ];
+
+  # No devices with SMART
+  services.smartd.enable = false;
+
+  system.stateVersion = "23.11"; # Did you read the comment?
 
-  # Don't change (even during upgrades) unless you know what you are doing.
-  # See https://search.nixos.org/options?show=system.stateVersion
-  system.stateVersion = "23.11";
 }

hosts/ildkule/hardware-configuration.nix

@@ -1,12 +1,7 @@
 { modulesPath, lib, ... }:
 {
   imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
-  boot.initrd.availableKernelModules = [
+  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "xen_blkfront" "vmw_pvscsi" ];
-    "ata_piix"
-    "uhci_hcd"
-    "xen_blkfront"
-    "vmw_pvscsi"
-  ];
   boot.initrd.kernelModules = [ "nvme" ];
   fileSystems."/" = {
     device = "/dev/disk/by-uuid/e35eb4ce-aac3-4f91-8383-6e7cd8bbf942";

hosts/ildkule/services/journald-remote.nix

@@ -1,67 +0,0 @@
-{
-  config,
-  lib,
-  values,
-  ...
-}:
-let
-  cfg = config.services.journald.remote;
-  domainName = "journald.pvv.ntnu.no";
-in
-{
-  security.acme.certs.${domainName} = {
-    webroot = "/var/lib/acme/acme-challenge/";
-    group = config.services.nginx.group;
-  };
-
-  services.nginx = {
-    enable = true;
-    virtualHosts.${domainName} = {
-      forceSSL = true;
-      useACMEHost = "${domainName}";
-      locations."/.well-known/".root = "/var/lib/acme/acme-challenge/";
-    };
-  };
-
-  services.journald.upload.enable = lib.mkForce false;
-
-  services.journald.remote = {
-    enable = true;
-    settings.Remote =
-      let
-        inherit (config.security.acme.certs.${domainName}) directory;
-      in
-      {
-        ServerKeyFile = "/run/credentials/systemd-journal-remote.service/key.pem";
-        ServerCertificateFile = "/run/credentials/systemd-journal-remote.service/cert.pem";
-        TrustedCertificateFile = "-";
-      };
-  };
-
-  systemd.sockets."systemd-journal-remote" = {
-    socketConfig = {
-      IPAddressDeny = "any";
-      IPAddressAllow = [
-        "127.0.0.1"
-        "::1"
-        values.ipv4-space
-        values.ipv6-space
-      ];
-    };
-  };
-
-  networking.firewall.allowedTCPPorts = [ cfg.port ];
-
-  systemd.services."systemd-journal-remote" = {
-    serviceConfig = {
-      LoadCredential =
-        let
-          inherit (config.security.acme.certs.${domainName}) directory;
-        in
-        [
-          "key.pem:${directory}/key.pem"
-          "cert.pem:${directory}/cert.pem"
-        ];
-    };
-  };
-}

hosts/ildkule/services/monitoring/dashboards/mysql.json

@@ -13,7 +13,7 @@
     ]
   },
   "description": "",
-  "editable": false,
+  "editable": true,
   "gnetId": 11323,
   "graphTooltip": 1,
   "id": 31,
@@ -3690,7 +3690,7 @@
         },
         "hide": 0,
         "includeAll": false,
-        "label": "Data source",
+        "label": "Data Source",
         "multi": false,
         "name": "datasource",
         "options": [],
@@ -3713,12 +3713,12 @@
         "definition": "label_values(mysql_up, job)",
         "hide": 0,
         "includeAll": true,
-        "label": "Job",
+        "label": "job",
         "multi": true,
         "name": "job",
         "options": [],
         "query": "label_values(mysql_up, job)",
-        "refresh": 2,
+        "refresh": 1,
         "regex": "",
         "skipUrlSync": false,
         "sort": 0,
@@ -3742,12 +3742,12 @@
         "definition": "label_values(mysql_up, instance)",
         "hide": 0,
         "includeAll": true,
-        "label": "Instance",
+        "label": "instance",
         "multi": true,
         "name": "instance",
         "options": [],
         "query": "label_values(mysql_up, instance)",
-        "refresh": 2,
+        "refresh": 1,
         "regex": "",
         "skipUrlSync": false,
         "sort": 0,

hosts/ildkule/services/monitoring/dashboards/postgres.json

@@ -328,7 +328,7 @@
         "rgba(50, 172, 45, 0.97)"
       ],
       "datasource": "${DS_PROMETHEUS}",
-      "format": "short",
+      "format": "decbytes",
       "gauge": {
         "maxValue": 100,
         "minValue": 0,
@@ -411,7 +411,7 @@
         "rgba(50, 172, 45, 0.97)"
       ],
       "datasource": "${DS_PROMETHEUS}",
-      "format": "short",
+      "format": "decbytes",
       "gauge": {
         "maxValue": 100,
         "minValue": 0,
@@ -1410,7 +1410,7 @@
       "tableColumn": "",
       "targets": [
         {
-          "expr": "pg_settings_seq_page_cost{instance=\"$instance\"}",
+          "expr": "pg_settings_seq_page_cost",
           "format": "time_series",
           "intervalFactor": 1,
           "refId": "A"
@@ -1872,7 +1872,7 @@
       },
       "yaxes": [
         {
-          "format": "short",
+          "format": "bytes",
           "label": null,
           "logBase": 1,
           "max": null,
@@ -1966,7 +1966,7 @@
       },
       "yaxes": [
         {
-          "format": "short",
+          "format": "bytes",
           "label": null,
           "logBase": 1,
           "max": null,
@@ -2060,7 +2060,7 @@
       },
       "yaxes": [
         {
-          "format": "short",
+          "format": "bytes",
           "label": null,
           "logBase": 1,
           "max": null,
@@ -2251,7 +2251,7 @@
       },
       "yaxes": [
         {
-          "format": "short",
+          "format": "bytes",
           "label": null,
           "logBase": 1,
           "max": null,
@@ -2439,7 +2439,7 @@
       },
       "yaxes": [
         {
-          "format": "short",
+          "format": "bytes",
           "label": null,
           "logBase": 1,
           "max": null,
@@ -2589,35 +2589,35 @@
       "steppedLine": false,
       "targets": [
         {
-          "expr": "irate(pg_stat_bgwriter_buffers_backend_total{instance=\"$instance\"}[5m])",
+          "expr": "irate(pg_stat_bgwriter_buffers_backend{instance=\"$instance\"}[5m])",
           "format": "time_series",
           "intervalFactor": 1,
           "legendFormat": "buffers_backend",
           "refId": "A"
         },
         {
-          "expr": "irate(pg_stat_bgwriter_buffers_alloc_total{instance=\"$instance\"}[5m])",
+          "expr": "irate(pg_stat_bgwriter_buffers_alloc{instance=\"$instance\"}[5m])",
           "format": "time_series",
           "intervalFactor": 1,
           "legendFormat": "buffers_alloc",
           "refId": "B"
         },
         {
-          "expr": "irate(pg_stat_bgwriter_buffers_backend_fsync_total{instance=\"$instance\"}[5m])",
+          "expr": "irate(pg_stat_bgwriter_buffers_backend_fsync{instance=\"$instance\"}[5m])",
           "format": "time_series",
           "intervalFactor": 1,
           "legendFormat": "backend_fsync",
           "refId": "C"
         },
         {
-          "expr": "irate(pg_stat_bgwriter_buffers_checkpoint_total{instance=\"$instance\"}[5m])",
+          "expr": "irate(pg_stat_bgwriter_buffers_checkpoint{instance=\"$instance\"}[5m])",
           "format": "time_series",
           "intervalFactor": 1,
           "legendFormat": "buffers_checkpoint",
           "refId": "D"
         },
         {
-          "expr": "irate(pg_stat_bgwriter_buffers_clean_total{instance=\"$instance\"}[5m])",
+          "expr": "irate(pg_stat_bgwriter_buffers_clean{instance=\"$instance\"}[5m])",
           "format": "time_series",
           "intervalFactor": 1,
           "legendFormat": "buffers_clean",
@@ -2886,14 +2886,14 @@
       "steppedLine": false,
       "targets": [
         {
-          "expr": "irate(pg_stat_bgwriter_checkpoint_write_time_total{instance=\"$instance\"}[5m])",
+          "expr": "irate(pg_stat_bgwriter_checkpoint_write_time{instance=\"$instance\"}[5m])",
           "format": "time_series",
           "intervalFactor": 1,
           "legendFormat": "write_time - Total amount of time that has been spent in the portion of checkpoint processing where files are written to disk.",
           "refId": "B"
         },
         {
-          "expr": "irate(pg_stat_bgwriter_checkpoint_sync_time_total{instance=\"$instance\"}[5m])",
+          "expr": "irate(pg_stat_bgwriter_checkpoint_sync_time{instance=\"$instance\"}[5m])",
           "format": "time_series",
           "intervalFactor": 1,
           "legendFormat": "sync_time - Total amount of time that has been spent in the portion of checkpoint processing where files are synchronized to disk.",

hosts/ildkule/services/monitoring/grafana.nix

@@ -1,19 +1,10 @@
-{
+{ config, pkgs, values, ... }: let
-  config,
-  pkgs,
-  values,
-  ...
-}:
-let
   cfg = config.services.grafana;
-in
+in {
-{
+  sops.secrets = let
-  sops.secrets =
-    let
     owner = "grafana";
     group = "grafana";
-    in
+  in {
-    {
     "keys/grafana/secret_key" = { inherit owner group; };
     "keys/grafana/admin_password" = { inherit owner group; };
   };
@@ -21,12 +12,10 @@ in
   services.grafana = {
     enable = true;
 
-    settings =
+    settings = let
-      let
       # See https://grafana.com/docs/grafana/latest/setup-grafana/configure-grafana/#file-provider
       secretFile = path: "$__file{${path}}";
-      in
+    in {
-      {
       server = {
         domain = "grafana.pvv.ntnu.no";
         http_port = 2342;
@@ -58,13 +47,13 @@ in
         {
           name = "Node Exporter Full";
           type = "file";
-          url = "https://grafana.com/api/dashboards/1860/revisions/42/download";
+          url = "https://grafana.com/api/dashboards/1860/revisions/29/download";
           options.path = dashboards/node-exporter-full.json;
         }
         {
           name = "Matrix Synapse";
           type = "file";
-          url = "https://github.com/element-hq/synapse/raw/refs/heads/develop/contrib/grafana/synapse.json";
+          url = "https://raw.githubusercontent.com/matrix-org/synapse/develop/contrib/grafana/synapse.json";
           options.path = dashboards/synapse.json;
         }
         {
@@ -76,9 +65,15 @@ in
         {
           name = "Postgresql";
           type = "file";
-          url = "https://grafana.com/api/dashboards/9628/revisions/8/download";
+          url = "https://grafana.com/api/dashboards/9628/revisions/7/download";
           options.path = dashboards/postgres.json;
         }
+        {
+          name = "Go Processes (gogs)";
+          type = "file";
+          url = "https://grafana.com/api/dashboards/240/revisions/3/download";
+          options.path = dashboards/go-processes.json;
+        }
         {
           name = "Gitea Dashboard";
           type = "file";

hosts/ildkule/services/monitoring/loki.nix

@@ -3,8 +3,7 @@
 let
   cfg = config.services.loki;
   stateDir = "/data/monitoring/loki";
-in
+in {
-{
   services.loki = {
     enable = true;
     configuration = {

hosts/ildkule/services/monitoring/prometheus/default.nix

@@ -1,8 +1,6 @@
-{ config, ... }:
+{ config, ... }: let
-let
   stateDir = "/data/monitoring/prometheus";
-in
+in {
-{
   imports = [
     ./exim.nix
     ./gitea.nix

hosts/ildkule/services/monitoring/prometheus/exim.nix

@@ -5,11 +5,9 @@
       {
         job_name = "exim";
         scrape_interval = "15s";
-        static_configs = [
+        static_configs = [{
-          {
           targets = [ "microbel.pvv.ntnu.no:9636" ];
-          }
+        }];
-        ];
       }
     ];
   };

hosts/ildkule/services/monitoring/prometheus/gitea.nix

@@ -1,7 +1,6 @@
 { ... }:
 {
-  services.prometheus.scrapeConfigs = [
+  services.prometheus.scrapeConfigs = [{
-    {
     job_name = "gitea";
     scrape_interval = "60s";
     scheme = "https";
@@ -13,6 +12,5 @@
         ];
       }
     ];
-    }
+  }];
-  ];
 }

hosts/ildkule/services/monitoring/prometheus/machines.nix

@@ -1,5 +1,4 @@
-{ config, ... }:
+{ config, ... }: let
-let
   cfg = config.services.prometheus;
 
   mkHostScrapeConfig = name: ports: {
@@ -10,98 +9,29 @@ let
   defaultNodeExporterPort = 9100;
   defaultSystemdExporterPort = 9101;
   defaultNixosExporterPort = 9102;
-in
+in {
-{
+  services.prometheus.scrapeConfigs = [{
-  services.prometheus.scrapeConfigs = [
-    {
     job_name = "base_info";
     static_configs = [
-        (mkHostScrapeConfig "ildkule" [
+      (mkHostScrapeConfig "ildkule" [ cfg.exporters.node.port cfg.exporters.systemd.port defaultNixosExporterPort ])
-          cfg.exporters.node.port
-          cfg.exporters.systemd.port
-          defaultNixosExporterPort
-        ])
 
-        (mkHostScrapeConfig "bekkalokk" [
+      (mkHostScrapeConfig "bekkalokk" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
-          defaultNodeExporterPort
+      (mkHostScrapeConfig "bicep" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
-          defaultSystemdExporterPort
+      (mkHostScrapeConfig "brzeczyszczykiewicz" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
-          defaultNixosExporterPort
+      (mkHostScrapeConfig "georg" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
-        ])
+      (mkHostScrapeConfig "kommode" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
-        (mkHostScrapeConfig "bicep" [
+      (mkHostScrapeConfig "ustetind" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
-          defaultNodeExporterPort
+      (mkHostScrapeConfig "wenche" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
-          defaultSystemdExporterPort
-          defaultNixosExporterPort
-        ])
-        (mkHostScrapeConfig "brzeczyszczykiewicz" [
-          defaultNodeExporterPort
-          defaultSystemdExporterPort
-          defaultNixosExporterPort
-        ])
-        (mkHostScrapeConfig "georg" [
-          defaultNodeExporterPort
-          defaultSystemdExporterPort
-          defaultNixosExporterPort
-        ])
-        (mkHostScrapeConfig "gluttony" [
-          defaultNodeExporterPort
-          defaultSystemdExporterPort
-          defaultNixosExporterPort
-        ])
-        (mkHostScrapeConfig "kommode" [
-          defaultNodeExporterPort
-          defaultSystemdExporterPort
-          defaultNixosExporterPort
-        ])
-        (mkHostScrapeConfig "lupine-1" [
-          defaultNodeExporterPort
-          defaultSystemdExporterPort
-          defaultNixosExporterPort
-        ])
-        (mkHostScrapeConfig "lupine-2" [
-          defaultNodeExporterPort
-          defaultSystemdExporterPort
-          defaultNixosExporterPort
-        ])
-        (mkHostScrapeConfig "lupine-3" [
-          defaultNodeExporterPort
-          defaultSystemdExporterPort
-          defaultNixosExporterPort
-        ])
-        (mkHostScrapeConfig "lupine-4" [
-          defaultNodeExporterPort
-          defaultSystemdExporterPort
-          defaultNixosExporterPort
-        ])
-        (mkHostScrapeConfig "lupine-5" [
-          defaultNodeExporterPort
-          defaultSystemdExporterPort
-          defaultNixosExporterPort
-        ])
-        (mkHostScrapeConfig "temmie" [
-          defaultNodeExporterPort
-          defaultSystemdExporterPort
-          defaultNixosExporterPort
-        ])
-        (mkHostScrapeConfig "ustetind" [
-          defaultNodeExporterPort
-          defaultSystemdExporterPort
-          defaultNixosExporterPort
-        ])
-        (mkHostScrapeConfig "wenche" [
-          defaultNodeExporterPort
-          defaultSystemdExporterPort
-          defaultNixosExporterPort
-        ])
 
-        (mkHostScrapeConfig "skrott" [
+      (mkHostScrapeConfig "lupine-1" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
-          defaultNodeExporterPort
+      # (mkHostScrapeConfig "lupine-2" [ defaultNodeExporterPort defaultSystemdExporterPort ])
-          defaultSystemdExporterPort
+      (mkHostScrapeConfig "lupine-3" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
-        ])
+      (mkHostScrapeConfig "lupine-4" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
+      (mkHostScrapeConfig "lupine-5" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
 
       (mkHostScrapeConfig "hildring" [ defaultNodeExporterPort ])
       (mkHostScrapeConfig "isvegg" [ defaultNodeExporterPort ])
       (mkHostScrapeConfig "microbel" [ defaultNodeExporterPort ])
     ];
-    }
+  }];
-  ];
 }

hosts/ildkule/services/monitoring/prometheus/matrix-synapse.nix

@@ -1,16 +1,13 @@
 { ... }:
 {
-  services.prometheus.scrapeConfigs = [
+  services.prometheus.scrapeConfigs = [{
-    {
     job_name = "synapse";
     scrape_interval = "15s";
     scheme = "https";
 
-      http_sd_configs = [
+    http_sd_configs = [{
-        {
       url = "https://matrix.pvv.ntnu.no/metrics/config.json";
-        }
+    }];
-      ];
 
     relabel_configs = [
       {
@@ -39,6 +36,5 @@
         target_label = "__address__";
       }
     ];
-    }
+  }];
-  ];
 }

hosts/ildkule/services/monitoring/prometheus/mysqld.nix

@@ -1,18 +1,14 @@
-{ config, ... }:
+{ config, ... }: let
-let
   cfg = config.services.prometheus;
-in
+in {
-{
   sops = {
     secrets."config/mysqld_exporter_password" = { };
 
     templates."mysqld_exporter.conf" = {
       restartUnits = [ "prometheus-mysqld-exporter.service" ];
-      content =
+      content = let
-        let
         inherit (config.sops) placeholder;
-        in
+      in ''
-        ''
         [client]
         host = mysql.pvv.ntnu.no
         port = 3306
@@ -23,8 +19,7 @@ in
   };
 
   services.prometheus = {
-    scrapeConfigs = [
+    scrapeConfigs = [{
-      {
       job_name = "mysql";
       scheme = "http";
       metrics_path = cfg.exporters.mysqld.telemetryPath;
@@ -35,8 +30,7 @@ in
           ];
         }
       ];
-      }
+    }];
-    ];
 
     exporters.mysqld = {
       enable = true;

hosts/ildkule/services/monitoring/prometheus/postgres.nix

@@ -1,14 +1,6 @@
-{
+{ pkgs, lib, config, values, ... }: let
-  pkgs,
-  lib,
-  config,
-  values,
-  ...
-}:
-let
   cfg = config.services.prometheus;
-in
+in {
-{
   sops.secrets = {
     "keys/postgres/postgres_exporter_env" = {};
     "keys/postgres/postgres_exporter_knakelibrak_env" = {};
@@ -19,26 +11,22 @@ in
       {
         job_name = "postgres";
         scrape_interval = "15s";
-        static_configs = [
+        static_configs = [{
-          {
           targets = [ "localhost:${toString cfg.exporters.postgres.port}" ];
           labels = {
             server = "bicep";
           };
-          }
+        }];
-        ];
       }
       {
         job_name = "postgres-knakelibrak";
         scrape_interval = "15s";
-        static_configs = [
+        static_configs = [{
-          {
           targets = [ "localhost:${toString (cfg.exporters.postgres.port + 1)}" ];
           labels = {
             server = "knakelibrak";
           };
-          }
+        }];
-        ];
       }
     ];
 
@@ -49,11 +37,9 @@ in
     };
   };
 
-  systemd.services.prometheus-postgres-exporter-knakelibrak.serviceConfig =
+  systemd.services.prometheus-postgres-exporter-knakelibrak.serviceConfig = let
-    let
     localCfg = config.services.prometheus.exporters.postgres;
-    in
+  in lib.recursiveUpdate config.systemd.services.prometheus-postgres-exporter.serviceConfig {
-    lib.recursiveUpdate config.systemd.services.prometheus-postgres-exporter.serviceConfig {
       EnvironmentFile = config.sops.secrets."keys/postgres/postgres_exporter_knakelibrak_env".path;
       ExecStart = ''
         ${pkgs.prometheus-postgres-exporter}/bin/postgres_exporter \

hosts/ildkule/services/monitoring/uptime-kuma.nix

@@ -1,15 +1,9 @@
-{
+{ config, pkgs, lib, ... }:
-  config,
-  pkgs,
-  lib,
-  ...
-}:
 let
   cfg = config.services.uptime-kuma;
   domain = "status.pvv.ntnu.no";
   stateDir = "/data/monitoring/uptime-kuma";
-in
+in {
-{
   services.uptime-kuma = {
     enable = true;
     settings = {

hosts/kommode/configuration.nix

@@ -1,33 +1,32 @@
-{
+{ pkgs, values, fp, ... }:
-  pkgs,
-  values,
-  fp,
-  ...
-}:
 {
   imports = [
     # Include the results of the hardware scan.
     ./hardware-configuration.nix
     (fp /base)
-    ./disks.nix
 
     ./services/gitea
     ./services/nginx.nix
   ];
 
+  sops.defaultSopsFile = fp /secrets/kommode/kommode.yaml;
+  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
+  sops.age.generateKey = true;
+
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  networking.hostName = "kommode"; # Define your hostname.
+
   systemd.network.networks."30-ens18" = values.defaultNetworkConfig // {
     matchConfig.Name = "ens18";
-    address = with values.hosts.kommode; [
+    address = with values.hosts.kommode; [ (ipv4 + "/25") (ipv6 + "/64") ];
-      (ipv4 + "/25")
-      (ipv6 + "/64")
-    ];
   };
 
   services.btrfs.autoScrub.enable = true;
 
-  services.qemuGuest.enable = true;
+  environment.systemPackages = with pkgs; [];
 
-  # Don't change (even during upgrades) unless you know what you are doing.
-  # See https://search.nixos.org/options?show=system.stateVersion
   system.stateVersion = "24.11";
 }

hosts/kommode/disks.nix

@@ -1,80 +0,0 @@
-{ lib, ... }:
-{
-  disko.devices = {
-    disk = {
-      sda = {
-        type = "disk";
-        device = "/dev/sda";
-        content = {
-          type = "gpt";
-          partitions = {
-            root = {
-              name = "root";
-              label = "root";
-              start = "1MiB";
-              end = "-5G";
-              content = {
-                type = "btrfs";
-                extraArgs = [ "-f" ]; # Override existing partition
-                # subvolumes = let
-                #   makeSnapshottable = subvolPath: mountOptions: let
-                #     name = lib.replaceString "/" "-" subvolPath;
-                #   in {
-                #     "@${name}/active" = {
-                #       mountpoint = subvolPath;
-                #       inherit mountOptions;
-                #     };
-                #     "@${name}/snapshots" = {
-                #       mountpoint = "${subvolPath}/.snapshots";
-                #       inherit mountOptions;
-                #     };
-                #   };
-                # in {
-                #   "@" = { };
-                #   "@/swap" = {
-                #     mountpoint = "/.swapvol";
-                #     swap.swapfile.size = "4G";
-                #   };
-                #   "@/root" = {
-                #     mountpoint = "/";
-                #     mountOptions = [ "compress=zstd" "noatime" ];
-                #   };
-                # }
-                # // (makeSnapshottable "/home" [ "compress=zstd" "noatime" ])
-                # // (makeSnapshottable "/nix" [ "compress=zstd" "noatime" ])
-                # // (makeSnapshottable "/var/lib" [ "compress=zstd" "noatime" ])
-                # // (makeSnapshottable "/var/log" [ "compress=zstd" "noatime" ])
-                # // (makeSnapshottable "/var/cache" [ "compress=zstd" "noatime" ]);
-
-                # swap.swapfile.size = "4G";
-                mountpoint = "/";
-              };
-            };
-
-            swap = {
-              name = "swap";
-              label = "swap";
-              start = "-5G";
-              end = "-1G";
-              content.type = "swap";
-            };
-
-            ESP = {
-              name = "ESP";
-              label = "ESP";
-              start = "-1G";
-              end = "100%";
-              type = "EF00";
-              content = {
-                type = "filesystem";
-                format = "vfat";
-                mountpoint = "/boot";
-                mountOptions = [ "umask=0077" ];
-              };
-            };
-          };
-        };
-      };
-    };
-  };
-}

hosts/kommode/hardware-configuration.nix

@@ -1,31 +1,33 @@
-# Do not modify this file!  It was generated by 'nixos-generate-config'
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{
+{ config, lib, pkgs, modulesPath, ... }:
-  config,
-  lib,
-  pkgs,
-  modulesPath,
-  ...
-}:
 
 {
-  imports = [
+  imports =
-    (modulesPath + "/profiles/qemu-guest.nix")
+    [ (modulesPath + "/profiles/qemu-guest.nix")
     ];
 
-  boot.initrd.availableKernelModules = [
+  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
-    "ata_piix"
-    "uhci_hcd"
-    "virtio_pci"
-    "virtio_scsi"
-    "sd_mod"
-    "sr_mod"
-  ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ ];
   boot.extraModulePackages = [ ];
 
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/d421538f-a260-44ae-8e03-47cac369dcc1";
+      fsType = "btrfs";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/86CD-4C23";
+      fsType = "vfat";
+      options = [ "fmask=0077" "dmask=0077" ];
+    };
+
+  swapDevices =
+    [ { device = "/dev/disk/by-uuid/4cfbb41e-801f-40dd-8c58-0a0c1a6025f6"; }
+    ];
+
   # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
   # (the default) this is the recommended approach. When using systemd-networkd it's
   # still possible to use this option, but it's recommended to use it in conjunction

hosts/kommode/services/gitea/customization/default.nix

@@ -1,10 +1,4 @@
-{
+{ config, pkgs, lib, fp, ... }:
-  config,
-  pkgs,
-  lib,
-  fp,
-  ...
-}:
 let
   cfg = config.services.gitea;
 in
@@ -16,59 +10,6 @@ in
     catppuccin = pkgs.gitea-theme-catppuccin;
   };
 
-  services.gitea.settings = {
-    ui = {
-      DEFAULT_THEME = "gitea-auto";
-      REACTIONS = lib.concatStringsSep "," [
-        "+1"
-        "-1"
-        "laugh"
-        "confused"
-        "heart"
-        "hooray"
-        "rocket"
-        "eyes"
-        "100"
-        "anger"
-        "astonished"
-        "no_good"
-        "ok_hand"
-        "pensive"
-        "pizza"
-        "point_up"
-        "sob"
-        "skull"
-        "upside_down_face"
-        "shrug"
-        "huh"
-        "bruh"
-        "okiedokie"
-        "grr"
-      ];
-
-      CUSTOM_EMOJIS = lib.concatStringsSep "," [
-        "bruh"
-        "grr"
-        "huh"
-        "ohyeah"
-      ];
-    };
-    "ui.meta" = {
-      AUTHOR = "Programvareverkstedet";
-      DESCRIPTION = "Bokstavelig talt programvareverkstedet";
-      KEYWORDS = lib.concatStringsSep "," [
-        "git"
-        "hackerspace"
-        "nix"
-        "open source"
-        "foss"
-        "organization"
-        "software"
-        "student"
-      ];
-    };
-  };
-
   systemd.services.gitea-customization = lib.mkIf cfg.enable {
     description = "Install extra customization in gitea's CUSTOM_DIR";
     wantedBy = [ "gitea.service" ];
@@ -80,8 +21,7 @@ in
       Group = cfg.group;
     };
 
-    script =
+    script = let
-      let
       logo-svg = fp /assets/logo_blue_regular.svg;
       logo-png = fp /assets/logo_blue_regular.png;
 
@@ -99,21 +39,17 @@ in
         labels = lib.importJSON ./labels/projects.json;
       };
 
-        customTemplates =
+      customTemplates = pkgs.runCommandLocal "gitea-templates" {
-          pkgs.runCommandLocal "gitea-templates"
-            {
         nativeBuildInputs = with pkgs; [
           coreutils
           gnused
         ];
-            }
+      } ''
-            ''
         # Bigger icons
         install -Dm444 "${cfg.package.src}/templates/repo/icon.tmpl" "$out/repo/icon.tmpl"
         sed -i -e 's/24/60/g' "$out/repo/icon.tmpl"
       '';
-      in
+    in ''
-      ''
       install -Dm444 ${logo-svg} ${cfg.customDir}/public/assets/img/logo.svg
       install -Dm444 ${logo-png} ${cfg.customDir}/public/assets/img/logo.png
       install -Dm444 ${./loading.apng} ${cfg.customDir}/public/assets/img/loading.png
@@ -121,11 +57,6 @@ in
       install -Dm444 ${extraLinksFooter} ${cfg.customDir}/templates/custom/extra_links_footer.tmpl
       install -Dm444 ${project-labels} ${cfg.customDir}/options/label/project-labels.yaml
 
-        install -Dm644 ${./emotes/bruh.png} ${cfg.customDir}/public/assets/img/emoji/bruh.png
-        install -Dm644 ${./emotes/huh.gif} ${cfg.customDir}/public/assets/img/emoji/huh.png
-        install -Dm644 ${./emotes/grr.png} ${cfg.customDir}/public/assets/img/emoji/grr.png
-        install -Dm644 ${./emotes/okiedokie.jpg} ${cfg.customDir}/public/assets/img/emoji/okiedokie.png
-
       "${lib.getExe pkgs.rsync}" -a "${customTemplates}/" ${cfg.customDir}/templates/
     '';
   };