base/auto-upgrade: display build logs in journalctl

.gitea/workflows/build-topology-graph.yml

@@ -7,13 +7,16 @@ jobs:
   evals:
     runs-on: debian-latest
     steps:
-    - name: Install sudo
-      run: apt-get install --update --assume-yes sudo
-
     - uses: actions/checkout@v6
 
+    - name: Install sudo
+      run: apt-get update && apt-get -y install sudo
+
     - uses: https://github.com/cachix/install-nix-action@v31
 
+    - name: Configure Nix
+      run: echo -e "show-trace = true\nmax-jobs = auto\ntrusted-users = root\nexperimental-features = nix-command flakes\nbuild-users-group =" > /etc/nix/nix.conf
+
     - name: Build topology graph
       run: nix build .#topology -L
 

.gitea/workflows/eval.yml

@@ -6,11 +6,8 @@ jobs:
   evals:
     runs-on: debian-latest
     steps:
-    - name: Install sudo
-      run: apt-get install --update --assume-yes sudo
-
     - uses: actions/checkout@v6
-
+    - run: apt-get update && apt-get -y install sudo
     - uses: https://github.com/cachix/install-nix-action@v31
-
+    - run: echo -e "show-trace = true\nmax-jobs = auto\ntrusted-users = root\nexperimental-features = nix-command flakes\nbuild-users-group =" > /etc/nix/nix.conf
     - run: nix flake check

.mailmap

@@ -23,9 +23,3 @@ Adrian Gunnar Lauterer <adriangl@pvv.ntnu.no> Adrian Gunnar Lauterer <adrian@lau
 
 Fredrik Robertsen <frero@pvv.ntnu.no> frero <frero@pvv.ntnu.no>
 Fredrik Robertsen <frero@pvv.ntnu.no> fredrikr79 <fredrikrobertsen7@gmail.com>
-Fredrik Robertsen <frero@pvv.ntnu.no> fredrik <fredrikr79@pm.me>
-
-Vegard Bieker Matthey <vegardbm@pvv.ntnu.no> Vegard Matthey <VegardMatthey@protonmail.com>
-Vegard Bieker Matthey <vegardbm@pvv.ntnu.no> Vegard Bieker Matthey <VegardMatthey@protonmail.com>
-
-Albert Bayazidi <albertba@pvv.ntnu.no> Albert <albert.bayazidi@gmail.com>

.sops.yaml

@@ -7,21 +7,19 @@ keys:
   - &user_pederbs_bjarte age1zhxul786an743u0fascv4wtc5xduu7qfy803lfs539yzhgmlq5ds2lznt5
   - &user_pederbs_nord age1wrssr4z4g6vl3fd3qme5cewchmmhm0j2xe6wf2meu4r6ycn37anse98mfs
   - &user_pederbs_sopp age1hmpdk4h69wxpwqk9tkud39f66hprhehxtzhgw97r6dvr7v0mx5jscsuhkn
-  - &user_vegardbm age1sqs7urnzsdy64efmd0zukzv3gs5pnjksuxd7nqmdwdy5l0nqnunq6hyune
 
   # Hosts
+  - &host_bakke age1syted6kt48sumjjucggh6r3uca4x2ppp4mfungf3lamkt2le05csc99633
   - &host_bekkalokk age12nj59tguy9wg882updc2vjdusx5srnxmjyfaqve4zx6jnnsaw3qsyjq6zd
   - &host_bicep age19nk55kcs7s0358jpkn75xnr57dfq6fq3p43nartvsprx0su22v7qcgcjdx
-  - &host_ildkule age102e6y8gah0ntr6fxqnkpepc8ar29p6ls7ks9ka7v8w87q8scm9yqmc2u8d
+  - &host_ildkule age1x28hmzvuv6f2n66c0jtqcca3h9rput8d7j5uek6jcpx8n9egd52sqpejq0
   - &host_kommode age1mt4d0hg5g76qp7j0884llemy0k2ymr5up8vfudz6vzvsflk5nptqqd32ly
-  - &host_lupine-1 age18lta9d683yekz487xwtd99da236d8mgk4ftlmv2jffx858p9qf2s9j868l
+  - &host_lupine-1 age1fkrypl6fu4ldsa7te4g3v4qsegnk7sd6qhkquuwzh04vguy96qus08902e
-  - &host_lupine-2 age1e0a4ru707v637wzmuxqv0xywmlkhunzgyfy4mrkjc7a23qq8msgq7nqtvt
+  - &host_lupine-2 age1mu0ej57n4s30ghealhyju3enls83qyjua69986la35t2yh0q2s0seruz5n
-  - &host_lupine-3 age1wmrrhd5deatmgflkas636u3rzuk46u9knl02v4t39ncs37xqquhq9vwzye
+  - &host_lupine-3 age1j2u876z8hu87q5npfxzzpfgllyw8ypj66d7cgelmzmnrf3xud34qzkntp9
-  - &host_lupine-4 age1ml48zztcmnrdrhrdsjrlyxf09jtmjgz46u8td4zm59wn3fm4g57qs4wg0l
+  - &host_lupine-4 age1t8zlawqkmhye737pn8yx0z3p9cl947d9ktv2cajdc6hnvn52d3fsc59s2k
-  - &host_lupine-5 age12gws5nws69vxryd3kt7q0ayngch90efmhqcrfhnnsmj00lkgxd4qsdkvqn
+  - &host_lupine-5 age199zkqq4jp4yc3d0hx2q0ksxdtp42xhmjsqwyngh8tswuck34ke3smrfyqu
-  - &host_skrot age1hzkvnktkr8t5gvtq0ccw69e44z5z6wf00n3xhk3hj24emf07je5s6q2evr
+  - &host_ustetind age1hffjafs4slznksefmtqrlj7rdaqgzqncn4un938rhr053237ry8s3rs0v8
-  - &host_temmie age10avsdvqger25z0lyzlq8v7xfzcmypkmjsswswaxwqnpnl6x9wcjq0uv2n7
-  - &host_gluttony age12czfkvuw9pjk5qny5c6m2hjhd634cj9r4dsa3ss5zkux5h4vvc7s7k4urq
 
 creation_rules:
   # Global secrets
@@ -34,7 +32,6 @@ creation_rules:
       - *user_pederbs_sopp
       - *user_pederbs_nord
       - *user_pederbs_bjarte
-      - *user_vegardbm
       pgp:
       - *user_oysteikt
 
@@ -49,7 +46,6 @@ creation_rules:
       - *user_pederbs_sopp
       - *user_pederbs_nord
       - *user_pederbs_bjarte
-      - *user_vegardbm
       pgp:
       - *user_oysteikt
 
@@ -62,7 +58,6 @@ creation_rules:
       - *user_pederbs_sopp
       - *user_pederbs_nord
       - *user_pederbs_bjarte
-      - *user_vegardbm
       pgp:
       - *user_oysteikt
 
@@ -75,7 +70,6 @@ creation_rules:
       - *user_pederbs_sopp
       - *user_pederbs_nord
       - *user_pederbs_bjarte
-      - *user_vegardbm
       pgp:
       - *user_oysteikt
 
@@ -88,7 +82,18 @@ creation_rules:
       - *user_pederbs_sopp
       - *user_pederbs_nord
       - *user_pederbs_bjarte
-      - *user_vegardbm
+      pgp:
+      - *user_oysteikt
+
+  - path_regex: secrets/ustetind/[^/]+\.yaml$
+    key_groups:
+    - age:
+      - *host_ustetind
+      - *user_danio
+      - *user_felixalb
+      - *user_pederbs_sopp
+      - *user_pederbs_nord
+      - *user_pederbs_bjarte
       pgp:
       - *user_oysteikt
 
@@ -105,45 +110,28 @@ creation_rules:
       - *user_pederbs_sopp
       - *user_pederbs_nord
       - *user_pederbs_bjarte
-      - *user_vegardbm
       pgp:
       - *user_oysteikt
 
-  - path_regex: secrets/skrot/[^/]+\.yaml$
+  - path_regex: secrets/bakke/[^/]+\.yaml$
     key_groups:
     - age:
-      - *host_skrot
+      - *host_bakke
       - *user_danio
       - *user_felixalb
       - *user_pederbs_sopp
       - *user_pederbs_nord
       - *user_pederbs_bjarte
-      - *user_vegardbm
       pgp:
       - *user_oysteikt
 
-  - path_regex: secrets/temmie/[^/]+\.yaml$
+  - path_regex: secrets/skrott/[^/]+\.yaml$
     key_groups:
     - age:
-      - *host_temmie
       - *user_danio
       - *user_felixalb
       - *user_pederbs_sopp
       - *user_pederbs_nord
       - *user_pederbs_bjarte
-      - *user_vegardbm
-      pgp:
-      - *user_oysteikt
-
-  - path_regex: secrets/gluttony/[^/]+\.yaml$
-    key_groups:
-    - age:
-      - *host_gluttony
-      - *user_danio
-      - *user_felixalb
-      - *user_pederbs_sopp
-      - *user_pederbs_nord
-      - *user_pederbs_bjarte
-      - *user_vegardbm
       pgp:
       - *user_oysteikt

README.md

@@ -4,33 +4,7 @@ This repository contains the NixOS configurations for Programvareverkstedet's se
 In addition to machine configurations, it also contains a bunch of shared modules, packages, and
 more.
 
-> [!WARNING]
+## Machines
-> Please read [Development - working on the PVV machines](./docs/development.md) before making
-> any changes, and [Secret management and `sops-nix`](./docs/secret-management.md) before adding
-> any credentials such as passwords, API tokens, etc. to the configuration.
-
-## Deploying to machines
-
-> [!WARNING]
-> Be careful to think about state when testing changes against the machines. Sometimes, a certain change
-> can lead to irreversible changes to the data stored on the machine. An example would be a set of database
-> migrations applied when testing a newer version of a service. Unless that service also comes with downwards
-> migrations, you can not go back to the previous version without losing data.
-
-To deploy the changes to a machine, you should first SSH into the machine, and clone the pvv-nixos-config
-repository unless you have already done so. After that, checkout the branch you want to deploy from, and rebuild:
-
-```bash
-# Run this while in the pvv-nixos-config directory
-sudo nixos-rebuild switch --update-input nixpkgs --update-input nixpkgs-unstable --no-write-lock-file --refresh --flake .# --upgrade
-```
-
-This will rebuild the NixOS system on the current branch and switch the system configuration to reflect the new changes.
-
-Note that unless you eventually merge the current changes into `main`, the machine will rebuild itself automatically and
-revert the changes on the next nightly rebuild (tends to happen when everybody is asleep).
-
-## Machine overview
 
 | Name                       | Type     | Description                                               |
 |----------------------------|----------|-----------------------------------------------------------|
@@ -39,13 +13,10 @@ revert the changes on the next nightly rebuild (tends to happen when everybody i
 |  bikkje                    | Virtual  | Experimental login box                                    |
 | [brzeczyszczykiewicz][brz] | Physical | Shared music player                                       |
 | [georg][geo]               | Physical | Shared music player                                       |
-| [gluttony][glu]            | Virtual  | General purpose compute                                   |
 | [ildkule][ild]             | Virtual  | Logging and monitoring host, prometheus, grafana, ...     |
 | [kommode][kom]             | Virtual  | Gitea + Gitea pages                                       |
 | [lupine][lup]              | Physical | Gitea CI/CD runners                                       |
 |  shark                     | Virtual  | Test host for authentication, absolutely horrendous       |
-| [skrot][skr]               | Physical | Kiosk, snacks and soda                                    |
-| [temmie][tem]              | Virtual  | User websites                                             |
 | [wenche][wen]              | Virtual  | Nix-builders, general purpose compute                     |
 
 ## Documentation
@@ -59,10 +30,7 @@ revert the changes on the next nightly rebuild (tends to happen when everybody i
 [bic]: https://wiki.pvv.ntnu.no/wiki/Maskiner/bicep
 [brz]: https://wiki.pvv.ntnu.no/wiki/Maskiner/brzęczyszczykiewicz
 [geo]: https://wiki.pvv.ntnu.no/wiki/Maskiner/georg
-[glu]: https://wiki.pvv.ntnu.no/wiki/Maskiner/gluttony
 [ild]: https://wiki.pvv.ntnu.no/wiki/Maskiner/ildkule
 [kom]: https://wiki.pvv.ntnu.no/wiki/Maskiner/kommode
 [lup]: https://wiki.pvv.ntnu.no/wiki/Maskiner/lupine
-[skr]: https://wiki.pvv.ntnu.no/wiki/Maskiner/Skrot
-[tem]: https://wiki.pvv.ntnu.no/wiki/Maskiner/temmie
 [wen]: https://wiki.pvv.ntnu.no/wiki/Maskiner/wenche

base/default.nix

@@ -1,8 +1,6 @@
 {
-  config,
   pkgs,
   lib,
-  inputs,
   fp,
   ...
 }:
@@ -12,55 +10,34 @@
     (fp /users)
     (fp /modules/snakeoil-certs.nix)
 
-    ./mitigations.nix
-
-    ./hardening.nix
     ./networking.nix
     ./nix.nix
-    ./programs.nix
-    ./sops.nix
     ./vm.nix
+    ./flake-input-exporter.nix
 
     ./services/acme.nix
     ./services/auto-upgrade.nix
     ./services/dbus.nix
-    ./services/fluentbit.nix
     ./services/fwupd.nix
     ./services/irqbalance.nix
-    ./services/journald-upload.nix
     ./services/logrotate.nix
     ./services/nginx.nix
     ./services/openssh.nix
-    ./services/polkit.nix
     ./services/postfix.nix
-    ./services/prometheus-flake-input-exporter.nix
     ./services/prometheus-node-exporter.nix
     ./services/prometheus-systemd-exporter.nix
+    ./services/promtail.nix
     ./services/roowho2.nix
-    ./services/rsyslogd.nix
-    ./services/scrutiny-collector.nix
     ./services/smartd.nix
     ./services/thermald.nix
-    ./services/timesyncd.nix
     ./services/uptimed.nix
     ./services/userborn.nix
     ./services/userdbd.nix
   ];
 
-  system.nixos.tags = lib.optionals (inputs.self.sourceInfo ? dirtyRev) [ "dirty" ];
-
-  specialisation."auto-upgrade".configuration = {
-    system.nixos.tags = [ "auto" ];
-  };
-
   boot.tmp.cleanOnBoot = lib.mkDefault true;
   boot.kernelPackages = lib.mkDefault pkgs.linuxPackages_latest;
 
-  boot.loader.systemd-boot.enable = lib.mkDefault true;
-  boot.loader.efi.canTouchEfiVariables = lib.mkDefault true;
-
-  services.btrfs.autoScrub.enable = lib.mkDefault (lib.any ({ fsType, ... }: fsType == "btrfs") (lib.attrValues config.fileSystems));
-
   time.timeZone = "Europe/Oslo";
 
   i18n.defaultLocale = "en_US.UTF-8";
@@ -69,8 +46,21 @@
     keyMap = "no";
   };
 
-  # Don't install the /lib/ld-linux.so.2 stub
+  environment.systemPackages = with pkgs; [
-  environment.ldso32 = null;
+    file
+    git
+    gnupg
+    htop
+    nano
+    ripgrep
+    rsync
+    screen
+    tmux
+    vim
+    wget
+
+    kitty.terminfo
+  ];
 
   # .bash_profile already works, but lets also use .bashrc like literally every other distro
   # https://man.archlinux.org/man/core/bash/bash.1.en#INVOCATION
@@ -84,25 +74,15 @@
     fi
   '';
 
+  programs.zsh.enable = true;
+
+  # security.lockKernelModules = true;
+  security.protectKernelImage = true;
   security.sudo.execWheelOnly = true;
   security.sudo.extraConfig = ''
     Defaults lecture = never
   '';
 
-  # These are servers, sleep is for the weak
-  systemd.sleep.settings.Sleep = {
-    AllowSuspend = lib.mkDefault false;
-    AllowHibernation = lib.mkDefault false;
-  };
-
-  systemd.slices."system-monitoring" = {
-    description = "Monitoring related services";
-  };
-
-  # users.mutableUsers = lib.mkDefault false;
-
-  users.users.root.initialHashedPassword = "$y$j9T$ahP6GAdttD17OMBo7Yqeh.$Ad7qBcFvTL7HrJ9uTtrQzksN3220Nj9t/CrP6DwgK34"; # generated using mkpasswd, see huttiheita root on vaultwarden
-
   users.groups."drift".name = "drift";
 
   # Trusted users on the nix builder machines

base/flake-input-exporter.nix

@@ -0,0 +1,55 @@
+{
+  config,
+  inputs,
+  lib,
+  pkgs,
+  values,
+  ...
+}:
+let
+  data = lib.flip lib.mapAttrs inputs (
+    name: input: {
+      inherit (input)
+        lastModified
+        ;
+    }
+  );
+  folder = pkgs.writeTextDir "share/flake-inputs" (
+    lib.concatMapStringsSep "\n" (
+      { name, value }: ''nixos_last_modified_input{flake="${name}"} ${toString value.lastModified}''
+    ) (lib.attrsToList data)
+  );
+  port = 9102;
+in
+{
+  services.nginx.virtualHosts."${config.networking.fqdn}-nixos-metrics" = {
+    serverName = config.networking.fqdn;
+    serverAliases = [
+      "${config.networking.hostName}.pvv.org"
+    ];
+    locations."/metrics" = {
+      root = "${folder}/share";
+      tryFiles = "/flake-inputs =404";
+      extraConfig = ''
+        default_type text/plain;
+      '';
+    };
+    listen = [
+      {
+        inherit port;
+        addr = "0.0.0.0";
+      }
+    ];
+    extraConfig = ''
+      allow ${values.hosts.ildkule.ipv4}/32;
+      allow ${values.hosts.ildkule.ipv6}/128;
+      allow 127.0.0.1/32;
+      allow ::1/128;
+      allow ${values.ipv4-space};
+      allow ${values.ipv6-space};
+      deny all;
+    '';
+  };
+
+  networking.firewall.allowedTCPPorts = [ port ];
+}

base/hardening.nix

@@ -1,71 +0,0 @@
-{ ... }:
-{
-  boot.blacklistedKernelModules = [
-    # Obscure network protocols
-    "appletalk"
-    "atm"
-    "ax25"
-    "batman-adv"
-    "can"
-    "dccp"
-    "ipx"
-    "llc"
-    "n-hdlc"
-    "netrom"
-    "p8022"
-    "p8023"
-    "psnap"
-    "rds"
-    "rose"
-    "sctp"
-    "tipc"
-
-    # Filesystems we don't use
-    "adfs"
-    "affs"
-    "befs"
-    "bfs"
-    "cifs"
-    "cramfs"
-    "efs"
-    "exofs"
-    "freevxfs"
-    "gfs2"
-    "hfs"
-    "hfsplus"
-    "hpfs"
-    "jffs2"
-    "jfs"
-    "minix"
-    "nilfs2"
-    "ntfs"
-    "omfs"
-    "orangefs"
-    "qnx4"
-    "qnx6"
-    "sysv"
-    "ubifs"
-    "udf"
-    "ufs"
-
-    # Legacy hardware
-    "pcspkr"
-    "floppy"
-    "parport"
-    "ppdev"
-
-    # Other stuff we don't use
-    "firewire-core"
-    "firewire-ohci"
-    "ksmbd"
-    "ib_core"
-    "l2tp_eth"
-    "l2tp_netlink"
-    "l2tp_ppp"
-    "nfc"
-    "soundwire"
-  ];
-
-  # security.lockKernelModules = true;
-  security.protectKernelImage = true;
-}

base/mitigations.nix

@@ -1,24 +0,0 @@
-{ pkgs, lib, ... }:
-let
-  modulesToBan = [
-    # copy.fail
-    "af_alg"
-    "algif_aead"
-    "algif_hash"
-    "algif_rng"
-    "algif_skcipher"
-
-    # dirtyfrag / Fragnesia
-    "esp4"
-    "esp6"
-    "rxrpc"
-
-    # PinTheft
-    "rds"
-  ];
-in
-{
-  boot.blacklistedKernelModules = modulesToBan;
-
-  boot.extraModprobeConfig = lib.concatMapStringsSep "\n" (mod: "install ${mod} ${lib.getExe' pkgs.coreutils "false"}") modulesToBan;
-}

base/networking.nix

@@ -8,6 +8,6 @@
 
   services.resolved = {
     enable = lib.mkDefault true;
-    settings.Resolve.DNSSEC = false; # Supposdly this keeps breaking and the default is to allow downgrades anyways...
+    dnssec = "false"; # Supposdly this keeps breaking and the default is to allow downgrades anyways...
   };
 }

base/nix.nix

@@ -37,9 +37,4 @@
       "unstable=${inputs.nixpkgs-unstable}"
     ];
   };
-
-  # Make builds to be more likely killed than important services.
-  # 100 is the default for user slices and 500 is systemd-coredumpd@
-  # We rather want a build to be killed than our precious user sessions as builds can be easily restarted.
-  systemd.services.nix-daemon.serviceConfig.OOMScoreAdjust = lib.mkDefault 250;
 }

base/programs.nix

@@ -1,68 +0,0 @@
-{ pkgs, lib, ... }:
-{
-  # We don't need fonts on headless machines
-  fonts.fontconfig.enable = lib.mkDefault false;
-
-  # Extra packags for better terminal emulator compatibility in SSH sessions
-  environment.enableAllTerminfo = true;
-
-  environment.systemPackages = with pkgs; [
-    # Debug dns outside resolvectl
-    dig
-
-    # Debug and find files
-    file
-
-    # Process json data
-    jq
-
-    # Check computer specs
-    lshw
-
-    # Check who is keeping open files
-    lsof
-
-    # Scan for open ports with netstat
-    net-tools
-
-    # Grep for files quickly
-    ripgrep
-
-    # Copy files over the network
-    rsync
-
-    # Access various state, often in /var/lib
-    sqlite-interactive
-
-    # Debug software which won't debug itself
-    strace
-
-    # Download files from the internet
-    wget
-  ];
-
-  # Clone/push nix config and friends
-  programs.git.enable = true;
-
-  # Gitea gpg, oysteikt sops, etc.
-  programs.gnupg.agent.enable = true;
-
-  # Monitor the wellbeing of the machines
-  programs.htop.enable = true;
-
-  # Keep sessions running during work over SSH
-  programs.tmux.enable = true;
-
-  # Same reasoning as tmux
-  programs.screen.enable = true;
-
-  # Edit files on the system without resorting to joe(1)
-  programs.nano.enable = true;
-  # Same reasoning as nano
-  programs.vim.enable = true;
-  # Same reasoning as vim
-  programs.neovim.enable = true;
-
-  # Some people like this shell for some reason
-  programs.zsh.enable = true;
-}

base/services/acme.nix

@@ -8,5 +8,8 @@
   # Let's not spam LetsEncrypt in `nixos-rebuild build-vm` mode:
   virtualisation.vmVariant = {
     security.acme.defaults.server = "https://127.0.0.1";
+    security.acme.preliminarySelfsigned = true;
+
+    users.users.root.initialPassword = "root";
   };
 }

base/services/auto-upgrade.nix

@@ -13,7 +13,6 @@ in
 
       "--refresh"
       "--no-write-lock-file"
-      "--specialisation auto-upgrade"
       # --update-input is deprecated since nix 2.22, and removed in lix 2.90
       # as such we instead use --override-input combined with --refresh
       # https://git.lix.systems/lix-project/lix/issues/400
@@ -29,7 +28,7 @@ in
 
   # workaround for https://github.com/NixOS/nix/issues/6895
   # via https://git.lix.systems/lix-project/lix/issues/400
-  environment.etc = lib.mkIf (!config.virtualisation.isVmVariant && config.system.autoUpgrade.enable) {
+  environment.etc = lib.mkIf (!config.virtualisation.isVmVariant) {
     "current-system-flake-inputs.json".source
       = pkgs.writers.writeJSON "flake-inputs.json" (
         lib.flip lib.mapAttrs inputs (name: input:

base/services/fluentbit.nix

@@ -1,138 +0,0 @@
-{ config, lib, ... }:
-let
-  cfg = config.services.fluent-bit;
-in
-{
-  services.fluent-bit = {
-    enable = lib.mkDefault true;
-    settings = {
-      service = {
-        flush = 1;
-        log_level = "warn";
-
-        http_server = "on";
-        http_listen = "127.0.0.1";
-        http_port = 28183;
-
-        # filesystem-backed buffering so logs survives potential outages.
-        "storage.path" = "/var/lib/fluent-bit/storage";
-        "storage.sync" = "normal";
-        "storage.max_chunks_up" = 64;
-        "storage.backlog.mem_limit" = "16M";
-      };
-
-      pipeline = {
-        inputs = [{
-          name = "systemd";
-          tag = "journal.*";
-
-          db = "/var/lib/fluent-bit/journal.db";
-          read_from_tail = true;
-          strip_underscores = true;
-          lowercase = true;
-          max_entries = 1000;
-          "storage.type" = "filesystem";
-        }];
-
-        filters = [{
-          name = "modify";
-          match = "journal.*";
-          rename = [
-            "hostname host"
-            "priority level"
-            "systemd_unit unit"
-          ];
-        }] ++ (lib.mapAttrsToList (k: v: {
-          name = "modify";
-          match = "journal.*";
-          condition = "Key_value_equals level ${k}";
-          set = "level ${v}";
-        }) {
-          "7" = "debug";
-          "6" = "info";
-          "5" = "notice";
-          "4" = "warning";
-          "3" = "error";
-          "2" = "crit";
-          "1" = "alert";
-          "0" = "emergency";
-        });
-
-        outputs = [{
-          name = "loki";
-          match = "*";
-
-          host = "loki.pvv.ntnu.no";
-          port = 443;
-          tls = "on";
-          "tls.verify" = "on";
-          uri = "/loki/api/v1/push";
-          compress = "gzip";
-
-          labels = lib.concatStringsSep ", " [
-            "job=systemd-journal"
-          ];
-          label_keys = lib.concatMapStringsSep "," (k: "$" + k) [
-            "host"
-            "unit"
-            "level"
-          ];
-
-          # JSON is probably fine for now, then we just extract the keys we want with the grafana web ui
-          # line_format = "key_value";
-          # drop_single_key = true;
-
-          "storage.total_limit_size" = "256M";
-        }];
-      };
-    };
-  };
-
-  systemd.services.fluent-bit = lib.mkIf cfg.enable {
-    serviceConfig = {
-      Slice = "system-monitoring.slice";
-      StateDirectory = "fluent-bit";
-
-      # NOTE: This hardening might be way too strong for general purpose use, don't upstream this.
-      AmbientCapabilities = [ "" ];
-      CapabilityBoundingSet = [ "" ];
-      DeviceAllow = [ "" ];
-      LockPersonality = true;
-      # Lua JIT, maybe other things
-      MemoryDenyWriteExecute = false;
-      NoNewPrivileges = true;
-      PrivateDevices = true;
-      PrivateMounts = true;
-      PrivateTmp = true;
-      PrivateUsers = true;
-      ProtectClock = true;
-      ProtectControlGroups = true;
-      ProtectHome = true;
-      ProtectHostname = true;
-      ProtectKernelLogs = true;
-      ProtectKernelModules = true;
-      ProtectKernelTunables = true;
-      ProtectProc = "invisible";
-      ProtectSystem = "strict";
-      RestrictAddressFamilies = [
-        "AF_INET"
-        "AF_INET6"
-        "AF_UNIX"
-      ];
-      RestrictNamespaces = true;
-      RestrictRealtime = true;
-      RestrictSUIDSGID = true;
-      SystemCallArchitectures = "native";
-      SystemCallFilter = [
-        "@system-service"
-        "~@privileged"
-        "~@resources"
-      ];
-      UMask = "0077";
-
-      BindReadOnlyPaths = [
-        "/run/systemd/journal"
-      ];
-    };
-  };
-}

base/services/journald-upload.nix

@@ -1,24 +0,0 @@
-{ config, lib, values, ... }:
-let
-  cfg = config.services.journald.upload;
-in
-{
-  services.journald.upload = {
-    enable = lib.mkDefault true;
-    settings.Upload = {
-      URL = "https://journald.pvv.ntnu.no:${toString config.services.journald.remote.port}";
-      ServerKeyFile = "-";
-      ServerCertificateFile = "-";
-      TrustedCertificateFile = "-";
-    };
-  };
-
-  systemd.services."systemd-journal-upload".serviceConfig = lib.mkIf cfg.enable {
-    Slice = "system-monitoring.slice";
-    IPAddressDeny = "any";
-    IPAddressAllow = [
-      values.hosts.ildkule.ipv4
-      values.hosts.ildkule.ipv6
-    ];
-  };
-}

base/services/nginx.nix

@@ -1,5 +1,18 @@
 { config, lib, ... }:
 {
+  # nginx return 444 for all nonexistent virtualhosts
+
+  systemd.services.nginx.after = [ "generate-snakeoil-certs.service" ];
+
+  environment.snakeoil-certs = lib.mkIf config.services.nginx.enable {
+    "/etc/certs/nginx" = {
+      owner = "nginx";
+      group = "nginx";
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = lib.mkIf config.services.nginx.enable [ 80 443 ];
+
   services.nginx = {
     recommendedTlsSettings = true;
     recommendedProxySettings = true;
@@ -26,29 +39,29 @@
     SystemCallFilter = lib.mkForce null;
   };
 
-  services.nginx.virtualHosts = lib.mkIf config.services.nginx.enable {
+  services.nginx.virtualHosts."_" = lib.mkIf config.services.nginx.enable {
-    "_" = {
+    listen = [
-      listen = [
+      {
-        {
+        addr = "0.0.0.0";
-          addr = "0.0.0.0";
+        extraParameters = [
-          extraParameters = [
+          "default_server"
-            "default_server"
+          # Seemingly the default value of net.core.somaxconn
-            # Seemingly the default value of net.core.somaxconn
+          "backlog=4096"
-            "backlog=4096"
+          "deferred"
-            "deferred"
+        ];
-          ];
+      }
-        }
+      {
-        {
+        addr = "[::0]";
-          addr = "[::0]";
+        extraParameters = [
-          extraParameters = [
+          "default_server"
-            "default_server"
+          "backlog=4096"
-            "backlog=4096"
+          "deferred"
-            "deferred"
+        ];
-          ];
+      }
-        }
+    ];
-      ];
+    sslCertificate = "/etc/certs/nginx.crt";
-    };
+    sslCertificateKey = "/etc/certs/nginx.key";
+    addSSL = true;
+    extraConfig = "return 444;";
   };
-
-  networking.firewall.allowedTCPPorts = lib.mkIf config.services.nginx.enable [ 80 443 ];
 }

base/services/polkit.nix

@@ -1,18 +0,0 @@
-{ config, lib, ... }:
-let
-  cfg = config.security.polkit;
-in
-{
-  security.polkit.enable = true;
-
-  environment.etc."polkit-1/rules.d/9-nixos-overrides.rules".text = lib.mkIf cfg.enable ''
-    polkit.addRule(function(action, subject) {
-       if (
-           action.id.startsWith("org.freedesktop.systemd1.") &&
-           subject.isInGroup("wheel")
-       ) {
-           return polkit.Result.AUTH_SELF_KEEP;
-         }
-     });
-  '';
-}

base/services/prometheus-flake-input-exporter.nix

@@ -1,47 +0,0 @@
-{
-  config,
-  inputs,
-  lib,
-  pkgs,
-  values,
-  ...
-}:
-let
-  data = lib.flip lib.mapAttrs inputs (
-    name: input: {
-      inherit (input)
-        lastModified
-        ;
-    }
-  );
-  folder = pkgs.writeTextDir "share/flake-inputs" (
-    lib.concatMapStringsSep "\n" (
-      { name, value }: ''nixos_last_modified_input{flake="${name}"} ${toString value.lastModified}''
-    ) (lib.attrsToList data)
-  );
-in
-{
-  services.nginx = {
-    enable = lib.mkDefault true;
-
-    virtualHosts.${config.networking.fqdn} = lib.mkIf config.services.nginx.enable {
-      forceSSL = true;
-      enableACME = true;
-      kTLS = true;
-
-      locations."/prometheus-nixos-flake-input-exporter/metrics" = {
-        root = "${folder}/share";
-        tryFiles = "/flake-inputs =404";
-        extraConfig = ''
-          default_type text/plain;
-
-          allow 127.0.0.1;
-          allow ::1;
-          allow ${values.hosts.ildkule.ipv4};
-          allow ${values.hosts.ildkule.ipv6};
-          deny all;
-        '';
-      };
-    };
-  };
-}

base/services/prometheus-node-exporter.nix

@@ -5,34 +5,19 @@ in
 {
   services.prometheus.exporters.node = {
     enable = lib.mkDefault true;
-    listenAddress = "127.0.0.1";
     port = 9100;
     enabledCollectors = [ "systemd" ];
   };
 
-  services.nginx = lib.mkIf cfg.enable {
+  systemd.services.prometheus-node-exporter.serviceConfig = lib.mkIf cfg.enable {
-    enable = lib.mkDefault true;
+    IPAddressDeny = "any";
-
+    IPAddressAllow = [
-    virtualHosts.${config.networking.fqdn} = lib.mkIf config.services.nginx.enable {
+      "127.0.0.1"
-      forceSSL = true;
+      "::1"
-      enableACME = true;
+      values.hosts.ildkule.ipv4
-      kTLS = true;
+      values.hosts.ildkule.ipv6
-
+    ];
-      locations."/prometheus-node-exporter/metrics" = {
-        proxyPass = "http://localhost:${toString cfg.port}/metrics";
-
-        extraConfig = ''
-          allow 127.0.0.1;
-          allow ::1;
-          allow ${values.hosts.ildkule.ipv4};
-          allow ${values.hosts.ildkule.ipv6};
-          deny all;
-        '';
-      };
-    };
   };
 
-  systemd.services = lib.mkIf cfg.enable {
+  networking.firewall.allowedTCPPorts = lib.mkIf cfg.enable [ cfg.port ];
-    "prometheus-node-exporter".serviceConfig.Slice = "system-monitoring.slice";
-  };
 }

base/services/prometheus-systemd-exporter.nix

@@ -5,7 +5,6 @@ in
 {
   services.prometheus.exporters.systemd = {
     enable = lib.mkDefault true;
-    listenAddress = "127.0.0.1";
     port = 9101;
     extraFlags = [
       "--systemd.collector.enable-restart-count"
@@ -13,29 +12,15 @@ in
     ];
   };
 
-  services.nginx = lib.mkIf cfg.enable {
+  systemd.services.prometheus-systemd-exporter.serviceConfig = {
-    enable = lib.mkDefault true;
+    IPAddressDeny = "any";
-
+    IPAddressAllow = [
-    virtualHosts.${config.networking.fqdn} = lib.mkIf config.services.nginx.enable {
+      "127.0.0.1"
-      forceSSL = true;
+      "::1"
-      enableACME = true;
+      values.hosts.ildkule.ipv4
-      kTLS = true;
+      values.hosts.ildkule.ipv6
-
+    ];
-      locations."/prometheus-systemd-exporter/metrics" = {
-        proxyPass = "http://localhost:${toString cfg.port}/metrics";
-
-        extraConfig = ''
-          allow 127.0.0.1;
-          allow ::1;
-          allow ${values.hosts.ildkule.ipv4};
-          allow ${values.hosts.ildkule.ipv6};
-          deny all;
-        '';
-      };
-    };
   };
 
-  systemd.services = lib.mkIf cfg.enable {
+  networking.firewall.allowedTCPPorts = lib.mkIf cfg.enable [ cfg.port ];
-    "prometheus-systemd-exporter".serviceConfig.Slice = "system-monitoring.slice";
-  };
 }

base/services/promtail.nix

@@ -0,0 +1,38 @@
+{ config, lib, values, ... }:
+let
+  cfg = config.services.prometheus.exporters.node;
+in
+{
+  services.promtail = {
+    enable = lib.mkDefault true;
+    configuration = {
+      server = {
+        http_listen_port = 28183;
+        grpc_listen_port = 0;
+      };
+      clients = [{
+        url = "http://ildkule.pvv.ntnu.no:3100/loki/api/v1/push";
+      }];
+      scrape_configs = [{
+        job_name = "systemd-journal";
+        journal = {
+          max_age = "12h";
+          labels = {
+            job = "systemd-journal";
+            host = config.networking.hostName;
+          };
+        };
+        relabel_configs = [
+          {
+            source_labels = [ "__journal__systemd_unit" ];
+            target_label = "unit";
+          }
+          {
+            source_labels = [ "__journal_priority_keyword" ];
+            target_label = "level";
+          }
+        ];
+      }];
+    };
+  };
+}

base/services/rsyslogd.nix

@@ -1,20 +0,0 @@
-{ config, lib, ... }:
-let
-  cfg = config.services.rsyslogd;
-in
-{
-  services.rsyslogd = {
-    enable = lib.mkDefault true;
-    defaultConfig = ''
-      *.* @loghost.pvv.ntnu.no
-    '';
-  };
-
-  services.journald.extraConfig = lib.mkIf cfg.enable ''
-    ForwardToSyslog=yes
-  '';
-
-  systemd.services = lib.mkIf cfg.enable {
-    "syslog".serviceConfig.Slice = "system-monitoring.slice";
-  };
-}

base/services/scrutiny-collector.nix

@@ -1,11 +0,0 @@
-{ config, ... }:
-{
-  services.scrutiny.collector = {
-    enable = !config.services.qemuGuest.enable;
-    settings = {
-      version = 1;
-      host.id = config.networking.hostName;
-      api.endpoint = "https://scrutiny.pvv.ntnu.no/";
-    };
-  };
-}

base/services/smartd.nix

@@ -1,9 +1,7 @@
 { config, pkgs, lib, ... }:
 {
   services.smartd = {
-    # NOTE: qemu guests tend not to have SMART-reporting disks. Please override for the
+    enable = lib.mkDefault true;
-    #       hosts with disk passthrough.
-    enable = lib.mkDefault (!config.services.qemuGuest.enable);
     notifications = {
       mail = {
         enable = true;

base/services/timesyncd.nix

@@ -1,12 +0,0 @@
-{ ... }:
-{
-  services.timesyncd = {
-    servers = [ "ntp.ntnu.no" ];
-    fallbackServers = [
-      "0.pool.ntp.org"
-      "1.pool.ntp.org"
-      "0.no.pool.ntp.org"
-    ];
-  };
-}
-

base/services/uptimed.nix

@@ -23,7 +23,7 @@ in
       };
     };
 
-    systemd.services.uptimed = lib.mkIf cfg.enable {
+    systemd.services.uptimed = lib.mkIf (cfg.enable) {
       serviceConfig = let
         uptimed = pkgs.uptimed.overrideAttrs (prev: {
           postPatch = ''
@@ -35,8 +35,6 @@ in
         });
 
       in {
-        Slice = "system-monitoring.slice";
-
         Type = "notify";
 
         ExecStart = lib.mkForce "${uptimed}/sbin/uptimed -f";

base/sops.nix

@@ -1,12 +0,0 @@
-{ config, fp, lib, ... }:
-{
-  sops.defaultSopsFile = let
-    secretsFilePath = fp /secrets/${config.networking.hostName}/${config.networking.hostName}.yaml;
-  in lib.mkIf (builtins.pathExists secretsFilePath) secretsFilePath;
-
-  sops.age = lib.mkIf (config.sops.defaultSopsFile != null) {
-    sshKeyPaths = lib.mkDefault [ "/etc/ssh/ssh_host_ed25519_key" ];
-    keyFile = "/var/lib/sops-nix/key.txt";
-    generateKey = true;
-  };
-}

base/vm.nix

@@ -11,6 +11,5 @@
   };
   config.virtualisation.vmVariant = {
     virtualisation.isVmVariant = true;
-    virtualisation.graphics = false;
   };
 }

docs/development.md

@@ -156,6 +156,27 @@ nix build .#
 > built some of the machines recently. Be prepared to wait for up to an hour to build all machines from scratch
 > if this is the first time.
 
+### Deploying to machines
+
+> [!WARNING]
+> Be careful to think about state when testing changes against the machines. Sometimes, a certain change
+> can lead to irreversible changes to the data stored on the machine. An example would be a set of database
+> migrations applied when testing a newer version of a service. Unless that service also comes with downwards
+> migrations, you can not go back to the previous version without losing data.
+
+To deploy the changes to a machine, you should first SSH into the machine, and clone the pvv-nixos-config
+repository unless you have already done so. After that, checkout the branch you want to deploy from, and rebuild:
+
+```bash
+# Run this while in the pvv-nixos-config directory
+sudo nixos-rebuild switch --update-input nixpkgs --update-input nixpkgs-unstable --no-write-lock-file --refresh --flake .# --upgrade
+```
+
+This will rebuild the NixOS system on the current branch and switch the system configuration to reflect the new changes.
+
+Note that unless you eventually merge the current changes into `main`, the machine will rebuild itself automatically and
+revert the changes on the next nightly rebuild (tends to happen when everybody is asleep).
+
 ### Forcefully reset to `main`
 
 If you ever want to reset a machine to the `main` branch, you can do so by running:

docs/secret-management.md

@@ -151,7 +151,7 @@ is up to date, you can do the following:
 
 ```console
 # Fetch gpg (unless you have it already)
-nix shell nixpkgs#gnupg
+nix-shell -p gpg
 
 # Import oysteikts key to the gpg keychain
 gpg --import ./keys/oysteikt.pub

flake.lock

@@ -1,54 +1,39 @@
 {
   "nodes": {
-    "bro": {
+    "devshell": {
       "inputs": {
         "nixpkgs": [
+          "nix-topology",
           "nixpkgs"
-        ],
+        ]
-        "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1779629827,
+        "lastModified": 1764011051,
-        "narHash": "sha256-nrlB50/oelB8oFx9DhOoXI5z0VoTZGEA6XxYvkvpqDA=",
+        "narHash": "sha256-M7SZyPZiqZUR/EiiBJnmyUbOi5oE/03tCeFrTiUZchI=",
-        "ref": "main",
+        "owner": "numtide",
-        "rev": "7d0f35e12e4dec39f981c08fc33515589f41f4a5",
+        "repo": "devshell",
-        "revCount": 3,
+        "rev": "17ed8d9744ebe70424659b0ef74ad6d41fc87071",
-        "type": "git",
-        "url": "https://git.pvv.ntnu.no/Projects/bro.git"
-      },
-      "original": {
-        "ref": "main",
-        "type": "git",
-        "url": "https://git.pvv.ntnu.no/Projects/bro.git"
-      }
-    },
-    "crane": {
-      "locked": {
-        "lastModified": 1776635034,
-        "narHash": "sha256-OEOJrT3ZfwbChzODfIH4GzlNTtOFuZFWPtW7jIeR8xU=",
-        "owner": "ipetkov",
-        "repo": "crane",
-        "rev": "dc7496d8ea6e526b1254b55d09b966e94673750f",
         "type": "github"
       },
       "original": {
-        "owner": "ipetkov",
+        "owner": "numtide",
-        "repo": "crane",
+        "repo": "devshell",
         "type": "github"
       }
     },
     "dibbler": {
       "inputs": {
+        "flake-utils": "flake-utils",
         "nixpkgs": [
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1780236125,
+        "lastModified": 1767906875,
-        "narHash": "sha256-LFFdHbXFthgU81S6P+p9FFKs/Wx868d4CtsFvbgvQqo=",
+        "narHash": "sha256-S88Qh7TJwuTkMQqAdXmF3JMkuV2e5GHTdom02QrtdIs=",
         "ref": "main",
-        "rev": "267af00ebd8693632fa0f80300e49203cfcebbd4",
+        "rev": "b86962ef0e15d1a7de445172d4acea454b119a91",
-        "revCount": 258,
+        "revCount": 220,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Projects/dibbler.git"
       },
@@ -65,50 +50,83 @@
         ]
       },
       "locked": {
-        "lastModified": 1768920986,
+        "lastModified": 1736864502,
-        "narHash": "sha256-CNzzBsRhq7gg4BMBuTDObiWDH/rFYHEuDRVOwCcwXw4=",
+        "narHash": "sha256-ItkIZyebGvNH2dK9jVGzJHGPtb6BSWLN8Gmef16NeY0=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "de5708739256238fb912c62f03988815db89ec9a",
+        "rev": "0141aabed359f063de7413f80d906e1d98c0c123",
         "type": "github"
       },
       "original": {
         "owner": "nix-community",
-        "ref": "v1.13.0",
+        "ref": "v1.11.0",
         "repo": "disko",
         "type": "github"
       }
     },
-    "flake-parts": {
+    "flake-compat": {
-      "inputs": {
+      "flake": false,
-        "nixpkgs-lib": "nixpkgs-lib"
-      },
       "locked": {
-        "lastModified": 1772408722,
+        "lastModified": 1761588595,
-        "narHash": "sha256-rHuJtdcOjK7rAHpHphUb1iCvgkU3GpfvicLMwwnfMT0=",
+        "narHash": "sha256-XKUZz9zewJNUj46b4AJdiRZJAvSZ0Dqj2BNfXvFlJC4=",
-        "owner": "hercules-ci",
+        "owner": "edolstra",
-        "repo": "flake-parts",
+        "repo": "flake-compat",
-        "rev": "f20dc5d9b8027381c474144ecabc9034d6a839a3",
+        "rev": "f387cd2afec9419c8ee37694406ca490c3f34ee5",
         "type": "github"
       },
       "original": {
-        "owner": "hercules-ci",
+        "owner": "edolstra",
-        "repo": "flake-parts",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "id": "flake-utils",
+        "type": "indirect"
+      }
+    },
+    "flake-utils_2": {
+      "inputs": {
+        "systems": "systems_2"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
         "type": "github"
       }
     },
     "gergle": {
       "inputs": {
         "nixpkgs": [
-          "nixpkgs-unstable"
+          "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1777067150,
+        "lastModified": 1767906545,
-        "narHash": "sha256-vqPz8jCS1zTQlvmgctUFpvnr6f9ISR5h7CPG/HgQvf0=",
+        "narHash": "sha256-LOf08pcjEQFLs3dLPuep5d1bAXWOFcdfxuk3YMb5KWw=",
         "ref": "main",
-        "rev": "b452a854fb78d6df9fe062b45e23a968657d115d",
+        "rev": "e55cbe0ce0b20fc5952ed491fa8a553c8afb1bdd",
-        "revCount": 35,
+        "revCount": 23,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Grzegorz/gergle.git"
       },
@@ -118,18 +136,40 @@
         "url": "https://git.pvv.ntnu.no/Grzegorz/gergle.git"
       }
     },
+    "gitignore": {
+      "inputs": {
+        "nixpkgs": [
+          "nix-topology",
+          "pre-commit-hooks",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1709087332,
+        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "type": "github"
+      }
+    },
     "greg-ng": {
       "inputs": {
         "nixpkgs": [
-          "nixpkgs-unstable"
+          "nixpkgs"
         ],
-        "rust-overlay": "rust-overlay_2"
+        "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1779345549,
+        "lastModified": 1767906494,
-        "narHash": "sha256-naEMpFsQrco5eDtYmcTG6cpbPG+kqElOyS7fTb/jw9s=",
+        "narHash": "sha256-Dd6gtdZfRMAD6JhdX0GdJwIHVaBikePSpQXhIdwLlWI=",
         "ref": "main",
-        "rev": "5631e1124508fdef0604b08bfcf6343d967a21b3",
+        "rev": "7258822e2e90fea2ea00b13b5542f63699e33a9e",
         "revCount": 61,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Grzegorz/greg-ng.git"
@@ -161,27 +201,6 @@
         "url": "https://git.pvv.ntnu.no/Grzegorz/grzegorz-clients.git"
       }
     },
-    "libdib": {
-      "inputs": {
-        "nixpkgs": [
-          "worblehat",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1780178524,
-        "narHash": "sha256-2PcNyNqbGCWBpAMdCU1HxSQmhQiG6evdjxVnPA7w5bQ=",
-        "ref": "refs/heads/main",
-        "rev": "2406de41ce9d0a1404cbf4e55537e3f720f37f23",
-        "revCount": 15,
-        "type": "git",
-        "url": "https://git.pvv.ntnu.no/Projects/libdib.git"
-      },
-      "original": {
-        "type": "git",
-        "url": "https://git.pvv.ntnu.no/Projects/libdib.git"
-      }
-    },
     "matrix-next": {
       "inputs": {
         "nixpkgs": [
@@ -189,16 +208,16 @@
         ]
       },
       "locked": {
-        "lastModified": 1782122067,
+        "lastModified": 1764844095,
-        "narHash": "sha256-95q3DiYOTHjQGbqR0I1w4ETrH+smtddqW0bBxaB/Egg=",
+        "narHash": "sha256-Drf1orxsmFDzO+UbPo85gHjXW7QzAM+6oTPvI7vOSik=",
         "owner": "dali99",
         "repo": "nixos-matrix-modules",
-        "rev": "0e0fd9f6a407b08dd5e180a2ff6c3808461e2c47",
+        "rev": "25b9f31ef1dbc3987b4c716de716239f2b283701",
         "type": "github"
       },
       "original": {
         "owner": "dali99",
-        "ref": "master",
+        "ref": "v0.8.0",
         "repo": "nixos-matrix-modules",
         "type": "github"
       }
@@ -208,7 +227,7 @@
         "nixpkgs": [
           "nixpkgs"
         ],
-        "rust-overlay": "rust-overlay_3"
+        "rust-overlay": "rust-overlay_2"
       },
       "locked": {
         "lastModified": 1767906976,
@@ -232,11 +251,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1769500363,
+        "lastModified": 1767906653,
-        "narHash": "sha256-vFxmdsLBPdTy5j2bf54gbTQi1XnWbZDmeR/BBh8MFrw=",
+        "narHash": "sha256-KMiVvnlkRpW4/MVloLURfjv3bvjcae0X9skext2jKVE=",
         "ref": "main",
-        "rev": "2618e434e40e109eaab6a0693313c7e0de7324a3",
+        "rev": "584fd6379c905a6370484c5b5ba0623b4fcb778f",
-        "revCount": 47,
+        "revCount": 27,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Projects/minecraft-kartverket.git"
       },
@@ -253,11 +272,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1770960722,
+        "lastModified": 1767906352,
-        "narHash": "sha256-IdhPsWFZUKSJh/nLjGLJvGM5d5Uta+k1FlVYPxTZi0E=",
+        "narHash": "sha256-wYsH9MMAPFG3XTL+3DwI39XMG0F2fTmn/5lt265a3Es=",
         "ref": "main",
-        "rev": "c2e4aca7e1ba27cd09eeaeab47010d32a11841b2",
+        "rev": "d054c5d064b8ed6d53a0adb0cf6c0a72febe212e",
-        "revCount": 15,
+        "revCount": 13,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Drift/nix-gitea-themes.git"
       },
@@ -269,17 +288,19 @@
     },
     "nix-topology": {
       "inputs": {
-        "flake-parts": "flake-parts",
+        "devshell": "devshell",
+        "flake-utils": "flake-utils_2",
         "nixpkgs": [
           "nixpkgs"
-        ]
+        ],
+        "pre-commit-hooks": "pre-commit-hooks"
       },
       "locked": {
-        "lastModified": 1778407980,
+        "lastModified": 1767888340,
-        "narHash": "sha256-r980BhsReZQe6FkmyNZkwCZpvzARo5jZgTl8HxjAssY=",
+        "narHash": "sha256-CccRg4d8TpOUGz2HefBZLNYtGrcAyCMa7GVJHcUd8W4=",
         "owner": "oddlama",
         "repo": "nix-topology",
-        "rev": "ca0a602f650306d00d6f3e3c76d0f4c48a5c5adc",
+        "rev": "416ff06f72e810c554761e3f5dbf33b4f331e73e",
         "type": "github"
       },
       "original": {
@@ -291,64 +312,51 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1782708249,
+        "lastModified": 1767871818,
-        "narHash": "sha256-ASIzbiHLqFDHfomCJVMDaW1rsD9IJQ/m997Tw8569tM=",
+        "narHash": "sha256-SOIHRu1sk+dW5f5DNTN5xYoeuZCyGIlKqxZ8RRj4lCM=",
-        "rev": "68d68014342a18d2514d6e6f1185cfc24d02fc00",
+        "rev": "6eb8dee465373971d4495d92e23c2f0979384f76",
         "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/26.05-small/nixos-26.05.3713.68d68014342a/nixexprs.tar.xz"
+        "url": "https://releases.nixos.org/nixos/25.11-small/nixos-25.11.3412.6eb8dee46537/nixexprs.tar.xz"
       },
       "original": {
         "type": "tarball",
-        "url": "https://nixos.org/channels/nixos-26.05-small/nixexprs.tar.xz"
+        "url": "https://nixos.org/channels/nixos-25.11-small/nixexprs.tar.xz"
-      }
-    },
-    "nixpkgs-lib": {
-      "locked": {
-        "lastModified": 1772328832,
-        "narHash": "sha256-e+/T/pmEkLP6BHhYjx6GmwP5ivonQQn0bJdH9YrRB+Q=",
-        "owner": "nix-community",
-        "repo": "nixpkgs.lib",
-        "rev": "c185c7a5e5dd8f9add5b2f8ebeff00888b070742",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "nixpkgs.lib",
-        "type": "github"
       }
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1782731455,
+        "lastModified": 1767870855,
-        "narHash": "sha256-vFMOLxoARiCUBQOysAAJ0VmPzilmHUqk3EZfSRweKN8=",
+        "narHash": "sha256-SmrGFE9SdHFz60YbSCF7TtZ+GV8nIiYiI8fTEDyUouc=",
-        "rev": "9c4c05a947a91dc14625265fab505fb695e93218",
+        "rev": "719f19e8e447a52152aee8061c7a2951f9254f14",
         "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/unstable-small/nixos-26.11pre1024311.9c4c05a947a9/nixexprs.tar.xz"
+        "url": "https://releases.nixos.org/nixos/unstable-small/nixos-26.05pre924399.719f19e8e447/nixexprs.tar.xz"
       },
       "original": {
         "type": "tarball",
         "url": "https://nixos.org/channels/nixos-unstable-small/nixexprs.tar.xz"
       }
     },
-    "passwd2systemd-users": {
+    "pre-commit-hooks": {
       "inputs": {
+        "flake-compat": "flake-compat",
+        "gitignore": "gitignore",
         "nixpkgs": [
+          "nix-topology",
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1780764154,
+        "lastModified": 1765911976,
-        "narHash": "sha256-Xvf9aBNLYDnbDKdtFjp5GEA/rZwVczHZWbJ0hac8Vv4=",
+        "narHash": "sha256-t3T/xm8zstHRLx+pIHxVpQTiySbKqcQbK+r+01XVKc0=",
-        "ref": "main",
+        "owner": "cachix",
-        "rev": "8b4541be73ee3bd6c60525b2f42605efe89398c9",
+        "repo": "pre-commit-hooks.nix",
-        "revCount": 14,
+        "rev": "b68b780b69702a090c8bb1b973bab13756cc7a27",
-        "type": "git",
+        "type": "github"
-        "url": "https://git.pvv.ntnu.no/Projects/passwd2systemd-users.git"
       },
       "original": {
-        "ref": "main",
+        "owner": "cachix",
-        "type": "git",
+        "repo": "pre-commit-hooks.nix",
-        "url": "https://git.pvv.ntnu.no/Projects/passwd2systemd-users.git"
+        "type": "github"
       }
     },
     "pvv-calendar-bot": {
@@ -358,11 +366,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1779774845,
+        "lastModified": 1764869785,
-        "narHash": "sha256-QJU1J4eupwjRrtvWGzRut0GY3woql92RS9O/acWkJkk=",
+        "narHash": "sha256-FGTIpC7gB4lbeL0bfYzn1Ge0PaCpd7VqWBLhJBx0i4A=",
         "ref": "main",
-        "rev": "13667cd216db260ab549e6f1b6281aa230d2f9e0",
+        "rev": "8ce7fb0b1918bdb3d1489a40d73895693955e8b2",
-        "revCount": 29,
+        "revCount": 23,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Projects/calendar-bot.git"
       },
@@ -379,11 +387,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1782759909,
+        "lastModified": 1768292629,
-        "narHash": "sha256-gktjBeZyoRvVBkm2cO1tD99fdQ34iUDyB6iecRdorm4=",
+        "narHash": "sha256-gOiSfqeQs/rOcJtQMrH5r1t7Xvg9r3GO5YaUtQxTgVs=",
         "ref": "main",
-        "rev": "ad6c79fb713884a4a2df8aab30914cd0c1c2e6cb",
+        "rev": "597aaf413a9d3f1f8c1265a0d2bea24b3c7217c1",
-        "revCount": 587,
+        "revCount": 560,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Projects/nettsiden.git"
       },
@@ -393,30 +401,8 @@
         "url": "https://git.pvv.ntnu.no/Projects/nettsiden.git"
       }
     },
-    "qotd": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1768684204,
-        "narHash": "sha256-TErBiXxTRPUtZ/Mw8a5p+KCeGCFXa0o8fzwGoo75//Y=",
-        "ref": "main",
-        "rev": "a86f361bb8cfac3845b96d49fcbb2faea669844f",
-        "revCount": 11,
-        "type": "git",
-        "url": "https://git.pvv.ntnu.no/Projects/qotd.git"
-      },
-      "original": {
-        "ref": "main",
-        "type": "git",
-        "url": "https://git.pvv.ntnu.no/Projects/qotd.git"
-      }
-    },
     "root": {
       "inputs": {
-        "bro": "bro",
         "dibbler": "dibbler",
         "disko": "disko",
         "gergle": "gergle",
@@ -429,35 +415,30 @@
         "nix-topology": "nix-topology",
         "nixpkgs": "nixpkgs",
         "nixpkgs-unstable": "nixpkgs-unstable",
-        "passwd2systemd-users": "passwd2systemd-users",
         "pvv-calendar-bot": "pvv-calendar-bot",
         "pvv-nettsiden": "pvv-nettsiden",
-        "qotd": "qotd",
         "roowho2": "roowho2",
-        "sops-nix": "sops-nix",
+        "sops-nix": "sops-nix"
-        "worblehat": "worblehat"
       }
     },
     "roowho2": {
       "inputs": {
-        "crane": "crane",
         "nixpkgs": [
           "nixpkgs"
         ],
-        "rust-overlay": "rust-overlay_4"
+        "rust-overlay": "rust-overlay_3"
       },
       "locked": {
-        "lastModified": 1782275838,
+        "lastModified": 1767903580,
-        "narHash": "sha256-CW84hEFcypvEegQp+4zZZ4lCnPT7Qn27OpKiQBxiWS8=",
+        "narHash": "sha256-UtulIUyFv6HcU5BUcQONtyG29XPTOBMsJ4N0nJGNOUk=",
         "ref": "main",
-        "rev": "71d2b72c34352a79dbee8ebf23ce64f39aead692",
+        "rev": "dd23346bda46629788b08aba2e8af3b3f13335af",
-        "revCount": 102,
+        "revCount": 38,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Projects/roowho2.git"
       },
       "original": {
         "ref": "main",
-        "rev": "71d2b72c34352a79dbee8ebf23ce64f39aead692",
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Projects/roowho2.git"
       }
@@ -465,16 +446,16 @@
     "rust-overlay": {
       "inputs": {
         "nixpkgs": [
-          "bro",
+          "greg-ng",
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1779419951,
+        "lastModified": 1767840362,
-        "narHash": "sha256-dMX0PUslUHPajP6o8FEoRdFv9afq/dec4POR0vVfjK4=",
+        "narHash": "sha256-ZtsFqUhilubohNZ1TgpQIFsi4biZTwRH9rjZsDRDik8=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "5b5c521d6cae9ef4aa32f888eb2c0ce595c9be52",
+        "rev": "d159ea1fc321c60f88a616ac28bab660092a227d",
         "type": "github"
       },
       "original": {
@@ -484,27 +465,6 @@
       }
     },
     "rust-overlay_2": {
-      "inputs": {
-        "nixpkgs": [
-          "greg-ng",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1779333539,
-        "narHash": "sha256-lpmN2lrBDZDPjov2cbD3bOOJsI0fkKolKXasYPCqSys=",
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "rev": "672fa5fc5608d5cd82286a6f69aaf84a40b4fe41",
-        "type": "github"
-      },
-      "original": {
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "type": "github"
-      }
-    },
-    "rust-overlay_3": {
       "inputs": {
         "nixpkgs": [
           "minecraft-heatmap",
@@ -525,7 +485,7 @@
         "type": "github"
       }
     },
-    "rust-overlay_4": {
+    "rust-overlay_3": {
       "inputs": {
         "nixpkgs": [
           "roowho2",
@@ -533,11 +493,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1776914043,
+        "lastModified": 1767322002,
-        "narHash": "sha256-qug5r56yW1qOsjSI99l3Jm15JNT9CvS2otkXNRNtrPI=",
+        "narHash": "sha256-yHKXXw2OWfIFsyTjduB4EyFwR0SYYF0hK8xI9z4NIn0=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "2d35c4358d7de3a0e606a6e8b27925d981c01cc3",
+        "rev": "03c6e38661c02a27ca006a284813afdc461e9f7e",
         "type": "github"
       },
       "original": {
@@ -553,11 +513,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1782165805,
+        "lastModified": 1767826491,
-        "narHash": "sha256-478kKQBvK6SYTOdN2h9jhKJv94nbXRbFMfuL1WshErg=",
+        "narHash": "sha256-WSBENPotD2MIhZwolL6GC9npqgaS5fkM7j07V2i/Ur8=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "56b24064fdcaedca53553b1a6d607fd23b613a24",
+        "rev": "ea3adcb6d2a000d9a69d0e23cad1f2cacb3a9fbe",
         "type": "github"
       },
       "original": {
@@ -567,26 +527,34 @@
         "type": "github"
       }
     },
-    "worblehat": {
+    "systems": {
-      "inputs": {
-        "libdib": "libdib",
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
       "locked": {
-        "lastModified": 1780762731,
+        "lastModified": 1681028828,
-        "narHash": "sha256-EuDaLnasWN0mpi995n+fAQQfPGBhqNW4fNjlQRpHt58=",
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "ref": "main",
+        "owner": "nix-systems",
-        "rev": "931bd2d63e285e767c8c81c103dda3c0a63f2965",
+        "repo": "default",
-        "revCount": 108,
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "git",
+        "type": "github"
-        "url": "https://git.pvv.ntnu.no/Projects/worblehat.git"
       },
       "original": {
-        "ref": "main",
+        "owner": "nix-systems",
-        "type": "git",
+        "repo": "default",
-        "url": "https://git.pvv.ntnu.no/Projects/worblehat.git"
+        "type": "github"
+      }
+    },
+    "systems_2": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
       }
     }
   },

flake.nix

@@ -2,13 +2,13 @@
   description = "PVV System flake";
 
   inputs = {
-    nixpkgs.url = "https://nixos.org/channels/nixos-26.05-small/nixexprs.tar.xz";
+    nixpkgs.url = "https://nixos.org/channels/nixos-25.11-small/nixexprs.tar.xz";
     nixpkgs-unstable.url = "https://nixos.org/channels/nixos-unstable-small/nixexprs.tar.xz";
 
     sops-nix.url = "github:Mic92/sops-nix/master";
     sops-nix.inputs.nixpkgs.follows = "nixpkgs";
 
-    disko.url = "github:nix-community/disko/v1.13.0";
+    disko.url = "github:nix-community/disko/v1.11.0";
     disko.inputs.nixpkgs.follows = "nixpkgs";
 
     nix-topology.url = "github:oddlama/nix-topology/main";
@@ -23,10 +23,7 @@
     dibbler.url = "git+https://git.pvv.ntnu.no/Projects/dibbler.git?ref=main";
     dibbler.inputs.nixpkgs.follows = "nixpkgs";
 
-    worblehat.url = "git+https://git.pvv.ntnu.no/Projects/worblehat.git?ref=main";
+    matrix-next.url = "github:dali99/nixos-matrix-modules/v0.8.0";
-    worblehat.inputs.nixpkgs.follows = "nixpkgs";
-
-    matrix-next.url = "github:dali99/nixos-matrix-modules/master";
     matrix-next.inputs.nixpkgs.follows = "nixpkgs";
 
     nix-gitea-themes.url = "git+https://git.pvv.ntnu.no/Drift/nix-gitea-themes.git?ref=main";
@@ -35,36 +32,22 @@
     minecraft-heatmap.url = "git+https://git.pvv.ntnu.no/Projects/minecraft-heatmap.git?ref=main";
     minecraft-heatmap.inputs.nixpkgs.follows = "nixpkgs";
 
-    roowho2.url = "git+https://git.pvv.ntnu.no/Projects/roowho2.git?ref=main&rev=71d2b72c34352a79dbee8ebf23ce64f39aead692";
+    roowho2.url = "git+https://git.pvv.ntnu.no/Projects/roowho2.git?ref=main";
     roowho2.inputs.nixpkgs.follows = "nixpkgs";
 
     greg-ng.url = "git+https://git.pvv.ntnu.no/Grzegorz/greg-ng.git?ref=main";
-    greg-ng.inputs.nixpkgs.follows = "nixpkgs-unstable";
+    greg-ng.inputs.nixpkgs.follows = "nixpkgs";
     gergle.url = "git+https://git.pvv.ntnu.no/Grzegorz/gergle.git?ref=main";
-    gergle.inputs.nixpkgs.follows = "nixpkgs-unstable";
+    gergle.inputs.nixpkgs.follows = "nixpkgs";
     grzegorz-clients.url = "git+https://git.pvv.ntnu.no/Grzegorz/grzegorz-clients.git?ref=master";
     grzegorz-clients.inputs.nixpkgs.follows = "nixpkgs";
 
     minecraft-kartverket.url = "git+https://git.pvv.ntnu.no/Projects/minecraft-kartverket.git?ref=main";
     minecraft-kartverket.inputs.nixpkgs.follows = "nixpkgs";
-
-    qotd.url = "git+https://git.pvv.ntnu.no/Projects/qotd.git?ref=main";
-    qotd.inputs.nixpkgs.follows = "nixpkgs";
-
-    bro.url = "git+https://git.pvv.ntnu.no/Projects/bro.git?ref=main";
-    bro.inputs.nixpkgs.follows = "nixpkgs";
-    passwd2systemd-users.url = "git+https://git.pvv.ntnu.no/Projects/passwd2systemd-users.git?ref=main";
-    passwd2systemd-users.inputs.nixpkgs.follows = "nixpkgs";
   };
 
-  outputs = {
+  outputs = { self, nixpkgs, nixpkgs-unstable, sops-nix, disko, ... }@inputs:
-    self,
+  let
-    nixpkgs,
-    nixpkgs-unstable,
-    sops-nix,
-    disko,
-    ...
-  } @ inputs: let
     inherit (nixpkgs) lib;
     systems = [
       "x86_64-linux"
@@ -76,11 +59,9 @@
     importantMachines = [
       "bekkalokk"
       "bicep"
+      "brzeczyszczykiewicz"
       "georg"
       "ildkule"
-      "kommode"
-      "lupine-1"
-      "skrot"
     ];
   in {
     inputs = lib.mapAttrs (_: src: src.outPath) inputs;
@@ -88,245 +69,180 @@
     pkgs = forAllSystems (system:
       import nixpkgs {
         inherit system;
-        config.allowUnfreePredicate = pkg:
+        config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg)
-          builtins.elem (lib.getName pkg)
           [
             "nvidia-x11"
             "nvidia-settings"
-            "nvidia-kernel-modules"
           ];
       });
 
-    apps = forAllSystems (system: let
-      pkgs = nixpkgs.legacyPackages.${system};
-    in {
-      gitea-workflows = {
-        type = "app";
-        meta.description = "Run all gitea workflows locally";
-        program = toString (pkgs.writeShellScript "pvv-nixos-config-run-gitea-worflows" ''
-          ${lib.getExe pkgs.gitea-actions-runner} exec -i node:current-trixie
-        '');
-      };
-    });
-
     nixosConfigurations = let
-      nixosConfig = nixpkgs: name: configurationPath: extraArgs @ {
+      unstablePkgs = nixpkgs-unstable.legacyPackages.x86_64-linux;
-        localSystem ? "x86_64-linux", # buildPlatform
+
-        crossSystem ? "x86_64-linux", # hostPlatform
+      nixosConfig =
-        specialArgs ? {},
+        nixpkgs:
-        modules ? [],
+        name:
-        overlays ? [],
+        configurationPath:
-        enableDefaults ? true,
+        extraArgs@{
-        ...
+          system ? "x86_64-linux",
-      }: let
+          specialArgs ? { },
-        commonPkgsConfig =
+          modules ? [ ],
-          {
+          overlays ? [ ],
-            config.allowUnfreePredicate = pkg:
+          enableDefaults ? true,
-              builtins.elem (lib.getName pkg)
+          ...
+        }:
+        lib.nixosSystem (lib.recursiveUpdate
+        {
+          inherit system;
+
+          specialArgs = {
+            inherit unstablePkgs inputs;
+            values = import ./values.nix;
+            fp = path: ./${path};
+          } // specialArgs;
+
+          modules = [
+            configurationPath
+          ] ++ (lib.optionals enableDefaults [
+            sops-nix.nixosModules.sops
+            inputs.roowho2.nixosModules.default
+          ]) ++ modules;
+
+          pkgs = import nixpkgs {
+            inherit system;
+            config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg)
               [
                 "nvidia-x11"
                 "nvidia-settings"
-                "nvidia-kernel-modules"
               ];
-            overlays =
+            overlays = (lib.optionals enableDefaults [
-              (lib.optionals enableDefaults [
+              # Global overlays go here
-                # Global overlays go here
+              inputs.roowho2.overlays.default
-                inputs.roowho2.overlays.default
+            ]) ++ overlays;
-              ])
+          };
-              ++ overlays;
+        }
-          }
+        (builtins.removeAttrs extraArgs [
-          // (
+          "system"
-            if localSystem != crossSystem
+          "modules"
-            then {
+          "overlays"
-              inherit localSystem crossSystem;
+          "specialArgs"
-            }
+          "enableDefaults"
-            else {
+        ])
-              system = crossSystem;
+      );
-            }
-          );
-        pkgs = import nixpkgs commonPkgsConfig;
-        unstablePkgs = import nixpkgs-unstable commonPkgsConfig;
-      in
-        lib.nixosSystem (
-          lib.recursiveUpdate
-          {
-            system = crossSystem;
-
-            inherit pkgs;
-
-            specialArgs =
-              {
-                inherit inputs unstablePkgs;
-                values = import ./values.nix;
-                fp = path: ./${path};
-              }
-              // specialArgs;
-
-            modules =
-              [
-                {
-                  networking.hostName = lib.mkDefault name;
-                }
-                configurationPath
-              ]
-              ++ (lib.optionals enableDefaults [
-                sops-nix.nixosModules.sops
-                inputs.roowho2.nixosModules.default
-                self.nixosModules.rsync-pull-targets
-              ])
-              ++ modules;
-          }
-          (builtins.removeAttrs extraArgs [
-            "localSystem"
-            "crossSystem"
-            "modules"
-            "overlays"
-            "specialArgs"
-            "enableDefaults"
-          ])
-        );
 
       stableNixosConfig = name: extraArgs:
-        nixosConfig nixpkgs name ./hosts/${name}/configuration.nix extraArgs;
+          nixosConfig nixpkgs name ./hosts/${name}/configuration.nix extraArgs;
-    in
+    in {
-      {
+      bakke = stableNixosConfig "bakke" {
-        bicep = stableNixosConfig "bicep" {
+        modules = [
-          modules = [
+          disko.nixosModules.disko
-            inputs.matrix-next.nixosModules.default
+        ];
-            inputs.pvv-calendar-bot.nixosModules.default
+      };
-            inputs.minecraft-heatmap.nixosModules.default
+      bicep = stableNixosConfig "bicep" {
-            self.nixosModules.gickup
+        modules = [
-            self.nixosModules.matrix-ooye
+          inputs.matrix-next.nixosModules.default
-          ];
+          inputs.pvv-calendar-bot.nixosModules.default
-          overlays = [
+          inputs.minecraft-heatmap.nixosModules.default
-            inputs.pvv-calendar-bot.overlays.default
+          self.nixosModules.gickup
-            inputs.minecraft-heatmap.overlays.default
+          self.nixosModules.matrix-ooye
-            (final: prev: {
+        ];
-              inherit (self.packages.${prev.stdenv.hostPlatform.system}) out-of-your-element;
+        overlays = [
-            })
+          inputs.pvv-calendar-bot.overlays.default
-            (final: prev: {
+          inputs.minecraft-heatmap.overlays.default
-              # See https://git.pvv.ntnu.no/Drift/issues/issues/369
+          (final: prev: {
-              mjolnir = prev.mjolnir.override {
+            inherit (self.packages.${prev.stdenv.hostPlatform.system}) out-of-your-element;
-                nodejs = prev.nodejs_22;
+          })
-              };
+        ];
-            })
+      };
-          ];
+      bekkalokk = stableNixosConfig "bekkalokk" {
-        };
+        overlays = [
-        bekkalokk = stableNixosConfig "bekkalokk" {
+          (final: prev: {
-          overlays = [
+            heimdal = unstablePkgs.heimdal;
-            (final: prev: {
+            mediawiki-extensions = final.callPackage ./packages/mediawiki-extensions { };
-              mediawiki-extensions = final.callPackage ./packages/mediawiki-extensions {};
+            simplesamlphp = final.callPackage ./packages/simplesamlphp { };
-              simplesamlphp = final.callPackage ./packages/simplesamlphp {};
+            bluemap = final.callPackage ./packages/bluemap.nix { };
-            })
+          })
-            inputs.pvv-nettsiden.overlays.default
+          inputs.pvv-nettsiden.overlays.default
-            inputs.qotd.overlays.default
+        ];
-          ];
+        modules = [
-          modules = [
+          inputs.pvv-nettsiden.nixosModules.default
-            inputs.pvv-nettsiden.nixosModules.default
+          self.nixosModules.bluemap
-            inputs.qotd.nixosModules.default
+        ];
-          ];
+      };
-        };
+      ildkule = stableNixosConfig "ildkule" { };
-        ildkule = stableNixosConfig "ildkule" {
+      #ildkule-unstable = unstableNixosConfig "ildkule" { };
-          modules = [
+      shark = stableNixosConfig "shark" { };
-            inputs.disko.nixosModules.disko
+      wenche = stableNixosConfig "wenche" { };
-          ];
-        };
-        skrot = stableNixosConfig "skrot" {
-          modules = [
-            self.nixosModules.drumknotty
-            inputs.disko.nixosModules.disko
-          ];
-          overlays =
-          [
-            inputs.dibbler.overlays.default
-            inputs.worblehat.overlays.default
-          ];
-        };
-        shark = stableNixosConfig "shark" {};
-        wenche = stableNixosConfig "wenche" {};
-        temmie = stableNixosConfig "temmie" {
-          overlays = [
-            inputs.bro.overlays.default
-            inputs.passwd2systemd-users.overlays.default
-          ];
-          modules = [
-            inputs.bro.nixosModules.default
-          ];
-        };
-        gluttony = stableNixosConfig "gluttony" {
-          overlays = [
-            (final: prev: { bluemap = final.callPackage ./packages/bluemap.nix {}; })
-          ];
-          modules = [ self.nixosModules.bluemap ];
-        };
 
-        kommode = stableNixosConfig "kommode" {
+      kommode = stableNixosConfig "kommode" {
-          overlays = [
+        overlays = [
-            inputs.nix-gitea-themes.overlays.default
+          inputs.nix-gitea-themes.overlays.default
-          ];
+        ];
-          modules = [
+        modules = [
-            inputs.nix-gitea-themes.nixosModules.default
+          inputs.nix-gitea-themes.nixosModules.default
-            inputs.disko.nixosModules.disko
+        ];
-          ];
+      };
-        };
 
-        brzeczyszczykiewicz = stableNixosConfig "brzeczyszczykiewicz" {
+      ustetind = stableNixosConfig "ustetind" {
-          modules = [
+        modules = [
-            inputs.grzegorz-clients.nixosModules.grzegorz-webui
+         "${nixpkgs}/nixos/modules/virtualisation/lxc-container.nix"
-            inputs.gergle.nixosModules.default
+        ];
-            inputs.greg-ng.nixosModules.default
+      };
-          ];
+
-          overlays = [
+      brzeczyszczykiewicz = stableNixosConfig "brzeczyszczykiewicz" {
-            inputs.greg-ng.overlays.default
+        modules = [
-            inputs.gergle.overlays.default
+          inputs.grzegorz-clients.nixosModules.grzegorz-webui
-          ];
+          inputs.gergle.nixosModules.default
-        };
+          inputs.greg-ng.nixosModules.default
-        georg = stableNixosConfig "georg" {
+        ];
-          modules = [
+        overlays = [
-            inputs.grzegorz-clients.nixosModules.grzegorz-webui
+          inputs.greg-ng.overlays.default
-            inputs.gergle.nixosModules.default
+          inputs.gergle.overlays.default
-            inputs.greg-ng.nixosModules.default
+        ];
-          ];
+      };
-          overlays = [
+      georg = stableNixosConfig "georg" {
-            inputs.greg-ng.overlays.default
+        modules = [
-            inputs.gergle.overlays.default
+          inputs.grzegorz-clients.nixosModules.grzegorz-webui
-          ];
+          inputs.gergle.nixosModules.default
-        };
+          inputs.greg-ng.nixosModules.default
-      }
+        ];
-      // (let
+        overlays = [
-        machineNames = map (i: "lupine-${toString i}") (lib.range 1 5);
+          inputs.greg-ng.overlays.default
-        stableLupineNixosConfig = name: extraArgs:
+          inputs.gergle.overlays.default
+        ];
+      };
+      skrott = stableNixosConfig "skrott" {
+        system = "aarch64-linux";
+        modules = [
+          (nixpkgs + "/nixos/modules/installer/sd-card/sd-image-aarch64.nix")
+          inputs.dibbler.nixosModules.default
+        ];
+        overlays = [
+          inputs.dibbler.overlays.default
+        ];
+      };
+    }
+    //
+    (let
+      machineNames = map (i: "lupine-${toString i}") (lib.range 1 5);
+      stableLupineNixosConfig = name: extraArgs:
           nixosConfig nixpkgs name ./hosts/lupine/configuration.nix extraArgs;
-      in
+    in lib.genAttrs machineNames (name: stableLupineNixosConfig name {
-        lib.genAttrs machineNames (name:
+      modules = [{ networking.hostName = name; }];
-          stableLupineNixosConfig name {
+      specialArgs.lupineName = name;
-            modules = [{networking.hostName = name;}];
+    }));
-            specialArgs.lupineName = name;
-          }));
 
     nixosModules = {
       bluemap = ./modules/bluemap.nix;
-      gickup = ./modules/gickup;
-      matrix-ooye = ./modules/matrix-ooye.nix;
-      robots-txt = ./modules/robots-txt.nix;
-      rsync-pull-targets = ./modules/rsync-pull-targets.nix;
       snakeoil-certs = ./modules/snakeoil-certs.nix;
       snappymail = ./modules/snappymail.nix;
-      drumknotty = ./modules/drumknotty;
+      robots-txt = ./modules/robots-txt.nix;
+      gickup = ./modules/gickup;
+      matrix-ooye = ./modules/matrix-ooye.nix;
     };
 
     devShells = forAllSystems (system: {
-      default = let
+      default = nixpkgs-unstable.legacyPackages.${system}.callPackage ./shell.nix { };
-        pkgs = import nixpkgs-unstable {
-          inherit system;
-          overlays = [
-            (final: prev: {
-              inherit (inputs.disko.packages.${system}) disko;
-            })
-          ];
-        };
-      in
-        pkgs.callPackage ./shell.nix {};
       cuda = let
         cuda-pkgs = import nixpkgs-unstable {
           inherit system;
@@ -335,93 +251,85 @@
             cudaSupport = true;
           };
         };
-      in
+      in cuda-pkgs.callPackage ./shells/cuda.nix { };
-        cuda-pkgs.callPackage ./shells/cuda.nix {};
     });
 
     packages = {
       "x86_64-linux" = let
-        system = "x86_64-linux";
+        pkgs = nixpkgs.legacyPackages."x86_64-linux";
-        pkgs = nixpkgs.legacyPackages.${system};
+      in rec {
-      in
+        default = important-machines;
-        rec {
+        important-machines = pkgs.linkFarm "important-machines"
-          default = important-machines;
+          (lib.getAttrs importantMachines self.packages.x86_64-linux);
-          important-machines =
+        all-machines = pkgs.linkFarm "all-machines"
-            pkgs.linkFarm "important-machines"
+          (lib.getAttrs allMachines self.packages.x86_64-linux);
-            (lib.getAttrs importantMachines self.packages.${system});
-          all-machines =
-            pkgs.linkFarm "all-machines"
-            (lib.getAttrs allMachines self.packages.${system});
 
-          simplesamlphp = pkgs.callPackage ./packages/simplesamlphp {};
+        simplesamlphp = pkgs.callPackage ./packages/simplesamlphp { };
 
-          bluemap = pkgs.callPackage ./packages/bluemap.nix {};
+        bluemap = pkgs.callPackage ./packages/bluemap.nix { };
 
-          out-of-your-element = pkgs.callPackage ./packages/ooye/package.nix {};
+        out-of-your-element = pkgs.callPackage ./packages/out-of-your-element.nix { };
-        }
+      }
-        //
+      //
-        # Mediawiki extensions
+      # Mediawiki extensions
-        (lib.pipe null [
+      (lib.pipe null [
-          (_: pkgs.callPackage ./packages/mediawiki-extensions {})
+        (_: pkgs.callPackage ./packages/mediawiki-extensions { })
-          (lib.flip builtins.removeAttrs ["override" "overrideDerivation"])
+        (lib.flip builtins.removeAttrs ["override" "overrideDerivation"])
-          (lib.mapAttrs' (name: lib.nameValuePair "mediawiki-${name}"))
+        (lib.mapAttrs' (name: lib.nameValuePair "mediawiki-${name}"))
-        ])
+      ])
-        //
+      //
-        # Machines
+      # Machines
-        lib.genAttrs allMachines
+      lib.genAttrs allMachines
-        (machine: self.nixosConfigurations.${machine}.config.system.build.toplevel.overrideAttrs (prev: {
+        (machine: self.nixosConfigurations.${machine}.config.system.build.toplevel)
-          passthru =
+      //
-            (prev.passthru or { })
+      # Skrott is exception
-            // self.nixosConfigurations.${machine}.config.system.build
+      {
-            // { inherit (self.nixosConfigurations.${machine}) pkgs config; };
+        skrott = self.nixosConfigurations.skrott.config.system.build.sdImage;
-        }))
+      }
-        //
+      //
-        # Nix-topology
+      # Nix-topology
-        (let
+      (let
-          topology' = import inputs.nix-topology {
+        topology' = import inputs.nix-topology {
-            pkgs = import nixpkgs {
+          pkgs = import nixpkgs {
-              inherit system;
+            system = "x86_64-linux";
-              overlays = [
+            overlays = [
-                inputs.nix-topology.overlays.default
+              inputs.nix-topology.overlays.default
-                (final: prev: {
+              (final: prev: {
-                  inherit (nixpkgs-unstable.legacyPackages.${system}) super-tiny-icons;
+                inherit (nixpkgs-unstable.legacyPackages.x86_64-linux) super-tiny-icons;
-                })
+              })
-              ];
-            };
-
-            specialArgs = {
-              values = import ./values.nix;
-            };
-
-            modules = [
-              ./topology
-              {
-                nixosConfigurations = lib.mapAttrs (_name: nixosCfg:
-                  nixosCfg.extendModules {
-                    modules = [
-                      inputs.nix-topology.nixosModules.default
-                      ./topology/service-extractors/greg-ng.nix
-                      ./topology/service-extractors/postgresql.nix
-                      ./topology/service-extractors/mysql.nix
-                      ./topology/service-extractors/gitea-runners.nix
-                    ];
-                  })
-                self.nixosConfigurations;
-              }
             ];
           };
-        in {
+
-          topology = topology'.config.output;
+          specialArgs = {
-          topology-png =
+            values = import ./values.nix;
-            pkgs.runCommand "pvv-config-topology-png" {
+          };
-              nativeBuildInputs = [pkgs.writableTmpDirAsHomeHook];
+
-            } ''
+          modules = [
-              mkdir -p "$out"
+            ./topology
-              for file in '${topology'.config.output}'/*.svg; do
+            {
-                ${lib.getExe pkgs.imagemagick} -density 300 -background none "$file" "$out"/"$(basename "''${file%.svg}.png")"
+              nixosConfigurations = lib.mapAttrs (_name: nixosCfg: nixosCfg.extendModules {
-              done
+                modules = [
-            '';
+                  inputs.nix-topology.nixosModules.default
-        });
+                  ./topology/service-extractors/greg-ng.nix
+                  ./topology/service-extractors/postgresql.nix
+                  ./topology/service-extractors/mysql.nix
+                  ./topology/service-extractors/gitea-runners.nix
+                ];
+              }) self.nixosConfigurations;
+            }
+          ];
+        };
+      in {
+        topology = topology'.config.output;
+        topology-png = pkgs.runCommand "pvv-config-topology-png" {
+          nativeBuildInputs = [ pkgs.writableTmpDirAsHomeHook ];
+        } ''
+          mkdir -p "$out"
+          for file in '${topology'.config.output}'/*.svg; do
+            ${lib.getExe pkgs.imagemagick} -density 300 -background none "$file" "$out"/"$(basename "''${file%.svg}.png")"
+          done
+        '';
+      });
     };
   };
 }

hosts/bakke/configuration.nix

@@ -0,0 +1,25 @@
+{ config, pkgs, values, ... }:
+{
+  imports = [
+      ./hardware-configuration.nix
+      ../../base
+      ./filesystems.nix
+    ];
+
+  sops.defaultSopsFile = ../../secrets/bakke/bakke.yaml;
+  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
+  sops.age.generateKey = true;
+
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  networking.hostName = "bakke";
+  networking.hostId = "99609ffc";
+  systemd.network.networks."30-enp2s0" = values.defaultNetworkConfig // {
+    matchConfig.Name = "enp2s0";
+    address = with values.hosts.bakke; [ (ipv4 + "/25") (ipv6 + "/64") ];
+  };
+
+  system.stateVersion = "24.05";
+}

hosts/bakke/disks.nix

@@ -0,0 +1,83 @@
+{
+  # https://github.com/nix-community/disko/blob/master/example/boot-raid1.nix
+  # Note: Disko was used to create the initial md raid, but is no longer in active use on this host.
+  disko.devices = {
+    disk = {
+      one = {
+        type = "disk";
+        device = "/dev/disk/by-id/ata-WDC_WD40EFRX-68WT0N0_WD-WCC4E2EER6N6";
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              size = "500M";
+              type = "EF00";
+              content = {
+                type = "mdraid";
+                name = "boot";
+              };
+            };
+            mdadm = {
+              size = "100%";
+              content = {
+                type = "mdraid";
+                name = "raid1";
+              };
+            };
+          };
+        };
+      };
+      two = {
+        type = "disk";
+        device = "/dev/disk/by-id/ata-WDC_WD40EFRX-68WT0N0_WD-WCC4E7LPLU71";
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              size = "500M";
+              type = "EF00";
+              content = {
+                type = "mdraid";
+                name = "boot";
+              };
+            };
+            mdadm = {
+              size = "100%";
+              content = {
+                type = "mdraid";
+                name = "raid1";
+              };
+            };
+          };
+        };
+      };
+    };
+    mdadm = {
+      boot = {
+        type = "mdadm";
+        level = 1;
+        metadata = "1.0";
+        content = {
+          type = "filesystem";
+          format = "vfat";
+          mountpoint = "/boot";
+        };
+      };
+      raid1 = {
+        type = "mdadm";
+        level = 1;
+        content = {
+          type = "gpt";
+          partitions.primary = {
+            size = "100%";
+            content = {
+              type = "filesystem";
+              format = "ext4";
+              mountpoint = "/";
+            };
+          };
+        };
+      };
+    };
+  };
+}

hosts/bakke/filesystems.nix

@@ -0,0 +1,26 @@
+{ config, pkgs, lib, ... }:
+{
+  # Boot drives:
+  boot.swraid.enable = true;
+
+  # ZFS Data pool:
+  environment.systemPackages = with pkgs; [ zfs ];
+  boot = {
+    zfs = {
+      extraPools = [ "tank" ];
+      requestEncryptionCredentials = false;
+    };
+    supportedFilesystems = [ "zfs" ];
+    kernelPackages = config.boot.zfs.package.latestCompatibleLinuxPackages;
+  };
+  services.zfs.autoScrub = {
+    enable = true;
+    interval = "Wed *-*-8..14 00:00:00";
+  };
+
+  # NFS Exports:
+  #TODO
+
+  # NFS Import mounts:
+  #TODO
+}

hosts/bakke/hardware-configuration.nix

@@ -0,0 +1,52 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "ehci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/0f63c3d2-fc12-4ed5-a5a5-141bfd67a571";
+      fsType = "btrfs";
+      options = [ "subvol=root" ];
+    };
+
+  fileSystems."/home" =
+    { device = "/dev/disk/by-uuid/0f63c3d2-fc12-4ed5-a5a5-141bfd67a571";
+      fsType = "btrfs";
+      options = [ "subvol=home" ];
+    };
+
+  fileSystems."/nix" =
+    { device = "/dev/disk/by-uuid/0f63c3d2-fc12-4ed5-a5a5-141bfd67a571";
+      fsType = "btrfs";
+      options = [ "subvol=nix" "noatime" ];
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/sdc2";
+      fsType = "vfat";
+      options = [ "fmask=0022" "dmask=0022" ];
+    };
+
+  swapDevices = [ ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault false;
+  # networking.interfaces.eno1.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp2s0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/bekkalokk/configuration.nix

@@ -7,7 +7,6 @@
 
     ./services/alps.nix
     ./services/bluemap.nix
-    ./services/radicale.nix
     ./services/idp-simplesamlphp
     ./services/kerberos.nix
     ./services/mediawiki
@@ -17,15 +16,26 @@
     ./services/webmail
     ./services/website
     ./services/well-known
-    ./services/qotd
   ];
 
+  sops.defaultSopsFile = fp /secrets/bekkalokk/bekkalokk.yaml;
+  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
+  sops.age.generateKey = true;
+
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  networking.hostName = "bekkalokk";
+
   systemd.network.networks."30-enp2s0" = values.defaultNetworkConfig // {
     matchConfig.Name = "enp2s0";
     address = with values.hosts.bekkalokk; [ (ipv4 + "/25") (ipv6 + "/64") ];
   };
 
-  # Don't change (even during upgrades) unless you know what you are doing.
+  services.btrfs.autoScrub.enable = true;
+
+  # Do not change, even during upgrades.
   # See https://search.nixos.org/options?show=system.stateVersion
-  system.stateVersion = "25.11";
+  system.stateVersion = "22.11";
 }

hosts/bekkalokk/hardware-configuration.nix

@@ -1,4 +1,4 @@
-# Do not modify this file!  It was generated by 'nixos-generate-config'
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
 { config, lib, pkgs, modulesPath, ... }:
@@ -16,7 +16,6 @@
   fileSystems."/" =
     { device = "/dev/sda1";
       fsType = "btrfs";
-      options = [ "relatime" ];
     };
 
   fileSystems."/boot" =

hosts/bekkalokk/services/bluemap.nix

@@ -1,10 +1,111 @@
-{ values, ... }:
+{ config, lib, pkgs, inputs, ... }:
 let
-  webExport = "/var/lib/bluemap/web";
+  vanillaSurvival = "/var/lib/bluemap/vanilla_survival_world";
+  format = pkgs.formats.hocon { };
 in {
-  # NOTE: our version of the module gets added in flake.nix
+  # NOTE: our versino of the module gets added in flake.nix
   disabledModules = [ "services/web-apps/bluemap.nix" ];
 
+  sops.secrets."bluemap/ssh-key" = { };
+  sops.secrets."bluemap/ssh-known-hosts" = { };
+
+  services.bluemap = {
+    enable = true;
+
+    eula = true;
+    onCalendar = "*-*-* 05:45:00"; # a little over an hour after auto-upgrade
+
+    host = "minecraft.pvv.ntnu.no";
+
+    maps = let
+      inherit (inputs.minecraft-kartverket.packages.${pkgs.stdenv.hostPlatform.system}) bluemap-export;
+    in {
+      "verden" = {
+        settings = {
+          world = vanillaSurvival;
+          dimension = "minecraft:overworld";
+          name = "Verden";
+          sorting = 0;
+          start-pos = {
+            x = 0;
+            z = 0;
+          };
+          ambient-light = 0.1;
+          cave-detection-ocean-floor = -5;
+          marker-sets = {
+            _includes = [ (format.lib.mkInclude "${bluemap-export}/overworld.hocon") ];
+          };
+        };
+      };
+      "underverden" = {
+        settings = {
+          world = vanillaSurvival;
+          dimension = "minecraft:the_nether";
+          name = "Underverden";
+          sorting = 100;
+          start-pos = {
+            x = 0;
+            z = 0;
+          };
+          sky-color = "#290000";
+          void-color = "#150000";
+          sky-light = 1;
+          ambient-light = 0.6;
+          remove-caves-below-y = -10000;
+          cave-detection-ocean-floor = -5;
+          cave-detection-uses-block-light = true;
+          render-mask = [{
+            max-y = 90;
+          }];
+          marker-sets = {
+            _includes = [ (format.lib.mkInclude "${bluemap-export}/nether.hocon") ];
+          };
+        };
+      };
+      "enden" = {
+        settings = {
+          world = vanillaSurvival;
+          dimension = "minecraft:the_end";
+          name = "Enden";
+          sorting = 200;
+          start-pos = {
+            x = 0;
+            z = 0;
+          };
+          sky-color = "#080010";
+          void-color = "#080010";
+          sky-light = 1;
+          ambient-light = 0.6;
+          remove-caves-below-y = -10000;
+          cave-detection-ocean-floor = -5;
+          marker-sets = {
+            _includes = [ (format.lib.mkInclude "${bluemap-export}/the-end.hocon") ];
+          };
+        };
+      };
+    };
+  };
+
+  systemd.services."render-bluemap-maps" = {
+    serviceConfig = {
+      StateDirectory = [ "bluemap/world" ];
+      ExecStartPre = let
+        rsyncArgs = lib.cli.toCommandLineShellGNU { } {
+          archive = true;
+          compress = true;
+          verbose = true;
+          no-owner = true;
+          no-group = true;
+          rsh = "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=%d/ssh-known-hosts -i %d/sshkey";
+        };
+      in "${lib.getExe pkgs.rsync} ${rsyncArgs} root@innovation.pvv.ntnu.no:/ ${vanillaSurvival}";
+      LoadCredential = [
+        "sshkey:${config.sops.secrets."bluemap/ssh-key".path}"
+        "ssh-known-hosts:${config.sops.secrets."bluemap/ssh-known-hosts".path}"
+      ];
+    };
+  };
+
   services.nginx.virtualHosts."minecraft.pvv.ntnu.no" = {
     enableACME = true;
     forceSSL = true;
@@ -20,30 +121,6 @@ in {
       quic_retry on;
       add_header Alt-Svc 'h3=":$server_port"; ma=86400';
     '';
-    root = webExport;
-    locations = {
-      "~* ^/maps/[^/]*/tiles/".extraConfig = ''
-        error_page 404 = @empty;
-      '';
-      "@empty".return = "204";
-    };
-  };
-
-  services.rsync-pull-targets = {
-    enable = true;
-    locations.${webExport} = {
-      user = "root";
-      rrsyncArgs.wo = true;
-      authorizedKeysAttrs = [
-        "restrict"
-        "from=\"gluttony.pvv.ntnu.no,${values.hosts.gluttony.ipv6},${values.hosts.gluttony.ipv4}\""
-        "no-agent-forwarding"
-        "no-port-forwarding"
-        "no-pty"
-        "no-X11-forwarding"
-      ];
-      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH5jrqMovXlWaFWZAV/aKyQReHvUQp5kb+7Ja4gnevSr root@gluttony bluemap";
-    };
   };
 
   networking.firewall.allowedUDPPorts = [ 443 ];

hosts/bekkalokk/services/mediawiki/default.nix

@@ -1,4 +1,4 @@
-{ pkgs, lib, fp, config, values, ... }: let
+{ pkgs, lib, fp, config, values, pkgs-unstable, ... }: let
   cfg = config.services.mediawiki;
 
   # "mediawiki"
@@ -34,7 +34,6 @@ in {
   services.idp.sp-remote-metadata = [ "https://wiki.pvv.ntnu.no/simplesaml/" ];
 
   sops.secrets = lib.pipe [
-    "mediawiki/secret-key"
     "mediawiki/password"
     "mediawiki/postgres_password"
     "mediawiki/simplesamlphp/postgres_password"
@@ -49,23 +48,6 @@ in {
     lib.listToAttrs
   ];
 
-  services.rsync-pull-targets = {
-    enable = true;
-    locations.${cfg.uploadsDir} = {
-      user = "root";
-      rrsyncArgs.ro = true;
-      authorizedKeysAttrs = [
-        "restrict"
-        "from=\"principal.pvv.ntnu.no,${values.hosts.principal.ipv6},${values.hosts.principal.ipv4}\""
-        "no-agent-forwarding"
-        "no-port-forwarding"
-        "no-pty"
-        "no-X11-forwarding"
-      ];
-      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICHFHa3Iq1oKPhbKCAIHgOoWOTkLmIc7yqxeTbut7ig/ mediawiki rsync backup";
-    };
-  };
-
   services.mediawiki = {
     enable = true;
     name = "Programvareverkstedet";
@@ -107,7 +89,6 @@ in {
         CodeEditor
         CodeMirror
         DeleteBatch
-        PdfHandler
         PluggableAuth
         Popups
         Scribunto
@@ -163,36 +144,13 @@ in {
       $wgDBserver = "${toString cfg.database.host}";
       $wgAllowCopyUploads = true;
 
-      # Files
-      $wgFileExtensions = [
-        'bmp',
-        'gif',
-        'jpeg',
-        'jpg',
-        'mp3',
-        'odg',
-        'odp',
-        'ods',
-        'odt',
-        'pdf',
-        'png',
-        'tiff',
-        'webm',
-        'webp',
-      ];
-
       # Misc program paths
-      $wgFFmpegLocation = '${lib.getExe pkgs.ffmpeg}';
+      $wgFFmpegLocation = '${pkgs.ffmpeg}/bin/ffmpeg';
-      $wgExiftool = '${lib.getExe pkgs.exiftool}';
+      $wgExiftool = '${pkgs.exiftool}/bin/exiftool';
-      $wgExiv2Command = '${lib.getExe pkgs.exiv2}';
+      $wgExiv2Command = '${pkgs.exiv2}/bin/exiv2';
       # See https://gist.github.com/sergejmueller/088dce028b6dd120a16e
-      $wgJpegTran = '${lib.getExe' pkgs.mozjpeg "jpegtran"}';
+      $wgJpegTran = '${pkgs.mozjpeg}/bin/jpegtran';
-      $wgGitBin = '${lib.getExe pkgs.git}';
+      $wgGitBin = '${pkgs.git}/bin/git';
-      $wgDiff3 = '${lib.getExe' pkgs.diffutils "diff3"}';
-      $wgDiff = '${lib.getExe' pkgs.diffutils "diff"}';
-
-      $wgUseImageMagick = true;
-      $wgImageMagickConvertCommand = '${lib.getExe pkgs.imagemagick}';
 
       # Debugging
       $wgShowExceptionDetails = false;
@@ -216,29 +174,20 @@ in {
 
       # EXT:WikiEditor
       $wgWikiEditorRealtimePreview = true;
-
-      # EXT:PdfHandler
-      $wgPdfProcessor = '${lib.getExe pkgs.ghostscript_headless}';
-      $wgPdfPostProcessor = $wgImageMagickConvertCommand;
-      $wgPdfInfo = '${lib.getExe' pkgs.poppler-utils "pdfinfo"}';
-      $wgPdftoText = '${lib.getExe' pkgs.poppler-utils "pdftotext"}';
-
-      # Override key from hardcoded config in nixpkgs
-      $wgSecretKey = file_get_contents("${config.sops.secrets."mediawiki/secret-key".path}");
     '';
   };
 
   # Cache directory for simplesamlphp
   # systemd.services.phpfpm-mediawiki.serviceConfig.CacheDirectory = "mediawiki/simplesamlphp";
-  systemd.tmpfiles.settings."10-mediawiki"."/var/cache/mediawiki/simplesamlphp".d = lib.mkIf cfg.enable {
+  systemd.tmpfiles.settings."10-mediawiki"."/var/cache/mediawiki/simplesamlphp".d = {
     user = "mediawiki";
     group = "mediawiki";
     mode = "0770";
   };
 
-  users.groups.mediawiki.members = lib.mkIf cfg.enable [ "nginx" ];
+  users.groups.mediawiki.members = [ "nginx" ];
 
-  services.nginx.virtualHosts."wiki.pvv.ntnu.no" = lib.mkIf cfg.enable {
+  services.nginx.virtualHosts."wiki.pvv.ntnu.no" = {
     kTLS = true;
     forceSSL = true;
     enableACME = true;
@@ -284,18 +233,4 @@ in {
     };
 
   };
-
-  systemd.services.mediawiki-init = lib.mkIf cfg.enable {
-    after = [ "sops-install-secrets.service" ];
-    serviceConfig = {
-      UMask = lib.mkForce "0007";
-    };
-  };
-
-  systemd.services.phpfpm-mediawiki = lib.mkIf cfg.enable {
-    after = [ "sops-install-secrets.service" ];
-    serviceConfig = {
-      UMask = lib.mkForce "0007";
-    };
-  };
 }

hosts/bekkalokk/services/qotd/default.nix

@@ -1,6 +0,0 @@
-{
-  services.qotd = {
-    enable = true;
-    quotes = builtins.fromJSON (builtins.readFile ./quotes.json);
-  };
-}

hosts/bekkalokk/services/qotd/quotes.json

@@ -1 +0,0 @@
-["quote 1", "quote 2"]

hosts/bekkalokk/services/radicale.nix

@@ -1,40 +0,0 @@
-{ config, lib, ... }:
-let
-  domain = "dav.pvv.ntnu.no";
-  radicalePort = 5232;
-in {
-  services.radicale = {
-    enable = true;
-
-    settings = {
-      server = {
-        hosts = [ "127.0.0.1:${toString radicalePort}" ];
-      };
-
-      auth = {
-        type = "imap";
-        imap_host = "imap.pvv.ntnu.no";
-        imap_security = "tls";
-      };
-
-      storage = {
-        filesystem_folder = "/var/lib/radicale/collections";
-      };
-    };
-  };
-
-  services.nginx.virtualHosts."${domain}" = {
-    forceSSL = true;
-    enableACME = true;
-    kTLS = true;
-
-    extraConfig = ''
-      client_max_body_size 128M;
-    '';
-
-    locations."/" = {
-      proxyPass = "http://127.0.0.1:${toString radicalePort}";
-      proxyWebsockets = true;
-    };
-  };
-}

hosts/bekkalokk/services/vaultwarden.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, lib, values, ... }:
+{ config, pkgs, lib, ... }:
 let
   cfg = config.services.vaultwarden;
   domain = "pw.pvv.ntnu.no";
@@ -6,58 +6,40 @@ let
   port = 3011;
   wsPort = 3012;
 in {
-  sops.secrets."vaultwarden/rsa_key.pem" = {
+  sops.secrets."vaultwarden/environ" = {
     owner = "vaultwarden";
     group = "vaultwarden";
-    mode = "440";
-    restartUnits = [ "vaultwarden.service" ];
-  };
-  sops.secrets."vaultwarden/rsa_key.pub.pem" = {
-    owner = "vaultwarden";
-    group = "vaultwarden";
-    mode = "440";
-    restartUnits = [ "vaultwarden.service" ];
-  };
-  sops.secrets."vaultwarden/env/DATABASE_PASSWORD" = { };
-  sops.secrets."vaultwarden/env/SMTP_PASSWORD" = { };
-  sops.templates."vaultwarden/environment_file" = {
-    owner = "vaultwarden";
-    group = "vaultwarden";
-    mode = "440";
-    restartUnits = [ "vaultwarden.service" ];
-    content = ''
-        DATABASE_URL=postgresql://vaultwarden:${config.sops.placeholder."vaultwarden/env/DATABASE_PASSWORD"}@postgres.pvv.ntnu.no/vaultwarden
-        SMTP_PASSWORD=${config.sops.placeholder."vaultwarden/env/SMTP_PASSWORD"}
-    '';
   };
 
   services.vaultwarden = {
     enable = true;
     dbBackend = "postgresql";
-    environmentFile = config.sops.templates."vaultwarden/environment_file".path;
+    environmentFile = config.sops.secrets."vaultwarden/environ".path;
     config = {
-      DOMAIN = "https://${domain}";
+      domain = "https://${domain}";
 
-      ROCKET_ADDRESS = address;
+      rocketAddress = address;
-      ROCKET_PORT = port;
+      rocketPort = port;
 
-      WEBSOCKET_ENABLED = true;
+      websocketEnabled = true;
-      WEBSOCKET_ADDRESS = address;
+      websocketAddress = address;
-      WEBSOCKET_PORT = wsPort;
+      websocketPort = wsPort;
 
-      SIGNUPS_ALLOWED = true;
+      signupsAllowed = true;
-      SIGNUPS_VERIFY = true;
+      signupsVerify = true;
-      SIGNUPS_DOMAINS_WHITELIST = "pvv.ntnu.no";
+      signupsDomainsWhitelist = "pvv.ntnu.no";
 
-      SMTP_FROM = "vaultwarden@pvv.ntnu.no";
+      smtpFrom = "vaultwarden@pvv.ntnu.no";
-      SMTP_FROM_NAME = "VaultWarden PVV";
+      smtpFromName = "VaultWarden PVV";
 
-      SMTP_HOST = "smtp.pvv.ntnu.no";
+      smtpHost = "smtp.pvv.ntnu.no";
-      SMTP_USERNAME = "vaultwarden";
+      smtpUsername = "vaultwarden";
-      SMTP_SECURITY = "force_tls";
+      smtpSecurity = "force_tls";
-      SMTP_AUTH_MECHANISM = "Login";
+      smtpAuthMechanism = "Login";
 
-      RSA_KEY_FILENAME = lib.removeSuffix ".pem" config.sops.secrets."vaultwarden/rsa_key.pem".path;
+      # Configured in environ:
+      # databaseUrl = "postgresql://vaultwarden@/vaultwarden";
+      # smtpPassword = hemli
     };
   };
 
@@ -84,20 +66,37 @@ in {
     };
   };
 
-  services.rsync-pull-targets = {
+  systemd.services.vaultwarden = lib.mkIf cfg.enable {
-    enable = true;
+    serviceConfig = {
-    locations."/var/lib/vaultwarden" = {
+      AmbientCapabilities = [ "" ];
-      user = "root";
+      CapabilityBoundingSet = [ "" ];
-      rrsyncArgs.ro = true;
+      DeviceAllow = [ "" ];
-      authorizedKeysAttrs = [
+      LockPersonality = true;
-        "restrict"
+      NoNewPrivileges = true;
-        "from=\"principal.pvv.ntnu.no,${values.hosts.principal.ipv6},${values.hosts.principal.ipv4}\""
+      # MemoryDenyWriteExecute = true;
-        "no-agent-forwarding"
+      PrivateMounts = true;
-        "no-port-forwarding"
+      PrivateUsers = true;
-        "no-pty"
+      ProcSubset = "pid";
-        "no-X11-forwarding"
+      ProtectClock = true;
+      ProtectControlGroups = true;
+      ProtectHostname = true;
+      ProtectKernelLogs = true;
+      ProtectKernelModules = true;
+      ProtectKernelTunables = true;
+      RestrictAddressFamilies = [
+        "AF_INET"
+        "AF_INET6"
+        "AF_UNIX"
+      ];
+      RemoveIPC = true;
+      RestrictNamespaces = true;
+      RestrictRealtime = true;
+      RestrictSUIDSGID = true;
+      SystemCallArchitectures = "native";
+      SystemCallFilter = [
+        "@system-service"
+        "~@privileged"
       ];
-      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB2cDaW52gBtLVaNqoGijvN2ZAVkAWlII5AXUzT3Dswj vaultwarden rsync backup";
     };
   };
 }

hosts/bekkalokk/services/webmail/default.nix

@@ -10,9 +10,8 @@
     enableACME = true;
     kTLS = true;
     locations = {
-      # "= /".return = "302 https://webmail.pvv.ntnu.no/roundcube";
+      "= /".return = "302 https://webmail.pvv.ntnu.no/roundcube";
 
-      "/roundcube".return = "302 https://webmail.pvv.ntnu.no/";
       "/afterlogic_lite".return = "302 https://webmail.pvv.ntnu.no/roundcube";
       "/squirrelmail".return = "302 https://webmail.pvv.ntnu.no/roundcube";
       "/rainloop".return = "302 https://snappymail.pvv.ntnu.no/";

hosts/bekkalokk/services/webmail/roundcube.nix

@@ -9,12 +9,6 @@ in
   sops.secrets."roundcube/postgres_password" = {
     owner = "nginx";
     group = "nginx";
-    restartUnits = [ "phpfpm-roundcube.service" ];
-  };
-  sops.secrets."roundcube/des_key" = {
-    owner = "nginx";
-    group = "nginx";
-    restartUnits = [ "phpfpm-roundcube.service" ];
   };
 
   services.roundcube = {
@@ -29,7 +23,7 @@ in
 
     dicts = with pkgs.aspellDicts; [ en en-computers nb nn fr de it ];
     maxAttachmentSize = 20;
-    hostName = domain;
+    hostName = "roundcubeplaceholder.example.com";
 
     database = {
       host = "postgres.pvv.ntnu.no";
@@ -45,13 +39,47 @@ in
       $config['mail_domain'] = "pvv.ntnu.no";
       $config['smtp_user'] = "%u";
       $config['support_url'] = "";
-      $config['des_key'] = "${config.sops.secrets."roundcube/des_key".path}";
     '';
   };
 
-  # TODO: move this back to `webmail.pvv.ntnu.no/roundcube` subpath
+  services.nginx.virtualHosts."roundcubeplaceholder.example.com" = lib.mkForce { };
 
   services.nginx.virtualHosts.${domain} = {
     kTLS = true;
+    locations."/roundcube" = {
+      tryFiles = "$uri $uri/ =404";
+      index = "index.php";
+      root = pkgs.runCommandLocal "roundcube-dir" { } ''
+        mkdir -p $out
+        ln -s ${cfg.package} $out/roundcube
+      '';
+      extraConfig = ''
+        location ~ ^/roundcube/(${builtins.concatStringsSep "|" [
+        # https://wiki.archlinux.org/title/Roundcube
+        "README"
+        "INSTALL"
+        "LICENSE"
+        "CHANGELOG"
+        "UPGRADING"
+        "bin"
+        "SQL"
+        ".+\\.md"
+        "\\."
+        "config"
+        "temp"
+        "logs"
+        ]})/? {
+          deny all;
+        }
+
+        location ~ ^/roundcube/(.+\.php)(/?.*)$ {
+          fastcgi_split_path_info ^/roundcube(/.+\.php)(/.+)$;
+          include ${config.services.nginx.package}/conf/fastcgi_params;
+          include ${config.services.nginx.package}/conf/fastcgi.conf;
+          fastcgi_index index.php;
+          fastcgi_pass unix:${config.services.phpfpm.pools.roundcube.socket};
+        }
+      '';
+    };
   };
 }

hosts/bekkalokk/services/webmail/snappymail.nix

@@ -1,4 +1,4 @@
-{ config, lib, fp, pkgs, values, ... }:
+{ config, lib, fp, pkgs, ... }:
 let
   cfg = config.services.snappymail;
 in {
@@ -14,21 +14,5 @@ in {
     enableACME = true;
     kTLS = true;
   };
-
-  services.rsync-pull-targets = {
-    enable = true;
-    locations.${cfg.dataDir} = {
-      user = "root";
-      rrsyncArgs.ro = true;
-      authorizedKeysAttrs = [
-        "restrict"
-        "from=\"principal.pvv.ntnu.no,${values.hosts.principal.ipv6},${values.hosts.principal.ipv4}\""
-        "no-agent-forwarding"
-        "no-port-forwarding"
-        "no-pty"
-        "no-X11-forwarding"
-      ];
-      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJENMnuNsHEeA91oX+cj7Qpex2defSXP/lxznxCAqV03 snappymail rsync backup";
-    };
-  };
 }
+

hosts/bekkalokk/services/website/default.nix

@@ -80,46 +80,14 @@ in {
   };
 
   services.phpfpm.pools."pvv-nettsiden".settings = {
-    "php_admin_value[error_log]" = "syslog";
+    # "php_admin_value[error_log]" = "stderr";
     "php_admin_flag[log_errors]" = true;
     "catch_workers_output" = true;
-
-    "php_admin_value[max_execution_time]" = "30";
-    "request_terminate_timeout" = "60s";
-
-    "php_admin_value[sendmail_path]" = let
-      fakeSendmail = pkgs.writeShellApplication {
-        name = "fake-sendmail";
-        text = ''
-          TIMESTAMP="$(date +%Y-%m-%d-%H-%M-%S-%N)"
-          (
-            echo "SENDMAIL ARGS:"
-            echo "$@"
-            echo "SENDMAIL STDIN:"
-            cat -
-          ) > "/var/lib/pvv-nettsiden/emails/$TIMESTAMP.mail"
-        '';
-      };
-    in lib.getExe fakeSendmail;
-
-    "php_admin_value[disable_functions]" = lib.concatStringsSep "," [
-      "curl_exec"
-      "curl_multi_exec"
-      "exec"
-      "parse_ini_file"
-      "passthru"
-      "popen"
-      "proc_open"
-      "shell_exec"
-      "show_source"
-      "system"
-    ];
   };
 
   services.nginx.virtualHosts."pvv.ntnu.no" = {
     globalRedirect = cfg.domainName;
     redirectCode = 307;
-    kTLS = true;
     forceSSL = true;
     useACMEHost = "www.pvv.ntnu.no";
   };
@@ -127,7 +95,6 @@ in {
   services.nginx.virtualHosts."www.pvv.org" = {
     globalRedirect = cfg.domainName;
     redirectCode = 307;
-    kTLS = true;
     forceSSL = true;
     useACMEHost = "www.pvv.ntnu.no";
   };
@@ -135,13 +102,11 @@ in {
   services.nginx.virtualHosts."pvv.org" = {
     globalRedirect = cfg.domainName;
     redirectCode = 307;
-    kTLS = true;
     forceSSL = true;
     useACMEHost = "www.pvv.ntnu.no";
   };
 
   services.nginx.virtualHosts.${cfg.domainName} = {
-    kTLS = true;
     locations = {
       # Proxy home directories
       "^~ /~" = {

hosts/bekkalokk/services/website/fetch-gallery.nix

@@ -1,30 +1,15 @@
-{ pkgs, lib, config, values, ... }:
+{ pkgs, lib, config, ... }:
 let
   galleryDir = config.services.pvv-nettsiden.settings.GALLERY.DIR;
   transferDir = "${config.services.pvv-nettsiden.settings.GALLERY.DIR}-transfer";
 in {
   users.users.${config.services.pvv-nettsiden.user} = {
-    # NOTE: the user unfortunately needs a registered shell for rrsync to function...
-    #       is there anything we can do to remove this?
     useDefaultShell = true;
-  };
 
-  # This is pushed from microbel:/var/www/www-gallery/build-gallery.sh
+    # This is pushed from microbel:/var/www/www-gallery/build-gallery.sh
-  services.rsync-pull-targets = {
+    openssh.authorizedKeys.keys = [
-    enable = true;
+    ''command="${pkgs.rrsync}/bin/rrsync -wo ${transferDir}",restrict,no-agent-forwarding,no-port-forwarding,no-pty,no-X11-forwarding ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIjHhC2dikhWs/gG+m7qP1eSohWzTehn4ToNzDSOImyR gallery-publish''
-    locations.${transferDir} = {
+    ];
-      user = config.services.pvv-nettsiden.user;
-      rrsyncArgs.wo = true;
-      authorizedKeysAttrs = [
-        "restrict"
-        "from=\"microbel.pvv.ntnu.no,${values.hosts.microbel.ipv6},${values.hosts.microbel.ipv4}\""
-        "no-agent-forwarding"
-        "no-port-forwarding"
-        "no-pty"
-        "no-X11-forwarding"
-      ];
-      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIjHhC2dikhWs/gG+m7qP1eSohWzTehn4ToNzDSOImyR gallery-publish";
-    };
   };
 
   systemd.paths.pvv-nettsiden-gallery-update = {
@@ -37,56 +22,47 @@ in {
   };
 
   systemd.services.pvv-nettsiden-gallery-update = {
+    path = with pkgs; [ imagemagick gnutar gzip ];
+
+    script = ''
+      tar ${lib.cli.toGNUCommandLineShell {} {
+        extract = true;
+        file = "${transferDir}/gallery.tar.gz";
+        directory = ".";
+      }}
+
+      # Delete files and directories that exists in the gallery that don't exist in the tarball
+      filesToRemove=$(uniq -u <(sort <(find . -not -path "./.thumbnails*") <(tar -tf ${transferDir}/gallery.tar.gz | sed 's|/$||')))
+      while IFS= read fname; do
+        rm -f "$fname" ||:
+        rm -f ".thumbnails/$fname.png" ||:
+      done <<< "$filesToRemove"
+
+      find . -type d -empty -delete
+
+      mkdir -p .thumbnails
+      images=$(find . -type f -not -path "./.thumbnails*")
+
+      while IFS= read fname; do
+        # Skip this file if an up-to-date thumbnail already exists
+        if [ -f ".thumbnails/$fname.png" ] && \
+          [ "$(date -R -r "$fname")" == "$(date -R -r ".thumbnails/$fname.png")" ]
+        then
+          continue
+        fi
+
+        echo "Creating thumbnail for $fname"
+        mkdir -p $(dirname ".thumbnails/$fname")
+        magick -define jpeg:size=200x200 "$fname" -thumbnail 300 -auto-orient ".thumbnails/$fname.png" ||:
+        touch -m -d "$(date -R -r "$fname")" ".thumbnails/$fname.png"
+      done <<< "$images"
+    '';
+
     serviceConfig = {
       WorkingDirectory = galleryDir;
       User = config.services.pvv-nettsiden.user;
       Group = config.services.pvv-nettsiden.group;
 
-      ExecStart = lib.getExe (pkgs.writeShellApplication {
-        name = "pvv-nettsiden-gallery-update-exec-start.sh";
-        runtimeInputs = with pkgs; [
-          coreutils
-          findutils
-          gnused
-          gnutar
-          gzip
-          imagemagick
-        ];
-        text = ''
-          tar ${lib.cli.toCommandLineShellGNU { } {
-            extract = true;
-            file = "${transferDir}/gallery.tar.gz";
-            directory = ".";
-          }}
-
-          # Delete files and directories that exists in the gallery that don't exist in the tarball
-          filesToRemove="$(uniq -u <(sort <(find . -not -path './.thumbnails*') <(tar -tf '${transferDir}/gallery.tar.gz' | sed 's|/$||')))"
-          while IFS= read -r fname; do
-            rm -f "$fname" ||:
-            rm -f ".thumbnails/$fname.png" ||:
-          done <<< "$filesToRemove"
-
-          find . -type d -empty -delete
-
-          mkdir -p .thumbnails
-          images="$(find . -type f -not -path './.thumbnails*')"
-
-          while IFS= read -r fname; do
-            # Skip this file if an up-to-date thumbnail already exists
-            if [ -f ".thumbnails/$fname.png" ] && \
-              [ "$(date -R -r "$fname")" == "$(date -R -r ".thumbnails/$fname.png")" ]
-            then
-              continue
-            fi
-
-            echo "Creating thumbnail for $fname"
-            mkdir -p "$(dirname ".thumbnails/$fname")"
-            magick -define jpeg:size=200x200 "$fname" -thumbnail 300 -auto-orient ".thumbnails/$fname.png" ||:
-            touch -m -d "$(date -R -r "$fname")" ".thumbnails/$fname.png"
-          done <<< "$images"
-        '';
-      });
-
       AmbientCapabilities = [ "" ];
       CapabilityBoundingSet = [ "" ];
       DeviceAllow = [ "" ];

hosts/bekkalokk/services/well-known/default.nix

@@ -1,25 +1,18 @@
-{ lib, ... }:
+{ ... }:
 {
-  services.nginx.virtualHosts = lib.genAttrs [
+  services.nginx.virtualHosts."www.pvv.ntnu.no".locations = {
-    "pvv.ntnu.no"
+    "^~ /.well-known/" = {
-    "www.pvv.ntnu.no"
+      alias = (toString ./root) + "/";
-    "pvv.org"
-    "www.pvv.org"
-  ] (_: {
-    locations = {
-      "^~ /.well-known/" = {
-        alias = (toString ./root) + "/";
-      };
-
-      # Proxy the matrix well-known files
-      # Host has be set before proxy_pass
-      # The header must be set so nginx on the other side routes it to the right place
-      "^~ /.well-known/matrix/" = {
-        extraConfig = ''
-          proxy_set_header Host matrix.pvv.ntnu.no;
-          proxy_pass https://matrix.pvv.ntnu.no/.well-known/matrix/;
-        '';
-      };
     };
-  });
+
+    # Proxy the matrix well-known files
+    # Host has be set before proxy_pass
+    # The header must be set so nginx on the other side routes it to the right place
+    "^~ /.well-known/matrix/" = {
+      extraConfig = ''
+        proxy_set_header Host matrix.pvv.ntnu.no;
+        proxy_pass https://matrix.pvv.ntnu.no/.well-known/matrix/;
+      '';
+    };
+  };
 }

hosts/bekkalokk/services/well-known/root/security.txt

@@ -6,11 +6,7 @@ Contact: mailto:cert@pvv.ntnu.no
 Preferred-Languages: no, en
 
 Expires: 2032-12-31T23:59:59.000Z
-# This file was last updated 2026-02-27.
+# This file was last updated 2024-09-14.
 
 # You can find a wikipage for our security policies at:
 # https://wiki.pvv.ntnu.no/wiki/CERT
-
-# Please note that we are a student organization, and unfortunately we do not
-# have a bug bounty program or offer monetary compensation for disclosure of
-# security vulnerabilities.

hosts/bicep/configuration.nix

@@ -9,12 +9,22 @@
     ./services/calendar-bot.nix
     #./services/git-mirrors
     ./services/minecraft-heatmap.nix
-    ./services/mysql
+    ./services/mysql.nix
-    ./services/postgresql
+    ./services/postgres.nix
 
     ./services/matrix
   ];
 
+  sops.defaultSopsFile = fp /secrets/bicep/bicep.yaml;
+  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
+  sops.age.generateKey = true;
+
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  networking.hostName = "bicep";
+
   #systemd.network.networks."30-enp6s0f0" = values.defaultNetworkConfig // {
   systemd.network.networks."30-ens18" = values.defaultNetworkConfig // {
     #matchConfig.Name = "enp6s0f0";
@@ -26,9 +36,17 @@
     anyInterface = true;
   };
 
+  # There are no smart devices
+  services.smartd.enable = false;
+
+  # we are a vm now
   services.qemuGuest.enable = true;
 
-  # Don't change (even during upgrades) unless you know what you are doing.
+  # Enable the OpenSSH daemon.
+  services.openssh.enable = true;
+  services.sshguard.enable = true;
+
+  # Do not change, even during upgrades.
   # See https://search.nixos.org/options?show=system.stateVersion
-  system.stateVersion = "25.11";
+  system.stateVersion = "22.11";
 }

hosts/bicep/hardware-configuration.nix

@@ -1,4 +1,4 @@
-# Do not modify this file!  It was generated by 'nixos-generate-config'
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
 { config, lib, pkgs, modulesPath, ... }:

hosts/bicep/services/git-mirrors/default.nix

@@ -66,7 +66,6 @@ in
       package = pkgs.callPackage (fp /packages/cgit.nix) { };
       group = "gickup";
       scanPath = "${cfg.dataDir}/linktree";
-      gitHttpBackend.checkExportOkFiles = false;
       settings = {
         enable-commit-graph = true;
         enable-follow-links = true;
@@ -83,7 +82,6 @@ in
   };
 
   services.nginx.virtualHosts."mirrors.pvv.ntnu.no" = {
-    kTLS = true;
     forceSSL = true;
     enableACME = true;
 

hosts/bicep/services/matrix/coturn.nix

@@ -1,6 +1,13 @@
 { config, lib, fp, pkgs, secrets, values, ... }:
 
 {
+  sops.secrets."matrix/synapse/turnconfig" = {
+    sopsFile = fp /secrets/bicep/matrix.yaml;
+    key = "synapse/turnconfig";
+    owner = config.users.users.matrix-synapse.name;
+    group = config.users.users.matrix-synapse.group;
+    restartUnits = [ "coturn.service" ];
+  };
   sops.secrets."matrix/coturn/static-auth-secret" = {
     sopsFile = fp /secrets/bicep/matrix.yaml;
     key = "coturn/static-auth-secret";
@@ -9,18 +16,9 @@
     restartUnits = [ "coturn.service" ];
   };
 
-  sops.templates."matrix-synapse-turnconfig" = {
-    owner = config.users.users.matrix-synapse.name;
-    group = config.users.users.matrix-synapse.group;
-    content = ''
-      turn_shared_secret: ${config.sops.placeholder."matrix/coturn/static-auth-secret"}
-    '';
-    restartUnits = [ "matrix-synapse.target" ];
-  };
-
   services.matrix-synapse-next = {
     extraConfigFiles = [
-      config.sops.templates."matrix-synapse-turnconfig".path
+      config.sops.secrets."matrix/synapse/turnconfig".path
     ];
 
     settings = {

hosts/bicep/services/matrix/default.nix

@@ -1,17 +1,19 @@
 { config, ... }:
+
 {
+
   imports = [
-    ./synapse-admin.nix
-    ./synapse-auto-compressor.nix
     ./synapse.nix
+    ./synapse-admin.nix
     ./element.nix
     ./coturn.nix
-    ./livekit.nix
     ./mjolnir.nix
-    ./well-known.nix
 
     # ./discord.nix
     ./out-of-your-element.nix
     ./hookshot
   ];
+
+
+
 }

hosts/bicep/services/matrix/element.nix

@@ -2,13 +2,6 @@
 let
   synapse-cfg = config.services.matrix-synapse-next;
 in {
-  services.pvv-matrix-well-known.client = {
-    "m.homeserver" = {
-      base_url = "https://matrix.pvv.ntnu.no";
-      server_name = "pvv.ntnu.no";
-    };
-  };
-
   services.nginx.virtualHosts."chat.pvv.ntnu.no" = {
     enableACME = true;
     forceSSL = true;
@@ -16,10 +9,10 @@ in {
 
     root = pkgs.element-web.override {
       conf = {
-        # Tries to look up well-known first, else uses bundled config.
+        default_server_config."m.homeserver" = {
-        default_server_name = "matrix.pvv.ntnu.no";
+          base_url = "https://matrix.pvv.ntnu.no";
-        default_server_config = config.services.pvv-matrix-well-known.client;
+          server_name = "pvv.ntnu.no";
-
+        };
         disable_3pid_login = true;
 #        integrations_ui_url = "https://dimension.dodsorf.as/riot";
 #        integrations_rest_url = "https://dimension.dodsorf.as/api/v1/scalar";
@@ -37,7 +30,6 @@ in {
           # element call group calls
           feature_group_calls = true;
         };
-        default_country_code = "NO";
         default_theme = "dark";
         # Servers in this list should provide some sort of valuable scoping
         # matrix.org is not useful compared to matrixrooms.info,

hosts/bicep/services/matrix/hookshot/default.nix

@@ -14,15 +14,10 @@ in
     sopsFile = fp /secrets/bicep/matrix.yaml;
     key = "hookshot/hs_token";
   };
-  sops.secrets."matrix/hookshot/passkey" = {
-    sopsFile = fp /secrets/bicep/matrix.yaml;
-    key = "hookshot/passkey";
-  };
 
   sops.templates."hookshot-registration.yaml" = {
     owner = config.users.users.matrix-synapse.name;
     group = config.users.groups.keys-matrix-registrations.name;
-    mode = "0440";
     restartUnits = [ "matrix-hookshot.service" ];
     content = ''
       id: matrix-hookshot
@@ -49,61 +44,9 @@ in
   };
 
   systemd.services.matrix-hookshot = {
-    serviceConfig = {
+    serviceConfig.SupplementaryGroups = [
-      DynamicUser = true;
+      config.users.groups.keys-matrix-registrations.name
-      SupplementaryGroups = [
+    ];
-        config.users.groups.keys-matrix-registrations.name
-      ];
-      LoadCredential = [
-        "passkey.pem:${config.sops.secrets."matrix/hookshot/passkey".path}"
-      ];
-
-      RuntimeDirectory = [ "matrix-hookshot/root-mnt" ];
-      RootDirectory = "/run/matrix-hookshot/root-mnt";
-      BindReadOnlyPaths = [
-        config.sops.templates."hookshot-registration.yaml".path
-        builtins.storeDir
-        "/etc"
-        "/run/nscd"
-        "/var/run/nscd"
-      ];
-
-      AmbientCapabilities = "";
-      CapabilityBoundingSet = "";
-      LockPersonality = true;
-      MemoryDenyWriteExecute = false; # node needs this
-      NoNewPrivileges = true;
-      PrivateDevices = true;
-      PrivateMounts = true;
-      PrivateTmp = true;
-      PrivateUsers = true;
-      ProcSubset = "pid";
-      ProtectClock = true;
-      ProtectControlGroups = true;
-      ProtectHome = true;
-      ProtectHostname = true;
-      ProtectKernelLogs = true;
-      ProtectKernelModules = true;
-      ProtectKernelTunables = true;
-      ProtectProc = "invisible";
-      ProtectSystem = "strict";
-      RemoveIPC = true;
-      RestrictAddressFamilies = [
-        "AF_INET"
-        "AF_INET6"
-        "AF_UNIX"
-      ];
-      RestrictNamespaces = true;
-      RestrictRealtime = true;
-      RestrictSUIDSGID = true;
-      SystemCallArchitectures = "native";
-      SystemCallFilter = [
-        "@system-service"
-        "~@privileged"
-        "~@resources"
-      ];
-      UMask = "0077";
-    };
   };
 
   services.matrix-hookshot = {
@@ -111,8 +54,6 @@ in
     package = unstablePkgs.matrix-hookshot;
     registrationFile = config.sops.templates."hookshot-registration.yaml".path;
     settings = {
-      passFile = "/run/credentials/matrix-hookshot.service/passkey.pem";
-
       bridge = {
         bindAddress = "127.0.0.1";
         domain = "pvv.ntnu.no";
@@ -120,7 +61,6 @@ in
         mediaUrl = "https://matrix.pvv.ntnu.no";
         port = 9993;
       };
-
       listeners = [
         {
           bindAddress = webhookListenAddress;
@@ -133,7 +73,6 @@ in
           ];
         }
       ];
-
       generic = {
         enabled = true;
         outbound = true;
@@ -194,7 +133,6 @@ in
   };
 
   services.nginx.virtualHosts."hookshot.pvv.ntnu.no" = {
-    kTLS = true;
     enableACME = true;
     addSSL = true;
     locations."/" = {

hosts/bicep/services/matrix/livekit.nix

@@ -1,67 +0,0 @@
-{ config, lib, fp, ... }:
-let
-  synapseConfig = config.services.matrix-synapse-next;
-  matrixDomain = "matrix.pvv.ntnu.no";
-  cfg = config.services.livekit;
-in
-{
-  sops.secrets."matrix/livekit/keyfile/lk-jwt-service" = {
-    sopsFile = fp /secrets/bicep/matrix.yaml;
-    key = "livekit/keyfile/lk-jwt-service";
-  };
-  sops.templates."matrix-livekit-keyfile" = {
-    restartUnits = [
-      "livekit.service"
-      "lk-jwt-service.service"
-    ];
-    content = ''
-      lk-jwt-service: ${config.sops.placeholder."matrix/livekit/keyfile/lk-jwt-service"}
-    '';
-  };
-
-  services.pvv-matrix-well-known.client = lib.mkIf cfg.enable {
-    "org.matrix.msc4143.rtc_foci" = [{
-      type = "livekit";
-      livekit_service_url = "https://${matrixDomain}/livekit/jwt";
-    }];
-  };
-
-  services.livekit = {
-    enable = true;
-    openFirewall = true;
-    keyFile = config.sops.templates."matrix-livekit-keyfile".path;
-
-    # NOTE: needed for ingress/egress workers
-    # redis.createLocally = true;
-
-    # settings.room.auto_create = false;
-  };
-
-  services.lk-jwt-service = lib.mkIf cfg.enable {
-    enable = true;
-    livekitUrl = "wss://${matrixDomain}/livekit/sfu";
-    keyFile = config.sops.templates."matrix-livekit-keyfile".path;
-  };
-
-  systemd.services.lk-jwt-service.environment.LIVEKIT_FULL_ACCESS_HOMESERVERS = lib.mkIf cfg.enable (builtins.concatStringsSep "," [ "pvv.ntnu.no" "dodsorf.as" ]);
-
-  services.nginx.virtualHosts.${matrixDomain} = lib.mkIf cfg.enable {
-    locations."^~ /livekit/jwt/" = {
-      proxyPass = "http://localhost:${toString config.services.lk-jwt-service.port}/";
-    };
-
-    # TODO: load balance to multiple livekit ingress/egress workers
-    locations."^~ /livekit/sfu/" = {
-      proxyPass = "http://localhost:${toString config.services.livekit.settings.port}/";
-      proxyWebsockets = true;
-      extraConfig = ''
-        proxy_send_timeout 120;
-        proxy_read_timeout 120;
-        proxy_buffering off;
-        proxy_set_header Accept-Encoding gzip;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection "upgrade";
-      '';
-    };
-  };
-}

hosts/bicep/services/matrix/mjolnir.nix

@@ -54,53 +54,4 @@
     # TODO: Fix upstream module in nixpkgs
     pantalaimon.username = "bot_admin";
   };
-
-  systemd.services.mjolnir.serviceConfig = {
-    DynamicUser = true;
-    RuntimeDirectory = [ "mjolnir/root-mnt" ];
-    RootDirectory = "/run/mjolnir/root-mnt";
-    BindReadOnlyPaths = [
-      config.sops.secrets."matrix/mjolnir/access_token".path
-      builtins.storeDir
-      "/etc"
-      "/run/nscd"
-      "/var/run/nscd"
-    ];
-
-    AmbientCapabilities = "";
-    CapabilityBoundingSet = "";
-    LockPersonality = true;
-    MemoryDenyWriteExecute = false; # node needs this
-    NoNewPrivileges = true;
-    PrivateDevices = true;
-    PrivateMounts = true;
-    PrivateTmp = true;
-    PrivateUsers = true;
-    ProcSubset = "pid";
-    ProtectClock = true;
-    ProtectControlGroups = true;
-    ProtectHome = true;
-    ProtectHostname = true;
-    ProtectKernelLogs = true;
-    ProtectKernelModules = true;
-    ProtectKernelTunables = true;
-    ProtectProc = "invisible";
-    ProtectSystem = "strict";
-    RemoveIPC = true;
-    RestrictAddressFamilies = [
-      "AF_INET"
-      "AF_INET6"
-      "AF_UNIX"
-    ];
-    RestrictNamespaces = true;
-    RestrictRealtime = true;
-    RestrictSUIDSGID = true;
-    SystemCallArchitectures = "native";
-    SystemCallFilter = [
-      "@system-service"
-      "~@privileged"
-      "~@resources"
-    ];
-    UMask = "0077";
-  };
 }

hosts/bicep/services/matrix/out-of-your-element.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, lib, values, fp, ... }:
+{ config, pkgs, fp, ... }:
 let
   cfg = config.services.matrix-ooye;
 in
@@ -28,23 +28,6 @@ in
     };
   };
 
-  services.rsync-pull-targets = lib.mkIf cfg.enable {
-    enable = true;
-    locations."/var/lib/private/matrix-ooye" = {
-      user = "root";
-      rrsyncArgs.ro = true;
-      authorizedKeysAttrs = [
-        "restrict"
-        "from=\"principal.pvv.ntnu.no,${values.hosts.principal.ipv6},${values.hosts.principal.ipv4}\""
-        "no-agent-forwarding"
-        "no-port-forwarding"
-        "no-pty"
-        "no-X11-forwarding"
-      ];
-      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE5koYfor5+kKB30Dugj3dAWvmj8h/akQQ2XYDvLobFL matrix_ooye rsync backup";
-    };
-  };
-
   services.matrix-ooye = {
     enable = true;
     homeserver = "https://matrix.pvv.ntnu.no";
@@ -56,55 +39,6 @@ in
     enableSynapseIntegration = false;
   };
 
-  systemd.services."matrix-ooye" = {
-    serviceConfig = {
-      RuntimeDirectory = [ "matrix-ooye/root-mnt" ];
-      RootDirectory = "/run/matrix-ooye/root-mnt";
-      BindReadOnlyPaths = [
-        builtins.storeDir
-        "/etc"
-        "/run/nscd"
-        "/var/run/nscd"
-      ];
-
-      AmbientCapabilities = "";
-      CapabilityBoundingSet = "";
-      LockPersonality = true;
-      MemoryDenyWriteExecute = false; # node needs this
-      NoNewPrivileges = true;
-      PrivateDevices = true;
-      PrivateMounts = true;
-      PrivateTmp = true;
-      PrivateUsers = true;
-      ProcSubset = "pid";
-      ProtectClock = true;
-      ProtectControlGroups = true;
-      ProtectHome = true;
-      ProtectHostname = true;
-      ProtectKernelLogs = true;
-      ProtectKernelModules = true;
-      ProtectKernelTunables = true;
-      ProtectProc = "invisible";
-      ProtectSystem = "strict";
-      RemoveIPC = true;
-      RestrictAddressFamilies = [
-        "AF_INET"
-        "AF_INET6"
-        "AF_UNIX"
-      ];
-      RestrictNamespaces = true;
-      RestrictRealtime = true;
-      RestrictSUIDSGID = true;
-      SystemCallArchitectures = "native";
-      SystemCallFilter = [
-        "@system-service"
-        "~@privileged"
-        "~@resources"
-      ];
-      UMask = "0077";
-    };
-  };
-
   systemd.services."matrix-synapse" = {
     after = [
       "matrix-ooye-pre-start.service"
@@ -129,7 +63,6 @@ in
   };
 
   services.nginx.virtualHosts."ooye.pvv.ntnu.no" = {
-    kTLS = true;
     forceSSL = true;
     enableACME = true;
     locations."/".proxyPass = "http://localhost:${cfg.socket}";

hosts/bicep/services/matrix/synapse-auto-compressor.nix

@@ -1,56 +0,0 @@
-{ config, lib, utils, ... }:
-let
-  cfg = config.services.synapse-auto-compressor;
-in
-{
-  services.synapse-auto-compressor = {
-    # enable = true;
-    postgresUrl = "postgresql://matrix-synapse@/synapse?host=/run/postgresql";
-  };
-
-  # NOTE: nixpkgs has some broken asserts, vendored the entire unit
-  systemd.services.synapse-auto-compressor = {
-    description = "synapse-auto-compressor";
-    requires = [
-      "postgresql.target"
-    ];
-    inherit (cfg) startAt;
-    serviceConfig = {
-      Type = "oneshot";
-      DynamicUser = true;
-      User = "matrix-synapse";
-      PrivateTmp = true;
-      ExecStart = utils.escapeSystemdExecArgs [
-        "${cfg.package}/bin/synapse_auto_compressor"
-        "-p"
-        cfg.postgresUrl
-        "-c"
-        cfg.settings.chunk_size
-        "-n"
-        cfg.settings.chunks_to_compress
-        "-l"
-        (lib.concatStringsSep "," (map toString cfg.settings.levels))
-      ];
-      LockPersonality = true;
-      MemoryDenyWriteExecute = true;
-      NoNewPrivileges = true;
-      PrivateDevices = true;
-      PrivateMounts = true;
-      PrivateUsers = true;
-      RemoveIPC = true;
-      RestrictNamespaces = true;
-      RestrictRealtime = true;
-      RestrictSUIDSGID = true;
-      ProcSubset = "pid";
-      ProtectProc = "invisible";
-      ProtectSystem = "strict";
-      ProtectHome = true;
-      ProtectHostname = true;
-      ProtectClock = true;
-      ProtectKernelTunables = true;
-      ProtectKernelModules = true;
-      ProtectKernelLogs = true;
-      ProtectControlGroups = true;
-    };
-  };
-}

hosts/bicep/services/matrix/synapse.nix

@@ -15,33 +15,11 @@ in {
     group = config.users.users.matrix-synapse.group;
   };
 
-  sops.secrets."matrix/synapse/user_registration/registration_shared_secret" = {
+  sops.secrets."matrix/synapse/user_registration" = {
     sopsFile = fp /secrets/bicep/matrix.yaml;
-    key = "synapse/user_registration/registration_shared_secret";
+    key = "synapse/signing_key";
-  };
-  sops.templates."matrix-synapse-user-registration" = {
     owner = config.users.users.matrix-synapse.name;
     group = config.users.users.matrix-synapse.group;
-    content = ''
-      registration_shared_secret: ${config.sops.placeholder."matrix/synapse/user_registration/registration_shared_secret"}
-    '';
-  };
-
-  services.rsync-pull-targets = {
-    enable = true;
-    locations.${cfg.settings.media_store_path} = {
-      user = "root";
-      rrsyncArgs.ro = true;
-      authorizedKeysAttrs = [
-        "restrict"
-        "from=\"principal.pvv.ntnu.no,${values.hosts.principal.ipv6},${values.hosts.principal.ipv4}\""
-        "no-agent-forwarding"
-        "no-port-forwarding"
-        "no-pty"
-        "no-X11-forwarding"
-      ];
-      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIASnjI9b3j4ZS3BL/D1ggHfws1BkE8iS0v0cGpEmbG+k matrix_media_store rsync backup";
-    };
   };
 
   services.matrix-synapse-next = {
@@ -74,7 +52,7 @@ in {
         name = "psycopg2";
         args = {
           host = "/var/run/postgresql";
-          database = "synapse";
+          dbname = "synapse";
           user = "matrix-synapse";
           cp_min = 1;
           cp_max = 5;
@@ -105,7 +83,7 @@ in {
       mau_stats_only = true;
 
       enable_registration = false;
-      registration_shared_secret_path = config.sops.templates."matrix-synapse-user-registration".path;
+      registration_shared_secret_path = config.sops.secrets."matrix/synapse/user_registration".path;
 
       password_config.enabled = true;
 
@@ -117,32 +95,6 @@ in {
         }
       ];
 
-      experimental_features = {
-        # MSC3266: Room summary API. Used for knocking over federation
-        msc3266_enabled = true;
-        # MSC4222 needed for syncv2 state_after. This allow clients to
-        # correctly track the state of the room.
-        msc4222_enabled = true;
-      };
-
-      # The maximum allowed duration by which sent events can be delayed, as
-      # per MSC4140.
-      max_event_delay_duration = "24h";
-
-      rc_message = {
-        # This needs to match at least e2ee key sharing frequency plus a bit of headroom
-        # Note key sharing events are bursty
-        per_second = 0.5;
-        burst_count = 30;
-      };
-
-      rc_delayed_event_mgmt = {
-        # This needs to match at least the heart-beat frequency plus a bit of headroom
-        # Currently the heart-beat is every 5 seconds which translates into a rate of 0.2s
-        per_second = 1;
-        burst_count = 20;
-      };
-
       trusted_key_servers = [
         { server_name = "matrix.org"; }
         { server_name = "dodsorf.as"; }
@@ -180,12 +132,21 @@ in {
 
   services.redis.servers."".enable = true;
 
-  services.pvv-matrix-well-known.server."m.server" = "matrix.pvv.ntnu.no:443";
-
   services.nginx.virtualHosts."matrix.pvv.ntnu.no" = lib.mkMerge [
   {
     kTLS = true;
   }
+  {
+    locations."/.well-known/matrix/server" = {
+      return = ''
+        200 '{"m.server": "matrix.pvv.ntnu.no:443"}'
+      '';
+      extraConfig = ''
+        default_type application/json;
+        add_header Access-Control-Allow-Origin *;
+      '';
+    };
+  }
   {
     locations."/_synapse/admin" = {
       proxyPass = "http://$synapse_backend";

hosts/bicep/services/matrix/well-known.nix

@@ -1,44 +0,0 @@
-{ config, pkgs, lib, ... }:
-let
-  cfg = config.services.pvv-matrix-well-known;
-  format = pkgs.formats.json { };
-  matrixDomain = "matrix.pvv.ntnu.no";
-in
-{
-  options.services.pvv-matrix-well-known = {
-    client = lib.mkOption {
-      type = lib.types.submodule { freeformType = format.type; };
-      default = { };
-      example = {
-        "m.homeserver".base_url = "https://${matrixDomain}/";
-      };
-    };
-
-    server = lib.mkOption {
-      type = lib.types.submodule { freeformType = format.type; };
-      default = { };
-      example = {
-        "m.server" = "https://${matrixDomain}/";
-      };
-    };
-  };
-
-  config = {
-    services.nginx.virtualHosts.${matrixDomain} = {
-      locations."= /.well-known/matrix/client" = lib.mkIf (cfg.client != { }) {
-        alias = format.generate "nginx-well-known-matrix-server.json" cfg.client;
-        extraConfig = ''
-          default_type application/json;
-          add_header Access-Control-Allow-Origin *;
-        '';
-      };
-      locations."= /.well-known/matrix/server" = lib.mkIf (cfg.server != { }) {
-        alias = format.generate "nginx-well-known-matrix-server.json" cfg.server;
-        extraConfig = ''
-          default_type application/json;
-          add_header Access-Control-Allow-Origin *;
-        '';
-      };
-    };
-  };
-}

hosts/bicep/services/minecraft-heatmap.nix

@@ -22,29 +22,28 @@ in
     };
   };
 
-  systemd.services.minecraft-heatmap-ingest-logs = lib.mkIf cfg.enable {
+  systemd.services.minecraft-heatmap-ingest-logs = {
-    serviceConfig = {
+    serviceConfig.LoadCredential = [
-      LoadCredential = [
+      "sshkey:${config.sops.secrets."minecraft-heatmap/ssh-key/private".path}"
-        "sshkey:${config.sops.secrets."minecraft-heatmap/ssh-key/private".path}"
+    ];
-      ];
+
-      ExecStartPre = let
+    preStart = let
-        knownHostsFile = pkgs.writeText "minecraft-heatmap-known-hosts" ''
+      knownHostsFile = pkgs.writeText "minecraft-heatmap-known-hosts" ''
-          innovation.pvv.ntnu.no ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE9O/y5uqcLKCodg2Q+XfZPH/AoUIyBlDhigImU+4+Kn
+        innovation.pvv.ntnu.no ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE9O/y5uqcLKCodg2Q+XfZPH/AoUIyBlDhigImU+4+Kn
-          innovation.pvv.ntnu.no ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQClR9GvWeVPZHudlnFXhGHUX5sGX9nscsOsotnlQ4uVuGsgvRifsVsuDULlAFXwoV1tYp4vnyXlsVtMddpLI5ANOIDcZ4fgDxpfSQmtHKssNpDcfMhFJbfRVyacipjA4osxTxvLox/yjtVt+URjTHUA1MWzEwc26KfiOvWO5tCBTan7doN/4KOyT05GwBxwzUAwUmoGTacIITck2Y9qp4+xFYqehbXqPdBb15hFyd38OCQhtU1hWV2Yi18+hJ4nyjc/g5pr6mW09ULlFghe/BaTUXrTisYC6bMcJZsTDwsvld9581KPvoNZOTQhZPTEQCZZ1h54fe0ZHuveVB3TIHovZyjoUuaf4uiFOjJVaKRB+Ig+Il6r7tMUn9CyHtus/Nd86E0TFBzoKxM0OFu88oaUlDtZVrUJL5En1lGoimajebb1JPxllFN5hqIT+gVyMY6nRzkcfS7ieny/U4rzXY2rfz98selftgh3LsBywwADv65i+mPw1A/1QdND1R6fV4U=
+        innovation.pvv.ntnu.no ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQClR9GvWeVPZHudlnFXhGHUX5sGX9nscsOsotnlQ4uVuGsgvRifsVsuDULlAFXwoV1tYp4vnyXlsVtMddpLI5ANOIDcZ4fgDxpfSQmtHKssNpDcfMhFJbfRVyacipjA4osxTxvLox/yjtVt+URjTHUA1MWzEwc26KfiOvWO5tCBTan7doN/4KOyT05GwBxwzUAwUmoGTacIITck2Y9qp4+xFYqehbXqPdBb15hFyd38OCQhtU1hWV2Yi18+hJ4nyjc/g5pr6mW09ULlFghe/BaTUXrTisYC6bMcJZsTDwsvld9581KPvoNZOTQhZPTEQCZZ1h54fe0ZHuveVB3TIHovZyjoUuaf4uiFOjJVaKRB+Ig+Il6r7tMUn9CyHtus/Nd86E0TFBzoKxM0OFu88oaUlDtZVrUJL5En1lGoimajebb1JPxllFN5hqIT+gVyMY6nRzkcfS7ieny/U4rzXY2rfz98selftgh3LsBywwADv65i+mPw1A/1QdND1R6fV4U=
-          innovation.pvv.ntnu.no ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBNjl3HfsDqmALWCL9uhz9k93RAD2565ndBqUh4N/rvI7MCwEJ6iRCdDev0YzB1Fpg24oriyYoxZRP24ifC2sQf8=
+        innovation.pvv.ntnu.no ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBNjl3HfsDqmALWCL9uhz9k93RAD2565ndBqUh4N/rvI7MCwEJ6iRCdDev0YzB1Fpg24oriyYoxZRP24ifC2sQf8=
-        '';
+      '';
-        rsyncArgs = lib.cli.toCommandLineShellGNU { } {
+    in ''
-          archive = true;
+      mkdir -p '${cfg.minecraftLogsDir}'
-          verbose = true;
+      "${lib.getExe pkgs.rsync}" \
-          progress = true;
+      --archive \
-          no-owner = true;
+      --verbose \
-          no-group = true;
+      --progress \
-        };
+      --no-owner \
-        sshCommand = ''${pkgs.openssh}/bin/ssh -o UserKnownHostsFile='${knownHostsFile}' -i \"$CREDENTIALS_DIRECTORY\"/sshkey'';
+      --no-group \
-      in [
+      --rsh="${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=\"${knownHostsFile}\" -i \"$CREDENTIALS_DIRECTORY\"/sshkey" \
-        "${lib.getExe' pkgs.coreutils "mkdir"} -p '${cfg.minecraftLogsDir}'"
+      root@innovation.pvv.ntnu.no:/ \
-        "${lib.getExe pkgs.rsync} ${rsyncArgs} --rsh=\"${sshCommand}\" root@innovation.pvv.ntnu.no:. '${cfg.minecraftLogsDir}'/"
+      '${cfg.minecraftLogsDir}'/
-      ];
+    '';
-    };
   };
 }

hosts/bicep/services/mysql.nix

@@ -0,0 +1,55 @@
+{ pkgs, lib, config, values, ... }:
+{
+  sops.secrets."mysql/password" = {
+    owner = "mysql";
+    group = "mysql";
+  };
+
+  users.mysql.passwordFile = config.sops.secrets."mysql/password".path;
+
+  services.mysql = {
+    enable = true;
+    dataDir = "/data/mysql";
+    package = pkgs.mariadb;
+    settings = {
+      mysqld = {
+        # PVV allows a lot of connections at the same time
+        max_connect_errors = 10000;
+        bind-address = values.services.mysql.ipv4;
+        skip-networking = 0;
+
+        # This was needed in order to be able to use all of the old users
+        # during migration from knakelibrak to bicep in Sep. 2023
+        secure_auth = 0;
+      };
+    };
+
+    # Note: This user also has MAX_USER_CONNECTIONS set to 3, and
+    #       a password which can be found in /secrets/ildkule/ildkule.yaml
+    #       We have also changed both the host and auth plugin of this user
+    #       to be 'ildkule.pvv.ntnu.no' and 'mysql_native_password' respectively.
+    ensureUsers = [{
+      name = "prometheus_mysqld_exporter";
+      ensurePermissions = {
+        "*.*" = "PROCESS, REPLICATION CLIENT, SELECT, SLAVE MONITOR";
+      };
+    }];
+  };
+
+  services.mysqlBackup = {
+    enable = true;
+    location = "/var/lib/mysql/backups";
+  };
+
+  networking.firewall.allowedTCPPorts = [ 3306 ];
+
+  systemd.services.mysql.serviceConfig = {
+    IPAddressDeny = "any";
+    IPAddressAllow = [
+      values.ipv4-space
+      values.ipv6-space
+      values.hosts.ildkule.ipv4
+      values.hosts.ildkule.ipv6
+    ];
+  };
+}

hosts/bicep/services/mysql/backup.nix

@@ -1,83 +0,0 @@
-{ config, lib, pkgs, values, ... }:
-let
-  cfg = config.services.mysql;
-  backupDir = "/data/mysql-backups";
-in
-{
-  # services.mysqlBackup = lib.mkIf cfg.enable {
-  #   enable = true;
-  #   location = "/var/lib/mysql-backups";
-  # };
-
-  systemd.tmpfiles.settings."10-mysql-backups".${backupDir}.d = {
-	  user = "mysql";
-	  group = "mysql";
-	  mode = "700";
-	};
-
-  services.rsync-pull-targets = lib.mkIf cfg.enable {
-    enable = true;
-    locations.${backupDir} = {
-      user = "root";
-      rrsyncArgs.ro = true;
-      authorizedKeysAttrs = [
-        "restrict"
-        "from=\"principal.pvv.ntnu.no,${values.hosts.principal.ipv6},${values.hosts.principal.ipv4}\""
-        "no-agent-forwarding"
-        "no-port-forwarding"
-        "no-pty"
-        "no-X11-forwarding"
-      ];
-      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJgj55/7Cnj4cYMJ5sIkl+OwcGeBe039kXJTOf2wvo9j mysql rsync backup";
-    };
-  };
-
-  # NOTE: instead of having the upstream nixpkgs postgres backup unit trigger
-  #       another unit, it was easier to just make one ourselves.
-  systemd.services."backup-mysql" = lib.mkIf cfg.enable {
-    description = "Backup MySQL data";
-    requires = [ "mysql.service" ];
-
-    path = with pkgs; [
-      cfg.package
-      coreutils
-      zstd
-    ];
-
-    script = let
-      rotations = 2;
-    in ''
-      set -euo pipefail
-
-      OUT_FILE="$STATE_DIRECTORY/mysql-dump-$(date --iso-8601).sql.zst"
-
-      mysqldump --all-databases | zstd --compress -9 --rsyncable -o "$OUT_FILE"
-
-      # NOTE: this needs to be a hardlink for rrsync to allow sending it
-      rm "$STATE_DIRECTORY/mysql-dump-latest.sql.zst" ||:
-      ln -T "$OUT_FILE" "$STATE_DIRECTORY/mysql-dump-latest.sql.zst"
-
-      while [ "$(find "$STATE_DIRECTORY" -type f -printf '.' | wc -c)" -gt '${toString (rotations + 1)}' ]; do
-        rm "$(find "$STATE_DIRECTORY" -type f -printf '%T+ %p\n' | sort | head -n 1 | cut -d' ' -f2)"
-      done
-    '';
-
-    serviceConfig = {
-      Type = "oneshot";
-      User = "mysql";
-      Group = "mysql";
-      UMask = "0077";
-
-      Nice = 19;
-      IOSchedulingClass = "best-effort";
-      IOSchedulingPriority = 7;
-
-      StateDirectory = [ "mysql-backups" ];
-      BindPaths = [ "${backupDir}:/var/lib/mysql-backups" ];
-
-      # TODO: hardening
-    };
-
-    startAt = "*-*-* 02:15:00";
-  };
-}

hosts/bicep/services/mysql/default.nix

@@ -1,89 +0,0 @@
-{ config, pkgs, lib, values, ... }:
-let
-  cfg = config.services.mysql;
-  dataDir = "/data/mysql";
-in
-{
-  imports = [ ./backup.nix ];
-
-  sops.secrets."mysql/password" = {
-    owner = "mysql";
-    group = "mysql";
-  };
-
-  users.mysql.passwordFile = config.sops.secrets."mysql/password".path;
-
-  services.mysql = {
-    enable = true;
-    package = pkgs.mariadb_118;
-    settings = {
-      mysqld = {
-        # PVV allows a lot of connections at the same time
-        max_connect_errors = 10000;
-        bind-address = values.services.mysql.ipv4;
-        skip-networking = 0;
-
-        # Useful for the mysqld prometheus exporter
-        userstat = 1;
-
-        # This was needed in order to be able to use all of the old users
-        # during migration from knakelibrak to bicep in Sep. 2023
-        secure_auth = 0;
-
-        slow-query-log = 1;
-        slow-query-log-file = "/var/log/mysql/mysql-slow.log";
-      };
-    };
-
-    # Note: This user also has MAX_USER_CONNECTIONS set to 3, and
-    #       a password which can be found in /secrets/ildkule/ildkule.yaml
-    #       We have also changed both the host and auth plugin of this user
-    #       to be 'ildkule.pvv.ntnu.no' and 'mysql_native_password' respectively.
-    ensureUsers = [{
-      name = "prometheus_mysqld_exporter";
-      ensurePermissions = {
-        "*.*" = "PROCESS, REPLICATION CLIENT, SELECT, SLAVE MONITOR";
-      };
-    }];
-  };
-
-  networking.firewall.allowedTCPPorts = lib.mkIf cfg.enable [ 3306 ];
-
-  systemd.tmpfiles.settings."10-mysql".${dataDir}.d = lib.mkIf cfg.enable {
-    inherit (cfg) user group;
-    mode = "0700";
-  };
-
-  systemd.services.mysql = lib.mkIf cfg.enable {
-    after = [
-      "systemd-tmpfiles-setup.service"
-      "systemd-tmpfiles-resetup.service"
-    ];
-
-    serviceConfig = {
-      BindPaths = [ "${dataDir}:${cfg.dataDir}" ];
-
-      LogsDirectory = "mysql";
-
-      IPAddressDeny = "any";
-      IPAddressAllow = [
-        values.ipv4-space
-        values.ipv6-space
-        values.hosts.ildkule.ipv4
-        values.hosts.ildkule.ipv6
-      ];
-    };
-  };
-
-  services.logrotate = lib.mkIf (cfg.settings.mysqld.slow-query-log == 1) {
-    enable = true;
-    settings.mysql-slowlog = {
-      files = [ cfg.settings.mysqld.slow-query-log-file ];
-      frequency = "weekly";
-      rotate = 12;
-      create = "0660 mysql mysql";
-      minsize = "1M";
-      compress = true;
-    };
-  };
-}

hosts/bicep/services/postgres.nix

@@ -1,17 +1,8 @@
-{ config, lib, pkgs, values, ... }:
+{ config, pkgs, values, ... }:
-let
-  cfg = config.services.postgresql;
-in
 {
-  imports = [
-    ./backup.nix
-    ./cleanup-timers.nix
-  ];
-
   services.postgresql = {
     enable = true;
-    package = pkgs.postgresql_18;
+    package = pkgs.postgresql_15;
-    extensions = ps: with ps; [ pg_repack ];
     enableTCPIP = true;
 
     authentication = ''
@@ -83,13 +74,13 @@ in
     };
   };
 
-  systemd.tmpfiles.settings."10-postgresql"."/data/postgresql".d = lib.mkIf cfg.enable {
+  systemd.tmpfiles.settings."10-postgresql"."/data/postgresql".d = {
     user = config.systemd.services.postgresql.serviceConfig.User;
     group = config.systemd.services.postgresql.serviceConfig.Group;
     mode = "0700";
   };
 
-  systemd.services.postgresql-setup = lib.mkIf cfg.enable {
+  systemd.services.postgresql-setup = {
     after = [
       "systemd-tmpfiles-setup.service"
       "systemd-tmpfiles-resetup.service"
@@ -104,7 +95,7 @@ in
     };
   };
 
-  systemd.services.postgresql = lib.mkIf cfg.enable {
+  systemd.services.postgresql = {
     after = [
       "systemd-tmpfiles-setup.service"
       "systemd-tmpfiles-resetup.service"
@@ -119,35 +110,18 @@ in
     };
   };
 
-  environment.snakeoil-certs."/etc/certs/postgres" = lib.mkIf cfg.enable {
+  environment.snakeoil-certs."/etc/certs/postgres" = {
     owner = "postgres";
     group = "postgres";
     subject = "/C=NO/O=Programvareverkstedet/CN=postgres.pvv.ntnu.no/emailAddress=drift@pvv.ntnu.no";
   };
 
-  networking.firewall.allowedTCPPorts = lib.mkIf cfg.enable [ 5432 ];
+  networking.firewall.allowedTCPPorts = [ 5432 ];
-  networking.firewall.allowedUDPPorts = lib.mkIf cfg.enable [ 5432 ];
+  networking.firewall.allowedUDPPorts = [ 5432 ];
 
-  environment.systemPackages = [
+  services.postgresqlBackup = {
-    (pkgs.writeShellApplication {
+    enable = true;
-      name = "postgres-update-collations.sh";
+    location = "/var/lib/postgres/backups";
-      runtimeInputs = [
+    backupAll = true;
-        config.systemd.package
+  };
-        cfg.package
-      ];
-      text = ''
-        run0 --user=postgres psql <${pkgs.writeText "postgres-update-collations.sql" ''
-          CREATE FUNCTION exec(text) returns text language plpgsql volatile
-            AS $f$
-              BEGIN
-                EXECUTE $1;
-                RETURN $1;
-              END;
-          $f$;
-
-          SELECT exec('ALTER DATABASE "' || datname || '" REFRESH COLLATION VERSION') FROM pg_database WHERE datistemplate = false;
-        ''}
-      '';
-    })
-  ];
 }

hosts/bicep/services/postgresql/backup.nix

@@ -1,84 +0,0 @@
-{ config, lib, pkgs, values, ... }:
-let
-  cfg = config.services.postgresql;
-  backupDir = "/data/postgresql-backups";
-in
-{
-  # services.postgresqlBackup = lib.mkIf cfg.enable {
-  #   enable = true;
-  #   location = "/var/lib/postgresql-backups";
-  #   backupAll = true;
-  # };
-
-  systemd.tmpfiles.settings."10-postgresql-backups".${backupDir}.d = {
-	  user = "postgres";
-	  group = "postgres";
-	  mode = "700";
-	};
-
-  services.rsync-pull-targets = lib.mkIf cfg.enable {
-    enable = true;
-    locations.${backupDir} = {
-      user = "root";
-      rrsyncArgs.ro = true;
-      authorizedKeysAttrs = [
-        "restrict"
-        "from=\"principal.pvv.ntnu.no,${values.hosts.principal.ipv6},${values.hosts.principal.ipv4}\""
-        "no-agent-forwarding"
-        "no-port-forwarding"
-        "no-pty"
-        "no-X11-forwarding"
-      ];
-      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGvO7QX7QmwSiGLXEsaxPIOpAqnJP3M+qqQRe5dzf8gJ postgresql rsync backup";
-    };
-  };
-
-  # NOTE: instead of having the upstream nixpkgs postgres backup unit trigger
-  #       another unit, it was easier to just make one ourselves
-  systemd.services."backup-postgresql" = {
-    description = "Backup PostgreSQL data";
-    requires = [ "postgresql.service" ];
-
-    path = with pkgs; [
-      coreutils
-      zstd
-      cfg.package
-    ];
-
-    script = let
-      rotations = 2;
-    in ''
-      set -euo pipefail
-
-      OUT_FILE="$STATE_DIRECTORY/postgresql-dump-$(date --iso-8601).sql.zst"
-
-      pg_dumpall -U postgres | zstd --compress -9 --rsyncable -o "$OUT_FILE"
-
-      # NOTE: this needs to be a hardlink for rrsync to allow sending it
-      rm "$STATE_DIRECTORY/postgresql-dump-latest.sql.zst" ||:
-      ln -T "$OUT_FILE" "$STATE_DIRECTORY/postgresql-dump-latest.sql.zst"
-
-      while [ "$(find "$STATE_DIRECTORY" -type f -printf '.' | wc -c)" -gt '${toString (rotations + 1)}' ]; do
-        rm "$(find "$STATE_DIRECTORY" -type f -printf '%T+ %p\n' | sort | head -n 1 | cut -d' ' -f2)"
-      done
-    '';
-
-    serviceConfig = {
-      Type = "oneshot";
-      User = "postgres";
-      Group = "postgres";
-      UMask = "0077";
-
-      Nice = 19;
-      IOSchedulingClass = "best-effort";
-      IOSchedulingPriority = 7;
-
-      StateDirectory = [ "postgresql-backups" ];
-      BindPaths = [ "${backupDir}:/var/lib/postgresql-backups" ];
-
-      # TODO: hardening
-    };
-
-    startAt = "*-*-* 01:15:00";
-  };
-}

hosts/bicep/services/postgresql/cleanup-timers.nix

@@ -1,37 +0,0 @@
-{ config, lib, pkgs, ... }:
-let
-  cfg = config.services.postgresql;
-in
-{
-  config = lib.mkIf cfg.enable {
-    systemd.services = {
-      postgresql-repack = {
-        requires = [ "postgresql.service" ];
-        after = [ "postgresql.target" ];
-        description = "Repack all PostgreSQL databases";
-        startAt = "Mon 06:00:00";
-        serviceConfig = {
-          Type = "oneshot";
-          User = "postgres";
-          Group = "postgres";
-
-          ExecStart = "${lib.getExe cfg.package.pkgs.pg_repack} --host=/run/postgresql --no-kill-backend --wait-timeout=30 --all";
-        };
-      };
-
-      postgresql-vacuum-analyze = {
-        requires = [ "postgresql.service" ];
-        after = [ "postgresql.target" ];
-        description = "Vacuum and analyze all PostgreSQL databases";
-        startAt = "Tue 06:00:00";
-        serviceConfig = {
-          Type = "oneshot";
-          User = "postgres";
-          Group = "postgres";
-
-          ExecStart = "${lib.getExe' cfg.package "psql"} --port=${builtins.toString cfg.settings.port} -tAc 'VACUUM ANALYZE'";
-        };
-      };
-    };
-  };
-}

hosts/bikkje/configuration.nix

@@ -1,6 +1,6 @@
 { config, pkgs, values, ... }:
 {
-  networking.nat = {
+    networking.nat = {
     enable = true;
     internalInterfaces = ["ve-+"];
     externalInterface = "ens3";
@@ -25,33 +25,10 @@
       ];
 
       networking = {
-        hostName = "bikkje";
         firewall = {
           enable = true;
           # Allow SSH and HTTP and ports for email and irc
-          allowedTCPPorts = [
+          allowedTCPPorts = [ 80 22 194 994 6665 6666 6667 6668 6669 6697 995 993 25 465 587 110 143 993 995 ];
-            22 # SSH
-            80 # HTTP
-
-            # IRC
-            194 # IRC
-            994 # IRC (TLS)
-            6697 # IRC (SSL)
-            6665
-            6666
-            6667
-            6668
-            6669
-
-            # EMAIL
-            25  # STMP
-            465 # STMP (SSL)
-            587 # STMP (TLS/STARTTLS)
-            110 # POP3
-            995 # POP3 (SSL/TLS)
-            143 # IMAP
-            993 # IMAP (SSL/TLS)
-          ];
           allowedUDPPorts = [ 80 22 194 994 6665 6666 6667 6668 6669 6697 995 993 25 465 587 110 143 993 995 ];
         };
         # Use systemd-resolved inside the container
@@ -59,11 +36,9 @@
         useHostResolvConf = mkForce false;
       };
 
-      services.resolved.enable = true;
-
-      # Don't change (even during upgrades) unless you know what you are doing.
-      # See https://search.nixos.org/options?show=system.stateVersion
       system.stateVersion = "23.11";
+      services.resolved.enable = true;
     };
   };
+
 };

hosts/brzeczyszczykiewicz/configuration.nix

@@ -8,14 +8,28 @@
       ./services/grzegorz.nix
     ];
 
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  networking.hostName = "brzeczyszczykiewicz";
+
   systemd.network.networks."30-eno1" = values.defaultNetworkConfig // {
     matchConfig.Name = "eno1";
     address = with values.hosts.brzeczyszczykiewicz; [ (ipv4 + "/25") (ipv6 + "/64") ];
   };
 
-  fonts.fontconfig.enable = true;
+  # List packages installed in system profile
+  environment.systemPackages = with pkgs; [
+  ];
+
+  # List services that you want to enable:
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "23.05"; # Did you read the comment?
 
-  # Don't change (even during upgrades) unless you know what you are doing.
-  # See https://search.nixos.org/options?show=system.stateVersion
-  system.stateVersion = "25.11";
 }

hosts/brzeczyszczykiewicz/hardware-configuration.nix

@@ -1,4 +1,4 @@
-# Do not modify this file!  It was generated by 'nixos-generate-config'
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
 { config, lib, pkgs, modulesPath, ... }:
@@ -16,7 +16,6 @@
   fileSystems."/" =
     { device = "/dev/disk/by-uuid/4e8667f8-55de-4103-8369-b94665f42204";
       fsType = "ext4";
-      options = [ "relatime" ];
     };
 
   fileSystems."/boot" =

hosts/georg/configuration.nix

@@ -8,11 +8,24 @@
       (fp /modules/grzegorz.nix)
     ];
 
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  networking.hostName = "georg";
+
   systemd.network.networks."30-eno1" = values.defaultNetworkConfig // {
     matchConfig.Name = "eno1";
     address = with values.hosts.georg; [ (ipv4 + "/25") (ipv6 + "/64") ];
   };
 
+  # List packages installed in system profile
+  environment.systemPackages = with pkgs; [
+  ];
+
+  # List services that you want to enable:
+
+
+
   services.spotifyd = {
     enable = true;
     settings.global = {
@@ -28,9 +41,15 @@
     5353 # spotifyd is its own mDNS service wtf
   ];
 
-  fonts.fontconfig.enable = true;
 
-  # Don't change (even during upgrades) unless you know what you are doing.
+
-  # See https://search.nixos.org/options?show=system.stateVersion
+
-  system.stateVersion = "25.11";
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "23.05"; # Did you read the comment?
+
 }

hosts/georg/hardware-configuration.nix

@@ -1,4 +1,4 @@
-# Do not modify this file!  It was generated by 'nixos-generate-config'
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
 { config, lib, pkgs, modulesPath, ... }:
@@ -16,7 +16,6 @@
   fileSystems."/" =
     { device = "/dev/disk/by-uuid/33825f0d-5a63-40fc-83db-bfa1ebb72ba0";
       fsType = "ext4";
-      options = [ "relatime" ];
     };
 
   fileSystems."/boot" =

hosts/gluttony/configuration.nix

@@ -1,61 +0,0 @@
-{
-  fp,
-  lib,
-  values,
-  ...
-}:
-{
-  imports = [
-    ./hardware-configuration.nix
-    ./services/bluemap.nix
-    (fp /base)
-  ];
-
-  systemd.network.enable = lib.mkForce false;
-  boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
-
-  boot.loader = {
-    systemd-boot.enable = false; # no uefi support on this device
-    grub.device = "/dev/sda";
-    grub.enable = true;
-  };
-  boot.tmp.cleanOnBoot = true;
-
-  networking =
-    let
-      hostConf = values.hosts.gluttony;
-    in
-    {
-      tempAddresses = "disabled";
-      useDHCP = false;
-
-      search = values.defaultNetworkConfig.domains;
-      nameservers = values.defaultNetworkConfig.dns;
-      defaultGateway.address = hostConf.ipv4_internal_gw;
-
-      interfaces."ens3" = {
-        ipv4.addresses = [
-          {
-            address = hostConf.ipv4;
-            prefixLength = 32;
-          }
-          {
-            address = hostConf.ipv4_internal;
-            prefixLength = 24;
-          }
-        ];
-        ipv6.addresses = [
-          {
-            address = hostConf.ipv6;
-            prefixLength = 64;
-          }
-        ];
-      };
-    };
-
-  services.qemuGuest.enable = true;
-
-  # Don't change (even during upgrades) unless you know what you are doing.
-  # See https://search.nixos.org/options?show=system.stateVersion
-  system.stateVersion = "25.11";
-}

hosts/gluttony/hardware-configuration.nix

@@ -1,51 +0,0 @@
-# Do not modify this file!  It was generated by 'nixos-generate-config'
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{
-  config,
-  lib,
-  pkgs,
-  modulesPath,
-  ...
-}:
-
-{
-  imports = [
-    (modulesPath + "/profiles/qemu-guest.nix")
-  ];
-
-  boot.initrd.availableKernelModules = [
-    "ata_piix"
-    "uhci_hcd"
-    "virtio_pci"
-    "virtio_scsi"
-    "sd_mod"
-  ];
-  boot.initrd.kernelModules = [ "dm-snapshot" ];
-  boot.kernelModules = [ "kvm-intel" ];
-  boot.extraModulePackages = [ ];
-
-  fileSystems."/" = {
-    device = "/dev/mapper/pool-root";
-    fsType = "ext4";
-    options = [ "relatime" ];
-  };
-
-  fileSystems."/boot" = {
-    device = "/dev/disk/by-uuid/BD97-FCA0";
-    fsType = "vfat";
-    options = [
-      "fmask=0077"
-      "dmask=0077"
-    ];
-  };
-
-  swapDevices = [
-    {
-      device = "/var/lib/swapfile";
-      size = 8 * 1024;
-    }
-  ];
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-}

hosts/gluttony/services/bluemap.nix

@@ -1,113 +0,0 @@
-{ config, lib, pkgs, inputs, ... }:
-let
-  vanillaSurvival = "/var/lib/bluemap/vanilla_survival_world";
-in {
-  # NOTE: our version of the module gets added in flake.nix
-  disabledModules = [ "services/web-apps/bluemap.nix" ];
-
-  sops.secrets."bluemap/ssh-key" = { };
-  sops.secrets."bluemap/ssh-known-hosts" = { };
-
-  services.bluemap = {
-    enable = true;
-
-    eula = true;
-    onCalendar = "*-*-* 05:45:00"; # a little over an hour after auto-upgrade
-
-    enableNginx = false;
-
-    host = "minecraft.pvv.ntnu.no";
-
-    maps = let
-      inherit (inputs.minecraft-kartverket.packages.${pkgs.stdenv.hostPlatform.system}) bluemap-export;
-    in {
-      "verden" = {
-        extraHoconMarkersFile = "${bluemap-export}/overworld.hocon";
-        settings = {
-          world = vanillaSurvival;
-          dimension = "minecraft:overworld";
-          name = "Verden";
-          sorting = 0;
-          start-pos = {
-            x = 0;
-            z = 0;
-          };
-          ambient-light = 0.1;
-          cave-detection-ocean-floor = -5;
-        };
-      };
-      "underverden" = {
-        extraHoconMarkersFile = "${bluemap-export}/nether.hocon";
-        settings = {
-          world = vanillaSurvival;
-          dimension = "minecraft:the_nether";
-          name = "Underverden";
-          sorting = 100;
-          start-pos = {
-            x = 0;
-            z = 0;
-          };
-          sky-color = "#290000";
-          void-color = "#150000";
-          sky-light = 1;
-          ambient-light = 0.6;
-          remove-caves-below-y = -10000;
-          cave-detection-ocean-floor = -5;
-          cave-detection-uses-block-light = true;
-          render-mask = [{
-            max-y = 90;
-          }];
-        };
-      };
-      "enden" = {
-        extraHoconMarkersFile = "${bluemap-export}/the-end.hocon";
-        settings = {
-          world = vanillaSurvival;
-          dimension = "minecraft:the_end";
-          name = "Enden";
-          sorting = 200;
-          start-pos = {
-            x = 0;
-            z = 0;
-          };
-          sky-color = "#080010";
-          void-color = "#080010";
-          sky-light = 1;
-          ambient-light = 0.6;
-          remove-caves-below-y = -10000;
-          cave-detection-ocean-floor = -5;
-        };
-      };
-    };
-  };
-
-  systemd.services."render-bluemap-maps" = {
-    serviceConfig = {
-      StateDirectory = [ "bluemap/world" ];
-      ExecStartPre = let
-        rsyncArgs = lib.cli.toCommandLineShellGNU { } {
-          archive = true;
-          compress = true;
-          verbose = true;
-          no-owner = true;
-          no-group = true;
-          rsh = "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=%d/ssh-known-hosts -i %d/sshkey";
-        };
-      in "${lib.getExe pkgs.rsync} ${rsyncArgs} root@innovation.pvv.ntnu.no:. ${vanillaSurvival}";
-      ExecStartPost = let
-        rsyncArgs = lib.cli.toCommandLineShellGNU { } {
-          archive = true;
-          compress = true;
-          verbose = true;
-          no-owner = true;
-          no-group = true;
-          rsh = "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=%d/ssh-known-hosts -i %d/sshkey";
-        };
-      in "${lib.getExe pkgs.rsync} ${rsyncArgs} --groupmap=root:nginx ${config.services.bluemap.webRoot}/ root@bekkalokk.pvv.ntnu.no:.";
-      LoadCredential = [
-        "sshkey:${config.sops.secrets."bluemap/ssh-key".path}"
-        "ssh-known-hosts:${config.sops.secrets."bluemap/ssh-known-hosts".path}"
-      ];
-    };
-  };
-}

hosts/ildkule/configuration.nix

@@ -1,23 +1,20 @@
+{ config, fp, pkgs, lib, values, ... }:
 {
-  config,
-  fp,
-  pkgs,
-  lib,
-  values,
-  ...
-}: {
   imports = [
-    ./hardware-configuration.nix
+      # Include the results of the hardware scan.
-    ./disks.nix
+      ./hardware-configuration.nix
-    (fp /base)
+      (fp /base)
 
-    ./services/monitoring
+      ./services/monitoring
-    ./services/nginx
+      ./services/nginx
-    ./services/journald-remote.nix
+    ];
-  ];
 
-  boot.loader.grub.enable = true;
+  sops.defaultSopsFile = fp /secrets/ildkule/ildkule.yaml;
-  boot.loader.systemd-boot.enable = lib.mkForce false;
+  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
+  sops.age.generateKey = true;
+
+  boot.loader.grub.device = "/dev/vda";
   boot.tmp.cleanOnBoot = true;
   zramSwap.enable = true;
 
@@ -26,6 +23,7 @@
   networking = let
     hostConf = values.hosts.ildkule;
   in {
+    hostName = "ildkule";
     tempAddresses = "disabled";
     useDHCP = lib.mkForce true;
 
@@ -33,29 +31,24 @@
     nameservers = values.defaultNetworkConfig.dns;
     defaultGateway.address = hostConf.ipv4_internal_gw;
 
-    interfaces."ens3" = {
+    interfaces."ens4" = {
       ipv4.addresses = [
-        {
+        { address = hostConf.ipv4;          prefixLength = 32; }
-          address = hostConf.ipv4;
+        { address = hostConf.ipv4_internal; prefixLength = 24; }
-          prefixLength = 32;
-        }
-        {
-          address = hostConf.ipv4_internal;
-          prefixLength = 24;
-        }
       ];
       ipv6.addresses = [
-        {
+        { address = hostConf.ipv6;          prefixLength = 64; }
-          address = hostConf.ipv6;
-          prefixLength = 64;
-        }
       ];
     };
   };
 
-  services.qemuGuest.enable = true;
+  # List packages installed in system profile
+  environment.systemPackages = with pkgs; [
+  ];
+
+  # No devices with SMART
+  services.smartd.enable = false;
+
+  system.stateVersion = "23.11"; # Did you read the comment?
 
-  # Don't change (even during upgrades) unless you know what you are doing.
-  # See https://search.nixos.org/options?show=system.stateVersion
-  system.stateVersion = "23.11";
 }

hosts/ildkule/disks.nix

@@ -1,27 +0,0 @@
-{
-  disko.devices = {
-    disk = {
-      sda = {
-        device = "/dev/sda";
-        type = "disk";
-        content = {
-          type = "gpt";
-          partitions = {
-            bios = {
-              size = "1M";
-              type = "EF02";
-            };
-            root = {
-              size = "100%";
-              content = {
-                type = "filesystem";
-                format = "ext4";
-                mountpoint = "/";
-              };
-            };
-          };
-        };
-      };
-    };
-  };
-}

hosts/ildkule/hardware-configuration.nix

@@ -1,24 +1,16 @@
-# Do not modify this file!  It was generated by 'nixos-generate-config'
+{ modulesPath, lib, ... }:
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
-
 {
-  imports =
+  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
-    [ (modulesPath + "/profiles/qemu-guest.nix")
+  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "xen_blkfront" "vmw_pvscsi" ];
-    ];
+  boot.initrd.kernelModules = [ "nvme" ];
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/e35eb4ce-aac3-4f91-8383-6e7cd8bbf942";
+    fsType = "ext4";
+  };
+  fileSystems."/data" = {
+    device = "/dev/disk/by-uuid/0a4c1234-02d3-4b53-aeca-d95c4c8d534b";
+    fsType = "ext4";
+  };
 
-  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ "kvm-intel" ];
-  boot.extraModulePackages = [ ];
-
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
   networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.ens3.useDHCP = lib.mkDefault true;
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
 }

hosts/ildkule/services/journald-remote.nix

@@ -1,58 +0,0 @@
-{ config, lib, values, ... }:
-let
-  cfg = config.services.journald.remote;
-  domainName = "journald.pvv.ntnu.no";
-in
-{
-  security.acme.certs.${domainName} = {
-    webroot = "/var/lib/acme/acme-challenge/";
-    group = config.services.nginx.group;
-  };
-
-  services.nginx = {
-    enable = true;
-    virtualHosts.${domainName} = {
-      forceSSL = true;
-      useACMEHost = "${domainName}";
-      locations."/.well-known/".root = "/var/lib/acme/acme-challenge/";
-    };
-  };
-
-  services.journald.upload.enable = lib.mkForce false;
-
-  services.journald.remote = {
-    enable = true;
-    settings.Remote = let
-      inherit (config.security.acme.certs.${domainName}) directory;
-    in {
-      ServerKeyFile = "/run/credentials/systemd-journal-remote.service/key.pem";
-      ServerCertificateFile = "/run/credentials/systemd-journal-remote.service/cert.pem";
-      TrustedCertificateFile = "-";
-    };
-  };
-
-  systemd.sockets."systemd-journal-remote" = {
-    socketConfig = {
-      IPAddressDeny = "any";
-      IPAddressAllow = [
-        "127.0.0.1"
-        "::1"
-        values.ipv4-space
-        values.ipv6-space
-      ];
-    };
-  };
-
-  networking.firewall.allowedTCPPorts = [ cfg.port ];
-
-  systemd.services."systemd-journal-remote" = {
-    serviceConfig = {
-      LoadCredential = let
-        inherit (config.security.acme.certs.${domainName}) directory;
-      in [
-        "key.pem:${directory}/key.pem"
-        "cert.pem:${directory}/cert.pem"
-      ];
-    };
-  };
-}

hosts/ildkule/services/monitoring/dashboards/mysql.json

@@ -13,7 +13,7 @@
     ]
   },
   "description": "",
-  "editable": false,
+  "editable": true,
   "gnetId": 11323,
   "graphTooltip": 1,
   "id": 31,
@@ -3690,7 +3690,7 @@
         },
         "hide": 0,
         "includeAll": false,
-        "label": "Data source",
+        "label": "Data Source",
         "multi": false,
         "name": "datasource",
         "options": [],
@@ -3713,12 +3713,12 @@
         "definition": "label_values(mysql_up, job)",
         "hide": 0,
         "includeAll": true,
-        "label": "Job",
+        "label": "job",
         "multi": true,
         "name": "job",
         "options": [],
         "query": "label_values(mysql_up, job)",
-        "refresh": 2,
+        "refresh": 1,
         "regex": "",
         "skipUrlSync": false,
         "sort": 0,
@@ -3742,12 +3742,12 @@
         "definition": "label_values(mysql_up, instance)",
         "hide": 0,
         "includeAll": true,
-        "label": "Instance",
+        "label": "instance",
         "multi": true,
         "name": "instance",
         "options": [],
         "query": "label_values(mysql_up, instance)",
-        "refresh": 2,
+        "refresh": 1,
         "regex": "",
         "skipUrlSync": false,
         "sort": 0,

hosts/ildkule/services/monitoring/dashboards/postgres.json

@@ -328,7 +328,7 @@
         "rgba(50, 172, 45, 0.97)"
       ],
       "datasource": "${DS_PROMETHEUS}",
-      "format": "short",
+      "format": "decbytes",
       "gauge": {
         "maxValue": 100,
         "minValue": 0,
@@ -411,7 +411,7 @@
         "rgba(50, 172, 45, 0.97)"
       ],
       "datasource": "${DS_PROMETHEUS}",
-      "format": "short",
+      "format": "decbytes",
       "gauge": {
         "maxValue": 100,
         "minValue": 0,
@@ -1410,7 +1410,7 @@
       "tableColumn": "",
       "targets": [
         {
-          "expr": "pg_settings_seq_page_cost{instance=\"$instance\"}",
+          "expr": "pg_settings_seq_page_cost",
           "format": "time_series",
           "intervalFactor": 1,
           "refId": "A"
@@ -1872,7 +1872,7 @@
       },
       "yaxes": [
         {
-          "format": "short",
+          "format": "bytes",
           "label": null,
           "logBase": 1,
           "max": null,
@@ -1966,7 +1966,7 @@
       },
       "yaxes": [
         {
-          "format": "short",
+          "format": "bytes",
           "label": null,
           "logBase": 1,
           "max": null,
@@ -2060,7 +2060,7 @@
       },
       "yaxes": [
         {
-          "format": "short",
+          "format": "bytes",
           "label": null,
           "logBase": 1,
           "max": null,
@@ -2251,7 +2251,7 @@
       },
       "yaxes": [
         {
-          "format": "short",
+          "format": "bytes",
           "label": null,
           "logBase": 1,
           "max": null,
@@ -2439,7 +2439,7 @@
       },
       "yaxes": [
         {
-          "format": "short",
+          "format": "bytes",
           "label": null,
           "logBase": 1,
           "max": null,
@@ -2589,35 +2589,35 @@
       "steppedLine": false,
       "targets": [
         {
-          "expr": "irate(pg_stat_bgwriter_buffers_backend_total{instance=\"$instance\"}[5m])",
+          "expr": "irate(pg_stat_bgwriter_buffers_backend{instance=\"$instance\"}[5m])",
           "format": "time_series",
           "intervalFactor": 1,
           "legendFormat": "buffers_backend",
           "refId": "A"
         },
         {
-          "expr": "irate(pg_stat_bgwriter_buffers_alloc_total{instance=\"$instance\"}[5m])",
+          "expr": "irate(pg_stat_bgwriter_buffers_alloc{instance=\"$instance\"}[5m])",
           "format": "time_series",
           "intervalFactor": 1,
           "legendFormat": "buffers_alloc",
           "refId": "B"
         },
         {
-          "expr": "irate(pg_stat_bgwriter_buffers_backend_fsync_total{instance=\"$instance\"}[5m])",
+          "expr": "irate(pg_stat_bgwriter_buffers_backend_fsync{instance=\"$instance\"}[5m])",
           "format": "time_series",
           "intervalFactor": 1,
           "legendFormat": "backend_fsync",
           "refId": "C"
         },
         {
-          "expr": "irate(pg_stat_bgwriter_buffers_checkpoint_total{instance=\"$instance\"}[5m])",
+          "expr": "irate(pg_stat_bgwriter_buffers_checkpoint{instance=\"$instance\"}[5m])",
           "format": "time_series",
           "intervalFactor": 1,
           "legendFormat": "buffers_checkpoint",
           "refId": "D"
         },
         {
-          "expr": "irate(pg_stat_bgwriter_buffers_clean_total{instance=\"$instance\"}[5m])",
+          "expr": "irate(pg_stat_bgwriter_buffers_clean{instance=\"$instance\"}[5m])",
           "format": "time_series",
           "intervalFactor": 1,
           "legendFormat": "buffers_clean",
@@ -2886,14 +2886,14 @@
       "steppedLine": false,
       "targets": [
         {
-          "expr": "irate(pg_stat_bgwriter_checkpoint_write_time_total{instance=\"$instance\"}[5m])",
+          "expr": "irate(pg_stat_bgwriter_checkpoint_write_time{instance=\"$instance\"}[5m])",
           "format": "time_series",
           "intervalFactor": 1,
           "legendFormat": "write_time - Total amount of time that has been spent in the portion of checkpoint processing where files are written to disk.",
           "refId": "B"
         },
         {
-          "expr": "irate(pg_stat_bgwriter_checkpoint_sync_time_total{instance=\"$instance\"}[5m])",
+          "expr": "irate(pg_stat_bgwriter_checkpoint_sync_time{instance=\"$instance\"}[5m])",
           "format": "time_series",
           "intervalFactor": 1,
           "legendFormat": "sync_time - Total amount of time that has been spent in the portion of checkpoint processing where files are synchronized to disk.",

hosts/ildkule/services/monitoring/default.nix

@@ -5,7 +5,6 @@
     ./grafana.nix
     ./loki.nix
     ./prometheus
-    ./scrutiny.nix
     ./uptime-kuma.nix
   ];
 }

hosts/ildkule/services/monitoring/grafana.nix

@@ -47,13 +47,13 @@ in {
         {
           name = "Node Exporter Full";
           type = "file";
-          url = "https://grafana.com/api/dashboards/1860/revisions/42/download";
+          url = "https://grafana.com/api/dashboards/1860/revisions/29/download";
           options.path = dashboards/node-exporter-full.json;
         }
         {
           name = "Matrix Synapse";
           type = "file";
-          url = "https://github.com/element-hq/synapse/raw/refs/heads/develop/contrib/grafana/synapse.json";
+          url = "https://raw.githubusercontent.com/matrix-org/synapse/develop/contrib/grafana/synapse.json";
           options.path = dashboards/synapse.json;
         }
         {
@@ -65,9 +65,15 @@ in {
         {
           name = "Postgresql";
           type = "file";
-          url = "https://grafana.com/api/dashboards/9628/revisions/8/download";
+          url = "https://grafana.com/api/dashboards/9628/revisions/7/download";
           options.path = dashboards/postgres.json;
         }
+        {
+          name = "Go Processes (gogs)";
+          type = "file";
+          url = "https://grafana.com/api/dashboards/240/revisions/3/download";
+          options.path = dashboards/go-processes.json;
+        }
         {
           name = "Gitea Dashboard";
           type = "file";

hosts/ildkule/services/monitoring/loki.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, values, ... }:
+{ config, pkgs, ... }:
 
 let
   cfg = config.services.loki;
@@ -9,8 +9,8 @@ in {
     configuration = {
       auth_enabled = false;
       server = {
-        http_listen_port = 31832;
+        http_listen_port = 3100;
-        http_listen_address = "127.0.0.1";
+        http_listen_address = "0.0.0.0";
         grpc_listen_port = 9096;
       };
 
@@ -81,25 +81,5 @@ in {
     };
   };
 
-  services.nginx.virtualHosts."loki.pvv.ntnu.no" = {
+  networking.firewall.allowedTCPPorts = [ cfg.configuration.server.http_listen_port ];
-    forceSSL = true;
-    enableACME = true;
-    kTLS = true;
-
-    locations = {
-      "/".return = "403";
-      "/loki/api/v1/push" = {
-        proxyPass = "http://${cfg.configuration.server.http_listen_address}:${toString cfg.configuration.server.http_listen_port}/loki/api/v1/push";
-        extraConfig = ''
-          allow 127.0.0.1;
-          allow ::1;
-          allow ${values.ipv4-space};
-          allow ${values.ipv6-space};
-          allow ${values.ntnu.ipv4-space};
-          allow ${values.ntnu.ipv6-space};
-          deny all;
-        '';
-      };
-    };
-  };
 }

hosts/ildkule/services/monitoring/prometheus/default.nix

@@ -21,7 +21,6 @@ in {
 
   fileSystems."/var/lib/prometheus2" = {
     device = stateDir;
-    fsType = "bind";
     options = [ "bind" ];
   };
 }

hosts/ildkule/services/monitoring/prometheus/exim.nix

@@ -1,12 +1,14 @@
 { ... }:
 {
-  services.prometheus.scrapeConfigs = [{
+  services.prometheus = {
-    job_name = "exim";
+    scrapeConfigs = [
-    scrape_interval = "15s";
+      {
-    scheme = "http";
+        job_name = "exim";
-
+        scrape_interval = "15s";
-    static_configs = [{
+        static_configs = [{
-      targets = [ "microbel.pvv.ntnu.no:9636" ];
+          targets = [ "microbel.pvv.ntnu.no:9636" ];
-    }];
+        }];
-  }];
+      }
+    ];
+  };
 }

hosts/ildkule/services/monitoring/prometheus/machines.nix

@@ -6,63 +6,32 @@
     targets = map (port: "${name}.pvv.ntnu.no:${toString port}") ports;
   };
 
-  nixosMachines = [
-    "ildkule"
-    "bekkalokk"
-    "bicep"
-    "brzeczyszczykiewicz"
-    "georg"
-    "gluttony"
-    "kommode"
-    "lupine-1"
-    "lupine-2"
-    "lupine-3"
-    "lupine-4"
-    "lupine-5"
-    # TODO: export prometheus stats via apache on temmie
-    # "temmie"
-    "wenche"
-  ];
-
   defaultNodeExporterPort = 9100;
+  defaultSystemdExporterPort = 9101;
+  defaultNixosExporterPort = 9102;
 in {
-  services.prometheus.scrapeConfigs = [
+  services.prometheus.scrapeConfigs = [{
-    {
+    job_name = "base_info";
-      job_name = "nixos-node";
+    static_configs = [
-      scheme = "https";
+      (mkHostScrapeConfig "ildkule" [ cfg.exporters.node.port cfg.exporters.systemd.port defaultNixosExporterPort ])
-      metrics_path = "/prometheus-node-exporter/metrics";
+
-      static_configs = map (name: {
+      (mkHostScrapeConfig "bekkalokk" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
-        labels.hostname = name;
+      (mkHostScrapeConfig "bicep" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
-        targets = [ "${name}.pvv.ntnu.no:443" ];
+      (mkHostScrapeConfig "brzeczyszczykiewicz" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
-      }) nixosMachines;
+      (mkHostScrapeConfig "georg" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
-    }
+      (mkHostScrapeConfig "kommode" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
-    {
+      (mkHostScrapeConfig "ustetind" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
-      job_name = "nixos-systemd";
+      (mkHostScrapeConfig "wenche" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
-      scheme = "https";
+
-      metrics_path = "/prometheus-systemd-exporter/metrics";
+      (mkHostScrapeConfig "lupine-1" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
-      static_configs = map (name: {
+      # (mkHostScrapeConfig "lupine-2" [ defaultNodeExporterPort defaultSystemdExporterPort ])
-        labels.hostname = name;
+      (mkHostScrapeConfig "lupine-3" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
-        targets = [ "${name}.pvv.ntnu.no:443" ];
+      (mkHostScrapeConfig "lupine-4" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
-      }) nixosMachines;
+      (mkHostScrapeConfig "lupine-5" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
-    }
+
-    {
+      (mkHostScrapeConfig "hildring" [ defaultNodeExporterPort ])
-      job_name = "nixos-flake-input";
+      (mkHostScrapeConfig "isvegg" [ defaultNodeExporterPort ])
-      scheme = "https";
+      (mkHostScrapeConfig "microbel" [ defaultNodeExporterPort ])
-      metrics_path = "/prometheus-nixos-flake-input-exporter/metrics";
+    ];
-      static_configs = map (name: {
+  }];
-        labels.hostname = name;
-        targets = [ "${name}.pvv.ntnu.no:443" ];
-      }) nixosMachines;
-    }
-    {
-      job_name = "non-nixos-node";
-      scheme = "http";
-      metrics_path = "/metrics";
-      static_configs = [
-        (mkHostScrapeConfig "hildring" [ defaultNodeExporterPort ])
-        (mkHostScrapeConfig "isvegg" [ defaultNodeExporterPort ])
-        (mkHostScrapeConfig "microbel" [ defaultNodeExporterPort ])
-      ];
-    }
-  ];
 }

hosts/ildkule/services/monitoring/scrutiny.nix

@@ -1,40 +0,0 @@
-{ config, values, ... }:
-let
-  cfg = config.services.scrutiny;
-in
-{
-  services.scrutiny = {
-    enable = true;
-    settings = {
-      web.listen = {
-        host = "127.0.0.1";
-        port = 18293;
-        basepath = "";
-      };
-
-      # notify.urls = [
-      #   "matrix://username:password@host:port/[?rooms=!roomID1[,roomAlias2]]"
-      # ];
-    };
-  };
-
-  services.nginx.virtualHosts."scrutiny.pvv.ntnu.no" = {
-    kTLS = true;
-    enableACME = true;
-    forceSSL = true;
-    locations."/" = {
-      proxyPass = "http://${cfg.settings.web.listen.host}:${toString cfg.settings.web.listen.port}";
-    };
-
-    # TODO: allow website access to the outside world, but restrict input api
-    extraConfig = ''
-      allow ${values.hosts.ildkule.ipv4}/32;
-      allow ${values.hosts.ildkule.ipv6}/128;
-      allow 127.0.0.1/32;
-      allow ::1/128;
-      allow ${values.ipv4-space};
-      allow ${values.ipv6-space};
-      deny all;
-    '';
-  };
-}

hosts/ildkule/services/monitoring/uptime-kuma.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, lib, values, ... }:
+{ config, pkgs, lib, ... }:
 let
   cfg = config.services.uptime-kuma;
   domain = "status.pvv.ntnu.no";
@@ -19,26 +19,8 @@ in {
     locations."/".proxyPass = "http://${cfg.settings.HOST}:${cfg.settings.PORT}";
   };
 
-  fileSystems."/var/lib/private/uptime-kuma" = {
+  fileSystems."/var/lib/uptime-kuma" = {
     device = stateDir;
-    fsType = "bind";
     options = [ "bind" ];
   };
-
-  services.rsync-pull-targets = {
-    enable = true;
-    locations.${stateDir} = {
-      user = "root";
-      rrsyncArgs.ro = true;
-      authorizedKeysAttrs = [
-        "restrict"
-        "from=\"principal.pvv.ntnu.no,${values.hosts.principal.ipv6},${values.hosts.principal.ipv4}\""
-        "no-agent-forwarding"
-        "no-port-forwarding"
-        "no-pty"
-        "no-X11-forwarding"
-      ];
-      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJXzcDm6cVr4NmWzUSroy33FlielKqaG83wY0RCMC0p/ uptime_kuma rsync backup";
-    };
-  };
 }

hosts/kommode/configuration.nix

@@ -4,20 +4,29 @@
     # Include the results of the hardware scan.
     ./hardware-configuration.nix
     (fp /base)
-    ./disks.nix
 
     ./services/gitea
     ./services/nginx.nix
   ];
 
+  sops.defaultSopsFile = fp /secrets/kommode/kommode.yaml;
+  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
+  sops.age.generateKey = true;
+
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  networking.hostName = "kommode"; # Define your hostname.
+
   systemd.network.networks."30-ens18" = values.defaultNetworkConfig // {
     matchConfig.Name = "ens18";
     address = with values.hosts.kommode; [ (ipv4 + "/25") (ipv6 + "/64") ];
   };
 
-  services.qemuGuest.enable = true;
+  services.btrfs.autoScrub.enable = true;
+
+  environment.systemPackages = with pkgs; [];
 
-  # Don't change (even during upgrades) unless you know what you are doing.
-  # See https://search.nixos.org/options?show=system.stateVersion
   system.stateVersion = "24.11";
 }

hosts/kommode/disks.nix

@@ -1,81 +0,0 @@
-{ lib, ... }:
-{
-  disko.devices = {
-    disk = {
-      sda = {
-        type = "disk";
-        device = "/dev/sda";
-        content = {
-          type = "gpt";
-          partitions = {
-            root = {
-              name = "root";
-              label = "root";
-              start = "1MiB";
-              end = "-5G";
-              content = {
-                type = "btrfs";
-                extraArgs = [ "-f" ]; # Override existing partition
-                # subvolumes = let
-                #   makeSnapshottable = subvolPath: mountOptions: let
-                #     name = lib.replaceString "/" "-" subvolPath;
-                #   in {
-                #     "@${name}/active" = {
-                #       mountpoint = subvolPath;
-                #       inherit mountOptions;
-                #     };
-                #     "@${name}/snapshots" = {
-                #       mountpoint = "${subvolPath}/.snapshots";
-                #       inherit mountOptions;
-                #     };
-                #   };
-                # in {
-                #   "@" = { };
-                #   "@/swap" = {
-                #     mountpoint = "/.swapvol";
-                #     swap.swapfile.size = "4G";
-                #   };
-                #   "@/root" = {
-                #     mountpoint = "/";
-                #     mountOptions = [ "compress=zstd" "noatime" ];
-                #   };
-                # }
-                # // (makeSnapshottable "/home" [ "compress=zstd" "noatime" ])
-                # // (makeSnapshottable "/nix" [ "compress=zstd" "noatime" ])
-                # // (makeSnapshottable "/var/lib" [ "compress=zstd" "noatime" ])
-                # // (makeSnapshottable "/var/log" [ "compress=zstd" "noatime" ])
-                # // (makeSnapshottable "/var/cache" [ "compress=zstd" "noatime" ]);
-
-                # swap.swapfile.size = "4G";
-                mountpoint = "/";
-                mountOptions = [ "relatime" ];
-              };
-            };
-
-            swap = {
-              name = "swap";
-              label = "swap";
-              start = "-5G";
-              end = "-1G";
-              content.type = "swap";
-            };
-
-            ESP = {
-              name = "ESP";
-              label = "ESP";
-              start = "-1G";
-              end = "100%";
-              type = "EF00";
-              content = {
-                type = "filesystem";
-                format = "vfat";
-                mountpoint = "/boot";
-                mountOptions = [ "umask=0077" ];
-              };
-            };
-          };
-        };
-      };
-    };
-  };
-}

hosts/kommode/hardware-configuration.nix

@@ -1,4 +1,4 @@
-# Do not modify this file!  It was generated by 'nixos-generate-config'
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
 { config, lib, pkgs, modulesPath, ... }:
@@ -13,6 +13,21 @@
   boot.kernelModules = [ ];
   boot.extraModulePackages = [ ];
 
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/d421538f-a260-44ae-8e03-47cac369dcc1";
+      fsType = "btrfs";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/86CD-4C23";
+      fsType = "vfat";
+      options = [ "fmask=0077" "dmask=0077" ];
+    };
+
+  swapDevices =
+    [ { device = "/dev/disk/by-uuid/4cfbb41e-801f-40dd-8c58-0a0c1a6025f6"; }
+    ];
+
   # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
   # (the default) this is the recommended approach. When using systemd-networkd it's
   # still possible to use this option, but it's recommended to use it in conjunction