WIP: kommode: use disko to configure disks

2026-04-05 15:37:33 +02:00 · 2026-01-27 18:16:54 +09:00
52 changed files with 25397 additions and 9942 deletions
--- a/.sops.yaml
+++ b/.sops.yaml
@@ -20,9 +20,8 @@ keys:
  - &host_lupine-3 age1j2u876z8hu87q5npfxzzpfgllyw8ypj66d7cgelmzmnrf3xud34qzkntp9
  - &host_lupine-4 age1t8zlawqkmhye737pn8yx0z3p9cl947d9ktv2cajdc6hnvn52d3fsc59s2k
  - &host_lupine-5 age199zkqq4jp4yc3d0hx2q0ksxdtp42xhmjsqwyngh8tswuck34ke3smrfyqu
-  - &host_skrott age1lpkju2e053aaddpgsr4ef83epclf4c9tp4m98d35ft2fswr8p4tq2ua0mf
+  - &host_skrott age1hlvwswsljxsvrtp4leuw8a8rf8l2q6y06xvxtafvzpq54xm9aegs0kqw2e
  - &host_ustetind age1hffjafs4slznksefmtqrlj7rdaqgzqncn4un938rhr053237ry8s3rs0v8
-  - &host_skrot age1hzkvnktkr8t5gvtq0ccw69e44z5z6wf00n3xhk3hj24emf07je5s6q2evr

 creation_rules:
  # Global secrets
@@ -145,18 +144,5 @@ creation_rules:
      - *user_pederbs_sopp
      - *user_pederbs_nord
      - *user_pederbs_bjarte
-      - *user_vegardbm
-      pgp:
-      - *user_oysteikt
-  - path_regex: secrets/skrot/[^/]+\.yaml$
-    key_groups:
-    - age:
-      - *host_skrot
-      - *user_danio
-      - *user_felixalb
-      - *user_pederbs_sopp
-      - *user_pederbs_nord
-      - *user_pederbs_bjarte
-      - *user_vegardbm
      pgp:
      - *user_oysteikt
--- a/README.md
+++ b/README.md
@@ -43,7 +43,7 @@ revert the changes on the next nightly rebuild (tends to happen when everybody i
 | [kommode][kom]             | Virtual  | Gitea + Gitea pages                                       |
 | [lupine][lup]              | Physical | Gitea CI/CD runners                                       |
 |  shark                     | Virtual  | Test host for authentication, absolutely horrendous       |
-| [skrot/skrott][skr]        | Physical | Kiosk, snacks and soda                                    |
+| [skrott][skr]              | Physical | Kiosk, snacks and soda                                    |
 | [wenche][wen]              | Virtual  | Nix-builders, general purpose compute                     |

 ## Documentation
--- a/base/programs.nix
+++ b/base/programs.nix
@@ -19,9 +19,6 @@
    # Check computer specs
    lshw

-    # Check who is keeping open files
-    lsof
-
    # Scan for open ports with netstat
    net-tools

--- a/docs/secret-management.md
+++ b/docs/secret-management.md
@@ -151,7 +151,7 @@ is up to date, you can do the following:

 ```console
 # Fetch gpg (unless you have it already)
-nix shell nixpkgs#gnupg
+nix-shell -p gpg

 # Import oysteikts key to the gpg keychain
 gpg --import ./keys/oysteikt.pub
--- a/flake.lock
+++ b/flake.lock
@@ -1,20 +1,5 @@
 {
  "nodes": {
-    "crane": {
-      "locked": {
-        "lastModified": 1770419512,
-        "narHash": "sha256-o8Vcdz6B6bkiGUYkZqFwH3Pv1JwZyXht3dMtS7RchIo=",
-        "owner": "ipetkov",
-        "repo": "crane",
-        "rev": "2510f2cbc3ccd237f700bb213756a8f35c32d8d7",
-        "type": "github"
-      },
-      "original": {
-        "owner": "ipetkov",
-        "repo": "crane",
-        "type": "github"
-      }
-    },
    "dibbler": {
      "inputs": {
        "nixpkgs": [
@@ -22,11 +7,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1771267058,
-        "narHash": "sha256-EEL4SmD1b3BPJPsSJJ4wDTXWMumJqbR+BLzhJJG0skE=",
+        "lastModified": 1769400154,
+        "narHash": "sha256-K0OeXzFCUZTkCBxUDr3U3ah0odS/urtNVG09WDl+HAA=",
        "ref": "main",
-        "rev": "e3962d02c78b9c7b4d18148d931a9a4bf22e7902",
-        "revCount": 254,
+        "rev": "8e84669d9bf963d5e46bac37fe9b0aa8e8be2d01",
+        "revCount": 230,
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Projects/dibbler.git"
      },
@@ -62,11 +47,11 @@
        "nixpkgs-lib": "nixpkgs-lib"
      },
      "locked": {
-        "lastModified": 1772408722,
-        "narHash": "sha256-rHuJtdcOjK7rAHpHphUb1iCvgkU3GpfvicLMwwnfMT0=",
+        "lastModified": 1765835352,
+        "narHash": "sha256-XswHlK/Qtjasvhd1nOa1e8MgZ8GS//jBoTqWtrS1Giw=",
        "owner": "hercules-ci",
        "repo": "flake-parts",
-        "rev": "f20dc5d9b8027381c474144ecabc9034d6a839a3",
+        "rev": "a34fae9c08a15ad73f295041fec82323541400a9",
        "type": "github"
      },
      "original": {
@@ -82,11 +67,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1770617355,
-        "narHash": "sha256-lauV1yKA67WxnlbiJiwhOT9xI8nTiUqqrrRlgA+rMis=",
+        "lastModified": 1767906545,
+        "narHash": "sha256-LOf08pcjEQFLs3dLPuep5d1bAXWOFcdfxuk3YMb5KWw=",
        "ref": "main",
-        "rev": "36af0316a7370d19db05ef7c0a87e826f4a222d5",
-        "revCount": 24,
+        "rev": "e55cbe0ce0b20fc5952ed491fa8a553c8afb1bdd",
+        "revCount": 23,
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Grzegorz/gergle.git"
      },
@@ -104,11 +89,11 @@
        "rust-overlay": "rust-overlay"
      },
      "locked": {
-        "lastModified": 1770617867,
-        "narHash": "sha256-xPLm4C13KUl0zmm1OA+A8UwDSixwtNQ/caRx/WjN+WY=",
+        "lastModified": 1767906494,
+        "narHash": "sha256-Dd6gtdZfRMAD6JhdX0GdJwIHVaBikePSpQXhIdwLlWI=",
        "ref": "main",
-        "rev": "155752914d81a3a3c02fcfc5d840cfdfda07216d",
-        "revCount": 62,
+        "rev": "7258822e2e90fea2ea00b13b5542f63699e33a9e",
+        "revCount": 61,
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Grzegorz/greg-ng.git"
      },
@@ -189,11 +174,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1769500363,
-        "narHash": "sha256-vFxmdsLBPdTy5j2bf54gbTQi1XnWbZDmeR/BBh8MFrw=",
+        "lastModified": 1768749374,
+        "narHash": "sha256-dhXYLc64d7TKCnRPW4TlHGl6nLRNdabJB2DpJ8ffUw0=",
        "ref": "main",
-        "rev": "2618e434e40e109eaab6a0693313c7e0de7324a3",
-        "revCount": 47,
+        "rev": "040294f2e1df46e33d995add6944b25859654097",
+        "revCount": 37,
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Projects/minecraft-kartverket.git"
      },
@@ -210,11 +195,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1770960722,
-        "narHash": "sha256-IdhPsWFZUKSJh/nLjGLJvGM5d5Uta+k1FlVYPxTZi0E=",
+        "lastModified": 1767906352,
+        "narHash": "sha256-wYsH9MMAPFG3XTL+3DwI39XMG0F2fTmn/5lt265a3Es=",
        "ref": "main",
-        "rev": "c2e4aca7e1ba27cd09eeaeab47010d32a11841b2",
-        "revCount": 15,
+        "rev": "d054c5d064b8ed6d53a0adb0cf6c0a72febe212e",
+        "revCount": 13,
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Drift/nix-gitea-themes.git"
      },
@@ -232,11 +217,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1774824790,
-        "narHash": "sha256-3R2aoykbutdJ7YQaZiU7uO8w4O8b6RjztTPNo8isLTI=",
+        "lastModified": 1768955766,
+        "narHash": "sha256-V9ns1OII7sWSbIDwPkiqmJ3Xu/bHgQzj+asgH9cTpOo=",
        "owner": "oddlama",
        "repo": "nix-topology",
-        "rev": "5765ce41be8a4fb5471a57671c2b740a350c5da0",
+        "rev": "71f27de56a03f6d8a1a72cf4d0dfd780bcc075bc",
        "type": "github"
      },
      "original": {
@@ -248,11 +233,11 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1775064210,
-        "narHash": "sha256-bEqbUNAnoyNZzd8rrhS8QETdDWr+vYzZeaggBLmFLIA=",
-        "rev": "9d1c3efdc713c1ed9679796c08a1a8a193e4704e",
+        "lastModified": 1768877948,
+        "narHash": "sha256-Bq9Hd6DWCBaZ2GkwvJCWGnpGOchaD6RWPSCFxmSmupw=",
+        "rev": "43b2e61c9d09cf6c1c9c192fe6da08accc9bfb1d",
        "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/25.11-small/nixos-25.11.8497.9d1c3efdc713/nixexprs.tar.xz"
+        "url": "https://releases.nixos.org/nixos/25.11-small/nixos-25.11.4368.43b2e61c9d09/nixexprs.tar.xz"
      },
      "original": {
        "type": "tarball",
@@ -261,11 +246,11 @@
    },
    "nixpkgs-lib": {
      "locked": {
-        "lastModified": 1772328832,
-        "narHash": "sha256-e+/T/pmEkLP6BHhYjx6GmwP5ivonQQn0bJdH9YrRB+Q=",
+        "lastModified": 1765674936,
+        "narHash": "sha256-k00uTP4JNfmejrCLJOwdObYC9jHRrr/5M/a/8L2EIdo=",
        "owner": "nix-community",
        "repo": "nixpkgs.lib",
-        "rev": "c185c7a5e5dd8f9add5b2f8ebeff00888b070742",
+        "rev": "2075416fcb47225d9b68ac469a5c4801a9c4dd85",
        "type": "github"
      },
      "original": {
@@ -276,11 +261,11 @@
    },
    "nixpkgs-unstable": {
      "locked": {
-        "lastModified": 1775064351,
-        "narHash": "sha256-KHkwW/A1+H23YBMQGDmPb8cw5LwZFnszVKg5eZ4JWhg=",
-        "rev": "1e6f1bb5bb05d14aea16063ab587c599a68241c2",
+        "lastModified": 1768886240,
+        "narHash": "sha256-HUAAI7AF+/Ov1u3Vvjs4DL91zTxMkWLC4xJgQ9QxOUQ=",
+        "rev": "80e4adbcf8992d3fd27ad4964fbb84907f9478b0",
        "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/unstable-small/nixos-26.05pre973082.1e6f1bb5bb05/nixexprs.tar.xz"
+        "url": "https://releases.nixos.org/nixos/unstable-small/nixos-26.05pre930839.80e4adbcf899/nixexprs.tar.xz"
      },
      "original": {
        "type": "tarball",
@@ -315,11 +300,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1769009806,
-        "narHash": "sha256-52xTtAOc9B+MBRMRZ8HI6ybNsRLMlHHLh+qwAbaJjRY=",
+        "lastModified": 1768636400,
+        "narHash": "sha256-AiSKT4/25LS1rUlPduBMogf4EbdMQYDY1rS7AvHFcxk=",
        "ref": "main",
-        "rev": "aa8adfc6a4d5b6222752e2d15d4a6d3b3b85252e",
-        "revCount": 575,
+        "rev": "3a8f82b12a44e6c4ceacd6955a290a52d1ee2856",
+        "revCount": 573,
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Projects/nettsiden.git"
      },
@@ -373,18 +358,17 @@
    },
    "roowho2": {
      "inputs": {
-        "crane": "crane",
        "nixpkgs": [
          "nixpkgs"
        ],
        "rust-overlay": "rust-overlay_3"
      },
      "locked": {
-        "lastModified": 1770912859,
-        "narHash": "sha256-wtf7YgthGVDY7dhWe8cO42+CD7Y2Pkngvzirwjwvfzg=",
+        "lastModified": 1768140181,
+        "narHash": "sha256-HfZzup5/jlu8X5vMUglTovVTSwhHGHwwV1YOFIL/ksA=",
        "ref": "main",
-        "rev": "9361dcf941fabb14e94f472754b0e0a26cc56e13",
-        "revCount": 59,
+        "rev": "834463ed64773939798589ee6fd4adfe3a97dddd",
+        "revCount": 43,
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Projects/roowho2.git"
      },
@@ -402,11 +386,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1770606655,
-        "narHash": "sha256-rpJf+kxvLWv32ivcgu8d+JeJooog3boJCT8J3joJvvM=",
+        "lastModified": 1767840362,
+        "narHash": "sha256-ZtsFqUhilubohNZ1TgpQIFsi4biZTwRH9rjZsDRDik8=",
        "owner": "oxalica",
        "repo": "rust-overlay",
-        "rev": "11a396520bf911e4ed01e78e11633d3fc63b350e",
+        "rev": "d159ea1fc321c60f88a616ac28bab660092a227d",
        "type": "github"
      },
      "original": {
@@ -444,11 +428,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1769309768,
-        "narHash": "sha256-AbOIlNO+JoqRJkK1VrnDXhxuX6CrdtIu2hSuy4pxi3g=",
+        "lastModified": 1767322002,
+        "narHash": "sha256-yHKXXw2OWfIFsyTjduB4EyFwR0SYYF0hK8xI9z4NIn0=",
        "owner": "oxalica",
        "repo": "rust-overlay",
-        "rev": "140c9dc582cb73ada2d63a2180524fcaa744fad5",
+        "rev": "03c6e38661c02a27ca006a284813afdc461e9f7e",
        "type": "github"
      },
      "original": {
@@ -464,11 +448,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1774910634,
-        "narHash": "sha256-B+rZDPyktGEjOMt8PcHKYmgmKoF+GaNAFJhguktXAo0=",
+        "lastModified": 1768863606,
+        "narHash": "sha256-1IHAeS8WtBiEo5XiyJBHOXMzECD6aaIOJmpQKzRRl64=",
        "owner": "Mic92",
        "repo": "sops-nix",
-        "rev": "19bf3d8678fbbfbc173beaa0b5b37d37938db301",
+        "rev": "c7067be8db2c09ab1884de67ef6c4f693973f4a2",
        "type": "github"
      },
      "original": {
--- a/flake.nix
+++ b/flake.nix
@@ -94,6 +94,7 @@
        }:
        let
          commonPkgsConfig = {
+            inherit localSystem crossSystem;
            config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg)
              [
                "nvidia-x11"
@@ -103,11 +104,8 @@
              # Global overlays go here
              inputs.roowho2.overlays.default
            ]) ++ overlays;
-          } // (if localSystem != crossSystem then {
-            inherit localSystem crossSystem;
-          } else {
-            system = crossSystem;
-          });
+          };
+
          pkgs = import nixpkgs commonPkgsConfig;
          unstablePkgs = import nixpkgs-unstable commonPkgsConfig;
        in
@@ -186,13 +184,6 @@
      };
      ildkule = stableNixosConfig "ildkule" { };
      #ildkule-unstable = unstableNixosConfig "ildkule" { };
-      skrot = stableNixosConfig "skrot" {
-        modules = [
-          inputs.disko.nixosModules.disko
-          inputs.dibbler.nixosModules.default
-        ];
-        overlays = [inputs.dibbler.overlays.default];
-      };
      shark = stableNixosConfig "shark" { };
      wenche = stableNixosConfig "wenche" { };
      temmie = stableNixosConfig "temmie" { };
@@ -290,16 +281,7 @@
    };

    devShells = forAllSystems (system: {
-      default = let
-        pkgs = import nixpkgs-unstable {
-          inherit system;
-          overlays = [
-            (final: prev: {
-              inherit (inputs.disko.packages.${system}) disko;
-            })
-          ];
-        };
-      in pkgs.callPackage ./shell.nix { };
+      default = nixpkgs-unstable.legacyPackages.${system}.callPackage ./shell.nix { };
      cuda = let
        cuda-pkgs = import nixpkgs-unstable {
          inherit system;
--- a/hosts/bekkalokk/services/mediawiki/default.nix
+++ b/hosts/bekkalokk/services/mediawiki/default.nix
@@ -52,17 +52,18 @@ in {
  services.rsync-pull-targets = {
    enable = true;
    locations.${cfg.uploadsDir} = {
-      user = "root";
+      user = config.services.root;
      rrsyncArgs.ro = true;
      authorizedKeysAttrs = [
        "restrict"
-        "from=\"principal.pvv.ntnu.no,${values.hosts.principal.ipv6},${values.hosts.principal.ipv4}\""
        "no-agent-forwarding"
        "no-port-forwarding"
        "no-pty"
        "no-X11-forwarding"
      ];
-      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICHFHa3Iq1oKPhbKCAIHgOoWOTkLmIc7yqxeTbut7ig/ mediawiki rsync backup";
+      # TODO: create new key on principal
+      enable = false;
+      publicKey = "";
    };
  };

@@ -162,24 +163,6 @@ in {
      $wgDBserver = "${toString cfg.database.host}";
      $wgAllowCopyUploads = true;

-      # Files
-      $wgFileExtensions = [
-        'bmp',
-        'gif',
-        'jpeg',
-        'jpg',
-        'mp3',
-        'odg',
-        'odp',
-        'ods',
-        'odt',
-        'pdf',
-        'png',
-        'tiff',
-        'webm',
-        'webp',
-      ];
-
      # Misc program paths
      $wgFFmpegLocation = '${pkgs.ffmpeg}/bin/ffmpeg';
      $wgExiftool = '${pkgs.exiftool}/bin/exiftool';
@@ -275,7 +258,6 @@ in {
    serviceConfig = {
      BindReadOnlyPaths = [ "/run/credentials/mediawiki-init.service/secret-key:/var/lib/mediawiki/secret.key" ];
      LoadCredential = [ "secret-key:${config.sops.secrets."mediawiki/secret-key".path}" ];
-      UMask = lib.mkForce "0007";
    };
  };

@@ -284,7 +266,6 @@ in {
    serviceConfig = {
      BindReadOnlyPaths = [ "/run/credentials/phpfpm-mediawiki.service/secret-key:/var/lib/mediawiki/secret.key" ];
      LoadCredential = [ "secret-key:${config.sops.secrets."mediawiki/secret-key".path}" ];
-      UMask = lib.mkForce "0007";
    };
  };
 }
--- a/hosts/bekkalokk/services/vaultwarden.nix
+++ b/hosts/bekkalokk/services/vaultwarden.nix
@@ -1,4 +1,4 @@
-{ config, pkgs, lib, values, ... }:
+{ config, pkgs, lib, ... }:
 let
  cfg = config.services.vaultwarden;
  domain = "pw.pvv.ntnu.no";
@@ -99,21 +99,4 @@ in {
      ];
    };
  };
-
-  services.rsync-pull-targets = {
-    enable = true;
-    locations."/var/lib/vaultwarden" = {
-      user = "root";
-      rrsyncArgs.ro = true;
-      authorizedKeysAttrs = [
-        "restrict"
-        "from=\"principal.pvv.ntnu.no,${values.hosts.principal.ipv6},${values.hosts.principal.ipv4}\""
-        "no-agent-forwarding"
-        "no-port-forwarding"
-        "no-pty"
-        "no-X11-forwarding"
-      ];
-      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB2cDaW52gBtLVaNqoGijvN2ZAVkAWlII5AXUzT3Dswj vaultwarden rsync backup";
-    };
-  };
 }
--- a/hosts/bekkalokk/services/webmail/snappymail.nix
+++ b/hosts/bekkalokk/services/webmail/snappymail.nix
@@ -1,4 +1,4 @@
-{ config, lib, fp, pkgs, values, ... }:
+{ config, lib, fp, pkgs, ... }:
 let
  cfg = config.services.snappymail;
 in {
@@ -14,21 +14,5 @@ in {
    enableACME = true;
    kTLS = true;
  };
-
-  services.rsync-pull-targets = {
-    enable = true;
-    locations.${cfg.dataDir} = {
-      user = "root";
-      rrsyncArgs.ro = true;
-      authorizedKeysAttrs = [
-        "restrict"
-        "from=\"principal.pvv.ntnu.no,${values.hosts.principal.ipv6},${values.hosts.principal.ipv4}\""
-        "no-agent-forwarding"
-        "no-port-forwarding"
-        "no-pty"
-        "no-X11-forwarding"
-      ];
-      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJENMnuNsHEeA91oX+cj7Qpex2defSXP/lxznxCAqV03 snappymail rsync backup";
-    };
-  };
 }
+
--- a/hosts/bekkalokk/services/website/fetch-gallery.nix
+++ b/hosts/bekkalokk/services/website/fetch-gallery.nix
@@ -1,14 +1,8 @@
-{ pkgs, lib, config, values, ... }:
+{ pkgs, lib, config, ... }:
 let
  galleryDir = config.services.pvv-nettsiden.settings.GALLERY.DIR;
  transferDir = "${config.services.pvv-nettsiden.settings.GALLERY.DIR}-transfer";
 in {
-  users.users.${config.services.pvv-nettsiden.user} = {
-    # NOTE: the user unfortunately needs a registered shell for rrsync to function...
-    #       is there anything we can do to remove this?
-    useDefaultShell = true;
-  };
-
  # This is pushed from microbel:/var/www/www-gallery/build-gallery.sh
  services.rsync-pull-targets = {
    enable = true;
@@ -17,7 +11,6 @@ in {
      rrsyncArgs.wo = true;
      authorizedKeysAttrs = [
        "restrict"
-        "from=\"microbel.pvv.ntnu.no,${values.hosts.microbel.ipv6},${values.hosts.microbel.ipv4}\""
        "no-agent-forwarding"
        "no-port-forwarding"
        "no-pty"
--- a/hosts/bicep/configuration.nix
+++ b/hosts/bicep/configuration.nix
@@ -9,8 +9,8 @@
    ./services/calendar-bot.nix
    #./services/git-mirrors
    ./services/minecraft-heatmap.nix
-    ./services/mysql
-    ./services/postgresql
+    ./services/mysql.nix
+    ./services/postgres.nix

    ./services/matrix
  ];
--- a/hosts/bicep/services/matrix/default.nix
+++ b/hosts/bicep/services/matrix/default.nix
@@ -1,9 +1,8 @@
 { config, ... }:
 {
  imports = [
-    ./synapse-admin.nix
-    ./synapse-auto-compressor.nix
    ./synapse.nix
+    ./synapse-admin.nix
    ./element.nix
    ./coturn.nix
    ./livekit.nix
--- a/hosts/bicep/services/matrix/livekit.nix
+++ b/hosts/bicep/services/matrix/livekit.nix
@@ -43,7 +43,7 @@ in
    keyFile = config.sops.templates."matrix-livekit-keyfile".path;
  };

-  systemd.services.lk-jwt-service.environment.LIVEKIT_FULL_ACCESS_HOMESERVERS = lib.mkIf cfg.enable (builtins.concatStringsSep "," [ "pvv.ntnu.no" "dodsorf.as" ]);
+  systemd.services.lk-jwt-service.environment.LIVEKIT_FULL_ACCESS_HOMESERVERS = lib.mkIf cfg.enable matrixDomain;

  services.nginx.virtualHosts.${matrixDomain} = lib.mkIf cfg.enable {
    locations."^~ /livekit/jwt/" = {
--- a/hosts/bicep/services/matrix/out-of-your-element.nix
+++ b/hosts/bicep/services/matrix/out-of-your-element.nix
@@ -1,4 +1,4 @@
-{ config, pkgs, lib, values, fp, ... }:
+{ config, pkgs, fp, ... }:
 let
  cfg = config.services.matrix-ooye;
 in
@@ -28,23 +28,6 @@ in
    };
  };

-  services.rsync-pull-targets = lib.mkIf cfg.enable {
-    enable = true;
-    locations."/var/lib/private/matrix-ooye" = {
-      user = "root";
-      rrsyncArgs.ro = true;
-      authorizedKeysAttrs = [
-        "restrict"
-        "from=\"principal.pvv.ntnu.no,${values.hosts.principal.ipv6},${values.hosts.principal.ipv4}\""
-        "no-agent-forwarding"
-        "no-port-forwarding"
-        "no-pty"
-        "no-X11-forwarding"
-      ];
-      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE5koYfor5+kKB30Dugj3dAWvmj8h/akQQ2XYDvLobFL matrix_ooye rsync backup";
-    };
-  };
-
  services.matrix-ooye = {
    enable = true;
    homeserver = "https://matrix.pvv.ntnu.no";
--- a/hosts/bicep/services/matrix/synapse-auto-compressor.nix
+++ b/hosts/bicep/services/matrix/synapse-auto-compressor.nix
@@ -1,56 +0,0 @@
-{ config, lib, utils, ... }:
-let
-  cfg = config.services.synapse-auto-compressor;
-in
-{
-  services.synapse-auto-compressor = {
-    # enable = true;
-    postgresUrl = "postgresql://matrix-synapse@/synapse?host=/run/postgresql";
-  };
-
-  # NOTE: nixpkgs has some broken asserts, vendored the entire unit
-  systemd.services.synapse-auto-compressor = {
-    description = "synapse-auto-compressor";
-    requires = [
-      "postgresql.target"
-    ];
-    inherit (cfg) startAt;
-    serviceConfig = {
-      Type = "oneshot";
-      DynamicUser = true;
-      User = "matrix-synapse";
-      PrivateTmp = true;
-      ExecStart = utils.escapeSystemdExecArgs [
-        "${cfg.package}/bin/synapse_auto_compressor"
-        "-p"
-        cfg.postgresUrl
-        "-c"
-        cfg.settings.chunk_size
-        "-n"
-        cfg.settings.chunks_to_compress
-        "-l"
-        (lib.concatStringsSep "," (map toString cfg.settings.levels))
-      ];
-      LockPersonality = true;
-      MemoryDenyWriteExecute = true;
-      NoNewPrivileges = true;
-      PrivateDevices = true;
-      PrivateMounts = true;
-      PrivateUsers = true;
-      RemoveIPC = true;
-      RestrictNamespaces = true;
-      RestrictRealtime = true;
-      RestrictSUIDSGID = true;
-      ProcSubset = "pid";
-      ProtectProc = "invisible";
-      ProtectSystem = "strict";
-      ProtectHome = true;
-      ProtectHostname = true;
-      ProtectClock = true;
-      ProtectKernelTunables = true;
-      ProtectKernelModules = true;
-      ProtectKernelLogs = true;
-      ProtectControlGroups = true;
-    };
-  };
-}
--- a/hosts/bicep/services/matrix/synapse.nix
+++ b/hosts/bicep/services/matrix/synapse.nix
@@ -30,17 +30,18 @@ in {
  services.rsync-pull-targets = {
    enable = true;
    locations.${cfg.settings.media_store_path} = {
-      user = "root";
+      user = config.services.root;
      rrsyncArgs.ro = true;
      authorizedKeysAttrs = [
        "restrict"
-        "from=\"principal.pvv.ntnu.no,${values.hosts.principal.ipv6},${values.hosts.principal.ipv4}\""
        "no-agent-forwarding"
        "no-port-forwarding"
        "no-pty"
        "no-X11-forwarding"
      ];
-      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIASnjI9b3j4ZS3BL/D1ggHfws1BkE8iS0v0cGpEmbG+k matrix_media_store rsync backup";
+      # TODO: create new key on principal
+      enable = false;
+      publicKey = "";
    };
  };

--- a/hosts/bicep/services/minecraft-heatmap.nix
+++ b/hosts/bicep/services/minecraft-heatmap.nix
@@ -22,7 +22,7 @@ in
    };
  };

-  systemd.services.minecraft-heatmap-ingest-logs = lib.mkIf cfg.enable {
+  systemd.services.minecraft-heatmap-ingest-logs = {
    serviceConfig.LoadCredential = [
      "sshkey:${config.sops.secrets."minecraft-heatmap/ssh-key/private".path}"
    ];
--- a/hosts/bicep/services/mysql/default.nix
+++ b/hosts/bicep/services/mysql/default.nix
@@ -4,8 +4,6 @@ let
  dataDir = "/data/mysql";
 in
 {
-  imports = [ ./backup.nix ];
-
  sops.secrets."mysql/password" = {
    owner = "mysql";
    group = "mysql";
@@ -15,7 +13,7 @@ in

  services.mysql = {
    enable = true;
-    package = pkgs.mariadb_118;
+    package = pkgs.mariadb;
    settings = {
      mysqld = {
        # PVV allows a lot of connections at the same time
@@ -26,9 +24,6 @@ in
        # This was needed in order to be able to use all of the old users
        # during migration from knakelibrak to bicep in Sep. 2023
        secure_auth = 0;
-
-        slow-query-log = 1;
-        slow-query-log-file = "/var/log/mysql/mysql-slow.log";
      };
    };

@@ -44,6 +39,11 @@ in
    }];
  };

+  services.mysqlBackup = lib.mkIf cfg.enable {
+    enable = true;
+    location = "/var/lib/mysql/backups";
+  };
+
  networking.firewall.allowedTCPPorts = lib.mkIf cfg.enable [ 3306 ];

  systemd.tmpfiles.settings."10-mysql".${dataDir}.d = lib.mkIf cfg.enable {
@@ -60,8 +60,6 @@ in
    serviceConfig = {
      BindPaths = [ "${dataDir}:${cfg.dataDir}" ];

-      LogsDirectory = "mysql";
-
      IPAddressDeny = "any";
      IPAddressAllow = [
        values.ipv4-space
--- a/hosts/bicep/services/mysql/backup.nix
+++ b/hosts/bicep/services/mysql/backup.nix
@@ -1,83 +0,0 @@
-{ config, lib, pkgs, values, ... }:
-let
-  cfg = config.services.mysql;
-  backupDir = "/data/mysql-backups";
-in
-{
-  # services.mysqlBackup = lib.mkIf cfg.enable {
-  #   enable = true;
-  #   location = "/var/lib/mysql-backups";
-  # };
-
-  systemd.tmpfiles.settings."10-mysql-backups".${backupDir}.d = {
-	  user = "mysql";
-	  group = "mysql";
-	  mode = "700";
-	};
-
-  services.rsync-pull-targets = lib.mkIf cfg.enable {
-    enable = true;
-    locations.${backupDir} = {
-      user = "root";
-      rrsyncArgs.ro = true;
-      authorizedKeysAttrs = [
-        "restrict"
-        "from=\"principal.pvv.ntnu.no,${values.hosts.principal.ipv6},${values.hosts.principal.ipv4}\""
-        "no-agent-forwarding"
-        "no-port-forwarding"
-        "no-pty"
-        "no-X11-forwarding"
-      ];
-      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJgj55/7Cnj4cYMJ5sIkl+OwcGeBe039kXJTOf2wvo9j mysql rsync backup";
-    };
-  };
-
-  # NOTE: instead of having the upstream nixpkgs postgres backup unit trigger
-  #       another unit, it was easier to just make one ourselves.
-  systemd.services."backup-mysql" = lib.mkIf cfg.enable {
-    description = "Backup MySQL data";
-    requires = [ "mysql.service" ];
-
-    path = with pkgs; [
-      cfg.package
-      coreutils
-      zstd
-    ];
-
-    script = let
-      rotations = 2;
-    in ''
-      set -euo pipefail
-
-      OUT_FILE="$STATE_DIRECTORY/mysql-dump-$(date --iso-8601).sql.zst"
-
-      mysqldump --all-databases | zstd --compress -9 --rsyncable -o "$OUT_FILE"
-
-      # NOTE: this needs to be a hardlink for rrsync to allow sending it
-      rm "$STATE_DIRECTORY/mysql-dump-latest.sql.zst" ||:
-      ln -T "$OUT_FILE" "$STATE_DIRECTORY/mysql-dump-latest.sql.zst"
-
-      while [ "$(find "$STATE_DIRECTORY" -type f -printf '.' | wc -c)" -gt ${toString (rotations + 1)} ]; do
-        rm "$(find "$STATE_DIRECTORY" -type f -printf '%T+ %p\n' | sort | head -n 1 | cut -d' ' -f2)"
-      done
-    '';
-
-    serviceConfig = {
-      Type = "oneshot";
-      User = "mysql";
-      Group = "mysql";
-      UMask = "0077";
-
-      Nice = 19;
-      IOSchedulingClass = "best-effort";
-      IOSchedulingPriority = 7;
-
-      StateDirectory = [ "mysql-backups" ];
-      BindPaths = [ "${backupDir}:/var/lib/mysql-backups" ];
-
-      # TODO: hardening
-    };
-
-    startAt = "*-*-* 02:15:00";
-  };
-}
--- a/hosts/bicep/services/postgresql/default.nix
+++ b/hosts/bicep/services/postgresql/default.nix
@@ -1,13 +1,8 @@
-{ config, lib, pkgs, values, ... }:
-let
-  cfg = config.services.postgresql;
-in
+{ config, pkgs, values, ... }:
 {
-  imports = [ ./backup.nix ];
-
  services.postgresql = {
    enable = true;
-    package = pkgs.postgresql_18;
+    package = pkgs.postgresql_15;
    enableTCPIP = true;

    authentication = ''
@@ -79,13 +74,13 @@ in
    };
  };

-  systemd.tmpfiles.settings."10-postgresql"."/data/postgresql".d = lib.mkIf cfg.enable {
+  systemd.tmpfiles.settings."10-postgresql"."/data/postgresql".d = {
    user = config.systemd.services.postgresql.serviceConfig.User;
    group = config.systemd.services.postgresql.serviceConfig.Group;
    mode = "0700";
  };

-  systemd.services.postgresql-setup = lib.mkIf cfg.enable {
+  systemd.services.postgresql-setup = {
    after = [
      "systemd-tmpfiles-setup.service"
      "systemd-tmpfiles-resetup.service"
@@ -100,7 +95,7 @@ in
    };
  };

-  systemd.services.postgresql = lib.mkIf cfg.enable {
+  systemd.services.postgresql = {
    after = [
      "systemd-tmpfiles-setup.service"
      "systemd-tmpfiles-resetup.service"
@@ -115,12 +110,18 @@ in
    };
  };

-  environment.snakeoil-certs."/etc/certs/postgres" = lib.mkIf cfg.enable {
+  environment.snakeoil-certs."/etc/certs/postgres" = {
    owner = "postgres";
    group = "postgres";
    subject = "/C=NO/O=Programvareverkstedet/CN=postgres.pvv.ntnu.no/emailAddress=drift@pvv.ntnu.no";
  };

-  networking.firewall.allowedTCPPorts = lib.mkIf cfg.enable [ 5432 ];
-  networking.firewall.allowedUDPPorts = lib.mkIf cfg.enable [ 5432 ];
+  networking.firewall.allowedTCPPorts = [ 5432 ];
+  networking.firewall.allowedUDPPorts = [ 5432 ];
+
+  services.postgresqlBackup = {
+    enable = true;
+    location = "/var/lib/postgres/backups";
+    backupAll = true;
+  };
 }
--- a/hosts/bicep/services/postgresql/backup.nix
+++ b/hosts/bicep/services/postgresql/backup.nix
@@ -1,84 +0,0 @@
-{ config, lib, pkgs, values, ... }:
-let
-  cfg = config.services.postgresql;
-  backupDir = "/data/postgresql-backups";
-in
-{
-  # services.postgresqlBackup = lib.mkIf cfg.enable {
-  #   enable = true;
-  #   location = "/var/lib/postgresql-backups";
-  #   backupAll = true;
-  # };
-
-  systemd.tmpfiles.settings."10-postgresql-backups".${backupDir}.d = {
-	  user = "postgres";
-	  group = "postgres";
-	  mode = "700";
-	};
-
-  services.rsync-pull-targets = lib.mkIf cfg.enable {
-    enable = true;
-    locations.${backupDir} = {
-      user = "root";
-      rrsyncArgs.ro = true;
-      authorizedKeysAttrs = [
-        "restrict"
-        "from=\"principal.pvv.ntnu.no,${values.hosts.principal.ipv6},${values.hosts.principal.ipv4}\""
-        "no-agent-forwarding"
-        "no-port-forwarding"
-        "no-pty"
-        "no-X11-forwarding"
-      ];
-      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGvO7QX7QmwSiGLXEsaxPIOpAqnJP3M+qqQRe5dzf8gJ postgresql rsync backup";
-    };
-  };
-
-  # NOTE: instead of having the upstream nixpkgs postgres backup unit trigger
-  #       another unit, it was easier to just make one ourselves
-  systemd.services."backup-postgresql" = {
-    description = "Backup PostgreSQL data";
-    requires = [ "postgresql.service" ];
-
-    path = with pkgs; [
-      coreutils
-      zstd
-      cfg.package
-    ];
-
-    script = let
-      rotations = 2;
-    in ''
-      set -euo pipefail
-
-      OUT_FILE="$STATE_DIRECTORY/postgresql-dump-$(date --iso-8601).sql.zst"
-
-      pg_dumpall -U postgres | zstd --compress -9 --rsyncable -o "$OUT_FILE"
-
-      # NOTE: this needs to be a hardlink for rrsync to allow sending it
-      rm "$STATE_DIRECTORY/postgresql-dump-latest.sql.zst" ||:
-      ln -T "$OUT_FILE" "$STATE_DIRECTORY/postgresql-dump-latest.sql.zst"
-
-      while [ "$(find "$STATE_DIRECTORY" -type f -printf '.' | wc -c)" -gt ${toString (rotations + 1)} ]; do
-        rm "$(find "$STATE_DIRECTORY" -type f -printf '%T+ %p\n' | sort | head -n 1 | cut -d' ' -f2)"
-      done
-    '';
-
-    serviceConfig = {
-      Type = "oneshot";
-      User = "postgres";
-      Group = "postgres";
-      UMask = "0077";
-
-      Nice = 19;
-      IOSchedulingClass = "best-effort";
-      IOSchedulingPriority = 7;
-
-      StateDirectory = [ "postgresql-backups" ];
-      BindPaths = [ "${backupDir}:/var/lib/postgresql-backups" ];
-
-      # TODO: hardening
-    };
-
-    startAt = "*-*-* 01:15:00";
-  };
-}
--- a/hosts/gluttony/hardware-configuration.nix
+++ b/hosts/gluttony/hardware-configuration.nix
@@ -31,7 +31,7 @@
  };

  fileSystems."/boot" = {
-    device = "/dev/disk/by-uuid/933A-3005";
+    device = "/dev/disk/by-uuid/D00A-B488";
    fsType = "vfat";
    options = [
      "fmask=0077"
--- a/hosts/ildkule/services/monitoring/dashboards/go-processes.json
+++ b/hosts/ildkule/services/monitoring/dashboards/go-processes.json
--- a/hosts/ildkule/services/monitoring/dashboards/mysql.json
+++ b/hosts/ildkule/services/monitoring/dashboards/mysql.json
@@ -13,7 +13,7 @@
    ]
  },
  "description": "",
-  "editable": false,
+  "editable": true,
  "gnetId": 11323,
  "graphTooltip": 1,
  "id": 31,
@@ -1899,7 +1899,7 @@
      "dashes": false,
      "datasource": "$datasource",
      "decimals": 0,
-      "description": "***System Memory***: Total Memory for the system.\\\n***InnoDB Buffer Pool Data***: InnoDB maintains a storage area called the buffer pool for caching data and indexes in memory.\\\n***TokuDB Cache Size***: Similar in function to the InnoDB Buffer Pool,  TokuDB will allocate 50% of the installed RAM for its own cache.\\\n***Key Buffer Size***: Index blocks for MYISAM tables are buffered and are shared by all threads. key_buffer_size is the size of the buffer used for index blocks.\\\n***Adaptive Hash Index Size***: When InnoDB notices that some index values are being accessed very frequently, it builds a hash index for them in memory on top of B-Tree indexes.\\\n ***Query Cache Size***: The query cache stores the text of a SELECT statement together with the corresponding result that was sent to the client. The query cache has huge scalability problems in that only one thread can do an operation in the query cache at the same time.\\\n***InnoDB Dictionary Size***: The data dictionary is InnoDB ‘s internal catalog of tables. InnoDB stores the data dictionary on disk, and loads entries into memory while the server is running.\\\n***InnoDB Log Buffer Size***: The MySQL InnoDB log buffer allows transactions to run without having to write the log to disk before the transactions commit.",
+      "description": "***System Memory***: Total Memory for the system.\\\n***InnoDB Buffer Pool Data***: InnoDB maintains a storage area called the buffer pool for caching data and indexes in memory.\\\n***TokuDB Cache Size***: Similar in function to the InnoDB Buffer Pool,  TokuDB will allocate 50% of the installed RAM for its own cache.\\\n***Key Buffer Size***: Index blocks for MYISAM tables are buffered and are shared by all threads. key_buffer_size is the size of the buffer used for index blocks.\\\n***Adaptive Hash Index Size***: When InnoDB notices that some index values are being accessed very frequently, it builds a hash index for them in memory on top of B-Tree indexes.\\\n ***Query Cache Size***: The query cache stores the text of a SELECT statement together with the corresponding result that was sent to the client. The query cache has huge scalability problems in that only one thread can do an operation in the query cache at the same time.\\\n***InnoDB Dictionary Size***: The data dictionary is InnoDB 's internal catalog of tables. InnoDB stores the data dictionary on disk, and loads entries into memory while the server is running.\\\n***InnoDB Log Buffer Size***: The MySQL InnoDB log buffer allows transactions to run without having to write the log to disk before the transactions commit.",
      "editable": true,
      "error": false,
      "fieldConfig": {
@@ -3690,7 +3690,7 @@
        },
        "hide": 0,
        "includeAll": false,
-        "label": "Data source",
+        "label": "Data Source",
        "multi": false,
        "name": "datasource",
        "options": [],
@@ -3713,12 +3713,12 @@
        "definition": "label_values(mysql_up, job)",
        "hide": 0,
        "includeAll": true,
-        "label": "Job",
+        "label": "job",
        "multi": true,
        "name": "job",
        "options": [],
        "query": "label_values(mysql_up, job)",
-        "refresh": 2,
+        "refresh": 1,
        "regex": "",
        "skipUrlSync": false,
        "sort": 0,
@@ -3742,12 +3742,12 @@
        "definition": "label_values(mysql_up, instance)",
        "hide": 0,
        "includeAll": true,
-        "label": "Instance",
+        "label": "instance",
        "multi": true,
        "name": "instance",
        "options": [],
        "query": "label_values(mysql_up, instance)",
-        "refresh": 2,
+        "refresh": 1,
        "regex": "",
        "skipUrlSync": false,
        "sort": 0,
--- a/hosts/ildkule/services/monitoring/dashboards/node-exporter-full.json
+++ b/hosts/ildkule/services/monitoring/dashboards/node-exporter-full.json
--- a/hosts/ildkule/services/monitoring/dashboards/postgres.json
+++ b/hosts/ildkule/services/monitoring/dashboards/postgres.json
@@ -328,7 +328,7 @@
        "rgba(50, 172, 45, 0.97)"
      ],
      "datasource": "${DS_PROMETHEUS}",
-      "format": "short",
+      "format": "decbytes",
      "gauge": {
        "maxValue": 100,
        "minValue": 0,
@@ -411,7 +411,7 @@
        "rgba(50, 172, 45, 0.97)"
      ],
      "datasource": "${DS_PROMETHEUS}",
-      "format": "short",
+      "format": "decbytes",
      "gauge": {
        "maxValue": 100,
        "minValue": 0,
@@ -1410,7 +1410,7 @@
      "tableColumn": "",
      "targets": [
        {
-          "expr": "pg_settings_seq_page_cost{instance=\"$instance\"}",
+          "expr": "pg_settings_seq_page_cost",
          "format": "time_series",
          "intervalFactor": 1,
          "refId": "A"
@@ -1872,7 +1872,7 @@
      },
      "yaxes": [
        {
-          "format": "short",
+          "format": "bytes",
          "label": null,
          "logBase": 1,
          "max": null,
@@ -1966,7 +1966,7 @@
      },
      "yaxes": [
        {
-          "format": "short",
+          "format": "bytes",
          "label": null,
          "logBase": 1,
          "max": null,
@@ -2060,7 +2060,7 @@
      },
      "yaxes": [
        {
-          "format": "short",
+          "format": "bytes",
          "label": null,
          "logBase": 1,
          "max": null,
@@ -2251,7 +2251,7 @@
      },
      "yaxes": [
        {
-          "format": "short",
+          "format": "bytes",
          "label": null,
          "logBase": 1,
          "max": null,
@@ -2439,7 +2439,7 @@
      },
      "yaxes": [
        {
-          "format": "short",
+          "format": "bytes",
          "label": null,
          "logBase": 1,
          "max": null,
@@ -2589,35 +2589,35 @@
      "steppedLine": false,
      "targets": [
        {
-          "expr": "irate(pg_stat_bgwriter_buffers_backend_total{instance=\"$instance\"}[5m])",
+          "expr": "irate(pg_stat_bgwriter_buffers_backend{instance=\"$instance\"}[5m])",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "buffers_backend",
          "refId": "A"
        },
        {
-          "expr": "irate(pg_stat_bgwriter_buffers_alloc_total{instance=\"$instance\"}[5m])",
+          "expr": "irate(pg_stat_bgwriter_buffers_alloc{instance=\"$instance\"}[5m])",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "buffers_alloc",
          "refId": "B"
        },
        {
-          "expr": "irate(pg_stat_bgwriter_buffers_backend_fsync_total{instance=\"$instance\"}[5m])",
+          "expr": "irate(pg_stat_bgwriter_buffers_backend_fsync{instance=\"$instance\"}[5m])",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "backend_fsync",
          "refId": "C"
        },
        {
-          "expr": "irate(pg_stat_bgwriter_buffers_checkpoint_total{instance=\"$instance\"}[5m])",
+          "expr": "irate(pg_stat_bgwriter_buffers_checkpoint{instance=\"$instance\"}[5m])",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "buffers_checkpoint",
          "refId": "D"
        },
        {
-          "expr": "irate(pg_stat_bgwriter_buffers_clean_total{instance=\"$instance\"}[5m])",
+          "expr": "irate(pg_stat_bgwriter_buffers_clean{instance=\"$instance\"}[5m])",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "buffers_clean",
@@ -2886,14 +2886,14 @@
      "steppedLine": false,
      "targets": [
        {
-          "expr": "irate(pg_stat_bgwriter_checkpoint_write_time_total{instance=\"$instance\"}[5m])",
+          "expr": "irate(pg_stat_bgwriter_checkpoint_write_time{instance=\"$instance\"}[5m])",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "write_time - Total amount of time that has been spent in the portion of checkpoint processing where files are written to disk.",
          "refId": "B"
        },
        {
-          "expr": "irate(pg_stat_bgwriter_checkpoint_sync_time_total{instance=\"$instance\"}[5m])",
+          "expr": "irate(pg_stat_bgwriter_checkpoint_sync_time{instance=\"$instance\"}[5m])",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "sync_time - Total amount of time that has been spent in the portion of checkpoint processing where files are synchronized to disk.",
@@ -3164,4 +3164,4 @@
  "title": "PostgreSQL Database",
  "uid": "000000039",
  "version": 1
-}
+}
--- a/hosts/ildkule/services/monitoring/dashboards/synapse.json
+++ b/hosts/ildkule/services/monitoring/dashboards/synapse.json
--- a/hosts/ildkule/services/monitoring/grafana.nix
+++ b/hosts/ildkule/services/monitoring/grafana.nix
@@ -47,13 +47,13 @@ in {
        {
          name = "Node Exporter Full";
          type = "file";
-          url = "https://grafana.com/api/dashboards/1860/revisions/42/download";
+          url = "https://grafana.com/api/dashboards/1860/revisions/29/download";
          options.path = dashboards/node-exporter-full.json;
        }
        {
          name = "Matrix Synapse";
          type = "file";
-          url = "https://github.com/element-hq/synapse/raw/refs/heads/develop/contrib/grafana/synapse.json";
+          url = "https://raw.githubusercontent.com/matrix-org/synapse/develop/contrib/grafana/synapse.json";
          options.path = dashboards/synapse.json;
        }
        {
@@ -65,9 +65,15 @@ in {
        {
          name = "Postgresql";
          type = "file";
-          url = "https://grafana.com/api/dashboards/9628/revisions/8/download";
+          url = "https://grafana.com/api/dashboards/9628/revisions/7/download";
          options.path = dashboards/postgres.json;
        }
+        {
+          name = "Go Processes (gogs)";
+          type = "file";
+          url = "https://grafana.com/api/dashboards/240/revisions/3/download";
+          options.path = dashboards/go-processes.json;
+        }
        {
          name = "Gitea Dashboard";
          type = "file";
--- a/hosts/kommode/disks.nix
+++ b/hosts/kommode/disks.nix
@@ -21,11 +21,11 @@
                #     name = lib.replaceString "/" "-" subvolPath;
                #   in {
                #     "@${name}/active" = {
-                #       mountpoint = subvolPath;
+                #       mountPoint = subvolPath;
                #       inherit mountOptions;
                #     };
                #     "@${name}/snapshots" = {
-                #       mountpoint = "${subvolPath}/.snapshots";
+                #       mountPoint = "${subvolPath}/.snapshots";
                #       inherit mountOptions;
                #     };
                #   };
--- a/hosts/kommode/services/gitea/customization/default.nix
+++ b/hosts/kommode/services/gitea/customization/default.nix
@@ -10,59 +10,6 @@ in
    catppuccin = pkgs.gitea-theme-catppuccin;
  };

-  services.gitea.settings = {
-    ui = {
-      DEFAULT_THEME = "gitea-auto";
-      REACTIONS = lib.concatStringsSep "," [
-        "+1"
-        "-1"
-        "laugh"
-        "confused"
-        "heart"
-        "hooray"
-        "rocket"
-        "eyes"
-        "100"
-        "anger"
-        "astonished"
-        "no_good"
-        "ok_hand"
-        "pensive"
-        "pizza"
-        "point_up"
-        "sob"
-        "skull"
-        "upside_down_face"
-        "shrug"
-        "huh"
-        "bruh"
-        "okiedokie"
-        "grr"
-      ];
-
-      CUSTOM_EMOJIS = lib.concatStringsSep "," [
-        "bruh"
-        "grr"
-        "huh"
-        "ohyeah"
-      ];
-    };
-    "ui.meta" = {
-      AUTHOR = "Programvareverkstedet";
-      DESCRIPTION = "Bokstavelig talt programvareverkstedet";
-      KEYWORDS = lib.concatStringsSep "," [
-        "git"
-        "hackerspace"
-        "nix"
-        "open source"
-        "foss"
-        "organization"
-        "software"
-        "student"
-      ];
-    };
-  };
-
  systemd.services.gitea-customization = lib.mkIf cfg.enable {
    description = "Install extra customization in gitea's CUSTOM_DIR";
    wantedBy = [ "gitea.service" ];
@@ -110,11 +57,6 @@ in
      install -Dm444 ${extraLinksFooter} ${cfg.customDir}/templates/custom/extra_links_footer.tmpl
      install -Dm444 ${project-labels} ${cfg.customDir}/options/label/project-labels.yaml

-      install -Dm644 ${./emotes/bruh.png} ${cfg.customDir}/public/assets/img/emoji/bruh.png
-      install -Dm644 ${./emotes/huh.gif} ${cfg.customDir}/public/assets/img/emoji/huh.png
-      install -Dm644 ${./emotes/grr.png} ${cfg.customDir}/public/assets/img/emoji/grr.png
-      install -Dm644 ${./emotes/okiedokie.jpg} ${cfg.customDir}/public/assets/img/emoji/okiedokie.png
-
      "${lib.getExe pkgs.rsync}" -a "${customTemplates}/" ${cfg.customDir}/templates/
    '';
  };
--- a/hosts/kommode/services/gitea/customization/emotes/bruh.png
+++ b/hosts/kommode/services/gitea/customization/emotes/bruh.png
--- a/hosts/kommode/services/gitea/customization/emotes/grr.png
+++ b/hosts/kommode/services/gitea/customization/emotes/grr.png
--- a/hosts/kommode/services/gitea/customization/emotes/huh.gif
+++ b/hosts/kommode/services/gitea/customization/emotes/huh.gif
--- a/hosts/kommode/services/gitea/customization/emotes/okiedokie.jpg
+++ b/hosts/kommode/services/gitea/customization/emotes/okiedokie.jpg
--- a/hosts/kommode/services/gitea/default.nix
+++ b/hosts/kommode/services/gitea/default.nix
@@ -83,24 +83,11 @@ in {
        AUTO_WATCH_NEW_REPOS = false;
      };
      admin.DEFAULT_EMAIL_NOTIFICATIONS = "onmention";
+      session.COOKIE_SECURE = true;
      security = {
        SECRET_KEY = lib.mkForce "";
        SECRET_KEY_URI = "file:${config.sops.secrets."gitea/secret-key".path}";
      };
-      cache = {
-        ADAPTER = "redis";
-        HOST = "redis+socket://${config.services.redis.servers.gitea.unixSocket}?db=0";
-        ITEM_TTL = "72h";
-      };
-      session = {
-        COOKIE_SECURE = true;
-        PROVIDER = "redis";
-        PROVIDER_CONFIG = "redis+socket://${config.services.redis.servers.gitea.unixSocket}?db=1";
-      };
-      queue = {
-        TYPE = "redis";
-        CONN_STR = "redis+socket://${config.services.redis.servers.gitea.unixSocket}?db=2";
-      };
      database.LOG_SQL = false;
      repository = {
        PREFERRED_LICENSES = lib.concatStringsSep "," [
@@ -131,7 +118,6 @@ in {
          "repo.pulls"
          "repo.releases"
        ];
-        ALLOW_FORK_INTO_SAME_OWNER = true;
      };
      picture = {
        DISABLE_GRAVATAR = true;
@@ -142,6 +128,31 @@ in {
        AVATAR_MAX_ORIGIN_SIZE = 1024 * 1024 * 2;
      };
      actions.ENABLED = true;
+      ui = {
+        REACTIONS = lib.concatStringsSep "," [
+          "+1"
+          "-1"
+          "laugh"
+          "confused"
+          "heart"
+          "hooray"
+          "rocket"
+          "eyes"
+          "100"
+          "anger"
+          "astonished"
+          "no_good"
+          "ok_hand"
+          "pensive"
+          "pizza"
+          "point_up"
+          "sob"
+          "skull"
+          "upside_down_face"
+          "shrug"
+        ];
+      };
+      "ui.meta".DESCRIPTION = "Bokstavelig talt programvareverkstedet";
    };

    dump = {
@@ -153,26 +164,12 @@ in {

  environment.systemPackages = [ cfg.package ];

-  systemd.services.gitea = lib.mkIf cfg.enable {
-    wants = [ "redis-gitea.service" ];
-    after = [ "redis-gitea.service" ];
+  systemd.services.gitea.serviceConfig.CPUSchedulingPolicy = "batch";

-    serviceConfig = {
-      CPUSchedulingPolicy = "batch";
-      CacheDirectory = "gitea/repo-archive";
-      BindPaths = [
-        "%C/gitea/repo-archive:${cfg.stateDir}/data/repo-archive"
-      ];
-    };
-  };
-
-  services.redis.servers.gitea = lib.mkIf cfg.enable {
-    enable = true;
-    user = config.services.gitea.user;
-    save = [ ];
-    openFirewall = false;
-    port = 5698;
-  };
+  systemd.services.gitea.serviceConfig.CacheDirectory = "gitea/repo-archive";
+  systemd.services.gitea.serviceConfig.BindPaths = [
+    "%C/gitea/repo-archive:${cfg.stateDir}/data/repo-archive"
+  ];

  services.nginx.virtualHosts."${domain}" = {
    forceSSL = true;
@@ -198,23 +195,6 @@ in {

  networking.firewall.allowedTCPPorts = [ sshPort ];

-  services.rsync-pull-targets = {
-    enable = true;
-    locations.${cfg.dump.backupDir} = {
-      user = "root";
-      rrsyncArgs.ro = true;
-      authorizedKeysAttrs = [
-        "restrict"
-        "from=\"principal.pvv.ntnu.no,${values.hosts.principal.ipv6},${values.hosts.principal.ipv4}\""
-        "no-agent-forwarding"
-        "no-port-forwarding"
-        "no-pty"
-        "no-X11-forwarding"
-      ];
-      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGpMVrOppyqYaDiAhqmAuOaRsubFvcQGBGyz+NHB6+0o gitea rsync backup";
-    };
-  };
-
  systemd.services.gitea-dump = {
    serviceConfig.ExecStart = let
      args = lib.cli.toGNUCommandLineShell { } {
--- a/hosts/kommode/services/gitea/web-secret-provider/default.nix
+++ b/hosts/kommode/services/gitea/web-secret-provider/default.nix
@@ -28,7 +28,7 @@ in
  users.users."gitea-web" = {
    group = "gitea-web";
    isSystemUser = true;
-    useDefaultShell = true;
+    shell = pkgs.bash;
  };

  sops.secrets."gitea/web-secret-provider/token" = {
--- a/hosts/lupine/configuration.nix
+++ b/hosts/lupine/configuration.nix
@@ -1,11 +1,12 @@
-{ fp, values, lib, lupineName, ... }:
+{ fp, values, lupineName, ... }:
 {
  imports = [
    ./hardware-configuration/${lupineName}.nix

    (fp /base)
-    # lupine-4 does not have enough ram for running nix flake check
-  ] ++ lib.optionals (lupineName != "lupine-4")  [ ./services/gitea-runner.nix ];
+
+    ./services/gitea-runner.nix
+  ];

  sops.defaultSopsFile = fp /secrets/lupine/lupine.yaml;

--- a/hosts/skrot/configuration.nix
+++ b/hosts/skrot/configuration.nix
@@ -1,63 +0,0 @@
-{
-  fp,
-  lib,
-  config,
-  values,
-  ...
-}:
-
-{
-  imports = [
-    # Include the results of the hardware scan.
-    ./hardware-configuration.nix
-    ./disk-config.nix
-    (fp /base)
-  ];
-
-  boot.consoleLogLevel = 0;
-
-  sops.defaultSopsFile = fp /secrets/skrot/skrot.yaml;
-
-  systemd.network.networks."enp2s0" = values.defaultNetworkConfig // {
-    matchConfig.Name = "enp2s0";
-    address = with values.hosts.skrot; [
-      (ipv4 + "/25")
-      (ipv6 + "/64")
-    ];
-  };
-
-  sops.secrets = {
-    "dibbler/postgresql/password" = {
-      owner = "dibbler";
-      group = "dibbler";
-    };
-  };
-
-  services.dibbler = {
-    enable = true;
-    kioskMode = true;
-    limitScreenWidth = 80;
-    limitScreenHeight = 42;
-
-    settings = {
-      general.quit_allowed = false;
-      database = {
-        type = "postgresql";
-        postgresql = {
-          username = "pvv_vv";
-          dbname = "pvv_vv";
-          host = "postgres.pvv.ntnu.no";
-          password_file = config.sops.secrets."dibbler/postgresql/password".path;
-        };
-      };
-    };
-  };
-
-  systemd.services."serial-getty@ttyUSB0" = lib.mkIf (!config.virtualisation.isVmVariant) {
-    enable = true;
-    wantedBy = [ "getty.target" ]; # to start at boot
-    serviceConfig.Restart = "always"; # restart when session is closed
-  };
-
-  system.stateVersion = "25.11"; # Did you read the comment? Nah bro
-}
--- a/hosts/skrot/disk-config.nix
+++ b/hosts/skrot/disk-config.nix
@@ -1,41 +0,0 @@
-{
-  disko.devices = {
-    disk = {
-      main = {
-        device = "/dev/sda";
-        type = "disk";
-        content = {
-          type = "gpt";
-          partitions = {
-            ESP = {
-              type = "EF00";
-              size = "1G";
-              content = {
-                type = "filesystem";
-                format = "vfat";
-                mountpoint = "/boot";
-                mountOptions = [ "umask=0077" ];
-              };
-            };
-            plainSwap = {
-              size = "8G";
-              content = {
-                type = "swap";
-                discardPolicy = "both";
-                resumeDevice = false;
-              };
-            };
-            root = {
-              size = "100%";
-              content = {
-                type = "filesystem";
-                format = "ext4";
-                mountpoint = "/";
-              };
-            };
-          };
-        };
-      };
-    };
-  };
-}
--- a/hosts/skrot/hardware-configuration.nix
+++ b/hosts/skrot/hardware-configuration.nix
@@ -1,15 +0,0 @@
-{ config, lib, pkgs, modulesPath, ... }:
-
-{
-  imports =
-    [ (modulesPath + "/installer/scan/not-detected.nix")
-    ];
-
-  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usbhid" "sd_mod" ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ "kvm-amd" ];
-  boot.extraModulePackages = [ ];
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-}
--- a/hosts/skrott/configuration.nix
+++ b/hosts/skrott/configuration.nix
@@ -59,7 +59,7 @@
  # zramSwap.enable = true;

  networking = {
-    hostName = "skrott";
+    hostName = "skrot";
    defaultGateway = values.hosts.gateway;
    defaultGateway6 = values.hosts.gateway6;
    interfaces.eth0 = {
--- a/hosts/temmie/services/nfs-mounts.nix
+++ b/hosts/temmie/services/nfs-mounts.nix
@@ -1,7 +1,7 @@
 { lib, values, ... }:
 let
  # See microbel:/etc/exports
-  letters = [ "a" "b" "c" "d" "h" "i" "j" "k" "l" "m" "z" ];
+  letters = [ "a" "b" "c" "d"  "h" "i" "j" "k" "l" "m" "z" ];
 in
 {
  systemd.targets."pvv-homedirs" = {
@@ -52,6 +52,9 @@ in
      # TODO: are there cgi scripts that modify stuff in peoples homedirs?
      # "ro"
      "rw"
+
+      # TODO: can we enable this and still run cgi stuff?
+      # "noexec"
    ];
  }) letters;
 }
--- a/hosts/temmie/services/userweb.nix
+++ b/hosts/temmie/services/userweb.nix
@@ -1,342 +1,27 @@
-{ config, lib, pkgs, ... }:
-let
-  cfg = config.services.httpd;
-
-  homeLetters = [ "a" "b" "c" "d" "h" "i" "j" "k" "l" "m" "z" ];
-
-  # https://nixos.org/manual/nixpkgs/stable/#ssec-php-user-guide-installing-with-extensions
-  phpEnv = pkgs.php.buildEnv {
-    extensions = { all, ... }: with all; [
-      imagick
-      opcache
-      protobuf
-    ];
-
-    extraConfig = ''
-      display_errors=0
-      post_max_size = 40M
-      upload_max_filesize = 40M
-    '';
-  };
-
-  perlEnv = pkgs.perl.withPackages (ps: with ps; [
-    pkgs.exiftool
-    pkgs.ikiwiki
-    pkgs.irssi
-    pkgs.nix.libs.nix-perl-bindings
-
-    AlgorithmDiff
-    AnyEvent
-    AnyEventI3
-    ArchiveZip
-    CGI
-    CPAN
-    CPANPLUS
-    DBDPg
-    DBDSQLite
-    DBI
-    EmailAddress
-    EmailSimple
-    Env
-    Git
-    HTMLMason
-    HTMLParser
-    HTMLTagset
-    HTTPDAV
-    HTTPDaemon
-    ImageMagick
-    JSON
-    LWP
-    MozillaCA
-    PathTiny
-    Switch
-    SysSyslog
-    TestPostgreSQL
-    TextPDF
-    TieFile
-    Tk
-    URI
-    XMLLibXML
-  ]);
-
-  # https://nixos.org/manual/nixpkgs/stable/#python.buildenv-function
-  pythonEnv = pkgs.python3.buildEnv.override {
-    extraLibs = with pkgs.python3Packages; [
-      legacy-cgi
-
-      matplotlib
-      requests
-    ];
-    ignoreCollisions = true;
-  };
-
-  # https://nixos.org/manual/nixpkgs/stable/#sec-building-environment
-  fhsEnv = pkgs.buildEnv {
-    name = "userweb-env";
-    paths = with pkgs; [
-      bash
-
-      perlEnv
-      pythonEnv
-
-      phpEnv
-    ]
-    ++ (with phpEnv.packages; [
-      # composer
-    ])
-    ++ [
-      acl
-      aspell
-      autoconf
-      autotrash
-      bazel
-      bintools
-      bison
-      bsd-finger
-      catdoc
-      ccache
-      clang
-      cmake
-      coreutils-full
-      curl
-      devcontainer
-      diffutils
-      emacs
-      # exiftags
-      exiftool
-      ffmpeg
-      file
-      findutils
-      gawk
-      gcc
-      glibc
-      gnugrep
-      gnumake
-      gnupg
-      gnuplot
-      gnused
-      gnutar
-      gzip
-      html-tidy
-      imagemagick
-      inetutils
-      iproute2
-      jhead
-      less
-      libgcc
-      lndir
-      mailutils
-      man # TODO: does this one want a mandb instance?
-      meson
-      more
-      mpc
-      mpi
-      mplayer
-      ninja
-      nix
-      openssh
-      openssl
-      patchelf
-      pkg-config
-      ppp
-      procmail
-      procps
-      qemu
-      rc
-      rhash
-      rsync
-      ruby # TODO: does this one want systemwide packages?
-      salt
-      sccache
-      sourceHighlight
-      spamassassin
-      strace
-      subversion
-      system-sendmail
-      systemdMinimal
-      texliveMedium
-      tmux
-      unzip
-      util-linux
-      valgrind
-      vim
-      wget
-      which
-      wine
-      xdg-utils
-      zip
-      zstd
-    ];
-
-    extraOutputsToInstall = [
-      "man"
-      "doc"
-    ];
-  };
-in
+{ ... }:
 {
  services.httpd = {
    enable = true;
-    adminAddr = "drift@pvv.ntnu.no";

-    # TODO: consider upstreaming systemd support
-    # TODO: mod_log_journald in v2.5
-    package = pkgs.apacheHttpd.overrideAttrs (prev: {
-      nativeBuildInputs = prev.nativeBuildInputs ++ [ pkgs.pkg-config ];
-      buildInputs = prev.buildInputs ++ [ pkgs.systemdLibs ];
-      configureFlags = prev.configureFlags ++ [ "--enable-systemd" ];
-    });
-
-    enablePHP = true;
-    phpPackage = phpEnv;
-
-    enablePerl = true;
-
-    # TODO: mod_log_journald in v2.5
-    extraModules = [
-      "systemd"
-      "userdir"
-      # TODO: I think the compilation steps of pkgs.apacheHttpdPackages.mod_perl might have some
-      #       incorrect or restrictive assumptions upstream, either nixpkgs or source
-      # {
-      #   name = "perl";
-      #   path = let
-      #     mod_perl = pkgs.apacheHttpdPackages.mod_perl.override {
-      #       apacheHttpd = cfg.package.out;
-      #       perl = perlEnv;
-      #     };
-      #   in "${mod_perl}/modules/mod_perl.so";
-      # }
-    ];
-
-    extraConfig = ''
-      TraceEnable on
-      LogLevel warn rewrite:trace3
-      ScriptLog ${cfg.logDir}/cgi.log
-    '';
+    # extraModules = [];

    # virtualHosts."userweb.pvv.ntnu.no" = {
    virtualHosts."temmie.pvv.ntnu.no" = {
+
      forceSSL = true;
      enableACME = true;
-
-      extraConfig = ''
-        UserDir ${lib.concatMapStringsSep " " (l: "/home/pvv/${l}/*/web-docs") homeLetters}
-        UserDir disabled root
-        AddHandler cgi-script .cgi
-        DirectoryIndex index.html index.html.var index.php index.php3 index.cgi index.phtml index.shtml meg.html
-
-        <Directory "/home/pvv/?/*/web-docs">
-          Options MultiViews Indexes SymLinksIfOwnerMatch ExecCGI IncludesNoExec
-          AllowOverride All
-          Require all granted
-        </Directory>
-      '';
    };
  };

-  networking.firewall.allowedTCPPorts = [
-    80
-    443
-  ];
-
-  # socket activation comes in v2.5
-  # systemd.sockets.httpd = {
-  #   wantedBy = [ "sockets.target" ];
-  #   description = "HTTPD socket";
-  #   listenStreams = [
-  #     "0.0.0.0:80"
-  #     "0.0.0.0:443"
-  #   ];
-  # };
-
  systemd.services.httpd = {
    after = [ "pvv-homedirs.target" ];
    requires = [ "pvv-homedirs.target" ];

-    environment = {
-      PATH = lib.mkForce "/usr/bin";
-    };
-
    serviceConfig = {
-      Type = lib.mkForce "notify";
-
-      ExecStart = lib.mkForce "${cfg.package}/bin/httpd -D FOREGROUND -f /etc/httpd/httpd.conf -k start";
-      ExecReload = lib.mkForce "${cfg.package}/bin/httpd -f /etc/httpd/httpd.conf -k graceful";
-      ExecStop = lib.mkForce "";
-      KillMode = "mixed";
-
-      ConfigurationDirectory = [ "httpd" ];
-      LogsDirectory = [ "httpd" ];
-      LogsDirectoryMode = "0700";
-
-      CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
-      LockPersonality = true;
-      PrivateDevices = true;
-      PrivateTmp = true;
-      # NOTE: this removes CAP_NET_BIND_SERVICE...
-      # PrivateUsers = true;
-      ProtectClock = true;
-      ProtectControlGroups = true;
      ProtectHome = "tmpfs";
-      ProtectKernelLogs = true;
-      ProtectKernelModules = true;
-      ProtectSystem = true;
-      RemoveIPC = true;
-      RestrictAddressFamilies = [
-        "AF_INET"
-        "AF_INET6"
-        "AF_UNIX"
-        "AF_NETLINK"
-      ];
-      RestrictNamespaces = true;
-      RestrictRealtime = true;
-      RestrictSUIDSGID = true;
-      SocketBindDeny = "any";
-      SocketBindAllow = [
-        "tcp:80"
-        "tcp:443"
-      ];
-      SystemCallArchitectures = "native";
-      SystemCallFilter = [
-         "@system-service"
-      ];
-      UMask = "0077";
-
-      RuntimeDirectory = [ "httpd/root-mnt" ];
-      RootDirectory = "/run/httpd/root-mnt";
-      MountAPIVFS = true;
-      BindReadOnlyPaths = [
-        builtins.storeDir
-        "/etc"
-        # NCSD socket
-        "/var/run"
-        "/var/lib/acme"
-
-        "${fhsEnv}/bin:/bin"
-        "${fhsEnv}/sbin:/sbin"
-        "${fhsEnv}/lib:/lib"
-        "${fhsEnv}/share:/share"
-      ] ++ (lib.mapCartesianProduct ({ parent, child }: "${fhsEnv}${child}:${parent}${child}") {
-        parent = [
-          "/local"
-          "/opt"
-          "/opt/local"
-          "/store"
-          "/store/gnu"
-          "/usr"
-          "/usr/local"
-        ];
-        child = [
-          "/bin"
-          "/sbin"
-          "/lib"
-          "/libexec"
-          "/include"
-          "/share"
-        ];
-      });
-      BindPaths = map (l: "/run/pvv-home-mounts/${l}:/home/pvv/${l}") homeLetters;
+      BindPaths = let
+        letters = [ "a" "b" "c" "d"  "h" "i" "j" "k" "l" "m" "z" ];
+      in map (l: "/run/pvv-home-mounts/${l}:/home/pvv/${l}") letters;
    };
  };

--- a/modules/rsync-pull-targets.nix
+++ b/modules/rsync-pull-targets.nix
@@ -124,22 +124,16 @@ in
    services.openssh.enable = true;
    users.users = lib.pipe cfg.locations [
      (lib.filterAttrs (_: value: value.enable))
-
-      lib.attrValues
-
-      # Index locations by SSH user
-      (lib.foldl (acc: location: acc // {
-        ${location.user} = (acc.${location.user} or [ ]) ++ [ location ];
-      }) { })
-
-      (lib.mapAttrs (_name: locations: {
-        openssh.authorizedKeys.keys = map ({ user, location, rrsyncPackage, rrsyncArgs, authorizedKeysAttrs, publicKey, ... }: let
-          rrsyncArgString = lib.cli.toCommandLineShellGNU {
-            isLong = _: false;
-          } rrsyncArgs;
-          # TODO: handle " in location
-        in "command=\"${lib.getExe rrsyncPackage} ${rrsyncArgString} ${location}\",${lib.concatStringsSep "," authorizedKeysAttrs} ${publicKey}"
-        ) locations;
+      (lib.mapAttrs' (_: { user, location, rrsyncPackage, rrsyncArgs, authorizedKeysAttrs, publicKey, ... }: let
+        rrsyncArgString = lib.cli.toCommandLineShellGNU {
+          isLong = _: false;
+        } rrsyncArgs;
+        # TODO: handle " in location
+      in {
+        name = user;
+        value.openssh.authorizedKeys.keys = [
+          "command=\"${lib.getExe rrsyncPackage} ${rrsyncArgString} ${location}\",${lib.concatStringsSep "," authorizedKeysAttrs} ${publicKey}"
+        ];
      }))
    ];
  };
--- a/packages/mediawiki-extensions/default.nix
+++ b/packages/mediawiki-extensions/default.nix
@@ -33,63 +33,63 @@ in
 lib.mergeAttrsList [
  (mw-ext {
    name = "CodeEditor";
-    commit = "83e1d0c13f34746f0d7049e38b00e9ab0a47c23f";
-    hash = "sha256-qH9fSQZGA+z6tBSh1DaTKLcujqA6K/vQmZML9w5X8mU=";
+    commit = "6e5b06e8cf2d040c0abb53ac3735f9f3c96a7a4f";
+    hash = "sha256-Jee+Ws9REUohywhbuemixXKaTRc54+cIlyUNDCyYcEM=";
  })
  (mw-ext {
    name = "CodeMirror";
-    commit = "af2b08b9ad2b89a64b2626cf80b026c5b45e9922";
-    hash = "sha256-CxXPwCKUlF9Tg4JhwLaKQyvt43owq75jCugVtb3VX+I=";
+    commit = "da9c5d4f03e6425f6f2cf68b75d21311e0f7e77e";
+    hash = "sha256-aL+v9xeqKHGmQVUWVczh54BkReu+fP49PT1NP7eTC6k=";
  })
  (mw-ext {
    name = "DeleteBatch";
-    commit = "3d6f2fd0e3efdae1087dd0cc8b1f96fe0edf734f";
-    hash = "sha256-iD9EjDIW7AGpZan74SIRcr54dV8W7xMKIDjatjdVkKs=";
+    commit = "122072bbfb4eab96ed8c1451a3e74b5557054c58";
+    hash = "sha256-L6AXoyFJEZoAQpLO6knJvYtQ6JJPMtaa+WhpnwbJeNU=";
  })
  (mw-ext {
    name = "PluggableAuth";
-    commit = "85e96acd1ac0ebcdaa29c20eae721767a938f426";
-    hash = "sha256-bMVhrg8FsfWhXF605Cj5TgI0A6Jy/MIQ5aaUcLQQ0Ss=";
+    commit = "5caf605b9dfdd482cb439d1ba2000cba37f8b018";
+    hash = "sha256-TYJqR9ZvaWJ7i1t0XfgUS05qqqCgxAH8tRTklz/Bmlg=";
  })
  (mw-ext {
    name = "Popups";
-    commit = "410e2343c32a7b18dcdc2bbd995b0bfdf3bf5f37";
-    hash = "sha256-u2AlR75x54rCpiK9Mz00D9odJCn8fmi6DRU4QKmKqSc=";
+    commit = "7ed940a09f83f869cbc0bc20f3ca92f85b534951";
+    hash = "sha256-pcDPcu4kSvMHfSOuShrod694TKI9Oo3AEpMP9DXp9oY=";
  })
  (mw-ext {
    name = "Scribunto";
-    commit = "904f323f343dba5ff6a6cdd143c4a8ef5b7d2c55";
-    hash = "sha256-ZOVYhjMMyWbqwZOBb39hMIRmzzCPEnz2y8Q2jgyeERw=";
+    commit = "e755852a8e28a030a21ded2d5dd7270eb933b683";
+    hash = "sha256-zyI5nSE+KuodJOWyV0CQM7G0GfkKEgfoF/czi2/qk98=";
  })
  (mw-ext {
    name = "SimpleSAMLphp";
    kebab-name = "simple-saml-php";
-    commit = "a2f77374713473d594e368de24539aebcc1a800a";
-    hash = "sha256-5+t3VQFKcrIffDNPJ4RWBIWS6K1gTOcEleYWmM6xWms=";
+    commit = "d41b4efd3cc44ca3f9f12e35385fc64337873c2a";
+    hash = "sha256-wfzXtsEEEjQlW5QE4Rf8pasAW/KSJsLkrez13baxeqA=";
  })
  (mw-ext {
    name = "TemplateData";
-    commit = "76a6a04bd13a606923847ba68750b5d98372cacd";
-    hash = "sha256-X2+U5PMqzkSljw2ypIvJUSaPDaonTkQx89OgKzf5scw=";
+    commit = "fd7cf4d95a70ef564130266f2a6b18f33a2a2ff9";
+    hash = "sha256-5OhDPFhIi55Eh5+ovMP1QTjNBb9Sm/3vyArNCApAgSw=";
  })
  (mw-ext {
    name = "TemplateStyles";
-    commit = "7de60a8da6576d7930f293d19ef83529abf52704";
-    hash = "sha256-iPmFDoO5V4964CVyd1mBSQcNlW34odbvpm2CfDBlPBU=";
+    commit = "0f7b94a0b094edee1c2a9063a3c42a1bdc0282d9";
+    hash = "sha256-R406FgNcIip9St1hurtZoPPykRQXBrkJRKA9hapG81I=";
  })
  (mw-ext {
    name = "UserMerge";
-    commit = "71eb53ff4289ac4efaa31685ab8b6483c165a584";
-    hash = "sha256-OfKSEPgctfr659oh5jf99T0Rzqn+60JhNaZq+2gfubk=";
+    commit = "d1917817dd287e7d883e879459d2d2d7bc6966f2";
+    hash = "sha256-la3/AQ38DMsrZ2f24T/z3yKzIrbyi3w6FIB5YfxGK9U=";
  })
  (mw-ext {
    name = "VisualEditor";
-    commit = "a6a63f53605c4d596c3df1dcc2583ffd3eb8d929";
-    hash = "sha256-4d8picO66uzKoxh1TdyvKLHebc6ZL7N2DdXLV2vgBL4=";
+    commit = "032364cfdff33818e6ae0dfa251fe3973b0ae4f3";
+    hash = "sha256-AQDdq9r6rSo8h4u1ERonH14/1i1BgLGdzANEiQ065PU=";
  })
  (mw-ext {
    name = "WikiEditor";
-    commit = "0a5719bb95326123dd0fee1f88658358321ed7be";
-    hash = "sha256-eQMyjhdm1E6TkktIHad1NMeMo8QNoO8z4A05FYOMCwQ=";
+    commit = "cb9f7e06a9c59b6d3b31c653e5886b7f53583d01";
+    hash = "sha256-UWi3Ac+LCOLliLkXnS8YL0rD/HguuPH5MseqOm0z7s4=";
  })
 ]
--- a/packages/ooye/fix-lockfile.patch
+++ b/packages/ooye/fix-lockfile.patch
--- a/packages/ooye/package.nix
+++ b/packages/ooye/package.nix
@@ -10,19 +10,22 @@ let
 in
 buildNpmPackage {
  pname = "delete-your-element";
-  version = "3.5.1";
+  version = "3.3-unstable-2026-01-21";
  src = fetchFromGitea {
    domain = "git.pvv.ntnu.no";
    owner = "Drift";
    repo = "delete-your-element";
-    rev = "80ac1d9d79207b6327975a264fcd9747b99a2a5d";
-    hash = "sha256-fcBpUZ+WEMUXyyo/uaArl4D1NJmK95isWqhFSt6HzUU=";
+    rev = "04d7872acb933254c0a4703064b2e08de31cfeb4";
+    hash = "sha256-CkKt+8VYjIhNM76c3mTf7X6d4ob8tB2w8T6xYS7+LuY=";
  };

  inherit nodejs;

-  npmDepsHash = "sha256-EYxJi6ObJQOLyiJq4C3mV6I62ns9l64ZHcdoQxmN5Ao=";
+  patches = [ ./fix-lockfile.patch ];
+
+  npmDepsHash = "sha256-tiGXr86x9QNAwhZcxSOox6sP9allyz9QSH3XOZOb3z8=";
  dontNpmBuild = true;
+  makeCacheWritable = true;

  nativeBuildInputs = [ makeWrapper ];

--- a/secrets/skrot/skrot.yaml
+++ b/secrets/skrot/skrot.yaml
@@ -1,93 +0,0 @@
-dibbler:
-    postgresql:
-        password: ENC[AES256_GCM,data:3X9A3jOpFVRuBg0gRiCEsZVKfLI=,iv:XC7LBNUhALk9IEhItV8fO5p/m7VKL0REBY1W2IZt7G4=,tag:l18R7EhbOlucZHFQiEvpHw==,type:str]
-sops:
-    age:
-        - recipient: age1hzkvnktkr8t5gvtq0ccw69e44z5z6wf00n3xhk3hj24emf07je5s6q2evr
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvTk5YU3Z2Yy9HS1R4ME5I
-            UU1PRWVncHJYcXY5RlFpOWVQUWZsdy93ZDFBCnlxWkpaL1g5WmNSckNYd202WE40
-            RkwwSEM1YUNNZmozejlrdW8yY1JiekkKLS0tIHVWY0JKZm9CNWhzVGl4cG82UXZs
-            ZnllQzJiK1ZkRmFndmtYdW9IclFWY1EK82f1iGt3nt8dJnEQlMujNqConf6Qq6GX
-            hqoqPoc2EM4kun28Bbpq4pAY7eEPRrWFqOkjYVvgIRoS88D7xT3LWg==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1ug30gg4y7ftuya0wdv7q0vh4egn00wlv2th7mt7cgc2ze46wmvyq9lq6ge
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5WTJIOUcxRlBuNmRrNUZo
-            MXFxeVJBTEhDK00yTUw1U2dHckNFYWZKWkhNCnYxYmtrUEVvd1RaYUI5WTRTRW16
-            S2NhbDdpdDZhSkVWeUhjZDhKd3ZpTmcKLS0tIFovWm5lOXBzcnN3Zm5GQlBhNmlp
-            eTB4WldMNW9GNUwwaEUzRThsemxRVzQKGpa0J2PBzDRdHijm0e3nFAaxQCHUjz+L
-            KataXJEMCijJ6k+7vpb5QMxe2jB1J2PMxNGFp0bWAy2Al3p/Ez2Kww==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1mrnldl334l2nszuta6ywvewng0fswv2dz9l5g4qcwe3nj4yxf92qjskdx6
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZaW1ZSXhVeFVTQW9WYzVh
-            WkVUM2JkOU5VNU9oQXE2Y2pvcFlOWTdvbnpJClduS0RHL2xja291a2doQ0wzbzhQ
-            NmJOSGVvQUdxM3IvaS8zRW1VbVhvYmsKLS0tIHoyOUdvT0xXWXo3SWcyQ1lqTmJS
-            ZUdnS2RvOXI1dGNYQTl6ZHE1cUdMWHMK4ycAJQLyKCgJIzjQ02bPjz4Ct9eO6ivw
-            kfWhyMaoWwM9PhFcwSak0cLpX0C/IOzSzO78pf3WhG16pV7aXapdog==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1hmpdk4h69wxpwqk9tkud39f66hprhehxtzhgw97r6dvr7v0mx5jscsuhkn
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqaml0OVlhcUJSU1hSY3lP
-            bkM0cUV4Z2ZLeERHZ3BUNExuYS9KSU5CekQ4CmQ3SE1vdDBtdFJ6czZYR3U5Tk1X
-            SFJmTVlERjBzV0hFalFLMmVLQzNNdXMKLS0tIDdJLzZveFdnYTI0azk1UXJZLzZF
-            Sy9XbjhwOFR6SFpaNHZLd3ZxdmxOVUEKBBbGmdVVlKHxO+/iODznLP3+dJGppybW
-            +1k9uenVHzie+pDKcrQpSyX2WDnmgg7hUAUiXPuz1eEWmwbRJnU/5w==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1wrssr4z4g6vl3fd3qme5cewchmmhm0j2xe6wf2meu4r6ycn37anse98mfs
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXK01vOVV5YlhsZ2ljYS91
-            OUVEaEpTbXFKOHVNVDVoMTlrS05wRmsyM2dvCjZHOXlCUGowd0J4UlQzSzM5dWJ0
-            eU50SHdtZ2ZyUE1JVHdvODFxWDYvRWsKLS0tIDhlRVQ0Mm5Ua0J2aExqMzRyUGlP
-            RUR6Yi9SUDFCUkZmRk5hYTVFeGloZXcKY/XtaSoW8Pu2wS4oistLSc0T5JvMnt+w
-            s3yfe/zx9/1K6OtbeljF9FZVOB/dOamvk+Qlfl0T5qush7/WgGzErA==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1zhxul786an743u0fascv4wtc5xduu7qfy803lfs539yzhgmlq5ds2lznt5
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOM0pFb2tRTURtWmp6elRN
-            M0xtajlzMTNPMnppcGhJMVlsNHdwWmNGbFVFCnlxM1JQTkR2elAvdytKUEJ3djBS
-            UnlhL0tLLzY3Z05RU3phNDZIOGtTMFEKLS0tIEpOZDUxU1JQVXJTbmVFQlVkOUcy
-            eWlyWGhaS1JCNitUSVVScFk2WGEvOG8K2rpYPGx5jhyyRK4UkeJR96wDFr4Frzsr
-            QWz7fYZRWKWf0H0qn+bm9IfVJiBAlS5i16D1FnipZVmdWefFaZSEPg==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1sqs7urnzsdy64efmd0zukzv3gs5pnjksuxd7nqmdwdy5l0nqnunq6hyune
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJVFV0WVZrK0wzbnhkcmcz
-            c2lIdVlKcFpoYjZIWlNPN0M5N2g2WG9YdlRJCjg5YlNoSzQ5YW5yRUVSeTEzRThY
-            WklKQzlzRXdrUUlFNzF4M1BFZCtPT28KLS0tIDlUOTVIQVZJNFJwTnQxN0Z1ZlQx
-            MmxPMWNPYzJiOFRqY2VYczhvRm5IR3cKpUVV+zsMolsHI2YK9YqC6ecNT6QXv0TV
-            d1SpXRAexZBeWCCHBjSdvQBl8AT4EwrAIP2M2o++6i5DaGoGiEIWZQ==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-02-10T20:02:28Z"
-    mac: ENC[AES256_GCM,data:i8CjVxoD7zdkLNJlI9DCo/tDV5DUI7JdpozLtYZzI7Cu51GayaE2Y3Wg4de6P0L7C3FER04WfRe/h+G9PLZICX/CfSipQysyrEq3Pjt9IKsjytDhP9VYJ36QFGF0PuHUQAMSLts/tAoAvLue6MP+V82l5js9ghvyBrzyBGxoyJw=,iv:QFNxvCYxrSkwy7iT+2BEacNPftDXju1cibprVPDjic0=,tag:496E+oCy/VwTylyaWhQD+A==,type:str]
-    pgp:
-        - created_at: "2026-02-10T20:01:32Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA0av/duuklWYARAAnSjSeI8BybEl1PwNt3KTGcUjpCI+XZPWgNWuvjIymVBv
-            ZgNESNktJB4loNvd/+TIADE7TqGFQK9ev6IPRoDHHkSMdmJ9Bc/lu2HPO+rJa1yD
-            vLXbjf8vRa+GkBDV8DTrPPFvSrHY+jv9vQIzY3nQPKMlyV58E85N262q/2gJUfm9
-            cy/dYE2BUWMQC1DfiGbBRC4xGHhp94XccOMBkIpchP+BL90ZVpocnxeSrSjBsSLE
-            wuhMQPRQSI4PFm8ZYajf6tF001HDa5zaqF1lqkTxtxypDDUr8BVb9n/ObaD8omDI
-            QHQUiPmVgpDs7w2Ph5UgJxK1c+dOcG+mXsl1CHOLldA29sNzDBuh94PKfRl1B3cY
-            KPoPIqntdn59zzRDbuVJxWeJal7Ffynwsrx4h7w7muIR/FYeaFphsokE5Q6gqwTO
-            ZqWY2tuQ0CFRtMl7HB7ZVdSsKv6D5DlesXPXdrhQBKRrNylBpSBmcZH8KRAuHGNj
-            4GFZRN++GFuq54d7wB689kn+F7+pbNom7CDILXiCrz8+9DjFw0maDRoas8OaUyW6
-            kfyJe/YnK94EyCPitkJWYc9uvA2t9y25Rm9uUSvh7WnTFAEK9mJLOal4VgHbqCtg
-            zSGbdw79U4H0Umbi5eSCvEYNtv7eBzKaS/t6irfDRr1WajNhThcd1wmnvjZYxl3S
-            XgHOucYvQvxXjqG0B0Qbd12ucYthPO1+gozEzWxJx2wtiL3gClPYOaiteRlO/XQA
-            WTG6A36X3IxB6qW8lEx12geyjHxFYb82BjyrBnnlj+YcViIBpPQqd8Dz6sl4Rls=
-            =tCoI
-            -----END PGP MESSAGE-----
-          fp: F7D37890228A907440E1FD4846B9228E814A2AAC
-    unencrypted_suffix: _unencrypted
-    version: 3.11.0
--- a/secrets/skrott/skrott.yaml
+++ b/secrets/skrott/skrott.yaml
@@ -3,90 +3,81 @@ dibbler:
        password: ENC[AES256_GCM,data:2n85TO709GJc7/qoYp2RXO8Ttfo=,iv:5ZCZPEQQXPGYfDd1qPhDwDfm1Gds1M8PEX9IiCsHcrw=,tag:PAseyFBAe56pLj5Uv8Jd7A==,type:str]
 sops:
    age:
-        - recipient: age1lpkju2e053aaddpgsr4ef83epclf4c9tp4m98d35ft2fswr8p4tq2ua0mf
+        - recipient: age1hlvwswsljxsvrtp4leuw8a8rf8l2q6y06xvxtafvzpq54xm9aegs0kqw2e
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNdjk1L1N4QU5SK3pjTit6
-            V0hIZHhyOW9Rc2xWdE9yN0tmMG93V0IzZzA4Ck5OSUlRTE5mVGZtMTl3NDh1QzA2
-            Uk9RVnRENmVnQUZuQUVSeGxBS0VaK2sKLS0tIHRHbUUzcmlQbW0weXU0eWJKVmVT
-            ZUxJKzV3UDVVSW11SHRrWGxOSmgrZk0KyWxjEmCvNhiZfgXfObQfQ5riscy0mLFn
-            3pslIN7fbxgxnEVyAhl9FOUS65GrmWrrhvN0pkIpgMw1cqtCrZHxyw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4WllOQ1dRSUJ6a1pvNFg2
+            N0YrQVBtMFZKRml0dG5PUGVhcU9VUXVHc25nClNFSXowUVRRVVhNeHUrTVVZRGRC
+            YkpVYlcrZm1NTE1IT1pSTDdOZGNHYlEKLS0tIHlJbkNBb3o0TlJlbEtsQ2ZsYlJn
+            Wis3T2V5QVYvQi9laUdoaE1DbUZZZE0K/liRzp6TJeufyTzemv+zBTOwzkeJRID4
+            ZviYwwODWopB9/rCd8sIQaNXvEtvuXNWwcV1/p8DsJ9NHwqtdYHpmw==
            -----END AGE ENCRYPTED FILE-----
        - recipient: age1ug30gg4y7ftuya0wdv7q0vh4egn00wlv2th7mt7cgc2ze46wmvyq9lq6ge
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoVFh2WC9iVHpURDBzckdB
-            UjVGcHkyR3V6VHVMbXc4c21ob1lSMDRWeW44ClgzRXhLY2RYN2hleDNLWHoyeXVm
-            T2xJMlNZMml2NGZDNmlQWGp6RXJRQ1EKLS0tIGNmK0lGdjRLM3l4S3JVazZ0MkFU
-            SzZOMFNvcGZRcjJsU242cnZ4NU9OZmcKxlRdhZlXP4KQBHFLFt195H5R33hLuQ0O
-            bVHtQk00IZmMPq4R4aOc0WMkuJxcFaLi0YDQigcFtReSvWDhTHns7A==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByY0dTMWc2VEVRdTJyOXo4
+            R3BYb1VETHI2RktGVnVJUzg4WUsxbTNsK2tVCjVqVml3d29lK21wUXFnRm5GNHdX
+            blV4NEFZU01ZS3Qwc2FSMlVDRlU0SEEKLS0tIExwWXFJZGRTaTBSbjZtdTBXSXNJ
+            TUhJWkIrdGg5UDdDQkdnQk50YTQ0M0UKqoMwtPlOSIqMcLvII/EVuZGrNDeULJHK
+            l7xCzQM0n72E/zxPuO7koVXVcUNwn4kNQCRLOHLcuqx2ZRD8Oc+zNA==
            -----END AGE ENCRYPTED FILE-----
        - recipient: age1mrnldl334l2nszuta6ywvewng0fswv2dz9l5g4qcwe3nj4yxf92qjskdx6
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBua0cvc21qeFp4d1NZZ0Vw
-            aWhldXVjUm1wSmJPdnpZV1JvTVowSWw4RVU0CngzUWkrcXA1TkpZN1M4QVBCS0pX
-            Z0w5aURoQU9Xck1RckNsRTlGeWk2N2cKLS0tIFlSdG05V2l6eStURDJVTXEzc0Zh
-            U2tFemF1djFGeVFQYWg5NjFhdW13Vm8K/QztsuBUcmJNBta3R7uYHGzqKOCRus3s
-            bFd2AOC0PNqvAe8e5q2XYf87MUt/U6AaFjroaDpoC3IUI2+qLJDXDA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxNy8rcHpJclk1b0h2T0dw
+            U0pBYlJvQXlZTG1PeTRCV2hONEJlUWFqdUIwClJ4QnQyOGt4d1NEcVZYek9JUC9X
+            UW0wNjArK2YvZDRMMGpRU1N1dk9jSDQKLS0tIGJMbkZxLzZBVm4wNXVTNFpoRDNo
+            a3dwemI2Wlh2RE8zN0xsbmY5YnJUeTAKhkSpB4RgrfbDpK7IwLs1KGXCj8v0Rze3
+            YZh3BHW2WZLS7uQcIe/tnpIHwPrQnadKeYIw7xBmXu9dWyim9/5RyQ==
            -----END AGE ENCRYPTED FILE-----
        - recipient: age1hmpdk4h69wxpwqk9tkud39f66hprhehxtzhgw97r6dvr7v0mx5jscsuhkn
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkcUVib2tsd3lNS0VmOGNS
-            WWR6NDE5RWw3bStqVjRtdWFSM1E2QUp2cEg0Cm0zdjE3eVpUS3M1L241akM3cyta
-            WGVFVGtQVnQ1d2U1QVRSYXE1YUYrTU0KLS0tIGRTK29EdzVka3hmaFIrSnVUQ1c5
-            c0YxcWZIRHRxZEVjVk9MckJMVisyS28KGH6+9IXIBeXrrZ3AoL3zU1v6EA5TNwN5
-            8DgPO9+yfVesZiEJ0MNhs6tXAA4ODInpU1CUdsjKWRA6/QXBbmEUQw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxUnA5SXNucGN4bi9zeGlU
+            TzJPUGk5SWVONFVVYnNnejJBdFJmL3d1S0Y0Ci9SOVZmVUMzRWNicGN2dE5aRy80
+            MFh3MUNTSE5EWEhQcUFsUENDdWlWYkkKLS0tIDYrb2RzVm9OTHlzKzBCdEtPYnF3
+            L2VmNm5ITEUwUVJ3WXRmVGZnY0RSNE0KraXjJSZ9HKV8SO93khWVjBJcEYQLI0Rm
+            lQuagfkZ5oaedsPGNqaXWo/cd3g2SZOfhmmRxY9R9gxmnjpP4L6gGg==
            -----END AGE ENCRYPTED FILE-----
        - recipient: age1wrssr4z4g6vl3fd3qme5cewchmmhm0j2xe6wf2meu4r6ycn37anse98mfs
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLS0RnMDNOZzBIZzF4VG1R
-            T083bXFOdE1JSzl0SE1SUGlxdnFFQVluWVgwCnRLMThOSU45RTRFMVZybm9YV01n
-            K1pCMThGUFhMMzZhUEszRlZlK2FoQXcKLS0tIHdJRGw4aEU5UkgrU3ZEZXl4bDhi
-            dCtIVkdSWmg1dGNzNmhjZDBiWUJVWkEKSZySabmhM3HDXdduzFGAbOPR6m1CjwWb
-            ttMA9hTvl+T/UqYjxSHj8hmsyTfDY7a4sfHaFcMBJMJrjuEllm/L9g==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKTlgxOGJwbDYrbXNDWmNY
+            YzZGTTdlQXBFRUEySW1Rd0Z4bi90akZIOGpBCjdseUJIeGlJZVB1WDNFeU5LZDE0
+            cExQSFBPTWlUbVRjREdJaXROTjRwWTgKLS0tIENPM2VnZGtyaUowZmx5ZVdZVjRz
+            SW9kSTVBbDJUWHBzV0xBYTlReGloSkEKq6Q3HVKRnw2B0CUvgXlUkQUBgmCNLP80
+            fY5/ePAWZKt4P6TxzPNFH3aANWcnVC2/QxF2RgYfDXKKp1AVlAIlTA==
            -----END AGE ENCRYPTED FILE-----
        - recipient: age1zhxul786an743u0fascv4wtc5xduu7qfy803lfs539yzhgmlq5ds2lznt5
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEYmF6cm5xUHVKMWw3MHJD
-            cWsvZTNWUjRZNDQxbFdDWGh5dUpCc2lGTTNjCm1uV0FCVEgxOG5WbXJUdXlkYTZW
-            KzFzaDNma3RJWEtlUmFHNGxNVUFKN28KLS0tIFFCSi82Q3EvV01UeHg4bG96K1Jm
-            S2JrZlcwcGsrTzdFTDlHcktJd0hmUVUKt0W/8r+L1m25kHKbh5RcweKbl4JB5xqX
-            DYUhUW1Rh1EI63CgVzriz4HZjuNGiuqG9cFv72wIg9Hl2lBPpkC4LQ==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1sqs7urnzsdy64efmd0zukzv3gs5pnjksuxd7nqmdwdy5l0nqnunq6hyune
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQYUtHY1djWno1MG1zQTRB
-            ZHNjbitQbTUwVjFkZWtHU0gwUFFMTTIrQUVZCkUwd3UrbmpyMndXcVl6MEFsSktX
-            L1ZBM2ZPbGMycXd0MDRyWGI1SHh2NVkKLS0tIHFKcS82cUJYZ2V6dHJ6djJSajFy
-            RkIzYUI3dUZjenpxRnplOTZKZmhoS0kKDw9Zuf57k+MAINMReYcCN1DoTtFMgKGJ
-            CWwkNN59Ojgz757xS+2cmK6oxAkDRcN+KZc3sANdj0LY//rXq/UJgw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvS2gzN0ZyakcyVjlYRUZU
+            OFNmUHhsTysxV0JIV1JlM3hLNW9KRm9oY0gwCkh3SWxUV3ZqRXluVVRyRC9OQzVa
+            ODE0NnE2ZHdZc1Qrdkp0YWZFZ0xnMWMKLS0tIFFsNElqVlZ3Sm56b2ZNcEpQMXo4
+            RGJCWmpyd1g1NC9Ud3I3TWRBZ2llblEKVrHE0kPVjapor98D4Z1gCtQsuWS/iAuE
+            5cje1AZdpYVdHoRtzRxKwPekfm9xa/knzFckjjO0JizTQWTPYg0gsQ==
            -----END AGE ENCRYPTED FILE-----
    lastmodified: "2026-01-25T14:03:57Z"
    mac: ENC[AES256_GCM,data:RBf3LjVNSclsPN7I4QPaDUjWbKlaccjk3rzsRNdRe3+OvJSd7MsS9RfpUFCqUtO7ZkkocXHmkHA8z8LNxs6vejT9czMsLLQD14qHZS6fFdTnToOx3Kt5UuviPO/2UryVI+6HWORkH1aqFJhzkSMop2TO5mzuOTfbCEBLYUUuS6s=,iv:NQs8O1hIbjzGBTZo+gCuisj3edraFGk/Y146HmfPmQY=,tag:4g9IXw2UFC5V9EIHuWJqdA==,type:str]
    pgp:
-        - created_at: "2026-02-07T21:15:24Z"
+        - created_at: "2026-01-26T04:52:39Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----

-            hQIMA0av/duuklWYARAAsIJXQn91VrFoSuu0ppgC79T2juR6mA7H5Z2NSGypbild
-            BsNPlWy+q8rpctGkria2Jm37Wz8Qu+sUNQ8Y2w6Z8Bv+M5tks62wc7qBjJkcZKmw
-            IjumrbsEmKQsZKS2YzGFcTjuwpBTGnACAMjUTz1rqnRcaq4U8Wqfi+mmf81yRSnR
-            F0emN015EmGCAUQYD6YRFMAw0PGbP3HiQrXQxdmv8zObbCg9d3+ZozurqFO2RmB4
-            SeZIUEtxgVDuMsr87AmHgbCr8Ux9eZmHU0qv+ejgbnXE7/MaUbppa1gy3RdcwHqG
-            DaETVa6YLUQqP9GOuTVy4gVr3AHtaGwMYRz30gjgQuoGUlQOG1U38PRtqe/94iHF
-            1lo14e31BSfHTnv66vupvWdfDXZme/1rOBJw0lM8Q+wHHJrr3mKmiLus85bJsMD7
-            M4Cn+5n3lE4kSrup8Y5fOsYSwq1WM9GYUfkVR+x2eHNmNdXLVHS0No6kA2TpKeqg
-            zbTyL59i+VBPfANCPehVYxFv7JM9pTFYQXDzMEAJcFerWBmB70HUoYXPZxeDEpiC
-            6seUT9lXM733QGbxwZLXRhXX4sDhJ7rMQJOvrxSvVDhiJx+Arqhz5srM8FlQHdjG
-            kfC507phCarRqXoef55G4trYjrr3zf+sWHRnPuh1IdFch3U+2CMrBUZIRU+C1nXS
-            XgHnubHvfLECTWfeEZUQvZaTtio1K3NSWqv/KBivBBRMfNI20A5erQXnocCYXB7o
-            RYisThHMQomNI7bT8vbf5/N/xlqEra5par0SDX16jl4FuU6dgKRuQ3SrpzFjQTA=
-            =ySHN
+            hQIMA0av/duuklWYARAAtSg5bRhk7DN14CpdTtG9XPwQfZAP2EvCpFqXcU1LnIqi
+            odRqr1vzFlgXH/A/36C/c/JN7M0673PWivUidiMU38/WExgzxPTe/mpwoTHqRRgG
+            aSP5or2UjhwbN7M844JGbTMNAIUh9bVG2/Qm6cLFhv2HalAVhhnWsbIdJIjUmpjU
+            cMjCfxO36uTVp1SajeJKd9x9n+AbWY84SzN/7HYrFcJQomOyb6FcioIwHcIe2YdN
+            GEdNkA13+hTNBR2ZYW3wrPxr39qK4R3mEJambwZLhQfRwUaqIB6PqvXICdqeLbRc
+            2OfzR5oN5HE3Z7QGwDDM8x8diegLYUyTyY3yhJ8PcCs44mXL2XN6XGefgNWuxxDd
+            o8189NRNXD2xloiIcbBJQ6Mpix+qlEI4VRnaxiGI3huv/vpKqSxBZFCu4x4kxGwj
+            OuaX3cPsvjzj0WEFsAvmrUB/Qdabfhhdm1TgY1PqoXfCudyLuDYqRg8sjIIUjmtA
+            /EyXTO6Ah+vc/NP3mLcHeFAh91Lzvxvm6jEmpN7/jg9zbIzs0jNeVchFYxxVZuRn
+            J6ySrkQ5x4FC1DdJlxv36uOLdbsosgia8q3WHOfbt/Lyp/n1RuQX2Kjysi/C79ap
+            xYaozqRmuJIy4Ph4PbhA737PFS4GEyKsHfvskWeGvpGiu/XHP+R+AfE45Mac1O/S
+            XgEgpNsTDb4GS70fjYBjaSyLcgCeAhqt4Mm4O3UTrYWLfziVLMI7vl9zTznGmY9n
+            fS70cnezoSWVj9Nfz+EmmsRWwAYRebzqLWaAtPmrrS5IbWZkLgpay7ga1y9cACo=
+            =0Z+d
            -----END PGP MESSAGE-----
          fp: F7D37890228A907440E1FD4846B9228E814A2AAC
    unencrypted_suffix: _unencrypted
--- a/shell.nix
+++ b/shell.nix
@@ -1,16 +1,15 @@
 { pkgs ? import <nixpkgs> {} }:
 pkgs.mkShellNoCC {
  packages = with pkgs; [
-    disko
-    editorconfig-checker
-    gnupg
-    gum
-    jq
    just
-    openstackclient
+    jq
+    gum
    sops
    ssh-to-age
+    gnupg
    statix
+    openstackclient
+    editorconfig-checker
  ];

  env = {
--- a/topology/default.nix
+++ b/topology/default.nix
@@ -228,7 +228,7 @@ in {
        (mkConnection "demiurgen" "eno1")
        (mkConnection "sanctuary" "ethernet_0")
        (mkConnection "torskas" "eth0")
-        (mkConnection "skrott" "eth0")
+        (mkConnection "skrot" "eth0")
        (mkConnection "homeassistant" "eth0")
        (mkConnection "orchid" "eth0")
        (mkConnection "principal" "em0")
--- a/values.nix
+++ b/values.nix
@@ -73,10 +73,6 @@ in rec {
      ipv4 = pvv-ipv4 179;
      ipv6 = pvv-ipv6 "1:2";
    };
-    principal = {
-      ipv4 = pvv-ipv4 233;
-      ipv6 = pvv-ipv6 "4:233";
-    };
    ustetind = {
      ipv4 = pvv-ipv4 234;
      ipv6 = pvv-ipv6 234;
@@ -85,17 +81,13 @@ in rec {
      ipv4 = pvv-ipv4 235;
      ipv6 = pvv-ipv6 235;
    };
-    skrot = {
-      ipv4 = pvv-ipv4 237;
-      ipv6 = pvv-ipv6 237;
-    };
    temmie = {
      ipv4 = pvv-ipv4 167;
      ipv6 = pvv-ipv6 167;
    };
    gluttony = {
      ipv4 = "129.241.100.118";
-      ipv4_internal = "192.168.20.77";
+      ipv4_internal = "192.168.20.11";
      ipv4_internal_gw = "192.168.20.1";
      ipv6 = "2001:700:305:aa07::3b3";
    };