temmie/nfs-mounts: generate systemd units ourselves

2026-02-21 01:17:53 +01:00 · 2026-01-22 17:34:35 +09:00
164 changed files with 25460 additions and 13925 deletions
--- a/.mailmap
+++ b/.mailmap
@@ -23,9 +23,3 @@ Adrian Gunnar Lauterer <adriangl@pvv.ntnu.no> Adrian Gunnar Lauterer <adrian@lau

 Fredrik Robertsen <frero@pvv.ntnu.no> frero <frero@pvv.ntnu.no>
 Fredrik Robertsen <frero@pvv.ntnu.no> fredrikr79 <fredrikrobertsen7@gmail.com>
-Fredrik Robertsen <frero@pvv.ntnu.no> fredrik <fredrikr79@pm.me>
-
-Vegard Bieker Matthey <vegardbm@pvv.ntnu.no> Vegard Matthey <VegardMatthey@protonmail.com>
-Vegard Bieker Matthey <vegardbm@pvv.ntnu.no> Vegard Bieker Matthey <VegardMatthey@protonmail.com>
-
-Albert Bayazidi <albertba@pvv.ntnu.no> Albert <albert.bayazidi@gmail.com>
--- a/.sops.yaml
+++ b/.sops.yaml
@@ -20,9 +20,7 @@ keys:
  - &host_lupine-3 age1j2u876z8hu87q5npfxzzpfgllyw8ypj66d7cgelmzmnrf3xud34qzkntp9
  - &host_lupine-4 age1t8zlawqkmhye737pn8yx0z3p9cl947d9ktv2cajdc6hnvn52d3fsc59s2k
  - &host_lupine-5 age199zkqq4jp4yc3d0hx2q0ksxdtp42xhmjsqwyngh8tswuck34ke3smrfyqu
-  - &host_skrott age1lpkju2e053aaddpgsr4ef83epclf4c9tp4m98d35ft2fswr8p4tq2ua0mf
  - &host_ustetind age1hffjafs4slznksefmtqrlj7rdaqgzqncn4un938rhr053237ry8s3rs0v8
-  - &host_skrot age1hzkvnktkr8t5gvtq0ccw69e44z5z6wf00n3xhk3hj24emf07je5s6q2evr

 creation_rules:
  # Global secrets
@@ -139,24 +137,10 @@ creation_rules:
  - path_regex: secrets/skrott/[^/]+\.yaml$
    key_groups:
    - age:
-      - *host_skrott
      - *user_danio
      - *user_felixalb
      - *user_pederbs_sopp
      - *user_pederbs_nord
      - *user_pederbs_bjarte
-      - *user_vegardbm
-      pgp:
-      - *user_oysteikt
-  - path_regex: secrets/skrot/[^/]+\.yaml$
-    key_groups:
-    - age:
-      - *host_skrot
-      - *user_danio
-      - *user_felixalb
-      - *user_pederbs_sopp
-      - *user_pederbs_nord
-      - *user_pederbs_bjarte
-      - *user_vegardbm
      pgp:
      - *user_oysteikt
--- a/README.md
+++ b/README.md
@@ -43,7 +43,6 @@ revert the changes on the next nightly rebuild (tends to happen when everybody i
 | [kommode][kom]             | Virtual  | Gitea + Gitea pages                                       |
 | [lupine][lup]              | Physical | Gitea CI/CD runners                                       |
 |  shark                     | Virtual  | Test host for authentication, absolutely horrendous       |
-| [skrot/skrott][skr]        | Physical | Kiosk, snacks and soda                                    |
 | [wenche][wen]              | Virtual  | Nix-builders, general purpose compute                     |

 ## Documentation
@@ -60,5 +59,4 @@ revert the changes on the next nightly rebuild (tends to happen when everybody i
 [ild]: https://wiki.pvv.ntnu.no/wiki/Maskiner/ildkule
 [kom]: https://wiki.pvv.ntnu.no/wiki/Maskiner/kommode
 [lup]: https://wiki.pvv.ntnu.no/wiki/Maskiner/lupine
-[skr]: https://wiki.pvv.ntnu.no/wiki/Maskiner/Skrott
 [wen]: https://wiki.pvv.ntnu.no/wiki/Maskiner/wenche
--- a/base/default.nix
+++ b/base/default.nix
@@ -81,7 +81,7 @@
    AllowHibernation=no
  '';

-  # users.mutableUsers = lib.mkDefault false;
+  users.mutableUsers = lib.mkDefault false;

  users.groups."drift".name = "drift";

--- a/base/nix.nix
+++ b/base/nix.nix
@@ -1,9 +1,4 @@
-{
-  lib,
-  config,
-  inputs,
-  ...
-}:
+{ lib, config, inputs, ... }:
 {
  nix = {
    gc = {
@@ -16,17 +11,12 @@
      allow-dirty = true;
      auto-allocate-uids = true;
      builders-use-substitutes = true;
-      experimental-features = [
-        "nix-command"
-        "flakes"
-        "auto-allocate-uids"
-      ];
+      experimental-features = [ "nix-command" "flakes" "auto-allocate-uids" ];
      log-lines = 50;
      use-xdg-base-directories = true;
    };

-    /*
-      This makes commandline tools like
+    /* This makes commandline tools like
    ** nix run nixpkgs#hello
    ** and nix-shell -p hello
    ** use the same channel the system
--- a/base/programs.nix
+++ b/base/programs.nix
@@ -13,15 +13,9 @@
    # Debug and find files
    file

-    # Process json data
-    jq
-
    # Check computer specs
    lshw

-    # Check who is keeping open files
-    lsof
-
    # Scan for open ports with netstat
    net-tools

@@ -60,8 +54,6 @@
  programs.nano.enable = true;
  # Same reasoning as nano
  programs.vim.enable = true;
-  # Same reasoning as vim
-  programs.neovim.enable = true;

  # Some people like this shell for some reason
  programs.zsh.enable = true;
--- a/base/services/acme.nix
+++ b/base/services/acme.nix
@@ -2,12 +2,14 @@
 {
  security.acme = {
    acceptTerms = true;
-    defaults.email = "acme-drift@pvv.ntnu.no";
+    defaults.email = "drift@pvv.ntnu.no";
  };

  # Let's not spam LetsEncrypt in `nixos-rebuild build-vm` mode:
  virtualisation.vmVariant = {
    security.acme.defaults.server = "https://127.0.0.1";
+    security.acme.preliminarySelfsigned = true;
+
    users.users.root.initialPassword = "root";
  };
 }
--- a/base/services/auto-upgrade.nix
+++ b/base/services/auto-upgrade.nix
@@ -1,10 +1,4 @@
-{
-  config,
-  inputs,
-  pkgs,
-  lib,
-  ...
-}:
+{ config, inputs, pkgs, lib, ... }:

 let
  inputUrls = lib.mapAttrs (input: value: value.url) (import "${inputs.self}/flake.nix").inputs;
@@ -22,33 +16,25 @@ in
      # --update-input is deprecated since nix 2.22, and removed in lix 2.90
      # as such we instead use --override-input combined with --refresh
      # https://git.lix.systems/lix-project/lix/issues/400
-    ]
-    ++ (lib.pipe inputUrls [
+    ] ++ (lib.pipe inputUrls [
      (lib.intersectAttrs {
        nixpkgs = { };
        nixpkgs-unstable = { };
      })
-      (lib.mapAttrsToList (
-        input: url: [
-          "--override-input"
-          input
-          url
-        ]
-      ))
+      (lib.mapAttrsToList (input: url: ["--override-input" input url]))
      lib.concatLists
    ]);
  };

  # workaround for https://github.com/NixOS/nix/issues/6895
  # via https://git.lix.systems/lix-project/lix/issues/400
-  environment.etc =
-    lib.mkIf (!config.virtualisation.isVmVariant && config.system.autoUpgrade.enable)
-      {
-        "current-system-flake-inputs.json".source = pkgs.writers.writeJSON "flake-inputs.json" (
-          lib.flip lib.mapAttrs inputs (
-            name: input:
+  environment.etc = lib.mkIf (!config.virtualisation.isVmVariant) {
+    "current-system-flake-inputs.json".source
+      = pkgs.writers.writeJSON "flake-inputs.json" (
+        lib.flip lib.mapAttrs inputs (name: input:
          # inputs.*.sourceInfo sans outPath, since writeJSON will otherwise serialize sourceInfo like a derivation
-            lib.removeAttrs (input.sourceInfo or { }) [ "outPath" ] // { store-path = input.outPath; } # comment this line if you don't want to retain a store reference to the flake inputs
+          lib.removeAttrs (input.sourceInfo or {}) [ "outPath" ]
+            // { store-path = input.outPath; } # comment this line if you don't want to retain a store reference to the flake inputs
        )
      );
  };
--- a/base/services/journald-upload.nix
+++ b/base/services/journald-upload.nix
@@ -1,9 +1,4 @@
-{
-  config,
-  lib,
-  values,
-  ...
-}:
+{ config, lib, values, ... }:
 let
  cfg = config.services.journald.upload;
 in
--- a/base/services/logrotate.nix
+++ b/base/services/logrotate.nix
@@ -1,10 +1,7 @@
 { ... }:
 {
  systemd.services.logrotate = {
-    documentation = [
-      "man:logrotate(8)"
-      "man:logrotate.conf(5)"
-    ];
+    documentation = [ "man:logrotate(8)" "man:logrotate.conf(5)" ];
    unitConfig.RequiresMountsFor = "/var/log";
    serviceConfig.ReadWritePaths = [ "/var/log" ];
  };
--- a/base/services/nginx.nix
+++ b/base/services/nginx.nix
@@ -11,10 +11,7 @@
    };
  };

-  networking.firewall.allowedTCPPorts = lib.mkIf config.services.nginx.enable [
-    80
-    443
-  ];
+  networking.firewall.allowedTCPPorts = lib.mkIf config.services.nginx.enable [ 80 443 ];

  services.nginx = {
    recommendedTlsSettings = true;
--- a/base/services/openssh.nix
+++ b/base/services/openssh.nix
@@ -18,3 +18,4 @@
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICCbgJ0Uwh9VSVhfId7l9i5/jk4CvAK5rbkiab8R+moF root@sleipner"
    ];
 }
+
--- a/base/services/postfix.nix
+++ b/base/services/postfix.nix
@@ -1,9 +1,4 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}:
+{ config, pkgs, lib, ... }:
 let
  cfg = config.services.postfix;
 in
--- a/base/services/prometheus-node-exporter.nix
+++ b/base/services/prometheus-node-exporter.nix
@@ -1,9 +1,4 @@
-{
-  config,
-  lib,
-  values,
-  ...
-}:
+{ config, lib, values, ... }:
 let
  cfg = config.services.prometheus.exporters.node;
 in
--- a/base/services/prometheus-systemd-exporter.nix
+++ b/base/services/prometheus-systemd-exporter.nix
@@ -1,9 +1,4 @@
-{
-  config,
-  lib,
-  values,
-  ...
-}:
+{ config, lib, values, ... }:
 let
  cfg = config.services.prometheus.exporters.systemd;
 in
--- a/base/services/promtail.nix
+++ b/base/services/promtail.nix
@@ -1,9 +1,4 @@
-{
-  config,
-  lib,
-  values,
-  ...
-}:
+{ config, lib, values, ... }:
 let
  cfg = config.services.prometheus.exporters.node;
 in
@@ -15,13 +10,10 @@ in
        http_listen_port = 28183;
        grpc_listen_port = 0;
      };
-      clients = [
-        {
+      clients = [{
        url = "http://ildkule.pvv.ntnu.no:3100/loki/api/v1/push";
-        }
-      ];
-      scrape_configs = [
-        {
+      }];
+      scrape_configs = [{
        job_name = "systemd-journal";
        journal = {
          max_age = "12h";
@@ -40,8 +32,7 @@ in
            target_label = "level";
          }
        ];
-        }
-      ];
+      }];
    };
  };
 }
--- a/base/services/smartd.nix
+++ b/base/services/smartd.nix
@@ -1,9 +1,4 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}:
+{ config, pkgs, lib, ... }:
 {
  services.smartd = {
    # NOTE: qemu guests tend not to have SMART-reporting disks. Please override for the
@@ -19,12 +14,9 @@
    };
  };

-  environment.systemPackages = lib.optionals config.services.smartd.enable (
-    with pkgs;
-    [
+  environment.systemPackages = lib.optionals config.services.smartd.enable (with pkgs; [
    smartmontools
-    ]
-  );
+  ]);

  systemd.services.smartd.unitConfig.ConditionVirtualization = "no";
 }
--- a/base/services/uptimed.nix
+++ b/base/services/uptimed.nix
@@ -1,9 +1,4 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}:
+{ config, pkgs, lib, ... }:
 let
  cfg = config.services.uptimed;
 in
@@ -20,19 +15,16 @@ in
    services.uptimed = {
      enable = true;

-      settings =
-        let
+      settings = let
        stateDir = "/var/lib/uptimed";
-        in
-        {
+      in {
        PIDFILE = "${stateDir}/pid";
        SENDMAIL = lib.mkDefault "${pkgs.system-sendmail}/bin/sendmail -t";
      };
    };

    systemd.services.uptimed = lib.mkIf (cfg.enable) {
-      serviceConfig =
-        let
+      serviceConfig = let
        uptimed = pkgs.uptimed.overrideAttrs (prev: {
          postPatch = ''
             substituteInPlace Makefile.am \
@@ -42,23 +34,23 @@ in
          '';
        });

-        in
-        {
+      in {
        Type = "notify";

        ExecStart = lib.mkForce "${uptimed}/sbin/uptimed -f";

-          BindReadOnlyPaths =
-            let
+        BindReadOnlyPaths = let
          configFile = lib.pipe cfg.settings [
-                (lib.mapAttrsToList (
-                  k: v: if builtins.isList v then lib.mapConcatStringsSep "\n" (v': "${k}=${v'}") v else "${k}=${v}"
-                ))
+            (lib.mapAttrsToList
+              (k: v:
+                if builtins.isList v
+                  then lib.mapConcatStringsSep "\n" (v': "${k}=${v'}") v
+                  else "${k}=${v}")
+            )
            (lib.concatStringsSep "\n")
            (pkgs.writeText "uptimed.conf")
          ];
-            in
-            [
+        in [
          "${configFile}:/var/lib/uptimed/uptimed.conf"
        ];
      };
--- a/base/sops.nix
+++ b/base/sops.nix
@@ -1,15 +1,8 @@
+{ config, fp, lib, ... }:
 {
-  config,
-  fp,
-  lib,
-  ...
-}:
-{
-  sops.defaultSopsFile =
-    let
+  sops.defaultSopsFile = let
    secretsFilePath = fp /secrets/${config.networking.hostName}/${config.networking.hostName}.yaml;
-    in
-    lib.mkIf (builtins.pathExists secretsFilePath) secretsFilePath;
+  in lib.mkIf (builtins.pathExists secretsFilePath) secretsFilePath;

  sops.age = lib.mkIf (config.sops.defaultSopsFile != null) {
    sshKeyPaths = lib.mkDefault [ "/etc/ssh/ssh_host_ed25519_key" ];
--- a/base/vm.nix
+++ b/base/vm.nix
@@ -11,6 +11,5 @@
  };
  config.virtualisation.vmVariant = {
    virtualisation.isVmVariant = true;
-    virtualisation.graphics = false;
  };
 }
--- a/docs/secret-management.md
+++ b/docs/secret-management.md
@@ -151,7 +151,7 @@ is up to date, you can do the following:

 ```console
 # Fetch gpg (unless you have it already)
-nix shell nixpkgs#gnupg
+nix-shell -p gpg

 # Import oysteikts key to the gpg keychain
 gpg --import ./keys/oysteikt.pub
--- a/flake.lock
+++ b/flake.lock
@@ -2,16 +2,17 @@
  "nodes": {
    "dibbler": {
      "inputs": {
+        "flake-utils": "flake-utils",
        "nixpkgs": [
          "nixpkgs"
        ]
      },
      "locked": {
-        "lastModified": 1770133120,
-        "narHash": "sha256-RuAWONXb+U3omSsuIPCrPcgj0XYqv+2djG0cnPGEyKg=",
+        "lastModified": 1768138611,
+        "narHash": "sha256-KfZX6wpuwE2IRKLjh0DrEviE4f6kqLJWwKIE5QJSqa4=",
        "ref": "main",
-        "rev": "3123b8b474319bc75ee780e0357dcdea69dc85e6",
-        "revCount": 244,
+        "rev": "cb385097dcda5fb9772f903688d078b30a66ccd4",
+        "revCount": 221,
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Projects/dibbler.git"
      },
@@ -60,6 +61,23 @@
        "type": "github"
      }
    },
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "id": "flake-utils",
+        "type": "indirect"
+      }
+    },
    "gergle": {
      "inputs": {
        "nixpkgs": [
@@ -174,11 +192,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1769500363,
-        "narHash": "sha256-vFxmdsLBPdTy5j2bf54gbTQi1XnWbZDmeR/BBh8MFrw=",
+        "lastModified": 1768749374,
+        "narHash": "sha256-dhXYLc64d7TKCnRPW4TlHGl6nLRNdabJB2DpJ8ffUw0=",
        "ref": "main",
-        "rev": "2618e434e40e109eaab6a0693313c7e0de7324a3",
-        "revCount": 47,
+        "rev": "040294f2e1df46e33d995add6944b25859654097",
+        "revCount": 37,
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Projects/minecraft-kartverket.git"
      },
@@ -195,11 +213,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1770960722,
-        "narHash": "sha256-IdhPsWFZUKSJh/nLjGLJvGM5d5Uta+k1FlVYPxTZi0E=",
+        "lastModified": 1767906352,
+        "narHash": "sha256-wYsH9MMAPFG3XTL+3DwI39XMG0F2fTmn/5lt265a3Es=",
        "ref": "main",
-        "rev": "c2e4aca7e1ba27cd09eeaeab47010d32a11841b2",
-        "revCount": 15,
+        "rev": "d054c5d064b8ed6d53a0adb0cf6c0a72febe212e",
+        "revCount": 13,
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Drift/nix-gitea-themes.git"
      },
@@ -217,11 +235,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1769018862,
-        "narHash": "sha256-x3eMpPQhZwEDunyaUos084Hx41XwYTi2uHY4Yc4YNlk=",
+        "lastModified": 1768955766,
+        "narHash": "sha256-V9ns1OII7sWSbIDwPkiqmJ3Xu/bHgQzj+asgH9cTpOo=",
        "owner": "oddlama",
        "repo": "nix-topology",
-        "rev": "a15cac71d3399a4c2d1a3482ae62040a3a0aa07f",
+        "rev": "71f27de56a03f6d8a1a72cf4d0dfd780bcc075bc",
        "type": "github"
      },
      "original": {
@@ -233,11 +251,11 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1769724120,
-        "narHash": "sha256-oQBM04hQk1kotfv4qmIG1tHmuwODd1+hqRJE5TELeCE=",
-        "rev": "8ec59ed5093c2a742d7744e9ecf58f358aa4a87d",
+        "lastModified": 1768877948,
+        "narHash": "sha256-Bq9Hd6DWCBaZ2GkwvJCWGnpGOchaD6RWPSCFxmSmupw=",
+        "rev": "43b2e61c9d09cf6c1c9c192fe6da08accc9bfb1d",
        "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/25.11-small/nixos-25.11.4961.8ec59ed5093c/nixexprs.tar.xz"
+        "url": "https://releases.nixos.org/nixos/25.11-small/nixos-25.11.4368.43b2e61c9d09/nixexprs.tar.xz"
      },
      "original": {
        "type": "tarball",
@@ -261,11 +279,11 @@
    },
    "nixpkgs-unstable": {
      "locked": {
-        "lastModified": 1769813739,
-        "narHash": "sha256-RmNWW1DQczvDwBHu11P0hGwJZxbngdoymVu7qkwq/2M=",
-        "rev": "16a3cae5c2487b1afa240e5f2c1811f172419558",
+        "lastModified": 1768886240,
+        "narHash": "sha256-HUAAI7AF+/Ov1u3Vvjs4DL91zTxMkWLC4xJgQ9QxOUQ=",
+        "rev": "80e4adbcf8992d3fd27ad4964fbb84907f9478b0",
        "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/unstable-small/nixos-26.05pre937548.16a3cae5c248/nixexprs.tar.xz"
+        "url": "https://releases.nixos.org/nixos/unstable-small/nixos-26.05pre930839.80e4adbcf899/nixexprs.tar.xz"
      },
      "original": {
        "type": "tarball",
@@ -300,11 +318,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1769009806,
-        "narHash": "sha256-52xTtAOc9B+MBRMRZ8HI6ybNsRLMlHHLh+qwAbaJjRY=",
+        "lastModified": 1768636400,
+        "narHash": "sha256-AiSKT4/25LS1rUlPduBMogf4EbdMQYDY1rS7AvHFcxk=",
        "ref": "main",
-        "rev": "aa8adfc6a4d5b6222752e2d15d4a6d3b3b85252e",
-        "revCount": 575,
+        "rev": "3a8f82b12a44e6c4ceacd6955a290a52d1ee2856",
+        "revCount": 573,
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Projects/nettsiden.git"
      },
@@ -364,11 +382,11 @@
        "rust-overlay": "rust-overlay_3"
      },
      "locked": {
-        "lastModified": 1769834595,
-        "narHash": "sha256-P1jrO7BxHyIKDuOXHuUb7bi4H2TuYnACW5eqf1gG47g=",
+        "lastModified": 1768140181,
+        "narHash": "sha256-HfZzup5/jlu8X5vMUglTovVTSwhHGHwwV1YOFIL/ksA=",
        "ref": "main",
-        "rev": "def4eec2d59a69b4638b3f25d6d713b703b2fa56",
-        "revCount": 49,
+        "rev": "834463ed64773939798589ee6fd4adfe3a97dddd",
+        "revCount": 43,
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Projects/roowho2.git"
      },
@@ -428,11 +446,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1769309768,
-        "narHash": "sha256-AbOIlNO+JoqRJkK1VrnDXhxuX6CrdtIu2hSuy4pxi3g=",
+        "lastModified": 1767322002,
+        "narHash": "sha256-yHKXXw2OWfIFsyTjduB4EyFwR0SYYF0hK8xI9z4NIn0=",
        "owner": "oxalica",
        "repo": "rust-overlay",
-        "rev": "140c9dc582cb73ada2d63a2180524fcaa744fad5",
+        "rev": "03c6e38661c02a27ca006a284813afdc461e9f7e",
        "type": "github"
      },
      "original": {
@@ -448,11 +466,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1769469829,
-        "narHash": "sha256-wFcr32ZqspCxk4+FvIxIL0AZktRs6DuF8oOsLt59YBU=",
+        "lastModified": 1768863606,
+        "narHash": "sha256-1IHAeS8WtBiEo5XiyJBHOXMzECD6aaIOJmpQKzRRl64=",
        "owner": "Mic92",
        "repo": "sops-nix",
-        "rev": "c5eebd4eb2e3372fe12a8d70a248a6ee9dd02eff",
+        "rev": "c7067be8db2c09ab1884de67ef6c4f693973f4a2",
        "type": "github"
      },
      "original": {
@@ -461,6 +479,21 @@
        "repo": "sops-nix",
        "type": "github"
      }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
    }
  },
  "root": "root",
--- a/flake.nix
+++ b/flake.nix
@@ -49,15 +49,7 @@
    qotd.inputs.nixpkgs.follows = "nixpkgs";
  };

-  outputs =
-    {
-      self,
-      nixpkgs,
-      nixpkgs-unstable,
-      sops-nix,
-      disko,
-      ...
-    }@inputs:
+  outputs = { self, nixpkgs, nixpkgs-unstable, sops-nix, disko, ... }@inputs:
  let
    inherit (nixpkgs) lib;
    systems = [
@@ -74,38 +66,56 @@
      "georg"
      "ildkule"
    ];
-    in
-    {
+  in {
    inputs = lib.mapAttrs (_: src: src.outPath) inputs;

-      pkgs = forAllSystems (
-        system:
+    pkgs = forAllSystems (system:
      import nixpkgs {
        inherit system;
-          config.allowUnfreePredicate =
-            pkg:
-            builtins.elem (lib.getName pkg) [
+        config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg)
+          [
            "nvidia-x11"
            "nvidia-settings"
          ];
-        }
-      );
+      });
+
+    nixosConfigurations = let
+      unstablePkgs = nixpkgs-unstable.legacyPackages.x86_64-linux;

-      nixosConfigurations =
-        let
      nixosConfig =
-            nixpkgs: name: configurationPath:
+        nixpkgs:
+        name:
+        configurationPath:
        extraArgs@{
-              localSystem ? "x86_64-linux", # buildPlatform
-              crossSystem ? "x86_64-linux", # hostPlatform
+          system ? "x86_64-linux",
          specialArgs ? { },
          modules ? [ ],
          overlays ? [ ],
          enableDefaults ? true,
          ...
        }:
-            let
-              commonPkgsConfig = {
+        lib.nixosSystem (lib.recursiveUpdate
+        {
+          inherit system;
+
+          specialArgs = {
+            inherit unstablePkgs inputs;
+            values = import ./values.nix;
+            fp = path: ./${path};
+          } // specialArgs;
+
+          modules = [
+            {
+              networking.hostName = lib.mkDefault name;
+            }
+            configurationPath
+          ] ++ (lib.optionals enableDefaults [
+            sops-nix.nixosModules.sops
+            inputs.roowho2.nixosModules.default
+          ]) ++ modules;
+
+          pkgs = import nixpkgs {
+            inherit system;
            config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg)
              [
                "nvidia-x11"
@@ -115,61 +125,23 @@
              # Global overlays go here
              inputs.roowho2.overlays.default
            ]) ++ overlays;
-              } // (if localSystem != crossSystem then {
-                inherit localSystem crossSystem;
-              } else {
-                system = crossSystem;
-              });
-
-              pkgs = import nixpkgs commonPkgsConfig;
-              unstablePkgs = import nixpkgs-unstable commonPkgsConfig;
-            in
-            lib.nixosSystem (
-              lib.recursiveUpdate
-                {
-                  system = crossSystem;
-
-                  inherit pkgs;
-
-                  specialArgs = {
-                    inherit inputs unstablePkgs;
-                    values = import ./values.nix;
-                    fp = path: ./${path};
+          };
        }
-                  // specialArgs;
-
-                  modules = [
-                    {
-                      networking.hostName = lib.mkDefault name;
-                    }
-                    configurationPath
-                  ]
-                  ++ (lib.optionals enableDefaults [
-                    sops-nix.nixosModules.sops
-                    inputs.roowho2.nixosModules.default
-                    self.nixosModules.rsync-pull-targets
-                  ])
-                  ++ modules;
-                }
-                (
-                  builtins.removeAttrs extraArgs [
-                    "localSystem"
-                    "crossSystem"
+        (builtins.removeAttrs extraArgs [
+          "system"
          "modules"
          "overlays"
          "specialArgs"
          "enableDefaults"
-                  ]
-                )
+        ])
      );

-          stableNixosConfig =
-            name: extraArgs: nixosConfig nixpkgs name ./hosts/${name}/configuration.nix extraArgs;
-        in
-        {
+      stableNixosConfig = name: extraArgs:
+          nixosConfig nixpkgs name ./hosts/${name}/configuration.nix extraArgs;
+    in {
      bakke = stableNixosConfig "bakke" {
        modules = [
-              inputs.disko.nixosModules.disko
+          disko.nixosModules.disko
        ];
      };
      bicep = stableNixosConfig "bicep" {
@@ -191,6 +163,7 @@
      bekkalokk = stableNixosConfig "bekkalokk" {
        overlays = [
          (final: prev: {
+            heimdal = unstablePkgs.heimdal;
            mediawiki-extensions = final.callPackage ./packages/mediawiki-extensions { };
            simplesamlphp = final.callPackage ./packages/simplesamlphp { };
            bluemap = final.callPackage ./packages/bluemap.nix { };
@@ -206,13 +179,6 @@
      };
      ildkule = stableNixosConfig "ildkule" { };
      #ildkule-unstable = unstableNixosConfig "ildkule" { };
-          skrot = stableNixosConfig "skrot" {
-            modules = [
-              inputs.disko.nixosModules.disko
-              inputs.dibbler.nixosModules.default
-            ];
-            overlays = [ inputs.dibbler.overlays.default ];
-          };
      shark = stableNixosConfig "shark" { };
      wenche = stableNixosConfig "wenche" { };
      temmie = stableNixosConfig "temmie" { };
@@ -224,7 +190,6 @@
        ];
        modules = [
          inputs.nix-gitea-themes.nixosModules.default
-              inputs.disko.nixosModules.disko
        ];
      };

@@ -256,90 +221,39 @@
          inputs.gergle.overlays.default
        ];
      };
-        }
-        // (
-          let
-            skrottConfig = {
+      skrott = stableNixosConfig "skrott" {
+        system = "aarch64-linux";
        modules = [
          (nixpkgs + "/nixos/modules/installer/sd-card/sd-image-aarch64.nix")
          inputs.dibbler.nixosModules.default
        ];
        overlays = [
          inputs.dibbler.overlays.default
-                (final: prev: {
-                  # NOTE: Yeetus (these break crosscompile ¯\_(ツ)_/¯)
-                  atool = prev.emptyDirectory;
-                  micro = prev.emptyDirectory;
-                  ncdu = prev.emptyDirectory;
-                })
        ];
      };
-          in
-          {
-            skrott = self.nixosConfigurations.skrott-native;
-            skrott-native = stableNixosConfig "skrott" (
-              skrottConfig
-              // {
-                localSystem = "aarch64-linux";
-                crossSystem = "aarch64-linux";
    }
-            );
-            skrott-cross = stableNixosConfig "skrott" (
-              skrottConfig
-              // {
-                localSystem = "x86_64-linux";
-                crossSystem = "aarch64-linux";
-              }
-            );
-            skrott-x86_64 = stableNixosConfig "skrott" (
-              skrottConfig
-              // {
-                localSystem = "x86_64-linux";
-                crossSystem = "x86_64-linux";
-              }
-            );
-          }
-        )
-        // (
-          let
+    //
+    (let
      machineNames = map (i: "lupine-${toString i}") (lib.range 1 5);
-            stableLupineNixosConfig =
-              name: extraArgs: nixosConfig nixpkgs name ./hosts/lupine/configuration.nix extraArgs;
-          in
-          lib.genAttrs machineNames (
-            name:
-            stableLupineNixosConfig name {
+      stableLupineNixosConfig = name: extraArgs:
+          nixosConfig nixpkgs name ./hosts/lupine/configuration.nix extraArgs;
+    in lib.genAttrs machineNames (name: stableLupineNixosConfig name {
      modules = [{ networking.hostName = name; }];
      specialArgs.lupineName = name;
-            }
-          )
-        );
+    }));

    nixosModules = {
      bluemap = ./modules/bluemap.nix;
-        gickup = ./modules/gickup;
-        matrix-ooye = ./modules/matrix-ooye.nix;
-        robots-txt = ./modules/robots-txt.nix;
-        rsync-pull-targets = ./modules/rsync-pull-targets.nix;
      snakeoil-certs = ./modules/snakeoil-certs.nix;
      snappymail = ./modules/snappymail.nix;
+      robots-txt = ./modules/robots-txt.nix;
+      gickup = ./modules/gickup;
+      matrix-ooye = ./modules/matrix-ooye.nix;
    };

    devShells = forAllSystems (system: {
-        default =
-          let
-            pkgs = import nixpkgs-unstable {
-              inherit system;
-              overlays = [
-                (final: prev: {
-                  inherit (inputs.disko.packages.${system}) disko;
-                })
-              ];
-            };
-          in
-          pkgs.callPackage ./shell.nix { };
-        cuda =
-          let
+      default = nixpkgs-unstable.legacyPackages.${system}.callPackage ./shell.nix { };
+      cuda = let
        cuda-pkgs = import nixpkgs-unstable {
          inherit system;
          config = {
@@ -347,22 +261,18 @@
            cudaSupport = true;
          };
        };
-          in
-          cuda-pkgs.callPackage ./shells/cuda.nix { };
+      in cuda-pkgs.callPackage ./shells/cuda.nix { };
    });

    packages = {
-        "x86_64-linux" =
-          let
-            system = "x86_64-linux";
-            pkgs = nixpkgs.legacyPackages.${system};
-          in
-          rec {
+      "x86_64-linux" = let
+        pkgs = nixpkgs.legacyPackages."x86_64-linux";
+      in rec {
        default = important-machines;
-            important-machines = pkgs.linkFarm "important-machines" (
-              lib.getAttrs importantMachines self.packages.${system}
-            );
-            all-machines = pkgs.linkFarm "all-machines" (lib.getAttrs allMachines self.packages.${system});
+        important-machines = pkgs.linkFarm "important-machines"
+          (lib.getAttrs importantMachines self.packages.x86_64-linux);
+        all-machines = pkgs.linkFarm "all-machines"
+          (lib.getAttrs allMachines self.packages.x86_64-linux);

        simplesamlphp = pkgs.callPackage ./packages/simplesamlphp { };

@@ -374,36 +284,28 @@
      # Mediawiki extensions
      (lib.pipe null [
        (_: pkgs.callPackage ./packages/mediawiki-extensions { })
-              (lib.flip builtins.removeAttrs [
-                "override"
-                "overrideDerivation"
-              ])
+        (lib.flip builtins.removeAttrs ["override" "overrideDerivation"])
        (lib.mapAttrs' (name: lib.nameValuePair "mediawiki-${name}"))
      ])
      //
      # Machines
-            lib.genAttrs allMachines (machine: self.nixosConfigurations.${machine}.config.system.build.toplevel)
+      lib.genAttrs allMachines
+        (machine: self.nixosConfigurations.${machine}.config.system.build.toplevel)
      //
      # Skrott is exception
      {
-              skrott = self.packages.${system}.skrott-native-sd;
-              skrott-native = self.nixosConfigurations.skrott-native.config.system.build.toplevel;
-              skrott-native-sd = self.nixosConfigurations.skrott-native.config.system.build.sdImage;
-              skrott-cross = self.nixosConfigurations.skrott-cross.config.system.build.toplevel;
-              skrott-cross-sd = self.nixosConfigurations.skrott-cross.config.system.build.sdImage;
-              skrott-x86_64 = self.nixosConfigurations.skrott-x86_64.config.system.build.toplevel;
+        skrott = self.nixosConfigurations.skrott.config.system.build.sdImage;
      }
      //
      # Nix-topology
-            (
-              let
+      (let
        topology' = import inputs.nix-topology {
          pkgs = import nixpkgs {
-                    inherit system;
+            system = "x86_64-linux";
            overlays = [
              inputs.nix-topology.overlays.default
              (final: prev: {
-                        inherit (nixpkgs-unstable.legacyPackages.${system}) super-tiny-icons;
+                inherit (nixpkgs-unstable.legacyPackages.x86_64-linux) super-tiny-icons;
              })
            ];
          };
@@ -415,9 +317,7 @@
          modules = [
            ./topology
            {
-                      nixosConfigurations = lib.mapAttrs (
-                        _name: nixosCfg:
-                        nixosCfg.extendModules {
+              nixosConfigurations = lib.mapAttrs (_name: nixosCfg: nixosCfg.extendModules {
                modules = [
                  inputs.nix-topology.nixosModules.default
                  ./topology/service-extractors/greg-ng.nix
@@ -425,27 +325,21 @@
                  ./topology/service-extractors/mysql.nix
                  ./topology/service-extractors/gitea-runners.nix
                ];
-                        }
-                      ) self.nixosConfigurations;
+              }) self.nixosConfigurations;
            }
          ];
        };
-              in
-              {
+      in {
        topology = topology'.config.output;
-                topology-png =
-                  pkgs.runCommand "pvv-config-topology-png"
-                    {
+        topology-png = pkgs.runCommand "pvv-config-topology-png" {
          nativeBuildInputs = [ pkgs.writableTmpDirAsHomeHook ];
-                    }
-                    ''
+        } ''
          mkdir -p "$out"
          for file in '${topology'.config.output}'/*.svg; do
            ${lib.getExe pkgs.imagemagick} -density 300 -background none "$file" "$out"/"$(basename "''${file%.svg}.png")"
          done
        '';
-              }
-            );
+      });
    };
  };
 }
--- a/hosts/bakke/configuration.nix
+++ b/hosts/bakke/configuration.nix
@@ -1,9 +1,4 @@
-{
-  config,
-  pkgs,
-  values,
-  ...
-}:
+{ config, pkgs, values, ... }:
 {
  imports = [
      ./hardware-configuration.nix
@@ -14,10 +9,7 @@
  networking.hostId = "99609ffc";
  systemd.network.networks."30-enp2s0" = values.defaultNetworkConfig // {
    matchConfig.Name = "enp2s0";
-    address = with values.hosts.bakke; [
-      (ipv4 + "/25")
-      (ipv6 + "/64")
-    ];
+    address = with values.hosts.bakke; [ (ipv4 + "/25") (ipv6 + "/64") ];
  };

  # Don't change (even during upgrades) unless you know what you are doing.
--- a/hosts/bakke/filesystems.nix
+++ b/hosts/bakke/filesystems.nix
@@ -1,17 +1,17 @@
-{ pkgs, ... }:
+{ config, pkgs, lib, ... }:
 {
  # Boot drives:
  boot.swraid.enable = true;

  # ZFS Data pool:
+  environment.systemPackages = with pkgs; [ zfs ];
  boot = {
    zfs = {
      extraPools = [ "tank" ];
      requestEncryptionCredentials = false;
    };
-    supportedFilesystems.zfs = true;
-    # Use stable linux packages, these work with zfs
-    kernelPackages = pkgs.linuxPackages;
+    supportedFilesystems = [ "zfs" ];
+    kernelPackages = config.boot.zfs.package.latestCompatibleLinuxPackages;
  };
  services.zfs.autoScrub = {
    enable = true;
--- a/hosts/bakke/hardware-configuration.nix
+++ b/hosts/bakke/hardware-configuration.nix
@@ -1,58 +1,40 @@
 # Do not modify this file!  It was generated by 'nixos-generate-config'
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{
-  config,
-  lib,
-  pkgs,
-  modulesPath,
-  ...
-}:
+{ config, lib, pkgs, modulesPath, ... }:

 {
-  imports = [
-    (modulesPath + "/installer/scan/not-detected.nix")
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
    ];

-  boot.initrd.availableKernelModules = [
-    "ehci_pci"
-    "ahci"
-    "usbhid"
-    "usb_storage"
-    "sd_mod"
-  ];
+  boot.initrd.availableKernelModules = [ "ehci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
  boot.initrd.kernelModules = [ ];
  boot.kernelModules = [ "kvm-intel" ];
  boot.extraModulePackages = [ ];

-  fileSystems."/" = {
-    device = "/dev/disk/by-uuid/0f63c3d2-fc12-4ed5-a5a5-141bfd67a571";
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/0f63c3d2-fc12-4ed5-a5a5-141bfd67a571";
      fsType = "btrfs";
      options = [ "subvol=root" ];
    };

-  fileSystems."/home" = {
-    device = "/dev/disk/by-uuid/0f63c3d2-fc12-4ed5-a5a5-141bfd67a571";
+  fileSystems."/home" =
+    { device = "/dev/disk/by-uuid/0f63c3d2-fc12-4ed5-a5a5-141bfd67a571";
      fsType = "btrfs";
      options = [ "subvol=home" ];
    };

-  fileSystems."/nix" = {
-    device = "/dev/disk/by-uuid/0f63c3d2-fc12-4ed5-a5a5-141bfd67a571";
+  fileSystems."/nix" =
+    { device = "/dev/disk/by-uuid/0f63c3d2-fc12-4ed5-a5a5-141bfd67a571";
      fsType = "btrfs";
-    options = [
-      "subvol=nix"
-      "noatime"
-    ];
+      options = [ "subvol=nix" "noatime" ];
    };

-  fileSystems."/boot" = {
-    device = "/dev/sdc2";
+  fileSystems."/boot" =
+    { device = "/dev/sdc2";
      fsType = "vfat";
-    options = [
-      "fmask=0022"
-      "dmask=0022"
-    ];
+      options = [ "fmask=0022" "dmask=0022" ];
    };

  swapDevices = [ ];
--- a/hosts/bekkalokk/configuration.nix
+++ b/hosts/bekkalokk/configuration.nix
@@ -1,9 +1,4 @@
-{
-  fp,
-  pkgs,
-  values,
-  ...
-}:
+{ fp, pkgs, values, ... }:
 {
  imports = [
    ./hardware-configuration.nix
@@ -26,15 +21,12 @@

  systemd.network.networks."30-enp2s0" = values.defaultNetworkConfig // {
    matchConfig.Name = "enp2s0";
-    address = with values.hosts.bekkalokk; [
-      (ipv4 + "/25")
-      (ipv6 + "/64")
-    ];
+    address = with values.hosts.bekkalokk; [ (ipv4 + "/25") (ipv6 + "/64") ];
  };

  services.btrfs.autoScrub.enable = true;

  # Don't change (even during upgrades) unless you know what you are doing.
  # See https://search.nixos.org/options?show=system.stateVersion
-  system.stateVersion = "25.11";
+  system.stateVersion = "22.11";
 }
--- a/hosts/bekkalokk/hardware-configuration.nix
+++ b/hosts/bekkalokk/hardware-configuration.nix
@@ -1,42 +1,30 @@
 # Do not modify this file!  It was generated by 'nixos-generate-config'
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{
-  config,
-  lib,
-  pkgs,
-  modulesPath,
-  ...
-}:
+{ config, lib, pkgs, modulesPath, ... }:

 {
-  imports = [
-    (modulesPath + "/installer/scan/not-detected.nix")
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
    ];

-  boot.initrd.availableKernelModules = [
-    "ehci_pci"
-    "ahci"
-    "usbhid"
-    "usb_storage"
-    "sd_mod"
-  ];
+  boot.initrd.availableKernelModules = [ "ehci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
  boot.initrd.kernelModules = [ ];
  boot.kernelModules = [ "kvm-intel" ];
  boot.extraModulePackages = [ ];

-  fileSystems."/" = {
-    device = "/dev/sda1";
+  fileSystems."/" =
+    { device = "/dev/sda1";
      fsType = "btrfs";
    };

-  fileSystems."/boot" = {
-    device = "/dev/disk/by-uuid/CE63-3B9B";
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/CE63-3B9B";
      fsType = "vfat";
    };

-  swapDevices = [
-    { device = "/dev/disk/by-uuid/2df10c7b-0dec-45c6-a728-533f7da7f4b9"; }
+  swapDevices =
+    [ { device = "/dev/disk/by-uuid/2df10c7b-0dec-45c6-a728-533f7da7f4b9"; }
    ];

  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
--- a/hosts/bekkalokk/services/bluemap.nix
+++ b/hosts/bekkalokk/services/bluemap.nix
@@ -1,15 +1,8 @@
-{
-  config,
-  lib,
-  pkgs,
-  inputs,
-  ...
-}:
+{ config, lib, pkgs, inputs, ... }:
 let
  vanillaSurvival = "/var/lib/bluemap/vanilla_survival_world";
  format = pkgs.formats.hocon { };
-in
-{
+in {
  # NOTE: our versino of the module gets added in flake.nix
  disabledModules = [ "services/web-apps/bluemap.nix" ];

@@ -24,11 +17,9 @@ in

    host = "minecraft.pvv.ntnu.no";

-    maps =
-      let
+    maps = let
      inherit (inputs.minecraft-kartverket.packages.${pkgs.stdenv.hostPlatform.system}) bluemap-export;
-      in
-      {
+    in {
      "verden" = {
        extraHoconMarkersFile = "${bluemap-export}/overworld.hocon";
        settings = {
@@ -62,11 +53,9 @@ in
          remove-caves-below-y = -10000;
          cave-detection-ocean-floor = -5;
          cave-detection-uses-block-light = true;
-            render-mask = [
-              {
+          render-mask = [{
            max-y = 90;
-              }
-            ];
+          }];
        };
      };
      "enden" = {
@@ -94,8 +83,7 @@ in
  systemd.services."render-bluemap-maps" = {
    serviceConfig = {
      StateDirectory = [ "bluemap/world" ];
-      ExecStartPre =
-        let
+      ExecStartPre = let
        rsyncArgs = lib.cli.toCommandLineShellGNU { } {
          archive = true;
          compress = true;
@@ -104,8 +92,7 @@ in
          no-group = true;
          rsh = "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=%d/ssh-known-hosts -i %d/sshkey";
        };
-        in
-        "${lib.getExe pkgs.rsync} ${rsyncArgs} root@innovation.pvv.ntnu.no:/ ${vanillaSurvival}";
+      in "${lib.getExe pkgs.rsync} ${rsyncArgs} root@innovation.pvv.ntnu.no:/ ${vanillaSurvival}";
      LoadCredential = [
        "sshkey:${config.sops.secrets."bluemap/ssh-key".path}"
        "ssh-known-hosts:${config.sops.secrets."bluemap/ssh-known-hosts".path}"
--- a/hosts/bekkalokk/services/idp-simplesamlphp/default.nix
+++ b/hosts/bekkalokk/services/idp-simplesamlphp/default.nix
@@ -1,16 +1,8 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}:
+{ config, pkgs, lib, ... }:
 let
  pwAuthScript = pkgs.writeShellApplication {
    name = "pwauth";
-    runtimeInputs = with pkgs; [
-      coreutils
-      heimdal
-    ];
+    runtimeInputs = with pkgs; [ coreutils heimdal ];
    text = ''
      read -r user1
      user2="$(echo -n "$user1" | tr -c -d '0123456789abcdefghijklmnopqrstuvwxyz')"
@@ -93,20 +85,14 @@ let

        substituteInPlace "$out" \
          --replace-warn '$SAML_COOKIE_SECURE' 'true' \
-          --replace-warn '$SAML_COOKIE_SALT' 'file_get_contents("${
-            config.sops.secrets."idp/cookie_salt".path
-          }")' \
+          --replace-warn '$SAML_COOKIE_SALT' 'file_get_contents("${config.sops.secrets."idp/cookie_salt".path}")' \
          --replace-warn '$SAML_ADMIN_NAME' '"Drift"' \
          --replace-warn '$SAML_ADMIN_EMAIL' '"drift@pvv.ntnu.no"' \
-          --replace-warn '$SAML_ADMIN_PASSWORD' 'file_get_contents("${
-            config.sops.secrets."idp/admin_password".path
-          }")' \
+          --replace-warn '$SAML_ADMIN_PASSWORD' 'file_get_contents("${config.sops.secrets."idp/admin_password".path}")' \
          --replace-warn '$SAML_TRUSTED_DOMAINS' 'array( "idp.pvv.ntnu.no" )' \
          --replace-warn '$SAML_DATABASE_DSN' '"pgsql:host=postgres.pvv.ntnu.no;port=5432;dbname=idp"' \
          --replace-warn '$SAML_DATABASE_USERNAME' '"idp"' \
-          --replace-warn '$SAML_DATABASE_PASSWORD' 'file_get_contents("${
-            config.sops.secrets."idp/postgres_password".path
-          }")' \
+          --replace-warn '$SAML_DATABASE_PASSWORD' 'file_get_contents("${config.sops.secrets."idp/postgres_password".path}")' \
          --replace-warn '$CACHE_DIRECTORY' '/var/cache/idp'
      '';

@@ -172,12 +158,10 @@ in
    services.phpfpm.pools.idp = {
      user = "idp";
      group = "idp";
-      settings =
-        let
+      settings = let
        listenUser = config.services.nginx.user;
        listenGroup = config.services.nginx.group;
-        in
-        {
+      in {
        "pm" = "dynamic";
        "pm.max_children" = 32;
        "pm.max_requests" = 500;
--- a/hosts/bekkalokk/services/kerberos.nix
+++ b/hosts/bekkalokk/services/kerberos.nix
@@ -1,9 +1,4 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}:
+{ config, pkgs, lib, ... }:
 {
  security.krb5 = {
    enable = true;
--- a/hosts/bekkalokk/services/mediawiki/default.nix
+++ b/hosts/bekkalokk/services/mediawiki/default.nix
@@ -1,12 +1,4 @@
-{
-  pkgs,
-  lib,
-  fp,
-  config,
-  values,
-  ...
-}:
-let
+{ pkgs, lib, fp, config, values, pkgs-unstable, ... }: let
  cfg = config.services.mediawiki;

  # "mediawiki"
@@ -17,9 +9,7 @@ let

  simplesamlphp = pkgs.simplesamlphp.override {
    extra_files = {
-      "metadata/saml20-idp-remote.php" = pkgs.writeText "mediawiki-saml20-idp-remote.php" (
-        import ../idp-simplesamlphp/metadata.php.nix
-      );
+      "metadata/saml20-idp-remote.php" = pkgs.writeText "mediawiki-saml20-idp-remote.php" (import ../idp-simplesamlphp/metadata.php.nix);

      "config/authsources.php" = ./simplesaml-authsources.php;

@@ -28,67 +18,36 @@ let

        substituteInPlace "$out" \
          --replace-warn '$SAML_COOKIE_SECURE' 'true' \
-          --replace-warn '$SAML_COOKIE_SALT' 'file_get_contents("${
-            config.sops.secrets."mediawiki/simplesamlphp/cookie_salt".path
-          }")' \
+          --replace-warn '$SAML_COOKIE_SALT' 'file_get_contents("${config.sops.secrets."mediawiki/simplesamlphp/cookie_salt".path}")' \
          --replace-warn '$SAML_ADMIN_NAME' '"Drift"' \
          --replace-warn '$SAML_ADMIN_EMAIL' '"drift@pvv.ntnu.no"' \
-          --replace-warn '$SAML_ADMIN_PASSWORD' 'file_get_contents("${
-            config.sops.secrets."mediawiki/simplesamlphp/admin_password".path
-          }")' \
+          --replace-warn '$SAML_ADMIN_PASSWORD' 'file_get_contents("${config.sops.secrets."mediawiki/simplesamlphp/admin_password".path}")' \
          --replace-warn '$SAML_TRUSTED_DOMAINS' 'array( "wiki.pvv.ntnu.no" )' \
          --replace-warn '$SAML_DATABASE_DSN' '"pgsql:host=postgres.pvv.ntnu.no;port=5432;dbname=mediawiki_simplesamlphp"' \
          --replace-warn '$SAML_DATABASE_USERNAME' '"mediawiki_simplesamlphp"' \
-          --replace-warn '$SAML_DATABASE_PASSWORD' 'file_get_contents("${
-            config.sops.secrets."mediawiki/simplesamlphp/postgres_password".path
-          }")' \
+          --replace-warn '$SAML_DATABASE_PASSWORD' 'file_get_contents("${config.sops.secrets."mediawiki/simplesamlphp/postgres_password".path}")' \
          --replace-warn '$CACHE_DIRECTORY' '/var/cache/mediawiki/idp'
      '';
    };
  };
-in
-{
+in {
  services.idp.sp-remote-metadata = [ "https://wiki.pvv.ntnu.no/simplesaml/" ];

-  sops.secrets =
-    lib.pipe
-      [
-        "mediawiki/secret-key"
+  sops.secrets = lib.pipe [
    "mediawiki/password"
    "mediawiki/postgres_password"
    "mediawiki/simplesamlphp/postgres_password"
    "mediawiki/simplesamlphp/cookie_salt"
    "mediawiki/simplesamlphp/admin_password"
-      ]
-      [
-        (map (
-          key:
-          lib.nameValuePair key {
+  ] [
+    (map (key: lib.nameValuePair key {
      owner = user;
      group = group;
      restartUnits = [ "phpfpm-mediawiki.service" ];
-          }
-        ))
+    }))
    lib.listToAttrs
  ];

-  services.rsync-pull-targets = {
-    enable = true;
-    locations.${cfg.uploadsDir} = {
-      user = "root";
-      rrsyncArgs.ro = true;
-      authorizedKeysAttrs = [
-        "restrict"
-        "from=\"principal.pvv.ntnu.no,${values.hosts.principal.ipv6},${values.hosts.principal.ipv4}\""
-        "no-agent-forwarding"
-        "no-port-forwarding"
-        "no-pty"
-        "no-X11-forwarding"
-      ];
-      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICHFHa3Iq1oKPhbKCAIHgOoWOTkLmIc7yqxeTbut7ig/ mediawiki rsync backup";
-    };
-  };
-
  services.mediawiki = {
    enable = true;
    name = "Programvareverkstedet";
@@ -185,24 +144,6 @@ in
      $wgDBserver = "${toString cfg.database.host}";
      $wgAllowCopyUploads = true;

-      # Files
-      $wgFileExtensions = [
-        'bmp',
-        'gif',
-        'jpeg',
-        'jpg',
-        'mp3',
-        'odg',
-        'odp',
-        'ods',
-        'odt',
-        'pdf',
-        'png',
-        'tiff',
-        'webm',
-        'webp',
-      ];
-
      # Misc program paths
      $wgFFmpegLocation = '${pkgs.ffmpeg}/bin/ffmpeg';
      $wgExiftool = '${pkgs.exiftool}/bin/exiftool';
@@ -238,17 +179,15 @@ in

  # Cache directory for simplesamlphp
  # systemd.services.phpfpm-mediawiki.serviceConfig.CacheDirectory = "mediawiki/simplesamlphp";
-  systemd.tmpfiles.settings."10-mediawiki"."/var/cache/mediawiki/simplesamlphp".d =
-    lib.mkIf cfg.enable
-      {
+  systemd.tmpfiles.settings."10-mediawiki"."/var/cache/mediawiki/simplesamlphp".d = {
    user = "mediawiki";
    group = "mediawiki";
    mode = "0770";
  };

-  users.groups.mediawiki.members = lib.mkIf cfg.enable [ "nginx" ];
+  users.groups.mediawiki.members = [ "nginx" ];

-  services.nginx.virtualHosts."wiki.pvv.ntnu.no" = lib.mkIf cfg.enable {
+  services.nginx.virtualHosts."wiki.pvv.ntnu.no" = {
    kTLS = true;
    forceSSL = true;
    enableACME = true;
@@ -278,12 +217,9 @@ in

      "= /PNG/PVV-logo.svg".alias = fp /assets/logo_blue_regular.svg;
      "= /PNG/PVV-logo.png".alias = fp /assets/logo_blue_regular.png;
-      "= /favicon.ico".alias =
-        pkgs.runCommandLocal "mediawiki-favicon.ico"
-          {
+      "= /favicon.ico".alias = pkgs.runCommandLocal "mediawiki-favicon.ico" {
        buildInputs = with pkgs; [ imagemagick ];
-          }
-          ''
+      } ''
        magick \
          ${fp /assets/logo_blue_regular.png} \
          -resize x64 \
@@ -297,26 +233,4 @@ in
    };

  };
-
-  systemd.services.mediawiki-init = lib.mkIf cfg.enable {
-    after = [ "sops-install-secrets.service" ];
-    serviceConfig = {
-      BindReadOnlyPaths = [
-        "/run/credentials/mediawiki-init.service/secret-key:/var/lib/mediawiki/secret.key"
-      ];
-      LoadCredential = [ "secret-key:${config.sops.secrets."mediawiki/secret-key".path}" ];
-      UMask = lib.mkForce "0007";
-    };
-  };
-
-  systemd.services.phpfpm-mediawiki = lib.mkIf cfg.enable {
-    after = [ "sops-install-secrets.service" ];
-    serviceConfig = {
-      BindReadOnlyPaths = [
-        "/run/credentials/phpfpm-mediawiki.service/secret-key:/var/lib/mediawiki/secret.key"
-      ];
-      LoadCredential = [ "secret-key:${config.sops.secrets."mediawiki/secret-key".path}" ];
-      UMask = lib.mkForce "0007";
-    };
-  };
 }
--- a/hosts/bekkalokk/services/phpfpm.nix
+++ b/hosts/bekkalokk/services/phpfpm.nix
@@ -11,8 +11,7 @@ in
 {
  # Source: https://www.pierreblazquez.com/2023/06/17/how-to-harden-apache-php-fpm-daemons-using-systemd/
  systemd.services = lib.genAttrs pools (_: {
-    serviceConfig =
-      let
+    serviceConfig = let
      caps = [
        "CAP_NET_BIND_SERVICE"
        "CAP_SETGID"
@@ -22,8 +21,7 @@ in
        "CAP_IPC_LOCK"
        "CAP_DAC_OVERRIDE"
      ];
-      in
-      {
+    in {
      AmbientCapabilities = caps;
      CapabilityBoundingSet = caps;
      DeviceAllow = [ "" ];
--- a/hosts/bekkalokk/services/vaultwarden.nix
+++ b/hosts/bekkalokk/services/vaultwarden.nix
@@ -1,18 +1,11 @@
-{
-  config,
-  pkgs,
-  lib,
-  values,
-  ...
-}:
+{ config, pkgs, lib, ... }:
 let
  cfg = config.services.vaultwarden;
  domain = "pw.pvv.ntnu.no";
  address = "127.0.1.2";
  port = 3011;
  wsPort = 3012;
-in
-{
+in {
  sops.secrets."vaultwarden/environ" = {
    owner = "vaultwarden";
    group = "vaultwarden";
@@ -106,21 +99,4 @@ in
      ];
    };
  };
-
-  services.rsync-pull-targets = {
-    enable = true;
-    locations."/var/lib/vaultwarden" = {
-      user = "root";
-      rrsyncArgs.ro = true;
-      authorizedKeysAttrs = [
-        "restrict"
-        "from=\"principal.pvv.ntnu.no,${values.hosts.principal.ipv6},${values.hosts.principal.ipv4}\""
-        "no-agent-forwarding"
-        "no-port-forwarding"
-        "no-pty"
-        "no-X11-forwarding"
-      ];
-      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB2cDaW52gBtLVaNqoGijvN2ZAVkAWlII5AXUzT3Dswj vaultwarden rsync backup";
-    };
-  };
 }
--- a/hosts/bekkalokk/services/webmail/default.nix
+++ b/hosts/bekkalokk/services/webmail/default.nix
@@ -1,10 +1,4 @@
-{
-  config,
-  values,
-  pkgs,
-  lib,
-  ...
-}:
+{ config, values, pkgs, lib, ... }:
 {
  imports = [
    ./roundcube.nix
--- a/hosts/bekkalokk/services/webmail/roundcube.nix
+++ b/hosts/bekkalokk/services/webmail/roundcube.nix
@@ -1,9 +1,4 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}:
+{ config, pkgs, lib, ... }:

 with lib;
 let
@@ -19,24 +14,14 @@ in
  services.roundcube = {
    enable = true;

-    package = pkgs.roundcube.withPlugins (
-      plugins: with plugins; [
+    package = pkgs.roundcube.withPlugins (plugins: with plugins; [
      persistent_login
      thunderbird_labels
      contextmenu
      custom_from
-      ]
-    );
+    ]);

-    dicts = with pkgs.aspellDicts; [
-      en
-      en-computers
-      nb
-      nn
-      fr
-      de
-      it
-    ];
+    dicts = with pkgs.aspellDicts; [ en en-computers nb nn fr de it ];
    maxAttachmentSize = 20;
    hostName = "roundcubeplaceholder.example.com";

@@ -69,8 +54,7 @@ in
        ln -s ${cfg.package} $out/roundcube
      '';
      extraConfig = ''
-        location ~ ^/roundcube/(${
-          builtins.concatStringsSep "|" [
+        location ~ ^/roundcube/(${builtins.concatStringsSep "|" [
        # https://wiki.archlinux.org/title/Roundcube
        "README"
        "INSTALL"
@@ -84,8 +68,7 @@ in
        "config"
        "temp"
        "logs"
-          ]
-        })/? {
+        ]})/? {
          deny all;
        }

--- a/hosts/bekkalokk/services/webmail/snappymail.nix
+++ b/hosts/bekkalokk/services/webmail/snappymail.nix
@@ -1,15 +1,7 @@
-{
-  config,
-  lib,
-  fp,
-  pkgs,
-  values,
-  ...
-}:
+{ config, lib, fp, pkgs, ... }:
 let
  cfg = config.services.snappymail;
-in
-{
+in {
  imports = [ (fp /modules/snappymail.nix) ];

  services.snappymail = {
@@ -22,21 +14,5 @@ in
    enableACME = true;
    kTLS = true;
  };
-
-  services.rsync-pull-targets = {
-    enable = true;
-    locations.${cfg.dataDir} = {
-      user = "root";
-      rrsyncArgs.ro = true;
-      authorizedKeysAttrs = [
-        "restrict"
-        "from=\"principal.pvv.ntnu.no,${values.hosts.principal.ipv6},${values.hosts.principal.ipv4}\""
-        "no-agent-forwarding"
-        "no-port-forwarding"
-        "no-pty"
-        "no-X11-forwarding"
-      ];
-      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJENMnuNsHEeA91oX+cj7Qpex2defSXP/lxznxCAqV03 snappymail rsync backup";
-    };
-  };
 }
+
--- a/hosts/bekkalokk/services/website/default.nix
+++ b/hosts/bekkalokk/services/website/default.nix
@@ -1,27 +1,18 @@
-{
-  pkgs,
-  lib,
-  config,
-  ...
-}:
+{ pkgs, lib, config, ... }:
 let
  format = pkgs.formats.php { };
  cfg = config.services.pvv-nettsiden;
-in
-{
+in {
  imports = [
    ./fetch-gallery.nix
  ];

-  sops.secrets =
-    lib.genAttrs
-      [
+  sops.secrets = lib.genAttrs [
    "nettsiden/door_secret"
    "nettsiden/mysql_password"
    "nettsiden/simplesamlphp/admin_password"
    "nettsiden/simplesamlphp/cookie_salt"
-      ]
-      (_: {
+  ] (_: {
    owner = config.services.phpfpm.pools.pvv-nettsiden.user;
    group = config.services.phpfpm.pools.pvv-nettsiden.group;
    restartUnits = [ "phpfpm-pvv-nettsiden.service" ];
@@ -44,10 +35,8 @@ in

    package = pkgs.pvv-nettsiden.override {
      extra_files = {
-        "${pkgs.pvv-nettsiden.passthru.simplesamlphpPath}/metadata/saml20-idp-remote.php" =
-          pkgs.writeText "pvv-nettsiden-saml20-idp-remote.php" (import ../idp-simplesamlphp/metadata.php.nix);
-        "${pkgs.pvv-nettsiden.passthru.simplesamlphpPath}/config/authsources.php" =
-          pkgs.writeText "pvv-nettsiden-authsources.php" ''
+        "${pkgs.pvv-nettsiden.passthru.simplesamlphpPath}/metadata/saml20-idp-remote.php" = pkgs.writeText "pvv-nettsiden-saml20-idp-remote.php" (import ../idp-simplesamlphp/metadata.php.nix);
+        "${pkgs.pvv-nettsiden.passthru.simplesamlphpPath}/config/authsources.php" = pkgs.writeText "pvv-nettsiden-authsources.php" ''
          <?php
          $config = array(
              'admin' => array(
@@ -65,12 +54,9 @@ in

    domainName = "www.pvv.ntnu.no";

-    settings =
-      let
-        includeFromSops =
-          path: format.lib.mkRaw "file_get_contents('${config.sops.secrets."nettsiden/${path}".path}')";
-      in
-      {
+    settings = let
+      includeFromSops = path: format.lib.mkRaw "file_get_contents('${config.sops.secrets."nettsiden/${path}".path}')";
+    in {
      DOOR_SECRET = includeFromSops "door_secret";

      DB = {
--- a/hosts/bekkalokk/services/website/fetch-gallery.nix
+++ b/hosts/bekkalokk/services/website/fetch-gallery.nix
@@ -1,37 +1,15 @@
-{
-  pkgs,
-  lib,
-  config,
-  values,
-  ...
-}:
+{ pkgs, lib, config, ... }:
 let
  galleryDir = config.services.pvv-nettsiden.settings.GALLERY.DIR;
  transferDir = "${config.services.pvv-nettsiden.settings.GALLERY.DIR}-transfer";
-in
-{
+in {
  users.users.${config.services.pvv-nettsiden.user} = {
-    # NOTE: the user unfortunately needs a registered shell for rrsync to function...
-    #       is there anything we can do to remove this?
    useDefaultShell = true;
-  };

    # This is pushed from microbel:/var/www/www-gallery/build-gallery.sh
-  services.rsync-pull-targets = {
-    enable = true;
-    locations.${transferDir} = {
-      user = config.services.pvv-nettsiden.user;
-      rrsyncArgs.wo = true;
-      authorizedKeysAttrs = [
-        "restrict"
-        "from=\"microbel.pvv.ntnu.no,${values.hosts.microbel.ipv6},${values.hosts.microbel.ipv4}\""
-        "no-agent-forwarding"
-        "no-port-forwarding"
-        "no-pty"
-        "no-X11-forwarding"
+    openssh.authorizedKeys.keys = [
+    ''command="${pkgs.rrsync}/bin/rrsync -wo ${transferDir}",restrict,no-agent-forwarding,no-port-forwarding,no-pty,no-X11-forwarding ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIjHhC2dikhWs/gG+m7qP1eSohWzTehn4ToNzDSOImyR gallery-publish''
    ];
-      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIjHhC2dikhWs/gG+m7qP1eSohWzTehn4ToNzDSOImyR gallery-publish";
-    };
  };

  systemd.paths.pvv-nettsiden-gallery-update = {
@@ -44,20 +22,14 @@ in
  };

  systemd.services.pvv-nettsiden-gallery-update = {
-    path = with pkgs; [
-      imagemagick
-      gnutar
-      gzip
-    ];
+    path = with pkgs; [ imagemagick gnutar gzip ];

    script = ''
-      tar ${
-        lib.cli.toGNUCommandLineShell { } {
+      tar ${lib.cli.toGNUCommandLineShell {} {
        extract = true;
        file = "${transferDir}/gallery.tar.gz";
        directory = ".";
-        }
-      }
+      }}

      # Delete files and directories that exists in the gallery that don't exist in the tarball
      filesToRemove=$(uniq -u <(sort <(find . -not -path "./.thumbnails*") <(tar -tf ${transferDir}/gallery.tar.gz | sed 's|/$||')))
--- a/hosts/bekkalokk/services/well-known/default.nix
+++ b/hosts/bekkalokk/services/well-known/default.nix
@@ -1,14 +1,11 @@
 { lib, ... }:
 {
-  services.nginx.virtualHosts =
-    lib.genAttrs
-      [
+  services.nginx.virtualHosts = lib.genAttrs [
    "pvv.ntnu.no"
    "www.pvv.ntnu.no"
    "pvv.org"
    "www.pvv.org"
-      ]
-      (_: {
+  ] (_: {
    locations = {
      "^~ /.well-known/" = {
        alias = (toString ./root) + "/";
--- a/hosts/bekkalokk/services/well-known/root/security.txt
+++ b/hosts/bekkalokk/services/well-known/root/security.txt
@@ -6,11 +6,7 @@ Contact: mailto:cert@pvv.ntnu.no
 Preferred-Languages: no, en

 Expires: 2032-12-31T23:59:59.000Z
-# This file was last updated 2026-02-27.
+# This file was last updated 2024-09-14.

 # You can find a wikipage for our security policies at:
 # https://wiki.pvv.ntnu.no/wiki/CERT
-
-# Please note that we are a student organization, and unfortunately we do not
-# have a bug bounty program or offer monetary compensation for disclosure of
-# security vulnerabilities.
--- a/hosts/bicep/configuration.nix
+++ b/hosts/bicep/configuration.nix
@@ -1,9 +1,4 @@
-{
-  fp,
-  pkgs,
-  values,
-  ...
-}:
+{ fp, pkgs, values, ... }:
 {
  imports = [
    ./hardware-configuration.nix
@@ -14,8 +9,8 @@
    ./services/calendar-bot.nix
    #./services/git-mirrors
    ./services/minecraft-heatmap.nix
-    ./services/mysql
-    ./services/postgresql
+    ./services/mysql.nix
+    ./services/postgres.nix

    ./services/matrix
  ];
@@ -24,16 +19,8 @@
  systemd.network.networks."30-ens18" = values.defaultNetworkConfig // {
    #matchConfig.Name = "enp6s0f0";
    matchConfig.Name = "ens18";
-    address =
-      with values.hosts.bicep;
-      [
-        (ipv4 + "/25")
-        (ipv6 + "/64")
-      ]
-      ++ (with values.services.turn; [
-        (ipv4 + "/25")
-        (ipv6 + "/64")
-      ]);
+    address = with values.hosts.bicep; [ (ipv4 + "/25") (ipv6 + "/64") ]
+      ++ (with values.services.turn; [ (ipv4 + "/25") (ipv6 + "/64") ]);
  };
  systemd.network.wait-online = {
    anyInterface = true;
@@ -43,5 +30,5 @@

  # Don't change (even during upgrades) unless you know what you are doing.
  # See https://search.nixos.org/options?show=system.stateVersion
-  system.stateVersion = "25.11";
+  system.stateVersion = "22.11";
 }
--- a/hosts/bicep/hardware-configuration.nix
+++ b/hosts/bicep/hardware-configuration.nix
@@ -1,48 +1,33 @@
 # Do not modify this file!  It was generated by 'nixos-generate-config'
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{
-  config,
-  lib,
-  pkgs,
-  modulesPath,
-  ...
-}:
+{ config, lib, pkgs, modulesPath, ... }:

 {
-  imports = [
-    (modulesPath + "/profiles/qemu-guest.nix")
+  imports =
+    [ (modulesPath + "/profiles/qemu-guest.nix")
    ];

-  boot.initrd.availableKernelModules = [
-    "ata_piix"
-    "uhci_hcd"
-    "ahci"
-    "sd_mod"
-    "sr_mod"
-  ];
+  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "ahci" "sd_mod" "sr_mod" ];
  boot.initrd.kernelModules = [ ];
  boot.kernelModules = [ ];
  boot.extraModulePackages = [ ];

-  fileSystems."/" = {
-    device = "/dev/disk/by-uuid/20e06202-7a09-47cc-8ef6-5e7afe19453a";
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/20e06202-7a09-47cc-8ef6-5e7afe19453a";
      fsType = "ext4";
    };

  # temp data disk, only 128gb not enough until we can add another disk to the system.
-  fileSystems."/data" = {
-    device = "/dev/disk/by-uuid/c81af266-0781-4084-b8eb-c2587cbcf1ba";
+  fileSystems."/data" =
+    { device = "/dev/disk/by-uuid/c81af266-0781-4084-b8eb-c2587cbcf1ba";
      fsType = "ext4";
    };

-  fileSystems."/boot" = {
-    device = "/dev/disk/by-uuid/198B-E363";
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/198B-E363";
      fsType = "vfat";
-    options = [
-      "fmask=0022"
-      "dmask=0022"
-    ];
+      options = [ "fmask=0022" "dmask=0022" ];
    };

  swapDevices = [ ];
--- a/hosts/bicep/services/calendar-bot.nix
+++ b/hosts/bicep/services/calendar-bot.nix
@@ -1,14 +1,7 @@
-{
-  config,
-  fp,
-  lib,
-  pkgs,
-  ...
-}:
+{ config, fp, lib, pkgs, ... }:
 let
  cfg = config.services.pvv-calendar-bot;
-in
-{
+in {
  sops.secrets = {
    "calendar-bot/matrix_token" = {
      sopsFile = fp /secrets/bicep/bicep.yaml;
--- a/hosts/bicep/services/git-mirrors/default.nix
+++ b/hosts/bicep/services/git-mirrors/default.nix
@@ -1,10 +1,4 @@
-{
-  config,
-  pkgs,
-  lib,
-  fp,
-  ...
-}:
+{ config, pkgs, lib, fp, ... }:
 let
  cfg = config.services.gickup;
 in
@@ -26,16 +20,14 @@ in
      lfs = false;
    };

-    instances =
-      let
+    instances = let
      defaultGithubConfig = {
        settings.token_file = config.sops.secrets."gickup/github-token".path;
      };
      defaultGitlabConfig = {
        # settings.token_file = ...
      };
-      in
-      {
+    in {
      "github:Git-Mediawiki/Git-Mediawiki" = defaultGithubConfig;
      "github:NixOS/nixpkgs" = defaultGithubConfig;
      "github:go-gitea/gitea" = defaultGithubConfig;
@@ -66,11 +58,9 @@ in
    };
  };

-  services.cgit =
-    let
+  services.cgit = let
    domain = "mirrors.pvv.ntnu.no";
-    in
-    {
+  in {
    ${domain} = {
      enable = true;
      package = pkgs.callPackage (fp /packages/cgit.nix) { };
@@ -96,18 +86,13 @@ in
    forceSSL = true;
    enableACME = true;

-    locations."= /PVV-logo.png".alias =
-      let
-        small-pvv-logo =
-          pkgs.runCommandLocal "pvv-logo-96x96"
-            {
+    locations."= /PVV-logo.png".alias = let
+      small-pvv-logo = pkgs.runCommandLocal "pvv-logo-96x96" {
        nativeBuildInputs = [ pkgs.imagemagick ];
-            }
-            ''
+      } ''
        magick '${fp /assets/logo_blue_regular.svg}' -resize 96x96 PNG:"$out"
      '';
-      in
-      toString small-pvv-logo;
+    in toString small-pvv-logo;
  };

  systemd.services."fcgiwrap-cgit-mirrors.pvv.ntnu.no" = {
--- a/hosts/bicep/services/matrix/coturn.nix
+++ b/hosts/bicep/services/matrix/coturn.nix
@@ -1,12 +1,4 @@
-{
-  config,
-  lib,
-  fp,
-  pkgs,
-  secrets,
-  values,
-  ...
-}:
+{ config, lib, fp, pkgs, secrets, values, ... }:

 {
  sops.secrets."matrix/coturn/static-auth-secret" = {
@@ -135,30 +127,17 @@
  };

  networking.firewall = {
-    interfaces.enp6s0f0 =
-      let
-        range = with config.services.coturn; [
-          {
+    interfaces.enp6s0f0 = let
+      range = with config.services.coturn; [ {
      from = min-port;
      to = max-port;
-          }
-        ];
+    } ];
    in
    {
      allowedUDPPortRanges = range;
-        allowedUDPPorts = [
-          443
-          3478
-          3479
-          5349
-        ];
+      allowedUDPPorts = [ 443 3478 3479 5349 ];
      allowedTCPPortRanges = range;
-        allowedTCPPorts = [
-          443
-          3478
-          3479
-          5349
-        ];
+      allowedTCPPorts = [ 443 3478 3479 5349 ];
    };
  };

--- a/hosts/bicep/services/matrix/default.nix
+++ b/hosts/bicep/services/matrix/default.nix
@@ -1,9 +1,8 @@
 { config, ... }:
 {
  imports = [
-    ./synapse-admin.nix
-    ./synapse-auto-compressor.nix
    ./synapse.nix
+    ./synapse-admin.nix
    ./element.nix
    ./coturn.nix
    ./livekit.nix
--- a/hosts/bicep/services/matrix/discord.nix
+++ b/hosts/bicep/services/matrix/discord.nix
@@ -1,9 +1,4 @@
-{
-  config,
-  lib,
-  fp,
-  ...
-}:
+{ config, lib, fp, ... }:

 let
  cfg = config.services.mx-puppet-discord;
@@ -49,6 +44,7 @@ in
    ];
  };

+
  services.mx-puppet-discord.enable = false;
  services.mx-puppet-discord.settings = {
    bridge = {
@@ -56,21 +52,16 @@ in
      domain = "pvv.ntnu.no";
      homeserverUrl = "https://matrix.pvv.ntnu.no";
    };
-    provisioning.whitelist = [
-      "@dandellion:dodsorf\\.as"
-      "@danio:pvv\\.ntnu\\.no"
-    ];
+    provisioning.whitelist = [ "@dandellion:dodsorf\\.as" "@danio:pvv\\.ntnu\\.no"];
    relay.whitelist = [ ".*" ];
-    selfService.whitelist = [
-      "@danio:pvv\\.ntnu\\.no"
-      "@dandellion:dodsorf\\.as"
-    ];
+    selfService.whitelist = [ "@danio:pvv\\.ntnu\\.no" "@dandellion:dodsorf\\.as" ];
  };
  services.mx-puppet-discord.serviceDependencies = [
    "matrix-synapse.target"
    "nginx.service"
  ];

+
  services.matrix-synapse-next.settings = {
    app_service_config_files = [
      config.sops.templates."discord-registration.yaml".path
--- a/hosts/bicep/services/matrix/element.nix
+++ b/hosts/bicep/services/matrix/element.nix
@@ -1,13 +1,7 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
+{ config, lib, pkgs, ... }:
 let
  synapse-cfg = config.services.matrix-synapse-next;
-in
-{
+in {
  services.pvv-matrix-well-known.client = {
    "m.homeserver" = {
      base_url = "https://matrix.pvv.ntnu.no";
@@ -43,7 +37,6 @@ in
          # element call group calls
          feature_group_calls = true;
        };
-        default_country_code = "NO";
        default_theme = "dark";
        # Servers in this list should provide some sort of valuable scoping
        # matrix.org is not useful compared to matrixrooms.info,
--- a/hosts/bicep/services/matrix/hookshot/default.nix
+++ b/hosts/bicep/services/matrix/hookshot/default.nix
@@ -1,11 +1,4 @@
-{
-  config,
-  lib,
-  fp,
-  unstablePkgs,
-  inputs,
-  ...
-}:
+{ config, lib, fp, unstablePkgs, inputs, ... }:

 let
  cfg = config.services.matrix-hookshot;
@@ -21,10 +14,6 @@ in
    sopsFile = fp /secrets/bicep/matrix.yaml;
    key = "hookshot/hs_token";
  };
-  sops.secrets."matrix/hookshot/passkey" = {
-    sopsFile = fp /secrets/bicep/matrix.yaml;
-    key = "hookshot/passkey";
-  };

  sops.templates."hookshot-registration.yaml" = {
    owner = config.users.users.matrix-synapse.name;
@@ -55,14 +44,9 @@ in
  };

  systemd.services.matrix-hookshot = {
-    serviceConfig = {
-      SupplementaryGroups = [
+    serviceConfig.SupplementaryGroups = [
      config.users.groups.keys-matrix-registrations.name
    ];
-      LoadCredential = [
-        "passkey.pem:${config.sops.secrets."matrix/hookshot/passkey".path}"
-      ];
-    };
  };

  services.matrix-hookshot = {
@@ -70,8 +54,6 @@ in
    package = unstablePkgs.matrix-hookshot;
    registrationFile = config.sops.templates."hookshot-registration.yaml".path;
    settings = {
-      passFile = "/run/credentials/matrix-hookshot.service/passkey.pem";
-
      bridge = {
        bindAddress = "127.0.0.1";
        domain = "pvv.ntnu.no";
@@ -79,7 +61,6 @@ in
        mediaUrl = "https://matrix.pvv.ntnu.no";
        port = 9993;
      };
-
      listeners = [
        {
          bindAddress = webhookListenAddress;
@@ -92,7 +73,6 @@ in
          ];
        }
      ];
-
      generic = {
        enabled = true;
        outbound = true;
@@ -107,8 +87,7 @@ in
      };

      serviceBots = [
-        {
-          localpart = "bot_feeds";
+        { localpart = "bot_feeds";
          displayname = "Aya";
          avatar = ./feeds.png;
          prefix = "!aya";
@@ -123,44 +102,20 @@ in

      permissions = [
        # Users of the PVV Server
-        {
-          actor = "pvv.ntnu.no";
-          services = [
-            {
-              service = "*";
-              level = "commands";
-            }
-          ];
+        { actor = "pvv.ntnu.no";
+          services = [ { service = "*"; level = "commands"; } ];
        }
        # Members of Medlem space (for people with their own hs)
-        {
-          actor = "!pZOTJQinWyyTWaeOgK:pvv.ntnu.no";
-          services = [
-            {
-              service = "*";
-              level = "commands";
-            }
-          ];
+        { actor = "!pZOTJQinWyyTWaeOgK:pvv.ntnu.no";
+          services = [ { service = "*"; level = "commands"; } ];
        }
        # Members of Drift
-        {
-          actor = "!eYgeufLrninXxQpYml:pvv.ntnu.no";
-          services = [
-            {
-              service = "*";
-              level = "admin";
-            }
-          ];
+        { actor = "!eYgeufLrninXxQpYml:pvv.ntnu.no";
+          services = [ { service = "*"; level = "admin"; } ];
        }
        # Dan bootstrap
-        {
-          actor = "@dandellion:dodsorf.as";
-          services = [
-            {
-              service = "*";
-              level = "admin";
-            }
-          ];
+        { actor = "@dandellion:dodsorf.as";
+          services = [ { service = "*"; level = "admin"; } ];
        }
      ];
    };
--- a/hosts/bicep/services/matrix/livekit.nix
+++ b/hosts/bicep/services/matrix/livekit.nix
@@ -1,9 +1,4 @@
-{
-  config,
-  lib,
-  fp,
-  ...
-}:
+{ config, lib, fp, ... }:
 let
  synapseConfig = config.services.matrix-synapse-next;
  matrixDomain = "matrix.pvv.ntnu.no";
@@ -25,12 +20,10 @@ in
  };

  services.pvv-matrix-well-known.client = lib.mkIf cfg.enable {
-    "org.matrix.msc4143.rtc_foci" = [
-      {
+    "org.matrix.msc4143.rtc_foci" = [{
      type = "livekit";
      livekit_service_url = "https://${matrixDomain}/livekit/jwt";
-      }
-    ];
+    }];
  };

  services.livekit = {
@@ -50,12 +43,7 @@ in
    keyFile = config.sops.templates."matrix-livekit-keyfile".path;
  };

-  systemd.services.lk-jwt-service.environment.LIVEKIT_FULL_ACCESS_HOMESERVERS = lib.mkIf cfg.enable (
-    builtins.concatStringsSep "," [
-      "pvv.ntnu.no"
-      "dodsorf.as"
-    ]
-  );
+  systemd.services.lk-jwt-service.environment.LIVEKIT_FULL_ACCESS_HOMESERVERS = lib.mkIf cfg.enable matrixDomain;

  services.nginx.virtualHosts.${matrixDomain} = lib.mkIf cfg.enable {
    locations."^~ /livekit/jwt/" = {
--- a/hosts/bicep/services/matrix/mjolnir.nix
+++ b/hosts/bicep/services/matrix/mjolnir.nix
@@ -1,9 +1,4 @@
-{
-  config,
-  lib,
-  fp,
-  ...
-}:
+{ config, lib, fp, ... }:

 {
  sops.secrets."matrix/mjolnir/access_token" = {
--- a/hosts/bicep/services/matrix/out-of-your-element.nix
+++ b/hosts/bicep/services/matrix/out-of-your-element.nix
@@ -1,11 +1,4 @@
-{
-  config,
-  pkgs,
-  lib,
-  values,
-  fp,
-  ...
-}:
+{ config, pkgs, fp, ... }:
 let
  cfg = config.services.matrix-ooye;
 in
@@ -35,23 +28,6 @@ in
    };
  };

-  services.rsync-pull-targets = lib.mkIf cfg.enable {
-    enable = true;
-    locations."/var/lib/private/matrix-ooye" = {
-      user = "root";
-      rrsyncArgs.ro = true;
-      authorizedKeysAttrs = [
-        "restrict"
-        "from=\"principal.pvv.ntnu.no,${values.hosts.principal.ipv6},${values.hosts.principal.ipv4}\""
-        "no-agent-forwarding"
-        "no-port-forwarding"
-        "no-pty"
-        "no-X11-forwarding"
-      ];
-      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE5koYfor5+kKB30Dugj3dAWvmj8h/akQQ2XYDvLobFL matrix_ooye rsync backup";
-    };
-  };
-
  services.matrix-ooye = {
    enable = true;
    homeserver = "https://matrix.pvv.ntnu.no";
--- a/hosts/bicep/services/matrix/smtp-authenticator/default.nix
+++ b/hosts/bicep/services/matrix/smtp-authenticator/default.nix
@@ -1,9 +1,4 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchFromGitHub,
-  setuptools,
-}:
+{ lib, buildPythonPackage, fetchFromGitHub, setuptools }:

 buildPythonPackage rec {
  pname = "matrix-synapse-smtp-auth";
--- a/hosts/bicep/services/matrix/synapse-admin.nix
+++ b/hosts/bicep/services/matrix/synapse-admin.nix
@@ -1,9 +1,5 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
+{ config, lib, pkgs, ... }:
+

 # This service requires you to have access to endpoints not available over the internet
 # Use an ssh proxy or similar to access this dashboard.
--- a/hosts/bicep/services/matrix/synapse-auto-compressor.nix
+++ b/hosts/bicep/services/matrix/synapse-auto-compressor.nix
@@ -1,61 +0,0 @@
-{
-  config,
-  lib,
-  utils,
-  ...
-}:
-let
-  cfg = config.services.synapse-auto-compressor;
-in
-{
-  services.synapse-auto-compressor = {
-    # enable = true;
-    postgresUrl = "postgresql://matrix-synapse@/synapse?host=/run/postgresql";
-  };
-
-  # NOTE: nixpkgs has some broken asserts, vendored the entire unit
-  systemd.services.synapse-auto-compressor = {
-    description = "synapse-auto-compressor";
-    requires = [
-      "postgresql.target"
-    ];
-    inherit (cfg) startAt;
-    serviceConfig = {
-      Type = "oneshot";
-      DynamicUser = true;
-      User = "matrix-synapse";
-      PrivateTmp = true;
-      ExecStart = utils.escapeSystemdExecArgs [
-        "${cfg.package}/bin/synapse_auto_compressor"
-        "-p"
-        cfg.postgresUrl
-        "-c"
-        cfg.settings.chunk_size
-        "-n"
-        cfg.settings.chunks_to_compress
-        "-l"
-        (lib.concatStringsSep "," (map toString cfg.settings.levels))
-      ];
-      LockPersonality = true;
-      MemoryDenyWriteExecute = true;
-      NoNewPrivileges = true;
-      PrivateDevices = true;
-      PrivateMounts = true;
-      PrivateUsers = true;
-      RemoveIPC = true;
-      RestrictNamespaces = true;
-      RestrictRealtime = true;
-      RestrictSUIDSGID = true;
-      ProcSubset = "pid";
-      ProtectProc = "invisible";
-      ProtectSystem = "strict";
-      ProtectHome = true;
-      ProtectHostname = true;
-      ProtectClock = true;
-      ProtectKernelTunables = true;
-      ProtectKernelModules = true;
-      ProtectKernelLogs = true;
-      ProtectControlGroups = true;
-    };
-  };
-}
--- a/hosts/bicep/services/matrix/synapse.nix
+++ b/hosts/bicep/services/matrix/synapse.nix
@@ -1,23 +1,13 @@
-{
-  config,
-  lib,
-  fp,
-  pkgs,
-  values,
-  inputs,
-  ...
-}:
+{ config, lib, fp, pkgs, values, inputs, ... }:

 let
  cfg = config.services.matrix-synapse-next;

  matrix-lib = inputs.matrix-next.lib;

-  imap0Attrs =
-    with lib;
-    f: set: listToAttrs (imap0 (i: attr: nameValuePair attr (f i attr set.${attr})) (attrNames set));
-in
-{
+  imap0Attrs = with lib; f: set:
+    listToAttrs (imap0 (i: attr: nameValuePair attr (f i attr set.${attr})) (attrNames set));
+in {
  sops.secrets."matrix/synapse/signing_key" = {
    key = "synapse/signing_key";
    sopsFile = fp /secrets/bicep/matrix.yaml;
@@ -33,29 +23,10 @@ in
    owner = config.users.users.matrix-synapse.name;
    group = config.users.users.matrix-synapse.group;
    content = ''
-      registration_shared_secret: ${
-        config.sops.placeholder."matrix/synapse/user_registration/registration_shared_secret"
-      }
+      registration_shared_secret: ${config.sops.placeholder."matrix/synapse/user_registration/registration_shared_secret"}
    '';
  };

-  services.rsync-pull-targets = {
-    enable = true;
-    locations.${cfg.settings.media_store_path} = {
-      user = "root";
-      rrsyncArgs.ro = true;
-      authorizedKeysAttrs = [
-        "restrict"
-        "from=\"principal.pvv.ntnu.no,${values.hosts.principal.ipv6},${values.hosts.principal.ipv4}\""
-        "no-agent-forwarding"
-        "no-port-forwarding"
-        "no-pty"
-        "no-X11-forwarding"
-      ];
-      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIASnjI9b3j4ZS3BL/D1ggHfws1BkE8iS0v0cGpEmbG+k matrix_media_store rsync backup";
-    };
-  };
-
  services.matrix-synapse-next = {
    enable = true;

@@ -122,8 +93,7 @@ in
      password_config.enabled = true;

      modules = [
-        {
-          module = "smtp_auth_provider.SMTPAuthProvider";
+        { module = "smtp_auth_provider.SMTPAuthProvider";
          config = {
            smtp_host = "smtp.pvv.ntnu.no";
          };
@@ -212,30 +182,22 @@ in
    };
  }
  {
-      locations =
-        let
+    locations = let
      connectionInfo = w: matrix-lib.workerConnectionResource "metrics" w;
-          socketAddress =
-            w:
-            let
-              c = connectionInfo w;
-            in
-            "${c.host}:${toString c.port}";
+      socketAddress = w: let c = connectionInfo w; in "${c.host}:${toString c.port}";

      metricsPath = w: "/metrics/${w.type}/${toString w.index}";
      proxyPath = w: "http://${socketAddress w}/_synapse/metrics";
-        in
-        lib.mapAttrs' (
-          n: v:
-          lib.nameValuePair (metricsPath v) {
+    in lib.mapAttrs' (n: v: lib.nameValuePair
+      (metricsPath v) {
        proxyPass = proxyPath v;
        extraConfig = ''
          allow ${values.hosts.ildkule.ipv4};
          allow ${values.hosts.ildkule.ipv6};
          deny all;
        '';
-          }
-        ) cfg.workers.instances;
+      })
+      cfg.workers.instances;
  }
  {
    locations."/metrics/master/1" = {
@@ -247,28 +209,18 @@ in
      '';
    };

-      locations."/metrics/" =
-        let
-          endpoints =
-            lib.pipe cfg.workers.instances [
+    locations."/metrics/" = let
+      endpoints = lib.pipe cfg.workers.instances [
        (lib.mapAttrsToList (_: v: v))
        (map (w: "${w.type}/${toString w.index}"))
        (map (w: "matrix.pvv.ntnu.no/metrics/${w}"))
-            ]
-            ++ [ "matrix.pvv.ntnu.no/metrics/master/1" ];
-        in
-        {
-          alias =
-            pkgs.writeTextDir "/config.json" (
-              builtins.toJSON [
-                {
-                  targets = endpoints;
+      ] ++ [ "matrix.pvv.ntnu.no/metrics/master/1" ];
+    in {
+      alias = pkgs.writeTextDir "/config.json"
+        (builtins.toJSON [
+          { targets = endpoints;
            labels = { };
-                }
-              ]
-            )
-            + "/";
+          }]) + "/";
    };
-    }
-  ];
+  }];
 }
--- a/hosts/bicep/services/matrix/well-known.nix
+++ b/hosts/bicep/services/matrix/well-known.nix
@@ -1,9 +1,4 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}:
+{ config, pkgs, lib, ... }:
 let
  cfg = config.services.pvv-matrix-well-known;
  format = pkgs.formats.json { };
--- a/hosts/bicep/services/minecraft-heatmap.nix
+++ b/hosts/bicep/services/minecraft-heatmap.nix
@@ -1,9 +1,4 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
+{ config, lib, pkgs, ... }:
 let
  cfg = config.services.minecraft-heatmap;
 in
@@ -27,20 +22,18 @@ in
    };
  };

-  systemd.services.minecraft-heatmap-ingest-logs = lib.mkIf cfg.enable {
+  systemd.services.minecraft-heatmap-ingest-logs = {
    serviceConfig.LoadCredential = [
      "sshkey:${config.sops.secrets."minecraft-heatmap/ssh-key/private".path}"
    ];

-    preStart =
-      let
+    preStart = let
      knownHostsFile = pkgs.writeText "minecraft-heatmap-known-hosts" ''
        innovation.pvv.ntnu.no ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE9O/y5uqcLKCodg2Q+XfZPH/AoUIyBlDhigImU+4+Kn
        innovation.pvv.ntnu.no ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQClR9GvWeVPZHudlnFXhGHUX5sGX9nscsOsotnlQ4uVuGsgvRifsVsuDULlAFXwoV1tYp4vnyXlsVtMddpLI5ANOIDcZ4fgDxpfSQmtHKssNpDcfMhFJbfRVyacipjA4osxTxvLox/yjtVt+URjTHUA1MWzEwc26KfiOvWO5tCBTan7doN/4KOyT05GwBxwzUAwUmoGTacIITck2Y9qp4+xFYqehbXqPdBb15hFyd38OCQhtU1hWV2Yi18+hJ4nyjc/g5pr6mW09ULlFghe/BaTUXrTisYC6bMcJZsTDwsvld9581KPvoNZOTQhZPTEQCZZ1h54fe0ZHuveVB3TIHovZyjoUuaf4uiFOjJVaKRB+Ig+Il6r7tMUn9CyHtus/Nd86E0TFBzoKxM0OFu88oaUlDtZVrUJL5En1lGoimajebb1JPxllFN5hqIT+gVyMY6nRzkcfS7ieny/U4rzXY2rfz98selftgh3LsBywwADv65i+mPw1A/1QdND1R6fV4U=
        innovation.pvv.ntnu.no ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBNjl3HfsDqmALWCL9uhz9k93RAD2565ndBqUh4N/rvI7MCwEJ6iRCdDev0YzB1Fpg24oriyYoxZRP24ifC2sQf8=
      '';
-      in
-      ''
+    in ''
      mkdir -p '${cfg.minecraftLogsDir}'
      "${lib.getExe pkgs.rsync}" \
      --archive \
--- a/hosts/bicep/services/mysql.nix
+++ b/hosts/bicep/services/mysql.nix
@@ -0,0 +1,55 @@
+{ pkgs, lib, config, values, ... }:
+{
+  sops.secrets."mysql/password" = {
+    owner = "mysql";
+    group = "mysql";
+  };
+
+  users.mysql.passwordFile = config.sops.secrets."mysql/password".path;
+
+  services.mysql = {
+    enable = true;
+    dataDir = "/data/mysql";
+    package = pkgs.mariadb;
+    settings = {
+      mysqld = {
+        # PVV allows a lot of connections at the same time
+        max_connect_errors = 10000;
+        bind-address = values.services.mysql.ipv4;
+        skip-networking = 0;
+
+        # This was needed in order to be able to use all of the old users
+        # during migration from knakelibrak to bicep in Sep. 2023
+        secure_auth = 0;
+      };
+    };
+
+    # Note: This user also has MAX_USER_CONNECTIONS set to 3, and
+    #       a password which can be found in /secrets/ildkule/ildkule.yaml
+    #       We have also changed both the host and auth plugin of this user
+    #       to be 'ildkule.pvv.ntnu.no' and 'mysql_native_password' respectively.
+    ensureUsers = [{
+      name = "prometheus_mysqld_exporter";
+      ensurePermissions = {
+        "*.*" = "PROCESS, REPLICATION CLIENT, SELECT, SLAVE MONITOR";
+      };
+    }];
+  };
+
+  services.mysqlBackup = {
+    enable = true;
+    location = "/var/lib/mysql/backups";
+  };
+
+  networking.firewall.allowedTCPPorts = [ 3306 ];
+
+  systemd.services.mysql.serviceConfig = {
+    IPAddressDeny = "any";
+    IPAddressAllow = [
+      values.ipv4-space
+      values.ipv6-space
+      values.hosts.ildkule.ipv4
+      values.hosts.ildkule.ipv6
+    ];
+  };
+}
--- a/hosts/bicep/services/mysql/backup.nix
+++ b/hosts/bicep/services/mysql/backup.nix
@@ -1,91 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  values,
-  ...
-}:
-let
-  cfg = config.services.mysql;
-  backupDir = "/data/mysql-backups";
-in
-{
-  # services.mysqlBackup = lib.mkIf cfg.enable {
-  #   enable = true;
-  #   location = "/var/lib/mysql-backups";
-  # };
-
-  systemd.tmpfiles.settings."10-mysql-backups".${backupDir}.d = {
-    user = "mysql";
-    group = "mysql";
-    mode = "700";
-  };
-
-  services.rsync-pull-targets = lib.mkIf cfg.enable {
-    enable = true;
-    locations.${backupDir} = {
-      user = "root";
-      rrsyncArgs.ro = true;
-      authorizedKeysAttrs = [
-        "restrict"
-        "from=\"principal.pvv.ntnu.no,${values.hosts.principal.ipv6},${values.hosts.principal.ipv4}\""
-        "no-agent-forwarding"
-        "no-port-forwarding"
-        "no-pty"
-        "no-X11-forwarding"
-      ];
-      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJgj55/7Cnj4cYMJ5sIkl+OwcGeBe039kXJTOf2wvo9j mysql rsync backup";
-    };
-  };
-
-  # NOTE: instead of having the upstream nixpkgs postgres backup unit trigger
-  #       another unit, it was easier to just make one ourselves.
-  systemd.services."backup-mysql" = lib.mkIf cfg.enable {
-    description = "Backup MySQL data";
-    requires = [ "mysql.service" ];
-
-    path = with pkgs; [
-      cfg.package
-      coreutils
-      zstd
-    ];
-
-    script =
-      let
-        rotations = 2;
-      in
-      ''
-        set -euo pipefail
-
-        OUT_FILE="$STATE_DIRECTORY/mysql-dump-$(date --iso-8601).sql.zst"
-
-        mysqldump --all-databases | zstd --compress -9 --rsyncable -o "$OUT_FILE"
-
-        # NOTE: this needs to be a hardlink for rrsync to allow sending it
-        rm "$STATE_DIRECTORY/mysql-dump-latest.sql.zst" ||:
-        ln -T "$OUT_FILE" "$STATE_DIRECTORY/mysql-dump-latest.sql.zst"
-
-        while [ "$(find "$STATE_DIRECTORY" -type f -printf '.' | wc -c)" -gt ${toString (rotations + 1)} ]; do
-          rm "$(find "$STATE_DIRECTORY" -type f -printf '%T+ %p\n' | sort | head -n 1 | cut -d' ' -f2)"
-        done
-      '';
-
-    serviceConfig = {
-      Type = "oneshot";
-      User = "mysql";
-      Group = "mysql";
-      UMask = "0077";
-
-      Nice = 19;
-      IOSchedulingClass = "best-effort";
-      IOSchedulingPriority = 7;
-
-      StateDirectory = [ "mysql-backups" ];
-      BindPaths = [ "${backupDir}:/var/lib/mysql-backups" ];
-
-      # TODO: hardening
-    };
-
-    startAt = "*-*-* 02:15:00";
-  };
-}
--- a/hosts/bicep/services/mysql/default.nix
+++ b/hosts/bicep/services/mysql/default.nix
@@ -1,82 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  values,
-  ...
-}:
-let
-  cfg = config.services.mysql;
-  dataDir = "/data/mysql";
-in
-{
-  imports = [ ./backup.nix ];
-
-  sops.secrets."mysql/password" = {
-    owner = "mysql";
-    group = "mysql";
-  };
-
-  users.mysql.passwordFile = config.sops.secrets."mysql/password".path;
-
-  services.mysql = {
-    enable = true;
-    package = pkgs.mariadb_118;
-    settings = {
-      mysqld = {
-        # PVV allows a lot of connections at the same time
-        max_connect_errors = 10000;
-        bind-address = values.services.mysql.ipv4;
-        skip-networking = 0;
-
-        # This was needed in order to be able to use all of the old users
-        # during migration from knakelibrak to bicep in Sep. 2023
-        secure_auth = 0;
-
-        slow-query-log = 1;
-        slow-query-log-file = "/var/log/mysql/mysql-slow.log";
-      };
-    };
-
-    # Note: This user also has MAX_USER_CONNECTIONS set to 3, and
-    #       a password which can be found in /secrets/ildkule/ildkule.yaml
-    #       We have also changed both the host and auth plugin of this user
-    #       to be 'ildkule.pvv.ntnu.no' and 'mysql_native_password' respectively.
-    ensureUsers = [
-      {
-        name = "prometheus_mysqld_exporter";
-        ensurePermissions = {
-          "*.*" = "PROCESS, REPLICATION CLIENT, SELECT, SLAVE MONITOR";
-        };
-      }
-    ];
-  };
-
-  networking.firewall.allowedTCPPorts = lib.mkIf cfg.enable [ 3306 ];
-
-  systemd.tmpfiles.settings."10-mysql".${dataDir}.d = lib.mkIf cfg.enable {
-    inherit (cfg) user group;
-    mode = "0700";
-  };
-
-  systemd.services.mysql = lib.mkIf cfg.enable {
-    after = [
-      "systemd-tmpfiles-setup.service"
-      "systemd-tmpfiles-resetup.service"
-    ];
-
-    serviceConfig = {
-      BindPaths = [ "${dataDir}:${cfg.dataDir}" ];
-
-      LogsDirectory = "mysql";
-
-      IPAddressDeny = "any";
-      IPAddressAllow = [
-        values.ipv4-space
-        values.ipv6-space
-        values.hosts.ildkule.ipv4
-        values.hosts.ildkule.ipv6
-      ];
-    };
-  };
-}
--- a/hosts/bicep/services/postgresql/default.nix
+++ b/hosts/bicep/services/postgresql/default.nix
@@ -1,19 +1,8 @@
+{ config, pkgs, values, ... }:
 {
-  config,
-  lib,
-  pkgs,
-  values,
-  ...
-}:
-let
-  cfg = config.services.postgresql;
-in
-{
-  imports = [ ./backup.nix ];
-
  services.postgresql = {
    enable = true;
-    package = pkgs.postgresql_18;
+    package = pkgs.postgresql_15;
    enableTCPIP = true;

    authentication = ''
@@ -85,13 +74,13 @@ in
    };
  };

-  systemd.tmpfiles.settings."10-postgresql"."/data/postgresql".d = lib.mkIf cfg.enable {
+  systemd.tmpfiles.settings."10-postgresql"."/data/postgresql".d = {
    user = config.systemd.services.postgresql.serviceConfig.User;
    group = config.systemd.services.postgresql.serviceConfig.Group;
    mode = "0700";
  };

-  systemd.services.postgresql-setup = lib.mkIf cfg.enable {
+  systemd.services.postgresql-setup = {
    after = [
      "systemd-tmpfiles-setup.service"
      "systemd-tmpfiles-resetup.service"
@@ -106,7 +95,7 @@ in
    };
  };

-  systemd.services.postgresql = lib.mkIf cfg.enable {
+  systemd.services.postgresql = {
    after = [
      "systemd-tmpfiles-setup.service"
      "systemd-tmpfiles-resetup.service"
@@ -121,12 +110,18 @@ in
    };
  };

-  environment.snakeoil-certs."/etc/certs/postgres" = lib.mkIf cfg.enable {
+  environment.snakeoil-certs."/etc/certs/postgres" = {
    owner = "postgres";
    group = "postgres";
    subject = "/C=NO/O=Programvareverkstedet/CN=postgres.pvv.ntnu.no/emailAddress=drift@pvv.ntnu.no";
  };

-  networking.firewall.allowedTCPPorts = lib.mkIf cfg.enable [ 5432 ];
-  networking.firewall.allowedUDPPorts = lib.mkIf cfg.enable [ 5432 ];
+  networking.firewall.allowedTCPPorts = [ 5432 ];
+  networking.firewall.allowedUDPPorts = [ 5432 ];
+
+  services.postgresqlBackup = {
+    enable = true;
+    location = "/var/lib/postgres/backups";
+    backupAll = true;
+  };
 }
--- a/hosts/bicep/services/postgresql/backup.nix
+++ b/hosts/bicep/services/postgresql/backup.nix
@@ -1,92 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  values,
-  ...
-}:
-let
-  cfg = config.services.postgresql;
-  backupDir = "/data/postgresql-backups";
-in
-{
-  # services.postgresqlBackup = lib.mkIf cfg.enable {
-  #   enable = true;
-  #   location = "/var/lib/postgresql-backups";
-  #   backupAll = true;
-  # };
-
-  systemd.tmpfiles.settings."10-postgresql-backups".${backupDir}.d = {
-    user = "postgres";
-    group = "postgres";
-    mode = "700";
-  };
-
-  services.rsync-pull-targets = lib.mkIf cfg.enable {
-    enable = true;
-    locations.${backupDir} = {
-      user = "root";
-      rrsyncArgs.ro = true;
-      authorizedKeysAttrs = [
-        "restrict"
-        "from=\"principal.pvv.ntnu.no,${values.hosts.principal.ipv6},${values.hosts.principal.ipv4}\""
-        "no-agent-forwarding"
-        "no-port-forwarding"
-        "no-pty"
-        "no-X11-forwarding"
-      ];
-      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGvO7QX7QmwSiGLXEsaxPIOpAqnJP3M+qqQRe5dzf8gJ postgresql rsync backup";
-    };
-  };
-
-  # NOTE: instead of having the upstream nixpkgs postgres backup unit trigger
-  #       another unit, it was easier to just make one ourselves
-  systemd.services."backup-postgresql" = {
-    description = "Backup PostgreSQL data";
-    requires = [ "postgresql.service" ];
-
-    path = with pkgs; [
-      coreutils
-      zstd
-      cfg.package
-    ];
-
-    script =
-      let
-        rotations = 2;
-      in
-      ''
-        set -euo pipefail
-
-        OUT_FILE="$STATE_DIRECTORY/postgresql-dump-$(date --iso-8601).sql.zst"
-
-        pg_dumpall -U postgres | zstd --compress -9 --rsyncable -o "$OUT_FILE"
-
-        # NOTE: this needs to be a hardlink for rrsync to allow sending it
-        rm "$STATE_DIRECTORY/postgresql-dump-latest.sql.zst" ||:
-        ln -T "$OUT_FILE" "$STATE_DIRECTORY/postgresql-dump-latest.sql.zst"
-
-        while [ "$(find "$STATE_DIRECTORY" -type f -printf '.' | wc -c)" -gt ${toString (rotations + 1)} ]; do
-          rm "$(find "$STATE_DIRECTORY" -type f -printf '%T+ %p\n' | sort | head -n 1 | cut -d' ' -f2)"
-        done
-      '';
-
-    serviceConfig = {
-      Type = "oneshot";
-      User = "postgres";
-      Group = "postgres";
-      UMask = "0077";
-
-      Nice = 19;
-      IOSchedulingClass = "best-effort";
-      IOSchedulingPriority = 7;
-
-      StateDirectory = [ "postgresql-backups" ];
-      BindPaths = [ "${backupDir}:/var/lib/postgresql-backups" ];
-
-      # TODO: hardening
-    };
-
-    startAt = "*-*-* 01:15:00";
-  };
-}
--- a/hosts/bikkje/configuration.nix
+++ b/hosts/bikkje/configuration.nix
@@ -1,10 +1,4 @@
-{
-  lib,
-  config,
-  pkgs,
-  values,
-  ...
-}:
+{ config, pkgs, values, ... }:
 {
  networking.nat = {
    enable = true;
@@ -16,9 +10,7 @@

  containers.bikkje = {
    autoStart = true;
-    config =
-      { config, pkgs, ... }:
-      {
+    config = { config, pkgs, ... }: {
      #import packages
      packages = with pkgs; [
          alpine
@@ -37,52 +29,12 @@
        firewall = {
          enable = true;
          # Allow SSH and HTTP and ports for email and irc
-            allowedTCPPorts = [
-              80
-              22
-              194
-              994
-              6665
-              6666
-              6667
-              6668
-              6669
-              6697
-              995
-              993
-              25
-              465
-              587
-              110
-              143
-              993
-              995
-            ];
-            allowedUDPPorts = [
-              80
-              22
-              194
-              994
-              6665
-              6666
-              6667
-              6668
-              6669
-              6697
-              995
-              993
-              25
-              465
-              587
-              110
-              143
-              993
-              995
-            ];
+          allowedTCPPorts = [ 80 22 194 994 6665 6666 6667 6668 6669 6697 995 993 25 465 587 110 143 993 995 ];
+          allowedUDPPorts = [ 80 22 194 994 6665 6666 6667 6668 6669 6697 995 993 25 465 587 110 143 993 995 ];
        };
        # Use systemd-resolved inside the container
        # Workaround for bug https://github.com/NixOS/nixpkgs/issues/162686
-          useHostResolvConf = lib.mkForce false;
+        useHostResolvConf = mkForce false;
      };

      services.resolved.enable = true;
@@ -92,4 +44,4 @@
      system.stateVersion = "23.11";
    };
  };
-}
+};
--- a/hosts/brzeczyszczykiewicz/configuration.nix
+++ b/hosts/brzeczyszczykiewicz/configuration.nix
@@ -1,10 +1,4 @@
-{
-  config,
-  fp,
-  pkgs,
-  values,
-  ...
-}:
+{ config, fp, pkgs, values, ... }:
 {
  imports = [
      # Include the results of the hardware scan.
@@ -16,15 +10,12 @@

  systemd.network.networks."30-eno1" = values.defaultNetworkConfig // {
    matchConfig.Name = "eno1";
-    address = with values.hosts.brzeczyszczykiewicz; [
-      (ipv4 + "/25")
-      (ipv6 + "/64")
-    ];
+    address = with values.hosts.brzeczyszczykiewicz; [ (ipv4 + "/25") (ipv6 + "/64") ];
  };

  fonts.fontconfig.enable = true;

  # Don't change (even during upgrades) unless you know what you are doing.
  # See https://search.nixos.org/options?show=system.stateVersion
-  system.stateVersion = "25.11";
+  system.stateVersion = "23.05";
 }
--- a/hosts/brzeczyszczykiewicz/hardware-configuration.nix
+++ b/hosts/brzeczyszczykiewicz/hardware-configuration.nix
@@ -1,44 +1,30 @@
 # Do not modify this file!  It was generated by 'nixos-generate-config'
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{
-  config,
-  lib,
-  pkgs,
-  modulesPath,
-  ...
-}:
+{ config, lib, pkgs, modulesPath, ... }:

 {
-  imports = [
-    (modulesPath + "/installer/scan/not-detected.nix")
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
    ];

-  boot.initrd.availableKernelModules = [
-    "xhci_pci"
-    "ehci_pci"
-    "ahci"
-    "usbhid"
-    "usb_storage"
-    "sd_mod"
-    "sr_mod"
-  ];
+  boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" "sr_mod" ];
  boot.initrd.kernelModules = [ ];
  boot.kernelModules = [ "kvm-intel" ];
  boot.extraModulePackages = [ ];

-  fileSystems."/" = {
-    device = "/dev/disk/by-uuid/4e8667f8-55de-4103-8369-b94665f42204";
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/4e8667f8-55de-4103-8369-b94665f42204";
      fsType = "ext4";
    };

-  fileSystems."/boot" = {
-    device = "/dev/disk/by-uuid/82E3-3D03";
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/82E3-3D03";
      fsType = "vfat";
    };

-  swapDevices = [
-    { device = "/dev/disk/by-uuid/d0bf9a21-44bc-44a3-ae55-8f0971875883"; }
+  swapDevices =
+    [ { device = "/dev/disk/by-uuid/d0bf9a21-44bc-44a3-ae55-8f0971875883"; }
    ];

  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
--- a/hosts/georg/configuration.nix
+++ b/hosts/georg/configuration.nix
@@ -1,10 +1,4 @@
-{
-  config,
-  fp,
-  pkgs,
-  values,
-  ...
-}:
+{ config, fp, pkgs, values, ... }:
 {
  imports = [
      # Include the results of the hardware scan.
@@ -16,10 +10,7 @@

  systemd.network.networks."30-eno1" = values.defaultNetworkConfig // {
    matchConfig.Name = "eno1";
-    address = with values.hosts.georg; [
-      (ipv4 + "/25")
-      (ipv6 + "/64")
-    ];
+    address = with values.hosts.georg; [ (ipv4 + "/25") (ipv6 + "/64") ];
  };

  services.spotifyd = {
@@ -41,5 +32,5 @@

  # Don't change (even during upgrades) unless you know what you are doing.
  # See https://search.nixos.org/options?show=system.stateVersion
-  system.stateVersion = "25.11";
+  system.stateVersion = "23.05";
 }
--- a/hosts/georg/hardware-configuration.nix
+++ b/hosts/georg/hardware-configuration.nix
@@ -1,43 +1,30 @@
 # Do not modify this file!  It was generated by 'nixos-generate-config'
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{
-  config,
-  lib,
-  pkgs,
-  modulesPath,
-  ...
-}:
+{ config, lib, pkgs, modulesPath, ... }:

 {
-  imports = [
-    (modulesPath + "/installer/scan/not-detected.nix")
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
    ];

-  boot.initrd.availableKernelModules = [
-    "xhci_pci"
-    "ehci_pci"
-    "ahci"
-    "usb_storage"
-    "usbhid"
-    "sd_mod"
-  ];
+  boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" ];
  boot.initrd.kernelModules = [ ];
  boot.kernelModules = [ "kvm-intel" ];
  boot.extraModulePackages = [ ];

-  fileSystems."/" = {
-    device = "/dev/disk/by-uuid/33825f0d-5a63-40fc-83db-bfa1ebb72ba0";
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/33825f0d-5a63-40fc-83db-bfa1ebb72ba0";
      fsType = "ext4";
    };

-  fileSystems."/boot" = {
-    device = "/dev/disk/by-uuid/145E-7362";
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/145E-7362";
      fsType = "vfat";
    };

-  swapDevices = [
-    { device = "/dev/disk/by-uuid/7ed27e21-3247-44cd-8bcc-5d4a2efebf57"; }
+  swapDevices =
+    [ { device = "/dev/disk/by-uuid/7ed27e21-3247-44cd-8bcc-5d4a2efebf57"; }
    ];

  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
--- a/hosts/gluttony/configuration.nix
+++ b/hosts/gluttony/configuration.nix
@@ -10,16 +10,9 @@
    (fp /base)
  ];

+  boot.loader.systemd-boot.enable = false;
+
  systemd.network.enable = lib.mkForce false;
-  boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
-
-  boot.loader = {
-    systemd-boot.enable = false; # no uefi support on this device
-    grub.device = "/dev/sda";
-    grub.enable = true;
-  };
-  boot.tmp.cleanOnBoot = true;
-
  networking =
    let
      hostConf = values.hosts.gluttony;
--- a/hosts/gluttony/hardware-configuration.nix
+++ b/hosts/gluttony/hardware-configuration.nix
@@ -31,7 +31,7 @@
  };

  fileSystems."/boot" = {
-    device = "/dev/disk/by-uuid/933A-3005";
+    device = "/dev/disk/by-uuid/D00A-B488";
    fsType = "vfat";
    options = [
      "fmask=0077"
--- a/hosts/ildkule/configuration.nix
+++ b/hosts/ildkule/configuration.nix
@@ -1,11 +1,4 @@
-{
-  config,
-  fp,
-  pkgs,
-  lib,
-  values,
-  ...
-}:
+{ config, fp, pkgs, lib, values, ... }:
 {
  imports = [
      # Include the results of the hardware scan.
@@ -24,11 +17,9 @@

  # Openstack Neutron and systemd-networkd are not best friends, use something else:
  systemd.network.enable = lib.mkForce false;
-  networking =
-    let
+  networking = let
    hostConf = values.hosts.ildkule;
-    in
-    {
+  in {
    tempAddresses = "disabled";
    useDHCP = lib.mkForce true;

@@ -38,20 +29,11 @@

    interfaces."ens4" = {
      ipv4.addresses = [
-          {
-            address = hostConf.ipv4;
-            prefixLength = 32;
-          }
-          {
-            address = hostConf.ipv4_internal;
-            prefixLength = 24;
-          }
+        { address = hostConf.ipv4;          prefixLength = 32; }
+        { address = hostConf.ipv4_internal; prefixLength = 24; }
      ];
      ipv6.addresses = [
-          {
-            address = hostConf.ipv6;
-            prefixLength = 64;
-          }
+        { address = hostConf.ipv6;          prefixLength = 64; }
      ];
    };
  };
--- a/hosts/ildkule/hardware-configuration.nix
+++ b/hosts/ildkule/hardware-configuration.nix
@@ -1,12 +1,7 @@
 { modulesPath, lib, ... }:
 {
  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
-  boot.initrd.availableKernelModules = [
-    "ata_piix"
-    "uhci_hcd"
-    "xen_blkfront"
-    "vmw_pvscsi"
-  ];
+  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "xen_blkfront" "vmw_pvscsi" ];
  boot.initrd.kernelModules = [ "nvme" ];
  fileSystems."/" = {
    device = "/dev/disk/by-uuid/e35eb4ce-aac3-4f91-8383-6e7cd8bbf942";
--- a/hosts/ildkule/services/journald-remote.nix
+++ b/hosts/ildkule/services/journald-remote.nix
@@ -1,9 +1,4 @@
-{
-  config,
-  lib,
-  values,
-  ...
-}:
+{ config, lib, values, ... }:
 let
  cfg = config.services.journald.remote;
  domainName = "journald.pvv.ntnu.no";
@@ -27,11 +22,9 @@ in

  services.journald.remote = {
    enable = true;
-    settings.Remote =
-      let
+    settings.Remote = let
      inherit (config.security.acme.certs.${domainName}) directory;
-      in
-      {
+    in {
      ServerKeyFile = "/run/credentials/systemd-journal-remote.service/key.pem";
      ServerCertificateFile = "/run/credentials/systemd-journal-remote.service/cert.pem";
      TrustedCertificateFile = "-";
@@ -54,11 +47,9 @@ in

  systemd.services."systemd-journal-remote" = {
    serviceConfig = {
-      LoadCredential =
-        let
+      LoadCredential = let
        inherit (config.security.acme.certs.${domainName}) directory;
-        in
-        [
+      in [
        "key.pem:${directory}/key.pem"
        "cert.pem:${directory}/cert.pem"
      ];
--- a/hosts/ildkule/services/monitoring/dashboards/go-processes.json
+++ b/hosts/ildkule/services/monitoring/dashboards/go-processes.json
--- a/hosts/ildkule/services/monitoring/dashboards/mysql.json
+++ b/hosts/ildkule/services/monitoring/dashboards/mysql.json
@@ -13,7 +13,7 @@
    ]
  },
  "description": "",
-  "editable": false,
+  "editable": true,
  "gnetId": 11323,
  "graphTooltip": 1,
  "id": 31,
@@ -1899,7 +1899,7 @@
      "dashes": false,
      "datasource": "$datasource",
      "decimals": 0,
-      "description": "***System Memory***: Total Memory for the system.\\\n***InnoDB Buffer Pool Data***: InnoDB maintains a storage area called the buffer pool for caching data and indexes in memory.\\\n***TokuDB Cache Size***: Similar in function to the InnoDB Buffer Pool,  TokuDB will allocate 50% of the installed RAM for its own cache.\\\n***Key Buffer Size***: Index blocks for MYISAM tables are buffered and are shared by all threads. key_buffer_size is the size of the buffer used for index blocks.\\\n***Adaptive Hash Index Size***: When InnoDB notices that some index values are being accessed very frequently, it builds a hash index for them in memory on top of B-Tree indexes.\\\n ***Query Cache Size***: The query cache stores the text of a SELECT statement together with the corresponding result that was sent to the client. The query cache has huge scalability problems in that only one thread can do an operation in the query cache at the same time.\\\n***InnoDB Dictionary Size***: The data dictionary is InnoDB ‘s internal catalog of tables. InnoDB stores the data dictionary on disk, and loads entries into memory while the server is running.\\\n***InnoDB Log Buffer Size***: The MySQL InnoDB log buffer allows transactions to run without having to write the log to disk before the transactions commit.",
+      "description": "***System Memory***: Total Memory for the system.\\\n***InnoDB Buffer Pool Data***: InnoDB maintains a storage area called the buffer pool for caching data and indexes in memory.\\\n***TokuDB Cache Size***: Similar in function to the InnoDB Buffer Pool,  TokuDB will allocate 50% of the installed RAM for its own cache.\\\n***Key Buffer Size***: Index blocks for MYISAM tables are buffered and are shared by all threads. key_buffer_size is the size of the buffer used for index blocks.\\\n***Adaptive Hash Index Size***: When InnoDB notices that some index values are being accessed very frequently, it builds a hash index for them in memory on top of B-Tree indexes.\\\n ***Query Cache Size***: The query cache stores the text of a SELECT statement together with the corresponding result that was sent to the client. The query cache has huge scalability problems in that only one thread can do an operation in the query cache at the same time.\\\n***InnoDB Dictionary Size***: The data dictionary is InnoDB 's internal catalog of tables. InnoDB stores the data dictionary on disk, and loads entries into memory while the server is running.\\\n***InnoDB Log Buffer Size***: The MySQL InnoDB log buffer allows transactions to run without having to write the log to disk before the transactions commit.",
      "editable": true,
      "error": false,
      "fieldConfig": {
@@ -3690,7 +3690,7 @@
        },
        "hide": 0,
        "includeAll": false,
-        "label": "Data source",
+        "label": "Data Source",
        "multi": false,
        "name": "datasource",
        "options": [],
@@ -3713,12 +3713,12 @@
        "definition": "label_values(mysql_up, job)",
        "hide": 0,
        "includeAll": true,
-        "label": "Job",
+        "label": "job",
        "multi": true,
        "name": "job",
        "options": [],
        "query": "label_values(mysql_up, job)",
-        "refresh": 2,
+        "refresh": 1,
        "regex": "",
        "skipUrlSync": false,
        "sort": 0,
@@ -3742,12 +3742,12 @@
        "definition": "label_values(mysql_up, instance)",
        "hide": 0,
        "includeAll": true,
-        "label": "Instance",
+        "label": "instance",
        "multi": true,
        "name": "instance",
        "options": [],
        "query": "label_values(mysql_up, instance)",
-        "refresh": 2,
+        "refresh": 1,
        "regex": "",
        "skipUrlSync": false,
        "sort": 0,
--- a/hosts/ildkule/services/monitoring/dashboards/node-exporter-full.json
+++ b/hosts/ildkule/services/monitoring/dashboards/node-exporter-full.json
--- a/hosts/ildkule/services/monitoring/dashboards/postgres.json
+++ b/hosts/ildkule/services/monitoring/dashboards/postgres.json
@@ -328,7 +328,7 @@
        "rgba(50, 172, 45, 0.97)"
      ],
      "datasource": "${DS_PROMETHEUS}",
-      "format": "short",
+      "format": "decbytes",
      "gauge": {
        "maxValue": 100,
        "minValue": 0,
@@ -411,7 +411,7 @@
        "rgba(50, 172, 45, 0.97)"
      ],
      "datasource": "${DS_PROMETHEUS}",
-      "format": "short",
+      "format": "decbytes",
      "gauge": {
        "maxValue": 100,
        "minValue": 0,
@@ -1410,7 +1410,7 @@
      "tableColumn": "",
      "targets": [
        {
-          "expr": "pg_settings_seq_page_cost{instance=\"$instance\"}",
+          "expr": "pg_settings_seq_page_cost",
          "format": "time_series",
          "intervalFactor": 1,
          "refId": "A"
@@ -1872,7 +1872,7 @@
      },
      "yaxes": [
        {
-          "format": "short",
+          "format": "bytes",
          "label": null,
          "logBase": 1,
          "max": null,
@@ -1966,7 +1966,7 @@
      },
      "yaxes": [
        {
-          "format": "short",
+          "format": "bytes",
          "label": null,
          "logBase": 1,
          "max": null,
@@ -2060,7 +2060,7 @@
      },
      "yaxes": [
        {
-          "format": "short",
+          "format": "bytes",
          "label": null,
          "logBase": 1,
          "max": null,
@@ -2251,7 +2251,7 @@
      },
      "yaxes": [
        {
-          "format": "short",
+          "format": "bytes",
          "label": null,
          "logBase": 1,
          "max": null,
@@ -2439,7 +2439,7 @@
      },
      "yaxes": [
        {
-          "format": "short",
+          "format": "bytes",
          "label": null,
          "logBase": 1,
          "max": null,
@@ -2589,35 +2589,35 @@
      "steppedLine": false,
      "targets": [
        {
-          "expr": "irate(pg_stat_bgwriter_buffers_backend_total{instance=\"$instance\"}[5m])",
+          "expr": "irate(pg_stat_bgwriter_buffers_backend{instance=\"$instance\"}[5m])",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "buffers_backend",
          "refId": "A"
        },
        {
-          "expr": "irate(pg_stat_bgwriter_buffers_alloc_total{instance=\"$instance\"}[5m])",
+          "expr": "irate(pg_stat_bgwriter_buffers_alloc{instance=\"$instance\"}[5m])",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "buffers_alloc",
          "refId": "B"
        },
        {
-          "expr": "irate(pg_stat_bgwriter_buffers_backend_fsync_total{instance=\"$instance\"}[5m])",
+          "expr": "irate(pg_stat_bgwriter_buffers_backend_fsync{instance=\"$instance\"}[5m])",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "backend_fsync",
          "refId": "C"
        },
        {
-          "expr": "irate(pg_stat_bgwriter_buffers_checkpoint_total{instance=\"$instance\"}[5m])",
+          "expr": "irate(pg_stat_bgwriter_buffers_checkpoint{instance=\"$instance\"}[5m])",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "buffers_checkpoint",
          "refId": "D"
        },
        {
-          "expr": "irate(pg_stat_bgwriter_buffers_clean_total{instance=\"$instance\"}[5m])",
+          "expr": "irate(pg_stat_bgwriter_buffers_clean{instance=\"$instance\"}[5m])",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "buffers_clean",
@@ -2886,14 +2886,14 @@
      "steppedLine": false,
      "targets": [
        {
-          "expr": "irate(pg_stat_bgwriter_checkpoint_write_time_total{instance=\"$instance\"}[5m])",
+          "expr": "irate(pg_stat_bgwriter_checkpoint_write_time{instance=\"$instance\"}[5m])",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "write_time - Total amount of time that has been spent in the portion of checkpoint processing where files are written to disk.",
          "refId": "B"
        },
        {
-          "expr": "irate(pg_stat_bgwriter_checkpoint_sync_time_total{instance=\"$instance\"}[5m])",
+          "expr": "irate(pg_stat_bgwriter_checkpoint_sync_time{instance=\"$instance\"}[5m])",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "sync_time - Total amount of time that has been spent in the portion of checkpoint processing where files are synchronized to disk.",
--- a/hosts/ildkule/services/monitoring/dashboards/synapse.json
+++ b/hosts/ildkule/services/monitoring/dashboards/synapse.json
--- a/hosts/ildkule/services/monitoring/grafana.nix
+++ b/hosts/ildkule/services/monitoring/grafana.nix
@@ -1,19 +1,10 @@
-{
-  config,
-  pkgs,
-  values,
-  ...
-}:
-let
+{ config, pkgs, values, ... }: let
  cfg = config.services.grafana;
-in
-{
-  sops.secrets =
-    let
+in {
+  sops.secrets = let
    owner = "grafana";
    group = "grafana";
-    in
-    {
+  in {
    "keys/grafana/secret_key" = { inherit owner group; };
    "keys/grafana/admin_password" = { inherit owner group; };
  };
@@ -21,12 +12,10 @@ in
  services.grafana = {
    enable = true;

-    settings =
-      let
+    settings = let
      # See https://grafana.com/docs/grafana/latest/setup-grafana/configure-grafana/#file-provider
      secretFile = path: "$__file{${path}}";
-      in
-      {
+    in {
      server = {
        domain = "grafana.pvv.ntnu.no";
        http_port = 2342;
@@ -58,13 +47,13 @@ in
        {
          name = "Node Exporter Full";
          type = "file";
-          url = "https://grafana.com/api/dashboards/1860/revisions/42/download";
+          url = "https://grafana.com/api/dashboards/1860/revisions/29/download";
          options.path = dashboards/node-exporter-full.json;
        }
        {
          name = "Matrix Synapse";
          type = "file";
-          url = "https://github.com/element-hq/synapse/raw/refs/heads/develop/contrib/grafana/synapse.json";
+          url = "https://raw.githubusercontent.com/matrix-org/synapse/develop/contrib/grafana/synapse.json";
          options.path = dashboards/synapse.json;
        }
        {
@@ -76,9 +65,15 @@ in
        {
          name = "Postgresql";
          type = "file";
-          url = "https://grafana.com/api/dashboards/9628/revisions/8/download";
+          url = "https://grafana.com/api/dashboards/9628/revisions/7/download";
          options.path = dashboards/postgres.json;
        }
+        {
+          name = "Go Processes (gogs)";
+          type = "file";
+          url = "https://grafana.com/api/dashboards/240/revisions/3/download";
+          options.path = dashboards/go-processes.json;
+        }
        {
          name = "Gitea Dashboard";
          type = "file";
--- a/hosts/ildkule/services/monitoring/loki.nix
+++ b/hosts/ildkule/services/monitoring/loki.nix
@@ -3,8 +3,7 @@
 let
  cfg = config.services.loki;
  stateDir = "/data/monitoring/loki";
-in
-{
+in {
  services.loki = {
    enable = true;
    configuration = {
--- a/hosts/ildkule/services/monitoring/prometheus/default.nix
+++ b/hosts/ildkule/services/monitoring/prometheus/default.nix
@@ -1,8 +1,6 @@
-{ config, ... }:
-let
+{ config, ... }: let
  stateDir = "/data/monitoring/prometheus";
-in
-{
+in {
  imports = [
    ./exim.nix
    ./gitea.nix
--- a/hosts/ildkule/services/monitoring/prometheus/exim.nix
+++ b/hosts/ildkule/services/monitoring/prometheus/exim.nix
@@ -5,11 +5,9 @@
      {
        job_name = "exim";
        scrape_interval = "15s";
-        static_configs = [
-          {
+        static_configs = [{
          targets = [ "microbel.pvv.ntnu.no:9636" ];
-          }
-        ];
+        }];
      }
    ];
  };
--- a/hosts/ildkule/services/monitoring/prometheus/gitea.nix
+++ b/hosts/ildkule/services/monitoring/prometheus/gitea.nix
@@ -1,7 +1,6 @@
 { ... }:
 {
-  services.prometheus.scrapeConfigs = [
-    {
+  services.prometheus.scrapeConfigs = [{
    job_name = "gitea";
    scrape_interval = "60s";
    scheme = "https";
@@ -13,6 +12,5 @@
        ];
      }
    ];
-    }
-  ];
+  }];
 }
--- a/hosts/ildkule/services/monitoring/prometheus/machines.nix
+++ b/hosts/ildkule/services/monitoring/prometheus/machines.nix
@@ -1,5 +1,4 @@
-{ config, ... }:
-let
+{ config, ... }: let
  cfg = config.services.prometheus;

  mkHostScrapeConfig = name: ports: {
@@ -10,98 +9,29 @@ let
  defaultNodeExporterPort = 9100;
  defaultSystemdExporterPort = 9101;
  defaultNixosExporterPort = 9102;
-in
-{
-  services.prometheus.scrapeConfigs = [
-    {
+in {
+  services.prometheus.scrapeConfigs = [{
    job_name = "base_info";
    static_configs = [
-        (mkHostScrapeConfig "ildkule" [
-          cfg.exporters.node.port
-          cfg.exporters.systemd.port
-          defaultNixosExporterPort
-        ])
+      (mkHostScrapeConfig "ildkule" [ cfg.exporters.node.port cfg.exporters.systemd.port defaultNixosExporterPort ])

-        (mkHostScrapeConfig "bekkalokk" [
-          defaultNodeExporterPort
-          defaultSystemdExporterPort
-          defaultNixosExporterPort
-        ])
-        (mkHostScrapeConfig "bicep" [
-          defaultNodeExporterPort
-          defaultSystemdExporterPort
-          defaultNixosExporterPort
-        ])
-        (mkHostScrapeConfig "brzeczyszczykiewicz" [
-          defaultNodeExporterPort
-          defaultSystemdExporterPort
-          defaultNixosExporterPort
-        ])
-        (mkHostScrapeConfig "georg" [
-          defaultNodeExporterPort
-          defaultSystemdExporterPort
-          defaultNixosExporterPort
-        ])
-        (mkHostScrapeConfig "gluttony" [
-          defaultNodeExporterPort
-          defaultSystemdExporterPort
-          defaultNixosExporterPort
-        ])
-        (mkHostScrapeConfig "kommode" [
-          defaultNodeExporterPort
-          defaultSystemdExporterPort
-          defaultNixosExporterPort
-        ])
-        (mkHostScrapeConfig "lupine-1" [
-          defaultNodeExporterPort
-          defaultSystemdExporterPort
-          defaultNixosExporterPort
-        ])
-        (mkHostScrapeConfig "lupine-2" [
-          defaultNodeExporterPort
-          defaultSystemdExporterPort
-          defaultNixosExporterPort
-        ])
-        (mkHostScrapeConfig "lupine-3" [
-          defaultNodeExporterPort
-          defaultSystemdExporterPort
-          defaultNixosExporterPort
-        ])
-        (mkHostScrapeConfig "lupine-4" [
-          defaultNodeExporterPort
-          defaultSystemdExporterPort
-          defaultNixosExporterPort
-        ])
-        (mkHostScrapeConfig "lupine-5" [
-          defaultNodeExporterPort
-          defaultSystemdExporterPort
-          defaultNixosExporterPort
-        ])
-        (mkHostScrapeConfig "temmie" [
-          defaultNodeExporterPort
-          defaultSystemdExporterPort
-          defaultNixosExporterPort
-        ])
-        (mkHostScrapeConfig "ustetind" [
-          defaultNodeExporterPort
-          defaultSystemdExporterPort
-          defaultNixosExporterPort
-        ])
-        (mkHostScrapeConfig "wenche" [
-          defaultNodeExporterPort
-          defaultSystemdExporterPort
-          defaultNixosExporterPort
-        ])
+      (mkHostScrapeConfig "bekkalokk" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
+      (mkHostScrapeConfig "bicep" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
+      (mkHostScrapeConfig "brzeczyszczykiewicz" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
+      (mkHostScrapeConfig "georg" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
+      (mkHostScrapeConfig "kommode" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
+      (mkHostScrapeConfig "ustetind" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
+      (mkHostScrapeConfig "wenche" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])

-        (mkHostScrapeConfig "skrott" [
-          defaultNodeExporterPort
-          defaultSystemdExporterPort
-        ])
+      (mkHostScrapeConfig "lupine-1" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
+      # (mkHostScrapeConfig "lupine-2" [ defaultNodeExporterPort defaultSystemdExporterPort ])
+      (mkHostScrapeConfig "lupine-3" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
+      (mkHostScrapeConfig "lupine-4" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
+      (mkHostScrapeConfig "lupine-5" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])

      (mkHostScrapeConfig "hildring" [ defaultNodeExporterPort ])
      (mkHostScrapeConfig "isvegg" [ defaultNodeExporterPort ])
      (mkHostScrapeConfig "microbel" [ defaultNodeExporterPort ])
    ];
-    }
-  ];
+  }];
 }
--- a/hosts/ildkule/services/monitoring/prometheus/matrix-synapse.nix
+++ b/hosts/ildkule/services/monitoring/prometheus/matrix-synapse.nix
@@ -1,16 +1,13 @@
 { ... }:
 {
-  services.prometheus.scrapeConfigs = [
-    {
+  services.prometheus.scrapeConfigs = [{
    job_name = "synapse";
    scrape_interval = "15s";
    scheme = "https";

-      http_sd_configs = [
-        {
+    http_sd_configs = [{
      url = "https://matrix.pvv.ntnu.no/metrics/config.json";
-        }
-      ];
+    }];

    relabel_configs = [
      {
@@ -39,6 +36,5 @@
        target_label = "__address__";
      }
    ];
-    }
-  ];
+  }];
 }
--- a/hosts/ildkule/services/monitoring/prometheus/mysqld.nix
+++ b/hosts/ildkule/services/monitoring/prometheus/mysqld.nix
@@ -1,18 +1,14 @@
-{ config, ... }:
-let
+{ config, ... }: let
  cfg = config.services.prometheus;
-in
-{
+in {
  sops = {
    secrets."config/mysqld_exporter_password" = { };

    templates."mysqld_exporter.conf" = {
      restartUnits = [ "prometheus-mysqld-exporter.service" ];
-      content =
-        let
+      content = let
        inherit (config.sops) placeholder;
-        in
-        ''
+      in ''
        [client]
        host = mysql.pvv.ntnu.no
        port = 3306
@@ -23,8 +19,7 @@ in
  };

  services.prometheus = {
-    scrapeConfigs = [
-      {
+    scrapeConfigs = [{
      job_name = "mysql";
      scheme = "http";
      metrics_path = cfg.exporters.mysqld.telemetryPath;
@@ -35,8 +30,7 @@ in
          ];
        }
      ];
-      }
-    ];
+    }];

    exporters.mysqld = {
      enable = true;
--- a/hosts/ildkule/services/monitoring/prometheus/postgres.nix
+++ b/hosts/ildkule/services/monitoring/prometheus/postgres.nix
@@ -1,14 +1,6 @@
-{
-  pkgs,
-  lib,
-  config,
-  values,
-  ...
-}:
-let
+{ pkgs, lib, config, values, ... }: let
  cfg = config.services.prometheus;
-in
-{
+in {
  sops.secrets = {
    "keys/postgres/postgres_exporter_env" = {};
    "keys/postgres/postgres_exporter_knakelibrak_env" = {};
@@ -19,26 +11,22 @@ in
      {
        job_name = "postgres";
        scrape_interval = "15s";
-        static_configs = [
-          {
+        static_configs = [{
          targets = [ "localhost:${toString cfg.exporters.postgres.port}" ];
          labels = {
            server = "bicep";
          };
-          }
-        ];
+        }];
      }
      {
        job_name = "postgres-knakelibrak";
        scrape_interval = "15s";
-        static_configs = [
-          {
+        static_configs = [{
          targets = [ "localhost:${toString (cfg.exporters.postgres.port + 1)}" ];
          labels = {
            server = "knakelibrak";
          };
-          }
-        ];
+        }];
      }
    ];

@@ -49,11 +37,9 @@ in
    };
  };

-  systemd.services.prometheus-postgres-exporter-knakelibrak.serviceConfig =
-    let
+  systemd.services.prometheus-postgres-exporter-knakelibrak.serviceConfig = let
    localCfg = config.services.prometheus.exporters.postgres;
-    in
-    lib.recursiveUpdate config.systemd.services.prometheus-postgres-exporter.serviceConfig {
+  in lib.recursiveUpdate config.systemd.services.prometheus-postgres-exporter.serviceConfig {
      EnvironmentFile = config.sops.secrets."keys/postgres/postgres_exporter_knakelibrak_env".path;
      ExecStart = ''
        ${pkgs.prometheus-postgres-exporter}/bin/postgres_exporter \
--- a/hosts/ildkule/services/monitoring/uptime-kuma.nix
+++ b/hosts/ildkule/services/monitoring/uptime-kuma.nix
@@ -1,15 +1,9 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}:
+{ config, pkgs, lib, ... }:
 let
  cfg = config.services.uptime-kuma;
  domain = "status.pvv.ntnu.no";
  stateDir = "/data/monitoring/uptime-kuma";
-in
-{
+in {
  services.uptime-kuma = {
    enable = true;
    settings = {
--- a/hosts/kommode/configuration.nix
+++ b/hosts/kommode/configuration.nix
@@ -1,15 +1,9 @@
-{
-  pkgs,
-  values,
-  fp,
-  ...
-}:
+{ pkgs, values, fp, ... }:
 {
  imports = [
    # Include the results of the hardware scan.
    ./hardware-configuration.nix
    (fp /base)
-    ./disks.nix

    ./services/gitea
    ./services/nginx.nix
@@ -17,10 +11,7 @@

  systemd.network.networks."30-ens18" = values.defaultNetworkConfig // {
    matchConfig.Name = "ens18";
-    address = with values.hosts.kommode; [
-      (ipv4 + "/25")
-      (ipv6 + "/64")
-    ];
+    address = with values.hosts.kommode; [ (ipv4 + "/25") (ipv6 + "/64") ];
  };

  services.btrfs.autoScrub.enable = true;
--- a/hosts/kommode/disks.nix
+++ b/hosts/kommode/disks.nix
@@ -1,80 +0,0 @@
-{ lib, ... }:
-{
-  disko.devices = {
-    disk = {
-      sda = {
-        type = "disk";
-        device = "/dev/sda";
-        content = {
-          type = "gpt";
-          partitions = {
-            root = {
-              name = "root";
-              label = "root";
-              start = "1MiB";
-              end = "-5G";
-              content = {
-                type = "btrfs";
-                extraArgs = [ "-f" ]; # Override existing partition
-                # subvolumes = let
-                #   makeSnapshottable = subvolPath: mountOptions: let
-                #     name = lib.replaceString "/" "-" subvolPath;
-                #   in {
-                #     "@${name}/active" = {
-                #       mountpoint = subvolPath;
-                #       inherit mountOptions;
-                #     };
-                #     "@${name}/snapshots" = {
-                #       mountpoint = "${subvolPath}/.snapshots";
-                #       inherit mountOptions;
-                #     };
-                #   };
-                # in {
-                #   "@" = { };
-                #   "@/swap" = {
-                #     mountpoint = "/.swapvol";
-                #     swap.swapfile.size = "4G";
-                #   };
-                #   "@/root" = {
-                #     mountpoint = "/";
-                #     mountOptions = [ "compress=zstd" "noatime" ];
-                #   };
-                # }
-                # // (makeSnapshottable "/home" [ "compress=zstd" "noatime" ])
-                # // (makeSnapshottable "/nix" [ "compress=zstd" "noatime" ])
-                # // (makeSnapshottable "/var/lib" [ "compress=zstd" "noatime" ])
-                # // (makeSnapshottable "/var/log" [ "compress=zstd" "noatime" ])
-                # // (makeSnapshottable "/var/cache" [ "compress=zstd" "noatime" ]);
-
-                # swap.swapfile.size = "4G";
-                mountpoint = "/";
-              };
-            };
-
-            swap = {
-              name = "swap";
-              label = "swap";
-              start = "-5G";
-              end = "-1G";
-              content.type = "swap";
-            };
-
-            ESP = {
-              name = "ESP";
-              label = "ESP";
-              start = "-1G";
-              end = "100%";
-              type = "EF00";
-              content = {
-                type = "filesystem";
-                format = "vfat";
-                mountpoint = "/boot";
-                mountOptions = [ "umask=0077" ];
-              };
-            };
-          };
-        };
-      };
-    };
-  };
-}
--- a/hosts/kommode/hardware-configuration.nix
+++ b/hosts/kommode/hardware-configuration.nix
@@ -1,31 +1,33 @@
 # Do not modify this file!  It was generated by 'nixos-generate-config'
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{
-  config,
-  lib,
-  pkgs,
-  modulesPath,
-  ...
-}:
+{ config, lib, pkgs, modulesPath, ... }:

 {
-  imports = [
-    (modulesPath + "/profiles/qemu-guest.nix")
+  imports =
+    [ (modulesPath + "/profiles/qemu-guest.nix")
    ];

-  boot.initrd.availableKernelModules = [
-    "ata_piix"
-    "uhci_hcd"
-    "virtio_pci"
-    "virtio_scsi"
-    "sd_mod"
-    "sr_mod"
-  ];
+  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
  boot.initrd.kernelModules = [ ];
  boot.kernelModules = [ ];
  boot.extraModulePackages = [ ];

+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/d421538f-a260-44ae-8e03-47cac369dcc1";
+      fsType = "btrfs";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/86CD-4C23";
+      fsType = "vfat";
+      options = [ "fmask=0077" "dmask=0077" ];
+    };
+
+  swapDevices =
+    [ { device = "/dev/disk/by-uuid/4cfbb41e-801f-40dd-8c58-0a0c1a6025f6"; }
+    ];
+
  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
  # (the default) this is the recommended approach. When using systemd-networkd it's
  # still possible to use this option, but it's recommended to use it in conjunction
--- a/hosts/kommode/services/gitea/customization/default.nix
+++ b/hosts/kommode/services/gitea/customization/default.nix
@@ -1,10 +1,4 @@
-{
-  config,
-  pkgs,
-  lib,
-  fp,
-  ...
-}:
+{ config, pkgs, lib, fp, ... }:
 let
  cfg = config.services.gitea;
 in
@@ -16,59 +10,6 @@ in
    catppuccin = pkgs.gitea-theme-catppuccin;
  };

-  services.gitea.settings = {
-    ui = {
-      DEFAULT_THEME = "gitea-auto";
-      REACTIONS = lib.concatStringsSep "," [
-        "+1"
-        "-1"
-        "laugh"
-        "confused"
-        "heart"
-        "hooray"
-        "rocket"
-        "eyes"
-        "100"
-        "anger"
-        "astonished"
-        "no_good"
-        "ok_hand"
-        "pensive"
-        "pizza"
-        "point_up"
-        "sob"
-        "skull"
-        "upside_down_face"
-        "shrug"
-        "huh"
-        "bruh"
-        "okiedokie"
-        "grr"
-      ];
-
-      CUSTOM_EMOJIS = lib.concatStringsSep "," [
-        "bruh"
-        "grr"
-        "huh"
-        "ohyeah"
-      ];
-    };
-    "ui.meta" = {
-      AUTHOR = "Programvareverkstedet";
-      DESCRIPTION = "Bokstavelig talt programvareverkstedet";
-      KEYWORDS = lib.concatStringsSep "," [
-        "git"
-        "hackerspace"
-        "nix"
-        "open source"
-        "foss"
-        "organization"
-        "software"
-        "student"
-      ];
-    };
-  };
-
  systemd.services.gitea-customization = lib.mkIf cfg.enable {
    description = "Install extra customization in gitea's CUSTOM_DIR";
    wantedBy = [ "gitea.service" ];
@@ -80,8 +21,7 @@ in
      Group = cfg.group;
    };

-    script =
-      let
+    script = let
      logo-svg = fp /assets/logo_blue_regular.svg;
      logo-png = fp /assets/logo_blue_regular.png;

@@ -99,21 +39,17 @@ in
        labels = lib.importJSON ./labels/projects.json;
      };

-        customTemplates =
-          pkgs.runCommandLocal "gitea-templates"
-            {
+      customTemplates = pkgs.runCommandLocal "gitea-templates" {
        nativeBuildInputs = with pkgs; [
          coreutils
          gnused
        ];
-            }
-            ''
+      } ''
        # Bigger icons
        install -Dm444 "${cfg.package.src}/templates/repo/icon.tmpl" "$out/repo/icon.tmpl"
        sed -i -e 's/24/60/g' "$out/repo/icon.tmpl"
      '';
-      in
-      ''
+    in ''
      install -Dm444 ${logo-svg} ${cfg.customDir}/public/assets/img/logo.svg
      install -Dm444 ${logo-png} ${cfg.customDir}/public/assets/img/logo.png
      install -Dm444 ${./loading.apng} ${cfg.customDir}/public/assets/img/loading.png
@@ -121,11 +57,6 @@ in
      install -Dm444 ${extraLinksFooter} ${cfg.customDir}/templates/custom/extra_links_footer.tmpl
      install -Dm444 ${project-labels} ${cfg.customDir}/options/label/project-labels.yaml

-        install -Dm644 ${./emotes/bruh.png} ${cfg.customDir}/public/assets/img/emoji/bruh.png
-        install -Dm644 ${./emotes/huh.gif} ${cfg.customDir}/public/assets/img/emoji/huh.png
-        install -Dm644 ${./emotes/grr.png} ${cfg.customDir}/public/assets/img/emoji/grr.png
-        install -Dm644 ${./emotes/okiedokie.jpg} ${cfg.customDir}/public/assets/img/emoji/okiedokie.png
-
      "${lib.getExe pkgs.rsync}" -a "${customTemplates}/" ${cfg.customDir}/templates/
    '';
  };
--- a/hosts/kommode/services/gitea/customization/emotes/bruh.png
+++ b/hosts/kommode/services/gitea/customization/emotes/bruh.png
--- a/hosts/kommode/services/gitea/customization/emotes/grr.png
+++ b/hosts/kommode/services/gitea/customization/emotes/grr.png
--- a/hosts/kommode/services/gitea/customization/emotes/huh.gif
+++ b/hosts/kommode/services/gitea/customization/emotes/huh.gif
--- a/hosts/kommode/services/gitea/customization/emotes/okiedokie.jpg
+++ b/hosts/kommode/services/gitea/customization/emotes/okiedokie.jpg
--- a/hosts/kommode/services/gitea/default.nix
+++ b/hosts/kommode/services/gitea/default.nix
@@ -1,17 +1,9 @@
-{
-  config,
-  values,
-  lib,
-  pkgs,
-  unstablePkgs,
-  ...
-}:
+{ config, values, lib, pkgs, unstablePkgs, ... }:
 let
  cfg = config.services.gitea;
  domain = "git.pvv.ntnu.no";
  sshPort  = 2222;
-in
-{
+in {
  imports = [
    ./customization
    ./gpg.nix
@@ -19,15 +11,13 @@ in
    ./web-secret-provider
  ];

-  sops.secrets =
-    let
+  sops.secrets = let
    defaultConfig = {
      owner = "gitea";
      group = "gitea";
      restartUnits = [ "gitea.service" ];
    };
-    in
-    {
+  in {
    "gitea/database" = defaultConfig;
    "gitea/email-password" = defaultConfig;
    "gitea/lfs-jwt-secret" = defaultConfig;
@@ -93,24 +83,11 @@ in
        AUTO_WATCH_NEW_REPOS = false;
      };
      admin.DEFAULT_EMAIL_NOTIFICATIONS = "onmention";
+      session.COOKIE_SECURE = true;
      security = {
        SECRET_KEY = lib.mkForce "";
        SECRET_KEY_URI = "file:${config.sops.secrets."gitea/secret-key".path}";
      };
-      cache = {
-        ADAPTER = "redis";
-        HOST = "redis+socket://${config.services.redis.servers.gitea.unixSocket}?db=0";
-        ITEM_TTL = "72h";
-      };
-      session = {
-        COOKIE_SECURE = true;
-        PROVIDER = "redis";
-        PROVIDER_CONFIG = "redis+socket://${config.services.redis.servers.gitea.unixSocket}?db=1";
-      };
-      queue = {
-        TYPE = "redis";
-        CONN_STR = "redis+socket://${config.services.redis.servers.gitea.unixSocket}?db=2";
-      };
      database.LOG_SQL = false;
      repository = {
        PREFERRED_LICENSES = lib.concatStringsSep "," [
@@ -151,6 +128,31 @@ in
        AVATAR_MAX_ORIGIN_SIZE = 1024 * 1024 * 2;
      };
      actions.ENABLED = true;
+      ui = {
+        REACTIONS = lib.concatStringsSep "," [
+          "+1"
+          "-1"
+          "laugh"
+          "confused"
+          "heart"
+          "hooray"
+          "rocket"
+          "eyes"
+          "100"
+          "anger"
+          "astonished"
+          "no_good"
+          "ok_hand"
+          "pensive"
+          "pizza"
+          "point_up"
+          "sob"
+          "skull"
+          "upside_down_face"
+          "shrug"
+        ];
+      };
+      "ui.meta".DESCRIPTION = "Bokstavelig talt programvareverkstedet";
    };

    dump = {
@@ -162,26 +164,12 @@ in

  environment.systemPackages = [ cfg.package ];

-  systemd.services.gitea = lib.mkIf cfg.enable {
-    wants = [ "redis-gitea.service" ];
-    after = [ "redis-gitea.service" ];
+  systemd.services.gitea.serviceConfig.CPUSchedulingPolicy = "batch";

-    serviceConfig = {
-      CPUSchedulingPolicy = "batch";
-      CacheDirectory = "gitea/repo-archive";
-      BindPaths = [
+  systemd.services.gitea.serviceConfig.CacheDirectory = "gitea/repo-archive";
+  systemd.services.gitea.serviceConfig.BindPaths = [
    "%C/gitea/repo-archive:${cfg.stateDir}/data/repo-archive"
  ];
-    };
-  };
-
-  services.redis.servers.gitea = lib.mkIf cfg.enable {
-    enable = true;
-    user = config.services.gitea.user;
-    save = [ ];
-    openFirewall = false;
-    port = 5698;
-  };

  services.nginx.virtualHosts."${domain}" = {
    forceSSL = true;
@@ -207,26 +195,8 @@ in

  networking.firewall.allowedTCPPorts = [ sshPort ];

-  services.rsync-pull-targets = {
-    enable = true;
-    locations.${cfg.dump.backupDir} = {
-      user = "root";
-      rrsyncArgs.ro = true;
-      authorizedKeysAttrs = [
-        "restrict"
-        "from=\"principal.pvv.ntnu.no,${values.hosts.principal.ipv6},${values.hosts.principal.ipv4}\""
-        "no-agent-forwarding"
-        "no-port-forwarding"
-        "no-pty"
-        "no-X11-forwarding"
-      ];
-      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGpMVrOppyqYaDiAhqmAuOaRsubFvcQGBGyz+NHB6+0o gitea rsync backup";
-    };
-  };
-
  systemd.services.gitea-dump = {
-    serviceConfig.ExecStart =
-      let
+    serviceConfig.ExecStart = let
      args = lib.cli.toGNUCommandLineShell { } {
        type = cfg.dump.type;

@@ -239,16 +209,13 @@ in
        # Logs are stored in the systemd journal
        skip-log = true;
      };
-      in
-      lib.mkForce "${lib.getExe cfg.package} ${args}";
+    in lib.mkForce "${lib.getExe cfg.package} ${args}";

    # Only keep n backup files at a time
-    postStop =
-      let
+    postStop = let
      cu = prog: "'${lib.getExe' pkgs.coreutils prog}'";
      backupCount = 3;
-      in
-      ''
+    in ''
      for file in $(${cu "ls"} -t1 '${cfg.dump.backupDir}' | ${cu "sort"} --reverse | ${cu "tail"} -n+${toString (backupCount + 1)}); do
        ${cu "rm"} "$file"
      done
--- a/hosts/kommode/services/gitea/gpg.nix
+++ b/hosts/kommode/services/gitea/gpg.nix
@@ -1,9 +1,4 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}:
+{ config, pkgs, lib, ... }:
 let
  cfg = config.services.gitea;
  GNUPGHOME = "${config.users.users.gitea.home}/gnupg";
--- a/hosts/kommode/services/gitea/import-users/default.nix
+++ b/hosts/kommode/services/gitea/import-users/default.nix
@@ -1,9 +1,4 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}:
+{ config, pkgs, lib, ... }:
 let
  cfg = config.services.gitea;
 in
--- a/Show More
+++ b/Show More