[fanny] add disable autoupdate option at startup

2026-02-21 12:55:49 +01:00
15 changed files with 68 additions and 420 deletions
--- a/.hydra/declarative-jobsets.nix
+++ b/.hydra/declarative-jobsets.nix
@@ -1,53 +0,0 @@
-{ nixpkgs, pulls, ... }:
-
-let
-  pkgs = import nixpkgs { };
-
-  prs = builtins.fromJSON (builtins.readFile pulls);
-  prJobsets = pkgs.lib.mapAttrs (num: info: {
-    enabled = 1;
-    hidden = false;
-    description = "PR ${num}: ${info.title}";
-    checkinterval = 300;
-    schedulingshares = 20;
-    enableemail = false;
-    emailoverride = "";
-    keepnr = 1;
-    type = 1;
-    flake = "gitea:git.dynamicdiscord.de/ahtlon/infrastructure/pulls/${num}";
-  }) prs;
-  mkFlakeJobset = branch: {
-    description = "Build ${branch} branch of Simple NixOS MailServer";
-    checkinterval = 300;
-    enabled = "1";
-    schedulingshares = 100;
-    enableemail = false;
-    emailoverride = "";
-    keepnr = 3;
-    hidden = false;
-    type = 1;
-    flake = "git:simple-nixos-mailserver/nixos-mailserver/${branch}";
-  };
-
-  desc = prJobsets // {
-    "master" = mkFlakeJobset "master";
-  };
-
-  log = {
-    pulls = prs;
-    jobsets = desc;
-  };
-
-in
-{
-  jobsets = pkgs.runCommand "spec-jobsets.json" { } ''
-    cat >$out <<'EOF'
-    ${builtins.toJSON desc}
-    EOF
-    # This is to get nice .jobsets build logs on Hydra
-    cat >tmp <<'EOF'
-    ${builtins.toJSON log}
-    EOF
-    ${pkgs.jq}/bin/jq . tmp
-  '';
-}
--- a/.hydra/spec.json
+++ b/.hydra/spec.json
@@ -1,30 +0,0 @@
-{
-  "enabled": 1,
-  "hidden": false,
-  "description": "Simple NixOS Mailserver",
-  "nixexprinput": "nixexpr",
-  "nixexprpath": ".hydra/declarative-jobsets.nix",
-  "checkinterval": 60,
-  "schedulingshares": 100,
-  "enableemail": false,
-  "emailoverride": "",
-  "keepnr": 3,
-  "type": 0,
-  "inputs": {
-    "nixexpr": {
-      "value": "https://git.dynamicdiscord.de/ahtlon/infrastructure master",
-      "type": "git",
-      "emailresponsible": false
-    },
-    "nixpkgs": {
-      "value": "https://github.com/NixOS/nixpkgs nixos-25.11",
-      "type": "git",
-      "emailresponsible": false
-    },
-    "pulls": {
-      "type": "path",
-      "value": "http://127.0.0.1:27364/gitea-pulls-sorted.json",
-      "emailresponsible": false
-    }
-  }
-}
--- a/flake.lock
+++ b/flake.lock
@@ -7,11 +7,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1768920986,
-        "narHash": "sha256-CNzzBsRhq7gg4BMBuTDObiWDH/rFYHEuDRVOwCcwXw4=",
+        "lastModified": 1746728054,
+        "narHash": "sha256-eDoSOhxGEm2PykZFa/x9QG5eTH0MJdiJ9aR00VAofXE=",
        "owner": "nix-community",
        "repo": "disko",
-        "rev": "de5708739256238fb912c62f03988815db89ec9a",
+        "rev": "ff442f5d1425feb86344c028298548024f21256d",
        "type": "github"
      },
      "original": {
@@ -78,6 +78,24 @@
        "type": "github"
      }
    },
+    "flake-utils_2": {
+      "inputs": {
+        "systems": "systems_3"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
    "home-manager": {
      "inputs": {
        "nixpkgs": [
@@ -120,17 +138,18 @@
    },
    "microvm": {
      "inputs": {
+        "flake-utils": "flake-utils_2",
        "nixpkgs": [
          "nixpkgs"
        ],
        "spectrum": "spectrum"
      },
      "locked": {
-        "lastModified": 1773018425,
-        "narHash": "sha256-fpgZBmZpKoEXEowBK/6m8g9FcOLWQ4UxhXHqCw2CpSM=",
+        "lastModified": 1764549796,
+        "narHash": "sha256-Mswg665P92EoHkBwCwPr/7bdnj04g2Qfb+t02ZEYTHA=",
        "owner": "astro",
        "repo": "microvm.nix",
-        "rev": "25ebda3c558e923720c965832dc9a04f559a055c",
+        "rev": "030d055e877cc13d7525b39f434150226d5e4482",
        "type": "github"
      },
      "original": {
@@ -162,11 +181,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1769813415,
-        "narHash": "sha256-nnVmNNKBi1YiBNPhKclNYDORoHkuKipoz7EtVnXO50A=",
+        "lastModified": 1764234087,
+        "narHash": "sha256-NHF7QWa0ZPT8hsJrvijREW3+nifmF2rTXgS2v0tpcEA=",
        "owner": "nix-community",
        "repo": "nixos-generators",
-        "rev": "8946737ff703382fda7623b9fab071d037e897d5",
+        "rev": "032a1878682fafe829edfcf5fdfad635a2efe748",
        "type": "github"
      },
      "original": {
@@ -177,11 +196,11 @@
    },
    "nixos-hardware": {
      "locked": {
-        "lastModified": 1772972630,
-        "narHash": "sha256-mUJxsNOrBMNOUJzN0pfdVJ1r2pxeqm9gI/yIKXzVVbk=",
+        "lastModified": 1764440730,
+        "narHash": "sha256-ZlJTNLUKQRANlLDomuRWLBCH5792x+6XUJ4YdFRjtO4=",
        "owner": "NixOS",
        "repo": "nixos-hardware",
-        "rev": "3966ce987e1a9a164205ac8259a5fe8a64528f72",
+        "rev": "9154f4569b6cdfd3c595851a6ba51bfaa472d9f3",
        "type": "github"
      },
      "original": {
@@ -209,11 +228,11 @@
    },
    "nixpkgs-unstable": {
      "locked": {
-        "lastModified": 1772963539,
-        "narHash": "sha256-9jVDGZnvCckTGdYT53d/EfznygLskyLQXYwJLKMPsZs=",
+        "lastModified": 1764517877,
+        "narHash": "sha256-pp3uT4hHijIC8JUK5MEqeAWmParJrgBVzHLNfJDZxg4=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "9dcb002ca1690658be4a04645215baea8b95f31d",
+        "rev": "2d293cbfa5a793b4c50d17c05ef9e385b90edf6c",
        "type": "github"
      },
      "original": {
@@ -225,11 +244,11 @@
    },
    "nixpkgs_2": {
      "locked": {
-        "lastModified": 1773068389,
-        "narHash": "sha256-vMrm7Pk2hjBRPnCSjhq1pH0bg350Z+pXhqZ9ICiqqCs=",
+        "lastModified": 1764522689,
+        "narHash": "sha256-SqUuBFjhl/kpDiVaKLQBoD8TLD+/cTUzzgVFoaHrkqY=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "44bae273f9f82d480273bab26f5c50de3724f52f",
+        "rev": "8bb5646e0bed5dbd3ab08c7a7cc15b75ab4e1d0f",
        "type": "github"
      },
      "original": {
@@ -264,11 +283,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1773096132,
-        "narHash": "sha256-M3zEnq9OElB7zqc+mjgPlByPm1O5t2fbUrH3t/Hm5Ag=",
+        "lastModified": 1764483358,
+        "narHash": "sha256-EyyvCzXoHrbL467YSsQBTWWg4sR96MH1sPpKoSOelB4=",
        "owner": "Mic92",
        "repo": "sops-nix",
-        "rev": "d1ff3b1034d5bab5d7d8086a7803c5a5968cd784",
+        "rev": "5aca6ff67264321d47856a2ed183729271107c9c",
        "type": "github"
      },
      "original": {
@@ -280,11 +299,11 @@
    "spectrum": {
      "flake": false,
      "locked": {
-        "lastModified": 1772189877,
-        "narHash": "sha256-i1p90Rgssb//aNiTDFq46ZG/fk3LmyRLChtp/9lddyA=",
+        "lastModified": 1759482047,
+        "narHash": "sha256-H1wiXRQHxxPyMMlP39ce3ROKCwI5/tUn36P8x6dFiiQ=",
        "ref": "refs/heads/main",
-        "rev": "fe39e122d898f66e89ffa17d4f4209989ccb5358",
-        "revCount": 1255,
+        "rev": "c5d5786d3dc938af0b279c542d1e43bce381b4b9",
+        "revCount": 996,
        "type": "git",
        "url": "https://spectrum-os.org/git/spectrum"
      },
@@ -353,6 +372,21 @@
        "type": "github"
      }
    },
+    "systems_5": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
    "tasklist": {
      "inputs": {
        "nixpkgs": [
@@ -411,7 +445,7 @@
    },
    "utils_3": {
      "inputs": {
-        "systems": "systems_3"
+        "systems": "systems_4"
      },
      "locked": {
        "lastModified": 1731533236,
@@ -429,7 +463,7 @@
    },
    "utils_4": {
      "inputs": {
-        "systems": "systems_4"
+        "systems": "systems_5"
      },
      "locked": {
        "lastModified": 1731533236,
--- a/machines/.sops.yaml
+++ b/machines/.sops.yaml
@@ -15,7 +15,6 @@ keys:
  - &machine_fanny age136sz3lzhxf74ryruvq34d4tmmxnezkqkgu6zqa3dm582c22fgejqagrqxk
  - &machine_nextcloud age1g084sl230x94mkd2wq92s03mw0e8mnpjdjfx9uzaxw6psm8neyzqqwpnqe
  - &machine_vaultwarden age1zs9puemeevc5kt84w9d2mc5396w0t9p60qxymkpatwvwxunzs5usmxr3an
-  - &machine_pretalx age1y04q8n7mgk82c87rfddm0u72h0ny6sfzktjsk0cc3gu93kezudfqdp9v9g
  #this dummy key is used for testing.
  - &machine_dummy age18jn5mrfs4gqrnv0e2sxsgh3kq4sgxx39hwr8z7mz9kt7wlgaasjqlr88ng
 creation_rules:
@@ -106,14 +105,6 @@ creation_rules:
      age:
      - *admin_atlan
      - *machine_vaultwarden
-  - path_regex: pretalx/secrets.yaml$
-    key_groups:
-    - pgp:
-      - *admin_kalipso
-      - *admin_kalipso_dsktp
-      age:
-      - *admin_atlan
-      - *machine_pretalx
  - path_regex: .*/secrets/.*
    key_groups:
    - pgp:
--- a/machines/durruti/host_config.nix
+++ b/machines/durruti/host_config.nix
@@ -63,16 +63,6 @@ in
      };
    };

-    services.nginx.virtualHosts."events.malobeo.org" = {
-      forceSSL = true;
-      enableACME= true;
-      locations."/" = {
-        proxyPass = "http://10.0.0.10";
-        extraConfig = ''
-        '';
-      };
-    };
-
    services.nginx.virtualHosts."tasklist.malobeo.org" = {
      forceSSL = true;
      enableACME= true;
--- a/machines/fanny/configuration.nix
+++ b/machines/fanny/configuration.nix
@@ -1,4 +1,4 @@
-{ inputs, config, ... }:
+{ inputs, config, lib, ... }:
 let
  sshKeys = import ../ssh_keys.nix;
  peers = import ../modules/malobeo/peers.nix;
@@ -47,6 +47,10 @@ in
    jobset = "infrastructure";
    cacheurl = "https://cache.dynamicdiscord.de";
  };
+  specialisation."NOAUTOUPDATE".configuration = {
+    system.nixos.tags = [ "NOAUTOUPDATE" ];
+    malobeo.autoUpdate.enable = lib.mkForce false;
+  };

  malobeo.backup = {
    enable = true;
@@ -145,7 +149,6 @@ in
    "durruti" 
    "zineshop"
    "vaultwarden"
-    "pretalx"
  ];

  networking = {
@@ -230,15 +233,6 @@ in
      };
    };

-    virtualHosts."events.malobeo.org" = {
-      locations."/" = {
-        proxyPass = "http://${hosts.malobeo.hosts.pretalx.network.address}";
-        extraConfig = ''
-          proxy_set_header Host $host;
-        '';
-      };
-    };
-
    virtualHosts."tasklist.malobeo.org" = {
      locations."/" = {
        proxyPass = "http://${hosts.malobeo.hosts.durruti.network.address}:8080";
--- a/machines/hosts.nix
+++ b/machines/hosts.nix
@@ -103,11 +103,6 @@ in
        type = "microvm";
        network = createMaloNet "17" "52:DA:0D:F9:EF:F3";
      };
-
-      pretalx = {
-        type = "microvm";
-        network = createMaloNet "18" "52:DA:0D:F9:EF:F4";
-      };
    };
  };
 }
--- a/machines/louise/configuration.nix
+++ b/machines/louise/configuration.nix
@@ -42,7 +42,6 @@
      mpv
      vlc
      simple-scan
-      bitwarden-desktop
    ];
  };

--- a/machines/modules/malobeo/microvm_host.nix
+++ b/machines/modules/malobeo/microvm_host.nix
@@ -14,12 +14,6 @@ in
        description = lib.mdDoc "Setup bridge device for microvms.";
      };

-      testHost = mkOption {
-        default = false;
-        type = types.bool;
-        description = lib.mdDoc "Enable when the host is used for development and testing using run-vm";
-      };
-
      interface = mkOption {
        default = "eno1";
        type = types.str;
@@ -74,7 +68,7 @@ in
    systemd.network = mkIf (cfg.enableHostBridge || cfg.enableHostBridgeUnstable) {
      enable = true;
      networks."10-lan" = {
-        matchConfig.Name = ["vm-*"] ++ (if !cfg.testHost then [ "${cfg.interface}" ] else [ ]);
+        matchConfig.Name = [ "${cfg.interface}" "vm-*"];
        networkConfig = {
          Bridge = "malobeo0";
        };
@@ -87,7 +81,7 @@ in
        };
      };
      
-      networks."10-lan-bridge" = if !cfg.testHost then {
+      networks."10-lan-bridge" = {
        matchConfig.Name = "malobeo0";
        networkConfig = {
          Address = [ "${cfg.address}" ];
@@ -96,17 +90,6 @@ in
          IPv6AcceptRA = true;
        };
        linkConfig.RequiredForOnline = "routable";
-      } else {
-        matchConfig.Name = "malobeo0";
-        networkConfig = {
-          DHCPServer = true;
-          IPv6SendRA = true;
-        };
-        addresses = if cfg.enableHostBridgeUnstable then [
-          { Address = "10.0.0.1/24"; }
-        ] else [
-          { Address = "10.0.0.1/24"; }
-        ];
      };
    }; 

--- a/machines/overwatch/configuration.nix
+++ b/machines/overwatch/configuration.nix
@@ -144,18 +144,6 @@ in
          targets = [ "${hosts.malobeo.hosts.zineshop.network.address}:9002" ];
        }];
      }
-      {
-        job_name = "vaultwarden";
-        static_configs = [{
-          targets = [ "${hosts.malobeo.hosts.vaultwarden.network.address}:9002" ];
-        }];
-      }
-      {
-        job_name = "pretalx";
-        static_configs = [{
-          targets = [ "${hosts.malobeo.hosts.pretalx.network.address}:9002" ];
-        }];
-      }
      {
        job_name = "fanny";
        static_configs = [{
--- a/machines/pretalx/configuration.nix
+++ b/machines/pretalx/configuration.nix
@@ -1,99 +0,0 @@
-{ config, self, lib, pkgs,  ... }:
-
-with lib;
-
-let
-  hosts = import ../hosts.nix {};
-in
-{
-  sops.defaultSopsFile = ./secrets.yaml;
-  sops.secrets = {
-    pretalx_smtp = {
-      owner = "pretalx";
-      group = "pretalx";
-    };
-  };
-
-  networking = {
-    hostName = mkDefault "pretalx";
-    useDHCP = false;
-  };
-
-  imports = [
-    self.nixosModules.malobeo.metrics
-    self.nixosModules.malobeo.users
-    ../modules/sshd.nix
-    ../modules/minimal_tools.nix
-    ../modules/autoupdate.nix
-  ];
-
-  malobeo.metrics = {
-    enable = true;
-    enablePromtail = true;
-    logNginx = true;
-  };
-
-  malobeo.users = {
-    admin = true;
-  };
-
-
-  services.postgresqlBackup = {
-    enable = true;
-  };
-
-  services.nginx = {
-    enable = true;
-    commonHttpConfig = /* nginx */ ''
-      proxy_headers_hash_bucket_size 64;
-    '';
-    virtualHosts = {
-      "events.malobeo.org" = {
-        forceSSL = false;
-        enableACME = false;
-      };
-    };
-  };
-
-
-  services.pretalx = {
-    enable = true;
-    celery.extraArgs = [
-      "--concurrency=${toString config.microvm.vcpu}"
-    ];
-    gunicorn.extraArgs = [
-      # https://docs.pretalx.org/administrator/installation/#step-6-starting-pretalx-as-a-service
-      "--log-level=info"
-      "--max-requests-jitter=50"
-      "--max-requests=1200"
-      "--workers=${toString config.microvm.vcpu}"
-
-      # TODO: 25.11 upstream
-      "--name=pretalx"
-      "--preload"
-    ];
-    nginx.domain = "events.malobeo.org";
-    environmentFiles = [
-      config.sops.secrets.pretalx_smtp.path
-    ];
-    settings = {
-      locale = {
-        language_code = "de";
-      };
-      mail = {
-        from = "malobot@systemli.org";
-        user = "malobot@systemli.org";
-        host = "mail.systemli.org";
-        port = "465";
-        ssl = true;
-        tls = false;
-      };
-
-    };
-  };
-
-  networking.firewall.allowedTCPPorts = [ 80 443 ];
-
-  system.stateVersion = "22.11"; # Did you read the comment?
-}
-
--- a/machines/pretalx/dummy.yaml
+++ b/machines/pretalx/dummy.yaml
@@ -1,64 +0,0 @@
-pretalx_smtp: ENC[AES256_GCM,data:zYnhuulpJAEEacXxpqNG2GEVrV21H0UZfx3sqZaZxWYL2HW6WwFMZ2PeGL8bWCv92+iZ2DGkhg==,iv:kMJLfeQ+9ZZFc6T+HnS64p9BJUy38nXrakAOXdQ0gIU=,tag:l8/eSrcOtt9MLnqcif5v2A==,type:str]
-sops:
-    age:
-        - recipient: age18jn5mrfs4gqrnv0e2sxsgh3kq4sgxx39hwr8z7mz9kt7wlgaasjqlr88ng
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNZXExRE14NDF6cnFRSE9G
-            RjdxV09UMXUvczBQai9GQW5PT2g0eUZhSUVvClRZL1dJVlpKUTArTkhhR2JCV1VG
-            cktFb21wNDZiZC9oc2l5VS9hdzVhbFUKLS0tIGZZa2Z2R0Nvd3RUbWRHMkFJMjVK
-            QXdRdkVwSFg2TVRBYU1qWFJ2bE9hWFUK8HuJ9ErFU0yH3QlXl1tnmawNX0fHDOFb
-            g+DpDYKccGcC6PxNOE/CsftJqGLtFlToYHOYWG18bFjNZawUoaOfLQ==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3S0s4UlZuSWc3K3cvTDBR
-            WEt2L3hYSGRVWHBYbEtoci9rYkJEK1hYSkRZCkM5S25YNGM2Y3R0MG9lWUNJem9P
-            bnJXbTRFZUpUVmhWVVVqeVhjdDV2SWMKLS0tIEdXbXU0RkJ6ZzBTcTdiZlJPbG83
-            RW8zUzBkNjViYnVFY3MyM1ZENmZXVmcK4144dF921EuNaofNhaYw9Yh56KHdfQD/
-            vxPkp5jC02Wbb6hjImd+oMUg3jgCbWC4j3Qpvaky8Ig2AaJRhtqlxg==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-03-09T11:58:41Z"
-    mac: ENC[AES256_GCM,data:n11H0rFtXvCeleTKXnQ8tORm3YH11tvjRd/PYSRof8EIUpQ7ZtyVqdYqPZCUuck12LG8hh9+GBBpXIRDhwEJlteC61Vl0syW9bQvCbfETvIgRZsoIZr+mofYHe1twm73sd7YaGzC6xxVm5HZG/qS1LflHah6jFO6NkgQ0GpLPTE=,iv:np3bKJIbVwn96rMBeedLmw6f1him35waUWN6LJ5MLNk=,tag:fs8rmrSkK1REaUKJHxeSbw==,type:str]
-    pgp:
-        - created_at: "2026-03-09T11:58:34Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQGMA5HdvEwzh/H7AQv/VMIZlsBZPEolTd0yUfHyZ5PRsQDirt4hOuVFGXdKi8tb
-            Pk+L3y69ynfF+ZJsu41+GdVgaNX58bbdqJfnEgE+k35IrJxYmVlNuUmd5s79rOHQ
-            b1dn6SdoVrKTAgtrnicO0n0F41XZBSpqP4wKVHigsWgfHkaUUsI+5d/T/2F+VCcS
-            slhvveCMKNjDlK9sukp5TBiX+xrWTq4QIbMS7L6VSlwHod72bp73o7RV9PgoO4vy
-            aodYiPmJqDjF0Az7JXdu2UdWJGUYxNWb5jHCT3qpcZyX1kVSmZvcRjxtVVCySFx+
-            agcavtdlEV3t8JOOvVmYoxwNOGjDvJ83k6wdueFpoJFE4Z1pHy/XCVCHykmWH/+m
-            nYADzmg+GiOSrTR2xWEmkesrByOMucYiZngDV3RLuZraE+8PJbqX2aAAip1Ol6AX
-            eYGCtLw/cXvDM1ngdj/4vaelek/TMLRRmuDyzVHevnqMGhdgAp4Ns6+ihZajSYkK
-            4YqUSKOMHrfEwbZgGYGW0lgB4cv1uzPgyufcPWzg8oAS0/2jW6KjZPLIx4SYcp41
-            C3BE/osbnyzGhzmabNstFbVmBYF1iK73O/Np2PGj3glBsE7PNMmcDu4ASaEI1nNw
-            CpOmQCR9jRGi
-            =6itD
-            -----END PGP MESSAGE-----
-          fp: c4639370c41133a738f643a591ddbc4c3387f1fb
-        - created_at: "2026-03-09T11:58:34Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA98TrrsQEbXUAQ//aQNOD855rikMtrXENG/XA5dZeKGaLQAv0kWUHuJbRddn
-            IB9pW+Y8AgyB6xc9A4oKOKgjT8TCSYvGI6zDchf5tjrvQwmiMlpQouflcjR+UgDy
-            mANqL2+7GLFVcTuQfRPbEdK54Q78KciQ2bxMeh0WDZ5vV8fCTz+aPsvlNT8AJBcq
-            BO4dyG1oqCT13ln7g7LoHPn22wAj+H93F8aqyFk6YjgomKRf0j9gAW/NI1w8TIsg
-            etgMBrn0AupANrADQHAij1zSS+GaK8ZMBVgCoInc9gAQl97ytMLp/eQj4Ll69r+z
-            JRhFdFDZgP0UIIFurAU5eFixNq8IZnFYvFRGpR/XzAiOh8JfgWUDs5HSLyRcADi9
-            XxLsEnTFm1kfoI+lpma0WtlAIXg2WpCoaU3B2kB15T4giVs6LWGmssux5t8uKTFR
-            DySHvdl9o78zBFPVxhW+j9h04fAeUmCWZYKpnEdFwKpBmGWtnC5rvz22Xwu3Q/wT
-            HioLzvETqVn+knc/ErR6Axw4A9zeLi1AccJdceVopR7rEq+0DjpLV/zYqwGruQaa
-            q1qtQIgPf888TKtNgAGSxQ2nUfkMM2oK2cC6r2juhxwbmTFcz6FUV41To9/hCo1c
-            1SE4ZiRu7R8i+KFn4K2y6RGRkJo75trJkxuwGvAYuo6gGUmj50EeimFx0rKRddfS
-            WAH8JPQH6ohAqaA1hdrQRM7lPtwjPCfJW/fUqPHAR5Ytwn9xmt0A+jQYvmubH9dR
-            UT8OMUOIh2XC2JDYt4P4pFXXODB6WPb3Fdft6S95+vLhx6eHuo7PvVM=
-            =KkYj
-            -----END PGP MESSAGE-----
-          fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4
-    unencrypted_suffix: _unencrypted
-    version: 3.11.0
--- a/machines/pretalx/secrets.yaml
+++ b/machines/pretalx/secrets.yaml
@@ -1,64 +0,0 @@
-pretalx_smtp: ENC[AES256_GCM,data:Jrgx1/AsgTb1KxtgiTPGRkgtl5EHPWHPde4ItwOHH9lcmakAb1b2n4JP70vF53uuKIfiyCPeVQ==,iv:fcVFgjKSGTaFxC1DAX2Sb6WD/IbJO0s1A63wrQkLWbg=,tag:NjcNwa+6h/boRemEg1j9ng==,type:str]
-sops:
-    age:
-        - recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxb1dGalUyNzVtYjFFNm9T
-            a3ord2NSTEE3UkhrTm1TbHdMV3lITHJRLzJvCnAxeUZib0d0dCtUZ0x3NUtsdzdD
-            SjVYY0Y4MXhGRVZGZTRiNHJHSHNkb0kKLS0tIGtCL0puTDRZcUsrc2VRUU1URERs
-            Y084Z0tGR3JPZkw5ci9icFVSd051bE0KXaT1mPUBFUorZ/zgYjDyqWGbnHAkcjmZ
-            KVZJae9HC35+mq9mme7XOH96NX6tq69Hg+TUFoQg1m2Ifz27GKD3bQ==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1y04q8n7mgk82c87rfddm0u72h0ny6sfzktjsk0cc3gu93kezudfqdp9v9g
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWVVJyZFZCTVZhUXN0WFJu
-            UWU2UWxTY3ErWHVhMGNGU0t3N0c2ekM5a0NvCkVtTDdyeEVMQzY5RUg1NnVZVHd1
-            a1U4cytPSjU3K0NaSmJDdk5peHM5emMKLS0tIGhTemxzbjBzNkFILy9QRG53V0lX
-            dEZTQVpCOUNDSW0yRS9rYkZkVjZPRG8K/Hea01veMQ0Gxo//24PRhDcncYUuExpQ
-            T4ff4CNXF2vDYDsSIPDlhHdmSRGmoCw00ChCZ8vvIlHl2O86Qmd0Ng==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-03-09T11:58:07Z"
-    mac: ENC[AES256_GCM,data:QWFdEg+I1YUH65qPUQvOwwb7i+X+HYKdhYJiLoku+XcvYq4xFaoBvFTW3eZ/S2i20yK1SQcAVjUe7JQEgZDtqzPdZH6w4YIZJVvQdDMPy99xdXXEZrnW+rHOy60XFS7WiyeUdLA3TQ4+Ec1f2kkQw7MhbDbOoOh0obsvfhtz3OE=,iv:h4Qn/LpayhXCWWsO/nm18Rapz6WXQcjItF9YwyiFJJ0=,tag:bxtQQMNgVyFkHp+pbSP3UQ==,type:str]
-    pgp:
-        - created_at: "2026-03-09T11:57:24Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQGMA5HdvEwzh/H7AQwAkahLpq8vqQn6N5EyrbC+33Ohl61ZbBPR6NnQaLvU3s+i
-            WJ3xe7T+LP0jv2C2t//VhYvVNolQ2LBA+yLE3Cvjw6JCyVhu54ZRDJciY2w/wY5J
-            MN++Bqac6avoEYHkvoN6m1/F8JK46fzgQT7xXFTGix+g1W48aSC70GRZUmsg469p
-            ZFYbj/mEseG1ICxhZANU2NgRgW7kA/La/fe3/+YE8tkNHSXF2ZevQvluarm7kXT9
-            KWani1wMlUMwZoCpwbfNwKpXPL0jW48FJsFIlxPbDrDCkR1gih1PHFVyqd45am9g
-            Uo0hJ1NOKzm5Cy5c/3xJzaP62UWyNJf+v5VojEg2XfSGqtaZDFQsLK0of5G/XArn
-            C7k7UbQJqz15rHWPznIppv2h+cTIsVDQcz77es1/qaOQyCMHdYqdkzi5YV7DJBZS
-            K6PP3Nt77uL4LGRL0vFtBgdhKFtXAAf8lhRfZJcJ2P9BYvaFdRUfjm/r0TNfCref
-            k2WCesk4F/pQSyB3ofuR0lYBJzlZ3iNpl7DlfyZ6DRZ/+aVFceRf9A8QKtkVmdMt
-            noqBJfLzhWgVmUUh3DO97mJV5pNOx8238vqVTxWrUqZXjXdXaUDaFUDXvgwg3GOA
-            N28ZjLy1XA==
-            =mIVi
-            -----END PGP MESSAGE-----
-          fp: c4639370c41133a738f643a591ddbc4c3387f1fb
-        - created_at: "2026-03-09T11:57:24Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA98TrrsQEbXUAQ//cnVHHJEwQn+W8Jkt+jwgnKCgbRutvG3U8hlXizzdk2RI
-            j6nVPpv2DwuXvX3ktnng8XrmWwXf9rFRRltVs7alenEnHLxiDd5w+WYeH4NCHOFr
-            +vvFwxNOxzLDj5B2Fjod4El70jUdrP6Mqzy37DPu1Gb2qIUEwdF1LEzM4FMWdeWL
-            BA0wCJzlTXzdlb0shw7xEsqvmnL11u+aQ8AVU3kgWxSkn0VZJIYYkwegUYfflSIr
-            wZsNsh8k+wG58f5IVr8SqnzkfxRfJSoxNKWV9dK3a9hJnnD3DUhqnOgvCnPCRKSP
-            drH+7KxqmNBxqQK3f2iJvgcyLQwyEEqF2Rt6gXwyDByHy3ewupAQD0aQwi5HMWcK
-            iEUVSQVZ6jRfAIyDs3sBnBHceB9BShFr+NN9eUjKJWm2QD4TdQamnpMLsQGpdZv5
-            Lomk9VfdZPNw7DAKJs1oDeBRmhAP/crlOW/ZZho9mewKHr7Htu3VZP812GVupJns
-            IK9mMnpwAhgCtChcOj/ule9NcA/AWKcrtdAyId11SvjtMO+ZjRFrOCK1wKgIif3p
-            ogjaK38v/7gy4/8CDyVgru+luNklsRHfZr+BuPGBDDL8M7umXilK+GyGO1CnrjxW
-            DJXdvMe+u75OsYvGv7eX0tqd+ePanCEoDXxFJbMc2QZigD2kZgq+qRM9CxJ2jCXS
-            VgEEHybyGrOo5RcJkpk+UQpb2aTMLgFNqkTn0PRQSMFeXVQIt584a9xZs1TQ7ZsT
-            5H4jaFXFcS+GG09CORbkf2fkQI2KpaqBAGFct21K2hY17Tpm7kgC
-            =yGms
-            -----END PGP MESSAGE-----
-          fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4
-    unencrypted_suffix: _unencrypted
-    version: 3.11.0
--- a/machines/vaultwarden/configuration.nix
+++ b/machines/vaultwarden/configuration.nix
@@ -18,17 +18,10 @@ with lib;
  imports = [
    ../modules/malobeo_user.nix
    ../modules/sshd.nix
-    inputs.self.nixosModules.malobeo.metrics
  ];

  networking.firewall.allowedTCPPorts = [ 80 ];

-  malobeo.metrics = {
-    enable = true;
-    enablePromtail = true;
-    logNginx = true;
-  };
-
  services.nginx = {
    enable = true;
    virtualHosts."keys.malobeo.org" = {
--- a/machines/vpn/configuration.nix
+++ b/machines/vpn/configuration.nix
@@ -58,15 +58,6 @@ with lib;
      };
    };

-    virtualHosts."events.malobeo.org" = {
-      locations."/" = {
-        proxyPass = "http://10.100.0.101";
-        extraConfig = ''
-          proxy_set_header Host $host;
-        '';
-      };
-    };
-
    virtualHosts."tasklist.malobeo.org" = {
      locations."/" = {
        proxyPass = "http://10.100.0.101";