[gitea] init

[doc] add basic microvm documentation
[docs] fix docs app exec format error
2024-11-19 19:41:51 +01:00 · 2024-11-19 15:43:23 +01:00 · 2024-11-19 15:31:27 +01:00 · 2024-11-19 13:31:09 +01:00 · 2024-11-19 13:03:47 +01:00 · 2024-11-19 12:59:11 +01:00
35 changed files with 726 additions and 314 deletions
--- a/.gitea/workflows/eval-hydra-jobs.yml
+++ b/.gitea/workflows/eval-hydra-jobs.yml
@@ -0,0 +1,15 @@
+name: "Evaluate Hydra Jobs"
+on:
+  pull_request:
+  push:
+jobs:
+  eval-hydra-jobs:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+    - name: Install dependencies for Nix setup action
+      run: |
+        apt update -y
+        apt install sudo -y        
+    - uses: cachix/install-nix-action@v27
+    - run: nix eval --no-update-lock-file --accept-flake-config .\#hydraJobs
--- a/.gitignore
+++ b/.gitignore
@@ -3,3 +3,5 @@
 *.log
 result
 *.qcow2
+.direnv/
+book/
--- a/README.md
+++ b/README.md
@@ -98,32 +98,3 @@ for documentation we currently just use README.md files.

 the devshell provides the python package ['grip'](https://github.com/joeyespo/grip) which can be used to preview different README.md files in the browser.
 the usage is simple, just run ```grip``` in the same folder as the README.md you wanna preview. then open your browser at ```http://localhost:6419 ```.
-
-## todos...
-
-#### infrastructure
-* [ ] host a local wiki with public available information about the space, for example:
-  * [ ] how to use coffe machine
-  * [ ] how to turn on/off electricity
-  * [ ] how to use beamer
-  * [ ] how to buecher ausleihen
-  * ...
-* [x] host some pad (codimd aka hedgedoc)
-* [ ] some network fileshare for storing the movies and streaming them within the network
-* [x] malobeo network infrastructure rework
-  * [x] request mulvad acc
-  * [x] remove freifunk, use openwrt with mulvad configured
-
-#### external services
-we want to host two services that need a bit more resources, this is a booking system for the room itself and a library system.
- [x] analyse best way to include our stuff into external nixOs server
-  - [x] writing some module that is included by the server
-  - [x] directly use nixOs container on host
-  - [x] combination of both (module that manages nginx blabla + nixOs container for the services
-
-#### bots&progrmaming
-* [ ] create telegram bot automatically posting tuesday events
-* [x] create webapp/interface replacing current task list pad
-  * could be a simple form for every tuesday
-  * [x] element bot should send updates if some tasks are not filled out
-
--- a/doc/.gitignore
+++ b/doc/.gitignore
@@ -0,0 +1 @@
+book
--- a/doc/book.toml
+++ b/doc/book.toml
@@ -0,0 +1,6 @@
+[book]
+authors = ["ahtlon"]
+language = "de"
+multilingual = false
+src = "src"
+title = "Malobeo Infrastruktur Dokumentation"
--- a/doc/src/Index.md
+++ b/doc/src/Index.md
@@ -0,0 +1 @@
+# Index
--- a/doc/src/SUMMARY.md
+++ b/doc/src/SUMMARY.md
@@ -0,0 +1,17 @@
+# Summary
+
+- [Index](./Index.md)
+    - [Info]()
+        - [Aktuelle Server]()
+            - [Durruti](./server/durruti.md)
+            - [Lucia](./server/lucia.md)
+        - [Hardware]()
+        - [Netzwerk]()
+        - [Seiten]()
+            - [Website](./server/website.md)
+            - [musik](./projekte/musik.md)
+        - [TODO](./todo.md)
+    - [How-to]()
+        - [Updates](./anleitung/updates.md)
+        - [Rollbacks](./anleitung/rollback.md)
+        - [MicroVM](./anleitung/microvm.md)
--- a/doc/src/anleitung/microvm.md
+++ b/doc/src/anleitung/microvm.md
@@ -0,0 +1,39 @@
+### Declaring a MicroVM
+
+The hosts nixosSystems modules should be declared using the ```makeMicroVM``` helper function.
+Use durruti as orientation:
+``` nix
+    modules = makeMicroVM "durruti" "10.0.0.5" [
+      ./durruti/configuration.nix
+    ];
+```
+
+"durruti" is the hostname.  
+"10.0.0.5" is the IP assigned to its tap interface.  
+
+### Testing MicroVMs locally
+MicroVMs can be built and run easily on your local host.
+For durruti this is done by:
+``` bash
+sudo nix run .\#nixosConfigurations.durruti.config.microvm.declaredRunner
+```
+
+It seems to be necessary to run this as root so that the according tap interface can be created.
+To be able to ping the VM or give Internet Access to the VM your host needs to be setup as described below.
+
+### Host Setup
+To provide network access to the VMs a bridge interface needs to be created on your host.
+For that:
+- Add the infrastructure flake as input to your hosts flake  
+- Add ```inputs.malobeo.nixosModules.malobeo``` to your hosts imports
+- enable the host bridge: ```services.malobeo.microvm.enableHostBridge = true;```
+
+If you want to provide Internet access to the VM it is necessary to create a nat.
+This could be done like this:
+``` nix
+networking.nat = {
+  enable = true;
+  internalInterfaces = [ "microvm" ];
+  externalInterface = "eth0"; #change to your interface name
+};
+```
--- a/doc/src/anleitung/rollback.md
+++ b/doc/src/anleitung/rollback.md
@@ -0,0 +1 @@
+# Rollbacks
--- a/doc/src/anleitung/updates.md
+++ b/doc/src/anleitung/updates.md
@@ -0,0 +1 @@
+# Updates
--- a/doc/src/projekte/musik.md
+++ b/doc/src/projekte/musik.md
@@ -0,0 +1 @@
+# musik
--- a/doc/src/server/durruti.md
+++ b/doc/src/server/durruti.md
@@ -0,0 +1,2 @@
+# Durruti
+Hetzner Server
--- a/doc/src/server/lucia.md
+++ b/doc/src/server/lucia.md
@@ -0,0 +1,2 @@
+# Lucia
+Lokaler Raspberry Pi 3
--- a/doc/src/server/website.md
+++ b/doc/src/server/website.md
@@ -0,0 +1,7 @@
+#Website
+
+hosted on uberspace  
+runs malobeo.org(wordpress) and forum.malobeo.org(phpbb)  
+access via ssh with public key or password  
+Files under /var/www/virtual/malobeo/html
+
--- a/doc/src/todo.md
+++ b/doc/src/todo.md
@@ -0,0 +1,32 @@
+# TODO
+- [ ] Dieses wiki schreiben
+#### infrastructure
+* [ ] host a local wiki with public available information about the space, for example:
+  * [ ] how to use coffe machine
+  * [ ] how to turn on/off electricity
+  * [ ] how to use beamer
+  * [ ] how to buecher ausleihen
+  * ...
+- [x] host a local wiki with infrastructure information
+* [x] host some pad (codimd aka hedgedoc)
+* [ ] some network fileshare for storing the movies and streaming them within the network
+  - Currently developed in the 'fileserver' branch
+    - NFSV4 based
+* [x] malobeo network infrastructure rework
+  * [x] request mulvad acc
+  * [x] remove freifunk, use openwrt with mulvad configured
+* [ ] evaluate imposing solutions
+    * [ ] pdfarranger
+
+#### external services
+we want to host two services that need a bit more resources, this is a booking system for the room itself and a library system.
+- [x] analyse best way to include our stuff into external nixOs server
+  - [x] writing some module that is included by the server
+  - [x] directly use nixOs container on host
+  - [x] combination of both (module that manages nginx blabla + nixOs container for the services
+
+#### bots&progrmaming
+* [ ] create telegram bot automatically posting tuesday events
+* [x] create webapp/interface replacing current task list pad
+  * could be a simple form for every tuesday
+  * [x] element bot should send updates if some tasks are not filled out
--- a/flake.lock
+++ b/flake.lock
@@ -8,11 +8,11 @@
        "utils": "utils"
      },
      "locked": {
-        "lastModified": 1706278226,
-        "narHash": "sha256-PfLIjoCzTp/wBxEA1/lxH0worupATAHW2bM8qerm59M=",
+        "lastModified": 1719395767,
+        "narHash": "sha256-Uu7dhaTBdPplKsxQx37xGKihXbQymh80nNlxofjsEw4=",
        "ref": "refs/heads/master",
-        "rev": "5ea5fa2f15ab5eedce812c36546247494a73ed3c",
-        "revCount": 18,
+        "rev": "a4128e9603f9decbdf531dbfc6131d238742c211",
+        "revCount": 20,
        "type": "git",
        "url": "https://git.dynamicdiscord.de/kalipso/ep3-bs.nix"
      },
@@ -21,6 +21,24 @@
        "url": "https://git.dynamicdiscord.de/kalipso/ep3-bs.nix"
      }
    },
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems_3"
+      },
+      "locked": {
+        "lastModified": 1726560853,
+        "narHash": "sha256-X6rJYSESBVr3hBoH0WbKE5KvhPU5bloyZ2L4K60/fPQ=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "c1dfcf08411b08f6b8615f7d8971a2bfa81d5e8a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
    "home-manager": {
      "inputs": {
        "nixpkgs": [
@@ -28,16 +46,16 @@
        ]
      },
      "locked": {
-        "lastModified": 1717476296,
-        "narHash": "sha256-ScHe38Tr+TxGURC17kby4mIIxOG3aJvZWXzPM79UnEk=",
+        "lastModified": 1726989464,
+        "narHash": "sha256-Vl+WVTJwutXkimwGprnEtXc/s/s8sMuXzqXaspIGlwM=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "095ef64aa3b2ab4a4f1bf07f29997e21e3a5576a",
+        "rev": "2f23fa308a7c067e52dfcc30a0758f47043ec176",
        "type": "github"
      },
      "original": {
        "owner": "nix-community",
-        "ref": "release-23.11",
+        "ref": "release-24.05",
        "repo": "home-manager",
        "type": "github"
      }
@@ -61,13 +79,35 @@
        "type": "github"
      }
    },
+    "microvm": {
+      "inputs": {
+        "flake-utils": "flake-utils",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "spectrum": "spectrum"
+      },
+      "locked": {
+        "lastModified": 1731240174,
+        "narHash": "sha256-HYu+bPoV3UILhwc4Ar5iQ7aF+DuQWHXl4mljN6Bwq6A=",
+        "owner": "astro",
+        "repo": "microvm.nix",
+        "rev": "dd89404e1885b8d7033106f3898eaef8db660cb2",
+        "type": "github"
+      },
+      "original": {
+        "owner": "astro",
+        "repo": "microvm.nix",
+        "type": "github"
+      }
+    },
    "nixlib": {
      "locked": {
-        "lastModified": 1712450863,
-        "narHash": "sha256-K6IkdtMtq9xktmYPj0uaYc8NsIqHuaAoRBaMgu9Fvrw=",
+        "lastModified": 1729386149,
+        "narHash": "sha256-hUP9oxmnOmNnKcDOf5Y55HQ+NnoT0+bLWHLQWLLw9Ks=",
        "owner": "nix-community",
        "repo": "nixpkgs.lib",
-        "rev": "3c62b6a12571c9a7f65ab037173ee153d539905f",
+        "rev": "cce4521b6df014e79a7b7afc58c703ed683c916e",
        "type": "github"
      },
      "original": {
@@ -84,11 +124,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1718025593,
-        "narHash": "sha256-WZ1gdKq/9u1Ns/oXuNsDm+W0salonVA0VY1amw8urJ4=",
+        "lastModified": 1729472750,
+        "narHash": "sha256-s93LPHi5BN7I2xSGNAFWiYb8WRsPvT1LE9ZjZBrpFlg=",
        "owner": "nix-community",
        "repo": "nixos-generators",
-        "rev": "35c20ba421dfa5059e20e0ef2343c875372bdcf3",
+        "rev": "7c60ba4bc8d6aa2ba3e5b0f6ceb9fc07bc261565",
        "type": "github"
      },
      "original": {
@@ -99,11 +139,11 @@
    },
    "nixos-hardware": {
      "locked": {
-        "lastModified": 1719322773,
-        "narHash": "sha256-BqPxtFwXrpJQDh65NOIHX99pz2rtIMshG9Mt2xnnc5c=",
+        "lastModified": 1730919458,
+        "narHash": "sha256-yMO0T0QJlmT/x4HEyvrCyigGrdYfIXX3e5gWqB64wLg=",
        "owner": "NixOS",
        "repo": "nixos-hardware",
-        "rev": "caabc425565bbd5c8640630b0bf6974961a49242",
+        "rev": "e1cc1f6483393634aee94514186d21a4871e78d7",
        "type": "github"
      },
      "original": {
@@ -131,27 +171,27 @@
    },
    "nixpkgs-stable": {
      "locked": {
-        "lastModified": 1719099622,
-        "narHash": "sha256-YzJECAxFt+U5LPYf/pCwW/e1iUd2PF21WITHY9B/BAs=",
+        "lastModified": 1730602179,
+        "narHash": "sha256-efgLzQAWSzJuCLiCaQUCDu4NudNlHdg2NzGLX5GYaEY=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "5e8e3b89adbd0be63192f6e645e0a54080004924",
+        "rev": "3c2f1c4ca372622cb2f9de8016c9a0b1cbd0f37c",
        "type": "github"
      },
      "original": {
        "owner": "NixOS",
-        "ref": "release-23.11",
+        "ref": "release-24.05",
        "repo": "nixpkgs",
        "type": "github"
      }
    },
    "nixpkgs-unstable": {
      "locked": {
-        "lastModified": 1719075281,
-        "narHash": "sha256-CyyxvOwFf12I91PBWz43iGT1kjsf5oi6ax7CrvaMyAo=",
+        "lastModified": 1730785428,
+        "narHash": "sha256-Zwl8YgTVJTEum+L+0zVAWvXAGbWAuXHax3KzuejaDyo=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "a71e967ef3694799d0c418c98332f7ff4cc5f6af",
+        "rev": "4aa36568d413aca0ea84a1684d2d46f55dbabad7",
        "type": "github"
      },
      "original": {
@@ -163,11 +203,11 @@
    },
    "nixpkgs_2": {
      "locked": {
-        "lastModified": 1719145550,
-        "narHash": "sha256-K0i/coxxTEl30tgt4oALaylQfxqbotTSNb1/+g+mKMQ=",
+        "lastModified": 1730883749,
+        "narHash": "sha256-mwrFF0vElHJP8X3pFCByJR365Q2463ATp2qGIrDUdlE=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "e4509b3a560c87a8d4cb6f9992b8915abf9e36d8",
+        "rev": "dba414932936fde69f0606b4f1d87c5bc0003ede",
        "type": "github"
      },
      "original": {
@@ -182,6 +222,7 @@
        "ep3-bs": "ep3-bs",
        "home-manager": "home-manager",
        "mfsync": "mfsync",
+        "microvm": "microvm",
        "nixos-generators": "nixos-generators",
        "nixos-hardware": "nixos-hardware",
        "nixpkgs": "nixpkgs_2",
@@ -199,11 +240,11 @@
        "nixpkgs-stable": "nixpkgs-stable"
      },
      "locked": {
-        "lastModified": 1719268571,
-        "narHash": "sha256-pcUk2Fg5vPXLUEnFI97qaB8hto/IToRfqskFqsjvjb8=",
+        "lastModified": 1731047660,
+        "narHash": "sha256-iyp51lPWEQz4c5VH9bVbAuBcFP4crETU2QJYh5V0NYA=",
        "owner": "Mic92",
        "repo": "sops-nix",
-        "rev": "c2ea1186c0cbfa4d06d406ae50f3e4b085ddc9b3",
+        "rev": "60e1bce1999f126e3b16ef45f89f72f0c3f8d16f",
        "type": "github"
      },
      "original": {
@@ -212,6 +253,22 @@
        "type": "github"
      }
    },
+    "spectrum": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1729945407,
+        "narHash": "sha256-iGNMamNOAnVTETnIVqDWd6fl74J8fLEi1ejdZiNjEtY=",
+        "ref": "refs/heads/main",
+        "rev": "f1d94ee7029af18637dbd5fdf4749621533693fa",
+        "revCount": 764,
+        "type": "git",
+        "url": "https://spectrum-os.org/git/spectrum"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://spectrum-os.org/git/spectrum"
+      }
+    },
    "systems": {
      "locked": {
        "lastModified": 1681028828,
@@ -242,6 +299,36 @@
        "type": "github"
      }
    },
+    "systems_3": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_4": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
    "tasklist": {
      "inputs": {
        "nixpkgs": [
@@ -249,11 +336,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1719327780,
-        "narHash": "sha256-dA5mQinY/VKxzhgMz6oPGUXCS660RWAtherW7B0+aAk=",
+        "lastModified": 1729717517,
+        "narHash": "sha256-Gul0Zqy0amouh8Hs8BL/DIKFYD6BmdTo4H8+5K5+mTo=",
        "ref": "refs/heads/master",
-        "rev": "c60fc43f733fb0368529e72f5e07c424b30055fb",
-        "revCount": 15,
+        "rev": "610269a14232c2888289464feb5227e284eef336",
+        "revCount": 27,
        "type": "git",
        "url": "https://git.dynamicdiscord.de/kalipso/tasklist"
      },
@@ -263,12 +350,15 @@
      }
    },
    "utils": {
+      "inputs": {
+        "systems": "systems"
+      },
      "locked": {
-        "lastModified": 1678901627,
-        "narHash": "sha256-U02riOqrKKzwjsxc/400XnElV+UtPUQWpANPlyazjH0=",
+        "lastModified": 1694529238,
+        "narHash": "sha256-zsNZZGTGnMOf9YpHKJqMSsa0dXbfmxeoJ7xHlrt+xmY=",
        "owner": "numtide",
        "repo": "flake-utils",
-        "rev": "93a2b84fc4b70d9e089d029deacc3583435c2ed6",
+        "rev": "ff7b65b44d01cf9ba6a71320833626af21126384",
        "type": "github"
      },
      "original": {
@@ -279,7 +369,7 @@
    },
    "utils_2": {
      "inputs": {
-        "systems": "systems"
+        "systems": "systems_2"
      },
      "locked": {
        "lastModified": 1701680307,
@@ -297,14 +387,14 @@
    },
    "utils_3": {
      "inputs": {
-        "systems": "systems_2"
+        "systems": "systems_4"
      },
      "locked": {
-        "lastModified": 1710146030,
-        "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
+        "lastModified": 1726560853,
+        "narHash": "sha256-X6rJYSESBVr3hBoH0WbKE5KvhPU5bloyZ2L4K60/fPQ=",
        "owner": "numtide",
        "repo": "flake-utils",
-        "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
+        "rev": "c1dfcf08411b08f6b8615f7d8971a2bfa81d5e8a",
        "type": "github"
      },
      "original": {
--- a/flake.nix
+++ b/flake.nix
@@ -2,13 +2,18 @@
  description = "malobeo infrastructure";

  inputs = {
-    utils.url = "github:numtide/flake-utils";
    nixos-hardware.url = "github:NixOS/nixos-hardware/master";
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.05";
    nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixos-unstable";
    sops-nix.url = "github:Mic92/sops-nix";
    sops-nix.inputs.nixpkgs.follows = "nixpkgs";
    mfsync.url = "github:k4lipso/mfsync";
+    microvm.url = "github:astro/microvm.nix";
+    microvm.inputs.nixpkgs.follows = "nixpkgs";
+
+    utils = {
+      url = "github:numtide/flake-utils";
+    };

    tasklist = {
      url = "git+https://git.dynamicdiscord.de/kalipso/tasklist";
@@ -26,7 +31,7 @@
    };

    home-manager=  {
-      url = "github:nix-community/home-manager/release-23.11";
+      url = "github:nix-community/home-manager/release-24.05";
      inputs = {
        nixpkgs.follows = "nixpkgs";
      };
--- a/machines/.sops.yaml
+++ b/machines/.sops.yaml
@@ -7,6 +7,7 @@ keys:
  - &admin_kalipso_dsktp aef8d6c7e4761fc297cda833df13aebb1011b5d4
  - &machine_moderatio 3b7027ab1933c4c5e0eb935f8f9b3c058aa6d4c2
  - &machine_lucia 3474196f3adf27cfb70f8f56bcd52d1ed55033db
+  - &machine_durruti 4095412245b6efc14cf92ca25911def5a4218567
 creation_rules:
  - path_regex: moderatio/secrets/secrets.yaml$
    key_groups:
@@ -20,3 +21,9 @@ creation_rules:
      - *admin_kalipso
      - *admin_kalipso_dsktp
      - *machine_lucia
+  - path_regex: durruti/secrets.yaml$
+    key_groups:
+    - pgp:
+      - *admin_kalipso
+      - *admin_kalipso_dsktp
+      - *machine_durruti
--- a/machines/configuration.nix
+++ b/machines/configuration.nix
@@ -40,16 +40,36 @@ let
    }
  ];
  defaultModules = baseModules;
+
+  makeMicroVM = hostName: ipv4Addr: modules: [
+    inputs.microvm.nixosModules.microvm
+    {
+      microvm = {
+        hypervisor = "qemu";
+        interfaces = [
+          {
+            type = "tap";
+            id = "vm-${hostName}";
+            mac = "02:00:00:00:00:01";
+          }
+        ];
+      };
+      
+      systemd.network.enable = true;
+      
+      systemd.network.networks."20-lan" = {
+        matchConfig.Type = "ether";
+        networkConfig = {
+          Address = [ "${ipv4Addr}/24" ];
+          Gateway = "10.0.0.1";
+          DNS = ["1.1.1.1"];
+          DHCP = "no";
+        };
+      };
+    }
+  ] ++ defaultModules ++ modules;
 in
 {
-  moderatio = nixosSystem {
-    system = "x86_64-linux";
-    specialArgs.inputs = inputs;
-    modules = defaultModules ++ [
-      ./moderatio/configuration.nix
-    ];
-  };
-
  louise = nixosSystem {
    system = "x86_64-linux";
    specialArgs.inputs = inputs;
@@ -61,7 +81,7 @@ in
  durruti = nixosSystem {
    system = "x86_64-linux";
    specialArgs.inputs = inputs;
-    modules = defaultModules ++ [
+    modules = makeMicroVM "durruti" "10.0.0.5" [
      ./durruti/configuration.nix
    ];
  };
@@ -75,15 +95,11 @@ in
    ];
  };

-  sdImageLucia = nixosSystem {
-    system = "aarch64-linux";
+  gitea = nixosSystem {
+    system = "x86_64-linux";
    specialArgs.inputs = inputs;
-    modules = defaultModules ++ [
-      "${nixpkgs}/nixos/modules/installer/sd-card/sd-image-aarch64.nix"
-      ./lucia/configuration.nix
-      {
-        sdImage.compressImage = false;
-      }
+    modules = makeMicroVM "gitea" "10.0.0.6" [
+      ./gitea/configuration.nix
    ];
  };
 }
--- a/machines/durruti/configuration.nix
+++ b/machines/durruti/configuration.nix
@@ -3,7 +3,8 @@
 with lib;

 {
-  boot.isContainer = true;
+  sops.defaultSopsFile = ./secrets.yaml;
+
  networking = {
    hostName = mkDefault "durruti";
    useDHCP = false;
@@ -24,8 +25,17 @@ with lib;
    ../modules/malobeo_user.nix
    ../modules/sshd.nix
    ../modules/minimal_tools.nix
+    ../modules/autoupdate.nix
  ];

+  malobeo.autoUpdate = {
+    enable = true;
+    url = "https://hydra.dynamicdiscord.de";
+    project = "malobeo";
+    jobset = "infrastructure";
+    cacheurl = "https://cache.dynamicdiscord.de";
+  };
+
  services.malobeo-tasklist.enable = true;

  services.ep3-bs = {
@@ -39,17 +49,28 @@ with lib;
      address = "dynamicdiscorddresden@systemli.org";
      host = "mail.systemli.org";
      user = "dynamicdiscorddresden@systemli.org";
-      password = "E4XaTzv5hi0ClsMRtzy58uQ6D";
+      passwordFile = config.sops.secrets.ep3bsMail.path;
      auth = "plain";
    };


    database = {
      user = "malodbuser";
-      password = "aAljwdlaKQWhdakwLHdalkhwdhalaWLKhdaoiu";
+      passwordFile = config.sops.secrets.ep3bsDb.path;
    };
  };

+  sops.secrets.ep3bsDb = {
+    owner = config.services.ep3-bs.user;
+    key = "ep3bsDb";
+  };
+
+  sops.secrets.ep3bsMail = {
+    owner = config.services.ep3-bs.user;
+    key = "ep3bsMail";
+  };
+
+
  system.stateVersion = "22.11"; # Did you read the comment?
 }

--- a/machines/durruti/host_config.nix
+++ b/machines/durruti/host_config.nix
@@ -44,6 +44,5 @@ in
      enableACME= true;
      locations."/".proxyPass = "http://${cfg.host_ip}:80";
    };
-
  };
 }
--- a/machines/durruti/secrets.yaml
+++ b/machines/durruti/secrets.yaml
@@ -0,0 +1,72 @@
+hello: ENC[AES256_GCM,data:MKKsvoFlHX6h4qazxcjl/RE1ZsK64G926k4hgFW3AkoJgXO1QXmTaRG7ZBgS8A==,iv:hoFbcNRkge24xJfLZJH651jB4NnXCjYAdTrirkans+4=,tag:68AyEHamlGxdmSJGkTGbsA==,type:str]
+ep3bsDb: ENC[AES256_GCM,data:Z4ZYRaV/eCkaW5Ma+88hbl1o8qsI7PANrIHXoLdIOqIGFLPt7dw=,iv:BCVM+PeGm2NRcvBBy0kId1iVOD/uoiVKKBDA03p0QFM=,tag:CMypO3RLOhvHdVG5YvWewg==,type:str]
+ep3bsMail: ENC[AES256_GCM,data:rZhRb/+gs0Lm8Gdi2P2FMe15A344b88TRg==,iv:hEIG2CBcMslg3hmH3ST3bu6tmes01jncQ3V7h5KcuhA=,tag:XAHdMAlVZNyMdp4TznWDQQ==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age: []
+    lastmodified: "2024-06-26T10:07:26Z"
+    mac: ENC[AES256_GCM,data:TfN80Hffm+Lf/5Cz7T37bBxMgJCAnk2aBxxW1/lr89N2p3cckcSOGAKoLWNIsdOkqOjAs4kft0nQ+xyfdLehG1WPo6OlOwZhJexfUUcS7GJ0QGNEVntkehQiHGw9TIv08/WHRbjnKTOGHLn1vuJAIJmSyff0hncGR7nxcwghZUU=,iv:TfidjsiqDx4SCbtb6ksNYOSz/EwzwnYieeWOaBrvA7Y=,tag:e8Vaycv9bxrVBn2QjRyfSw==,type:str]
+    pgp:
+        - created_at: "2024-06-26T10:06:21Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQGMA5HdvEwzh/H7AQv8D3vncBeC4Kq+Vzk6XOMV6gRRGOZp+w2e/055sZ40IUu+
+            43Yi5giVL0I7PZkZD787LNiKy6kTcI6D9tJIp9YSMRVJb4x8oDJWS8NbVZZOUCwT
+            d9KYaMO6hN8VobhUKsu7uAKCrgVzPWrWPNmZPvwZ6pxL+cBFK2W/GEvQsXvaELUc
+            5mNlB4k5S9oG4ZMli3WWhVJRMZgdjGWDKiFVGCSenEkhua/5TUUefV8urf1IBjoN
+            MB8TPwsm3PBEG6/zrfXls/7Zhbv7mtl1uB9nWBC9M4EL9euzC83X+IiFAlThpoPu
+            eylOhEkAq60tQglk2SRsdFpHvEwaijqSKL0ieDQjvLxLNCdtCQS3yM21S4SkfRvv
+            pDGQROqjhtgZSF7MZqD67mA9tMwYGlZLfkzjpYrErbG6G4xYGO2ZODPNZ4FH/2Zf
+            Yf9xpAd0/m4mmg+py041nas8lgJzOXn5mKIxX/kLkV1U/ccrZXB9DTsWbuRVxh3W
+            CZTzgT0VdZWd88cUcYIR0lgBz0vCxDRgyPhc3B3ivoOHBisoBWbYURv+6rYE84Qs
+            6nDtCt4fUqrfKqnw1b++L1II+QjEBkhawOWNbqE9AxESOLAVwkn4cCOqeWDP8DBq
+            OBN3luBRDDAj
+            =+dua
+            -----END PGP MESSAGE-----
+          fp: c4639370c41133a738f643a591ddbc4c3387f1fb
+        - created_at: "2024-06-26T10:06:21Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA98TrrsQEbXUARAAmj8h6g8Knwg5c/Ugfxcb4nuWuLydyzNZpKJ9YcQ4VTAo
+            HA38lHH79JbnIoZ9kvxHzUONBLfnW3KekomUdmj1a2DjWllnsIOH8/16JCpFPXbx
+            hcWQFLxXzJcUEbVfONih4Zmb/2OTzSYoDjNzGaBJUx6x3AwJ0jTzCTxF9WIU1ieh
+            9u+ovry7bcHPTn3RS0gQPGRx9gN0A8OSPScKpvz2CRtUA2Uzs0/fIe3NbKQSj6g3
+            rZYityYC7uFoE792dkJ3rG9GZneIwWB8sp1remHyRhxaRN4YNPKmje/Pe/fe7sxQ
+            lWPmW4wa2uSI7/2PAkIjafoDmnpaLxQ+qY9hXobpL7OlyAuA+Sy8Ns2z6nXfPSSj
+            fQE4OS3hhUStv7PdVVvlH6JVGZK/cJOjOX0lF69A5R5XKQlasRq/t5CKBjxDWnb1
+            2bb3YavIUKWbf/DdlGNb9aKeiYX4RsaMbdc6vU5EOp69S66dF5l5W6+EDLICQEdl
+            TRNxzofVqjroeQeK9xFd+SXHVwnU9FGPr9cN7803/r17hONDxfL7o7cL1sKfX1tC
+            3nRqV3fxSfosz19jmIDu/6lqvJhBBQ8zQeKz/yWxUKowP6WUNAWsMWC7w89Ie1vA
+            UOy+xO0epIGLJSRU5YBNr9z7854NATnxRWRTya+CyFAgPVoBUxd/+2CjlkUeQWnS
+            WAELWSqQ4zsAryLhEqSWVg6nwSDCIvF/U56/vIacXwoKMqLYra5gxV78cCU6gcMt
+            08O8qM7cxHy5tGzTm6LQZvXTb8W6ybcPvPw695TirUjq9zYVnaT2lmQ=
+            =7OG0
+            -----END PGP MESSAGE-----
+          fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4
+        - created_at: "2024-06-26T10:06:21Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA1kR3vWkIYVnAQ//RZM4ifHThNFNV6pTCGKHdkF7BMHB4gv7BBkXT9cWTGcf
+            XxH3tH/kFPBSoWWfmtmHbN1bw77vpKda2lLHyOETGCusOFwuFe0+cz7sWStnf/T6
+            GVoaCRljhRxlXS2PY9gSG5fLi1uUjmCn9EshdCQdz1ix46kgSe17I+UJYRxi9r4U
+            e1R0ky4md8tLGGXg2cz1z48+kS7QX6TA1L5jjrW6MEa5ld2wywXD1g7UKpaP6QAc
+            B5xo4G+6zZNYk6x5i0NJ4EJalyyEXBvJDgsFzW4luqBGjMU2zLkq5VTQjssCbp6l
+            aE1ZZtMJYDa3IdEV/gEIF7/WmODMopO2hfTWFCx9fZ2cp0gK2d6ffo7vum4WkAMv
+            FjsbRLCmoZrlwD+/y38Hru2Ok/2cDF+QiEHq0cx+XMjgRrV6vCYrg67kOGjXZ+0v
+            eZMPGo5506cp/0cbo6eIoG9XzdNirp9mXQHMBb47/dETr+mBAyVzImuHJVmUgXlK
+            0nScCjrE2BPfsphMlQKMV007znA8QB65wEuoQ9QWTfgUfxVqzqJxdnFHKSSKAciU
+            fxAJTGN2RnbBDcehvch+QZAnIHznz3c+2WKetmFMpymqL1OKQKjhnEFewOK8rXKM
+            cEFRo1BOMkaccBBFHt/A/IQJt2+RuADbkxI9rPqPU9iPi3Ts4jFqfNzZp+m+ADHS
+            WAGHQuVbo0oQ5RLEOMPheNbr2eL+uyuMLMNsv41G4Mr+lSjN2/KvBoMQEQvpPasG
+            HDYyoe7JdYbVs+08h465+L+cbi0LzaBUxTm44GliJXVbrz6eqy6lRto=
+            =GiUe
+            -----END PGP MESSAGE-----
+          fp: 4095412245b6efc14cf92ca25911def5a4218567
+    unencrypted_suffix: _unencrypted
+    version: 3.8.1
--- a/machines/gitea/configuration.nix
+++ b/machines/gitea/configuration.nix
@@ -0,0 +1,37 @@
+{ config, lib, pkgs, inputs, ... }:
+
+with lib;
+
+{
+  #sops.defaultSopsFile = ./secrets.yaml;
+
+  networking = {
+    hostName = mkDefault "gitea";
+    useDHCP = false;
+    nameservers = [ "1.1.1.1" ];
+  };
+
+  imports = [
+    ../modules/malobeo_user.nix
+    ../modules/sshd.nix
+    ../modules/minimal_tools.nix
+    ../modules/autoupdate.nix
+  ];
+
+  services.gitea = {
+    enable = true;
+    appName = "malobeo git instance";
+
+    settings.server = {
+      DOMAIN = "git.malobeo.org";
+      HTTP_PORT = 3001;
+      SSH_PORT = 22;
+      ROOT_URL = "https://git.malobeo.org/";
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = [ 3001 ];
+
+  system.stateVersion = "22.11"; # Did you read the comment?
+}
+
--- a/machines/louise/configuration.nix
+++ b/machines/louise/configuration.nix
@@ -8,8 +8,17 @@
      ../modules/malobeo_user.nix
      ../modules/sshd.nix
      ../modules/minimal_tools.nix
+      ../modules/autoupdate.nix
    ];

+  malobeo.autoUpdate = {
+    enable = true;
+    url = "https://hydra.dynamicdiscord.de";
+    project = "malobeo";
+    jobset = "infrastructure";
+    cacheurl = "https://cache.dynamicdiscord.de";
+  };
+
  boot.loader.systemd-boot.enable = true;

  hardware.sane.enable = true; #scanner support
@@ -43,8 +52,16 @@
  services.printing.enable = true;
  services.printing.drivers = [
    (pkgs.writeTextDir "share/cups/model/brother5350.ppd" (builtins.readFile ../modules/BR5350_2_GPL.ppd))
+    pkgs.gutenprint
+    pkgs.gutenprintBin
+    pkgs.brlaser
+    pkgs.brgenml1lpr 
+    pkgs.brgenml1cupswrapper
  ];

+  # needed for printing drivers
+  nixpkgs.config.allowUnfree = true; 
+
  services.acpid.enable = true;

  networking.hostName = "louise";
--- a/machines/lucia/configuration.nix
+++ b/machines/lucia/configuration.nix
@@ -14,7 +14,7 @@ in

  services.openssh.enable = true;
  services.openssh.ports = [ 22 ];
-  services.openssh.passwordAuthentication = false;
+  services.openssh.settings.PasswordAuthentication = false;
  services.openssh.settings.PermitRootLogin = "prohibit-password";
  users.users.root.openssh.authorizedKeys.keys = sshKeys.admins;

@@ -173,7 +173,7 @@ in
    mpv
    ncmpcpp
    ncpamixer
-    pulseaudio
+    # pulseaudio
    vim
    htop
    wget
@@ -182,23 +182,23 @@ in
    nix-tree
  ];

-  hardware.pulseaudio = {
-    enable = true;
-    systemWide = true;
-    tcp = {
-      enable = true;
-      anonymousClients.allowedIpRanges = [
-        "127.0.0.0/8"
-        "192.168.1.0/24"
-      ];
-    };
+  #hardware.pulseaudio = {
+  #  enable = true;
+  #  systemWide = true;
+  #  tcp = {
+  #    enable = true;
+  #    anonymousClients.allowedIpRanges = [
+  #      "127.0.0.0/8"
+  #      "192.168.1.0/24"
+  #    ];
+  #  };

-    zeroconf.publish.enable = true;
-  };
+  #  zeroconf.publish.enable = true;
+  #};

  services.avahi = {
    enable = true;
-    nssmdns = true;
+    nssmdns4 = true;
    publish = {
      enable = true;
      addresses = true;
--- a/machines/moderatio/configuration.nix
+++ b/machines/moderatio/configuration.nix
@@ -1,92 +0,0 @@
-# Edit this configuration file to define what should be installed on
-# your system.  Help is available in the configuration.nix(5) man page
-# and in the NixOS manual (accessible by running ‘nixos-help’).
-
-{ config, pkgs, ... }:
-
-{
-  services.acpid.enable = true;
-
-  boot.kernelPackages = pkgs.linuxPackages_5_4;
-  services.xserver.videoDrivers = [ "intel" ];
-  services.xserver.deviceSection = ''
-    Option "DRI" "2"
-    Option "TearFree" "true"
-  '';
-
-  zramSwap.enable = true;
-  zramSwap.memoryPercent = 150;
-
-  imports =
-    [ # Include the results of the hardware scan.
-      ./hardware-configuration.nix
-      ./zfs.nix
-
-      ../modules/xserver.nix
-      ../modules/malobeo_user.nix
-      ../modules/sshd.nix
-      ../modules/minimal_tools.nix
-    ];
-
-  users.users.malobeo = {
-    packages = with pkgs; [
-      firefox
-      thunderbird
-    ];
-  };
-
-  networking.hostName = "moderatio"; # Define your hostname.
-  networking.networkmanager.enable = true;  # Easiest to use and most distros use this by default.
-
-  # Set your time zone.
-  time.timeZone = "Europe/Berlin";
-
-  # Select internationalisation properties.
-  # i18n.defaultLocale = "en_US.UTF-8";
-  # console = {
-  #   font = "Lat2-Terminus16";
-  #   keyMap = "us";
-  #   useXkbConfig = true; # use xkbOptions in tty.
-  # };
-
-  # Enable CUPS to print documents.
-  # services.printing.enable = true;
-
-  # Enable sound.
-  sound.enable = true;
-  hardware.pulseaudio.enable = true;
-
-  # Some programs need SUID wrappers, can be configured further or are
-  # started in user sessions.
-  # programs.mtr.enable = true;
-  # programs.gnupg.agent = {
-  #   enable = true;
-  #   enableSSHSupport = true;
-  # };
-
-  # List services that you want to enable:
-
-  # Enable the OpenSSH daemon.
-  # services.openssh.enable = true;
-
-  # Open ports in the firewall.
-  # networking.firewall.allowedTCPPorts = [ ... ];
-  # networking.firewall.allowedUDPPorts = [ ... ];
-  # Or disable the firewall altogether.
-  # networking.firewall.enable = false;
-
-  # Copy the NixOS configuration file and link it from the resulting system
-  # (/run/current-system/configuration.nix). This is useful in case you
-  # accidentally delete configuration.nix.
-  # system.copySystemConfiguration = true;
-
-  # This value determines the NixOS release from which the default
-  # settings for stateful data, like file locations and database versions
-  # on your system were taken. It‘s perfectly fine and recommended to leave
-  # this value at the release version of the first install of this system.
-  # Before changing this value read the documentation for this option
-  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
-  system.stateVersion = "22.05"; # Did you read the comment?
-
-}
-
--- a/machines/moderatio/hardware-configuration.nix
+++ b/machines/moderatio/hardware-configuration.nix
@@ -1,53 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
-
-{
-  imports =
-    [ (modulesPath + "/installer/scan/not-detected.nix")
-    ];
-
-  boot.initrd.availableKernelModules = [ "uhci_hcd" "ehci_pci" "ahci" "usb_storage" "ums_realtek" "sd_mod" ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ ];
-  boot.extraModulePackages = [ ];
-
-  fileSystems."/" =
-    { device = "rpool/nixos/root";
-      fsType = "zfs"; options = [ "zfsutil" "X-mount.mkdir" ];
-    };
-
-  fileSystems."/home" =
-    { device = "rpool/nixos/home";
-      fsType = "zfs"; options = [ "zfsutil" "X-mount.mkdir" ];
-    };
-
-  fileSystems."/boot" =
-    { device = "bpool/nixos/root";
-      fsType = "zfs"; options = [ "zfsutil" "X-mount.mkdir" ];
-    };
-
-  fileSystems."/boot/efis/ata-ST250LT003-9YG14C_W041QXCA-part1" =
-    { device = "/dev/disk/by-uuid/A0D1-00C1";
-      fsType = "vfat";
-    };
-
-  fileSystems."/boot/efi" =
-    { device = "/boot/efis/ata-ST250LT003-9YG14C_W041QXCA-part1";
-      fsType = "none";
-      options = [ "bind" ];
-    };
-
-  swapDevices = [ ];
-
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.enp1s0.useDHCP = lib.mkDefault true;
-  # networking.interfaces.wlo1.useDHCP = lib.mkDefault true;
-
-  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-}
--- a/machines/moderatio/zfs.nix
+++ b/machines/moderatio/zfs.nix
@@ -1,34 +0,0 @@
-{ config, pkgs, ... }:
-
-{ boot.supportedFilesystems = [ "zfs" ];
-  networking.hostId = "ae749b82";
-  #boot.kernelPackages = config.boot.zfs.package.latestCompatibleLinuxPackages;
-boot.loader.efi.efiSysMountPoint = "/boot/efi";
-boot.loader.efi.canTouchEfiVariables = false;
-boot.loader.generationsDir.copyKernels = true;
-boot.loader.grub.efiInstallAsRemovable = true;
-boot.loader.grub.enable = true;
-boot.loader.grub.version = 2;
-boot.loader.grub.copyKernels = true;
-boot.loader.grub.efiSupport = true;
-boot.loader.grub.zfsSupport = true;
-boot.loader.grub.extraPrepareConfig = ''
-  mkdir -p /boot/efis
-  for i in  /boot/efis/*; do mount $i ; done
-
-  mkdir -p /boot/efi
-  mount /boot/efi
-'';
-boot.loader.grub.extraInstallCommands = ''
-ESP_MIRROR=$(mktemp -d)
-cp -r /boot/efi/EFI $ESP_MIRROR
-for i in /boot/efis/*; do
- cp -r $ESP_MIRROR/EFI $i
-done
-rm -rf $ESP_MIRROR
-'';
-boot.loader.grub.devices = [
-      "/dev/disk/by-id/ata-ST250LT003-9YG14C_W041QXCA"
-    ];
-users.users.root.initialHashedPassword = "$6$PmoyhSlGGT6SI0t0$.cFsLyhtO1ks1LUDhLjG0vT44/NjuWCBrv5vUSXqwrU5WpaBvvthnLp0Dfwfyd6Zcdx/4izDcjQAgEWs4QdzW0";
-}
--- a/machines/modules/autoupdate.nix
+++ b/machines/modules/autoupdate.nix
@@ -0,0 +1,139 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.malobeo.autoUpdate;
+in
+{
+  options.malobeo.autoUpdate = {
+    enable = mkOption {
+      description = ''
+        Enables a timer that periodically checks a hydra instance for the last build of the local system, and switches to it if it is different.
+  
+        Also enables periodical /nix/store GC.
+      '';
+      type = types.bool;
+      default = false;
+    };
+
+    # https://hydra.dynamicdiscord.de/job/malobeo/infrastructure/louise/latest
+    url = mkOption {
+      description = lib.mdDoc ''
+        Url to your hydra instace. like https://hydra.example.de
+      '';
+      type = types.str;
+      default = "";
+    };
+
+    project = mkOption {
+      description = lib.mdDoc ''
+        Name of the project at the hydra instace
+      '';
+      type = types.str;
+      default = "";
+    };
+
+    jobset = mkOption {
+      description = lib.mdDoc ''
+        Name of the jobset at the hydra instace
+      '';
+      type = types.str;
+      default = "";
+    };
+
+    cacheurl = mkOption {
+      description = lib.mdDoc ''
+        Url of the binary cache
+      '';
+      type = types.str;
+      default = cfg.url;
+    };
+  };
+
+  config = {
+    # the presence of this .service file signifies that the system is
+    # autoupdate-enabled. it is checked to prevent autoupdating back
+    # to a system without autoupdate when deploying with autoupdate
+    # for the first time.
+    systemd.services.autoupdate = lib.mkIf config.malobeo.autoUpdate.enable {
+      wantedBy = [ "multi-user.target" ];
+      path = with pkgs; [ nix nettools curl jq ];
+      serviceConfig = {
+        Type = "oneshot";
+        # switch-to-configuration may not return. HACK: cap running
+        # time so that the timer can be scheduled again.
+        TimeoutStartSec = "30min";
+      };
+      script = ''
+        OLD=$(readlink /run/current-system)
+        echo Current system: $(basename $OLD)
+        NEW=$(curl -sLH "Accept: application/json" ${cfg.url}/job/${cfg.project}/${cfg.jobset}/${config.networking.hostName}/latest | jq -er .buildoutputs.out.path)
+        if [ -z "$NEW" ] || [ "$NEW" = "null" ]; then
+          echo "Unable to obtain updated system"
+          exit 1
+        fi
+        echo New system: $(basename $NEW)
+
+        if [ "$OLD" != "$NEW" ]; then
+          echo "Fetching new system built by ${cfg.url}/job/${cfg.project}/${cfg.jobset}"
+          # this should fetch the new system from the binary cache
+          nix copy --from ${cfg.cacheurl} "$NEW"
+          if [ -e "$NEW/etc/systemd/system/autoupdate.timer" ]; then
+            echo "Switch to the new system..."
+            nix-env -p /nix/var/nix/profiles/system --set $NEW
+            "$NEW/bin/switch-to-configuration" switch
+          else
+            echo "New system is not yet autoupdate-enabled. Refusing to switch into a dead end."
+          fi
+        else
+          echo "No update required"
+        fi
+      '';
+      # don't let the switch kill this service, aborting the switch
+      restartIfChanged = false;
+      unitConfig.X-StopOnRemoval = false;
+      # create timer
+      startAt = "hourly";
+    };
+
+    nix = {
+      # Show a diff when activating a new system except for microvms which handle this seperately
+      #diffSystem = config.malobeo.deployment.server or "" == "";
+      #TODO: THIS WIPES HOSTS NIX STORE FROM WITHIN NIXOS-CONTAINER
+      #gc = lib.mkIf config.malobeo.autoUpdate.enable {
+      #  automatic = true;
+      #  randomizedDelaySec = "6h";
+      #  options = "--delete-older-than 21d";
+      #};
+    };
+
+    environment.systemPackages = [ (
+      # Provide a manual updating script that fetches the latest
+      # updated+built system from Hydra
+      pkgs.writeScriptBin "update-from-hydra" ''
+        #! ${pkgs.runtimeShell} -e
+
+        OLD=$(readlink /run/current-system)
+        echo Current system: $(basename $OLD)
+        NEW=$(curl -sLH "Accept: application/json" ${cfg.url}/job/${cfg.project}/${cfg.jobset}/${config.networking.hostName}/latest | ${pkgs.jq}/bin/jq -er .buildoutputs.out.path)
+        if [ -z "$NEW" ] || [ "$NEW" = "null" ]; then
+          echo "Unable to obtain updated system"
+          exit 1
+        fi
+        echo New system: $(basename $NEW)
+
+        if [ "$OLD" != "$NEW" ]; then
+          echo "Fetching new system built by ${cfg.url}/job/${cfg.project}/${cfg.jobset}"
+          # this should fetch the new system from the binary cache
+          nix copy --from ${cfg.cacheurl} "$NEW"
+          echo "Switch to the new system..."
+          nix-env -p /nix/var/nix/profiles/system --set $NEW
+          "$NEW/bin/switch-to-configuration" switch
+        else
+          echo "No update required"
+        fi
+      ''
+    ) ];
+  };
+}
--- a/machines/modules/malobeo/microvm_host.nix
+++ b/machines/modules/malobeo/microvm_host.nix
@@ -0,0 +1,52 @@
+{ config, lib, options, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.malobeo.microvm;
+in
+{
+  options = {
+    services.malobeo.microvm = {
+      enableHostBridge = mkOption {
+        default = false;
+        type = types.bool;
+        description = lib.mdDoc "Setup bridge device for microvms.";
+      };
+    };
+  };
+
+  config = mkIf cfg.enableHostBridge
+  { 
+    systemd.network = {
+      enable = true;
+      # create a bride device that all the microvms will be connected to
+      netdevs."10-microvm".netdevConfig = {
+        Kind = "bridge";
+        Name = "microvm";
+      };
+
+      networks."10-microvm" = {
+        matchConfig.Name = "microvm";
+        networkConfig = {
+          DHCPServer = true;
+          IPv6SendRA = true;
+        };
+        addresses = [ {
+          Address = "10.0.0.1/24";
+        } {
+          Address = "fd12:3456:789a::1/64";
+        } ];
+        ipv6Prefixes = [ {
+          Prefix = "fd12:3456:789a::/64";
+        } ];
+      };
+
+      # connect the vms to the bridge
+      networks."11-microvm" = {
+        matchConfig.Name = "vm-*";
+        networkConfig.Bridge = "microvm";
+      };
+    };
+  };
+}
--- a/machines/modules/sshd.nix
+++ b/machines/modules/sshd.nix
@@ -6,7 +6,7 @@ in
 {
  services.openssh.enable = true;
  services.openssh.ports = [ 22 ];
-  services.openssh.passwordAuthentication = false;
+  services.openssh.settings.PasswordAuthentication = false;
  services.openssh.settings.PermitRootLogin = "no";
  users.users.root.openssh.authorizedKeys.keys = sshKeys.admins;
 }
--- a/machines/modules/xserver.nix
+++ b/machines/modules/xserver.nix
@@ -7,7 +7,6 @@
      xterm.enable = false;
      cinnamon.enable = true;
    };
-
-    displayManager.defaultSession = "cinnamon";
  };
+  services.displayManager.defaultSession = "cinnamon";
 }
--- a/machines/secrets/keys/hosts/durruti.asc
+++ b/machines/secrets/keys/hosts/durruti.asc
@@ -0,0 +1,28 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+xsFNBAAAAAABEADh28tGiUsmPPbsQYKSi9WiI4UCPO4qd7hEoER34Ku5w+kpy1MI
+ymJHNlZODjrjvznRidyYt+1vpED941LawzsujBV7pSfIBY0cQWYTbF/euuQFJYxN
+sBLG4kek5IhdnIsav2f7fMv6Rhfkau7p20AYkWUkpoUxBJTxixIkxrO90ODSzMMe
+tLI9MnqPcMASy6dbAGKXSABaYi9bwggIgyYHNaXThEuEAWPMPMMj8Wlo0H0X/B9O
+UEOHSA4N3TBKJXuDhsKgUo6ADLAA5op+YG+JtAdvdjW0XxtDamLkkrEx/fsYWsn2
+LjiX7z6cCQjYy+GG6LV82cavyF9sBAs8kEl4AVXVYsaB0g99rpY91EYLAD2Ddh4d
+lHPwPVQ52Ht3QeEPAsqeXRh+gZOp/xx6EJXXaH7aorXoWlbUFcCnTTEFAM0HibZg
+ChZEX+pl9RxdPeIwU4kd9LxNygDwp4YhdJzbcpHkp7RrkHJHgmAxUEVCxZfw/P2c
+GDIBHQSS4FZ5PIhh+aejYCo4BrisGuAjwlaH26BRNraM8EImaLwLuQZ1TOWm97tI
+BEI0JFscrTi2RSPgDCg1Cu78ocbcpqC3cRclXzRohvp83NpWnAQFCAdNaTttQsio
+lQTXxmJlaeo/0vHAN+Llukchh6sFzzNP3v4B8vLvdXkE3s5XYxJungblTwARAQAB
+zSlyb290IChJbXBvcnRlZCBmcm9tIFNTSCkgPHJvb3RAbG9jYWxob3N0PsLBYgQT
+AQgAFgUCAAAAAAkQWRHe9aQhhWcCGw8CGQEAALRQEABVEYsIn5zGV84caxE/LXN7
+7nDsUEyo3lCetStM7JT7uDdMl5t33pUAIbm4gv6/BrvVZ6pBtPfTrVrTKKDornKJ
+VU/tKims+CbnuPUIbOmuXcPbQIa/IF4WVop8XJTzMOSW636/eH1D2VTLI8Jmw35s
+qDmqx72hISUBGCszTJkThp8xUFMW5NcJc6zGB9I4vdac6Sf6yuZqmdfDm0MzcvmA
+tDASc6ZLeffPkJxUA+x2WouAYkfdV1CdVS6ob6owrSza/T+wQ3DgzO5AVZ31HXTa
+gDkVIBgdZYR2H8IaaTetb4m2+SgdXr7s9WCOR2i8DiSKpnUAJKoVIOl6pBd13jCu
+PHQzkKq6kqn4bRYCZil3fKDB90mVDIyixJJCt//VA5y9Tgggp9o7a+l35I9hCJ2F
+6AYtpfXkTbI9wqmk33TJX2litqqPZkhEERv25UDvnZ7Mm0my9QXJZ1Fp1nRLIKZg
+VABDS/wIB1QHtOldDLMeRD7Fnrnjgnyuk4/HmCem0wFDPHDo/ppa2QtCUk1xxywu
+fa7hs/oDVUMsofpDm6Ls4IgFXbSD9GUTDdB+UvZi5vITaZ1f1QLcrShhSUHkLIpc
+65Fj79r9cdHKdUhnM2+pTuVM6Az3huMkZ+abgjSHWSni2njowRUd2P7pG+ZhaUk3
+Rj7jxxXh1KQ7X8Rbbce8Mg==
+=sb6Z
+-----END PGP PUBLIC KEY BLOCK-----
--- a/outputs.nix
+++ b/outputs.nix
@@ -18,12 +18,44 @@ in (utils.lib.eachSystem (builtins.filter filter_system utils.lib.defaultSystems
    devShells.default = pkgs.callPackage ./shell.nix {
      inherit (sops-nix.packages."${pkgs.system}") sops-import-keys-hook ssh-to-pgp sops-init-gpg-key;
    };
+
+    packages = {
+      docs = pkgs.stdenv.mkDerivation {
+        name = "malobeo-docs";
+        phases = [ "buildPhase" ];
+        buildInputs = [ pkgs.mdbook ];
+      
+        inputs = pkgs.lib.sourceFilesBySuffices ./doc/. [ ".md" ".toml" ];
+      
+        buildPhase = ''
+          dest=$out/share/doc
+          mkdir -p $dest
+          cp -r --no-preserve=all $inputs/* ./
+          mdbook build
+          ls
+          cp -r ./book/* $dest
+        '';
+      };
+    };
+
+    apps = {
+      docs = {
+        type = "app";
+        program = builtins.toString (pkgs.writeShellScript "docs" ''
+          ${pkgs.mdbook}/bin/mdbook serve --open ./doc
+        '');
+      };
+    };
+
  })) // rec {
    nixosConfigurations = import ./machines/configuration.nix (inputs // {
      inherit inputs;
    });

-    nixosModules.malobeo = import ./machines/durruti/host_config.nix;
+    nixosModules.malobeo.imports = [
+      ./machines/durruti/host_config.nix
+      ./machines/modules/malobeo/microvm_host.nix
+    ];

    hydraJobs = nixpkgs.lib.mapAttrs (_: nixpkgs.lib.hydraJob) (
      let
@@ -36,26 +68,4 @@ in (utils.lib.eachSystem (builtins.filter filter_system utils.lib.defaultSystems
      nixpkgs.lib.mapAttrs getBuildEntry self.nixosConfigurations

      );
-
-      #lucia = self.nixosConfigurations.lucia.config.system.build.toplevel;
-    
-
-    #images.lucia_base_image = nixosConfigurations.lucia.config.system.build.sdImage;
-
-    #packages.x86_64-linux = {
-    #  lucia_base_img = nixos-generators.nixosGenerate {
-    #    system = "aarch64-linux";
-    #    modules = [
-    #      #"${nixpkgs}/nixos/modules/installer/sd-card/sd-image-raspberrypi.nix"
-    #      ./machines/modules/sshd.nix
-    #      {
-    #        nixpkgs.config.allowUnsupportedSystem = true;
-    #        nixpkgs.crossSystem.system = "aarch64-linux";
-    #        networking.dhcpcd.enable = true;
-    #      }
-    #    ];
-
-    #    format = "sd-aarch64-installer";
-    #  };
-    #};
 }
--- a/shell.nix
+++ b/shell.nix
@@ -18,5 +18,6 @@ mkShell {
    sops-init-gpg-key
    sops
    pkgs.python310Packages.grip
+    pkgs.mdbook
  ];
 }
Author	SHA1	Message	Date
kalipso	6f0bf4aacb	[gitea] init All checks were successful Evaluate Hydra Jobs / eval-hydra-jobs (push) Successful in 4m10s Details Evaluate Hydra Jobs / eval-hydra-jobs (pull_request) Successful in 2m49s Details	2024-11-19 19:41:51 +01:00
kalipso	6456814319	[doc] add basic microvm documentation All checks were successful Evaluate Hydra Jobs / eval-hydra-jobs (push) Successful in 3m39s Details Evaluate Hydra Jobs / eval-hydra-jobs (pull_request) Successful in 3m38s Details	2024-11-19 15:43:23 +01:00
kalipso	21310dcf3c	[docs] fix docs app exec format error	2024-11-19 15:31:27 +01:00
kalipso	63c36f6add	[microvm] put vm creation into function All checks were successful Evaluate Hydra Jobs / eval-hydra-jobs (push) Successful in 3m14s Details Evaluate Hydra Jobs / eval-hydra-jobs (pull_request) Successful in 3m44s Details	2024-11-19 13:31:09 +01:00
kalipso	be194e4293	[microvm] rm duplicate option Some checks failed Evaluate Hydra Jobs / eval-hydra-jobs (push) Successful in 2m39s Details Evaluate Hydra Jobs / eval-hydra-jobs (pull_request) Failing after 13m12s Details	2024-11-19 13:03:47 +01:00
kalipso	edb9dcb28b	[microvm] split module files All checks were successful Evaluate Hydra Jobs / eval-hydra-jobs (push) Successful in 4m0s Details Evaluate Hydra Jobs / eval-hydra-jobs (pull_request) Successful in 4m10s Details	2024-11-19 12:59:11 +01:00
kalipso	05ec7004ad	[microvm] setup network, allow adding bridge interface to host All checks were successful Evaluate Hydra Jobs / eval-hydra-jobs (push) Successful in 3m19s Details Evaluate Hydra Jobs / eval-hydra-jobs (pull_request) Successful in 3m20s Details	2024-11-18 22:55:03 +01:00
kalipso	d1afbe9f14	[durruti] make durruti microvm All checks were successful Evaluate Hydra Jobs / eval-hydra-jobs (push) Successful in 3m18s Details Evaluate Hydra Jobs / eval-hydra-jobs (pull_request) Successful in 2m56s Details Networking still needs to be done but the vm boots using ```nix run .\#nixosConfigurations.durruti.config.microvm.declaredRunner```	2024-11-14 14:37:02 +01:00
kalipso	807d2007fa	[nixpkgs] add microvm.nix	2024-11-14 14:36:32 +01:00
kalipso	29567efb99	[nixpkgs] update All checks were successful Evaluate Hydra Jobs / eval-hydra-jobs (push) Successful in 2m46s Details	2024-11-08 11:59:53 +01:00
kalipso	ca4db0ad5c	Revert "[doc] Init dokumentation mit mdbook + grobes inhaltsverzeichnis" All checks were successful Evaluate Hydra Jobs / eval-hydra-jobs (push) Successful in 2m29s Details This reverts commit `753c44a875`.	2024-10-29 18:20:45 +01:00
ahtlon	753c44a875	[doc] Init dokumentation mit mdbook + grobes inhaltsverzeichnis All checks were successful Evaluate Hydra Jobs / eval-hydra-jobs (push) Successful in 2m51s Details	2024-10-29 18:16:37 +01:00
Ahtlon	0eeb9bc131	doc/src/SUMMARY.md aktualisiert	2024-10-29 18:16:37 +01:00
Ahtlon	142277879a	Added temporary information about website host	2024-10-29 18:16:37 +01:00
ahtlon	4ecd2139a9	todo bearbeitet	2024-10-29 18:16:37 +01:00
kalipso	e73105bc66	[doc] add app doc to serve doc 'nix run .#doc' will open documentaion in browser and update on filechange	2024-10-29 18:16:37 +01:00
kalipso	38a7d58ef6	[doc] add doc package this can be used for hosting later on	2024-10-29 18:16:37 +01:00
kalipso	6a185a54bc	[doc] mv files into /doc	2024-10-29 18:16:37 +01:00
ahtlon	4334f6bec2	[doc] Todo aus readme verschieben	2024-10-29 18:16:37 +01:00
ahtlon	fad4f72c0b	[doc] Init leere seiten	2024-10-29 18:16:37 +01:00
ahtlon	8e0f846e54	[doc] Init dokumentation mit mdbook + grobes inhaltsverzeichnis	2024-10-29 18:16:35 +01:00
kalipso	29fa4eda1e	[nixpkgs] update All checks were successful Evaluate Hydra Jobs / eval-hydra-jobs (pull_request) Successful in 4m18s Details Evaluate Hydra Jobs / eval-hydra-jobs (push) Successful in 2m28s Details	2024-10-29 10:59:07 +01:00
ahtlon	e57cc9dbe6	moderatio entfernt All checks were successful Evaluate Hydra Jobs / eval-hydra-jobs (pull_request) Successful in 2m25s Details Evaluate Hydra Jobs / eval-hydra-jobs (push) Successful in 2m38s Details	2024-10-26 20:37:04 +02:00
ahtlon	2da812fecd	mehrere warnungen gefixt	2024-10-26 20:31:54 +02:00
ahtlon	8ff71f14dc	add direnv to gitignore All checks were successful Evaluate Hydra Jobs / eval-hydra-jobs (push) Successful in 2m53s Details	2024-10-26 20:19:03 +02:00
kalipso	98a79d708a	[durruti] fix wiping of hosts /nix/store All checks were successful Evaluate Hydra Jobs / eval-hydra-jobs (push) Successful in 8m41s Details the automatic garbage collection of durruti - which runs inside a nixos-container - complelty wiped the hosts nix store making basically all the services fail and the machine unbootable.	2024-10-25 12:47:27 +02:00
kalipso	822cd46310	[lucia] rm sdImage All checks were successful Evaluate Hydra Jobs / eval-hydra-jobs (push) Successful in 3m51s Details Evaluate Hydra Jobs / eval-hydra-jobs (pull_request) Successful in 2m54s Details sdImage is exceeding hydra max build size of 2GB. also it makes more sense to have this as a package then a configuration	2024-10-24 17:35:55 +02:00
kalipso	435dfa170b	[lucia] disable pulse All checks were successful Evaluate Hydra Jobs / eval-hydra-jobs (push) Successful in 3m8s Details	2024-10-24 13:34:36 +02:00
kalipso	4b45afa478	[nixpkgs] update All checks were successful Evaluate Hydra Jobs / eval-hydra-jobs (pull_request) Successful in 3m59s Details Evaluate Hydra Jobs / eval-hydra-jobs (push) Successful in 3m10s Details	2024-10-24 12:44:14 +02:00
kalipso	6a7a8a569c	[actions] update: rm for now since pr's dont work All checks were successful Evaluate Hydra Jobs / eval-hydra-jobs (push) Successful in 3m22s Details	2024-10-24 12:40:12 +02:00
kalipso	d729ec5758	[actions] update: fix version Some checks failed Evaluate Hydra Jobs / eval-hydra-jobs (push) Successful in 3m45s Details Update flakes / update-flake-lock (push) Failing after 4m41s Details	2024-10-24 11:50:44 +02:00
kalipso	0cb0849c5a	[actions] update: fix version Some checks failed Update flakes / update-flake-lock (push) Failing after 36s Details Evaluate Hydra Jobs / eval-hydra-jobs (push) Successful in 3m24s Details	2024-10-24 11:41:50 +02:00
kalipso	a2a3d6f4bf	[actions] update: try custom action with gitea-pull api Some checks failed Evaluate Hydra Jobs / eval-hydra-jobs (push) Successful in 3m53s Details Update flakes / update-flake-lock (push) Failing after 4m6s Details	2024-10-24 11:28:27 +02:00
kalipso	5ca39f9598	[actions] update: add api token Some checks failed Evaluate Hydra Jobs / eval-hydra-jobs (push) Successful in 4m10s Details Update flakes / update-flake-lock (push) Failing after 5m6s Details i try this to prevent api limit	2024-10-24 11:10:35 +02:00
kalipso	99669969de	[actions] eval: accept untrusted substituters	2024-10-24 00:29:26 +02:00
kalipso	1245d5f071	[nixpkgs] update home-manager Some checks failed Evaluate Hydra Jobs / eval-hydra-jobs (push) Successful in 3m5s Details Update flakes / update-flake-lock (push) Failing after 54s Details	2024-10-24 00:26:01 +02:00
kalipso	33f383b0ec	[actions] update flake lock updater Some checks failed Evaluate Hydra Jobs / eval-hydra-jobs (push) Failing after 47s Details Update flakes / update-flake-lock (push) Failing after 51s Details	2024-10-24 00:21:07 +02:00
kalipso	918c9d29bd	[actions] rm WIP github token	2024-10-24 00:11:15 +02:00
kalipso	8826a5e2ac	[actions] eval runner do not update lock Some checks failed Evaluate Hydra Jobs / eval-hydra-jobs (push) Failing after 41s Details Update flakes / createPullRequest (push) Failing after 51s Details	2024-10-24 00:08:16 +02:00
kalipso	efc4ce0191	[actions] add hydraJob evaluation Some checks failed Update flakes / createPullRequest (push) Has been cancelled Details Evaluate Hydra Jobs / tests (push) Successful in 3m13s Details	2024-10-23 23:48:27 +02:00
kalipso	696e7e4a1e	[nixpkgs] home-manager 23.11 -> 24.05 Some checks failed Update flakes / createPullRequest (push) Failing after 45s Details	2024-10-23 23:38:45 +02:00
kalipso	c4f52e28f2	[actions] fix missing dependency Some checks failed Update flakes / createPullRequest (push) Failing after 47s Details	2024-10-23 23:32:55 +02:00
kalipso	c624ac0dce	[actions] test on push Some checks failed Update flakes / createPullRequest (push) Failing after 1m12s Details	2024-10-23 23:28:31 +02:00
kalipso	4c594436d2	[actions] add auto-update workflow	2024-10-23 23:26:33 +02:00
kalipso	875d3c1605	[readme] update	2024-10-19 16:40:07 +02:00
kalipso	f1f5c099f2	[nixpkgs] update	2024-10-19 15:30:27 +02:00
kalipso	8d6c599064	[nixpkgs] update	2024-10-17 23:37:18 +02:00
kalipso	6c43b892f5	[durruti] fix missing autoupdate import	2024-10-17 14:16:40 +02:00
kalipso	4974903508	[durruti] enable autoupdate	2024-10-17 14:13:16 +02:00
kalipso	51db6691a9	[nixpkgs] update	2024-10-17 14:04:52 +02:00
System administrator	bbd222d644	[nixpkgs] update	2024-10-15 19:09:42 +02:00
System administrator	de31f58dbb	[louise] add printer drivers	2024-10-15 17:59:48 +02:00
kalipso	270d3367fa	[nixpkgs] try re-eval by chaning flake.nix	2024-10-15 14:42:23 +02:00
kalipso	f700374114	[nixpkgs] update	2024-10-14 14:48:49 +02:00
kalipso	9940225673	add autoupdate.nix	2024-10-10 12:00:59 +02:00
kalipso	2129729396	[nixpkgs] update	2024-10-07 12:01:20 +02:00
kalipso	646721dea7	[nixpkgs] update	2024-09-22 15:44:50 +02:00
kalipso	fe2df658c0	[nixpkgs] update	2024-08-26 17:40:19 +02:00
kalipso	281778db3a	[nixpkgs] update	2024-08-09 11:53:05 +02:00
kalipso	51ccb7870a	[nixpkgs] update	2024-07-15 11:25:36 +02:00
kalipso	d5cca32f3a	[tasklist] update	2024-07-15 11:22:23 +02:00
System administrator	32c48b3e05	[durruti] fix scoping issue	2024-06-26 12:40:06 +02:00
kalipso	f268ce005b	[durruti] fix sops key ownership	2024-06-26 12:26:25 +02:00
kalipso	d566532635	[durruti] rm cleartext passwords	2024-06-26 12:13:50 +02:00
kalipso	30e1bb85e8	[durruti] add to sops	2024-06-26 12:10:45 +02:00