[disko] rm duplicate filesystems entry

Merge branch 'master' into issue31
Merge master
2025-02-05 14:31:39 +01:00 · 2025-02-05 14:25:57 +01:00 · 2025-01-19 18:00:27 +01:00 · 2025-01-19 17:59:29 +01:00 · 2025-01-18 22:57:21 +01:00 · 2025-01-18 21:33:41 +01:00
13 changed files with 416 additions and 330 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -6,4 +6,3 @@ result
 .direnv/
 book/
 fanny-efi-vars.fd
 nix-store-overlay.img
--- a/README.md
+++ b/README.md
@@ -1,20 +1,44 @@
 # malobeo infrastructure
-this repository contains nixos configurations of the digital malobeo infrastructure. it should be used to setup, test, build and deploy different hosts in a reproducible manner.
+this repository nxios configurations of the digital malobeo infrastructure. it should be used to setup, test, build and deploy different hosts in a reproducible manner.
 the file structure is based on this [blog post](https://samleathers.com/posts/2022-02-03-my-new-network-and-deploy-rs.html)
 ## hosts
 #### durruti
 - nixos-container running on dedicated hetzner server
 - login via ```ssh -p 222 malobeo@dynamicdiscord.de```
 - if rebuild switch fails due to biglock do ```mount -o remount,rw /nix/var/nix/db```
 - currently is running tasklist in detached tmux session
  - [x] make module with systemd service out of that
 ## creating a new host
 ### setting up filesystem
 currently nixos offers no declarative way of setting up filesystems and partitions. that means this has to be done manually for every new host. [to make it as easy as possible we can use this guide to setup an encrypted zfs filesystem](https://openzfs.github.io/openzfs-docs/Getting%20Started/NixOS/Root%20on%20ZFS.html)
 *we could create a shell script out of that*
 ### deploying configuration
-hosts are deployed automatically from master. The [hydra build server](https://hydra.dynamicdiscord.de/jobset/malobeo/infrastructure) will build new commits and on success, hosts will periodically pull those changes.
+#### local deployment
-Big changes (like updating flake lock) could be commited to the staging branch first. [Hydra builds staging seperate](https://hydra.dynamicdiscord.de/jobset/malobeo/staging), and on success you can merge into master.
+``` shell
 nixos-rebuild switch --use-remote-sudo
 ```
-### deploy fresh host
+#### remote deployment
 if you want to deploy a completly new host refer to [docs](https://docs.malobeo.org/anleitung/create.html)
-### testing configuration
+you need the hostname and ip address of the host:
 ``` shell
 nixos-rebuild switch --flake .#<hostname> --target-host root@<ip_address> --build-host localhost
 ```
 in this case 'localhost' is used as buildhost which can be usefull if the target host is low systemresources
 refer to https://docs.malobeo.org/anleitung/microvm.html#testing-microvms-locally
 ## development
 ### requirements
 we use flake based configurations for our hosts. if you want to build configurations on you own machine you have to enable flakes first by adding the following to your *configuration.nix* or *nix.conf*
 ``` nix
@@ -31,13 +55,46 @@ a development shell with the correct environment can be created by running ```ni
 If you're using direnv you can add flake support by following those steps: [link](https://nixos.wiki/wiki/Flakes#Direnv_integration)
 ### build a configuration
 to build a configuration run the following command (replace ```<hostname>``` with the actual hostname):
 ``` shell
 nix build .#nixosConfigurations.<hostname>.config.system.build.toplevel
 ```
 ### building raspberry image
 for the raspberry it is possible to build the whole configuration as an sd-card image which then can be flashed directly. more information about building arm on nixos can be found [here](https://nixos.wiki/wiki/NixOS_on_ARM).
 to be able to build the image you need to enable qemu emulation on the machine you are building with. therefore it is necessary to add the following to your configuration.nix:
 ``` nix
 boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
 ```
 then you can build the image with:
 ``` shell
 nix build .#nixosConfigurations.rpi1_base_image.config.system.build.sdImage
 ```
 ### run a configuration as vm
 to run a vm we have to build it first using the following command (replace ```<hostname>``` with the actual hostname):
 ``` shell
 nix build .#nixosConfigurations.<hostname>.config.system.build.vm
 ```
 afterwards run the following command to start the vm:
 ``` shell
 ./result/bin/run-<hostname>-vm
 ```
 ### documentation
-documentation is automatically build from master and can be found here: docs.malobeo.org  
+for documentation we currently just use README.md files.
-locally you can run documentation using ```nix run .#docs``` or ```nix run .#docsDev```
+
 the devshell provides the python package ['grip'](https://github.com/joeyespo/grip) which can be used to preview different README.md files in the browser.
 the usage is simple, just run ```grip``` in the same folder as the README.md you wanna preview. then open your browser at ```http://localhost:6419 ```.
--- a/doc/src/Index.md
+++ b/doc/src/Index.md
@@ -1,20 +1,26 @@
 # malobeo infrastructure
-this repository contains nixos configurations of the digital malobeo infrastructure. it should be used to setup, test, build and deploy different hosts in a reproducible manner.
+this repository nxios configurations of the digital malobeo infrastructure. it should be used to setup, test, build and deploy different hosts in a reproducible manner.
 the file structure is based on this [blog post](https://samleathers.com/posts/2022-02-03-my-new-network-and-deploy-rs.html)
 ### deploying configuration
 #### local deployment
 ``` shell
 nixos-rebuild switch --use-remote-sudo
 ```
-hosts are deployed automatically from master. The [hydra build server](https://hydra.dynamicdiscord.de/jobset/malobeo/infrastructure) will build new commits and on success, hosts will periodically pull those changes.
+#### remote deployment
-Big changes (like updating flake lock) could be commited to the staging branch first. [Hydra builds staging seperate](https://hydra.dynamicdiscord.de/jobset/malobeo/staging), and on success you can merge into master.
+you need the hostname and ip address of the host:
 ``` shell
 nixos-rebuild switch --flake .#<hostname> --target-host root@<ip_address> --build-host localhost
 ```
-### deploy fresh host
+in this case 'localhost' is used as buildhost which can be usefull if the target host is low systemresources
 if you want to deploy a completly new host refer to [docs](https://docs.malobeo.org/anleitung/create.html)
 ### testing configuration
 refer to https://docs.malobeo.org/anleitung/microvm.html#testing-microvms-locally
 ## development
 ### requirements
 we use flake based configurations for our hosts. if you want to build configurations on you own machine you have to enable flakes first by adding the following to your *configuration.nix* or *nix.conf*
 ``` nix
@@ -31,13 +37,46 @@ a development shell with the correct environment can be created by running ```ni
 If you're using direnv you can add flake support by following those steps: [link](https://nixos.wiki/wiki/Flakes#Direnv_integration)
 ### build a configuration
 to build a configuration run the following command (replace ```<hostname>``` with the actual hostname):
 ``` shell
 nix build .#nixosConfigurations.<hostname>.config.system.build.toplevel
 ```
 ### building raspberry image
 for the raspberry it is possible to build the whole configuration as an sd-card image which then can be flashed directly. more information about building arm on nixos can be found [here](https://nixos.wiki/wiki/NixOS_on_ARM).
 to be able to build the image you need to enable qemu emulation on the machine you are building with. therefore it is necessary to add the following to your configuration.nix:
 ``` nix
 boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
 ```
 then you can build the image with:
 ``` shell
 nix build .#nixosConfigurations.rpi1_base_image.config.system.build.sdImage
 ```
 ### run a configuration as vm
 to run a vm we have to build it first using the following command (replace ```<hostname>``` with the actual hostname):
 ``` shell
 nix build .#nixosConfigurations.<hostname>.config.system.build.vm
 ```
 afterwards run the following command to start the vm:
 ``` shell
 ./result/bin/run-<hostname>-vm
 ```
 ### documentation
-documentation is automatically build from master and can be found here: docs.malobeo.org  
+for documentation we currently just use README.md files.
-locally you can run documentation using ```nix run .#docs``` or ```nix run .#docsDev```
+
 the devshell provides the python package ['grip'](https://github.com/joeyespo/grip) which can be used to preview different README.md files in the browser.
 the usage is simple, just run ```grip``` in the same folder as the README.md you wanna preview. then open your browser at ```http://localhost:6419 ```.
--- a/flake.lock
+++ b/flake.lock
@@ -109,11 +109,11 @@
        "spectrum": "spectrum"
      },
      "locked": {
-        "lastModified": 1739104176,
+        "lastModified": 1736905611,
-        "narHash": "sha256-bNvtud2PUcbYM0i5Uq1v01Dcgq7RuhVKfjaSKkW2KRI=",
+        "narHash": "sha256-eW6SfZRaOnOybBzhvEzu3iRL8IhwE0ETxUpnkErlqkE=",
        "owner": "astro",
        "repo": "microvm.nix",
-        "rev": "d3a9b7504d420a1ffd7c83c1bb8fe57deaf939d2",
+        "rev": "a18d7ba1bb7fd4841191044ca7a7f895ef2adf3b",
        "type": "github"
      },
      "original": {
@@ -160,11 +160,11 @@
    },
    "nixos-hardware": {
      "locked": {
-        "lastModified": 1738816619,
+        "lastModified": 1736978406,
-        "narHash": "sha256-5yRlg48XmpcX5b5HesdGMOte+YuCy9rzQkJz+imcu6I=",
+        "narHash": "sha256-oMr3PVIQ8XPDI8/x6BHxsWEPBRU98Pam6KGVwUh8MPk=",
        "owner": "NixOS",
        "repo": "nixos-hardware",
-        "rev": "2eccff41bab80839b1d25b303b53d339fbb07087",
+        "rev": "b678606690027913f3434dea3864e712b862dde5",
        "type": "github"
      },
      "original": {
@@ -192,11 +192,11 @@
    },
    "nixpkgs-unstable": {
      "locked": {
-        "lastModified": 1739020877,
+        "lastModified": 1737062831,
-        "narHash": "sha256-mIvECo/NNdJJ/bXjNqIh8yeoSjVLAuDuTUzAo7dzs8Y=",
+        "narHash": "sha256-Tbk1MZbtV2s5aG+iM99U8FqwxU/YNArMcWAv6clcsBc=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "a79cfe0ebd24952b580b1cf08cd906354996d547",
+        "rev": "5df43628fdf08d642be8ba5b3625a6c70731c19c",
        "type": "github"
      },
      "original": {
@@ -208,11 +208,11 @@
    },
    "nixpkgs_2": {
      "locked": {
-        "lastModified": 1739206421,
+        "lastModified": 1736916166,
-        "narHash": "sha256-PwQASeL2cGVmrtQYlrBur0U20Xy07uSWVnFup2PHnDs=",
+        "narHash": "sha256-puPDoVKxkuNmYIGMpMQiK8bEjaACcCksolsG36gdaNQ=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "44534bc021b85c8d78e465021e21f33b856e2540",
+        "rev": "e24b4c09e963677b1beea49d411cd315a024ad3a",
        "type": "github"
      },
      "original": {
@@ -245,11 +245,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1739262228,
+        "lastModified": 1737107480,
-        "narHash": "sha256-7JAGezJ0Dn5qIyA2+T4Dt/xQgAbhCglh6lzCekTVMeU=",
+        "narHash": "sha256-GXUE9+FgxoZU8v0p6ilBJ8NH7k8nKmZjp/7dmMrCv3o=",
        "owner": "Mic92",
        "repo": "sops-nix",
-        "rev": "07af005bb7d60c7f118d9d9f5530485da5d1e975",
+        "rev": "4c4fb93f18b9072c6fa1986221f9a3d7bf1fe4b6",
        "type": "github"
      },
      "original": {
--- a/machines/.sops.yaml
+++ b/machines/.sops.yaml
@@ -8,12 +8,10 @@ keys:
  - &admin_atlan age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
  - &machine_moderatio 3b7027ab1933c4c5e0eb935f8f9b3c058aa6d4c2
  - &machine_lucia 3474196f3adf27cfb70f8f56bcd52d1ed55033db
-  - &machine_durruti age1arwef7t65lz40lxhs5svyzentskjzam3e0e0yxen872vwy6v234s9uftvr
+  - &machine_durruti age1xu6kxpf8p0r8d6sgyl0m20p5hmw35nserl7rejuzm66eql0ur4mq03u0vp
  - &machine_infradocs age15rqsygf7yfe6pv6t4c6c9jc6yk4vu5grmmcu7sexvqfw8763mf2q6qw50h
  - &machine_overwatch age1075ep3sl5ztshnq4jrygxqqqfts9wzk4gvvtwfjcep5ke8nzqs5sxtw7vd
  - &machine_vpn age1v6uxwej4nlrpfanr9js7x6059mtvyg4fw50pzt0a2kt3ahk7edlslafeuh
-  - &machine_fanny age136sz3lzhxf74ryruvq34d4tmmxnezkqkgu6zqa3dm582c22fgejqagrqxk
+  - &machine_fanny age14dpm6vaycd6u34dkndcktpamqgdyj4aqccjnl5533dsza05hxuds0tjfnf
-  - &machine_nextcloud age19mn55pz5dgeghjg5cp7mymwax20jshmp8gwzuf2s3h5xlvzjksyqfscsqk
+  - &machine_nextcloud age1w07s4y2uh0xd322ralyyh79545lvxzqncd0s65q9cx4ttlqv5u9s7y78gr
  #this dummy key is used for testing.
  - &machine_dummy age18jn5mrfs4gqrnv0e2sxsgh3kq4sgxx39hwr8z7mz9kt7wlgaasjqlr88ng
 creation_rules:
--- a/machines/bakunin/configuration.nix
+++ b/machines/bakunin/configuration.nix
@@ -26,6 +26,7 @@ in
  malobeo.disks = {
    enable = true;
    legacy = true;
    hostId = "a3c3102f";
    root = {
      disk0 = "disk/by-id/ata-HITACHI_HTS725016A9A364_110308PCKB04VNHX9XTJ";
@@ -33,9 +34,7 @@ in
  };
  malobeo.initssh = {
-    enable = true;
+    enable = false;
    authorizedKeys = sshKeys.admins;
    ethernetDrivers = ["r8169"];
  };
  hardware.sane.enable = true; #scanner support
--- a/machines/fanny/configuration.nix
+++ b/machines/fanny/configuration.nix
@@ -20,13 +20,6 @@ in
      inputs.self.nixosModules.malobeo.metrics
    ];
    virtualisation.vmVariantWithDisko = {
      virtualisation = {
        memorySize =  4096; 
        cores = 3;
      };
    };
  malobeo.metrics = {
    enable = true;
    enablePromtail = true;
@@ -64,11 +57,6 @@ in
    };
  };
  systemd.tmpfiles.rules = [ 
    "L /var/lib/microvms/data - - - - /data/microvms"
    "d /data/microvms 0755 root root" #not needed for real host?
    ];
  malobeo.initssh = {
    enable = true;
    authorizedKeys = sshKeys.admins;
--- a/machines/fanny/secrets.yaml
+++ b/machines/fanny/secrets.yaml
@@ -5,63 +5,63 @@ sops:
    azure_kv: []
    hc_vault: []
    age:
-        - recipient: age136sz3lzhxf74ryruvq34d4tmmxnezkqkgu6zqa3dm582c22fgejqagrqxk
+        - recipient: age14dpm6vaycd6u34dkndcktpamqgdyj4aqccjnl5533dsza05hxuds0tjfnf
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2ZFBYMHMzTFRMLzhCbnBE
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCTmdrV1IyM2hldloxM3Zh
-            MXkreklWSUVOckl5OTJ0VzlWS2tIOFBRRVVJCk90OXJoMHQza0hTSGt5VUphNjY1
+            cGVIZmtCZ0FLTEQxcFBLaVh0VXUwNWVGR1hBCnJ6SHpzckh5VVduM0Z2dkh2WHdy
-            MkFrTHQwTHJNSGZjT2JOYXJLWExwQTQKLS0tIHlTeVgvRlU0MXA3cUl2OE9tYUls
+            WGxRV0JFZTdqcWgzUFlSZkowZElJd2MKLS0tIGxYL0orSVdmZzJBSEIvRUNDUVlK
-            TStjbTBkMTNOcHBja0JRYUdvSWJUN00KtOPBH8xZy/GD9Ua3H6jisoluCR+UzaeE
+            RWFLOWp4TVJBM3llS0lmQlBUQ2ZQNkUKEz/dXR0tkVeyC9Oxai5gZEAhRImdL1FL
-            pAWM9Y6Gn6f7jv2BPKVTaWsyrafsYP7cDabQe2ancAuuKvkng/jrEw==
+            2LdVRiCt3MqR9wtfw1/pR7166Bx8nLIN42uWh2YU5j0/0rXNq+I6Qg==
            -----END AGE ENCRYPTED FILE-----
        - recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhc282T2VVamFGcG1Ub3hp
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoQW5OU2FiNStkazFRRHBK
-            S1VwKzVsWW1sRXczZnRNdkxDWE5Sd0hhVUJRCkovNGZ1ZlN0c1VyMXV0WThJMGFi
+            U2kzNkpWRDVQTDBkTFFNWnREcjh6NlhmRnhZCkxMYlZhcUlGUnN3QWFzbVkyYlpX
-            QVM3WW5Eam81dWpGaFd3bm80TmtQSlUKLS0tIFFSUy9SYWdKeE5KWk0yZld5dDYy
+            eWZaOUxsUCtZYmx0U29ZckFaMjNLTFEKLS0tIExxV0REL3MwUTZpMkgxYlZMc0JS
-            QVZyNWVOMTh3ejBha21Qb2xCRkFERGMKH9nMQUoS5bGcLUx2T1dOmKd9jshttTrP
+            cTNEYTBGT3VRaDI1eUhucnd5d2JhTWMKNZlkUjxX2QTFoiCWPzz62jz4kK8d5rW/
-            SKFx7MXcjFRLKS2Ij12V8ftjL3Uod6be5zoMibkxK19KmXY/514Jww==
+            MJ1w69Qve7lsUAg74YlFF7i/yYSZZkHoRMs92lRmq3lHlbK6aaUMTw==
            -----END AGE ENCRYPTED FILE-----
    lastmodified: "2025-01-14T12:41:07Z"
    mac: ENC[AES256_GCM,data:RJ4Fa8MmX8u8S3zrD/SaywTC3d2IfHQPBDy3C9u4GuXJ/ruEChAB1kN8rqMPvkmET8UUgHIEp7RpbzMtg/FOmKYKYTTx5t//3/VozvAEZurhG/4mnN3r6uaZ0R9+wSjym8IyOKsJ7p4XrfE5tRdzNyU4EqfkEiyf+jO751uSnYI=,iv:eiTdmbcrpUvyDPFmGawxJs/ehmD7KqulaoB+nfpC6ko=,tag:+TKr53cFS3wbLXNgcbZfJQ==,type:str]
    pgp:
-        - created_at: "2025-02-11T18:32:49Z"
+        - created_at: "2025-01-14T12:32:13Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----
-            hQGMA5HdvEwzh/H7AQwAmorRyo7mguHQxATRRuKstaXertmyz2AhKFr1Kr880vBJ
+            hQGMA5HdvEwzh/H7AQv/YM4JBfaFngZt0SmMP3fBCodQXWnWMjy5VYoTOKKaOfG8
-            ODjEKmkH77wIpOnZjOYrx7j2JWosoJ1KgsUUh4VlAPM3O6cXVwqDucu1d8O/HzK3
+            5GRTf+o1stsru3EKImh5PTqniRO6UH+/DOKBY8zHsy9lXojGka3uPJRKv7JUD5YO
-            RPuPfTKDr/lKl7QyQCx5lQuxE1/qn88D/g/fMQYu3NAVJa7acpTdSsfyo9nZ3QMb
+            8NjlHwwg+jcQN/qtrWc+1D69zR1aO/6yxfgujL3r/fJ4reqtSNfkVYVy2lEcw2ZN
-            ly6YEyGDc/IhBy5igc7bIWy1o+XATmyUxA+jZVMLiBKhetogMC507Eq71tUCMEht
+            zhlN+fBxZCyHyUTKLcXrG7Fg8BRudjwBnIsBTLAVFkWg0bnlq38vicGpF5CHsRjA
-            CItRoFFPeoCzC8JPjpQNQmXoe5WDv3hzWpUBRJgjScYz3JuEfakbsAnzrPc41Mga
+            cTPq2D9ev888WKHcjFcXYqxeKkXkqBuOOMlCHQyJCv8HHfA/GY+pBQfiVmvSt77O
-            yPhSPYPBtHlEt+DntW9i/CFLEJ+I0V+uz3gnNtNdHTIIe2AZbGympjZldZThldb3
+            /MA8hVYl8G4tRFsbUdZzqtPbAsLy30w1e9dpsD2M6tD55V2RNUCrznB2lo0uXZ24
-            Tupo7ep6VQgi+hG37wLmQdvSVWR8lVJDMvOmV9xZqdFYfQdBr2gewTT6Y2QCc8GZ
+            9MUnad+NQdntbe5B2OBUF/MNKZ9/tC+B9pBm7Tx3rxSELytGuQF11x4EyLwn+Ict
-            HBtJASlpIbydd/rtLtaTwtdOz64g+F5Vw/6T3ciyExt6RCoPALqZCoyzQnvnQm7e
+            iBBV5P3RiulxLW6MbDs+7JPILfcMfg6e8q+GY1dnIPZrs8Qf5W60FxbOYYiMvJ9k
-            JPPauAs8BH8ejoDlJYjK0lgBBMSJTZ2xlGYh4wG8zmGtGok2wvXYy+DeqlXuCIy6
+            UtnZAixVdlpkAsQz/t630lgBX9DLYjEVgaxC+zqtRjfHkoyvGIac6cgHDX/fBs7p
-            7Xu4BLTL9eOZZo0sPR+RQfYbII0zMIc2fPBtU2c2z89YOTI44FI0BVbTlhLIIXXz
+            Woud0RbwffhOhaIF47Z2W4UPfn5Mtcu63fQpjCM9urk9asaRPeNDTeEYVjqSZD6N
-            NJMDln08MWwr
+            J+o9dahBHvIF
-            =hhKC
+            =GKm4
            -----END PGP MESSAGE-----
          fp: c4639370c41133a738f643a591ddbc4c3387f1fb
-        - created_at: "2025-02-11T18:32:49Z"
+        - created_at: "2025-01-14T12:32:13Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----
-            hQIMA98TrrsQEbXUAQ//cBdyq4JxOhU9t7Z9iWAp2DRObgv7HMbhIXh1351wuzA7
+            hQIMA98TrrsQEbXUARAAmD4PfLpRVUXTo5yyS9LSs5vmEvnCmNc0ad4Oiv7YAxhs
-            Fe0Kqcoo/ekCkIPrLZOC5z4CMjXwOCPSncMMm5vK5ibixTlX9446+Hv7AQ1vq2Nt
+            W7SCKHq2zOfGIeZZHP0wjRnJELwMCVLy4dVo/slDHCiy8T4MZXaYR04ZaJJ+OHrF
-            2daL8ZzpCeCJmi07Vyp72/NJOZYa6YY/gFiiRw044lNLFS//b0sYkipne5COjvca
+            e5xxAA6FjipufvxgRZvLhDj+g+RaX2TuxdL9gFSVS81rvEpSRDnydt2O/6G4SGBR
-            I7BxWCpGwLLWZ7LNKhg6i0at+0AqEdBDiwSE7jfeY6IL9tPOIqmBxYIWMbiAkPMd
+            GO5b176eMerrqOqRLL5Ou4b6oitagvRwZzOXQ+YonKZz3STlyXRMgWxeFTDK9T/q
-            /nK8PVPrt41NkJkuxfjXcYowJRcJmAYHGiRUQaAkUZyRQxmolbLwwJ+/CVYxv5Kk
+            yYOwPVAOU1jhYzUjHNAYCp3CH4ERScrO7AwomAWH+Fe48WRbg2ebdqRnuv/Vl4PM
-            hN5QvT82z5I8gK5LXrt3ZGEcC9dADkRSQr/qcWQT+CEnsGZi8b0unwUZZruDVb7d
+            wc5DQcCIIIIENMGIYOzUo1KrfQlevzXF/mbgAgo/uVuRl3Y3lCRAcZBQOtUCF5Ap
-            eIwICaXu62gH/mlJN1z/J5jEciwQtC9Eh932x5qY3sdtd6Gm7/EHTf9NJ9Zg3gTk
+            FhsO87EMXlZWj3bv08f21t3hQztfuaHIqFpCbSIGgmiE9cAY0cOtCYpJfCYdV7iT
-            nfytwpfUmtJO/bI5RvYSUkXkU6CLY6bqRW12+YrsAP+vDITYcLVEJGt7jrXDFto2
+            cOElJgYRbAsAbFC9wTQWEvwIxrgnCIrkCg1bzP5KNLG1K+ae5J7qN77qeTQw2/ul
-            Z9rlywZsQiZhLrzi1UImCTthcceI6Hd7l3TOYV84gMxdahBo3FLKnoZRK2I7ukGq
+            QDDUUNnzjes562t+/xFLQa/bust1Y8pAYn1s1LEBol1hLX4Igonlkw303UPjZOI2
-            Wi0KjajcsJ6LBUCCpMg/tW+TT8/+66QY9BDzcv/hBdRc4lCKNeKDwwGFPSFZCcib
+            MyH5hOh0hNUReuOpHpre/pYquE8Dd27XKAHfJsSd3ZLJG5+1Msw23lIsptgovNrB
-            uyT8UB6iUYVMiNSHRqdGGcH0NwH45Oe2g9nF/lrJ0vYw1toN3WSpEc5v/Nch8DbS
+            5VRvPj8WPojiDHqN27kt/IuayN3TeoJFjmAjkoFjlyKTcs+b6cDkxUw3LcP+6NjS
-            WAE3DazXQgd4UQ19q+5cC+L5POWcAjgWpZlRwBXBRdeOKFDF9maCPL6MpfMm6XG1
+            WAHQI0pWTa5zD8UPow4DHxteP4jW/6ddBfJ1Vz1scqKMXYvxFkRqZvn3uAJOtcuw
-            /JNfzhipjL5OXgJgK7iUFJlH9AuD18g/by7yID0bTsg2fkfLglwjfm8=
+            CgQ4CXE43n4G7g5gvWl6ZFW8tdXR7Sw+USnHR/9oS9fV0rHcxxDFEfE=
-            =Sdch
+            =9FN4
            -----END PGP MESSAGE-----
          fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4
    unencrypted_suffix: _unencrypted
--- a/machines/modules/disko/default.nix
+++ b/machines/modules/disko/default.nix
@@ -20,6 +20,11 @@ in
      default = true;
      description = "Allows encryption to be disabled for testing";
    };
    legacy = lib.mkOption {
      type = lib.types.bool;
      default = false;
      description = "Enable legacy boot (bios)";
    };
    devNodes = lib.mkOption {
      type = lib.types.str;
      default = "/dev/disk/by-id/";
@@ -81,202 +86,220 @@ in
    };
  };
-  config = lib.mkIf cfg.enable {
+  config = lib.mkMerge [
-    networking.hostId = cfg.hostId;
+    (lib.mkIf (cfg.enable && !cfg.legacy) {
-    disko.devices = {
+      boot = {
-      disk = lib.mkMerge [
+        loader.systemd-boot.enable = true;
-        {
+        loader.efi.canTouchEfiVariables = true;
-          ssd0 = lib.mkIf (cfg.root.disk0 != "") {
+        supportedFilesystems = [ "vfat" "zfs" ];
-            type = "disk";
+      };
-            device = "/dev/${cfg.root.disk0}";
+      fileSystems."/boot".neededForBoot = true;
-            content = {
+    })
-              type = "gpt";
+    (lib.mkIf (cfg.enable && cfg.legacy) {
-              partitions = {
+      boot.loader.grub = {
-                ESP = {
+        enable = lib.mkForce true;
-                  size = "1024M";
+        device = "/dev/${cfg.root.disk0}-part1";
-                  type = "EF00";
+        efiSupport = false;
-                  content = {
+        enableCryptodisk = cfg.encryption;
-                    type = "filesystem";
+        zfsSupport = true;
-                    format = "vfat";
+      };
-                    mountpoint = "/boot";
+    })
-                    mountOptions = [ "umask=0077" ];
+    (lib.mkIf cfg.enable {
      networking.hostId = cfg.hostId;
      disko.devices = {
        disk = lib.mkMerge [
          {
            ssd0 = lib.mkIf (cfg.root.disk0 != "") {
              type = "disk";
              device = "/dev/${cfg.root.disk0}";
              content = {
                type = "gpt";
                partitions = {
                  ESP = lib.mkIf (!cfg.legacy) {
                    size = "1024M";
                    type = "EF00";
                    content = {
                      type = "filesystem";
                      format = "vfat";
                      mountpoint = "/boot";
                      mountOptions = [ "umask=0077" ];
                    };
                  };
-                };
+                  boot = lib.mkIf cfg.legacy {
-                encryptedSwap = lib.mkIf cfg.encryption {
+                    size = "1024M";
-                  size = cfg.root.swap;
+                    type = "EF02";
                  content =  {
                    type = "swap";
                    randomEncryption = true;
                  };
-                };
+                  encryptedSwap = {
-                zfs = {
+                    size = cfg.root.swap;
-                  size = "100%";
+                    content =  {
-                  content = {
+                      type = "swap";
-                    type = "zfs";
+                      randomEncryption = true;
-                    pool = "zroot";
+                    };
                  };
-                };
+                  zfs = {
-              };
+                    size = "100%";
-            };
+                    content = {
-          };
+                      type = "zfs";
-          ssd1 = lib.mkIf (cfg.root.disk1 != "") {
+                      pool = "zroot";
            type = "disk";
            device = "/dev/${cfg.root.disk1}";
            content = {
              type = "gpt";
              partitions = {
                zfs = {
                  size = "100%";
                  content = {
                    type = "zfs";
                    pool = "zroot";
                  };
                };
              };
            };
          };
        }
        (lib.mkIf cfg.storage.enable (
          lib.mkMerge (
            map (diskname: {
              "${diskname}" = {
                type = "disk";
                device = "/dev/${diskname}";
                content = {
                  type = "gpt";
                  partitions = {
                    zfs = {
                      size = "100%";
                      content = {
                        type = "zfs";
                        pool = "storage";
                      };
                    };
                  };
                };
              };
-            }) cfg.storage.disks
+            };
-          )
+            ssd1 = lib.mkIf (cfg.root.disk1 != "") {
-        ))
+              type = "disk";
-      ];
+              device = "/dev/${cfg.root.disk1}";
              content = {
                type = "gpt";
                partitions = {
                  zfs = {
                    size = "100%";
                    content = {
                      type = "zfs";
                      pool = "zroot";
                    };
                  };
                };
              };
            };
          }
          (lib.mkIf cfg.storage.enable (
            lib.mkMerge (
              map (diskname: {
                "${diskname}" = {
                  type = "disk";
                  device = "/dev/${diskname}";
                  content = {
                    type = "gpt";
                    partitions = {
                      zfs = {
                        size = "100%";
                        content = {
                          type = "zfs";
                          pool = "storage";
                        };
                      };
                    };
                  };
                };
              }) cfg.storage.disks
            )
          ))
        ];
-      zpool = {
+        zpool = {
-        zroot = {
+          zroot = {
-          type = "zpool";
+            type = "zpool";
-          mode = lib.mkIf cfg.root.mirror "mirror";
+            mode = lib.mkIf cfg.root.mirror "mirror";
-          # Workaround: cannot import 'zroot': I/O error in disko tests
+            # Workaround: cannot import 'zroot': I/O error in disko tests
-          options.cachefile = "none";
+            options.cachefile = "none";
-          rootFsOptions = {
+            rootFsOptions = {
-            mountpoint = "none";
+              mountpoint = "none";
-            xattr = "sa";         # für microvm virtiofs mount
+              xattr = "sa";         # für microvm virtiofs mount
-            acltype = "posixacl"; # für microvm virtiofs mount 
+              acltype = "posixacl"; # für microvm virtiofs mount 
-            compression = "zstd";
+              compression = "zstd";
-            "com.sun:auto-snapshot" = "false";
+              "com.sun:auto-snapshot" = "false";
            };
            datasets = {
              encrypted = {
                type = "zfs_fs";
                options = {
                  mountpoint = "none";
                  encryption = lib.mkIf cfg.encryption "aes-256-gcm";
                  keyformat = lib.mkIf cfg.encryption "passphrase";
                  keylocation = lib.mkIf cfg.encryption "file:///tmp/secret.key";
                };
                # use this to read the key during boot
                postCreateHook = lib.mkIf cfg.encryption ''
                  zfs set keylocation="prompt" zroot/encrypted;
                '';
              };
              "encrypted/root" = {
                type = "zfs_fs";
                mountpoint = "/";
                options.mountpoint = "legacy";
              };
              "encrypted/var" = {
                type = "zfs_fs";
                mountpoint = "/var";
                options.mountpoint = "legacy";
              };
              "encrypted/etc" = {
                type = "zfs_fs";
                mountpoint = "/etc";
                options.mountpoint = "legacy";
              };
              "encrypted/home" = {
                type = "zfs_fs";
                mountpoint = "/home";
                options.mountpoint = "legacy";
              };
              "encrypted/nix" = {
                type = "zfs_fs";
                mountpoint = "/nix";
                options.mountpoint = "legacy";
              };
              reserved = {
                # for cow delete if pool is full
                options = {
                  canmount = "off";
                  mountpoint = "none";
                  reservation = "${cfg.root.reservation}";
                };
                type = "zfs_fs";
              };
            };
          };
-          datasets = {
+          storage = lib.mkIf cfg.storage.enable {
-            encrypted = {
+            type = "zpool";
-              type = "zfs_fs";
+            mode = lib.mkIf (cfg.storage.mirror) "mirror";
-              options = {
+            rootFsOptions = { 
-                mountpoint = "none";
+              mountpoint = "none";
-                encryption = lib.mkIf cfg.encryption "aes-256-gcm";
+              xattr = "sa";         # für microvm virtiofs mount
-                keyformat = lib.mkIf cfg.encryption "passphrase";
+              acltype = "posixacl"; # für microvm virtiofs mount 
-                keylocation = lib.mkIf cfg.encryption "file:///tmp/secret.key";
+            };
            datasets = {
              encrypted = {
                type = "zfs_fs";
                options = {
                  mountpoint = "none";
                  encryption = lib.mkIf cfg.encryption "aes-256-gcm";
                  keyformat = lib.mkIf cfg.encryption "passphrase";
                  keylocation = lib.mkIf cfg.encryption "file:///tmp/secret.key";
                };
                # use this to read the key during boot
                postCreateHook = lib.mkIf cfg.encryption ''
                  zfs set keylocation="file:///root/secret.key" storage/encrypted;
                '';
              };
-              # use this to read the key during boot
+              "encrypted/data" = {
-              postCreateHook = lib.mkIf cfg.encryption ''
+                type = "zfs_fs";
-                zfs set keylocation="prompt" zroot/encrypted;
+                mountpoint = "/data";
              '';
            };
            "encrypted/root" = {
              type = "zfs_fs";
              mountpoint = "/";
              options.mountpoint = "legacy";
            };
            "encrypted/var" = {
              type = "zfs_fs";
              mountpoint = "/var";
              options.mountpoint = "legacy";
            };
            "encrypted/etc" = {
              type = "zfs_fs";
              mountpoint = "/etc";
              options.mountpoint = "legacy";
            };
            "encrypted/home" = {
              type = "zfs_fs";
              mountpoint = "/home";
              options.mountpoint = "legacy";
            };
            "encrypted/nix" = {
              type = "zfs_fs";
              mountpoint = "/nix";
              options.mountpoint = "legacy";
            };
            reserved = {
              # for cow delete if pool is full
              options = {
                canmount = "off";
                mountpoint = "none";
                reservation = "${cfg.root.reservation}";
              };
-              type = "zfs_fs";
+              reserved = {
-            };
+                # for cow delete if pool is full
-          };
+                options = {
-        };
+                  canmount = "off";
-
+                  mountpoint = "none";
-        storage = lib.mkIf cfg.storage.enable {
+                  reservation = "${cfg.storage.reservation}";
-          type = "zpool";
+                };
-          mode = lib.mkIf (cfg.storage.mirror) "mirror";
+                type = "zfs_fs";
          rootFsOptions = { 
            mountpoint = "none";
            xattr = "sa";         # für microvm virtiofs mount
            acltype = "posixacl"; # für microvm virtiofs mount 
          };
          datasets = {
            encrypted = {
              type = "zfs_fs";
              options = {
                mountpoint = "none";
                encryption = lib.mkIf cfg.encryption "aes-256-gcm";
                keyformat = lib.mkIf cfg.encryption "passphrase";
                keylocation = lib.mkIf cfg.encryption "file:///tmp/secret.key";
              };
              # use this to read the key during boot
              postCreateHook = lib.mkIf cfg.encryption ''
                zfs set keylocation="file:///root/secret.key" storage/encrypted;
              '';
            };
            "encrypted/data" = {
              type = "zfs_fs";
              mountpoint = "/data";
            };
            "encrypted/data/microvms" = {
              type = "zfs_fs";
              mountpoint = "/data/microvms";
            };
            reserved = {
              # for cow delete if pool is full
              options = {
                canmount = "off";
                mountpoint = "none";
                reservation = "${cfg.storage.reservation}";
              };
              type = "zfs_fs";
            };
          };
        };
      };
    };
-    boot.zfs.devNodes = lib.mkDefault cfg.devNodes;
+      boot.zfs.devNodes = lib.mkDefault cfg.devNodes;
-    boot.zfs.extraPools = lib.mkIf cfg.storage.enable [ "storage" ];
+      boot.zfs.extraPools = lib.mkIf cfg.storage.enable [ "storage" ];
-    fileSystems."/".neededForBoot = true;
+
-    fileSystems."/etc".neededForBoot = true;
+      fileSystems."/".neededForBoot = true;
-    fileSystems."/boot".neededForBoot = true;
+      fileSystems."/etc".neededForBoot = true;
-    fileSystems."/var".neededForBoot = true;
+      fileSystems."/var".neededForBoot = true;
-    fileSystems."/home".neededForBoot = true;
+      fileSystems."/home".neededForBoot = true;
-    fileSystems."/nix".neededForBoot = true;
+      fileSystems."/nix".neededForBoot = true;
-  };
+    })
  ];
 }
--- a/machines/modules/host_builder.nix
+++ b/machines/modules/host_builder.nix
@@ -70,13 +70,6 @@ rec {
            proto = "virtiofs";
            socket = "var.socket";
          }
          {
            source = "/var/lib/microvms/data/${hostName}";
            mountPoint = "/data";
            tag = "data";
            proto = "virtiofs";
            socket = "microdata.socket";
          }
        ];
        interfaces = [
--- a/machines/modules/malobeo/initssh.nix
+++ b/machines/modules/malobeo/initssh.nix
@@ -26,9 +26,6 @@ in
  config = lib.mkIf (cfg.enable && config.malobeo.disks.encryption) {
    boot = {
      loader.systemd-boot.enable = true;
      loader.efi.canTouchEfiVariables = true;
      supportedFilesystems = [ "vfat" "zfs" ];
      zfs = {
        requestEncryptionCredentials = true;
      };
--- a/machines/nextcloud/configuration.nix
+++ b/machines/nextcloud/configuration.nix
@@ -37,7 +37,6 @@ with lib;
    hostName = "cloud.malobeo.org";
    config.adminpassFile = config.sops.secrets.nextcloudAdminPass.path;
    #https = true; #disable for testing
    datadir = "/data/services/nextcloud/";
    database.createLocally = true;
    config.dbtype = "pgsql";
    configureRedis = true;
@@ -56,12 +55,6 @@ with lib;
    };
    settings = {
      trusted_domains = ["10.0.0.13"];
      "maintenance_window_start" = "1";
      "default_phone_region" = "DE";
    };
    phpOptions = {
      "realpath_cache_size" = "0";
      "opcache.interned_strings_buffer" = "23";
    };
  };
--- a/machines/nextcloud/secrets.yaml
+++ b/machines/nextcloud/secrets.yaml
@@ -8,60 +8,60 @@ sops:
        - recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3cFBEempENHlXNnhNb1d5
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqSk9GWktrZ3FsRHpOcTJp
-            UitGNFliTDliZUdCSVBPRUVEWDc1Skw3N2xvCkFoL01DL2ZmWHhoMHV4TGdhaFdH
+            Y3VWMytTRlhxVXJma1puT1lMRTN2NHBNV2xrCi8xYTFWeVN6RWl0Um9mZXpoKzFh
-            bG9XdUQ4ano4VjRxVTloNnl4OHJ6dkkKLS0tIDJvK2ZjNVhYZ1FkQTVWWjBhSFlt
+            SjVFcGJRNlhkVUZQYXpEb0EwYzUvUjQKLS0tIGEvdGdMRGxvcndxMllZTWZqKzg1
-            R1Ixc3pWNFMvUVl0M1NsZ0txRXFMTkkK5aDgbCd13gAfZUrROnwRHgyXvIF67o1W
+            aWlJOTdYV1JMM0dIWEFDSHRuQWdlcVUKsdwGZ3SkJEf4ALDhHUlSQJNKrFyWd7fW
-            EzEFyhWatq2KKzv6VoJSFnvEx5lMPSs0LLvOK2qgrsz0jWdy6yUkAg==
+            WTGk66NJ2yD8ko/6OyB9J9U0WPbFLgr972H+klBq/IDmOx0hClbYNA==
            -----END AGE ENCRYPTED FILE-----
-        - recipient: age19mn55pz5dgeghjg5cp7mymwax20jshmp8gwzuf2s3h5xlvzjksyqfscsqk
+        - recipient: age1w07s4y2uh0xd322ralyyh79545lvxzqncd0s65q9cx4ttlqv5u9s7y78gr
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxc3BSNVdqSTNYZSt4c05K
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoNzdib3Ztd0g0MlVqYVF6
-            TnpuYXF1L2lzQkdZOS9uUnA5aUpGTldWZVQ0CkZvN2hubmwvUW5xUWhtaE0xMzlp
+            cUtjZzEyY2FJYVRoT1p5RlJwYVQwUXVOUkNVCkp4V3hMYlJsaVN4RjlwQXNWS1Jt
-            U3dpRHlmdU5UVG1nTS9XUVpTSjdQQ00KLS0tIC9sWTBOMStOYis1SDhLbjFlVk1F
+            aitzWVdOcUdrNHorenZGZU1iWFZzVjgKLS0tIGNGcTU5OUJLM3VzQk1uODFwS1hO
-            M2dYNEpmWmxyeXU5S0FuV083NkVaQ3cKXuGyR0YQy+22z2kgM7IPhr0gurWQYczm
+            WG16Y25tMDkreGFnSFRKN1AybyttYWcKcLHJScp2Ozh0jIdi7Hb/tSjaCGorqXaC
-            FA7C/2hoqb4tyyejomitndBSyxIxnaReO0Apl6JXeTLor8Dpuu42oQ==
+            9DIrQPHbPP1RIc6Ak8Kn30/BHEWV3VaiBCT3vfS9pNJQNjB4T+901g==
            -----END AGE ENCRYPTED FILE-----
    lastmodified: "2024-11-26T20:00:50Z"
    mac: ENC[AES256_GCM,data:qoY9SfpoU+8HfvD5v/1S6BOkbnZUmHIbtwr0tTSuPETjnFNgr1VVw9mnRatJKPYYFb9/rMZQWIqTY+iUIEkcTVyVXhd6ki5CHW+uxCeBIyMzq33rtEa/btkEUoii4iPieamBCIY21W0znE+edxfR04yRJtLxMICEbuW4Hjf6bwk=,iv:nG42fRgjpuIjPMYnn/6egEdzYolcUBsspaZ8zMv4888=,tag:C6apGoAvVLsWdLWSCwrx6w==,type:str]
    pgp:
-        - created_at: "2025-02-19T14:34:54Z"
+        - created_at: "2025-01-21T21:04:08Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----
-            hQGMA5HdvEwzh/H7AQwAkNhF9L1ocTsJRDyIA+0y24gtvRKAZhSRwds2wvTiBkPS
+            hQGMA5HdvEwzh/H7AQv/ejIylIgs3yeVcZriQTA8d/xyXTdFw6On422lTCDk3d0W
-            jzse8z4wY2yWz/JbEgqJqeFxJCaE64oc+2dETJIl2IsiRBDlXKfpL4yfRV+P6Ffu
+            GOdV44vAzUzNX5tziQtLjectLUrKh9Qb9WaP4VnTCGI0XJ/dEtYRCkYMx8MjjbLl
-            DQfAR57hKIYa9emx+iFGoDMpRSuuLg4EGDoe1tmAu2OwLhKsqJrbL1ak88GB7/ko
+            8GqFi3Hw958Uykp9wt0iiP6BQ42Fo77EPxVcn21eHKZY0zg/vaeRXXeXSzkjzANs
-            gFk02AF/QYuEetc7R0pZPxB6n1HQGBrvqAFrnHEsxw2rR7I4kNYpEzyf0IuGHfB1
+            NN/KFS06uFRJhmp+0z6hDRrHnpb0wd5JGjHOp96jK9LmpwfZZZlVpAHp04hOhlPV
-            92WfYtdYSni7cqmTPV+t+k6P1VcJe6GXdlQnHk2pByqC2WrcrP+MtaAMkmWqxU72
+            cMmdjg9IRSubvbraTbDrgwB0h3JKdqovFDnAP/KvT+rw5xnVUVMq/3tUNq4MbfZb
-            AGarWEV2bnXmBsM5LcOQF6Mbui9tpEBE0O3lMlzUNXoVYHpOczlqdWkqh/y3Ea8V
+            CvQrXsjQJQbEhY+eAJZVRO07kX0+zMvIin4ss7Xt++qlo4/OvFvuGbnUhJE+hrBb
-            bnHcaLQ8XubRyccK4JYZ4AIMJVPlVcnXdjZ4VFJwjRzGrllorq4x8L0niv60HV/g
+            nkyGhbDrjpsfa3djCEZ0UxMAWtPeIQ7T8QMkGY+UKeJKxfOGSchARnfCtGD/rtsj
-            akxsjW1DPnJURNFacT3JYF+PsN+hpj/ma2k8qUTX5wFVJy3Gm0psVYqE5901ivBA
+            wuhqGya7g7WP78WzwASzlPwB5jpdQ29/zLWXR60lNCYu0UYSVYmlspZnKEB0FkLO
-            yg7mfiftchDvIeGQR8tE0lgBZrJbf/SjpVdawq7DORFVxkaNeoSAxOkCnqZ5kc7C
+            TNUrwXXMrM0XwMVaG/sF0lgBEPE6CTuE85evCHFyu6zhEAa7YimKAPIowcwYLSJ2
-            w6zfxABWvwz73QM0AqfNzjkyswGk7N/09Zpj4BvjbbYuAfvIdiVVDHRPez/qWjnB
+            46KfttJAYnRnb68Kk9N5xcFyvhKyTx/6eMdxkgr2LMoSTBDUgZfG3rDQC+ZbFE3m
-            vkt9aLXFepLl
+            bUOvx3Ho80EC
-            =4LVt
+            =oQd6
            -----END PGP MESSAGE-----
          fp: c4639370c41133a738f643a591ddbc4c3387f1fb
-        - created_at: "2025-02-19T14:34:54Z"
+        - created_at: "2025-01-21T21:04:08Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----
-            hQIMA98TrrsQEbXUARAAmoHJ3i2vABDamIF3Nj6uuawarW+KKjzrIfYvAmWW4fgz
+            hQIMA98TrrsQEbXUAQ//eu7YkPL7dU4AYWCZI7THsiJ51SOMahOXp/qC5yL18aZY
-            zVAquTl1Oculhv+H4eVuylNUM5kwyCkM/VAxy3KoSNZn6aGZVDuns70r9lbNC1R8
+            r4SpyNhFezGIJfMuhwBSZZBI/MNW6M+zMwIJ2wkioxUDnDvfVi10/cV6p85U75Jn
-            +diYAIe33rE3h6/Rw74RgOXUgNalONeoBWbIUuG+y9XOIfu7CBoUeGJct4ycYH0h
+            59e1afN+eekG2DCI6sWPmLy8jmYh4CQRdEurtfzquDOARZ4IHZjotP5AWI8OPHlM
-            bn5iI0e4myDldmSc7OYnyruQMYg9OcKBnQPTZl1qzTqpwR6/BnIhWJcItuc3W5rv
+            FdK2jGXFVevQY0m619CNm78D2NEdlGe1QtLVSazWQ8MsDLfMnHTYFUy3EoSihzat
-            aEunQ8lVyNxhGWMDwFucUJ2WbxkOFOFWPrLGXtsUg/I32aCUNR6X/HnYUezqCoSA
+            QkcR//8whzlLT/NcqKlnBDNBU7FvPov+ZdUmIw1mx2wp5f2sGp4m737Yhoey2aFL
-            SFJAsaPkBr07o5Be5D03m0s5ryktQUdAElyDaz2Sgc58re9mtYKBAf4P4fKD5Zx+
+            qLXHDc91nVRcw95FBDNYlSH8a2AzT4sm4vFR5EkC6vrfz+v1pdg1Fc3dc++hPgE0
-            TJJGr6dmtb28Nxb5mbMroKbTit92NHHatXfz/YrZ1JyCHuINZ5Sq01TGhx6y71Uj
+            MYWn6f4v8lDhPhw2kpmAP4Oz4uPdmPgdfXKiIzr7qf3O5lIC6ZIIwoqhj2f0odj6
-            0Afq3S2la+85UYRsQ5g9q6jM8rBHjm9AdcUkWA1chtn6elAUG8J0B+DUYYwcrMtp
+            7anDUN5C3B5ruFU3UNJEBLrZelbmg4zf2hAtzfoi0L9paIZX5SCLP3PDbvdRbADc
-            YWFaKNHT09FRn4TcgE50Wgn9lX2RZ03viBbgCvDBLh3fmzl+dU1DsFdwuYmbgOeO
+            oyC3Gw/DeddQ9ZeP+wYiwJ/614zRBmZRzQr9RFowf0gJBSS7TaWPCONfUJ/3eekX
-            B6SQ2+SF3VVR7vAn4oPKydztCfYmb+38sCQl/FtZdP1RRW150fXtUx7aAzWGsLhq
+            or8JpLTD5PMQNoS0L4S41Cj+yOg/AlmHF/9yvj1GVTKT9rBj3Snki9NOmY2ZUQo3
-            AObrNp0uMeCBHtpWctwFR1qssfRD3DHkI59MqoGK7ehDtBS6hzayjJp8sTiqCTzS
+            BDdnsftA3w4q4iu06ojQkrjn/FJjmNzb83XR2WxrHFUAaY//nISyY/9uTsEhwFbS
-            WAH/vMH2cvGN3q9mr73bBqHBxAL+ANWxrDvQmM4xwbLxET24ULnsC35bn4psWjTN
+            WAFlKfmyVc7nLBI12i0yWLLy/tcVF3c8gtGfNmyoe/RIr+6EQmzUi0v+X49Tnzpj
-            Y3aQqzhaZdYOki09fLENaYl6BMeIcfBx4qUrgfQKLUNqGV5fvVuXJUc=
+            8JAnE+4Jzm2ijqF4Ats5KoXqFiLUenJZQHJ3IFoI36n+hM4P/ICeZ4k=
-            =/V5O
+            =s9pl
            -----END PGP MESSAGE-----
          fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4
    unencrypted_suffix: _unencrypted
Author	SHA1	Message	Date
kalipso	2f4cb3787b	[disko] rm duplicate filesystems entry All checks were successful Check flake syntax / flake-check (push) Successful in 4m16s Details	2025-02-05 14:31:39 +01:00
kalipso	4f9e66ba82	Merge branch 'master' into issue31 Some checks failed Check flake syntax / flake-check (push) Failing after 2m0s Details	2025-02-05 14:25:57 +01:00
ahtlon	c51c1e8e92	Merge master All checks were successful Check flake syntax / flake-check (push) Successful in 6m6s Details	2025-01-19 18:00:27 +01:00
ahtlon	a96b8f65c9	[disko]Force grub on legacy boot Some checks failed Check flake syntax / flake-check (push) Waiting to run Details Evaluate Hydra Jobs / eval-hydra-jobs (push) Has been cancelled Details Evaluate Hydra Jobs / eval-hydra-jobs (pull_request) Has been cancelled Details Check flake syntax / flake-check (pull_request) Has been cancelled Details	2025-01-19 17:59:29 +01:00
Ahtlon	29d6bc02e0	Merge branch 'master' into issue31 Some checks failed Evaluate Hydra Jobs / eval-hydra-jobs (pull_request) Successful in 3m41s Details Evaluate Hydra Jobs / eval-hydra-jobs (push) Successful in 3m46s Details Check flake syntax / flake-check (pull_request) Failing after 2m20s Details Check flake syntax / flake-check (push) Failing after 2m15s Details	2025-01-18 22:57:21 +01:00
ahtlon	c0cef1ff1e	Apply legacy to bakunin Some checks failed Evaluate Hydra Jobs / eval-hydra-jobs (push) Has been cancelled Details Evaluate Hydra Jobs / eval-hydra-jobs (pull_request) Successful in 5m14s Details	2025-01-18 21:33:41 +01:00
ahtlon	7099c92236	[disko] add legacy option I don't know if the grub device is right	2025-01-18 21:33:23 +01:00