[scripts] only need to unlock once

currently only allows forwarding to port 80, i was to lazy to handle two
arguments in bash

flake.lock

@@ -341,11 +341,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1736184101,
-        "narHash": "sha256-HAX+TkDXzyNp6SAsKwjNFql7KzAtxximpQSv+GmP8KQ=",
+        "lastModified": 1737548421,
+        "narHash": "sha256-gmlqJdC+v86vXc2yMhiza1mvsqh3vMfrEsiw+tV5MXg=",
         "ref": "refs/heads/master",
-        "rev": "9cdab949f44301553e3817cf1f38287ad947e00c",
-        "revCount": 28,
+        "rev": "c5fff78c83959841ac724980a13597dcfa6dc26d",
+        "revCount": 29,
         "type": "git",
         "url": "https://git.dynamicdiscord.de/kalipso/tasklist"
       },

machines/.sops.yaml

@@ -85,7 +85,6 @@ creation_rules:
       - *admin_kalipso_dsktp
       age:
       - *admin_atlan
-
   - path_regex: nextcloud/secrets.yaml$
     key_groups:
     - pgp:
@@ -94,3 +93,10 @@ creation_rules:
       age:
       - *admin_atlan
       - *machine_nextcloud
+  - path_regex: overwatch/secrets.yaml$
+    key_groups:
+    - pgp:
+      - *admin_kalipso
+      - *admin_kalipso_dsktp
+      age:
+      - *admin_atlan

machines/configuration.nix

@@ -1,198 +0,0 @@
-{ self
-, nixpkgs-unstable
-, nixpkgs
-, sops-nix
-, inputs
-, nixos-hardware
-, home-manager
-, ...
-}:
-let
-  nixosSystem = nixpkgs.lib.makeOverridable nixpkgs.lib.nixosSystem;
-  nixosSystemUnstable = nixpkgs-unstable.lib.makeOverridable nixpkgs-unstable.lib.nixosSystem;
-
-  baseModules = [
-    # make flake inputs accessiable in NixOS
-    { _module.args.inputs = inputs; }
-    {
-      imports = [
-        ({ pkgs, ... }: {
-          nix = {
-            extraOptions = ''
-              experimental-features = nix-command flakes
-            '';
-
-            settings = {
-              substituters = [
-                "https://cache.dynamicdiscord.de"
-                "https://cache.nixos.org/"
-              ];
-              trusted-public-keys = [
-                "cache.dynamicdiscord.de:DKueZicqi2NhJJXz9MYgUbiyobMs10fTyHCgAUibRP4="
-              ];
-              trusted-users = [ "root" "@wheel" ];
-            };
-          };
-        })
-
-        sops-nix.nixosModules.sops
-      ];
-    }
-  ];
-  defaultModules = baseModules;
-
-  makeMicroVM = hostName: ipv4Addr: macAddr: modules: [
-    inputs.microvm.nixosModules.microvm
-    {
-      microvm = {
-        hypervisor = "cloud-hypervisor";
-        mem = 2560;
-        shares = [
-          {
-            source = "/nix/store";
-            mountPoint = "/nix/.ro-store";
-            tag = "store";
-            proto = "virtiofs";
-            socket = "store.socket";
-          }
-          {
-            source = "/var/lib/microvms/${hostName}/etc";
-            mountPoint = "/etc";
-            tag = "etc";
-            proto = "virtiofs";
-            socket = "etc.socket";
-          }
-          {
-            source = "/var/lib/microvms/${hostName}/var";
-            mountPoint = "/var";
-            tag = "var";
-            proto = "virtiofs";
-            socket = "var.socket";
-          }
-        ];
-
-        interfaces = [
-          {
-            type = "tap";
-            id = "vm-${hostName}";
-            mac = "${macAddr}";
-          }
-        ];
-      };
-
-      systemd.network.enable = true;
-      
-      systemd.network.networks."20-lan" = {
-        matchConfig.Type = "ether";
-        networkConfig = {
-          Address = [ "${ipv4Addr}/24" ];
-          Gateway = "10.0.0.1";
-          DNS = ["1.1.1.1"];
-          DHCP = "no";
-        };
-      };
-    }
-  ] ++ defaultModules ++ modules;
-
-  inputsMod = inputs // { malobeo = self; };
-in
-{
-  louise = nixosSystem {
-    system = "x86_64-linux";
-    specialArgs.inputs = inputs;
-    modules = defaultModules ++ [
-      ./louise/configuration.nix
-    ];
-  };
-
-  bakunin = nixosSystem {
-    system = "x86_64-linux";
-    specialArgs.inputs = inputs;
-    modules = defaultModules ++ [
-      ./bakunin/configuration.nix
-      inputs.disko.nixosModules.disko
-    ];
-  };
-
-  lucia = nixosSystem {
-    system = "aarch64-linux";
-    specialArgs.inputs = inputs;
-    modules = defaultModules ++ [
-      ./lucia/configuration.nix
-      ./lucia/hardware_configuration.nix
-    ];
-  };
-
-  fanny = nixosSystem {
-    system = "x86_64-linux";
-    specialArgs.inputs = inputsMod;
-    modules = defaultModules ++ [
-      self.nixosModules.malobeo.vpn
-      ./fanny/configuration.nix
-    ];
-  };
-
-  durruti = nixosSystem {
-    system = "x86_64-linux";
-    specialArgs.inputs = inputs;
-    specialArgs.self = self;
-    modules = makeMicroVM "durruti" "10.0.0.5" "52:DA:0D:F9:EF:F9" [
-      ./durruti/configuration.nix
-    ];
-  };
-
-  vpn = nixosSystem {
-    system = "x86_64-linux";
-    specialArgs.inputs = inputs;
-    specialArgs.self = self;
-    modules = makeMicroVM "vpn" "10.0.0.10" "D0:E5:CA:F0:D7:E6" [
-      self.nixosModules.malobeo.vpn
-      ./vpn/configuration.nix
-    ];
-  };
-
-  infradocs = nixosSystem {
-    system = "x86_64-linux";
-    specialArgs.inputs = inputs;
-    specialArgs.self = self;
-    modules = makeMicroVM "infradocs" "10.0.0.11" "D0:E5:CA:F0:D7:E7" [
-      self.nixosModules.malobeo.vpn
-      ./infradocs/configuration.nix
-    ];
-  };
-
-  uptimekuma = nixosSystem {
-    system = "x86_64-linux";
-    specialArgs.inputs = inputs;
-    specialArgs.self = self;
-    modules = makeMicroVM "uptimekuma" "10.0.0.12" "D0:E5:CA:F0:D7:E8" [
-      ./uptimekuma/configuration.nix
-    ];
-  };
-
-  nextcloud = nixosSystem {
-    system = "x86_64-linux";
-    specialArgs.inputs = inputs;
-    specialArgs.self = self;
-    modules = makeMicroVM "nextcloud" "10.0.0.13" "D0:E5:CA:F0:D7:E9" [
-      ./nextcloud/configuration.nix
-    ];
-  };
-
-  overwatch = nixosSystem {
-    system = "x86_64-linux";
-    specialArgs.inputs = inputs;
-    specialArgs.self = self;
-    modules = makeMicroVM "overwatch" "10.0.0.14" "D0:E5:CA:F0:D7:E0" [
-      ./overwatch/configuration.nix
-    ];
-  };
-
-  testvm = nixosSystem {
-    system = "x86_64-linux";
-    specialArgs.inputs = inputs;
-    specialArgs.self = self;
-    modules = defaultModules ++ [ ./testvm ];
-  };
-
-}

machines/durruti/configuration.nix

@@ -1,4 +1,4 @@
-{ config, lib, pkgs, inputs, ... }:
+{ config, self, lib, pkgs, inputs, ... }:
 
 with lib;
 
@@ -17,15 +17,21 @@ with lib;
   ];
 
   imports = [
+    self.nixosModules.malobeo.metrics
     inputs.tasklist.nixosModules.malobeo-tasklist
 
-    ./documentation.nix
-
     ../modules/malobeo_user.nix
     ../modules/sshd.nix
     ../modules/minimal_tools.nix
   ];
 
+  malobeo.metrics = {
+    enable = true;
+    enablePromtail = true;
+    logNginx = true;
+    lokiHost = "10.0.0.14";
+  };
+
   services.malobeo-tasklist.enable = true;
 
   system.stateVersion = "22.11"; # Did you read the comment?

machines/durruti/host_config.nix

@@ -39,7 +39,6 @@ in
       locations."/" = {
         proxyPass = "http://10.0.0.10";
         extraConfig = ''
-          proxy_set_header Host $host;
         '';
       };
     };
@@ -50,7 +49,26 @@ in
       locations."/" = {
         proxyPass = "http://10.0.0.10";
         extraConfig = ''
-          proxy_set_header Host $host;
+        '';
+      };
+    };
+
+    services.nginx.virtualHosts."grafana.malobeo.org" = {
+      forceSSL = true;
+      enableACME= true;
+      locations."/" = {
+        proxyPass = "http://10.0.0.10";
+        extraConfig = ''
+        '';
+      };
+    };
+
+    services.nginx.virtualHosts."tasklist.malobeo.org" = {
+      forceSSL = true;
+      enableACME= true;
+      locations."/" = {
+        proxyPass = "http://10.0.0.10";
+        extraConfig = ''
         '';
       };
     };
@@ -61,15 +79,8 @@ in
       locations."/" = {
         proxyPass = "http://10.0.0.12";
         extraConfig = ''
-          proxy_set_header Host $host;
         '';
       };
     };
-
-    services.nginx.virtualHosts."tasklist.malobeo.org" = {
-      forceSSL = true;
-      enableACME= true;
-      locations."/".proxyPass = "http://${cfg.host_ip}:8080";
-    };
   };
 }

machines/fanny/configuration.nix

@@ -13,11 +13,20 @@ in
       ../modules/sshd.nix
       ../modules/minimal_tools.nix
       ../modules/autoupdate.nix
+      inputs.self.nixosModules.malobeo.vpn
       inputs.self.nixosModules.malobeo.initssh
       inputs.self.nixosModules.malobeo.disko
       inputs.self.nixosModules.malobeo.microvm
+      inputs.self.nixosModules.malobeo.metrics
     ];
 
+  malobeo.metrics = {
+    enable = true;
+    enablePromtail = true;
+    logNginx = true;
+    lokiHost = "10.0.0.14";
+  };
+
   malobeo.autoUpdate = {
     enable = true;
     url = "https://hydra.dynamicdiscord.de";
@@ -60,9 +69,15 @@ in
   };
 
   services.malobeo.microvm.enableHostBridge = true;
-  services.malobeo.microvm.deployHosts = [ "infradocs" "nextcloud" ];
+  services.malobeo.microvm.deployHosts = [ "overwatch" "infradocs" "nextcloud" "durruti" ];
 
   networking = {
+    nat = {
+      enable = true;
+      externalInterface = "enp1s0";
+      internalInterfaces = [ "microvm" ];
+    };
+
     firewall = {
       allowedTCPPorts = [ 80 ];
     };
@@ -87,6 +102,24 @@ in
         '';
       };
     };
+
+    virtualHosts."grafana.malobeo.org" = {
+      locations."/" = {
+        proxyPass = "http://10.0.0.14";
+        extraConfig = ''
+          proxy_set_header Host $host;
+        '';
+      };
+    };
+
+    virtualHosts."tasklist.malobeo.org" = {
+      locations."/" = {
+        proxyPass = "http://10.0.0.5:8080";
+        extraConfig = ''
+          proxy_set_header Host $host;
+        '';
+      };
+    };
   };
 
   services.tor = {

machines/hosts.nix

@@ -0,0 +1,75 @@
+{ ... }:
+
+{
+  malobeo = {
+    hosts = {
+      louise = {
+        type = "host";
+      };
+
+      bakunin = {
+        type = "host";
+      };
+
+      fanny = {
+        type = "host";
+      };
+
+      lucia = {
+        type = "rpi";
+      };
+
+      durruti = {
+        type = "microvm";
+        network = {
+          address = "10.0.0.5";
+          mac = "52:DA:0D:F9:EF:F9";
+        };
+      };
+
+      vpn = {
+        type = "microvm";
+        network = {
+          address = "10.0.0.10";
+          mac = "D0:E5:CA:F0:D7:E6";
+        };
+      };
+
+      infradocs = {
+        type = "microvm";
+        network = {
+          address = "10.0.0.11";
+          mac = "D0:E5:CA:F0:D7:E7";
+        };
+      };
+
+      uptimekuma = {
+        type = "microvm";
+        network = {
+          address = "10.0.0.12";
+          mac = "D0:E5:CA:F0:D7:E8";
+        };
+      };
+
+      nextcloud = {
+        type = "microvm";
+        network = {
+          address = "10.0.0.13";
+          mac = "D0:E5:CA:F0:D7:E9";
+        };
+      };
+
+      overwatch = {
+        type = "microvm";
+        network = {
+          address = "10.0.0.14";
+          mac = "D0:E5:CA:F0:D7:E0";
+        };
+      };
+
+      testvm = {
+        type = "host";
+      };
+    };
+  };
+}

machines/infradocs/configuration.nix

@@ -9,7 +9,7 @@ with lib;
   };
 
   imports = [
-    self.nixosModules.malobeo.metrics
+    inputs.malobeo.nixosModules.malobeo.metrics
     ../durruti/documentation.nix
     ../modules/malobeo_user.nix
     ../modules/sshd.nix

machines/lucia/configuration.nix

@@ -6,6 +6,7 @@ in
 {
   imports =
     [ # Include the results of the hardware scan.
+      ./hardware_configuration.nix
       ../modules/malobeo_user.nix
     ];
 

machines/modules/disko/btrfs-laptop.nix

@@ -1,63 +0,0 @@
-{ config, self, inputs, ... }:
-
-{
-  imports = [
-    inputs.disko.nixosModules.disko
-  ];
-
-  # https://github.com/nix-community/disko/blob/master/example/luks-btrfs-subvolumes.nix
-  disko.devices = {
-    disk = {
-      main = {
-        type = "disk";
-        # When using disko-install, we will overwrite this value from the commandline
-        device = "/dev/disk/by-id/some-disk-id";
-        content = {
-          type = "gpt";
-          partitions = {
-            ESP = {
-              size = "512M";
-              type = "EF00";
-              content = {
-                type = "filesystem";
-                format = "vfat";
-                mountpoint = "/boot";
-                mountOptions = [ "umask=0077" ];
-              };
-            };
-            luks = {
-              size = "100%";
-              content = {
-                type = "luks";
-                name = "crypted";
-                passwordFile = /tmp/secret.key; # Interactive
-                content = {
-                  type = "btrfs";
-                  extraArgs = [ "-f" ];
-                  subvolumes = {
-                    "/root" = {
-                      mountpoint = "/";
-                      mountOptions = [ "compress=zstd" "noatime" ];
-                    };
-                    "/home" = {
-                      mountpoint = "/home";
-                      mountOptions = [ "compress=zstd" "noatime" ];
-                    };
-                    "/nix" = {
-                      mountpoint = "/nix";
-                      mountOptions = [ "compress=zstd" "noatime" ];
-                    };
-                    "/swap" = {
-                      mountpoint = "/.swapvol";
-                      swap.swapfile.size = "20M";
-                    };
-                  };
-                };
-              };
-            };
-          };
-        };
-      };
-    };
-  };
-}

machines/modules/disko/default.nix

@@ -187,6 +187,7 @@ in
               postCreateHook = lib.mkIf cfg.encryption ''
                 zfs set keylocation="prompt" zroot/encrypted;
               '';
+
             };
             "encrypted/root" = {
               type = "zfs_fs";
@@ -244,13 +245,12 @@ in
               };
               # use this to read the key during boot
               postCreateHook = lib.mkIf cfg.encryption ''
-                zfs set keylocation="prompt" storage/encrypted;
+                zfs set keylocation="file:///root/secret.key" storage/encrypted;
               '';
             };
             "encrypted/data" = {
               type = "zfs_fs";
               mountpoint = "/data";
-              options.mountpoint = "legacy";
             };
             reserved = {
               # for cow delete if pool is full
@@ -267,7 +267,7 @@ in
     };
 
     boot.zfs.devNodes = lib.mkDefault cfg.devNodes;
-
+    boot.zfs.extraPools = lib.mkIf cfg.storage.enable [ "storage" ];
     fileSystems."/".neededForBoot = true;
     fileSystems."/etc".neededForBoot = true;
     fileSystems."/boot".neededForBoot = true;

machines/modules/host_builder.nix

@@ -0,0 +1,243 @@
+{ self
+, nixpkgs-unstable
+, nixpkgs
+, sops-nix
+, inputs
+, hosts
+, ...
+}:
+let
+  pkgs = nixpkgs.legacyPackages."x86_64-linux";
+in
+rec {
+  nixosSystem = nixpkgs.lib.makeOverridable nixpkgs.lib.nixosSystem;
+  nixosSystemUnstable = nixpkgs-unstable.lib.makeOverridable nixpkgs-unstable.lib.nixosSystem;
+
+  baseModules = [
+    # make flake inputs accessiable in NixOS
+    { _module.args.inputs = inputs; }
+    {
+      imports = [
+        ({ pkgs, ... }: {
+          nix = {
+            extraOptions = ''
+              experimental-features = nix-command flakes
+            '';
+
+            settings = {
+              substituters = [
+                "https://cache.dynamicdiscord.de"
+                "https://cache.nixos.org/"
+              ];
+              trusted-public-keys = [
+                "cache.dynamicdiscord.de:DKueZicqi2NhJJXz9MYgUbiyobMs10fTyHCgAUibRP4="
+              ];
+              trusted-users = [ "root" "@wheel" ];
+            };
+          };
+        })
+
+        sops-nix.nixosModules.sops
+      ];
+    }
+  ];
+  defaultModules = baseModules;
+
+  makeMicroVM = hostName: ipv4Addr: macAddr: modules: [
+    {
+      microvm = {
+        hypervisor = "cloud-hypervisor";
+        mem = 2560;
+        shares = [
+          {
+            source = "/nix/store";
+            mountPoint = "/nix/.ro-store";
+            tag = "store";
+            proto = "virtiofs";
+            socket = "store.socket";
+          }
+          {
+            source = "/var/lib/microvms/${hostName}/etc";
+            mountPoint = "/etc";
+            tag = "etc";
+            proto = "virtiofs";
+            socket = "etc.socket";
+          }
+          {
+            source = "/var/lib/microvms/${hostName}/var";
+            mountPoint = "/var";
+            tag = "var";
+            proto = "virtiofs";
+            socket = "var.socket";
+          }
+        ];
+
+        interfaces = [
+          {
+            type = "tap";
+            id = "vm-${hostName}";
+            mac = "${macAddr}";
+          }
+        ];
+      };
+
+      systemd.network.enable = true;
+      
+      systemd.network.networks."20-lan" = {
+        matchConfig.Type = "ether";
+        networkConfig = {
+          Address = [ "${ipv4Addr}/24" ];
+          Gateway = "10.0.0.1";
+          DNS = ["1.1.1.1"];
+          DHCP = "no";
+        };
+      };
+    }
+  ] ++ defaultModules ++ modules;
+
+  inputsMod = inputs // { malobeo = self; };
+
+
+    vmMicroVMOverwrites = hostname: options: {
+      microvm = rec {
+        mem = pkgs.lib.mkForce 4096;
+        hypervisor = pkgs.lib.mkForce "qemu";
+        socket = pkgs.lib.mkForce null;
+
+
+        #needed for hosts that deploy imperative microvms (for example fanny)
+        writableStoreOverlay = pkgs.lib.mkIf options.writableStore "/nix/.rw-store";
+        volumes = pkgs.lib.mkIf options.writableStore [ {
+          image = "nix-store-overlay.img";
+          mountPoint = writableStoreOverlay;
+          size = 2048;
+        } ];
+
+        shares = pkgs.lib.mkForce (pkgs.lib.optionals (!options.writableStore) [
+          {
+            tag = "ro-store";
+            source = "/nix/store";
+            mountPoint = "/nix/.ro-store";
+          }
+        ] ++ pkgs.lib.optionals (options.varPath != "") [
+          {
+            source = "${options.varPath}";
+            securityModel = "mapped";
+            mountPoint = "/var";
+            tag = "var";
+          }
+        ]);
+
+        interfaces = pkgs.lib.mkIf (!options.withNetworking) (pkgs.lib.mkForce [{
+          type = "user";
+          id = "eth0";
+          mac = "02:23:de:ad:be:ef";
+        }]);
+
+        #if networking is disabled forward port 80 to still have access to webservices
+        forwardPorts = pkgs.lib.mkIf (!options.withNetworking && options.fwdPort != 0) (pkgs.lib.mkForce [
+          { from = "host"; host.port = options.fwdPort; guest.port = 80; }
+        ]);
+
+      };
+
+      fileSystems = {
+        "/".fsType = pkgs.lib.mkForce "tmpfs";
+
+        # prometheus uses a memory mapped file which doesnt seem supported by 9p shares
+        # therefore we mount a tmpfs inside the datadir
+        "/var/lib/prometheus2/data" = pkgs.lib.mkIf (hostname == "overwatch" && options.varPath != "") (pkgs.lib.mkForce {
+          fsType = pkgs.lib.mkForce "tmpfs";
+        });
+      };
+
+      boot.isContainer = pkgs.lib.mkForce false;
+      services.timesyncd.enable = false;
+      users.users.root.password = "";
+      services.getty.helpLine = ''
+        Log in as "root" with an empty password.
+        Use "reboot" to shut qemu down.
+      '';
+    };
+
+    vmDiskoOverwrites = {
+      boot.initrd = {
+        secrets = pkgs.lib.mkForce {};
+        network.ssh.enable = pkgs.lib.mkForce false;
+      };
+
+      malobeo.disks.enable = pkgs.lib.mkForce false;
+      networking.hostId = "a3c3101f";
+    };
+
+    vmSopsOverwrites = host: {
+      sops.defaultSopsFile = pkgs.lib.mkForce ../${host}/dummy.yaml;
+
+      environment.etc = {
+        devHostKey = {
+          source = ../secrets/devkey_ed25519;
+          mode = "0600";
+        };
+      };
+
+      services.openssh.hostKeys = [{
+        path = "/etc/devHostKey";
+        type = "ed25519";
+      }];
+    };
+
+    vmNestedMicroVMOverwrites = host: sopsDummy: {
+
+      services.malobeo.microvm.deployHosts = pkgs.lib.mkForce [];
+      microvm.vms = 
+      let
+        # Map the values to each hostname to then generate an Attrset using listToAttrs
+        mapperFunc = name: { inherit name; value = {
+          specialArgs.inputs = inputsMod;
+          specialArgs.self = self;
+          config = {
+            imports = (makeMicroVM "${name}" 
+                                   "${hosts.malobeo.hosts.${name}.network.address}"
+                                   "${hosts.malobeo.hosts.${name}.network.mac}" [
+              ../${name}/configuration.nix     
+              (vmMicroVMOverwrites name { 
+                withNetworking = true; 
+                varPath = ""; 
+                writableStore = false; })
+              (if sopsDummy then (vmSopsOverwrites name) else {})
+            ]);
+          };
+        }; };
+      in
+      builtins.listToAttrs (map mapperFunc self.nixosConfigurations.${host}.config.services.malobeo.microvm.deployHosts);
+    };
+
+    buildVM = host: networking: sopsDummy: disableDisko: varPath: writableStore: fwdPort: (self.nixosConfigurations.${host}.extendModules {
+        modules = [
+            (vmMicroVMOverwrites host { 
+              withNetworking = networking; 
+              varPath = "${varPath}"; 
+              writableStore = writableStore;
+              fwdPort = fwdPort; })
+            (if sopsDummy then (vmSopsOverwrites host) else {})
+            (if disableDisko then vmDiskoOverwrites else {})
+          ] ++ pkgs.lib.optionals (hosts.malobeo.hosts.${host}.type != "microvm") [
+            inputs.microvm.nixosModules.microvm
+          ] ++ pkgs.lib.optionals (self.nixosConfigurations.${host}.config ? services.malobeo.microvm.deployHosts) [
+            (vmNestedMicroVMOverwrites host sopsDummy)
+        ];
+      });
+
+  buildHost = hosts: (builtins.mapAttrs (host: settings: nixosSystem {
+    system = if (settings.type == "rpi") then "aarch64-linux" else "x86_64-linux";
+    specialArgs.inputs = inputsMod;
+    specialArgs.self = self;
+    modules = (if (settings.type != "microvm") then
+      defaultModules ++ [ ../${host}/configuration.nix ]
+      else
+      makeMicroVM "${host}" "${settings.network.address}" "${settings.network.mac}" [
+        inputs.microvm.nixosModules.microvm
+        ../${host}/configuration.nix
+      ]);
+  }) hosts);
+}

machines/modules/malobeo/initssh.nix

@@ -30,9 +30,7 @@ in
       loader.efi.canTouchEfiVariables = true;
       supportedFilesystems = [ "vfat" "zfs" ];
       zfs = {
-        forceImportAll = true;
         requestEncryptionCredentials = true;
-        
       };
       initrd = {
         availableKernelModules = cfg.ethernetDrivers;

machines/nextcloud/configuration.nix

@@ -1,4 +1,4 @@
-{ config, lib, pkgs,  ... }:
+{ config, self, lib, pkgs,  ... }:
 
 with lib;
 
@@ -17,12 +17,20 @@ with lib;
   };
 
   imports = [
+    self.nixosModules.malobeo.metrics
     ../modules/malobeo_user.nix
     ../modules/sshd.nix
     ../modules/minimal_tools.nix
     ../modules/autoupdate.nix
   ];
 
+  malobeo.metrics = {
+    enable = true;
+    enablePromtail = true;
+    logNginx = true;
+    lokiHost = "10.0.0.14";
+  };
+
   services.nextcloud = {
     enable = true;
     package = pkgs.nextcloud30;
@@ -38,7 +46,7 @@ with lib;
     };
     extraAppsEnable = true;
     extraApps = {
-      inherit (config.services.nextcloud.package.packages.apps) contacts calendar;
+      inherit (config.services.nextcloud.package.packages.apps) contacts calendar deck polls;
       collectives = pkgs.fetchNextcloudApp {
         sha256 = "sha256-cj/8FhzxOACJaUEu0eG9r7iAQmnOG62yFHeyUICalFY=";
         url = "https://github.com/nextcloud/collectives/releases/download/v2.15.2/collectives-2.15.2.tar.gz";

machines/overwatch/configuration.nix

@@ -25,9 +25,11 @@ with lib;
 
   services.grafana = {
     enable = true;
-    domain = "grafana.malobeo.org";
-    port = 2342;
-    addr = "127.0.0.1";
+    settings.server = {
+      domain = "grafana.malobeo.org";
+      http_port = 2342;
+      http_addr = "127.0.0.1";
+    };
 
     provision.datasources.settings = {
       apiVersion = 1;
@@ -87,24 +89,30 @@ with lib;
           targets = [ "127.0.0.1:9002" ];
         }];
       }
-      #{
-      #  job_name = "durruti";
-      #  static_configs = [{
-      #    targets = [ "10.0.0.5:9002" ];
-      #  }];
-      #}
+      {
+        job_name = "durruti";
+        static_configs = [{
+          targets = [ "10.0.0.5:9002" ];
+        }];
+      }
       {
         job_name = "infradocs";
         static_configs = [{
           targets = [ "10.0.0.11:9002" ];
         }];
       }
-      #{
-      #  job_name = "nextcloud";
-      #  static_configs = [{
-      #    targets = [ "10.0.0.13:9002" ];
-      #  }];
-      #}
+      {
+        job_name = "nextcloud";
+        static_configs = [{
+          targets = [ "10.0.0.13:9002" ];
+        }];
+      }
+      {
+        job_name = "fanny";
+        static_configs = [{
+          targets = [ "10.0.0.1:9002" ];
+        }];
+      }
       # add vpn - check how to reach it first. most probably 10.100.0.1
     ];
   };

machines/overwatch/loki.yaml

@@ -3,7 +3,7 @@ auth_enabled: false
 server:
   http_listen_port: 3100
   grpc_listen_port: 9096
-  log_level: debug
+  log_level: info
   grpc_server_max_concurrent_streams: 1000
 
 common:

machines/overwatch/secrets.yaml

@@ -0,0 +1,59 @@
+grafana_admin: ENC[AES256_GCM,data:c+ZnOyxSXrG4eiK8ETKHheadiSz98LLHYwxb,iv:Ut2qFD2p6OmKDWjLMjFxyISxzTdJpZpgIB7obW5bgkY=,tag:HdayzjXQ1Zc7w9ITLzKLxA==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxN1VURXJuMENJV1Z2eEtS
+            bUR2cTNmNUdhU1B4SHZNMW9KRDV2dW5VNmlNCjdmYXpZb05mMEdPdjN4c0VWOUhV
+            RW4vV05CMno1MmJmYzdESjN5MFVFcjQKLS0tIDNxTE1KaW1EVGhtOEQwWXZndk53
+            bFBCMExGdEdMb2Z0TzF0Yk02MUpkN0kKIUm9iUvU/xu1Xl6yoYSVGcIXKnGsp/D/
+            RjVQ7tgJIbrupubny/fg4v2sz5HOs5uzmEq4ZKgBWrBeMPss4gYstA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-01-22T00:51:32Z"
+    mac: ENC[AES256_GCM,data:TEEyPmVxIJxC49hDqDbwzTZZ/tNymFr0dMvWn6DRli70Kp5XXNCLTpicAbiFh3WoyzbDpN/5c2yxVNGjhB8nXgKpCZdffdONMY6eSCpPbblYwJS7hNsjW+u2wysSFPDAk5apwbNXJcKnlI1tBcGQRHlym9ShSw6fT7K7afWYWqo=,iv:583DWNug8yNF/vZZN4btT6P1yUa0b1UN4frvAX4UKv0=,tag:YI5KIAe5P5Bx0TZU4wG8ag==,type:str]
+    pgp:
+        - created_at: "2025-01-22T00:51:09Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQGMA5HdvEwzh/H7AQv+PxajhJgXHcxwJ7Mk0gjqFV0dGmNJ1m0eY3gPyIS38GSB
+            Rjto1zUd6EARu1GnxSrVrSZYlQaL6x3l2DuFIP7mtymvlFrmhiAoDz/si0zlzsJp
+            WZyQZdepnt9FyYJAwTzbmfVdpZDYajuMI38byMJqzUhS7SEOsPwiU1KRoTHcf4se
+            2E+9v8OwTVT2UoDxyiVJuDAA+K+Jh2RjHk3p/uVnZDqqQpI9UAI8LrCpun9uALpH
+            +29wyhkCZ9RIHU7nDQNVvwHkbYCyRUwR44bciSwITpjp7GuZCcZvzSSimPktkC9q
+            VZkHA6rHgHgcu6mnMfpP0+j4gB0dU0t4hGF41klV3YpEGfYcFIsKV10lfa6aMNmW
+            08RuLdCtnQyplYhgBm1zQvYHJsIuwK9s1B2dz3Z8l3o2eg8AqFuIL+MlZOvf5A/2
+            MOXffyXbOM5Dhy7DdUckTOYYfwWe1mStw3vx3I3mAFzuOOR7HQuzlc9Bf1oxh36T
+            6e/qOijjPPqkLeR2mufo0lgBBFTQFt2jVvMo1lrCB8Amj4yj/4noXTzglkYTYBKs
+            S513kUdhAGtWoNrqcItOYAn/gl+CPGY2Op3tJBVCWM6aT/KO6M/LPJ7wiQk2zlOL
+            pp7SnCKvv9eQ
+            =N+uj
+            -----END PGP MESSAGE-----
+          fp: c4639370c41133a738f643a591ddbc4c3387f1fb
+        - created_at: "2025-01-22T00:51:09Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA98TrrsQEbXUAQ//fm/TcxgsAMY6P8jvOQMcRBmjjVwfLP1UTTnkRUa36Mmn
+            2V9619zsH1dzTp0gUVV8mvIKUtpz2nCBTZBJw803wW9KorxW6f4e3+mIWelZT5WM
+            sLcQPFWAYKDVnSfk5j8kRSmpM6k2xFRB9DTEMIyFH9PZL99Fztp2hjTn553YTQOo
+            pdw+AMzgptYQghW/Pl/32wXHwCO+bL8tyk62VIQO13l3tX83oSslXNkFzNQYt3jv
+            xXFUaQEGD/1lFLeFnIuJZzfjWt6n0fShJboUcuk/ZIcYdwrbG0pyLLoBoObSRQtG
+            t+7VpWpfl3rnk822SU9z9YcaMNy9HD3Kz9Qh0BRQiN3scCMzm1LyzlXLqlc/gPiq
+            JyCxy98vJXIxmlLQZpDFfTMe3xsc8jSsHI6av+wEFKGEJAOUkDtRYvLfZdgDTfiB
+            XTAhQ3ixnlBxdZZ9DjBXyVfM8q9iB8bggFi7g2SjO32LKhXRFUqZR+avddCyKR/V
+            hRpWjDRn+eX2tl7LPawvX6tIow3aZiezkMVyeRXfcZCvpicq64b80LrYR+JJUfJE
+            vxHaekKImrdJ9ocii0wW91ZmESJwL6m5lt3ZsCY5GTlEDt4wBse5uhj48mtuK8sh
+            g8uQMKp7SiiCtV5a6O1SQLDJeAt6VCcRyudLToO9S4gwrGXNPcGxsHj07XAN2PHS
+            WAE6wUhufXfpa8UgSWy7fmEZt4L03XlRfC7bm/ycwaFww3A7w4+B1gkW6gOon6sy
+            nOyIxUZfU6abZWKzH+OIuViKH7xPiULDy75gEmkRHjKu5BiC3Tx0eO4=
+            =+PPr
+            -----END PGP MESSAGE-----
+          fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4
+    unencrypted_suffix: _unencrypted
+    version: 3.9.2

machines/testvm/configuration.nix

@@ -24,7 +24,7 @@ in
 
   malobeo.disks = {
     enable = true;
-    encryption = false;
+    encryption = true;
     hostId = "83abc8cb";
     devNodes = "/dev/disk/by-path/";
     root = {

machines/vpn/configuration.nix

@@ -17,6 +17,7 @@ with lib;
   };
 
   imports = [
+    inputs.self.nixosModules.malobeo.vpn
     ../modules/malobeo_user.nix
     ../modules/sshd.nix
     ../modules/minimal_tools.nix
@@ -47,6 +48,24 @@ with lib;
         '';
       };
     };
+
+    virtualHosts."grafana.malobeo.org" = {
+      locations."/" = {
+        proxyPass = "http://10.100.0.101";
+        extraConfig = ''
+          proxy_set_header Host $host;
+        '';
+      };
+    };
+
+    virtualHosts."tasklist.malobeo.org" = {
+      locations."/" = {
+        proxyPass = "http://10.100.0.101";
+        extraConfig = ''
+          proxy_set_header Host $host;
+        '';
+      };
+    };
   };
 
   system.stateVersion = "22.11"; # Did you read the comment?

outputs.nix

@@ -15,86 +15,8 @@ in (utils.lib.eachSystem (builtins.filter filter_system utils.lib.defaultSystems
     pkgs-unstable = nixpkgs-unstable.legacyPackages."${system}";
     pkgs = nixpkgs.legacyPackages."${system}";
 
-    vmMicroVMOverwrites = hostname: options: {
-      microvm = {
-        mem = pkgs.lib.mkForce 4096;
-        hypervisor = pkgs.lib.mkForce "qemu";
-        socket = pkgs.lib.mkForce null;
-        shares = pkgs.lib.mkForce ([
-          {
-            tag = "ro-store";
-            source = "/nix/store";
-            mountPoint = "/nix/.ro-store";
-          }
-        ] ++ pkgs.lib.optionals (options.varPath != "") [
-          {
-            source = "${options.varPath}";
-            securityModel = "mapped";
-            mountPoint = "/var";
-            tag = "var";
-          }
-        ]);
-        interfaces = pkgs.lib.mkIf (!options.withNetworking) (pkgs.lib.mkForce [{
-          type = "user";
-          id = "eth0";
-          mac = "02:23:de:ad:be:ef";
-        }]);
-      };
-
-      fileSystems = {
-        "/".fsType = pkgs.lib.mkForce "tmpfs";
-
-        # prometheus uses a memory mapped file which doesnt seem supported by 9p shares
-        # therefore we mount a tmpfs inside the datadir
-        "/var/lib/prometheus2/data" = pkgs.lib.mkIf (hostname == "overwatch" && options.varPath != "") (pkgs.lib.mkForce {
-          fsType = pkgs.lib.mkForce "tmpfs";
-        });
-      };
-
-      boot.isContainer = pkgs.lib.mkForce false;
-      services.timesyncd.enable = false;
-      users.users.root.password = "";
-      services.getty.helpLine = ''
-        Log in as "root" with an empty password.
-        Use "reboot" to shut qemu down.
-      '';
-    };
-
-    vmDiskoOverwrites = {
-      boot.initrd = {
-        secrets = pkgs.lib.mkForce {};
-        network.ssh.enable = pkgs.lib.mkForce false;
-      };
-
-      malobeo.disks.enable = pkgs.lib.mkForce false;
-      networking.hostId = "a3c3101f";
-    };
-
-    vmSopsOverwrites = host: {
-      sops.defaultSopsFile = pkgs.lib.mkForce ./machines/${host}/dummy.yaml;
-
-      environment.etc = {
-        devHostKey = {
-          source = ./machines/secrets/devkey_ed25519;
-          mode = "0600";
-        };
-      };
-
-      services.openssh.hostKeys = [{
-        path = "/etc/devHostKey";
-        type = "ed25519";
-      }];
-    };
-
-    buildVM = host: networking: sopsDummy: disableDisko: varPath: (self.nixosConfigurations.${host}.extendModules {
-        modules = [
-          (vmMicroVMOverwrites host { withNetworking = networking; varPath = "${varPath}"; })
-          (if sopsDummy then (vmSopsOverwrites host) else {})
-          (if disableDisko then vmDiskoOverwrites else {})
-        ] ++ pkgs.lib.optionals (! self.nixosConfigurations.${host}.config ? microvm) [
-          microvm.nixosModules.microvm
-        ];
-      }).config.microvm.declaredRunner;
+    hosts = import ./machines/hosts.nix ( inputs // { inherit inputs; self = self; });
+    utils = import ./machines/modules/host_builder.nix ( inputs // { inherit inputs; self = self; hosts = hosts; });
   in
   {
     devShells.default =
@@ -130,7 +52,7 @@ in (utils.lib.eachSystem (builtins.filter filter_system utils.lib.defaultSystems
       scripts.run-vm = self.packages.${system}.run-vm;
     };
 
-    vmBuilder = buildVM;
+    vmBuilder = utils.buildVM;
 
     packages = {
       docs = pkgs.stdenv.mkDerivation {
@@ -150,60 +72,7 @@ in (utils.lib.eachSystem (builtins.filter filter_system utils.lib.defaultSystems
         '';
       };
 
-      run-vm = pkgs.writeShellScriptBin "run-vm" ''
-        usage() {
-            echo "Usage: run-vm <hostname> [--networking] [--dummy-secrets] [--no-disko]"
-            echo "ATTENTION: This script must be run from the flakes root directory"
-            echo "--networking setup interfaces. requires root and hostbridge enabled on the host"
-            echo "--dummy-secrets run vm with dummy sops secrets"
-            echo "--no-disko disable disko and initrd secrets. needed for real hosts like fanny"
-            echo "--var path to directory that should be shared as /var. may require root otherwise some systemd units fail within vm. if dir is empty vm will populate"
-            exit 1
-        }
-        
-        # check at least one arg was given
-        if [ "$#" -lt 1 ]; then
-            usage
-        fi
-        
-        HOSTNAME=$1
-        
-        # Optionale Argumente
-        NETWORK=false
-        DUMMY_SECRETS=false
-        NO_DISKO=false
-        VAR_PATH=""
-        
-        # check argws
-        shift
-        while [[ "$#" -gt 0 ]]; do
-            case $1 in
-                --networking) NETWORK=true ;;
-                --dummy-secrets) DUMMY_SECRETS=true ;;
-                --no-disko) NO_DISKO=true ;;
-                --var) 
-                  if [[ -n "$2" && ! "$2" =~ ^- ]]; then
-                      VAR_PATH="$2"
-                      shift
-                  else
-                      echo "Error: --var requires a non-empty string argument."
-                      usage
-                  fi
-                  ;;
-                *) echo "Unknown argument: $1"; usage ;;
-            esac
-            shift
-        done
-        echo "starting host $HOSTNAME"
-        echo "enable networking: $NETWORK"
-        echo "deploy dummy secrets: $DUMMY_SECRETS"
-        echo "disable disko and initrd secrets: $NO_DISKO"
-        if [ -n "$VAR_PATH" ]; then
-          echo "sharing var directory: $VAR_PATH"
-        fi
-        
-        ${pkgs.nix}/bin/nix run --show-trace --impure --expr "((builtins.getFlake \"$(pwd)\").vmBuilder.x86_64-linux \"$HOSTNAME\" $NETWORK $DUMMY_SECRETS $NO_DISKO \"$VAR_PATH\")"
-      '';
+      run-vm = pkgs.writeShellScriptBin "run-vm"  (builtins.readFile ./scripts/run-vm.sh);
     };
 
     apps = {
@@ -229,11 +98,13 @@ in (utils.lib.eachSystem (builtins.filter filter_system utils.lib.defaultSystems
       };
     };
 
-  })) // {
-    nixosConfigurations = import ./machines/configuration.nix (inputs // {
-      inherit inputs;
-      self = self;
-    });
+  })) // (
+  let
+    hosts = import ./machines/hosts.nix ( inputs // { inherit inputs; self = self; });
+    utils = import ./machines/modules/host_builder.nix ( inputs // { inherit inputs; self = self; hosts = hosts; });
+  in
+  {
+    nixosConfigurations = utils.buildHost hosts.malobeo.hosts;
 
     nixosModules.malobeo = {
       host.imports = [ ./machines/durruti/host_config.nix ];
@@ -255,4 +126,4 @@ in (utils.lib.eachSystem (builtins.filter filter_system utils.lib.defaultSystems
       nixpkgs.lib.mapAttrs getBuildEntry self.nixosConfigurations
 
       );
-}
+})

scripts/remote-install-encrypt.sh

@@ -37,9 +37,11 @@ trap cleanup EXIT
 
 # Create the directory where sshd expects to find the host keys
 install -d -m755 "$temp/etc/ssh/"
+install -d -m755 "$temp/root/"
 
 diskKey=$(sops -d machines/$hostname/disk.key)
 echo "$diskKey" > /tmp/secret.key
+echo "$diskKey" > $temp/root/secret.key
 
 ssh-keygen -f $temp/etc/ssh/"$hostname" -t ed25519 -N ""
 ssh-keygen -f $temp/etc/ssh/initrd -t ed25519 -N ""

scripts/run-vm.sh

@@ -0,0 +1,67 @@
+usage() {
+    echo "Usage: run-vm <hostname> [--networking] [--dummy-secrets] [--no-disko]"
+    echo "ATTENTION: This script must be run from the flakes root directory"
+    echo "--networking setup interfaces. requires root and hostbridge enabled on the host"
+    echo "--dummy-secrets run vm with dummy sops secrets"
+    echo "--no-disko disable disko and initrd secrets. needed for real hosts like fanny"
+    echo "--writable-store enables writable store. necessary for host with nested imperative microvms like fanny"
+    echo "--var path to directory that should be shared as /var. may require root otherwise some systemd units fail within vm. if dir is empty vm will populate"
+    echo "--fwd-port forwards the given port to port 80 on vm"
+    exit 1
+}
+
+# check at least one arg was given
+if [ "$#" -lt 1 ]; then
+    usage
+fi
+
+HOSTNAME=$1
+
+# Optionale Argumente
+NETWORK=false
+DUMMY_SECRETS=false
+NO_DISKO=false
+RW_STORE=false
+VAR_PATH=""
+FWD_PORT=0
+
+# check argws
+shift
+while [[ "$#" -gt 0 ]]; do
+    case $1 in
+        --networking) NETWORK=true ;;
+        --dummy-secrets) DUMMY_SECRETS=true ;;
+        --no-disko) NO_DISKO=true ;;
+        --writable-store) RW_STORE=true ;;
+        --var) 
+          if [[ -n "$2" && ! "$2" =~ ^- ]]; then
+              VAR_PATH="$2"
+              shift
+          else
+              echo "Error: --var requires a non-empty string argument."
+              usage
+          fi
+          ;;
+        --fwd-port) 
+          if [[ -n "$2" && ! "$2" =~ ^- ]]; then
+              FWD_PORT="$2"
+              shift
+          else
+              echo "Error: --var requires a non-empty string argument."
+              usage
+          fi
+          ;;
+        *) echo "Unknown argument: $1"; usage ;;
+    esac
+    shift
+done
+echo "starting host $HOSTNAME"
+echo "enable networking: $NETWORK"
+echo "deploy dummy secrets: $DUMMY_SECRETS"
+echo "disable disko and initrd secrets: $NO_DISKO"
+echo "use writable store: $RW_STORE"
+if [ -n "$VAR_PATH" ]; then
+  echo "sharing var directory: $VAR_PATH"
+fi
+
+nix run --show-trace --impure --expr "((builtins.getFlake \"$(pwd)\").vmBuilder.x86_64-linux \"$HOSTNAME\" $NETWORK $DUMMY_SECRETS $NO_DISKO \"$VAR_PATH\" $RW_STORE $FWD_PORT).config.microvm.declaredRunner"

scripts/unlock-boot.sh

@@ -23,16 +23,12 @@ echo
 if [ $# = 1 ]
     then
     diskkey=$(sops -d machines/$HOSTNAME/disk.key)
-    echo "$diskkey" | ssh $sshoptions root@$HOSTNAME-initrd "systemd-tty-ask-password-agent" #storage
-
     echo "$diskkey" | ssh $sshoptions root@$HOSTNAME-initrd "systemd-tty-ask-password-agent" #root
 
 elif [ $# = 2 ]
     then
     diskkey=$(sops -d machines/$HOSTNAME/disk.key)
     IP=$2
-    echo "$diskkey" | ssh $sshoptions root@$IP "systemd-tty-ask-password-agent" #storage
-
     echo "$diskkey" | ssh $sshoptions root@$IP "systemd-tty-ask-password-agent" #root
     
 else