Configure fanny for disk and initssh module

2025-01-05 20:38:38 +01:00
20 changed files with 37 additions and 364 deletions
--- a/.gitea/workflows/eval-hydra-jobs.yml
+++ b/.gitea/workflows/eval-hydra-jobs.yml
@@ -1,8 +1,9 @@
-name: "Check flake syntax"
+name: "Evaluate Hydra Jobs"
 on:
+  pull_request:
  push:
 jobs:
-  flake-check:
+  eval-hydra-jobs:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
@@ -10,5 +11,5 @@ jobs:
      run: |
        apt update -y
        apt install sudo -y        
-    - uses: cachix/install-nix-action@v30
-    - run: nix flake check --no-update-lock-file --accept-flake-config .
+    - uses: cachix/install-nix-action@v27
+    - run: nix eval --no-update-lock-file --accept-flake-config .\#hydraJobs
--- a/doc/src/anleitung/sops.md
+++ b/doc/src/anleitung/sops.md
@@ -22,14 +22,4 @@

 - Write `- *admin_$USER` under the apropriate `key_grups:` of the secrets the user should have access to

- `cd machines/` and reencrypt existing secrets for the new key with `sops updatekeys $path/to/secrets.yaml`
-
-## How to add host keys
-If a new host is created we have to add its age keys to the sops config.
-Do the following:
-```bash
-# ssh into the host and run:
-nix-shell -p ssh-to-age --run 'cat /etc/ssh/ssh_host_ed25519_key.pub | ssh-to-age'
-# create new host with the output of that command in /machines/.sops.yaml
-```
-
+- `cd machines/` and reencrypt existing secrets for the new key with `sops updatekeys $path/to/secrets.yaml`
--- a/flake.lock
+++ b/flake.lock
@@ -341,11 +341,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1736184101,
-        "narHash": "sha256-HAX+TkDXzyNp6SAsKwjNFql7KzAtxximpQSv+GmP8KQ=",
+        "lastModified": 1729717517,
+        "narHash": "sha256-Gul0Zqy0amouh8Hs8BL/DIKFYD6BmdTo4H8+5K5+mTo=",
        "ref": "refs/heads/master",
-        "rev": "9cdab949f44301553e3817cf1f38287ad947e00c",
-        "revCount": 28,
+        "rev": "610269a14232c2888289464feb5227e284eef336",
+        "revCount": 27,
        "type": "git",
        "url": "https://git.dynamicdiscord.de/kalipso/tasklist"
      },
--- a/machines/.sops.yaml
+++ b/machines/.sops.yaml
@@ -10,7 +10,6 @@ keys:
  - &machine_lucia 3474196f3adf27cfb70f8f56bcd52d1ed55033db
  - &machine_durruti age1xu6kxpf8p0r8d6sgyl0m20p5hmw35nserl7rejuzm66eql0ur4mq03u0vp
  - &machine_vpn age1v6uxwej4nlrpfanr9js7x6059mtvyg4fw50pzt0a2kt3ahk7edlslafeuh
-  - &machine_fanny age14dpm6vaycd6u34dkndcktpamqgdyj4aqccjnl5533dsza05hxuds0tjfnf
 creation_rules:
  - path_regex: moderatio/secrets/secrets.yaml$
    key_groups:
@@ -44,14 +43,6 @@ creation_rules:
      age:
      - *machine_vpn
      - *admin_atlan
-  - path_regex: fanny/secrets.yaml$
-    key_groups:
-    - pgp:
-      - *admin_kalipso
-      - *admin_kalipso_dsktp
-      age:
-      - *machine_fanny
-      - *admin_atlan
  - path_regex: testvm/disk.key
    key_groups:
    - pgp:
@@ -66,10 +57,3 @@ creation_rules:
      - *admin_kalipso_dsktp
      age:
      - *admin_atlan
-  - path_regex: bakunin/disk.key
-    key_groups:
-    - pgp:
-      - *admin_kalipso
-      - *admin_kalipso_dsktp
-      age:
-      - *admin_atlan
--- a/machines/bakunin/configuration.nix
+++ b/machines/bakunin/configuration.nix
@@ -1,8 +1,5 @@
-{ config, pkgs, inputs, ... }:
+{ config, pkgs, ... }:

-let
-  sshKeys = import ../ssh_keys.nix;
-in
 {
  imports =
    [ # Include the results of the hardware scan.
@@ -12,8 +9,6 @@ in
      ../modules/sshd.nix
      ../modules/minimal_tools.nix
      ../modules/autoupdate.nix
-      inputs.self.nixosModules.malobeo.disko
-      inputs.self.nixosModules.malobeo.initssh
    ];

  malobeo.autoUpdate = {
@@ -24,19 +19,7 @@ in
    cacheurl = "https://cache.dynamicdiscord.de";
  };

-  malobeo.disks = {
-    enable = true;
-    hostId = "a3c3102f";
-    root = {
-      disk0 = "disk/by-id/ata-HITACHI_HTS725016A9A364_110308PCKB04VNHX9XTJ";
-    };
-  };
-
-  malobeo.initssh = {
-    enable = true;
-    authorizedKeys = sshKeys.admins;
-    ethernetDrivers = ["r8169"];
-  };
+  boot.loader.systemd-boot.enable = true;

  hardware.sane.enable = true; #scanner support

--- a/machines/bakunin/disk.key
+++ b/machines/bakunin/disk.key
@@ -1,31 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:2/tfkG7SwWNpnqgkFkmUqbAJBF2eN/lfZCK/9VsZag==,iv:Sps+ZIQGveS/zumjVE8VFfVTlNwQJ093eMDndlne2nU=,tag:lW8xcz43jj1XPV6M/0e11g==,type:str]",
-	"sops": {
-		"kms": null,
-		"gcp_kms": null,
-		"azure_kv": null,
-		"hc_vault": null,
-		"age": [
-			{
-				"recipient": "age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRU003cys0d0d4MXFmVVVH\ndDg1eHZpVjFMeDBGL3JQcjB5a0luSVRaSWtnCmxNOEUyZ2oybkNLdm12ZTVmNUpo\nVCtUem44bXA2dGhURGdyRWxKdUF6OVkKLS0tIDdVbUt2eGVHMHBzOEt6QnRpOXZF\nVWFEUFloRXpIUGJxblpaNUNuTjlLbDQKQii2qUIl72d02D3P0oTDHZQT1srSk6jS\n89XSBy6ND9vP0tGXcZ4a7jghO0Q1OVNe1fm6Ez41lKOuUu77hgOAWg==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2025-01-14T16:40:57Z",
-		"mac": "ENC[AES256_GCM,data:M8l4a2SbBikF/tEtGx4ZY13eK3ffM70aUCDYo4ljgTAtQEbGLx1SJM/mrFW325LycFMNOerWhXyipbXPZPw2VfnSJ9dz+bQ53xK7Mpf/bOZs5aQZJpJ1/MJh6lkmR/zPeQXhE08WsyJ1rCRqAfygau2CqdV8ujY5li3jIIDQMcQ=,iv:lJZhTjJAxSky9MrzYldkJOG0dCIzkv4IE3ZKzxgUxvo=,tag:t/grczWX+0sDcsHC5SCd/A==,type:str]",
-		"pgp": [
-			{
-				"created_at": "2025-01-14T16:40:08Z",
-				"enc": "-----BEGIN PGP MESSAGE-----\n\nhQGMA5HdvEwzh/H7AQv/S6LvVBsznEqLZbT/UAom1KmfmA3swxAJnQ5tl/vnnix6\nvzs4KSFGZMOQZihEKC/M/og8qTCvlUFBAUMkYLgX+8ehZeZwnnH9V8EDGDIyoWXE\n6AIHP9Ur6yk62gHqmfHlMxFG2A9/A4a+mOvxyKKPDK/AYG0PBaSVMkM6cp7efWwe\n7C6m4BpPRU+3NsNKy/4FkWt9xoFy82K89FqUGC8oZOQW1q+fS7ZIhmnTzzApwILy\n5Y77yBnpPECDYNZdH097bZli6KGWob7aXJ431gyw2OMVQHFb0DlQbKxemo9eWpIr\nnXu2FYrY2D7YxXBGQvXTuNQD3BuvrccOgWAmmi852C1gVVKV+egeOBRq2RYPl6+j\n8TBaNzl0rcvaoWeTJGR142pR9ht9B3aGzXcvCsciZo3SjYyt31J0huzPfv4Dakfn\nyY8BvOaNfugjx0aS6BOZgZiOPlBer86/0FKX469QQAnqL0LRoPyjn53JYUdPdI+s\nCI2WuVynSl7ItiwoKkJK0lgBm0oMhpSiGOC4Z2Bkk2xdpiuXUdMcP6m8OlG9ldCs\n0KrWubh9Ne6CP7etvTkwqWvMuSpCuheToIQ0rp8j21/YdCFX5LpxA3+em0t9M7Is\nV4ZoLnqA2KjI\n=4+Yl\n-----END PGP MESSAGE-----",
-				"fp": "c4639370c41133a738f643a591ddbc4c3387f1fb"
-			},
-			{
-				"created_at": "2025-01-14T16:40:08Z",
-				"enc": "-----BEGIN PGP MESSAGE-----\n\nhQIMA98TrrsQEbXUAQ//c/UkuZRpJM5sH1snP8Kidek6nHgC11hUaY1G15a5ap1D\nn9cMIn4xUdfCAN/DoNiE14NzeTDQyawmIV1ZmrYZzItFdNgunf1r9jQNa3EqcWfE\norJS2RwWDrsw7tmx0wyenr9BLefMGJYaJ6Rd7J3j8sXL7aT+SbNw27mmVbYrJiFJ\nYh2usIsxDu2C+dCeTb3J9sKK6F96IbNnj/2Sx8AGYsIQvcpwloCRrnjiEa+hrEBn\nj1I6U4B/NjRGv20PAR1OnQ2OhKVL5UgTJgNKWCLdvGVOQnqJgDNUrrNEBY19wDQL\nQzJEzL21aiyF+8BB3IrtQlntmAIMcUUHTpqIols9rpVJl54yiK1mQ3UqTQPQ2+gd\nu2gtjXXk3FMnVzaI33ZMcxENGHy/+ZdZMfY70/EwJpRvneHTsLr3Z/bHUxavSYdL\nQqbeWLUm7a2/pnOl5JKa9asKYaNBNdmzO/YVgQNhLQzFtHJ9riVN7Ro+S2bocN9Z\npHGCCISAdMDyuFC7aSngnZEwE4NACbQEc8Udu+YCAUIeeBaPI/QWu3n61fZrkxR7\nmik9uJdXnMzKpmNGVQbPurifykDA6Bsqakn69AZQIPyxMtEDBV+pDX0yy3tI5D12\nhksuXSC7fpV/4BsZWKczK9fpDUJMDTFajSSVrSKb4nr2hk49IAZX9rhgbiHmT1LS\nWAHa5YGYUMkVQc59J3uhAjuSckWA/7R7oMhIrL5e/vnnHVR5zFW/auHkDytzZ0d0\nbGdrIRZh81C+yxB1pSJvlUnIWbYnpqhaH3xL+8yARpGZMNi595x0EJM=\n=8puy\n-----END PGP MESSAGE-----",
-				"fp": "aef8d6c7e4761fc297cda833df13aebb1011b5d4"
-			}
-		],
-		"unencrypted_suffix": "_unencrypted",
-		"version": "3.9.2"
-	}
-}
--- a/machines/configuration.nix
+++ b/machines/configuration.nix
@@ -3,7 +3,6 @@
 , nixpkgs
 , sops-nix
 , inputs
-, microvm
 , nixos-hardware
 , home-manager
 , ...
@@ -35,14 +34,15 @@ let
            };
          };
        })
+
        sops-nix.nixosModules.sops
-        microvm.nixosModules.microvm
      ];
    }
  ];
  defaultModules = baseModules;

  makeMicroVM = hostName: ipv4Addr: macAddr: modules: [
+    inputs.microvm.nixosModules.microvm
    {
      microvm = {
        hypervisor = "cloud-hypervisor";
@@ -93,8 +93,6 @@ let
      };
    }
  ] ++ defaultModules ++ modules;
-
-  inputsMod = inputs // { malobeo = self; };
 in
 {
  louise = nixosSystem {
@@ -111,23 +109,14 @@ in
    modules = defaultModules ++ [
      ./bakunin/configuration.nix
      inputs.disko.nixosModules.disko
-    ];
-  };
-
-  lucia = nixosSystem {
-    system = "aarch64-linux";
-    specialArgs.inputs = inputs;
-    modules = defaultModules ++ [
-      ./lucia/configuration.nix
-      ./lucia/hardware_configuration.nix
+      ./modules/disko/btrfs-laptop.nix
    ];
  };

  fanny = nixosSystem {
    system = "x86_64-linux";
-    specialArgs.inputs = inputsMod;
+    specialArgs.inputs = inputs;
    modules = defaultModules ++ [
-      self.nixosModules.malobeo.vpn
      ./fanny/configuration.nix
    ];
  };
@@ -151,22 +140,12 @@ in
    ];
  };

-  infradocs = nixosSystem {
-    system = "x86_64-linux";
+  lucia = nixosSystem {
+    system = "aarch64-linux";
    specialArgs.inputs = inputs;
-    specialArgs.self = self;
-    modules = makeMicroVM "infradocs" "10.0.0.11" "D0:E5:CA:F0:D7:E7" [
-      self.nixosModules.malobeo.vpn
-      ./infradocs/configuration.nix
-    ];
-  };
-
-  uptimekuma = nixosSystem {
-    system = "x86_64-linux";
-    specialArgs.inputs = inputs;
-    specialArgs.self = self;
-    modules = makeMicroVM "uptimekuma" "10.0.0.12" "D0:E5:CA:F0:D7:E8" [
-      ./uptimekuma/configuration.nix
+    modules = defaultModules ++ [
+      ./lucia/configuration.nix
+      ./lucia/hardware_configuration.nix
    ];
  };

--- a/machines/durruti/documentation.nix
+++ b/machines/durruti/documentation.nix
@@ -8,15 +8,6 @@
        { addr = "0.0.0.0"; port = 9000; } 
      ];
      root = "${self.packages.x86_64-linux.docs}/share/doc";
-      extraConfig = ''
-        proxy_buffering off;
-        proxy_cache off;
-        proxy_http_version 1.1; 
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-      '';
    };
  };

--- a/machines/durruti/host_config.nix
+++ b/machines/durruti/host_config.nix
@@ -36,21 +36,7 @@ in
    services.nginx.virtualHosts."docs.malobeo.org" = {
      forceSSL = true;
      enableACME= true;
-      locations."/" = {
-        proxyPass = "http://10.0.0.10";
-        extraConfig = ''
-        '';
-      };
-    };
-
-    services.nginx.virtualHosts."status.malobeo.org" = {
-      forceSSL = true;
-      enableACME= true;
-      locations."/" = {
-        proxyPass = "http://10.0.0.12";
-        extraConfig = ''
-        '';
-      };
+      locations."/".proxyPass = "http://${cfg.host_ip}:9000";
    };

    services.nginx.virtualHosts."tasklist.malobeo.org" = {
--- a/machines/fanny/configuration.nix
+++ b/machines/fanny/configuration.nix
@@ -1,11 +1,8 @@
-{ inputs, config, ... }:
+{ inputs, pkgs, ... }:
 let
  sshKeys = import ../ssh_keys.nix;
 in
 {
-  sops.defaultSopsFile = ./secrets.yaml;
-  sops.secrets.wg_private = {};
-
  imports =
    [ # Include the results of the hardware scan.
      #./hardware-configuration.nix
@@ -15,7 +12,6 @@ in
      ../modules/autoupdate.nix
      inputs.self.nixosModules.malobeo.initssh
      inputs.self.nixosModules.malobeo.disko
-      inputs.self.nixosModules.malobeo.microvm
    ];

  malobeo.autoUpdate = {
@@ -26,6 +22,9 @@ in
    cacheurl = "https://cache.dynamicdiscord.de";
  };

+  boot.initrd.systemd.enable = true;
+  boot.loader.systemd-boot.enable = true;
+
  nix.settings.experimental-features = [ "nix-command" "flakes" ];

  malobeo.disks = {
@@ -46,32 +45,6 @@ in
    ethernetDrivers = ["r8169"];
  };

-  services.malobeo.vpn = {
-    enable = true;
-    name = "fanny";
-    privateKeyFile = config.sops.secrets.wg_private.path;
-  };
-
-  services.malobeo.microvm.enableHostBridge = true;
-  services.malobeo.microvm.deployHosts = [ "infradocs" ];
-
-  networking = {
-    firewall = {
-      allowedTCPPorts = [ 80 ];
-    };
-  };
-
-  services.nginx = {
-    enable = true;
-    virtualHosts."docs.malobeo.org" = {
-      locations."/" = {
-        proxyPass = "http://10.0.0.11:9000";
-        extraConfig = ''
-        '';
-      };
-    };
-  };
-
  services.tor = {
    enable = true;
    client.enable = true;
--- a/machines/fanny/secrets.yaml
+++ b/machines/fanny/secrets.yaml
@@ -1,68 +0,0 @@
-wg_private: ENC[AES256_GCM,data:kFuLzZz9lmtUccQUIYiXvJRf7WBg5iCq1xxCiI76J3TaIBELqgbEmUtPR4g=,iv:0S0uzX4OVxQCKDOl1zB6nDo8152oE7ymBWdVkPkKlro=,tag:gg1n1BsnjNPikMBNB60F5Q==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age14dpm6vaycd6u34dkndcktpamqgdyj4aqccjnl5533dsza05hxuds0tjfnf
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCTmdrV1IyM2hldloxM3Zh
-            cGVIZmtCZ0FLTEQxcFBLaVh0VXUwNWVGR1hBCnJ6SHpzckh5VVduM0Z2dkh2WHdy
-            WGxRV0JFZTdqcWgzUFlSZkowZElJd2MKLS0tIGxYL0orSVdmZzJBSEIvRUNDUVlK
-            RWFLOWp4TVJBM3llS0lmQlBUQ2ZQNkUKEz/dXR0tkVeyC9Oxai5gZEAhRImdL1FL
-            2LdVRiCt3MqR9wtfw1/pR7166Bx8nLIN42uWh2YU5j0/0rXNq+I6Qg==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoQW5OU2FiNStkazFRRHBK
-            U2kzNkpWRDVQTDBkTFFNWnREcjh6NlhmRnhZCkxMYlZhcUlGUnN3QWFzbVkyYlpX
-            eWZaOUxsUCtZYmx0U29ZckFaMjNLTFEKLS0tIExxV0REL3MwUTZpMkgxYlZMc0JS
-            cTNEYTBGT3VRaDI1eUhucnd5d2JhTWMKNZlkUjxX2QTFoiCWPzz62jz4kK8d5rW/
-            MJ1w69Qve7lsUAg74YlFF7i/yYSZZkHoRMs92lRmq3lHlbK6aaUMTw==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-01-14T12:41:07Z"
-    mac: ENC[AES256_GCM,data:RJ4Fa8MmX8u8S3zrD/SaywTC3d2IfHQPBDy3C9u4GuXJ/ruEChAB1kN8rqMPvkmET8UUgHIEp7RpbzMtg/FOmKYKYTTx5t//3/VozvAEZurhG/4mnN3r6uaZ0R9+wSjym8IyOKsJ7p4XrfE5tRdzNyU4EqfkEiyf+jO751uSnYI=,iv:eiTdmbcrpUvyDPFmGawxJs/ehmD7KqulaoB+nfpC6ko=,tag:+TKr53cFS3wbLXNgcbZfJQ==,type:str]
-    pgp:
-        - created_at: "2025-01-14T12:32:13Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQGMA5HdvEwzh/H7AQv/YM4JBfaFngZt0SmMP3fBCodQXWnWMjy5VYoTOKKaOfG8
-            5GRTf+o1stsru3EKImh5PTqniRO6UH+/DOKBY8zHsy9lXojGka3uPJRKv7JUD5YO
-            8NjlHwwg+jcQN/qtrWc+1D69zR1aO/6yxfgujL3r/fJ4reqtSNfkVYVy2lEcw2ZN
-            zhlN+fBxZCyHyUTKLcXrG7Fg8BRudjwBnIsBTLAVFkWg0bnlq38vicGpF5CHsRjA
-            cTPq2D9ev888WKHcjFcXYqxeKkXkqBuOOMlCHQyJCv8HHfA/GY+pBQfiVmvSt77O
-            /MA8hVYl8G4tRFsbUdZzqtPbAsLy30w1e9dpsD2M6tD55V2RNUCrznB2lo0uXZ24
-            9MUnad+NQdntbe5B2OBUF/MNKZ9/tC+B9pBm7Tx3rxSELytGuQF11x4EyLwn+Ict
-            iBBV5P3RiulxLW6MbDs+7JPILfcMfg6e8q+GY1dnIPZrs8Qf5W60FxbOYYiMvJ9k
-            UtnZAixVdlpkAsQz/t630lgBX9DLYjEVgaxC+zqtRjfHkoyvGIac6cgHDX/fBs7p
-            Woud0RbwffhOhaIF47Z2W4UPfn5Mtcu63fQpjCM9urk9asaRPeNDTeEYVjqSZD6N
-            J+o9dahBHvIF
-            =GKm4
-            -----END PGP MESSAGE-----
-          fp: c4639370c41133a738f643a591ddbc4c3387f1fb
-        - created_at: "2025-01-14T12:32:13Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA98TrrsQEbXUARAAmD4PfLpRVUXTo5yyS9LSs5vmEvnCmNc0ad4Oiv7YAxhs
-            W7SCKHq2zOfGIeZZHP0wjRnJELwMCVLy4dVo/slDHCiy8T4MZXaYR04ZaJJ+OHrF
-            e5xxAA6FjipufvxgRZvLhDj+g+RaX2TuxdL9gFSVS81rvEpSRDnydt2O/6G4SGBR
-            GO5b176eMerrqOqRLL5Ou4b6oitagvRwZzOXQ+YonKZz3STlyXRMgWxeFTDK9T/q
-            yYOwPVAOU1jhYzUjHNAYCp3CH4ERScrO7AwomAWH+Fe48WRbg2ebdqRnuv/Vl4PM
-            wc5DQcCIIIIENMGIYOzUo1KrfQlevzXF/mbgAgo/uVuRl3Y3lCRAcZBQOtUCF5Ap
-            FhsO87EMXlZWj3bv08f21t3hQztfuaHIqFpCbSIGgmiE9cAY0cOtCYpJfCYdV7iT
-            cOElJgYRbAsAbFC9wTQWEvwIxrgnCIrkCg1bzP5KNLG1K+ae5J7qN77qeTQw2/ul
-            QDDUUNnzjes562t+/xFLQa/bust1Y8pAYn1s1LEBol1hLX4Igonlkw303UPjZOI2
-            MyH5hOh0hNUReuOpHpre/pYquE8Dd27XKAHfJsSd3ZLJG5+1Msw23lIsptgovNrB
-            5VRvPj8WPojiDHqN27kt/IuayN3TeoJFjmAjkoFjlyKTcs+b6cDkxUw3LcP+6NjS
-            WAHQI0pWTa5zD8UPow4DHxteP4jW/6ddBfJ1Vz1scqKMXYvxFkRqZvn3uAJOtcuw
-            CgQ4CXE43n4G7g5gvWl6ZFW8tdXR7Sw+USnHR/9oS9fV0rHcxxDFEfE=
-            =9FN4
-            -----END PGP MESSAGE-----
-          fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4
-    unencrypted_suffix: _unencrypted
-    version: 3.9.2
--- a/machines/infradocs/configuration.nix
+++ b/machines/infradocs/configuration.nix
@@ -1,20 +0,0 @@
-{ config, lib, pkgs, inputs, ... }:
-
-with lib;
-
-{
-  networking = {
-    hostName = mkDefault "infradocs";
-    useDHCP = false;
-    nameservers = [ "1.1.1.1" ];
-  };
-
-  imports = [
-    ../durruti/documentation.nix
-    ../modules/malobeo_user.nix
-    ../modules/sshd.nix
-  ];
-
-  system.stateVersion = "22.11"; # Did you read the comment?
-}
-
--- a/machines/modules/malobeo/peers.nix
+++ b/machines/modules/malobeo/peers.nix
@@ -6,34 +6,26 @@
    allowedIPs = [ "10.100.0.0/24" ];
    listenPort = 51821;
    publicKey = "hF9H10Y8Ar7zvZXFoNM8LSoaYFgPCXv30c54SSEucX4=";
-    persistentKeepalive = 25;
  };

  "celine" = {
    role = "client";
    address = [ "10.100.0.2/24" ];
-    allowedIPs = [ "10.100.0.2/32" ];
+    allowedIPs = [ "10.100.0.0/24" ];
    publicKey = "Jgx82tSOmZJS4sm1o8Eci9ahaQdQir2PLq9dBqsWZw4=";
  };

  "desktop" = {
    role = "client";
    address = [ "10.100.0.3/24" ];
-    allowedIPs = [ "10.100.0.3/32" ];
+    allowedIPs = [ "10.100.0.0/24" ];
    publicKey = "FtY2lcdWcw+nvtydOOUDyaeh/xkaqHA8y9GXzqU0Am0=";
  };

  "atlan-pc" = {
    role = "client";
    address = [ "10.100.0.5/24" ];
-    allowedIPs = [ "10.100.0.5/32" ];
+    allowedIPs = [ "10.100.0.0/24" ];
    publicKey = "TrJ4UAF//zXdaLwZudI78L+rTC36zEDodTDOWNS4Y1Y=";
  };
-
-  "fanny" = {
-    role = "client";
-    address = [ "10.100.0.101/24" ];
-    allowedIPs = [ "10.100.0.101/32" ];
-    publicKey = "3U59F6T1s/1LaZBIa6wB0qsVuO6pRR9jfYZJIH2piAU=";
-  };
 }
--- a/machines/modules/malobeo/wireguard.nix
+++ b/machines/modules/malobeo/wireguard.nix
@@ -63,13 +63,10 @@ in
        '';
      }
    ];
-    
-    boot.kernel.sysctl."net.ipv4.ip_forward" = mkIf (myPeer.role == "server") 1;

    networking.wg-quick = {
      interfaces = {
        malovpn = {
-          mtu = 1340; #seems to be necessary to proxypass nginx traffic through vpn
          address = myPeer.address;
          autostart = cfg.autostart;
          listenPort = mkIf (myPeer.role == "server") myPeer.listenPort;
--- a/machines/testvm/default.nix
+++ b/machines/testvm/default.nix
@@ -14,8 +14,6 @@ in
    ];


-  boot.initrd.systemd.enable = true;
-  boot.loader.systemd-boot.enable = true;
  malobeo.initssh = {
    enable = true;
    authorizedKeys = sshKeys.admins;
@@ -50,7 +48,7 @@ in

  services.acpid.enable = true;

-  networking.hostName = "testvm";
+  networking.hostName = "fanny";
  networking.networkmanager.enable = true;

  time.timeZone = "Europe/Berlin";
--- a/machines/uptimekuma/configuration.nix
+++ b/machines/uptimekuma/configuration.nix
@@ -1,37 +0,0 @@
-{ config, lib, pkgs, inputs, ... }:
-
-with lib;
-
-{
-  networking = {
-    hostName = mkDefault "uptimekuma";
-    useDHCP = false;
-    nameservers = [ "1.1.1.1" ];
-  };
-
-  imports = [
-    ../modules/malobeo_user.nix
-    ../modules/sshd.nix
-  ];
-
-  networking.firewall.allowedTCPPorts = [ 80 ];
-
-  services.nginx = {
-    enable = true;
-    virtualHosts."status.malobeo.org" = {
-      locations."/" = {
-        proxyPass = "http://127.0.0.1:3001";
-        extraConfig = ''
-        '';
-      };
-
-    };
-  };
-
-  services.uptime-kuma = {
-    enable = true;
-  };
-
-  system.stateVersion = "22.11"; # Did you read the comment?
-}
-
--- a/machines/vpn/configuration.nix
+++ b/machines/vpn/configuration.nix
@@ -12,7 +12,6 @@ with lib;
    nameservers = [ "1.1.1.1" ];
    firewall = {
      allowedUDPPorts = [ 51821 ];
-      allowedTCPPorts = [ 80 ];
    };
  };

@@ -28,18 +27,6 @@ with lib;
    privateKeyFile = config.sops.secrets.wg_private.path;
  };

-  services.nginx = {
-    enable = true;
-    virtualHosts."docs.malobeo.org" = {
-      locations."/" = {
-        proxyPass = "http://10.100.0.101";
-        extraConfig = ''
-        '';
-      };
-
-    };
-  };
-
  system.stateVersion = "22.11"; # Did you read the comment?
 }

--- a/outputs.nix
+++ b/outputs.nix
@@ -20,7 +20,6 @@ in (utils.lib.eachSystem (builtins.filter filter_system utils.lib.defaultSystems
    let
      sops = sops-nix.packages."${pkgs.system}";
      microvmpkg = microvm.packages."${pkgs.system}";
-      installed = builtins.attrNames self.legacyPackages."${pkgs.system}".scripts;
    in
    pkgs.mkShell {
      sopsPGPKeyDirs = [
@@ -38,14 +37,11 @@ in (utils.lib.eachSystem (builtins.filter filter_system utils.lib.defaultSystems
        pkgs.mdbook
        microvmpkg.microvm
      ];
-      packages = builtins.map (pkgName: self.legacyPackages."${pkgs.system}".scripts.${pkgName}) installed;
-      shellHook = ''echo "Available scripts: ${builtins.concatStringsSep " " installed}"'';
-    };
-    legacyPackages = {
-      scripts.remote-install = pkgs.writeShellScriptBin "remote-install" (builtins.readFile ./scripts/remote-install-encrypt.sh);
-      scripts.boot-unlock = pkgs.writeShellScriptBin "boot-unlock" (builtins.readFile ./scripts/unlock-boot.sh);
    };
+
    packages = {
+      remote-install = pkgs.writeShellScriptBin "remote-install" (builtins.readFile ./scripts/remote-install-encrypt.sh);
+      boot-unlock = pkgs.writeShellScriptBin "boot-unlock" (builtins.readFile ./scripts/unlock-boot.sh);
      docs = pkgs.stdenv.mkDerivation {
        name = "malobeo-docs";
        phases = [ "buildPhase" ];
--- a/scripts/remote-install-encrypt.sh
+++ b/scripts/remote-install-encrypt.sh
@@ -1,4 +1,5 @@
 set -o errexit
+set -o nounset
 set -o pipefail

 if [ $# -lt 2 ]; then
@@ -8,21 +9,6 @@ if [ $# -lt 2 ]; then
  exit 1
 fi

-if [ ! -e flake.nix ]
-    then
-    echo "flake.nix not found. Searching down."
-    while [ ! -e flake.nix ]
-        do
-        if [ $PWD = "/" ]
-            then
-            echo "Found root. Aborting."
-            exit 1
-            else
-            cd ..
-        fi
-    done
-fi
-
 hostname=$1
 ipaddress=$2

--- a/scripts/unlock-boot.sh
+++ b/scripts/unlock-boot.sh
@@ -4,33 +4,19 @@ set -o pipefail
 sshoptions="-o StrictHostKeyChecking=no -o ServerAliveInterval=1 -o ServerAliveCountMax=1 -p 222 -T"
 HOSTNAME=$1

-if [ ! -e flake.nix ]
-    then
-    echo "flake.nix not found. Searching down."
-    while [ ! -e flake.nix ]
-        do
-        if [ $PWD = "/" ]
-            then
-            echo "Found root. Aborting."
-            exit 1
-            else
-            cd ..
-        fi
-    done
-fi
-
 echo
+diskkey=$(sops -d machines/$HOSTNAME/disk.key)
+
 if [ $# = 1 ]
    then
-    diskkey=$(sops -d machines/$HOSTNAME/disk.key)
    echo "$diskkey" | ssh $sshoptions root@$HOSTNAME-initrd "systemd-tty-ask-password-agent" #storage

    echo "$diskkey" | ssh $sshoptions root@$HOSTNAME-initrd "systemd-tty-ask-password-agent" #root

 elif [ $# = 2 ]
    then
-    diskkey=$(sops -d machines/$HOSTNAME/disk.key)
    IP=$2
+    
    echo "$diskkey" | ssh $sshoptions root@$IP "systemd-tty-ask-password-agent" #storage

    echo "$diskkey" | ssh $sshoptions root@$IP "systemd-tty-ask-password-agent" #root