wip

[overwatch] grafana provision datasource and dashboards
[metrics] enable on all microvms
2025-01-21 22:17:16 +01:00 · 2025-01-20 22:31:36 +01:00 · 2025-01-20 21:32:07 +01:00 · 2025-01-20 21:32:07 +01:00 · 2025-01-20 21:32:07 +01:00 · 2025-01-20 21:32:07 +01:00
35 changed files with 757 additions and 911 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -6,4 +6,3 @@ result
 .direnv/
 book/
 fanny-efi-vars.fd
-nix-store-overlay.img
--- a/flake.lock
+++ b/flake.lock
@@ -341,11 +341,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1737548421,
-        "narHash": "sha256-gmlqJdC+v86vXc2yMhiza1mvsqh3vMfrEsiw+tV5MXg=",
+        "lastModified": 1736184101,
+        "narHash": "sha256-HAX+TkDXzyNp6SAsKwjNFql7KzAtxximpQSv+GmP8KQ=",
        "ref": "refs/heads/master",
-        "rev": "c5fff78c83959841ac724980a13597dcfa6dc26d",
-        "revCount": 29,
+        "rev": "9cdab949f44301553e3817cf1f38287ad947e00c",
+        "revCount": 28,
        "type": "git",
        "url": "https://git.dynamicdiscord.de/kalipso/tasklist"
      },
--- a/machines/.sops.yaml
+++ b/machines/.sops.yaml
@@ -8,12 +8,9 @@ keys:
  - &admin_atlan age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
  - &machine_moderatio 3b7027ab1933c4c5e0eb935f8f9b3c058aa6d4c2
  - &machine_lucia 3474196f3adf27cfb70f8f56bcd52d1ed55033db
-  - &machine_durruti age1pd2kkscyh7fuvm49umz8lfhse4fpkmp5pa3gvnh4ranwxs4mz9nqdy7sda
-  - &machine_infradocs age1decc74l6tm5sjtnjyj8rkxysr9j49fxsc92r2dcfpmzdcjv5dews8f03se
-  - &machine_overwatch age1psj6aeu03s2k4zdfcte89nj4fw95xgk4e7yr3e6k6u2evq84ng3s57p6f0
+  - &machine_durruti age1xu6kxpf8p0r8d6sgyl0m20p5hmw35nserl7rejuzm66eql0ur4mq03u0vp
  - &machine_vpn age1v6uxwej4nlrpfanr9js7x6059mtvyg4fw50pzt0a2kt3ahk7edlslafeuh
-  - &machine_fanny age1u6ljjefkyy242xxtpm65v8dl908efnpt4txjkh0c9emvagdv8etqt22wll
-  - &machine_nextcloud age1z0cfz7l4vakjrte220h46fc05503506fjcz440na92pzgztlspmqc8vt6k
+  - &machine_fanny age14dpm6vaycd6u34dkndcktpamqgdyj4aqccjnl5533dsza05hxuds0tjfnf
  #this dummy key is used for testing.
  - &machine_dummy age18jn5mrfs4gqrnv0e2sxsgh3kq4sgxx39hwr8z7mz9kt7wlgaasjqlr88ng
 creation_rules:
@@ -73,6 +70,13 @@ creation_rules:
      - *admin_kalipso_dsktp
      age:
      - *admin_atlan
+  - path_regex: fanny/disk.key
+    key_groups:
+    - pgp:
+      - *admin_kalipso
+      - *admin_kalipso_dsktp
+      age:
+      - *admin_atlan
  - path_regex: bakunin/disk.key
    key_groups:
    - pgp:
@@ -80,25 +84,12 @@ creation_rules:
      - *admin_kalipso_dsktp
      age:
      - *admin_atlan
+
  - path_regex: nextcloud/secrets.yaml$
    key_groups:
    - pgp:
      - *admin_kalipso
      - *admin_kalipso_dsktp
-      age:
-      - *admin_atlan
-      - *machine_nextcloud
-  - path_regex: overwatch/secrets.yaml$
-    key_groups:
-    - pgp:
-      - *admin_kalipso
-      - *admin_kalipso_dsktp
-      age:
-      - *admin_atlan
-  - path_regex: secrets/keys/itag/.*/.*
-    key_groups:
-    - pgp:
-      - *admin_kalipso
-      - *admin_kalipso_dsktp
+      - *machine_durruti
      age:
      - *admin_atlan
--- a/machines/configuration.nix
+++ b/machines/configuration.nix
@@ -0,0 +1,205 @@
+{ self
+, nixpkgs-unstable
+, nixpkgs
+, sops-nix
+, inputs
+, microvm
+, nixos-hardware
+, home-manager
+, ...
+}:
+let
+  nixosSystem = nixpkgs.lib.makeOverridable nixpkgs.lib.nixosSystem;
+  nixosSystemUnstable = nixpkgs-unstable.lib.makeOverridable nixpkgs-unstable.lib.nixosSystem;
+
+  baseModules = [
+    # make flake inputs accessiable in NixOS
+    { _module.args.inputs = inputs; }
+    {
+      imports = [
+        ({ pkgs, ... }: {
+          nix = {
+            extraOptions = ''
+              experimental-features = nix-command flakes
+            '';
+
+            settings = {
+              substituters = [
+                "https://cache.dynamicdiscord.de"
+                "https://cache.nixos.org/"
+              ];
+              trusted-public-keys = [
+                "cache.dynamicdiscord.de:DKueZicqi2NhJJXz9MYgUbiyobMs10fTyHCgAUibRP4="
+              ];
+              trusted-users = [ "root" "@wheel" ];
+            };
+          };
+        })
+        sops-nix.nixosModules.sops
+        microvm.nixosModules.microvm
+      ];
+    }
+  ];
+  defaultModules = baseModules;
+
+  makeMicroVM = hostName: ipv4Addr: macAddr: modules: [
+    self.nixosModules.malobeo.metrics
+    {
+      microvm = {
+        hypervisor = "cloud-hypervisor";
+        mem = 2560;
+        shares = [
+          {
+            source = "/nix/store";
+            mountPoint = "/nix/.ro-store";
+            tag = "store";
+            proto = "virtiofs";
+            socket = "store.socket";
+          }
+          {
+            source = "/var/lib/microvms/${hostName}/etc";
+            mountPoint = "/etc";
+            tag = "etc";
+            proto = "virtiofs";
+            socket = "etc.socket";
+          }
+          {
+            source = "/var/lib/microvms/${hostName}/var";
+            mountPoint = "/var";
+            tag = "var";
+            proto = "virtiofs";
+            socket = "var.socket";
+          }
+        ];
+
+        interfaces = [
+          {
+            type = "tap";
+            id = "vm-${hostName}";
+            mac = "${macAddr}";
+          }
+        ];
+      };
+
+      malobeo.metrics = {
+        enable = true;
+        enablePromtail = true;
+        logNginx = false;
+        lokiHost = "10.0.0.14";
+      };
+      
+      systemd.network.enable = true;
+      
+      systemd.network.networks."20-lan" = {
+        matchConfig.Type = "ether";
+        networkConfig = {
+          Address = [ "${ipv4Addr}/24" ];
+          Gateway = "10.0.0.1";
+          DNS = ["1.1.1.1"];
+          DHCP = "no";
+        };
+      };
+    }
+  ] ++ defaultModules ++ modules;
+
+  inputsMod = inputs // { malobeo = self; };
+in
+{
+  louise = nixosSystem {
+    system = "x86_64-linux";
+    specialArgs.inputs = inputs;
+    modules = defaultModules ++ [
+      ./louise/configuration.nix
+    ];
+  };
+
+  bakunin = nixosSystem {
+    system = "x86_64-linux";
+    specialArgs.inputs = inputs;
+    modules = defaultModules ++ [
+      ./bakunin/configuration.nix
+      inputs.disko.nixosModules.disko
+    ];
+  };
+
+  lucia = nixosSystem {
+    system = "aarch64-linux";
+    specialArgs.inputs = inputs;
+    modules = defaultModules ++ [
+      ./lucia/configuration.nix
+      ./lucia/hardware_configuration.nix
+    ];
+  };
+
+  fanny = nixosSystem {
+    system = "x86_64-linux";
+    specialArgs.inputs = inputsMod;
+    modules = defaultModules ++ [
+      self.nixosModules.malobeo.vpn
+      ./fanny/configuration.nix
+    ];
+  };
+
+  durruti = nixosSystem {
+    system = "x86_64-linux";
+    specialArgs.inputs = inputs;
+    specialArgs.self = self;
+    modules = makeMicroVM "durruti" "10.0.0.5" "52:DA:0D:F9:EF:F9" [
+      ./durruti/configuration.nix
+    ];
+  };
+
+  vpn = nixosSystem {
+    system = "x86_64-linux";
+    specialArgs.inputs = inputs;
+    specialArgs.self = self;
+    modules = makeMicroVM "vpn" "10.0.0.10" "D0:E5:CA:F0:D7:E6" [
+      self.nixosModules.malobeo.vpn
+      ./vpn/configuration.nix
+    ];
+  };
+
+  infradocs = nixosSystem {
+    system = "x86_64-linux";
+    specialArgs.inputs = inputs;
+    specialArgs.self = self;
+    modules = makeMicroVM "infradocs" "10.0.0.11" "D0:E5:CA:F0:D7:E7" [
+      self.nixosModules.malobeo.vpn
+      ./infradocs/configuration.nix
+    ];
+  };
+
+  uptimekuma = nixosSystem {
+    system = "x86_64-linux";
+    specialArgs.inputs = inputs;
+    specialArgs.self = self;
+    modules = makeMicroVM "uptimekuma" "10.0.0.12" "D0:E5:CA:F0:D7:E8" [
+      ./uptimekuma/configuration.nix
+    ];
+  };
+
+  nextcloud = nixosSystem {
+    system = "x86_64-linux";
+    specialArgs.inputs = inputs;
+    specialArgs.self = self;
+    modules = makeMicroVM "nextcloud" "10.0.0.13" "D0:E5:CA:F0:D7:E9" [
+      ./nextcloud/configuration.nix
+    ];
+  };
+
+  overwatch = nixosSystem {
+    system = "x86_64-linux";
+    specialArgs.inputs = inputs;
+    specialArgs.self = self;
+    modules = makeMicroVM "overwatch" "10.0.0.14" "D0:E5:CA:F0:D7:E0" [
+      ./overwatch/configuration.nix
+    ];
+  };
+
+  testvm = nixosSystem {
+    system = "x86_64-linux";
+    specialArgs.inputs = inputs;
+    specialArgs.self = self;
+    modules = defaultModules ++ [ ./testvm ];
+  };
+}
--- a/machines/durruti/configuration.nix
+++ b/machines/durruti/configuration.nix
@@ -1,4 +1,4 @@
-{ config, self, lib, pkgs, inputs, ... }:
+{ config, lib, pkgs, inputs, ... }:

 with lib;

@@ -17,21 +17,15 @@ with lib;
  ];

  imports = [
-    self.nixosModules.malobeo.metrics
    inputs.tasklist.nixosModules.malobeo-tasklist

+    ./documentation.nix
+
    ../modules/malobeo_user.nix
    ../modules/sshd.nix
    ../modules/minimal_tools.nix
  ];

-  malobeo.metrics = {
-    enable = true;
-    enablePromtail = true;
-    logNginx = true;
-    lokiHost = "10.0.0.14";
-  };
-
  services.malobeo-tasklist.enable = true;

  system.stateVersion = "22.11"; # Did you read the comment?
--- a/machines/durruti/host_config.nix
+++ b/machines/durruti/host_config.nix
@@ -43,36 +43,6 @@ in
      };
    };

-    services.nginx.virtualHosts."cloud.malobeo.org" = {
-      forceSSL = true;
-      enableACME= true;
-      locations."/" = {
-        proxyPass = "http://10.0.0.10";
-        extraConfig = ''
-        '';
-      };
-    };
-
-    services.nginx.virtualHosts."grafana.malobeo.org" = {
-      forceSSL = true;
-      enableACME= true;
-      locations."/" = {
-        proxyPass = "http://10.0.0.10";
-        extraConfig = ''
-        '';
-      };
-    };
-
-    services.nginx.virtualHosts."tasklist.malobeo.org" = {
-      forceSSL = true;
-      enableACME= true;
-      locations."/" = {
-        proxyPass = "http://10.0.0.10";
-        extraConfig = ''
-        '';
-      };
-    };
-
    services.nginx.virtualHosts."status.malobeo.org" = {
      forceSSL = true;
      enableACME= true;
@@ -82,5 +52,17 @@ in
        '';
      };
    };
+
+    services.nginx.virtualHosts."tasklist.malobeo.org" = {
+      forceSSL = true;
+      enableACME= true;
+      locations."/".proxyPass = "http://${cfg.host_ip}:8080";
+    };
+
+    services.nginx.virtualHosts."booking.dynamicdiscord.de" = {
+      forceSSL = true;
+      enableACME= true;
+      locations."/".proxyPass = "http://${cfg.host_ip}:80";
+    };
  };
 }
--- a/machines/fanny/configuration.nix
+++ b/machines/fanny/configuration.nix
@@ -13,27 +13,11 @@ in
      ../modules/sshd.nix
      ../modules/minimal_tools.nix
      ../modules/autoupdate.nix
-      inputs.self.nixosModules.malobeo.vpn
      inputs.self.nixosModules.malobeo.initssh
      inputs.self.nixosModules.malobeo.disko
      inputs.self.nixosModules.malobeo.microvm
-      inputs.self.nixosModules.malobeo.metrics
    ];

-    virtualisation.vmVariantWithDisko = {
-      virtualisation = {
-        memorySize =  4096; 
-        cores = 3;
-      };
-    };
-
-  malobeo.metrics = {
-    enable = true;
-    enablePromtail = true;
-    logNginx = true;
-    lokiHost = "10.0.0.14";
-  };
-
  malobeo.autoUpdate = {
    enable = true;
    url = "https://hydra.dynamicdiscord.de";
@@ -42,14 +26,7 @@ in
    cacheurl = "https://cache.dynamicdiscord.de";
  };

-  nix = {
-    settings.experimental-features = [ "nix-command" "flakes" ];
-    #always update microvms
-    extraOptions = ''
-      tarball-ttl = 0
-    '';
-  };
-
+  nix.settings.experimental-features = [ "nix-command" "flakes" ];

  malobeo.disks = {
    enable = true;
@@ -58,17 +35,11 @@ in
      disk0 = "disk/by-id/ata-SAMSUNG_MZ7LN256HCHP-000L7_S20HNAAH200381";
    };
    storage = {
-      enable = true;
      disks = ["disk/by-id/wwn-0x50014ee265b53b60" "disk/by-id/wwn-0x50014ee2bb0a194a"];
      mirror = true;
    };
  };

-  systemd.tmpfiles.rules = [ 
-    "L /var/lib/microvms/data - - - - /data/microvms"
-    "d /data/microvms 0755 root root" #not needed for real host?
-    ];
-
  malobeo.initssh = {
    enable = true;
    authorizedKeys = sshKeys.admins;
@@ -82,15 +53,9 @@ in
  };

  services.malobeo.microvm.enableHostBridge = true;
-  services.malobeo.microvm.deployHosts = [ "overwatch" "infradocs" "nextcloud" "durruti" ];
+  services.malobeo.microvm.deployHosts = [ "infradocs" "nextcloud" "overwatch" ];

  networking = {
-    nat = {
-      enable = true;
-      externalInterface = "enp1s0";
-      internalInterfaces = [ "microvm" ];
-    };
-
    firewall = {
      allowedTCPPorts = [ 80 ];
    };
@@ -102,7 +67,6 @@ in
      locations."/" = {
        proxyPass = "http://10.0.0.11:9000";
        extraConfig = ''
-          proxy_set_header Host $host;
        '';
      };
    };
@@ -111,25 +75,6 @@ in
      locations."/" = {
        proxyPass = "http://10.0.0.13";
        extraConfig = ''
-          proxy_set_header Host $host;
-        '';
-      };
-    };
-
-    virtualHosts."grafana.malobeo.org" = {
-      locations."/" = {
-        proxyPass = "http://10.0.0.14";
-        extraConfig = ''
-          proxy_set_header Host $host;
-        '';
-      };
-    };
-
-    virtualHosts."tasklist.malobeo.org" = {
-      locations."/" = {
-        proxyPass = "http://10.0.0.5:8080";
-        extraConfig = ''
-          proxy_set_header Host $host;
        '';
      };
    };
--- a/machines/fanny/disk.key
+++ b/machines/fanny/disk.key
@@ -0,0 +1,31 @@
+{
+	"data": "ENC[AES256_GCM,data:1I8fN241VOaW4GaNUe/OVr+1HQKmtYL1GSuIfsE=,iv:aHdgEUj5QhusEavG9mVgtTQ4uqLJD2ozQ/kVVtFakYY=,tag:JJUbt4kgpa4hVD3HjLXGOg==,type:str]",
+	"sops": {
+		"kms": null,
+		"gcp_kms": null,
+		"azure_kv": null,
+		"hc_vault": null,
+		"age": [
+			{
+				"recipient": "age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEUGpORk5zWXU1OVpqc2hT\nVW5PYlNLT3lKQVpTdCtMT1M3YlZ3Uno5bVJjCkJXR3I2Y3lDT0dJNThCcDN1NXYr\nK3VucjRKU0dac3BtQmV5ZFdrZXkrS1EKLS0tIGRGMGxDM0ZGbzVPTnJQK01GS3VW\nRHpJQWZLU1lrRS9ScXM0L0dyTjhGTGsKJEYq5vKxxYBAgkqUEkBwESur0reNIDPb\nK3rtflNi3dUYYZdLFNFV5rQX5q8aDnM6fO/zYPkzfBn7Ewq3jbBIIg==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-01-05T19:35:48Z",
+		"mac": "ENC[AES256_GCM,data:z7elJ0+3r0bWc/H6h4rI36xC7Uj0NS04VssjPDNVZM17LeN4ansSOfcOKPaUMziV/z5Aq8RVLROR+FImzxBZGaZm37frCoN1OP3WjeDnP6AsoY9dY+S/aYmErVEsQEIi8T4RAdQP2c3BUt1oKZ9Nki2pu3IBRabBlFhaTI0bspc=,iv:8Nn8r9ancHwBJOaJSsv8Vj3s+d0UvRmKIeCDNzx1qRg=,tag:BSO2yu70H2wjen3BCGC4Gw==,type:str]",
+		"pgp": [
+			{
+				"created_at": "2025-01-05T19:32:11Z",
+				"enc": "-----BEGIN PGP MESSAGE-----\n\nhQGMA5HdvEwzh/H7AQv+JpNwP+BLJf4+0pSr17TToviCo0yWmcaP1dIUqClBSoDO\nI3ZzqHdImAj4QgExif2zsuzz1+WC+sjvFqEmX5pBKza/e30qCZirkelz9mzc0mhG\nLhTzfhqC6fLbV5f+pDp6N40ommu+LX1pIz6nViCUjqBdnAkCb+tqLU4eQJQqVmlz\n7BToLsvYomPK1nJ6f4rt1nTR9wkBI68AYM/K0SgCJXjwj1LpZ/+3yElkiCqZ9uZB\n1jrDKX+QPySlZ7OERL70UT7Eh8DTUNzFnozvliBnyxe00wwiiucCgrC94TmaKCmh\ni/FOdS6Izm3QwcWB0eMCX6GQBvlUWpjSz5xF4+YODJe9tGNz/sNxpk6B8xG5NuG2\n61nohMHoml6X3Z9dOwu/Svl+eS8SV/r278W/F9miE8YeayyLlPxHF3DXjd6WeDhZ\n20NExQUJYIRf6w/XQPQZ+E39NkIHxz8v+P29ncmSsRPWS6d2MK0Yj+UW0vT0u1vJ\n+lAs24xYofbu5tmBbnK10lgBrZMXDJM2nQbKMKSkVVjzbzmOe5jzMBxuWLX+ykeI\npaj32wQDWvfBqLPH1Kwvy5nqHvy375jPZ7RTzT7W0d4jKQf7xapbi4CEepHHfxCF\nD0HIEi8RUlXJ\n=KVUJ\n-----END PGP MESSAGE-----",
+				"fp": "c4639370c41133a738f643a591ddbc4c3387f1fb"
+			},
+			{
+				"created_at": "2025-01-05T19:32:11Z",
+				"enc": "-----BEGIN PGP MESSAGE-----\n\nhQIMA98TrrsQEbXUARAAqowFMavIniFheNvt03EH1iEn64xNmExotYcDt2L0bR39\nXQdLvg7cJ/Jh7EuZ44mHTs21mpbYIlygMs6kimqQ8iO30vGTEcn5bt/eUEoGHciM\nYVHktWNR81ZgjvKCcmTUK3ld+DMKmg2BABr4auUOYLu4ToSnFb1fv+fvZG0D3iQs\nm6LJuafH+4utM16Vnkp9+ziY/ieMPYfbOFuSFq0UWxGK9P+koSYVGnYhH55Lksyf\nBb/esEGCY671/Jl/qHw8so4TELeRsW/v/xAcNqbE1Msdeas7WJy/B6WqXQgK/Y+J\nPsyZ2XHKhPRitN77/eDJXVBi0mKBTE/RCzDzMYxKA7IQm28v8+u+wpdCajewnyF4\ns2HACaYs/TWRpIUzqxRlznc0nMpk8xUaeVb0N7nrtSDEBF8ETOGOcPk1AmdKMR4M\nsy0vu+K2oJ9L7e/o1ntpejKHN7t2Lzq+CvszBYKmyw/KgxeqY0hx4cJTUDsdgLjI\nMTrs6bySVXDyRaw3rHo7OvA+5c8dLfnWJd1R78nZTx89CYCvjJeMo7PNvN6C9HxK\nJoCOCnZo6a3j4NqJvXD5GNqGSP6m1lqBRWYQUIhWaOfz8aTY1Z3EXX0/4tv5C+A/\nknhc694ujtmBXio4XgDIrSz3jr9G8+ZLvig88xV12HTJfsatypQdHVIZj08EeR/S\nWAG872Q/DVD/aDmhaOlq/o/QBoEyrnJdkRHT9NX8iBboQ81wezfJxWUWlWyHaXVq\n5YBLFQvQAZLz3h05EBkMOiS2dHUa8OnNImj8txnCePAlcUdv7LIVxHA=\n=9APA\n-----END PGP MESSAGE-----",
+				"fp": "aef8d6c7e4761fc297cda833df13aebb1011b5d4"
+			}
+		],
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.9.2"
+	}
+}
--- a/machines/fanny/secrets.yaml
+++ b/machines/fanny/secrets.yaml
@@ -5,63 +5,63 @@ sops:
    azure_kv: []
    hc_vault: []
    age:
-        - recipient: age136sz3lzhxf74ryruvq34d4tmmxnezkqkgu6zqa3dm582c22fgejqagrqxk
+        - recipient: age14dpm6vaycd6u34dkndcktpamqgdyj4aqccjnl5533dsza05hxuds0tjfnf
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2ZFBYMHMzTFRMLzhCbnBE
-            MXkreklWSUVOckl5OTJ0VzlWS2tIOFBRRVVJCk90OXJoMHQza0hTSGt5VUphNjY1
-            MkFrTHQwTHJNSGZjT2JOYXJLWExwQTQKLS0tIHlTeVgvRlU0MXA3cUl2OE9tYUls
-            TStjbTBkMTNOcHBja0JRYUdvSWJUN00KtOPBH8xZy/GD9Ua3H6jisoluCR+UzaeE
-            pAWM9Y6Gn6f7jv2BPKVTaWsyrafsYP7cDabQe2ancAuuKvkng/jrEw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCTmdrV1IyM2hldloxM3Zh
+            cGVIZmtCZ0FLTEQxcFBLaVh0VXUwNWVGR1hBCnJ6SHpzckh5VVduM0Z2dkh2WHdy
+            WGxRV0JFZTdqcWgzUFlSZkowZElJd2MKLS0tIGxYL0orSVdmZzJBSEIvRUNDUVlK
+            RWFLOWp4TVJBM3llS0lmQlBUQ2ZQNkUKEz/dXR0tkVeyC9Oxai5gZEAhRImdL1FL
+            2LdVRiCt3MqR9wtfw1/pR7166Bx8nLIN42uWh2YU5j0/0rXNq+I6Qg==
            -----END AGE ENCRYPTED FILE-----
        - recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhc282T2VVamFGcG1Ub3hp
-            S1VwKzVsWW1sRXczZnRNdkxDWE5Sd0hhVUJRCkovNGZ1ZlN0c1VyMXV0WThJMGFi
-            QVM3WW5Eam81dWpGaFd3bm80TmtQSlUKLS0tIFFSUy9SYWdKeE5KWk0yZld5dDYy
-            QVZyNWVOMTh3ejBha21Qb2xCRkFERGMKH9nMQUoS5bGcLUx2T1dOmKd9jshttTrP
-            SKFx7MXcjFRLKS2Ij12V8ftjL3Uod6be5zoMibkxK19KmXY/514Jww==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoQW5OU2FiNStkazFRRHBK
+            U2kzNkpWRDVQTDBkTFFNWnREcjh6NlhmRnhZCkxMYlZhcUlGUnN3QWFzbVkyYlpX
+            eWZaOUxsUCtZYmx0U29ZckFaMjNLTFEKLS0tIExxV0REL3MwUTZpMkgxYlZMc0JS
+            cTNEYTBGT3VRaDI1eUhucnd5d2JhTWMKNZlkUjxX2QTFoiCWPzz62jz4kK8d5rW/
+            MJ1w69Qve7lsUAg74YlFF7i/yYSZZkHoRMs92lRmq3lHlbK6aaUMTw==
            -----END AGE ENCRYPTED FILE-----
    lastmodified: "2025-01-14T12:41:07Z"
    mac: ENC[AES256_GCM,data:RJ4Fa8MmX8u8S3zrD/SaywTC3d2IfHQPBDy3C9u4GuXJ/ruEChAB1kN8rqMPvkmET8UUgHIEp7RpbzMtg/FOmKYKYTTx5t//3/VozvAEZurhG/4mnN3r6uaZ0R9+wSjym8IyOKsJ7p4XrfE5tRdzNyU4EqfkEiyf+jO751uSnYI=,iv:eiTdmbcrpUvyDPFmGawxJs/ehmD7KqulaoB+nfpC6ko=,tag:+TKr53cFS3wbLXNgcbZfJQ==,type:str]
    pgp:
-        - created_at: "2025-02-11T18:32:49Z"
+        - created_at: "2025-01-14T12:32:13Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----

-            hQGMA5HdvEwzh/H7AQwAmorRyo7mguHQxATRRuKstaXertmyz2AhKFr1Kr880vBJ
-            ODjEKmkH77wIpOnZjOYrx7j2JWosoJ1KgsUUh4VlAPM3O6cXVwqDucu1d8O/HzK3
-            RPuPfTKDr/lKl7QyQCx5lQuxE1/qn88D/g/fMQYu3NAVJa7acpTdSsfyo9nZ3QMb
-            ly6YEyGDc/IhBy5igc7bIWy1o+XATmyUxA+jZVMLiBKhetogMC507Eq71tUCMEht
-            CItRoFFPeoCzC8JPjpQNQmXoe5WDv3hzWpUBRJgjScYz3JuEfakbsAnzrPc41Mga
-            yPhSPYPBtHlEt+DntW9i/CFLEJ+I0V+uz3gnNtNdHTIIe2AZbGympjZldZThldb3
-            Tupo7ep6VQgi+hG37wLmQdvSVWR8lVJDMvOmV9xZqdFYfQdBr2gewTT6Y2QCc8GZ
-            HBtJASlpIbydd/rtLtaTwtdOz64g+F5Vw/6T3ciyExt6RCoPALqZCoyzQnvnQm7e
-            JPPauAs8BH8ejoDlJYjK0lgBBMSJTZ2xlGYh4wG8zmGtGok2wvXYy+DeqlXuCIy6
-            7Xu4BLTL9eOZZo0sPR+RQfYbII0zMIc2fPBtU2c2z89YOTI44FI0BVbTlhLIIXXz
-            NJMDln08MWwr
-            =hhKC
+            hQGMA5HdvEwzh/H7AQv/YM4JBfaFngZt0SmMP3fBCodQXWnWMjy5VYoTOKKaOfG8
+            5GRTf+o1stsru3EKImh5PTqniRO6UH+/DOKBY8zHsy9lXojGka3uPJRKv7JUD5YO
+            8NjlHwwg+jcQN/qtrWc+1D69zR1aO/6yxfgujL3r/fJ4reqtSNfkVYVy2lEcw2ZN
+            zhlN+fBxZCyHyUTKLcXrG7Fg8BRudjwBnIsBTLAVFkWg0bnlq38vicGpF5CHsRjA
+            cTPq2D9ev888WKHcjFcXYqxeKkXkqBuOOMlCHQyJCv8HHfA/GY+pBQfiVmvSt77O
+            /MA8hVYl8G4tRFsbUdZzqtPbAsLy30w1e9dpsD2M6tD55V2RNUCrznB2lo0uXZ24
+            9MUnad+NQdntbe5B2OBUF/MNKZ9/tC+B9pBm7Tx3rxSELytGuQF11x4EyLwn+Ict
+            iBBV5P3RiulxLW6MbDs+7JPILfcMfg6e8q+GY1dnIPZrs8Qf5W60FxbOYYiMvJ9k
+            UtnZAixVdlpkAsQz/t630lgBX9DLYjEVgaxC+zqtRjfHkoyvGIac6cgHDX/fBs7p
+            Woud0RbwffhOhaIF47Z2W4UPfn5Mtcu63fQpjCM9urk9asaRPeNDTeEYVjqSZD6N
+            J+o9dahBHvIF
+            =GKm4
            -----END PGP MESSAGE-----
          fp: c4639370c41133a738f643a591ddbc4c3387f1fb
-        - created_at: "2025-02-11T18:32:49Z"
+        - created_at: "2025-01-14T12:32:13Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----

-            hQIMA98TrrsQEbXUAQ//cBdyq4JxOhU9t7Z9iWAp2DRObgv7HMbhIXh1351wuzA7
-            Fe0Kqcoo/ekCkIPrLZOC5z4CMjXwOCPSncMMm5vK5ibixTlX9446+Hv7AQ1vq2Nt
-            2daL8ZzpCeCJmi07Vyp72/NJOZYa6YY/gFiiRw044lNLFS//b0sYkipne5COjvca
-            I7BxWCpGwLLWZ7LNKhg6i0at+0AqEdBDiwSE7jfeY6IL9tPOIqmBxYIWMbiAkPMd
-            /nK8PVPrt41NkJkuxfjXcYowJRcJmAYHGiRUQaAkUZyRQxmolbLwwJ+/CVYxv5Kk
-            hN5QvT82z5I8gK5LXrt3ZGEcC9dADkRSQr/qcWQT+CEnsGZi8b0unwUZZruDVb7d
-            eIwICaXu62gH/mlJN1z/J5jEciwQtC9Eh932x5qY3sdtd6Gm7/EHTf9NJ9Zg3gTk
-            nfytwpfUmtJO/bI5RvYSUkXkU6CLY6bqRW12+YrsAP+vDITYcLVEJGt7jrXDFto2
-            Z9rlywZsQiZhLrzi1UImCTthcceI6Hd7l3TOYV84gMxdahBo3FLKnoZRK2I7ukGq
-            Wi0KjajcsJ6LBUCCpMg/tW+TT8/+66QY9BDzcv/hBdRc4lCKNeKDwwGFPSFZCcib
-            uyT8UB6iUYVMiNSHRqdGGcH0NwH45Oe2g9nF/lrJ0vYw1toN3WSpEc5v/Nch8DbS
-            WAE3DazXQgd4UQ19q+5cC+L5POWcAjgWpZlRwBXBRdeOKFDF9maCPL6MpfMm6XG1
-            /JNfzhipjL5OXgJgK7iUFJlH9AuD18g/by7yID0bTsg2fkfLglwjfm8=
-            =Sdch
+            hQIMA98TrrsQEbXUARAAmD4PfLpRVUXTo5yyS9LSs5vmEvnCmNc0ad4Oiv7YAxhs
+            W7SCKHq2zOfGIeZZHP0wjRnJELwMCVLy4dVo/slDHCiy8T4MZXaYR04ZaJJ+OHrF
+            e5xxAA6FjipufvxgRZvLhDj+g+RaX2TuxdL9gFSVS81rvEpSRDnydt2O/6G4SGBR
+            GO5b176eMerrqOqRLL5Ou4b6oitagvRwZzOXQ+YonKZz3STlyXRMgWxeFTDK9T/q
+            yYOwPVAOU1jhYzUjHNAYCp3CH4ERScrO7AwomAWH+Fe48WRbg2ebdqRnuv/Vl4PM
+            wc5DQcCIIIIENMGIYOzUo1KrfQlevzXF/mbgAgo/uVuRl3Y3lCRAcZBQOtUCF5Ap
+            FhsO87EMXlZWj3bv08f21t3hQztfuaHIqFpCbSIGgmiE9cAY0cOtCYpJfCYdV7iT
+            cOElJgYRbAsAbFC9wTQWEvwIxrgnCIrkCg1bzP5KNLG1K+ae5J7qN77qeTQw2/ul
+            QDDUUNnzjes562t+/xFLQa/bust1Y8pAYn1s1LEBol1hLX4Igonlkw303UPjZOI2
+            MyH5hOh0hNUReuOpHpre/pYquE8Dd27XKAHfJsSd3ZLJG5+1Msw23lIsptgovNrB
+            5VRvPj8WPojiDHqN27kt/IuayN3TeoJFjmAjkoFjlyKTcs+b6cDkxUw3LcP+6NjS
+            WAHQI0pWTa5zD8UPow4DHxteP4jW/6ddBfJ1Vz1scqKMXYvxFkRqZvn3uAJOtcuw
+            CgQ4CXE43n4G7g5gvWl6ZFW8tdXR7Sw+USnHR/9oS9fV0rHcxxDFEfE=
+            =9FN4
            -----END PGP MESSAGE-----
          fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4
    unencrypted_suffix: _unencrypted
--- a/machines/hosts.nix
+++ b/machines/hosts.nix
@@ -1,75 +0,0 @@
-{ ... }:
-
-{
-  malobeo = {
-    hosts = {
-      louise = {
-        type = "host";
-      };
-
-      bakunin = {
-        type = "host";
-      };
-
-      fanny = {
-        type = "host";
-      };
-
-      lucia = {
-        type = "rpi";
-      };
-
-      durruti = {
-        type = "microvm";
-        network = {
-          address = "10.0.0.5";
-          mac = "52:DA:0D:F9:EF:F9";
-        };
-      };
-
-      vpn = {
-        type = "microvm";
-        network = {
-          address = "10.0.0.10";
-          mac = "D0:E5:CA:F0:D7:E6";
-        };
-      };
-
-      infradocs = {
-        type = "microvm";
-        network = {
-          address = "10.0.0.11";
-          mac = "D0:E5:CA:F0:D7:E7";
-        };
-      };
-
-      uptimekuma = {
-        type = "microvm";
-        network = {
-          address = "10.0.0.12";
-          mac = "D0:E5:CA:F0:D7:E8";
-        };
-      };
-
-      nextcloud = {
-        type = "microvm";
-        network = {
-          address = "10.0.0.13";
-          mac = "D0:E5:CA:F0:D7:E9";
-        };
-      };
-
-      overwatch = {
-        type = "microvm";
-        network = {
-          address = "10.0.0.14";
-          mac = "D0:E5:CA:F0:D7:E0";
-        };
-      };
-
-      testvm = {
-        type = "host";
-      };
-    };
-  };
-}
--- a/machines/infradocs/configuration.nix
+++ b/machines/infradocs/configuration.nix
@@ -1,4 +1,4 @@
-{ self, config, lib, pkgs, inputs, ... }:
+{ config, lib, pkgs, inputs, ... }:

 with lib;

@@ -9,18 +9,16 @@ with lib;
  };

  imports = [
-    inputs.malobeo.nixosModules.malobeo.metrics
    ../durruti/documentation.nix
    ../modules/malobeo_user.nix
    ../modules/sshd.nix
  ];

-  malobeo.metrics = {
-    enable = true;
-    enablePromtail = true;
-    logNginx = true;
-    lokiHost = "10.0.0.14";
-  };
+  networking.firewall.allowedTCPPorts = [ 9002 ];
+
+  malobeo.metrics.logNginx = lib.mkForce true;
+
+  users.users.promtail.extraGroups = [ "nginx" "systemd-journal" ];

  system.stateVersion = "22.11"; # Did you read the comment?
 }
--- a/machines/lucia/configuration.nix
+++ b/machines/lucia/configuration.nix
@@ -6,7 +6,6 @@ in
 {
  imports =
    [ # Include the results of the hardware scan.
-      ./hardware_configuration.nix
      ../modules/malobeo_user.nix
    ];

--- a/machines/modules/disko/btrfs-laptop.nix
+++ b/machines/modules/disko/btrfs-laptop.nix
@@ -0,0 +1,63 @@
+{ config, self, inputs, ... }:
+
+{
+  imports = [
+    inputs.disko.nixosModules.disko
+  ];
+
+  # https://github.com/nix-community/disko/blob/master/example/luks-btrfs-subvolumes.nix
+  disko.devices = {
+    disk = {
+      main = {
+        type = "disk";
+        # When using disko-install, we will overwrite this value from the commandline
+        device = "/dev/disk/by-id/some-disk-id";
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              size = "512M";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [ "umask=0077" ];
+              };
+            };
+            luks = {
+              size = "100%";
+              content = {
+                type = "luks";
+                name = "crypted";
+                passwordFile = /tmp/secret.key; # Interactive
+                content = {
+                  type = "btrfs";
+                  extraArgs = [ "-f" ];
+                  subvolumes = {
+                    "/root" = {
+                      mountpoint = "/";
+                      mountOptions = [ "compress=zstd" "noatime" ];
+                    };
+                    "/home" = {
+                      mountpoint = "/home";
+                      mountOptions = [ "compress=zstd" "noatime" ];
+                    };
+                    "/nix" = {
+                      mountpoint = "/nix";
+                      mountOptions = [ "compress=zstd" "noatime" ];
+                    };
+                    "/swap" = {
+                      mountpoint = "/.swapvol";
+                      swap.swapfile.size = "20M";
+                    };
+                  };
+                };
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+}
--- a/machines/modules/disko/default.nix
+++ b/machines/modules/disko/default.nix
@@ -102,7 +102,7 @@ in
                    mountOptions = [ "umask=0077" ];
                  };
                };
-                encryptedSwap = lib.mkIf cfg.encryption {
+                encryptedSwap = {
                  size = cfg.root.swap;
                  content =  {
                    type = "swap";
@@ -187,7 +187,6 @@ in
              postCreateHook = lib.mkIf cfg.encryption ''
                zfs set keylocation="prompt" zroot/encrypted;
              '';
-
            };
            "encrypted/root" = {
              type = "zfs_fs";
@@ -245,16 +244,13 @@ in
              };
              # use this to read the key during boot
              postCreateHook = lib.mkIf cfg.encryption ''
-                zfs set keylocation="file:///root/secret.key" storage/encrypted;
+                zfs set keylocation="prompt" storage/encrypted;
              '';
            };
            "encrypted/data" = {
              type = "zfs_fs";
              mountpoint = "/data";
-            };
-            "encrypted/data/microvms" = {
-              type = "zfs_fs";
-              mountpoint = "/data/microvms";
+              options.mountpoint = "legacy";
            };
            reserved = {
              # for cow delete if pool is full
@@ -271,7 +267,7 @@ in
    };

    boot.zfs.devNodes = lib.mkDefault cfg.devNodes;
-    boot.zfs.extraPools = lib.mkIf cfg.storage.enable [ "storage" ];
+
    fileSystems."/".neededForBoot = true;
    fileSystems."/etc".neededForBoot = true;
    fileSystems."/boot".neededForBoot = true;
--- a/machines/modules/host_builder.nix
+++ b/machines/modules/host_builder.nix
@@ -1,250 +0,0 @@
-{ self
-, nixpkgs-unstable
-, nixpkgs
-, sops-nix
-, inputs
-, hosts
-, ...
-}:
-let
-  pkgs = nixpkgs.legacyPackages."x86_64-linux";
-in
-rec {
-  nixosSystem = nixpkgs.lib.makeOverridable nixpkgs.lib.nixosSystem;
-  nixosSystemUnstable = nixpkgs-unstable.lib.makeOverridable nixpkgs-unstable.lib.nixosSystem;
-
-  baseModules = [
-    # make flake inputs accessiable in NixOS
-    { _module.args.inputs = inputs; }
-    {
-      imports = [
-        ({ pkgs, ... }: {
-          nix = {
-            extraOptions = ''
-              experimental-features = nix-command flakes
-            '';
-
-            settings = {
-              substituters = [
-                "https://cache.dynamicdiscord.de"
-                "https://cache.nixos.org/"
-              ];
-              trusted-public-keys = [
-                "cache.dynamicdiscord.de:DKueZicqi2NhJJXz9MYgUbiyobMs10fTyHCgAUibRP4="
-              ];
-              trusted-users = [ "root" "@wheel" ];
-            };
-          };
-        })
-
-        sops-nix.nixosModules.sops
-      ];
-    }
-  ];
-  defaultModules = baseModules;
-
-  makeMicroVM = hostName: ipv4Addr: macAddr: modules: [
-    {
-      microvm = {
-        hypervisor = "cloud-hypervisor";
-        mem = 2560;
-        shares = [
-          {
-            source = "/nix/store";
-            mountPoint = "/nix/.ro-store";
-            tag = "store";
-            proto = "virtiofs";
-            socket = "store.socket";
-          }
-          {
-            source = "/var/lib/microvms/${hostName}/etc";
-            mountPoint = "/etc";
-            tag = "etc";
-            proto = "virtiofs";
-            socket = "etc.socket";
-          }
-          {
-            source = "/var/lib/microvms/${hostName}/var";
-            mountPoint = "/var";
-            tag = "var";
-            proto = "virtiofs";
-            socket = "var.socket";
-          }
-          {
-            source = "/var/lib/microvms/data/${hostName}";
-            mountPoint = "/data";
-            tag = "data";
-            proto = "virtiofs";
-            socket = "microdata.socket";
-          }
-        ];
-
-        interfaces = [
-          {
-            type = "tap";
-            id = "vm-${hostName}";
-            mac = "${macAddr}";
-          }
-        ];
-      };
-
-      systemd.network.enable = true;
-      
-      systemd.network.networks."20-lan" = {
-        matchConfig.Type = "ether";
-        networkConfig = {
-          Address = [ "${ipv4Addr}/24" ];
-          Gateway = "10.0.0.1";
-          DNS = ["1.1.1.1"];
-          DHCP = "no";
-        };
-      };
-    }
-  ] ++ defaultModules ++ modules;
-
-  inputsMod = inputs // { malobeo = self; };
-
-
-    vmMicroVMOverwrites = hostname: options: {
-      microvm = rec {
-        mem = pkgs.lib.mkForce 4096;
-        hypervisor = pkgs.lib.mkForce "qemu";
-        socket = pkgs.lib.mkForce null;
-
-
-        #needed for hosts that deploy imperative microvms (for example fanny)
-        writableStoreOverlay = pkgs.lib.mkIf options.writableStore "/nix/.rw-store";
-        volumes = pkgs.lib.mkIf options.writableStore [ {
-          image = "nix-store-overlay.img";
-          mountPoint = writableStoreOverlay;
-          size = 2048;
-        } ];
-
-        shares = pkgs.lib.mkForce (pkgs.lib.optionals (!options.writableStore) [
-          {
-            tag = "ro-store";
-            source = "/nix/store";
-            mountPoint = "/nix/.ro-store";
-          }
-        ] ++ pkgs.lib.optionals (options.varPath != "") [
-          {
-            source = "${options.varPath}";
-            securityModel = "mapped";
-            mountPoint = "/var";
-            tag = "var";
-          }
-        ]);
-
-        interfaces = pkgs.lib.mkIf (!options.withNetworking) (pkgs.lib.mkForce [{
-          type = "user";
-          id = "eth0";
-          mac = "02:23:de:ad:be:ef";
-        }]);
-
-        #if networking is disabled forward port 80 to still have access to webservices
-        forwardPorts = pkgs.lib.mkIf (!options.withNetworking && options.fwdPort != 0) (pkgs.lib.mkForce [
-          { from = "host"; host.port = options.fwdPort; guest.port = 80; }
-        ]);
-
-      };
-
-      fileSystems = {
-        "/".fsType = pkgs.lib.mkForce "tmpfs";
-
-        # prometheus uses a memory mapped file which doesnt seem supported by 9p shares
-        # therefore we mount a tmpfs inside the datadir
-        "/var/lib/prometheus2/data" = pkgs.lib.mkIf (hostname == "overwatch" && options.varPath != "") (pkgs.lib.mkForce {
-          fsType = pkgs.lib.mkForce "tmpfs";
-        });
-      };
-
-      boot.isContainer = pkgs.lib.mkForce false;
-      services.timesyncd.enable = false;
-      users.users.root.password = "";
-      services.getty.helpLine = ''
-        Log in as "root" with an empty password.
-        Use "reboot" to shut qemu down.
-      '';
-    };
-
-    vmDiskoOverwrites = {
-      boot.initrd = {
-        secrets = pkgs.lib.mkForce {};
-        network.ssh.enable = pkgs.lib.mkForce false;
-      };
-
-      malobeo.disks.enable = pkgs.lib.mkForce false;
-      networking.hostId = "a3c3101f";
-    };
-
-    vmSopsOverwrites = host: {
-      sops.defaultSopsFile = pkgs.lib.mkForce ../${host}/dummy.yaml;
-
-      environment.etc = {
-        devHostKey = {
-          source = ../secrets/devkey_ed25519;
-          mode = "0600";
-        };
-      };
-
-      services.openssh.hostKeys = [{
-        path = "/etc/devHostKey";
-        type = "ed25519";
-      }];
-    };
-
-    vmNestedMicroVMOverwrites = host: sopsDummy: {
-
-      services.malobeo.microvm.deployHosts = pkgs.lib.mkForce [];
-      microvm.vms = 
-      let
-        # Map the values to each hostname to then generate an Attrset using listToAttrs
-        mapperFunc = name: { inherit name; value = {
-          specialArgs.inputs = inputsMod;
-          specialArgs.self = self;
-          config = {
-            imports = (makeMicroVM "${name}" 
-                                   "${hosts.malobeo.hosts.${name}.network.address}"
-                                   "${hosts.malobeo.hosts.${name}.network.mac}" [
-              ../${name}/configuration.nix     
-              (vmMicroVMOverwrites name { 
-                withNetworking = true; 
-                varPath = ""; 
-                writableStore = false; })
-              (if sopsDummy then (vmSopsOverwrites name) else {})
-            ]);
-          };
-        }; };
-      in
-      builtins.listToAttrs (map mapperFunc self.nixosConfigurations.${host}.config.services.malobeo.microvm.deployHosts);
-    };
-
-    buildVM = host: networking: sopsDummy: disableDisko: varPath: writableStore: fwdPort: (self.nixosConfigurations.${host}.extendModules {
-        modules = [
-            (vmMicroVMOverwrites host { 
-              withNetworking = networking; 
-              varPath = "${varPath}"; 
-              writableStore = writableStore;
-              fwdPort = fwdPort; })
-            (if sopsDummy then (vmSopsOverwrites host) else {})
-            (if disableDisko then vmDiskoOverwrites else {})
-          ] ++ pkgs.lib.optionals (hosts.malobeo.hosts.${host}.type != "microvm") [
-            inputs.microvm.nixosModules.microvm
-          ] ++ pkgs.lib.optionals (self.nixosConfigurations.${host}.config ? services.malobeo.microvm.deployHosts) [
-            (vmNestedMicroVMOverwrites host sopsDummy)
-        ];
-      });
-
-  buildHost = hosts: (builtins.mapAttrs (host: settings: nixosSystem {
-    system = if (settings.type == "rpi") then "aarch64-linux" else "x86_64-linux";
-    specialArgs.inputs = inputsMod;
-    specialArgs.self = self;
-    modules = (if (settings.type != "microvm") then
-      defaultModules ++ [ ../${host}/configuration.nix ]
-      else
-      makeMicroVM "${host}" "${settings.network.address}" "${settings.network.mac}" [
-        inputs.microvm.nixosModules.microvm
-        ../${host}/configuration.nix
-      ]);
-  }) hosts);
-}
--- a/machines/modules/malobeo/initssh.nix
+++ b/machines/modules/malobeo/initssh.nix
@@ -30,7 +30,9 @@ in
      loader.efi.canTouchEfiVariables = true;
      supportedFilesystems = [ "vfat" "zfs" ];
      zfs = {
+        forceImportAll = true;
        requestEncryptionCredentials = true;
+        
      };
      initrd = {
        availableKernelModules = cfg.ethernetDrivers;
--- a/machines/modules/malobeo/microvm_host.nix
+++ b/machines/modules/malobeo/microvm_host.nix
@@ -86,6 +86,12 @@ in
    in
    builtins.listToAttrs (map mapperFunc cfg.deployHosts);

+    systemd.tmpfiles.rules = builtins.concatLists (map (name: [
+      "d /var/lib/microvms/${name}/var 0755 root root - -"
+      "d /var/lib/microvms/${name}/etc 0755 root root - -"
+      "d /${name} 0755 root root - -"
+    ]) cfg.deployHosts);
+
    systemd.services = builtins.foldl' (services: name: services // {
      "microvm-update@${name}" = {
        description = "Update MicroVMs automatically";
--- a/machines/modules/malobeo/peers.nix
+++ b/machines/modules/malobeo/peers.nix
@@ -30,13 +30,6 @@
    publicKey = "TrJ4UAF//zXdaLwZudI78L+rTC36zEDodTDOWNS4Y1Y=";
  };

-  "hetzner" = {
-    role = "client";
-    address = [ "10.100.0.6/24" ];
-    allowedIPs = [ "10.100.0.6/32" ];
-    publicKey = "csRzgwtnzmSLeLkSwTwEOrdKq55UOxZacR5D3GopCTQ=";
-  };
-
  "fanny" = {
    role = "client";
    address = [ "10.100.0.101/24" ];
--- a/machines/nextcloud/configuration.nix
+++ b/machines/nextcloud/configuration.nix
@@ -1,4 +1,4 @@
-{ config, self, lib, pkgs,  ... }:
+{ config, lib, pkgs,  ... }:

 with lib;

@@ -17,27 +17,18 @@ with lib;
  };

  imports = [
-    self.nixosModules.malobeo.metrics
    ../modules/malobeo_user.nix
    ../modules/sshd.nix
    ../modules/minimal_tools.nix
    ../modules/autoupdate.nix
  ];

-  malobeo.metrics = {
-    enable = true;
-    enablePromtail = true;
-    logNginx = true;
-    lokiHost = "10.0.0.14";
-  };
-
  services.nextcloud = {
    enable = true;
    package = pkgs.nextcloud30;
    hostName = "cloud.malobeo.org";
    config.adminpassFile = config.sops.secrets.nextcloudAdminPass.path;
    #https = true; #disable for testing
-    datadir = "/data/services/nextcloud/";
    database.createLocally = true;
    config.dbtype = "pgsql";
    configureRedis = true;
@@ -47,7 +38,7 @@ with lib;
    };
    extraAppsEnable = true;
    extraApps = {
-      inherit (config.services.nextcloud.package.packages.apps) contacts calendar deck polls;
+      inherit (config.services.nextcloud.package.packages.apps) contacts calendar;
      collectives = pkgs.fetchNextcloudApp {
        sha256 = "sha256-cj/8FhzxOACJaUEu0eG9r7iAQmnOG62yFHeyUICalFY=";
        url = "https://github.com/nextcloud/collectives/releases/download/v2.15.2/collectives-2.15.2.tar.gz";
@@ -56,12 +47,6 @@ with lib;
    };
    settings = {
      trusted_domains = ["10.0.0.13"];
-      "maintenance_window_start" = "1";
-      "default_phone_region" = "DE";
-    };
-    phpOptions = {
-      "realpath_cache_size" = "0";
-      "opcache.interned_strings_buffer" = "23";
    };
  };

--- a/machines/nextcloud/secrets.yaml
+++ b/machines/nextcloud/secrets.yaml
@@ -8,61 +8,72 @@ sops:
        - recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4dCt1ZFR0QnRqVFdiL0Zi
-            VTR6Zy9ZTy9YNDBZaDRTZzJnU2ZKcjJ0MG1vCldpRU5tTzc1YU5KbjlDbXlNRjBU
-            Sm8yc0oyNWU1WHJoYTRvK3o4aGtTY2MKLS0tIE9wY0R0V3Vkc3Y1T1YwTkFTY0J5
-            ZCtzbVdtNlh0cXpra2RWbEwzUDM0UjgKY3zZn5PUWuLBQgYxm9BUpLYWw3CdXYA8
-            4U6OVdRF6foj4/GrKKyhVf8dMbLbkhPvxqZ5wg40o6bwHEw9QNM+5Q==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1z0cfz7l4vakjrte220h46fc05503506fjcz440na92pzgztlspmqc8vt6k
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQbDZaYjRTTDc0SFU2U2xQ
-            cUhESStvKzM5Z0QyZlJldURtRUJZTHhvNEFrCmxReGJ6MU9qdkh6UFVPYmRuQThs
-            VmVCMTQwc0xkR0gzemlSUVlnN0NCZE0KLS0tIDFtK041ZlF4VFBreHVacitSVEN5
-            WXg4UkJtU2dTR3ZjeFYzR3lRODhLYzgKrO+NtT0Q3K8FgDwW0WiZJOUHwkEz+wp8
-            lgBkXy2QJuuJ11f2e9ZJ3hx1xgOm6SMBmgl3zQVfVpq88yZE8uDe2Q==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmVGxsNmZ3Z0RIYmMyL0Mr
+            UUpaMEZLTCtQaGFrL1YwOVBicEtNRTVaVGhRCmhDSUgxYXpRcldaMngvOWJDdnNo
+            b2ZFbUdmcE9EV2E3SkMvZ1RpKzZmeU0KLS0tIE5hNmVFTXpBZFZ3bHYwQlJQaUtw
+            UFJmTVFaOTJXN09QLzY4emh5Z3hqRjAKXk1PSwR2x0H2cMN06fyigiusz8v2IRIg
+            S4ZTq/JX39U4QQHgWA1dFPfC636LNBo+QKdl/2mjwnXW7duqDJ+5kA==
            -----END AGE ENCRYPTED FILE-----
    lastmodified: "2024-11-26T20:00:50Z"
    mac: ENC[AES256_GCM,data:qoY9SfpoU+8HfvD5v/1S6BOkbnZUmHIbtwr0tTSuPETjnFNgr1VVw9mnRatJKPYYFb9/rMZQWIqTY+iUIEkcTVyVXhd6ki5CHW+uxCeBIyMzq33rtEa/btkEUoii4iPieamBCIY21W0znE+edxfR04yRJtLxMICEbuW4Hjf6bwk=,iv:nG42fRgjpuIjPMYnn/6egEdzYolcUBsspaZ8zMv4888=,tag:C6apGoAvVLsWdLWSCwrx6w==,type:str]
    pgp:
-        - created_at: "2025-02-06T12:36:59Z"
+        - created_at: "2024-11-26T19:59:36Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----

-            hQGMA5HdvEwzh/H7AQv8DLbU8OaQmYtAjTPlqeg1nv+/z3gA16MTZjz8rRBqK695
-            JaEbWoCJ2Nv5Mnzj7owQSk/+f+Q/d00osr4KOhQWTNoq1442MyWgIXKGPDmHgXv8
-            CxFT3hIKMEFFvFtkSdo+HlBSTQJZtHgDSGabd2xd4e45tLnHsPvWQ4ngGn+piUaw
-            qz5+YIpmFNlnL9ubsB8NivryXlIL6wBXL83FyfAPnY+qG0/7frVWwP1Cejg1CGYl
-            bOYxgb1uPYIIqvvU9bZ4r46DfojFFGur9pwG/wKGOgIQ867vsXtRnNm6+SJIHeyt
-            eNqil3tee++V4VVUrDTf+gWufx9YFS/afRgMKuf1pUvQGTBMbUJNhIp+PjpOSBCk
-            Kk6uyMWrBhiCpAVU9GKFW1AbDBCgUig2sLIUGOrfb+RkzDLX4pEoa9DVVDC2pRVy
-            F2fjEEbPAZepsPFNbgDyaixv+FeA5oWWiBnA7qO/v8t142UOtqBcexUZjBYYgRmt
-            c0S+lTk//xEip9wYvY6W0lgBOLqEUEiLg1tw0xvt9H4R9aGNLkCyvUediwuAbfw4
-            bGha9PTckYpnKN589xxsDMqbQ0Vn/rxeSzC7RT+qtjUg1gDbDJQTZdYr0+//e0YV
-            xRvlnfPW9voB
-            =xqAk
+            hQGMA5HdvEwzh/H7AQv+KkX46UGQzLvhrk/VUCnnMdLEcNbYfk4h+sZJzs1riOGA
+            LAKYNeaeN6iLLeZX+T2/s5OT4WkIEKGg8/gziurdx01BR70M96Faubp6EVtdK44+
+            6F5BLLrDhlEKDNOx48qPwJdFjbYW4wZLWmv5nzwPmmRCKO7MoI9UHKq69msCor1i
+            ralbjlVHyKSuRfvflKAlxFoEqeB6H+ryc54g3stk1j2eFiMNuF/oKDJZT+XI5LHZ
+            Ai80DAWoUBYgpP4aWiNC075GPutdPlZ3mrGf5+7QnNm7GmNUdJN5VAWmI2NUGr1J
+            BLopnPFo4juWNsZkLMj2aAuKvGTkhz2PuFKfLj6Erpu82RAjadpFWx239n+i4Ryq
+            wSquYshpuiecLEejntTBKLEacwp+aPx8IHKnOOKBTdJj+YYaISiznQAlkF7WS+lg
+            MTZR85BvCxiPogujL7uhYSx1wM5FVkuAIPf1JOJCRvQt30eRRrR0VMrmqQ1Kl5OT
+            VMzZRIGIoC5vrKGeIIjJ0lgBWQ3bYFh/LGrwKetku6TRAH29mp/XwQqBC97RsUYb
+            EOxft5sUWaYrXK+z2yzCxOQBWKJISPgcyhdoKfYGnRkHXHi2Uay84oQP4co72eVF
+            cAhEJOxMw36e
+            =bSaN
            -----END PGP MESSAGE-----
          fp: c4639370c41133a738f643a591ddbc4c3387f1fb
-        - created_at: "2025-02-06T12:36:59Z"
+        - created_at: "2024-11-26T19:59:36Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----

-            hQIMA98TrrsQEbXUARAAqGyBZLrJ1UpiJKIbQSTQpKA7bRD7olMczjh0Bx1fTN0U
-            bctdfIGVvdp5pM1C6xbvubNqAMEisQ1tMVozDkXCnLARTwcaq6lyE9vl3gJ1iF1Z
-            N8SbxVTYV1SXg3qokyBsZIggQ6gJqAr62Pyoansp4HfwwFwYohwR2zTfHJ8pFkkW
-            R2FfEI2Gw5nN4GaauIxUGFDPuvvZapCWZ/ejt4s/ezT9cYrwYfu9XIlqsivsi3yp
-            I03ohKS/pKhxlE7RV2ufRboG+m6TUCnyj5U5AzQa09hkSHd94s9A6M8I6M6zWebv
-            pdX73sCjWZQdIZoeM5oXcyY/s/h4/w37loOUE/thh1+hIjybAG0CH31nJkjcdcLg
-            l/fqTLa89JVt37bU9c/hVsx2Bc1cTO7nqhG3kyahkMSLFrsb73yTNn4kOqSKZ7+z
-            189oR0EjNySgRt+M20vjKzhPbjxxQTKlpTE0vho6fEHYRmzPQ3IQbVUbPEbZR64I
-            S+Nk7m95ZV8djaUOwqqU9pwDTvuYIBwhGOY1kefDg1sCCTM8C9RI9sG02HeQpme3
-            bgkO+m4khXeiiIrTAODiyM+GCwx6UcwooUSpu8LZJmhiZtfgMsFdGF3P7ngtoOEQ
-            4cxP231EI/zoMqRyXYrvAovxXndwghG0LGcCAZZL6mNN2xzE6z1gesVWRjXM8inS
-            WAFB7DgLTlY43D4QbhkyZfo6XltYe1g1tcJJraG/HICa7hq5BZn48t/BcacCvsrJ
-            lIkEgOT8gn1SlQbDL+T+3pRNOixGKPNU6Ategoy+Eq0Im3AhE0XO8Ns=
-            =Uvc2
+            hQIMA98TrrsQEbXUARAAmG88ZDt43zj6dCJkYYVj7MGIhIviJzilTvX4+EfNobtA
+            tll60GYfRotKnwbuqzSVaaIcV+6cDQ5I1hG5WNFJSXm7DpJ0W1Ir1x2hpxektXFa
+            fQ+9HiCOfEqUu5PEynCAD1jN6CQLdl87hLQx9TqbZnHuUYPSH1o9Y6kbA/Vp3bpy
+            evJc8qa66WHYH1kjdEw+qneD5HzZQOLOtXZ7xkxjGbyMcYex9JfyGHohO5dpLg6B
+            3XrLlIWWERVz04MlnzlaMKfzhoMCU9ByqJSQ3VBm9kblQqu54fOZD2sN8j9ACEfL
+            YNC7Jm2rasVSqv09G1kso9/VNDw3kNCLvjnpE5rJRP7Ckfj+4FxQN/zPVUwQ1e1k
+            upoQ8MHyf1bJr8vspm/prm9zp+PRRTUwY1Yyts/ffj+CF5ec9M3jr/RSeEAdswsL
+            6dLKBL1LuLAjKXOuVnQ7E6gN940Y994sDFkbqEmzzCUHGcfxSF3IDn/qpkQlqerU
+            B/D43Yef+rtsUDyTA5RUpxKleGORcS4sV0BhQrNXeFclaMTyMr+AbOei4Y77qlD1
+            x/fHB3IT4Intvp9k4m6jJ86RtLpVhEoA4cHEdCCiXHzUpA6aVtNHVAOqT/aBykrf
+            uSm1wu/nl6yKbIwTJueli1OfQYKEYcUdjOrEOwXb+UDQKSohWZrMg0sj7/S6Pl/S
+            WAG1BZ20HXD2ZrVqESV87Pl04nKMqswrio+BINfAT9X3ya7L3DF69MR18bDt+ZIB
+            0F3+9WUREGI5in4S3hXNxrgfLNFl1YLklfWLYcx0HXJN3z6F2eJOUvM=
+            =aT3U
            -----END PGP MESSAGE-----
          fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4
+        - created_at: "2024-11-26T19:59:36Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA1kR3vWkIYVnARAAqFyuCtvu6AidWg/9+btEcjWv0sBZaIRpYfX3p2QECwCu
+            UYAtssvSHgHdBEQzU27MA/5CGmEreB3NhWrjGquv88RojLO1JuhNHGYPZKeIcBKr
+            I2oS79RKuYs+d2Qu0KUYDaVoY9M5YJsfkju2FOXqMNYlbqX+lDuWnisigj3n2N4e
+            OEBnVIpfPBQE6c1Z9DaQJE7MyBbKfg5YeWjlwwh+fCf1dV/nGp+QdD88F3dzWMoK
+            xNGt69TwZ8JUVmElAIJqLJTpyDI5xHQUw2A6ddPSTk/u363eHhOnZZUNAAm3FdO5
+            0x+4QhcBaH59S8WDZhw4MVmZN7v4+3l3mf7Rx/TXSz4oJg+U7RMgvc291/gowNVm
+            /cVhBlMYz4Ogx/OYR/t+nzq35r+eBungTB+dRXw7qTTfkCtNgp34JMCkGAq5WWnY
+            57H2HtssGiMF0qN4SfWxw7317oUmqHI2XvG0yWt42G++jNgIGbDOtuc/7wATEbhK
+            SBX2aLqDIB1OUwLHQeawyKkB0qGmRSVPkPg8JLwRp43ICETH1WPkY5m/a2slVlDj
+            qgdw00clTI5Fgu/5G5QBD4Ds9f9ZwjrMD4v+NYfGxa0ajisXl1X6CL1+YvQ6Uicf
+            QmIRJYxyVd0VoXScZnsk0T/XTKjJB/fRLRalA2PmlZ1v+gisCUz2dhM+OHtSjGTS
+            WAG5znRbP8UMVt02O0PgbzHYtIUAtQLCuBnzfEKJn721rqCXf7DXU3jrR73Ys6ce
+            VJzkVBMnBszF71GN56t0PaUYIDOnaGvgjMtHHtOCLQHSK7asnm/Bc+E=
+            =Znii
+            -----END PGP MESSAGE-----
+          fp: 4095412245b6efc14cf92ca25911def5a4218567
    unencrypted_suffix: _unencrypted
    version: 3.8.1
--- a/machines/overwatch/configuration.nix
+++ b/machines/overwatch/configuration.nix
@@ -1,4 +1,4 @@
-{ config, self, lib, pkgs, inputs, ... }:
+{ config, lib, pkgs, inputs, ... }:

 with lib;

@@ -9,27 +9,17 @@ with lib;
  };

  imports = [
-    self.nixosModules.malobeo.metrics
    ../modules/malobeo_user.nix
    ../modules/sshd.nix
  ];

-  networking.firewall.allowedTCPPorts = [ 80 3100 ];
-
-  malobeo.metrics = {
-    enable = true;
-    enablePromtail = true;
-    logNginx = false;
-    lokiHost = "10.0.0.14";
-  };
+  networking.firewall.allowedTCPPorts = [ 80 9080 9001 3100 ];

  services.grafana = {
    enable = true;
-    settings.server = {
-      domain = "grafana.malobeo.org";
-      http_port = 2342;
-      http_addr = "127.0.0.1";
-    };
+    domain = "grafana.malobeo.org";
+    port = 2342;
+    addr = "127.0.0.1";

    provision.datasources.settings = {
      apiVersion = 1;
@@ -107,12 +97,6 @@ with lib;
          targets = [ "10.0.0.13:9002" ];
        }];
      }
-      {
-        job_name = "fanny";
-        static_configs = [{
-          targets = [ "10.0.0.1:9002" ];
-        }];
-      }
      # add vpn - check how to reach it first. most probably 10.100.0.1
    ];
  };
--- a/machines/overwatch/loki.yaml
+++ b/machines/overwatch/loki.yaml
@@ -3,7 +3,7 @@ auth_enabled: false
 server:
  http_listen_port: 3100
  grpc_listen_port: 9096
-  log_level: info
+  log_level: debug
  grpc_server_max_concurrent_streams: 1000

 common:
--- a/machines/overwatch/secrets.yaml
+++ b/machines/overwatch/secrets.yaml
@@ -1,59 +0,0 @@
-grafana_admin: ENC[AES256_GCM,data:c+ZnOyxSXrG4eiK8ETKHheadiSz98LLHYwxb,iv:Ut2qFD2p6OmKDWjLMjFxyISxzTdJpZpgIB7obW5bgkY=,tag:HdayzjXQ1Zc7w9ITLzKLxA==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxN1VURXJuMENJV1Z2eEtS
-            bUR2cTNmNUdhU1B4SHZNMW9KRDV2dW5VNmlNCjdmYXpZb05mMEdPdjN4c0VWOUhV
-            RW4vV05CMno1MmJmYzdESjN5MFVFcjQKLS0tIDNxTE1KaW1EVGhtOEQwWXZndk53
-            bFBCMExGdEdMb2Z0TzF0Yk02MUpkN0kKIUm9iUvU/xu1Xl6yoYSVGcIXKnGsp/D/
-            RjVQ7tgJIbrupubny/fg4v2sz5HOs5uzmEq4ZKgBWrBeMPss4gYstA==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-01-22T00:51:32Z"
-    mac: ENC[AES256_GCM,data:TEEyPmVxIJxC49hDqDbwzTZZ/tNymFr0dMvWn6DRli70Kp5XXNCLTpicAbiFh3WoyzbDpN/5c2yxVNGjhB8nXgKpCZdffdONMY6eSCpPbblYwJS7hNsjW+u2wysSFPDAk5apwbNXJcKnlI1tBcGQRHlym9ShSw6fT7K7afWYWqo=,iv:583DWNug8yNF/vZZN4btT6P1yUa0b1UN4frvAX4UKv0=,tag:YI5KIAe5P5Bx0TZU4wG8ag==,type:str]
-    pgp:
-        - created_at: "2025-01-22T00:51:09Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQGMA5HdvEwzh/H7AQv+PxajhJgXHcxwJ7Mk0gjqFV0dGmNJ1m0eY3gPyIS38GSB
-            Rjto1zUd6EARu1GnxSrVrSZYlQaL6x3l2DuFIP7mtymvlFrmhiAoDz/si0zlzsJp
-            WZyQZdepnt9FyYJAwTzbmfVdpZDYajuMI38byMJqzUhS7SEOsPwiU1KRoTHcf4se
-            2E+9v8OwTVT2UoDxyiVJuDAA+K+Jh2RjHk3p/uVnZDqqQpI9UAI8LrCpun9uALpH
-            +29wyhkCZ9RIHU7nDQNVvwHkbYCyRUwR44bciSwITpjp7GuZCcZvzSSimPktkC9q
-            VZkHA6rHgHgcu6mnMfpP0+j4gB0dU0t4hGF41klV3YpEGfYcFIsKV10lfa6aMNmW
-            08RuLdCtnQyplYhgBm1zQvYHJsIuwK9s1B2dz3Z8l3o2eg8AqFuIL+MlZOvf5A/2
-            MOXffyXbOM5Dhy7DdUckTOYYfwWe1mStw3vx3I3mAFzuOOR7HQuzlc9Bf1oxh36T
-            6e/qOijjPPqkLeR2mufo0lgBBFTQFt2jVvMo1lrCB8Amj4yj/4noXTzglkYTYBKs
-            S513kUdhAGtWoNrqcItOYAn/gl+CPGY2Op3tJBVCWM6aT/KO6M/LPJ7wiQk2zlOL
-            pp7SnCKvv9eQ
-            =N+uj
-            -----END PGP MESSAGE-----
-          fp: c4639370c41133a738f643a591ddbc4c3387f1fb
-        - created_at: "2025-01-22T00:51:09Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA98TrrsQEbXUAQ//fm/TcxgsAMY6P8jvOQMcRBmjjVwfLP1UTTnkRUa36Mmn
-            2V9619zsH1dzTp0gUVV8mvIKUtpz2nCBTZBJw803wW9KorxW6f4e3+mIWelZT5WM
-            sLcQPFWAYKDVnSfk5j8kRSmpM6k2xFRB9DTEMIyFH9PZL99Fztp2hjTn553YTQOo
-            pdw+AMzgptYQghW/Pl/32wXHwCO+bL8tyk62VIQO13l3tX83oSslXNkFzNQYt3jv
-            xXFUaQEGD/1lFLeFnIuJZzfjWt6n0fShJboUcuk/ZIcYdwrbG0pyLLoBoObSRQtG
-            t+7VpWpfl3rnk822SU9z9YcaMNy9HD3Kz9Qh0BRQiN3scCMzm1LyzlXLqlc/gPiq
-            JyCxy98vJXIxmlLQZpDFfTMe3xsc8jSsHI6av+wEFKGEJAOUkDtRYvLfZdgDTfiB
-            XTAhQ3ixnlBxdZZ9DjBXyVfM8q9iB8bggFi7g2SjO32LKhXRFUqZR+avddCyKR/V
-            hRpWjDRn+eX2tl7LPawvX6tIow3aZiezkMVyeRXfcZCvpicq64b80LrYR+JJUfJE
-            vxHaekKImrdJ9ocii0wW91ZmESJwL6m5lt3ZsCY5GTlEDt4wBse5uhj48mtuK8sh
-            g8uQMKp7SiiCtV5a6O1SQLDJeAt6VCcRyudLToO9S4gwrGXNPcGxsHj07XAN2PHS
-            WAE6wUhufXfpa8UgSWy7fmEZt4L03XlRfC7bm/ycwaFww3A7w4+B1gkW6gOon6sy
-            nOyIxUZfU6abZWKzH+OIuViKH7xPiULDy75gEmkRHjKu5BiC3Tx0eO4=
-            =+PPr
-            -----END PGP MESSAGE-----
-          fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4
-    unencrypted_suffix: _unencrypted
-    version: 3.9.2
--- a/machines/secrets/keys/itag/fanny/disk.key
+++ b/machines/secrets/keys/itag/fanny/disk.key
@@ -1,31 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:xmMPJyp3y9XI2QsWJniRM+Nds4Y5zoqb5QSJqZo=,iv:KRLS4JYN2OVmbbLe8DCD0xW8VVnbmYN/MfZNp7eOS2M=,tag:FV1Qm8Wr5fbpJ+ovAK+uaw==,type:str]",
-	"sops": {
-		"kms": null,
-		"gcp_kms": null,
-		"azure_kv": null,
-		"hc_vault": null,
-		"age": [
-			{
-				"recipient": "age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoQ1EwOGcxazlIcy9mdmkr\nMzJCcWkxQXFEQ25sUU1HUFJqSEE1b2M2QmxVCm1hWWExbWtJdmxjMk1VUE43ZkNR\nNmRpdGNPNURwdjJkaXhxcjNxRFFiSWcKLS0tIHB5Y2NWM0pCbGdtTGRUV1hyVlVs\nZTRsUnZoUnN6cHNPTWF2SzhxUUJ0aVEKzchgMPjpDAX7NUTSxUYxoKLoOh7+X9GV\nxrarnXswpSV/bfR4w4x+DmoocG7TbdH+UvCTsg3LtdjWmfpjK/c8Kw==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2025-02-22T11:49:56Z",
-		"mac": "ENC[AES256_GCM,data:WKZIdINWSCn9ZOtsnLQ9dXCOdG49Ltf7/G91zEuj88+nvQC4+WTLCCXBGdhVBamV1PWHYnFvZbiXKJ/VFdN3EDZeW9r6cXuF2PEveOn6Bj1bYi0WrzFRfxxvt56AM9j/0D5E1hE9rp2yAWg5V4E3nIGT+rVsOczMk1+Yx4Q8NCc=,iv:DKD+E5yeFJrARfP5Qw6I1Cn9lvvHUHHok+3l8dyzVcE=,tag:lCBrrqfFxvtldBfbha99vQ==,type:str]",
-		"pgp": [
-			{
-				"created_at": "2025-02-22T11:49:08Z",
-				"enc": "-----BEGIN PGP MESSAGE-----\n\nhQGMA5HdvEwzh/H7AQv/Xn1mh8ojou0/ntHLA+iNzYf6vsJVoWB6Cfh/WL9s/Vxn\nJWhvIzo+blJnoMJMsRPx4wiIuAjT2KkJko5v8Wr9pzzOAqOCghk+8YYnpC49PpCA\nhT8Yuu1v53Ycomwj1IdZj6GWeIkuLw2N4ZVqh1vZnvTT1tWltxmp9lhb/cWP+ze1\ngzIO7wqd9hisX9DVl4IVV/q8QVIfhWR2dMX+xgRcEssAjQu/nFGv88i6NJQsbIwm\nKOlUI3QJ49DEVFxH6Z36ZhUpdszHKi3IPg2IqtpfDicU807rQ3VihM9abkhp7cY6\ndvxW2rMijahy2IXuvGyTuwh9ow4bHXWBQgEkaFo8eKCx/KnR5shpR3/0CdegU45H\nGF/RhIq5wC4lMXy5/O3pgb5QPItcOB4ke+s48sGdxWWyXkp3MLXS1NblEZ6K9xTm\n/1GUcpCeoePWMeNmPgdeEcQL8jBxBol2wP5cXl4Ov86wegd0O56lVi6L2jqhgYiZ\n+SMhqmsMqZFVJWExkyX00lgBzFNsLWpT+KGuesodu9mtbYJ/s7Pz7+d+apgtzLI1\nGyjD9TDyZQUmM4El7SbZ/KNniRhR2Rnthg1r/cAcMYSyOnRbM/n5t5ynUc8vzr4y\nIPGXwW3pEoOh\n=48Pd\n-----END PGP MESSAGE-----",
-				"fp": "c4639370c41133a738f643a591ddbc4c3387f1fb"
-			},
-			{
-				"created_at": "2025-02-22T11:49:08Z",
-				"enc": "-----BEGIN PGP MESSAGE-----\n\nhQIMA98TrrsQEbXUAQ//S41vk86ETjZa/AI9N5rS/RnPk3SuvGCiFxVkPl+ScY+j\nMOIqQFr55JpZm2Tb2nYA07yzW0b9q7jnVDt1dGp1MEC9QZZj1dEoZNGU+UjLhD3F\nDW9/NLeoJ2+D2rSxQmIwWdMqw3XehZDXvcicmKprtSK1MThV1cy5BITTStoX+qSQ\n4pFg7AVJij7+mtEK6pdV3S9BT1R27X9fanm4v785MEB+KERhe+5rQ7QR33Ohrotk\nqp6FqQJRAkc2ea+SFLRp8q4oIKK8lIoVv2mos/RUyBMf1HYPERohvqBjOF7oUjHt\ntOGGb+TLpVicPEsrAiNG5krfLCcI8vZeqkZQvu3YZx1zopYrW1mQuW1/kedFqtpc\nN6piYNz7KaYX0zpCJv1YQN8z1YOc+9LxTIemDUNt3zEYwrehi/DeXMt+Np+U0PKq\nSmfxRiMnbTT14la8mUa4Uov6KNUhzLgDVm8z/6XuM4qqEPw1ApG2UT+n5swZeqhN\nXBIAdSfybLW6vGhIOJduiI7LbQOADcEqlwiMDM4WMtG5acM/MLFQVQzP0DnQeIYj\nlNeGxT0m92ZfhwPupJG8PlC4dAANU3anBVGtMGn66aAEoVq/5RdOI9Iw8z8FIvnq\nN4Sef+5eqJuNeFdvxWG4IP6mrU1BmeWTXgI59aifSPUc0vrviYD6eRYCuI1NySLS\nWAHY6GESDXqeH6mlUryle6HSnJD43faFNkdlUaEBt0tH4ij2OvM5s8XTnr03hPnT\nYOHSVh6PVF2wwgV+JJuy7Nfj1+ylZCl2G61GO4QXtLexeWpPSzbo3Hw=\n=A2Pv\n-----END PGP MESSAGE-----",
-				"fp": "aef8d6c7e4761fc297cda833df13aebb1011b5d4"
-			}
-		],
-		"unencrypted_suffix": "_unencrypted",
-		"version": "3.9.2"
-	}
-}
--- a/machines/secrets/keys/itag/fanny/fanny
+++ b/machines/secrets/keys/itag/fanny/fanny
@@ -1,31 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:HyKweXScDgvctgx168oBvB22fQcq6mCAs/Bsy0f1+UClAf313UynPJpBig41XVZdRFHOKkAMh/GmyIP04DtrXC/eAO9As+kaLkli/mBWiXSUA9l8pU8Wb3rC5YUu6/9ZraKWaC1ONAty2+d/v2EpWJhKMJWeeihiYfT8FMqRy2tjx0wmIz/Y6HgrR2pvHxyS2nGyrGhraaMnpm1WLsJ5b5yTbgkKVAoMwKNltnSIVA9AYvWmoNB8qIEPI5ppPvrSFSLOxYBG8zl/bBVtJ5ekM2bg733nCISRWhmelQLFVrUrN+3jsfpmE/nTe+xXClUmPC+7ePsCQuU2RKVWw5g99RewPdiszHdq/73Eo+7+ETLgRmo2vtLB/zFSiC8hmtJWh7WvVc4DXhGPDrqYPsh9GR87ZlSORgvadd5Mj/JuMzvmacWoFV9ERLnWjTTlIg+vSEBa0zB2vZHgAzBL+6R7WW3VgsBylRHQqsaJP5RIc4ktT6Qrt3REnArg/V/zJJGYBw+nQrqr5rrbbAmSA/57,iv:BdRM22/SMiHrq4SWVZTIpYPy/eHS1Kc/XxYj49Jf3H4=,tag:QdIwNFO7PnChvhWJAYNONw==,type:str]",
-	"sops": {
-		"kms": null,
-		"gcp_kms": null,
-		"azure_kv": null,
-		"hc_vault": null,
-		"age": [
-			{
-				"recipient": "age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYVnRlb2x4SGdPbWltWVUy\nZEl5OC83UldXMjEwOUdTNTFWMytYejFVRkI0CldKN0F0MUp6U2hnRUJQaGZKbzJR\nZFByOHRwbWgxTlJndGh3NWZIR2FKbmsKLS0tIFNjNDVHWjZNYlRCY0tQRlVtTlQ2\nMTlUVFd4dEo4dythYVV1WEQ5dWlEQTgKYqoEes44TbflFTFBzNwEVP9DDHtkmhfn\ndCFBPhBTwuoFKai3kOOX/E9gEOwqY24HAqKdeyiO2VXrL8JKEazggg==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2025-02-22T11:49:08Z",
-		"mac": "ENC[AES256_GCM,data:V7B26cct1W4ihesyVxpAI8AvMXSy7dd0hWFdYqWtzKkCN73au2V3h1DilOiNn3gclFhL9Crw38iNUtnGeHscGLGrNbwkyCMDj1KXKl6wnSYdFkw9XD+PnRwYq7hMTTLIH19nqBg+K9tjaDEkK7y8WygUHfknxJj5D4bURgl/jow=,iv:/f3GXl6o2oxRJjIJEpYN5T5x9q4acxFqqakzBRG4hlg=,tag:G6F9hXdO9BoXZ2eXaEG43Q==,type:str]",
-		"pgp": [
-			{
-				"created_at": "2025-02-22T11:49:08Z",
-				"enc": "-----BEGIN PGP MESSAGE-----\n\nhQGMA5HdvEwzh/H7AQwAk5+mzJ/KJX4bxyb5w8dUiLXilBMJQiBxQZWsC8Q+G5v6\n9LGMMWPrQeLuTHkNe9FpddIUixjuFox1TJxaph3t+DfamR3yPdUYDuRckc9iF+jZ\n4oa8txJ9oWoEYx5QlxCCricSxomC9LV4DcBKQ2gyXnAeX2Wwe5/3uw+S/KyHZM+y\n9flO7qIVQk8MkVzZOc2KVCyvUL1UnAwgXzR1OmznpGBiZpaipCmXBs/elncxViry\nrmgA/+Aob37ChXQk5mVQLyrV+E1M+u1PwigML7PbbE3WpBVgpbb+MH639nBC/rTV\n+B70BaayFdzvUln4OFonfvsvPQEynmE1rfJRUavvAQDORHHmmbOKdWWVaYHDlp4Z\nAgYI10mnnFBpm2Qd/EjBa2a1CWboaGCaz/KldTzjp+TxW0GVf6WQ5SKlqZj3MdGM\nVS+91ph2LaRCTB5WObTX4KKDiwwoRAB+0A4ewu5ttsmeuhTy3o/r1Liu/UBdaL6i\nA9t59cMopIL6YXRD1YwF0lgBHtGC/KGsnZjC4dscoU2eTfmJ4rFx9vmc8I/JaO+h\nNDoFnd0sk2FQhnMvAN16U8HurfAzbHiqf3utEcMOg0bPw43Q/8g8JgUAaxqkJIQn\nn4fqE2GFjBqJ\n=Eivh\n-----END PGP MESSAGE-----",
-				"fp": "c4639370c41133a738f643a591ddbc4c3387f1fb"
-			},
-			{
-				"created_at": "2025-02-22T11:49:08Z",
-				"enc": "-----BEGIN PGP MESSAGE-----\n\nhQIMA98TrrsQEbXUAQ/9Hy7wKpuAeKotD/HBoM+aptxnKiExf7mphpdZZ1sr8fHE\nDDdVehwhFxsxLkcIwh+dj35KswHw6aMzyQGj4bYsxSmsFKscATknsklR1UATWfSw\np3hVjNFCZ+yd+uzSJnfTkldTcaJiN9MxPmaOMd4e7Ui5k7dcYo0/FD5AZQZMjKDO\nQYUsUASWLHWAoiS7nnFrbaFvXKAPS4wOsB2T263QsoZyEvpQIgWP6lb9kS7V4ftZ\nxetGJFIk2hanYfdGXZy3TiHaJO+fESpVYmp6YykDqeZqZkWB59aeWVL/7Cz7H/wj\n4RU9RWBMbXGjPz+5WMo7X7kLrJgLAWywch6bM2fktkadG9n2tAa/FISysR25qtmQ\nzJtwCY8j26ZZJdc/FEA6dYwIYeGZ0BwV91dPaEotAtgSVpSihdXI/DzE9T9OjWuQ\n1c2sCjVJ7Kw19uCHLaZg+Tvob0RQJu5mnKPnLqinpxDn6Vf/nxIU80gFsPPr4f2T\n627iBaQOaMxdxHLV8r16WrNzBRj28sPZDBlGQ0HouToO2dn3uN+onQGszRAAIadJ\nZMo8SoWCdx+xiDK0S5oxnoxfk2QMAW75qyFiR373axb6HgMMSpJSG8TE+vg9++oa\nE7dddc7nq6ZnuhRNDn9V6cam8hfkFvKwRCeul1Yg5qZn5qI9H0/glR+KisKZVK/S\nWAF/XJucPmK9gsScxB4FgfKmpZD0cJkKmwndB5Idc6waRrjHxFnLFTFxbUnUD2KC\n198dZo7Y4ftOIWKHCY1R4RWhsmIUX5XzxwEnYSzy0pta/uyaqwa6sWs=\n=wi7r\n-----END PGP MESSAGE-----",
-				"fp": "aef8d6c7e4761fc297cda833df13aebb1011b5d4"
-			}
-		],
-		"unencrypted_suffix": "_unencrypted",
-		"version": "3.9.2"
-	}
-}
--- a/machines/secrets/keys/itag/fanny/fanny-init
+++ b/machines/secrets/keys/itag/fanny/fanny-init
@@ -1,31 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:2RNOB8VVg+TGykuRU0h9fElGUhrje8gDkMdQyYQaF1U9P68oMJCEJYJno4qB0jEb5IPeTHrJamDjoQKv97OsGBkhPiamlImuBHjAUIxQq9a8xmFAhT60dZqCqIPqSuBs2OeVJE+wbHlo4pjGqe/PymMtz5M85SgOxvYSOktYRUZLmHIkZ9APy6PVit7AeUzRkf5H9Y58Xhg8gh4wCK0djorszPSY3Pf+G5PeV4EdNjIZ2FoL8MjWnYyEl8e/C11w1qdRA39J6l9LDTn8kNp3zHzYEWfY1G1sShc9M6kT83qmU4HMExERs4MlXEXkPd8EztAAgMKZIZWiwJ2Eu+9854V7KDb6T48sILCesjJwB94DWuXmdf/2CV1uGVat9baGOIE0ImGHTZYtGutxP1pBl1qZcU89LLRSPlmnRNWnTLcc3nnw0dgSsk132/7Qckrq5mUpD7F/fs1bYfG2LZGCqnXq6olnzh5jILe5iffvZprEH/Fm6jcDXBQN8WR4ADReSvHN7r0Vpvm1aZ01NtkJ,iv:6IIpVx4Dtrn+uahiH3kZHy6bmBj9ti1UiswKwAe2qZE=,tag:hGJkYXIarS+QEwJiHVmP/w==,type:str]",
-	"sops": {
-		"kms": null,
-		"gcp_kms": null,
-		"azure_kv": null,
-		"hc_vault": null,
-		"age": [
-			{
-				"recipient": "age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxMXJSeTFQdElLc2FKVFlG\nTjdlOGZHaUZkNjMzZDJTcXh1ZjF2bVpzRlU4CjdiS3NYeDZyNit1OCswSjFWbWJU\nT1BTNWFsRnpQWjZGbzJFV05tV1lNS2sKLS0tIEdrb3JOMUFRMkdIdFUwK0dHSXRQ\nbmtCVEJjRllnMHZFNkJ2UndBcXlaQkUK9bHFPsVaZovR4rGuQ6GfqAvZxNKqVhC5\nHybQWv1PCoaNOvQbtBgCxMlV8HOJfwe2EgysJErvriXeyVad5+zY2g==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2025-02-22T11:49:08Z",
-		"mac": "ENC[AES256_GCM,data:IFctz/f9I9vcWN82u3qta+o/oILTHpCScSezHwt0ifsENnUQLz+uAmpMs+ok1ZR5+20XpEq4C7f1s4n2h8dijxsPuE/IOQM7rvwjoVPsM/0XUglDK3Vc5u1oooGpLJg1PchwWGOAlKQHun3mh4j/bz5UMpD8AWC++NLPE1Hr0Jc=,iv:y0aD+4iLSKedGAjZP1SygyzzIE0/SHWcOUS/aghzrII=,tag:01dQZoLlz0w5dE3DePwjbA==,type:str]",
-		"pgp": [
-			{
-				"created_at": "2025-02-22T11:49:08Z",
-				"enc": "-----BEGIN PGP MESSAGE-----\n\nhQGMA5HdvEwzh/H7AQv6A4kG9S33l07+BwNeUsDZVrzRTP2Gz5F679VKTBrr96t/\nTJaa+FlCWDU3DczaC18Y6yIyU22+97xqQ4WYnno0h7bF2uhjbyXjp3JV5na7BgGe\nn3V6p0yJcBM5XfrJRuKghEB3kHddQIcVR8JurWrynCKy1C4njR6pJDA3pqp9PReP\n0ubTiJqAwJfx5hGSAjSDWitQ2vpubowCXssqyh9S2P07H5u8HHbLRyJGgvl/LgTR\nEe2EUh7KrTMT6cCXBHAPSK2bZgwP667bhEOJzuCpknG4/Q7EtVQzjKaXGrDR0vMi\nIwA7knQ0UMeRCa/jSSPYUbscMJIb5+wh0rnPfWGGgtVshdd6YtuETBnqZsjUETXd\nsXdem+UoMEN6Co1ABzHEeSGT7y6D8OghoodofLBvgf5TduiX5Pqceo7SkfXPN/3G\n4fqg+e+VTT63Jwp7rk+ekRJYPkHNoB5w0VIrvsyBPlDUhEVywKWJTfzu8905hkVP\ntsQEoJxkpT27PFACoxZ80lgB/9kyQKvsRG9kl68osivg2gIB/13+4TjMdS+x3ycL\no5QnE0D/adRJHpDRwuPfzGyRwFWT8bHFEpw8qErLEWaXh27QMStOgr2By2PsOFTP\nAtJo/wheNGMb\n=qa04\n-----END PGP MESSAGE-----",
-				"fp": "c4639370c41133a738f643a591ddbc4c3387f1fb"
-			},
-			{
-				"created_at": "2025-02-22T11:49:08Z",
-				"enc": "-----BEGIN PGP MESSAGE-----\n\nhQIMA98TrrsQEbXUAQ/9F41AW+ruudLanRh8Rn8rHJRfGpdhv1oFkFRIK+Z/2oGr\nMGMm+2EPhCHCMp2tFJRm0HwZruGJda31iFNbaFSqHmTlqWfEMoEj4ztcOhe1vFG/\nhqtp39DawyHb/1AXPHvsuwbucEf/DH9gflXgbnBrZQ0K+7FiOSnXNi34YByKipbI\nbGg+8PV1iYXw0vuLgERy5aP20zyvr+sg53jnr8RR98A2E7VWg2YNfxEOKxxQczxe\nlgblSVqLLmEKAJcE3JWY6c5HR5Xlt4Y02JrAYD11qD21hmtS8plEZ70kiz4elgMU\nkWxM1HSm9Tyq2I5c9v8uk8VOCfEYE+glASJKtyHtyzDJRJcKwvaE8SqStlfoGot6\nKiJ4flqGapTOkJtOvR7FczO7T3j19Ga62dUvoHrei9Q0FYcyG70/lvTWEJy4/jYg\nOk5QJyseRhrDhcLKg9nUbuSfYhXtJc9C/S8B1n/bwjO1O3vslkewFAnhBIqweh1D\nnHjrSHsssrpkeyefmjVh7NiQZtn122hnPnIz5B62is27MD+m8qWWoWghc5lzsw5S\nCGBRY8l+vvGca1TZFJX1JO/L6vhdN4qd/H4IWRmj1oSR8qtQ6SKbt1UmQtB2BtPg\ncqlRCn4x2ORpRgwAIZtD6GFUFUjUduz6LpaxG2tpnmZcQfPAF7YYjjpR07oPIg3S\nWAGomgQyyubfDCH/tM0RwuTlMX4hkMtlKyMDuOHuZVxWZqoh/utGazasBogGm6zK\nIz0nKh+z0w0nv9kGzalq9L+ek0A07ylIlakSaR/vxh2ZaKHojBEEPh8=\n=1EB6\n-----END PGP MESSAGE-----",
-				"fp": "aef8d6c7e4761fc297cda833df13aebb1011b5d4"
-			}
-		],
-		"unencrypted_suffix": "_unencrypted",
-		"version": "3.9.2"
-	}
-}
--- a/machines/secrets/keys/itag/fanny/fanny-init.pub
+++ b/machines/secrets/keys/itag/fanny/fanny-init.pub
@@ -1 +0,0 @@
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEY60NKfdjFiXNvl1r4mBcXKADHA80laxio+qN6izevN atlan@nixos
--- a/machines/secrets/keys/itag/fanny/fanny.pub
+++ b/machines/secrets/keys/itag/fanny/fanny.pub
@@ -1 +0,0 @@
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBiKzGgQVfvfSqhdWNqkhTWd8gfJCVoyYoe9zh1LATsC atlan@nixos
--- a/machines/testvm/configuration.nix
+++ b/machines/testvm/configuration.nix
@@ -24,7 +24,7 @@ in

  malobeo.disks = {
    enable = true;
-    encryption = true;
+    encryption = false;
    hostId = "83abc8cb";
    devNodes = "/dev/disk/by-path/";
    root = {
--- a/machines/vpn/configuration.nix
+++ b/machines/vpn/configuration.nix
@@ -35,36 +35,9 @@ with lib;
      locations."/" = {
        proxyPass = "http://10.100.0.101";
        extraConfig = ''
-          proxy_set_header Host $host;
        '';
      };
-    };

-    virtualHosts."cloud.malobeo.org" = {
-      locations."/" = {
-        proxyPass = "http://10.100.0.101";
-        extraConfig = ''
-          proxy_set_header Host $host;
-        '';
-      };
-    };
-
-    virtualHosts."grafana.malobeo.org" = {
-      locations."/" = {
-        proxyPass = "http://10.100.0.101";
-        extraConfig = ''
-          proxy_set_header Host $host;
-        '';
-      };
-    };
-
-    virtualHosts."tasklist.malobeo.org" = {
-      locations."/" = {
-        proxyPass = "http://10.100.0.101";
-        extraConfig = ''
-          proxy_set_header Host $host;
-        '';
-      };
    };
  };

--- a/outputs.nix
+++ b/outputs.nix
@@ -12,11 +12,241 @@
 let filter_system = name: if name == utils.lib.system.i686-linux then false else true;
 in (utils.lib.eachSystem (builtins.filter filter_system utils.lib.defaultSystems) ( system:
  let
+    baseModules = [
+      # make flake inputs accessiable in NixOS
+      { _module.args.inputs = inputs; }
+      {
+        imports = [
+          ({ pkgs, ... }: {
+            nix = {
+              extraOptions = ''
+                experimental-features = nix-command flakes
+              '';
+
+              settings = {
+                substituters = [
+                  "https://cache.dynamicdiscord.de"
+                  "https://cache.nixos.org/"
+                ];
+                trusted-public-keys = [
+                  "cache.dynamicdiscord.de:DKueZicqi2NhJJXz9MYgUbiyobMs10fTyHCgAUibRP4="
+                ];
+                trusted-users = [ "root" "@wheel" ];
+              };
+            };
+          })
+          sops-nix.nixosModules.sops
+          #microvm.nixosModules.microvm
+        ];
+      }
+    ];
+    defaultModules = baseModules;
+
+  makeMicroVM = hostName: ipv4Addr: macAddr: modules: [
+    self.nixosModules.malobeo.metrics
+    {
+      microvm = {
+        hypervisor = "cloud-hypervisor";
+        mem = 2560;
+        shares = [
+          {
+            source = "/nix/store";
+            mountPoint = "/nix/.ro-store";
+            tag = "store";
+            proto = "virtiofs";
+            socket = "store.socket";
+          }
+          {
+            source = "/var/lib/microvms/${hostName}/etc";
+            mountPoint = "/etc";
+            tag = "etc";
+            proto = "virtiofs";
+            socket = "etc.socket";
+          }
+          {
+            source = "/var/lib/microvms/${hostName}/var";
+            mountPoint = "/var";
+            tag = "var";
+            proto = "virtiofs";
+            socket = "var.socket";
+          }
+        ];
+
+        interfaces = [
+          {
+            type = "tap";
+            id = "vm-${hostName}";
+            mac = "${macAddr}";
+          }
+        ];
+      };
+
+      malobeo.metrics = {
+        enable = true;
+        enablePromtail = true;
+        logNginx = false;
+        lokiHost = "10.0.0.14";
+      };
+      
+      systemd.network.enable = true;
+      
+      systemd.network.networks."20-lan" = {
+        matchConfig.Type = "ether";
+        networkConfig = {
+          Address = [ "${ipv4Addr}/24" ];
+          Gateway = "10.0.0.1";
+          DNS = ["1.1.1.1"];
+          DHCP = "no";
+        };
+      };
+    }
+  ] ++ defaultModules ++ modules;
+
+
    pkgs-unstable = nixpkgs-unstable.legacyPackages."${system}";
    pkgs = nixpkgs.legacyPackages."${system}";

-    hosts = import ./machines/hosts.nix ( inputs // { inherit inputs; self = self; });
-    utils = import ./machines/modules/host_builder.nix ( inputs // { inherit inputs; self = self; hosts = hosts; });
+    vmMicroVMOverwrites = hostname: options: {
+      microvm = {
+        mem = pkgs.lib.mkForce 4096;
+        hypervisor = pkgs.lib.mkForce "qemu";
+        socket = pkgs.lib.mkForce null;
+
+
+        #needed for hosts that deploy imperative microvms (for example fanny)
+        writableStoreOverlay = pkgs.lib.mkIf options.writableStore "/nix/.rw-store";
+        volumes = pkgs.lib.mkIf options.writableStore [ {
+          image = "nix-store-overlay.img";
+          mountPoint = self.nixosConfigurations.${hostname}.config.microvm.writableStoreOverlay;
+          size = 2048;
+        } ];
+
+        shares = pkgs.lib.mkForce (pkgs.lib.optionals (!options.writableStore) [
+          {
+            tag = "ro-store";
+            source = "/nix/store";
+            mountPoint = "/nix/.ro-store";
+          }
+        ] ++ pkgs.lib.optionals (options.varPath != "") [
+          {
+            source = "${options.varPath}";
+            securityModel = "mapped";
+            mountPoint = "/var";
+            tag = "var";
+          }
+        ]);
+
+        interfaces = pkgs.lib.mkIf (!options.withNetworking) (pkgs.lib.mkForce [{
+          type = "user";
+          id = "eth0";
+          mac = "02:23:de:ad:be:ef";
+        }]);
+
+        #if networking is disabled forward port 80 to still have access to webservices
+        forwardPorts = pkgs.lib.mkIf (!options.withNetworking) (pkgs.lib.mkForce [
+          { from = "host"; host.port = 8080; guest.port = 80; }
+        ]);
+
+      };
+
+      fileSystems = {
+        "/".fsType = pkgs.lib.mkForce "tmpfs";
+
+        # prometheus uses a memory mapped file which doesnt seem supported by 9p shares
+        # therefore we mount a tmpfs inside the datadir
+        "/var/lib/prometheus2/data" = pkgs.lib.mkIf (hostname == "overwatch" && options.varPath != "") (pkgs.lib.mkForce {
+          fsType = pkgs.lib.mkForce "tmpfs";
+        });
+      };
+
+      boot.isContainer = pkgs.lib.mkForce false;
+      services.timesyncd.enable = false;
+      users.users.root.password = "";
+      services.getty.helpLine = ''
+        Log in as "root" with an empty password.
+        Use "reboot" to shut qemu down.
+      '';
+    };
+
+    vmDiskoOverwrites = {
+      boot.initrd = {
+        secrets = pkgs.lib.mkForce {};
+        network.ssh.enable = pkgs.lib.mkForce false;
+      };
+
+      malobeo.disks.enable = pkgs.lib.mkForce false;
+      networking.hostId = "a3c3101f";
+    };
+
+    vmSopsOverwrites = host: {
+      sops.defaultSopsFile = pkgs.lib.mkForce ./machines/${host}/dummy.yaml;
+
+      environment.etc = {
+        devHostKey = {
+          source = ./machines/secrets/devkey_ed25519;
+          mode = "0600";
+        };
+      };
+
+      services.openssh.hostKeys = [{
+        path = "/etc/devHostKey";
+        type = "ed25519";
+      }];
+    };
+
+    buildVM = host: networking: sopsDummy: disableDisko: varPath: writableStore: (self.nixosConfigurations.${host}.extendModules {
+        modules = [
+          (vmMicroVMOverwrites host { 
+            withNetworking = networking; 
+            varPath = "${varPath}"; 
+            writableStore = writableStore; })
+          (if sopsDummy then (vmSopsOverwrites host) else {})
+          (if disableDisko then vmDiskoOverwrites else {})
+        ] ++ pkgs.lib.optionals (! self.nixosConfigurations.${host}.config ? microvm) [
+          #microvm.nixosModules.microvm
+        ] ++ pkgs.lib.optionals (self.nixosConfigurations.${host}.config ? services.malobeo.microvm.deployHosts) [
+          #microvm.nixosModules.host
+          {
+          services.malobeo.microvm.deployHosts = pkgs.lib.mkForce [];
+          systemd.tmpfiles.rules = builtins.concatLists (map (name: [
+            "q /var/lib/microvms/${name}/var 0755 root root - -"
+            "q /var/lib/microvms/${name}/etc 0755 root root - -"
+            "q /var/${name}/wow/it/works 0755 root root - -"
+            "q /var/lib/${name} 0755 root root - -"
+            "d /${name} 0755 root root - -"
+          ]) self.nixosConfigurations.${host}.config.services.malobeo.microvm.deployHosts);
+
+
+          microvm.vms = 
+          let
+            # Map the values to each hostname to then generate an Attrset using listToAttrs
+            mapperFunc = name: { inherit name; value = {
+              #pkgs = import self.nixosConfigurations.${name}.config.nixpkgs;
+
+              #pkgs = (buildVM name networking sopsDummy false "" false).config.nixpkgs;
+              #config = (buildVM name networking sopsDummy false "" false);
+              #pkgs = pkgs;
+              #config = self.nixosConfigurations.${name};
+              specialArgs.inputs = inputs;
+              specialArgs.self = self;
+              config = {
+                imports = (makeMicroVM "${name}" "10.0.0.11" "D0:E5:CA:F0:D7:E7" [
+              
+                  #(vmMicroVMOverwrites name { 
+                  #  withNetworking = true; 
+                  #  varPath = ""; 
+                  #  writableStore = false; })
+                  (if sopsDummy then (vmSopsOverwrites name) else {})
+
+                  
+                ]);
+
+              };
+            }; };
+          in
+          builtins.listToAttrs (map mapperFunc self.nixosConfigurations.${host}.config.services.malobeo.microvm.deployHosts);
+        }];
+      });
  in
  {
    devShells.default =
@@ -39,7 +269,6 @@ in (utils.lib.eachSystem (builtins.filter filter_system utils.lib.defaultSystems
        pkgs.age
        pkgs.python310Packages.grip
        pkgs.mdbook
-        pkgs.ssh-to-age
        microvmpkg.microvm
      ];

@@ -50,11 +279,10 @@ in (utils.lib.eachSystem (builtins.filter filter_system utils.lib.defaultSystems
    legacyPackages = {
      scripts.remote-install = pkgs.writeShellScriptBin "remote-install" (builtins.readFile ./scripts/remote-install-encrypt.sh);
      scripts.boot-unlock = pkgs.writeShellScriptBin "boot-unlock" (builtins.readFile ./scripts/unlock-boot.sh);
-      scripts.add-host-keys = pkgs.writeShellScriptBin "add-host-keys" (builtins.readFile ./scripts/add_new_host_keys.sh);
      scripts.run-vm = self.packages.${system}.run-vm;
    };

-    vmBuilder = utils.buildVM;
+    vmBuilder = buildVM;

    packages = {
      docs = pkgs.stdenv.mkDerivation {
@@ -74,7 +302,64 @@ in (utils.lib.eachSystem (builtins.filter filter_system utils.lib.defaultSystems
        '';
      };

-      run-vm = pkgs.writeShellScriptBin "run-vm"  (builtins.readFile ./scripts/run-vm.sh);
+      run-vm = pkgs.writeShellScriptBin "run-vm" ''
+        usage() {
+            echo "Usage: run-vm <hostname> [--networking] [--dummy-secrets] [--no-disko]"
+            echo "ATTENTION: This script must be run from the flakes root directory"
+            echo "--networking setup interfaces. requires root and hostbridge enabled on the host"
+            echo "--dummy-secrets run vm with dummy sops secrets"
+            echo "--no-disko disable disko and initrd secrets. needed for real hosts like fanny"
+            echo "--writable-store enables writable store. necessary for host with nested imperative microvms like fanny"
+            echo "--var path to directory that should be shared as /var. may require root otherwise some systemd units fail within vm. if dir is empty vm will populate"
+            exit 1
+        }
+        
+        # check at least one arg was given
+        if [ "$#" -lt 1 ]; then
+            usage
+        fi
+        
+        HOSTNAME=$1
+        
+        # Optionale Argumente
+        NETWORK=false
+        DUMMY_SECRETS=false
+        NO_DISKO=false
+        RW_STORE=false
+        VAR_PATH=""
+        
+        # check argws
+        shift
+        while [[ "$#" -gt 0 ]]; do
+            case $1 in
+                --networking) NETWORK=true ;;
+                --dummy-secrets) DUMMY_SECRETS=true ;;
+                --no-disko) NO_DISKO=true ;;
+                --writable-store) RW_STORE=true ;;
+                --var) 
+                  if [[ -n "$2" && ! "$2" =~ ^- ]]; then
+                      VAR_PATH="$2"
+                      shift
+                  else
+                      echo "Error: --var requires a non-empty string argument."
+                      usage
+                  fi
+                  ;;
+                *) echo "Unknown argument: $1"; usage ;;
+            esac
+            shift
+        done
+        echo "starting host $HOSTNAME"
+        echo "enable networking: $NETWORK"
+        echo "deploy dummy secrets: $DUMMY_SECRETS"
+        echo "disable disko and initrd secrets: $NO_DISKO"
+        echo "use writable store: $RW_STORE"
+        if [ -n "$VAR_PATH" ]; then
+          echo "sharing var directory: $VAR_PATH"
+        fi
+        
+        ${pkgs.nix}/bin/nix run --show-trace --impure --expr "((builtins.getFlake \"$(pwd)\").vmBuilder.x86_64-linux \"$HOSTNAME\" $NETWORK $DUMMY_SECRETS $NO_DISKO \"$VAR_PATH\" $RW_STORE).config.microvm.declaredRunner"
+      '';
    };

    apps = {
@@ -100,13 +385,11 @@ in (utils.lib.eachSystem (builtins.filter filter_system utils.lib.defaultSystems
      };
    };

-  })) // (
-  let
-    hosts = import ./machines/hosts.nix ( inputs // { inherit inputs; self = self; });
-    utils = import ./machines/modules/host_builder.nix ( inputs // { inherit inputs; self = self; hosts = hosts; });
-  in
-  {
-    nixosConfigurations = utils.buildHost hosts.malobeo.hosts;
+  })) // {
+    nixosConfigurations = import ./machines/configuration.nix (inputs // {
+      inherit inputs;
+      self = self;
+    });

    nixosModules.malobeo = {
      host.imports = [ ./machines/durruti/host_config.nix ];
@@ -128,4 +411,4 @@ in (utils.lib.eachSystem (builtins.filter filter_system utils.lib.defaultSystems
      nixpkgs.lib.mapAttrs getBuildEntry self.nixosConfigurations

      );
-})
+}
--- a/scripts/add_new_host_keys.sh
+++ b/scripts/add_new_host_keys.sh
@@ -1,48 +0,0 @@
-set -o errexit
-#set -o pipefail
-
-if [ ! -e flake.nix ]
-    then
-    echo "flake.nix not found. Searching down."
-    while [ ! -e flake.nix ]
-        do
-        if [ $PWD = "/" ]
-            then
-            echo "Found root. Aborting."
-            exit 1
-            else
-            cd ..
-        fi
-    done
-fi
-
-pwpath="machines/secrets/keys/itag"
-read -p "Enter new host name: " host
-
-if [ "$host" = "" ]; then exit 0
-fi
-
-mkdir -p $pwpath/$host
-cd $pwpath/$host
-
-# Generate SSH keys
-ssh-keygen -f "$host" -t ed25519 -N ""
-ssh-keygen -f "$host"-init -t ed25519 -N ""
-
-#encrypt the private keys
-sops -e -i ./"$host"
-sops -e -i ./"$host"-init
-
-#generate encryption key
-tr -dc 'A-Za-z0-9' < /dev/urandom | head -c 20 > disk.key
-sops -e -i ./disk.key
-
-# Info
-echo
-echo "Hier ist der age public key für sops etc:"
-echo "$(ssh-to-age -i ./$host.pub)"
-echo
-echo "Hier ist eine reproduzierbare mac-addresse:"
-echo "$host"|md5sum|sed 's/^\(..\)\(..\)\(..\)\(..\)\(..\).*$/02:\1:\2:\3:\4:\5/'
-
-exit 0
--- a/scripts/remote-install-encrypt.sh
+++ b/scripts/remote-install-encrypt.sh
@@ -25,7 +25,6 @@ fi

 hostname=$1
 ipaddress=$2
-pwpath="machines/secrets/keys/itag"

 # Create a temporary directory
 temp=$(mktemp -d)
@@ -38,15 +37,12 @@ trap cleanup EXIT

 # Create the directory where sshd expects to find the host keys
 install -d -m755 "$temp/etc/ssh/"
-install -d -m755 "$temp/root/"

-diskKey=$(sops -d $pwpath/$hostname/disk.key)
+diskKey=$(sops -d machines/$hostname/disk.key)
 echo "$diskKey" > /tmp/secret.key
-echo "$diskKey" > $temp/root/secret.key

-sops -d "$pwpath/$hostname/$hostname" > "$temp/etc/ssh/$hostname"
-
-sopd -d "$pwpath/$hostname/$hostname"-init > "$temp/etc/ssh/initrd"
+ssh-keygen -f $temp/etc/ssh/"$hostname" -t ed25519 -N ""
+ssh-keygen -f $temp/etc/ssh/initrd -t ed25519 -N ""

 # # Set the correct permissions so sshd will accept the key
 chmod 600 "$temp/etc/ssh/$hostname"
--- a/scripts/run-vm.sh
+++ b/scripts/run-vm.sh
@@ -1,67 +0,0 @@
-usage() {
-    echo "Usage: run-vm <hostname> [--networking] [--dummy-secrets] [--no-disko]"
-    echo "ATTENTION: This script must be run from the flakes root directory"
-    echo "--networking setup interfaces. requires root and hostbridge enabled on the host"
-    echo "--dummy-secrets run vm with dummy sops secrets"
-    echo "--no-disko disable disko and initrd secrets. needed for real hosts like fanny"
-    echo "--writable-store enables writable store. necessary for host with nested imperative microvms like fanny"
-    echo "--var path to directory that should be shared as /var. may require root otherwise some systemd units fail within vm. if dir is empty vm will populate"
-    echo "--fwd-port forwards the given port to port 80 on vm"
-    exit 1
-}
-
-# check at least one arg was given
-if [ "$#" -lt 1 ]; then
-    usage
-fi
-
-HOSTNAME=$1
-
-# Optionale Argumente
-NETWORK=false
-DUMMY_SECRETS=false
-NO_DISKO=false
-RW_STORE=false
-VAR_PATH=""
-FWD_PORT=0
-
-# check argws
-shift
-while [[ "$#" -gt 0 ]]; do
-    case $1 in
-        --networking) NETWORK=true ;;
-        --dummy-secrets) DUMMY_SECRETS=true ;;
-        --no-disko) NO_DISKO=true ;;
-        --writable-store) RW_STORE=true ;;
-        --var) 
-          if [[ -n "$2" && ! "$2" =~ ^- ]]; then
-              VAR_PATH="$2"
-              shift
-          else
-              echo "Error: --var requires a non-empty string argument."
-              usage
-          fi
-          ;;
-        --fwd-port) 
-          if [[ -n "$2" && ! "$2" =~ ^- ]]; then
-              FWD_PORT="$2"
-              shift
-          else
-              echo "Error: --var requires a non-empty string argument."
-              usage
-          fi
-          ;;
-        *) echo "Unknown argument: $1"; usage ;;
-    esac
-    shift
-done
-echo "starting host $HOSTNAME"
-echo "enable networking: $NETWORK"
-echo "deploy dummy secrets: $DUMMY_SECRETS"
-echo "disable disko and initrd secrets: $NO_DISKO"
-echo "use writable store: $RW_STORE"
-if [ -n "$VAR_PATH" ]; then
-  echo "sharing var directory: $VAR_PATH"
-fi
-
-nix run --show-trace --impure --expr "((builtins.getFlake \"$(pwd)\").vmBuilder.x86_64-linux \"$HOSTNAME\" $NETWORK $DUMMY_SECRETS $NO_DISKO \"$VAR_PATH\" $RW_STORE $FWD_PORT).config.microvm.declaredRunner"
--- a/scripts/unlock-boot.sh
+++ b/scripts/unlock-boot.sh
@@ -19,18 +19,22 @@ if [ ! -e flake.nix ]
    done
 fi

-diskkey=$(sops -d machines/secrets/keys/itag/$HOSTNAME/disk.key)
-
 echo
 if [ $# = 1 ]
    then
+    diskkey=$(sops -d machines/$HOSTNAME/disk.key)
+    echo "$diskkey" | ssh $sshoptions root@$HOSTNAME-initrd "systemd-tty-ask-password-agent" #storage
+
    echo "$diskkey" | ssh $sshoptions root@$HOSTNAME-initrd "systemd-tty-ask-password-agent" #root

 elif [ $# = 2 ]
    then
+    diskkey=$(sops -d machines/$HOSTNAME/disk.key)
    IP=$2
+    echo "$diskkey" | ssh $sshoptions root@$IP "systemd-tty-ask-password-agent" #storage
+
    echo "$diskkey" | ssh $sshoptions root@$IP "systemd-tty-ask-password-agent" #root
-    
+
 else
    echo
    echo "Unlock the root disk on a remote host."
Author	SHA1	Message	Date
kalipso	af11810935	wip All checks were successful Check flake syntax / flake-check (push) Successful in 4m5s Details	2025-01-21 22:17:16 +01:00
kalipso	81f73a0704	[overwatch] grafana provision datasource and dashboards All checks were successful Check flake syntax / flake-check (push) Successful in 4m3s Details	2025-01-20 22:31:36 +01:00
kalipso	7730163b84	[metrics] enable on all microvms All checks were successful Check flake syntax / flake-check (push) Successful in 4m9s Details	2025-01-20 21:32:07 +01:00
kalipso	725efc3e0a	[metrics] init module	2025-01-20 21:32:07 +01:00
kalipso	724f14cfcd	[overwatch] backup dashboard	2025-01-20 21:32:07 +01:00
kalipso	cf3bfa1784	[infradocs] fix loki addr	2025-01-20 21:32:07 +01:00
kalipso	c71d7959f2	[run-vm] handle edgecase for prometheus mmaped file on 9p share	2025-01-20 21:31:43 +01:00
kalipso	155e78b519	[run-vm] use securityModel mapped to allow mounting /var 9p share	2025-01-20 21:31:43 +01:00
kalipso	c54f04cb62	[nix] change .#docs to just start browser and use .#docsDev for local development	2025-01-20 21:31:43 +01:00
kalipso	197a8427b7	[docs] add run-vm examples	2025-01-20 21:31:43 +01:00
kalipso	1877f6dc9c	[run-vm] allow sharing of /var/lib sharing /var somehow doesnt work. for example nginx fails because of lacking permissions to access /var/log/nginx. this also happens when run-vm is started as root. thats why only /var/lib is shared which still allows application persistency between tests	2025-01-20 21:31:43 +01:00
kalipso	c47e93170f	[run-vm] add flag to disable disko needed to run fanny as vm	2025-01-20 21:31:43 +01:00
kalipso	eea5d6924d	[nix] add run-vm script	2025-01-20 21:31:43 +01:00
kalipso	468106677c	[vpn] update dummy secrets	2025-01-20 21:31:43 +01:00
kalipso	df4d769f82	[lucia] init dummy secrets	2025-01-20 21:31:43 +01:00
kalipso	249eebf164	[fanny] init dummy secrets	2025-01-20 21:31:43 +01:00
kalipso	e3bcd250e0	[durruti] rm secrets.yaml - currently empty	2025-01-20 21:31:43 +01:00
kalipso	1b871f3860	[nextcloud] add dummy secrets	2025-01-20 21:31:43 +01:00
kalipso	3564436dfe	[sops] add a dummy key to allow secret usage within test vms	2025-01-20 21:31:43 +01:00
kalipso	4744324385	[sops] test sharing hostkey with vm	2025-01-20 21:31:43 +01:00
kalipso	88ef307a65	[fanny] proxypass cloud.malobeo.org	2025-01-20 21:31:43 +01:00
kalipso	dec968a4db	[fanny] deploy nextcloud	2025-01-20 21:31:43 +01:00
kalipso	283dc51d67	[nextcloud] rm obsolete nameserver	2025-01-20 21:31:43 +01:00
ahtlon	f4a6c40cd2	[nextcloud] nextcloud works now	2025-01-20 21:31:43 +01:00
ahtlon	23caa27d4e	[nextcloud] flake update because for some reason the sha changed	2025-01-20 21:31:43 +01:00
ahtlon	d6aee8657b	[nextcloud] enable postgress, redis, change domain	2025-01-20 21:31:43 +01:00
ahtlon	e7e05327e4	[nextcloud] rm discourse	2025-01-20 21:31:40 +01:00
kalipso	1fc3538e03	[nextcloud] fix hostname	2025-01-20 21:30:48 +01:00
ahtlon	1ebee6d886	add nextcloud collectives	2025-01-20 21:30:48 +01:00
ahtlon	94e439bf0b	login geht	2025-01-20 21:30:48 +01:00
ahtlon	e50f3349ba	nextcloud minimal	2025-01-20 21:30:48 +01:00
ahtlon	18b747a7df	sops....	2025-01-20 21:30:48 +01:00
ahtlon	ea6e019b64	Start over but right this time	2025-01-20 21:30:48 +01:00
ahtlon	8581f762a2	basic discourse example	2025-01-20 21:30:48 +01:00
ahtlon	b223f0cb0c	with nix flake check the hydraJobs output is evaluated in the same way as Hydra's hydra-eval-jobs	2025-01-20 21:30:48 +01:00
ahtlon	9ba607ce16	Only run on push	2025-01-20 21:30:48 +01:00
ahtlon	34c2661c53	[actions] Add flake check	2025-01-20 21:30:48 +01:00
ahtlon	211799b6b9	[modules] move microvm module import from makeMicroVM to baseModules	2025-01-20 21:30:48 +01:00
ahtlon	543c4ed49e	[scripts] move packages to legacyPackages	2025-01-20 21:30:48 +01:00
ahtlon	27085dd3e6	[scripts] check for flake.nix	2025-01-20 21:30:48 +01:00
ahtlon	8076956982	[packages] make scripts available in shell without nix run	2025-01-20 21:30:48 +01:00
kalipso	26829f9255	[infradocs] provide stats All checks were successful Evaluate Hydra Jobs / eval-hydra-jobs (push) Successful in 4m55s Details Evaluate Hydra Jobs / eval-hydra-jobs (pull_request) Successful in 5m57s Details	2025-01-18 20:01:27 +01:00
kalipso	0d93cad9d4	[overwatch] init All checks were successful Evaluate Hydra Jobs / eval-hydra-jobs (push) Successful in 4m19s Details	2025-01-18 11:40:27 +01:00
kalipso	02a57d98d0	[microvms] rm nameserver option	2025-01-18 11:39:36 +01:00
kalipso	4553c2c069	[nix] do not rm network interfaces of vms	2025-01-17 16:19:19 +01:00
kalipso	3f3dca3c7f	[docs] make readme the index still most of it is quite out of date...	2025-01-17 14:30:49 +01:00
				`@@ -1 +0,0 @@`
				`ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEY60NKfdjFiXNvl1r4mBcXKADHA80laxio+qN6izevN atlan@nixos`
				`@@ -1 +0,0 @@`
				`ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBiKzGgQVfvfSqhdWNqkhTWd8gfJCVoyYoe9zh1LATsC atlan@nixos`