i don't know if this should be used

Since only passing though the ssh dir doesn't work, the host would be polluted by all the other hosts writing to etc
add note to docs
2025-01-18 17:39:28 +01:00 · 2025-01-18 16:35:34 +01:00 · 2025-01-18 16:34:24 +01:00
41 changed files with 443 additions and 26617 deletions
--- a/.gitea/workflows/eval-hydra-jobs.yml
+++ b/.gitea/workflows/eval-hydra-jobs.yml
@@ -1,8 +1,9 @@
-name: "Check flake syntax"
+name: "Evaluate Hydra Jobs"
 on:
  pull_request:
  push:
 jobs:
-  flake-check:
+  eval-hydra-jobs:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
@@ -10,5 +11,5 @@ jobs:
      run: |
        apt update -y
        apt install sudo -y        
-    - uses: cachix/install-nix-action@v30
+    - uses: cachix/install-nix-action@v27
-    - run: nix flake check --no-update-lock-file --accept-flake-config .
+    - run: nix eval --no-update-lock-file --accept-flake-config .\#hydraJobs
--- a/doc/src/Index.md
+++ b/doc/src/Index.md
@@ -1,82 +1 @@
-# malobeo infrastructure
+# Index
 this repository nxios configurations of the digital malobeo infrastructure. it should be used to setup, test, build and deploy different hosts in a reproducible manner.
 the file structure is based on this [blog post](https://samleathers.com/posts/2022-02-03-my-new-network-and-deploy-rs.html)
 ### deploying configuration
 #### local deployment
 ``` shell
 nixos-rebuild switch --use-remote-sudo
 ```
 #### remote deployment
 you need the hostname and ip address of the host:
 ``` shell
 nixos-rebuild switch --flake .#<hostname> --target-host root@<ip_address> --build-host localhost
 ```
 in this case 'localhost' is used as buildhost which can be usefull if the target host is low systemresources
 ## development
 ### requirements
 we use flake based configurations for our hosts. if you want to build configurations on you own machine you have to enable flakes first by adding the following to your *configuration.nix* or *nix.conf*
 ``` nix
 nix.extraOptions = ''
  experimental-features = nix-command flakes
 '';
 ```
 More information about flakes can be found [here](https://nixos.wiki/wiki/Flakes)
 ### dev shell
 a development shell with the correct environment can be created by running ```nix develop ```
 If you're using direnv you can add flake support by following those steps: [link](https://nixos.wiki/wiki/Flakes#Direnv_integration)
 ### build a configuration
 to build a configuration run the following command (replace ```<hostname>``` with the actual hostname):
 ``` shell
 nix build .#nixosConfigurations.<hostname>.config.system.build.toplevel
 ```
 ### building raspberry image
 for the raspberry it is possible to build the whole configuration as an sd-card image which then can be flashed directly. more information about building arm on nixos can be found [here](https://nixos.wiki/wiki/NixOS_on_ARM).
 to be able to build the image you need to enable qemu emulation on the machine you are building with. therefore it is necessary to add the following to your configuration.nix:
 ``` nix
 boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
 ```
 then you can build the image with:
 ``` shell
 nix build .#nixosConfigurations.rpi1_base_image.config.system.build.sdImage
 ```
 ### run a configuration as vm
 to run a vm we have to build it first using the following command (replace ```<hostname>``` with the actual hostname):
 ``` shell
 nix build .#nixosConfigurations.<hostname>.config.system.build.vm
 ```
 afterwards run the following command to start the vm:
 ``` shell
 ./result/bin/run-<hostname>-vm
 ```
 ### documentation
 for documentation we currently just use README.md files.
 the devshell provides the python package ['grip'](https://github.com/joeyespo/grip) which can be used to preview different README.md files in the browser.
 the usage is simple, just run ```grip``` in the same folder as the README.md you wanna preview. then open your browser at ```http://localhost:6419 ```.
--- a/doc/src/anleitung/microvm.md
+++ b/doc/src/anleitung/microvm.md
@@ -12,31 +12,13 @@ Use durruti as orientation:
 "10.0.0.5" is the IP assigned to its tap interface.  
 ### Testing MicroVMs locally
-MicroVMs can be built and run easily on your localhost for development.  
+MicroVMs can be built and run easily on your local host, but they are not persistent!
-We provide the script ```run-vm``` to handle stuff like development (dummy) secrets, sharing directories, ect. easily.
+For durruti for example this is done by:
 Usage examples:
 ``` bash
-# run without args to get available options and usage info
+nix run .\#durruti-vm
 run-vm
 # run nextcloud locally with dummy secrets
 run-vm nextcloud --dummy-secrets
 # share a local folder as /var/lib dir so that nextcloud application data stays persistent between boots
 mkdir /tmp/nextcloud
 run-vm nextcloud --dummy-secrets --varlib /tmp/nextcloud
 # enable networking to provide connectivity between multiple vms
 # for that the malobeo hostBridge must be enabled on your host
 # this example deploys persistent grafana on overwatch and fetches metrics from infradocs
 mkdir overwatch
 run-vm overwatch --networking --varlib /tmp/overwatch
 run-vm infradocs --networking
 ```
-
+### Testing persistent microvms
 ### Fully deploy microvms on local host
 In order to test persistent microvms locally we need to create them using the ```microvm``` command.  
 This is necessary to be able to mount persistent /etc and /var volumes on those hosts.  
 Do the following:
@@ -62,6 +44,9 @@ sudo mkdir -p /var/lib/microvms/durruti/{var,etc}
 # alternatively u can run the vm in interactive mode (maybe stop the microvm@durruti.service first)
 microvm -r durruti
 #if you get an error like "Error booting VM: VmBoot(DeviceManager(CreateVirtioFs(VhostUserConnect)))", try starting the virtio service manually
 sudo systemctl start microvm-virtiofsd@{host}.service
 # after u made changes to the microvm update and restart the vm 
 microvm -uR durruti
--- a/flake.lock
+++ b/flake.lock
@@ -7,11 +7,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1736864502,
+        "lastModified": 1730135292,
-        "narHash": "sha256-ItkIZyebGvNH2dK9jVGzJHGPtb6BSWLN8Gmef16NeY0=",
+        "narHash": "sha256-CI27qHAbc3/tIe8sb37kiHNaeCqGxNimckCMj0lW5kg=",
        "owner": "nix-community",
        "repo": "disko",
-        "rev": "0141aabed359f063de7413f80d906e1d98c0c123",
+        "rev": "ab58501b2341bc5e0fc88f2f5983a679b075ddf5",
        "type": "github"
      },
      "original": {
@@ -67,11 +67,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1736373539,
+        "lastModified": 1733951536,
-        "narHash": "sha256-dinzAqCjenWDxuy+MqUQq0I4zUSfaCvN9rzuCmgMZJY=",
+        "narHash": "sha256-Zb5ZCa7Xj+0gy5XVXINTSr71fCfAv+IKtmIXNrykT54=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "bd65bc3cde04c16755955630b344bc9e35272c56",
+        "rev": "1318c3f3b068cdcea922fa7c1a0a1f0c96c22f5f",
        "type": "github"
      },
      "original": {
@@ -109,11 +109,11 @@
        "spectrum": "spectrum"
      },
      "locked": {
-        "lastModified": 1736905611,
+        "lastModified": 1734041466,
-        "narHash": "sha256-eW6SfZRaOnOybBzhvEzu3iRL8IhwE0ETxUpnkErlqkE=",
+        "narHash": "sha256-51bhaMe8BZuNAStUHvo07nDO72wmw8PAqkSYH4U31Yo=",
        "owner": "astro",
        "repo": "microvm.nix",
-        "rev": "a18d7ba1bb7fd4841191044ca7a7f895ef2adf3b",
+        "rev": "3910e65c3d92c82ea41ab295c66df4c0b4f9e7b3",
        "type": "github"
      },
      "original": {
@@ -124,11 +124,11 @@
    },
    "nixlib": {
      "locked": {
-        "lastModified": 1736643958,
+        "lastModified": 1733620091,
-        "narHash": "sha256-tmpqTSWVRJVhpvfSN9KXBvKEXplrwKnSZNAoNPf/S/s=",
+        "narHash": "sha256-5WoMeCkaXqTZwwCNLRzyLxEJn8ISwjx4cNqLgqKwg9s=",
        "owner": "nix-community",
        "repo": "nixpkgs.lib",
-        "rev": "1418bc28a52126761c02dd3d89b2d8ca0f521181",
+        "rev": "f4dc9a6c02e5e14d91d158522f69f6ab4194eb5b",
        "type": "github"
      },
      "original": {
@@ -145,11 +145,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1737057290,
+        "lastModified": 1733965598,
-        "narHash": "sha256-3Pe0yKlCc7EOeq1X/aJVDH0CtNL+tIBm49vpepwL1MQ=",
+        "narHash": "sha256-0tlZU8xfQGPcBOdXZee7P3vJLyPjTrXw7WbIgXD34gM=",
        "owner": "nix-community",
        "repo": "nixos-generators",
-        "rev": "d002ce9b6e7eb467cd1c6bb9aef9c35d191b5453",
+        "rev": "d162ffdf0a30f3d19e67df5091d6744ab8b9229f",
        "type": "github"
      },
      "original": {
@@ -160,11 +160,11 @@
    },
    "nixos-hardware": {
      "locked": {
-        "lastModified": 1736978406,
+        "lastModified": 1733861262,
-        "narHash": "sha256-oMr3PVIQ8XPDI8/x6BHxsWEPBRU98Pam6KGVwUh8MPk=",
+        "narHash": "sha256-+jjPup/ByS0LEVIrBbt7FnGugJgLeG9oc+ivFASYn2U=",
        "owner": "NixOS",
        "repo": "nixos-hardware",
-        "rev": "b678606690027913f3434dea3864e712b862dde5",
+        "rev": "cf737e2eba82b603f54f71b10cb8fd09d22ce3f5",
        "type": "github"
      },
      "original": {
@@ -192,11 +192,11 @@
    },
    "nixpkgs-unstable": {
      "locked": {
-        "lastModified": 1737062831,
+        "lastModified": 1733759999,
-        "narHash": "sha256-Tbk1MZbtV2s5aG+iM99U8FqwxU/YNArMcWAv6clcsBc=",
+        "narHash": "sha256-463SNPWmz46iLzJKRzO3Q2b0Aurff3U1n0nYItxq7jU=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "5df43628fdf08d642be8ba5b3625a6c70731c19c",
+        "rev": "a73246e2eef4c6ed172979932bc80e1404ba2d56",
        "type": "github"
      },
      "original": {
@@ -208,11 +208,11 @@
    },
    "nixpkgs_2": {
      "locked": {
-        "lastModified": 1736916166,
+        "lastModified": 1733808091,
-        "narHash": "sha256-puPDoVKxkuNmYIGMpMQiK8bEjaACcCksolsG36gdaNQ=",
+        "narHash": "sha256-KWwINTQelKOoQgrXftxoqxmKFZb9pLVfnRvK270nkVk=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "e24b4c09e963677b1beea49d411cd315a024ad3a",
+        "rev": "a0f3e10d94359665dba45b71b4227b0aeb851f8e",
        "type": "github"
      },
      "original": {
@@ -245,11 +245,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1737107480,
+        "lastModified": 1733965552,
-        "narHash": "sha256-GXUE9+FgxoZU8v0p6ilBJ8NH7k8nKmZjp/7dmMrCv3o=",
+        "narHash": "sha256-GZ4YtqkfyTjJFVCub5yAFWsHknG1nS/zfk7MuHht4Fs=",
        "owner": "Mic92",
        "repo": "sops-nix",
-        "rev": "4c4fb93f18b9072c6fa1986221f9a3d7bf1fe4b6",
+        "rev": "2d73fc6ac4eba4b9a83d3cb8275096fbb7ab4004",
        "type": "github"
      },
      "original": {
@@ -341,11 +341,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1737548421,
+        "lastModified": 1736184101,
-        "narHash": "sha256-gmlqJdC+v86vXc2yMhiza1mvsqh3vMfrEsiw+tV5MXg=",
+        "narHash": "sha256-HAX+TkDXzyNp6SAsKwjNFql7KzAtxximpQSv+GmP8KQ=",
        "ref": "refs/heads/master",
-        "rev": "c5fff78c83959841ac724980a13597dcfa6dc26d",
+        "rev": "9cdab949f44301553e3817cf1f38287ad947e00c",
-        "revCount": 29,
+        "revCount": 28,
        "type": "git",
        "url": "https://git.dynamicdiscord.de/kalipso/tasklist"
      },
--- a/machines/.sops.yaml
+++ b/machines/.sops.yaml
@@ -11,19 +11,7 @@ keys:
  - &machine_durruti age1xu6kxpf8p0r8d6sgyl0m20p5hmw35nserl7rejuzm66eql0ur4mq03u0vp
  - &machine_vpn age1v6uxwej4nlrpfanr9js7x6059mtvyg4fw50pzt0a2kt3ahk7edlslafeuh
  - &machine_fanny age14dpm6vaycd6u34dkndcktpamqgdyj4aqccjnl5533dsza05hxuds0tjfnf
  - &machine_nextcloud age1w07s4y2uh0xd322ralyyh79545lvxzqncd0s65q9cx4ttlqv5u9s7y78gr
  #this dummy key is used for testing.
  - &machine_dummy age18jn5mrfs4gqrnv0e2sxsgh3kq4sgxx39hwr8z7mz9kt7wlgaasjqlr88ng
 creation_rules:
  #provide fake secrets in a dummy.yaml file for each host
  - path_regex: '.*dummy\.yaml$'
    key_groups:
    - pgp:
      - *admin_kalipso
      - *admin_kalipso_dsktp
      age:
      - *machine_dummy
      - *admin_atlan
  - path_regex: moderatio/secrets/secrets.yaml$
    key_groups:
    - pgp:
@@ -85,18 +73,3 @@ creation_rules:
      - *admin_kalipso_dsktp
      age:
      - *admin_atlan
  - path_regex: nextcloud/secrets.yaml$
    key_groups:
    - pgp:
      - *admin_kalipso
      - *admin_kalipso_dsktp
      age:
      - *admin_atlan
      - *machine_nextcloud
  - path_regex: overwatch/secrets.yaml$
    key_groups:
    - pgp:
      - *admin_kalipso
      - *admin_kalipso_dsktp
      age:
      - *admin_atlan
--- a/machines/configuration.nix
+++ b/machines/configuration.nix
@@ -0,0 +1,179 @@
 { self
 , nixpkgs-unstable
 , nixpkgs
 , sops-nix
 , inputs
 , nixos-hardware
 , home-manager
 , ...
 }:
 let
  nixosSystem = nixpkgs.lib.makeOverridable nixpkgs.lib.nixosSystem;
  nixosSystemUnstable = nixpkgs-unstable.lib.makeOverridable nixpkgs-unstable.lib.nixosSystem;
  baseModules = [
    # make flake inputs accessiable in NixOS
    { _module.args.inputs = inputs; }
    {
      imports = [
        ({ pkgs, ... }: {
          nix = {
            extraOptions = ''
              experimental-features = nix-command flakes
            '';
            settings = {
              substituters = [
                "https://cache.dynamicdiscord.de"
                "https://cache.nixos.org/"
              ];
              trusted-public-keys = [
                "cache.dynamicdiscord.de:DKueZicqi2NhJJXz9MYgUbiyobMs10fTyHCgAUibRP4="
              ];
              trusted-users = [ "root" "@wheel" ];
            };
          };
        })
        sops-nix.nixosModules.sops
      ];
    }
  ];
  defaultModules = baseModules;
  makeMicroVM = hostName: ipv4Addr: macAddr: modules: [
    inputs.microvm.nixosModules.microvm
    {
      microvm = {
        hypervisor = "cloud-hypervisor";
        mem = 2560;
        shares = [
          {
            source = "/nix/store";
            mountPoint = "/nix/.ro-store";
            tag = "store";
            proto = "virtiofs";
            socket = "store.socket";
          }
          {
            source = "/var/lib/microvms/test/etc/";
            mountPoint = "/etc";
            tag = "etcssh";
            proto = "virtiofs";
            socket = "etcssh.socket";
          }
          {
            source = "/var/lib/microvms/${hostName}/var";
            mountPoint = "/var";
            tag = "var";
            proto = "virtiofs";
            socket = "var.socket";
          }
        ];
        interfaces = [
          {
            type = "tap";
            id = "vm-${hostName}";
            mac = "${macAddr}";
          }
        ];
      };
      systemd.network.enable = true;
      systemd.network.networks."20-lan" = {
        matchConfig.Type = "ether";
        networkConfig = {
          Address = [ "${ipv4Addr}/24" ];
          Gateway = "10.0.0.1";
          DNS = ["1.1.1.1"];
          DHCP = "no";
        };
      };
    }
  ] ++ defaultModules ++ modules;
  inputsMod = inputs // { malobeo = self; };
 in
 {
  louise = nixosSystem {
    system = "x86_64-linux";
    specialArgs.inputs = inputs;
    modules = defaultModules ++ [
      ./louise/configuration.nix
    ];
  };
  bakunin = nixosSystem {
    system = "x86_64-linux";
    specialArgs.inputs = inputs;
    modules = defaultModules ++ [
      ./bakunin/configuration.nix
      inputs.disko.nixosModules.disko
    ];
  };
  lucia = nixosSystem {
    system = "aarch64-linux";
    specialArgs.inputs = inputs;
    modules = defaultModules ++ [
      ./lucia/configuration.nix
      ./lucia/hardware_configuration.nix
    ];
  };
  fanny = nixosSystem {
    system = "x86_64-linux";
    specialArgs.inputs = inputsMod;
    modules = defaultModules ++ [
      self.nixosModules.malobeo.vpn
      ./fanny/configuration.nix
    ];
  };
  durruti = nixosSystem {
    system = "x86_64-linux";
    specialArgs.inputs = inputs;
    specialArgs.self = self;
    modules = makeMicroVM "durruti" "10.0.0.5" "52:DA:0D:F9:EF:F9" [
      ./durruti/configuration.nix
    ];
  };
  vpn = nixosSystem {
    system = "x86_64-linux";
    specialArgs.inputs = inputs;
    specialArgs.self = self;
    modules = makeMicroVM "vpn" "10.0.0.10" "D0:E5:CA:F0:D7:E6" [
      self.nixosModules.malobeo.vpn
      ./vpn/configuration.nix
    ];
  };
  infradocs = nixosSystem {
    system = "x86_64-linux";
    specialArgs.inputs = inputs;
    specialArgs.self = self;
    modules = makeMicroVM "infradocs" "10.0.0.11" "D0:E5:CA:F0:D7:E7" [
      self.nixosModules.malobeo.vpn
      ./infradocs/configuration.nix
    ];
  };
  uptimekuma = nixosSystem {
    system = "x86_64-linux";
    specialArgs.inputs = inputs;
    specialArgs.self = self;
    modules = makeMicroVM "uptimekuma" "10.0.0.12" "D0:E5:CA:F0:D7:E8" [
      ./uptimekuma/configuration.nix
    ];
  };
  testvm = nixosSystem {
    system = "x86_64-linux";
    specialArgs.inputs = inputs;
    specialArgs.self = self;
    modules = defaultModules ++ [ ./testvm ];
  };
 }
--- a/machines/durruti/configuration.nix
+++ b/machines/durruti/configuration.nix
@@ -1,11 +1,14 @@
-{ config, self, lib, pkgs, inputs, ... }:
+{ config, lib, pkgs, inputs, ... }:
 with lib;
 {
  sops.defaultSopsFile = ./secrets.yaml;
  networking = {
    hostName = mkDefault "durruti";
    useDHCP = false;
    nameservers = [ "1.1.1.1" ];
  };
  networking.firewall.allowedTCPPorts = [ 8080 ];
@@ -17,21 +20,16 @@ with lib;
  ];
  imports = [
-    self.nixosModules.malobeo.metrics
+    inputs.ep3-bs.nixosModules.ep3-bs
    inputs.tasklist.nixosModules.malobeo-tasklist
    ./documentation.nix
    ../modules/malobeo_user.nix
    ../modules/sshd.nix
    ../modules/minimal_tools.nix
  ];
  malobeo.metrics = {
    enable = true;
    enablePromtail = true;
    logNginx = true;
    lokiHost = "10.0.0.14";
  };
  services.malobeo-tasklist.enable = true;
  system.stateVersion = "22.11"; # Did you read the comment?
--- a/machines/durruti/host_config.nix
+++ b/machines/durruti/host_config.nix
@@ -43,36 +43,6 @@ in
      };
    };
    services.nginx.virtualHosts."cloud.malobeo.org" = {
      forceSSL = true;
      enableACME= true;
      locations."/" = {
        proxyPass = "http://10.0.0.10";
        extraConfig = ''
        '';
      };
    };
    services.nginx.virtualHosts."grafana.malobeo.org" = {
      forceSSL = true;
      enableACME= true;
      locations."/" = {
        proxyPass = "http://10.0.0.10";
        extraConfig = ''
        '';
      };
    };
    services.nginx.virtualHosts."tasklist.malobeo.org" = {
      forceSSL = true;
      enableACME= true;
      locations."/" = {
        proxyPass = "http://10.0.0.10";
        extraConfig = ''
        '';
      };
    };
    services.nginx.virtualHosts."status.malobeo.org" = {
      forceSSL = true;
      enableACME= true;
@@ -82,5 +52,17 @@ in
        '';
      };
    };
    services.nginx.virtualHosts."tasklist.malobeo.org" = {
      forceSSL = true;
      enableACME= true;
      locations."/".proxyPass = "http://${cfg.host_ip}:8080";
    };
    services.nginx.virtualHosts."booking.dynamicdiscord.de" = {
      forceSSL = true;
      enableACME= true;
      locations."/".proxyPass = "http://${cfg.host_ip}:80";
    };
  };
 }
--- a/machines/durruti/secrets.yaml
+++ b/machines/durruti/secrets.yaml
@@ -0,0 +1,70 @@
 hello: ENC[AES256_GCM,data:MKKsvoFlHX6h4qazxcjl/RE1ZsK64G926k4hgFW3AkoJgXO1QXmTaRG7ZBgS8A==,iv:hoFbcNRkge24xJfLZJH651jB4NnXCjYAdTrirkans+4=,tag:68AyEHamlGxdmSJGkTGbsA==,type:str]
 ep3bsDb: ENC[AES256_GCM,data:Z4ZYRaV/eCkaW5Ma+88hbl1o8qsI7PANrIHXoLdIOqIGFLPt7dw=,iv:BCVM+PeGm2NRcvBBy0kId1iVOD/uoiVKKBDA03p0QFM=,tag:CMypO3RLOhvHdVG5YvWewg==,type:str]
 ep3bsMail: ENC[AES256_GCM,data:rZhRb/+gs0Lm8Gdi2P2FMe15A344b88TRg==,iv:hEIG2CBcMslg3hmH3ST3bu6tmes01jncQ3V7h5KcuhA=,tag:XAHdMAlVZNyMdp4TznWDQQ==,type:str]
 sops:
    kms: []
    gcp_kms: []
    azure_kv: []
    hc_vault: []
    age:
        - recipient: age1xu6kxpf8p0r8d6sgyl0m20p5hmw35nserl7rejuzm66eql0ur4mq03u0vp
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEay9wZGM5elhUd2RqVFdJ
            aHFhRVNiY0lzZEZzSkVvcVlMT1FmMXN4YzNrCkE3SnprNUJ6Ty9hUGZhbzNEVit4
            THpoUnMyNmQ2Q3Z0SlR6cDFzeE9BaDAKLS0tIHFpbFJadTdtb2s2T2hmMWFBTlBV
            azZzNXBTRVFoUGtJaGpPdzlDNVpYcjAKd/9v8gn3jbMEK+UPipI8cIufCoWwWfS/
            kI9zLws/jtjhRZLNHJaXWz7CjAEwKA+6NOQA3pwZaeS1QKwSmeRdZA==
            -----END AGE ENCRYPTED FILE-----
        - recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxc1o2eTlFc1l4YjVOUHdM
            S1F2RG9PQWwyd2VYSmJmVzE4cWNSSEt5WUJZCjlwaWNJWFNHNnZkUVBwdVJUbVNi
            WjdYZ2dENVIydWw4WHJmckF0ZjRLWXMKLS0tIDRsNXNSRnZkVzFkSHpDSWgrSEhv
            bjBqRlYzcGIvNzhLbjdUbmFhMkU2RXMKsgkwNqQeP40boqriANQg13YKKwMz9iTZ
            Vw1wYVeQmo4En7c4yAztqBriVoTNsbWkkvGw0P4z37B+6ll8kdEMSQ==
            -----END AGE ENCRYPTED FILE-----
    lastmodified: "2024-06-26T10:07:26Z"
    mac: ENC[AES256_GCM,data:TfN80Hffm+Lf/5Cz7T37bBxMgJCAnk2aBxxW1/lr89N2p3cckcSOGAKoLWNIsdOkqOjAs4kft0nQ+xyfdLehG1WPo6OlOwZhJexfUUcS7GJ0QGNEVntkehQiHGw9TIv08/WHRbjnKTOGHLn1vuJAIJmSyff0hncGR7nxcwghZUU=,iv:TfidjsiqDx4SCbtb6ksNYOSz/EwzwnYieeWOaBrvA7Y=,tag:e8Vaycv9bxrVBn2QjRyfSw==,type:str]
    pgp:
        - created_at: "2024-12-19T15:09:01Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----
            hQGMA5HdvEwzh/H7AQv+K+G7MhXO0RlQENydEstPcMV5vAgkzL06kiN3wXpeOPmj
            2gwdNcbOLtcXV8a4mH6xGZPkKOV8xjkybp7Myicll6YDs+4Uw3qRTUmCyZ0BC2Wc
            WDrTMz/lCx1gZGVa99KgHaLmALhZbEO/R08qW52Xkwmcvg1GdM22RtB12L+c8JPB
            +RR/pLR4UCTfN21uS2CJ33bJnAayfi+s/maGYsElZkH/zoPtDBxF/ntk7g/xeN13
            Jymg1Ofmjm8JT0FPe8RE7Er/qXlxsG46GVj964chCtljz3NgL76tgC207E8CLUJq
            rVqGKU0PO6h924uNmVON+JI1CeyCsjejsFOGaS8kOEAwEgCoeICqiqkTbtUCU21K
            4C7J3mFwhAL+F2IueOY8NZxEV4tMJoY6JZ8c8wtM4Gl6JePlkFRX8LhuO/Bw2VJ9
            cuGlkIIg3pA94U6Hql7LwLZbIkquI7SWGx7IHOhk/4qtCUlEn4t40JdN4PbA0bz2
            Cde3+6zFOkX0m1BXkj4f0lgBIOfcPsXmY8ho4isVd9+v7arbE2WSZ6IBG75cx0a1
            4LYx3QWTLlujiDIc5arhBgpB2ceO8lFTARnoLLqG6y1T+w6UNoVHQZ4n987SpWkk
            EKQxUDnO8Nvb
            =1PHB
            -----END PGP MESSAGE-----
          fp: c4639370c41133a738f643a591ddbc4c3387f1fb
        - created_at: "2024-12-19T15:09:01Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----
            hQIMA98TrrsQEbXUARAAhfUKm9iR11pU0U44IDfwa7NRRurim8GOPX4FWwJJORNL
            q85xGM0jA/k8JRsOdsjfHb4/khHtG8cl+t09nEBxTeeb7mKdiOXfsxrvHEf6qeUw
            F/DQGoaxk+ISXW4iMcV0CPYciLb7kSHCqVFovmmTGlI9fMXryKl3UpP/nzzz9Zk2
            5cXLmbQqeQVsp17Dw5x7rglkTlx8+W7Z1tDHlHrycxzh6LYpJ7QX54EHM8JgMjw/
            WREO0qnJMt6C0qp8e3KWhYhMHIidM3WexJR9ixBICxevy0QwvNult0ryOZMc+nTY
            48sXxCTebnLspiFBS5OsagGxNgwMixydfKv0ci8E7FyB84jwq7XriiQRzYfzU/6L
            wEPapKrXno0F7wyiiesl/HKdLkOujFIhAl7P1ZNHQLcDuzDCqSo2xd7dbUsbPLcR
            BUNcfc0VK3TEJks1lXkO5C1PeYEy+NgsJnEQ2lrnAbmKDxpH6qOA2KSGh12uZnHp
            7kk/hRclVnygkcQc6j71eOyprQms2VjU6fVy2dED+ucjvogrceWWSUkuP6GQEqZV
            bPhLxpMMw6cIWcTLZIEqLRQv9EqibIFEohkUh9A2TL7XxPb6MEhsRXKTsmMqzdiH
            /xUwxH3w0w8CrEheVvxGxQi7B4XWC9jHGN+KvJGisrLeGpl/wJ8NKcqOSasB4fLS
            WAHQxsAnNtNj5rV/BQJHr8lvX+ebJkMpCEBmIdQUeX4WVegr3HkDF34EWoqVfzV2
            T0ZUaCXNI+tdmvJji9MPd1ZFrTgF5XuFjQxMP1uPI6gannH9InvBXvY=
            =5AlZ
            -----END PGP MESSAGE-----
          fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4
    unencrypted_suffix: _unencrypted
    version: 3.8.1
--- a/machines/fanny/configuration.nix
+++ b/machines/fanny/configuration.nix
@@ -13,20 +13,11 @@ in
      ../modules/sshd.nix
      ../modules/minimal_tools.nix
      ../modules/autoupdate.nix
      inputs.self.nixosModules.malobeo.vpn
      inputs.self.nixosModules.malobeo.initssh
      inputs.self.nixosModules.malobeo.disko
      inputs.self.nixosModules.malobeo.microvm
      inputs.self.nixosModules.malobeo.metrics
    ];
  malobeo.metrics = {
    enable = true;
    enablePromtail = true;
    logNginx = true;
    lokiHost = "10.0.0.14";
  };
  malobeo.autoUpdate = {
    enable = true;
    url = "https://hydra.dynamicdiscord.de";
@@ -35,14 +26,7 @@ in
    cacheurl = "https://cache.dynamicdiscord.de";
  };
-  nix = {
+  nix.settings.experimental-features = [ "nix-command" "flakes" ];
    settings.experimental-features = [ "nix-command" "flakes" ];
    #always update microvms
    extraOptions = ''
      tarball-ttl = 0
    '';
  };
  malobeo.disks = {
    enable = true;
@@ -69,16 +53,9 @@ in
  };
  services.malobeo.microvm.enableHostBridge = true;
-  services.malobeo.microvm.deployHosts = [ "overwatch" "infradocs" "durruti" ];
+  services.malobeo.microvm.deployHosts = [ "infradocs" ];
  services.malobeo.microvm.client.nextcloud.enable = true;
  networking = {
    nat = {
      enable = true;
      externalInterface = "enp1s0";
      internalInterfaces = [ "microvm" ];
    };
    firewall = {
      allowedTCPPorts = [ 80 ];
    };
@@ -90,34 +67,6 @@ in
      locations."/" = {
        proxyPass = "http://10.0.0.11:9000";
        extraConfig = ''
          proxy_set_header Host $host;
        '';
      };
    };
    virtualHosts."cloud.malobeo.org" = {
      locations."/" = {
        proxyPass = "http://10.0.0.13";
        extraConfig = ''
          proxy_set_header Host $host;
        '';
      };
    };
    virtualHosts."grafana.malobeo.org" = {
      locations."/" = {
        proxyPass = "http://10.0.0.14";
        extraConfig = ''
          proxy_set_header Host $host;
        '';
      };
    };
    virtualHosts."tasklist.malobeo.org" = {
      locations."/" = {
        proxyPass = "http://10.0.0.5:8080";
        extraConfig = ''
          proxy_set_header Host $host;
        '';
      };
    };
--- a/machines/fanny/dummy.yaml
+++ b/machines/fanny/dummy.yaml
@@ -1,68 +0,0 @@
 wg_private: ENC[AES256_GCM,data:YEmIfgtyHE9msYijva0Ye2w7shVmYBPZ3mcKRF7Cy20xa6yHEUQ0kC2OWnM=,iv:ouK6fHcrxrEtsmiPmtCz9Ca8Ec1algOifrgZSBNHi74=,tag:524e/SQt++hwVyeWruCsLg==,type:str]
 sops:
    kms: []
    gcp_kms: []
    azure_kv: []
    hc_vault: []
    age:
        - recipient: age18jn5mrfs4gqrnv0e2sxsgh3kq4sgxx39hwr8z7mz9kt7wlgaasjqlr88ng
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIVnB0dDdQT0tNSUJDSlhx
            QVFoVTZlb01MbVBwM2V2MGdGZFJTWm1FTW5nCkN5V0Y5MEp4K2FiU0xNVlRQM2xN
            SFJEWFFwTGhQWWwzNjlFN3NiakNBMnMKLS0tIE9MRHdnVHVYTG5rR1lGazdlK0Nv
            cmZiN0R5OW9vaitZb0JIa2srdmNMRjAKYlL4e8hfB0YuVNLM65yyvvCKl6EAF6E5
            YkAidAO5MY/wo1SDFQMeDub0Uso1QuNexYUZt7kzotvuPOzgywUORA==
            -----END AGE ENCRYPTED FILE-----
        - recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRZ25EdmdWVjAwWGhiVDRa
            cU9saUxnSXVDN0NodzI3aXMrTDZRc1FOUUJZCmh6V3lhS1FER2lyMzk5eU1XbXVh
            b3JFQ05GdEZTNVFTdFJjN3dTN2xBaXMKLS0tIG15YlVvVHZ5c2pYVmZCaktwRXFx
            NjJ5cFdTVS9NZmVWMjcrcHo2WDZEZDgKiDwkuUn90cDmidwYGZBb5qp+4R1HafV0
            vMQfjT9GrwB5K/O1GumOmvbzLNhvO2vRZJhfVHzyHLzQK64abQgF5Q==
            -----END AGE ENCRYPTED FILE-----
    lastmodified: "2025-01-19T22:46:09Z"
    mac: ENC[AES256_GCM,data:eU3SIqAGrgbO2tz4zH1tgYcif7oe5j+/wmdYl2xXXI+D6IhiKrTJGvzE3rd3ElEpb+Bg0UQId952U2Ut0yPTfxGLtdlbJA66CmhLAksByoJ8lOXUcp/qDyA4yMRSuwYG2v7uF2crvue9fyRfZ7hl7abE/Q7Z2UjOKqhSZC5cO3U=,iv:NmCVvtBWZRzhpr5nMLy+98VuQZWoUms7xFSxq8PMvBA=,tag:UWjA7oqoNWh4wb0myNg7FA==,type:str]
    pgp:
        - created_at: "2025-01-19T22:45:26Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----
            hQGMA5HdvEwzh/H7AQv/fLoi/LsDTN6tDdw0rWQg1iG/6oFFxcYO44XU2vCd13Ql
            okvR1ZtvXtnM/FwTboK2KjxahkuAbapXXEvfWJ2W+d2L38aYxCPe/ryQhjrUP/jJ
            4IjFSa5R6oWca9i5Apue5In71ACzGCF/v2oyNAF4fSDX7Q+YKOMiwaDatfOAKp5v
            JlkcfIq6WBR+gKZsTCfLunURNJoKu7jz35OUJDmzyZl9u/xV0ENveQxaKa3hj87s
            hb7RGXqph6WWhigy+rtTqYQNjycRDHuspb2GgGE5N7OYteZo/XxA3tDz2EWVCYx+
            g8aEEvxHK3qEIcWbgmbKXNPNSH/CG1XQFaUhdSnkg5lMJsBuYToeNsPTS0o866k1
            wmoiI3nT2KtnV2SeR3UUMNDqSDl5unLgBCrbDi0m3Sqt9ubjCfuOYN2T19WvAMZx
            CwB33mVAevPy4Qs5IjPad1WtiaUFulkfJFd1iCM9dhA0RDxbIJRaVGCjqnaE4lW4
            yP25uKoEUSitgr5nLk000lgBQBkE3obMFZ+DPoNaqupremevGJ71LyjJhXwgzQvk
            7pwQXBZWybBFFcH7wDurSIJMqE1KP24Krshm7aR9yVNd3mEz7v2T5pbUywTP8H1I
            TkFpiaZ7OG8G
            =VXoo
            -----END PGP MESSAGE-----
          fp: c4639370c41133a738f643a591ddbc4c3387f1fb
        - created_at: "2025-01-19T22:45:26Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----
            hQIMA98TrrsQEbXUARAAmhiwA8S+wZ0wiyIJwmRyLMWj3Xm95dTnEoeZmJ2I3O4g
            0szCKLdW8eUWrjZML09ByPYXQINkuyUR+g72+/ALEr9F587GxWDdMwcwLSlIYlX0
            3GwnJ7ACv/uTZjK24AXno3TkffPQy+rRQwXkpmUz7CMCeH/WRmVtf1LFUuxgbcrj
            Kmx9x52dn+ae5JOeMkEu4t8lAtI1pv1JRPnm6RIqK2N7VBRGjiD9SiyJiwLqV2GN
            7N+vepFhbBKPzt+CFpnPWnFePb+TtQmAdJVULedlFPLcJGsPMloEXSuunK2eKveB
            Vj1NO80i8PEVup02IlEabp+H7eYV8wZOviAJ7HGVhpw6kxD1tqO98KeSFfhuqbul
            ijaeF2COgf9lioR6Y8T+RhTqeEZK85U/OGXgiM7MdTdYQV9BrY5nR5XSYIrK6zl9
            TlS24DdM/Sd2939o+wdtgpm0FNQjW3WwA3n2QE/rqjQ6z2pyCTH16yRalAgHKNk/
            B3uDGxIO5ua6xZwPzFrOB7uKggB8W/lx1eyAT53Lv7MTRp9PW6mm+NoVkNIzmCYa
            5G2Y/bluKRt39O6UuSVrN8YLcyYCC+xYUfQf4Lr6/CwZ/XbgMTYm29+IgkOkgoS0
            UxPcmXUgxi98lu5IhdIwWTNtaWEvT9adwmd3bxebWgDmUvK5QxAc7BYUnGIe+C7S
            WAHA1m5OEQrNFLKGTSha/K20cDAoV2f4IAykRRWD3zieBAP3rzsIv78mgrMBIWP6
            z1L41UXlBToKfcw8TI9XKIlYId/asI7mR+bqT3oLSdni8qr32VpRjZ0=
            =MPBp
            -----END PGP MESSAGE-----
          fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4
    unencrypted_suffix: _unencrypted
    version: 3.9.2
--- a/machines/hosts.nix
+++ b/machines/hosts.nix
@@ -1,75 +0,0 @@
 { ... }:
 {
  malobeo = {
    hosts = {
      louise = {
        type = "host";
      };
      bakunin = {
        type = "host";
      };
      fanny = {
        type = "host";
      };
      lucia = {
        type = "rpi";
      };
      durruti = {
        type = "microvm";
        network = {
          address = "10.0.0.5";
          mac = "52:DA:0D:F9:EF:F9";
        };
      };
      vpn = {
        type = "microvm";
        network = {
          address = "10.0.0.10";
          mac = "D0:E5:CA:F0:D7:E6";
        };
      };
      infradocs = {
        type = "microvm";
        network = {
          address = "10.0.0.11";
          mac = "D0:E5:CA:F0:D7:E7";
        };
      };
      uptimekuma = {
        type = "microvm";
        network = {
          address = "10.0.0.12";
          mac = "D0:E5:CA:F0:D7:E8";
        };
      };
      nextcloud = {
        type = "microvm";
        network = {
          address = "10.0.0.13";
          mac = "D0:E5:CA:F0:D7:E9";
        };
      };
      overwatch = {
        type = "microvm";
        network = {
          address = "10.0.0.14";
          mac = "D0:E5:CA:F0:D7:E0";
        };
      };
      testvm = {
        type = "host";
      };
    };
  };
 }
--- a/machines/infradocs/configuration.nix
+++ b/machines/infradocs/configuration.nix
@@ -1,4 +1,4 @@
-{ self, config, lib, pkgs, inputs, ... }:
+{ config, lib, pkgs, inputs, ... }:
 with lib;
@@ -6,22 +6,15 @@ with lib;
  networking = {
    hostName = mkDefault "infradocs";
    useDHCP = false;
    nameservers = [ "1.1.1.1" ];
  };
  imports = [
    inputs.malobeo.nixosModules.malobeo.metrics
    ../durruti/documentation.nix
    ../modules/malobeo_user.nix
    ../modules/sshd.nix
  ];
  malobeo.metrics = {
    enable = true;
    enablePromtail = true;
    logNginx = true;
    lokiHost = "10.0.0.14";
  };
  system.stateVersion = "22.11"; # Did you read the comment?
 }
--- a/machines/lucia/configuration.nix
+++ b/machines/lucia/configuration.nix
@@ -6,7 +6,6 @@ in
 {
  imports =
    [ # Include the results of the hardware scan.
      ./hardware_configuration.nix
      ../modules/malobeo_user.nix
    ];
--- a/machines/lucia/dummy.yaml
+++ b/machines/lucia/dummy.yaml
@@ -1,70 +0,0 @@
 hello: ENC[AES256_GCM,data:ehp7eckur8THsbnSUcFYobA2SVDORUpqBcPTWC6/EvunlZbihaJoDoSfSh4Itg==,iv:nEHRg9TfYVdmJgrBs62Tek/3JhwFz8BMKHph4ThUqA8=,tag:1h2DSiOk4khxhRc7YX9ljg==,type:str]
 njala_api_key: ENC[AES256_GCM,data:vGH79aN2m1rZ0278ydoCQ0U5393HL0AZlajTVWcRbD+/V7QREN7ROW2LrdVK95I0cxobmJQ=,iv:vMpFTwWkC0R1/J9fZaks7c0G1Vj64/ryRkN5EgpWCdU=,tag:g2MJADBrJYTbmj2bhUQ8UA==,type:str]
 wireguard_private: ENC[AES256_GCM,data:T4c0qdFZdrwRU9i+nzAdg4ePEVXyeG4e/zNyn8G9Kd//Fwu1woNhQiyDuAo=,iv:VGPCSeU+RqjUdUlLA+RaCXQZK6AMdE4BwOdxM3whwaM=,tag:pXOwj3zxuFRpv2TInjISuw==,type:str]
 sops:
    kms: []
    gcp_kms: []
    azure_kv: []
    hc_vault: []
    age:
        - recipient: age18jn5mrfs4gqrnv0e2sxsgh3kq4sgxx39hwr8z7mz9kt7wlgaasjqlr88ng
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArU0lpUjBadHc2c1lPMUtv
            dmtqRTd0OEd6TnJrQjJaaFFaMjQ0MWlONEJZClBrdVNMb2xhK2RXRzlmN2dmTzZk
            SStWSzVGbWdqNEFpMnc3RFdpYWNEcTQKLS0tIDY0SlBvcmJ5RjFKTHQyN3lpSEZ2
            Z3hTOHN2VWVPMENVS1YzR0Z6Y0MxZmMKf0K43yWL7DE15wqEWb6Z0xsQ3nb1Ybyi
            0gKxb3hTeoWJnJug3hWyeAJvAJ4pzaA5v8PonnSIJK4UxBUnr+5nGw==
            -----END AGE ENCRYPTED FILE-----
        - recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIa0pnOGFlYU5OenJvWGhl
            TjFhU0NyWmprRDY3ZWIrRHdmSVBMS3pER3dZCmVQdlVYQ0pFRTBwZXQ1Z1V5ODVK
            dkREdEpsYk1MMm5kZU1hUEJYRWZDVjAKLS0tIHdsUjJTaURjaGErclJadTF0clhh
            aStSbDZ6NWtFZ2NrNHY1a29DTmo4bGcKfZZjFA2j5RgMf0crK8TV67iVizzmXvBR
            6tePJuCePnNDOoZ7WV5YThxYOPSTI1QvfEvcC1qo7l3Kca9jdkkfbQ==
            -----END AGE ENCRYPTED FILE-----
    lastmodified: "2025-01-19T22:46:57Z"
    mac: ENC[AES256_GCM,data:GIRj11bDZi38RobJvGoOf5geN42gaGk3294EvB21M/Y+lAsDOUUUbU1fQbBPRUsYvA/lyuHMQWRORTdy0LdjN9ejzwcuev8+j4i6A1zwPSmjIL2+Jp2pBqQj0F6th27hECJlh0wK3vU/aNcccRJP9kEgRME+7FS5uYw9r+ZPJWk=,iv:CUgdVr1b3O4niYTSFokA9uWR3ceiU+6qo+3N+K1BZ3Q=,tag:AERU8MZWHqVsZ+zbT27WIg==,type:str]
    pgp:
        - created_at: "2025-01-19T22:46:34Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----
            hQGMA5HdvEwzh/H7AQwAqm3KeXNDFMwVoz9qIIqtNHR+KIcdvdRTlG0GA5BEBiHp
            hSGkyK/Ni3GGX0WYU5Cf85Id/eEoxqDqDd9kX6MSZK3LBnH+hFy4JiSPENVpmwfQ
            eONaMwdfwI+/5ZfquVj/AApTXZ8ENhdBzLTuAfIa2hGPDwwkajzkVIg18TZOvKG6
            f2wiEpnSOVHKnPcGhI1dGxN9TqqN74IUoPhThRzQ79l9RcTEZVClos9IPOhaPfk0
            TvcBQez3G5Mn8W+s7kg4rl7g6XRZqjcaOuNwopB0x+Dx+alZExsTR6A+1Gf+29a+
            ELwQYg2mkKUi48vrcKXxz+OMhW7V7wuXQIjLP4jULc7LI3ShRP8z4QKy7asOVRBh
            XPjxRJ2RcTtEHYUoW3guzoZGSiPW/ex2fcupwaSRDG2GQ/ImiB5dmXSaG2va1MbX
            z93Ej7Gy2IURglWCK29v4mJiqtDzq8/GNztT7zezHxyUAjjuJ59qXzFF/MQPibxY
            p3dTfkNNrTqrCQnrFa8k0lgBtKmvz/HO3eCguXVMNgOt+BmfZbJqq+AD8HKYNxaM
            W0A+9WRmYXcOEUqfaoX9IE9LhgqDd/xgpW4CujUZrXRYgf4IokSm/MFAD/ZnoxKm
            n2My3wf5PCNd
            =oUOe
            -----END PGP MESSAGE-----
          fp: c4639370c41133a738f643a591ddbc4c3387f1fb
        - created_at: "2025-01-19T22:46:34Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----
            hQIMA98TrrsQEbXUAQ/9HD1muIaf8us6XE5hGfrXuy5axFeJNBtc8igo/OP3jCam
            M2pjwDNIX3EjsgrK2WYo43Xt7aHW5bqnP+d1faLXJ3I0cMia3XxSLmaKswQRrBSi
            P00ew43kBSx0Smwixf5zCSCzBpWrtOXI8monO8xYLtRnSpfKBf/4kc2gQiuAxByd
            fxdE/x1et0XXiK038KgHMnYdOIvMTGcpymoSDHk0bDw+ruBqG93cmzOkT4Oc5CsF
            oeFN83ku1cGFQr58hUhJ1q5eUTK/lDEVYElGJ2n0pGxThYyrUz3SIzZu3Jbxgs/Q
            2Xok4KsNPEbY2VKz/d3nrwbg2S3VF/CHl9sKxoFK8g3WcEE+HO7BFqvz901H+aUJ
            5mN7stKSs5pViDHusv3Kv2+eT2fPJ4lPU2IEvXkCt3jjB/G0UDz+t6Qn1Wr8PPcO
            8u+QafpILgYTK7QOF88GYstq8iWOWHlN9VKFYfqHMGWkrMtnGRWCbXsNmg7lKh6D
            MtdvROsESVDKtydZwBpoQ4ILLROhkoL+eOMzFOgc/i4PWFlva2RBuRnZQNlieq/R
            9aYpGsZbD+YYGjQKhlwwakpWK5XOoqqSh6Fv6Qzonu2Y++Zf9c9zpe+LINlUhxEY
            AA1YnxbqvVJCqoBuq5avAd0fivhFDes0OmR7jLZzluotgwUePwBOVGo5l2ow/03S
            WAGO2443OWOfbmTi/mq1C/8It1WAkC70XSQbff9pHLd4pRA6XgjMXbJ8+5X0FXRM
            H5nWOAaO4Dp6SnccT3Q9zytkm+lXdJL6Rou3PkmP4JBvU535bNv5a3k=
            =732R
            -----END PGP MESSAGE-----
          fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4
    unencrypted_suffix: _unencrypted
    version: 3.9.2
--- a/machines/modules/disko/btrfs-laptop.nix
+++ b/machines/modules/disko/btrfs-laptop.nix
@@ -0,0 +1,63 @@
 { config, self, inputs, ... }:
 {
  imports = [
    inputs.disko.nixosModules.disko
  ];
  # https://github.com/nix-community/disko/blob/master/example/luks-btrfs-subvolumes.nix
  disko.devices = {
    disk = {
      main = {
        type = "disk";
        # When using disko-install, we will overwrite this value from the commandline
        device = "/dev/disk/by-id/some-disk-id";
        content = {
          type = "gpt";
          partitions = {
            ESP = {
              size = "512M";
              type = "EF00";
              content = {
                type = "filesystem";
                format = "vfat";
                mountpoint = "/boot";
                mountOptions = [ "umask=0077" ];
              };
            };
            luks = {
              size = "100%";
              content = {
                type = "luks";
                name = "crypted";
                passwordFile = /tmp/secret.key; # Interactive
                content = {
                  type = "btrfs";
                  extraArgs = [ "-f" ];
                  subvolumes = {
                    "/root" = {
                      mountpoint = "/";
                      mountOptions = [ "compress=zstd" "noatime" ];
                    };
                    "/home" = {
                      mountpoint = "/home";
                      mountOptions = [ "compress=zstd" "noatime" ];
                    };
                    "/nix" = {
                      mountpoint = "/nix";
                      mountOptions = [ "compress=zstd" "noatime" ];
                    };
                    "/swap" = {
                      mountpoint = "/.swapvol";
                      swap.swapfile.size = "20M";
                    };
                  };
                };
              };
            };
          };
        };
      };
    };
  };
 }
--- a/machines/modules/disko/default.nix
+++ b/machines/modules/disko/default.nix
@@ -187,7 +187,6 @@ in
              postCreateHook = lib.mkIf cfg.encryption ''
                zfs set keylocation="prompt" zroot/encrypted;
              '';
            };
            "encrypted/root" = {
              type = "zfs_fs";
@@ -245,12 +244,13 @@ in
              };
              # use this to read the key during boot
              postCreateHook = lib.mkIf cfg.encryption ''
-                zfs set keylocation="file:///root/secret.key" storage/encrypted;
+                zfs set keylocation="prompt" storage/encrypted;
              '';
            };
            "encrypted/data" = {
              type = "zfs_fs";
              mountpoint = "/data";
              options.mountpoint = "legacy";
            };
            reserved = {
              # for cow delete if pool is full
@@ -267,7 +267,7 @@ in
    };
    boot.zfs.devNodes = lib.mkDefault cfg.devNodes;
-    boot.zfs.extraPools = lib.mkIf cfg.storage.enable [ "storage" ];
+
    fileSystems."/".neededForBoot = true;
    fileSystems."/etc".neededForBoot = true;
    fileSystems."/boot".neededForBoot = true;
--- a/machines/modules/host_builder.nix
+++ b/machines/modules/host_builder.nix
@@ -1,243 +0,0 @@
 { self
 , nixpkgs-unstable
 , nixpkgs
 , sops-nix
 , inputs
 , hosts
 , ...
 }:
 let
  pkgs = nixpkgs.legacyPackages."x86_64-linux";
 in
 rec {
  nixosSystem = nixpkgs.lib.makeOverridable nixpkgs.lib.nixosSystem;
  nixosSystemUnstable = nixpkgs-unstable.lib.makeOverridable nixpkgs-unstable.lib.nixosSystem;
  baseModules = [
    # make flake inputs accessiable in NixOS
    { _module.args.inputs = inputs; }
    {
      imports = [
        ({ pkgs, ... }: {
          nix = {
            extraOptions = ''
              experimental-features = nix-command flakes
            '';
            settings = {
              substituters = [
                "https://cache.dynamicdiscord.de"
                "https://cache.nixos.org/"
              ];
              trusted-public-keys = [
                "cache.dynamicdiscord.de:DKueZicqi2NhJJXz9MYgUbiyobMs10fTyHCgAUibRP4="
              ];
              trusted-users = [ "root" "@wheel" ];
            };
          };
        })
        sops-nix.nixosModules.sops
      ];
    }
  ];
  defaultModules = baseModules;
  makeMicroVM = hostName: ipv4Addr: macAddr: modules: [
    {
      microvm = {
        hypervisor = "cloud-hypervisor";
        mem = 2560;
        shares = [
          {
            source = "/nix/store";
            mountPoint = "/nix/.ro-store";
            tag = "store";
            proto = "virtiofs";
            socket = "store.socket";
          }
          {
            source = "/var/lib/microvms/${hostName}/etc";
            mountPoint = "/etc";
            tag = "etc";
            proto = "virtiofs";
            socket = "etc.socket";
          }
          {
            source = "/var/lib/microvms/${hostName}/var";
            mountPoint = "/var";
            tag = "var";
            proto = "virtiofs";
            socket = "var.socket";
          }
        ];
        interfaces = [
          {
            type = "tap";
            id = "vm-${hostName}";
            mac = "${macAddr}";
          }
        ];
      };
      systemd.network.enable = true;
      systemd.network.networks."20-lan" = {
        matchConfig.Type = "ether";
        networkConfig = {
          Address = [ "${ipv4Addr}/24" ];
          Gateway = "10.0.0.1";
          DNS = ["1.1.1.1"];
          DHCP = "no";
        };
      };
    }
  ] ++ defaultModules ++ modules;
  inputsMod = inputs // { malobeo = self; };
    vmMicroVMOverwrites = hostname: options: {
      microvm = rec {
        mem = pkgs.lib.mkForce 4096;
        hypervisor = pkgs.lib.mkForce "qemu";
        socket = pkgs.lib.mkForce null;
        #needed for hosts that deploy imperative microvms (for example fanny)
        writableStoreOverlay = pkgs.lib.mkIf options.writableStore "/nix/.rw-store";
        volumes = pkgs.lib.mkIf options.writableStore [ {
          image = "nix-store-overlay.img";
          mountPoint = writableStoreOverlay;
          size = 2048;
        } ];
        shares = pkgs.lib.mkForce (pkgs.lib.optionals (!options.writableStore) [
          {
            tag = "ro-store";
            source = "/nix/store";
            mountPoint = "/nix/.ro-store";
          }
        ] ++ pkgs.lib.optionals (options.varPath != "") [
          {
            source = "${options.varPath}";
            securityModel = "mapped";
            mountPoint = "/var";
            tag = "var";
          }
        ]);
        interfaces = pkgs.lib.mkIf (!options.withNetworking) (pkgs.lib.mkForce [{
          type = "user";
          id = "eth0";
          mac = "02:23:de:ad:be:ef";
        }]);
        #if networking is disabled forward port 80 to still have access to webservices
        forwardPorts = pkgs.lib.mkIf (!options.withNetworking && options.fwdPort != 0) (pkgs.lib.mkForce [
          { from = "host"; host.port = options.fwdPort; guest.port = 80; }
        ]);
      };
      fileSystems = {
        "/".fsType = pkgs.lib.mkForce "tmpfs";
        # prometheus uses a memory mapped file which doesnt seem supported by 9p shares
        # therefore we mount a tmpfs inside the datadir
        "/var/lib/prometheus2/data" = pkgs.lib.mkIf (hostname == "overwatch" && options.varPath != "") (pkgs.lib.mkForce {
          fsType = pkgs.lib.mkForce "tmpfs";
        });
      };
      boot.isContainer = pkgs.lib.mkForce false;
      services.timesyncd.enable = false;
      users.users.root.password = "";
      services.getty.helpLine = ''
        Log in as "root" with an empty password.
        Use "reboot" to shut qemu down.
      '';
    };
    vmDiskoOverwrites = {
      boot.initrd = {
        secrets = pkgs.lib.mkForce {};
        network.ssh.enable = pkgs.lib.mkForce false;
      };
      malobeo.disks.enable = pkgs.lib.mkForce false;
      networking.hostId = "a3c3101f";
    };
    vmSopsOverwrites = host: {
      sops.defaultSopsFile = pkgs.lib.mkForce ../${host}/dummy.yaml;
      environment.etc = {
        devHostKey = {
          source = ../secrets/devkey_ed25519;
          mode = "0600";
        };
      };
      services.openssh.hostKeys = [{
        path = "/etc/devHostKey";
        type = "ed25519";
      }];
    };
    vmNestedMicroVMOverwrites = host: sopsDummy: {
      services.malobeo.microvm.deployHosts = pkgs.lib.mkForce [];
      microvm.vms = 
      let
        # Map the values to each hostname to then generate an Attrset using listToAttrs
        mapperFunc = name: { inherit name; value = {
          specialArgs.inputs = inputsMod;
          specialArgs.self = self;
          config = {
            imports = (makeMicroVM "${name}" 
                                   "${hosts.malobeo.hosts.${name}.network.address}"
                                   "${hosts.malobeo.hosts.${name}.network.mac}" [
              ../${name}/configuration.nix     
              (vmMicroVMOverwrites name { 
                withNetworking = true; 
                varPath = ""; 
                writableStore = false; })
              (if sopsDummy then (vmSopsOverwrites name) else {})
            ]);
          };
        }; };
      in
      builtins.listToAttrs (map mapperFunc self.nixosConfigurations.${host}.config.services.malobeo.microvm.deployHosts);
    };
    buildVM = host: networking: sopsDummy: disableDisko: varPath: writableStore: fwdPort: (self.nixosConfigurations.${host}.extendModules {
        modules = [
            (vmMicroVMOverwrites host { 
              withNetworking = networking; 
              varPath = "${varPath}"; 
              writableStore = writableStore;
              fwdPort = fwdPort; })
            (if sopsDummy then (vmSopsOverwrites host) else {})
            (if disableDisko then vmDiskoOverwrites else {})
          ] ++ pkgs.lib.optionals (hosts.malobeo.hosts.${host}.type != "microvm") [
            inputs.microvm.nixosModules.microvm
          ] ++ pkgs.lib.optionals (self.nixosConfigurations.${host}.config ? services.malobeo.microvm.deployHosts) [
            (vmNestedMicroVMOverwrites host sopsDummy)
        ];
      });
  buildHost = hosts: (builtins.mapAttrs (host: settings: nixosSystem {
    system = if (settings.type == "rpi") then "aarch64-linux" else "x86_64-linux";
    specialArgs.inputs = inputsMod;
    specialArgs.self = self;
    modules = (if (settings.type != "microvm") then
      defaultModules ++ [ ../${host}/configuration.nix ]
      else
      makeMicroVM "${host}" "${settings.network.address}" "${settings.network.mac}" [
        inputs.microvm.nixosModules.microvm
        ../${host}/configuration.nix
      ]);
  }) hosts);
 }
--- a/machines/modules/malobeo/initssh.nix
+++ b/machines/modules/malobeo/initssh.nix
@@ -30,7 +30,9 @@ in
      loader.efi.canTouchEfiVariables = true;
      supportedFilesystems = [ "vfat" "zfs" ];
      zfs = {
        forceImportAll = true;
        requestEncryptionCredentials = true;
      };
      initrd = {
        availableKernelModules = cfg.ethernetDrivers;
--- a/machines/modules/malobeo/metrics.nix
+++ b/machines/modules/malobeo/metrics.nix
@@ -1,56 +0,0 @@
 { config, lib, pkgs, ... }:
 let 
  cfg = config.malobeo.metrics;
 in
 {
  options.malobeo.metrics = {
    enable = lib.mkOption {
      type = lib.types.bool;
      default = false;
      description = "Enable sharing metrics";
    };
    enablePromtail = lib.mkOption {
      type = lib.types.bool;
      default = true;
      description = "Enable sharing logs";
    };
    logNginx = lib.mkOption {
      type = lib.types.bool;
      default = false;
      description = "Share nginx logs";
    };
    lokiHost = lib.mkOption {
      type = lib.types.str;
      default = "10.0.0.14";
      description = "Address of loki host";
    };
  };
  config = lib.mkIf (cfg.enable) {
    networking.firewall.allowedTCPPorts = [ 9002 ];
    services.prometheus = {
      exporters = {
        node = {
          enable = true;
          enabledCollectors = [ "systemd" "processes" ];
          port = 9002;
        };
      };
    };
    services.promtail = {
      enable = cfg.enablePromtail;
      configFile = import ./promtail_config.nix { 
        lokiAddress = cfg.lokiHost;
        logNginx = cfg.logNginx;
        config = config;
        pkgs = pkgs;
      };
    };
    users.users.promtail.extraGroups = [ "systemd-journal" ] ++ (lib.optionals cfg.logNginx [ "nginx" ]) ;
  };
 }
--- a/machines/modules/malobeo/microvm_client.nix
+++ b/machines/modules/malobeo/microvm_client.nix
@@ -1,28 +0,0 @@
 {config, lib, pkgs, ...}:
 let
  cfg = config.services.malobeo.microvm.client;
 in
 {
  options.services.malobeo.microvm.client = {
    nextcloud = {
      enable = lib.mkEnableOption "enable the nextcloud microvm wrapper";
      datadir = lib.mkOption {
        type = lib.types.string;
        default = "/data/services/nextcloud/";
        description = "set a custom datadir";
      };
    };
  };
  config = lib.mkMerge [
    (lib.mkIf cfg.nextcloud.enable { #add check for run-vm?
      services.malobeo.microvm.deployHosts = ["nextcloud"];
      microvm.vms.nextcloud.config.microvm.shares = lib.mkAfter [{
        source = cfg.datadir;
        mountPoint = "/datadir";
        tag = "nc-datadir";
        proto = "virtiofs";
      }];
    })
  ];
 }
--- a/machines/modules/malobeo/promtail_config.nix
+++ b/machines/modules/malobeo/promtail_config.nix
@@ -1,49 +0,0 @@
 { logNginx, lokiAddress, config, pkgs, ... }:
 let
  basecfg = ''
    server:
      http_listen_port: 9080
      grpc_listen_port: 0
    positions:
      filename: /tmp/positions.yaml
    clients:
      - url: http://${lokiAddress}:3100/loki/api/v1/push
  '';
  withNginx = ''
    scrape_configs:
      - job_name: journal
        journal:
          max_age: 12h
          labels:
            job: systemd-journal
            host: ${config.networking.hostName}
        relabel_configs:
          - source_labels: ["__journal__systemd_unit"]
            target_label: "unit"
      - job_name: nginx
        static_configs:
        - targets:
            - localhost
          labels:
            job: nginx
            __path__: /var/log/nginx/*log
  '';
  withoutNginx = ''
    scrape_configs:
      - job_name: journal
        journal:
          max_age: 12h
          labels:
            job: systemd-journal
            host: ${config.networking.hostName}
        relabel_configs:
          - source_labels: ["__journal__systemd_unit"]
            target_label: "unit"
  '';
 in
 pkgs.writeText "promtailcfg.yaml" (if logNginx then ''${basecfg}${withNginx}'' else ''${basecfg}${withoutNginx}'')
--- a/machines/nextcloud/configuration.nix
+++ b/machines/nextcloud/configuration.nix
@@ -1,72 +0,0 @@
 { config, self, lib, pkgs,  ... }:
 with lib;
 {
  sops.defaultSopsFile = ./secrets.yaml;
  sops.secrets = {
    nextcloudAdminPass = {
      owner = "nextcloud";
      group = "nextcloud";
    };
  };
  networking = {
    hostName = mkDefault "nextcloud";
    useDHCP = false;
  };
  imports = [
    self.nixosModules.malobeo.metrics
    ../modules/malobeo_user.nix
    ../modules/sshd.nix
    ../modules/minimal_tools.nix
    ../modules/autoupdate.nix
  ];
  malobeo.metrics = {
    enable = true;
    enablePromtail = true;
    logNginx = true;
    lokiHost = "10.0.0.14";
  };
  services.nextcloud = {
    enable = true;
    package = pkgs.nextcloud30;
    hostName = "cloud.malobeo.org";
    config.adminpassFile = config.sops.secrets.nextcloudAdminPass.path;
    #https = true; #disable for testing
    datadir = "/datadir";
    database.createLocally = true;
    config.dbtype = "pgsql";
    configureRedis = true;
    caching = {
      redis = true;
      apcu = true;
    };
    extraAppsEnable = true;
    extraApps = {
      inherit (config.services.nextcloud.package.packages.apps) contacts calendar deck polls;
      collectives = pkgs.fetchNextcloudApp {
        sha256 = "sha256-cj/8FhzxOACJaUEu0eG9r7iAQmnOG62yFHeyUICalFY=";
        url = "https://github.com/nextcloud/collectives/releases/download/v2.15.2/collectives-2.15.2.tar.gz";
        license = "agpl3Plus";
      };
    };
    settings = {
      trusted_domains = ["10.0.0.13"];
      "maintenance_window_start" = "1";
      "default_phone_region" = "DE";
    };
    phpOptions = {
      "realpath_cache_size" = "0";
      "opcache.interned_strings_buffer" = "23";
    };
  };
  networking.firewall.allowedTCPPorts = [ 80 443 ];
  system.stateVersion = "22.11"; # Did you read the comment?
 }
--- a/machines/nextcloud/dummy.yaml
+++ b/machines/nextcloud/dummy.yaml
@@ -1,68 +0,0 @@
 nextcloudAdminPass: ENC[AES256_GCM,data:4GvCg7g=,iv:3m2Vh86WzrVR7BG0xlNwRE9ebIGLWbVdcxoYC9x7dXo=,tag:t2bWTVlw9rHSVnkXW8ZTFQ==,type:str]
 sops:
    kms: []
    gcp_kms: []
    azure_kv: []
    hc_vault: []
    age:
        - recipient: age18jn5mrfs4gqrnv0e2sxsgh3kq4sgxx39hwr8z7mz9kt7wlgaasjqlr88ng
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvbTYrcUV3Wk0xSDM1Mm0w
            TkoxZHBFUXFBSC80YzkwV3paWGpRaFY2WndZClh1c0xmNWpWMjFXOS9OYU9OU2Mx
            c3NEREczaDkvNC90eERwb0RKUlNZemsKLS0tIEp1VWZISXZoWFNuRC9mVE1JUmc3
            bUNFd2dyRGludFQ3MzdiRzFTcXUwWlkKFGd8Uvfu2W1LejgQFpF162JnVmfPxAuX
            IQ3oopYXUBM3QqCXGLTY3DBffD4WZ4AXyGLsfUtwn3kcvjQ85ewidw==
            -----END AGE ENCRYPTED FILE-----
        - recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBraEtDblNxMGY0NlhzcDdM
            RFo2VGI1UFE4eVdZdDZ5ZTNKRUFCRWFHOWdBCkRBaGk2WmYxK2ovbHQrSGl3akVp
            TUhxck83Q1NVQy9VU0lXOEVraGtOZ1UKLS0tIDYxS0hHSW1nZW9hOTFJNCtheU1x
            ZXk2b1RVd1FoYk4xTGxKQ1cxZmVJalkKkC5XckyrgwfqaeVq+OjNCzAtKKiCf7Q9
            sC9ZMlPoOAm8xpLEpWgNooOBa04YsDEe9XgN8S0HrVxt/NHlnS5+ow==
            -----END AGE ENCRYPTED FILE-----
    lastmodified: "2025-01-19T22:23:37Z"
    mac: ENC[AES256_GCM,data:ZVMA4qgliSASQ0LtuedU4pybVwJA0x4vdSlOspsTF22s9DjRbG2tA7PpxTqDBGliBqS4w5J6Rqp3OSF7zddZ23GOz72sOZv0WY5YGeYxIltT7RWSMRkhkwXoM8Pf3BOYCZ4Gy8zaMVnbwbhHZ9LZI6wulh19SDKBV965moUW+Z0=,iv:tmz8C1kGUZq8gfzTHoaU/8RfrT5ohLqA11H42l7TEv0=,tag:E3AV6t2bbKASeVI2G3kNYA==,type:str]
    pgp:
        - created_at: "2025-01-19T22:23:26Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----
            hQGMA5HdvEwzh/H7AQwAsbbUEzSg7iETqT40w/+qjJ+iuHUeeZ+NFMPVVedbLuZX
            /gPPSJ3JSx3wxJke+QPX/OUiRxXwGBZ5yg7CDoc+RrrdaavazuOUGISL38KPQiin
            TmUq4nY6nWjMqHPSaQ+NiGxRpIErCQCUx6YEdi4YgHhf9J4KEg0f7ueR5wWlfzx4
            c7pXkEubFpPy4v45mh8sYXOQTa2yt2keprJ6iqmfL/HKnCJf1TBFxJAvwnPuKDfe
            npvE4Pk5hcoKjFQNsqpnz7Etc8XfAYXSCXSLKfSaZNSeXQRhE1lHLH9OPnC46li7
            Dw6SPW0/4MTJrg08JvrNeogQ1QohLT4mkfAnASVUUeGFaF7UhztVoodqMsG8kuhD
            LtmYv625h3j/QqshpFPGe8nJG1DziE4YHngxvgToIC+6+Q2x47ciulpimlpt6b6w
            s+mGEVlJLSoJMd9jwE53PMXteBYKWgSEL7osj1V5KIJDFSgwfjYEngCkuyxjf8e3
            uYxb1WEadSyLhW8xnoyE0lYB6WI8m6j2Ls9TFG7kKtQqrnVSZd2nsKk/5wPVIAXO
            nrMtb4Q88PLM1eusiLgCs592owKHoWVYqBRpi79EBlnGZwmTfDQzTsQlL7aQCbIo
            kBI1swNH3g==
            =K/IK
            -----END PGP MESSAGE-----
          fp: c4639370c41133a738f643a591ddbc4c3387f1fb
        - created_at: "2025-01-19T22:23:26Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----
            hQIMA98TrrsQEbXUAQ/7BGOQn8xVX9IOFHnUXKdiw/+fcXHu0L7CLuhcEfpZRJNI
            vIbztLTH5gT59SkS07cIEcYWqERO+gjK6pZLCxmYO/c15YDWCv1PtS4YHZAET+ow
            YHzBTZDq2k+pV/cTbUtJgGYOxuqkqUtflyGZSQM+NjSXu4In83u+nwkEaKSxcaWt
            q9rrYVkBUiika2FYtyehoCoDuyJzNmfGhZ9CPJaUzrSzuRLQZy6Hdg8TDPTzGqi4
            awo53eOdsEpNu1AQ5rnJ19RFLU63IQlwEnApnXZZ+AX8J2//KgLOcAqjo5skJuN1
            EJBh4DjfmOdCCN3uRccNiDn9YYrPP5Jl3jfnkMUQ2gVEE/c5ib84hvjc+y9Eh1jJ
            s2JqhfX+ccV5kuva1q1CuTUCHQVEKahJAvghl77JQjtUY6Lf+5QLeKbchUnwxaIN
            v6MwZmdCwBJOS40SnA+Ft2g9psho4MIPXtu4DR4t5VWvhrmw2cl7TCffQslWETxE
            267PHQegcO40skEOYwkLSv7PWycL3YUg/EfPuElAobqlM45UQA/lcC5seV0WvEPB
            Lj+Pk8stY3LZ5wpblmmA72PyJhTq7ghsPvxlyRByHIS8v94gu5Zasbi63WGmxgPA
            mt/M/HIQEf2XOOKuJnGJ3yDwLTAHAgFa0jlIgvt4gkuhm5ibcHLmedBh4ecRNfDS
            VgFA4UwqUKN1XYTWOvT1vlxE9UE+dgVO0QNMX8yw1ivmL2eyPUk8HtIpKbuDLFIC
            iKwHMtUIW/q7UPmfKLRbDumimG/290GXxN24ouiN8AR0dCXK9oor
            =EsRn
            -----END PGP MESSAGE-----
          fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4
    unencrypted_suffix: _unencrypted
    version: 3.9.2
--- a/machines/nextcloud/secrets.yaml
+++ b/machines/nextcloud/secrets.yaml
@@ -1,68 +0,0 @@
 nextcloudAdminPass: ENC[AES256_GCM,data:es9hhtCcqBqPbV2L,iv:Kyq5kqao0uaMPs0GeRkJT9OWYSZfImBXngg51k0uQ0M=,tag:zN/u90/j4rmdo0HtY+cF9w==,type:str]
 sops:
    kms: []
    gcp_kms: []
    azure_kv: []
    hc_vault: []
    age:
        - recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqSk9GWktrZ3FsRHpOcTJp
            Y3VWMytTRlhxVXJma1puT1lMRTN2NHBNV2xrCi8xYTFWeVN6RWl0Um9mZXpoKzFh
            SjVFcGJRNlhkVUZQYXpEb0EwYzUvUjQKLS0tIGEvdGdMRGxvcndxMllZTWZqKzg1
            aWlJOTdYV1JMM0dIWEFDSHRuQWdlcVUKsdwGZ3SkJEf4ALDhHUlSQJNKrFyWd7fW
            WTGk66NJ2yD8ko/6OyB9J9U0WPbFLgr972H+klBq/IDmOx0hClbYNA==
            -----END AGE ENCRYPTED FILE-----
        - recipient: age1w07s4y2uh0xd322ralyyh79545lvxzqncd0s65q9cx4ttlqv5u9s7y78gr
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoNzdib3Ztd0g0MlVqYVF6
            cUtjZzEyY2FJYVRoT1p5RlJwYVQwUXVOUkNVCkp4V3hMYlJsaVN4RjlwQXNWS1Jt
            aitzWVdOcUdrNHorenZGZU1iWFZzVjgKLS0tIGNGcTU5OUJLM3VzQk1uODFwS1hO
            WG16Y25tMDkreGFnSFRKN1AybyttYWcKcLHJScp2Ozh0jIdi7Hb/tSjaCGorqXaC
            9DIrQPHbPP1RIc6Ak8Kn30/BHEWV3VaiBCT3vfS9pNJQNjB4T+901g==
            -----END AGE ENCRYPTED FILE-----
    lastmodified: "2024-11-26T20:00:50Z"
    mac: ENC[AES256_GCM,data:qoY9SfpoU+8HfvD5v/1S6BOkbnZUmHIbtwr0tTSuPETjnFNgr1VVw9mnRatJKPYYFb9/rMZQWIqTY+iUIEkcTVyVXhd6ki5CHW+uxCeBIyMzq33rtEa/btkEUoii4iPieamBCIY21W0znE+edxfR04yRJtLxMICEbuW4Hjf6bwk=,iv:nG42fRgjpuIjPMYnn/6egEdzYolcUBsspaZ8zMv4888=,tag:C6apGoAvVLsWdLWSCwrx6w==,type:str]
    pgp:
        - created_at: "2025-01-21T21:04:08Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----
            hQGMA5HdvEwzh/H7AQv/ejIylIgs3yeVcZriQTA8d/xyXTdFw6On422lTCDk3d0W
            GOdV44vAzUzNX5tziQtLjectLUrKh9Qb9WaP4VnTCGI0XJ/dEtYRCkYMx8MjjbLl
            8GqFi3Hw958Uykp9wt0iiP6BQ42Fo77EPxVcn21eHKZY0zg/vaeRXXeXSzkjzANs
            NN/KFS06uFRJhmp+0z6hDRrHnpb0wd5JGjHOp96jK9LmpwfZZZlVpAHp04hOhlPV
            cMmdjg9IRSubvbraTbDrgwB0h3JKdqovFDnAP/KvT+rw5xnVUVMq/3tUNq4MbfZb
            CvQrXsjQJQbEhY+eAJZVRO07kX0+zMvIin4ss7Xt++qlo4/OvFvuGbnUhJE+hrBb
            nkyGhbDrjpsfa3djCEZ0UxMAWtPeIQ7T8QMkGY+UKeJKxfOGSchARnfCtGD/rtsj
            wuhqGya7g7WP78WzwASzlPwB5jpdQ29/zLWXR60lNCYu0UYSVYmlspZnKEB0FkLO
            TNUrwXXMrM0XwMVaG/sF0lgBEPE6CTuE85evCHFyu6zhEAa7YimKAPIowcwYLSJ2
            46KfttJAYnRnb68Kk9N5xcFyvhKyTx/6eMdxkgr2LMoSTBDUgZfG3rDQC+ZbFE3m
            bUOvx3Ho80EC
            =oQd6
            -----END PGP MESSAGE-----
          fp: c4639370c41133a738f643a591ddbc4c3387f1fb
        - created_at: "2025-01-21T21:04:08Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----
            hQIMA98TrrsQEbXUAQ//eu7YkPL7dU4AYWCZI7THsiJ51SOMahOXp/qC5yL18aZY
            r4SpyNhFezGIJfMuhwBSZZBI/MNW6M+zMwIJ2wkioxUDnDvfVi10/cV6p85U75Jn
            59e1afN+eekG2DCI6sWPmLy8jmYh4CQRdEurtfzquDOARZ4IHZjotP5AWI8OPHlM
            FdK2jGXFVevQY0m619CNm78D2NEdlGe1QtLVSazWQ8MsDLfMnHTYFUy3EoSihzat
            QkcR//8whzlLT/NcqKlnBDNBU7FvPov+ZdUmIw1mx2wp5f2sGp4m737Yhoey2aFL
            qLXHDc91nVRcw95FBDNYlSH8a2AzT4sm4vFR5EkC6vrfz+v1pdg1Fc3dc++hPgE0
            MYWn6f4v8lDhPhw2kpmAP4Oz4uPdmPgdfXKiIzr7qf3O5lIC6ZIIwoqhj2f0odj6
            7anDUN5C3B5ruFU3UNJEBLrZelbmg4zf2hAtzfoi0L9paIZX5SCLP3PDbvdRbADc
            oyC3Gw/DeddQ9ZeP+wYiwJ/614zRBmZRzQr9RFowf0gJBSS7TaWPCONfUJ/3eekX
            or8JpLTD5PMQNoS0L4S41Cj+yOg/AlmHF/9yvj1GVTKT9rBj3Snki9NOmY2ZUQo3
            BDdnsftA3w4q4iu06ojQkrjn/FJjmNzb83XR2WxrHFUAaY//nISyY/9uTsEhwFbS
            WAFlKfmyVc7nLBI12i0yWLLy/tcVF3c8gtGfNmyoe/RIr+6EQmzUi0v+X49Tnzpj
            8JAnE+4Jzm2ijqF4Ats5KoXqFiLUenJZQHJ3IFoI36n+hM4P/ICeZ4k=
            =s9pl
            -----END PGP MESSAGE-----
          fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4
    unencrypted_suffix: _unencrypted
    version: 3.8.1
--- a/machines/overwatch/configuration.nix
+++ b/machines/overwatch/configuration.nix
@@ -1,131 +0,0 @@
 { config, self, lib, pkgs, inputs, ... }:
 with lib;
 {
  networking = {
    hostName = mkDefault "overwatch";
    useDHCP = false;
  };
  imports = [
    self.nixosModules.malobeo.metrics
    ../modules/malobeo_user.nix
    ../modules/sshd.nix
  ];
  networking.firewall.allowedTCPPorts = [ 80 3100 ];
  malobeo.metrics = {
    enable = true;
    enablePromtail = true;
    logNginx = false;
    lokiHost = "10.0.0.14";
  };
  services.grafana = {
    enable = true;
    settings.server = {
      domain = "grafana.malobeo.org";
      http_port = 2342;
      http_addr = "127.0.0.1";
    };
    provision.datasources.settings = {
      apiVersion = 1;
      datasources = [
        {
          name = "loki";
          type = "loki";
          access = "proxy";
          uid = "eeakiack8nqwwc";
          url = "http://localhost:3100";
          editable = false;
        }
        {
          name = "prometheus";
          type = "prometheus";
          access = "proxy";
          uid = "feakib1gq7ugwc";
          url = "http://localhost:9001";
          editable = false;
        }
      ];
    };
    provision.dashboards.settings = {
      apiVersion = 1;
      providers = [{
        name = "default";
        options.path = ./dashboards;
      }];
    };
  };
  services.nginx = {
    enable = true;
    virtualHosts.${config.services.grafana.domain} = {
      locations."/" = {
          proxyPass = "http://127.0.0.1:${toString config.services.grafana.port}";
          proxyWebsockets = true;
      extraConfig = ''
        proxy_set_header Host $host;
      '';
    };
      };
  };
  services.prometheus = {
    enable = true;
    port = 9001;
    scrapeConfigs = [
      {
        job_name = "overwatch";
        static_configs = [{
          targets = [ "127.0.0.1:9002" ];
        }];
      }
      {
        job_name = "durruti";
        static_configs = [{
          targets = [ "10.0.0.5:9002" ];
        }];
      }
      {
        job_name = "infradocs";
        static_configs = [{
          targets = [ "10.0.0.11:9002" ];
        }];
      }
      {
        job_name = "nextcloud";
        static_configs = [{
          targets = [ "10.0.0.13:9002" ];
        }];
      }
      {
        job_name = "fanny";
        static_configs = [{
          targets = [ "10.0.0.1:9002" ];
        }];
      }
      # add vpn - check how to reach it first. most probably 10.100.0.1
    ];
  };
  services.loki = {
    enable = true;
    configFile = ./loki.yaml;
  };
  users.users.promtail.extraGroups = [ "nginx" "systemd-journal" ];
  system.stateVersion = "22.11"; # Did you read the comment?
 }
--- a/machines/overwatch/dashboards/main.json
+++ b/machines/overwatch/dashboards/main.json
--- a/machines/overwatch/dashboards/node_full.json
+++ b/machines/overwatch/dashboards/node_full.json
--- a/machines/overwatch/loki.yaml
+++ b/machines/overwatch/loki.yaml
@@ -1,60 +0,0 @@
 auth_enabled: false
 server:
  http_listen_port: 3100
  grpc_listen_port: 9096
  log_level: info
  grpc_server_max_concurrent_streams: 1000
 common:
  instance_addr: 127.0.0.1
  path_prefix: /tmp/loki
  storage:
    filesystem:
      chunks_directory: /tmp/loki/chunks
      rules_directory: /tmp/loki/rules
  replication_factor: 1
  ring:
    kvstore:
      store: inmemory
 query_range:
  results_cache:
    cache:
      embedded_cache:
        enabled: true
        max_size_mb: 100
 schema_config:
  configs:
    - from: 2020-10-24
      store: tsdb
      object_store: filesystem
      schema: v13
      index:
        prefix: index_
        period: 24h
 pattern_ingester:
  enabled: true
  metric_aggregation:
    loki_address: localhost:3100
 ruler:
  alertmanager_url: http://localhost:9093
 frontend:
  encoding: protobuf
 # By default, Loki will send anonymous, but uniquely-identifiable usage and configuration
 # analytics to Grafana Labs. These statistics are sent to https://stats.grafana.org/
 #
 # Statistics help us better understand how Loki is used, and they show us performance
 # levels for most users. This helps us prioritize features and documentation.
 # For more information on what's sent, look at
 # https://github.com/grafana/loki/blob/main/pkg/analytics/stats.go
 # Refer to the buildReport method to see what goes into a report.
 #
 # If you would like to disable reporting, uncomment the following lines:
 analytics:
  reporting_enabled: false
--- a/machines/overwatch/promtail.yaml
+++ b/machines/overwatch/promtail.yaml
@@ -1,29 +0,0 @@
 server:
  http_listen_port: 9080
  grpc_listen_port: 0
 positions:
  filename: /tmp/positions.yaml
 clients:
  - url: http://10.0.0.13:3100/loki/api/v1/push
 scrape_configs:
  - job_name: journal
    journal:
      max_age: 12h
      labels:
        job: systemd-journal
        host: overwatch
    relabel_configs:
      - source_labels: ["__journal__systemd_unit"]
        target_label: "unit"
  - job_name: nginx
    static_configs:
    - targets:
        - localhost
      labels:
        job: nginx
        __path__: /var/log/nginx/*log
--- a/machines/overwatch/secrets.yaml
+++ b/machines/overwatch/secrets.yaml
@@ -1,59 +0,0 @@
 grafana_admin: ENC[AES256_GCM,data:c+ZnOyxSXrG4eiK8ETKHheadiSz98LLHYwxb,iv:Ut2qFD2p6OmKDWjLMjFxyISxzTdJpZpgIB7obW5bgkY=,tag:HdayzjXQ1Zc7w9ITLzKLxA==,type:str]
 sops:
    kms: []
    gcp_kms: []
    azure_kv: []
    hc_vault: []
    age:
        - recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxN1VURXJuMENJV1Z2eEtS
            bUR2cTNmNUdhU1B4SHZNMW9KRDV2dW5VNmlNCjdmYXpZb05mMEdPdjN4c0VWOUhV
            RW4vV05CMno1MmJmYzdESjN5MFVFcjQKLS0tIDNxTE1KaW1EVGhtOEQwWXZndk53
            bFBCMExGdEdMb2Z0TzF0Yk02MUpkN0kKIUm9iUvU/xu1Xl6yoYSVGcIXKnGsp/D/
            RjVQ7tgJIbrupubny/fg4v2sz5HOs5uzmEq4ZKgBWrBeMPss4gYstA==
            -----END AGE ENCRYPTED FILE-----
    lastmodified: "2025-01-22T00:51:32Z"
    mac: ENC[AES256_GCM,data:TEEyPmVxIJxC49hDqDbwzTZZ/tNymFr0dMvWn6DRli70Kp5XXNCLTpicAbiFh3WoyzbDpN/5c2yxVNGjhB8nXgKpCZdffdONMY6eSCpPbblYwJS7hNsjW+u2wysSFPDAk5apwbNXJcKnlI1tBcGQRHlym9ShSw6fT7K7afWYWqo=,iv:583DWNug8yNF/vZZN4btT6P1yUa0b1UN4frvAX4UKv0=,tag:YI5KIAe5P5Bx0TZU4wG8ag==,type:str]
    pgp:
        - created_at: "2025-01-22T00:51:09Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----
            hQGMA5HdvEwzh/H7AQv+PxajhJgXHcxwJ7Mk0gjqFV0dGmNJ1m0eY3gPyIS38GSB
            Rjto1zUd6EARu1GnxSrVrSZYlQaL6x3l2DuFIP7mtymvlFrmhiAoDz/si0zlzsJp
            WZyQZdepnt9FyYJAwTzbmfVdpZDYajuMI38byMJqzUhS7SEOsPwiU1KRoTHcf4se
            2E+9v8OwTVT2UoDxyiVJuDAA+K+Jh2RjHk3p/uVnZDqqQpI9UAI8LrCpun9uALpH
            +29wyhkCZ9RIHU7nDQNVvwHkbYCyRUwR44bciSwITpjp7GuZCcZvzSSimPktkC9q
            VZkHA6rHgHgcu6mnMfpP0+j4gB0dU0t4hGF41klV3YpEGfYcFIsKV10lfa6aMNmW
            08RuLdCtnQyplYhgBm1zQvYHJsIuwK9s1B2dz3Z8l3o2eg8AqFuIL+MlZOvf5A/2
            MOXffyXbOM5Dhy7DdUckTOYYfwWe1mStw3vx3I3mAFzuOOR7HQuzlc9Bf1oxh36T
            6e/qOijjPPqkLeR2mufo0lgBBFTQFt2jVvMo1lrCB8Amj4yj/4noXTzglkYTYBKs
            S513kUdhAGtWoNrqcItOYAn/gl+CPGY2Op3tJBVCWM6aT/KO6M/LPJ7wiQk2zlOL
            pp7SnCKvv9eQ
            =N+uj
            -----END PGP MESSAGE-----
          fp: c4639370c41133a738f643a591ddbc4c3387f1fb
        - created_at: "2025-01-22T00:51:09Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----
            hQIMA98TrrsQEbXUAQ//fm/TcxgsAMY6P8jvOQMcRBmjjVwfLP1UTTnkRUa36Mmn
            2V9619zsH1dzTp0gUVV8mvIKUtpz2nCBTZBJw803wW9KorxW6f4e3+mIWelZT5WM
            sLcQPFWAYKDVnSfk5j8kRSmpM6k2xFRB9DTEMIyFH9PZL99Fztp2hjTn553YTQOo
            pdw+AMzgptYQghW/Pl/32wXHwCO+bL8tyk62VIQO13l3tX83oSslXNkFzNQYt3jv
            xXFUaQEGD/1lFLeFnIuJZzfjWt6n0fShJboUcuk/ZIcYdwrbG0pyLLoBoObSRQtG
            t+7VpWpfl3rnk822SU9z9YcaMNy9HD3Kz9Qh0BRQiN3scCMzm1LyzlXLqlc/gPiq
            JyCxy98vJXIxmlLQZpDFfTMe3xsc8jSsHI6av+wEFKGEJAOUkDtRYvLfZdgDTfiB
            XTAhQ3ixnlBxdZZ9DjBXyVfM8q9iB8bggFi7g2SjO32LKhXRFUqZR+avddCyKR/V
            hRpWjDRn+eX2tl7LPawvX6tIow3aZiezkMVyeRXfcZCvpicq64b80LrYR+JJUfJE
            vxHaekKImrdJ9ocii0wW91ZmESJwL6m5lt3ZsCY5GTlEDt4wBse5uhj48mtuK8sh
            g8uQMKp7SiiCtV5a6O1SQLDJeAt6VCcRyudLToO9S4gwrGXNPcGxsHj07XAN2PHS
            WAE6wUhufXfpa8UgSWy7fmEZt4L03XlRfC7bm/ycwaFww3A7w4+B1gkW6gOon6sy
            nOyIxUZfU6abZWKzH+OIuViKH7xPiULDy75gEmkRHjKu5BiC3Tx0eO4=
            =+PPr
            -----END PGP MESSAGE-----
          fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4
    unencrypted_suffix: _unencrypted
    version: 3.9.2
--- a/machines/secrets/devkey_ed25519
+++ b/machines/secrets/devkey_ed25519
@@ -1,7 +0,0 @@
 -----BEGIN OPENSSH PRIVATE KEY-----
 b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
 QyNTUxOQAAACBpnsgZCWwvETJKoZf7QFKCLaUnj8hioci+SewK8cUUwgAAAJgdrbX3Ha21
 9wAAAAtzc2gtZWQyNTUxOQAAACBpnsgZCWwvETJKoZf7QFKCLaUnj8hioci+SewK8cUUwg
 AAAECaQfylNoG/uN8fozvq3loBLWQ3gIKPOGnZpwyHUlAMO2meyBkJbC8RMkqhl/tAUoIt
 pSePyGKhyL5J7ArxxRTCAAAADmthbGlwc29AY2VsaW5lAQIDBAUGBw==
 -----END OPENSSH PRIVATE KEY-----
--- a/machines/secrets/devkey_ed25519.pub
+++ b/machines/secrets/devkey_ed25519.pub
@@ -1 +0,0 @@
 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGmeyBkJbC8RMkqhl/tAUoItpSePyGKhyL5J7ArxxRTC kalipso@celine
--- a/machines/testvm/configuration.nix
+++ b/machines/testvm/configuration.nix
@@ -24,7 +24,7 @@ in
  malobeo.disks = {
    enable = true;
-    encryption = true;
+    encryption = false;
    hostId = "83abc8cb";
    devNodes = "/dev/disk/by-path/";
    root = {
--- a/machines/uptimekuma/configuration.nix
+++ b/machines/uptimekuma/configuration.nix
@@ -6,6 +6,7 @@ with lib;
  networking = {
    hostName = mkDefault "uptimekuma";
    useDHCP = false;
    nameservers = [ "1.1.1.1" ];
  };
  imports = [
--- a/machines/vpn/configuration.nix
+++ b/machines/vpn/configuration.nix
@@ -17,7 +17,6 @@ with lib;
  };
  imports = [
    inputs.self.nixosModules.malobeo.vpn
    ../modules/malobeo_user.nix
    ../modules/sshd.nix
    ../modules/minimal_tools.nix
@@ -35,36 +34,9 @@ with lib;
      locations."/" = {
        proxyPass = "http://10.100.0.101";
        extraConfig = ''
          proxy_set_header Host $host;
        '';
      };
    };
    virtualHosts."cloud.malobeo.org" = {
      locations."/" = {
        proxyPass = "http://10.100.0.101";
        extraConfig = ''
          proxy_set_header Host $host;
        '';
      };
    };
    virtualHosts."grafana.malobeo.org" = {
      locations."/" = {
        proxyPass = "http://10.100.0.101";
        extraConfig = ''
          proxy_set_header Host $host;
        '';
      };
    };
    virtualHosts."tasklist.malobeo.org" = {
      locations."/" = {
        proxyPass = "http://10.100.0.101";
        extraConfig = ''
          proxy_set_header Host $host;
        '';
      };
    };
  };
--- a/machines/vpn/dummy.yaml
+++ b/machines/vpn/dummy.yaml
@@ -1,68 +0,0 @@
 wg_private: ENC[AES256_GCM,data:s+dZfKCfrdZnFKhmCl7u1LRzR5dMflJumh1uVQ5Dktb5teohxDo0zlOR7KE=,iv:N9WSEzGonWNkqix8yaImhvrxpcAEJraWEcTrXORASow=,tag:pKgOmtKJ933FEKZVDHCWWQ==,type:str]
 sops:
    kms: []
    gcp_kms: []
    azure_kv: []
    hc_vault: []
    age:
        - recipient: age18jn5mrfs4gqrnv0e2sxsgh3kq4sgxx39hwr8z7mz9kt7wlgaasjqlr88ng
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSMFk2bzE3OG9VR0VqOTIz
            UEQySS9SUnRmMDFqVTg1dks3WTZvbE13VGxVCitHVE1SVlBlYkZwejNlWWNMTVhF
            M2EzSFRmS3lFd1VPMHRpMjhtMVgyVDQKLS0tIGJObk1kcWlaeUhveHdrY1BEQkh4
            WTJua1FvNFFtMDFGWE9ZaW9wWFoxcncKlYHjkzlUj+rBPmXK/jj9XCUoGrQ4vBXH
            ZTItzrbCI30juPjy6dJ0ffZF2ILvJLUdwurz4lZFybNuUjhE2sAY+A==
            -----END AGE ENCRYPTED FILE-----
        - recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5S1dhZUVpT3NMaGR4eEhV
            dUxvUGVvMUtPbWhEQnpJd3Y1YTBYbm1QMTBVCmpQbkhvM3VWV2MvcmY2RVhVOWdy
            MVZxK201bmcwVHlwUlFnb0p5eGFNNGsKLS0tIDlrc1ErS0NiRUJ0UFZnNHNNSk9m
            U2xLQVhoS2NxNUVvcGZBYW9VVkZNOUEKeCpijhxpkAxCB9/iIQmek03mj7b14sqs
            CuGKgoeq7C6eG1PK3I8MzGplQMyCpEFQ+33KMj0vGwktpv/eVzC8/w==
            -----END AGE ENCRYPTED FILE-----
    lastmodified: "2025-01-19T22:47:26Z"
    mac: ENC[AES256_GCM,data:DiriXLPnm+08q1Jp1YxjEdsJzFiewQxgu1JDdevo9aGdkq92Xu8cnSxLzWUkh8bEDx4uhjOXvZd3PSU9rWiTh899U3Ou99NiSOgR1+wr5ouR20viCZqIe86YqoZlLJnYs2dlZDhL+ggwFqYJ5wfWbq7OauIVEEdnM/57RyNI2qM=,iv:lwOJi4pVGGHn7+CGq7jAHorOTFtl7ONzzV35ec1uEsg=,tag:DhjloWlsGqM579NafaERIw==,type:str]
    pgp:
        - created_at: "2025-01-19T21:35:34Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----
            hQGMA5HdvEwzh/H7AQwAoO2gRS+Vwu+5KZ4V2ReXPcjFcEUb6aoYe8PNUhjBu0yE
            hs4lhWGy53BdupQ+cyxk0U+L6UhOjTfIAYE9emqTDlF5OImN/379j9NfiPe/K0/8
            ylSOuzNgVmTpsXlHGaXE2wk0ADp1P9mZUwbJ5vHCtm+ZFe5HCuTrB61drIU0fEYw
            NVCaARK/IRn5eAlPCjPuW1mhKP+3HNGMQszqCRKMU5kLZPzjqsHmEITSFJ5bVtAu
            fLRtF8SyJpHgvyw1AH1IX6I+/lrDRQro0oD/0LcC1Nay9n86WIWhA/VbotyFCkI2
            gZtV0IQq05mxO11DycgxlDLQk6nqiqDDjWv/8kj23HnQ3BAO6SXLKhHWq9rH8EOX
            wkee7RHc09GWNcGL93YMkjIHWJyitphpU/NtTmEpTptzry5vPfittPaZ+zU+MF8G
            REyft2X9Aj7UWcL1w3kbX9BDWuxImcirWWCShHakSrzAlpuIoXVQA6MCl6/Jr2Ve
            lLx3lDX+BiSpU01zY32q0lgBOGcSEcRVXTiYO00EoJbIiEMwqm1aAXQzaCvhCCpP
            54NsNzZ4eoGL0DmioKwzLbv1CpIJs3w0k6StfOtTCPKdlL99k24Z8GyJ44UnkhCe
            V32jGc/yCong
            =OZSD
            -----END PGP MESSAGE-----
          fp: c4639370c41133a738f643a591ddbc4c3387f1fb
        - created_at: "2025-01-19T21:35:34Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----
            hQIMA98TrrsQEbXUARAAhnd9Z1gekp4XWw+gcWK5j9mXWP7XS/FGNXmmCUBKec1j
            zXzMJjG1YZyCYmqj3XGFMFwg2Ex6pBPoOTzOL2VOGd9mZvHjh0MGtuUopg1GprE7
            NoyrYlV2UikyBSzVlsvykyNCYWfEt0uDotnGIK0NXYzfWfqgw+ImAH/PvNRY4nIB
            wxI/Ze100ITAN7Dop9d6MFUZbrYKZTMsO8w5Z7TWHRPzFWH//XZjY7UpxvNVP1oJ
            RXqqo2I97P0c6H7s17+xw6ZjyE0Qoin1gq4XSMHc4l8o+3D7fWecoTLxcjma5gvY
            SMVCYeSrI2kc8DJ2RVeXdDlEP7SS3bwPNaE4Tklxv1rE+CUuYQ1X6dkPVKnKLfRS
            Lwy614LDAarZmvXc3jPgFkpG+grE80PAStzOze0eWyZA/oCAI3/CS+yaeBAI4viz
            UEkNmCMTZu1eXyIurC/suTOdq4nehGlD/2F8EKU+Y/6f6J2wHUJdvLjNxOuAOHd0
            lGSu61gt/b2PFy/aHqFgQaZCPUMJ8UfK8JQ66zOIUW3HzsXOsvVqo/8DMQRIw7/z
            3tZ43LPjmIeCRFwPfbIbeThoZmq1SPejkzadxDEwD3U0YAiblBJ2E+AyEDiKqP/N
            D+NRN5Ta0ySAmGOyYgDES8QDDBQGA4cSZak7pMidCrSbAagNyYNg3Qrowc0aG93S
            WAFD/Q4EtOdM6kveLdbDkPX/bAiCFwhzSCtDVkLAPxfrkw/a+az6emPWmImML5FT
            to3vvXendrd9+u6uSNK5acuwzW2cW8GM4gLC90+p/kRFJukiGJbl400=
            =6Gw4
            -----END PGP MESSAGE-----
          fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4
    unencrypted_suffix: _unencrypted
    version: 3.9.2
--- a/outputs.nix
+++ b/outputs.nix
@@ -14,16 +14,12 @@ in (utils.lib.eachSystem (builtins.filter filter_system utils.lib.defaultSystems
  let
    pkgs-unstable = nixpkgs-unstable.legacyPackages."${system}";
    pkgs = nixpkgs.legacyPackages."${system}";
    hosts = import ./machines/hosts.nix ( inputs // { inherit inputs; self = self; });
    utils = import ./machines/modules/host_builder.nix ( inputs // { inherit inputs; self = self; hosts = hosts; });
  in
  {
    devShells.default =
    let
      sops = sops-nix.packages."${pkgs.system}";
      microvmpkg = microvm.packages."${pkgs.system}";
      installed = builtins.attrNames self.legacyPackages."${pkgs.system}".scripts;
    in
    pkgs.mkShell {
      sopsPGPKeyDirs = [
@@ -41,20 +37,11 @@ in (utils.lib.eachSystem (builtins.filter filter_system utils.lib.defaultSystems
        pkgs.mdbook
        microvmpkg.microvm
      ];
      packages = builtins.map (pkgName: self.legacyPackages."${pkgs.system}".scripts.${pkgName}) installed;
      shellHook = ''echo "Available scripts: ${builtins.concatStringsSep " " installed}"'';
    };
    legacyPackages = {
      scripts.remote-install = pkgs.writeShellScriptBin "remote-install" (builtins.readFile ./scripts/remote-install-encrypt.sh);
      scripts.boot-unlock = pkgs.writeShellScriptBin "boot-unlock" (builtins.readFile ./scripts/unlock-boot.sh);
      scripts.run-vm = self.packages.${system}.run-vm;
    };
    vmBuilder = utils.buildVM;
    packages = {
      remote-install = pkgs.writeShellScriptBin "remote-install" (builtins.readFile ./scripts/remote-install-encrypt.sh);
      boot-unlock = pkgs.writeShellScriptBin "boot-unlock" (builtins.readFile ./scripts/unlock-boot.sh);
      docs = pkgs.stdenv.mkDerivation {
        name = "malobeo-docs";
        phases = [ "buildPhase" ];
@@ -71,47 +58,67 @@ in (utils.lib.eachSystem (builtins.filter filter_system utils.lib.defaultSystems
          cp -r ./book/* $dest
        '';
      };
    } //
-      run-vm = pkgs.writeShellScriptBin "run-vm"  (builtins.readFile ./scripts/run-vm.sh);
+    builtins.foldl'
    (result: host:
      let
        inherit (self.nixosConfigurations.${host}) config;
      in
      result // {
        # boot any machine in a microvm
        "${host}-vm" = (self.nixosConfigurations.${host}.extendModules {
          modules = [{
            microvm = {
              mem = pkgs.lib.mkForce 4096;
              hypervisor = pkgs.lib.mkForce "qemu";
              socket = pkgs.lib.mkForce null;
              shares = pkgs.lib.mkForce [{
                tag = "ro-store";
                source = "/nix/store";
                mountPoint = "/nix/.ro-store";
              }];
              interfaces = pkgs.lib.mkForce [{
                type = "user";
                id = "eth0";
                mac = "02:23:de:ad:be:ef";
              }];
            };
            boot.isContainer = pkgs.lib.mkForce false;
            users.users.root.password = "";
            fileSystems."/".fsType = pkgs.lib.mkForce "tmpfs";
            services.getty.helpLine = ''
              Log in as "root" with an empty password.
              Use "reboot" to shut qemu down.
            '';
          }] ++ pkgs.lib.optionals (! config ? microvm) [
            microvm.nixosModules.microvm
          ];
        }).config.microvm.declaredRunner;
    })
    { }
    (builtins.attrNames self.nixosConfigurations);
    apps = {
      docs = {
        type = "app";
        program = builtins.toString (pkgs.writeShellScript "docs" ''
          ${pkgs.xdg-utils}/bin/xdg-open "${self.packages.${system}.docs}/share/doc/index.html"
        '');
      };
      docsDev = {
        type = "app";
        program = builtins.toString (pkgs.writeShellScript "docs" ''
          echo "needs to run from infrastuctre root folder"
          ${pkgs.mdbook}/bin/mdbook serve --open ./doc
        '');
      };
      run-vm = {
        type = "app";
        program = "${self.packages.${system}.run-vm}/bin/run-vm";
      };
    };
-  })) // (
+  })) // rec {
-  let
+    nixosConfigurations = import ./machines/configuration.nix (inputs // {
-    hosts = import ./machines/hosts.nix ( inputs // { inherit inputs; self = self; });
+      inherit inputs;
-    utils = import ./machines/modules/host_builder.nix ( inputs // { inherit inputs; self = self; hosts = hosts; });
+      self = self;
-  in
+    });
  {
    nixosConfigurations = utils.buildHost hosts.malobeo.hosts;
    nixosModules.malobeo = {
      host.imports = [ ./machines/durruti/host_config.nix ];
-      microvm.imports = [ ./machines/modules/malobeo/microvm_host.nix ./machines/modules/malobeo/microvm_client.nix];
+      microvm.imports = [ ./machines/modules/malobeo/microvm_host.nix ];
      vpn.imports = [ ./machines/modules/malobeo/wireguard.nix ];
      initssh.imports = [ ./machines/modules/malobeo/initssh.nix ];
      metrics.imports = [ ./machines/modules/malobeo/metrics.nix ];
      disko.imports = [ ./machines/modules/disko ];
    };
@@ -126,4 +133,4 @@ in (utils.lib.eachSystem (builtins.filter filter_system utils.lib.defaultSystems
      nixpkgs.lib.mapAttrs getBuildEntry self.nixosConfigurations
      );
-})
+}
--- a/scripts/remote-install-encrypt.sh
+++ b/scripts/remote-install-encrypt.sh
@@ -1,4 +1,5 @@
 set -o errexit
 set -o nounset
 set -o pipefail
 if [ $# -lt 2 ]; then
@@ -8,21 +9,6 @@ if [ $# -lt 2 ]; then
  exit 1
 fi
 if [ ! -e flake.nix ]
    then
    echo "flake.nix not found. Searching down."
    while [ ! -e flake.nix ]
        do
        if [ $PWD = "/" ]
            then
            echo "Found root. Aborting."
            exit 1
            else
            cd ..
        fi
    done
 fi
 hostname=$1
 ipaddress=$2
@@ -37,11 +23,9 @@ trap cleanup EXIT
 # Create the directory where sshd expects to find the host keys
 install -d -m755 "$temp/etc/ssh/"
 install -d -m755 "$temp/root/"
 diskKey=$(sops -d machines/$hostname/disk.key)
 echo "$diskKey" > /tmp/secret.key
 echo "$diskKey" > $temp/root/secret.key
 ssh-keygen -f $temp/etc/ssh/"$hostname" -t ed25519 -N ""
 ssh-keygen -f $temp/etc/ssh/initrd -t ed25519 -N ""
--- a/scripts/run-vm.sh
+++ b/scripts/run-vm.sh
@@ -1,67 +0,0 @@
 usage() {
    echo "Usage: run-vm <hostname> [--networking] [--dummy-secrets] [--no-disko]"
    echo "ATTENTION: This script must be run from the flakes root directory"
    echo "--networking setup interfaces. requires root and hostbridge enabled on the host"
    echo "--dummy-secrets run vm with dummy sops secrets"
    echo "--no-disko disable disko and initrd secrets. needed for real hosts like fanny"
    echo "--writable-store enables writable store. necessary for host with nested imperative microvms like fanny"
    echo "--var path to directory that should be shared as /var. may require root otherwise some systemd units fail within vm. if dir is empty vm will populate"
    echo "--fwd-port forwards the given port to port 80 on vm"
    exit 1
 }
 # check at least one arg was given
 if [ "$#" -lt 1 ]; then
    usage
 fi
 HOSTNAME=$1
 # Optionale Argumente
 NETWORK=false
 DUMMY_SECRETS=false
 NO_DISKO=false
 RW_STORE=false
 VAR_PATH=""
 FWD_PORT=0
 # check argws
 shift
 while [[ "$#" -gt 0 ]]; do
    case $1 in
        --networking) NETWORK=true ;;
        --dummy-secrets) DUMMY_SECRETS=true ;;
        --no-disko) NO_DISKO=true ;;
        --writable-store) RW_STORE=true ;;
        --var) 
          if [[ -n "$2" && ! "$2" =~ ^- ]]; then
              VAR_PATH="$2"
              shift
          else
              echo "Error: --var requires a non-empty string argument."
              usage
          fi
          ;;
        --fwd-port) 
          if [[ -n "$2" && ! "$2" =~ ^- ]]; then
              FWD_PORT="$2"
              shift
          else
              echo "Error: --var requires a non-empty string argument."
              usage
          fi
          ;;
        *) echo "Unknown argument: $1"; usage ;;
    esac
    shift
 done
 echo "starting host $HOSTNAME"
 echo "enable networking: $NETWORK"
 echo "deploy dummy secrets: $DUMMY_SECRETS"
 echo "disable disko and initrd secrets: $NO_DISKO"
 echo "use writable store: $RW_STORE"
 if [ -n "$VAR_PATH" ]; then
  echo "sharing var directory: $VAR_PATH"
 fi
 nix run --show-trace --impure --expr "((builtins.getFlake \"$(pwd)\").vmBuilder.x86_64-linux \"$HOSTNAME\" $NETWORK $DUMMY_SECRETS $NO_DISKO \"$VAR_PATH\" $RW_STORE $FWD_PORT).config.microvm.declaredRunner"
--- a/scripts/unlock-boot.sh
+++ b/scripts/unlock-boot.sh
@@ -4,31 +4,21 @@ set -o pipefail
 sshoptions="-o StrictHostKeyChecking=no -o ServerAliveInterval=1 -o ServerAliveCountMax=1 -p 222 -T"
 HOSTNAME=$1
 if [ ! -e flake.nix ]
    then
    echo "flake.nix not found. Searching down."
    while [ ! -e flake.nix ]
        do
        if [ $PWD = "/" ]
            then
            echo "Found root. Aborting."
            exit 1
            else
            cd ..
        fi
    done
 fi
 echo
 diskkey=$(sops -d machines/$HOSTNAME/disk.key)
 if [ $# = 1 ]
    then
-    diskkey=$(sops -d machines/$HOSTNAME/disk.key)
+    echo "$diskkey" | ssh $sshoptions root@$HOSTNAME-initrd "systemd-tty-ask-password-agent" #storage
    echo "$diskkey" | ssh $sshoptions root@$HOSTNAME-initrd "systemd-tty-ask-password-agent" #root
 elif [ $# = 2 ]
    then
    diskkey=$(sops -d machines/$HOSTNAME/disk.key)
    IP=$2
    echo "$diskkey" | ssh $sshoptions root@$IP "systemd-tty-ask-password-agent" #storage
    echo "$diskkey" | ssh $sshoptions root@$IP "systemd-tty-ask-password-agent" #root
 else
Author	SHA1	Message	Date
ahtlon	d4ef6381a0	i don't know if this should be used All checks were successful Evaluate Hydra Jobs / eval-hydra-jobs (push) Successful in 4m9s Details Since only passing though the ssh dir doesn't work, the host would be polluted by all the other hosts writing to etc	2025-01-18 17:39:28 +01:00
ahtlon	c416f27c81	add note to docs	2025-01-18 16:35:34 +01:00
ahtlon	0d61107515	Try constant test keys	2025-01-18 16:34:24 +01:00
		`@@ -1 +0,0 @@`
			`ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGmeyBkJbC8RMkqhl/tAUoItpSePyGKhyL5J7ArxxRTC kalipso@celine`