fix flake check

doc/book.toml

@@ -1,5 +1,6 @@
 [book]
 authors = ["ahtlon"]
 language = "de"
+multilingual = false
 src = "src"
 title = "Malobeo Infrastruktur Dokumentation"

flake.lock

@@ -78,6 +78,29 @@
         "type": "github"
       }
     },
+    "gatekeeper": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs-unstable"
+        ],
+        "pyproject-build-systems": "pyproject-build-systems",
+        "pyproject-nix": "pyproject-nix",
+        "uv2nix": "uv2nix"
+      },
+      "locked": {
+        "lastModified": 1785429358,
+        "narHash": "sha256-uWUZm9iRqPkkNWrgtpsN9GyDQsiz80eHvuE14wOKp+Q=",
+        "ref": "refs/heads/master",
+        "rev": "40312020c8e17c78ac345def6ac95cb1ed8f344f",
+        "revCount": 110,
+        "type": "git",
+        "url": "https://git.dynamicdiscord.de/malobeo/gatekeeper"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://git.dynamicdiscord.de/malobeo/gatekeeper"
+      }
+    },
     "home-manager": {
       "inputs": {
         "nixpkgs": [
@@ -85,16 +108,16 @@
         ]
       },
       "locked": {
-        "lastModified": 1781319724,
+        "lastModified": 1763992789,
-        "narHash": "sha256-ZGuxexEMo4Xv28KJ0dX/m/PHN4oZIOnxHZpNTyrvx4M=",
+        "narHash": "sha256-WHkdBlw6oyxXIra/vQPYLtqY+3G8dUVZM8bEXk0t8x4=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "8355f0a16b2dbb06a97959a918af5b239bbe05ae",
+        "rev": "44831a7eaba4360fb81f2acc5ea6de5fde90aaa3",
         "type": "github"
       },
       "original": {
         "owner": "nix-community",
-        "ref": "release-26.05",
+        "ref": "release-25.05",
         "repo": "home-manager",
         "type": "github"
       }
@@ -126,11 +149,11 @@
         "spectrum": "spectrum"
       },
       "locked": {
-        "lastModified": 1781389237,
+        "lastModified": 1780588968,
-        "narHash": "sha256-Ne1/E5XNUq0gleaQz0vW5R4xf/0h/uEZ+bOW1aNjeQk=",
+        "narHash": "sha256-zQk+GqLO+T9taIl1UUt3swvaOksWJxL7PL8K0+Fc/Hs=",
         "owner": "astro",
         "repo": "microvm.nix",
-        "rev": "6ad601df0a07d9855c5e8f9b81135ecaf7c287eb",
+        "rev": "4d3fb17437944ea57eef2b9e6108ca777b1209ca",
         "type": "github"
       },
       "original": {
@@ -180,11 +203,11 @@
         "nixpkgs": "nixpkgs_2"
       },
       "locked": {
-        "lastModified": 1781622756,
+        "lastModified": 1781020964,
-        "narHash": "sha256-JrPh4M6S7aPsEE9tOENuZrxC6o2szSLlK+t4+nLke9s=",
+        "narHash": "sha256-fS7xTi2j2iso5Hj7RNZLv/acDlCT+fgMVkVk40A7Uco=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "08018c72174a4df5657f8d94178ac69fb9c243e5",
+        "rev": "32c2cd9e46286c4eced3dc6b613c659126bf3cca",
         "type": "github"
       },
       "original": {
@@ -212,11 +235,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1781577229,
+        "lastModified": 1780749050,
-        "narHash": "sha256-lrp67w8AulE9Ks53n27I45ADSzbOCn4H+CNW1Ck8B+8=",
+        "narHash": "sha256-3av0pIjlOWQ6rDbNOmpUSvbNnJkGORQKKjb4LtCZsIY=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "567a49d1913ce81ac6e9582e3553dd90a955875f",
+        "rev": "a799d3e3886da994fa307f817a6bc705ae538eeb",
         "type": "github"
       },
       "original": {
@@ -241,25 +264,76 @@
     },
     "nixpkgs_3": {
       "locked": {
-        "lastModified": 1781216227,
+        "lastModified": 1780952837,
-        "narHash": "sha256-9mUW6gNwoN2SWc/l0fW4svPNOulXLl8ijqKyeSOGgJE=",
+        "narHash": "sha256-Fwd1+spDtQ0hDyBwme6ufG3n4mY0UrjjFdYHv+G/Hds=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "a0374025a863d007d98e3297f6aa46cc3141c2f0",
+        "rev": "e820eb4a444b46a19b2e03e8dfd2359439ff30fe",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-26.05",
+        "ref": "nixos-25.11",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
+    "pyproject-build-systems": {
+      "inputs": {
+        "nixpkgs": [
+          "gatekeeper",
+          "nixpkgs"
+        ],
+        "pyproject-nix": [
+          "gatekeeper",
+          "pyproject-nix"
+        ],
+        "uv2nix": [
+          "gatekeeper",
+          "uv2nix"
+        ]
+      },
+      "locked": {
+        "lastModified": 1776659114,
+        "narHash": "sha256-qapCOQmR++yZSY43dzrp3wCrkOTLpod+ONtJWBk6iKU=",
+        "owner": "pyproject-nix",
+        "repo": "build-system-pkgs",
+        "rev": "ffaa2161dd5d63e0e94591f86b54fc239660fb2e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "pyproject-nix",
+        "repo": "build-system-pkgs",
+        "type": "github"
+      }
+    },
+    "pyproject-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "gatekeeper",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1778901413,
+        "narHash": "sha256-GSKXTAnFqRAMlZkJrIPcQMYf+lpMr66K3i60mB9STvc=",
+        "owner": "pyproject-nix",
+        "repo": "pyproject.nix",
+        "rev": "a228447c3e179d477c1b6246ef3efa8cfe3c469a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "pyproject-nix",
+        "repo": "pyproject.nix",
+        "type": "github"
+      }
+    },
     "root": {
       "inputs": {
         "disko": "disko",
         "dns": "dns",
         "ep3-bs": "ep3-bs",
+        "gatekeeper": "gatekeeper",
         "home-manager": "home-manager",
         "mfsync": "mfsync",
         "microvm": "microvm",
@@ -461,6 +535,31 @@
         "type": "github"
       }
     },
+    "uv2nix": {
+      "inputs": {
+        "nixpkgs": [
+          "gatekeeper",
+          "nixpkgs"
+        ],
+        "pyproject-nix": [
+          "gatekeeper",
+          "pyproject-nix"
+        ]
+      },
+      "locked": {
+        "lastModified": 1779269674,
+        "narHash": "sha256-P1LHCRdYpdtHAEzuEsNHrI6d9mVPl5a2fyFDZGHNVbI=",
+        "owner": "pyproject-nix",
+        "repo": "uv2nix",
+        "rev": "69aec536f6d1acc415ed2e20299312802aba98c6",
+        "type": "github"
+      },
+      "original": {
+        "owner": "pyproject-nix",
+        "repo": "uv2nix",
+        "type": "github"
+      }
+    },
     "zineshop": {
       "inputs": {
         "nixpkgs": [

flake.nix

@@ -3,7 +3,7 @@
 
   inputs = {
     nixos-hardware.url = "github:NixOS/nixos-hardware/master";
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
     nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixos-unstable";
     sops-nix.url = "github:Mic92/sops-nix";
     sops-nix.inputs.nixpkgs.follows = "nixpkgs";
@@ -37,13 +37,18 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
+    gatekeeper = {
+      url = "git+https://git.dynamicdiscord.de/malobeo/gatekeeper";
+      inputs.nixpkgs.follows = "nixpkgs-unstable";
+    };
+
     nixos-generators = {
       url = "github:nix-community/nixos-generators";
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
     home-manager=  {
-      url = "github:nix-community/home-manager/release-26.05";
+      url = "github:nix-community/home-manager/release-25.05";
       inputs = {
         nixpkgs.follows = "nixpkgs";
       };

machines/fanny/configuration.nix

@@ -165,7 +165,7 @@ in
     defaults.email = "malobeo@systemli.org";
     defaults = {
       dnsProvider = "njalla";
-      environmentFile = config.sops.secrets.njala_api_key.path;
+      credentialsFile = config.sops.secrets.njala_api_key.path;
       dnsPropagationCheck = false;
     };
   };

machines/goldman/configuration.nix

@@ -0,0 +1,72 @@
+{ config, pkgs, inputs, modulesPath, ... }:
+
+let
+  sshKeys = import ../ssh_keys.nix;
+in
+{
+  networking.hostName = "goldman"; # Define your hostname.
+  nixpkgs.hostPlatform = { system = "aarch64-linux"; };
+  imports =
+    [ 
+      inputs.gatekeeper.nixosModules.gatekeeper
+      ../modules/malobeo_user.nix
+      #inputs.nixos-hardware.nixosModules.raspberry-pi-3
+      (modulesPath + "/profiles/minimal.nix")
+      #(modulesPath + "/installer/sd-card/sd-image.nix")
+    ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-label/NIXOS_SD";
+      fsType = "ext4";
+    };
+
+  #Try to reduce size
+  documentation.man.enable = false;
+  documentation.nixos.enable = false;
+
+  services.openssh.enable = true;
+  services.openssh.ports = [ 22 ];
+  services.openssh.settings.PasswordAuthentication = false;
+  services.openssh.settings.PermitRootLogin = "prohibit-password";
+  users.users.root.openssh.authorizedKeys.keys = sshKeys.admins;
+
+  # Use the extlinux boot loader. (NixOS wants to enable GRUB by default)
+  boot.loader.grub.enable = false;
+
+  # Enables the generation of /boot/extlinux/extlinux.conf
+  boot.loader.generic-extlinux-compatible.enable = true;
+
+  networking.dhcpcd.enable = true;
+
+  # Set your time zone.
+  time.timeZone = "Europe/Berlin";
+
+  services = {
+    gatekeeper = {
+      enable = true;
+    };
+  };
+
+  environment.systemPackages = with pkgs; [
+    htop
+    wget
+    git
+    pciutils
+    nix-tree
+  ];
+
+  services.avahi = {
+    enable = true;
+    nssmdns4 = true;
+    publish = {
+      enable = true;
+      addresses = true;
+      userServices = true;
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
+
+  system.stateVersion = "23.05";
+}
+

machines/hosts.nix

@@ -58,6 +58,15 @@ in
           address = "192.168.1.105";
         };
       };
+
+      goldman = {
+        type = "rpi";
+        network = {
+          local = true;
+          hostId = "16";
+          address = "192.168.1.106";
+        };
+      };
   
       durruti = {
         type = "microvm";

machines/lucia/configuration.nix

@@ -64,29 +64,29 @@ in
   };
 
 
-  # mpd = {
+  mpd = {
-  #   enable = true;
+    enable = true;
-  #   musicDirectory = "/var/lib/mpd/music";
+    musicDirectory = "/var/lib/mpd/music";
-  #   settings = {
+    extraConfig = ''
-  #     audio_output = [{
+      audio_output {
-  #       type = "alsa";
+        type "alsa"
-  #       name = "My ALSA";
+        name "My ALSA"
-  #       device = "hw:0,0";	# optional 
+        device			"hw:0,0"	# optional 
-  #       format = "44100:16:2";	# optional
+        format			"44100:16:2"	# optional
-  #       mixer_type = "hardware";
+        mixer_type		"hardware"
-  #       mixer_device = "default";
+        mixer_device	"default"
-  #       mixer_control = "PCM";
+        mixer_control	"PCM"
-  #     }];
+      }
-  #   };
+    '';
   
-  #   # Optional:
+    # Optional:
-  #   network.listenAddress = "any"; # if you want to allow non-localhost connections
+    network.listenAddress = "any"; # if you want to allow non-localhost connections
-  #   startWhenNeeded = true; # systemd feature: only start MPD service upon connection to its socket
+    startWhenNeeded = true; # systemd feature: only start MPD service upon connection to its socket
-  # };
+  };
 
-  # ympd = {
+  ympd = {
-  #   enable = true;
+    enable = true;
-  # };
+  };
 
   #samba = {
   #  enable = true;
@@ -199,7 +199,7 @@ in
     defaults.email = "malobeo@systemli.org";
     defaults = {
       dnsProvider = "njalla";
-      environmentFile = config.sops.secrets.njala_api_key.path;
+      credentialsFile = config.sops.secrets.njala_api_key.path;
       dnsPropagationCheck = false;
     };
   };

machines/modules/malobeo/metrics.nix

@@ -41,22 +41,17 @@ in
       };
     };
 
-    services.alloy = {
+    services.promtail = {
       enable = cfg.enablePromtail;
-      extraFlags = ["--config.format=promtail"]; #TODO please change this to native alloy config later
+      configFile = import ./promtail_config.nix { 
-      configPath = import ./promtail_config.nix { 
         lokiAddress = cfg.lokiHost;
         logNginx = cfg.logNginx;
         config = config;
         pkgs = pkgs;
       };
     };
-    users.groups.promtail = {};
+
-    users.users.promtail = {
+    users.users.promtail.extraGroups = [ "systemd-journal" ] ++ (lib.optionals cfg.logNginx [ "nginx" ]) ;
-      isNormalUser = true;
-      group = "promtail";
-      extraGroups = [ "systemd-journal" ] ++ (lib.optionals cfg.logNginx [ "nginx" ]) ;
-    };
 
   };
 }

machines/nextcloud/configuration.nix

@@ -39,7 +39,7 @@ in
 
   services.nextcloud = {
     enable = true;
-    package = pkgs.nextcloud33;
+    package = pkgs.nextcloud32;
     hostName = "cloud.malobeo.org";
     config.adminpassFile = config.sops.secrets.nextcloudAdminPass.path;
     maxUploadSize = "10G";
@@ -55,8 +55,8 @@ in
     extraApps = {
       inherit (config.services.nextcloud.package.packages.apps) contacts calendar polls registration collectives forms;
       deck = pkgs.fetchNextcloudApp {
-        sha256 = "sha256-Oc/J0Ey7f9aHhLBWoAXaDMe2t0eeEQKvpwY510qNpiI=";
+        sha256 = "sha256-epjwIANb6vTNx9KqaG6jZc14YPoFMBTCj+/c9JHcWkA=";
-        url = "https://s3.g.megas4.com/ya5mczgkbk6bw7tcy2yr4bl2vdryfe76ok2dj/malo/deck33.tar.gz";
+        url = "https://link.storjshare.io/raw/jvrl62dakd6htpyxohjkiiqiw5ma/mal/deck32.tar.gz";
         license = "agpl3Plus";
       };
     };

machines/overwatch/configuration.nix

@@ -37,7 +37,6 @@ in
   services.grafana = {
     enable = true;
     settings = {
-      security.secret_key = "SW2YcwTIb9zpOOhoPsMm";
       server = {
         domain = "grafana.malobeo.org";
         http_port = 2342;

machines/ssh_keys.nix

@@ -4,6 +4,7 @@
    "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCxgcjNOYbza3+RfANFDXy7HXNRFlkpDOAcGyB7MKshiVlbPByWRSjfZa0BeRNjpeCd8QkIodKUzqYOCOrc8ad3kiNbdLRcDz57A5xSLD3ynakoWJo0AmJjT3Ta1JJj8inNwwykR0ig5//SrtsZb9HkWJDAF017MokM2r8AWPE1QzcQdh93kojXcgTHrJHzEqgKbEGDEk37f1RvZG4umEFeqdK2FvS5isPa7P9X7hyyoDC8bvEy7xfaDrToJAoXon6r79taxH8UWIvy//xsU0NBLYK2eE4RQe2AjF6Ri+CybI6y1SsHOvyh4nNKWlfUOEL6UnIulRn/LXFOKCJi7xuoTeJXS0+w1DNEuiGosVNXPSKbUm/eDBVnb8Iyep9wmygSZayN82xL5lRlG3Mn45ttecqfm2SJkmduBA5qXcTdDPe/lXTZaVO9tbiIcJfUgd3ttEu2+6YjLn74D965PlovzvR6EhbVUZ8IkOAt4VmuTkXIdm8SCS7jzhsiKeUXoZ4rfa375zi79SIPuIkoMasj6d16wcYOeFIUIMFFccfQ9jQjr9NTSXC2dd7sfbI9I9mF7eRQSsUdSwpP8WH1b+M1MxTbdhEUdPwpOLviTTIuk8E8K8DQDZIcOOh38mCDpyoh02nwfRxlyoYVsKAHIQH02dHTvYEa3/pMsRwGc9W1Ow== kalipso@desktop"
    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINQg6a2EGmq+i9lfwU+SRMQ8MGN3is3VS6janzl9qOHo quaseb67@hzdr.de"
    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICKaEcGaSKU0xC5qCwzj2oCLLG4PYjWHZ7/CXHw4urVk atlan@nixos"
+   "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDi8yxrMZoXEy7e8/MZeyihOARU2tN0TpJTUX55UO31B atlan@argon"
  ];
  backup = [
   "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDIGryhnXdmbGObONG88K+c9zeduMrwtoLHwzMDZg3UXB+Cnq2FXWOrlLZxA+95VUgHpyGZiykJmzeWrKhldDlDeGGd8QCCLeuliiOgXADTYjWaVfhd+6arPZrK2VtqqsguvH40gW1xfoGAOmAT4WFnxWxIaEip0V2u6NOoKTiH9I3bz2Qe4lfJvPXig+XwCXcukXd6XUkDFYDpiw8XNV3X7pqTus5d2RYR97bAhIYZZQ6h50ZpTY8N0lFh4RY5yfx8BhxJW3tfoi9uZvVuPx7dGPsZsSniENFPMNz3UwHGitTJMr4088cJrAGgd5lyFuLouiHiM2JMGA0wx9wWTbWJEwTLaTVQK9gSJf857ndV2zCh9vKlfko4w9bQgqxKg4U/mY8dXX1E7D51nD2ci8Ed+ZG+NEneFLyZhLsD82GkBY+YovA+4xm/pcx+hBhlyqGNxI8v+Jh+JhEyD/ZLgJfq3ZMbGIGsTiDwZ2flLLxImHHEoDoT6PHU6hDhPDJu560="