[fanny] add disable autoupdate option at startup

Reviewed-on: kalipso/infrastructure#128

.gitea/workflows/autoupdate.yml

@@ -18,8 +18,27 @@ jobs:
               run: |
                   apt-get update
                   apt-get install -y sudo
+            - name: Install Tea
+              env:
+                TEA_DL_URL: "https://dl.gitea.com/tea/0.9.2/tea-0.9.2-linux-amd64"
+              shell: bash
+              run: |
+                TEA_DIR=$(mktemp -d -t tmp.XXXX)
+                pushd $TEA_DIR
+                wget "$TEA_DL_URL"
+                wget "${TEA_DL_URL}.sha256"
+                if $(sha256sum --quiet -c "tea-0.9.2-linux-amd64.sha256"); then
+                mv "tea-0.9.2-linux-amd64" /usr/bin/tea
+                chmod +x /usr/bin/tea
+                popd
+                rm -rf $TEA_DIR
+                else
+                popd
+                rm -rf $TEA_DIR
+                echo "::error title=⛔ error hint::Tea v0.9.2 Checksum Failed"
+                exit 1
+                fi
             - uses: https://code.forgejo.org/actions/checkout@v6
-
             - name: Set up Nix
               uses: https://github.com/cachix/install-nix-action@v31
               with: 
@@ -27,16 +46,65 @@ jobs:
 
             - name: Run nix flake update
               run: nix flake update
-            - name: Run nix flake check
-              run: nix flake check --all-systems --verbose
 
-            - name: Create Gitea PR
+            - name: Commit flake.lock
-              uses: https://github.com/infinilabs/gitea-pr@v0
+              run: |
-              with:
+                  git config user.name "malobot"
-                url: https://git.dynamicdiscord.de
+                  git config user.email "malobot@systemli.org"
-                token: ${{ secrets.AHTLONS_GITEA_TOKEN }}
+                  git stash push
-                commit-message: 'Update flake.lock'
+                  git branch nixpkgs_bump_$(date +%Y%m%d)
-                committer: 'malobot <malobot@systemli.org>'
+                  git checkout nixpkgs_bump_$(date +%Y%m%d)
-                base: 'master'
+                  git stash pop
-                title: 'Update flake.lock'
+                  git add flake.lock
-                assignee: 'ahtlon'
+                  git diff --staged --quiet || git commit -m "Update flake.lock"
+
+            - name: Check for eval warnings
+              id: commit
+              shell: bash
+              run: |
+                {
+                echo "COMMIT_DESC<<EOF"
+                echo "Date: $(date)"
+                echo "Evaluation warnings:"
+                nix flake check --all-systems --no-build 2>&1 | grep evaluation | awk '!seen[$0]++' || echo "None :)"
+                echo EOF
+                } >> "$GITHUB_OUTPUT"
+            
+            
+            - name: Login to Gitea
+              shell: bash
+              env:
+                GIT_SERVER_URL: https://git.dynamicdiscord.de
+                GIT_SERVER_TOKEN: ${{ secrets.AHTLONS_GITEA_TOKEN }}
+              run: >-
+                tea login add
+                -u "$GIT_SERVER_URL"
+                -t "$GIT_SERVER_TOKEN"
+            - name: Check for existing pull request
+              id: no-pr
+              continue-on-error: true
+              shell: bash
+              run: >-
+                tea pr -f head -o simple |
+                grep -q ${{ github.ref_name }} &&
+                exit 1 ||
+                exit 0
+            - name: Force push branch
+              run: git push --force -u origin nixpkgs_bump_$(date +%Y%m%d)
+            - name: Create pull request
+              if: steps.no-pr.outcome == 'success'
+              env:
+                COMMIT_MSG: Automatic Nixpkgs update
+                COMMIT_DESC: ${{ steps.commit.outputs.COMMIT_DESC }}
+              shell: bash
+              run: >-
+                tea pr create
+                -L "bump"
+                -t "$COMMIT_MSG"
+                -d "$COMMIT_DESC"
+            - name: Skip pull request
+              if: steps.no-pr.outcome == 'failure'
+              shell: bash
+              run: >
+                echo "::error title=⛔ error hint::
+                A PR already exists for this branch: ${{ github.ref_name }}"

machines/fanny/configuration.nix

@@ -1,4 +1,4 @@
-{ inputs, config, ... }:
+{ inputs, config, lib, ... }:
 let
   sshKeys = import ../ssh_keys.nix;
   peers = import ../modules/malobeo/peers.nix;
@@ -47,6 +47,10 @@ in
     jobset = "infrastructure";
     cacheurl = "https://cache.dynamicdiscord.de";
   };
+  specialisation."NOAUTOUPDATE".configuration = {
+    system.nixos.tags = [ "NOAUTOUPDATE" ];
+    malobeo.autoUpdate.enable = lib.mkForce false;
+  };
 
   malobeo.backup = {
     enable = true;
@@ -135,8 +139,9 @@ in
     enableHostBridge = true;
     interface = "enp1s0";
     gateway = "192.168.1.1";
-    address = "192.168.1.2/24";
+    address = "192.168.1.103/24";
   };
+
   services.malobeo.microvm.deployHosts = [ 
     "overwatch" 
     "infradocs" 
@@ -154,7 +159,7 @@ in
     };
 
     firewall = {
-      allowedTCPPorts = [ 80 ];
+      allowedTCPPorts = [ 80 443 ];
     };
   };
 
@@ -212,7 +217,7 @@ in
 
     virtualHosts."keys.malobeo.org" = {
       locations."/" = {
-        proxyPass = "http://10.0.0.16";
+        proxyPass = "http://${hosts.malobeo.hosts.vaultwarden.network.address}";
         extraConfig = ''
           proxy_set_header Host $host;
         '';

machines/fanny/dummy.yaml

@@ -1,5 +1,7 @@
 wg_private: ENC[AES256_GCM,data:YEmIfgtyHE9msYijva0Ye2w7shVmYBPZ3mcKRF7Cy20xa6yHEUQ0kC2OWnM=,iv:ouK6fHcrxrEtsmiPmtCz9Ca8Ec1algOifrgZSBNHi74=,tag:524e/SQt++hwVyeWruCsLg==,type:str]
 njala_api_key: ENC[AES256_GCM,data:uEzx7KeI7ZZP63Igu5vHmuvASVxJai8bezM40UZVobQMr7r6opjnVTc0BPyIGfnG2mx/6Bo=,iv:lch04oGn6bkqtBGVzYlz6B97FGXlGOoxkiT1IplSxm4=,tag:bzXx2jSqFBv1hgJO1r5i+w==,type:str]
+njalacloud: ENC[AES256_GCM,data:Xg85D9LMMYd8po8vrpxHZA==,iv:L5Gsm3bX61WW1PAdWswFNrScFoBipS2qDGU7iTubt1U=,tag:M2PCfE1h4IkW/iFq8XeIrA==,type:str]
+njalazines: ENC[AES256_GCM,data:ooDRj4HqKVFrgRyzgFGQjg==,iv:9X8r1eY+6FqXv19mO0uMRd5A2tpvtmT11P77t9BQaCk=,tag:4BE55c8x66/UxyTCpCmdUg==,type:str]
 sops:
     age:
         - recipient: age18jn5mrfs4gqrnv0e2sxsgh3kq4sgxx39hwr8z7mz9kt7wlgaasjqlr88ng
@@ -20,8 +22,8 @@ sops:
             NjJ5cFdTVS9NZmVWMjcrcHo2WDZEZDgKiDwkuUn90cDmidwYGZBb5qp+4R1HafV0
             vMQfjT9GrwB5K/O1GumOmvbzLNhvO2vRZJhfVHzyHLzQK64abQgF5Q==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-02-20T18:33:50Z"
+    lastmodified: "2026-02-20T19:26:21Z"
-    mac: ENC[AES256_GCM,data:YlsQVjfgtlcSObjLiZif/sOJNx2PqH9q0kguPgBSwAoNiX2/eJhNH2WwtQ8uXQfdPiX7kwfFrl2E0xevqwLv+4AICr+9v6oCfcUHJYPRdkLfCs0jXyvnZr52LzfyV3GOPah/j8Uye9d9sspUMqqaXewoeWtrXHgo277pQVdrKxM=,iv:Xb5ckc/cvpGqkZoViTrw8rUniO2OWy0/rNfhF+Qb/iM=,tag:ZhI4jS2Iyig9juVGAeii+w==,type:str]
+    mac: ENC[AES256_GCM,data:D8ZOgcDCY+I2rFc6+GSRj53QjnhZP0oz5wPgG2x4dOfVRWYMEgR2pnb/IIF95Dq0XR6ja9PLgw42PfdI1dS7vITb1jW5IExcnkB/Pa/RjB3GFeXPFTV6QCAQcK9cLct6yhB/pPbHdt8qHQt7kddiN162RlMHDyR6BAh4gO0Rf3w=,iv:f1RWrxbqNNUdANDR6V+OFuEYJ2ZLVde+5GTcFmSXYSQ=,tag:IBEdkSEz/w4Rxwb6uSBpTw==,type:str]
     pgp:
         - created_at: "2025-01-19T22:45:26Z"
           enc: |-

machines/fanny/dyndns.nix

@@ -4,8 +4,8 @@
   sops.secrets.njalazines = {};
   systemd.services."dyndns" = {
     script = ''
-      KEYCLOUD=$(cat /run/secrets/njallacloud)
+      KEYCLOUD=$(cat /run/secrets/njalacloud)
-      KEYZINES=$(cat /run/secrets/njallazines)
+      KEYZINES=$(cat /run/secrets/njalazines)
       ${pkgs.curl}/bin/curl --fail --silent --show-error "https://njal.la/update/?h=cloud.malobeo.org&k="$KEYCLOUD"&auto"
       ${pkgs.curl}/bin/curl --fail --silent --show-error "https://njal.la/update/?h=zines.malobeo.org&k="$KEYZINES"&auto"
     '';

machines/fanny/secrets.yaml

@@ -1,8 +1,8 @@
 wg_private: ENC[AES256_GCM,data:kFuLzZz9lmtUccQUIYiXvJRf7WBg5iCq1xxCiI76J3TaIBELqgbEmUtPR4g=,iv:0S0uzX4OVxQCKDOl1zB6nDo8152oE7ymBWdVkPkKlro=,tag:gg1n1BsnjNPikMBNB60F5Q==,type:str]
 shop_cleartext: ENC[AES256_GCM,data:sifpX/R6JCcNKgwN2M4Dbflgnfs5CqB8ez5fULPohuFS6k36BLemWzEk,iv:1lRYausj7V/53sfSO9UnJ2OC/Si94JXgIo81Ld74BE8=,tag:5osQU/67bvFeUGA90BSiIA==,type:str]
 shop_auth: ENC[AES256_GCM,data:0NDIRjmGwlSFls12sCb5OlgyGTCHpPQIjycEJGhYlZsWKhEYXV2u3g1RHMkF8Ny913jarjf0BgwSq5pBD9rgPL9t8X8=,iv:3jgCv/Gg93Mhdm4eYzwF9QrK14QL2bcC4wwSajCA88o=,tag:h8dhMK46hABv9gYW4johkA==,type:str]
-njallacloud: ENC[AES256_GCM,data:HBFew0tXEYG34G0N5hab9Q==,iv:q4PgqLJkST5exS3fYOQoAN9AubcfYafdjhhRQAIe0Yc=,tag:SZeM1ZcszSJeNo7uZfS0bQ==,type:str]
+njalacloud: ENC[AES256_GCM,data:sp79Ij1vd9pQZuPUR1phmw==,iv:AWKZoOfBA/n16pWQCfA0dZmH1KajCztnLvYItoZZbgA=,tag:BIUrobBoO96pxUz1sjIYIw==,type:str]
-njallazines: ENC[AES256_GCM,data:dySUyb1/IBGfjvyGx4iF1Q==,iv:dq60RACMotAzZoiv3+DTx4X6+HK8Wg4CMVzDi3qr6fA=,tag:niHK/B8xYIcEfjHuPkKaQw==,type:str]
+njalazines: ENC[AES256_GCM,data:fnObUEnXYvdj9HtkZNzXVA==,iv:0Zj2n2we9w4fj/n7e1ayd9XgFEMAGCHk4QLTu1IlRnQ=,tag:zeOLAB0oE6XbxqdqhdRNxw==,type:str]
 njala_api_key: ENC[AES256_GCM,data:ohSVzQUvFjia/s9WceqnZCdLyk3N1Lm2BCBmXeBlkWD2dyrohKCnd9GiJ499IORpuYcOXyM=,iv:Uczk8op5mgqe8gefxgU9YuTqOsYvjzHCKvzA7GDsgio=,tag:XA7JRq/LsGkpHcQSO36Whg==,type:str]
 sops:
     age:
@@ -24,8 +24,8 @@ sops:
             QVZyNWVOMTh3ejBha21Qb2xCRkFERGMKH9nMQUoS5bGcLUx2T1dOmKd9jshttTrP
             SKFx7MXcjFRLKS2Ij12V8ftjL3Uod6be5zoMibkxK19KmXY/514Jww==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-02-20T19:08:38Z"
+    lastmodified: "2026-02-20T19:25:05Z"
-    mac: ENC[AES256_GCM,data:PnCsmzbOji2iD3cwOl3vkXNMZJjxXqfxLuzlQgczwbHzDRXS9Xma2HuoQ9rnraA4CGc0LCgD/E2X0/LlL2lYks2Rh5Axd1kuBIn3pg2ihvzEAb+zBfnLzFGJW7xq4XJHB+OOnr4301cGFD8aPxlI6wrPeY6qu06rx7hGjsKrNTE=,iv:lhsVRbUUvUYrvC5EutX5Hn9O4tzfmED9TvRpt75qY9s=,tag:fs90cns6OeCaKUE6L0sG/A==,type:str]
+    mac: ENC[AES256_GCM,data:g+bFYqJN1X8F52tpIO60S2WKxLG27ZrP399fsfE6o7rPtIMimZou/4oUo7i+kpNtygEuCr3+suP8TPas4x5zMXhRjnjJuwJwL/NwdciHZU0O3rPJgucCEWqr9OdAtxezDM9c2vv+jzqZxWT9t0fIpB9RxO5oy1pHZs0RCgjAJR4=,iv:v6RdTMeQUxSdjIVNFbx2HtxCsdVgFTQTzMXS5Fj62is=,tag:pLoZMBRIXYElO5rY+xX9zg==,type:str]
     pgp:
         - created_at: "2025-02-11T18:32:49Z"
           enc: |-

machines/hosts.nix

@@ -6,7 +6,7 @@ let
     hostId = hostId;
     address = "192.168.1.${hostId}";
     gateway = "192.168.1.1";
-    nameservers = [ "192.168.1.17" "1.1.1.1" ]; #setting ns1 as nameserver
+    nameservers = [ "192.168.1.1" "1.1.1.1" ]; #setting ns1 as nameserver
     mac = mac;
   };
 
@@ -37,7 +37,7 @@ in
         network = {
           local = true;
           hostId = "12";
-          address = "192.168.1.12";
+          address = "192.168.1.102";
         };
       };
   
@@ -46,7 +46,7 @@ in
         network = {
           local = true;
           hostId = "13";
-          address = "192.168.1.13";
+          address = "192.168.1.103";
         };
       };
   
@@ -55,7 +55,7 @@ in
         network = {
           local = true;
           hostId = "15";
-          address = "192.168.1.15";
+          address = "192.168.1.105";
         };
       };
   

machines/modules/malobeo/microvm_host.nix

@@ -101,7 +101,7 @@ in
           # under nixosConfigurations
           flake = inputs.malobeo; 
           # Specify from where to let `microvm -u` update later on
-          updateFlake = "git+https://git.dynamicdiscord.de/kalipso/infrastructure";
+          updateFlake = "git+https://git.dynamicdiscord.de/malobeo/infrastructure";
         }; };
     in
     builtins.listToAttrs (map mapperFunc cfg.deployHosts);

machines/nextcloud/configuration.nix

@@ -61,7 +61,7 @@ in
       };
     };
     settings = {
-      trusted_domains = [ "cloud.malobeo.org" ];
+      trusted_domains = [ "cloud.malobeo.org" "cloud.hq.malobeo.org" ];
       trusted_proxies = [ hosts.malobeo.hosts.fanny.network.address ];
       "maintenance_window_start" = "1";
       "default_phone_region" = "DE";