[fanny] deploy wordpress

also remove my previous comit

.gitea/workflows/hydra-callback.yml

@@ -7,13 +7,13 @@ on:
             - synchronize
         paths:
           - '**.nix'
-          - flake.lock
+          - 'flake.lock'
     push:
         branches:
-          - master
+          - 'master'
         paths:
           - '**.nix'
-          - flake.lock
+          - 'flake.lock'
 
 permissions:
     contents: write

flake.lock

@@ -469,11 +469,11 @@
         "utils": "utils_4"
       },
       "locked": {
-        "lastModified": 1768820076,
-        "narHash": "sha256-0vnIYuWvsYasbHZHUjAcK9FR0kxkRRtzYG661VEtoPU=",
+        "lastModified": 1789131197,
+        "narHash": "sha256-gpjhy2mIBt89oCVzoSXy8AgfAKjJ9Fi3u01CX09UTF4=",
         "ref": "refs/heads/master",
-        "rev": "cfdfae84bb045ae429f0760eba708468871b1738",
-        "revCount": 159,
+        "rev": "38bcceb0e8b84d6dcd50d05683c71eea8d410479",
+        "revCount": 161,
         "type": "git",
         "url": "https://git.dynamicdiscord.de/kalipso/zineshop"
       },

machines/.sops.yaml

@@ -17,6 +17,7 @@ keys:
   - &machine_vaultwarden age1zs9puemeevc5kt84w9d2mc5396w0t9p60qxymkpatwvwxunzs5usmxr3an
   - &machine_pretalx age1y04q8n7mgk82c87rfddm0u72h0ny6sfzktjsk0cc3gu93kezudfqdp9v9g
   - &machine_albert age1mfarz0n7qfa7vg8zz355qf8eregm6myl38lld0h767nuvhgjqd4qruxuhn
+  - &machine_ns1 age1mam7y7x4my6g8yt8leze3pvlq0fr48hdsqz62gs7l9rstf9hh3fs03xf7n
   #this dummy key is used for testing.
   - &machine_dummy age18jn5mrfs4gqrnv0e2sxsgh3kq4sgxx39hwr8z7mz9kt7wlgaasjqlr88ng
 creation_rules:
@@ -123,6 +124,14 @@ creation_rules:
       age:
       - *admin_atlan
       - *machine_albert
+  - path_regex: ns1/secrets.yaml$
+    key_groups:
+    - pgp:
+      - *admin_kalipso
+      - *admin_kalipso_dsktp
+      age:
+      - *machine_ns1
+      - *admin_atlan
   - path_regex: .*/secrets/.*
     key_groups:
     - pgp:

machines/albert/configuration.nix

@@ -6,6 +6,10 @@ let
 in
 {
   networking.hostName = "albert";
+  networking.nameservers = [
+    "192.168.1.1"
+    "1.1.1.1"
+  ];
 
   sops.defaultSopsFile = ./secrets.yaml;
   sops.secrets.wg_private = {};
@@ -23,6 +27,7 @@ in
       inputs.self.nixosModules.malobeo.users
       inputs.self.nixosModules.malobeo.backup
       ./hydra.nix
+      ./gitea_runner.nix
     ];
 
   virtualisation.vmVariantWithDisko = {
@@ -45,7 +50,7 @@ in
     enable = true;
     url = "https://hydra.malobeo.org";
     project = "malobeo";
-    jobset = "infrastructure";
+    jobset = "master";
     cacheurl = "https://cache.malobeo.org";
   };
 
@@ -77,14 +82,13 @@ in
 
   networking = {
     firewall = {
-      allowedTCPPorts = [ 80 443 3000 ];
+      allowedTCPPorts = [ 80 443 3000 5000];
     };
   };
 
   nixpkgs.config.allowUnfree = true; 
-
+  boot.binfmt.emulatedSystems = [ "aarch64-linux" "i686-linux" ];
   services.acpid.enable = true;
-  networking.networkmanager.enable = true;
   time.timeZone = "Europe/Berlin";
   system.stateVersion = "26.05"; # Do.. Not.. Change..
 }

machines/albert/dummy.yaml

@@ -0,0 +1,67 @@
+wg_private: ENC[AES256_GCM,data:yHkjJjW/I/5mFJuMQR0XpoMqPDt9b/ZZRmLiqJjug31p5aV6AC7Pk7bhNN8=,iv:OjRVJCCO0WTUSd6w5oeZbEeilcffJQOOrudIkss9VaE=,tag:t5N0tNjrfM8/pKbJMMDEig==,type:str]
+gitea_token: ENC[AES256_GCM,data:+zHmfVfdheo4KzOBjDr8WNcJh78ReZ7CWiiG9fAcXpQw21yWb4/jq3RqqIenB2p1EEtF0OlSUr3lu478gEBmxlilBCpEaEzNJKfOFL77P66OYLo7RJkp3TE0sILDCaVwGDkCWQKd05zqJzbb5opHE5B0NUf9dOgs8CuYZPelrTzGsTfWjdZWxweSrOcFtsGLJcR0hLd9obAuqOxi2vID2YY/uIguGEhZYHshTlZSzMTg+8k2UCe/x+LOitCkLqFJfS5b+1HJpD6R1dKsVKtSjXtzLHzfIMy28xYvqgIju0JtUA==,iv:Kah6BYvKCe06/yHBICp2YOdJfSqktNrZl5kKYgs/AY0=,tag:3B+g6zqW7vcT1t/wfmYfUg==,type:str]
+cache_priv: ENC[AES256_GCM,data:CpxYGSSdSZoULqH/AJdaYWiuAgI8Spuf/lod8x5bFEnFB2KlRFp7vBjwwRzxykurbezP2/c938NL2WxI+sDw7UV6LAG+E5KmYxXQpOJZgIPx3YcEidyp5HWq628lf1k=,iv:t7BFA4IM6eFl+Uuq7k7OR26+wHVKbvWi+yV0xg2xFGs=,tag:9hpxyjEUnbOz1NFc2JctEA==,type:str]
+gitea_runner_token: ENC[AES256_GCM,data:wUHExAD2tf1bKc3W3GXHcPg6WS8OqQK7efcR4SBMSQnSIo/E32lo9w==,iv:P9JouWGa8c4NNTua2OhqJzjjj37mLmkYmJ+c4mogH20=,tag:dLR06+PBBl1SodaLH7ElqQ==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMRnE5OFQwdlV1bTJwdmZ0
+            Q2pLVGcyOXlILy9selVYeERGcFFyenRrcVRVClNaMWRPNllHS0ZEYlkvaUp2di9N
+            cDNuY2syKzZ5WTlKTndXQnMyQkp2RGsKLS0tIEVGYVcxUTU1NVhFZnBsR1Z3RDNH
+            RTJscHI0SmtUTzA3R3JkYTBZRUxlL3MKzEajq1IEBOjiF431vtkqnT3VWC2D+vGW
+            C5dTc/stQ0PXvfuTlRTKKTBlaSdnwBu/pKQ5/QtqwKee2Z3nxySziQ==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age18jn5mrfs4gqrnv0e2sxsgh3kq4sgxx39hwr8z7mz9kt7wlgaasjqlr88ng
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGaVNOSHZvSmJ0ZFhSVVhs
+            Z3ZvTU9jRytLaUJwd3VCZ0NJb3NGRzE1MVFvCnRYaTI2MHJRZnhhZjBmZkdqMTQ3
+            Rkh2WDVoUHZCY0Z2YlFlakVKTzUxUm8KLS0tIENjVXlxcWRjRXVjVFBNMVJSeTNs
+            YXU5TEpNeE9oMTZpbW10ekU3Z09EbEEKYr5TMIs9KmrHZqhhc6GZx6tM78XOXYAq
+            PffqNVDxsFbxAUK7dd5WPw++dE4W1gwRxI+sSPQ2H8ZvjqB8ff3TYw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
+    lastmodified: "2026-09-11T11:23:55Z"
+    mac: ENC[AES256_GCM,data:swEaZC/CLOdrjDSEYsaWBnl7cew01eUraa4ORkJljlqKusr0BdYFozjR3Rxc66JWRChc4bP0ckeDhU6AOiXk4k4zL8CJ3S4eY3111z36xjZXY9LXxMVn0oTx+3SrD6pOttTxZUkcdogRsi/jOsMPoTgSQN5OwvV8RTLF5waxU4I=,iv:ISZk4qsmmy4RYy1cxjpE/vbcCp6UoArtOqzd1ePYL0c=,tag:N68qZyHsiOFkfNM7e+t2zQ==,type:str]
+    pgp:
+        - created_at: "2026-09-11T11:23:21Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQGMA5HdvEwzh/H7AQv8D1hDUkuvip430Qe/djdEP6N26XQkqcZVfuzdhgQOwdTC
+            N1ou9MPJ0D0gIk72uYExHGDTwhvOEBTMuDk+te9foffcj6MHzUUpqI+TKsjV/PeY
+            Xpj9YGNjmGI7hz0ERyALMDpfFbkLPIDP3LwbxM+UFpe0weGoxfROVFWlFnXi6Rrg
+            MoFgDOUD9Ku7v9dkMkMcmoZULAozf5fcVMFe1mpByEh9LuATQRkuAO7Uf6nH46Qa
+            n7rMm04CNdBtmVSEPsU3CZ4C9+kyOzH1xwynb6MVDnY3j6sUGr3Seu7nCfMPDjmU
+            l2wcv4THJbUU+0gM9+Y3zSZlRYa0xe05D8CfpASnZ4FamFZOwuAJAgiKc8y3DEp6
+            kQMK76ncZQLhOIS//1tXkD3iIeLgr6D7VCjP23IaOV/7cakmqL7mbCdA6es9tXBm
+            7Hy0p7xkSVpJrxiV3NbiN84MILxpJey/usq9VEBUf3oRtVBHt3uxVnL33Txc7PRg
+            JimkwsrGi9JV1YiF3Y1Q0lgBxOYufbPdYJ9n5Ki/unD1AJI/WBm/ii2Kt5RY0L2X
+            JY3AguNG29wBBWJg4hyCq7fisI88TBJh6syUb91UHHMloOVe1Pk3Bb7oMWMgLl0g
+            YLU07kt67eaX
+            =xifQ
+            -----END PGP MESSAGE-----
+          fp: c4639370c41133a738f643a591ddbc4c3387f1fb
+        - created_at: "2026-09-11T11:23:21Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA98TrrsQEbXUARAApu96xR6Fy6Y0dAHzM9CjnFuSFLlUbU0yRWksHCFoo6XS
+            acRWL0pVlwCWt3sR+tjpd1tEvQZFspqq+UhDLlaz+qS2dpI0IkjNEbD/0uTTcqkn
+            0wlKcvDdRGv5Mb2wjFp5Q0VBIDC2nRbK579IghaEIoRRN9j2VfksracmfrvEpuuL
+            5rF4Uvpzc5VLQyf9hy53j9MXuiTfWv4xEPC3zfcbxeOKaXPKEVkc0e8QyNPes3Q2
+            AefQBd+QRBSCDc9P6V5Xb2r+K52k6zWxpoeR1oyJbAv5c4NKWtKtdackIyPoLF4N
+            9TtcidG2OTtuIqIAmSix23KVBgJB0nESSuUhy4f0YUUnGNWpu4TDGzB9BNmiob9K
+            0fO/awGV87kYKPcjdj/XLgVB+zZ/5T7b3dL6tl4lpwMf69qzq0Io/CffnYpTItGJ
+            A/3G0rokjmicGSme5nNkZKXXwxNidaxvSOLXd+yAmInMcXacvO2WuA1CmCnU4Px/
+            igA19i1GDc9OS1qGhIdrG14iUf1820DACdsPlg3jFEys7dpkGDIOiMAqo66OhX9Q
+            gYN4Dz2PaPSrTJl0rkBds1qiGI4TN6AKQlLlwkowx465lX8UsjvaYT4z7d2JWYN2
+            VHMaeEBZvO688oFYA/wn/b+OHUkRIkL1oIeU2G5Pw9m5wQbgd8DMgvYZKe3rzrbS
+            WAGKWwzwHc4BjBzL1PxcwMchMfiZJ0Ltel5dcXHkHi7VV+O7dIQiseZwfHBbGyIa
+            uXogIDlqULSiRxw9oht3hVDS90uW2riMEoDcr47hh1oFaGBHoY7/kf8=
+            =+ckT
+            -----END PGP MESSAGE-----
+          fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4
+    unencrypted_suffix: _unencrypted
+    version: 3.13.1

machines/albert/gitea_runner.nix

@@ -0,0 +1,31 @@
+{ config, lib, pkgs, ... }:
+
+let
+  mkRunner = runnerName: {
+    enable = true;
+    name = runnerName;
+    url = "https://git.dynamicdiscord.de/";
+    tokenFile = config.sops.secrets.gitea_runner_token.path;
+    labels = [
+      "ubuntu-latest:docker://node:latest"
+    ];
+
+    settings = {
+      runner = {
+        devices = [ "/dev/kvm" ];
+      };
+    };
+  };
+in
+{
+  sops.secrets.gitea_runner_token = {};
+
+  virtualisation.docker.enable = true;
+  users.users.admin.extraGroups = [ "docker" ];
+
+  services.gitea-actions-runner.instances = {
+    albert01 = mkRunner "albert01";
+    albert02 = mkRunner "albert02";
+  };
+}
+

machines/albert/hydra.nix

@@ -24,7 +24,7 @@
 
   services.hydra = {
     enable = true;
-    hydraURL = "localhost:3000";
+    hydraURL = "https://hydra.malobeo.org";
     useSubstitutes = true;
     notificationSender = "hydra@localhost";
 
@@ -33,9 +33,19 @@
       binary_cache_secret_key_file = /etc/nix/albert/secret
       binary_cache_dir = /var/lib/hydra/cache
       Include ${config.sops.secrets.gitea_token.path}
+      using_frontend_proxy 1
+      base_uri hydra.malobeo.org
+      <hydra_notify>
+        <prometheus>
+          listen_address = 0.0.0.0
+          port = 9199
+        </prometheus>
+      </hydra_notify>
+      queue_runner_metrics_address = 0.0.0.0:9198
     '';
   };
-
+  networking.firewall.allowedTCPPorts = [ 9199 9198 ];
+  
   systemd.services.hydra-manual-setup = {
     description = "Create Admin User for Hydra";
     serviceConfig.Type = "oneshot";
@@ -95,11 +105,5 @@
     "git+ssh://git.dynamicdiscord.de/"
     "https://git.dynamicdiscord.de"
   ];
-
-  services.nginx.virtualHosts."hydra.malobeo.org" = {
-    forceSSL = true;
-    enableACME = true;
-    locations."/".proxyPass = "http://localhost:3000";
-  };
 }
 

machines/albert/secrets.yaml

@@ -1,6 +1,7 @@
 wg_private: ENC[AES256_GCM,data:rSENHGEat9wre1bFcM3LYnlGjf9gmcE9FmeCySzbGZ4SCCUl5QLQN/quXw0=,iv:Bdwlk5UHSiyA9gSW91LUPJyBG50FG/hpwyClzTOUoUI=,tag:/Jw549R5Qmg4WblL7rUE8w==,type:str]
 gitea_token: ENC[AES256_GCM,data:1LevtPr5awIu2rcCGbLIsQA5QO0AhFk5Rep7RG28QdlFHDADCaEoS18pEEZ9NMYMZaGWIBA8Zq/NsCYxQGzuWh3TESZW7CO5kzCaSVG1aqjGpjfbeyG+xQEDtab2Owh+TVN/wVGUUDR1NBlWqE4Shw7mO228CWbxQRSQo3lsLhmf69fLEV1DDnH0Xt7Ml8tr7yLIeWHlG0BeOMKSkY17APahxqBx547Zw+kgaUW3WgTyxeWZaDjk/prK6bYV2euK4Il/4vTZE/x0mThmTThjszcAvdaon+V8y1Ax34gTyAgjvpFC2kE=,iv:1A8YNv/A0MEkGKV5Z9WPI4LwQFu2Z9BWuN2yfFHCPLI=,tag:hEfskDEAQiriXNjcYzziSg==,type:str]
 cache_priv: ENC[AES256_GCM,data:NbfyBv68UCWuSjbUu5lFUXPgG+vYrxbAQeD77YlklTRm6MVS4lAEjUzjnjewcX6Khca1N7r7vGieFyaBlQm0264KGTP5tc7BnEIKJDOD/UHQBdMpZgUzd2cKQWK7Kx0=,iv:6VWsZd/VDjQ/BhfwHZBcL3Zp0W/9sO/ZC9sF1Jnqguo=,tag:/gSe6TyaZDKoRFaRKiYyzw==,type:str]
+gitea_runner_token: ENC[AES256_GCM,data:7pVUx9TI/WbCWg2aI/k/fngtWZtffUCMsRfyJn2AQW6VOXknWMeXIKc07MDnbjjc,iv:isSUZ1yq3j/gIzqoCLGpmPIay5L5gYkOBW08K1rGvuA=,tag:uOkrUB6If/gQ5680A0VTxQ==,type:str]
 sops:
     age:
         - enc: |
@@ -21,8 +22,8 @@ sops:
             N6DSIVisJf7qNuNw6M0J5nny6xfWeIEZJettF0xSHM1gSfr7oUbHOQ==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1mfarz0n7qfa7vg8zz355qf8eregm6myl38lld0h767nuvhgjqd4qruxuhn
-    lastmodified: "2026-08-26T17:31:59Z"
-    mac: ENC[AES256_GCM,data:G0Xpe7zJZh4xAwFRUXSbR11ENqRd4UoU7gFK3nDM7Icm9DMyqyi3uBfg1j0c8yTCInIrnyX1dy7zUWjns+OAbXv8CMLXVUPdomgCxX0zUWEkTzgQqnJy97KFAmPPPMCGTUby3TMVQkcrk5/iATmydSMhs0lKErS4737u9jen/3I=,iv:YB3BqypuvamDJy64FeaSUQBCAdlr7a9UWJDNhGsTRvo=,tag:lXc7heG+MRiUo+SfRcRDNg==,type:str]
+    lastmodified: "2026-09-11T18:12:32Z"
+    mac: ENC[AES256_GCM,data:4uH4hVrc3ISolaYHZb0NK65Rx6wQf+P6bpbcYCPHbn3N9vkbkqBSKePsxGgKaNQQhAHwkLMdxRIcwtERjMsAngL5IZrO3riI91MZxRoFadbklJbJ4HSpQ240PT5vrpkpVb68KqCeVdoKRcR2MqH30H8UDCCvpZhdSNSl8ceQCss=,iv:5FnwnOb1dBSRCs4/5WONIYPji/+2WVtgFboTfybGZ/U=,tag:QWKWjN8ljeloS7UJM4LiKg==,type:str]
     pgp:
         - created_at: "2026-08-20T15:43:21Z"
           enc: |-

machines/antamap/configuration.nix

@@ -0,0 +1,59 @@
+{ self, config, lib, pkgs, inputs, ... }:
+
+with lib;
+
+let
+  antamap-pkg = pkgs.stdenv.mkDerivation {
+    name = "antamap";
+    src = pkgs.fetchgit {
+      url = "https://0xacab.org/AND/antamap.git";
+      branchName = "master";
+      rev = "ec584c0c4bd4ddd9ff8353bf8a926bd94526d304";
+      sha256 = "sha256-o5alTWBZIaUJiwYE0/gkGlxH+v1BxaGauxHDb6gK3+I=";
+    };
+
+    installPhase = "mkdir -p $out; cp -R * $out/";
+  };
+in
+{
+  networking = {
+    hostName = mkDefault "antamap";
+    useDHCP = false;
+  };
+
+  imports = [
+    self.nixosModules.malobeo.users
+    ../modules/sshd.nix
+  ];
+
+  malobeo.users = {
+    malobeo = false;
+    admin = true;
+  };
+
+  services.nginx = {
+    enable = true;
+    virtualHosts."_" = {
+      listen = [ 
+        { addr = "0.0.0.0"; port = 80; } 
+      ];
+      root = "${antamap-pkg}";
+      extraConfig = ''
+        proxy_buffering off;
+        proxy_cache off;
+        proxy_http_version 1.1; 
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+      '';
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = [ 80 ];
+
+  time.timeZone = "Europe/Berlin";
+
+  system.stateVersion = "22.11"; # Did you read the comment?
+}
+

machines/bakunin/configuration.nix

@@ -19,7 +19,7 @@ in
     enable = true;
     url = "https://hydra.malobeo.org";
     project = "malobeo";
-    jobset = "infrastructure";
+    jobset = "master";
     cacheurl = "https://cache.malobeo.org";
   };
 
@@ -83,7 +83,6 @@ in
   services.acpid.enable = true;
 
   networking.hostName = "bakunin";
-  networking.networkmanager.enable = true;
 
   security.rtkit.enable = true;
   services.pipewire = {

machines/fanny/configuration.nix

@@ -44,7 +44,7 @@ in
     enable = true;
     url = "https://hydra.malobeo.org";
     project = "malobeo";
-    jobset = "infrastructure";
+    jobset = "master";
     cacheurl = "https://cache.malobeo.org";
   };
 
@@ -146,6 +146,9 @@ in
     "zineshop"
     "vaultwarden"
     "pretalx"
+    "antamap" 
+    "ns1"
+    "wordpress"
   ];
 
   networking = {
@@ -286,6 +289,56 @@ in
         '';
       };
     };
+
+    virtualHosts."antamap.malobeo.org" = {
+      forceSSL = true;
+      enableACME = true;
+      locations."/" = {
+        proxyPass = "http://${hosts.malobeo.hosts.antamap.network.address}:80";
+        extraConfig = ''
+          proxy_set_header Host $host;
+        '';
+      };
+    };
+    
+    virtualHosts."hydra.malobeo.org" = {
+      forceSSL = true;
+      enableACME = true;
+      locations."/" = {
+        proxyPass = "http://${hosts.malobeo.hosts.albert.network.address}:3000";
+        recommendedProxySettings = true;
+        extraConfig = ''
+          proxy_set_header Host $host;
+          proxy_set_header X-Forwarded-Port 443;
+          proxy_set_header X-Forwarded-Proto https;
+        '';
+      };
+    };
+
+    virtualHosts."www.rm16bleibt.org" = {
+      forceSSL = true;
+      enableACME = true;
+      locations."/" = {
+        proxyPass = "http://${hosts.malobeo.hosts.wordpress.network.address}:80";
+        recommendedProxySettings = true;
+        extraConfig = ''
+          proxy_set_header Host $host;
+          proxy_set_header X-Forwarded-Port 443;
+          proxy_set_header X-Forwarded-Proto https;
+        '';
+      };
+    };
+
+    virtualHosts."cache.malobeo.org" = {
+      forceSSL = true;
+      enableACME = true;
+      locations."/" = {
+        proxyPass = "http://${hosts.malobeo.hosts.albert.network.address}:5000";
+        extraConfig = ''
+          proxy_set_header Host $host;
+        '';
+      };
+    };
   };
 
   services.tor = {
@@ -299,7 +352,6 @@ in
   services.acpid.enable = true;
 
   networking.hostName = "fanny";
-  networking.networkmanager.enable = true;
 
   virtualisation.vmVariant.virtualisation.graphics = false;
 

machines/fanny/dyndns.nix

@@ -2,12 +2,17 @@
 {
   sops.secrets.njalacloud = {};
   sops.secrets.njalazines = {};
+  sops.secrets.njalaantamap = {};
   systemd.services."dyndns" = {
     script = ''
       KEYCLOUD=$(cat /run/secrets/njalacloud)
       KEYZINES=$(cat /run/secrets/njalazines)
+      KEYANATAMAP=$(cat /run/secrets/njalaantamap)
+      KEYRM16=$(cat /run/secrets/njalarm16)
       ${pkgs.curl}/bin/curl --fail --silent --show-error "https://njal.la/update/?h=cloud.malobeo.org&k="$KEYCLOUD"&auto"
       ${pkgs.curl}/bin/curl --fail --silent --show-error "https://njal.la/update/?h=zines.malobeo.org&k="$KEYZINES"&auto"
+      ${pkgs.curl}/bin/curl --fail --silent --show-error "https://njal.la/update/?h=antamap.malobeo.org&k="$KEYANATAMAP"&auto"
+      ${pkgs.curl}/bin/curl --fail --silent --show-error "https://njal.la/update/?h=www.rm16bleibt.org&k="$KEYRM16"&auto"
     '';
     serviceConfig = {
       Type = "oneshot";

machines/fanny/secrets.yaml

@@ -3,11 +3,11 @@ shop_cleartext: ENC[AES256_GCM,data:sifpX/R6JCcNKgwN2M4Dbflgnfs5CqB8ez5fULPohuFS
 shop_auth: ENC[AES256_GCM,data:0NDIRjmGwlSFls12sCb5OlgyGTCHpPQIjycEJGhYlZsWKhEYXV2u3g1RHMkF8Ny913jarjf0BgwSq5pBD9rgPL9t8X8=,iv:3jgCv/Gg93Mhdm4eYzwF9QrK14QL2bcC4wwSajCA88o=,tag:h8dhMK46hABv9gYW4johkA==,type:str]
 njalacloud: ENC[AES256_GCM,data:sp79Ij1vd9pQZuPUR1phmw==,iv:AWKZoOfBA/n16pWQCfA0dZmH1KajCztnLvYItoZZbgA=,tag:BIUrobBoO96pxUz1sjIYIw==,type:str]
 njalazines: ENC[AES256_GCM,data:fnObUEnXYvdj9HtkZNzXVA==,iv:0Zj2n2we9w4fj/n7e1ayd9XgFEMAGCHk4QLTu1IlRnQ=,tag:zeOLAB0oE6XbxqdqhdRNxw==,type:str]
+njalaantamap: ENC[AES256_GCM,data:nUc+E7HNbW0EDclzNDV6+w==,iv:H8nqeuOrvvu8O8QhGWkBkYWAQXwkBehf/jU6u/grs1A=,tag:mqX6jn47DyeSuk8xzG0e/Q==,type:str]
 njala_api_key: ENC[AES256_GCM,data:ohSVzQUvFjia/s9WceqnZCdLyk3N1Lm2BCBmXeBlkWD2dyrohKCnd9GiJ499IORpuYcOXyM=,iv:Uczk8op5mgqe8gefxgU9YuTqOsYvjzHCKvzA7GDsgio=,tag:XA7JRq/LsGkpHcQSO36Whg==,type:str]
 sops:
     age:
-        - recipient: age136sz3lzhxf74ryruvq34d4tmmxnezkqkgu6zqa3dm582c22fgejqagrqxk
-          enc: |
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2ZFBYMHMzTFRMLzhCbnBE
             MXkreklWSUVOckl5OTJ0VzlWS2tIOFBRRVVJCk90OXJoMHQza0hTSGt5VUphNjY1
@@ -15,8 +15,8 @@ sops:
             TStjbTBkMTNOcHBja0JRYUdvSWJUN00KtOPBH8xZy/GD9Ua3H6jisoluCR+UzaeE
             pAWM9Y6Gn6f7jv2BPKVTaWsyrafsYP7cDabQe2ancAuuKvkng/jrEw==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
-          enc: |
+          recipient: age136sz3lzhxf74ryruvq34d4tmmxnezkqkgu6zqa3dm582c22fgejqagrqxk
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhc282T2VVamFGcG1Ub3hp
             S1VwKzVsWW1sRXczZnRNdkxDWE5Sd0hhVUJRCkovNGZ1ZlN0c1VyMXV0WThJMGFi
@@ -24,8 +24,9 @@ sops:
             QVZyNWVOMTh3ejBha21Qb2xCRkFERGMKH9nMQUoS5bGcLUx2T1dOmKd9jshttTrP
             SKFx7MXcjFRLKS2Ij12V8ftjL3Uod6be5zoMibkxK19KmXY/514Jww==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-02-20T19:25:05Z"
-    mac: ENC[AES256_GCM,data:g+bFYqJN1X8F52tpIO60S2WKxLG27ZrP399fsfE6o7rPtIMimZou/4oUo7i+kpNtygEuCr3+suP8TPas4x5zMXhRjnjJuwJwL/NwdciHZU0O3rPJgucCEWqr9OdAtxezDM9c2vv+jzqZxWT9t0fIpB9RxO5oy1pHZs0RCgjAJR4=,iv:v6RdTMeQUxSdjIVNFbx2HtxCsdVgFTQTzMXS5Fj62is=,tag:pLoZMBRIXYElO5rY+xX9zg==,type:str]
+          recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
+    lastmodified: "2026-08-28T12:19:14Z"
+    mac: ENC[AES256_GCM,data:TnElCRaL/b238clfFVEq+Ot1lwg5MLMchCkmhi5PmADRn2exA42Zeq5v1M/IM5sHt4xEyFLn5R/88Y49DAfehRFwu6rddV+3lnFV40k2rWRtMfQOUXSrCd7lGxZdFbMU0eIXF5jaATFbcP0wO03FohNA69/u6kNsS0y0jK3vuLQ=,iv:xPeNXUIavVYFfAv1fs5TXCHXmvnXQDs4mJZMHOX7qG8=,tag:85hrBTKMh1ckTtXpOxj5lg==,type:str]
     pgp:
         - created_at: "2025-02-11T18:32:49Z"
           enc: |-
@@ -66,4 +67,4 @@ sops:
             -----END PGP MESSAGE-----
           fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4
     unencrypted_suffix: _unencrypted
-    version: 3.11.0
+    version: 3.13.1

machines/hosts.nix

@@ -29,6 +29,8 @@ in
           local = true;
           hostId = "11";
           address = "192.168.1.101";
+          gateway = "192.168.1.1";
+          nameservers = [ "192.168.1.1" "1.1.1.1" ];
         };
       };
 
@@ -38,6 +40,8 @@ in
           local = true;
           hostId = "12";
           address = "192.168.1.102";
+          gateway = "192.168.1.1";
+          nameservers = [ "192.168.1.1" "1.1.1.1" ];
         };
       };
   
@@ -47,6 +51,8 @@ in
           local = true;
           hostId = "13";
           address = "192.168.1.103";
+          gateway = "192.168.1.1";
+          nameservers = [ "192.168.1.1" "1.1.1.1" ];
         };
       };
   
@@ -56,6 +62,8 @@ in
           local = true;
           hostId = "15";
           address = "192.168.1.105";
+          gateway = "192.168.1.1";
+          nameservers = [ "192.168.1.1" "1.1.1.1" ];
         };
       };
 
@@ -65,6 +73,8 @@ in
           local = true;
           hostId = "19";
           address = "192.168.1.111";
+          gateway = "192.168.1.1";
+          nameservers = [ "192.168.1.1" "1.1.1.1" ];
         };
       };
   
@@ -118,7 +128,17 @@ in
         network = createMaloNet "18" "52:DA:0D:F9:EF:F4";
       };
 
-      # last host id: 19
+      antamap = {
+        type = "microvm";
+        network = createMaloNet "20" "52:DA:0D:F9:EF:F6";
+      };
+
+      wordpress = {
+        type = "microvm";
+        network = createMaloNet "21" "52:DA:0D:F9:EF:F6";
+      };
+
+      # last host id: 21
     };
   };
 }

machines/louise/configuration.nix

@@ -16,7 +16,7 @@
     enable = true;
     url = "https://hydra.malobeo.org";
     project = "malobeo";
-    jobset = "infrastructure";
+    jobset = "master";
     cacheurl = "https://cache.malobeo.org";
   };
 
@@ -71,7 +71,6 @@
   services.acpid.enable = true;
 
   networking.hostName = "louise";
-  networking.networkmanager.enable = true;
 
   security.rtkit.enable = true;
   services.pipewire = {

machines/modules/host_builder.nix

@@ -31,8 +31,8 @@ rec {
                 "https://cache.nixos.org/"
               ];
               trusted-public-keys = [
-                # TODO: add cache.malobeo.org key after creation
                 "cache.dynamicdiscord.de:DKueZicqi2NhJJXz9MYgUbiyobMs10fTyHCgAUibRP4="
+                "albert:+eSv8F63uj94A0fvmdyPcDDH0qI3CYR91fsbA/eLFGw="
               ];
               trusted-users = [ "root" "@wheel" ];
             };
@@ -45,6 +45,20 @@ rec {
   ];
   defaultModules = baseModules;
 
+  makeNetwork = network: [{
+    systemd.network.enable = true;
+    
+    systemd.network.networks."20-lan" = {
+      matchConfig.Type = "ether";
+      networkConfig = {
+        Address = [ "${network.address}/24" ];
+        Gateway = "${network.gateway}";
+        DNS = network.nameservers;
+        DHCP = "no";
+      };
+    };
+  }];
+
   makeMicroVM = hostName: network: modules: [
     {
       microvm = {
@@ -89,18 +103,6 @@ rec {
           }
         ];
       };
-
-      systemd.network.enable = true;
-      
-      systemd.network.networks."20-lan" = {
-        matchConfig.Type = "ether";
-        networkConfig = {
-          Address = [ "${network.address}/24" ];
-          Gateway = "${network.gateway}";
-          DNS = network.nameservers;
-          DHCP = "no";
-        };
-      };
     }
   ] ++ defaultModules ++ modules;
 
@@ -259,9 +261,9 @@ rec {
     specialArgs.inputs = inputsMod;
     specialArgs.self = self;
     modules = (if (settings.type != "microvm") then
-      defaultModules ++ [ ../${host}/configuration.nix ]
+      (makeNetwork settings.network) ++ defaultModules ++ [ ../${host}/configuration.nix ]
       else
-      makeMicroVM "${host}" settings.network [
+      (makeNetwork settings.network) ++ makeMicroVM "${host}" settings.network [
         inputs.microvm.nixosModules.microvm
         ../${host}/configuration.nix
       ]);

machines/modules/malobeo/peers.nix

@@ -65,4 +65,11 @@
     allowedIPs = [ "10.100.0.20/32" ];
     publicKey = "Pp55Jg//jREzHdbbIqTXc9N7rnLZIFw904qh6NLrACE=";
   };
+
+  "ns1" = {
+    role = "client";
+    address = "10.100.0.21";
+    allowedIPs = [ "10.100.0.21/32" ];
+    publicKey = "jozMsP5MA2uz7eOrXG8LB8mr2tHVa6FL1+tbMQs9ySk=";
+  };
 }

machines/modules/malobeo/wireguard.nix

@@ -72,6 +72,7 @@ in
           mtu = 1340; #seems to be necessary to proxypass nginx traffic through vpn
           address = [ "${myPeer.address}/24" ];
           autostart = cfg.autostart;
+          dns = [peers.ns1.address];
           listenPort = mkIf (myPeer.role == "server") myPeer.listenPort;
 
           # This allows the wireguard server to route your traffic to the internet and hence be like a VPN

machines/ns1/dummy.yaml

@@ -0,0 +1,64 @@
+wg_private: ENC[AES256_GCM,data:KnlCYE1/WjhNLfazuKViiVKZLPqQHwwqX1o2Irxaoj6oa54s6vBoiHVste4=,iv:ZAqdUSGwzbrLjskAntzmcNCcIjyePG+awYRkSgi6tZg=,tag:vllLI+0dbuFlkcdaYsBqYQ==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBSDdNMUxFRGROR2YwN0Vn
+            SjlqVXV5SmVwOXdWcmgrOUswNnB6YitYeTJvClcrVk53d1FBUndSQWgxRVVySnFl
+            bVp4R3hHWmtGQW9lWER4L0tmTzdjc00KLS0tIFJRUHlMMGlvOVplTGNGNUo3NWNw
+            azVxT1hPUUZ4Wmc4QjNGcEtUcDFqd1kKZU2LEJsStdOspRE1CmbXevkQDfPHTuWp
+            k4AOM/W2T1Jz70pPl4M+Xg8oCJ5TNaURnvCxuiaBgAtQuZC7OR/Pnw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age18jn5mrfs4gqrnv0e2sxsgh3kq4sgxx39hwr8z7mz9kt7wlgaasjqlr88ng
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHMlE1bGVyWkdOOHdja1pM
+            OUhRU2VCVDhEZ3kxVDRzb0Z4YUxOeFZFTVdJCjlWd2NlUmcwU3dQb1pMT2U0a1ZO
+            Zk5HNVJtQWREMWpXVG9ZVkd2QkVjeVkKLS0tIHBXbDUrcjl5VXNXT3JPTThIYVFa
+            TEtTb1pNUjVUM3dBVFRJMUpnNng2bEkKBfxqOkJ4R4RMl4AYMmFXq0dYeiH8UuwB
+            1ozr78TT5ksdRHuYmOyJzAG3Q14tK/+h1tcSmh5bXIZtuzJzZKN4kw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
+    lastmodified: "2026-09-10T15:02:33Z"
+    mac: ENC[AES256_GCM,data:e03qvt+6PI5FsKtV4aK1XhX1RCzzsvAf42/NOau5kEa0pRaSM+ajTJSD+06oC35gBYwB3w9Hq1ubFZVvZM3vgqITSNzCNJr7ft6LI48Srq0VjtKoGmjKqETYTTSNhbisNCI+sU13pdV18BESHE5eIGY/0KHcSeF1vG7Ys2DMTwM=,iv:cmfCkTMj5+NxWgBIthg2MaG39CYOsZdqTOMszOiOmY0=,tag:a4ooDhkCtLZm/s1O0tNGug==,type:str]
+    pgp:
+        - created_at: "2026-09-10T15:02:19Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQGMA5HdvEwzh/H7AQv/Wz+3/F+/IPsaVUZbJ6GB8V5HkowP7KCzWJOxwY3B3Yhl
+            H4Qir6G6aT2CpD5hHy+zEFw7s5t+MILybyzMZqNocjuQWIrF/YIYUbTDKK6rgSzC
+            tx0E6DcndBf69eK2wL8Um19/boB+MTN3DQSUom6Jpvg7WGo0NjtDexAqwSpJwFFF
+            di2DoUDHyTUUdHTcD+hfODTiQYC7cp51hZ6n3JACu1toGNfre1A/PtoSOTYP9i2p
+            aIIWBSciT4K1RJnIhV4fpU7wh7gi0O4xS1XZnTQ/SOA26sHp8wObLvi3TwF5AKum
+            dYyuCinJGMep7VBjBf7eJ73TI4CD1QM+MEQTzegPVlo54LvqSqwp8ZwHdIZi9gQ4
+            3Vku2hGSOI9SmOjOR5GGEYfJS3BbbF9rJCnamBhZVVO5lXbFtZqWi0JOu8U4Esnw
+            DTzLDOJpajEo7YxADD7yyLlFXDRtMNgU91hCjBLz76SgExI3avWq3Mm+KZXI4xCt
+            L0yENHriidkFR2T/uV4w0lYBAPOSvPnvxK92VEa1oDrhIjcFd0JwH/XsrYq/nih6
+            4PBf4U5DdO+ulJOj6MXV0QmsZXMObX8LWh6myufRTPIPl6wA5SeSvleDuiWQKYdW
+            j0rqALTicw==
+            =mpXh
+            -----END PGP MESSAGE-----
+          fp: c4639370c41133a738f643a591ddbc4c3387f1fb
+        - created_at: "2026-09-10T15:02:19Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA98TrrsQEbXUAQ/9EqodWqh61g7Uv1L/oF8PMMsONmprOg+17Xvn33xI8Pam
+            SjiEaGh8qZRJckFPdWgw1QNfpzFnEjpJEYMQ46oHJxlLMd5T4eqOTHbmPC3IAktm
+            lg3yYRmHEhyrngmQPTnoKuNQg6YDhzorHsfD98Tf0zA0B9AGCukgDZoEUs2oXwsY
+            PiZYcTcgB8z/8petU9YlieO7frm17Srso5JfOfIlu88vtlAeu3z8LZl5iKl34Lxz
+            +2TGAz/6YTYx24Tmj9qWpRYYPpbnQNUTkm+D9eDts6Pz1SFY/cerd1Q0Do8apIo7
+            dO1gz0C2dhh6QvGAovH7k0fS+bH3N1qpqbzmLQfMArXytQVZg1Ucisk9VYkS9XEE
+            dV0TVTOOEyq8rOzmZHfhVqGv+VsAMQXdcgsCRJ8HDLDWlDAOnuIX86NvlNmDHuZu
+            9jMqCq+cmf7W0sZdamHLM/T3IXs0oJJc4YvyFAlPTPdbGHICQ1rWDLXvICIXiifg
+            LzkbK0XjxG+fDCzKzMXJ/gho7KHOut/+Kf5+hQNMnoPZ3/MeDJEyAHKBEsTI/CYe
+            9qla0CJnUVNRHDnc99qMeSeD7p6OLZsO4cANTSEnz0eiyZoJKa2m8du1TTtxIzCt
+            Jcu1yFana7MX68ppxlqkfd7iSPyGo9d7DcPO9lFscNQ9yIPiGReZ8Ow7KSlu37LS
+            VgFsGneFVfYYk6SnW9SOtooNAFNL9sWxqiWjb3fxfGeIuOF7LJqmevx7SU8V5eAt
+            nCqGZZg/YCAecjTDHi8Yy5ly2LrNjF6yOhUtYifW6yBJB2UEQdDE
+            =mUhm
+            -----END PGP MESSAGE-----
+          fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4
+    unencrypted_suffix: _unencrypted
+    version: 3.13.1

machines/ns1/secrets.yaml

@@ -0,0 +1,64 @@
+wg_private: ENC[AES256_GCM,data:KjuXpIBnp/LVjOvaSk0vZEF3vOcq0y7cnEohYMFAHnnJK+TiGt3+ESkF08c=,iv:zlWkp9blv2KmIpXEOQRqle2voHIS/EhTVuWKJQ/qowY=,tag:nOUDEcwKODx8G8p7jWPA2w==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZa0ticWhrdXRNa094MEoz
+            ZmJiYTJoSTFHUnFpakJuc1NCTjZlN2kzazBzClRYb3B6YUozMUxFY09wdHNsK3No
+            eWVBSUU2bUd5M2Z5WjVjWnpxcjFBTHcKLS0tIDBESUtRQVkzRVp5MGYwVER1aDFE
+            dGl4bXlDTkhNVWM3R1Y4aDVabnYrd2cKCuLUw7SP/pyDJbmq/ADRvH7EfDVlYItW
+            rU2b1KTyI4JpVK6/OLN2leSioYzqiE3ONewC9CMMrluCWwNEKmLiUg==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1mam7y7x4my6g8yt8leze3pvlq0fr48hdsqz62gs7l9rstf9hh3fs03xf7n
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGaEV0WkI4Y2JoV0IzTlNj
+            SkFGVTQ1ZG1VNzdtK0xTWFZRS0FTY1Y1MlZvCjdhYk9UWWtUWC9MNUwybVhZSzhI
+            bjhydVVkK01zcmZZampEVW16L0dWRzAKLS0tIDhpK2YrTEtPYmVsUHExdnA4WHRa
+            Y1JUT1VQMmdRUnl1b0NGOEFsNlR1VGcKOR35LVxYuGw8HOWwQ+ODN9y4I9FHq3lg
+            1vDrSI3JBfRuU2G/OXbkV6bNPH9KnzgXxUEOWkZmamrcwtIGldfh9Q==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
+    lastmodified: "2026-09-10T15:02:04Z"
+    mac: ENC[AES256_GCM,data:Ykr0571wJjFij/4j6aIBXVOpkyU6jCbAdnjvxLQfwrxB25CgqaposamrFJVWMKXTHhjD9cyERuApAglIcDmgfDAE7udeE5UaQDTPzTgxSteDwr8t1Ln7D5nQ2euPZXqSEdEUYTvQZSufr47x1jHBdgpcsm2xjBQijRh5UtsuCzc=,iv:H3PuuKbdEoEq2Xrw1NuYEZty99MHCcHRZHAhRFgmrYw=,tag:s4vBcEvL4A39PLNInXknvg==,type:str]
+    pgp:
+        - created_at: "2026-09-11T18:55:59Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQGMA5HdvEwzh/H7AQv/cD7baU+5Ujkrf5jUdn4HSPtVW/KkeW0Mw7uQmd7bI5sp
+            n3iekWWTOpCv98lNdCMXn+iV1BL37ILPOYSXsjxw2vfKjGfgWkkwpFdcLUiS7Qnm
+            ymGVIPyqHDJRqhxxhiR5B1aC7AhR+otkULNzKSSgYZa+Rj8DlFwW07aknJDSeZM0
+            yy70RTxCGgH/4amYZN+QLOJapjGX4FMvJeG+y0vv65GinMmjkQ7B5z3rKUiKbud8
+            mjPgMIfxcBo5o5vepld315atoZQX+kCIgJPU3rQshTobgwQD+uVZo/ocGHVdZWra
+            eVOpKZYO4ecQJ8xRvSMNSrXRmeW/a6h7NhHN2kD74Ms1xB8cuhYklCz8gWd50yyo
+            7kTG8wBPnvvkx4SSgFwvnj1hnppUweFUM64JBHXrjQWeDof1FPC18kiNTAQGwAOL
+            UiI4Yka0d1zLl1vpdBN8E17jBqfi2CSLB9wL3IbD5CTYAprzzvptfXI2Ubqq82c1
+            Np71LvSaBYA4SPNJ2EZB0lYBtkjGzUw8L9Kuod5UwXTeJQ2vbhpYpqHzjWrmWvK/
+            VlCzVV+AYfOQUVvmbYf+DtowO/wCS8n2gVepyOoMCcEnRT9lqm7ndC/ozt+iZove
+            vDcSGqKuUg==
+            =oEsA
+            -----END PGP MESSAGE-----
+          fp: c4639370c41133a738f643a591ddbc4c3387f1fb
+        - created_at: "2026-09-11T18:55:59Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA98TrrsQEbXUAQ//fciJkmAmvlAHzZxO2CTCFkNNn+aSpkH/IoNRKfEIJDtf
+            wAChdactP8yq6qKxSqv3Ks90K+hQRQr6tXpF652NDFYkP2CHsEo0wbOAgcqFzGtY
+            92MenPwOKP6B9UTvm0ZqVFet7/jmQBatXMzFWsSkUCBqWXAg/UUrJVf/zbGoHwB7
+            efskMTrkArlxhoY/3+/0bMeEqZJlhm9UmlAST1/xNlI4DUYhlBxnzA2vgi8QWBFT
+            6+QkZ2YiM0IlDCUbe920c1ad0/McV8Bj6jccW1ZBISXk9KYQq41PBjQKhyKoC/Xc
+            xJLcxy1NeUZWlPSFF05TTWaRUkBH8YZm7vum5xWdT1lz6FrHB+aNHr9XxKj5c7pp
+            bLAQ2PfG0kK/kemNBKd9/Q5r2SfEUbmI+cGLbqkaZwbhD0ThMmEkMxdGwzzrf2Wq
+            Lhpkj+2zx37r6GI8UlBp9jhUbhj1N9HetyjBhKzEcxqCEg4DXNiKRiXvMvCg6sCz
+            kIKsmNDhbmt0jKNL8NJio10lo4+S2gPi8jg6mcj4RDkS8zC95P/EHkNZl2aQwBRU
+            /GLzzpODa41ZZB9+WC68vMZudSQwHK0c7SNoEc5putlbUjKDSpJHY4manF6O4rG2
+            FZNG8TA8VeEg6wjBPkBw5ardM//E5r0iFfx2IjrCjhNoaknc5aPRZ96XqY/5TqbS
+            VgGRpWs5jaQv4CbRA0yAHqFrGgSRFY0wCFT5Hkwi7wyGyxR5Y30jISsn+kU8ysHV
+            OGZFCDl7tRvL9ICJheXWS61k5LNd4H8rAMqXoPbSvtU/KC/hfRMk
+            =ZdHS
+            -----END PGP MESSAGE-----
+          fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4
+    unencrypted_suffix: _unencrypted
+    version: 3.13.1

machines/overwatch/blackbox.yaml

@@ -0,0 +1,78 @@
+modules:
+  http_2xx:
+    prober: http
+    http:
+      preferred_ip_protocol: "ip4"
+  http_post_2xx:
+    prober: http
+    http:
+      method: POST
+  tcp_connect:
+    prober: tcp
+  pop3s_banner:
+    prober: tcp
+    tcp:
+      query_response:
+      - expect: "^+OK"
+      tls: true
+      tls_config:
+        insecure_skip_verify: false
+  grpc:
+    prober: grpc
+    grpc:
+      tls: true
+      preferred_ip_protocol: "ip4"
+  grpc_plain:
+    prober: grpc
+    grpc:
+      tls: false
+      service: "service1"
+  ssh_banner:
+    prober: tcp
+    tcp:
+      query_response:
+      - expect: "^SSH-2.0-"
+      - send: "SSH-2.0-blackbox-ssh-check"
+  ssh_banner_extract:
+    prober: tcp
+    timeout: 5s
+    tcp:
+      query_response:
+      - expect: "^SSH-2.0-([^ -]+)(?: (.*))?$"
+        labels:
+        - name: ssh_version
+          value: "${1}"
+        - name: ssh_comments
+          value: "${2}"
+  irc_banner:
+    prober: tcp
+    tcp:
+      query_response:
+      - send: "NICK prober"
+      - send: "USER prober prober prober :prober"
+      - expect: "PING :([^ ]+)"
+        send: "PONG ${1}"
+      - expect: "^:[^ ]+ 001"
+  icmp:
+    prober: icmp
+  icmp_ttl5:
+    prober: icmp
+    timeout: 5s
+    icmp:
+      ttl: 5
+  websocket:
+    prober: websocket
+  http_3xx:
+    prober: http
+    http:
+      preferred_ip_protocol: "ip4"
+      enable_http3: true
+      enable_http2: false
+      valid_http_versions: ["HTTP/3.0"]
+  postgresql:
+    prober: tcp
+    tcp:
+      query_response:
+      - send: !!binary AAAACATSFi8= # 0x00, 0x00, 0x00, 0x08, 0x04, 0xD2, 0x16, 0x2F - PostgreSQL SSLRequest
+      - expect_bytes: S # 0x53 - Reply will be 'S' if SSL is enabled, and 'N' if it is not.
+      - starttls: true

machines/overwatch/configuration.nix

@@ -108,7 +108,58 @@ in
     retentionTime = "1y";
     port = 9001;
 
+    exporters.blackbox = {
+      enable = true;
+      configFile = ./blackbox.yaml;
+    };
+
     scrapeConfigs = [
+      {
+        job_name = "blackbox-http";
+        metrics_path = "/probe";
+        params = {
+          module = ["http_2xx"];
+        };
+        static_configs = [{
+          targets = [ 
+            "https://malobeo.org"
+            "https://cloud.malobeo.org"
+            "https://antamap.malobeo.org"
+            "https://docs.malobeo.org"
+            "https://events.malobeo.org"
+            "https://hydra.malobeo.org"
+            "https://keys.malobeo.org"
+            "https://tasklist.malobeo.org"
+            "https://zines.malobeo.org"
+           ];
+        }];
+        relabel_configs = [
+          {
+            source_labels = ["__address__"];
+            target_label = "__param_target";
+          }
+          {
+            source_labels = ["__param_target"];
+            target_label = "instance";
+          }
+          {
+            target_label = "__address__";
+            replacement = "127.0.0.1:9115";
+          }
+        ];
+      }
+      {
+        job_name = "hydra";
+        static_configs = [{
+          targets = [ "${hosts.malobeo.hosts.albert.network.address}:9199" ];
+        }];
+      }
+      {
+        job_name = "hydra-queue-runner";
+        static_configs = [{
+          targets = [ "${hosts.malobeo.hosts.albert.network.address}:9198" ];
+        }];
+      }
       {
         job_name = "overwatch";
         static_configs = [{
@@ -163,6 +214,12 @@ in
           targets = [ "${hosts.malobeo.hosts.fanny.network.address}:9002" ];
         }];
       }
+      {
+        job_name = "albert";
+        static_configs = [{
+          targets = [ "${hosts.malobeo.hosts.albert.network.address}:9002" ];
+        }];
+      }
       # add vpn - check how to reach it first. most probably 10.100.0.1
     ];
   };

machines/testvm/configuration.nix

@@ -51,7 +51,6 @@ in
   services.acpid.enable = true;
 
   networking.hostName = "testvm";
-  networking.networkmanager.enable = true;
 
   time.timeZone = "Europe/Berlin";
   system.stateVersion = "23.05"; # Do.. Not.. Change..

machines/wordpress/configuration.nix

@@ -0,0 +1,139 @@
+{ config, lib, pkgs, inputs, ... }:
+
+# 1. copy wp folder to host
+# 2. chown nginx:nginx wordpress.bak/rm16bleibt.org/* -R
+# 3. create user through webinterface
+# 4. delete hello world post
+# 5. run importer
+
+with lib;
+
+let
+
+  user = "wordpress";
+  stateDir = "/var/lib/wordpress/rm16bleibt.org";
+  webserver = config.services.nginx;
+  uploadsDir = "/var/lib/wordpress/rm16bleibt.org/wp-content/uploads";
+  fontsDir = "/var/lib/wordpress/rm16bleibt.org/wp-content/fonts";
+
+in {
+  networking = {
+    hostName = mkDefault "wordpress";
+    useDHCP = false;
+  };
+
+  imports = [
+    inputs.self.nixosModules.malobeo.users
+    ../modules/sshd.nix
+  ];
+
+  malobeo.users = {
+    malobeo = false;
+    admin = true;
+  };
+
+  users.users.wordpress = {
+    group = webserver.group;
+    isSystemUser = true;
+  };
+
+  systemd.tmpfiles.rules = [
+    "d '${stateDir}' 0750 ${user} ${webserver.group} - -"
+    "d '${stateDir}/wp-content' 0750 ${user} ${webserver.group} - -"
+    "d '${uploadsDir}' 0750 ${user} ${webserver.group} - -"
+    "Z '${uploadsDir}' 0750 ${user} ${webserver.group} - -"
+    "d '${fontsDir}' 0750 ${user} ${webserver.group} - -"
+    "Z '${fontsDir}' 0750 ${user} ${webserver.group} - -"
+  ];
+
+  services.phpfpm.pools = {
+    "wordpress-rm16bleibt.org" = {
+      user = user;
+      group = webserver.group;
+      settings = {
+        "pm" = "dynamic";
+        "pm.max_children" = 32;
+        "pm.start_servers" = 2;
+        "pm.min_spare_servers" = 2;
+        "pm.max_spare_servers" = 4;
+        "pm.max_requests" = 500;
+        "listen.owner" = webserver.user;
+        "listen.group" = webserver.group;
+      };
+    };
+  };
+
+  services.mysql = {
+    enable = true;
+    #package = mkDefault pkgs.mariadb;
+    package = pkgs.mysql84;
+    ensureDatabases = ["wordpress"];
+    ensureUsers = [
+      {
+        name = "wordpress";
+        ensurePermissions = {
+          "wordpress.*" = "ALL PRIVILEGES";
+        };
+      }
+    ];
+  };
+
+  services.nginx = {
+    enable = true;
+    virtualHosts."rm16bleibt.org" = {
+      #serverName = "rm16bleibt.org";
+      root = "/var/lib/wordpress/rm16bleibt.org";
+      extraConfig = ''
+        index index.php;
+      '';
+      locations = {
+        "/" = {
+          priority = 200;
+          extraConfig = ''
+            try_files $uri $uri/ /index.php$is_args$args;
+          '';
+        };
+        "~ \\.php$" = {
+          priority = 500;
+          extraConfig = ''
+            fastcgi_split_path_info ^(.+\.php)(/.+)$;
+            fastcgi_pass unix:${config.services.phpfpm.pools."wordpress-rm16bleibt.org".socket};
+            fastcgi_index index.php;
+            include "${config.services.nginx.package}/conf/fastcgi.conf";
+            fastcgi_param PATH_INFO $fastcgi_path_info;
+            fastcgi_param PATH_TRANSLATED $document_root$fastcgi_path_info;
+
+            # Mitigate https://httpoxy.org/ vulnerabilities
+            fastcgi_param HTTP_PROXY "";
+            fastcgi_intercept_errors off;
+            fastcgi_buffer_size 16k;
+            fastcgi_buffers 4 16k;
+            fastcgi_connect_timeout 300;
+            fastcgi_send_timeout 300;
+            fastcgi_read_timeout 300;
+          '';
+        };
+        "~ /\\." = {
+          priority = 800;
+          extraConfig = "deny all;";
+        };
+        "~* /(?:uploads|files)/.*\\.php$" = {
+          priority = 900;
+          extraConfig = "deny all;";
+        };
+        "~* \\.(js|css|png|jpg|jpeg|gif|ico)$" = {
+          priority = 1000;
+          extraConfig = ''
+            expires max;
+            log_not_found off;
+          '';
+        };
+      };
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = [ 80 ];
+
+  system.stateVersion = "22.11"; # Did you read the comment?
+}
+