[nextcloud] fix missing inputs

if imported in external projects `inputs.self` will point
to the external resource instead of malobeo leading to errors.
therefore all occurences of inputs.self got replaces with inputs.malobeo

.gitea/workflows/hydra-callback.yml

@@ -7,13 +7,13 @@ on:
             - synchronize
         paths:
           - '**.nix'
-          - flake.lock
+          - 'flake.lock'
     push:
         branches:
-          - master
+          - 'master'
         paths:
           - '**.nix'
-          - flake.lock
+          - 'flake.lock'
 
 permissions:
     contents: write
@@ -40,7 +40,7 @@ jobs:
               timeout-minutes: 200
               run: |
                 echo "Running now @ pr no $PR"
-                nix run nixpkgs#hydra-cli -- -H https://hydra.dynamicdiscord.de jobset-wait malobeo2 "$PR"
+                nix run nixpkgs#hydra-cli -- -H https://hydra.malobeo.org jobset-wait malobeo "$PR"
 
     on_push:
         if: github.event.push
@@ -60,4 +60,4 @@ jobs:
               timeout-minutes: 200
               run: |
                 echo "Running now @ master"
-                nix run nixpkgs#hydra-cli -- -H https://hydra.dynamicdiscord.de jobset-wait malobeo2 master
+                nix run nixpkgs#hydra-cli -- -H https://hydra.malobeo.org jobset-wait malobeo master

README.md

@@ -4,8 +4,8 @@ this repository contains nixos configurations of the digital malobeo infrastruct
 
 ### deploying configuration
 
-hosts are deployed automatically from master. The [hydra build server](https://hydra.dynamicdiscord.de/jobset/malobeo/infrastructure) will build new commits and on success, hosts will periodically pull those changes.
-Big changes (like updating flake lock) could be commited to the staging branch first. [Hydra builds staging seperate](https://hydra.dynamicdiscord.de/jobset/malobeo/staging), and on success you can merge into master.
+hosts are deployed automatically from master. The [hydra build server](https://hydra.malobeo.org/jobset/malobeo/infrastructure) will build new commits and on success, hosts will periodically pull those changes.
+Big changes (like updating flake lock) could be commited to the staging branch first. [Hydra builds staging seperate](https://hydra.malobeo.org/jobset/malobeo/staging), and on success you can merge into master.
 
 ### deploy fresh host
 if you want to deploy a completly new host refer to [docs](https://docs.malobeo.org/anleitung/create.html)

doc/src/Index.md

@@ -4,8 +4,8 @@ this repository contains nixos configurations of the digital malobeo infrastruct
 
 ### deploying configuration
 
-hosts are deployed automatically from master. The [hydra build server](https://hydra.dynamicdiscord.de/jobset/malobeo/infrastructure) will build new commits and on success, hosts will periodically pull those changes.
-Big changes (like updating flake lock) could be commited to the staging branch first. [Hydra builds staging seperate](https://hydra.dynamicdiscord.de/jobset/malobeo/staging), and on success you can merge into master.
+hosts are deployed automatically from master. The [hydra build server](https://hydra.malobeo.org/jobset/malobeo/infrastructure) will build new commits and on success, hosts will periodically pull those changes.
+Big changes (like updating flake lock) could be commited to the staging branch first. [Hydra builds staging seperate](https://hydra.malobeo.org/jobset/malobeo/staging), and on success you can merge into master.
 
 ### deploy fresh host
 if you want to deploy a completly new host refer to [docs](https://docs.malobeo.org/anleitung/create.html)

doc/src/anleitung/create.md

@@ -1,4 +1,36 @@
-# Create host with nixos-anywhere
+# Create a new host
+
+### Base config
+there is an example config [here](../files/base_host.md) *note: TODO*
+## If this is a physical host
+Create the keys and secrets using `add-host-keys`
+This will ask for a hostname and then
+- create and encrypt a ssh-key with sops
+- create and encrypt a second ssh-key for the init
+- convert the main key to a sops pubkey and display it
+- create public/private wireguard keys and display the pubkey
+- generate a reproducible mac-address
+
+After this you have to
+- write the age public key into machines/.sops.yaml under `keys:`
+- write a new creation rule for the `secrets.yaml` under `creation_rules:` like
+```
+creation_rules:
+  - path_regex: {hostname}/secrets.yaml$
+    key_groups:
+    - pgp:
+      - *admin_kalipso
+      - *admin_kalipso_dsktp
+      age:
+      - *admin_atlan
+      - *machine_{hostname}
+```
+- create the secrets.yaml using `sops {hostname}/secrets.yaml`
+    - you can already add `wg_private: {wg priv key}` here
+- add the host to the `hosts.nix` file (if microvm use the generated mac here)
+- add the host to `machines/modules/malobeo/peers.nix` for vpn access (use the wireguard pubkey here)
+
+# deploy the host with nixos-anywhere
 We use a nixos-anywhere wrapper script to deploy new hosts.
 The wrapper script takes care of copying persistent host keys before calling nixos-anywhere.
 

doc/src/module/disks.md

@@ -1,5 +1,5 @@
 # Disks
-The disks module can be used by importing `inputs.self.nixosModules.malobeo.disko`
+The disks module can be used by importing `inputs.malobeo.nixosModules.malobeo.disko`
 
 
 #### `let cfg = malobeo.disks`

doc/src/module/gitea-translator.md

@@ -1,5 +1,5 @@
 # Gitea-tanslator
-The module can be used by importing `inputs.self.nixosModules.malobeo.gitea-translator`
+The module can be used by importing `inputs.malobeo.nixosModules.malobeo.gitea-translator`
 
 This module starts a python server that fetches the gitea pull request api and translates it to a file that hydra understands.   
 To use, just set the parameters of the gitea server, then send a GET request to either `http://${host}:${port}/` or `http://${host}:${port}/gitea-pulls-sorted.json`

doc/src/module/initssh.md

@@ -1,5 +1,5 @@
 # Initrd-ssh
-The initssh module can be used by importing `inputs.self.nixosModules.malobeo.initssh`
+The initssh module can be used by importing `inputs.malobeo.nixosModules.malobeo.initssh`
 
 #### `let cfg = malobeo.initssh`
 
@@ -26,4 +26,4 @@ Run ` lspci -k | grep -iA4 ethernet `
 ` [ ] `
 
 *Example:*
-`[ "r8169" ]`
+`[ "r8169" ]`

flake.lock

@@ -29,11 +29,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1768143854,
-        "narHash": "sha256-E5/kyPz4zAZn/lZdvqlF83jMgCWNxmqYjjWuadngCbk=",
+        "lastModified": 1788076475,
+        "narHash": "sha256-sD4UyILWAhk7aexE3YpDOdb71ZEeL+1/+LV05XIWCBo=",
         "owner": "kirelagin",
         "repo": "dns.nix",
-        "rev": "a97cf4156e9f044fe4bed5be531061000dfabb07",
+        "rev": "4710a34f2c36e7a0d634d7ba8fe2499d75f012a2",
         "type": "github"
       },
       "original": {
@@ -85,11 +85,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1781319724,
-        "narHash": "sha256-ZGuxexEMo4Xv28KJ0dX/m/PHN4oZIOnxHZpNTyrvx4M=",
+        "lastModified": 1787377438,
+        "narHash": "sha256-Sxu1NLTD/Ern6hFGLlZmtKCSct3YQXZI/lls8RE1XeM=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "8355f0a16b2dbb06a97959a918af5b239bbe05ae",
+        "rev": "65258d5c65a250189fde2e35f490d15e064c4c62",
         "type": "github"
       },
       "original": {
@@ -126,11 +126,11 @@
         "spectrum": "spectrum"
       },
       "locked": {
-        "lastModified": 1781389237,
-        "narHash": "sha256-Ne1/E5XNUq0gleaQz0vW5R4xf/0h/uEZ+bOW1aNjeQk=",
+        "lastModified": 1788263502,
+        "narHash": "sha256-gyVqW5U9wy6A8voJNu6SiSYTKDplo/MDl31x7FszWlk=",
         "owner": "astro",
         "repo": "microvm.nix",
-        "rev": "6ad601df0a07d9855c5e8f9b81135ecaf7c287eb",
+        "rev": "974d315e504e666eac4920d712e3ff6804dc1502",
         "type": "github"
       },
       "original": {
@@ -180,11 +180,11 @@
         "nixpkgs": "nixpkgs_2"
       },
       "locked": {
-        "lastModified": 1781622756,
-        "narHash": "sha256-JrPh4M6S7aPsEE9tOENuZrxC6o2szSLlK+t4+nLke9s=",
+        "lastModified": 1788335262,
+        "narHash": "sha256-3jBEq8avfzlrsY4UpW4d5TOmm7ocseZfnitEJhqauyc=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "08018c72174a4df5657f8d94178ac69fb9c243e5",
+        "rev": "44d95795ee2d475b3d687325e26dcf4ca9104557",
         "type": "github"
       },
       "original": {
@@ -212,11 +212,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1781577229,
-        "narHash": "sha256-lrp67w8AulE9Ks53n27I45ADSzbOCn4H+CNW1Ck8B+8=",
+        "lastModified": 1788179007,
+        "narHash": "sha256-hn1oU2rue2SYK8dAr8+WNZWtbsz1S2W5mnHlSEuh3bo=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "567a49d1913ce81ac6e9582e3553dd90a955875f",
+        "rev": "34ab99075ac4f7e40cf037eef32cb1c360bb85e9",
         "type": "github"
       },
       "original": {
@@ -241,11 +241,11 @@
     },
     "nixpkgs_3": {
       "locked": {
-        "lastModified": 1781216227,
-        "narHash": "sha256-9mUW6gNwoN2SWc/l0fW4svPNOulXLl8ijqKyeSOGgJE=",
+        "lastModified": 1788187754,
+        "narHash": "sha256-bu1QxmXKmPuvBLN7bHP355OV9Qo13x9WCiRDH62CqRM=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "a0374025a863d007d98e3297f6aa46cc3141c2f0",
+        "rev": "5dfba6236110080a54247d6460bc2ff5dda939cc",
         "type": "github"
       },
       "original": {
@@ -280,11 +280,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1780547341,
-        "narHash": "sha256-Gq8KNx5A7hBB3uGJaj6eQfLDIz5YdLu92gqBcvHvoUo=",
+        "lastModified": 1788337237,
+        "narHash": "sha256-gkSH8VUtCo6hnysNmb9DbTuDepH2t5pv+QWjP75xKAk=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "9ed65852b6257fbeae4355bc24ecfea307ca759a",
+        "rev": "fbf759290e0cb0a98dfc813a4eb7d53ad1dacb57",
         "type": "github"
       },
       "original": {
@@ -296,11 +296,11 @@
     "spectrum": {
       "flake": false,
       "locked": {
-        "lastModified": 1778940603,
-        "narHash": "sha256-voSM8dZNlaOWN3kbYFky+FNY6fFQOEw0xF+ZMpZKkCQ=",
+        "lastModified": 1785761586,
+        "narHash": "sha256-MWOMVqJJERwjQGgRIv8d6rlEBqbLM3VZWxHkNKIIZNw=",
         "ref": "refs/heads/main",
-        "rev": "367dd227f539267eae2b62770b4c17b88ac8c1f1",
-        "revCount": 1265,
+        "rev": "a7762d6f54b40560dd5255ce902e6e6a5d980fe9",
+        "revCount": 1416,
         "type": "git",
         "url": "https://spectrum-os.org/git/spectrum"
       },
@@ -469,11 +469,11 @@
         "utils": "utils_4"
       },
       "locked": {
-        "lastModified": 1768820076,
-        "narHash": "sha256-0vnIYuWvsYasbHZHUjAcK9FR0kxkRRtzYG661VEtoPU=",
+        "lastModified": 1789131197,
+        "narHash": "sha256-gpjhy2mIBt89oCVzoSXy8AgfAKjJ9Fi3u01CX09UTF4=",
         "ref": "refs/heads/master",
-        "rev": "cfdfae84bb045ae429f0760eba708468871b1738",
-        "revCount": 159,
+        "rev": "38bcceb0e8b84d6dcd50d05683c71eea8d410479",
+        "revCount": 161,
         "type": "git",
         "url": "https://git.dynamicdiscord.de/kalipso/zineshop"
       },

machines/.sops.yaml

@@ -16,6 +16,8 @@ keys:
   - &machine_nextcloud age1g084sl230x94mkd2wq92s03mw0e8mnpjdjfx9uzaxw6psm8neyzqqwpnqe
   - &machine_vaultwarden age1zs9puemeevc5kt84w9d2mc5396w0t9p60qxymkpatwvwxunzs5usmxr3an
   - &machine_pretalx age1y04q8n7mgk82c87rfddm0u72h0ny6sfzktjsk0cc3gu93kezudfqdp9v9g
+  - &machine_albert age1mfarz0n7qfa7vg8zz355qf8eregm6myl38lld0h767nuvhgjqd4qruxuhn
+  - &machine_ns1 age1mam7y7x4my6g8yt8leze3pvlq0fr48hdsqz62gs7l9rstf9hh3fs03xf7n
   #this dummy key is used for testing.
   - &machine_dummy age18jn5mrfs4gqrnv0e2sxsgh3kq4sgxx39hwr8z7mz9kt7wlgaasjqlr88ng
 creation_rules:
@@ -114,6 +116,22 @@ creation_rules:
       age:
       - *admin_atlan
       - *machine_pretalx
+  - path_regex: albert/secrets.yaml$
+    key_groups:
+    - pgp:
+      - *admin_kalipso
+      - *admin_kalipso_dsktp
+      age:
+      - *admin_atlan
+      - *machine_albert
+  - path_regex: ns1/secrets.yaml$
+    key_groups:
+    - pgp:
+      - *admin_kalipso
+      - *admin_kalipso_dsktp
+      age:
+      - *machine_ns1
+      - *admin_atlan
   - path_regex: .*/secrets/.*
     key_groups:
     - pgp:

machines/albert/configuration.nix

@@ -0,0 +1,96 @@
+{ inputs, config, ... }:
+let
+  sshKeys = import ../ssh_keys.nix;
+  peers = import ../modules/malobeo/peers.nix;
+  hosts = import ../hosts.nix {};
+in
+{
+  networking.hostName = "albert";
+  networking.nameservers = [
+    "192.168.1.1"
+    "1.1.1.1"
+  ];
+
+  sops.defaultSopsFile = ./secrets.yaml;
+  sops.secrets.wg_private = {};
+
+  imports =
+    [
+      inputs.malobeo.nixosModules.malobeo.vpn
+      inputs.malobeo.nixosModules.malobeo.initssh
+      inputs.malobeo.nixosModules.malobeo.disko
+      inputs.malobeo.nixosModules.malobeo.metrics
+      inputs.malobeo.nixosModules.malobeo.users
+      inputs.malobeo.nixosModules.malobeo.backup
+
+      #./hardware-configuration.nix
+      ../modules/sshd.nix
+      ../modules/minimal_tools.nix
+      ../modules/autoupdate.nix
+      ./hydra.nix
+      ./gitea_runner.nix
+    ];
+
+  virtualisation.vmVariantWithDisko = {
+    virtualisation = {
+      memorySize =  4096; 
+      cores = 3;
+    };
+  };
+
+  virtualisation.vmVariant.virtualisation.graphics = false;
+
+  malobeo.metrics = {
+    enable = true;
+    enablePromtail = true;
+    logNginx = true;
+    lokiHost = hosts.malobeo.hosts.overwatch.network.address;
+  };
+
+  malobeo.autoUpdate = {
+    enable = true;
+    url = "https://hydra.malobeo.org";
+    project = "malobeo";
+    jobset = "master";
+    cacheurl = "https://cache.malobeo.org";
+  };
+
+  malobeo.users = {
+    malobeo = false;
+    admin = true;
+    backup = true;
+  };
+
+  malobeo.disks = {
+    enable = true;
+    hostId = "a3c31011";
+    root = {
+      disk0 = "disk/by-id/nvme-WD_PC_SN740_SDDQNQD-512G-1001_22445F801371";
+    };
+  };
+
+  malobeo.initssh = {
+    enable = true;
+    authorizedKeys = sshKeys.admins;
+    ethernetDrivers = ["e1000e"];
+  };
+
+  services.malobeo.vpn = {
+    enable = true;
+    name = "albert";
+    privateKeyFile = config.sops.secrets.wg_private.path;
+  };
+
+  networking = {
+    firewall = {
+      allowedTCPPorts = [ 80 443 3000 5000];
+    };
+  };
+
+  nixpkgs.config.allowUnfree = true; 
+  boot.binfmt.emulatedSystems = [ "aarch64-linux" "i686-linux" ];
+  services.acpid.enable = true;
+  time.timeZone = "Europe/Berlin";
+  system.stateVersion = "26.05"; # Do.. Not.. Change..
+}
+

machines/albert/dummy.yaml

@@ -0,0 +1,67 @@
+wg_private: ENC[AES256_GCM,data:yHkjJjW/I/5mFJuMQR0XpoMqPDt9b/ZZRmLiqJjug31p5aV6AC7Pk7bhNN8=,iv:OjRVJCCO0WTUSd6w5oeZbEeilcffJQOOrudIkss9VaE=,tag:t5N0tNjrfM8/pKbJMMDEig==,type:str]
+gitea_token: ENC[AES256_GCM,data:+zHmfVfdheo4KzOBjDr8WNcJh78ReZ7CWiiG9fAcXpQw21yWb4/jq3RqqIenB2p1EEtF0OlSUr3lu478gEBmxlilBCpEaEzNJKfOFL77P66OYLo7RJkp3TE0sILDCaVwGDkCWQKd05zqJzbb5opHE5B0NUf9dOgs8CuYZPelrTzGsTfWjdZWxweSrOcFtsGLJcR0hLd9obAuqOxi2vID2YY/uIguGEhZYHshTlZSzMTg+8k2UCe/x+LOitCkLqFJfS5b+1HJpD6R1dKsVKtSjXtzLHzfIMy28xYvqgIju0JtUA==,iv:Kah6BYvKCe06/yHBICp2YOdJfSqktNrZl5kKYgs/AY0=,tag:3B+g6zqW7vcT1t/wfmYfUg==,type:str]
+cache_priv: ENC[AES256_GCM,data:CpxYGSSdSZoULqH/AJdaYWiuAgI8Spuf/lod8x5bFEnFB2KlRFp7vBjwwRzxykurbezP2/c938NL2WxI+sDw7UV6LAG+E5KmYxXQpOJZgIPx3YcEidyp5HWq628lf1k=,iv:t7BFA4IM6eFl+Uuq7k7OR26+wHVKbvWi+yV0xg2xFGs=,tag:9hpxyjEUnbOz1NFc2JctEA==,type:str]
+gitea_runner_token: ENC[AES256_GCM,data:wUHExAD2tf1bKc3W3GXHcPg6WS8OqQK7efcR4SBMSQnSIo/E32lo9w==,iv:P9JouWGa8c4NNTua2OhqJzjjj37mLmkYmJ+c4mogH20=,tag:dLR06+PBBl1SodaLH7ElqQ==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMRnE5OFQwdlV1bTJwdmZ0
+            Q2pLVGcyOXlILy9selVYeERGcFFyenRrcVRVClNaMWRPNllHS0ZEYlkvaUp2di9N
+            cDNuY2syKzZ5WTlKTndXQnMyQkp2RGsKLS0tIEVGYVcxUTU1NVhFZnBsR1Z3RDNH
+            RTJscHI0SmtUTzA3R3JkYTBZRUxlL3MKzEajq1IEBOjiF431vtkqnT3VWC2D+vGW
+            C5dTc/stQ0PXvfuTlRTKKTBlaSdnwBu/pKQ5/QtqwKee2Z3nxySziQ==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age18jn5mrfs4gqrnv0e2sxsgh3kq4sgxx39hwr8z7mz9kt7wlgaasjqlr88ng
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGaVNOSHZvSmJ0ZFhSVVhs
+            Z3ZvTU9jRytLaUJwd3VCZ0NJb3NGRzE1MVFvCnRYaTI2MHJRZnhhZjBmZkdqMTQ3
+            Rkh2WDVoUHZCY0Z2YlFlakVKTzUxUm8KLS0tIENjVXlxcWRjRXVjVFBNMVJSeTNs
+            YXU5TEpNeE9oMTZpbW10ekU3Z09EbEEKYr5TMIs9KmrHZqhhc6GZx6tM78XOXYAq
+            PffqNVDxsFbxAUK7dd5WPw++dE4W1gwRxI+sSPQ2H8ZvjqB8ff3TYw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
+    lastmodified: "2026-09-11T11:23:55Z"
+    mac: ENC[AES256_GCM,data:swEaZC/CLOdrjDSEYsaWBnl7cew01eUraa4ORkJljlqKusr0BdYFozjR3Rxc66JWRChc4bP0ckeDhU6AOiXk4k4zL8CJ3S4eY3111z36xjZXY9LXxMVn0oTx+3SrD6pOttTxZUkcdogRsi/jOsMPoTgSQN5OwvV8RTLF5waxU4I=,iv:ISZk4qsmmy4RYy1cxjpE/vbcCp6UoArtOqzd1ePYL0c=,tag:N68qZyHsiOFkfNM7e+t2zQ==,type:str]
+    pgp:
+        - created_at: "2026-09-11T11:23:21Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQGMA5HdvEwzh/H7AQv8D1hDUkuvip430Qe/djdEP6N26XQkqcZVfuzdhgQOwdTC
+            N1ou9MPJ0D0gIk72uYExHGDTwhvOEBTMuDk+te9foffcj6MHzUUpqI+TKsjV/PeY
+            Xpj9YGNjmGI7hz0ERyALMDpfFbkLPIDP3LwbxM+UFpe0weGoxfROVFWlFnXi6Rrg
+            MoFgDOUD9Ku7v9dkMkMcmoZULAozf5fcVMFe1mpByEh9LuATQRkuAO7Uf6nH46Qa
+            n7rMm04CNdBtmVSEPsU3CZ4C9+kyOzH1xwynb6MVDnY3j6sUGr3Seu7nCfMPDjmU
+            l2wcv4THJbUU+0gM9+Y3zSZlRYa0xe05D8CfpASnZ4FamFZOwuAJAgiKc8y3DEp6
+            kQMK76ncZQLhOIS//1tXkD3iIeLgr6D7VCjP23IaOV/7cakmqL7mbCdA6es9tXBm
+            7Hy0p7xkSVpJrxiV3NbiN84MILxpJey/usq9VEBUf3oRtVBHt3uxVnL33Txc7PRg
+            JimkwsrGi9JV1YiF3Y1Q0lgBxOYufbPdYJ9n5Ki/unD1AJI/WBm/ii2Kt5RY0L2X
+            JY3AguNG29wBBWJg4hyCq7fisI88TBJh6syUb91UHHMloOVe1Pk3Bb7oMWMgLl0g
+            YLU07kt67eaX
+            =xifQ
+            -----END PGP MESSAGE-----
+          fp: c4639370c41133a738f643a591ddbc4c3387f1fb
+        - created_at: "2026-09-11T11:23:21Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA98TrrsQEbXUARAApu96xR6Fy6Y0dAHzM9CjnFuSFLlUbU0yRWksHCFoo6XS
+            acRWL0pVlwCWt3sR+tjpd1tEvQZFspqq+UhDLlaz+qS2dpI0IkjNEbD/0uTTcqkn
+            0wlKcvDdRGv5Mb2wjFp5Q0VBIDC2nRbK579IghaEIoRRN9j2VfksracmfrvEpuuL
+            5rF4Uvpzc5VLQyf9hy53j9MXuiTfWv4xEPC3zfcbxeOKaXPKEVkc0e8QyNPes3Q2
+            AefQBd+QRBSCDc9P6V5Xb2r+K52k6zWxpoeR1oyJbAv5c4NKWtKtdackIyPoLF4N
+            9TtcidG2OTtuIqIAmSix23KVBgJB0nESSuUhy4f0YUUnGNWpu4TDGzB9BNmiob9K
+            0fO/awGV87kYKPcjdj/XLgVB+zZ/5T7b3dL6tl4lpwMf69qzq0Io/CffnYpTItGJ
+            A/3G0rokjmicGSme5nNkZKXXwxNidaxvSOLXd+yAmInMcXacvO2WuA1CmCnU4Px/
+            igA19i1GDc9OS1qGhIdrG14iUf1820DACdsPlg3jFEys7dpkGDIOiMAqo66OhX9Q
+            gYN4Dz2PaPSrTJl0rkBds1qiGI4TN6AKQlLlwkowx465lX8UsjvaYT4z7d2JWYN2
+            VHMaeEBZvO688oFYA/wn/b+OHUkRIkL1oIeU2G5Pw9m5wQbgd8DMgvYZKe3rzrbS
+            WAGKWwzwHc4BjBzL1PxcwMchMfiZJ0Ltel5dcXHkHi7VV+O7dIQiseZwfHBbGyIa
+            uXogIDlqULSiRxw9oht3hVDS90uW2riMEoDcr47hh1oFaGBHoY7/kf8=
+            =+ckT
+            -----END PGP MESSAGE-----
+          fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4
+    unencrypted_suffix: _unencrypted
+    version: 3.13.1

machines/albert/gitea_runner.nix

@@ -0,0 +1,31 @@
+{ config, lib, pkgs, ... }:
+
+let
+  mkRunner = runnerName: {
+    enable = true;
+    name = runnerName;
+    url = "https://git.dynamicdiscord.de/";
+    tokenFile = config.sops.secrets.gitea_runner_token.path;
+    labels = [
+      "ubuntu-latest:docker://node:latest"
+    ];
+
+    settings = {
+      runner = {
+        devices = [ "/dev/kvm" ];
+      };
+    };
+  };
+in
+{
+  sops.secrets.gitea_runner_token = {};
+
+  virtualisation.docker.enable = true;
+  users.users.admin.extraGroups = [ "docker" ];
+
+  services.gitea-actions-runner.instances = {
+    albert01 = mkRunner "albert01";
+    albert02 = mkRunner "albert02";
+  };
+}
+

machines/albert/hydra.nix

@@ -0,0 +1,109 @@
+{ config, pkgs, inputs, ... }:
+
+{
+  sops.secrets.cache_priv = {};
+  sops.secrets.gitea_token = {
+    owner = "hydra";
+    group = "hydra";
+    mode = "0440";
+  };
+
+  services.postfix = {
+    enable = true;
+    setSendmail = true;
+  };
+
+  imports =
+    [
+      inputs.malobeo.nixosModules.malobeo.gitea-translator
+    ];
+
+  services.malobeo.gitea-translator = {
+    enable = true;
+  };
+
+  services.hydra = {
+    enable = true;
+    hydraURL = "https://hydra.malobeo.org";
+    useSubstitutes = true;
+    notificationSender = "hydra@localhost";
+
+    extraConfig = ''
+      store_uri = file:///var/lib/hydra/cache?secret-key=/etc/nix/albert/secret
+      binary_cache_secret_key_file = /etc/nix/albert/secret
+      binary_cache_dir = /var/lib/hydra/cache
+      Include ${config.sops.secrets.gitea_token.path}
+      using_frontend_proxy 1
+      base_uri hydra.malobeo.org
+      <hydra_notify>
+        <prometheus>
+          listen_address = 0.0.0.0
+          port = 9199
+        </prometheus>
+      </hydra_notify>
+      queue_runner_metrics_address = 0.0.0.0:9198
+    '';
+  };
+  networking.firewall.allowedTCPPorts = [ 9199 9198 ];
+  
+  systemd.services.hydra-manual-setup = {
+    description = "Create Admin User for Hydra";
+    serviceConfig.Type = "oneshot";
+    serviceConfig.RemainAfterExit = true;
+    wantedBy = [ "multi-user.target" ];
+    requires = [ "hydra-init.service" ];
+    after = [ "hydra-init.service" ];
+    environment = builtins.removeAttrs (config.systemd.services.hydra-init.environment) ["PATH"];
+    script = ''
+      if [ ! -e ~hydra/.setup-is-complete ]; then
+        # create signing keys
+        /run/current-system/sw/bin/install -d -m 551 /etc/nix/albert
+        /run/current-system/sw/bin/nix-store --generate-binary-cache-key albert /etc/nix/albert/secret /etc/nix/albert/public
+        /run/current-system/sw/bin/chown -R hydra:hydra /etc/nix/albert
+        /run/current-system/sw/bin/chmod 440 /etc/nix/albert/secret
+        /run/current-system/sw/bin/chmod 444 /etc/nix/albert/public
+        # create cache
+        /run/current-system/sw/bin/install -d -m 755 /var/lib/hydra/cache
+        /run/current-system/sw/bin/chown -R hydra-queue-runner:hydra /var/lib/hydra/cache
+        # done
+        touch ~hydra/.setup-is-complete
+      fi
+    '';
+  };
+
+  nix.gc = {
+    automatic = true;
+    dates = "15 3 * * *"; # [1]
+  };
+
+
+  nix.settings.trusted-users = ["hydra" "hydra-evaluator" "hydra-queue-runner"];
+  nix.settings.auto-optimise-store = true;
+
+  services.nix-serve = {
+    enable = true;
+    secretKeyFile = config.sops.secrets.cache_priv.path;
+  };
+
+  nix.buildMachines = [
+    {
+      hostName = "localhost";
+      systems = [ "x86_64-linux" "i686-linux" "aarch64-linux" ];
+      protocol = null;
+      maxJobs = 6;
+      supportedFeatures = ["kvm" "nixos-test" "big-parallel" "benchmark"];
+    }
+  ];
+
+  nix.settings.allowed-uris = [
+    "github:"
+    "git+https://github.com/"
+    "git+ssh://github.com/"
+    "https://github.com/nixos/nixpkgs"
+
+    "git+https://git.dynamicdiscord.de/"
+    "git+ssh://git.dynamicdiscord.de/"
+    "https://git.dynamicdiscord.de"
+  ];
+}
+

machines/albert/secrets.yaml

@@ -0,0 +1,67 @@
+wg_private: ENC[AES256_GCM,data:rSENHGEat9wre1bFcM3LYnlGjf9gmcE9FmeCySzbGZ4SCCUl5QLQN/quXw0=,iv:Bdwlk5UHSiyA9gSW91LUPJyBG50FG/hpwyClzTOUoUI=,tag:/Jw549R5Qmg4WblL7rUE8w==,type:str]
+gitea_token: ENC[AES256_GCM,data:1LevtPr5awIu2rcCGbLIsQA5QO0AhFk5Rep7RG28QdlFHDADCaEoS18pEEZ9NMYMZaGWIBA8Zq/NsCYxQGzuWh3TESZW7CO5kzCaSVG1aqjGpjfbeyG+xQEDtab2Owh+TVN/wVGUUDR1NBlWqE4Shw7mO228CWbxQRSQo3lsLhmf69fLEV1DDnH0Xt7Ml8tr7yLIeWHlG0BeOMKSkY17APahxqBx547Zw+kgaUW3WgTyxeWZaDjk/prK6bYV2euK4Il/4vTZE/x0mThmTThjszcAvdaon+V8y1Ax34gTyAgjvpFC2kE=,iv:1A8YNv/A0MEkGKV5Z9WPI4LwQFu2Z9BWuN2yfFHCPLI=,tag:hEfskDEAQiriXNjcYzziSg==,type:str]
+cache_priv: ENC[AES256_GCM,data:NbfyBv68UCWuSjbUu5lFUXPgG+vYrxbAQeD77YlklTRm6MVS4lAEjUzjnjewcX6Khca1N7r7vGieFyaBlQm0264KGTP5tc7BnEIKJDOD/UHQBdMpZgUzd2cKQWK7Kx0=,iv:6VWsZd/VDjQ/BhfwHZBcL3Zp0W/9sO/ZC9sF1Jnqguo=,tag:/gSe6TyaZDKoRFaRKiYyzw==,type:str]
+gitea_runner_token: ENC[AES256_GCM,data:7pVUx9TI/WbCWg2aI/k/fngtWZtffUCMsRfyJn2AQW6VOXknWMeXIKc07MDnbjjc,iv:isSUZ1yq3j/gIzqoCLGpmPIay5L5gYkOBW08K1rGvuA=,tag:uOkrUB6If/gQ5680A0VTxQ==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoM3lEUnJiamMyVzY0dHE5
+            YUE3KzA5ay95b2RRSTVIYUdyd1djNmIxMDFBCjFWN29TZDI2QnJramR4TmhOL3Ex
+            T0RISkMxM2IvUnRXTnkvUjJmSWNRTlkKLS0tIG4yaTlhTlhjVXZLODJUa0hwaGRD
+            bzlyNDJoRzBBMnViT0hmdWlDNk5DVjAK/u3XH8+MbjmaM3n46CGGjXFfY2aZkBNx
+            EDTiUmR3FJSHEcWBhICEevrAnDJgTRgiei187/sSjehIgv5ZngeupA==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqRUcxaGszajdlVm9VWSsw
+            QWxTbEYyVzlxRm1NbnJ3Ly8yeW12S1NUUnlVClk5TjZvMW1zWHY3OGdjQkdoMGNT
+            L0JUdlhYTGZBZ3ZEOGhuN2FzSUNMZFUKLS0tIEhCVlFBcFhvYkw1RVlOQ29NSkJL
+            VGNyL0pmQlJOMnZ5YmhHem15YzlXWDAKBgcH7kd5uBWVQ1gHeR5CYZVP8IG4s1HG
+            N6DSIVisJf7qNuNw6M0J5nny6xfWeIEZJettF0xSHM1gSfr7oUbHOQ==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1mfarz0n7qfa7vg8zz355qf8eregm6myl38lld0h767nuvhgjqd4qruxuhn
+    lastmodified: "2026-09-11T18:12:32Z"
+    mac: ENC[AES256_GCM,data:4uH4hVrc3ISolaYHZb0NK65Rx6wQf+P6bpbcYCPHbn3N9vkbkqBSKePsxGgKaNQQhAHwkLMdxRIcwtERjMsAngL5IZrO3riI91MZxRoFadbklJbJ4HSpQ240PT5vrpkpVb68KqCeVdoKRcR2MqH30H8UDCCvpZhdSNSl8ceQCss=,iv:5FnwnOb1dBSRCs4/5WONIYPji/+2WVtgFboTfybGZ/U=,tag:QWKWjN8ljeloS7UJM4LiKg==,type:str]
+    pgp:
+        - created_at: "2026-08-20T15:43:21Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQGMA5HdvEwzh/H7AQwAi5C90LmuQOdXWpDxD4KE00yADfcbJH1no2ZFoC+w7AaN
+            tgVWX5IR0f0wM9eBL3CimMMwxtZLOTLWdJVQ/55XYqZDQmWzdhjSHIH+STSz8W3k
+            i0j3ufrr4rImqw5PGpiHdTVMq5Ffv0LwnwBGDdca+5YrH0qn9LrPJNj3pkMT2mDp
+            pwcCcoXsxucdBtpYhfgTbuHNQgyndVTgWpduIuaRVp3s7ISM3+9pozmzmtm+Q7cZ
+            ppPIHdTtPp595KC6DEhYP1WF32LTs6uuDuatip0Tz6+XAFJdOuFnGwcIpwtcK6iz
+            UnluXNArw8eBiaKFmSURkOcq9cjkscxdvgQXbSl1fTglEz5gjGdkc/XZIc/4gDP/
+            foa5Bxjp56+uF6qFd/RuUMmf9iu4I5qM+9WbU+iF9dZXtiaoABrFWbRpxYr/qX5c
+            J0lIF+Xtgz7AF5FUJox2G1Jlbf+xY1LbrVrvH1R+mrb8mbASi50X2LUzrl7Hgslv
+            NB9F1o4I7DJWewRC9eCB0lgBzkncGtgA5cjay7/kwejPr+TYGYFjDMl/7SNBSerw
+            jnto+uSFfsdiGb4WOeYZZBxAN+ALVxv4agK9mKoNJ/wKWsIz1udtENtECk/vS4AX
+            Ey+OfiJ8j3WJ
+            =09pj
+            -----END PGP MESSAGE-----
+          fp: c4639370c41133a738f643a591ddbc4c3387f1fb
+        - created_at: "2026-08-20T15:43:21Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQILA98TrrsQEbXUAQ/4+e8U4pIRBLMJSe2ryIiV1sTDC/OJUstfpn3dAesJrVVl
+            WtuOl/dwkLM6e6yFAJgd+F7rv8xDAka+99trkik6wG4POoXY5xkPjalJDmOFMesA
+            HD65LUFhChXyj5pPMyd5Far/Dv7an5/OPlfY2eWrMX+gep8jEIJgbnvPPyCI3wjf
+            7Uc6DZH0ctWuG/fnXjLBPB8lrqYLdjsLT68dCyDRVrWyhJUN1/u8oKRwoXR2vqi2
+            p+ubaGjc0IkVPHSFBiskN6cPp8fLC08qtlGHCJoSO1EZFms7KkdC/7a0pwNGIAji
+            1/Xjs9iU1iN52ATlxf+iSXqtbjd9i8Ye5wugne6Raerwc/vxQzpi/0yuKFRmvYGW
+            YrjKQHMoMxvlAqbkLbFeGfcgwm/n00twH9h1oeskAwwjYUnnwuDqvwqndqzIAFUK
+            6gFiRtxLZ1AVOEPfAVkzxznm+ZNvSbk/A8hENuWzZfGYmoTrQAHvCrMFr03EcvMM
+            Z+L8vX647E/4+Eh87CqZ03VQXZq9H8lMz+1ToQdwpurwnOpc9tMT1UcDh5FxkugW
+            3A2oomRByHoJw+51i6wujJZ3Rkx/H0SYXswCTsUHX6JOOrRWfNgUFnI2MeVDu0Tg
+            L7hmNQyKW2Ncf+EqT5i5dlucR85SLZ0IE6QJMAjzyuOcQBpSPW1/1U7XUtJDOdJY
+            AWto/wuOyoZml3GK1+pGfraL5JMYvhSu4jdmlTPAQibdVeS+nLBPVx/Wd+R6Lerv
+            QkWv772a1ho98j1LwWCu+mM18dveIElI6HZyIv4RE8YBbErKpL1pBQ==
+            =ciwJ
+            -----END PGP MESSAGE-----
+          fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4
+    unencrypted_suffix: _unencrypted
+    version: 3.13.1

machines/albert/secrets/disk.key

@@ -0,0 +1,26 @@
+{
+	"data": "ENC[AES256_GCM,data:tLzYReb0okzTrfWMYBRgXr7MA+4=,iv:q/OZYLPA9sJ5sdlXLF5dJpd+E++OK81GyRWZlbNG8iU=,tag:mJgFIVEKBHjD0Ga9af5Egg==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2TUl5NTZHTDF4NklpbThn\nSkdJeFlodEx2OXFZRURSUDhGSDFzaHBqMWhjCmQzYUV5VWRPdVErdkxvcnkySERN\nVklUQU5MWVBDeDNvOElXZFhaRmdQUEkKLS0tIGtBUjZRWFgrZHZRTWJEb0JKKzc5\nWTJhMitWeWJ6d0xxZEZYSW8vdDdJUmMKCu4uPNOWlqGPV7rftZDnQRq3o2ZdKK4I\noqOnnCdT6Gg3Xuo/gs4steg/mgqNijRTd1Y8ZJUIkpYM1KNw6xVpJg==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c"
+			}
+		],
+		"lastmodified": "2026-08-20T15:24:41Z",
+		"mac": "ENC[AES256_GCM,data:+oWxWUPWo14zvhnupIlRFiBNVT3BjPIXjmsXYA8KCMARYtxWntr2hf4Ly1Flx2EZRM4dgvVtZAFeYwqFTD7RafNGHr+2SulOxAyYHYk+ld7IWdt/izi5eLV2AVZig+1o/B5+G1XTdDWRnKtp6+oCFw8PGNoohtS86eMR522zIKY=,iv:Zbvm86kzRh+4TsB5wWSZwqq++Sl1X99wkpcYnAGYo10=,tag:nEV1mn9atTG9HcOvJztEvw==,type:str]",
+		"pgp": [
+			{
+				"created_at": "2026-08-20T15:24:41Z",
+				"enc": "-----BEGIN PGP MESSAGE-----\n\nhQGMA5HdvEwzh/H7AQv+Prou85l0Vr0T/btpsk7dbr5CbIaiNUKcg3l4jiz+WTUr\np8az7LL9RxxMScqOiGiPOtl1hbfygLOUOebt3FkhGf9JChYCZ8MMGArzdO6KMsQg\na+BsfAgOKIq+AEVd5GX/a5mspl8zU3rG3QQgKDEpyxIa89ZK4mI974s94Xv8MD/4\nZGyCWgL+RFxQ6Ad/XSQU2+4wUBugBSKh0X+ETagmAZAqApdfZ0uYGNRD5bngVk1X\nYTDx2+uZ6vYFqNfqapKuG1hVZvsiU13tC3IQ8Swrg5rNwzS3OT9qQYoeSBCWYg1a\ndJLKaSfYqCYNbdKI8tYx3oeWeeQa9CgB2iCCGI6vGyyBdVI0NrWf/Vyghw1fQgmD\nJGEVsBcp4U0LQDL8znGj1ohL//cJug7SPWVBZYMUKecN6Ho6ILoHwoqiXrMPPE0/\nm1hTmP4kTtuUEnngnoBnFnCt19Ma+qBBc7ydkj7MILdczaZt7TpePUlGmQgQdB9U\n2p4acI0QQGEhp3jCzdt70lgBDDl6Jzf18HqOaREnRfeiedujQrd08ITqQZE/s4Gc\nIgu7zzG2DKr4VljPQbxof5E95SNW/+wsvxxu0Wbo/cpAjA7I2u8qyVA/QnvmMXHn\nKx8GMhIdmbUT\n=O/hu\n-----END PGP MESSAGE-----",
+				"fp": "c4639370c41133a738f643a591ddbc4c3387f1fb"
+			},
+			{
+				"created_at": "2026-08-20T15:24:41Z",
+				"enc": "-----BEGIN PGP MESSAGE-----\n\nhQIMA98TrrsQEbXUAQ/+PBo3H+FNYZ275YMIEZxsbeKY48eP4ZZRopZDrmKsgEYT\nI889inzKVoCBADYNnwheCDAo7gcnxRIGxNaL8ftu0gqu7M0OLtK/LJvmpan5RBYq\ncW5ou0mL0vObWqbGUlrGjaQoETFgy5oEfqhXGtpEccyqMcd89b9tciS9BfeKVusA\nBRE/d5vElDtkHsU4wSCPAhj4D3GlHn9AvdexCNt1J09tJWuti8OWYq1yrts5fUiM\nTCi3/gxEZLrbPa5Gu31VIs+FfO8nMPecjEsmszKqns/J0RNHrGrpLLiYFhL5Yaj0\nxaySk7LRDWB8sPRqp+dCEE24Tht0iOnQ29CU5UeKj7LRGPd4xYHVx8Tmdi4V0hBL\noTkpYt+kU2VvA5LJI+skx7akM2uNGvLRtaurj3In6JFv5Z2Y4ELrjVPF+TPSBieV\nn31ToI+F5STUaWb5j9Hk/Ch4L1UpM3OD6f5qZJ9EFAvrHLMWuAa2YSZkBLJ6c0eI\nVp4Rn8gd2E6jXGsBxR/c4VAZ/1gF9A4LMWAOrPkYzWZIHC9I+mc7OPT9nz4tW7xC\nf4czBHdLIEOCe0JgYsUIzr5PaWOBD7u/FH971qEEMKqYuGYuzv54V7L5lzprcgcQ\nRh4wbs6obg4Luh2/fUl4I+Xv4a8vuG8a8GdA5Kcf5ai8O3SsMeZUcc8CeIotZOLS\nWAF+3h7HQCyBf0qAKeHC51lUtJLUGYwMIIPMlZZkyjmRMfz0sm8HiKfAQycd4n4D\nK33Cjinqky3mPmv0c4NrK40r7wCdrrN5kCVJZK574vw47++s4zhVVww=\n=zDIP\n-----END PGP MESSAGE-----",
+				"fp": "aef8d6c7e4761fc297cda833df13aebb1011b5d4"
+			}
+		],
+		"version": "3.13.1"
+	}
+}

machines/albert/secrets/initrd_ed25519_key

@@ -0,0 +1,26 @@
+{
+	"data": "ENC[AES256_GCM,data:hb56sZ8AYq+BBXE1igSFFDaWS04C5zp9Ieay60cKIRsZ2KZ/UC0Zw9vgNhugp1EUFt5oFzdNILWy+OHuK7/dtUV8IlpCyiyuOROggw704aMs1+h1SvfyxuzWVxHLxFgYX0QSCa01Jdvf8X+Md/zW7iNYWmUMr88ZvMXieU3rCI3NV+IKdCvHycW0uTyn2NdllD/wvnsRdvmxY5cjT5226YnlvroePO6rI6TkcGHy61WnrGSL8rU1FdxSEVO8RfIxd+lueQqrerNMyP/i+Dt+fyUXkazwItoWIXy3CYceI8nvxrq6YO0CGMF9NVWcjrmEFJKgZGzbFiIe7X28paHEn+lwc0RfrPgMyOqSVfvSzjBDUkvZ3dMASc9fEp7i4XT8J1W6Qh1XkmK1HKCzKlC0eOGYw89i8rP4vymhJNqArIreIG1LyYEVlXCOac2fuQ382izp2+tbKq77gnIpesqaDsob95dnONRJb8ZBePSiAxLSa+JBkQnLTArg0VaSKz9rK+ighFDTiq2FGDV/w6KG,iv:nyjIr1RjVkgnNDeP/HegpVh6yXBMferHC/qM9NiOcGw=,tag:PajjQ1c5KnwXF/3j1r8Dtg==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBK2R5d2tYTWo1MTNkS2ds\ndkZnZm1lVlpZN3UzOWsxMFFOYkd0Ykl4b0VJCkFVLzZocWVmVjF6SEJHZ3FOdmIw\nQnQ5RFM5T3praVhLbVUzakRsbnlncUkKLS0tIElWTFZ0RGdYN0tiUEdrR1ZERjVL\nSXFSMkY0eHFYa1lQK2NTZElxL1diYnMKn0WvatDVmpQHUoxXMw9tlLU/xv+A9Oue\nEctWF6gqBHIUr5YMNd1/Clb6y5nv15ID29uKY9KUPOrkvJiCITIn8g==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c"
+			}
+		],
+		"lastmodified": "2026-08-20T15:24:41Z",
+		"mac": "ENC[AES256_GCM,data:uxXGCKk4Dq7awNtok5bwudJqgPzYDhlmvV1RfwMQCC2X8DI9JAdN44lwuVadm2qRdcqqF1JnEotb7wWuQXQ2Ifg60aMiEGuvSjAFBqrhsGy4ZzoDsSPCatPLTf94JWXHfnB1n/BKKVrlBEn3pY42w6m9kYBKSmSo4FBOyQHJJmk=,iv:Wg3FIOTczCoNv0zoGHGJEuJbJFA1nM8nSSimUmLm24w=,tag:cNxZg1qU5ge1miHQMXE2Fw==,type:str]",
+		"pgp": [
+			{
+				"created_at": "2026-08-20T15:24:40Z",
+				"enc": "-----BEGIN PGP MESSAGE-----\n\nhQGMA5HdvEwzh/H7AQwAlzMuEl+LEktZCdo7nw5+i0MBuWhi5N74OaaXOPMgtWck\n5DfUp77lKwUlVD/wWwSQZcKSxKUYuVMwN9xpxKbhidbUEsOfylyrBEbJvJg/2Dxy\ncVcEBu7W3cqAHNm8jAz2uSpc0v4a6XcQZXOOAcY4ZVp+Jrjv404U/ylNguE5FO1+\nTbHd0fpXlJ/EIkV2+OB34KEjqMhqE3BViO2hNNqTItadvzECBHwDHfxdNR4HCW2W\noL0ofnGXOkf008RLcC2xGjiIP1aCdux5Rj5kTVLnAiuWuyLwieDmCQdPlnCg1Hz7\ncRYDoSq/KP4a3Td8olfyPYoBdjU0JTgdaG4mrK80w7RoFruz9s+MvIuEh0mTWlv8\nk3hQynCJINpXUSgeJsQJ9mHVr6sADHvD/XknJ7DghAE3SDQnEw7S8+W7TuZRL4YE\nsuxU+gxj0TyXL05dbDo3V0wrtC4DjcnVqwQ1DYXYtSTyPYzxbiwsHxksKXWmriuG\nBQXPP1EFBx90cvjqUHMO0lgBm9X/loNgE8ouu/nPf7vfS3CXTqVENiurUgcLLjZZ\nBA9CQxCqIm1hgbGqyjXqlkSdNrZiEE6YemhcTcD8VaXZdEe9po52cPuNF4j1uyE1\nsRTfjY7Q9lRW\n=qFFI\n-----END PGP MESSAGE-----",
+				"fp": "c4639370c41133a738f643a591ddbc4c3387f1fb"
+			},
+			{
+				"created_at": "2026-08-20T15:24:40Z",
+				"enc": "-----BEGIN PGP MESSAGE-----\n\nhQIMA98TrrsQEbXUAQ//erdf1kP6oiR0tdJmUCuFJ7y/jbdt+jJPJ2i6cAj6Vwe7\n6OvxzNVEUgVRJN0Owm8/9sHZJajZd92AbHsfcGqDDhutzUSweQ7PUcSvYcyMGey1\nggMuUNFlhoXWcxn3kSCVWqg1aJ0CGxqtyW1y4222zZpaSRdNRK0a8svo4yj7xJPe\njTiJl3H2OVx73uAUW1onbuoG8SAbQi51LiGWB+v4eoHoFZgH6C+pjLE4F9lEjskz\n5EZXvIW3EVMs0tQVtV6S0yBf6tRRI0KM9BYMXNSvApE2RQI3/zJrJvdkCl9ttN7C\nmqDMTLAqG685yaERBKPVyDTkixnt0dNtzhl1wjFoBOiQuvIPBGlmJO+03YxYoa5q\nDwFRvAaRDYAeh94ZAeIubgdA8B1xLdnpx3Ox56q1GSJU1gv1SE9WhE+woFul4VlY\nro+mOJzfjlHFKzMc4D1VwPEs0b1MYKurktXaBaXX9WHjejc8rK1wHMTadlvJ7xLG\nUjeeLCeytQzMjuTkHPMswkARj13iK5HgSz7GAUeefeauMyOOn3V6RtrpvrrD0ASv\nm8nBC8hIiNEKJIk2M47N6l/oRr1OOvuB8QmuPzDTuXc51Srgc8v/2ayIkoNmY93T\nnNoNZEnxiEqgHqeIenhHhe0VwHgXdLVOhEFR1sBDDFh2W6yjtdMSRXHjVB9Y80HS\nWAGkn8q+4fSx47xZTSfOoS0tagYQkN1MLykFnR0S6IgjLSIXF2TtORNCs6tqMgSK\nWZAJhO84PKTFeEh+Hwo88wUil31V02VEjnuAe2rhigvn9sTE7Pr2Znc=\n=nnbP\n-----END PGP MESSAGE-----",
+				"fp": "aef8d6c7e4761fc297cda833df13aebb1011b5d4"
+			}
+		],
+		"version": "3.13.1"
+	}
+}

machines/albert/secrets/initrd_ed25519_key.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICPedKJa0L4v+35m+YK1CN4QRoXaF7oMOg74LiPnYgBj root@-initrd

machines/albert/secrets/ssh_host_ed25519_key

@@ -0,0 +1,26 @@
+{
+	"data": "ENC[AES256_GCM,data:B+2jQsx0tLwTbNwvXQxdR6gNNYgTeTXCiaSwWwaM2eJjmX40em6ekvf8lL8biAuyTgM5tp3n3mYmEJsk8P1EWgBlS2xmUAk6CLMXFs9oozGFbBcrQU74ffE4PgZoWJQnBt7vVB6ZHaCqFq09bbbUI/avqDCD402vXv4pUc7sL8cj6J1KSkjjAO2uJle3UcqcINYOQscSGGflN0HCJfAgQGco/61bKysUrfB6QRaayODfLrm3GLIwWfM9gk3wpLcdb3OtbPFTz9j/w2LLbu6P/ZGKU92O2CGcAG7tbHv4f5w3eDAY392nC/CA7GYcEvolMfrzP3zC1N/UXL6ImkLovKczBdJ3gPZUZikonPip58ZJIWIIgbINxrAv+S5ZWNL0VgITcXmi+IWoCQsGAWsrNeikMIAgqiFQcLInHMfPvb8S3BcZtoGBYq6zBKl0TU2zSWmcSDNMv+Lu+CBnYX31EYRC61MaIaJAtyc3okIdDGnR3a5bexSlIO1cT3sCYxrQTr/2,iv:mbpzAzdXJTkR5AUW4ByWuWrebRGcWO/D4RnyzIzIuQ0=,tag:/Ym4cCdykKhQRzZGEnW/FA==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZbnpISDBPaFFjQ0x0a0h4\nMldJbGlUUlpGZXNqcHZJcVFRUWE0YUo1eXpBCjFYcWhYVzM1TkxiTThuUmh1V2FI\nYVNlcC9YQm5oSTBhREF0YWM3aXkzMXcKLS0tIENYa2tlQy9kWUE4TFVvOGN6YUtl\nM1FLR3JFWGYzenpXMEFFdlZ4K1lWY1UK4ObhtwwiKDavy4960HavpMoPUIAvwyok\nBiiPXqW8VQRgYlaAn5mcufWnfnsl4kRAC2eSZo9Q381ACC65nVBNJA==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c"
+			}
+		],
+		"lastmodified": "2026-08-20T15:24:40Z",
+		"mac": "ENC[AES256_GCM,data:oV54qtArlFEaKGwlhTeMWKJJs9eiWoYda5Jyg/QzRYEP2sT7DmzdjcBKFtATRl8twHzbXqBj7jlXFZKcqSIaWxd/yMoDZbNiepul4CSdCSEgtzTH2lEkvVmpk3qTnPtIuPGQkXXuykz4auuPYlvEO1cPQh6mcz+BWzqFb1c6Fv0=,iv:X6WJO/tNVp+wtG2wfTw+kKnJRr8lzNZdzzAy+gVfdMA=,tag:XRz8/Xk3DaX4hILSFUzDQA==,type:str]",
+		"pgp": [
+			{
+				"created_at": "2026-08-20T15:24:40Z",
+				"enc": "-----BEGIN PGP MESSAGE-----\n\nhQGMA5HdvEwzh/H7AQwAoG8X9k+oTUtWVqV13RiurT0MYkTm8Sv7YEKzUTlnloES\nuXghxmaZM6HIg97WDATGv63RGHj4kguww1uyMjC03sQ2kqlLDLOvPz0p2EA5AZja\nQhW+QbcsCXuXDjmCMytrEW4HXXBKySrdVcqpf6yJr66jpxbUhj54fQoRPr4FTrm2\nLxSoFjZ+G1ZZOfV1vvp9duqXvV7PsR0hiIhAX/AS6MgSXAAtfXc++Xwl4w3/ZeQB\nI4Vn+4hJ3HqvDLQcGC8jTPCUxIoeb3HTlPcuWxLu20PGd33GMwvUOBXhXtKNdeSB\nddxNgN1nTVDJmDDgbKKB3MFB+GaIjtOYm19wUxh2rNyrGEVzmj6Reyf0e/sjJph+\nR1hlmHZklp+/42vnTWuTittIQIl9cjLTnpTMwkpO/StjcpTss1pMbIMM7uZpMPub\npUDodBdw/oCTWlaogj+9EAPfItQN1+T2wcGsCfgQOLv49mHyVN/gUsGDqIn8pv9W\nDzS8Tkyjb6qemBNsbMXy0lYByNYG40ROaYZoBcdygvFtudZlWPwF3Ka9FnWnxiZ5\n7b9XHoK9mPC1JfGaDkJvbsHHf+oxXuqhW+ue/jDlYQmDdaUeROITV7XmFC30zFuY\n4rF1UgVWEw==\n=vQ0V\n-----END PGP MESSAGE-----",
+				"fp": "c4639370c41133a738f643a591ddbc4c3387f1fb"
+			},
+			{
+				"created_at": "2026-08-20T15:24:40Z",
+				"enc": "-----BEGIN PGP MESSAGE-----\n\nhQIMA98TrrsQEbXUAQ/8CKXnmqU93XSdJ8WmS6BpssbMwcVDbgUl+U7wYOhq5ctr\nS2C0lPFO8g4QwQQiWBVCPuFqBypm0MjvaVfR86BqKkHPCcygRP3vTIzkR9mFfT//\n66Nhi4rBKJ41WDr4fMgsAOqNSvFvVsooK8AFpNg8uVBEpVkAOiPXd/3XtImO18Op\nuZs1yL+6OZxtF7smTwEEc3bZ4y3NQhefXLDJChnpCiLPNIJ25HG+QYpNz9Nokc4D\nvGbva5l6YtN+tGKyD3aNmnWL5N8jlKS92ZjaeQEdWECFcGEvCJDyAwwwDgWqAbui\nLETFynG1fV8MjrNuM3Ow4UWpn0FU4J38xI4AI4+6yBAdyOgBGX2fL6AS/2FQ0jQw\nEJbint8cETZTIb9AlazCWJrbIVCI8rw3JgmI9qR8caB3clAqp+1FNmiQV0mvlJG2\nS+8WxxlZW/ViUpe4XjuaSoVhlbpkHjeJLEs/uXC4ULWvdgerX+SvbVI3JoyTAdzU\n3qZpcUJBdtkhhaSY3MJNq1kSXmCIpwzbRpMGhRm2VmNccmCiGLTNhweIInK6is5a\nSxzprQUqsm9zdmhm75/7Dnm4GAxQ9XM8ItZjethnYtPgzDAYNIcRCW3fXc4LnkpB\nDqYzE8WElw+tb6LllRGG4iWeO3BN53Un/J2dQpqpoQchzsGggP9x6rRpZGf4ZKvS\nVgHnl30SJEno4IpxkHAkDQ8YZRJSeuTHTSk4ryrutFxpsq/hiqeqcD9KqqPdS0A6\noe4YP8PsI+xSdAJ34HdsoP4ZVl3ybFC4fzchDD2GQJiJJVX2OVWG\n=HjXN\n-----END PGP MESSAGE-----",
+				"fp": "aef8d6c7e4761fc297cda833df13aebb1011b5d4"
+			}
+		],
+		"version": "3.13.1"
+	}
+}

machines/albert/secrets/ssh_host_ed25519_key.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFsZ2PYP5eqXAerPWPYp+ZLM7zRZUGZLD4W5/H7fSEe7 root@

machines/albert/secrets/wg.private

@@ -0,0 +1,26 @@
+{
+	"data": "ENC[AES256_GCM,data:M5KfpqjYoQwjpAqSktu/8luQS7CRLUPTCRLpGGIwc2siFq8GXXxX+73DzvSN,iv:/aXgooRQK3k1VGQCa97f7u4Mw1PDd4FBup1z4NWNg7E=,tag:CbqhhaIuzcIGuK9Uxv3nfA==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1MzVzWHRNSmdzL0syV0xo\nblI0OW10bE1sSGpFQmRpNjdaS1dkQmZVdkI0CnJobmdZNXVJSlVkQ05oQlJ3NElP\nMXJjS2o1dzdIb0daVjFSR1g2NDAzd1kKLS0tIFNUd0FPZkFqM2RHSGJkT1Y2TDlo\na1VEZ0hDSFN6UHlmZ0IrZE0vZ2NPWDgKXfpLmDnTVHSjqTOwn6c1w8oBR1RCepPZ\nT9w7PVQFrOv6nshF2QyOb8WvbeN8kpWWHbOgOldc4cT0aDSU00xrrw==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c"
+			}
+		],
+		"lastmodified": "2026-08-20T15:24:41Z",
+		"mac": "ENC[AES256_GCM,data:hVIji3rvNEu4ZyIfjuWsgN3A6x4iRvO/Pkj0E2WlX+cf19Tjubqnp6/IPEaNjzqnflwTBBulz3dK4QkenoJH53TvTlMB1um72W4hquzhOkkiqYu/QljyzyJ1VLzBXbdtbdyZxvgZIEu/OuBZA9MAGozfen7sYNpoL979NwQdBXQ=,iv:31JhyX+KGK5CMCBEiqc0XNyrsxQVEXiuxsiDYjZucZQ=,tag:36CvEpeZfOuxDWwluGdg2w==,type:str]",
+		"pgp": [
+			{
+				"created_at": "2026-08-20T15:24:41Z",
+				"enc": "-----BEGIN PGP MESSAGE-----\n\nhQGMA5HdvEwzh/H7AQv/cFmsAoVY6lRHQ9zTuuLsR3AhJEzmNf4GYUm2/rhB3Odp\n2SOtOvVku9uei7PxIyttVYelNVI28+MDP8B9wknkTRAIRgoRPJ7bPYa/3OVGn8co\neFBmqcHPTdssy4oaLa6KK6YZFyq/8Dg7Sy97nySALSBZHvX8CPqgnODVSgSRvoMO\nhORKFE2WFut0uPu/iUgyJAjRnJ9sWZ2O0alIuoYhDc6ruwrLymfWbQVHMi2YSq9v\n9oJ3yWlwnusLFSvHGvF4Qt40n77/dtbr2510UDO85ADJ+HTgmg/GkObrYaz8Obbl\nrWhmS2G1v4aY2+PSHCWUgdecCKm6S8mDcWUPwn6CM/Rs8lWrTTGbFwGE5faZ+/wp\n+g2fBlCbpR9ZSS7iY7mzu0mNDXVTw2zis8zaGyCAA45xhFITToaTgQ9oGRrBLOBJ\n5uutof/zM6NZsPXmOP6COCSVar47/zaY/2sfuzNJ9ILyg3fUqGu+eYSDszqQK9FS\ng+c7vrcWsB56GfArRgxT0lgBhVMyYgwqZDN5Do2Q0pj8nzvL6wYacFJjsdYIWppk\n3K2e09EWtx30s+6lAj0dFNw9Owr5ImkEsQycZr2pfbJc+QLsMW5/gIQNMpDz+fnG\nGvCs7yXcKShk\n=j9Cj\n-----END PGP MESSAGE-----",
+				"fp": "c4639370c41133a738f643a591ddbc4c3387f1fb"
+			},
+			{
+				"created_at": "2026-08-20T15:24:41Z",
+				"enc": "-----BEGIN PGP MESSAGE-----\n\nhQIMA98TrrsQEbXUAQ/8DNarclMtOlejcGih7sivOrlDKQKlfb/eQOncnOXfwYII\nc+T1gJmYZEsRPsp08rfuYsxvsE5RDhcdXMlre+07RCywSGKBE3f3PzK9YefMHpJy\nGGu8/cegPSAAnegqXi8I9UsWObjvRPCNXT+cWz+OgJ6ekjhY9G4GL6MtuCi/NQju\nMhony9LFvIXQTAdy5KY+msggT1O+ApTJQH7G80zLMsxUTeS+hew5XNVVXClnKAY0\nvT73vebL4qAJ8j6WiNVTL5kQBCMsKLK5JckOly5tzJ4XHu3zPrDy3ZwImlnYFPS4\nkpZoc2EFgZIe5b17UYIX8//RTuSmeZ8ljVChZX5mGTl1QgwVoaZumJsbgctj0/WO\nJG+hqTE4YMcZaMpgbRJnB/No+arODhYSH5kgM+Bg31+RFzzhzac/7v6A2fGj1O3Z\n4eFMEQYKm49KZhsrsU9U1uK03GFs67G/9qH6kXSc0sywsz/IxvzxVMBKk6fNchlD\niaHD7jxBaB+VrTeFBT7OOdIziakVJvOP9RlAaArxga52ugV41d9NV9cZyfmPG9SN\nluoQet3Y3jdUU30Y6ZRdkSZNzesBWBdUgBp2f3qutUU7OqR1sVoh/uhNkpwodK8o\nqIPWfcdmxw+RbgswoLcKQT+ls4jr/cygHe61Xor/dOXbd5F7krL30Ka5FoMyhCnS\nWAF6DKcCYaPQVw3vghfGEr9a+9ml3a5DyP4QEWc5dsl4CpOsoCK67wSQJVYVIu0B\njHuKLPT0rYwFwi11DyWTXMJE5qodtVdm7ocZW2BTF5czGRQuJaX8Qgs=\n=r1KM\n-----END PGP MESSAGE-----",
+				"fp": "aef8d6c7e4761fc297cda833df13aebb1011b5d4"
+			}
+		],
+		"version": "3.13.1"
+	}
+}

machines/antamap/configuration.nix

@@ -1,4 +1,4 @@
-{ self, config, lib, pkgs, inputs, ... }:
+{ config, lib, pkgs, inputs, ... }:
 
 with lib;
 
@@ -8,8 +8,8 @@ let
     src = pkgs.fetchgit {
       url = "https://0xacab.org/AND/antamap.git";
       branchName = "master";
-      rev = "f62cc588df661e089d4ffb17adb78e667bda8f87";
-      sha256 = "sha256-vMAk2pphApkp1YkFBtX4cQDAyxDgMLnrhI4DTVgBYdE=";
+      rev = "ec584c0c4bd4ddd9ff8353bf8a926bd94526d304";
+      sha256 = "sha256-o5alTWBZIaUJiwYE0/gkGlxH+v1BxaGauxHDb6gK3+I=";
     };
 
     installPhase = "mkdir -p $out; cp -R * $out/";
@@ -22,10 +22,16 @@ in
   };
 
   imports = [
-    ../modules/malobeo_user.nix
+    inputs.malobeo.nixosModules.malobeo.users
+
     ../modules/sshd.nix
   ];
 
+  malobeo.users = {
+    malobeo = false;
+    admin = true;
+  };
+
   services.nginx = {
     enable = true;
     virtualHosts."_" = {
@@ -47,6 +53,8 @@ in
 
   networking.firewall.allowedTCPPorts = [ 80 ];
 
+  time.timeZone = "Europe/Berlin";
+
   system.stateVersion = "22.11"; # Did you read the comment?
 }
 

machines/bakunin/configuration.nix

@@ -6,21 +6,22 @@ in
 {
   imports =
     [ # Include the results of the hardware scan.
+      inputs.malobeo.nixosModules.malobeo.disko
+      inputs.malobeo.nixosModules.malobeo.initssh
+      inputs.malobeo.nixosModules.malobeo.users
+
       #./hardware-configuration.nix
       ../modules/xserver.nix
       ../modules/sshd.nix
       ../modules/autoupdate.nix
-      inputs.self.nixosModules.malobeo.disko
-      inputs.self.nixosModules.malobeo.initssh
-      inputs.self.nixosModules.malobeo.users
     ];
 
   malobeo.autoUpdate = {
     enable = true;
-    url = "https://hydra.dynamicdiscord.de";
+    url = "https://hydra.malobeo.org";
     project = "malobeo";
-    jobset = "infrastructure";
-    cacheurl = "https://cache.dynamicdiscord.de";
+    jobset = "master";
+    cacheurl = "https://cache.malobeo.org";
   };
 
   malobeo.disks = {
@@ -83,7 +84,6 @@ in
   services.acpid.enable = true;
 
   networking.hostName = "bakunin";
-  networking.networkmanager.enable = true;
 
   security.rtkit.enable = true;
   services.pipewire = {

machines/durruti/configuration.nix

@@ -1,4 +1,4 @@
-{ config, self, lib, pkgs, inputs, ... }:
+{ config, lib, pkgs, inputs, ... }:
 
 with lib;
 
@@ -17,14 +17,19 @@ with lib;
   ];
 
   imports = [
-    self.nixosModules.malobeo.metrics
+    inputs.malobeo.nixosModules.malobeo.metrics
+    inputs.malobeo.nixosModules.malobeo.users
     inputs.tasklist.nixosModules.malobeo-tasklist
 
-    ../modules/malobeo_user.nix
     ../modules/sshd.nix
     ../modules/minimal_tools.nix
   ];
 
+  malobeo.users = {
+    admin = true;
+    malobeo = false;
+  };
+
   malobeo.metrics = {
     enable = true;
     enablePromtail = true;

machines/fanny/configuration.nix

@@ -11,18 +11,19 @@ in
   sops.secrets.njala_api_key = {};
 
   imports =
-    [ # Include the results of the hardware scan.
+    [ 
+      inputs.malobeo.nixosModules.malobeo.vpn
+      inputs.malobeo.nixosModules.malobeo.initssh
+      inputs.malobeo.nixosModules.malobeo.disko
+      inputs.malobeo.nixosModules.malobeo.microvm
+      inputs.malobeo.nixosModules.malobeo.metrics
+      inputs.malobeo.nixosModules.malobeo.users
+      inputs.malobeo.nixosModules.malobeo.backup
+
       #./hardware-configuration.nix
       ../modules/sshd.nix
       ../modules/minimal_tools.nix
       ../modules/autoupdate.nix
-      inputs.self.nixosModules.malobeo.vpn
-      inputs.self.nixosModules.malobeo.initssh
-      inputs.self.nixosModules.malobeo.disko
-      inputs.self.nixosModules.malobeo.microvm
-      inputs.self.nixosModules.malobeo.metrics
-      inputs.self.nixosModules.malobeo.users
-      inputs.self.nixosModules.malobeo.backup
       ./dyndns.nix
     ];
 
@@ -42,10 +43,10 @@ in
 
   malobeo.autoUpdate = {
     enable = true;
-    url = "https://hydra.dynamicdiscord.de";
+    url = "https://hydra.malobeo.org";
     project = "malobeo";
-    jobset = "infrastructure";
-    cacheurl = "https://cache.dynamicdiscord.de";
+    jobset = "master";
+    cacheurl = "https://cache.malobeo.org";
   };
 
   malobeo.backup = {
@@ -147,6 +148,8 @@ in
     "vaultwarden"
     "pretalx"
     "antamap" 
+    "ns1"
+    "wordpress"
   ];
 
   networking = {
@@ -190,7 +193,7 @@ in
         proxyPass = "http://${hosts.malobeo.hosts.nextcloud.network.address}";
         extraConfig = ''
           proxy_set_header Host $host;
-          client_max_body_size ${inputs.self.nixosConfigurations.nextcloud.config.services.nextcloud.maxUploadSize};
+          client_max_body_size ${inputs.malobeo.nixosConfigurations.nextcloud.config.services.nextcloud.maxUploadSize};
           client_body_timeout 3600s;
           send_timeout 3600s;
           fastcgi_buffers 64 4K;
@@ -205,7 +208,7 @@ in
         proxyPass = "http://${hosts.malobeo.hosts.nextcloud.network.address}";
         extraConfig = ''
           proxy_set_header Host $host;
-          client_max_body_size ${inputs.self.nixosConfigurations.nextcloud.config.services.nextcloud.maxUploadSize};
+          client_max_body_size ${inputs.malobeo.nixosConfigurations.nextcloud.config.services.nextcloud.maxUploadSize};
           client_body_timeout 3600s;
           send_timeout 3600s;
           fastcgi_buffers 64 4K;
@@ -289,6 +292,8 @@ in
     };
 
     virtualHosts."antamap.malobeo.org" = {
+      forceSSL = true;
+      enableACME = true;
       locations."/" = {
         proxyPass = "http://${hosts.malobeo.hosts.antamap.network.address}:80";
         extraConfig = ''
@@ -296,6 +301,47 @@ in
         '';
       };
     };
+    
+    virtualHosts."hydra.malobeo.org" = {
+      forceSSL = true;
+      enableACME = true;
+      locations."/" = {
+        proxyPass = "http://${hosts.malobeo.hosts.albert.network.address}:3000";
+        recommendedProxySettings = true;
+        extraConfig = ''
+          proxy_set_header Host $host;
+          proxy_set_header X-Forwarded-Port 443;
+          proxy_set_header X-Forwarded-Proto https;
+        '';
+      };
+    };
+
+    virtualHosts."rm16bleibt.org" = {
+      forceSSL = true;
+      enableACME = true;
+      locations."/" = {
+        proxyPass = "http://${hosts.malobeo.hosts.wordpress.network.address}";
+        extraConfig = ''
+          proxy_set_header Host $host;
+          proxy_set_header X-Real-IP $remote_addr;
+          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+          proxy_set_header X-Forwarded-Host $host;
+          proxy_set_header X-Forwarded-Port 443;
+          proxy_set_header X-Forwarded-Proto https;
+        '';
+      };
+    };
+
+    virtualHosts."cache.malobeo.org" = {
+      forceSSL = true;
+      enableACME = true;
+      locations."/" = {
+        proxyPass = "http://${hosts.malobeo.hosts.albert.network.address}:5000";
+        extraConfig = ''
+          proxy_set_header Host $host;
+        '';
+      };
+    };
   };
 
   services.tor = {
@@ -309,7 +355,6 @@ in
   services.acpid.enable = true;
 
   networking.hostName = "fanny";
-  networking.networkmanager.enable = true;
 
   virtualisation.vmVariant.virtualisation.graphics = false;
 

machines/fanny/dyndns.nix

@@ -8,9 +8,11 @@
       KEYCLOUD=$(cat /run/secrets/njalacloud)
       KEYZINES=$(cat /run/secrets/njalazines)
       KEYANATAMAP=$(cat /run/secrets/njalaantamap)
+      KEYRM16=$(cat /run/secrets/njalarm16)
       ${pkgs.curl}/bin/curl --fail --silent --show-error "https://njal.la/update/?h=cloud.malobeo.org&k="$KEYCLOUD"&auto"
       ${pkgs.curl}/bin/curl --fail --silent --show-error "https://njal.la/update/?h=zines.malobeo.org&k="$KEYZINES"&auto"
       ${pkgs.curl}/bin/curl --fail --silent --show-error "https://njal.la/update/?h=antamap.malobeo.org&k="$KEYANATAMAP"&auto"
+      ${pkgs.curl}/bin/curl --fail --silent --show-error "https://njal.la/update/?h=rm16bleibt.org&k="$KEYRM16"&auto"
     '';
     serviceConfig = {
       Type = "oneshot";

machines/fanny/secrets.yaml

@@ -4,6 +4,7 @@ shop_auth: ENC[AES256_GCM,data:0NDIRjmGwlSFls12sCb5OlgyGTCHpPQIjycEJGhYlZsWKhEYX
 njalacloud: ENC[AES256_GCM,data:sp79Ij1vd9pQZuPUR1phmw==,iv:AWKZoOfBA/n16pWQCfA0dZmH1KajCztnLvYItoZZbgA=,tag:BIUrobBoO96pxUz1sjIYIw==,type:str]
 njalazines: ENC[AES256_GCM,data:fnObUEnXYvdj9HtkZNzXVA==,iv:0Zj2n2we9w4fj/n7e1ayd9XgFEMAGCHk4QLTu1IlRnQ=,tag:zeOLAB0oE6XbxqdqhdRNxw==,type:str]
 njalaantamap: ENC[AES256_GCM,data:nUc+E7HNbW0EDclzNDV6+w==,iv:H8nqeuOrvvu8O8QhGWkBkYWAQXwkBehf/jU6u/grs1A=,tag:mqX6jn47DyeSuk8xzG0e/Q==,type:str]
+njalarm16: ENC[AES256_GCM,data:Uo/TBNgyvH7EGSJb7ZQUBw==,iv:YDGjr9w9YceiDGJAtNIAPltxaR5pfpEYswu33WtAiQQ=,tag:PtlbcggOHgb1vIb7KBV0hg==,type:str]
 njala_api_key: ENC[AES256_GCM,data:ohSVzQUvFjia/s9WceqnZCdLyk3N1Lm2BCBmXeBlkWD2dyrohKCnd9GiJ499IORpuYcOXyM=,iv:Uczk8op5mgqe8gefxgU9YuTqOsYvjzHCKvzA7GDsgio=,tag:XA7JRq/LsGkpHcQSO36Whg==,type:str]
 sops:
     age:
@@ -25,8 +26,8 @@ sops:
             SKFx7MXcjFRLKS2Ij12V8ftjL3Uod6be5zoMibkxK19KmXY/514Jww==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
-    lastmodified: "2026-08-28T12:19:14Z"
-    mac: ENC[AES256_GCM,data:TnElCRaL/b238clfFVEq+Ot1lwg5MLMchCkmhi5PmADRn2exA42Zeq5v1M/IM5sHt4xEyFLn5R/88Y49DAfehRFwu6rddV+3lnFV40k2rWRtMfQOUXSrCd7lGxZdFbMU0eIXF5jaATFbcP0wO03FohNA69/u6kNsS0y0jK3vuLQ=,iv:xPeNXUIavVYFfAv1fs5TXCHXmvnXQDs4mJZMHOX7qG8=,tag:85hrBTKMh1ckTtXpOxj5lg==,type:str]
+    lastmodified: "2026-09-14T12:42:34Z"
+    mac: ENC[AES256_GCM,data:cOv94thIsHzpsiYnJAP2R/RZIkkdr+NHQuO5jCMxWssFu5WcWzeXC9mbYe0RAhY0Hx+tUHJsEG5SQqRaudpbGH9aYLC+5jkVaURXSYd5FIv+I8aUrBsZtpVrE7NJwo+S3+PAgpOUCO4w0bBFsmAWvgpEQSWIcndnkZvvwF2GtrU=,iv:pupuBdJsZTLY246yanDPdgDlRm2oOZprERy3uNdY7E4=,tag:9c1IAKpXBb2KhI1N6M7hOA==,type:str]
     pgp:
         - created_at: "2025-02-11T18:32:49Z"
           enc: |-

machines/hosts.nix

@@ -29,6 +29,8 @@ in
           local = true;
           hostId = "11";
           address = "192.168.1.101";
+          gateway = "192.168.1.1";
+          nameservers = [ "192.168.1.1" "1.1.1.1" ];
         };
       };
 
@@ -38,6 +40,8 @@ in
           local = true;
           hostId = "12";
           address = "192.168.1.102";
+          gateway = "192.168.1.1";
+          nameservers = [ "192.168.1.1" "1.1.1.1" ];
         };
       };
   
@@ -47,6 +51,8 @@ in
           local = true;
           hostId = "13";
           address = "192.168.1.103";
+          gateway = "192.168.1.1";
+          nameservers = [ "192.168.1.1" "1.1.1.1" ];
         };
       };
   
@@ -56,6 +62,19 @@ in
           local = true;
           hostId = "15";
           address = "192.168.1.105";
+          gateway = "192.168.1.1";
+          nameservers = [ "192.168.1.1" "1.1.1.1" ];
+        };
+      };
+
+      albert = {
+        type = "host";
+        network = {
+          local = true;
+          hostId = "19";
+          address = "192.168.1.111";
+          gateway = "192.168.1.1";
+          nameservers = [ "192.168.1.1" "1.1.1.1" ];
         };
       };
   
@@ -113,6 +132,13 @@ in
         type = "microvm";
         network = createMaloNet "20" "52:DA:0D:F9:EF:F6";
       };
+
+      wordpress = {
+        type = "microvm";
+        network = createMaloNet "21" "52:DA:0D:F9:EF:F6";
+      };
+
+      # last host id: 21
     };
   };
 }

machines/infradocs/configuration.nix

@@ -1,4 +1,4 @@
-{ self, config, lib, pkgs, inputs, ... }:
+{ config, lib, pkgs, inputs, ... }:
 
 with lib;
 
@@ -10,11 +10,17 @@ with lib;
 
   imports = [
     inputs.malobeo.nixosModules.malobeo.metrics
+    inputs.malobeo.nixosModules.malobeo.users
+
     ../durruti/documentation.nix
-    ../modules/malobeo_user.nix
     ../modules/sshd.nix
   ];
 
+  malobeo.users = {
+    admin = true;
+    malobeo = false;
+  };
+
   malobeo.metrics = {
     enable = true;
     enablePromtail = true;

machines/louise/configuration.nix

@@ -3,21 +3,22 @@
 {
   imports =
     [ # Include the results of the hardware scan.
+      inputs.malobeo.nixosModules.malobeo.printing
+
       ./hardware-configuration.nix
       ../modules/xserver.nix
       ../modules/malobeo_user.nix
       ../modules/sshd.nix
       ../modules/minimal_tools.nix
       ../modules/autoupdate.nix
-      inputs.self.nixosModules.malobeo.printing
     ];
 
   malobeo.autoUpdate = {
     enable = true;
-    url = "https://hydra.dynamicdiscord.de";
+    url = "https://hydra.malobeo.org";
     project = "malobeo";
-    jobset = "infrastructure";
-    cacheurl = "https://cache.dynamicdiscord.de";
+    jobset = "master";
+    cacheurl = "https://cache.malobeo.org";
   };
 
   boot.loader.systemd-boot.enable = true;
@@ -71,7 +72,6 @@
   services.acpid.enable = true;
 
   networking.hostName = "louise";
-  networking.networkmanager.enable = true;
 
   security.rtkit.enable = true;
   services.pipewire = {

machines/lucia/configuration.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, ... }:
+{ config, pkgs, inputs, ... }:
 
 let
   sshKeys = import ../ssh_keys.nix;
@@ -6,10 +6,16 @@ in
 {
   imports =
     [ # Include the results of the hardware scan.
+      inputs.malobeo.nixosModules.malobeo.users
+
       ./hardware_configuration.nix
-      ../modules/malobeo_user.nix
     ];
 
+  malobeo.users = {
+    admin = true;
+    malobeo = false;
+  };
+
   sops.defaultSopsFile = ./secrets.yaml;
   sops.secrets.njala_api_key = {};
 

machines/modules/autoupdate.nix

@@ -17,7 +17,7 @@ in
       default = false;
     };
 
-    # https://hydra.dynamicdiscord.de/job/malobeo/infrastructure/louise/latest
+    # https://hydra.malobeo.org/job/malobeo/infrastructure/louise/latest
     url = mkOption {
       description = lib.mdDoc ''
         Url to your hydra instace. like https://hydra.example.de

machines/modules/host_builder.nix

@@ -26,11 +26,13 @@ rec {
 
             settings = {
               substituters = [
+                "https://cache.malobeo.org"
                 "https://cache.dynamicdiscord.de"
                 "https://cache.nixos.org/"
               ];
               trusted-public-keys = [
                 "cache.dynamicdiscord.de:DKueZicqi2NhJJXz9MYgUbiyobMs10fTyHCgAUibRP4="
+                "albert:+eSv8F63uj94A0fvmdyPcDDH0qI3CYR91fsbA/eLFGw="
               ];
               trusted-users = [ "root" "@wheel" ];
             };
@@ -43,6 +45,20 @@ rec {
   ];
   defaultModules = baseModules;
 
+  makeNetwork = network: [{
+    systemd.network.enable = true;
+    
+    systemd.network.networks."20-lan" = {
+      matchConfig.Type = "ether";
+      networkConfig = {
+        Address = [ "${network.address}/24" ];
+        Gateway = "${network.gateway}";
+        DNS = network.nameservers;
+        DHCP = "no";
+      };
+    };
+  }];
+
   makeMicroVM = hostName: network: modules: [
     {
       microvm = {
@@ -87,18 +103,6 @@ rec {
           }
         ];
       };
-
-      systemd.network.enable = true;
-      
-      systemd.network.networks."20-lan" = {
-        matchConfig.Type = "ether";
-        networkConfig = {
-          Address = [ "${network.address}/24" ];
-          Gateway = "${network.gateway}";
-          DNS = network.nameservers;
-          DHCP = "no";
-        };
-      };
     }
   ] ++ defaultModules ++ modules;
 
@@ -257,9 +261,9 @@ rec {
     specialArgs.inputs = inputsMod;
     specialArgs.self = self;
     modules = (if (settings.type != "microvm") then
-      defaultModules ++ [ ../${host}/configuration.nix ]
+      (makeNetwork settings.network) ++ defaultModules ++ [ ../${host}/configuration.nix ]
       else
-      makeMicroVM "${host}" settings.network [
+      (makeNetwork settings.network) ++ makeMicroVM "${host}" settings.network [
         inputs.microvm.nixosModules.microvm
         ../${host}/configuration.nix
       ]);

machines/modules/malobeo/peers.nix

@@ -52,10 +52,24 @@
     publicKey = "h1A2yt7OQ5EJIilC8tQg203u27o6J6/c+Kd/pZ4UWAY=";
   };
 
+  "albert" = {
+    role = "client";
+    address = "10.100.0.103";
+    allowedIPs = [ "10.100.0.103/32" ];
+    publicKey = "8wgQ+GYLX9PzldmeDOsrhnbBWPCGvHbT+7POT7e4oj4=";
+  };
+
   "backup0" = {
     role = "client";
     address = "10.100.0.20";
     allowedIPs = [ "10.100.0.20/32" ];
     publicKey = "Pp55Jg//jREzHdbbIqTXc9N7rnLZIFw904qh6NLrACE=";
   };
+
+  "ns1" = {
+    role = "client";
+    address = "10.100.0.21";
+    allowedIPs = [ "10.100.0.21/32" ];
+    publicKey = "jozMsP5MA2uz7eOrXG8LB8mr2tHVa6FL1+tbMQs9ySk=";
+  };
 }

machines/modules/malobeo/users.nix

@@ -1,7 +1,7 @@
 {config, lib, pkgs, inputs, ...}:
 let 
   cfg = config.malobeo.users;
-  sshKeys = import ( inputs.self + /machines/ssh_keys.nix);
+  sshKeys = import ( inputs.malobeo + /machines/ssh_keys.nix);
   inherit (config.networking) hostName; 
 in
 {

machines/modules/malobeo/wireguard.nix

@@ -72,6 +72,7 @@ in
           mtu = 1340; #seems to be necessary to proxypass nginx traffic through vpn
           address = [ "${myPeer.address}/24" ];
           autostart = cfg.autostart;
+          #dns = [peers.ns1.address "1.1.1.1"]; #currently broken, see commit message
           listenPort = mkIf (myPeer.role == "server") myPeer.listenPort;
 
           # This allows the wireguard server to route your traffic to the internet and hence be like a VPN

machines/nextcloud/configuration.nix

@@ -1,4 +1,4 @@
-{ config, self, lib, pkgs,  ... }:
+{ config, lib, pkgs, inputs, ... }:
 
 with lib;
 
@@ -20,13 +20,19 @@ in
   };
 
   imports = [
-    self.nixosModules.malobeo.metrics
-    ../modules/malobeo_user.nix
+    inputs.malobeo.nixosModules.malobeo.metrics
+    inputs.malobeo.nixosModules.malobeo.users
+
     ../modules/sshd.nix
     ../modules/minimal_tools.nix
     ../modules/autoupdate.nix
   ];
 
+  malobeo.users = {
+    admin = true;
+    malobeo = false;
+  };
+
   malobeo.metrics = {
     enable = true;
     enablePromtail = true;

machines/ns1/configuration.nix

@@ -1,4 +1,4 @@
-{ config, self, lib, inputs, pkgs,  ... }:
+{ config, lib, inputs, pkgs,  ... }:
 
 with lib;
 with inputs;
@@ -13,18 +13,33 @@ in
   };
 
   imports = [
-    ../modules/malobeo_user.nix
+    inputs.malobeo.nixosModules.malobeo.users
+    inputs.malobeo.nixosModules.malobeo.vpn
+
     ../modules/sshd.nix
     ../modules/minimal_tools.nix
     ../modules/autoupdate.nix
   ];
 
+  malobeo.users = {
+    admin = true;
+    malobeo = false;
+  };
+
   networking.firewall = {
     enable = true;
     allowedTCPPorts = [ 53 ];
     allowedUDPPorts = [ 53 ];
   };
 
+  sops.defaultSopsFile = ./secrets.yaml;
+  sops.secrets.wg_private = {};
+  services.malobeo.vpn = {
+    enable = true;
+    name = "ns1";
+    privateKeyFile = config.sops.secrets.wg_private.path;
+  };
+
   services.bind = {
     enable = true;
     forwarders = [

machines/ns1/dummy.yaml

@@ -0,0 +1,64 @@
+wg_private: ENC[AES256_GCM,data:KnlCYE1/WjhNLfazuKViiVKZLPqQHwwqX1o2Irxaoj6oa54s6vBoiHVste4=,iv:ZAqdUSGwzbrLjskAntzmcNCcIjyePG+awYRkSgi6tZg=,tag:vllLI+0dbuFlkcdaYsBqYQ==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBSDdNMUxFRGROR2YwN0Vn
+            SjlqVXV5SmVwOXdWcmgrOUswNnB6YitYeTJvClcrVk53d1FBUndSQWgxRVVySnFl
+            bVp4R3hHWmtGQW9lWER4L0tmTzdjc00KLS0tIFJRUHlMMGlvOVplTGNGNUo3NWNw
+            azVxT1hPUUZ4Wmc4QjNGcEtUcDFqd1kKZU2LEJsStdOspRE1CmbXevkQDfPHTuWp
+            k4AOM/W2T1Jz70pPl4M+Xg8oCJ5TNaURnvCxuiaBgAtQuZC7OR/Pnw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age18jn5mrfs4gqrnv0e2sxsgh3kq4sgxx39hwr8z7mz9kt7wlgaasjqlr88ng
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHMlE1bGVyWkdOOHdja1pM
+            OUhRU2VCVDhEZ3kxVDRzb0Z4YUxOeFZFTVdJCjlWd2NlUmcwU3dQb1pMT2U0a1ZO
+            Zk5HNVJtQWREMWpXVG9ZVkd2QkVjeVkKLS0tIHBXbDUrcjl5VXNXT3JPTThIYVFa
+            TEtTb1pNUjVUM3dBVFRJMUpnNng2bEkKBfxqOkJ4R4RMl4AYMmFXq0dYeiH8UuwB
+            1ozr78TT5ksdRHuYmOyJzAG3Q14tK/+h1tcSmh5bXIZtuzJzZKN4kw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
+    lastmodified: "2026-09-10T15:02:33Z"
+    mac: ENC[AES256_GCM,data:e03qvt+6PI5FsKtV4aK1XhX1RCzzsvAf42/NOau5kEa0pRaSM+ajTJSD+06oC35gBYwB3w9Hq1ubFZVvZM3vgqITSNzCNJr7ft6LI48Srq0VjtKoGmjKqETYTTSNhbisNCI+sU13pdV18BESHE5eIGY/0KHcSeF1vG7Ys2DMTwM=,iv:cmfCkTMj5+NxWgBIthg2MaG39CYOsZdqTOMszOiOmY0=,tag:a4ooDhkCtLZm/s1O0tNGug==,type:str]
+    pgp:
+        - created_at: "2026-09-10T15:02:19Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQGMA5HdvEwzh/H7AQv/Wz+3/F+/IPsaVUZbJ6GB8V5HkowP7KCzWJOxwY3B3Yhl
+            H4Qir6G6aT2CpD5hHy+zEFw7s5t+MILybyzMZqNocjuQWIrF/YIYUbTDKK6rgSzC
+            tx0E6DcndBf69eK2wL8Um19/boB+MTN3DQSUom6Jpvg7WGo0NjtDexAqwSpJwFFF
+            di2DoUDHyTUUdHTcD+hfODTiQYC7cp51hZ6n3JACu1toGNfre1A/PtoSOTYP9i2p
+            aIIWBSciT4K1RJnIhV4fpU7wh7gi0O4xS1XZnTQ/SOA26sHp8wObLvi3TwF5AKum
+            dYyuCinJGMep7VBjBf7eJ73TI4CD1QM+MEQTzegPVlo54LvqSqwp8ZwHdIZi9gQ4
+            3Vku2hGSOI9SmOjOR5GGEYfJS3BbbF9rJCnamBhZVVO5lXbFtZqWi0JOu8U4Esnw
+            DTzLDOJpajEo7YxADD7yyLlFXDRtMNgU91hCjBLz76SgExI3avWq3Mm+KZXI4xCt
+            L0yENHriidkFR2T/uV4w0lYBAPOSvPnvxK92VEa1oDrhIjcFd0JwH/XsrYq/nih6
+            4PBf4U5DdO+ulJOj6MXV0QmsZXMObX8LWh6myufRTPIPl6wA5SeSvleDuiWQKYdW
+            j0rqALTicw==
+            =mpXh
+            -----END PGP MESSAGE-----
+          fp: c4639370c41133a738f643a591ddbc4c3387f1fb
+        - created_at: "2026-09-10T15:02:19Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA98TrrsQEbXUAQ/9EqodWqh61g7Uv1L/oF8PMMsONmprOg+17Xvn33xI8Pam
+            SjiEaGh8qZRJckFPdWgw1QNfpzFnEjpJEYMQ46oHJxlLMd5T4eqOTHbmPC3IAktm
+            lg3yYRmHEhyrngmQPTnoKuNQg6YDhzorHsfD98Tf0zA0B9AGCukgDZoEUs2oXwsY
+            PiZYcTcgB8z/8petU9YlieO7frm17Srso5JfOfIlu88vtlAeu3z8LZl5iKl34Lxz
+            +2TGAz/6YTYx24Tmj9qWpRYYPpbnQNUTkm+D9eDts6Pz1SFY/cerd1Q0Do8apIo7
+            dO1gz0C2dhh6QvGAovH7k0fS+bH3N1qpqbzmLQfMArXytQVZg1Ucisk9VYkS9XEE
+            dV0TVTOOEyq8rOzmZHfhVqGv+VsAMQXdcgsCRJ8HDLDWlDAOnuIX86NvlNmDHuZu
+            9jMqCq+cmf7W0sZdamHLM/T3IXs0oJJc4YvyFAlPTPdbGHICQ1rWDLXvICIXiifg
+            LzkbK0XjxG+fDCzKzMXJ/gho7KHOut/+Kf5+hQNMnoPZ3/MeDJEyAHKBEsTI/CYe
+            9qla0CJnUVNRHDnc99qMeSeD7p6OLZsO4cANTSEnz0eiyZoJKa2m8du1TTtxIzCt
+            Jcu1yFana7MX68ppxlqkfd7iSPyGo9d7DcPO9lFscNQ9yIPiGReZ8Ow7KSlu37LS
+            VgFsGneFVfYYk6SnW9SOtooNAFNL9sWxqiWjb3fxfGeIuOF7LJqmevx7SU8V5eAt
+            nCqGZZg/YCAecjTDHi8Yy5ly2LrNjF6yOhUtYifW6yBJB2UEQdDE
+            =mUhm
+            -----END PGP MESSAGE-----
+          fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4
+    unencrypted_suffix: _unencrypted
+    version: 3.13.1

machines/ns1/secrets.yaml

@@ -0,0 +1,64 @@
+wg_private: ENC[AES256_GCM,data:KjuXpIBnp/LVjOvaSk0vZEF3vOcq0y7cnEohYMFAHnnJK+TiGt3+ESkF08c=,iv:zlWkp9blv2KmIpXEOQRqle2voHIS/EhTVuWKJQ/qowY=,tag:nOUDEcwKODx8G8p7jWPA2w==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZa0ticWhrdXRNa094MEoz
+            ZmJiYTJoSTFHUnFpakJuc1NCTjZlN2kzazBzClRYb3B6YUozMUxFY09wdHNsK3No
+            eWVBSUU2bUd5M2Z5WjVjWnpxcjFBTHcKLS0tIDBESUtRQVkzRVp5MGYwVER1aDFE
+            dGl4bXlDTkhNVWM3R1Y4aDVabnYrd2cKCuLUw7SP/pyDJbmq/ADRvH7EfDVlYItW
+            rU2b1KTyI4JpVK6/OLN2leSioYzqiE3ONewC9CMMrluCWwNEKmLiUg==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1mam7y7x4my6g8yt8leze3pvlq0fr48hdsqz62gs7l9rstf9hh3fs03xf7n
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGaEV0WkI4Y2JoV0IzTlNj
+            SkFGVTQ1ZG1VNzdtK0xTWFZRS0FTY1Y1MlZvCjdhYk9UWWtUWC9MNUwybVhZSzhI
+            bjhydVVkK01zcmZZampEVW16L0dWRzAKLS0tIDhpK2YrTEtPYmVsUHExdnA4WHRa
+            Y1JUT1VQMmdRUnl1b0NGOEFsNlR1VGcKOR35LVxYuGw8HOWwQ+ODN9y4I9FHq3lg
+            1vDrSI3JBfRuU2G/OXbkV6bNPH9KnzgXxUEOWkZmamrcwtIGldfh9Q==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
+    lastmodified: "2026-09-10T15:02:04Z"
+    mac: ENC[AES256_GCM,data:Ykr0571wJjFij/4j6aIBXVOpkyU6jCbAdnjvxLQfwrxB25CgqaposamrFJVWMKXTHhjD9cyERuApAglIcDmgfDAE7udeE5UaQDTPzTgxSteDwr8t1Ln7D5nQ2euPZXqSEdEUYTvQZSufr47x1jHBdgpcsm2xjBQijRh5UtsuCzc=,iv:H3PuuKbdEoEq2Xrw1NuYEZty99MHCcHRZHAhRFgmrYw=,tag:s4vBcEvL4A39PLNInXknvg==,type:str]
+    pgp:
+        - created_at: "2026-09-11T18:55:59Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQGMA5HdvEwzh/H7AQv/cD7baU+5Ujkrf5jUdn4HSPtVW/KkeW0Mw7uQmd7bI5sp
+            n3iekWWTOpCv98lNdCMXn+iV1BL37ILPOYSXsjxw2vfKjGfgWkkwpFdcLUiS7Qnm
+            ymGVIPyqHDJRqhxxhiR5B1aC7AhR+otkULNzKSSgYZa+Rj8DlFwW07aknJDSeZM0
+            yy70RTxCGgH/4amYZN+QLOJapjGX4FMvJeG+y0vv65GinMmjkQ7B5z3rKUiKbud8
+            mjPgMIfxcBo5o5vepld315atoZQX+kCIgJPU3rQshTobgwQD+uVZo/ocGHVdZWra
+            eVOpKZYO4ecQJ8xRvSMNSrXRmeW/a6h7NhHN2kD74Ms1xB8cuhYklCz8gWd50yyo
+            7kTG8wBPnvvkx4SSgFwvnj1hnppUweFUM64JBHXrjQWeDof1FPC18kiNTAQGwAOL
+            UiI4Yka0d1zLl1vpdBN8E17jBqfi2CSLB9wL3IbD5CTYAprzzvptfXI2Ubqq82c1
+            Np71LvSaBYA4SPNJ2EZB0lYBtkjGzUw8L9Kuod5UwXTeJQ2vbhpYpqHzjWrmWvK/
+            VlCzVV+AYfOQUVvmbYf+DtowO/wCS8n2gVepyOoMCcEnRT9lqm7ndC/ozt+iZove
+            vDcSGqKuUg==
+            =oEsA
+            -----END PGP MESSAGE-----
+          fp: c4639370c41133a738f643a591ddbc4c3387f1fb
+        - created_at: "2026-09-11T18:55:59Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA98TrrsQEbXUAQ//fciJkmAmvlAHzZxO2CTCFkNNn+aSpkH/IoNRKfEIJDtf
+            wAChdactP8yq6qKxSqv3Ks90K+hQRQr6tXpF652NDFYkP2CHsEo0wbOAgcqFzGtY
+            92MenPwOKP6B9UTvm0ZqVFet7/jmQBatXMzFWsSkUCBqWXAg/UUrJVf/zbGoHwB7
+            efskMTrkArlxhoY/3+/0bMeEqZJlhm9UmlAST1/xNlI4DUYhlBxnzA2vgi8QWBFT
+            6+QkZ2YiM0IlDCUbe920c1ad0/McV8Bj6jccW1ZBISXk9KYQq41PBjQKhyKoC/Xc
+            xJLcxy1NeUZWlPSFF05TTWaRUkBH8YZm7vum5xWdT1lz6FrHB+aNHr9XxKj5c7pp
+            bLAQ2PfG0kK/kemNBKd9/Q5r2SfEUbmI+cGLbqkaZwbhD0ThMmEkMxdGwzzrf2Wq
+            Lhpkj+2zx37r6GI8UlBp9jhUbhj1N9HetyjBhKzEcxqCEg4DXNiKRiXvMvCg6sCz
+            kIKsmNDhbmt0jKNL8NJio10lo4+S2gPi8jg6mcj4RDkS8zC95P/EHkNZl2aQwBRU
+            /GLzzpODa41ZZB9+WC68vMZudSQwHK0c7SNoEc5putlbUjKDSpJHY4manF6O4rG2
+            FZNG8TA8VeEg6wjBPkBw5ardM//E5r0iFfx2IjrCjhNoaknc5aPRZ96XqY/5TqbS
+            VgGRpWs5jaQv4CbRA0yAHqFrGgSRFY0wCFT5Hkwi7wyGyxR5Y30jISsn+kU8ysHV
+            OGZFCDl7tRvL9ICJheXWS61k5LNd4H8rAMqXoPbSvtU/KC/hfRMk
+            =ZdHS
+            -----END PGP MESSAGE-----
+          fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4
+    unencrypted_suffix: _unencrypted
+    version: 3.13.1

machines/overwatch/blackbox.yaml

@@ -0,0 +1,78 @@
+modules:
+  http_2xx:
+    prober: http
+    http:
+      preferred_ip_protocol: "ip4"
+  http_post_2xx:
+    prober: http
+    http:
+      method: POST
+  tcp_connect:
+    prober: tcp
+  pop3s_banner:
+    prober: tcp
+    tcp:
+      query_response:
+      - expect: "^+OK"
+      tls: true
+      tls_config:
+        insecure_skip_verify: false
+  grpc:
+    prober: grpc
+    grpc:
+      tls: true
+      preferred_ip_protocol: "ip4"
+  grpc_plain:
+    prober: grpc
+    grpc:
+      tls: false
+      service: "service1"
+  ssh_banner:
+    prober: tcp
+    tcp:
+      query_response:
+      - expect: "^SSH-2.0-"
+      - send: "SSH-2.0-blackbox-ssh-check"
+  ssh_banner_extract:
+    prober: tcp
+    timeout: 5s
+    tcp:
+      query_response:
+      - expect: "^SSH-2.0-([^ -]+)(?: (.*))?$"
+        labels:
+        - name: ssh_version
+          value: "${1}"
+        - name: ssh_comments
+          value: "${2}"
+  irc_banner:
+    prober: tcp
+    tcp:
+      query_response:
+      - send: "NICK prober"
+      - send: "USER prober prober prober :prober"
+      - expect: "PING :([^ ]+)"
+        send: "PONG ${1}"
+      - expect: "^:[^ ]+ 001"
+  icmp:
+    prober: icmp
+  icmp_ttl5:
+    prober: icmp
+    timeout: 5s
+    icmp:
+      ttl: 5
+  websocket:
+    prober: websocket
+  http_3xx:
+    prober: http
+    http:
+      preferred_ip_protocol: "ip4"
+      enable_http3: true
+      enable_http2: false
+      valid_http_versions: ["HTTP/3.0"]
+  postgresql:
+    prober: tcp
+    tcp:
+      query_response:
+      - send: !!binary AAAACATSFi8= # 0x00, 0x00, 0x00, 0x08, 0x04, 0xD2, 0x16, 0x2F - PostgreSQL SSLRequest
+      - expect_bytes: S # 0x53 - Reply will be 'S' if SSL is enabled, and 'N' if it is not.
+      - starttls: true

machines/overwatch/configuration.nix

@@ -1,4 +1,4 @@
-{ config, self, lib, pkgs, inputs, ... }:
+{ config, lib, pkgs, inputs, ... }:
 
 with lib;
 
@@ -7,11 +7,21 @@ let
 in
 {
   sops.defaultSopsFile = ./secrets.yaml;
+
   sops.secrets = {
     grafana_smtp = {
       owner = "grafana";
       group = "grafana";
     };
+
+    # Contains private targets for blackbox monitoring
+    # It is used below in the blackbox-http-private0 job
+    # More of these can be created such as private1, private2, ...
+    private0_blackbox_config = {
+      owner = "prometheus";
+      group = "prometheus";
+      path = "/var/lib/prometheus2/private0.json";
+    };
   };
 
   networking = {
@@ -20,12 +30,18 @@ in
   };
 
   imports = [
-    self.nixosModules.malobeo.metrics
-    ../modules/malobeo_user.nix
+    inputs.malobeo.nixosModules.malobeo.metrics
+    inputs.malobeo.nixosModules.malobeo.users
+
     ../modules/sshd.nix
     ./printer_module.nix
   ];
 
+  malobeo.users = {
+    admin = true;
+    malobeo = false;
+  };
+
   networking.firewall.allowedTCPPorts = [ 80 3100 ];
 
   malobeo.metrics = {
@@ -108,7 +124,91 @@ in
     retentionTime = "1y";
     port = 9001;
 
+    # We have to disable the checks since we use file_sd_configs provided through
+    # sops secrets. These are not available during buildtime which leads to errors during the check
+    checkConfig = false;
+
+    exporters.blackbox = {
+      enable = true;
+      configFile = ./blackbox.yaml;
+    };
+
     scrapeConfigs = [
+      {
+        job_name = "blackbox-http";
+        metrics_path = "/probe";
+        params = {
+          module = ["http_2xx"];
+        };
+        static_configs = [{
+          targets = [ 
+            "https://malobeo.org"
+            "https://cloud.malobeo.org"
+            "https://antamap.malobeo.org"
+            "https://docs.malobeo.org"
+            "https://events.malobeo.org"
+            "https://hydra.malobeo.org"
+            "https://keys.malobeo.org"
+            "https://tasklist.malobeo.org"
+            "https://zines.malobeo.org"
+           ];
+        }];
+
+        relabel_configs = [
+          {
+            source_labels = ["__address__"];
+            target_label = "__param_target";
+          }
+          {
+            source_labels = ["__param_target"];
+            target_label = "instance";
+          }
+          {
+            target_label = "__address__";
+            replacement = "127.0.0.1:9115";
+          }
+        ];
+      }
+      {
+        job_name = "blackbox-http-private0";
+        metrics_path = "/probe";
+        params = {
+          module = ["http_2xx"];
+        };
+        file_sd_configs = [
+          {
+            files = [ 
+              config.sops.secrets.private0_blackbox_config.path
+            ];
+          }
+        ];
+        relabel_configs = [
+          {
+            source_labels = ["__address__"];
+            target_label = "__param_target";
+          }
+          {
+            source_labels = ["__param_target"];
+            target_label = "instance";
+          }
+          {
+            target_label = "__address__";
+            replacement = "127.0.0.1:9115";
+          }
+        ];
+      }
+      {
+        job_name = "hydra";
+        static_configs = [{
+          targets = [ "${hosts.malobeo.hosts.albert.network.address}:9199" ];
+        }];
+      }
+      {
+        job_name = "hydra-queue-runner";
+        static_configs = [{
+          targets = [ "${hosts.malobeo.hosts.albert.network.address}:9198" ];
+        }];
+      }
       {
         job_name = "overwatch";
         static_configs = [{
@@ -163,6 +263,12 @@ in
           targets = [ "${hosts.malobeo.hosts.fanny.network.address}:9002" ];
         }];
       }
+      {
+        job_name = "albert";
+        static_configs = [{
+          targets = [ "${hosts.malobeo.hosts.albert.network.address}:9002" ];
+        }];
+      }
       # add vpn - check how to reach it first. most probably 10.100.0.1
     ];
   };

machines/overwatch/dummy.yaml

@@ -1,9 +1,9 @@
 grafana_admin: ENC[AES256_GCM,data:zO7Tfmo=,iv:xa456cUb14VjJPEKClqGJiYR7cSsjQPIld+O2E0YNM8=,tag:dFgGtqMYhg4uweoLZPu48Q==,type:str]
 grafana_smtp: ENC[AES256_GCM,data:xndLMw==,iv:0P4INbDD2/Teo8Dv6lIfLhXvNAkcneEDCeB5OAY25wI=,tag:ilE0Noleb+uL5gqF4bU70w==,type:str]
+private0_blackbox_config: ENC[AES256_GCM,data:Q7Ll0GFtCEgCKsq2rE4/qLZwo4F+8HAkWFDrc0zz7GvWR29q88rm6P3YqiGpuHo5nGoxanJPxV0ucNV4dA9CRuH6kx1B3WONUd97BSjSY0iVjVMtGhBVNdRGl3i9q9+vTsfXT7jEY5kmEQ1uUMjC+3h5r3J6s6JlVAwxdA==,iv:V4nOZYipocrZjZ9L7Kv/QZEftVwu4yIRoiff5H5Gl4M=,tag:5RCh2ra+5sBEbxLe604m8w==,type:str]
 sops:
     age:
-        - recipient: age18jn5mrfs4gqrnv0e2sxsgh3kq4sgxx39hwr8z7mz9kt7wlgaasjqlr88ng
-          enc: |
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPMXlEbWlabzVUNlRkVFFC
             ZktpQUx2alRNN01qYmhFYnhMRDBkYmFRdzNnCi9YbjBDUlRhc1kwVjZWY0NGZERQ
@@ -11,8 +11,8 @@ sops:
             eDFDVStZS0o0WVh4cmJPa2o3eWNseGMKc0ydK8/2Gzxe2IYG96saVosJTrRcWizR
             lcMbsh8mKlVCt5Fx9EQOtj50ylOGk2h2Itk4uLYG4UAySDU/Aw3iQw==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
-          enc: |
+          recipient: age18jn5mrfs4gqrnv0e2sxsgh3kq4sgxx39hwr8z7mz9kt7wlgaasjqlr88ng
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1QmsxNERCclRBeFo0WGZ1
             OGlHTGxDMURsWXdDRXpoUk10S0JpeGk2QURvCjBkaVFHTHo1eGtKbERPWmhNZEpL
@@ -20,8 +20,9 @@ sops:
             QXZwTVd5NnNSdUxRSzNLMHk2SWYxVnMKZyZvZV5qhJj4KATFV2eh9aN9XMbSQL7i
             kRGQI9y5ADv6UsLh/y+rWe0xF4BPOGF0xL8JUnHfTy/RsKfhB3aTYQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-01-24T17:01:57Z"
-    mac: ENC[AES256_GCM,data:KySo9sJgOLBPtxQZ1gXY8aCmCHbn44aiLKiK1mGziKsBoPkBdEivCT7dDQ1tXQj9wz3gly6raS4FEmR6ikcbtAE2EN86cDLNuu9sSiW2OYiJRe5iZvet2veqtA00K7TtPZgAX+ccsUE5iy0W55bu+kpK3J8MPNy3LUK0EbSKW8I=,iv:7BQKCNyWe4azTelyKlV6XvvgPIrspVbwITyycsW/c44=,tag:1XbSxju44GCKcGw8Ln9iuQ==,type:str]
+          recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
+    lastmodified: "2026-09-21T11:52:54Z"
+    mac: ENC[AES256_GCM,data:rgxYGqsksR8vTznjod8nB9sukqRpHTNuH1hdFCUr7HnE67fojNpz3WzOQvl8Su3JK+8Kj2fe9EodQT9VUkMiSywwSw30M9j3aaXlKj798PEIHDhJBWKhkMrQDyaTMla1Lrp5PuGHDdTQ/vmPNUyeQu3XitfcAma6SdX3e9w1J0s=,iv:Je5Fu9f7NPG/to5t+qOVMV195rwbITPy4JsOjouxiLU=,tag:BhlRWoreptzqYCe29/kXdg==,type:str]
     pgp:
         - created_at: "2026-01-24T17:01:26Z"
           enc: |-
@@ -62,4 +63,4 @@ sops:
             -----END PGP MESSAGE-----
           fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4
     unencrypted_suffix: _unencrypted
-    version: 3.11.0
+    version: 3.13.3

machines/overwatch/secrets.yaml

@@ -1,9 +1,9 @@
 grafana_admin: ENC[AES256_GCM,data:c+ZnOyxSXrG4eiK8ETKHheadiSz98LLHYwxb,iv:Ut2qFD2p6OmKDWjLMjFxyISxzTdJpZpgIB7obW5bgkY=,tag:HdayzjXQ1Zc7w9ITLzKLxA==,type:str]
 grafana_smtp: ENC[AES256_GCM,data:gOER9SzqRACIWe3PchyKguX3RdW6xhSZDzLd727CK1w=,iv:KDOyXGYGXnUu92hvt6eBqI8zeKP+JRDsF8Ir5X/9TDk=,tag:wRexcIJp8XEURKcZnHCRtQ==,type:str]
+private0_blackbox_config: ENC[AES256_GCM,data:seiw3jvNucIn8NfmYkOt9hxr17OgmydCzTSOfpmDsdL0sD8ZZ4cty0vO63f+cPzU5uWKDYOwCmFL1Rg+vefJFoXGGIHi0hjd4JNAADW3TJ5YMu91fHoB+0ikQcKsRdD8vAs3PjteohlvjBh3IuhHLcIk6NeE09yqBcHpVHbU0/Q1HUVF7gpO/4LK0V2FmJ3HTiWvo4qZNa3T,iv:OJuiotdqVT8ASeKj4Pa8RLn7TGze2O8ICwVB3BmLybk=,tag:fynrBmQOphqzwprhx0MYlA==,type:str]
 sops:
     age:
-        - recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
-          enc: |
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWdVhpdTdJNnh5VCtmNHh5
             M1ZTKzk1WlVYYmRWKzJxd1ZUTi9IMW1ta1VvCjVZQVQ1K1lFeC9QZkI2MGZXNk81
@@ -11,8 +11,8 @@ sops:
             NmRNSit1TkRRbUFQNzUvYThUczAxRzAKvpDK4R7m/GpfOzM4nU5vSYDXZGUy4D+c
             xouTxOguMdId8GiKb1AJnVv2q/YYdr2M9yA/FpKn7kBfuQw/Hrj1rg==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age1hq75x3dpnfqat9sgtfjf8lep49qvkdgza3xwp7ugft3kd74pdfnqfsmmdn
-          enc: |
+          recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0bEhCQitwNVpYSHRJOEMr
             ZnZLQ3lELzdtREVpSHVGd3BHZ3p6WU9BK3lFCkFlYXNsa2JWZmZFVjRmK3BTejc1
@@ -20,8 +20,9 @@ sops:
             VnRIYVVIZktISENseEVLVWlsenFhcVkKvj8i349iNX2YNL5G0w7F9IuW/5ZRP6Z7
             XC8TrYzCSOEOXt5nMnZg2yQUJHi6Qq8Wu2e2KV7Cd9J8Q/39dRv2cg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-01-24T16:52:54Z"
-    mac: ENC[AES256_GCM,data:BoJwPldIVZf2NZALbeMTq6DvuBMwOwyvmr5UjsPvQrdbbzYjLTl5dplkhT6QRHPDCFDT4Ibd1UfJ8pQYRkGdO2EjlUyuk3hvAYdR+PUmVz8afFE07sNsGw2EDGVHmsFjUVHLT69YqXtGpVNTW6KjqYuRhz/Ik0wEZLxzDSiy86c=,iv:TQU0si/AYaMpShF4l3CzUN3qajQpE0ZWa7mLOqhRP00=,tag:Oyapkoo4+Q7x08m6RTXfcQ==,type:str]
+          recipient: age1hq75x3dpnfqat9sgtfjf8lep49qvkdgza3xwp7ugft3kd74pdfnqfsmmdn
+    lastmodified: "2026-09-21T11:52:44Z"
+    mac: ENC[AES256_GCM,data:5/3fCS1QFmy4kHDCDklR+EwY/VPcb73pOI+rxDj44qlrR+1aRni97ZxdnvlfERy/Hkgsbk5UIKkj9+xMTcCW6Dqp1/zLf1YIL/xF1JVBIxBCVfNxWeS5XDsC0rORwgGi+BuRT4AuRdg2gu1cPwpbyJifpupNl9sOcaFcoctZ4NU=,iv:d2OQk8AIgHyQDOevKeeXi4sQStJF5KMky2ySwxmJrQs=,tag:KIkBsJlaGze4i43OoiXSVg==,type:str]
     pgp:
         - created_at: "2026-01-24T18:05:47Z"
           enc: |-
@@ -62,4 +63,4 @@ sops:
             -----END PGP MESSAGE-----
           fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4
     unencrypted_suffix: _unencrypted
-    version: 3.11.0
+    version: 3.13.3

machines/pretalx/configuration.nix

@@ -1,4 +1,4 @@
-{ config, self, lib, pkgs, inputs,  ... }:
+{ config, lib, pkgs, inputs,  ... }:
 
 with lib;
 
@@ -19,9 +19,12 @@ in
     useDHCP = false;
   };
 
+  disabledModules = [ "services/web-apps/pretalx.nix" ];
   imports = [
-    self.nixosModules.malobeo.metrics
-    self.nixosModules.malobeo.users
+    inputs.malobeo.nixosModules.malobeo.metrics
+    inputs.malobeo.nixosModules.malobeo.users
+
+    "${inputs.nixpkgs-unstable}/nixos/modules/services/web-apps/pretalx.nix"
     ../modules/sshd.nix
     ../modules/minimal_tools.nix
     ../modules/autoupdate.nix
@@ -35,6 +38,7 @@ in
 
   malobeo.users = {
     admin = true;
+    malobeo = false;
   };
 
 
@@ -78,6 +82,7 @@ in
       config.sops.secrets.pretalx_smtp.path
     ];
     settings = {
+      redis.session = false;
       locale = {
         language_code = "de";
       };

machines/testvm/configuration.nix

@@ -6,13 +6,18 @@ in
   imports =
     [ # Include the results of the hardware scan.
       #./hardware-configuration.nix
-      ../modules/malobeo_user.nix
+      inputs.malobeo.nixosModules.malobeo.users
+      inputs.malobeo.nixosModules.malobeo.initssh
+      inputs.malobeo.nixosModules.malobeo.disko
+
       ../modules/sshd.nix
       ../modules/minimal_tools.nix
-      inputs.self.nixosModules.malobeo.initssh
-      inputs.self.nixosModules.malobeo.disko
     ];
 
+  malobeo.users = {
+    admin = true;
+    malobeo = false;
+  };
 
   boot.initrd.systemd.enable = true;
   boot.loader.systemd-boot.enable = true;
@@ -51,7 +56,6 @@ in
   services.acpid.enable = true;
 
   networking.hostName = "testvm";
-  networking.networkmanager.enable = true;
 
   time.timeZone = "Europe/Berlin";
   system.stateVersion = "23.05"; # Do.. Not.. Change..

machines/uptimekuma/configuration.nix

@@ -9,10 +9,16 @@ with lib;
   };
 
   imports = [
-    ../modules/malobeo_user.nix
+    inputs.malobeo.nixosModules.malobeo.users
+
     ../modules/sshd.nix
   ];
 
+  malobeo.users = {
+    admin = true;
+    malobeo = false;
+  };
+
   networking.firewall.allowedTCPPorts = [ 80 ];
 
   services.nginx = {

machines/vaultwarden/configuration.nix

@@ -16,11 +16,17 @@ with lib;
   };
 
   imports = [
-    ../modules/malobeo_user.nix
+    inputs.malobeo.nixosModules.malobeo.users
+    inputs.malobeo.nixosModules.malobeo.metrics
+
     ../modules/sshd.nix
-    inputs.self.nixosModules.malobeo.metrics
   ];
 
+  malobeo.users = {
+    admin = true;
+    malobeo = false;
+  };
+
   networking.firewall.allowedTCPPorts = [ 80 ];
 
   malobeo.metrics = {

machines/vpn/configuration.nix

@@ -17,12 +17,18 @@ with lib;
   };
 
   imports = [
-    inputs.self.nixosModules.malobeo.vpn
-    ../modules/malobeo_user.nix
+    inputs.malobeo.nixosModules.malobeo.vpn
+    inputs.malobeo.nixosModules.malobeo.users
+
     ../modules/sshd.nix
     ../modules/minimal_tools.nix
   ];
 
+  malobeo.users = {
+    admin = true;
+    malobeo = false;
+  };
+
   services.malobeo.vpn = {
     enable = true;
     name = "vpn";

machines/wordpress/configuration.nix

@@ -0,0 +1,140 @@
+{ config, lib, pkgs, inputs, ... }:
+
+# 1. copy wp folder to host
+# 2. chown nginx:nginx wordpress.bak/rm16bleibt.org/* -R
+# 3. create user through webinterface
+# 4. delete hello world post
+# 5. run importer
+
+with lib;
+
+let
+
+  user = "wordpress";
+  stateDir = "/var/lib/wordpress/rm16bleibt.org";
+  webserver = config.services.nginx;
+  uploadsDir = "/var/lib/wordpress/rm16bleibt.org/wp-content/uploads";
+  fontsDir = "/var/lib/wordpress/rm16bleibt.org/wp-content/fonts";
+
+in {
+  networking = {
+    hostName = mkDefault "wordpress";
+    useDHCP = false;
+  };
+
+  imports = [
+    inputs.malobeo.nixosModules.malobeo.users
+
+    ../modules/sshd.nix
+  ];
+
+  malobeo.users = {
+    malobeo = false;
+    admin = true;
+  };
+
+  users.users.wordpress = {
+    group = webserver.group;
+    isSystemUser = true;
+  };
+
+  systemd.tmpfiles.rules = [
+    "d '${stateDir}' 0750 ${user} ${webserver.group} - -"
+    "d '${stateDir}/wp-content' 0750 ${user} ${webserver.group} - -"
+    "d '${uploadsDir}' 0750 ${user} ${webserver.group} - -"
+    "Z '${uploadsDir}' 0750 ${user} ${webserver.group} - -"
+    "d '${fontsDir}' 0750 ${user} ${webserver.group} - -"
+    "Z '${fontsDir}' 0750 ${user} ${webserver.group} - -"
+  ];
+
+  services.phpfpm.pools = {
+    "wordpress-rm16bleibt.org" = {
+      user = user;
+      group = webserver.group;
+      settings = {
+        "pm" = "dynamic";
+        "pm.max_children" = 32;
+        "pm.start_servers" = 2;
+        "pm.min_spare_servers" = 2;
+        "pm.max_spare_servers" = 4;
+        "pm.max_requests" = 500;
+        "listen.owner" = webserver.user;
+        "listen.group" = webserver.group;
+      };
+    };
+  };
+
+  services.mysql = {
+    enable = true;
+    #package = mkDefault pkgs.mariadb;
+    package = pkgs.mysql84;
+    ensureDatabases = ["wordpress"];
+    ensureUsers = [
+      {
+        name = "wordpress";
+        ensurePermissions = {
+          "wordpress.*" = "ALL PRIVILEGES";
+        };
+      }
+    ];
+  };
+
+  services.nginx = {
+    enable = true;
+    virtualHosts."_" = {
+      #serverName = "rm16bleibt.org";
+      root = "/var/lib/wordpress/rm16bleibt.org";
+      extraConfig = ''
+        index index.php;
+      '';
+      locations = {
+        "/" = {
+          priority = 200;
+          extraConfig = ''
+            try_files $uri $uri/ /index.php$is_args$args;
+          '';
+        };
+        "~ \\.php$" = {
+          priority = 500;
+          extraConfig = ''
+            fastcgi_split_path_info ^(.+\.php)(/.+)$;
+            fastcgi_pass unix:${config.services.phpfpm.pools."wordpress-rm16bleibt.org".socket};
+            fastcgi_index index.php;
+            include "${config.services.nginx.package}/conf/fastcgi.conf";
+            fastcgi_param PATH_INFO $fastcgi_path_info;
+            fastcgi_param PATH_TRANSLATED $document_root$fastcgi_path_info;
+
+            # Mitigate https://httpoxy.org/ vulnerabilities
+            fastcgi_param HTTP_PROXY "";
+            fastcgi_intercept_errors off;
+            fastcgi_buffer_size 16k;
+            fastcgi_buffers 4 16k;
+            fastcgi_connect_timeout 300;
+            fastcgi_send_timeout 300;
+            fastcgi_read_timeout 300;
+          '';
+        };
+        "~ /\\." = {
+          priority = 800;
+          extraConfig = "deny all;";
+        };
+        "~* /(?:uploads|files)/.*\\.php$" = {
+          priority = 900;
+          extraConfig = "deny all;";
+        };
+        "~* \\.(js|css|png|jpg|jpeg|gif|ico)$" = {
+          priority = 1000;
+          extraConfig = ''
+            expires max;
+            log_not_found off;
+          '';
+        };
+      };
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = [ 80 ];
+
+  system.stateVersion = "22.11"; # Did you read the comment?
+}
+

machines/zineshop/configuration.nix

@@ -1,4 +1,4 @@
-{ self, config, lib, pkgs, inputs, ... }:
+{ config, lib, pkgs, inputs, ... }:
 
 with lib;
 
@@ -11,11 +11,17 @@ with lib;
   imports = [
     inputs.malobeo.nixosModules.malobeo.metrics
     inputs.malobeo.nixosModules.malobeo.printing
+    inputs.malobeo.nixosModules.malobeo.users
     inputs.zineshop.nixosModules.zineshop
-    ../modules/malobeo_user.nix
+
     ../modules/sshd.nix
   ];
 
+  malobeo.users = {
+    admin = true;
+    malobeo = false;
+  };
+
   malobeo.metrics = {
     enable = true;
     enablePromtail = true;

scripts/unlock-boot.sh

@@ -1,4 +1,3 @@
-set -o errexit
 set -o pipefail
 
 sshoptions="-o StrictHostKeyChecking=no -o ServerAliveInterval=1 -o ServerAliveCountMax=1 -p 222 -T"