Update flake.lock

Reviewed-on: #132

flake.lock

@@ -7,11 +7,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1746728054,
+        "lastModified": 1768920986,
-        "narHash": "sha256-eDoSOhxGEm2PykZFa/x9QG5eTH0MJdiJ9aR00VAofXE=",
+        "narHash": "sha256-CNzzBsRhq7gg4BMBuTDObiWDH/rFYHEuDRVOwCcwXw4=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "ff442f5d1425feb86344c028298548024f21256d",
+        "rev": "de5708739256238fb912c62f03988815db89ec9a",
         "type": "github"
       },
       "original": {
@@ -78,24 +78,6 @@
         "type": "github"
       }
     },
-    "flake-utils_2": {
-      "inputs": {
-        "systems": "systems_3"
-      },
-      "locked": {
-        "lastModified": 1731533236,
-        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
     "home-manager": {
       "inputs": {
         "nixpkgs": [
@@ -138,18 +120,17 @@
     },
     "microvm": {
       "inputs": {
-        "flake-utils": "flake-utils_2",
         "nixpkgs": [
           "nixpkgs"
         ],
         "spectrum": "spectrum"
       },
       "locked": {
-        "lastModified": 1764549796,
+        "lastModified": 1773018425,
-        "narHash": "sha256-Mswg665P92EoHkBwCwPr/7bdnj04g2Qfb+t02ZEYTHA=",
+        "narHash": "sha256-fpgZBmZpKoEXEowBK/6m8g9FcOLWQ4UxhXHqCw2CpSM=",
         "owner": "astro",
         "repo": "microvm.nix",
-        "rev": "030d055e877cc13d7525b39f434150226d5e4482",
+        "rev": "25ebda3c558e923720c965832dc9a04f559a055c",
         "type": "github"
       },
       "original": {
@@ -181,11 +162,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1764234087,
+        "lastModified": 1769813415,
-        "narHash": "sha256-NHF7QWa0ZPT8hsJrvijREW3+nifmF2rTXgS2v0tpcEA=",
+        "narHash": "sha256-nnVmNNKBi1YiBNPhKclNYDORoHkuKipoz7EtVnXO50A=",
         "owner": "nix-community",
         "repo": "nixos-generators",
-        "rev": "032a1878682fafe829edfcf5fdfad635a2efe748",
+        "rev": "8946737ff703382fda7623b9fab071d037e897d5",
         "type": "github"
       },
       "original": {
@@ -196,11 +177,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1764440730,
+        "lastModified": 1772972630,
-        "narHash": "sha256-ZlJTNLUKQRANlLDomuRWLBCH5792x+6XUJ4YdFRjtO4=",
+        "narHash": "sha256-mUJxsNOrBMNOUJzN0pfdVJ1r2pxeqm9gI/yIKXzVVbk=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "9154f4569b6cdfd3c595851a6ba51bfaa472d9f3",
+        "rev": "3966ce987e1a9a164205ac8259a5fe8a64528f72",
         "type": "github"
       },
       "original": {
@@ -228,11 +209,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1764517877,
+        "lastModified": 1772963539,
-        "narHash": "sha256-pp3uT4hHijIC8JUK5MEqeAWmParJrgBVzHLNfJDZxg4=",
+        "narHash": "sha256-9jVDGZnvCckTGdYT53d/EfznygLskyLQXYwJLKMPsZs=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "2d293cbfa5a793b4c50d17c05ef9e385b90edf6c",
+        "rev": "9dcb002ca1690658be4a04645215baea8b95f31d",
         "type": "github"
       },
       "original": {
@@ -244,11 +225,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1764522689,
+        "lastModified": 1773068389,
-        "narHash": "sha256-SqUuBFjhl/kpDiVaKLQBoD8TLD+/cTUzzgVFoaHrkqY=",
+        "narHash": "sha256-vMrm7Pk2hjBRPnCSjhq1pH0bg350Z+pXhqZ9ICiqqCs=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "8bb5646e0bed5dbd3ab08c7a7cc15b75ab4e1d0f",
+        "rev": "44bae273f9f82d480273bab26f5c50de3724f52f",
         "type": "github"
       },
       "original": {
@@ -283,11 +264,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1764483358,
+        "lastModified": 1773096132,
-        "narHash": "sha256-EyyvCzXoHrbL467YSsQBTWWg4sR96MH1sPpKoSOelB4=",
+        "narHash": "sha256-M3zEnq9OElB7zqc+mjgPlByPm1O5t2fbUrH3t/Hm5Ag=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "5aca6ff67264321d47856a2ed183729271107c9c",
+        "rev": "d1ff3b1034d5bab5d7d8086a7803c5a5968cd784",
         "type": "github"
       },
       "original": {
@@ -299,11 +280,11 @@
     "spectrum": {
       "flake": false,
       "locked": {
-        "lastModified": 1759482047,
+        "lastModified": 1772189877,
-        "narHash": "sha256-H1wiXRQHxxPyMMlP39ce3ROKCwI5/tUn36P8x6dFiiQ=",
+        "narHash": "sha256-i1p90Rgssb//aNiTDFq46ZG/fk3LmyRLChtp/9lddyA=",
         "ref": "refs/heads/main",
-        "rev": "c5d5786d3dc938af0b279c542d1e43bce381b4b9",
+        "rev": "fe39e122d898f66e89ffa17d4f4209989ccb5358",
-        "revCount": 996,
+        "revCount": 1255,
         "type": "git",
         "url": "https://spectrum-os.org/git/spectrum"
       },
@@ -372,21 +353,6 @@
         "type": "github"
       }
     },
-    "systems_5": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    },
     "tasklist": {
       "inputs": {
         "nixpkgs": [
@@ -445,7 +411,7 @@
     },
     "utils_3": {
       "inputs": {
-        "systems": "systems_4"
+        "systems": "systems_3"
       },
       "locked": {
         "lastModified": 1731533236,
@@ -463,7 +429,7 @@
     },
     "utils_4": {
       "inputs": {
-        "systems": "systems_5"
+        "systems": "systems_4"
       },
       "locked": {
         "lastModified": 1731533236,

machines/.sops.yaml

@@ -15,6 +15,7 @@ keys:
   - &machine_fanny age136sz3lzhxf74ryruvq34d4tmmxnezkqkgu6zqa3dm582c22fgejqagrqxk
   - &machine_nextcloud age1g084sl230x94mkd2wq92s03mw0e8mnpjdjfx9uzaxw6psm8neyzqqwpnqe
   - &machine_vaultwarden age1zs9puemeevc5kt84w9d2mc5396w0t9p60qxymkpatwvwxunzs5usmxr3an
+  - &machine_pretalx age1y04q8n7mgk82c87rfddm0u72h0ny6sfzktjsk0cc3gu93kezudfqdp9v9g
   #this dummy key is used for testing.
   - &machine_dummy age18jn5mrfs4gqrnv0e2sxsgh3kq4sgxx39hwr8z7mz9kt7wlgaasjqlr88ng
 creation_rules:
@@ -105,6 +106,14 @@ creation_rules:
       age:
       - *admin_atlan
       - *machine_vaultwarden
+  - path_regex: pretalx/secrets.yaml$
+    key_groups:
+    - pgp:
+      - *admin_kalipso
+      - *admin_kalipso_dsktp
+      age:
+      - *admin_atlan
+      - *machine_pretalx
   - path_regex: .*/secrets/.*
     key_groups:
     - pgp:

machines/durruti/host_config.nix

@@ -63,6 +63,16 @@ in
       };
     };
 
+    services.nginx.virtualHosts."events.malobeo.org" = {
+      forceSSL = true;
+      enableACME= true;
+      locations."/" = {
+        proxyPass = "http://10.0.0.10";
+        extraConfig = ''
+        '';
+      };
+    };
+
     services.nginx.virtualHosts."tasklist.malobeo.org" = {
       forceSSL = true;
       enableACME= true;

machines/fanny/configuration.nix

@@ -145,6 +145,7 @@ in
     "durruti" 
     "zineshop"
     "vaultwarden"
+    "pretalx"
   ];
 
   networking = {
@@ -229,6 +230,15 @@ in
       };
     };
 
+    virtualHosts."events.malobeo.org" = {
+      locations."/" = {
+        proxyPass = "http://${hosts.malobeo.hosts.pretalx.network.address}";
+        extraConfig = ''
+          proxy_set_header Host $host;
+        '';
+      };
+    };
+
     virtualHosts."tasklist.malobeo.org" = {
       locations."/" = {
         proxyPass = "http://${hosts.malobeo.hosts.durruti.network.address}:8080";

machines/hosts.nix

@@ -103,6 +103,11 @@ in
         type = "microvm";
         network = createMaloNet "17" "52:DA:0D:F9:EF:F3";
       };
+
+      pretalx = {
+        type = "microvm";
+        network = createMaloNet "18" "52:DA:0D:F9:EF:F4";
+      };
     };
   };
 }

machines/louise/configuration.nix

@@ -42,6 +42,7 @@
       mpv
       vlc
       simple-scan
+      bitwarden-desktop
     ];
   };
 

machines/modules/malobeo/microvm_host.nix

@@ -14,6 +14,12 @@ in
         description = lib.mdDoc "Setup bridge device for microvms.";
       };
 
+      testHost = mkOption {
+        default = false;
+        type = types.bool;
+        description = lib.mdDoc "Enable when the host is used for development and testing using run-vm";
+      };
+
       interface = mkOption {
         default = "eno1";
         type = types.str;
@@ -68,7 +74,7 @@ in
     systemd.network = mkIf (cfg.enableHostBridge || cfg.enableHostBridgeUnstable) {
       enable = true;
       networks."10-lan" = {
-        matchConfig.Name = [ "${cfg.interface}" "vm-*"];
+        matchConfig.Name = ["vm-*"] ++ (if !cfg.testHost then [ "${cfg.interface}" ] else [ ]);
         networkConfig = {
           Bridge = "malobeo0";
         };
@@ -81,7 +87,7 @@ in
         };
       };
       
-      networks."10-lan-bridge" = {
+      networks."10-lan-bridge" = if !cfg.testHost then {
         matchConfig.Name = "malobeo0";
         networkConfig = {
           Address = [ "${cfg.address}" ];
@@ -90,6 +96,17 @@ in
           IPv6AcceptRA = true;
         };
         linkConfig.RequiredForOnline = "routable";
+      } else {
+        matchConfig.Name = "malobeo0";
+        networkConfig = {
+          DHCPServer = true;
+          IPv6SendRA = true;
+        };
+        addresses = if cfg.enableHostBridgeUnstable then [
+          { Address = "10.0.0.1/24"; }
+        ] else [
+          { Address = "10.0.0.1/24"; }
+        ];
       };
     }; 
 

machines/overwatch/configuration.nix

@@ -144,6 +144,18 @@ in
           targets = [ "${hosts.malobeo.hosts.zineshop.network.address}:9002" ];
         }];
       }
+      {
+        job_name = "vaultwarden";
+        static_configs = [{
+          targets = [ "${hosts.malobeo.hosts.vaultwarden.network.address}:9002" ];
+        }];
+      }
+      {
+        job_name = "pretalx";
+        static_configs = [{
+          targets = [ "${hosts.malobeo.hosts.pretalx.network.address}:9002" ];
+        }];
+      }
       {
         job_name = "fanny";
         static_configs = [{

machines/pretalx/configuration.nix

@@ -0,0 +1,99 @@
+{ config, self, lib, pkgs,  ... }:
+
+with lib;
+
+let
+  hosts = import ../hosts.nix {};
+in
+{
+  sops.defaultSopsFile = ./secrets.yaml;
+  sops.secrets = {
+    pretalx_smtp = {
+      owner = "pretalx";
+      group = "pretalx";
+    };
+  };
+
+  networking = {
+    hostName = mkDefault "pretalx";
+    useDHCP = false;
+  };
+
+  imports = [
+    self.nixosModules.malobeo.metrics
+    self.nixosModules.malobeo.users
+    ../modules/sshd.nix
+    ../modules/minimal_tools.nix
+    ../modules/autoupdate.nix
+  ];
+
+  malobeo.metrics = {
+    enable = true;
+    enablePromtail = true;
+    logNginx = true;
+  };
+
+  malobeo.users = {
+    admin = true;
+  };
+
+
+  services.postgresqlBackup = {
+    enable = true;
+  };
+
+  services.nginx = {
+    enable = true;
+    commonHttpConfig = /* nginx */ ''
+      proxy_headers_hash_bucket_size 64;
+    '';
+    virtualHosts = {
+      "events.malobeo.org" = {
+        forceSSL = false;
+        enableACME = false;
+      };
+    };
+  };
+
+
+  services.pretalx = {
+    enable = true;
+    celery.extraArgs = [
+      "--concurrency=${toString config.microvm.vcpu}"
+    ];
+    gunicorn.extraArgs = [
+      # https://docs.pretalx.org/administrator/installation/#step-6-starting-pretalx-as-a-service
+      "--log-level=info"
+      "--max-requests-jitter=50"
+      "--max-requests=1200"
+      "--workers=${toString config.microvm.vcpu}"
+
+      # TODO: 25.11 upstream
+      "--name=pretalx"
+      "--preload"
+    ];
+    nginx.domain = "events.malobeo.org";
+    environmentFiles = [
+      config.sops.secrets.pretalx_smtp.path
+    ];
+    settings = {
+      locale = {
+        language_code = "de";
+      };
+      mail = {
+        from = "malobot@systemli.org";
+        user = "malobot@systemli.org";
+        host = "mail.systemli.org";
+        port = "465";
+        ssl = true;
+        tls = false;
+      };
+
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
+
+  system.stateVersion = "22.11"; # Did you read the comment?
+}
+

machines/pretalx/dummy.yaml

@@ -0,0 +1,64 @@
+pretalx_smtp: ENC[AES256_GCM,data:zYnhuulpJAEEacXxpqNG2GEVrV21H0UZfx3sqZaZxWYL2HW6WwFMZ2PeGL8bWCv92+iZ2DGkhg==,iv:kMJLfeQ+9ZZFc6T+HnS64p9BJUy38nXrakAOXdQ0gIU=,tag:l8/eSrcOtt9MLnqcif5v2A==,type:str]
+sops:
+    age:
+        - recipient: age18jn5mrfs4gqrnv0e2sxsgh3kq4sgxx39hwr8z7mz9kt7wlgaasjqlr88ng
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNZXExRE14NDF6cnFRSE9G
+            RjdxV09UMXUvczBQai9GQW5PT2g0eUZhSUVvClRZL1dJVlpKUTArTkhhR2JCV1VG
+            cktFb21wNDZiZC9oc2l5VS9hdzVhbFUKLS0tIGZZa2Z2R0Nvd3RUbWRHMkFJMjVK
+            QXdRdkVwSFg2TVRBYU1qWFJ2bE9hWFUK8HuJ9ErFU0yH3QlXl1tnmawNX0fHDOFb
+            g+DpDYKccGcC6PxNOE/CsftJqGLtFlToYHOYWG18bFjNZawUoaOfLQ==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3S0s4UlZuSWc3K3cvTDBR
+            WEt2L3hYSGRVWHBYbEtoci9rYkJEK1hYSkRZCkM5S25YNGM2Y3R0MG9lWUNJem9P
+            bnJXbTRFZUpUVmhWVVVqeVhjdDV2SWMKLS0tIEdXbXU0RkJ6ZzBTcTdiZlJPbG83
+            RW8zUzBkNjViYnVFY3MyM1ZENmZXVmcK4144dF921EuNaofNhaYw9Yh56KHdfQD/
+            vxPkp5jC02Wbb6hjImd+oMUg3jgCbWC4j3Qpvaky8Ig2AaJRhtqlxg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-03-09T11:58:41Z"
+    mac: ENC[AES256_GCM,data:n11H0rFtXvCeleTKXnQ8tORm3YH11tvjRd/PYSRof8EIUpQ7ZtyVqdYqPZCUuck12LG8hh9+GBBpXIRDhwEJlteC61Vl0syW9bQvCbfETvIgRZsoIZr+mofYHe1twm73sd7YaGzC6xxVm5HZG/qS1LflHah6jFO6NkgQ0GpLPTE=,iv:np3bKJIbVwn96rMBeedLmw6f1him35waUWN6LJ5MLNk=,tag:fs8rmrSkK1REaUKJHxeSbw==,type:str]
+    pgp:
+        - created_at: "2026-03-09T11:58:34Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQGMA5HdvEwzh/H7AQv/VMIZlsBZPEolTd0yUfHyZ5PRsQDirt4hOuVFGXdKi8tb
+            Pk+L3y69ynfF+ZJsu41+GdVgaNX58bbdqJfnEgE+k35IrJxYmVlNuUmd5s79rOHQ
+            b1dn6SdoVrKTAgtrnicO0n0F41XZBSpqP4wKVHigsWgfHkaUUsI+5d/T/2F+VCcS
+            slhvveCMKNjDlK9sukp5TBiX+xrWTq4QIbMS7L6VSlwHod72bp73o7RV9PgoO4vy
+            aodYiPmJqDjF0Az7JXdu2UdWJGUYxNWb5jHCT3qpcZyX1kVSmZvcRjxtVVCySFx+
+            agcavtdlEV3t8JOOvVmYoxwNOGjDvJ83k6wdueFpoJFE4Z1pHy/XCVCHykmWH/+m
+            nYADzmg+GiOSrTR2xWEmkesrByOMucYiZngDV3RLuZraE+8PJbqX2aAAip1Ol6AX
+            eYGCtLw/cXvDM1ngdj/4vaelek/TMLRRmuDyzVHevnqMGhdgAp4Ns6+ihZajSYkK
+            4YqUSKOMHrfEwbZgGYGW0lgB4cv1uzPgyufcPWzg8oAS0/2jW6KjZPLIx4SYcp41
+            C3BE/osbnyzGhzmabNstFbVmBYF1iK73O/Np2PGj3glBsE7PNMmcDu4ASaEI1nNw
+            CpOmQCR9jRGi
+            =6itD
+            -----END PGP MESSAGE-----
+          fp: c4639370c41133a738f643a591ddbc4c3387f1fb
+        - created_at: "2026-03-09T11:58:34Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA98TrrsQEbXUAQ//aQNOD855rikMtrXENG/XA5dZeKGaLQAv0kWUHuJbRddn
+            IB9pW+Y8AgyB6xc9A4oKOKgjT8TCSYvGI6zDchf5tjrvQwmiMlpQouflcjR+UgDy
+            mANqL2+7GLFVcTuQfRPbEdK54Q78KciQ2bxMeh0WDZ5vV8fCTz+aPsvlNT8AJBcq
+            BO4dyG1oqCT13ln7g7LoHPn22wAj+H93F8aqyFk6YjgomKRf0j9gAW/NI1w8TIsg
+            etgMBrn0AupANrADQHAij1zSS+GaK8ZMBVgCoInc9gAQl97ytMLp/eQj4Ll69r+z
+            JRhFdFDZgP0UIIFurAU5eFixNq8IZnFYvFRGpR/XzAiOh8JfgWUDs5HSLyRcADi9
+            XxLsEnTFm1kfoI+lpma0WtlAIXg2WpCoaU3B2kB15T4giVs6LWGmssux5t8uKTFR
+            DySHvdl9o78zBFPVxhW+j9h04fAeUmCWZYKpnEdFwKpBmGWtnC5rvz22Xwu3Q/wT
+            HioLzvETqVn+knc/ErR6Axw4A9zeLi1AccJdceVopR7rEq+0DjpLV/zYqwGruQaa
+            q1qtQIgPf888TKtNgAGSxQ2nUfkMM2oK2cC6r2juhxwbmTFcz6FUV41To9/hCo1c
+            1SE4ZiRu7R8i+KFn4K2y6RGRkJo75trJkxuwGvAYuo6gGUmj50EeimFx0rKRddfS
+            WAH8JPQH6ohAqaA1hdrQRM7lPtwjPCfJW/fUqPHAR5Ytwn9xmt0A+jQYvmubH9dR
+            UT8OMUOIh2XC2JDYt4P4pFXXODB6WPb3Fdft6S95+vLhx6eHuo7PvVM=
+            =KkYj
+            -----END PGP MESSAGE-----
+          fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4
+    unencrypted_suffix: _unencrypted
+    version: 3.11.0

machines/pretalx/secrets.yaml

@@ -0,0 +1,64 @@
+pretalx_smtp: ENC[AES256_GCM,data:Jrgx1/AsgTb1KxtgiTPGRkgtl5EHPWHPde4ItwOHH9lcmakAb1b2n4JP70vF53uuKIfiyCPeVQ==,iv:fcVFgjKSGTaFxC1DAX2Sb6WD/IbJO0s1A63wrQkLWbg=,tag:NjcNwa+6h/boRemEg1j9ng==,type:str]
+sops:
+    age:
+        - recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxb1dGalUyNzVtYjFFNm9T
+            a3ord2NSTEE3UkhrTm1TbHdMV3lITHJRLzJvCnAxeUZib0d0dCtUZ0x3NUtsdzdD
+            SjVYY0Y4MXhGRVZGZTRiNHJHSHNkb0kKLS0tIGtCL0puTDRZcUsrc2VRUU1URERs
+            Y084Z0tGR3JPZkw5ci9icFVSd051bE0KXaT1mPUBFUorZ/zgYjDyqWGbnHAkcjmZ
+            KVZJae9HC35+mq9mme7XOH96NX6tq69Hg+TUFoQg1m2Ifz27GKD3bQ==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1y04q8n7mgk82c87rfddm0u72h0ny6sfzktjsk0cc3gu93kezudfqdp9v9g
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWVVJyZFZCTVZhUXN0WFJu
+            UWU2UWxTY3ErWHVhMGNGU0t3N0c2ekM5a0NvCkVtTDdyeEVMQzY5RUg1NnVZVHd1
+            a1U4cytPSjU3K0NaSmJDdk5peHM5emMKLS0tIGhTemxzbjBzNkFILy9QRG53V0lX
+            dEZTQVpCOUNDSW0yRS9rYkZkVjZPRG8K/Hea01veMQ0Gxo//24PRhDcncYUuExpQ
+            T4ff4CNXF2vDYDsSIPDlhHdmSRGmoCw00ChCZ8vvIlHl2O86Qmd0Ng==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-03-09T11:58:07Z"
+    mac: ENC[AES256_GCM,data:QWFdEg+I1YUH65qPUQvOwwb7i+X+HYKdhYJiLoku+XcvYq4xFaoBvFTW3eZ/S2i20yK1SQcAVjUe7JQEgZDtqzPdZH6w4YIZJVvQdDMPy99xdXXEZrnW+rHOy60XFS7WiyeUdLA3TQ4+Ec1f2kkQw7MhbDbOoOh0obsvfhtz3OE=,iv:h4Qn/LpayhXCWWsO/nm18Rapz6WXQcjItF9YwyiFJJ0=,tag:bxtQQMNgVyFkHp+pbSP3UQ==,type:str]
+    pgp:
+        - created_at: "2026-03-09T11:57:24Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQGMA5HdvEwzh/H7AQwAkahLpq8vqQn6N5EyrbC+33Ohl61ZbBPR6NnQaLvU3s+i
+            WJ3xe7T+LP0jv2C2t//VhYvVNolQ2LBA+yLE3Cvjw6JCyVhu54ZRDJciY2w/wY5J
+            MN++Bqac6avoEYHkvoN6m1/F8JK46fzgQT7xXFTGix+g1W48aSC70GRZUmsg469p
+            ZFYbj/mEseG1ICxhZANU2NgRgW7kA/La/fe3/+YE8tkNHSXF2ZevQvluarm7kXT9
+            KWani1wMlUMwZoCpwbfNwKpXPL0jW48FJsFIlxPbDrDCkR1gih1PHFVyqd45am9g
+            Uo0hJ1NOKzm5Cy5c/3xJzaP62UWyNJf+v5VojEg2XfSGqtaZDFQsLK0of5G/XArn
+            C7k7UbQJqz15rHWPznIppv2h+cTIsVDQcz77es1/qaOQyCMHdYqdkzi5YV7DJBZS
+            K6PP3Nt77uL4LGRL0vFtBgdhKFtXAAf8lhRfZJcJ2P9BYvaFdRUfjm/r0TNfCref
+            k2WCesk4F/pQSyB3ofuR0lYBJzlZ3iNpl7DlfyZ6DRZ/+aVFceRf9A8QKtkVmdMt
+            noqBJfLzhWgVmUUh3DO97mJV5pNOx8238vqVTxWrUqZXjXdXaUDaFUDXvgwg3GOA
+            N28ZjLy1XA==
+            =mIVi
+            -----END PGP MESSAGE-----
+          fp: c4639370c41133a738f643a591ddbc4c3387f1fb
+        - created_at: "2026-03-09T11:57:24Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA98TrrsQEbXUAQ//cnVHHJEwQn+W8Jkt+jwgnKCgbRutvG3U8hlXizzdk2RI
+            j6nVPpv2DwuXvX3ktnng8XrmWwXf9rFRRltVs7alenEnHLxiDd5w+WYeH4NCHOFr
+            +vvFwxNOxzLDj5B2Fjod4El70jUdrP6Mqzy37DPu1Gb2qIUEwdF1LEzM4FMWdeWL
+            BA0wCJzlTXzdlb0shw7xEsqvmnL11u+aQ8AVU3kgWxSkn0VZJIYYkwegUYfflSIr
+            wZsNsh8k+wG58f5IVr8SqnzkfxRfJSoxNKWV9dK3a9hJnnD3DUhqnOgvCnPCRKSP
+            drH+7KxqmNBxqQK3f2iJvgcyLQwyEEqF2Rt6gXwyDByHy3ewupAQD0aQwi5HMWcK
+            iEUVSQVZ6jRfAIyDs3sBnBHceB9BShFr+NN9eUjKJWm2QD4TdQamnpMLsQGpdZv5
+            Lomk9VfdZPNw7DAKJs1oDeBRmhAP/crlOW/ZZho9mewKHr7Htu3VZP812GVupJns
+            IK9mMnpwAhgCtChcOj/ule9NcA/AWKcrtdAyId11SvjtMO+ZjRFrOCK1wKgIif3p
+            ogjaK38v/7gy4/8CDyVgru+luNklsRHfZr+BuPGBDDL8M7umXilK+GyGO1CnrjxW
+            DJXdvMe+u75OsYvGv7eX0tqd+ePanCEoDXxFJbMc2QZigD2kZgq+qRM9CxJ2jCXS
+            VgEEHybyGrOo5RcJkpk+UQpb2aTMLgFNqkTn0PRQSMFeXVQIt584a9xZs1TQ7ZsT
+            5H4jaFXFcS+GG09CORbkf2fkQI2KpaqBAGFct21K2hY17Tpm7kgC
+            =yGms
+            -----END PGP MESSAGE-----
+          fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4
+    unencrypted_suffix: _unencrypted
+    version: 3.11.0

machines/vaultwarden/configuration.nix

@@ -18,10 +18,17 @@ with lib;
   imports = [
     ../modules/malobeo_user.nix
     ../modules/sshd.nix
+    inputs.self.nixosModules.malobeo.metrics
   ];
 
   networking.firewall.allowedTCPPorts = [ 80 ];
 
+  malobeo.metrics = {
+    enable = true;
+    enablePromtail = true;
+    logNginx = true;
+  };
+
   services.nginx = {
     enable = true;
     virtualHosts."keys.malobeo.org" = {

machines/vpn/configuration.nix

@@ -58,6 +58,15 @@ with lib;
       };
     };
 
+    virtualHosts."events.malobeo.org" = {
+      locations."/" = {
+        proxyPass = "http://10.100.0.101";
+        extraConfig = ''
+          proxy_set_header Host $host;
+        '';
+      };
+    };
+
     virtualHosts."tasklist.malobeo.org" = {
       locations."/" = {
         proxyPass = "http://10.100.0.101";