WIP

.gitea/workflows/autoupdate.yml

@@ -1,110 +0,0 @@
-name: Weekly Flake Update
-
-on:
-    schedule:
-        - cron: "0 0 * * 4"
-    workflow_dispatch:
-
-permissions:
-    contents: write
-
-jobs:
-    update_and_check_flake:
-        runs-on: ubuntu-latest
-        env:
-            NIXPKGS_ALLOW_UNFREE: 1
-        steps:
-            - name: Install sudo
-              run: |
-                  apt-get update
-                  apt-get install -y sudo
-            - name: Install Tea
-              env:
-                TEA_DL_URL: "https://dl.gitea.com/tea/0.9.2/tea-0.9.2-linux-amd64"
-              shell: bash
-              run: |
-                TEA_DIR=$(mktemp -d -t tmp.XXXX)
-                pushd $TEA_DIR
-                wget "$TEA_DL_URL"
-                wget "${TEA_DL_URL}.sha256"
-                if $(sha256sum --quiet -c "tea-0.9.2-linux-amd64.sha256"); then
-                mv "tea-0.9.2-linux-amd64" /usr/bin/tea
-                chmod +x /usr/bin/tea
-                popd
-                rm -rf $TEA_DIR
-                else
-                popd
-                rm -rf $TEA_DIR
-                echo "::error title=⛔ error hint::Tea v0.9.2 Checksum Failed"
-                exit 1
-                fi
-            - uses: https://code.forgejo.org/actions/checkout@v6
-            - name: Set up Nix
-              uses: https://github.com/cachix/install-nix-action@v31
-              with: 
-                github_access_token: ${{ secrets.AHTLONS_GITHUB_TOKEN }} #Fuck github
-
-            - name: Run nix flake update
-              run: nix flake update
-
-            - name: Commit flake.lock
-              run: |
-                  git config user.name "malobot"
-                  git config user.email "malobot@systemli.org"
-                  git stash push
-                  git branch nixpkgs_bump_$(date +%Y%m%d)
-                  git checkout nixpkgs_bump_$(date +%Y%m%d)
-                  git stash pop
-                  git add flake.lock
-                  git diff --staged --quiet || git commit -m "Update flake.lock"
-
-            - name: Check for eval warnings
-              id: commit
-              shell: bash
-              run: |
-                {
-                echo "COMMIT_DESC<<EOF"
-                echo "Date: $(date)"
-                echo "Evaluation warnings:"
-                nix flake check --all-systems --no-build 2>&1 | grep evaluation | awk '!seen[$0]++' || echo "None :)"
-                echo EOF
-                } >> "$GITHUB_OUTPUT"
-            
-            
-            - name: Login to Gitea
-              shell: bash
-              env:
-                GIT_SERVER_URL: https://git.dynamicdiscord.de
-                GIT_SERVER_TOKEN: ${{ secrets.AHTLONS_GITEA_TOKEN }}
-              run: >-
-                tea login add
-                -u "$GIT_SERVER_URL"
-                -t "$GIT_SERVER_TOKEN"
-            - name: Check for existing pull request
-              id: no-pr
-              continue-on-error: true
-              shell: bash
-              run: >-
-                tea pr -f head -o simple |
-                grep -q ${{ github.ref_name }} &&
-                exit 1 ||
-                exit 0
-            - name: Force push branch
-              run: git push --force -u origin nixpkgs_bump_$(date +%Y%m%d)
-            - name: Create pull request
-              if: steps.no-pr.outcome == 'success'
-              env:
-                COMMIT_MSG: Automatic Nixpkgs update
-                COMMIT_DESC: ${{ steps.commit.outputs.COMMIT_DESC }}
-              shell: bash
-              run: >-
-                tea pr create
-                -L "bump"
-                -t "$COMMIT_MSG"
-                -d "$COMMIT_DESC"
-            - name: Skip pull request
-              if: steps.no-pr.outcome == 'failure'
-              shell: bash
-              run: >
-                echo "::error title=⛔ error hint::
-                A PR already exists for this branch: ${{ github.ref_name }}"

flake.lock

@@ -21,27 +21,6 @@
         "type": "github"
       }
     },
-    "dns": {
-      "inputs": {
-        "flake-utils": "flake-utils",
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1768143854,
-        "narHash": "sha256-E5/kyPz4zAZn/lZdvqlF83jMgCWNxmqYjjWuadngCbk=",
-        "owner": "kirelagin",
-        "repo": "dns.nix",
-        "rev": "a97cf4156e9f044fe4bed5be531061000dfabb07",
-        "type": "github"
-      },
-      "original": {
-        "owner": "kirelagin",
-        "repo": "dns.nix",
-        "type": "github"
-      }
-    },
     "ep3-bs": {
       "inputs": {
         "nixpkgs": [
@@ -64,21 +43,6 @@
       }
     },
     "flake-utils": {
-      "locked": {
-        "lastModified": 1614513358,
-        "narHash": "sha256-LakhOx3S1dRjnh0b5Dg3mbZyH0ToC9I8Y2wKSkBaTzU=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "5466c5bbece17adaab2d82fae80b46e807611bf3",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "flake-utils_2": {
       "inputs": {
         "systems": "systems_3"
       },
@@ -138,7 +102,7 @@
     },
     "microvm": {
       "inputs": {
-        "flake-utils": "flake-utils_2",
+        "flake-utils": "flake-utils",
         "nixpkgs": [
           "nixpkgs"
         ],
@@ -261,7 +225,6 @@
     "root": {
       "inputs": {
         "disko": "disko",
-        "dns": "dns",
         "ep3-bs": "ep3-bs",
         "home-manager": "home-manager",
         "mfsync": "mfsync",
@@ -487,11 +450,11 @@
         "utils": "utils_4"
       },
       "locked": {
-        "lastModified": 1768820076,
+        "lastModified": 1764942243,
-        "narHash": "sha256-0vnIYuWvsYasbHZHUjAcK9FR0kxkRRtzYG661VEtoPU=",
+        "narHash": "sha256-P02Zm0VAON9SqRxqe6h5vfxgpCBYeiz5JPWGIn6KFFg=",
         "ref": "refs/heads/master",
-        "rev": "cfdfae84bb045ae429f0760eba708468871b1738",
+        "rev": "f56b7eb6887b7e0fecae4a1f4c1311392eebad8d",
-        "revCount": 159,
+        "revCount": 156,
         "type": "git",
         "url": "https://git.dynamicdiscord.de/kalipso/zineshop"
       },

flake.nix

@@ -13,11 +13,6 @@
     disko.url = "github:nix-community/disko/latest";
     disko.inputs.nixpkgs.follows = "nixpkgs";
 
-    dns = {
-      url = "github:kirelagin/dns.nix";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-
     utils = {
       url = "github:numtide/flake-utils";
     };

machines/.sops.yaml

@@ -14,7 +14,6 @@ keys:
   - &machine_vpn age1v6uxwej4nlrpfanr9js7x6059mtvyg4fw50pzt0a2kt3ahk7edlslafeuh
   - &machine_fanny age136sz3lzhxf74ryruvq34d4tmmxnezkqkgu6zqa3dm582c22fgejqagrqxk
   - &machine_nextcloud age1g084sl230x94mkd2wq92s03mw0e8mnpjdjfx9uzaxw6psm8neyzqqwpnqe
-  - &machine_vaultwarden age1zs9puemeevc5kt84w9d2mc5396w0t9p60qxymkpatwvwxunzs5usmxr3an
   #this dummy key is used for testing.
   - &machine_dummy age18jn5mrfs4gqrnv0e2sxsgh3kq4sgxx39hwr8z7mz9kt7wlgaasjqlr88ng
 creation_rules:
@@ -96,15 +95,6 @@ creation_rules:
       - *admin_kalipso_dsktp
       age:
       - *admin_atlan
-      - *machine_overwatch
-  - path_regex: vaultwarden/secrets.yaml$
-    key_groups:
-    - pgp:
-      - *admin_kalipso
-      - *admin_kalipso_dsktp
-      age:
-      - *admin_atlan
-      - *machine_vaultwarden
   - path_regex: .*/secrets/.*
     key_groups:
     - pgp:

machines/durruti/configuration.nix

@@ -29,6 +29,7 @@ with lib;
     enable = true;
     enablePromtail = true;
     logNginx = true;
+    lokiHost = "10.0.0.14";
   };
 
   services.malobeo-tasklist.enable = true;

machines/durruti/host_config.nix

@@ -43,7 +43,7 @@ in
       };
     };
 
-    services.nginx.virtualHosts."keys.malobeo.org" = {
+    services.nginx.virtualHosts."cloud.malobeo.org" = {
       forceSSL = true;
       enableACME= true;
       locations."/" = {
@@ -73,6 +73,24 @@ in
       };
     };
 
+
+    services.nginx.virtualHosts."zines.malobeo.org" = {
+      forceSSL = true;
+      enableACME= true;
+      locations."/" = {
+        proxyPass = "http://10.0.0.10";
+        extraConfig = ''
+          client_body_in_file_only clean;
+          client_body_buffer_size 32K;
+          
+          client_max_body_size 50M;
+          
+          sendfile on;
+          send_timeout 300s;
+        '';
+      };
+    };
+
     services.nginx.virtualHosts."status.malobeo.org" = {
       forceSSL = true;
       enableACME= true;

machines/fanny/configuration.nix

@@ -1,14 +1,12 @@
-{ inputs, config, lib, ... }:
+{ inputs, config, ... }:
 let
   sshKeys = import ../ssh_keys.nix;
   peers = import ../modules/malobeo/peers.nix;
-  hosts = import ../hosts.nix {};
 in
 {
   sops.defaultSopsFile = ./secrets.yaml;
   sops.secrets.wg_private = {};
   sops.secrets.shop_auth = {};
-  sops.secrets.njala_api_key = {};
 
   imports =
     [ # Include the results of the hardware scan.
@@ -23,7 +21,6 @@ in
       inputs.self.nixosModules.malobeo.metrics
       inputs.self.nixosModules.malobeo.users
       inputs.self.nixosModules.malobeo.backup
-      ./dyndns.nix
     ];
 
     virtualisation.vmVariantWithDisko = {
@@ -37,7 +34,7 @@ in
     enable = true;
     enablePromtail = true;
     logNginx = true;
-    lokiHost = hosts.malobeo.hosts.overwatch.network.address;
+    lokiHost = "10.0.0.14";
   };
 
   malobeo.autoUpdate = {
@@ -47,10 +44,6 @@ in
     jobset = "infrastructure";
     cacheurl = "https://cache.dynamicdiscord.de";
   };
-  specialisation."NOAUTOUPDATE".configuration = {
-    system.nixos.tags = [ "NOAUTOUPDATE" ];
-    malobeo.autoUpdate.enable = lib.mkForce false;
-  };
 
   malobeo.backup = {
     enable = true;
@@ -135,20 +128,13 @@ in
     privateKeyFile = config.sops.secrets.wg_private.path;
   };
 
-  services.malobeo.microvm = {
+  services.malobeo.microvm.enableHostBridge = true;
-    enableHostBridge = true;
-    interface = "enp1s0";
-    gateway = "192.168.1.1";
-    address = "192.168.1.103/24";
-  };
-
   services.malobeo.microvm.deployHosts = [ 
     "overwatch" 
     "infradocs" 
     "nextcloud" 
     "durruti" 
     "zineshop"
-    "vaultwarden"
   ];
 
   networking = {
@@ -159,17 +145,7 @@ in
     };
 
     firewall = {
-      allowedTCPPorts = [ 80 443 ];
+      allowedTCPPorts = [ 80 ];
-    };
-  };
-
-  security.acme = {
-    acceptTerms = true;
-    defaults.email = "malobeo@systemli.org";
-    defaults = {
-      dnsProvider = "njalla";
-      credentialsFile = config.sops.secrets.njala_api_key.path;
-      dnsPropagationCheck = false;
     };
   };
 
@@ -177,56 +153,26 @@ in
     enable = true;
     virtualHosts."docs.malobeo.org" = {
       locations."/" = {
-        proxyPass = "http://${hosts.malobeo.hosts.infradocs.network.address}:9000";
+        proxyPass = "http://10.0.0.11:9000";
         extraConfig = ''
           proxy_set_header Host $host;
         '';
       };
     };
 
-    virtualHosts."cloud.hq.malobeo.org" = {
-      forceSSL = true;
-      enableACME = true;
-      acmeRoot = null;
-      locations."/" = {
-        proxyPass = "http://${hosts.malobeo.hosts.nextcloud.network.address}";
-        extraConfig = ''
-          proxy_set_header Host $host;
-          client_max_body_size ${inputs.self.nixosConfigurations.nextcloud.config.services.nextcloud.maxUploadSize};
-          client_body_timeout 3600s;
-          send_timeout 3600s;
-          fastcgi_buffers 64 4K;
-        '';
-      };
-    };
-
     virtualHosts."cloud.malobeo.org" = {
-      forceSSL = true;
-      enableACME = true;
       locations."/" = {
-        proxyPass = "http://${hosts.malobeo.hosts.nextcloud.network.address}";
+        proxyPass = "http://10.0.0.13";
-        extraConfig = ''
-          proxy_set_header Host $host;
-          client_max_body_size ${inputs.self.nixosConfigurations.nextcloud.config.services.nextcloud.maxUploadSize};
-          client_body_timeout 3600s;
-          send_timeout 3600s;
-          fastcgi_buffers 64 4K;
-        '';
-      };
-    };
-
-    virtualHosts."keys.malobeo.org" = {
-      locations."/" = {
-        proxyPass = "http://${hosts.malobeo.hosts.vaultwarden.network.address}";
         extraConfig = ''
           proxy_set_header Host $host;
+          client_max_body_size 10G;
         '';
       };
     };
 
     virtualHosts."grafana.malobeo.org" = {
       locations."/" = {
-        proxyPass = "http://${hosts.malobeo.hosts.overwatch.network.address}";
+        proxyPass = "http://10.0.0.14";
         extraConfig = ''
           proxy_set_header Host $host;
         '';
@@ -235,19 +181,19 @@ in
 
     virtualHosts."tasklist.malobeo.org" = {
       locations."/" = {
-        proxyPass = "http://${hosts.malobeo.hosts.durruti.network.address}:8080";
+        proxyPass = "http://10.0.0.5:8080";
         extraConfig = ''
           proxy_set_header Host $host;
         '';
       };
     };
 
-    virtualHosts."zines.hq.malobeo.org" = {
+    virtualHosts."zines.malobeo.org" = {
-      forceSSL = true;
+      # created with: nix-shell --packages apacheHttpd --run 'htpasswd -B -c foo.txt malobeo'
-      enableACME = true;
+      # then content of foo.txt put into sops
-      acmeRoot = null;
+      # basicAuthFile = config.sops.secrets.shop_auth.path;
       locations."/" = {
-        proxyPass = "http://${hosts.malobeo.hosts.zineshop.network.address}:8080";
+        proxyPass = "http://10.0.0.15:8080";
         extraConfig = ''
           proxy_set_header Host $host;
 
@@ -261,25 +207,6 @@ in
         '';
       };
     };
-
-    virtualHosts."zines.malobeo.org" = {
-      forceSSL = true;
-      enableACME = true;
-      locations."/" = {
-        proxyPass = "http://${hosts.malobeo.hosts.zineshop.network.address}:8080";
-        extraConfig = ''
-          proxy_set_header Host $host;
-
-          client_body_in_file_only clean;
-          client_body_buffer_size 32K;
-          
-          client_max_body_size 500M;
-          
-          sendfile on;
-          send_timeout 300s;
-        '';
-      };
-    };
   };
 
   services.tor = {

machines/fanny/dummy.yaml

@@ -1,8 +1,9 @@
 wg_private: ENC[AES256_GCM,data:YEmIfgtyHE9msYijva0Ye2w7shVmYBPZ3mcKRF7Cy20xa6yHEUQ0kC2OWnM=,iv:ouK6fHcrxrEtsmiPmtCz9Ca8Ec1algOifrgZSBNHi74=,tag:524e/SQt++hwVyeWruCsLg==,type:str]
-njala_api_key: ENC[AES256_GCM,data:uEzx7KeI7ZZP63Igu5vHmuvASVxJai8bezM40UZVobQMr7r6opjnVTc0BPyIGfnG2mx/6Bo=,iv:lch04oGn6bkqtBGVzYlz6B97FGXlGOoxkiT1IplSxm4=,tag:bzXx2jSqFBv1hgJO1r5i+w==,type:str]
-njalacloud: ENC[AES256_GCM,data:Xg85D9LMMYd8po8vrpxHZA==,iv:L5Gsm3bX61WW1PAdWswFNrScFoBipS2qDGU7iTubt1U=,tag:M2PCfE1h4IkW/iFq8XeIrA==,type:str]
-njalazines: ENC[AES256_GCM,data:ooDRj4HqKVFrgRyzgFGQjg==,iv:9X8r1eY+6FqXv19mO0uMRd5A2tpvtmT11P77t9BQaCk=,tag:4BE55c8x66/UxyTCpCmdUg==,type:str]
 sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
     age:
         - recipient: age18jn5mrfs4gqrnv0e2sxsgh3kq4sgxx39hwr8z7mz9kt7wlgaasjqlr88ng
           enc: |
@@ -22,8 +23,8 @@ sops:
             NjJ5cFdTVS9NZmVWMjcrcHo2WDZEZDgKiDwkuUn90cDmidwYGZBb5qp+4R1HafV0
             vMQfjT9GrwB5K/O1GumOmvbzLNhvO2vRZJhfVHzyHLzQK64abQgF5Q==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-02-20T19:26:21Z"
+    lastmodified: "2025-01-19T22:46:09Z"
-    mac: ENC[AES256_GCM,data:D8ZOgcDCY+I2rFc6+GSRj53QjnhZP0oz5wPgG2x4dOfVRWYMEgR2pnb/IIF95Dq0XR6ja9PLgw42PfdI1dS7vITb1jW5IExcnkB/Pa/RjB3GFeXPFTV6QCAQcK9cLct6yhB/pPbHdt8qHQt7kddiN162RlMHDyR6BAh4gO0Rf3w=,iv:f1RWrxbqNNUdANDR6V+OFuEYJ2ZLVde+5GTcFmSXYSQ=,tag:IBEdkSEz/w4Rxwb6uSBpTw==,type:str]
+    mac: ENC[AES256_GCM,data:eU3SIqAGrgbO2tz4zH1tgYcif7oe5j+/wmdYl2xXXI+D6IhiKrTJGvzE3rd3ElEpb+Bg0UQId952U2Ut0yPTfxGLtdlbJA66CmhLAksByoJ8lOXUcp/qDyA4yMRSuwYG2v7uF2crvue9fyRfZ7hl7abE/Q7Z2UjOKqhSZC5cO3U=,iv:NmCVvtBWZRzhpr5nMLy+98VuQZWoUms7xFSxq8PMvBA=,tag:UWjA7oqoNWh4wb0myNg7FA==,type:str]
     pgp:
         - created_at: "2025-01-19T22:45:26Z"
           enc: |-
@@ -64,4 +65,4 @@ sops:
             -----END PGP MESSAGE-----
           fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4
     unencrypted_suffix: _unencrypted
-    version: 3.11.0
+    version: 3.9.2

machines/fanny/dyndns.nix

@@ -1,25 +0,0 @@
-{pkgs, ...}:
-{
-  sops.secrets.njalacloud = {};
-  sops.secrets.njalazines = {};
-  systemd.services."dyndns" = {
-    script = ''
-      KEYCLOUD=$(cat /run/secrets/njalacloud)
-      KEYZINES=$(cat /run/secrets/njalazines)
-      ${pkgs.curl}/bin/curl --fail --silent --show-error "https://njal.la/update/?h=cloud.malobeo.org&k="$KEYCLOUD"&auto"
-      ${pkgs.curl}/bin/curl --fail --silent --show-error "https://njal.la/update/?h=zines.malobeo.org&k="$KEYZINES"&auto"
-    '';
-    serviceConfig = {
-      Type = "oneshot";
-      User = "root";
-    };
-  };
-  systemd.timers."dyndns" = {
-    wantedBy = ["timers.target"];
-    timerConfig = {
-      OnBootSec = "100s";
-      OnUnitActiveSec = "10m";
-      Unit = "dyndns.service";
-    };
-  };
-}

machines/fanny/secrets.yaml

@@ -1,10 +1,11 @@
 wg_private: ENC[AES256_GCM,data:kFuLzZz9lmtUccQUIYiXvJRf7WBg5iCq1xxCiI76J3TaIBELqgbEmUtPR4g=,iv:0S0uzX4OVxQCKDOl1zB6nDo8152oE7ymBWdVkPkKlro=,tag:gg1n1BsnjNPikMBNB60F5Q==,type:str]
 shop_cleartext: ENC[AES256_GCM,data:sifpX/R6JCcNKgwN2M4Dbflgnfs5CqB8ez5fULPohuFS6k36BLemWzEk,iv:1lRYausj7V/53sfSO9UnJ2OC/Si94JXgIo81Ld74BE8=,tag:5osQU/67bvFeUGA90BSiIA==,type:str]
 shop_auth: ENC[AES256_GCM,data:0NDIRjmGwlSFls12sCb5OlgyGTCHpPQIjycEJGhYlZsWKhEYXV2u3g1RHMkF8Ny913jarjf0BgwSq5pBD9rgPL9t8X8=,iv:3jgCv/Gg93Mhdm4eYzwF9QrK14QL2bcC4wwSajCA88o=,tag:h8dhMK46hABv9gYW4johkA==,type:str]
-njalacloud: ENC[AES256_GCM,data:sp79Ij1vd9pQZuPUR1phmw==,iv:AWKZoOfBA/n16pWQCfA0dZmH1KajCztnLvYItoZZbgA=,tag:BIUrobBoO96pxUz1sjIYIw==,type:str]
-njalazines: ENC[AES256_GCM,data:fnObUEnXYvdj9HtkZNzXVA==,iv:0Zj2n2we9w4fj/n7e1ayd9XgFEMAGCHk4QLTu1IlRnQ=,tag:zeOLAB0oE6XbxqdqhdRNxw==,type:str]
-njala_api_key: ENC[AES256_GCM,data:ohSVzQUvFjia/s9WceqnZCdLyk3N1Lm2BCBmXeBlkWD2dyrohKCnd9GiJ499IORpuYcOXyM=,iv:Uczk8op5mgqe8gefxgU9YuTqOsYvjzHCKvzA7GDsgio=,tag:XA7JRq/LsGkpHcQSO36Whg==,type:str]
 sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
     age:
         - recipient: age136sz3lzhxf74ryruvq34d4tmmxnezkqkgu6zqa3dm582c22fgejqagrqxk
           enc: |
@@ -24,8 +25,8 @@ sops:
             QVZyNWVOMTh3ejBha21Qb2xCRkFERGMKH9nMQUoS5bGcLUx2T1dOmKd9jshttTrP
             SKFx7MXcjFRLKS2Ij12V8ftjL3Uod6be5zoMibkxK19KmXY/514Jww==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-02-20T19:25:05Z"
+    lastmodified: "2025-04-14T10:34:55Z"
-    mac: ENC[AES256_GCM,data:g+bFYqJN1X8F52tpIO60S2WKxLG27ZrP399fsfE6o7rPtIMimZou/4oUo7i+kpNtygEuCr3+suP8TPas4x5zMXhRjnjJuwJwL/NwdciHZU0O3rPJgucCEWqr9OdAtxezDM9c2vv+jzqZxWT9t0fIpB9RxO5oy1pHZs0RCgjAJR4=,iv:v6RdTMeQUxSdjIVNFbx2HtxCsdVgFTQTzMXS5Fj62is=,tag:pLoZMBRIXYElO5rY+xX9zg==,type:str]
+    mac: ENC[AES256_GCM,data:vcDXtTi0bpqhHnL6XanJo+6a8f5LAE628HazDVaNO34Ll3eRyhi95eYGXQDDkVk2WUn9NJ5oCMPltnU82bpLtskzTfQDuXHaPZJq5gtOuMH/bAKrY0dfShrdyx71LkA4AFlcI1P5hchpbyY1FK3iqe4D0miBv+Q8lCMgQMVrfxI=,iv:1lMzH899K0CnEtm16nyq8FL/aCkSYJVoj7HSKCyUnPg=,tag:mEbkmFNg5VZtSKqq80NrCw==,type:str]
     pgp:
         - created_at: "2025-02-11T18:32:49Z"
           enc: |-
@@ -66,4 +67,4 @@ sops:
             -----END PGP MESSAGE-----
           fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4
     unencrypted_suffix: _unencrypted
-    version: 3.11.0
+    version: 3.9.4

machines/hosts.nix

@@ -1,107 +1,82 @@
 { ... }:
 
-let
-  createMaloNet = hostId: mac: {
-    local = true;
-    hostId = hostId;
-    address = "192.168.1.${hostId}";
-    gateway = "192.168.1.1";
-    nameservers = [ "192.168.1.1" "1.1.1.1" ]; #setting ns1 as nameserver
-    mac = mac;
-  };
-
-  createOffsiteNet = hostId: mac: {
-    local = false;
-    hostId = hostId;
-    address = "10.0.0.${hostId}";
-    gateway = "10.0.0.1";
-    nameservers = [ "1.1.1.1" ];
-    mac = mac;
-  };
-in
 {
-  #TODO: fix local 192.168.1.0/24 addresses they are just palceholders!
   malobeo = {
     hosts = {
       louise = {
         type = "host";
-        network = {
-          local = true;
-          hostId = "11";
-          address = "192.168.1.101";
-        };
       };
 
       bakunin = {
         type = "host";
-        network = {
-          local = true;
-          hostId = "12";
-          address = "192.168.1.102";
-        };
       };
-  
+
       fanny = {
         type = "host";
-        network = {
-          local = true;
-          hostId = "13";
-          address = "192.168.1.103";
-        };
       };
-  
+
       lucia = {
         type = "rpi";
-        network = {
-          local = true;
-          hostId = "15";
-          address = "192.168.1.105";
-        };
       };
-  
+
       durruti = {
         type = "microvm";
-        network = createMaloNet "5" "52:DA:0D:F9:EF:F9";
+        network = {
+          address = "10.0.0.5";
+          mac = "52:DA:0D:F9:EF:F9";
+        };
       };
-  
+
       vpn = {
         type = "microvm";
-        network = createOffsiteNet "10" "52:DA:0D:F9:EF:E6";
+        network = {
+          address = "10.0.0.10";
+          mac = "D0:E5:CA:F0:D7:E6";
+        };
       };
-  
+
       infradocs = {
         type = "microvm";
-        network = createMaloNet "11" "52:DA:0D:F9:EF:E7";
+        network = {
+          address = "10.0.0.11";
+          mac = "D0:E5:CA:F0:D7:E7";
+        };
       };
-  
+
       uptimekuma = {
         type = "microvm";
-        network = createOffsiteNet "12" "52:DA:0D:F9:EF:E8";
+        network = {
+          address = "10.0.0.12";
+          mac = "D0:E5:CA:F0:D7:E8";
+        };
       };
-  
+
       nextcloud = {
         type = "microvm";
-        network = createMaloNet "13" "52:DA:0D:F9:EF:E9";
+        network = {
+          address = "10.0.0.13";
+          mac = "D0:E5:CA:F0:D7:E9";
+        };
       };
-  
+
       overwatch = {
         type = "microvm";
-        network = createMaloNet "14" "52:DA:0D:F9:EF:E0";
+        network = {
+          address = "10.0.0.14";
+          mac = "D0:E5:CA:F0:D7:E0";
+        };
       };
-  
+
       zineshop = {
         type = "microvm";
-        network = createMaloNet "15" "52:DA:0D:F9:EF:F1";
+        network = {
+          address = "10.0.0.15";
+          mac = "D0:E5:CA:F0:D7:F1";
+        };
       };
 
-      vaultwarden = {
+      testvm = {
-        type = "microvm";
+        type = "host";
-        network = createMaloNet "16" "D0:E5:CA:F0:D7:F2";
-      };
-
-      ns1 = {
-        type = "microvm";
-        network = createMaloNet "17" "52:DA:0D:F9:EF:F3";
       };
     };
   };

machines/infradocs/configuration.nix

@@ -19,6 +19,7 @@ with lib;
     enable = true;
     enablePromtail = true;
     logNginx = true;
+    lokiHost = "10.0.0.14";
   };
 
   system.stateVersion = "22.11"; # Did you read the comment?

machines/modules/host_builder.nix

@@ -43,7 +43,7 @@ rec {
   ];
   defaultModules = baseModules;
 
-  makeMicroVM = hostName: network: modules: [
+  makeMicroVM = hostName: ipv4Addr: macAddr: modules: [
     {
       microvm = {
         hypervisor = "cloud-hypervisor";
@@ -83,7 +83,7 @@ rec {
           {
             type = "tap";
             id = "vm-${hostName}";
-            mac = "${network.mac}";
+            mac = "${macAddr}";
           }
         ];
       };
@@ -93,9 +93,9 @@ rec {
       systemd.network.networks."20-lan" = {
         matchConfig.Type = "ether";
         networkConfig = {
-          Address = [ "${network.address}/24" ];
+          Address = [ "${ipv4Addr}/24" ];
-          Gateway = "${network.gateway}";
+          Gateway = "10.0.0.1";
-          DNS = network.nameservers;
+          DNS = ["1.1.1.1"];
           DHCP = "no";
         };
       };
@@ -165,16 +165,6 @@ rec {
       });
     };
 
-    systemd.network.networks."20-lan" = pkgs.lib.mkForce {
-      matchConfig.Type = "ether";
-      networkConfig = {
-        Address = [ "10.0.0.${hosts.malobeo.hosts.${hostname}.network.hostId}/24" ];
-        Gateway = "10.0.0.1";
-        DNS = [ "1.1.1.1" ];
-        DHCP = "no";
-      };
-    };
-
     boot.isContainer = pkgs.lib.mkForce false;
     services.timesyncd.enable = false;
     users.users.root.password = "";
@@ -220,7 +210,8 @@ rec {
         specialArgs.self = self;
         config = {
           imports = (makeMicroVM "${name}" 
-                                 hosts.malobeo.hosts.${name}.network [
+                                 "${hosts.malobeo.hosts.${name}.network.address}"
+                                 "${hosts.malobeo.hosts.${name}.network.mac}" [
             ../${name}/configuration.nix     
             (vmMicroVMOverwrites name { 
               withNetworking = true; 
@@ -259,7 +250,7 @@ rec {
     modules = (if (settings.type != "microvm") then
       defaultModules ++ [ ../${host}/configuration.nix ]
       else
-      makeMicroVM "${host}" settings.network [
+      makeMicroVM "${host}" "${settings.network.address}" "${settings.network.mac}" [
         inputs.microvm.nixosModules.microvm
         ../${host}/configuration.nix
       ]);

machines/modules/malobeo/metrics.nix

@@ -1,7 +1,6 @@
 { config, lib, pkgs, ... }:
 let 
   cfg = config.malobeo.metrics;
-  hosts = import ../../hosts.nix {};
 in
 {
   options.malobeo.metrics = {
@@ -22,7 +21,7 @@ in
     };
     lokiHost = lib.mkOption {
       type = lib.types.str;
-      default = hosts.malobeo.hosts.overwatch.network.address;
+      default = "10.0.0.14";
       description = "Address of loki host";
     };
   };

machines/modules/malobeo/microvm_host.nix

@@ -14,26 +14,6 @@ in
         description = lib.mdDoc "Setup bridge device for microvms.";
       };
 
-      interface = mkOption {
-        default = "eno1";
-        type = types.str;
-      };
-
-      gateway = mkOption {
-        default = "10.0.0.1";
-        type = types.str;
-      };
-
-      address = mkOption {
-        default = "10.0.0.1/24";
-        type = types.str;
-      };
-
-      dns = mkOption {
-        default = [ "1.1.1.1" ];
-        type = types.listOf types.str;
-      };
-
       enableHostBridgeUnstable = mkOption {
         default = false;
         type = types.bool;
@@ -67,29 +47,29 @@ in
 
     systemd.network = mkIf (cfg.enableHostBridge || cfg.enableHostBridgeUnstable) {
       enable = true;
-      networks."10-lan" = {
+      # create a bride device that all the microvms will be connected to
-        matchConfig.Name = [ "${cfg.interface}" "vm-*"];
+      netdevs."10-microvm".netdevConfig = {
-        networkConfig = {
+        Kind = "bridge";
-          Bridge = "malobeo0";
+        Name = "microvm";
-        };
       };
-      
+
-      netdevs."malobeo0" = {
+      networks."10-microvm" = {
-        netdevConfig = {
+        matchConfig.Name = "microvm";
-          Name = "malobeo0";
-          Kind = "bridge";
-        };
-      };
-      
-      networks."10-lan-bridge" = {
-        matchConfig.Name = "malobeo0";
         networkConfig = {
-          Address = [ "${cfg.address}" ];
+          DHCPServer = true;
-          Gateway = "${cfg.gateway}";
+          IPv6SendRA = true;
-          DNS = cfg.dns;
-          IPv6AcceptRA = true;
         };
-        linkConfig.RequiredForOnline = "routable";
+        addresses = if cfg.enableHostBridgeUnstable then [
+          { Address = "10.0.0.1/24"; }
+        ] else [
+          { Address = "10.0.0.1/24"; }
+        ];
+      };
+
+      # connect the vms to the bridge
+      networks."11-microvm" = {
+        matchConfig.Name = "vm-*";
+        networkConfig.Bridge = "microvm";
       };
     }; 
 
@@ -101,7 +81,7 @@ in
           # under nixosConfigurations
           flake = inputs.malobeo; 
           # Specify from where to let `microvm -u` update later on
-          updateFlake = "git+https://git.dynamicdiscord.de/malobeo/infrastructure";
+          updateFlake = "git+https://git.dynamicdiscord.de/kalipso/infrastructure";
         }; };
     in
     builtins.listToAttrs (map mapperFunc cfg.deployHosts);

machines/modules/malobeo/zones.nix

@@ -1,41 +0,0 @@
-{ inputs }:
-
-let
-  vpnNS = "vpn";
-  localNS = "hq";
-  peers = import ./peers.nix;
-  hosts = ((import ../../hosts.nix ) {}).malobeo.hosts;
-
-in
-{
-  SOA = {
-    nameServer = "ns1";
-    adminEmail = "admin@malobeo.org";
-    serial = 2019030801;
-  };
-  useOrigin = false;
-
-  NS = [
-    "ns1.malobeo.org."
-  ];
-
-  subdomains = {
-    ns1 = {
-      A = [ hosts.ns1.network.address ];
-    };
-
-    ${localNS} = {
-      A = [ hosts.fanny.network.address ];
-      subdomains = builtins.mapAttrs (name: value: if value.network.local == true then {
-        A = [ value.network.address ];
-      } else {}) hosts;
-    };
-
-    ${vpnNS} = {
-      A = [ peers.vpn.address ];
-      subdomains = builtins.mapAttrs (name: value: if value.role != "server" then {
-        A = [ value.address ];
-      } else {}) peers;
-    };
-  };
-}

machines/nextcloud/configuration.nix

@@ -2,9 +2,6 @@
 
 with lib;
 
-let
-  hosts = import ../hosts.nix {};
-in
 {
   sops.defaultSopsFile = ./secrets.yaml;
   sops.secrets = {
@@ -31,10 +28,7 @@ in
     enable = true;
     enablePromtail = true;
     logNginx = true;
-  };
+    lokiHost = "10.0.0.14";
-
-  services.postgresqlBackup = {
-    enable = true;
   };
 
   services.nextcloud = {
@@ -54,15 +48,43 @@ in
     extraAppsEnable = true;
     extraApps = {
       inherit (config.services.nextcloud.package.packages.apps) contacts calendar polls registration collectives forms;
-      deck = pkgs.fetchNextcloudApp {
+
-        sha256 = "sha256-epjwIANb6vTNx9KqaG6jZc14YPoFMBTCj+/c9JHcWkA=";
+      deckWithDrag = pkgs.php.buildComposerProject (finalAttrs: {
-        url = "https://link.storjshare.io/raw/jvrl62dakd6htpyxohjkiiqiw5ma/mal/deck32.tar.gz";
+        pname = "deck";
-        license = "agpl3Plus";
+        version = "1.0.0";
-      };
+        src = pkgs.fetchzip {
+          url = "https://github.com/nextcloud/deck/archive/refs/heads/stable32.zip";
+          hash = "sha256-eMHjfki+axEtlhV6518mlAzPhZxAZqEX7HiRsJf1vxo=";
+        };
+        composerNoDev = true;
+        vendorHash = pkgs.lib.fakeHash;
+        postInstall = ''
+          cp -r $out/share/php/deck/* $out/
+          rm -r $out/share
+        '';
+      });
+      
+      #deckWithDrag = pkgs.fetchNextcloudApp {
+      #  appName = "deck";
+      #  appVersion = "1.16.2";
+      #  license = "agpl3Plus";
+      #  teams = [ pkgs.lib.teams.nextcloud ];
+      #  url = "https://github.com/nextcloud-releases/deck/releases/download/v1.16.2/deck-v1.16.2.tar.gz";
+      #  hash = "sha256-rFymTIr7pOuMES3DMIOS7cvq+CEIekLZYLqz58TOP04=";
+      #  description = "";
+      #  homepage = "https://github.com/nextcloud/deck";
+      #  unpack = true;
+      #  patches = [
+      #    (pkgs.fetchpatch {
+      #      url = "https://git.dynamicdiscord.de/ahtlon/deck/commit/77cbcf42ca80dd32e450839f02faca2e5fed3761.patch";
+      #      sha256 = "sha256-agwFMwXO8WLL0+pdeKF/pA59V9ah9t590sCl1msQonA=";
+      #    })
+      #  ];
+      #};
     };
     settings = {
-      trusted_domains = [ "cloud.malobeo.org" "cloud.hq.malobeo.org" ];
+      trusted_domains = ["10.0.0.13"];
-      trusted_proxies = [ hosts.malobeo.hosts.fanny.network.address ];
+      trusted_proxies = [ "10.0.0.1" ];
       "maintenance_window_start" = "1";
       "default_phone_region" = "DE";
     };

machines/ns1/configuration.nix

@@ -1,52 +0,0 @@
-{ config, self, lib, inputs, pkgs,  ... }:
-
-with lib;
-with inputs;
-
-let
-  dns = inputs.dns;
-in
-{
-  networking = {
-    hostName = mkDefault "ns1";
-    useDHCP = false;
-  };
-
-  imports = [
-    ../modules/malobeo_user.nix
-    ../modules/sshd.nix
-    ../modules/minimal_tools.nix
-    ../modules/autoupdate.nix
-  ];
-
-  networking.firewall = {
-    enable = true;
-    allowedTCPPorts = [ 53 ];
-    allowedUDPPorts = [ 53 ];
-  };
-
-  services.bind = {
-    enable = true;
-    forwarders = [
-      "1.1.1.1"
-      "1.0.0.1"
-    ];
-  
-    cacheNetworks = [
-      "127.0.0.0/24"
-      "10.0.0.0/24"
-      "192.168.1.0/24"
-      "10.100.0.0/24"
-    ];
-
-    zones = {
-      "malobeo.org" = {
-        master = true;
-        file = pkgs.writeText "zone-malobeo.org" (dns.lib.toString "malobeo.org" (import ../modules/malobeo/zones.nix { inherit inputs; }));
-      };
-    };
-  };
-
-  system.stateVersion = "22.11"; # Did you read the comment?
-}
-

machines/overwatch/configuration.nix

@@ -2,18 +2,7 @@
 
 with lib;
 
-let
-  hosts = import ../hosts.nix {};
-in
 {
-  sops.defaultSopsFile = ./secrets.yaml;
-  sops.secrets = {
-    grafana_smtp = {
-      owner = "grafana";
-      group = "grafana";
-    };
-  };
-
   networking = {
     hostName = mkDefault "overwatch";
     useDHCP = false;
@@ -32,25 +21,15 @@ in
     enable = true;
     enablePromtail = true;
     logNginx = false;
+    lokiHost = "10.0.0.14";
   };
 
   services.grafana = {
     enable = true;
-    settings = {
+    settings.server = {
-      server = {
+      domain = "grafana.malobeo.org";
-        domain = "grafana.malobeo.org";
+      http_port = 2342;
-        http_port = 2342;
+      http_addr = "127.0.0.1";
-        http_addr = "127.0.0.1";
-      };
-
-      smtp = {
-        enabled = true;
-        host = "mail.systemli.org:465";
-        user = "malobot@systemli.org";
-        from_address = "malobot@systemli.org";
-        from_name = "malobot";
-        password = "$__file{${config.sops.secrets.grafana_smtp.path}}";
-      };
     };
 
     provision.datasources.settings = {
@@ -104,7 +83,6 @@ in
 
   services.prometheus = {
     enable = true;
-    retentionTime = "1y";
     port = 9001;
 
     scrapeConfigs = [
@@ -123,31 +101,31 @@ in
       {
         job_name = "durruti";
         static_configs = [{
-          targets = [ "${hosts.malobeo.hosts.durruti.network.address}:9002" ];
+          targets = [ "10.0.0.5:9002" ];
         }];
       }
       {
         job_name = "infradocs";
         static_configs = [{
-          targets = [ "${hosts.malobeo.hosts.infradocs.network.address}:9002" ];
+          targets = [ "10.0.0.11:9002" ];
         }];
       }
       {
         job_name = "nextcloud";
         static_configs = [{
-          targets = [ "${hosts.malobeo.hosts.nextcloud.network.address}:9002" ];
+          targets = [ "10.0.0.13:9002" ];
         }];
       }
       {
         job_name = "zineshop";
         static_configs = [{
-          targets = [ "${hosts.malobeo.hosts.zineshop.network.address}:9002" ];
+          targets = [ "10.0.0.15:9002" ];
         }];
       }
       {
         job_name = "fanny";
         static_configs = [{
-          targets = [ "${hosts.malobeo.hosts.fanny.network.address}:9002" ];
+          targets = [ "10.0.0.1:9002" ];
         }];
       }
       # add vpn - check how to reach it first. most probably 10.100.0.1

machines/overwatch/dashboards/node_full.json

@@ -23750,8 +23750,8 @@
       },
       {
         "current": {
-          "text": "192.168.1.13:9002",
+          "text": "10.0.0.13:9002",
-          "value": "192.168.1.13:9002"
+          "value": "10.0.0.13:9002"
         },
         "datasource": {
           "type": "prometheus",

machines/overwatch/dummy.yaml

@@ -1,65 +0,0 @@
-grafana_admin: ENC[AES256_GCM,data:zO7Tfmo=,iv:xa456cUb14VjJPEKClqGJiYR7cSsjQPIld+O2E0YNM8=,tag:dFgGtqMYhg4uweoLZPu48Q==,type:str]
-grafana_smtp: ENC[AES256_GCM,data:xndLMw==,iv:0P4INbDD2/Teo8Dv6lIfLhXvNAkcneEDCeB5OAY25wI=,tag:ilE0Noleb+uL5gqF4bU70w==,type:str]
-sops:
-    age:
-        - recipient: age18jn5mrfs4gqrnv0e2sxsgh3kq4sgxx39hwr8z7mz9kt7wlgaasjqlr88ng
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPMXlEbWlabzVUNlRkVFFC
-            ZktpQUx2alRNN01qYmhFYnhMRDBkYmFRdzNnCi9YbjBDUlRhc1kwVjZWY0NGZERQ
-            U05BMlFpemVhR29VZWJUdGJYNWhMdVUKLS0tIFU5dEEvaFdvelpqZGg5a1BHb1Bn
-            eDFDVStZS0o0WVh4cmJPa2o3eWNseGMKc0ydK8/2Gzxe2IYG96saVosJTrRcWizR
-            lcMbsh8mKlVCt5Fx9EQOtj50ylOGk2h2Itk4uLYG4UAySDU/Aw3iQw==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1QmsxNERCclRBeFo0WGZ1
-            OGlHTGxDMURsWXdDRXpoUk10S0JpeGk2QURvCjBkaVFHTHo1eGtKbERPWmhNZEpL
-            SHlFR3FPMG1XY0VBRzI0RWhHYno1RnMKLS0tIFAwSFBhcWRrZG9MQ1FjRFVlVTZB
-            QXZwTVd5NnNSdUxRSzNLMHk2SWYxVnMKZyZvZV5qhJj4KATFV2eh9aN9XMbSQL7i
-            kRGQI9y5ADv6UsLh/y+rWe0xF4BPOGF0xL8JUnHfTy/RsKfhB3aTYQ==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-01-24T17:01:57Z"
-    mac: ENC[AES256_GCM,data:KySo9sJgOLBPtxQZ1gXY8aCmCHbn44aiLKiK1mGziKsBoPkBdEivCT7dDQ1tXQj9wz3gly6raS4FEmR6ikcbtAE2EN86cDLNuu9sSiW2OYiJRe5iZvet2veqtA00K7TtPZgAX+ccsUE5iy0W55bu+kpK3J8MPNy3LUK0EbSKW8I=,iv:7BQKCNyWe4azTelyKlV6XvvgPIrspVbwITyycsW/c44=,tag:1XbSxju44GCKcGw8Ln9iuQ==,type:str]
-    pgp:
-        - created_at: "2026-01-24T17:01:26Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQGMA5HdvEwzh/H7AQv6AsOXbgAIOqhQIwmq/t0uUTq77bI2Z96n49kdUqVG0AAr
-            OdnArcAe8J80gr1FUkjhU8jxO1cwh0N6bQdEO5S/MHo156+tToB64l858sxRBeSK
-            V5Ko7Pc0JulgQ5MFgD3SMaOVO9G0pvZJjU+E/WJCkoYnh4HBWWiCx4+OoxeSDFma
-            hvLiAciH6eB5wlKeLeMt9L80stIeSxXSDL/r/5QHg7qI8Fy5YWCtBmlRDQ3Lma3Q
-            erU5M5iVh7nr4P11lsGjgnPPalxuD0bdLQxm3zOXFK4nVJE1dI4zov386IjI57Ur
-            Hzl7LF7fUoaiGZNskfZzt38cdx0EJL2WV71DD5jlEgaPBUom1sRP4pPDSlDi4oFL
-            A3+AK2GvH6xlExagDevtsn7IgA3Dm/ummGpCE12y4To4Heq0uh0nRmRsnpQlzfGx
-            40Ka06u+xM8tLIuyhLFeaVq0IfEtRRo0GeMQYOX/GQS8ns5+WGguhOamDlAf4Tcw
-            UmDn4HEaObHAiQJC50pl0lgBJroiCV4kljDFALv8nKTuu1l/l+X9ULNImtRp0z0K
-            +U+DcuWb+8mNj3WRXEA+zLqxI34pLohZPys85GbUOo1J+OwXrajujuOofOInUfNt
-            OYrcItXgSqZp
-            =8n3V
-            -----END PGP MESSAGE-----
-          fp: c4639370c41133a738f643a591ddbc4c3387f1fb
-        - created_at: "2026-01-24T17:01:26Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA98TrrsQEbXUAQ//Z44dVz5B2l72NhkoxAzaUIvqnluoJw59hbNyfss6ia3m
-            uAFJcz4Vf30AO1CnIWRbGaGvL3hn+qbHr+VDWLJ5gmL8+PLX2LRHhtQnISsFhGRd
-            spXfVr7NpqdWxjTy8EIoWJ2Ucpz6pzwFHh2FhCadKZlz8orvOB+SvmIe3o9LdORV
-            lqqelNASlHjPwyck7xOB71evtfvoFwfWw3CNR3hxE3zkZ55F776Fypi1VxfxRpbx
-            sWPze7LD6/kV04wXZMBDvlQQUShdXfCRSF3SujAWIEhuJu0UsmIdV9omnhGbSOoe
-            LyAyCdryjYmYGUn4MBmFQOf9k/FWnN8OMmLx2lNbXLopCLTM3UA4YY8411CgQd9X
-            RzM8M7YjbfAptvI1sf1DCrxOaKF0tcN6l44bPDkzy1lErKsPcR9N9HfV3cdWii26
-            JDyz+MtYj8DvxofRqsyjJL/qyP/4w+trvnIttbJPW3GZ6LCulJVQupXWvr6Q1lJ1
-            2g3Lyyv4/xwPMRP4/Vt6olOrwkn5H1fcj7w9Dl0osuG2VEnR0sFs33u76kTLMHum
-            7EDT8Dq480SLQ7g4JTCk2ElFBJBdAf8TTX+1rQ+2aUu94IihKHDeXbuxd+MdTyrV
-            q13QAOzLjjeQTYSKwxq9sZlMw5TPU5CJ4lXQ7UGAJ7efH6A/Rd23TMv2stTFyA3S
-            WAGVYDwKP7S49KkwMCC6Dvi0rjYD9fVnk19bQ/SdO/eiKQ5mb4DcOxx+KXxnKDTr
-            GI8pUz9lmOcLZB7umDHR5WnqtG0q1EgASQrvGDGQqORHqEpL343+wBg=
-            =0JXx
-            -----END PGP MESSAGE-----
-          fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4
-    unencrypted_suffix: _unencrypted
-    version: 3.11.0

machines/overwatch/promtail.yaml

@@ -6,7 +6,7 @@ positions:
   filename: /tmp/positions.yaml
 
 clients:
-  - url: http://192.168.1.13:3100/loki/api/v1/push
+  - url: http://10.0.0.13:3100/loki/api/v1/push
 
   
 scrape_configs:

machines/overwatch/secrets.yaml

@@ -1,65 +1,59 @@
 grafana_admin: ENC[AES256_GCM,data:c+ZnOyxSXrG4eiK8ETKHheadiSz98LLHYwxb,iv:Ut2qFD2p6OmKDWjLMjFxyISxzTdJpZpgIB7obW5bgkY=,tag:HdayzjXQ1Zc7w9ITLzKLxA==,type:str]
-grafana_smtp: ENC[AES256_GCM,data:gOER9SzqRACIWe3PchyKguX3RdW6xhSZDzLd727CK1w=,iv:KDOyXGYGXnUu92hvt6eBqI8zeKP+JRDsF8Ir5X/9TDk=,tag:wRexcIJp8XEURKcZnHCRtQ==,type:str]
 sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
     age:
         - recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWdVhpdTdJNnh5VCtmNHh5
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxN1VURXJuMENJV1Z2eEtS
-            M1ZTKzk1WlVYYmRWKzJxd1ZUTi9IMW1ta1VvCjVZQVQ1K1lFeC9QZkI2MGZXNk81
+            bUR2cTNmNUdhU1B4SHZNMW9KRDV2dW5VNmlNCjdmYXpZb05mMEdPdjN4c0VWOUhV
-            MGlibVFCYXZ0RFEzNUQxUm5PcWdadTgKLS0tIHFJNXFieVd4TXc4ck9VT3cxWDFs
+            RW4vV05CMno1MmJmYzdESjN5MFVFcjQKLS0tIDNxTE1KaW1EVGhtOEQwWXZndk53
-            NmRNSit1TkRRbUFQNzUvYThUczAxRzAKvpDK4R7m/GpfOzM4nU5vSYDXZGUy4D+c
+            bFBCMExGdEdMb2Z0TzF0Yk02MUpkN0kKIUm9iUvU/xu1Xl6yoYSVGcIXKnGsp/D/
-            xouTxOguMdId8GiKb1AJnVv2q/YYdr2M9yA/FpKn7kBfuQw/Hrj1rg==
+            RjVQ7tgJIbrupubny/fg4v2sz5HOs5uzmEq4ZKgBWrBeMPss4gYstA==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age1hq75x3dpnfqat9sgtfjf8lep49qvkdgza3xwp7ugft3kd74pdfnqfsmmdn
+    lastmodified: "2025-01-22T00:51:32Z"
-          enc: |
+    mac: ENC[AES256_GCM,data:TEEyPmVxIJxC49hDqDbwzTZZ/tNymFr0dMvWn6DRli70Kp5XXNCLTpicAbiFh3WoyzbDpN/5c2yxVNGjhB8nXgKpCZdffdONMY6eSCpPbblYwJS7hNsjW+u2wysSFPDAk5apwbNXJcKnlI1tBcGQRHlym9ShSw6fT7K7afWYWqo=,iv:583DWNug8yNF/vZZN4btT6P1yUa0b1UN4frvAX4UKv0=,tag:YI5KIAe5P5Bx0TZU4wG8ag==,type:str]
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0bEhCQitwNVpYSHRJOEMr
-            ZnZLQ3lELzdtREVpSHVGd3BHZ3p6WU9BK3lFCkFlYXNsa2JWZmZFVjRmK3BTejc1
-            K0JVSlZPbFh0VklvZHFaOUwyVHlibFUKLS0tIDFMcU8wc01lT3g0bUw3VHBmd3Zv
-            VnRIYVVIZktISENseEVLVWlsenFhcVkKvj8i349iNX2YNL5G0w7F9IuW/5ZRP6Z7
-            XC8TrYzCSOEOXt5nMnZg2yQUJHi6Qq8Wu2e2KV7Cd9J8Q/39dRv2cg==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-01-24T16:52:54Z"
-    mac: ENC[AES256_GCM,data:BoJwPldIVZf2NZALbeMTq6DvuBMwOwyvmr5UjsPvQrdbbzYjLTl5dplkhT6QRHPDCFDT4Ibd1UfJ8pQYRkGdO2EjlUyuk3hvAYdR+PUmVz8afFE07sNsGw2EDGVHmsFjUVHLT69YqXtGpVNTW6KjqYuRhz/Ik0wEZLxzDSiy86c=,iv:TQU0si/AYaMpShF4l3CzUN3qajQpE0ZWa7mLOqhRP00=,tag:Oyapkoo4+Q7x08m6RTXfcQ==,type:str]
     pgp:
-        - created_at: "2026-01-24T18:05:47Z"
+        - created_at: "2025-01-22T00:51:09Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQGMA5HdvEwzh/H7AQwApRb25y9gYvAV1XvhhnazjaFKPeNkL47Rou9fNySfa1fg
+            hQGMA5HdvEwzh/H7AQv+PxajhJgXHcxwJ7Mk0gjqFV0dGmNJ1m0eY3gPyIS38GSB
-            WOh/m0Pu1RUK6QHhnQhLvwQeVV/eQc4M3RWccSKdSmhDJGN3WdfZZAgDXT7ovifD
+            Rjto1zUd6EARu1GnxSrVrSZYlQaL6x3l2DuFIP7mtymvlFrmhiAoDz/si0zlzsJp
-            oMEwstACzCCKwNQ1TRc2KyTUGOudWuFQzt1TnOv+jdByScDwRXVItWHoIBk0B4T9
+            WZyQZdepnt9FyYJAwTzbmfVdpZDYajuMI38byMJqzUhS7SEOsPwiU1KRoTHcf4se
-            qq+sLjdWDNXQpED609kkYm0Ge6IApDN9kt8ZXylFDnsSEu9dRWNUY4fBjfMK8Nfp
+            2E+9v8OwTVT2UoDxyiVJuDAA+K+Jh2RjHk3p/uVnZDqqQpI9UAI8LrCpun9uALpH
-            aPpGfRUrlAEK87ApPtD1I3SBNkz73KSXSieUeCGqra5c/W6oRY8nzUljvHAD4Zr2
+            +29wyhkCZ9RIHU7nDQNVvwHkbYCyRUwR44bciSwITpjp7GuZCcZvzSSimPktkC9q
-            aGer5lLujih5nR+QybaNnREGrlNDh7SEhBk3p7Nuj/bH2f4Pyto2J+9WaLPZ8UzW
+            VZkHA6rHgHgcu6mnMfpP0+j4gB0dU0t4hGF41klV3YpEGfYcFIsKV10lfa6aMNmW
-            /nnhIZmPvcRm6z0++tJtKRhloutSNiuv1emM7XpGk4zjeW4f8hg+eld6c/ngZ5vw
+            08RuLdCtnQyplYhgBm1zQvYHJsIuwK9s1B2dz3Z8l3o2eg8AqFuIL+MlZOvf5A/2
-            tv2RH75AuOfkkychZJwBPy2hhmBgPEoY5Z1qPkqv/2m8utO9vuHeFn+pxgSsijF1
+            MOXffyXbOM5Dhy7DdUckTOYYfwWe1mStw3vx3I3mAFzuOOR7HQuzlc9Bf1oxh36T
-            Q70noa9SQSoeqDVGmldF0lYBPT8ldR5RleLKnYj0vdyLSWgQUBUlx/CbWl7JoNzc
+            6e/qOijjPPqkLeR2mufo0lgBBFTQFt2jVvMo1lrCB8Amj4yj/4noXTzglkYTYBKs
-            eCRp16b0MmfSWqBwtmHfhZSb5g2qVwsw6LlfeyshngNUJNc9Mc4HqBtQZivAjQCI
+            S513kUdhAGtWoNrqcItOYAn/gl+CPGY2Op3tJBVCWM6aT/KO6M/LPJ7wiQk2zlOL
-            9lYbc+2rDw==
+            pp7SnCKvv9eQ
-            =b4hD
+            =N+uj
             -----END PGP MESSAGE-----
           fp: c4639370c41133a738f643a591ddbc4c3387f1fb
-        - created_at: "2026-01-24T18:05:47Z"
+        - created_at: "2025-01-22T00:51:09Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA98TrrsQEbXUARAAmL5wfXTStuu0hFz6E3sEfGdWrV+O5ZmP79Bu+1BgCzkQ
+            hQIMA98TrrsQEbXUAQ//fm/TcxgsAMY6P8jvOQMcRBmjjVwfLP1UTTnkRUa36Mmn
-            iIp18D/e6vsCoWrTGtgEWfqWe0i1B2Iq5sPxPvSg356nfxuNEWxWjsjK6yVziAos
+            2V9619zsH1dzTp0gUVV8mvIKUtpz2nCBTZBJw803wW9KorxW6f4e3+mIWelZT5WM
-            On6HQJyEnSs7yfnQ1BXNVPVa3dCXfAhlz4zJ6kfSFuKV2WhDs6y0azNCD0QdE6d3
+            sLcQPFWAYKDVnSfk5j8kRSmpM6k2xFRB9DTEMIyFH9PZL99Fztp2hjTn553YTQOo
-            YHd/WOPr726u1prQDMKsyYKHQd5QyjAl+egXyrlbqwQowYdS4hYpGYeZbdiVPsCo
+            pdw+AMzgptYQghW/Pl/32wXHwCO+bL8tyk62VIQO13l3tX83oSslXNkFzNQYt3jv
-            cKHvfq+3cS3bdzzwJ1RadBg+sR9zmKlsWCkRTyMB/uL3bhVomtsSU3U8CN09QOpG
+            xXFUaQEGD/1lFLeFnIuJZzfjWt6n0fShJboUcuk/ZIcYdwrbG0pyLLoBoObSRQtG
-            +eJjk3T07B23lzH6t214CZRFJ8dudgMyseMUnsWngWfn3VfCW10wciaxvhKqMcE7
+            t+7VpWpfl3rnk822SU9z9YcaMNy9HD3Kz9Qh0BRQiN3scCMzm1LyzlXLqlc/gPiq
-            4VLAPCjJNh8IQcmYE0+fFrpUya3CR1cQo3nwx9Hc/BPuXrjJXzbDyeMPWJAJgwbK
+            JyCxy98vJXIxmlLQZpDFfTMe3xsc8jSsHI6av+wEFKGEJAOUkDtRYvLfZdgDTfiB
-            Hxuer4x25LWRFCu/EkICxRPIbFqymLVXr/ZTsxwve8lTJnpGMTsZd4H93BMZ48sc
+            XTAhQ3ixnlBxdZZ9DjBXyVfM8q9iB8bggFi7g2SjO32LKhXRFUqZR+avddCyKR/V
-            U7V9ZoLlVp9mSCM4jbrhpoDOz96YoH0rt00+5SW9EaFEsqeLzTrSZinKSnRaR5+6
+            hRpWjDRn+eX2tl7LPawvX6tIow3aZiezkMVyeRXfcZCvpicq64b80LrYR+JJUfJE
-            G04oOyG9eSHWMTHqlZihR68ut6qUQK2GJMiv7ZIimYgbNaWG4tU/ExkUZY7rTGgq
+            vxHaekKImrdJ9ocii0wW91ZmESJwL6m5lt3ZsCY5GTlEDt4wBse5uhj48mtuK8sh
-            d1swV52fPbFhwk8PfXxeVep0VYUfjHk9GVJRRgUEoqc93NhDwWSBZuZR7FJNCM/S
+            g8uQMKp7SiiCtV5a6O1SQLDJeAt6VCcRyudLToO9S4gwrGXNPcGxsHj07XAN2PHS
-            VgFYepBIOp1J5DaeZ5jquRRIFVtFa3+nf1ceHR2GbCUy+7xGhEtIMBUsgRwDF4Wu
+            WAE6wUhufXfpa8UgSWy7fmEZt4L03XlRfC7bm/ycwaFww3A7w4+B1gkW6gOon6sy
-            pbwb8T4EreK1C9XlEfWwF44WJXuqU2Rzx3oq6FcNUfAksIk6y+SA
+            nOyIxUZfU6abZWKzH+OIuViKH7xPiULDy75gEmkRHjKu5BiC3Tx0eO4=
-            =9zQv
+            =+PPr
             -----END PGP MESSAGE-----
           fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4
     unencrypted_suffix: _unencrypted
-    version: 3.11.0
+    version: 3.9.2

machines/vaultwarden/configuration.nix

@@ -1,60 +0,0 @@
-{ config, lib, pkgs, inputs, ... }:
-
-with lib;
-
-{
-  sops.defaultSopsFile = ./secrets.yaml;
-  sops.secrets = {
-    vaultwarden_env = {
-      owner = "vaultwarden";
-      group = "vaultwarden";
-    };
-  };
-  networking = {
-    hostName = mkDefault "vaultwarden";
-    useDHCP = false;
-  };
-
-  imports = [
-    ../modules/malobeo_user.nix
-    ../modules/sshd.nix
-  ];
-
-  networking.firewall.allowedTCPPorts = [ 80 ];
-
-  services.nginx = {
-    enable = true;
-    virtualHosts."keys.malobeo.org" = {
-      locations."/" = {
-        proxyPass = "http://127.0.0.1:${toString config.services.vaultwarden.config.ROCKET_PORT}";
-        extraConfig = ''
-        '';
-      };
-    };
-  };
-
-  services.vaultwarden = {
-    enable = true;
-    backupDir = "/var/local/vaultwarden/backup";
-    environmentFile = config.sops.secrets.vaultwarden_env.path;
-    config = {
-      DOMAIN = "https://keys.malobeo.org";
-      SIGNUPS_ALLOWED = true;
-      #WEBSERVER
-      ROCKET_ADDRESS = "127.0.0.1";
-      ROCKET_PORT = 8222;
-      ROCKET_LOG = "critical";
-      #EMAIL
-      SMTP_HOST = "mail.systemli.org";
-      SMTP_PORT = 465;
-      SMTP_SECURITY = "force_tls";
-      SMTP_USERNAME = "malobot@systemli.org";
-
-      SMTP_FROM = "malobot@systemli.org";
-      SMTP_FROM_NAME = "Malobeo Vaultwarden Server";
-    };
-  };
-
-  system.stateVersion = "22.11"; # Did you read the comment?
-}
-

machines/vaultwarden/dummy.yaml

@@ -1,64 +0,0 @@
-vaultwarden_env: ENC[AES256_GCM,data:dgEYC2VcGKrIvts9sw60kmEemhRdaaLWvsEQjAE52mAfhA29iLpB/sKXt3bxRGV8gpSF8OQoXdniWwCrDhOWUihawy2WFhLENamIyY4tVBOKkEtkhQDkoAhZ1VCShb1fgN+BzfM=,iv:zvg1uh8fxeHNFOq/DpicwAk+5j1fDogrnpTX5Ua0yDQ=,tag:rcyLE928+DQF41y4ztvMbQ==,type:str]
-sops:
-    age:
-        - recipient: age18jn5mrfs4gqrnv0e2sxsgh3kq4sgxx39hwr8z7mz9kt7wlgaasjqlr88ng
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1ZE9qK2tmTWxERklOSFdZ
-            bVVUbW5aajFrWkVBREZtallvS1dreGNFVjJFCmdBdGNQQzZkMUp4dzZUYTg1Tmgr
-            K3BmajYxY01jdVVubmRUUy8rNm9oVTgKLS0tIGNtTTQwWUdzaXpjVGt5aTEvUFZy
-            UWlGRzhPcDlVb0s2OGJTOTBVS2RKVDAKKyFK+ISjqbwOftiDn5uuIJfAl3fkX4C9
-            iNHl84utfFyeUnJJK59uX3YGY8B4wEG7L3/hPt9gLtuX6Ey64yusIA==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0Y1l4Uzd1TjlKbHpuQ01v
-            YnFFWWRNNU1relVHSTk4ZjE5eXdnS2czZWpBCnJwbmRhdUtkVDUrcnFJSmVmcjBJ
-            eVBDd0l5bEovZEpRdEZMTlFMUFJ1UjAKLS0tIGo5bEQ3Tis0aXcyc1JxSVRCeXFU
-            OXFDMHExSWQ4U0RleXBqaXBGcnhEUmsKmBGLpusD28V406Gz9uHV0N43J9wEWkY3
-            WJ8R2OjVeRfMmOriWLzEkHHJw+3DJc9abzSOoIS/ViN30MkhdqzOMA==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-02-03T20:56:51Z"
-    mac: ENC[AES256_GCM,data:zkykMvBMjSmyhSPFTvyeUVZZwu0Fb4cgXD4m4lWQWKEXiHeCHQEy6YIxqutdW6vjaO/P64Hk72OH4Dh/gDl+riMbWIpFwtkzIWvclqui+PmdMoRG7u8oLa7wE9C/zypTw0yzbREyeoouIZq4zzWZsCmljfgcYSpMpQxdWgYkkbU=,iv:WbW7NAZUb2B7421chzK9LDUEkpGJ9rvnuA3jW3VjlZs=,tag:HiOV2LSLqsv+XGrVB0MugQ==,type:str]
-    pgp:
-        - created_at: "2026-02-03T20:09:53Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQGMA5HdvEwzh/H7AQwAmyshbidzh+sGpxfFEAbvcLv02pt31PopMM9XzceV0z17
-            7MaJ8+qZpif1SMpyjNmrZ4vvBa/nGF55tHLGQ+jijsEqqOqnR1+MihxLBX71wRVj
-            G9VdoaSnlKTgXLbtimo7qRjNIm4UaONLIw9M7l4DwhUNxYucNEr2eFy2wzrNgmDF
-            As5NswJXap0maBb78ieevqlTa7mE5I9FyBgTDsMubBZpD9CU6+vav9KrYLwgDuKj
-            X2SFfIo3SJdZFHDTTS3e/DTpRRf80bJ5PDChiDZ3Qr3SmaV7m+0V2EMRT7duoZ7J
-            bremMsVJo+0RhuncLgIWXFDiqU43VVfriQJeTFFTaqzqqnWTn+1Nx1ORH5NmhBhk
-            qMi2Eqc7K15Q/0AU8lHYOOvYdn62OjdyJciCBq/hTSscEpRxJNvz5G+WChMJyU6X
-            PytHqw2mFNs3jx3DleAZat+SBD8aa1e4ORC5AIVVAaVdsT4a1lFJ5V1jlk5ddg55
-            tFPh2qOqGX4V6HBBZS740lgBo7EYNFeKleDKCN8jjJYyUUfC13JnaWJy/5/9xMyi
-            YtTh7w5lTFV349zlBZSLqPuunanGN+dylWSZZrp5XTw7Q/rpa7za5LwjcDQpwaY1
-            FaFNoImglFKQ
-            =C4re
-            -----END PGP MESSAGE-----
-          fp: c4639370c41133a738f643a591ddbc4c3387f1fb
-        - created_at: "2026-02-03T20:09:53Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA98TrrsQEbXUAQ//Z6puWp6MFQZgNp95JMkCJyVMKAYDUJ4d/WRMWWxaA8pt
-            dtWokpON0st30dhXBGsicUGjAsM15gIuN3d5I2hDQqGA5Dt2LchBjdt392FoTpij
-            fdwUKpwhi91j71PrbRP1iCS6+66t5rDmUk8AWNv+9eA/4xJ+JQKgZWpBv19qbc9i
-            sb6IjhuZ3/m1Yooh7LywKUM/5qeWSeH5QFfpbhrCLLEmpL6W4/6LMl/HcF+on4h6
-            6bMZQoT+cFInBw9N3Rq4B8ffwahlkf2bv17k8sjEBvrH+rpFi85Kh0pBB8elPiUr
-            4zMJkuZZcv4YfUFoxSqVcUee5uen8RtoOHMM2tSuEq8Mjo86oIA95JkROhGLq9qz
-            NPq7k4DyotMf/2T6fZJ1nQOWAoH9ZJp4Q10qTc/Xg4xzWBlpwZh9oaLBw+HdUsYm
-            mP2ZvPw1/FHJuP2RhMz/kbEoeABm3JMGFPg1BmvVudZsr7kLpByPRGcKtm3qjARW
-            9+6fp0AYXw3C1fpYsQC+CwaSaw57GiiITtGTHCWR70yuV+G3ev/uqsFjj+96c8gy
-            h7hJaI0Ff2bFakkuwRb64UsY4FjJel1oyvDbW6y2IIswwYpzBEMV5ANzPGMIvw/G
-            x1+olgWwhXTaLZ9jIaVDfcZ2SL6v6VcMoOBhiWbeqdm+BFEkZsOitZARDIcl1trS
-            WAGu6rvESbtRp/G1ATxmP9xHCTfjNHKRj8D1eHfkObjFFG2DSL9BXozBBuvkJi8H
-            CPqVEOQZMheyU2ZnH1JNXQyANBAllEJ++XdFB5RvcTNxxeJS/APS9NM=
-            =zSyS
-            -----END PGP MESSAGE-----
-          fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4
-    unencrypted_suffix: _unencrypted
-    version: 3.11.0

machines/vaultwarden/secrets.yaml

@@ -1,64 +0,0 @@
-vaultwarden_env: ENC[AES256_GCM,data:AsgpcUGW8y5WKL+9pOYemupgB6eVlMSLYj7uCFtYQFisjGcCwBFcGTKRpzMysroo32Ugicl8WImGybrmqdJ/Xht9lAx2ralNHrgSpps3QFg+c34LFVP/F1FO3Vk+jjU00XcV1uVghxpRh95HSTEVuu9kgjYeWpAQVqp68Ku2Dww=,iv:/9l4smzqPpB5Qr+mcroiLUnRg+9GQ+pmxF523N1bOIU=,tag:jBmrxvfA8HG1Gp1KHgwssw==,type:str]
-sops:
-    age:
-        - recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsMk9xN1ZLSFc2QWQza3Zp
-            R0ladFBENFpXYWdjOE9XZm9Eek91dGxGOGdvCnpVaXU1RTZpVXYrZThGOEdnNytn
-            Vi95MTJNS09EMU5WMWwvRGlLUUdudEEKLS0tIGtUOWlWSSs0STA5ZkU0RzZpQ1c1
-            bGpVcVJJWk0vMUNoaEJvY3ZLNTRacWcKLkRr+vi2oIPiB1BbSTX71FFKuxysxE0n
-            0+0aHEFAj8LX3hyEiDzQA3IkX9GP9ba/x+XUMBdWwyw25MnUMVFKTQ==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1zs9puemeevc5kt84w9d2mc5396w0t9p60qxymkpatwvwxunzs5usmxr3an
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwS0ZHOXJSUTdlMGIzU0Nh
-            SzJDcHdvb3dmZ3dTWFJkaE9wZXFmVE9ZUkJBCjk4eTRhb3RkTlJRSUVSK2RWbDc0
-            cEtycnFOZlU5ellTSFZXc2ZVZ3lwZU0KLS0tIHpyQ1NCR2dWNURxT0pxcmxMWTlo
-            NGJqai9HNjdkc1NOTGRtSFZWWDIvQkEKe3GqRFTdMQwPbavO6bDobWMf7FwJx1OA
-            7JufIAMJORTfDTyC2fN3bpcZ+UcbPm2pplyzJ6T5p4wOFqQhRrHHyQ==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-02-03T20:58:16Z"
-    mac: ENC[AES256_GCM,data:zxM4GRwlcYoJF51Hbe0VfWvO9PrHQeCUTrGgiVgrP91qX51WTGWfCQfAVAouT3sEvE6Ie5bnAMUWjVjIrnRS6WUCQwUBwFYYUKIkJPooKwlvXRAuZ9UGZERi0/i43WKwB3/xSyVqRb9T5M6exjlkYCuE4Yv3lSEUiIn8fu/Zaas=,iv:D6f3V19E+4qukW8i9wKtNPKfYgD3OXztkICMhD24IzY=,tag:e97txZiaqDPxCLQUbNHwwg==,type:str]
-    pgp:
-        - created_at: "2026-02-05T17:22:42Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQGMA5HdvEwzh/H7AQv/XLqprcMEI3EYKJw/DA5w64lHAXKzkf8bKpFPWYSnbqMT
-            ajDkcOhA+KMRt1Qgr8aCW7cnWLfy6Ff7U2rSFQ4uBgGKChmYSiMiPdEokYQuYbFE
-            pJh/j4qGcewVpQDVe6N+obqZ0n5oQImn0mO8KkXjrcBhrhuLThAeNxFl7RILOfD0
-            HPFYwy6vMIVPFYCAm4CqIjsMo4feCPYcpxJJwO4aRISkR8vcGAgu9/wWhQIxvdPf
-            O4gTcRshfX6C+TwnwW6Ac7D1rDS5HBnQF4pD4wfYEI00qHKHgeYC4TrEnmta6MG2
-            bvOQBbAUDSf3heEcQ3CwqcRDHzIssAlbW3p9nBRUVOuOta+3rV29lSuz8cbEqVOs
-            MOwN/atluA1jhWgZbt+8SuoleHnbR+hJNJnplvoKN2PmJ3tEbpSCaRaZVaaRFEhm
-            K1tLG2B5IaKMY4n0N1bPnFcvL7s1xS0INPodXzJITyvuJssEL5Dc+YEWxNvEmHGJ
-            ttlyHBJCxWOHsPMh2UcB0lgBBtJt+O2lcAIpwky9T2ufj1EFzLkXV4Sf39S6J/PI
-            814IQE1Bmuy1qqkGhc6WthiooVf/udtWgehwQFwrpY+35GaNQHluFJOrthqraYXK
-            shMbX3AZdLuu
-            =w602
-            -----END PGP MESSAGE-----
-          fp: c4639370c41133a738f643a591ddbc4c3387f1fb
-        - created_at: "2026-02-05T17:22:42Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA98TrrsQEbXUARAAiZsUiicVpIDdSF/XSuZOITPwmL0P1Nyc1LI9QpyQw2fj
-            uaoJV3xO+MW4ovDcJRms/6T5b4IG740s19l/iryd2jhPwn+94EkzhR1cRydvCimU
-            Zexf+y793kKe0TbcNvakAnpArI5RPdAIoPB7V2aa0vweABaxE5XoDedJA646wMbl
-            +pgzVxoE7i6+uxWHGw3MitCneiBcljg9g04FVj9doJfG6LQxfpx01pjiRLVsTGfV
-            LXPLKVJOToEusFz1hLaFMLxPkvFbgQD1YQz82OOJasHr9YGCzitqhA+EV4U4Y9AH
-            bzPlz1qractUIz8pawhKcTUd8Xw+WOZ6kFX3EdUUnD46jMf12j2fe9Axw8v+Cujx
-            jb8+mSbRNH8Tx/phbhWyBhTNhNXoMLW/2nTSJjTUvdjNlIJi3Ntu4AyPpZ9Z2LwM
-            azvzHRC20gEsf25YKAv2/EnOAi7/jx9uknj3pATdaAAS5hKcMutVdiBAPS37695W
-            Fh8aaoCb4ieuHmHFAt0SQ30z/oR2psurwaurGcLQz9IR9uUlCFU9uVifDaSCNiwF
-            EVsRQZAslLqGPDf7c/r8efsMcHRfVVCJvvuvyRZNSHIpOnR/QGLOeNY+B59IdTCJ
-            fk2dMvZpyM1AdLkW2jT0qXj4vKAvVPlEbIXmq9bu/jJER35MzMRWfMmbBzek9t3S
-            WAGL4Zf96omkP7Z9j1UYGv4xcGksajbA6HvCHfjI+mUKV4QxGieeJhicaPYLuo7x
-            wKZqzMZGPpy1dPq75t0RAmnRzHaB9VEUWfO+KYIY/+1qRxOANYl+uZA=
-            =K3Hh
-            -----END PGP MESSAGE-----
-          fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4
-    unencrypted_suffix: _unencrypted
-    version: 3.11.0

machines/vpn/configuration.nix

@@ -40,7 +40,7 @@ with lib;
       };
     };
 
-    virtualHosts."keys.malobeo.org" = {
+    virtualHosts."cloud.malobeo.org" = {
       locations."/" = {
         proxyPass = "http://10.100.0.101";
         extraConfig = ''
@@ -66,6 +66,28 @@ with lib;
         '';
       };
     };
+
+    virtualHosts."zines.malobeo.org" = {
+      locations."/" = {
+        proxyPass = "http://10.100.0.101";
+        extraConfig = ''
+          proxy_set_header Host $host;
+          proxy_set_header X-Real-IP $remote_addr;
+          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+          proxy_set_header X-Forwarded-Proto $scheme;
+          proxy_set_header Authorization $http_authorization;  # Pass the Authorization header
+          proxy_pass_header Authorization;
+
+          client_body_in_file_only clean;
+          client_body_buffer_size 32K;
+          
+          client_max_body_size 50M;
+          
+          sendfile on;
+          send_timeout 300s;
+        '';
+      };
+    };
   };
 
   system.stateVersion = "22.11"; # Did you read the comment?

machines/zineshop/configuration.nix

@@ -20,6 +20,7 @@ with lib;
     enable = true;
     enablePromtail = true;
     logNginx = true;
+    lokiHost = "10.0.0.14";
   };
 
   services.printing.enable = true;

outputs.nix

@@ -74,6 +74,63 @@ in (utils.lib.eachSystem (builtins.filter filter_system utils.lib.defaultSystems
         '';
       };
 
+      #deckWithDrag = pkgs.buildNpmPackage {
+      #  name = "deckWithDrag";
+      #  version = "1.16.2";
+      #  src = pkgs.fetchFromGitHub {
+      #    owner = "nextcloud";
+      #    repo = "deck";
+      #    rev = "v1.16.2";
+      #    hash = "sha256-NBkCdMjIY2r+AgCLBt4YnD4sUW7GTKxT5vHAmpk4wno=";
+      #    leaveDotGit = true;
+      #  };
+
+      #  makeCacheWritable = true;
+      #  npmDepsHash = "sha256-VaKfpYFtrTUvGbKORPvex1FvLz4vR7zfHAf+fdf/6OE=";
+
+      #  buildInputs = with pkgs; [
+      #    gnumake krankerl php84Packages.composer php nodejs_24
+      #  ];
+
+      #  patches = [
+      #    (pkgs.fetchpatch {
+      #      url = "https://git.dynamicdiscord.de/ahtlon/deck/commit/77cbcf42ca80dd32e450839f02faca2e5fed3761.patch";
+      #      sha256 = "sha256-agwFMwXO8WLL0+pdeKF/pA59V9ah9t590sCl1msQonA=";
+      #    })
+      #  ];
+
+      #  buildPhase = ''
+      #    ${pkgs.krankerl}/bin/krankerl package
+      #  '';
+      #};
+
+      deckWithDrag = pkgs.stdenv.mkDerivation {
+        name = "deckWithDrag";
+        src = pkgs.fetchFromGitHub {
+          owner = "nextcloud";
+          repo = "deck";
+          rev = "v1.16.2";
+          hash = "sha256-NBkCdMjIY2r+AgCLBt4YnD4sUW7GTKxT5vHAmpk4wno=";
+          leaveDotGit = true;
+        };
+
+        buildInputs = with pkgs; [
+          gnumake krankerl php84Packages.composer php nodejs_24
+        ];
+
+        patches = [
+          (pkgs.fetchpatch {
+            url = "https://git.dynamicdiscord.de/ahtlon/deck/commit/77cbcf42ca80dd32e450839f02faca2e5fed3761.patch";
+            sha256 = "sha256-agwFMwXO8WLL0+pdeKF/pA59V9ah9t590sCl1msQonA=";
+          })
+        ];
+
+        buildPhase = ''
+          make release
+          #${pkgs.krankerl}/bin/krankerl package
+        '';
+      };
+
       run-vm = pkgs.writeShellScriptBin "run-vm"  (builtins.readFile ./scripts/run-vm.sh);
     };