[pretalx] fix eval by pulling service file from unstable

my bad, i read that `RemainAfterExit` would allow a manual nixos switch to work but it prevents the timer from starting the service at all

.gitea/workflows/autoupdate.yml

@@ -2,7 +2,7 @@ name: Weekly Flake Update
 
 on:
     schedule:
-        - cron: "0 0 * * 4"
+        - cron: "0 4 1/14 * *"
     workflow_dispatch:
 
 permissions:
@@ -89,6 +89,18 @@ jobs:
                 grep -q ${{ github.ref_name }} &&
                 exit 1 ||
                 exit 0
+            - name: close other bump requests
+              run: |
+                for i in $(tea pr -o simple | grep "Automatic Nixpkgs update" | awk '{print $1}')
+                do
+                  if [ "$i" = "" ]
+                  then
+                    echo "No bumps to close"
+                    exit 0
+                  else
+                    tea pr close $i
+                  fi
+                done
             - name: Force push branch
               run: git push --force -u origin nixpkgs_bump_$(date +%Y%m%d)
             - name: Create pull request

.gitea/workflows/hydra-callback.yml

@@ -0,0 +1,63 @@
+name: Hydra callback
+
+on:
+    pull_request:
+        types: 
+            - opened
+            - synchronize
+        paths:
+          - '**.nix'
+          - flake.lock
+    push:
+        branches:
+          - master
+        paths:
+          - '**.nix'
+          - flake.lock
+
+permissions:
+    contents: write
+
+jobs:
+    on_pr:
+        if: github.event.pull_request
+        runs-on: ubuntu-latest
+        env:
+            NIXPKGS_ALLOW_UNFREE: 1
+        steps:
+            - name: Install sudo
+              run: |
+                  apt-get update
+                  apt-get install -y sudo
+            - name: Set up Nix
+              uses: https://github.com/cachix/install-nix-action@v31
+              with: 
+                github_access_token: ${{ secrets.AHTLONS_GITHUB_TOKEN }}
+            - name: Find pr number
+              run: |
+                echo PR=$(echo "${{ github.ref }}" | cut -d / -f 3) >> "$GITHUB_ENV"
+            - name: run hydra wait
+              timeout-minutes: 200
+              run: |
+                echo "Running now @ pr no $PR"
+                nix run nixpkgs#hydra-cli -- -H https://hydra.malobeo.org jobset-wait malobeo "$PR"
+
+    on_push:
+        if: github.event.push
+        runs-on: ubuntu-latest
+        env:
+            NIXPKGS_ALLOW_UNFREE: 1
+        steps:
+            - name: Install sudo
+              run: |
+                  apt-get update
+                  apt-get install -y sudo
+            - name: Set up Nix
+              uses: https://github.com/cachix/install-nix-action@v31
+              with: 
+                github_access_token: ${{ secrets.AHTLONS_GITHUB_TOKEN }}
+            - name: run hydra wait
+              timeout-minutes: 200
+              run: |
+                echo "Running now @ master"
+                nix run nixpkgs#hydra-cli -- -H https://hydra.malobeo.org jobset-wait malobeo master

.hydra/declarative-jobsets.nix

@@ -0,0 +1,75 @@
+{ nixpkgs, pulls, ... }:
+
+let
+  pkgs = import nixpkgs { };
+
+  prs = builtins.fromJSON (builtins.readFile pulls);
+  prJobsets = pkgs.lib.mapAttrs (num: info: {
+    enabled = 1;
+    hidden = false;
+    description = "PR ${num}: ${info.title}";
+    checkinterval = 300;
+    schedulingshares = 20;
+    enableemail = false;
+    emailoverride = "";
+    keepnr = 1;
+    type = 1;
+    flake = "${info.head.repo.html_url}/archive/${info.head.ref}.tar.gz";
+    inputs = {
+      gitea_repo_name = {
+        type = "string";
+        value = "${info.head.repo.name}";
+        emailresponsible = false;
+      };
+      gitea_repo_owner = {
+        type = "string";
+        value = "${info.head.repo.owner.username}";
+        emailresponsible = false;
+      };
+      gitea_http_url = {
+        type = "string";
+        value = "https://git.dynamicdiscord.de";
+        emailresponsible = false;
+      };
+      gitea_status_repo = {
+        type = "string";
+        value = "${info.head.ref}";
+        emailresponsible = false;
+      };
+    };
+  }) prs;
+  mkFlakeJobset = branch: {
+    description = "Build ${branch} branch of the Malobeo Infrastructure repo";
+    checkinterval = 300;
+    enabled = "1";
+    schedulingshares = 100;
+    enableemail = false;
+    emailoverride = "";
+    keepnr = 3;
+    hidden = false;
+    type = 1;
+    flake = "https://git.dynamicdiscord.de/malobeo/infrastructure/archive/${branch}.tar.gz";
+  };
+
+  desc = prJobsets // {
+    "master" = mkFlakeJobset "master";
+  };
+
+  log = {
+    pulls = prs;
+    jobsets = desc;
+  };
+
+in
+{
+  jobsets = pkgs.runCommand "spec-jobsets.json" { } ''
+    cat >$out <<'EOF'
+    ${builtins.toJSON desc}
+    EOF
+    # This is to get nice .jobsets build logs on Hydra
+    cat >tmp <<'EOF'
+    ${builtins.toJSON log}
+    EOF
+    ${pkgs.jq}/bin/jq . tmp
+  '';
+}

.hydra/spec.json

@@ -0,0 +1,30 @@
+{
+  "enabled": 1,
+  "hidden": false,
+  "description": "Malobeo infrastructure repo",
+  "nixexprinput": "nixexpr",
+  "nixexprpath": ".hydra/declarative-jobsets.nix",
+  "checkinterval": 60,
+  "schedulingshares": 100,
+  "enableemail": false,
+  "emailoverride": "",
+  "keepnr": 5,
+  "type": 0,
+  "inputs": {
+    "nixexpr": {
+      "value": "https://git.dynamicdiscord.de/malobeo/infrastructure master",
+      "type": "git",
+      "emailresponsible": false
+    },
+    "nixpkgs": {
+      "value": "https://github.com/NixOS/nixpkgs nixos-25.11",
+      "type": "git",
+      "emailresponsible": false
+    },
+    "pulls": {
+      "type": "path",
+      "value": "http://127.0.0.1:27364/gitea-pulls-sorted.json",
+      "emailresponsible": false
+    }
+  }
+}

README.md

@@ -4,8 +4,8 @@ this repository contains nixos configurations of the digital malobeo infrastruct
 
 ### deploying configuration
 
-hosts are deployed automatically from master. The [hydra build server](https://hydra.dynamicdiscord.de/jobset/malobeo/infrastructure) will build new commits and on success, hosts will periodically pull those changes.
-Big changes (like updating flake lock) could be commited to the staging branch first. [Hydra builds staging seperate](https://hydra.dynamicdiscord.de/jobset/malobeo/staging), and on success you can merge into master.
+hosts are deployed automatically from master. The [hydra build server](https://hydra.malobeo.org/jobset/malobeo/infrastructure) will build new commits and on success, hosts will periodically pull those changes.
+Big changes (like updating flake lock) could be commited to the staging branch first. [Hydra builds staging seperate](https://hydra.malobeo.org/jobset/malobeo/staging), and on success you can merge into master.
 
 ### deploy fresh host
 if you want to deploy a completly new host refer to [docs](https://docs.malobeo.org/anleitung/create.html)

doc/book.toml

@@ -1,6 +1,5 @@
 [book]
 authors = ["ahtlon"]
 language = "de"
-multilingual = false
 src = "src"
 title = "Malobeo Infrastruktur Dokumentation"

doc/src/Index.md

@@ -4,8 +4,8 @@ this repository contains nixos configurations of the digital malobeo infrastruct
 
 ### deploying configuration
 
-hosts are deployed automatically from master. The [hydra build server](https://hydra.dynamicdiscord.de/jobset/malobeo/infrastructure) will build new commits and on success, hosts will periodically pull those changes.
-Big changes (like updating flake lock) could be commited to the staging branch first. [Hydra builds staging seperate](https://hydra.dynamicdiscord.de/jobset/malobeo/staging), and on success you can merge into master.
+hosts are deployed automatically from master. The [hydra build server](https://hydra.malobeo.org/jobset/malobeo/infrastructure) will build new commits and on success, hosts will periodically pull those changes.
+Big changes (like updating flake lock) could be commited to the staging branch first. [Hydra builds staging seperate](https://hydra.malobeo.org/jobset/malobeo/staging), and on success you can merge into master.
 
 ### deploy fresh host
 if you want to deploy a completly new host refer to [docs](https://docs.malobeo.org/anleitung/create.html)

doc/src/SUMMARY.md

@@ -12,6 +12,7 @@
             - [musik](./projekte/musik.md)
         - [TODO](./todo.md)
         - [Modules]()
+            - [Gitea-translator](./module/gitea-translator.md)
             - [Initrd-ssh](./module/initssh.md)
             - [Disks](./module/disks.md)
     - [How-to]()

doc/src/anleitung/create.md

@@ -1,4 +1,36 @@
-# Create host with nixos-anywhere
+# Create a new host
+
+### Base config
+there is an example config [here](../files/base_host.md) *note: TODO*
+## If this is a physical host
+Create the keys and secrets using `add-host-keys`
+This will ask for a hostname and then
+- create and encrypt a ssh-key with sops
+- create and encrypt a second ssh-key for the init
+- convert the main key to a sops pubkey and display it
+- create public/private wireguard keys and display the pubkey
+- generate a reproducible mac-address
+
+After this you have to
+- write the age public key into machines/.sops.yaml under `keys:`
+- write a new creation rule for the `secrets.yaml` under `creation_rules:` like
+```
+creation_rules:
+  - path_regex: {hostname}/secrets.yaml$
+    key_groups:
+    - pgp:
+      - *admin_kalipso
+      - *admin_kalipso_dsktp
+      age:
+      - *admin_atlan
+      - *machine_{hostname}
+```
+- create the secrets.yaml using `sops {hostname}/secrets.yaml`
+    - you can already add `wg_private: {wg priv key}` here
+- add the host to the `hosts.nix` file (if microvm use the generated mac here)
+- add the host to `machines/modules/malobeo/peers.nix` for vpn access (use the wireguard pubkey here)
+
+# deploy the host with nixos-anywhere
 We use a nixos-anywhere wrapper script to deploy new hosts.
 The wrapper script takes care of copying persistent host keys before calling nixos-anywhere.
 

doc/src/module/gitea-translator.md

@@ -0,0 +1,21 @@
+# Gitea-tanslator
+The module can be used by importing `inputs.self.nixosModules.malobeo.gitea-translator`
+
+This module starts a python server that fetches the gitea pull request api and translates it to a file that hydra understands.   
+To use, just set the parameters of the gitea server, then send a GET request to either `http://${host}:${port}/` or `http://${host}:${port}/gitea-pulls-sorted.json`
+
+## Module config
+##### enable (default = false) - enables the module  
+##### baseurl (default = "git.dynamicdiscord.de") - Base URL of the Gitea instance   
+##### owner (default = "malobeo") - Repository owner   
+##### repo (default = "infrastructure") - Repository name   
+##### host (default = "127.0.0.1") - Address the server binds to   
+##### port (default = 27364) - Port the server listens on   
+
+## Hydra config
+If you change the default port or host, the file `.hydra/spec.json` has to be modified accordingly.
+With the module running on the hydra host, create a new hydra project, then:
+
+    - Set `Declarative spec file` to `.hydra/spec.json`
+    - Change declaritive input type to `Git checkout`
+    - Set your git repo location in the field below that

flake.lock

@@ -7,11 +7,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1746728054,
-        "narHash": "sha256-eDoSOhxGEm2PykZFa/x9QG5eTH0MJdiJ9aR00VAofXE=",
+        "lastModified": 1768920986,
+        "narHash": "sha256-CNzzBsRhq7gg4BMBuTDObiWDH/rFYHEuDRVOwCcwXw4=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "ff442f5d1425feb86344c028298548024f21256d",
+        "rev": "de5708739256238fb912c62f03988815db89ec9a",
         "type": "github"
       },
       "original": {
@@ -29,11 +29,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1768143854,
-        "narHash": "sha256-E5/kyPz4zAZn/lZdvqlF83jMgCWNxmqYjjWuadngCbk=",
+        "lastModified": 1788076475,
+        "narHash": "sha256-sD4UyILWAhk7aexE3YpDOdb71ZEeL+1/+LV05XIWCBo=",
         "owner": "kirelagin",
         "repo": "dns.nix",
-        "rev": "a97cf4156e9f044fe4bed5be531061000dfabb07",
+        "rev": "4710a34f2c36e7a0d634d7ba8fe2499d75f012a2",
         "type": "github"
       },
       "original": {
@@ -78,24 +78,6 @@
         "type": "github"
       }
     },
-    "flake-utils_2": {
-      "inputs": {
-        "systems": "systems_3"
-      },
-      "locked": {
-        "lastModified": 1731533236,
-        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
     "home-manager": {
       "inputs": {
         "nixpkgs": [
@@ -103,16 +85,16 @@
         ]
       },
       "locked": {
-        "lastModified": 1763992789,
-        "narHash": "sha256-WHkdBlw6oyxXIra/vQPYLtqY+3G8dUVZM8bEXk0t8x4=",
+        "lastModified": 1787377438,
+        "narHash": "sha256-Sxu1NLTD/Ern6hFGLlZmtKCSct3YQXZI/lls8RE1XeM=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "44831a7eaba4360fb81f2acc5ea6de5fde90aaa3",
+        "rev": "65258d5c65a250189fde2e35f490d15e064c4c62",
         "type": "github"
       },
       "original": {
         "owner": "nix-community",
-        "ref": "release-25.05",
+        "ref": "release-26.05",
         "repo": "home-manager",
         "type": "github"
       }
@@ -138,18 +120,17 @@
     },
     "microvm": {
       "inputs": {
-        "flake-utils": "flake-utils_2",
         "nixpkgs": [
           "nixpkgs"
         ],
         "spectrum": "spectrum"
       },
       "locked": {
-        "lastModified": 1764549796,
-        "narHash": "sha256-Mswg665P92EoHkBwCwPr/7bdnj04g2Qfb+t02ZEYTHA=",
+        "lastModified": 1788263502,
+        "narHash": "sha256-gyVqW5U9wy6A8voJNu6SiSYTKDplo/MDl31x7FszWlk=",
         "owner": "astro",
         "repo": "microvm.nix",
-        "rev": "030d055e877cc13d7525b39f434150226d5e4482",
+        "rev": "974d315e504e666eac4920d712e3ff6804dc1502",
         "type": "github"
       },
       "original": {
@@ -181,11 +162,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1764234087,
-        "narHash": "sha256-NHF7QWa0ZPT8hsJrvijREW3+nifmF2rTXgS2v0tpcEA=",
+        "lastModified": 1769813415,
+        "narHash": "sha256-nnVmNNKBi1YiBNPhKclNYDORoHkuKipoz7EtVnXO50A=",
         "owner": "nix-community",
         "repo": "nixos-generators",
-        "rev": "032a1878682fafe829edfcf5fdfad635a2efe748",
+        "rev": "8946737ff703382fda7623b9fab071d037e897d5",
         "type": "github"
       },
       "original": {
@@ -195,12 +176,15 @@
       }
     },
     "nixos-hardware": {
+      "inputs": {
+        "nixpkgs": "nixpkgs_2"
+      },
       "locked": {
-        "lastModified": 1764440730,
-        "narHash": "sha256-ZlJTNLUKQRANlLDomuRWLBCH5792x+6XUJ4YdFRjtO4=",
+        "lastModified": 1788335262,
+        "narHash": "sha256-3jBEq8avfzlrsY4UpW4d5TOmm7ocseZfnitEJhqauyc=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "9154f4569b6cdfd3c595851a6ba51bfaa472d9f3",
+        "rev": "44d95795ee2d475b3d687325e26dcf4ca9104557",
         "type": "github"
       },
       "original": {
@@ -228,11 +212,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1764517877,
-        "narHash": "sha256-pp3uT4hHijIC8JUK5MEqeAWmParJrgBVzHLNfJDZxg4=",
+        "lastModified": 1788179007,
+        "narHash": "sha256-hn1oU2rue2SYK8dAr8+WNZWtbsz1S2W5mnHlSEuh3bo=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "2d293cbfa5a793b4c50d17c05ef9e385b90edf6c",
+        "rev": "34ab99075ac4f7e40cf037eef32cb1c360bb85e9",
         "type": "github"
       },
       "original": {
@@ -244,16 +228,29 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1764522689,
-        "narHash": "sha256-SqUuBFjhl/kpDiVaKLQBoD8TLD+/cTUzzgVFoaHrkqY=",
+        "lastModified": 1767892417,
+        "narHash": "sha256-8bW3q88CEg2u4hSP66Vf4lpbLonHz7hqDNBMcCY7E9U=",
+        "rev": "3497aa5c9457a9d88d71fa93a4a8368816fbeeba",
+        "type": "tarball",
+        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.05pre924538.3497aa5c9457/nixexprs.tar.xz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://channels.nixos.org/nixos-unstable/nixexprs.tar.xz"
+      }
+    },
+    "nixpkgs_3": {
+      "locked": {
+        "lastModified": 1788187754,
+        "narHash": "sha256-bu1QxmXKmPuvBLN7bHP355OV9Qo13x9WCiRDH62CqRM=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "8bb5646e0bed5dbd3ab08c7a7cc15b75ab4e1d0f",
+        "rev": "5dfba6236110080a54247d6460bc2ff5dda939cc",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-25.11",
+        "ref": "nixos-26.05",
         "repo": "nixpkgs",
         "type": "github"
       }
@@ -268,7 +265,7 @@
         "microvm": "microvm",
         "nixos-generators": "nixos-generators",
         "nixos-hardware": "nixos-hardware",
-        "nixpkgs": "nixpkgs_2",
+        "nixpkgs": "nixpkgs_3",
         "nixpkgs-unstable": "nixpkgs-unstable",
         "sops-nix": "sops-nix",
         "tasklist": "tasklist",
@@ -283,11 +280,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1764483358,
-        "narHash": "sha256-EyyvCzXoHrbL467YSsQBTWWg4sR96MH1sPpKoSOelB4=",
+        "lastModified": 1788337237,
+        "narHash": "sha256-gkSH8VUtCo6hnysNmb9DbTuDepH2t5pv+QWjP75xKAk=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "5aca6ff67264321d47856a2ed183729271107c9c",
+        "rev": "fbf759290e0cb0a98dfc813a4eb7d53ad1dacb57",
         "type": "github"
       },
       "original": {
@@ -299,11 +296,11 @@
     "spectrum": {
       "flake": false,
       "locked": {
-        "lastModified": 1759482047,
-        "narHash": "sha256-H1wiXRQHxxPyMMlP39ce3ROKCwI5/tUn36P8x6dFiiQ=",
+        "lastModified": 1785761586,
+        "narHash": "sha256-MWOMVqJJERwjQGgRIv8d6rlEBqbLM3VZWxHkNKIIZNw=",
         "ref": "refs/heads/main",
-        "rev": "c5d5786d3dc938af0b279c542d1e43bce381b4b9",
-        "revCount": 996,
+        "rev": "a7762d6f54b40560dd5255ce902e6e6a5d980fe9",
+        "revCount": 1416,
         "type": "git",
         "url": "https://spectrum-os.org/git/spectrum"
       },
@@ -372,21 +369,6 @@
         "type": "github"
       }
     },
-    "systems_5": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    },
     "tasklist": {
       "inputs": {
         "nixpkgs": [
@@ -445,7 +427,7 @@
     },
     "utils_3": {
       "inputs": {
-        "systems": "systems_4"
+        "systems": "systems_3"
       },
       "locked": {
         "lastModified": 1731533236,
@@ -463,7 +445,7 @@
     },
     "utils_4": {
       "inputs": {
-        "systems": "systems_5"
+        "systems": "systems_4"
       },
       "locked": {
         "lastModified": 1731533236,

flake.nix

@@ -3,7 +3,7 @@
 
   inputs = {
     nixos-hardware.url = "github:NixOS/nixos-hardware/master";
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05";
     nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixos-unstable";
     sops-nix.url = "github:Mic92/sops-nix";
     sops-nix.inputs.nixpkgs.follows = "nixpkgs";
@@ -43,7 +43,7 @@
     };
 
     home-manager=  {
-      url = "github:nix-community/home-manager/release-25.05";
+      url = "github:nix-community/home-manager/release-26.05";
       inputs = {
         nixpkgs.follows = "nixpkgs";
       };

machines/.sops.yaml

@@ -15,6 +15,8 @@ keys:
   - &machine_fanny age136sz3lzhxf74ryruvq34d4tmmxnezkqkgu6zqa3dm582c22fgejqagrqxk
   - &machine_nextcloud age1g084sl230x94mkd2wq92s03mw0e8mnpjdjfx9uzaxw6psm8neyzqqwpnqe
   - &machine_vaultwarden age1zs9puemeevc5kt84w9d2mc5396w0t9p60qxymkpatwvwxunzs5usmxr3an
+  - &machine_pretalx age1y04q8n7mgk82c87rfddm0u72h0ny6sfzktjsk0cc3gu93kezudfqdp9v9g
+  - &machine_albert age1mfarz0n7qfa7vg8zz355qf8eregm6myl38lld0h767nuvhgjqd4qruxuhn
   #this dummy key is used for testing.
   - &machine_dummy age18jn5mrfs4gqrnv0e2sxsgh3kq4sgxx39hwr8z7mz9kt7wlgaasjqlr88ng
 creation_rules:
@@ -105,6 +107,22 @@ creation_rules:
       age:
       - *admin_atlan
       - *machine_vaultwarden
+  - path_regex: pretalx/secrets.yaml$
+    key_groups:
+    - pgp:
+      - *admin_kalipso
+      - *admin_kalipso_dsktp
+      age:
+      - *admin_atlan
+      - *machine_pretalx
+  - path_regex: albert/secrets.yaml$
+    key_groups:
+    - pgp:
+      - *admin_kalipso
+      - *admin_kalipso_dsktp
+      age:
+      - *admin_atlan
+      - *machine_albert
   - path_regex: .*/secrets/.*
     key_groups:
     - pgp:

machines/albert/configuration.nix

@@ -0,0 +1,94 @@
+{ inputs, config, ... }:
+let
+  sshKeys = import ../ssh_keys.nix;
+  peers = import ../modules/malobeo/peers.nix;
+  hosts = import ../hosts.nix {};
+in
+{
+  networking.hostName = "albert";
+  networking.nameservers = [
+    "192.168.1.1"
+    "1.1.1.1"
+  ];
+
+  sops.defaultSopsFile = ./secrets.yaml;
+  sops.secrets.wg_private = {};
+
+  imports =
+    [ # Include the results of the hardware scan.
+      #./hardware-configuration.nix
+      ../modules/sshd.nix
+      ../modules/minimal_tools.nix
+      ../modules/autoupdate.nix
+      inputs.self.nixosModules.malobeo.vpn
+      inputs.self.nixosModules.malobeo.initssh
+      inputs.self.nixosModules.malobeo.disko
+      inputs.self.nixosModules.malobeo.metrics
+      inputs.self.nixosModules.malobeo.users
+      inputs.self.nixosModules.malobeo.backup
+      ./hydra.nix
+    ];
+
+  virtualisation.vmVariantWithDisko = {
+    virtualisation = {
+      memorySize =  4096; 
+      cores = 3;
+    };
+  };
+
+  virtualisation.vmVariant.virtualisation.graphics = false;
+
+  malobeo.metrics = {
+    enable = true;
+    enablePromtail = true;
+    logNginx = true;
+    lokiHost = hosts.malobeo.hosts.overwatch.network.address;
+  };
+
+  malobeo.autoUpdate = {
+    enable = true;
+    url = "https://hydra.malobeo.org";
+    project = "malobeo";
+    jobset = "master";
+    cacheurl = "https://cache.malobeo.org";
+  };
+
+  malobeo.users = {
+    malobeo = false;
+    admin = true;
+    backup = true;
+  };
+
+  malobeo.disks = {
+    enable = true;
+    hostId = "a3c31011";
+    root = {
+      disk0 = "disk/by-id/nvme-WD_PC_SN740_SDDQNQD-512G-1001_22445F801371";
+    };
+  };
+
+  malobeo.initssh = {
+    enable = true;
+    authorizedKeys = sshKeys.admins;
+    ethernetDrivers = ["e1000e"];
+  };
+
+  services.malobeo.vpn = {
+    enable = true;
+    name = "albert";
+    privateKeyFile = config.sops.secrets.wg_private.path;
+  };
+
+  networking = {
+    firewall = {
+      allowedTCPPorts = [ 80 443 3000 5000];
+    };
+  };
+
+  nixpkgs.config.allowUnfree = true; 
+  boot.binfmt.emulatedSystems = [ "aarch64-linux" "i686-linux" ];
+  services.acpid.enable = true;
+  time.timeZone = "Europe/Berlin";
+  system.stateVersion = "26.05"; # Do.. Not.. Change..
+}
+

machines/albert/hydra.nix

@@ -0,0 +1,101 @@
+{ config, pkgs, inputs, ... }:
+
+{
+  sops.secrets.cache_priv = {};
+  sops.secrets.gitea_token = {
+    owner = "hydra";
+    group = "hydra";
+    mode = "0440";
+  };
+
+  services.postfix = {
+    enable = true;
+    setSendmail = true;
+  };
+
+  imports =
+    [
+      inputs.self.nixosModules.malobeo.gitea-translator
+    ];
+
+  services.malobeo.gitea-translator = {
+    enable = true;
+  };
+
+  services.hydra = {
+    enable = true;
+    hydraURL = "https://hydra.malobeo.org";
+    useSubstitutes = true;
+    notificationSender = "hydra@localhost";
+
+    extraConfig = ''
+      store_uri = file:///var/lib/hydra/cache?secret-key=/etc/nix/albert/secret
+      binary_cache_secret_key_file = /etc/nix/albert/secret
+      binary_cache_dir = /var/lib/hydra/cache
+      Include ${config.sops.secrets.gitea_token.path}
+      using_frontend_proxy 1
+      base_uri hydra.malobeo.org
+    '';
+  };
+
+  systemd.services.hydra-manual-setup = {
+    description = "Create Admin User for Hydra";
+    serviceConfig.Type = "oneshot";
+    serviceConfig.RemainAfterExit = true;
+    wantedBy = [ "multi-user.target" ];
+    requires = [ "hydra-init.service" ];
+    after = [ "hydra-init.service" ];
+    environment = builtins.removeAttrs (config.systemd.services.hydra-init.environment) ["PATH"];
+    script = ''
+      if [ ! -e ~hydra/.setup-is-complete ]; then
+        # create signing keys
+        /run/current-system/sw/bin/install -d -m 551 /etc/nix/albert
+        /run/current-system/sw/bin/nix-store --generate-binary-cache-key albert /etc/nix/albert/secret /etc/nix/albert/public
+        /run/current-system/sw/bin/chown -R hydra:hydra /etc/nix/albert
+        /run/current-system/sw/bin/chmod 440 /etc/nix/albert/secret
+        /run/current-system/sw/bin/chmod 444 /etc/nix/albert/public
+        # create cache
+        /run/current-system/sw/bin/install -d -m 755 /var/lib/hydra/cache
+        /run/current-system/sw/bin/chown -R hydra-queue-runner:hydra /var/lib/hydra/cache
+        # done
+        touch ~hydra/.setup-is-complete
+      fi
+    '';
+  };
+
+  nix.gc = {
+    automatic = true;
+    dates = "15 3 * * *"; # [1]
+  };
+
+
+  nix.settings.trusted-users = ["hydra" "hydra-evaluator" "hydra-queue-runner"];
+  nix.settings.auto-optimise-store = true;
+
+  services.nix-serve = {
+    enable = true;
+    secretKeyFile = config.sops.secrets.cache_priv.path;
+  };
+
+  nix.buildMachines = [
+    {
+      hostName = "localhost";
+      systems = [ "x86_64-linux" "i686-linux" "aarch64-linux" ];
+      protocol = null;
+      maxJobs = 6;
+      supportedFeatures = ["kvm" "nixos-test" "big-parallel" "benchmark"];
+    }
+  ];
+
+  nix.settings.allowed-uris = [
+    "github:"
+    "git+https://github.com/"
+    "git+ssh://github.com/"
+    "https://github.com/nixos/nixpkgs"
+
+    "git+https://git.dynamicdiscord.de/"
+    "git+ssh://git.dynamicdiscord.de/"
+    "https://git.dynamicdiscord.de"
+  ];
+}
+

machines/albert/secrets.yaml

@@ -0,0 +1,66 @@
+wg_private: ENC[AES256_GCM,data:rSENHGEat9wre1bFcM3LYnlGjf9gmcE9FmeCySzbGZ4SCCUl5QLQN/quXw0=,iv:Bdwlk5UHSiyA9gSW91LUPJyBG50FG/hpwyClzTOUoUI=,tag:/Jw549R5Qmg4WblL7rUE8w==,type:str]
+gitea_token: ENC[AES256_GCM,data:1LevtPr5awIu2rcCGbLIsQA5QO0AhFk5Rep7RG28QdlFHDADCaEoS18pEEZ9NMYMZaGWIBA8Zq/NsCYxQGzuWh3TESZW7CO5kzCaSVG1aqjGpjfbeyG+xQEDtab2Owh+TVN/wVGUUDR1NBlWqE4Shw7mO228CWbxQRSQo3lsLhmf69fLEV1DDnH0Xt7Ml8tr7yLIeWHlG0BeOMKSkY17APahxqBx547Zw+kgaUW3WgTyxeWZaDjk/prK6bYV2euK4Il/4vTZE/x0mThmTThjszcAvdaon+V8y1Ax34gTyAgjvpFC2kE=,iv:1A8YNv/A0MEkGKV5Z9WPI4LwQFu2Z9BWuN2yfFHCPLI=,tag:hEfskDEAQiriXNjcYzziSg==,type:str]
+cache_priv: ENC[AES256_GCM,data:NbfyBv68UCWuSjbUu5lFUXPgG+vYrxbAQeD77YlklTRm6MVS4lAEjUzjnjewcX6Khca1N7r7vGieFyaBlQm0264KGTP5tc7BnEIKJDOD/UHQBdMpZgUzd2cKQWK7Kx0=,iv:6VWsZd/VDjQ/BhfwHZBcL3Zp0W/9sO/ZC9sF1Jnqguo=,tag:/gSe6TyaZDKoRFaRKiYyzw==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoM3lEUnJiamMyVzY0dHE5
+            YUE3KzA5ay95b2RRSTVIYUdyd1djNmIxMDFBCjFWN29TZDI2QnJramR4TmhOL3Ex
+            T0RISkMxM2IvUnRXTnkvUjJmSWNRTlkKLS0tIG4yaTlhTlhjVXZLODJUa0hwaGRD
+            bzlyNDJoRzBBMnViT0hmdWlDNk5DVjAK/u3XH8+MbjmaM3n46CGGjXFfY2aZkBNx
+            EDTiUmR3FJSHEcWBhICEevrAnDJgTRgiei187/sSjehIgv5ZngeupA==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqRUcxaGszajdlVm9VWSsw
+            QWxTbEYyVzlxRm1NbnJ3Ly8yeW12S1NUUnlVClk5TjZvMW1zWHY3OGdjQkdoMGNT
+            L0JUdlhYTGZBZ3ZEOGhuN2FzSUNMZFUKLS0tIEhCVlFBcFhvYkw1RVlOQ29NSkJL
+            VGNyL0pmQlJOMnZ5YmhHem15YzlXWDAKBgcH7kd5uBWVQ1gHeR5CYZVP8IG4s1HG
+            N6DSIVisJf7qNuNw6M0J5nny6xfWeIEZJettF0xSHM1gSfr7oUbHOQ==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1mfarz0n7qfa7vg8zz355qf8eregm6myl38lld0h767nuvhgjqd4qruxuhn
+    lastmodified: "2026-08-26T17:31:59Z"
+    mac: ENC[AES256_GCM,data:G0Xpe7zJZh4xAwFRUXSbR11ENqRd4UoU7gFK3nDM7Icm9DMyqyi3uBfg1j0c8yTCInIrnyX1dy7zUWjns+OAbXv8CMLXVUPdomgCxX0zUWEkTzgQqnJy97KFAmPPPMCGTUby3TMVQkcrk5/iATmydSMhs0lKErS4737u9jen/3I=,iv:YB3BqypuvamDJy64FeaSUQBCAdlr7a9UWJDNhGsTRvo=,tag:lXc7heG+MRiUo+SfRcRDNg==,type:str]
+    pgp:
+        - created_at: "2026-08-20T15:43:21Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQGMA5HdvEwzh/H7AQwAi5C90LmuQOdXWpDxD4KE00yADfcbJH1no2ZFoC+w7AaN
+            tgVWX5IR0f0wM9eBL3CimMMwxtZLOTLWdJVQ/55XYqZDQmWzdhjSHIH+STSz8W3k
+            i0j3ufrr4rImqw5PGpiHdTVMq5Ffv0LwnwBGDdca+5YrH0qn9LrPJNj3pkMT2mDp
+            pwcCcoXsxucdBtpYhfgTbuHNQgyndVTgWpduIuaRVp3s7ISM3+9pozmzmtm+Q7cZ
+            ppPIHdTtPp595KC6DEhYP1WF32LTs6uuDuatip0Tz6+XAFJdOuFnGwcIpwtcK6iz
+            UnluXNArw8eBiaKFmSURkOcq9cjkscxdvgQXbSl1fTglEz5gjGdkc/XZIc/4gDP/
+            foa5Bxjp56+uF6qFd/RuUMmf9iu4I5qM+9WbU+iF9dZXtiaoABrFWbRpxYr/qX5c
+            J0lIF+Xtgz7AF5FUJox2G1Jlbf+xY1LbrVrvH1R+mrb8mbASi50X2LUzrl7Hgslv
+            NB9F1o4I7DJWewRC9eCB0lgBzkncGtgA5cjay7/kwejPr+TYGYFjDMl/7SNBSerw
+            jnto+uSFfsdiGb4WOeYZZBxAN+ALVxv4agK9mKoNJ/wKWsIz1udtENtECk/vS4AX
+            Ey+OfiJ8j3WJ
+            =09pj
+            -----END PGP MESSAGE-----
+          fp: c4639370c41133a738f643a591ddbc4c3387f1fb
+        - created_at: "2026-08-20T15:43:21Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQILA98TrrsQEbXUAQ/4+e8U4pIRBLMJSe2ryIiV1sTDC/OJUstfpn3dAesJrVVl
+            WtuOl/dwkLM6e6yFAJgd+F7rv8xDAka+99trkik6wG4POoXY5xkPjalJDmOFMesA
+            HD65LUFhChXyj5pPMyd5Far/Dv7an5/OPlfY2eWrMX+gep8jEIJgbnvPPyCI3wjf
+            7Uc6DZH0ctWuG/fnXjLBPB8lrqYLdjsLT68dCyDRVrWyhJUN1/u8oKRwoXR2vqi2
+            p+ubaGjc0IkVPHSFBiskN6cPp8fLC08qtlGHCJoSO1EZFms7KkdC/7a0pwNGIAji
+            1/Xjs9iU1iN52ATlxf+iSXqtbjd9i8Ye5wugne6Raerwc/vxQzpi/0yuKFRmvYGW
+            YrjKQHMoMxvlAqbkLbFeGfcgwm/n00twH9h1oeskAwwjYUnnwuDqvwqndqzIAFUK
+            6gFiRtxLZ1AVOEPfAVkzxznm+ZNvSbk/A8hENuWzZfGYmoTrQAHvCrMFr03EcvMM
+            Z+L8vX647E/4+Eh87CqZ03VQXZq9H8lMz+1ToQdwpurwnOpc9tMT1UcDh5FxkugW
+            3A2oomRByHoJw+51i6wujJZ3Rkx/H0SYXswCTsUHX6JOOrRWfNgUFnI2MeVDu0Tg
+            L7hmNQyKW2Ncf+EqT5i5dlucR85SLZ0IE6QJMAjzyuOcQBpSPW1/1U7XUtJDOdJY
+            AWto/wuOyoZml3GK1+pGfraL5JMYvhSu4jdmlTPAQibdVeS+nLBPVx/Wd+R6Lerv
+            QkWv772a1ho98j1LwWCu+mM18dveIElI6HZyIv4RE8YBbErKpL1pBQ==
+            =ciwJ
+            -----END PGP MESSAGE-----
+          fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4
+    unencrypted_suffix: _unencrypted
+    version: 3.13.1

machines/albert/secrets/disk.key

@@ -0,0 +1,26 @@
+{
+	"data": "ENC[AES256_GCM,data:tLzYReb0okzTrfWMYBRgXr7MA+4=,iv:q/OZYLPA9sJ5sdlXLF5dJpd+E++OK81GyRWZlbNG8iU=,tag:mJgFIVEKBHjD0Ga9af5Egg==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2TUl5NTZHTDF4NklpbThn\nSkdJeFlodEx2OXFZRURSUDhGSDFzaHBqMWhjCmQzYUV5VWRPdVErdkxvcnkySERN\nVklUQU5MWVBDeDNvOElXZFhaRmdQUEkKLS0tIGtBUjZRWFgrZHZRTWJEb0JKKzc5\nWTJhMitWeWJ6d0xxZEZYSW8vdDdJUmMKCu4uPNOWlqGPV7rftZDnQRq3o2ZdKK4I\noqOnnCdT6Gg3Xuo/gs4steg/mgqNijRTd1Y8ZJUIkpYM1KNw6xVpJg==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c"
+			}
+		],
+		"lastmodified": "2026-08-20T15:24:41Z",
+		"mac": "ENC[AES256_GCM,data:+oWxWUPWo14zvhnupIlRFiBNVT3BjPIXjmsXYA8KCMARYtxWntr2hf4Ly1Flx2EZRM4dgvVtZAFeYwqFTD7RafNGHr+2SulOxAyYHYk+ld7IWdt/izi5eLV2AVZig+1o/B5+G1XTdDWRnKtp6+oCFw8PGNoohtS86eMR522zIKY=,iv:Zbvm86kzRh+4TsB5wWSZwqq++Sl1X99wkpcYnAGYo10=,tag:nEV1mn9atTG9HcOvJztEvw==,type:str]",
+		"pgp": [
+			{
+				"created_at": "2026-08-20T15:24:41Z",
+				"enc": "-----BEGIN PGP MESSAGE-----\n\nhQGMA5HdvEwzh/H7AQv+Prou85l0Vr0T/btpsk7dbr5CbIaiNUKcg3l4jiz+WTUr\np8az7LL9RxxMScqOiGiPOtl1hbfygLOUOebt3FkhGf9JChYCZ8MMGArzdO6KMsQg\na+BsfAgOKIq+AEVd5GX/a5mspl8zU3rG3QQgKDEpyxIa89ZK4mI974s94Xv8MD/4\nZGyCWgL+RFxQ6Ad/XSQU2+4wUBugBSKh0X+ETagmAZAqApdfZ0uYGNRD5bngVk1X\nYTDx2+uZ6vYFqNfqapKuG1hVZvsiU13tC3IQ8Swrg5rNwzS3OT9qQYoeSBCWYg1a\ndJLKaSfYqCYNbdKI8tYx3oeWeeQa9CgB2iCCGI6vGyyBdVI0NrWf/Vyghw1fQgmD\nJGEVsBcp4U0LQDL8znGj1ohL//cJug7SPWVBZYMUKecN6Ho6ILoHwoqiXrMPPE0/\nm1hTmP4kTtuUEnngnoBnFnCt19Ma+qBBc7ydkj7MILdczaZt7TpePUlGmQgQdB9U\n2p4acI0QQGEhp3jCzdt70lgBDDl6Jzf18HqOaREnRfeiedujQrd08ITqQZE/s4Gc\nIgu7zzG2DKr4VljPQbxof5E95SNW/+wsvxxu0Wbo/cpAjA7I2u8qyVA/QnvmMXHn\nKx8GMhIdmbUT\n=O/hu\n-----END PGP MESSAGE-----",
+				"fp": "c4639370c41133a738f643a591ddbc4c3387f1fb"
+			},
+			{
+				"created_at": "2026-08-20T15:24:41Z",
+				"enc": "-----BEGIN PGP MESSAGE-----\n\nhQIMA98TrrsQEbXUAQ/+PBo3H+FNYZ275YMIEZxsbeKY48eP4ZZRopZDrmKsgEYT\nI889inzKVoCBADYNnwheCDAo7gcnxRIGxNaL8ftu0gqu7M0OLtK/LJvmpan5RBYq\ncW5ou0mL0vObWqbGUlrGjaQoETFgy5oEfqhXGtpEccyqMcd89b9tciS9BfeKVusA\nBRE/d5vElDtkHsU4wSCPAhj4D3GlHn9AvdexCNt1J09tJWuti8OWYq1yrts5fUiM\nTCi3/gxEZLrbPa5Gu31VIs+FfO8nMPecjEsmszKqns/J0RNHrGrpLLiYFhL5Yaj0\nxaySk7LRDWB8sPRqp+dCEE24Tht0iOnQ29CU5UeKj7LRGPd4xYHVx8Tmdi4V0hBL\noTkpYt+kU2VvA5LJI+skx7akM2uNGvLRtaurj3In6JFv5Z2Y4ELrjVPF+TPSBieV\nn31ToI+F5STUaWb5j9Hk/Ch4L1UpM3OD6f5qZJ9EFAvrHLMWuAa2YSZkBLJ6c0eI\nVp4Rn8gd2E6jXGsBxR/c4VAZ/1gF9A4LMWAOrPkYzWZIHC9I+mc7OPT9nz4tW7xC\nf4czBHdLIEOCe0JgYsUIzr5PaWOBD7u/FH971qEEMKqYuGYuzv54V7L5lzprcgcQ\nRh4wbs6obg4Luh2/fUl4I+Xv4a8vuG8a8GdA5Kcf5ai8O3SsMeZUcc8CeIotZOLS\nWAF+3h7HQCyBf0qAKeHC51lUtJLUGYwMIIPMlZZkyjmRMfz0sm8HiKfAQycd4n4D\nK33Cjinqky3mPmv0c4NrK40r7wCdrrN5kCVJZK574vw47++s4zhVVww=\n=zDIP\n-----END PGP MESSAGE-----",
+				"fp": "aef8d6c7e4761fc297cda833df13aebb1011b5d4"
+			}
+		],
+		"version": "3.13.1"
+	}
+}

machines/albert/secrets/initrd_ed25519_key

@@ -0,0 +1,26 @@
+{
+	"data": "ENC[AES256_GCM,data:hb56sZ8AYq+BBXE1igSFFDaWS04C5zp9Ieay60cKIRsZ2KZ/UC0Zw9vgNhugp1EUFt5oFzdNILWy+OHuK7/dtUV8IlpCyiyuOROggw704aMs1+h1SvfyxuzWVxHLxFgYX0QSCa01Jdvf8X+Md/zW7iNYWmUMr88ZvMXieU3rCI3NV+IKdCvHycW0uTyn2NdllD/wvnsRdvmxY5cjT5226YnlvroePO6rI6TkcGHy61WnrGSL8rU1FdxSEVO8RfIxd+lueQqrerNMyP/i+Dt+fyUXkazwItoWIXy3CYceI8nvxrq6YO0CGMF9NVWcjrmEFJKgZGzbFiIe7X28paHEn+lwc0RfrPgMyOqSVfvSzjBDUkvZ3dMASc9fEp7i4XT8J1W6Qh1XkmK1HKCzKlC0eOGYw89i8rP4vymhJNqArIreIG1LyYEVlXCOac2fuQ382izp2+tbKq77gnIpesqaDsob95dnONRJb8ZBePSiAxLSa+JBkQnLTArg0VaSKz9rK+ighFDTiq2FGDV/w6KG,iv:nyjIr1RjVkgnNDeP/HegpVh6yXBMferHC/qM9NiOcGw=,tag:PajjQ1c5KnwXF/3j1r8Dtg==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBK2R5d2tYTWo1MTNkS2ds\ndkZnZm1lVlpZN3UzOWsxMFFOYkd0Ykl4b0VJCkFVLzZocWVmVjF6SEJHZ3FOdmIw\nQnQ5RFM5T3praVhLbVUzakRsbnlncUkKLS0tIElWTFZ0RGdYN0tiUEdrR1ZERjVL\nSXFSMkY0eHFYa1lQK2NTZElxL1diYnMKn0WvatDVmpQHUoxXMw9tlLU/xv+A9Oue\nEctWF6gqBHIUr5YMNd1/Clb6y5nv15ID29uKY9KUPOrkvJiCITIn8g==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c"
+			}
+		],
+		"lastmodified": "2026-08-20T15:24:41Z",
+		"mac": "ENC[AES256_GCM,data:uxXGCKk4Dq7awNtok5bwudJqgPzYDhlmvV1RfwMQCC2X8DI9JAdN44lwuVadm2qRdcqqF1JnEotb7wWuQXQ2Ifg60aMiEGuvSjAFBqrhsGy4ZzoDsSPCatPLTf94JWXHfnB1n/BKKVrlBEn3pY42w6m9kYBKSmSo4FBOyQHJJmk=,iv:Wg3FIOTczCoNv0zoGHGJEuJbJFA1nM8nSSimUmLm24w=,tag:cNxZg1qU5ge1miHQMXE2Fw==,type:str]",
+		"pgp": [
+			{
+				"created_at": "2026-08-20T15:24:40Z",
+				"enc": "-----BEGIN PGP MESSAGE-----\n\nhQGMA5HdvEwzh/H7AQwAlzMuEl+LEktZCdo7nw5+i0MBuWhi5N74OaaXOPMgtWck\n5DfUp77lKwUlVD/wWwSQZcKSxKUYuVMwN9xpxKbhidbUEsOfylyrBEbJvJg/2Dxy\ncVcEBu7W3cqAHNm8jAz2uSpc0v4a6XcQZXOOAcY4ZVp+Jrjv404U/ylNguE5FO1+\nTbHd0fpXlJ/EIkV2+OB34KEjqMhqE3BViO2hNNqTItadvzECBHwDHfxdNR4HCW2W\noL0ofnGXOkf008RLcC2xGjiIP1aCdux5Rj5kTVLnAiuWuyLwieDmCQdPlnCg1Hz7\ncRYDoSq/KP4a3Td8olfyPYoBdjU0JTgdaG4mrK80w7RoFruz9s+MvIuEh0mTWlv8\nk3hQynCJINpXUSgeJsQJ9mHVr6sADHvD/XknJ7DghAE3SDQnEw7S8+W7TuZRL4YE\nsuxU+gxj0TyXL05dbDo3V0wrtC4DjcnVqwQ1DYXYtSTyPYzxbiwsHxksKXWmriuG\nBQXPP1EFBx90cvjqUHMO0lgBm9X/loNgE8ouu/nPf7vfS3CXTqVENiurUgcLLjZZ\nBA9CQxCqIm1hgbGqyjXqlkSdNrZiEE6YemhcTcD8VaXZdEe9po52cPuNF4j1uyE1\nsRTfjY7Q9lRW\n=qFFI\n-----END PGP MESSAGE-----",
+				"fp": "c4639370c41133a738f643a591ddbc4c3387f1fb"
+			},
+			{
+				"created_at": "2026-08-20T15:24:40Z",
+				"enc": "-----BEGIN PGP MESSAGE-----\n\nhQIMA98TrrsQEbXUAQ//erdf1kP6oiR0tdJmUCuFJ7y/jbdt+jJPJ2i6cAj6Vwe7\n6OvxzNVEUgVRJN0Owm8/9sHZJajZd92AbHsfcGqDDhutzUSweQ7PUcSvYcyMGey1\nggMuUNFlhoXWcxn3kSCVWqg1aJ0CGxqtyW1y4222zZpaSRdNRK0a8svo4yj7xJPe\njTiJl3H2OVx73uAUW1onbuoG8SAbQi51LiGWB+v4eoHoFZgH6C+pjLE4F9lEjskz\n5EZXvIW3EVMs0tQVtV6S0yBf6tRRI0KM9BYMXNSvApE2RQI3/zJrJvdkCl9ttN7C\nmqDMTLAqG685yaERBKPVyDTkixnt0dNtzhl1wjFoBOiQuvIPBGlmJO+03YxYoa5q\nDwFRvAaRDYAeh94ZAeIubgdA8B1xLdnpx3Ox56q1GSJU1gv1SE9WhE+woFul4VlY\nro+mOJzfjlHFKzMc4D1VwPEs0b1MYKurktXaBaXX9WHjejc8rK1wHMTadlvJ7xLG\nUjeeLCeytQzMjuTkHPMswkARj13iK5HgSz7GAUeefeauMyOOn3V6RtrpvrrD0ASv\nm8nBC8hIiNEKJIk2M47N6l/oRr1OOvuB8QmuPzDTuXc51Srgc8v/2ayIkoNmY93T\nnNoNZEnxiEqgHqeIenhHhe0VwHgXdLVOhEFR1sBDDFh2W6yjtdMSRXHjVB9Y80HS\nWAGkn8q+4fSx47xZTSfOoS0tagYQkN1MLykFnR0S6IgjLSIXF2TtORNCs6tqMgSK\nWZAJhO84PKTFeEh+Hwo88wUil31V02VEjnuAe2rhigvn9sTE7Pr2Znc=\n=nnbP\n-----END PGP MESSAGE-----",
+				"fp": "aef8d6c7e4761fc297cda833df13aebb1011b5d4"
+			}
+		],
+		"version": "3.13.1"
+	}
+}

machines/albert/secrets/initrd_ed25519_key.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICPedKJa0L4v+35m+YK1CN4QRoXaF7oMOg74LiPnYgBj root@-initrd

machines/albert/secrets/ssh_host_ed25519_key

@@ -0,0 +1,26 @@
+{
+	"data": "ENC[AES256_GCM,data:B+2jQsx0tLwTbNwvXQxdR6gNNYgTeTXCiaSwWwaM2eJjmX40em6ekvf8lL8biAuyTgM5tp3n3mYmEJsk8P1EWgBlS2xmUAk6CLMXFs9oozGFbBcrQU74ffE4PgZoWJQnBt7vVB6ZHaCqFq09bbbUI/avqDCD402vXv4pUc7sL8cj6J1KSkjjAO2uJle3UcqcINYOQscSGGflN0HCJfAgQGco/61bKysUrfB6QRaayODfLrm3GLIwWfM9gk3wpLcdb3OtbPFTz9j/w2LLbu6P/ZGKU92O2CGcAG7tbHv4f5w3eDAY392nC/CA7GYcEvolMfrzP3zC1N/UXL6ImkLovKczBdJ3gPZUZikonPip58ZJIWIIgbINxrAv+S5ZWNL0VgITcXmi+IWoCQsGAWsrNeikMIAgqiFQcLInHMfPvb8S3BcZtoGBYq6zBKl0TU2zSWmcSDNMv+Lu+CBnYX31EYRC61MaIaJAtyc3okIdDGnR3a5bexSlIO1cT3sCYxrQTr/2,iv:mbpzAzdXJTkR5AUW4ByWuWrebRGcWO/D4RnyzIzIuQ0=,tag:/Ym4cCdykKhQRzZGEnW/FA==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZbnpISDBPaFFjQ0x0a0h4\nMldJbGlUUlpGZXNqcHZJcVFRUWE0YUo1eXpBCjFYcWhYVzM1TkxiTThuUmh1V2FI\nYVNlcC9YQm5oSTBhREF0YWM3aXkzMXcKLS0tIENYa2tlQy9kWUE4TFVvOGN6YUtl\nM1FLR3JFWGYzenpXMEFFdlZ4K1lWY1UK4ObhtwwiKDavy4960HavpMoPUIAvwyok\nBiiPXqW8VQRgYlaAn5mcufWnfnsl4kRAC2eSZo9Q381ACC65nVBNJA==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c"
+			}
+		],
+		"lastmodified": "2026-08-20T15:24:40Z",
+		"mac": "ENC[AES256_GCM,data:oV54qtArlFEaKGwlhTeMWKJJs9eiWoYda5Jyg/QzRYEP2sT7DmzdjcBKFtATRl8twHzbXqBj7jlXFZKcqSIaWxd/yMoDZbNiepul4CSdCSEgtzTH2lEkvVmpk3qTnPtIuPGQkXXuykz4auuPYlvEO1cPQh6mcz+BWzqFb1c6Fv0=,iv:X6WJO/tNVp+wtG2wfTw+kKnJRr8lzNZdzzAy+gVfdMA=,tag:XRz8/Xk3DaX4hILSFUzDQA==,type:str]",
+		"pgp": [
+			{
+				"created_at": "2026-08-20T15:24:40Z",
+				"enc": "-----BEGIN PGP MESSAGE-----\n\nhQGMA5HdvEwzh/H7AQwAoG8X9k+oTUtWVqV13RiurT0MYkTm8Sv7YEKzUTlnloES\nuXghxmaZM6HIg97WDATGv63RGHj4kguww1uyMjC03sQ2kqlLDLOvPz0p2EA5AZja\nQhW+QbcsCXuXDjmCMytrEW4HXXBKySrdVcqpf6yJr66jpxbUhj54fQoRPr4FTrm2\nLxSoFjZ+G1ZZOfV1vvp9duqXvV7PsR0hiIhAX/AS6MgSXAAtfXc++Xwl4w3/ZeQB\nI4Vn+4hJ3HqvDLQcGC8jTPCUxIoeb3HTlPcuWxLu20PGd33GMwvUOBXhXtKNdeSB\nddxNgN1nTVDJmDDgbKKB3MFB+GaIjtOYm19wUxh2rNyrGEVzmj6Reyf0e/sjJph+\nR1hlmHZklp+/42vnTWuTittIQIl9cjLTnpTMwkpO/StjcpTss1pMbIMM7uZpMPub\npUDodBdw/oCTWlaogj+9EAPfItQN1+T2wcGsCfgQOLv49mHyVN/gUsGDqIn8pv9W\nDzS8Tkyjb6qemBNsbMXy0lYByNYG40ROaYZoBcdygvFtudZlWPwF3Ka9FnWnxiZ5\n7b9XHoK9mPC1JfGaDkJvbsHHf+oxXuqhW+ue/jDlYQmDdaUeROITV7XmFC30zFuY\n4rF1UgVWEw==\n=vQ0V\n-----END PGP MESSAGE-----",
+				"fp": "c4639370c41133a738f643a591ddbc4c3387f1fb"
+			},
+			{
+				"created_at": "2026-08-20T15:24:40Z",
+				"enc": "-----BEGIN PGP MESSAGE-----\n\nhQIMA98TrrsQEbXUAQ/8CKXnmqU93XSdJ8WmS6BpssbMwcVDbgUl+U7wYOhq5ctr\nS2C0lPFO8g4QwQQiWBVCPuFqBypm0MjvaVfR86BqKkHPCcygRP3vTIzkR9mFfT//\n66Nhi4rBKJ41WDr4fMgsAOqNSvFvVsooK8AFpNg8uVBEpVkAOiPXd/3XtImO18Op\nuZs1yL+6OZxtF7smTwEEc3bZ4y3NQhefXLDJChnpCiLPNIJ25HG+QYpNz9Nokc4D\nvGbva5l6YtN+tGKyD3aNmnWL5N8jlKS92ZjaeQEdWECFcGEvCJDyAwwwDgWqAbui\nLETFynG1fV8MjrNuM3Ow4UWpn0FU4J38xI4AI4+6yBAdyOgBGX2fL6AS/2FQ0jQw\nEJbint8cETZTIb9AlazCWJrbIVCI8rw3JgmI9qR8caB3clAqp+1FNmiQV0mvlJG2\nS+8WxxlZW/ViUpe4XjuaSoVhlbpkHjeJLEs/uXC4ULWvdgerX+SvbVI3JoyTAdzU\n3qZpcUJBdtkhhaSY3MJNq1kSXmCIpwzbRpMGhRm2VmNccmCiGLTNhweIInK6is5a\nSxzprQUqsm9zdmhm75/7Dnm4GAxQ9XM8ItZjethnYtPgzDAYNIcRCW3fXc4LnkpB\nDqYzE8WElw+tb6LllRGG4iWeO3BN53Un/J2dQpqpoQchzsGggP9x6rRpZGf4ZKvS\nVgHnl30SJEno4IpxkHAkDQ8YZRJSeuTHTSk4ryrutFxpsq/hiqeqcD9KqqPdS0A6\noe4YP8PsI+xSdAJ34HdsoP4ZVl3ybFC4fzchDD2GQJiJJVX2OVWG\n=HjXN\n-----END PGP MESSAGE-----",
+				"fp": "aef8d6c7e4761fc297cda833df13aebb1011b5d4"
+			}
+		],
+		"version": "3.13.1"
+	}
+}

machines/albert/secrets/ssh_host_ed25519_key.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFsZ2PYP5eqXAerPWPYp+ZLM7zRZUGZLD4W5/H7fSEe7 root@

machines/albert/secrets/wg.private

@@ -0,0 +1,26 @@
+{
+	"data": "ENC[AES256_GCM,data:M5KfpqjYoQwjpAqSktu/8luQS7CRLUPTCRLpGGIwc2siFq8GXXxX+73DzvSN,iv:/aXgooRQK3k1VGQCa97f7u4Mw1PDd4FBup1z4NWNg7E=,tag:CbqhhaIuzcIGuK9Uxv3nfA==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1MzVzWHRNSmdzL0syV0xo\nblI0OW10bE1sSGpFQmRpNjdaS1dkQmZVdkI0CnJobmdZNXVJSlVkQ05oQlJ3NElP\nMXJjS2o1dzdIb0daVjFSR1g2NDAzd1kKLS0tIFNUd0FPZkFqM2RHSGJkT1Y2TDlo\na1VEZ0hDSFN6UHlmZ0IrZE0vZ2NPWDgKXfpLmDnTVHSjqTOwn6c1w8oBR1RCepPZ\nT9w7PVQFrOv6nshF2QyOb8WvbeN8kpWWHbOgOldc4cT0aDSU00xrrw==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c"
+			}
+		],
+		"lastmodified": "2026-08-20T15:24:41Z",
+		"mac": "ENC[AES256_GCM,data:hVIji3rvNEu4ZyIfjuWsgN3A6x4iRvO/Pkj0E2WlX+cf19Tjubqnp6/IPEaNjzqnflwTBBulz3dK4QkenoJH53TvTlMB1um72W4hquzhOkkiqYu/QljyzyJ1VLzBXbdtbdyZxvgZIEu/OuBZA9MAGozfen7sYNpoL979NwQdBXQ=,iv:31JhyX+KGK5CMCBEiqc0XNyrsxQVEXiuxsiDYjZucZQ=,tag:36CvEpeZfOuxDWwluGdg2w==,type:str]",
+		"pgp": [
+			{
+				"created_at": "2026-08-20T15:24:41Z",
+				"enc": "-----BEGIN PGP MESSAGE-----\n\nhQGMA5HdvEwzh/H7AQv/cFmsAoVY6lRHQ9zTuuLsR3AhJEzmNf4GYUm2/rhB3Odp\n2SOtOvVku9uei7PxIyttVYelNVI28+MDP8B9wknkTRAIRgoRPJ7bPYa/3OVGn8co\neFBmqcHPTdssy4oaLa6KK6YZFyq/8Dg7Sy97nySALSBZHvX8CPqgnODVSgSRvoMO\nhORKFE2WFut0uPu/iUgyJAjRnJ9sWZ2O0alIuoYhDc6ruwrLymfWbQVHMi2YSq9v\n9oJ3yWlwnusLFSvHGvF4Qt40n77/dtbr2510UDO85ADJ+HTgmg/GkObrYaz8Obbl\nrWhmS2G1v4aY2+PSHCWUgdecCKm6S8mDcWUPwn6CM/Rs8lWrTTGbFwGE5faZ+/wp\n+g2fBlCbpR9ZSS7iY7mzu0mNDXVTw2zis8zaGyCAA45xhFITToaTgQ9oGRrBLOBJ\n5uutof/zM6NZsPXmOP6COCSVar47/zaY/2sfuzNJ9ILyg3fUqGu+eYSDszqQK9FS\ng+c7vrcWsB56GfArRgxT0lgBhVMyYgwqZDN5Do2Q0pj8nzvL6wYacFJjsdYIWppk\n3K2e09EWtx30s+6lAj0dFNw9Owr5ImkEsQycZr2pfbJc+QLsMW5/gIQNMpDz+fnG\nGvCs7yXcKShk\n=j9Cj\n-----END PGP MESSAGE-----",
+				"fp": "c4639370c41133a738f643a591ddbc4c3387f1fb"
+			},
+			{
+				"created_at": "2026-08-20T15:24:41Z",
+				"enc": "-----BEGIN PGP MESSAGE-----\n\nhQIMA98TrrsQEbXUAQ/8DNarclMtOlejcGih7sivOrlDKQKlfb/eQOncnOXfwYII\nc+T1gJmYZEsRPsp08rfuYsxvsE5RDhcdXMlre+07RCywSGKBE3f3PzK9YefMHpJy\nGGu8/cegPSAAnegqXi8I9UsWObjvRPCNXT+cWz+OgJ6ekjhY9G4GL6MtuCi/NQju\nMhony9LFvIXQTAdy5KY+msggT1O+ApTJQH7G80zLMsxUTeS+hew5XNVVXClnKAY0\nvT73vebL4qAJ8j6WiNVTL5kQBCMsKLK5JckOly5tzJ4XHu3zPrDy3ZwImlnYFPS4\nkpZoc2EFgZIe5b17UYIX8//RTuSmeZ8ljVChZX5mGTl1QgwVoaZumJsbgctj0/WO\nJG+hqTE4YMcZaMpgbRJnB/No+arODhYSH5kgM+Bg31+RFzzhzac/7v6A2fGj1O3Z\n4eFMEQYKm49KZhsrsU9U1uK03GFs67G/9qH6kXSc0sywsz/IxvzxVMBKk6fNchlD\niaHD7jxBaB+VrTeFBT7OOdIziakVJvOP9RlAaArxga52ugV41d9NV9cZyfmPG9SN\nluoQet3Y3jdUU30Y6ZRdkSZNzesBWBdUgBp2f3qutUU7OqR1sVoh/uhNkpwodK8o\nqIPWfcdmxw+RbgswoLcKQT+ls4jr/cygHe61Xor/dOXbd5F7krL30Ka5FoMyhCnS\nWAF6DKcCYaPQVw3vghfGEr9a+9ml3a5DyP4QEWc5dsl4CpOsoCK67wSQJVYVIu0B\njHuKLPT0rYwFwi11DyWTXMJE5qodtVdm7ocZW2BTF5czGRQuJaX8Qgs=\n=r1KM\n-----END PGP MESSAGE-----",
+				"fp": "aef8d6c7e4761fc297cda833df13aebb1011b5d4"
+			}
+		],
+		"version": "3.13.1"
+	}
+}

machines/antamap/configuration.nix

@@ -0,0 +1,59 @@
+{ self, config, lib, pkgs, inputs, ... }:
+
+with lib;
+
+let
+  antamap-pkg = pkgs.stdenv.mkDerivation {
+    name = "antamap";
+    src = pkgs.fetchgit {
+      url = "https://0xacab.org/AND/antamap.git";
+      branchName = "master";
+      rev = "f07f4522e8658ee5dc113ea3feffb67418e5f403";
+      sha256 = "sha256-ODEey7PwoBAwVxcQm02Q8/a42UxzOcQB2Dqr3FYxqyo=";
+    };
+
+    installPhase = "mkdir -p $out; cp -R * $out/";
+  };
+in
+{
+  networking = {
+    hostName = mkDefault "antamap";
+    useDHCP = false;
+  };
+
+  imports = [
+    self.nixosModules.malobeo.users
+    ../modules/sshd.nix
+  ];
+
+  malobeo.users = {
+    malobeo = false;
+    admin = true;
+  };
+
+  services.nginx = {
+    enable = true;
+    virtualHosts."_" = {
+      listen = [ 
+        { addr = "0.0.0.0"; port = 80; } 
+      ];
+      root = "${antamap-pkg}";
+      extraConfig = ''
+        proxy_buffering off;
+        proxy_cache off;
+        proxy_http_version 1.1; 
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+      '';
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = [ 80 ];
+
+  time.timeZone = "Europe/Berlin";
+
+  system.stateVersion = "22.11"; # Did you read the comment?
+}
+

machines/bakunin/configuration.nix

@@ -17,10 +17,10 @@ in
 
   malobeo.autoUpdate = {
     enable = true;
-    url = "https://hydra.dynamicdiscord.de";
+    url = "https://hydra.malobeo.org";
     project = "malobeo";
-    jobset = "infrastructure";
-    cacheurl = "https://cache.dynamicdiscord.de";
+    jobset = "master";
+    cacheurl = "https://cache.malobeo.org";
   };
 
   malobeo.disks = {
@@ -83,7 +83,6 @@ in
   services.acpid.enable = true;
 
   networking.hostName = "bakunin";
-  networking.networkmanager.enable = true;
 
   security.rtkit.enable = true;
   services.pipewire = {

machines/durruti/host_config.nix

@@ -63,6 +63,16 @@ in
       };
     };
 
+    services.nginx.virtualHosts."events.malobeo.org" = {
+      forceSSL = true;
+      enableACME= true;
+      locations."/" = {
+        proxyPass = "http://10.0.0.10";
+        extraConfig = ''
+        '';
+      };
+    };
+
     services.nginx.virtualHosts."tasklist.malobeo.org" = {
       forceSSL = true;
       enableACME= true;

machines/fanny/configuration.nix

@@ -1,4 +1,4 @@
-{ inputs, config, lib, ... }:
+{ inputs, config, ... }:
 let
   sshKeys = import ../ssh_keys.nix;
   peers = import ../modules/malobeo/peers.nix;
@@ -42,14 +42,10 @@ in
 
   malobeo.autoUpdate = {
     enable = true;
-    url = "https://hydra.dynamicdiscord.de";
+    url = "https://hydra.malobeo.org";
     project = "malobeo";
-    jobset = "infrastructure";
-    cacheurl = "https://cache.dynamicdiscord.de";
-  };
-  specialisation."NOAUTOUPDATE".configuration = {
-    system.nixos.tags = [ "NOAUTOUPDATE" ];
-    malobeo.autoUpdate.enable = lib.mkForce false;
+    jobset = "master";
+    cacheurl = "https://cache.malobeo.org";
   };
 
   malobeo.backup = {
@@ -149,6 +145,8 @@ in
     "durruti" 
     "zineshop"
     "vaultwarden"
+    "pretalx"
+    "antamap" 
   ];
 
   networking = {
@@ -168,7 +166,7 @@ in
     defaults.email = "malobeo@systemli.org";
     defaults = {
       dnsProvider = "njalla";
-      credentialsFile = config.sops.secrets.njala_api_key.path;
+      environmentFile = config.sops.secrets.njala_api_key.path;
       dnsPropagationCheck = false;
     };
   };
@@ -233,6 +231,15 @@ in
       };
     };
 
+    virtualHosts."events.malobeo.org" = {
+      locations."/" = {
+        proxyPass = "http://${hosts.malobeo.hosts.pretalx.network.address}";
+        extraConfig = ''
+          proxy_set_header Host $host;
+        '';
+      };
+    };
+
     virtualHosts."tasklist.malobeo.org" = {
       locations."/" = {
         proxyPass = "http://${hosts.malobeo.hosts.durruti.network.address}:8080";
@@ -280,6 +287,41 @@ in
         '';
       };
     };
+
+    virtualHosts."antamap.malobeo.org" = {
+      forceSSL = true;
+      enableACME = true;
+      locations."/" = {
+        proxyPass = "http://${hosts.malobeo.hosts.antamap.network.address}:80";
+        extraConfig = ''
+          proxy_set_header Host $host;
+        '';
+      };
+    };
+    
+    virtualHosts."hydra.malobeo.org" = {
+      forceSSL = true;
+      enableACME = true;
+      locations."/" = {
+        proxyPass = "http://${hosts.malobeo.hosts.albert.network.address}:3000";
+        recommendedProxySettings = true;
+        extraConfig = ''
+          proxy_set_header Host $host;
+          proxy_set_header X-Forwarded-Port 443;
+          proxy_set_header X-Forwarded-Proto https;
+        '';
+      };
+    };
+    virtualHosts."cache.malobeo.org" = {
+      forceSSL = true;
+      enableACME = true;
+      locations."/" = {
+        proxyPass = "http://${hosts.malobeo.hosts.albert.network.address}:5000";
+        extraConfig = ''
+          proxy_set_header Host $host;
+        '';
+      };
+    };
   };
 
   services.tor = {
@@ -293,7 +335,6 @@ in
   services.acpid.enable = true;
 
   networking.hostName = "fanny";
-  networking.networkmanager.enable = true;
 
   virtualisation.vmVariant.virtualisation.graphics = false;
 

machines/fanny/dyndns.nix

@@ -2,12 +2,15 @@
 {
   sops.secrets.njalacloud = {};
   sops.secrets.njalazines = {};
+  sops.secrets.njalaantamap = {};
   systemd.services."dyndns" = {
     script = ''
       KEYCLOUD=$(cat /run/secrets/njalacloud)
       KEYZINES=$(cat /run/secrets/njalazines)
+      KEYANATAMAP=$(cat /run/secrets/njalaantamap)
       ${pkgs.curl}/bin/curl --fail --silent --show-error "https://njal.la/update/?h=cloud.malobeo.org&k="$KEYCLOUD"&auto"
       ${pkgs.curl}/bin/curl --fail --silent --show-error "https://njal.la/update/?h=zines.malobeo.org&k="$KEYZINES"&auto"
+      ${pkgs.curl}/bin/curl --fail --silent --show-error "https://njal.la/update/?h=antamap.malobeo.org&k="$KEYANATAMAP"&auto"
     '';
     serviceConfig = {
       Type = "oneshot";

machines/fanny/secrets.yaml

@@ -3,11 +3,11 @@ shop_cleartext: ENC[AES256_GCM,data:sifpX/R6JCcNKgwN2M4Dbflgnfs5CqB8ez5fULPohuFS
 shop_auth: ENC[AES256_GCM,data:0NDIRjmGwlSFls12sCb5OlgyGTCHpPQIjycEJGhYlZsWKhEYXV2u3g1RHMkF8Ny913jarjf0BgwSq5pBD9rgPL9t8X8=,iv:3jgCv/Gg93Mhdm4eYzwF9QrK14QL2bcC4wwSajCA88o=,tag:h8dhMK46hABv9gYW4johkA==,type:str]
 njalacloud: ENC[AES256_GCM,data:sp79Ij1vd9pQZuPUR1phmw==,iv:AWKZoOfBA/n16pWQCfA0dZmH1KajCztnLvYItoZZbgA=,tag:BIUrobBoO96pxUz1sjIYIw==,type:str]
 njalazines: ENC[AES256_GCM,data:fnObUEnXYvdj9HtkZNzXVA==,iv:0Zj2n2we9w4fj/n7e1ayd9XgFEMAGCHk4QLTu1IlRnQ=,tag:zeOLAB0oE6XbxqdqhdRNxw==,type:str]
+njalaantamap: ENC[AES256_GCM,data:nUc+E7HNbW0EDclzNDV6+w==,iv:H8nqeuOrvvu8O8QhGWkBkYWAQXwkBehf/jU6u/grs1A=,tag:mqX6jn47DyeSuk8xzG0e/Q==,type:str]
 njala_api_key: ENC[AES256_GCM,data:ohSVzQUvFjia/s9WceqnZCdLyk3N1Lm2BCBmXeBlkWD2dyrohKCnd9GiJ499IORpuYcOXyM=,iv:Uczk8op5mgqe8gefxgU9YuTqOsYvjzHCKvzA7GDsgio=,tag:XA7JRq/LsGkpHcQSO36Whg==,type:str]
 sops:
     age:
-        - recipient: age136sz3lzhxf74ryruvq34d4tmmxnezkqkgu6zqa3dm582c22fgejqagrqxk
-          enc: |
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2ZFBYMHMzTFRMLzhCbnBE
             MXkreklWSUVOckl5OTJ0VzlWS2tIOFBRRVVJCk90OXJoMHQza0hTSGt5VUphNjY1
@@ -15,8 +15,8 @@ sops:
             TStjbTBkMTNOcHBja0JRYUdvSWJUN00KtOPBH8xZy/GD9Ua3H6jisoluCR+UzaeE
             pAWM9Y6Gn6f7jv2BPKVTaWsyrafsYP7cDabQe2ancAuuKvkng/jrEw==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
-          enc: |
+          recipient: age136sz3lzhxf74ryruvq34d4tmmxnezkqkgu6zqa3dm582c22fgejqagrqxk
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhc282T2VVamFGcG1Ub3hp
             S1VwKzVsWW1sRXczZnRNdkxDWE5Sd0hhVUJRCkovNGZ1ZlN0c1VyMXV0WThJMGFi
@@ -24,8 +24,9 @@ sops:
             QVZyNWVOMTh3ejBha21Qb2xCRkFERGMKH9nMQUoS5bGcLUx2T1dOmKd9jshttTrP
             SKFx7MXcjFRLKS2Ij12V8ftjL3Uod6be5zoMibkxK19KmXY/514Jww==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-02-20T19:25:05Z"
-    mac: ENC[AES256_GCM,data:g+bFYqJN1X8F52tpIO60S2WKxLG27ZrP399fsfE6o7rPtIMimZou/4oUo7i+kpNtygEuCr3+suP8TPas4x5zMXhRjnjJuwJwL/NwdciHZU0O3rPJgucCEWqr9OdAtxezDM9c2vv+jzqZxWT9t0fIpB9RxO5oy1pHZs0RCgjAJR4=,iv:v6RdTMeQUxSdjIVNFbx2HtxCsdVgFTQTzMXS5Fj62is=,tag:pLoZMBRIXYElO5rY+xX9zg==,type:str]
+          recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
+    lastmodified: "2026-08-28T12:19:14Z"
+    mac: ENC[AES256_GCM,data:TnElCRaL/b238clfFVEq+Ot1lwg5MLMchCkmhi5PmADRn2exA42Zeq5v1M/IM5sHt4xEyFLn5R/88Y49DAfehRFwu6rddV+3lnFV40k2rWRtMfQOUXSrCd7lGxZdFbMU0eIXF5jaATFbcP0wO03FohNA69/u6kNsS0y0jK3vuLQ=,iv:xPeNXUIavVYFfAv1fs5TXCHXmvnXQDs4mJZMHOX7qG8=,tag:85hrBTKMh1ckTtXpOxj5lg==,type:str]
     pgp:
         - created_at: "2025-02-11T18:32:49Z"
           enc: |-
@@ -66,4 +67,4 @@ sops:
             -----END PGP MESSAGE-----
           fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4
     unencrypted_suffix: _unencrypted
-    version: 3.11.0
+    version: 3.13.1

machines/hosts.nix

@@ -29,6 +29,8 @@ in
           local = true;
           hostId = "11";
           address = "192.168.1.101";
+          gateway = "192.168.1.1";
+          nameservers = [ "192.168.1.1" "1.1.1.1" ];
         };
       };
 
@@ -38,6 +40,8 @@ in
           local = true;
           hostId = "12";
           address = "192.168.1.102";
+          gateway = "192.168.1.1";
+          nameservers = [ "192.168.1.1" "1.1.1.1" ];
         };
       };
   
@@ -47,6 +51,8 @@ in
           local = true;
           hostId = "13";
           address = "192.168.1.103";
+          gateway = "192.168.1.1";
+          nameservers = [ "192.168.1.1" "1.1.1.1" ];
         };
       };
   
@@ -56,6 +62,19 @@ in
           local = true;
           hostId = "15";
           address = "192.168.1.105";
+          gateway = "192.168.1.1";
+          nameservers = [ "192.168.1.1" "1.1.1.1" ];
+        };
+      };
+
+      albert = {
+        type = "host";
+        network = {
+          local = true;
+          hostId = "19";
+          address = "192.168.1.111";
+          gateway = "192.168.1.1";
+          nameservers = [ "192.168.1.1" "1.1.1.1" ];
         };
       };
   
@@ -103,6 +122,18 @@ in
         type = "microvm";
         network = createMaloNet "17" "52:DA:0D:F9:EF:F3";
       };
+
+      pretalx = {
+        type = "microvm";
+        network = createMaloNet "18" "52:DA:0D:F9:EF:F4";
+      };
+
+      antamap = {
+        type = "microvm";
+        network = createMaloNet "20" "52:DA:0D:F9:EF:F6";
+      };
+
+      # last host id: 20
     };
   };
 }

machines/louise/configuration.nix

@@ -14,10 +14,10 @@
 
   malobeo.autoUpdate = {
     enable = true;
-    url = "https://hydra.dynamicdiscord.de";
+    url = "https://hydra.malobeo.org";
     project = "malobeo";
-    jobset = "infrastructure";
-    cacheurl = "https://cache.dynamicdiscord.de";
+    jobset = "master";
+    cacheurl = "https://cache.malobeo.org";
   };
 
   boot.loader.systemd-boot.enable = true;
@@ -42,9 +42,12 @@
       mpv
       vlc
       simple-scan
+      bitwarden-desktop
     ];
   };
 
+  nixpkgs.config.permittedInsecurePackages = [ "electron-39.8.10" ];
+
   services.tor = {
     enable = true;
     client.enable = true;
@@ -68,7 +71,6 @@
   services.acpid.enable = true;
 
   networking.hostName = "louise";
-  networking.networkmanager.enable = true;
 
   security.rtkit.enable = true;
   services.pipewire = {

machines/lucia/configuration.nix

@@ -64,29 +64,29 @@ in
   };
 
 
-  mpd = {
-    enable = true;
-    musicDirectory = "/var/lib/mpd/music";
-    extraConfig = ''
-      audio_output {
-        type "alsa"
-        name "My ALSA"
-        device			"hw:0,0"	# optional 
-        format			"44100:16:2"	# optional
-        mixer_type		"hardware"
-        mixer_device	"default"
-        mixer_control	"PCM"
-      }
-    '';
+  # mpd = {
+  #   enable = true;
+  #   musicDirectory = "/var/lib/mpd/music";
+  #   settings = {
+  #     audio_output = [{
+  #       type = "alsa";
+  #       name = "My ALSA";
+  #       device = "hw:0,0";	# optional 
+  #       format = "44100:16:2";	# optional
+  #       mixer_type = "hardware";
+  #       mixer_device = "default";
+  #       mixer_control = "PCM";
+  #     }];
+  #   };
   
-    # Optional:
-    network.listenAddress = "any"; # if you want to allow non-localhost connections
-    startWhenNeeded = true; # systemd feature: only start MPD service upon connection to its socket
-  };
+  #   # Optional:
+  #   network.listenAddress = "any"; # if you want to allow non-localhost connections
+  #   startWhenNeeded = true; # systemd feature: only start MPD service upon connection to its socket
+  # };
 
-  ympd = {
-    enable = true;
-  };
+  # ympd = {
+  #   enable = true;
+  # };
 
   #samba = {
   #  enable = true;
@@ -199,7 +199,7 @@ in
     defaults.email = "malobeo@systemli.org";
     defaults = {
       dnsProvider = "njalla";
-      credentialsFile = config.sops.secrets.njala_api_key.path;
+      environmentFile = config.sops.secrets.njala_api_key.path;
       dnsPropagationCheck = false;
     };
   };

machines/modules/autoupdate.nix

@@ -17,7 +17,7 @@ in
       default = false;
     };
 
-    # https://hydra.dynamicdiscord.de/job/malobeo/infrastructure/louise/latest
+    # https://hydra.malobeo.org/job/malobeo/infrastructure/louise/latest
     url = mkOption {
       description = lib.mdDoc ''
         Url to your hydra instace. like https://hydra.example.de

machines/modules/host_builder.nix

@@ -26,11 +26,13 @@ rec {
 
             settings = {
               substituters = [
+                "https://cache.malobeo.org"
                 "https://cache.dynamicdiscord.de"
                 "https://cache.nixos.org/"
               ];
               trusted-public-keys = [
                 "cache.dynamicdiscord.de:DKueZicqi2NhJJXz9MYgUbiyobMs10fTyHCgAUibRP4="
+                "cache.malobeo.org:+eSv8F63uj94A0fvmdyPcDDH0qI3CYR91fsbA/eLFGw="
               ];
               trusted-users = [ "root" "@wheel" ];
             };
@@ -43,6 +45,20 @@ rec {
   ];
   defaultModules = baseModules;
 
+  makeNetwork = network: [{
+    systemd.network.enable = true;
+    
+    systemd.network.networks."20-lan" = {
+      matchConfig.Type = "ether";
+      networkConfig = {
+        Address = [ "${network.address}/24" ];
+        Gateway = "${network.gateway}";
+        DNS = network.nameservers;
+        DHCP = "no";
+      };
+    };
+  }];
+
   makeMicroVM = hostName: network: modules: [
     {
       microvm = {
@@ -87,18 +103,6 @@ rec {
           }
         ];
       };
-
-      systemd.network.enable = true;
-      
-      systemd.network.networks."20-lan" = {
-        matchConfig.Type = "ether";
-        networkConfig = {
-          Address = [ "${network.address}/24" ];
-          Gateway = "${network.gateway}";
-          DNS = network.nameservers;
-          DHCP = "no";
-        };
-      };
     }
   ] ++ defaultModules ++ modules;
 
@@ -257,9 +261,9 @@ rec {
     specialArgs.inputs = inputsMod;
     specialArgs.self = self;
     modules = (if (settings.type != "microvm") then
-      defaultModules ++ [ ../${host}/configuration.nix ]
+      (makeNetwork settings.network) ++ defaultModules ++ [ ../${host}/configuration.nix ]
       else
-      makeMicroVM "${host}" settings.network [
+      (makeNetwork settings.network) ++ makeMicroVM "${host}" settings.network [
         inputs.microvm.nixosModules.microvm
         ../${host}/configuration.nix
       ]);

machines/modules/malobeo/gitea_translator.nix

@@ -0,0 +1,78 @@
+{ config, self, lib, inputs, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.malobeo.gitea-translator;
+in
+{
+  options = {
+    services.malobeo.gitea-translator = {
+      enable = mkOption {
+        default = false;
+        type = types.bool;
+        description = lib.mdDoc "Start a webserver for hydra to use the gitea pull request api.";
+      };
+
+      baseurl = mkOption {
+        type = types.str;
+        default = "git.dynamicdiscord.de";
+        description = lib.mdDoc "Base URL of the Gitea instance.";
+      };
+
+      owner = mkOption {
+        type = types.str;
+        default = "malobeo";
+        description = lib.mdDoc "Repository owner on the Gitea instance.";
+      };
+
+      repo = mkOption {
+        type = types.str;
+        default = "infrastructure";
+        description = lib.mdDoc "Repository name on the Gitea instance.";
+      };
+
+      host = mkOption {
+        type = types.str;
+        default = "127.0.0.1";
+        description = lib.mdDoc "Address the server binds to.";
+      };
+
+      port = mkOption {
+        type = types.port;
+        default = 27364;
+        description = lib.mdDoc "Port the server listens on.";
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.gitea-translator = {
+      description = "Gitea Pull Request Translator for Hydra";
+      after = [ "network-online.target" ];
+      wants = [ "network-online.target" ];
+      wantedBy = [ "multi-user.target" ];
+
+      serviceConfig = {
+        ExecStart = ''
+          ${pkgs.python3}/bin/python3 ${../../../scripts/gitea_hydra_server.py} \
+            --baseurl ${cfg.baseurl} \
+            --owner ${cfg.owner} \
+            --repo ${cfg.repo} \
+            --host ${cfg.host} \
+            --port ${toString cfg.port}
+        '';
+        Restart = "on-failure";
+        RestartSec = 5;
+
+        # Hardening because why not 
+        DynamicUser = true;
+        NoNewPrivileges = true;
+        ProtectSystem = "strict";
+        ProtectHome = true;
+        PrivateTmp = true;
+        PrivateDevices = true;
+      };
+    };
+  };
+}

machines/modules/malobeo/initssh.nix

@@ -58,7 +58,7 @@ in
               networkctl down wg-initrd
             '';
             serviceConfig.Type = "oneshot";
-      };
+          };
         };
         network = {
           flushBeforeStage2 = true;

machines/modules/malobeo/metrics.nix

@@ -41,17 +41,22 @@ in
       };
     };
 
-    services.promtail = {
+    services.alloy = {
       enable = cfg.enablePromtail;
-      configFile = import ./promtail_config.nix { 
+      extraFlags = ["--config.format=promtail"]; #TODO please change this to native alloy config later
+      configPath = import ./promtail_config.nix { 
         lokiAddress = cfg.lokiHost;
         logNginx = cfg.logNginx;
         config = config;
         pkgs = pkgs;
       };
     };
-
-    users.users.promtail.extraGroups = [ "systemd-journal" ] ++ (lib.optionals cfg.logNginx [ "nginx" ]) ;
+    users.groups.promtail = {};
+    users.users.promtail = {
+      isNormalUser = true;
+      group = "promtail";
+      extraGroups = [ "systemd-journal" ] ++ (lib.optionals cfg.logNginx [ "nginx" ]) ;
+    };
 
   };
 }

machines/modules/malobeo/microvm_host.nix

@@ -14,6 +14,12 @@ in
         description = lib.mdDoc "Setup bridge device for microvms.";
       };
 
+      testHost = mkOption {
+        default = false;
+        type = types.bool;
+        description = lib.mdDoc "Enable when the host is used for development and testing using run-vm";
+      };
+
       interface = mkOption {
         default = "eno1";
         type = types.str;
@@ -68,7 +74,7 @@ in
     systemd.network = mkIf (cfg.enableHostBridge || cfg.enableHostBridgeUnstable) {
       enable = true;
       networks."10-lan" = {
-        matchConfig.Name = [ "${cfg.interface}" "vm-*"];
+        matchConfig.Name = ["vm-*"] ++ (if !cfg.testHost then [ "${cfg.interface}" ] else [ ]);
         networkConfig = {
           Bridge = "malobeo0";
         };
@@ -81,7 +87,7 @@ in
         };
       };
       
-      networks."10-lan-bridge" = {
+      networks."10-lan-bridge" = if !cfg.testHost then {
         matchConfig.Name = "malobeo0";
         networkConfig = {
           Address = [ "${cfg.address}" ];
@@ -90,6 +96,17 @@ in
           IPv6AcceptRA = true;
         };
         linkConfig.RequiredForOnline = "routable";
+      } else {
+        matchConfig.Name = "malobeo0";
+        networkConfig = {
+          DHCPServer = true;
+          IPv6SendRA = true;
+        };
+        addresses = if cfg.enableHostBridgeUnstable then [
+          { Address = "10.0.0.1/24"; }
+        ] else [
+          { Address = "10.0.0.1/24"; }
+        ];
       };
     }; 
 

machines/modules/malobeo/peers.nix

@@ -52,6 +52,13 @@
     publicKey = "h1A2yt7OQ5EJIilC8tQg203u27o6J6/c+Kd/pZ4UWAY=";
   };
 
+  "albert" = {
+    role = "client";
+    address = "10.100.0.103";
+    allowedIPs = [ "10.100.0.103/32" ];
+    publicKey = "8wgQ+GYLX9PzldmeDOsrhnbBWPCGvHbT+7POT7e4oj4=";
+  };
+
   "backup0" = {
     role = "client";
     address = "10.100.0.20";

machines/nextcloud/configuration.nix

@@ -39,7 +39,7 @@ in
 
   services.nextcloud = {
     enable = true;
-    package = pkgs.nextcloud32;
+    package = pkgs.nextcloud33;
     hostName = "cloud.malobeo.org";
     config.adminpassFile = config.sops.secrets.nextcloudAdminPass.path;
     maxUploadSize = "10G";
@@ -55,14 +55,15 @@ in
     extraApps = {
       inherit (config.services.nextcloud.package.packages.apps) contacts calendar polls registration collectives forms;
       deck = pkgs.fetchNextcloudApp {
-        sha256 = "sha256-epjwIANb6vTNx9KqaG6jZc14YPoFMBTCj+/c9JHcWkA=";
-        url = "https://link.storjshare.io/raw/jvrl62dakd6htpyxohjkiiqiw5ma/mal/deck32.tar.gz";
+        sha256 = "sha256-Oc/J0Ey7f9aHhLBWoAXaDMe2t0eeEQKvpwY510qNpiI=";
+        url = "https://s3.g.megas4.com/ya5mczgkbk6bw7tcy2yr4bl2vdryfe76ok2dj/malo/deck33.tar.gz";
         license = "agpl3Plus";
       };
     };
     settings = {
       trusted_domains = [ "cloud.malobeo.org" "cloud.hq.malobeo.org" ];
       trusted_proxies = [ hosts.malobeo.hosts.fanny.network.address ];
+      overwriteprotocol = "https";
       "maintenance_window_start" = "1";
       "default_phone_region" = "DE";
     };

machines/overwatch/configuration.nix

@@ -37,6 +37,7 @@ in
   services.grafana = {
     enable = true;
     settings = {
+      security.secret_key = "SW2YcwTIb9zpOOhoPsMm";
       server = {
         domain = "grafana.malobeo.org";
         http_port = 2342;
@@ -144,12 +145,30 @@ in
           targets = [ "${hosts.malobeo.hosts.zineshop.network.address}:9002" ];
         }];
       }
+      {
+        job_name = "vaultwarden";
+        static_configs = [{
+          targets = [ "${hosts.malobeo.hosts.vaultwarden.network.address}:9002" ];
+        }];
+      }
+      {
+        job_name = "pretalx";
+        static_configs = [{
+          targets = [ "${hosts.malobeo.hosts.pretalx.network.address}:9002" ];
+        }];
+      }
       {
         job_name = "fanny";
         static_configs = [{
           targets = [ "${hosts.malobeo.hosts.fanny.network.address}:9002" ];
         }];
       }
+      {
+        job_name = "albert";
+        static_configs = [{
+          targets = [ "${hosts.malobeo.hosts.albert.network.address}:9002" ];
+        }];
+      }
       # add vpn - check how to reach it first. most probably 10.100.0.1
     ];
   };

machines/pretalx/configuration.nix

@@ -0,0 +1,103 @@
+{ config, self, lib, pkgs, inputs,  ... }:
+
+with lib;
+
+let
+  hosts = import ../hosts.nix {};
+in
+{
+  sops.defaultSopsFile = ./secrets.yaml;
+  sops.secrets = {
+    pretalx_smtp = {
+      owner = "pretalx";
+      group = "pretalx";
+    };
+  };
+
+  networking = {
+    hostName = mkDefault "pretalx";
+    useDHCP = false;
+  };
+
+  disabledModules = [ "services/web-apps/pretalx.nix" ];
+  imports = [
+    "${inputs.nixpkgs-unstable}/nixos/modules/services/web-apps/pretalx.nix"
+    self.nixosModules.malobeo.metrics
+    self.nixosModules.malobeo.users
+    ../modules/sshd.nix
+    ../modules/minimal_tools.nix
+    ../modules/autoupdate.nix
+  ];
+
+  malobeo.metrics = {
+    enable = true;
+    enablePromtail = true;
+    logNginx = true;
+  };
+
+  malobeo.users = {
+    admin = true;
+  };
+
+
+  services.postgresqlBackup = {
+    enable = true;
+  };
+
+  services.nginx = {
+    enable = true;
+    commonHttpConfig = /* nginx */ ''
+      proxy_headers_hash_bucket_size 64;
+    '';
+    virtualHosts = {
+      "events.malobeo.org" = {
+        forceSSL = false;
+        enableACME = false;
+      };
+    };
+  };
+
+
+  services.pretalx = {
+    enable = true;
+    package = inputs.nixpkgs-unstable.legacyPackages."x86_64-linux".pretalx;
+    celery.extraArgs = [
+      "--concurrency=${toString config.microvm.vcpu}"
+    ];
+    gunicorn.extraArgs = [
+      # https://docs.pretalx.org/administrator/installation/#step-6-starting-pretalx-as-a-service
+      "--log-level=info"
+      "--max-requests-jitter=50"
+      "--max-requests=1200"
+      "--workers=${toString config.microvm.vcpu}"
+
+      # TODO: 25.11 upstream
+      "--name=pretalx"
+      "--preload"
+    ];
+    nginx.domain = "events.malobeo.org";
+    environmentFiles = [
+      config.sops.secrets.pretalx_smtp.path
+    ];
+    settings = {
+      redis.session = false;
+      locale = {
+        language_code = "de";
+      };
+      mail = {
+        from = "malobot@systemli.org";
+        user = "malobot@systemli.org";
+        host = "mail.systemli.org";
+        port = "465";
+        ssl = true;
+        tls = false;
+      };
+
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
+
+  system.stateVersion = "22.11"; # Did you read the comment?
+}
+

machines/pretalx/dummy.yaml

@@ -0,0 +1,64 @@
+pretalx_smtp: ENC[AES256_GCM,data:zYnhuulpJAEEacXxpqNG2GEVrV21H0UZfx3sqZaZxWYL2HW6WwFMZ2PeGL8bWCv92+iZ2DGkhg==,iv:kMJLfeQ+9ZZFc6T+HnS64p9BJUy38nXrakAOXdQ0gIU=,tag:l8/eSrcOtt9MLnqcif5v2A==,type:str]
+sops:
+    age:
+        - recipient: age18jn5mrfs4gqrnv0e2sxsgh3kq4sgxx39hwr8z7mz9kt7wlgaasjqlr88ng
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNZXExRE14NDF6cnFRSE9G
+            RjdxV09UMXUvczBQai9GQW5PT2g0eUZhSUVvClRZL1dJVlpKUTArTkhhR2JCV1VG
+            cktFb21wNDZiZC9oc2l5VS9hdzVhbFUKLS0tIGZZa2Z2R0Nvd3RUbWRHMkFJMjVK
+            QXdRdkVwSFg2TVRBYU1qWFJ2bE9hWFUK8HuJ9ErFU0yH3QlXl1tnmawNX0fHDOFb
+            g+DpDYKccGcC6PxNOE/CsftJqGLtFlToYHOYWG18bFjNZawUoaOfLQ==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3S0s4UlZuSWc3K3cvTDBR
+            WEt2L3hYSGRVWHBYbEtoci9rYkJEK1hYSkRZCkM5S25YNGM2Y3R0MG9lWUNJem9P
+            bnJXbTRFZUpUVmhWVVVqeVhjdDV2SWMKLS0tIEdXbXU0RkJ6ZzBTcTdiZlJPbG83
+            RW8zUzBkNjViYnVFY3MyM1ZENmZXVmcK4144dF921EuNaofNhaYw9Yh56KHdfQD/
+            vxPkp5jC02Wbb6hjImd+oMUg3jgCbWC4j3Qpvaky8Ig2AaJRhtqlxg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-03-09T11:58:41Z"
+    mac: ENC[AES256_GCM,data:n11H0rFtXvCeleTKXnQ8tORm3YH11tvjRd/PYSRof8EIUpQ7ZtyVqdYqPZCUuck12LG8hh9+GBBpXIRDhwEJlteC61Vl0syW9bQvCbfETvIgRZsoIZr+mofYHe1twm73sd7YaGzC6xxVm5HZG/qS1LflHah6jFO6NkgQ0GpLPTE=,iv:np3bKJIbVwn96rMBeedLmw6f1him35waUWN6LJ5MLNk=,tag:fs8rmrSkK1REaUKJHxeSbw==,type:str]
+    pgp:
+        - created_at: "2026-03-09T11:58:34Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQGMA5HdvEwzh/H7AQv/VMIZlsBZPEolTd0yUfHyZ5PRsQDirt4hOuVFGXdKi8tb
+            Pk+L3y69ynfF+ZJsu41+GdVgaNX58bbdqJfnEgE+k35IrJxYmVlNuUmd5s79rOHQ
+            b1dn6SdoVrKTAgtrnicO0n0F41XZBSpqP4wKVHigsWgfHkaUUsI+5d/T/2F+VCcS
+            slhvveCMKNjDlK9sukp5TBiX+xrWTq4QIbMS7L6VSlwHod72bp73o7RV9PgoO4vy
+            aodYiPmJqDjF0Az7JXdu2UdWJGUYxNWb5jHCT3qpcZyX1kVSmZvcRjxtVVCySFx+
+            agcavtdlEV3t8JOOvVmYoxwNOGjDvJ83k6wdueFpoJFE4Z1pHy/XCVCHykmWH/+m
+            nYADzmg+GiOSrTR2xWEmkesrByOMucYiZngDV3RLuZraE+8PJbqX2aAAip1Ol6AX
+            eYGCtLw/cXvDM1ngdj/4vaelek/TMLRRmuDyzVHevnqMGhdgAp4Ns6+ihZajSYkK
+            4YqUSKOMHrfEwbZgGYGW0lgB4cv1uzPgyufcPWzg8oAS0/2jW6KjZPLIx4SYcp41
+            C3BE/osbnyzGhzmabNstFbVmBYF1iK73O/Np2PGj3glBsE7PNMmcDu4ASaEI1nNw
+            CpOmQCR9jRGi
+            =6itD
+            -----END PGP MESSAGE-----
+          fp: c4639370c41133a738f643a591ddbc4c3387f1fb
+        - created_at: "2026-03-09T11:58:34Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA98TrrsQEbXUAQ//aQNOD855rikMtrXENG/XA5dZeKGaLQAv0kWUHuJbRddn
+            IB9pW+Y8AgyB6xc9A4oKOKgjT8TCSYvGI6zDchf5tjrvQwmiMlpQouflcjR+UgDy
+            mANqL2+7GLFVcTuQfRPbEdK54Q78KciQ2bxMeh0WDZ5vV8fCTz+aPsvlNT8AJBcq
+            BO4dyG1oqCT13ln7g7LoHPn22wAj+H93F8aqyFk6YjgomKRf0j9gAW/NI1w8TIsg
+            etgMBrn0AupANrADQHAij1zSS+GaK8ZMBVgCoInc9gAQl97ytMLp/eQj4Ll69r+z
+            JRhFdFDZgP0UIIFurAU5eFixNq8IZnFYvFRGpR/XzAiOh8JfgWUDs5HSLyRcADi9
+            XxLsEnTFm1kfoI+lpma0WtlAIXg2WpCoaU3B2kB15T4giVs6LWGmssux5t8uKTFR
+            DySHvdl9o78zBFPVxhW+j9h04fAeUmCWZYKpnEdFwKpBmGWtnC5rvz22Xwu3Q/wT
+            HioLzvETqVn+knc/ErR6Axw4A9zeLi1AccJdceVopR7rEq+0DjpLV/zYqwGruQaa
+            q1qtQIgPf888TKtNgAGSxQ2nUfkMM2oK2cC6r2juhxwbmTFcz6FUV41To9/hCo1c
+            1SE4ZiRu7R8i+KFn4K2y6RGRkJo75trJkxuwGvAYuo6gGUmj50EeimFx0rKRddfS
+            WAH8JPQH6ohAqaA1hdrQRM7lPtwjPCfJW/fUqPHAR5Ytwn9xmt0A+jQYvmubH9dR
+            UT8OMUOIh2XC2JDYt4P4pFXXODB6WPb3Fdft6S95+vLhx6eHuo7PvVM=
+            =KkYj
+            -----END PGP MESSAGE-----
+          fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4
+    unencrypted_suffix: _unencrypted
+    version: 3.11.0

machines/pretalx/secrets.yaml

@@ -0,0 +1,64 @@
+pretalx_smtp: ENC[AES256_GCM,data:Jrgx1/AsgTb1KxtgiTPGRkgtl5EHPWHPde4ItwOHH9lcmakAb1b2n4JP70vF53uuKIfiyCPeVQ==,iv:fcVFgjKSGTaFxC1DAX2Sb6WD/IbJO0s1A63wrQkLWbg=,tag:NjcNwa+6h/boRemEg1j9ng==,type:str]
+sops:
+    age:
+        - recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxb1dGalUyNzVtYjFFNm9T
+            a3ord2NSTEE3UkhrTm1TbHdMV3lITHJRLzJvCnAxeUZib0d0dCtUZ0x3NUtsdzdD
+            SjVYY0Y4MXhGRVZGZTRiNHJHSHNkb0kKLS0tIGtCL0puTDRZcUsrc2VRUU1URERs
+            Y084Z0tGR3JPZkw5ci9icFVSd051bE0KXaT1mPUBFUorZ/zgYjDyqWGbnHAkcjmZ
+            KVZJae9HC35+mq9mme7XOH96NX6tq69Hg+TUFoQg1m2Ifz27GKD3bQ==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1y04q8n7mgk82c87rfddm0u72h0ny6sfzktjsk0cc3gu93kezudfqdp9v9g
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWVVJyZFZCTVZhUXN0WFJu
+            UWU2UWxTY3ErWHVhMGNGU0t3N0c2ekM5a0NvCkVtTDdyeEVMQzY5RUg1NnVZVHd1
+            a1U4cytPSjU3K0NaSmJDdk5peHM5emMKLS0tIGhTemxzbjBzNkFILy9QRG53V0lX
+            dEZTQVpCOUNDSW0yRS9rYkZkVjZPRG8K/Hea01veMQ0Gxo//24PRhDcncYUuExpQ
+            T4ff4CNXF2vDYDsSIPDlhHdmSRGmoCw00ChCZ8vvIlHl2O86Qmd0Ng==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-03-09T11:58:07Z"
+    mac: ENC[AES256_GCM,data:QWFdEg+I1YUH65qPUQvOwwb7i+X+HYKdhYJiLoku+XcvYq4xFaoBvFTW3eZ/S2i20yK1SQcAVjUe7JQEgZDtqzPdZH6w4YIZJVvQdDMPy99xdXXEZrnW+rHOy60XFS7WiyeUdLA3TQ4+Ec1f2kkQw7MhbDbOoOh0obsvfhtz3OE=,iv:h4Qn/LpayhXCWWsO/nm18Rapz6WXQcjItF9YwyiFJJ0=,tag:bxtQQMNgVyFkHp+pbSP3UQ==,type:str]
+    pgp:
+        - created_at: "2026-03-09T11:57:24Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQGMA5HdvEwzh/H7AQwAkahLpq8vqQn6N5EyrbC+33Ohl61ZbBPR6NnQaLvU3s+i
+            WJ3xe7T+LP0jv2C2t//VhYvVNolQ2LBA+yLE3Cvjw6JCyVhu54ZRDJciY2w/wY5J
+            MN++Bqac6avoEYHkvoN6m1/F8JK46fzgQT7xXFTGix+g1W48aSC70GRZUmsg469p
+            ZFYbj/mEseG1ICxhZANU2NgRgW7kA/La/fe3/+YE8tkNHSXF2ZevQvluarm7kXT9
+            KWani1wMlUMwZoCpwbfNwKpXPL0jW48FJsFIlxPbDrDCkR1gih1PHFVyqd45am9g
+            Uo0hJ1NOKzm5Cy5c/3xJzaP62UWyNJf+v5VojEg2XfSGqtaZDFQsLK0of5G/XArn
+            C7k7UbQJqz15rHWPznIppv2h+cTIsVDQcz77es1/qaOQyCMHdYqdkzi5YV7DJBZS
+            K6PP3Nt77uL4LGRL0vFtBgdhKFtXAAf8lhRfZJcJ2P9BYvaFdRUfjm/r0TNfCref
+            k2WCesk4F/pQSyB3ofuR0lYBJzlZ3iNpl7DlfyZ6DRZ/+aVFceRf9A8QKtkVmdMt
+            noqBJfLzhWgVmUUh3DO97mJV5pNOx8238vqVTxWrUqZXjXdXaUDaFUDXvgwg3GOA
+            N28ZjLy1XA==
+            =mIVi
+            -----END PGP MESSAGE-----
+          fp: c4639370c41133a738f643a591ddbc4c3387f1fb
+        - created_at: "2026-03-09T11:57:24Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA98TrrsQEbXUAQ//cnVHHJEwQn+W8Jkt+jwgnKCgbRutvG3U8hlXizzdk2RI
+            j6nVPpv2DwuXvX3ktnng8XrmWwXf9rFRRltVs7alenEnHLxiDd5w+WYeH4NCHOFr
+            +vvFwxNOxzLDj5B2Fjod4El70jUdrP6Mqzy37DPu1Gb2qIUEwdF1LEzM4FMWdeWL
+            BA0wCJzlTXzdlb0shw7xEsqvmnL11u+aQ8AVU3kgWxSkn0VZJIYYkwegUYfflSIr
+            wZsNsh8k+wG58f5IVr8SqnzkfxRfJSoxNKWV9dK3a9hJnnD3DUhqnOgvCnPCRKSP
+            drH+7KxqmNBxqQK3f2iJvgcyLQwyEEqF2Rt6gXwyDByHy3ewupAQD0aQwi5HMWcK
+            iEUVSQVZ6jRfAIyDs3sBnBHceB9BShFr+NN9eUjKJWm2QD4TdQamnpMLsQGpdZv5
+            Lomk9VfdZPNw7DAKJs1oDeBRmhAP/crlOW/ZZho9mewKHr7Htu3VZP812GVupJns
+            IK9mMnpwAhgCtChcOj/ule9NcA/AWKcrtdAyId11SvjtMO+ZjRFrOCK1wKgIif3p
+            ogjaK38v/7gy4/8CDyVgru+luNklsRHfZr+BuPGBDDL8M7umXilK+GyGO1CnrjxW
+            DJXdvMe+u75OsYvGv7eX0tqd+ePanCEoDXxFJbMc2QZigD2kZgq+qRM9CxJ2jCXS
+            VgEEHybyGrOo5RcJkpk+UQpb2aTMLgFNqkTn0PRQSMFeXVQIt584a9xZs1TQ7ZsT
+            5H4jaFXFcS+GG09CORbkf2fkQI2KpaqBAGFct21K2hY17Tpm7kgC
+            =yGms
+            -----END PGP MESSAGE-----
+          fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4
+    unencrypted_suffix: _unencrypted
+    version: 3.11.0

machines/ssh_keys.nix

@@ -4,6 +4,7 @@
    "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCxgcjNOYbza3+RfANFDXy7HXNRFlkpDOAcGyB7MKshiVlbPByWRSjfZa0BeRNjpeCd8QkIodKUzqYOCOrc8ad3kiNbdLRcDz57A5xSLD3ynakoWJo0AmJjT3Ta1JJj8inNwwykR0ig5//SrtsZb9HkWJDAF017MokM2r8AWPE1QzcQdh93kojXcgTHrJHzEqgKbEGDEk37f1RvZG4umEFeqdK2FvS5isPa7P9X7hyyoDC8bvEy7xfaDrToJAoXon6r79taxH8UWIvy//xsU0NBLYK2eE4RQe2AjF6Ri+CybI6y1SsHOvyh4nNKWlfUOEL6UnIulRn/LXFOKCJi7xuoTeJXS0+w1DNEuiGosVNXPSKbUm/eDBVnb8Iyep9wmygSZayN82xL5lRlG3Mn45ttecqfm2SJkmduBA5qXcTdDPe/lXTZaVO9tbiIcJfUgd3ttEu2+6YjLn74D965PlovzvR6EhbVUZ8IkOAt4VmuTkXIdm8SCS7jzhsiKeUXoZ4rfa375zi79SIPuIkoMasj6d16wcYOeFIUIMFFccfQ9jQjr9NTSXC2dd7sfbI9I9mF7eRQSsUdSwpP8WH1b+M1MxTbdhEUdPwpOLviTTIuk8E8K8DQDZIcOOh38mCDpyoh02nwfRxlyoYVsKAHIQH02dHTvYEa3/pMsRwGc9W1Ow== kalipso@desktop"
    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINQg6a2EGmq+i9lfwU+SRMQ8MGN3is3VS6janzl9qOHo quaseb67@hzdr.de"
    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICKaEcGaSKU0xC5qCwzj2oCLLG4PYjWHZ7/CXHw4urVk atlan@nixos"
+   "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDi8yxrMZoXEy7e8/MZeyihOARU2tN0TpJTUX55UO31B atlan@argon"
  ];
  backup = [
   "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDIGryhnXdmbGObONG88K+c9zeduMrwtoLHwzMDZg3UXB+Cnq2FXWOrlLZxA+95VUgHpyGZiykJmzeWrKhldDlDeGGd8QCCLeuliiOgXADTYjWaVfhd+6arPZrK2VtqqsguvH40gW1xfoGAOmAT4WFnxWxIaEip0V2u6NOoKTiH9I3bz2Qe4lfJvPXig+XwCXcukXd6XUkDFYDpiw8XNV3X7pqTus5d2RYR97bAhIYZZQ6h50ZpTY8N0lFh4RY5yfx8BhxJW3tfoi9uZvVuPx7dGPsZsSniENFPMNz3UwHGitTJMr4088cJrAGgd5lyFuLouiHiM2JMGA0wx9wWTbWJEwTLaTVQK9gSJf857ndV2zCh9vKlfko4w9bQgqxKg4U/mY8dXX1E7D51nD2ci8Ed+ZG+NEneFLyZhLsD82GkBY+YovA+4xm/pcx+hBhlyqGNxI8v+Jh+JhEyD/ZLgJfq3ZMbGIGsTiDwZ2flLLxImHHEoDoT6PHU6hDhPDJu560="

machines/testvm/configuration.nix

@@ -51,7 +51,6 @@ in
   services.acpid.enable = true;
 
   networking.hostName = "testvm";
-  networking.networkmanager.enable = true;
 
   time.timeZone = "Europe/Berlin";
   system.stateVersion = "23.05"; # Do.. Not.. Change..

machines/vaultwarden/configuration.nix

@@ -18,10 +18,17 @@ with lib;
   imports = [
     ../modules/malobeo_user.nix
     ../modules/sshd.nix
+    inputs.self.nixosModules.malobeo.metrics
   ];
 
   networking.firewall.allowedTCPPorts = [ 80 ];
 
+  malobeo.metrics = {
+    enable = true;
+    enablePromtail = true;
+    logNginx = true;
+  };
+
   services.nginx = {
     enable = true;
     virtualHosts."keys.malobeo.org" = {

machines/vpn/configuration.nix

@@ -58,6 +58,15 @@ with lib;
       };
     };
 
+    virtualHosts."events.malobeo.org" = {
+      locations."/" = {
+        proxyPass = "http://10.100.0.101";
+        extraConfig = ''
+          proxy_set_header Host $host;
+        '';
+      };
+    };
+
     virtualHosts."tasklist.malobeo.org" = {
       locations."/" = {
         proxyPass = "http://10.100.0.101";

outputs.nix

@@ -118,6 +118,7 @@ in (utils.lib.eachSystem (builtins.filter filter_system utils.lib.defaultSystems
       users.imports = [ ./machines/modules/malobeo/users.nix ];
       backup.imports = [ ./machines/modules/malobeo/backup.nix ];
       printing.imports = [ ./machines/modules/malobeo/printing.nix ];
+      gitea-translator.imports = [ ./machines/modules/malobeo/gitea_translator.nix ];
     };
 
     hydraJobs = nixpkgs.lib.mapAttrs (_: nixpkgs.lib.hydraJob) (

scripts/gitea_hydra_server.py

@@ -0,0 +1,107 @@
+#!/usr/bin/env python3
+
+#imports
+import os
+import json
+import argparse
+from http.server import BaseHTTPRequestHandler, HTTPServer
+import urllib.request
+
+def _get_api_response(baseurl, owner, repo):
+    ###https://docs.gitea.com/api/1.21/#tag/repository/operation/repoListPullRequests
+    ###GET /api/v1/repos/{owner}/{repo}/pulls
+    url=(f"https://{baseurl}/api/v1/repos/{owner}/{repo}/pulls?state=open")
+    headers={"Accept": "application/json"}
+    req=urllib.request.Request(url, headers=headers)
+    with urllib.request.urlopen(req) as resp:
+        return json.loads(resp.read().decode("utf-8"))
+
+def _parse_response(baseurl, owner, repo):
+    target_repo_url=f"https://{baseurl}/{owner}/{repo}.git"
+    pulls: dict={}
+    response=_get_api_response(baseurl, owner, repo)
+    for pr in response:
+        pr["target_repo_url"]=target_repo_url
+        pulls[str(pr["number"])]=pr
+    return pulls
+
+class PullsHandler(BaseHTTPRequestHandler):
+    _VALID_PATHS={"/", "/gitea-pulls-sorted.json"}
+
+    # Class variables to store configuration
+    baseurl = None
+    owner = None
+    repo = None
+
+    def do_GET(self):
+        if self.path not in self._VALID_PATHS:
+            self.send_error(404, "Not Found")
+            return
+
+        answer=dict(_parse_response(self.baseurl, self.owner, self.repo))
+
+        body=json.dumps(answer, indent=2, sort_keys=True).encode("utf-8")
+
+        self.send_response(200)
+        self.send_header("Content-Type", "application/json; charset=utf-8")
+        self.send_header("Content-Length", str(len(body)))
+        self.end_headers()
+        self.wfile.write(body)
+
+    def log_message(self, fmt, *args):
+        print(
+            f"[gitea-translator] {self.address_string()} - {fmt % args}",
+            flush=True,
+        )
+
+def main():
+    parser = argparse.ArgumentParser(
+        description="Hydra Server to Gitea-pull-request translator"
+    )
+    parser.add_argument(
+        "--baseurl",
+        default="git.dynamicdiscord.de",
+        help="Base URL of Gitea instance (default: git.dynamicdiscord.de)"
+    )
+    parser.add_argument(
+        "--owner",
+        default="malobeo",
+        help="Repository owner (default: malobeo)"
+    )
+    parser.add_argument(
+        "--repo",
+        default="infrastructure",
+        help="Repository name (default: infrastructure)"
+    )
+    parser.add_argument(
+        "--host",
+        default="127.0.0.1",
+        help="Host to bind to (default: 127.0.0.1)"
+    )
+    parser.add_argument(
+        "--port",
+        type=int,
+        default=27364,
+        help="Port to bind to (default: 27364)"
+    )
+
+    args = parser.parse_args()
+
+    # Set class variables so they're accessible in request handlers
+    PullsHandler.baseurl = args.baseurl
+    PullsHandler.owner = args.owner
+    PullsHandler.repo = args.repo
+
+    print(
+        f"[gitea-translator] Starting, pulling from {args.baseurl}/{args.owner}/{args.repo}",
+        flush=True,
+    )
+    server=HTTPServer((args.host, args.port), PullsHandler)
+    print(
+        f"[gitea-translator] online @ {args.host}:{args.port}",
+        flush=True,
+    )
+    server.serve_forever()
+
+if __name__ == "__main__":
+    main()

scripts/unlock-boot.sh

@@ -1,4 +1,3 @@
-set -o errexit
 set -o pipefail
 
 sshoptions="-o StrictHostKeyChecking=no -o ServerAliveInterval=1 -o ServerAliveCountMax=1 -p 222 -T"