Update flake.lock

[goldman] fix secrets
update gatekeeper
2026-11-15 04:02:06 +00:00 · 2026-11-10 17:15:37 +01:00 · 2026-11-10 16:39:11 +01:00 · 2026-11-10 16:36:14 +01:00 · 2026-11-10 16:35:25 +01:00 · 2026-11-10 15:45:11 +01:00
13 changed files with 299 additions and 76 deletions
@@ -88,11 +88,11 @@
        "uv2nix": "uv2nix"
      },
      "locked": {
-        "lastModified": 1786138873,
-        "narHash": "sha256-+G/hTquaK4AjYxNSJTpcZXUEKxFDv9lOn3x+lHHTWJw=",
+        "lastModified": 1794324984,
+        "narHash": "sha256-av7o0pNaukTFE2NPD/t7s8YW9tXUlkZD4h6OlGP8L/0=",
        "ref": "refs/heads/master",
-        "rev": "c5934d05c6f01c94c36221deb7ed4de03aa91ca1",
-        "revCount": 127,
+        "rev": "70aaab5596d217c7201829c7cc174515a9a84e7b",
+        "revCount": 152,
        "type": "git",
        "url": "https://git.dynamicdiscord.de/malobeo/gatekeeper"
      },
@@ -108,11 +108,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1787377438,
-        "narHash": "sha256-Sxu1NLTD/Ern6hFGLlZmtKCSct3YQXZI/lls8RE1XeM=",
+        "lastModified": 1794251182,
+        "narHash": "sha256-R2sZBXiOJo3HAnvTiVkbbHDJy//JMlAwUKEiPbfqPXk=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "65258d5c65a250189fde2e35f490d15e064c4c62",
+        "rev": "6eb2d33d1d0c95a37ef6443c88e6c1686012ee8b",
        "type": "github"
      },
      "original": {
@@ -149,11 +149,11 @@
        "spectrum": "spectrum"
      },
      "locked": {
-        "lastModified": 1788263502,
-        "narHash": "sha256-gyVqW5U9wy6A8voJNu6SiSYTKDplo/MDl31x7FszWlk=",
+        "lastModified": 1794529892,
+        "narHash": "sha256-m5iXk3ILiCuRpCgqYWNiGVFmu8YLh2FNxxaZj/Auc10=",
        "owner": "astro",
        "repo": "microvm.nix",
-        "rev": "974d315e504e666eac4920d712e3ff6804dc1502",
+        "rev": "194a254693f49af939a2b53d04982bd4b276fdb3",
        "type": "github"
      },
      "original": {
@@ -203,11 +203,11 @@
        "nixpkgs": "nixpkgs_2"
      },
      "locked": {
-        "lastModified": 1788335262,
-        "narHash": "sha256-3jBEq8avfzlrsY4UpW4d5TOmm7ocseZfnitEJhqauyc=",
+        "lastModified": 1794597451,
+        "narHash": "sha256-bUkc9dMpCFiJuuf5Efr7pnCDs5q18aA8zJah+MYZl9w=",
        "owner": "NixOS",
        "repo": "nixos-hardware",
-        "rev": "44d95795ee2d475b3d687325e26dcf4ca9104557",
+        "rev": "eb3c90bd715f7a9a28719bb014f53d309ccb2fc8",
        "type": "github"
      },
      "original": {
@@ -235,11 +235,11 @@
    },
    "nixpkgs-unstable": {
      "locked": {
-        "lastModified": 1788179007,
-        "narHash": "sha256-hn1oU2rue2SYK8dAr8+WNZWtbsz1S2W5mnHlSEuh3bo=",
+        "lastModified": 1794386569,
+        "narHash": "sha256-x9sADJvoVG0L6RejZB+/BB4YiGZFBZrfTlhF4uBq1tQ=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "34ab99075ac4f7e40cf037eef32cb1c360bb85e9",
+        "rev": "d4f25a3e562008648d45bcf2d70bcc7422cad84e",
        "type": "github"
      },
      "original": {
@@ -251,11 +251,11 @@
    },
    "nixpkgs_2": {
      "locked": {
-        "lastModified": 1767892417,
-        "narHash": "sha256-8bW3q88CEg2u4hSP66Vf4lpbLonHz7hqDNBMcCY7E9U=",
-        "rev": "3497aa5c9457a9d88d71fa93a4a8368816fbeeba",
+        "lastModified": 1789546076,
+        "narHash": "sha256-vWkSk5bbfTqdtMoSgD9FshACO8JCvXTFi+3cqEp0mH0=",
+        "rev": "b1b875982b17dabde9b4a37f3e229e74913e6db3",
        "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.05pre924538.3497aa5c9457/nixexprs.tar.xz"
+        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.11pre1074753.b1b875982b17/nixexprs.tar.xz"
      },
      "original": {
        "type": "tarball",
@@ -264,11 +264,11 @@
    },
    "nixpkgs_3": {
      "locked": {
-        "lastModified": 1788187754,
-        "narHash": "sha256-bu1QxmXKmPuvBLN7bHP355OV9Qo13x9WCiRDH62CqRM=",
+        "lastModified": 1794552581,
+        "narHash": "sha256-qXFIqA6FCcx7XeDzw0ZNlkDT9UiCzrNDwK8RuU8RcHM=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "5dfba6236110080a54247d6460bc2ff5dda939cc",
+        "rev": "f1e5c356f35d07e7b71a6b5e6c9338e0b029e0c0",
        "type": "github"
      },
      "original": {
@@ -278,6 +278,27 @@
        "type": "github"
      }
    },
+    "portal": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "utils": "utils_3"
+      },
+      "locked": {
+        "lastModified": 1794324704,
+        "narHash": "sha256-f8IaShGcCQ42VuuT8JHBhX1b8jw/dGpRhpAcw3rkhQ0=",
+        "ref": "refs/heads/master",
+        "rev": "cfb18582948c2249a8d6b625ddc68de31f668f1d",
+        "revCount": 34,
+        "type": "git",
+        "url": "https://git.dynamicdiscord.de/malobeo/portal"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://git.dynamicdiscord.de/malobeo/portal"
+      }
+    },
    "pyproject-build-systems": {
      "inputs": {
        "nixpkgs": [
@@ -341,9 +362,10 @@
        "nixos-hardware": "nixos-hardware",
        "nixpkgs": "nixpkgs_3",
        "nixpkgs-unstable": "nixpkgs-unstable",
+        "portal": "portal",
        "sops-nix": "sops-nix",
        "tasklist": "tasklist",
-        "utils": "utils_3",
+        "utils": "utils_4",
        "zineshop": "zineshop"
      }
    },
@@ -354,11 +376,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1788337237,
-        "narHash": "sha256-gkSH8VUtCo6hnysNmb9DbTuDepH2t5pv+QWjP75xKAk=",
+        "lastModified": 1794624949,
+        "narHash": "sha256-3q/hxp/flW1PnV3Dx+H3p8kHGEHJ7251BqVMNsAAB9E=",
        "owner": "Mic92",
        "repo": "sops-nix",
-        "rev": "fbf759290e0cb0a98dfc813a4eb7d53ad1dacb57",
+        "rev": "11e5885d241743ff0193465d533b20e754bc3ce0",
        "type": "github"
      },
      "original": {
@@ -370,11 +392,11 @@
    "spectrum": {
      "flake": false,
      "locked": {
-        "lastModified": 1785761586,
-        "narHash": "sha256-MWOMVqJJERwjQGgRIv8d6rlEBqbLM3VZWxHkNKIIZNw=",
+        "lastModified": 1786032750,
+        "narHash": "sha256-+Ba/kIn5BjvV7PN8bWOo7RoqgTY/Yv2M7qeMf3wS2Ag=",
        "ref": "refs/heads/main",
-        "rev": "a7762d6f54b40560dd5255ce902e6e6a5d980fe9",
-        "revCount": 1416,
+        "rev": "77d2389874bb092b8dbf05ecc5b1030372e80e98",
+        "revCount": 1417,
        "type": "git",
        "url": "https://spectrum-os.org/git/spectrum"
      },
@@ -429,6 +451,21 @@
      }
    },
    "systems_4": {
+      "locked": {
+        "lastModified": 1791244623,
+        "narHash": "sha256-uuanbkFk8a313Zfrxdcz8Us/yQtaxNnKJtX8v0ZPpd8=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "d36eeed142f88b5a636f2e3856a53c61654cf29b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_5": {
      "locked": {
        "lastModified": 1681028828,
        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
@@ -504,11 +541,11 @@
        "systems": "systems_3"
      },
      "locked": {
-        "lastModified": 1731533236,
-        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "lastModified": 1791914995,
+        "narHash": "sha256-Zf/xfQEAasnwnmEfHqW/4hjDE/s44yn2hD4RuVIZRjA=",
        "owner": "numtide",
        "repo": "flake-utils",
-        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "rev": "b7a79d3fea1e214f6d668d521cecec0c01e26544",
        "type": "github"
      },
      "original": {
@@ -521,6 +558,24 @@
      "inputs": {
        "systems": "systems_4"
      },
+      "locked": {
+        "lastModified": 1794427683,
+        "narHash": "sha256-o7ey9gEilsxaifqJWnBDlYSKbNWYQYtKwDyXeZU2kaU=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "cd489559845d81f673a12885576016c65cbe9363",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "utils_5": {
+      "inputs": {
+        "systems": "systems_5"
+      },
      "locked": {
        "lastModified": 1731533236,
        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
@@ -565,14 +620,14 @@
        "nixpkgs": [
          "nixpkgs"
        ],
-        "utils": "utils_4"
+        "utils": "utils_5"
      },
      "locked": {
-        "lastModified": 1789131197,
-        "narHash": "sha256-gpjhy2mIBt89oCVzoSXy8AgfAKjJ9Fi3u01CX09UTF4=",
+        "lastModified": 1792488750,
+        "narHash": "sha256-VLBpNctawQ+Yd03hkfhNPUqQVXNCc7bc6Qhu7mwJvKM=",
        "ref": "refs/heads/master",
-        "rev": "38bcceb0e8b84d6dcd50d05683c71eea8d410479",
-        "revCount": 161,
+        "rev": "7a8b9d4f3522c68cd15b21a1ec093c8c441775bf",
+        "revCount": 162,
        "type": "git",
        "url": "https://git.dynamicdiscord.de/kalipso/zineshop"
      },
@@ -32,6 +32,11 @@
      inputs.nixpkgs.follows = "nixpkgs";
    };

+    portal = {
+      url = "git+https://git.dynamicdiscord.de/malobeo/portal";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
    ep3-bs = {
      url = "git+https://git.dynamicdiscord.de/kalipso/ep3-bs.nix";
      inputs.nixpkgs.follows = "nixpkgs";
@@ -18,6 +18,7 @@ keys:
  - &machine_pretalx age1y04q8n7mgk82c87rfddm0u72h0ny6sfzktjsk0cc3gu93kezudfqdp9v9g
  - &machine_albert age1mfarz0n7qfa7vg8zz355qf8eregm6myl38lld0h767nuvhgjqd4qruxuhn
  - &machine_ns1 age1mam7y7x4my6g8yt8leze3pvlq0fr48hdsqz62gs7l9rstf9hh3fs03xf7n
+  - &machine_goldman age10gk6kydhljjk99vmaj6z0sz5d9x7pwp458gpr3hzqpl5hh04z5xqgley7j
  #this dummy key is used for testing.
  - &machine_dummy age18jn5mrfs4gqrnv0e2sxsgh3kq4sgxx39hwr8z7mz9kt7wlgaasjqlr88ng
 creation_rules:
@@ -132,6 +133,14 @@ creation_rules:
      age:
      - *machine_ns1
      - *admin_atlan
+  - path_regex: goldman/secrets.yaml$
+    key_groups:
+    - pgp:
+      - *admin_kalipso
+      - *admin_kalipso_dsktp
+      age:
+      - *machine_goldman
+      - *admin_atlan
  - path_regex: .*/secrets/.*
    key_groups:
    - pgp:
@@ -149,6 +149,7 @@ in
    "antamap" 
    "ns1"
    "wordpress"
+    "portal"
  ];

  networking = {
@@ -184,6 +185,22 @@ in
      };
    };

+    virtualHosts."portal.hq.malobeo.org" = {
+      forceSSL = true;
+      enableACME = true;
+      acmeRoot = null;
+      locations."/" = {
+        proxyPass = "http://${hosts.malobeo.hosts.portal.network.address}:8080";
+        extraConfig = ''
+          proxy_set_header Host $host;
+          client_max_body_size ${inputs.self.nixosConfigurations.nextcloud.config.services.nextcloud.maxUploadSize};
+          client_body_timeout 3600s;
+          send_timeout 3600s;
+          fastcgi_buffers 64 4K;
+        '';
+      };
+    };
+
    virtualHosts."cloud.hq.malobeo.org" = {
      forceSSL = true;
      enableACME = true;
@@ -263,7 +280,7 @@ in
          client_body_in_file_only clean;
          client_body_buffer_size 32K;
          
-          client_max_body_size 50M;
+          client_max_body_size 500M;
          
          sendfile on;
          send_timeout 300s;
@@ -10,17 +10,33 @@ in
  imports =
    [ 
      inputs.gatekeeper.nixosModules.gatekeeper
-      ../modules/malobeo_user.nix
+      inputs.self.nixosModules.malobeo.users
      #inputs.nixos-hardware.nixosModules.raspberry-pi-3
      (modulesPath + "/profiles/minimal.nix")
      #(modulesPath + "/installer/sd-card/sd-image.nix")
+      ../modules/autoupdate.nix
    ];

+  malobeo.users = {
+    malobeo = false;
+    admin = true;
+    backup = false;
+    hostKeyLocation = "/etc/ssh/ssh_host_ed25519_key";
+  };
+
  fileSystems."/" =
    { device = "/dev/disk/by-label/NIXOS_SD";
      fsType = "ext4";
    };

+  malobeo.autoUpdate = {
+    enable = true;
+    url = "https://hydra.malobeo.org";
+    project = "malobeo";
+    jobset = "master";
+    cacheurl = "https://cache.malobeo.org";
+  };
+
  #Try to reduce size
  documentation.man.enable = false;
  documentation.nixos.enable = false;
@@ -50,18 +66,13 @@ in
      settings.allow_anonymous = true;
    }];
  };
-
+  sops.secrets.gatekeeperEnv = {
+    sopsFile = ./secrets.yaml;
+  };
  services = {
    gatekeeper = {
      enable = true;
-      envFile = pkgs.writeText "env" ''
-        MIFARE_APP_MASTER_KEY="7b195adb892073c9e34ebe7e0ca28b2b"
-        MIFARE_ACL_READ_BASE_KEY="741a50f2b189cc9f151e0600f50a6e1a"
-        MIFARE_ACL_WRITE_BASE_KEY="f1aa99f81cca268de98d422ee0ccb65c"
-        SECRET_KEY="8b14d0b447bff7efa24d5019cc59a999786e31f6f865173bbd642bf18de5ad85"
-        MQTT_HOST = "localhost"
-        MQTT_PORT = "1883"
-      '';
+      envFile = config.sops.secrets.gatekeeperEnv.path;
      mock = "False";
    };
  };
@@ -86,7 +97,7 @@ in
    };
  };

-  networking.firewall.allowedTCPPorts = [ 80 443 1883];
+  networking.firewall.allowedTCPPorts = [ 80 443 1883 8000 ];

  system.stateVersion = "23.05";
 }
@@ -0,0 +1,64 @@
+gatekeeperEnv: ENC[AES256_GCM,data:1zcanuvSNQlxschxfHF3g7FRFwZr/0xLvLsShKYzDeTOjabnzJzn+uFSbOblvQTFUU6PLj3XuQ8iHaCO7l8aHqw8Omu/3VZXYb7ImvDC39Swxx9SqaGKzZKxLksp6tDf/m1YG0KrPYtw6E21PGOtwovawYNEpth3I8YH6yb/Aw62tsOFiJmC3AszQK16pffsCuahJtJRnTh488YTBSR1GTFAPHkEOTsKWCw3WoXyniQJSvNLICMB1LBmIXYvDicIQQsQouK6TTHkV9EQx6Vs54cTEzlAXgSpiQn+ka7aCaHLaZzXTN/s3wd2DK+C+gMyqP5XTc9zeYKOiUxvRhW217u8pmn7TnYbxS09WAlw+VnDGGhZwv2xhdNwuvdSbtxKvLJGYmn1X8sLn6gn4hDj675WSZNxOQkxLMkTn+ixTnIBhnVV89f4SvWkNwygJbV53sLzLgPUkvscz2HxeQkQ1s8y89O/WvhOgM8i5OQ5jDRcq9vKG9E7AvVXFx0cuk1uN6JKT1OAUUEWsjUEQgdLwfajMYCN2zLUvxGTYbvI67/UsAx5JgLzyXGeVrzBB8U/HQrclFdE3LQg5SfJvZp2yoFbbAasU+UiBj3yorRJ1IeFuBKSMmf2RcK7U7990uR4kZGyQJ5ZLxpxTeZTDR5dhk78qBAWAAJkSJeF,iv:ZGI/OOZtHRCb8MUb5bmHzDKys4W6TrJ2R4rczGIfXLg=,tag:LO+Ejl06xvOnHyUAGHhv4A==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0ZVNEdENac1RGaXdzb0ox
+            aXJvQ3RhOHZULzVUMjIzVkFKMUp0aG00ZHlnCmFqQmlLbmZQVUUveG1INGVnbW5x
+            OE1HOUx1TmR6bERuUGxYUjNwSGoyRlEKLS0tIE1tWEJXQk5CT1lMdmdad2FTOENa
+            NW9lOTd5TGNobFN5VFR4Q2xIMjk3MkkKj85PvBY45bF4UlwQ2BhCjmfLdpWvtuD5
+            MmBql3JijU22TVh4d85tvKGrxmwMPenLC+GzawR0wbMXKKwmGu+Tqg==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age10gk6kydhljjk99vmaj6z0sz5d9x7pwp458gpr3hzqpl5hh04z5xqgley7j
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4UlYvam94d1hvbmRpdHI2
+            dEhocE5ZQUkwQ1ljcDlwYVZYelRTcHI3T0VnCjVURFNvc1c3Q2tTNXB1cXE5SWZj
+            aXl6YU9TMmJNaERGT1pOZWFEVG9tNDgKLS0tIEE2TzZ2eTJlQXMzOUp5UXIvMGFU
+            b0o0VFdNZGpjOWRSSmQ2RWlkUm9IZkkK33kOgGs5K8QEYwQ/n65y+Lftio1A6SGD
+            UK46fFb+yAoK/H3XRgzot0dt8+7RBTCJwNF+1tHWPl2Nk/1KY2bJ1g==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
+    lastmodified: "2026-11-10T16:15:22Z"
+    mac: ENC[AES256_GCM,data:33FyofOAHb5EX4ZQe7pURPmfyG86LlF1BrigKtiFNrJ0MH6c5o+Bi/PG+zf0sKqcqkNr8PybL6iexj4YRMOqNA/OcEI9LSKCrtV1e9weUfknC4wQXLww3jba8StBZpHdMOpQ0LtbWbZwzkKF9lY3nFFtC/duprBDD7qe8L/IlXw=,iv:VZMt+wC9vV4YQOiJNy3XpjfwMBZwLJkmSk7lWSyi6x8=,tag:oF1pKKNvo5weyvhyMDdKOQ==,type:str]
+    pgp:
+        - created_at: "2026-11-10T14:43:03Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQGMA5HdvEwzh/H7AQwAmZuazwF5B/LTZMEe6nV+TBPubQN2b4CVI8HEFwfFKPeM
+            sKhn8isOnf+Q7gonZVLRiSraMc/Ttj2VZEJDA1Y76GSBNQK5irIQsYHl6J7fd2c4
+            85+YBbNiFLeSTmUMdkqjRDeo49o2J0ItAy7nwtiqpL59rLVcUq5cPvAHiaEGSTes
+            c1qe23BpRuagvKlzKYOoauGD3cDNyQ+jOhfJxsROlrsAL2N+1QNhIxE95JGhDnX9
+            AirNruuufDGVBsryZVUDo8fdZzc+p5CsL9UHMgowLiH+UjmfEvEr1y6uNgQnjhG3
+            SMVf0qnbJNI7jSpRtnLYg/x0y3NxcmZEWvTqJ7s1LoM3z8Fc8iSYz9W6xLmZXZMg
+            LxmYfd3tmYyE7CAKQ7UAPs0yu9YGbLP9hNRhALEW9mse8wpgQ377wl6nB7CtF3dT
+            F64zrB9P72RAHrn882LQac4gY7hAERkGzgtC1zOfPBUTHUo+b839lNQ1nBDYzNr9
+            On85Sud8dAd2mLEaCCG60lgBDdYz5kzoXkY7trpIG+w9YLJhOwXt4jMsbTlQTs2x
+            NFnCUxik+W65Bl7PIACCmfjsdPoiGy/yrdeAblCZlthjy4AkKlaRb4NpdTKt3tSc
+            9v+JtcrlUFpC
+            =Bhqc
+            -----END PGP MESSAGE-----
+          fp: c4639370c41133a738f643a591ddbc4c3387f1fb
+        - created_at: "2026-11-10T14:43:03Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA98TrrsQEbXUAQ/6Awh/C2TD7Bz3JrOE4+aKm79MuHYHCjwqat2F/bfpRANr
+            MqEjrKi1YpfcPoSd05FbmjJgXdp3vHk1xz7n28rjEtqdNhV30bWyvEEc+XOpcyPV
+            hjAzHcw93Hk7PZDRsq70JhwXo4GFwI+jamgtxKy3stcCeUPpjvX97Z9GhGLhPh+3
+            PVoAR13p0NtliYVLs53IYnJ1ZkAsGoyNaTdjAT4FgeIrXJxfW1QS+8A51ERNpW8f
+            i+GfvYdZhgjBh187hCvPdkW6Bl5tk3Rf9fOTKIQe3mrrqYzzzESQy43UskFod0I4
+            IOobruNzm6nxmdzA9tFITYFljtWSAH3HQMokY+UufsRuJWgc6r+osPWVGZTGrMF8
+            HYly3lYNZ5alwevk5R/jQ1cTQFrRbJr3+iRR6FNVf/clnLLnRzsjAbxlQobFW7tb
+            YxyQYMh7f8jXvl/T+HYM6yM8G4qtFYmaRVhnssHFvyOcBxNTc1rOvr4xrLLX+QG7
+            YYZiS+JYh3/Jf4SGahc4UW9Qq19spBSXz9nAy+WJ+wFv1UUQwBTDxne2dO8DMCQv
+            J5BI0tGc7LiavFJPnUkFtFMvl/+Q56QE6lALc8M0HmEOX4m2y/8HJdptyXO/DasZ
+            y23JHAOxFRgOWbiVEsNjtT2n2wCP3gkZrqYP2XKMTdLXSfvlRbKs/oUlzgMFUBXS
+            WAHCyiUKfKq3CkTknBAORgZDMqbX2L6uFLkDKdoD7XREzJruYxUOfmuzvgUI2/iR
+            RXdxeKrJhCRYTrKwyTO00eT0W+IK08E0clZM0SrMjsbggoYtOcAElyE=
+            =brjr
+            -----END PGP MESSAGE-----
+          fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4
+    unencrypted_suffix: _unencrypted
+    version: 3.13.3
@@ -146,10 +146,15 @@ in

      wordpress = {
        type = "microvm";
-        network = createMaloNet "21" "52:DA:0D:F9:EF:F6";
+        network = createMaloNet "21" "52:DA:0D:F9:EF:F7";
      };

-      # last host id: 21
+      portal = {
+        type = "microvm";
+        network = createMaloNet "22" "52:DA:0D:F9:EF:F8";
+      };
+
+      # last host id: 22
    };
  };
 }
@@ -21,6 +21,11 @@ in
      default = false;
      description = "enable backup user, ";
    };
+    hostKeyLocation = lib.mkOption {
+      type = lib.types.path;
+      default = "/etc/ssh/${hostName}";
+      description = "path to the hostkey used for sops. Defaults to '/etc/ssh/${hostName}'. Change to '/etc/ssh/ssh_host_ed25519_key' for migrating other machines.";
+    };
  };
  config = lib.mkMerge [
    (lib.mkIf cfg.malobeo {
@@ -81,13 +86,14 @@ in
    })
    {
      users.mutableUsers = false;
+
      services.openssh.hostKeys = [
        {
-          path = "/etc/ssh/${hostName}";
+          path = cfg.hostKeyLocation;
          type = "ssh-ed25519"; 
        }
      ];
-      sops.age.sshKeyPaths = [ "/etc/ssh/${hostName}" ];
+      sops.age.sshKeyPaths = [ cfg.hostKeyLocation ];
      environment.systemPackages = with pkgs; [
        nix-output-monitor
        vim
@@ -6,6 +6,7 @@ let
  hosts = import ../hosts.nix {};
 in
 {
+  microvm.vcpu = 2;
  sops.defaultSopsFile = ./secrets.yaml;
  sops.secrets = {
    nextcloudAdminPass = {
@@ -39,7 +40,7 @@ in

  services.nextcloud = {
    enable = true;
-    package = pkgs.nextcloud33;
+    package = pkgs.nextcloud35;
    hostName = "cloud.malobeo.org";
    config.adminpassFile = config.sops.secrets.nextcloudAdminPass.path;
    maxUploadSize = "10G";
@@ -49,16 +50,10 @@ in
    configureRedis = true;
    caching = {
      redis = true;
-      apcu = true;
    };
    extraAppsEnable = true;
    extraApps = {
-      inherit (config.services.nextcloud.package.packages.apps) contacts calendar polls registration collectives forms;
-      deck = pkgs.fetchNextcloudApp {
-        sha256 = "sha256-Oc/J0Ey7f9aHhLBWoAXaDMe2t0eeEQKvpwY510qNpiI=";
-        url = "https://s3.g.megas4.com/ya5mczgkbk6bw7tcy2yr4bl2vdryfe76ok2dj/malo/deck33.tar.gz";
-        license = "agpl3Plus";
-      };
+      inherit (config.services.nextcloud.package.packages.apps) contacts calendar polls registration collectives forms deck;
    };
    settings = {
      trusted_domains = [ "cloud.malobeo.org" "cloud.hq.malobeo.org" ];
@@ -68,7 +63,6 @@ in
      "default_phone_region" = "DE";
    };
    phpOptions = {
-      "realpath_cache_size" = "0";
      "opcache.interned_strings_buffer" = "32";
    };
  };
@@ -1,12 +1,7 @@
-nextcloudAdminPass: ENC[AES256_GCM,data:es9hhtCcqBqPbV2L,iv:Kyq5kqao0uaMPs0GeRkJT9OWYSZfImBXngg51k0uQ0M=,tag:zN/u90/j4rmdo0HtY+cF9w==,type:str]
+nextcloudAdminPass: ENC[AES256_GCM,data:RsP8Q1FqS9qgYTNe+H/nDHwQwr0fvlQawCOJWZVoF2U=,iv:AqJ79m3GAUd6sczDByJlb+K3XxxEt3HS4fURd7kn0bY=,tag:n/GyRKrIwOcksDtewnnXZw==,type:str]
 sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
    age:
-        - recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
-          enc: |
+        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPT3ZxNEpRVktDWG9BR0Rv
            ZUZQTkJwQ0pSblNvTkFOT3BBdjVaSzJhVzBvCnVWc2xRUjBnRFFXSDgxczRMSFMy
@@ -14,8 +9,8 @@ sops:
            aDd0UlpMR3RNd3BDMmhqNmxhTFRoUlkK6Pni+cswKIU94WkP/fg5fzSmx/fhXjjl
            mRG2o4ALCqcOxAxHBrKJppUCLjUgKG53wPF/jlIzkvbwHwnqVMfYsQ==
            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1g084sl230x94mkd2wq92s03mw0e8mnpjdjfx9uzaxw6psm8neyzqqwpnqe
-          enc: |
+          recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
+        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRK2o2K2tPTFcvbXRkZ0lq
            bS9ZOUc3dG1JeERZYVNsc3k3RjcxQ0RsdkRJCkx1VFhBQXRDOElqakJ0eTd3NEJX
@@ -23,8 +18,9 @@ sops:
            VjBFeldXS1p0Zk1uSk02aHpJd3BPOHcKvCmnK/KttB4RgnID/fj2KOdjvNnV3EWU
            B9mW4yxbEqhoxtu+GFD3eR/8SvMPEsHl9xorT/ZygMG7hAzedSukWw==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-11-26T20:00:50Z"
-    mac: ENC[AES256_GCM,data:qoY9SfpoU+8HfvD5v/1S6BOkbnZUmHIbtwr0tTSuPETjnFNgr1VVw9mnRatJKPYYFb9/rMZQWIqTY+iUIEkcTVyVXhd6ki5CHW+uxCeBIyMzq33rtEa/btkEUoii4iPieamBCIY21W0znE+edxfR04yRJtLxMICEbuW4Hjf6bwk=,iv:nG42fRgjpuIjPMYnn/6egEdzYolcUBsspaZ8zMv4888=,tag:C6apGoAvVLsWdLWSCwrx6w==,type:str]
+          recipient: age1g084sl230x94mkd2wq92s03mw0e8mnpjdjfx9uzaxw6psm8neyzqqwpnqe
+    lastmodified: "2026-10-22T19:07:13Z"
+    mac: ENC[AES256_GCM,data:HD1uqrxxfLrHGQfu7HFpuunpj/npPe35AvvFrhGFRUTtXLGRPDn5xeOiuHyT+qSs51lukE+hYhv/+u4xolb0SInOJtPTZ6suRcZ4maJ+9P0mgjs7OmI4e68CpGo0xuOg378WvlF15VQH2KCcVskEkO9UBTfOUmyNku1g4F6PeWw=,iv:cJaz6dYkspBlBY9aCaK2/zBDiVg7J7nCE+fnwNHz1Tw=,tag:5sKITZ8uD7JnRtwhaOPoGw==,type:str]
    pgp:
        - created_at: "2025-03-05T08:24:30Z"
          enc: |-
@@ -65,4 +61,4 @@ sops:
            -----END PGP MESSAGE-----
          fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4
    unencrypted_suffix: _unencrypted
-    version: 3.8.1
+    version: 3.13.3
@@ -264,6 +264,18 @@ in
          targets = [ "${hosts.malobeo.hosts.albert.network.address}:9002" ];
        }];
      }
+      {
+        job_name = "wordpress";
+        static_configs = [{
+          targets = [ "${hosts.malobeo.hosts.wordpress.network.address}:9002" ];
+        }];
+      }
+      {
+        job_name = "portal";
+        static_configs = [{
+          targets = [ "${hosts.malobeo.hosts.zineshop.network.address}:9002" ];
+        }];
+      }
      # add vpn - check how to reach it first. most probably 10.100.0.1
    ];
  };
@@ -0,0 +1,42 @@
+{ self, config, lib, pkgs, inputs, ... }:
+
+with lib;
+
+let
+  hosts = import ../hosts.nix {};
+in
+{
+  networking = {
+    hostName = mkDefault "portal";
+    useDHCP = false;
+  };
+
+  imports = [
+    inputs.malobeo.nixosModules.malobeo.metrics
+    inputs.portal.nixosModules.portal
+    inputs.self.nixosModules.malobeo.users
+    ../modules/sshd.nix
+  ];
+
+  malobeo.metrics = {
+    enable = true;
+    enablePromtail = true;
+    logNginx = true;
+  };
+
+  malobeo.users = {
+    admin = true;
+  };
+
+  services.portal = {
+    enable = true;
+    #TODO: we should use FQDN like gatekeeper.hq.malobeo.org
+    gatekeeperHost = "${hosts.malobeo.hosts.goldman.network.address}:8000";
+    gatekeeperScheme = "http";
+  };
+
+  networking.firewall.allowedTCPPorts = [ 8080 ];
+
+  system.stateVersion = "22.11"; # Did you read the comment?
+}
+
@@ -23,10 +23,17 @@ in {
  };

  imports = [
+    inputs.malobeo.nixosModules.malobeo.metrics
    inputs.self.nixosModules.malobeo.users
    ../modules/sshd.nix
  ];

+  malobeo.metrics = {
+    enable = true;
+    enablePromtail = true;
+    logNginx = true;
+  };
+
  malobeo.users = {
    malobeo = false;
    admin = true;
Author	SHA1	Message	Date
malobot	43b708e21d	Update flake.lock Hydra callback / on_pr (pull_request) In progress Details Hydra callback / on_push (pull_request) Skipped Details	2026-11-15 04:02:06 +00:00
kalipso	7d238e48a6	[goldman] fix secrets Check flake syntax / flake-check (push) Successful in 10m1s Details	2026-11-10 17:15:37 +01:00
ahtlon	0323bf8ef4	update gatekeeper Hydra callback / on_pr (push) Skipped Details Hydra callback / on_push (push) Skipped Details Check flake syntax / flake-check (push) Successful in 21m7s Details	2026-11-10 16:39:11 +01:00
kalipso	ee5dba6dea	[portal] update Hydra callback / on_pr (push) Skipped Details Hydra callback / on_push (push) Skipped Details Check flake syntax / flake-check (push) Failing after 6m22s Details	2026-11-10 16:36:14 +01:00
ahtlon	db7affb02d	Merge pull request 'add goldman secrets with encryption' (#212 ) from goldman_secrets into master Hydra callback / on_push (push) Skipped Details Hydra callback / on_pr (push) Skipped Details Check flake syntax / flake-check (push) Successful in 10m45s Details Reviewed-on: #212 Reviewed-by: kalipso <kalipso@c3d2.de>	2026-11-10 16:35:25 +01:00
ahtlon	5474555fe2	[goldman] Switch secrets Hydra callback / on_push (pull_request) Skipped Details Hydra callback / on_pr (pull_request) Successful in 5m0s Details Check flake syntax / flake-check (push) Failing after 4m34s Details	2026-11-10 15:45:11 +01:00
ahtlon	c060796659	add goldman secrets with encryption Check flake syntax / flake-check (push) Successful in 6m33s Details Hydra callback / on_push (pull_request) Skipped Details Hydra callback / on_pr (pull_request) Failing after 6m24s Details	2026-11-08 01:05:55 +01:00
ahtlon	ef5f811bc7	update gatekeeper+portal Hydra callback / on_pr (push) Skipped Details Hydra callback / on_push (push) Skipped Details Check flake syntax / flake-check (push) Successful in 8m57s Details	2026-11-07 14:28:31 +01:00
ahtlon	b570bddbc5	Merge pull request 'add portal' (#210 ) from portal into master Hydra callback / on_pr (push) Skipped Details Hydra callback / on_push (push) Skipped Details Check flake syntax / flake-check (push) Successful in 10m2s Details Reviewed-on: #210	2026-11-07 14:21:43 +01:00
kalipso	66328a5fbf	[portal] disable printing	2026-11-07 14:21:43 +01:00
kalipso	2f964aeeae	[portal] disable backup user	2026-11-07 14:21:43 +01:00
kalipso	3e6c40f0dc	[portal] update	2026-11-07 14:21:43 +01:00
kalipso	6917bc359b	[portal] update	2026-11-07 14:21:43 +01:00
kalipso	b5d0ef7099	[portal] update	2026-11-07 14:21:43 +01:00
kalipso	7c395a72e0	[portal] use gatekeeper api port 8000	2026-11-07 14:21:43 +01:00
kalipso	5be3d3ba62	[goldman] open port 8000	2026-11-07 14:21:43 +01:00
kalipso	c4b38ecc7a	[portal] update	2026-11-07 14:21:43 +01:00
kalipso	d273204b7d	[portal] import missing hosts	2026-11-07 14:21:43 +01:00
kalipso	dd776cfede	[portal] update	2026-11-07 14:21:43 +01:00
kalipso	586dbc711a	[portal] update lock	2026-11-07 14:21:43 +01:00
kalipso	95f7e039ac	[portal] init	2026-11-07 14:21:43 +01:00
ahtlon	7800ea61f3	[goldman] add autoupdate Hydra callback / on_push (push) Skipped Details Hydra callback / on_pr (push) Skipped Details Check flake syntax / flake-check (push) Successful in 15m27s Details	2026-11-06 20:36:56 +01:00
ahtlon	0862da3576	Merge pull request '[nextcloud] upgrade to hub 26 summer/v35' (#206 ) from nextcloud_35 into master Hydra callback / on_pr (push) Skipped Details Hydra callback / on_push (push) Skipped Details Check flake syntax / flake-check (push) Successful in 11m38s Details Reviewed-on: #206 Reviewed-by: kalipso <kalipso@c3d2.de>	2026-10-27 17:24:36 +01:00
ahtlon	9c884e553c	[nextcloud] increase cpu count for nextcloud microvm Hydra callback / on_push (pull_request) Skipped Details Hydra callback / on_pr (pull_request) Successful in 2m9s Details Check flake syntax / flake-check (push) Successful in 12m14s Details	2026-10-26 10:49:59 +01:00
ahtlon	fcb9642023	[nextcloud] upgrade to hub 26 summer/v35 Hydra callback / on_push (pull_request) Skipped Details Hydra callback / on_pr (pull_request) Successful in 7m14s Details Check flake syntax / flake-check (push) Successful in 17m41s Details	2026-10-25 00:55:25 +02:00
ahtlon	ce09e8003e	Merge pull request 'Upgrade nextcloud to v34' (#205 ) from nextcloud_upgrade_34 into master Hydra callback / on_pr (push) Skipped Details Hydra callback / on_push (push) Skipped Details Check flake syntax / flake-check (push) Successful in 24m58s Details Reviewed-on: #205	2026-10-23 00:21:38 +02:00
ahtlon	cbcf5a0c5b	[nextcloud] use default deck app Hydra callback / on_pr (pull_request) Successful in 6m15s Details Hydra callback / on_push (pull_request) Skipped Details Check flake syntax / flake-check (push) Successful in 20m51s Details With thanks to https://github.com/nextcloud/deck/pull/7765	2026-10-22 21:14:34 +02:00
ahtlon	52b43a9b2b	[Nextcloud] upgrade to 34	2026-10-22 21:14:34 +02:00
ahtlon	5c373880fd	[Nextcloud] Update admin pass	2026-10-22 21:14:34 +02:00
kalipso	f7533dff9d	Merge pull request 'Fix PHP critical RCE' (#204 ) from php_fix into master Hydra callback / on_pr (push) Skipped Details Hydra callback / on_push (push) Skipped Details Check flake syntax / flake-check (push) Successful in 26m29s Details	2026-10-22 12:07:32 +02:00
kalipso	88f7da1700	[nixpkgs] update Check flake syntax / flake-check (push) Successful in 5m9s Details Hydra callback / on_push (pull_request) Skipped Details Hydra callback / on_pr (pull_request) Successful in 1h16m46s Details	2026-10-22 10:42:04 +02:00
kalipso	70f0812a8e	Merge pull request 'wordpress: enable metrics' (#203 ) from wordpress_metrics into master Hydra callback / on_pr (push) Skipped Details Hydra callback / on_push (push) Skipped Details Check flake syntax / flake-check (push) Successful in 5m29s Details	2026-10-21 17:32:43 +02:00
kalipso	277caf6375	[wordpress] enable metrics Hydra callback / on_push (pull_request) Skipped Details Hydra callback / on_pr (pull_request) Successful in 2m28s Details Check flake syntax / flake-check (push) Successful in 22m19s Details	2026-10-21 12:29:50 +02:00
kalipso	e059576114	[zineshop] update Hydra callback / on_pr (push) Skipped Details Hydra callback / on_push (push) Skipped Details Check flake syntax / flake-check (push) Successful in 10m29s Details	2026-10-20 11:32:51 +02:00
kalipso	b6d7030967	[zineshop] increase local upload limit to 500mb Hydra callback / on_pr (push) Skipped Details Hydra callback / on_push (push) Skipped Details Check flake syntax / flake-check (push) Successful in 13m21s Details	2026-10-20 11:27:52 +02:00