add goldman secrets with encryption

Reviewed-on: #210

doc/src/module/disks.md

@@ -1,5 +1,5 @@
 # Disks
-The disks module can be used by importing `inputs.malobeo.nixosModules.malobeo.disko`
+The disks module can be used by importing `inputs.self.nixosModules.malobeo.disko`
 
 
 #### `let cfg = malobeo.disks`

doc/src/module/gitea-translator.md

@@ -1,5 +1,5 @@
 # Gitea-tanslator
-The module can be used by importing `inputs.malobeo.nixosModules.malobeo.gitea-translator`
+The module can be used by importing `inputs.self.nixosModules.malobeo.gitea-translator`
 
 This module starts a python server that fetches the gitea pull request api and translates it to a file that hydra understands.   
 To use, just set the parameters of the gitea server, then send a GET request to either `http://${host}:${port}/` or `http://${host}:${port}/gitea-pulls-sorted.json`

doc/src/module/initssh.md

@@ -1,5 +1,5 @@
 # Initrd-ssh
-The initssh module can be used by importing `inputs.malobeo.nixosModules.malobeo.initssh`
+The initssh module can be used by importing `inputs.self.nixosModules.malobeo.initssh`
 
 #### `let cfg = malobeo.initssh`
 
@@ -26,4 +26,4 @@ Run ` lspci -k | grep -iA4 ethernet `
 ` [ ] `
 
 *Example:*
-`[ "r8169" ]`
+`[ "r8169" ]`

flake.lock

@@ -78,6 +78,29 @@
         "type": "github"
       }
     },
+    "gatekeeper": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs-unstable"
+        ],
+        "pyproject-build-systems": "pyproject-build-systems",
+        "pyproject-nix": "pyproject-nix",
+        "uv2nix": "uv2nix"
+      },
+      "locked": {
+        "lastModified": 1793952308,
+        "narHash": "sha256-4NNLnvolKzJ7aNOzf85q6x5RtLWwhcLcsFssdGiBcHA=",
+        "ref": "refs/heads/master",
+        "rev": "8ca4da2e1a9f56babd14a862a2ac770d81de046a",
+        "revCount": 145,
+        "type": "git",
+        "url": "https://git.dynamicdiscord.de/malobeo/gatekeeper"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://git.dynamicdiscord.de/malobeo/gatekeeper"
+      }
+    },
     "home-manager": {
       "inputs": {
         "nixpkgs": [
@@ -241,11 +264,11 @@
     },
     "nixpkgs_3": {
       "locked": {
-        "lastModified": 1788187754,
-        "narHash": "sha256-bu1QxmXKmPuvBLN7bHP355OV9Qo13x9WCiRDH62CqRM=",
+        "lastModified": 1792615934,
+        "narHash": "sha256-MlvRfa1O5Cqc2/a+gG+l9TSuowEoCKCmrJ1d9oAVm0I=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "5dfba6236110080a54247d6460bc2ff5dda939cc",
+        "rev": "da6dc0e7b26060f2f71ce3ef7088fb56ee44fa36",
         "type": "github"
       },
       "original": {
@@ -255,11 +278,83 @@
         "type": "github"
       }
     },
+    "portal": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "utils": "utils_3"
+      },
+      "locked": {
+        "lastModified": 1793962157,
+        "narHash": "sha256-syLIoDUWY5g2ubyNZNqgR+R6R5wLgSD8/XWnIazjhYc=",
+        "ref": "refs/heads/master",
+        "rev": "5a5b043354b88f024b53fce39b60a563fd895063",
+        "revCount": 33,
+        "type": "git",
+        "url": "https://git.dynamicdiscord.de/malobeo/portal"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://git.dynamicdiscord.de/malobeo/portal"
+      }
+    },
+    "pyproject-build-systems": {
+      "inputs": {
+        "nixpkgs": [
+          "gatekeeper",
+          "nixpkgs"
+        ],
+        "pyproject-nix": [
+          "gatekeeper",
+          "pyproject-nix"
+        ],
+        "uv2nix": [
+          "gatekeeper",
+          "uv2nix"
+        ]
+      },
+      "locked": {
+        "lastModified": 1776659114,
+        "narHash": "sha256-qapCOQmR++yZSY43dzrp3wCrkOTLpod+ONtJWBk6iKU=",
+        "owner": "pyproject-nix",
+        "repo": "build-system-pkgs",
+        "rev": "ffaa2161dd5d63e0e94591f86b54fc239660fb2e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "pyproject-nix",
+        "repo": "build-system-pkgs",
+        "type": "github"
+      }
+    },
+    "pyproject-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "gatekeeper",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1778901413,
+        "narHash": "sha256-GSKXTAnFqRAMlZkJrIPcQMYf+lpMr66K3i60mB9STvc=",
+        "owner": "pyproject-nix",
+        "repo": "pyproject.nix",
+        "rev": "a228447c3e179d477c1b6246ef3efa8cfe3c469a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "pyproject-nix",
+        "repo": "pyproject.nix",
+        "type": "github"
+      }
+    },
     "root": {
       "inputs": {
         "disko": "disko",
         "dns": "dns",
         "ep3-bs": "ep3-bs",
+        "gatekeeper": "gatekeeper",
         "home-manager": "home-manager",
         "mfsync": "mfsync",
         "microvm": "microvm",
@@ -267,9 +362,10 @@
         "nixos-hardware": "nixos-hardware",
         "nixpkgs": "nixpkgs_3",
         "nixpkgs-unstable": "nixpkgs-unstable",
+        "portal": "portal",
         "sops-nix": "sops-nix",
         "tasklist": "tasklist",
-        "utils": "utils_3",
+        "utils": "utils_4",
         "zineshop": "zineshop"
       }
     },
@@ -369,6 +465,21 @@
         "type": "github"
       }
     },
+    "systems_5": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
     "tasklist": {
       "inputs": {
         "nixpkgs": [
@@ -430,11 +541,11 @@
         "systems": "systems_3"
       },
       "locked": {
-        "lastModified": 1731533236,
-        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "lastModified": 1791914995,
+        "narHash": "sha256-Zf/xfQEAasnwnmEfHqW/4hjDE/s44yn2hD4RuVIZRjA=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "rev": "b7a79d3fea1e214f6d668d521cecec0c01e26544",
         "type": "github"
       },
       "original": {
@@ -461,19 +572,62 @@
         "type": "github"
       }
     },
+    "utils_5": {
+      "inputs": {
+        "systems": "systems_5"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "uv2nix": {
+      "inputs": {
+        "nixpkgs": [
+          "gatekeeper",
+          "nixpkgs"
+        ],
+        "pyproject-nix": [
+          "gatekeeper",
+          "pyproject-nix"
+        ]
+      },
+      "locked": {
+        "lastModified": 1779269674,
+        "narHash": "sha256-P1LHCRdYpdtHAEzuEsNHrI6d9mVPl5a2fyFDZGHNVbI=",
+        "owner": "pyproject-nix",
+        "repo": "uv2nix",
+        "rev": "69aec536f6d1acc415ed2e20299312802aba98c6",
+        "type": "github"
+      },
+      "original": {
+        "owner": "pyproject-nix",
+        "repo": "uv2nix",
+        "type": "github"
+      }
+    },
     "zineshop": {
       "inputs": {
         "nixpkgs": [
           "nixpkgs"
         ],
-        "utils": "utils_4"
+        "utils": "utils_5"
       },
       "locked": {
-        "lastModified": 1789131197,
-        "narHash": "sha256-gpjhy2mIBt89oCVzoSXy8AgfAKjJ9Fi3u01CX09UTF4=",
+        "lastModified": 1792488750,
+        "narHash": "sha256-VLBpNctawQ+Yd03hkfhNPUqQVXNCc7bc6Qhu7mwJvKM=",
         "ref": "refs/heads/master",
-        "rev": "38bcceb0e8b84d6dcd50d05683c71eea8d410479",
-        "revCount": 161,
+        "rev": "7a8b9d4f3522c68cd15b21a1ec093c8c441775bf",
+        "revCount": 162,
         "type": "git",
         "url": "https://git.dynamicdiscord.de/kalipso/zineshop"
       },

flake.nix

@@ -32,11 +32,21 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
+    portal = {
+      url = "git+https://git.dynamicdiscord.de/malobeo/portal";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
     ep3-bs = {
       url = "git+https://git.dynamicdiscord.de/kalipso/ep3-bs.nix";
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
+    gatekeeper = {
+      url = "git+https://git.dynamicdiscord.de/malobeo/gatekeeper";
+      inputs.nixpkgs.follows = "nixpkgs-unstable";
+    };
+
     nixos-generators = {
       url = "github:nix-community/nixos-generators";
       inputs.nixpkgs.follows = "nixpkgs";

machines/.sops.yaml

@@ -18,6 +18,7 @@ keys:
   - &machine_pretalx age1y04q8n7mgk82c87rfddm0u72h0ny6sfzktjsk0cc3gu93kezudfqdp9v9g
   - &machine_albert age1mfarz0n7qfa7vg8zz355qf8eregm6myl38lld0h767nuvhgjqd4qruxuhn
   - &machine_ns1 age1mam7y7x4my6g8yt8leze3pvlq0fr48hdsqz62gs7l9rstf9hh3fs03xf7n
+  - &machine_goldman age10gk6kydhljjk99vmaj6z0sz5d9x7pwp458gpr3hzqpl5hh04z5xqgley7j
   #this dummy key is used for testing.
   - &machine_dummy age18jn5mrfs4gqrnv0e2sxsgh3kq4sgxx39hwr8z7mz9kt7wlgaasjqlr88ng
 creation_rules:
@@ -132,6 +133,14 @@ creation_rules:
       age:
       - *machine_ns1
       - *admin_atlan
+  - path_regex: goldman/gatekeeper.env$
+    key_groups:
+    - pgp:
+      - *admin_kalipso
+      - *admin_kalipso_dsktp
+      age:
+      - *machine_goldman
+      - *admin_atlan
   - path_regex: .*/secrets/.*
     key_groups:
     - pgp:

machines/albert/configuration.nix

@@ -15,18 +15,17 @@ in
   sops.secrets.wg_private = {};
 
   imports =
-    [
-      inputs.malobeo.nixosModules.malobeo.vpn
-      inputs.malobeo.nixosModules.malobeo.initssh
-      inputs.malobeo.nixosModules.malobeo.disko
-      inputs.malobeo.nixosModules.malobeo.metrics
-      inputs.malobeo.nixosModules.malobeo.users
-      inputs.malobeo.nixosModules.malobeo.backup
-
+    [ # Include the results of the hardware scan.
       #./hardware-configuration.nix
       ../modules/sshd.nix
       ../modules/minimal_tools.nix
       ../modules/autoupdate.nix
+      inputs.self.nixosModules.malobeo.vpn
+      inputs.self.nixosModules.malobeo.initssh
+      inputs.self.nixosModules.malobeo.disko
+      inputs.self.nixosModules.malobeo.metrics
+      inputs.self.nixosModules.malobeo.users
+      inputs.self.nixosModules.malobeo.backup
       ./hydra.nix
       ./gitea_runner.nix
     ];
@@ -87,6 +86,11 @@ in
     };
   };
 
+  systemd.network.networks."05-unmanaged-docker" = {
+    matchConfig = { Name = "veth*"; Kind = "veth"; };
+    linkConfig = { Unmanaged = true; };
+  };
+
   nixpkgs.config.allowUnfree = true; 
   boot.binfmt.emulatedSystems = [ "aarch64-linux" "i686-linux" ];
   services.acpid.enable = true;

machines/albert/hydra.nix

@@ -15,11 +15,12 @@
 
   imports =
     [
-      inputs.malobeo.nixosModules.malobeo.gitea-translator
+      inputs.self.nixosModules.malobeo.gitea-translator
     ];
 
   services.malobeo.gitea-translator = {
     enable = true;
+    host = "0.0.0.0";
   };
 
   services.hydra = {

machines/antamap/configuration.nix

@@ -1,4 +1,4 @@
-{ config, lib, pkgs, inputs, ... }:
+{ self, config, lib, pkgs, inputs, ... }:
 
 with lib;
 
@@ -22,8 +22,7 @@ in
   };
 
   imports = [
-    inputs.malobeo.nixosModules.malobeo.users
-
+    self.nixosModules.malobeo.users
     ../modules/sshd.nix
   ];
 

machines/bakunin/configuration.nix

@@ -6,14 +6,13 @@ in
 {
   imports =
     [ # Include the results of the hardware scan.
-      inputs.malobeo.nixosModules.malobeo.disko
-      inputs.malobeo.nixosModules.malobeo.initssh
-      inputs.malobeo.nixosModules.malobeo.users
-
       #./hardware-configuration.nix
       ../modules/xserver.nix
       ../modules/sshd.nix
       ../modules/autoupdate.nix
+      inputs.self.nixosModules.malobeo.disko
+      inputs.self.nixosModules.malobeo.initssh
+      inputs.self.nixosModules.malobeo.users
     ];
 
   malobeo.autoUpdate = {

machines/durruti/configuration.nix

@@ -1,4 +1,4 @@
-{ config, lib, pkgs, inputs, ... }:
+{ config, self, lib, pkgs, inputs, ... }:
 
 with lib;
 
@@ -17,19 +17,14 @@ with lib;
   ];
 
   imports = [
-    inputs.malobeo.nixosModules.malobeo.metrics
-    inputs.malobeo.nixosModules.malobeo.users
+    self.nixosModules.malobeo.metrics
     inputs.tasklist.nixosModules.malobeo-tasklist
 
+    ../modules/malobeo_user.nix
     ../modules/sshd.nix
     ../modules/minimal_tools.nix
   ];
 
-  malobeo.users = {
-    admin = true;
-    malobeo = false;
-  };
-
   malobeo.metrics = {
     enable = true;
     enablePromtail = true;

machines/fanny/configuration.nix

@@ -11,19 +11,18 @@ in
   sops.secrets.njala_api_key = {};
 
   imports =
-    [ 
-      inputs.malobeo.nixosModules.malobeo.vpn
-      inputs.malobeo.nixosModules.malobeo.initssh
-      inputs.malobeo.nixosModules.malobeo.disko
-      inputs.malobeo.nixosModules.malobeo.microvm
-      inputs.malobeo.nixosModules.malobeo.metrics
-      inputs.malobeo.nixosModules.malobeo.users
-      inputs.malobeo.nixosModules.malobeo.backup
-
+    [ # Include the results of the hardware scan.
       #./hardware-configuration.nix
       ../modules/sshd.nix
       ../modules/minimal_tools.nix
       ../modules/autoupdate.nix
+      inputs.self.nixosModules.malobeo.vpn
+      inputs.self.nixosModules.malobeo.initssh
+      inputs.self.nixosModules.malobeo.disko
+      inputs.self.nixosModules.malobeo.microvm
+      inputs.self.nixosModules.malobeo.metrics
+      inputs.self.nixosModules.malobeo.users
+      inputs.self.nixosModules.malobeo.backup
       ./dyndns.nix
     ];
 
@@ -150,6 +149,7 @@ in
     "antamap" 
     "ns1"
     "wordpress"
+    "portal"
   ];
 
   networking = {
@@ -185,6 +185,22 @@ in
       };
     };
 
+    virtualHosts."portal.hq.malobeo.org" = {
+      forceSSL = true;
+      enableACME = true;
+      acmeRoot = null;
+      locations."/" = {
+        proxyPass = "http://${hosts.malobeo.hosts.portal.network.address}:8080";
+        extraConfig = ''
+          proxy_set_header Host $host;
+          client_max_body_size ${inputs.self.nixosConfigurations.nextcloud.config.services.nextcloud.maxUploadSize};
+          client_body_timeout 3600s;
+          send_timeout 3600s;
+          fastcgi_buffers 64 4K;
+        '';
+      };
+    };
+
     virtualHosts."cloud.hq.malobeo.org" = {
       forceSSL = true;
       enableACME = true;
@@ -193,7 +209,7 @@ in
         proxyPass = "http://${hosts.malobeo.hosts.nextcloud.network.address}";
         extraConfig = ''
           proxy_set_header Host $host;
-          client_max_body_size ${inputs.malobeo.nixosConfigurations.nextcloud.config.services.nextcloud.maxUploadSize};
+          client_max_body_size ${inputs.self.nixosConfigurations.nextcloud.config.services.nextcloud.maxUploadSize};
           client_body_timeout 3600s;
           send_timeout 3600s;
           fastcgi_buffers 64 4K;
@@ -208,7 +224,7 @@ in
         proxyPass = "http://${hosts.malobeo.hosts.nextcloud.network.address}";
         extraConfig = ''
           proxy_set_header Host $host;
-          client_max_body_size ${inputs.malobeo.nixosConfigurations.nextcloud.config.services.nextcloud.maxUploadSize};
+          client_max_body_size ${inputs.self.nixosConfigurations.nextcloud.config.services.nextcloud.maxUploadSize};
           client_body_timeout 3600s;
           send_timeout 3600s;
           fastcgi_buffers 64 4K;
@@ -264,7 +280,7 @@ in
           client_body_in_file_only clean;
           client_body_buffer_size 32K;
           
-          client_max_body_size 50M;
+          client_max_body_size 500M;
           
           sendfile on;
           send_timeout 300s;

machines/fanny/dyndns.nix

@@ -1,17 +1,12 @@
 {pkgs, ...}:
 {
   sops.secrets.njalacloud = {};
-  sops.secrets.njalazines = {};
-  sops.secrets.njalaantamap = {};
+  sops.secrets.njalarm16 = {};
   systemd.services."dyndns" = {
     script = ''
       KEYCLOUD=$(cat /run/secrets/njalacloud)
-      KEYZINES=$(cat /run/secrets/njalazines)
-      KEYANATAMAP=$(cat /run/secrets/njalaantamap)
       KEYRM16=$(cat /run/secrets/njalarm16)
       ${pkgs.curl}/bin/curl --fail --silent --show-error "https://njal.la/update/?h=cloud.malobeo.org&k="$KEYCLOUD"&auto"
-      ${pkgs.curl}/bin/curl --fail --silent --show-error "https://njal.la/update/?h=zines.malobeo.org&k="$KEYZINES"&auto"
-      ${pkgs.curl}/bin/curl --fail --silent --show-error "https://njal.la/update/?h=antamap.malobeo.org&k="$KEYANATAMAP"&auto"
       ${pkgs.curl}/bin/curl --fail --silent --show-error "https://njal.la/update/?h=rm16bleibt.org&k="$KEYRM16"&auto"
     '';
     serviceConfig = {

machines/goldman/configuration.nix

@@ -0,0 +1,105 @@
+{ config, pkgs, inputs, modulesPath, ... }:
+
+let
+  sshKeys = import ../ssh_keys.nix;
+in
+{
+  networking.hostName = "goldman"; # Define your hostname.
+  nixpkgs.hostPlatform = { system = "aarch64-linux"; };
+  
+  imports =
+    [ 
+      inputs.gatekeeper.nixosModules.gatekeeper
+      inputs.self.nixosModules.malobeo.users
+      #inputs.nixos-hardware.nixosModules.raspberry-pi-3
+      (modulesPath + "/profiles/minimal.nix")
+      #(modulesPath + "/installer/sd-card/sd-image.nix")
+      ../modules/autoupdate.nix
+    ];
+
+  malobeo.users = {
+    malobeo = false;
+    admin = true;
+    backup = false;
+    hostKeyLocation = "/etc/ssh/ssh_host_ed25519_key";
+  };
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-label/NIXOS_SD";
+      fsType = "ext4";
+    };
+
+  malobeo.autoUpdate = {
+    enable = true;
+    url = "https://hydra.malobeo.org";
+    project = "malobeo";
+    jobset = "master";
+    cacheurl = "https://cache.malobeo.org";
+  };
+
+  #Try to reduce size
+  documentation.man.enable = false;
+  documentation.nixos.enable = false;
+
+  services.openssh.enable = true;
+  services.openssh.ports = [ 22 ];
+  services.openssh.settings.PasswordAuthentication = false;
+  services.openssh.settings.PermitRootLogin = "prohibit-password";
+  users.users.root.openssh.authorizedKeys.keys = sshKeys.admins;
+
+  # Use the extlinux boot loader. (NixOS wants to enable GRUB by default)
+  boot.loader.grub.enable = false;
+
+  # Enables the generation of /boot/extlinux/extlinux.conf
+  boot.loader.generic-extlinux-compatible.enable = true;
+
+  networking.dhcpcd.enable = true;
+
+  # Set your time zone.
+  time.timeZone = "Europe/Berlin";
+
+  services.mosquitto = {
+    enable = true;
+    listeners = [{
+      acl = [ "pattern readwrite #" ];
+      omitPasswordAuth = true;
+      settings.allow_anonymous = true;
+    }];
+  };
+  sops.secrets.gatekeeperEnv = {
+    sopsFile = ./gatekeeper.env;
+    key = "";
+  };
+  services = {
+    gatekeeper = {
+      enable = true;
+      envFile = config.sops.secrets.gatekeeperEnv.path;
+      mock = "False";
+    };
+  };
+
+  environment.systemPackages = with pkgs; [
+    htop
+    wget
+    git
+    pciutils
+    gpio-utils
+    nix-tree
+    lgpio
+  ];
+
+  services.avahi = {
+    enable = true;
+    nssmdns4 = true;
+    publish = {
+      enable = true;
+      addresses = true;
+      userServices = true;
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = [ 80 443 1883 8000 ];
+
+  system.stateVersion = "23.05";
+}
+

machines/goldman/gatekeeper.env

@@ -0,0 +1,27 @@
+MIFARE_APP_MASTER_KEY=ENC[AES256_GCM,data:I1YgnEjcMOnUtp5W2etsJgYyLr7lonzNg8gsUwZJcslfAw==,iv:oZknXxh5KcVzX6vdtyUH69kKjYAckmHL56QaMF1MOH0=,tag:GfR7AVn6IXCfI3mGBN9Dsw==,type:str]
+MIFARE_ACL_READ_BASE_KEY=ENC[AES256_GCM,data:A5cnHzlEW38YrQpoAL20+YMtx+PbaidM5Q2n9b4fWngQUg==,iv:eNhI23L2GVzpPEa0QyEU97iBQVDuhqsOwWPezzuS8+Y=,tag:9CuZSpqYsV/y0mvaAO3S/w==,type:str]
+MIFARE_ACL_WRITE_BASE_KEY=ENC[AES256_GCM,data:V4q0PuQJxcDXsix6XQsBamq1V/V+K+N4noRGgpJjjTB13g==,iv:4OJN8HzWQtaoJlh01uFmUvgXRwFY0jorkTgZjljJsRc=,tag:1H648/Jy7KANtRNDSkyTSA==,type:str]
+SECRET_KEY=ENC[AES256_GCM,data:K2FYP/4vk9maohnSQF735zGbkeV5HGcCJFSzyrifGPS3YA==,iv:oAxz/gAn76ch/UliCDlXzVNTRzuIDgdhD/k92vXqmok=,tag:NuoXXPdhLpxDuDh78qTF1A==,type:str]
+MQTT_HOST =ENC[AES256_GCM,data:6YTmAljhE9w/pnXo,iv:08FNf3xopciUPLeGMnSIkehaM/Gjfvwi2RHb4t7TzJI=,tag:UYyFxbkugBULoQ6hS1aqWw==,type:str]
+MQTT_PORT =ENC[AES256_GCM,data:sGh+xyaVwQ==,iv:YuY1prObChjS0Urwe6M90hMMeBDkpG8sAou/uP2jXq4=,tag:Sqp92fwgGTRgHe9zk+D6Tw==,type:str]
+DISABLE_CALDAV =ENC[AES256_GCM,data:3iAINTq/Htc=,iv:GWcnwG607jbMxVpl0jKRFBJ+tCRHM9SLUbj7ChVwh1k=,tag:sQUdgiGqlROtSH4/cfvoCg==,type:str]
+DISABLE_CARDS =ENC[AES256_GCM,data:4IFbzoLNdYU=,iv:So2jIQ6bBvKbh9aki0H/yJ4cvdeqYxMj0gtS7C/Snhs=,tag:G21lbZ6DpMwBjIzERXBjZw==,type:str]
+CALDAV_URL =ENC[AES256_GCM,data:hgObeMHReiqCXXQ2N8Y1rLKPydz1bY1ae4YBt1X1BIsnpU0S7EB1XFifhpcx9X12szibtQ59YA==,iv:jxsDZnSX78UF8Hrtjng8/JThg/MweBUYvqdVLptYWXI=,tag:YfFgxQehpYIuZQ7MHq0WkA==,type:str]
+CALDAV_USER =ENC[AES256_GCM,data:+BSTNCi7mULdWhM1oa06,iv:UlpkZTEmvuktC0daH4nBm0kaJiIaWt8DVL+wMLBjuxo=,tag:RfX5dbLBtJ0FfSXVxlW99w==,type:str]
+CALDAV_PASSWORD =ENC[AES256_GCM,data:TXUBlhjge6b3Uu0BH/IJ53zqGAAVF8/XhvXVHuhgmi8=,iv:oSDpRWTP/jP06ZS4diwcUdAAnI+GSIomY+IbIERki4E=,tag:RKNW99kkZd5WmOe2poFM1A==,type:str]
+CALDAV_CALENDARS =ENC[AES256_GCM,data:0T42oZqIDFgUegGBzw==,iv:LFYzH4Ej+Aavugg3lRaR+rP4ZGjDUPyTbxwTc9DChgc=,tag:IPx04P8KFW6vfN6UTKJPIA==,type:str]
+CALDAV_REFRESH_INTERVAL =ENC[AES256_GCM,data:/tHX+A==,iv:I7JNh30TMyT5L8cLPGINTxZVUXzk94nix4tMHfIHKlI=,tag:flZqije+8tsQXL68nEewnQ==,type:str]
+sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxQTNNN0dpbWR2OFJtalIz\nOGFQaHlzRGEyVlZTUUpBRGI0Q3NpbnZVeWlRClYrTlAvZmNMUVg5MnhETlEvTU8x\nSzdlU0syT3FjdmZqOWY5eGprYkxPeHMKLS0tIENNOXZZc2hkTXhyUkgxN3I1TE8y\nU2h5d0ZaWS9QdTVsZGJjVlZuL3kwK28K6ATJuMyMSKAbbz0DVC/Yuz0g7F0DgNd5\nEo1L86EefttFwUuvz+hpNqllU3f6kGa19sFBcQc5cpQF6G6MTCJxOA==\n-----END AGE ENCRYPTED FILE-----\n
+sops_age__list_0__map_recipient=age10gk6kydhljjk99vmaj6z0sz5d9x7pwp458gpr3hzqpl5hh04z5xqgley7j
+sops_age__list_1__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5aGgxWmovR2gzVnZaT1Uw\nd2VtUis1SEM5OXZYVENjWURrNUJscnQ0TUhjCmZ2dURBL2NESUJFd3RYNGdWWmNM\nSmpRdURMK0xJVzFhUkwrMHd3ZDkwbm8KLS0tIDRjemJEN1lJSXBvN2prRVFEQ25N\ncXBqeXF4dzNIak8vTUd1Rmt1ZkhTclEKRSoxGpRmrejYTx/KnbG6IxRSzrRXNyHP\nTQpY5OD6/nmajrxIymvEFdsMMw2DiWevypCAJZQK3/+OqIlgKnfiaQ==\n-----END AGE ENCRYPTED FILE-----\n
+sops_age__list_1__map_recipient=age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
+sops_lastmodified=2026-11-07T23:23:15Z
+sops_mac=ENC[AES256_GCM,data:VT1hKDEC2QUwEz6E+qAbUBVJi0sF6yNBfdkYIccb4+5EYWr1dKIiwOxwkqvvHKi1S5Kw501CH/oB3nswgDV1/fJsXlrgvCrF9AeX8W5IFMyTYe/aEtsWBS2lnyL2do5YFGss9XX0RJOXmqvsyGDRpnMi0wTvths/f7tmVv8m3Es=,iv:UZDX5rF0sl2nGwbR16IQcQJq/W+QYjeTwSE1CkjHHC0=,tag:kJIpwvmYThnjoS09XSEmtQ==,type:str]
+sops_pgp__list_0__map_created_at=2026-11-07T23:23:15Z
+sops_pgp__list_0__map_enc=-----BEGIN PGP MESSAGE-----\n\nhQGMA5HdvEwzh/H7AQv/R4//v0z5OOfd+OB52bTcA8Cl1s5vkPg7Xkjzn4yhc47e\nWdMHW3i2y18I1WJyoNTQGqoZNXAIyvZleq8q8e/iibfr+ZefP/UaCKOPiLJ6fUN+\nD+bqYn3LBR0whzEBI7GWr+/xwyJX6L7qk16NhR2zTFku+PGRaHo2YhfKxqw9GqbL\niNSVs3MGRvinLlLYZbAAKtfQ7IZJ/JIvWLAU4ZGvfNBh8XQ9xirVnl32A5/2dSPV\nOv1gg1gmxGAkOFbShw4k6nmCCM+HB95goHbriWk/3oCsToNuhQyVVGz3m+E4ZXFP\n6GDHh2zuRENe+UZHQStle1fS/4v/mHrkXfH771pDy6DPWGbOz/abmRYD+CtOxhRP\niD0w0jbrvma5+kn53/CN/WTJa3aBzyr1T+5fVamczriC7cnZgR+u1zp2gS+th1WE\nFtsh7WrNkHRYWBXsj1YnH/x62cO9t/29i6i0qXuCILxP/39wdcljyNIUzFBZ04TI\naY3Nc3+uoSp42RTeYfIm0lYBs8uuPhELVlFblaI8dZ4hTDLzr7lRYs07nvOkWvfS\nWnnY23oYRvmj66qujLaxYrvhrOe9l+xe1qGj0Kzolb9xgDsSdb/HjUysLNGU3CuL\nBbquv+RcSA==\n=k+7t\n-----END PGP MESSAGE-----
+sops_pgp__list_0__map_fp=c4639370c41133a738f643a591ddbc4c3387f1fb
+sops_pgp__list_1__map_created_at=2026-11-07T23:23:15Z
+sops_pgp__list_1__map_enc=-----BEGIN PGP MESSAGE-----\n\nhQIMA98TrrsQEbXUAQ/7BPsXeKJ4NwpHMonr0l5nfWrbXwtBCwE6YrMWsYFVnleZ\nxZe/w8vsAfe2fcVyXsmPsHnskh7Mqjnxk+M6oc9OWxCS35NQ2BROxqPDXVqOuTNJ\nQTNuHNMMornysa28TCnO+zr90K7s3WUc0g53VcWxEZndPhiSdA/KftAmJJaFV+kd\nbUQW7Yc0WkO64S2DMpFI9GCfgqNll53nnXt6KgbRrNcE7bD08kOBVCHyZ1hXJKai\nQ0LLQ4+odv1mSn5UP48dOKYZcFlIQ0QCKdCJ96zApaPajOF24f+0Yi4f6wMEVxfs\nAWQbBOFot78zOQJH8mZO0WlOf1Cw6v18tE74dGPPsFInCqMYth9oDJ4lTP+wMyl2\nskXJRuK3wzmmWL8h9qL4yym1vVW9V0NHZLlTip8SKlnujrmE+rjgKAmFvcezygDG\nKIQuOUQsuiWiRE7XCMMQX+2bwjUjerM3yhoLQixX6fDzhWTX5f70nq+OBnLR0SD9\n1uq5Nkb5N01qyhAtYyTcsxJvTy0YJ6NE6CDoGmIOS4hUq1Lf4nMRx7vfemsrvcca\nNj7nkMWcLeOUcBSVBR84nRVlTN96qjAeOycl4TmAw3H9sciBWs6MNdPgD6XR7D0r\nboHxhXApCiPj6YGTdCGEtqs5ha0yFJVljyWR63+EM9iKVV4lMZL4excHSCBlmojS\nVgEufYXXDTuWonGAsLyciMGokCvxCIKuIxC/3FcdHT0Ijg97h1vZ9K3qY8VQ1NeI\n92fAnC7edWJ3W7zbbxZqhXKx6NOF1EideBdy8xOP2nk6RZkS82i0\n=LofN\n-----END PGP MESSAGE-----
+sops_pgp__list_1__map_fp=aef8d6c7e4761fc297cda833df13aebb1011b5d4
+sops_unencrypted_suffix=_unencrypted
+sops_version=3.13.3

machines/hosts.nix

@@ -77,6 +77,17 @@ in
           nameservers = [ "192.168.1.1" "1.1.1.1" ];
         };
       };
+
+      goldman = {
+        type = "rpi";
+        network = {
+          local = true;
+          hostId = "16";
+          address = "192.168.1.106";
+          gateway = "192.168.1.1";
+          nameservers = [ "192.168.1.1" "1.1.1.1" ];
+        };
+      };
   
       durruti = {
         type = "microvm";
@@ -135,10 +146,15 @@ in
 
       wordpress = {
         type = "microvm";
-        network = createMaloNet "21" "52:DA:0D:F9:EF:F6";
+        network = createMaloNet "21" "52:DA:0D:F9:EF:F7";
       };
 
-      # last host id: 21
+      portal = {
+        type = "microvm";
+        network = createMaloNet "22" "52:DA:0D:F9:EF:F8";
+      };
+
+      # last host id: 22
     };
   };
 }

machines/infradocs/configuration.nix

@@ -1,4 +1,4 @@
-{ config, lib, pkgs, inputs, ... }:
+{ self, config, lib, pkgs, inputs, ... }:
 
 with lib;
 
@@ -10,17 +10,11 @@ with lib;
 
   imports = [
     inputs.malobeo.nixosModules.malobeo.metrics
-    inputs.malobeo.nixosModules.malobeo.users
-
     ../durruti/documentation.nix
+    ../modules/malobeo_user.nix
     ../modules/sshd.nix
   ];
 
-  malobeo.users = {
-    admin = true;
-    malobeo = false;
-  };
-
   malobeo.metrics = {
     enable = true;
     enablePromtail = true;

machines/louise/configuration.nix

@@ -3,14 +3,13 @@
 {
   imports =
     [ # Include the results of the hardware scan.
-      inputs.malobeo.nixosModules.malobeo.printing
-
       ./hardware-configuration.nix
       ../modules/xserver.nix
       ../modules/malobeo_user.nix
       ../modules/sshd.nix
       ../modules/minimal_tools.nix
       ../modules/autoupdate.nix
+      inputs.self.nixosModules.malobeo.printing
     ];
 
   malobeo.autoUpdate = {

machines/lucia/configuration.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, inputs, ... }:
+{ config, pkgs, ... }:
 
 let
   sshKeys = import ../ssh_keys.nix;
@@ -6,16 +6,10 @@ in
 {
   imports =
     [ # Include the results of the hardware scan.
-      inputs.malobeo.nixosModules.malobeo.users
-
       ./hardware_configuration.nix
+      ../modules/malobeo_user.nix
     ];
 
-  malobeo.users = {
-    admin = true;
-    malobeo = false;
-  };
-
   sops.defaultSopsFile = ./secrets.yaml;
   sops.secrets.njala_api_key = {};
 

machines/modules/malobeo/users.nix

@@ -1,7 +1,7 @@
 {config, lib, pkgs, inputs, ...}:
 let 
   cfg = config.malobeo.users;
-  sshKeys = import ( inputs.malobeo + /machines/ssh_keys.nix);
+  sshKeys = import ( inputs.self + /machines/ssh_keys.nix);
   inherit (config.networking) hostName; 
 in
 {
@@ -21,6 +21,11 @@ in
       default = false;
       description = "enable backup user, ";
     };
+    hostKeyLocation = lib.mkOption {
+      type = lib.types.path;
+      default = "/etc/ssh/${hostName}";
+      description = "path to the hostkey used for sops. Defaults to '/etc/ssh/${hostName}'. Change to '/etc/ssh/ssh_host_ed25519_key' for migrating other machines.";
+    };
   };
   config = lib.mkMerge [
     (lib.mkIf cfg.malobeo {
@@ -81,13 +86,14 @@ in
     })
     {
       users.mutableUsers = false;
+
       services.openssh.hostKeys = [
         {
-          path = "/etc/ssh/${hostName}";
+          path = cfg.hostKeyLocation;
           type = "ssh-ed25519"; 
         }
       ];
-      sops.age.sshKeyPaths = [ "/etc/ssh/${hostName}" ];
+      sops.age.sshKeyPaths = [ cfg.hostKeyLocation ];
       environment.systemPackages = with pkgs; [
         nix-output-monitor
         vim

machines/nextcloud/configuration.nix

@@ -1,4 +1,4 @@
-{ config, lib, pkgs, inputs, ... }:
+{ config, self, lib, pkgs,  ... }:
 
 with lib;
 
@@ -6,6 +6,7 @@ let
   hosts = import ../hosts.nix {};
 in
 {
+  microvm.vcpu = 2;
   sops.defaultSopsFile = ./secrets.yaml;
   sops.secrets = {
     nextcloudAdminPass = {
@@ -20,19 +21,13 @@ in
   };
 
   imports = [
-    inputs.malobeo.nixosModules.malobeo.metrics
-    inputs.malobeo.nixosModules.malobeo.users
-
+    self.nixosModules.malobeo.metrics
+    ../modules/malobeo_user.nix
     ../modules/sshd.nix
     ../modules/minimal_tools.nix
     ../modules/autoupdate.nix
   ];
 
-  malobeo.users = {
-    admin = true;
-    malobeo = false;
-  };
-
   malobeo.metrics = {
     enable = true;
     enablePromtail = true;
@@ -45,7 +40,7 @@ in
 
   services.nextcloud = {
     enable = true;
-    package = pkgs.nextcloud33;
+    package = pkgs.nextcloud35;
     hostName = "cloud.malobeo.org";
     config.adminpassFile = config.sops.secrets.nextcloudAdminPass.path;
     maxUploadSize = "10G";
@@ -55,16 +50,10 @@ in
     configureRedis = true;
     caching = {
       redis = true;
-      apcu = true;
     };
     extraAppsEnable = true;
     extraApps = {
-      inherit (config.services.nextcloud.package.packages.apps) contacts calendar polls registration collectives forms;
-      deck = pkgs.fetchNextcloudApp {
-        sha256 = "sha256-Oc/J0Ey7f9aHhLBWoAXaDMe2t0eeEQKvpwY510qNpiI=";
-        url = "https://s3.g.megas4.com/ya5mczgkbk6bw7tcy2yr4bl2vdryfe76ok2dj/malo/deck33.tar.gz";
-        license = "agpl3Plus";
-      };
+      inherit (config.services.nextcloud.package.packages.apps) contacts calendar polls registration collectives forms deck;
     };
     settings = {
       trusted_domains = [ "cloud.malobeo.org" "cloud.hq.malobeo.org" ];
@@ -74,7 +63,6 @@ in
       "default_phone_region" = "DE";
     };
     phpOptions = {
-      "realpath_cache_size" = "0";
       "opcache.interned_strings_buffer" = "32";
     };
   };

machines/nextcloud/secrets.yaml

@@ -1,12 +1,7 @@
-nextcloudAdminPass: ENC[AES256_GCM,data:es9hhtCcqBqPbV2L,iv:Kyq5kqao0uaMPs0GeRkJT9OWYSZfImBXngg51k0uQ0M=,tag:zN/u90/j4rmdo0HtY+cF9w==,type:str]
+nextcloudAdminPass: ENC[AES256_GCM,data:RsP8Q1FqS9qgYTNe+H/nDHwQwr0fvlQawCOJWZVoF2U=,iv:AqJ79m3GAUd6sczDByJlb+K3XxxEt3HS4fURd7kn0bY=,tag:n/GyRKrIwOcksDtewnnXZw==,type:str]
 sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
     age:
-        - recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
-          enc: |
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPT3ZxNEpRVktDWG9BR0Rv
             ZUZQTkJwQ0pSblNvTkFOT3BBdjVaSzJhVzBvCnVWc2xRUjBnRFFXSDgxczRMSFMy
@@ -14,8 +9,8 @@ sops:
             aDd0UlpMR3RNd3BDMmhqNmxhTFRoUlkK6Pni+cswKIU94WkP/fg5fzSmx/fhXjjl
             mRG2o4ALCqcOxAxHBrKJppUCLjUgKG53wPF/jlIzkvbwHwnqVMfYsQ==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age1g084sl230x94mkd2wq92s03mw0e8mnpjdjfx9uzaxw6psm8neyzqqwpnqe
-          enc: |
+          recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRK2o2K2tPTFcvbXRkZ0lq
             bS9ZOUc3dG1JeERZYVNsc3k3RjcxQ0RsdkRJCkx1VFhBQXRDOElqakJ0eTd3NEJX
@@ -23,8 +18,9 @@ sops:
             VjBFeldXS1p0Zk1uSk02aHpJd3BPOHcKvCmnK/KttB4RgnID/fj2KOdjvNnV3EWU
             B9mW4yxbEqhoxtu+GFD3eR/8SvMPEsHl9xorT/ZygMG7hAzedSukWw==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-11-26T20:00:50Z"
-    mac: ENC[AES256_GCM,data:qoY9SfpoU+8HfvD5v/1S6BOkbnZUmHIbtwr0tTSuPETjnFNgr1VVw9mnRatJKPYYFb9/rMZQWIqTY+iUIEkcTVyVXhd6ki5CHW+uxCeBIyMzq33rtEa/btkEUoii4iPieamBCIY21W0znE+edxfR04yRJtLxMICEbuW4Hjf6bwk=,iv:nG42fRgjpuIjPMYnn/6egEdzYolcUBsspaZ8zMv4888=,tag:C6apGoAvVLsWdLWSCwrx6w==,type:str]
+          recipient: age1g084sl230x94mkd2wq92s03mw0e8mnpjdjfx9uzaxw6psm8neyzqqwpnqe
+    lastmodified: "2026-10-22T19:07:13Z"
+    mac: ENC[AES256_GCM,data:HD1uqrxxfLrHGQfu7HFpuunpj/npPe35AvvFrhGFRUTtXLGRPDn5xeOiuHyT+qSs51lukE+hYhv/+u4xolb0SInOJtPTZ6suRcZ4maJ+9P0mgjs7OmI4e68CpGo0xuOg378WvlF15VQH2KCcVskEkO9UBTfOUmyNku1g4F6PeWw=,iv:cJaz6dYkspBlBY9aCaK2/zBDiVg7J7nCE+fnwNHz1Tw=,tag:5sKITZ8uD7JnRtwhaOPoGw==,type:str]
     pgp:
         - created_at: "2025-03-05T08:24:30Z"
           enc: |-
@@ -65,4 +61,4 @@ sops:
             -----END PGP MESSAGE-----
           fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4
     unencrypted_suffix: _unencrypted
-    version: 3.8.1
+    version: 3.13.3

machines/ns1/configuration.nix

@@ -1,4 +1,4 @@
-{ config, lib, inputs, pkgs,  ... }:
+{ config, self, lib, inputs, pkgs,  ... }:
 
 with lib;
 with inputs;
@@ -13,19 +13,13 @@ in
   };
 
   imports = [
-    inputs.malobeo.nixosModules.malobeo.users
-    inputs.malobeo.nixosModules.malobeo.vpn
-
+    ../modules/malobeo_user.nix
     ../modules/sshd.nix
     ../modules/minimal_tools.nix
     ../modules/autoupdate.nix
+    inputs.self.nixosModules.malobeo.vpn
   ];
 
-  malobeo.users = {
-    admin = true;
-    malobeo = false;
-  };
-
   networking.firewall = {
     enable = true;
     allowedTCPPorts = [ 53 ];

machines/overwatch/configuration.nix

@@ -1,4 +1,4 @@
-{ config, lib, pkgs, inputs, ... }:
+{ config, self, lib, pkgs, inputs, ... }:
 
 with lib;
 
@@ -30,18 +30,12 @@ in
   };
 
   imports = [
-    inputs.malobeo.nixosModules.malobeo.metrics
-    inputs.malobeo.nixosModules.malobeo.users
-
+    self.nixosModules.malobeo.metrics
+    ../modules/malobeo_user.nix
     ../modules/sshd.nix
     ./printer_module.nix
   ];
 
-  malobeo.users = {
-    admin = true;
-    malobeo = false;
-  };
-
   networking.firewall.allowedTCPPorts = [ 80 3100 ];
 
   malobeo.metrics = {
@@ -151,6 +145,7 @@ in
             "https://keys.malobeo.org"
             "https://tasklist.malobeo.org"
             "https://zines.malobeo.org"
+            "http://${hosts.malobeo.hosts.albert.network.address}:27364/health"
            ];
         }];
 
@@ -269,6 +264,18 @@ in
           targets = [ "${hosts.malobeo.hosts.albert.network.address}:9002" ];
         }];
       }
+      {
+        job_name = "wordpress";
+        static_configs = [{
+          targets = [ "${hosts.malobeo.hosts.wordpress.network.address}:9002" ];
+        }];
+      }
+      {
+        job_name = "portal";
+        static_configs = [{
+          targets = [ "${hosts.malobeo.hosts.zineshop.network.address}:9002" ];
+        }];
+      }
       # add vpn - check how to reach it first. most probably 10.100.0.1
     ];
   };

machines/portal/configuration.nix

@@ -0,0 +1,42 @@
+{ self, config, lib, pkgs, inputs, ... }:
+
+with lib;
+
+let
+  hosts = import ../hosts.nix {};
+in
+{
+  networking = {
+    hostName = mkDefault "portal";
+    useDHCP = false;
+  };
+
+  imports = [
+    inputs.malobeo.nixosModules.malobeo.metrics
+    inputs.portal.nixosModules.portal
+    inputs.self.nixosModules.malobeo.users
+    ../modules/sshd.nix
+  ];
+
+  malobeo.metrics = {
+    enable = true;
+    enablePromtail = true;
+    logNginx = true;
+  };
+
+  malobeo.users = {
+    admin = true;
+  };
+
+  services.portal = {
+    enable = true;
+    #TODO: we should use FQDN like gatekeeper.hq.malobeo.org
+    gatekeeperHost = "${hosts.malobeo.hosts.goldman.network.address}:8000";
+    gatekeeperScheme = "http";
+  };
+
+  networking.firewall.allowedTCPPorts = [ 8080 ];
+
+  system.stateVersion = "22.11"; # Did you read the comment?
+}
+

machines/pretalx/configuration.nix

@@ -1,4 +1,4 @@
-{ config, lib, pkgs, inputs,  ... }:
+{ config, self, lib, pkgs, inputs,  ... }:
 
 with lib;
 
@@ -21,10 +21,9 @@ in
 
   disabledModules = [ "services/web-apps/pretalx.nix" ];
   imports = [
-    inputs.malobeo.nixosModules.malobeo.metrics
-    inputs.malobeo.nixosModules.malobeo.users
-
     "${inputs.nixpkgs-unstable}/nixos/modules/services/web-apps/pretalx.nix"
+    self.nixosModules.malobeo.metrics
+    self.nixosModules.malobeo.users
     ../modules/sshd.nix
     ../modules/minimal_tools.nix
     ../modules/autoupdate.nix
@@ -38,7 +37,6 @@ in
 
   malobeo.users = {
     admin = true;
-    malobeo = false;
   };
 
 

machines/testvm/configuration.nix

@@ -6,18 +6,13 @@ in
   imports =
     [ # Include the results of the hardware scan.
       #./hardware-configuration.nix
-      inputs.malobeo.nixosModules.malobeo.users
-      inputs.malobeo.nixosModules.malobeo.initssh
-      inputs.malobeo.nixosModules.malobeo.disko
-
+      ../modules/malobeo_user.nix
       ../modules/sshd.nix
       ../modules/minimal_tools.nix
+      inputs.self.nixosModules.malobeo.initssh
+      inputs.self.nixosModules.malobeo.disko
     ];
 
-  malobeo.users = {
-    admin = true;
-    malobeo = false;
-  };
 
   boot.initrd.systemd.enable = true;
   boot.loader.systemd-boot.enable = true;

machines/uptimekuma/configuration.nix

@@ -9,16 +9,10 @@ with lib;
   };
 
   imports = [
-    inputs.malobeo.nixosModules.malobeo.users
-
+    ../modules/malobeo_user.nix
     ../modules/sshd.nix
   ];
 
-  malobeo.users = {
-    admin = true;
-    malobeo = false;
-  };
-
   networking.firewall.allowedTCPPorts = [ 80 ];
 
   services.nginx = {

machines/vaultwarden/configuration.nix

@@ -16,17 +16,11 @@ with lib;
   };
 
   imports = [
-    inputs.malobeo.nixosModules.malobeo.users
-    inputs.malobeo.nixosModules.malobeo.metrics
-
+    ../modules/malobeo_user.nix
     ../modules/sshd.nix
+    inputs.self.nixosModules.malobeo.metrics
   ];
 
-  malobeo.users = {
-    admin = true;
-    malobeo = false;
-  };
-
   networking.firewall.allowedTCPPorts = [ 80 ];
 
   malobeo.metrics = {

machines/vpn/configuration.nix

@@ -17,18 +17,12 @@ with lib;
   };
 
   imports = [
-    inputs.malobeo.nixosModules.malobeo.vpn
-    inputs.malobeo.nixosModules.malobeo.users
-
+    inputs.self.nixosModules.malobeo.vpn
+    ../modules/malobeo_user.nix
     ../modules/sshd.nix
     ../modules/minimal_tools.nix
   ];
 
-  malobeo.users = {
-    admin = true;
-    malobeo = false;
-  };
-
   services.malobeo.vpn = {
     enable = true;
     name = "vpn";

machines/wordpress/configuration.nix

@@ -23,11 +23,17 @@ in {
   };
 
   imports = [
-    inputs.malobeo.nixosModules.malobeo.users
-
+    inputs.malobeo.nixosModules.malobeo.metrics
+    inputs.self.nixosModules.malobeo.users
     ../modules/sshd.nix
   ];
 
+  malobeo.metrics = {
+    enable = true;
+    enablePromtail = true;
+    logNginx = true;
+  };
+
   malobeo.users = {
     malobeo = false;
     admin = true;

machines/zineshop/configuration.nix

@@ -1,4 +1,4 @@
-{ config, lib, pkgs, inputs, ... }:
+{ self, config, lib, pkgs, inputs, ... }:
 
 with lib;
 
@@ -11,17 +11,11 @@ with lib;
   imports = [
     inputs.malobeo.nixosModules.malobeo.metrics
     inputs.malobeo.nixosModules.malobeo.printing
-    inputs.malobeo.nixosModules.malobeo.users
     inputs.zineshop.nixosModules.zineshop
-
+    ../modules/malobeo_user.nix
     ../modules/sshd.nix
   ];
 
-  malobeo.users = {
-    admin = true;
-    malobeo = false;
-  };
-
   malobeo.metrics = {
     enable = true;
     enablePromtail = true;

scripts/gitea_hydra_server.py

@@ -26,7 +26,7 @@ def _parse_response(baseurl, owner, repo):
     return pulls
 
 class PullsHandler(BaseHTTPRequestHandler):
-    _VALID_PATHS={"/", "/gitea-pulls-sorted.json"}
+    _VALID_PATHS={"/", "/gitea-pulls-sorted.json", "/health"}
 
     # Class variables to store configuration
     baseurl = None
@@ -34,6 +34,15 @@ class PullsHandler(BaseHTTPRequestHandler):
     repo = None
 
     def do_GET(self):
+        if self.path == "/health":
+            body=json.dumps({"status": "ok"}).encode("utf-8")
+            self.send_response(200)
+            self.send_header("Content-Type", "application/json; charset=utf-8")
+            self.send_header("Content-Length", str(len(body)))
+            self.end_headers()
+            self.wfile.write(body)
+            return
+
         if self.path not in self._VALID_PATHS:
             self.send_error(404, "Not Found")
             return