Update flake.lock

2026-03-05 00:03:33 +00:00
18 changed files with 12 additions and 614 deletions
--- a/.hydra/declarative-jobsets.nix
+++ b/.hydra/declarative-jobsets.nix
@@ -1,75 +0,0 @@
 { nixpkgs, pulls, ... }:
 let
  pkgs = import nixpkgs { };
  prs = builtins.fromJSON (builtins.readFile pulls);
  prJobsets = pkgs.lib.mapAttrs (num: info: {
    enabled = 1;
    hidden = false;
    description = "PR ${num}: ${info.title}";
    checkinterval = 300;
    schedulingshares = 20;
    enableemail = false;
    emailoverride = "";
    keepnr = 1;
    type = 1;
    flake = "${info.head.repo.html_url}/archive/${info.head.ref}.tar.gz";
    inputs = {
      gitea_repo_name = {
        type = "string";
        value = "${info.head.repo.name}";
        emailresponsible = false;
      };
      gitea_repo_owner = {
        type = "string";
        value = "${info.head.repo.owner.username}";
        emailresponsible = false;
      };
      gitea_http_url = {
        type = "string";
        value = "https://git.dynamicdiscord.de";
        emailresponsible = false;
      };
      gitea_status_repo = {
        type = "string";
        value = "${info.head.ref}";
        emailresponsible = false;
      };
    };
  }) prs;
  mkFlakeJobset = branch: {
    description = "Build ${branch} branch of the Malobeo Infrastructure repo";
    checkinterval = 300;
    enabled = "1";
    schedulingshares = 100;
    enableemail = false;
    emailoverride = "";
    keepnr = 3;
    hidden = false;
    type = 1;
    flake = "https://git.dynamicdiscord.de/malobeo/infrastructure/archive/${branch}.tar.gz";
  };
  desc = prJobsets // {
    "master" = mkFlakeJobset "master";
  };
  log = {
    pulls = prs;
    jobsets = desc;
  };
 in
 {
  jobsets = pkgs.runCommand "spec-jobsets.json" { } ''
    cat >$out <<'EOF'
    ${builtins.toJSON desc}
    EOF
    # This is to get nice .jobsets build logs on Hydra
    cat >tmp <<'EOF'
    ${builtins.toJSON log}
    EOF
    ${pkgs.jq}/bin/jq . tmp
  '';
 }
--- a/.hydra/spec.json
+++ b/.hydra/spec.json
@@ -1,30 +0,0 @@
 {
  "enabled": 1,
  "hidden": false,
  "description": "Malobeo infrastructure repo",
  "nixexprinput": "nixexpr",
  "nixexprpath": ".hydra/declarative-jobsets.nix",
  "checkinterval": 60,
  "schedulingshares": 100,
  "enableemail": false,
  "emailoverride": "",
  "keepnr": 5,
  "type": 0,
  "inputs": {
    "nixexpr": {
      "value": "https://git.dynamicdiscord.de/malobeo/infrastructure master",
      "type": "git",
      "emailresponsible": false
    },
    "nixpkgs": {
      "value": "https://github.com/NixOS/nixpkgs nixos-25.11",
      "type": "git",
      "emailresponsible": false
    },
    "pulls": {
      "type": "path",
      "value": "http://127.0.0.1:27364/gitea-pulls-sorted.json",
      "emailresponsible": false
    }
  }
 }
--- a/doc/src/SUMMARY.md
+++ b/doc/src/SUMMARY.md
@@ -12,7 +12,6 @@
            - [musik](./projekte/musik.md)
        - [TODO](./todo.md)
        - [Modules]()
            - [Gitea-translator](./module/gitea-translator.md)
            - [Initrd-ssh](./module/initssh.md)
            - [Disks](./module/disks.md)
    - [How-to]()
--- a/doc/src/module/gitea-translator.md
+++ b/doc/src/module/gitea-translator.md
@@ -1,21 +0,0 @@
 # Gitea-tanslator
 The module can be used by importing `inputs.self.nixosModules.malobeo.gitea-translator`
 This module starts a python server that fetches the gitea pull request api and translates it to a file that hydra understands.   
 To use, just set the parameters of the gitea server, then send a GET request to either `http://${host}:${port}/` or `http://${host}:${port}/gitea-pulls-sorted.json`
 ## Module config
 ##### enable (default = false) - enables the module  
 ##### baseurl (default = "git.dynamicdiscord.de") - Base URL of the Gitea instance   
 ##### owner (default = "malobeo") - Repository owner   
 ##### repo (default = "infrastructure") - Repository name   
 ##### host (default = "127.0.0.1") - Address the server binds to   
 ##### port (default = 27364) - Port the server listens on   
 ## Hydra config
 If you change the default port or host, the file `.hydra/spec.json` has to be modified accordingly.
 With the module running on the hydra host, create a new hydra project, then:
    - Set `Declarative spec file` to `.hydra/spec.json`
    - Change declaritive input type to `Git checkout`
    - Set your git repo location in the field below that
--- a/flake.lock
+++ b/flake.lock
@@ -126,11 +126,11 @@
        "spectrum": "spectrum"
      },
      "locked": {
-        "lastModified": 1772055583,
+        "lastModified": 1772338235,
-        "narHash": "sha256-iPIm1orqkhsxqju6EVODOrV1BmyA5HNTZ8a1o812bFM=",
+        "narHash": "sha256-9XcwtSIL/c+pkC3SBNuxCJuSktFOBV1TLvvkhekyB8I=",
        "owner": "astro",
        "repo": "microvm.nix",
-        "rev": "f6dcfb7c16cc3775536c825dc0698d4ede13d063",
+        "rev": "9d1ff9b53532908a5eba7707931c9093508b6b92",
        "type": "github"
      },
      "original": {
@@ -209,11 +209,11 @@
    },
    "nixpkgs-unstable": {
      "locked": {
-        "lastModified": 1771848320,
+        "lastModified": 1772542754,
-        "narHash": "sha256-0MAd+0mun3K/Ns8JATeHT1sX28faLII5hVLq0L3BdZU=",
+        "narHash": "sha256-WGV2hy+VIeQsYXpsLjdr4GvHv5eECMISX1zKLTedhdg=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "2fc6539b481e1d2569f25f8799236694180c0993",
+        "rev": "8c809a146a140c5c8806f13399592dbcb1bb5dc4",
        "type": "github"
      },
      "original": {
@@ -225,11 +225,11 @@
    },
    "nixpkgs_2": {
      "locked": {
-        "lastModified": 1771903837,
+        "lastModified": 1772598333,
-        "narHash": "sha256-sdaqdnsQCv3iifzxwB22tUwN/fSHoN7j2myFW5EIkGk=",
+        "narHash": "sha256-YaHht/C35INEX3DeJQNWjNaTcPjYmBwwjFJ2jdtr+5U=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "e764fc9a405871f1f6ca3d1394fb422e0a0c3951",
+        "rev": "fabb8c9deee281e50b1065002c9828f2cf7b2239",
        "type": "github"
      },
      "original": {
@@ -264,11 +264,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1772048434,
+        "lastModified": 1772495394,
-        "narHash": "sha256-/wA0OaH6kZ/pFA+nXR/tvg5oupOmEDmMS5us79JT60o=",
+        "narHash": "sha256-hmIvE/slLKEFKNEJz27IZ8BKlAaZDcjIHmkZ7GCEjfw=",
        "owner": "Mic92",
        "repo": "sops-nix",
-        "rev": "334daa7c273dd8bf7a0cd370e4e16022b64e55e9",
+        "rev": "1d9b98a29a45abe9c4d3174bd36de9f28755e3ff",
        "type": "github"
      },
      "original": {
--- a/machines/.sops.yaml
+++ b/machines/.sops.yaml
@@ -15,7 +15,6 @@ keys:
  - &machine_fanny age136sz3lzhxf74ryruvq34d4tmmxnezkqkgu6zqa3dm582c22fgejqagrqxk
  - &machine_nextcloud age1g084sl230x94mkd2wq92s03mw0e8mnpjdjfx9uzaxw6psm8neyzqqwpnqe
  - &machine_vaultwarden age1zs9puemeevc5kt84w9d2mc5396w0t9p60qxymkpatwvwxunzs5usmxr3an
  - &machine_pretalx age1y04q8n7mgk82c87rfddm0u72h0ny6sfzktjsk0cc3gu93kezudfqdp9v9g
  #this dummy key is used for testing.
  - &machine_dummy age18jn5mrfs4gqrnv0e2sxsgh3kq4sgxx39hwr8z7mz9kt7wlgaasjqlr88ng
 creation_rules:
@@ -106,14 +105,6 @@ creation_rules:
      age:
      - *admin_atlan
      - *machine_vaultwarden
  - path_regex: pretalx/secrets.yaml$
    key_groups:
    - pgp:
      - *admin_kalipso
      - *admin_kalipso_dsktp
      age:
      - *admin_atlan
      - *machine_pretalx
  - path_regex: .*/secrets/.*
    key_groups:
    - pgp:
--- a/machines/durruti/host_config.nix
+++ b/machines/durruti/host_config.nix
@@ -63,16 +63,6 @@ in
      };
    };
    services.nginx.virtualHosts."events.malobeo.org" = {
      forceSSL = true;
      enableACME= true;
      locations."/" = {
        proxyPass = "http://10.0.0.10";
        extraConfig = ''
        '';
      };
    };
    services.nginx.virtualHosts."tasklist.malobeo.org" = {
      forceSSL = true;
      enableACME= true;
--- a/machines/fanny/configuration.nix
+++ b/machines/fanny/configuration.nix
@@ -145,7 +145,6 @@ in
    "durruti" 
    "zineshop"
    "vaultwarden"
    "pretalx"
  ];
  networking = {
@@ -230,15 +229,6 @@ in
      };
    };
    virtualHosts."events.malobeo.org" = {
      locations."/" = {
        proxyPass = "http://${hosts.malobeo.hosts.pretalx.network.address}";
        extraConfig = ''
          proxy_set_header Host $host;
        '';
      };
    };
    virtualHosts."tasklist.malobeo.org" = {
      locations."/" = {
        proxyPass = "http://${hosts.malobeo.hosts.durruti.network.address}:8080";
--- a/machines/hosts.nix
+++ b/machines/hosts.nix
@@ -103,11 +103,6 @@ in
        type = "microvm";
        network = createMaloNet "17" "52:DA:0D:F9:EF:F3";
      };
      pretalx = {
        type = "microvm";
        network = createMaloNet "18" "52:DA:0D:F9:EF:F4";
      };
    };
  };
 }
--- a/machines/modules/malobeo/gitea_translator.nix
+++ b/machines/modules/malobeo/gitea_translator.nix
@@ -1,78 +0,0 @@
 { config, self, lib, inputs, pkgs, ... }:
 with lib;
 let
  cfg = config.services.malobeo.gitea-translator;
 in
 {
  options = {
    services.malobeo.gitea-translator = {
      enable = mkOption {
        default = false;
        type = types.bool;
        description = lib.mdDoc "Start a webserver for hydra to use the gitea pull request api.";
      };
      baseurl = mkOption {
        type = types.str;
        default = "git.dynamicdiscord.de";
        description = lib.mdDoc "Base URL of the Gitea instance.";
      };
      owner = mkOption {
        type = types.str;
        default = "malobeo";
        description = lib.mdDoc "Repository owner on the Gitea instance.";
      };
      repo = mkOption {
        type = types.str;
        default = "infrastructure";
        description = lib.mdDoc "Repository name on the Gitea instance.";
      };
      host = mkOption {
        type = types.str;
        default = "127.0.0.1";
        description = lib.mdDoc "Address the server binds to.";
      };
      port = mkOption {
        type = types.port;
        default = 27364;
        description = lib.mdDoc "Port the server listens on.";
      };
    };
  };
  config = mkIf cfg.enable {
    systemd.services.gitea-translator = {
      description = "Gitea Pull Request Translator for Hydra";
      after = [ "network-online.target" ];
      wants = [ "network-online.target" ];
      wantedBy = [ "multi-user.target" ];
      serviceConfig = {
        ExecStart = ''
          ${pkgs.python3}/bin/python3 ${../../../scripts/gitea_hydra_server.py} \
            --baseurl ${cfg.baseurl} \
            --owner ${cfg.owner} \
            --repo ${cfg.repo} \
            --host ${cfg.host} \
            --port ${toString cfg.port}
        '';
        Restart = "on-failure";
        RestartSec = 5;
        # Hardening because why not 
        DynamicUser = true;
        NoNewPrivileges = true;
        ProtectSystem = "strict";
        ProtectHome = true;
        PrivateTmp = true;
        PrivateDevices = true;
      };
    };
  };
 }
--- a/machines/overwatch/configuration.nix
+++ b/machines/overwatch/configuration.nix
@@ -144,18 +144,6 @@ in
          targets = [ "${hosts.malobeo.hosts.zineshop.network.address}:9002" ];
        }];
      }
      {
        job_name = "vaultwarden";
        static_configs = [{
          targets = [ "${hosts.malobeo.hosts.vaultwarden.network.address}:9002" ];
        }];
      }
      {
        job_name = "pretalx";
        static_configs = [{
          targets = [ "${hosts.malobeo.hosts.pretalx.network.address}:9002" ];
        }];
      }
      {
        job_name = "fanny";
        static_configs = [{
--- a/machines/pretalx/configuration.nix
+++ b/machines/pretalx/configuration.nix
@@ -1,99 +0,0 @@
 { config, self, lib, pkgs,  ... }:
 with lib;
 let
  hosts = import ../hosts.nix {};
 in
 {
  sops.defaultSopsFile = ./secrets.yaml;
  sops.secrets = {
    pretalx_smtp = {
      owner = "pretalx";
      group = "pretalx";
    };
  };
  networking = {
    hostName = mkDefault "pretalx";
    useDHCP = false;
  };
  imports = [
    self.nixosModules.malobeo.metrics
    self.nixosModules.malobeo.users
    ../modules/sshd.nix
    ../modules/minimal_tools.nix
    ../modules/autoupdate.nix
  ];
  malobeo.metrics = {
    enable = true;
    enablePromtail = true;
    logNginx = true;
  };
  malobeo.users = {
    admin = true;
  };
  services.postgresqlBackup = {
    enable = true;
  };
  services.nginx = {
    enable = true;
    commonHttpConfig = /* nginx */ ''
      proxy_headers_hash_bucket_size 64;
    '';
    virtualHosts = {
      "events.malobeo.org" = {
        forceSSL = false;
        enableACME = false;
      };
    };
  };
  services.pretalx = {
    enable = true;
    celery.extraArgs = [
      "--concurrency=${toString config.microvm.vcpu}"
    ];
    gunicorn.extraArgs = [
      # https://docs.pretalx.org/administrator/installation/#step-6-starting-pretalx-as-a-service
      "--log-level=info"
      "--max-requests-jitter=50"
      "--max-requests=1200"
      "--workers=${toString config.microvm.vcpu}"
      # TODO: 25.11 upstream
      "--name=pretalx"
      "--preload"
    ];
    nginx.domain = "events.malobeo.org";
    environmentFiles = [
      config.sops.secrets.pretalx_smtp.path
    ];
    settings = {
      locale = {
        language_code = "de";
      };
      mail = {
        from = "malobot@systemli.org";
        user = "malobot@systemli.org";
        host = "mail.systemli.org";
        port = "465";
        ssl = true;
        tls = false;
      };
    };
  };
  networking.firewall.allowedTCPPorts = [ 80 443 ];
  system.stateVersion = "22.11"; # Did you read the comment?
 }
--- a/machines/pretalx/dummy.yaml
+++ b/machines/pretalx/dummy.yaml
@@ -1,64 +0,0 @@
 pretalx_smtp: ENC[AES256_GCM,data:zYnhuulpJAEEacXxpqNG2GEVrV21H0UZfx3sqZaZxWYL2HW6WwFMZ2PeGL8bWCv92+iZ2DGkhg==,iv:kMJLfeQ+9ZZFc6T+HnS64p9BJUy38nXrakAOXdQ0gIU=,tag:l8/eSrcOtt9MLnqcif5v2A==,type:str]
 sops:
    age:
        - recipient: age18jn5mrfs4gqrnv0e2sxsgh3kq4sgxx39hwr8z7mz9kt7wlgaasjqlr88ng
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNZXExRE14NDF6cnFRSE9G
            RjdxV09UMXUvczBQai9GQW5PT2g0eUZhSUVvClRZL1dJVlpKUTArTkhhR2JCV1VG
            cktFb21wNDZiZC9oc2l5VS9hdzVhbFUKLS0tIGZZa2Z2R0Nvd3RUbWRHMkFJMjVK
            QXdRdkVwSFg2TVRBYU1qWFJ2bE9hWFUK8HuJ9ErFU0yH3QlXl1tnmawNX0fHDOFb
            g+DpDYKccGcC6PxNOE/CsftJqGLtFlToYHOYWG18bFjNZawUoaOfLQ==
            -----END AGE ENCRYPTED FILE-----
        - recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3S0s4UlZuSWc3K3cvTDBR
            WEt2L3hYSGRVWHBYbEtoci9rYkJEK1hYSkRZCkM5S25YNGM2Y3R0MG9lWUNJem9P
            bnJXbTRFZUpUVmhWVVVqeVhjdDV2SWMKLS0tIEdXbXU0RkJ6ZzBTcTdiZlJPbG83
            RW8zUzBkNjViYnVFY3MyM1ZENmZXVmcK4144dF921EuNaofNhaYw9Yh56KHdfQD/
            vxPkp5jC02Wbb6hjImd+oMUg3jgCbWC4j3Qpvaky8Ig2AaJRhtqlxg==
            -----END AGE ENCRYPTED FILE-----
    lastmodified: "2026-03-09T11:58:41Z"
    mac: ENC[AES256_GCM,data:n11H0rFtXvCeleTKXnQ8tORm3YH11tvjRd/PYSRof8EIUpQ7ZtyVqdYqPZCUuck12LG8hh9+GBBpXIRDhwEJlteC61Vl0syW9bQvCbfETvIgRZsoIZr+mofYHe1twm73sd7YaGzC6xxVm5HZG/qS1LflHah6jFO6NkgQ0GpLPTE=,iv:np3bKJIbVwn96rMBeedLmw6f1him35waUWN6LJ5MLNk=,tag:fs8rmrSkK1REaUKJHxeSbw==,type:str]
    pgp:
        - created_at: "2026-03-09T11:58:34Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----
            hQGMA5HdvEwzh/H7AQv/VMIZlsBZPEolTd0yUfHyZ5PRsQDirt4hOuVFGXdKi8tb
            Pk+L3y69ynfF+ZJsu41+GdVgaNX58bbdqJfnEgE+k35IrJxYmVlNuUmd5s79rOHQ
            b1dn6SdoVrKTAgtrnicO0n0F41XZBSpqP4wKVHigsWgfHkaUUsI+5d/T/2F+VCcS
            slhvveCMKNjDlK9sukp5TBiX+xrWTq4QIbMS7L6VSlwHod72bp73o7RV9PgoO4vy
            aodYiPmJqDjF0Az7JXdu2UdWJGUYxNWb5jHCT3qpcZyX1kVSmZvcRjxtVVCySFx+
            agcavtdlEV3t8JOOvVmYoxwNOGjDvJ83k6wdueFpoJFE4Z1pHy/XCVCHykmWH/+m
            nYADzmg+GiOSrTR2xWEmkesrByOMucYiZngDV3RLuZraE+8PJbqX2aAAip1Ol6AX
            eYGCtLw/cXvDM1ngdj/4vaelek/TMLRRmuDyzVHevnqMGhdgAp4Ns6+ihZajSYkK
            4YqUSKOMHrfEwbZgGYGW0lgB4cv1uzPgyufcPWzg8oAS0/2jW6KjZPLIx4SYcp41
            C3BE/osbnyzGhzmabNstFbVmBYF1iK73O/Np2PGj3glBsE7PNMmcDu4ASaEI1nNw
            CpOmQCR9jRGi
            =6itD
            -----END PGP MESSAGE-----
          fp: c4639370c41133a738f643a591ddbc4c3387f1fb
        - created_at: "2026-03-09T11:58:34Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----
            hQIMA98TrrsQEbXUAQ//aQNOD855rikMtrXENG/XA5dZeKGaLQAv0kWUHuJbRddn
            IB9pW+Y8AgyB6xc9A4oKOKgjT8TCSYvGI6zDchf5tjrvQwmiMlpQouflcjR+UgDy
            mANqL2+7GLFVcTuQfRPbEdK54Q78KciQ2bxMeh0WDZ5vV8fCTz+aPsvlNT8AJBcq
            BO4dyG1oqCT13ln7g7LoHPn22wAj+H93F8aqyFk6YjgomKRf0j9gAW/NI1w8TIsg
            etgMBrn0AupANrADQHAij1zSS+GaK8ZMBVgCoInc9gAQl97ytMLp/eQj4Ll69r+z
            JRhFdFDZgP0UIIFurAU5eFixNq8IZnFYvFRGpR/XzAiOh8JfgWUDs5HSLyRcADi9
            XxLsEnTFm1kfoI+lpma0WtlAIXg2WpCoaU3B2kB15T4giVs6LWGmssux5t8uKTFR
            DySHvdl9o78zBFPVxhW+j9h04fAeUmCWZYKpnEdFwKpBmGWtnC5rvz22Xwu3Q/wT
            HioLzvETqVn+knc/ErR6Axw4A9zeLi1AccJdceVopR7rEq+0DjpLV/zYqwGruQaa
            q1qtQIgPf888TKtNgAGSxQ2nUfkMM2oK2cC6r2juhxwbmTFcz6FUV41To9/hCo1c
            1SE4ZiRu7R8i+KFn4K2y6RGRkJo75trJkxuwGvAYuo6gGUmj50EeimFx0rKRddfS
            WAH8JPQH6ohAqaA1hdrQRM7lPtwjPCfJW/fUqPHAR5Ytwn9xmt0A+jQYvmubH9dR
            UT8OMUOIh2XC2JDYt4P4pFXXODB6WPb3Fdft6S95+vLhx6eHuo7PvVM=
            =KkYj
            -----END PGP MESSAGE-----
          fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4
    unencrypted_suffix: _unencrypted
    version: 3.11.0
--- a/machines/pretalx/secrets.yaml
+++ b/machines/pretalx/secrets.yaml
@@ -1,64 +0,0 @@
 pretalx_smtp: ENC[AES256_GCM,data:Jrgx1/AsgTb1KxtgiTPGRkgtl5EHPWHPde4ItwOHH9lcmakAb1b2n4JP70vF53uuKIfiyCPeVQ==,iv:fcVFgjKSGTaFxC1DAX2Sb6WD/IbJO0s1A63wrQkLWbg=,tag:NjcNwa+6h/boRemEg1j9ng==,type:str]
 sops:
    age:
        - recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxb1dGalUyNzVtYjFFNm9T
            a3ord2NSTEE3UkhrTm1TbHdMV3lITHJRLzJvCnAxeUZib0d0dCtUZ0x3NUtsdzdD
            SjVYY0Y4MXhGRVZGZTRiNHJHSHNkb0kKLS0tIGtCL0puTDRZcUsrc2VRUU1URERs
            Y084Z0tGR3JPZkw5ci9icFVSd051bE0KXaT1mPUBFUorZ/zgYjDyqWGbnHAkcjmZ
            KVZJae9HC35+mq9mme7XOH96NX6tq69Hg+TUFoQg1m2Ifz27GKD3bQ==
            -----END AGE ENCRYPTED FILE-----
        - recipient: age1y04q8n7mgk82c87rfddm0u72h0ny6sfzktjsk0cc3gu93kezudfqdp9v9g
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWVVJyZFZCTVZhUXN0WFJu
            UWU2UWxTY3ErWHVhMGNGU0t3N0c2ekM5a0NvCkVtTDdyeEVMQzY5RUg1NnVZVHd1
            a1U4cytPSjU3K0NaSmJDdk5peHM5emMKLS0tIGhTemxzbjBzNkFILy9QRG53V0lX
            dEZTQVpCOUNDSW0yRS9rYkZkVjZPRG8K/Hea01veMQ0Gxo//24PRhDcncYUuExpQ
            T4ff4CNXF2vDYDsSIPDlhHdmSRGmoCw00ChCZ8vvIlHl2O86Qmd0Ng==
            -----END AGE ENCRYPTED FILE-----
    lastmodified: "2026-03-09T11:58:07Z"
    mac: ENC[AES256_GCM,data:QWFdEg+I1YUH65qPUQvOwwb7i+X+HYKdhYJiLoku+XcvYq4xFaoBvFTW3eZ/S2i20yK1SQcAVjUe7JQEgZDtqzPdZH6w4YIZJVvQdDMPy99xdXXEZrnW+rHOy60XFS7WiyeUdLA3TQ4+Ec1f2kkQw7MhbDbOoOh0obsvfhtz3OE=,iv:h4Qn/LpayhXCWWsO/nm18Rapz6WXQcjItF9YwyiFJJ0=,tag:bxtQQMNgVyFkHp+pbSP3UQ==,type:str]
    pgp:
        - created_at: "2026-03-09T11:57:24Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----
            hQGMA5HdvEwzh/H7AQwAkahLpq8vqQn6N5EyrbC+33Ohl61ZbBPR6NnQaLvU3s+i
            WJ3xe7T+LP0jv2C2t//VhYvVNolQ2LBA+yLE3Cvjw6JCyVhu54ZRDJciY2w/wY5J
            MN++Bqac6avoEYHkvoN6m1/F8JK46fzgQT7xXFTGix+g1W48aSC70GRZUmsg469p
            ZFYbj/mEseG1ICxhZANU2NgRgW7kA/La/fe3/+YE8tkNHSXF2ZevQvluarm7kXT9
            KWani1wMlUMwZoCpwbfNwKpXPL0jW48FJsFIlxPbDrDCkR1gih1PHFVyqd45am9g
            Uo0hJ1NOKzm5Cy5c/3xJzaP62UWyNJf+v5VojEg2XfSGqtaZDFQsLK0of5G/XArn
            C7k7UbQJqz15rHWPznIppv2h+cTIsVDQcz77es1/qaOQyCMHdYqdkzi5YV7DJBZS
            K6PP3Nt77uL4LGRL0vFtBgdhKFtXAAf8lhRfZJcJ2P9BYvaFdRUfjm/r0TNfCref
            k2WCesk4F/pQSyB3ofuR0lYBJzlZ3iNpl7DlfyZ6DRZ/+aVFceRf9A8QKtkVmdMt
            noqBJfLzhWgVmUUh3DO97mJV5pNOx8238vqVTxWrUqZXjXdXaUDaFUDXvgwg3GOA
            N28ZjLy1XA==
            =mIVi
            -----END PGP MESSAGE-----
          fp: c4639370c41133a738f643a591ddbc4c3387f1fb
        - created_at: "2026-03-09T11:57:24Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----
            hQIMA98TrrsQEbXUAQ//cnVHHJEwQn+W8Jkt+jwgnKCgbRutvG3U8hlXizzdk2RI
            j6nVPpv2DwuXvX3ktnng8XrmWwXf9rFRRltVs7alenEnHLxiDd5w+WYeH4NCHOFr
            +vvFwxNOxzLDj5B2Fjod4El70jUdrP6Mqzy37DPu1Gb2qIUEwdF1LEzM4FMWdeWL
            BA0wCJzlTXzdlb0shw7xEsqvmnL11u+aQ8AVU3kgWxSkn0VZJIYYkwegUYfflSIr
            wZsNsh8k+wG58f5IVr8SqnzkfxRfJSoxNKWV9dK3a9hJnnD3DUhqnOgvCnPCRKSP
            drH+7KxqmNBxqQK3f2iJvgcyLQwyEEqF2Rt6gXwyDByHy3ewupAQD0aQwi5HMWcK
            iEUVSQVZ6jRfAIyDs3sBnBHceB9BShFr+NN9eUjKJWm2QD4TdQamnpMLsQGpdZv5
            Lomk9VfdZPNw7DAKJs1oDeBRmhAP/crlOW/ZZho9mewKHr7Htu3VZP812GVupJns
            IK9mMnpwAhgCtChcOj/ule9NcA/AWKcrtdAyId11SvjtMO+ZjRFrOCK1wKgIif3p
            ogjaK38v/7gy4/8CDyVgru+luNklsRHfZr+BuPGBDDL8M7umXilK+GyGO1CnrjxW
            DJXdvMe+u75OsYvGv7eX0tqd+ePanCEoDXxFJbMc2QZigD2kZgq+qRM9CxJ2jCXS
            VgEEHybyGrOo5RcJkpk+UQpb2aTMLgFNqkTn0PRQSMFeXVQIt584a9xZs1TQ7ZsT
            5H4jaFXFcS+GG09CORbkf2fkQI2KpaqBAGFct21K2hY17Tpm7kgC
            =yGms
            -----END PGP MESSAGE-----
          fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4
    unencrypted_suffix: _unencrypted
    version: 3.11.0
--- a/machines/vaultwarden/configuration.nix
+++ b/machines/vaultwarden/configuration.nix
@@ -18,17 +18,10 @@ with lib;
  imports = [
    ../modules/malobeo_user.nix
    ../modules/sshd.nix
    inputs.self.nixosModules.malobeo.metrics
  ];
  networking.firewall.allowedTCPPorts = [ 80 ];
  malobeo.metrics = {
    enable = true;
    enablePromtail = true;
    logNginx = true;
  };
  services.nginx = {
    enable = true;
    virtualHosts."keys.malobeo.org" = {
--- a/machines/vpn/configuration.nix
+++ b/machines/vpn/configuration.nix
@@ -58,15 +58,6 @@ with lib;
      };
    };
    virtualHosts."events.malobeo.org" = {
      locations."/" = {
        proxyPass = "http://10.100.0.101";
        extraConfig = ''
          proxy_set_header Host $host;
        '';
      };
    };
    virtualHosts."tasklist.malobeo.org" = {
      locations."/" = {
        proxyPass = "http://10.100.0.101";
--- a/outputs.nix
+++ b/outputs.nix
@@ -118,7 +118,6 @@ in (utils.lib.eachSystem (builtins.filter filter_system utils.lib.defaultSystems
      users.imports = [ ./machines/modules/malobeo/users.nix ];
      backup.imports = [ ./machines/modules/malobeo/backup.nix ];
      printing.imports = [ ./machines/modules/malobeo/printing.nix ];
      gitea-translator.imports = [ ./machines/modules/malobeo/gitea_translator.nix ];
    };
    hydraJobs = nixpkgs.lib.mapAttrs (_: nixpkgs.lib.hydraJob) (
--- a/scripts/gitea_hydra_server.py
+++ b/scripts/gitea_hydra_server.py
@@ -1,107 +0,0 @@
 #!/usr/bin/env python3
 #imports
 import os
 import json
 import argparse
 from http.server import BaseHTTPRequestHandler, HTTPServer
 import urllib.request
 def _get_api_response(baseurl, owner, repo):
    ###https://docs.gitea.com/api/1.21/#tag/repository/operation/repoListPullRequests
    ###GET /api/v1/repos/{owner}/{repo}/pulls
    url=(f"https://{baseurl}/api/v1/repos/{owner}/{repo}/pulls?state=open")
    headers={"Accept": "application/json"}
    req=urllib.request.Request(url, headers=headers)
    with urllib.request.urlopen(req) as resp:
        return json.loads(resp.read().decode("utf-8"))
 def _parse_response(baseurl, owner, repo):
    target_repo_url=f"https://{baseurl}/{owner}/{repo}.git"
    pulls: dict={}
    response=_get_api_response(baseurl, owner, repo)
    for pr in response:
        pr["target_repo_url"]=target_repo_url
        pulls[str(pr["number"])]=pr
    return pulls
 class PullsHandler(BaseHTTPRequestHandler):
    _VALID_PATHS={"/", "/gitea-pulls-sorted.json"}
    # Class variables to store configuration
    baseurl = None
    owner = None
    repo = None
    def do_GET(self):
        if self.path not in self._VALID_PATHS:
            self.send_error(404, "Not Found")
            return
        answer=dict(_parse_response(self.baseurl, self.owner, self.repo))
        body=json.dumps(answer, indent=2, sort_keys=True).encode("utf-8")
        self.send_response(200)
        self.send_header("Content-Type", "application/json; charset=utf-8")
        self.send_header("Content-Length", str(len(body)))
        self.end_headers()
        self.wfile.write(body)
    def log_message(self, fmt, *args):
        print(
            f"[gitea-translator] {self.address_string()} - {fmt % args}",
            flush=True,
        )
 def main():
    parser = argparse.ArgumentParser(
        description="Hydra Server to Gitea-pull-request translator"
    )
    parser.add_argument(
        "--baseurl",
        default="git.dynamicdiscord.de",
        help="Base URL of Gitea instance (default: git.dynamicdiscord.de)"
    )
    parser.add_argument(
        "--owner",
        default="malobeo",
        help="Repository owner (default: malobeo)"
    )
    parser.add_argument(
        "--repo",
        default="infrastructure",
        help="Repository name (default: infrastructure)"
    )
    parser.add_argument(
        "--host",
        default="127.0.0.1",
        help="Host to bind to (default: 127.0.0.1)"
    )
    parser.add_argument(
        "--port",
        type=int,
        default=27364,
        help="Port to bind to (default: 27364)"
    )
    args = parser.parse_args()
    # Set class variables so they're accessible in request handlers
    PullsHandler.baseurl = args.baseurl
    PullsHandler.owner = args.owner
    PullsHandler.repo = args.repo
    print(
        f"[gitea-translator] Starting, pulling from {args.baseurl}/{args.owner}/{args.repo}",
        flush=True,
    )
    server=HTTPServer((args.host, args.port), PullsHandler)
    print(
        f"[gitea-translator] online @ {args.host}:{args.port}",
        flush=True,
    )
    server.serve_forever()
 if __name__ == "__main__":
    main()