[scripts] init malobeo ssh commands

they are not yet working, its just placeholders

flake.lock

@@ -264,11 +264,11 @@
     },
     "nixpkgs_3": {
       "locked": {
-        "lastModified": 1792615934,
-        "narHash": "sha256-MlvRfa1O5Cqc2/a+gG+l9TSuowEoCKCmrJ1d9oAVm0I=",
+        "lastModified": 1788187754,
+        "narHash": "sha256-bu1QxmXKmPuvBLN7bHP355OV9Qo13x9WCiRDH62CqRM=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "da6dc0e7b26060f2f71ce3ef7088fb56ee44fa36",
+        "rev": "5dfba6236110080a54247d6460bc2ff5dda939cc",
         "type": "github"
       },
       "original": {
@@ -278,27 +278,6 @@
         "type": "github"
       }
     },
-    "portal": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ],
-        "utils": "utils_3"
-      },
-      "locked": {
-        "lastModified": 1793727485,
-        "narHash": "sha256-zpTS/6sgapW7cZqPNqQ4wMHoxXsKZZPby+RpPxZVxAo=",
-        "ref": "refs/heads/master",
-        "rev": "3cc90f3a470e95e3c79edaa1539173ae6d76874c",
-        "revCount": 20,
-        "type": "git",
-        "url": "https://git.dynamicdiscord.de/malobeo/portal"
-      },
-      "original": {
-        "type": "git",
-        "url": "https://git.dynamicdiscord.de/malobeo/portal"
-      }
-    },
     "pyproject-build-systems": {
       "inputs": {
         "nixpkgs": [
@@ -362,10 +341,9 @@
         "nixos-hardware": "nixos-hardware",
         "nixpkgs": "nixpkgs_3",
         "nixpkgs-unstable": "nixpkgs-unstable",
-        "portal": "portal",
         "sops-nix": "sops-nix",
         "tasklist": "tasklist",
-        "utils": "utils_4",
+        "utils": "utils_3",
         "zineshop": "zineshop"
       }
     },
@@ -465,21 +443,6 @@
         "type": "github"
       }
     },
-    "systems_5": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    },
     "tasklist": {
       "inputs": {
         "nixpkgs": [
@@ -540,24 +503,6 @@
       "inputs": {
         "systems": "systems_3"
       },
-      "locked": {
-        "lastModified": 1791914995,
-        "narHash": "sha256-Zf/xfQEAasnwnmEfHqW/4hjDE/s44yn2hD4RuVIZRjA=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "b7a79d3fea1e214f6d668d521cecec0c01e26544",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "utils_4": {
-      "inputs": {
-        "systems": "systems_4"
-      },
       "locked": {
         "lastModified": 1731533236,
         "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
@@ -572,9 +517,9 @@
         "type": "github"
       }
     },
-    "utils_5": {
+    "utils_4": {
       "inputs": {
-        "systems": "systems_5"
+        "systems": "systems_4"
       },
       "locked": {
         "lastModified": 1731533236,
@@ -620,7 +565,7 @@
         "nixpkgs": [
           "nixpkgs"
         ],
-        "utils": "utils_5"
+        "utils": "utils_4"
       },
       "locked": {
         "lastModified": 1792488750,

flake.nix

@@ -32,11 +32,6 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
-    portal = {
-      url = "git+https://git.dynamicdiscord.de/malobeo/portal";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-
     ep3-bs = {
       url = "git+https://git.dynamicdiscord.de/kalipso/ep3-bs.nix";
       inputs.nixpkgs.follows = "nixpkgs";

machines/fanny/configuration.nix

@@ -149,7 +149,6 @@ in
     "antamap" 
     "ns1"
     "wordpress"
-    "portal"
   ];
 
   networking = {
@@ -185,22 +184,6 @@ in
       };
     };
 
-    virtualHosts."portal.hq.malobeo.org" = {
-      forceSSL = true;
-      enableACME = true;
-      acmeRoot = null;
-      locations."/" = {
-        proxyPass = "http://${hosts.malobeo.hosts.portal.network.address}:8080";
-        extraConfig = ''
-          proxy_set_header Host $host;
-          client_max_body_size ${inputs.self.nixosConfigurations.nextcloud.config.services.nextcloud.maxUploadSize};
-          client_body_timeout 3600s;
-          send_timeout 3600s;
-          fastcgi_buffers 64 4K;
-        '';
-      };
-    };
-
     virtualHosts."cloud.hq.malobeo.org" = {
       forceSSL = true;
       enableACME = true;

machines/goldman/configuration.nix

@@ -86,7 +86,7 @@ in
     };
   };
 
-  networking.firewall.allowedTCPPorts = [ 80 443 1883 8000 ];
+  networking.firewall.allowedTCPPorts = [ 80 443 1883];
 
   system.stateVersion = "23.05";
 }

machines/hosts.nix

@@ -146,15 +146,10 @@ in
 
       wordpress = {
         type = "microvm";
-        network = createMaloNet "21" "52:DA:0D:F9:EF:F7";
+        network = createMaloNet "21" "52:DA:0D:F9:EF:F6";
       };
 
-      portal = {
-        type = "microvm";
-        network = createMaloNet "22" "52:DA:0D:F9:EF:F8";
-      };
-
-      # last host id: 22
+      # last host id: 21
     };
   };
 }

machines/nextcloud/configuration.nix

@@ -6,7 +6,6 @@ let
   hosts = import ../hosts.nix {};
 in
 {
-  microvm.vcpu = 2;
   sops.defaultSopsFile = ./secrets.yaml;
   sops.secrets = {
     nextcloudAdminPass = {
@@ -40,7 +39,7 @@ in
 
   services.nextcloud = {
     enable = true;
-    package = pkgs.nextcloud35;
+    package = pkgs.nextcloud33;
     hostName = "cloud.malobeo.org";
     config.adminpassFile = config.sops.secrets.nextcloudAdminPass.path;
     maxUploadSize = "10G";
@@ -50,10 +49,16 @@ in
     configureRedis = true;
     caching = {
       redis = true;
+      apcu = true;
     };
     extraAppsEnable = true;
     extraApps = {
-      inherit (config.services.nextcloud.package.packages.apps) contacts calendar polls registration collectives forms deck;
+      inherit (config.services.nextcloud.package.packages.apps) contacts calendar polls registration collectives forms;
+      deck = pkgs.fetchNextcloudApp {
+        sha256 = "sha256-Oc/J0Ey7f9aHhLBWoAXaDMe2t0eeEQKvpwY510qNpiI=";
+        url = "https://s3.g.megas4.com/ya5mczgkbk6bw7tcy2yr4bl2vdryfe76ok2dj/malo/deck33.tar.gz";
+        license = "agpl3Plus";
+      };
     };
     settings = {
       trusted_domains = [ "cloud.malobeo.org" "cloud.hq.malobeo.org" ];
@@ -63,6 +68,7 @@ in
       "default_phone_region" = "DE";
     };
     phpOptions = {
+      "realpath_cache_size" = "0";
       "opcache.interned_strings_buffer" = "32";
     };
   };

machines/nextcloud/secrets.yaml

@@ -1,7 +1,12 @@
-nextcloudAdminPass: ENC[AES256_GCM,data:RsP8Q1FqS9qgYTNe+H/nDHwQwr0fvlQawCOJWZVoF2U=,iv:AqJ79m3GAUd6sczDByJlb+K3XxxEt3HS4fURd7kn0bY=,tag:n/GyRKrIwOcksDtewnnXZw==,type:str]
+nextcloudAdminPass: ENC[AES256_GCM,data:es9hhtCcqBqPbV2L,iv:Kyq5kqao0uaMPs0GeRkJT9OWYSZfImBXngg51k0uQ0M=,tag:zN/u90/j4rmdo0HtY+cF9w==,type:str]
 sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
     age:
-        - enc: |
+        - recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
+          enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPT3ZxNEpRVktDWG9BR0Rv
             ZUZQTkJwQ0pSblNvTkFOT3BBdjVaSzJhVzBvCnVWc2xRUjBnRFFXSDgxczRMSFMy
@@ -9,8 +14,8 @@ sops:
             aDd0UlpMR3RNd3BDMmhqNmxhTFRoUlkK6Pni+cswKIU94WkP/fg5fzSmx/fhXjjl
             mRG2o4ALCqcOxAxHBrKJppUCLjUgKG53wPF/jlIzkvbwHwnqVMfYsQ==
             -----END AGE ENCRYPTED FILE-----
-          recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
-        - enc: |
+        - recipient: age1g084sl230x94mkd2wq92s03mw0e8mnpjdjfx9uzaxw6psm8neyzqqwpnqe
+          enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRK2o2K2tPTFcvbXRkZ0lq
             bS9ZOUc3dG1JeERZYVNsc3k3RjcxQ0RsdkRJCkx1VFhBQXRDOElqakJ0eTd3NEJX
@@ -18,9 +23,8 @@ sops:
             VjBFeldXS1p0Zk1uSk02aHpJd3BPOHcKvCmnK/KttB4RgnID/fj2KOdjvNnV3EWU
             B9mW4yxbEqhoxtu+GFD3eR/8SvMPEsHl9xorT/ZygMG7hAzedSukWw==
             -----END AGE ENCRYPTED FILE-----
-          recipient: age1g084sl230x94mkd2wq92s03mw0e8mnpjdjfx9uzaxw6psm8neyzqqwpnqe
-    lastmodified: "2026-10-22T19:07:13Z"
-    mac: ENC[AES256_GCM,data:HD1uqrxxfLrHGQfu7HFpuunpj/npPe35AvvFrhGFRUTtXLGRPDn5xeOiuHyT+qSs51lukE+hYhv/+u4xolb0SInOJtPTZ6suRcZ4maJ+9P0mgjs7OmI4e68CpGo0xuOg378WvlF15VQH2KCcVskEkO9UBTfOUmyNku1g4F6PeWw=,iv:cJaz6dYkspBlBY9aCaK2/zBDiVg7J7nCE+fnwNHz1Tw=,tag:5sKITZ8uD7JnRtwhaOPoGw==,type:str]
+    lastmodified: "2024-11-26T20:00:50Z"
+    mac: ENC[AES256_GCM,data:qoY9SfpoU+8HfvD5v/1S6BOkbnZUmHIbtwr0tTSuPETjnFNgr1VVw9mnRatJKPYYFb9/rMZQWIqTY+iUIEkcTVyVXhd6ki5CHW+uxCeBIyMzq33rtEa/btkEUoii4iPieamBCIY21W0znE+edxfR04yRJtLxMICEbuW4Hjf6bwk=,iv:nG42fRgjpuIjPMYnn/6egEdzYolcUBsspaZ8zMv4888=,tag:C6apGoAvVLsWdLWSCwrx6w==,type:str]
     pgp:
         - created_at: "2025-03-05T08:24:30Z"
           enc: |-
@@ -61,4 +65,4 @@ sops:
             -----END PGP MESSAGE-----
           fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4
     unencrypted_suffix: _unencrypted
-    version: 3.13.3
+    version: 3.8.1

machines/overwatch/configuration.nix

@@ -270,12 +270,6 @@ in
           targets = [ "${hosts.malobeo.hosts.wordpress.network.address}:9002" ];
         }];
       }
-      {
-        job_name = "portal";
-        static_configs = [{
-          targets = [ "${hosts.malobeo.hosts.zineshop.network.address}:9002" ];
-        }];
-      }
       # add vpn - check how to reach it first. most probably 10.100.0.1
     ];
   };

machines/portal/configuration.nix

@@ -1,46 +0,0 @@
-{ self, config, lib, pkgs, inputs, ... }:
-
-with lib;
-
-let
-  hosts = import ../hosts.nix {};
-in
-{
-  networking = {
-    hostName = mkDefault "portal";
-    useDHCP = false;
-  };
-
-  imports = [
-    inputs.malobeo.nixosModules.malobeo.metrics
-    inputs.malobeo.nixosModules.malobeo.printing
-    inputs.portal.nixosModules.portal
-    inputs.self.nixosModules.malobeo.users
-    ../modules/sshd.nix
-  ];
-
-  malobeo.metrics = {
-    enable = true;
-    enablePromtail = true;
-    logNginx = true;
-  };
-
-  malobeo.users = {
-    admin = true;
-    backup = true;
-  };
-
-  services.printing.enable = true;
-  services.malobeo.printing.enable = true;
-
-  services.portal = {
-    enable = true;
-    #TODO: we should use FQDN like gatekeeper.hq.malobeo.org
-    gatekeeperHost = "${hosts.malobeo.hosts.goldman.network.address}:8000";
-    gatekeeperScheme = "http";
-  };
-  networking.firewall.allowedTCPPorts = [ 8080 ];
-
-  system.stateVersion = "22.11"; # Did you read the comment?
-}
-

outputs.nix

@@ -47,12 +47,18 @@ in (utils.lib.eachSystem (builtins.filter filter_system utils.lib.defaultSystems
       shellHook = ''echo "Available scripts: ${builtins.concatStringsSep " " installed}"'';
     };
 
-    legacyPackages = {
-      scripts.remote-install = pkgs.writeShellScriptBin "remote-install" (builtins.readFile ./scripts/remote-install-encrypt.sh);
-      scripts.boot-unlock = pkgs.writeShellScriptBin "boot-unlock" (builtins.readFile ./scripts/unlock-boot.sh);
-      scripts.add-host-keys = pkgs.writeShellScriptBin "add-host-keys" (builtins.readFile ./scripts/add_new_host_keys.sh);
-      scripts.run-vm = self.packages.${system}.run-vm;
-    };
+    legacyPackages.scripts = {
+      malobeo-remote-install = pkgs.writeShellScriptBin "malobeo-remote-install" (builtins.readFile ./scripts/remote-install-encrypt.sh);
+      malobeo-boot-unlock = pkgs.writeShellScriptBin "malobeo-boot-unlock" (builtins.readFile ./scripts/unlock-boot.sh);
+      malobeo-add-host-keys = pkgs.writeShellScriptBin "malobeo-add-host-keys" (builtins.readFile ./scripts/add_new_host_keys.sh);
+      malobeo-run-vm = self.packages.${system}.run-vm;
+    } // (import ./packages/ssh_to_hosts.nix) {
+           malobeo = (import ./machines/hosts.nix {}).malobeo;
+           peers = import ./machines/modules/malobeo/peers.nix;
+           pkgs = pkgs;
+           lib = nixpkgs.lib;
+         };
+
 
     vmBuilder = utils.buildVM;
 
@@ -75,6 +81,11 @@ in (utils.lib.eachSystem (builtins.filter filter_system utils.lib.defaultSystems
       };
 
       run-vm = pkgs.writeShellScriptBin "run-vm"  (builtins.readFile ./scripts/run-vm.sh);
+    } // (import ./packages/ssh_to_hosts.nix) {
+      malobeo = (import ./machines/hosts.nix {}).malobeo;
+      peers = import ./machines/modules/malobeo/peers.nix;
+      pkgs = pkgs;
+      lib = nixpkgs.lib;
     };
 
     apps = {

packages/ssh_to_hosts.nix

@@ -0,0 +1,35 @@
+{ malobeo, peers, pkgs, lib, ... }:
+#mapAttrs' (name: value: nameValuePair ("foo_" + name) ("bar-" + value))
+let
+  get_ip = hostname: malobeo.hosts.${hostname}.network.address;
+  generate_ssh_command = hostname: hostConfig: (
+    if hostConfig.network.local == true then
+      if hostname == "fanny" then
+        "ssh admin@${malobeo.hosts."fanny".network.address}"
+      else
+        "ssh -J admin@${malobeo.hosts."fanny".network.address} admin@${get_ip hostname}"
+    else
+      "offsite"
+  );
+in
+(lib.attrsets.mapAttrs' (hostname: hostConfig: lib.nameValuePair 
+  ("malobeo-ssh-${hostname}")
+  (pkgs.writeShellScriptBin "malobeo-ssh-${hostname}"
+  ''
+  #!/bin/sh 
+  echo "${hostname} ${generate_ssh_command hostname hostConfig}"
+  '')) malobeo.hosts )
+#{
+#  test-pkg = pkgs.writeShellScriptBin "run-vm"  (builtins.readFile ../scripts/run-vm.sh);
+#}
+
+
+# microvm
+# - local:
+#   - yes: ssh through fanny  
+#   - no: if in peers.nix -> ssh through vpn, else not possible
+# not microvm:
+# - local:
+#   - yes: ssh through fanny (except for fanny)
+#   - no: not supported
+