[vaultwarden] add vaultwarden key and rekey secrets

[vaultwarden] change all secrets to use env file; add dummy.yaml
[fanny] deploy vaultwarden
2026-02-05 18:22:59 +01:00 · 2026-02-03 22:03:55 +01:00 · 2026-01-26 21:22:14 +01:00 · 2026-01-26 21:14:03 +01:00 · 2026-01-26 21:13:35 +01:00 · 2026-01-26 21:13:09 +01:00
18 changed files with 468 additions and 111 deletions
--- a/flake.lock
+++ b/flake.lock
@@ -67,11 +67,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1748226808,
-        "narHash": "sha256-GaBRgxjWO1bAQa8P2+FDxG4ANBVhjnSjBms096qQdxo=",
+        "lastModified": 1763992789,
+        "narHash": "sha256-WHkdBlw6oyxXIra/vQPYLtqY+3G8dUVZM8bEXk0t8x4=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "83665c39fa688bd6a1f7c43cf7997a70f6a109f9",
+        "rev": "44831a7eaba4360fb81f2acc5ea6de5fde90aaa3",
        "type": "github"
      },
      "original": {
@@ -109,11 +109,11 @@
        "spectrum": "spectrum"
      },
      "locked": {
-        "lastModified": 1748260747,
-        "narHash": "sha256-V3ONd70wm55JxcUa1rE0JU3zD+Cz7KK/iSVhRD7lq68=",
+        "lastModified": 1764549796,
+        "narHash": "sha256-Mswg665P92EoHkBwCwPr/7bdnj04g2Qfb+t02ZEYTHA=",
        "owner": "astro",
        "repo": "microvm.nix",
-        "rev": "b6c5dfc2a1c7614c94fd2c5d2e8578fd52396f3b",
+        "rev": "030d055e877cc13d7525b39f434150226d5e4482",
        "type": "github"
      },
      "original": {
@@ -145,11 +145,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1747663185,
-        "narHash": "sha256-Obh50J+O9jhUM/FgXtI3he/QRNiV9+J53+l+RlKSaAk=",
+        "lastModified": 1764234087,
+        "narHash": "sha256-NHF7QWa0ZPT8hsJrvijREW3+nifmF2rTXgS2v0tpcEA=",
        "owner": "nix-community",
        "repo": "nixos-generators",
-        "rev": "ee07ba0d36c38e9915c55d2ac5a8fb0f05f2afcc",
+        "rev": "032a1878682fafe829edfcf5fdfad635a2efe748",
        "type": "github"
      },
      "original": {
@@ -160,11 +160,11 @@
    },
    "nixos-hardware": {
      "locked": {
-        "lastModified": 1747900541,
-        "narHash": "sha256-dn64Pg9xLETjblwZs9Euu/SsjW80pd6lr5qSiyLY1pg=",
+        "lastModified": 1764440730,
+        "narHash": "sha256-ZlJTNLUKQRANlLDomuRWLBCH5792x+6XUJ4YdFRjtO4=",
        "owner": "NixOS",
        "repo": "nixos-hardware",
-        "rev": "11f2d9ea49c3e964315215d6baa73a8d42672f06",
+        "rev": "9154f4569b6cdfd3c595851a6ba51bfaa472d9f3",
        "type": "github"
      },
      "original": {
@@ -192,11 +192,11 @@
    },
    "nixpkgs-unstable": {
      "locked": {
-        "lastModified": 1748190013,
-        "narHash": "sha256-R5HJFflOfsP5FBtk+zE8FpL8uqE7n62jqOsADvVshhE=",
+        "lastModified": 1764517877,
+        "narHash": "sha256-pp3uT4hHijIC8JUK5MEqeAWmParJrgBVzHLNfJDZxg4=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "62b852f6c6742134ade1abdd2a21685fd617a291",
+        "rev": "2d293cbfa5a793b4c50d17c05ef9e385b90edf6c",
        "type": "github"
      },
      "original": {
@@ -208,16 +208,16 @@
    },
    "nixpkgs_2": {
      "locked": {
-        "lastModified": 1748162331,
-        "narHash": "sha256-rqc2RKYTxP3tbjA+PB3VMRQNnjesrT0pEofXQTrMsS8=",
+        "lastModified": 1764522689,
+        "narHash": "sha256-SqUuBFjhl/kpDiVaKLQBoD8TLD+/cTUzzgVFoaHrkqY=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "7c43f080a7f28b2774f3b3f43234ca11661bf334",
+        "rev": "8bb5646e0bed5dbd3ab08c7a7cc15b75ab4e1d0f",
        "type": "github"
      },
      "original": {
        "owner": "NixOS",
-        "ref": "nixos-25.05",
+        "ref": "nixos-25.11",
        "repo": "nixpkgs",
        "type": "github"
      }
@@ -246,11 +246,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1747603214,
-        "narHash": "sha256-lAblXm0VwifYCJ/ILPXJwlz0qNY07DDYdLD+9H+Wc8o=",
+        "lastModified": 1764483358,
+        "narHash": "sha256-EyyvCzXoHrbL467YSsQBTWWg4sR96MH1sPpKoSOelB4=",
        "owner": "Mic92",
        "repo": "sops-nix",
-        "rev": "8d215e1c981be3aa37e47aeabd4e61bb069548fd",
+        "rev": "5aca6ff67264321d47856a2ed183729271107c9c",
        "type": "github"
      },
      "original": {
@@ -262,11 +262,11 @@
    "spectrum": {
      "flake": false,
      "locked": {
-        "lastModified": 1746869549,
-        "narHash": "sha256-BKZ/yZO/qeLKh9YqVkKB6wJiDQJAZNN5rk5NsMImsWs=",
+        "lastModified": 1759482047,
+        "narHash": "sha256-H1wiXRQHxxPyMMlP39ce3ROKCwI5/tUn36P8x6dFiiQ=",
        "ref": "refs/heads/main",
-        "rev": "d927e78530892ec8ed389e8fae5f38abee00ad87",
-        "revCount": 862,
+        "rev": "c5d5786d3dc938af0b279c542d1e43bce381b4b9",
+        "revCount": 996,
        "type": "git",
        "url": "https://spectrum-os.org/git/spectrum"
      },
@@ -450,11 +450,11 @@
        "utils": "utils_4"
      },
      "locked": {
-        "lastModified": 1751462005,
-        "narHash": "sha256-vhr2GORiXij3mL+QIfnL0sKSbbBIglw1wnHWNmFejiA=",
+        "lastModified": 1768820076,
+        "narHash": "sha256-0vnIYuWvsYasbHZHUjAcK9FR0kxkRRtzYG661VEtoPU=",
        "ref": "refs/heads/master",
-        "rev": "f505fb17bf1882cc3683e1e252ce44583cbe58ce",
-        "revCount": 155,
+        "rev": "cfdfae84bb045ae429f0760eba708468871b1738",
+        "revCount": 159,
        "type": "git",
        "url": "https://git.dynamicdiscord.de/kalipso/zineshop"
      },
--- a/flake.nix
+++ b/flake.nix
@@ -3,7 +3,7 @@

  inputs = {
    nixos-hardware.url = "github:NixOS/nixos-hardware/master";
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
    nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixos-unstable";
    sops-nix.url = "github:Mic92/sops-nix";
    sops-nix.inputs.nixpkgs.follows = "nixpkgs";
--- a/machines/.sops.yaml
+++ b/machines/.sops.yaml
@@ -14,6 +14,7 @@ keys:
  - &machine_vpn age1v6uxwej4nlrpfanr9js7x6059mtvyg4fw50pzt0a2kt3ahk7edlslafeuh
  - &machine_fanny age136sz3lzhxf74ryruvq34d4tmmxnezkqkgu6zqa3dm582c22fgejqagrqxk
  - &machine_nextcloud age1g084sl230x94mkd2wq92s03mw0e8mnpjdjfx9uzaxw6psm8neyzqqwpnqe
+  - &machine_vaultwarden age1zs9puemeevc5kt84w9d2mc5396w0t9p60qxymkpatwvwxunzs5usmxr3an
  #this dummy key is used for testing.
  - &machine_dummy age18jn5mrfs4gqrnv0e2sxsgh3kq4sgxx39hwr8z7mz9kt7wlgaasjqlr88ng
 creation_rules:
@@ -95,6 +96,15 @@ creation_rules:
      - *admin_kalipso_dsktp
      age:
      - *admin_atlan
+      - *machine_overwatch
+  - path_regex: vaultwarden/secrets.yaml$
+    key_groups:
+    - pgp:
+      - *admin_kalipso
+      - *admin_kalipso_dsktp
+      age:
+      - *admin_atlan
+      - *machine_vaultwarden
  - path_regex: .*/secrets/.*
    key_groups:
    - pgp:
--- a/machines/bakunin/configuration.nix
+++ b/machines/bakunin/configuration.nix
@@ -48,7 +48,7 @@ in
      firefox
      thunderbird
      telegram-desktop
-      tor-browser-bundle-bin
+      tor-browser
      keepassxc
      libreoffice
      gimp
--- a/machines/durruti/host_config.nix
+++ b/machines/durruti/host_config.nix
@@ -49,10 +49,25 @@ in
      locations."/" = {
        proxyPass = "http://10.0.0.10";
        extraConfig = ''
+          client_max_body_size 10G;
+          client_body_timeout 3600s;
+          send_timeout 3600s;
+          fastcgi_buffers 64 4K;
        '';
      };
    };

+    services.nginx.virtualHosts."keys.malobeo.org" = {
+      forceSSL = true;
+      enableACME= true;
+      locations."/" = {
+        proxyPass = "http://10.0.0.10";
+        extraConfig = ''
+        '';
+      };
+    };
+
+
    services.nginx.virtualHosts."grafana.malobeo.org" = {
      forceSSL = true;
      enableACME= true;
@@ -83,7 +98,7 @@ in
          client_body_in_file_only clean;
          client_body_buffer_size 32K;
          
-          client_max_body_size 50M;
+          client_max_body_size 500M;
          
          sendfile on;
          send_timeout 300s;
--- a/machines/fanny/configuration.nix
+++ b/machines/fanny/configuration.nix
@@ -86,10 +86,15 @@ in
    enable = true;
    authorizedKeys = sshKeys.admins;
    ethernetDrivers = ["r8169"];
+    zfsExtraPools = [ "storage" ];
  };

  boot.initrd = {
    availableKernelModules = [ "wireguard" ];
+    # postMountCommands = ''
+    #   ip address flush dev wg-initrd
+    #   ip link set dev wg-initrd down
+    # '';
    systemd = {
      enable = true;
      network = {
@@ -101,15 +106,15 @@ in
          };
          wireguardConfig = { PrivateKeyFile = "/etc/secrets/30-wg-initrd.key"; };
          wireguardPeers = [{
-            AllowedIPs = peers.fanny-initrd.allowedIPs;
-            PublicKey = peers.fanny-initrd.publicKey;
+            AllowedIPs = peers.vpn.allowedIPs;
+            PublicKey = peers.vpn.publicKey;
            Endpoint = "${peers.vpn.publicIp}:${builtins.toString(peers.vpn.listenPort)}";
            PersistentKeepalive = 25;
          }];
        };
        networks."30-wg-initrd" = {
          name = "wg-initrd";
-          addresses = [{ Address = peers.fanny-initrd.address; }];
+          addresses = [{ Address = "${peers.fanny-initrd.address}/24"; }];
        };
      };
    };
@@ -130,6 +135,7 @@ in
    "nextcloud" 
    "durruti" 
    "zineshop"
+    "vaultwarden"
  ];

  networking = {
@@ -160,7 +166,19 @@ in
        proxyPass = "http://10.0.0.13";
        extraConfig = ''
          proxy_set_header Host $host;
-          client_max_body_size 10G;
+          client_max_body_size ${inputs.self.nixosConfigurations.nextcloud.config.services.nextcloud.maxUploadSize};
+          client_body_timeout 3600s;
+          send_timeout 3600s;
+          fastcgi_buffers 64 4K;
+        '';
+      };
+    };
+
+    virtualHosts."keys.malobeo.org" = {
+      locations."/" = {
+        proxyPass = "http://10.0.0.16";
+        extraConfig = ''
+          proxy_set_header Host $host;
        '';
      };
    };
@@ -195,7 +213,7 @@ in
          client_body_in_file_only clean;
          client_body_buffer_size 32K;
          
-          client_max_body_size 50M;
+          client_max_body_size 500M;
          
          sendfile on;
          send_timeout 300s;
--- a/machines/hosts.nix
+++ b/machines/hosts.nix
@@ -75,6 +75,14 @@
        };
      };

+      vaultwarden = {
+        type = "microvm";
+        network = {
+          address = "10.0.0.16";
+          mac = "D0:E5:CA:F0:D7:F2";
+        };
+      };
+
      testvm = {
        type = "host";
      };
--- a/machines/louise/configuration.nix
+++ b/machines/louise/configuration.nix
@@ -31,7 +31,7 @@
      firefox
      thunderbird
      telegram-desktop
-      tor-browser-bundle-bin
+      tor-browser
      keepassxc
      libreoffice
      gimp
--- a/machines/modules/malobeo/initssh.nix
+++ b/machines/modules/malobeo/initssh.nix
@@ -22,6 +22,11 @@ in
      description = "Ethernet drivers to load: run `lspci -k | grep -iA4 ethernet`";
      example = "r8169";
    };
+    zfsExtraPools = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+      description = "Name or GUID of extra ZFS pools that you wish to import during boot.";
+    };
  };
  
  config = lib.mkIf (cfg.enable && config.malobeo.disks.encryption) {
@@ -32,33 +37,41 @@ in
      zfs = {
        forceImportAll = true;
        requestEncryptionCredentials = true;
-        
+        extraPools = cfg.zfsExtraPools;
      };
      initrd = {
        availableKernelModules = cfg.ethernetDrivers;
        systemd = {
+          initrdBin = [ pkgs.busybox pkgs.wireguard-tools pkgs.iproute2 ]; 
          enable = true;
          network.enable = true;
+          services."stopInitVpn" = {
+            description = "stop init vpn";
+            wantedBy = [
+              "initrd.target"
+            ];
+            after = [
+              "zfs.target"
+            ];
+            serviceConfig.StandardOutput = "journal+console";
+            script = ''
+              networkctl down wg-initrd
+            '';
+            serviceConfig.Type = "oneshot";
+      };
        };
-        network.ssh = {
-          enable = true;
-          port = 222;
-          authorizedKeys = cfg.authorizedKeys;
-          hostKeys = [ "/etc/ssh/initrd" ];
+        network = {
+          flushBeforeStage2 = true;
+          ssh = {
+            enable = true;
+            port = 222;
+            authorizedKeys = cfg.authorizedKeys;
+            hostKeys = [ "/etc/ssh/initrd" ];
+          };
        };
        secrets = {
          "/etc/ssh/initrd" = "/etc/ssh/initrd";
        };
-        systemd.services.zfs-remote-unlock = {
-          description = "Prepare for ZFS remote unlock";
-          wantedBy = ["initrd.target"];
-          after = ["systemd-networkd.service"];
-          path = with pkgs; [ zfs ];
-          serviceConfig.Type = "oneshot";
-          script = ''
-            echo "zfs load-key -a; killall zfs; systemctl default" >> /var/empty/.profile
-          '';
-        };
      };
      kernelParams = [ "ip=::::${hostName}-initrd::dhcp" ];
    };
--- a/machines/nextcloud/configuration.nix
+++ b/machines/nextcloud/configuration.nix
@@ -31,9 +31,13 @@ with lib;
    lokiHost = "10.0.0.14";
  };

+  services.postgresqlBackup = {
+    enable = true;
+  };
+
  services.nextcloud = {
    enable = true;
-    package = pkgs.nextcloud31;
+    package = pkgs.nextcloud32;
    hostName = "cloud.malobeo.org";
    config.adminpassFile = config.sops.secrets.nextcloudAdminPass.path;
    maxUploadSize = "10G";
@@ -48,14 +52,9 @@ with lib;
    extraAppsEnable = true;
    extraApps = {
      inherit (config.services.nextcloud.package.packages.apps) contacts calendar polls registration collectives forms;
-      appointments = pkgs.fetchNextcloudApp {
-        sha256 = "sha256-ls1rLnsX7U9wo2WkEtzhrvliTcWUl6LWXolE/9etJ78=";
-        url = "https://github.com/SergeyMosin/Appointments/raw/refs/tags/v2.4.3/build/artifacts/appstore/appointments.tar.gz";
-        license = "agpl3Plus";
-      };
      deck = pkgs.fetchNextcloudApp {
-        sha256 = "sha256-1sqDmJpM9SffMY2aaxwzqntdjdcUaRySyaUDv9VHuiE=";
-        url = "https://link.storjshare.io/raw/jw7pf6gct34j3pcqvlq6ddasvdwq/mal/deck.tar.gz";
+        sha256 = "sha256-epjwIANb6vTNx9KqaG6jZc14YPoFMBTCj+/c9JHcWkA=";
+        url = "https://link.storjshare.io/raw/jvrl62dakd6htpyxohjkiiqiw5ma/mal/deck32.tar.gz";
        license = "agpl3Plus";
      };
    };
--- a/machines/overwatch/configuration.nix
+++ b/machines/overwatch/configuration.nix
@@ -3,6 +3,14 @@
 with lib;

 {
+  sops.defaultSopsFile = ./secrets.yaml;
+  sops.secrets = {
+    grafana_smtp = {
+      owner = "grafana";
+      group = "grafana";
+    };
+  };
+
  networking = {
    hostName = mkDefault "overwatch";
    useDHCP = false;
@@ -26,10 +34,21 @@ with lib;

  services.grafana = {
    enable = true;
-    settings.server = {
-      domain = "grafana.malobeo.org";
-      http_port = 2342;
-      http_addr = "127.0.0.1";
+    settings = {
+      server = {
+        domain = "grafana.malobeo.org";
+        http_port = 2342;
+        http_addr = "127.0.0.1";
+      };
+
+      smtp = {
+        enabled = true;
+        host = "mail.systemli.org:465";
+        user = "malobot@systemli.org";
+        from_address = "malobot@systemli.org";
+        from_name = "malobot";
+        password = "$__file{${config.sops.secrets.grafana_smtp.path}}";
+      };
    };

    provision.datasources.settings = {
@@ -83,6 +102,7 @@ with lib;

  services.prometheus = {
    enable = true;
+    retentionTime = "1y";
    port = 9001;

    scrapeConfigs = [
--- a/machines/overwatch/dummy.yaml
+++ b/machines/overwatch/dummy.yaml
@@ -0,0 +1,65 @@
+grafana_admin: ENC[AES256_GCM,data:zO7Tfmo=,iv:xa456cUb14VjJPEKClqGJiYR7cSsjQPIld+O2E0YNM8=,tag:dFgGtqMYhg4uweoLZPu48Q==,type:str]
+grafana_smtp: ENC[AES256_GCM,data:xndLMw==,iv:0P4INbDD2/Teo8Dv6lIfLhXvNAkcneEDCeB5OAY25wI=,tag:ilE0Noleb+uL5gqF4bU70w==,type:str]
+sops:
+    age:
+        - recipient: age18jn5mrfs4gqrnv0e2sxsgh3kq4sgxx39hwr8z7mz9kt7wlgaasjqlr88ng
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPMXlEbWlabzVUNlRkVFFC
+            ZktpQUx2alRNN01qYmhFYnhMRDBkYmFRdzNnCi9YbjBDUlRhc1kwVjZWY0NGZERQ
+            U05BMlFpemVhR29VZWJUdGJYNWhMdVUKLS0tIFU5dEEvaFdvelpqZGg5a1BHb1Bn
+            eDFDVStZS0o0WVh4cmJPa2o3eWNseGMKc0ydK8/2Gzxe2IYG96saVosJTrRcWizR
+            lcMbsh8mKlVCt5Fx9EQOtj50ylOGk2h2Itk4uLYG4UAySDU/Aw3iQw==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1QmsxNERCclRBeFo0WGZ1
+            OGlHTGxDMURsWXdDRXpoUk10S0JpeGk2QURvCjBkaVFHTHo1eGtKbERPWmhNZEpL
+            SHlFR3FPMG1XY0VBRzI0RWhHYno1RnMKLS0tIFAwSFBhcWRrZG9MQ1FjRFVlVTZB
+            QXZwTVd5NnNSdUxRSzNLMHk2SWYxVnMKZyZvZV5qhJj4KATFV2eh9aN9XMbSQL7i
+            kRGQI9y5ADv6UsLh/y+rWe0xF4BPOGF0xL8JUnHfTy/RsKfhB3aTYQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-01-24T17:01:57Z"
+    mac: ENC[AES256_GCM,data:KySo9sJgOLBPtxQZ1gXY8aCmCHbn44aiLKiK1mGziKsBoPkBdEivCT7dDQ1tXQj9wz3gly6raS4FEmR6ikcbtAE2EN86cDLNuu9sSiW2OYiJRe5iZvet2veqtA00K7TtPZgAX+ccsUE5iy0W55bu+kpK3J8MPNy3LUK0EbSKW8I=,iv:7BQKCNyWe4azTelyKlV6XvvgPIrspVbwITyycsW/c44=,tag:1XbSxju44GCKcGw8Ln9iuQ==,type:str]
+    pgp:
+        - created_at: "2026-01-24T17:01:26Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQGMA5HdvEwzh/H7AQv6AsOXbgAIOqhQIwmq/t0uUTq77bI2Z96n49kdUqVG0AAr
+            OdnArcAe8J80gr1FUkjhU8jxO1cwh0N6bQdEO5S/MHo156+tToB64l858sxRBeSK
+            V5Ko7Pc0JulgQ5MFgD3SMaOVO9G0pvZJjU+E/WJCkoYnh4HBWWiCx4+OoxeSDFma
+            hvLiAciH6eB5wlKeLeMt9L80stIeSxXSDL/r/5QHg7qI8Fy5YWCtBmlRDQ3Lma3Q
+            erU5M5iVh7nr4P11lsGjgnPPalxuD0bdLQxm3zOXFK4nVJE1dI4zov386IjI57Ur
+            Hzl7LF7fUoaiGZNskfZzt38cdx0EJL2WV71DD5jlEgaPBUom1sRP4pPDSlDi4oFL
+            A3+AK2GvH6xlExagDevtsn7IgA3Dm/ummGpCE12y4To4Heq0uh0nRmRsnpQlzfGx
+            40Ka06u+xM8tLIuyhLFeaVq0IfEtRRo0GeMQYOX/GQS8ns5+WGguhOamDlAf4Tcw
+            UmDn4HEaObHAiQJC50pl0lgBJroiCV4kljDFALv8nKTuu1l/l+X9ULNImtRp0z0K
+            +U+DcuWb+8mNj3WRXEA+zLqxI34pLohZPys85GbUOo1J+OwXrajujuOofOInUfNt
+            OYrcItXgSqZp
+            =8n3V
+            -----END PGP MESSAGE-----
+          fp: c4639370c41133a738f643a591ddbc4c3387f1fb
+        - created_at: "2026-01-24T17:01:26Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA98TrrsQEbXUAQ//Z44dVz5B2l72NhkoxAzaUIvqnluoJw59hbNyfss6ia3m
+            uAFJcz4Vf30AO1CnIWRbGaGvL3hn+qbHr+VDWLJ5gmL8+PLX2LRHhtQnISsFhGRd
+            spXfVr7NpqdWxjTy8EIoWJ2Ucpz6pzwFHh2FhCadKZlz8orvOB+SvmIe3o9LdORV
+            lqqelNASlHjPwyck7xOB71evtfvoFwfWw3CNR3hxE3zkZ55F776Fypi1VxfxRpbx
+            sWPze7LD6/kV04wXZMBDvlQQUShdXfCRSF3SujAWIEhuJu0UsmIdV9omnhGbSOoe
+            LyAyCdryjYmYGUn4MBmFQOf9k/FWnN8OMmLx2lNbXLopCLTM3UA4YY8411CgQd9X
+            RzM8M7YjbfAptvI1sf1DCrxOaKF0tcN6l44bPDkzy1lErKsPcR9N9HfV3cdWii26
+            JDyz+MtYj8DvxofRqsyjJL/qyP/4w+trvnIttbJPW3GZ6LCulJVQupXWvr6Q1lJ1
+            2g3Lyyv4/xwPMRP4/Vt6olOrwkn5H1fcj7w9Dl0osuG2VEnR0sFs33u76kTLMHum
+            7EDT8Dq480SLQ7g4JTCk2ElFBJBdAf8TTX+1rQ+2aUu94IihKHDeXbuxd+MdTyrV
+            q13QAOzLjjeQTYSKwxq9sZlMw5TPU5CJ4lXQ7UGAJ7efH6A/Rd23TMv2stTFyA3S
+            WAGVYDwKP7S49KkwMCC6Dvi0rjYD9fVnk19bQ/SdO/eiKQ5mb4DcOxx+KXxnKDTr
+            GI8pUz9lmOcLZB7umDHR5WnqtG0q1EgASQrvGDGQqORHqEpL343+wBg=
+            =0JXx
+            -----END PGP MESSAGE-----
+          fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4
+    unencrypted_suffix: _unencrypted
+    version: 3.11.0
--- a/machines/overwatch/secrets.yaml
+++ b/machines/overwatch/secrets.yaml
@@ -1,59 +1,65 @@
 grafana_admin: ENC[AES256_GCM,data:c+ZnOyxSXrG4eiK8ETKHheadiSz98LLHYwxb,iv:Ut2qFD2p6OmKDWjLMjFxyISxzTdJpZpgIB7obW5bgkY=,tag:HdayzjXQ1Zc7w9ITLzKLxA==,type:str]
+grafana_smtp: ENC[AES256_GCM,data:gOER9SzqRACIWe3PchyKguX3RdW6xhSZDzLd727CK1w=,iv:KDOyXGYGXnUu92hvt6eBqI8zeKP+JRDsF8Ir5X/9TDk=,tag:wRexcIJp8XEURKcZnHCRtQ==,type:str]
 sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
    age:
        - recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxN1VURXJuMENJV1Z2eEtS
-            bUR2cTNmNUdhU1B4SHZNMW9KRDV2dW5VNmlNCjdmYXpZb05mMEdPdjN4c0VWOUhV
-            RW4vV05CMno1MmJmYzdESjN5MFVFcjQKLS0tIDNxTE1KaW1EVGhtOEQwWXZndk53
-            bFBCMExGdEdMb2Z0TzF0Yk02MUpkN0kKIUm9iUvU/xu1Xl6yoYSVGcIXKnGsp/D/
-            RjVQ7tgJIbrupubny/fg4v2sz5HOs5uzmEq4ZKgBWrBeMPss4gYstA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWdVhpdTdJNnh5VCtmNHh5
+            M1ZTKzk1WlVYYmRWKzJxd1ZUTi9IMW1ta1VvCjVZQVQ1K1lFeC9QZkI2MGZXNk81
+            MGlibVFCYXZ0RFEzNUQxUm5PcWdadTgKLS0tIHFJNXFieVd4TXc4ck9VT3cxWDFs
+            NmRNSit1TkRRbUFQNzUvYThUczAxRzAKvpDK4R7m/GpfOzM4nU5vSYDXZGUy4D+c
+            xouTxOguMdId8GiKb1AJnVv2q/YYdr2M9yA/FpKn7kBfuQw/Hrj1rg==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-01-22T00:51:32Z"
-    mac: ENC[AES256_GCM,data:TEEyPmVxIJxC49hDqDbwzTZZ/tNymFr0dMvWn6DRli70Kp5XXNCLTpicAbiFh3WoyzbDpN/5c2yxVNGjhB8nXgKpCZdffdONMY6eSCpPbblYwJS7hNsjW+u2wysSFPDAk5apwbNXJcKnlI1tBcGQRHlym9ShSw6fT7K7afWYWqo=,iv:583DWNug8yNF/vZZN4btT6P1yUa0b1UN4frvAX4UKv0=,tag:YI5KIAe5P5Bx0TZU4wG8ag==,type:str]
+        - recipient: age1hq75x3dpnfqat9sgtfjf8lep49qvkdgza3xwp7ugft3kd74pdfnqfsmmdn
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0bEhCQitwNVpYSHRJOEMr
+            ZnZLQ3lELzdtREVpSHVGd3BHZ3p6WU9BK3lFCkFlYXNsa2JWZmZFVjRmK3BTejc1
+            K0JVSlZPbFh0VklvZHFaOUwyVHlibFUKLS0tIDFMcU8wc01lT3g0bUw3VHBmd3Zv
+            VnRIYVVIZktISENseEVLVWlsenFhcVkKvj8i349iNX2YNL5G0w7F9IuW/5ZRP6Z7
+            XC8TrYzCSOEOXt5nMnZg2yQUJHi6Qq8Wu2e2KV7Cd9J8Q/39dRv2cg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-01-24T16:52:54Z"
+    mac: ENC[AES256_GCM,data:BoJwPldIVZf2NZALbeMTq6DvuBMwOwyvmr5UjsPvQrdbbzYjLTl5dplkhT6QRHPDCFDT4Ibd1UfJ8pQYRkGdO2EjlUyuk3hvAYdR+PUmVz8afFE07sNsGw2EDGVHmsFjUVHLT69YqXtGpVNTW6KjqYuRhz/Ik0wEZLxzDSiy86c=,iv:TQU0si/AYaMpShF4l3CzUN3qajQpE0ZWa7mLOqhRP00=,tag:Oyapkoo4+Q7x08m6RTXfcQ==,type:str]
    pgp:
-        - created_at: "2025-01-22T00:51:09Z"
+        - created_at: "2026-01-24T18:05:47Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----

-            hQGMA5HdvEwzh/H7AQv+PxajhJgXHcxwJ7Mk0gjqFV0dGmNJ1m0eY3gPyIS38GSB
-            Rjto1zUd6EARu1GnxSrVrSZYlQaL6x3l2DuFIP7mtymvlFrmhiAoDz/si0zlzsJp
-            WZyQZdepnt9FyYJAwTzbmfVdpZDYajuMI38byMJqzUhS7SEOsPwiU1KRoTHcf4se
-            2E+9v8OwTVT2UoDxyiVJuDAA+K+Jh2RjHk3p/uVnZDqqQpI9UAI8LrCpun9uALpH
-            +29wyhkCZ9RIHU7nDQNVvwHkbYCyRUwR44bciSwITpjp7GuZCcZvzSSimPktkC9q
-            VZkHA6rHgHgcu6mnMfpP0+j4gB0dU0t4hGF41klV3YpEGfYcFIsKV10lfa6aMNmW
-            08RuLdCtnQyplYhgBm1zQvYHJsIuwK9s1B2dz3Z8l3o2eg8AqFuIL+MlZOvf5A/2
-            MOXffyXbOM5Dhy7DdUckTOYYfwWe1mStw3vx3I3mAFzuOOR7HQuzlc9Bf1oxh36T
-            6e/qOijjPPqkLeR2mufo0lgBBFTQFt2jVvMo1lrCB8Amj4yj/4noXTzglkYTYBKs
-            S513kUdhAGtWoNrqcItOYAn/gl+CPGY2Op3tJBVCWM6aT/KO6M/LPJ7wiQk2zlOL
-            pp7SnCKvv9eQ
-            =N+uj
+            hQGMA5HdvEwzh/H7AQwApRb25y9gYvAV1XvhhnazjaFKPeNkL47Rou9fNySfa1fg
+            WOh/m0Pu1RUK6QHhnQhLvwQeVV/eQc4M3RWccSKdSmhDJGN3WdfZZAgDXT7ovifD
+            oMEwstACzCCKwNQ1TRc2KyTUGOudWuFQzt1TnOv+jdByScDwRXVItWHoIBk0B4T9
+            qq+sLjdWDNXQpED609kkYm0Ge6IApDN9kt8ZXylFDnsSEu9dRWNUY4fBjfMK8Nfp
+            aPpGfRUrlAEK87ApPtD1I3SBNkz73KSXSieUeCGqra5c/W6oRY8nzUljvHAD4Zr2
+            aGer5lLujih5nR+QybaNnREGrlNDh7SEhBk3p7Nuj/bH2f4Pyto2J+9WaLPZ8UzW
+            /nnhIZmPvcRm6z0++tJtKRhloutSNiuv1emM7XpGk4zjeW4f8hg+eld6c/ngZ5vw
+            tv2RH75AuOfkkychZJwBPy2hhmBgPEoY5Z1qPkqv/2m8utO9vuHeFn+pxgSsijF1
+            Q70noa9SQSoeqDVGmldF0lYBPT8ldR5RleLKnYj0vdyLSWgQUBUlx/CbWl7JoNzc
+            eCRp16b0MmfSWqBwtmHfhZSb5g2qVwsw6LlfeyshngNUJNc9Mc4HqBtQZivAjQCI
+            9lYbc+2rDw==
+            =b4hD
            -----END PGP MESSAGE-----
          fp: c4639370c41133a738f643a591ddbc4c3387f1fb
-        - created_at: "2025-01-22T00:51:09Z"
+        - created_at: "2026-01-24T18:05:47Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----

-            hQIMA98TrrsQEbXUAQ//fm/TcxgsAMY6P8jvOQMcRBmjjVwfLP1UTTnkRUa36Mmn
-            2V9619zsH1dzTp0gUVV8mvIKUtpz2nCBTZBJw803wW9KorxW6f4e3+mIWelZT5WM
-            sLcQPFWAYKDVnSfk5j8kRSmpM6k2xFRB9DTEMIyFH9PZL99Fztp2hjTn553YTQOo
-            pdw+AMzgptYQghW/Pl/32wXHwCO+bL8tyk62VIQO13l3tX83oSslXNkFzNQYt3jv
-            xXFUaQEGD/1lFLeFnIuJZzfjWt6n0fShJboUcuk/ZIcYdwrbG0pyLLoBoObSRQtG
-            t+7VpWpfl3rnk822SU9z9YcaMNy9HD3Kz9Qh0BRQiN3scCMzm1LyzlXLqlc/gPiq
-            JyCxy98vJXIxmlLQZpDFfTMe3xsc8jSsHI6av+wEFKGEJAOUkDtRYvLfZdgDTfiB
-            XTAhQ3ixnlBxdZZ9DjBXyVfM8q9iB8bggFi7g2SjO32LKhXRFUqZR+avddCyKR/V
-            hRpWjDRn+eX2tl7LPawvX6tIow3aZiezkMVyeRXfcZCvpicq64b80LrYR+JJUfJE
-            vxHaekKImrdJ9ocii0wW91ZmESJwL6m5lt3ZsCY5GTlEDt4wBse5uhj48mtuK8sh
-            g8uQMKp7SiiCtV5a6O1SQLDJeAt6VCcRyudLToO9S4gwrGXNPcGxsHj07XAN2PHS
-            WAE6wUhufXfpa8UgSWy7fmEZt4L03XlRfC7bm/ycwaFww3A7w4+B1gkW6gOon6sy
-            nOyIxUZfU6abZWKzH+OIuViKH7xPiULDy75gEmkRHjKu5BiC3Tx0eO4=
-            =+PPr
+            hQIMA98TrrsQEbXUARAAmL5wfXTStuu0hFz6E3sEfGdWrV+O5ZmP79Bu+1BgCzkQ
+            iIp18D/e6vsCoWrTGtgEWfqWe0i1B2Iq5sPxPvSg356nfxuNEWxWjsjK6yVziAos
+            On6HQJyEnSs7yfnQ1BXNVPVa3dCXfAhlz4zJ6kfSFuKV2WhDs6y0azNCD0QdE6d3
+            YHd/WOPr726u1prQDMKsyYKHQd5QyjAl+egXyrlbqwQowYdS4hYpGYeZbdiVPsCo
+            cKHvfq+3cS3bdzzwJ1RadBg+sR9zmKlsWCkRTyMB/uL3bhVomtsSU3U8CN09QOpG
+            +eJjk3T07B23lzH6t214CZRFJ8dudgMyseMUnsWngWfn3VfCW10wciaxvhKqMcE7
+            4VLAPCjJNh8IQcmYE0+fFrpUya3CR1cQo3nwx9Hc/BPuXrjJXzbDyeMPWJAJgwbK
+            Hxuer4x25LWRFCu/EkICxRPIbFqymLVXr/ZTsxwve8lTJnpGMTsZd4H93BMZ48sc
+            U7V9ZoLlVp9mSCM4jbrhpoDOz96YoH0rt00+5SW9EaFEsqeLzTrSZinKSnRaR5+6
+            G04oOyG9eSHWMTHqlZihR68ut6qUQK2GJMiv7ZIimYgbNaWG4tU/ExkUZY7rTGgq
+            d1swV52fPbFhwk8PfXxeVep0VYUfjHk9GVJRRgUEoqc93NhDwWSBZuZR7FJNCM/S
+            VgFYepBIOp1J5DaeZ5jquRRIFVtFa3+nf1ceHR2GbCUy+7xGhEtIMBUsgRwDF4Wu
+            pbwb8T4EreK1C9XlEfWwF44WJXuqU2Rzx3oq6FcNUfAksIk6y+SA
+            =9zQv
            -----END PGP MESSAGE-----
          fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4
    unencrypted_suffix: _unencrypted
-    version: 3.9.2
+    version: 3.11.0
--- a/machines/vaultwarden/configuration.nix
+++ b/machines/vaultwarden/configuration.nix
@@ -0,0 +1,60 @@
+{ config, lib, pkgs, inputs, ... }:
+
+with lib;
+
+{
+  sops.defaultSopsFile = ./secrets.yaml;
+  sops.secrets = {
+    vaultwarden_env = {
+      owner = "vaultwarden";
+      group = "vaultwarden";
+    };
+  };
+  networking = {
+    hostName = mkDefault "vaultwarden";
+    useDHCP = false;
+  };
+
+  imports = [
+    ../modules/malobeo_user.nix
+    ../modules/sshd.nix
+  ];
+
+  networking.firewall.allowedTCPPorts = [ 80 ];
+
+  services.nginx = {
+    enable = true;
+    virtualHosts."keys.malobeo.org" = {
+      locations."/" = {
+        proxyPass = "http://127.0.0.1:${toString config.services.vaultwarden.config.ROCKET_PORT}";
+        extraConfig = ''
+        '';
+      };
+    };
+  };
+
+  services.vaultwarden = {
+    enable = true;
+    backupDir = "/var/local/vaultwarden/backup";
+    environmentFile = config.sops.secrets.vaultwarden_env.path;
+    config = {
+      DOMAIN = "http://keys.malobeo.org";
+      SIGNUPS_ALLOWED = true;
+      #WEBSERVER
+      ROCKET_ADDRESS = "127.0.0.1";
+      ROCKET_PORT = 8222;
+      ROCKET_LOG = "critical";
+      #EMAIL
+      SMTP_HOST = "mail.systemli.org";
+      SMTP_PORT = 465;
+      SMTP_SECURITY = "force_tls";
+      SMTP_USERNAME = "malobot@systemli.org";
+
+      SMTP_FROM = "malobot@systemli.org";
+      SMTP_FROM_NAME = "Malobeo Vaultwarden Server";
+    };
+  };
+
+  system.stateVersion = "22.11"; # Did you read the comment?
+}
+
--- a/machines/vaultwarden/dummy.yaml
+++ b/machines/vaultwarden/dummy.yaml
@@ -0,0 +1,64 @@
+vaultwarden_env: ENC[AES256_GCM,data:dgEYC2VcGKrIvts9sw60kmEemhRdaaLWvsEQjAE52mAfhA29iLpB/sKXt3bxRGV8gpSF8OQoXdniWwCrDhOWUihawy2WFhLENamIyY4tVBOKkEtkhQDkoAhZ1VCShb1fgN+BzfM=,iv:zvg1uh8fxeHNFOq/DpicwAk+5j1fDogrnpTX5Ua0yDQ=,tag:rcyLE928+DQF41y4ztvMbQ==,type:str]
+sops:
+    age:
+        - recipient: age18jn5mrfs4gqrnv0e2sxsgh3kq4sgxx39hwr8z7mz9kt7wlgaasjqlr88ng
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1ZE9qK2tmTWxERklOSFdZ
+            bVVUbW5aajFrWkVBREZtallvS1dreGNFVjJFCmdBdGNQQzZkMUp4dzZUYTg1Tmgr
+            K3BmajYxY01jdVVubmRUUy8rNm9oVTgKLS0tIGNtTTQwWUdzaXpjVGt5aTEvUFZy
+            UWlGRzhPcDlVb0s2OGJTOTBVS2RKVDAKKyFK+ISjqbwOftiDn5uuIJfAl3fkX4C9
+            iNHl84utfFyeUnJJK59uX3YGY8B4wEG7L3/hPt9gLtuX6Ey64yusIA==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0Y1l4Uzd1TjlKbHpuQ01v
+            YnFFWWRNNU1relVHSTk4ZjE5eXdnS2czZWpBCnJwbmRhdUtkVDUrcnFJSmVmcjBJ
+            eVBDd0l5bEovZEpRdEZMTlFMUFJ1UjAKLS0tIGo5bEQ3Tis0aXcyc1JxSVRCeXFU
+            OXFDMHExSWQ4U0RleXBqaXBGcnhEUmsKmBGLpusD28V406Gz9uHV0N43J9wEWkY3
+            WJ8R2OjVeRfMmOriWLzEkHHJw+3DJc9abzSOoIS/ViN30MkhdqzOMA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-02-03T20:56:51Z"
+    mac: ENC[AES256_GCM,data:zkykMvBMjSmyhSPFTvyeUVZZwu0Fb4cgXD4m4lWQWKEXiHeCHQEy6YIxqutdW6vjaO/P64Hk72OH4Dh/gDl+riMbWIpFwtkzIWvclqui+PmdMoRG7u8oLa7wE9C/zypTw0yzbREyeoouIZq4zzWZsCmljfgcYSpMpQxdWgYkkbU=,iv:WbW7NAZUb2B7421chzK9LDUEkpGJ9rvnuA3jW3VjlZs=,tag:HiOV2LSLqsv+XGrVB0MugQ==,type:str]
+    pgp:
+        - created_at: "2026-02-03T20:09:53Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQGMA5HdvEwzh/H7AQwAmyshbidzh+sGpxfFEAbvcLv02pt31PopMM9XzceV0z17
+            7MaJ8+qZpif1SMpyjNmrZ4vvBa/nGF55tHLGQ+jijsEqqOqnR1+MihxLBX71wRVj
+            G9VdoaSnlKTgXLbtimo7qRjNIm4UaONLIw9M7l4DwhUNxYucNEr2eFy2wzrNgmDF
+            As5NswJXap0maBb78ieevqlTa7mE5I9FyBgTDsMubBZpD9CU6+vav9KrYLwgDuKj
+            X2SFfIo3SJdZFHDTTS3e/DTpRRf80bJ5PDChiDZ3Qr3SmaV7m+0V2EMRT7duoZ7J
+            bremMsVJo+0RhuncLgIWXFDiqU43VVfriQJeTFFTaqzqqnWTn+1Nx1ORH5NmhBhk
+            qMi2Eqc7K15Q/0AU8lHYOOvYdn62OjdyJciCBq/hTSscEpRxJNvz5G+WChMJyU6X
+            PytHqw2mFNs3jx3DleAZat+SBD8aa1e4ORC5AIVVAaVdsT4a1lFJ5V1jlk5ddg55
+            tFPh2qOqGX4V6HBBZS740lgBo7EYNFeKleDKCN8jjJYyUUfC13JnaWJy/5/9xMyi
+            YtTh7w5lTFV349zlBZSLqPuunanGN+dylWSZZrp5XTw7Q/rpa7za5LwjcDQpwaY1
+            FaFNoImglFKQ
+            =C4re
+            -----END PGP MESSAGE-----
+          fp: c4639370c41133a738f643a591ddbc4c3387f1fb
+        - created_at: "2026-02-03T20:09:53Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA98TrrsQEbXUAQ//Z6puWp6MFQZgNp95JMkCJyVMKAYDUJ4d/WRMWWxaA8pt
+            dtWokpON0st30dhXBGsicUGjAsM15gIuN3d5I2hDQqGA5Dt2LchBjdt392FoTpij
+            fdwUKpwhi91j71PrbRP1iCS6+66t5rDmUk8AWNv+9eA/4xJ+JQKgZWpBv19qbc9i
+            sb6IjhuZ3/m1Yooh7LywKUM/5qeWSeH5QFfpbhrCLLEmpL6W4/6LMl/HcF+on4h6
+            6bMZQoT+cFInBw9N3Rq4B8ffwahlkf2bv17k8sjEBvrH+rpFi85Kh0pBB8elPiUr
+            4zMJkuZZcv4YfUFoxSqVcUee5uen8RtoOHMM2tSuEq8Mjo86oIA95JkROhGLq9qz
+            NPq7k4DyotMf/2T6fZJ1nQOWAoH9ZJp4Q10qTc/Xg4xzWBlpwZh9oaLBw+HdUsYm
+            mP2ZvPw1/FHJuP2RhMz/kbEoeABm3JMGFPg1BmvVudZsr7kLpByPRGcKtm3qjARW
+            9+6fp0AYXw3C1fpYsQC+CwaSaw57GiiITtGTHCWR70yuV+G3ev/uqsFjj+96c8gy
+            h7hJaI0Ff2bFakkuwRb64UsY4FjJel1oyvDbW6y2IIswwYpzBEMV5ANzPGMIvw/G
+            x1+olgWwhXTaLZ9jIaVDfcZ2SL6v6VcMoOBhiWbeqdm+BFEkZsOitZARDIcl1trS
+            WAGu6rvESbtRp/G1ATxmP9xHCTfjNHKRj8D1eHfkObjFFG2DSL9BXozBBuvkJi8H
+            CPqVEOQZMheyU2ZnH1JNXQyANBAllEJ++XdFB5RvcTNxxeJS/APS9NM=
+            =zSyS
+            -----END PGP MESSAGE-----
+          fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4
+    unencrypted_suffix: _unencrypted
+    version: 3.11.0
--- a/machines/vaultwarden/secrets.yaml
+++ b/machines/vaultwarden/secrets.yaml
@@ -0,0 +1,64 @@
+vaultwarden_env: ENC[AES256_GCM,data:AsgpcUGW8y5WKL+9pOYemupgB6eVlMSLYj7uCFtYQFisjGcCwBFcGTKRpzMysroo32Ugicl8WImGybrmqdJ/Xht9lAx2ralNHrgSpps3QFg+c34LFVP/F1FO3Vk+jjU00XcV1uVghxpRh95HSTEVuu9kgjYeWpAQVqp68Ku2Dww=,iv:/9l4smzqPpB5Qr+mcroiLUnRg+9GQ+pmxF523N1bOIU=,tag:jBmrxvfA8HG1Gp1KHgwssw==,type:str]
+sops:
+    age:
+        - recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsMk9xN1ZLSFc2QWQza3Zp
+            R0ladFBENFpXYWdjOE9XZm9Eek91dGxGOGdvCnpVaXU1RTZpVXYrZThGOEdnNytn
+            Vi95MTJNS09EMU5WMWwvRGlLUUdudEEKLS0tIGtUOWlWSSs0STA5ZkU0RzZpQ1c1
+            bGpVcVJJWk0vMUNoaEJvY3ZLNTRacWcKLkRr+vi2oIPiB1BbSTX71FFKuxysxE0n
+            0+0aHEFAj8LX3hyEiDzQA3IkX9GP9ba/x+XUMBdWwyw25MnUMVFKTQ==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1zs9puemeevc5kt84w9d2mc5396w0t9p60qxymkpatwvwxunzs5usmxr3an
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwS0ZHOXJSUTdlMGIzU0Nh
+            SzJDcHdvb3dmZ3dTWFJkaE9wZXFmVE9ZUkJBCjk4eTRhb3RkTlJRSUVSK2RWbDc0
+            cEtycnFOZlU5ellTSFZXc2ZVZ3lwZU0KLS0tIHpyQ1NCR2dWNURxT0pxcmxMWTlo
+            NGJqai9HNjdkc1NOTGRtSFZWWDIvQkEKe3GqRFTdMQwPbavO6bDobWMf7FwJx1OA
+            7JufIAMJORTfDTyC2fN3bpcZ+UcbPm2pplyzJ6T5p4wOFqQhRrHHyQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-02-03T20:58:16Z"
+    mac: ENC[AES256_GCM,data:zxM4GRwlcYoJF51Hbe0VfWvO9PrHQeCUTrGgiVgrP91qX51WTGWfCQfAVAouT3sEvE6Ie5bnAMUWjVjIrnRS6WUCQwUBwFYYUKIkJPooKwlvXRAuZ9UGZERi0/i43WKwB3/xSyVqRb9T5M6exjlkYCuE4Yv3lSEUiIn8fu/Zaas=,iv:D6f3V19E+4qukW8i9wKtNPKfYgD3OXztkICMhD24IzY=,tag:e97txZiaqDPxCLQUbNHwwg==,type:str]
+    pgp:
+        - created_at: "2026-02-05T17:22:42Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQGMA5HdvEwzh/H7AQv/XLqprcMEI3EYKJw/DA5w64lHAXKzkf8bKpFPWYSnbqMT
+            ajDkcOhA+KMRt1Qgr8aCW7cnWLfy6Ff7U2rSFQ4uBgGKChmYSiMiPdEokYQuYbFE
+            pJh/j4qGcewVpQDVe6N+obqZ0n5oQImn0mO8KkXjrcBhrhuLThAeNxFl7RILOfD0
+            HPFYwy6vMIVPFYCAm4CqIjsMo4feCPYcpxJJwO4aRISkR8vcGAgu9/wWhQIxvdPf
+            O4gTcRshfX6C+TwnwW6Ac7D1rDS5HBnQF4pD4wfYEI00qHKHgeYC4TrEnmta6MG2
+            bvOQBbAUDSf3heEcQ3CwqcRDHzIssAlbW3p9nBRUVOuOta+3rV29lSuz8cbEqVOs
+            MOwN/atluA1jhWgZbt+8SuoleHnbR+hJNJnplvoKN2PmJ3tEbpSCaRaZVaaRFEhm
+            K1tLG2B5IaKMY4n0N1bPnFcvL7s1xS0INPodXzJITyvuJssEL5Dc+YEWxNvEmHGJ
+            ttlyHBJCxWOHsPMh2UcB0lgBBtJt+O2lcAIpwky9T2ufj1EFzLkXV4Sf39S6J/PI
+            814IQE1Bmuy1qqkGhc6WthiooVf/udtWgehwQFwrpY+35GaNQHluFJOrthqraYXK
+            shMbX3AZdLuu
+            =w602
+            -----END PGP MESSAGE-----
+          fp: c4639370c41133a738f643a591ddbc4c3387f1fb
+        - created_at: "2026-02-05T17:22:42Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA98TrrsQEbXUARAAiZsUiicVpIDdSF/XSuZOITPwmL0P1Nyc1LI9QpyQw2fj
+            uaoJV3xO+MW4ovDcJRms/6T5b4IG740s19l/iryd2jhPwn+94EkzhR1cRydvCimU
+            Zexf+y793kKe0TbcNvakAnpArI5RPdAIoPB7V2aa0vweABaxE5XoDedJA646wMbl
+            +pgzVxoE7i6+uxWHGw3MitCneiBcljg9g04FVj9doJfG6LQxfpx01pjiRLVsTGfV
+            LXPLKVJOToEusFz1hLaFMLxPkvFbgQD1YQz82OOJasHr9YGCzitqhA+EV4U4Y9AH
+            bzPlz1qractUIz8pawhKcTUd8Xw+WOZ6kFX3EdUUnD46jMf12j2fe9Axw8v+Cujx
+            jb8+mSbRNH8Tx/phbhWyBhTNhNXoMLW/2nTSJjTUvdjNlIJi3Ntu4AyPpZ9Z2LwM
+            azvzHRC20gEsf25YKAv2/EnOAi7/jx9uknj3pATdaAAS5hKcMutVdiBAPS37695W
+            Fh8aaoCb4ieuHmHFAt0SQ30z/oR2psurwaurGcLQz9IR9uUlCFU9uVifDaSCNiwF
+            EVsRQZAslLqGPDf7c/r8efsMcHRfVVCJvvuvyRZNSHIpOnR/QGLOeNY+B59IdTCJ
+            fk2dMvZpyM1AdLkW2jT0qXj4vKAvVPlEbIXmq9bu/jJER35MzMRWfMmbBzek9t3S
+            WAGL4Zf96omkP7Z9j1UYGv4xcGksajbA6HvCHfjI+mUKV4QxGieeJhicaPYLuo7x
+            wKZqzMZGPpy1dPq75t0RAmnRzHaB9VEUWfO+KYIY/+1qRxOANYl+uZA=
+            =K3Hh
+            -----END PGP MESSAGE-----
+          fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4
+    unencrypted_suffix: _unencrypted
+    version: 3.11.0
--- a/machines/vpn/configuration.nix
+++ b/machines/vpn/configuration.nix
@@ -41,6 +41,19 @@ with lib;
    };

    virtualHosts."cloud.malobeo.org" = {
+      locations."/" = {
+        proxyPass = "http://10.100.0.101";
+        extraConfig = ''
+          proxy_set_header Host $host;
+          client_max_body_size ${inputs.self.nixosConfigurations.nextcloud.config.services.nextcloud.maxUploadSize};
+          client_body_timeout 3600s;
+          send_timeout 3600s;
+          fastcgi_buffers 64 4K;
+        '';
+      };
+    };
+
+    virtualHosts."keys.malobeo.org" = {
      locations."/" = {
        proxyPass = "http://10.100.0.101";
        extraConfig = ''
@@ -81,7 +94,7 @@ with lib;
          client_body_in_file_only clean;
          client_body_buffer_size 32K;
          
-          client_max_body_size 50M;
+          client_max_body_size 500M;
          
          sendfile on;
          send_timeout 300s;
--- a/scripts/unlock-boot.sh
+++ b/scripts/unlock-boot.sh
@@ -24,14 +24,16 @@ diskkey=$(sops -d machines/$hostname/secrets/disk.key)
 echo
 if [ $# = 1 ]
    then
-    echo "$diskkey" | ssh $sshoptions root@$hostname-initrd "systemd-tty-ask-password-agent" #root
+    ssh $sshoptions root@$hostname-initrd "zpool import -a"
+    echo "$diskkey" | ssh $sshoptions root@$hostname-initrd "zfs load-key storage/encrypted" #root
    echo "$diskkey" | ssh $sshoptions root@$hostname-initrd "systemd-tty-ask-password-agent" #data

 elif [ $# = 2 ]
    then
    ip=$2
-    echo "$diskkey" | ssh $sshoptions root@$ip "systemd-tty-ask-password-agent" #root
-    echo "$diskkey" | ssh $sshoptions root@$ip "systemd-tty-ask-password-agent" #data
+    ssh $sshoptions root@$ip "zpool import -a"
+    echo "$diskkey" | ssh $sshoptions root@$ip "zfs load-key storage/encrypted" 
+    echo "$diskkey" | ssh $sshoptions root@$ip "systemd-tty-ask-password-agent"
    
 else
    echo
Author	SHA1	Message	Date
ahtlon	96af871f70	[vaultwarden] add vaultwarden key and rekey secrets All checks were successful Check flake syntax / flake-check (push) Successful in 12m3s Details	2026-02-05 18:22:59 +01:00
ahtlon	73cc0e3674	[vaultwarden] change all secrets to use env file; add dummy.yaml All checks were successful Check flake syntax / flake-check (push) Successful in 7m9s Details	2026-02-03 22:03:55 +01:00
kalipso	5517d3b136	[fanny] deploy vaultwarden All checks were successful Check flake syntax / flake-check (push) Successful in 5m40s Details	2026-01-26 21:22:14 +01:00
kalipso	db9dec5c79	[vaultwarden] fix config All checks were successful Check flake syntax / flake-check (push) Successful in 5m48s Details	2026-01-26 21:14:03 +01:00
kalipso	55825fb4b7	[vaultwarden] add to hosts	2026-01-26 21:13:35 +01:00
kalipso	2d9e65442e	[vaultwarden] add forward proxy through vpn	2026-01-26 21:13:09 +01:00
kalipso	4f6acde34b	Merge branch 'master' into vaultwarden	2026-01-26 14:24:48 +01:00
kalipso	4be95a53ca	[overwatch] add dummy secrets All checks were successful Check flake syntax / flake-check (push) Successful in 5m25s Details	2026-01-26 14:21:56 +01:00
kalipso	058942aa6f	[overwatch] fix from_address/name All checks were successful Check flake syntax / flake-check (push) Successful in 5m52s Details	2026-01-24 19:13:59 +01:00
kalipso	449c23eb87	[overwatch] add machine to sops Some checks failed Check flake syntax / flake-check (push) Has been cancelled Details	2026-01-24 19:06:23 +01:00
kalipso	f0b9142562	[overwatch] configure grafana smtp All checks were successful Check flake syntax / flake-check (push) Successful in 7m45s Details	2026-01-24 18:35:01 +01:00
kalipso	6350e41131	[overwatch] set retentiontime to 1y All checks were successful Check flake syntax / flake-check (push) Successful in 11m22s Details	2026-01-24 00:02:03 +01:00
kalipso	6e144925b2	[zineshop] raise max body size to 500M All checks were successful Check flake syntax / flake-check (push) Successful in 9m50s Details	2026-01-19 12:17:51 +01:00
kalipso	649249a162	[flake] update zineshop Some checks failed Check flake syntax / flake-check (push) Has been cancelled Details	2026-01-19 11:57:43 +01:00
ahtlon	087a8a6220	[Vaultwarden] outline All checks were successful Check flake syntax / flake-check (push) Successful in 6m33s Details	2025-12-23 19:18:49 +01:00
ahtlon	2fda92f712	Merge branch 'staging' All checks were successful Check flake syntax / flake-check (push) Successful in 22m9s Details	2025-12-23 19:14:25 +01:00
ahtlon	6e6448eeca	[nextcloud] fix hash for xustom deck32 app All checks were successful Check flake syntax / flake-check (push) Successful in 12m51s Details	2025-12-23 19:13:22 +01:00
kalipso	530c0cc5f3	[zineshop] re-enable	2025-12-23 19:13:22 +01:00
ahtlon	633b2f4dc7	Fix nix check; Also i disabled the zineshop temporairly	2025-12-23 19:13:22 +01:00
kalipso	af9253b91c	[nixpkgs] 25.05 -> 25.11	2025-12-23 19:13:22 +01:00
kalipso	a2f8d84d96	[nixpkgs] update	2025-12-23 19:13:22 +01:00
kalipso	9899889924	[nextcloud] adjust nginx for large fileuploads All checks were successful Check flake syntax / flake-check (push) Successful in 11m51s Details	2025-12-22 19:37:13 +01:00
kalipso	b3e93349d1	[nextcloud] use fix body size in external code All checks were successful Check flake syntax / flake-check (push) Successful in 5m53s Details	2025-12-10 12:07:15 +01:00
kalipso	f7d00246e8	[nextcloud] set max_body_size in nginx proxy chain All checks were successful Check flake syntax / flake-check (push) Successful in 12m0s Details	2025-12-10 10:55:38 +01:00
kalipso	a79afe7dea	[nextcloud] enable postgresql backup All checks were successful Check flake syntax / flake-check (push) Successful in 8m7s Details if we need to restore from backup this is necessary since db state from zfs snapshots might be corrupted	2025-12-10 10:38:27 +01:00
ahtlon	b94574c640	[fanny] fix flushing init vpn All checks were successful Check flake syntax / flake-check (push) Successful in 4m46s Details	2025-11-15 18:02:20 +01:00
kalipso	a97de389e5	[fanny] fix typo Some checks failed Check flake syntax / flake-check (push) Failing after 2m48s Details	2025-11-15 17:21:45 +01:00
kalipso	845379ac86	[fanny] flush wg-initd Some checks failed Check flake syntax / flake-check (push) Failing after 2m52s Details	2025-11-15 17:17:40 +01:00
kalipso	e91481c405	[initssh] network.flushBeforeStage2 All checks were successful Check flake syntax / flake-check (push) Successful in 10m17s Details	2025-11-15 16:50:07 +01:00
kalipso	d3312c870a	[fanny] remove zfs-remote-unlock All checks were successful Check flake syntax / flake-check (push) Successful in 5m19s Details	2025-11-15 16:37:11 +01:00
kalipso	eee561b650	[fanny] set /24 for wg ip All checks were successful Check flake syntax / flake-check (push) Successful in 4m51s Details	2025-11-15 16:22:03 +01:00
ahtlon	a612221e2a	change script to first import storage before unlocking root All checks were successful Check flake syntax / flake-check (push) Successful in 4m49s Details	2025-11-15 16:12:32 +01:00
kalipso	73c482ece0	[fanny] set vpn pubkey All checks were successful Check flake syntax / flake-check (push) Successful in 4m53s Details	2025-11-15 16:07:17 +01:00
kalipso	4d4e9d980b	[initssh] add iproute2 All checks were successful Check flake syntax / flake-check (push) Successful in 4m55s Details	2025-11-15 15:48:40 +01:00
kalipso	beb3839a6b	[initssh] add wireguard-tools	2025-11-15 15:47:38 +01:00
kalipso	0df32bf47c	[initssh] fix busybox	2025-11-15 15:47:02 +01:00
kalipso	f6bbbdec3e	[initssh] add pkgs.busybox to initrd All checks were successful Check flake syntax / flake-check (push) Successful in 4m47s Details	2025-11-15 15:11:47 +01:00
kalipso	2a5539c204	[fanny] import storage in systemd script All checks were successful Check flake syntax / flake-check (push) Successful in 8m51s Details	2025-11-15 14:51:51 +01:00
kalipso	9588103e67	[fanny] import storage on boot All checks were successful Check flake syntax / flake-check (push) Successful in 4m52s Details	2025-11-15 14:30:57 +01:00