Merge remote-tracking branch 'origin/autoupdate'

Merge pull request 'update the update domain to prepare for repo move' (#128 ) from move_repo into master
Reviewed-on: kalipso/infrastructure#128
2026-02-21 00:33:02 +01:00 · 2026-02-21 00:23:54 +01:00 · 2026-02-20 23:55:27 +01:00 · 2026-02-20 23:49:04 +01:00 · 2026-02-20 23:22:19 +01:00 · 2026-02-20 22:58:16 +01:00
25 changed files with 534 additions and 219 deletions
--- a/.gitea/workflows/autoupdate.yml
+++ b/.gitea/workflows/autoupdate.yml
@@ -0,0 +1,110 @@
+name: Weekly Flake Update
+
+on:
+    schedule:
+        - cron: "0 0 * * 4"
+    workflow_dispatch:
+
+permissions:
+    contents: write
+
+jobs:
+    update_and_check_flake:
+        runs-on: ubuntu-latest
+        env:
+            NIXPKGS_ALLOW_UNFREE: 1
+        steps:
+            - name: Install sudo
+              run: |
+                  apt-get update
+                  apt-get install -y sudo
+            - name: Install Tea
+              env:
+                TEA_DL_URL: "https://dl.gitea.com/tea/0.9.2/tea-0.9.2-linux-amd64"
+              shell: bash
+              run: |
+                TEA_DIR=$(mktemp -d -t tmp.XXXX)
+                pushd $TEA_DIR
+                wget "$TEA_DL_URL"
+                wget "${TEA_DL_URL}.sha256"
+                if $(sha256sum --quiet -c "tea-0.9.2-linux-amd64.sha256"); then
+                mv "tea-0.9.2-linux-amd64" /usr/bin/tea
+                chmod +x /usr/bin/tea
+                popd
+                rm -rf $TEA_DIR
+                else
+                popd
+                rm -rf $TEA_DIR
+                echo "::error title=⛔ error hint::Tea v0.9.2 Checksum Failed"
+                exit 1
+                fi
+            - uses: https://code.forgejo.org/actions/checkout@v6
+            - name: Set up Nix
+              uses: https://github.com/cachix/install-nix-action@v31
+              with: 
+                github_access_token: ${{ secrets.AHTLONS_GITHUB_TOKEN }} #Fuck github
+
+            - name: Run nix flake update
+              run: nix flake update
+
+            - name: Commit flake.lock
+              run: |
+                  git config user.name "malobot"
+                  git config user.email "malobot@systemli.org"
+                  git stash push
+                  git branch nixpkgs_bump_$(date +%Y%m%d)
+                  git checkout nixpkgs_bump_$(date +%Y%m%d)
+                  git stash pop
+                  git add flake.lock
+                  git diff --staged --quiet || git commit -m "Update flake.lock"
+
+            - name: Check for eval warnings
+              id: commit
+              shell: bash
+              run: |
+                {
+                echo "COMMIT_DESC<<EOF"
+                echo "Date: $(date)"
+                echo "Evaluation warnings:"
+                nix flake check --all-systems --no-build 2>&1 | grep evaluation | awk '!seen[$0]++' || echo "None :)"
+                echo EOF
+                } >> "$GITHUB_OUTPUT"
+            
+            
+            - name: Login to Gitea
+              shell: bash
+              env:
+                GIT_SERVER_URL: https://git.dynamicdiscord.de
+                GIT_SERVER_TOKEN: ${{ secrets.AHTLONS_GITEA_TOKEN }}
+              run: >-
+                tea login add
+                -u "$GIT_SERVER_URL"
+                -t "$GIT_SERVER_TOKEN"
+            - name: Check for existing pull request
+              id: no-pr
+              continue-on-error: true
+              shell: bash
+              run: >-
+                tea pr -f head -o simple |
+                grep -q ${{ github.ref_name }} &&
+                exit 1 ||
+                exit 0
+            - name: Force push branch
+              run: git push --force -u origin nixpkgs_bump_$(date +%Y%m%d)
+            - name: Create pull request
+              if: steps.no-pr.outcome == 'success'
+              env:
+                COMMIT_MSG: Automatic Nixpkgs update
+                COMMIT_DESC: ${{ steps.commit.outputs.COMMIT_DESC }}
+              shell: bash
+              run: >-
+                tea pr create
+                -L "bump"
+                -t "$COMMIT_MSG"
+                -d "$COMMIT_DESC"
+            - name: Skip pull request
+              if: steps.no-pr.outcome == 'failure'
+              shell: bash
+              run: >
+                echo "::error title=⛔ error hint::
+                A PR already exists for this branch: ${{ github.ref_name }}"
--- a/flake.lock
+++ b/flake.lock
@@ -21,6 +21,27 @@
        "type": "github"
      }
    },
+    "dns": {
+      "inputs": {
+        "flake-utils": "flake-utils",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1768143854,
+        "narHash": "sha256-E5/kyPz4zAZn/lZdvqlF83jMgCWNxmqYjjWuadngCbk=",
+        "owner": "kirelagin",
+        "repo": "dns.nix",
+        "rev": "a97cf4156e9f044fe4bed5be531061000dfabb07",
+        "type": "github"
+      },
+      "original": {
+        "owner": "kirelagin",
+        "repo": "dns.nix",
+        "type": "github"
+      }
+    },
    "ep3-bs": {
      "inputs": {
        "nixpkgs": [
@@ -43,6 +64,21 @@
      }
    },
    "flake-utils": {
+      "locked": {
+        "lastModified": 1614513358,
+        "narHash": "sha256-LakhOx3S1dRjnh0b5Dg3mbZyH0ToC9I8Y2wKSkBaTzU=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "5466c5bbece17adaab2d82fae80b46e807611bf3",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_2": {
      "inputs": {
        "systems": "systems_3"
      },
@@ -102,7 +138,7 @@
    },
    "microvm": {
      "inputs": {
-        "flake-utils": "flake-utils",
+        "flake-utils": "flake-utils_2",
        "nixpkgs": [
          "nixpkgs"
        ],
@@ -225,6 +261,7 @@
    "root": {
      "inputs": {
        "disko": "disko",
+        "dns": "dns",
        "ep3-bs": "ep3-bs",
        "home-manager": "home-manager",
        "mfsync": "mfsync",
--- a/flake.nix
+++ b/flake.nix
@@ -13,6 +13,11 @@
    disko.url = "github:nix-community/disko/latest";
    disko.inputs.nixpkgs.follows = "nixpkgs";

+    dns = {
+      url = "github:kirelagin/dns.nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
    utils = {
      url = "github:numtide/flake-utils";
    };
--- a/machines/.sops.yaml
+++ b/machines/.sops.yaml
@@ -14,6 +14,7 @@ keys:
  - &machine_vpn age1v6uxwej4nlrpfanr9js7x6059mtvyg4fw50pzt0a2kt3ahk7edlslafeuh
  - &machine_fanny age136sz3lzhxf74ryruvq34d4tmmxnezkqkgu6zqa3dm582c22fgejqagrqxk
  - &machine_nextcloud age1g084sl230x94mkd2wq92s03mw0e8mnpjdjfx9uzaxw6psm8neyzqqwpnqe
+  - &machine_vaultwarden age1zs9puemeevc5kt84w9d2mc5396w0t9p60qxymkpatwvwxunzs5usmxr3an
  #this dummy key is used for testing.
  - &machine_dummy age18jn5mrfs4gqrnv0e2sxsgh3kq4sgxx39hwr8z7mz9kt7wlgaasjqlr88ng
 creation_rules:
@@ -103,6 +104,7 @@ creation_rules:
      - *admin_kalipso_dsktp
      age:
      - *admin_atlan
+      - *machine_vaultwarden
  - path_regex: .*/secrets/.*
    key_groups:
    - pgp:
--- a/machines/durruti/configuration.nix
+++ b/machines/durruti/configuration.nix
@@ -29,7 +29,6 @@ with lib;
    enable = true;
    enablePromtail = true;
    logNginx = true;
-    lokiHost = "10.0.0.14";
  };

  services.malobeo-tasklist.enable = true;
--- a/machines/durruti/host_config.nix
+++ b/machines/durruti/host_config.nix
@@ -43,20 +43,6 @@ in
      };
    };

-    services.nginx.virtualHosts."cloud.malobeo.org" = {
-      forceSSL = true;
-      enableACME= true;
-      locations."/" = {
-        proxyPass = "http://10.0.0.10";
-        extraConfig = ''
-          client_max_body_size 10G;
-          client_body_timeout 3600s;
-          send_timeout 3600s;
-          fastcgi_buffers 64 4K;
-        '';
-      };
-    };
-
    services.nginx.virtualHosts."keys.malobeo.org" = {
      forceSSL = true;
      enableACME= true;
@@ -67,7 +53,6 @@ in
      };
    };

-
    services.nginx.virtualHosts."grafana.malobeo.org" = {
      forceSSL = true;
      enableACME= true;
@@ -88,24 +73,6 @@ in
      };
    };

-
-    services.nginx.virtualHosts."zines.malobeo.org" = {
-      forceSSL = true;
-      enableACME= true;
-      locations."/" = {
-        proxyPass = "http://10.0.0.10";
-        extraConfig = ''
-          client_body_in_file_only clean;
-          client_body_buffer_size 32K;
-          
-          client_max_body_size 500M;
-          
-          sendfile on;
-          send_timeout 300s;
-        '';
-      };
-    };
-
    services.nginx.virtualHosts."status.malobeo.org" = {
      forceSSL = true;
      enableACME= true;
--- a/machines/fanny/configuration.nix
+++ b/machines/fanny/configuration.nix
@@ -2,11 +2,13 @@
 let
  sshKeys = import ../ssh_keys.nix;
  peers = import ../modules/malobeo/peers.nix;
+  hosts = import ../hosts.nix {};
 in
 {
  sops.defaultSopsFile = ./secrets.yaml;
  sops.secrets.wg_private = {};
  sops.secrets.shop_auth = {};
+  sops.secrets.njala_api_key = {};

  imports =
    [ # Include the results of the hardware scan.
@@ -21,6 +23,7 @@ in
      inputs.self.nixosModules.malobeo.metrics
      inputs.self.nixosModules.malobeo.users
      inputs.self.nixosModules.malobeo.backup
+      ./dyndns.nix
    ];

    virtualisation.vmVariantWithDisko = {
@@ -34,7 +37,7 @@ in
    enable = true;
    enablePromtail = true;
    logNginx = true;
-    lokiHost = "10.0.0.14";
+    lokiHost = hosts.malobeo.hosts.overwatch.network.address;
  };

  malobeo.autoUpdate = {
@@ -128,7 +131,13 @@ in
    privateKeyFile = config.sops.secrets.wg_private.path;
  };

-  services.malobeo.microvm.enableHostBridge = true;
+  services.malobeo.microvm = {
+    enableHostBridge = true;
+    interface = "enp1s0";
+    gateway = "192.168.1.1";
+    address = "192.168.1.103/24";
+  };
+
  services.malobeo.microvm.deployHosts = [ 
    "overwatch" 
    "infradocs" 
@@ -146,7 +155,17 @@ in
    };

    firewall = {
-      allowedTCPPorts = [ 80 ];
+      allowedTCPPorts = [ 80 443 ];
+    };
+  };
+
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "malobeo@systemli.org";
+    defaults = {
+      dnsProvider = "njalla";
+      credentialsFile = config.sops.secrets.njala_api_key.path;
+      dnsPropagationCheck = false;
    };
  };

@@ -154,16 +173,34 @@ in
    enable = true;
    virtualHosts."docs.malobeo.org" = {
      locations."/" = {
-        proxyPass = "http://10.0.0.11:9000";
+        proxyPass = "http://${hosts.malobeo.hosts.infradocs.network.address}:9000";
        extraConfig = ''
          proxy_set_header Host $host;
        '';
      };
    };

-    virtualHosts."cloud.malobeo.org" = {
+    virtualHosts."cloud.hq.malobeo.org" = {
+      forceSSL = true;
+      enableACME = true;
+      acmeRoot = null;
      locations."/" = {
-        proxyPass = "http://10.0.0.13";
+        proxyPass = "http://${hosts.malobeo.hosts.nextcloud.network.address}";
+        extraConfig = ''
+          proxy_set_header Host $host;
+          client_max_body_size ${inputs.self.nixosConfigurations.nextcloud.config.services.nextcloud.maxUploadSize};
+          client_body_timeout 3600s;
+          send_timeout 3600s;
+          fastcgi_buffers 64 4K;
+        '';
+      };
+    };
+
+    virtualHosts."cloud.malobeo.org" = {
+      forceSSL = true;
+      enableACME = true;
+      locations."/" = {
+        proxyPass = "http://${hosts.malobeo.hosts.nextcloud.network.address}";
        extraConfig = ''
          proxy_set_header Host $host;
          client_max_body_size ${inputs.self.nixosConfigurations.nextcloud.config.services.nextcloud.maxUploadSize};
@@ -176,7 +213,7 @@ in

    virtualHosts."keys.malobeo.org" = {
      locations."/" = {
-        proxyPass = "http://10.0.0.16";
+        proxyPass = "http://${hosts.malobeo.hosts.vaultwarden.network.address}";
        extraConfig = ''
          proxy_set_header Host $host;
        '';
@@ -185,7 +222,7 @@ in

    virtualHosts."grafana.malobeo.org" = {
      locations."/" = {
-        proxyPass = "http://10.0.0.14";
+        proxyPass = "http://${hosts.malobeo.hosts.overwatch.network.address}";
        extraConfig = ''
          proxy_set_header Host $host;
        '';
@@ -194,19 +231,38 @@ in

    virtualHosts."tasklist.malobeo.org" = {
      locations."/" = {
-        proxyPass = "http://10.0.0.5:8080";
+        proxyPass = "http://${hosts.malobeo.hosts.durruti.network.address}:8080";
        extraConfig = ''
          proxy_set_header Host $host;
        '';
      };
    };

-    virtualHosts."zines.malobeo.org" = {
-      # created with: nix-shell --packages apacheHttpd --run 'htpasswd -B -c foo.txt malobeo'
-      # then content of foo.txt put into sops
-      # basicAuthFile = config.sops.secrets.shop_auth.path;
+    virtualHosts."zines.hq.malobeo.org" = {
+      forceSSL = true;
+      enableACME = true;
+      acmeRoot = null;
      locations."/" = {
-        proxyPass = "http://10.0.0.15:8080";
+        proxyPass = "http://${hosts.malobeo.hosts.zineshop.network.address}:8080";
+        extraConfig = ''
+          proxy_set_header Host $host;
+
+          client_body_in_file_only clean;
+          client_body_buffer_size 32K;
+          
+          client_max_body_size 50M;
+          
+          sendfile on;
+          send_timeout 300s;
+        '';
+      };
+    };
+
+    virtualHosts."zines.malobeo.org" = {
+      forceSSL = true;
+      enableACME = true;
+      locations."/" = {
+        proxyPass = "http://${hosts.malobeo.hosts.zineshop.network.address}:8080";
        extraConfig = ''
          proxy_set_header Host $host;

--- a/machines/fanny/dummy.yaml
+++ b/machines/fanny/dummy.yaml
@@ -1,9 +1,8 @@
 wg_private: ENC[AES256_GCM,data:YEmIfgtyHE9msYijva0Ye2w7shVmYBPZ3mcKRF7Cy20xa6yHEUQ0kC2OWnM=,iv:ouK6fHcrxrEtsmiPmtCz9Ca8Ec1algOifrgZSBNHi74=,tag:524e/SQt++hwVyeWruCsLg==,type:str]
+njala_api_key: ENC[AES256_GCM,data:uEzx7KeI7ZZP63Igu5vHmuvASVxJai8bezM40UZVobQMr7r6opjnVTc0BPyIGfnG2mx/6Bo=,iv:lch04oGn6bkqtBGVzYlz6B97FGXlGOoxkiT1IplSxm4=,tag:bzXx2jSqFBv1hgJO1r5i+w==,type:str]
+njalacloud: ENC[AES256_GCM,data:Xg85D9LMMYd8po8vrpxHZA==,iv:L5Gsm3bX61WW1PAdWswFNrScFoBipS2qDGU7iTubt1U=,tag:M2PCfE1h4IkW/iFq8XeIrA==,type:str]
+njalazines: ENC[AES256_GCM,data:ooDRj4HqKVFrgRyzgFGQjg==,iv:9X8r1eY+6FqXv19mO0uMRd5A2tpvtmT11P77t9BQaCk=,tag:4BE55c8x66/UxyTCpCmdUg==,type:str]
 sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
    age:
        - recipient: age18jn5mrfs4gqrnv0e2sxsgh3kq4sgxx39hwr8z7mz9kt7wlgaasjqlr88ng
          enc: |
@@ -23,8 +22,8 @@ sops:
            NjJ5cFdTVS9NZmVWMjcrcHo2WDZEZDgKiDwkuUn90cDmidwYGZBb5qp+4R1HafV0
            vMQfjT9GrwB5K/O1GumOmvbzLNhvO2vRZJhfVHzyHLzQK64abQgF5Q==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-01-19T22:46:09Z"
-    mac: ENC[AES256_GCM,data:eU3SIqAGrgbO2tz4zH1tgYcif7oe5j+/wmdYl2xXXI+D6IhiKrTJGvzE3rd3ElEpb+Bg0UQId952U2Ut0yPTfxGLtdlbJA66CmhLAksByoJ8lOXUcp/qDyA4yMRSuwYG2v7uF2crvue9fyRfZ7hl7abE/Q7Z2UjOKqhSZC5cO3U=,iv:NmCVvtBWZRzhpr5nMLy+98VuQZWoUms7xFSxq8PMvBA=,tag:UWjA7oqoNWh4wb0myNg7FA==,type:str]
+    lastmodified: "2026-02-20T19:26:21Z"
+    mac: ENC[AES256_GCM,data:D8ZOgcDCY+I2rFc6+GSRj53QjnhZP0oz5wPgG2x4dOfVRWYMEgR2pnb/IIF95Dq0XR6ja9PLgw42PfdI1dS7vITb1jW5IExcnkB/Pa/RjB3GFeXPFTV6QCAQcK9cLct6yhB/pPbHdt8qHQt7kddiN162RlMHDyR6BAh4gO0Rf3w=,iv:f1RWrxbqNNUdANDR6V+OFuEYJ2ZLVde+5GTcFmSXYSQ=,tag:IBEdkSEz/w4Rxwb6uSBpTw==,type:str]
    pgp:
        - created_at: "2025-01-19T22:45:26Z"
          enc: |-
@@ -65,4 +64,4 @@ sops:
            -----END PGP MESSAGE-----
          fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4
    unencrypted_suffix: _unencrypted
-    version: 3.9.2
+    version: 3.11.0
--- a/machines/fanny/dyndns.nix
+++ b/machines/fanny/dyndns.nix
@@ -0,0 +1,25 @@
+{pkgs, ...}:
+{
+  sops.secrets.njalacloud = {};
+  sops.secrets.njalazines = {};
+  systemd.services."dyndns" = {
+    script = ''
+      KEYCLOUD=$(cat /run/secrets/njalacloud)
+      KEYZINES=$(cat /run/secrets/njalazines)
+      ${pkgs.curl}/bin/curl --fail --silent --show-error "https://njal.la/update/?h=cloud.malobeo.org&k="$KEYCLOUD"&auto"
+      ${pkgs.curl}/bin/curl --fail --silent --show-error "https://njal.la/update/?h=zines.malobeo.org&k="$KEYZINES"&auto"
+    '';
+    serviceConfig = {
+      Type = "oneshot";
+      User = "root";
+    };
+  };
+  systemd.timers."dyndns" = {
+    wantedBy = ["timers.target"];
+    timerConfig = {
+      OnBootSec = "100s";
+      OnUnitActiveSec = "10m";
+      Unit = "dyndns.service";
+    };
+  };
+}
--- a/machines/fanny/secrets.yaml
+++ b/machines/fanny/secrets.yaml
@@ -1,11 +1,10 @@
 wg_private: ENC[AES256_GCM,data:kFuLzZz9lmtUccQUIYiXvJRf7WBg5iCq1xxCiI76J3TaIBELqgbEmUtPR4g=,iv:0S0uzX4OVxQCKDOl1zB6nDo8152oE7ymBWdVkPkKlro=,tag:gg1n1BsnjNPikMBNB60F5Q==,type:str]
 shop_cleartext: ENC[AES256_GCM,data:sifpX/R6JCcNKgwN2M4Dbflgnfs5CqB8ez5fULPohuFS6k36BLemWzEk,iv:1lRYausj7V/53sfSO9UnJ2OC/Si94JXgIo81Ld74BE8=,tag:5osQU/67bvFeUGA90BSiIA==,type:str]
 shop_auth: ENC[AES256_GCM,data:0NDIRjmGwlSFls12sCb5OlgyGTCHpPQIjycEJGhYlZsWKhEYXV2u3g1RHMkF8Ny913jarjf0BgwSq5pBD9rgPL9t8X8=,iv:3jgCv/Gg93Mhdm4eYzwF9QrK14QL2bcC4wwSajCA88o=,tag:h8dhMK46hABv9gYW4johkA==,type:str]
+njalacloud: ENC[AES256_GCM,data:sp79Ij1vd9pQZuPUR1phmw==,iv:AWKZoOfBA/n16pWQCfA0dZmH1KajCztnLvYItoZZbgA=,tag:BIUrobBoO96pxUz1sjIYIw==,type:str]
+njalazines: ENC[AES256_GCM,data:fnObUEnXYvdj9HtkZNzXVA==,iv:0Zj2n2we9w4fj/n7e1ayd9XgFEMAGCHk4QLTu1IlRnQ=,tag:zeOLAB0oE6XbxqdqhdRNxw==,type:str]
+njala_api_key: ENC[AES256_GCM,data:ohSVzQUvFjia/s9WceqnZCdLyk3N1Lm2BCBmXeBlkWD2dyrohKCnd9GiJ499IORpuYcOXyM=,iv:Uczk8op5mgqe8gefxgU9YuTqOsYvjzHCKvzA7GDsgio=,tag:XA7JRq/LsGkpHcQSO36Whg==,type:str]
 sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
    age:
        - recipient: age136sz3lzhxf74ryruvq34d4tmmxnezkqkgu6zqa3dm582c22fgejqagrqxk
          enc: |
@@ -25,8 +24,8 @@ sops:
            QVZyNWVOMTh3ejBha21Qb2xCRkFERGMKH9nMQUoS5bGcLUx2T1dOmKd9jshttTrP
            SKFx7MXcjFRLKS2Ij12V8ftjL3Uod6be5zoMibkxK19KmXY/514Jww==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-04-14T10:34:55Z"
-    mac: ENC[AES256_GCM,data:vcDXtTi0bpqhHnL6XanJo+6a8f5LAE628HazDVaNO34Ll3eRyhi95eYGXQDDkVk2WUn9NJ5oCMPltnU82bpLtskzTfQDuXHaPZJq5gtOuMH/bAKrY0dfShrdyx71LkA4AFlcI1P5hchpbyY1FK3iqe4D0miBv+Q8lCMgQMVrfxI=,iv:1lMzH899K0CnEtm16nyq8FL/aCkSYJVoj7HSKCyUnPg=,tag:mEbkmFNg5VZtSKqq80NrCw==,type:str]
+    lastmodified: "2026-02-20T19:25:05Z"
+    mac: ENC[AES256_GCM,data:g+bFYqJN1X8F52tpIO60S2WKxLG27ZrP399fsfE6o7rPtIMimZou/4oUo7i+kpNtygEuCr3+suP8TPas4x5zMXhRjnjJuwJwL/NwdciHZU0O3rPJgucCEWqr9OdAtxezDM9c2vv+jzqZxWT9t0fIpB9RxO5oy1pHZs0RCgjAJR4=,iv:v6RdTMeQUxSdjIVNFbx2HtxCsdVgFTQTzMXS5Fj62is=,tag:pLoZMBRIXYElO5rY+xX9zg==,type:str]
    pgp:
        - created_at: "2025-02-11T18:32:49Z"
          enc: |-
@@ -67,4 +66,4 @@ sops:
            -----END PGP MESSAGE-----
          fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4
    unencrypted_suffix: _unencrypted
-    version: 3.9.4
+    version: 3.11.0
--- a/machines/hosts.nix
+++ b/machines/hosts.nix
@@ -1,90 +1,107 @@
 { ... }:

+let
+  createMaloNet = hostId: mac: {
+    local = true;
+    hostId = hostId;
+    address = "192.168.1.${hostId}";
+    gateway = "192.168.1.1";
+    nameservers = [ "192.168.1.1" "1.1.1.1" ]; #setting ns1 as nameserver
+    mac = mac;
+  };
+
+  createOffsiteNet = hostId: mac: {
+    local = false;
+    hostId = hostId;
+    address = "10.0.0.${hostId}";
+    gateway = "10.0.0.1";
+    nameservers = [ "1.1.1.1" ];
+    mac = mac;
+  };
+in
 {
+  #TODO: fix local 192.168.1.0/24 addresses they are just palceholders!
  malobeo = {
    hosts = {
      louise = {
        type = "host";
+        network = {
+          local = true;
+          hostId = "11";
+          address = "192.168.1.101";
+        };
      };

      bakunin = {
        type = "host";
+        network = {
+          local = true;
+          hostId = "12";
+          address = "192.168.1.102";
+        };
      };
-
+  
      fanny = {
        type = "host";
+        network = {
+          local = true;
+          hostId = "13";
+          address = "192.168.1.103";
+        };
      };
-
+  
      lucia = {
        type = "rpi";
+        network = {
+          local = true;
+          hostId = "15";
+          address = "192.168.1.105";
+        };
      };
-
+  
      durruti = {
        type = "microvm";
-        network = {
-          address = "10.0.0.5";
-          mac = "52:DA:0D:F9:EF:F9";
-        };
+        network = createMaloNet "5" "52:DA:0D:F9:EF:F9";
      };
-
+  
      vpn = {
        type = "microvm";
-        network = {
-          address = "10.0.0.10";
-          mac = "D0:E5:CA:F0:D7:E6";
-        };
+        network = createOffsiteNet "10" "52:DA:0D:F9:EF:E6";
      };
-
+  
      infradocs = {
        type = "microvm";
-        network = {
-          address = "10.0.0.11";
-          mac = "D0:E5:CA:F0:D7:E7";
-        };
+        network = createMaloNet "11" "52:DA:0D:F9:EF:E7";
      };
-
+  
      uptimekuma = {
        type = "microvm";
-        network = {
-          address = "10.0.0.12";
-          mac = "D0:E5:CA:F0:D7:E8";
-        };
+        network = createOffsiteNet "12" "52:DA:0D:F9:EF:E8";
      };
-
+  
      nextcloud = {
        type = "microvm";
-        network = {
-          address = "10.0.0.13";
-          mac = "D0:E5:CA:F0:D7:E9";
-        };
+        network = createMaloNet "13" "52:DA:0D:F9:EF:E9";
      };
-
+  
      overwatch = {
        type = "microvm";
-        network = {
-          address = "10.0.0.14";
-          mac = "D0:E5:CA:F0:D7:E0";
-        };
+        network = createMaloNet "14" "52:DA:0D:F9:EF:E0";
      };
-
+  
      zineshop = {
        type = "microvm";
-        network = {
-          address = "10.0.0.15";
-          mac = "D0:E5:CA:F0:D7:F1";
-        };
+        network = createMaloNet "15" "52:DA:0D:F9:EF:F1";
      };

      vaultwarden = {
        type = "microvm";
-        network = {
-          address = "10.0.0.16";
-          mac = "D0:E5:CA:F0:D7:F2";
-        };
+        network = createMaloNet "16" "D0:E5:CA:F0:D7:F2";
      };

-      testvm = {
-        type = "host";
+      ns1 = {
+        type = "microvm";
+        network = createMaloNet "17" "52:DA:0D:F9:EF:F3";
      };
    };
  };
--- a/machines/infradocs/configuration.nix
+++ b/machines/infradocs/configuration.nix
@@ -19,7 +19,6 @@ with lib;
    enable = true;
    enablePromtail = true;
    logNginx = true;
-    lokiHost = "10.0.0.14";
  };

  system.stateVersion = "22.11"; # Did you read the comment?
--- a/machines/modules/host_builder.nix
+++ b/machines/modules/host_builder.nix
@@ -43,7 +43,7 @@ rec {
  ];
  defaultModules = baseModules;

-  makeMicroVM = hostName: ipv4Addr: macAddr: modules: [
+  makeMicroVM = hostName: network: modules: [
    {
      microvm = {
        hypervisor = "cloud-hypervisor";
@@ -83,7 +83,7 @@ rec {
          {
            type = "tap";
            id = "vm-${hostName}";
-            mac = "${macAddr}";
+            mac = "${network.mac}";
          }
        ];
      };
@@ -93,9 +93,9 @@ rec {
      systemd.network.networks."20-lan" = {
        matchConfig.Type = "ether";
        networkConfig = {
-          Address = [ "${ipv4Addr}/24" ];
-          Gateway = "10.0.0.1";
-          DNS = ["1.1.1.1"];
+          Address = [ "${network.address}/24" ];
+          Gateway = "${network.gateway}";
+          DNS = network.nameservers;
          DHCP = "no";
        };
      };
@@ -165,6 +165,16 @@ rec {
      });
    };

+    systemd.network.networks."20-lan" = pkgs.lib.mkForce {
+      matchConfig.Type = "ether";
+      networkConfig = {
+        Address = [ "10.0.0.${hosts.malobeo.hosts.${hostname}.network.hostId}/24" ];
+        Gateway = "10.0.0.1";
+        DNS = [ "1.1.1.1" ];
+        DHCP = "no";
+      };
+    };
+
    boot.isContainer = pkgs.lib.mkForce false;
    services.timesyncd.enable = false;
    users.users.root.password = "";
@@ -210,8 +220,7 @@ rec {
        specialArgs.self = self;
        config = {
          imports = (makeMicroVM "${name}" 
-                                 "${hosts.malobeo.hosts.${name}.network.address}"
-                                 "${hosts.malobeo.hosts.${name}.network.mac}" [
+                                 hosts.malobeo.hosts.${name}.network [
            ../${name}/configuration.nix     
            (vmMicroVMOverwrites name { 
              withNetworking = true; 
@@ -250,7 +259,7 @@ rec {
    modules = (if (settings.type != "microvm") then
      defaultModules ++ [ ../${host}/configuration.nix ]
      else
-      makeMicroVM "${host}" "${settings.network.address}" "${settings.network.mac}" [
+      makeMicroVM "${host}" settings.network [
        inputs.microvm.nixosModules.microvm
        ../${host}/configuration.nix
      ]);
--- a/machines/modules/malobeo/metrics.nix
+++ b/machines/modules/malobeo/metrics.nix
@@ -1,6 +1,7 @@
 { config, lib, pkgs, ... }:
 let 
  cfg = config.malobeo.metrics;
+  hosts = import ../../hosts.nix {};
 in
 {
  options.malobeo.metrics = {
@@ -21,7 +22,7 @@ in
    };
    lokiHost = lib.mkOption {
      type = lib.types.str;
-      default = "10.0.0.14";
+      default = hosts.malobeo.hosts.overwatch.network.address;
      description = "Address of loki host";
    };
  };
--- a/machines/modules/malobeo/microvm_host.nix
+++ b/machines/modules/malobeo/microvm_host.nix
@@ -14,6 +14,26 @@ in
        description = lib.mdDoc "Setup bridge device for microvms.";
      };

+      interface = mkOption {
+        default = "eno1";
+        type = types.str;
+      };
+
+      gateway = mkOption {
+        default = "10.0.0.1";
+        type = types.str;
+      };
+
+      address = mkOption {
+        default = "10.0.0.1/24";
+        type = types.str;
+      };
+
+      dns = mkOption {
+        default = [ "1.1.1.1" ];
+        type = types.listOf types.str;
+      };
+
      enableHostBridgeUnstable = mkOption {
        default = false;
        type = types.bool;
@@ -47,29 +67,29 @@ in

    systemd.network = mkIf (cfg.enableHostBridge || cfg.enableHostBridgeUnstable) {
      enable = true;
-      # create a bride device that all the microvms will be connected to
-      netdevs."10-microvm".netdevConfig = {
-        Kind = "bridge";
-        Name = "microvm";
-      };
-
-      networks."10-microvm" = {
-        matchConfig.Name = "microvm";
+      networks."10-lan" = {
+        matchConfig.Name = [ "${cfg.interface}" "vm-*"];
        networkConfig = {
-          DHCPServer = true;
-          IPv6SendRA = true;
+          Bridge = "malobeo0";
        };
-        addresses = if cfg.enableHostBridgeUnstable then [
-          { Address = "10.0.0.1/24"; }
-        ] else [
-          { Address = "10.0.0.1/24"; }
-        ];
      };
-
-      # connect the vms to the bridge
-      networks."11-microvm" = {
-        matchConfig.Name = "vm-*";
-        networkConfig.Bridge = "microvm";
+      
+      netdevs."malobeo0" = {
+        netdevConfig = {
+          Name = "malobeo0";
+          Kind = "bridge";
+        };
+      };
+      
+      networks."10-lan-bridge" = {
+        matchConfig.Name = "malobeo0";
+        networkConfig = {
+          Address = [ "${cfg.address}" ];
+          Gateway = "${cfg.gateway}";
+          DNS = cfg.dns;
+          IPv6AcceptRA = true;
+        };
+        linkConfig.RequiredForOnline = "routable";
      };
    }; 

@@ -81,7 +101,7 @@ in
          # under nixosConfigurations
          flake = inputs.malobeo; 
          # Specify from where to let `microvm -u` update later on
-          updateFlake = "git+https://git.dynamicdiscord.de/kalipso/infrastructure";
+          updateFlake = "git+https://git.dynamicdiscord.de/malobeo/infrastructure";
        }; };
    in
    builtins.listToAttrs (map mapperFunc cfg.deployHosts);
--- a/machines/modules/malobeo/zones.nix
+++ b/machines/modules/malobeo/zones.nix
@@ -0,0 +1,41 @@
+{ inputs }:
+
+let
+  vpnNS = "vpn";
+  localNS = "hq";
+  peers = import ./peers.nix;
+  hosts = ((import ../../hosts.nix ) {}).malobeo.hosts;
+
+in
+{
+  SOA = {
+    nameServer = "ns1";
+    adminEmail = "admin@malobeo.org";
+    serial = 2019030801;
+  };
+  useOrigin = false;
+
+  NS = [
+    "ns1.malobeo.org."
+  ];
+
+  subdomains = {
+    ns1 = {
+      A = [ hosts.ns1.network.address ];
+    };
+
+    ${localNS} = {
+      A = [ hosts.fanny.network.address ];
+      subdomains = builtins.mapAttrs (name: value: if value.network.local == true then {
+        A = [ value.network.address ];
+      } else {}) hosts;
+    };
+
+    ${vpnNS} = {
+      A = [ peers.vpn.address ];
+      subdomains = builtins.mapAttrs (name: value: if value.role != "server" then {
+        A = [ value.address ];
+      } else {}) peers;
+    };
+  };
+}
--- a/machines/nextcloud/configuration.nix
+++ b/machines/nextcloud/configuration.nix
@@ -2,6 +2,9 @@

 with lib;

+let
+  hosts = import ../hosts.nix {};
+in
 {
  sops.defaultSopsFile = ./secrets.yaml;
  sops.secrets = {
@@ -28,7 +31,6 @@ with lib;
    enable = true;
    enablePromtail = true;
    logNginx = true;
-    lokiHost = "10.0.0.14";
  };

  services.postgresqlBackup = {
@@ -59,8 +61,8 @@ with lib;
      };
    };
    settings = {
-      trusted_domains = ["10.0.0.13"];
-      trusted_proxies = [ "10.0.0.1" ];
+      trusted_domains = [ "cloud.malobeo.org" "cloud.hq.malobeo.org" ];
+      trusted_proxies = [ hosts.malobeo.hosts.fanny.network.address ];
      "maintenance_window_start" = "1";
      "default_phone_region" = "DE";
    };
--- a/machines/ns1/configuration.nix
+++ b/machines/ns1/configuration.nix
@@ -0,0 +1,52 @@
+{ config, self, lib, inputs, pkgs,  ... }:
+
+with lib;
+with inputs;
+
+let
+  dns = inputs.dns;
+in
+{
+  networking = {
+    hostName = mkDefault "ns1";
+    useDHCP = false;
+  };
+
+  imports = [
+    ../modules/malobeo_user.nix
+    ../modules/sshd.nix
+    ../modules/minimal_tools.nix
+    ../modules/autoupdate.nix
+  ];
+
+  networking.firewall = {
+    enable = true;
+    allowedTCPPorts = [ 53 ];
+    allowedUDPPorts = [ 53 ];
+  };
+
+  services.bind = {
+    enable = true;
+    forwarders = [
+      "1.1.1.1"
+      "1.0.0.1"
+    ];
+  
+    cacheNetworks = [
+      "127.0.0.0/24"
+      "10.0.0.0/24"
+      "192.168.1.0/24"
+      "10.100.0.0/24"
+    ];
+
+    zones = {
+      "malobeo.org" = {
+        master = true;
+        file = pkgs.writeText "zone-malobeo.org" (dns.lib.toString "malobeo.org" (import ../modules/malobeo/zones.nix { inherit inputs; }));
+      };
+    };
+  };
+
+  system.stateVersion = "22.11"; # Did you read the comment?
+}
+
--- a/machines/overwatch/configuration.nix
+++ b/machines/overwatch/configuration.nix
@@ -2,6 +2,9 @@

 with lib;

+let
+  hosts = import ../hosts.nix {};
+in
 {
  sops.defaultSopsFile = ./secrets.yaml;
  sops.secrets = {
@@ -29,7 +32,6 @@ with lib;
    enable = true;
    enablePromtail = true;
    logNginx = false;
-    lokiHost = "10.0.0.14";
  };

  services.grafana = {
@@ -121,31 +123,31 @@ with lib;
      {
        job_name = "durruti";
        static_configs = [{
-          targets = [ "10.0.0.5:9002" ];
+          targets = [ "${hosts.malobeo.hosts.durruti.network.address}:9002" ];
        }];
      }
      {
        job_name = "infradocs";
        static_configs = [{
-          targets = [ "10.0.0.11:9002" ];
+          targets = [ "${hosts.malobeo.hosts.infradocs.network.address}:9002" ];
        }];
      }
      {
        job_name = "nextcloud";
        static_configs = [{
-          targets = [ "10.0.0.13:9002" ];
+          targets = [ "${hosts.malobeo.hosts.nextcloud.network.address}:9002" ];
        }];
      }
      {
        job_name = "zineshop";
        static_configs = [{
-          targets = [ "10.0.0.15:9002" ];
+          targets = [ "${hosts.malobeo.hosts.zineshop.network.address}:9002" ];
        }];
      }
      {
        job_name = "fanny";
        static_configs = [{
-          targets = [ "10.0.0.1:9002" ];
+          targets = [ "${hosts.malobeo.hosts.fanny.network.address}:9002" ];
        }];
      }
      # add vpn - check how to reach it first. most probably 10.100.0.1
--- a/machines/overwatch/dashboards/node_full.json
+++ b/machines/overwatch/dashboards/node_full.json
@@ -23750,8 +23750,8 @@
      },
      {
        "current": {
-          "text": "10.0.0.13:9002",
-          "value": "10.0.0.13:9002"
+          "text": "192.168.1.13:9002",
+          "value": "192.168.1.13:9002"
        },
        "datasource": {
          "type": "prometheus",
--- a/machines/overwatch/promtail.yaml
+++ b/machines/overwatch/promtail.yaml
@@ -6,7 +6,7 @@ positions:
  filename: /tmp/positions.yaml

 clients:
-  - url: http://10.0.0.13:3100/loki/api/v1/push
+  - url: http://192.168.1.13:3100/loki/api/v1/push

  
 scrape_configs:
--- a/machines/vaultwarden/configuration.nix
+++ b/machines/vaultwarden/configuration.nix
@@ -38,7 +38,7 @@ with lib;
    backupDir = "/var/local/vaultwarden/backup";
    environmentFile = config.sops.secrets.vaultwarden_env.path;
    config = {
-      DOMAIN = "http://keys.malobeo.org";
+      DOMAIN = "https://keys.malobeo.org";
      SIGNUPS_ALLOWED = true;
      #WEBSERVER
      ROCKET_ADDRESS = "127.0.0.1";
--- a/machines/vaultwarden/secrets.yaml
+++ b/machines/vaultwarden/secrets.yaml
@@ -4,51 +4,60 @@ sops:
        - recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYRnd3NGpkWjZVZjYxZ2VP
-            QUpTMjNwTml3NW8zL2o2c2R0TE53aEtlK0JNCi9jTjhZVXNMZ29oNDIrbFJBenkz
-            UkVBKzBQVUlYREc3bkxRb1R6RE5MaUUKLS0tIDJmdmlidmZCOXU5dDdFRmY2Q2pu
-            bWhRZS9oamtQYnRZVnI1clVGNytHWlkKb1hYwkqfSiMCVFOWraCiWoAU1Ua/U0Kc
-            2UnXRByOST5hfKkTnpJ0765UATUny0K53H/ieMR0cyQxE3aCbk5AfA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsMk9xN1ZLSFc2QWQza3Zp
+            R0ladFBENFpXYWdjOE9XZm9Eek91dGxGOGdvCnpVaXU1RTZpVXYrZThGOEdnNytn
+            Vi95MTJNS09EMU5WMWwvRGlLUUdudEEKLS0tIGtUOWlWSSs0STA5ZkU0RzZpQ1c1
+            bGpVcVJJWk0vMUNoaEJvY3ZLNTRacWcKLkRr+vi2oIPiB1BbSTX71FFKuxysxE0n
+            0+0aHEFAj8LX3hyEiDzQA3IkX9GP9ba/x+XUMBdWwyw25MnUMVFKTQ==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1zs9puemeevc5kt84w9d2mc5396w0t9p60qxymkpatwvwxunzs5usmxr3an
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwS0ZHOXJSUTdlMGIzU0Nh
+            SzJDcHdvb3dmZ3dTWFJkaE9wZXFmVE9ZUkJBCjk4eTRhb3RkTlJRSUVSK2RWbDc0
+            cEtycnFOZlU5ellTSFZXc2ZVZ3lwZU0KLS0tIHpyQ1NCR2dWNURxT0pxcmxMWTlo
+            NGJqai9HNjdkc1NOTGRtSFZWWDIvQkEKe3GqRFTdMQwPbavO6bDobWMf7FwJx1OA
+            7JufIAMJORTfDTyC2fN3bpcZ+UcbPm2pplyzJ6T5p4wOFqQhRrHHyQ==
            -----END AGE ENCRYPTED FILE-----
    lastmodified: "2026-02-03T20:58:16Z"
    mac: ENC[AES256_GCM,data:zxM4GRwlcYoJF51Hbe0VfWvO9PrHQeCUTrGgiVgrP91qX51WTGWfCQfAVAouT3sEvE6Ie5bnAMUWjVjIrnRS6WUCQwUBwFYYUKIkJPooKwlvXRAuZ9UGZERi0/i43WKwB3/xSyVqRb9T5M6exjlkYCuE4Yv3lSEUiIn8fu/Zaas=,iv:D6f3V19E+4qukW8i9wKtNPKfYgD3OXztkICMhD24IzY=,tag:e97txZiaqDPxCLQUbNHwwg==,type:str]
    pgp:
-        - created_at: "2025-12-18T17:32:21Z"
+        - created_at: "2026-02-05T17:22:42Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----

-            hQGMA5HdvEwzh/H7AQv/X02f2/84Twa9Sgj7husyP8ZOva1gsUnakZRd670K1Vxe
-            Z7eY4THMkP59qtbzCDkop0GulM1WNXd3jocT169WKYA5+myjNl131Ppn/DfAHMCk
-            QqguILH7K8X7zQkDU6Y4LE2sLuxYeoYz7aptdwoZpWZRKJjX6Q0pFrbFLZP54CJD
-            BXqcRAGHXSmr8lMJVmaQolzyn9B08Vv/D1LTfgI9qA+K+sxjKQopOjvv03NFSM67
-            PbNNqjQpToM2LaFJTfxXrwljRUkt1BN98wxKlFRIKVbb4spezYHFU+zf5XqM8+sg
-            V9mIGw/5lhYPfSB9EN/2mcqabaWFEqmhBRKRHVirXWBrUmvb5+cKTRQ93zM7Lipr
-            prz7MK+1DRxB5BgKxOiLTz+q/1JlmwpulxBBSSd8o3nHhpjEyaMBoa30TYuUWAVl
-            lW8zCC9H0H8vnqam2OXalu6tu8jvQ6AIquQGOKb3NtWf6pCTQNv0F7t0AWK2zkUL
-            WjrkEiG3lv3vGJeVGq9U0lgBj8HtXnnHsDMJkhPGClQeJcWiv7Tj8f79+Mni8QhM
-            dVWXVesg+dsUazptP35n2S2XlLY8Jk3tyD1KTLrt5R/MMGhAZOmgPS4I4q+zrZSj
-            S0Dj9iTJcJ/F
-            =YEYS
+            hQGMA5HdvEwzh/H7AQv/XLqprcMEI3EYKJw/DA5w64lHAXKzkf8bKpFPWYSnbqMT
+            ajDkcOhA+KMRt1Qgr8aCW7cnWLfy6Ff7U2rSFQ4uBgGKChmYSiMiPdEokYQuYbFE
+            pJh/j4qGcewVpQDVe6N+obqZ0n5oQImn0mO8KkXjrcBhrhuLThAeNxFl7RILOfD0
+            HPFYwy6vMIVPFYCAm4CqIjsMo4feCPYcpxJJwO4aRISkR8vcGAgu9/wWhQIxvdPf
+            O4gTcRshfX6C+TwnwW6Ac7D1rDS5HBnQF4pD4wfYEI00qHKHgeYC4TrEnmta6MG2
+            bvOQBbAUDSf3heEcQ3CwqcRDHzIssAlbW3p9nBRUVOuOta+3rV29lSuz8cbEqVOs
+            MOwN/atluA1jhWgZbt+8SuoleHnbR+hJNJnplvoKN2PmJ3tEbpSCaRaZVaaRFEhm
+            K1tLG2B5IaKMY4n0N1bPnFcvL7s1xS0INPodXzJITyvuJssEL5Dc+YEWxNvEmHGJ
+            ttlyHBJCxWOHsPMh2UcB0lgBBtJt+O2lcAIpwky9T2ufj1EFzLkXV4Sf39S6J/PI
+            814IQE1Bmuy1qqkGhc6WthiooVf/udtWgehwQFwrpY+35GaNQHluFJOrthqraYXK
+            shMbX3AZdLuu
+            =w602
            -----END PGP MESSAGE-----
          fp: c4639370c41133a738f643a591ddbc4c3387f1fb
-        - created_at: "2025-12-18T17:32:21Z"
+        - created_at: "2026-02-05T17:22:42Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----

-            hQIMA98TrrsQEbXUAQ/+LMZHO0oxmlivnL1qKaDz5JKAL718pHmjshxc53gUo4aN
-            x9WC4USniK8IMV4MTZUxti/ekJ5Bxd+myMMIORHE4R1q1FNO1tWx9n8PXAVhIrDx
-            XF/2NZKzUzCHd3OE3GvS+LSTITLnJdtSuAOPA9MjOeC2TU52r3CkNxUfYMjLYIuk
-            soZi8HfTWVfXKyEq300CLdEqoiaN6lqaxY+e0LoiQjPTpZSs0KhpcjvvmKBpZI0x
-            temAZ+VbEU93DuCVxsXQAQria5GUYs66237goctBjto6G0uOyzJ3lOE17ThDkL8J
-            PpbmoR+CkT++lJnSeeRuhF5FYaVWPl0LDGVLAQrkeblGUjhLtzSrN/ZNyjhGaYdk
-            zlUOFUNVlaok1fcC+8PNsfcna7keLW+N4YPTeZQljjH1uWvdzIZaJto1TaDYrSyu
-            EVF4J0FDThMCu7fyf0TrbqE8n7xs/1F7BBfhUC0wWztX4sNo9mNBZK1d96ihFlzB
-            FRBjrAKCGSD4eZcwaJZB/4NoipFDUh9kmQemmSalDNaHjvdXsT4euY4JNqwKw2iK
-            76EYBym1fvEaOeYvoOotLU3vrW6dH0YNEf0+Zvtl8XiUHlDCnxeLaBoVybA7p+Rt
-            0J/S3wPMubikTuq3mSsJcUM8c25sRBD90LjZsAcwKbmfDZntkTNGUr3AEaBdEyTS
-            WAGKfeJiKoH24BQrslUV8V4i4Fcz6xh1tb11Dmg9XcEiZm4+IF/P+UvjHgXanVdu
-            GvEauo1dOpGu+L8xc68fSFfMNQcWDJ1UmZIyJ3FLDbaxI/66H041peA=
-            =YUFg
+            hQIMA98TrrsQEbXUARAAiZsUiicVpIDdSF/XSuZOITPwmL0P1Nyc1LI9QpyQw2fj
+            uaoJV3xO+MW4ovDcJRms/6T5b4IG740s19l/iryd2jhPwn+94EkzhR1cRydvCimU
+            Zexf+y793kKe0TbcNvakAnpArI5RPdAIoPB7V2aa0vweABaxE5XoDedJA646wMbl
+            +pgzVxoE7i6+uxWHGw3MitCneiBcljg9g04FVj9doJfG6LQxfpx01pjiRLVsTGfV
+            LXPLKVJOToEusFz1hLaFMLxPkvFbgQD1YQz82OOJasHr9YGCzitqhA+EV4U4Y9AH
+            bzPlz1qractUIz8pawhKcTUd8Xw+WOZ6kFX3EdUUnD46jMf12j2fe9Axw8v+Cujx
+            jb8+mSbRNH8Tx/phbhWyBhTNhNXoMLW/2nTSJjTUvdjNlIJi3Ntu4AyPpZ9Z2LwM
+            azvzHRC20gEsf25YKAv2/EnOAi7/jx9uknj3pATdaAAS5hKcMutVdiBAPS37695W
+            Fh8aaoCb4ieuHmHFAt0SQ30z/oR2psurwaurGcLQz9IR9uUlCFU9uVifDaSCNiwF
+            EVsRQZAslLqGPDf7c/r8efsMcHRfVVCJvvuvyRZNSHIpOnR/QGLOeNY+B59IdTCJ
+            fk2dMvZpyM1AdLkW2jT0qXj4vKAvVPlEbIXmq9bu/jJER35MzMRWfMmbBzek9t3S
+            WAGL4Zf96omkP7Z9j1UYGv4xcGksajbA6HvCHfjI+mUKV4QxGieeJhicaPYLuo7x
+            wKZqzMZGPpy1dPq75t0RAmnRzHaB9VEUWfO+KYIY/+1qRxOANYl+uZA=
+            =K3Hh
            -----END PGP MESSAGE-----
          fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4
    unencrypted_suffix: _unencrypted
--- a/machines/vpn/configuration.nix
+++ b/machines/vpn/configuration.nix
@@ -40,19 +40,6 @@ with lib;
      };
    };

-    virtualHosts."cloud.malobeo.org" = {
-      locations."/" = {
-        proxyPass = "http://10.100.0.101";
-        extraConfig = ''
-          proxy_set_header Host $host;
-          client_max_body_size ${inputs.self.nixosConfigurations.nextcloud.config.services.nextcloud.maxUploadSize};
-          client_body_timeout 3600s;
-          send_timeout 3600s;
-          fastcgi_buffers 64 4K;
-        '';
-      };
-    };
-
    virtualHosts."keys.malobeo.org" = {
      locations."/" = {
        proxyPass = "http://10.100.0.101";
@@ -79,28 +66,6 @@ with lib;
        '';
      };
    };
-
-    virtualHosts."zines.malobeo.org" = {
-      locations."/" = {
-        proxyPass = "http://10.100.0.101";
-        extraConfig = ''
-          proxy_set_header Host $host;
-          proxy_set_header X-Real-IP $remote_addr;
-          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-          proxy_set_header X-Forwarded-Proto $scheme;
-          proxy_set_header Authorization $http_authorization;  # Pass the Authorization header
-          proxy_pass_header Authorization;
-
-          client_body_in_file_only clean;
-          client_body_buffer_size 32K;
-          
-          client_max_body_size 500M;
-          
-          sendfile on;
-          send_timeout 300s;
-        '';
-      };
-    };
  };

  system.stateVersion = "22.11"; # Did you read the comment?
--- a/machines/zineshop/configuration.nix
+++ b/machines/zineshop/configuration.nix
@@ -20,7 +20,6 @@ with lib;
    enable = true;
    enablePromtail = true;
    logNginx = true;
-    lokiHost = "10.0.0.14";
  };

  services.printing.enable = true;
Author	SHA1	Message	Date
kalipso	9d7ab9f901	Merge remote-tracking branch 'origin/autoupdate' All checks were successful Check flake syntax / flake-check (push) Successful in 11m15s Details	2026-02-21 00:33:02 +01:00
kalipso	a55b498eaa	Merge pull request 'update the update domain to prepare for repo move' (#128 ) from move_repo into master All checks were successful Check flake syntax / flake-check (push) Successful in 7m43s Details Reviewed-on: kalipso/infrastructure#128	2026-02-21 00:23:54 +01:00
ahtlon	8afc42d46f	update the update domain to prepare for repo move All checks were successful Check flake syntax / flake-check (push) Successful in 5m41s Details	2026-02-20 23:55:27 +01:00
ahtlon	e32c1f31bc	[fanny] fix keys.malobeo.org proxypass All checks were successful Check flake syntax / flake-check (push) Successful in 11m9s Details	2026-02-20 23:49:04 +01:00
ahtlon	66a0433148	[nextcloud] add hq to trusted_domains All checks were successful Check flake syntax / flake-check (push) Successful in 6m21s Details	2026-02-20 23:22:19 +01:00
kalipso	04ee3105c1	[hosts] fix dns All checks were successful Check flake syntax / flake-check (push) Successful in 6m12s Details	2026-02-20 22:58:16 +01:00
kalipso	5a35febf77	[fanny] fix ip	2026-02-20 22:58:10 +01:00
kalipso	5403d97506	[fanny] open 443 All checks were successful Check flake syntax / flake-check (push) Successful in 6m49s Details	2026-02-20 20:31:09 +01:00
kalipso	dabda0ccb9	[general] fix physical host ips Some checks failed Check flake syntax / flake-check (push) Has been cancelled Details	2026-02-20 20:28:59 +01:00
kalipso	f6dc3d46e9	[fanny] fix secrets Some checks failed Check flake syntax / flake-check (push) Has been cancelled Details	2026-02-20 20:26:41 +01:00
kalipso	79fef44bcf	Merge branch 'dns' Some checks failed Check flake syntax / flake-check (push) Has been cancelled Details	2026-02-20 20:21:22 +01:00
ahtlon	6182318a29	[actions] fix the autoupdate action All checks were successful Check flake syntax / flake-check (push) Successful in 7m46s Details	2026-02-20 20:19:57 +01:00
kalipso	5a517d57fb	Merge pull request '[fanny] add dyndns service' (#125 ) from dyndns2 into master All checks were successful Check flake syntax / flake-check (push) Successful in 6m6s Details Reviewed-on: kalipso/infrastructure#125	2026-02-20 20:15:25 +01:00
ahtlon	329305a916	[fanny] added zines to dyndns All checks were successful Check flake syntax / flake-check (push) Successful in 5m41s Details	2026-02-20 20:08:54 +01:00
kalipso	f28125c9a4	[louise] new ip All checks were successful Check flake syntax / flake-check (push) Successful in 5m16s Details	2026-02-20 19:59:51 +01:00
kalipso	e46c6bef00	[general] update local vm ip addresses	2026-02-20 19:59:27 +01:00
ahtlon	6661357f05	[fanny] add dyndns service Some checks failed Check flake syntax / flake-check (push) Failing after 3m6s Details	2026-02-20 19:57:08 +01:00
kalipso	b012b89a48	[fanny] update hostbridge for local access All checks were successful Check flake syntax / flake-check (push) Successful in 5m21s Details	2026-02-20 19:39:16 +01:00
kalipso	4d101aee29	[durruti][vpn] rm deprecated cloud/zineshop proxies	2026-02-20 19:38:43 +01:00
kalipso	93fb64b2c6	[fanny] update proxy for local access and dyndns	2026-02-20 19:37:22 +01:00
kalipso	a92336fb30	[fanny] add njala api token	2026-02-20 19:36:58 +01:00
ahtlon	a90960d7a1	Add autoupdate runner + fix a typo in the vaultwarden config	2026-02-18 23:57:42 +01:00
ahtlon	c73ffe95c5	Add autoupdate runner + fix a typo in the vaultwarden config Some checks failed Check flake syntax / flake-check (push) Has been cancelled Details Weekly Flake Update / update_and_check_flake (push) Failing after 42s Details	2026-02-18 23:11:08 +01:00
ahtlon	7464e0b710	[vaultwarden] add vaultwarden key and rekey secrets All checks were successful Check flake syntax / flake-check (push) Successful in 7m31s Details	2026-02-05 18:23:58 +01:00
ahtlon	5a12803694	Merge pull request 'Add vaultwarden' (#122 ) from vaultwarden into master All checks were successful Check flake syntax / flake-check (push) Successful in 7m59s Details Reviewed-on: kalipso/infrastructure#122 Reviewed-by: kalipso <kalipso@c3d2.de>	2026-02-03 22:09:28 +01:00
kalipso	0347fa68c7	[hosts] use hostId in offsite net All checks were successful Check flake syntax / flake-check (push) Successful in 5m29s Details	2026-01-30 20:26:12 +01:00
kalipso	f0e1f07c3e	[zones] set ns1 A record	2026-01-30 20:25:49 +01:00
kalipso	b4d199d00c	[ns1] setup forwarding, open ports	2026-01-30 20:25:10 +01:00
kalipso	bec232a023	[run-vm] override network cfg for local testing	2026-01-30 20:24:43 +01:00
kalipso	62c92821b4	[microvm] put vms on local network All checks were successful Check flake syntax / flake-check (push) Successful in 5m27s Details	2026-01-28 15:27:21 +01:00
kalipso	eb1ec22605	[hosts] dont configure network on offsite hosts Some checks failed Check flake syntax / flake-check (push) Failing after 1m44s Details	2026-01-26 14:10:49 +01:00
kalipso	cb5e68ef16	[dns] init Some checks failed Check flake syntax / flake-check (push) Failing after 3m49s Details	2026-01-26 14:05:12 +01:00