bakke: Update disk IDs

bakke: create sops secret placeholder
bakke: fix state(🤬) version
2025-03-29 22:55:34 +01:00 · 2025-03-29 22:46:31 +01:00 · 2025-03-29 22:44:55 +01:00 · 2025-03-29 22:44:55 +01:00 · 2025-03-29 22:44:55 +01:00 · 2025-03-29 22:44:55 +01:00
22 changed files with 309 additions and 797 deletions
--- a/.sops.yaml
+++ b/.sops.yaml
@@ -1,20 +1,21 @@
 keys:
  # Users
  - &user_danio age17tagmpwqjk3mdy45rfesrfey6h863x8wfq38wh33tkrlrywxducs0k6tpq
+  - &user_eirikwit age1ju7rd26llahz3g8tz7cy5ld52swj8gsmg0flrmrxngc0nj0avq3ssh0sn5
  - &user_felixalb age1mrnldl334l2nszuta6ywvewng0fswv2dz9l5g4qcwe3nj4yxf92qjskdx6
  - &user_oysteikt F7D37890228A907440E1FD4846B9228E814A2AAC
-  - &user_eirikwit age1ju7rd26llahz3g8tz7cy5ld52swj8gsmg0flrmrxngc0nj0avq3ssh0sn5
-  - &user_pederbs_sopp age1hmpdk4h69wxpwqk9tkud39f66hprhehxtzhgw97r6dvr7v0mx5jscsuhkn
-  - &user_pederbs_nord age1wrssr4z4g6vl3fd3qme5cewchmmhm0j2xe6wf2meu4r6ycn37anse98mfs
  - &user_pederbs_bjarte age1zhxul786an743u0fascv4wtc5xduu7qfy803lfs539yzhgmlq5ds2lznt5
+  - &user_pederbs_nord age1wrssr4z4g6vl3fd3qme5cewchmmhm0j2xe6wf2meu4r6ycn37anse98mfs
+  - &user_pederbs_sopp age1hmpdk4h69wxpwqk9tkud39f66hprhehxtzhgw97r6dvr7v0mx5jscsuhkn

  # Hosts
-  - &host_jokum age1gp8ye4g2mmw3may5xg0zsy7mm04glfz3788mmdx9cvcsdxs9hg0s0cc9kt
-  - &host_ildkule age1x28hmzvuv6f2n66c0jtqcca3h9rput8d7j5uek6jcpx8n9egd52sqpejq0
+  - &host_bakke age1syted6kt48sumjjucggh6r3uca4x2ppp4mfungf3lamkt2le05csc99633
  - &host_bekkalokk age12nj59tguy9wg882updc2vjdusx5srnxmjyfaqve4zx6jnnsaw3qsyjq6zd
  - &host_bicep age1sl43gc9cw939z5tgha2lpwf0xxxgcnlw7w4xem4sqgmt2pt264vq0dmwx2
-  - &host_ustetind age1hffjafs4slznksefmtqrlj7rdaqgzqncn4un938rhr053237ry8s3rs0v8
+  - &host_ildkule age1x28hmzvuv6f2n66c0jtqcca3h9rput8d7j5uek6jcpx8n9egd52sqpejq0
+  - &host_jokum age1gp8ye4g2mmw3may5xg0zsy7mm04glfz3788mmdx9cvcsdxs9hg0s0cc9kt
  - &host_kommode age1mt4d0hg5g76qp7j0884llemy0k2ymr5up8vfudz6vzvsflk5nptqqd32ly
+  - &host_ustetind age1hffjafs4slznksefmtqrlj7rdaqgzqncn4un938rhr053237ry8s3rs0v8

 creation_rules:
  # Global secrets
@@ -105,8 +106,14 @@ creation_rules:
      pgp:
      - *user_oysteikt

-  - path_regex: secrets/skrott/[^/]+\.yaml$
+  - path_regex: secrets/bakke/[^/]+\.yaml$
    key_groups:
    - age:
+      - *host_bakke
      - *user_danio
-      - *user_eirikwit
+      - *user_felixalb
+      - *user_pederbs_sopp
+      - *user_pederbs_nord
+      - *user_pederbs_bjarte
+      pgp:
+      - *user_oysteikt
--- a/base/services/nginx.nix
+++ b/base/services/nginx.nix
@@ -20,14 +20,14 @@
    recommendedGzipSettings = true;

    appendConfig = ''
-      # pcre_jit on;
+      pcre_jit on;
      worker_processes auto;
      worker_rlimit_nofile 100000;
    '';
    eventsConfig = ''
      worker_connections 2048;
      use epoll;
-      # multi_accept on;
+      multi_accept on;
    '';
  };

--- a/flake.lock
+++ b/flake.lock
@@ -1,26 +1,5 @@
 {
  "nodes": {
-    "dibbler": {
-      "inputs": {
-        "flake-utils": "flake-utils",
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1747505135,
-        "narHash": "sha256-kfDCvIbNKePKpJCXST2V1bwWHtsgFOL/E7DvQbBygsQ=",
-        "ref": "refs/heads/main",
-        "rev": "0844843e595be617f683fbc245c944edd2bc6aa8",
-        "revCount": 209,
-        "type": "git",
-        "url": "https://git.pvv.ntnu.no/Projects/dibbler.git"
-      },
-      "original": {
-        "type": "git",
-        "url": "https://git.pvv.ntnu.no/Projects/dibbler.git"
-      }
-    },
    "disko": {
      "inputs": {
        "nixpkgs": [
@@ -28,11 +7,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1745502102,
-        "narHash": "sha256-LqhRwzvIVPEjH0TaPgwzqpyhW6DtCrvz7FnUJDoUZh8=",
+        "lastModified": 1741786315,
+        "narHash": "sha256-VT65AE2syHVj6v/DGB496bqBnu1PXrrzwlw07/Zpllc=",
        "owner": "nix-community",
        "repo": "disko",
-        "rev": "ca27b88c88948d96feeee9ed814cbd34f53d0d70",
+        "rev": "0d8c6ad4a43906d14abd5c60e0ffe7b587b213de",
        "type": "github"
      },
      "original": {
@@ -41,23 +20,6 @@
        "type": "github"
      }
    },
-    "flake-utils": {
-      "inputs": {
-        "systems": "systems"
-      },
-      "locked": {
-        "lastModified": 1731533236,
-        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
-        "type": "github"
-      },
-      "original": {
-        "id": "flake-utils",
-        "type": "indirect"
-      }
-    },
    "gergle": {
      "inputs": {
        "nixpkgs": [
@@ -86,11 +48,11 @@
        "rust-overlay": "rust-overlay"
      },
      "locked": {
-        "lastModified": 1746563623,
-        "narHash": "sha256-5DxgNFpSgxft/sWraZnHIUlb4S3Io73SVS7FZCbWSUY=",
+        "lastModified": 1736545379,
+        "narHash": "sha256-PeTTmGumdOX3rd6OKI7QMCrZovCDkrckZbcHr+znxWA=",
        "ref": "refs/heads/main",
-        "rev": "4e0408887f80e61a90286ff630a7855b828ae421",
-        "revCount": 45,
+        "rev": "74f5316121776db2769385927ec0d0c2cc2b23e4",
+        "revCount": 42,
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Grzegorz/greg-ng.git"
      },
@@ -162,26 +124,26 @@
        ]
      },
      "locked": {
-        "lastModified": 1743881366,
-        "narHash": "sha256-ScGA2IHPk9ugf9bqEZnp+YB/OJgrkZblnG/XLEKvJAo=",
+        "lastModified": 1736531400,
+        "narHash": "sha256-+X/HVI1AwoPcud28wI35XRrc1kDgkYdDUGABJBAkxDI=",
        "ref": "refs/heads/main",
-        "rev": "db2e4becf1b11e5dfd33de12a90a7d089fcf68ec",
-        "revCount": 11,
+        "rev": "e4dafd06b3d7e9e6e07617766e9c3743134571b7",
+        "revCount": 7,
        "type": "git",
-        "url": "https://git.pvv.ntnu.no/Drift/nix-gitea-themes.git"
+        "url": "https://git.pvv.ntnu.no/oysteikt/nix-gitea-themes.git"
      },
      "original": {
        "type": "git",
-        "url": "https://git.pvv.ntnu.no/Drift/nix-gitea-themes.git"
+        "url": "https://git.pvv.ntnu.no/oysteikt/nix-gitea-themes.git"
      }
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1745526780,
-        "narHash": "sha256-LXXYBmFPMQU2lTb6alKWfjgQs08BKn+txMNcgbu00hI=",
+        "lastModified": 1741969460,
+        "narHash": "sha256-SCNxTTBfMJV7XuTcLUfdAd6cgCGsazzi+DoPrceQrZ0=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "9204750b34cae1a8347ab4b5588115edfeebc6d7",
+        "rev": "68612419aa6c9fd5b178b81e6fabbdf46d300ea4",
        "type": "github"
      },
      "original": {
@@ -193,11 +155,11 @@
    },
    "nixpkgs-unstable": {
      "locked": {
-        "lastModified": 1745688173,
-        "narHash": "sha256-fgvG1O5JvSSjeQx+ea0DJ3GfMbLPVhAQta/DqQ2y6jc=",
+        "lastModified": 1741960758,
+        "narHash": "sha256-pSGMbfkxF7TSeco54W+B1q+g22YCVp1qXHgtrdgtyR4=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "6a2957c7978b189202e03721aab901c0a9dc1e1a",
+        "rev": "845dc1e9cbc2e48640b8968af58b4a19db67aa8f",
        "type": "github"
      },
      "original": {
@@ -249,7 +211,6 @@
    },
    "root": {
      "inputs": {
-        "dibbler": "dibbler",
        "disko": "disko",
        "gergle": "gergle",
        "greg-ng": "greg-ng",
@@ -272,11 +233,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1746498961,
-        "narHash": "sha256-rp+oh/N88JKHu7ySPuGiA3lBUVIsrOtHbN2eWJdYCgk=",
+        "lastModified": 1729391507,
+        "narHash": "sha256-as0I9xieJUHf7kiK2a9znDsVZQTFWhM1pLivII43Gi0=",
        "owner": "oxalica",
        "repo": "rust-overlay",
-        "rev": "24b00064cdd1d7ba25200c4a8565dc455dc732ba",
+        "rev": "784981a9feeba406de38c1c9a3decf966d853cca",
        "type": "github"
      },
      "original": {
@@ -292,11 +253,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1745310711,
-        "narHash": "sha256-ePyTpKEJTgX0gvgNQWd7tQYQ3glIkbqcW778RpHlqgA=",
+        "lastModified": 1741861888,
+        "narHash": "sha256-ynOgXAyToeE1UdLNfrUn/hL7MN0OpIS2BtNdLjpjPf0=",
        "owner": "Mic92",
        "repo": "sops-nix",
-        "rev": "5e3e92b16d6fdf9923425a8d4df7496b2434f39c",
+        "rev": "d016ce0365b87d848a57c12ffcfdc71da7a2b55f",
        "type": "github"
      },
      "original": {
@@ -304,21 +265,6 @@
        "repo": "sops-nix",
        "type": "github"
      }
-    },
-    "systems": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
    }
  },
  "root": "root",
--- a/flake.nix
+++ b/flake.nix
@@ -20,7 +20,7 @@
    matrix-next.url = "github:dali99/nixos-matrix-modules/0.7.0";
    matrix-next.inputs.nixpkgs.follows = "nixpkgs";

-    nix-gitea-themes.url = "git+https://git.pvv.ntnu.no/Drift/nix-gitea-themes.git";
+    nix-gitea-themes.url = "git+https://git.pvv.ntnu.no/oysteikt/nix-gitea-themes.git";
    nix-gitea-themes.inputs.nixpkgs.follows = "nixpkgs";

    greg-ng.url = "git+https://git.pvv.ntnu.no/Grzegorz/greg-ng.git";
@@ -31,9 +31,6 @@
    grzegorz-clients.inputs.nixpkgs.follows = "nixpkgs";

    minecraft-data.url = "git+https://git.pvv.ntnu.no/Projects/minecraft-kartverket.git";
-
-    dibbler.url = "git+https://git.pvv.ntnu.no/Projects/dibbler.git";
-    dibbler.inputs.nixpkgs.follows = "nixpkgs";
  };

  outputs = { self, nixpkgs, nixpkgs-unstable, sops-nix, disko, ... }@inputs:
@@ -90,11 +87,15 @@
      stableNixosConfig = nixosConfig nixpkgs;
      unstableNixosConfig = nixosConfig nixpkgs-unstable;
    in {
+      bakke = stableNixosConfig "bakke" {
+        modules = [
+          disko.nixosModules.disko
+        ];
+      };
      bicep = stableNixosConfig "bicep" {
        modules = [
          inputs.matrix-next.nixosModules.default
          inputs.pvv-calendar-bot.nixosModules.default
-          self.nixosModules.gickup
        ];
        overlays = [
          inputs.pvv-calendar-bot.overlays.x86_64-linux.default
@@ -162,20 +163,12 @@
          inputs.gergle.overlays.default
        ];
      };
-      skrott = stableNixosConfig "skrott" {
-        modules = [
-          ./hosts/skrott/configuration.nix
-          inputs.dibbler.nixosModules.default
-          sops-nix.nixosModules.sops
-        ];
-      };
    };

    nixosModules = {
      snakeoil-certs = ./modules/snakeoil-certs.nix;
      snappymail = ./modules/snappymail.nix;
      robots-txt = ./modules/robots-txt.nix;
-      gickup = ./modules/gickup;
    };

    devShells = forAllSystems (system: {
--- a/hosts/bakke/configuration.nix
+++ b/hosts/bakke/configuration.nix
@@ -0,0 +1,26 @@
+{ config, pkgs, values, ... }:
+{
+  imports = [
+      ./hardware-configuration.nix
+      ../../base
+      ../../misc/metrics-exporters.nix
+      ./filesystems.nix
+    ];
+
+  sops.defaultSopsFile = ../../secrets/bakke/bakke.yaml;
+  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
+  sops.age.generateKey = true;
+
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  networking.hostName = "bakke";
+  networking.hostId = "99609ffc";
+  systemd.network.networks."30-enp2s0" = values.defaultNetworkConfig // {
+    matchConfig.Name = "enp2s0";
+    address = with values.hosts.bakke; [ (ipv4 + "/25") (ipv6 + "/64") ];
+  };
+
+  system.stateVersion = "24.05";
+}
--- a/hosts/bakke/disks.nix
+++ b/hosts/bakke/disks.nix
@@ -0,0 +1,83 @@
+{
+  # https://github.com/nix-community/disko/blob/master/example/boot-raid1.nix
+  # Note: Disko was used to create the initial md raid, but is no longer in active use on this host.
+  disko.devices = {
+    disk = {
+      one = {
+        type = "disk";
+        device = "/dev/disk/by-id/ata-WDC_WD40EFRX-68WT0N0_WD-WCC4E2EER6N6";
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              size = "500M";
+              type = "EF00";
+              content = {
+                type = "mdraid";
+                name = "boot";
+              };
+            };
+            mdadm = {
+              size = "100%";
+              content = {
+                type = "mdraid";
+                name = "raid1";
+              };
+            };
+          };
+        };
+      };
+      two = {
+        type = "disk";
+        device = "/dev/disk/by-id/ata-WDC_WD40EFRX-68WT0N0_WD-WCC4E7LPLU71";
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              size = "500M";
+              type = "EF00";
+              content = {
+                type = "mdraid";
+                name = "boot";
+              };
+            };
+            mdadm = {
+              size = "100%";
+              content = {
+                type = "mdraid";
+                name = "raid1";
+              };
+            };
+          };
+        };
+      };
+    };
+    mdadm = {
+      boot = {
+        type = "mdadm";
+        level = 1;
+        metadata = "1.0";
+        content = {
+          type = "filesystem";
+          format = "vfat";
+          mountpoint = "/boot";
+        };
+      };
+      raid1 = {
+        type = "mdadm";
+        level = 1;
+        content = {
+          type = "gpt";
+          partitions.primary = {
+            size = "100%";
+            content = {
+              type = "filesystem";
+              format = "ext4";
+              mountpoint = "/";
+            };
+          };
+        };
+      };
+    };
+  };
+}
--- a/hosts/bakke/filesystems.nix
+++ b/hosts/bakke/filesystems.nix
@@ -0,0 +1,26 @@
+{ config, pkgs, lib, ... }:
+{
+  # Boot drives:
+  boot.swraid.enable = true;
+
+  # ZFS Data pool:
+  environment.systemPackages = with pkgs; [ zfs ];
+  boot = {
+    zfs = {
+      extraPools = [ "tank" ];
+      requestEncryptionCredentials = false;
+    };
+    supportedFilesystems = [ "zfs" ];
+    kernelPackages = config.boot.zfs.package.latestCompatibleLinuxPackages;
+  };
+  services.zfs.autoScrub = {
+    enable = true;
+    interval = "Wed *-*-8..14 00:00:00";
+  };
+
+  # NFS Exports:
+  #TODO
+
+  # NFS Import mounts:
+  #TODO
+}
--- a/hosts/skrott/hardware-configuration.nix
+++ b/hosts/skrott/hardware-configuration.nix
@@ -8,19 +8,33 @@
    [ (modulesPath + "/installer/scan/not-detected.nix")
    ];

-  boot.initrd.availableKernelModules = [ "uhci_hcd" "ehci_pci" "hpsa" "ohci_pci" "usbhid" "sd_mod" ];
+  boot.initrd.availableKernelModules = [ "ehci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
  boot.initrd.kernelModules = [ ];
  boot.kernelModules = [ "kvm-intel" ];
  boot.extraModulePackages = [ ];

  fileSystems."/" =
-    { device = "/dev/disk/by-uuid/31a67903-dc00-448a-a24a-36e820318fe5";
-      fsType = "ext4";
+    { device = "/dev/disk/by-uuid/0f63c3d2-fc12-4ed5-a5a5-141bfd67a571";
+      fsType = "btrfs";
+      options = [ "subvol=root" ];
    };

-  fileSystems."/data" =
-    { device = "/dev/disk/by-uuid/79e93eed-ad95-45c9-b115-4ef92afcc8c0";
-      fsType = "f2fs";
+  fileSystems."/home" =
+    { device = "/dev/disk/by-uuid/0f63c3d2-fc12-4ed5-a5a5-141bfd67a571";
+      fsType = "btrfs";
+      options = [ "subvol=home" ];
+    };
+
+  fileSystems."/nix" =
+    { device = "/dev/disk/by-uuid/0f63c3d2-fc12-4ed5-a5a5-141bfd67a571";
+      fsType = "btrfs";
+      options = [ "subvol=nix" "noatime" ];
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/sdc2";
+      fsType = "vfat";
+      options = [ "fmask=0022" "dmask=0022" ];
    };

  swapDevices = [ ];
@@ -29,11 +43,9 @@
  # (the default) this is the recommended approach. When using systemd-networkd it's
  # still possible to use this option, but it's recommended to use it in conjunction
  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.enp6s0f0.useDHCP = lib.mkDefault true;
-  # networking.interfaces.enp6s0f1.useDHCP = lib.mkDefault true;
-  # networking.interfaces.enp6s0f2.useDHCP = lib.mkDefault true;
-  # networking.interfaces.enp6s0f3.useDHCP = lib.mkDefault true;
+  networking.useDHCP = lib.mkDefault false;
+  # networking.interfaces.eno1.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp2s0.useDHCP = lib.mkDefault true;

  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
--- a/hosts/bicep/configuration.nix
+++ b/hosts/bicep/configuration.nix
@@ -7,10 +7,10 @@
    (fp /misc/metrics-exporters.nix)
    ./services/nginx

-    ./services/calendar-bot.nix
-    ./services/git-mirrors
    ./services/mysql.nix
    ./services/postgres.nix
+    ./services/mysql.nix
+    ./services/calendar-bot.nix

    ./services/matrix
  ];
--- a/hosts/bicep/services/git-mirrors/default.nix
+++ b/hosts/bicep/services/git-mirrors/default.nix
@@ -1,100 +0,0 @@
-{ config, pkgs, lib, fp, ... }:
-let
-  cfg = config.services.gickup;
-in
-{
-  sops.secrets."gickup/github-token" = {
-    owner = "gickup";
-  };
-
-  services.gickup = {
-    enable = true;
-
-    dataDir = "/data/gickup";
-
-    destinationSettings = {
-      structured = true;
-      zip = false;
-      keep = 10;
-      bare = true;
-      lfs = true;
-    };
-
-    instances = let
-      defaultGithubConfig = {
-        settings.token_file = config.sops.secrets."gickup/github-token".path;
-      };
-      defaultGitlabConfig = {
-        # settings.token_file = ...
-      };
-    in {
-      "github:Git-Mediawiki/Git-Mediawiki" = defaultGithubConfig;
-      "github:NixOS/nixpkgs" = defaultGithubConfig;
-      "github:go-gitea/gitea" = defaultGithubConfig;
-      "github:heimdal/heimdal" = defaultGithubConfig;
-      "github:saltstack/salt" = defaultGithubConfig;
-      "github:typst/typst" = defaultGithubConfig;
-      "github:unmojang/FjordLauncher" = defaultGithubConfig;
-      "github:unmojang/drasl" = defaultGithubConfig;
-      "github:yushijinhun/authlib-injector" = defaultGithubConfig;
-
-      "gitlab:mx-puppet/discord/better-discord.js" = defaultGitlabConfig;
-      "gitlab:mx-puppet/discord/discord-markdown" = defaultGitlabConfig;
-      "gitlab:mx-puppet/discord/matrix-discord-parser" = defaultGitlabConfig;
-      "gitlab:mx-puppet/discord/mx-puppet-discord" = defaultGitlabConfig;
-      "gitlab:mx-puppet/mx-puppet-bridge" = defaultGitlabConfig;
-
-      "any:glibc" = {
-        settings.url = "https://sourceware.org/git/glibc.git";
-      };
-
-      "any:out-of-your-element" = {
-        settings.url = "https://gitdab.com/cadence/out-of-your-element.git";
-      };
-
-      "any:out-of-your-element-module" = {
-        settings.url = "https://cgit.rory.gay/nix/OOYE-module.git";
-      };
-    };
-  };
-
-  services.cgit = let
-    domain = "bicep.pvv.ntnu.no";
-  in {
-    ${domain} = {
-      enable = true;
-      package = pkgs.callPackage (fp /packages/cgit.nix) { };
-      group = "gickup";
-      scanPath = "${cfg.dataDir}/linktree";
-      settings = {
-        enable-commit-graph = true;
-        enable-follow-links = true;
-        enable-http-clone = true;
-        enable-remote-branches = true;
-        clone-url = "https://${domain}/$CGIT_REPO_URL";
-        remove-suffix = true;
-        root-title = "PVVSPPP";
-        root-desc = "PVV Speiler Praktisk og Prominent Programvare";
-        snapshots = "all";
-        logo = "/PVV-logo.png";
-      };
-    };
-  };
-
-  services.nginx.virtualHosts."bicep.pvv.ntnu.no" = {
-    forceSSL = true;
-    enableACME = true;
-
-    locations."= /PVV-logo.png".alias = let
-      small-pvv-logo = pkgs.runCommandLocal "pvv-logo-96x96" {
-        nativeBuildInputs = [ pkgs.imagemagick ];
-      } ''
-        magick '${fp /assets/logo_blue_regular.svg}' -resize 96x96 PNG:"$out"
-      '';
-    in toString small-pvv-logo;
-  };
-
-  systemd.services."fcgiwrap-cgit-bicep.pvv.ntnu.no" = {
-    serviceConfig.BindReadOnlyPaths = [ cfg.dataDir ];
-  };
-}
--- a/hosts/skrott/configuration.nix
+++ b/hosts/skrott/configuration.nix
@@ -1,27 +0,0 @@
-{ fp, config, pkgs, values, ... }:
-{
-  imports = [
-    # Include the results of the hardware scan.
-    ./hardware-configuration.nix
-    (fp /base)
-    (fp /misc/metrics-exporters.nix)
-    # ./services/dibbler.nix
-  ];
-  
-  sops.defaultSopsFile = ../../secrets/skrott/skrott.yaml;
-  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
-  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
-  sops.age.generateKey = true;
-
-  boot.loader.systemd-boot.enable = true;
-  boot.loader.efi.canTouchEfiVariables = true;
-
-  networking.hostName = "skrott";
-
-  systemd.network.networks."30-yolo" = values.defaultNetworkConfig // {
-    matchConfig.Name = "*";
-    address = with values.hosts.skrott; [ (ipv4 + "/25") (ipv6 + "/64") ];
-  };
-
-  system.stateVersion = "24.11";
-}
--- a/hosts/skrott/services/dibbler.nix
+++ b/hosts/skrott/services/dibbler.nix
@@ -1,28 +0,0 @@
-{ config, inputs, ... }:
-{
-  sops.secrets = {
-    "dibbler/config" = {
-      owner = "dibbler";
-      group = "dibbler";
-    };
-  };
-
-  services.dibbler = {
-    enable = true;
-    package = inputs.dibbler.packages.dibbler;
-    settings = {
-      quit_allowed = false;
-      stop_allowed = false;
-      show_tracebacks = true;
-      input_encoding = "utf8";
-
-      low_credit_warning_limit = -100;
-      user_recent_transaction_limit = 20;
-
-      # See https://pypi.org/project/brother_ql/ for label types
-      # Set rotate to False for endless labels
-      label_type = "62";
-      label_rotate = false;
-    };
-  };
-}
--- a/modules/gickup/default.nix
+++ b/modules/gickup/default.nix
@@ -1,310 +0,0 @@
-{ config, pkgs, lib, utils, ... }:
-let
-  cfg = config.services.gickup;
-  format = pkgs.formats.yaml { };
-in
-{
-  imports = [
-    ./set-description.nix
-    ./hardlink-files.nix
-    ./import-from-toml.nix
-    ./update-linktree.nix
-  ];
-
-  options.services.gickup = {
-    enable = lib.mkEnableOption "gickup, a git repository mirroring service";
-
-    package = lib.mkPackageOption pkgs "gickup" { };
-    gitPackage = lib.mkPackageOption pkgs "git" { };
-    gitLfsPackage = lib.mkPackageOption pkgs "git-lfs" { };
-
-    dataDir = lib.mkOption {
-      type = lib.types.path;
-      description = "The directory to mirror repositories to.";
-      default = "/var/lib/gickup";
-      example = "/data/gickup";
-    };
-
-    destinationSettings = lib.mkOption {
-      description = ''
-        Settings for destination local, see gickup configuration file
-
-        Note that `path` will be set automatically to `/var/lib/gickup`
-      '';
-      type = lib.types.submodule {
-        freeformType = format.type;
-      };
-      default = { };
-      example = {
-        structured = true;
-        zip = false;
-        keep = 10;
-        bare = true;
-        lfs = true;
-      };
-    };
-
-    instances = lib.mkOption {
-      type = lib.types.attrsOf (lib.types.submodule (submoduleInputs@{ name, ... }: let
-        submoduleName = name;
-
-        nameParts = rec {
-          repoType = builtins.head (lib.splitString ":" submoduleName);
-
-          owner = if repoType == "any"
-                  then null
-                  else lib.pipe submoduleName [
-                    (lib.removePrefix "${repoType}:")
-                    (lib.splitString "/")
-                    builtins.head
-                  ];
-
-          repo = if repoType == "any"
-                 then null
-                 else lib.pipe submoduleName [
-                    (lib.removePrefix "${repoType}:")
-                    (lib.splitString "/")
-                    lib.last
-                  ];
-
-          slug = if repoType == "any"
-                 then lib.toLower (builtins.replaceStrings [ ":" "/" ] [ "-" "-" ] submoduleName)
-                 else "${lib.toLower repoType}-${lib.toLower owner}-${lib.toLower repo}";
-        };
-      in {
-        options = {
-          interval = lib.mkOption {
-            type = lib.types.str;
-            default = "daily";
-            example = "weekly";
-            description = ''
-              Specification (in the format described by {manpage}`systemd.time(7)`) of the time
-              interval at which to run the service.
-            '';
-          };
-
-          type = lib.mkOption {
-            type = lib.types.enum [
-              "github"
-              "gitlab"
-              "gitea"
-              "gogs"
-              "bitbucket"
-              "onedev"
-              "sourcehut"
-              "any"
-            ];
-            example = "github";
-            default = nameParts.repoType;
-            description = ''
-              The type of the repository to mirror.
-            '';
-          };
-
-          owner = lib.mkOption {
-            type = with lib.types; nullOr str;
-            example = "go-gitea";
-            default = nameParts.owner;
-            description = ''
-              The owner of the repository to mirror (if applicable)
-            '';
-          };
-
-          repo = lib.mkOption {
-            type = with lib.types; nullOr str;
-            example = "gitea";
-            default = nameParts.repo;
-            description = ''
-              The name of the repository to mirror (if applicable)
-            '';
-          };
-
-          slug = lib.mkOption {
-            type = lib.types.str;
-            default = nameParts.slug;
-            example = "github-go-gitea-gitea";
-            description = ''
-              The slug of the repository to mirror.
-            '';
-          };
-
-          description = lib.mkOption {
-            type = with lib.types; nullOr str;
-            example = "A project which does this and that";
-            description = ''
-              A description of the project. This isn't used directly by gickup for anything,
-              but can be useful if gickup is used together with cgit or similar.
-            '';
-          };
-
-          settings = lib.mkOption {
-            description = "Instance specific settings, see gickup configuration file";
-            type = lib.types.submodule {
-              freeformType = format.type;
-            };
-            default = { };
-            example = {
-              username = "gickup";
-              password = "hunter2";
-              wiki = true;
-              issues = true;
-            };
-          };
-        };
-      }));
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    users.users.gickup = {
-      isSystemUser = true;
-      group = "gickup";
-      home = "/var/lib/gickup";
-    };
-
-    users.groups.gickup = { };
-
-    services.gickup.destinationSettings.path = "/var/lib/gickup/raw";
-
-    systemd.tmpfiles.settings."10-gickup" = lib.mkIf (cfg.dataDir != "/var/lib/gickup") {
-      ${cfg.dataDir}.d = {
-        user = "gickup";
-        group = "gickup";
-        mode = "0755";
-      };
-    };
-
-    systemd.slices."system-gickup" = {
-      description = "Gickup git repository mirroring service";
-      after = [ "network.target" ];
-    };
-
-    systemd.targets.gickup = {
-      description = "Gickup git repository mirroring service";
-      wants = map ({ slug, ... }: "gickup@${slug}.service") (lib.attrValues cfg.instances);
-    };
-
-    systemd.timers = {
-      "gickup@" = {
-        description = "Gickup git repository mirroring service for %i";
-
-        timerConfig = {
-          OnCalendar = "daily";
-          RandomizedDelaySec = "1h";
-          Persistent = true;
-          AccuracySec = "1s";
-        };
-      };
-    }
-    //
-    # Overrides for mirrors which are not "daily"
-    (lib.pipe cfg.instances [
-      builtins.attrValues
-      (builtins.filter (instance: instance.interval != "daily"))
-      (map ({ slug, interval, ... }: {
-        name = "gickup@${slug}";
-        value = {
-          overrideStrategy = "asDropin";
-          timerConfig.OnCalendar = interval;
-        };
-      }))
-      builtins.listToAttrs
-    ]);
-
-    systemd.targets.timers.wants = map ({ slug, ... }: "gickup@${slug}.timer") (lib.attrValues cfg.instances);
-
-    systemd.services = {
-      "gickup@" = let
-        configDir = lib.pipe cfg.instances [
-          (lib.mapAttrsToList (name: instance: {
-            name = "${instance.slug}.yml";
-            path = format.generate "gickup-configuration-${name}.yml" {
-              destination.local = [ cfg.destinationSettings ];
-              source.${instance.type} = [
-                (
-                  (lib.optionalAttrs (instance.type != "any") {
-                    user = instance.owner;
-                    includeorgs = [ instance.owner ];
-                    include = [ instance.repo ];
-                  })
-                  //
-                  instance.settings
-                )
-              ];
-            };
-          }))
-          (pkgs.linkFarm "gickup-configuration-files")
-        ];
-      in {
-        description = "Gickup git repository mirroring service for %i";
-        after = [ "network.target" ];
-
-        path = [
-          cfg.gitPackage
-          cfg.gitLfsPackage
-        ];
-
-        restartIfChanged = false;
-
-        serviceConfig = {
-          Type = "oneshot";
-          ExecStart = "'${pkgs.gickup}/bin/gickup' '${configDir}/%i.yml'";
-          ExecStartPost = "";
-
-          User = "gickup";
-          Group = "gickup";
-
-          BindPaths = lib.optionals (cfg.dataDir != "/var/lib/gickup") [
-            "${cfg.dataDir}:/var/lib/gickup"
-          ];
-
-          Slice = "system-gickup.slice";
-
-          SyslogIdentifier = "gickup-%i";
-          StateDirectory = "gickup";
-          # WorkingDirectory = "gickup";
-          # RuntimeDirectory = "gickup";
-          # RuntimeDirectoryMode = "0700";
-
-          # https://discourse.nixos.org/t/how-to-prevent-custom-systemd-service-from-restarting-on-nixos-rebuild-switch/43431
-          RemainAfterExit = true;
-
-          # Hardening options
-          AmbientCapabilities = [];
-          LockPersonality = true;
-          NoNewPrivileges = true;
-          PrivateDevices = true;
-          PrivateMounts = true;
-          PrivateTmp = true;
-          PrivateUsers = true;
-          ProcSubset = "pid";
-          ProtectClock = true;
-          ProtectControlGroups = true;
-          ProtectHome = true;
-          ProtectHostname = true;
-          ProtectKernelLogs = true;
-          ProtectKernelModules = true;
-          ProtectKernelTunables = true;
-          # ProtectProc = "invisible";
-          # ProtectSystem = "strict";
-          RemoveIPC = true;
-          RestrictAddressFamilies = [
-            "AF_INET"
-            "AF_INET6"
-          ];
-          RestrictNamespaces = true;
-          RestrictRealtime = true;
-          RestrictSUIDSGID = true;
-          SystemCallArchitectures = "native";
-          # SystemCallFilter = [
-          #   "@system-service"
-          #   "~@resources"
-          #   "~@privileged"
-          # ];
-          UMask = "0002";
-          CapabilityBoundingSet = [];
-        };
-      };
-    };
-  };
-}
--- a/modules/gickup/hardlink-files.nix
+++ b/modules/gickup/hardlink-files.nix
@@ -1,42 +0,0 @@
-{ config, lib, pkgs, ... }:
-let
-  cfg = config.services.gickup;
-in
-{
-  config = lib.mkIf cfg.enable {
-    # TODO: add a service that will look at the backed up files and hardlink
-    #       the ones that have a matching hash together to save space. This can
-    #       either run routinely (i.e. trigger by systemd-timer), or be activated
-    #       whenever a gickup@<slug>.service finishes. The latter is probably better.
-
-    # systemd.services."gickup-hardlink" = {
-    #   serviceConfig = {
-    #     Type = "oneshot";
-    #     ExecStart = let
-    #       script = pkgs.writeShellApplication {
-    #         name = "gickup-hardlink-files.sh";
-    #         runtimeInputs = [ pkgs.coreutils pkgs.jdupes ];
-    #         text = ''
-
-    #         '';
-    #       };
-    #     in lib.getExe script;
-
-    #     User = "gickup";
-    #     Group = "gickup";
-
-    #     BindPaths = lib.optionals (cfg.dataDir != "/var/lib/gickup") [
-    #       "${cfg.dataDir}:/var/lib/gickup"
-    #     ];
-
-    #     Slice = "system-gickup.slice";
-
-    #     StateDirectory = "gickup";
-
-    #     # Hardening options
-    #     # TODO:
-    #     PrivateNetwork = true;
-    #   };
-    # };
-  };
-}
--- a/modules/gickup/import-from-toml.nix
+++ b/modules/gickup/import-from-toml.nix
@@ -1,11 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-let
-  cfg = config.services.gickup;
-in
-{
-  config = lib.mkIf cfg.enable {
-    # TODO: import cfg.instances from a toml file to make it easier for non-nix users
-    #       to add repositories to mirror
-  };
-}
--- a/modules/gickup/set-description.nix
+++ b/modules/gickup/set-description.nix
@@ -1,9 +0,0 @@
-{ config, lib, pkgs, ... }:
-let
-  cfg = config.services.gickup;
-in
-{
-  config = lib.mkIf cfg.enable {
-    # TODO: create .git/description files for each repo where cfg.instances.<instance>.description is set
-  };
-}
--- a/modules/gickup/update-linktree.nix
+++ b/modules/gickup/update-linktree.nix
@@ -1,84 +0,0 @@
-{ config, lib, pkgs, ... }:
-let
-  cfg = config.services.gickup;
-in
-{
-  config = lib.mkIf cfg.enable {
-    # TODO: run upon completion of cloning a repository
-    systemd.timers."gickup-linktree" = {
-      wantedBy = [ "timers.target" ];
-      timerConfig = {
-        OnCalendar = "daily";
-        Persistent = true;
-        Unit = "gickup-linktree.service";
-      };
-    };
-
-    # TODO: update symlink for one repo at a time (e.g. gickup-linktree@<instance>.service)
-    systemd.services."gickup-linktree" = {
-      serviceConfig = {
-        Type = "oneshot";
-        ExecStart = let
-          script = pkgs.writeShellApplication {
-            name = "gickup-update-symlink-tree.sh";
-            runtimeInputs = [
-              pkgs.coreutils
-              pkgs.findutils
-            ];
-            text = ''
-              shopt -s nullglob
-
-              for repository in ./*/*/*; do
-                REPOSITORY_RELATIVE_DIRS=''${repository#"./"}
-
-                echo "Checking $REPOSITORY_RELATIVE_DIRS"
-
-                declare -a REVISIONS
-                readarray -t REVISIONS < <(find "$repository" -mindepth 1 -maxdepth 1 -printf "%f\n" | sort --numeric-sort --reverse)
-
-                if [[ "''${#REVISIONS[@]}" == 0 ]]; then
-                  echo "Found no revisions for $repository, continuing"
-                  continue
-                fi
-
-                LAST_REVISION="''${REVISIONS[0]}"
-                SYMLINK_PATH="../linktree/''${REPOSITORY_RELATIVE_DIRS}"
-
-                mkdir -p "$(dirname "$SYMLINK_PATH")"
-
-                EXPECTED_SYMLINK_TARGET=$(realpath "''${repository}/''${LAST_REVISION}")
-                EXISTING_SYMLINK_TARGET=$(realpath "$SYMLINK_PATH" || echo "<none>")
-
-                if [[ "$EXISTING_SYMLINK_TARGET" != "$EXPECTED_SYMLINK_TARGET" ]]; then
-                  echo "Updating symlink for $REPOSITORY_RELATIVE_DIRS"
-                  rm "$SYMLINK_PATH" ||:
-                  ln -rs "$EXPECTED_SYMLINK_TARGET" "$SYMLINK_PATH"
-                else
-                  echo "Symlink already up to date, continuing..."
-                fi
-
-                echo "---"
-              done
-            '';
-          };
-        in lib.getExe script;
-
-        User = "gickup";
-        Group = "gickup";
-
-        BindPaths = lib.optionals (cfg.dataDir != "/var/lib/gickup") [
-          "${cfg.dataDir}:/var/lib/gickup"
-        ];
-
-        Slice = "system-gickup.slice";
-
-        StateDirectory = "gickup";
-        WorkingDirectory = "/var/lib/gickup/raw";
-
-        # Hardening options
-        # TODO:
-        PrivateNetwork = true;
-      };
-    };
-  };
-}
--- a/packages/cgit.nix
+++ b/packages/cgit.nix
@@ -1,21 +0,0 @@
-{ cgit, fetchurl, ... }:
-let
-  pname = cgit.pname;
-  commit = "09d24d7cd0b7e85633f2f43808b12871bb209d69";
-in
-cgit.overrideAttrs (_: {
-  version = "1.2.3-unstable-2024.07.16";
-
-  src = fetchurl {
-    url = "https://git.zx2c4.com/cgit/snapshot/${pname}-${commit}.tar.xz";
-    hash = "sha256-gfgjAXnWRqVCP+4cmYOVdB/3OFOLJl2WBOc3bFVDsjw=";
-  };
-
-  # cgit is tightly coupled with git and needs a git source tree to build.
-  # IMPORTANT: Remember to check which git version cgit needs on every version
-  # bump (look for "GIT_VER" in the top-level Makefile).
-  gitSrc = fetchurl {
-    url = "mirror://kernel/software/scm/git/git-2.46.0.tar.xz";
-    hash = "sha256-fxI0YqKLfKPr4mB0hfcWhVTCsQ38FVx+xGMAZmrCf5U=";
-  };
-})
--- a/secrets/bakke/bakke.yaml
+++ b/secrets/bakke/bakke.yaml
@@ -0,0 +1,94 @@
+hello: ENC[AES256_GCM,data:+GWORSIf9TxmJLw1ytZwPbve2yz5H9ewVE5sOpQzkrRpct6Wes+vTE19Ij8W1g==,iv:C/WhXNBBM/bidC9xynZzk34nYXF3mUjAd4nPXpUlYHs=,tag:OJXSwuI8aNDnHFFTkwyGBQ==,type:str]
+example_key: ENC[AES256_GCM,data:ojSsrFYo5YD0YtiqcA==,iv:nvNtG6c0OqnQovzWQLMjcn9vbQ4PPYSv2B43Y8z0h5s=,tag:+h7YUNRA2MTvwGJq1VZW8g==,type:str]
+#ENC[AES256_GCM,data:6EvhlBtrl5wqyf6UAGwY8Q==,iv:fzLUjBzyuT17FcP8jlmLrsKW46pu6/lAvAVLHBxje6k=,tag:n+qR1NUqa91uFRIpALKlmw==,type:comment]
+example_array:
+    - ENC[AES256_GCM,data:A38KXABxJzMoKitKpHo=,iv:OlRap3R//9tvKdPLz7uP+lvBa/fD0W8xFzdxIKKFi4E=,tag:QKizPN1fYOv5zZlMVgTIOQ==,type:str]
+    - ENC[AES256_GCM,data:8X2iVkHQtQMReopWdgM=,iv:2Wq3QOadwd3G3ROXNe7JQD4AL/5H/WV19TBEbxijG/8=,tag:tikKT9Wvzm4Vz5aoy6w9WQ==,type:str]
+example_number: ENC[AES256_GCM,data:0K05hiSPh2Ok1A==,iv:IVRo61xkKugv4OiPm0vt9ODm5DC1DzJFdlgQJb1TfTg=,tag:o3xXygVEUD4jaGSJr0Nxtw==,type:float]
+example_booleans:
+    - ENC[AES256_GCM,data:zoykmQ==,iv:1JGy1Cg5GdAiod9qPSzW+wsG6rUgUJyYMEE4k576Tlk=,tag:RUCbytPpo78bqlAVEUsbLg==,type:bool]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1syted6kt48sumjjucggh6r3uca4x2ppp4mfungf3lamkt2le05csc99633
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlYmlqekUzY2NlQzAxQmZB
+            QllRaVVWSnpNNm4xWlpwNHdMOTJRS2hnS0FzClhkd1hHZk9NWWF3K25HWkxwbEUv
+            bXpmQjNTTERaRDlKODh2NEdIaytJYlUKLS0tIE5ZNGhrbUNONU1rY2dqR08rclRO
+            VHF2MXB2VGNhRzJ2czk5RGlLRm1QM0kKFQhRRrISgmU1neqwAewsS2AVog4Gg2QX
+            ukHvwzO8B6EHH83ppR9Z56aThSmyTSrU5TMwRiLRCWjKGpbL8Gap3Q==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age17tagmpwqjk3mdy45rfesrfey6h863x8wfq38wh33tkrlrywxducs0k6tpq
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSamUvT015TW9iQ3F5UHla
+            SWJ6cjQ0aEdmd0U0WUViL293MEtUazMrY1NVCmgvNXNhZzBSM1Y4b1JnbktQcm9Q
+            Rm9CaU9oZExyMFg5aVlQaHhZMkdhQUkKLS0tIDRiSHY2eFA5NmRtaTNYcnNiQ1Fx
+            RzhPY2l5UnREeFArWE5lS0p1TlBFdFkKoaV8MHuRCvPapWy/SDFjbtRSnzpU9qpL
+            uTfUHMYAkzTwftoQyKYRXY3Qizznn6O8e8SGgLUGPBk0HwrU9vq/8A==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1mrnldl334l2nszuta6ywvewng0fswv2dz9l5g4qcwe3nj4yxf92qjskdx6
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEaDVaaVAzSnMxSERHT1BM
+            TkthN0VQL3QzNGUranBxSE41ZW5ZeW5hL3cwCmR3SVk4bEtRdW53cURRbDh6SEZ3
+            OUx1ZDZtZmdSRjlKWWpSTi9ndnNsZTgKLS0tIDlja3h0N2dxUUZzMWVmZ1lTY0lO
+            VVBiSzAyamlTV3RXRTB4VDJubnRJbzAKZKALwMcN8rpCZdTPE17wNcqt81Lyh0lb
+            paU9GRRp5qBxMaNZaHGirhZWChf3ZjyA/assN4EWSNYe1yzNq9TCPg==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1hmpdk4h69wxpwqk9tkud39f66hprhehxtzhgw97r6dvr7v0mx5jscsuhkn
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCdW0vOHpiUnYwNkRaTzdH
+            NVlKazBUWHlzazRKZlZKZVpXZ1BNdjUreVV3CnlIRXpCTUdwSUNkSXRFdVdnM0E1
+            blZYdnpDK3orcTdQNVk5U3JiMEVEaTgKLS0tIGR1V1d0dW1TSDROQ1pVY0ZvellP
+            WnNxOFlNTWpxV0J2VWk1WDE4UjViUHcKZcGxaNaoalFmc1h2AOf5MKS9O7Kid+Xx
+            WatBjO9oU+lVcy2HGJhuDYoEg6cQ0ER+HTnfZwJRzDwBB6DCyeH8IQ==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1wrssr4z4g6vl3fd3qme5cewchmmhm0j2xe6wf2meu4r6ycn37anse98mfs
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLbm0wMW92U0tMaGR3bzdJ
+            c3QrODN3eXIvb1V2TVZldExpNzZoWEc5UkdjCmtETGxvK0ZHbWVvL1MrdVJOL2V1
+            R3Y4SjhlT3lObGdWRVZQSHh6MUJFd0kKLS0tIDhnOFQ3dEsrVnJWU1lUQlFzd3l1
+            Ny9NbUd1L201cTdkYWQvbHJIRjVWa1UKcHICycS4yPtk0lXrDJmFpS66C7c+GIdS
+            XzghorP2JQxpb3uUcy2XwOHJZMWy0KbFKYjLsIH48oJqqQ9j43WS8w==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1zhxul786an743u0fascv4wtc5xduu7qfy803lfs539yzhgmlq5ds2lznt5
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0YmFheU4wSG9QZTNtRVRz
+            Z21zalZBcWNObEFabXgxOWdYY3F1MENlMlc4CmtWeFl0ZSt4bUo0R3dydEozK3V1
+            dnZlZmtjMk9rdFZlTzFqUXJUdFNZWVUKLS0tIGU2VTdNVCsvRitZMXVleUg0L3lC
+            dU5QblEyZzJBOWJOeGoxQ29OS29hczgKC03MEGwaYq7WKKhh7pq1QOQfjH+L5+8b
+            HXP90cOyvc+dnpV/D2lSns6iK92FYOYVQ+wMjCsoB7zMj24MjPc03w==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-03-15T21:42:17Z"
+    mac: ENC[AES256_GCM,data:2gH/ZaxSA6ShRu53dxj7V3jk7FsVdYS+PSHQyFT8qMvKM1hsQ/nWrKt00PUl9I7Gb4uomP9Ga3SyphYOXRBzKoV+x52oEWOJE3Q4iPrwdCkyHlxEezhTd/ZRQVatG6dvHpLuDNS9Dyph4f7Mw5USI+m4WeVdgCvHTydw+4KIfP4=,iv:yimfq96WVsagvKr8HTg1RdZBSrVGcCWPvv8XOXkOfcg=,tag:zHzdrE0PX5+AeD2lpqeJVQ==,type:str]
+    pgp:
+        - created_at: "2025-03-15T21:46:06Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA0av/duuklWYAQ//QdHVK0PzPDj4BhvVm/FCiRMdKGw7BFDR/+qhxhEULMnu
+            6YSBtO5HMNhIkLlb+3gs/iIJ9+RxQjcxl00sUoEKpucE03QdmRD5EhGoNk3lNKc+
+            A2xelfPFOtbJpzjLub6JwsyfAQMO3c+Wj4f3SKCWK/ad8MVr2xHEhCUfoG9g5w4O
+            KprijBL98/nCXnhhseXFQLvlSIeAUcGMSj+nyvIpBVDIOsYPmgYxZDTOajRFQhcT
+            ZfAA36ViPwEz9LKSMvZe1KYHJVwrUsSrCdTZWZtRUb2udiVXCh6bFNd/eTqdMKiz
+            OBWtnYjD/JNpCtQmy+Y6xsy16udvuPZigY7Rb7CGKOoM4F32QUb22yY5DBLZDq+e
+            XCq1cQCZ+CCqHa3+7dqvZcnbTDa1plCdoinRaZNLuT9cKoclIZjFNW7bBbPTnFhx
+            0e8Zs85CJgarEE8K4b+6unBRN1C+awjCCeSXrPCcz59+qIyY/DC5EsjjV/11VTC3
+            WlHrafbOF1umDZ+Vp2ihylQO+gedVKvQ4qPLkweXn0u1UqokoxcCh+FsdUiGeeDp
+            PsRAQukmo60IPfnwVlZqpMVmJJ5gXIUOEZF7BmTvvcRzZIHTtJZFcNjYHyl5+/Un
+            r6CWiJbExYJm6cLVr8ZBA7gCg6XiVmdRQ/edkVfMHBharH0H8PNxd8WCgkelmsPS
+            XgFfQwymmSTaZHewifFWYe75rDJ8TPLmmmR1JCkIK8lJy6vygQ4k+JL6rKekVW/P
+            SYLrwup1QwcZR78gxjr7lzZNbAKij331EoSsO2+O+MQcfJIeUP51G6+UgJkxRfo=
+            =DyBj
+            -----END PGP MESSAGE-----
+          fp: F7D37890228A907440E1FD4846B9228E814A2AAC
+    unencrypted_suffix: _unencrypted
+    version: 3.8.1
--- a/secrets/bicep/bicep.yaml
+++ b/secrets/bicep/bicep.yaml
@@ -3,8 +3,6 @@ calendar-bot:
    mysql_password: ENC[AES256_GCM,data:Gqag8yOgPH3ntoT5TmaqJWv1j+si2qIyz5Ryfw5E2A==,iv:kQDcxnPfwJQcFovI4f87UDt18F8ah3z5xeY86KmdCyY=,tag:A1sCSNXJziAmtUWohqwJgg==,type:str]
 mysql:
    password: ENC[AES256_GCM,data:KqEe0TVdeMIzPKsmFg9x0X9xWijnOk306ycyXTm2Tpqo/O0F,iv:Y+hlQ8n1ZIP9ncXBzd2kCSs/DWVTWhiEluFVwZFKRCA=,tag:xlaUk0Wftk62LpYE5pKNQw==,type:str]
-gickup:
-    github-token: ENC[AES256_GCM,data:H/yBDLIvEXunmaUha3c2vUWKLRIbl9QrC0t13AQDRCTnrvhabeiUFLNxZ/F+4B6sZ2aPSgZoB69WwnHvh1wLdiFp1qLWKW/jQPvzZOxE4n+jXrnSOutUWktbPzVj,iv:KFW4jRru93JIl9doVFtcNkJDWp89NlzWjPDflHxcL/U=,tag:YtgyRxkoZO9MkuP3DJh7zA==,type:str]
 sops:
    kms: []
    gcp_kms: []
@@ -65,8 +63,8 @@ sops:
            cTh5bnJ3WW90aXRCSUp6NHFYeU1tZ0kK4afdtJwGNu6wLRI0fuu+mBVeqVeB0rgX
            0q5hwyzjiRnHnyjF38CmcGgydSfDRmF6P+WIMbCwXC6LwfRhAmBGPg==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-05-07T21:34:48Z"
-    mac: ENC[AES256_GCM,data:n6GHD+nQmZL17WvUZiMCBLRHbtpoKU6U8o/Oraj0VSRi/pQ74QWGVEcIX87kFjBvR2C+UPd3KwXzjQHhjUfHpz9EjIGi6tXLTTo8K3ptd2wCL8MW418TVO4KV+BFmHGT4kwlbdoqaJ2SA7HcfXNaC68e/2CTXhtkLpIwGXtYWJA=,iv:iC5QX/JMwno4mBljPdorNmcQSD2wy/wOYvGrUoC2yzg=,tag:GuFNQ6+d6o9DYC6Do/IEqQ==,type:str]
+    lastmodified: "2024-08-15T21:18:33Z"
+    mac: ENC[AES256_GCM,data:uR5HgeDAYqoqB9kk1V6p0T30+v6WpQJi4+qIeCDRnoUPnQKUVR10hvBhICck+E+Uh8p+tGhM6Uf3YrAJAV0ZCUiNJjtwDJQQLUDT53vdOAXN4xADCQqNuhgVwVMaruoTheEiwOswRuhFeEwy0gBj3Ze2pu47lueHYclmEzumLeQ=,iv:t0UyXN2YaR2m7M/pV2wTLJG5wVfqTIUs7wSQMmyeTVw=,tag:O7dIffzrDAXz3kGx5uazhw==,type:str]
    pgp:
        - created_at: "2024-08-04T00:03:40Z"
          enc: |-
@@ -89,4 +87,4 @@ sops:
            -----END PGP MESSAGE-----
          fp: F7D37890228A907440E1FD4846B9228E814A2AAC
    unencrypted_suffix: _unencrypted
-    version: 3.9.4
+    version: 3.9.0
--- a/secrets/skrott/skrott.yaml
+++ b/secrets/skrott/skrott.yaml
@@ -1,41 +0,0 @@
-hello: ENC[AES256_GCM,data:KRtCZhcS+LMV5oUivFDBjQo7m9XkaGbHKOW6N/SFRiyZA3eXSkVeltttUHhCrw==,iv:AXlyyW5gQvXu//jV/BVb79ASbKsfu5FFNnRmXNBbfg0=,tag:UVLWNgxtSFh4txCDWl5bPg==,type:str]
-example_key: ENC[AES256_GCM,data:7SpSse4uVUzCwCzbdQ==,iv:zUh9qk/T7LNOXMqToQozn2KeHu9HJtAKarU+Xb5xwi0=,tag:AyO1cflpYraiABPApfjL8A==,type:str]
-#ENC[AES256_GCM,data:NnvbBdwOv5xiqArBdyypGg==,iv:iFCVF8EL8xrKNaDcPOcWp65EoilnG0mN/ph/ZaafLS0=,tag:7pQcs8grVPZbbjr/tze4LQ==,type:comment]
-example_array:
-    - ENC[AES256_GCM,data:fd3mltqGVj7bXHEMmcY=,iv:wzTLHEgQ7bDfUlu01qtaU6fe8L1ZTqmDEBJYf1jttxc=,tag:53XJn1OdJBTEC2BvoSIG1A==,type:str]
-    - ENC[AES256_GCM,data:jZffrJgY0C0YuGIwxxk=,iv:PH+x0/4vm40w+YuCO3JlOqw5bdfaBT29m0YjKMRCFXg=,tag:rWSocVW9kimF5Dcs8lBuLQ==,type:str]
-example_number: ENC[AES256_GCM,data:lWYwd7RXk//H/w==,iv:lD62NqHV/o2QJft48l+0MSeoiGRQ1WFKDoD0sXUevqI=,tag:Ov8j/DqbFww27tDJhmaufA==,type:float]
-example_booleans:
-    - ENC[AES256_GCM,data:QEIQzw==,iv:sGfKE8VMl1uElsfG0Cip647jv/i1+eGE0UxgOM3i4uA=,tag:eWKw678aymRGa1fk8d7RSA==,type:bool]
-    - ENC[AES256_GCM,data:9czVwLg=,iv:OEKALhwOl0OcEJe+k9bhxxdZ/bNd/Xfcvrd40fwAwF8=,tag:CWBuPlcO9WgrSUb0BgfL9g==,type:bool]
-dibbler:
-    config: ENC[AES256_GCM,data:SVTe6MOansry+FKwdu3mDZna4vmu+UMwySfKrfImnGozLz2FYHLW+RvjWaRpa7aGInPfE/icYbSxbHrFIPcIGGlJHTKUlCqQ6km/qYh3UxggKGH1JeUEIgkyvgBXvofym8b5CzyfRXpm35fs+1Io7MWTpeDhmNVk1hVoIU/qR6o6NhOCeH00Gy3cqxCGqi4loJYa51BMNczcUMynwP/9lB2OOb7ogl2TbKXZOK2jwSDCTLJ8FrKcCtUcUnGqUp9VwgktxNrRtFwGohW2gAg2Oq2OR+00dpT2VS+gUtHabrcwft7ioZBmb7rrI4KxpJwG96CYqX90iQiltkwA57BqVByvaYhga4nwdVT48e76MIgBYcQX1WDolL8eEU5QPvhnbmU2mVjdD9SmapoHwBm2qM7LqmsMjqnH8ZHMdtETs6kzt227/QZdh7fc7kaIK1x3Lpxpl3whUMc+mrM8D9xFSjuyxSiF0h7tBH6H,iv:oGd6Dnw655bpwXjqW4niU5dN0RfUDY39hFfiiIc9vhQ=,tag:4CL6iqCiALp/k03Ju6OI/Q==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age17tagmpwqjk3mdy45rfesrfey6h863x8wfq38wh33tkrlrywxducs0k6tpq
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpUlh2azlDTm9PRjJXQ2hO
-            MDlVbTdEN1RIVHkrbjIyY3pVVVlXY3M4eFNjCmJvZUNobVJHdnBhWjFHVVhmVVdX
-            aFloQVRyUXZsQ2g0bENQald6T2F3cEUKLS0tIGRuQjBXb2lzQnJQdDk0SzYwNUsx
-            SnhWdGZaTTVXbm4waW42ZUE0aWFtdDQKFLiRLCBHLAn43q7EPdc/mmQImltIsA5T
-            5ejVVvsva2wznc/pYvAeLb40yAwtszsNwH02SJ19WDz5wEARaQ8+8w==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1ju7rd26llahz3g8tz7cy5ld52swj8gsmg0flrmrxngc0nj0avq3ssh0sn5
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwd2w1YUtHaFZoNEFxMjF4
-            d1V2OFF4ZjFwNnpBWi9Cc3d1SHdqeVh4RDBzCmNLU3VWeVl4Z0ZPOUUvRjlsYzFZ
-            bjEwRlAweVcvME9nZTY1cmM4VHpXWVUKLS0tIHZJRjIveGoyQm02R0xaT2FEclFv
-            ZjhLdUhWdHp2N2krbkxqcHRoZVB6WkEK7uRAXYfI9LMfBXbHwitEVIyhGe6adIFz
-            9at0KEwLXePpR6bO9PM+T4am9V46Ygdq5iS8bSmX03832sK69pF9CA==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-03-16T22:32:52Z"
-    mac: ENC[AES256_GCM,data:A1kg0QtZN3gMnBz1uqllPK4WI4U/CE8yJh8rHJ9CQ9V2kJQA6Kk7XrESVMsBpIazI6GuN1s33v4hNpeXhns5DMSdpWgQdyz8OM4Kj2nGz5h/JxCYwKT0e3R5qy48e0dcM906SG08DVQCCsiBnXAFWymM9Hs2+dPAAWlCNiR0gME=,iv:SookZTJGT7F5vZU6uDr9gO1A6XuDmL1UXlyphYS2dsI=,tag:8S77OX8aJcCn3efY25k4Dw==,type:str]
-    pgp: []
-    unencrypted_suffix: _unencrypted
-    version: 3.8.1
--- a/values.nix
+++ b/values.nix
@@ -27,6 +27,10 @@ in rec {
    gateway = pvv-ipv4 129;
    gateway6 = pvv-ipv6 1;

+    bakke = {
+      ipv4 = pvv-ipv4 173;
+      ipv6 = pvv-ipv6 173;
+    };
    bekkalokk = {
      ipv4 = pvv-ipv4 168;
      ipv6 = pvv-ipv6 168;
@@ -72,10 +76,6 @@ in rec {
      ipv4 = pvv-ipv4 240;
      ipv6 = pvv-ipv6 240;
    };
-    skrott = {
-      ipv4 = pvv-ipv4 235;
-      ipv6 = pvv-ipv6 235;
-    };
  };

  defaultNetworkConfig = {
Author	SHA1	Message	Date
Felix Albrigtsen	686c2d682a	bakke: Update disk IDs Some checks failed Eval nix flake / evals (push) Has been cancelled Details Eval nix flake / evals (pull_request) Has been cancelled Details	2025-03-29 22:55:34 +01:00
Felix Albrigtsen	12a53f3a00	bakke: create sops secret placeholder Some checks failed Eval nix flake / evals (push) Waiting to run Details Eval nix flake / evals (pull_request) Has been cancelled Details	2025-03-29 22:46:31 +01:00
Felix Albrigtsen	83e7da8616	bakke: fix state(🤬) version	2025-03-29 22:44:55 +01:00
Felix Albrigtsen	c9dec343dc	bakke: get rid of disko 💀	2025-03-29 22:44:55 +01:00
Felix Albrigtsen	f6e530692b	Bakke: more disk stuff	2025-03-29 22:44:55 +01:00
Felix Albrigtsen	9e562ef256	bakke: Update disk layout	2025-03-29 22:44:55 +01:00
Felix Albrigtsen	94818fb037	WIP: Init new backup server; bakke	2025-03-29 22:44:55 +01:00