lupine: add runner token for all runners

flake.lock

@@ -7,11 +7,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1758287904,
+        "lastModified": 1752113600,
-        "narHash": "sha256-IGmaEf3Do8o5Cwp1kXBN1wQmZwQN3NLfq5t4nHtVtcU=",
+        "narHash": "sha256-7LYDxKxZgBQ8LZUuolAQ8UkIB+jb4A2UmiR+kzY9CLI=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "67ff9807dd148e704baadbd4fd783b54282ca627",
+        "rev": "79264292b7e3482e5702932949de9cbb69fedf6d",
         "type": "github"
       },
       "original": {
@@ -27,11 +27,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1758384693,
+        "lastModified": 1736621371,
-        "narHash": "sha256-zakdGo9micgEXGiC5Uq0gE5GkHtX12qaRYLcstKPek4=",
+        "narHash": "sha256-45UIQSQA7R5iU4YWvilo7mQbhY1Liql9bHBvYa3qRI0=",
         "ref": "refs/heads/main",
-        "rev": "5f6a462d87cbe25834e8f31283f39fb46c9c3561",
+        "rev": "3729796c1213fe76e568ac28f1df8de4e596950b",
-        "revCount": 21,
+        "revCount": 20,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Grzegorz/gergle.git"
       },
@@ -48,11 +48,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1758386174,
+        "lastModified": 1752258704,
-        "narHash": "sha256-iNDxHSDdb/LlqDbqP9BcZd1QEmks4iYiyN34UhUizZ8=",
+        "narHash": "sha256-pRK99+MCgkeVptbJxXhVMXIXl8uwSdkZDpQzFi3OgkA=",
         "ref": "refs/heads/main",
-        "rev": "a21fdfe56743afc7de1fb14597711fbd97ddef76",
+        "rev": "9ff525339b62855d53a44b4dc0154a33ac19e44d",
-        "revCount": 50,
+        "revCount": 48,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Grzegorz/greg-ng.git"
       },
@@ -117,26 +117,6 @@
         "url": "https://git.pvv.ntnu.no/Projects/minecraft-kartverket.git"
       }
     },
-    "minecraft-heatmap": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1756124334,
-        "narHash": "sha256-DXFmSpgI8FrqcdqY7wg5l/lpssWjslHq5ufvyp/5k4o=",
-        "ref": "refs/heads/main",
-        "rev": "83760b1ebcd9722ddf58a4117d29555da65538ad",
-        "revCount": 13,
-        "type": "git",
-        "url": "https://git.pvv.ntnu.no/Projects/minecraft-heatmap.git"
-      },
-      "original": {
-        "type": "git",
-        "url": "https://git.pvv.ntnu.no/Projects/minecraft-heatmap.git"
-      }
-    },
     "nix-gitea-themes": {
       "inputs": {
         "nixpkgs": [
@@ -159,11 +139,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1758363343,
+        "lastModified": 1752439653,
-        "narHash": "sha256-TWem5ajoX0vD7j1v/cg3XU7GHWW10HRUQbZL++QNXLk=",
+        "narHash": "sha256-mG27U2CFuggpAuozOu/4XAMKaOtJxzJVzdEemjQEBgg=",
-        "rev": "b2a3852bd078e68dd2b3dfa8c00c67af1f0a7d20",
+        "rev": "dfcd5b901dbab46c9c6e80b265648481aafb01f8",
         "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/25.05-small/nixos-25.05.810175.b2a3852bd078/nixexprs.tar.xz"
+        "url": "https://releases.nixos.org/nixos/25.05-small/nixos-25.05.806304.dfcd5b901dba/nixexprs.tar.xz"
       },
       "original": {
         "type": "tarball",
@@ -172,11 +152,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1758361324,
+        "lastModified": 1752439402,
-        "narHash": "sha256-uCqhgJlmxP3UmyCNZ21ucc5Ic0I2le3rA7+Q61UH1YA=",
+        "narHash": "sha256-xDfOnjnKStgsgcn9SFPgOV6qzwac4JvGKYyfR++49Pw=",
-        "rev": "0f3383ef02bc092d2f82afa4e556743c6e6b74d6",
+        "rev": "b47d4f01d4213715a1f09b999bab96bb6a5b675e",
         "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/unstable-small/nixos-25.11pre864278.0f3383ef02bc/nixexprs.tar.xz"
+        "url": "https://releases.nixos.org/nixos/unstable-small/nixos-25.11pre829909.b47d4f01d421/nixexprs.tar.xz"
       },
       "original": {
         "type": "tarball",
@@ -210,11 +190,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1757332682,
+        "lastModified": 1752865540,
-        "narHash": "sha256-4p4aVQWs7jHu3xb6TJlGik20lqbUU/Fc0/EHpzoRlO0=",
+        "narHash": "sha256-VYLXcV8FsaMTsmxISOejvBq76eA41yi7BCRNW1qGbV0=",
         "ref": "refs/heads/main",
-        "rev": "da1113341ad9881d8d333d1e29790317bd7701e7",
+        "rev": "f732582d0d1389721ea2c91ab370ba2fb824d644",
-        "revCount": 518,
+        "revCount": 496,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Projects/nettsiden.git"
       },
@@ -231,7 +211,6 @@
         "grzegorz-clients": "grzegorz-clients",
         "matrix-next": "matrix-next",
         "minecraft-data": "minecraft-data",
-        "minecraft-heatmap": "minecraft-heatmap",
         "nix-gitea-themes": "nix-gitea-themes",
         "nixpkgs": "nixpkgs",
         "nixpkgs-unstable": "nixpkgs-unstable",
@@ -248,11 +227,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1758335443,
+        "lastModified": 1752201818,
-        "narHash": "sha256-2jaGMj32IckpZgBjn7kG4zyJl66T+2A1Fn2ppkHh91o=",
+        "narHash": "sha256-d8KczaVT8WFEZdWg//tMAbv8EDyn2YTWcJvSY8gqKBU=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "f1ccb14649cf87e48051a6ac3a571b4a57d84ff3",
+        "rev": "bd8f8329780b348fedcd37b53dbbee48c08c496d",
         "type": "github"
       },
       "original": {
@@ -268,11 +247,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1758007585,
+        "lastModified": 1751606940,
-        "narHash": "sha256-HYnwlbY6RE5xVd5rh0bYw77pnD8lOgbT4mlrfjgNZ0c=",
+        "narHash": "sha256-KrDPXobG7DFKTOteqdSVeL1bMVitDcy7otpVZWDE6MA=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "f77d4cfa075c3de66fc9976b80e0c4fc69e2c139",
+        "rev": "3633fc4acf03f43b260244d94c71e9e14a2f6e0d",
         "type": "github"
       },
       "original": {

flake.nix

@@ -23,9 +23,6 @@
     nix-gitea-themes.url = "git+https://git.pvv.ntnu.no/Drift/nix-gitea-themes.git";
     nix-gitea-themes.inputs.nixpkgs.follows = "nixpkgs";
 
-    minecraft-heatmap.url = "git+https://git.pvv.ntnu.no/Projects/minecraft-heatmap.git";
-    minecraft-heatmap.inputs.nixpkgs.follows = "nixpkgs";
-
     greg-ng.url = "git+https://git.pvv.ntnu.no/Grzegorz/greg-ng.git";
     greg-ng.inputs.nixpkgs.follows = "nixpkgs";
     gergle.url = "git+https://git.pvv.ntnu.no/Grzegorz/gergle.git";
@@ -107,13 +104,11 @@
         modules = [
           inputs.matrix-next.nixosModules.default
           inputs.pvv-calendar-bot.nixosModules.default
-          inputs.minecraft-heatmap.nixosModules.default
           self.nixosModules.gickup
           self.nixosModules.matrix-ooye
         ];
         overlays = [
           inputs.pvv-calendar-bot.overlays.x86_64-linux.default
-          inputs.minecraft-heatmap.overlays.default
           (final: prev: {
             inherit (self.packages.${prev.system}) out-of-your-element;
           })

hosts/bekkalokk/services/website/500.html

@@ -1,99 +0,0 @@
-<!DOCTYPE html>
-<html lang="no">
-<head>
-  <meta charset="utf-8">
-  <title>500 – Intern serverfeil | PVV</title>
-  <meta name="viewport" content="width=device-width, initial-scale=1">
-  <style>
-    body {
-      margin: 0;
-      padding: 0;
-      font-family: 'Open Sans', sans-serif;
-      background-color: #002244;
-      color: #f0f0f0;
-      display: flex;
-      align-items: center;
-      justify-content: center;
-      height: 100vh;
-      text-align: center;
-    }
-    .box {
-      max-width: 480px;
-      padding: 2rem;
-    }
-    .logo {
-      width: 30%;
-      height: auto;
-      margin: 0 auto 2rem;
-    }
-    h1 {
-      margin: 0 0 1rem;
-      font-size: 2.25rem;
-      font-weight: 700;
-    }
-    p {
-      margin: 0 0 1.25rem;
-      font-size: 1.05rem;
-      line-height: 1.4;
-    }
-    .error-code {
-      margin: 1.5rem 0;
-      opacity: 0.7;
-    }
-    .contact {
-      margin-top: 1.75rem;
-      font-size: 0.93rem;
-      line-height: 1.4;
-    }
-    .contact a {
-      color: #bcd025;
-      text-decoration: none;
-    }
-    ul {
-      padding: 0;
-      list-style: none;
-      margin: 0.5rem 0 0;
-    }
-    li {
-      margin: 0.35rem 0;
-    }
-  </style>
-</head>
-<body>
-  <div class="box">
-    <div class="logo">
-      <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 200 200">
-        <path fill="#283681" d="M0 0h200v200H0z"/>
-        <g fill="none" fill-opacity="0" stroke="#fff" stroke-width="1.1">
-          <path d="M119.6 180H78.3"/>
-          <path d="M179.3 55.8v124.3h-55"/>
-          <path stroke-linecap="square" d="M124.6 180a2.5 2.5 0 0 0-2.5-2.5 2.5 2.5 0 0 0-2.6 2.6H78.6a2.5 2.5 0 0 0-2.5-2.6 2.5 2.5 0 0 0-2.6 2.6H19.2V19.9h160v30H175v6.2h4.3"/>
-        </g>
-        <circle cx="396.8" cy="400" r="320.3" fill="none" stroke="#fff" stroke-miterlimit="10" stroke-width="4.2" transform="scale(.25)"/>
-        <g fill="none" fill-opacity="0" stroke="#fff" stroke-width="1.1">
-          <path stroke-linejoin="bevel" d="M128.6 43.4h-86v113.3h113.2V53.8l-9.7-10.5h-6.8L137 45h-5.4"/>
-          <path d="M131.6 83c0 1.9-1.3 3.4-3 3.4H57c-1.6 0-3-1.6-3-3.5v-36c0-1.9 1.4-3.4 3-3.4h71.7c1.7 0 3 1.5 3 3.4z"/>
-          <path d="M131.7 83.4a3 3 0 0 1-3 3H74.2a3 3 0 0 1-3-3v-37a3 3 0 0 1 3-3h54.5a3 3 0 0 1 3 3zm12.8 70a3 3 0 0 1-3 3H56.9a3 3 0 0 1-3-3V95.3a3 3 0 0 1 3-3h84.6a3 3 0 0 1 3 3zM45 147.6h6.4v5.7H45zm101.9 0h6.4v5.7H147z"/>
-          <path d="M108.4 48.4h16.2v34.4h-16.2z"/>
-        </g>
-        <path fill="#fff" stroke="#fff" stroke-miterlimit="10" stroke-width="4.2" d="M275 541.6c0 3.5 2.7 6.4 6.2 6.4 3.6 0 6.5-2.9 6.5-6.4v-31h30.8c10.5 0 19.2-8.7 19.2-19.2v-22.7c0-10.3-8.7-19-19.2-19H275zm12.7-43.8v-35.4h30.8c3.3 0 6.5 3 6.5 6.3v22.7c0 3.6-3 6.5-6.5 6.5zm78.3-19 25.3 65.2a6.4 6.4 0 0 0 12 0l25.4-65.3V456c0-3.4-2.9-6.3-6.4-6.3a6.3 6.3 0 0 0-6.3 6.3v20.3l-18.6 47.6-18.7-47.6V456c0-3.4-2.9-6.3-6.4-6.3a6.3 6.3 0 0 0-6.3 6.3zm91 0 25.4 65.2a6.4 6.4 0 0 0 12 0l25.4-65.3V456c0-3.4-2.9-6.3-6.4-6.3a6.3 6.3 0 0 0-6.3 6.3v20.3l-18.7 47.6-18.6-47.6V456c0-3.4-3-6.3-6.5-6.3a6.3 6.3 0 0 0-6.3 6.3z" transform="scale(.25)"/>
-      </svg>
-    </div>
-
-    <h1>50X: Intern serverfeil</h1>
-    <p>Beklager, noe gikk galt.</p>
-    <p>Vennligst prøv igjen senere eller gå til forsiden.</p>
-    <div class="error-code">Feilkode: 50X</div>
-
-    <div class="contact">
-      <p>Kontakt drift hvis problemet vedvarer:</p>
-      <ul>
-        <li><strong>Discord:</strong> <a href="https://discord.gg/pyDDFpbG2x" target="_blank">discord.gg/pyDDFpbG2x</a></li>
-        <li><strong>Matrix:</strong> <a href="https://matrix.to/#/#pvv:pvv.ntnu.no" target="_blank">#pvv:pvv.ntnu.no</a></li>
-        <li><strong>E‑post:</strong> <a href="mailto:drift@pvv.ntnu.no">drift@pvv.ntnu.no</a></li>
-      </ul>
-    </div>
-  </div>
-</body>
-</html>
-

hosts/bekkalokk/services/website/default.nix

@@ -84,10 +84,6 @@ in {
   };
 
   services.nginx.virtualHosts.${cfg.domainName} = {
-    extraConfig = ''
-        error_page 500 /500.html;
-    '';
-
     serverAliases = [
       "pvv.ntnu.no"
       "www.pvv.org"
@@ -107,12 +103,6 @@ in {
         '';
       };
 
-      "= /500.html" = {
-        root = ./.;
-        extraConfig = "add_header X-Error-Page 1;";
-      };
-
-
       # Redirect the old webmail/wiki paths from spikkjeposche
       "^~ /webmail".return = "301 https://webmail.pvv.ntnu.no";
       "~ /pvv/([^\\n\\r]*)".return = "301 https://wiki.pvv.ntnu.no/wiki/$1";

hosts/bicep/configuration.nix

@@ -9,7 +9,6 @@
 
     ./services/calendar-bot.nix
     ./services/git-mirrors
-    ./services/minecraft-heatmap.nix
     ./services/mysql.nix
     ./services/postgres.nix
 

hosts/bicep/services/minecraft-heatmap.nix

@@ -1,49 +0,0 @@
-{ config, lib, pkgs, ... }:
-let
-  cfg = config.services.minecraft-heatmap;
-in
-{
-  sops.secrets."minecraft-heatmap/ssh-key/private" = {
-    mode = "600";
-  };
-
-  sops.secrets."minecraft-heatmap/postgres-passwd" = {
-    mode = "600";
-  };
-
-  services.minecraft-heatmap = {
-    enable = true;
-    database = {
-      host = "postgres.pvv.ntnu.no";
-      port = 5432;
-      name = "minecraft_heatmap";
-      user = "minecraft_heatmap";
-      passwordFile = config.sops.secrets."minecraft-heatmap/postgres-passwd".path;
-    };
-  };
-
-  systemd.services.minecraft-heatmap-ingest-logs = {
-    serviceConfig.LoadCredential = [
-      "sshkey:${config.sops.secrets."minecraft-heatmap/ssh-key/private".path}"
-    ];
-
-    preStart = let
-      knownHostsFile = pkgs.writeText "minecraft-heatmap-known-hosts" ''
-        innovation.pvv.ntnu.no ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE9O/y5uqcLKCodg2Q+XfZPH/AoUIyBlDhigImU+4+Kn
-        innovation.pvv.ntnu.no ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQClR9GvWeVPZHudlnFXhGHUX5sGX9nscsOsotnlQ4uVuGsgvRifsVsuDULlAFXwoV1tYp4vnyXlsVtMddpLI5ANOIDcZ4fgDxpfSQmtHKssNpDcfMhFJbfRVyacipjA4osxTxvLox/yjtVt+URjTHUA1MWzEwc26KfiOvWO5tCBTan7doN/4KOyT05GwBxwzUAwUmoGTacIITck2Y9qp4+xFYqehbXqPdBb15hFyd38OCQhtU1hWV2Yi18+hJ4nyjc/g5pr6mW09ULlFghe/BaTUXrTisYC6bMcJZsTDwsvld9581KPvoNZOTQhZPTEQCZZ1h54fe0ZHuveVB3TIHovZyjoUuaf4uiFOjJVaKRB+Ig+Il6r7tMUn9CyHtus/Nd86E0TFBzoKxM0OFu88oaUlDtZVrUJL5En1lGoimajebb1JPxllFN5hqIT+gVyMY6nRzkcfS7ieny/U4rzXY2rfz98selftgh3LsBywwADv65i+mPw1A/1QdND1R6fV4U=
-        innovation.pvv.ntnu.no ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBNjl3HfsDqmALWCL9uhz9k93RAD2565ndBqUh4N/rvI7MCwEJ6iRCdDev0YzB1Fpg24oriyYoxZRP24ifC2sQf8=
-      '';
-    in ''
-      mkdir -p '${cfg.minecraftLogsDir}'
-      "${lib.getExe pkgs.rsync}" \
-      --archive \
-      --verbose \
-      --progress \
-      --no-owner \
-      --no-group \
-      --rsh="${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=\"${knownHostsFile}\" -i \"$CREDENTIALS_DIRECTORY\"/sshkey" \
-      root@innovation.pvv.ntnu.no:/ \
-      '${cfg.minecraftLogsDir}'/
-    '';
-  };
-}

hosts/kommode/services/gitea/default.nix

@@ -1,4 +1,4 @@
-{ config, values, lib, pkgs, unstablePkgs, ... }:
+{ config, values, lib, unstablePkgs, ... }:
 let
   cfg = config.services.gitea;
   domain = "git.pvv.ntnu.no";
@@ -51,11 +51,11 @@ in {
         START_SSH_SERVER = true;
         START_LFS_SERVER = true;
         LFS_JWT_SECRET = lib.mkForce "";
-        LFS_JWT_SECRET_URI = "file:${config.sops.secrets."gitea/lfs-jwt-secret".path}";
+        LFS_JWT_SECRET_URI = config.sops.secrets."gitea/lfs-jwt-secret".path;
       };
       oauth2 = {
         JWT_SECRET = lib.mkForce "";
-        JWT_SECRET_URI = "file:${config.sops.secrets."gitea/oauth2-jwt-secret".path}";
+        JWT_SECRET_URI = config.sops.secrets."gitea/oauth2-jwt-secret".path;
       };
       "git.timeout" = {
         MIGRATE = 3600;
@@ -85,7 +85,7 @@ in {
       session.COOKIE_SECURE = true;
       security = {
         SECRET_KEY = lib.mkForce "";
-        SECRET_KEY_URI = "file:${config.sops.secrets."gitea/secret-key".path}";
+        SECRET_KEY_PATH = config.sops.secrets."gitea/secret-key".path;
       };
       database.LOG_SQL = false;
       repository = {
@@ -159,17 +159,8 @@ in {
 
   environment.systemPackages = [ cfg.package ];
 
-  systemd.services.gitea.serviceConfig.Type = lib.mkForce "notify";
-
-  systemd.services.gitea.serviceConfig.WatchdogSec = "60";
-
   systemd.services.gitea.serviceConfig.CPUSchedulingPolicy = "batch";
 
-  systemd.services.gitea.serviceConfig.CacheDirectory = "gitea/repo-archive";
-  systemd.services.gitea.serviceConfig.BindPaths = [
-    "%C/gitea/repo-archive:${cfg.stateDir}/data/repo-archive"
-  ];
-
   services.nginx.virtualHosts."${domain}" = {
     forceSSL = true;
     enableACME = true;
@@ -193,31 +184,4 @@ in {
   };
 
   networking.firewall.allowedTCPPorts = [ sshPort ];
-
-  systemd.services.gitea-dump = {
-    serviceConfig.ExecStart = let
-      args = lib.cli.toGNUCommandLineShell { } {
-        type = cfg.dump.type;
-
-        # This should be declarative on nixos, no need to backup.
-        skip-custom-dir = true;
-
-        # This can be regenerated, no need to backup
-        skip-index = true;
-
-        # Logs are stored in the systemd journal
-        skip-log = true;
-      };
-    in lib.mkForce "${lib.getExe cfg.package} ${args}";
-
-    # Only keep n backup files at a time
-    postStop = let
-      cu = prog: "'${lib.getExe' pkgs.coreutils prog}'";
-      backupCount = 3;
-    in ''
-      for file in $(${cu "ls"} -t1 '${cfg.dump.backupDir}' | ${cu "sort"} --reverse | ${cu "tail"} -n+${toString (backupCount + 1)}); do
-        ${cu "rm"} "$file"
-      done
-      '';
-  };
 }

hosts/kommode/services/gitea/import-users/default.nix

@@ -11,8 +11,7 @@ in
 
   systemd.services.gitea-import-users = lib.mkIf cfg.enable {
     enable = true;
-    preStart=''${pkgs.rsync}/bin/rsync -e "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=$CREDENTIALS_DIRECTORY/ssh-known-hosts -i $CREDENTIALS_DIRECTORY/sshkey" -a pvv@smtp.pvv.ntnu.no:/etc/passwd /run/gitea-import-users/passwd'';
+    preStart=''${pkgs.rsync}/bin/rsync -e "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=$CREDENTIALS_DIRECTORY/ssh-known-hosts -i $CREDENTIALS_DIRECTORY/sshkey" -a pvv@smtp.pvv.ntnu.no:/etc/passwd /tmp/passwd-import'';
-    environment.PASSWD_FILE_PATH = "/run/gitea-import-users/passwd";
     serviceConfig = {
       ExecStart = pkgs.writers.writePython3 "gitea-import-users" {
         flakeIgnore = [
@@ -26,7 +25,6 @@ in
       ];
       DynamicUser="yes";
       EnvironmentFile=config.sops.secrets."gitea/import-user-env".path;
-      RuntimeDirectory = "gitea-import-users";
     };
   };
 

hosts/kommode/services/gitea/import-users/gitea-import-users.py

@@ -17,10 +17,6 @@ GITEA_API_URL = os.getenv('GITEA_API_URL')
 if GITEA_API_URL is None:
     GITEA_API_URL = 'https://git.pvv.ntnu.no/api/v1'
 
-PASSWD_FILE_PATH = os.getenv('PASSWD_FILE_PATH')
-if PASSWD_FILE_PATH is None:
-    PASSWD_FILE_PATH = '/tmp/passwd-import'
-
 
 def gitea_list_all_users() -> dict[str, dict[str, any]] | None:
     r = requests.get(
@@ -191,8 +187,7 @@ def main():
     if existing_users is None:
         exit(1)
 
-    print(f"Reading passwd entries from {PASSWD_FILE_PATH}")
+    for username, name in passwd_file_parser("/tmp/passwd-import"):
-    for username, name in passwd_file_parser(PASSWD_FILE_PATH):
         print(f"Processing {username}")
         add_or_patch_gitea_user(username, name, existing_users)
         for org, team_name in COMMON_USER_TEAMS:

hosts/lupine/services/gitea-runner.nix

@@ -6,16 +6,14 @@
   # successfully registered will gitea give you the next token.
   # - oysteikt Sep 2023
   sops = {
-    secrets."gitea/runners/token" = {
+    secrets."gitea/runners/token" = { };
-      key = "gitea/runners/${lupineName}";
-    };
 
     templates."gitea-runner-envfile" = {
       restartUnits = [
         "gitea-runner-${lupineName}.service"
       ];
       content = ''
-        TOKEN="${config.sops.placeholder."gitea/runners/token"}"
+        TOKEN=${config.sops.placeholder."gitea/runners/token"}
       '';
     };
   };
@@ -41,5 +39,5 @@
 
   networking.dhcpcd.IPv6rs = false;
 
-  networking.firewall.interfaces."podman+".allowedUDPPorts = [53 5353];
+  networking.firewall.interfaces."podman+".allowedUDPPorts = [ 53 5353 ];
 }

modules/grzegorz.nix

@@ -1,4 +1,4 @@
-{ config, lib, pkgs, unstablePkgs, ... }:
+{config, lib, pkgs, ...}:
 let
   grg = config.services.greg-ng;
   grgw = config.services.grzegorz-webui;
@@ -11,8 +11,6 @@ in {
     settings.port = 31337;
     enableSway = true;
     enablePipewire = true;
-
-    mpvPackage = unstablePkgs.mpv;
   };
 
   systemd.user.services.restart-greg-ng = {

secrets/bicep/bicep.yaml

@@ -5,12 +5,11 @@ mysql:
     password: ENC[AES256_GCM,data:KqEe0TVdeMIzPKsmFg9x0X9xWijnOk306ycyXTm2Tpqo/O0F,iv:Y+hlQ8n1ZIP9ncXBzd2kCSs/DWVTWhiEluFVwZFKRCA=,tag:xlaUk0Wftk62LpYE5pKNQw==,type:str]
 gickup:
     github-token: ENC[AES256_GCM,data:H/yBDLIvEXunmaUha3c2vUWKLRIbl9QrC0t13AQDRCTnrvhabeiUFLNxZ/F+4B6sZ2aPSgZoB69WwnHvh1wLdiFp1qLWKW/jQPvzZOxE4n+jXrnSOutUWktbPzVj,iv:KFW4jRru93JIl9doVFtcNkJDWp89NlzWjPDflHxcL/U=,tag:YtgyRxkoZO9MkuP3DJh7zA==,type:str]
-minecraft-heatmap:
-    postgres-passwd: ENC[AES256_GCM,data:T8s9xct07AJ4/Z6MQjNrqZQq7FerHz8Op+ea8zO2MDLPWWgU7/hBfrr+T4sc1TgT3e5vtE0dVcqCSbZCZj+6zQ==,iv:prx6d8c92OvbL8IjBLAvi1Vqk69D6ZIkAp7E8CSljok=,tag:UA5YS4YwViYZJ2PWzIIM3g==,type:str]
-    ssh-key:
-        private: ENC[AES256_GCM,data:h9OtD6hxrxyokFDe9bveAkMICrs3YrsAEqg0RVHV+xCkgkNAdoh85wb1QI8FJ0tga4Bfq8ZxZTdMnexQvbYWL8m/N/P6gWoPPJd7dwGuxaUZu5lqngVuHIhH0yWFWtPXjQ0Zyl5Q1aBKyjzJMvJc/H2iprgVH4YFs/fWf/KDEp17Plvvz0AoPGPrOZErDmne4MtLbW3pUm1r5ACo/41OyXYwjHk1Ywgsoz1CMxe/DrmkADnf7jSDWL6Q0mz8hIIYi8GbToJS4BIJ2plttraxV9sqpIPzS/1jMERNchItlkCppSYIy/eohVmskP8dAySm5Z7HNGGtzWSSGLxq15xKc7OVFYPMI+B35nPnp1LVOUWqBHAqVo7dwxc3VXOlVat7AMknUZnr67d4TIIl5BOdy/rvAxzXS/fDV0zntIs5o3phKStVvq07eZFaOVva45B7Pyyn0PdBhHBt2JcBtm+Xtg9i3xvZdwQgbeeJRhnYgDqK6BVhmtTuirwp1GOyslqaFCjg0MJj+W+d8R9gbbfyFR6YrZQAkcd/o/yZGg86z7Phe18=,iv:nt/+qPBwPZKQt43VJ9FbKjLYioFwCxD7VK9WNCJCmpQ=,tag:MuDfnTiro3VVJq9x5rkEQg==,type:str]
-        public: ENC[AES256_GCM,data:+fiCO8VRSmV7tmyweYSpZJMOuMORLHkWetYbr20aTQ1vRYr927nYGes4E464t+Dv9OyJPCLmHBdgt7UvxJWuC3pZE8iStnBYnej3D4ebMzi2SMfOkJjGuQSplXtl8QeAYe1YvROmtQ==,iv:thgGQUyWdXfwUt1E/vudoNjl8JjnksFd1rb/asTry+g=,tag:t1iQPocvfI+JafuJycaLuw==,type:str]
 sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
     age:
         - recipient: age1sl43gc9cw939z5tgha2lpwf0xxxgcnlw7w4xem4sqgmt2pt264vq0dmwx2
           enc: |
@@ -66,8 +65,8 @@ sops:
             cTh5bnJ3WW90aXRCSUp6NHFYeU1tZ0kK4afdtJwGNu6wLRI0fuu+mBVeqVeB0rgX
             0q5hwyzjiRnHnyjF38CmcGgydSfDRmF6P+WIMbCwXC6LwfRhAmBGPg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-08-25T12:27:53Z"
+    lastmodified: "2025-05-07T21:34:48Z"
-    mac: ENC[AES256_GCM,data:GoJ2en7e+D4wjyPJqq7i1s8JPdgFO3wcxrtXOgSKTxi6HTibuIcP4KQcKrCMRAZmXOEL1vpnWFA2uk7S00Av7/QOnzP0Zrk3aPBM6lbB+p9XSabN0sOe1UpZDtAM3bzvS9JZzyztT5nHKvO/eV2rP71y/tYbsT6yvj7Y9zxpvKg=,iv:tQiCr7zpo7g5jZpt2VD9jtFKo32XUWs94Jay+T4XWys=,tag:npBqmlbUUfN+ztttajva3w==,type:str]
+    mac: ENC[AES256_GCM,data:n6GHD+nQmZL17WvUZiMCBLRHbtpoKU6U8o/Oraj0VSRi/pQ74QWGVEcIX87kFjBvR2C+UPd3KwXzjQHhjUfHpz9EjIGi6tXLTTo8K3ptd2wCL8MW418TVO4KV+BFmHGT4kwlbdoqaJ2SA7HcfXNaC68e/2CTXhtkLpIwGXtYWJA=,iv:iC5QX/JMwno4mBljPdorNmcQSD2wy/wOYvGrUoC2yzg=,tag:GuFNQ6+d6o9DYC6Do/IEqQ==,type:str]
     pgp:
         - created_at: "2024-08-04T00:03:40Z"
           enc: |-
@@ -90,4 +89,4 @@ sops:
             -----END PGP MESSAGE-----
           fp: F7D37890228A907440E1FD4846B9228E814A2AAC
     unencrypted_suffix: _unencrypted
-    version: 3.10.2
+    version: 3.9.4

secrets/lupine/lupine.yaml

@@ -1,10 +1,6 @@
 gitea:
     runners:
-        lupine-1: ENC[AES256_GCM,data:UcZB2p/dInvcl0yNBEohzbmcVxg/QQPXlIsaVB3M3hyxFg1gtGfUGA==,iv:OigyPfPoRIjvyiId7hiiWdNrZqyZqI3OonvJC+zYEzI=,tag:SjBsvo/IJKhFQs+PiI596g==,type:str]
+        token: ENC[AES256_GCM,data:Y27trzUHuA1k9fVs/3PM/L8aIlI+37nAPTVDgWjBX+K4q23saa5XUA==,iv:J4litvX0ip/a340E7S+XHZQG+BGh+K/RzFxdS1VLwA0=,tag:H4oK4vn27U+yXqa/YQJOxA==,type:str]
-        lupine-2: null
-        lupine-3: null
-        lupine-4: null
-        lupine-5: null
 sops:
     age:
         - recipient: age1fkrypl6fu4ldsa7te4g3v4qsegnk7sd6qhkquuwzh04vguy96qus08902e
@@ -97,8 +93,8 @@ sops:
             YU5mMDlRckJCMDAzcHYyMWN1clRJRVEK77PiAQP+2+WblGYEgAf6bx6RTh0JHiSZ
             /jPIN/rbAKNv36wpZDbuLV8tcMuvhleNMRSSqbIloLSzww+Z5nOU4A==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-07-30T18:29:08Z"
+    lastmodified: "2025-08-03T01:13:50Z"
-    mac: ENC[AES256_GCM,data:47cki5ucPTVd4JuEyK0QkDCCEqj1pW6SA5I6ihC/MEja6TIuHTcEPFpje8+LvpGjpP9uobKX4g3UcyvkJ63j/k3hU0xPYQX3Z1ee00KIMKB0GHNjUR8ENtnwd3TU7kp5ohtXeCtcyzCjdFFuXp8AINGv3vpbU2MzauctUxn5B1Y=,iv:1mpk/f1QlRtHfA9dqyNLBrvfVPgtLnZ7ibj8qNrEGD8=,tag:drEK1+qeJy97rgeQJyqucA==,type:str]
+    mac: ENC[AES256_GCM,data:oFbwmbLk3z6oYQMCEcFAGstf6DUT7hh9OUa5HVyeIR15YVgJ9/0hwZPG1m00w1HpKjt7/iVnQQYdPvt00snwn7g0M822MquMbwavozOrWWuhpxlzjM1kn/zTHAPFMmDihAciuQSSk43Dc5FRS5Gc6gwonEsJ5EUqcq2nM/cnAUY=,iv:H1CEaaypKUMCd2zJOXhIUQQqTfOwknG+iBOpgYlirmY=,tag:gKX+OTZ+BrHvcwoyO6YFdA==,type:str]
     pgp:
         - created_at: "2025-07-30T18:27:50Z"
           enc: |-

users/albertba.nix

@@ -1,23 +0,0 @@
-{ pkgs, ... }:
-{
-  users.users.albertba = {
-    isNormalUser = true;
-    extraGroups = [ "wheel" "drift" "nix-builder-users" ];
-
-    packages = with pkgs; [
-      htop
-      neovim
-      ripgrep
-      fd
-      tmux
-    ];
-
-    shell = pkgs.zsh;
-
-    openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICheSCAxsYc/6g8hq2lXXHoUWPjWvntzzTA7OhG8waMN albert@Arch"
-    ];
-  };
-
-}
-

users/vegardbm.nix

@@ -1,22 +0,0 @@
-{ pkgs, ... }:
-{
-  users.users.vegardbm = {
-    isNormalUser = true;
-    description = "noe";
-    extraGroups = [
-      "wheel"
-      "drift"
-      "nix-builder-users"
-    ];
-    packages = with pkgs; [
-      btop
-      eza
-      neovim
-      ripgrep
-      tmux
-    ];
-    openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDVA3HqEx3je6L1AC+bP8sTxu3ZTKvTCR0npCyOVAYK5 vbm@arch-xeon"
-    ];
-  };
-}