WIP

flake.lock: bump minecraft-kartverket
2025-12-16 17:49:23 +01:00 · 2025-12-17 01:48:32 +09:00
65 changed files with 2212 additions and 2208 deletions
--- a/.gitea/workflows/build-topology-graph.yml
+++ b/.gitea/workflows/build-topology-graph.yml
@@ -1,32 +0,0 @@
-name: "Build topology graph"
-on:
-  push:
-    branches:
-      - main
-jobs:
-  evals:
-    runs-on: debian-latest
-    steps:
-    - uses: actions/checkout@v6
-
-    - name: Install sudo
-      run: apt-get update && apt-get -y install sudo
-
-    - uses: https://github.com/cachix/install-nix-action@v31
-
-    - name: Configure Nix
-      run: echo -e "show-trace = true\nmax-jobs = auto\ntrusted-users = root\nexperimental-features = nix-command flakes\nbuild-users-group =" > /etc/nix/nix.conf
-
-    - name: Build topology graph
-      run: nix build .#topology -L
-
-    - name: Upload topology graph
-      uses: https://git.pvv.ntnu.no/Projects/rsync-action@v2
-      with:
-        source: result/*.svg
-        quote-source: false
-        target: ${{ gitea.ref_name }}/topology_graph/
-        username: gitea-web
-        ssh-key: ${{ secrets.WEB_SYNC_SSH_KEY }}
-        host: pages.pvv.ntnu.no
-        known-hosts: "pages.pvv.ntnu.no ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH2QjfFB+city1SYqltkVqWACfo1j37k+oQQfj13mtgg"
--- a/.sops.yaml
+++ b/.sops.yaml
@@ -1,31 +1,32 @@
 keys:
  # Users
  - &user_danio age1ug30gg4y7ftuya0wdv7q0vh4egn00wlv2th7mt7cgc2ze46wmvyq9lq6ge
-  - &user_eirikwit age1ju7rd26llahz3g8tz7cy5ld52swj8gsmg0flrmrxngc0nj0avq3ssh0sn5
  - &user_felixalb age1mrnldl334l2nszuta6ywvewng0fswv2dz9l5g4qcwe3nj4yxf92qjskdx6
  - &user_oysteikt F7D37890228A907440E1FD4846B9228E814A2AAC
-  - &user_pederbs_bjarte age1zhxul786an743u0fascv4wtc5xduu7qfy803lfs539yzhgmlq5ds2lznt5
-  - &user_pederbs_nord age1wrssr4z4g6vl3fd3qme5cewchmmhm0j2xe6wf2meu4r6ycn37anse98mfs
+  - &user_eirikwit age1ju7rd26llahz3g8tz7cy5ld52swj8gsmg0flrmrxngc0nj0avq3ssh0sn5
  - &user_pederbs_sopp age1hmpdk4h69wxpwqk9tkud39f66hprhehxtzhgw97r6dvr7v0mx5jscsuhkn
+  - &user_pederbs_nord age1wrssr4z4g6vl3fd3qme5cewchmmhm0j2xe6wf2meu4r6ycn37anse98mfs
+  - &user_pederbs_bjarte age1zhxul786an743u0fascv4wtc5xduu7qfy803lfs539yzhgmlq5ds2lznt5

  # Hosts
-  - &host_bakke age1syted6kt48sumjjucggh6r3uca4x2ppp4mfungf3lamkt2le05csc99633
+  - &host_jokum age1gp8ye4g2mmw3may5xg0zsy7mm04glfz3788mmdx9cvcsdxs9hg0s0cc9kt
+  - &host_ildkule age1x28hmzvuv6f2n66c0jtqcca3h9rput8d7j5uek6jcpx8n9egd52sqpejq0
  - &host_bekkalokk age12nj59tguy9wg882updc2vjdusx5srnxmjyfaqve4zx6jnnsaw3qsyjq6zd
  - &host_bicep age19nk55kcs7s0358jpkn75xnr57dfq6fq3p43nartvsprx0su22v7qcgcjdx
-  - &host_ildkule age1x28hmzvuv6f2n66c0jtqcca3h9rput8d7j5uek6jcpx8n9egd52sqpejq0
+  - &host_ustetind age1hffjafs4slznksefmtqrlj7rdaqgzqncn4un938rhr053237ry8s3rs0v8
  - &host_kommode age1mt4d0hg5g76qp7j0884llemy0k2ymr5up8vfudz6vzvsflk5nptqqd32ly
  - &host_lupine-1 age1fkrypl6fu4ldsa7te4g3v4qsegnk7sd6qhkquuwzh04vguy96qus08902e
  - &host_lupine-2 age1mu0ej57n4s30ghealhyju3enls83qyjua69986la35t2yh0q2s0seruz5n
  - &host_lupine-3 age1j2u876z8hu87q5npfxzzpfgllyw8ypj66d7cgelmzmnrf3xud34qzkntp9
  - &host_lupine-4 age1t8zlawqkmhye737pn8yx0z3p9cl947d9ktv2cajdc6hnvn52d3fsc59s2k
  - &host_lupine-5 age199zkqq4jp4yc3d0hx2q0ksxdtp42xhmjsqwyngh8tswuck34ke3smrfyqu
-  - &host_ustetind age1hffjafs4slznksefmtqrlj7rdaqgzqncn4un938rhr053237ry8s3rs0v8

 creation_rules:
  # Global secrets
  - path_regex: secrets/[^/]+\.yaml$
    key_groups:
    - age:
+      - *host_jokum
      - *user_danio
      - *user_felixalb
      - *user_eirikwit
@@ -61,6 +62,18 @@ creation_rules:
      pgp:
      - *user_oysteikt

+  - path_regex: secrets/jokum/[^/]+\.yaml$
+    key_groups:
+    - age:
+      - *host_jokum
+      - *user_danio
+      - *user_felixalb
+      - *user_pederbs_sopp
+      - *user_pederbs_nord
+      - *user_pederbs_bjarte
+      pgp:
+      - *user_oysteikt
+
  - path_regex: secrets/ildkule/[^/]+\.yaml$
    key_groups:
    - age:
@@ -112,15 +125,3 @@ creation_rules:
      - *user_pederbs_bjarte
      pgp:
      - *user_oysteikt
-
-  - path_regex: secrets/bakke/[^/]+\.yaml$
-    key_groups:
-    - age:
-      - *host_bakke
-      - *user_danio
-      - *user_felixalb
-      - *user_pederbs_sopp
-      - *user_pederbs_nord
-      - *user_pederbs_bjarte
-      pgp:
-      - *user_oysteikt
--- a/README.MD
+++ b/README.MD
@@ -0,0 +1,61 @@
+# PVV NixOS configs
+
+## Hvordan endre på ting
+
+Før du endrer på ting husk å ikke putte ting som skal være hemmelig uten å først lese seksjonen for hemmeligheter!
+
+Etter å ha klonet prosjektet ned og gjort endringer kan du evaluere configene med:
+
+`nix flake check --keep-going`
+
+før du bygger en maskin med:
+
+`nix build .#<maskinnavn>`
+
+hvis du vil være ekstra sikker på at alt bygger så kan du kjøre:
+
+`nix build .` for å bygge alle de viktige maskinene.
+
+NB: Dette kan ta opp til 30 minutter avhengig av hva som ligger i caches
+
+Husk å hvertfall stage nye filer om du har laget dem!
+
+Om alt bygger fint commit det og push til git repoet.
+Det er sikkert lurt å lage en PR først om du ikke er vandt til nix enda.
+
+Innen 24h skal alle systemene hente ned den nye konfigurasjonen og deploye den.
+
+Du kan tvinge en maskin til å oppdatere seg før dette ved å kjøre:
+`nixos-rebuild switch --update-input nixpkgs --update-input nixpkgs-unstable --no-write-lock-file --refresh --upgrade --flake git+https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git`
+
+som root på maskinen.
+
+Hvis du ikke har lyst til å oppdatere alle pakkene (og kanskje måtte vente en stund!) kan du kjøre
+
+`nixos-rebuild switch --override-input nixpkgs nixpkgs --override-input nixpkgs-unstable nixpkgs-unstable --flake git+https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git`
+
+## Seksjonen for hemmeligheter
+
+For at hemmeligheter ikke skal deles med hele verden i git - eller å være world
+readable i nix-storen, bruker vi [sops-nix](https://github.com/Mic92/sops-nix)
+
+For å legge til secrets kan du kjøre f.eks. `sops secrets/jokum/jokum.yaml`
+Dette vil dekryptere filen og gi deg en text-editor du kan bruke for endre hemmelighetene.
+
+Et nix shell med dette verktøyet inkludert ligger i flaket og shell.nix og kan aktiveres med:
+
+`nix-shell` eller `nix develop`. Vi anbefaler det siste.
+I tilegg kan du sette opp [direnv](https://direnv.net/) slik at dette skjer automatisk
+
+for å få tilgang til å lese/skrive hemmeligheter må du spørre noen/noe som har tilgang til hemmelighetene
+om å legge til age eller pgp nøkkelen din i [`.sops.yaml`](https://git.pvv.ntnu.no/Drift/pvv-nixos-config/src/main/.sops.yaml)
+
+Denne kan du generere fra ssh-nøkkelene dine eller lage en egen nøkkel.
+
+### Legge til flere keys
+
+Gjør det som gir mening i .sops.yml
+
+Etter det kjør `sops updatekeys secrets/host/file.yml`
+
+MERK at det ikke er `sops -r` som BARE roterer nøkklene for de som allerede er i secretfila
--- a/README.md
+++ b/README.md
@@ -1,36 +0,0 @@
-# PVV NixOS config
-
-This repository contains the NixOS configurations for Programvareverkstedet's server closet.
-In addition to machine configurations, it also contains a bunch of shared modules, packages, and
-more.
-
-## Machines
-
-| Name                       | Type     | Description                                               |
-|----------------------------|----------|-----------------------------------------------------------|
-| [bekkalokk][bek]           | Physical | Our main web host, webmail, wiki, idp, minecraft map, ... |
-| [bicep][bic]               | Virtual  | Database host, matrix, git mirrors, ...                   |
-|  bikkje                    | Virtual  | Experimental login box                                    |
-| [brzeczyszczykiewicz][brz] | Physical | Shared music player                                       |
-| [georg][geo]               | Physical | Shared music player                                       |
-| [ildkule][ild]             | Virtual  | Logging and monitoring host, prometheus, grafana, ...     |
-| [kommode][kom]             | Virtual  | Gitea + Gitea pages                                       |
-| [lupine][lup]              | Physical | Gitea CI/CD runners                                       |
-|  shark                     | Virtual  | Test host for authentication, absolutely horrendous       |
-| [wenche][wen]              | Virtual  | Nix-builders, general purpose compute                     |
-
-## Documentation
-
- [Development - working on the PVV machines](./docs/development.md)
- [Miscellaneous development notes](./docs/development-misc.md)
- [User management](./docs/users.md)
- [Secret management and `sops-nix`](./docs/secret-management.md)
-
-[bek]: https://wiki.pvv.ntnu.no/wiki/Maskiner/bekkalokk
-[bic]: https://wiki.pvv.ntnu.no/wiki/Maskiner/bicep
-[brz]: https://wiki.pvv.ntnu.no/wiki/Maskiner/brzęczyszczykiewicz
-[geo]: https://wiki.pvv.ntnu.no/wiki/Maskiner/georg
-[ild]: https://wiki.pvv.ntnu.no/wiki/Maskiner/ildkule
-[kom]: https://wiki.pvv.ntnu.no/wiki/Maskiner/kommode
-[lup]: https://wiki.pvv.ntnu.no/wiki/Maskiner/lupine
-[wen]: https://wiki.pvv.ntnu.no/wiki/Maskiner/wenche
--- a/base/default.nix
+++ b/base/default.nix
@@ -25,9 +25,6 @@
    ./services/nginx.nix
    ./services/openssh.nix
    ./services/postfix.nix
-    ./services/prometheus-node-exporter.nix
-    ./services/prometheus-systemd-exporter.nix
-    ./services/promtail.nix
    ./services/smartd.nix
    ./services/thermald.nix
    ./services/userborn.nix
--- a/base/flake-input-exporter.nix
+++ b/base/flake-input-exporter.nix
@@ -45,8 +45,8 @@ in
      allow ${values.hosts.ildkule.ipv6}/128;
      allow 127.0.0.1/32;
      allow ::1/128;
-      allow ${values.ipv4-space};
-      allow ${values.ipv6-space};
+      allow 129.241.210.128/25;
+      allow 2001:700:300:1900::/64;
      deny all;
    '';
  };
--- a/base/services/nginx.nix
+++ b/base/services/nginx.nix
@@ -40,25 +40,6 @@
  };

  services.nginx.virtualHosts."_" = lib.mkIf config.services.nginx.enable {
-    listen = [
-      {
-        addr = "0.0.0.0";
-        extraParameters = [
-          "default_server"
-          # Seemingly the default value of net.core.somaxconn
-          "backlog=4096"
-          "deferred"
-        ];
-      }
-      {
-        addr = "[::0]";
-        extraParameters = [
-          "default_server"
-          "backlog=4096"
-          "deferred"
-        ];
-      }
-    ];
    sslCertificate = "/etc/certs/nginx.crt";
    sslCertificateKey = "/etc/certs/nginx.key";
    addSSL = true;
--- a/base/services/prometheus-node-exporter.nix
+++ b/base/services/prometheus-node-exporter.nix
@@ -1,23 +0,0 @@
-{ config, lib, values, ... }:
-let
-  cfg = config.services.prometheus.exporters.node;
-in
-{
-  services.prometheus.exporters.node = {
-    enable = lib.mkDefault true;
-    port = 9100;
-    enabledCollectors = [ "systemd" ];
-  };
-
-  systemd.services.prometheus-node-exporter.serviceConfig = lib.mkIf cfg.enable {
-    IPAddressDeny = "any";
-    IPAddressAllow = [
-      "127.0.0.1"
-      "::1"
-      values.hosts.ildkule.ipv4
-      values.hosts.ildkule.ipv6
-    ];
-  };
-
-  networking.firewall.allowedTCPPorts = lib.mkIf cfg.enable [ cfg.port ];
-}
--- a/base/services/prometheus-systemd-exporter.nix
+++ b/base/services/prometheus-systemd-exporter.nix
@@ -1,26 +0,0 @@
-{ config, lib, values, ... }:
-let
-  cfg = config.services.prometheus.exporters.systemd;
-in
-{
-  services.prometheus.exporters.systemd = {
-    enable = lib.mkDefault true;
-    port = 9101;
-    extraFlags = [
-      "--systemd.collector.enable-restart-count"
-      "--systemd.collector.enable-ip-accounting"
-    ];
-  };
-
-  systemd.services.prometheus-systemd-exporter.serviceConfig = {
-    IPAddressDeny = "any";
-    IPAddressAllow = [
-      "127.0.0.1"
-      "::1"
-      values.hosts.ildkule.ipv4
-      values.hosts.ildkule.ipv6
-    ];
-  };
-
-  networking.firewall.allowedTCPPorts = lib.mkIf cfg.enable [ cfg.port ];
-}
--- a/base/services/promtail.nix
+++ b/base/services/promtail.nix
@@ -1,38 +0,0 @@
-{ config, lib, values, ... }:
-let
-  cfg = config.services.prometheus.exporters.node;
-in
-{
-  services.promtail = {
-    enable = lib.mkDefault true;
-    configuration = {
-      server = {
-        http_listen_port = 28183;
-        grpc_listen_port = 0;
-      };
-      clients = [{
-        url = "http://ildkule.pvv.ntnu.no:3100/loki/api/v1/push";
-      }];
-      scrape_configs = [{
-        job_name = "systemd-journal";
-        journal = {
-          max_age = "12h";
-          labels = {
-            job = "systemd-journal";
-            host = config.networking.hostName;
-          };
-        };
-        relabel_configs = [
-          {
-            source_labels = [ "__journal__systemd_unit" ];
-            target_label = "unit";
-          }
-          {
-            source_labels = [ "__journal_priority_keyword" ];
-            target_label = "level";
-          }
-        ];
-      }];
-    };
-  };
-}
--- a/docs/development-misc.md
+++ b/docs/development-misc.md
@@ -1,103 +0,0 @@
-# Miscellaneous development notes
-
-This document contains a bunch of information that is not particularly specific to the pvv nixos config,
-but concerns technologies we use often or gotchas to be aware of when working with NixOS. A lot of the information
-here is already public information spread around the internet, but we've collected some of the items we use often
-here.
-
-## The firewall
-
-`networking.firewall` is a NixOS module that configures `iptables` rules on the machine. It is enabled by default on
-all of our machines, and it can be easy to forget about it when setting up new services, especially when we are the
-ones creating the NixOS module.
-
-When setting up a new service that listens on a TCP or UDP port, make sure to add the appropriate ports to either
-`networking.firewall.allowedTCPPorts` or `networking.firewall.allowedUDPPorts`.
-
-You can list out the current firewall rules by running `sudo iptables -L -n -v` on the machine.
-
-## Finding stuff
-
-Finding stuff, both underlying implementation and usage is absolutely crucial when working on nix.
-Oftentimes, the documentation will be outdated, lacking or just plain out wrong. These are some of
-the techniques we have found to be quite good when working with nix.
-
-### [ripgrep](https://github.com/BurntSushi/ripgrep)
-
-ripgrep (or `rg` for short) is a tool that lets you recursively grep for regex patters in a directory.
-
-It is great for finding references to configuration, and where and how certain things are used. It is
-especially great when working with [nixpkgs](https://github.com/NixOS/nixpkgs), which is quite large.
-
-### GitHub Search
-
-When trying to set up a new service or reconfigure something, it is very common that someone has done it
-before you, but it has never been documented anywhere. A lot of Nix code exists on GitHub, and you can
-easily query it by using the `lang:nix` filter in the search bar.
-
-For example: https://github.com/search?q=lang%3Anix+dibbler&type=code
-
-## rsync
-
-`rsync` is a tool for synchronizing files between machines. It is very useful when transferring large
-amounts of data from a to b. We use it for multiple things, often when data is produced or stored on
-one machine, and we want to process or convert it on another. For example, we use it to transfer gitea
-artifacts, to transfer gallery pictures, to transfer minecraft world data for map rendering, and more.
-
-Along with `rsync`, we often use a lesser known tool called `rrsync`, which you can use inside an ssh
-configuration (`authorized_keys` file) to restrict what paths a user can access when connecting over ssh.
-This is useful both as a security measure, but also to avoid accidental overwrites of files outside the intended
-path. `rrsync` will use chroot to restrict what paths the user can access, as well as refuse to run arbitrary commands.
-
-## `nix repl`
-
-`nix repl` is an interactive REPL for the Nix language. It is very useful for experimenting with Nix code,
-and testing out small snippets of code to make sure it behaves as expected. You can also use it to explore
-NixOS machine configurations, to interactively see that the configuration evaluates to what you expect.
-
-```
-# While in the pvv-nixos-config directory
-nix repl .
-
-# Upon writing out the config path and clickin [Tab], you will get autocompletion suggestions:
-nix-repl> nixosConfigurations.bekkalokk.config.services.nginx.virtualHosts.
-nixosConfigurations.bekkalokk.config.services.nginx.virtualHosts._
-nixosConfigurations.bekkalokk.config.services.nginx.virtualHosts.bekkalokk.pvv.ntnu.no-nixos-metrics
-nixosConfigurations.bekkalokk.config.services.nginx.virtualHosts.idp.pvv.ntnu.no
-nixosConfigurations.bekkalokk.config.services.nginx.virtualHosts.minecraft.pvv.ntnu.no
-nixosConfigurations.bekkalokk.config.services.nginx.virtualHosts.pvv.ntnu.no
-nixosConfigurations.bekkalokk.config.services.nginx.virtualHosts.pvv.org
-nixosConfigurations.bekkalokk.config.services.nginx.virtualHosts.pw.pvv.ntnu.no
-nixosConfigurations.bekkalokk.config.services.nginx.virtualHosts.roundcubeplaceholder.example.com
-nixosConfigurations.bekkalokk.config.services.nginx.virtualHosts.snappymail.pvv.ntnu.no
-nixosConfigurations.bekkalokk.config.services.nginx.virtualHosts.webmail.pvv.ntnu.no
-nixosConfigurations.bekkalokk.config.services.nginx.virtualHosts.wiki.pvv.ntnu.no
-nixosConfigurations.bekkalokk.config.services.nginx.virtualHosts.www.pvv.ntnu.no
-nixosConfigurations.bekkalokk.config.services.nginx.virtualHosts.www.pvv.org
-```
-
-## `nix why-depends`
-
-If you ever wonder why a certain package is being used as a dependency of another package,
-or another machine, you can use `nix why-depends` to find the dependency path from one package to another.
-This is often useful after updating nixpkgs and finding an error saying that a certain package is insecure,
-broken or whatnot. You can do something like the following
-
-```bash
-# Why does bekkalokk depend on openssl?
-nix why-depends .#nixosConfigurations.bekkalokk.config.system.build.toplevel .#nixosConfigurations.bekkalokk.pkgs.openssl
-
-# Why does bekkalokk's minecraft-server depend on zlib? (this is not real)
-nix why-depends .#nixosConfigurations.bekkalokk.pkgs.minecraft-server .#nixosConfigurations.bekkalokk.pkgs.zlib
-```
-
-## php-fpm
-
-php-fpm (FastCGI Process Manager) is a PHP implementation that is designed for speed and production use. We host a bunch
-of different PHP applications (including our own website), and so we use php-fpm quite a bit. php-fpm typically exposes a
-unix socket that nginx will connect to, and php-fpm will then render php upon web requests forwarded from nginx and return
-it.
-
-php-fpm has a tendency to be a bit hard to debug. It is not always very willing to spit out error messages and logs, and so
-it can be a bit hard to figure out what's up when something goes wrong. You should see some of the commented stuff laying around
-in the website code on bekkalokk for examples of how to configure php-fpm for better logging and error reporting.
--- a/docs/development.md
+++ b/docs/development.md
@@ -1,190 +0,0 @@
-# Development - working on the PVV machines
-
-This document outlines the process of editing our NixOS configurations, and testing and deploying said changes
-to the machines. Most of the information written here is specific to the PVV NixOS configuration, and the topics
-will not really cover the nix code itself in detail. You can find some more resources for that by either following
-the links from the *Upstream documentation* section below, or in [Miscellaneous development notes](./development-misc.md).
-
-## Editing nix files
-
-> [!WARN]
-> Before editing any nix files, make sure to read [Secret management and `sops-nix`](./secret-management.md)!
-> We do not want to add any secrets in plaintext to the nix files, and certainly not commit and publish
-> them into the common public.
-
-The files are plaintext code, written in the [`Nix` language](https://nix.dev/manual/nix/stable/language/).
-
-Below is a list of important files and directories, and a description of what they contain.
-
-### `flake.nix`
-
-The `flake.nix` file is a [nix flake](https://wiki.nixos.org/wiki/Flakes) and makes up the entrypoint of the
-entire configuration. It declares what inputs are used (similar to dependencies), as well as what outputs the
-flake exposes. In our case, the most important outputs are the `nixosConfigurations` (our machine configs), but
-we also expose custom modules, packages, devshells, and more. You can run `nix flake show` to get an overview of
-the outputs (however you will need to [enable the `nix-flakes` experimental option](https://wiki.nixos.org/wiki/Flakes#Setup)).
-
-You will find that a lot of the flake inputs are the different PVV projects that we develop, imported to be hosted
-on the NixOS machines. This makes it easy to deploy changes to these projects, as we can just update the flake input
-to point to a new commit or version, and then rebuild the machines.
-
-A NixOS configuration is usually made with the `nixpkgs.lib.nixosSystem` function, however we have a few custom wrapper
-functions named `nixosConfig` and `stableNixosConfig` that abstracts away some common configuration we want on all our machines.
-
-### `values.nix`
-
-`values.nix` is a somewhat rare pattern in NixOS configurations around the internet. It contains a bunch of constant values
-that we use throughout the configuration, such as IP addresses, DNS names, paths and more. This not only makes it easier to
-change the values should we need to, but it also makes the configuration more readable. Instead of caring what exact IP any
-machine has, you can write `values.machines.name.ipv4` and abstract the details away.
-
-### `base`
-
-The `base` directory contains a bunch of NixOS configuration that is common for all or most machines. Some of the config
-you will find here sets defaults for certain services without enabling them, so that when they are enabled in a machine config,
-we don't need to repeat the same defaults over again. Other parts actually enable certain services that we want on all machines,
-such as `openssh` or the auto upgrade timer.
-
-### Vendoring `modules` and `packages`
-
-Sometimes, we either find that the packages or modules provided by `nixpkgs` is not sufficient for us,
-or that they are bugged in some way that can not be easily overrided. There are also cases where the
-modules or packages does not exist. In these cases, we tend to either copy and modify the modules and
-packages from nixpkgs, or create our own. These modules and packages end up in the top-level `modules`
-and `packages` directories. They are usually exposed in `flake.nix` as flake outputs `nixosModules.<name>`
-and `packages.<platform>.<name>`, and they are usually also added to the machines that need them in the flake.
-
-In order to override or add an extra package, the easiest way is to use an [`overlay`](https://wiki.nixos.org/wiki/Overlays).
-This makes it so that the package from `pkgs.<name>` now refers to the modified variant of the package.
-
-In order to add a module, you can just register it in the modules of the nixos machine.
-In order to override a module, you also have to use `disabledModules = [ "<path-relative-to-nixpkgs/modules>" ];`.
-Use `rg` to find examples of the latter.
-
-Do note that if you believe a new module to be of high enough quality, or the change you are making to be
-relevant for every nix user, you should strongly consider also creating a PR towards nixpkgs. However,
-getting changes made there has a bit higher threshold and takes more time than making changes in the PVV config,
-so feel free to make the changes here first. We can always remove the changes again once the upstreaming is finished.
-
-### `users`, `secrets` and `keys`
-
-For `users`, see [User management](./users.md)
-
-For `secrets` and `keys`, see [Secret management and `sops-nix`](./secret-management.md)
-
-### Collaboration
-
-We use our gitea to collaborate on changes to the nix configuration. Every PVV maintenance member should have
-access to the repository. The usual workflow is that we create a branch for the change we want to make, do a bunch
-of commits and changes, and then open a merge request for review (or just rebase on master if you know what you are doing).
-
-### Upstream documentation
-
-Here are different sources of documentation and stuff that you might find useful while
-writing, editing and debugging nix code.
-
- - [nixpkgs repository](https://github.com/NixOS/nixpkgs)
-
-This is particularly useful to read the source code, as well as upstreaming pieces of code that we think
-everyone would want
-
- - [NixOS search](https://search.nixos.org/)
-
-This is useful for searching for both packages and NixOS options.
-
- - [nixpkgs documentation](https://nixos.org/manual/nixpkgs/stable/)
- - [NixOS documentation](https://nixos.org/manual/nixos/stable/)
- - [nix (the tool) documentation](https://nix.dev/manual/nix/stable/)
-
-All of the three above make up the official documentation with all technical
-details about the different pieces that makes up NixOS.
-
- - [The official NixOS wiki](https://wiki.nixos.org)
-
-User-contributed guides, tips and tricks, and whatever else.
-
- - [nix.dev](https://nix.dev)
-
-Additional stuff
-
- - [Noogle](https://noogle.dev)
-
-This is useful when looking for nix functions and packaging helpers.
-
-## Testing and deploying changes
-
-After editing the nix files on a certain branch, you will want to test and deploy the changes to the machines.
-Unfortunately, we don't really have a good setup for testing for runtime correctness locally, but we can at least
-make sure that the code evaluates and builds correctly before deploying.
-
-To just check that the code evaluates without errors, you can run:
-
-```bash
-nix flake check
-# Or if you want to keep getting all errors before it quits:
-nix flake check --keep-going
-```
-
-> [!NOTE]
-> If you are making changes that involves creating new nix files, remember to `git add` those files before running
-> any nix commands. Nix refuses to acknowledge files that are not either commited or at least staged. It will spit
-> out an error message about not finding the file in question.
-
-### Building machine configurations
-
-To build any specific machine configuration and look at the output, you can run:
-
-```bash
-nix build .#nixosConfigurations.<machine-name>.config.system.build.toplevel
-# or just
-nix build .#<machine-name>
-```
-
-This will create a symlink name `./result` to a directory containing the built NixOS system. It is oftentimes
-the case that config files for certain services only end up in the nix store without being put into `/etc`. If you wish
-to read those files, you can often find them by looking at the systemd unit files in `./result/etc/systemd/system/`.
-(if you are using vim, `gf` or go-to-file while the cursor is over a file path is a useful trick while doing this).
-
-If you have edited something that affects multiple machines, you can also build all important machines at once by running:
-
-```bash
-nix build .#
-```
-
-> [!NOTE]
-> Building all machines at once can take a long time, depending on what has changed and whether you have already
-> built some of the machines recently. Be prepared to wait for up to an hour to build all machines from scratch
-> if this is the first time.
-
-### Deploying to machines
-
-> [!WARN]
-> Be careful to think about state when testing changes against the machines. Sometimes, a certain change
-> can lead to irreversible changes to the data stored on the machine. An example would be a set of database
-> migrations applied when testing a newer version of a service. Unless that service also comes with downwards
-> migrations, you can not go back to the previous version without losing data.
-
-To deploy the changes to a machine, you should first SSH into the machine, and clone the pvv-nixos-config
-repository unless you have already done so. After that, checkout the branch you want to deploy from, and rebuild:
-
-```bash
-# Run this while in the pvv-nixos-config directory
-sudo nixos-rebuild switch --update-input nixpkgs --update-input nixpkgs-unstable --no-write-lock-file --refresh --flake .# --upgrade
-```
-
-This will rebuild the NixOS system on the current branch and switch the system configuration to reflect the new changes.
-
-Note that unless you eventually merge the current changes into `main`, the machine will rebuild itself automatically and
-revert the changes on the next nightly rebuild (tends to happen when everybody is asleep).
-
-### Forcefully reset to `main`
-
-If you ever want to reset a machine to the `main` branch, you can do so by running:
-
-```bash
-nixos-rebuild switch --update-input nixpkgs --update-input nixpkgs-unstable --no-write-lock-file --refresh --upgrade --flake git+https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git
-```
-
-This will ignore the current branch and just pull the latest `main` from the git repository directly from gitea.
-You can also use this command if there are updates on the `main` branch that you want to deploy to the machine without
-waiting for the nightly rebuild.
--- a/docs/secret-management.md
+++ b/docs/secret-management.md
@@ -1,160 +0,0 @@
-# Secret management and `sops-nix`
-
-Nix config is love, nix config is life, and publishing said config to the
-internet is not only a good deed and kinda cool, but also encourages properly
-secured configuration as opposed to [security through obscurity](https://en.wikipedia.org/wiki/Security_through_obscurity).
-That being said, there are some details of the config that we really shouldn't
-share with the general public. In particular, there are so-called *secrets*, that is
-API keys, passwords, tokens, cookie secrets, salts, peppers and jalapenos that we'd
-rather keep to ourselves. However, it is not entirely trivial to do so in the NixOS config.
-For one, we'd have to keep these secrets out of the public git repo somehow, and secondly
-everything that is configured via nix ends up as world readable files (i.e. any user on the
-system can read the file) in `/nix/store`.
-
-In order to solve this, we use a NixOS module called [`sops-nix`](https://github.com/Mic92/sops-nix)
-which uses a technology called [`sops`](https://github.com/getsops/sops) behind the scenes.
-The idea is simple: we encrypt these secrets with a bunch of different keys and store the
-encrypted files in the git repo. First of all, we encrypt the secrets a bunch of time with
-PVV maintenance member's keys, so that we can decrypt and edit the contents. Secondly, we
-encrypt the secrets with the [host keys]() of the NixOS machines, so that they can decrypt
-the secrets. The secrets will be decrypted and stored in a well-known location (usually `/run/secrets`)
-so that they do not end up in the nix store, and are not world readable.
-
-This way, we can both keep the secrets in the git repository and let multiple people edit them,
-but also ensure that they don't end up in the wrong hands.
-
-## Adding a new machine
-
-In order to add a new machine to the nix-sops setup, you should do the following:
-
-```console
-# Create host keys (if they don't already exist)
-ssh-keygen -A -b 4096
-
-# Derive an age-key from the public host key
-nix-shell -p ssh-to-age --run 'cat /etc/ssh/ssh_host_ed25519_key.pub | ssh-to-age'
-
-# Register the age key in .sops.yaml
-vim .sops.yaml
-```
-
-The contents of `.sops.yaml` should look like this:
-
-```yaml
-keys:
-  # Users
-  ...
-
-  # Hosts
-  ...
-  - &host_<machine_name> <public_age_key>
-
-creation_rules:
-  ...
-
-  - path_regex: secrets/<machine_name>/[^/]+\.yaml$
-    key_groups:
-    - age:
-      - *host_<machine_name>
-      - ... user keys
-    - pgp:
-      - ... user keys
-```
-
-> [!NOTE]
-> Take care that all the keys in the `age` and `pgp` sections are prefixed
-> with a `-`, or else sops might try to encrypt the secrets in a way where
-> you need both keys present to decrypt the content. Also, it tends to throw
-> interesting errors when it fails to do so.
-
-```console
-# While cd-ed into the repository, run this to get a shell with the `sops` tool present
-nix-shell
-```
-
-Now you should also be able to edit secrets for this machine by running:
-
-```
-sops secrets/<machine_name>/<machine_name>.yaml
-```
-
-## Adding a user
-
-Adding a user is quite similar to adding a new machine.
-This guide assumes you have already set up SSH keys.
-
-```
-# Derive an age-key from your key
-# (edit the path to the key if it is named something else)
-nix-shell -p ssh-to-age --run 'cat ~/.ssh/id_ed25519.pub | ssh-to-age'
-
-# Register the age key in .sops.yaml
-vim .sops.yaml
-```
-
-The contents of `.sops.yaml` should look like this:
-
-```yaml
-keys:
-  # Users
-  ...
-  - &user_<user_name> <public_age_key>
-
-  # Hosts
-  ...
-
-creation_rules:
-  ...
-
-  # Do this for all the machines you are planning to edit
-  # (or just do it for all machines)
-  - path_regex: secrets/<machine_name>/[^/]+\.yaml$
-    key_groups:
-    - age:
-      - *host_<machine_name>
-      - ... user keys
-      - *host_<user_name>
-    - pgp:
-      - ... user keys
-```
-
-Now that sops is properly configured to recognize the key, you need someone
-who already has access to decrypt all the secrets and re-encrypt them with your
-key. At this point, you should probably [open a PR](https://docs.gitea.com/usage/issues-prs/pull-request)
-and ask someone in PVV maintenance if they can checkout the PR branch, run the following
-command and push the diff back into the PR (and maybe even ask them to merge if you're feeling
-particularly needy).
-
-```console
-sops updatekeys secrets/*/*.yaml
-```
-
-## Updating keys
-
-> [!NOTE]
-> At some point, we found this flag called `sops -r` that seemed to be described to do what
-> `sops updatekeys` does, do not be fooled. This only rotates the "inner key" for those who
-> already have the secrets encrypted with their key.
-
-Updating keys is done with this command:
-
-```console
-sops updatekeys secrets/*/*.yaml
-```
-
-However, there is a small catch. [oysteikt](https://git.pvv.ntnu.no/oysteikt) has kinda been
-getting gray hairs lately, and refuses to use modern technology - he is still stuck using GPG.
-This means that to be able to re-encrypt the sops secrets, you will need to have a gpg keychain
-with his latest public key available. The key has an expiry date, so if he forgets to update it,
-you should send him and angry email and tag him a bunch of times in a gitea issue. If the key
-is up to date, you can do the following:
-
-```console
-# Fetch gpg (unless you have it already)
-nix-shell -p gpg
-
-# Import oysteikts key to the gpg keychain
-gpg --import ./keys/oysteikt.pub
-```
-
-Now you should be able to run the `sops updatekeys` command again.
--- a/docs/users.md
+++ b/docs/users.md
@@ -1,50 +0,0 @@
-# User management
-
-Due to some complications with how NixOS creates users compared to how we used to
-create users with the salt-based setup, the NixOS machine users are created and
-managed separately. We tend to create users on-demand, whenever someone in PVV
-maintenance want to work on the NixOS machines.
-
-## Setting up a new user
-
-You can find the files for the existing users, and thereby examples of user files
-in the [`users`](../users) directory. When creating a new file here, you should name it
-`your-username.nix`, and add *at least* the following contents:
-
-```nix
-{ pkgs, ... }:
-{
-  users.users."<username>" = {
-    isNormalUser = true;
-    extraGroups = [
-      "wheel" # In case you wanna use sudo (you probably do)
-      "nix-builder-users" # Arbitrary access to write to the nix store
-    ];
-
-    # Any packages you frequently use to manage servers go here.
-    # Please don't pull gigantonormous packages here unless you
-    # absolutely need them, and remember that any package can be
-    # pulled via nix-shell if you only use it once in a blue moon.
-    packages = with pkgs; [
-      bottom
-      eza
-    ];
-
-    # Not strictly needed, but we recommend adding your public SSH
-    # key here. If it is not present, you will have to log into the
-    # machine as 'root' before setting your password for every NixOS
-    # machine you have not logged into yet.
-    openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIjiQ0wg4lpC7YBMAAHoGmgwqHOBi+EUz5mmCymGlIyT my-key"
-    ];
-  };
-}
-```
-
-The file will be picked up automatically, so creating the file and adding the
-contents should be enough to get you registered. You should
-[open a PR](https://docs.gitea.com/usage/issues-prs/pull-request) with the new
-code so the machines will be rebuilt with your user present.
-
-See also [Secret Management](./secret-management.md) for how to add your keys to the
-system that lets us add secrets (API keys, password, etc.) to the NixOS config.
--- a/flake.lock
+++ b/flake.lock
@@ -1,26 +1,5 @@
 {
  "nodes": {
-    "devshell": {
-      "inputs": {
-        "nixpkgs": [
-          "nix-topology",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1728330715,
-        "narHash": "sha256-xRJ2nPOXb//u1jaBnDP56M7v5ldavjbtR6lfGqSvcKg=",
-        "owner": "numtide",
-        "repo": "devshell",
-        "rev": "dd6b80932022cea34a019e2bb32f6fa9e494dfef",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "devshell",
-        "type": "github"
-      }
-    },
    "disko": {
      "inputs": {
        "nixpkgs": [
@@ -28,54 +7,19 @@
        ]
      },
      "locked": {
-        "lastModified": 1736864502,
-        "narHash": "sha256-ItkIZyebGvNH2dK9jVGzJHGPtb6BSWLN8Gmef16NeY0=",
+        "lastModified": 1764627417,
+        "narHash": "sha256-D6xc3Rl8Ab6wucJWdvjNsGYGSxNjQHzRc2EZ6eeQ6l4=",
        "owner": "nix-community",
        "repo": "disko",
-        "rev": "0141aabed359f063de7413f80d906e1d98c0c123",
+        "rev": "5a88a6eceb8fd732b983e72b732f6f4b8269bef3",
        "type": "github"
      },
      "original": {
        "owner": "nix-community",
-        "ref": "v1.11.0",
        "repo": "disko",
        "type": "github"
      }
    },
-    "flake-compat": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1696426674,
-        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
-        "owner": "edolstra",
-        "repo": "flake-compat",
-        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
-        "type": "github"
-      },
-      "original": {
-        "owner": "edolstra",
-        "repo": "flake-compat",
-        "type": "github"
-      }
-    },
-    "flake-utils": {
-      "inputs": {
-        "systems": "systems"
-      },
-      "locked": {
-        "lastModified": 1726560853,
-        "narHash": "sha256-X6rJYSESBVr3hBoH0WbKE5KvhPU5bloyZ2L4K60/fPQ=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "c1dfcf08411b08f6b8615f7d8971a2bfa81d5e8a",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
    "gergle": {
      "inputs": {
        "nixpkgs": [
@@ -85,40 +29,17 @@
      "locked": {
        "lastModified": 1764868579,
        "narHash": "sha256-rfTUOIc0wnC4+19gLVfPbHfXx/ilfuUix6bWY+yaM2U=",
-        "ref": "main",
+        "ref": "refs/heads/main",
        "rev": "9c923d1d50daa6a3b28c3214ad2300bfaf6c8fcd",
        "revCount": 22,
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Grzegorz/gergle.git"
      },
      "original": {
-        "ref": "main",
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Grzegorz/gergle.git"
      }
    },
-    "gitignore": {
-      "inputs": {
-        "nixpkgs": [
-          "nix-topology",
-          "pre-commit-hooks",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1709087332,
-        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
-        "owner": "hercules-ci",
-        "repo": "gitignore.nix",
-        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hercules-ci",
-        "repo": "gitignore.nix",
-        "type": "github"
-      }
-    },
    "greg-ng": {
      "inputs": {
        "nixpkgs": [
@@ -127,16 +48,15 @@
        "rust-overlay": "rust-overlay"
      },
      "locked": {
-        "lastModified": 1765760377,
-        "narHash": "sha256-2+lgzUjVas9hPSeWn52MwuX+iidMN4RkzkHo4vrGmR8=",
-        "ref": "main",
-        "rev": "f340dc5b9c9f3b75b7aca41f56f8869b9e28cf8c",
-        "revCount": 58,
+        "lastModified": 1764868843,
+        "narHash": "sha256-ZXYLXKO+VjAJr2f5zz+7SuKFICfI2eZnmTgS/626YE0=",
+        "ref": "refs/heads/main",
+        "rev": "c095533c50e80dd18ac48046f1479cf4d83c631c",
+        "revCount": 52,
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Grzegorz/greg-ng.git"
      },
      "original": {
-        "ref": "main",
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Grzegorz/greg-ng.git"
      }
@@ -150,14 +70,13 @@
      "locked": {
        "lastModified": 1764867811,
        "narHash": "sha256-UWHiwr8tIcGcVxMLvAdNxDbQ8QuHf3REHboyxvFkYEI=",
-        "ref": "master",
+        "ref": "refs/heads/master",
        "rev": "c9983e947efe047ea9d6f97157a1f90e49d0eab3",
        "revCount": 81,
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Grzegorz/grzegorz-clients.git"
      },
      "original": {
-        "ref": "master",
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Grzegorz/grzegorz-clients.git"
      }
@@ -187,20 +106,18 @@
      "inputs": {
        "nixpkgs": [
          "nixpkgs"
-        ],
-        "rust-overlay": "rust-overlay_2"
+        ]
      },
      "locked": {
-        "lastModified": 1766407405,
-        "narHash": "sha256-UEJ8F8/oG70biWRrGbL5/aB7OXzzvnYs+jxkR07UHvA=",
-        "ref": "main",
-        "rev": "e719840f72ca1b0cd169562a3a0de69899821de0",
-        "revCount": 16,
+        "lastModified": 1756124334,
+        "narHash": "sha256-DXFmSpgI8FrqcdqY7wg5l/lpssWjslHq5ufvyp/5k4o=",
+        "ref": "refs/heads/main",
+        "rev": "83760b1ebcd9722ddf58a4117d29555da65538ad",
+        "revCount": 13,
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Projects/minecraft-heatmap.git"
      },
      "original": {
-        "ref": "main",
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Projects/minecraft-heatmap.git"
      }
@@ -212,16 +129,15 @@
        ]
      },
      "locked": {
-        "lastModified": 1765904683,
-        "narHash": "sha256-uXM56y5n5GWpCiCNdKlTcCAy2IntgDB21c4gBDU30io=",
-        "ref": "main",
-        "rev": "6fae27b1659efb6774cf08a4e36ed29ab0e24105",
-        "revCount": 26,
+        "lastModified": 1765903589,
+        "narHash": "sha256-JRLmckeM4G2hkH2V3VdfjHrrsWgJ8j7rZDYYjHTkRqA=",
+        "ref": "refs/heads/main",
+        "rev": "7c86d342e68506fcd83cb74af3336f99ff522a0a",
+        "revCount": 24,
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Projects/minecraft-kartverket.git"
      },
      "original": {
-        "ref": "main",
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Projects/minecraft-kartverket.git"
      }
@@ -235,49 +151,24 @@
      "locked": {
        "lastModified": 1743881366,
        "narHash": "sha256-ScGA2IHPk9ugf9bqEZnp+YB/OJgrkZblnG/XLEKvJAo=",
-        "ref": "main",
+        "ref": "refs/heads/main",
        "rev": "db2e4becf1b11e5dfd33de12a90a7d089fcf68ec",
        "revCount": 11,
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Drift/nix-gitea-themes.git"
      },
      "original": {
-        "ref": "main",
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Drift/nix-gitea-themes.git"
      }
    },
-    "nix-topology": {
-      "inputs": {
-        "devshell": "devshell",
-        "flake-utils": "flake-utils",
-        "nixpkgs": [
-          "nixpkgs"
-        ],
-        "pre-commit-hooks": "pre-commit-hooks"
-      },
-      "locked": {
-        "lastModified": 1765969653,
-        "narHash": "sha256-qVpQxyvdByeDfb+d+jhbyNna2Ie+w85iHpt4Qu0rv/E=",
-        "owner": "oddlama",
-        "repo": "nix-topology",
-        "rev": "0ed73e5a1b65eb8ed388d070ebe8dedb9182f466",
-        "type": "github"
-      },
-      "original": {
-        "owner": "oddlama",
-        "ref": "main",
-        "repo": "nix-topology",
-        "type": "github"
-      }
-    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1767043167,
-        "narHash": "sha256-wN04/SL+8tV0D2HBIgt9dpX/03U18xoJ+8PT+dcn30E=",
-        "rev": "0b43a6ee07997a6e319e92dcbf276c2736506944",
+        "lastModified": 1764806471,
+        "narHash": "sha256-Qk0SArnS83KqyS9wNt1YoTkkYKDraNrjRWKUtB9DKoM=",
+        "rev": "6707b1809330d0f912f5813963bb29f6f194ee81",
        "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/25.11-small/nixos-25.11.2789.0b43a6ee0799/nixexprs.tar.xz"
+        "url": "https://releases.nixos.org/nixos/25.11-small/nixos-25.11.896.6707b1809330/nixexprs.tar.xz"
      },
      "original": {
        "type": "tarball",
@@ -286,44 +177,17 @@
    },
    "nixpkgs-unstable": {
      "locked": {
-        "lastModified": 1767031366,
-        "narHash": "sha256-SJz8tVEnXusU8OzN5ixAXQgzXv8fNIzp9ztzUyobh4s=",
-        "rev": "d23fedd87fcd067b1d160323fae0d0e4f995527d",
+        "lastModified": 1764854611,
+        "narHash": "sha256-MVzFp4ZKwdh6U1wy4fJe/GY3Hb4cvvyJbAZOhaeBQoo=",
+        "rev": "3a4b875aef660bbd148e86b92cffea2a360c3275",
        "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/unstable-small/nixos-26.05pre918279.d23fedd87fcd/nixexprs.tar.xz"
+        "url": "https://releases.nixos.org/nixos/unstable-small/nixos-26.05pre906534.3a4b875aef66/nixexprs.tar.xz"
      },
      "original": {
        "type": "tarball",
        "url": "https://nixos.org/channels/nixos-unstable-small/nixexprs.tar.xz"
      }
    },
-    "pre-commit-hooks": {
-      "inputs": {
-        "flake-compat": "flake-compat",
-        "gitignore": "gitignore",
-        "nixpkgs": [
-          "nix-topology",
-          "nixpkgs"
-        ],
-        "nixpkgs-stable": [
-          "nix-topology",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1730797577,
-        "narHash": "sha256-SrID5yVpyUfknUTGWgYkTyvdr9J1LxUym4om3SVGPkg=",
-        "owner": "cachix",
-        "repo": "pre-commit-hooks.nix",
-        "rev": "1864030ed24a2b8b4e4d386a5eeaf0c5369e50a9",
-        "type": "github"
-      },
-      "original": {
-        "owner": "cachix",
-        "repo": "pre-commit-hooks.nix",
-        "type": "github"
-      }
-    },
    "pvv-calendar-bot": {
      "inputs": {
        "nixpkgs": [
@@ -333,14 +197,13 @@
      "locked": {
        "lastModified": 1764869785,
        "narHash": "sha256-FGTIpC7gB4lbeL0bfYzn1Ge0PaCpd7VqWBLhJBx0i4A=",
-        "ref": "main",
+        "ref": "refs/heads/main",
        "rev": "8ce7fb0b1918bdb3d1489a40d73895693955e8b2",
        "revCount": 23,
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Projects/calendar-bot.git"
      },
      "original": {
-        "ref": "main",
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Projects/calendar-bot.git"
      }
@@ -352,16 +215,15 @@
        ]
      },
      "locked": {
-        "lastModified": 1767080188,
-        "narHash": "sha256-BmyPuWeSQ9XREyi0KSerWRfJndmyzHNJLysBJld/KwA=",
-        "ref": "main",
-        "rev": "08a216f4473e26aa2a5349e72633c0ab24e8ffbd",
-        "revCount": 534,
+        "lastModified": 1757332682,
+        "narHash": "sha256-4p4aVQWs7jHu3xb6TJlGik20lqbUU/Fc0/EHpzoRlO0=",
+        "ref": "refs/heads/main",
+        "rev": "da1113341ad9881d8d333d1e29790317bd7701e7",
+        "revCount": 518,
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Projects/nettsiden.git"
      },
      "original": {
-        "ref": "main",
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Projects/nettsiden.git"
      }
@@ -376,7 +238,6 @@
        "minecraft-heatmap": "minecraft-heatmap",
        "minecraft-kartverket": "minecraft-kartverket",
        "nix-gitea-themes": "nix-gitea-themes",
-        "nix-topology": "nix-topology",
        "nixpkgs": "nixpkgs",
        "nixpkgs-unstable": "nixpkgs-unstable",
        "pvv-calendar-bot": "pvv-calendar-bot",
@@ -392,32 +253,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1765680428,
-        "narHash": "sha256-fyPmRof9SZeI14ChPk5rVPOm7ISiiGkwGCunkhM+eUg=",
+        "lastModified": 1764816035,
+        "narHash": "sha256-F0IQSmSj4t2ThkbWZooAhkCTO+YpZSd2Pqiv2uoYEHo=",
        "owner": "oxalica",
        "repo": "rust-overlay",
-        "rev": "eb3898d8ef143d4bf0f7f2229105fc51c7731b2f",
-        "type": "github"
-      },
-      "original": {
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "type": "github"
-      }
-    },
-    "rust-overlay_2": {
-      "inputs": {
-        "nixpkgs": [
-          "minecraft-heatmap",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1766371695,
-        "narHash": "sha256-W7CX9vy7H2Jj3E8NI4djHyF8iHSxKpb2c/7uNQ/vGFU=",
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "rev": "d81285ba8199b00dc31847258cae3c655b605e8c",
+        "rev": "74d9abb7c5c030469f90d97a67d127cc5d76c238",
        "type": "github"
      },
      "original": {
@@ -433,34 +273,18 @@
        ]
      },
      "locked": {
-        "lastModified": 1766894905,
-        "narHash": "sha256-pn8AxxfajqyR/Dmr1wnZYdUXHgM3u6z9x0Z1Ijmz2UQ=",
+        "lastModified": 1764483358,
+        "narHash": "sha256-EyyvCzXoHrbL467YSsQBTWWg4sR96MH1sPpKoSOelB4=",
        "owner": "Mic92",
        "repo": "sops-nix",
-        "rev": "61b39c7b657081c2adc91b75dd3ad8a91d6f07a7",
+        "rev": "5aca6ff67264321d47856a2ed183729271107c9c",
        "type": "github"
      },
      "original": {
        "owner": "Mic92",
-        "ref": "master",
        "repo": "sops-nix",
        "type": "github"
      }
-    },
-    "systems": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
    }
  },
  "root": "root",
--- a/flake.nix
+++ b/flake.nix
@@ -5,38 +5,35 @@
    nixpkgs.url = "https://nixos.org/channels/nixos-25.11-small/nixexprs.tar.xz";
    nixpkgs-unstable.url = "https://nixos.org/channels/nixos-unstable-small/nixexprs.tar.xz";

-    sops-nix.url = "github:Mic92/sops-nix/master";
+    sops-nix.url = "github:Mic92/sops-nix";
    sops-nix.inputs.nixpkgs.follows = "nixpkgs";

-    disko.url = "github:nix-community/disko/v1.11.0";
+    disko.url = "github:nix-community/disko";
    disko.inputs.nixpkgs.follows = "nixpkgs";

-    nix-topology.url = "github:oddlama/nix-topology/main";
-    nix-topology.inputs.nixpkgs.follows = "nixpkgs";
-
-    pvv-nettsiden.url = "git+https://git.pvv.ntnu.no/Projects/nettsiden.git?ref=main";
+    pvv-nettsiden.url = "git+https://git.pvv.ntnu.no/Projects/nettsiden.git";
    pvv-nettsiden.inputs.nixpkgs.follows = "nixpkgs";

-    pvv-calendar-bot.url = "git+https://git.pvv.ntnu.no/Projects/calendar-bot.git?ref=main";
+    pvv-calendar-bot.url = "git+https://git.pvv.ntnu.no/Projects/calendar-bot.git";
    pvv-calendar-bot.inputs.nixpkgs.follows = "nixpkgs";

    matrix-next.url = "github:dali99/nixos-matrix-modules/v0.8.0";
    matrix-next.inputs.nixpkgs.follows = "nixpkgs";

-    nix-gitea-themes.url = "git+https://git.pvv.ntnu.no/Drift/nix-gitea-themes.git?ref=main";
+    nix-gitea-themes.url = "git+https://git.pvv.ntnu.no/Drift/nix-gitea-themes.git";
    nix-gitea-themes.inputs.nixpkgs.follows = "nixpkgs";

-    minecraft-heatmap.url = "git+https://git.pvv.ntnu.no/Projects/minecraft-heatmap.git?ref=main";
+    minecraft-heatmap.url = "git+https://git.pvv.ntnu.no/Projects/minecraft-heatmap.git";
    minecraft-heatmap.inputs.nixpkgs.follows = "nixpkgs";

-    greg-ng.url = "git+https://git.pvv.ntnu.no/Grzegorz/greg-ng.git?ref=main";
+    greg-ng.url = "git+https://git.pvv.ntnu.no/Grzegorz/greg-ng.git";
    greg-ng.inputs.nixpkgs.follows = "nixpkgs";
-    gergle.url = "git+https://git.pvv.ntnu.no/Grzegorz/gergle.git?ref=main";
+    gergle.url = "git+https://git.pvv.ntnu.no/Grzegorz/gergle.git";
    gergle.inputs.nixpkgs.follows = "nixpkgs";
-    grzegorz-clients.url = "git+https://git.pvv.ntnu.no/Grzegorz/grzegorz-clients.git?ref=master";
+    grzegorz-clients.url = "git+https://git.pvv.ntnu.no/Grzegorz/grzegorz-clients.git";
    grzegorz-clients.inputs.nixpkgs.follows = "nixpkgs";

-    minecraft-kartverket.url = "git+https://git.pvv.ntnu.no/Projects/minecraft-kartverket.git?ref=main";
+    minecraft-kartverket.url = "git+https://git.pvv.ntnu.no/Projects/minecraft-kartverket.git";
    minecraft-kartverket.inputs.nixpkgs.follows = "nixpkgs";
  };

@@ -60,16 +57,6 @@
  in {
    inputs = lib.mapAttrs (_: src: src.outPath) inputs;

-    pkgs = forAllSystems (system:
-      import nixpkgs {
-        inherit system;
-        config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg)
-          [
-            "nvidia-x11"
-            "nvidia-settings"
-          ];
-      });
-
    nixosConfigurations = let
      unstablePkgs = nixpkgs-unstable.legacyPackages.x86_64-linux;

@@ -117,11 +104,6 @@
      stableNixosConfig = name: extraArgs:
          nixosConfig nixpkgs name ./hosts/${name}/configuration.nix extraArgs;
    in {
-      bakke = stableNixosConfig "bakke" {
-        modules = [
-          disko.nixosModules.disko
-        ];
-      };
      bicep = stableNixosConfig "bicep" {
        modules = [
          inputs.matrix-next.nixosModules.default
@@ -150,7 +132,6 @@
        ];
        modules = [
          inputs.pvv-nettsiden.nixosModules.default
-          self.nixosModules.bluemap
        ];
      };
      ildkule = stableNixosConfig "ildkule" { };
@@ -207,7 +188,6 @@
    }));

    nixosModules = {
-      bluemap = ./modules/bluemap.nix;
      snakeoil-certs = ./modules/snakeoil-certs.nix;
      snappymail = ./modules/snappymail.nix;
      robots-txt = ./modules/robots-txt.nix;
@@ -240,57 +220,15 @@

        simplesamlphp = pkgs.callPackage ./packages/simplesamlphp { };

-        bluemap = pkgs.callPackage ./packages/bluemap.nix { };
-
        out-of-your-element = pkgs.callPackage ./packages/out-of-your-element.nix { };
-      }
-      //
-      # Mediawiki extensions
+      } //
      (lib.pipe null [
        (_: pkgs.callPackage ./packages/mediawiki-extensions { })
        (lib.flip builtins.removeAttrs ["override" "overrideDerivation"])
        (lib.mapAttrs' (name: lib.nameValuePair "mediawiki-${name}"))
      ])
-      //
-      # Machines
-      lib.genAttrs allMachines
-        (machine: self.nixosConfigurations.${machine}.config.system.build.toplevel)
-      //
-      # Nix-topology
-      (let
-        topology' = import inputs.nix-topology {
-          pkgs = import nixpkgs {
-            system = "x86_64-linux";
-            overlays = [ inputs.nix-topology.overlays.default ];
-          };
-
-          specialArgs = {
-            values = import ./values.nix;
-          };
-
-          modules = [
-            ./topology
-            {
-              nixosConfigurations = lib.mapAttrs (_name: nixosCfg: nixosCfg.extendModules {
-                modules = [
-                  inputs.nix-topology.nixosModules.default
-                  ./topology/service-extractors/greg-ng.nix
-                ];
-              }) self.nixosConfigurations;
-            }
-          ];
-        };
-      in {
-        topology = topology'.config.output;
-        topology-png = pkgs.runCommand "pvv-config-topology-png" {
-          nativeBuildInputs = [ pkgs.writableTmpDirAsHomeHook ];
-        } ''
-          mkdir -p "$out"
-          for file in '${topology'.config.output}'/*.svg; do
-            ${lib.getExe pkgs.imagemagick} -density 300 -background none "$file" "$out"/"$(basename "''${file%.svg}.png")"
-          done
-        '';
-      });
+      // lib.genAttrs allMachines
+        (machine: self.nixosConfigurations.${machine}.config.system.build.toplevel);
    };
  };
 }
--- a/hosts/bakke/configuration.nix
+++ b/hosts/bakke/configuration.nix
@@ -1,25 +0,0 @@
-{ config, pkgs, values, ... }:
-{
-  imports = [
-      ./hardware-configuration.nix
-      ../../base
-      ./filesystems.nix
-    ];
-
-  sops.defaultSopsFile = ../../secrets/bakke/bakke.yaml;
-  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
-  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
-  sops.age.generateKey = true;
-
-  boot.loader.systemd-boot.enable = true;
-  boot.loader.efi.canTouchEfiVariables = true;
-
-  networking.hostName = "bakke";
-  networking.hostId = "99609ffc";
-  systemd.network.networks."30-enp2s0" = values.defaultNetworkConfig // {
-    matchConfig.Name = "enp2s0";
-    address = with values.hosts.bakke; [ (ipv4 + "/25") (ipv6 + "/64") ];
-  };
-
-  system.stateVersion = "24.05";
-}
--- a/hosts/bakke/disks.nix
+++ b/hosts/bakke/disks.nix
@@ -1,83 +0,0 @@
-{
-  # https://github.com/nix-community/disko/blob/master/example/boot-raid1.nix
-  # Note: Disko was used to create the initial md raid, but is no longer in active use on this host.
-  disko.devices = {
-    disk = {
-      one = {
-        type = "disk";
-        device = "/dev/disk/by-id/ata-WDC_WD40EFRX-68WT0N0_WD-WCC4E2EER6N6";
-        content = {
-          type = "gpt";
-          partitions = {
-            ESP = {
-              size = "500M";
-              type = "EF00";
-              content = {
-                type = "mdraid";
-                name = "boot";
-              };
-            };
-            mdadm = {
-              size = "100%";
-              content = {
-                type = "mdraid";
-                name = "raid1";
-              };
-            };
-          };
-        };
-      };
-      two = {
-        type = "disk";
-        device = "/dev/disk/by-id/ata-WDC_WD40EFRX-68WT0N0_WD-WCC4E7LPLU71";
-        content = {
-          type = "gpt";
-          partitions = {
-            ESP = {
-              size = "500M";
-              type = "EF00";
-              content = {
-                type = "mdraid";
-                name = "boot";
-              };
-            };
-            mdadm = {
-              size = "100%";
-              content = {
-                type = "mdraid";
-                name = "raid1";
-              };
-            };
-          };
-        };
-      };
-    };
-    mdadm = {
-      boot = {
-        type = "mdadm";
-        level = 1;
-        metadata = "1.0";
-        content = {
-          type = "filesystem";
-          format = "vfat";
-          mountpoint = "/boot";
-        };
-      };
-      raid1 = {
-        type = "mdadm";
-        level = 1;
-        content = {
-          type = "gpt";
-          partitions.primary = {
-            size = "100%";
-            content = {
-              type = "filesystem";
-              format = "ext4";
-              mountpoint = "/";
-            };
-          };
-        };
-      };
-    };
-  };
-}
--- a/hosts/bakke/filesystems.nix
+++ b/hosts/bakke/filesystems.nix
@@ -1,26 +0,0 @@
-{ config, pkgs, lib, ... }:
-{
-  # Boot drives:
-  boot.swraid.enable = true;
-
-  # ZFS Data pool:
-  environment.systemPackages = with pkgs; [ zfs ];
-  boot = {
-    zfs = {
-      extraPools = [ "tank" ];
-      requestEncryptionCredentials = false;
-    };
-    supportedFilesystems = [ "zfs" ];
-    kernelPackages = config.boot.zfs.package.latestCompatibleLinuxPackages;
-  };
-  services.zfs.autoScrub = {
-    enable = true;
-    interval = "Wed *-*-8..14 00:00:00";
-  };
-
-  # NFS Exports:
-  #TODO
-
-  # NFS Import mounts:
-  #TODO
-}
--- a/hosts/bakke/hardware-configuration.nix
+++ b/hosts/bakke/hardware-configuration.nix
@@ -1,52 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
-
-{
-  imports =
-    [ (modulesPath + "/installer/scan/not-detected.nix")
-    ];
-
-  boot.initrd.availableKernelModules = [ "ehci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ "kvm-intel" ];
-  boot.extraModulePackages = [ ];
-
-  fileSystems."/" =
-    { device = "/dev/disk/by-uuid/0f63c3d2-fc12-4ed5-a5a5-141bfd67a571";
-      fsType = "btrfs";
-      options = [ "subvol=root" ];
-    };
-
-  fileSystems."/home" =
-    { device = "/dev/disk/by-uuid/0f63c3d2-fc12-4ed5-a5a5-141bfd67a571";
-      fsType = "btrfs";
-      options = [ "subvol=home" ];
-    };
-
-  fileSystems."/nix" =
-    { device = "/dev/disk/by-uuid/0f63c3d2-fc12-4ed5-a5a5-141bfd67a571";
-      fsType = "btrfs";
-      options = [ "subvol=nix" "noatime" ];
-    };
-
-  fileSystems."/boot" =
-    { device = "/dev/sdc2";
-      fsType = "vfat";
-      options = [ "fmask=0022" "dmask=0022" ];
-    };
-
-  swapDevices = [ ];
-
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault false;
-  # networking.interfaces.eno1.useDHCP = lib.mkDefault true;
-  # networking.interfaces.enp2s0.useDHCP = lib.mkDefault true;
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-}
--- a/hosts/bekkalokk/configuration.nix
+++ b/hosts/bekkalokk/configuration.nix
@@ -4,10 +4,11 @@
    ./hardware-configuration.nix

    (fp /base)
+    (fp /misc/metrics-exporters.nix)

-    ./services/bluemap.nix
+    ./services/bluemap/default.nix
    ./services/idp-simplesamlphp
-    ./services/kerberos.nix
+    ./services/kerberos
    ./services/mediawiki
    ./services/nginx.nix
    ./services/phpfpm.nix
--- a/hosts/bekkalokk/services/bluemap/default.nix
+++ b/hosts/bekkalokk/services/bluemap/default.nix
@@ -3,7 +3,10 @@ let
  vanillaSurvival = "/var/lib/bluemap/vanilla_survival_world";
  format = pkgs.formats.hocon { };
 in {
-  # NOTE: our versino of the module gets added in flake.nix
+  imports = [
+    ./module.nix # From danio, pending upstreaming
+  ];
+
  disabledModules = [ "services/web-apps/bluemap.nix" ];

  sops.secrets."bluemap/ssh-key" = { };
@@ -11,6 +14,7 @@ in {

  services.bluemap = {
    enable = true;
+    package = pkgs.callPackage ./package.nix { };

    eula = true;
    onCalendar = "*-*-* 05:45:00"; # a little over an hour after auto-upgrade
@@ -23,13 +27,7 @@ in {
      "verden" = {
        settings = {
          world = vanillaSurvival;
-          dimension = "minecraft:overworld";
-          name = "Verden";
          sorting = 0;
-          start-pos = {
-            x = 0;
-            z = 0;
-          };
          ambient-light = 0.1;
          cave-detection-ocean-floor = -5;
          marker-sets = {
@@ -39,47 +37,29 @@ in {
      };
      "underverden" = {
        settings = {
-          world = vanillaSurvival;
-          dimension = "minecraft:the_nether";
-          name = "Underverden";
+          world = "${vanillaSurvival}/DIM-1";
          sorting = 100;
-          start-pos = {
-            x = 0;
-            z = 0;
-          };
          sky-color = "#290000";
          void-color = "#150000";
-          sky-light = 1;
          ambient-light = 0.6;
+          world-sky-light = 0;
          remove-caves-below-y = -10000;
          cave-detection-ocean-floor = -5;
          cave-detection-uses-block-light = true;
-          render-mask = [{
-            max-y = 90;
-          }];
+          max-y = 90;
          marker-sets = {
-            _includes = [ (format.lib.mkInclude {
-              required = true;
-              type = "file";
-              value = "${bluemap-export}/nether.hocon";
-            }) ];
+            _includes = [ (format.lib.mkInclude "${bluemap-export}/nether.hocon") ];
          };
        };
      };
      "enden" = {
        settings = {
-          world = vanillaSurvival;
-          dimension = "minecraft:the_end";
-          name = "Enden";
+          world = "${vanillaSurvival}/DIM1";
          sorting = 200;
-          start-pos = {
-            x = 0;
-            z = 0;
-          };
          sky-color = "#080010";
          void-color = "#080010";
-          sky-light = 1;
          ambient-light = 0.6;
+          world-sky-light = 0;
          remove-caves-below-y = -10000;
          cave-detection-ocean-floor = -5;
          marker-sets = {
@@ -90,42 +70,26 @@ in {
    };
  };

+  services.nginx.virtualHosts."minecraft.pvv.ntnu.no" = {
+    enableACME = true;
+    forceSSL = true;
+  };
+
+  # TODO: render somewhere else lmao
  systemd.services."render-bluemap-maps" = {
+    preStart = ''
+      mkdir -p /var/lib/bluemap/world
+      ${pkgs.rsync}/bin/rsync \
+        -e "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=$CREDENTIALS_DIRECTORY/ssh-known-hosts -i $CREDENTIALS_DIRECTORY/sshkey" \
+        -avz --no-owner --no-group \
+        root@innovation.pvv.ntnu.no:/ \
+        ${vanillaSurvival}
+    '';
    serviceConfig = {
-      StateDirectory = [ "bluemap/world" ];
-      ExecStartPre = let
-        rsyncArgs = lib.cli.toCommandLineShellGNU { } {
-          archive = true;
-          compress = true;
-          verbose = true;
-          no-owner = true;
-          no-group = true;
-          rsh = "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=%d/ssh-known-hosts -i %d/sshkey";
-        };
-      in "${lib.getExe pkgs.rsync} ${rsyncArgs} root@innovation.pvv.ntnu.no:/ ${vanillaSurvival}";
      LoadCredential = [
        "sshkey:${config.sops.secrets."bluemap/ssh-key".path}"
        "ssh-known-hosts:${config.sops.secrets."bluemap/ssh-known-hosts".path}"
      ];
    };
  };
-
-  services.nginx.virtualHosts."minecraft.pvv.ntnu.no" = {
-    enableACME = true;
-    forceSSL = true;
-    kTLS = true;
-    http3 = true;
-    quic = true;
-    http3_hq = true;
-    extraConfig = ''
-      # Enabling QUIC 0-RTT
-      ssl_early_data on;
-
-      quic_gso on;
-      quic_retry on;
-      add_header Alt-Svc 'h3=":$server_port"; ma=86400';
-    '';
-  };
-
-  networking.firewall.allowedUDPPorts = [ 443 ];
 }
--- a/hosts/bekkalokk/services/bluemap/module.nix
+++ b/hosts/bekkalokk/services/bluemap/module.nix
@@ -25,7 +25,7 @@ let
    "core.conf" = coreConfig;
    "webapp.conf" = webappConfig;
    "webserver.conf" = webserverConfig;
-    "packs" = cfg.packs;
+    "packs" = cfg.resourcepacks;
  };

  renderConfigFolder = name: value: pkgs.linkFarm "bluemap-${name}-config" {
@@ -36,7 +36,7 @@ let
    "core.conf" = coreConfig;
    "webapp.conf" = format.generate "webapp.conf" (cfg.webappSettings // { "update-settings-file" = false; });
    "webserver.conf" = webserverConfig;
-    "packs" = value.packs;
+    "packs" = value.resourcepacks;
  };

  inherit (lib) mkOption;
@@ -110,7 +110,7 @@ in {
          metrics = lib.mkEnableOption "Sending usage metrics containing the version of bluemap in use";
        };
      };
-      description = "Settings for the core.conf file, [see upstream docs](https://github.com/BlueMap-Minecraft/BlueMap/blob/master/common/src/main/resources/de/bluecolored/bluemap/config/core.conf).";
+      description = "Settings for the core.conf file, [see upstream docs](https://github.com/BlueMap-Minecraft/BlueMap/blob/master/BlueMapCommon/src/main/resources/de/bluecolored/bluemap/config/core.conf).";
    };

    webappSettings = mkOption {
@@ -127,7 +127,7 @@ in {
          webroot = config.services.bluemap.webRoot;
        }
      '';
-      description = "Settings for the webapp.conf file, see [upstream docs](https://github.com/BlueMap-Minecraft/BlueMap/blob/master/common/src/main/resources/de/bluecolored/bluemap/config/webapp.conf).";
+      description = "Settings for the webapp.conf file, see [upstream docs](https://github.com/BlueMap-Minecraft/BlueMap/blob/master/BlueMapCommon/src/main/resources/de/bluecolored/bluemap/config/webapp.conf).";
    };

    webserverSettings = mkOption {
@@ -147,18 +147,18 @@ in {
      default = { };
      description = ''
        Settings for the webserver.conf file, usually not required.
-        [See upstream docs](https://github.com/BlueMap-Minecraft/BlueMap/blob/master/common/src/main/resources/de/bluecolored/bluemap/config/webserver.conf).
+        [See upstream docs](https://github.com/BlueMap-Minecraft/BlueMap/blob/master/BlueMapCommon/src/main/resources/de/bluecolored/bluemap/config/webserver.conf).
      '';
    };

    maps = mkOption {
-      type = lib.types.attrsOf (lib.types.submodule ({ name, ... }: {
+      type = lib.types.attrsOf (lib.types.submodule {
        options = {
-          packs = mkOption {
+          resourcepacks = mkOption {
            type = lib.types.path;
-            default = cfg.packs;
-            defaultText = lib.literalExpression "config.services.bluemap.packs";
-            description = "A set of resourcepacks, datapacks, and mods to extract resources from, loaded in alphabetical order.";
+            default = cfg.resourcepacks;
+            defaultText = lib.literalExpression "config.services.bluemap.resourcepacks";
+            description = "A set of resourcepacks/mods/bluemap-addons to extract models from loaded in alphabetical order";
          };
          settings = mkOption {
            type = (lib.types.submodule {
@@ -168,74 +168,43 @@ in {
                  type = lib.types.path;
                  description = "Path to world folder containing the dimension to render";
                };
-                name = mkOption {
-                  type = lib.types.str;
-                  description = "The display name of this map (how this map will be named on the webapp)";
-                  default = name;
-                  defaultText = lib.literalExpression "<name>";
-                };
-                render-mask = mkOption {
-                  type = with lib.types; listOf (attrsOf format.type);
-                  description = "Limits for the map render";
-                  default = [ ];
-                  example = [
-                    {
-                      min-x = -4000;
-                      max-x = 4000;
-                      min-z = -4000;
-                      max-z = 4000;
-                      min-y = 50;
-                      max-y = 100;
-                    }
-                    {
-                      subtract = true;
-                      min-y = 90;
-                      max-y = 127;
-                    }
-                  ];
-                };
              };
            });
            description = ''
              Settings for files in `maps/`.
              See the default for an example with good options for the different world types.
-              For valid values [consult upstream docs](https://github.com/BlueMap-Minecraft/BlueMap/blob/master/common/src/main/resources/de/bluecolored/bluemap/config/maps/map.conf).
+              For valid values [consult upstream docs](https://github.com/BlueMap-Minecraft/BlueMap/blob/master/BlueMapCommon/src/main/resources/de/bluecolored/bluemap/config/maps/map.conf).
            '';
          };
        };
-      }));
+      });
      default = {
        "overworld".settings = {
-          world = cfg.defaultWorld;
-          dimension = "minecraft:overworld";
-          name = "Overworld";
+          world = "${cfg.defaultWorld}";
          ambient-light = 0.1;
          cave-detection-ocean-floor = -5;
        };

        "nether".settings = {
-          world = cfg.defaultWorld;
-          dimension = "minecraft:the_nether";
-          name = "Nether";
+          world = "${cfg.defaultWorld}/DIM-1";
          sorting = 100;
          sky-color = "#290000";
          void-color = "#150000";
-          sky-light = 1;
          ambient-light = 0.6;
+          world-sky-light = 0;
          remove-caves-below-y = -10000;
          cave-detection-ocean-floor = -5;
          cave-detection-uses-block-light = true;
+          max-y = 90;
        };

        "end".settings = {
-          world = cfg.defaultWorld;
-          dimension = "minecraft:the_end";
-          name = "The End";
+          world = "${cfg.defaultWorld}/DIM1";
          sorting = 200;
          sky-color = "#080010";
          void-color = "#080010";
-          sky-light = 1;
          ambient-light = 0.6;
+          world-sky-light = 0;
          remove-caves-below-y = -10000;
          cave-detection-ocean-floor = -5;
        };
@@ -243,36 +212,31 @@ in {
      defaultText = lib.literalExpression ''
        {
          "overworld".settings = {
-            world = cfg.defaultWorld;
-            name = "Overworld";
-            dimension = "minecraft:overworld";
+            world = "''${cfg.defaultWorld}";
            ambient-light = 0.1;
            cave-detection-ocean-floor = -5;
          };

          "nether".settings = {
-            world = cfg.defaultWorld;
-            dimension = "minecraft:the_nether";
-            name = "Nether";
+            world = "''${cfg.defaultWorld}/DIM-1";
            sorting = 100;
            sky-color = "#290000";
            void-color = "#150000";
-            sky-light = 1;
            ambient-light = 0.6;
+            world-sky-light = 0;
            remove-caves-below-y = -10000;
            cave-detection-ocean-floor = -5;
            cave-detection-uses-block-light = true;
+            max-y = 90;
          };

          "end".settings = {
-            world = cfg.defaultWorld;
-            name = "The End";
-            dimension = "minecraft:the_end";
+            world = "''${cfg.defaultWorld}/DIM1";
            sorting = 200;
            sky-color = "#080010";
            void-color = "#080010";
-            sky-light = 1;
            ambient-light = 0.6;
+            world-sky-light = 0;
            remove-caves-below-y = -10000;
            cave-detection-ocean-floor = -5;
          };
@@ -300,7 +264,7 @@ in {
      description = ''
        Where the rendered map will be stored.
        Unless you are doing something advanced you should probably leave this alone and configure webRoot instead.
-        [See upstream docs](https://github.com/BlueMap-Minecraft/BlueMap/tree/master/common/src/main/resources/de/bluecolored/bluemap/config/storages)
+        [See upstream docs](https://github.com/BlueMap-Minecraft/BlueMap/tree/master/BlueMapCommon/src/main/resources/de/bluecolored/bluemap/config/storages)
      '';
      default = {
        "file" = {
@@ -316,12 +280,12 @@ in {
      '';
    };

-    packs = mkOption {
+    resourcepacks = mkOption {
      type = lib.types.path;
-      default = pkgs.linkFarm "packs" { };
+      default = pkgs.linkFarm "resourcepacks" { };
      description = ''
-        A set of resourcepacks, datapacks, and mods to extract resources from, loaded in alphabetical order.
-        Can be overriden on a per-map basis with `services.bluemap.maps.<name>.packs`.
+        A set of resourcepacks/mods to extract models from loaded in alphabetical order.
+        Can be overriden on a per-map basis with `services.bluemap.maps.<name>.resourcepacks`.
      '';
    };
  };
@@ -342,23 +306,21 @@ in {
    systemd.services."render-bluemap-maps" = lib.mkIf cfg.enableRender {
      serviceConfig = {
        Type = "oneshot";
-        CPUSchedulingPolicy = "batch";
        Group = "nginx";
        UMask = "026";
-        ExecStart = [
-          # If web folder doesnt exist generate it
-          ''|test -f "${cfg.webRoot}" || ${lib.getExe cfg.package} -c ${webappConfigFolder} -gs''
-        ]
-        ++
-          # Render each minecraft map
-          lib.attrsets.mapAttrsToList
-            (name: value: "${lib.getExe cfg.package} -c ${renderConfigFolder name value} -r")
-            cfg.maps
-        ++ [
-          # Generate updated webapp
-          "${lib.getExe cfg.package} -c ${webappConfigFolder} -gs"
-        ];
      };
+      script = ''
+        # If web folder doesnt exist generate it
+        test -f "${cfg.webRoot}" || ${lib.getExe cfg.package} -c ${webappConfigFolder} -gs
+
+        # Render each minecraft map
+        ${lib.strings.concatStringsSep "\n" (lib.attrsets.mapAttrsToList
+          (name: value: "${lib.getExe cfg.package} -c ${renderConfigFolder name value} -r")
+          cfg.maps)}
+
+        # Generate updated webapp
+        ${lib.getExe cfg.package} -c ${webappConfigFolder} -gs
+      '';
    };

    systemd.timers."render-bluemap-maps" = lib.mkIf cfg.enableRender {
--- a/hosts/bekkalokk/services/bluemap/package.nix
+++ b/hosts/bekkalokk/services/bluemap/package.nix
@@ -0,0 +1,30 @@
+{ lib, stdenvNoCC, fetchurl, makeWrapper, jre }:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "bluemap";
+  version = "5.7";
+
+  src = fetchurl {
+    url = "https://github.com/BlueMap-Minecraft/BlueMap/releases/download/v${version}/BlueMap-${version}-cli.jar";
+    hash = "sha256-8udZYJgrr4bi2mjRYrASd8JwUoUVZW1tZpOLRgafAIw=";
+  };
+
+  dontUnpack = true;
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  installPhase = ''
+    runHook preInstall
+    makeWrapper ${jre}/bin/java $out/bin/bluemap --add-flags "-jar $src"
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "3D minecraft map renderer";
+    homepage = "https://bluemap.bluecolored.de/";
+    sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ dandellion h7x4 ];
+    mainProgram = "bluemap";
+  };
+}
--- a/hosts/bekkalokk/services/kerberos/default.nix
+++ b/hosts/bekkalokk/services/kerberos/default.nix
--- a/hosts/bekkalokk/services/kerberos/krb5-conf-format.nix
+++ b/hosts/bekkalokk/services/kerberos/krb5-conf-format.nix
@@ -0,0 +1,88 @@
+{ pkgs, lib, ... }:
+
+# Based on
+# - https://web.mit.edu/kerberos/krb5-1.12/doc/admin/conf_files/krb5_conf.html
+# - https://manpages.debian.org/unstable/heimdal-docs/krb5.conf.5heimdal.en.html
+
+let
+  inherit (lib) boolToString concatMapStringsSep concatStringsSep filter
+    isAttrs isBool isList mapAttrsToList mdDoc mkOption singleton splitString;
+  inherit (lib.types) attrsOf bool coercedTo either int listOf oneOf path
+    str submodule;
+in
+{ }: {
+  type = let
+    section = attrsOf relation;
+    relation = either (attrsOf value) value;
+    value = either (listOf atom) atom;
+    atom = oneOf [int str bool];
+  in submodule {
+    freeformType = attrsOf section;
+    options = {
+      include = mkOption {
+        default = [ ];
+        description = mdDoc ''
+          Files to include in the Kerberos configuration.
+        '';
+        type = coercedTo path singleton (listOf path);
+      };
+      includedir = mkOption {
+        default = [ ];
+        description = mdDoc ''
+          Directories containing files to include in the Kerberos configuration.
+        '';
+        type = coercedTo path singleton (listOf path);
+      };
+      module = mkOption {
+        default = [ ];
+        description = mdDoc ''
+          Modules to obtain Kerberos configuration from.
+        '';
+        type = coercedTo path singleton (listOf path);
+      };
+    };
+  };
+
+  generate = let
+    indent = str: concatMapStringsSep "\n" (line: "  " + line) (splitString "\n" str);
+
+    formatToplevel = args @ {
+      include ? [ ],
+      includedir ? [ ],
+      module ? [ ],
+      ...
+    }: let
+      sections = removeAttrs args [ "include" "includedir" "module" ];
+    in concatStringsSep "\n" (filter (x: x != "") [
+      (concatStringsSep "\n" (mapAttrsToList formatSection sections))
+      (concatMapStringsSep "\n" (m: "module ${m}") module)
+      (concatMapStringsSep "\n" (i: "include ${i}") include)
+      (concatMapStringsSep "\n" (i: "includedir ${i}") includedir)
+    ]);
+
+    formatSection = name: section: ''
+      [${name}]
+      ${indent (concatStringsSep "\n" (mapAttrsToList formatRelation section))}
+    '';
+
+    formatRelation = name: relation:
+      if isAttrs relation
+      then ''
+        ${name} = {
+        ${indent (concatStringsSep "\n" (mapAttrsToList formatValue relation))}
+        }''
+      else formatValue name relation;
+
+    formatValue = name: value:
+      if isList value
+      then concatMapStringsSep "\n" (formatAtom name) value
+      else formatAtom name value;
+
+    formatAtom = name: atom: let
+      v = if isBool atom then boolToString atom else toString atom;
+    in "${name} = ${v}";
+  in
+    name: value: pkgs.writeText name ''
+      ${formatToplevel value}
+    '';
+}
--- a/hosts/bekkalokk/services/kerberos/krb5.nix
+++ b/hosts/bekkalokk/services/kerberos/krb5.nix
@@ -0,0 +1,90 @@
+{ config, lib, pkgs, ... }:
+let
+  inherit (lib) mdDoc mkIf mkOption mkPackageOption mkRemovedOptionModule;
+  inherit (lib.types) bool;
+
+  mkRemovedOptionModule' = name: reason: mkRemovedOptionModule ["krb5" name] reason;
+  mkRemovedOptionModuleCfg = name: mkRemovedOptionModule' name ''
+    The option `krb5.${name}' has been removed. Use
+    `security.krb5.settings.${name}' for structured configuration.
+  '';
+
+  cfg = config.security.krb5;
+  format = import ./krb5-conf-format.nix { inherit pkgs lib; } { };
+in {
+  imports = [
+    (mkRemovedOptionModuleCfg "libdefaults")
+    (mkRemovedOptionModuleCfg "realms")
+    (mkRemovedOptionModuleCfg "domain_realm")
+    (mkRemovedOptionModuleCfg "capaths")
+    (mkRemovedOptionModuleCfg "appdefaults")
+    (mkRemovedOptionModuleCfg "plugins")
+    (mkRemovedOptionModuleCfg "config")
+    (mkRemovedOptionModuleCfg "extraConfig")
+    (mkRemovedOptionModule' "kerberos" ''
+      The option `krb5.kerberos' has been moved to `security.krb5.package'.
+    '')
+  ];
+
+  options = {
+    security.krb5 = {
+      enable = mkOption {
+        default = false;
+        description = mdDoc "Enable and configure Kerberos utilities";
+        type = bool;
+      };
+
+      package = mkPackageOption pkgs "krb5" {
+        example = "heimdal";
+      };
+
+      settings = mkOption {
+        default = { };
+        type = format.type;
+        description = mdDoc ''
+          Structured contents of the {file}`krb5.conf` file. See
+          {manpage}`krb5.conf(5)` for details about configuration.
+        '';
+        example = {
+          include = [ "/run/secrets/secret-krb5.conf" ];
+          includedir = [ "/run/secrets/secret-krb5.conf.d" ];
+
+          libdefaults = {
+            default_realm = "ATHENA.MIT.EDU";
+          };
+
+          realms = {
+            "ATHENA.MIT.EDU" = {
+              admin_server = "athena.mit.edu";
+              kdc = [
+                "athena01.mit.edu"
+                "athena02.mit.edu"
+              ];
+            };
+          };
+
+          domain_realm = {
+            "mit.edu" = "ATHENA.MIT.EDU";
+          };
+
+          logging = {
+            kdc = "SYSLOG:NOTICE";
+            admin_server = "SYSLOG:NOTICE";
+            default = "SYSLOG:NOTICE";
+          };
+        };
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    environment = {
+      systemPackages = [ cfg.package ];
+      etc."krb5.conf".source = format.generate "krb5.conf" cfg.settings;
+    };
+  };
+
+  meta.maintainers = builtins.attrValues {
+    inherit (lib.maintainers) dblsaiko h7x4;
+  };
+}
--- a/hosts/bekkalokk/services/kerberos/pam.nix
+++ b/hosts/bekkalokk/services/kerberos/pam.nix
--- a/hosts/bekkalokk/services/mediawiki/default.nix
+++ b/hosts/bekkalokk/services/mediawiki/default.nix
@@ -130,12 +130,6 @@ in {
      $wgVectorDefaultSidebarVisibleForAnonymousUser = true;
      $wgVectorResponsive = true;

-      # Experimental dark mode support for Vector 2022
-      $wgVectorNightMode['beta'] = true;
-      $wgVectorNightMode['logged_out'] = true;
-      $wgVectorNightMode['logged_in'] = true;
-      $wgDefaultUserOptions['vector-theme'] = 'os';
-
      # Misc
      $wgEmergencyContact = "${cfg.passwordSender}";
      $wgUseTeX = false;
--- a/hosts/bekkalokk/services/website/default.nix
+++ b/hosts/bekkalokk/services/website/default.nix
@@ -18,16 +18,11 @@ in {
    restartUnits = [ "phpfpm-pvv-nettsiden.service" ];
  });

-  security.acme.certs."www.pvv.ntnu.no" = {
-    extraDomainNames = [
-      "pvv.ntnu.no"
-      "www.pvv.org"
-      "pvv.org"
-    ];
-  };
-
  services.idp.sp-remote-metadata = [
    "https://www.pvv.ntnu.no/simplesaml/"
+    "https://pvv.ntnu.no/simplesaml/"
+    "https://www.pvv.org/simplesaml/"
+    "https://pvv.org/simplesaml/"
  ];

  services.pvv-nettsiden = {
@@ -60,8 +55,10 @@ in {
      DOOR_SECRET = includeFromSops "door_secret";

      DB = {
-        DSN = "mysql:dbname=www-data_nettside;host=mysql.pvv.ntnu.no";
-        USER = "www-data_nettsi";
+        # DSN = "mysql:dbname=www-data_nettside;host=mysql.pvv.ntnu.no";
+        # USER = "www-data_nettsi";
+        DSN = "pgsql:dbname=pvv_nettsiden;host=postgres.pvv.ntnu.no";
+        USER = "pvv_nettsiden";
        PASS = includeFromSops "mysql_password";
      };

@@ -74,39 +71,28 @@ in {
        ADMIN_PASSWORD = includeFromSops "simplesamlphp/admin_password";
        TRUSTED_DOMAINS = [
          "www.pvv.ntnu.no"
+          "pvv.ntnu.no"
+          "www.pvv.org"
+          "pvv.org"
        ];
      };
    };
  };

  services.phpfpm.pools."pvv-nettsiden".settings = {
-    # "php_admin_value[error_log]" = "stderr";
+    "php_flag[display_errors]" = true;
+    "php_admin_value[error_log]" = "syslog";
    "php_admin_flag[log_errors]" = true;
    "catch_workers_output" = true;
  };

-  services.nginx.virtualHosts."pvv.ntnu.no" = {
-    globalRedirect = cfg.domainName;
-    redirectCode = 307;
-    forceSSL = true;
-    useACMEHost = "www.pvv.ntnu.no";
-  };
-
-  services.nginx.virtualHosts."www.pvv.org" = {
-    globalRedirect = cfg.domainName;
-    redirectCode = 307;
-    forceSSL = true;
-    useACMEHost = "www.pvv.ntnu.no";
-  };
-
-  services.nginx.virtualHosts."pvv.org" = {
-    globalRedirect = cfg.domainName;
-    redirectCode = 307;
-    forceSSL = true;
-    useACMEHost = "www.pvv.ntnu.no";
-  };
-
  services.nginx.virtualHosts.${cfg.domainName} = {
+    serverAliases = [
+      "pvv.ntnu.no"
+      "www.pvv.org"
+      "pvv.org"
+    ];
+
    locations = {
      # Proxy home directories
      "^~ /~" = {
--- a/hosts/bicep/configuration.nix
+++ b/hosts/bicep/configuration.nix
@@ -4,11 +4,12 @@
    ./hardware-configuration.nix

    (fp /base)
+    (fp /misc/metrics-exporters.nix)
    ./services/nginx

    ./services/calendar-bot.nix
    #./services/git-mirrors
-    ./services/minecraft-heatmap.nix
+    #./services/minecraft-heatmap.nix
    ./services/mysql.nix
    ./services/postgres.nix

--- a/hosts/bicep/services/matrix/coturn.nix
+++ b/hosts/bicep/services/matrix/coturn.nix
@@ -6,14 +6,12 @@
    key = "synapse/turnconfig";
    owner = config.users.users.matrix-synapse.name;
    group = config.users.users.matrix-synapse.group;
-    restartUnits = [ "coturn.service" ];
  };
  sops.secrets."matrix/coturn/static-auth-secret" = {
    sopsFile = fp /secrets/bicep/matrix.yaml;
    key = "coturn/static-auth-secret";
    owner = config.users.users.turnserver.name;
    group = config.users.users.turnserver.group;
-    restartUnits = [ "coturn.service" ];
  };

  services.matrix-synapse-next = {
@@ -44,7 +42,7 @@

  security.acme.certs.${config.services.coturn.realm} = {
    email = "drift@pvv.ntnu.no";
-    listenHTTP = "${values.services.turn.ipv4}:80";
+    listenHTTP = "129.241.210.213:80";
    reloadServices = [ "coturn.service" ];
  };

--- a/hosts/bicep/services/matrix/hookshot/default.nix
+++ b/hosts/bicep/services/matrix/hookshot/default.nix
@@ -18,7 +18,6 @@ in
  sops.templates."hookshot-registration.yaml" = {
    owner = config.users.users.matrix-synapse.name;
    group = config.users.groups.keys-matrix-registrations.name;
-    restartUnits = [ "matrix-hookshot.service" ];
    content = ''
      id: matrix-hookshot
      as_token: "${config.sops.placeholder."matrix/hookshot/as_token"}"
--- a/hosts/bicep/services/matrix/mjolnir.nix
+++ b/hosts/bicep/services/matrix/mjolnir.nix
@@ -6,7 +6,6 @@
    key = "mjolnir/access_token";
    owner = config.users.users.mjolnir.name;
    group = config.users.users.mjolnir.group;
-    restartUnits = [ "mjolnir.service" ];
  };

  services.mjolnir = {
--- a/hosts/bicep/services/matrix/out-of-your-element.nix
+++ b/hosts/bicep/services/matrix/out-of-your-element.nix
@@ -9,22 +9,18 @@ in
    "matrix/ooye/as_token" = {
      sopsFile = fp /secrets/bicep/matrix.yaml;
      key = "ooye/as_token";
-      restartUnits = [ "matrix-ooye.service" ];
    };
    "matrix/ooye/hs_token" = {
      sopsFile = fp /secrets/bicep/matrix.yaml;
      key = "ooye/hs_token";
-      restartUnits = [ "matrix-ooye.service" ];
    };
    "matrix/ooye/discord_token" = {
      sopsFile = fp /secrets/bicep/matrix.yaml;
      key = "ooye/discord_token";
-      restartUnits = [ "matrix-ooye.service" ];
    };
    "matrix/ooye/discord_client_secret" = {
      sopsFile = fp /secrets/bicep/matrix.yaml;
      key = "ooye/discord_client_secret";
-      restartUnits = [ "matrix-ooye.service" ];
    };
  };

--- a/hosts/bicep/services/matrix/synapse.nix
+++ b/hosts/bicep/services/matrix/synapse.nix
@@ -124,8 +124,8 @@ in {
        "fec0::/10"

        # NTNU
-        values.ntnu.ipv4-space
-        values.ntnu.ipv6-space
+        "129.241.0.0/16"
+        "2001:700:300::/44"
      ];
    };
  };
--- a/hosts/bicep/services/mysql.nix
+++ b/hosts/bicep/services/mysql.nix
@@ -48,8 +48,6 @@
    IPAddressAllow = [
      values.ipv4-space
      values.ipv6-space
-      values.hosts.ildkule.ipv4
-      values.hosts.ildkule.ipv6
    ];
  };
 }
--- a/hosts/bicep/services/postgres.nix
+++ b/hosts/bicep/services/postgres.nix
@@ -1,15 +1,15 @@
-{ config, pkgs, values, ... }:
+{ config, pkgs, ... }:
 {
  services.postgresql = {
    enable = true;
    package = pkgs.postgresql_15;
    enableTCPIP = true;

+    dataDir = "/data/postgresql";
+
    authentication = ''
-      host all all ${values.ipv4-space} md5
-      host all all ${values.ipv6-space} md5
-      host all all ${values.hosts.ildkule.ipv4}/32 md5
-      host all all ${values.hosts.ildkule.ipv6}/32 md5
+      host all all 129.241.210.128/25 md5
+      host all all 2001:700:300:1900::/64 md5
    '';

    # Hilsen https://pgconfigurator.cybertec-postgresql.com/
@@ -74,40 +74,11 @@
    };
  };

-  systemd.tmpfiles.settings."10-postgresql"."/data/postgresql".d = {
-    user = config.systemd.services.postgresql.serviceConfig.User;
-    group = config.systemd.services.postgresql.serviceConfig.Group;
-    mode = "0700";
-  };
-
-  systemd.services.postgresql-setup = {
-    after = [
-      "systemd-tmpfiles-setup.service"
-      "systemd-tmpfiles-resetup.service"
+  systemd.services.postgresql.serviceConfig = {
+    LoadCredential = [
+      "cert:/etc/certs/postgres.crt"
+      "key:/etc/certs/postgres.key"
    ];
-    serviceConfig = {
-      LoadCredential = [
-        "cert:/etc/certs/postgres.crt"
-        "key:/etc/certs/postgres.key"
-      ];
-
-      BindPaths = [ "/data/postgresql:/var/lib/postgresql" ];
-    };
-  };
-
-  systemd.services.postgresql = {
-    after = [
-      "systemd-tmpfiles-setup.service"
-      "systemd-tmpfiles-resetup.service"
-    ];
-    serviceConfig = {
-      LoadCredential = [
-        "cert:/etc/certs/postgres.crt"
-        "key:/etc/certs/postgres.key"
-      ];
-
-      BindPaths = [ "/data/postgresql:/var/lib/postgresql" ];
-    };
  };

  environment.snakeoil-certs."/etc/certs/postgres" = {
--- a/hosts/brzeczyszczykiewicz/configuration.nix
+++ b/hosts/brzeczyszczykiewicz/configuration.nix
@@ -4,6 +4,7 @@
      # Include the results of the hardware scan.
      ./hardware-configuration.nix
      (fp /base)
+      (fp /misc/metrics-exporters.nix)

      ./services/grzegorz.nix
    ];
--- a/hosts/georg/configuration.nix
+++ b/hosts/georg/configuration.nix
@@ -4,6 +4,7 @@
      # Include the results of the hardware scan.
      ./hardware-configuration.nix
      (fp /base)
+      (fp /misc/metrics-exporters.nix)

      (fp /modules/grzegorz.nix)
    ];
--- a/hosts/ildkule/configuration.nix
+++ b/hosts/ildkule/configuration.nix
@@ -4,6 +4,7 @@
      # Include the results of the hardware scan.
      ./hardware-configuration.nix
      (fp /base)
+      (fp /misc/metrics-exporters.nix)

      ./services/monitoring
      ./services/nginx
--- a/hosts/ildkule/services/monitoring/prometheus/mysqld.nix
+++ b/hosts/ildkule/services/monitoring/prometheus/mysqld.nix
@@ -10,7 +10,7 @@ in {
        inherit (config.sops) placeholder;
      in ''
        [client]
-        host = mysql.pvv.ntnu.no
+        host = bicep.pvv.ntnu.no
        port = 3306
        user = prometheus_mysqld_exporter
        password = ${placeholder."config/mysqld_exporter_password"}
--- a/hosts/kommode/configuration.nix
+++ b/hosts/kommode/configuration.nix
@@ -4,6 +4,7 @@
    # Include the results of the hardware scan.
    ./hardware-configuration.nix
    (fp /base)
+    (fp /misc/metrics-exporters.nix)

    ./services/gitea
    ./services/nginx.nix
@@ -30,3 +31,4 @@

  system.stateVersion = "24.11";
 }
+
--- a/hosts/kommode/services/gitea/customization/default.nix
+++ b/hosts/kommode/services/gitea/customization/default.nix
@@ -24,15 +24,10 @@ in
    script = let
      logo-svg = fp /assets/logo_blue_regular.svg;
      logo-png = fp /assets/logo_blue_regular.png;
-
      extraLinks = pkgs.writeText "gitea-extra-links.tmpl" ''
-        <a class="item" href="https://git.pvv.ntnu.no/Drift/-/projects/4">Tokyo Drift Issues</a>
-      '';
-
-      extraLinksFooter = pkgs.writeText "gitea-extra-links-footer.tmpl" ''
        <a class="item" href="https://www.pvv.ntnu.no/">PVV</a>
        <a class="item" href="https://wiki.pvv.ntnu.no/">Wiki</a>
-        <a class="item" href="https://wiki.pvv.ntnu.no/wiki/Tjenester/Kodelager">PVV Gitea Howto</a>
+        <a class="item" href="https://git.pvv.ntnu.no/Drift/-/projects/4">Tokyo Drift Issues</a>
      '';

      project-labels = (pkgs.formats.yaml { }).generate "gitea-project-labels.yaml" {
@@ -54,7 +49,6 @@ in
      install -Dm444 ${logo-png} ${cfg.customDir}/public/assets/img/logo.png
      install -Dm444 ${./loading.apng} ${cfg.customDir}/public/assets/img/loading.png
      install -Dm444 ${extraLinks} ${cfg.customDir}/templates/custom/extra_links.tmpl
-      install -Dm444 ${extraLinksFooter} ${cfg.customDir}/templates/custom/extra_links_footer.tmpl
      install -Dm444 ${project-labels} ${cfg.customDir}/options/label/project-labels.yaml

      "${lib.getExe pkgs.rsync}" -a "${customTemplates}/" ${cfg.customDir}/templates/
--- a/hosts/kommode/services/gitea/default.nix
+++ b/hosts/kommode/services/gitea/default.nix
@@ -15,7 +15,6 @@ in {
    defaultConfig = {
      owner = "gitea";
      group = "gitea";
-      restartUnits = [ "gitea.service" ];
    };
  in {
    "gitea/database" = defaultConfig;
--- a/hosts/kommode/services/gitea/gpg.nix
+++ b/hosts/kommode/services/gitea/gpg.nix
@@ -4,23 +4,9 @@ let
  GNUPGHOME = "${config.users.users.gitea.home}/gnupg";
 in
 {
-  sops.secrets = {
-    "gitea/gpg-signing-key-public" = {
-      owner = cfg.user;
-      inherit (cfg) group;
-      restartUnits = [
-        "gitea.service"
-        "gitea-ensure-gnupg-homedir.service"
-      ];
-    };
-    "gitea/gpg-signing-key-private" = {
-      owner = cfg.user;
-      inherit (cfg) group;
-      restartUnits = [
-        "gitea.service"
-        "gitea-ensure-gnupg-homedir.service"
-      ];
-    };
+  sops.secrets."gitea/gpg-signing-key" = {
+    owner = cfg.user;
+    inherit (cfg) group;
  };

  systemd.services.gitea.environment = { inherit GNUPGHOME; };
@@ -32,7 +18,6 @@ in

  systemd.services.gitea-ensure-gnupg-homedir = {
    description = "Import gpg key for gitea";
-    before = [ "gitea.service" ];
    environment = { inherit GNUPGHOME; };
    serviceConfig = {
      Type = "oneshot";
@@ -40,8 +25,7 @@ in
      PrivateNetwork = true;
    };
    script = ''
-      ${lib.getExe pkgs.gnupg} --import ${config.sops.secrets."gitea/gpg-signing-key-public".path}
-      ${lib.getExe pkgs.gnupg} --import ${config.sops.secrets."gitea/gpg-signing-key-private".path}
+      ${lib.getExe pkgs.gnupg} --import ${config.sops.secrets."gitea/gpg-signing-key".path}
    '';
  };

@@ -50,6 +34,5 @@ in
    SIGNING_NAME = "PVV Git";
    SIGNING_EMAIL = "gitea@git.pvv.ntnu.no";
    INITIAL_COMMIT = "always";
-    WIKI = "always";
  };
 }
--- a/hosts/lupine/configuration.nix
+++ b/hosts/lupine/configuration.nix
@@ -4,6 +4,7 @@
    ./hardware-configuration/${lupineName}.nix

    (fp /base)
+    (fp /misc/metrics-exporters.nix)

    ./services/gitea-runner.nix
  ];
--- a/hosts/shark/configuration.nix
+++ b/hosts/shark/configuration.nix
@@ -4,6 +4,7 @@
      # Include the results of the hardware scan.
      ./hardware-configuration.nix
      (fp /base)
+      (fp /misc/metrics-exporters.nix)
    ];

  sops.defaultSopsFile = fp /secrets/shark/shark.yaml;
--- a/hosts/ustetind/configuration.nix
+++ b/hosts/ustetind/configuration.nix
@@ -3,6 +3,7 @@
 {
  imports = [
    (fp /base)
+    (fp /misc/metrics-exporters.nix)

    ./services/gitea-runners.nix
  ];
--- a/hosts/wenche/configuration.nix
+++ b/hosts/wenche/configuration.nix
@@ -4,16 +4,11 @@
      # Include the results of the hardware scan.
      ./hardware-configuration.nix
      (fp /base)
+      (fp /misc/metrics-exporters.nix)
+
+      (fp /misc/builder.nix)
    ];

-  nix.settings.trusted-users = [ "@nix-builder-users" ];
-  nix.daemonCPUSchedPolicy = "batch";
-
-  boot.binfmt.emulatedSystems = [
-    "aarch64-linux"
-    "armv7l-linux"
-  ];
-
  sops.defaultSopsFile = fp /secrets/wenche/wenche.yaml;
  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
--- a/misc/builder.nix
+++ b/misc/builder.nix
@@ -0,0 +1,11 @@
+{ ... }:
+
+{
+  nix.settings.trusted-users = [ "@nix-builder-users" ];
+  nix.daemonCPUSchedPolicy = "batch";
+
+  boot.binfmt.emulatedSystems = [
+    "aarch64-linux"
+    "armv7l-linux"
+  ];
+}
--- a/misc/metrics-exporters.nix
+++ b/misc/metrics-exporters.nix
@@ -0,0 +1,80 @@
+{ config, pkgs, values, ... }:
+
+{
+  services.prometheus.exporters.node = {
+    enable = true;
+    port = 9100;
+    enabledCollectors = [ "systemd" ];
+  };
+
+  systemd.services.prometheus-node-exporter.serviceConfig = {
+    IPAddressDeny = "any";
+    IPAddressAllow = [
+      "127.0.0.1"
+      "::1"
+      values.hosts.ildkule.ipv4
+      values.hosts.ildkule.ipv6
+    ];
+  };
+
+
+  services.prometheus.exporters.systemd = {
+    enable = true;
+    port = 9101;
+    extraFlags = [
+      "--systemd.collector.enable-restart-count"
+      "--systemd.collector.enable-ip-accounting"
+    ];
+  };
+
+  systemd.services.prometheus-systemd-exporter.serviceConfig = {
+    IPAddressDeny = "any";
+    IPAddressAllow = [
+      "127.0.0.1"
+      "::1"
+      values.hosts.ildkule.ipv4
+      values.hosts.ildkule.ipv6
+    ];
+  };
+  
+
+  networking.firewall.allowedTCPPorts = [ 9100 9101 ];
+
+  services.promtail = {
+    enable = true;
+    configuration = {
+      server = {
+        http_listen_port = 28183;
+        grpc_listen_port = 0;
+      };
+      clients = [
+        {
+          url = "http://ildkule.pvv.ntnu.no:3100/loki/api/v1/push";
+        }
+      ];
+      scrape_configs = [
+        {
+          job_name = "systemd-journal";
+          journal = {
+            max_age = "12h";
+            labels = {
+              job = "systemd-journal";
+              host = config.networking.hostName;
+            };
+          };
+          relabel_configs = [
+            {
+              source_labels = [ "__journal__systemd_unit" ];
+              target_label = "unit";
+            }
+            {
+              source_labels = [ "__journal_priority_keyword" ];
+              target_label = "level";
+            }
+          ];
+        }
+      ];
+    };
+  };
+
+}
--- a/misc/rust-motd.nix
+++ b/misc/rust-motd.nix
@@ -0,0 +1,86 @@
+{ pkgs, lib, config, ... }:
+{
+  environment = {
+    systemPackages = with pkgs; [
+      rust-motd
+      toilet
+    ];
+
+    loginShellInit = let
+      motd = "${pkgs.rust-motd}/bin/rust-motd /etc/${config.environment.etc.rustMotdConfig.target}";
+    in ''
+      # Assure stdout is a terminal, so headless programs won't be broken
+      if [ "x''${SSH_TTY}" != "x" ]; then
+        ${motd}
+      fi
+    '';
+
+    etc.rustMotdConfig = {
+      target = "rust-motd-config.toml";
+      source = let
+
+        cfg = {
+          global = {
+            progress_full_character = "=";
+            progress_empty_character = "=";
+            progress_prefix = "[";
+            progress_suffix = "]";
+            time_format = "%Y-%m-%d %H:%M:%S";
+          };
+
+          banner = {
+            color = "red";
+            command = "hostname | ${pkgs.toilet}/bin/toilet -f mono9";
+          };
+
+          service_status = {
+            Accounts = "accounts-daemon";
+            Cron = "cron";
+            Docker = "docker";
+            Matrix = "matrix-synapse";
+            sshd = "sshd";
+          };
+
+          uptime = {
+            prefix = "Uptime: ";
+          };
+
+          # Not relevant for server
+          # user_service_status = {
+          #   Gpg-agent = "gpg-agent";
+          # };
+
+          filesystems = let
+            inherit (lib.attrsets) attrNames listToAttrs nameValuePair;
+            inherit (lib.lists) imap1;
+            inherit (config) fileSystems;
+
+            imap1Attrs' = f: set:
+              listToAttrs (imap1 (i: attr: f i attr set.${attr}) (attrNames set));
+
+            getName = i: v: if (v.label != null) then v.label else "<? ${toString i}>";
+          in
+            imap1Attrs' (i: n: v: nameValuePair (getName i v) n) fileSystems;
+
+          memory = {
+            swap_pos = "beside"; # or "below" or "none"
+          };
+
+          last_login = let
+            inherit (lib.lists) imap1;
+            inherit (lib.attrsets) filterAttrs nameValuePair attrValues listToAttrs;
+            inherit (config.users) users;
+
+            normalUsers = filterAttrs (n: v: v.isNormalUser || n == "root") users;
+            userNPVs = imap1 (index: user: nameValuePair user.name index) (attrValues normalUsers);
+          in listToAttrs userNPVs;
+
+          last_run = {};
+        };
+
+        toml = pkgs.formats.toml {};
+
+      in toml.generate "rust-motd.toml" cfg;
+    };
+  };
+}
--- a/modules/grzegorz.nix
+++ b/modules/grzegorz.nix
@@ -1,4 +1,4 @@
-{config, lib, pkgs, unstablePkgs, values, ...}:
+{ config, lib, pkgs, unstablePkgs, ... }:
 let
  grg = config.services.greg-ng;
  grgw = config.services.grzegorz-webui;
@@ -44,12 +44,8 @@ in {
        "${machine}.pvv.org"
      ];
      extraConfig = ''
-        # pvv
-        allow ${values.ipv4-space}
-        allow ${values.ipv6-space}
-        # ntnu
-        allow ${values.ntnu.ipv4-space}
-        allow ${values.ntnu.ipv6-space}
+        allow 129.241.210.128/25;
+        allow 2001:700:300:1900::/64;
        deny all;
      '';

@@ -71,12 +67,8 @@ in {
        "${machine}-backend.pvv.org"
      ];
      extraConfig = ''
-        # pvv
-        allow ${values.ipv4-space}
-        allow ${values.ipv6-space}
-        # ntnu
-        allow ${values.ntnu.ipv4-space}
-        allow ${values.ntnu.ipv6-space}
+        allow 129.241.210.128/25;
+        allow 2001:700:300:1900::/64;
        deny all;
      '';

@@ -94,12 +86,8 @@ in {
        "${machine}-old.pvv.org"
      ];
      extraConfig = ''
-        # pvv
-        allow ${values.ipv4-space}
-        allow ${values.ipv6-space}
-        # ntnu
-        allow ${values.ntnu.ipv4-space}
-        allow ${values.ntnu.ipv6-space}
+        allow 129.241.210.128/25;
+        allow 2001:700:300:1900::/64;
        deny all;
      '';

--- a/packages/bluemap.nix
+++ b/packages/bluemap.nix
@@ -2,11 +2,11 @@

 stdenvNoCC.mkDerivation rec {
  pname = "bluemap";
-  version = "5.15";
+  version = "5.2";

  src = fetchurl {
    url = "https://github.com/BlueMap-Minecraft/BlueMap/releases/download/v${version}/BlueMap-${version}-cli.jar";
-    hash = "sha256-g50V/4LtHaHNRMTt+PK/ZTf4Tber2D6ZHJvuAXQLaFI=";
+    hash = "sha256-4vld+NBwzBxdwbMtsKuqvO6immkbh4HB//6wdjXaxoU=";
  };

  dontUnpack = true;
--- a/packages/mediawiki-extensions/default.nix
+++ b/packages/mediawiki-extensions/default.nix
@@ -33,13 +33,13 @@ in
 lib.mergeAttrsList [
  (mw-ext {
    name = "CodeEditor";
-    commit = "6e5b06e8cf2d040c0abb53ac3735f9f3c96a7a4f";
-    hash = "sha256-Jee+Ws9REUohywhbuemixXKaTRc54+cIlyUNDCyYcEM=";
+    commit = "9f19fe510beb671d6ea3076e2e7cbd1025451924";
+    hash = "sha256-Bl0evDM4TpsoU5gvZ02UaH5ehFatJcn8YJPbUWRcK9s=";
  })
  (mw-ext {
    name = "CodeMirror";
-    commit = "da9c5d4f03e6425f6f2cf68b75d21311e0f7e77e";
-    hash = "sha256-aL+v9xeqKHGmQVUWVczh54BkReu+fP49PT1NP7eTC6k=";
+    commit = "050d8257c942dfd95b98525c0a61290a89fe8ef4";
+    hash = "sha256-3DnY9wlaG9BrnSgt8GMM6fzp3nAAPno49vr2QAz50Ho=";
  })
  (mw-ext {
    name = "DeleteBatch";
@@ -53,13 +53,13 @@ lib.mergeAttrsList [
  })
  (mw-ext {
    name = "Popups";
-    commit = "7ed940a09f83f869cbc0bc20f3ca92f85b534951";
-    hash = "sha256-pcDPcu4kSvMHfSOuShrod694TKI9Oo3AEpMP9DXp9oY=";
+    commit = "4c22b8604b0dca04f001d9e2bc13b1ea4f934835";
+    hash = "sha256-mul9m5zPFSBCfBHZJihJrxP55kFMo/YJ18+JLt5X6zA=";
  })
  (mw-ext {
    name = "Scribunto";
-    commit = "e755852a8e28a030a21ded2d5dd7270eb933b683";
-    hash = "sha256-zyI5nSE+KuodJOWyV0CQM7G0GfkKEgfoF/czi2/qk98=";
+    commit = "4a917ed13212f60c33dbc82d3d18c7f5b8461fdc";
+    hash = "sha256-3qQgXyPb00V9McN8fxgZlU+MeBzQm5ikH/vkXazibY8=";
  })
  (mw-ext {
    name = "SimpleSAMLphp";
@@ -69,8 +69,8 @@ lib.mergeAttrsList [
  })
  (mw-ext {
    name = "TemplateData";
-    commit = "fd7cf4d95a70ef564130266f2a6b18f33a2a2ff9";
-    hash = "sha256-5OhDPFhIi55Eh5+ovMP1QTjNBb9Sm/3vyArNCApAgSw=";
+    commit = "1b02875f3e668fa9033849a663c5f5e450581071";
+    hash = "sha256-vQ/o7X7puTN1OQzX3bwKsW3IyVbK1IzvQKV9KtV2kRA=";
  })
  (mw-ext {
    name = "TemplateStyles";
@@ -84,12 +84,12 @@ lib.mergeAttrsList [
  })
  (mw-ext {
    name = "VisualEditor";
-    commit = "032364cfdff33818e6ae0dfa251fe3973b0ae4f3";
-    hash = "sha256-AQDdq9r6rSo8h4u1ERonH14/1i1BgLGdzANEiQ065PU=";
+    commit = "3cca60141dec1150d3019bd14bd9865cf120362d";
+    hash = "sha256-HwbmRVaQObYoJdABeHn19WBoq8aw+Q6QU8xr9YvDcJU=";
  })
  (mw-ext {
    name = "WikiEditor";
-    commit = "cb9f7e06a9c59b6d3b31c653e5886b7f53583d01";
-    hash = "sha256-UWi3Ac+LCOLliLkXnS8YL0rD/HguuPH5MseqOm0z7s4=";
+    commit = "d5e6856eeba114fcd1653f3e7ae629989f5ced56";
+    hash = "sha256-U5ism/ni9uAxiD4wOVE0/8FFUc4zQCPqYmQ1AL5+E7Q=";
  })
 ]
--- a/secrets/bakke/bakke.yaml
+++ b/secrets/bakke/bakke.yaml
@@ -1,90 +0,0 @@
-hello: ENC[AES256_GCM,data:+GWORSIf9TxmJLw1ytZwPbve2yz5H9ewVE5sOpQzkrRpct6Wes+vTE19Ij8W1g==,iv:C/WhXNBBM/bidC9xynZzk34nYXF3mUjAd4nPXpUlYHs=,tag:OJXSwuI8aNDnHFFTkwyGBQ==,type:str]
-example_key: ENC[AES256_GCM,data:ojSsrFYo5YD0YtiqcA==,iv:nvNtG6c0OqnQovzWQLMjcn9vbQ4PPYSv2B43Y8z0h5s=,tag:+h7YUNRA2MTvwGJq1VZW8g==,type:str]
-#ENC[AES256_GCM,data:6EvhlBtrl5wqyf6UAGwY8Q==,iv:fzLUjBzyuT17FcP8jlmLrsKW46pu6/lAvAVLHBxje6k=,tag:n+qR1NUqa91uFRIpALKlmw==,type:comment]
-example_array:
-    - ENC[AES256_GCM,data:A38KXABxJzMoKitKpHo=,iv:OlRap3R//9tvKdPLz7uP+lvBa/fD0W8xFzdxIKKFi4E=,tag:QKizPN1fYOv5zZlMVgTIOQ==,type:str]
-    - ENC[AES256_GCM,data:8X2iVkHQtQMReopWdgM=,iv:2Wq3QOadwd3G3ROXNe7JQD4AL/5H/WV19TBEbxijG/8=,tag:tikKT9Wvzm4Vz5aoy6w9WQ==,type:str]
-example_number: ENC[AES256_GCM,data:0K05hiSPh2Ok1A==,iv:IVRo61xkKugv4OiPm0vt9ODm5DC1DzJFdlgQJb1TfTg=,tag:o3xXygVEUD4jaGSJr0Nxtw==,type:float]
-example_booleans:
-    - ENC[AES256_GCM,data:zoykmQ==,iv:1JGy1Cg5GdAiod9qPSzW+wsG6rUgUJyYMEE4k576Tlk=,tag:RUCbytPpo78bqlAVEUsbLg==,type:bool]
-sops:
-    age:
-        - recipient: age1syted6kt48sumjjucggh6r3uca4x2ppp4mfungf3lamkt2le05csc99633
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOM0NNRFlYaDVtY2taK2xZ
-            R1pJKzhzOFJJbVI1ZEtQZTJJd1JiejdwaHpJCjlyZVZLZUpVeG1HNHo1UTlaa1gz
-            Q2JOTmpibndlcERXaWw3Ujd3OGo2aU0KLS0tIEhKcjFKYm82VFdHWTkvcFBDam5H
-            bzhGbFF6ZmRPTXpzMWgzWGJJbGlkUTAKtNREtgj4kXKDymmbBt2YVFUqrAaGY72z
-            8fUEIz/2/kPeb4QBpYt4HQabXDLCZXZ0Q5qhHRFOSER8o+TrkJDEow==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1ug30gg4y7ftuya0wdv7q0vh4egn00wlv2th7mt7cgc2ze46wmvyq9lq6ge
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSbEJRNjVJSE5qSk1VcVR6
-            VTh6ZU93Q2dGclhZWXA4YTh5WXZ4MWFMRzNRCkJ6Z1F6a20za3ZxLzRsZGg2aHpn
-            Nll0NW9XRndIOFpzMVgwK3RxWm1BUkEKLS0tIGF0MUYwblY4a3haelJYRkNyd3lS
-            S0ZuSUVXWGVXbnJocm1LRjZRSGVrMFkKQcwZk7mlF96kPdvZyLNR2i5CnU/qR7/i
-            u897JxtxmXuuNDKPA80pFxfwkOwzcUVrYiwOlAbMENwJWH1SwFO3Cg==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1mrnldl334l2nszuta6ywvewng0fswv2dz9l5g4qcwe3nj4yxf92qjskdx6
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWa2c5d0RvR21jQ21ZRVBL
-            dkR2RDhMMmJKTXk4UnFTbEZCbE5vV2cwRTNnCkFFT05kYUhXREtzSGkyY1VYQ2ZE
-            bU0xZnlUN0draW5DZXRqQlloVi9NaFkKLS0tIDdHb05weWlzcDN4bFdzYnpUVjVV
-            ZkVXK01odnZJeGhoaFFLbEVSMFJsMHcK/mgeA6aMlr7T35rHL3GriYHu2DQE45sI
-            8RdxdErESmpx0bneFbmsBgXOYu+iT64zatPEGVSu1taW/nMa8Ucpzw==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1hmpdk4h69wxpwqk9tkud39f66hprhehxtzhgw97r6dvr7v0mx5jscsuhkn
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxbm4wL1pHeVVRYzJrb0RZ
-            VHA5ZGRTUHkxbk9qenpNRGE4bjQ0SzN6UVFvCkRHQ0VDaUhRRDI3Yy90UXZCdTlo
-            dnBHSmU5WlBlczlBbDBZRHFvLzFBWVkKLS0tIFVNVG5qRDZlcWZ4R00zc0N5bkli
-            d0Z4TEJzdEFuV3NnTndFZlpPMTNYSHMK1d1Use9/w4ClrCfShBymIxHZppCXmhmQ
-            vIW5vI4Ui0jSX9Rwhd17CLT66mQYBbaHTGB9fiGNQpFRc/ztaFbbnw==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1wrssr4z4g6vl3fd3qme5cewchmmhm0j2xe6wf2meu4r6ycn37anse98mfs
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrNmF2ZTFreDdzdVZHRWt4
-            VW1TNXFWRW13T3VBN04wMi95VkRCeHJIalVNClRLZGFDY2ZIREkweXp5dU9yYVRD
-            T1N5QVh0eWczd3VIWEthbTZRVXM0L00KLS0tIFlWeDZmQzYrQXdoZ3dycS9udEFW
-            TGg0bGwxQjQ1UkR5OC9FajI1RHprUXMK8NRbkEjLEW6pANEkB0QyBcgMin/Aaf5A
-            dkFYo01G3XM7AmlnnM9UCc56Gc/ZfcsVaUhMAZoEvEvuU0++ufCIZg==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1zhxul786an743u0fascv4wtc5xduu7qfy803lfs539yzhgmlq5ds2lznt5
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYNE04cmdoYnc4cGhmMmlW
-            aU1MNXpacVp2eGV1dU1GUUNyd3dFRDI0and3CllsSG9qR1IwaG1iU2FpWEduanhx
-            WVE2SWZBblp5RWd3Mi8rc2s3M2F6cXcKLS0tIFBnaCtIelBPdEtqRUIrTnY3VytC
-            K3dUNVgrYlVnRjRKVVRDQmxsUC9tOG8KFE/pU3tSnyohg58FTWWc2j1Yk0+QHRyH
-            VakZTPA8l2j7X01KOwEDaZBZrzFd8059GBUMRnylcVOCg5a5VjXpEg==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-03-15T21:42:17Z"
-    mac: ENC[AES256_GCM,data:2gH/ZaxSA6ShRu53dxj7V3jk7FsVdYS+PSHQyFT8qMvKM1hsQ/nWrKt00PUl9I7Gb4uomP9Ga3SyphYOXRBzKoV+x52oEWOJE3Q4iPrwdCkyHlxEezhTd/ZRQVatG6dvHpLuDNS9Dyph4f7Mw5USI+m4WeVdgCvHTydw+4KIfP4=,iv:yimfq96WVsagvKr8HTg1RdZBSrVGcCWPvv8XOXkOfcg=,tag:zHzdrE0PX5+AeD2lpqeJVQ==,type:str]
-    pgp:
-        - created_at: "2025-12-22T06:10:02Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA0av/duuklWYAQ/+Jcq2EiWutguXVgFJsG0eU9CmM/ZrSfN7Of6MeGh53vw5
-            F125rivlWf56nEjAnW0u0Ai1MRUUvL6cSqnIxH0y0NcgllkUVrMDJPtsp4/1pFG3
-            pMhQuaoun7mmHbMwFD/WIGk3NeQA2WRm8vCa2yHuOHKG5rISZDgY/5WdkLGK9Vll
-            A3eBaz2r+jQwZNHMTu9Sgmuya7EAGCb/7oSTyE+ZyG9zDwyvbKcuS+xMx/Sqx5a+
-            a1a38fJCdwTHNGR293kMhVK75z0aOvGp4t92bulAe0Tp0Efc43TNGYIGjOQT7r3J
-            k4YQ0OcR+fezp8GSLxoewWBpCMFaRliSnLh7XJwd2jTURbzlpQFFKNXW4pLxrAIr
-            ZJXZ6Hloz91MRoQ8HLCs7WqhLptXGnqXsJPCwdBJEeVzutyt3cZIzq11bNgf9sNv
-            Ydj86FmGTMFK5d9kNYAqxwnfcVIc3/AdbyKNoky1Muu0z5XvUdgUcYu5RK9yL3DA
-            dUJVI5uam+ONUatFeTbS2Vz7KEbwh1H3gfQUQTrE6FOSrh8bk0lp1aG1geL69ram
-            XXh/uHkvzTgbq+oiyiqbodurrEQHcdhrYJwvPELLQwtIq+0iVu7xNIFz+LNuAMqK
-            d1lualLK7xHNqCOhihY1nKR3PjDrE4tUKjtwu1lp2Ae+VEXg1FgrqdkquxlE+0XS
-            XgG0jfeGqwQKM1qGkaj9UX/xXe8Io5KhOAqRhnkauU9nZ4Uaj5X1rFpbLAOT2/FZ
-            rHjT46gUUh1hK2TEnL14yJ8ttIntlcXh6lJ6zbkIL7G+56GlqhPmr8M6N67VEq8=
-            =8M3y
-            -----END PGP MESSAGE-----
-          fp: F7D37890228A907440E1FD4846B9228E814A2AAC
-    unencrypted_suffix: _unencrypted
-    version: 3.8.1
--- a/secrets/kommode/kommode.yaml
+++ b/secrets/kommode/kommode.yaml
@@ -5,8 +5,7 @@ gitea:
    database: ENC[AES256_GCM,data:nDZqnSBKijyhslBjhSu9weqLVJzUiBD8Ltu/nmllicadraeISylyEk3pOA==,iv:XFzM1pGv98jehdgvlZN217LrsK8TcAMFK5eDrPi2bm0=,tag:+YpXqMmvMTrnt7cDK/Sa7A==,type:str]
    email-password: ENC[AES256_GCM,data:tasMZ2Zu449o/mH6uSSPM7cFOlBg4vC+,iv:lDNMvXh5P3HNy9pW6nBsSLCyij/3HiSRunVuLeKAmbI=,tag:ApqGWYE9MSE8m6iYLK6Yww==,type:str]
    passwd-ssh-key: ENC[AES256_GCM,data:VOp8vqVoX9IFJhzpKy0J+AzyX3TvxEIBvv3dXpD1f8szmUyPwd4gDOlaFpqTSDu8ebmK3m/D0FMTkfBkPVhUG6XTPo7YIV37gLhfsBF6CuwCMXxTQAd23nfpwJKcDIn3R5h8Mu4MMme2Ev/4PNDztktmIYv3KoEbPglzBMS4LrZqJsDilvIYKEIDUExhSAkESKQZiIzK1TdtWDQSUzvUZ3OsbxONZgaTw5e+xz3qk/q+IR5eRNp9fpeZQ8EkpC7aa/JDIwxzNIuMFi8W9PWh6ANmAOm6GK7JSKiHYQL8GofVifhUGUanAnjgDTYkIWpDiSsuHjfDPGupFCeONNd+Wd4NpJZsej3p9ldLOVxa01Le2tIVYY80jUWT0dpV9IJ5syp4gVaky5Vk6i2QhvjunDoEUnArSRGyMTxWfxAxZLvbLYMNAJDoWzy25vf3jteNB43lVHckEW1F8w/RtzoKzbjKYiANHg+eNLVq0HK67gX2twpblNN4OBt9d03ZbV2lZjTMXGzJXHGFT5ZPDwTkxcDooNvoRuCMe8t8dpuksHFaIp4=,iv:3sgiIgGD9pmCMLVRk0Q8+7GZajYIWsokDUx9JuNrO2c=,tag:WDXyNYtqjdAMePEsnA0hbw==,type:str]
-    gpg-signing-key-public: ENC[AES256_GCM,data:WgEr+ehNJa9ivlPYnsTD2772MUmsu3uvGtuwn2htqHtNxJwNG6rlnAWr1zG5D69A3G01u61mWCxLYETzjg6GsLW3rKadzUSP934kl5VQMISW2iW3XDaPLpO8dPfk2IaT4oXpui0zk0z+Viy87yl/p6JVLJ2HHFTwh7QTl+gZj8JXF5zpst8Y1op+JuBlePCUgBIE4YCF/m1kKuCDEUnZ5b4QKrogOtlN8AXwIKgrEADGgufXee5B+mg/KYBfX3/JB6evfz3rAn3gLyT8nO9T8V7RJjVeastHw0tPEx7Ep12rQxZ7uOQ66n1D0WIYB5FgiqDoY9AJxMJi02roiW1d2bqvkKfikWnYkk8zkKPWzbLWkL/gaXR5wrvK4x5kLg3GUdNzGKLUrNOy/3QjCUOe4RDXBDPgvB+LNmoME9hGGhtPRBzAsM5n7HKCTRksDRHWnArP2JsNhxeUoJWp09lBIbQ6qoF5x9C/mcxdbfuzP8+PrWiTNbxb7ZWwfhc/NYzS2YYYBUdc30xJwqgPVtJdo2FHLwQFlLNnQzvSTL/ed11EGLaNDQ4ybLVymJE1NGdsqTxzhkh0bejIkl5AcYmuw7qdzjc4bKEokT7EixVNqzw9wohyLrOfaN1fSWt8hWgULkeYNbxUMAicLIyrrBxz0D88wrug6LzNhxAC28RRs4ALhFhXpYQKnr8ldLWgoDUq8uefnWiRCiXPBB6u8BhzwTUR68lbjXjZDTUOLEubdBavRtHsWF2sy7nex8oVcMuD5+YGb+coEB4Js/QhcBSf/ewWFMmg/UIGfCkIpzpsbRTJZtHIgI7eQ8RQ0zRFlNPDeQ0Us05Qza8YcGEtIwyZgc7rJXZ2+6VtQrGuCkOAHiZzlkauDD0RZkB+oAI9RW3HoW0HdfXNwLAlHldNEMNkl2lf5fYNfZIXv6GbHXVnhGo13K8arLMqo6o5DUO3f57PWUk821kNaw5vr6dMb92rx0k0yNp1kxAug8JWYWmUcBypJHNEHTvNiMDO45HwS1C7e670NB8c2MWE2akimbSZTWF1U3RiSAD3MRUjMnT4yvpumhJlKlC9tRsKmE5WapCvwNxwIkGhFV2c0rml+8wBae0Y9CxVGWVwDnJc,iv:LpQufJB8jurx+2b1zvMd87z+byT3kKCITN0PQlW6yE4=,tag:K9tdQyFwbmk8J/6yHz27lQ==,type:str]
-    gpg-signing-key-private: ENC[AES256_GCM,data:WoFK9E4vCkQ68WTgSrmTwf3qaDfpjd/MVi1wSEiwJLqtWvm6BhWzTD+LQlgqrqZkSbX7bEcRwY2XT2DDLqK32xA8NgmOFinf3Xj3XsVTxTUWB7QoEksl1FVtrzTiJV+5Ztk/irhRnyCBnWSl6dHallY9RxbPVRMdgFzYP09FKhgJ90nmTtbfRzTO+jVsUp886kRwrJhitjie+nJlNrZwdh7YtqazJrmggPs6Z8cF/GkQrpSZpVHPGh6uNWRyxf50R8dcjLTHOHgVMuPo8UHX2w4lSGmEfNVa6VKKiZg86laTr998H1oUzC00erII5RENDb+PulVe3Gy8aSxd+swybM+3QTSGg/2q6hk2rS/uDQ8nDN80xKqho9T5IDqSbVamS9X5n/adY2wDoJMwlF7oha6mrmaUiGaWVoRkhw0YpwH4xY9US5O5BfUgJ+NAAo4U+YQGAJvQkO1txkFifv/lLptRRexvfRQJ5nNP0Dn0Yvolz/Xwx78IykWIHzv1mx3odKc8wDDKfzPEA9Y3KgiSHb8B3CL4XQqcW0ADAO1gfeLRBWTy0wtrgoYKdLW+eNTjy/WW5qWf81CrrjDb0hDwRQRaO0elCjS3tg1FYQYfyc2dg0XPANhCACbBajP9l6MShzpj9+0WWBTrc1e+bKy42FiteYk42f3oI5k9EGsYqlpyTCUyk0Iezwskl5ui/3Jce9G8BhpWH5YQpIg8iXiKkLwaAMDgfrZe5I8ad44L798LVZM+0kXjBW1pbt6ok2PkhQh75sDKubiNKFGVyR70QguQyAfr1FKGC2W351OzX/2CMJ2426/M2IXBfaXxZLDjlMN1KMhwGAGQOPRv8EqZABvPUUP8fIDhUhtAn0AhLs7cga1Xoz0DmY2x+0aVvfYjZIPzrrJA1LIJtTFvJzUltpf6e3UWX+r6MoDfpp4vNLi2x3mDWM8sC75Ouv4jKL2o3VA3C0EuIUK8L/aDh+V53L0Yvc0AZxv+eV3cZjveEgcwSBhv6hXpZYYOHrAOSrHQFns5jUqxZcGMWGDOtl/tmKW9cRuxeSHKB9bNHoJWtMDX2ojcU0l4APCFeM2RRXFSohJRS/0lDgWz0JwI9xXkqDfdB8r7WS0cLKxcHmAxF+d9+qoJRwMc5AVIRFfH8NyDhS5ngFJgeVE1ae0ng6nIauxwjpmtjdWl7a2XOKAtbh+jwHe0OqlG20/i,iv:D7QmF6bx/r9JX2S1Tb8IpDqX/yD3deNPqqNHXJHrhqs=,tag:NSEP9RCcaZBgbaRnmR/p7g==,type:str]
+    gpg-signing-key: ENC[AES256_GCM,data:AyafTF3H8p1qDk9xsNvT68BksoKGLwE2uE3hjz0TrT2XPxCRDOIlfAVYEPSu2Ih6l5a2uruEJhHPtU2fPCB2hln3Bv3gZfFGLb3GFWkSvdePIYFxG56uqGK5dE1KaMccc2cTi+raDImKqSTbp7Qpdo/c6C0WYVglYrD+2l8Y4QOiFuazyLY9zwcX0qG7pIjJ+akCUjfE4rJDAW6H/v+OqvHpcED3q4iXOYuw9sj/UeIgZfJ5Xc/uVrRmPewP4yALnA8o9gsaaLdjWRFIILe7VRwPr0YqwQ6XGgc+pEartkV8AzxjCq6DOtifOOzmu8EI1U1yoaOViYCAMbSHfP6SIKr7pJbrdU+YDBq9mvRx8KPXWUU2uNGrMObATEzlqMYAYA/HJeOdV4w3Axvq8RG2FLkJxJJniwNP5VZRF3bbbI3w+hprRP2yAwgeQw19KBU8yF8upKga/GdMNScpKJvRyVLjZtI0rsfvSC81lHawouuje6aPXT3dH1S5ROJBHMTeV0sP0vK6liBevz9RZpvNs6JVyNCgiRRtRSSYqsgwPJonDKuPeI/Zpgih7HboA8HqhIibqpO96h5/4yO69oJAbLUYV3zlKQcMDTaqadL4Ox5Z+8ygSAL3l1ufZIFGSj73SNHGQqQlIS/a3dAccRi5fPqv0gOmGFAAUJPKfeauFn3TclwojKzu5vwmQxZ5g50txEpTSTaYOy++qq6UZa/dXEyDC7fle75dXhqXyqMCf9kDwZZl5E9eBsabNdTF+auQCp82iLQivdBy7uJX2hkJFSg84fF9MLgH4mOcMQc2E/z961uNzEgoyvVhbDY6+SIJ+6SGmnardbFW7mYrj/QqnSUiMc4tHukAB4NGQYHgjOYRZMpHfVO/6dLbjmTOljnPsnfQUCepvb9rGim8NazvnARaVzezx4t3tfbNR8uLQudSeLZzn/Fu1mKSQvpP+IjdglmyAgp6QhB4OCDPbiaMRDUtOQIzlVILdz1/geUVzhZkJ4xzkm5klGukhtv+3TqjiTcEnoVJC+A1jRvxBQUfEE92GFuupJUfrw8bIDqsWQLkHPCNUMgdoKa/q2OkrWeQz2zm2yUqMAJn1/puoLHdSH5aCELUggx1gQZoc480pSBUvSCML+Qc4B4Cd6hX2PPp+/KQeKtfqHIsKz2I+DMT6KDirReX6WHxqk+s2DtLw7Wx/j65PWCIWLCz,iv:c9BDRxQImWTmwq11+T2CW0S00Dixd8d0od5xn5zZmY8=,tag:brnMedsdTwlkbaHaLa2w2g==,type:str]
    ssh-known-hosts: ENC[AES256_GCM,data:P6hKaCpcZdXIy4rE/1b1+66Md/3Kmviileb0OIT3Vz4IVsDLecBh3IiadHq66V4KocXC4LBUNFjcrxlVVGIonHJ3qd6VpQUwG0n83yhj6LD5hgxmZ5phAyR77Ri8BiH1lWUcg51L2k0U+WJFPP6JkumT9MEz1t1+JYr5Imij6GKRWRKFwTbU6QJwFH4tCA/iGw0ElrzIjSHiNiwIKfbm8yas9vlOhr4y7vCeV10hVyvV,iv:dZ8hQxhn7pokWbQG/8rQ2vFDpPYut7WCG3xy9g6kzNs=,tag:xMyPtJJoh8kjJcOT4t9aRA==,type:str]
    import-user-env: ENC[AES256_GCM,data:9SE2k3/IJqbdexj0QFSQBQ1+u1AduWNjt+0XIHryJlxIEdvv9a+6hP4EXPo+31GnaE4=,iv:qZlWOBV5owr3ESTyFaV/R8VwlGl04kaui80I2zYk4zY=,tag:PhjRfEC1xoHaYyl648yCVw==,type:str]
    secret-key: ENC[AES256_GCM,data:YqwSJazPqz1OOsUVIPKsGvIHbX7SyJqryan1KWSRGRJkt9yZlaiRtQG/mQugAM6IvLFD3pj+gPTcXyqenaAQKA==,iv:nyPnL7wuhpb0kl0tm1JhOHmF7KI9vVcTN1SRGTgD2o8=,tag:Rt/IPC/YtBcmTx5osGlbBg==,type:str]
@@ -68,8 +67,8 @@ sops:
            ZWRCSXpESTNpbnQzU3A3VG1xSE1BeXcKDr35W9phmGfEQtNb7V/f+g4GIcbk/klU
            +1EJsJ+jK1qCSDgO7omQge5Jx1XqSAg8H+21fnHA4JLhfIeZbntBTQ==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-12-22T06:35:29Z"
-    mac: ENC[AES256_GCM,data:Tvj7CzTOFGTMJyNMTjx4XTmrBGBTkOKb2kIHNEtvhCfc5fSbAjzl/keONaq6LGMhyc83jp0XZpM22vN8d+TqTsUiFGwlXIEJ9aa2N/IFlixd/FGRIZUihQj65Uctbk1x5y0LHUDl53aUa/FFEeuF7aPlUB70Q2SiLME1ATtG9+0=,iv:b0Fp4fQUzhgmSKH7caegMXbstWkj2by/8ABQXUJjdIQ=,tag:uzkkvggilx6KWaeMhYRBEQ==,type:str]
+    lastmodified: "2025-08-03T01:35:52Z"
+    mac: ENC[AES256_GCM,data:wQPIW9zRhB6IjK1OQy69Ln+dj6OMNLnNKIzFIhv/vbQ4GllMJ3N/gZjuzMJIumcVND+jEY/qiYnsCFSptStlDYtB3/zHWo1e6It2pM4igtoTP29uiQME0vPJSz0guakZlDMa20mOTN0vVZODEbeBiQNXWtnTbl93R2JVJlZrWcI=,iv:L9Dk5S+hbBO0LTM0irfLuqjLYHzVtY5Tq+Q7m65u6p8=,tag:0GT9IyPeGY5YM6PP/LNs/Q==,type:str]
    pgp:
        - created_at: "2025-12-01T10:58:24Z"
          enc: |-
@@ -92,4 +91,4 @@ sops:
            -----END PGP MESSAGE-----
          fp: F7D37890228A907440E1FD4846B9228E814A2AAC
    unencrypted_suffix: _unencrypted
-    version: 3.11.0
+    version: 3.10.2
--- a/topology/default.nix
+++ b/topology/default.nix
@@ -1,240 +0,0 @@
-{ config, pkgs, lib, values, ... }:
-let
-  inherit
-    (config.lib.topology)
-    mkInternet
-    mkRouter
-    mkSwitch
-    mkDevice
-    mkConnection
-    mkConnectionRev;
-in {
-  imports = [
-    ./non-nixos-machines.nix
-  ];
-
-  ### Networks
-
-  networks.pvv = {
-    name = "PVV Network";
-    cidrv4 = values.ipv4-space;
-    cidrv6 = values.ipv6-space;
-  };
-
-  networks.site-vpn = {
-    name = "OpenVPN Site to Site";
-    style = {
-      primaryColor = "#9dd68d";
-      secondaryColor = null;
-      pattern = "dashed";
-    };
-  };
-
-  networks.ntnu = {
-    name = "NTNU";
-    cidrv4 = values.ntnu.ipv4-space;
-    cidrv6 = values.ntnu.ipv6-space;
-  };
-
-  nodes.internet = mkInternet {
-    connections = mkConnection "ntnu" "wan1";
-  };
-
-  nodes.ntnu = mkRouter "NTNU" {
-    interfaceGroups = [ ["wan1"] ["eth1" "eth2" "eth3"] ];
-    connections.eth1 = mkConnection "ntnu-pvv-router" "wan1";
-    connections.eth2 = mkConnection "ntnu-veggen" "wan1";
-    connections.eth3 = mkConnection "stackit" "*";
-    interfaces.eth1.network = "ntnu";
-  };
-
-  ### Brus
-
-  nodes.ntnu-pvv-router = mkRouter "NTNU PVV Gateway" {
-    interfaceGroups = [ ["wan1"] ["eth1"] ];
-    connections.eth1 = mkConnection "knutsen" "em1";
-    interfaces.eth1.network = "pvv";
-  };
-
-  nodes.knutsen = mkRouter "knutsen" {
-    deviceIcon = "${pkgs.super-tiny-icons}/share/icons/SuperTinyIcons/svg/freebsd.svg";
-
-    interfaceGroups = [ ["em0"] ["em1"] ["vpn1"] ];
-
-    connections.em0 = mkConnection "nintendo" "eth0";
-
-    # connections.vpn1 = mkConnection "ludvigsen" "vpn1";
-    interfaces.vpn1.network = "site-vpn";
-    interfaces.vpn1.virtual = true;
-    interfaces.vpn1.icon = "${pkgs.super-tiny-icons}/share/icons/SuperTinyIcons/svg/openvpn.svg";
-
-    interfaces.em0.network = "pvv";
-    interfaces.em1.network = "ntnu";
-  };
-
-  nodes.nintendo = mkSwitch "Nintendo (brus switch)" {
-    interfaceGroups =  [ (lib.genList (i: "eth${toString i}") 16) ];
-
-    connections = let
-      connections' = [
-        (mkConnection "bekkalokk" "enp2s0")
-        # (mkConnection "bicep" "enp6s0f0") # NOTE: physical machine is dead at the moment
-        (mkConnection "buskerud" "eth1")
-        # (mkConnection "knutsen" "eth1")
-        (mkConnection "powerpuff-cluster" "eth1")
-        (mkConnection "lupine-1" "enp0s31f6")
-        (mkConnection "lupine-2" "enp0s31f6")
-        (mkConnection "lupine-3" "enp0s31f6")
-        (mkConnection "lupine-4" "enp0s31f6")
-        (mkConnection "lupine-5" "enp0s31f6")
-        (mkConnection "innovation" "em0")
-        (mkConnection "microbel" "eth0")
-        (mkConnection "isvegg" "eth0")
-        (mkConnection "ameno" "eth0")
-        (mkConnection "sleipner" "eno0")
-      ];
-    in
-    assert (lib.length connections' <= 15);
-    builtins.listToAttrs (
-      lib.zipListsWith
-        (a: b: lib.nameValuePair a b)
-        (lib.genList (i: "eth${toString (i + 1)}") 15)
-        connections'
-    );
-  };
-
-  nodes.buskerud = mkDevice "buskerud" {
-    deviceIcon = ./icons/proxmox.svg;
-    interfaceGroups = [ [ "eth1" ] ];
-
-    interfaces.eth1.network = "pvv";
-  };
-
-  nodes.shark = {
-    guestType = "proxmox";
-    parent = config.nodes.buskerud.id;
-
-    interfaces.ens18.network = "pvv";
-  };
-
-  ### Powerpuff
-
-  nodes.powerpuff-cluster = mkDevice "Powerpuff Cluster" {
-    deviceIcon = ./icons/proxmox.svg;
-
-    hardware.info = "Dell PowerEdge R730 x 3";
-
-    interfaceGroups = [ [ "eth1" ] ];
-  };
-
-  nodes.kommode = {
-    guestType = "proxmox";
-    parent = config.nodes.powerpuff-cluster.id;
-
-    interfaces.ens18.network = "pvv";
-  };
-
-  nodes.bicep = {
-    guestType = "proxmox";
-    parent = config.nodes.powerpuff-cluster.id;
-
-    # hardware.info = "HP Proliant DL370G6";
-
-    interfaces.ens18.network = "pvv";
-  };
-
-  nodes.ustetind = {
-    guestType = "proxmox LXC";
-    parent = config.nodes.powerpuff-cluster.id;
-
-    # TODO: the interface name is likely wrong
-    # interfaceGroups = [ [ "eth0" ] ];
-    interfaces.eth0 = {
-      network = "pvv";
-      # mac = "";
-      addresses = [
-        "129.241.210.234"
-        "2001:700:300:1900::234"
-      ];
-      gateways = [
-        values.hosts.gateway
-        values.hosts.gateway6
-      ];
-    };
-  };
-
-  ### PVV
-
-  nodes.ntnu-veggen = mkRouter "NTNU-Veggen" {
-    interfaceGroups = [ ["wan1"] ["eth1"] ];
-    connections.eth1 = mkConnection "ludvigsen" "re0";
-  };
-
-  nodes.ludvigsen = mkRouter "ludvigsen" {
-    deviceIcon = "${pkgs.super-tiny-icons}/share/icons/SuperTinyIcons/svg/freebsd.svg";
-
-    interfaceGroups = [ [ "re0" ] [ "em0" ] [ "vpn1" ] ];
-
-    connections.em0 = mkConnection "pvv-switch" "eth0";
-
-    interfaces.vpn1.network = "site-vpn";
-    interfaces.vpn1.virtual = true;
-    interfaces.vpn1.icon = "${pkgs.super-tiny-icons}/share/icons/SuperTinyIcons/svg/openvpn.svg";
-
-    interfaces.re0.network = "ntnu";
-    interfaces.em0.network = "pvv";
-  };
-
-  nodes.pvv-switch = mkSwitch "PVV Switch (Terminalrommet)" {
-    interfaceGroups =  [ (lib.genList (i: "eth${toString i}") 16) ];
-    connections = let
-      connections' = [
-        (mkConnection "brzeczyszczykiewicz" "eno1")
-        (mkConnection "georg" "eno1")
-        (mkConnection "wegonke" "enp4s0")
-        (mkConnection "demiurgen" "eno1")
-        (mkConnection "sanctuary" "ethernet_0")
-        (mkConnection "torskas" "eth0")
-        (mkConnection "skrott" "eth0")
-        (mkConnection "homeassistant" "eth0")
-        (mkConnection "orchid" "eth0")
-        (mkConnection "principal" "em0")
-      ];
-    in
-    assert (lib.length connections' <= 15);
-    builtins.listToAttrs (
-      lib.zipListsWith
-        (a: b: lib.nameValuePair a b)
-        (lib.genList (i: "eth${toString (i + 1)}") 15)
-        connections'
-    );
-  };
-
-
-  ### Openstack
-
-  nodes.stackit = mkDevice "stackit" {
-    interfaceGroups = [ [ "*" ] ];
-
-    interfaces."*".network = "ntnu";
-  };
-
-  nodes.ildkule = {
-    guestType = "openstack";
-    parent = config.nodes.stackit.id;
-
-    interfaces.ens4.network = "ntnu";
-  };
-  nodes.wenche = {
-    guestType = "openstack";
-    parent = config.nodes.stackit.id;
-
-    interfaces.ens18.network = "pvv";
-  };
-  nodes.bakke = {
-    guestType = "openstack";
-    parent = config.nodes.stackit.id;
-
-    interfaces.enp2s0.network = "pvv";
-  };
-}
--- a/topology/icons/bind9.png
+++ b/topology/icons/bind9.png
--- a/topology/icons/greg-ng.png
+++ b/topology/icons/greg-ng.png
--- a/topology/icons/proxmox.svg
+++ b/topology/icons/proxmox.svg
@@ -1,5 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?><!-- Uploaded to: SVG Repo, www.svgrepo.com, Generator: SVG Repo Mixer Tools -->
-<svg width="800px" height="800px" viewBox="0 0 1024 1024" xmlns="http://www.w3.org/2000/svg">
-   <circle cx="512" cy="512" r="512" style="fill:#e57000"/>
-   <path d="M512 497.8 342.7 311.6c6.6-6.6 14.2-11.7 22.9-15.5 8.7-3.8 18.1-5.7 28.1-5.7 10.7.1 20.4 2.2 29.3 6.3 8.9 4.1 16.6 9.8 23.1 17l65.8 71.9 65.4-71.9c6.8-7.2 14.7-12.9 23.6-17 9-4.1 18.7-6.2 29.2-6.3 10 .1 19.4 2 28.1 5.7 8.7 3.8 16.4 8.9 22.9 15.5L512 497.8m0 28.4L342.7 712.4c6.6 6.6 14.2 11.7 22.9 15.5 8.7 3.8 18.1 5.7 28.1 5.7 10.5-.1 20.2-2.2 29.2-6.3s16.9-9.8 23.6-17l65.4-71.9 65.8 71.9c6.5 7.2 14.2 12.9 23.1 17 8.9 4.1 18.6 6.2 29.3 6.3 10-.1 19.4-2 28.1-5.7 8.7-3.8 16.4-8.9 22.9-15.5L512 526.2M497.8 512 370.3 372.2c-7.4-7.9-16-14.1-25.9-18.7-9.8-4.5-20.5-6.8-31.9-6.9-11 .1-21.3 2.2-30.8 6.3-9.6 4.1-17.9 9.8-25.1 16.9L385.9 512 256.5 654.2c7.2 7.4 15.6 13.2 25.1 17.4 9.6 4.2 19.8 6.3 30.8 6.3 11.5-.1 22.2-2.4 32.1-6.9 9.9-4.5 18.5-10.8 25.7-18.7L497.8 512m28.4 0 127.5 140.3c7.2 7.9 15.8 14.1 25.7 18.7 9.9 4.5 20.6 6.8 32.1 6.9 11-.1 21.3-2.2 30.8-6.3 9.6-4.2 17.9-9.9 25.1-17.4L638.1 512l129.4-142.2c-7.2-7.2-15.6-12.8-25.1-16.9-9.6-4.1-19.8-6.2-30.8-6.3-11.4.1-22.1 2.4-31.9 6.9-9.8 4.5-18.5 10.8-25.9 18.7L526.2 512" style="fill:#fff"/>
-</svg>
--- a/topology/non-nixos-machines.nix
+++ b/topology/non-nixos-machines.nix
@@ -1,362 +0,0 @@
-{ config, pkgs, lib, values, ... }:
-let
-  inherit (config.lib.topology) mkDevice;
-in {
-  nodes.balduzius = mkDevice "balduzius" {
-    guestType = "proxmox";
-    parent = config.nodes.powerpuff-cluster.id;
-    deviceIcon = "${pkgs.super-tiny-icons}/share/icons/SuperTinyIcons/svg/debian.svg";
-
-    interfaceGroups = [ [ "ens18" ] ];
-    interfaces.ens18 = {
-      network = "pvv";
-      mac = "00:0c:29:de:05:0f";
-      addresses = [
-        "129.241.210.192"
-        "2001:700:300:1900::1:42"
-      ];
-      gateways = [
-        values.hosts.gateway
-        values.hosts.gateway6
-      ];
-    };
-
-    services = {
-      kdc = {
-        name = "Heimdal KDC";
-        info = "kdc.pvv.ntnu.no";
-        details.kdc.text = "0.0.0.0:88";
-        details.kpasswd.text = "0.0.0.0:464";
-      };
-    };
-  };
-
-  nodes.tom = mkDevice "tom" {
-    guestType = "proxmox";
-    parent = config.nodes.powerpuff-cluster.id;
-    deviceIcon = "${pkgs.super-tiny-icons}/share/icons/SuperTinyIcons/svg/debian.svg";
-
-    interfaceGroups = [ [ "ens18" ] ];
-    interfaces.ens18 = {
-      network = "pvv";
-      mac = "00:0c:29:4d:f7:56";
-      addresses = [
-        "129.241.210.180"
-        "2001:700:300:1900::180"
-      ];
-      gateways = [
-        values.hosts.gateway
-        values.hosts.gateway6
-      ];
-    };
-
-    services = {
-      apache2 = {
-        name = "Apache2 - user websites";
-        info = "www.pvv.ntnu.no/~";
-        details.listen.text = "0.0.0.0:443";
-      };
-    };
-  };
-
-  nodes.hildring = mkDevice "hildring" {
-    guestType = "proxmox";
-    parent = config.nodes.powerpuff-cluster.id;
-    deviceType = "loginbox";
-    deviceIcon = "${pkgs.super-tiny-icons}/share/icons/SuperTinyIcons/svg/debian.svg";
-
-    interfaceGroups = [ [ "eth0" ] ];
-    interfaces.eth0 = {
-      network = "pvv";
-      mac = "00:0c:29:e7:dd:79";
-      addresses = [
-        "129.241.210.176"
-        "2001:700:300:1900::1:9"
-      ];
-      gateways = [
-        values.hosts.gateway
-        values.hosts.gateway6
-      ];
-    };
-  };
-
-  nodes.drolsum = mkDevice "drolsum" {
-    guestType = "proxmox";
-    parent = config.nodes.powerpuff-cluster.id;
-    deviceType = "loginbox";
-    deviceIcon = "${pkgs.super-tiny-icons}/share/icons/SuperTinyIcons/svg/debian.svg";
-
-    # TODO: the interface name is likely wrong
-    interfaceGroups = [ [ "eth0" ] ];
-    interfaces.eth0 = {
-      network = "pvv";
-      # mac = "";
-      addresses = [
-        "129.241.210.217"
-        "2001:700:300:1900::217"
-        "2001:700:300:1900::1:217"
-      ];
-      gateways = [
-        values.hosts.gateway
-        values.hosts.gateway6
-      ];
-    };
-  };
-
-  nodes.microbel = mkDevice "microbel" {
-    deviceIcon = "${pkgs.super-tiny-icons}/share/icons/SuperTinyIcons/svg/debian.svg";
-
-    hardware.info = "Supermicro X8ST3";
-
-    interfaceGroups = [ [ "eth0" "eth1" ] ];
-    interfaces.eth0 = {
-      mac = "00:25:90:24:76:2c";
-      addresses = [
-        "129.241.210.179"
-        "2001:700:300:1900::1:2"
-      ];
-      gateways = [
-        values.hosts.gateway
-        values.hosts.gateway6
-      ];
-    };
-  };
-
-  nodes.innovation = mkDevice "innovation" {
-    deviceIcon = "${pkgs.super-tiny-icons}/share/icons/SuperTinyIcons/svg/freebsd.svg";
-
-    hardware.info = "Dell Optiplex 9010";
-
-    interfaceGroups = [ [ "em0" ] ];
-    interfaces.em0 = {
-      mac = "18:03:73:20:18:d3";
-      addresses = [
-        "129.241.210.214"
-        "2001:700:300:1900::1:56"
-      ];
-      gateways = [
-        values.hosts.gateway
-        values.hosts.gateway6
-      ];
-    };
-    services = {
-      minecraft = {
-        name = "Minecraft";
-        icon = "services.minecraft";
-        info = "minecraft.pvv.ntnu.no";
-        details.listen.text = "0.0.0.0:25565";
-      };
-    };
-  };
-
-  nodes.principal = mkDevice "principal" {
-    deviceIcon = "${pkgs.super-tiny-icons}/share/icons/SuperTinyIcons/svg/freebsd.svg";
-
-    # TODO: the interface name is likely wrong
-    interfaceGroups = [ [ "em0" ] ];
-    interfaces.em0 = {
-      # mac = "";
-      addresses = [
-        "129.241.210.233"
-        "2001:700:300:1900::1:233"
-      ];
-      gateways = [
-        values.hosts.gateway
-        values.hosts.gateway6
-      ];
-    };
-  };
-
-  nodes.homeassistant = mkDevice "homeassistant" {
-    deviceIcon = "services.home-assistant";
-
-    hardware.info = "Raspberry Pi 4B";
-
-    # TODO: the interface name is likely wrong
-    interfaceGroups = [ [ "eth0" ] ];
-    interfaces.eth0 = {
-      # mac = "";
-      addresses = [
-        "129.241.210.229"
-        "2001:700:300:1900::4:229"
-      ];
-      gateways = [
-        values.hosts.gateway
-        values.hosts.gateway6
-      ];
-    };
-  };
-
-  nodes.sleipner = mkDevice "sleipner" {
-    deviceIcon = "${pkgs.super-tiny-icons}/share/icons/SuperTinyIcons/svg/debian.svg";
-
-    interfaceGroups = [ [ "eno0" "enp2s0" ] ];
-    interfaces.enp2s0 = {
-      mac = "00:25:90:57:35:8e";
-      addresses = [
-        "129.241.210.193"
-        "2001:700:300:1900:fab:cab:dab:7ab"
-      ];
-      gateways = [
-        values.hosts.gateway
-        values.hosts.gateway6
-      ];
-    };
-  };
-
-  nodes.isvegg = mkDevice "isvegg" {
-    deviceIcon = "${pkgs.super-tiny-icons}/share/icons/SuperTinyIcons/svg/debian.svg";
-
-    # TODO: the interface name is likely wrong
-    interfaceGroups = [ [ "eth0" ] ];
-    interfaces.eth0 = {
-      # mac = "";
-      addresses = [
-        "129.241.210.175"
-        "2001:700:300:1900::1:a"
-      ];
-      gateways = [
-        values.hosts.gateway
-        values.hosts.gateway6
-      ];
-    };
-  };
-
-  nodes.ameno = mkDevice "ameno" {
-    deviceIcon = "${pkgs.super-tiny-icons}/share/icons/SuperTinyIcons/svg/ubuntu.svg";
-
-    interfaceGroups = [ [ "eth0" ] ];
-    interfaces.eth0 = {
-      mac = "b8:27:eb:62:1d:d8";
-      addresses = [
-        "129.241.210.230"
-        "129.241.210.211"
-        "129.241.210.153"
-        "2001:700:300:1900:ba27:ebff:fe62:1dd8"
-        "2001:700:300:1900::4:230"
-      ];
-      gateways = [
-        values.hosts.gateway
-        values.hosts.gateway6
-      ];
-    };
-    services = {
-      bind = {
-        name = "Bind DNS";
-        icon = ./icons/bind9.png;
-        info = "hostmaster.pvv.ntnu.no";
-        details.listen.text = "0.0.0.0:53";
-      };
-    };
-  };
-
-  nodes.skrott = mkDevice "skrott" {
-    # TODO: the interface name is likely wrong
-    interfaceGroups = [ [ "eth0" ] ];
-    interfaces.eth0 = {
-      # mac = "";
-      addresses = [
-        "129.241.210.235"
-      ];
-      gateways = [
-        values.hosts.gateway
-        values.hosts.gateway6
-      ];
-    };
-  };
-
-  nodes.torskas = mkDevice "torskas" {
-    deviceIcon = "${pkgs.super-tiny-icons}/share/icons/SuperTinyIcons/svg/arch_linux.svg";
-
-    hardware.info = "Raspberry pi 4B";
-
-    # TODO: the interface name is likely wrong
-    interfaceGroups = [ [ "eth0" ] ];
-    interfaces.eth0 = {
-      # mac = "";
-      addresses = [
-        "129.241.210.241"
-        "2001:700:300:1900::241"
-      ];
-      gateways = [
-        values.hosts.gateway
-        values.hosts.gateway6
-      ];
-    };
-  };
-
-  nodes.wegonke = mkDevice "wegonke" {
-    deviceType = "terminal";
-    deviceIcon = "${pkgs.super-tiny-icons}/share/icons/SuperTinyIcons/svg/debian.svg";
-
-    hardware.info = "ASUSTeK G11CD-K";
-
-    interfaceGroups = [ [ "enp4s0" ] ];
-    interfaces.enp4s0 = {
-      mac = "70:4d:7b:a3:32:57";
-      addresses = [
-        "129.241.210.218"
-        "2001:700:300:1900::1:218"
-      ];
-      gateways = [
-        values.hosts.gateway
-        values.hosts.gateway6
-      ];
-    };
-  };
-
-  nodes.demiurgen = mkDevice "demiurgen" {
-    deviceType = "terminal";
-    deviceIcon = "${pkgs.super-tiny-icons}/share/icons/SuperTinyIcons/svg/debian.svg";
-
-    interfaceGroups = [ [ "eno1" ] ];
-    interfaces.eno1 = {
-      mac = "18:03:73:1f:f4:1f";
-      addresses = [
-        "129.241.210.201"
-        "2001:700:300:1900::1:4e"
-      ];
-      gateways = [
-        values.hosts.gateway
-        values.hosts.gateway6
-      ];
-    };
-  };
-
-  nodes.sanctuary = mkDevice "sanctuary" {
-    deviceType = "terminal";
-    deviceIcon = "${pkgs.super-tiny-icons}/share/icons/SuperTinyIcons/svg/windows.svg";
-
-    interfaceGroups = [ [ "ethernet_0" ] ];
-    interfaces.ethernet_0 = {
-      addresses = [
-        "129.241.210.170"
-        "2001:700:300:1900::1337"
-      ];
-      gateways = [
-        values.hosts.gateway
-        values.hosts.gateway6
-      ];
-    };
-  };
-
-  nodes.orchid = mkDevice "orchid" {
-    deviceType = "terminal";
-    deviceIcon = "${pkgs.super-tiny-icons}/share/icons/SuperTinyIcons/svg/debian.svg";
-
-    hardware.info = "Ryzen1600 Nvidia GTX 1060";
-
-    # TODO: the interface name is likely wrong
-    interfaceGroups = [ [ "eth0" ] ];
-    interfaces.eth0 = {
-      addresses = [
-        "129.241.210.210"
-        "2001:700:300:1900::210"
-      ];
-      gateways = [
-        values.hosts.gateway
-        values.hosts.gateway6
-      ];
-    };
-  };
-}
--- a/topology/service-extractors/greg-ng.nix
+++ b/topology/service-extractors/greg-ng.nix
@@ -1,11 +0,0 @@
-{ config, lib, ... }:
-let
-  cfg = config.services.greg-ng or { enable = false; };
-in
-{
-  config.topology.self.services.greg-ng = lib.mkIf cfg.enable {
-    name = "Greg-ng";
-    icon = ../icons/greg-ng.png;
-    details.listen = { text = "${cfg.settings.host}:${toString cfg.settings.port}"; };
-  };
-}
--- a/values.nix
+++ b/values.nix
@@ -1,13 +1,8 @@
 # Feel free to change the structure of this file
 let
-  ntnu-ipv4 = suffix: "129.241.${toString suffix}";
-  ntnu-ipv6 = suffix: "2001:700:300:${toString suffix}";
-  pvv-ipv4 = suffix: ntnu-ipv4 "210.${toString suffix}";
-  pvv-ipv6 = suffix: ntnu-ipv6 "1900::${toString suffix}";
+  pvv-ipv4 = suffix: "129.241.210.${toString suffix}";
+  pvv-ipv6 = suffix: "2001:700:300:1900::${toString suffix}";
 in rec {
-  ntnu.ipv4-space = ntnu-ipv4 "0.0/16"; # https://ipinfo.io/ips/129.241.0.0/16
-  ntnu.ipv6-space = ntnu-ipv6 ":/48"; # https://ipinfo.io/2001:700:300::
-
  ipv4-space = pvv-ipv4 "128/25";
  ipv6-space = pvv-ipv6 "/64";

@@ -32,10 +27,6 @@ in rec {
    gateway = pvv-ipv4 129;
    gateway6 = pvv-ipv6 1;

-    bakke = {
-      ipv4 = pvv-ipv4 173;
-      ipv6 = pvv-ipv6 173;
-    };
    bekkalokk = {
      ipv4 = pvv-ipv4 168;
      ipv6 = pvv-ipv6 168;
Author	SHA1	Message	Date
Øystein Tveit	f580a3ddce	WIP All checks were successful Eval nix flake / evals (push) Successful in 6m8s Details	2025-12-16 17:49:23 +01:00
h7x4	91f02c7b75	flake.lock: bump minecraft-kartverket Some checks failed Eval nix flake / evals (push) Has been cancelled Details	2025-12-17 01:48:32 +09:00