WIP: grevling/tuba: init

2023-11-04 21:28:47 +01:00
89 changed files with 986 additions and 6106 deletions
--- a/.sops.yaml
+++ b/.sops.yaml
@@ -3,11 +3,10 @@ keys:
  - &user_danio age17tagmpwqjk3mdy45rfesrfey6h863x8wfq38wh33tkrlrywxducs0k6tpq
  - &user_felixalb age1mrnldl334l2nszuta6ywvewng0fswv2dz9l5g4qcwe3nj4yxf92qjskdx6
  - &user_oysteikt F7D37890228A907440E1FD4846B9228E814A2AAC
-  - &user_eirikwit age1ju7rd26llahz3g8tz7cy5ld52swj8gsmg0flrmrxngc0nj0avq3ssh0sn5

  # Hosts
  - &host_jokum age1gp8ye4g2mmw3may5xg0zsy7mm04glfz3788mmdx9cvcsdxs9hg0s0cc9kt
-  - &host_ildkule age1x28hmzvuv6f2n66c0jtqcca3h9rput8d7j5uek6jcpx8n9egd52sqpejq0
+  - &host_ildkule age1hn45n46ypyrvypv0mwfnpt9ddrlmw34dwlpf33n8v67jexr3lucq6ahc9x
  - &host_bekkalokk age12nj59tguy9wg882updc2vjdusx5srnxmjyfaqve4zx6jnnsaw3qsyjq6zd
  - &host_bicep age1sl43gc9cw939z5tgha2lpwf0xxxgcnlw7w4xem4sqgmt2pt264vq0dmwx2

@@ -19,7 +18,6 @@ creation_rules:
      - *host_jokum
      - *user_danio
      - *user_felixalb
-      - *user_eirikwit
      pgp:
      - *user_oysteikt

--- a/README.MD
+++ b/README.MD
@@ -26,7 +26,7 @@ Det er sikkert lurt å lage en PR først om du ikke er vandt til nix enda.
 Innen 24h skal alle systemene hente ned den nye konfigurasjonen og deploye den.

 Du kan tvinge en maskin til å oppdatere seg før dette ved å kjøre:
-`nixos-rebuild switch --update-input nixpkgs --update-input nixpkgs-unstable --no-write-lock-file --refresh --flake git+https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git --upgrade`
+`nixos-rebuild switch --update-input nixpkgs --update-input unstable --no-write-lock-file --refresh --flake git+https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git --upgrade`

 som root på maskinen.

--- a/base.nix
+++ b/base.nix
@@ -3,7 +3,6 @@
 {
  imports = [
    ./users
-    ./modules/snakeoil-certs.nix
  ];

  networking.domain = "pvv.ntnu.no";
@@ -33,7 +32,7 @@
    flake = "git+https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git";
    flags = [
      "--update-input" "nixpkgs"
-      "--update-input" "nixpkgs-unstable"
+      "--update-input" "unstable"
      "--no-write-lock-file"
    ];
  };
@@ -59,7 +58,6 @@
    gnupg
    htop
    nano
-    ripgrep
    rsync
    screen
    tmux
@@ -73,9 +71,6 @@

  users.groups."drift".name = "drift";

-  # Trusted users on the nix builder machines
-  users.groups."nix-builder-users".name = "nix-builder-users";
-
  services.openssh = {
    enable = true;
    extraConfig = ''
@@ -84,50 +79,5 @@
    settings.PermitRootLogin = "yes";
  };

-  # nginx return 444 for all nonexistent virtualhosts

-  systemd.services.nginx.after = [ "generate-snakeoil-certs.service" ];
-
-  environment.snakeoil-certs = lib.mkIf config.services.nginx.enable {
-    "/etc/certs/nginx" = {
-      owner = "nginx";
-      group = "nginx";
-    };
-  };
-
-  services.nginx = {
-    recommendedTlsSettings = true;
-    recommendedProxySettings = true;
-    recommendedOptimisation = true;
-    recommendedGzipSettings = true;
-
-    appendConfig = ''
-      pcre_jit on;
-      worker_processes auto;
-      worker_rlimit_nofile 100000;
-    '';
-    eventsConfig = ''
-      worker_connections 2048;
-      use epoll;
-      multi_accept on;
-    '';
-  };
-
-  systemd.services.nginx.serviceConfig = lib.mkIf config.services.nginx.enable {
-    LimitNOFILE = 65536;
-  };
-
-  services.nginx.virtualHosts."_" = lib.mkIf config.services.nginx.enable {
-    sslCertificate = "/etc/certs/nginx.crt";
-    sslCertificateKey = "/etc/certs/nginx.key";
-    addSSL = true;
-    extraConfig = "return 444;";
-  };
-
-  networking.firewall.allowedTCPPorts = lib.mkIf config.services.nginx.enable [ 80 443 ];
-
-  security.acme = {
-    acceptTerms = true;
-    defaults.email = "drift@pvv.ntnu.no";
-  };
 }
--- a/flake.lock
+++ b/flake.lock
@@ -1,37 +1,17 @@
 {
  "nodes": {
-    "disko": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1712798444,
-        "narHash": "sha256-aAksVB7zMfBQTz0q2Lw3o78HM3Bg2FRziX2D6qnh+sk=",
-        "owner": "nix-community",
-        "repo": "disko",
-        "rev": "a297cb1cb0337ee10a7a0f9517954501d8f6f74d",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "disko",
-        "type": "github"
-      }
-    },
    "grzegorz": {
      "inputs": {
        "nixpkgs": [
-          "nixpkgs-unstable"
+          "unstable"
        ]
      },
      "locked": {
-        "lastModified": 1712875951,
-        "narHash": "sha256-4kcRd2Q2XM4r+U2zp+LADjrzazKpWvs0WrMKPktEEkc=",
+        "lastModified": 1696346665,
+        "narHash": "sha256-J6Tf6a/zhFZ8SereluHLrvgPsIVm2CGHHA8wrbhZB3Y=",
        "owner": "Programvareverkstedet",
        "repo": "grzegorz",
-        "rev": "9eaba26b1671e8810cb135997c867ac3550e685a",
+        "rev": "9b9c3ac7d408ac7c6d67544b201e6b169afacb03",
        "type": "github"
      },
      "original": {
@@ -47,11 +27,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1711853301,
-        "narHash": "sha256-KxRNyW/fgq690bt3B+Nz4EKLoubybcuASYyMa41bAPE=",
+        "lastModified": 1693864994,
+        "narHash": "sha256-oLDiWdCKDtEfeGzfAuDTq+n9VWp6JCo67PEESEZ3y8E=",
        "owner": "Programvareverkstedet",
        "repo": "grzegorz-clients",
-        "rev": "c38f2f22a6d47ae2da015351a45d13cbc1eb48e4",
+        "rev": "a38a0b0fb31ad0ad78a91458cb2c7f77f686468f",
        "type": "github"
      },
      "original": {
@@ -62,16 +42,14 @@
    },
    "matrix-next": {
      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
+        "nixpkgs-lib": "nixpkgs-lib"
      },
      "locked": {
-        "lastModified": 1710311999,
-        "narHash": "sha256-s0pT1NyrMgeolUojXXcnXQDymN7m80GTF7itCv0ZH20=",
+        "lastModified": 1697420972,
+        "narHash": "sha256-eFDasOzXAN8VswUntNBBwvKFyVKFvmwRNNVTDfGdB3M=",
        "owner": "dali99",
        "repo": "nixos-matrix-modules",
-        "rev": "6c9b67974b839740e2a738958512c7a704481157",
+        "rev": "1e370b96223b94d52006249a60033caaea605c65",
        "type": "github"
      },
      "original": {
@@ -80,72 +58,53 @@
        "type": "github"
      }
    },
-    "nix-gitea-themes": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1712621190,
-        "narHash": "sha256-O8xtza+wPplTmSm0EAPk8Ud9sJ6huVNY6jU21FYHCp4=",
-        "ref": "refs/heads/main",
-        "rev": "812c1fc4061d534a8c7d35271ce32b6c76a9f385",
-        "revCount": 5,
-        "type": "git",
-        "url": "https://git.pvv.ntnu.no/oysteikt/nix-gitea-themes.git"
-      },
-      "original": {
-        "type": "git",
-        "url": "https://git.pvv.ntnu.no/oysteikt/nix-gitea-themes.git"
-      }
-    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1712848736,
-        "narHash": "sha256-CzZwhqyLlebljv1zFS2KWVH/3byHND0LfaO1jKsGuVo=",
+        "lastModified": 1697706247,
+        "narHash": "sha256-nWLggeUxn/l8JrcQr9f+RfnCXp8cn0BN568PjMJh9ko=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "1d6a23f11e44d0fb64b3237569b87658a9eb5643",
+        "rev": "4ee5b576ac2861a818950aea99f609d7a6fc02a3",
        "type": "github"
      },
      "original": {
-        "id": "nixpkgs",
-        "ref": "nixos-23.11-small",
-        "type": "indirect"
+        "owner": "NixOS",
+        "ref": "nixos-23.05-small",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs-lib": {
+      "locked": {
+        "lastModified": 1673743903,
+        "narHash": "sha256-sloY6KYyVOozJ1CkbgJPpZ99TKIjIvM+04V48C04sMQ=",
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "rev": "7555e2dfcbac1533f047021f1744ac8871150f9f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "type": "github"
      }
    },
    "nixpkgs-stable": {
      "locked": {
-        "lastModified": 1712437997,
-        "narHash": "sha256-g0whLLwRvgO2FsyhY8fNk+TWenS3jg5UdlWL4uqgFeo=",
+        "lastModified": 1697332183,
+        "narHash": "sha256-ACYvYsgLETfEI2xM1jjp8ZLVNGGC0onoCGe+69VJGGE=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "e38d7cb66ea4f7a0eb6681920615dfcc30fc2920",
+        "rev": "0e1cff585c1a85aeab059d3109f66134a8f76935",
        "type": "github"
      },
      "original": {
        "owner": "NixOS",
-        "ref": "release-23.11",
+        "ref": "release-23.05",
        "repo": "nixpkgs",
        "type": "github"
      }
    },
-    "nixpkgs-unstable": {
-      "locked": {
-        "lastModified": 1712837137,
-        "narHash": "sha256-9joaU/GD35J9Utb0ipelQbOcvsw5eoYTmSarLV3MbNk=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "681d4a87b26b1dcaae7ffe6cf88c9912c575415f",
-        "type": "github"
-      },
-      "original": {
-        "id": "nixpkgs",
-        "ref": "nixos-unstable-small",
-        "type": "indirect"
-      }
-    },
    "pvv-calendar-bot": {
      "inputs": {
        "nixpkgs": [
@@ -166,38 +125,15 @@
        "url": "https://git.pvv.ntnu.no/Projects/calendar-bot.git"
      }
    },
-    "pvv-nettsiden": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1712834399,
-        "narHash": "sha256-deNJvqboPk3bEoRZ/FyZnxscsf2BpS3/52JM4qXCNSA=",
-        "ref": "refs/heads/master",
-        "rev": "216e153f89f1dbdc4c98a7c1db2a40e52becc901",
-        "revCount": 451,
-        "type": "git",
-        "url": "https://git.pvv.ntnu.no/Projects/nettsiden.git"
-      },
-      "original": {
-        "type": "git",
-        "url": "https://git.pvv.ntnu.no/Projects/nettsiden.git"
-      }
-    },
    "root": {
      "inputs": {
-        "disko": "disko",
        "grzegorz": "grzegorz",
        "grzegorz-clients": "grzegorz-clients",
        "matrix-next": "matrix-next",
-        "nix-gitea-themes": "nix-gitea-themes",
        "nixpkgs": "nixpkgs",
-        "nixpkgs-unstable": "nixpkgs-unstable",
        "pvv-calendar-bot": "pvv-calendar-bot",
-        "pvv-nettsiden": "pvv-nettsiden",
-        "sops-nix": "sops-nix"
+        "sops-nix": "sops-nix",
+        "unstable": "unstable"
      }
    },
    "sops-nix": {
@@ -208,11 +144,11 @@
        "nixpkgs-stable": "nixpkgs-stable"
      },
      "locked": {
-        "lastModified": 1712617241,
-        "narHash": "sha256-a4hbls4vlLRMciv62YrYT/Xs/3Cubce8WFHPUDWwzf8=",
+        "lastModified": 1697339241,
+        "narHash": "sha256-ITsFtEtRbCBeEH9XrES1dxZBkE1fyNNUfIyQjQ2AYQs=",
        "owner": "Mic92",
        "repo": "sops-nix",
-        "rev": "538c114cfdf1f0458f507087b1dcf018ce1c0c4c",
+        "rev": "51186b8012068c417dac7c31fb12861726577898",
        "type": "github"
      },
      "original": {
@@ -220,6 +156,22 @@
        "repo": "sops-nix",
        "type": "github"
      }
+    },
+    "unstable": {
+      "locked": {
+        "lastModified": 1697713104,
+        "narHash": "sha256-DN7YOyKMCpAVeZ44N42LrujtTkoerkS9+kTufQiuntY=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "6be2c349a30fcb489a3153dd331e9df387ab6449",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable-small",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
    }
  },
  "root": "root",
--- a/flake.nix
+++ b/flake.nix
@@ -2,34 +2,24 @@
  description = "PVV System flake";

  inputs = {
-    nixpkgs.url = "nixpkgs/nixos-23.11-small";
-    nixpkgs-unstable.url = "nixpkgs/nixos-unstable-small";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-23.05-small";
+    unstable.url = "github:NixOS/nixpkgs/nixos-unstable-small";

    sops-nix.url = "github:Mic92/sops-nix";
    sops-nix.inputs.nixpkgs.follows = "nixpkgs";

-    disko.url = "github:nix-community/disko";
-    disko.inputs.nixpkgs.follows = "nixpkgs";
-
-    pvv-nettsiden.url = "git+https://git.pvv.ntnu.no/Projects/nettsiden.git";
-    pvv-nettsiden.inputs.nixpkgs.follows = "nixpkgs";
-
    pvv-calendar-bot.url = "git+https://git.pvv.ntnu.no/Projects/calendar-bot.git";
    pvv-calendar-bot.inputs.nixpkgs.follows = "nixpkgs";

    matrix-next.url = "github:dali99/nixos-matrix-modules";
-    matrix-next.inputs.nixpkgs.follows = "nixpkgs";
-
-    nix-gitea-themes.url = "git+https://git.pvv.ntnu.no/oysteikt/nix-gitea-themes.git";
-    nix-gitea-themes.inputs.nixpkgs.follows = "nixpkgs";

    grzegorz.url = "github:Programvareverkstedet/grzegorz";
-    grzegorz.inputs.nixpkgs.follows = "nixpkgs-unstable";
+    grzegorz.inputs.nixpkgs.follows = "unstable";
    grzegorz-clients.url = "github:Programvareverkstedet/grzegorz-clients";
    grzegorz-clients.inputs.nixpkgs.follows = "nixpkgs";
  };

-  outputs = { self, nixpkgs, nixpkgs-unstable, pvv-nettsiden, sops-nix, disko, ... }@inputs:
+  outputs = { self, nixpkgs, matrix-next, pvv-calendar-bot, unstable, sops-nix, ... }@inputs:
  let
    nixlib = nixpkgs.lib;
    systems = [
@@ -48,82 +38,81 @@
    ];
  in {
    nixosConfigurations = let
-      unstablePkgs = nixpkgs-unstable.legacyPackages.x86_64-linux;
      nixosConfig = nixpkgs: name: config: nixpkgs.lib.nixosSystem (nixpkgs.lib.recursiveUpdate
        rec {
          system = "x86_64-linux";
          specialArgs = {
-            inherit nixpkgs-unstable inputs;
+            inherit unstable inputs;
            values = import ./values.nix;
          };

          modules = [
            ./hosts/${name}/configuration.nix
            sops-nix.nixosModules.sops
-          ] ++ config.modules or [];
+          ];

          pkgs = import nixpkgs {
            inherit system;
            overlays = [
-              (import ./overlays/nginx-test.nix
-                (builtins.attrNames self.nixosConfigurations.${name}.config.security.acme.certs)
-              )
-            ] ++ config.overlays or [ ];
+              (final: prev: {
+                mx-puppet-discord = prev.mx-puppet-discord.override { nodejs_14 = final.nodejs_18; };
+              })
+              pvv-calendar-bot.overlays.${system}.default
+            ];
          };
        }
-        (removeAttrs config [ "modules" "overlays" ])
+        config
      );

      stableNixosConfig = nixosConfig nixpkgs;
-      unstableNixosConfig = nixosConfig nixpkgs-unstable;
+      unstableNixosConfig = nixosConfig unstable;
    in {
      bicep = stableNixosConfig "bicep" {
        modules = [
-          inputs.matrix-next.nixosModules.default
-          inputs.pvv-calendar-bot.nixosModules.default
-        ];
-        overlays = [
-          inputs.pvv-calendar-bot.overlays.x86_64-linux.default
-        ];
-      };
-      bekkalokk = stableNixosConfig "bekkalokk" {
-        overlays = [
-          (final: prev: {
-            heimdal = unstablePkgs.heimdal;
-            mediawiki-extensions = final.callPackage ./packages/mediawiki-extensions { };
-            simplesamlphp = final.callPackage ./packages/simplesamlphp { };
-          })
-          inputs.nix-gitea-themes.overlays.default
-          inputs.pvv-nettsiden.overlays.default
-        ];
-        modules = [
-          inputs.nix-gitea-themes.nixosModules.default
-          inputs.pvv-nettsiden.nixosModules.default
-        ];
-      };
-      bob = stableNixosConfig "bob" {
-        modules = [
-          disko.nixosModules.disko
-          { disko.devices.disk.disk1.device = "/dev/vda"; }
+          ./hosts/bicep/configuration.nix
+          sops-nix.nixosModules.sops
+
+          matrix-next.nixosModules.default
+          pvv-calendar-bot.nixosModules.default
        ];
      };
+      bekkalokk = stableNixosConfig "bekkalokk" { };
      ildkule = stableNixosConfig "ildkule" { };
      #ildkule-unstable = unstableNixosConfig "ildkule" { };
      shark = stableNixosConfig "shark" { };

      brzeczyszczykiewicz = stableNixosConfig "brzeczyszczykiewicz" {
        modules = [
+          ./hosts/brzeczyszczykiewicz/configuration.nix
+          sops-nix.nixosModules.sops
+
          inputs.grzegorz.nixosModules.grzegorz-kiosk
          inputs.grzegorz-clients.nixosModules.grzegorz-webui
        ];
      };
      georg = stableNixosConfig "georg" {
        modules = [
+          ./hosts/georg/configuration.nix
+          sops-nix.nixosModules.sops
+
          inputs.grzegorz.nixosModules.grzegorz-kiosk
          inputs.grzegorz-clients.nixosModules.grzegorz-webui
        ];
      };
-      buskerud = stableNixosConfig "buskerud" { };
+
+      grevling = stableNixosConfig "grevling" {
+        modules = [
+          ./hosts/grevling/configuration.nix
+          sops-nix.nixosModules.sops
+        ];
+      };
+
+      tuba = stableNixosConfig "grevling" {
+        modules = [
+          ./hosts/tuba/configuration.nix
+          sops-nix.nixosModules.sops
+        ];
+      };
    };

    devShells = forAllSystems (system: {
@@ -139,10 +128,6 @@
          (nixlib.getAttrs importantMachines self.packages.x86_64-linux);
        all-machines = pkgs.linkFarm "all-machines"
          (nixlib.getAttrs allMachines self.packages.x86_64-linux);
-
-        simplesamlphp = pkgs.callPackage ./packages/simplesamlphp { };
-
-        # mediawiki-extensions = pkgs.callPackage ./packages/mediawiki-extensions { };
      } // nixlib.genAttrs allMachines
        (machine: self.nixosConfigurations.${machine}.config.system.build.toplevel);
    };
--- a/hosts/bekkalokk/configuration.nix
+++ b/hosts/bekkalokk/configuration.nix
@@ -5,14 +5,15 @@

    ../../base.nix
    ../../misc/metrics-exporters.nix
+    ../../modules/wackattack-ctf-stockfish

-    ./services/website
+    #./services/keycloak.nix
+
+    # TODO: set up authentication for the following:
+    # ./services/website.nix
    ./services/nginx.nix
    ./services/gitea/default.nix
-    ./services/kerberos
-    ./services/webmail
-    ./services/mediawiki
-    ./services/idp-simplesamlphp
+    # ./services/mediawiki.nix
  ];

  sops.defaultSopsFile = ../../secrets/bekkalokk/bekkalokk.yaml;
@@ -23,6 +24,8 @@
  boot.loader.systemd-boot.enable = true;
  boot.loader.efi.canTouchEfiVariables = true;

+  virtualisation.podman.enable = true;
+
  networking.hostName = "bekkalokk";

  systemd.network.networks."30-enp2s0" = values.defaultNetworkConfig // {
--- a/hosts/bekkalokk/services/gitea/ci.nix
+++ b/hosts/bekkalokk/services/gitea/ci.nix
@@ -27,8 +27,4 @@ lib.mkMerge [
  (mkRunner "alpha")
  (mkRunner "beta")
  (mkRunner "epsilon")
-  {
-    virtualisation.podman.enable = true;
-    networking.firewall.interfaces."podman+".allowedUDPPorts = [ 53 5353 ];
-  }
 ]
--- a/hosts/bekkalokk/services/gitea/default.nix
+++ b/hosts/bekkalokk/services/gitea/default.nix
@@ -52,16 +52,14 @@ in {
    };
  };

-  services.gitea-themes.monokai = pkgs.gitea-theme-monokai;
-
  environment.systemPackages = [ cfg.package ];

  services.nginx.virtualHosts."${domain}" = {
    forceSSL = true;
    enableACME = true;
-    kTLS = true;
    locations."/" = {
      proxyPass = "http://unix:${cfg.settings.server.HTTP_ADDR}";
+      recommendedProxySettings = true;
      extraConfig = ''
        client_max_body_size 512M;
      '';
--- a/hosts/bekkalokk/services/gitea/gitea-import-users.py
+++ b/hosts/bekkalokk/services/gitea/gitea-import-users.py
@@ -32,6 +32,7 @@ def add_user(username, name):
            "full_name": name,
            "username": username,
            "login_name": username,
+            "visibility": "public",
            "source_id": 1,  # 1 = SMTP
    }

@@ -51,7 +52,6 @@ def add_user(username, name):
        existing_users[username] = user

    else:
-        user["visibility"] = existing_users[username]["visibility"]
        r = requests.patch(GITEA_API_URL + f'/admin/users/{username}',
                           json=user,
                           headers={'Authorization': 'token ' + API_TOKEN})
--- a/hosts/bekkalokk/services/idp-simplesamlphp/authpwauth.php
+++ b/hosts/bekkalokk/services/idp-simplesamlphp/authpwauth.php
@@ -1,135 +0,0 @@
-<?php
-
-/**
- * Authenticate using HTTP login.
- *
- * @author Yorn de Jong
- * @author Oystein Kristoffer Tveit
- * @package simpleSAMLphp
- */
-
-namespace SimpleSAML\Module\authpwauth\Auth\Source;
-
-class PwAuth extends \SimpleSAML\Module\core\Auth\UserPassBase
-{
-    protected $pwauth_bin_path;
-    protected $mail_domain;
-
-    public function __construct(array $info, array &$config) {
-            assert('is_array($info)');
-            assert('is_array($config)');
-
-            /* Call the parent constructor first, as required by the interface. */
-            parent::__construct($info, $config);
-
-            $this->pwauth_bin_path = $config['pwauth_bin_path'];
-            if (array_key_exists('mail_domain', $config)) {
-                    $this->mail_domain = '@' . ltrim($config['mail_domain'], '@');
-            }
-    }
-
-    public function login(string $username, string $password): array {
-            $username = strtolower( $username );
-
-	    if (!file_exists($this->pwauth_bin_path)) {
-                    die("Could not find pwauth binary");
-                    return false;
-	    }
-
-	    if (!is_executable($this->pwauth_bin_path)) {
-                    die("pwauth binary is not executable");
-                    return false;
-	    }
-
-            $handle = popen($this->pwauth_bin_path, 'w');
-            if ($handle === FALSE) {
-                    die("Error opening pipe to pwauth");
-                    return false;
-            }
-
-            $data = "$username\n$password\n";
-            if (fwrite($handle, $data) !== strlen($data)) {
-                    die("Error writing to pwauth pipe");
-                    return false;
-            }
-
-            # Is the password valid?
-            $result = pclose( $handle );
-            if ($result !== 0) {
-                    if (!in_array($result, [1, 2, 3, 4, 5, 6, 7], true)) {
-                            die("pwauth returned $result for username $username");
-                    }
-                    throw new \SimpleSAML\Error\Error('WRONGUSERPASS');
-            }
-            /*
-            $ldap = ldap_connect('129.241.210.159', 389);
-            ldap_set_option($ldap, LDAP_OPT_PROTOCOL_VERSION, 3);
-            ldap_start_tls($ldap);
-            ldap_bind($ldap, 'passordendrer@pvv.ntnu.no', 'Oi7aekoh');
-            $search = ldap_search($ldap, 'DC=pvv,DC=ntnu,DC=no', '(sAMAccountName='.ldap_escape($username, '', LDAP_ESCAPE_FILTER).')');
-            $entry = ldap_first_entry($ldap, $search);
-            $dn = ldap_get_dn($ldap, $entry);
-            $newpassword = mb_convert_encoding("\"$password\"", 'UTF-16LE', 'UTF-8');
-            ldap_modify_batch($ldap, $dn, [
-                    #[
-                    #       'modtype' => LDAP_MODIFY_BATCH_REMOVE,
-                    #       'attrib' => 'unicodePwd',
-                    #       'values' => [$password],
-                    #],
-                    [
-                            #'modtype' => LDAP_MODIFY_BATCH_ADD,
-                            'modtype' => LDAP_MODIFY_BATCH_REPLACE,
-                            'attrib' => 'unicodePwd',
-                            'values' => [$newpassword],
-                    ],
-            ]);
-            */
-
-            #0  -  Login OK.
-            #1  -  Nonexistant login or (for some configurations) incorrect password.
-            #2  -  Incorrect password (for some configurations).
-            #3  -  Uid number is below MIN_UNIX_UID value configured in config.h.
-            #4  -  Login ID has expired.
-            #5  -  Login's password has expired.
-            #6  -  Logins to system have been turned off (usually by /etc/nologin file).
-            #7  -  Limit on number of bad logins exceeded.
-            #50 -  pwauth was not run with real uid SERVER_UID.  If you get this
-            #      this error code, you probably have SERVER_UID set incorrectly
-            #      in pwauth's config.h file.
-            #51 -  pwauth was not given a login & password to check.  The means
-            #      the passing of data from mod_auth_external to pwauth is messed
-            #      up.  Most likely one is trying to pass data via environment
-            #      variables, while the other is trying to pass data via a pipe.
-            #52 -  one of several possible internal errors occured.
-
-
-            $uid = $username;
-	    # TODO: Reinstate this code once passwd is working...
-	    /*
-            $cn = trim(shell_exec('getent passwd '.escapeshellarg($uid).' | cut -d: -f5 | cut -d, -f1'));
-
-            $groups = preg_split('_\\s_', shell_exec('groups '.escapeshellarg($uid)));
-            array_shift($groups);
-            array_shift($groups);
-            array_pop($groups);
-	    
-            $info = posix_getpwnam($uid);
-            $group = $info['gid'];
-            if (!in_array($group, $groups)) {
-                    $groups[] = $group;
-            }
-	    */
-	    $cn = "Unknown McUnknown";
-	    $groups = array();
-
-            $result = array(
-                    'uid' => array($uid),
-                    'cn' => array($cn),
-                    'group' => $groups,
-            );
-            if (isset($this->mail_domain)) {
-                    $result['mail'] = array($uid.$this->mail_domain);
-            }
-            return $result;
-    }
-}
--- a/hosts/bekkalokk/services/idp-simplesamlphp/config.php
+++ b/hosts/bekkalokk/services/idp-simplesamlphp/config.php
--- a/hosts/bekkalokk/services/idp-simplesamlphp/default.nix
+++ b/hosts/bekkalokk/services/idp-simplesamlphp/default.nix
@@ -1,208 +0,0 @@
-{ config, pkgs, lib, ... }:
-let
-  pwAuthScript = pkgs.writeShellApplication {
-    name = "pwauth";
-    runtimeInputs = with pkgs; [ coreutils heimdal ];
-    text = ''
-      read -r user1
-      user2="$(echo -n "$user1" | tr -c -d '0123456789abcdefghijklmnopqrstuvwxyz')"
-      if test "$user1" != "$user2"
-      then
-        read -r _
-        exit 2
-      fi
-      kinit --password-file=STDIN "''${user1}@PVV.NTNU.NO" >/dev/null 2>/dev/null
-      kdestroy >/dev/null 2>/dev/null
-    '';
-  };
-
-  package = pkgs.simplesamlphp.override {
-    extra_files = {
-      # NOTE: Using self signed certificate created 30. march 2024, with command:
-      # openssl req -newkey rsa:4096 -new -x509 -days 365 -nodes -out idp.crt -keyout idp.pem
-      "metadata/saml20-idp-hosted.php" = pkgs.writeText "saml20-idp-remote.php" ''
-        <?php
-	  $metadata['https://idp.pvv.ntnu.no/'] = array(
-	    'host' => '__DEFAULT__',
-	    'privatekey' => '${config.sops.secrets."idp/privatekey".path}',
-	    'certificate' => '${./idp.crt}',
-	    'auth' => 'pwauth',
-	  );
-	?>
-      '';
-
-      "metadata/saml20-sp-remote.php" = pkgs.writeText "saml20-sp-remote.php" ''
-        <?php
-	  ${ lib.pipe config.services.idp.sp-remote-metadata [
-             (map (url: ''
-               $metadata['${url}'] = [
-                   'SingleLogoutService' => [
-                       [
-                           'Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect',
-                           'Location' => '${url}module.php/saml/sp/saml2-logout.php/default-sp',
-                       ],
-                       [
-                           'Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:SOAP',
-                           'Location' => '${url}module.php/saml/sp/saml2-logout.php/default-sp',
-                       ],
-                   ],
-                   'AssertionConsumerService' => [
-                       [
-                           'Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST',
-                           'Location' => '${url}module.php/saml/sp/saml2-acs.php/default-sp',
-                           'index' => 0,
-                       ],
-                       [
-                           'Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact',
-                           'Location' => '${url}module.php/saml/sp/saml2-acs.php/default-sp',
-                           'index' => 1,
-                       ],
-                   ],
-               ];
-	     ''))
-	     (lib.concatStringsSep "\n")
-	  ]}
-	?>
-      '';
-
-      "config/authsources.php" = pkgs.writeText "idp-authsources.php" ''
-        <?php
-          $config = array(
-	    'admin' => array(
-	      'core:AdminPassword'
-	    ),
-            'pwauth' => array(
-               'authpwauth:PwAuth',
-               'pwauth_bin_path' => '${lib.getExe pwAuthScript}',
-               'mail_domain' => '@pvv.ntnu.no',
-            ),
-          );
-	?>
-      '';
-
-      "config/config.php" = pkgs.runCommandLocal "simplesamlphp-config.php" { } ''
-        cp ${./config.php} "$out"
-
-        substituteInPlace "$out" \
-          --replace '$SAML_COOKIE_SECURE' 'true' \
-          --replace '$SAML_COOKIE_SALT' 'file_get_contents("${config.sops.secrets."idp/cookie_salt".path}")' \
-          --replace '$SAML_ADMIN_NAME' '"Drift"' \
-          --replace '$SAML_ADMIN_EMAIL' '"drift@pvv.ntnu.no"' \
-          --replace '$SAML_ADMIN_PASSWORD' 'file_get_contents("${config.sops.secrets."idp/admin_password".path}")' \
-          --replace '$SAML_TRUSTED_DOMAINS' 'array( "idp.pvv.ntnu.no" )' \
-          --replace '$SAML_DATABASE_DSN' '"pgsql:host=postgres.pvv.ntnu.no;port=5432;dbname=idp"' \
-          --replace '$SAML_DATABASE_USERNAME' '"idp"' \
-          --replace '$SAML_DATABASE_PASSWORD' 'file_get_contents("${config.sops.secrets."idp/postgres_password".path}")' \
-          --replace '$CACHE_DIRECTORY' '/var/cache/idp'
-      '';
-
-      "modules/authpwauth/src/Auth/Source/PwAuth.php" = ./authpwauth.php;
-    };
-  };
-in
-{
-  options.services.idp.sp-remote-metadata = lib.mkOption {
-    type = with lib.types; listOf str;
-    default = [ ];
-    description = ''
-      List of urls point to (simplesamlphp) service profiders, which the idp should trust.
-
-      :::{.note}
-	Make sure the url ends with a `/`
-      :::
-    '';
-  };
-
-  config = {
-    sops.secrets = {
-      "idp/privatekey" = {
-        owner = "idp";
-        group = "idp";
-        mode = "0770";
-      };
-      "idp/admin_password" = {
-        owner = "idp";
-        group = "idp";
-      };
-      "idp/postgres_password" = {
-        owner = "idp";
-        group = "idp";
-      };
-      "idp/cookie_salt" = {
-        owner = "idp";
-        group = "idp";
-      };
-    };  
-
-    users.groups."idp" = { };
-    users.users."idp" = {
-      description = "PVV Identity Provider Service User";
-      group = "idp";
-      createHome = false;
-      isSystemUser = true;
-    };
-
-    systemd.tmpfiles.settings."10-idp" = {
-      "/var/cache/idp".d = {
-        user = "idp";
-        group = "idp";
-        mode = "0770";
-      };
-      "/var/lib/idp".d = {
-        user = "idp";
-        group = "idp";
-        mode = "0770";
-      };
-    };
-
-    services.phpfpm.pools.idp = {
-      user = "idp";
-      group = "idp";
-      settings = let
-        listenUser = config.services.nginx.user;
-        listenGroup = config.services.nginx.group;
-      in {
-        "pm" = "dynamic";
-        "pm.max_children" = 32;
-        "pm.max_requests" = 500;
-        "pm.start_servers" = 2;
-        "pm.min_spare_servers" = 2;
-        "pm.max_spare_servers" = 4;
-        "listen.owner" = listenUser;
-        "listen.group" = listenGroup;
-
-        "catch_workers_output" = true;
-        "php_admin_flag[log_errors]" = true;
-        # "php_admin_value[error_log]" = "stderr";
-      };
-    };
-
-    services.nginx.virtualHosts."idp.pvv.ntnu.no" = {
-      forceSSL = true;
-      enableACME = true;
-      kTLS = true;
-      root = "${package}/share/php/simplesamlphp/public";
-      locations =  {
-        # based on https://simplesamlphp.org/docs/stable/simplesamlphp-install.html#configuring-nginx
-        "/" = {
-          alias = "${package}/share/php/simplesamlphp/public/";
-          index = "index.php";
-
-          extraConfig = ''
-            location ~ ^/(?<phpfile>.+?\.php)(?<pathinfo>/.*)?$ {
-              include ${pkgs.nginx}/conf/fastcgi_params;
-              fastcgi_pass unix:${config.services.phpfpm.pools.idp.socket};
-              fastcgi_param SCRIPT_FILENAME ${package}/share/php/simplesamlphp/public/$phpfile;
-              fastcgi_param SCRIPT_NAME /$phpfile;
-              fastcgi_param PATH_INFO $pathinfo if_not_empty;
-            }
-          '';
-        };
-        "^~ /simplesaml/".extraConfig = ''
-	  rewrite ^/simplesaml/(.*)$ /$1 redirect;
-	  return 404;
-	'';
-      };
-    };
-  };
-}
--- a/hosts/bekkalokk/services/idp-simplesamlphp/idp.crt
+++ b/hosts/bekkalokk/services/idp-simplesamlphp/idp.crt
@@ -1,33 +0,0 @@
-----BEGIN CERTIFICATE-----
-MIIFqTCCA5GgAwIBAgIUL2+PMM9rE9wI5W2yNnJ2CmfGxh0wDQYJKoZIhvcNAQEL
-BQAwZDELMAkGA1UEBhMCTk8xEzARBgNVBAgMClNvbWUtU3RhdGUxHjAcBgNVBAoM
-FVByb2dyYW12YXJldmVya3N0ZWRldDEgMB4GCSqGSIb3DQEJARYRZHJpZnRAcHZ2
-Lm50bnUubm8wHhcNMjQwMzMwMDAyNjQ0WhcNMjUwMzMwMDAyNjQ0WjBkMQswCQYD
-VQQGEwJOTzETMBEGA1UECAwKU29tZS1TdGF0ZTEeMBwGA1UECgwVUHJvZ3JhbXZh
-cmV2ZXJrc3RlZGV0MSAwHgYJKoZIhvcNAQkBFhFkcmlmdEBwdnYubnRudS5ubzCC
-AiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAL/0l0jdV+PoVxdd21F+2NLm
-JN6sZmSJexOSk/sFjhhF4WMtjOfDAQYjt3hlLPyYl//jCe9WteavvtdCx1tHJitd
-xjOUJ/leVjHzBttCVZR+iTlQtpsZ2TbRMJ5Fcfl82njlPecV4umJvnnFXawE4Qee
-dE2OM8ODjjrK1cNaHR74tyZCwmdOxNHXZ7RN22p9kZjLD18LQyNr5igaDBeaZkyk
-Gxbg4tbP51x9JFRLF7kUlyAc83geFnw6v/wBahr49m/X4y7xE0rdPb2L0moUjmOO
-Zyl3hvxMI3+g/0FVMM5eKmfIIP2rIVEAa6MWMx0vPjC6h2fIyxkUqg5C8aFlpqav
-+8f2rUc+JfdiFsIZNrylBXsleGzS+/wY1uB/pAy5Vg9WCp+eC75EtWMt0k2f442G
-rhKa3lAZ6GIYrtEiQiNGM1aT1Cs1nqTtslfnHiuAKBefLjCXgq9uvL2yRodwe9/m
-oZiqYnLHy/v1xfnF5rKTcRmOleU3tc+nlN6tZSGC1nZgMpqpoqdcbJXAkvaJ2Km4
-sl0YS28VQnztgzuVPNdnv8lcS6HmkaGaNWbepKgWeaH5oT7O6u99wZIv88m+tf5m
-Eu197YVpcclnojQCYKauWcQFsXS20egsVP87Qk0e2SHmGTUQp6YEYX6RLjkg7/vS
-BelDBbCldraNVEiC0jmpAgMBAAGjUzBRMB0GA1UdDgQWBBSL0yofG5NEmzFIRuqC
-xmyiuZW6DTAfBgNVHSMEGDAWgBSL0yofG5NEmzFIRuqCxmyiuZW6DTAPBgNVHRMB
-Af8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4ICAQAZZVs7BLk/NLq3f4Ik8qH3IoDN
-2m4XXRZS+xxw5RwctgSnik7AffgAfv8QQm2co8UYkHbB0whaG1PDz+L7wB1hVkWn
-DVUaJcKQnn0x+sNU5LoTbjI0PlaST7PO5D0OMFab8FSNxpzzpbUcgZUhelc99Ri/
-2Gh8mf4b3Y3Uzq6YKFsuFM65OuJhH8f1w6onai9x28t6tERHUSUfJ2keXzU4ytCV
-EitWXwhe759VLqmdP4BATwlCOCuwa5aDeGcWRIqFpYIn0SOAmVV3o4V71JdZc1jE
-fuOo/PbiHZ+R9ZGbh98aMidb0moL1ZDhmir9KbedezNyki6JJ72mVclhLqUajFxr
-T39FXd5e2+QBMHPPhVFznQoHWnHEbZigTt61b0cg/TsxaxOkF4Ilmr/2DmSWysWK
-TF5eq8hp6/53qVbXXSzrCjxd3wzGnRabsEVPX/L2hYDx81hluovJQCtskqTq1joI
-W2R7AO5Sdyc6NfOR85kl0HXzHa+0Slsf8ZDs5nCz/mOOPoAGl7IxF7xQ6kPO7V+U
-HdGE2tkblM/TrAObJH0HXySeJGI7Vfya+D1Y8IqGtyZtWyx1DmlA/OezGGf5D3rG
-88LywHQQ2mQ+8aosBTE4+HQ+apLKZBprqQKuiDjT1RSUbfUHQkYuL+D1oIVmklAc
-UxTpf01QJnZkMqf5NQ==
-----END CERTIFICATE-----
--- a/hosts/bekkalokk/services/idp-simplesamlphp/metadata.php.nix
+++ b/hosts/bekkalokk/services/idp-simplesamlphp/metadata.php.nix
@@ -1,22 +0,0 @@
-''
-  <?php
-  $metadata['https://idp.pvv.ntnu.no/'] = [
-      'metadata-set' => 'saml20-idp-hosted',
-      'entityid' => 'https://idp.pvv.ntnu.no/',
-      'SingleSignOnService' => [
-          [
-              'Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect',
-              'Location' => 'https://idp.pvv.ntnu.no/module.php/saml/idp/singleSignOnService',
-          ],
-      ],
-      'SingleLogoutService' => [
-          [
-              'Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect',
-              'Location' => 'https://idp.pvv.ntnu.no/module.php/saml/idp/singleLogout',
-          ],
-      ],
-      'NameIDFormat' => [ 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient' ],
-      'certificate' => '${./idp.crt}',
-  ];
-  ?>
-''
--- a/hosts/bekkalokk/services/kerberos/default.nix
+++ b/hosts/bekkalokk/services/kerberos/default.nix
@@ -1,27 +0,0 @@
-{ config, pkgs, lib, ... }:
-{
-  #######################
-  # TODO: remove these once nixos 24.05 gets released
-  #######################
-  imports = [
-    ./krb5.nix
-    ./pam.nix
-  ];
-  disabledModules = [
-    "config/krb5/default.nix"
-    "security/pam.nix"
-  ];
-  #######################
-
-  security.krb5 = {
-    enable = true;
-    settings = {
-      libdefaults = {
-        default_realm = "PVV.NTNU.NO";
-        dns_lookup_realm = "yes";
-        dns_lookup_kdc = "yes";
-      };
-      realms."PVV.NTNU.NO".admin_server = "kdc.pvv.ntnu.no";
-    };
-  };
-}
--- a/hosts/bekkalokk/services/kerberos/krb5-conf-format.nix
+++ b/hosts/bekkalokk/services/kerberos/krb5-conf-format.nix
@@ -1,88 +0,0 @@
-{ pkgs, lib, ... }:
-
-# Based on
-# - https://web.mit.edu/kerberos/krb5-1.12/doc/admin/conf_files/krb5_conf.html
-# - https://manpages.debian.org/unstable/heimdal-docs/krb5.conf.5heimdal.en.html
-
-let
-  inherit (lib) boolToString concatMapStringsSep concatStringsSep filter
-    isAttrs isBool isList mapAttrsToList mdDoc mkOption singleton splitString;
-  inherit (lib.types) attrsOf bool coercedTo either int listOf oneOf path
-    str submodule;
-in
-{ }: {
-  type = let
-    section = attrsOf relation;
-    relation = either (attrsOf value) value;
-    value = either (listOf atom) atom;
-    atom = oneOf [int str bool];
-  in submodule {
-    freeformType = attrsOf section;
-    options = {
-      include = mkOption {
-        default = [ ];
-        description = mdDoc ''
-          Files to include in the Kerberos configuration.
-        '';
-        type = coercedTo path singleton (listOf path);
-      };
-      includedir = mkOption {
-        default = [ ];
-        description = mdDoc ''
-          Directories containing files to include in the Kerberos configuration.
-        '';
-        type = coercedTo path singleton (listOf path);
-      };
-      module = mkOption {
-        default = [ ];
-        description = mdDoc ''
-          Modules to obtain Kerberos configuration from.
-        '';
-        type = coercedTo path singleton (listOf path);
-      };
-    };
-  };
-
-  generate = let
-    indent = str: concatMapStringsSep "\n" (line: "  " + line) (splitString "\n" str);
-
-    formatToplevel = args @ {
-      include ? [ ],
-      includedir ? [ ],
-      module ? [ ],
-      ...
-    }: let
-      sections = removeAttrs args [ "include" "includedir" "module" ];
-    in concatStringsSep "\n" (filter (x: x != "") [
-      (concatStringsSep "\n" (mapAttrsToList formatSection sections))
-      (concatMapStringsSep "\n" (m: "module ${m}") module)
-      (concatMapStringsSep "\n" (i: "include ${i}") include)
-      (concatMapStringsSep "\n" (i: "includedir ${i}") includedir)
-    ]);
-
-    formatSection = name: section: ''
-      [${name}]
-      ${indent (concatStringsSep "\n" (mapAttrsToList formatRelation section))}
-    '';
-
-    formatRelation = name: relation:
-      if isAttrs relation
-      then ''
-        ${name} = {
-        ${indent (concatStringsSep "\n" (mapAttrsToList formatValue relation))}
-        }''
-      else formatValue name relation;
-
-    formatValue = name: value:
-      if isList value
-      then concatMapStringsSep "\n" (formatAtom name) value
-      else formatAtom name value;
-
-    formatAtom = name: atom: let
-      v = if isBool atom then boolToString atom else toString atom;
-    in "${name} = ${v}";
-  in
-    name: value: pkgs.writeText name ''
-      ${formatToplevel value}
-    '';
-}
--- a/hosts/bekkalokk/services/kerberos/krb5.nix
+++ b/hosts/bekkalokk/services/kerberos/krb5.nix
@@ -1,90 +0,0 @@
-{ config, lib, pkgs, ... }:
-let
-  inherit (lib) mdDoc mkIf mkOption mkPackageOption mkRemovedOptionModule;
-  inherit (lib.types) bool;
-
-  mkRemovedOptionModule' = name: reason: mkRemovedOptionModule ["krb5" name] reason;
-  mkRemovedOptionModuleCfg = name: mkRemovedOptionModule' name ''
-    The option `krb5.${name}' has been removed. Use
-    `security.krb5.settings.${name}' for structured configuration.
-  '';
-
-  cfg = config.security.krb5;
-  format = import ./krb5-conf-format.nix { inherit pkgs lib; } { };
-in {
-  imports = [
-    (mkRemovedOptionModuleCfg "libdefaults")
-    (mkRemovedOptionModuleCfg "realms")
-    (mkRemovedOptionModuleCfg "domain_realm")
-    (mkRemovedOptionModuleCfg "capaths")
-    (mkRemovedOptionModuleCfg "appdefaults")
-    (mkRemovedOptionModuleCfg "plugins")
-    (mkRemovedOptionModuleCfg "config")
-    (mkRemovedOptionModuleCfg "extraConfig")
-    (mkRemovedOptionModule' "kerberos" ''
-      The option `krb5.kerberos' has been moved to `security.krb5.package'.
-    '')
-  ];
-
-  options = {
-    security.krb5 = {
-      enable = mkOption {
-        default = false;
-        description = mdDoc "Enable and configure Kerberos utilities";
-        type = bool;
-      };
-
-      package = mkPackageOption pkgs "krb5" {
-        example = "heimdal";
-      };
-
-      settings = mkOption {
-        default = { };
-        type = format.type;
-        description = mdDoc ''
-          Structured contents of the {file}`krb5.conf` file. See
-          {manpage}`krb5.conf(5)` for details about configuration.
-        '';
-        example = {
-          include = [ "/run/secrets/secret-krb5.conf" ];
-          includedir = [ "/run/secrets/secret-krb5.conf.d" ];
-
-          libdefaults = {
-            default_realm = "ATHENA.MIT.EDU";
-          };
-
-          realms = {
-            "ATHENA.MIT.EDU" = {
-              admin_server = "athena.mit.edu";
-              kdc = [
-                "athena01.mit.edu"
-                "athena02.mit.edu"
-              ];
-            };
-          };
-
-          domain_realm = {
-            "mit.edu" = "ATHENA.MIT.EDU";
-          };
-
-          logging = {
-            kdc = "SYSLOG:NOTICE";
-            admin_server = "SYSLOG:NOTICE";
-            default = "SYSLOG:NOTICE";
-          };
-        };
-      };
-    };
-  };
-
-  config = mkIf cfg.enable {
-    environment = {
-      systemPackages = [ cfg.package ];
-      etc."krb5.conf".source = format.generate "krb5.conf" cfg.settings;
-    };
-  };
-
-  meta.maintainers = builtins.attrValues {
-    inherit (lib.maintainers) dblsaiko h7x4;
-  };
-}
--- a/hosts/bekkalokk/services/kerberos/pam.nix
+++ b/hosts/bekkalokk/services/kerberos/pam.nix
--- a/hosts/bekkalokk/services/keycloak.nix
+++ b/hosts/bekkalokk/services/keycloak.nix
@@ -0,0 +1,24 @@
+{ pkgs, config, values, ... }:
+{
+  sops.secrets."keys/postgres/keycloak" = {
+    owner = "keycloak";
+    group = "keycloak";
+    restartUnits = [ "keycloak.service" ];
+  };
+
+  services.keycloak = {
+    enable = true;
+
+    settings = {
+      hostname = "auth.pvv.ntnu.no";
+      # hostname-strict-backchannel = true;
+    };
+
+    database = {
+      host = values.hosts.bicep.ipv4;
+      createLocally = false;
+      passwordFile = config.sops.secrets."keys/postgres/keycloak".path;
+      caCert = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
+    };
+  };
+}
--- a/hosts/bekkalokk/services/mediawiki.nix
+++ b/hosts/bekkalokk/services/mediawiki.nix
@@ -0,0 +1,175 @@
+{ pkgs, lib, config, values, ... }: let
+  cfg = config.services.mediawiki;
+
+  # "mediawiki"
+  user = config.systemd.services.mediawiki-init.serviceConfig.User;
+
+  # "mediawiki"
+  group = config.users.users.${user}.group;
+in {
+  sops.secrets = {
+    "mediawiki/password" = {
+      restartUnits = [ "mediawiki-init.service" "phpfpm-mediawiki.service" ];
+      owner = user;
+      group = group;
+    };
+    "keys/postgres/mediawiki" = {
+      restartUnits = [ "mediawiki-init.service" "phpfpm-mediawiki.service" ];
+      owner = user;
+      group = group;
+    };
+  };
+
+  services.mediawiki = {
+    enable = true;
+    name = "Programvareverkstedet";
+    passwordFile = config.sops.secrets."mediawiki/password".path;
+    passwordSender = "drift@pvv.ntnu.no";
+
+    database = {
+      type = "postgres";
+      host = "postgres.pvv.ntnu.no";
+      port = config.services.postgresql.port;
+      passwordFile = config.sops.secrets."keys/postgres/mediawiki".path;
+      createLocally = false;
+      # TODO: create a normal database and copy over old data when the service is production ready
+      name = "mediawiki_test";
+    };
+
+    # Host through nginx
+    webserver = "none";
+    poolConfig = let
+      listenUser = config.services.nginx.user;
+      listenGroup = config.services.nginx.group;
+    in {
+      inherit user group;
+      "pm" = "dynamic";
+      "pm.max_children" = 32;
+      "pm.max_requests" = 500;
+      "pm.start_servers" = 2;
+      "pm.min_spare_servers" = 2;
+      "pm.max_spare_servers" = 4;
+      "listen.owner" = listenUser;
+      "listen.group" = listenGroup;
+      "php_admin_value[error_log]" = "stderr";
+      "php_admin_flag[log_errors]" = "on";
+      "env[PATH]" = lib.makeBinPath [ pkgs.php ];
+      "catch_workers_output" = true;
+      # to accept *.html file
+      "security.limit_extensions" = "";
+    };
+
+    extensions = {
+      DeleteBatch = pkgs.fetchzip {
+        url = "https://extdist.wmflabs.org/dist/extensions/DeleteBatch-REL1_39-995ea6f.tar.gz";
+	sha256 = "sha256-0F4GLCy2f5WcWIY2YgF1tVxgYbglR0VOsj/pMrW93b8=";
+      };
+      UserMerge = pkgs.fetchzip {
+        url = "https://extdist.wmflabs.org/dist/extensions/UserMerge-REL1_39-b10d50e.tar.gz";
+	sha256 = "sha256-bXhj1+OlOUJDbvEuc8iwqb1LLEu6cN6+C/7cAvnWPOQ=";
+      };
+      PluggableAuth = pkgs.fetchzip {
+        url = "https://extdist.wmflabs.org/dist/extensions/PluggableAuth-REL1_39-1210fc3.tar.gz";
+	sha256 = "sha256-F6bTMCzkK3kZwZGIsNE87WlZWqXXmTMhEjApO99YKR0=";
+      };
+      SimpleSAMLphp = pkgs.fetchzip {
+        url = "https://extdist.wmflabs.org/dist/extensions/SimpleSAMLphp-REL1_39-dcf0acb.tar.gz";
+        sha256 = "sha256-tCvFmb2+q2rxms+lRo5pgoI3h6GjCwXAR8XisPg03TQ=";
+      };
+    };
+
+    extraConfig = let
+
+      SimpleSAMLphpRepo = pkgs.stdenvNoCC.mkDerivation rec {
+        pname = "configuredSimpleSAML";
+	version = "2.0.4";
+        src = pkgs.fetchzip {
+          url = "https://github.com/simplesamlphp/simplesamlphp/releases/download/v${version}/simplesamlphp-${version}.tar.gz";
+          sha256 = "sha256-pfMV/VmqqxgtG7Nx4s8MW4tWSaxOkVPtCRJwxV6RDSE=";
+        };
+
+	buildPhase = ''
+          cat > config/authsources.php << EOF
+          <?php
+          $config = array(
+            'default-sp' => array(
+              'saml:SP',
+              'idp' => 'https://idp.pvv.ntnu.no/',
+            ),
+          );
+	  EOF
+	'';
+
+	installPhase = ''
+	  cp -r . $out
+	'';
+      };
+
+    in ''
+      $wgServer = "https://bekkalokk.pvv.ntnu.no";
+      $wgLocaltimezone = "Europe/Oslo";
+
+      # Only allow login through SSO
+      $wgEnableEmail = false;
+      $wgEnableUserEmail = false;
+      $wgEmailAuthentication = false;
+      $wgGroupPermissions['*']['createaccount'] = false;
+      $wgGroupPermissions['*']['autocreateaccount'] = true;
+      $wgPluggableAuth_EnableAutoLogin = true;
+
+      # Disable anonymous editing
+      $wgGroupPermissions['*']['edit'] = false;
+
+      # Styling
+      $wgLogo = "/PNG/PVV-logo.png";
+      $wgDefaultSkin = "monobook";
+
+      # Misc
+      $wgEmergencyContact = "${cfg.passwordSender}";
+      $wgShowIPinHeader = false;
+      $wgUseTeX = false;
+      $wgLocalInterwiki = $wgSitename;
+
+      # SimpleSAML
+      $wgSimpleSAMLphp_InstallDir = "${SimpleSAMLphpRepo}";
+      $wgSimpleSAMLphp_AuthSourceId = "default-sp";
+      $wgSimpleSAMLphp_RealNameAttribute = "cn";
+      $wgSimpleSAMLphp_EmailAttribute = "mail";
+      $wgSimpleSAMLphp_UsernameAttribute = "uid";
+
+      # Fix https://github.com/NixOS/nixpkgs/issues/183097
+      $wgDBserver = "${toString cfg.database.host}";
+    '';
+  };
+
+  # Override because of https://github.com/NixOS/nixpkgs/issues/183097
+  systemd.services.mediawiki-init.script = let
+    # According to module
+    stateDir = "/var/lib/mediawiki";
+    pkg = cfg.finalPackage;
+    mediawikiConfig = config.services.phpfpm.pools.mediawiki.phpEnv.MEDIAWIKI_CONFIG;
+    inherit (lib) optionalString mkForce;
+  in mkForce ''
+    if ! test -e "${stateDir}/secret.key"; then
+      tr -dc A-Za-z0-9 </dev/urandom 2>/dev/null | head -c 64 > ${stateDir}/secret.key
+    fi
+
+    echo "exit( wfGetDB( DB_MASTER )->tableExists( 'user' ) ? 1 : 0 );" | \
+    ${pkgs.php}/bin/php ${pkg}/share/mediawiki/maintenance/eval.php --conf ${mediawikiConfig} && \
+    ${pkgs.php}/bin/php ${pkg}/share/mediawiki/maintenance/install.php \
+      --confpath /tmp \
+      --scriptpath / \
+      --dbserver "${cfg.database.host}" \
+      --dbport ${toString cfg.database.port} \
+      --dbname ${cfg.database.name} \
+      ${optionalString (cfg.database.tablePrefix != null) "--dbprefix ${cfg.database.tablePrefix}"} \
+      --dbuser ${cfg.database.user} \
+      ${optionalString (cfg.database.passwordFile != null) "--dbpassfile ${cfg.database.passwordFile}"} \
+      --passfile ${cfg.passwordFile} \
+      --dbtype ${cfg.database.type} \
+      ${cfg.name} \
+      admin
+
+    ${pkgs.php}/bin/php ${pkg}/share/mediawiki/maintenance/update.php --conf ${mediawikiConfig} --quick
+  '';
+}
--- a/hosts/bekkalokk/services/mediawiki/default.nix
+++ b/hosts/bekkalokk/services/mediawiki/default.nix
@@ -1,200 +0,0 @@
-{ pkgs, lib, config, values, pkgs-unstable, ... }: let
-  cfg = config.services.mediawiki;
-
-  # "mediawiki"
-  user = config.systemd.services.mediawiki-init.serviceConfig.User;
-
-  # "mediawiki"
-  group = config.users.users.${user}.group;
-
-  simplesamlphp = pkgs.simplesamlphp.override {
-    extra_files = {
-      "metadata/saml20-idp-remote.php" = pkgs.writeText "mediawiki-saml20-idp-remote.php" (import ../idp-simplesamlphp/metadata.php.nix);
-
-      "config/authsources.php" = ./simplesaml-authsources.php;
-
-      "config/config.php" = pkgs.runCommandLocal "mediawiki-simplesamlphp-config.php" { } ''
-        cp ${./simplesaml-config.php} "$out"
-
-        substituteInPlace "$out" \
-          --replace '$SAML_COOKIE_SECURE' 'true' \
-          --replace '$SAML_COOKIE_SALT' 'file_get_contents("${config.sops.secrets."mediawiki/simplesamlphp/cookie_salt".path}")' \
-          --replace '$SAML_ADMIN_NAME' '"Drift"' \
-          --replace '$SAML_ADMIN_EMAIL' '"drift@pvv.ntnu.no"' \
-          --replace '$SAML_ADMIN_PASSWORD' 'file_get_contents("${config.sops.secrets."mediawiki/simplesamlphp/admin_password".path}")' \
-          --replace '$SAML_TRUSTED_DOMAINS' 'array( "wiki.pvv.ntnu.no" )' \
-          --replace '$SAML_DATABASE_DSN' '"pgsql:host=postgres.pvv.ntnu.no;port=5432;dbname=mediawiki_simplesamlphp"' \
-          --replace '$SAML_DATABASE_USERNAME' '"mediawiki_simplesamlphp"' \
-          --replace '$SAML_DATABASE_PASSWORD' 'file_get_contents("${config.sops.secrets."mediawiki/simplesamlphp/postgres_password".path}")' \
-          --replace '$CACHE_DIRECTORY' '/var/cache/mediawiki/idp'
-      '';
-    };
-  };
-in {
-  services.idp.sp-remote-metadata = [ "https://wiki.pvv.ntnu.no/simplesaml/" ];
-
-  sops.secrets = lib.pipe [
-    "mediawiki/password"
-    "mediawiki/postgres_password"
-    "mediawiki/simplesamlphp/postgres_password"
-    "mediawiki/simplesamlphp/cookie_salt"
-    "mediawiki/simplesamlphp/admin_password"
-  ] [
-    (map (key: lib.nameValuePair key {
-      owner = user;
-      group = group;
-      restartUnits = [ "phpfpm-mediawiki.service" ];
-    }))
-    lib.listToAttrs
-  ];
-
-  services.mediawiki = {
-    enable = true;
-    name = "Programvareverkstedet";
-    passwordFile = config.sops.secrets."mediawiki/password".path;
-    passwordSender = "drift@pvv.ntnu.no";
-
-    database = {
-      type = "mysql";
-      host = "mysql.pvv.ntnu.no";
-      port = 3306;
-      user = "mediawiki";
-      passwordFile = config.sops.secrets."mediawiki/postgres_password".path;
-      createLocally = false;
-      # TODO: create a normal database and copy over old data when the service is production ready
-      name = "mediawiki";
-    };
-
-    webserver = "nginx";
-    nginx.hostName = "wiki.pvv.ntnu.no";
-
-    poolConfig = {
-      inherit user group;
-      "pm" = "dynamic";
-      "pm.max_children" = 32;
-      "pm.max_requests" = 500;
-      "pm.start_servers" = 2;
-      "pm.min_spare_servers" = 2;
-      "pm.max_spare_servers" = 4;
-
-      "catch_workers_output" = true;
-      "php_admin_flag[log_errors]" = true;
-      # "php_admin_value[error_log]" = "stderr";
-
-      # to accept *.html file
-      "security.limit_extensions" = "";
-    };
-
-    extensions = {
-      inherit (pkgs.mediawiki-extensions) DeleteBatch UserMerge PluggableAuth SimpleSAMLphp VisualEditor;
-    };
-
-    extraConfig = ''
-      $wgServer = "https://wiki.pvv.ntnu.no";
-      $wgLocaltimezone = "Europe/Oslo";
-
-      # Only allow login through SSO
-      $wgEnableEmail = false;
-      $wgEnableUserEmail = false;
-      $wgEmailAuthentication = false;
-      $wgGroupPermissions['*']['createaccount'] = false;
-      $wgGroupPermissions['*']['autocreateaccount'] = true;
-      $wgPluggableAuth_EnableAutoLogin = false;
-
-      # Misc. permissions
-      $wgGroupPermissions['*']['edit'] = false;
-      $wgGroupPermissions['*']['read'] = true;
-
-      # Allow subdirectories in article URLs
-      $wgNamespacesWithSubpages[NS_MAIN] = true;
-
-      # Styling
-      $wgLogos = array(
-        "2x" => "/PNG/PVV-logo.png",
-        "icon" => "/PNG/PVV-logo.svg",
-      );
-      $wgDefaultSkin = "vector-2022";
-      # from https://github.com/wikimedia/mediawiki-skins-Vector/blob/master/skin.json
-      $wgVectorDefaultSidebarVisibleForAnonymousUser = true;
-      $wgVectorResponsive = true;
-
-      # Misc
-      $wgEmergencyContact = "${cfg.passwordSender}";
-      $wgShowIPinHeader = false;
-      $wgUseTeX = false;
-      $wgLocalInterwiki = $wgSitename;
-
-      # SimpleSAML
-      $wgSimpleSAMLphp_InstallDir = "${simplesamlphp}/share/php/simplesamlphp/";
-      $wgPluggableAuth_Config['Log in using my SAML'] = [
-        'plugin' => 'SimpleSAMLphp',
-        'data' => [
-          'authSourceId' => 'default-sp',
-          'usernameAttribute' => 'uid',
-          'emailAttribute' => 'mail',
-          'realNameAttribute' => 'cn',
-        ]
-      ];
-
-      # Fix https://github.com/NixOS/nixpkgs/issues/183097
-      $wgDBserver = "${toString cfg.database.host}";
-    '';
-  };
-
-  # Cache directory for simplesamlphp
-  # systemd.services.phpfpm-mediawiki.serviceConfig.CacheDirectory = "mediawiki/simplesamlphp";
-  systemd.tmpfiles.settings."10-mediawiki"."/var/cache/mediawiki/simplesamlphp".d = {
-    user = "mediawiki";
-    group = "mediawiki";
-    mode = "0770";
-  };
-
-  users.groups.mediawiki.members = [ "nginx" ];
-
-  services.nginx.virtualHosts."wiki.pvv.ntnu.no" = {
-    kTLS = true;
-    forceSSL = true;
-    enableACME = true;
-    locations =  {
-      "= /wiki/Main_Page" = lib.mkForce {
-        return = "301 /wiki/Programvareverkstedet";
-      };
-
-      # based on https://simplesamlphp.org/docs/stable/simplesamlphp-install.html#configuring-nginx
-      "^~ /simplesaml/" = {
-        alias = "${simplesamlphp}/share/php/simplesamlphp/public/";
-        index = "index.php";
-
-        extraConfig = ''
-          location ~ ^/simplesaml/(?<phpfile>.+?\.php)(?<pathinfo>/.*)?$ {
-            include ${pkgs.nginx}/conf/fastcgi_params;
-            fastcgi_pass unix:${config.services.phpfpm.pools.mediawiki.socket}; 
-            fastcgi_param SCRIPT_FILENAME ${simplesamlphp}/share/php/simplesamlphp/public/$phpfile;
-
-            # Must be prepended with the baseurlpath
-            fastcgi_param SCRIPT_NAME /simplesaml/$phpfile;
-
-            fastcgi_param PATH_INFO $pathinfo if_not_empty;
-          }
-        '';
-      };
-
-      "= /PNG/PVV-logo.svg".alias = ../../../../assets/logo_blue_regular.svg;
-      "= /PNG/PVV-logo.png".alias = ../../../../assets/logo_blue_regular.png;
-      "= /favicon.ico".alias = pkgs.runCommandLocal "mediawiki-favicon.ico" {
-        buildInputs = with pkgs; [ imagemagick ];
-      } ''
-        convert \
-          -resize x64 \
-          -gravity center \
-          -crop 64x64+0+0 \
-          ${../../../../assets/logo_blue_regular.png} \
-          -flatten \
-          -colors 256 \
-          -background transparent \
-          $out
-      '';
-    };
-
-  };
-}
--- a/hosts/bekkalokk/services/mediawiki/simplesaml-authsources.php
+++ b/hosts/bekkalokk/services/mediawiki/simplesaml-authsources.php
@@ -1,11 +0,0 @@
-<?php
-$config = array(
-    'admin' => array(
-      'core:AdminPassword'
-    ),
-    'default-sp' => array(
-        'saml:SP',
-        'entityID' => 'https://wiki.pvv.ntnu.no/simplesaml/',
-        'idp' => 'https://idp.pvv.ntnu.no/',
-    ),
-);
--- a/hosts/bekkalokk/services/mediawiki/simplesaml-config.php
+++ b/hosts/bekkalokk/services/mediawiki/simplesaml-config.php
--- a/hosts/bekkalokk/services/nginx.nix
+++ b/hosts/bekkalokk/services/nginx.nix
@@ -1,4 +1,18 @@
 { pkgs, config, ... }:
 {
-  services.nginx.enable = true;
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "drift@pvv.ntnu.no";
+  };
+
+  services.nginx = {
+    enable = true;
+
+    recommendedTlsSettings = true;
+    recommendedProxySettings = true;
+    recommendedOptimisation = true;
+    recommendedGzipSettings = true;
+  };
+
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
 }
--- a/hosts/bekkalokk/services/webmail/default.nix
+++ b/hosts/bekkalokk/services/webmail/default.nix
@@ -1,18 +0,0 @@
-{ config, values, pkgs, lib, ... }:
-{
-  imports = [
-    ./roundcube.nix
-  ];
-
-  services.nginx.virtualHosts."webmail.pvv.ntnu.no" = {
-    forceSSL = true;
-    enableACME = true;
-    kTLS = true;
-    locations = {
-      "= /".return = "302 https://webmail.pvv.ntnu.no/roundcube";
-      "/afterlogic_lite".return = "302 https://webmail.pvv.ntnu.no/roundcube";
-      "/squirrelmail".return = "302 https://webmail.pvv.ntnu.no/roundcube";
-      "/rainloop".return = "302 https://webmail.pvv.ntnu.no/roundcube";
-    };
-  };
-}
--- a/hosts/bekkalokk/services/webmail/roundcube.nix
+++ b/hosts/bekkalokk/services/webmail/roundcube.nix
@@ -1,75 +0,0 @@
-{ config, pkgs, lib, ... }:
-
-with lib;
-let
-  cfg = config.services.roundcube;
-  domain = "webmail.pvv.ntnu.no";
-in 
-{
-  services.roundcube = {
-    enable = true;
-
-    package = pkgs.roundcube.withPlugins (plugins: with plugins; [
-      persistent_login
-      thunderbird_labels
-      contextmenu
-      custom_from
-    ]);
-
-    dicts = with pkgs.aspellDicts; [ en en-science en-computers nb nn fr de it ];
-    maxAttachmentSize = 20;
-    hostName = "roundcubeplaceholder.example.com";
-
-    extraConfig = ''
-      $config['enable_installer'] = false;
-      $config['default_host'] = "ssl://imap.pvv.ntnu.no";
-      $config['default_port'] = 993;
-      $config['smtp_server'] = "ssl://smtp.pvv.ntnu.no";
-      $config['smtp_port'] = 465;
-      $config['mail_domain'] = "pvv.ntnu.no";
-      $config['smtp_user'] = "%u";
-      $config['support_url'] = "";
-    '';
-  };
-
-  services.nginx.virtualHosts."roundcubeplaceholder.example.com" = lib.mkForce { };
-
-  services.nginx.virtualHosts.${domain} = {
-    kTLS = true;
-    locations."/roundcube" = {
-      tryFiles = "$uri $uri/ =404";
-      index = "index.php";
-      root = pkgs.runCommandLocal "roundcube-dir" { } ''
-        mkdir -p $out
-        ln -s ${cfg.package} $out/roundcube
-      '';
-      extraConfig = ''
-        location ~ ^/roundcube/(${builtins.concatStringsSep "|" [
-        # https://wiki.archlinux.org/title/Roundcube
-        "README"
-        "INSTALL"
-        "LICENSE"
-        "CHANGELOG"
-        "UPGRADING"
-        "bin"
-        "SQL"
-        ".+\\.md"
-        "\\."
-        "config"
-        "temp"
-        "logs"
-        ]})/? {
-          deny all;
-        }
-
-        location ~ ^/roundcube/(.+\.php)(/?.*)$ {
-          fastcgi_split_path_info ^/roundcube(/.+\.php)(/.+)$;
-          include ${config.services.nginx.package}/conf/fastcgi_params;
-          include ${config.services.nginx.package}/conf/fastcgi.conf;
-          fastcgi_index index.php;
-          fastcgi_pass unix:${config.services.phpfpm.pools.roundcube.socket};
-        }
-      '';
-    };
-  };
-}
--- a/hosts/bekkalokk/services/website.nix
+++ b/hosts/bekkalokk/services/website.nix
@@ -0,0 +1,4 @@
+{ ... }:
+{
+
+}
--- a/hosts/bekkalokk/services/website/default.nix
+++ b/hosts/bekkalokk/services/website/default.nix
@@ -1,126 +0,0 @@
-{ pkgs, lib, config, ... }:
-let
-  format = pkgs.formats.php { };
-  cfg = config.services.pvv-nettsiden;
-in {
-  imports = [
-    ./fetch-gallery.nix
-  ];
-
-  sops.secrets = lib.genAttrs [
-    "nettsiden/door_secret"
-    "nettsiden/mysql_password"
-    "nettsiden/simplesamlphp/admin_password"
-    "nettsiden/simplesamlphp/cookie_salt"
-  ] (_: {
-    owner = config.services.phpfpm.pools.pvv-nettsiden.user;
-    group = config.services.phpfpm.pools.pvv-nettsiden.group;
-    restartUnits = [ "phpfpm-pvv-nettsiden.service" ];
-  });
-
-  services.idp.sp-remote-metadata = [ "https://${cfg.domainName}/simplesaml/" ];
-
-  services.pvv-nettsiden = {
-    enable = true;
-
-    package = pkgs.pvv-nettsiden.override {
-      extra_files = {
-        "${pkgs.pvv-nettsiden.passthru.simplesamlphpPath}/metadata/saml20-idp-remote.php" = pkgs.writeText "pvv-nettsiden-saml20-idp-remote.php" (import ../idp-simplesamlphp/metadata.php.nix);
-        "${pkgs.pvv-nettsiden.passthru.simplesamlphpPath}/config/authsources.php" = pkgs.writeText "pvv-nettsiden-authsources.php" ''
-          <?php
-          $config = array(
-              'admin' => array(
-                'core:AdminPassword'
-              ),
-              'default-sp' => array(
-                  'saml:SP',
-                  'entityID' => 'https://${cfg.domainName}/simplesaml/',
-                  'idp' => 'https://idp.pvv.ntnu.no/',
-              ),
-          );
-	'';
-      };
-    };
-
-    domainName = "www.pvv.ntnu.no";
-
-    settings = let
-      includeFromSops = path: format.lib.mkRaw "file_get_contents('${config.sops.secrets."nettsiden/${path}".path}')";
-    in {
-      DOOR_SECRET = includeFromSops "door_secret";
-
-      DB = {
-        DSN = "mysql:dbname=www-data_nettside;host=mysql.pvv.ntnu.no";
-        USER = "www-data_nettsi";
-        PASS = includeFromSops "mysql_password";
-      };
-
-      # TODO: set up postgres session for simplesamlphp
-      SAML = {
-        COOKIE_SALT = includeFromSops "simplesamlphp/cookie_salt";
-        COOKIE_SECURE = true;
-        ADMIN_NAME = "PVV Drift";
-        ADMIN_EMAIL = "drift@pvv.ntnu.no";
-        ADMIN_PASSWORD = includeFromSops "simplesamlphp/admin_password";
-        TRUSTED_DOMAINS = [ cfg.domainName ];
-      };
-    };
-  };
-
-  services.phpfpm.pools."pvv-nettsiden".settings = {
-    # "php_admin_value[error_log]" = "stderr";
-    "php_admin_flag[log_errors]" = true;
-    "catch_workers_output" = true;
-  };
-
-  services.nginx.virtualHosts.${cfg.domainName} = {
-    serverAliases = [
-      "pvv.ntnu.no"
-      "www.pvv.org"
-      "pvv.org"
-    ];
-
-    locations = {
-      # Proxy home directories
-      "^~ /~" = {
-        extraConfig = ''
-          proxy_redirect off;
-          proxy_pass https://tom.pvv.ntnu.no;
-          proxy_set_header Host $host;
-          proxy_set_header X-Real-IP $remote_addr;
-          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-          proxy_set_header X-Forwarded-Proto $scheme;
-        '';
-      };
-
-      # Redirect the old webmail/wiki paths from spikkjeposche
-      "^~ /webmail".return = "301 https://webmail.pvv.ntnu.no";
-      "~ /pvv/([^\\n\\r]*)".return = "301 https://wiki.pvv.ntnu.no/wiki/$1";
-      "= /pvv".return = "301 https://wiki.pvv.ntnu.no/";
-
-      # Redirect old wiki entries
-      "/disk".return = "301 https://wiki.pvv.ntnu.no/wiki/Diskkjøp";
-      "/dok/boker.php".return = "301 https://wiki.pvv.ntnu.no/wiki/Bokhyllen";
-      "/styret/lover/".return = "301 https://wiki.pvv.ntnu.no/wiki/Lover";
-      "/styret/".return = "301 https://wiki.pvv.ntnu.no/wiki/Styret";
-      "/info/".return = "301 https://wiki.pvv.ntnu.no/wiki/";
-      "/info/maskinpark/".return = "301 https://wiki.pvv.ntnu.no/wiki/Maskiner";
-      "/medlemssider/meldinn.php".return = "301 https://wiki.pvv.ntnu.no/wiki/Medlemskontingent";
-      "/diverse/medlems-sider.php".return = "301 https://wiki.pvv.ntnu.no/wiki/Medlemssider";
-      "/cert/".return = "301 https://wiki.pvv.ntnu.no/wiki/CERT";
-      "/drift".return = "301 https://wiki.pvv.ntnu.no/wiki/Drift";
-      "/diverse/abuse.php".return = "301 https://wiki.pvv.ntnu.no/wiki/CERT/Abuse";
-      "/nerds/".return = "301 https://wiki.pvv.ntnu.no/wiki/Nerdepizza";
-
-      # Proxy the matrix well-known files
-      # Host has be set before proxy_pass
-      # The header must be set so nginx on the other side routes it to the right place
-      "^~ /.well-known/matrix/" = {
-        extraConfig = ''
-          proxy_set_header Host matrix.pvv.ntnu.no;
-          proxy_pass https://matrix.pvv.ntnu.no/.well-known/matrix/;
-        '';
-      };
-    };
-  };
-}
--- a/hosts/bekkalokk/services/website/fetch-gallery.nix
+++ b/hosts/bekkalokk/services/website/fetch-gallery.nix
@@ -1,67 +0,0 @@
-{ pkgs, lib, config, ... }:
-let
-  galleryDir = config.services.pvv-nettsiden.settings.GALLERY.DIR;
-  transferDir = "${config.services.pvv-nettsiden.settings.GALLERY.DIR}-transfer";
-in {
-  users.users.${config.services.pvv-nettsiden.user} = {
-    useDefaultShell = true;
-
-    # This is pushed from microbel:/var/www/www-gallery/build-gallery.sh
-    openssh.authorizedKeys.keys = [
-    ''command="${pkgs.rrsync}/bin/rrsync -wo ${transferDir}",restrict,no-agent-forwarding,no-port-forwarding,no-pty,no-X11-forwarding ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIjHhC2dikhWs/gG+m7qP1eSohWzTehn4ToNzDSOImyR gallery-publish''
-    ];
-  };
-
-  systemd.paths.pvv-nettsiden-gallery-update = {
-    wantedBy = [ "multi-user.target" ];
-    pathConfig = {
-      PathChanged = "${transferDir}/gallery.tar.gz";
-      Unit = "pvv-nettsiden-gallery-update.service";
-      MakeDirectory = true;
-    };
-  };
-
-  systemd.services.pvv-nettsiden-gallery-update = {
-    path = with pkgs; [ imagemagick gnutar gzip ];
-
-    script = ''
-      tar ${lib.cli.toGNUCommandLineShell {} {
-        extract = true;
-        file = "${transferDir}/gallery.tar.gz";
-        directory = ".";
-      }}
-
-      # Delete files and directories that exists in the gallery that don't exist in the tarball
-      filesToRemove=$(uniq -u <(sort <(find . -not -path "./.thumbnails*") <(tar -tf ${transferDir}/gallery.tar.gz | sed 's|/$||')))
-      while IFS= read fname; do
-        rm -f "$fname" ||:
-        rm -f ".thumbnails/$fname.png" ||:
-      done <<< "$filesToRemove"
-
-      find . -type d -empty -delete
-
-      mkdir -p .thumbnails
-      images=$(find . -type f -not -path "./.thumbnails*")
-
-      while IFS= read fname; do
-        # Skip this file if an up-to-date thumbnail already exists
-        if [ -f ".thumbnails/$fname.png" ] && \
-           [ "$(date -R -r "$fname")" == "$(date -R -r ".thumbnails/$fname.png")" ]
-        then
-          continue
-        fi
-
-        echo "Creating thumbnail for $fname"
-        mkdir -p $(dirname ".thumbnails/$fname")
-        convert -define jpeg:size=200x200 "$fname" -thumbnail 300 -auto-orient ".thumbnails/$fname.png" ||:
-	touch -m -d "$(date -R -r "$fname")" ".thumbnails/$fname.png"
-      done <<< "$images"
-    '';
-
-    serviceConfig = {
-      WorkingDirectory = galleryDir;
-      User = config.services.pvv-nettsiden.user;
-      Group = config.services.pvv-nettsiden.group;
-    };
-  };
-}
--- a/hosts/bicep/configuration.nix
+++ b/hosts/bicep/configuration.nix
@@ -12,8 +12,7 @@
    ./services/mysql.nix
    ./services/postgres.nix
    ./services/mysql.nix
-    # TODO: fix the calendar bot
-    # ./services/calendar-bot.nix
+    ./services/calendar-bot.nix

    ./services/matrix
  ];
--- a/hosts/bicep/services/matrix/element.nix
+++ b/hosts/bicep/services/matrix/element.nix
@@ -5,7 +5,6 @@ in {
  services.nginx.virtualHosts."chat.pvv.ntnu.no" = {
    enableACME = true;
    forceSSL = true;
-    kTLS = true;

    root = pkgs.element-web.override {
      conf = {
@@ -25,26 +24,21 @@ in {
        features = {
          feature_latex_maths = true;
          feature_pinning = true;
-          feature_render_reaction_images = true;
          feature_state_counters = true;
-          # element call group calls
-          feature_group_calls = true;
+          feature_custom_status = false;
        };
        default_theme = "dark";
-        # Servers in this list should provide some sort of valuable scoping
-        # matrix.org is not useful compared to matrixrooms.info,
-        # because it has so many general members, rooms of all topics are on it.
-        # Something matrixrooms.info is already providing.
        room_directory.servers = [
          "pvv.ntnu.no"
-          "matrixrooms.info" # Searches all public room directories
-          "matrix.omegav.no" # Friends
-          "gitter.im" # gitter rooms
-          "mozilla.org" # mozilla and friends
-          "kde.org" # KDE rooms
-          "fosdem.org" # FOSDEM
-          "dodsorf.as" # PVV Member
-          "nani.wtf" # PVV Member
+          "matrix.omegav.no"
+          "matrix.org"
+          "libera.chat"
+          "gitter.im"
+          "mozilla.org"
+          "kde.org"
+          "t2bot.io"
+          "fosdem.org"
+          "dodsorf.as"
        ];
        enable_presence_by_hs_url = {
          "https://matrix.org" = false;
--- a/hosts/bicep/services/matrix/smtp-authenticator/smtp_auth_provider.py
+++ b/hosts/bicep/services/matrix/smtp-authenticator/smtp_auth_provider.py
@@ -5,10 +5,6 @@ from smtplib import SMTP_SSL as SMTP
 import synapse
 from synapse import module_api

-import re
-
-import logging
-logger = logging.getLogger(__name__)

 class SMTPAuthProvider:
    def __init__(self, config: dict, api: module_api):
@@ -31,10 +27,6 @@ class SMTPAuthProvider:
        if login_type != "m.login.password":
            return None

-        # Convert `@username:server` to `username`
-        match = re.match(r'^@([\da-z\-\.=_\/\+]+):[\w\d\.:\[\]]+$', username)
-        username = match.group(1) if match else username
-
        result = False
        with SMTP(self.config["smtp_host"]) as smtp:
            password = login_dict.get("password")
@@ -46,13 +38,8 @@ class SMTPAuthProvider:

        if result == True:
            userid = self.api.get_qualified_user_id(username)
-
-            userid = await self.api.check_user_exists(userid)
-            if not userid:
-                logger.info(f"user did not exist, registering {username}")
-                userid = await self.api.register_user(username)
-                logger.info(f"registered userid: {userid}")
+            if not self.api.check_user_exists(userid):
+                self.api.register_user(username)
            return (userid, None)
        else:
-            logger.info("returning None")
            return None
--- a/hosts/bicep/services/matrix/synapse.nix
+++ b/hosts/bicep/services/matrix/synapse.nix
@@ -134,6 +134,80 @@ in {
        "129.241.0.0/16"
        "2001:700:300::/44"
      ];
+
+      saml2_config = {
+        sp_config.metadata.remote = [
+          { url = "https://idp.pvv.ntnu.no/simplesaml/saml2/idp/metadata.php"; }
+        ];
+
+        description = [ "Matrix Synapse SP" "en" ];
+        name = [ "Matrix Synapse SP" "en" ];
+
+        ui_info = {
+          display_name = [
+            {
+              lang = "en";
+              text = "PVV Matrix login";
+            }
+          ];
+          description = [
+            {
+              lang = "en";
+              text = "Matrix is a modern free and open federated chat protocol";
+            }
+          ];
+          #information_url = [
+          #  {
+          #    lang = "en";
+          #    text = "";
+          #  };
+          #];
+          #privacy_statement_url = [
+          #  {
+          #    lang = "en";
+          #    text = "";
+          #  };
+          #];
+          keywords = [
+            {
+              lang = "en";
+              text = [ "Matrix" "Element" ];
+            }
+          ];
+          #logo = [
+          #  {
+          #    lang = "en";
+          #    text = "";
+          #    width = "";
+          #    height = "";
+          #  }
+          #];
+        };
+
+        organization = {
+          name = "Programvareverkstedet";
+          display_name = [ "Programvareverkstedet" "en" ];
+          url = "https://www.pvv.ntnu.no";
+        };
+        contact_person = [
+          { given_name = "Drift";
+            sur_name = "King";
+            email_adress = [ "drift@pvv.ntnu.no" ];
+            contact_type = "technical";
+          }
+        ];
+
+        user_mapping_provider = {
+          config = {
+            mxid_source_attribute =  "uid"; # What is this supposed to be?
+            mxid_mapping = "hexencode";
+          };
+        };
+
+        #attribute_requirements = [
+        #  {attribute = "userGroup"; value = "medlem";} # Do we have this?
+        #];
+      };
    };
  };

@@ -142,22 +216,7 @@ in {

  services.redis.servers."".enable = true;
  
-  services.nginx.virtualHosts."matrix.pvv.ntnu.no" = lib.mkMerge [
-  ({
-    kTLS = true;
-  })
-  ({
-    locations."/.well-known/matrix/server" = {
-      return = ''
-        200 '{"m.server": "matrix.pvv.ntnu.no:443"}'
-      '';
-      extraConfig = ''
-        default_type application/json;
-        add_header Access-Control-Allow-Origin *;
-      '';
-    };
-  })
-  ({
+  services.nginx.virtualHosts."matrix.pvv.ntnu.no" = lib.mkMerge [({
    locations = let
      connectionInfo = w: matrix-lib.workerConnectionResource "metrics" w;
      socketAddress = w: let c = connectionInfo w; in "${c.host}:${toString (c.port)}";
@@ -170,8 +229,6 @@ in {
        extraConfig = ''
          allow ${values.hosts.ildkule.ipv4};
          allow ${values.hosts.ildkule.ipv6};
-          allow ${values.hosts.ildkule.ipv4_global};
-          allow ${values.hosts.ildkule.ipv6_global};
          deny all;
        '';
      }))
@@ -183,8 +240,6 @@ in {
      extraConfig = ''
        allow ${values.hosts.ildkule.ipv4};
        allow ${values.hosts.ildkule.ipv6};
-        allow ${values.hosts.ildkule.ipv4_global};
-        allow ${values.hosts.ildkule.ipv6_global};
        deny all;
      '';
    };
--- a/hosts/bicep/services/nginx/default.nix
+++ b/hosts/bicep/services/nginx/default.nix
@@ -1,8 +1,15 @@
 { config, values, ... }:
 {
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "danio@pvv.ntnu.no";
+  };
+
  services.nginx = {
    enable = true;
+
    enableReload = true;
+
    defaultListenAddresses = [
      values.hosts.bicep.ipv4
      "[${values.hosts.bicep.ipv6}]"
@@ -11,5 +18,28 @@
      "127.0.0.2"
      "[::1]"
    ];
+
+    appendConfig = ''
+      pcre_jit on;
+      worker_processes 8;
+      worker_rlimit_nofile 8192;
+    '';
+
+    eventsConfig = ''
+      multi_accept on;
+      worker_connections 4096;
+    '';
+
+    recommendedProxySettings = true;
+    recommendedTlsSettings = true;
+    recommendedGzipSettings = true;
+    recommendedBrotliSettings = true;
+    recommendedOptimisation = true;
+  };
+
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
+
+  systemd.services.nginx.serviceConfig = {
+    LimitNOFILE = 65536;
  };
 }
--- a/hosts/bikkje/configuration.nix
+++ b/hosts/bikkje/configuration.nix
@@ -1,44 +0,0 @@
-{ config, pkgs, values, ... }:
-{
-    networking.nat = {
-    enable = true;
-    internalInterfaces = ["ve-+"];
-    externalInterface = "ens3";
-    # Lazy IPv6 connectivity for the container
-    enableIPv6 = true;
-  };
-
-  containers.bikkje = {
-    autoStart = true;
-    config = { config, pkgs, ... }: {
-      #import packages
-      packages = with pkgs; [
-          alpine
-          mutt
-          mutt-ics
-          mutt-wizard
-          weechat
-          weechatScripts.edit
-          hexchat
-          irssi
-          pidgin
-      ];
-
-      networking = {
-        firewall = {
-          enable = true;
-          # Allow SSH and HTTP and ports for email and irc
-          allowedTCPPorts = [ 80 22 194 994 6665 6666 6667 6668 6669 6697 995 993 25 465 587 110 143 993 995 ];
-          allowedUDPPorts = [ 80 22 194 994 6665 6666 6667 6668 6669 6697 995 993 25 465 587 110 143 993 995 ];
-        };
-        # Use systemd-resolved inside the container
-        # Workaround for bug https://github.com/NixOS/nixpkgs/issues/162686
-        useHostResolvConf = mkForce false;
-      };
-      
-      system.stateVersion = "23.11";
-      services.resolved.enable = true;
-    };
-  };
-
-};
--- a/hosts/bob/disks.nix
+++ b/hosts/bob/disks.nix
@@ -1,39 +0,0 @@
-# Example to create a bios compatible gpt partition
-{ lib, ... }:
-{
-  disko.devices = {
-    disk.disk1 = {
-      device = lib.mkDefault "/dev/sda";
-      type = "disk";
-      content = {
-        type = "gpt";
-        partitions = {
-          boot = {
-            name = "boot";
-            size = "1M";
-            type = "EF02";
-          };
-          esp = {
-            name = "ESP";
-            size = "500M";
-            type = "EF00";
-            content = {
-              type = "filesystem";
-              format = "vfat";
-              mountpoint = "/boot";
-            };
-          };
-          root = {
-            name = "root";
-            size = "100%";
-            content = {
-              type = "filesystem";
-              format = "ext4";
-              mountpoint = "/";
-            };
-          };
-        };
-      };
-    };
-  };
-}
--- a/hosts/brzeczyszczykiewicz/configuration.nix
+++ b/hosts/brzeczyszczykiewicz/configuration.nix
@@ -6,7 +6,7 @@
      ../../base.nix
      ../../misc/metrics-exporters.nix

-      ./services/grzegorz.nix
+      ../../modules/grzegorz.nix
    ];

  boot.loader.systemd-boot.enable = true;
--- a/hosts/brzeczyszczykiewicz/services/grzegorz.nix
+++ b/hosts/brzeczyszczykiewicz/services/grzegorz.nix
@@ -1,11 +0,0 @@
-{ config, ... }:
-{
-  imports = [ ../../../modules/grzegorz.nix ];
-
-  services.nginx.virtualHosts."${config.networking.fqdn}" = {
-    serverAliases = [
-      "bokhylle.pvv.ntnu.no"
-      "bokhylle.pvv.org"
-    ];
-  };
-}
--- a/hosts/buskerud/configuration.nix
+++ b/hosts/buskerud/configuration.nix
@@ -1,36 +0,0 @@
-{ config, pkgs, values, ... }:
-{
-  imports = [
-    ./hardware-configuration.nix
-    ../../base.nix
-    ../../misc/metrics-exporters.nix
-  ];
-
-  # buskerud does not support efi?
-  # boot.loader.systemd-boot.enable = true;
-  # boot.loader.efi.canTouchEfiVariables = true;
-  boot.loader.grub.enable = true;
-  boot.loader.grub.device = "/dev/sdb";
-
-  networking.hostName = "buskerud";
-  networking.search = [ "pvv.ntnu.no" "pvv.org" ];
-  networking.nameservers = [ "129.241.0.200" "129.241.0.201" ];
-  networking.tempAddresses = "disabled";
-
-  systemd.network.networks."enp3s0f0" = values.defaultNetworkConfig // {
-    matchConfig.Name = "enp3s0f0";
-    address = with values.hosts.buskerud; [ (ipv4 + "/25") (ipv6 + "/64") ];
-  };
-
-  # List packages installed in system profile
-  environment.systemPackages = with pkgs; [
-  ];
-
-  # This value determines the NixOS release from which the default
-  # settings for stateful data, like file locations and database versions
-  # on your system were taken. It‘s perfectly fine and recommended to leave
-  # this value at the release version of the first install of this system.
-  # Before changing this value read the documentation for this option
-  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
-  system.stateVersion = "23.05"; # Did you read the comment?
-}
--- a/hosts/grevling/configuration.nix
+++ b/hosts/grevling/configuration.nix
@@ -5,29 +5,19 @@
      ./hardware-configuration.nix
      ../../base.nix
      ../../misc/metrics-exporters.nix
-      ./disks.nix

-      ../../misc/builder.nix
+      ./services/openvpn
    ];

-  sops.defaultSopsFile = ../../secrets/bob/bob.yaml;
-  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
-  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
-  sops.age.generateKey = true;
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;

-  boot.loader.grub = {
-    enable = true;
-    efiSupport = true;
-    efiInstallAsRemovable = true;
-  };
+  networking.hostName = "grevling";

-  networking.hostName = "bob"; # Define your hostname.
-
-  systemd.network.networks."30-all" = values.defaultNetworkConfig // {
-    matchConfig.Name = "en*";
-    DHCP = "yes";
-    gateway = [ ];
-  };
+  # systemd.network.networks."30-eno1" = values.defaultNetworkConfig // {
+  #   matchConfig.Name = "eno1";
+  #   address = with values.hosts.georg; [ (ipv4 + "/25") (ipv6 + "/64") ];
+  # };

  # List packages installed in system profile
  environment.systemPackages = with pkgs; [
--- a/hosts/grevling/hardware-configuration.nix
+++ b/hosts/grevling/hardware-configuration.nix
@@ -8,29 +8,32 @@
    [ (modulesPath + "/installer/scan/not-detected.nix")
    ];

-  boot.initrd.availableKernelModules = [ "uhci_hcd" "ehci_pci" "ata_piix" "hpsa" "usb_storage" "usbhid" "sd_mod" "sr_mod" ];
+  boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" ];
  boot.initrd.kernelModules = [ ];
  boot.kernelModules = [ "kvm-intel" ];
  boot.extraModulePackages = [ ];

  fileSystems."/" =
-    { device = "/dev/disk/by-uuid/ed9654fe-575a-4fb3-b6ff-1b059479acff";
+    { device = "/dev/disk/by-uuid/33825f0d-5a63-40fc-83db-bfa1ebb72ba0";
      fsType = "ext4";
    };

-  swapDevices = [ ];
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/145E-7362";
+      fsType = "vfat";
+    };
+
+  swapDevices =
+    [ { device = "/dev/disk/by-uuid/7ed27e21-3247-44cd-8bcc-5d4a2efebf57"; }
+    ];

  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
  # (the default) this is the recommended approach. When using systemd-networkd it's
  # still possible to use this option, but it's recommended to use it in conjunction
  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.enp14s0f0.useDHCP = lib.mkDefault true;
-  # networking.interfaces.enp14s0f1.useDHCP = lib.mkDefault true;
-  # networking.interfaces.enp3s0f0.useDHCP = lib.mkDefault true;
-  # networking.interfaces.enp3s0f1.useDHCP = lib.mkDefault true;
-  # networking.interfaces.enp4s0f0.useDHCP = lib.mkDefault true;
-  # networking.interfaces.enp4s0f1.useDHCP = lib.mkDefault true;
+  # networking.interfaces.eno1.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp2s2.useDHCP = lib.mkDefault true;

  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
--- a/hosts/grevling/services/openvpn/default.nix
+++ b/hosts/grevling/services/openvpn/default.nix
@@ -0,0 +1,77 @@
+{ pkgs, lib, values, ... }:
+{
+  services.openvpn.servers."ov-tunnel" = {
+    config = let
+      conf = {
+        # TODO: use aliases
+        local = "129.241.210.191";
+        port = 1194;
+        proto = "udp";
+        dev = "tap";
+
+        # TODO: set up
+        ca = "";
+        cert = "";
+        key = "";
+        dh = "";
+
+        # Maintain a record of client <-> virtual IP address
+        # associations in this file.  If OpenVPN goes down or
+        # is restarted, reconnecting clients can be assigned
+        # the same virtual IP address from the pool that was
+        # previously assigned.
+        ifconfig-pool-persist = ./ipp.txt;
+
+        server-bridge = builtins.concatStringsSep " " [
+          "129.241.210.129"
+          "255.255.255.128"
+          "129.241.210.253"
+          "129.241.210.254"
+        ];
+
+        keepalive = "10 120";
+        cipher = "none";
+
+        user = "nobody";
+        group = "nobody";
+
+        status = "/var/log/openvpn-status.log";
+
+        client-config-dir = pkgs.writeTextDir "tuba" ''
+          # Sett IP-adr. for tap0 til tubas PVV-adr.
+          ifconfig-push ${values.services.tuba-tap} 255.255.255.128
+          # Hvordan skal man faa dette til aa funke, tro?
+          #ifconfig-ipv6-push 2001:700:300:1900::xxx/64
+          
+          # La tuba bruke std. PVV-gateway til all trafikk (unntatt
+          # VPN-tunnellen).
+          push "redirect-gateway"
+        '';
+
+        persist-key = true;
+        persist-tun = true;
+
+        verb = 5;
+
+        explicit-exit-notify = 1;
+      };
+    in lib.pipe conf [
+      (lib.filterAttrs (_: value: !(builtins.isNull value || value == false)))
+      (builtins.mapAttrs (_: value:
+        if builtins.isList value then builtins.concatStringsSep " " (map toString value)
+        else if value == true then value
+        else if builtins.any (f: f value) [
+          builtins.isString
+          builtins.isInt
+          builtins.isFloat
+          lib.isPath
+          lib.isDerivation
+        ] then toString value
+        else throw "Unknown value in grevling openvpn config, deading now\n${value}"
+      ))
+      (lib.mapAttrsToList (name: value: if value == true then name else "${name} ${value}"))
+      (builtins.concatStringsSep "\n")
+      (x: x + "\n\n")
+    ];
+  };
+}
--- a/hosts/grevling/services/openvpn/ipp.txt
+++ b/hosts/grevling/services/openvpn/ipp.txt
--- a/hosts/ildkule/configuration.nix
+++ b/hosts/ildkule/configuration.nix
@@ -6,8 +6,8 @@
      ../../base.nix
      ../../misc/metrics-exporters.nix

-      ./services/monitoring
      ./services/nginx
+      ./services/metrics
    ];

  sops.defaultSopsFile = ../../secrets/ildkule/ildkule.yaml;
@@ -15,21 +15,28 @@
  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
  sops.age.generateKey = true;

-  boot.loader.grub.device = "/dev/vda";
-  boot.tmp.cleanOnBoot = true;
-  zramSwap.enable = true;
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;

  networking.hostName = "ildkule"; # Define your hostname.
-  systemd.network.networks."30-all" = values.defaultNetworkConfig // {
-    matchConfig.Name = "en*";
-    DHCP = "yes";
-    gateway = [ ];
+
+  systemd.network.networks."30-ens18" = values.defaultNetworkConfig // {
+    matchConfig.Name = "ens18";
+    address = with values.hosts.ildkule; [ (ipv4 + "/25") (ipv6 + "/64") ];
  };

  # List packages installed in system profile
  environment.systemPackages = with pkgs; [
  ];

-  system.stateVersion = "23.11"; # Did you read the comment?
+  # List services that you want to enable:
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "21.11"; # Did you read the comment?

 }
--- a/hosts/ildkule/hardware-configuration.nix
+++ b/hosts/ildkule/hardware-configuration.nix
@@ -1,9 +1,37 @@
-{ modulesPath, lib, ... }:
-{
-  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
-  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "xen_blkfront" "vmw_pvscsi" ];
-  boot.initrd.kernelModules = [ "nvme" ];
-  fileSystems."/" = { device = "/dev/vda1"; fsType = "ext4"; };
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:

+{
+  imports =
+    [ (modulesPath + "/profiles/qemu-guest.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "sr_mod" "virtio_blk" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/afe70fe4-681a-4675-8cbd-e5d08cdcf5b5";
+      fsType = "ext4";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/B71A-E5CD";
+      fsType = "vfat";
+    };
+
+  swapDevices = [ ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.ens18.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }
--- a/hosts/ildkule/services/monitoring/dashboards/go-processes.json
+++ b/hosts/ildkule/services/monitoring/dashboards/go-processes.json
--- a/hosts/ildkule/services/monitoring/dashboards/mysql.json
+++ b/hosts/ildkule/services/monitoring/dashboards/mysql.json
--- a/hosts/ildkule/services/monitoring/dashboards/node-exporter-full.json
+++ b/hosts/ildkule/services/monitoring/dashboards/node-exporter-full.json
--- a/hosts/ildkule/services/monitoring/dashboards/postgres.json
+++ b/hosts/ildkule/services/monitoring/dashboards/postgres.json
--- a/hosts/ildkule/services/monitoring/dashboards/synapse.json
+++ b/hosts/ildkule/services/monitoring/dashboards/synapse.json
--- a/hosts/ildkule/services/monitoring/default.nix
+++ b/hosts/ildkule/services/monitoring/default.nix
@@ -2,9 +2,8 @@

 {
  imports = [
+    ./prometheus
    ./grafana.nix
    ./loki.nix
-    ./prometheus
-    ./uptime-kuma.nix
  ];
 }
--- a/hosts/ildkule/services/monitoring/grafana.nix
+++ b/hosts/ildkule/services/monitoring/grafana.nix
@@ -7,6 +7,7 @@ in {
  in {
    "keys/grafana/secret_key" = { inherit owner group; };
    "keys/grafana/admin_password" = { inherit owner group; };
+    "keys/postgres/grafana" = { inherit owner group; };
  };

  services.grafana = {
@@ -17,7 +18,7 @@ in {
      secretFile = path: "$__file{${path}}";
    in {
      server = {
-        domain = "grafana.pvv.ntnu.no";
+        domain = "ildkule.pvv.ntnu.no";
        http_port = 2342;
        http_addr = "127.0.0.1";
      };
@@ -26,6 +27,13 @@ in {
        secret_key = secretFile config.sops.secrets."keys/grafana/secret_key".path;
        admin_password = secretFile config.sops.secrets."keys/grafana/admin_password".path;
      };
+
+      database = {
+        type = "postgres";
+        user = "grafana";
+        host = "${values.hosts.bicep.ipv4}:5432";
+        password = secretFile config.sops.secrets."keys/postgres/grafana".path;
+      };
    };

    provision = {
@@ -83,7 +91,6 @@ in {
  services.nginx.virtualHosts.${cfg.settings.server.domain} = {
    enableACME = true;
    forceSSL = true;
-    kTLS = true;
    locations = {
      "/" = {
        proxyPass = "http://127.0.0.1:${toString cfg.settings.server.http_port}";
--- a/hosts/ildkule/services/monitoring/loki.nix
+++ b/hosts/ildkule/services/monitoring/loki.nix
--- a/hosts/ildkule/services/monitoring/prometheus/default.nix
+++ b/hosts/ildkule/services/monitoring/prometheus/default.nix
--- a/hosts/ildkule/services/monitoring/prometheus/gogs.nix
+++ b/hosts/ildkule/services/monitoring/prometheus/gogs.nix
--- a/hosts/ildkule/services/monitoring/prometheus/matrix-synapse.nix
+++ b/hosts/ildkule/services/monitoring/prometheus/matrix-synapse.nix
--- a/hosts/ildkule/services/monitoring/prometheus/mysqld.nix
+++ b/hosts/ildkule/services/monitoring/prometheus/mysqld.nix
@@ -1,4 +1,4 @@
-{ config, ... }: let
+{ config, unstable, ... }: let
  cfg = config.services.prometheus;
 in {
  sops.secrets."config/mysqld_exporter" = { };
--- a/hosts/ildkule/services/monitoring/prometheus/node.nix
+++ b/hosts/ildkule/services/monitoring/prometheus/node.nix
--- a/hosts/ildkule/services/monitoring/prometheus/postgres.nix
+++ b/hosts/ildkule/services/monitoring/prometheus/postgres.nix
--- a/hosts/ildkule/services/monitoring/prometheus/rules/synapse-v2.rules
+++ b/hosts/ildkule/services/monitoring/prometheus/rules/synapse-v2.rules
--- a/hosts/ildkule/services/monitoring/uptime-kuma.nix
+++ b/hosts/ildkule/services/monitoring/uptime-kuma.nix
@@ -1,20 +0,0 @@
-{ config, pkgs, lib, ... }:
-let
-  cfg = config.services.uptime-kuma;
-  domain = "status.pvv.ntnu.no";
-in {
-  services.uptime-kuma = {
-    enable = true;
-    settings = {
-      PORT = "5059";
-      HOST = "127.0.1.2";
-    };
-  };
-
-  services.nginx.virtualHosts.${domain} = {
-    enableACME = true;
-    forceSSL = true;
-    kTLS = true;
-    locations."/".proxyPass = "http://${cfg.settings.HOST}:${cfg.settings.PORT}";
-  };
-}
--- a/hosts/ildkule/services/nginx/default.nix
+++ b/hosts/ildkule/services/nginx/default.nix
@@ -1,7 +1,29 @@
 { config, values, ... }:
 {
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "drift@pvv.ntnu.no";
+  };
+
  services.nginx = {
    enable = true;
+
    enableReload = true;
+
+    defaultListenAddresses = [
+      values.hosts.ildkule.ipv4
+      "[${values.hosts.ildkule.ipv6}]"
+
+      "127.0.0.1"
+      "127.0.0.2"
+      "[::1]"
+    ];
+
+    recommendedProxySettings = true;
+    recommendedTlsSettings = true;
+    recommendedGzipSettings = true;
+    recommendedOptimisation = true;
  };
+
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
 }
--- a/hosts/tuba/configuration.nix
+++ b/hosts/tuba/configuration.nix
@@ -0,0 +1,36 @@
+{ config, pkgs, values, ... }:
+{
+  imports = [
+      # Include the results of the hardware scan.
+      ./hardware-configuration.nix
+      ../../base.nix
+      ../../misc/metrics-exporters.nix
+
+      ./services/openvpn
+    ];
+
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  networking.hostName = "tuba";
+
+  # systemd.network.networks."30-eno1" = values.defaultNetworkConfig // {
+  #   matchConfig.Name = "eno1";
+  #   address = with values.hosts.georg; [ (ipv4 + "/25") (ipv6 + "/64") ];
+  # };
+
+  # List packages installed in system profile
+  environment.systemPackages = with pkgs; [
+  ];
+
+  # List services that you want to enable:
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "23.05"; # Did you read the comment?
+
+}
--- a/hosts/tuba/hardware-configuration.nix
+++ b/hosts/tuba/hardware-configuration.nix
@@ -5,20 +5,36 @@

 {
  imports =
-    [ (modulesPath + "/profiles/qemu-guest.nix")
+    [ (modulesPath + "/installer/scan/not-detected.nix")
    ];

-  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_blk" ];
+  boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" ];
  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
  boot.extraModulePackages = [ ];

+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/33825f0d-5a63-40fc-83db-bfa1ebb72ba0";
+      fsType = "ext4";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/145E-7362";
+      fsType = "vfat";
+    };
+
+  swapDevices =
+    [ { device = "/dev/disk/by-uuid/7ed27e21-3247-44cd-8bcc-5d4a2efebf57"; }
+    ];
+
  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
  # (the default) this is the recommended approach. When using systemd-networkd it's
  # still possible to use this option, but it's recommended to use it in conjunction
  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.ens3.useDHCP = lib.mkDefault true;
+  # networking.interfaces.eno1.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp2s2.useDHCP = lib.mkDefault true;

  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }
--- a/hosts/tuba/services/openvpn/default.nix
+++ b/hosts/tuba/services/openvpn/default.nix
@@ -0,0 +1,54 @@
+{ lib, values, ... }:
+{
+  services.openvpn.servers."ov-tunnel" = {
+    config = let
+      conf = {
+        # TODO: use aliases
+        client = true;
+        dev = "tap";
+        proto = "udp";
+        remote = "129.241.210.191 1194";
+
+        resolv-retry = "infinite";
+        nobind = true;
+
+        # # TODO: set up
+        ca = "";
+        cert = "";
+        key = "";
+        remote-cert-tls = "server";
+        cipher = "none";
+
+        user = "nobody";
+        group = "nobody";
+
+        status = "/var/log/openvpn-status.log";
+
+        persist-key = true;
+        persist-tun = true;
+
+        verb = 5;
+
+        # script-security = 2;
+        # up = "systemctl restart rwhod";
+      };
+    in lib.pipe conf [
+      (lib.filterAttrs (_: value: !(builtins.isNull value || value == false)))
+      (builtins.mapAttrs (_: value:
+        if builtins.isList value then builtins.concatStringsSep " " (map toString value)
+        else if value == true then value
+        else if builtins.any (f: f value) [
+          builtins.isString
+          builtins.isInt
+          builtins.isFloat
+          lib.isPath
+          lib.isDerivation
+        ] then toString value
+        else throw "Unknown value in tuba openvpn config, deading now\n${value}"
+      ))
+      (lib.mapAttrsToList (name: value: if value == true then name else "${name} ${value}"))
+      (builtins.concatStringsSep "\n")
+      (x: x + "\n\n")
+    ];
+  };
+}
--- a/misc/builder.nix
+++ b/misc/builder.nix
@@ -1,5 +0,0 @@
-{ ... }:
-
-{
-  nix.settings.trusted-users = [ "@nix-builder-users" ];
-}
--- a/misc/metrics-exporters.nix
+++ b/misc/metrics-exporters.nix
@@ -14,8 +14,6 @@
      "::1"
      values.hosts.ildkule.ipv4
      values.hosts.ildkule.ipv6
-      values.hosts.ildkule.ipv4_global
-      values.hosts.ildkule.ipv6_global
    ];
  };

--- a/modules/grzegorz.nix
+++ b/modules/grzegorz.nix
@@ -24,12 +24,15 @@ in {
  services.grzegorz-webui.hostName = "${config.networking.fqdn}";
  services.grzegorz-webui.apiBase = "http://${toString grg.listenAddr}:${toString grg.listenPort}/api";

+  security.acme.acceptTerms = true;
+  security.acme.defaults.email = "pederbs@pvv.ntnu.no";
+
  services.nginx.enable = true;
+  networking.firewall.allowedTCPPorts = [ 80 443 ];

  services.nginx.virtualHosts."${config.networking.fqdn}" = {
    forceSSL = true;
    enableACME = true;
-    kTLS = true;
    serverAliases = [
      "${config.networking.hostName}.pvv.org"
    ];
--- a/modules/snakeoil-certs.nix
+++ b/modules/snakeoil-certs.nix
@@ -1,83 +0,0 @@
-{ config, pkgs, lib, ... }:
-let
-  cfg = config.environment.snakeoil-certs;
-in
-{
-  options.environment.snakeoil-certs = lib.mkOption {
-    default = { };
-    description = "Self signed certs, which are rotated regularly";
-    type = lib.types.attrsOf (lib.types.submodule ({ name, ... }: {
-      options = {
-        owner = lib.mkOption {
-          type = lib.types.str;
-          default = "root";
-        };
-        group = lib.mkOption {
-          type = lib.types.str;
-          default = "root";
-        };
-        mode = lib.mkOption {
-          type = lib.types.str;
-          default = "0660";
-        };
-        daysValid = lib.mkOption {
-          type = lib.types.str;
-          default = "90";
-        };
-        extraOpenSSLArgs = lib.mkOption {
-          type = with lib.types; listOf str;
-          default = [ ];
-        };
-        certificate = lib.mkOption {
-          type = lib.types.str;
-          default = "${name}.crt";
-        };
-        certificateKey = lib.mkOption {
-          type = lib.types.str;
-          default = "${name}.key";
-        };
-	subject = lib.mkOption {
-	  type = lib.types.str;
-	  default = "/C=NO/O=Programvareverkstedet/CN=*.pvv.ntnu.no/emailAddress=drift@pvv.ntnu.no";
-	};
-      };
-    }));
-  };
-
-  config = {
-    systemd.services."generate-snakeoil-certs" = {
-      enable = true;
-      serviceConfig.Type = "oneshot";
-      script = let
-        openssl = lib.getExe pkgs.openssl;
-      in lib.concatMapStringsSep "\n----------------\n" ({ name, value }: ''
-        mkdir -p $(dirname "${value.certificate}") $(dirname "${value.certificateKey}")
-        if ! ${openssl} x509 -checkend 86400 -noout -in ${value.certificate}
-        then
-           echo "Regenerating '${value.certificate}'"
-           ${openssl} req \
-             -newkey rsa:4096 \
-             -new -x509 \
-             -days "${toString value.daysValid}" \
-             -nodes \
-             -subj "${value.subject}" \
-             -out "${value.certificate}" \
-             -keyout "${value.certificateKey}" \
-             ${lib.escapeShellArgs value.extraOpenSSLArgs}
-        fi
-        chown "${value.owner}:${value.group}" "${value.certificate}"
-        chown "${value.owner}:${value.group}" "${value.certificateKey}"
-        chmod "${value.mode}" "${value.certificate}"
-        chmod "${value.mode}" "${value.certificateKey}"
-      '') (lib.attrsToList cfg);
-    };
-    systemd.timers."generate-snakeoil-certs" = {
-      wantedBy = [ "timers.target" ];
-      timerConfig = {
-        OnCalendar = "*-*-* 02:00:00";
-        Persistent = true;
-        Unit = "generate-snakeoil-certs.service";
-      };
-    };
-  };
-}
--- a/modules/wackattack-ctf-stockfish/chess.py
+++ b/modules/wackattack-ctf-stockfish/chess.py
@@ -0,0 +1,74 @@
+#!/usr/bin/env python3
+from stockfish import *
+from inputimeout import inputimeout
+import time
+from datetime import datetime
+import random
+
+thinking_time = 1000
+
+game = Stockfish(path="./stockfish", depth=15, parameters={"Threads": 1, "Minimum Thinking Time": thinking_time, "UCI_Chess960": True})
+
+def create_random_position():
+    pos = "/pppppppp/8/8/8/8/PPPPPPPP/"
+    rank8 = ["r","r","b","q","k","b","n","n"]
+
+    while rank8.index("k") < [i for i, n in enumerate(rank8) if n == "r"][0] or rank8.index("k") > [i for i, n in enumerate(rank8) if n == "r"][1] or [i for i, n in enumerate(rank8) if n == "b"][0] % 2 == [i for i, n in enumerate(rank8) if n == "b"][1] % 2:
+        random.seed(datetime.now().microsecond)
+        random.shuffle(rank8)
+
+    rank1 = [c.upper() for c in rank8]
+    pos = "".join(rank8) + pos + "".join(rank1) + " w KQkq - 0 1"
+    game.set_fen_position(pos)
+
+def player_won():
+    with open("flag.txt") as file:
+        flag = file.read()
+    print(flag)
+    exit()
+
+def get_fast_player_move():
+    try:
+        time_over = inputimeout(prompt='Your move: ', timeout=5)
+    except Exception:
+        time_over = 'Too slow, you lost!'
+        print(time_over)
+        exit()
+    return time_over
+
+def check_game_status():
+    evaluation = game.get_evaluation()
+    turn = game.get_fen_position().split(" ")[1]
+    if evaluation["type"] == "mate" and evaluation["value"] == 0 and turn == "w":
+        print("Wow, you beat me!")
+        player_won()
+    elif evaluation["type"] == "mate" and evaluation["value"] == 0 and turn == "b":
+        print("Hah, I won again")
+        exit()
+    if evaluation["type"] == "draw":
+        print("It's a draw!")
+        print("Impressive, but I am still undefeated.")
+        exit()
+
+if __name__ == "__main__":
+    create_random_position()
+    print("Welcome to fischer chess.\nYou get 5 seconds per move. Good luck")
+    print(game.get_board_visual())
+    print("Heres the position for this game, Ill give you a few seconds to look at it before we start.")
+    time.sleep(3)
+    while True:
+        server_move = game.get_best_move_time(thinking_time)
+        game.make_moves_from_current_position([server_move])
+        check_game_status()
+        print(game.get_board_visual())
+        print(f"My move: {server_move}")
+        player_move = get_fast_player_move()
+        if type(player_move) != str or len([player_move]) != 1:
+            print("Illegal input")
+            exit()
+        try:
+            game.make_moves_from_current_position([player_move])
+            check_game_status()
+        except:
+            print("Couldn't comprehend that")
+            exit()
--- a/modules/wackattack-ctf-stockfish/default.nix
+++ b/modules/wackattack-ctf-stockfish/default.nix
@@ -0,0 +1,108 @@
+{ config, pkgs, lib, ... }: let
+  stockfish = with pkgs.python3Packages; buildPythonPackage rec {
+    pname = "stockfish";
+    version = "3.28.0";
+    disabled = pythonOlder "3.7";
+
+    src = pkgs.fetchFromGitHub {
+      owner = "zhelyabuzhsky";
+      repo = pname;
+      rev = version;
+      hash = "sha256-XLgVjLV2QXeTYPjP/lwc0LH850LKJsymFlrAMkAn8HU=";
+    };
+
+    format = "setuptools";
+    nativeBuildInputs = [
+      setuptools
+    ];
+
+    propagatedBuildInputs = [
+      pytest-runner
+    ];
+
+    doCheck = false;
+  };
+
+  inputimeout = with pkgs.python3Packages; buildPythonPackage rec {
+    pname = "inputimeout";
+    version = "1.0.4";
+    src = pkgs.fetchFromGitHub {
+      owner = "johejo";
+      repo = pname;
+      rev = "v${version}";
+      hash = "sha256-Fh1CaqJOK58nURt4imkhCmZKG2eJlP/Hi10SarUJ+Fs=";
+    };
+
+    format = "setuptools";
+    nativeBuildInputs = [ setuptools ];
+
+    doCheck = false;
+  };
+
+  script = pkgs.writers.writePython3 "chess" {
+    libraries = [
+      stockfish
+      inputimeout   
+    ];
+
+    # Fy!
+    flakeIgnore = [ "F403" "F405" "E231" "E265" "E302" "E305" "E501" "E722" ];
+  } (builtins.replaceStrings [''path="./stockfish"''] [''path="${pkgs.stockfish}/bin/stockfish"''] (builtins.readFile ./chess.py));
+in
+{
+  sops.secrets."keys/wackattack_ctf/flag" = { };
+
+  systemd.sockets."wackattack-ctf-stockfish" = {
+    description = "Save some azure credit for the rest of us";
+    partOf = [ "wackattack-ctf-stockfish.service" ];
+    wantedBy = [ "sockets.target" ];
+
+    socketConfig = {
+      ListenStream = "0.0.0.0:9999";
+      Accept = true;
+    };
+  };
+
+  systemd.services."wackattack-ctf-stockfish@" = {
+    description = "Save some azure credit for the rest of us";
+    after = [ "network.target" ];
+    requires = [ "wackattack-ctf-stockfish.socket" ];
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig = {
+      Type = "simple";
+      DynamicUser = true;
+      WorkingDirectory = "%d";
+      Restart = "always";
+      StandardInput = "socket";
+      LoadCredential = "flag.txt:${config.sops.secrets."keys/wackattack_ctf/flag".path}";
+
+      Exec = script;
+
+      # systemd hardening go barr
+      ProcSubset = "pid";
+      ProtectProc = "invisible";
+      AmbientCapabilities = "";
+      CapabilityBoundingSet = "";
+      NoNewPrivileges = true;
+      ProtectSystem = "strict";
+      ProtectHome = true;
+      PrivateTmp = true;
+      PrivateDevices = true;
+      PrivateUsers = true;
+      ProtectHostname = true;
+      ProtectClock = true;
+      ProtectKernelTunables = true;
+      ProtectKernelModules = true;
+      ProtectKernelLogs = true;
+      ProtectControlGroups = true;
+      RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+      RestrictNamespaces = true;
+      LockPersonality = true;
+      RestrictRealtime = true;
+      RestrictSUIDSGID = true;
+      RemoveIPC = true;
+      PrivateMounts = true;
+      SystemCallArchitectures = "native";
+    };
+  };
+}
--- a/overlays/nginx-test.nix
+++ b/overlays/nginx-test.nix
@@ -1,28 +0,0 @@
-acme-certs: final: prev:
-  let
-    lib = final.lib;
-    crt = "${final.path}/nixos/tests/common/acme/server/acme.test.cert.pem";
-    key = "${final.path}/nixos/tests/common/acme/server/acme.test.key.pem";
-  in {
-  writers = prev.writers // {
-    writeNginxConfig = name: text: final.runCommandLocal name {
-      nginxConfig = prev.writers.writeNginxConfig name text;
-      nativeBuildInputs = [ final.bubblewrap ];
-    } ''
-      ln -s "$nginxConfig" "$out"
-      set +o pipefail
-      bwrap \
-        --ro-bind "${crt}" "/etc/certs/nginx.crt" \
-        --ro-bind "${key}" "/etc/certs/nginx.key" \
-        --ro-bind "/nix" "/nix" \
-        --ro-bind "/etc/hosts" "/etc/hosts" \
-        --dir "/run/nginx" \
-        --dir "/tmp" \
-        --dir "/var/log/nginx" \
-        ${lib.concatMapStrings (name: "--ro-bind \"${crt}\" \"/var/lib/acme/${name}/fullchain.pem\" \\") acme-certs}
-        ${lib.concatMapStrings (name: "--ro-bind \"${key}\" \"/var/lib/acme/${name}/key.pem\" \\") acme-certs}
-        ${lib.concatMapStrings (name: "--ro-bind \"${crt}\" \"/var/lib/acme/${name}/chain.pem\" \\") acme-certs}
-        ${lib.getExe' final.nginx "nginx"} -t -c "$out" |& grep "syntax is ok"
-    '';
-  };
-}
--- a/packages/mediawiki-extensions/default.nix
+++ b/packages/mediawiki-extensions/default.nix
@@ -1,8 +0,0 @@
-{ pkgs, lib }:
-lib.makeScope pkgs.newScope (self: {
-  DeleteBatch = self.callPackage ./delete-batch { };
-  PluggableAuth = self.callPackage ./pluggable-auth { };
-  SimpleSAMLphp = self.callPackage ./simple-saml-php { };
-  UserMerge = self.callPackage ./user-merge { };
-  VisualEditor = self.callPackage ./visual-editor { };
-})
--- a/packages/mediawiki-extensions/delete-batch/default.nix
+++ b/packages/mediawiki-extensions/delete-batch/default.nix
@@ -1,7 +0,0 @@
-{ fetchzip }:
-
-fetchzip {
-  name = "mediawiki-delete-batch";
-  url = "https://extdist.wmflabs.org/dist/extensions/DeleteBatch-REL1_41-5774fdd.tar.gz";
-  hash = "sha256-ROkn93lf0mNXBvij9X2pMhd8LXZ0azOz7ZRaqZvhh8k=";
-}
--- a/packages/mediawiki-extensions/pluggable-auth/default.nix
+++ b/packages/mediawiki-extensions/pluggable-auth/default.nix
@@ -1,7 +0,0 @@
-{ fetchzip }:
-
-fetchzip {
-  name = "mediawiki-pluggable-auth-source";
-  url = "https://extdist.wmflabs.org/dist/extensions/PluggableAuth-REL1_41-d5b3ad8.tar.gz";
-  hash = "sha256-OLlkKeSlfNgWXWwDdINrYRZpYuSGRwzZHgU8EYW6rYU=";
-}
--- a/packages/mediawiki-extensions/simple-saml-php/default.nix
+++ b/packages/mediawiki-extensions/simple-saml-php/default.nix
@@ -1,7 +0,0 @@
-{ fetchzip }:
-
-fetchzip {
-  name = "mediawiki-simple-saml-php-source";
-  url = "https://extdist.wmflabs.org/dist/extensions/SimpleSAMLphp-REL1_41-9ae0678.tar.gz";
-  hash = "sha256-AmCaG5QXMJvi3N6zFyWylwYDt8GvyIk/0GFpM1Y0vkY=";
-}
--- a/packages/mediawiki-extensions/update-mediawiki-extensions.py
+++ b/packages/mediawiki-extensions/update-mediawiki-extensions.py
@@ -1,66 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i python3 -p "python3.withPackages(ps: with ps; [ beautifulsoup4 requests ])"
-
-import os
-from pathlib import Path
-import re
-import subprocess
-from collections import defaultdict
-from pprint import pprint
-
-import bs4
-import requests
-
-BASE_URL = "https://extdist.wmflabs.org/dist/extensions"
-
-def fetch_plugin_list(skip_master=True) -> dict[str, list[str]]:
-    content = requests.get(BASE_URL).text
-    soup = bs4.BeautifulSoup(content, features="html.parser")
-    result = defaultdict(list)
-    for a in soup.find_all('a'):
-        if skip_master and 'master' in a.text:
-            continue
-        split = a.text.split('-')
-        result[split[0]].append(a.text)
-    return result
-
-def update(package_file: Path, plugin_list: dict[str, list[str]]) -> None:
-    assert package_file.is_file()
-    with open(package_file) as file:
-        content = file.read()
-
-    tarball = re.search(f'url = "{BASE_URL}/(.+\.tar\.gz)";', content).group(1)
-    split = tarball.split('-')
-    updated_tarball = plugin_list[split[0]][-1]
-
-    _hash = re.search(f'hash = "(.+?)";', content).group(1)
-
-    out, err = subprocess.Popen(
-        ["nix-prefetch-url", "--unpack", "--type", "sha256", f"{BASE_URL}/{updated_tarball}"],
-        stdout=subprocess.PIPE,
-        stderr=subprocess.PIPE
-    ).communicate()
-    out, err = subprocess.Popen(
-        ["nix", "hash", "to-sri", "--type", "sha256", out.decode().strip()],
-        stdout=subprocess.PIPE,
-        stderr=subprocess.PIPE
-    ).communicate()
-
-    updated_hash = out.decode().strip()
-
-    if tarball == updated_tarball and _hash == updated_hash:
-        return
-
-    print(f"Updating: {tarball} ({_hash[7:14]}) -> {updated_tarball} ({updated_hash[7:14]})")
-
-    updated_text = re.sub(f'url = "{BASE_URL}/.+?\.tar\.gz";', f'url = "{BASE_URL}/{updated_tarball}";', content)
-    updated_text = re.sub('hash = ".+";', f'hash = "{updated_hash}";', updated_text)
-    with open(package_file, 'w') as file:
-        file.write(updated_text)
-
-if __name__ == "__main__":
-    plugin_list = fetch_plugin_list()
-
-    for direntry in os.scandir(Path(__file__).parent):
-        if direntry.is_dir():
-            update(Path(direntry) / "default.nix", plugin_list)
--- a/packages/mediawiki-extensions/user-merge/default.nix
+++ b/packages/mediawiki-extensions/user-merge/default.nix
@@ -1,7 +0,0 @@
-{ fetchzip }:
-
-fetchzip {
-  name = "mediawiki-user-merge-source";
-  url = "https://extdist.wmflabs.org/dist/extensions/UserMerge-REL1_41-a53af3b.tar.gz";
-  hash = "sha256-TxUkEqMW79thYl1la2r+w9laRnd3uSYYg1xDB+1he1g=";
-}
--- a/packages/mediawiki-extensions/visual-editor/default.nix
+++ b/packages/mediawiki-extensions/visual-editor/default.nix
@@ -1,7 +0,0 @@
-{ fetchzip }:
-
-fetchzip {
-  name = "mediawiki-visual-editor-source";
-  url = "https://extdist.wmflabs.org/dist/extensions/VisualEditor-REL1_40-5f8c97e.tar.gz";
-  hash = "sha256-oBMmEDKsFxrD0tpN2dy264IXK164BrZWrNK3v3FNX6w=";
-}
--- a/packages/simplesamlphp/default.nix
+++ b/packages/simplesamlphp/default.nix
@@ -1,38 +0,0 @@
-{ lib
-, php
-, writeText
-, fetchFromGitHub
-, extra_files ? { }
-
-}:
-
-php.buildComposerProject rec {
-  pname = "simplesamlphp";
-  version = "2.2.1";
-
-  src = fetchFromGitHub {
-    owner = "simplesamlphp";
-    repo = "simplesamlphp";
-    rev = "v${version}";
-    hash = "sha256-jo7xma60M4VZgeDgyFumvJp1Sm+RP4XaugDkttQVB+k=";
-  };
-
-  composerStrictValidation = false;
-
-  vendorHash = "sha256-n6lJ/Fb6xI124PkKJMbJBDiuISlukWQcHl043uHoBb4=";
-
-  # TODO: metadata could be fetched automagically with these:
-  #   - https://simplesamlphp.org/docs/contrib_modules/metarefresh/simplesamlphp-automated_metadata.html
-  #   - https://idp.pvv.ntnu.no/simplesaml/saml2/idp/metadata.php
-  postPatch = lib.pipe extra_files [
-    (lib.mapAttrsToList (target_path: source_path: ''
-      mkdir -p $(dirname "${target_path}")
-      cp -r "${source_path}" "${target_path}"
-    ''))
-    (lib.concatStringsSep "\n")
-  ];
-
-  postInstall = ''
-    ln -sr $out/share/php/simplesamlphp/vendor/simplesamlphp/simplesamlphp-assets-base $out/share/php/simplesamlphp/public/assets/base
-  '';
-}
--- a/secrets/bekkalokk/bekkalokk.yaml
+++ b/secrets/bekkalokk/bekkalokk.yaml
@@ -10,23 +10,12 @@ gitea:
        epsilon: ENC[AES256_GCM,data:JMnZVBdiy+5oPyXgDpfYvy7qLzIEfHy09fQSBDpNG4zDXTil2pSKBKxk09h5xg==,iv:/8oXKJW6+sMBjDt51MqVAWjQPM5nk02Lv5QqbZsZ5ms=,tag:+Rx7ursfVWc0EcExCLgLhQ==,type:str]
 mediawiki:
    password: ENC[AES256_GCM,data:HsBuA1E7187roGnKuFPfPDYxA16GFjAUucgUtrdUFmcOzmTNiFH+NWY2ZQ==,iv:vDYUmmZftcrkDtJxNYKAJSx9j+AQcmQarC62QRHR4IM=,tag:3TKjNrGRivFWoK3djC748g==,type:str]
-    postgres_password: ENC[AES256_GCM,data:XIOmrOVXWvMMcPJtmovhdyZvLlhmrsrwjuMMkdEY1NIXWjevj5XEkp6Cpw==,iv:KMPTRzu3H/ewfEhc/O0q3o230QNkABfPYF/D1SYL2R8=,tag:sFZiFPHWxwzD9HndPmH3pQ==,type:str]
-    simplesamlphp:
-        postgres_password: ENC[AES256_GCM,data:FzykBVtJbA+Bey1GE5VqnSuv2GeobH1j,iv:wayQH3+y0FYFkr3JjmulI53SADk0Ikur/2mUS5kFrTk=,tag:d+nQ/se2bDA5aaQfBicnPQ==,type:str]
-        cookie_salt: ENC[AES256_GCM,data:BioRPAvL4F9ORBJDFdqHot81RhVpAOf32v1ah3pvOLq8E88bxGyKFQZxAwpIL3UkWQIsWMnEerm5MEMYL1C2OQ==,iv:yMVqiPTQ8hO1IVAax6PIkD0V9YTOEunwDTtnGcmy6Kc=,tag:Z4+bZF4olLlkx7YpXeQiUw==,type:str]
-        admin_password: ENC[AES256_GCM,data:4eUXvcO7NLOWke9XShfKzj+x3FvqPONa,iv:3iZ+BTBTZ7yMJ0HT14cEMebKZattWUcYEevRsl/6WOk=,tag:CU0iDhPP2ndztdX5U5A4cw==,type:str]
-idp:
-    cookie_salt: ENC[AES256_GCM,data:cyV6HDCPHKQIa8T1+rFBFh6EuHtG5B508lg6uFYENK7qVpYuiTUIokdVQhY8SRLs2mECx/ampgnUHxCRB/Cc/A==,iv:QRrRUhzRQrLkmg38rrYtCEfF8U4/7ZHZUDSEq++BlbI=,tag:fLqFSLd+CKqJvmCh1fx8vg==,type:str]
-    admin_password: ENC[AES256_GCM,data:Vf33Oenk6x6BIij1uW8RQDjTPcKhUVYA,iv:RNeyCNpTAYdBPrZwE3Y6CCjoAML/3XUvjfJCrr06IEU=,tag:zVOrx1oXnEyr/VwFCFaCDQ==,type:str]
-    postgres_password: ENC[AES256_GCM,data:HGwKLbn/umPLPgH+qpXtugvXzOcXdlhK,iv:ypTW0VLSape8K5aCYu3BdjG/oMmqvfDSLw9uGLthb0Q=,tag:qlDMGz59qzMwEwBYxsC0XQ==,type:str]
-    privatekey: ENC[AES256_GCM,data:pK74wjuk9lt2PNJIzi6NpPBkxcSRsBZJl28BElUiri2zz17CY81x66CMlFsNjvzKB3JVX+b28FHFuSsEpd/mAPtmzZPR+CoWBHvU+OrSYYoufBxexRTtXzu0vx/KFL4X5tsb+GCgfm72CM+u9dElYHJzn3teBUmZc0pIoF29slTuwF+iZrbFwaieECxXMjHC9f+ivxWQsOvYFjhmAwgjBw/LsfURgLxZwcIRiiKsN41P2WtR9a/hjN53sJnihL9VZw/Xbbynm+bDmaAwhKUAZR28TU9Q1PTfNPEAOMoRgKF4MFuhQ5o0Cxq8RRz7fwCcCTV2sK4jgL7gKiy/gI/K41ybPQPon3NrDj3U2G1VhNgBfSNaTHgygiWI08HGWRHk83eJPHp3Ph8/A774g15SE10BXkL12n0kzodsZWYu3ybrhp167vL/ZW3xUnvFFlm4dTX/ndwS5rp1dIW0a5/0EDwMoGIJw94W5ph5sK9YoUTXwLdAJ9UWRZKQGk6iJstq2BMEBAN2BCSPHS2cflMjoVV4KKX1eq6s8/w6YFzCSQkt3+pGQ3DmiOaaqiv7sUfxyfMDzDcuTVETYRhsvr1ChfBFNn1yoH8BffeVTI2Ei3Edek1vXcg05mHxslhCmzQ4U4us0agtpm2Ar6ppvuedJHLWLFz8pgWSENeGdRcbz0CXiy7lIEYW4uQBru4MAjQ+ZQhz/F4L6At60Q4NelYMDxryQ8LxV0fA/ba2llwl8bDHDFDYkxu3/IaaWG8bp1i6gqvEao3/CRpPt/OAJGAHO3HViPm6xmWlWinUEatNlgCoDotkc56eZU/Af/P7R0QPQF0PpEIDHPcNjc/HcfheUXzJSzkD7wja8VB6rtqdRHFC793QsgdHJMJ+/bvJWZSQciSwaY3PBKLLuB6vrn7VD2NB4cE6beaGwneiAn83lAV+I4cJMDQFLkhWm8LIC7JIZKq/7eBfDEmajWEBL6wSbomBi/UGbA+FyvOokYYMemwVu1JGULcz9Lvn6pxkftQlN0gqE3MncrcZ/l59fepbka/z8oqH6i+3nKdaEh6D+WudD/0xiJSdXAVM6jGrxQtFc1R+OmGTTKJB4aLqgcM25YQ760wKavx5+B52pSki7XdYLmb6Xbnnv7AnyCNmGcpcj795P7qasE2sVokqq9a2PZD7VhP9TPHGtEO6QkkNV5gLxGsGvmshMM8KQgjK60HPQuSfHFVN/SlcOKvvH5ec8sBuYUt24xcDPewV9cXZwjcmwufFOVbC72FTEmU5qvmKobJTGjjbhWsHwpopESctmXuArIcVPsX5jSe3C9Y+9tjbkBGW6/+o8pTfodsjioXevVDXwjVBmGYk8xjZtF6/xfhpWvfunDXgEhnpT4i6ikoQiva8Mw8NvLe8U8Ivr6qCDE4ys4RTs56aw/CJHzydKjX96ZPzim52fAIJvEt1HvMvQx/O/q00h0WujYBcSBivYDtl7hC2fl6pBvM7fjipbeF04idkAKKXf4j6SGunx4hWq+eIA5tnlG8XVZZKIpdXKLgarvWs5pLlTSAK5ckF/yddcik7gAZc+pwo8kCAXIXPisX/yw9cZhI51PNTG1yxtPHAWKgULYLoWcnBCGTmPVXmj6IhpGuNuQ18TTpEtwnrMmcGq6aG/M2ZI+oq0q6suJUWwsCKUVM/TS6SKXEArzDtOMdXgyyDC/H3u+w3Bt/DwALLacq6lwoKBJZxQ6ewv3+ZkLcOkMRKu97hgV+rKmFqdPXqs+Skrf2MRl48sUCPIUXhD46ocFNpemcXcr73G7AxmmFLT6T4ZFm69K6eftUP6FsgUwbed+SaWTeptaG+wueL1NECoXafGlJAmXkjbBdWVgF2oMQFP3Kau135fiqmHpoWGzG5UhKxshTTtRIvbG/296NOkNZWBT/VzjwZti3IUka7HjC3leu28IlLsN0fsNPjQc2uIR3uVsR020g6et0m/Nys9gHDWXG/aCAYKhrgU8w37ZHBs383rkl4uUIYJH61SmTS4JP/wgh/+Q1aU8gXaZ8/Bc0BZUJdF3JR48fjkuMi2A8q5vkTQ1yFCvbBTtdg336v5tZc/xOW5/pt0W1Y7IgPFwHNh4iPAtKQZ3Qybh5PXs4N80YeYFWIjV6Ai0uY4yPdwYPfd1pRdpf3Ll+bhnbDPg0ye4f9lAhSR/cAZpft7BTd6W6jCv8QfWZcDmoBGZy68GZsYfCJ3QAo6szxzDtuyp7WMJRxioPt1EVA9q+8Rp7hHmZosoZOIUV+q3W5yZymL/PXZABiIc2OW9kryNlxQlBo79CSLGdXWeMq3dN1MSWoKJzxEseQqtSY5E1DYQosT1+3B8DXm77WSLMuB6OLjEz760y8jyIiLTGAVslcOb5XNfrQf5+l52nxCl/uSZo9FxiKg7ip0v3PZLuFSTSEaR2R2WeSuv/KoXi7WxFiG6VskpyL5jMhBwjepExFVosrOi4XugqR8vD3byTYUnmQvWJyyrI2LqQsYsa3o65SIO4g8SMKRsJJ8WWHpywLjF00HJSWiGRu8bQguvDTQd3UP6lgudzpubERXuUIBiMPqBKFJ1QTWA6N/t7dxR7NVaSexrGmY4ZSoIBKb9Jnge/+lkKrO9CgqDQpTAAvwwBZpFOV7EYLZNRpW+F8HaCNMeql7V/nFqdaaNdm9yLBhXbaeujalyiLtvBCghe330JVjbBTYWiRulJ2xnlX4GLzORBRIVHJYjxEKzCeVW7J2wAKkJ6gx5rlfDOd6r+Tf+1L8ZZoJEdBhIW7flslxo4amGRTI9QGJKVCIq/hrUGEgIAKsDsqTd21lVdhy+EDM+gumO7FbMcqVPRpwmQMFAZbJgH6TeS46tA4XQJGbwQhhBaqVb3jz7OJVOZ9C3/XfxPPpK4B2OyqINKNIRfyZ0fSmGlIT4LPf2IUEDCEKuPd3ClX51qNnVAPt/MbooF++Vp91KImdqCHwdiAygZTH9u91UN8S9IW8vo0XE4eAgdInjOM+IzUPhC+G8i6UNHbOpfQ7dntDc2nCv4nFKLjLZrgpm2kFrQ60/gDlbXBFF2eRcfYkSQSxVLWC4kWF1ce9YZf/j6erm6GnsQiyNoePe/Nb0v2f5DAR+9yoSJEOAi/AHacA9Dq5kfcoOYCrLkoc17SKQYmy/M9m5Mh3inI/O4wbUQrYDKHT0j77BJnkY11M6AiEF9YC0F4lCV4hIefQ3PnI4nmmo9b8rHnqvmrwUZrcOom6Zp+A7ydo4t0Bw1cDzEwJfpcb3JjpFi7F32/vHHLtGuPDvcJqkhw8VLuaAWAcEPJcIHJ+vAKCGWtDH7yQEOhFq4touwyPYDWBA5tqPY2xkFIAImFRhyLtTQupiNbZVR4G4dj24l8uQl2iz9aoDbJlNhoT+9YhwrKrYdM6hqnvpmiYqLIM+2kijZ8JmBS0BWNLCr+6rnbZbEB5e1ezokice8HQ1XcXbsegcI+eJ+gfDhYKw75VVyOd1Uy/pjLCCwQTywTIbf3iSuETvs3YjQrET1m7GJm3q8G4dx2M9c2B7R6B0ej06pkC4WwzFg3hEG6z2BaNrkopKkoE99bjoB2VHkgGTe+YM1Q3t+jA8IB7XNlnVH82AJ6eDMqgGSWBZiGxwx0KVUMg7cTi0iD6JNSYea0ykw+fh7Mj+8N0zhmzdUjdNBwZqxHVUbqIhUhk6meGRN5EASyt6qR329AqzbKaloS2VqjLjDkSEMhQfL4jHa8yPp8Cyj6EjgM2n5LnZs0u/43eh0h4ig3zQYMkwrHixI5hNQTBwSm3QnNpr3OnXAlypCPbCTiMC5sxHfrSTFkmjduT29aZ5qHQOc5zYG5bE2CmhWJdCOZm1s1mUT+Pxbxf4m/sh8w7TwnA+leD1rUvwYfyl5WI8f071vPcg62uTwScxr+TErvdzAkg9HElnsO6km0IncHIh79zexCR51CrtrZAVxc1gnnDtTLsaKmcEDkqIY4U2cUv+1CtPWz7IfKea9B56x+bFY32pwqYeXCHdDVfBGSMuM7mqZUBu+3jETSbglozYrukbgjftdWob3s/hR0WB0lH9uwkugfoGVonasPkmPvBhuvozkCLvP9aplqwUoL74D4JhHFLciPvV+Cmw5ag1WtErB89Oimm3tnOpynCJwZTQM+NVgBtKjom0qOnyn7l0vYIKQFJwV2k5w+RfrX5EOOjFfg9D2u+gHgmrqzaSl6kk2dHlQYmfeP+nJxiH7eGO5D3ooYHp7JKZBAaJHcAWWpgqVL/L8pjSJLCPRGBF/5DnfggwFdNprl3LqYnr4io+Wp4+Du74uvQHNpojrUQ4j7Qp330rSbCK9iX5v14zYr6RlqKe5CtTqHjPzuL8CxFUI1ImHgViNpff4=,iv:8cb1FcIm0oGkcrfLNqXamx4aDA3owBZoHur8+uFsdmA=,tag:oFPP/Yene6QrxFDKlmoVcA==,type:str]
-nettsiden:
-    mysql_password: ENC[AES256_GCM,data:Uv74HhWtYRbaFHcfh0Rk/Q==,iv:/lRTaMepwpJKZJWHnwb98Ywa1zP4e2EqYGmwI7BCl1I=,tag:ZnE0u2/65zdkONcoiBGSOQ==,type:str]
-    door_secret: ENC[AES256_GCM,data:t0jEN1WnyEi10KRSg4Dlcd7IuIMBiOU7riOdYSZjvZTQqPijRYIoMEQ6OemIkD1Yg67uISTxnjxP,iv:Ss02VGKRa4oZMubbi8IfQDAjh3h295+n07vOx/IZGBs=,tag:OvdxqIUdYi/cR7IjopSVQQ==,type:str]
-    simplesamlphp:
-        postgres_password: ENC[AES256_GCM,data:SvbrdHF4vQ94DgoEfy67QS5oziAsMT8H,iv:LOHBqMecA6mgV3NMfmfTh3zDGiDve+t3+uaO53dIxt4=,tag:9ffz84ozIqytNdGB1COMhA==,type:str]
-        cookie_salt: ENC[AES256_GCM,data:VmODSLOP1YDBrpHdk/49qx9BS+aveEYDQ1D24d4zCi06kZsCENCr+vdPAnTeM1pw98RTr3yZAEQTh4s90b6v8Q==,iv:vRClu6neyYPFdtD63kjnvK2iNOIHMbh+9qEGph7CI60=,tag:66fgppVxY0egs4+9XfDBPA==,type:str]
-        admin_password: ENC[AES256_GCM,data:SADr/zN3F0tW339kSK1nD9Pb38rw7hz8,iv:s5jgl1djXd5JKwx1WG/w2Q4STMMpjJP91qxOwAoNcL0=,tag:N8bKnO9N0ei06HDkSGt6XQ==,type:str]
+    database: ENC[AES256_GCM,data:EvVK3Mo6cZiIZS+gTxixU4r9SXN41VqwaWOtortZRNH+WPJ4xcYvzYMJNg==,iv:JtFTRLn3fzKIfgAPRqRgQjct7EdkEHtiyQKPy8/sZ2Q=,tag:nqzseG6BC0X5UNI/3kZZ3A==,type:str]
+keycloak:
+    database: ENC[AES256_GCM,data:76+AZnNR5EiturTP7BdOCKE90bFFkfGlRtviSP5NHxPbb3RfFPJEMlwtzA==,iv:nS7VTossHdlrHjPeethhX+Ysp9ukrb5JD7kjG28OFpY=,tag:OMpiEv9nQA7v6lWJfNxEEw==,type:str]
+keys:
+    wackattack_ctf:
+        flag: ENC[AES256_GCM,data:cZCaGb/u/OZgAvXnuJPL3XqmnIa26Rl2IUpWpG/fpt/dJ7+/KssXVa6A5G6ObQhF7deCmTxuoVP8JU+DQzYRr0ftvKhLJ87rgzrE3j+UkA==,iv:3uFkNqXlVj94klU20yPIUd8tIeyUIfp0++2wkdIkiYM=,tag:OZMyEt118u10F5vSUFZE7A==,type:str]
 sops:
    kms: []
    gcp_kms: []
@@ -60,8 +49,8 @@ sops:
            akVjeTNTeGorZjJQOVlMeCtPRUVYL3MK+VMvGxrbzGz4Q3sdaDDWjal+OiK+JYKX
            GHiMXVHQJZu/RrlxMjHKN6V3iaqxZpuvLAEJ2Lzy5EOHPtuiiRyeHQ==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-04-14T21:58:31Z"
-    mac: ENC[AES256_GCM,data:+o7YvaaKTjN/uZT5mv3z9FgIbXwG4NPJePWwRmtkBINn9X+vrCmYOXqWhKw7qfInn4Ftcg0FA7cYFZe5Pv8MNp+f8v1yoiLrVX12cxmEYtqTXJz7pNeD2st1YjGJKihNi2/fyCCf4YBCGN+8Ze//HeVf7/tfWNB+ysyC9g9Tze4=,iv:C6XBCVXn8GuNeaWGdJRnUIh1us0i8fSoxu9Sx7Feb58=,tag:W0RLPPv7eP5kCNrhMG3z7A==,type:str]
+    lastmodified: "2023-10-26T19:59:04Z"
+    mac: ENC[AES256_GCM,data:uH0RfKBjjbYvxjl4XyoXWvwUpi+W7IQZjBdC5UoslotToTw0xnici2fKxPNZ9aFJsukLMPLC+tsT/shUqW373f/NyhsJt0Vb2YtuozFQyQstZQEpnm4WuVoFR/MEjAra/PaM4ATHSGgDuHa7qrpdKTLnrMOai5ZqxLfFbLws3dA=,iv:47hHzrnfZG5NtCN0HjziZdDBJTr451/kvY95GpB3G2M=,tag:3TCs7DSeWB6NujDUlQVGjA==,type:str]
    pgp:
        - created_at: "2023-05-21T00:28:40Z"
          enc: |
--- a/secrets/ildkule/ildkule.yaml
+++ b/secrets/ildkule/ildkule.yaml
@@ -15,6 +15,7 @@ keys:
        secret_key: ENC[AES256_GCM,data:+WoAJbDBEgKs0RoHT+7oEELAVQ+/2Xt+5RTMSXg23moCqVRx+Gzll9P5Drw=,iv:AkRn/Y20iEe5i1T+84wAgLCTFtAox2G3giyawAkltAw=,tag:BZbt5Wb5lYLIJBm/pfP4GQ==,type:str]
        admin_password: ENC[AES256_GCM,data:ttKwfC4WuXeL/6x4,iv:x1X+e3z08CR992GzC62YnFIN7SGrE81/nDNrgcgVzx0=,tag:YajUoy61kYbpeGeC7yNrXQ==,type:str]
    postgres:
+        grafana: ENC[AES256_GCM,data:D6qkg98WZYzKYegSNBb31v8o+KHisGmJ+ab5Ut7EMtsJz36kUup5RS4EbtM=,iv:rfE1uH1QycKMTpSq2p1ntQ2BIvptAh2J3l/QcQhiuLo=,tag:QxmGFcekjFRPf6orN86IxQ==,type:str]
        postgres_exporter_env: ENC[AES256_GCM,data:8MEoikoA6tFNm9qZbk0DFWANd7nRs5QSqrsGLoLKPIc1xykJaXTlyP5v8ywVGR8j7bfPs4p6QfpUIWK8CCnfQ1QhsFPXUMksl8p+K+xuMakYZr9OoWigGqvOHpFb9blfBN1FBdRrk38REXWAMUn74KSRI9v+0i5lpC4=,iv:anpjWVUadKfSAm9XbkeAKu+jAk+LxcpVYQ+gUe5szYw=,tag:4tzb/8B/e1uVoqTsQGlcKA==,type:str]
        postgres_exporter_knakelibrak_env: ENC[AES256_GCM,data:xjC7DGXrW2GIJq8XioIZb+jSe/Hzcz0tv9cUHmX/n1nhI+D64lYt+EKnq1+RX/vJzU4sTaKjveKBh88Qqnv6RQm+MZC//dIxcvnnAdl50qnHZyBCaFFEzSNI8I8vGyArMk8Ja72clBq3kMpUz/pLBP0qDrjblKDoWkU=,iv:ZW98hJy8A5t4Oxtu17R3tM7gou183VLbgBsHA8LFuJY=,tag:VMOvQz3X/XDylV1YFg2Jsg==,type:str]
 sops:
@@ -23,55 +24,55 @@ sops:
    azure_kv: []
    hc_vault: []
    age:
-        - recipient: age1x28hmzvuv6f2n66c0jtqcca3h9rput8d7j5uek6jcpx8n9egd52sqpejq0
+        - recipient: age1mrnldl334l2nszuta6ywvewng0fswv2dz9l5g4qcwe3nj4yxf92qjskdx6
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBURkY4WTZhQzJoREpxV1Vr
-            aUExZ1dxNkIyMkJtUXpqOWtTT1J0MGpmMkY4ClR4Wm1FTmhKN2pIMENRdERrWVY2
-            SUlHblpEc3VackMrbFpHUUJwM2ltZHcKLS0tIEovMEtiOWc1L2tzZDh3ekZKbStr
-            NEFkcW03ZTRJODNxTlVuUnFlcFFUUncKEZzOeUtRsZiuugTLzG2xU4eJ3XtVuop7
-            hhlDBL/YoFn/CO3HjqFdCVv33QoPu7KKMeV52pbVEnv93mvdEeFxVA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrN3lJM2xWTUZ3UkRBaENI
+            VmJiWDlQbHd0VUNYdllPdURyQmUvL3lKMzJzCkZlRFVxbmNLOVNqUFg1akJQQlBP
+            VmdOMUdjZ1M4U2lLVEpGaGI5NjNTR2MKLS0tIDRlQUtucEZhZmRYbmpadVdKK01v
+            cWxCQlBRR1VaZTBDQnkzNGE0WGttWm8KK5s/coWNsdCP5lKQ8LMK7/3ku179+Lg1
+            4ujTVn4LhvXy6JvgGTWS/UbMmJjJebVxkulzf5St3YMMs2mcIYjOtA==
            -----END AGE ENCRYPTED FILE-----
        - recipient: age17tagmpwqjk3mdy45rfesrfey6h863x8wfq38wh33tkrlrywxducs0k6tpq
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSY3cxSGFvdDdWcFVLRTRy
-            Zng2VnhjZlFkc1RQN0NqUjJGeW02WlFaMlFZCjVZc2x2UXNXS1I2WDBxeHdjNUdr
-            WnZGc0l5NlArekUwUGU3Qkdub25EVm8KLS0tIDB2bGo3ZURtZ0pSZjFzcGpOdW5D
-            aTI3aTBUS0d1MzFmMTVMbUlFYTR4VlUKzOvNCAzan1GTXjoRxeySkUYIYtI4Mpvu
-            MC0Q8e350SyoOsrF7fUvw+Ru68fDMLW27H6Ly36xP7D3eo/h4eZVXw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSa25taGsxdlhrUS96cXBi
+            cUo3WDVmdEhKN256THJhS2tHSitDRkVraDJNCmhGZzlFUDFkN0JKNkFWUlVLVzcz
+            MjFhcDdmcmpxdTA3V3JRREFNVmNUbEEKLS0tIFNSU2xNZzN2Y1ZzR2hFM0dOK0Zy
+            Tmk4bXd0ZHhPemxDSDREb3IvSjFza1EKsjtC6J3kYGRe8oLAoUZmg1BUmpkMyC98
+            uYq+IQmfJt48R/MKDei00j1w3zIK5+E5GU4o8+jILzwfpzYUUZWwiA==
            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1mrnldl334l2nszuta6ywvewng0fswv2dz9l5g4qcwe3nj4yxf92qjskdx6
+        - recipient: age1hn45n46ypyrvypv0mwfnpt9ddrlmw34dwlpf33n8v67jexr3lucq6ahc9x
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFbDBYMDNQcWkySC8vN05t
-            U3hLMjlYVUE3Zms3U2R4R0VnMUtFcmVQclZvClY4aWZEYWZPdkltMElkUWxQeUtP
-            TEF0a0txbVQ4d3lrelp3cG9TbG5OSkEKLS0tIHR1V3JIVEwwUjM3RVdES2pQUmhP
-            T1MwME1tbGQ2NysrOEVNYVZRT1R0YmcKFpfe9GfH7s779CNQswRm/W7zwYO6wK11
-            z6IGPxtBlUGdshYiHA1BEz7fMVg3ZolL2D98cTNMM24U89Gssiw9qw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPb09qTTc4cjRMcjIzRmxu
+            RzZWTDBNTGdvaEc2VFJPakYvakRMK1RnS1FnCktHRVkwZGlUUXl4UTBRcGxMQzdn
+            QVBCYVdlWEw5NW9tNytJTGIzRlpwa0UKLS0tIGdDdUtFMUgyT0phMXBxZE41Y1h4
+            a2hQVVprakt5NURpNXdQUjREczJKWTgKn60yrLqco9brlqigAolO8rEkww9z3y3u
+            KmefLVZCGfoko+fnKLVE9UKFS/tAowqgPS1qE76u1Mmkk6yqZoG9rg==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-04-20T23:41:59Z"
-    mac: ENC[AES256_GCM,data:38Ask+adT2FshF8DYEfCWeVWt4KiaJsTXhF7Ib3xxdfQ6vAixM2OXTaK/qqUvN6gQok9TFF+HMJBJ+jezV00nVcKUYn04FaU2/D2zdam44eEEYEEovmfAZ6vbC+CiDv4d/DCc3hnYtDZCEgUTfP4gsZ9rLZFAOwaOFWRJxcDi6Y=,iv:BzuWdTjn6LhscNeouHjM7IYKxTahA8PzzlHSCYZ618s=,tag:BWtPbNwzdOJb788eOO5ZNA==,type:str]
+    lastmodified: "2023-07-08T12:46:19Z"
+    mac: ENC[AES256_GCM,data:bQWG/GgSIv5LdhGTsyx3ENOAywtYVKjzK6nxOnUEZvD+RSi6jxj9Wze7qOhXvgjKWCz/cZj5oSuMQNRyoI8p8xJdxf0+UNdX8uPT05HiKuF7CBcXzprjKri/H6yFp87epOM9fMdn7ZUACn/iT1IZBo+5OuMtDnqVUm/GEmMcsog=,iv:ll/vEeiXsD3crbbxEFsJlxGbm9dZDUPC4GeO95RZZX4=,tag:TGCA721vK9EY3xlY6zIeIg==,type:str]
    pgp:
-        - created_at: "2024-04-20T23:15:17Z"
-          enc: |-
+        - created_at: "2023-01-21T19:52:08Z"
+          enc: |
            -----BEGIN PGP MESSAGE-----

-            hQIMA0av/duuklWYAQ/+LSTWjii2dblTAkuqHan3uuuRRpt1ppmHEgHYkQZD+RzE
-            g+ljNaM/BPqci7Kr1NHFDw+cU2MYm/40Tz63l1cvfE3NEoVefsmoA5voNI3G/bx/
-            LTAe2aacPwO/TNoLtrCgRkzNyKXluUkM9OoIvkvB5DEGjYbe82+gI5Zi+NbW9N/p
-            5ilr9Cc1jvIivjZMGGPLRgkAc/twOOuyrZlsFd9kddAL9YFO7wpd/dko886y1jE5
-            jz9n9F4SKYOcgLPqZuG1iZ8qaA2zGT2bP2caai/QJAmL90stQCiRWtQgB8KeWugm
-            nRFBm5BLamtoqjXXwzdtXGKbFAhvL5/h+kPxnJDjylfFVbgCpoWJ/fxdE5xxxZtq
-            zCcGCQQsaa85eWkBByhu7TdwyAW7bJCm8z6kfFPGqhNDkS8ifxnEWm6ulgYVokiL
-            WVBvuQCd1s8KSExs6zNWGcGlqgvcbovHXyVlmLeqZfBA7i/vYqksZtBT47rG7nCS
-            YGfHy69yVrMdj4KrLuMXNfjtS92hkQqWmCyl5X5zOSJXqEL2dorMzSZn89gK4nL4
-            V4zOKkKtsj2MqynYn/XAoUf3AfYs2wtRhJiU+r/q+rx9Hx31H8mnUuUerT58yQCY
-            mAkjIhTzvZcWIalQo7xnZhos4p1IYaA7MAuGC6HxuWVaOsyiFkRaKwB9svWyZ/DS
-            XAFID3fQ1xfNyYsW8nvXQmvZubnhE+dAQPaiAFP9ujY4RVXWBFOrV6NAs7y/LID/
-            89lpfWN87JWSJWUk6DCD3AQ+1GiBCFy7uswUJkG4zou1RQBSl7X88ziVDILU
-            =tXkN
+            hQIMA0av/duuklWYAQ//Sw5EHNbC9iPXcHSULYVmSMOQCAH7GSGvaaFvey/KffPD
+            5gbFr00vIi1JfjYXmYfn3KKpUfs/mMMo5NzYU2Ou5fWcPsqFLXOwubebuf61X6p7
+            7YfLYQMnjgBzkpb972AJl2tWUlcBcOz89tIw3oMi8R5vvXjRjEdDY8Yp+Z2Apj9V
+            YJCoSIe6RLBlubMs4I6VIOaTaKIM1DWthg95dozlShXYsEgFTYaJ6FbN9RuZOZPa
+            KzFs2DXtbylXXJtiCArQCHnOgA1Jnp80VvMYLO1ldteQhqGdmnxnqwjETx/uqy4l
+            QE31LcRf2JFKi0BBJdQfEqBGW9LD4Mjfwi6tWbHq4Mn29u8IT6z5HJIB99JRAV/9
+            RfBPzF7UVLq2baWxDwG/M6TvZlVJPdAyhJ5QqhkVdrWir7D1D108u+cgtJWw+vlS
+            cP3hT73LWCo2bXUrHXxFnrWdDQQSDpew/x2cTHUNvqdqLZgMJWdZgh+mXOQLjzHP
+            xGkjt0ae5/CEnUIse/Qt3SyoKN3rGVKJgoQ4D0AeBFU5z7NEOx7Ebl9t6IgVnJIB
+            sDJXg+7jJ8A0V1xGan6BP8dFi7m0aAJH0xi8RB9jC1ZRVNxUjFow3Szh0JQ7u2P5
+            4jZ3FT4tWzPzLQsgJUd/H41QyKSd3ke4VMf97mEKULJ7prtXdyxQfRDcE93UgVXS
+            XAF0u7pIl+O2RlJtki+UvuwVDszPBRSmGmfiQa4vsYfXahO4fmBjhdl2hdLtz82F
+            dh+dPu+RSD9OKwIhUwsDLtWWlI/4BvIB1yXbQxP2MyjZm3uVf1CtgUHyjWw8
+            =rri5
            -----END PGP MESSAGE-----
          fp: F7D37890228A907440E1FD4846B9228E814A2AAC
    unencrypted_suffix: _unencrypted
-    version: 3.8.1
+    version: 3.7.3
--- a/shell.nix
+++ b/shell.nix
@@ -3,17 +3,5 @@ pkgs.mkShell {
  nativeBuildInputs = with pkgs; [
    sops
    gnupg
-    openstackclient
  ];
-
-  shellHook = ''
-    export OS_AUTH_URL=https://api.stack.it.ntnu.no:5000
-    export OS_PROJECT_ID=b78432a088954cdc850976db13cfd61c
-    export OS_PROJECT_NAME="STUDORG_Programvareverkstedet"
-    export OS_USER_DOMAIN_NAME="NTNU"
-    export OS_PROJECT_DOMAIN_ID="d3f99bcdaf974685ad0c74c2e5d259db"
-    export OS_REGION_NAME="NTNU-IT"
-    export OS_INTERFACE=public
-    export OS_IDENTITY_API_VERSION=3
-  '';
 }
--- a/users/adriangl.nix
+++ b/users/adriangl.nix
@@ -6,21 +6,15 @@
    extraGroups = [
      "wheel"
      "drift"
-      "nix-builder-users"
    ];

    packages = with pkgs; [
+      exa
      neovim
-      htop
-      ripgrep
-      vim
-      foot.terminfo
    ];

    openssh.authorizedKeys.keys = [
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFa5y7KyLn2tjxed1czMbyM5scnEpo9v/GfnhL/28ckM legolas"
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICf7SlyHR6KgP7+IeFr/Iuiu2lL5vaSlzqPonaO8XU0J gunalx@aragon"
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEj+Y0RUrSaF8gUW8m2BY6i8e7/0bUWhu8u8KW+AoHDh gunalx@nixos"
    ];
  };
 }
--- a/users/danio.nix
+++ b/users/danio.nix
@@ -3,12 +3,7 @@
 {
  users.users.danio = {
    isNormalUser = true;
-    extraGroups = [ "drift" "nix-builder-users" ];
+    extraGroups = [ "drift" ]; # Enable ‘sudo’ for the user.
    shell = pkgs.zsh;
-
-    openssh.authorizedKeys.keys = [
-      "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCp8iMOx3eTiG5AmDh2KjKcigf7xdRKn9M7iZQ4RqP0np0UN2NUbu+VAMJmkWFyi3JpxmLuhszU0F1xY+3qM3ARduy1cs89B/bBE85xlOeYhcYVmpcgPR5xduS+TuHTBzFAgp+IU7/lgxdjcJ3PH4K0ruGRcX1xrytmk/vdY8IeSk3GVWDRrRbH6brO4cCCFjX0zJ7G6hBQueTPQoOy3jrUvgpRkzZY4ZCuljXtxbuX5X/2qWAkp8ca0iTQ5FzNA5JUyj+DWeEzjIEz6GrckOdV2LjWpT9+CtOqoPZOUudE1J9mJk4snNlMQjE06It7Kr50bpwoPqnxjo7ZjlHFLezl"
-      "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDpGSDczzDOhTETCj+uB5e3/9QbOCaVW1knM+n1ey0n6LXH7uiPPmzuZiqfzmfbB1z4bjM2zpn3D6Et6zRCrBUjhTZqf/5GoNlvhVA6QYmBmBp98b8oY7juj5cmu55voxD0S5rC1mQMnWAAf8e8OPbkhs9Lt0XlOYdotLNIZQubzWqE2DK45g/h17ELJs+jkNXoalFjLvLXWzE/C+3pYoeNJVGHfVMTIwt7o64E6JXhxuYTYdSIuzd+BjntkSCXzcAzBFMRwkdlFVoBtLUMMcMQl39kcXv7lAQ8pv+8b1j1N9WuQVf1qEAcZguaimI1ifbXP5d841pZPApCj5KXectIEldfTrcwg8rZpd2UfYS/3XCcOuidBGprY7XsU/jz8wHbH68UjUrsLyaOMnG2ChYztnf63vm3gRs3Fc6FqTycpgYOPDeZBVTcMyPGgtiZvhnTeY20xFS5lK6M+dmgaDqH24kPLiwYSpUF2NK+Rg/2bZxvt/GaSr4U6fJGi3FCJOM= root@DanixLaptop"
-    ];
  };
 }
--- a/users/eirikwit.nix
+++ b/users/eirikwit.nix
@@ -1,18 +0,0 @@
-{ pkgs, ... }:
-{
-  users.users.eirikwit = {
-    isNormalUser = true;
-    extraGroups = [
-      "wheel"
-      "drift"
-    ];
-
-    packages = with pkgs; [
-      micro
-    ];
-
-    openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGZusOSiUVSMjrvNdUq4R91Gafq4XVs9C77Zt+LMPhCU eirikw@live.no"
-    ];
-  };
-}
--- a/users/jonmro.nix
+++ b/users/jonmro.nix
@@ -1,12 +0,0 @@
-{pkgs, ...}:
-
-{
-  users.users.jonmro = {
-    isNormalUser = true;
-    extraGroups = [ "wheel" "drift" "nix-builder-users" ]; 
-    shell = pkgs.zsh;
-    openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEm5PfYmfl/0fnAP/3coVlvTw3/TYNLT6r/NwJHZbLAK jonrodtang@gmail.com"
-    ];
-  };
-}
--- a/users/oysteikt.nix
+++ b/users/oysteikt.nix
@@ -6,12 +6,11 @@
    extraGroups = [
      "wheel"
      "drift"
-      "nix-builder-users"
    ];

    packages = with pkgs; [
      bottom
-      eza
+      exa
      neovim
      diskonaut
      ripgrep
--- a/values.nix
+++ b/values.nix
@@ -21,6 +21,12 @@ in rec {
      ipv4 = pvv-ipv4 213;
      ipv6 = pvv-ipv6 213;
    };
+    grevling-tap = {
+      ipv4 = pvv-ipv4 251;
+    };
+    tuba-tap = {
+      ipv4 = pvv-ipv4 252;
+    };
  };

  hosts = {
@@ -30,23 +36,13 @@ in rec {
      ipv6 = pvv-ipv6 168;
    };
    ildkule = {
-      ipv4 = "10.212.25.209";
-      ipv6 = "2001:700:300:6025:f816:3eff:feee:812d";
-
-      ipv4_global = "129.241.153.213";
-      ipv6_global = "2001:700:300:6026:f816:3eff:fe58:f1e8";
+      ipv4 = pvv-ipv4 187;
+      ipv6 = pvv-ipv6 "1:187";
    };
    bicep = {
      ipv4 = pvv-ipv4 209;
      ipv6 = pvv-ipv6 209;
    };
-    bob = {
-      ipv4 = "129.241.152.254";
-      # ipv6 = ;
-    };
-    knutsen = {
-      ipv4 = pvv-ipv4 191;
-    };
    shark = {
      ipv4 = pvv-ipv4 196;
      ipv6 = pvv-ipv6 196;
@@ -59,9 +55,13 @@ in rec {
      ipv4 = pvv-ipv4 204;
      ipv6 = pvv-ipv6 "1:4f"; # Wtf øystein og daniel why
    };
-    buskerud = {
-      ipv4 = pvv-ipv4 231;
-      ipv6 = pvv-ipv6 231;
+    grevling = {
+      ipv4 = pvv-ipv4 198;
+      ipv6 = pvv-ipv6 198;
+    };
+    tuba = {
+      ipv4 = pvv-ipv4 199;
+      ipv6 = pvv-ipv6 199;
    };
  };