flake: Make openstack-image EFI

flake: Add openstack image generator
2024-09-15 02:47:49 +02:00 · 2024-09-15 02:45:33 +02:00
68 changed files with 497 additions and 1429 deletions
--- a/.sops.yaml
+++ b/.sops.yaml
@@ -13,7 +13,6 @@ keys:
  - &host_ildkule age1x28hmzvuv6f2n66c0jtqcca3h9rput8d7j5uek6jcpx8n9egd52sqpejq0
  - &host_bekkalokk age12nj59tguy9wg882updc2vjdusx5srnxmjyfaqve4zx6jnnsaw3qsyjq6zd
  - &host_bicep age1sl43gc9cw939z5tgha2lpwf0xxxgcnlw7w4xem4sqgmt2pt264vq0dmwx2
-  - &host_ustetind age1hffjafs4slznksefmtqrlj7rdaqgzqncn4un938rhr053237ry8s3rs0v8

 creation_rules:
  # Global secrets
@@ -79,15 +78,3 @@ creation_rules:
      - *user_pederbs_bjarte
      pgp:
      - *user_oysteikt
-
-  - path_regex: secrets/ustetind/[^/]+\.yaml$
-    key_groups:
-    - age:
-      - *host_ustetind
-      - *user_danio
-      - *user_felixalb
-      - *user_pederbs_sopp
-      - *user_pederbs_nord
-      - *user_pederbs_bjarte
-      pgp:
-      - *user_oysteikt
--- a/base/default.nix
+++ b/base/default.nix
@@ -1,17 +1,15 @@
-{ pkgs, lib, fp, ... }:
+{ pkgs, lib, ... }:

 {
  imports = [
-    (fp /users)
-    (fp /modules/snakeoil-certs.nix)
+    ../users
+    ../modules/snakeoil-certs.nix

    ./networking.nix
    ./nix.nix

    ./services/acme.nix
    ./services/auto-upgrade.nix
-    ./services/dbus.nix
-    ./services/fwupd.nix
    ./services/irqbalance.nix
    ./services/logrotate.nix
    ./services/nginx.nix
@@ -19,12 +17,9 @@
    ./services/postfix.nix
    ./services/smartd.nix
    ./services/thermald.nix
-    ./services/userborn.nix
-    ./services/userdbd.nix
  ];

  boot.tmp.cleanOnBoot = lib.mkDefault true;
-  boot.kernelPackages = lib.mkDefault pkgs.linuxPackages_latest;

  time.timeZone = "Europe/Oslo";

@@ -52,8 +47,6 @@

  programs.zsh.enable = true;

-  security.lockKernelModules = true;
-  security.protectKernelImage = true;
  security.sudo.execWheelOnly = true;
  security.sudo.extraConfig = ''
    Defaults lecture = never
--- a/base/networking.nix
+++ b/base/networking.nix
@@ -1,13 +1,16 @@
 { lib, values, ... }:
 {
-  systemd.network.enable = true;
  networking.domain = "pvv.ntnu.no";
  networking.useDHCP = false;
+  # networking.search = [ "pvv.ntnu.no" "pvv.org" ];
+  # networking.nameservers = lib.mkDefault [ "129.241.0.200" "129.241.0.201" ];
+  # networking.tempAddresses = lib.mkDefault "disabled";
+  # networking.defaultGateway = values.hosts.gateway;

-  # The rest of the networking configuration is usually sourced from /values.nix
+  systemd.network.enable = true;

  services.resolved = {
    enable = lib.mkDefault true;
    dnssec = "false"; # Supposdly this keeps breaking and the default is to allow downgrades anyways...
  };
-}
+}
--- a/base/nix.nix
+++ b/base/nix.nix
@@ -5,10 +5,10 @@
      automatic = true;
      options = "--delete-older-than 2d";
    };
-    optimise.automatic = true;

    settings = {
      allow-dirty = true;
+      auto-optimise-store = true;
      builders-use-substitutes = true;
      experimental-features = [ "nix-command" "flakes" ];
      log-lines = 50;
--- a/base/services/auto-upgrade.nix
+++ b/base/services/auto-upgrade.nix
@@ -1,26 +1,12 @@
-{ inputs, pkgs, lib, ... }:
+{ ... }:
 {
  system.autoUpgrade = {
    enable = true;
    flake = "git+https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git";
    flags = [
-      # --update-input is deprecated since nix 2.22, and removed in lix 2.90
-      # https://git.lix.systems/lix-project/lix/issues/400
-      "--refresh"
-      "--override-input" "nixpkgs" "github:nixos/nixpkgs/nixos-24.11-small"
-      "--override-input" "nixpkgs-unstable" "github:nixos/nixpkgs/nixos-unstable-small"
+      "--update-input" "nixpkgs"
+      "--update-input" "nixpkgs-unstable"
      "--no-write-lock-file"
    ];
  };
-
-  # workaround for https://github.com/NixOS/nix/issues/6895
-  # via https://git.lix.systems/lix-project/lix/issues/400
-  environment.etc."current-system-flake-inputs.json".source
-    = pkgs.writers.writeJSON "flake-inputs.json" (
-      lib.flip lib.mapAttrs inputs (name: input:
-        # inputs.*.sourceInfo sans outPath, since writeJSON will otherwise serialize sourceInfo like a derivation
-        lib.removeAttrs (input.sourceInfo or {}) [ "outPath" ]
-          // { store-path = input.outPath; } # comment this line if you don't want to retain a store reference to the flake inputs
-      )
-    );
-}
+}
--- a/base/services/dbus.nix
+++ b/base/services/dbus.nix
@@ -1,7 +0,0 @@
-{ ... }:
-{
-  services.dbus = {
-    enable = true;
-    implementation = "broker";
-  };
-}
--- a/base/services/fwupd.nix
+++ b/base/services/fwupd.nix
@@ -1,4 +0,0 @@
-{ ... }:
-{
-  services.fwupd.enable = true;
-}
--- a/base/services/logrotate.nix
+++ b/base/services/logrotate.nix
@@ -1,8 +1,42 @@
 { ... }:
 {
+  # source: https://github.com/logrotate/logrotate/blob/main/examples/logrotate.service
  systemd.services.logrotate = {
    documentation = [ "man:logrotate(8)" "man:logrotate.conf(5)" ];
    unitConfig.RequiresMountsFor = "/var/log";
-    serviceConfig.ReadWritePaths = [ "/var/log" ];
+    serviceConfig = {
+      Nice = 19;
+      IOSchedulingClass = "best-effort";
+      IOSchedulingPriority = 7;
+
+      ReadWritePaths = [ "/var/log" ];
+
+      AmbientCapabilities = [ "" ];
+      CapabilityBoundingSet = [ "" ];
+      DeviceAllow = [ "" ];
+      LockPersonality = true;
+      MemoryDenyWriteExecute = true;
+      NoNewPrivileges = true; # disable for third party rotate scripts
+      PrivateDevices = true;
+      PrivateNetwork = true; # disable for mail delivery
+      PrivateTmp = true;
+      ProtectClock = true;
+      ProtectControlGroups = true;
+      ProtectHome = true; # disable for userdir logs
+      ProtectHostname = true;
+      ProtectKernelLogs = true;
+      ProtectKernelModules = true;
+      ProtectKernelTunables = true;
+      ProtectProc = "invisible";
+      ProtectSystem = "full";
+      RestrictNamespaces = true;
+      RestrictRealtime = true;
+      RestrictSUIDSGID = true; # disable for creating setgid directories
+      SocketBindDeny = [ "any" ];
+      SystemCallArchitectures = "native";
+      SystemCallFilter = [
+        "@system-service"
+      ];
+    };
  };
-}
+}
--- a/base/services/nginx.nix
+++ b/base/services/nginx.nix
@@ -33,10 +33,6 @@

  systemd.services.nginx.serviceConfig = lib.mkIf config.services.nginx.enable {
    LimitNOFILE = 65536;
-    # We use jit my dudes
-    MemoryDenyWriteExecute = lib.mkForce false;
-    # What the fuck do we use that where the defaults are not enough???
-    SystemCallFilter = lib.mkForce null;
  };

  services.nginx.virtualHosts."_" = lib.mkIf config.services.nginx.enable {
@@ -45,4 +41,4 @@
    addSSL = true;
    extraConfig = "return 444;";
  };
-}
+}
--- a/base/services/openssh.nix
+++ b/base/services/openssh.nix
@@ -10,12 +10,5 @@
      Match All
    '';
    settings.PermitRootLogin = "yes";
-
  };
-    users.users."root".openssh.authorizedKeys.keys = [
-      "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCqVt4LCe0YIttr9swFxjkjn37ZDY9JxwVC+2gvfSINDJorOCtqPjDOTD2fTS1Gz08QCwpnLWq2kyvRchu6WgriAbSACpbZZBgxRaF/FVh3oiMVFGnNKGnv6/fdo/vZtu8mUVuqtmTrgLYpZdbR4oD3XiBlDKs7Cv5hPqt95lnP6MNFvE8mICCfd1PwhsABd2IQ5laz3u77/RXhNFJL0Kf2/+6gk9awcLuwHrPdvq7c3BxRHbc9UMRQENyjyQPa7aLe+uJBFLKP51I8VBuDpDacuibQx7nMt6N2UJ2KWI0JxRMHuJNq4S5jidR82aOw9gzGbTv30SKNLMqsZ0xj4LtdqCXDiZF6Lr09PsJYsvnBUFWa14HGcThKDtgwQwBryNViYmfv//0h9+RLZiU0ab+NEwSs7Zh5iAD+vhx64QqNX3tR7Le4SWXh8W0eShU9N78qYdSkiC3Ui7htxeqOocXM/P4AwbnHsLELIvkHdvgchCPvl8ygZa4WJTEWv16+ICskJcAKWGuqjvXAFuwjJJmPp9xLW9O0DFfQhMELiGamQR9wK07yYQVr34iah6qZO7cwhSKyEPFrVPIaNtfDhsjED639F7vmktf26SWNJHWfW0wOHILjI6TgqUvy0JDd8W8w0CHlAfz6Fs2l99NNgNF8dB3vBASbxS0hu/y0PVu/xQ== openstack-sleipner"
-
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICCbgJ0Uwh9VSVhfId7l9i5/jk4CvAK5rbkiab8R+moF root@sleipner"
-    ];
-}
-
+}
--- a/base/services/smartd.nix
+++ b/base/services/smartd.nix
@@ -1,20 +1,8 @@
 { config, pkgs, lib, ... }:
 {
-  services.smartd = {
-    enable = lib.mkDefault true;
-    notifications = {
-      mail = {
-        enable = true;
-        sender = "root@pvv.ntnu.no";
-        recipient = "root@pvv.ntnu.no";
-      };
-      wall.enable = false;
-    };
-  };
+  services.smartd.enable = lib.mkDefault true;

  environment.systemPackages = lib.optionals config.services.smartd.enable (with pkgs; [
    smartmontools
  ]);
-
-  systemd.services.smartd.unitConfig.ConditionVirtualization = "no";
-}
+}
--- a/base/services/userborn.nix
+++ b/base/services/userborn.nix
@@ -1,4 +0,0 @@
-{ ... }:
-{
-  services.userborn.enable = true;
-}
--- a/base/services/userdbd.nix
+++ b/base/services/userdbd.nix
@@ -1,4 +0,0 @@
-{ ... }:
-{
-  services.userdbd.enable = true;
-}
--- a/flake.lock
+++ b/flake.lock
@@ -7,11 +7,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1741786315,
-        "narHash": "sha256-VT65AE2syHVj6v/DGB496bqBnu1PXrrzwlw07/Zpllc=",
+        "lastModified": 1725242307,
+        "narHash": "sha256-a2iTMBngegEZvaNAzzxq5Gc5Vp3UWoGUqWtK11Txbic=",
        "owner": "nix-community",
        "repo": "disko",
-        "rev": "0d8c6ad4a43906d14abd5c60e0ffe7b587b213de",
+        "rev": "96073e6423623d4a8027e9739d2af86d6422ea7a",
        "type": "github"
      },
      "original": {
@@ -20,45 +20,64 @@
        "type": "github"
      }
    },
-    "gergle": {
+    "fix-python": {
      "inputs": {
+        "flake-utils": "flake-utils",
+        "nixpkgs": [
+          "grzegorz",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1713887124,
+        "narHash": "sha256-hGTSm0p9xXUYDgsAAr/ORZICo6T6u33vLfX3tILikaQ=",
+        "owner": "GuillaumeDesforges",
+        "repo": "fix-python",
+        "rev": "f7f4b33e22414071fc1f9cbf68072c413c3a7fdf",
+        "type": "github"
+      },
+      "original": {
+        "owner": "GuillaumeDesforges",
+        "repo": "fix-python",
+        "type": "github"
+      }
+    },
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1689068808,
+        "narHash": "sha256-6ixXo3wt24N/melDWjq70UuHQLxGV8jZvooRanIHXw0=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "919d646de7be200f3bf08cb76ae1f09402b6f9b4",
+        "type": "github"
+      },
+      "original": {
+        "id": "flake-utils",
+        "type": "indirect"
+      }
+    },
+    "grzegorz": {
+      "inputs": {
+        "fix-python": "fix-python",
        "nixpkgs": [
          "nixpkgs"
        ]
      },
      "locked": {
-        "lastModified": 1736621371,
-        "narHash": "sha256-45UIQSQA7R5iU4YWvilo7mQbhY1Liql9bHBvYa3qRI0=",
-        "ref": "refs/heads/main",
-        "rev": "3729796c1213fe76e568ac28f1df8de4e596950b",
-        "revCount": 20,
-        "type": "git",
-        "url": "https://git.pvv.ntnu.no/Grzegorz/gergle.git"
+        "lastModified": 1716065905,
+        "narHash": "sha256-08uhxBzfakfhl/ooc+gMzDupWKYvTeyQZwuvB1SBS7A=",
+        "owner": "Programvareverkstedet",
+        "repo": "grzegorz",
+        "rev": "0481aef6553ae9aee86e4edb4ca0ed4f2eba2058",
+        "type": "github"
      },
      "original": {
-        "type": "git",
-        "url": "https://git.pvv.ntnu.no/Grzegorz/gergle.git"
-      }
-    },
-    "greg-ng": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ],
-        "rust-overlay": "rust-overlay"
-      },
-      "locked": {
-        "lastModified": 1736545379,
-        "narHash": "sha256-PeTTmGumdOX3rd6OKI7QMCrZovCDkrckZbcHr+znxWA=",
-        "ref": "refs/heads/main",
-        "rev": "74f5316121776db2769385927ec0d0c2cc2b23e4",
-        "revCount": 42,
-        "type": "git",
-        "url": "https://git.pvv.ntnu.no/Grzegorz/greg-ng.git"
-      },
-      "original": {
-        "type": "git",
-        "url": "https://git.pvv.ntnu.no/Grzegorz/greg-ng.git"
+        "owner": "Programvareverkstedet",
+        "repo": "grzegorz",
+        "type": "github"
      }
    },
    "grzegorz-clients": {
@@ -68,17 +87,17 @@
        ]
      },
      "locked": {
-        "lastModified": 1736178795,
-        "narHash": "sha256-mPdi8cgvIDYcgG3FRG7A4BOIMu2Jef96TPMnV00uXlM=",
-        "ref": "refs/heads/master",
-        "rev": "fde738910de1fd8293535a6382c2f0c2749dd7c1",
-        "revCount": 79,
-        "type": "git",
-        "url": "https://git.pvv.ntnu.no/Grzegorz/grzegorz-clients.git"
+        "lastModified": 1716115695,
+        "narHash": "sha256-aI65l4x+U5v3i/nfn6N3eW5IZodmf4pyAByE7vTJh8I=",
+        "owner": "Programvareverkstedet",
+        "repo": "grzegorz-clients",
+        "rev": "b9444658fbb39cd1bf1c61ee5a1d5f0641c49abe",
+        "type": "github"
      },
      "original": {
-        "type": "git",
-        "url": "https://git.pvv.ntnu.no/Grzegorz/grzegorz-clients.git"
+        "owner": "Programvareverkstedet",
+        "repo": "grzegorz-clients",
+        "type": "github"
      }
    },
    "matrix-next": {
@@ -88,16 +107,16 @@
        ]
      },
      "locked": {
-        "lastModified": 1735857245,
-        "narHash": "sha256-AKLLPrgXTxgzll3DqVUMa4QlPlRN3QceutgFBmEf8Nk=",
+        "lastModified": 1717234745,
+        "narHash": "sha256-MFyKRdw4WQD6V3vRGbP6MYbtJhZp712zwzjW6YiOBYM=",
        "owner": "dali99",
        "repo": "nixos-matrix-modules",
-        "rev": "da9dc0479ffe22362793c87dc089035facf6ec4d",
+        "rev": "d7dc42c9bbb155c5e4aa2f0985d0df75ce978456",
        "type": "github"
      },
      "original": {
        "owner": "dali99",
-        "ref": "0.7.0",
+        "ref": "v0.6.0",
        "repo": "nixos-matrix-modules",
        "type": "github"
      }
@@ -110,11 +129,11 @@
        "rev": "1b4087bd3322a2e2ba84271c8fcc013e6b641a58",
        "revCount": 2,
        "type": "git",
-        "url": "https://git.pvv.ntnu.no/Projects/minecraft-kartverket.git"
+        "url": "https://git.pvv.ntnu.no/Drift/minecraft-data.git"
      },
      "original": {
        "type": "git",
-        "url": "https://git.pvv.ntnu.no/Projects/minecraft-kartverket.git"
+        "url": "https://git.pvv.ntnu.no/Drift/minecraft-data.git"
      }
    },
    "nix-gitea-themes": {
@@ -124,11 +143,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1736531400,
-        "narHash": "sha256-+X/HVI1AwoPcud28wI35XRrc1kDgkYdDUGABJBAkxDI=",
+        "lastModified": 1714416973,
+        "narHash": "sha256-aZUcvXjdETUC6wVQpWDVjLUzwpDAEca8yR0ITDeK39o=",
        "ref": "refs/heads/main",
-        "rev": "e4dafd06b3d7e9e6e07617766e9c3743134571b7",
-        "revCount": 7,
+        "rev": "2b23c0ba8aae68d3cb6789f0f6e4891cef26cc6d",
+        "revCount": 6,
        "type": "git",
        "url": "https://git.pvv.ntnu.no/oysteikt/nix-gitea-themes.git"
      },
@@ -137,36 +156,86 @@
        "url": "https://git.pvv.ntnu.no/oysteikt/nix-gitea-themes.git"
      }
    },
+    "nixlib": {
+      "locked": {
+        "lastModified": 1725757153,
+        "narHash": "sha256-c1a6iLmCVPFI9EUVMrBN8xdmFxFXEjcVwiTSVmqajOs=",
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "rev": "68584f89dd0eb16fea5d80ae127f3f681f6a5df7",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "type": "github"
+      }
+    },
+    "nixos-generators": {
+      "inputs": {
+        "nixlib": "nixlib",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1726102718,
+        "narHash": "sha256-u89QyfjtXryLHrO3Wre4kuWK5KDKiXe8lgRi6+cUOEw=",
+        "owner": "nix-community",
+        "repo": "nixos-generators",
+        "rev": "5ae384b83b91080f0fead6bc1add1cff8277cb3f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nixos-generators",
+        "type": "github"
+      }
+    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1741969460,
-        "narHash": "sha256-SCNxTTBfMJV7XuTcLUfdAd6cgCGsazzi+DoPrceQrZ0=",
+        "lastModified": 1725198597,
+        "narHash": "sha256-w3sjCEbnc242ByJ18uebzgjFZY3QU7dZhmLwPsJIZJs=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "68612419aa6c9fd5b178b81e6fabbdf46d300ea4",
+        "rev": "3524b030c839db4ea4ba16737789c6fb8a1769c6",
+        "type": "github"
+      },
+      "original": {
+        "id": "nixpkgs",
+        "ref": "nixos-24.05-small",
+        "type": "indirect"
+      }
+    },
+    "nixpkgs-stable": {
+      "locked": {
+        "lastModified": 1721524707,
+        "narHash": "sha256-5NctRsoE54N86nWd0psae70YSLfrOek3Kv1e8KoXe/0=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "556533a23879fc7e5f98dd2e0b31a6911a213171",
        "type": "github"
      },
      "original": {
        "owner": "NixOS",
-        "ref": "nixos-24.11-small",
+        "ref": "release-24.05",
        "repo": "nixpkgs",
        "type": "github"
      }
    },
    "nixpkgs-unstable": {
      "locked": {
-        "lastModified": 1741960758,
-        "narHash": "sha256-pSGMbfkxF7TSeco54W+B1q+g22YCVp1qXHgtrdgtyR4=",
+        "lastModified": 1725183711,
+        "narHash": "sha256-gkjg8FfjL92azt3gzZUm1+v+U4y+wbQE630uIf4Aybo=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "845dc1e9cbc2e48640b8968af58b4a19db67aa8f",
+        "rev": "a2c345850e5e1d96c62e7fa8ca6c9d77ebad1c37",
        "type": "github"
      },
      "original": {
-        "owner": "NixOS",
+        "id": "nixpkgs",
        "ref": "nixos-unstable-small",
-        "repo": "nixpkgs",
-        "type": "github"
+        "type": "indirect"
      }
    },
    "pvv-calendar-bot": {
@@ -196,11 +265,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1741738148,
-        "narHash": "sha256-cJo6nbcJEOjkazkZ194NDnlsZe0W0wpxeUh2/886uC8=",
-        "ref": "refs/heads/main",
-        "rev": "c1802e7cf27c7cf8b4890354c982a4eef5b11593",
-        "revCount": 486,
+        "lastModified": 1725212759,
+        "narHash": "sha256-yZBsefIarFUEhFRj+rCGMp9Zvag3MCafqV/JfGVRVwc=",
+        "ref": "refs/heads/master",
+        "rev": "e7b66b4bc6a89bab74bac45b87e9434f5165355f",
+        "revCount": 473,
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Projects/nettsiden.git"
      },
@@ -212,12 +281,12 @@
    "root": {
      "inputs": {
        "disko": "disko",
-        "gergle": "gergle",
-        "greg-ng": "greg-ng",
+        "grzegorz": "grzegorz",
        "grzegorz-clients": "grzegorz-clients",
        "matrix-next": "matrix-next",
        "minecraft-data": "minecraft-data",
        "nix-gitea-themes": "nix-gitea-themes",
+        "nixos-generators": "nixos-generators",
        "nixpkgs": "nixpkgs",
        "nixpkgs-unstable": "nixpkgs-unstable",
        "pvv-calendar-bot": "pvv-calendar-bot",
@@ -225,39 +294,19 @@
        "sops-nix": "sops-nix"
      }
    },
-    "rust-overlay": {
-      "inputs": {
-        "nixpkgs": [
-          "greg-ng",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1729391507,
-        "narHash": "sha256-as0I9xieJUHf7kiK2a9znDsVZQTFWhM1pLivII43Gi0=",
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "rev": "784981a9feeba406de38c1c9a3decf966d853cca",
-        "type": "github"
-      },
-      "original": {
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "type": "github"
-      }
-    },
    "sops-nix": {
      "inputs": {
        "nixpkgs": [
          "nixpkgs"
-        ]
+        ],
+        "nixpkgs-stable": "nixpkgs-stable"
      },
      "locked": {
-        "lastModified": 1741861888,
-        "narHash": "sha256-ynOgXAyToeE1UdLNfrUn/hL7MN0OpIS2BtNdLjpjPf0=",
+        "lastModified": 1725201042,
+        "narHash": "sha256-lj5pxOwidP0W//E7IvyhbhXrnEUW99I07+QpERnzTS4=",
        "owner": "Mic92",
        "repo": "sops-nix",
-        "rev": "d016ce0365b87d848a57c12ffcfdc71da7a2b55f",
+        "rev": "5db5921e40ae382d6716dce591ea23b0a39d96f7",
        "type": "github"
      },
      "original": {
@@ -265,6 +314,21 @@
        "repo": "sops-nix",
        "type": "github"
      }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
    }
  },
  "root": "root",
--- a/flake.nix
+++ b/flake.nix
@@ -2,8 +2,8 @@
  description = "PVV System flake";

  inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.11-small"; # remember to also update the url in base/services/auto-upgrade.nix
-    nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixos-unstable-small";
+    nixpkgs.url = "nixpkgs/nixos-24.05-small";
+    nixpkgs-unstable.url = "nixpkgs/nixos-unstable-small";

    sops-nix.url = "github:Mic92/sops-nix";
    sops-nix.inputs.nixpkgs.follows = "nixpkgs";
@@ -17,31 +17,32 @@
    pvv-calendar-bot.url = "git+https://git.pvv.ntnu.no/Projects/calendar-bot.git";
    pvv-calendar-bot.inputs.nixpkgs.follows = "nixpkgs";

-    matrix-next.url = "github:dali99/nixos-matrix-modules/0.7.0";
+    matrix-next.url = "github:dali99/nixos-matrix-modules/v0.6.0";
    matrix-next.inputs.nixpkgs.follows = "nixpkgs";

    nix-gitea-themes.url = "git+https://git.pvv.ntnu.no/oysteikt/nix-gitea-themes.git";
    nix-gitea-themes.inputs.nixpkgs.follows = "nixpkgs";

-    greg-ng.url = "git+https://git.pvv.ntnu.no/Grzegorz/greg-ng.git";
-    greg-ng.inputs.nixpkgs.follows = "nixpkgs";
-    gergle.url = "git+https://git.pvv.ntnu.no/Grzegorz/gergle.git";
-    gergle.inputs.nixpkgs.follows = "nixpkgs";
-    grzegorz-clients.url = "git+https://git.pvv.ntnu.no/Grzegorz/grzegorz-clients.git";
+    grzegorz.url = "github:Programvareverkstedet/grzegorz";
+    grzegorz.inputs.nixpkgs.follows = "nixpkgs";
+    grzegorz-clients.url = "github:Programvareverkstedet/grzegorz-clients";
    grzegorz-clients.inputs.nixpkgs.follows = "nixpkgs";

-    minecraft-data.url = "git+https://git.pvv.ntnu.no/Projects/minecraft-kartverket.git";
+    minecraft-data.url = "git+https://git.pvv.ntnu.no/Drift/minecraft-data.git";
+
+    nixos-generators.url = "github:nix-community/nixos-generators";
+    nixos-generators.inputs.nixpkgs.follows = "nixpkgs";
  };

-  outputs = { self, nixpkgs, nixpkgs-unstable, sops-nix, disko, ... }@inputs:
+  outputs = { self, nixpkgs, nixpkgs-unstable, sops-nix, disko, nixos-generators, ... }@inputs:
  let
-    inherit (nixpkgs) lib;
+    nixlib = nixpkgs.lib;
    systems = [
      "x86_64-linux"
      "aarch64-linux"
      "aarch64-darwin"
    ];
-    forAllSystems = f: lib.genAttrs systems f;
+    forAllSystems = f: nixlib.genAttrs systems f;
    allMachines = builtins.attrNames self.nixosConfigurations;
    importantMachines = [
      "bekkalokk"
@@ -51,17 +52,16 @@
      "ildkule"
    ];
  in {
-    inputs = lib.mapAttrs (_: src: src.outPath) inputs;
+    inherit inputs;

    nixosConfigurations = let
      unstablePkgs = nixpkgs-unstable.legacyPackages.x86_64-linux;
-      nixosConfig = nixpkgs: name: config: lib.nixosSystem (lib.recursiveUpdate
+      nixosConfig = nixpkgs: name: config: nixpkgs.lib.nixosSystem (nixpkgs.lib.recursiveUpdate
        rec {
          system = "x86_64-linux";
          specialArgs = {
-            inherit unstablePkgs inputs;
+            inherit nixpkgs-unstable inputs;
            values = import ./values.nix;
-            fp = path: ./${path};
          };

          modules = [
@@ -105,7 +105,6 @@
        modules = [
          inputs.nix-gitea-themes.nixosModules.default
          inputs.pvv-nettsiden.nixosModules.default
-          self.nixosModules.robots-txt
        ];
      };
      bob = stableNixosConfig "bob" {
@@ -118,32 +117,16 @@
      #ildkule-unstable = unstableNixosConfig "ildkule" { };
      shark = stableNixosConfig "shark" { };

-      ustetind = stableNixosConfig "ustetind" {
-        modules = [
-         "${nixpkgs}/nixos/modules/virtualisation/lxc-container.nix"
-        ];
-      };
-
      brzeczyszczykiewicz = stableNixosConfig "brzeczyszczykiewicz" {
        modules = [
+          inputs.grzegorz.nixosModules.grzegorz-kiosk
          inputs.grzegorz-clients.nixosModules.grzegorz-webui
-          inputs.gergle.nixosModules.default
-          inputs.greg-ng.nixosModules.default
-        ];
-        overlays = [
-          inputs.greg-ng.overlays.default
-          inputs.gergle.overlays.default
        ];
      };
      georg = stableNixosConfig "georg" {
        modules = [
+          inputs.grzegorz.nixosModules.grzegorz-kiosk
          inputs.grzegorz-clients.nixosModules.grzegorz-webui
-          inputs.gergle.nixosModules.default
-          inputs.greg-ng.nixosModules.default
-        ];
-        overlays = [
-          inputs.greg-ng.overlays.default
-          inputs.gergle.overlays.default
        ];
      };
    };
@@ -151,7 +134,6 @@
    nixosModules = {
      snakeoil-certs = ./modules/snakeoil-certs.nix;
      snappymail = ./modules/snappymail.nix;
-      robots-txt = ./modules/robots-txt.nix;
    };

    devShells = forAllSystems (system: {
@@ -164,19 +146,53 @@
      in rec {
        default = important-machines;
        important-machines = pkgs.linkFarm "important-machines"
-          (lib.getAttrs importantMachines self.packages.x86_64-linux);
+          (nixlib.getAttrs importantMachines self.packages.x86_64-linux);
        all-machines = pkgs.linkFarm "all-machines"
-          (lib.getAttrs allMachines self.packages.x86_64-linux);
+          (nixlib.getAttrs allMachines self.packages.x86_64-linux);

        simplesamlphp = pkgs.callPackage ./packages/simplesamlphp { };

+        openstack-image = nixos-generators.nixosGenerate {
+          system = "x86_64-linux";
+          format = "openstack";
+
+          modules = [
+            ({config, lib, pkgs, modulesPath, ... }: {
+              system.build.openstackImage = lib.mkForce (import "${modulesPath}/../lib/make-disk-image.nix" {
+                inherit config lib pkgs;
+                additionalSpace = "1024M";
+                copyChannel = true;
+                diskSize = "auto";
+                format = "raw";
+                partitionTableType = "efi";
+                configFile = pkgs.writeText "configuration.nix"
+                  ''
+                    {
+                      imports = [ <nixpkgs/nixos/modules/virtualisation/openstack-config.nix> ];
+                    }
+                  '';
+              });
+              boot.loader.grub = lib.mkForce {
+                device = "nodev";
+                efiSupport = true;
+                efiInstallAsRemovable = true;
+              };
+
+              fileSystems."/boot" = {
+                device = "/dev/disk/by-label/ESP";
+                fsType = "vfat";
+              };
+            })
+          ];
+        };
+
      } //
-      (lib.pipe null [
+      (nixlib.pipe null [
        (_: pkgs.callPackage ./packages/mediawiki-extensions { })
-        (lib.flip builtins.removeAttrs ["override" "overrideDerivation"])
-        (lib.mapAttrs' (name: lib.nameValuePair "mediawiki-${name}"))
+        (nixlib.flip builtins.removeAttrs ["override" "overrideDerivation"])
+        (nixlib.mapAttrs' (name: nixlib.nameValuePair "mediawiki-${name}"))
      ])
-      // lib.genAttrs allMachines
+      // nixlib.genAttrs allMachines
        (machine: self.nixosConfigurations.${machine}.config.system.build.toplevel);
    };
  };
--- a/hosts/bekkalokk/configuration.nix
+++ b/hosts/bekkalokk/configuration.nix
@@ -1,10 +1,10 @@
-{ fp, pkgs, values, ... }:
+{ pkgs, values, ... }:
 {
  imports = [
    ./hardware-configuration.nix

-    (fp /base)
-    (fp /misc/metrics-exporters.nix)
+    ../../base
+    ../../misc/metrics-exporters.nix

    ./services/bluemap/default.nix
    ./services/gitea/default.nix
@@ -16,10 +16,9 @@
    ./services/vaultwarden.nix
    ./services/webmail
    ./services/website
-    ./services/well-known
  ];

-  sops.defaultSopsFile = fp /secrets/bekkalokk/bekkalokk.yaml;
+  sops.defaultSopsFile = ../../secrets/bekkalokk/bekkalokk.yaml;
  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
  sops.age.generateKey = true;
--- a/hosts/bekkalokk/services/bluemap/default.nix
+++ b/hosts/bekkalokk/services/bluemap/default.nix
@@ -6,15 +6,13 @@ in {
    ./module.nix # From danio, pending upstreaming
  ];

-  disabledModules = [ "services/web-apps/bluemap.nix" ];
+  disabledModules = [ "services/web-servers/bluemap.nix" ];

  sops.secrets."bluemap/ssh-key" = { };
  sops.secrets."bluemap/ssh-known-hosts" = { };

  services.bluemap = {
    enable = true;
-    package = pkgs.callPackage ./package.nix { };
-    
    eula = true;
    onCalendar = "*-*-* 05:45:00"; # a little over an hour after auto-upgrade

--- a/hosts/bekkalokk/services/bluemap/module.nix
+++ b/hosts/bekkalokk/services/bluemap/module.nix
@@ -26,6 +26,7 @@ let
    "webapp.conf" = webappConfig;
    "webserver.conf" = webserverConfig;
    "packs" = cfg.resourcepacks;
+    "addons" = cfg.resourcepacks; # TODO
  };

  renderConfigFolder = name: value: pkgs.linkFarm "bluemap-${name}-config" {
@@ -37,13 +38,13 @@ let
    "webapp.conf" = format.generate "webapp.conf" (cfg.webappSettings // { "update-settings-file" = false; });
    "webserver.conf" = webserverConfig;
    "packs" = value.resourcepacks;
+    "addons" = cfg.resourcepacks; # TODO
  };

  inherit (lib) mkOption;
 in {
  options.services.bluemap = {
    enable = lib.mkEnableOption "bluemap";
-    package = lib.mkPackageOption pkgs "bluemap" { };

    eula = mkOption {
      type = lib.types.bool;
@@ -158,7 +159,7 @@ in {
            type = lib.types.path;
            default = cfg.resourcepacks;
            defaultText = lib.literalExpression "config.services.bluemap.resourcepacks";
-            description = "A set of resourcepacks/mods/bluemap-addons to extract models from loaded in alphabetical order";
+            description = "A set of resourcepacks/mods to extract models from loaded in alphabetical order";
          };
          settings = mkOption {
            type = (lib.types.submodule {
@@ -309,18 +310,9 @@ in {
        Group = "nginx";
        UMask = "026";
      };
-      script = ''
-        # If web folder doesnt exist generate it
-        test -f "${cfg.webRoot}" || ${lib.getExe cfg.package} -c ${webappConfigFolder} -gs
-
-        # Render each minecraft map
-        ${lib.strings.concatStringsSep "\n" (lib.attrsets.mapAttrsToList
-          (name: value: "${lib.getExe cfg.package} -c ${renderConfigFolder name value} -r")
-          cfg.maps)}
-
-        # Generate updated webapp
-        ${lib.getExe cfg.package} -c ${webappConfigFolder} -gs
-      '';
+      script = lib.strings.concatStringsSep "\n" ((lib.attrsets.mapAttrsToList
+        (name: value: "${lib.getExe pkgs.bluemap} -c ${renderConfigFolder name value} -r")
+        cfg.maps) ++ [ "${lib.getExe pkgs.bluemap} -c ${webappConfigFolder} -gs" ]);
    };

    systemd.timers."render-bluemap-maps" = lib.mkIf cfg.enableRender {
--- a/hosts/bekkalokk/services/bluemap/package.nix
+++ b/hosts/bekkalokk/services/bluemap/package.nix
@@ -1,30 +0,0 @@
-{ lib, stdenvNoCC, fetchurl, makeWrapper, jre }:
-
-stdenvNoCC.mkDerivation rec {
-  pname = "bluemap";
-  version = "5.7";
-
-  src = fetchurl {
-    url = "https://github.com/BlueMap-Minecraft/BlueMap/releases/download/v${version}/BlueMap-${version}-cli.jar";
-    hash = "sha256-8udZYJgrr4bi2mjRYrASd8JwUoUVZW1tZpOLRgafAIw=";
-  };
-
-  dontUnpack = true;
-
-  nativeBuildInputs = [ makeWrapper ];
-
-  installPhase = ''
-    runHook preInstall
-    makeWrapper ${jre}/bin/java $out/bin/bluemap --add-flags "-jar $src"
-    runHook postInstall
-  '';
-
-  meta = {
-    description = "3D minecraft map renderer";
-    homepage = "https://bluemap.bluecolored.de/";
-    sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
-    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ dandellion h7x4 ];
-    mainProgram = "bluemap";
-  };
-}
--- a/hosts/ustetind/services/gitea-runners.nix
+++ b/hosts/ustetind/services/gitea-runners.nix
@@ -15,8 +15,8 @@ let
        enable = true;
        name = "git-runner-${name}"; url = "https://git.pvv.ntnu.no";
        labels = [
-          "debian-latest:docker://node:current-bookworm"
-          "ubuntu-latest:docker://node:current-bookworm"
+          "debian-latest:docker://node:18-bullseye"
+          "ubuntu-latest:docker://node:18-bullseye"
        ];
        tokenFile = config.sops.secrets."gitea/runners/${name}".path;
      };
@@ -27,15 +27,5 @@ lib.mkMerge [
  (mkRunner "alpha")
  (mkRunner "beta")
  (mkRunner "epsilon")
-  {
-    virtualisation.podman = {
-      enable = true;
-      defaultNetwork.settings.dns_enabled = true;
-      autoPrune.enable = true;
-    };
-
-    networking.dhcpcd.IPv6rs = false;
-
-    networking.firewall.interfaces."podman+".allowedUDPPorts = [53 5353];
-  }
+  { virtualisation.podman.enable = true; }
 ]
--- a/hosts/bekkalokk/services/gitea/customization.nix
+++ b/hosts/bekkalokk/services/gitea/customization.nix
@@ -1,52 +0,0 @@
-{ config, pkgs, lib, fp, ... }:
-let
-  cfg = config.services.gitea;
-in
-{
-  services.gitea-themes.monokai = pkgs.gitea-theme-monokai;
-
-  systemd.services.gitea-customization = lib.mkIf cfg.enable {
-    description = "Install extra customization in gitea's CUSTOM_DIR";
-    wantedBy = [ "gitea.service" ];
-    requiredBy = [ "gitea.service" ];
-
-    serviceConfig =  {
-      Type = "oneshot";
-      User = cfg.user;
-      Group = cfg.group;
-    };
-
-    script = let
-      logo-svg = fp /assets/logo_blue_regular.svg;
-      logo-png = fp /assets/logo_blue_regular.png;
-      extraLinks = pkgs.writeText "gitea-extra-links.tmpl" ''
-        <a class="item" href="https://www.pvv.ntnu.no/">PVV</a>
-        <a class="item" href="https://wiki.pvv.ntnu.no/">Wiki</a>
-        <a class="item" href="https://git.pvv.ntnu.no/Drift/-/projects/4">Tokyo Drift Issues</a>
-      '';
-
-      project-labels = (pkgs.formats.yaml { }).generate "gitea-project-labels.yaml" {
-        labels = lib.importJSON ./labels/projects.json;
-      };
-
-      customTemplates = pkgs.runCommandLocal "gitea-templates" {
-        nativeBuildInputs = with pkgs; [
-          coreutils
-          gnused
-        ];
-      } ''
-        # Bigger icons
-        install -Dm444 "${cfg.package.src}/templates/repo/icon.tmpl" "$out/repo/icon.tmpl"
-        sed -i -e 's/24/48/g' "$out/repo/icon.tmpl"
-      '';
-    in ''
-      install -Dm444 ${logo-svg} ${cfg.customDir}/public/assets/img/logo.svg
-      install -Dm444 ${logo-png} ${cfg.customDir}/public/assets/img/logo.png
-      install -Dm444 ${./loading.apng} ${cfg.customDir}/public/assets/img/loading.png
-      install -Dm444 ${extraLinks} ${cfg.customDir}/templates/custom/extra_links.tmpl
-      install -Dm444 ${project-labels} ${cfg.customDir}/options/label/project-labels.yaml
-
-      "${lib.getExe pkgs.rsync}" -a "${customTemplates}/" ${cfg.customDir}/templates/
-    '';
-  };
-}
--- a/hosts/bekkalokk/services/gitea/default.nix
+++ b/hosts/bekkalokk/services/gitea/default.nix
@@ -1,12 +1,11 @@
-{ config, values, lib, unstablePkgs, ... }:
+{ config, values, pkgs, lib, ... }:
 let
  cfg = config.services.gitea;
  domain = "git.pvv.ntnu.no";
  sshPort  = 2222;
 in {
  imports = [
-    ./customization.nix
-    ./gpg.nix
+    ./ci.nix
    ./import-users
    ./web-secret-provider
  ];
@@ -26,8 +25,6 @@ in {
    enable = true;
    appName = "PVV Git";

-    package = unstablePkgs.gitea;
-
    database = {
      type = "postgres";
      host = "postgres.pvv.ntnu.no";
@@ -107,37 +104,8 @@ in {
        ENABLE_FEDERATED_AVATAR = false;
      };
      actions.ENABLED = true;
-      ui = {
-        REACTIONS = lib.concatStringsSep "," [
-          "+1"
-          "-1"
-          "laugh"
-          "confused"
-          "heart"
-          "hooray"
-          "rocket"
-          "eyes"
-          "100"
-          "anger"
-          "astonished"
-          "no_good"
-          "ok_hand"
-          "pensive"
-          "pizza"
-          "point_up"
-          "sob"
-          "skull"
-          "upside_down_face"
-          "shrug"
-        ];
-      };
      "ui.meta".DESCRIPTION = "Bokstavelig talt programvareverkstedet";
    };
-
-    dump = {
-      enable = true;
-      type = "tar.gz";
-    };
  };

  environment.systemPackages = [ cfg.package ];
@@ -163,108 +131,36 @@ in {
    };
  };

-  environment.robots-txt."gitea" = {
-    virtualHost = domain;
-    rules = [
-      {
-        pre_comment = ''
-          Gitea internals
-
-          See these for more information:
-          - https://gitea.com/robots.txt
-          - https://codeberg.org/robots.txt
-        '';
-        User-agent = "*";
-        Disallow = [
-          "/api/*"
-          "/avatars"
-          "/*/*/src/commit/*"
-          "/*/*/commit/*"
-          "/*/*/*/refs/*"
-          "/*/*/*/star"
-          "/*/*/*/watch"
-          "/*/*/labels"
-          "/*/*/activity/*"
-          "/vendor/*"
-          "/swagger.*.json"
-          "/repo/create"
-          "/repo/migrate"
-          "/org/create"
-          "/*/*/fork"
-          "/*/*/watchers"
-          "/*/*/stargazers"
-          "/*/*/forks"
-          "*/.git/"
-          "/*.git"
-          "/*.atom"
-          "/*.rss"
-        ];
-      }
-      {
-        pre_comment = "Language Spam";
-        Disallow = "/*?lang=";
-      }
-      {
-        pre_comment = ''
-          AI bots
-
-          Sourced from:
-          - https://www.vg.no/robots.txt
-          - https://codeberg.org/robots.txt
-        '';
-        User-agent = [
-          "AI2Bot"
-          "Ai2Bot-Dolma"
-          "Amazonbot"
-          "Applebot-Extended"
-          "Bytespider"
-          "CCBot"
-          "ChatGPT-User"
-          "Claude-Web"
-          "ClaudeBot"
-          "Crawlspace"
-          "Diffbot"
-          "FacebookBot"
-          "FriendlyCrawler"
-          "GPTBot"
-          "Google-Extended"
-          "ICC-Crawler"
-          "ImagesiftBot"
-          "Kangaroo Bot"
-          "Meta-ExternalAgent"
-          "OAI-SearchBot"
-          "Omgili"
-          "Omgilibot"
-          "PanguBot"
-          "PerplexityBot"
-          "PetalBot"
-          "Scrapy"
-          "SemrushBot-OCOB"
-          "Sidetrade indexer bot"
-          "Timpibot"
-          "VelenPublicWebCrawler"
-          "Webzio-Extended"
-          "YouBot"
-          "anthropic-ai"
-          "cohere-ai"
-          "cohere-training-data-crawler"
-          "facebookexternalhit"
-          "iaskspider/2.0"
-          "img2dataset"
-          "meta-externalagent"
-          "omgili"
-          "omgilibot"
-        ];
-        Disallow = "/";
-      }
-      {
-        Crawl-delay = "2";
-      }
-      {
-        Sitemap = "https://${domain}/sitemap.xml";
-      }
-    ];
-  };
-
  networking.firewall.allowedTCPPorts = [ sshPort ];
+
+  # Extra customization
+
+  services.gitea-themes.monokai = pkgs.gitea-theme-monokai;
+
+  systemd.services.install-gitea-customization = {
+    description = "Install extra customization in gitea's CUSTOM_DIR";
+    wantedBy = [ "gitea.service" ];
+    requiredBy = [ "gitea.service" ];
+
+    serviceConfig =  {
+      Type = "oneshot";
+      User = cfg.user;
+      Group = cfg.group;
+    };
+
+    script = let
+      logo-svg = ../../../../assets/logo_blue_regular.svg;
+      logo-png = ../../../../assets/logo_blue_regular.png;
+      extraLinks = pkgs.writeText "gitea-extra-links.tmpl" ''
+        <a class="item" href="https://www.pvv.ntnu.no/">PVV</a>
+        <a class="item" href="https://wiki.pvv.ntnu.no/">Wiki</a>
+        <a class="item" href="https://git.pvv.ntnu.no/Drift/-/projects/4">Tokyo Drift Issues</a>
+      '';
+    in ''
+      install -Dm444 ${logo-svg} ${cfg.customDir}/public/assets/img/logo.svg
+      install -Dm444 ${logo-png} ${cfg.customDir}/public/assets/img/logo.png
+      install -Dm444 ${./loading.apng} ${cfg.customDir}/public/assets/img/loading.png
+      install -Dm444 ${extraLinks} ${cfg.customDir}/templates/custom/extra_links.tmpl
+    '';
+  };
 }
--- a/hosts/bekkalokk/services/gitea/gpg.nix
+++ b/hosts/bekkalokk/services/gitea/gpg.nix
@@ -1,38 +0,0 @@
-{ config, pkgs, lib, ... }:
-let
-  cfg = config.services.gitea;
-  GNUPGHOME = "${config.users.users.gitea.home}/gnupg";
-in
-{
-  sops.secrets."gitea/gpg-signing-key" = {
-    owner = cfg.user;
-    inherit (cfg) group;
-  };
-
-  systemd.services.gitea.environment = { inherit GNUPGHOME; };
-
-  systemd.tmpfiles.settings."20-gitea-gnugpg".${GNUPGHOME}.d = {
-    inherit (cfg) user group;
-    mode = "700";
-  };
-
-  systemd.services.gitea-ensure-gnupg-homedir = {
-    description = "Import gpg key for gitea";
-    environment = { inherit GNUPGHOME; };
-    serviceConfig = {
-      Type = "oneshot";
-      User = cfg.user;
-      PrivateNetwork = true;
-    };
-    script = ''
-      ${lib.getExe pkgs.gnupg} --import ${config.sops.secrets."gitea/gpg-signing-key".path}
-    '';
-  };
-
-  services.gitea.settings."repository.signing" = {
-    SIGNING_KEY = "0549C43374D2253C";
-    SIGNING_NAME = "PVV Git";
-    SIGNING_EMAIL = "gitea@git.pvv.ntnu.no";
-    INITIAL_COMMIT = "always";
-  };
-}
--- a/hosts/bekkalokk/services/gitea/import-users/gitea-import-users.py
+++ b/hosts/bekkalokk/services/gitea/import-users/gitea-import-users.py
@@ -177,7 +177,6 @@ def ensure_gitea_user_is_part_of_team(
 # List of teams that all users should be part of by default
 COMMON_USER_TEAMS = [
    ("Projects", "Members"),
-    ("Grzegorz", "Members"),
    ("Kurs", "Members"),
 ]

--- a/hosts/bekkalokk/services/gitea/labels/projects.json
+++ b/hosts/bekkalokk/services/gitea/labels/projects.json
@@ -1,116 +0,0 @@
-[
-  {
-    "name": "art",
-    "exclusive": false,
-    "color": "#006b75",
-    "description": "Requires some creativity"
-  },
-  {
-    "name": "big",
-    "exclusive": false,
-    "color": "#754bc4",
-    "description": "This is gonna take a while"
-  },
-  {
-    "name": "blocked",
-    "exclusive": false,
-    "color": "#850021",
-    "description": "This issue/PR depends on one or more other issues/PRs"
-  },
-  {
-    "name": "bug",
-    "exclusive": false,
-    "color": "#f05048",
-    "description": "Something brokey"
-  },
-  {
-    "name": "ci-cd",
-    "exclusive": false,
-    "color": "#d1ff78",
-    "description": "Continuous integrals and continuous derivation"
-  },
-  {
-    "name": "crash report",
-    "exclusive": false,
-    "color": "#ed1111",
-    "description": "Report an oopsie"
-  },
-  {
-    "name": "disputed",
-    "exclusive": false,
-    "color": "#5319e7",
-    "description": "Kranglefanter"
-  },
-  {
-    "name": "documentation",
-    "exclusive": false,
-    "color": "#fbca04",
-    "description": "Documentation changes required"
-  },
-  {
-    "name": "duplicate",
-    "exclusive": false,
-    "color": "#cccccc",
-    "description": "This issue or pull request already exists"
-  },
-  {
-    "name": "feature request",
-    "exclusive": false,
-    "color": "#0052cc",
-    "description": ""
-  },
-  {
-    "name": "good first issue",
-    "exclusive": false,
-    "color": "#009800",
-    "description": "Get your hands dirty with a new project here"
-  },
-  {
-    "name": "me gusta",
-    "exclusive": false,
-    "color": "#30ff36",
-    "description": "( ͡° ͜ʖ ͡°)"
-  },
-  {
-    "name": "packaging",
-    "exclusive": false,
-    "color": "#bf642b",
-    "description": ""
-  },
-  {
-    "name": "question",
-    "exclusive": false,
-    "color": "#cc317c",
-    "description": ""
-  },
-  {
-    "name": "security",
-    "exclusive": false,
-    "color": "#ed1111",
-    "description": "Skommel"
-  },
-  {
-    "name": "techdebt spring cleaning",
-    "exclusive": false,
-    "color": "#8c6217",
-    "description": "The code is smelly 👃"
-  },
-  {
-    "name": "testing",
-    "exclusive": false,
-    "color": "#52b373",
-    "description": "Poke it and see if it explodes"
-  },
-  {
-    "name": "ui/ux",
-    "exclusive": false,
-    "color": "#f28852",
-    "description": "User complaints about ergonomics and economics and whatever"
-  },
-  {
-    "name": "wontfix",
-    "exclusive": false,
-    "color": "#ffffff",
-    "description": "Nei, vil ikke"
-  }
-]
--- a/hosts/bekkalokk/services/gitea/web-secret-provider/default.nix
+++ b/hosts/bekkalokk/services/gitea/web-secret-provider/default.nix
@@ -3,7 +3,6 @@ let
  organizations = [
    "Drift"
    "Projects"
-    "Grzegorz"
    "Kurs"
  ];

@@ -28,7 +27,6 @@ in
  users.users."gitea-web" = {
    group = "gitea-web";
    isSystemUser = true;
-    shell = pkgs.bash;
  };

  sops.secrets."gitea/web-secret-provider/token" = {
@@ -60,7 +58,6 @@ in
          key-dir = "/var/lib/gitea-web/keys/%i";
          authorized-keys-path = "/var/lib/gitea-web/authorized_keys.d/%i";
          rrsync-script = pkgs.writeShellScript "rrsync-chown" ''
-            mkdir -p "$1"
            ${lib.getExe pkgs.rrsync} -wo "$1"
            ${pkgs.coreutils}/bin/chown -R gitea-web:gitea-web "$1"
          '';
--- a/hosts/bekkalokk/services/gitea/web-secret-provider/gitea-web-secret-provider.py
+++ b/hosts/bekkalokk/services/gitea/web-secret-provider/gitea-web-secret-provider.py
@@ -34,21 +34,7 @@ def get_org_repo_list(args: argparse.Namespace, token: str):
        f"{args.api_url}/orgs/{args.org}/repos",
        headers = { 'Authorization': 'token ' + token },
    )
-
-    results = [repo["name"] for repo in result.json()]
-    target = int(result.headers['X-Total-Count'])
-
-    i = 2
-    while len(results) < target:
-        result = requests.get(
-            f"{args.api_url}/orgs/{args.org}/repos",
-            params = { 'page': i },
-            headers = { 'Authorization': 'token ' + token },
-        )
-        results += [repo["name"] for repo in result.json()]
-        i += 1
-
-    return results
+    return [repo["name"] for repo in result.json()]


 def generate_ssh_key(args: argparse.Namespace, repository: str):
--- a/hosts/bekkalokk/services/mediawiki/default.nix
+++ b/hosts/bekkalokk/services/mediawiki/default.nix
@@ -1,4 +1,4 @@
-{ pkgs, lib, fp, config, values, pkgs-unstable, ... }: let
+{ pkgs, lib, config, values, pkgs-unstable, ... }: let
  cfg = config.services.mediawiki;

  # "mediawiki"
@@ -210,8 +210,8 @@ in {
        '';
      };

-      "= /PNG/PVV-logo.svg".alias = fp /assets/logo_blue_regular.svg;
-      "= /PNG/PVV-logo.png".alias = fp /assets/logo_blue_regular.png;
+      "= /PNG/PVV-logo.svg".alias = ../../../../assets/logo_blue_regular.svg;
+      "= /PNG/PVV-logo.png".alias = ../../../../assets/logo_blue_regular.png;
      "= /favicon.ico".alias = pkgs.runCommandLocal "mediawiki-favicon.ico" {
        buildInputs = with pkgs; [ imagemagick ];
      } ''
@@ -219,7 +219,7 @@ in {
          -resize x64 \
          -gravity center \
          -crop 64x64+0+0 \
-          ${fp /assets/logo_blue_regular.png} \
+          ${../../../../assets/logo_blue_regular.png} \
          -flatten \
          -colors 256 \
          -background transparent \
--- a/hosts/bekkalokk/services/vaultwarden.nix
+++ b/hosts/bekkalokk/services/vaultwarden.nix
@@ -83,6 +83,7 @@ in {
      ProtectKernelLogs = true;
      ProtectKernelModules = true;
      ProtectKernelTunables = true;
+      ProtectProc = "invisible";
      RestrictAddressFamilies = [
        "AF_INET"
        "AF_INET6"
@@ -97,6 +98,7 @@ in {
        "@system-service"
        "~@privileged"
      ];
+      UMask = "0007";
    };
  };
 }
--- a/hosts/bekkalokk/services/webmail/roundcube.nix
+++ b/hosts/bekkalokk/services/webmail/roundcube.nix
@@ -6,11 +6,6 @@ let
  domain = "webmail.pvv.ntnu.no";
 in
 {
-  sops.secrets."roundcube/postgres_password" = {
-    owner = "nginx";
-    group = "nginx";
-  };
-
  services.roundcube = {
    enable = true;

@@ -21,15 +16,10 @@ in
      custom_from
    ]);

-    dicts = with pkgs.aspellDicts; [ en en-computers nb nn fr de it ];
+    dicts = with pkgs.aspellDicts; [ en en-science en-computers nb nn fr de it ];
    maxAttachmentSize = 20;
    hostName = "roundcubeplaceholder.example.com";

-    database = {
-      host = "postgres.pvv.ntnu.no";
-      passwordFile = config.sops.secrets."roundcube/postgres_password".path;
-    };
-
    extraConfig = ''
      $config['enable_installer'] = false;
      $config['default_host'] = "ssl://imap.pvv.ntnu.no";
--- a/hosts/bekkalokk/services/webmail/snappymail.nix
+++ b/hosts/bekkalokk/services/webmail/snappymail.nix
@@ -1,8 +1,8 @@
-{ config, lib, fp, pkgs, ... }:
+{ config, lib, pkgs, ... }:
 let
  cfg = config.services.snappymail;
 in {
-  imports = [ (fp /modules/snappymail.nix) ];
+  imports = [ ../../../../modules/snappymail.nix ];

  services.snappymail = {
    enable = true;
--- a/hosts/bekkalokk/services/website/default.nix
+++ b/hosts/bekkalokk/services/website/default.nix
@@ -116,6 +116,16 @@ in {
      "/drift".return = "301 https://wiki.pvv.ntnu.no/wiki/Drift";
      "/diverse/abuse.php".return = "301 https://wiki.pvv.ntnu.no/wiki/CERT/Abuse";
      "/nerds/".return = "301 https://wiki.pvv.ntnu.no/wiki/Nerdepizza";
+
+      # Proxy the matrix well-known files
+      # Host has be set before proxy_pass
+      # The header must be set so nginx on the other side routes it to the right place
+      "^~ /.well-known/matrix/" = {
+        extraConfig = ''
+          proxy_set_header Host matrix.pvv.ntnu.no;
+          proxy_pass https://matrix.pvv.ntnu.no/.well-known/matrix/;
+        '';
+      };
    };
  };
 }
--- a/hosts/bekkalokk/services/website/fetch-gallery.nix
+++ b/hosts/bekkalokk/services/website/fetch-gallery.nix
@@ -62,33 +62,6 @@ in {
      WorkingDirectory = galleryDir;
      User = config.services.pvv-nettsiden.user;
      Group = config.services.pvv-nettsiden.group;
-
-      AmbientCapabilities = [ "" ];
-      CapabilityBoundingSet = [ "" ];
-      DeviceAllow = [ "" ];
-      LockPersonality = true;
-      MemoryDenyWriteExecute = true;
-      NoNewPrivileges = true; # disable for third party rotate scripts
-      PrivateDevices = true;
-      PrivateNetwork = true; # disable for mail delivery
-      PrivateTmp = true;
-      ProtectClock = true;
-      ProtectControlGroups = true;
-      ProtectHome = true; # disable for userdir logs
-      ProtectHostname = true;
-      ProtectKernelLogs = true;
-      ProtectKernelModules = true;
-      ProtectKernelTunables = true;
-      ProtectProc = "invisible";
-      ProtectSystem = "full";
-      RestrictNamespaces = true;
-      RestrictRealtime = true;
-      RestrictSUIDSGID = true; # disable for creating setgid directories
-      SocketBindDeny = [ "any" ];
-      SystemCallArchitectures = "native";
-      SystemCallFilter = [
-        "@system-service"
-      ];
    };
  };
 }
--- a/hosts/bekkalokk/services/well-known/default.nix
+++ b/hosts/bekkalokk/services/well-known/default.nix
@@ -1,18 +0,0 @@
-{ ... }:
-{
-  services.nginx.virtualHosts."www.pvv.ntnu.no".locations = {
-    "^~ /.well-known/" = {
-      alias = (toString ./root) + "/";
-    };
-
-    # Proxy the matrix well-known files
-    # Host has be set before proxy_pass
-    # The header must be set so nginx on the other side routes it to the right place
-    "^~ /.well-known/matrix/" = {
-      extraConfig = ''
-        proxy_set_header Host matrix.pvv.ntnu.no;
-        proxy_pass https://matrix.pvv.ntnu.no/.well-known/matrix/;
-      '';
-    };
-  };
-}
--- a/hosts/bekkalokk/services/well-known/root/autoconfig/mail/config-v1.1.xml
+++ b/hosts/bekkalokk/services/well-known/root/autoconfig/mail/config-v1.1.xml
@@ -1,31 +0,0 @@
-<?xml version="1.0"?>
-<clientConfig version="1.1">
-  <emailProvider id="pvv.ntnu.no">
-    <domain>pvv.ntnu.no</domain>
-    <domain>pvv.org</domain>
-
-    <displayName>Programvareverkstedet</displayName>
-
-    <incomingServer type="imap">
-      <hostname>imap.pvv.ntnu.no</hostname>
-      <port>993</port>
-      <socketType>SSL</socketType>
-      <username>%EMAILLOCALPART%</username>
-      <authentication>password-cleartext</authentication>
-    </incomingServer>
-
-    <outgoingServer type="smtp">
-      <hostname>smtp.pvv.ntnu.no</hostname>
-      <port>587</port>
-      <socketType>STARTTLS</socketType>
-      <username>%EMAILLOCALPART%</username>
-      <authentication>password-cleartext</authentication>
-      <useGlobalPreferredServer>true</useGlobalPreferredServer>
-    </outgoingServer>
-
-    <documentation url="https://www.pvv.ntnu.no/pvv/Drift/Mail/IMAP_POP3">
-       <descr lang="en">Setup programvareverkstedet email user with IMAP or POP3</descr>
-       <descr lang="nb">Sett opp programvareverkstedet email bruker med IMAP eller POP3</descr>
-    </documentation>
-  </emailProvider>
-</clientConfig>
--- a/hosts/bekkalokk/services/well-known/root/security.txt
+++ b/hosts/bekkalokk/services/well-known/root/security.txt
@@ -1,12 +0,0 @@
-Contact: mailto:drift@pvv.ntnu.no
-Contact: mailto:cert@pvv.ntnu.no
-# drift@pvv.ntnu.no is read by more people and have a quicker reaction time,
-# but cert@pvv.ntnu.no can be used for more severe issues.
-
-Preferred-Languages: no, en
-
-Expires: 2032-12-31T23:59:59.000Z
-# This file was last updated 2024-09-14.
-
-# You can find a wikipage for our security policies at:
-# https://wiki.pvv.ntnu.no/wiki/CERT
--- a/hosts/bicep/configuration.nix
+++ b/hosts/bicep/configuration.nix
@@ -1,10 +1,10 @@
-{ fp, pkgs, values, ... }:
+{ pkgs, values, ... }:
 {
  imports = [
    ./hardware-configuration.nix

-    (fp /base)
-    (fp /misc/metrics-exporters.nix)
+    ../../base
+    ../../misc/metrics-exporters.nix
    ./services/nginx

    ./services/mysql.nix
@@ -15,7 +15,7 @@
    ./services/matrix
  ];

-  sops.defaultSopsFile = fp /secrets/bicep/bicep.yaml;
+  sops.defaultSopsFile = ../../secrets/bicep/bicep.yaml;
  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
  sops.age.generateKey = true;
--- a/hosts/bicep/services/calendar-bot.nix
+++ b/hosts/bicep/services/calendar-bot.nix
@@ -1,16 +1,16 @@
-{ config, fp, lib, pkgs, ... }:
+{ config, lib, pkgs, ... }:
 let
  cfg = config.services.pvv-calendar-bot;
 in {
  sops.secrets = {
    "calendar-bot/matrix_token" = {
-      sopsFile = fp /secrets/bicep/bicep.yaml;
+      sopsFile = ../../../secrets/bicep/bicep.yaml;
      key = "calendar-bot/matrix_token";
      owner = cfg.user;
      group = cfg.group;
    };
    "calendar-bot/mysql_password" = {
-      sopsFile = fp /secrets/bicep/bicep.yaml;
+      sopsFile = ../../../secrets/bicep/bicep.yaml;
      key = "calendar-bot/mysql_password";
      owner = cfg.user;
      group = cfg.group;
--- a/hosts/bicep/services/matrix/coturn.nix
+++ b/hosts/bicep/services/matrix/coturn.nix
@@ -1,14 +1,14 @@
-{ config, lib, fp, pkgs, secrets, values, ... }:
+{ config, lib, pkgs, secrets, ... }:

 {
  sops.secrets."matrix/synapse/turnconfig" = {
-    sopsFile = fp /secrets/bicep/matrix.yaml;
+    sopsFile = ../../../../secrets/bicep/matrix.yaml;
    key = "synapse/turnconfig";
    owner = config.users.users.matrix-synapse.name;
    group = config.users.users.matrix-synapse.group;
  };
  sops.secrets."matrix/coturn/static-auth-secret" = {
-    sopsFile = fp /secrets/bicep/matrix.yaml;
+    sopsFile = ../../../../secrets/bicep/matrix.yaml;
    key = "coturn/static-auth-secret";
    owner = config.users.users.turnserver.name;
    group = config.users.users.turnserver.group;
@@ -48,9 +48,6 @@

  users.users.turnserver.extraGroups = [ "acme" ];

-  # It needs this to be allowed to access the files with the acme group
-  systemd.services.coturn.serviceConfig.PrivateUsers = lib.mkForce false;
-
  systemd.services."acme-${config.services.coturn.realm}".serviceConfig = {
    AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
  };
@@ -63,14 +60,12 @@
    pkey = "${config.security.acme.certs.${realm}.directory}/key.pem";

    use-auth-secret = true;
+    # World readable but I  dont think it's that bad
    static-auth-secret-file = config.sops.secrets."matrix/coturn/static-auth-secret".path;

    secure-stun = true;

-    listening-ips = [
-      values.services.turn.ipv4
-      values.services.turn.ipv6
-    ];
+    listening-ips = [ "129.241.210.213" "2001:700:300:1900::213" ];

    tls-listening-port = 443;
    alt-tls-listening-port = 5349;
--- a/hosts/bicep/services/matrix/default.nix
+++ b/hosts/bicep/services/matrix/default.nix
@@ -10,7 +10,6 @@
    ./mjolnir.nix

    ./discord.nix
-    ./hookshot
  ];


--- a/hosts/bicep/services/matrix/discord.nix
+++ b/hosts/bicep/services/matrix/discord.nix
@@ -1,4 +1,4 @@
-{ config, lib, fp, ... }:
+{ config, lib, ... }:

 let
  cfg = config.services.mx-puppet-discord;
@@ -6,42 +6,15 @@ in
 {
  users.groups.keys-matrix-registrations = { };

-  sops.secrets."matrix/discord/as_token" = {
-    sopsFile = fp /secrets/bicep/matrix.yaml;
-    key = "discord/as_token";
-  };
-  sops.secrets."matrix/discord/hs_token" = {
-    sopsFile = fp /secrets/bicep/matrix.yaml;
-    key = "discord/hs_token";
-  };
-
-  sops.templates."discord-registration.yaml" = {
+  sops.secrets."matrix/registrations/mx-puppet-discord" = {
+    sopsFile = ../../../../secrets/bicep/matrix.yaml;
+    key = "registrations/mx-puppet-discord";
    owner = config.users.users.matrix-synapse.name;
    group = config.users.groups.keys-matrix-registrations.name;
-    content = ''
-      as_token: "${config.sops.placeholder."matrix/discord/as_token"}"
-      hs_token: "${config.sops.placeholder."matrix/discord/hs_token"}"
-      id: discord-puppet
-      namespaces:
-        users:
-          - exclusive: true
-            regex: '@_discordpuppet_.*'
-        rooms: []
-        aliases:
-          - exclusive: true
-            regex: '#_discordpuppet_.*'
-      protocols: []
-      rate_limited: false
-      sender_localpart: _discordpuppet_bot
-      url: 'http://localhost:8434'
-      de.sorunome.msc2409.push_ephemeral: true
-    '';
  };

  systemd.services.mx-puppet-discord = {
-    serviceConfig.SupplementaryGroups = [
-      config.users.groups.keys-matrix-registrations.name
-    ];
+    serviceConfig.SupplementaryGroups = [ config.users.groups.keys-matrix-registrations.name ];
  };


@@ -56,16 +29,11 @@ in
    relay.whitelist = [ ".*" ];
    selfService.whitelist = [ "@danio:pvv\\.ntnu\\.no" "@dandellion:dodsorf\\.as" ];
  };
-  services.mx-puppet-discord.serviceDependencies = [
-    "matrix-synapse.target"
-    "nginx.service"
-  ];
+  services.mx-puppet-discord.serviceDependencies = [ "matrix-synapse.target" "nginx.service" ];


  services.matrix-synapse-next.settings = {
-    app_service_config_files = [
-      config.sops.templates."discord-registration.yaml".path
-    ];
+    app_service_config_files = [ config.sops.secrets."matrix/registrations/mx-puppet-discord".path ];
    use_appservice_legacy_authorization = true;
  };

--- a/hosts/bicep/services/matrix/hookshot/default.nix
+++ b/hosts/bicep/services/matrix/hookshot/default.nix
@@ -1,135 +0,0 @@
-{ config, lib, fp, unstablePkgs, inputs, ... }:
-
-let
-  cfg = config.services.matrix-hookshot;
-  webhookListenAddress = "127.0.0.1";
-  webhookListenPort = 8435;
-in
-{
-  sops.secrets."matrix/hookshot/as_token" = {
-    sopsFile = fp /secrets/bicep/matrix.yaml;
-    key = "hookshot/as_token";
-  };
-  sops.secrets."matrix/hookshot/hs_token" = {
-    sopsFile = fp /secrets/bicep/matrix.yaml;
-    key = "hookshot/hs_token";
-  };
-
-  sops.templates."hookshot-registration.yaml" = {
-    owner = config.users.users.matrix-synapse.name;
-    group = config.users.groups.keys-matrix-registrations.name;
-    content = ''
-      id: matrix-hookshot
-      as_token: "${config.sops.placeholder."matrix/hookshot/as_token"}"
-      hs_token: "${config.sops.placeholder."matrix/hookshot/hs_token"}"
-      namespaces:
-        rooms: []
-        users:
-          - regex: "@_webhooks_.*:pvv.ntnu.no"
-            exclusive: true
-          - regex: "@bot_feeds:pvv.ntnu.no"
-            exclusive: true
-        aliases: []
-
-      sender_localpart: hookshot
-      url: "http://${cfg.settings.bridge.bindAddress}:${toString cfg.settings.bridge.port}"
-      rate_limited: false
-
-      # If enabling encryption
-      de.sorunome.msc2409.push_ephemeral: true
-      push_ephemeral: true
-      org.matrix.msc3202: true
-    '';
-  };
-
-  systemd.services.matrix-hookshot = {
-    serviceConfig.SupplementaryGroups = [
-      config.users.groups.keys-matrix-registrations.name
-    ];
-  };
-
-  services.matrix-hookshot = {
-    enable = true;
-    package = unstablePkgs.matrix-hookshot;
-    registrationFile = config.sops.templates."hookshot-registration.yaml".path;
-    settings = {
-      bridge = {
-        bindAddress = "127.0.0.1";
-        domain = "pvv.ntnu.no";
-        url = "https://matrix.pvv.ntnu.no";
-        mediaUrl = "https://matrix.pvv.ntnu.no";
-        port = 9993;
-      };
-      listeners = [
-        {
-          bindAddress = webhookListenAddress;
-          port = webhookListenPort;
-          resources = [
-            "webhooks"
-            # "metrics"
-            # "provisioning"
-            "widgets"
-          ];
-        }
-      ];
-      generic = {
-        enabled = true;
-        outbound = true;
-        urlPrefix = "https://hookshot.pvv.ntnu.no/webhook/";
-        userIdPrefix = "_webhooks_";
-        allowJsTransformationFunctions = false;
-        waitForComplete = false;
-      };
-      feeds = {
-        enabled = true;
-        pollIntervalSeconds = 600;
-      };
-      
-      serviceBots = [
-        { localpart = "bot_feeds";
-          displayname = "Aya";
-          avatar = ./feeds.png;
-          prefix = "!aya";
-          service = "feeds";
-        }
-      ];
-
-      permissions = [
-        # Users of the PVV Server
-        { actor = "pvv.ntnu.no";
-          services = [ { service = "*"; level = "commands"; } ];
-        }
-        # Members of Medlem space (for people with their own hs)
-        { actor = "!pZOTJQinWyyTWaeOgK:pvv.ntnu.no";
-          services = [ { service = "*"; level = "commands"; } ];
-        }
-        # Members of Drift
-        { actor = "!eYgeufLrninXxQpYml:pvv.ntnu.no";
-          services = [ { service = "*"; level = "admin"; } ];
-        }
-        # Dan bootstrap
-        { actor = "@dandellion:dodsorf.as";
-          services = [ { service = "*"; level = "admin"; } ];
-        }
-      ];
-    };
-  };
-
-  services.matrix-hookshot.serviceDependencies = [
-    "matrix-synapse.target"
-    "nginx.service"
-  ];
-
-  services.matrix-synapse-next.settings = {
-    app_service_config_files = [
-      config.sops.templates."hookshot-registration.yaml".path
-    ];
-  };
-
-  services.nginx.virtualHosts."hookshot.pvv.ntnu.no" = {
-    enableACME = true;
-    locations."/" = {
-      proxyPass = "http://${webhookListenAddress}:${toString webhookListenPort}";
-    };
-  };
-}
--- a/hosts/bicep/services/matrix/hookshot/feeds.png
+++ b/hosts/bicep/services/matrix/hookshot/feeds.png
--- a/hosts/bicep/services/matrix/mjolnir.nix
+++ b/hosts/bicep/services/matrix/mjolnir.nix
@@ -1,8 +1,8 @@
-{ config, lib, fp, ... }:
+{ config, lib, ... }:

 {
  sops.secrets."matrix/mjolnir/access_token" = {
-    sopsFile = fp /secrets/bicep/matrix.yaml;
+    sopsFile = ../../../../secrets/bicep/matrix.yaml;
    key = "mjolnir/access_token";
    owner = config.users.users.mjolnir.name;
    group = config.users.users.mjolnir.group;
--- a/hosts/bicep/services/matrix/synapse.nix
+++ b/hosts/bicep/services/matrix/synapse.nix
@@ -1,4 +1,4 @@
-{ config, lib, fp, pkgs, values, inputs, ... }:
+{ config, lib, pkgs, values, inputs, ... }:

 let
  cfg = config.services.matrix-synapse-next;
@@ -10,18 +10,23 @@ let
 in {
  sops.secrets."matrix/synapse/signing_key" = {
    key = "synapse/signing_key";
-    sopsFile = fp /secrets/bicep/matrix.yaml;
+    sopsFile = ../../../../secrets/bicep/matrix.yaml;
    owner = config.users.users.matrix-synapse.name;
    group = config.users.users.matrix-synapse.group;
  };

  sops.secrets."matrix/synapse/user_registration" = {
-    sopsFile = fp /secrets/bicep/matrix.yaml;
+    sopsFile = ../../../../secrets/bicep/matrix.yaml;
    key = "synapse/signing_key";
    owner = config.users.users.matrix-synapse.name;
    group = config.users.users.matrix-synapse.group;
  };

+  sops.secrets."matrix/sliding-sync/env" = {
+    sopsFile = ../../../../secrets/bicep/matrix.yaml;
+    key = "sliding-sync/env";
+  };
+
  services.matrix-synapse-next = {
    enable = true;

@@ -38,6 +43,8 @@ in {
    workers.eventPersisters = 2;
    workers.useUserDirectoryWorker = true;

+    enableSlidingSync = true;
+
    enableNginx = true;

    settings = {
@@ -130,6 +137,9 @@ in {
    };
  };

+  services.matrix-synapse.sliding-sync.environmentFile = config.sops.secrets."matrix/sliding-sync/env".path;
+
+
  services.redis.servers."".enable = true;

  services.nginx.virtualHosts."matrix.pvv.ntnu.no" = lib.mkMerge [
--- a/hosts/bob/configuration.nix
+++ b/hosts/bob/configuration.nix
@@ -1,16 +1,16 @@
-{ config, fp, pkgs, values, ... }:
+{ config, pkgs, values, ... }:
 {
  imports = [
      # Include the results of the hardware scan.
      ./hardware-configuration.nix
-      (fp /base)
-      (fp /misc/metrics-exporters.nix)
+      ../../base
+      ../../misc/metrics-exporters.nix
      ./disks.nix

-      (fp /misc/builder.nix)
+      ../../misc/builder.nix
    ];

-  sops.defaultSopsFile = fp /secrets/bob/bob.yaml;
+  sops.defaultSopsFile = ../../secrets/bob/bob.yaml;
  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
  sops.age.generateKey = true;
--- a/hosts/brzeczyszczykiewicz/configuration.nix
+++ b/hosts/brzeczyszczykiewicz/configuration.nix
@@ -1,10 +1,10 @@
-{ config, fp, pkgs, values, ... }:
+{ config, pkgs, values, ... }:
 {
  imports = [
      # Include the results of the hardware scan.
      ./hardware-configuration.nix
-      (fp /base)
-      (fp /misc/metrics-exporters.nix)
+      ../../base
+      ../../misc/metrics-exporters.nix

      ./services/grzegorz.nix
    ];
--- a/hosts/brzeczyszczykiewicz/services/grzegorz.nix
+++ b/hosts/brzeczyszczykiewicz/services/grzegorz.nix
@@ -1,6 +1,6 @@
-{ config, fp, ... }:
+{ config, ... }:
 {
-  imports = [ (fp /modules/grzegorz.nix) ];
+  imports = [ ../../../modules/grzegorz.nix ];

  services.nginx.virtualHosts."${config.networking.fqdn}" = {
    serverAliases = [
--- a/hosts/georg/configuration.nix
+++ b/hosts/georg/configuration.nix
@@ -1,12 +1,12 @@
-{ config, fp, pkgs, values, ... }:
+{ config, pkgs, values, ... }:
 {
  imports = [
      # Include the results of the hardware scan.
      ./hardware-configuration.nix
-      (fp /base)
-      (fp /misc/metrics-exporters.nix)
+      ../../base
+      ../../misc/metrics-exporters.nix

-      (fp /modules/grzegorz.nix)
+      ../../modules/grzegorz.nix
    ];

  boot.loader.systemd-boot.enable = true;
--- a/hosts/ildkule/configuration.nix
+++ b/hosts/ildkule/configuration.nix
@@ -1,16 +1,16 @@
-{ config, fp, pkgs, lib, values, ... }:
+{ config, pkgs, lib, values, ... }:
 {
  imports = [
      # Include the results of the hardware scan.
      ./hardware-configuration.nix
-      (fp /base)
-      (fp /misc/metrics-exporters.nix)
+      ../../base
+      ../../misc/metrics-exporters.nix

      ./services/monitoring
      ./services/nginx
    ];

-  sops.defaultSopsFile = fp /secrets/ildkule/ildkule.yaml;
+  sops.defaultSopsFile = ../../secrets/ildkule/ildkule.yaml;
  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
  sops.age.generateKey = true;
--- a/hosts/ildkule/hardware-configuration.nix
+++ b/hosts/ildkule/hardware-configuration.nix
@@ -3,14 +3,7 @@
  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "xen_blkfront" "vmw_pvscsi" ];
  boot.initrd.kernelModules = [ "nvme" ];
-  fileSystems."/" = {
-    device = "/dev/disk/by-uuid/e35eb4ce-aac3-4f91-8383-6e7cd8bbf942";
-    fsType = "ext4";
-  };
-  fileSystems."/data" = {
-    device = "/dev/disk/by-uuid/0a4c1234-02d3-4b53-aeca-d95c4c8d534b";
-    fsType = "ext4";
-  };
+  fileSystems."/" = { device = "/dev/vda1"; fsType = "ext4"; };

  networking.useDHCP = lib.mkDefault true;
 }
--- a/hosts/ildkule/services/monitoring/loki.nix
+++ b/hosts/ildkule/services/monitoring/loki.nix
@@ -2,7 +2,6 @@

 let
  cfg = config.services.loki;
-  stateDir = "/data/monitoring/loki";
 in {
  services.loki = {
    enable = true;
@@ -17,7 +16,7 @@ in {
      ingester = {
        wal = {
          enabled = true;
-          dir = "${stateDir}/wal";
+          dir = "/var/lib/loki/wal";
        };
        lifecycler = {
          address = "127.0.0.1";
@@ -49,12 +48,12 @@ in {

      storage_config = {
        boltdb_shipper = {
-          active_index_directory = "${stateDir}/boltdb-shipper-index";
-          cache_location = "${stateDir}/boltdb-shipper-cache";
+          active_index_directory = "/var/lib/loki/boltdb-shipper-index";
+          cache_location = "/var/lib/loki/boltdb-shipper-cache";
          cache_ttl = "24h";
        };
        filesystem = {
-          directory = "${stateDir}/chunks";
+          directory = "/var/lib/loki/chunks";
        };
      };

@@ -65,14 +64,14 @@ in {
      };

      compactor = {
-        working_directory = "${stateDir}/compactor";
+        working_directory = "/var/lib/loki/compactor";
      };

      # ruler = {
      #   storage = {
      #     type = "local";
      #     local = {
-      #       directory = "${stateDir}/rules";
+      #       directory = "/var/lib/loki/rules";
      #     };
      #   };
      #   rule_path = "/etc/loki/rules";
--- a/hosts/ildkule/services/monitoring/prometheus/default.nix
+++ b/hosts/ildkule/services/monitoring/prometheus/default.nix
@@ -1,6 +1,4 @@
-{ config, ... }: let
-  stateDir = "/data/monitoring/prometheus";
-in {
+{ config, ... }: {
  imports = [
    ./gitea.nix
    ./matrix-synapse.nix
@@ -12,15 +10,9 @@ in {

  services.prometheus = {
    enable = true;
-
    listenAddress = "127.0.0.1";
    port = 9001;

    ruleFiles = [ rules/synapse-v2.rules ];
  };
-
-  fileSystems."/var/lib/prometheus2" = {
-    device = stateDir;
-    options = [ "bind" ];
-  };
 }
--- a/hosts/ildkule/services/monitoring/uptime-kuma.nix
+++ b/hosts/ildkule/services/monitoring/uptime-kuma.nix
@@ -2,7 +2,6 @@
 let
  cfg = config.services.uptime-kuma;
  domain = "status.pvv.ntnu.no";
-  stateDir = "/data/monitoring/uptime-kuma";
 in {
  services.uptime-kuma = {
    enable = true;
@@ -18,9 +17,4 @@ in {
    kTLS = true;
    locations."/".proxyPass = "http://${cfg.settings.HOST}:${cfg.settings.PORT}";
  };
-
-  fileSystems."/var/lib/uptime-kuma" = {
-    device = stateDir;
-    options = [ "bind" ];
-  };
 }
--- a/hosts/shark/configuration.nix
+++ b/hosts/shark/configuration.nix
@@ -1,13 +1,13 @@
-{ config, fp, pkgs, values, ... }:
+{ config, pkgs, values, ... }:
 {
  imports = [
      # Include the results of the hardware scan.
      ./hardware-configuration.nix
-      (fp /base)
-      (fp /misc/metrics-exporters.nix)
+      ../../base
+      ../../misc/metrics-exporters.nix
    ];

-  sops.defaultSopsFile = fp /secrets/shark/shark.yaml;
+  sops.defaultSopsFile = ../../secrets/shark/shark.yaml;
  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
  sops.age.generateKey = true;
--- a/hosts/ustetind/configuration.nix
+++ b/hosts/ustetind/configuration.nix
@@ -1,44 +0,0 @@
-{ config, fp, pkgs, lib, values, ... }:
-
-{
-  imports = [
-    (fp /base)
-    (fp /misc/metrics-exporters.nix)
-
-    ./services/gitea-runners.nix
-  ];
-
-  sops.defaultSopsFile = fp /secrets/ustetind/ustetind.yaml;
-  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
-  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
-  sops.age.generateKey = true;
-
-  networking.hostName = "ustetind";
-
-  networking.useHostResolvConf = lib.mkForce false;
-
-  systemd.network.networks = {
-    "30-lxc-eth" = values.defaultNetworkConfig // {
-      matchConfig = {
-        Type = "ether";
-        Kind = "veth";
-        Name = [
-          "eth*"
-        ];
-      };
-      address = with values.hosts.ustetind; [ (ipv4 + "/25") (ipv6 + "/64") ];
-    };
-    "40-podman-veth" = values.defaultNetworkConfig // {
-      matchConfig = {
-        Type = "ether";
-        Kind = "veth";
-        Name = [
-          "veth*"
-        ];
-      };
-      DHCP = "yes";
-    };
-  };
-
-  system.stateVersion = "24.11";
-}
--- a/misc/builder.nix
+++ b/misc/builder.nix
@@ -2,10 +2,4 @@

 {
  nix.settings.trusted-users = [ "@nix-builder-users" ];
-  nix.daemonCPUSchedPolicy = "batch";
-
-  boot.binfmt.emulatedSystems = [
-    "aarch64-linux"
-    "armv7l-linux"
-  ];
 }
--- a/modules/grzegorz.nix
+++ b/modules/grzegorz.nix
@@ -1,95 +1,59 @@
 {config, lib, pkgs, ...}:
 let
-  grg = config.services.greg-ng;
+  grg = config.services.grzegorz;
  grgw = config.services.grzegorz-webui;
-
-  machine = config.networking.hostName;
 in {
-  services.greg-ng = {
-    enable = true;
-    settings.host = "localhost";
-    settings.port = 31337;
-    enableSway = true;
-    enablePipewire = true;
+  services.pipewire.enable = true;
+  services.pipewire.alsa.enable = true;
+  services.pipewire.alsa.support32Bit = true;
+  services.pipewire.pulse.enable = true;
+
+  users.users.pvv = {
+    isNormalUser = true;
+    description = "pvv";
  };

-  services.grzegorz-webui = {
-    enable = true;
-    listenAddr = "localhost";
-    listenPort = 42069;
-    listenWebsocketPort = 42042;
-    hostName = "${machine}-old.pvv.ntnu.no";
-    apiBase = "https://${machine}-backend.pvv.ntnu.no/api";
-  };
+  services.grzegorz.enable = true;
+  services.grzegorz.listenAddr = "localhost";
+  services.grzegorz.listenPort = 31337;

-  services.gergle = {
-    enable = true;
-    virtualHost = config.networking.fqdn;
-  };
+  services.grzegorz-webui.enable = true;
+  services.grzegorz-webui.listenAddr = "localhost";
+  services.grzegorz-webui.listenPort = 42069;
+  services.grzegorz-webui.listenWebsocketPort = 42042;
+  services.grzegorz-webui.hostName = "${config.networking.fqdn}";
+  services.grzegorz-webui.apiBase = "http://${toString grg.listenAddr}:${toString grg.listenPort}/api";

  services.nginx.enable = true;
-  services.nginx.virtualHosts = {
-    ${config.networking.fqdn} = {
-      forceSSL = true;
-      enableACME = true;
-      kTLS = true;
-      serverAliases = [
-        "${machine}.pvv.org"
-      ];
-      extraConfig = ''
-        allow 129.241.210.128/25;
-        allow 2001:700:300:1900::/64;
-        deny all;
-      '';
+
+  services.nginx.virtualHosts."${config.networking.fqdn}" = {
+    forceSSL = true;
+    enableACME = true;
+    kTLS = true;
+    serverAliases = [
+      "${config.networking.hostName}.pvv.org"
+    ];
+    extraConfig = ''
+      allow 129.241.210.128/25;
+      allow 2001:700:300:1900::/64;
+      deny all;
+    '';
+
+    locations."/" = {
+      proxyPass = "http://localhost:${builtins.toString config.services.grzegorz-webui.listenPort}";
    };
-
-    "${machine}-backend.pvv.ntnu.no" = {
-      forceSSL = true;
-      enableACME = true;
-      kTLS = true;
-      serverAliases = [
-        "${machine}-backend.pvv.org"
-      ];
-      extraConfig = ''
-        allow 129.241.210.128/25;
-        allow 2001:700:300:1900::/64;
-        deny all;
-      '';
-
-      locations."/" = {
-        proxyPass = "http://${grg.settings.host}:${toString grg.settings.port}";
-        proxyWebsockets = true;
-      };
+    # https://github.com/rawpython/remi/issues/216
+    locations."/websocket" = {
+      proxyPass = "http://localhost:${builtins.toString config.services.grzegorz-webui.listenWebsocketPort}";
+      proxyWebsockets = true;
    };
-
-    "${machine}-old.pvv.ntnu.no" = {
-      forceSSL = true;
-      enableACME = true;
-      kTLS = true;
-      serverAliases = [
-        "${machine}-old.pvv.org"
-      ];
-      extraConfig = ''
-        allow 129.241.210.128/25;
-        allow 2001:700:300:1900::/64;
-        deny all;
-      '';
-
-      locations."/" = {
-        proxyPass = "http://${grgw.listenAddr}:${toString grgw.listenPort}";
-      };
-      # https://github.com/rawpython/remi/issues/216
-      locations."/websocket" = {
-        proxyPass = "http://${grgw.listenAddr}:${toString grgw.listenWebsocketPort}";
-        proxyWebsockets = true;
-      };
-      locations."/api" = {
-        proxyPass = "http://${grg.settings.host}:${toString grg.settings.port}";
-      };
-      locations."/docs" = {
-        proxyPass = "http://${grg.settings.host}:${toString grg.settings.port}";
-      };
+    locations."/api" = {
+      proxyPass = "http://localhost:${builtins.toString config.services.grzegorz.listenPort}";
+    };
+    locations."/docs" = {
+      proxyPass = "http://localhost:${builtins.toString config.services.grzegorz.listenPort}";
    };
  };
+
 }

--- a/modules/robots-txt.nix
+++ b/modules/robots-txt.nix
@@ -1,116 +0,0 @@
-{ config, pkgs, lib, ... }:
-let
-  cfg = config.environment.robots-txt;
-
-  robots-txt-format = {
-    type = let
-      coercedStrToNonEmptyListOfStr = lib.types.coercedTo lib.types.str lib.singleton (lib.types.nonEmptyListOf lib.types.str);
-    in lib.types.listOf (lib.types.submodule {
-      freeformType = lib.types.attrsOf coercedStrToNonEmptyListOfStr;
-      options = {
-        pre_comment = lib.mkOption {
-          description = "Comment to add before the rule";
-          type = lib.types.lines;
-          default = "";
-        };
-        post_comment = lib.mkOption {
-          description = "Comment to add after the rule";
-          type = lib.types.lines;
-          default = "";
-        };
-      };
-    });
-
-    generate = name: value: let
-      makeComment = comment: lib.pipe comment [
-        (lib.splitString "\n")
-        (lib.map (line: if line == "" then "#" else "# ${line}"))
-        (lib.concatStringsSep "\n")
-      ];
-
-      ruleToString = rule: let
-        user_agent = rule.User-agent or [];
-        pre_comment = rule.pre_comment;
-        post_comment = rule.post_comment;
-        rest = builtins.removeAttrs rule [ "User-agent" "pre_comment" "post_comment" ];
-      in lib.concatStringsSep "\n" (lib.filter (x: x != null) [
-        (if (pre_comment != "") then makeComment pre_comment else null)
-        (let
-          user-agents = lib.concatMapStringsSep "\n" (value: "User-agent: ${value}") user_agent;
-        in
-          if user_agent == [] then null else user-agents
-        )
-        (lib.pipe rest [
-          (lib.mapAttrsToList (ruleName: map (value: "${ruleName}: ${value}")))
-          lib.concatLists
-          (lib.concatStringsSep "\n")
-        ])
-        (if (post_comment != "") then makeComment post_comment else null)
-      ]);
-
-      content = lib.concatMapStringsSep "\n\n" ruleToString value;
-    in pkgs.writeText name content;
-  };
-in
-{
-  options.environment.robots-txt = lib.mkOption {
-    default = { };
-    description = ''
-      Different instances of robots.txt to use with web services.
-    '';
-    type = lib.types.attrsOf (lib.types.submodule ({ name, ... }: {
-      options = {
-        enable = lib.mkEnableOption "this instance of robots.txt" // {
-          default = true;
-        };
-
-        path = lib.mkOption {
-          description = "The resulting path of the dir containing the robots.txt file";
-          type = lib.types.path;
-          readOnly = true;
-          default = "/etc/robots-txt/${name}";
-        };
-
-        rules = lib.mkOption {
-          description = "Rules to include in robots.txt";
-          default = [ ];
-          example = [
-            { User-agent = "Googlebot"; Disallow = "/no-googlebot"; }
-            { User-agent = "Bingbot"; Disallow = [ "/no-bingbot" "/no-bingbot2" ]; }
-          ];
-          type = robots-txt-format.type;
-        };
-
-        virtualHost = lib.mkOption {
-          description = "An nginx virtual host to add the robots.txt to";
-          type = lib.types.nullOr lib.types.str;
-          default = null;
-        };
-      };
-    }));
-  };
-
-  config = {
-    environment.etc = lib.mapAttrs' (name: value: {
-      name = "robots-txt/${name}/robots.txt";
-      value.source = robots-txt-format.generate name value.rules;
-    }) cfg;
-
-    services.nginx.virtualHosts = lib.pipe cfg [
-      (lib.filterAttrs (_: value: value.virtualHost != null))
-      (lib.mapAttrs' (name: value: {
-        name = value.virtualHost;
-        value = {
-          locations = {
-            "= /robots.txt" = {
-              extraConfig = ''
-                add_header Content-Type text/plain;
-              '';
-              root = cfg.${name}.path;
-            };
-          };
-        };
-      }))
-    ];
-  };
-}
--- a/packages/mediawiki-extensions/default.nix
+++ b/packages/mediawiki-extensions/default.nix
@@ -12,7 +12,7 @@ let
    name
  , commit
  , hash
-  , tracking-branch ? "REL1_42"
+  , tracking-branch ? "REL1_41"
  , kebab-name ? kebab-case-name name
  , fetchgit ? pkgs.fetchgit
  }:
@@ -33,63 +33,63 @@ in
 lib.mergeAttrsList [
  (mw-ext {
    name = "CodeEditor";
-    commit = "9f69f2cf7616342d236726608a702d651b611938";
-    hash = "sha256-sRaYj34+7aghJUw18RoowzEiMx0aOANU1a7YT8jivBw=";
+    commit = "7d8447035e381d76387e38b92e4d1e2b8d373a01";
+    hash = "sha256-v2AlbP0vZma3qZyEAWGjZ/rLcvOpIMroyc1EixKjlAU=";
  })
  (mw-ext {
    name = "CodeMirror";
-    commit = "1a1048c770795789676adcf8a33c1b69f6f5d3ae";
-    hash = "sha256-Y5ePrtLNiko2uU/sesm8jdYmxZkYzQDHfkIG1Q0v47I=";
+    commit = "a7b4541089f9b88a0b722d9d790e4cf0f13aa328";
+    hash = "sha256-clyzN3v3+J4GjdyhrCsytBrH7VR1tq5yd0rB+32eWCg=";
  })
  (mw-ext {
    name = "DeleteBatch";
-    commit = "b76bb482e026453079104d00f9675b4ab851947e";
-    hash = "sha256-GebF9B3RVwpPw8CYKDDT6zHv/MrrzV6h2TEIvNlRmcw=";
+    commit = "cad869fbd95637902673f744581b29e0f3e3f61a";
+    hash = "sha256-M1ek1WdO1/uTjeYlrk3Tz+nlb/fFZH+O0Ok7b10iKak=";
  })
  (mw-ext {
    name = "PluggableAuth";
-    commit = "1da98f447fd8321316d4286d8106953a6665f1cc";
-    hash = "sha256-DKDVcAfWL90FmZbSsdx1J5PkGu47EsDQmjlCpcgLCn4=";
+    commit = "4111a57c34e25bde579cce5d14ea094021e450c8";
+    hash = "sha256-aPtN8A9gDxLlq2+EloRZBO0DfHtE0E5kbV/adk82jvM=";
  })
  (mw-ext {
    name = "Popups";
-    commit = "9b9e986316b9662b1b45ce307a58dd0320dd33cf";
-    hash = "sha256-rSOZHT3yFIxA3tPhIvztwMSmSef/XHKmNfQl1JtGrUA=";
+    commit = "f1bcadbd8b868f32ed189feff232c47966c2c49e";
+    hash = "sha256-PQAjq/X4ZYwnnZ6ADCp3uGWMIucJy0ZXxsTTbAyxlSE=";
  })
  (mw-ext {
    name = "Scribunto";
-    commit = "eb6a987e90db47b09b0454fd06cddb69fdde9c40";
-    hash = "sha256-Nr0ZLIrS5jnpiBgGnd90lzi6KshcsxeC+xGmNsB/g88=";
+    commit = "7b99c95f588b06635ee3c487080d6cb04617d4b5";
+    hash = "sha256-pviueRHQAsSlv4AtnUpo2Cjci7CbJ5aM75taEXY+WrI=";
  })
  (mw-ext {
    name = "SimpleSAMLphp";
    kebab-name = "simple-saml-php";
-    commit = "fd4d49cf48d16efdb91ae8128cdd507efe84d311";
-    hash = "sha256-Qdtroew2j3AsZYlhAAUKQXXS2kUzUeQFnuR6ZHdFhAQ=";
+    commit = "ecb47191fecd1e0dc4c9d8b90a9118e393d82c23";
+    hash = "sha256-gKu+O49XrAVt6hXdt36Ru7snjsKX6g2CYJ0kk/d+CI8=";
  })
  (mw-ext {
    name = "TemplateData";
-    commit = "836e3ca277301addd2578b2e746498ff6eb8e574";
-    hash = "sha256-UMcRLYxYn+AormwTYjKjjZZjA806goMY2TRQ4KoS5fY=";
+    commit = "1ec66ce80f8a4322138efa56864502d0ee069bad";
+    hash = "sha256-Lv3Lq9dYAtdgWcwelveTuOhkP38MTu0m5kmW8+ltRis=";
  })
  (mw-ext {
    name = "TemplateStyles";
-    commit = "06a2587689eba0a17945fd9bd4bb61674d3a7853";
-    hash = "sha256-C7j0jCkMeVZiLKpk+55X+lLnbG4aeH+hWIm3P5fF4fw=";
+    commit = "581180e898d6a942e2a65c8f13435a5d50fffa67";
+    hash = "sha256-zW8O0mzG4jYfQoKi2KzsP+8iwRCLnWgH7qfmDE2R+HU=";
  })
  (mw-ext {
    name = "UserMerge";
-    commit = "41759d0c61377074d159f7d84130a095822bc7a3";
-    hash = "sha256-pGjA7r30StRw4ff0QzzZYUhgD3dC3ZuiidoSEz8kA8Q=";
+    commit = "c17c919bdb9b67bb69f80df43e9ee9d33b1ecf1b";
+    hash = "sha256-+mkzTCo8RVlGoFyfCrSb5YMh4J6Pbi1PZLFu5ps8bWY=";
  })
  (mw-ext {
    name = "VisualEditor";
-    commit = "a128b11fe109aa882de5a40d2be0cdd0947ab11b";
-    hash = "sha256-bv1TkomouOxe+DKzthyLyppdEUFSXJ9uE0zsteVU+D4=";
+    commit = "90bb3d455892e25317029ffd4bda93159e8faac8";
+    hash = "sha256-SZAVELQUKZtwSM6NVlxvIHdFPodko8fhZ/uwB0LCFDA=";
  })
  (mw-ext {
    name = "WikiEditor";
-    commit = "21383e39a4c9169000acd03edfbbeec4451d7974";
-    hash = "sha256-aPVpE6e4qLLliN9U5TA36e8tFrIt7Fl8RT1cGPUWoNI=";
+    commit = "8dba5b13246d7ae09193f87e6273432b3264de5f";
+    hash = "sha256-vF9PBuM+VfOIs/a2X1JcPn6WH4GqP/vUJDFkfXzWyFU=";
  })
 ]
--- a/secrets/bekkalokk/bekkalokk.yaml
+++ b/secrets/bekkalokk/bekkalokk.yaml
@@ -5,9 +5,12 @@ gitea:
    database: ENC[AES256_GCM,data:UlS33IdCEyeSvT6ngpmnkBWHuSEqsB//DT+3b7C+UwbD8UXWJlsLf1X8/w==,iv:mPRW5ldyZaHP+y/0vC2JGSLZmlkhgmkvXPk4LazkSDs=,tag:gGk6Z/nbPvzE1zG+tJC8Sw==,type:str]
    email-password: ENC[AES256_GCM,data:KRwC+aL1aPvJuXt91Oq1ttATMnFTnuUy,iv:ats8TygB/2pORkaTZzPOLufZ9UmvVAKoRcWNvYF1z6w=,tag:Do0fA+4cZ3+l7JJyu8hjBg==,type:str]
    passwd-ssh-key: ENC[AES256_GCM,data:L0lF0wvpayss1NU9m3A45cH0bCMQzODTFVrq6EPd1JHx54wIcoaRBYLmxXKXASzBlCg9zlwXMUIk3OQcS3kdzMKL0iqcSL2iicAcKjFIHyrWLqXgwV5pRSP/tRPcVw8KW8gz0bh33EgESs5ReddZ3VZ0Cy1s2YupMRQvBXr89k1+Hv70OWB6P06hvxhv/zKcMGI1N/dWLroMgrQuT9imw4+/Q1RqwzTYeEU+eUn24AM9GjcBg4qf3OI+6g0nXUat/upIYE28iF5J3lbUSmDSmirBLc8xgHLdOyyJPTObWYWYxlSL78T7IqiMm9lI3rtBlpJDDcn/YxZpVqN5bg2154GISNK+uR0TVSLdJ+drdGHIfIX3G78XSxf2L9rbJyRn8MQlgStfdBIQicLavQKVMrmj+XQfvEMez23WbPLjH4oViBQFI+GrOHOGy/f16cz8Sn4n+69OcsOeTxs3tKYdfq6r1XLYSJ/fe/zvxBpaZiyGXljsuyEdIyBL2A8D6uSXe3Nd3/DAdBtceFfIdN1olCdutixzVWgxaJnrel161z5A/4w=,iv:Uy46yY3jFYSvpxrgCHxRMUksnWfhf5DViLMvCXVMMl4=,tag:wFEJ5+icFrOKkc56gY0A5g==,type:str]
-    gpg-signing-key: ENC[AES256_GCM,data:y/g1rpsEgiGEJ9BGii6te166ABpg1jgsyYMT1Ji5njLbT8/juBBMc7BFEM5BcIxKpQGijymsB+Htl8CZAN4Bl3FHSRyrnXGuMCnveJfw1qTVjMa6soriHv7EdTDFPCp3TYMbs1OgY/bhGJIvp8e4hCVd4F3x8eAlFmiwHhkxr62qQNHjH7SRNIyUNibf/TTttOeEcercxOy7FeUE99D+CWG4pnJNEYyRHDdddalgpSJyZIJvPpXoKmeCDk3futnxiZ15Vr7bDS5u4dqnE+no7DKoZ5fvk38f/77JH3w/Qom7NCYSG6L+unJ3r3RKuuGMRDjdz09TPZ4APpmrlyOElfGMmm134g6mdhgXmwNCo65Z7VOd1OKFA/uyZm2b7XsT3tCgRalE8gBa0R3MBMi3JK+5KUdS6ZUvYXDt8D8C68ldM3K9E7lyeeHn775rV6L4JIXcj/NL1O23sXtjeVuUPQmsUesgYlllRaiTSTfY7K+yOIG3wqqCuCDSAeILQICkvod4iw4xdVMQzd8eQtbD6bCjOzHwvBcu+rOSN6ti+xOQ7bJ9+6xhCgJJsiADkp2q09cUu8mDbUh+YJxfu+oZhPomOJVDMSqfS4qNXcVM9mbak/L9KPR4b83GqTpmXHnDMlGe4BHGXrkIUKPsBQ5TmdckXbpRDBQFrnjVvFT+Gfx3xwHxWc9fbxcFID2wp69EzQrGC77bDPCFxBT5vAVwffGYUezPQEo25bKRpCWxTFTpiIQfACrwzZc/O9cmwDgrYN7bTZyrrp8cbyBtllZGYmXxLDkDOzIqzpLG3b0yJC2jSnw0f1DkU6M2mD/j9FRTVW1MVymyLPiZQ7T9QyZ3MekHEEY1QqmyiJMIOekSzC5+3Us6Nl32MeBrIry6NuV8ewIQF5bcZEHtSmZ0k/wBtK0fpFHUuc/vETFuRUiQw/InhN5W8iH78vFvflxBfg61Qp7PzEx0k0axwEc6VAKbEg/uFNL+fhUKKt7sYiEBmwg2Vsj3pyZgdmjPZEsOQ86+psaxv+2feH94wog47jDHFRrc4iRC5w7kZ6UJXHfZt9lkBbwl4qNwiOLlPnUUcR+CpTBpPoKD9ulidQGfcYY49+iE+PM5dAI2CtisKpLQiwmrvjOzB1a/rC9QnH679frgH5Ebb57WRL4uSAVNRdIvIGzAF5MNwQOu+cxKoiW6ZmuNJSb547XUB1UO,iv:aKzrgAV30sLfPEpgdQ26ZzdM3+gYtoSpZ9mNyqCqf/M=,tag:vjywN4qxh2zsCE3RPG6Yrw==,type:str]
    ssh-known-hosts: ENC[AES256_GCM,data:zlRLoelQeumMxGqPmgMTB69X1RVWXIs2jWwc67lk0wrdNOHUs5UzV5TUA1JnQ43RslBU92+js7DkyvE5enGzw7zZE5F1ZYdGv/eCgvkTMC9BoLfzHzP6OzayPLYEt3xJ5PRocN8JUAD55cuu4LgsuebuydHPi2oWOfpbSUBKSeCh6dvk5Pp1XRDprPS5SzGLW8Xjq98QlzmfGv50meI9CDJZVF9Wq/72gkyfgtb3YVdr,iv:AF06TBitHegfWk6w07CdkHklh4ripQCmA45vswDQgss=,tag:zKh7WVXMJN2o9ZIwIkby3Q==,type:str]
    import-user-env: ENC[AES256_GCM,data:wArFwTd0ZoB4VXHPpichfnmykxGxN8y2EQsMgOPHv7zsm6A+m2rG9BWDGskQPr5Ns9o=,iv:gPUzYFSNoALJb1N0dsbNlgHIb7+xG7E9ANpmVNZURQ0=,tag:JghfRy2OcDFWKS9zX1XJ9A==,type:str]
+    runners:
+        alpha: ENC[AES256_GCM,data:gARxCufePz+EMVwEwRsL2iZUfh9HUowWqtb7Juz3fImeeAdbt+k3DvL/Nwgegg==,iv:3fEaWd7v7uLGTy2J7EFQGfN0ztI0uCOJRz5Mw8V5UOU=,tag:Aa6LwWeW2hfDz1SqEhUJpA==,type:str]
+        beta: ENC[AES256_GCM,data:DVjS78IKWiWgf+PuijCZKx4ZaEJGhQr7vl+lc7QOg1JlA4p9Kux/tOD8+f2+jA==,iv:tk3Xk7lKWNdZ035+QVIhxXy2iJbHwunI4jRFM4It46E=,tag:9Mr6o//svYEyYhSvzkOXMg==,type:str]
+        epsilon: ENC[AES256_GCM,data:JMnZVBdiy+5oPyXgDpfYvy7qLzIEfHy09fQSBDpNG4zDXTil2pSKBKxk09h5xg==,iv:/8oXKJW6+sMBjDt51MqVAWjQPM5nk02Lv5QqbZsZ5ms=,tag:+Rx7ursfVWc0EcExCLgLhQ==,type:str]
 mediawiki:
    password: ENC[AES256_GCM,data:HsBuA1E7187roGnKuFPfPDYxA16GFjAUucgUtrdUFmcOzmTNiFH+NWY2ZQ==,iv:vDYUmmZftcrkDtJxNYKAJSx9j+AQcmQarC62QRHR4IM=,tag:3TKjNrGRivFWoK3djC748g==,type:str]
    postgres_password: ENC[AES256_GCM,data:XIOmrOVXWvMMcPJtmovhdyZvLlhmrsrwjuMMkdEY1NIXWjevj5XEkp6Cpw==,iv:KMPTRzu3H/ewfEhc/O0q3o230QNkABfPYF/D1SYL2R8=,tag:sFZiFPHWxwzD9HndPmH3pQ==,type:str]
@@ -15,8 +18,6 @@ mediawiki:
        postgres_password: ENC[AES256_GCM,data:FzykBVtJbA+Bey1GE5VqnSuv2GeobH1j,iv:wayQH3+y0FYFkr3JjmulI53SADk0Ikur/2mUS5kFrTk=,tag:d+nQ/se2bDA5aaQfBicnPQ==,type:str]
        cookie_salt: ENC[AES256_GCM,data:BioRPAvL4F9ORBJDFdqHot81RhVpAOf32v1ah3pvOLq8E88bxGyKFQZxAwpIL3UkWQIsWMnEerm5MEMYL1C2OQ==,iv:yMVqiPTQ8hO1IVAax6PIkD0V9YTOEunwDTtnGcmy6Kc=,tag:Z4+bZF4olLlkx7YpXeQiUw==,type:str]
        admin_password: ENC[AES256_GCM,data:4eUXvcO7NLOWke9XShfKzj+x3FvqPONa,iv:3iZ+BTBTZ7yMJ0HT14cEMebKZattWUcYEevRsl/6WOk=,tag:CU0iDhPP2ndztdX5U5A4cw==,type:str]
-roundcube:
-    postgres_password: ENC[AES256_GCM,data:fGHmq6r/ZCeIseHL8/gmm5DfWQYorI3OJq1TW0EHvh7rHL62M4TE+Lrlrmq8AIlmGLSWtO8AQzOP3toxidL6xWX3pcwLxtTefa1gom2oQf6ZL4TbAZLidHksdiro6pWtpMOO66bb8O9eXvZmns4=,iv:Irnb2/bgx8WilDyRLleWfo6HHafZ+vlDEwxIcgm1f18=,tag:eTNBUELmLwO7DsQN9CLX7Q==,type:str]
 idp:
    cookie_salt: ENC[AES256_GCM,data:cyV6HDCPHKQIa8T1+rFBFh6EuHtG5B508lg6uFYENK7qVpYuiTUIokdVQhY8SRLs2mECx/ampgnUHxCRB/Cc/A==,iv:QRrRUhzRQrLkmg38rrYtCEfF8U4/7ZHZUDSEq++BlbI=,tag:fLqFSLd+CKqJvmCh1fx8vg==,type:str]
    admin_password: ENC[AES256_GCM,data:Vf33Oenk6x6BIij1uW8RQDjTPcKhUVYA,iv:RNeyCNpTAYdBPrZwE3Y6CCjoAML/3XUvjfJCrr06IEU=,tag:zVOrx1oXnEyr/VwFCFaCDQ==,type:str]
@@ -94,8 +95,8 @@ sops:
            UHpLRkdQTnhkeGlWVG9VS1hkWktyckEKAdwnA9URLYZ50lMtXrU9Q09d0L3Zfsyr
            4UsvjjdnFtsXwEZ9ZzOQrpiN0Oz24s3csw5KckDni6kslaloJZsLGg==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-12-09T21:18:23Z"
-    mac: ENC[AES256_GCM,data:scdduZPcJZgeT9LarRgxVr/obYsGrJAbMoLGJPPPp19qxOJMTdvYfMz8bxPjCikB4MacEgVZmcnKIn5aCzHJAnCI/7F2wm1DDtW9ZI5qbhDJKSSld+m2leOSPfR8VY/0qj6UNgGnwkwx7dfcAlv8cP2Sp3o1M2oyQxeXPr5FWEg=,iv:JEAwkCewMp0ERmYU62kZkbl7+FET1ZeRr6xeEwt6ioM=,tag:jxvli935X3JyZYe7fFbnLg==,type:str]
+    lastmodified: "2024-09-01T01:33:50Z"
+    mac: ENC[AES256_GCM,data:PkcOD9hJWD5tILO9PuZkOgIoujt4q2qtHBB9KF8ikrNKo0yw24Jf1ceI5/+BHCxhdi8sF4qQM/zty61zqwNaBsvrsLUkdWDwUDsuJQa1KKZiCEZPqYBc+qGIQ5wNPsU2zJ0c8+wU8H0LtGqKOH9GmaQtTdm0Rt2IcexV823uTjQ=,iv:GYTI85OgqnN8iUc6OOXO7Sz2XIthWJtz8zwMuWutEYs=,tag:2rhfhjXXzZLzoVlkINo0ZQ==,type:str]
    pgp:
        - created_at: "2024-08-04T00:03:28Z"
          enc: |-
@@ -118,4 +119,4 @@ sops:
            -----END PGP MESSAGE-----
          fp: F7D37890228A907440E1FD4846B9228E814A2AAC
    unencrypted_suffix: _unencrypted
-    version: 3.9.1
+    version: 3.9.0
--- a/secrets/bicep/matrix.yaml
+++ b/secrets/bicep/matrix.yaml
@@ -2,16 +2,14 @@ synapse:
    turnconfig: ENC[AES256_GCM,data:mASRjYa4C9WRow4x0XYRrlCE5LMJUYaId+o62r1qhsyJPa2LzrI=,iv:5vYdubvMDjLS6soiWx2DzkEAATb9NFbSS/Jhuuz1yI8=,tag:wOW07CQMDbOiZNervee/pg==,type:str]
    user_registration: ENC[AES256_GCM,data:ZDZfEEvyw8pg0WzhrdC8747ed+ZR2ZA8/WypJd/iDkmIy2RmxOeI0sE=,iv:l61mOlvzpCql4fC/eubBSU6px21et2WcpxQ6rFl14iw=,tag:sVDEAa3xipKIi/6isCjWew==,type:str]
    signing_key: ENC[AES256_GCM,data:6UpfiRlX9pRM7zhdm7Mc8y8EItLzugWkHSgE0tGpEmudCTa1wc60oNbYfhKDWU81DT/U148pZOoX1A==,iv:UlqCPicPm5eNBz1xBMI3A3Rn4t/GtldNIDdMH5MMnLw=,tag:HHaw6iMjEAv5b9mjHSVpwA==,type:str]
+sliding-sync:
+    env: ENC[AES256_GCM,data:DsU1qKTy5sn06Y0S5kFUqZHML20n6HdHUdXsQRUw,iv:/TNTc+StAZbf6pBY9CeXdxkx8E+3bak/wOqHyBNMprU=,tag:er5u4FRlSmUZrOT/sj+RhQ==,type:str]
 coturn:
    static-auth-secret: ENC[AES256_GCM,data:y5cG/LyrorkDH+8YrgcV7DY=,iv:ca90q2J3+NOy51mUBy4TMKfYMgWL4hxWDdsKIuxRBgU=,tag:hpFCns1lpi07paHyGB7tGQ==,type:str]
 mjolnir:
    access_token: ENC[AES256_GCM,data:ERFqZjK7MRD0xWt91FNCIxP1YC6Qj54QgnckHlCTtcQVLWaM1h2h9lHS+K8=,iv:1d7vmFkXAPcsmumzlmOT31amdrKLWtL5sJiS8G9g+LE=,tag:2l0vWzJ6P12ofuBdf5CCWw==,type:str]
-discord:
-    as_token: ENC[AES256_GCM,data:cnPZjBbODZUA1p0kLNeWpKh1oGkDPxDw/g7163XnoRCIgpqk,iv:Uu4L36uDPMBgzdXE2Lt9U0qrBSl3Xuufh1313BD8B/U=,tag:nTm6s7IGd4vNzZ95mfxDpA==,type:str]
-    hs_token: ENC[AES256_GCM,data:UzcaNsJtJPKvFT4gQDNfat0nmyJzmQ6OcSI73pANibzOVrWl,iv:ujgRM2jb1rbeloPB4UPLBEvQ7uue4a+bHiqsZAHIqtk=,tag:uIfuaTWSTeVvpQx5o28HPA==,type:str]
-hookshot:
-    as_token: ENC[AES256_GCM,data:L4vEw5r4RhcgritOeDTLHN5E/dM=,iv:pC8BLzxf6NaVAGsotoq6chOceBVdMLvrsQn1LGw9H9w=,tag:SI3CDFHAvgQZEvf/oms3EA==,type:str]
-    hs_token: ENC[AES256_GCM,data:2ufSJfYzzAB5IO+edwKSra5d/+M=,iv:cmTycGzNL+IeRRKZGbkhTtiksYTtbxED0k0B5haFw7k=,tag:FmWe5sGi9rlapUeAE6lKvg==,type:str]
+registrations:
+    mx-puppet-discord: ENC[AES256_GCM,data:FleyXxgOmc05nTP6M2DBJlacufN3p/05eZm4kB8+K4ci0k24o3zli988wlM/kyeZmxu4pgQlJ3lNLte4uip2hBXHWG5t5Ldzmr7bNCUD+r7nM+I1lfNkrDROPZ54bHysmn9O5CHpEa16rSo6RJgncIPqsLJxTwjC7qZlkOpzqvMhkq/MHCVOpvg0M/6AUR+AlSZoggujBMoXLznQNQapN13foEsbuo/QxjszM/ObGmhYMVyaS+TDBXzQLA8Yuj50Q/gZCIINWZ4G2qmgsGxxNR4I+usUQml/jxCtIXS4zn/ettXfL9G4Fdm2F9u1v11DehtTGa5xoxDq94M9rIxOqeJpvgEQEyyKAyFUIrlINfGl7tAj4Zu7+9Z8JTRAnppjM1q8iInwn/Z2L9KgB0YFi/Go1whgXly+TH6hpreo7m5klXV/ff/aV3ghOgFCGA8nBrZFqE8Uw268q9tV1s1dxCb6TbpGf19V5c9MD6BsCIVeoq+j9I/I8iZpzg2Reb4IlHhMDwbwsL2w2ks30wiZ9XO/CFrXDY4uBlI=,iv:3vvkGvldS8Raibg6tzlV8VY1O9NCLxSuNX/lwi1QgiA=,tag:D/noIsE3xlOiYM6Pk+cc8Q==,type:str]
 sops:
    kms: []
    gcp_kms: []
@@ -72,8 +70,8 @@ sops:
            WEh5NFN6SFF1TlltdWFWTGw4MHRHUkUKrKIvC87xjEmwxPQhH8dN+ZuaJTCgPY28
            pR62KxmoKFICLTHPpYP3euiAx5M9BWvgvCnA/US/5klpk8MtlreNFA==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-10-13T23:30:01Z"
-    mac: ENC[AES256_GCM,data:vdsAZmg7gPqzeucBhLhPemtRVkcxRecIdB6PXZ4paU+Uv5UorBKcTZ3jseN2cLi6ot3ycTIm+UI6uhlCy87vAJVynVJhuJS+ICFRS2+DfoVyuttLjZQGC2sr3+dEBHxIH7sZJSo9PIzbIWw3qHrpOPAZj0//1pFyp/k15k3vidM=,iv:jWtV+WAPt08lgdrVvtXOl35rDB4QflkZWuGBW1+ESyw=,tag:YxSHncZZOAW5uDxXtb/krw==,type:str]
+    lastmodified: "2023-10-22T00:31:46Z"
+    mac: ENC[AES256_GCM,data:UpnaUfRxvdyzBy5x4EC3w5LQ1qWxILTQhpyVPd9whTzQMAivAHT0pVmP9aE4T9w3NcWTaghp+f70GmQXx/OCC6DsRCWtU9pFHRj12YUowM3yB5lVTOomOLZQ9m4gUXw5I2GZHWBJn8CyosDcBMlXz2tiR91v/8Ulh6sDSAO86U0=,iv:5GcgRvbpqDEslZruKHM/TcMaF52A5X7AK41DEbrsRIQ=,tag:ndDgCRyX1aDRnzEUNmpoMw==,type:str]
    pgp:
        - created_at: "2024-08-04T00:03:46Z"
          enc: |-
@@ -96,4 +94,4 @@ sops:
            -----END PGP MESSAGE-----
          fp: F7D37890228A907440E1FD4846B9228E814A2AAC
    unencrypted_suffix: _unencrypted
-    version: 3.8.1
+    version: 3.7.3
--- a/secrets/ustetind/ustetind.yaml
+++ b/secrets/ustetind/ustetind.yaml
@@ -1,90 +0,0 @@
-gitea:
-    runners:
-        alpha: ENC[AES256_GCM,data:Hnq2guka4oERPIFCv1/ggrLjaePA7907VHXMStDQ7ll3hntTioT76qGOUJgfIw==,iv:wDPYuuL6VAWJakrz6asVRrzwRxqw0JDRes13MgJIT6E=,tag:ogFUeUirHVkCLN63nctxOw==,type:str]
-        beta: ENC[AES256_GCM,data:HmdjBvW8eO5MkzXf7KEzSNQAptF/RKN8Bh03Ru7Ru/Ky+eJJtk91aqSSIjFa+Q==,iv:Hz9HE3U6CFfZFcPmYMd6wSzZkSvszt92L2gV+pUlMis=,tag:LG3NfsS7B1EdRFvnP3XESQ==,type:str]
-        epsilon: ENC[AES256_GCM,data:wfGxwWwDzb6AJaFnxe/93WNZGtuTpCkLci/Cc5MTCTKJz6XlNuy3m/1Xsnw0hA==,iv:I6Zl+4BBAUTXym2qUlFfdnoLTHShu+VyxPMjRlFzMis=,tag:jjTyZs1Nzqlhjd8rAldxDw==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age1hffjafs4slznksefmtqrlj7rdaqgzqncn4un938rhr053237ry8s3rs0v8
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIYVl6ZnI5TkhxK0JKNnlL
-            WE5YZUZ2T1JEbCtvSVUxemZ1QUs4R2pjMWc0ClJ0cnU0c0d5bU5jWU1aVGd6WE45
-            Wm9OT0xPaTJ3Y2kxMU5RTHdRKy81b2sKLS0tIEx4SkFoV240VUJieWFlc3hRWU1Y
-            SWlwZnNOT3paRHRsTC9CQUp5SlBvTncKdcMI8pWtsfBpgeUagOmZUXIC6svkfmwE
-            QF3GpWZgeVvo8e2oT2kBjerCDlUlzd0jJ8aK+B56xifTm7ii3oCAIA==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age17tagmpwqjk3mdy45rfesrfey6h863x8wfq38wh33tkrlrywxducs0k6tpq
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3QVBaQWlSZk43dEtHVWF1
-            WmFBcmx3eFUvU2lrd0RCUGx3a2hDWHEzTUR3Cm9BclM3OU9SUnpySDZJZHRudmtO
-            Ulp5OEZvZmMyRGJvQXJnUDVLdVRJUVkKLS0tIHE3M3MycE9pU1huYUREN3luWEZV
-            WlNuN3BWeHhqL1dEOUJBSVNTaVJ3eTgKb5MRfeaay22PI9V5hni5mhnb0QF8PG8H
-            bKWbc2SwdMNolrxhUiiIhdppEtXGHqLyBel786tuOdtEwVcy+m/rtA==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1mrnldl334l2nszuta6ywvewng0fswv2dz9l5g4qcwe3nj4yxf92qjskdx6
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQaDB6enozMFpqcWxFdU93
-            MEg5RTRzZExzWGppenlBTlZZRlpqWDBPT0UwCnhOaXI5R3Jrd0hWY0xqc1VXaDJZ
-            TUxwSTZDcHd0bnZPR2N2d0JVTUJONnMKLS0tIENzOW9PM0tQSndVNmF1bTZ4anpw
-            b1RzL0NEOWg0dGZUa0Jpd3hiTlRGSm8KleRV5c/Xoe0B1VtnR3y0sgXpmhMS8pKl
-            TWaAQTRlM9X2Pk5M/J/bu369ncmw/kycJKjK6W1yluaGwBNuEP+K4Q==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1hmpdk4h69wxpwqk9tkud39f66hprhehxtzhgw97r6dvr7v0mx5jscsuhkn
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0N1JvRVE0Y0xOMERMVXdB
-            enZiNk1DZTJTUnluRVBIWm9WNmFPc21rU0FZCjBIeHErSHgveFFFdk9ybWwrRXZG
-            WGpVcHliUW9Qb3dLb2Q0aWlrZmpiVm8KLS0tIG0wcXJVK2dMeG9NUTFQSzVtY2RG
-            UE1FS3MvSXlxdEtJVWxJVDRFSkRmQkkK/2z7Lu6LVd6RLZAXKs+JsPc+1kcqFAET
-            0zlTTTU0goTBLuXZ7uxFVZtqc1Nmoarf5Ksm/zcZ2B80P5ox9CzcWQ==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1wrssr4z4g6vl3fd3qme5cewchmmhm0j2xe6wf2meu4r6ycn37anse98mfs
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4SFpKcVBTTlp3SXhVaGQy
-            QVVEV3h6dTZVcmx6aFc1eHF4UzJPbXQ2RnhvCkZiOEYydWhCYUtwcUdieGpBeTZh
-            Z3dYVno5bFNkOUszNHBJNTdQWS9jUTQKLS0tIEhPVEdLK0RaclVvdklFNUJCcHNi
-            OXVobVJCTjhQZ2RTQ21xK2dUY0h5RGcKcPBgD5FIWuyQBhmPt5aqrWgEG1tzhtr0
-            gVyLxgtMFGeeShjdpivgcWI/GZZlhWJilJOoZo7f6TknvCIIKsrUSA==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1zhxul786an743u0fascv4wtc5xduu7qfy803lfs539yzhgmlq5ds2lznt5
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYWlhiS1dxekZGZkRCQU9O
-            SktHRHRXL2VhNUJSRVhBeEM5UEZ1R0pFdXdrCnZQOUZaYitpSlJ0aXFpZXFrRFJj
-            MmZiLytvekZtVXYzamJDakc1RjdIREEKLS0tICtiOTZMRGZuWEdHTmZwRjZ2dUNT
-            aU4xWjVYYlNvSmYxajVGdzk5dTQ4WG8Klq12bSegsW29xp4qteuCB5Tzis6EhVCk
-            53jqtYe5UG9MjFVQYiSi2jJz5/dxfqSINMZ/Y/EB5LxbwgbFws8Yuw==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-12-12T12:20:19Z"
-    mac: ENC[AES256_GCM,data:D9/NAd/zrF6pHFdZjTUqI+u4WiwJqt0w5Y+SYCS1o/dAXJE/ajHzse/vCSGXZIjP0yqe+S/NyTvhf+stw2B4dk6Njtabjd+PhG0hR4L0X07FtFqzB3u5pLHCb0bH9QLG5zWcyMkwNiNTCvhRUZzbcqLEGqqJ7ZjZAEUfYSR+Jls=,iv:5xPfODPxtQjgbl8delUHsmhD0TI2gHjrxpHV+qiFE00=,tag:HHLo5G8jhy/sKB3R+sKmwQ==,type:str]
-    pgp:
-        - created_at: "2024-12-09T21:17:27Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA0av/duuklWYARAAv2XS2jzoymOzpRHquUbYpUtbIeKXhPS8i9uk2zBvSKnr
-            b/jZCpvtkCcSz1UFm+HzSn/i1eNkj9ghObisifvqY6JbO0DIa1jFlx1TfE9pj8dE
-            rrNTsYfxNwdGOvklPBHm3vKY5qPiGlE71TaKkJcO79vE5jxwhUqzWI9SWAZY3cFw
-            IVJN44DT0I4ctTlwPM9eAYYodL8QP8OMXHJ/mjI4SPODRsvrOyy6rpip40Q+dU/N
-            DwRupzrRlxJ8BDSh/x6J/AryZSwkmChX9cYyGaDknJ3ONQ0XLhVUtLkAvPWtWeow
-            6NVHmUOJ39ockT1clhYy2P5rQTraZESuI7vaSS9zVIuScBnJwbSRZ5xgxSD6Fj+C
-            Y/JyogXa8FtyG6xeMgIwW7t/m/rbXL5OkP4w8D+CJs+4I55WXz054XOZ937EisVH
-            XAlNBIHixjQVckbb+sS7rEmegfoC+rvOXA0irpwXFiapAbMGUePCwQHdSBMP8orC
-            Tb3E8kqHATN40b8CpUBcPw6HCQKmbhe8o+R8NG6TZh6JH7kSztl2+SIIuMzhDflr
-            1AphY047Ku2RANaWfo+xyVZMWgAQcnoaUOeYaHJ9nZ7f2klJ3fnRtdXJn1gcO3i3
-            NZVRjjYHJgzCVCIZJa1b1TMGep84naF7NmRkNlS4wyv6MXGqSpHHZUGUBAQOCMPS
-            XAEqjZt8va0LKtsPsBOTGQDuzTar+2069fu6TjS07mJM2sTp/G8bGBnvjc0TIplZ
-            M5FOiCilI9yX7vQ0O3LUKJW5zELWnW2d+3okpGjgkr0BFERtM7BMCp6nxR6+
-            =rEY5
-            -----END PGP MESSAGE-----
-          fp: F7D37890228A907440E1FD4846B9228E814A2AAC
-    unencrypted_suffix: _unencrypted
-    version: 3.9.2
--- a/shell.nix
+++ b/shell.nix
@@ -11,14 +11,14 @@ pkgs.mkShellNoCC {
    editorconfig-checker
  ];

-  env = {
-    OS_AUTH_URL = "https://api.stack.it.ntnu.no:5000";
-    OS_PROJECT_ID = "b78432a088954cdc850976db13cfd61c";
-    OS_PROJECT_NAME = "STUDORG_Programvareverkstedet";
-    OS_USER_DOMAIN_NAME = "NTNU";
-    OS_PROJECT_DOMAIN_ID = "d3f99bcdaf974685ad0c74c2e5d259db";
-    OS_REGION_NAME = "NTNU-IT";
-    OS_INTERFACE = "public";
-    OS_IDENTITY_API_VERSION = "3";
-  };
+  shellHook = ''
+    export OS_AUTH_URL=https://api.stack.it.ntnu.no:5000
+    export OS_PROJECT_ID=b78432a088954cdc850976db13cfd61c
+    export OS_PROJECT_NAME="STUDORG_Programvareverkstedet"
+    export OS_USER_DOMAIN_NAME="NTNU"
+    export OS_PROJECT_DOMAIN_ID="d3f99bcdaf974685ad0c74c2e5d259db"
+    export OS_REGION_NAME="NTNU-IT"
+    export OS_INTERFACE=public
+    export OS_IDENTITY_API_VERSION=3
+  '';
 }
--- a/users/alfhj.nix
+++ b/users/alfhj.nix
@@ -1,13 +0,0 @@
-{pkgs, ...}:
-
-{
-  users.users.alfhj = {
-    isNormalUser = true;
-    extraGroups = [ "wheel" ];
-    shell = pkgs.zsh;
-    openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMCAYE0U3sFizm/NSbKCs0jEhZ1mpAWPcijFevejiFL1 alfhj"
-    ];
-  };
-}
-
--- a/users/danio.nix
+++ b/users/danio.nix
@@ -3,7 +3,7 @@
 {
  users.users.danio = {
    isNormalUser = true;
-    extraGroups = [ "drift" "nix-builder-users" "wheel" ];
+    extraGroups = [ "drift" "nix-builder-users" ];
    shell = pkgs.zsh;

    openssh.authorizedKeys.keys = [
--- a/users/frero.nix
+++ b/users/frero.nix
@@ -1,11 +0,0 @@
-{ pkgs, ... }:
-{
-  users.users.frero = {
-    isNormalUser = true;
-    extraGroups = [ "wheel" "drift" "nix-builder-users" ];
-    shell = pkgs.zsh;
-    openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII09JbtSUMurvmHpJ7TmUQctXpNVhjFYhoJ3+1ZITmMx"
-    ];
-  };
-}
--- a/values.nix
+++ b/values.nix
@@ -25,8 +25,6 @@ in rec {

  hosts = {
    gateway = pvv-ipv4 129;
-    gateway6 = pvv-ipv6 1;
-
    bekkalokk = {
      ipv4 = pvv-ipv4 168;
      ipv6 = pvv-ipv6 168;
@@ -60,16 +58,12 @@ in rec {
      ipv4 = pvv-ipv4 204;
      ipv6 = pvv-ipv6 "1:4f"; # Wtf øystein og daniel why
    };
-    ustetind = {
-      ipv4 = pvv-ipv4 234;
-      ipv6 = pvv-ipv6 234;
-    };
  };

  defaultNetworkConfig = {
    dns = [ "129.241.0.200" "129.241.0.201" "2001:700:300:1900::200" "2001:700:300:1900::201" ];
    domains = [ "pvv.ntnu.no" "pvv.org" ];
-    gateway = [ hosts.gateway hosts.gateway6 ];
+    gateway = [ hosts.gateway ];

    networkConfig.IPv6AcceptRA = "no";
    DHCP = "no";
Author	SHA1	Message	Date
Felix Albrigtsen	3a6b6cfdb7	flake: Make openstack-image EFI	2024-09-15 02:47:49 +02:00
Felix Albrigtsen	871a24947c	flake: Add openstack image generator	2024-09-15 02:45:33 +02:00