nixosonsktrott WIP

.mailmap

@@ -1,25 +0,0 @@
-Daniel Løvbrøtte Olsen <danio@pvv.ntnu.no> <daniel.olsen99@gmail.com>
-Daniel Løvbrøtte Olsen <danio@pvv.ntnu.no> Daniel <danio@pvv.ntnu.no>
-Daniel Løvbrøtte Olsen <danio@pvv.ntnu.no> Daniel Lovbrotte Olsen <danio@pvv.ntnu.no>
-Daniel Løvbrøtte Olsen <danio@pvv.ntnu.no> Daniel Olsen <danio@pvv.ntnu.no>
-Daniel Løvbrøtte Olsen <danio@pvv.ntnu.no> danio <danio@pvv.ntnu.no>
-Daniel Løvbrøtte Olsen <danio@pvv.ntnu.no> Daniel Olsen <danio@bicep.pvv.ntnu.no>
-
-
-Øystein Kristoffer Tveit <oysteikt@pvv.ntnu.no> h7x4 <h7x4@nani.wtf>
-Øystein Kristoffer Tveit <oysteikt@pvv.ntnu.no> Øystein Tveit <oysteikt@pvv.ntnu.no>
-Øystein Kristoffer Tveit <oysteikt@pvv.ntnu.no> oysteikt <oysteikt@pvv.ntnu.no>
-Øystein Kristoffer Tveit <oysteikt@pvv.ntnu.no> Øystein <oysteikt@pvv.org>
-Øystein Kristoffer Tveit <oysteikt@pvv.ntnu.no> Oystein Kristoffer Tveit <oysteikt@pvv.ntnu.no>
-
-Felix Albrigtsen <felixalb@pvv.ntnu.no> <felix@albrigtsen.it>
-Felix Albrigtsen <felixalb@pvv.ntnu.no> <felixalbrigtsen@gmail.com>
-Felix Albrigtsen <felixalb@pvv.ntnu.no> felixalb <felixalb@pvv.ntnu.no>
-
-Peder Bergebakken Sundt <pederbs@pvv.ntnu.no> <pbsds@hotmail.com>
-
-Adrian Gunnar Lauterer <adriangl@pvv.ntnu.no> Adrian G L <adrian@lauterer.it>
-Adrian Gunnar Lauterer <adriangl@pvv.ntnu.no> Adrian Gunnar Lauterer <adrian@lauterer.it>
-
-Fredrik Robertsen <frero@pvv.ntnu.no> frero <frero@pvv.ntnu.no>
-Fredrik Robertsen <frero@pvv.ntnu.no> fredrikr79 <fredrikrobertsen7@gmail.com>

.sops.yaml

@@ -15,11 +15,6 @@ keys:
   - &host_bicep age1sl43gc9cw939z5tgha2lpwf0xxxgcnlw7w4xem4sqgmt2pt264vq0dmwx2
   - &host_ustetind age1hffjafs4slznksefmtqrlj7rdaqgzqncn4un938rhr053237ry8s3rs0v8
   - &host_kommode age1mt4d0hg5g76qp7j0884llemy0k2ymr5up8vfudz6vzvsflk5nptqqd32ly
-  - &host_lupine-1 age1fkrypl6fu4ldsa7te4g3v4qsegnk7sd6qhkquuwzh04vguy96qus08902e
-  - &host_lupine-2 age1mu0ej57n4s30ghealhyju3enls83qyjua69986la35t2yh0q2s0seruz5n
-  - &host_lupine-3 age1j2u876z8hu87q5npfxzzpfgllyw8ypj66d7cgelmzmnrf3xud34qzkntp9
-  - &host_lupine-4 age1t8zlawqkmhye737pn8yx0z3p9cl947d9ktv2cajdc6hnvn52d3fsc59s2k
-  - &host_lupine-5 age199zkqq4jp4yc3d0hx2q0ksxdtp42xhmjsqwyngh8tswuck34ke3smrfyqu
 
 creation_rules:
   # Global secrets
@@ -110,18 +105,8 @@ creation_rules:
       pgp:
       - *user_oysteikt
 
-  - path_regex: secrets/lupine/[^/]+\.yaml$
+  - path_regex: secrets/skrott/[^/]+\.yaml$
     key_groups:
     - age:
-      - *host_lupine-1
-      - *host_lupine-2
-      - *host_lupine-3
-      - *host_lupine-4
-      - *host_lupine-5
       - *user_danio
-      - *user_felixalb
+      - *user_eirikwit
-      - *user_pederbs_sopp
-      - *user_pederbs_nord
-      - *user_pederbs_bjarte
-      pgp:
-      - *user_oysteikt

base/default.nix

@@ -7,10 +7,8 @@
 
     ./networking.nix
     ./nix.nix
-    ./vm.nix
 
     ./services/acme.nix
-    ./services/uptimed.nix
     ./services/auto-upgrade.nix
     ./services/dbus.nix
     ./services/fwupd.nix
@@ -78,3 +76,4 @@
   # Trusted users on the nix builder machines
   users.groups."nix-builder-users".name = "nix-builder-users";
 }
+

base/nix.nix

@@ -1,4 +1,4 @@
-{ lib, config, inputs, ... }:
+{ inputs, ... }:
 {
   nix = {
     gc = {
@@ -21,16 +21,11 @@
     ** use the same channel the system
     ** was built with
     */
-    registry = lib.mkMerge [
+    registry = {
-      {
+      "nixpkgs".flake = inputs.nixpkgs;
-        "nixpkgs".flake = inputs.nixpkgs;
+      "nixpkgs-unstable".flake = inputs.nixpkgs-unstable;
-        "nixpkgs-unstable".flake = inputs.nixpkgs-unstable;
+      "pvv-nix".flake = inputs.self;
-      }
+    };
-      # We avoid the reference to self in vmVariant to get a stable system .outPath for equivalence testing
-      (lib.mkIf (!config.virtualisation.isVmVariant) {
-        "pvv-nix".flake = inputs.self;
-      })
-    ];
     nixPath = [
       "nixpkgs=${inputs.nixpkgs}"
       "unstable=${inputs.nixpkgs-unstable}"

base/services/auto-upgrade.nix

@@ -1,39 +1,26 @@
-{ config, inputs, pkgs, lib, ... }:
+{ inputs, pkgs, lib, ... }:
-
-let
-  inputUrls = lib.mapAttrs (input: value: value.url) (import "${inputs.self}/flake.nix").inputs;
-in
-
 {
   system.autoUpgrade = {
     enable = true;
     flake = "git+https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git";
     flags = [
-      "--refresh"
-      "--no-write-lock-file"
       # --update-input is deprecated since nix 2.22, and removed in lix 2.90
-      # as such we instead use --override-input combined with --refresh
       # https://git.lix.systems/lix-project/lix/issues/400
-    ] ++ (lib.pipe inputUrls [
+      "--refresh"
-      (lib.intersectAttrs {
+      "--override-input" "nixpkgs" "github:nixos/nixpkgs/nixos-24.11-small"
-        nixpkgs = { };
+      "--override-input" "nixpkgs-unstable" "github:nixos/nixpkgs/nixos-unstable-small"
-        nixpkgs-unstable = { };
+      "--no-write-lock-file"
-      })
+    ];
-      (lib.mapAttrsToList (input: url: ["--override-input" input url]))
-      lib.concatLists
-    ]);
   };
 
   # workaround for https://github.com/NixOS/nix/issues/6895
   # via https://git.lix.systems/lix-project/lix/issues/400
-  environment.etc = lib.mkIf (!config.virtualisation.isVmVariant) {
+  environment.etc."current-system-flake-inputs.json".source
-    "current-system-flake-inputs.json".source
+    = pkgs.writers.writeJSON "flake-inputs.json" (
-      = pkgs.writers.writeJSON "flake-inputs.json" (
+      lib.flip lib.mapAttrs inputs (name: input:
-        lib.flip lib.mapAttrs inputs (name: input:
+        # inputs.*.sourceInfo sans outPath, since writeJSON will otherwise serialize sourceInfo like a derivation
-          # inputs.*.sourceInfo sans outPath, since writeJSON will otherwise serialize sourceInfo like a derivation
+        lib.removeAttrs (input.sourceInfo or {}) [ "outPath" ]
-          lib.removeAttrs (input.sourceInfo or {}) [ "outPath" ]
+          // { store-path = input.outPath; } # comment this line if you don't want to retain a store reference to the flake inputs
-            // { store-path = input.outPath; } # comment this line if you don't want to retain a store reference to the flake inputs
+      )
-        )
+    );
-      );
-  };
 }

base/services/uptimed.nix

@@ -1,59 +0,0 @@
-{ config, pkgs, lib, ... }:
-let
-  cfg = config.services.uptimed;
-in
-{
-  options.services.uptimed.settings = lib.mkOption {
-    description = "";
-    default = { };
-    type = lib.types.submodule {
-      freeformType = with lib.types; attrsOf (either str (listOf str));
-    };
-  };
-
-  config = {
-    services.uptimed = {
-      enable = true;
-
-      settings = let
-        stateDir = "/var/lib/uptimed";
-      in {
-        PIDFILE = "${stateDir}/pid";
-        SENDMAIL = lib.mkDefault "${pkgs.system-sendmail}/bin/sendmail -t";
-      };
-    };
-
-    systemd.services.uptimed = lib.mkIf (cfg.enable) {
-      serviceConfig = let
-        uptimed = pkgs.uptimed.overrideAttrs (prev: {
-          postPatch = ''
-             substituteInPlace Makefile.am \
-               --replace-fail '$(sysconfdir)/uptimed.conf' '/var/lib/uptimed/uptimed.conf'
-             substituteInPlace src/Makefile.am \
-               --replace-fail '$(sysconfdir)/uptimed.conf' '/var/lib/uptimed/uptimed.conf'
-          '';
-        });
-
-      in {
-        Type = "notify";
-
-        ExecStart = lib.mkForce "${uptimed}/sbin/uptimed -f";
-
-        BindReadOnlyPaths = let
-          configFile = lib.pipe cfg.settings [
-            (lib.mapAttrsToList
-              (k: v:
-                if builtins.isList v
-                  then lib.mapConcatStringsSep "\n" (v': "${k}=${v'}") v
-                  else "${k}=${v}")
-            )
-            (lib.concatStringsSep "\n")
-            (pkgs.writeText "uptimed.conf")
-          ];
-        in [
-          "${configFile}:/var/lib/uptimed/uptimed.conf"
-        ];
-      };
-    };
-  };
-}

base/vm.nix

@@ -1,15 +0,0 @@
-{ lib, ... }:
-
-# This enables
-#     lib.mkIf (!config.virtualisation.isVmVariant) { ... }
-
-{
-  options.virtualisation.isVmVariant = lib.mkOption {
-    description = "`true` if system is build with 'nixos-rebuild build-vm'";
-    type = lib.types.bool;
-    default = false;
-  };
-  config.virtualisation.vmVariant = {
-    virtualisation.isVmVariant = true;
-  };
-}

flake.lock

@@ -1,5 +1,26 @@
 {
   "nodes": {
+    "dibbler": {
+      "inputs": {
+        "flake-utils": "flake-utils",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1747505135,
+        "narHash": "sha256-kfDCvIbNKePKpJCXST2V1bwWHtsgFOL/E7DvQbBygsQ=",
+        "ref": "refs/heads/main",
+        "rev": "0844843e595be617f683fbc245c944edd2bc6aa8",
+        "revCount": 209,
+        "type": "git",
+        "url": "https://git.pvv.ntnu.no/Projects/dibbler.git"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://git.pvv.ntnu.no/Projects/dibbler.git"
+      }
+    },
     "disko": {
       "inputs": {
         "nixpkgs": [
@@ -7,11 +28,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1752113600,
+        "lastModified": 1745502102,
-        "narHash": "sha256-7LYDxKxZgBQ8LZUuolAQ8UkIB+jb4A2UmiR+kzY9CLI=",
+        "narHash": "sha256-LqhRwzvIVPEjH0TaPgwzqpyhW6DtCrvz7FnUJDoUZh8=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "79264292b7e3482e5702932949de9cbb69fedf6d",
+        "rev": "ca27b88c88948d96feeee9ed814cbd34f53d0d70",
         "type": "github"
       },
       "original": {
@@ -20,6 +41,23 @@
         "type": "github"
       }
     },
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "id": "flake-utils",
+        "type": "indirect"
+      }
+    },
     "gergle": {
       "inputs": {
         "nixpkgs": [
@@ -48,11 +86,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1752258704,
+        "lastModified": 1746563623,
-        "narHash": "sha256-pRK99+MCgkeVptbJxXhVMXIXl8uwSdkZDpQzFi3OgkA=",
+        "narHash": "sha256-5DxgNFpSgxft/sWraZnHIUlb4S3Io73SVS7FZCbWSUY=",
         "ref": "refs/heads/main",
-        "rev": "9ff525339b62855d53a44b4dc0154a33ac19e44d",
+        "rev": "4e0408887f80e61a90286ff630a7855b828ae421",
-        "revCount": 48,
+        "revCount": 45,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Grzegorz/greg-ng.git"
       },
@@ -139,28 +177,34 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1752439653,
+        "lastModified": 1745526780,
-        "narHash": "sha256-mG27U2CFuggpAuozOu/4XAMKaOtJxzJVzdEemjQEBgg=",
+        "narHash": "sha256-LXXYBmFPMQU2lTb6alKWfjgQs08BKn+txMNcgbu00hI=",
-        "rev": "dfcd5b901dbab46c9c6e80b265648481aafb01f8",
+        "owner": "NixOS",
-        "type": "tarball",
+        "repo": "nixpkgs",
-        "url": "https://releases.nixos.org/nixos/25.05-small/nixos-25.05.806304.dfcd5b901dba/nixexprs.tar.xz"
+        "rev": "9204750b34cae1a8347ab4b5588115edfeebc6d7",
+        "type": "github"
       },
       "original": {
-        "type": "tarball",
+        "owner": "NixOS",
-        "url": "https://nixos.org/channels/nixos-25.05-small/nixexprs.tar.xz"
+        "ref": "nixos-24.11-small",
+        "repo": "nixpkgs",
+        "type": "github"
       }
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1752439402,
+        "lastModified": 1745688173,
-        "narHash": "sha256-xDfOnjnKStgsgcn9SFPgOV6qzwac4JvGKYyfR++49Pw=",
+        "narHash": "sha256-fgvG1O5JvSSjeQx+ea0DJ3GfMbLPVhAQta/DqQ2y6jc=",
-        "rev": "b47d4f01d4213715a1f09b999bab96bb6a5b675e",
+        "owner": "NixOS",
-        "type": "tarball",
+        "repo": "nixpkgs",
-        "url": "https://releases.nixos.org/nixos/unstable-small/nixos-25.11pre829909.b47d4f01d421/nixexprs.tar.xz"
+        "rev": "6a2957c7978b189202e03721aab901c0a9dc1e1a",
+        "type": "github"
       },
       "original": {
-        "type": "tarball",
+        "owner": "NixOS",
-        "url": "https://nixos.org/channels/nixos-unstable-small/nixexprs.tar.xz"
+        "ref": "nixos-unstable-small",
+        "repo": "nixpkgs",
+        "type": "github"
       }
     },
     "pvv-calendar-bot": {
@@ -170,11 +214,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1742225512,
+        "lastModified": 1723850344,
-        "narHash": "sha256-OB0ndlrGLE5wMUeYP4lmxly9JUEpPCeZRQyMzITKCB0=",
+        "narHash": "sha256-aT37O9l9eclWEnqxASVNBL1dKwDHZUOqdbA4VO9DJvw=",
         "ref": "refs/heads/main",
-        "rev": "c4a6a02c84d8227abf00305dc995d7242176e6f6",
+        "rev": "38b66677ab8c01aee10cd59e745af9ce3ea88092",
-        "revCount": 21,
+        "revCount": 19,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Projects/calendar-bot.git"
       },
@@ -190,11 +234,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1752865540,
+        "lastModified": 1741738148,
-        "narHash": "sha256-VYLXcV8FsaMTsmxISOejvBq76eA41yi7BCRNW1qGbV0=",
+        "narHash": "sha256-cJo6nbcJEOjkazkZ194NDnlsZe0W0wpxeUh2/886uC8=",
         "ref": "refs/heads/main",
-        "rev": "f732582d0d1389721ea2c91ab370ba2fb824d644",
+        "rev": "c1802e7cf27c7cf8b4890354c982a4eef5b11593",
-        "revCount": 496,
+        "revCount": 486,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Projects/nettsiden.git"
       },
@@ -205,6 +249,7 @@
     },
     "root": {
       "inputs": {
+        "dibbler": "dibbler",
         "disko": "disko",
         "gergle": "gergle",
         "greg-ng": "greg-ng",
@@ -227,11 +272,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1752201818,
+        "lastModified": 1746498961,
-        "narHash": "sha256-d8KczaVT8WFEZdWg//tMAbv8EDyn2YTWcJvSY8gqKBU=",
+        "narHash": "sha256-rp+oh/N88JKHu7ySPuGiA3lBUVIsrOtHbN2eWJdYCgk=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "bd8f8329780b348fedcd37b53dbbee48c08c496d",
+        "rev": "24b00064cdd1d7ba25200c4a8565dc455dc732ba",
         "type": "github"
       },
       "original": {
@@ -247,11 +292,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1751606940,
+        "lastModified": 1745310711,
-        "narHash": "sha256-KrDPXobG7DFKTOteqdSVeL1bMVitDcy7otpVZWDE6MA=",
+        "narHash": "sha256-ePyTpKEJTgX0gvgNQWd7tQYQ3glIkbqcW778RpHlqgA=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "3633fc4acf03f43b260244d94c71e9e14a2f6e0d",
+        "rev": "5e3e92b16d6fdf9923425a8d4df7496b2434f39c",
         "type": "github"
       },
       "original": {
@@ -259,6 +304,21 @@
         "repo": "sops-nix",
         "type": "github"
       }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
     }
   },
   "root": "root",

flake.nix

@@ -2,8 +2,8 @@
   description = "PVV System flake";
 
   inputs = {
-    nixpkgs.url = "https://nixos.org/channels/nixos-25.05-small/nixexprs.tar.xz";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.11-small"; # remember to also update the url in base/services/auto-upgrade.nix
-    nixpkgs-unstable.url = "https://nixos.org/channels/nixos-unstable-small/nixexprs.tar.xz";
+    nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixos-unstable-small";
 
     sops-nix.url = "github:Mic92/sops-nix";
     sops-nix.inputs.nixpkgs.follows = "nixpkgs";
@@ -31,6 +31,9 @@
     grzegorz-clients.inputs.nixpkgs.follows = "nixpkgs";
 
     minecraft-data.url = "git+https://git.pvv.ntnu.no/Projects/minecraft-kartverket.git";
+
+    dibbler.url = "git+https://git.pvv.ntnu.no/Projects/dibbler.git";
+    dibbler.inputs.nixpkgs.follows = "nixpkgs";
   };
 
   outputs = { self, nixpkgs, nixpkgs-unstable, sops-nix, disko, ... }@inputs:
@@ -55,63 +58,46 @@
 
     nixosConfigurations = let
       unstablePkgs = nixpkgs-unstable.legacyPackages.x86_64-linux;
-
+      nixosConfig = nixpkgs: name: config: lib.nixosSystem (lib.recursiveUpdate
-      nixosConfig =
+        rec {
-        nixpkgs:
-        name:
-        configurationPath:
-        extraArgs:
-        lib.nixosSystem (lib.recursiveUpdate
-        (let
           system = "x86_64-linux";
-        in {
-          inherit system;
-
           specialArgs = {
             inherit unstablePkgs inputs;
             values = import ./values.nix;
             fp = path: ./${path};
-          } // extraArgs.specialArgs or { };
+          };
 
           modules = [
-            configurationPath
+            ./hosts/${name}/configuration.nix
             sops-nix.nixosModules.sops
-          ] ++ extraArgs.modules or [];
+          ] ++ config.modules or [];
 
           pkgs = import nixpkgs {
             inherit system;
-            extraArgs.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg)
+            config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg)
               [
                 "nvidia-x11"
                 "nvidia-settings"
               ];
             overlays = [
               # Global overlays go here
-            ] ++ extraArgs.overlays or [ ];
+            ] ++ config.overlays or [ ];
           };
-        })
+        }
-        (builtins.removeAttrs extraArgs [
+        (removeAttrs config [ "modules" "overlays" ])
-          "modules"
-          "overlays"
-          "specialArgs"
-        ])
       );
 
-      stableNixosConfig = name: extraArgs:
+      stableNixosConfig = nixosConfig nixpkgs;
-          nixosConfig nixpkgs name ./hosts/${name}/configuration.nix extraArgs;
+      unstableNixosConfig = nixosConfig nixpkgs-unstable;
     in {
       bicep = stableNixosConfig "bicep" {
         modules = [
           inputs.matrix-next.nixosModules.default
           inputs.pvv-calendar-bot.nixosModules.default
           self.nixosModules.gickup
-          self.nixosModules.matrix-ooye
         ];
         overlays = [
           inputs.pvv-calendar-bot.overlays.x86_64-linux.default
-          (final: prev: {
-            inherit (self.packages.${prev.system}) out-of-your-element;
-          })
         ];
       };
       bekkalokk = stableNixosConfig "bekkalokk" {
@@ -128,6 +114,12 @@
           inputs.pvv-nettsiden.nixosModules.default
         ];
       };
+      bob = stableNixosConfig "bob" {
+        modules = [
+          disko.nixosModules.disko
+          { disko.devices.disk.disk1.device = "/dev/vda"; }
+        ];
+      };
       ildkule = stableNixosConfig "ildkule" { };
       #ildkule-unstable = unstableNixosConfig "ildkule" { };
       shark = stableNixosConfig "shark" { };
@@ -170,29 +162,26 @@
           inputs.gergle.overlays.default
         ];
       };
-    }
+      skrott = stableNixosConfig "skrott" {
-    //
+        modules = [
-    (let
+          ./hosts/skrott/configuration.nix
-      machineNames = map (i: "lupine-${toString i}") (lib.range 1 5);
+          inputs.dibbler.nixosModules.default
-      stableLupineNixosConfig = name: extraArgs:
+          sops-nix.nixosModules.sops
-          nixosConfig nixpkgs name ./hosts/lupine/configuration.nix extraArgs;
+        ];
-    in lib.genAttrs machineNames (name: stableLupineNixosConfig name {
+      };
-      modules = [{ networking.hostName = name; }];
+    };
-      specialArgs.lupineName = name;
-    }));
 
     nixosModules = {
       snakeoil-certs = ./modules/snakeoil-certs.nix;
       snappymail = ./modules/snappymail.nix;
       robots-txt = ./modules/robots-txt.nix;
       gickup = ./modules/gickup;
-      matrix-ooye = ./modules/matrix-ooye.nix;
     };
 
     devShells = forAllSystems (system: {
-      default = nixpkgs-unstable.legacyPackages.${system}.callPackage ./shell.nix { };
+      default = nixpkgs.legacyPackages.${system}.callPackage ./shell.nix { };
       cuda = let
-        cuda-pkgs = import nixpkgs-unstable {
+        cuda-pkgs = import nixpkgs {
           inherit system;
           config = {
             allowUnfree = true;
@@ -214,7 +203,6 @@
 
         simplesamlphp = pkgs.callPackage ./packages/simplesamlphp { };
 
-        out-of-your-element = pkgs.callPackage ./packages/out-of-your-element.nix { };
       } //
       (lib.pipe null [
         (_: pkgs.callPackage ./packages/mediawiki-extensions { })

hosts/bekkalokk/services/mediawiki/default.nix

@@ -214,11 +214,11 @@ in {
       "= /favicon.ico".alias = pkgs.runCommandLocal "mediawiki-favicon.ico" {
         buildInputs = with pkgs; [ imagemagick ];
       } ''
-        magick \
+        convert \
-          ${fp /assets/logo_blue_regular.png} \
           -resize x64 \
           -gravity center \
           -crop 64x64+0+0 \
+          ${fp /assets/logo_blue_regular.png} \
           -flatten \
           -colors 256 \
           -background transparent \

hosts/bekkalokk/services/website/fetch-gallery.nix

@@ -53,7 +53,7 @@ in {
 
         echo "Creating thumbnail for $fname"
         mkdir -p $(dirname ".thumbnails/$fname")
-        magick -define jpeg:size=200x200 "$fname" -thumbnail 300 -auto-orient ".thumbnails/$fname.png" ||:
+        convert -define jpeg:size=200x200 "$fname" -thumbnail 300 -auto-orient ".thumbnails/$fname.png" ||:
         touch -m -d "$(date -R -r "$fname")" ".thumbnails/$fname.png"
       done <<< "$images"
     '';

hosts/bicep/services/git-mirrors/default.nix

@@ -17,7 +17,7 @@ in
       zip = false;
       keep = 10;
       bare = true;
-      lfs = false;
+      lfs = true;
     };
 
     instances = let
@@ -59,7 +59,7 @@ in
   };
 
   services.cgit = let
-    domain = "mirrors.pvv.ntnu.no";
+    domain = "bicep.pvv.ntnu.no";
   in {
     ${domain} = {
       enable = true;
@@ -81,7 +81,7 @@ in
     };
   };
 
-  services.nginx.virtualHosts."mirrors.pvv.ntnu.no" = {
+  services.nginx.virtualHosts."bicep.pvv.ntnu.no" = {
     forceSSL = true;
     enableACME = true;
 
@@ -94,7 +94,7 @@ in
     in toString small-pvv-logo;
   };
 
-  systemd.services."fcgiwrap-cgit-mirrors.pvv.ntnu.no" = {
+  systemd.services."fcgiwrap-cgit-bicep.pvv.ntnu.no" = {
     serviceConfig.BindReadOnlyPaths = [ cfg.dataDir ];
   };
 }

hosts/bicep/services/matrix/default.nix

@@ -9,8 +9,7 @@
     ./coturn.nix
     ./mjolnir.nix
 
-    # ./discord.nix
+    ./discord.nix
-    ./out-of-your-element.nix
     ./hookshot
   ];
 

hosts/bicep/services/matrix/discord.nix

@@ -45,7 +45,7 @@ in
   };
 
 
-  services.mx-puppet-discord.enable = false;
+  services.mx-puppet-discord.enable = true;
   services.mx-puppet-discord.settings = {
     bridge = {
       bindAddress = "localhost";

hosts/bicep/services/matrix/out-of-your-element.nix

@@ -1,66 +0,0 @@
-{ config, pkgs, fp, ... }:
-let
-  cfg = config.services.matrix-ooye;
-in
-{
-  users.groups.keys-matrix-registrations = { };
-
-  sops.secrets = {
-    "matrix/ooye/as_token" = {
-      sopsFile = fp /secrets/bicep/matrix.yaml;
-      key = "ooye/as_token";
-    };
-    "matrix/ooye/hs_token" = {
-      sopsFile = fp /secrets/bicep/matrix.yaml;
-      key = "ooye/hs_token";
-    };
-    "matrix/ooye/discord_token" = {
-      sopsFile = fp /secrets/bicep/matrix.yaml;
-      key = "ooye/discord_token";
-    };
-    "matrix/ooye/discord_client_secret" = {
-      sopsFile = fp /secrets/bicep/matrix.yaml;
-      key = "ooye/discord_client_secret";
-    };
-  };
-
-  services.matrix-ooye = {
-    enable = true;
-    homeserver = "https://matrix.pvv.ntnu.no";
-    homeserverName = "pvv.ntnu.no";
-    discordTokenPath = config.sops.secrets."matrix/ooye/discord_token".path;
-    discordClientSecretPath = config.sops.secrets."matrix/ooye/discord_client_secret".path;
-    bridgeOrigin = "https://ooye.pvv.ntnu.no";
-
-    enableSynapseIntegration = false;
-  };
-
-  systemd.services."matrix-synapse" = {
-    after = [
-      "matrix-ooye-pre-start.service"
-      "network-online.target"
-    ];
-    requires = [ "matrix-ooye-pre-start.service" ];
-    serviceConfig = {
-      LoadCredential = [
-        "matrix-ooye-registration:/var/lib/matrix-ooye/registration.yaml"
-      ];
-      ExecStartPre = [
-        "+${pkgs.coreutils}/bin/cp /run/credentials/matrix-synapse.service/matrix-ooye-registration ${config.services.matrix-synapse-next.dataDir}/ooye-registration.yaml"
-        "+${pkgs.coreutils}/bin/chown matrix-synapse:keys-matrix-registrations ${config.services.matrix-synapse-next.dataDir}/ooye-registration.yaml"
-      ];
-    };
-  };
-
-  services.matrix-synapse-next.settings = {
-    app_service_config_files = [
-      "${config.services.matrix-synapse-next.dataDir}/ooye-registration.yaml"
-    ];
-  };
-
-  services.nginx.virtualHosts."ooye.pvv.ntnu.no" = {
-    forceSSL = true;
-    enableACME = true;
-    locations."/".proxyPass = "http://localhost:${cfg.socket}";
-  };
-}

hosts/bob/configuration.nix

@@ -0,0 +1,46 @@
+{ config, fp, pkgs, values, ... }:
+{
+  imports = [
+      # Include the results of the hardware scan.
+      ./hardware-configuration.nix
+      (fp /base)
+      (fp /misc/metrics-exporters.nix)
+      ./disks.nix
+
+      (fp /misc/builder.nix)
+    ];
+
+  sops.defaultSopsFile = fp /secrets/bob/bob.yaml;
+  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
+  sops.age.generateKey = true;
+
+  boot.loader.grub = {
+    enable = true;
+    efiSupport = true;
+    efiInstallAsRemovable = true;
+  };
+
+  networking.hostName = "bob"; # Define your hostname.
+
+  systemd.network.networks."30-all" = values.defaultNetworkConfig // {
+    matchConfig.Name = "en*";
+    DHCP = "yes";
+    gateway = [ ];
+  };
+
+  # List packages installed in system profile
+  environment.systemPackages = with pkgs; [
+  ];
+
+  # List services that you want to enable:
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "23.05"; # Did you read the comment?
+
+}

hosts/bob/disks.nix

@@ -0,0 +1,39 @@
+# Example to create a bios compatible gpt partition
+{ lib, ... }:
+{
+  disko.devices = {
+    disk.disk1 = {
+      device = lib.mkDefault "/dev/sda";
+      type = "disk";
+      content = {
+        type = "gpt";
+        partitions = {
+          boot = {
+            name = "boot";
+            size = "1M";
+            type = "EF02";
+          };
+          esp = {
+            name = "ESP";
+            size = "500M";
+            type = "EF00";
+            content = {
+              type = "filesystem";
+              format = "vfat";
+              mountpoint = "/boot";
+            };
+          };
+          root = {
+            name = "root";
+            size = "100%";
+            content = {
+              type = "filesystem";
+              format = "ext4";
+              mountpoint = "/";
+            };
+          };
+        };
+      };
+    };
+  };
+}

hosts/bob/hardware-configuration.nix

@@ -5,30 +5,20 @@
 
 {
   imports =
-    [ (modulesPath + "/installer/scan/not-detected.nix")
+    [ (modulesPath + "/profiles/qemu-guest.nix")
     ];
 
-  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usbhid" "sd_mod" ];
+  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_blk" ];
   boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ "kvm-intel" ];
+  boot.kernelModules = [ ];
   boot.extraModulePackages = [ ];
 
-  fileSystems."/" =
-    { device = "/dev/disk/by-uuid/c7bbb293-a0a3-4995-8892-0ec63e8c67dd";
-      fsType = "ext4";
-    };
-
-  swapDevices =
-    [ { device = "/dev/disk/by-uuid/a86ffda8-8ecb-42a1-bf9f-926072e90ca5"; }
-    ];
-
   # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
   # (the default) this is the recommended approach. When using systemd-networkd it's
   # still possible to use this option, but it's recommended to use it in conjunction
   # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
   networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.enp0s31f6.useDHCP = lib.mkDefault true;
+  # networking.interfaces.ens3.useDHCP = lib.mkDefault true;
 
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }

hosts/georg/configuration.nix

@@ -25,26 +25,6 @@
 
   # List services that you want to enable:
 
-
-
-  services.spotifyd = {
-    enable = true;
-    settings.global = {
-      device_name = "georg";
-      use_mpris = false;
-      #dbus_type = "system";
-      #zeroconf_port = 1234;
-    };
-  };
-
-  networking.firewall.allowedTCPPorts = [
-    # config.services.spotifyd.settings.zeroconf_port
-    5353 # spotifyd is its own mDNS service wtf
-  ];
-
-
-
-
   # This value determines the NixOS release from which the default
   # settings for stateful data, like file locations and database versions
   # on your system were taken. It‘s perfectly fine and recommended to leave

hosts/kommode/services/gitea/customization/default.nix

@@ -3,12 +3,7 @@ let
   cfg = config.services.gitea;
 in
 {
-  services.gitea-themes = {
+  services.gitea-themes.monokai = pkgs.gitea-theme-monokai;
-    monokai = pkgs.gitea-theme-monokai;
-    earl-grey = pkgs.gitea-theme-earl-grey;
-    pitch-black = pkgs.gitea-theme-pitch-black;
-    catppuccin = pkgs.gitea-theme-catppuccin;
-  };
 
   systemd.services.gitea-customization = lib.mkIf cfg.enable {
     description = "Install extra customization in gitea's CUSTOM_DIR";

hosts/lupine/configuration.nix

@@ -1,35 +0,0 @@
-{ fp, values, lupineName, ... }:
-{
-  imports = [
-    ./hardware-configuration/${lupineName}.nix
-
-    (fp /base)
-    (fp /misc/metrics-exporters.nix)
-
-    ./services/gitea-runner.nix
-  ];
-
-  sops.defaultSopsFile = fp /secrets/lupine/lupine.yaml;
-  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
-  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
-  sops.age.generateKey = true;
-
-  boot.loader.systemd-boot.enable = true;
-  boot.loader.efi.canTouchEfiVariables = true;
-
-  systemd.network.networks."30-enp0s31f6" = values.defaultNetworkConfig // {
-    matchConfig.Name = "enp0s31f6";
-    address = with values.hosts.${lupineName}; [ (ipv4 + "/25") (ipv6 + "/64") ];
-    networkConfig.LLDP = false;
-  };
-  systemd.network.wait-online = {
-    anyInterface = true;
-  };
-
-  # There are no smart devices
-  services.smartd.enable = false;
-
-  # Do not change, even during upgrades.
-  # See https://search.nixos.org/options?show=system.stateVersion
-  system.stateVersion = "25.05";
-}

hosts/lupine/hardware-configuration/lupine-2.nix

@@ -1,40 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
-
-{
-  imports =
-    [ (modulesPath + "/installer/scan/not-detected.nix")
-    ];
-
-  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usbhid" "sd_mod" ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ "kvm-intel" ];
-  boot.extraModulePackages = [ ];
-
-  fileSystems."/" =
-    { device = "/dev/disk/by-uuid/aa81d439-800b-403d-ac10-9d2aac3619d0";
-      fsType = "ext4";
-    };
-
-  fileSystems."/boot" =
-    { device = "/dev/disk/by-uuid/4A34-6AE5";
-      fsType = "vfat";
-      options = [ "fmask=0077" "dmask=0077" ];
-    };
-
-  swapDevices =
-    [ { device = "/dev/disk/by-uuid/efb7cd0c-c1ae-4a86-8bc2-8e7fd0066650"; }
-    ];
-
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.enp0s31f6.useDHCP = lib.mkDefault true;
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-}

hosts/lupine/hardware-configuration/lupine-3.nix

@@ -1,40 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
-
-{
-  imports =
-    [ (modulesPath + "/installer/scan/not-detected.nix")
-    ];
-
-  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usbhid" "sd_mod" ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ "kvm-intel" ];
-  boot.extraModulePackages = [ ];
-
-  fileSystems."/" =
-    { device = "/dev/disk/by-uuid/39ba059b-3205-4701-a832-e72c0122cb88";
-      fsType = "ext4";
-    };
-
-  fileSystems."/boot" =
-    { device = "/dev/disk/by-uuid/63FA-297B";
-      fsType = "vfat";
-      options = [ "fmask=0077" "dmask=0077" ];
-    };
-
-  swapDevices =
-    [ { device = "/dev/disk/by-uuid/9c72eb54-ea8c-4b09-808a-8be9b9a33869"; }
-    ];
-
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.enp0s31f6.useDHCP = lib.mkDefault true;
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-}

hosts/lupine/hardware-configuration/lupine-5.nix

@@ -1,40 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
-
-{
-  imports =
-    [ (modulesPath + "/installer/scan/not-detected.nix")
-    ];
-
-  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usbhid" "sd_mod" ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ "kvm-intel" ];
-  boot.extraModulePackages = [ ];
-
-  fileSystems."/" =
-    { device = "/dev/disk/by-uuid/5f8418ad-8ec1-4f9e-939e-f3a4c36ef343";
-      fsType = "ext4";
-    };
-
-  fileSystems."/boot" =
-    { device = "/dev/disk/by-uuid/F372-37DF";
-      fsType = "vfat";
-      options = [ "fmask=0077" "dmask=0077" ];
-    };
-
-  swapDevices =
-    [ { device = "/dev/disk/by-uuid/27bf292d-bbb3-48c4-a86e-456e0f1f648f"; }
-    ];
-
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.enp0s31f6.useDHCP = lib.mkDefault true;
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-}

hosts/lupine/services/gitea-runner.nix

@@ -1,45 +0,0 @@
-{ config, lupineName, ... }:
-{
-  # This is unfortunately state, and has to be generated one at a time :(
-  # To do that, comment out all except one of the runners, fill in its token
-  # inside the sops file, rebuild the system, and only after this runner has
-  # successfully registered will gitea give you the next token.
-  # - oysteikt Sep 2023
-  sops = {
-    secrets."gitea/runners/token" = {
-      key = "gitea/runners/${lupineName}";
-    };
-
-    templates."gitea-runner-envfile" = {
-      restartUnits = [
-        "gitea-runner-${lupineName}.service"
-      ];
-      content = ''
-        TOKEN="${config.sops.placeholder."gitea/runners/token"}"
-      '';
-    };
-  };
-
-  services.gitea-actions-runner.instances = {
-    ${lupineName} = {
-      enable = true;
-      name = "git-runner-${lupineName}";
-      url = "https://git.pvv.ntnu.no";
-      labels = [
-        "debian-latest:docker://node:current-bookworm"
-        "ubuntu-latest:docker://node:current-bookworm"
-      ];
-      tokenFile = config.sops.templates."gitea-runner-envfile".path;
-    };
-  };
-
-  virtualisation.podman = {
-    enable = true;
-    defaultNetwork.settings.dns_enabled = true;
-    autoPrune.enable = true;
-  };
-
-  networking.dhcpcd.IPv6rs = false;
-
-  networking.firewall.interfaces."podman+".allowedUDPPorts = [53 5353];
-}

hosts/skrott/configuration.nix

@@ -0,0 +1,27 @@
+{ fp, config, pkgs, values, ... }:
+{
+  imports = [
+    # Include the results of the hardware scan.
+    ./hardware-configuration.nix
+    (fp /base)
+    (fp /misc/metrics-exporters.nix)
+    # ./services/dibbler.nix
+  ];
+  
+  sops.defaultSopsFile = ../../secrets/skrott/skrott.yaml;
+  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
+  sops.age.generateKey = true;
+
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  networking.hostName = "skrott";
+
+  systemd.network.networks."30-yolo" = values.defaultNetworkConfig // {
+    matchConfig.Name = "*";
+    address = with values.hosts.skrott; [ (ipv4 + "/25") (ipv6 + "/64") ];
+  };
+
+  system.stateVersion = "24.11";
+}

hosts/skrott/hardware-configuration.nix

@@ -8,32 +8,32 @@
     [ (modulesPath + "/installer/scan/not-detected.nix")
     ];
 
-  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usbhid" "sd_mod" ];
+  boot.initrd.availableKernelModules = [ "uhci_hcd" "ehci_pci" "hpsa" "ohci_pci" "usbhid" "sd_mod" ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ "kvm-intel" ];
   boot.extraModulePackages = [ ];
 
   fileSystems."/" =
-    { device = "/dev/disk/by-uuid/a949e2e8-d973-4925-83e4-bcd815e65af7";
+    { device = "/dev/disk/by-uuid/31a67903-dc00-448a-a24a-36e820318fe5";
       fsType = "ext4";
     };
 
-  fileSystems."/boot" =
+  fileSystems."/data" =
-    { device = "/dev/disk/by-uuid/81D6-38D3";
+    { device = "/dev/disk/by-uuid/79e93eed-ad95-45c9-b115-4ef92afcc8c0";
-      fsType = "vfat";
+      fsType = "f2fs";
-      options = [ "fmask=0077" "dmask=0077" ];
     };
 
-  swapDevices =
+  swapDevices = [ ];
-    [ { device = "/dev/disk/by-uuid/82c2d7fa-7cd0-4398-8cf6-c892bc56264b"; }
-    ];
 
   # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
   # (the default) this is the recommended approach. When using systemd-networkd it's
   # still possible to use this option, but it's recommended to use it in conjunction
   # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
   networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.enp0s31f6.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp6s0f0.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp6s0f1.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp6s0f2.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp6s0f3.useDHCP = lib.mkDefault true;
 
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
   hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;

hosts/skrott/services/dibbler.nix

@@ -0,0 +1,28 @@
+{ config, inputs, ... }:
+{
+  sops.secrets = {
+    "dibbler/config" = {
+      owner = "dibbler";
+      group = "dibbler";
+    };
+  };
+
+  services.dibbler = {
+    enable = true;
+    package = inputs.dibbler.packages.dibbler;
+    settings = {
+      quit_allowed = false;
+      stop_allowed = false;
+      show_tracebacks = true;
+      input_encoding = "utf8";
+
+      low_credit_warning_limit = -100;
+      user_recent_transaction_limit = 20;
+
+      # See https://pypi.org/project/brother_ql/ for label types
+      # Set rotate to False for endless labels
+      label_type = "62";
+      label_rotate = false;
+    };
+  };
+}

justfile

@@ -1,56 +1,25 @@
-set positional-arguments # makes variables accesible as $1 $2 $@
 export GUM_FILTER_HEIGHT := "15"
-nom := `if [[ -t 1 ]] && command -v nom >/dev/null; then echo nom; else echo nix; fi`
+nom := `if command -v nom >/dev/null; then echo nom; else echo nix; fi`
-nix_eval_opts := "--log-format raw --option warn-dirty false"
 
 @_default:
   just "$(gum choose --ordered --header "Pick a recipie..." $(just --summary --unsorted))"
 
-check *_:
+check:
-  nix flake check --keep-going "$@"
+  nix flake check --keep-going
 
-build-machine machine=`just _a_machine` *_:
+build-machine machine=`just _a_machine`:
-  {{nom}} build .#nixosConfigurations.{{ machine }}.config.system.build.toplevel "${@:2}"
+  {{nom}} build .#nixosConfigurations.{{ machine }}.config.system.build.toplevel
 
-run-vm machine=`just _a_machine` *_:
+run-vm machine=`just _a_machine`:
-  nixos-rebuild build-vm --flake .#{{ machine }} "${@:2}"
+  nixos-rebuild build-vm --flake .#{{ machine }}
   QEMU_NET_OPTS="hostfwd=tcp::8080-:80,hostfwd=tcp::8081-:443,hostfwd=tcp::2222-:22" ./result/bin/run-*-vm
 
-@update-inputs *_:
+@update-inputs:
-  @git reset flake.lock
+  nix eval .#inputs --apply builtins.attrNames --json \
-  @git restore flake.lock
+    | jq '.[]' -r \
-  nix eval {{nix_eval_opts}} --file flake.nix --apply 'x: builtins.attrNames x.inputs' --json \
+    | gum choose --no-limit --height=15 \
-    | { printf "%s\n" --commit-lock-file; jq '.[]' -r | grep -vxF "self" ||:; } \
+    | xargs -L 1 nix flake lock --update-input
-    | gum choose --no-limit --header "Choose extra arguments:" \
-    | tee >(xargs -d'\n' echo + nix flake update "$@" >&2) \
-    | xargs -d'\n' nix flake update "$@"
-
-@repl $machine=`just _a_machine` *_:
-  set -v; nixos-rebuild --flake .#"$machine" repl "${@:2}"
-
-@eval $machine=`just _a_machine` $attrpath="system.build.toplevel.outPath" *_:
-  set -v; nix eval {{nix_eval_opts}} ".#nixosConfigurations.\"$machine\".config.$attrpath" --show-trace "${@:3}"
-
-@eval-vm $machine=`just _a_machine` $attrpath="system.build.toplevel.outPath" *_:
-  just eval "$machine" "virtualisation.vmVariant.$attrpath" "${@:3}"
 
 
-# helpers
-
-[no-exit-message]
 _a_machine:
-  #!/usr/bin/env -S sh -euo pipefail
+  nix eval .#nixosConfigurations --apply builtins.attrNames --json | jq .[] -r | gum filter
-  machines="$(
-    nix eval {{nix_eval_opts}} .#nixosConfigurations --apply builtins.attrNames --json | jq .[] -r
-  )"
-  [ -n "$machines" ] || { echo >&2 "ERROR: no machines found"; false; }
-  if [ -s .direnv/vars/last-machine.txt ]; then
-    machines="$(
-      grep <<<"$machines" -xF  "$(cat .direnv/vars/last-machine.txt)" ||:
-      grep <<<"$machines" -xFv "$(cat .direnv/vars/last-machine.txt)" ||:
-    )"
-  fi
-  choice="$(gum filter <<<"$machines")"
-  mkdir -p .direnv/vars
-  cat <<<"$choice" >.direnv/vars/last-machine.txt
-  cat <<<"$choice"

modules/grzegorz.nix

@@ -13,11 +13,6 @@ in {
     enablePipewire = true;
   };
 
-  systemd.user.services.restart-greg-ng = {
-    script = "systemctl --user restart greg-ng.service";
-    startAt = "*-*-* 06:30:00";
-  };
-
   services.grzegorz-webui = {
     enable = true;
     listenAddr = "localhost";
@@ -46,15 +41,6 @@ in {
         allow 2001:700:300:1900::/64;
         deny all;
       '';
-
-      locations."/docs" = {
-        proxyPass = "http://${grg.settings.host}:${toString grg.settings.port}";
-      };
-
-      locations."/api" = {
-        proxyPass = "http://${grg.settings.host}:${toString grg.settings.port}";
-        proxyWebsockets = true;
-      };
     };
 
     "${machine}-backend.pvv.ntnu.no" = {

modules/matrix-ooye.nix

@@ -1,211 +0,0 @@
-# Original from: https://cgit.rory.gay/nix/OOYE-module.git/
-
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-let
-  cfg = config.services.matrix-ooye;
-  mkStringOption =
-    name: default:
-    lib.mkOption {
-      type = lib.types.str;
-      default = default;
-    };
-in
-{
-  options = {
-    services.matrix-ooye = {
-      enable = lib.mkEnableOption "Enable OOYE service";
-      package = lib.mkOption {
-        type = lib.types.package;
-        default = pkgs.out-of-your-element;
-      };
-      appserviceId = mkStringOption "The ID of the appservice." "ooye";
-      homeserver = mkStringOption "The homeserver to connect to." "http://localhost:8006";
-      homeserverName = mkStringOption "The name of the homeserver to connect to." "localhost";
-      namespace = mkStringOption "The prefix to use for the MXIDs/aliases of bridged users/rooms. Should end with a _!" "_ooye_";
-      discordTokenPath = mkStringOption "The path to the discord token file." "/etc/ooye-discord-token";
-      discordClientSecretPath = mkStringOption "The path to the discord token file." "/etc/ooye-discord-client-secret";
-      socket = mkStringOption "The socket to listen on, can either be a port number or a unix socket path." "6693";
-      bridgeOrigin = mkStringOption "The web frontend URL for the bridge, defaults to http://localhost:{socket}" "";
-
-      enableSynapseIntegration = lib.mkEnableOption "Enable Synapse integration";
-    };
-  };
-  config = lib.mkIf cfg.enable (
-    let
-      baseConfig = pkgs.writeText "matrix-ooye-config.json" (
-        builtins.toJSON {
-          id = cfg.appserviceId;
-          namespaces = {
-            users = [
-              {
-                exclusive = true;
-                regex = "@${cfg.namespace}.*:${cfg.homeserverName}";
-              }
-            ];
-            aliases = [
-              {
-                exclusive = true;
-                regex = "#${cfg.namespace}.*:${cfg.homeserverName}";
-              }
-            ];
-          };
-          protocols = [ "discord" ];
-          sender_localpart = "${cfg.namespace}bot";
-          rate_limited = false;
-          socket = cfg.socket; # Can either be a TCP port or a unix socket path
-          url = if (lib.hasPrefix "/" cfg.socket) then "unix:${cfg.socket}" else "http://localhost:${cfg.socket}";
-          ooye = {
-            server_name = cfg.homeserverName;
-            namespace_prefix = cfg.namespace;
-            max_file_size = 5000000;
-            content_length_workaround = false;
-            include_user_id_in_mxid = true;
-            server_origin = cfg.homeserver;
-            bridge_origin = if (cfg.bridgeOrigin == "") then "http://localhost:${cfg.socket}" else cfg.bridgeOrigin;
-          };
-        }
-      );
-
-      script = pkgs.writeScript "matrix-ooye-pre-start.sh" ''
-        #!${lib.getExe pkgs.bash}
-        REGISTRATION_FILE=registration.yaml
-
-        id
-        echo "Before if statement"
-        stat ''${REGISTRATION_FILE}
-
-        if [[ ! -f ''${REGISTRATION_FILE} ]]; then
-          echo "No registration file found at '$REGISTRATION_FILE'"
-          cp --no-preserve=mode,ownership ${baseConfig} ''${REGISTRATION_FILE}
-        fi
-
-        echo "After if statement"
-        stat ''${REGISTRATION_FILE}
-
-        AS_TOKEN=$(${lib.getExe pkgs.jq} -r .as_token ''${REGISTRATION_FILE})
-        HS_TOKEN=$(${lib.getExe pkgs.jq} -r .hs_token ''${REGISTRATION_FILE})
-        DISCORD_TOKEN=$(cat /run/credentials/matrix-ooye-pre-start.service/discord_token)
-        DISCORD_CLIENT_SECRET=$(cat /run/credentials/matrix-ooye-pre-start.service/discord_client_secret)
-
-        # Check if we have all required tokens
-        if [[ -z "$AS_TOKEN" || "$AS_TOKEN" == "null" ]]; then
-          AS_TOKEN=$(${lib.getExe pkgs.openssl} rand -hex 64)
-          echo "Generated new AS token: ''${AS_TOKEN}"
-        fi
-
-        if [[ -z "$HS_TOKEN" || "$HS_TOKEN" == "null" ]]; then
-          HS_TOKEN=$(${lib.getExe pkgs.openssl} rand -hex 64)
-          echo "Generated new HS token: ''${HS_TOKEN}"
-        fi
-
-        if [[ -z "$DISCORD_TOKEN" ]]; then
-          echo "No Discord token found at '${cfg.discordTokenPath}'"
-          echo "You can find this on the 'Bot' tab of your Discord application."
-          exit 1
-        fi
-
-        if [[ -z "$DISCORD_CLIENT_SECRET" ]]; then
-          echo "No Discord client secret found at '${cfg.discordTokenPath}'"
-          echo "You can find this on the 'OAuth2' tab of your Discord application."
-          exit 1
-        fi
-
-        shred -u ''${REGISTRATION_FILE}
-        cp --no-preserve=mode,ownership ${baseConfig} ''${REGISTRATION_FILE}
-
-        ${lib.getExe pkgs.jq} '.as_token = "'$AS_TOKEN'" | .hs_token = "'$HS_TOKEN'" | .ooye.discord_token = "'$DISCORD_TOKEN'" | .ooye.discord_client_secret = "'$DISCORD_CLIENT_SECRET'"' ''${REGISTRATION_FILE} > ''${REGISTRATION_FILE}.tmp
-
-        shred -u ''${REGISTRATION_FILE}
-        mv ''${REGISTRATION_FILE}.tmp ''${REGISTRATION_FILE}
-      '';
-
-    in
-    {
-      warnings =
-        lib.optionals ((builtins.substring (lib.stringLength cfg.namespace - 1) 1 cfg.namespace) != "_") [
-          "OOYE namespace does not end with an underscore! This is recommended to have better ID formatting. Provided: '${cfg.namespace}'"
-        ]
-        ++ lib.optionals ((builtins.substring 0 1 cfg.namespace) != "_") [
-          "OOYE namespace does not start with an underscore! This is recommended to avoid conflicts with registered users. Provided: '${cfg.namespace}'"
-        ];
-
-      environment.systemPackages = [ cfg.package ];
-
-      systemd.services."matrix-ooye-pre-start" = {
-        enable = true;
-        wantedBy = [ "multi-user.target" ];
-        serviceConfig = {
-          ExecStart = script;
-          WorkingDirectory = "/var/lib/matrix-ooye";
-          StateDirectory = "matrix-ooye";
-          DynamicUser = true;
-          RemainAfterExit = true;
-          Type = "oneshot";
-
-          LoadCredential = [
-            "discord_token:${cfg.discordTokenPath}"
-            "discord_client_secret:${cfg.discordClientSecretPath}"
-          ];
-        };
-      };
-
-      systemd.services."matrix-ooye" = {
-        enable = true;
-        description = "Out of Your Element - a Discord bridge for Matrix.";
-
-        wants = [
-          "network-online.target"
-          "matrix-synapse.service"
-          "conduit.service"
-          "dendrite.service"
-        ];
-        after = [
-          "matrix-ooye-pre-start.service"
-          "network-online.target"
-        ];
-        requires = [ "matrix-ooye-pre-start.service" ];
-        wantedBy = [ "multi-user.target" ];
-
-        serviceConfig = {
-          ExecStart = lib.getExe config.services.matrix-ooye.package;
-          WorkingDirectory = "/var/lib/matrix-ooye";
-          StateDirectory = "matrix-ooye";
-          #ProtectSystem = "strict";
-          #ProtectHome = true;
-          #PrivateTmp = true;
-          #NoNewPrivileges = true;
-          #PrivateDevices = true;
-          Restart = "on-failure";
-          DynamicUser = true;
-        };
-      };
-
-      systemd.services."matrix-synapse" = lib.mkIf cfg.enableSynapseIntegration {
-
-        after = [
-          "matrix-ooye-pre-start.service"
-          "network-online.target"
-        ];
-        requires = [ "matrix-ooye-pre-start.service" ];
-        serviceConfig = {
-          LoadCredential = [
-            "matrix-ooye-registration:/var/lib/matrix-ooye/registration.yaml"
-          ];
-          ExecStartPre = [
-            "+${pkgs.coreutils}/bin/cp /run/credentials/matrix-synapse.service/matrix-ooye-registration ${config.services.matrix-synapse.dataDir}/ooye-registration.yaml"
-            "+${pkgs.coreutils}/bin/chown matrix-synapse:matrix-synapse ${config.services.matrix-synapse.dataDir}/ooye-registration.yaml"
-          ];
-        };
-      };
-
-      services.matrix-synapse.settings.app_service_config_files = lib.mkIf cfg.enableSynapseIntegration [
-        "${config.services.matrix-synapse.dataDir}/ooye-registration.yaml"
-      ];
-    }
-  );
-}

packages/out-of-your-element.nix

@@ -1,42 +0,0 @@
-{
-  lib,
-  fetchgit,
-  makeWrapper,
-  nodejs,
-  buildNpmPackage,
-}:
-buildNpmPackage {
-  pname = "delete-your-element";
-  version = "3.1-unstable-2025-06-23";
-  src = fetchgit {
-    url = "https://git.pvv.ntnu.no/Drift/delete-your-element.git";
-    rev = "67658bf68026918163a2e5c2a30007364c9b2d2d";
-    sha256 = "sha256-jSQ588kwvAYCe6ogmO+jDB6Hi3ACJ/3+rC8M94OVMNw=";
-  };
-  npmDepsHash = "sha256-HNHEGez8X7CsoGYXqzB49o1pcCImfmGYIw9QKF2SbHo=";
-  dontNpmBuild = true;
-
-  nativeBuildInputs = [makeWrapper];
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out/share
-    cp -a . $out/share/ooye
-    makeWrapper ${nodejs}/bin/node $out/bin/matrix-ooye --add-flags $out/share/ooye/start.js
-    makeWrapper ${nodejs}/bin/node $out/bin/matrix-ooye-addbot --add-flags $out/share/ooye/addbot.js
-
-    runHook postInstall
-  '';
-
-  meta = with lib; {
-    description = "Matrix-Discord bridge with modern features.";
-    homepage = "https://gitdab.com/cadence/out-of-your-element";
-    longDescription = ''
-      Modern Matrix-to-Discord appservice bridge, created by @cadence:cadence.moe.
-    '';
-    license = licenses.gpl3;
-    # maintainers = with maintainers; [ RorySys ];
-    mainProgram = "matrix-ooye";
-  };
-}

secrets/bicep/matrix.yaml

@@ -9,15 +9,14 @@ mjolnir:
 discord:
     as_token: ENC[AES256_GCM,data:cnPZjBbODZUA1p0kLNeWpKh1oGkDPxDw/g7163XnoRCIgpqk,iv:Uu4L36uDPMBgzdXE2Lt9U0qrBSl3Xuufh1313BD8B/U=,tag:nTm6s7IGd4vNzZ95mfxDpA==,type:str]
     hs_token: ENC[AES256_GCM,data:UzcaNsJtJPKvFT4gQDNfat0nmyJzmQ6OcSI73pANibzOVrWl,iv:ujgRM2jb1rbeloPB4UPLBEvQ7uue4a+bHiqsZAHIqtk=,tag:uIfuaTWSTeVvpQx5o28HPA==,type:str]
-ooye:
-    hs_token: ENC[AES256_GCM,data:QBrdRt4ozAh2XYJtssm82uHlk9aGO1Nr0fEZetmWfLvmw52FZEq8ijyKOgwS6uTcndMi4gGKkq9r4eapLwcMdQ==,iv:VHOAqxR1WGzZ9dmNx+FmjGAKRpUFjWOwyOVmgDswpE0=,tag:k5it/yx7pOfGbJXZUlV69Q==,type:str]
-    as_token: ENC[AES256_GCM,data:RMkY0xVj14FwDbYaAysSmzB0IlJuk0ucicNhhTmVAEgiU05PxWG+qk3/elFcaFwaXRFgQQtVyGFZEcK5gpE9hA==,iv:8JgNrTe7GQqPMdUCxEaxJ9qV7Uec2fkYBmF9LmH4X3o=,tag:tRnFpRAZs9kO3u2SDMwNnA==,type:str]
-    discord_token: ENC[AES256_GCM,data:6rzv3glW03jcYiJ7sAvDcvDmQHs9iVbV11tIFwgD3GuTkVn6mbAoQhjUaz3zpb/OeoGt+j/pCBRlZgk=,iv:JwkqLpeGYhgwLX7SACNh0AUO53XSx9IKgncI0+KkvyU=,tag:30C0X9nVSlEYPITVzuN0qA==,type:str]
-    discord_client_secret: ENC[AES256_GCM,data:wbM7bPZCWa2+UNUqXi27fP0ppdinRkEC4N9KB68TJzg=,iv:Y2j+8oI+kI7DMrBfFU3G5HtFWguNxDpxbNvJkpK5lQs=,tag:GntocbTCybCVqZ2T3lNSIQ==,type:str]
 hookshot:
     as_token: ENC[AES256_GCM,data:L4vEw5r4RhcgritOeDTLHN5E/dM=,iv:pC8BLzxf6NaVAGsotoq6chOceBVdMLvrsQn1LGw9H9w=,tag:SI3CDFHAvgQZEvf/oms3EA==,type:str]
     hs_token: ENC[AES256_GCM,data:2ufSJfYzzAB5IO+edwKSra5d/+M=,iv:cmTycGzNL+IeRRKZGbkhTtiksYTtbxED0k0B5haFw7k=,tag:FmWe5sGi9rlapUeAE6lKvg==,type:str]
 sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
     age:
         - recipient: age1sl43gc9cw939z5tgha2lpwf0xxxgcnlw7w4xem4sqgmt2pt264vq0dmwx2
           enc: |
@@ -73,8 +72,8 @@ sops:
             WEh5NFN6SFF1TlltdWFWTGw4MHRHUkUKrKIvC87xjEmwxPQhH8dN+ZuaJTCgPY28
             pR62KxmoKFICLTHPpYP3euiAx5M9BWvgvCnA/US/5klpk8MtlreNFA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-06-21T21:23:24Z"
+    lastmodified: "2024-10-13T23:30:01Z"
-    mac: ENC[AES256_GCM,data:bEJoCzxph/MOnTOJKdrRiQmbVWmAgsKy8vbD5YBeWagWUCJPDAZNDFLzEzmPvt0jDBol04JosrSIKZS1JzJIIm0zRkcOWSqERQCgjgtGdAYmfp0V6ddseDUVfKlZYJDkt6Bdkqg+9LzrP8dDVm2tMDXpo8vzs02o9dTYFm7imVQ=,iv:buP/297JMfvEm9+IdMWRGV7AgZwF0+G6Z2YIeYw/z1o=,tag:+zG612MJA4Ui8CZBgxM+AQ==,type:str]
+    mac: ENC[AES256_GCM,data:vdsAZmg7gPqzeucBhLhPemtRVkcxRecIdB6PXZ4paU+Uv5UorBKcTZ3jseN2cLi6ot3ycTIm+UI6uhlCy87vAJVynVJhuJS+ICFRS2+DfoVyuttLjZQGC2sr3+dEBHxIH7sZJSo9PIzbIWw3qHrpOPAZj0//1pFyp/k15k3vidM=,iv:jWtV+WAPt08lgdrVvtXOl35rDB4QflkZWuGBW1+ESyw=,tag:YxSHncZZOAW5uDxXtb/krw==,type:str]
     pgp:
         - created_at: "2024-08-04T00:03:46Z"
           enc: |-
@@ -97,4 +96,4 @@ sops:
             -----END PGP MESSAGE-----
           fp: F7D37890228A907440E1FD4846B9228E814A2AAC
     unencrypted_suffix: _unencrypted
-    version: 3.10.2
+    version: 3.8.1

secrets/lupine/lupine.yaml

@@ -1,124 +0,0 @@
-gitea:
-    runners:
-        lupine-1: ENC[AES256_GCM,data:UcZB2p/dInvcl0yNBEohzbmcVxg/QQPXlIsaVB3M3hyxFg1gtGfUGA==,iv:OigyPfPoRIjvyiId7hiiWdNrZqyZqI3OonvJC+zYEzI=,tag:SjBsvo/IJKhFQs+PiI596g==,type:str]
-        lupine-2: null
-        lupine-3: null
-        lupine-4: null
-        lupine-5: null
-sops:
-    age:
-        - recipient: age1fkrypl6fu4ldsa7te4g3v4qsegnk7sd6qhkquuwzh04vguy96qus08902e
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBncnd2NVdqdjU1WWx4YWJr
-            RUVuSThBWWdyVnpFT0kzZjBrVjZiN1FiU0ZBCmNCbGVZK09YaFNGSUE2QWpidEFw
-            aEZEVndkODRzYmNLWDRzSGMzOWZKajAKLS0tIE00b3NiclFrOEk3R1lkeWM0VHY3
-            dUFQcG04bWNwYjRjTlNWV0pXNnlTN28KEc8nM7jzMuh2B6Q9vDS9apmVZDH9fAGi
-            dyze2SHCvfbr6So6GtJnZQy5J7tPoHBd3zwjojYV11kR9Ci1GszrVw==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1mu0ej57n4s30ghealhyju3enls83qyjua69986la35t2yh0q2s0seruz5n
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuVzdFdXdETEN3bjdIY0hi
-            TUV3YjFSUHBhNTIyUDd6MC93R2xRZmZGTkd3CkZuNWRZY25nY1FMZjV1QzJuUUZN
-            d0hzMUplY0w4c0hVK0dCbHVzVURvUm8KLS0tIGt2UEozYTdzMDRGUlRYeWpLY0Q3
-            bmFMZGRhWGZQZlpwMFZsV3VwdEljRUkKwS1gGaLCY/+wv2blCiDWHXOTl7eRVDPH
-            NPk33fXDa0y4AxFmwJ9caHL+UHWhSCVvi6odl1F6OA4blNLHRZAyzQ==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1j2u876z8hu87q5npfxzzpfgllyw8ypj66d7cgelmzmnrf3xud34qzkntp9
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDdmZXREhrUk5kWHgyMzI0
-            RnR0bVE1cm9GQkpwc0VWZ3ZmUjMxMzF2WVhFCkcrcEI4enlRN09wNzF4M0tTNXZi
-            TWg1TTkwUlNYUU1ReUVSU1dTdFoxeWcKLS0tIGZaMmVmZ1kxbFVVMmsxTzczYU9j
-            N3Y3Qm9SQ2Z0bWNhM043czdnWC9RR0kK61W5sqXybAbjTUR8D05dYMInLl683Rzj
-            G+0MZEzvfYONGU1gduRB5quHAwZLG5b9N6zorRSFON1meni+v/Ciww==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1t8zlawqkmhye737pn8yx0z3p9cl947d9ktv2cajdc6hnvn52d3fsc59s2k
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBod1RDR1NLZlhQQWw4Nk8z
-            TTZHZitTNjFxUHVIZWY3N2VDd3pXRGt4N0JFClNzQ2REbSt5T0FXaVBhS09zcS9y
-            TW5PTW1mSzlyOHppSm1yMWp6by9ZUWMKLS0tIFVsYkJZbHE3K3B5TS95amJhbDYy
-            dFV1REdKYmIweWw1MDJ4L3p0cW9nVWMKQndDoniGQOn01SnscX7u7y6l119Eb++q
-            JoTZELALPIyGdI4pXd6zCfRyLFaqWd4CO0RFtl8FTcm75W+ETmqqlQ==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age199zkqq4jp4yc3d0hx2q0ksxdtp42xhmjsqwyngh8tswuck34ke3smrfyqu
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjdlhET094ZGJsZU9tZnhz
-            d20wcnltVU1MS09Qb3lzV2RjNi9OZjhDdFRBCndRY3hwQ3VHQWF2MVRFUU1MQkhh
-            bGRQdEVaSzF0YTgxTGdITGN2dDlYc1kKLS0tIEw1MmFkUHJaKzZGRU93T2VTTkxK
-            VU0xV0gwQ1NnbVIrS3lHTnJ5bU9IcGMKDWSWfA7iBQ+8iclmXDVf5Qjv67D2WbJg
-            ovrYcT1F5+qE4xkuUkzVaGn9vgT+/kkzFucBz0c0iD5KCoa52z5AlQ==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age17tagmpwqjk3mdy45rfesrfey6h863x8wfq38wh33tkrlrywxducs0k6tpq
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtV2R5VzdCbkFDTGRJUG81
-            bUk3Y3F6NkJGYUk1VW1XQnFOSTlwMTduL0Y0CjJ4N1Q5MXZjQXhsTk5Hbk40U1pU
-            aFNxeFIyaGJpd3dMZFpQL0R2M1dHbk0KLS0tIGpUVGMyRSt6aDZVOERRWnRSY1Ns
-            dXptcUNmeGRHcEs3WStpL3BuZUtJbjAKhqJEec4vjSC18oRl1dTNkF2Ev4YtudE4
-            Lp2vbcSHXwrZhqbFlQ8stCpUJvjCBEr2cT/shrG38aP0MzgeSmMacQ==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1mrnldl334l2nszuta6ywvewng0fswv2dz9l5g4qcwe3nj4yxf92qjskdx6
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBURXhRWEFHU2Rtd0pyZGUw
-            b09VQ1JhYjhJYlpnY2FCZndEcU1Ed3k1K0UwCit1NVIyL2xuZlAzbEJwY3V0UTB3
-            Unk1L3p6cHlVWjllMjcvcTdDcnlxcGcKLS0tIGdGa3MvTmJiSGF4YnBZbE1wdGEv
-            eFArZE5MaXlvOE9XN1I4eEtNMEpzcU0KVNUfcUJM+IVY/+b8mQiHKvuFnsih+zHx
-            ZdUD+FPjghqrzJB4MOl/PYAxJ4lga6gPbcRWD5UUDuyDGOUwRpOt7w==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1hmpdk4h69wxpwqk9tkud39f66hprhehxtzhgw97r6dvr7v0mx5jscsuhkn
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNUnhIOHVLUG1meWFlZ24w
-            SVlFenR1aWZXK21HSXpHU1NSZ2llQ1EwSnpnCmJYRXR3b3IvclZvaGpGdEpOUk9D
-            eDg2eFFJQ0M4TEJqZDVUQUZGa2h3V3cKLS0tIEhWTzhoMVg1UEM2M1k1TVZTUDlL
-            RDE1RCtUV2dDR3haclBMZDFhYXcyV2sKjwEI2dY4rluumihyEggLYDDvZZAK4SZw
-            FWkwIUpMCZzg2fCeDMnTSAWfAZbiDcPLoCieJ2bpGXPTzyasRlOakg==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1wrssr4z4g6vl3fd3qme5cewchmmhm0j2xe6wf2meu4r6ycn37anse98mfs
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxamdXMXJ4K3hMV2g1WmUy
-            Ry80dG5wdWlLc1paY1VoSE8vWk1ra1g5cldFClN1eXlVUGVndnovQ3dxQTdzQjRV
-            Wm9NNWg5VVR4NVNsRjM0VHFya1FQeWsKLS0tIG43bTdKVjNrQlBUWHJoNjIyOW85
-            TGd1Tng1akExRDd0TFZmQ3JnS3FtK3cKn2t7/4yIDZT2oy8fyJibF62usPjhuBOb
-            9qQjChRm5h5mNSWdAzyf48wID7czzJiZjqtfE4vjLYLsWKMzz9j3xg==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1zhxul786an743u0fascv4wtc5xduu7qfy803lfs539yzhgmlq5ds2lznt5
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKQm5UalBhV1NWa2ZQNzVQ
-            OEZXODkrYXRGR2lRMzMwSk5KV01WK3pLZlZ3ClNwZTV6aGRvZlV2UXJaNm9IOVVR
-            VFZscVZhVkFaMlk5a1ZCcWJReVN5YWcKLS0tIEhHMnRKdWJvTkREbFlWb25YRXg3
-            YU5mMDlRckJCMDAzcHYyMWN1clRJRVEK77PiAQP+2+WblGYEgAf6bx6RTh0JHiSZ
-            /jPIN/rbAKNv36wpZDbuLV8tcMuvhleNMRSSqbIloLSzww+Z5nOU4A==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-07-30T18:29:08Z"
-    mac: ENC[AES256_GCM,data:47cki5ucPTVd4JuEyK0QkDCCEqj1pW6SA5I6ihC/MEja6TIuHTcEPFpje8+LvpGjpP9uobKX4g3UcyvkJ63j/k3hU0xPYQX3Z1ee00KIMKB0GHNjUR8ENtnwd3TU7kp5ohtXeCtcyzCjdFFuXp8AINGv3vpbU2MzauctUxn5B1Y=,iv:1mpk/f1QlRtHfA9dqyNLBrvfVPgtLnZ7ibj8qNrEGD8=,tag:drEK1+qeJy97rgeQJyqucA==,type:str]
-    pgp:
-        - created_at: "2025-07-30T18:27:50Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA0av/duuklWYAQ/9HdDiIXAQjcAbokD7yliGC+p7j+RxD2FDh5aXtDIS14dM
-            pF7wdTdY7PvcXoSCQ5ZC7bjIY86MDfD+BT63MwjOczIgBJJ9wrGDZ2o9DnzzYsI1
-            XdUgQscjtbAycNlaczI6IXrYlWqjt6qpp/OADXdMXZo3W+pTR3aSdrj/FcMzJad1
-            AMQt8raqrD5LxIj0yWEYvob5z7NA6slBvVJRszsbYgz3aJWqG2DhlUBph6j2Rgmq
-            /W796+fywrunmY/dmzptT5Epp5gZ55BAqg09qHj/+crTxIt7SNpsfps2ki8JBVq0
-            4ooaUktBBMnhsZBA8NIauesokZkLO0MvyvjMBPGR8jun2EXoNtFmWZqUqD1fb0B5
-            xe0SVg8XIzS/AFnKVAWfj6h9lM4guLL/kxu3aPAJwOj+YtIAXx4vojs81Led8nlQ
-            jXvfy7Y94EQhKTLWuK12QC+bw2vy4V9L98nyDKB3ZuN2l3A2CN1ZLXArk/oez56d
-            5t/0C43qEPfzQH87kygGuuQmlZvQupnHN4iCvExmoiX362/3S9h1wS5QcKdC3Lk/
-            f3yr0+r1uOYuoQuofwitLZaq66aCmqYUmXhLvGujPjg8YuNXQ5k1MlOilDqoZnxk
-            0V8RQbTpvUcqRLgczofC0ovgE2W13khS2BGxG3ZPmAbUGiaIP9OkfebI7hJJE7LS
-            XgE4cU06C5jj4wLkOj3y4nEKwaFrEGRO3YQa1kl5/sExOg0Jd7fehozVh8+opGOZ
-            MhmVHghd/RYZzBi3NZL28xnAvsawE1m6h6WEGk6JaVEdJh9W009AQCtVyChs9Og=
-            =4gbo
-            -----END PGP MESSAGE-----
-          fp: F7D37890228A907440E1FD4846B9228E814A2AAC
-    unencrypted_suffix: _unencrypted
-    version: 3.10.2

secrets/skrott/skrott.yaml

@@ -0,0 +1,41 @@
+hello: ENC[AES256_GCM,data:KRtCZhcS+LMV5oUivFDBjQo7m9XkaGbHKOW6N/SFRiyZA3eXSkVeltttUHhCrw==,iv:AXlyyW5gQvXu//jV/BVb79ASbKsfu5FFNnRmXNBbfg0=,tag:UVLWNgxtSFh4txCDWl5bPg==,type:str]
+example_key: ENC[AES256_GCM,data:7SpSse4uVUzCwCzbdQ==,iv:zUh9qk/T7LNOXMqToQozn2KeHu9HJtAKarU+Xb5xwi0=,tag:AyO1cflpYraiABPApfjL8A==,type:str]
+#ENC[AES256_GCM,data:NnvbBdwOv5xiqArBdyypGg==,iv:iFCVF8EL8xrKNaDcPOcWp65EoilnG0mN/ph/ZaafLS0=,tag:7pQcs8grVPZbbjr/tze4LQ==,type:comment]
+example_array:
+    - ENC[AES256_GCM,data:fd3mltqGVj7bXHEMmcY=,iv:wzTLHEgQ7bDfUlu01qtaU6fe8L1ZTqmDEBJYf1jttxc=,tag:53XJn1OdJBTEC2BvoSIG1A==,type:str]
+    - ENC[AES256_GCM,data:jZffrJgY0C0YuGIwxxk=,iv:PH+x0/4vm40w+YuCO3JlOqw5bdfaBT29m0YjKMRCFXg=,tag:rWSocVW9kimF5Dcs8lBuLQ==,type:str]
+example_number: ENC[AES256_GCM,data:lWYwd7RXk//H/w==,iv:lD62NqHV/o2QJft48l+0MSeoiGRQ1WFKDoD0sXUevqI=,tag:Ov8j/DqbFww27tDJhmaufA==,type:float]
+example_booleans:
+    - ENC[AES256_GCM,data:QEIQzw==,iv:sGfKE8VMl1uElsfG0Cip647jv/i1+eGE0UxgOM3i4uA=,tag:eWKw678aymRGa1fk8d7RSA==,type:bool]
+    - ENC[AES256_GCM,data:9czVwLg=,iv:OEKALhwOl0OcEJe+k9bhxxdZ/bNd/Xfcvrd40fwAwF8=,tag:CWBuPlcO9WgrSUb0BgfL9g==,type:bool]
+dibbler:
+    config: ENC[AES256_GCM,data:SVTe6MOansry+FKwdu3mDZna4vmu+UMwySfKrfImnGozLz2FYHLW+RvjWaRpa7aGInPfE/icYbSxbHrFIPcIGGlJHTKUlCqQ6km/qYh3UxggKGH1JeUEIgkyvgBXvofym8b5CzyfRXpm35fs+1Io7MWTpeDhmNVk1hVoIU/qR6o6NhOCeH00Gy3cqxCGqi4loJYa51BMNczcUMynwP/9lB2OOb7ogl2TbKXZOK2jwSDCTLJ8FrKcCtUcUnGqUp9VwgktxNrRtFwGohW2gAg2Oq2OR+00dpT2VS+gUtHabrcwft7ioZBmb7rrI4KxpJwG96CYqX90iQiltkwA57BqVByvaYhga4nwdVT48e76MIgBYcQX1WDolL8eEU5QPvhnbmU2mVjdD9SmapoHwBm2qM7LqmsMjqnH8ZHMdtETs6kzt227/QZdh7fc7kaIK1x3Lpxpl3whUMc+mrM8D9xFSjuyxSiF0h7tBH6H,iv:oGd6Dnw655bpwXjqW4niU5dN0RfUDY39hFfiiIc9vhQ=,tag:4CL6iqCiALp/k03Ju6OI/Q==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age17tagmpwqjk3mdy45rfesrfey6h863x8wfq38wh33tkrlrywxducs0k6tpq
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpUlh2azlDTm9PRjJXQ2hO
+            MDlVbTdEN1RIVHkrbjIyY3pVVVlXY3M4eFNjCmJvZUNobVJHdnBhWjFHVVhmVVdX
+            aFloQVRyUXZsQ2g0bENQald6T2F3cEUKLS0tIGRuQjBXb2lzQnJQdDk0SzYwNUsx
+            SnhWdGZaTTVXbm4waW42ZUE0aWFtdDQKFLiRLCBHLAn43q7EPdc/mmQImltIsA5T
+            5ejVVvsva2wznc/pYvAeLb40yAwtszsNwH02SJ19WDz5wEARaQ8+8w==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1ju7rd26llahz3g8tz7cy5ld52swj8gsmg0flrmrxngc0nj0avq3ssh0sn5
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwd2w1YUtHaFZoNEFxMjF4
+            d1V2OFF4ZjFwNnpBWi9Cc3d1SHdqeVh4RDBzCmNLU3VWeVl4Z0ZPOUUvRjlsYzFZ
+            bjEwRlAweVcvME9nZTY1cmM4VHpXWVUKLS0tIHZJRjIveGoyQm02R0xaT2FEclFv
+            ZjhLdUhWdHp2N2krbkxqcHRoZVB6WkEK7uRAXYfI9LMfBXbHwitEVIyhGe6adIFz
+            9at0KEwLXePpR6bO9PM+T4am9V46Ygdq5iS8bSmX03832sK69pF9CA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-03-16T22:32:52Z"
+    mac: ENC[AES256_GCM,data:A1kg0QtZN3gMnBz1uqllPK4WI4U/CE8yJh8rHJ9CQ9V2kJQA6Kk7XrESVMsBpIazI6GuN1s33v4hNpeXhns5DMSdpWgQdyz8OM4Kj2nGz5h/JxCYwKT0e3R5qy48e0dcM906SG08DVQCCsiBnXAFWymM9Hs2+dPAAWlCNiR0gME=,iv:SookZTJGT7F5vZU6uDr9gO1A6XuDmL1UXlyphYS2dsI=,tag:8S77OX8aJcCn3efY25k4Dw==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.8.1

users/oysteikt.nix

@@ -13,6 +13,7 @@
       bottom
       eza
       neovim
+      diskonaut
       ripgrep
       tmux
     ];

values.nix

@@ -41,6 +41,10 @@ in rec {
       ipv4 = pvv-ipv4 209;
       ipv6 = pvv-ipv6 209;
     };
+    bob = {
+      ipv4 = "129.241.152.254";
+      # ipv6 = ;
+    };
     knutsen = {
       ipv4 = pvv-ipv4 191;
     };
@@ -68,25 +72,9 @@ in rec {
       ipv4 = pvv-ipv4 240;
       ipv6 = pvv-ipv6 240;
     };
-    lupine-1 = {
+    skrott = {
-      ipv4 = pvv-ipv4 224;
+      ipv4 = pvv-ipv4 235;
-      ipv6 = pvv-ipv6 224;
+      ipv6 = pvv-ipv6 235;
-    };
-    lupine-2 = {
-      ipv4 = pvv-ipv4 225;
-      ipv6 = pvv-ipv6 225;
-    };
-    lupine-3 = {
-      ipv4 = pvv-ipv4 226;
-      ipv6 = pvv-ipv6 226;
-    };
-    lupine-4 = {
-      ipv4 = pvv-ipv4 227;
-      ipv6 = pvv-ipv6 227;
-    };
-    lupine-5 = {
-      ipv4 = pvv-ipv4 228;
-      ipv6 = pvv-ipv6 228;
     };
   };