Adding unstable to pkgs.unstable and try apply it at runtime

2022-12-19 22:42:15 +01:00
111 changed files with 881 additions and 49098 deletions
--- a/.gitea/workflows/eval.yml
+++ b/.gitea/workflows/eval.yml
@@ -1,13 +0,0 @@
 name: "Eval nix flake"
 on:
  pull_request:
  push:
 jobs:
  evals:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v3
    - run: apt-get update && apt-get -y install sudo
    - uses: https://github.com/cachix/install-nix-action@v23
    - run: echo -e "show-trace = true\nmax-jobs = auto\ntrusted-users = root\nexperimental-features = nix-command flakes\nbuild-users-group =" > /etc/nix/nix.conf
    - run: nix flake check
--- a/.sops.yaml
+++ b/.sops.yaml
@@ -1,60 +1,31 @@
 keys:
  # Users
  - &user_danio age17tagmpwqjk3mdy45rfesrfey6h863x8wfq38wh33tkrlrywxducs0k6tpq
  - &user_felixalb age1mrnldl334l2nszuta6ywvewng0fswv2dz9l5g4qcwe3nj4yxf92qjskdx6
  - &user_oysteikt F7D37890228A907440E1FD4846B9228E814A2AAC
-
+  - &host_jokum age1n4vc3dhv8puqz6ntwrkkpdfj0q002hexqee48wzahll8cmce2ezssrq608
  # Hosts
  - &host_jokum age1gp8ye4g2mmw3may5xg0zsy7mm04glfz3788mmdx9cvcsdxs9hg0s0cc9kt
  - &host_ildkule age1hn45n46ypyrvypv0mwfnpt9ddrlmw34dwlpf33n8v67jexr3lucq6ahc9x
  - &host_bekkalokk age12nj59tguy9wg882updc2vjdusx5srnxmjyfaqve4zx6jnnsaw3qsyjq6zd
  - &host_bicep age1sl43gc9cw939z5tgha2lpwf0xxxgcnlw7w4xem4sqgmt2pt264vq0dmwx2
 creation_rules:
  # Global secrets
  - path_regex: secrets/[^/]+\.yaml$
    key_groups:
    - age:
      - *user_danio
      - *host_jokum
      - *user_danio
      - *user_felixalb
      pgp:
      - *user_oysteikt
  # Host specific secrets
-  
+  ## Jokum
  - path_regex: secrets/bekkalokk/[^/]+\.yaml$
    key_groups:
    - age:
      - *host_bekkalokk
      - *user_danio
      - *user_felixalb
      pgp:
      - *user_oysteikt
  - path_regex: secrets/jokum/[^/]+\.yaml$
    key_groups:
    - age:
      - *host_jokum
      - *user_danio
-      - *user_felixalb
+      - *host_jokum
      pgp:
      - *user_oysteikt
  - path_regex: secrets/ildkule/[^/]+\.yaml$
    key_groups:
    - age:
      - *host_ildkule
      - *user_danio
      - *user_felixalb
      pgp:
      - *user_oysteikt
  - path_regex: secrets/bicep/[^/]+\.yaml$
    key_groups:
    - age:
      - *host_bicep
      - *user_danio
      - *user_felixalb
      pgp:
-      - *user_oysteikt
+      - *user_oysteikt
--- a/README.MD
+++ b/README.MD
@@ -4,19 +4,9 @@
 Før du endrer på ting husk å ikke putte ting som skal være hemmelig uten å først lese seksjonen for hemmeligheter!
-Etter å ha klonet prosjektet ned og gjort endringer kan du evaluere configene med:
+Etter å ha klonet prosjektet ned og gjort endringer kan du bygge med:
-`nix flake check --keep-going`
+`nix build .#nixosConfigurations.jokum.config.system.build.toplevel`
 før du bygger en maskin med:
 `nix build .#<maskinnavn>`
 hvis du vil være ekstra sikker på at alt bygger så kan du kjøre:
 `nix build .` for å bygge alle de viktige maskinene.
 NB: Dette kan ta opp til 30 minutter avhengig av hva som ligger i caches
 Husk å hvertfall stage nye filer om du har laget dem!
@@ -26,7 +16,7 @@ Det er sikkert lurt å lage en PR først om du ikke er vandt til nix enda.
 Innen 24h skal alle systemene hente ned den nye konfigurasjonen og deploye den.
 Du kan tvinge en maskin til å oppdatere seg før dette ved å kjøre:
-`nixos-rebuild switch --update-input nixpkgs --update-input nixpkgs-unstable --no-write-lock-file --refresh --flake git+https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git --upgrade`
+`nixos-rebuild switch --flake "git+https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git"`
 som root på maskinen.
@@ -47,11 +37,3 @@ for å få tilgang til å lese/skrive hemmeligheter må du spørre noen/noe som
 om å legge til age eller pgp nøkkelen din i [`.sops.yaml`](https://git.pvv.ntnu.no/Drift/pvv-nixos-config/src/main/.sops.yaml)
 Denne kan du generere fra ssh-nøkkelene dine eller lage en egen nøkkel.
 ### Legge til flere keys
 Gjør det som gir mening i .sops.yml
 Etter det kjør `sops updatekeys secrets/host/file.yml`
 MERK at det ikke er `sops -r` som BARE roterer nøkklene for de som allerede er i secretfila
--- a/assets/logo_blue_regular.png
+++ b/assets/logo_blue_regular.png
--- a/assets/logo_blue_regular.svg
+++ b/assets/logo_blue_regular.svg
@@ -1,172 +0,0 @@
 <?xml version="1.0" encoding="UTF-8" standalone="no"?>
 <!-- Created with Inkscape (http://www.inkscape.org/) -->
 <svg
   width="200mm"
   height="200mm"
   viewBox="0 0 200 200"
   version="1.1"
   id="svg5"
   inkscape:version="1.1.2 (b8e25be833, 2022-02-05)"
   sodipodi:docname="logo_blue_thicc.svg"
   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
   xmlns="http://www.w3.org/2000/svg"
   xmlns:svg="http://www.w3.org/2000/svg">
  <sodipodi:namedview
     id="namedview7"
     pagecolor="#505050"
     bordercolor="#ffffff"
     borderopacity="1"
     inkscape:pageshadow="0"
     inkscape:pageopacity="0"
     inkscape:pagecheckerboard="1"
     inkscape:document-units="mm"
     showgrid="false"
     inkscape:zoom="3.9730533"
     inkscape:cx="359.54715"
     inkscape:cy="690.40101"
     inkscape:window-width="1920"
     inkscape:window-height="1057"
     inkscape:window-x="-8"
     inkscape:window-y="-8"
     inkscape:window-maximized="1"
     inkscape:current-layer="Layer_4"
     width="200mm" />
  <defs
     id="defs2" />
  <g
     inkscape:label="Layer 1"
     inkscape:groupmode="layer"
     id="layer1">
    <g
       id="g98"
       transform="scale(0.25)">
      <g
         id="Layer_2"
         style="fill:#283681;fill-opacity:1">
        <rect
           y="0"
           class="st0"
           width="800"
           height="800"
           id="rect4"
           x="0"
           style="fill:#283681;fill-opacity:1"
           inkscape:export-filename="C:\Users\al3xk\OneDrive - NTNU\PVV\Gogs\PR\logoer\logo_blue.png"
           inkscape:export-xdpi="480"
           inkscape:export-ydpi="480" />
      </g>
      <g
         id="Layer_4"
         style="fill:#283681;fill-opacity:0;stroke:#ffffff;stroke-width:4.2;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1">
        <line
           class="st1"
           x1="478.39999"
           y1="720.29999"
           x2="313.20001"
           y2="720.29999"
           id="line9"
           style="fill:#283681;fill-opacity:0;stroke:#ffffff;stroke-width:4.2;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
        <path
           class="st1"
           d="M 478.4,720.3"
           id="path11"
           style="fill:#283681;fill-opacity:0;stroke:#ffffff;stroke-width:4.2;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
        <polyline
           class="st2"
           points="717.1,223.3 717.1,720.3 497.3,720.3  "
           id="polyline13"
           style="fill:#283681;fill-opacity:0;stroke:#ffffff;stroke-width:4.2;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
        <path
           class="st2"
           d="m 498.39888,720.3 c 0,-5.6 -4.5,-10.1 -10.1,-10.1 -5.6,0 -10.1,4.5 -10.1,10.1 h -163.8 c 0,-5.6 -4.5,-10.1 -10.1,-10.1 -5.6,0 -10.1,4.5 -10.1,10.1 -69.7592,0 -145.68417,0 -217.599996,0 V 79.7 H 717.09888 v 120 0 h -17.3 v 24.8 h 17.3"
           id="path15"
           style="fill:#283681;fill-opacity:0;stroke:#ffffff;stroke-width:4.2;stroke-linecap:square;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
           sodipodi:nodetypes="csccsccccccccc" />
      </g>
      <g
         id="Layer_3"
         style="fill:#283681;fill-opacity:0;stroke:#ffffff;stroke-width:4.2;stroke-miterlimit:10;stroke-dasharray:none;stroke-opacity:1">
        <circle
           class="st2"
           cx="396.79999"
           cy="400"
           id="circle18"
           style="fill:#283681;fill-opacity:0;stroke:#ffffff;stroke-width:4.2;stroke-miterlimit:10;stroke-dasharray:none;stroke-opacity:1"
           r="320.29999" />
      </g>
      <g
         id="Layer_1"
         style="fill:#283681;fill-opacity:0;stroke:#ffffff;stroke-width:4.2;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1">
        <polyline
           class="st2"
           points="514.5,173.5 170.2,173.5 170.3,626.6 623.3,626.5 623.3,215.7 584.4,173.4 557,173.4 548,180.6    526.5,180.7  "
           id="polyline21"
           style="fill:#283681;fill-opacity:0;stroke:#ffffff;stroke-width:4.2;stroke-linejoin:bevel;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
        <path
           class="st2"
           d="m 526.5,331.8 c 0,7.6 -5.4,13.7 -12,13.7 H 227.7 c -6.6,0 -12,-6.1 -12,-13.7 V 187.2 c 0,-7.6 5.4,-13.7 12,-13.7 h 286.8 c 6.6,0 12,6.1 12,13.7 z"
           id="path27"
           style="fill:#283681;fill-opacity:0;stroke:#ffffff;stroke-width:4.2;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
        <path
           class="st2"
           d="m 526.7,333.6 c 0,6.6 -5.4,12 -12,12 H 296.8 c -6.6,0 -12,-5.4 -12,-12 V 185.5 c 0,-6.6 5.4,-12 12,-12 h 217.9 c 6.6,0 12,5.4 12,12 z"
           id="path29"
           style="fill:#283681;fill-opacity:0;stroke:#ffffff;stroke-width:4.2;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
        <path
           class="st2"
           d="m 577.9,613.7 c 0,6.6 -5.4,12 -12,12 H 227.7 c -6.6,0 -12,-5.4 -12,-12 V 381.1 c 0,-6.6 5.4,-12 12,-12 h 338.2 c 6.6,0 12,5.4 12,12 z"
           id="path31"
           style="fill:#283681;fill-opacity:0;stroke:#ffffff;stroke-width:4.2;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
        <rect
           x="179.89999"
           y="590.20001"
           class="st2"
           width="25.700001"
           height="23"
           id="rect33"
           style="fill:#283681;fill-opacity:0;stroke:#ffffff;stroke-width:4.2;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
        <rect
           x="587.59998"
           y="590.20001"
           class="st2"
           width="25.700001"
           height="23"
           id="rect35"
           style="fill:#283681;fill-opacity:0;stroke:#ffffff;stroke-width:4.2;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
        <rect
           x="433.60001"
           y="193.5"
           class="st2"
           width="64.900002"
           height="137.8"
           id="rect37"
           style="fill:#283681;fill-opacity:0;stroke:#ffffff;stroke-width:4.2;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
      </g>
      <path
         d="m 274.9401,541.572 c 0,3.528 2.772,6.426 6.3,6.426 3.528,0 6.426,-2.898 6.426,-6.426 v -30.996 h 30.87 c 10.458,0 19.152,-8.694 19.152,-19.152 v -22.68 c 0,-10.332 -8.694,-19.026 -19.152,-19.026 h -43.596 z m 12.726,-43.722 v -35.406 h 30.87 c 3.276,0 6.426,2.898 6.426,6.3 v 22.68 c 0,3.528 -3.024,6.426 -6.426,6.426 z"
         style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:126px;font-family:OCRA;-inkscape-font-specification:OCRA;fill:#ffffff;stroke:#ffffff;stroke-width:4.2;stroke-miterlimit:10;stroke-dasharray:none;stroke-opacity:1"
         id="path55-2" />
      <path
         d="m 365.99479,478.824 25.326,65.142 c 1.008,2.394 3.276,4.032 6.048,4.032 2.646,0 4.914,-1.638 5.922,-4.032 l 25.452,-65.268 v -22.68 c 0,-3.402 -2.898,-6.3 -6.426,-6.3 -3.528,0 -6.3,2.898 -6.3,6.3 v 20.286 l -18.648,47.628 -18.648,-47.628 v -20.286 c 0,-3.402 -2.898,-6.3 -6.426,-6.3 -3.528,0 -6.3,2.898 -6.3,6.3 z"
         style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:126px;font-family:OCRA;-inkscape-font-specification:OCRA;fill:#ffffff;stroke:#ffffff;stroke-width:4.2;stroke-miterlimit:10;stroke-dasharray:none;stroke-opacity:1"
         id="path57-8" />
      <path
         d="m 457.04947,478.824 25.326,65.142 c 1.008,2.394 3.276,4.032 6.048,4.032 2.646,0 4.914,-1.638 5.922,-4.032 l 25.452,-65.268 v -22.68 c 0,-3.402 -2.898,-6.3 -6.426,-6.3 -3.528,0 -6.3,2.898 -6.3,6.3 v 20.286 l -18.648,47.628 -18.648,-47.628 v -20.286 c 0,-3.402 -2.898,-6.3 -6.426,-6.3 -3.528,0 -6.3,2.898 -6.3,6.3 z"
         style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:126px;font-family:OCRA;-inkscape-font-specification:OCRA;fill:#ffffff;stroke:#ffffff;stroke-width:4.2;stroke-miterlimit:10;stroke-dasharray:none;stroke-opacity:1"
         id="path59-1" />
    </g>
  </g>
  <style
     type="text/css"
     id="style2">
 	.st0{fill:#ffffff;}
 	.st1{fill:none;stroke:#ffffff;stroke-width:2;stroke-miterlimit:10;}
 	.st2{fill:none;stroke:#000000;stroke-width:2;stroke-miterlimit:10;}
 	.st3{fill:none;}
 	.st4{stroke:#000000;stroke-miterlimit:10;}
 	.st5{font-family:'OCRAStd';}
 	.st6{font-size:126px;}
 </style>
 </svg>
--- a/base.nix
+++ b/base.nix
@@ -1,4 +1,4 @@
-{ config, lib, pkgs, inputs, values, ... }:
+{ config, pkgs, inputs, ... }:
 {
  imports = [
@@ -7,15 +7,10 @@
  networking.domain = "pvv.ntnu.no";
  networking.useDHCP = false;
-  # networking.search = [ "pvv.ntnu.no" "pvv.org" ];
+  networking.search = [ "pvv.ntnu.no" "pvv.org" ];
  # networking.nameservers = lib.mkDefault [ "129.241.0.200" "129.241.0.201" ];
  # networking.tempAddresses = lib.mkDefault "disabled";
  # networking.defaultGateway = values.hosts.gateway;
  systemd.network.enable = true;
  services.resolved = {
-    enable = lib.mkDefault true;
+    enable = true;
    dnssec = "false"; # Supposdly this keeps breaking and the default is to allow downgrades anyways...
  };
@@ -32,7 +27,7 @@
    flake = "git+https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git";
    flags = [
      "--update-input" "nixpkgs"
-      "--update-input" "nixpkgs-unstable"
+      "--update-input" "unstable"
      "--no-write-lock-file"
    ];
  };
@@ -41,25 +36,30 @@
  nix.settings.experimental-features = [ "nix-command" "flakes" ];
-  /* This makes commandline tools like
+  # This makes commandline tools like nix run nixpkgs#hello
-  ** nix run nixpkgs#hello
+  # and nix-shell -p hello use the same channel the system was built with
  ** and nix-shell -p hello
  ** use the same channel the system
  ** was built with
  */
  nix.registry = {
    nixpkgs.flake = inputs.nixpkgs;
  };
-  nix.nixPath = [ "nixpkgs=${inputs.nixpkgs}" ];
+  nix.nixPath = [
    "nixpkgs=${inputs.nixpkgs}"
    "nixpkgs-overlays=${./overlays-compat}/"
  ];
  # Allows access to nixpkgs-unstable via pkgs.unstable
  nixpkgs.overlays = let
    unstable-overlay = final: prev: {
      unstable = inputs.unstable.legacyPackages.${prev.system};
    };
  in [
    unstable-overlay
  ];
  environment.systemPackages = with pkgs; [
    file
    git
    gnupg
    htop
    nano
    rsync
    screen
    tmux
    vim
    wget
@@ -67,19 +67,14 @@
    kitty.terminfo
  ];
  programs.zsh.enable = true;
  users.groups."drift".name = "drift";
  # Trusted users on the nix builder machines
  users.groups."nix-builder-users".name = "nix-builder-users";
  services.openssh = {
    enable = true;
    permitRootLogin = "yes";
    extraConfig = ''
      PubkeyAcceptedAlgorithms=+ssh-rsa
    '';
    settings.PermitRootLogin = "yes";
  };
--- a/flake.lock
+++ b/flake.lock
@@ -1,174 +1,59 @@
 {
  "nodes": {
    "disko": {
      "inputs": {
        "nixpkgs": [
          "nixpkgs"
        ]
      },
      "locked": {
        "lastModified": 1709632354,
        "narHash": "sha256-jxRHwqrtNze51WKFKvxlQ8Inf62UNRl5cFqEQ2V96vE=",
        "owner": "nix-community",
        "repo": "disko",
        "rev": "0d11aa8d6431326e10b8656420f91085c3bd0b12",
        "type": "github"
      },
      "original": {
        "owner": "nix-community",
        "repo": "disko",
        "type": "github"
      }
    },
    "grzegorz": {
      "inputs": {
        "nixpkgs": [
          "nixpkgs-unstable"
        ]
      },
      "locked": {
        "lastModified": 1696346665,
        "narHash": "sha256-J6Tf6a/zhFZ8SereluHLrvgPsIVm2CGHHA8wrbhZB3Y=",
        "owner": "Programvareverkstedet",
        "repo": "grzegorz",
        "rev": "9b9c3ac7d408ac7c6d67544b201e6b169afacb03",
        "type": "github"
      },
      "original": {
        "owner": "Programvareverkstedet",
        "repo": "grzegorz",
        "type": "github"
      }
    },
    "grzegorz-clients": {
      "inputs": {
        "nixpkgs": [
          "nixpkgs"
        ]
      },
      "locked": {
        "lastModified": 1693864994,
        "narHash": "sha256-oLDiWdCKDtEfeGzfAuDTq+n9VWp6JCo67PEESEZ3y8E=",
        "owner": "Programvareverkstedet",
        "repo": "grzegorz-clients",
        "rev": "a38a0b0fb31ad0ad78a91458cb2c7f77f686468f",
        "type": "github"
      },
      "original": {
        "owner": "Programvareverkstedet",
        "repo": "grzegorz-clients",
        "type": "github"
      }
    },
    "matrix-next": {
      "inputs": {
        "nixpkgs-lib": "nixpkgs-lib"
      },
      "locked": {
-        "lastModified": 1701507532,
+        "lastModified": 1671480255,
-        "narHash": "sha256-Zzv8OFB7iilzDGe6z2t/j8qRtR23TN3N8LssGsvRWEA=",
+        "narHash": "sha256-06G6xYTFPVuvmN/k2QDeBk9XIp4LDxEKWRL3aLAFFNo=",
        "owner": "dali99",
        "repo": "nixos-matrix-modules",
-        "rev": "046194cdadc50d81255a9c57789381ed1153e2b1",
+        "rev": "f42306e0a2df064f1beb6dfcc1776ea33e7ae9df",
        "type": "github"
      },
      "original": {
        "owner": "dali99",
        "ref": "flake-experiments",
        "repo": "nixos-matrix-modules",
        "type": "github"
      }
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1709565521,
+        "lastModified": 1671445885,
-        "narHash": "sha256-YP3H7Lm3IhOKHIcn+qMCLRINJG313Io5CjvNTJyrnhY=",
+        "narHash": "sha256-oDCTgQiqr3y62NrU+viFCYXKln24wgUdYaf4ynXRPgI=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "9a5f1a573376eeb8c525f936eed32fabfb6e81be",
+        "rev": "d3cf188b498a7dc936de67254ba2fdafcf5a1368",
        "type": "github"
      },
      "original": {
-        "id": "nixpkgs",
+        "owner": "NixOS",
-        "ref": "nixos-23.11-small",
+        "ref": "nixos-22.11-small",
-        "type": "indirect"
+        "repo": "nixpkgs",
      }
    },
    "nixpkgs-lib": {
      "locked": {
        "lastModified": 1673743903,
        "narHash": "sha256-sloY6KYyVOozJ1CkbgJPpZ99TKIjIvM+04V48C04sMQ=",
        "owner": "nix-community",
        "repo": "nixpkgs.lib",
        "rev": "7555e2dfcbac1533f047021f1744ac8871150f9f",
        "type": "github"
      },
      "original": {
        "owner": "nix-community",
        "repo": "nixpkgs.lib",
        "type": "github"
      }
    },
    "nixpkgs-stable": {
      "locked": {
-        "lastModified": 1709428628,
+        "lastModified": 1671459584,
-        "narHash": "sha256-//ZCCnpVai/ShtO2vPjh3AWgo8riXCaret6V9s7Hew4=",
+        "narHash": "sha256-6wRK7xmeHfClJ0ICOkax1avLZVGTDqBodQlkl/opccY=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "66d65cb00b82ffa04ee03347595aa20e41fe3555",
+        "rev": "87b58217c9a05edcf7630b9be32570f889217aef",
        "type": "github"
      },
      "original": {
        "owner": "NixOS",
-        "ref": "release-23.11",
+        "ref": "release-22.11",
        "repo": "nixpkgs",
        "type": "github"
      }
    },
    "nixpkgs-unstable": {
      "locked": {
        "lastModified": 1712963716,
        "narHash": "sha256-WKm9CvgCldeIVvRz87iOMi8CFVB1apJlkUT4GGvA0iM=",
        "owner": "NixOS",
        "repo": "nixpkgs",
        "rev": "cfd6b5fc90b15709b780a5a1619695a88505a176",
        "type": "github"
      },
      "original": {
        "id": "nixpkgs",
        "ref": "nixos-unstable-small",
        "type": "indirect"
      }
    },
    "pvv-calendar-bot": {
      "inputs": {
        "nixpkgs": [
          "nixpkgs"
        ]
      },
      "locked": {
        "lastModified": 1693136143,
        "narHash": "sha256-amHprjftc3y/bg8yf4hITCLa+ez5HIi0yGfR7TU6UIc=",
        "ref": "refs/heads/main",
        "rev": "a32894b305f042d561500f5799226afd1faf5abb",
        "revCount": 9,
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Projects/calendar-bot.git"
      },
      "original": {
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Projects/calendar-bot.git"
      }
    },
    "root": {
      "inputs": {
        "disko": "disko",
        "grzegorz": "grzegorz",
        "grzegorz-clients": "grzegorz-clients",
        "matrix-next": "matrix-next",
        "nixpkgs": "nixpkgs",
-        "nixpkgs-unstable": "nixpkgs-unstable",
+        "sops-nix": "sops-nix",
-        "pvv-calendar-bot": "pvv-calendar-bot",
+        "unstable": "unstable"
        "sops-nix": "sops-nix"
      }
    },
    "sops-nix": {
@@ -179,11 +64,11 @@
        "nixpkgs-stable": "nixpkgs-stable"
      },
      "locked": {
-        "lastModified": 1709591996,
+        "lastModified": 1671472949,
-        "narHash": "sha256-0sQcalXSgqlO6mnxBTXkSQChBHy2GQsokB1XY8r+LpQ=",
+        "narHash": "sha256-9iHSGpljCX+RypahQssBXPwkru9onfKfceCTeVrMpH4=",
        "owner": "Mic92",
        "repo": "sops-nix",
-        "rev": "291aad29b59ceda517a06e59809f35cb0bb17c6b",
+        "rev": "32840f16ffa0856cdf9503a8658f2dd42bf70342",
        "type": "github"
      },
      "original": {
@@ -191,6 +76,22 @@
        "repo": "sops-nix",
        "type": "github"
      }
    },
    "unstable": {
      "locked": {
        "lastModified": 1671442489,
        "narHash": "sha256-pSCuSrG+XxWCs5IZ90eKIxDIZy4rM22YSFMRZ/fiixc=",
        "owner": "NixOS",
        "repo": "nixpkgs",
        "rev": "ff07b107adeda2164b29f8feb4a86ed012854dfb",
        "type": "github"
      },
      "original": {
        "owner": "NixOS",
        "ref": "nixos-unstable-small",
        "repo": "nixpkgs",
        "type": "github"
      }
    }
  },
  "root": "root",
--- a/flake.nix
+++ b/flake.nix
@@ -2,145 +2,47 @@
  description = "PVV System flake";
  inputs = {
-    nixpkgs.url = "nixpkgs/nixos-23.11-small";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-22.11-small";
-    nixpkgs-unstable.url = "nixpkgs/nixos-unstable-small";
+    unstable.url = "github:NixOS/nixpkgs/nixos-unstable-small";
    sops-nix.url = "github:Mic92/sops-nix";
    sops-nix.inputs.nixpkgs.follows = "nixpkgs";
-    disko.url = "github:nix-community/disko";
+    matrix-next.url = "github:dali99/nixos-matrix-modules/flake-experiments";
    disko.inputs.nixpkgs.follows = "nixpkgs";
    pvv-calendar-bot.url = "git+https://git.pvv.ntnu.no/Projects/calendar-bot.git";
    pvv-calendar-bot.inputs.nixpkgs.follows = "nixpkgs";
    matrix-next.url = "github:dali99/nixos-matrix-modules";
    grzegorz.url = "github:Programvareverkstedet/grzegorz";
    grzegorz.inputs.nixpkgs.follows = "nixpkgs-unstable";
    grzegorz-clients.url = "github:Programvareverkstedet/grzegorz-clients";
    grzegorz-clients.inputs.nixpkgs.follows = "nixpkgs";
  };
-  outputs = { self, nixpkgs, nixpkgs-unstable, sops-nix, disko, ... }@inputs:
+  outputs = { self, nixpkgs, unstable, sops-nix, ... }@inputs: 
  let
    nixlib = nixpkgs.lib;
    systems = [
      "x86_64-linux"
      "aarch64-linux"
      "aarch64-darwin"
    ];
    forAllSystems = f: nixlib.genAttrs systems (system: f system);
    allMachines = nixlib.mapAttrsToList (name: _: name) self.nixosConfigurations;
    importantMachines = [
      "bekkalokk"
      "bicep"
      "brzeczyszczykiewicz"
      "georg"
      "ildkule"
    ];
    forAllSystems = f: nixpkgs.lib.genAttrs systems (system: f system);
  in {
-    nixosConfigurations = let
+    nixosConfigurations = {
-      nixosConfig = nixpkgs: name: config: nixpkgs.lib.nixosSystem (nixpkgs.lib.recursiveUpdate
+      jokum = nixpkgs.lib.nixosSystem {
-        rec {
+        system = "x86_64-linux";
-          system = "x86_64-linux";
+        specialArgs = { inherit inputs; };
          specialArgs = {
            inherit nixpkgs-unstable inputs;
            values = import ./values.nix;
          };
          modules = [
            ./hosts/${name}/configuration.nix
            sops-nix.nixosModules.sops
          ];
          pkgs = import nixpkgs {
            inherit system;
            overlays = [
              inputs.pvv-calendar-bot.overlays.${system}.default
            ];
          };
        }
        config
      );
      stableNixosConfig = nixosConfig nixpkgs;
      unstableNixosConfig = nixosConfig nixpkgs-unstable;
    in {
      bicep = stableNixosConfig "bicep" {
        modules = [
-          ./hosts/bicep/configuration.nix
+          ./base.nix
          ./hosts/jokum/configuration.nix
          sops-nix.nixosModules.sops
-          inputs.matrix-next.nixosModules.default
+          inputs.matrix-next.nixosModules.synapse
          inputs.pvv-calendar-bot.nixosModules.default
        ];
      };
-      bekkalokk = stableNixosConfig "bekkalokk" { };
+      ildkule = nixpkgs.lib.nixosSystem {
-      bob = stableNixosConfig "bob" {
+        system = "x86_64-linux";
        specialArgs = { inherit inputs; };
        modules = [
-          ./hosts/bob/configuration.nix
+          ./base.nix
-          sops-nix.nixosModules.sops
+          ./hosts/ildkule/configuration.nix
          disko.nixosModules.disko
          { disko.devices.disk.disk1.device = "/dev/vda"; }
        ];
      };
      ildkule = stableNixosConfig "ildkule" { };
      #ildkule-unstable = unstableNixosConfig "ildkule" { };
      shark = stableNixosConfig "shark" { };
      brzeczyszczykiewicz = stableNixosConfig "brzeczyszczykiewicz" {
        modules = [
          ./hosts/brzeczyszczykiewicz/configuration.nix
          sops-nix.nixosModules.sops
          inputs.grzegorz.nixosModules.grzegorz-kiosk
          inputs.grzegorz-clients.nixosModules.grzegorz-webui
        ];
      };
      georg = stableNixosConfig "georg" {
        modules = [
          ./hosts/georg/configuration.nix
          sops-nix.nixosModules.sops
          inputs.grzegorz.nixosModules.grzegorz-kiosk
          inputs.grzegorz-clients.nixosModules.grzegorz-webui
        ];
      };
      buskerud = stableNixosConfig "buskerud" {
        modules = [
          ./hosts/buskerud/configuration.nix
          sops-nix.nixosModules.sops
        ];
      };
    };
    devShells = forAllSystems (system: {
      default = nixpkgs.legacyPackages.${system}.callPackage ./shell.nix { };
    });
    packages = {
      "x86_64-linux" = let
        pkgs = nixpkgs.legacyPackages."x86_64-linux";
        pkgs-unstable = nixpkgs-unstable.legacyPackages."x86_64-linux";
      in rec {
        default = important-machines;
        important-machines = pkgs.linkFarm "important-machines"
          (nixlib.getAttrs importantMachines self.packages.x86_64-linux);
        all-machines = pkgs.linkFarm "all-machines"
          (nixlib.getAttrs allMachines self.packages.x86_64-linux);
 	heimdal = pkgs.callPackage hosts/buskerud/containers/salsa/services/heimdal/package.nix {
          inherit (pkgs.apple_sdk.frameworks)
            CoreFoundation Security SystemConfiguration;
 	};
 	heimdal-unstable = pkgs-unstable.callPackage hosts/buskerud/containers/salsa/services/heimdal/package.nix {
          inherit (pkgs.apple_sdk.frameworks)
            CoreFoundation Security SystemConfiguration;
 	};
 	inherit pkgs pkgs-unstable;
      } // nixlib.genAttrs allMachines
        (machine: self.nixosConfigurations.${machine}.config.system.build.toplevel);
    };
  };
 }
--- a/hosts/bekkalokk/configuration.nix
+++ b/hosts/bekkalokk/configuration.nix
@@ -1,39 +0,0 @@
 { pkgs, values, ... }:
 {
  imports = [
    ./hardware-configuration.nix
    ../../base.nix
    ../../misc/metrics-exporters.nix
    #./services/keycloak.nix
    # TODO: set up authentication for the following:
    # ./services/website.nix
    ./services/nginx
    ./services/gitea/default.nix
    ./services/webmail
    # ./services/mediawiki.nix
  ];
  sops.defaultSopsFile = ../../secrets/bekkalokk/bekkalokk.yaml;
  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
  sops.age.generateKey = true;
  boot.loader.systemd-boot.enable = true;
  boot.loader.efi.canTouchEfiVariables = true;
  virtualisation.podman.enable = true;
  networking.hostName = "bekkalokk";
  systemd.network.networks."30-enp2s0" = values.defaultNetworkConfig // {
    matchConfig.Name = "enp2s0";
    address = with values.hosts.bekkalokk; [ (ipv4 + "/25") (ipv6 + "/64") ];
  };
  # Do not change, even during upgrades.
  # See https://search.nixos.org/options?show=system.stateVersion
  system.stateVersion = "22.11";
 }
--- a/hosts/bekkalokk/hardware-configuration.nix
+++ b/hosts/bekkalokk/hardware-configuration.nix
@@ -1,40 +0,0 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
 { config, lib, pkgs, modulesPath, ... }:
 {
  imports =
    [ (modulesPath + "/installer/scan/not-detected.nix")
    ];
  boot.initrd.availableKernelModules = [ "ehci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
  boot.initrd.kernelModules = [ ];
  boot.kernelModules = [ "kvm-intel" ];
  boot.extraModulePackages = [ ];
  fileSystems."/" =
    { device = "/dev/sda1";
      fsType = "btrfs";
    };
  fileSystems."/boot" =
    { device = "/dev/disk/by-uuid/CE63-3B9B";
      fsType = "vfat";
    };
  swapDevices =
    [ { device = "/dev/disk/by-uuid/2df10c7b-0dec-45c6-a728-533f7da7f4b9"; }
    ];
  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
  # (the default) this is the recommended approach. When using systemd-networkd it's
  # still possible to use this option, but it's recommended to use it in conjunction
  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
  networking.useDHCP = lib.mkDefault true;
  # networking.interfaces.eno1.useDHCP = lib.mkDefault true;
  # networking.interfaces.enp2s0.useDHCP = lib.mkDefault true;
  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }
--- a/hosts/bekkalokk/services/gitea/ci.nix
+++ b/hosts/bekkalokk/services/gitea/ci.nix
@@ -1,30 +0,0 @@
 { config, lib, values, ... }:
 let
  mkRunner = name: {
    # This is unfortunately state, and has to be generated one at a time :(
    # To do that, comment out all except one of the runners, fill in its token
    # inside the sops file, rebuild the system, and only after this runner has
    # successfully registered will gitea give you the next token.
    # - oysteikt Sep 2023
    sops.secrets."gitea/runners/${name}".restartUnits = [
      "gitea-runner-${name}.service"
    ];
    services.gitea-actions-runner.instances = {
      ${name} = {
        enable = true;
        name = "git-runner-${name}"; url = "https://git.pvv.ntnu.no";
        labels = [
 	  "debian-latest:docker://node:18-bullseye"
 	  "ubuntu-latest:docker://node:18-bullseye"
 	];
        tokenFile = config.sops.secrets."gitea/runners/${name}".path;
      };
    };
  };
 in
 lib.mkMerge [
  (mkRunner "alpha")
  (mkRunner "beta")
  (mkRunner "epsilon")
 ]
--- a/hosts/bekkalokk/services/gitea/default.nix
+++ b/hosts/bekkalokk/services/gitea/default.nix
@@ -1,105 +0,0 @@
 { config, values, pkgs, ... }:
 let
  cfg = config.services.gitea;
  domain = "git.pvv.ntnu.no";
  sshPort  = 2222;
 in {
  imports = [
    ./ci.nix
  ];
  sops.secrets = {
    "gitea/database" = {
      owner = "gitea";
      group = "gitea";
    };
    "gitea/passwd-ssh-key" = { };
    "gitea/ssh-known-hosts" = { };
    "gitea/import-user-env" = { };
  };
  services.gitea = {
    enable = true;
    stateDir = "/data/gitea";
    appName = "PVV Git";
    database = {
      type = "postgres";
      host = "postgres.pvv.ntnu.no";
      port = config.services.postgresql.port;
      passwordFile = config.sops.secrets."gitea/database".path;
      createDatabase = false;
    };
    settings = {
      server = {
        DOMAIN   = domain;
        ROOT_URL = "https://${domain}/";
        PROTOCOL = "http+unix";
        SSH_PORT = sshPort;
 	      START_SSH_SERVER = true;
      };
      indexer.REPO_INDEXER_ENABLED = true;
      service.DISABLE_REGISTRATION = true;
      session.COOKIE_SECURE = true;
      database.LOG_SQL = false;
      picture = {
        DISABLE_GRAVATAR = true;
        ENABLE_FEDERATED_AVATAR = false;
      };
      actions.ENABLED = true;
      "ui.meta".DESCRIPTION = "Bokstavelig talt programvareverkstedet";
    };
  };
  environment.systemPackages = [ cfg.package ];
  services.nginx.virtualHosts."${domain}" = {
    forceSSL = true;
    enableACME = true;
    locations."/" = {
      proxyPass = "http://unix:${cfg.settings.server.HTTP_ADDR}";
      recommendedProxySettings = true;
      extraConfig = ''
        client_max_body_size 512M;
      '';
    };
  };
  networking.firewall.allowedTCPPorts = [ sshPort ];
  # Automatically import users
  systemd.services.gitea-import-users = {
    enable = true;
    preStart=''${pkgs.rsync}/bin/rsync -e "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=$CREDENTIALS_DIRECTORY/ssh-known-hosts -i $CREDENTIALS_DIRECTORY/sshkey" -a pvv@smtp.pvv.ntnu.no:/etc/passwd /tmp/passwd-import'';
    serviceConfig = {
      ExecStart = pkgs.writers.writePython3 "gitea-import-users" { libraries = [ pkgs.python3Packages.requests ]; } (builtins.readFile ./gitea-import-users.py);
      LoadCredential=[
        "sshkey:${config.sops.secrets."gitea/passwd-ssh-key".path}"
        "ssh-known-hosts:${config.sops.secrets."gitea/ssh-known-hosts".path}"
      ];
      DynamicUser="yes";
      EnvironmentFile=config.sops.secrets."gitea/import-user-env".path;
    };
  };
  systemd.timers.gitea-import-users = {
    requires = [ "gitea.service" ];
    after = [ "gitea.service" ];
    wantedBy = [ "timers.target" ];
    timerConfig = {
      OnCalendar = "*-*-* 02:00:00";
      Persistent = true;
      Unit = "gitea-import-users.service";
    };
  };
  system.activationScripts.linkGiteaLogo.text = let
    logo-svg = ../../../../assets/logo_blue_regular.svg;
    logo-png = ../../../../assets/logo_blue_regular.png;
  in ''
    install -Dm444 ${logo-svg} ${cfg.stateDir}/custom/public/img/logo.svg
    install -Dm444 ${logo-png} ${cfg.stateDir}/custom/public/img/logo.png
    install -Dm444 ${./loading.apng} ${cfg.stateDir}/custom/public/img/loading.png
  '';
 }
--- a/hosts/bekkalokk/services/gitea/gitea-import-users.py
+++ b/hosts/bekkalokk/services/gitea/gitea-import-users.py
@@ -1,94 +0,0 @@
 import requests
 import secrets
 import os
 EMAIL_DOMAIN = os.getenv('EMAIL_DOMAIN')
 if EMAIL_DOMAIN is None:
    EMAIL_DOMAIN = 'pvv.ntnu.no'
 API_TOKEN = os.getenv('API_TOKEN')
 if API_TOKEN is None:
    raise Exception('API_TOKEN not set')
 GITEA_API_URL = os.getenv('GITEA_API_URL')
 if GITEA_API_URL is None:
    GITEA_API_URL = 'https://git.pvv.ntnu.no/api/v1'
 BANNED_SHELLS = [
    "/usr/bin/nologin",
    "/usr/sbin/nologin",
    "/sbin/nologin",
    "/bin/false",
    "/bin/msgsh",
 ]
 existing_users = {}
 # This function should only ever be called when adding users
 # from the passwd file
 def add_user(username, name):
    user = {
            "full_name": name,
            "username": username,
            "login_name": username,
            "visibility": "public",
            "source_id": 1,  # 1 = SMTP
    }
    if username not in existing_users:
        user["password"] = secrets.token_urlsafe(32)
        user["must_change_password"] = False
        user["visibility"] = "private"
        user["email"] = username + '@' + EMAIL_DOMAIN
        r = requests.post(GITEA_API_URL + '/admin/users', json=user,
                          headers={'Authorization': 'token ' + API_TOKEN})
        if r.status_code != 201:
            print('ERR: Failed to create user ' + username + ': ' + r.text)
            return
        print('Created user ' + username)
        existing_users[username] = user
    else:
        r = requests.patch(GITEA_API_URL + f'/admin/users/{username}',
                           json=user,
                           headers={'Authorization': 'token ' + API_TOKEN})
        if r.status_code != 200:
            print('ERR: Failed to update user ' + username + ': ' + r.text)
            return
        print('Updated user ' + username)
 def main():
    # Fetch existing users
    r = requests.get(GITEA_API_URL + '/admin/users',
                     headers={'Authorization': 'token ' + API_TOKEN})
    if r.status_code != 200:
        raise Exception('Failed to get users: ' + r.text)
    for user in r.json():
        existing_users[user['login']] = user
    # Read the file, add each user
    with open("/tmp/passwd-import", 'r') as f:
        for line in f.readlines():
            uid = int(line.split(':')[2])
            if uid < 1000:
                continue
            shell = line.split(':')[-1]
            if shell in BANNED_SHELLS:
                continue
            username = line.split(':')[0]
            name = line.split(':')[4].split(',')[0]
            add_user(username, name)
 if __name__ == '__main__':
    main()
--- a/hosts/bekkalokk/services/gitea/loading.apng
+++ b/hosts/bekkalokk/services/gitea/loading.apng
--- a/hosts/bekkalokk/services/keycloak.nix
+++ b/hosts/bekkalokk/services/keycloak.nix
@@ -1,24 +0,0 @@
 { pkgs, config, values, ... }:
 {
  sops.secrets."keys/postgres/keycloak" = {
    owner = "keycloak";
    group = "keycloak";
    restartUnits = [ "keycloak.service" ];
  };
  services.keycloak = {
    enable = true;
    settings = {
      hostname = "auth.pvv.ntnu.no";
      # hostname-strict-backchannel = true;
    };
    database = {
      host = values.hosts.bicep.ipv4;
      createLocally = false;
      passwordFile = config.sops.secrets."keys/postgres/keycloak".path;
      caCert = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
    };
  };
 }
--- a/hosts/bekkalokk/services/mediawiki.nix
+++ b/hosts/bekkalokk/services/mediawiki.nix
@@ -1,175 +0,0 @@
 { pkgs, lib, config, values, ... }: let
  cfg = config.services.mediawiki;
  # "mediawiki"
  user = config.systemd.services.mediawiki-init.serviceConfig.User;
  # "mediawiki"
  group = config.users.users.${user}.group;
 in {
  sops.secrets = {
    "mediawiki/password" = {
      restartUnits = [ "mediawiki-init.service" "phpfpm-mediawiki.service" ];
      owner = user;
      group = group;
    };
    "keys/postgres/mediawiki" = {
      restartUnits = [ "mediawiki-init.service" "phpfpm-mediawiki.service" ];
      owner = user;
      group = group;
    };
  };
  services.mediawiki = {
    enable = true;
    name = "Programvareverkstedet";
    passwordFile = config.sops.secrets."mediawiki/password".path;
    passwordSender = "drift@pvv.ntnu.no";
    database = {
      type = "postgres";
      host = "postgres.pvv.ntnu.no";
      port = config.services.postgresql.port;
      passwordFile = config.sops.secrets."keys/postgres/mediawiki".path;
      createLocally = false;
      # TODO: create a normal database and copy over old data when the service is production ready
      name = "mediawiki_test";
    };
    # Host through nginx
    webserver = "none";
    poolConfig = let
      listenUser = config.services.nginx.user;
      listenGroup = config.services.nginx.group;
    in {
      inherit user group;
      "pm" = "dynamic";
      "pm.max_children" = 32;
      "pm.max_requests" = 500;
      "pm.start_servers" = 2;
      "pm.min_spare_servers" = 2;
      "pm.max_spare_servers" = 4;
      "listen.owner" = listenUser;
      "listen.group" = listenGroup;
      "php_admin_value[error_log]" = "stderr";
      "php_admin_flag[log_errors]" = "on";
      "env[PATH]" = lib.makeBinPath [ pkgs.php ];
      "catch_workers_output" = true;
      # to accept *.html file
      "security.limit_extensions" = "";
    };
    extensions = {
      DeleteBatch = pkgs.fetchzip {
        url = "https://extdist.wmflabs.org/dist/extensions/DeleteBatch-REL1_39-995ea6f.tar.gz";
 	sha256 = "sha256-0F4GLCy2f5WcWIY2YgF1tVxgYbglR0VOsj/pMrW93b8=";
      };
      UserMerge = pkgs.fetchzip {
        url = "https://extdist.wmflabs.org/dist/extensions/UserMerge-REL1_39-b10d50e.tar.gz";
 	sha256 = "sha256-bXhj1+OlOUJDbvEuc8iwqb1LLEu6cN6+C/7cAvnWPOQ=";
      };
      PluggableAuth = pkgs.fetchzip {
        url = "https://extdist.wmflabs.org/dist/extensions/PluggableAuth-REL1_39-1210fc3.tar.gz";
 	sha256 = "sha256-F6bTMCzkK3kZwZGIsNE87WlZWqXXmTMhEjApO99YKR0=";
      };
      SimpleSAMLphp = pkgs.fetchzip {
        url = "https://extdist.wmflabs.org/dist/extensions/SimpleSAMLphp-REL1_39-dcf0acb.tar.gz";
        sha256 = "sha256-tCvFmb2+q2rxms+lRo5pgoI3h6GjCwXAR8XisPg03TQ=";
      };
    };
    extraConfig = let
      SimpleSAMLphpRepo = pkgs.stdenvNoCC.mkDerivation rec {
        pname = "configuredSimpleSAML";
 	version = "2.0.4";
        src = pkgs.fetchzip {
          url = "https://github.com/simplesamlphp/simplesamlphp/releases/download/v${version}/simplesamlphp-${version}.tar.gz";
          sha256 = "sha256-pfMV/VmqqxgtG7Nx4s8MW4tWSaxOkVPtCRJwxV6RDSE=";
        };
 	buildPhase = ''
          cat > config/authsources.php << EOF
          <?php
          $config = array(
            'default-sp' => array(
              'saml:SP',
              'idp' => 'https://idp.pvv.ntnu.no/',
            ),
          );
 	  EOF
 	'';
 	installPhase = ''
 	  cp -r . $out
 	'';
      };
    in ''
      $wgServer = "https://bekkalokk.pvv.ntnu.no";
      $wgLocaltimezone = "Europe/Oslo";
      # Only allow login through SSO
      $wgEnableEmail = false;
      $wgEnableUserEmail = false;
      $wgEmailAuthentication = false;
      $wgGroupPermissions['*']['createaccount'] = false;
      $wgGroupPermissions['*']['autocreateaccount'] = true;
      $wgPluggableAuth_EnableAutoLogin = true;
      # Disable anonymous editing
      $wgGroupPermissions['*']['edit'] = false;
      # Styling
      $wgLogo = "/PNG/PVV-logo.png";
      $wgDefaultSkin = "monobook";
      # Misc
      $wgEmergencyContact = "${cfg.passwordSender}";
      $wgShowIPinHeader = false;
      $wgUseTeX = false;
      $wgLocalInterwiki = $wgSitename;
      # SimpleSAML
      $wgSimpleSAMLphp_InstallDir = "${SimpleSAMLphpRepo}";
      $wgSimpleSAMLphp_AuthSourceId = "default-sp";
      $wgSimpleSAMLphp_RealNameAttribute = "cn";
      $wgSimpleSAMLphp_EmailAttribute = "mail";
      $wgSimpleSAMLphp_UsernameAttribute = "uid";
      # Fix https://github.com/NixOS/nixpkgs/issues/183097
      $wgDBserver = "${toString cfg.database.host}";
    '';
  };
  # Override because of https://github.com/NixOS/nixpkgs/issues/183097
  systemd.services.mediawiki-init.script = let
    # According to module
    stateDir = "/var/lib/mediawiki";
    pkg = cfg.finalPackage;
    mediawikiConfig = config.services.phpfpm.pools.mediawiki.phpEnv.MEDIAWIKI_CONFIG;
    inherit (lib) optionalString mkForce;
  in mkForce ''
    if ! test -e "${stateDir}/secret.key"; then
      tr -dc A-Za-z0-9 </dev/urandom 2>/dev/null | head -c 64 > ${stateDir}/secret.key
    fi
    echo "exit( wfGetDB( DB_MASTER )->tableExists( 'user' ) ? 1 : 0 );" | \
    ${pkgs.php}/bin/php ${pkg}/share/mediawiki/maintenance/eval.php --conf ${mediawikiConfig} && \
    ${pkgs.php}/bin/php ${pkg}/share/mediawiki/maintenance/install.php \
      --confpath /tmp \
      --scriptpath / \
      --dbserver "${cfg.database.host}" \
      --dbport ${toString cfg.database.port} \
      --dbname ${cfg.database.name} \
      ${optionalString (cfg.database.tablePrefix != null) "--dbprefix ${cfg.database.tablePrefix}"} \
      --dbuser ${cfg.database.user} \
      ${optionalString (cfg.database.passwordFile != null) "--dbpassfile ${cfg.database.passwordFile}"} \
      --passfile ${cfg.passwordFile} \
      --dbtype ${cfg.database.type} \
      ${cfg.name} \
      admin
    ${pkgs.php}/bin/php ${pkg}/share/mediawiki/maintenance/update.php --conf ${mediawikiConfig} --quick
  '';
 }
--- a/hosts/bekkalokk/services/metrics/loki.nix
+++ b/hosts/bekkalokk/services/metrics/loki.nix
@@ -1,4 +0,0 @@
 { ... }:
 {
 }
--- a/hosts/bekkalokk/services/metrics/prometheus.nix
+++ b/hosts/bekkalokk/services/metrics/prometheus.nix
@@ -1,4 +0,0 @@
 { ... }:
 {
 }
--- a/hosts/bekkalokk/services/nginx/ingress.nix
+++ b/hosts/bekkalokk/services/nginx/ingress.nix
@@ -1,55 +0,0 @@
 { config, lib, ... }:
 {
  services.nginx.virtualHosts = {
    "www2.pvv.ntnu.no" = {
      serverAliases = [ "www2.pvv.org" "pvv.ntnu.no" "pvv.org" ];
      addSSL = true;
      enableACME = true;
      locations = {
        # Proxy home directories
        "/~" = {
          extraConfig = ''
            proxy_redirect off;
            proxy_pass https://tom.pvv.ntnu.no;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
          '';
        };
        # Redirect old wiki entries
        "/disk".return = "301 https://www.pvv.ntnu.no/pvv/Diskkjøp";
        "/dok/boker.php".return = "301 https://www.pvv.ntnu.no/pvv/Bokhyllen";
        "/styret/lover/".return = "301 https://www.pvv.ntnu.no/pvv/Lover";
        "/styret/".return = "301 https://www.pvv.ntnu.no/pvv/Styret";
        "/info/".return = "301 https://www.pvv.ntnu.no/pvv/";
        "/info/maskinpark/".return = "301 https://www.pvv.ntnu.no/pvv/Maskiner";
        "/medlemssider/meldinn.php".return = "301 https://www.pvv.ntnu.no/pvv/Medlemskontingent";
        "/diverse/medlems-sider.php".return = "301 https://www.pvv.ntnu.no/pvv/Medlemssider";
        "/cert/".return = "301 https://www.pvv.ntnu.no/pvv/CERT";
        "/drift".return = "301 https://www.pvv.ntnu.no/pvv/Drift";
        "/diverse/abuse.php".return = "301 https://www.pvv.ntnu.no/pvv/CERT/Abuse";
        "/nerds/".return = "301 https://www.pvv.ntnu.no/pvv/Nerdepizza";
        # TODO: Redirect webmail
        "/webmail".return = "301 https://webmail.pvv.ntnu.no/squirrelmail";
        # Redirect everything else to the main website
        "/".return = "301 https://www.pvv.ntnu.no$request_uri";
        # Proxy the matrix well-known files
        # Host has be set before proxy_pass
        # The header must be set so nginx on the other side routes it to the right place
        "/.well-known/matrix/" = {
          extraConfig = ''
            proxy_set_header Host matrix.pvv.ntnu.no;
            proxy_pass https://matrix.pvv.ntnu.no/.well-known/matrix/;
          '';
        };
      };
    };
  };
 }
--- a/hosts/bekkalokk/services/webmail/default.nix
+++ b/hosts/bekkalokk/services/webmail/default.nix
@@ -1,15 +0,0 @@
 { config, values, pkgs, lib, ... }:
 {
  imports = [
    ./roundcube.nix
  ];
  services.nginx.virtualHosts."webmail2.pvv.ntnu.no" = {
    forceSSL = true;
    enableACME = true;
    #locations."/" = lib.mkForce { };
    locations."= /" = {
      return = "301 https://www.pvv.ntnu.no/mail/";
    };
  };
 }
--- a/hosts/bekkalokk/services/webmail/roundcube.nix
+++ b/hosts/bekkalokk/services/webmail/roundcube.nix
@@ -1,74 +0,0 @@
 { config, pkgs, lib, ... }:
 with lib;
 let
  cfg = config.services.roundcube;
  domain = "webmail2.pvv.ntnu.no";
 in 
 {
  services.roundcube = {
    enable = true;
    package = pkgs.roundcube.withPlugins (plugins: with plugins; [
      persistent_login
      thunderbird_labels
      contextmenu
      custom_from
    ]);
    dicts = with pkgs.aspellDicts; [ en en-science en-computers nb nn fr de it ];
    maxAttachmentSize = 20;
    hostName = "roundcubeplaceholder.example.com";
    extraConfig = ''
      $config['enable_installer'] = false;
      $config['default_host'] = "ssl://imap.pvv.ntnu.no";
      $config['default_port'] = 993;
      $config['smtp_server'] = "ssl://smtp.pvv.ntnu.no";
      $config['smtp_port'] = 465;
      $config['mail_domain'] = "pvv.ntnu.no";
      $config['smtp_user'] = "%u";
      $config['support_url'] = "";
    '';
  };
  services.nginx.virtualHosts."roundcubeplaceholder.example.com" = lib.mkForce { };
  services.nginx.virtualHosts.${domain} = {
    locations."/roundcube" = {
      tryFiles = "$uri $uri/ =404";
      index = "index.php";
      root = pkgs.runCommandLocal "roundcube-dir" { } ''
        mkdir -p $out
        ln -s ${cfg.package} $out/roundcube
      '';
      extraConfig = ''
        location ~ ^/roundcube/(${builtins.concatStringsSep "|" [
        # https://wiki.archlinux.org/title/Roundcube
        "README"
        "INSTALL"
        "LICENSE"
        "CHANGELOG"
        "UPGRADING"
        "bin"
        "SQL"
        ".+\\.md"
        "\\."
        "config"
        "temp"
        "logs"
        ]})/? {
          deny all;
        }
        location ~ ^/roundcube/(.+\.php)(/?.*)$ {
          fastcgi_split_path_info ^/roundcube(/.+\.php)(/.+)$;
          include ${config.services.nginx.package}/conf/fastcgi_params;
          include ${config.services.nginx.package}/conf/fastcgi.conf;
          fastcgi_index index.php;
          fastcgi_pass unix:${config.services.phpfpm.pools.roundcube.socket};
        }
      '';
    };
  };
 }
--- a/hosts/bekkalokk/services/website.nix
+++ b/hosts/bekkalokk/services/website.nix
@@ -1,4 +0,0 @@
 { ... }:
 {
 }
--- a/hosts/bicep/acmeCert.nix
+++ b/hosts/bicep/acmeCert.nix
@@ -1,24 +0,0 @@
 { values, ... }:
 {
  users.groups.acme.members = [ "nginx" ];
  security.acme.certs."postgres.pvv.ntnu.no" = {
    group = "acme";
    extraDomainNames = [
      # "postgres.pvv.org"
      "bicep.pvv.ntnu.no"
      # "bicep.pvv.org"
      # values.hosts.bicep.ipv4
      # values.hosts.bicep.ipv6
    ];
  };
  services.nginx = {
    enable = true;
    virtualHosts."postgres.pvv.ntnu.no" = {
      forceSSL = true;
      enableACME = true;
      # useACMEHost = "postgres.pvv.ntnu.no";
    };
  };
 }
--- a/hosts/bicep/configuration.nix
+++ b/hosts/bicep/configuration.nix
@@ -1,43 +0,0 @@
 { pkgs, values, ... }:
 {
  imports = [
    ./hardware-configuration.nix
    ../../base.nix
    ../../misc/metrics-exporters.nix
    ./services/nginx
    ./acmeCert.nix
    ./services/mysql.nix
    ./services/postgres.nix
    ./services/mysql.nix
    # TODO: fix the calendar bot
    # ./services/calendar-bot.nix
    ./services/matrix
  ];
  sops.defaultSopsFile = ../../secrets/bicep/bicep.yaml;
  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
  sops.age.generateKey = true;
  boot.loader.grub.enable = true;
  boot.loader.grub.device = "/dev/disk/by-id/scsi-3600508b1001cb1a8751c137b30610682";
  networking.hostName = "bicep";
  systemd.network.networks."30-enp6s0f0" = values.defaultNetworkConfig // {
    matchConfig.Name = "enp6s0f0";
    address = with values.hosts.bicep; [ (ipv4 + "/25") (ipv6 + "/64") ]
      ++ (with values.services.turn; [ (ipv4 + "/25") (ipv6 + "/64") ]);
  };
  systemd.network.wait-online = {
    anyInterface = true;
  };
  # Do not change, even during upgrades.
  # See https://search.nixos.org/options?show=system.stateVersion
  system.stateVersion = "22.11";
 }
--- a/hosts/bicep/hardware-configuration.nix
+++ b/hosts/bicep/hardware-configuration.nix
@@ -1,40 +0,0 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
 { config, lib, pkgs, modulesPath, ... }:
 {
  imports =
    [ (modulesPath + "/installer/scan/not-detected.nix")
    ];
  boot.initrd.availableKernelModules = [ "uhci_hcd" "ehci_pci" "hpsa" "ohci_pci" "usbhid" "sd_mod" ];
  boot.initrd.kernelModules = [ ];
  boot.kernelModules = [ "kvm-intel" ];
  boot.extraModulePackages = [ ];
  fileSystems."/" =
    { device = "/dev/disk/by-uuid/31a67903-dc00-448a-a24a-36e820318fe5";
      fsType = "ext4";
    };
  fileSystems."/data" =
    { device = "/dev/disk/by-uuid/79e93eed-ad95-45c9-b115-4ef92afcc8c0";
      fsType = "f2fs";
    };
  swapDevices = [ ];
  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
  # (the default) this is the recommended approach. When using systemd-networkd it's
  # still possible to use this option, but it's recommended to use it in conjunction
  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
  networking.useDHCP = lib.mkDefault true;
  # networking.interfaces.enp6s0f0.useDHCP = lib.mkDefault true;
  # networking.interfaces.enp6s0f1.useDHCP = lib.mkDefault true;
  # networking.interfaces.enp6s0f2.useDHCP = lib.mkDefault true;
  # networking.interfaces.enp6s0f3.useDHCP = lib.mkDefault true;
  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }
--- a/hosts/bicep/services/calendar-bot.nix
+++ b/hosts/bicep/services/calendar-bot.nix
@@ -1,25 +0,0 @@
 { config, lib, pkgs, ... }:
 let
  cfg = config.services.pvv-calendar-bot;
 in {
  sops.secrets."calendar-bot/matrix_token" = {
    sopsFile = ../../../secrets/bicep/bicep.yaml;
    key = "calendar-bot/matrix_token";
    owner = cfg.user;
    group = cfg.group;
  };
  services.pvv-calendar-bot = {
    enable = true;
    settings = {
      matrix = {
        homeserver = "https://matrix.pvv.ntnu.no";
        user = "@bot_calendar:pvv.ntnu.no";
        channel = "!gkNLUIhYVpEyLatcRz:pvv.ntnu.no";
      };
      secretsFile = config.sops.secrets."calendar-bot/matrix_token".path;
      onCalendar = "*-*-* 09:00:00";
    };
  };
 }
--- a/hosts/bicep/services/matrix/mjolnir.nix
+++ b/hosts/bicep/services/matrix/mjolnir.nix
@@ -1,56 +0,0 @@
 { config, lib, ... }:
 {
  sops.secrets."matrix/mjolnir/access_token" = {
    sopsFile = ../../../../secrets/bicep/matrix.yaml;
    key = "mjolnir/access_token";
    owner = config.users.users.mjolnir.name;
    group = config.users.users.mjolnir.group;
  };
  services.mjolnir = {
    enable = true;
    pantalaimon.enable = false;
    homeserverUrl = http://127.0.0.1:8008;
    accessTokenFile = config.sops.secrets."matrix/mjolnir/access_token".path;
    managementRoom = "!gsdeCoWjvYRBrzuiRq:pvv.ntnu.no";
    protectedRooms = map (a: "https://matrix.to/#/${a}") [
      "#pvv:pvv.ntnu.no"
      "#stand:pvv.ntnu.no"
      "#music:pvv.ntnu.no"
      "#arts-and-crafts:pvv.ntnu.no"
      "#programming:pvv.ntnu.no"
      "#talks-and-texts:pvv.ntnu.no"
      "#job-offers:pvv.ntnu.no"
      "#vaffling:pvv.ntnu.no"
      "#pvv-fadder:pvv.ntnu.no"
      "#offsite:pvv.ntnu.no"
      "#help:pvv.ntnu.no"
      "#garniske-algoritmer:pvv.ntnu.no"
      "#bouldering:pvv.ntnu.no"
      "#filmclub:pvv.ntnu.no"
      "#video-games:pvv.ntnu.no"
      "#board-games:pvv.ntnu.no"
      "#tabletop-rpgs:pvv.ntnu.no"
      "#anime:pvv.ntnu.no"
      "#general:pvv.ntnu.no"
      "#announcements:pvv.ntnu.no"
      "#memes:pvv.ntnu.no"
      "#drift:pvv.ntnu.no"
      "#notifikasjoner:pvv.ntnu.no"
      "#forespoersler:pvv.ntnu.no"
      "#krisekanalen:pvv.ntnu.no"
      "#styret:pvv.ntnu.no"
    ];
    settings = {
      admin.enableMakeRoomAdminCommand = true;
    };
    # Module wants it even when not using pantalaimon
    # TODO: Fix upstream module in nixpkgs
    pantalaimon.username = "bot_admin";
  };
 }
--- a/hosts/bicep/services/matrix/smtp-authenticator/default.nix
+++ b/hosts/bicep/services/matrix/smtp-authenticator/default.nix
@@ -1,17 +0,0 @@
 { lib, buildPythonPackage, fetchFromGitHub }:
 buildPythonPackage rec {
  pname = "matrix-synapse-smtp-auth";
  version = "0.1.0";
  src = ./.;
  doCheck = false;
  meta = with lib; {
    description = "An SMTP auth provider for Synapse";
    homepage = "pvv.ntnu.no";
    license = licenses.agpl3Only;
    maintainers = with maintainers; [ dandellion ];
  };
 }
--- a/hosts/bicep/services/matrix/smtp-authenticator/setup.py
+++ b/hosts/bicep/services/matrix/smtp-authenticator/setup.py
@@ -1,11 +0,0 @@
 from setuptools import setup
 setup(
    name="matrix-synapse-smtp-auth",
    version="0.1.0",
    py_modules=['smtp_auth_provider'],
    author="Daniel Løvbrøtte Olsen",
    author_email="danio@pvv.ntnu.no",
    description="An SMTP auth provider for Synapse",
    license="AGPL-3.0-only"
 )
--- a/hosts/bicep/services/matrix/smtp-authenticator/smtp_auth_provider.py
+++ b/hosts/bicep/services/matrix/smtp-authenticator/smtp_auth_provider.py
@@ -1,50 +0,0 @@
 from typing import Awaitable, Callable, Optional, Tuple
 from smtplib import SMTP_SSL as SMTP
 import synapse
 from synapse import module_api
 import re
 class SMTPAuthProvider:
    def __init__(self, config: dict, api: module_api):
        self.api = api
        self.config = config
        api.register_password_auth_provider_callbacks(
            auth_checkers={
                ("m.login.password", ("password",)): self.check_pass,
            },
        )
    async def check_pass(
        self,
        username: str,
        login_type: str,
        login_dict: "synapse.module_api.JsonDict",
    ):
        if login_type != "m.login.password":
            return None
        # Convert `@username:server` to `username`
        match = re.match(r'^@([\da-z\-\.=_\/\+]+):[\w\d\.:\[\]]+$', username)
        username = match.group(1) if match else username
        result = False
        with SMTP(self.config["smtp_host"]) as smtp:
            password = login_dict.get("password")
            try:
                smtp.login(username, password)
                result = True
            except:
                return None
        if result == True:
            userid = self.api.get_qualified_user_id(username)
            if not self.api.check_user_exists(userid):
                self.api.register_user(username)
            return (userid, None)
        else:
            return None
--- a/hosts/bicep/services/mysql.nix
+++ b/hosts/bicep/services/mysql.nix
@@ -1,53 +0,0 @@
 { pkgs, lib, config, values, ... }:
 {
  sops.secrets."mysql/password" = {
    owner = "mysql";
    group = "mysql";
  };
  users.mysql.passwordFile = config.sops.secrets."mysql/password".path;
  services.mysql = {
    enable = true;
    dataDir = "/data/mysql";
    package = pkgs.mariadb;
    settings = {
      mysqld = {
        # PVV allows a lot of connections at the same time
        max_connect_errors = 10000;
 	bind-address = values.services.mysql.ipv4;
 	skip-networking = 0;
 	# This was needed in order to be able to use all of the old users
 	# during migration from knakelibrak to bicep in Sep. 2023
 	secure_auth = 0;
      };
    };
    # Note: This user also has MAX_USER_CONNECTIONS set to 3, and
    #       a password which can be found in /secrets/ildkule/ildkule.yaml
    #       We have also changed both the host and auth plugin of this user
    #       to be 'ildkule.pvv.ntnu.no' and 'mysql_native_password' respectively.
    ensureUsers = [{
      name = "prometheus_mysqld_exporter";
      ensurePermissions = {
        "*.*" = "PROCESS, REPLICATION CLIENT, SELECT, SLAVE MONITOR";
      };
    }];
  };
  services.mysqlBackup = {
    enable = true;
    location = "/var/lib/mysql/backups";
  };
  networking.firewall.allowedTCPPorts = [ 3306 ];
  systemd.services.mysql.serviceConfig = {
    IPAddressDeny = "any";
    IPAddressAllow = [
      values.ipv4-space
      values.ipv6-space
    ];
  };
 }
--- a/hosts/bicep/services/nginx/default.nix
+++ b/hosts/bicep/services/nginx/default.nix
@@ -1,45 +0,0 @@
 { config, values, ... }:
 {
  security.acme = {
    acceptTerms = true;
    defaults.email = "danio@pvv.ntnu.no";
  };
  services.nginx = {
    enable = true;
    enableReload = true;
    defaultListenAddresses = [
      values.hosts.bicep.ipv4
      "[${values.hosts.bicep.ipv6}]"
      "127.0.0.1"
      "127.0.0.2"
      "[::1]"
    ];
    appendConfig = ''
      pcre_jit on;
      worker_processes 8;
      worker_rlimit_nofile 8192;
    '';
    eventsConfig = ''
      multi_accept on;
      worker_connections 4096;
    '';
    recommendedProxySettings = true;
    recommendedTlsSettings = true;
    recommendedGzipSettings = true;
    recommendedBrotliSettings = true;
    recommendedOptimisation = true;
  };
  networking.firewall.allowedTCPPorts = [ 80 443 ];
  systemd.services.nginx.serviceConfig = {
    LimitNOFILE = 65536;
  };
 }
--- a/hosts/bicep/services/postgres.nix
+++ b/hosts/bicep/services/postgres.nix
@@ -1,97 +0,0 @@
 { config, pkgs, ... }:
 let
  sslCert = config.security.acme.certs."postgres.pvv.ntnu.no";
 in
 {
  services.postgresql = {
    enable = true;
    package = pkgs.postgresql_15;
    enableTCPIP = true;
    dataDir = "/data/postgresql";
    authentication = ''
      host all all 129.241.210.128/25 md5
      host all all 2001:700:300:1900::/64 md5
    '';
    # Hilsen https://pgconfigurator.cybertec-postgresql.com/
    settings = {
      # Connectivity
      max_connections = 500;
      superuser_reserved_connections = 3;
      # Memory Settings
      shared_buffers = "8192 MB";
      work_mem = "32 MB";
      maintenance_work_mem = "420 MB";
      effective_cache_size = "22 GB";
      effective_io_concurrency = 100;
      random_page_cost = 1.25;
      # Monitoring
      shared_preload_libraries = "pg_stat_statements";
      track_io_timing = true;
      track_functions = "pl";
      # Replication
      wal_level = "replica";
      max_wal_senders = 0;
      synchronous_commit = false;
      # Checkpointing:
      checkpoint_timeout = "15 min";
      checkpoint_completion_target = 0.9;
      max_wal_size = "1024 MB";
      min_wal_size = "512 MB";
      # WAL writing
      wal_compression = true;
      wal_buffers = -1;
      # Background writer
      bgwriter_delay = "200ms";
      bgwriter_lru_maxpages = 100;
      bgwriter_lru_multiplier = 2.0;
      bgwriter_flush_after = 0;
      # Parallel queries:
      max_worker_processes = 8;
      max_parallel_workers_per_gather = 4;
      max_parallel_maintenance_workers = 4;
      max_parallel_workers = 8;
      parallel_leader_participation = true;
      # Advanced features
      enable_partitionwise_join = true;
      enable_partitionwise_aggregate = true;
      max_slot_wal_keep_size = "1000 MB";
      track_wal_io_timing = true;
      maintenance_io_concurrency = 100;
      wal_recycle = true;
      # SSL
      ssl = true;
      ssl_cert_file = "/run/credentials/postgresql.service/cert";
      ssl_key_file = "/run/credentials/postgresql.service/key";
    };
  };
  systemd.services.postgresql.serviceConfig = {
    LoadCredential = [
      "cert:${sslCert.directory}/cert.pem"
      "key:${sslCert.directory}/key.pem"
    ];
  };
  users.groups.acme.members = [ "postgres" ];
  networking.firewall.allowedTCPPorts = [ 5432 ];
  networking.firewall.allowedUDPPorts = [ 5432 ];
  services.postgresqlBackup = {
    enable = true;
    location = "/var/lib/postgres/backups";
    backupAll = true;
  };
 }
--- a/hosts/bikkje/configuration.nix
+++ b/hosts/bikkje/configuration.nix
@@ -1,44 +0,0 @@
 { config, pkgs, values, ... }:
 {
    networking.nat = {
    enable = true;
    internalInterfaces = ["ve-+"];
    externalInterface = "ens3";
    # Lazy IPv6 connectivity for the container
    enableIPv6 = true;
  };
  containers.bikkje = {
    autoStart = true;
    config = { config, pkgs, ... }: {
      #import packages
      packages = with pkgs; [
          alpine
          mutt
          mutt-ics
          mutt-wizard
          weechat
          weechatScripts.edit
          hexchat
          irssi
          pidgin
      ];
      networking = {
        firewall = {
          enable = true;
          # Allow SSH and HTTP and ports for email and irc
          allowedTCPPorts = [ 80 22 194 994 6665 6666 6667 6668 6669 6697 995 993 25 465 587 110 143 993 995 ];
          allowedUDPPorts = [ 80 22 194 994 6665 6666 6667 6668 6669 6697 995 993 25 465 587 110 143 993 995 ];
        };
        # Use systemd-resolved inside the container
        # Workaround for bug https://github.com/NixOS/nixpkgs/issues/162686
        useHostResolvConf = mkForce false;
      };
      system.stateVersion = "23.11";
      services.resolved.enable = true;
    };
  };
 };
--- a/hosts/bob/configuration.nix
+++ b/hosts/bob/configuration.nix
@@ -1,46 +0,0 @@
 { config, pkgs, values, ... }:
 {
  imports = [
      # Include the results of the hardware scan.
      ./hardware-configuration.nix
      ../../base.nix
      ../../misc/metrics-exporters.nix
      ./disks.nix
      ../../misc/builder.nix
    ];
  sops.defaultSopsFile = ../../secrets/bob/bob.yaml;
  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
  sops.age.generateKey = true;
  boot.loader.grub = {
    enable = true;
    efiSupport = true;
    efiInstallAsRemovable = true;
  };
  networking.hostName = "bob"; # Define your hostname.
  systemd.network.networks."30-all" = values.defaultNetworkConfig // {
    matchConfig.Name = "en*";
    DHCP = "yes";
    gateway = [ ];
  };
  # List packages installed in system profile
  environment.systemPackages = with pkgs; [
  ];
  # List services that you want to enable:
  # This value determines the NixOS release from which the default
  # settings for stateful data, like file locations and database versions
  # on your system were taken. It‘s perfectly fine and recommended to leave
  # this value at the release version of the first install of this system.
  # Before changing this value read the documentation for this option
  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
  system.stateVersion = "23.05"; # Did you read the comment?
 }
--- a/hosts/bob/disks.nix
+++ b/hosts/bob/disks.nix
@@ -1,39 +0,0 @@
 # Example to create a bios compatible gpt partition
 { lib, ... }:
 {
  disko.devices = {
    disk.disk1 = {
      device = lib.mkDefault "/dev/sda";
      type = "disk";
      content = {
        type = "gpt";
        partitions = {
          boot = {
            name = "boot";
            size = "1M";
            type = "EF02";
          };
          esp = {
            name = "ESP";
            size = "500M";
            type = "EF00";
            content = {
              type = "filesystem";
              format = "vfat";
              mountpoint = "/boot";
            };
          };
          root = {
            name = "root";
            size = "100%";
            content = {
              type = "filesystem";
              format = "ext4";
              mountpoint = "/";
            };
          };
        };
      };
    };
  };
 }
--- a/hosts/bob/hardware-configuration.nix
+++ b/hosts/bob/hardware-configuration.nix
@@ -1,24 +0,0 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
 { config, lib, pkgs, modulesPath, ... }:
 {
  imports =
    [ (modulesPath + "/profiles/qemu-guest.nix")
    ];
  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_blk" ];
  boot.initrd.kernelModules = [ ];
  boot.kernelModules = [ ];
  boot.extraModulePackages = [ ];
  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
  # (the default) this is the recommended approach. When using systemd-networkd it's
  # still possible to use this option, but it's recommended to use it in conjunction
  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
  networking.useDHCP = lib.mkDefault true;
  # networking.interfaces.ens3.useDHCP = lib.mkDefault true;
  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
 }
--- a/hosts/brzeczyszczykiewicz/configuration.nix
+++ b/hosts/brzeczyszczykiewicz/configuration.nix
@@ -1,36 +0,0 @@
 { config, pkgs, values, ... }:
 {
  imports = [
      # Include the results of the hardware scan.
      ./hardware-configuration.nix
      ../../base.nix
      ../../misc/metrics-exporters.nix
      ./services/grzegorz.nix
    ];
  boot.loader.systemd-boot.enable = true;
  boot.loader.efi.canTouchEfiVariables = true;
  networking.hostName = "brzeczyszczykiewicz";
  systemd.network.networks."30-eno1" = values.defaultNetworkConfig // {
    matchConfig.Name = "eno1";
    address = with values.hosts.brzeczyszczykiewicz; [ (ipv4 + "/25") (ipv6 + "/64") ];
  };
  # List packages installed in system profile
  environment.systemPackages = with pkgs; [
  ];
  # List services that you want to enable:
  # This value determines the NixOS release from which the default
  # settings for stateful data, like file locations and database versions
  # on your system were taken. It‘s perfectly fine and recommended to leave
  # this value at the release version of the first install of this system.
  # Before changing this value read the documentation for this option
  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
  system.stateVersion = "23.05"; # Did you read the comment?
 }
--- a/hosts/brzeczyszczykiewicz/hardware-configuration.nix
+++ b/hosts/brzeczyszczykiewicz/hardware-configuration.nix
@@ -1,39 +0,0 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
 { config, lib, pkgs, modulesPath, ... }:
 {
  imports =
    [ (modulesPath + "/installer/scan/not-detected.nix")
    ];
  boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" "sr_mod" ];
  boot.initrd.kernelModules = [ ];
  boot.kernelModules = [ "kvm-intel" ];
  boot.extraModulePackages = [ ];
  fileSystems."/" =
    { device = "/dev/disk/by-uuid/4e8667f8-55de-4103-8369-b94665f42204";
      fsType = "ext4";
    };
  fileSystems."/boot" =
    { device = "/dev/disk/by-uuid/82E3-3D03";
      fsType = "vfat";
    };
  swapDevices =
    [ { device = "/dev/disk/by-uuid/d0bf9a21-44bc-44a3-ae55-8f0971875883"; }
    ];
  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
  # (the default) this is the recommended approach. When using systemd-networkd it's
  # still possible to use this option, but it's recommended to use it in conjunction
  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
  networking.useDHCP = lib.mkDefault true;
  # networking.interfaces.eno1.useDHCP = lib.mkDefault true;
  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }
--- a/hosts/brzeczyszczykiewicz/services/grzegorz.nix
+++ b/hosts/brzeczyszczykiewicz/services/grzegorz.nix
@@ -1,11 +0,0 @@
 { config, ... }:
 {
  imports = [ ../../../modules/grzegorz.nix ];
  services.nginx.virtualHosts."${config.networking.fqdn}" = {
    serverAliases = [
      "bokhylle.pvv.ntnu.no"
      "bokhylle.pvv.org"
    ];
  };
 }
--- a/hosts/buskerud/configuration.nix
+++ b/hosts/buskerud/configuration.nix
@@ -1,38 +0,0 @@
 { config, pkgs, values, ... }:
 {
  imports = [
    ./hardware-configuration.nix
    ../../base.nix
    ../../misc/metrics-exporters.nix
    ./containers/salsa/configuration.nix
  ];
  # buskerud does not support efi?
  # boot.loader.systemd-boot.enable = true;
  # boot.loader.efi.canTouchEfiVariables = true;
  boot.loader.grub.enable = true;
  boot.loader.grub.device = "/dev/sdb";
  networking.hostName = "buskerud";
  networking.search = [ "pvv.ntnu.no" "pvv.org" ];
  networking.nameservers = [ "129.241.0.200" "129.241.0.201" ];
  networking.tempAddresses = "disabled";
  systemd.network.networks."enp3s0f0" = values.defaultNetworkConfig // {
    matchConfig.Name = "enp3s0f0";
    address = with values.hosts.buskerud; [ (ipv4 + "/25") (ipv6 + "/64") ];
  };
  # List packages installed in system profile
  environment.systemPackages = with pkgs; [
  ];
  # This value determines the NixOS release from which the default
  # settings for stateful data, like file locations and database versions
  # on your system were taken. It‘s perfectly fine and recommended to leave
  # this value at the release version of the first install of this system.
  # Before changing this value read the documentation for this option
  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
  system.stateVersion = "23.05"; # Did you read the comment?
 }
--- a/hosts/buskerud/containers/salsa/NOTES.md
+++ b/hosts/buskerud/containers/salsa/NOTES.md
@@ -1,27 +0,0 @@
 # Misc docs
 ### Old stuff about storing kerberos state inside LDAP - might not be relevant
 - https://wiki.debian.org/LDAP/OpenLDAPSetup#OpenLDAP_as_a_Backend
 - https://ubuntu.com/server/docs/service-kerberos-with-openldap-backend
 - https://forums.freebsd.org/threads/heimdal-and-openldap-integration-some-questions.58422/
 - http://osr507doc.sco.com/cgi-bin/info2html?(heimdal.info.gz)Using%2520LDAP%2520to%2520store%2520the%2520database&lang=en
 - https://bbs.archlinux.org/viewtopic.php?id=54236
 - https://openldap-software.0penldap.narkive.com/Ml6seAGL/ldap-backend-for-heimdal-kerberos
 ### Heimdal setup
 - http://chschneider.eu/linux/server/heimdal.shtml
 - https://github.com/NixOS/nixpkgs/blob/master/nixos/tests/kerberos/heimdal.nix
 - https://itk.samfundet.no/dok/Kerberos (possibly a bit dated)
 ### OpenLDAP setup with new olc stuff
 - https://www.openldap.org/doc/admin26/
 - https://www.openldap.org/doc/admin26/sasl.html#GSSAPI
 - https://www.zytrax.com/books/ldap/
 ### SASLAUTHD
 - https://linux.die.net/man/8/saslauthd
 - https://www.cyrusimap.org/sasl/index.html
--- a/hosts/buskerud/containers/salsa/configuration.nix
+++ b/hosts/buskerud/containers/salsa/configuration.nix
@@ -1,51 +0,0 @@
 { config, pkgs, lib, inputs, values, ... }:
 {
  containers.salsa = {
    autoStart = true;
    interfaces = [ "enp6s0f1" ];
    bindMounts = {
      "/data" = { hostPath = "/data/salsa"; isReadOnly = false; };
    };
    nixpkgs = inputs.nixpkgs-unstable;
    config = { config, pkgs, ... }: let
      inherit values inputs;
    in {
      imports = [
        inputs.sops-nix.nixosModules.sops
        ../../../../base.nix
        ./services/heimdal
        ./services/openldap.nix
        ./services/saslauthd.nix
 	# https://github.com/NixOS/nixpkgs/pull/287611
 	./modules/krb5
 	./modules/kerberos
      ];
      disabledModules = [
 	"security/krb5"
 	"services/system/kerberos/default.nix"
      ];
      _module.args = {
        inherit values inputs;
      };
      sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
      sops.age.keyFile = "/var/lib/sops-nix/key.txt";
      sops.age.generateKey = true;
      # systemd.network.networks."30-enp6s0f1" = values.defaultNetworkConfig // {
      #   matchConfig.Name = "enp6s0f1";
      #   address = with values.hosts.jokum; [ (ipv4 + "/25") (ipv6 + "/64") ]
      #     ++ (with values.services.turn; [ (ipv4 + "/25") (ipv6 + "/64") ]);
      # };
      networking.useHostResolvConf = lib.mkForce false;
      system.stateVersion = "23.11";
    };
  };
 }
--- a/hosts/buskerud/containers/salsa/modules/kerberos/default.nix
+++ b/hosts/buskerud/containers/salsa/modules/kerberos/default.nix
@@ -1,101 +0,0 @@
 { config, pkgs, lib, ... }:
 let
  inherit (lib) mkOption types;
  cfg = config.services.kerberos_server;
  inherit (config.security.krb5) package;
  format = import ../krb5/krb5-conf-format.nix { inherit pkgs lib; } { };
 in
 {
  imports = [
    (lib.mkRenamedOptionModule [ "services" "kerberos_server" "realms" ] [ "services" "kerberos_server" "settings" "realms" ])
    ./mit.nix
    ./heimdal.nix
  ];
  options = {
    services.kerberos_server = {
      enable = lib.mkEnableOption (lib.mdDoc "the kerberos authentication server");
      settings = let
        aclEntry = types.submodule {
          options = {
            principal = mkOption {
              type = types.str;
              description = lib.mdDoc "Which principal the rule applies to";
            };
            access = mkOption {
              type = types.either
                (types.listOf (types.enum ["add" "cpw" "delete" "get" "list" "modify"]))
                (types.enum ["all"]);
              default = "all";
              description = lib.mdDoc "The changes the principal is allowed to make.";
            };
            target = mkOption {
              type = types.str;
              default = "*";
              description = lib.mdDoc "The principals that 'access' applies to.";
            };
          };
        };
        realm = types.submodule ({ name, ... }: {
          freeformType = format.sectionType;
          options = {
            acl = mkOption {
              type = types.listOf aclEntry;
              default = [
                { principal = "*/admin"; access = "all"; }
                { principal = "admin"; access = "all"; }
              ];
              description = lib.mdDoc ''
                The privileges granted to a user.
              '';
            };
          };
        });
      in mkOption {
        type = types.submodule (format.type.getSubModules ++ [{
          options = {
            realms = mkOption {
              type = types.attrsOf realm;
              description = lib.mdDoc ''
                The realm(s) to serve keys for.
              '';
            };
          };
        }]);
        description = ''
          Settings for the kerberos server of choice.
          See the following documentation:
          - Heimdal: {manpage}`kdc.conf(5)`
          - MIT Kerberos: <https://web.mit.edu/kerberos/krb5-1.21/doc/admin/conf_files/kdc_conf.html>
        '';
        default = { };
      };
    };
  };
  config = lib.mkIf cfg.enable {
    environment.systemPackages = [ package ];
    assertions = [
      {
        assertion = cfg.settings.realms != { };
        message = "The server needs at least one realm";
      }
      {
        assertion = lib.length (lib.attrNames cfg.settings.realms) <= 1;
        message = "Only one realm per server is currently supported.";
      }
    ];
    systemd.slices.system-kerberos-server = { };
    systemd.targets.kerberos-server = {
      wantedBy = [ "multi-user.target" ];
    };
  };
 }
--- a/hosts/buskerud/containers/salsa/modules/kerberos/heimdal.nix
+++ b/hosts/buskerud/containers/salsa/modules/kerberos/heimdal.nix
@@ -1,87 +0,0 @@
 { pkgs, config, lib, ... } :
 let
  inherit (lib)  mapAttrs;
  cfg = config.services.kerberos_server;
  package = config.security.krb5.package;
  aclConfigs = lib.pipe cfg.settings.realms [
    (mapAttrs (name: { acl, ... }: lib.concatMapStringsSep "\n" (
      { principal, access, target, ... }:
      "${principal}\t${lib.concatStringsSep "," (lib.toList access)}\t${target}"
    ) acl))
    (lib.mapAttrsToList (name: text:
      {
        dbname = "/var/lib/heimdal/heimdal";
        acl_file = pkgs.writeText "${name}.acl" text;
      }
    ))
  ];
  finalConfig = cfg.settings // {
    realms = mapAttrs (_: v: removeAttrs v [ "acl" ]) (cfg.settings.realms or { });
    kdc = (cfg.settings.kdc or { }) // {
      database = aclConfigs;
    };
  };
  format = import ../krb5/krb5-conf-format.nix { inherit pkgs lib; } { };
  kdcConfFile = format.generate "kdc.conf" finalConfig;
 in
 {
  config = lib.mkIf (cfg.enable && package.passthru.implementation == "heimdal") {
    environment.etc."heimdal-kdc/kdc.conf".source = kdcConfFile;
    systemd.tmpfiles.settings."10-heimdal" = let
      databases = lib.pipe finalConfig.kdc.database [
        (map (dbAttrs: dbAttrs.dbname or null))
        (lib.filter (x: x != null))
        lib.unique
      ];
    in lib.genAttrs databases (_: {
      d = {
        user = "root";
        group = "root";
        mode = "0700";
      };
    });
    systemd.services.kadmind = {
      description = "Kerberos Administration Daemon";
      partOf = [ "kerberos-server.target" ];
      wantedBy = [ "kerberos-server.target" ];
      serviceConfig = {
        ExecStart = "${package}/libexec/kadmind --config-file=/etc/heimdal-kdc/kdc.conf";
        Slice = "system-kerberos-server.slice";
        StateDirectory = "heimdal";
      };
      restartTriggers = [ kdcConfFile ];
    };
    systemd.services.kdc = {
      description = "Key Distribution Center daemon";
      partOf = [ "kerberos-server.target" ];
      wantedBy = [ "kerberos-server.target" ];
      serviceConfig = {
        ExecStart = "${package}/libexec/kdc --config-file=/etc/heimdal-kdc/kdc.conf";
        Slice = "system-kerberos-server.slice";
        StateDirectory = "heimdal";
      };
      restartTriggers = [ kdcConfFile ];
    };
    systemd.services.kpasswdd = {
      description = "Kerberos Password Changing daemon";
      partOf = [ "kerberos-server.target" ];
      wantedBy = [ "kerberos-server.target" ];
      serviceConfig = {
        ExecStart = "${package}/libexec/kpasswdd";
        Slice = "system-kerberos-server.slice";
        StateDirectory = "heimdal";
      };
      restartTriggers = [ kdcConfFile ];
    };
  };
 }
--- a/hosts/buskerud/containers/salsa/modules/kerberos/mit.nix
+++ b/hosts/buskerud/containers/salsa/modules/kerberos/mit.nix
@@ -1,77 +0,0 @@
 { pkgs, config, lib, ... } :
 let
  inherit (lib) mapAttrs;
  cfg = config.services.kerberos_server;
  package = config.security.krb5.package;
  PIDFile = "/run/kdc.pid";
  format = import ../krb5/krb5-conf-format.nix { inherit pkgs lib; } { };
  aclMap = {
    add = "a"; cpw = "c"; delete = "d"; get = "i"; list = "l"; modify = "m";
    all = "*";
  };
  aclConfigs = lib.pipe cfg.settings.realms [
    (mapAttrs (name: { acl, ... }: lib.concatMapStringsSep "\n" (
      { principal, access, target, ... }: let
        access_code = map (a: aclMap.${a}) (lib.toList access);
      in "${principal} ${lib.concatStrings access_code} ${target}"
    ) acl))
    (lib.concatMapAttrs (name: text: {
      ${name} = {
        acl_file = pkgs.writeText "${name}.acl" text;
      };
    }))
  ];
  finalConfig = cfg.settings // {
    realms = mapAttrs (n: v: (removeAttrs v [ "acl" ]) // aclConfigs.${n}) (cfg.settings.realms or { });
  };
  kdcConfFile = format.generate "kdc.conf" finalConfig;
  env = {
    # What Debian uses, could possibly link directly to Nix store?
    KRB5_KDC_PROFILE = "/etc/krb5kdc/kdc.conf";
  };
 in
 {
  config = lib.mkIf (cfg.enable && package.passthru.implementation == "krb5") {
    environment = {
      etc."krb5kdc/kdc.conf".source = kdcConfFile;
      variables = env;
    };
    systemd.services.kadmind = {
      description = "Kerberos Administration Daemon";
      partOf = [ "kerberos-server.target" ];
      wantedBy = [ "kerberos-server.target" ];
      serviceConfig = {
        ExecStart = "${package}/bin/kadmind -nofork";
        Slice = "system-kerberos-server.slice";
        StateDirectory = "krb5kdc";
      };
      restartTriggers = [ kdcConfFile ];
      environment = env;
    };
    systemd.services.kdc = {
      description = "Key Distribution Center daemon";
      partOf = [ "kerberos-server.target" ];
      wantedBy = [ "kerberos-server.target" ];
      serviceConfig = {
        Type = "forking";
        PIDFile = PIDFile;
        ExecStart = "${package}/bin/krb5kdc -P ${PIDFile}";
        Slice = "system-kerberos-server.slice";
        StateDirectory = "krb5kdc";
      };
      restartTriggers = [ kdcConfFile ];
      environment = env;
    };
  };
 }
--- a/hosts/buskerud/containers/salsa/modules/krb5/default.nix
+++ b/hosts/buskerud/containers/salsa/modules/krb5/default.nix
@@ -1,104 +0,0 @@
 { config, lib, pkgs, ... }:
 let
  inherit (lib) mdDoc mkIf mkOption mkPackageOption mkRemovedOptionModule;
  inherit (lib.types) bool;
  mkRemovedOptionModule' = name: reason: mkRemovedOptionModule ["krb5" name] reason;
  mkRemovedOptionModuleCfg = name: mkRemovedOptionModule' name ''
    The option `krb5.${name}' has been removed. Use
    `security.krb5.settings.${name}' for structured configuration.
  '';
  cfg = config.security.krb5;
  format = import ./krb5-conf-format.nix { inherit pkgs lib; } { };
 in {
  imports = [
    (mkRemovedOptionModuleCfg "libdefaults")
    (mkRemovedOptionModuleCfg "realms")
    (mkRemovedOptionModuleCfg "domain_realm")
    (mkRemovedOptionModuleCfg "capaths")
    (mkRemovedOptionModuleCfg "appdefaults")
    (mkRemovedOptionModuleCfg "plugins")
    (mkRemovedOptionModuleCfg "config")
    (mkRemovedOptionModuleCfg "extraConfig")
    (mkRemovedOptionModule' "kerberos" ''
      The option `krb5.kerberos' has been moved to `security.krb5.package'.
    '')
  ];
  options = {
    security.krb5 = {
      enable = mkOption {
        default = false;
        description = mdDoc "Enable and configure Kerberos utilities";
        type = bool;
      };
      package = mkPackageOption pkgs "krb5" {
        example = "heimdal";
      };
      settings = mkOption {
        default = { };
        type = format.type;
        description = mdDoc ''
          Structured contents of the {file}`krb5.conf` file. See
          {manpage}`krb5.conf(5)` for details about configuration.
        '';
        example = {
          include = [ "/run/secrets/secret-krb5.conf" ];
          includedir = [ "/run/secrets/secret-krb5.conf.d" ];
          libdefaults = {
            default_realm = "ATHENA.MIT.EDU";
          };
          realms = {
            "ATHENA.MIT.EDU" = {
              admin_server = "athena.mit.edu";
              kdc = [
                "athena01.mit.edu"
                "athena02.mit.edu"
              ];
            };
          };
          domain_realm = {
            "mit.edu" = "ATHENA.MIT.EDU";
          };
          logging = {
            kdc = "SYSLOG:NOTICE";
            admin_server = "SYSLOG:NOTICE";
            default = "SYSLOG:NOTICE";
          };
        };
      };
    };
  };
  config = {
    assertions = mkIf (cfg.enable || config.services.kerberos_server.enable) [(let
      implementation = cfg.package.passthru.implementation or "<NOT SET>";
    in {
      assertion = lib.elem implementation [ "krb5" "heimdal" ];
      message = ''
        `security.krb5.package` must be one of:
          - krb5
          - heimdal
 	Currently chosen implementation: ${implementation}
      '';
    })];
    environment = mkIf cfg.enable {
      systemPackages = [ cfg.package ];
      etc."krb5.conf".source = format.generate "krb5.conf" cfg.settings;
    };
  };
  meta.maintainers = builtins.attrValues {
    inherit (lib.maintainers) dblsaiko h7x4;
  };
 }
--- a/hosts/buskerud/containers/salsa/modules/krb5/krb5-conf-format.nix
+++ b/hosts/buskerud/containers/salsa/modules/krb5/krb5-conf-format.nix
@@ -1,96 +0,0 @@
 { pkgs, lib, ... }:
 # Based on
 # - https://web.mit.edu/kerberos/krb5-1.12/doc/admin/conf_files/krb5_conf.html
 # - https://manpages.debian.org/unstable/heimdal-docs/krb5.conf.5heimdal.en.html
 let
  inherit (lib) boolToString concatMapStringsSep concatStringsSep filter
    isAttrs isBool isList mapAttrsToList mdDoc mkOption singleton splitString;
  inherit (lib.types) attrsOf bool coercedTo either int listOf oneOf path
    str submodule;
 in
 { }: rec {
  sectionType = let
    relation = oneOf [
      (listOf (attrsOf value))
      (attrsOf value)
      value
    ];
    value = either (listOf atom) atom;
    atom = oneOf [int str bool];
  in attrsOf relation;
  type = submodule {
    freeformType = attrsOf sectionType;
    options = {
      include = mkOption {
        default = [ ];
        description = mdDoc ''
          Files to include in the Kerberos configuration.
        '';
        type = coercedTo path singleton (listOf path);
      };
      includedir = mkOption {
        default = [ ];
        description = mdDoc ''
          Directories containing files to include in the Kerberos configuration.
        '';
        type = coercedTo path singleton (listOf path);
      };
      module = mkOption {
        default = [ ];
        description = mdDoc ''
          Modules to obtain Kerberos configuration from.
        '';
        type = coercedTo path singleton (listOf path);
      };
    };
  };
  generate = let
    indent = str: concatMapStringsSep "\n" (line: "  " + line) (splitString "\n" str);
    formatToplevel = args @ {
      include ? [ ],
      includedir ? [ ],
      module ? [ ],
      ...
    }: let
      sections = removeAttrs args [ "include" "includedir" "module" ];
    in concatStringsSep "\n" (filter (x: x != "") [
      (concatStringsSep "\n" (mapAttrsToList formatSection sections))
      (concatMapStringsSep "\n" (m: "module ${m}") module)
      (concatMapStringsSep "\n" (i: "include ${i}") include)
      (concatMapStringsSep "\n" (i: "includedir ${i}") includedir)
    ]);
    formatSection = name: section: ''
      [${name}]
      ${indent (concatStringsSep "\n" (mapAttrsToList formatRelation section))}
    '';
    formatRelation = name: relation:
      if isAttrs relation
      then ''
        ${name} = {
        ${indent (concatStringsSep "\n" (mapAttrsToList formatValue relation))}
        }''
      else if isList relation
      then
        concatMapStringsSep "\n" (formatRelation name) relation
      else formatValue name relation;
    formatValue = name: value:
      if isList value
      then concatMapStringsSep "\n" (formatAtom name) value
      else formatAtom name value;
    formatAtom = name: atom: let
      v = if isBool atom then boolToString atom else toString atom;
    in "${name} = ${v}";
  in
    name: value: pkgs.writeText name ''
      ${formatToplevel value}
    '';
 }
--- a/hosts/buskerud/containers/salsa/services/heimdal/default.nix
+++ b/hosts/buskerud/containers/salsa/services/heimdal/default.nix
@@ -1,78 +0,0 @@
 { config, pkgs, lib, ... }:
 let
  realm = "PVV.NTNU.NO";
  cfg = config.security.krb5;
 in
 {
  security.krb5 = {
    enable = true;
    # NOTE: This has a small edit that moves an include header to $dev/include.
    #       It is required in order to build smbk5pwd, because of some nested includes.
    #       We should open an issue upstream (heimdal, not nixpkgs), but this patch
    #       will do for now.
    # package = pkgs.heimdal;
    package = pkgs.callPackage ./package.nix {
      inherit (pkgs.apple_sdk.frameworks)
        CoreFoundation Security SystemConfiguration;
    };
    settings = {
      logging.kdc = "CONSOLE";
      realms.${realm} = {
        admin_server = "localhost";
        kdc = [ "localhost" ];
      };
      kadmin.default_keys = lib.concatStringsSep " " [
        "aes256-cts-hmac-sha1-96:pw-salt"
        "aes128-cts-hmac-sha1-96:pw-salt"
      ];
      libdefaults.default_etypes = lib.concatStringsSep " " [
        "aes256-cts-hmac-sha1-96"
        "aes128-cts-hmac-sha1-96"
      ];
      libdefaults = {
        default_realm = realm;
      };
      domain_realm = {
        "pvv.ntnu.no" = realm;
        ".pvv.ntnu.no" = realm;
      };
    };
  };
  services.kerberos_server = {
    enable = true;
    settings = {
      realms.${realm} = {
        dbname = "/var/heimdal/heimdal";
        mkey = "/var/heimdal/mkey";
      };
      # kadmin.default_keys = lib.concatStringsSep " " [
      #   "aes256-cts-hmac-sha1-96:pw-salt"
      #   "aes128-cts-hmac-sha1-96:pw-salt"
      # ];
      # libdefaults.default_etypes = lib.concatStringsSep " " [
      #   "aes256-cts-hmac-sha1-96"
      #   "aes128-cts-hmac-sha1-96"
      # ];
      # password_quality.min_length = 8;
    };
  };
  # NOTE: These changes are part of nixpkgs-unstable, but not 23.11.
  #       The package override needs these changes.
  # systemd.services = {
  #   kdc.serviceConfig.ExecStart =      lib.mkForce "${cfg.package}/libexec/kadmind --config-file=/etc/heimdal-kdc/kdc.conf";
  #   kpasswdd.serviceConfig.ExecStart = lib.mkForce "${cfg.package}/libexec/kpasswdd";
  #   kadmind.serviceConfig.ExecStart =  lib.mkForce "${cfg.package}/libexec/kdc --config-file=/etc/heimdal-kdc/kdc.conf";
  # };
 }
--- a/hosts/buskerud/containers/salsa/services/heimdal/package.nix
+++ b/hosts/buskerud/containers/salsa/services/heimdal/package.nix
@@ -1,180 +0,0 @@
 { lib
 , stdenv
 , fetchFromGitHub
 , autoreconfHook
 , pkg-config
 , python3
 , perl
 , bison
 , flex
 , texinfo
 , perlPackages
 , openldap
 , libcap_ng
 , sqlite
 , openssl
 , db
 , libedit
 , pam
 , krb5
 , libmicrohttpd
 , cjson
 , CoreFoundation
 , Security
 , SystemConfiguration
 , curl
 , jdk
 , unzip
 , which
 , nixosTests
 , withCJSON ? true
 , withCapNG ? stdenv.isLinux
 # libmicrohttpd should theoretically work for darwin as well, but something is broken.
 # It affects tests check-bx509d and check-httpkadmind.
 , withMicroHTTPD ? stdenv.isLinux
 , withOpenLDAP ? true
 , withOpenLDAPAsHDBModule ? false
 , withOpenSSL ? true
 , withSQLite3 ? true
 }:
 assert lib.assertMsg (withOpenLDAPAsHDBModule -> withOpenLDAP) ''
  OpenLDAP needs to be enabled in order to build the OpenLDAP HDB Module.
 '';
 stdenv.mkDerivation {
  pname = "heimdal";
  version = "7.8.0-unstable-2023-11-29";
  src = fetchFromGitHub {
    owner = "heimdal";
    repo = "heimdal";
    rev = "3253c49544eacb33d5ad2f6f919b0696e5aab794";
    hash = "sha256-uljzQBzXrZCZjcIWfioqHN8YsbUUNy14Vo+A3vZIXzM=";
  };
  outputs = [ "out" "dev" "man" "info" ];
  nativeBuildInputs = [
    autoreconfHook
    pkg-config
    python3
    perl
    bison
    flex
    texinfo
  ]
  ++ (with perlPackages; [ JSON ]);
  buildInputs = [ db libedit pam ]
    ++ lib.optionals (stdenv.isDarwin) [ CoreFoundation Security SystemConfiguration ]
    ++ lib.optionals (withCJSON) [ cjson ]
    ++ lib.optionals (withCapNG) [ libcap_ng ]
    ++ lib.optionals (withMicroHTTPD) [ libmicrohttpd ]
    ++ lib.optionals (withOpenLDAP) [ openldap ]
    ++ lib.optionals (withOpenSSL) [ openssl ]
    ++ lib.optionals (withSQLite3) [ sqlite ];
  doCheck = true;
  nativeCheckInputs = [
    curl
    jdk
    unzip
    which
  ];
  configureFlags = [
    "--with-libedit-include=${libedit.dev}/include"
    "--with-libedit-lib=${libedit}/lib"
    # "--with-berkeley-db-include=${db.dev}/include"
    "--with-berkeley-db=${db}/lib"
    "--without-x"
    "--disable-afs-string-to-key"
  ] ++ lib.optionals (withCapNG) [
    "--with-capng"
  ] ++ lib.optionals (withCJSON) [
    "--with-cjson=${cjson}"
  ] ++ lib.optionals (withOpenLDAP) [
    "--with-openldap=${openldap.dev}"
  ] ++ lib.optionals (withOpenLDAPAsHDBModule) [
    "--enable-hdb-openldap-module"
  ] ++ lib.optionals (withSQLite3) [
    "--with-sqlite3=${sqlite.dev}"
  ];
  # (check-ldap) slapd resides within ${openldap}/libexec,
  #              which is not part of $PATH by default.
  # (check-ldap) prepending ${openldap}/bin to the path to avoid
  #              using the default installation of openldap on unsandboxed darwin systems,
  #              which does not support the new mdb backend at the moment (2024-01-13).
  # (check-ldap) the bdb backend got deprecated in favour of mdb in openldap 2.5.0,
  #              but the heimdal tests still seem to expect bdb as the openldap backend.
  #              This might be fixed upstream in a future update.
  patchPhase = ''
    runHook prePatch
    substituteInPlace tests/ldap/slapd-init.in \
      --replace 'SCHEMA_PATHS="' 'SCHEMA_PATHS="${openldap}/etc/schema '
    substituteInPlace tests/ldap/check-ldap.in \
      --replace 'PATH=' 'PATH=${openldap}/libexec:${openldap}/bin:'
    substituteInPlace tests/ldap/slapd.conf \
      --replace 'database	bdb' 'database mdb'
    runHook postPatch
  '';
  # (test_cc) heimdal uses librokens implementation of `secure_getenv` on darwin,
  #           which expects either USER or LOGNAME to be set.
  preCheck = lib.optionalString (stdenv.isDarwin) ''
    export USER=nix-builder
  '';
  # We need to build hcrypt for applications like samba
  postBuild = ''
    (cd include/hcrypto; make -j $NIX_BUILD_CORES)
    (cd lib/hcrypto; make -j $NIX_BUILD_CORES)
  '';
  postInstall = ''
    # Install hcrypto
    (cd include/hcrypto; make -j $NIX_BUILD_CORES install)
    (cd lib/hcrypto; make -j $NIX_BUILD_CORES install)
    mkdir -p $dev/bin
    mv $out/bin/krb5-config $dev/bin/
    # asn1 compilers, move them to $dev
    mv $out/libexec/heimdal/* $dev/bin
    rmdir $out/libexec/heimdal
    cp include/heim_threads.h $dev/include
    # compile_et is needed for cross-compiling this package and samba
    mv lib/com_err/.libs/compile_et $dev/bin
  '';
  # Issues with hydra
  #  In file included from hxtool.c:34:0:
  #  hx_locl.h:67:25: fatal error: pkcs10_asn1.h: No such file or directory
  #enableParallelBuilding = true;
  passthru = {
    implementation = "heimdal";
    tests.nixos = nixosTests.kerberos.heimdal;
  };
  meta = with lib; {
    homepage = "https://www.heimdal.software";
    changelog = "https://github.com/heimdal/heimdal/releases";
    description = "An implementation of Kerberos 5 (and some more stuff)";
    license = licenses.bsd3;
    platforms = platforms.unix;
    maintainers = with maintainers; [ h7x4 ];
  };
 }
--- a/hosts/buskerud/containers/salsa/services/heimdal/package2.nix
+++ b/hosts/buskerud/containers/salsa/services/heimdal/package2.nix
@@ -1,178 +0,0 @@
 { lib
 , stdenv
 , fetchFromGitHub
 , autoreconfHook
 , pkg-config
 , python3
 , perl
 , bison
 , flex
 , texinfo
 , perlPackages
 , openldap
 , libcap_ng
 , sqlite
 , openssl
 , db
 , libedit
 , pam
 , krb5
 , libmicrohttpd
 , cjson
 , CoreFoundation
 , Security
 , SystemConfiguration
 , curl
 , jdk
 , unzip
 , which
 , nixosTests
 , withCJSON ? true
 , withCapNG ? stdenv.isLinux
 # libmicrohttpd should theoretically work for darwin as well, but something is broken.
 # It affects tests check-bx509d and check-httpkadmind.
 , withMicroHTTPD ? stdenv.isLinux
 , withOpenLDAP ? true
 , withOpenLDAPAsHDBModule ? false
 , withOpenSSL ? true
 , withSQLite3 ? true
 }:
 assert lib.assertMsg (withOpenLDAPAsHDBModule -> withOpenLDAP) ''
  OpenLDAP needs to be enabled in order to build the OpenLDAP HDB Module.
 '';
 stdenv.mkDerivation {
  pname = "heimdal";
  version = "7.8.0-unstable-2023-11-29";
  src = fetchFromGitHub {
    owner = "heimdal";
    repo = "heimdal";
    rev = "3253c49544eacb33d5ad2f6f919b0696e5aab794";
    hash = "sha256-uljzQBzXrZCZjcIWfioqHN8YsbUUNy14Vo+A3vZIXzM=";
  };
  outputs = [ "out" "dev" "man" "info" ];
  nativeBuildInputs = [
    autoreconfHook
    pkg-config
    python3
    perl
    bison
    flex
    texinfo
  ]
  ++ (with perlPackages; [ JSON ]);
  buildInputs = [ db libedit pam ]
    ++ lib.optionals (stdenv.isDarwin) [ CoreFoundation Security SystemConfiguration ]
    ++ lib.optionals (withCJSON) [ cjson ]
    ++ lib.optionals (withCapNG) [ libcap_ng ]
    ++ lib.optionals (withMicroHTTPD) [ libmicrohttpd ]
    ++ lib.optionals (withOpenLDAP) [ openldap ]
    ++ lib.optionals (withOpenSSL) [ openssl ]
    ++ lib.optionals (withSQLite3) [ sqlite ];
  doCheck = true;
  nativeCheckInputs = [
    curl
    jdk
    unzip
    which
  ];
  configureFlags = [
    "--with-libedit-include=${libedit.dev}/include"
    "--with-libedit-lib=${libedit}/lib"
    "--with-berkeley-db-include=${db.dev}/include"
    "--with-berkeley-db"
    "--without-x"
    "--disable-afs-string-to-key"
  ] ++ lib.optionals (withCapNG) [
    "--with-capng"
  ] ++ lib.optionals (withCJSON) [
    "--with-cjson=${cjson}"
  ] ++ lib.optionals (withOpenLDAP) [
    "--with-openldap=${openldap.dev}"
  ] ++ lib.optionals (withOpenLDAPAsHDBModule) [
    "--enable-hdb-openldap-module"
  ] ++ lib.optionals (withSQLite3) [
    "--with-sqlite3=${sqlite.dev}"
  ];
  # (check-ldap) slapd resides within ${openldap}/libexec,
  #              which is not part of $PATH by default.
  # (check-ldap) prepending ${openldap}/bin to the path to avoid
  #              using the default installation of openldap on unsandboxed darwin systems,
  #              which does not support the new mdb backend at the moment (2024-01-13).
  # (check-ldap) the bdb backend got deprecated in favour of mdb in openldap 2.5.0,
  #              but the heimdal tests still seem to expect bdb as the openldap backend.
  #              This might be fixed upstream in a future update.
  patchPhase = ''
    runHook prePatch
    substituteInPlace tests/ldap/slapd-init.in \
      --replace 'SCHEMA_PATHS="' 'SCHEMA_PATHS="${openldap}/etc/schema '
    substituteInPlace tests/ldap/check-ldap.in \
      --replace 'PATH=' 'PATH=${openldap}/libexec:${openldap}/bin:'
    substituteInPlace tests/ldap/slapd.conf \
      --replace 'database	bdb' 'database mdb'
    runHook postPatch
  '';
  # (test_cc) heimdal uses librokens implementation of `secure_getenv` on darwin,
  #           which expects either USER or LOGNAME to be set.
  preCheck = lib.optionalString (stdenv.isDarwin) ''
    export USER=nix-builder
  '';
  # We need to build hcrypt for applications like samba
  postBuild = ''
    (cd include/hcrypto; make -j $NIX_BUILD_CORES)
    (cd lib/hcrypto; make -j $NIX_BUILD_CORES)
  '';
  postInstall = ''
    # Install hcrypto
    (cd include/hcrypto; make -j $NIX_BUILD_CORES install)
    (cd lib/hcrypto; make -j $NIX_BUILD_CORES install)
    mkdir -p $dev/bin
    mv $out/bin/krb5-config $dev/bin/
    # asn1 compilers, move them to $dev
    mv $out/libexec/heimdal/* $dev/bin
    rmdir $out/libexec/heimdal
    # compile_et is needed for cross-compiling this package and samba
    mv lib/com_err/.libs/compile_et $dev/bin
  '';
  # Issues with hydra
  #  In file included from hxtool.c:34:0:
  #  hx_locl.h:67:25: fatal error: pkcs10_asn1.h: No such file or directory
  #enableParallelBuilding = true;
  passthru = {
    implementation = "heimdal";
    tests.nixos = nixosTests.kerberos.heimdal;
  };
  meta = with lib; {
    homepage = "https://www.heimdal.software";
    changelog = "https://github.com/heimdal/heimdal/releases";
    description = "An implementation of Kerberos 5 (and some more stuff)";
    license = licenses.bsd3;
    platforms = platforms.unix;
    maintainers = with maintainers; [ h7x4 ];
  };
 }
--- a/hosts/buskerud/containers/salsa/services/openldap.nix
+++ b/hosts/buskerud/containers/salsa/services/openldap.nix
@@ -1,115 +0,0 @@
 { config, pkgs, lib, ... }:
 {
  services.openldap = let
    dn = "dc=kerberos,dc=pvv,dc=ntnu,dc=no";
    cfg = config.services.openldap;
  in {
    enable = true;
    # NOTE: this is a custom build of openldap with support for
    #       perl and kerberos.
    package = pkgs.openldap.overrideAttrs (prev: {
      # https://github.com/openldap/openldap/blob/master/configure
      configureFlags = prev.configureFlags ++ [
        # Connect to slapd via UNIX socket
        "--enable-local"
        # Cyrus SASL
        "--enable-spasswd"
        # Reverse hostname lookups
        "--enable-rlookups"
        # perl
        "--enable-perl"
      ];
      buildInputs = prev.buildInputs ++ (with pkgs; [
        perl
        config.security.krb5.package
      ]);
      extraContribModules = prev.extraContribModules ++ [
        # https://git.openldap.org/openldap/openldap/-/tree/master/contrib/slapd-modules
        "smbk5pwd"
      ];
    });
    settings = {
      attrs = {
        olcLogLevel = [ "stats" "config" "args" ];
        # olcAuthzRegexp = ''
        #   gidNumber=.*\\\+uidNumber=0,cn=peercred,cn=external,cn=auth
        #         "uid=heimdal,${dn2}"
        # '';
        # olcSaslSecProps = "minssf=0";
      };
      children = {
        "cn=schema".includes = let
          # NOTE: needed for smbk5pwd.so module
          # schemaToLdif = name: path: pkgs.runCommandNoCC name {
          #   buildInputs = with pkgs; [ schema2ldif ];
          # } ''
          #   schema2ldif "${path}" > $out
          # '';
          # hdb-ldif = schemaToLdif "hdb.ldif" "${pkgs.heimdal.src}/lib/hdb/hdb.schema";
          # samba-ldif = schemaToLdif "samba.ldif" "${pkgs.heimdal.src}/tests/ldap/samba.schema";
        in [
           "${cfg.package}/etc/schema/core.ldif"
           "${cfg.package}/etc/schema/cosine.ldif"
           "${cfg.package}/etc/schema/nis.ldif"
           "${cfg.package}/etc/schema/inetorgperson.ldif"
           # "${hdb-ldif}"
           # "${samba-ldif}"
        ];
        # NOTE: installation of smbk5pwd.so module
        #       https://git.openldap.org/openldap/openldap/-/tree/master/contrib/slapd-modules/smbk5pwd
        # "cn=module{0}".attrs = {
        #   objectClass = [ "olcModuleList" ];
        #   olcModuleLoad = [ "${cfg.package}/lib/modules/smbk5pwd.so" ];
        # };
        # NOTE: activation of smbk5pwd.so module for {1}mdb
        # "olcOverlay={0}smbk5pwd,olcDatabase={1}mdb".attrs = {
        #   objectClass = [ "olcOverlayConfig" "olcSmbK5PwdConfig" ];
        #   olcOverlay = "{0}smbk5pwd";
        #   olcSmbK5PwdEnable = [ "krb5" "samba" ];
        #   olcSmbK5PwdMustChange = toString (60 * 60 * 24 * 30);
        # };
        "olcDatabase={1}mdb".attrs = {
          objectClass = [ "olcDatabaseConfig" "olcMdbConfig" ];
          olcDatabase = "{1}mdb";
          olcSuffix = dn;
          # TODO: PW is supposed to be a secret, but it's probably fine for testing
          olcRootDN = "cn=admin,${dn}";
          olcRootPW.path = pkgs.writeText "olcRootPW" "pass";
          olcDbDirectory = "/var/lib/openldap/test-db";
          olcDbIndex = "objectClass eq";
          olcAccess = [
            ''{0}to attrs=userPassword,shadowLastChange
                by dn.exact=cn=admin,${dn} write
                by self write
                by anonymous auth
                by * none''
            ''{1}to dn.base=""
                by * read''
            /* allow read on anything else */
            # ''{2}to *
            #     by cn=admin,${dn} write by dn.exact=gidNumber=0+uidNumber=0+cn=peercred,cn=external write
            #     by * read''
          ];
        };
      };
    };
  };
 }
--- a/hosts/buskerud/containers/salsa/services/saslauthd.nix
+++ b/hosts/buskerud/containers/salsa/services/saslauthd.nix
@@ -1,14 +0,0 @@
 { ... }:
 {
  # TODO: This is seemingly required for openldap to authenticate
  #       against kerberos, but I have no idea how to configure it as
  #       such. Does it need a keytab? There's a binary "testsaslauthd"
  #       that follows with `pkgs.cyrus_sasl` that might be useful.
  services.saslauthd = {
    enable = true;
    mechanism = "kerberos5";
    # config = ''
    # '';
  };
 }
--- a/hosts/buskerud/hardware-configuration.nix
+++ b/hosts/buskerud/hardware-configuration.nix
@@ -1,37 +0,0 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
 { config, lib, pkgs, modulesPath, ... }:
 {
  imports =
    [ (modulesPath + "/installer/scan/not-detected.nix")
    ];
  boot.initrd.availableKernelModules = [ "uhci_hcd" "ehci_pci" "ata_piix" "hpsa" "usb_storage" "usbhid" "sd_mod" "sr_mod" ];
  boot.initrd.kernelModules = [ ];
  boot.kernelModules = [ "kvm-intel" ];
  boot.extraModulePackages = [ ];
  fileSystems."/" =
    { device = "/dev/disk/by-uuid/ed9654fe-575a-4fb3-b6ff-1b059479acff";
      fsType = "ext4";
    };
  swapDevices = [ ];
  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
  # (the default) this is the recommended approach. When using systemd-networkd it's
  # still possible to use this option, but it's recommended to use it in conjunction
  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
  networking.useDHCP = lib.mkDefault true;
  # networking.interfaces.enp14s0f0.useDHCP = lib.mkDefault true;
  # networking.interfaces.enp14s0f1.useDHCP = lib.mkDefault true;
  # networking.interfaces.enp3s0f0.useDHCP = lib.mkDefault true;
  # networking.interfaces.enp3s0f1.useDHCP = lib.mkDefault true;
  # networking.interfaces.enp4s0f0.useDHCP = lib.mkDefault true;
  # networking.interfaces.enp4s0f1.useDHCP = lib.mkDefault true;
  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }
--- a/hosts/georg/configuration.nix
+++ b/hosts/georg/configuration.nix
@@ -1,36 +0,0 @@
 { config, pkgs, values, ... }:
 {
  imports = [
      # Include the results of the hardware scan.
      ./hardware-configuration.nix
      ../../base.nix
      ../../misc/metrics-exporters.nix
      ../../modules/grzegorz.nix
    ];
  boot.loader.systemd-boot.enable = true;
  boot.loader.efi.canTouchEfiVariables = true;
  networking.hostName = "georg";
  systemd.network.networks."30-eno1" = values.defaultNetworkConfig // {
    matchConfig.Name = "eno1";
    address = with values.hosts.georg; [ (ipv4 + "/25") (ipv6 + "/64") ];
  };
  # List packages installed in system profile
  environment.systemPackages = with pkgs; [
  ];
  # List services that you want to enable:
  # This value determines the NixOS release from which the default
  # settings for stateful data, like file locations and database versions
  # on your system were taken. It‘s perfectly fine and recommended to leave
  # this value at the release version of the first install of this system.
  # Before changing this value read the documentation for this option
  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
  system.stateVersion = "23.05"; # Did you read the comment?
 }
--- a/hosts/georg/hardware-configuration.nix
+++ b/hosts/georg/hardware-configuration.nix
@@ -1,40 +0,0 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
 { config, lib, pkgs, modulesPath, ... }:
 {
  imports =
    [ (modulesPath + "/installer/scan/not-detected.nix")
    ];
  boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" ];
  boot.initrd.kernelModules = [ ];
  boot.kernelModules = [ "kvm-intel" ];
  boot.extraModulePackages = [ ];
  fileSystems."/" =
    { device = "/dev/disk/by-uuid/33825f0d-5a63-40fc-83db-bfa1ebb72ba0";
      fsType = "ext4";
    };
  fileSystems."/boot" =
    { device = "/dev/disk/by-uuid/145E-7362";
      fsType = "vfat";
    };
  swapDevices =
    [ { device = "/dev/disk/by-uuid/7ed27e21-3247-44cd-8bcc-5d4a2efebf57"; }
    ];
  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
  # (the default) this is the recommended approach. When using systemd-networkd it's
  # still possible to use this option, but it's recommended to use it in conjunction
  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
  networking.useDHCP = lib.mkDefault true;
  # networking.interfaces.eno1.useDHCP = lib.mkDefault true;
  # networking.interfaces.enp2s2.useDHCP = lib.mkDefault true;
  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }
--- a/hosts/greddost/configuration.nix
+++ b/hosts/greddost/configuration.nix
@@ -0,0 +1,66 @@
 # Edit this configuration file to define what should be installed on
 # your system.  Help is available in the configuration.nix(5) man page
 # and in the NixOS manual (accessible by running ‘nixos-help’).
 { config, pkgs, ... }:
 {
  imports =
    [ # Include the results of the hardware scan.
      ../../hardware-configuration.nix
      ../../base.nix
      ../../services/minecraft
    ];
  nixpkgs.config.packageOverrides = pkgs: {
    unstable = (import <nixos-unstable>) { };
  };
  # Use the GRUB 2 boot loader.
  boot.loader.grub.enable = true;
  boot.loader.grub.version = 2;
  # boot.loader.grub.efiSupport = true;
  # boot.loader.grub.efiInstallAsRemovable = true;
  # boot.loader.efi.efiSysMountPoint = "/boot/efi";
  # Define on which hard drive you want to install Grub.
  boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only
  networking.hostName = "greddost"; # Define your hostname.
  networking.interfaces.ens18.useDHCP = false;
  networking.defaultGateway = "129.241.210.129";
  networking.interfaces.ens18.ipv4 = {
    addresses = [
      {
        address = "129.241.210.174";
        prefixLength = 25;
      }
    ];
  };
  networking.interfaces.ens18.ipv6 = {
    addresses = [
      {
        address = "2001:700:300:1900::174";
        prefixLength = 64;
      }
    ];
  };
  networking.nameservers = [ "129.241.0.200" "129.241.0.201" ];
  # Open ports in the firewall.
  networking.firewall.allowedTCPPorts = [ 25565 ];
  networking.firewall.allowedUDPPorts = [ 25565 ];
  # This value determines the NixOS release from which the default
  # settings for stateful data, like file locations and database versions
  # on your system were taken. It‘s perfectly fine and recommended to leave
  # this value at the release version of the first install of this system.
  # Before changing this value read the documentation for this option
  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
  system.stateVersion = "21.11"; # Did you read the comment?
 }
--- a/hosts/greddost/services/minecraft/default.nix
+++ b/hosts/greddost/services/minecraft/default.nix
@@ -0,0 +1,158 @@
 {config, lib, pkgs, ... }:
 {
  imports = [ ./minecraft-server-fabric.nix ];
  environment.systemPackages = with pkgs; [
    mcron
  ];
  pvv.minecraft-server-fabric = {
    enable = true;
    eula = true;
    package = pkgs.callPackage ../../pkgs/minecraft-server-fabric { minecraft-server = (pkgs.callPackage ../../pkgs/minecraft-server/1_18_1.nix { }); };
    jvmOpts = "-Xms10G -Xmx10G -XX:+UnlockExperimentalVMOptions -XX:+UseZGC  -XX:+DisableExplicitGC  -XX:+AlwaysPreTouch -XX:+ParallelRefProcEnabled";
    serverProperties = {
      view-distance = 12;
      simulation-distance = 12;
      enable-command-block = true;
      gamemode = "survival";
      difficulty = "normal";
      white-list = true;
      enable-rcon = true;
      "rcon.password" = "pvv";
    };
    dataDir = "/fast/minecraft-pvv";
    mods = [
      (pkgs.fetchurl { # Fabric API is a common dependency for fabric based mods
        url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/0.44.0+1.18/fabric-api-0.44.0+1.18.jar";
        sha256 = "0mlmj7mj073a48s8zgc1km0jwkphz01c1fvivn4mw37lbm2p4834";
      })
      (pkgs.fetchurl { # Lithium is a 100% vanilla compatible optimization mod
        url = "https://cdn.modrinth.com/data/gvQqBUqZ/versions/mc1.18.1-0.7.6/lithium-fabric-mc1.18.1-0.7.6.jar";
        sha256 = "1fw1ikg578v4i6bmry7810a3q53h8yspxa3awdz7d746g91g8lf7";
      })
      (pkgs.fetchurl { # Starlight is the lighting engine of papermc
        url = "https://cdn.modrinth.com/data/H8CaAYZC/versions/Starlight%201.0.0%201.18.x/starlight-1.0.0+fabric.d0a3220.jar";
        sha256 = "0bv9im45hhc8n6x57lakh2rms0g5qb7qfx8qpx8n6mbrjjz6gla1";
      })
      (pkgs.fetchurl { # Krypton is a linux optimized optimizer for minecrafts networking system
        url = "https://cdn.modrinth.com/data/fQEb0iXm/versions/0.1.6/krypton-0.1.6.jar";
        sha256 = "1ribvbww4msrfdnzlxipk8kpzz7fnwnd4q6ln6mpjlhihcjb3hni";
      })
      (pkgs.fetchurl { # C2ME is a parallelizer for chunk loading and generation, experimental!!!
        url = "https://cdn.modrinth.com/data/VSNURh3q/versions/0.2.0+alpha.5.104%201.18.1/c2me-fabric-mc1.18.1-0.2.0+alpha.5.104-all.jar";
        sha256 = "13zrpsg61fynqnnlm7dvy3ihxk8khlcqsif68ak14z7kgm4py6nw";
      })
      (pkgs.fetchurl { # Spark is a profiler for minecraft
        url = "https://ci.lucko.me/job/spark/251/artifact/spark-fabric/build/libs/spark-fabric.jar";
        sha256 = "1clvi5v7a14ba23jbka9baz99h6wcfjbadc8kkj712fmy2h0sx07";
      })
      #(pkgs.fetchurl { # Carpetmod gives you tps views in the tab menu,
      #  # but also adds a lot of optional serverside vanilla+ features (which we arent using).
      #  # So probably want something else
      #  url = "https://github.com/gnembon/fabric-carpet/releases/download/1.4.56/fabric-carpet-1.18-1.4.56+v211130.jar";
      #  sha256 = "0rvl2yb8xymla8c052j07gqkqfkz4h5pxf6aip2v9v0h8r84p9hf";
      #})
    ];
    whitelist = {
      gunalx = "913a21ae-3a11-4178-a192-401490ca0891";
      eirikwitt = "1689e626-1cc8-4b91-81c4-0632fd34eb19";
      Rockj = "202c0c91-a4e0-4b45-8c1b-fc51a8956c0a";
      paddishar = "326845aa-4b45-4cd9-8108-7816e10a9828";
      nordyorn = "f253cddf-a520-42ab-85d3-713992746e42";
      hell04 = "c681df2a-6a30-4c66-b70d-742eb68bbc04";
      steinarh = "bd8c419e-e6dc-4fc5-ac62-b92f98c1abc9";
      EastTown2000 = "f273ed2e-d3ba-43fc-aff4-3e800cdf25e1";
      DirDanner = "5b5476a2-1138-476b-9ff1-1f39f834a428";
      asgeirbj = "dbd5d89f-3d8a-4662-ad15-6c4802d0098f";
      Linke03 = "0dbc661d-898a-47ff-a371-32b7bd76b78b";
      somaen = "cc0bdd13-4304-4160-80e7-8f043446fa83";
      einaman = "39f45df3-423d-4274-9ef9-c9b7575e3804";
      liseu = "c8f4d9d8-3140-4c35-9f66-22bc351bb7e6";
      torsteno = "ae1e7b15-a0de-4244-9f73-25b68427e34a";
      simtind = "39c03c95-d628-4ccc-843d-ce1332462d9e";
      aellaie = "c585605d-24bb-4d75-ba9c-0064f6a39328";
      PerKjelsvik = "5df69f17-27c9-4426-bcae-88b435dfae73";
      CelestialCry = "9e34d192-364e-4566-883a-afc868c4224d";
      terjesc = "993d70e8-6f9b-4094-813c-050d1a90be62";
      maxelost = "bf465915-871a-4e3e-a80c-061117b86b23";
      "4ce1" = "8a9b4926-0de8-43f0-bcde-df1442dee1d0";
      exponential = "1ebcca9d-0964-48f3-9154-126a9a7e64f6";
      Dodsorbot = "3baa9d58-32e4-465e-80bc-9dcb34e23e1d";
      HFANTOM = "cd74d407-7fb0-4454-b3f4-c0b4341fde18";
      Ghostmaker = "96465eee-e665-49ab-9346-f12d5a040624";
      soonhalle = "61a8e674-7c7a-4120-80d1-4453a5993350";
      MasterMocca = "481e6dac-9a17-4212-9664-645c3abe232f";
      soulprayfree = "cfb1fb23-5115-4fe2-9af9-00a02aea9bf8";
      calibwam = "0d5d5209-bb7c-4006-9451-fb85d7d52618";
      Skuggen = "f0ccee0b-741a-413a-b8e6-d04552b9d78a";
      Sivertsen3 = "cefac1a6-52a7-4781-be80-e7520f758554";
      vafflonaut = "4d864d5c-74e2-4f29-b57d-50dea76aaabd";
      Dhila = "c71d6c23-14d7-4daf-ae59-cbf0caf45681";
      remorino = "2972ab22-96b3-462d-ab4d-9b6b1775b9bb";
      SamuelxJackson = "f140e4aa-0a19-48ab-b892-79b24bd82c1e";
      ToanBuiDuc = "a3c54742-4caf-4334-8bbb-6402a8eb4268";
      Joces123 = "ecbcfbf9-9bcc-49f0-9435-f2ac2b3217c1";
      brunsviken = "75ff5f0e-8adf-4807-a7f0-4cb66f81cb7f";
      oscarsb1 = "9460015a-65cc-4a2f-9f91-b940b6ce7996";
      CVi = "6f5691ce-9f9c-4310-84aa-759d2f9e138e";
      Tawos = "0b98e55c-10cf-4b23-85d3-d15407431ace";
      evenhunn = "8751581b-cc5f-4f8b-ae1e-34d90127e074";
      q41 = "a080e5b4-10ee-4d6f-957e-aa5053bb1046";
      jesper001 = "fbdf3ceb-eaa9-4aeb-94c2-a587cde41774";
      finninde = "f58afd00-28cd-48dd-a74a-6c1d76b57f66";
      GameGuru999 = "535f2188-a4a4-4e54-bec6-74977bee09ab";
      MinusOneKelvin = "b6b973bf-1e35-4a58-803b-a555fd90a172";
      SuperRagna = "e2c32136-e510-41b1-84c0-41baeccfb0b9";
      Zamazaki = "d4411eca-401a-4565-9451-5ced6f48f23f";
      supertheodor = "610c4e86-0ecc-4e7a-bffc-35a2e7d90aa6";
      Minelost = "22ae2a1f-cfd9-4f10-9e41-e7becd34aba8";
      Bjand = "aed136b6-17f7-4ce1-8a7b-a09eb1694ccf";
      Dandellion = "f393413b-59fc-49d7-a5c4-83a5d177132c";
      Shogori = "f9d571bd-5754-46e8-aef8-e89b38a6be9b";
      Caragath = "f8d34f3a-55c3-4adc-b8d8-73a277f979e8";
      Shmaapqueen = "425f2eef-1a9d-4626-9ba3-cd58156943dc";
      Liquidlif3 = "420482b3-885f-4951-ba1e-30c22438a7e0";
      newtonseple = "7d8bf9ca-0499-4cb7-9d6a-daabf80482b6";
      nainis = "2eaf3736-decc-4e11-9a44-af2df0ee7c81";
      Devolan = "87016228-76b2-434f-a963-33b005ae9e42";
      zSkyler = "c92169e4-ca14-4bd5-9ea2-410fe956abe2";
      Cryovat = "7127d743-873e-464b-927a-d23b9ad5b74a";
      cybrhuman = "14a67926-cff0-4542-a111-7f557d10cc67";
      stinl = "3a08be01-1e74-4d68-88d1-07d0eb23356f";
      Mirithing = "7b327f51-4f1b-4606-88c7-378eff1b92b1";
      "_dextra" = "4b7b4ee7-eb5b-48fd-88c3-1cc68f06acda";
      Soraryuu = "0d5ffe48-e64f-4d6d-9432-f374ea8ec10c";
      klarken1 = "d6967cb8-2bc6-4db7-a093-f0770cce47df";
    };
  };
  networking.firewall.allowedTCPPorts = [ 25565 ];
  networking.firewall.allowedUDPPorts = [ 25565 ];
  systemd.services."minecraft-backup" = {
    serviceConfig.Type = "oneshot";
    script = ''
      ${pkgs.mcrcon}/bin/mcrcon -p pvv "say Starting Backup" "save-off" "save-all"
      ${pkgs.rsync}/bin/rsync -aiz --delete ${config.pvv.minecraft-server-fabric.dataDir}/world /fast/backup # Where to put backup
      ${pkgs.mcrcon}/bin/mcrcon -p pvv "save-all" "say Completed Backup" "save-on" "save-all"
    '';
  };
  systemd.timers."minecraft-backup" = {
    wantedBy = ["timers.target"];
    timerConfig.OnCalendar = [ "hourly" ];
  };
 }
--- a/hosts/greddost/services/minecraft/minecraft-server-fabric.nix
+++ b/hosts/greddost/services/minecraft/minecraft-server-fabric.nix
@@ -0,0 +1,180 @@
 { lib, pkgs, config, ... }:
 with lib;
 let
  cfg = config.pvv.minecraft-server-fabric;
  # We don't allow eula=false anyways
  eulaFile = builtins.toFile "eula.txt" ''
    # eula.txt managed by NixOS Configuration
    eula=true
  '';
  whitelistFile = pkgs.writeText "whitelist.json"
    (builtins.toJSON
      (mapAttrsToList (n: v: { name = n; uuid = v; }) cfg.whitelist));
  cfgToString = v: if builtins.isBool v then boolToString v else toString v;
  serverPropertiesFile = pkgs.writeText "server.properties" (''
    # server.properties managed by NixOS configuration
  '' + concatStringsSep "\n" (mapAttrsToList
    (n: v: "${n}=${cfgToString v}") cfg.serverProperties));
  defaultServerPort = 25565;
  serverPort = cfg.serverProperties.server-port or defaultServerPort;
  rconPort = if cfg.serverProperties.enable-rcon or false
    then cfg.serverProperties."rcon.port" or 25575
    else null;
  queryPort = if cfg.serverProperties.enable-query or false
    then cfg.serverProperties."query.port" or 25565
    else null;
 in
 {
  options.pvv.minecraft-server-fabric = {
    enable = mkEnableOption "minecraft-server-fabric";
    package = mkOption {
      type = types.package;
    };
    eula = mkOption {
      type = types.bool;
      default = false;
      description = ''
        Whether you agree to
        <link xlink:href="https://account.mojang.com/documents/minecraft_eula">
        Mojangs EULA</link>. This option must be set to
        <literal>true</literal> to run Minecraft server.
      '';
    };
    dataDir = mkOption {
      type = types.path;
      default = "/var/lib/minecraft-fabric";
      description = ''
        Directory to store Minecraft database and other state/data files.
      '';
    };
    whitelist = mkOption {
      type = let
        minecraftUUID = types.strMatching
          "[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}" // {
            description = "Minecraft UUID";
          };
        in types.attrsOf minecraftUUID;
      default = {};
      description = ''
        Whitelisted players, only has an effect when
        <option>services.minecraft-server.declarative</option> is
        <literal>true</literal> and the whitelist is enabled
        via <option>services.minecraft-server.serverProperties</option> by
        setting <literal>white-list</literal> to <literal>true</literal>.
        This is a mapping from Minecraft usernames to UUIDs.
        You can use <link xlink:href="https://mcuuid.net/"/> to get a
        Minecraft UUID for a username.
      '';
      example = literalExpression ''
        {
          username1 = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx";
          username2 = "yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy";
        };
      '';
    };
    serverProperties = mkOption {
      type = with types; attrsOf (oneOf [ bool int str ]);
      default = {};
      example = literalExpression ''
        {
          server-port = 43000;
          difficulty = 3;
          gamemode = 1;
          max-players = 5;
          motd = "NixOS Minecraft server!";
          white-list = true;
          enable-rcon = true;
          "rcon.password" = "hunter2";
        }
      '';
      description = ''
        Minecraft server properties for the server.properties file. Only has
        an effect when <option>services.minecraft-server.declarative</option>
        is set to <literal>true</literal>. See
        <link xlink:href="https://minecraft.gamepedia.com/Server.properties#Java_Edition_3"/>
        for documentation on these values.
      '';
    };
    jvmOpts = mkOption {
      type = types.separatedString " ";
      default = "-Xmx2048M -Xms2048M";
      # Example options from https://minecraft.gamepedia.com/Tutorials/Server_startup_script
      example = "-Xmx2048M -Xms4092M -XX:+UseG1GC -XX:+CMSIncrementalPacing "
        + "-XX:+CMSClassUnloadingEnabled -XX:ParallelGCThreads=2 "
        + "-XX:MinHeapFreeRatio=5 -XX:MaxHeapFreeRatio=10";
      description = "JVM options for the Minecraft server.";
    };
    mods = mkOption {
      type = types.listOf types.package;
      example = literalExpression ''
        [
          (pkgs.fetchurl {
            url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/0.44.0+1.18/fabric-api-0.44.0+1.18.jar";
            sha256 = "0mlmj7mj073a48s8zgc1km0jwkphz01c1fvivn4mw37lbm2p4834";
          })
        ];
      '';
      description = "List of mods to put in the mods folder";
    };
  };
  config = mkIf cfg.enable {
    users.users.minecraft = {
      description     = "Minecraft server service user";
      home            = cfg.dataDir;
      createHome      = true;
      isSystemUser    = true;
      group           = "minecraft";
    };
    users.groups.minecraft = {};
    systemd.services.minecraft-server-fabric = {
      description   = "Minecraft Server Service";
      wantedBy      = [ "multi-user.target" ];
      after         = [ "network.target" ];
      serviceConfig = {
        ExecStart = "${cfg.package}/bin/minecraft-server ${cfg.jvmOpts}";
        Restart = "always";
        User = "minecraft";
        WorkingDirectory = cfg.dataDir;
      };
      preStart = ''
        ln -sf ${eulaFile} eula.txt
        ln -sf ${whitelistFile} whitelist.json
        cp -f ${serverPropertiesFile} server.properties
        ln -sfn ${pkgs.linkFarmFromDrvs "fabric-mods" cfg.mods} mods
      '';
    };
    assertions = [
      { assertion = cfg.eula;
        message = "You must agree to Mojangs EULA to run minecraft-server."
          + " Read https://account.mojang.com/documents/minecraft_eula and"
          + " set `services.minecraft-server.eula` to `true` if you agree.";
      }
    ]; 
  };
 }
--- a/hosts/ildkule/configuration.nix
+++ b/hosts/ildkule/configuration.nix
@@ -1,13 +1,11 @@
-{ config, pkgs, values, ... }:
+{ config, pkgs, ... }:
 {
  imports = [
      # Include the results of the hardware scan.
      ./hardware-configuration.nix
      ../../base.nix
      ../../misc/metrics-exporters.nix
-      ./services/nginx
+      ../../base.nix
-      ./services/metrics
+      # Users can just import any configuration they want even for non-user things. Improve the users/default.nix to just load some specific attributes if this isn't wanted
    ];
  sops.defaultSopsFile = ../../secrets/ildkule/ildkule.yaml;
@@ -20,10 +18,26 @@
  networking.hostName = "ildkule"; # Define your hostname.
-  systemd.network.networks."30-ens18" = values.defaultNetworkConfig // {
+  networking.interfaces.ens18.useDHCP = false;
-    matchConfig.Name = "ens18";
+
-    address = with values.hosts.ildkule; [ (ipv4 + "/25") (ipv6 + "/64") ];
+  networking.defaultGateway = "129.241.210.129";
  networking.interfaces.ens18.ipv4 = {
    addresses = [
      {
        address = "129.241.210.187";
        prefixLength = 25;
      }
    ];
  };
  networking.interfaces.ens18.ipv6 = {
    addresses = [
      {
        address = "2001:700:300:1900::187";
        prefixLength = 64;
      }
    ];
  };
  networking.nameservers = [ "129.241.0.200" "129.241.0.201" ];
  # List packages installed in system profile
  environment.systemPackages = with pkgs; [
--- a/hosts/ildkule/hardware-configuration.nix
+++ b/hosts/ildkule/hardware-configuration.nix
@@ -1,37 +0,0 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
 { config, lib, pkgs, modulesPath, ... }:
 {
  imports =
    [ (modulesPath + "/profiles/qemu-guest.nix")
    ];
  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "sr_mod" "virtio_blk" ];
  boot.initrd.kernelModules = [ ];
  boot.kernelModules = [ ];
  boot.extraModulePackages = [ ];
  fileSystems."/" =
    { device = "/dev/disk/by-uuid/afe70fe4-681a-4675-8cbd-e5d08cdcf5b5";
      fsType = "ext4";
    };
  fileSystems."/boot" =
    { device = "/dev/disk/by-uuid/B71A-E5CD";
      fsType = "vfat";
    };
  swapDevices = [ ];
  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
  # (the default) this is the recommended approach. When using systemd-networkd it's
  # still possible to use this option, but it's recommended to use it in conjunction
  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
  networking.useDHCP = lib.mkDefault true;
  # networking.interfaces.ens18.useDHCP = lib.mkDefault true;
  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }
--- a/hosts/ildkule/services/metrics/dashboards/go-processes.json
+++ b/hosts/ildkule/services/metrics/dashboards/go-processes.json
--- a/hosts/ildkule/services/metrics/dashboards/mysql.json
+++ b/hosts/ildkule/services/metrics/dashboards/mysql.json
--- a/hosts/ildkule/services/metrics/dashboards/node-exporter-full.json
+++ b/hosts/ildkule/services/metrics/dashboards/node-exporter-full.json
--- a/hosts/ildkule/services/metrics/dashboards/postgres.json
+++ b/hosts/ildkule/services/metrics/dashboards/postgres.json
--- a/hosts/ildkule/services/metrics/dashboards/synapse.json
+++ b/hosts/ildkule/services/metrics/dashboards/synapse.json
--- a/hosts/ildkule/services/metrics/default.nix
+++ b/hosts/ildkule/services/metrics/default.nix
@@ -1,9 +0,0 @@
 { config, pkgs, ... }:
 {
  imports = [
    ./prometheus
    ./grafana.nix
    ./loki.nix
  ];
 }
--- a/hosts/ildkule/services/metrics/grafana.nix
+++ b/hosts/ildkule/services/metrics/grafana.nix
@@ -1,105 +0,0 @@
 { config, pkgs, values, ... }: let
  cfg = config.services.grafana;
 in {
  sops.secrets = let
    owner = "grafana";
    group = "grafana";
  in {
    "keys/grafana/secret_key" = { inherit owner group; };
    "keys/grafana/admin_password" = { inherit owner group; };
    "keys/postgres/grafana" = { inherit owner group; };
  };
  services.grafana = {
    enable = true;
    settings = let
      # See https://grafana.com/docs/grafana/latest/setup-grafana/configure-grafana/#file-provider
      secretFile = path: "$__file{${path}}";
    in {
      server = {
        domain = "ildkule.pvv.ntnu.no";
        http_port = 2342;
        http_addr = "127.0.0.1";
      };
      security = {
        secret_key = secretFile config.sops.secrets."keys/grafana/secret_key".path;
        admin_password = secretFile config.sops.secrets."keys/grafana/admin_password".path;
      };
      database = {
        type = "postgres";
        user = "grafana";
        host = "${values.hosts.bicep.ipv4}:5432";
        password = secretFile config.sops.secrets."keys/postgres/grafana".path;
      };
    };
    provision = {
      enable = true;
      datasources.settings.datasources = [
        {
          name = "Ildkule Prometheus";
          type = "prometheus";
          url = ("http://${config.services.prometheus.listenAddress}:${toString config.services.prometheus.port}");
         isDefault = true;
        }
        {
          name = "Ildkule loki";
          type = "loki";
          url = ("http://${config.services.loki.configuration.server.http_listen_address}:${toString config.services.loki.configuration.server.http_listen_port}");
        }
      ];
      dashboards.settings.providers = [
        {
          name = "Node Exporter Full";
          type = "file";
          url = "https://grafana.com/api/dashboards/1860/revisions/29/download";
          options.path = dashboards/node-exporter-full.json;
        }
        {
          name = "Matrix Synapse";
          type = "file";
          url = "https://raw.githubusercontent.com/matrix-org/synapse/develop/contrib/grafana/synapse.json";
          options.path = dashboards/synapse.json;
        }
 	# TODO: enable once https://github.com/NixOS/nixpkgs/pull/242365 gets merged
 	# {
 	#   name = "MySQL";
 	#   type = "file";
 	#   url = "https://raw.githubusercontent.com/prometheus/mysqld_exporter/main/mysqld-mixin/dashboards/mysql-overview.json";
 	#   options.path = dashboards/mysql.json;
 	# }
        {
          name = "Postgresql";
          type = "file";
          url = "https://grafana.com/api/dashboards/9628/revisions/7/download";
          options.path = dashboards/postgres.json;
        }
        {
          name = "Go Processes (gogs)";
          type = "file";
          url = "https://grafana.com/api/dashboards/240/revisions/3/download";
          options.path = dashboards/go-processes.json;
        }
      ];
    };
  };
  services.nginx.virtualHosts.${cfg.settings.server.domain} = {
    enableACME = true;
    forceSSL = true;
    locations = {
      "/" = {
        proxyPass = "http://127.0.0.1:${toString cfg.settings.server.http_port}";
        proxyWebsockets = true;
        extraConfig = ''
          proxy_buffers 8 1024k;
          proxy_buffer_size 1024k;
        '';
      };
    };
  };
 }
--- a/hosts/ildkule/services/metrics/loki.nix
+++ b/hosts/ildkule/services/metrics/loki.nix
@@ -1,86 +0,0 @@
 { config, pkgs, ... }:
 let
  cfg = config.services.loki;
 in {
  services.loki = {
    enable = true;
    configuration = {
      auth_enabled = false;
      server = {
        http_listen_port = 3100;
        http_listen_address = "0.0.0.0";
        grpc_listen_port = 9096;
      };
      ingester = {
        wal = {
          enabled = true;
          dir = "/var/lib/loki/wal";
        };
        lifecycler = {
          address = "127.0.0.1";
          ring = {
            kvstore = {
              store = "inmemory";
            };
            replication_factor = 1;
          };
          final_sleep = "0s";
        };
        chunk_idle_period = "1h";
      };
      schema_config = {
        configs = [
          {
            from = "2022-12-01";
            store = "boltdb-shipper";
            object_store = "filesystem";
            schema = "v11";
            index = {
              prefix = "index_";
              period = "24h";
            };
          }
        ];
      };
      storage_config = {
        boltdb_shipper = {
          active_index_directory = "/var/lib/loki/boltdb-shipper-index";
          cache_location = "/var/lib/loki/boltdb-shipper-cache";
          shared_store = "filesystem";
          cache_ttl = "24h";
        };
        filesystem = {
          directory = "/var/lib/loki/chunks";
        };
      };
      limits_config = {
        enforce_metric_name = false;
        reject_old_samples = true;
        reject_old_samples_max_age = "72h";
      };
      compactor = {
        working_directory = "/var/lib/loki/compactor";
        shared_store = "filesystem";
      };
      # ruler = {
      #   storage = {
      #     type = "local";
      #     local = {
      #       directory = "/var/lib/loki/rules";
      #     };
      #   };
      #   rule_path = "/etc/loki/rules";
      #   alertmanager_url = "http://localhost:9093";
      # };
    };
  };
  networking.firewall.allowedTCPPorts = [ cfg.configuration.server.http_listen_port ];
 }
--- a/hosts/ildkule/services/metrics/prometheus/default.nix
+++ b/hosts/ildkule/services/metrics/prometheus/default.nix
@@ -1,18 +0,0 @@
 { config, ... }: {
  imports = [
    ./gogs.nix
    ./matrix-synapse.nix
    # TODO: enable once https://github.com/NixOS/nixpkgs/pull/242365 gets merged
    # ./mysqld.nix
    ./node.nix
    ./postgres.nix
  ];
  services.prometheus = {
    enable = true;
    listenAddress = "127.0.0.1";
    port = 9001;
    ruleFiles = [ rules/synapse-v2.rules ];
  };
 }
--- a/hosts/ildkule/services/metrics/prometheus/gogs.nix
+++ b/hosts/ildkule/services/metrics/prometheus/gogs.nix
@@ -1,16 +0,0 @@
 { config, ... }: let
  cfg = config.services.prometheus;
 in {
  services.prometheus.scrapeConfigs = [{
    job_name = "git-gogs";
    scheme = "https";
    metrics_path = "/-/metrics";
    static_configs = [
      {
        targets = [
          "essendrop.pvv.ntnu.no:443"
        ];
      }
    ];
  }];
 }
--- a/hosts/ildkule/services/metrics/prometheus/matrix-synapse.nix
+++ b/hosts/ildkule/services/metrics/prometheus/matrix-synapse.nix
@@ -1,40 +0,0 @@
 { ... }:
 {
  services.prometheus.scrapeConfigs = [{
    job_name = "synapse";
    scrape_interval = "15s";
    scheme = "https";
    http_sd_configs = [{
      url = "https://matrix.pvv.ntnu.no/metrics/config.json";
    }];
    relabel_configs = [
      {
        source_labels = [ "__address__" ];
        regex = "[^/]+(/.*)";
        target_label = "__metrics_path__";
      }
      {
        source_labels = [ "__address__" ];
        regex = "([^/]+)/.*";
        target_label = "instance";
      }
      {
        source_labels = [ "__address__" ];
        regex = "[^/]+\\/+[^/]+/(.*)/\\d+$";
        target_label = "job";
      }
      {
        source_labels = [ "__address__" ];
        regex = "[^/]+\\/+[^/]+/.*/(\\d+)$";
        target_label = "index";
      }
      {
        source_labels = [ "__address__" ];
        regex = "([^/]+)/.*";
        target_label = "__address__";
      }
    ];
  }];
 }
--- a/hosts/ildkule/services/metrics/prometheus/mysqld.nix
+++ b/hosts/ildkule/services/metrics/prometheus/mysqld.nix
@@ -1,25 +0,0 @@
 { config, ... }: let
  cfg = config.services.prometheus;
 in {
  sops.secrets."config/mysqld_exporter" = { };
  services.prometheus = {
    scrapeConfigs = [{
      job_name = "mysql";
      scheme = "http";
      metrics_path = cfg.exporters.mysqld.telemetryPath;
      static_configs = [
        {
          targets = [
            "localhost:${toString cfg.exporters.mysqld.port}"
          ];
        }
      ];
    }];
    exporters.mysqld = {
      enable = true;
      configFilePath = config.sops.secrets."config/mysqld_exporter".path;
    };
  };
 }
--- a/hosts/ildkule/services/metrics/prometheus/node.nix
+++ b/hosts/ildkule/services/metrics/prometheus/node.nix
@@ -1,22 +0,0 @@
 { config, ... }: let
  cfg = config.services.prometheus;
 in {
  services.prometheus.scrapeConfigs = [{
    job_name = "node";
    static_configs = [
      {
        targets = [
          "ildkule.pvv.ntnu.no:${toString cfg.exporters.node.port}"
          "microbel.pvv.ntnu.no:9100"
          "isvegg.pvv.ntnu.no:9100"
          "knakelibrak.pvv.ntnu.no:9100"
          "hildring.pvv.ntnu.no:9100"
          "bicep.pvv.ntnu.no:9100"
          "essendrop.pvv.ntnu.no:9100"
          "andresbu.pvv.ntnu.no:9100"
          "bekkalokk.pvv.ntnu.no:9100"
        ];
      }
    ];
  }];
 }
--- a/hosts/ildkule/services/metrics/prometheus/postgres.nix
+++ b/hosts/ildkule/services/metrics/prometheus/postgres.nix
@@ -1,51 +0,0 @@
 { pkgs, lib, config, values, ... }: let
  cfg = config.services.prometheus;
 in {
  sops.secrets = {
    "keys/postgres/postgres_exporter_env" = {};
    "keys/postgres/postgres_exporter_knakelibrak_env" = {};
  };
  services.prometheus = {
    scrapeConfigs = [
      {
        job_name = "postgres";
        scrape_interval = "15s";
        static_configs = [{
          targets = [ "localhost:${toString cfg.exporters.postgres.port}" ];
          labels = {
            server = "bicep";
          };
        }];
      }
      {
        job_name = "postgres-knakelibrak";
        scrape_interval = "15s";
        static_configs = [{
          targets = [ "localhost:${toString (cfg.exporters.postgres.port + 1)}" ];
          labels = {
            server = "knakelibrak";
          };
        }];
      }
    ];
    exporters.postgres = {
      enable = true;
      extraFlags = [ "--auto-discover-databases" ];
      environmentFile = config.sops.secrets."keys/postgres/postgres_exporter_env".path;
    };
  };
  systemd.services.prometheus-postgres-exporter-knakelibrak.serviceConfig = let
    localCfg = config.services.prometheus.exporters.postgres; 
  in lib.recursiveUpdate config.systemd.services.prometheus-postgres-exporter.serviceConfig {
      EnvironmentFile = config.sops.secrets."keys/postgres/postgres_exporter_knakelibrak_env".path;
      ExecStart = ''
        ${pkgs.prometheus-postgres-exporter}/bin/postgres_exporter \
          --web.listen-address ${localCfg.listenAddress}:${toString (localCfg.port + 1)} \
          --web.telemetry-path ${localCfg.telemetryPath} \
          ${lib.concatStringsSep " \\\n  " localCfg.extraFlags}
      '';
    };
 }
--- a/hosts/ildkule/services/metrics/prometheus/rules/synapse-v2.rules
+++ b/hosts/ildkule/services/metrics/prometheus/rules/synapse-v2.rules
@@ -1,74 +0,0 @@
 groups:
 - name: synapse
  rules:
  ###
  ### Prometheus Console Only
  ### The following rules are only needed if you use the Prometheus Console
  ### in contrib/prometheus/consoles/synapse.html
  ###
  - record: 'synapse_federation_client_sent'
    labels:
      type: "EDU"
    expr: 'synapse_federation_client_sent_edus_total + 0'
  - record: 'synapse_federation_client_sent'
    labels:
      type: "PDU"
    expr: 'synapse_federation_client_sent_pdu_destinations_count_total + 0'
  - record: 'synapse_federation_client_sent'
    labels:
      type: "Query"
    expr: 'sum(synapse_federation_client_sent_queries) by (job)'
  - record: 'synapse_federation_server_received'
    labels:
      type: "EDU"
    expr: 'synapse_federation_server_received_edus_total + 0'
  - record: 'synapse_federation_server_received'
    labels:
      type: "PDU"
    expr: 'synapse_federation_server_received_pdus_total + 0'
  - record: 'synapse_federation_server_received'
    labels:
      type: "Query"
    expr: 'sum(synapse_federation_server_received_queries) by (job)'
  - record: 'synapse_federation_transaction_queue_pending'
    labels:
      type: "EDU"
    expr: 'synapse_federation_transaction_queue_pending_edus + 0'
  - record: 'synapse_federation_transaction_queue_pending'
    labels:
      type: "PDU"
    expr: 'synapse_federation_transaction_queue_pending_pdus + 0'
  ###
  ### End of 'Prometheus Console Only' rules block
  ###
  ###
  ### Grafana Only
  ### The following rules are only needed if you use the Grafana dashboard
  ### in contrib/grafana/synapse.json
  ###
  - record: synapse_storage_events_persisted_by_source_type
    expr: sum without(type, origin_type, origin_entity) (synapse_storage_events_persisted_events_sep_total{origin_type="remote"})
    labels:
      type: remote
  - record: synapse_storage_events_persisted_by_source_type
    expr: sum without(type, origin_type, origin_entity) (synapse_storage_events_persisted_events_sep_total{origin_entity="*client*",origin_type="local"})
    labels:
      type: local
  - record: synapse_storage_events_persisted_by_source_type
    expr: sum without(type, origin_type, origin_entity) (synapse_storage_events_persisted_events_sep_total{origin_entity!="*client*",origin_type="local"})
    labels:
      type: bridges
  - record: synapse_storage_events_persisted_by_event_type
    expr: sum without(origin_entity, origin_type) (synapse_storage_events_persisted_events_sep_total)
  - record: synapse_storage_events_persisted_by_origin
    expr: sum without(type) (synapse_storage_events_persisted_events_sep_total)
  ###
  ### End of 'Grafana Only' rules block
  ###
--- a/hosts/ildkule/services/nginx/default.nix
+++ b/hosts/ildkule/services/nginx/default.nix
@@ -1,5 +1,7 @@
-{ config, values, ... }:
+{config, ... }:
 {
  security.acme = {
    acceptTerms = true;
    defaults.email = "drift@pvv.ntnu.no";
@@ -8,17 +10,6 @@
  services.nginx = {
    enable = true;
    enableReload = true;
    defaultListenAddresses = [
      values.hosts.ildkule.ipv4
      "[${values.hosts.ildkule.ipv6}]"
      "127.0.0.1"
      "127.0.0.2"
      "[::1]"
    ];
    recommendedProxySettings = true;
    recommendedTlsSettings = true;
    recommendedGzipSettings = true;
--- a/hosts/jokum/configuration.nix
+++ b/hosts/jokum/configuration.nix
@@ -0,0 +1,71 @@
 { config, pkgs, ... }:
 {
  imports = [
      # Include the results of the hardware scan.
      ./hardware-configuration.nix
      # Users can just import any configuration they want even for non-user things. Improve the users/default.nix to just load some specific attributes if this isn't wanted
      ../../misc/rust-motd.nix
      ./services/matrix
      ./services/nginx
    ];
  sops.defaultSopsFile = ../../secrets/jokum/jokum.yaml;
  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
  sops.age.generateKey = true;
  # Use the GRUB 2 boot loader.
  boot.loader.grub.enable = true;
  boot.loader.grub.version = 2;
  boot.loader.grub.devices = [ "/dev/sda" ];
  networking.hostName = "jokum"; # Define your hostname.
  networking.interfaces.ens18.useDHCP = false;
  networking.defaultGateway = "129.241.210.129";
  networking.interfaces.ens18.ipv4 = {
    addresses = [
      {
        address = "129.241.210.169";
        prefixLength = 25;
      }
      {
        address = "129.241.210.213";
        prefixLength = 25;
      }
    ];
  };
  networking.interfaces.ens18.ipv6 = {
    addresses = [
      {
        address = "2001:700:300:1900::169";
        prefixLength = 64;
      }
      {
        address = "2001:700:300:1900::213";
        prefixLength = 64;
      }
    ];
  };
  networking.nameservers = [ "129.241.0.200" "129.241.0.201" ];
  # List packages installed in system profile
  environment.systemPackages = with pkgs; [
  ];
  # List services that you want to enable:
  # This value determines the NixOS release from which the default
  # settings for stateful data, like file locations and database versions
  # on your system were taken. It‘s perfectly fine and recommended to leave
  # this value at the release version of the first install of this system.
  # Before changing this value read the documentation for this option
  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
  system.stateVersion = "21.05"; # Did you read the comment?
 }
--- a/hosts/jokum/hardware-configuration.nix
+++ b/hosts/jokum/hardware-configuration.nix
@@ -0,0 +1,29 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
 { config, lib, pkgs, modulesPath, ... }:
 {
  imports =
    [ (modulesPath + "/profiles/qemu-guest.nix")
    ];
  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
  boot.initrd.kernelModules = [ ];
  boot.kernelModules = [ ];
  boot.extraModulePackages = [ ];
  fileSystems."/" =
    { device = "/dev/disk/by-uuid/1a8bf91a-5948-40c2-a9fd-7a33e46fa441";
      fsType = "ext4";
    };
  fileSystems."/data" =
    { device = "/dev/disk/by-uuid/c812e204-b998-4ec5-9f26-29c5808ed6ba";
      fsType = "ext4";
    };
  swapDevices = [ ];
  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }
--- a/hosts/jokum/services/matrix/coturn.nix
+++ b/hosts/jokum/services/matrix/coturn.nix
@@ -2,14 +2,10 @@
 {
  sops.secrets."matrix/synapse/turnconfig" = {
    sopsFile = ../../../../secrets/bicep/matrix.yaml;
    key = "synapse/turnconfig";
    owner = config.users.users.matrix-synapse.name;
    group = config.users.users.matrix-synapse.group;
  };
  sops.secrets."matrix/coturn/static-auth-secret" = {
    sopsFile = ../../../../secrets/bicep/matrix.yaml;
    key = "coturn/static-auth-secret";
    owner = config.users.users.turnserver.name;
    group = config.users.users.turnserver.group;
  };
@@ -118,7 +114,7 @@
  };
  networking.firewall = {
-    interfaces.enp6s0f0 = let
+    interfaces.ens18 = let
      range = with config.services.coturn; [ {
      from = min-port;
      to = max-port;
--- a/hosts/jokum/services/matrix/default.nix
+++ b/hosts/jokum/services/matrix/default.nix
@@ -7,7 +7,6 @@
    ./synapse-admin.nix
    ./element.nix
    ./coturn.nix
    ./mjolnir.nix
    ./discord.nix
  ];
--- a/hosts/jokum/services/matrix/discord.nix
+++ b/hosts/jokum/services/matrix/discord.nix
@@ -7,8 +7,6 @@ in
  users.groups.keys-matrix-registrations = { };
  sops.secrets."matrix/registrations/mx-puppet-discord" = {
    sopsFile = ../../../../secrets/bicep/matrix.yaml;
    key = "registrations/mx-puppet-discord";
    owner = config.users.users.matrix-synapse.name;
    group = config.users.groups.keys-matrix-registrations.name;
  };
@@ -32,9 +30,6 @@ in
  services.mx-puppet-discord.serviceDependencies = [ "matrix-synapse.target" "nginx.service" ];
-  services.matrix-synapse-next.settings = {
+  services.matrix-synapse-next.settings.app_service_config_files = [ config.sops.secrets."matrix/registrations/mx-puppet-discord".path ];
    app_service_config_files = [ config.sops.secrets."matrix/registrations/mx-puppet-discord".path ];
    use_appservice_legacy_authorization = true;
  };
 }
--- a/hosts/jokum/services/matrix/element.nix
+++ b/hosts/jokum/services/matrix/element.nix
@@ -1,7 +1,6 @@
 { config, lib, pkgs, ... }:
-let
+
-  synapse-cfg = config.services.matrix-synapse-next;
+{
 in {
  services.nginx.virtualHosts."chat.pvv.ntnu.no" = {
    enableACME = true;
    forceSSL = true;
@@ -42,8 +41,7 @@ in {
        ];
        enable_presence_by_hs_url = {
          "https://matrix.org" = false;
-          # "https://matrix.dodsorf.as" = false;
+          "https://matrix.dodsorf.as" = false;
          "${synapse-cfg.settings.public_baseurl}" = synapse-cfg.settings.presence.enabled;
        };
      };
    };
--- a/hosts/jokum/services/matrix/synapse-admin.nix
+++ b/hosts/jokum/services/matrix/synapse-admin.nix
--- a/hosts/jokum/services/matrix/synapse.nix
+++ b/hosts/jokum/services/matrix/synapse.nix
@@ -1,52 +1,39 @@
-{ config, lib, pkgs, values, inputs, ... }:
+{ config, lib, pkgs, ... }:
 let
  cfg = config.services.matrix-synapse-next;
  matrix-lib = inputs.matrix-next.lib;
  imap0Attrs = with lib; f: set:
    listToAttrs (imap0 (i: attr: nameValuePair attr (f i attr set.${attr})) (attrNames set));
 in {
  sops.secrets."matrix/synapse/dbconfig" = {
    owner = config.users.users.matrix-synapse.name;
    group = config.users.users.matrix-synapse.group;
  };
  sops.secrets."matrix/synapse/signing_key" = {
    key = "synapse/signing_key";
    sopsFile = ../../../../secrets/bicep/matrix.yaml;
    owner = config.users.users.matrix-synapse.name;
    group = config.users.users.matrix-synapse.group;
  };
  sops.secrets."matrix/synapse/user_registration" = {
    sopsFile = ../../../../secrets/bicep/matrix.yaml;
    key = "synapse/signing_key";
    owner = config.users.users.matrix-synapse.name;
    group = config.users.users.matrix-synapse.group;
  };
  sops.secrets."matrix/sliding-sync/env" = {
    sopsFile = ../../../../secrets/bicep/matrix.yaml;
    key = "sliding-sync/env";
  };
  services.matrix-synapse-next = {
    enable = true;
    plugins = [
      (pkgs.python3Packages.callPackage ./smtp-authenticator { })
    ];
    dataDir = "/data/synapse";
    workers.federationSenders = 2;
-    workers.federationReceivers = 2;
+    workers.federationReceivers = 1;
    workers.initialSyncers = 1;
    workers.normalSyncers = 1;
-    workers.eventPersisters = 2;
+    workers.eventPersisters = 1;
    workers.useUserDirectoryWorker = true;
    enableSlidingSync = true;
    enableNginx = true;
    extraConfigFiles = [
      config.sops.secrets."matrix/synapse/dbconfig".path
    ];
    settings = {
      server_name = "pvv.ntnu.no";
      public_baseurl = "https://matrix.pvv.ntnu.no";
@@ -55,26 +42,6 @@ in {
      media_store_path =  "${cfg.dataDir}/media";
      database = {
        name = "psycopg2";
        args = {
          host = "/var/run/postgresql";
          dbname = "synapse";
          user = "matrix-synapse";
          cp_min = 1;
          cp_max = 5;
        };
      };
      presence.enabled = false;
      event_cache_size = "20K"; # Default is 10K but I can't find the factor for this cache
      caches = {
        per_cache_factors = {
          _event_auth_cache = 2.0;
        };
      };
      autocreate_auto_join_rooms = false;
      auto_join_rooms = [
        "#pvv:pvv.ntnu.no" # Main space
@@ -87,20 +54,10 @@ in {
      max_upload_size = "150M";
      enable_metrics = true;
      mau_stats_only = true;
      enable_registration = false;
      registration_shared_secret_path = config.sops.secrets."matrix/synapse/user_registration".path;
-      password_config.enabled = true;
+      password_config.enabled = lib.mkForce false;
      modules = [
        { module = "smtp_auth_provider.SMTPAuthProvider";
          config = {
            smtp_host = "smtp.pvv.ntnu.no";
          };
        }
      ];
      trusted_key_servers = [
        { server_name = "matrix.org"; }
@@ -211,57 +168,41 @@ in {
    };
  };
  services.matrix-synapse.sliding-sync.environmentFile = config.sops.secrets."matrix/sliding-sync/env".path;
  services.redis.servers."".enable = true;
-  services.nginx.virtualHosts."matrix.pvv.ntnu.no" = lib.mkMerge [
+  services.nginx.virtualHosts."matrix.pvv.ntnu.no" = lib.mkMerge [({
  ({
    locations."/.well-known/matrix/server" = {
      return = ''
        200 '{"m.server": "matrix.pvv.ntnu.no:443"}'
      '';
      extraConfig = ''
        default_type application/json;
        add_header Access-Control-Allow-Origin *;
      '';
    };
  })
  ({
    locations = let
-      connectionInfo = w: matrix-lib.workerConnectionResource "metrics" w;
+      isListenerType = type: listener: lib.lists.any (r: lib.lists.any (n: n == type) r.names) listener.resources;
-      socketAddress = w: let c = connectionInfo w; in "${c.host}:${toString (c.port)}";
+      isMetricsListener = l: isListenerType "metrics" l;
      firstMetricsListener = w: lib.lists.findFirst isMetricsListener (throw "No metrics endpoint on worker") w.settings.worker_listeners;
      wAddress = w: lib.lists.findFirst (_: true) (throw "No address in receiver") (firstMetricsListener w).bind_addresses;
      wPort = w: (firstMetricsListener w).port;
      socketAddress = w: "${wAddress w}:${toString (wPort w)}";
      metricsPath = w: "/metrics/${w.type}/${toString w.index}";
      proxyPath = w: "http://${socketAddress w}/_synapse/metrics";
-    in lib.mapAttrs' (n: v: lib.nameValuePair
+    in lib.mapAttrs' (n: v: lib.nameValuePair (metricsPath v) ({ proxyPass = proxyPath v; }))
      (metricsPath v) ({
        proxyPass = proxyPath v;
        extraConfig = ''
          allow ${values.hosts.ildkule.ipv4};
          allow ${values.hosts.ildkule.ipv6};
          deny all;
        '';
      }))
      cfg.workers.instances;
  })
  ({
    locations."/metrics/master/1" = {
      proxyPass = "http://127.0.0.1:9000/_synapse/metrics";
      extraConfig = ''
        allow ${values.hosts.ildkule.ipv4};
        allow ${values.hosts.ildkule.ipv6};
        deny all;
      '';
    };
    locations."/metrics/" = let
-      endpoints = lib.pipe cfg.workers.instances [
+      endpoints = builtins.map (x: "matrix.pvv.ntnu.no/metrics/${x}") [
-        (lib.mapAttrsToList (_: v: v))
+        "master/1"
-        (map (w: "${w.type}/${toString w.index}"))
+        "fed-sender/1"
-        (map (w: "matrix.pvv.ntnu.no/metrics/${w}"))
+        "fed-sender/2"
-      ] ++ [ "matrix.pvv.ntnu.no/metrics/master/1" ];
+        "fed-receiver/1"
        "initial-sync/1"
        "normal-sync/1"
        "event-persist/1"
        "user-dir/1"
      ];
    in {
      alias = pkgs.writeTextDir "/config.json"
        (builtins.toJSON [
--- a/hosts/bekkalokk/services/nginx/default.nix
+++ b/hosts/bekkalokk/services/nginx/default.nix
@@ -1,21 +1,21 @@
-{ pkgs, config, ... }:
+{config, ... }:
 {
  imports = [
    ./ingress.nix
  ];
  security.acme = {
    acceptTerms = true;
-    defaults.email = "drift@pvv.ntnu.no";
+    defaults.email = "danio@pvv.ntnu.no";
  };
  services.nginx = {
    enable = true;
-    recommendedTlsSettings = true;
+    defaultListenAddresses = [ "129.241.210.169" "127.0.0.1" "127.0.0.2" "[2001:700:300:1900::169]" "[::1]" ];
    recommendedProxySettings = true;
-    recommendedOptimisation = true;
+    recommendedTlsSettings = true;
    recommendedGzipSettings = true;
    recommendedOptimisation = true;
  };
  networking.firewall.allowedTCPPorts = [ 80 443 ];
--- a/hosts/shark/configuration.nix
+++ b/hosts/shark/configuration.nix
@@ -1,39 +0,0 @@
 { config, pkgs, values, ... }:
 {
  imports = [
      # Include the results of the hardware scan.
      ./hardware-configuration.nix
      ../../base.nix
      ../../misc/metrics-exporters.nix
    ];
  sops.defaultSopsFile = ../../secrets/shark/shark.yaml;
  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
  sops.age.generateKey = true;
  boot.loader.systemd-boot.enable = true;
  boot.loader.efi.canTouchEfiVariables = true;
  networking.hostName = "shark"; # Define your hostname.
  systemd.network.networks."30-ens18" = values.defaultNetworkConfig // {
    matchConfig.Name = "ens18";
    address = with values.hosts.shark; [ (ipv4 + "/25") (ipv6 + "/64") ];
  };
  # List packages installed in system profile
  environment.systemPackages = with pkgs; [
  ];
  # List services that you want to enable:
  # This value determines the NixOS release from which the default
  # settings for stateful data, like file locations and database versions
  # on your system were taken. It‘s perfectly fine and recommended to leave
  # this value at the release version of the first install of this system.
  # Before changing this value read the documentation for this option
  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
  system.stateVersion = "23.05"; # Did you read the comment?
 }
--- a/hosts/shark/hardware-configuration.nix
+++ b/hosts/shark/hardware-configuration.nix
@@ -1,38 +0,0 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
 { config, lib, pkgs, modulesPath, ... }:
 {
  imports =
    [ (modulesPath + "/profiles/qemu-guest.nix")
    ];
  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
  boot.initrd.kernelModules = [ ];
  boot.kernelModules = [ ];
  boot.extraModulePackages = [ ];
  fileSystems."/" =
    { device = "/dev/disk/by-uuid/224c45db-9fdc-45d4-b3ad-aaf20b3efa8a";
      fsType = "ext4";
    };
  fileSystems."/boot" =
    { device = "/dev/disk/by-uuid/CC37-F5FE";
      fsType = "vfat";
    };
  swapDevices =
    [ { device = "/dev/disk/by-uuid/a1ce3234-78b1-4565-9643-f4a05004424f"; }
    ];
  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
  # (the default) this is the recommended approach. When using systemd-networkd it's
  # still possible to use this option, but it's recommended to use it in conjunction
  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
  networking.useDHCP = lib.mkDefault true;
  # networking.interfaces.ens18.useDHCP = lib.mkDefault true;
  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
 }
--- a/misc/builder.nix
+++ b/misc/builder.nix
@@ -1,5 +0,0 @@
 { ... }:
 {
  nix.settings.trusted-users = [ "@nix-builder-users" ];
 }
--- a/misc/metrics-exporters.nix
+++ b/misc/metrics-exporters.nix
@@ -1,60 +0,0 @@
 { config, pkgs, values, ... }:
 {
  services.prometheus.exporters.node = {
    enable = true;
    port = 9100;
    enabledCollectors = [ "systemd" ];
  };
  systemd.services.prometheus-node-exporter.serviceConfig = {
    IPAddressDeny = "any";
    IPAddressAllow = [
      "127.0.0.1"
      "::1"
      values.hosts.ildkule.ipv4
      values.hosts.ildkule.ipv6
    ];
  };
  networking.firewall.allowedTCPPorts = [ 9100 ];
  services.promtail = {
    enable = true;
    configuration = {
      server = {
        http_listen_port = 28183;
        grpc_listen_port = 0;
      };
      clients = [
        {
          url = "http://ildkule.pvv.ntnu.no:3100/loki/api/v1/push";
        }
      ];
      scrape_configs = [
        {
          job_name = "systemd-journal";
          journal = {
            max_age = "12h";
            labels = {
              job = "systemd-journal";
              host = config.networking.hostName;
            };
          };
          relabel_configs = [
            {
              source_labels = [ "__journal__systemd_unit" ];
              target_label = "unit";
            }
            {
              source_labels = [ "__journal_priority_keyword" ];
              target_label = "level";
            }
          ];
        }
      ];
    };
  };
 }
--- a/modules/grzegorz.nix
+++ b/modules/grzegorz.nix
@@ -1,62 +0,0 @@
 {config, lib, pkgs, ...}:
 let
  grg = config.services.grzegorz;
  grgw = config.services.grzegorz-webui;
 in {
  services.pipewire.enable = true;
  services.pipewire.alsa.enable = true;
  services.pipewire.alsa.support32Bit = true;
  services.pipewire.pulse.enable = true;
  users.users.pvv = {
    isNormalUser = true;
    description = "pvv";
  };
  services.grzegorz.enable = true;
  services.grzegorz.listenAddr = "localhost";
  services.grzegorz.listenPort = 31337;
  services.grzegorz-webui.enable = true;
  services.grzegorz-webui.listenAddr = "localhost";
  services.grzegorz-webui.listenPort = 42069;
  services.grzegorz-webui.listenWebsocketPort = 42042;
  services.grzegorz-webui.hostName = "${config.networking.fqdn}";
  services.grzegorz-webui.apiBase = "http://${toString grg.listenAddr}:${toString grg.listenPort}/api";
  security.acme.acceptTerms = true;
  security.acme.defaults.email = "pederbs@pvv.ntnu.no";
  services.nginx.enable = true;
  networking.firewall.allowedTCPPorts = [ 80 443 ];
  services.nginx.virtualHosts."${config.networking.fqdn}" = {
    forceSSL = true;
    enableACME = true;
    serverAliases = [
      "${config.networking.hostName}.pvv.org"
    ];
    extraConfig = ''
      allow 129.241.210.128/25;
      allow 2001:700:300:1900::/64;
      deny all;
    '';
    locations."/" = {
      proxyPass = "http://localhost:${builtins.toString config.services.grzegorz-webui.listenPort}";
    };
    # https://github.com/rawpython/remi/issues/216
    locations."/websocket" = {
      proxyPass = "http://localhost:${builtins.toString config.services.grzegorz-webui.listenWebsocketPort}";
      proxyWebsockets = true;
    };
    locations."/api" = {
      proxyPass = "http://localhost:${builtins.toString config.services.grzegorz.listenPort}";
    };
    locations."/docs" = {
      proxyPass = "http://localhost:${builtins.toString config.services.grzegorz.listenPort}";
    };
  };
 }
--- a/overlays-compat/overlays.nix
+++ b/overlays-compat/overlays.nix
@@ -0,0 +1,8 @@
 self: super:
 with super.lib;
 let
  # Load the system config and get the `nixpkgs.overlays` option
  overlays = (import <nixpkgs/nixos> { }).config.nixpkgs.overlays;
 in
  # Apply all overlays to the input of the current "main" overlay
  foldl' (flip extends) (_: super) overlays self
--- a/pkgs/minecraft-server-fabric/default.nix
+++ b/pkgs/minecraft-server-fabric/default.nix
@@ -0,0 +1,43 @@
 { callPackage, writeTextFile, writeShellScriptBin, minecraft-server, jre_headless }:
 let
  loader = callPackage ./generate-loader.nix {};
  log4j = writeTextFile {
    name = "log4j.xml";
    text = ''
      <?xml version="1.0" encoding="UTF-8"?>
      <Configuration status="WARN" packages="com.mojang.util">
          <Appenders>
              <Console name="SysOut" target="SYSTEM_OUT">
                  <PatternLayout pattern="[%d{HH:mm:ss}] [%t/%level]: %msg%n" />
              </Console>
              <Queue name="ServerGuiConsole">
                  <PatternLayout pattern="[%d{HH:mm:ss} %level]: %msg%n" />
              </Queue>
              <RollingRandomAccessFile name="File" fileName="logs/latest.log" filePattern="logs/%d{yyyy-MM-dd}-%i.log.gz">
                  <PatternLayout pattern="[%d{HH:mm:ss}] [%t/%level]: %msg%n" />
                  <Policies>
                      <TimeBasedTriggeringPolicy />
                      <OnStartupTriggeringPolicy />
                  </Policies>
                  <DefaultRolloverStrategy max="1000"/>
              </RollingRandomAccessFile>
          </Appenders>
          <Loggers>
              <Root level="info">
                  <filters>
                      <MarkerFilter marker="NETWORK_PACKETS" onMatch="DENY" onMismatch="NEUTRAL" />
                  </filters>
                  <AppenderRef ref="SysOut"/>
                  <AppenderRef ref="File"/>
                  <AppenderRef ref="ServerGuiConsole"/>
              </Root>
          </Loggers>
      </Configuration>
    '';
  };
 in
 writeShellScriptBin "minecraft-server" ''
  echo "serverJar=${minecraft-server}/lib/minecraft/server.jar" >> fabric-server-launcher.properties
  exec ${jre_headless}/bin/java -Dlog4j.configurationFile=${log4j} $@ -jar ${loader} nogui
 ''
--- a/pkgs/minecraft-server-fabric/generate-loader.nix
+++ b/pkgs/minecraft-server-fabric/generate-loader.nix
@@ -0,0 +1,38 @@
 { lib, fetchurl, stdenv, unzip, zip, jre_headless }:
 let
  lock = import ./lock.nix;
  libraries = lib.forEach lock.libraries fetchurl;
 in
 stdenv.mkDerivation {
  name = "fabric-server-launch.jar";
  nativeBuildInputs = [ unzip zip jre_headless ];
  libraries = libraries;
  buildPhase = ''
    for i in $libraries; do
      unzip -o $i
    done
    cat > META-INF/MANIFEST.MF << EOF
    Manifest-Version: 1.0
    Main-Class: net.fabricmc.loader.impl.launch.server.FabricServerLauncher
    Name: org/objectweb/asm/
    Implementation-Version: 9.2
    EOF
    cat > fabric-server-launch.properties << EOF
    launch.mainClass=net.fabricmc.loader.impl.launch.knot.KnotServer
    EOF
  '';
  installPhase = ''
    jar cmvf META-INF/MANIFEST.MF "server.jar" .
    zip -d server.jar 'META-INF/*.SF' 'META-INF/*.RSA' 'META-INF/*.DSA'
    cp server.jar "$out"
  '';
  phases = [ "buildPhase" "installPhase" ];
 }
--- a/pkgs/minecraft-server-fabric/generate-lock-nix.sh
+++ b/pkgs/minecraft-server-fabric/generate-lock-nix.sh
@@ -0,0 +1,22 @@
 #!/usr/bin/env nix-shell
 #!nix-shell -i bash -p bash curl jq
 curl https://meta.fabricmc.net/v2/versions/loader/1.18.1/0.12.12/server/json \
 | jq -r '
  .mainClass,
  (.libraries[]
  | .url as $url
  | .name | split(":") as [$dir, $name, $version]
  |"\($name)-\($version).zip|\($url)\($dir|sub("\\.";"/";"g"))/\($name)/\($version)/\($name)-\($version).jar"
  )' \
 | {
    echo '{'
    read mainClass;
    echo "  mainClass = \"$mainClass\";"
    echo "  libraries = ["
    while IFS="|" read name url; do
        hash=$(nix-prefetch-url $url);
        echo "    { name = \"$name\"; sha256 = \"$hash\"; url = \"$url\"; }"
    done
    echo "  ];"
    echo '}'
 }
--- a/pkgs/minecraft-server-fabric/lock.nix
+++ b/pkgs/minecraft-server-fabric/lock.nix
@@ -0,0 +1,16 @@
 {
  mainClass = "net.fabricmc.loader.impl.launch.knot.KnotServer";
  libraries = [
    { name = "tiny-mappings-parser-0.3.0+build.17.zip"; sha256 = "19kvhxfk5v01f2rvl7j02vqhn3nd2bh5jsgbk44rpzqv9f6074db"; url = "https://maven.fabricmc.net/net/fabricmc/tiny-mappings-parser/0.3.0+build.17/tiny-mappings-parser-0.3.0+build.17.jar"; }
    { name = "sponge-mixin-0.10.7+mixin.0.8.4.zip"; sha256 = "18m5wksd9vjp676cxapkggnz8s3f8j89phln8gy5n8vxlrli8n0d"; url = "https://maven.fabricmc.net/net/fabricmc/sponge-mixin/0.10.7+mixin.0.8.4/sponge-mixin-0.10.7+mixin.0.8.4.jar"; }
    { name = "tiny-remapper-0.6.0.zip"; sha256 = "1ynjfxg7cj9rd9c4l450w7yp20p2csjdpnk3mcx5bdkjzhbgvgzf"; url = "https://maven.fabricmc.net/net/fabricmc/tiny-remapper/0.6.0/tiny-remapper-0.6.0.jar"; }
    { name = "access-widener-2.0.1.zip"; sha256 = "0a7s4x6dbaa9p59ps7pidzwrs0xwy5i17s35xrgh58i26szlsaxm"; url = "https://maven.fabricmc.net/net/fabricmc/access-widener/2.0.1/access-widener-2.0.1.jar"; }
    { name = "asm-9.2.zip"; sha256 = "1xa7kccwmcqcdw1xly6n2frzhk56m8ma9v7h764g73ckf56zxm5r"; url = "https://maven.fabricmc.net/org/ow2/asm/asm/9.2/asm-9.2.jar"; }
    { name = "asm-analysis-9.2.zip"; sha256 = "1i1kyirizs5sm2v0f06sdz86mbmyn61vjr9d9p8p5h1i2x9bx3w7"; url = "https://maven.fabricmc.net/org/ow2/asm/asm-analysis/9.2/asm-analysis-9.2.jar"; }
    { name = "asm-commons-9.2.zip"; sha256 = "19p04mr14ahndba65v4krbvf4p5syf8wz0fp5i9bnf5270qyak5y"; url = "https://maven.fabricmc.net/org/ow2/asm/asm-commons/9.2/asm-commons-9.2.jar"; }
    { name = "asm-tree-9.2.zip"; sha256 = "04g0zb7v65iz4k2m2grdpbv8jjryrzkkw7ww23yfp94i6399pgxa"; url = "https://maven.fabricmc.net/org/ow2/asm/asm-tree/9.2/asm-tree-9.2.jar"; }
    { name = "asm-util-9.2.zip"; sha256 = "16759v4hh3ijpf4cglrxybz29x2hiylhsa388y09m2mf679kqnzz"; url = "https://maven.fabricmc.net/org/ow2/asm/asm-util/9.2/asm-util-9.2.jar"; }
    { name = "intermediary-1.18.1.zip"; sha256 = "1rfz2gazvnivn6hlqiyjpiaycz8va87n5czy1p6w3lnrlfggj2i9"; url = "https://maven.fabricmc.net/net/fabricmc/intermediary/1.18.1/intermediary-1.18.1.jar"; }
    { name = "fabric-loader-0.12.12.zip"; sha256 = "070dpcp7kcj4xr75wp1j6pb1bgfzllwg8xmqk3sk79jfqiqwzizw"; url = "https://maven.fabricmc.net/net/fabricmc/fabric-loader/0.12.12/fabric-loader-0.12.12.jar"; }
  ];
 }
--- a/pkgs/minecraft-server/1_18_1.nix
+++ b/pkgs/minecraft-server/1_18_1.nix
@@ -0,0 +1,38 @@
 { lib, stdenv, fetchurl, nixosTests, jre_headless }:
 stdenv.mkDerivation {
  pname = "minecraft-server";
  version = "1.18.1";
  src = fetchurl {
    url = "https://launcher.mojang.com/v1/objects/125e5adf40c659fd3bce3e66e67a16bb49ecc1b9/server.jar";
    # sha1 because that comes from mojang via api
    sha1 = "125e5adf40c659fd3bce3e66e67a16bb49ecc1b9";
  };
  preferLocalBuild = true;
  installPhase = ''
    mkdir -p $out/bin $out/lib/minecraft
    cp -v $src $out/lib/minecraft/server.jar
    cat > $out/bin/minecraft-server << EOF
    #!/bin/sh
    exec ${jre_headless}/bin/java \$@ -jar $out/lib/minecraft/server.jar nogui
    EOF
    chmod +x $out/bin/minecraft-server
  '';
  dontUnpack = true;
  passthru = {
    tests = { inherit (nixosTests) minecraft-server; };
    updateScript = ./update.sh;
  };
  meta = with lib; {
    description = "Minecraft Server";
    homepage = "https://minecraft.net";
    license = licenses.unfreeRedistributable;
    platforms = platforms.unix;
    maintainers = with maintainers; [ thoughtpolice tomberek costrouc ];
  };
 }
--- a/secrets/bekkalokk/bekkalokk.yaml
+++ b/secrets/bekkalokk/bekkalokk.yaml
@@ -1,73 +0,0 @@
 gitea:
    password: ENC[AES256_GCM,data:hlNzdU1ope0t50/3aztyLeXjMHd2vFPpwURX+Iu8f49DOqgSnEMtV+KtLA==,iv:qljRnSnchL5cFmaUAfCH9GQYQxcy5cyWejgk1x6bFgI=,tag:tIhboFU5kZsj5oAQR3hLbw==,type:str]
    database: ENC[AES256_GCM,data:UlS33IdCEyeSvT6ngpmnkBWHuSEqsB//DT+3b7C+UwbD8UXWJlsLf1X8/w==,iv:mPRW5ldyZaHP+y/0vC2JGSLZmlkhgmkvXPk4LazkSDs=,tag:gGk6Z/nbPvzE1zG+tJC8Sw==,type:str]
    passwd-ssh-key: ENC[AES256_GCM,data:L0lF0wvpayss1NU9m3A45cH0bCMQzODTFVrq6EPd1JHx54wIcoaRBYLmxXKXASzBlCg9zlwXMUIk3OQcS3kdzMKL0iqcSL2iicAcKjFIHyrWLqXgwV5pRSP/tRPcVw8KW8gz0bh33EgESs5ReddZ3VZ0Cy1s2YupMRQvBXr89k1+Hv70OWB6P06hvxhv/zKcMGI1N/dWLroMgrQuT9imw4+/Q1RqwzTYeEU+eUn24AM9GjcBg4qf3OI+6g0nXUat/upIYE28iF5J3lbUSmDSmirBLc8xgHLdOyyJPTObWYWYxlSL78T7IqiMm9lI3rtBlpJDDcn/YxZpVqN5bg2154GISNK+uR0TVSLdJ+drdGHIfIX3G78XSxf2L9rbJyRn8MQlgStfdBIQicLavQKVMrmj+XQfvEMez23WbPLjH4oViBQFI+GrOHOGy/f16cz8Sn4n+69OcsOeTxs3tKYdfq6r1XLYSJ/fe/zvxBpaZiyGXljsuyEdIyBL2A8D6uSXe3Nd3/DAdBtceFfIdN1olCdutixzVWgxaJnrel161z5A/4w=,iv:Uy46yY3jFYSvpxrgCHxRMUksnWfhf5DViLMvCXVMMl4=,tag:wFEJ5+icFrOKkc56gY0A5g==,type:str]
    ssh-known-hosts: ENC[AES256_GCM,data:zlRLoelQeumMxGqPmgMTB69X1RVWXIs2jWwc67lk0wrdNOHUs5UzV5TUA1JnQ43RslBU92+js7DkyvE5enGzw7zZE5F1ZYdGv/eCgvkTMC9BoLfzHzP6OzayPLYEt3xJ5PRocN8JUAD55cuu4LgsuebuydHPi2oWOfpbSUBKSeCh6dvk5Pp1XRDprPS5SzGLW8Xjq98QlzmfGv50meI9CDJZVF9Wq/72gkyfgtb3YVdr,iv:AF06TBitHegfWk6w07CdkHklh4ripQCmA45vswDQgss=,tag:zKh7WVXMJN2o9ZIwIkby3Q==,type:str]
    import-user-env: ENC[AES256_GCM,data:vfaqjGEnUM9VtOPvBurz7nFwzGZt3L2EqijrQej4wiOcGCrRA4tN6kBV6NmhHqlFPsw=,iv:viPGkyOOacCWcgTu25da4qH7DC4wz2qdeC1W2WcMUdI=,tag:BllNqGQoaxqUo3lTz9LGnw==,type:str]
    runners:
        alpha: ENC[AES256_GCM,data:gARxCufePz+EMVwEwRsL2iZUfh9HUowWqtb7Juz3fImeeAdbt+k3DvL/Nwgegg==,iv:3fEaWd7v7uLGTy2J7EFQGfN0ztI0uCOJRz5Mw8V5UOU=,tag:Aa6LwWeW2hfDz1SqEhUJpA==,type:str]
        beta: ENC[AES256_GCM,data:DVjS78IKWiWgf+PuijCZKx4ZaEJGhQr7vl+lc7QOg1JlA4p9Kux/tOD8+f2+jA==,iv:tk3Xk7lKWNdZ035+QVIhxXy2iJbHwunI4jRFM4It46E=,tag:9Mr6o//svYEyYhSvzkOXMg==,type:str]
        epsilon: ENC[AES256_GCM,data:JMnZVBdiy+5oPyXgDpfYvy7qLzIEfHy09fQSBDpNG4zDXTil2pSKBKxk09h5xg==,iv:/8oXKJW6+sMBjDt51MqVAWjQPM5nk02Lv5QqbZsZ5ms=,tag:+Rx7ursfVWc0EcExCLgLhQ==,type:str]
 mediawiki:
    password: ENC[AES256_GCM,data:HsBuA1E7187roGnKuFPfPDYxA16GFjAUucgUtrdUFmcOzmTNiFH+NWY2ZQ==,iv:vDYUmmZftcrkDtJxNYKAJSx9j+AQcmQarC62QRHR4IM=,tag:3TKjNrGRivFWoK3djC748g==,type:str]
    database: ENC[AES256_GCM,data:EvVK3Mo6cZiIZS+gTxixU4r9SXN41VqwaWOtortZRNH+WPJ4xcYvzYMJNg==,iv:JtFTRLn3fzKIfgAPRqRgQjct7EdkEHtiyQKPy8/sZ2Q=,tag:nqzseG6BC0X5UNI/3kZZ3A==,type:str]
 keycloak:
    database: ENC[AES256_GCM,data:76+AZnNR5EiturTP7BdOCKE90bFFkfGlRtviSP5NHxPbb3RfFPJEMlwtzA==,iv:nS7VTossHdlrHjPeethhX+Ysp9ukrb5JD7kjG28OFpY=,tag:OMpiEv9nQA7v6lWJfNxEEw==,type:str]
 sops:
    kms: []
    gcp_kms: []
    azure_kv: []
    hc_vault: []
    age:
        - recipient: age12nj59tguy9wg882updc2vjdusx5srnxmjyfaqve4zx6jnnsaw3qsyjq6zd
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDbDc0NXZqYko1Z25qYkhq
            T2p4cGZ1bTZRS25YdjJ0K3JhSklCT1NwSHhzCi9MVnM2YTRuUERwTVlaM2lxNEtp
            Mk9hcDREcTErZXJtSEI0aE1PV2NDV1EKLS0tIDY2MEN6a3NWb3JpeU5JVkhoOFVR
            MjVqdHg0SnF5N3VEV2U4a2dvbTZjem8K8J6KQMJwpiC8gqlgi29x3dpSORAmuVQ6
            cX5jXggOoz5vME6BMQ3s/bglZG2pdEgWpGZVbc4x2iMwUWgJLHdgXg==
            -----END AGE ENCRYPTED FILE-----
        - recipient: age17tagmpwqjk3mdy45rfesrfey6h863x8wfq38wh33tkrlrywxducs0k6tpq
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1SHMrVmxsL0orQlk3dy9H
            NDMzWEZYMXhkamVkTy84VGEzUm1BU3lNY2dNCkNwOGJteVQzYlZESGlScTg0RnFx
            emNXbmZhL3BHWThPRUI4MVIzMU1POTgKLS0tIHRmQ0llR1NCSm9KMHZsOGJXYmxk
            eGpDUlFHdEZmWkZHTEw4Mmk2UWRnUU0Ki5GK2mzDIc2iTryjn6lf5lMqVZcCcxQ2
            a3Y/o/NMFDhMZpLlEljuWQVnuOyJZ3RSDCFN9BSEkxg05PaoSluUzQ==
            -----END AGE ENCRYPTED FILE-----
        - recipient: age1mrnldl334l2nszuta6ywvewng0fswv2dz9l5g4qcwe3nj4yxf92qjskdx6
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZY2ZiazhzdkxNZFZldjBV
            SjBCR2lXdFZZUUpJTnJVWUVMNTcybGQvbmpNClVDOEdMK0JIOUEvaVYxcm4yeVp4
            dVY5b292WVE5L2JXNGQvSENiTjBWVkkKLS0tIGIvdzBxMVNYbGN4ZXBBNDg1bFNB
            akVjeTNTeGorZjJQOVlMeCtPRUVYL3MK+VMvGxrbzGz4Q3sdaDDWjal+OiK+JYKX
            GHiMXVHQJZu/RrlxMjHKN6V3iaqxZpuvLAEJ2Lzy5EOHPtuiiRyeHQ==
            -----END AGE ENCRYPTED FILE-----
    lastmodified: "2023-09-17T02:02:24Z"
    mac: ENC[AES256_GCM,data:Lkvj9UOdE/WZtFReMs6n8ucFuJNPb76ZhPHFpYAEqYEe8d9FdMPMzq05DBAJe9IqpFS0jc9SWxJUPHfGgoMR8nPciZuR/mpJ+4s/cRkPbApwBPcLlvatE/qkbcxzoLlb1vN0gth5G/U7UEfk5Pp9gIz6Yo4sEIS3Za42tId1MpI=,iv:s3VELgU/RJ98/lbQV3vPtOLXtwFzB3KlY7bMKbAzp/g=,tag:D8s0XyGnd8UhbCseB/TyFg==,type:str]
    pgp:
        - created_at: "2023-05-21T00:28:40Z"
          enc: |
            -----BEGIN PGP MESSAGE-----
            hQIMA0av/duuklWYAQ//TewS5bITIo3bx0HEM0p8bwnSJAmNqGJmuILXg4k8eszF
            JHS9eCfU/Vz4Z8eMDJjntFIWvNCl0QOycvp37uNaqPedDE3v1nNpCxOZ76vLT9I5
            smXKpRmfgYxQAkWQRJ6aUV+DoVjSY/hT9JWD7u4uWgavG5D7/3SwiJC3uM0/8mxM
            gwbp5eVEO0mTvXZsmqIRJ00NKX+RIMuUZFvzu3ajGywZfQxFs7zUhx7Lc6ry/MYI
            FFrbXssgpH8U9dHMgBsGzeyQS4qQLGFHJuNBBzz48U+Dr5EgHqZ2ZXZschW+40qX
            TH8d4qyOROTiHKpKp3+nUoRiz1JPkJ0rqHg+9hOrFNpl1NZQ6w1UOc+0Ki6ZAwMd
            yNF733/I+OaI2b4nxhG+la6U9Z1fOat3BPRoxp8ZlLRrPq8ljxV78TMVfv7/lPO6
            MZopBmSOeV19t/QypYi2pl+QYRaVs2QaBFotulob+KbKpWC4T2tMEMnPngsTxOhk
            26VY5ahIp01QbewPxylpY6r1jx1tb8KcMmsGlaLrgOo9Q526bh5QGRDx9NCj064c
            uJ2ed7hY9tNHs6qN/94rcr1hOAq5kVh+36UvJBZYQuxwIXIws4Xw+obzoKVAAqEC
            qEZWL1NB0hXynom7Vc2e2MzT2guogXDHvlCDHjtt9ekGcmU+tQ/JdgTOJ93hEInS
            XgEjcd1xpnzebDo9SpNBq/J/uSKAKLPOI2y+LZzvs6oiFtc4QLcgGors38x9SiAP
            JSiQnUAC9XZtiugGdCOVy6MG1x3smAafW6kcH7yr+vWoJoQLbbF60PhuhAJ0N4Q=
            =3iQC
            -----END PGP MESSAGE-----
          fp: F7D37890228A907440E1FD4846B9228E814A2AAC
    unencrypted_suffix: _unencrypted
    version: 3.7.3
--- a/secrets/bicep/bicep.yaml
+++ b/secrets/bicep/bicep.yaml
@@ -1,62 +0,0 @@
 calendar-bot:
    matrix_token: ENC[AES256_GCM,data:zJv9sw6pEzb9hxKT682wsD87HC9iejbps2wl2Z5QW1XZUSBHdcqyg1pxd+jFKTeKGQ==,iv:zDbvF1H98NsECjCtGXS+Y9HIhXowzz9HF9mltqnArog=,tag:/ftcOSQ13ElkVJBxYIMUGQ==,type:str]
 mysql:
    password: ENC[AES256_GCM,data:KqEe0TVdeMIzPKsmFg9x0X9xWijnOk306ycyXTm2Tpqo/O0F,iv:Y+hlQ8n1ZIP9ncXBzd2kCSs/DWVTWhiEluFVwZFKRCA=,tag:xlaUk0Wftk62LpYE5pKNQw==,type:str]
 sops:
    kms: []
    gcp_kms: []
    azure_kv: []
    hc_vault: []
    age:
        - recipient: age1sl43gc9cw939z5tgha2lpwf0xxxgcnlw7w4xem4sqgmt2pt264vq0dmwx2
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2RFpLOEtUQ0ZLeUdmTGxl
            VXlTOG82Ly8vdjdldnB0dGFzTkdxUHNML1VJCmxDWHhyMHYrbmtMVWVJYTdrWjVn
            aE5qWWtHWSszYnNWc3l2VmFwUGl4R3MKLS0tIG9ocThFNm1pcUtMNHNlMlFsS2lx
            MDhubWVxamxlSVk0dUtIWnhyUlBNM00KRunPljgLCHkwn4HCPGpkNbLitCIF7hYL
            jRYVzu+Wddd13A4QfvHvAI7bJB5Zsv/xwmggVlICG1pky7gPNDwGcA==
            -----END AGE ENCRYPTED FILE-----
        - recipient: age17tagmpwqjk3mdy45rfesrfey6h863x8wfq38wh33tkrlrywxducs0k6tpq
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvem5LODRyU0VlcElOS0tY
            a1FaNHc0SDJLQ1llalBqQ2VEQjZpbUFyd0hNCldQNUpTdFZ5NTlxWU9icXN2Mm5a
            S0JQOUkvdEZRK3NBOGpEZkJleTB1TXMKLS0tIHdVcFRETFlBVWI3TTZYZGJMMkcv
            RkRXTTVURDRFNjFvci8zRVpqbkxVclEKW86hoVO0grt2x5YMt/YnmDI6J0QFKjZZ
            Mnmd/Z1S6a+rajCy0GkeM+Q8AbBqBrNei2H5Xp1PlxNyicGib6+Ngg==
            -----END AGE ENCRYPTED FILE-----
        - recipient: age1mrnldl334l2nszuta6ywvewng0fswv2dz9l5g4qcwe3nj4yxf92qjskdx6
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4bHNiY3ZCNHZsYlUrOHMy
            OG55QjVmQVUxbXl0bkdNQ0FEais5Sng0ZkRBCm5KdmMvNmN6VmdsREZrbGd4ZFpM
            VVpsQk43MlBxU042ZkE4L1hHK1R4RVEKLS0tIGttL01XcG1IUnBMbUVqKzJMK09o
            QmVlRnJhSk4xYWFVbGVxdlFxSDlXSGMKJvjMDaX4Aa98gT+GPjGaKKdnG67jNG3C
            nLsbxU4vNpFvjF4WI5vdvIQe5UGzoCYQZp3oHFnGq+Jp/hJ1HFF0GQ==
            -----END AGE ENCRYPTED FILE-----
    lastmodified: "2023-09-05T23:28:56Z"
    mac: ENC[AES256_GCM,data:pCWTkmCQgBOqhejK2sCLQ3H8bRXmXlToQxYmOG0IWDo2eGiZOLuIkZ1/1grYgfxAGiD4ysJod0nJuvo+eAsMeYAy6QJVtrOqO2d9V2NEdzLckXyYvwyJyZoFbNC5EW9471V0m4jLRSh5821ckNo/wtWFR11wfO15tI3MqtD1rtA=,iv:QDnckPl0LegaH0b7V4WAtmVXaL4LN+k3uKHQI2dkW7E=,tag:mScUQBR0ZHl1pi/YztrvFg==,type:str]
    pgp:
        - created_at: "2023-08-27T00:12:42Z"
          enc: |
            -----BEGIN PGP MESSAGE-----
            hQIMA0av/duuklWYAQ//edQVXnTS4Xarwt14tF6yyhWM9/JFSVWW97lTO6xTNe5S
            jNROmF/tHl29IPX0/QHXj/d4jMF/nteHdD53nD9s312CPOBv3SEwl4e7hfMf3rUN
            4YOahX9J4ryoB+ZleK5leoYSsWaVBDJfERMkYT9Ta/xv4EC5zHBTlZDpLRuS04eZ
            W5MG57TKBC0oifPvhCuv22OURNUp9t/bysSuKgU1v0Czu6ozuVgw9AO8G+PstFpW
            7lyIMUNJQ7g3hiKDrrPPYcrKTeBbhxTINObe29nv00y0lycnfx3PxWrXpBoyv82y
            xRgtalVvlYre1w6IFkqDFtpJD6N3zPFnPq4ZQ0nHN7A943Kxli5JnlkRH9Ak098K
            PuykZ+V2X+qFNf4LS+Gnjx9wZKaLEChMaDhILUDKuUcwPIU5EiaaBOS1Y8NQ4Lha
            pzyWzvpejV87Qvg2iog9UYLsK33GuxcFzYaklnknrI+9SotM7LRGQTVkVOwykh86
            8d+Sake0J/1xjOcxUNbaYreTA3myyklVlvoybyNOdSzxGveEq3KvGgcORnQxYwe3
            QDoCdVNTmU5ELwDPALVMenDr7VixN085oJkYqZJ6v5E0K1Bhtrb6PItoC5Kea55s
            zWP+0rYxFx884cqpf8/JuC1Jbs1DpljqMMW9aD6A0htzOwEyHzDKWxy7zxCJrgjS
            XgFHIr6sG1geqUzIhw8NzUpdOkdlQ6YFKP3MsUfxIqPHWVQWt1+LLvA5BX/wXIe6
            kPTa9qXwmK7Hrh5TyPPEjrO16qT3UE0nvRAI0s79L6U+99xXfhKIXhg2OMSZCR8=
            =xnr5
            -----END PGP MESSAGE-----
          fp: F7D37890228A907440E1FD4846B9228E814A2AAC
    unencrypted_suffix: _unencrypted
    version: 3.7.3
--- a/secrets/bicep/matrix.yaml
+++ b/secrets/bicep/matrix.yaml
@@ -1,70 +0,0 @@
 synapse:
    turnconfig: ENC[AES256_GCM,data:mASRjYa4C9WRow4x0XYRrlCE5LMJUYaId+o62r1qhsyJPa2LzrI=,iv:5vYdubvMDjLS6soiWx2DzkEAATb9NFbSS/Jhuuz1yI8=,tag:wOW07CQMDbOiZNervee/pg==,type:str]
    user_registration: ENC[AES256_GCM,data:ZDZfEEvyw8pg0WzhrdC8747ed+ZR2ZA8/WypJd/iDkmIy2RmxOeI0sE=,iv:l61mOlvzpCql4fC/eubBSU6px21et2WcpxQ6rFl14iw=,tag:sVDEAa3xipKIi/6isCjWew==,type:str]
    signing_key: ENC[AES256_GCM,data:6UpfiRlX9pRM7zhdm7Mc8y8EItLzugWkHSgE0tGpEmudCTa1wc60oNbYfhKDWU81DT/U148pZOoX1A==,iv:UlqCPicPm5eNBz1xBMI3A3Rn4t/GtldNIDdMH5MMnLw=,tag:HHaw6iMjEAv5b9mjHSVpwA==,type:str]
 sliding-sync:
    env: ENC[AES256_GCM,data:DsU1qKTy5sn06Y0S5kFUqZHML20n6HdHUdXsQRUw,iv:/TNTc+StAZbf6pBY9CeXdxkx8E+3bak/wOqHyBNMprU=,tag:er5u4FRlSmUZrOT/sj+RhQ==,type:str]
 coturn:
    static-auth-secret: ENC[AES256_GCM,data:y5cG/LyrorkDH+8YrgcV7DY=,iv:ca90q2J3+NOy51mUBy4TMKfYMgWL4hxWDdsKIuxRBgU=,tag:hpFCns1lpi07paHyGB7tGQ==,type:str]
 mjolnir:
    access_token: ENC[AES256_GCM,data:ERFqZjK7MRD0xWt91FNCIxP1YC6Qj54QgnckHlCTtcQVLWaM1h2h9lHS+K8=,iv:1d7vmFkXAPcsmumzlmOT31amdrKLWtL5sJiS8G9g+LE=,tag:2l0vWzJ6P12ofuBdf5CCWw==,type:str]
 registrations:
    mx-puppet-discord: ENC[AES256_GCM,data:FleyXxgOmc05nTP6M2DBJlacufN3p/05eZm4kB8+K4ci0k24o3zli988wlM/kyeZmxu4pgQlJ3lNLte4uip2hBXHWG5t5Ldzmr7bNCUD+r7nM+I1lfNkrDROPZ54bHysmn9O5CHpEa16rSo6RJgncIPqsLJxTwjC7qZlkOpzqvMhkq/MHCVOpvg0M/6AUR+AlSZoggujBMoXLznQNQapN13foEsbuo/QxjszM/ObGmhYMVyaS+TDBXzQLA8Yuj50Q/gZCIINWZ4G2qmgsGxxNR4I+usUQml/jxCtIXS4zn/ettXfL9G4Fdm2F9u1v11DehtTGa5xoxDq94M9rIxOqeJpvgEQEyyKAyFUIrlINfGl7tAj4Zu7+9Z8JTRAnppjM1q8iInwn/Z2L9KgB0YFi/Go1whgXly+TH6hpreo7m5klXV/ff/aV3ghOgFCGA8nBrZFqE8Uw268q9tV1s1dxCb6TbpGf19V5c9MD6BsCIVeoq+j9I/I8iZpzg2Reb4IlHhMDwbwsL2w2ks30wiZ9XO/CFrXDY4uBlI=,iv:3vvkGvldS8Raibg6tzlV8VY1O9NCLxSuNX/lwi1QgiA=,tag:D/noIsE3xlOiYM6Pk+cc8Q==,type:str]
 sops:
    kms: []
    gcp_kms: []
    azure_kv: []
    hc_vault: []
    age:
        - recipient: age1sl43gc9cw939z5tgha2lpwf0xxxgcnlw7w4xem4sqgmt2pt264vq0dmwx2
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSZ1dKNy93WmNTVkNzOE50
            SGQ3d1NvcXlMeW9LQ3JCT05aQk5qSTNIUVR3CmlDeE1wTUUzQVZrREdEeDZSeW15
            dEsyd0w5OUpabEZHNm54UDlmaU41V00KLS0tIGJZTXhVdUJJS0VIdGdnV21DUlhL
            MjNrRytKUXBXZWhPN2dpUk4wYUJyemsK5sspkZA7AOkVtq4e8p7QhtG2yLZE2TG0
            qOhodWBMqi9VWnwg6HTKtQK6hfZ17McB93J4wtciCFGB7Pa8d79TFw==
            -----END AGE ENCRYPTED FILE-----
        - recipient: age17tagmpwqjk3mdy45rfesrfey6h863x8wfq38wh33tkrlrywxducs0k6tpq
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEZ1l6SDdpdXl2cFNubjBn
            eTU0UCtGTWhFYWIybk0yaGswKyt2clJQekhZCkVkbXdrM1QwaGZ4TXFpOTE1eEJJ
            dUZKampwMjFzQXJqUUx0RTVwQzFoVnMKLS0tIEErNjhFZzhrVTJucXgwSVp2RlFi
            QllFM3MxbXBBbFNTQkNKWHhyQ09EVGcKJIJ3DB8YmhlL+6sNhp38PojDBcDItsR1
            SKyJC3nTJjwtPD/8P0LivCTn9Gi0Yjd5HVIXq/76RF4aB85HLZLgSg==
            -----END AGE ENCRYPTED FILE-----
        - recipient: age1mrnldl334l2nszuta6ywvewng0fswv2dz9l5g4qcwe3nj4yxf92qjskdx6
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwY2VLT3Ara1dXTk5EVXBi
            b1l6ekd2cEp0TzgrclVNMmR6bXBtZ2Z5V3k0CjRkd0JIUzBCd2NvWDJDU0FyRzR6
            MHJUSis3RHlBSm1raFRSaUY2NHpmWlkKLS0tIEk3VDhLSnU5YjRzNWFtb1ZMcy9o
            cGxZVnFhdXRka2drTGdkVk1iM0pFL1kK2ry7b2cLYPfntWi/BV3K2O+mHt3242Ef
            sI2JLLQYHeAhxjFdCzP1RDR+Wu/pRxZje6xuTZ9I9TKNmm+LhAXHQw==
            -----END AGE ENCRYPTED FILE-----
    lastmodified: "2023-10-22T00:31:46Z"
    mac: ENC[AES256_GCM,data:UpnaUfRxvdyzBy5x4EC3w5LQ1qWxILTQhpyVPd9whTzQMAivAHT0pVmP9aE4T9w3NcWTaghp+f70GmQXx/OCC6DsRCWtU9pFHRj12YUowM3yB5lVTOomOLZQ9m4gUXw5I2GZHWBJn8CyosDcBMlXz2tiR91v/8Ulh6sDSAO86U0=,iv:5GcgRvbpqDEslZruKHM/TcMaF52A5X7AK41DEbrsRIQ=,tag:ndDgCRyX1aDRnzEUNmpoMw==,type:str]
    pgp:
        - created_at: "2023-05-06T21:31:39Z"
          enc: |
            -----BEGIN PGP MESSAGE-----
            hQIMA0av/duuklWYARAAmj8qTRTeTXx9PNtqOFwCGmLlKGhj860JPE3BUR2n3QOE
            h9fdVJa9yqK7Lshyuf2t1HbgG+Ah4p4BaO5gYGsMLV9ybZpyNFuCgSZ3DZ4zSfxM
            GSqelcHJF5qbV5gwoJvtyVFV3qtKD9FpOJwh9MfEVe98VkoISCQsPl3CHDH4ot0l
            zKa56vOReHRmaCid2LNsN0nHlh1KPpwn7HdgaKyiPFexMFe4L/Q56UrlZx9XyPOb
            AJ91ayfI6jWH8Hj0xxyqx0shdA74nJ/Y6ZB3JxLXnGuPvAlC3XJRQUImqYsa7p11
            4Hus4hRAGEJGpmpxhazInHkWOT5ECtzxMd5LlUSq0AGYlEWJL+jtnrvy86HqpYRj
            jpMfwsuwY7dJ0Tll05+goWqn0zB0yZjax71Ynky/ie5Iv8FKaUHHh2HWAzqjUaKg
            6Yp3hzmMdP61fAm7ka4mxQLXQ0lrUbVnOk+pkaTrVrhcQial3W3lIgIhyo0EVi2V
            Z7yEFkec7XZieMklhkL7tq9SJlWJYG1T+bavD7JSWjOXu+NlSP1hLKytM7xjp5jH
            qZMEsjOaUEPvIO8Kd1f8MpLLe/+EhtmQJJMN8lwA8t/N+aOVYsW1GCspwX5mI+Ob
            ZCIPkmeBz+UhJvqFD9QwWB44VWH7429VCg9hL+iWR2UfIUQHQhRFWD3604QBppzS
            XgHEqjgLremZkvBsTAZsaLrTFlm7KwgjZsAkA5k+RZR5SH7xCXoSUSMnM8pWTway
            24M8mPHKyshggzR5B50YME5BY1qVKtOMEmTjwN5gpn4CQDcsQ7A3eafZg7uGd64=
            =4DU6
            -----END PGP MESSAGE-----
          fp: F7D37890228A907440E1FD4846B9228E814A2AAC
    unencrypted_suffix: _unencrypted
    version: 3.7.3
--- a/Show More
+++ b/Show More