bakke: Update disk IDs

.mailmap

@@ -1,25 +0,0 @@
-Daniel Løvbrøtte Olsen <danio@pvv.ntnu.no> <daniel.olsen99@gmail.com>
-Daniel Løvbrøtte Olsen <danio@pvv.ntnu.no> Daniel <danio@pvv.ntnu.no>
-Daniel Løvbrøtte Olsen <danio@pvv.ntnu.no> Daniel Lovbrotte Olsen <danio@pvv.ntnu.no>
-Daniel Løvbrøtte Olsen <danio@pvv.ntnu.no> Daniel Olsen <danio@pvv.ntnu.no>
-Daniel Løvbrøtte Olsen <danio@pvv.ntnu.no> danio <danio@pvv.ntnu.no>
-Daniel Løvbrøtte Olsen <danio@pvv.ntnu.no> Daniel Olsen <danio@bicep.pvv.ntnu.no>
-
-
-Øystein Kristoffer Tveit <oysteikt@pvv.ntnu.no> h7x4 <h7x4@nani.wtf>
-Øystein Kristoffer Tveit <oysteikt@pvv.ntnu.no> Øystein Tveit <oysteikt@pvv.ntnu.no>
-Øystein Kristoffer Tveit <oysteikt@pvv.ntnu.no> oysteikt <oysteikt@pvv.ntnu.no>
-Øystein Kristoffer Tveit <oysteikt@pvv.ntnu.no> Øystein <oysteikt@pvv.org>
-Øystein Kristoffer Tveit <oysteikt@pvv.ntnu.no> Oystein Kristoffer Tveit <oysteikt@pvv.ntnu.no>
-
-Felix Albrigtsen <felixalb@pvv.ntnu.no> <felix@albrigtsen.it>
-Felix Albrigtsen <felixalb@pvv.ntnu.no> <felixalbrigtsen@gmail.com>
-Felix Albrigtsen <felixalb@pvv.ntnu.no> felixalb <felixalb@pvv.ntnu.no>
-
-Peder Bergebakken Sundt <pederbs@pvv.ntnu.no> <pbsds@hotmail.com>
-
-Adrian Gunnar Lauterer <adriangl@pvv.ntnu.no> Adrian G L <adrian@lauterer.it>
-Adrian Gunnar Lauterer <adriangl@pvv.ntnu.no> Adrian Gunnar Lauterer <adrian@lauterer.it>
-
-Fredrik Robertsen <frero@pvv.ntnu.no> frero <frero@pvv.ntnu.no>
-Fredrik Robertsen <frero@pvv.ntnu.no> fredrikr79 <fredrikrobertsen7@gmail.com>

.sops.yaml

@@ -1,20 +1,21 @@
 keys:
   # Users
   - &user_danio age17tagmpwqjk3mdy45rfesrfey6h863x8wfq38wh33tkrlrywxducs0k6tpq
+  - &user_eirikwit age1ju7rd26llahz3g8tz7cy5ld52swj8gsmg0flrmrxngc0nj0avq3ssh0sn5
   - &user_felixalb age1mrnldl334l2nszuta6ywvewng0fswv2dz9l5g4qcwe3nj4yxf92qjskdx6
   - &user_oysteikt F7D37890228A907440E1FD4846B9228E814A2AAC
-  - &user_eirikwit age1ju7rd26llahz3g8tz7cy5ld52swj8gsmg0flrmrxngc0nj0avq3ssh0sn5
-  - &user_pederbs_sopp age1hmpdk4h69wxpwqk9tkud39f66hprhehxtzhgw97r6dvr7v0mx5jscsuhkn
-  - &user_pederbs_nord age1wrssr4z4g6vl3fd3qme5cewchmmhm0j2xe6wf2meu4r6ycn37anse98mfs
   - &user_pederbs_bjarte age1zhxul786an743u0fascv4wtc5xduu7qfy803lfs539yzhgmlq5ds2lznt5
+  - &user_pederbs_nord age1wrssr4z4g6vl3fd3qme5cewchmmhm0j2xe6wf2meu4r6ycn37anse98mfs
+  - &user_pederbs_sopp age1hmpdk4h69wxpwqk9tkud39f66hprhehxtzhgw97r6dvr7v0mx5jscsuhkn
 
   # Hosts
-  - &host_jokum age1gp8ye4g2mmw3may5xg0zsy7mm04glfz3788mmdx9cvcsdxs9hg0s0cc9kt
+  - &host_bakke age1syted6kt48sumjjucggh6r3uca4x2ppp4mfungf3lamkt2le05csc99633
-  - &host_ildkule age1x28hmzvuv6f2n66c0jtqcca3h9rput8d7j5uek6jcpx8n9egd52sqpejq0
   - &host_bekkalokk age12nj59tguy9wg882updc2vjdusx5srnxmjyfaqve4zx6jnnsaw3qsyjq6zd
   - &host_bicep age1sl43gc9cw939z5tgha2lpwf0xxxgcnlw7w4xem4sqgmt2pt264vq0dmwx2
-  - &host_ustetind age1hffjafs4slznksefmtqrlj7rdaqgzqncn4un938rhr053237ry8s3rs0v8
+  - &host_ildkule age1x28hmzvuv6f2n66c0jtqcca3h9rput8d7j5uek6jcpx8n9egd52sqpejq0
+  - &host_jokum age1gp8ye4g2mmw3may5xg0zsy7mm04glfz3788mmdx9cvcsdxs9hg0s0cc9kt
   - &host_kommode age1mt4d0hg5g76qp7j0884llemy0k2ymr5up8vfudz6vzvsflk5nptqqd32ly
+  - &host_ustetind age1hffjafs4slznksefmtqrlj7rdaqgzqncn4un938rhr053237ry8s3rs0v8
 
 creation_rules:
   # Global secrets
@@ -104,3 +105,15 @@ creation_rules:
       - *user_pederbs_bjarte
       pgp:
       - *user_oysteikt
+
+  - path_regex: secrets/bakke/[^/]+\.yaml$
+    key_groups:
+    - age:
+      - *host_bakke
+      - *user_danio
+      - *user_felixalb
+      - *user_pederbs_sopp
+      - *user_pederbs_nord
+      - *user_pederbs_bjarte
+      pgp:
+      - *user_oysteikt

base/default.nix

@@ -7,10 +7,8 @@
 
     ./networking.nix
     ./nix.nix
-    ./vm.nix
 
     ./services/acme.nix
-    ./services/uptimed.nix
     ./services/auto-upgrade.nix
     ./services/dbus.nix
     ./services/fwupd.nix
@@ -78,3 +76,4 @@
   # Trusted users on the nix builder machines
   users.groups."nix-builder-users".name = "nix-builder-users";
 }
+

base/services/auto-upgrade.nix

@@ -1,27 +1,16 @@
 { inputs, pkgs, lib, ... }:
-
-let
-  inputUrls = lib.mapAttrs (input: value: value.url) (import "${inputs.self}/flake.nix").inputs;
-in
-
 {
   system.autoUpgrade = {
     enable = true;
     flake = "git+https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git";
     flags = [
-      "--refresh"
-      "--no-write-lock-file"
       # --update-input is deprecated since nix 2.22, and removed in lix 2.90
-      # as such we instead use --override-input combined with --refresh
       # https://git.lix.systems/lix-project/lix/issues/400
-    ] ++ (lib.pipe inputUrls [
+      "--refresh"
-      (lib.intersectAttrs {
+      "--override-input" "nixpkgs" "github:nixos/nixpkgs/nixos-24.11-small"
-        nixpkgs = { };
+      "--override-input" "nixpkgs-unstable" "github:nixos/nixpkgs/nixos-unstable-small"
-        nixpkgs-unstable = { };
+      "--no-write-lock-file"
-      })
+    ];
-      (lib.mapAttrsToList (input: url: ["--override-input" input url]))
-      lib.concatLists
-    ]);
   };
 
   # workaround for https://github.com/NixOS/nix/issues/6895

base/services/nginx.nix

@@ -20,14 +20,14 @@
     recommendedGzipSettings = true;
 
     appendConfig = ''
-      # pcre_jit on;
+      pcre_jit on;
       worker_processes auto;
       worker_rlimit_nofile 100000;
     '';
     eventsConfig = ''
       worker_connections 2048;
       use epoll;
-      # multi_accept on;
+      multi_accept on;
     '';
   };
 

base/services/uptimed.nix

@@ -1,59 +0,0 @@
-{ config, pkgs, lib, ... }:
-let
-  cfg = config.services.uptimed;
-in
-{
-  options.services.uptimed.settings = lib.mkOption {
-    description = "";
-    default = { };
-    type = lib.types.submodule {
-      freeformType = with lib.types; attrsOf (either str (listOf str));
-    };
-  };
-
-  config = {
-    services.uptimed = {
-      enable = true;
-
-      settings = let
-        stateDir = "/var/lib/uptimed";
-      in {
-        PIDFILE = "${stateDir}/pid";
-        SENDMAIL = lib.mkDefault "${pkgs.system-sendmail}/bin/sendmail -t";
-      };
-    };
-
-    systemd.services.uptimed = lib.mkIf (cfg.enable) {
-      serviceConfig = let
-        uptimed = pkgs.uptimed.overrideAttrs (prev: {
-          postPatch = ''
-             substituteInPlace Makefile.am \
-               --replace-fail '$(sysconfdir)/uptimed.conf' '/var/lib/uptimed/uptimed.conf'
-             substituteInPlace src/Makefile.am \
-               --replace-fail '$(sysconfdir)/uptimed.conf' '/var/lib/uptimed/uptimed.conf'
-          '';
-        });
-
-      in {
-        Type = "notify";
-
-        ExecStart = lib.mkForce "${uptimed}/sbin/uptimed -f";
-
-        BindReadOnlyPaths = let
-          configFile = lib.pipe cfg.settings [
-            (lib.mapAttrsToList
-              (k: v:
-                if builtins.isList v
-                  then lib.mapConcatStringsSep "\n" (v': "${k}=${v'}") v
-                  else "${k}=${v}")
-            )
-            (lib.concatStringsSep "\n")
-            (pkgs.writeText "uptimed.conf")
-          ];
-        in [
-          "${configFile}:/var/lib/uptimed/uptimed.conf"
-        ];
-      };
-    };
-  };
-}

base/vm.nix

@@ -1,15 +0,0 @@
-{ lib, ... }:
-
-# This enables
-#     lib.mkIf (!config.virtualisation.isVmVariant) { ... }
-
-{
-  options.virtualisation.isVmVariant = lib.mkOption {
-    description = "`true` if system is build with 'nixos-rebuild build-vm'";
-    type = lib.types.bool;
-    default = false;
-  };
-  config.virtualisation.vmVariant = {
-    virtualisation.isVmVariant = true;
-  };
-}

flake.lock

@@ -7,11 +7,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1745502102,
+        "lastModified": 1741786315,
-        "narHash": "sha256-LqhRwzvIVPEjH0TaPgwzqpyhW6DtCrvz7FnUJDoUZh8=",
+        "narHash": "sha256-VT65AE2syHVj6v/DGB496bqBnu1PXrrzwlw07/Zpllc=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "ca27b88c88948d96feeee9ed814cbd34f53d0d70",
+        "rev": "0d8c6ad4a43906d14abd5c60e0ffe7b587b213de",
         "type": "github"
       },
       "original": {
@@ -48,11 +48,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1746563623,
+        "lastModified": 1736545379,
-        "narHash": "sha256-5DxgNFpSgxft/sWraZnHIUlb4S3Io73SVS7FZCbWSUY=",
+        "narHash": "sha256-PeTTmGumdOX3rd6OKI7QMCrZovCDkrckZbcHr+znxWA=",
         "ref": "refs/heads/main",
-        "rev": "4e0408887f80e61a90286ff630a7855b828ae421",
+        "rev": "74f5316121776db2769385927ec0d0c2cc2b23e4",
-        "revCount": 45,
+        "revCount": 42,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Grzegorz/greg-ng.git"
       },
@@ -124,43 +124,49 @@
         ]
       },
       "locked": {
-        "lastModified": 1743881366,
+        "lastModified": 1736531400,
-        "narHash": "sha256-ScGA2IHPk9ugf9bqEZnp+YB/OJgrkZblnG/XLEKvJAo=",
+        "narHash": "sha256-+X/HVI1AwoPcud28wI35XRrc1kDgkYdDUGABJBAkxDI=",
         "ref": "refs/heads/main",
-        "rev": "db2e4becf1b11e5dfd33de12a90a7d089fcf68ec",
+        "rev": "e4dafd06b3d7e9e6e07617766e9c3743134571b7",
-        "revCount": 11,
+        "revCount": 7,
         "type": "git",
-        "url": "https://git.pvv.ntnu.no/Drift/nix-gitea-themes.git"
+        "url": "https://git.pvv.ntnu.no/oysteikt/nix-gitea-themes.git"
       },
       "original": {
         "type": "git",
-        "url": "https://git.pvv.ntnu.no/Drift/nix-gitea-themes.git"
+        "url": "https://git.pvv.ntnu.no/oysteikt/nix-gitea-themes.git"
       }
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1748615477,
+        "lastModified": 1741969460,
-        "narHash": "sha256-8sjG4sNIonQPK2olCGvq3/j1qtjwPaTOFU5nkz1gj2Q=",
+        "narHash": "sha256-SCNxTTBfMJV7XuTcLUfdAd6cgCGsazzi+DoPrceQrZ0=",
-        "rev": "97d3ce1ceb663a24184aac92b7e9e8f5452111c1",
+        "owner": "NixOS",
-        "type": "tarball",
+        "repo": "nixpkgs",
-        "url": "https://releases.nixos.org/nixos/24.11-small/nixos-24.11.718472.97d3ce1ceb66/nixexprs.tar.xz?rev=97d3ce1ceb663a24184aac92b7e9e8f5452111c1"
+        "rev": "68612419aa6c9fd5b178b81e6fabbdf46d300ea4",
+        "type": "github"
       },
       "original": {
-        "type": "tarball",
+        "owner": "NixOS",
-        "url": "https://nixos.org/channels/nixos-24.11-small/nixexprs.tar.xz"
+        "ref": "nixos-24.11-small",
+        "repo": "nixpkgs",
+        "type": "github"
       }
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1748588304,
+        "lastModified": 1741960758,
-        "narHash": "sha256-YCnUqO9k39p0oMIBndxYTbu8m0fOA/KVcq3IekXPy9c=",
+        "narHash": "sha256-pSGMbfkxF7TSeco54W+B1q+g22YCVp1qXHgtrdgtyR4=",
-        "rev": "b8af95f4cf511c5f056b463c3a45d2b63c7cfb03",
+        "owner": "NixOS",
-        "type": "tarball",
+        "repo": "nixpkgs",
-        "url": "https://releases.nixos.org/nixos/unstable-small/nixos-25.11pre807945.b8af95f4cf51/nixexprs.tar.xz?rev=b8af95f4cf511c5f056b463c3a45d2b63c7cfb03"
+        "rev": "845dc1e9cbc2e48640b8968af58b4a19db67aa8f",
+        "type": "github"
       },
       "original": {
-        "type": "tarball",
+        "owner": "NixOS",
-        "url": "https://nixos.org/channels/nixos-unstable-small/nixexprs.tar.xz"
+        "ref": "nixos-unstable-small",
+        "repo": "nixpkgs",
+        "type": "github"
       }
     },
     "pvv-calendar-bot": {
@@ -227,11 +233,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1746498961,
+        "lastModified": 1729391507,
-        "narHash": "sha256-rp+oh/N88JKHu7ySPuGiA3lBUVIsrOtHbN2eWJdYCgk=",
+        "narHash": "sha256-as0I9xieJUHf7kiK2a9znDsVZQTFWhM1pLivII43Gi0=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "24b00064cdd1d7ba25200c4a8565dc455dc732ba",
+        "rev": "784981a9feeba406de38c1c9a3decf966d853cca",
         "type": "github"
       },
       "original": {
@@ -247,11 +253,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1745310711,
+        "lastModified": 1741861888,
-        "narHash": "sha256-ePyTpKEJTgX0gvgNQWd7tQYQ3glIkbqcW778RpHlqgA=",
+        "narHash": "sha256-ynOgXAyToeE1UdLNfrUn/hL7MN0OpIS2BtNdLjpjPf0=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "5e3e92b16d6fdf9923425a8d4df7496b2434f39c",
+        "rev": "d016ce0365b87d848a57c12ffcfdc71da7a2b55f",
         "type": "github"
       },
       "original": {

flake.nix

@@ -2,8 +2,8 @@
   description = "PVV System flake";
 
   inputs = {
-    nixpkgs.url = "https://nixos.org/channels/nixos-24.11-small/nixexprs.tar.xz";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.11-small"; # remember to also update the url in base/services/auto-upgrade.nix
-    nixpkgs-unstable.url = "https://nixos.org/channels/nixos-unstable-small/nixexprs.tar.xz";
+    nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixos-unstable-small";
 
     sops-nix.url = "github:Mic92/sops-nix";
     sops-nix.inputs.nixpkgs.follows = "nixpkgs";
@@ -20,7 +20,7 @@
     matrix-next.url = "github:dali99/nixos-matrix-modules/0.7.0";
     matrix-next.inputs.nixpkgs.follows = "nixpkgs";
 
-    nix-gitea-themes.url = "git+https://git.pvv.ntnu.no/Drift/nix-gitea-themes.git";
+    nix-gitea-themes.url = "git+https://git.pvv.ntnu.no/oysteikt/nix-gitea-themes.git";
     nix-gitea-themes.inputs.nixpkgs.follows = "nixpkgs";
 
     greg-ng.url = "git+https://git.pvv.ntnu.no/Grzegorz/greg-ng.git";
@@ -87,11 +87,15 @@
       stableNixosConfig = nixosConfig nixpkgs;
       unstableNixosConfig = nixosConfig nixpkgs-unstable;
     in {
+      bakke = stableNixosConfig "bakke" {
+        modules = [
+          disko.nixosModules.disko
+        ];
+      };
       bicep = stableNixosConfig "bicep" {
         modules = [
           inputs.matrix-next.nixosModules.default
           inputs.pvv-calendar-bot.nixosModules.default
-          self.nixosModules.gickup
         ];
         overlays = [
           inputs.pvv-calendar-bot.overlays.x86_64-linux.default
@@ -165,7 +169,6 @@
       snakeoil-certs = ./modules/snakeoil-certs.nix;
       snappymail = ./modules/snappymail.nix;
       robots-txt = ./modules/robots-txt.nix;
-      gickup = ./modules/gickup;
     };
 
     devShells = forAllSystems (system: {

hosts/bakke/configuration.nix

@@ -0,0 +1,26 @@
+{ config, pkgs, values, ... }:
+{
+  imports = [
+      ./hardware-configuration.nix
+      ../../base
+      ../../misc/metrics-exporters.nix
+      ./filesystems.nix
+    ];
+
+  sops.defaultSopsFile = ../../secrets/bakke/bakke.yaml;
+  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
+  sops.age.generateKey = true;
+
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  networking.hostName = "bakke";
+  networking.hostId = "99609ffc";
+  systemd.network.networks."30-enp2s0" = values.defaultNetworkConfig // {
+    matchConfig.Name = "enp2s0";
+    address = with values.hosts.bakke; [ (ipv4 + "/25") (ipv6 + "/64") ];
+  };
+
+  system.stateVersion = "24.05";
+}

hosts/bakke/disks.nix

@@ -0,0 +1,83 @@
+{
+  # https://github.com/nix-community/disko/blob/master/example/boot-raid1.nix
+  # Note: Disko was used to create the initial md raid, but is no longer in active use on this host.
+  disko.devices = {
+    disk = {
+      one = {
+        type = "disk";
+        device = "/dev/disk/by-id/ata-WDC_WD40EFRX-68WT0N0_WD-WCC4E2EER6N6";
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              size = "500M";
+              type = "EF00";
+              content = {
+                type = "mdraid";
+                name = "boot";
+              };
+            };
+            mdadm = {
+              size = "100%";
+              content = {
+                type = "mdraid";
+                name = "raid1";
+              };
+            };
+          };
+        };
+      };
+      two = {
+        type = "disk";
+        device = "/dev/disk/by-id/ata-WDC_WD40EFRX-68WT0N0_WD-WCC4E7LPLU71";
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              size = "500M";
+              type = "EF00";
+              content = {
+                type = "mdraid";
+                name = "boot";
+              };
+            };
+            mdadm = {
+              size = "100%";
+              content = {
+                type = "mdraid";
+                name = "raid1";
+              };
+            };
+          };
+        };
+      };
+    };
+    mdadm = {
+      boot = {
+        type = "mdadm";
+        level = 1;
+        metadata = "1.0";
+        content = {
+          type = "filesystem";
+          format = "vfat";
+          mountpoint = "/boot";
+        };
+      };
+      raid1 = {
+        type = "mdadm";
+        level = 1;
+        content = {
+          type = "gpt";
+          partitions.primary = {
+            size = "100%";
+            content = {
+              type = "filesystem";
+              format = "ext4";
+              mountpoint = "/";
+            };
+          };
+        };
+      };
+    };
+  };
+}

hosts/bakke/filesystems.nix

@@ -0,0 +1,26 @@
+{ config, pkgs, lib, ... }:
+{
+  # Boot drives:
+  boot.swraid.enable = true;
+
+  # ZFS Data pool:
+  environment.systemPackages = with pkgs; [ zfs ];
+  boot = {
+    zfs = {
+      extraPools = [ "tank" ];
+      requestEncryptionCredentials = false;
+    };
+    supportedFilesystems = [ "zfs" ];
+    kernelPackages = config.boot.zfs.package.latestCompatibleLinuxPackages;
+  };
+  services.zfs.autoScrub = {
+    enable = true;
+    interval = "Wed *-*-8..14 00:00:00";
+  };
+
+  # NFS Exports:
+  #TODO
+
+  # NFS Import mounts:
+  #TODO
+}

hosts/bakke/hardware-configuration.nix

@@ -0,0 +1,52 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "ehci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/0f63c3d2-fc12-4ed5-a5a5-141bfd67a571";
+      fsType = "btrfs";
+      options = [ "subvol=root" ];
+    };
+
+  fileSystems."/home" =
+    { device = "/dev/disk/by-uuid/0f63c3d2-fc12-4ed5-a5a5-141bfd67a571";
+      fsType = "btrfs";
+      options = [ "subvol=home" ];
+    };
+
+  fileSystems."/nix" =
+    { device = "/dev/disk/by-uuid/0f63c3d2-fc12-4ed5-a5a5-141bfd67a571";
+      fsType = "btrfs";
+      options = [ "subvol=nix" "noatime" ];
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/sdc2";
+      fsType = "vfat";
+      options = [ "fmask=0022" "dmask=0022" ];
+    };
+
+  swapDevices = [ ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault false;
+  # networking.interfaces.eno1.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp2s0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/bekkalokk/services/mediawiki/default.nix

@@ -214,11 +214,11 @@ in {
       "= /favicon.ico".alias = pkgs.runCommandLocal "mediawiki-favicon.ico" {
         buildInputs = with pkgs; [ imagemagick ];
       } ''
-        magick \
+        convert \
-          ${fp /assets/logo_blue_regular.png} \
           -resize x64 \
           -gravity center \
           -crop 64x64+0+0 \
+          ${fp /assets/logo_blue_regular.png} \
           -flatten \
           -colors 256 \
           -background transparent \

hosts/bekkalokk/services/website/fetch-gallery.nix

@@ -53,7 +53,7 @@ in {
 
         echo "Creating thumbnail for $fname"
         mkdir -p $(dirname ".thumbnails/$fname")
-        magick -define jpeg:size=200x200 "$fname" -thumbnail 300 -auto-orient ".thumbnails/$fname.png" ||:
+        convert -define jpeg:size=200x200 "$fname" -thumbnail 300 -auto-orient ".thumbnails/$fname.png" ||:
         touch -m -d "$(date -R -r "$fname")" ".thumbnails/$fname.png"
       done <<< "$images"
     '';

hosts/bicep/configuration.nix

@@ -7,10 +7,10 @@
     (fp /misc/metrics-exporters.nix)
     ./services/nginx
 
-    ./services/calendar-bot.nix
-    ./services/git-mirrors
     ./services/mysql.nix
     ./services/postgres.nix
+    ./services/mysql.nix
+    ./services/calendar-bot.nix
 
     ./services/matrix
   ];

hosts/bicep/services/git-mirrors/default.nix

@@ -1,100 +0,0 @@
-{ config, pkgs, lib, fp, ... }:
-let
-  cfg = config.services.gickup;
-in
-{
-  sops.secrets."gickup/github-token" = {
-    owner = "gickup";
-  };
-
-  services.gickup = {
-    enable = true;
-
-    dataDir = "/data/gickup";
-
-    destinationSettings = {
-      structured = true;
-      zip = false;
-      keep = 10;
-      bare = true;
-      lfs = false;
-    };
-
-    instances = let
-      defaultGithubConfig = {
-        settings.token_file = config.sops.secrets."gickup/github-token".path;
-      };
-      defaultGitlabConfig = {
-        # settings.token_file = ...
-      };
-    in {
-      "github:Git-Mediawiki/Git-Mediawiki" = defaultGithubConfig;
-      "github:NixOS/nixpkgs" = defaultGithubConfig;
-      "github:go-gitea/gitea" = defaultGithubConfig;
-      "github:heimdal/heimdal" = defaultGithubConfig;
-      "github:saltstack/salt" = defaultGithubConfig;
-      "github:typst/typst" = defaultGithubConfig;
-      "github:unmojang/FjordLauncher" = defaultGithubConfig;
-      "github:unmojang/drasl" = defaultGithubConfig;
-      "github:yushijinhun/authlib-injector" = defaultGithubConfig;
-
-      "gitlab:mx-puppet/discord/better-discord.js" = defaultGitlabConfig;
-      "gitlab:mx-puppet/discord/discord-markdown" = defaultGitlabConfig;
-      "gitlab:mx-puppet/discord/matrix-discord-parser" = defaultGitlabConfig;
-      "gitlab:mx-puppet/discord/mx-puppet-discord" = defaultGitlabConfig;
-      "gitlab:mx-puppet/mx-puppet-bridge" = defaultGitlabConfig;
-
-      "any:glibc" = {
-        settings.url = "https://sourceware.org/git/glibc.git";
-      };
-
-      "any:out-of-your-element" = {
-        settings.url = "https://gitdab.com/cadence/out-of-your-element.git";
-      };
-
-      "any:out-of-your-element-module" = {
-        settings.url = "https://cgit.rory.gay/nix/OOYE-module.git";
-      };
-    };
-  };
-
-  services.cgit = let
-    domain = "mirrors.pvv.ntnu.no";
-  in {
-    ${domain} = {
-      enable = true;
-      package = pkgs.callPackage (fp /packages/cgit.nix) { };
-      group = "gickup";
-      scanPath = "${cfg.dataDir}/linktree";
-      settings = {
-        enable-commit-graph = true;
-        enable-follow-links = true;
-        enable-http-clone = true;
-        enable-remote-branches = true;
-        clone-url = "https://${domain}/$CGIT_REPO_URL";
-        remove-suffix = true;
-        root-title = "PVVSPPP";
-        root-desc = "PVV Speiler Praktisk og Prominent Programvare";
-        snapshots = "all";
-        logo = "/PVV-logo.png";
-      };
-    };
-  };
-
-  services.nginx.virtualHosts."mirrors.pvv.ntnu.no" = {
-    forceSSL = true;
-    enableACME = true;
-
-    locations."= /PVV-logo.png".alias = let
-      small-pvv-logo = pkgs.runCommandLocal "pvv-logo-96x96" {
-        nativeBuildInputs = [ pkgs.imagemagick ];
-      } ''
-        magick '${fp /assets/logo_blue_regular.svg}' -resize 96x96 PNG:"$out"
-      '';
-    in toString small-pvv-logo;
-  };
-
-  systemd.services."fcgiwrap-cgit-mirrors.pvv.ntnu.no" = {
-    serviceConfig.BindReadOnlyPaths = [ cfg.dataDir ];
-  };
-}

hosts/georg/configuration.nix

@@ -8,7 +8,7 @@
 
       (fp /modules/grzegorz.nix)
     ];
-  services.spotifyd.enable = true;
+
   boot.loader.systemd-boot.enable = true;
   boot.loader.efi.canTouchEfiVariables = true;
 

hosts/kommode/services/gitea/customization/default.nix

@@ -3,12 +3,7 @@ let
   cfg = config.services.gitea;
 in
 {
-  services.gitea-themes = {
+  services.gitea-themes.monokai = pkgs.gitea-theme-monokai;
-    monokai = pkgs.gitea-theme-monokai;
-    earl-grey = pkgs.gitea-theme-earl-grey;
-    pitch-black = pkgs.gitea-theme-pitch-black;
-    catppuccin = pkgs.gitea-theme-catppuccin;
-  };
 
   systemd.services.gitea-customization = lib.mkIf cfg.enable {
     description = "Install extra customization in gitea's CUSTOM_DIR";

justfile

@@ -1,56 +1,25 @@
-set positional-arguments # makes variables accesible as $1 $2 $@
 export GUM_FILTER_HEIGHT := "15"
-nom := `if [[ -t 2 ]] && command -v nom >/dev/null; then echo nom; else echo nix; fi`
+nom := `if command -v nom >/dev/null; then echo nom; else echo nix; fi`
-nix_eval_opts := "--log-format raw --option warn-dirty false"
 
 @_default:
   just "$(gum choose --ordered --header "Pick a recipie..." $(just --summary --unsorted))"
 
-check *_:
+check:
-  nix flake check --keep-going "$@"
+  nix flake check --keep-going
 
-build-machine machine=`just _a_machine` *_:
+build-machine machine=`just _a_machine`:
-  {{nom}} build .#nixosConfigurations.{{ machine }}.config.system.build.toplevel "${@:2}"
+  {{nom}} build .#nixosConfigurations.{{ machine }}.config.system.build.toplevel
 
-run-vm machine=`just _a_machine` *_:
+run-vm machine=`just _a_machine`:
-  nixos-rebuild build-vm --flake .#{{ machine }} "${@:2}"
+  nixos-rebuild build-vm --flake .#{{ machine }}
   QEMU_NET_OPTS="hostfwd=tcp::8080-:80,hostfwd=tcp::8081-:443,hostfwd=tcp::2222-:22" ./result/bin/run-*-vm
 
-@update-inputs *_:
+@update-inputs:
-  @git reset flake.lock
+  nix eval .#inputs --apply builtins.attrNames --json \
-  @git restore flake.lock
+    | jq '.[]' -r \
-  nix eval {{nix_eval_opts}} --file flake.nix --apply 'x: builtins.attrNames x.inputs' --json \
+    | gum choose --no-limit --height=15 \
-    | { printf "%s\n" --commit-lock-file; jq '.[]' -r | grep -vxF "self" ||:; } \
+    | xargs -L 1 nix flake lock --update-input
-    | gum choose --no-limit --header "Choose extra arguments:" \
-    | tee >(xargs -d'\n' echo + nix flake update "$@" >&2) \
-    | xargs -d'\n' nix flake update "$@"
-
-@repl $machine=`just _a_machine` *_:
-  set -v; NIX_NO_NOM=1 nixos-rebuild --flake .#"$machine" repl "${@:2}"
-
-@eval $machine=`just _a_machine` $attrpath="system.build.toplevel.outPath" *_:
-  set -v; nix eval {{nix_eval_opts}} ".#nixosConfigurations.\"$machine\".config.$attrpath" --show-trace "${@:3}"
-
-@eval-vm $machine=`just _a_machine` $attrpath="system.build.toplevel.outPath" *_:
-  just eval "$machine" "virtualisation.vmVariant.$attrpath" "${@:3}"
 
 
-# helpers
-
-[no-exit-message]
 _a_machine:
-  #!/usr/bin/env -S sh -euo pipefail
+  nix eval .#nixosConfigurations --apply builtins.attrNames --json | jq .[] -r | gum filter
-  machines="$(
-    nix eval {{nix_eval_opts}} .#nixosConfigurations --apply builtins.attrNames --json | jq .[] -r
-  )"
-  [ -n "$machines" ] || { echo >&2 "ERROR: no machines found"; false; }
-  if [ -s .direnv/vars/last-machine.txt ]; then
-    machines="$(
-      grep <<<"$machines" -xF  "$(cat .direnv/vars/last-machine.txt)" ||:
-      grep <<<"$machines" -xFv "$(cat .direnv/vars/last-machine.txt)" ||:
-    )"
-  fi
-  choice="$(gum filter <<<"$machines")"
-  mkdir -p .direnv/vars
-  cat <<<"$choice" >.direnv/vars/last-machine.txt
-  cat <<<"$choice"

modules/gickup/default.nix

@@ -1,310 +0,0 @@
-{ config, pkgs, lib, utils, ... }:
-let
-  cfg = config.services.gickup;
-  format = pkgs.formats.yaml { };
-in
-{
-  imports = [
-    ./set-description.nix
-    ./hardlink-files.nix
-    ./import-from-toml.nix
-    ./update-linktree.nix
-  ];
-
-  options.services.gickup = {
-    enable = lib.mkEnableOption "gickup, a git repository mirroring service";
-
-    package = lib.mkPackageOption pkgs "gickup" { };
-    gitPackage = lib.mkPackageOption pkgs "git" { };
-    gitLfsPackage = lib.mkPackageOption pkgs "git-lfs" { };
-
-    dataDir = lib.mkOption {
-      type = lib.types.path;
-      description = "The directory to mirror repositories to.";
-      default = "/var/lib/gickup";
-      example = "/data/gickup";
-    };
-
-    destinationSettings = lib.mkOption {
-      description = ''
-        Settings for destination local, see gickup configuration file
-
-        Note that `path` will be set automatically to `/var/lib/gickup`
-      '';
-      type = lib.types.submodule {
-        freeformType = format.type;
-      };
-      default = { };
-      example = {
-        structured = true;
-        zip = false;
-        keep = 10;
-        bare = true;
-        lfs = true;
-      };
-    };
-
-    instances = lib.mkOption {
-      type = lib.types.attrsOf (lib.types.submodule (submoduleInputs@{ name, ... }: let
-        submoduleName = name;
-
-        nameParts = rec {
-          repoType = builtins.head (lib.splitString ":" submoduleName);
-
-          owner = if repoType == "any"
-                  then null
-                  else lib.pipe submoduleName [
-                    (lib.removePrefix "${repoType}:")
-                    (lib.splitString "/")
-                    builtins.head
-                  ];
-
-          repo = if repoType == "any"
-                 then null
-                 else lib.pipe submoduleName [
-                    (lib.removePrefix "${repoType}:")
-                    (lib.splitString "/")
-                    lib.last
-                  ];
-
-          slug = if repoType == "any"
-                 then lib.toLower (builtins.replaceStrings [ ":" "/" ] [ "-" "-" ] submoduleName)
-                 else "${lib.toLower repoType}-${lib.toLower owner}-${lib.toLower repo}";
-        };
-      in {
-        options = {
-          interval = lib.mkOption {
-            type = lib.types.str;
-            default = "daily";
-            example = "weekly";
-            description = ''
-              Specification (in the format described by {manpage}`systemd.time(7)`) of the time
-              interval at which to run the service.
-            '';
-          };
-
-          type = lib.mkOption {
-            type = lib.types.enum [
-              "github"
-              "gitlab"
-              "gitea"
-              "gogs"
-              "bitbucket"
-              "onedev"
-              "sourcehut"
-              "any"
-            ];
-            example = "github";
-            default = nameParts.repoType;
-            description = ''
-              The type of the repository to mirror.
-            '';
-          };
-
-          owner = lib.mkOption {
-            type = with lib.types; nullOr str;
-            example = "go-gitea";
-            default = nameParts.owner;
-            description = ''
-              The owner of the repository to mirror (if applicable)
-            '';
-          };
-
-          repo = lib.mkOption {
-            type = with lib.types; nullOr str;
-            example = "gitea";
-            default = nameParts.repo;
-            description = ''
-              The name of the repository to mirror (if applicable)
-            '';
-          };
-
-          slug = lib.mkOption {
-            type = lib.types.str;
-            default = nameParts.slug;
-            example = "github-go-gitea-gitea";
-            description = ''
-              The slug of the repository to mirror.
-            '';
-          };
-
-          description = lib.mkOption {
-            type = with lib.types; nullOr str;
-            example = "A project which does this and that";
-            description = ''
-              A description of the project. This isn't used directly by gickup for anything,
-              but can be useful if gickup is used together with cgit or similar.
-            '';
-          };
-
-          settings = lib.mkOption {
-            description = "Instance specific settings, see gickup configuration file";
-            type = lib.types.submodule {
-              freeformType = format.type;
-            };
-            default = { };
-            example = {
-              username = "gickup";
-              password = "hunter2";
-              wiki = true;
-              issues = true;
-            };
-          };
-        };
-      }));
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    users.users.gickup = {
-      isSystemUser = true;
-      group = "gickup";
-      home = "/var/lib/gickup";
-    };
-
-    users.groups.gickup = { };
-
-    services.gickup.destinationSettings.path = "/var/lib/gickup/raw";
-
-    systemd.tmpfiles.settings."10-gickup" = lib.mkIf (cfg.dataDir != "/var/lib/gickup") {
-      ${cfg.dataDir}.d = {
-        user = "gickup";
-        group = "gickup";
-        mode = "0755";
-      };
-    };
-
-    systemd.slices."system-gickup" = {
-      description = "Gickup git repository mirroring service";
-      after = [ "network.target" ];
-    };
-
-    systemd.targets.gickup = {
-      description = "Gickup git repository mirroring service";
-      wants = map ({ slug, ... }: "gickup@${slug}.service") (lib.attrValues cfg.instances);
-    };
-
-    systemd.timers = {
-      "gickup@" = {
-        description = "Gickup git repository mirroring service for %i";
-
-        timerConfig = {
-          OnCalendar = "daily";
-          RandomizedDelaySec = "1h";
-          Persistent = true;
-          AccuracySec = "1s";
-        };
-      };
-    }
-    //
-    # Overrides for mirrors which are not "daily"
-    (lib.pipe cfg.instances [
-      builtins.attrValues
-      (builtins.filter (instance: instance.interval != "daily"))
-      (map ({ slug, interval, ... }: {
-        name = "gickup@${slug}";
-        value = {
-          overrideStrategy = "asDropin";
-          timerConfig.OnCalendar = interval;
-        };
-      }))
-      builtins.listToAttrs
-    ]);
-
-    systemd.targets.timers.wants = map ({ slug, ... }: "gickup@${slug}.timer") (lib.attrValues cfg.instances);
-
-    systemd.services = {
-      "gickup@" = let
-        configDir = lib.pipe cfg.instances [
-          (lib.mapAttrsToList (name: instance: {
-            name = "${instance.slug}.yml";
-            path = format.generate "gickup-configuration-${name}.yml" {
-              destination.local = [ cfg.destinationSettings ];
-              source.${instance.type} = [
-                (
-                  (lib.optionalAttrs (instance.type != "any") {
-                    user = instance.owner;
-                    includeorgs = [ instance.owner ];
-                    include = [ instance.repo ];
-                  })
-                  //
-                  instance.settings
-                )
-              ];
-            };
-          }))
-          (pkgs.linkFarm "gickup-configuration-files")
-        ];
-      in {
-        description = "Gickup git repository mirroring service for %i";
-        after = [ "network.target" ];
-
-        path = [
-          cfg.gitPackage
-          cfg.gitLfsPackage
-        ];
-
-        restartIfChanged = false;
-
-        serviceConfig = {
-          Type = "oneshot";
-          ExecStart = "'${pkgs.gickup}/bin/gickup' '${configDir}/%i.yml'";
-          ExecStartPost = "";
-
-          User = "gickup";
-          Group = "gickup";
-
-          BindPaths = lib.optionals (cfg.dataDir != "/var/lib/gickup") [
-            "${cfg.dataDir}:/var/lib/gickup"
-          ];
-
-          Slice = "system-gickup.slice";
-
-          SyslogIdentifier = "gickup-%i";
-          StateDirectory = "gickup";
-          # WorkingDirectory = "gickup";
-          # RuntimeDirectory = "gickup";
-          # RuntimeDirectoryMode = "0700";
-
-          # https://discourse.nixos.org/t/how-to-prevent-custom-systemd-service-from-restarting-on-nixos-rebuild-switch/43431
-          RemainAfterExit = true;
-
-          # Hardening options
-          AmbientCapabilities = [];
-          LockPersonality = true;
-          NoNewPrivileges = true;
-          PrivateDevices = true;
-          PrivateMounts = true;
-          PrivateTmp = true;
-          PrivateUsers = true;
-          ProcSubset = "pid";
-          ProtectClock = true;
-          ProtectControlGroups = true;
-          ProtectHome = true;
-          ProtectHostname = true;
-          ProtectKernelLogs = true;
-          ProtectKernelModules = true;
-          ProtectKernelTunables = true;
-          # ProtectProc = "invisible";
-          # ProtectSystem = "strict";
-          RemoveIPC = true;
-          RestrictAddressFamilies = [
-            "AF_INET"
-            "AF_INET6"
-          ];
-          RestrictNamespaces = true;
-          RestrictRealtime = true;
-          RestrictSUIDSGID = true;
-          SystemCallArchitectures = "native";
-          # SystemCallFilter = [
-          #   "@system-service"
-          #   "~@resources"
-          #   "~@privileged"
-          # ];
-          UMask = "0002";
-          CapabilityBoundingSet = [];
-        };
-      };
-    };
-  };
-}

modules/gickup/hardlink-files.nix

@@ -1,42 +0,0 @@
-{ config, lib, pkgs, ... }:
-let
-  cfg = config.services.gickup;
-in
-{
-  config = lib.mkIf cfg.enable {
-    # TODO: add a service that will look at the backed up files and hardlink
-    #       the ones that have a matching hash together to save space. This can
-    #       either run routinely (i.e. trigger by systemd-timer), or be activated
-    #       whenever a gickup@<slug>.service finishes. The latter is probably better.
-
-    # systemd.services."gickup-hardlink" = {
-    #   serviceConfig = {
-    #     Type = "oneshot";
-    #     ExecStart = let
-    #       script = pkgs.writeShellApplication {
-    #         name = "gickup-hardlink-files.sh";
-    #         runtimeInputs = [ pkgs.coreutils pkgs.jdupes ];
-    #         text = ''
-
-    #         '';
-    #       };
-    #     in lib.getExe script;
-
-    #     User = "gickup";
-    #     Group = "gickup";
-
-    #     BindPaths = lib.optionals (cfg.dataDir != "/var/lib/gickup") [
-    #       "${cfg.dataDir}:/var/lib/gickup"
-    #     ];
-
-    #     Slice = "system-gickup.slice";
-
-    #     StateDirectory = "gickup";
-
-    #     # Hardening options
-    #     # TODO:
-    #     PrivateNetwork = true;
-    #   };
-    # };
-  };
-}

modules/gickup/import-from-toml.nix

@@ -1,11 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-let
-  cfg = config.services.gickup;
-in
-{
-  config = lib.mkIf cfg.enable {
-    # TODO: import cfg.instances from a toml file to make it easier for non-nix users
-    #       to add repositories to mirror
-  };
-}

modules/gickup/set-description.nix

@@ -1,9 +0,0 @@
-{ config, lib, pkgs, ... }:
-let
-  cfg = config.services.gickup;
-in
-{
-  config = lib.mkIf cfg.enable {
-    # TODO: create .git/description files for each repo where cfg.instances.<instance>.description is set
-  };
-}

modules/gickup/update-linktree.nix

@@ -1,84 +0,0 @@
-{ config, lib, pkgs, ... }:
-let
-  cfg = config.services.gickup;
-in
-{
-  config = lib.mkIf cfg.enable {
-    # TODO: run upon completion of cloning a repository
-    systemd.timers."gickup-linktree" = {
-      wantedBy = [ "timers.target" ];
-      timerConfig = {
-        OnCalendar = "daily";
-        Persistent = true;
-        Unit = "gickup-linktree.service";
-      };
-    };
-
-    # TODO: update symlink for one repo at a time (e.g. gickup-linktree@<instance>.service)
-    systemd.services."gickup-linktree" = {
-      serviceConfig = {
-        Type = "oneshot";
-        ExecStart = let
-          script = pkgs.writeShellApplication {
-            name = "gickup-update-symlink-tree.sh";
-            runtimeInputs = [
-              pkgs.coreutils
-              pkgs.findutils
-            ];
-            text = ''
-              shopt -s nullglob
-
-              for repository in ./*/*/*; do
-                REPOSITORY_RELATIVE_DIRS=''${repository#"./"}
-
-                echo "Checking $REPOSITORY_RELATIVE_DIRS"
-
-                declare -a REVISIONS
-                readarray -t REVISIONS < <(find "$repository" -mindepth 1 -maxdepth 1 -printf "%f\n" | sort --numeric-sort --reverse)
-
-                if [[ "''${#REVISIONS[@]}" == 0 ]]; then
-                  echo "Found no revisions for $repository, continuing"
-                  continue
-                fi
-
-                LAST_REVISION="''${REVISIONS[0]}"
-                SYMLINK_PATH="../linktree/''${REPOSITORY_RELATIVE_DIRS}"
-
-                mkdir -p "$(dirname "$SYMLINK_PATH")"
-
-                EXPECTED_SYMLINK_TARGET=$(realpath "''${repository}/''${LAST_REVISION}")
-                EXISTING_SYMLINK_TARGET=$(realpath "$SYMLINK_PATH" || echo "<none>")
-
-                if [[ "$EXISTING_SYMLINK_TARGET" != "$EXPECTED_SYMLINK_TARGET" ]]; then
-                  echo "Updating symlink for $REPOSITORY_RELATIVE_DIRS"
-                  rm "$SYMLINK_PATH" ||:
-                  ln -rs "$EXPECTED_SYMLINK_TARGET" "$SYMLINK_PATH"
-                else
-                  echo "Symlink already up to date, continuing..."
-                fi
-
-                echo "---"
-              done
-            '';
-          };
-        in lib.getExe script;
-
-        User = "gickup";
-        Group = "gickup";
-
-        BindPaths = lib.optionals (cfg.dataDir != "/var/lib/gickup") [
-          "${cfg.dataDir}:/var/lib/gickup"
-        ];
-
-        Slice = "system-gickup.slice";
-
-        StateDirectory = "gickup";
-        WorkingDirectory = "/var/lib/gickup/raw";
-
-        # Hardening options
-        # TODO:
-        PrivateNetwork = true;
-      };
-    };
-  };
-}

modules/grzegorz.nix

@@ -13,11 +13,6 @@ in {
     enablePipewire = true;
   };
 
-  systemd.user.services.restart-greg-ng = {
-    script = "systemctl --user restart greg-ng.service";
-    startAt = "*-*-* 06:30:00";
-  };
-
   services.grzegorz-webui = {
     enable = true;
     listenAddr = "localhost";

packages/cgit.nix

@@ -1,21 +0,0 @@
-{ cgit, fetchurl, ... }:
-let
-  pname = cgit.pname;
-  commit = "09d24d7cd0b7e85633f2f43808b12871bb209d69";
-in
-cgit.overrideAttrs (_: {
-  version = "1.2.3-unstable-2024.07.16";
-
-  src = fetchurl {
-    url = "https://git.zx2c4.com/cgit/snapshot/${pname}-${commit}.tar.xz";
-    hash = "sha256-gfgjAXnWRqVCP+4cmYOVdB/3OFOLJl2WBOc3bFVDsjw=";
-  };
-
-  # cgit is tightly coupled with git and needs a git source tree to build.
-  # IMPORTANT: Remember to check which git version cgit needs on every version
-  # bump (look for "GIT_VER" in the top-level Makefile).
-  gitSrc = fetchurl {
-    url = "mirror://kernel/software/scm/git/git-2.46.0.tar.xz";
-    hash = "sha256-fxI0YqKLfKPr4mB0hfcWhVTCsQ38FVx+xGMAZmrCf5U=";
-  };
-})

secrets/bakke/bakke.yaml

@@ -0,0 +1,94 @@
+hello: ENC[AES256_GCM,data:+GWORSIf9TxmJLw1ytZwPbve2yz5H9ewVE5sOpQzkrRpct6Wes+vTE19Ij8W1g==,iv:C/WhXNBBM/bidC9xynZzk34nYXF3mUjAd4nPXpUlYHs=,tag:OJXSwuI8aNDnHFFTkwyGBQ==,type:str]
+example_key: ENC[AES256_GCM,data:ojSsrFYo5YD0YtiqcA==,iv:nvNtG6c0OqnQovzWQLMjcn9vbQ4PPYSv2B43Y8z0h5s=,tag:+h7YUNRA2MTvwGJq1VZW8g==,type:str]
+#ENC[AES256_GCM,data:6EvhlBtrl5wqyf6UAGwY8Q==,iv:fzLUjBzyuT17FcP8jlmLrsKW46pu6/lAvAVLHBxje6k=,tag:n+qR1NUqa91uFRIpALKlmw==,type:comment]
+example_array:
+    - ENC[AES256_GCM,data:A38KXABxJzMoKitKpHo=,iv:OlRap3R//9tvKdPLz7uP+lvBa/fD0W8xFzdxIKKFi4E=,tag:QKizPN1fYOv5zZlMVgTIOQ==,type:str]
+    - ENC[AES256_GCM,data:8X2iVkHQtQMReopWdgM=,iv:2Wq3QOadwd3G3ROXNe7JQD4AL/5H/WV19TBEbxijG/8=,tag:tikKT9Wvzm4Vz5aoy6w9WQ==,type:str]
+example_number: ENC[AES256_GCM,data:0K05hiSPh2Ok1A==,iv:IVRo61xkKugv4OiPm0vt9ODm5DC1DzJFdlgQJb1TfTg=,tag:o3xXygVEUD4jaGSJr0Nxtw==,type:float]
+example_booleans:
+    - ENC[AES256_GCM,data:zoykmQ==,iv:1JGy1Cg5GdAiod9qPSzW+wsG6rUgUJyYMEE4k576Tlk=,tag:RUCbytPpo78bqlAVEUsbLg==,type:bool]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1syted6kt48sumjjucggh6r3uca4x2ppp4mfungf3lamkt2le05csc99633
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlYmlqekUzY2NlQzAxQmZB
+            QllRaVVWSnpNNm4xWlpwNHdMOTJRS2hnS0FzClhkd1hHZk9NWWF3K25HWkxwbEUv
+            bXpmQjNTTERaRDlKODh2NEdIaytJYlUKLS0tIE5ZNGhrbUNONU1rY2dqR08rclRO
+            VHF2MXB2VGNhRzJ2czk5RGlLRm1QM0kKFQhRRrISgmU1neqwAewsS2AVog4Gg2QX
+            ukHvwzO8B6EHH83ppR9Z56aThSmyTSrU5TMwRiLRCWjKGpbL8Gap3Q==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age17tagmpwqjk3mdy45rfesrfey6h863x8wfq38wh33tkrlrywxducs0k6tpq
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSamUvT015TW9iQ3F5UHla
+            SWJ6cjQ0aEdmd0U0WUViL293MEtUazMrY1NVCmgvNXNhZzBSM1Y4b1JnbktQcm9Q
+            Rm9CaU9oZExyMFg5aVlQaHhZMkdhQUkKLS0tIDRiSHY2eFA5NmRtaTNYcnNiQ1Fx
+            RzhPY2l5UnREeFArWE5lS0p1TlBFdFkKoaV8MHuRCvPapWy/SDFjbtRSnzpU9qpL
+            uTfUHMYAkzTwftoQyKYRXY3Qizznn6O8e8SGgLUGPBk0HwrU9vq/8A==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1mrnldl334l2nszuta6ywvewng0fswv2dz9l5g4qcwe3nj4yxf92qjskdx6
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEaDVaaVAzSnMxSERHT1BM
+            TkthN0VQL3QzNGUranBxSE41ZW5ZeW5hL3cwCmR3SVk4bEtRdW53cURRbDh6SEZ3
+            OUx1ZDZtZmdSRjlKWWpSTi9ndnNsZTgKLS0tIDlja3h0N2dxUUZzMWVmZ1lTY0lO
+            VVBiSzAyamlTV3RXRTB4VDJubnRJbzAKZKALwMcN8rpCZdTPE17wNcqt81Lyh0lb
+            paU9GRRp5qBxMaNZaHGirhZWChf3ZjyA/assN4EWSNYe1yzNq9TCPg==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1hmpdk4h69wxpwqk9tkud39f66hprhehxtzhgw97r6dvr7v0mx5jscsuhkn
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCdW0vOHpiUnYwNkRaTzdH
+            NVlKazBUWHlzazRKZlZKZVpXZ1BNdjUreVV3CnlIRXpCTUdwSUNkSXRFdVdnM0E1
+            blZYdnpDK3orcTdQNVk5U3JiMEVEaTgKLS0tIGR1V1d0dW1TSDROQ1pVY0ZvellP
+            WnNxOFlNTWpxV0J2VWk1WDE4UjViUHcKZcGxaNaoalFmc1h2AOf5MKS9O7Kid+Xx
+            WatBjO9oU+lVcy2HGJhuDYoEg6cQ0ER+HTnfZwJRzDwBB6DCyeH8IQ==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1wrssr4z4g6vl3fd3qme5cewchmmhm0j2xe6wf2meu4r6ycn37anse98mfs
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLbm0wMW92U0tMaGR3bzdJ
+            c3QrODN3eXIvb1V2TVZldExpNzZoWEc5UkdjCmtETGxvK0ZHbWVvL1MrdVJOL2V1
+            R3Y4SjhlT3lObGdWRVZQSHh6MUJFd0kKLS0tIDhnOFQ3dEsrVnJWU1lUQlFzd3l1
+            Ny9NbUd1L201cTdkYWQvbHJIRjVWa1UKcHICycS4yPtk0lXrDJmFpS66C7c+GIdS
+            XzghorP2JQxpb3uUcy2XwOHJZMWy0KbFKYjLsIH48oJqqQ9j43WS8w==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1zhxul786an743u0fascv4wtc5xduu7qfy803lfs539yzhgmlq5ds2lznt5
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0YmFheU4wSG9QZTNtRVRz
+            Z21zalZBcWNObEFabXgxOWdYY3F1MENlMlc4CmtWeFl0ZSt4bUo0R3dydEozK3V1
+            dnZlZmtjMk9rdFZlTzFqUXJUdFNZWVUKLS0tIGU2VTdNVCsvRitZMXVleUg0L3lC
+            dU5QblEyZzJBOWJOeGoxQ29OS29hczgKC03MEGwaYq7WKKhh7pq1QOQfjH+L5+8b
+            HXP90cOyvc+dnpV/D2lSns6iK92FYOYVQ+wMjCsoB7zMj24MjPc03w==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-03-15T21:42:17Z"
+    mac: ENC[AES256_GCM,data:2gH/ZaxSA6ShRu53dxj7V3jk7FsVdYS+PSHQyFT8qMvKM1hsQ/nWrKt00PUl9I7Gb4uomP9Ga3SyphYOXRBzKoV+x52oEWOJE3Q4iPrwdCkyHlxEezhTd/ZRQVatG6dvHpLuDNS9Dyph4f7Mw5USI+m4WeVdgCvHTydw+4KIfP4=,iv:yimfq96WVsagvKr8HTg1RdZBSrVGcCWPvv8XOXkOfcg=,tag:zHzdrE0PX5+AeD2lpqeJVQ==,type:str]
+    pgp:
+        - created_at: "2025-03-15T21:46:06Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA0av/duuklWYAQ//QdHVK0PzPDj4BhvVm/FCiRMdKGw7BFDR/+qhxhEULMnu
+            6YSBtO5HMNhIkLlb+3gs/iIJ9+RxQjcxl00sUoEKpucE03QdmRD5EhGoNk3lNKc+
+            A2xelfPFOtbJpzjLub6JwsyfAQMO3c+Wj4f3SKCWK/ad8MVr2xHEhCUfoG9g5w4O
+            KprijBL98/nCXnhhseXFQLvlSIeAUcGMSj+nyvIpBVDIOsYPmgYxZDTOajRFQhcT
+            ZfAA36ViPwEz9LKSMvZe1KYHJVwrUsSrCdTZWZtRUb2udiVXCh6bFNd/eTqdMKiz
+            OBWtnYjD/JNpCtQmy+Y6xsy16udvuPZigY7Rb7CGKOoM4F32QUb22yY5DBLZDq+e
+            XCq1cQCZ+CCqHa3+7dqvZcnbTDa1plCdoinRaZNLuT9cKoclIZjFNW7bBbPTnFhx
+            0e8Zs85CJgarEE8K4b+6unBRN1C+awjCCeSXrPCcz59+qIyY/DC5EsjjV/11VTC3
+            WlHrafbOF1umDZ+Vp2ihylQO+gedVKvQ4qPLkweXn0u1UqokoxcCh+FsdUiGeeDp
+            PsRAQukmo60IPfnwVlZqpMVmJJ5gXIUOEZF7BmTvvcRzZIHTtJZFcNjYHyl5+/Un
+            r6CWiJbExYJm6cLVr8ZBA7gCg6XiVmdRQ/edkVfMHBharH0H8PNxd8WCgkelmsPS
+            XgFfQwymmSTaZHewifFWYe75rDJ8TPLmmmR1JCkIK8lJy6vygQ4k+JL6rKekVW/P
+            SYLrwup1QwcZR78gxjr7lzZNbAKij331EoSsO2+O+MQcfJIeUP51G6+UgJkxRfo=
+            =DyBj
+            -----END PGP MESSAGE-----
+          fp: F7D37890228A907440E1FD4846B9228E814A2AAC
+    unencrypted_suffix: _unencrypted
+    version: 3.8.1

secrets/bicep/bicep.yaml

@@ -3,8 +3,6 @@ calendar-bot:
     mysql_password: ENC[AES256_GCM,data:Gqag8yOgPH3ntoT5TmaqJWv1j+si2qIyz5Ryfw5E2A==,iv:kQDcxnPfwJQcFovI4f87UDt18F8ah3z5xeY86KmdCyY=,tag:A1sCSNXJziAmtUWohqwJgg==,type:str]
 mysql:
     password: ENC[AES256_GCM,data:KqEe0TVdeMIzPKsmFg9x0X9xWijnOk306ycyXTm2Tpqo/O0F,iv:Y+hlQ8n1ZIP9ncXBzd2kCSs/DWVTWhiEluFVwZFKRCA=,tag:xlaUk0Wftk62LpYE5pKNQw==,type:str]
-gickup:
-    github-token: ENC[AES256_GCM,data:H/yBDLIvEXunmaUha3c2vUWKLRIbl9QrC0t13AQDRCTnrvhabeiUFLNxZ/F+4B6sZ2aPSgZoB69WwnHvh1wLdiFp1qLWKW/jQPvzZOxE4n+jXrnSOutUWktbPzVj,iv:KFW4jRru93JIl9doVFtcNkJDWp89NlzWjPDflHxcL/U=,tag:YtgyRxkoZO9MkuP3DJh7zA==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -65,8 +63,8 @@ sops:
             cTh5bnJ3WW90aXRCSUp6NHFYeU1tZ0kK4afdtJwGNu6wLRI0fuu+mBVeqVeB0rgX
             0q5hwyzjiRnHnyjF38CmcGgydSfDRmF6P+WIMbCwXC6LwfRhAmBGPg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-05-07T21:34:48Z"
+    lastmodified: "2024-08-15T21:18:33Z"
-    mac: ENC[AES256_GCM,data:n6GHD+nQmZL17WvUZiMCBLRHbtpoKU6U8o/Oraj0VSRi/pQ74QWGVEcIX87kFjBvR2C+UPd3KwXzjQHhjUfHpz9EjIGi6tXLTTo8K3ptd2wCL8MW418TVO4KV+BFmHGT4kwlbdoqaJ2SA7HcfXNaC68e/2CTXhtkLpIwGXtYWJA=,iv:iC5QX/JMwno4mBljPdorNmcQSD2wy/wOYvGrUoC2yzg=,tag:GuFNQ6+d6o9DYC6Do/IEqQ==,type:str]
+    mac: ENC[AES256_GCM,data:uR5HgeDAYqoqB9kk1V6p0T30+v6WpQJi4+qIeCDRnoUPnQKUVR10hvBhICck+E+Uh8p+tGhM6Uf3YrAJAV0ZCUiNJjtwDJQQLUDT53vdOAXN4xADCQqNuhgVwVMaruoTheEiwOswRuhFeEwy0gBj3Ze2pu47lueHYclmEzumLeQ=,iv:t0UyXN2YaR2m7M/pV2wTLJG5wVfqTIUs7wSQMmyeTVw=,tag:O7dIffzrDAXz3kGx5uazhw==,type:str]
     pgp:
         - created_at: "2024-08-04T00:03:40Z"
           enc: |-
@@ -89,4 +87,4 @@ sops:
             -----END PGP MESSAGE-----
           fp: F7D37890228A907440E1FD4846B9228E814A2AAC
     unencrypted_suffix: _unencrypted
-    version: 3.9.4
+    version: 3.9.0

shell.nix

@@ -1,18 +1,6 @@
 { pkgs ? import <nixpkgs> {} }:
-
-let
-  nixos-rebuild-nom = pkgs.writeScriptBin "nixos-rebuild" ''
-    if [[ -t 1 && -z "''${NIX_NO_NOM-}" ]]; then
-      exec ${pkgs.lib.getExe pkgs.nixos-rebuild} -L "$@" |& ${pkgs.lib.getExe pkgs.nix-output-monitor}
-    else
-      exec ${pkgs.lib.getExe pkgs.nixos-rebuild} -L "$@"
-    fi
-  '';
-in
-
 pkgs.mkShellNoCC {
   packages = with pkgs; [
-    nixos-rebuild-nom
     just
     jq
     gum

users/oysteikt.nix

@@ -13,6 +13,7 @@
       bottom
       eza
       neovim
+      diskonaut
       ripgrep
       tmux
     ];

values.nix

@@ -27,6 +27,10 @@ in rec {
     gateway = pvv-ipv4 129;
     gateway6 = pvv-ipv6 1;
 
+    bakke = {
+      ipv4 = pvv-ipv4 173;
+      ipv6 = pvv-ipv6 173;
+    };
     bekkalokk = {
       ipv4 = pvv-ipv4 168;
       ipv6 = pvv-ipv6 168;