bicep: start revival

2026-04-18 22:51:57 +02:00
147 changed files with 2301 additions and 7357 deletions
@@ -7,13 +7,16 @@ jobs:
  evals:
    runs-on: debian-latest
    steps:
-    - name: Install sudo
-      run: apt-get install --update --assume-yes sudo
-
    - uses: actions/checkout@v6

+    - name: Install sudo
+      run: apt-get update && apt-get -y install sudo
+
    - uses: https://github.com/cachix/install-nix-action@v31

+    - name: Configure Nix
+      run: echo -e "show-trace = true\nmax-jobs = auto\ntrusted-users = root\nexperimental-features = nix-command flakes\nbuild-users-group =" > /etc/nix/nix.conf
+
    - name: Build topology graph
      run: nix build .#topology -L

@@ -6,11 +6,8 @@ jobs:
  evals:
    runs-on: debian-latest
    steps:
-    - name: Install sudo
-      run: apt-get install --update --assume-yes sudo
-
    - uses: actions/checkout@v6
-
+    - run: apt-get update && apt-get -y install sudo
    - uses: https://github.com/cachix/install-nix-action@v31
-
+    - run: echo -e "show-trace = true\nmax-jobs = auto\ntrusted-users = root\nexperimental-features = nix-command flakes\nbuild-users-group =" > /etc/nix/nix.conf
    - run: nix flake check
@@ -10,18 +10,19 @@ keys:
  - &user_vegardbm age1sqs7urnzsdy64efmd0zukzv3gs5pnjksuxd7nqmdwdy5l0nqnunq6hyune

  # Hosts
+  - &host_bakke age1syted6kt48sumjjucggh6r3uca4x2ppp4mfungf3lamkt2le05csc99633
  - &host_bekkalokk age12nj59tguy9wg882updc2vjdusx5srnxmjyfaqve4zx6jnnsaw3qsyjq6zd
  - &host_bicep age19nk55kcs7s0358jpkn75xnr57dfq6fq3p43nartvsprx0su22v7qcgcjdx
-  - &host_ildkule age102e6y8gah0ntr6fxqnkpepc8ar29p6ls7ks9ka7v8w87q8scm9yqmc2u8d
+  - &host_ildkule age1x28hmzvuv6f2n66c0jtqcca3h9rput8d7j5uek6jcpx8n9egd52sqpejq0
  - &host_kommode age1mt4d0hg5g76qp7j0884llemy0k2ymr5up8vfudz6vzvsflk5nptqqd32ly
  - &host_lupine-1 age18lta9d683yekz487xwtd99da236d8mgk4ftlmv2jffx858p9qf2s9j868l
  - &host_lupine-2 age1e0a4ru707v637wzmuxqv0xywmlkhunzgyfy4mrkjc7a23qq8msgq7nqtvt
  - &host_lupine-3 age1wmrrhd5deatmgflkas636u3rzuk46u9knl02v4t39ncs37xqquhq9vwzye
  - &host_lupine-4 age1ml48zztcmnrdrhrdsjrlyxf09jtmjgz46u8td4zm59wn3fm4g57qs4wg0l
  - &host_lupine-5 age12gws5nws69vxryd3kt7q0ayngch90efmhqcrfhnnsmj00lkgxd4qsdkvqn
+  - &host_skrott age1lpkju2e053aaddpgsr4ef83epclf4c9tp4m98d35ft2fswr8p4tq2ua0mf
+  - &host_ustetind age1hffjafs4slznksefmtqrlj7rdaqgzqncn4un938rhr053237ry8s3rs0v8
  - &host_skrot age1hzkvnktkr8t5gvtq0ccw69e44z5z6wf00n3xhk3hj24emf07je5s6q2evr
-  - &host_temmie age10avsdvqger25z0lyzlq8v7xfzcmypkmjsswswaxwqnpnl6x9wcjq0uv2n7
-  - &host_gluttony age12czfkvuw9pjk5qny5c6m2hjhd634cj9r4dsa3ss5zkux5h4vvc7s7k4urq

 creation_rules:
  # Global secrets
@@ -92,6 +93,19 @@ creation_rules:
      pgp:
      - *user_oysteikt

+  - path_regex: secrets/ustetind/[^/]+\.yaml$
+    key_groups:
+    - age:
+      - *host_ustetind
+      - *user_danio
+      - *user_felixalb
+      - *user_pederbs_sopp
+      - *user_pederbs_nord
+      - *user_pederbs_bjarte
+      - *user_vegardbm
+      pgp:
+      - *user_oysteikt
+
  - path_regex: secrets/lupine/[^/]+\.yaml$
    key_groups:
    - age:
@@ -109,6 +123,31 @@ creation_rules:
      pgp:
      - *user_oysteikt

+  - path_regex: secrets/bakke/[^/]+\.yaml$
+    key_groups:
+    - age:
+      - *host_bakke
+      - *user_danio
+      - *user_felixalb
+      - *user_pederbs_sopp
+      - *user_pederbs_nord
+      - *user_pederbs_bjarte
+      - *user_vegardbm
+      pgp:
+      - *user_oysteikt
+
+  - path_regex: secrets/skrott/[^/]+\.yaml$
+    key_groups:
+    - age:
+      - *host_skrott
+      - *user_danio
+      - *user_felixalb
+      - *user_pederbs_sopp
+      - *user_pederbs_nord
+      - *user_pederbs_bjarte
+      - *user_vegardbm
+      pgp:
+      - *user_oysteikt
  - path_regex: secrets/skrot/[^/]+\.yaml$
    key_groups:
    - age:
@@ -121,29 +160,3 @@ creation_rules:
      - *user_vegardbm
      pgp:
      - *user_oysteikt
-
-  - path_regex: secrets/temmie/[^/]+\.yaml$
-    key_groups:
-    - age:
-      - *host_temmie
-      - *user_danio
-      - *user_felixalb
-      - *user_pederbs_sopp
-      - *user_pederbs_nord
-      - *user_pederbs_bjarte
-      - *user_vegardbm
-      pgp:
-      - *user_oysteikt
-
-  - path_regex: secrets/gluttony/[^/]+\.yaml$
-    key_groups:
-    - age:
-      - *host_gluttony
-      - *user_danio
-      - *user_felixalb
-      - *user_pederbs_sopp
-      - *user_pederbs_nord
-      - *user_pederbs_bjarte
-      - *user_vegardbm
-      pgp:
-      - *user_oysteikt
@@ -39,13 +39,11 @@ revert the changes on the next nightly rebuild (tends to happen when everybody i
 |  bikkje                    | Virtual  | Experimental login box                                    |
 | [brzeczyszczykiewicz][brz] | Physical | Shared music player                                       |
 | [georg][geo]               | Physical | Shared music player                                       |
-| [gluttony][glu]            | Virtual  | General purpose compute                                   |
 | [ildkule][ild]             | Virtual  | Logging and monitoring host, prometheus, grafana, ...     |
 | [kommode][kom]             | Virtual  | Gitea + Gitea pages                                       |
 | [lupine][lup]              | Physical | Gitea CI/CD runners                                       |
 |  shark                     | Virtual  | Test host for authentication, absolutely horrendous       |
-| [skrot][skr]               | Physical | Kiosk, snacks and soda                                    |
-| [temmie][tem]              | Virtual  | User websites                                             |
+| [skrot/skrott][skr]        | Physical | Kiosk, snacks and soda                                    |
 | [wenche][wen]              | Virtual  | Nix-builders, general purpose compute                     |

 ## Documentation
@@ -59,10 +57,8 @@ revert the changes on the next nightly rebuild (tends to happen when everybody i
 [bic]: https://wiki.pvv.ntnu.no/wiki/Maskiner/bicep
 [brz]: https://wiki.pvv.ntnu.no/wiki/Maskiner/brzęczyszczykiewicz
 [geo]: https://wiki.pvv.ntnu.no/wiki/Maskiner/georg
-[glu]: https://wiki.pvv.ntnu.no/wiki/Maskiner/gluttony
 [ild]: https://wiki.pvv.ntnu.no/wiki/Maskiner/ildkule
 [kom]: https://wiki.pvv.ntnu.no/wiki/Maskiner/kommode
 [lup]: https://wiki.pvv.ntnu.no/wiki/Maskiner/lupine
-[skr]: https://wiki.pvv.ntnu.no/wiki/Maskiner/Skrot
-[tem]: https://wiki.pvv.ntnu.no/wiki/Maskiner/temmie
+[skr]: https://wiki.pvv.ntnu.no/wiki/Maskiner/Skrott
 [wen]: https://wiki.pvv.ntnu.no/wiki/Maskiner/wenche
@@ -1,8 +1,6 @@
 {
-  config,
  pkgs,
  lib,
-  inputs,
  fp,
  ...
 }:
@@ -12,9 +10,7 @@
    (fp /users)
    (fp /modules/snakeoil-certs.nix)

-    ./mitigations.nix
-
-    ./hardening.nix
+    ./flake-input-exporter.nix
    ./networking.nix
    ./nix.nix
    ./programs.nix
@@ -24,43 +20,31 @@
    ./services/acme.nix
    ./services/auto-upgrade.nix
    ./services/dbus.nix
-    ./services/fluentbit.nix
    ./services/fwupd.nix
    ./services/irqbalance.nix
    ./services/journald-upload.nix
    ./services/logrotate.nix
    ./services/nginx.nix
-    ./services/nullmailer.nix
    ./services/openssh.nix
    ./services/polkit.nix
-    ./services/prometheus-flake-input-exporter.nix
+    ./services/postfix.nix
    ./services/prometheus-node-exporter.nix
    ./services/prometheus-systemd-exporter.nix
+    ./services/promtail.nix
    ./services/roowho2.nix
-    ./services/rsyslogd.nix
-    ./services/scrutiny-collector.nix
    ./services/smartd.nix
    ./services/thermald.nix
-    ./services/timesyncd.nix
    ./services/uptimed.nix
    ./services/userborn.nix
    ./services/userdbd.nix
  ];

-  system.nixos.tags = lib.optionals (inputs.self.sourceInfo ? dirtyRev) [ "dirty" ];
-
-  specialisation."auto-upgrade".configuration = {
-    system.nixos.tags = [ "auto" ];
-  };
-
  boot.tmp.cleanOnBoot = lib.mkDefault true;
  boot.kernelPackages = lib.mkDefault pkgs.linuxPackages_latest;

  boot.loader.systemd-boot.enable = lib.mkDefault true;
  boot.loader.efi.canTouchEfiVariables = lib.mkDefault true;

-  services.btrfs.autoScrub.enable = lib.mkDefault (lib.any ({ fsType, ... }: fsType == "btrfs") (lib.attrValues config.fileSystems));
-
  time.timeZone = "Europe/Oslo";

  i18n.defaultLocale = "en_US.UTF-8";
@@ -84,25 +68,21 @@
    fi
  '';

+  # security.lockKernelModules = true;
+  security.protectKernelImage = true;
  security.sudo.execWheelOnly = true;
  security.sudo.extraConfig = ''
    Defaults lecture = never
  '';

  # These are servers, sleep is for the weak
-  systemd.sleep.settings.Sleep = {
-    AllowSuspend = lib.mkDefault false;
-    AllowHibernation = lib.mkDefault false;
-  };
-
-  systemd.slices."system-monitoring" = {
-    description = "Monitoring related services";
-  };
+  systemd.sleep.extraConfig = lib.mkDefault ''
+    AllowSuspend=no
+    AllowHibernation=no
+  '';

  # users.mutableUsers = lib.mkDefault false;

-  users.users.root.initialHashedPassword = "$y$j9T$ahP6GAdttD17OMBo7Yqeh.$Ad7qBcFvTL7HrJ9uTtrQzksN3220Nj9t/CrP6DwgK34"; # generated using mkpasswd, see huttiheita root on vaultwarden
-
  users.groups."drift".name = "drift";

  # Trusted users on the nix builder machines
@@ -0,0 +1,55 @@
+{
+  config,
+  inputs,
+  lib,
+  pkgs,
+  values,
+  ...
+}:
+let
+  data = lib.flip lib.mapAttrs inputs (
+    name: input: {
+      inherit (input)
+        lastModified
+        ;
+    }
+  );
+  folder = pkgs.writeTextDir "share/flake-inputs" (
+    lib.concatMapStringsSep "\n" (
+      { name, value }: ''nixos_last_modified_input{flake="${name}"} ${toString value.lastModified}''
+    ) (lib.attrsToList data)
+  );
+  port = 9102;
+in
+{
+  services.nginx.virtualHosts."${config.networking.fqdn}-nixos-metrics" = {
+    serverName = config.networking.fqdn;
+    serverAliases = [
+      "${config.networking.hostName}.pvv.org"
+    ];
+    locations."/metrics" = {
+      root = "${folder}/share";
+      tryFiles = "/flake-inputs =404";
+      extraConfig = ''
+        default_type text/plain;
+      '';
+    };
+    listen = [
+      {
+        inherit port;
+        addr = "0.0.0.0";
+      }
+    ];
+    extraConfig = ''
+      allow ${values.hosts.ildkule.ipv4}/32;
+      allow ${values.hosts.ildkule.ipv6}/128;
+      allow 127.0.0.1/32;
+      allow ::1/128;
+      allow ${values.ipv4-space};
+      allow ${values.ipv6-space};
+      deny all;
+    '';
+  };
+
+  networking.firewall.allowedTCPPorts = [ port ];
+}
@@ -1,71 +0,0 @@
-{ ... }:
-{
-  boot.blacklistedKernelModules = [
-    # Obscure network protocols
-    "appletalk"
-    "atm"
-    "ax25"
-    "batman-adv"
-    "can"
-    "dccp"
-    "ipx"
-    "llc"
-    "n-hdlc"
-    "netrom"
-    "p8022"
-    "p8023"
-    "psnap"
-    "rds"
-    "rose"
-    "sctp"
-    "tipc"
-
-    # Filesystems we don't use
-    "adfs"
-    "affs"
-    "befs"
-    "bfs"
-    "cifs"
-    "cramfs"
-    "efs"
-    "exofs"
-    "freevxfs"
-    "gfs2"
-    "hfs"
-    "hfsplus"
-    "hpfs"
-    "jffs2"
-    "jfs"
-    "minix"
-    "nilfs2"
-    "ntfs"
-    "omfs"
-    "orangefs"
-    "qnx4"
-    "qnx6"
-    "sysv"
-    "ubifs"
-    "udf"
-    "ufs"
-
-    # Legacy hardware
-    "pcspkr"
-    "floppy"
-    "parport"
-    "ppdev"
-
-    # Other stuff we don't use
-    "firewire-core"
-    "firewire-ohci"
-    "ksmbd"
-    "ib_core"
-    "l2tp_eth"
-    "l2tp_netlink"
-    "l2tp_ppp"
-    "nfc"
-    "soundwire"
-  ];
-
-  # security.lockKernelModules = true;
-  security.protectKernelImage = true;
-}
@@ -1,24 +0,0 @@
-{ pkgs, lib, ... }:
-let
-  modulesToBan = [
-    # copy.fail
-    "af_alg"
-    "algif_aead"
-    "algif_hash"
-    "algif_rng"
-    "algif_skcipher"
-
-    # dirtyfrag / Fragnesia
-    "esp4"
-    "esp6"
-    "rxrpc"
-
-    # PinTheft
-    "rds"
-  ];
-in
-{
-  boot.blacklistedKernelModules = modulesToBan;
-
-  boot.extraModprobeConfig = lib.concatMapStringsSep "\n" (mod: "install ${mod} ${lib.getExe' pkgs.coreutils "false"}") modulesToBan;
-}
@@ -8,6 +8,6 @@

  services.resolved = {
    enable = lib.mkDefault true;
-    settings.Resolve.DNSSEC = false; # Supposdly this keeps breaking and the default is to allow downgrades anyways...
+    dnssec = "false"; # Supposdly this keeps breaking and the default is to allow downgrades anyways...
  };
 }
@@ -8,5 +8,6 @@
  # Let's not spam LetsEncrypt in `nixos-rebuild build-vm` mode:
  virtualisation.vmVariant = {
    security.acme.defaults.server = "https://127.0.0.1";
+    users.users.root.initialPassword = "root";
  };
 }
@@ -13,7 +13,6 @@ in

      "--refresh"
      "--no-write-lock-file"
-      "--specialisation auto-upgrade"
      # --update-input is deprecated since nix 2.22, and removed in lix 2.90
      # as such we instead use --override-input combined with --refresh
      # https://git.lix.systems/lix-project/lix/issues/400
@@ -1,138 +0,0 @@
-{ config, lib, ... }:
-let
-  cfg = config.services.fluent-bit;
-in
-{
-  services.fluent-bit = {
-    enable = lib.mkDefault true;
-    settings = {
-      service = {
-        flush = 1;
-        log_level = "warn";
-
-        http_server = "on";
-        http_listen = "127.0.0.1";
-        http_port = 28183;
-
-        # filesystem-backed buffering so logs survives potential outages.
-        "storage.path" = "/var/lib/fluent-bit/storage";
-        "storage.sync" = "normal";
-        "storage.max_chunks_up" = 64;
-        "storage.backlog.mem_limit" = "16M";
-      };
-
-      pipeline = {
-        inputs = [{
-          name = "systemd";
-          tag = "journal.*";
-
-          db = "/var/lib/fluent-bit/journal.db";
-          read_from_tail = true;
-          strip_underscores = true;
-          lowercase = true;
-          max_entries = 1000;
-          "storage.type" = "filesystem";
-        }];
-
-        filters = [{
-          name = "modify";
-          match = "journal.*";
-          rename = [
-            "hostname host"
-            "priority level"
-            "systemd_unit unit"
-          ];
-        }] ++ (lib.mapAttrsToList (k: v: {
-          name = "modify";
-          match = "journal.*";
-          condition = "Key_value_equals level ${k}";
-          set = "level ${v}";
-        }) {
-          "7" = "debug";
-          "6" = "info";
-          "5" = "notice";
-          "4" = "warning";
-          "3" = "error";
-          "2" = "crit";
-          "1" = "alert";
-          "0" = "emergency";
-        });
-
-        outputs = [{
-          name = "loki";
-          match = "*";
-
-          host = "loki.pvv.ntnu.no";
-          port = 443;
-          tls = "on";
-          "tls.verify" = "on";
-          uri = "/loki/api/v1/push";
-          compress = "gzip";
-
-          labels = lib.concatStringsSep ", " [
-            "job=systemd-journal"
-          ];
-          label_keys = lib.concatMapStringsSep "," (k: "$" + k) [
-            "host"
-            "unit"
-            "level"
-          ];
-
-          # JSON is probably fine for now, then we just extract the keys we want with the grafana web ui
-          # line_format = "key_value";
-          # drop_single_key = true;
-
-          "storage.total_limit_size" = "256M";
-        }];
-      };
-    };
-  };
-
-  systemd.services.fluent-bit = lib.mkIf cfg.enable {
-    serviceConfig = {
-      Slice = "system-monitoring.slice";
-      StateDirectory = "fluent-bit";
-
-      # NOTE: This hardening might be way too strong for general purpose use, don't upstream this.
-      AmbientCapabilities = [ "" ];
-      CapabilityBoundingSet = [ "" ];
-      DeviceAllow = [ "" ];
-      LockPersonality = true;
-      # Lua JIT, maybe other things
-      MemoryDenyWriteExecute = false;
-      NoNewPrivileges = true;
-      PrivateDevices = true;
-      PrivateMounts = true;
-      PrivateTmp = true;
-      PrivateUsers = true;
-      ProtectClock = true;
-      ProtectControlGroups = true;
-      ProtectHome = true;
-      ProtectHostname = true;
-      ProtectKernelLogs = true;
-      ProtectKernelModules = true;
-      ProtectKernelTunables = true;
-      ProtectProc = "invisible";
-      ProtectSystem = "strict";
-      RestrictAddressFamilies = [
-        "AF_INET"
-        "AF_INET6"
-        "AF_UNIX"
-      ];
-      RestrictNamespaces = true;
-      RestrictRealtime = true;
-      RestrictSUIDSGID = true;
-      SystemCallArchitectures = "native";
-      SystemCallFilter = [
-        "@system-service"
-        "~@privileged"
-        "~@resources"
-      ];
-      UMask = "0077";
-
-      BindReadOnlyPaths = [
-        "/run/systemd/journal"
-      ];
-    };
-  };
-}
@@ -1,22 +1,4 @@
-{ config, pkgs, lib, ... }:
-let
-  cfg = config.services.irqbalance;
-in
+{ ... }:
 {
  services.irqbalance.enable = true;
-
-  # irqbalance only has meaningful work to do on multi-socket machines, so
-  # skip starting it pointlessly everywhere else.
-  systemd.services.irqbalance.serviceConfig.ExecCondition = let
-    isMultiSocket = pkgs.writeShellApplication {
-      name = "irqbalance-is-multi-socket";
-      runtimeInputs = [ pkgs.coreutils ];
-      text = ''
-        sockets=$(cat /sys/devices/system/cpu/cpu*/topology/physical_package_id | sort -u | wc -l)
-        [ "$sockets" -gt 1 ]
-      '';
-    };
-  in lib.mkIf cfg.enable [
-    (lib.getExe isMultiSocket)
-  ];
-}
+}
@@ -6,7 +6,8 @@ in
  services.journald.upload = {
    enable = lib.mkDefault true;
    settings.Upload = {
-      URL = "https://journald.pvv.ntnu.no:${toString config.services.journald.remote.port}";
+      # URL = "https://journald.pvv.ntnu.no:${toString config.services.journald.remote.port}";
+      URL = "https://${values.hosts.ildkule.ipv4}:${toString config.services.journald.remote.port}";
      ServerKeyFile = "-";
      ServerCertificateFile = "-";
      TrustedCertificateFile = "-";
@@ -14,7 +15,6 @@ in
  };

  systemd.services."systemd-journal-upload".serviceConfig = lib.mkIf cfg.enable {
-    Slice = "system-monitoring.slice";
    IPAddressDeny = "any";
    IPAddressAllow = [
      values.hosts.ildkule.ipv4
@@ -1,5 +1,18 @@
 { config, lib, ... }:
 {
+  # nginx return 444 for all nonexistent virtualhosts
+
+  systemd.services.nginx.after = [ "generate-snakeoil-certs.service" ];
+
+  environment.snakeoil-certs = lib.mkIf config.services.nginx.enable {
+    "/etc/certs/nginx" = {
+      owner = "nginx";
+      group = "nginx";
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = lib.mkIf config.services.nginx.enable [ 80 443 ];
+
  services.nginx = {
    recommendedTlsSettings = true;
    recommendedProxySettings = true;
@@ -47,8 +60,17 @@
          ];
        }
      ];
+      sslCertificate = "/etc/certs/nginx.crt";
+      sslCertificateKey = "/etc/certs/nginx.key";
+      addSSL = true;
+      extraConfig = "return 444;";
+    };
+
+    ${config.networking.fqdn} = {
+      sslCertificate = lib.mkDefault "/etc/certs/nginx.crt";
+      sslCertificateKey = lib.mkDefault "/etc/certs/nginx.key";
+      addSSL = lib.mkDefault true;
+      extraConfig = lib.mkDefault "return 444;";
    };
  };
-
-  networking.firewall.allowedTCPPorts = lib.mkIf config.services.nginx.enable [ 80 443 ];
 }
@@ -1,15 +0,0 @@
-{ config, lib, ... }:
-{
-  services.nullmailer = {
-    enable = true;
-
-    config = {
-      adminaddr = "root@pvv.ntnu.no";
-      defaultdomain = "pvv.ntnu.no";
-      defaulthost = "pvv.ntnu.no";
-
-      me = lib.mkDefault config.networking.fqdn;
-      remotes = lib.mkDefault "smtp.pvv.ntnu.no smtp port=465 tls";
-    };
-  };
-}
@@ -10,18 +10,12 @@
      Match All
    '';
    settings.PermitRootLogin = "yes";
-    settings.AcceptEnv = [
-      "LANG"
-      "LC_*"
-      "COLORTERM"
-      "GIT_PROTOCOL"
-    ];
+
  };
+    users.users."root".openssh.authorizedKeys.keys = [
+      "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCqVt4LCe0YIttr9swFxjkjn37ZDY9JxwVC+2gvfSINDJorOCtqPjDOTD2fTS1Gz08QCwpnLWq2kyvRchu6WgriAbSACpbZZBgxRaF/FVh3oiMVFGnNKGnv6/fdo/vZtu8mUVuqtmTrgLYpZdbR4oD3XiBlDKs7Cv5hPqt95lnP6MNFvE8mICCfd1PwhsABd2IQ5laz3u77/RXhNFJL0Kf2/+6gk9awcLuwHrPdvq7c3BxRHbc9UMRQENyjyQPa7aLe+uJBFLKP51I8VBuDpDacuibQx7nMt6N2UJ2KWI0JxRMHuJNq4S5jidR82aOw9gzGbTv30SKNLMqsZ0xj4LtdqCXDiZF6Lr09PsJYsvnBUFWa14HGcThKDtgwQwBryNViYmfv//0h9+RLZiU0ab+NEwSs7Zh5iAD+vhx64QqNX3tR7Le4SWXh8W0eShU9N78qYdSkiC3Ui7htxeqOocXM/P4AwbnHsLELIvkHdvgchCPvl8ygZa4WJTEWv16+ICskJcAKWGuqjvXAFuwjJJmPp9xLW9O0DFfQhMELiGamQR9wK07yYQVr34iah6qZO7cwhSKyEPFrVPIaNtfDhsjED639F7vmktf26SWNJHWfW0wOHILjI6TgqUvy0JDd8W8w0CHlAfz6Fs2l99NNgNF8dB3vBASbxS0hu/y0PVu/xQ== openstack-sleipner"

-  users.users."root".openssh.authorizedKeys.keys = [
-    "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCqVt4LCe0YIttr9swFxjkjn37ZDY9JxwVC+2gvfSINDJorOCtqPjDOTD2fTS1Gz08QCwpnLWq2kyvRchu6WgriAbSACpbZZBgxRaF/FVh3oiMVFGnNKGnv6/fdo/vZtu8mUVuqtmTrgLYpZdbR4oD3XiBlDKs7Cv5hPqt95lnP6MNFvE8mICCfd1PwhsABd2IQ5laz3u77/RXhNFJL0Kf2/+6gk9awcLuwHrPdvq7c3BxRHbc9UMRQENyjyQPa7aLe+uJBFLKP51I8VBuDpDacuibQx7nMt6N2UJ2KWI0JxRMHuJNq4S5jidR82aOw9gzGbTv30SKNLMqsZ0xj4LtdqCXDiZF6Lr09PsJYsvnBUFWa14HGcThKDtgwQwBryNViYmfv//0h9+RLZiU0ab+NEwSs7Zh5iAD+vhx64QqNX3tR7Le4SWXh8W0eShU9N78qYdSkiC3Ui7htxeqOocXM/P4AwbnHsLELIvkHdvgchCPvl8ygZa4WJTEWv16+ICskJcAKWGuqjvXAFuwjJJmPp9xLW9O0DFfQhMELiGamQR9wK07yYQVr34iah6qZO7cwhSKyEPFrVPIaNtfDhsjED639F7vmktf26SWNJHWfW0wOHILjI6TgqUvy0JDd8W8w0CHlAfz6Fs2l99NNgNF8dB3vBASbxS0hu/y0PVu/xQ== openstack-sleipner"
-
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICCbgJ0Uwh9VSVhfId7l9i5/jk4CvAK5rbkiab8R+moF root@sleipner"
-  ];
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICCbgJ0Uwh9VSVhfId7l9i5/jk4CvAK5rbkiab8R+moF root@sleipner"
+    ];
 }

@@ -6,13 +6,10 @@ in
  security.polkit.enable = true;

  environment.etc."polkit-1/rules.d/9-nixos-overrides.rules".text = lib.mkIf cfg.enable ''
-    polkit.addRule(function(action, subject) {
-       if (
-           action.id.startsWith("org.freedesktop.systemd1.") &&
-           subject.isInGroup("wheel")
-       ) {
-           return polkit.Result.AUTH_SELF_KEEP;
-         }
-     });
+    polkit.addAdminRule(function(action, subject) {
+        if(subject.isInGroup("wheel")) {
+            return ["unix-user:"+subject.user];
+        }
+    });
  '';
 }
@@ -0,0 +1,22 @@
+{ config, pkgs, lib, ... }:
+let
+  cfg = config.services.postfix;
+in
+{
+  services.postfix = {
+    enable = true;
+
+    settings.main = {
+      myhostname = "${config.networking.hostName}.pvv.ntnu.no";
+      mydomain = "pvv.ntnu.no";
+
+      # Nothing should be delivered to this machine
+      mydestination = [ ];
+
+      relayhost = [ "smtp.pvv.ntnu.no:465" ];
+
+      smtp_tls_wrappermode = "yes";
+      smtp_tls_security_level = "encrypt";
+    };
+  };
+}
@@ -1,47 +0,0 @@
-{
-  config,
-  inputs,
-  lib,
-  pkgs,
-  values,
-  ...
-}:
-let
-  data = lib.flip lib.mapAttrs inputs (
-    name: input: {
-      inherit (input)
-        lastModified
-        ;
-    }
-  );
-  folder = pkgs.writeTextDir "share/flake-inputs" (
-    lib.concatMapStringsSep "\n" (
-      { name, value }: ''nixos_last_modified_input{flake="${name}"} ${toString value.lastModified}''
-    ) (lib.attrsToList data)
-  );
-in
-{
-  services.nginx = {
-    enable = lib.mkDefault true;
-
-    virtualHosts.${config.networking.fqdn} = lib.mkIf config.services.nginx.enable {
-      forceSSL = true;
-      enableACME = true;
-      kTLS = true;
-
-      locations."/prometheus-nixos-flake-input-exporter/metrics" = {
-        root = "${folder}/share";
-        tryFiles = "/flake-inputs =404";
-        extraConfig = ''
-          default_type text/plain;
-
-          allow 127.0.0.1;
-          allow ::1;
-          allow ${values.hosts.ildkule.ipv4};
-          allow ${values.hosts.ildkule.ipv6};
-          deny all;
-        '';
-      };
-    };
-  };
-}
@@ -5,34 +5,19 @@ in
 {
  services.prometheus.exporters.node = {
    enable = lib.mkDefault true;
-    listenAddress = "127.0.0.1";
    port = 9100;
    enabledCollectors = [ "systemd" ];
  };

-  services.nginx = lib.mkIf cfg.enable {
-    enable = lib.mkDefault true;
-
-    virtualHosts.${config.networking.fqdn} = lib.mkIf config.services.nginx.enable {
-      forceSSL = true;
-      enableACME = true;
-      kTLS = true;
-
-      locations."/prometheus-node-exporter/metrics" = {
-        proxyPass = "http://localhost:${toString cfg.port}/metrics";
-
-        extraConfig = ''
-          allow 127.0.0.1;
-          allow ::1;
-          allow ${values.hosts.ildkule.ipv4};
-          allow ${values.hosts.ildkule.ipv6};
-          deny all;
-        '';
-      };
-    };
+  systemd.services.prometheus-node-exporter.serviceConfig = lib.mkIf cfg.enable {
+    IPAddressDeny = "any";
+    IPAddressAllow = [
+      "127.0.0.1"
+      "::1"
+      values.hosts.ildkule.ipv4
+      values.hosts.ildkule.ipv6
+    ];
  };

-  systemd.services = lib.mkIf cfg.enable {
-    "prometheus-node-exporter".serviceConfig.Slice = "system-monitoring.slice";
-  };
+  networking.firewall.allowedTCPPorts = lib.mkIf cfg.enable [ cfg.port ];
 }
@@ -5,7 +5,6 @@ in
 {
  services.prometheus.exporters.systemd = {
    enable = lib.mkDefault true;
-    listenAddress = "127.0.0.1";
    port = 9101;
    extraFlags = [
      "--systemd.collector.enable-restart-count"
@@ -13,29 +12,15 @@ in
    ];
  };

-  services.nginx = lib.mkIf cfg.enable {
-    enable = lib.mkDefault true;
-
-    virtualHosts.${config.networking.fqdn} = lib.mkIf config.services.nginx.enable {
-      forceSSL = true;
-      enableACME = true;
-      kTLS = true;
-
-      locations."/prometheus-systemd-exporter/metrics" = {
-        proxyPass = "http://localhost:${toString cfg.port}/metrics";
-
-        extraConfig = ''
-          allow 127.0.0.1;
-          allow ::1;
-          allow ${values.hosts.ildkule.ipv4};
-          allow ${values.hosts.ildkule.ipv6};
-          deny all;
-        '';
-      };
-    };
+  systemd.services.prometheus-systemd-exporter.serviceConfig = {
+    IPAddressDeny = "any";
+    IPAddressAllow = [
+      "127.0.0.1"
+      "::1"
+      values.hosts.ildkule.ipv4
+      values.hosts.ildkule.ipv6
+    ];
  };

-  systemd.services = lib.mkIf cfg.enable {
-    "prometheus-systemd-exporter".serviceConfig.Slice = "system-monitoring.slice";
-  };
+  networking.firewall.allowedTCPPorts = lib.mkIf cfg.enable [ cfg.port ];
 }
@@ -0,0 +1,38 @@
+{ config, lib, values, ... }:
+let
+  cfg = config.services.prometheus.exporters.node;
+in
+{
+  services.promtail = {
+    enable = lib.mkDefault true;
+    configuration = {
+      server = {
+        http_listen_port = 28183;
+        grpc_listen_port = 0;
+      };
+      clients = [{
+        url = "http://ildkule.pvv.ntnu.no:3100/loki/api/v1/push";
+      }];
+      scrape_configs = [{
+        job_name = "systemd-journal";
+        journal = {
+          max_age = "12h";
+          labels = {
+            job = "systemd-journal";
+            host = config.networking.hostName;
+          };
+        };
+        relabel_configs = [
+          {
+            source_labels = [ "__journal__systemd_unit" ];
+            target_label = "unit";
+          }
+          {
+            source_labels = [ "__journal_priority_keyword" ];
+            target_label = "level";
+          }
+        ];
+      }];
+    };
+  };
+}
@@ -1,20 +0,0 @@
-{ config, lib, ... }:
-let
-  cfg = config.services.rsyslogd;
-in
-{
-  services.rsyslogd = {
-    enable = lib.mkDefault true;
-    defaultConfig = ''
-      *.* @loghost.pvv.ntnu.no
-    '';
-  };
-
-  services.journald.extraConfig = lib.mkIf cfg.enable ''
-    ForwardToSyslog=yes
-  '';
-
-  systemd.services = lib.mkIf cfg.enable {
-    "syslog".serviceConfig.Slice = "system-monitoring.slice";
-  };
-}
@@ -1,11 +0,0 @@
-{ config, ... }:
-{
-  services.scrutiny.collector = {
-    enable = !config.services.qemuGuest.enable;
-    settings = {
-      version = 1;
-      host.id = config.networking.hostName;
-      api.endpoint = "https://scrutiny.pvv.ntnu.no/";
-    };
-  };
-}
@@ -1,12 +0,0 @@
-{ ... }:
-{
-  services.timesyncd = {
-    servers = [ "ntp.ntnu.no" ];
-    fallbackServers = [
-      "0.pool.ntp.org"
-      "1.pool.ntp.org"
-      "0.no.pool.ntp.org"
-    ];
-  };
-}
-
@@ -23,7 +23,7 @@ in
      };
    };

-    systemd.services.uptimed = lib.mkIf cfg.enable {
+    systemd.services.uptimed = lib.mkIf (cfg.enable) {
      serviceConfig = let
        uptimed = pkgs.uptimed.overrideAttrs (prev: {
          postPatch = ''
@@ -35,8 +35,6 @@ in
        });

      in {
-        Slice = "system-monitoring.slice";
-
        Type = "notify";

        ExecStart = lib.mkForce "${uptimed}/sbin/uptimed -f";
@@ -1,34 +1,12 @@
 {
  "nodes": {
-    "bro": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ],
-        "rust-overlay": "rust-overlay"
-      },
-      "locked": {
-        "lastModified": 1779629827,
-        "narHash": "sha256-nrlB50/oelB8oFx9DhOoXI5z0VoTZGEA6XxYvkvpqDA=",
-        "ref": "main",
-        "rev": "7d0f35e12e4dec39f981c08fc33515589f41f4a5",
-        "revCount": 3,
-        "type": "git",
-        "url": "https://git.pvv.ntnu.no/Projects/bro.git"
-      },
-      "original": {
-        "ref": "main",
-        "type": "git",
-        "url": "https://git.pvv.ntnu.no/Projects/bro.git"
-      }
-    },
    "crane": {
      "locked": {
-        "lastModified": 1784407669,
-        "narHash": "sha256-gcFMcRjw0ZSn380Rx2QLlU1goUQeSrKX/DF12omI6+o=",
+        "lastModified": 1770419512,
+        "narHash": "sha256-o8Vcdz6B6bkiGUYkZqFwH3Pv1JwZyXht3dMtS7RchIo=",
        "owner": "ipetkov",
        "repo": "crane",
-        "rev": "1316b7d278ad77a16aec024b71d971366e123bec",
+        "rev": "2510f2cbc3ccd237f700bb213756a8f35c32d8d7",
        "type": "github"
      },
      "original": {
@@ -44,11 +22,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1784367836,
-        "narHash": "sha256-yeWTb3KNvHY/InqbVmIjQRH5BI4d2HFbQqWi2eRKiv0=",
+        "lastModified": 1771267058,
+        "narHash": "sha256-EEL4SmD1b3BPJPsSJJ4wDTXWMumJqbR+BLzhJJG0skE=",
        "ref": "main",
-        "rev": "422f383fd8736d60cd2fe818168b93d07f013865",
-        "revCount": 259,
+        "rev": "e3962d02c78b9c7b4d18148d931a9a4bf22e7902",
+        "revCount": 254,
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Projects/dibbler.git"
      },
@@ -65,16 +43,16 @@
        ]
      },
      "locked": {
-        "lastModified": 1768920986,
-        "narHash": "sha256-CNzzBsRhq7gg4BMBuTDObiWDH/rFYHEuDRVOwCcwXw4=",
+        "lastModified": 1736864502,
+        "narHash": "sha256-ItkIZyebGvNH2dK9jVGzJHGPtb6BSWLN8Gmef16NeY0=",
        "owner": "nix-community",
        "repo": "disko",
-        "rev": "de5708739256238fb912c62f03988815db89ec9a",
+        "rev": "0141aabed359f063de7413f80d906e1d98c0c123",
        "type": "github"
      },
      "original": {
        "owner": "nix-community",
-        "ref": "v1.13.0",
+        "ref": "v1.11.0",
        "repo": "disko",
        "type": "github"
      }
@@ -100,15 +78,15 @@
    "gergle": {
      "inputs": {
        "nixpkgs": [
-          "nixpkgs-unstable"
+          "nixpkgs"
        ]
      },
      "locked": {
-        "lastModified": 1784553797,
-        "narHash": "sha256-buGdmnsKNRDUNsb+aXGeUc/UjGGsMbH1KWy3xnheInA=",
+        "lastModified": 1770617355,
+        "narHash": "sha256-lauV1yKA67WxnlbiJiwhOT9xI8nTiUqqrrRlgA+rMis=",
        "ref": "main",
-        "rev": "c3101eb7424d4b15665bd00624220ec411187797",
-        "revCount": 36,
+        "rev": "36af0316a7370d19db05ef7c0a87e826f4a222d5",
+        "revCount": 24,
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Grzegorz/gergle.git"
      },
@@ -121,15 +99,15 @@
    "greg-ng": {
      "inputs": {
        "nixpkgs": [
-          "nixpkgs-unstable"
+          "nixpkgs"
        ],
-        "rust-overlay": "rust-overlay_2"
+        "rust-overlay": "rust-overlay"
      },
      "locked": {
-        "lastModified": 1784553736,
-        "narHash": "sha256-W1pPlTHmp+EvONwf8Qa5NvCiuyV4LC/yNDdc27RSpuA=",
+        "lastModified": 1770617867,
+        "narHash": "sha256-xPLm4C13KUl0zmm1OA+A8UwDSixwtNQ/caRx/WjN+WY=",
        "ref": "main",
-        "rev": "e06daaef1f48160254c202c59b060ac6f1da9f38",
+        "rev": "155752914d81a3a3c02fcfc5d840cfdfda07216d",
        "revCount": 62,
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Grzegorz/greg-ng.git"
@@ -161,27 +139,6 @@
        "url": "https://git.pvv.ntnu.no/Grzegorz/grzegorz-clients.git"
      }
    },
-    "libdib": {
-      "inputs": {
-        "nixpkgs": [
-          "worblehat",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1780178524,
-        "narHash": "sha256-2PcNyNqbGCWBpAMdCU1HxSQmhQiG6evdjxVnPA7w5bQ=",
-        "ref": "refs/heads/main",
-        "rev": "2406de41ce9d0a1404cbf4e55537e3f720f37f23",
-        "revCount": 15,
-        "type": "git",
-        "url": "https://git.pvv.ntnu.no/Projects/libdib.git"
-      },
-      "original": {
-        "type": "git",
-        "url": "https://git.pvv.ntnu.no/Projects/libdib.git"
-      }
-    },
    "matrix-next": {
      "inputs": {
        "nixpkgs": [
@@ -189,16 +146,16 @@
        ]
      },
      "locked": {
-        "lastModified": 1782122067,
-        "narHash": "sha256-95q3DiYOTHjQGbqR0I1w4ETrH+smtddqW0bBxaB/Egg=",
+        "lastModified": 1764844095,
+        "narHash": "sha256-Drf1orxsmFDzO+UbPo85gHjXW7QzAM+6oTPvI7vOSik=",
        "owner": "dali99",
        "repo": "nixos-matrix-modules",
-        "rev": "0e0fd9f6a407b08dd5e180a2ff6c3808461e2c47",
+        "rev": "25b9f31ef1dbc3987b4c716de716239f2b283701",
        "type": "github"
      },
      "original": {
        "owner": "dali99",
-        "ref": "master",
+        "ref": "v0.8.0",
        "repo": "nixos-matrix-modules",
        "type": "github"
      }
@@ -208,14 +165,14 @@
        "nixpkgs": [
          "nixpkgs"
        ],
-        "rust-overlay": "rust-overlay_3"
+        "rust-overlay": "rust-overlay_2"
      },
      "locked": {
-        "lastModified": 1784554105,
-        "narHash": "sha256-lgtCXgYCf0ljf14H7K7ngxnUc30FwcHMJlDZx+7Nt8s=",
+        "lastModified": 1767906976,
+        "narHash": "sha256-igCg8I83eO+noF00raXVJqDxzLS2SrZN8fK5bnvO+xI=",
        "ref": "main",
-        "rev": "cbd5b7318239303e19e8a7a407699ed85cc25d94",
-        "revCount": 18,
+        "rev": "626bc9b6bae6a997b347cdbe84080240884f2955",
+        "revCount": 17,
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Projects/minecraft-heatmap.git"
      },
@@ -232,11 +189,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1784554069,
-        "narHash": "sha256-5UNUBVAAMEvLanAyOgm6yGZgKJoTAZ2gXavKbMH+6OA=",
+        "lastModified": 1769500363,
+        "narHash": "sha256-vFxmdsLBPdTy5j2bf54gbTQi1XnWbZDmeR/BBh8MFrw=",
        "ref": "main",
-        "rev": "62ffa4f7de826ced2c2a8ad787695118589450bb",
-        "revCount": 48,
+        "rev": "2618e434e40e109eaab6a0693313c7e0de7324a3",
+        "revCount": 47,
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Projects/minecraft-kartverket.git"
      },
@@ -275,11 +232,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1782153600,
-        "narHash": "sha256-Vbkgl7/x8+Gg0gMe94EStfIfNC4bHQIbaZrIAxpuQ/w=",
+        "lastModified": 1774824790,
+        "narHash": "sha256-3R2aoykbutdJ7YQaZiU7uO8w4O8b6RjztTPNo8isLTI=",
        "owner": "oddlama",
        "repo": "nix-topology",
-        "rev": "e61876f548e4f301d63640d30ecc1305c05c3986",
+        "rev": "5765ce41be8a4fb5471a57671c2b740a350c5da0",
        "type": "github"
      },
      "original": {
@@ -291,15 +248,15 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1784526640,
-        "narHash": "sha256-UDnuu3uM64qjfVvsGSislJgP1j15FiFiDiKOjbGTv9Q=",
-        "rev": "036c2421db75172aeef4bb83921988891d4773c9",
+        "lastModified": 1775064210,
+        "narHash": "sha256-bEqbUNAnoyNZzd8rrhS8QETdDWr+vYzZeaggBLmFLIA=",
+        "rev": "9d1c3efdc713c1ed9679796c08a1a8a193e4704e",
        "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/26.05-small/nixos-26.05.5692.036c2421db75/nixexprs.tar.xz"
+        "url": "https://releases.nixos.org/nixos/25.11-small/nixos-25.11.8497.9d1c3efdc713/nixexprs.tar.xz"
      },
      "original": {
        "type": "tarball",
-        "url": "https://nixos.org/channels/nixos-26.05-small/nixexprs.tar.xz"
+        "url": "https://nixos.org/channels/nixos-25.11-small/nixexprs.tar.xz"
      }
    },
    "nixpkgs-lib": {
@@ -319,38 +276,17 @@
    },
    "nixpkgs-unstable": {
      "locked": {
-        "lastModified": 1784536202,
-        "narHash": "sha256-7CmHmK10lEXBgymS0DeYj4/4STLpzRWCc/5BfoIxHQo=",
-        "rev": "94f12be79cb7f961726a0157b4168bc722befeac",
+        "lastModified": 1775064351,
+        "narHash": "sha256-KHkwW/A1+H23YBMQGDmPb8cw5LwZFnszVKg5eZ4JWhg=",
+        "rev": "1e6f1bb5bb05d14aea16063ab587c599a68241c2",
        "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/unstable-small/nixos-26.11pre1037880.94f12be79cb7/nixexprs.tar.xz"
+        "url": "https://releases.nixos.org/nixos/unstable-small/nixos-26.05pre973082.1e6f1bb5bb05/nixexprs.tar.xz"
      },
      "original": {
        "type": "tarball",
        "url": "https://nixos.org/channels/nixos-unstable-small/nixexprs.tar.xz"
      }
    },
-    "passwd2systemd-users": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1780764154,
-        "narHash": "sha256-Xvf9aBNLYDnbDKdtFjp5GEA/rZwVczHZWbJ0hac8Vv4=",
-        "ref": "main",
-        "rev": "8b4541be73ee3bd6c60525b2f42605efe89398c9",
-        "revCount": 14,
-        "type": "git",
-        "url": "https://git.pvv.ntnu.no/Projects/passwd2systemd-users.git"
-      },
-      "original": {
-        "ref": "main",
-        "type": "git",
-        "url": "https://git.pvv.ntnu.no/Projects/passwd2systemd-users.git"
-      }
-    },
    "pvv-calendar-bot": {
      "inputs": {
        "nixpkgs": [
@@ -358,11 +294,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1784554034,
-        "narHash": "sha256-NbL+1ju1j53MqsjUCAFWgpVp3IXo2lLET1OoDdxc18Q=",
+        "lastModified": 1764869785,
+        "narHash": "sha256-FGTIpC7gB4lbeL0bfYzn1Ge0PaCpd7VqWBLhJBx0i4A=",
        "ref": "main",
-        "rev": "a7cbd30941ee0430f6a626e7dc38b5358dcc8a2a",
-        "revCount": 30,
+        "rev": "8ce7fb0b1918bdb3d1489a40d73895693955e8b2",
+        "revCount": 23,
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Projects/calendar-bot.git"
      },
@@ -379,11 +315,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1784979981,
-        "narHash": "sha256-OnvjEXYU/InjJYH2+iIrvHWIjHnc5J9f84qWhrgAWlY=",
+        "lastModified": 1769009806,
+        "narHash": "sha256-52xTtAOc9B+MBRMRZ8HI6ybNsRLMlHHLh+qwAbaJjRY=",
        "ref": "main",
-        "rev": "ffb8ed0c9df2444727e49f16f7e43ea70184dc4b",
-        "revCount": 590,
+        "rev": "aa8adfc6a4d5b6222752e2d15d4a6d3b3b85252e",
+        "revCount": 575,
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Projects/nettsiden.git"
      },
@@ -416,7 +352,6 @@
    },
    "root": {
      "inputs": {
-        "bro": "bro",
        "dibbler": "dibbler",
        "disko": "disko",
        "gergle": "gergle",
@@ -429,13 +364,11 @@
        "nix-topology": "nix-topology",
        "nixpkgs": "nixpkgs",
        "nixpkgs-unstable": "nixpkgs-unstable",
-        "passwd2systemd-users": "passwd2systemd-users",
        "pvv-calendar-bot": "pvv-calendar-bot",
        "pvv-nettsiden": "pvv-nettsiden",
        "qotd": "qotd",
        "roowho2": "roowho2",
-        "sops-nix": "sops-nix",
-        "worblehat": "worblehat"
+        "sops-nix": "sops-nix"
      }
    },
    "roowho2": {
@@ -444,20 +377,19 @@
        "nixpkgs": [
          "nixpkgs"
        ],
-        "rust-overlay": "rust-overlay_4"
+        "rust-overlay": "rust-overlay_3"
      },
      "locked": {
-        "lastModified": 1784550731,
-        "narHash": "sha256-KDrBGT98fQWlnEBmTvIijPq4n4sVLcETBu8EuL486SM=",
+        "lastModified": 1770912859,
+        "narHash": "sha256-wtf7YgthGVDY7dhWe8cO42+CD7Y2Pkngvzirwjwvfzg=",
        "ref": "main",
-        "rev": "c0c0e47c8a45673c62462cadf38a489b72fd39ec",
-        "revCount": 112,
+        "rev": "9361dcf941fabb14e94f472754b0e0a26cc56e13",
+        "revCount": 59,
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Projects/roowho2.git"
      },
      "original": {
        "ref": "main",
-        "rev": "c0c0e47c8a45673c62462cadf38a489b72fd39ec",
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Projects/roowho2.git"
      }
@@ -465,16 +397,16 @@
    "rust-overlay": {
      "inputs": {
        "nixpkgs": [
-          "bro",
+          "greg-ng",
          "nixpkgs"
        ]
      },
      "locked": {
-        "lastModified": 1779419951,
-        "narHash": "sha256-dMX0PUslUHPajP6o8FEoRdFv9afq/dec4POR0vVfjK4=",
+        "lastModified": 1770606655,
+        "narHash": "sha256-rpJf+kxvLWv32ivcgu8d+JeJooog3boJCT8J3joJvvM=",
        "owner": "oxalica",
        "repo": "rust-overlay",
-        "rev": "5b5c521d6cae9ef4aa32f888eb2c0ce595c9be52",
+        "rev": "11a396520bf911e4ed01e78e11633d3fc63b350e",
        "type": "github"
      },
      "original": {
@@ -486,16 +418,16 @@
    "rust-overlay_2": {
      "inputs": {
        "nixpkgs": [
-          "greg-ng",
+          "minecraft-heatmap",
          "nixpkgs"
        ]
      },
      "locked": {
-        "lastModified": 1784526465,
-        "narHash": "sha256-L37teKC6oINWG4PGZLIqbphMWvSQ0PEz+aWxAk+rIDw=",
+        "lastModified": 1766371695,
+        "narHash": "sha256-W7CX9vy7H2Jj3E8NI4djHyF8iHSxKpb2c/7uNQ/vGFU=",
        "owner": "oxalica",
        "repo": "rust-overlay",
-        "rev": "58c6334db52d51fc5dd8877c90b01f00cf8a696b",
+        "rev": "d81285ba8199b00dc31847258cae3c655b605e8c",
        "type": "github"
      },
      "original": {
@@ -505,27 +437,6 @@
      }
    },
    "rust-overlay_3": {
-      "inputs": {
-        "nixpkgs": [
-          "minecraft-heatmap",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1784526465,
-        "narHash": "sha256-L37teKC6oINWG4PGZLIqbphMWvSQ0PEz+aWxAk+rIDw=",
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "rev": "58c6334db52d51fc5dd8877c90b01f00cf8a696b",
-        "type": "github"
-      },
-      "original": {
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "type": "github"
-      }
-    },
-    "rust-overlay_4": {
      "inputs": {
        "nixpkgs": [
          "roowho2",
@@ -533,11 +444,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1784438913,
-        "narHash": "sha256-NYF7ZM5ip0u+w1pBFDpIGEbrbgN/wpnLFAmBkWkYMXw=",
+        "lastModified": 1769309768,
+        "narHash": "sha256-AbOIlNO+JoqRJkK1VrnDXhxuX6CrdtIu2hSuy4pxi3g=",
        "owner": "oxalica",
        "repo": "rust-overlay",
-        "rev": "afacd6819d3765a05814ee8e3de74c77d42ac799",
+        "rev": "140c9dc582cb73ada2d63a2180524fcaa744fad5",
        "type": "github"
      },
      "original": {
@@ -553,11 +464,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1783174389,
-        "narHash": "sha256-aCWC8ngycU7OdJrU2+Je3qf+1a2ykuBvpPhZT/9tXMc=",
+        "lastModified": 1774910634,
+        "narHash": "sha256-B+rZDPyktGEjOMt8PcHKYmgmKoF+GaNAFJhguktXAo0=",
        "owner": "Mic92",
        "repo": "sops-nix",
-        "rev": "f1406619a3884cd5c47992a70b8b35c9c0fcb4c9",
+        "rev": "19bf3d8678fbbfbc173beaa0b5b37d37938db301",
        "type": "github"
      },
      "original": {
@@ -566,28 +477,6 @@
        "repo": "sops-nix",
        "type": "github"
      }
-    },
-    "worblehat": {
-      "inputs": {
-        "libdib": "libdib",
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1780762731,
-        "narHash": "sha256-EuDaLnasWN0mpi995n+fAQQfPGBhqNW4fNjlQRpHt58=",
-        "ref": "main",
-        "rev": "931bd2d63e285e767c8c81c103dda3c0a63f2965",
-        "revCount": 108,
-        "type": "git",
-        "url": "https://git.pvv.ntnu.no/Projects/worblehat.git"
-      },
-      "original": {
-        "ref": "main",
-        "type": "git",
-        "url": "https://git.pvv.ntnu.no/Projects/worblehat.git"
-      }
    }
  },
  "root": "root",
@@ -2,13 +2,13 @@
  description = "PVV System flake";

  inputs = {
-    nixpkgs.url = "https://nixos.org/channels/nixos-26.05-small/nixexprs.tar.xz";
+    nixpkgs.url = "https://nixos.org/channels/nixos-25.11-small/nixexprs.tar.xz";
    nixpkgs-unstable.url = "https://nixos.org/channels/nixos-unstable-small/nixexprs.tar.xz";

    sops-nix.url = "github:Mic92/sops-nix/master";
    sops-nix.inputs.nixpkgs.follows = "nixpkgs";

-    disko.url = "github:nix-community/disko/v1.13.0";
+    disko.url = "github:nix-community/disko/v1.11.0";
    disko.inputs.nixpkgs.follows = "nixpkgs";

    nix-topology.url = "github:oddlama/nix-topology/main";
@@ -23,10 +23,7 @@
    dibbler.url = "git+https://git.pvv.ntnu.no/Projects/dibbler.git?ref=main";
    dibbler.inputs.nixpkgs.follows = "nixpkgs";

-    worblehat.url = "git+https://git.pvv.ntnu.no/Projects/worblehat.git?ref=main";
-    worblehat.inputs.nixpkgs.follows = "nixpkgs";
-
-    matrix-next.url = "github:dali99/nixos-matrix-modules/master";
+    matrix-next.url = "github:dali99/nixos-matrix-modules/v0.8.0";
    matrix-next.inputs.nixpkgs.follows = "nixpkgs";

    nix-gitea-themes.url = "git+https://git.pvv.ntnu.no/Drift/nix-gitea-themes.git?ref=main";
@@ -35,13 +32,13 @@
    minecraft-heatmap.url = "git+https://git.pvv.ntnu.no/Projects/minecraft-heatmap.git?ref=main";
    minecraft-heatmap.inputs.nixpkgs.follows = "nixpkgs";

-    roowho2.url = "git+https://git.pvv.ntnu.no/Projects/roowho2.git?ref=main&rev=c0c0e47c8a45673c62462cadf38a489b72fd39ec";
+    roowho2.url = "git+https://git.pvv.ntnu.no/Projects/roowho2.git?ref=main";
    roowho2.inputs.nixpkgs.follows = "nixpkgs";

    greg-ng.url = "git+https://git.pvv.ntnu.no/Grzegorz/greg-ng.git?ref=main";
-    greg-ng.inputs.nixpkgs.follows = "nixpkgs-unstable";
+    greg-ng.inputs.nixpkgs.follows = "nixpkgs";
    gergle.url = "git+https://git.pvv.ntnu.no/Grzegorz/gergle.git?ref=main";
-    gergle.inputs.nixpkgs.follows = "nixpkgs-unstable";
+    gergle.inputs.nixpkgs.follows = "nixpkgs";
    grzegorz-clients.url = "git+https://git.pvv.ntnu.no/Grzegorz/grzegorz-clients.git?ref=master";
    grzegorz-clients.inputs.nixpkgs.follows = "nixpkgs";

@@ -50,21 +47,10 @@

    qotd.url = "git+https://git.pvv.ntnu.no/Projects/qotd.git?ref=main";
    qotd.inputs.nixpkgs.follows = "nixpkgs";
-
-    bro.url = "git+https://git.pvv.ntnu.no/Projects/bro.git?ref=main";
-    bro.inputs.nixpkgs.follows = "nixpkgs";
-    passwd2systemd-users.url = "git+https://git.pvv.ntnu.no/Projects/passwd2systemd-users.git?ref=main";
-    passwd2systemd-users.inputs.nixpkgs.follows = "nixpkgs";
  };

-  outputs = {
-    self,
-    nixpkgs,
-    nixpkgs-unstable,
-    sops-nix,
-    disko,
-    ...
-  } @ inputs: let
+  outputs = { self, nixpkgs, nixpkgs-unstable, sops-nix, disko, ... }@inputs:
+  let
    inherit (nixpkgs) lib;
    systems = [
      "x86_64-linux"
@@ -76,242 +62,227 @@
    importantMachines = [
      "bekkalokk"
      "bicep"
+      "brzeczyszczykiewicz"
      "georg"
      "ildkule"
-      "kommode"
-      "lupine-1"
-      "skrot"
    ];
  in {
    inputs = lib.mapAttrs (_: src: src.outPath) inputs;

-    pkgs = forAllSystems (system:
-      import nixpkgs {
-        inherit system;
-        config.allowUnfreePredicate = pkg:
-          builtins.elem (lib.getName pkg)
-          [
-            "nvidia-x11"
-            "nvidia-settings"
-            "nvidia-kernel-modules"
-          ];
-      });
-
-    apps = forAllSystems (system: let
-      pkgs = nixpkgs.legacyPackages.${system};
-    in {
-      gitea-workflows = {
-        type = "app";
-        meta.description = "Run all gitea workflows locally";
-        program = toString (pkgs.writeShellScript "pvv-nixos-config-run-gitea-worflows" ''
-          ${lib.getExe pkgs.gitea-actions-runner} exec -i node:current-trixie
-        '');
-      };
+    pkgs = forAllSystems (system: import nixpkgs {
+      inherit system;
+      config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg)
+        [
+          "nvidia-x11"
+          "nvidia-settings"
+        ];
    });

    nixosConfigurations = let
-      nixosConfig = nixpkgs: name: configurationPath: extraArgs @ {
-        localSystem ? "x86_64-linux", # buildPlatform
-        crossSystem ? "x86_64-linux", # hostPlatform
-        specialArgs ? {},
-        modules ? [],
-        overlays ? [],
-        enableDefaults ? true,
-        ...
-      }: let
-        commonPkgsConfig =
-          {
-            config.allowUnfreePredicate = pkg:
-              builtins.elem (lib.getName pkg)
+      nixosConfig =
+        nixpkgs:
+        name:
+        configurationPath:
+        extraArgs@{
+          localSystem ? "x86_64-linux", # buildPlatform
+          crossSystem ? "x86_64-linux", # hostPlatform
+          specialArgs ? { },
+          modules ? [ ],
+          overlays ? [ ],
+          enableDefaults ? true,
+          ...
+        }:
+        let
+          commonPkgsConfig = {
+            config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg)
              [
                "nvidia-x11"
                "nvidia-settings"
-                "nvidia-kernel-modules"
              ];
-            overlays =
-              (lib.optionals enableDefaults [
-                # Global overlays go here
-                inputs.roowho2.overlays.default
-              ])
-              ++ overlays;
-          }
-          // (
-            if localSystem != crossSystem
-            then {
-              inherit localSystem crossSystem;
-            }
-            else {
-              system = crossSystem;
-            }
-          );
-        pkgs = import nixpkgs commonPkgsConfig;
-        unstablePkgs = import nixpkgs-unstable commonPkgsConfig;
-      in
-        lib.nixosSystem (
-          lib.recursiveUpdate
-          {
+            overlays = (lib.optionals enableDefaults [
+              # Global overlays go here
+              inputs.roowho2.overlays.default
+            ]) ++ overlays;
+          } // (if localSystem != crossSystem then {
+            inherit localSystem crossSystem;
+          } else {
            system = crossSystem;
+          });
+          pkgs = import nixpkgs commonPkgsConfig;
+          unstablePkgs = import nixpkgs-unstable commonPkgsConfig;
+        in
+        lib.nixosSystem (lib.recursiveUpdate
+        {
+          system = crossSystem;

-            inherit pkgs;
+          inherit pkgs;

-            specialArgs =
-              {
-                inherit inputs unstablePkgs;
-                values = import ./values.nix;
-                fp = path: ./${path};
-              }
-              // specialArgs;
+          specialArgs = {
+            inherit inputs unstablePkgs;
+            values = import ./values.nix;
+            fp = path: ./${path};
+          } // specialArgs;

-            modules =
-              [
-                {
-                  networking.hostName = lib.mkDefault name;
-                }
-                configurationPath
-              ]
-              ++ (lib.optionals enableDefaults [
-                sops-nix.nixosModules.sops
-                inputs.roowho2.nixosModules.default
-                self.nixosModules.rsync-pull-targets
-                self.nixosModules.python-http-handlers
-              ])
-              ++ modules;
-          }
-          (builtins.removeAttrs extraArgs [
-            "localSystem"
-            "crossSystem"
-            "modules"
-            "overlays"
-            "specialArgs"
-            "enableDefaults"
-          ])
-        );
+          modules = [
+            {
+              networking.hostName = lib.mkDefault name;
+            }
+            configurationPath
+          ] ++ (lib.optionals enableDefaults [
+            sops-nix.nixosModules.sops
+            inputs.roowho2.nixosModules.default
+            self.nixosModules.rsync-pull-targets
+          ]) ++ modules;
+        }
+        (builtins.removeAttrs extraArgs [
+          "localSystem"
+          "crossSystem"
+          "modules"
+          "overlays"
+          "specialArgs"
+          "enableDefaults"
+        ])
+      );

      stableNixosConfig = name: extraArgs:
-        nixosConfig nixpkgs name ./hosts/${name}/configuration.nix extraArgs;
-    in
-      {
-        bicep = stableNixosConfig "bicep" {
-          modules = [
-            inputs.matrix-next.nixosModules.default
-            inputs.pvv-calendar-bot.nixosModules.default
-            inputs.minecraft-heatmap.nixosModules.default
-            self.nixosModules.gickup
-            self.nixosModules.matrix-ooye
-          ];
-          overlays = [
-            inputs.pvv-calendar-bot.overlays.default
-            inputs.minecraft-heatmap.overlays.default
-            (final: prev: {
-              inherit (self.packages.${prev.stdenv.hostPlatform.system}) out-of-your-element;
-            })
-            (final: prev: {
-              # See https://git.pvv.ntnu.no/Drift/issues/issues/369
-              mjolnir = prev.mjolnir.override {
-                nodejs = prev.nodejs_22;
-              };
-            })
-          ];
-        };
-        bekkalokk = stableNixosConfig "bekkalokk" {
-          overlays = [
-            (final: prev: {
-              mediawiki-extensions = final.callPackage ./packages/mediawiki-extensions {};
-              simplesamlphp = final.callPackage ./packages/simplesamlphp {};
-            })
-            inputs.pvv-nettsiden.overlays.default
-            inputs.qotd.overlays.default
-          ];
-          modules = [
-            inputs.pvv-nettsiden.nixosModules.default
-            inputs.qotd.nixosModules.default
-          ];
-        };
-        ildkule = stableNixosConfig "ildkule" {
-          modules = [
-            inputs.disko.nixosModules.disko
-          ];
-        };
-        skrot = stableNixosConfig "skrot" {
-          modules = [
-            self.nixosModules.drumknotty
-            inputs.disko.nixosModules.disko
-          ];
-          overlays =
-          [
-            inputs.dibbler.overlays.default
-            inputs.worblehat.overlays.default
-          ];
-        };
-        shark = stableNixosConfig "shark" {};
-        wenche = stableNixosConfig "wenche" {};
-        temmie = stableNixosConfig "temmie" {
-          overlays = [
-            inputs.bro.overlays.default
-            inputs.passwd2systemd-users.overlays.default
-          ];
-          modules = [
-            inputs.bro.nixosModules.default
-          ];
-        };
-        gluttony = stableNixosConfig "gluttony" {
-          overlays = [
-            (final: prev: { bluemap = final.callPackage ./packages/bluemap.nix {}; })
-          ];
-          modules = [ self.nixosModules.bluemap ];
-        };
+          nixosConfig nixpkgs name ./hosts/${name}/configuration.nix extraArgs;
+    in {
+      bakke = stableNixosConfig "bakke" {
+        modules = [
+          inputs.disko.nixosModules.disko
+        ];
+      };
+      bicep = stableNixosConfig "bicep" {
+        modules = [
+          inputs.matrix-next.nixosModules.default
+          inputs.pvv-calendar-bot.nixosModules.default
+          inputs.minecraft-heatmap.nixosModules.default
+          self.nixosModules.gickup
+          self.nixosModules.matrix-ooye
+        ];
+        overlays = [
+          inputs.pvv-calendar-bot.overlays.default
+          inputs.minecraft-heatmap.overlays.default
+          (final: prev: {
+            inherit (self.packages.${prev.stdenv.hostPlatform.system}) out-of-your-element;
+          })
+        ];
+      };
+      bekkalokk = stableNixosConfig "bekkalokk" {
+        overlays = [
+          (final: prev: {
+            mediawiki-extensions = final.callPackage ./packages/mediawiki-extensions { };
+            simplesamlphp = final.callPackage ./packages/simplesamlphp { };
+            bluemap = final.callPackage ./packages/bluemap.nix { };
+          })
+          inputs.pvv-nettsiden.overlays.default
+          inputs.qotd.overlays.default
+        ];
+        modules = [
+          inputs.pvv-nettsiden.nixosModules.default
+          self.nixosModules.bluemap
+          inputs.qotd.nixosModules.default
+        ];
+      };
+      ildkule = stableNixosConfig "ildkule" { };
+      #ildkule-unstable = unstableNixosConfig "ildkule" { };
+      skrot = stableNixosConfig "skrot" {
+        modules = [
+          inputs.disko.nixosModules.disko
+          inputs.dibbler.nixosModules.default
+        ];
+        overlays = [inputs.dibbler.overlays.default];
+      };
+      shark = stableNixosConfig "shark" { };
+      wenche = stableNixosConfig "wenche" { };
+      temmie = stableNixosConfig "temmie" { };
+      gluttony = stableNixosConfig "gluttony" { };

-        kommode = stableNixosConfig "kommode" {
-          overlays = [
-            inputs.nix-gitea-themes.overlays.default
-          ];
-          modules = [
-            inputs.nix-gitea-themes.nixosModules.default
-            inputs.disko.nixosModules.disko
-            self.nixosModules.robots-txt
-          ];
-        };
+      kommode = stableNixosConfig "kommode" {
+        overlays = [
+          inputs.nix-gitea-themes.overlays.default
+        ];
+        modules = [
+          inputs.nix-gitea-themes.nixosModules.default
+          inputs.disko.nixosModules.disko
+        ];
+      };

-        brzeczyszczykiewicz = stableNixosConfig "brzeczyszczykiewicz" {
-          modules = [
-            inputs.grzegorz-clients.nixosModules.grzegorz-webui
-            inputs.gergle.nixosModules.default
-            inputs.greg-ng.nixosModules.default
-          ];
-          overlays = [
-            inputs.greg-ng.overlays.default
-            inputs.gergle.overlays.default
-          ];
-        };
-        georg = stableNixosConfig "georg" {
-          modules = [
-            inputs.grzegorz-clients.nixosModules.grzegorz-webui
-            inputs.gergle.nixosModules.default
-            inputs.greg-ng.nixosModules.default
-          ];
-          overlays = [
-            inputs.greg-ng.overlays.default
-            inputs.gergle.overlays.default
-          ];
-        };
-      }
-      // (let
-        machineNames = map (i: "lupine-${toString i}") (lib.range 1 5);
-        stableLupineNixosConfig = name: extraArgs:
+      ustetind = stableNixosConfig "ustetind" {
+        modules = [
+         "${nixpkgs}/nixos/modules/virtualisation/lxc-container.nix"
+        ];
+      };
+
+      brzeczyszczykiewicz = stableNixosConfig "brzeczyszczykiewicz" {
+        modules = [
+          inputs.grzegorz-clients.nixosModules.grzegorz-webui
+          inputs.gergle.nixosModules.default
+          inputs.greg-ng.nixosModules.default
+        ];
+        overlays = [
+          inputs.greg-ng.overlays.default
+          inputs.gergle.overlays.default
+        ];
+      };
+      georg = stableNixosConfig "georg" {
+        modules = [
+          inputs.grzegorz-clients.nixosModules.grzegorz-webui
+          inputs.gergle.nixosModules.default
+          inputs.greg-ng.nixosModules.default
+        ];
+        overlays = [
+          inputs.greg-ng.overlays.default
+          inputs.gergle.overlays.default
+        ];
+      };
+    }
+    //
+    (let
+      skrottConfig = {
+        modules = [
+          (nixpkgs + "/nixos/modules/installer/sd-card/sd-image-aarch64.nix")
+          inputs.dibbler.nixosModules.default
+        ];
+        overlays = [
+          inputs.dibbler.overlays.default
+          (final: prev: {
+            # NOTE: Yeetus (these break crosscompile ¯\_(ツ)_/¯)
+            atool = prev.emptyDirectory;
+            micro = prev.emptyDirectory;
+            ncdu = prev.emptyDirectory;
+          })
+        ];
+      };
+    in {
+      skrott = self.nixosConfigurations.skrott-native;
+      skrott-native = stableNixosConfig "skrott" (skrottConfig // {
+        localSystem = "aarch64-linux";
+        crossSystem = "aarch64-linux";
+      });
+      skrott-cross = stableNixosConfig "skrott" (skrottConfig // {
+        localSystem = "x86_64-linux";
+        crossSystem = "aarch64-linux";
+      });
+      skrott-x86_64 = stableNixosConfig "skrott" (skrottConfig // {
+        localSystem = "x86_64-linux";
+        crossSystem = "x86_64-linux";
+      });
+    })
+    //
+    (let
+      machineNames = map (i: "lupine-${toString i}") (lib.range 1 5);
+      stableLupineNixosConfig = name: extraArgs:
          nixosConfig nixpkgs name ./hosts/lupine/configuration.nix extraArgs;
-      in
-        lib.genAttrs machineNames (name:
-          stableLupineNixosConfig name {
-            modules = [{networking.hostName = name;}];
-            specialArgs.lupineName = name;
-          }));
+    in lib.genAttrs machineNames (name: stableLupineNixosConfig name {
+      modules = [{ networking.hostName = name; }];
+      specialArgs.lupineName = name;
+    }));

    nixosModules = {
      bluemap = ./modules/bluemap.nix;
-      drumknotty = ./modules/drumknotty;
      gickup = ./modules/gickup;
      matrix-ooye = ./modules/matrix-ooye.nix;
-      python-http-handlers = ./modules/python-http-handlers.nix;
      robots-txt = ./modules/robots-txt.nix;
      rsync-pull-targets = ./modules/rsync-pull-targets.nix;
      snakeoil-certs = ./modules/snakeoil-certs.nix;
@@ -328,8 +299,7 @@
            })
          ];
        };
-      in
-        pkgs.callPackage ./shell.nix {};
+      in pkgs.callPackage ./shell.nix { };
      cuda = let
        cuda-pkgs = import nixpkgs-unstable {
          inherit system;
@@ -338,92 +308,91 @@
            cudaSupport = true;
          };
        };
-      in
-        cuda-pkgs.callPackage ./shells/cuda.nix {};
+      in cuda-pkgs.callPackage ./shells/cuda.nix { };
    });

    packages = {
      "x86_64-linux" = let
        system = "x86_64-linux";
        pkgs = nixpkgs.legacyPackages.${system};
-      in
-        rec {
-          default = important-machines;
-          important-machines =
-            pkgs.linkFarm "important-machines"
-            (lib.getAttrs importantMachines self.packages.${system});
-          all-machines =
-            pkgs.linkFarm "all-machines"
-            (lib.getAttrs allMachines self.packages.${system});
+      in rec {
+        default = important-machines;
+        important-machines = pkgs.linkFarm "important-machines"
+          (lib.getAttrs importantMachines self.packages.${system});
+        all-machines = pkgs.linkFarm "all-machines"
+          (lib.getAttrs allMachines self.packages.${system});

-          simplesamlphp = pkgs.callPackage ./packages/simplesamlphp {};
+        simplesamlphp = pkgs.callPackage ./packages/simplesamlphp { };

-          bluemap = pkgs.callPackage ./packages/bluemap.nix {};
+        bluemap = pkgs.callPackage ./packages/bluemap.nix { };

-          out-of-your-element = pkgs.callPackage ./packages/ooye/package.nix {};
-        }
-        //
-        # Mediawiki extensions
-        (lib.pipe null [
-          (_: pkgs.callPackage ./packages/mediawiki-extensions {})
-          (lib.flip builtins.removeAttrs ["override" "overrideDerivation"])
-          (lib.mapAttrs' (name: lib.nameValuePair "mediawiki-${name}"))
-        ])
-        //
-        # Machines
-        lib.genAttrs allMachines
-        (machine: self.nixosConfigurations.${machine}.config.system.build.toplevel.overrideAttrs (prev: {
-          passthru =
-            (prev.passthru or { })
-            // self.nixosConfigurations.${machine}.config.system.build
-            // { inherit (self.nixosConfigurations.${machine}) pkgs config; };
-        }))
-        //
-        # Nix-topology
-        (let
-          topology' = import inputs.nix-topology {
-            pkgs = import nixpkgs {
-              inherit system;
-              overlays = [
-                inputs.nix-topology.overlays.default
-                (final: prev: {
-                  inherit (nixpkgs-unstable.legacyPackages.${system}) super-tiny-icons;
-                })
-              ];
-            };
-
-            specialArgs = {
-              values = import ./values.nix;
-            };
-
-            modules = [
-              ./topology
-              {
-                nixosConfigurations = lib.mapAttrs (_name: nixosCfg:
-                  nixosCfg.extendModules {
-                    modules = [
-                      inputs.nix-topology.nixosModules.default
-                      ./topology/service-extractors/greg-ng.nix
-                      ./topology/service-extractors/postgresql.nix
-                      ./topology/service-extractors/gitea-runners.nix
-                    ];
-                  })
-                self.nixosConfigurations;
-              }
+        out-of-your-element = pkgs.callPackage ./packages/ooye/package.nix { };
+      }
+      //
+      # Mediawiki extensions
+      (lib.pipe null [
+        (_: pkgs.callPackage ./packages/mediawiki-extensions { })
+        (lib.flip builtins.removeAttrs ["override" "overrideDerivation"])
+        (lib.mapAttrs' (name: lib.nameValuePair "mediawiki-${name}"))
+      ])
+      //
+      # Machines
+      lib.genAttrs allMachines
+        (machine: self.nixosConfigurations.${machine}.config.system.build.toplevel)
+      //
+      # Skrott is exception
+      {
+        skrott = self.packages.${system}.skrott-native-sd;
+        skrott-native = self.nixosConfigurations.skrott-native.config.system.build.toplevel;
+        skrott-native-sd = self.nixosConfigurations.skrott-native.config.system.build.sdImage;
+        skrott-cross = self.nixosConfigurations.skrott-cross.config.system.build.toplevel;
+        skrott-cross-sd = self.nixosConfigurations.skrott-cross.config.system.build.sdImage;
+        skrott-x86_64 = self.nixosConfigurations.skrott-x86_64.config.system.build.toplevel;
+      }
+      //
+      # Nix-topology
+      (let
+        topology' = import inputs.nix-topology {
+          pkgs = import nixpkgs {
+            inherit system;
+            overlays = [
+              inputs.nix-topology.overlays.default
+              (final: prev: {
+                inherit (nixpkgs-unstable.legacyPackages.${system}) super-tiny-icons;
+              })
            ];
          };
-        in {
-          topology = topology'.config.output;
-          topology-png =
-            pkgs.runCommand "pvv-config-topology-png" {
-              nativeBuildInputs = [pkgs.writableTmpDirAsHomeHook];
-            } ''
-              mkdir -p "$out"
-              for file in '${topology'.config.output}'/*.svg; do
-                ${lib.getExe pkgs.imagemagick} -density 300 -background none "$file" "$out"/"$(basename "''${file%.svg}.png")"
-              done
-            '';
-        });
+
+          specialArgs = {
+            values = import ./values.nix;
+          };
+
+          modules = [
+            ./topology
+            {
+              nixosConfigurations = lib.mapAttrs (_name: nixosCfg: nixosCfg.extendModules {
+                modules = [
+                  inputs.nix-topology.nixosModules.default
+                  ./topology/service-extractors/greg-ng.nix
+                  ./topology/service-extractors/postgresql.nix
+                  ./topology/service-extractors/mysql.nix
+                  ./topology/service-extractors/gitea-runners.nix
+                ];
+              }) self.nixosConfigurations;
+            }
+          ];
+        };
+      in {
+        topology = topology'.config.output;
+        topology-png = pkgs.runCommand "pvv-config-topology-png" {
+          nativeBuildInputs = [ pkgs.writableTmpDirAsHomeHook ];
+        } ''
+          mkdir -p "$out"
+          for file in '${topology'.config.output}'/*.svg; do
+            ${lib.getExe pkgs.imagemagick} -density 300 -background none "$file" "$out"/"$(basename "''${file%.svg}.png")"
+          done
+        '';
+      });
    };
  };
 }
@@ -0,0 +1,18 @@
+{ config, pkgs, values, ... }:
+{
+  imports = [
+      ./hardware-configuration.nix
+      ../../base
+      ./filesystems.nix
+    ];
+
+  networking.hostId = "99609ffc";
+  systemd.network.networks."30-enp2s0" = values.defaultNetworkConfig // {
+    matchConfig.Name = "enp2s0";
+    address = with values.hosts.bakke; [ (ipv4 + "/25") (ipv6 + "/64") ];
+  };
+
+  # Don't change (even during upgrades) unless you know what you are doing.
+  # See https://search.nixos.org/options?show=system.stateVersion
+  system.stateVersion = "24.05";
+}
@@ -0,0 +1,83 @@
+{
+  # https://github.com/nix-community/disko/blob/master/example/boot-raid1.nix
+  # Note: Disko was used to create the initial md raid, but is no longer in active use on this host.
+  disko.devices = {
+    disk = {
+      one = {
+        type = "disk";
+        device = "/dev/disk/by-id/ata-WDC_WD40EFRX-68WT0N0_WD-WCC4E2EER6N6";
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              size = "500M";
+              type = "EF00";
+              content = {
+                type = "mdraid";
+                name = "boot";
+              };
+            };
+            mdadm = {
+              size = "100%";
+              content = {
+                type = "mdraid";
+                name = "raid1";
+              };
+            };
+          };
+        };
+      };
+      two = {
+        type = "disk";
+        device = "/dev/disk/by-id/ata-WDC_WD40EFRX-68WT0N0_WD-WCC4E7LPLU71";
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              size = "500M";
+              type = "EF00";
+              content = {
+                type = "mdraid";
+                name = "boot";
+              };
+            };
+            mdadm = {
+              size = "100%";
+              content = {
+                type = "mdraid";
+                name = "raid1";
+              };
+            };
+          };
+        };
+      };
+    };
+    mdadm = {
+      boot = {
+        type = "mdadm";
+        level = 1;
+        metadata = "1.0";
+        content = {
+          type = "filesystem";
+          format = "vfat";
+          mountpoint = "/boot";
+        };
+      };
+      raid1 = {
+        type = "mdadm";
+        level = 1;
+        content = {
+          type = "gpt";
+          partitions.primary = {
+            size = "100%";
+            content = {
+              type = "filesystem";
+              format = "ext4";
+              mountpoint = "/";
+            };
+          };
+        };
+      };
+    };
+  };
+}
@@ -0,0 +1,26 @@
+{ pkgs,... }:
+{
+  # Boot drives:
+  boot.swraid.enable = true;
+
+  # ZFS Data pool:
+  boot = {
+    zfs = {
+      extraPools = [ "tank" ];
+      requestEncryptionCredentials = false;
+    };
+    supportedFilesystems.zfs = true;
+    # Use stable linux packages, these work with zfs
+    kernelPackages = pkgs.linuxPackages;
+  };
+  services.zfs.autoScrub = {
+    enable = true;
+    interval = "Wed *-*-8..14 00:00:00";
+  };
+
+  # NFS Exports:
+  #TODO
+
+  # NFS Import mounts:
+  #TODO
+}
@@ -0,0 +1,52 @@
+# Do not modify this file!  It was generated by 'nixos-generate-config'
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "ehci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/0f63c3d2-fc12-4ed5-a5a5-141bfd67a571";
+      fsType = "btrfs";
+      options = [ "subvol=root" ];
+    };
+
+  fileSystems."/home" =
+    { device = "/dev/disk/by-uuid/0f63c3d2-fc12-4ed5-a5a5-141bfd67a571";
+      fsType = "btrfs";
+      options = [ "subvol=home" ];
+    };
+
+  fileSystems."/nix" =
+    { device = "/dev/disk/by-uuid/0f63c3d2-fc12-4ed5-a5a5-141bfd67a571";
+      fsType = "btrfs";
+      options = [ "subvol=nix" "noatime" ];
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/sdc2";
+      fsType = "vfat";
+      options = [ "fmask=0022" "dmask=0022" ];
+    };
+
+  swapDevices = [ ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault false;
+  # networking.interfaces.eno1.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp2s0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}
@@ -7,13 +7,11 @@

    ./services/alps.nix
    ./services/bluemap.nix
-    ./services/radicale.nix
    ./services/idp-simplesamlphp
    ./services/kerberos.nix
    ./services/mediawiki
    ./services/nginx.nix
    ./services/phpfpm.nix
-    ./services/prometheus-phpfpm-exporter.nix
    ./services/vaultwarden.nix
    ./services/webmail
    ./services/website
@@ -26,6 +24,8 @@
    address = with values.hosts.bekkalokk; [ (ipv4 + "/25") (ipv6 + "/64") ];
  };

+  services.btrfs.autoScrub.enable = true;
+
  # Don't change (even during upgrades) unless you know what you are doing.
  # See https://search.nixos.org/options?show=system.stateVersion
  system.stateVersion = "25.11";
@@ -16,7 +16,6 @@
  fileSystems."/" =
    { device = "/dev/sda1";
      fsType = "btrfs";
-      options = [ "relatime" ];
    };

  fileSystems."/boot" =
@@ -1,10 +1,105 @@
-{ values, ... }:
+{ config, lib, pkgs, inputs, ... }:
 let
-  webExport = "/var/lib/bluemap/web";
+  vanillaSurvival = "/var/lib/bluemap/vanilla_survival_world";
+  format = pkgs.formats.hocon { };
 in {
-  # NOTE: our version of the module gets added in flake.nix
+  # NOTE: our versino of the module gets added in flake.nix
  disabledModules = [ "services/web-apps/bluemap.nix" ];

+  sops.secrets."bluemap/ssh-key" = { };
+  sops.secrets."bluemap/ssh-known-hosts" = { };
+
+  services.bluemap = {
+    enable = true;
+
+    eula = true;
+    onCalendar = "*-*-* 05:45:00"; # a little over an hour after auto-upgrade
+
+    host = "minecraft.pvv.ntnu.no";
+
+    maps = let
+      inherit (inputs.minecraft-kartverket.packages.${pkgs.stdenv.hostPlatform.system}) bluemap-export;
+    in {
+      "verden" = {
+        extraHoconMarkersFile = "${bluemap-export}/overworld.hocon";
+        settings = {
+          world = vanillaSurvival;
+          dimension = "minecraft:overworld";
+          name = "Verden";
+          sorting = 0;
+          start-pos = {
+            x = 0;
+            z = 0;
+          };
+          ambient-light = 0.1;
+          cave-detection-ocean-floor = -5;
+        };
+      };
+      "underverden" = {
+        extraHoconMarkersFile = "${bluemap-export}/nether.hocon";
+        settings = {
+          world = vanillaSurvival;
+          dimension = "minecraft:the_nether";
+          name = "Underverden";
+          sorting = 100;
+          start-pos = {
+            x = 0;
+            z = 0;
+          };
+          sky-color = "#290000";
+          void-color = "#150000";
+          sky-light = 1;
+          ambient-light = 0.6;
+          remove-caves-below-y = -10000;
+          cave-detection-ocean-floor = -5;
+          cave-detection-uses-block-light = true;
+          render-mask = [{
+            max-y = 90;
+          }];
+        };
+      };
+      "enden" = {
+        extraHoconMarkersFile = "${bluemap-export}/the-end.hocon";
+        settings = {
+          world = vanillaSurvival;
+          dimension = "minecraft:the_end";
+          name = "Enden";
+          sorting = 200;
+          start-pos = {
+            x = 0;
+            z = 0;
+          };
+          sky-color = "#080010";
+          void-color = "#080010";
+          sky-light = 1;
+          ambient-light = 0.6;
+          remove-caves-below-y = -10000;
+          cave-detection-ocean-floor = -5;
+        };
+      };
+    };
+  };
+
+  systemd.services."render-bluemap-maps" = {
+    serviceConfig = {
+      StateDirectory = [ "bluemap/world" ];
+      ExecStartPre = let
+        rsyncArgs = lib.cli.toCommandLineShellGNU { } {
+          archive = true;
+          compress = true;
+          verbose = true;
+          no-owner = true;
+          no-group = true;
+          rsh = "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=%d/ssh-known-hosts -i %d/sshkey";
+        };
+      in "${lib.getExe pkgs.rsync} ${rsyncArgs} root@innovation.pvv.ntnu.no:/ ${vanillaSurvival}";
+      LoadCredential = [
+        "sshkey:${config.sops.secrets."bluemap/ssh-key".path}"
+        "ssh-known-hosts:${config.sops.secrets."bluemap/ssh-known-hosts".path}"
+      ];
+    };
+  };
+
  services.nginx.virtualHosts."minecraft.pvv.ntnu.no" = {
    enableACME = true;
    forceSSL = true;
@@ -20,30 +115,6 @@ in {
      quic_retry on;
      add_header Alt-Svc 'h3=":$server_port"; ma=86400';
    '';
-    root = webExport;
-    locations = {
-      "~* ^/maps/[^/]*/tiles/".extraConfig = ''
-        error_page 404 = @empty;
-      '';
-      "@empty".return = "204";
-    };
-  };
-
-  services.rsync-pull-targets = {
-    enable = true;
-    locations.${webExport} = {
-      user = "root";
-      rrsyncArgs.wo = true;
-      authorizedKeysAttrs = [
-        "restrict"
-        "from=\"gluttony.pvv.ntnu.no,${values.hosts.gluttony.ipv6},${values.hosts.gluttony.ipv4}\""
-        "no-agent-forwarding"
-        "no-port-forwarding"
-        "no-pty"
-        "no-X11-forwarding"
-      ];
-      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH5jrqMovXlWaFWZAV/aKyQReHvUQp5kb+7Ja4gnevSr root@gluttony bluemap";
-    };
  };

  networking.firewall.allowedUDPPorts = [ 443 ];
@@ -107,7 +107,6 @@ in {
        CodeEditor
        CodeMirror
        DeleteBatch
-        PdfHandler
        PluggableAuth
        Popups
        Scribunto
@@ -182,17 +181,12 @@ in {
      ];

      # Misc program paths
-      $wgFFmpegLocation = '${lib.getExe pkgs.ffmpeg}';
-      $wgExiftool = '${lib.getExe pkgs.exiftool}';
-      $wgExiv2Command = '${lib.getExe pkgs.exiv2}';
+      $wgFFmpegLocation = '${pkgs.ffmpeg}/bin/ffmpeg';
+      $wgExiftool = '${pkgs.exiftool}/bin/exiftool';
+      $wgExiv2Command = '${pkgs.exiv2}/bin/exiv2';
      # See https://gist.github.com/sergejmueller/088dce028b6dd120a16e
-      $wgJpegTran = '${lib.getExe' pkgs.mozjpeg "jpegtran"}';
-      $wgGitBin = '${lib.getExe pkgs.git}';
-      $wgDiff3 = '${lib.getExe' pkgs.diffutils "diff3"}';
-      $wgDiff = '${lib.getExe' pkgs.diffutils "diff"}';
-
-      $wgUseImageMagick = true;
-      $wgImageMagickConvertCommand = '${lib.getExe pkgs.imagemagick}';
+      $wgJpegTran = '${pkgs.mozjpeg}/bin/jpegtran';
+      $wgGitBin = '${pkgs.git}/bin/git';

      # Debugging
      $wgShowExceptionDetails = false;
@@ -216,15 +210,6 @@ in {

      # EXT:WikiEditor
      $wgWikiEditorRealtimePreview = true;
-
-      # EXT:PdfHandler
-      $wgPdfProcessor = '${lib.getExe pkgs.ghostscript_headless}';
-      $wgPdfPostProcessor = $wgImageMagickConvertCommand;
-      $wgPdfInfo = '${lib.getExe' pkgs.poppler-utils "pdfinfo"}';
-      $wgPdftoText = '${lib.getExe' pkgs.poppler-utils "pdftotext"}';
-
-      # Override key from hardcoded config in nixpkgs
-      $wgSecretKey = file_get_contents("${config.sops.secrets."mediawiki/secret-key".path}");
    '';
  };

@@ -288,6 +273,8 @@ in {
  systemd.services.mediawiki-init = lib.mkIf cfg.enable {
    after = [ "sops-install-secrets.service" ];
    serviceConfig = {
+      BindReadOnlyPaths = [ "/run/credentials/mediawiki-init.service/secret-key:/var/lib/mediawiki/secret.key" ];
+      LoadCredential = [ "secret-key:${config.sops.secrets."mediawiki/secret-key".path}" ];
      UMask = lib.mkForce "0007";
    };
  };
@@ -295,6 +282,8 @@ in {
  systemd.services.phpfpm-mediawiki = lib.mkIf cfg.enable {
    after = [ "sops-install-secrets.service" ];
    serviceConfig = {
+      BindReadOnlyPaths = [ "/run/credentials/phpfpm-mediawiki.service/secret-key:/var/lib/mediawiki/secret.key" ];
+      LoadCredential = [ "secret-key:${config.sops.secrets."mediawiki/secret-key".path}" ];
      UMask = lib.mkForce "0007";
    };
  };
@@ -1,49 +0,0 @@
-{ config, lib, values, ... }:
-let
-  cfg = config.services.prometheus.exporters.php-fpm;
-  pools = [
-    "idp"
-    "mediawiki"
-    "pvv-nettsiden"
-    "roundcube"
-    "snappymail"
-  ];
-in
-{
-  services.phpfpm.pools = lib.genAttrs pools (_: {
-    settings."pm.status_path" = "/status";
-  });
-
-  services.prometheus.exporters.php-fpm = {
-    enable = true;
-    listenAddress = "127.0.0.1";
-    extraFlags = map
-      (name: "--phpfpm.scrape-uri=unix://${config.services.phpfpm.pools.${name}.socket};/status")
-      pools;
-  };
-
-  systemd.services.prometheus-php-fpm-exporter.serviceConfig = {
-    Slice = "system-monitoring.slice";
-    SupplementaryGroups = [ config.services.nginx.group ];
-  };
-
-  services.nginx = lib.mkIf cfg.enable {
-    virtualHosts."www.pvv.ntnu.no" = lib.mkIf config.services.nginx.enable {
-      forceSSL = true;
-      enableACME = true;
-      kTLS = true;
-
-      locations."/prometheus-php-fpm-exporter/metrics" = {
-        proxyPass = "http://localhost:${toString cfg.port}/metrics";
-
-        extraConfig = ''
-          allow 127.0.0.1;
-          allow ::1;
-          allow ${values.hosts.ildkule.ipv4};
-          allow ${values.hosts.ildkule.ipv6};
-          deny all;
-        '';
-      };
-    };
-  };
-}
@@ -1,40 +0,0 @@
-{ config, lib, ... }:
-let
-  domain = "dav.pvv.ntnu.no";
-  radicalePort = 5232;
-in {
-  services.radicale = {
-    enable = true;
-
-    settings = {
-      server = {
-        hosts = [ "127.0.0.1:${toString radicalePort}" ];
-      };
-
-      auth = {
-        type = "imap";
-        imap_host = "imap.pvv.ntnu.no";
-        imap_security = "tls";
-      };
-
-      storage = {
-        filesystem_folder = "/var/lib/radicale/collections";
-      };
-    };
-  };
-
-  services.nginx.virtualHosts."${domain}" = {
-    forceSSL = true;
-    enableACME = true;
-    kTLS = true;
-
-    extraConfig = ''
-      client_max_body_size 128M;
-    '';
-
-    locations."/" = {
-      proxyPass = "http://127.0.0.1:${toString radicalePort}";
-      proxyWebsockets = true;
-    };
-  };
-}
@@ -6,58 +6,40 @@ let
  port = 3011;
  wsPort = 3012;
 in {
-  sops.secrets."vaultwarden/rsa_key.pem" = {
+  sops.secrets."vaultwarden/environ" = {
    owner = "vaultwarden";
    group = "vaultwarden";
-    mode = "440";
-    restartUnits = [ "vaultwarden.service" ];
-  };
-  sops.secrets."vaultwarden/rsa_key.pub.pem" = {
-    owner = "vaultwarden";
-    group = "vaultwarden";
-    mode = "440";
-    restartUnits = [ "vaultwarden.service" ];
-  };
-  sops.secrets."vaultwarden/env/DATABASE_PASSWORD" = { };
-  sops.secrets."vaultwarden/env/SMTP_PASSWORD" = { };
-  sops.templates."vaultwarden/environment_file" = {
-    owner = "vaultwarden";
-    group = "vaultwarden";
-    mode = "440";
-    restartUnits = [ "vaultwarden.service" ];
-    content = ''
-        DATABASE_URL=postgresql://vaultwarden:${config.sops.placeholder."vaultwarden/env/DATABASE_PASSWORD"}@postgres.pvv.ntnu.no/vaultwarden
-        SMTP_PASSWORD=${config.sops.placeholder."vaultwarden/env/SMTP_PASSWORD"}
-    '';
  };

  services.vaultwarden = {
    enable = true;
    dbBackend = "postgresql";
-    environmentFile = config.sops.templates."vaultwarden/environment_file".path;
+    environmentFile = config.sops.secrets."vaultwarden/environ".path;
    config = {
-      DOMAIN = "https://${domain}";
+      domain = "https://${domain}";

-      ROCKET_ADDRESS = address;
-      ROCKET_PORT = port;
+      rocketAddress = address;
+      rocketPort = port;

-      WEBSOCKET_ENABLED = true;
-      WEBSOCKET_ADDRESS = address;
-      WEBSOCKET_PORT = wsPort;
+      websocketEnabled = true;
+      websocketAddress = address;
+      websocketPort = wsPort;

-      SIGNUPS_ALLOWED = true;
-      SIGNUPS_VERIFY = true;
-      SIGNUPS_DOMAINS_WHITELIST = "pvv.ntnu.no";
+      signupsAllowed = true;
+      signupsVerify = true;
+      signupsDomainsWhitelist = "pvv.ntnu.no";

-      SMTP_FROM = "vaultwarden@pvv.ntnu.no";
-      SMTP_FROM_NAME = "VaultWarden PVV";
+      smtpFrom = "vaultwarden@pvv.ntnu.no";
+      smtpFromName = "VaultWarden PVV";

-      SMTP_HOST = "smtp.pvv.ntnu.no";
-      SMTP_USERNAME = "vaultwarden";
-      SMTP_SECURITY = "force_tls";
-      SMTP_AUTH_MECHANISM = "Login";
+      smtpHost = "smtp.pvv.ntnu.no";
+      smtpUsername = "vaultwarden";
+      smtpSecurity = "force_tls";
+      smtpAuthMechanism = "Login";

-      RSA_KEY_FILENAME = lib.removeSuffix ".pem" config.sops.secrets."vaultwarden/rsa_key.pem".path;
+      # Configured in environ:
+      # databaseUrl = "postgresql://vaultwarden@/vaultwarden";
+      # smtpPassword = hemli
    };
  };

@@ -84,6 +66,40 @@ in {
    };
  };

+  systemd.services.vaultwarden = lib.mkIf cfg.enable {
+    serviceConfig = {
+      AmbientCapabilities = [ "" ];
+      CapabilityBoundingSet = [ "" ];
+      DeviceAllow = [ "" ];
+      LockPersonality = true;
+      NoNewPrivileges = true;
+      # MemoryDenyWriteExecute = true;
+      PrivateMounts = true;
+      PrivateUsers = true;
+      ProcSubset = "pid";
+      ProtectClock = true;
+      ProtectControlGroups = true;
+      ProtectHostname = true;
+      ProtectKernelLogs = true;
+      ProtectKernelModules = true;
+      ProtectKernelTunables = true;
+      RestrictAddressFamilies = [
+        "AF_INET"
+        "AF_INET6"
+        "AF_UNIX"
+      ];
+      RemoveIPC = true;
+      RestrictNamespaces = true;
+      RestrictRealtime = true;
+      RestrictSUIDSGID = true;
+      SystemCallArchitectures = "native";
+      SystemCallFilter = [
+        "@system-service"
+        "~@privileged"
+      ];
+    };
+  };
+
  services.rsync-pull-targets = {
    enable = true;
    locations."/var/lib/vaultwarden" = {
@@ -10,9 +10,8 @@
    enableACME = true;
    kTLS = true;
    locations = {
-      # "= /".return = "302 https://webmail.pvv.ntnu.no/roundcube";
+      "= /".return = "302 https://webmail.pvv.ntnu.no/roundcube";

-      "/roundcube".return = "302 https://webmail.pvv.ntnu.no/";
      "/afterlogic_lite".return = "302 https://webmail.pvv.ntnu.no/roundcube";
      "/squirrelmail".return = "302 https://webmail.pvv.ntnu.no/roundcube";
      "/rainloop".return = "302 https://snappymail.pvv.ntnu.no/";
@@ -9,12 +9,6 @@ in
  sops.secrets."roundcube/postgres_password" = {
    owner = "nginx";
    group = "nginx";
-    restartUnits = [ "phpfpm-roundcube.service" ];
-  };
-  sops.secrets."roundcube/des_key" = {
-    owner = "nginx";
-    group = "nginx";
-    restartUnits = [ "phpfpm-roundcube.service" ];
  };

  services.roundcube = {
@@ -29,7 +23,7 @@ in

    dicts = with pkgs.aspellDicts; [ en en-computers nb nn fr de it ];
    maxAttachmentSize = 20;
-    hostName = domain;
+    hostName = "roundcubeplaceholder.example.com";

    database = {
      host = "postgres.pvv.ntnu.no";
@@ -45,13 +39,47 @@ in
      $config['mail_domain'] = "pvv.ntnu.no";
      $config['smtp_user'] = "%u";
      $config['support_url'] = "";
-      $config['des_key'] = "${config.sops.secrets."roundcube/des_key".path}";
    '';
  };

-  # TODO: move this back to `webmail.pvv.ntnu.no/roundcube` subpath
+  services.nginx.virtualHosts."roundcubeplaceholder.example.com" = lib.mkForce { };

  services.nginx.virtualHosts.${domain} = {
    kTLS = true;
+    locations."/roundcube" = {
+      tryFiles = "$uri $uri/ =404";
+      index = "index.php";
+      root = pkgs.runCommandLocal "roundcube-dir" { } ''
+        mkdir -p $out
+        ln -s ${cfg.package} $out/roundcube
+      '';
+      extraConfig = ''
+        location ~ ^/roundcube/(${builtins.concatStringsSep "|" [
+        # https://wiki.archlinux.org/title/Roundcube
+        "README"
+        "INSTALL"
+        "LICENSE"
+        "CHANGELOG"
+        "UPGRADING"
+        "bin"
+        "SQL"
+        ".+\\.md"
+        "\\."
+        "config"
+        "temp"
+        "logs"
+        ]})/? {
+          deny all;
+        }
+
+        location ~ ^/roundcube/(.+\.php)(/?.*)$ {
+          fastcgi_split_path_info ^/roundcube(/.+\.php)(/.+)$;
+          include ${config.services.nginx.package}/conf/fastcgi_params;
+          include ${config.services.nginx.package}/conf/fastcgi.conf;
+          fastcgi_index index.php;
+          fastcgi_pass unix:${config.services.phpfpm.pools.roundcube.socket};
+        }
+      '';
+    };
  };
 }
@@ -80,46 +80,14 @@ in {
  };

  services.phpfpm.pools."pvv-nettsiden".settings = {
-    "php_admin_value[error_log]" = "syslog";
+    # "php_admin_value[error_log]" = "stderr";
    "php_admin_flag[log_errors]" = true;
    "catch_workers_output" = true;
-
-    "php_admin_value[max_execution_time]" = "30";
-    "request_terminate_timeout" = "60s";
-
-    "php_admin_value[sendmail_path]" = let
-      fakeSendmail = pkgs.writeShellApplication {
-        name = "fake-sendmail";
-        text = ''
-          TIMESTAMP="$(date +%Y-%m-%d-%H-%M-%S-%N)"
-          (
-            echo "SENDMAIL ARGS:"
-            echo "$@"
-            echo "SENDMAIL STDIN:"
-            cat -
-          ) > "/var/lib/pvv-nettsiden/emails/$TIMESTAMP.mail"
-        '';
-      };
-    in lib.getExe fakeSendmail;
-
-    "php_admin_value[disable_functions]" = lib.concatStringsSep "," [
-      "curl_exec"
-      "curl_multi_exec"
-      "exec"
-      "parse_ini_file"
-      "passthru"
-      "popen"
-      "proc_open"
-      "shell_exec"
-      "show_source"
-      "system"
-    ];
  };

  services.nginx.virtualHosts."pvv.ntnu.no" = {
    globalRedirect = cfg.domainName;
    redirectCode = 307;
-    kTLS = true;
    forceSSL = true;
    useACMEHost = "www.pvv.ntnu.no";
  };
@@ -127,7 +95,6 @@ in {
  services.nginx.virtualHosts."www.pvv.org" = {
    globalRedirect = cfg.domainName;
    redirectCode = 307;
-    kTLS = true;
    forceSSL = true;
    useACMEHost = "www.pvv.ntnu.no";
  };
@@ -135,13 +102,11 @@ in {
  services.nginx.virtualHosts."pvv.org" = {
    globalRedirect = cfg.domainName;
    redirectCode = 307;
-    kTLS = true;
    forceSSL = true;
    useACMEHost = "www.pvv.ntnu.no";
  };

  services.nginx.virtualHosts.${cfg.domainName} = {
-    kTLS = true;
    locations = {
      # Proxy home directories
      "^~ /~" = {
@@ -37,56 +37,47 @@ in {
  };

  systemd.services.pvv-nettsiden-gallery-update = {
+    path = with pkgs; [ imagemagick gnutar gzip ];
+
+    script = ''
+      tar ${lib.cli.toGNUCommandLineShell {} {
+        extract = true;
+        file = "${transferDir}/gallery.tar.gz";
+        directory = ".";
+      }}
+
+      # Delete files and directories that exists in the gallery that don't exist in the tarball
+      filesToRemove=$(uniq -u <(sort <(find . -not -path "./.thumbnails*") <(tar -tf ${transferDir}/gallery.tar.gz | sed 's|/$||')))
+      while IFS= read fname; do
+        rm -f "$fname" ||:
+        rm -f ".thumbnails/$fname.png" ||:
+      done <<< "$filesToRemove"
+
+      find . -type d -empty -delete
+
+      mkdir -p .thumbnails
+      images=$(find . -type f -not -path "./.thumbnails*")
+
+      while IFS= read fname; do
+        # Skip this file if an up-to-date thumbnail already exists
+        if [ -f ".thumbnails/$fname.png" ] && \
+          [ "$(date -R -r "$fname")" == "$(date -R -r ".thumbnails/$fname.png")" ]
+        then
+          continue
+        fi
+
+        echo "Creating thumbnail for $fname"
+        mkdir -p $(dirname ".thumbnails/$fname")
+        magick -define jpeg:size=200x200 "$fname" -thumbnail 300 -auto-orient ".thumbnails/$fname.png" ||:
+        touch -m -d "$(date -R -r "$fname")" ".thumbnails/$fname.png"
+      done <<< "$images"
+    '';
+
    serviceConfig = {
      WorkingDirectory = galleryDir;
      User = config.services.pvv-nettsiden.user;
      Group = config.services.pvv-nettsiden.group;

-      ExecStart = lib.getExe (pkgs.writeShellApplication {
-        name = "pvv-nettsiden-gallery-update-exec-start.sh";
-        runtimeInputs = with pkgs; [
-          coreutils
-          findutils
-          gnused
-          gnutar
-          gzip
-          imagemagick
-        ];
-        text = ''
-          tar ${lib.cli.toCommandLineShellGNU { } {
-            extract = true;
-            file = "${transferDir}/gallery.tar.gz";
-            directory = ".";
-          }}
-
-          # Delete files and directories that exists in the gallery that don't exist in the tarball
-          filesToRemove="$(uniq -u <(sort <(find . -not -path './.thumbnails*') <(tar -tf '${transferDir}/gallery.tar.gz' | sed 's|/$||')))"
-          while IFS= read -r fname; do
-            rm -f "$fname" ||:
-            rm -f ".thumbnails/$fname.png" ||:
-          done <<< "$filesToRemove"
-
-          find . -type d -empty -delete
-
-          mkdir -p .thumbnails
-          images="$(find . -type f -not -path './.thumbnails*')"
-
-          while IFS= read -r fname; do
-            # Skip this file if an up-to-date thumbnail already exists
-            if [ -f ".thumbnails/$fname.png" ] && \
-              [ "$(date -R -r "$fname")" == "$(date -R -r ".thumbnails/$fname.png")" ]
-            then
-              continue
-            fi
-
-            echo "Creating thumbnail for $fname"
-            mkdir -p "$(dirname ".thumbnails/$fname")"
-            magick -define jpeg:size=200x200 "$fname" -thumbnail 300 -auto-orient ".thumbnails/$fname.png" ||:
-            touch -m -d "$(date -R -r "$fname")" ".thumbnails/$fname.png"
-          done <<< "$images"
-        '';
-      });
-
      AmbientCapabilities = [ "" ];
      CapabilityBoundingSet = [ "" ];
      DeviceAllow = [ "" ];
@@ -1,32 +1,56 @@
-{ fp, pkgs, values, ... }:
+{ fp, pkgs, values, lib, ... }:
 {
  imports = [
    ./hardware-configuration.nix

    (fp /base)
-    ./services/nginx
+    #./services/nginx

-    ./services/calendar-bot.nix
+    #./services/calendar-bot.nix
    #./services/git-mirrors
-    ./services/minecraft-heatmap.nix
-    ./services/mysql
-    ./services/postgresql
+    #./services/minecraft-heatmap.nix
+    #./services/mysql
+    #./services/postgresql

-    ./services/matrix
+    #./services/matrix
  ];

-  #systemd.network.networks."30-enp6s0f0" = values.defaultNetworkConfig // {
-  systemd.network.networks."30-ens18" = values.defaultNetworkConfig // {
-    #matchConfig.Name = "enp6s0f0";
-    matchConfig.Name = "ens18";
-    address = with values.hosts.bicep; [ (ipv4 + "/25") (ipv6 + "/64") ]
-      ++ (with values.services.turn; [ (ipv4 + "/25") (ipv6 + "/64") ]);
+  boot.loader = {
+    systemd-boot.enable = false; # no uefi support on this device
+    grub.device = "/dev/disk/by-id/scsi-3600508b1001ca9cf1c96afea40d5451d";
+    grub.enable = true;
+  };
+
+  boot = {
+    zfs = {
+      extraPools = [ "bicepdata" ];
+      requestEncryptionCredentials = false;
+    };
+    supportedFilesystems.zfs = true;
+
+    kernelPackages = pkgs.linuxPackages;
+  };
+
+  services.zfs.autoScrub = {
+    enable = true;
+    interval = "Wed *-*-8..14 00:00:00";
+  };
+
+  networking.hostId = "3b4bf6a5";
+  systemd.network.networks."30-ens10f3" = values.defaultNetworkConfig // {
+    matchConfig.Name = "ens10f3";
+    # IPs belong to guest1.pvv.ntnu.no
+    address = [ "129.241.210.248/25" "2001:700:300:1900::248/63" ];
  };
  systemd.network.wait-online = {
    anyInterface = true;
  };

-  services.qemuGuest.enable = true;
+  # local overrides
+  services.smartd.enable = lib.mkForce false;
+  system.autoUpgrade.enable = lib.mkForce false;
+  #services.userborn.enable = lib.mkForce false;
+  #services.userdbd.enable = lib.mkForce false;

  # Don't change (even during upgrades) unless you know what you are doing.
  # See https://search.nixos.org/options?show=system.stateVersion
@@ -5,39 +5,26 @@

 {
  imports =
-    [ (modulesPath + "/profiles/qemu-guest.nix")
+    [ (modulesPath + "/installer/scan/not-detected.nix")
    ];

-  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "ahci" "sd_mod" "sr_mod" ];
+  boot.initrd.availableKernelModules = [ "uhci_hcd" "ehci_pci" "hpsa" "ohci_pci" "usbhid" "sd_mod" ];
  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
  boot.extraModulePackages = [ ];

  fileSystems."/" =
-    { device = "/dev/disk/by-uuid/20e06202-7a09-47cc-8ef6-5e7afe19453a";
-      fsType = "ext4";
+    { device = "/dev/disk/by-uuid/ec4ab82a-f31e-4f02-a988-99c18160d04a";
+      fsType = "btrfs";
    };

-  # temp data disk, only 128gb not enough until we can add another disk to the system.
-  fileSystems."/data" =
-    { device = "/dev/disk/by-uuid/c81af266-0781-4084-b8eb-c2587cbcf1ba";
-      fsType = "ext4";
-    };
-
-  fileSystems."/boot" =
-    { device = "/dev/disk/by-uuid/198B-E363";
-      fsType = "vfat";
-      options = [ "fmask=0022" "dmask=0022" ];
-    };
-
-  swapDevices = [ ];
-
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.ens18.useDHCP = lib.mkDefault true;
+  swapDevices = [
+    {
+      device = "/var/lib/swapfile";
+      size = 8 * 1024;
+    }
+  ];

  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }
@@ -83,7 +83,6 @@ in
  };

  services.nginx.virtualHosts."mirrors.pvv.ntnu.no" = {
-    kTLS = true;
    forceSSL = true;
    enableACME = true;

@@ -22,7 +22,6 @@ in
  sops.templates."hookshot-registration.yaml" = {
    owner = config.users.users.matrix-synapse.name;
    group = config.users.groups.keys-matrix-registrations.name;
-    mode = "0440";
    restartUnits = [ "matrix-hookshot.service" ];
    content = ''
      id: matrix-hookshot
@@ -50,59 +49,12 @@ in

  systemd.services.matrix-hookshot = {
    serviceConfig = {
-      DynamicUser = true;
      SupplementaryGroups = [
        config.users.groups.keys-matrix-registrations.name
      ];
      LoadCredential = [
        "passkey.pem:${config.sops.secrets."matrix/hookshot/passkey".path}"
      ];
-
-      RuntimeDirectory = [ "matrix-hookshot/root-mnt" ];
-      RootDirectory = "/run/matrix-hookshot/root-mnt";
-      BindReadOnlyPaths = [
-        config.sops.templates."hookshot-registration.yaml".path
-        builtins.storeDir
-        "/etc"
-        "/run/nscd"
-        "/var/run/nscd"
-      ];
-
-      AmbientCapabilities = "";
-      CapabilityBoundingSet = "";
-      LockPersonality = true;
-      MemoryDenyWriteExecute = false; # node needs this
-      NoNewPrivileges = true;
-      PrivateDevices = true;
-      PrivateMounts = true;
-      PrivateTmp = true;
-      PrivateUsers = true;
-      ProcSubset = "pid";
-      ProtectClock = true;
-      ProtectControlGroups = true;
-      ProtectHome = true;
-      ProtectHostname = true;
-      ProtectKernelLogs = true;
-      ProtectKernelModules = true;
-      ProtectKernelTunables = true;
-      ProtectProc = "invisible";
-      ProtectSystem = "strict";
-      RemoveIPC = true;
-      RestrictAddressFamilies = [
-        "AF_INET"
-        "AF_INET6"
-        "AF_UNIX"
-      ];
-      RestrictNamespaces = true;
-      RestrictRealtime = true;
-      RestrictSUIDSGID = true;
-      SystemCallArchitectures = "native";
-      SystemCallFilter = [
-        "@system-service"
-        "~@privileged"
-        "~@resources"
-      ];
-      UMask = "0077";
    };
  };

@@ -194,7 +146,6 @@ in
  };

  services.nginx.virtualHosts."hookshot.pvv.ntnu.no" = {
-    kTLS = true;
    enableACME = true;
    addSSL = true;
    locations."/" = {
@@ -54,53 +54,4 @@
    # TODO: Fix upstream module in nixpkgs
    pantalaimon.username = "bot_admin";
  };
-
-  systemd.services.mjolnir.serviceConfig = {
-    DynamicUser = true;
-    RuntimeDirectory = [ "mjolnir/root-mnt" ];
-    RootDirectory = "/run/mjolnir/root-mnt";
-    BindReadOnlyPaths = [
-      config.sops.secrets."matrix/mjolnir/access_token".path
-      builtins.storeDir
-      "/etc"
-      "/run/nscd"
-      "/var/run/nscd"
-    ];
-
-    AmbientCapabilities = "";
-    CapabilityBoundingSet = "";
-    LockPersonality = true;
-    MemoryDenyWriteExecute = false; # node needs this
-    NoNewPrivileges = true;
-    PrivateDevices = true;
-    PrivateMounts = true;
-    PrivateTmp = true;
-    PrivateUsers = true;
-    ProcSubset = "pid";
-    ProtectClock = true;
-    ProtectControlGroups = true;
-    ProtectHome = true;
-    ProtectHostname = true;
-    ProtectKernelLogs = true;
-    ProtectKernelModules = true;
-    ProtectKernelTunables = true;
-    ProtectProc = "invisible";
-    ProtectSystem = "strict";
-    RemoveIPC = true;
-    RestrictAddressFamilies = [
-      "AF_INET"
-      "AF_INET6"
-      "AF_UNIX"
-    ];
-    RestrictNamespaces = true;
-    RestrictRealtime = true;
-    RestrictSUIDSGID = true;
-    SystemCallArchitectures = "native";
-    SystemCallFilter = [
-      "@system-service"
-      "~@privileged"
-      "~@resources"
-    ];
-    UMask = "0077";
-  };
 }
@@ -56,55 +56,6 @@ in
    enableSynapseIntegration = false;
  };

-  systemd.services."matrix-ooye" = {
-    serviceConfig = {
-      RuntimeDirectory = [ "matrix-ooye/root-mnt" ];
-      RootDirectory = "/run/matrix-ooye/root-mnt";
-      BindReadOnlyPaths = [
-        builtins.storeDir
-        "/etc"
-        "/run/nscd"
-        "/var/run/nscd"
-      ];
-
-      AmbientCapabilities = "";
-      CapabilityBoundingSet = "";
-      LockPersonality = true;
-      MemoryDenyWriteExecute = false; # node needs this
-      NoNewPrivileges = true;
-      PrivateDevices = true;
-      PrivateMounts = true;
-      PrivateTmp = true;
-      PrivateUsers = true;
-      ProcSubset = "pid";
-      ProtectClock = true;
-      ProtectControlGroups = true;
-      ProtectHome = true;
-      ProtectHostname = true;
-      ProtectKernelLogs = true;
-      ProtectKernelModules = true;
-      ProtectKernelTunables = true;
-      ProtectProc = "invisible";
-      ProtectSystem = "strict";
-      RemoveIPC = true;
-      RestrictAddressFamilies = [
-        "AF_INET"
-        "AF_INET6"
-        "AF_UNIX"
-      ];
-      RestrictNamespaces = true;
-      RestrictRealtime = true;
-      RestrictSUIDSGID = true;
-      SystemCallArchitectures = "native";
-      SystemCallFilter = [
-        "@system-service"
-        "~@privileged"
-        "~@resources"
-      ];
-      UMask = "0077";
-    };
-  };
-
  systemd.services."matrix-synapse" = {
    after = [
      "matrix-ooye-pre-start.service"
@@ -129,7 +80,6 @@ in
  };

  services.nginx.virtualHosts."ooye.pvv.ntnu.no" = {
-    kTLS = true;
    forceSSL = true;
    enableACME = true;
    locations."/".proxyPass = "http://localhost:${cfg.socket}";
@@ -74,7 +74,7 @@ in {
        name = "psycopg2";
        args = {
          host = "/var/run/postgresql";
-          database = "synapse";
+          dbname = "synapse";
          user = "matrix-synapse";
          cp_min = 1;
          cp_max = 5;
@@ -23,28 +23,27 @@ in
  };

  systemd.services.minecraft-heatmap-ingest-logs = lib.mkIf cfg.enable {
-    serviceConfig = {
-      LoadCredential = [
-        "sshkey:${config.sops.secrets."minecraft-heatmap/ssh-key/private".path}"
-      ];
-      ExecStartPre = let
-        knownHostsFile = pkgs.writeText "minecraft-heatmap-known-hosts" ''
-          innovation.pvv.ntnu.no ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE9O/y5uqcLKCodg2Q+XfZPH/AoUIyBlDhigImU+4+Kn
-          innovation.pvv.ntnu.no ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQClR9GvWeVPZHudlnFXhGHUX5sGX9nscsOsotnlQ4uVuGsgvRifsVsuDULlAFXwoV1tYp4vnyXlsVtMddpLI5ANOIDcZ4fgDxpfSQmtHKssNpDcfMhFJbfRVyacipjA4osxTxvLox/yjtVt+URjTHUA1MWzEwc26KfiOvWO5tCBTan7doN/4KOyT05GwBxwzUAwUmoGTacIITck2Y9qp4+xFYqehbXqPdBb15hFyd38OCQhtU1hWV2Yi18+hJ4nyjc/g5pr6mW09ULlFghe/BaTUXrTisYC6bMcJZsTDwsvld9581KPvoNZOTQhZPTEQCZZ1h54fe0ZHuveVB3TIHovZyjoUuaf4uiFOjJVaKRB+Ig+Il6r7tMUn9CyHtus/Nd86E0TFBzoKxM0OFu88oaUlDtZVrUJL5En1lGoimajebb1JPxllFN5hqIT+gVyMY6nRzkcfS7ieny/U4rzXY2rfz98selftgh3LsBywwADv65i+mPw1A/1QdND1R6fV4U=
-          innovation.pvv.ntnu.no ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBNjl3HfsDqmALWCL9uhz9k93RAD2565ndBqUh4N/rvI7MCwEJ6iRCdDev0YzB1Fpg24oriyYoxZRP24ifC2sQf8=
-        '';
-        rsyncArgs = lib.cli.toCommandLineShellGNU { } {
-          archive = true;
-          verbose = true;
-          progress = true;
-          no-owner = true;
-          no-group = true;
-        };
-        sshCommand = ''${pkgs.openssh}/bin/ssh -o UserKnownHostsFile='${knownHostsFile}' -i \"$CREDENTIALS_DIRECTORY\"/sshkey'';
-      in [
-        "${lib.getExe' pkgs.coreutils "mkdir"} -p '${cfg.minecraftLogsDir}'"
-        "${lib.getExe pkgs.rsync} ${rsyncArgs} --rsh=\"${sshCommand}\" root@innovation.pvv.ntnu.no:. '${cfg.minecraftLogsDir}'/"
-      ];
-    };
+    serviceConfig.LoadCredential = [
+      "sshkey:${config.sops.secrets."minecraft-heatmap/ssh-key/private".path}"
+    ];
+
+    preStart = let
+      knownHostsFile = pkgs.writeText "minecraft-heatmap-known-hosts" ''
+        innovation.pvv.ntnu.no ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE9O/y5uqcLKCodg2Q+XfZPH/AoUIyBlDhigImU+4+Kn
+        innovation.pvv.ntnu.no ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQClR9GvWeVPZHudlnFXhGHUX5sGX9nscsOsotnlQ4uVuGsgvRifsVsuDULlAFXwoV1tYp4vnyXlsVtMddpLI5ANOIDcZ4fgDxpfSQmtHKssNpDcfMhFJbfRVyacipjA4osxTxvLox/yjtVt+URjTHUA1MWzEwc26KfiOvWO5tCBTan7doN/4KOyT05GwBxwzUAwUmoGTacIITck2Y9qp4+xFYqehbXqPdBb15hFyd38OCQhtU1hWV2Yi18+hJ4nyjc/g5pr6mW09ULlFghe/BaTUXrTisYC6bMcJZsTDwsvld9581KPvoNZOTQhZPTEQCZZ1h54fe0ZHuveVB3TIHovZyjoUuaf4uiFOjJVaKRB+Ig+Il6r7tMUn9CyHtus/Nd86E0TFBzoKxM0OFu88oaUlDtZVrUJL5En1lGoimajebb1JPxllFN5hqIT+gVyMY6nRzkcfS7ieny/U4rzXY2rfz98selftgh3LsBywwADv65i+mPw1A/1QdND1R6fV4U=
+        innovation.pvv.ntnu.no ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBNjl3HfsDqmALWCL9uhz9k93RAD2565ndBqUh4N/rvI7MCwEJ6iRCdDev0YzB1Fpg24oriyYoxZRP24ifC2sQf8=
+      '';
+    in ''
+      mkdir -p '${cfg.minecraftLogsDir}'
+      "${lib.getExe pkgs.rsync}" \
+      --archive \
+      --verbose \
+      --progress \
+      --no-owner \
+      --no-group \
+      --rsh="${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=\"${knownHostsFile}\" -i \"$CREDENTIALS_DIRECTORY\"/sshkey" \
+      root@innovation.pvv.ntnu.no:/ \
+      '${cfg.minecraftLogsDir}'/
+    '';
  };
 }
@@ -57,7 +57,7 @@ in
      rm "$STATE_DIRECTORY/mysql-dump-latest.sql.zst" ||:
      ln -T "$OUT_FILE" "$STATE_DIRECTORY/mysql-dump-latest.sql.zst"

-      while [ "$(find "$STATE_DIRECTORY" -type f -printf '.' | wc -c)" -gt '${toString (rotations + 1)}' ]; do
+      while [ "$(find "$STATE_DIRECTORY" -type f -printf '.' | wc -c)" -gt ${toString (rotations + 1)} ]; do
        rm "$(find "$STATE_DIRECTORY" -type f -printf '%T+ %p\n' | sort | head -n 1 | cut -d' ' -f2)"
      done
    '';
@@ -4,10 +4,7 @@ let
  dataDir = "/data/mysql";
 in
 {
-  imports = [
-    ./backup.nix
-    ./timed-jobs.nix
-  ];
+  imports = [ ./backup.nix ];

  sops.secrets."mysql/password" = {
    owner = "mysql";
@@ -26,9 +23,6 @@ in
        bind-address = values.services.mysql.ipv4;
        skip-networking = 0;

-        # Useful for the mysqld prometheus exporter
-        userstat = 1;
-
        # This was needed in order to be able to use all of the old users
        # during migration from knakelibrak to bicep in Sep. 2023
        secure_auth = 0;
@@ -57,18 +51,6 @@ in
    mode = "0700";
  };

-  fileSystems.${dataDir} = lib.mkIf cfg.enable {
-    device = dataDir;
-    fsType = "none";
-    options = [
-      "bind"
-      "noatime"
-      "noauto"
-      "x-systemd.requires=systemd-tmpfiles-setup.service"
-      "x-systemd.requires=systemd-tmpfiles-resetup.service"
-    ];
-  };
-
  systemd.services.mysql = lib.mkIf cfg.enable {
    after = [
      "systemd-tmpfiles-setup.service"
@@ -76,7 +58,6 @@ in
    ];

    serviceConfig = {
-      RequiresMountsFor = [ dataDir ];
      BindPaths = [ "${dataDir}:${cfg.dataDir}" ];

      LogsDirectory = "mysql";
@@ -90,16 +71,4 @@ in
      ];
    };
  };
-
-  services.logrotate = lib.mkIf (cfg.settings.mysqld.slow-query-log == 1) {
-    enable = true;
-    settings.mysql-slowlog = {
-      files = [ cfg.settings.mysqld.slow-query-log-file ];
-      frequency = "weekly";
-      rotate = 12;
-      create = "0660 mysql mysql";
-      minsize = "1M";
-      compress = true;
-    };
-  };
 }
@@ -1,48 +0,0 @@
-{ config, lib, pkgs, ... }:
-let
-  cfg = config.services.mysql;
-in
-{
-  config = lib.mkIf cfg.enable {
-    systemd.services = {
-      mysql-analyze = {
-        requires = [ "mysql.service" ];
-        after = [ "mysql.service" ];
-        description = "Refresh MariaDB optimizer statistics for all databases";
-        startAt = "Mon 05:00:00";
-        serviceConfig = {
-          Type = "oneshot";
-          User = cfg.user;
-          Group = cfg.group;
-
-          Nice = 19;
-          IOSchedulingClass = "best-effort";
-          IOSchedulingPriority = 7;
-
-          ExecStart = "${lib.getExe' cfg.package "mariadb-check"} --all-databases --analyze";
-        };
-      };
-
-      mysql-optimize = {
-        requires = [ "mysql.service" ];
-        after = [ "mysql.service" ];
-        description = "Check, repair and optimize all MariaDB databases";
-        startAt = "*-*-01 04:00:00";
-        serviceConfig = {
-          Type = "oneshot";
-          User = cfg.user;
-          Group = cfg.group;
-
-          Nice = 19;
-          IOSchedulingClass = "best-effort";
-          IOSchedulingPriority = 7;
-
-          ExecStart = [
-            "${lib.getExe' cfg.package "mariadb-check"} --all-databases --auto-repair"
-            "${lib.getExe' cfg.package "mariadb-check"} --all-databases --optimize"
-          ];
-        };
-      };
-    };
-  };
-}
@@ -58,7 +58,7 @@ in
      rm "$STATE_DIRECTORY/postgresql-dump-latest.sql.zst" ||:
      ln -T "$OUT_FILE" "$STATE_DIRECTORY/postgresql-dump-latest.sql.zst"

-      while [ "$(find "$STATE_DIRECTORY" -type f -printf '.' | wc -c)" -gt '${toString (rotations + 1)}' ]; do
+      while [ "$(find "$STATE_DIRECTORY" -type f -printf '.' | wc -c)" -gt ${toString (rotations + 1)} ]; do
        rm "$(find "$STATE_DIRECTORY" -type f -printf '%T+ %p\n' | sort | head -n 1 | cut -d' ' -f2)"
      done
    '';
@@ -1,37 +0,0 @@
-{ config, lib, pkgs, ... }:
-let
-  cfg = config.services.postgresql;
-in
-{
-  config = lib.mkIf cfg.enable {
-    systemd.services = {
-      postgresql-repack = {
-        requires = [ "postgresql.service" ];
-        after = [ "postgresql.target" ];
-        description = "Repack all PostgreSQL databases";
-        startAt = "Mon 06:00:00";
-        serviceConfig = {
-          Type = "oneshot";
-          User = "postgres";
-          Group = "postgres";
-
-          ExecStart = "${lib.getExe cfg.package.pkgs.pg_repack} --host=/run/postgresql --no-kill-backend --wait-timeout=30 --all";
-        };
-      };
-
-      postgresql-vacuum-analyze = {
-        requires = [ "postgresql.service" ];
-        after = [ "postgresql.target" ];
-        description = "Vacuum and analyze all PostgreSQL databases";
-        startAt = "Tue 06:00:00";
-        serviceConfig = {
-          Type = "oneshot";
-          User = "postgres";
-          Group = "postgres";
-
-          ExecStart = "${lib.getExe' cfg.package "psql"} --port=${builtins.toString cfg.settings.port} -tAc 'VACUUM ANALYZE'";
-        };
-      };
-    };
-  };
-}
@@ -3,18 +3,13 @@ let
  cfg = config.services.postgresql;
 in
 {
-  imports = [
-    ./backup.nix
-    ./cleanup-timers.nix
-  ];
+  imports = [ ./backup.nix ];

  services.postgresql = {
    enable = true;
    package = pkgs.postgresql_18;
-    extensions = ps: with ps; [ pg_repack ];
    enableTCPIP = true;

-    # NOTE: md5 accepts both md5 and scram-sha-256
    authentication = ''
      host all all ${values.ipv4-space} md5
      host all all ${values.ipv6-space} md5
@@ -77,15 +72,6 @@ in
      maintenance_io_concurrency = 100;
      wal_recycle = true;

-      # -------------------------------- #
-
-      # Authentication
-      password_encryption = "scram-sha-256";
-
-      # Logging
-      log_connections = "authorization";
-      log_disconnections = true;
-
      # SSL
      ssl = true;
      ssl_cert_file = "/run/credentials/postgresql.service/cert";
@@ -99,18 +85,6 @@ in
    mode = "0700";
  };

-  fileSystems."/data/postgresql" = lib.mkIf cfg.enable {
-    device = "/data/postgresql";
-    fsType = "none";
-    options = [
-      "bind"
-      "noatime"
-      "noauto"
-      "x-systemd.requires=systemd-tmpfiles-setup.service"
-      "x-systemd.requires=systemd-tmpfiles-resetup.service"
-    ];
-  };
-
  systemd.services.postgresql-setup = lib.mkIf cfg.enable {
    after = [
      "systemd-tmpfiles-setup.service"
@@ -122,7 +96,6 @@ in
        "key:/etc/certs/postgres.key"
      ];

-      RequiresMountsFor = [ "/data/postgresql" ];
      BindPaths = [ "/data/postgresql:/var/lib/postgresql" ];
    };
  };
@@ -138,7 +111,6 @@ in
        "key:/etc/certs/postgres.key"
      ];

-      RequiresMountsFor = [ "/data/postgresql" ];
      BindPaths = [ "/data/postgresql:/var/lib/postgresql" ];
    };
  };
@@ -150,27 +122,5 @@ in
  };

  networking.firewall.allowedTCPPorts = lib.mkIf cfg.enable [ 5432 ];
-
-  environment.systemPackages = [
-    (pkgs.writeShellApplication {
-      name = "postgres-update-collations.sh";
-      runtimeInputs = [
-        config.systemd.package
-        cfg.package
-      ];
-      text = ''
-        run0 --user=postgres psql <${pkgs.writeText "postgres-update-collations.sql" ''
-          CREATE FUNCTION exec(text) returns text language plpgsql volatile
-            AS $f$
-              BEGIN
-                EXECUTE $1;
-                RETURN $1;
-              END;
-          $f$;
-
-          SELECT exec('ALTER DATABASE "' || datname || '" REFRESH COLLATION VERSION') FROM pg_database WHERE datistemplate = false;
-        ''}
-      '';
-    })
-  ];
+  networking.firewall.allowedUDPPorts = lib.mkIf cfg.enable [ 5432 ];
 }
@@ -29,29 +29,7 @@
        firewall = {
          enable = true;
          # Allow SSH and HTTP and ports for email and irc
-          allowedTCPPorts = [
-            22 # SSH
-            80 # HTTP
-
-            # IRC
-            194 # IRC
-            994 # IRC (TLS)
-            6697 # IRC (SSL)
-            6665
-            6666
-            6667
-            6668
-            6669
-
-            # EMAIL
-            25  # STMP
-            465 # STMP (SSL)
-            587 # STMP (TLS/STARTTLS)
-            110 # POP3
-            995 # POP3 (SSL/TLS)
-            143 # IMAP
-            993 # IMAP (SSL/TLS)
-          ];
+          allowedTCPPorts = [ 80 22 194 994 6665 6666 6667 6668 6669 6697 995 993 25 465 587 110 143 993 995 ];
          allowedUDPPorts = [ 80 22 194 994 6665 6666 6667 6668 6669 6697 995 993 25 465 587 110 143 993 995 ];
        };
        # Use systemd-resolved inside the container
@@ -16,7 +16,6 @@
  fileSystems."/" =
    { device = "/dev/disk/by-uuid/4e8667f8-55de-4103-8369-b94665f42204";
      fsType = "ext4";
-      options = [ "relatime" ];
    };

  fileSystems."/boot" =
@@ -16,7 +16,6 @@
  fileSystems."/" =
    { device = "/dev/disk/by-uuid/33825f0d-5a63-40fc-83db-bfa1ebb72ba0";
      fsType = "ext4";
-      options = [ "relatime" ];
    };

  fileSystems."/boot" =
@@ -7,7 +7,6 @@
 {
  imports = [
    ./hardware-configuration.nix
-    ./services/bluemap.nix
    (fp /base)
  ];

@@ -22,17 +22,16 @@
    "sd_mod"
  ];
  boot.initrd.kernelModules = [ "dm-snapshot" ];
-  boot.kernelModules = [ "kvm-intel" ];
+  boot.kernelModules = [ ];
  boot.extraModulePackages = [ ];

  fileSystems."/" = {
    device = "/dev/mapper/pool-root";
    fsType = "ext4";
-    options = [ "relatime" ];
  };

  fileSystems."/boot" = {
-    device = "/dev/disk/by-uuid/BD97-FCA0";
+    device = "/dev/disk/by-uuid/933A-3005";
    fsType = "vfat";
    options = [
      "fmask=0077"
@@ -1,113 +0,0 @@
-{ config, lib, pkgs, inputs, ... }:
-let
-  vanillaSurvival = "/var/lib/bluemap/vanilla_survival_world";
-in {
-  # NOTE: our version of the module gets added in flake.nix
-  disabledModules = [ "services/web-apps/bluemap.nix" ];
-
-  sops.secrets."bluemap/ssh-key" = { };
-  sops.secrets."bluemap/ssh-known-hosts" = { };
-
-  services.bluemap = {
-    enable = true;
-
-    eula = true;
-    onCalendar = "*-*-* 05:45:00"; # a little over an hour after auto-upgrade
-
-    enableNginx = false;
-
-    host = "minecraft.pvv.ntnu.no";
-
-    maps = let
-      inherit (inputs.minecraft-kartverket.packages.${pkgs.stdenv.hostPlatform.system}) bluemap-export;
-    in {
-      "verden" = {
-        extraHoconMarkersFile = "${bluemap-export}/overworld.hocon";
-        settings = {
-          world = vanillaSurvival;
-          dimension = "minecraft:overworld";
-          name = "Verden";
-          sorting = 0;
-          start-pos = {
-            x = 0;
-            z = 0;
-          };
-          ambient-light = 0.1;
-          cave-detection-ocean-floor = -5;
-        };
-      };
-      "underverden" = {
-        extraHoconMarkersFile = "${bluemap-export}/nether.hocon";
-        settings = {
-          world = vanillaSurvival;
-          dimension = "minecraft:the_nether";
-          name = "Underverden";
-          sorting = 100;
-          start-pos = {
-            x = 0;
-            z = 0;
-          };
-          sky-color = "#290000";
-          void-color = "#150000";
-          sky-light = 1;
-          ambient-light = 0.6;
-          remove-caves-below-y = -10000;
-          cave-detection-ocean-floor = -5;
-          cave-detection-uses-block-light = true;
-          render-mask = [{
-            max-y = 90;
-          }];
-        };
-      };
-      "enden" = {
-        extraHoconMarkersFile = "${bluemap-export}/the-end.hocon";
-        settings = {
-          world = vanillaSurvival;
-          dimension = "minecraft:the_end";
-          name = "Enden";
-          sorting = 200;
-          start-pos = {
-            x = 0;
-            z = 0;
-          };
-          sky-color = "#080010";
-          void-color = "#080010";
-          sky-light = 1;
-          ambient-light = 0.6;
-          remove-caves-below-y = -10000;
-          cave-detection-ocean-floor = -5;
-        };
-      };
-    };
-  };
-
-  systemd.services."render-bluemap-maps" = {
-    serviceConfig = {
-      StateDirectory = [ "bluemap/world" ];
-      ExecStartPre = let
-        rsyncArgs = lib.cli.toCommandLineShellGNU { } {
-          archive = true;
-          compress = true;
-          verbose = true;
-          no-owner = true;
-          no-group = true;
-          rsh = "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=%d/ssh-known-hosts -i %d/sshkey";
-        };
-      in "${lib.getExe pkgs.rsync} ${rsyncArgs} root@innovation.pvv.ntnu.no:. ${vanillaSurvival}";
-      ExecStartPost = let
-        rsyncArgs = lib.cli.toCommandLineShellGNU { } {
-          archive = true;
-          compress = true;
-          verbose = true;
-          no-owner = true;
-          no-group = true;
-          rsh = "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=%d/ssh-known-hosts -i %d/sshkey";
-        };
-      in "${lib.getExe pkgs.rsync} ${rsyncArgs} --groupmap=root:nginx ${config.services.bluemap.webRoot}/ root@bekkalokk.pvv.ntnu.no:.";
-      LoadCredential = [
-        "sshkey:${config.sops.secrets."bluemap/ssh-key".path}"
-        "ssh-known-hosts:${config.sops.secrets."bluemap/ssh-known-hosts".path}"
-      ];
-    };
-  };
-}
@@ -1,23 +1,17 @@
+{ config, fp, pkgs, lib, values, ... }:
 {
-  config,
-  fp,
-  pkgs,
-  lib,
-  values,
-  ...
-}: {
  imports = [
-    ./hardware-configuration.nix
-    ./disks.nix
-    (fp /base)
+      # Include the results of the hardware scan.
+      ./hardware-configuration.nix
+      (fp /base)

-    ./services/monitoring
-    ./services/nginx
-    ./services/journald-remote.nix
-  ];
+      ./services/monitoring
+      ./services/nginx
+      ./services/journald-remote.nix
+    ];

-  boot.loader.grub.enable = true;
-  boot.loader.systemd-boot.enable = lib.mkForce false;
+  boot.loader.systemd-boot.enable = false;
+  boot.loader.grub.device = "/dev/vda";
  boot.tmp.cleanOnBoot = true;
  zramSwap.enable = true;

@@ -33,22 +27,13 @@
    nameservers = values.defaultNetworkConfig.dns;
    defaultGateway.address = hostConf.ipv4_internal_gw;

-    interfaces."ens3" = {
+    interfaces."ens4" = {
      ipv4.addresses = [
-        {
-          address = hostConf.ipv4;
-          prefixLength = 32;
-        }
-        {
-          address = hostConf.ipv4_internal;
-          prefixLength = 24;
-        }
+        { address = hostConf.ipv4;          prefixLength = 32; }
+        { address = hostConf.ipv4_internal; prefixLength = 24; }
      ];
      ipv6.addresses = [
-        {
-          address = hostConf.ipv6;
-          prefixLength = 64;
-        }
+        { address = hostConf.ipv6;          prefixLength = 64; }
      ];
    };
  };
@@ -1,27 +0,0 @@
-{
-  disko.devices = {
-    disk = {
-      sda = {
-        device = "/dev/sda";
-        type = "disk";
-        content = {
-          type = "gpt";
-          partitions = {
-            bios = {
-              size = "1M";
-              type = "EF02";
-            };
-            root = {
-              size = "100%";
-              content = {
-                type = "filesystem";
-                format = "ext4";
-                mountpoint = "/";
-              };
-            };
-          };
-        };
-      };
-    };
-  };
-}
@@ -1,24 +1,16 @@
-# Do not modify this file!  It was generated by 'nixos-generate-config'
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
-
+{ modulesPath, lib, ... }:
 {
-  imports =
-    [ (modulesPath + "/profiles/qemu-guest.nix")
-    ];
+  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
+  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "xen_blkfront" "vmw_pvscsi" ];
+  boot.initrd.kernelModules = [ "nvme" ];
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/e35eb4ce-aac3-4f91-8383-6e7cd8bbf942";
+    fsType = "ext4";
+  };
+  fileSystems."/data" = {
+    device = "/dev/disk/by-uuid/0a4c1234-02d3-4b53-aeca-d95c4c8d534b";
+    fsType = "ext4";
+  };

-  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ "kvm-intel" ];
-  boot.extraModulePackages = [ ];
-
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.ens3.useDHCP = lib.mkDefault true;
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
 }
@@ -2,10 +2,9 @@

 {
  imports = [
-    ./gatus
    ./grafana.nix
    ./loki.nix
    ./prometheus
-    ./scrutiny.nix
+    ./uptime-kuma.nix
  ];
 }
@@ -1,169 +0,0 @@
-{ config, lib, ... }:
-let
-  cfg = config.services.gatus;
-in
-{
-  imports = [
-    ./minecraft-checker.nix
-    ./postgres-checker.nix
-    ./mariadb-checker.nix
-  ];
-
-  services.gatus = {
-    enable = true;
-
-    settings = {
-      web = {
-        address = "127.0.0.1";
-        port = 19283;
-      };
-
-      storage = {
-        type = "sqlite";
-        path = "/var/lib/gatus/data.db";
-      };
-
-      ui = {
-        title = "PVV Nede!?";
-        header = "😭😭😭";
-        dashboard-heading = "PVV Nede!?";
-        dashboard-subheading = "Kan noen ringe drift?";
-      };
-
-      endpoints = let
-        mkMachine = name: {
-          inherit name;
-          group = "Machines";
-          url = "icmp://${name}.pvv.ntnu.no";
-          conditions = [
-            "[CONNECTED] == true"
-          ];
-        };
-
-        mkWebsite = name: url: {
-          inherit name url;
-          group = "Websites";
-          method = "GET";
-          conditions = [
-            "[STATUS] == 200"
-          ];
-        };
-
-        mkService = name: url: {
-          inherit name url;
-          group = "Services";
-          conditions = [
-            "[CONNECTED] == true"
-          ];
-        };
-      in (lib.sortOn (m: m.name) [
-        (mkMachine "ambidextrous")
-        (mkMachine "bekkalokk")
-        (mkMachine "bicep")
-        (mkMachine "bikkje")
-        (mkMachine "brzeczyszczykiewicz")
-        (mkMachine "georg")
-        (mkMachine "gluttony")
-        (mkMachine "ildkule")
-        (mkMachine "kana")
-        (mkMachine "kommode")
-        (mkMachine "lupine-1")
-        (mkMachine "lupine-2")
-        (mkMachine "lupine-3")
-        (mkMachine "lupine-4")
-        (mkMachine "lupine-5")
-        (mkMachine "skrot")
-        (mkMachine "temmie")
-        (mkMachine "wenche")
-
-        (mkMachine "balduzius")
-        (mkMachine "blossom")
-        (mkMachine "bubbles")
-        (mkMachine "buskerud")
-        (mkMachine "buttercup")
-        (mkMachine "demiurgen")
-        (mkMachine "drolsum")
-        (mkMachine "hildring")
-        (mkMachine "innovation")
-        (mkMachine "isvegg")
-        (mkMachine "knutsen")
-        (mkMachine "ludvigsen" // {
-          url = "icmp://ludvigsen-tap.pvv.ntnu.no";
-        })
-        (mkMachine "microbel")
-        (mkMachine "mirage")
-        (mkMachine "orchid")
-        (mkMachine "principal")
-        (mkMachine "sleipner")
-        (mkMachine "smask")
-        (mkMachine "tom")
-        (mkMachine "wegonke")
-      ]) ++ [
-        (mkWebsite "Bluemap" "https://minecraft.pvv.ntnu.no")
-        (mkWebsite "Element Web" "https://chat.pvv.ntnu.no")
-        (mkWebsite "Gitea" "https://git.pvv.ntnu.no/api/healthz" // {
-          conditions = [
-            "[STATUS] == 200"
-            "[BODY].status == pass"
-          ];
-        })
-        (mkWebsite "Grafana" "https://grafana.pvv.ntnu.no/api/health" // {
-          conditions = [
-            "[STATUS] == 200"
-            "[BODY].database == ok"
-          ];
-        })
-        (mkWebsite "Grzegorz - Brzeczyszczykiewicz" "https://brzeczyszczykiewicz.pvv.ntnu.no")
-        (mkWebsite "Grzegorz - Georg" "https://georg.pvv.ntnu.no")
-        (mkWebsite "IDP" "https://idp.pvv.ntnu.no")
-        (mkWebsite "Mailing Lists" "http://list.pvv.ntnu.no")
-        (mkWebsite "Mapcrafter" "http://isvegg.pvv.ntnu.no/kart")
-        (mkWebsite "PVV-Nettsiden" "https://www.pvv.ntnu.no")
-        (mkWebsite "Roundcube" "https://webmail.pvv.ntnu.no/roundcube")
-        (mkWebsite "Scrutiny" "https://scrutiny.pvv.ntnu.no")
-        (mkWebsite "Snappymail" "http://snappymail.pvv.ntnu.no")
-        (mkWebsite "Userweb - Temmie" "https://temmie.pvv.ntnu.no/~oysteikt")
-        (mkWebsite "Userweb - Tom" "https://www.pvv.ntnu.no/~oysteikt")
-        (mkWebsite "Vaultwarden" "https://pw.pvv.ntnu.no/alive")
-        (mkWebsite "Wiki" "https://wiki.pvv.ntnu.no/w/api.php?action=query&format=json")
-
-        (mkService "Gitea SSH" "ssh://git.pvv.ntnu.no:2222")
-        (mkService "QoTD" "tcp://bekkalokk.pvv.ntnu.no:17")
-        (mkService "Minecraft" "http://localhost:1337" // {
-          conditions = [
-            "[STATUS] == 200"
-            "[BODY].ok == true"
-          ];
-        })
-        (mkService "PostgreSQL" "http://localhost:1338" // {
-          conditions = [
-            "[STATUS] == 200"
-            "[BODY].ok == true"
-          ];
-        })
-        (mkService "MariaDB" "http://localhost:1339" // {
-          conditions = [
-            "[STATUS] == 200"
-            "[BODY].ok == true"
-          ];
-        })
-        (mkService "Email (SMTP)" "starttls://mail.pvv.ntnu.no:587")
-        (mkService "Email (POP3)" "tls://mail.pvv.ntnu.no:995")
-        (mkService "Email (IMAP)" "tls://mail.pvv.ntnu.no:993")
-        (mkService "Matrix Synapse" "https://matrix.pvv.ntnu.no/_matrix/client/versions" // {
-          method = "GET";
-          conditions = [
-            "[STATUS] == 200"
-          ];
-        })
-      ];
-    };
-  };
-
-  services.nginx.virtualHosts."status.pvv.ntnu.no" = lib.mkIf cfg.enable {
-    enableACME = true;
-    forceSSL = true;
-    kTLS = true;
-    locations."/".proxyPass = "http://localhost:${toString cfg.settings.web.port}";
-  };
-}
@@ -1,79 +0,0 @@
-{ config, pkgs, ... }:
-{
-  sops.secrets."keys/gatus/mariadb" = {
-    restartUnits = [ "phh-gatus-mariadb-checker.service" ];
-  };
-
-  sops.templates."gatus-mariadb-checker.env" = {
-    restartUnits = [ "phh-gatus-mariadb-checker.service" ];
-    content = ''
-      MYSQL_HOST=mysql.pvv.ntnu.no
-      MYSQL_PORT=3306
-      MYSQL_DATABASE=mysql
-      MYSQL_USER=gatus_healthcheck
-      MYSQL_PASSWORD=${config.sops.placeholder."keys/gatus/mariadb"}
-    '';
-  };
-
-  services.python-http-handlers."gatus-mariadb-checker" = {
-    listenStreams = [ "127.0.0.1:1339" ];
-    libraries = with pkgs.python3Packages; [
-      pymysql
-    ];
-    serviceConfig = {
-      EnvironmentFile = config.sops.templates."gatus-mariadb-checker.env".path;
-    };
-    handler = ''
-      import os
-      import json
-      import pymysql
-
-      class Handler(BaseHTTPRequestHandler):
-          def do_GET(self):
-              try:
-                  conn = pymysql.connect(
-                      host=os.environ["MYSQL_HOST"],
-                      port=int(os.environ.get("MYSQL_PORT", "3306")),
-                      user=os.environ["MYSQL_USER"],
-                      password=os.environ["MYSQL_PASSWORD"],
-                      database=os.environ.get("MYSQL_DATABASE", "mysql"),
-                      connect_timeout=5,
-                  )
-
-                  try:
-                      with conn.cursor() as cur:
-                          cur.execute("SELECT VERSION();")
-                          (version,) = cur.fetchone()
-
-                          cur.execute("SHOW STATUS LIKE 'Threads_connected';")
-                          (_, connections) = cur.fetchone()
-
-                          cur.execute("SHOW DATABASES;")
-                          databases = cur.fetchall()
-                  finally:
-                      conn.close()
-
-                  body = {
-                      "ok": True,
-                      "version": version,
-                      "connections": int(connections),
-                      "databases": len(databases),
-                  }
-                  data = json.dumps(body).encode()
-
-                  self.send_response(200)
-                  self.send_header("Content-Type", "application/json")
-                  self.send_header("Content-Length", str(len(data)))
-                  self.end_headers()
-                  self.wfile.write(data)
-
-              except Exception as e:
-                  data = json.dumps({"ok": False, "error": str(e)}).encode()
-                  self.send_response(500)
-                  self.send_header("Content-Type", "application/json")
-                  self.send_header("Content-Length", str(len(data)))
-                  self.end_headers()
-                  self.wfile.write(data)
-    '';
-  };
-}
@@ -1,40 +0,0 @@
-{ lib, pkgs, ... }:
-{
-  services.python-http-handlers."gatus-minecraft-checker" = {
-    listenStreams = [ "127.0.0.1:1337" ];
-    libraries = with pkgs.python3Packages; [
-      mcstatus
-    ];
-    handler = ''
-      import json
-      from mcstatus import JavaServer
-
-      class Handler(BaseHTTPRequestHandler):
-          def do_GET(self):
-              try:
-                  mcserver = JavaServer.lookup("minecraft.pvv.ntnu.no")
-                  status = mcserver.status()
-
-                  body = {
-                      "ok": True,
-                      "players": status.players.online,
-                      "version": status.version.name,
-                      "latency": status.latency,
-                  }
-
-                  data = json.dumps(body).encode()
-
-                  self.send_response(200)
-                  self.send_header("Content-Type", "application/json")
-                  self.send_header("Content-Length", str(len(data)))
-                  self.end_headers()
-                  self.wfile.write(data)
-
-              except Exception as e:
-                  data = json.dumps({"ok": False, "error": str(e)}).encode()
-                  self.send_response(500)
-                  self.end_headers()
-                  self.wfile.write(data)
-    '';
-  };
-}
@@ -1,79 +0,0 @@
-{ config, pkgs, ... }:
-{
-  sops.secrets."keys/gatus/postgres" = {
-    restartUnits = [ "phh-gatus-postgres-checker.service" ];
-  };
-
-  sops.templates."gatus-postgres-checker.env" = {
-    restartUnits = [ "phh-gatus-postgres-checker.service" ];
-    content = ''
-      PGHOST=postgres.pvv.ntnu.no
-      PGPORT=5432
-      PGDATABASE=postgres
-      PGUSER=gatus_healthcheck
-      PGPASSWORD=${config.sops.placeholder."keys/gatus/postgres"}
-    '';
-  };
-
-  services.python-http-handlers."gatus-postgres-checker" = {
-    listenStreams = [ "127.0.0.1:1338" ];
-    libraries = with pkgs.python3Packages; [
-      psycopg2
-    ];
-    serviceConfig = {
-      EnvironmentFile = config.sops.templates."gatus-postgres-checker.env".path;
-    };
-    handler = ''
-      import os
-      import json
-      import psycopg2
-
-      class Handler(BaseHTTPRequestHandler):
-          def do_GET(self):
-              try:
-                  conn = psycopg2.connect(
-                      host=os.environ["PGHOST"],
-                      port=os.environ.get("PGPORT", "5432"),
-                      dbname=os.environ.get("PGDATABASE", "postgres"),
-                      user=os.environ["PGUSER"],
-                      password=os.environ["PGPASSWORD"],
-                      connect_timeout=5,
-                  )
-
-                  try:
-                      with conn.cursor() as cur:
-                          cur.execute("SELECT version();")
-                          (version,) = cur.fetchone()
-
-                          cur.execute("SELECT count(*) FROM pg_stat_activity;")
-                          (connections,) = cur.fetchone()
-
-                          cur.execute("SELECT count(*) FROM pg_database WHERE NOT datistemplate;")
-                          (databases,) = cur.fetchone()
-                  finally:
-                      conn.close()
-
-                  body = {
-                      "ok": True,
-                      "version": version,
-                      "connections": connections,
-                      "databases": databases,
-                  }
-                  data = json.dumps(body).encode()
-
-                  self.send_response(200)
-                  self.send_header("Content-Type", "application/json")
-                  self.send_header("Content-Length", str(len(data)))
-                  self.end_headers()
-                  self.wfile.write(data)
-
-              except Exception as e:
-                  data = json.dumps({"ok": False, "error": str(e)}).encode()
-                  self.send_response(500)
-                  self.send_header("Content-Type", "application/json")
-                  self.send_header("Content-Length", str(len(data)))
-                  self.end_headers()
-                  self.wfile.write(data)
-    '';
-  };
-}
@@ -68,12 +68,6 @@ in {
          url = "https://grafana.com/api/dashboards/9628/revisions/8/download";
          options.path = dashboards/postgres.json;
        }
-        {
-          name = "PHP-FPM";
-          type = "file";
-          url = "https://grafana.com/api/dashboards/25149/revisions/1/download";
-          options.path = dashboards/php-fpm.json;
-        }
        {
          name = "Gitea Dashboard";
          type = "file";
@@ -1,4 +1,4 @@
-{ config, pkgs, values, ... }:
+{ config, pkgs, ... }:

 let
  cfg = config.services.loki;
@@ -9,8 +9,8 @@ in {
    configuration = {
      auth_enabled = false;
      server = {
-        http_listen_port = 31832;
-        http_listen_address = "127.0.0.1";
+        http_listen_port = 3100;
+        http_listen_address = "0.0.0.0";
        grpc_listen_port = 9096;
      };

@@ -81,25 +81,5 @@ in {
    };
  };

-  services.nginx.virtualHosts."loki.pvv.ntnu.no" = {
-    forceSSL = true;
-    enableACME = true;
-    kTLS = true;
-
-    locations = {
-      "/".return = "403";
-      "/loki/api/v1/push" = {
-        proxyPass = "http://${cfg.configuration.server.http_listen_address}:${toString cfg.configuration.server.http_listen_port}/loki/api/v1/push";
-        extraConfig = ''
-          allow 127.0.0.1;
-          allow ::1;
-          allow ${values.ipv4-space};
-          allow ${values.ipv6-space};
-          allow ${values.ntnu.ipv4-space};
-          allow ${values.ntnu.ipv6-space};
-          deny all;
-        '';
-      };
-    };
-  };
+  networking.firewall.allowedTCPPorts = [ cfg.configuration.server.http_listen_port ];
 }
@@ -7,7 +7,6 @@ in {
    ./machines.nix
    ./matrix-synapse.nix
    ./mysqld.nix
-    ./phpfpm.nix
    ./postgres.nix
  ];

@@ -22,7 +21,6 @@ in {

  fileSystems."/var/lib/prometheus2" = {
    device = stateDir;
-    fsType = "bind";
    options = [ "bind" ];
  };
 }
@@ -1,12 +1,14 @@
 { ... }:
 {
-  services.prometheus.scrapeConfigs = [{
-    job_name = "exim";
-    scrape_interval = "15s";
-    scheme = "http";
-
-    static_configs = [{
-      targets = [ "microbel.pvv.ntnu.no:9636" ];
-    }];
-  }];
+  services.prometheus = {
+    scrapeConfigs = [
+      {
+        job_name = "exim";
+        scrape_interval = "15s";
+        static_configs = [{
+          targets = [ "microbel.pvv.ntnu.no:9636" ];
+        }];
+      }
+    ];
+  };
 }
@@ -6,63 +6,35 @@
    targets = map (port: "${name}.pvv.ntnu.no:${toString port}") ports;
  };

-  nixosMachines = [
-    "ildkule"
-    "bekkalokk"
-    "bicep"
-    "brzeczyszczykiewicz"
-    "georg"
-    "gluttony"
-    "kommode"
-    "lupine-1"
-    "lupine-2"
-    "lupine-3"
-    "lupine-4"
-    "lupine-5"
-    # TODO: export prometheus stats via apache on temmie
-    # "temmie"
-    "wenche"
-  ];
-
  defaultNodeExporterPort = 9100;
+  defaultSystemdExporterPort = 9101;
+  defaultNixosExporterPort = 9102;
 in {
-  services.prometheus.scrapeConfigs = [
-    {
-      job_name = "nixos-node";
-      scheme = "https";
-      metrics_path = "/prometheus-node-exporter/metrics";
-      static_configs = map (name: {
-        labels.hostname = name;
-        targets = [ "${name}.pvv.ntnu.no:443" ];
-      }) nixosMachines;
-    }
-    {
-      job_name = "nixos-systemd";
-      scheme = "https";
-      metrics_path = "/prometheus-systemd-exporter/metrics";
-      static_configs = map (name: {
-        labels.hostname = name;
-        targets = [ "${name}.pvv.ntnu.no:443" ];
-      }) nixosMachines;
-    }
-    {
-      job_name = "nixos-flake-input";
-      scheme = "https";
-      metrics_path = "/prometheus-nixos-flake-input-exporter/metrics";
-      static_configs = map (name: {
-        labels.hostname = name;
-        targets = [ "${name}.pvv.ntnu.no:443" ];
-      }) nixosMachines;
-    }
-    {
-      job_name = "non-nixos-node";
-      scheme = "http";
-      metrics_path = "/metrics";
-      static_configs = [
-        (mkHostScrapeConfig "hildring" [ defaultNodeExporterPort ])
-        (mkHostScrapeConfig "isvegg" [ defaultNodeExporterPort ])
-        (mkHostScrapeConfig "microbel" [ defaultNodeExporterPort ])
-      ];
-    }
-  ];
+  services.prometheus.scrapeConfigs = [{
+    job_name = "base_info";
+    static_configs = [
+      (mkHostScrapeConfig "ildkule" [ cfg.exporters.node.port cfg.exporters.systemd.port defaultNixosExporterPort ])
+
+      (mkHostScrapeConfig "bekkalokk" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
+      (mkHostScrapeConfig "bicep" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
+      (mkHostScrapeConfig "brzeczyszczykiewicz" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
+      (mkHostScrapeConfig "georg" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
+      (mkHostScrapeConfig "gluttony" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
+      (mkHostScrapeConfig "kommode" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
+      (mkHostScrapeConfig "lupine-1" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
+      (mkHostScrapeConfig "lupine-2" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
+      (mkHostScrapeConfig "lupine-3" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
+      (mkHostScrapeConfig "lupine-4" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
+      (mkHostScrapeConfig "lupine-5" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
+      (mkHostScrapeConfig "temmie" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
+      (mkHostScrapeConfig "ustetind" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
+      (mkHostScrapeConfig "wenche" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
+
+      (mkHostScrapeConfig "skrott" [ defaultNodeExporterPort defaultSystemdExporterPort ])
+
+      (mkHostScrapeConfig "hildring" [ defaultNodeExporterPort ])
+      (mkHostScrapeConfig "isvegg" [ defaultNodeExporterPort ])
+      (mkHostScrapeConfig "microbel" [ defaultNodeExporterPort ])
+    ];
+  }];
 }
@@ -1,15 +0,0 @@
-{ ... }:
-{
-  services.prometheus.scrapeConfigs = [{
-    job_name = "phpfpm";
-    scheme = "https";
-    metrics_path = "/prometheus-php-fpm-exporter/metrics";
-
-    static_configs = [
-      {
-        labels.hostname = "bekkalokk";
-        targets = [ "www.pvv.ntnu.no:443" ];
-      }
-    ];
-  }];
-}
@@ -1,40 +0,0 @@
-{ config, values, ... }:
-let
-  cfg = config.services.scrutiny;
-in
-{
-  services.scrutiny = {
-    enable = true;
-    settings = {
-      web.listen = {
-        host = "127.0.0.1";
-        port = 18293;
-        basepath = "";
-      };
-
-      # notify.urls = [
-      #   "matrix://username:password@host:port/[?rooms=!roomID1[,roomAlias2]]"
-      # ];
-    };
-  };
-
-  services.nginx.virtualHosts."scrutiny.pvv.ntnu.no" = {
-    kTLS = true;
-    enableACME = true;
-    forceSSL = true;
-    locations."/" = {
-      proxyPass = "http://${cfg.settings.web.listen.host}:${toString cfg.settings.web.listen.port}";
-    };
-
-    # TODO: allow website access to the outside world, but restrict input api
-    extraConfig = ''
-      allow ${values.hosts.ildkule.ipv4}/32;
-      allow ${values.hosts.ildkule.ipv6}/128;
-      allow 127.0.0.1/32;
-      allow ::1/128;
-      allow ${values.ipv4-space};
-      allow ${values.ipv6-space};
-      deny all;
-    '';
-  };
-}
@@ -0,0 +1,26 @@
+{ config, pkgs, lib, ... }:
+let
+  cfg = config.services.uptime-kuma;
+  domain = "status.pvv.ntnu.no";
+  stateDir = "/data/monitoring/uptime-kuma";
+in {
+  services.uptime-kuma = {
+    enable = true;
+    settings = {
+      PORT = "5059";
+      HOST = "127.0.1.2";
+    };
+  };
+
+  services.nginx.virtualHosts.${domain} = {
+    enableACME = true;
+    forceSSL = true;
+    kTLS = true;
+    locations."/".proxyPass = "http://${cfg.settings.HOST}:${cfg.settings.PORT}";
+  };
+
+  fileSystems."/var/lib/uptime-kuma" = {
+    device = stateDir;
+    options = [ "bind" ];
+  };
+}
@@ -15,6 +15,8 @@
    address = with values.hosts.kommode; [ (ipv4 + "/25") (ipv6 + "/64") ];
  };

+  services.btrfs.autoScrub.enable = true;
+
  services.qemuGuest.enable = true;

  # Don't change (even during upgrades) unless you know what you are doing.
@@ -48,7 +48,6 @@

                # swap.swapfile.size = "4G";
                mountpoint = "/";
-                mountOptions = [ "relatime" ];
              };
            };

@@ -72,52 +72,50 @@ in
      Type = "oneshot";
      User = cfg.user;
      Group = cfg.group;
-      PrivateNetwork = true;
-
-      ExecStart = let
-        logo-svg = fp /assets/logo_blue_regular.svg;
-        logo-png = fp /assets/logo_blue_regular.png;
-
-        extraLinks = pkgs.writeText "gitea-extra-links.tmpl" ''
-          <a class="item" href="https://git.pvv.ntnu.no/Drift/-/projects/4">Tokyo Drift Issues</a>
-        '';
-
-        extraLinksFooter = pkgs.writeText "gitea-extra-links-footer.tmpl" ''
-          <a class="item" href="https://www.pvv.ntnu.no/">PVV</a>
-          <a class="item" href="https://wiki.pvv.ntnu.no/">Wiki</a>
-          <a class="item" href="https://wiki.pvv.ntnu.no/wiki/Tjenester/Kodelager">PVV Gitea Howto</a>
-        '';
-
-        project-labels = (pkgs.formats.yaml { }).generate "gitea-project-labels.yaml" {
-          labels = lib.importJSON ./labels/projects.json;
-        };
-
-        customTemplates = pkgs.runCommandLocal "gitea-templates" {
-          nativeBuildInputs = with pkgs; [
-            coreutils
-            gnused
-          ];
-        } ''
-          # Bigger icons
-          install -Dm444 '${cfg.package.src}/templates/repo/icon.tmpl' "$out/repo/icon.tmpl"
-          sed -i -e 's/24/60/g' "$out/repo/icon.tmpl"
-        '';
-        install = lib.getExe' pkgs.coreutils "install";
-      in [
-        "${install} -Dm444 '${logo-svg}' '${cfg.customDir}/public/assets/img/logo.svg'"
-        "${install} -Dm444 '${logo-png}' '${cfg.customDir}/public/assets/img/logo.png'"
-        "${install} -Dm444 '${./loading.apng}' '${cfg.customDir}/public/assets/img/loading.png'"
-        "${install} -Dm444 '${extraLinks}' '${cfg.customDir}/templates/custom/extra_links.tmpl'"
-        "${install} -Dm444 '${extraLinksFooter}' '${cfg.customDir}/templates/custom/extra_links_footer.tmpl'"
-        "${install} -Dm444 '${project-labels}' '${cfg.customDir}/options/label/project-labels.yaml'"
-
-        "${install} -Dm644 '${./emotes/bruh.png}' '${cfg.customDir}/public/assets/img/emoji/bruh.png'"
-        "${install} -Dm644 '${./emotes/huh.gif}' '${cfg.customDir}/public/assets/img/emoji/huh.png'"
-        "${install} -Dm644 '${./emotes/grr.png}' '${cfg.customDir}/public/assets/img/emoji/grr.png'"
-        "${install} -Dm644 '${./emotes/okiedokie.jpg}' '${cfg.customDir}/public/assets/img/emoji/okiedokie.png'"
-
-        "${lib.getExe pkgs.rsync} -a '${customTemplates}/' '${cfg.customDir}/templates/'"
-      ];
    };
+
+    script = let
+      logo-svg = fp /assets/logo_blue_regular.svg;
+      logo-png = fp /assets/logo_blue_regular.png;
+
+      extraLinks = pkgs.writeText "gitea-extra-links.tmpl" ''
+        <a class="item" href="https://git.pvv.ntnu.no/Drift/-/projects/4">Tokyo Drift Issues</a>
+      '';
+
+      extraLinksFooter = pkgs.writeText "gitea-extra-links-footer.tmpl" ''
+        <a class="item" href="https://www.pvv.ntnu.no/">PVV</a>
+        <a class="item" href="https://wiki.pvv.ntnu.no/">Wiki</a>
+        <a class="item" href="https://wiki.pvv.ntnu.no/wiki/Tjenester/Kodelager">PVV Gitea Howto</a>
+      '';
+
+      project-labels = (pkgs.formats.yaml { }).generate "gitea-project-labels.yaml" {
+        labels = lib.importJSON ./labels/projects.json;
+      };
+
+      customTemplates = pkgs.runCommandLocal "gitea-templates" {
+        nativeBuildInputs = with pkgs; [
+          coreutils
+          gnused
+        ];
+      } ''
+        # Bigger icons
+        install -Dm444 "${cfg.package.src}/templates/repo/icon.tmpl" "$out/repo/icon.tmpl"
+        sed -i -e 's/24/60/g' "$out/repo/icon.tmpl"
+      '';
+    in ''
+      install -Dm444 ${logo-svg} ${cfg.customDir}/public/assets/img/logo.svg
+      install -Dm444 ${logo-png} ${cfg.customDir}/public/assets/img/logo.png
+      install -Dm444 ${./loading.apng} ${cfg.customDir}/public/assets/img/loading.png
+      install -Dm444 ${extraLinks} ${cfg.customDir}/templates/custom/extra_links.tmpl
+      install -Dm444 ${extraLinksFooter} ${cfg.customDir}/templates/custom/extra_links_footer.tmpl
+      install -Dm444 ${project-labels} ${cfg.customDir}/options/label/project-labels.yaml
+
+      install -Dm644 ${./emotes/bruh.png} ${cfg.customDir}/public/assets/img/emoji/bruh.png
+      install -Dm644 ${./emotes/huh.gif} ${cfg.customDir}/public/assets/img/emoji/huh.png
+      install -Dm644 ${./emotes/grr.png} ${cfg.customDir}/public/assets/img/emoji/grr.png
+      install -Dm644 ${./emotes/okiedokie.jpg} ${cfg.customDir}/public/assets/img/emoji/okiedokie.png
+
+      "${lib.getExe pkgs.rsync}" -a "${customTemplates}/" ${cfg.customDir}/templates/
+    '';
  };
 }
@@ -134,14 +134,14 @@ in {
        ALLOW_FORK_INTO_SAME_OWNER = true;
      };
      picture = {
+        DISABLE_GRAVATAR = true;
+        ENABLE_FEDERATED_AVATAR = false;
+
        AVATAR_MAX_FILE_SIZE = 1024 * 1024 * 5;
        # NOTE: go any bigger than this, and gitea will freeze your gif >:(
-        AVATAR_MAX_ORIGIN_SIZE = 1024 * 1024 * 4;
+        AVATAR_MAX_ORIGIN_SIZE = 1024 * 1024 * 2;
      };
      actions.ENABLED = true;
-      webhook.ALLOWED_HOST_LIST = lib.concatStringsSep "," [
-        "external"
-      ];
    };

    dump = {
@@ -196,108 +196,6 @@ in {
    };
  };

-  environment.robots-txt."gitea" = {
-    virtualHost = domain;
-    rules = [
-      {
-        pre_comment = ''
-          Gitea internals
-
-          See these for more information:
-          - https://gitea.com/robots.txt
-          - https://codeberg.org/robots.txt
-        '';
-        User-agent = "*";
-        Disallow = [
-          "/api/*"
-          "/avatars"
-          "/*/*/src/commit/*"
-          "/*/*/commit/*"
-          "/*/*/*/refs/*"
-          "/*/*/*/star"
-          "/*/*/*/watch"
-          "/*/*/labels"
-          "/*/*/activity/*"
-          "/vendor/*"
-          "/swagger.*.json"
-          "/repo/create"
-          "/repo/migrate"
-          "/org/create"
-          "/*/*/fork"
-          "/*/*/watchers"
-          "/*/*/stargazers"
-          "/*/*/forks"
-          "*/.git/"
-          "/*.git"
-          "/*.atom"
-          "/*.rss"
-        ];
-        Crawl-delay = "2";
-      }
-      {
-        pre_comment = "Language Spam";
-        Disallow = "/*?lang=";
-      }
-      {
-        pre_comment = ''
-          AI bots
-
-          Sourced from:
-          - https://www.vg.no/robots.txt
-          - https://codeberg.org/robots.txt
-        '';
-        User-agent = [
-          "AI2Bot"
-          "Ai2Bot-Dolma"
-          "Amazonbot"
-          "Applebot-Extended"
-          "Bytespider"
-          "CCBot"
-          "ChatGPT-User"
-          "Claude-Web"
-          "ClaudeBot"
-          "Crawlspace"
-          "Diffbot"
-          "FacebookBot"
-          "FriendlyCrawler"
-          "GPTBot"
-          "Google-Extended"
-          "ICC-Crawler"
-          "ImagesiftBot"
-          "Kangaroo Bot"
-          "Meta-ExternalAgent"
-          "OAI-SearchBot"
-          "Omgili"
-          "Omgilibot"
-          "PanguBot"
-          "PerplexityBot"
-          "PetalBot"
-          "Scrapy"
-          "SemrushBot-OCOB"
-          "Sidetrade indexer bot"
-          "Timpibot"
-          "VelenPublicWebCrawler"
-          "Webzio-Extended"
-          "YouBot"
-          "anthropic-ai"
-          "cohere-ai"
-          "cohere-training-data-crawler"
-          "facebookexternalhit"
-          "iaskspider/2.0"
-          "img2dataset"
-          "meta-externalagent"
-          "omgili"
-          "omgilibot"
-        ];
-        Disallow = "/";
-        Crawl-delay = "2";
-      }
-      {
-        Sitemap = "https://${domain}/sitemap.xml";
-      }
-    ];
-  };
-
  networking.firewall.allowedTCPPorts = [ sshPort ];

  services.rsync-pull-targets = {
@@ -319,7 +217,7 @@ in {

  systemd.services.gitea-dump = {
    serviceConfig.ExecStart = let
-      args = lib.cli.toCommandLineShellGNU { } {
+      args = lib.cli.toGNUCommandLineShell { } {
        type = cfg.dump.type;

        # This should be declarative on nixos, no need to backup.
@@ -331,11 +229,16 @@ in {
        # Logs are stored in the systemd journal
        skip-log = true;
      };
-    in lib.mkForce "${lib.getExe cfg.package} dump ${args}";
+    in lib.mkForce "${lib.getExe cfg.package} ${args}";

-    # Only keep a single backup file at a time.
-    postStop = ''
-      ${lib.getExe' pkgs.coreutils "mv"} '${cfg.dump.backupDir}'/gitea-dump-*.tar.gz gitea-dump.tar.gz
-    '';
+    # Only keep n backup files at a time
+    postStop = let
+      cu = prog: "'${lib.getExe' pkgs.coreutils prog}'";
+      backupCount = 3;
+    in ''
+      for file in $(${cu "ls"} -t1 '${cfg.dump.backupDir}' | ${cu "sort"} --reverse | ${cu "tail"} -n+${toString (backupCount + 1)}); do
+        ${cu "rm"} "$file"
+      done
+      '';
  };
 }
@@ -38,11 +38,11 @@ in
      Type = "oneshot";
      User = cfg.user;
      PrivateNetwork = true;
-      ExecStart = [
-        "${lib.getExe pkgs.gnupg} --import '${config.sops.secrets."gitea/gpg-signing-key-public".path}'"
-        "${lib.getExe pkgs.gnupg} --import '${config.sops.secrets."gitea/gpg-signing-key-private".path}'"
-      ];
    };
+    script = ''
+      ${lib.getExe pkgs.gnupg} --import ${config.sops.secrets."gitea/gpg-signing-key-public".path}
+      ${lib.getExe pkgs.gnupg} --import ${config.sops.secrets."gitea/gpg-signing-key-private".path}
+    '';
  };

  services.gitea.settings."repository.signing" = {
@@ -50,8 +50,6 @@ in
    SIGNING_NAME = "PVV Git";
    SIGNING_EMAIL = "gitea@git.pvv.ntnu.no";
    INITIAL_COMMIT = "always";
-    MERGES = lib.concatStringsSep "," [ "always" ];
-    CRUD_ACTIONS = lib.concatStringsSep "," [ "always" ];
    WIKI = "always";
  };
 }
@@ -11,9 +11,9 @@ in

  systemd.services.gitea-import-users = lib.mkIf cfg.enable {
    enable = true;
+    preStart=''${pkgs.rsync}/bin/rsync -e "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=$CREDENTIALS_DIRECTORY/ssh-known-hosts -i $CREDENTIALS_DIRECTORY/sshkey" -a pvv@smtp.pvv.ntnu.no:/etc/passwd /run/gitea-import-users/passwd'';
    environment.PASSWD_FILE_PATH = "/run/gitea-import-users/passwd";
    serviceConfig = {
-      ExecStartPre = ''${pkgs.rsync}/bin/rsync -e "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=$CREDENTIALS_DIRECTORY/ssh-known-hosts -i $CREDENTIALS_DIRECTORY/sshkey" -a pvv@smtp.pvv.ntnu.no:/etc/passwd /run/gitea-import-users/passwd'';
      ExecStart = pkgs.writers.writePython3 "gitea-import-users" {
        flakeIgnore = [
          "E501" # Line over 80 chars lol
@@ -53,7 +53,7 @@ in
      Slice = "system-giteaweb.slice";
      Type = "oneshot";
      ExecStart = let
-        args = lib.cli.toCommandLineShellGNU { } {
+        args = lib.cli.toGNUCommandLineShell { } {
          org = "%i";
          token-path = "%d/token";
          api-url = "${giteaCfg.settings.server.ROOT_URL}api/v1";
@@ -5,73 +5,21 @@

    (fp /base)
    ./services/gitea-runner.nix
-  ] ++ lib.optionals (lupineName == "lupine-5") [
-    ./services/openvpn.nix
  ];

  sops.defaultSopsFile = fp /secrets/lupine/lupine.yaml;

-  boot.binfmt.emulatedSystems = [
-    "aarch64-linux"
-    "armv7l-linux"
-    "i686-linux"
-  ];
+  systemd.network.networks."30-enp0s31f6" = values.defaultNetworkConfig // {
+    matchConfig.Name = "enp0s31f6";
+    address = with values.hosts.${lupineName}; [ (ipv4 + "/25") (ipv6 + "/64") ];
+    networkConfig.LLDP = false;
+  };
+  systemd.network.wait-online = {
+    anyInterface = true;
+  };

-  systemd.network = if (lupineName != "lupine-5")
-    then {
-      networks."30-enp0s31f6" =  (values.defaultNetworkConfig // {
-        matchConfig.Name = "enp0s31f6";
-        address = with values.hosts.${lupineName}; [ (ipv4 + "/25") (ipv6 + "/64") ];
-        networkConfig.LLDP = false;
-      });
-
-      wait-online = {
-        anyInterface = true;
-      };
-    }
-    else {
-      netdevs."10-br0".netdevConfig = {
-        Name = "br0";
-        Kind = "bridge";
-      };
-
-      netdevs."20-tap0".netdevConfig = {
-        Name = "tap0";
-        Kind = "tap";
-      };
-
-      networks."10-enp0s31f6" = {
-        matchConfig.Name = "enp0s31f6";
-        bridge = [ "br0" ];
-      };
-
-      networks."20-br0" = {
-        matchConfig.Name = "br0";
-
-        address = with values.hosts.${lupineName}; [
-          (ipv4 + "/25")
-          (ipv6 + "/64")
-          values.services.knutsen-vpn
-        ];
-        networkConfig.LLDP = false;
-
-        dns = ["129.241.0.200" "129.241.0.201" "2001:700:300:1900::200" "2001:700:300:1900::201"];
-        domains = ["pvv.ntnu.no" "pvv.org"];
-        gateway = [values.hosts.gateway values.hosts.gateway6];
-
-        networkConfig.IPv6AcceptRA = "no";
-        DHCP = "no";
-      };
-
-      networks."30-tap0" = {
-        matchConfig.Name = "tap0";
-        bridge = [ "br0" ];
-      };
-
-      wait-online = {
-        anyInterface = true;
-      };
-    };
+  # There are no smart devices
+  services.smartd.enable = false;

  # Don't change (even during upgrades) unless you know what you are doing.
  # See https://search.nixos.org/options?show=system.stateVersion
@@ -1,4 +1,4 @@
-# Do not modify this file!  It was generated by 'nixos-generate-config'
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
 { config, lib, pkgs, modulesPath, ... }:
@@ -1,4 +1,4 @@
-# Do not modify this file!  It was generated by 'nixos-generate-config'
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
 { config, lib, pkgs, modulesPath, ... }:
@@ -1,4 +1,4 @@
-# Do not modify this file!  It was generated by 'nixos-generate-config'
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
 { config, lib, pkgs, modulesPath, ... }:
@@ -39,22 +39,17 @@
        "debian-bullseye-slim:docker://node:current-bullseye-slim"

        "alpine-latest:docker://node:current-alpine"
-        "alpine-3.23:docker://node:current-alpine3.23"
        "alpine-3.22:docker://node:current-alpine3.22"
        "alpine-3.21:docker://node:current-alpine3.21"

        # See https://gitea.com/gitea/runner-images
        "ubuntu-latest:docker://docker.gitea.com/runner-images:ubuntu-latest"
-        "ubuntu-26.04:docker://docker.gitea.com/runner-images:ubuntu-26.04"
-        "ubuntu-resolute:docker://docker.gitea.com/runner-images:ubuntu-26.04"
        "ubuntu-24.04:docker://docker.gitea.com/runner-images:ubuntu-24.04"
        "ubuntu-noble:docker://docker.gitea.com/runner-images:ubuntu-24.04"
        "ubuntu-22.04:docker://docker.gitea.com/runner-images:ubuntu-22.04"
        "ubuntu-jammy:docker://docker.gitea.com/runner-images:ubuntu-22.04"

        "ubuntu-latest-slim:docker://docker.gitea.com/runner-images:ubuntu-latest-slim"
-        "ubuntu-26.04-slim:docker://docker.gitea.com/runner-images:ubuntu-26.04-slim"
-        "ubuntu-resolute-slim:docker://docker.gitea.com/runner-images:ubuntu-26.04-slim"
        "ubuntu-24.04-slim:docker://docker.gitea.com/runner-images:ubuntu-24.04-slim"
        "ubuntu-noble-slim:docker://docker.gitea.com/runner-images:ubuntu-24.04-slim"
        "ubuntu-22.04-slim:docker://docker.gitea.com/runner-images:ubuntu-22.04-slim"
@@ -1,101 +0,0 @@
-{ config, pkgs, lib, values, ... }:
-let
-  renderConfig = attrs: lib.pipe attrs [
-    (lib.filterAttrs (_: value: !(builtins.isNull value || value == false)))
-    (builtins.mapAttrs (_: value:
-      if builtins.isList value then builtins.concatStringsSep " " (map toString value)
-      else if value == true then value
-      else if builtins.any (f: f value) [
-        builtins.isString
-        builtins.isInt
-        builtins.isFloat
-        lib.isPath
-        lib.isDerivation
-      ] then toString value
-      else throw "Unknown value in lupine openvpn config:\n${value}"
-    ))
-    (lib.mapAttrsToList (name: value: if value == true then name else "${name} ${value}"))
-    (builtins.concatStringsSep "\n")
-    (x: x + "\n\n")
-  ];
-in
-{
-  sops.secrets = {
-    "openvpn/ca/crt" = { };
-    "openvpn/server/crt" = { };
-    "openvpn/server/key" = { };
-  };
-
-  services.openvpn.servers."ov-tunnel" = {
-    config = renderConfig {
-      mode = "server";
-
-      # TODO: use aliases
-      local = "0.0.0.0";
-      port = 1194;
-      proto = "udp";
-
-      dev = "tap0";
-      dev-type = "tap";
-
-      script-security = 0;
-
-      ca = config.sops.secrets."openvpn/ca/crt".path;
-      cert = config.sops.secrets."openvpn/server/crt".path;
-      key = config.sops.secrets."openvpn/server/key".path;
-      dh = "none";
-
-      # Maintain a record of client <-> virtual IP address
-      # associations in this file.  If OpenVPN goes down or
-      # is restarted, reconnecting clients can be assigned
-      # the same virtual IP address from the pool that was
-      # previously assigned.
-
-      # ifconfig-pool-persist = ./ipp.txt;
-
-      server-bridge = builtins.concatStringsSep " " [
-        # Gateway
-        "129.241.210.129"
-        # Netmask
-        "255.255.255.128"
-        # Pool start
-        values.services.knutsen-tap
-        # Pool end
-        values.services.ludvigsen-tap
-      ];
-
-      keepalive = "10 120";
-
-      user = "nobody";
-      group = "nobody";
-
-      status = "/var/log/openvpn-status.log";
-
-      client-config-dir = pkgs.writeTextDir "ludvigsen" ''
-        # Sett IP-adr. for tap0 til ludvigsens PVV-addresse.
-        ifconfig-push ${values.services.ludvigsen-tap} 255.255.255.128
-
-        # Hvordan skal man faa dette til aa funke, tro?
-        # ifconfig-ipv6-push 2001:700:300:1900::xxx/64
-
-        # La ludvigsen bruke std. PVV-gateway til all trafikk (unntatt VPN-tunnellen).
-        push "redirect-gateway"
-      '';
-
-      persist-key = true;
-      persist-tun = true;
-
-      tls-version-min = "1.2";
-      tls-version-max = "1.2";
-
-      verb = 5;
-
-      explicit-exit-notify = 1;
-    };
-  };
-
-  networking.firewall = {
-    allowedTCPPorts = [ 1194 ];
-    allowedUDPPorts = [ 1194 ];
-  };
-}
@@ -16,7 +16,6 @@
  fileSystems."/" =
    { device = "/dev/disk/by-uuid/224c45db-9fdc-45d4-b3ad-aaf20b3efa8a";
      fsType = "ext4";
-      options = [ "relatime" ];
    };

  fileSystems."/boot" =
@@ -12,8 +12,6 @@
    ./hardware-configuration.nix
    ./disk-config.nix
    (fp /base)
-
-    ./services/drumknotty.nix
  ];

  boot.consoleLogLevel = 0;
@@ -28,6 +26,33 @@
    ];
  };

+  sops.secrets = {
+    "dibbler/postgresql/password" = {
+      owner = "dibbler";
+      group = "dibbler";
+    };
+  };
+
+  services.dibbler = {
+    enable = true;
+    kioskMode = true;
+    limitScreenWidth = 80;
+    limitScreenHeight = 42;
+
+    settings = {
+      general.quit_allowed = false;
+      database = {
+        type = "postgresql";
+        postgresql = {
+          username = "pvv_vv";
+          dbname = "pvv_vv";
+          host = "postgres.pvv.ntnu.no";
+          password_file = config.sops.secrets."dibbler/postgresql/password".path;
+        };
+      };
+    };
+  };
+
  systemd.services."serial-getty@ttyUSB0" = lib.mkIf (!config.virtualisation.isVmVariant) {
    enable = true;
    wantedBy = [ "getty.target" ]; # to start at boot
@@ -31,7 +31,6 @@
                type = "filesystem";
                format = "ext4";
                mountpoint = "/";
-                mountOptions = [ "relatime" ];
              };
            };
          };
@@ -1,57 +0,0 @@
-{ config, ... }:
-{
-  sops.secrets = {
-    "dibbler/postgresql/password" = {
-      owner = "drumknotty";
-      group = "drumknotty";
-    };
-    "worblehat/postgresql/password" = {
-      owner = "drumknotty";
-      group = "drumknotty";
-    };
-  };
-
-  services.drumknotty = {
-    enable = true;
-    kioskMode = true;
-
-    screen = {
-      limitWidth = 80;
-      limitHeight = 42;
-    };
-
-    dibbler = {
-      enable = true;
-      settings = {
-        general.quit_allowed = false;
-        database = {
-          type = "postgresql";
-          postgresql = {
-            username = "pvv_vv";
-            dbname = "pvv_vv";
-            host = "postgres.pvv.ntnu.no";
-            password_file = config.sops.secrets."dibbler/postgresql/password".path;
-          };
-        };
-      };
-    };
-
-    worblehat = {
-      enable = true;
-      settings = {
-        general.quit_allowed = false;
-        database = {
-          type = "postgresql";
-          postgresql = {
-            username = "worblehat";
-            dbname = "worblehat";
-            host = "postgres.pvv.ntnu.no";
-            password = config.sops.secrets."worblehat/postgresql/password".path;
-          };
-        };
-      };
-    };
-  };
-
-  services.roowho2.settings.rwhod.ignoreUsers = [ "drumknotty" ];
-}
@@ -0,0 +1,112 @@
+{ config, pkgs, lib, modulesPath, fp, values, ... }: {
+  imports = [
+    (modulesPath + "/profiles/perlless.nix")
+
+    (fp /base)
+  ];
+
+  # Disable import of a bunch of tools we don't need from nixpkgs.
+  disabledModules = [ "profiles/base.nix" ];
+
+  sops.defaultSopsFile = fp /secrets/skrott/skrott.yaml;
+
+  boot = {
+    consoleLogLevel = 0;
+    enableContainers = false;
+    loader.grub.enable = false;
+    loader.systemd-boot.enable = false;
+    kernelPackages = pkgs.linuxPackages;
+  };
+
+  hardware = {
+    enableAllHardware = lib.mkForce false;
+    firmware = [ pkgs.raspberrypiWirelessFirmware ];
+  };
+
+  # Now turn off a bunch of stuff lol
+  # TODO: can we reduce further?
+  # See also https://nixcademy.com/posts/minimizing-nixos-images/
+  system.autoUpgrade.enable = lib.mkForce false;
+  services.irqbalance.enable = lib.mkForce false;
+  services.logrotate.enable = lib.mkForce false;
+  services.nginx.enable = lib.mkForce false;
+  services.postfix.enable = lib.mkForce false;
+  services.smartd.enable = lib.mkForce false;
+  services.udisks2.enable = lib.mkForce false;
+  services.thermald.enable = lib.mkForce false;
+  services.promtail.enable = lib.mkForce false;
+  # There aren't really that many firmware updates for rbpi3 anyway
+  services.fwupd.enable = lib.mkForce false;
+
+  documentation.enable = lib.mkForce false;
+
+  environment.enableAllTerminfo = lib.mkForce false;
+
+  programs.neovim.enable = lib.mkForce false;
+  programs.zsh.enable = lib.mkForce false;
+  programs.git.package = pkgs.gitMinimal;
+
+  nix.registry = lib.mkForce { };
+  nix.nixPath = lib.mkForce [ ];
+
+  sops.secrets = {
+    "dibbler/postgresql/password" = {
+      owner = "dibbler";
+      group = "dibbler";
+    };
+  };
+
+  # zramSwap.enable = true;
+
+  networking = {
+    hostName = "skrott";
+    defaultGateway = values.hosts.gateway;
+    defaultGateway6 = values.hosts.gateway6;
+    interfaces.eth0 = {
+      useDHCP = false;
+      ipv4.addresses = [{
+        address = values.hosts.skrott.ipv4;
+        prefixLength = 25;
+      }];
+      ipv6.addresses = [{
+        address = values.hosts.skrott.ipv6;
+        prefixLength = 25;
+      }];
+    };
+  };
+
+  services.dibbler = {
+    enable = true;
+    kioskMode = true;
+    limitScreenWidth = 80;
+    limitScreenHeight = 42;
+
+    settings = {
+      general.quit_allowed = false;
+      database = {
+        type = "postgresql";
+        postgresql = {
+          username = "pvv_vv";
+          dbname = "pvv_vv";
+          host = "postgres.pvv.ntnu.no";
+          password_file = config.sops.secrets."dibbler/postgresql/password".path;
+        };
+      };
+    };
+  };
+
+  # https://github.com/NixOS/nixpkgs/issues/84105
+  boot.kernelParams = lib.mkIf (!config.virtualisation.isVmVariant) [
+    "console=ttyUSB0,9600"
+    # "console=tty1" # Already part of the module
+  ];
+  systemd.services."serial-getty@ttyUSB0" = lib.mkIf (!config.virtualisation.isVmVariant) {
+    enable = true;
+    wantedBy = [ "getty.target" ]; # to start at boot
+    serviceConfig.Restart = "always"; # restart when session is closed
+  };
+
+  # Don't change (even during upgrades) unless you know what you are doing.
+  # See https://search.nixos.org/options?show=system.stateVersion
+  system.stateVersion = "25.11";
+}
@@ -6,7 +6,7 @@
    (fp /base)

    ./services/nfs-mounts.nix
-    ./services/userweb
+    ./services/userweb.nix
  ];

  systemd.network.networks."30-ens18" = values.defaultNetworkConfig // {
--- a/Show More
+++ b/Show More