WIP

flake.lock: bump minecraft-kartverket
2025-12-16 17:49:23 +01:00 · 2025-12-17 01:48:32 +09:00
154 changed files with 26021 additions and 15984 deletions
--- a/.gitea/workflows/build-topology-graph.yml
+++ b/.gitea/workflows/build-topology-graph.yml
@@ -1,32 +0,0 @@
 name: "Build topology graph"
 on:
  push:
    branches:
      - main
 jobs:
  evals:
    runs-on: debian-latest
    steps:
    - uses: actions/checkout@v6
    - name: Install sudo
      run: apt-get update && apt-get -y install sudo
    - uses: https://github.com/cachix/install-nix-action@v31
    - name: Configure Nix
      run: echo -e "show-trace = true\nmax-jobs = auto\ntrusted-users = root\nexperimental-features = nix-command flakes\nbuild-users-group =" > /etc/nix/nix.conf
    - name: Build topology graph
      run: nix build .#topology -L
    - name: Upload topology graph
      uses: https://git.pvv.ntnu.no/Projects/rsync-action@v2
      with:
        source: result/*.svg
        quote-source: false
        target: ${{ gitea.ref_name }}/topology_graph/
        username: gitea-web
        ssh-key: ${{ secrets.WEB_SYNC_SSH_KEY }}
        host: pages.pvv.ntnu.no
        known-hosts: "pages.pvv.ntnu.no ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH2QjfFB+city1SYqltkVqWACfo1j37k+oQQfj13mtgg"
--- a/.mailmap
+++ b/.mailmap
@@ -23,9 +23,3 @@ Adrian Gunnar Lauterer <adriangl@pvv.ntnu.no> Adrian Gunnar Lauterer <adrian@lau
 Fredrik Robertsen <frero@pvv.ntnu.no> frero <frero@pvv.ntnu.no>
 Fredrik Robertsen <frero@pvv.ntnu.no> fredrikr79 <fredrikrobertsen7@gmail.com>
 Fredrik Robertsen <frero@pvv.ntnu.no> fredrik <fredrikr79@pm.me>
 Vegard Bieker Matthey <vegardbm@pvv.ntnu.no> Vegard Matthey <VegardMatthey@protonmail.com>
 Vegard Bieker Matthey <vegardbm@pvv.ntnu.no> Vegard Bieker Matthey <VegardMatthey@protonmail.com>
 Albert Bayazidi <albertba@pvv.ntnu.no> Albert <albert.bayazidi@gmail.com>
--- a/.sops.yaml
+++ b/.sops.yaml
@@ -1,40 +1,38 @@
 keys:
  # Users
  - &user_danio age1ug30gg4y7ftuya0wdv7q0vh4egn00wlv2th7mt7cgc2ze46wmvyq9lq6ge
  - &user_eirikwit age1ju7rd26llahz3g8tz7cy5ld52swj8gsmg0flrmrxngc0nj0avq3ssh0sn5
  - &user_felixalb age1mrnldl334l2nszuta6ywvewng0fswv2dz9l5g4qcwe3nj4yxf92qjskdx6
  - &user_oysteikt F7D37890228A907440E1FD4846B9228E814A2AAC
-  - &user_pederbs_bjarte age1zhxul786an743u0fascv4wtc5xduu7qfy803lfs539yzhgmlq5ds2lznt5
+  - &user_eirikwit age1ju7rd26llahz3g8tz7cy5ld52swj8gsmg0flrmrxngc0nj0avq3ssh0sn5
  - &user_pederbs_nord age1wrssr4z4g6vl3fd3qme5cewchmmhm0j2xe6wf2meu4r6ycn37anse98mfs
  - &user_pederbs_sopp age1hmpdk4h69wxpwqk9tkud39f66hprhehxtzhgw97r6dvr7v0mx5jscsuhkn
-  - &user_vegardbm age1sqs7urnzsdy64efmd0zukzv3gs5pnjksuxd7nqmdwdy5l0nqnunq6hyune
+  - &user_pederbs_nord age1wrssr4z4g6vl3fd3qme5cewchmmhm0j2xe6wf2meu4r6ycn37anse98mfs
  - &user_pederbs_bjarte age1zhxul786an743u0fascv4wtc5xduu7qfy803lfs539yzhgmlq5ds2lznt5
  # Hosts
-  - &host_bakke age1syted6kt48sumjjucggh6r3uca4x2ppp4mfungf3lamkt2le05csc99633
+  - &host_jokum age1gp8ye4g2mmw3may5xg0zsy7mm04glfz3788mmdx9cvcsdxs9hg0s0cc9kt
  - &host_ildkule age1x28hmzvuv6f2n66c0jtqcca3h9rput8d7j5uek6jcpx8n9egd52sqpejq0
  - &host_bekkalokk age12nj59tguy9wg882updc2vjdusx5srnxmjyfaqve4zx6jnnsaw3qsyjq6zd
  - &host_bicep age19nk55kcs7s0358jpkn75xnr57dfq6fq3p43nartvsprx0su22v7qcgcjdx
-  - &host_ildkule age1x28hmzvuv6f2n66c0jtqcca3h9rput8d7j5uek6jcpx8n9egd52sqpejq0
+  - &host_ustetind age1hffjafs4slznksefmtqrlj7rdaqgzqncn4un938rhr053237ry8s3rs0v8
  - &host_kommode age1mt4d0hg5g76qp7j0884llemy0k2ymr5up8vfudz6vzvsflk5nptqqd32ly
  - &host_lupine-1 age1fkrypl6fu4ldsa7te4g3v4qsegnk7sd6qhkquuwzh04vguy96qus08902e
  - &host_lupine-2 age1mu0ej57n4s30ghealhyju3enls83qyjua69986la35t2yh0q2s0seruz5n
  - &host_lupine-3 age1j2u876z8hu87q5npfxzzpfgllyw8ypj66d7cgelmzmnrf3xud34qzkntp9
  - &host_lupine-4 age1t8zlawqkmhye737pn8yx0z3p9cl947d9ktv2cajdc6hnvn52d3fsc59s2k
  - &host_lupine-5 age199zkqq4jp4yc3d0hx2q0ksxdtp42xhmjsqwyngh8tswuck34ke3smrfyqu
  - &host_skrott age1lpkju2e053aaddpgsr4ef83epclf4c9tp4m98d35ft2fswr8p4tq2ua0mf
  - &host_ustetind age1hffjafs4slznksefmtqrlj7rdaqgzqncn4un938rhr053237ry8s3rs0v8
 creation_rules:
  # Global secrets
  - path_regex: secrets/[^/]+\.yaml$
    key_groups:
    - age:
      - *host_jokum
      - *user_danio
      - *user_felixalb
      - *user_eirikwit
      - *user_pederbs_sopp
      - *user_pederbs_nord
      - *user_pederbs_bjarte
      - *user_vegardbm
      pgp:
      - *user_oysteikt
@@ -49,7 +47,6 @@ creation_rules:
      - *user_pederbs_sopp
      - *user_pederbs_nord
      - *user_pederbs_bjarte
      - *user_vegardbm
      pgp:
      - *user_oysteikt
@@ -62,7 +59,18 @@ creation_rules:
      - *user_pederbs_sopp
      - *user_pederbs_nord
      - *user_pederbs_bjarte
-      - *user_vegardbm
+      pgp:
      - *user_oysteikt
  - path_regex: secrets/jokum/[^/]+\.yaml$
    key_groups:
    - age:
      - *host_jokum
      - *user_danio
      - *user_felixalb
      - *user_pederbs_sopp
      - *user_pederbs_nord
      - *user_pederbs_bjarte
      pgp:
      - *user_oysteikt
@@ -75,7 +83,6 @@ creation_rules:
      - *user_pederbs_sopp
      - *user_pederbs_nord
      - *user_pederbs_bjarte
      - *user_vegardbm
      pgp:
      - *user_oysteikt
@@ -88,7 +95,6 @@ creation_rules:
      - *user_pederbs_sopp
      - *user_pederbs_nord
      - *user_pederbs_bjarte
      - *user_vegardbm
      pgp:
      - *user_oysteikt
@@ -101,7 +107,6 @@ creation_rules:
      - *user_pederbs_sopp
      - *user_pederbs_nord
      - *user_pederbs_bjarte
      - *user_vegardbm
      pgp:
      - *user_oysteikt
@@ -118,32 +123,5 @@ creation_rules:
      - *user_pederbs_sopp
      - *user_pederbs_nord
      - *user_pederbs_bjarte
      - *user_vegardbm
      pgp:
      - *user_oysteikt
  - path_regex: secrets/bakke/[^/]+\.yaml$
    key_groups:
    - age:
      - *host_bakke
      - *user_danio
      - *user_felixalb
      - *user_pederbs_sopp
      - *user_pederbs_nord
      - *user_pederbs_bjarte
      - *user_vegardbm
      pgp:
      - *user_oysteikt
  - path_regex: secrets/skrott/[^/]+\.yaml$
    key_groups:
    - age:
      - *host_skrott
      - *user_danio
      - *user_felixalb
      - *user_pederbs_sopp
      - *user_pederbs_nord
      - *user_pederbs_bjarte
      - *user_vegardbm
      pgp:
      - *user_oysteikt
--- a/README.MD
+++ b/README.MD
@@ -0,0 +1,61 @@
 # PVV NixOS configs
 ## Hvordan endre på ting
 Før du endrer på ting husk å ikke putte ting som skal være hemmelig uten å først lese seksjonen for hemmeligheter!
 Etter å ha klonet prosjektet ned og gjort endringer kan du evaluere configene med:
 `nix flake check --keep-going`
 før du bygger en maskin med:
 `nix build .#<maskinnavn>`
 hvis du vil være ekstra sikker på at alt bygger så kan du kjøre:
 `nix build .` for å bygge alle de viktige maskinene.
 NB: Dette kan ta opp til 30 minutter avhengig av hva som ligger i caches
 Husk å hvertfall stage nye filer om du har laget dem!
 Om alt bygger fint commit det og push til git repoet.
 Det er sikkert lurt å lage en PR først om du ikke er vandt til nix enda.
 Innen 24h skal alle systemene hente ned den nye konfigurasjonen og deploye den.
 Du kan tvinge en maskin til å oppdatere seg før dette ved å kjøre:
 `nixos-rebuild switch --update-input nixpkgs --update-input nixpkgs-unstable --no-write-lock-file --refresh --upgrade --flake git+https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git`
 som root på maskinen.
 Hvis du ikke har lyst til å oppdatere alle pakkene (og kanskje måtte vente en stund!) kan du kjøre
 `nixos-rebuild switch --override-input nixpkgs nixpkgs --override-input nixpkgs-unstable nixpkgs-unstable --flake git+https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git`
 ## Seksjonen for hemmeligheter
 For at hemmeligheter ikke skal deles med hele verden i git - eller å være world
 readable i nix-storen, bruker vi [sops-nix](https://github.com/Mic92/sops-nix)
 For å legge til secrets kan du kjøre f.eks. `sops secrets/jokum/jokum.yaml`
 Dette vil dekryptere filen og gi deg en text-editor du kan bruke for endre hemmelighetene.
 Et nix shell med dette verktøyet inkludert ligger i flaket og shell.nix og kan aktiveres med:
 `nix-shell` eller `nix develop`. Vi anbefaler det siste.
 I tilegg kan du sette opp [direnv](https://direnv.net/) slik at dette skjer automatisk
 for å få tilgang til å lese/skrive hemmeligheter må du spørre noen/noe som har tilgang til hemmelighetene
 om å legge til age eller pgp nøkkelen din i [`.sops.yaml`](https://git.pvv.ntnu.no/Drift/pvv-nixos-config/src/main/.sops.yaml)
 Denne kan du generere fra ssh-nøkkelene dine eller lage en egen nøkkel.
 ### Legge til flere keys
 Gjør det som gir mening i .sops.yml
 Etter det kjør `sops updatekeys secrets/host/file.yml`
 MERK at det ikke er `sops -r` som BARE roterer nøkklene for de som allerede er i secretfila
--- a/README.md
+++ b/README.md
@@ -1,64 +0,0 @@
 # PVV NixOS config
 This repository contains the NixOS configurations for Programvareverkstedet's server closet.
 In addition to machine configurations, it also contains a bunch of shared modules, packages, and
 more.
 > [!WARNING]
 > Please read [Development - working on the PVV machines](./docs/development.md) before making
 > any changes, and [Secret management and `sops-nix`](./docs/secret-management.md) before adding
 > any credentials such as passwords, API tokens, etc. to the configuration.
 ## Deploying to machines
 > [!WARNING]
 > Be careful to think about state when testing changes against the machines. Sometimes, a certain change
 > can lead to irreversible changes to the data stored on the machine. An example would be a set of database
 > migrations applied when testing a newer version of a service. Unless that service also comes with downwards
 > migrations, you can not go back to the previous version without losing data.
 To deploy the changes to a machine, you should first SSH into the machine, and clone the pvv-nixos-config
 repository unless you have already done so. After that, checkout the branch you want to deploy from, and rebuild:
 ```bash
 # Run this while in the pvv-nixos-config directory
 sudo nixos-rebuild switch --update-input nixpkgs --update-input nixpkgs-unstable --no-write-lock-file --refresh --flake .# --upgrade
 ```
 This will rebuild the NixOS system on the current branch and switch the system configuration to reflect the new changes.
 Note that unless you eventually merge the current changes into `main`, the machine will rebuild itself automatically and
 revert the changes on the next nightly rebuild (tends to happen when everybody is asleep).
 ## Machine overview
 | Name                       | Type     | Description                                               |
 |----------------------------|----------|-----------------------------------------------------------|
 | [bekkalokk][bek]           | Physical | Our main web host, webmail, wiki, idp, minecraft map, ... |
 | [bicep][bic]               | Virtual  | Database host, matrix, git mirrors, ...                   |
 |  bikkje                    | Virtual  | Experimental login box                                    |
 | [brzeczyszczykiewicz][brz] | Physical | Shared music player                                       |
 | [georg][geo]               | Physical | Shared music player                                       |
 | [ildkule][ild]             | Virtual  | Logging and monitoring host, prometheus, grafana, ...     |
 | [kommode][kom]             | Virtual  | Gitea + Gitea pages                                       |
 | [lupine][lup]              | Physical | Gitea CI/CD runners                                       |
 |  shark                     | Virtual  | Test host for authentication, absolutely horrendous       |
 | [skrott][skr]              | Physical | Kiosk, snacks and soda                                    |
 | [wenche][wen]              | Virtual  | Nix-builders, general purpose compute                     |
 ## Documentation
 - [Development - working on the PVV machines](./docs/development.md)
 - [Miscellaneous development notes](./docs/development-misc.md)
 - [User management](./docs/users.md)
 - [Secret management and `sops-nix`](./docs/secret-management.md)
 [bek]: https://wiki.pvv.ntnu.no/wiki/Maskiner/bekkalokk
 [bic]: https://wiki.pvv.ntnu.no/wiki/Maskiner/bicep
 [brz]: https://wiki.pvv.ntnu.no/wiki/Maskiner/brzęczyszczykiewicz
 [geo]: https://wiki.pvv.ntnu.no/wiki/Maskiner/georg
 [ild]: https://wiki.pvv.ntnu.no/wiki/Maskiner/ildkule
 [kom]: https://wiki.pvv.ntnu.no/wiki/Maskiner/kommode
 [lup]: https://wiki.pvv.ntnu.no/wiki/Maskiner/lupine
 [skr]: https://wiki.pvv.ntnu.no/wiki/Maskiner/Skrott
 [wen]: https://wiki.pvv.ntnu.no/wiki/Maskiner/wenche
--- a/base/default.nix
+++ b/base/default.nix
@@ -10,31 +10,23 @@
    (fp /users)
    (fp /modules/snakeoil-certs.nix)
    ./flake-input-exporter.nix
    ./networking.nix
    ./nix.nix
    ./programs.nix
    ./sops.nix
    ./vm.nix
    ./flake-input-exporter.nix
    ./services/acme.nix
    ./services/uptimed.nix
    ./services/auto-upgrade.nix
    ./services/dbus.nix
    ./services/fwupd.nix
    ./services/irqbalance.nix
    ./services/journald-upload.nix
    ./services/logrotate.nix
    ./services/nginx.nix
    ./services/openssh.nix
    ./services/polkit.nix
    ./services/postfix.nix
    ./services/prometheus-node-exporter.nix
    ./services/prometheus-systemd-exporter.nix
    ./services/promtail.nix
    ./services/roowho2.nix
    ./services/smartd.nix
    ./services/thermald.nix
    ./services/uptimed.nix
    ./services/userborn.nix
    ./services/userdbd.nix
  ];
@@ -42,9 +34,6 @@
  boot.tmp.cleanOnBoot = lib.mkDefault true;
  boot.kernelPackages = lib.mkDefault pkgs.linuxPackages_latest;
  boot.loader.systemd-boot.enable = lib.mkDefault true;
  boot.loader.efi.canTouchEfiVariables = lib.mkDefault true;
  time.timeZone = "Europe/Oslo";
  i18n.defaultLocale = "en_US.UTF-8";
@@ -53,8 +42,21 @@
    keyMap = "no";
  };
-  # Don't install the /lib/ld-linux.so.2 stub
+  environment.systemPackages = with pkgs; [
-  environment.ldso32 = null;
+    file
    git
    gnupg
    htop
    nano
    ripgrep
    rsync
    screen
    tmux
    vim
    wget
    kitty.terminfo
  ];
  # .bash_profile already works, but lets also use .bashrc like literally every other distro
  # https://man.archlinux.org/man/core/bash/bash.1.en#INVOCATION
@@ -68,6 +70,8 @@
    fi
  '';
  programs.zsh.enable = true;
  # security.lockKernelModules = true;
  security.protectKernelImage = true;
  security.sudo.execWheelOnly = true;
@@ -75,14 +79,6 @@
    Defaults lecture = never
  '';
  # These are servers, sleep is for the weak
  systemd.sleep.extraConfig = lib.mkDefault ''
    AllowSuspend=no
    AllowHibernation=no
  '';
  # users.mutableUsers = lib.mkDefault false;
  users.groups."drift".name = "drift";
  # Trusted users on the nix builder machines
--- a/base/flake-input-exporter.nix
+++ b/base/flake-input-exporter.nix
@@ -45,8 +45,8 @@ in
      allow ${values.hosts.ildkule.ipv6}/128;
      allow 127.0.0.1/32;
      allow ::1/128;
-      allow ${values.ipv4-space};
+      allow 129.241.210.128/25;
-      allow ${values.ipv6-space};
+      allow 2001:700:300:1900::/64;
      deny all;
    '';
  };
--- a/base/nix.nix
+++ b/base/nix.nix
@@ -37,9 +37,4 @@
      "unstable=${inputs.nixpkgs-unstable}"
    ];
  };
  # Make builds to be more likely killed than important services.
  # 100 is the default for user slices and 500 is systemd-coredumpd@
  # We rather want a build to be killed than our precious user sessions as builds can be easily restarted.
  systemd.services.nix-daemon.serviceConfig.OOMScoreAdjust = lib.mkDefault 250;
 }
--- a/base/programs.nix
+++ b/base/programs.nix
@@ -1,68 +0,0 @@
 { pkgs, lib, ... }:
 {
  # We don't need fonts on headless machines
  fonts.fontconfig.enable = lib.mkDefault false;
  # Extra packags for better terminal emulator compatibility in SSH sessions
  environment.enableAllTerminfo = true;
  environment.systemPackages = with pkgs; [
    # Debug dns outside resolvectl
    dig
    # Debug and find files
    file
    # Process json data
    jq
    # Check computer specs
    lshw
    # Check who is keeping open files
    lsof
    # Scan for open ports with netstat
    net-tools
    # Grep for files quickly
    ripgrep
    # Copy files over the network
    rsync
    # Access various state, often in /var/lib
    sqlite-interactive
    # Debug software which won't debug itself
    strace
    # Download files from the internet
    wget
  ];
  # Clone/push nix config and friends
  programs.git.enable = true;
  # Gitea gpg, oysteikt sops, etc.
  programs.gnupg.agent.enable = true;
  # Monitor the wellbeing of the machines
  programs.htop.enable = true;
  # Keep sessions running during work over SSH
  programs.tmux.enable = true;
  # Same reasoning as tmux
  programs.screen.enable = true;
  # Edit files on the system without resorting to joe(1)
  programs.nano.enable = true;
  # Same reasoning as nano
  programs.vim.enable = true;
  # Same reasoning as vim
  programs.neovim.enable = true;
  # Some people like this shell for some reason
  programs.zsh.enable = true;
 }
--- a/base/services/acme.nix
+++ b/base/services/acme.nix
@@ -8,6 +8,8 @@
  # Let's not spam LetsEncrypt in `nixos-rebuild build-vm` mode:
  virtualisation.vmVariant = {
    security.acme.defaults.server = "https://127.0.0.1";
    security.acme.preliminarySelfsigned = true;
    users.users.root.initialPassword = "root";
  };
 }
--- a/base/services/auto-upgrade.nix
+++ b/base/services/auto-upgrade.nix
@@ -9,8 +9,6 @@ in
    enable = true;
    flake = "git+https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git";
    flags = [
      "-L"
      "--refresh"
      "--no-write-lock-file"
      # --update-input is deprecated since nix 2.22, and removed in lix 2.90
@@ -28,7 +26,7 @@ in
  # workaround for https://github.com/NixOS/nix/issues/6895
  # via https://git.lix.systems/lix-project/lix/issues/400
-  environment.etc = lib.mkIf (!config.virtualisation.isVmVariant && config.system.autoUpgrade.enable) {
+  environment.etc = lib.mkIf (!config.virtualisation.isVmVariant) {
    "current-system-flake-inputs.json".source
      = pkgs.writers.writeJSON "flake-inputs.json" (
        lib.flip lib.mapAttrs inputs (name: input:
--- a/base/services/journald-upload.nix
+++ b/base/services/journald-upload.nix
@@ -1,24 +0,0 @@
 { config, lib, values, ... }:
 let
  cfg = config.services.journald.upload;
 in
 {
  services.journald.upload = {
    enable = lib.mkDefault true;
    settings.Upload = {
      # URL = "https://journald.pvv.ntnu.no:${toString config.services.journald.remote.port}";
      URL = "https://${values.hosts.ildkule.ipv4}:${toString config.services.journald.remote.port}";
      ServerKeyFile = "-";
      ServerCertificateFile = "-";
      TrustedCertificateFile = "-";
    };
  };
  systemd.services."systemd-journal-upload".serviceConfig = lib.mkIf cfg.enable {
    IPAddressDeny = "any";
    IPAddressAllow = [
      values.hosts.ildkule.ipv4
      values.hosts.ildkule.ipv6
    ];
  };
 }
--- a/base/services/nginx.nix
+++ b/base/services/nginx.nix
@@ -39,38 +39,10 @@
    SystemCallFilter = lib.mkForce null;
  };
-  services.nginx.virtualHosts = lib.mkIf config.services.nginx.enable {
+  services.nginx.virtualHosts."_" = lib.mkIf config.services.nginx.enable {
-    "_" = {
+    sslCertificate = "/etc/certs/nginx.crt";
-      listen = [
+    sslCertificateKey = "/etc/certs/nginx.key";
-        {
+    addSSL = true;
-          addr = "0.0.0.0";
+    extraConfig = "return 444;";
          extraParameters = [
            "default_server"
            # Seemingly the default value of net.core.somaxconn
            "backlog=4096"
            "deferred"
          ];
        }
        {
          addr = "[::0]";
          extraParameters = [
            "default_server"
            "backlog=4096"
            "deferred"
          ];
        }
      ];
      sslCertificate = "/etc/certs/nginx.crt";
      sslCertificateKey = "/etc/certs/nginx.key";
      addSSL = true;
      extraConfig = "return 444;";
    };
    ${config.networking.fqdn} = {
      sslCertificate = lib.mkDefault "/etc/certs/nginx.crt";
      sslCertificateKey = lib.mkDefault "/etc/certs/nginx.key";
      addSSL = lib.mkDefault true;
      extraConfig = lib.mkDefault "return 444;";
    };
  };
 }
--- a/base/services/polkit.nix
+++ b/base/services/polkit.nix
@@ -1,15 +0,0 @@
 { config, lib, ... }:
 let
  cfg = config.security.polkit;
 in
 {
  security.polkit.enable = true;
  environment.etc."polkit-1/rules.d/9-nixos-overrides.rules".text = lib.mkIf cfg.enable ''
    polkit.addAdminRule(function(action, subject) {
        if(subject.isInGroup("wheel")) {
            return ["unix-user:"+subject.user];
        }
    });
  '';
 }
--- a/base/services/prometheus-node-exporter.nix
+++ b/base/services/prometheus-node-exporter.nix
@@ -1,23 +0,0 @@
 { config, lib, values, ... }:
 let
  cfg = config.services.prometheus.exporters.node;
 in
 {
  services.prometheus.exporters.node = {
    enable = lib.mkDefault true;
    port = 9100;
    enabledCollectors = [ "systemd" ];
  };
  systemd.services.prometheus-node-exporter.serviceConfig = lib.mkIf cfg.enable {
    IPAddressDeny = "any";
    IPAddressAllow = [
      "127.0.0.1"
      "::1"
      values.hosts.ildkule.ipv4
      values.hosts.ildkule.ipv6
    ];
  };
  networking.firewall.allowedTCPPorts = lib.mkIf cfg.enable [ cfg.port ];
 }
--- a/base/services/prometheus-systemd-exporter.nix
+++ b/base/services/prometheus-systemd-exporter.nix
@@ -1,26 +0,0 @@
 { config, lib, values, ... }:
 let
  cfg = config.services.prometheus.exporters.systemd;
 in
 {
  services.prometheus.exporters.systemd = {
    enable = lib.mkDefault true;
    port = 9101;
    extraFlags = [
      "--systemd.collector.enable-restart-count"
      "--systemd.collector.enable-ip-accounting"
    ];
  };
  systemd.services.prometheus-systemd-exporter.serviceConfig = {
    IPAddressDeny = "any";
    IPAddressAllow = [
      "127.0.0.1"
      "::1"
      values.hosts.ildkule.ipv4
      values.hosts.ildkule.ipv6
    ];
  };
  networking.firewall.allowedTCPPorts = lib.mkIf cfg.enable [ cfg.port ];
 }
--- a/base/services/promtail.nix
+++ b/base/services/promtail.nix
@@ -1,38 +0,0 @@
 { config, lib, values, ... }:
 let
  cfg = config.services.prometheus.exporters.node;
 in
 {
  services.promtail = {
    enable = lib.mkDefault true;
    configuration = {
      server = {
        http_listen_port = 28183;
        grpc_listen_port = 0;
      };
      clients = [{
        url = "http://ildkule.pvv.ntnu.no:3100/loki/api/v1/push";
      }];
      scrape_configs = [{
        job_name = "systemd-journal";
        journal = {
          max_age = "12h";
          labels = {
            job = "systemd-journal";
            host = config.networking.hostName;
          };
        };
        relabel_configs = [
          {
            source_labels = [ "__journal__systemd_unit" ];
            target_label = "unit";
          }
          {
            source_labels = [ "__journal_priority_keyword" ];
            target_label = "level";
          }
        ];
      }];
    };
  };
 }
--- a/base/services/roowho2.nix
+++ b/base/services/roowho2.nix
@@ -1,12 +0,0 @@
 { lib, values, ... }:
 {
  services.roowho2.enable = lib.mkDefault true;
  systemd.sockets.roowho2-rwhod.socketConfig = {
    IPAddressDeny = "any";
    IPAddressAllow = [
      "127.0.0.1"
      values.ipv4-space
    ];
  };
 }
--- a/base/services/smartd.nix
+++ b/base/services/smartd.nix
@@ -1,9 +1,7 @@
 { config, pkgs, lib, ... }:
 {
  services.smartd = {
-    # NOTE: qemu guests tend not to have SMART-reporting disks. Please override for the
+    enable = lib.mkDefault true;
    #       hosts with disk passthrough.
    enable = lib.mkDefault (!config.services.qemuGuest.enable);
    notifications = {
      mail = {
        enable = true;
--- a/base/sops.nix
+++ b/base/sops.nix
@@ -1,12 +0,0 @@
 { config, fp, lib, ... }:
 {
  sops.defaultSopsFile = let
    secretsFilePath = fp /secrets/${config.networking.hostName}/${config.networking.hostName}.yaml;
  in lib.mkIf (builtins.pathExists secretsFilePath) secretsFilePath;
  sops.age = lib.mkIf (config.sops.defaultSopsFile != null) {
    sshKeyPaths = lib.mkDefault [ "/etc/ssh/ssh_host_ed25519_key" ];
    keyFile = "/var/lib/sops-nix/key.txt";
    generateKey = true;
  };
 }
--- a/base/vm.nix
+++ b/base/vm.nix
@@ -11,6 +11,5 @@
  };
  config.virtualisation.vmVariant = {
    virtualisation.isVmVariant = true;
    virtualisation.graphics = false;
  };
 }
--- a/docs/development-misc.md
+++ b/docs/development-misc.md
@@ -1,103 +0,0 @@
 # Miscellaneous development notes
 This document contains a bunch of information that is not particularly specific to the pvv nixos config,
 but concerns technologies we use often or gotchas to be aware of when working with NixOS. A lot of the information
 here is already public information spread around the internet, but we've collected some of the items we use often
 here.
 ## The firewall
 `networking.firewall` is a NixOS module that configures `iptables` rules on the machine. It is enabled by default on
 all of our machines, and it can be easy to forget about it when setting up new services, especially when we are the
 ones creating the NixOS module.
 When setting up a new service that listens on a TCP or UDP port, make sure to add the appropriate ports to either
 `networking.firewall.allowedTCPPorts` or `networking.firewall.allowedUDPPorts`.
 You can list out the current firewall rules by running `sudo iptables -L -n -v` on the machine.
 ## Finding stuff
 Finding stuff, both underlying implementation and usage is absolutely crucial when working on nix.
 Oftentimes, the documentation will be outdated, lacking or just plain out wrong. These are some of
 the techniques we have found to be quite good when working with nix.
 ### [ripgrep](https://github.com/BurntSushi/ripgrep)
 ripgrep (or `rg` for short) is a tool that lets you recursively grep for regex patters in a directory.
 It is great for finding references to configuration, and where and how certain things are used. It is
 especially great when working with [nixpkgs](https://github.com/NixOS/nixpkgs), which is quite large.
 ### GitHub Search
 When trying to set up a new service or reconfigure something, it is very common that someone has done it
 before you, but it has never been documented anywhere. A lot of Nix code exists on GitHub, and you can
 easily query it by using the `lang:nix` filter in the search bar.
 For example: https://github.com/search?q=lang%3Anix+dibbler&type=code
 ## rsync
 `rsync` is a tool for synchronizing files between machines. It is very useful when transferring large
 amounts of data from a to b. We use it for multiple things, often when data is produced or stored on
 one machine, and we want to process or convert it on another. For example, we use it to transfer gitea
 artifacts, to transfer gallery pictures, to transfer minecraft world data for map rendering, and more.
 Along with `rsync`, we often use a lesser known tool called `rrsync`, which you can use inside an ssh
 configuration (`authorized_keys` file) to restrict what paths a user can access when connecting over ssh.
 This is useful both as a security measure, but also to avoid accidental overwrites of files outside the intended
 path. `rrsync` will use chroot to restrict what paths the user can access, as well as refuse to run arbitrary commands.
 ## `nix repl`
 `nix repl` is an interactive REPL for the Nix language. It is very useful for experimenting with Nix code,
 and testing out small snippets of code to make sure it behaves as expected. You can also use it to explore
 NixOS machine configurations, to interactively see that the configuration evaluates to what you expect.
 ```
 # While in the pvv-nixos-config directory
 nix repl .
 # Upon writing out the config path and clickin [Tab], you will get autocompletion suggestions:
 nix-repl> nixosConfigurations.bekkalokk.config.services.nginx.virtualHosts.
 nixosConfigurations.bekkalokk.config.services.nginx.virtualHosts._
 nixosConfigurations.bekkalokk.config.services.nginx.virtualHosts.bekkalokk.pvv.ntnu.no-nixos-metrics
 nixosConfigurations.bekkalokk.config.services.nginx.virtualHosts.idp.pvv.ntnu.no
 nixosConfigurations.bekkalokk.config.services.nginx.virtualHosts.minecraft.pvv.ntnu.no
 nixosConfigurations.bekkalokk.config.services.nginx.virtualHosts.pvv.ntnu.no
 nixosConfigurations.bekkalokk.config.services.nginx.virtualHosts.pvv.org
 nixosConfigurations.bekkalokk.config.services.nginx.virtualHosts.pw.pvv.ntnu.no
 nixosConfigurations.bekkalokk.config.services.nginx.virtualHosts.roundcubeplaceholder.example.com
 nixosConfigurations.bekkalokk.config.services.nginx.virtualHosts.snappymail.pvv.ntnu.no
 nixosConfigurations.bekkalokk.config.services.nginx.virtualHosts.webmail.pvv.ntnu.no
 nixosConfigurations.bekkalokk.config.services.nginx.virtualHosts.wiki.pvv.ntnu.no
 nixosConfigurations.bekkalokk.config.services.nginx.virtualHosts.www.pvv.ntnu.no
 nixosConfigurations.bekkalokk.config.services.nginx.virtualHosts.www.pvv.org
 ```
 ## `nix why-depends`
 If you ever wonder why a certain package is being used as a dependency of another package,
 or another machine, you can use `nix why-depends` to find the dependency path from one package to another.
 This is often useful after updating nixpkgs and finding an error saying that a certain package is insecure,
 broken or whatnot. You can do something like the following
 ```bash
 # Why does bekkalokk depend on openssl?
 nix why-depends .#nixosConfigurations.bekkalokk.config.system.build.toplevel .#nixosConfigurations.bekkalokk.pkgs.openssl
 # Why does bekkalokk's minecraft-server depend on zlib? (this is not real)
 nix why-depends .#nixosConfigurations.bekkalokk.pkgs.minecraft-server .#nixosConfigurations.bekkalokk.pkgs.zlib
 ```
 ## php-fpm
 php-fpm (FastCGI Process Manager) is a PHP implementation that is designed for speed and production use. We host a bunch
 of different PHP applications (including our own website), and so we use php-fpm quite a bit. php-fpm typically exposes a
 unix socket that nginx will connect to, and php-fpm will then render php upon web requests forwarded from nginx and return
 it.
 php-fpm has a tendency to be a bit hard to debug. It is not always very willing to spit out error messages and logs, and so
 it can be a bit hard to figure out what's up when something goes wrong. You should see some of the commented stuff laying around
 in the website code on bekkalokk for examples of how to configure php-fpm for better logging and error reporting.
--- a/docs/development.md
+++ b/docs/development.md
@@ -1,169 +0,0 @@
 # Development - working on the PVV machines
 This document outlines the process of editing our NixOS configurations, and testing and deploying said changes
 to the machines. Most of the information written here is specific to the PVV NixOS configuration, and the topics
 will not really cover the nix code itself in detail. You can find some more resources for that by either following
 the links from the *Upstream documentation* section below, or in [Miscellaneous development notes](./development-misc.md).
 ## Editing nix files
 > [!WARNING]
 > Before editing any nix files, make sure to read [Secret management and `sops-nix`](./secret-management.md)!
 > We do not want to add any secrets in plaintext to the nix files, and certainly not commit and publish
 > them into the common public.
 The files are plaintext code, written in the [`Nix` language](https://nix.dev/manual/nix/stable/language/).
 Below is a list of important files and directories, and a description of what they contain.
 ### `flake.nix`
 The `flake.nix` file is a [nix flake](https://wiki.nixos.org/wiki/Flakes) and makes up the entrypoint of the
 entire configuration. It declares what inputs are used (similar to dependencies), as well as what outputs the
 flake exposes. In our case, the most important outputs are the `nixosConfigurations` (our machine configs), but
 we also expose custom modules, packages, devshells, and more. You can run `nix flake show` to get an overview of
 the outputs (however you will need to [enable the `nix-flakes` experimental option](https://wiki.nixos.org/wiki/Flakes#Setup)).
 You will find that a lot of the flake inputs are the different PVV projects that we develop, imported to be hosted
 on the NixOS machines. This makes it easy to deploy changes to these projects, as we can just update the flake input
 to point to a new commit or version, and then rebuild the machines.
 A NixOS configuration is usually made with the `nixpkgs.lib.nixosSystem` function, however we have a few custom wrapper
 functions named `nixosConfig` and `stableNixosConfig` that abstracts away some common configuration we want on all our machines.
 ### `values.nix`
 `values.nix` is a somewhat rare pattern in NixOS configurations around the internet. It contains a bunch of constant values
 that we use throughout the configuration, such as IP addresses, DNS names, paths and more. This not only makes it easier to
 change the values should we need to, but it also makes the configuration more readable. Instead of caring what exact IP any
 machine has, you can write `values.machines.name.ipv4` and abstract the details away.
 ### `base`
 The `base` directory contains a bunch of NixOS configuration that is common for all or most machines. Some of the config
 you will find here sets defaults for certain services without enabling them, so that when they are enabled in a machine config,
 we don't need to repeat the same defaults over again. Other parts actually enable certain services that we want on all machines,
 such as `openssh` or the auto upgrade timer.
 ### Vendoring `modules` and `packages`
 Sometimes, we either find that the packages or modules provided by `nixpkgs` is not sufficient for us,
 or that they are bugged in some way that can not be easily overrided. There are also cases where the
 modules or packages does not exist. In these cases, we tend to either copy and modify the modules and
 packages from nixpkgs, or create our own. These modules and packages end up in the top-level `modules`
 and `packages` directories. They are usually exposed in `flake.nix` as flake outputs `nixosModules.<name>`
 and `packages.<platform>.<name>`, and they are usually also added to the machines that need them in the flake.
 In order to override or add an extra package, the easiest way is to use an [`overlay`](https://wiki.nixos.org/wiki/Overlays).
 This makes it so that the package from `pkgs.<name>` now refers to the modified variant of the package.
 In order to add a module, you can just register it in the modules of the nixos machine.
 In order to override a module, you also have to use `disabledModules = [ "<path-relative-to-nixpkgs/modules>" ];`.
 Use `rg` to find examples of the latter.
 Do note that if you believe a new module to be of high enough quality, or the change you are making to be
 relevant for every nix user, you should strongly consider also creating a PR towards nixpkgs. However,
 getting changes made there has a bit higher threshold and takes more time than making changes in the PVV config,
 so feel free to make the changes here first. We can always remove the changes again once the upstreaming is finished.
 ### `users`, `secrets` and `keys`
 For `users`, see [User management](./users.md)
 For `secrets` and `keys`, see [Secret management and `sops-nix`](./secret-management.md)
 ### Collaboration
 We use our gitea to collaborate on changes to the nix configuration. Every PVV maintenance member should have
 access to the repository. The usual workflow is that we create a branch for the change we want to make, do a bunch
 of commits and changes, and then open a merge request for review (or just rebase on master if you know what you are doing).
 ### Upstream documentation
 Here are different sources of documentation and stuff that you might find useful while
 writing, editing and debugging nix code.
 - [nixpkgs repository](https://github.com/NixOS/nixpkgs)
 This is particularly useful to read the source code, as well as upstreaming pieces of code that we think
 everyone would want
 - [NixOS search](https://search.nixos.org/)
 This is useful for searching for both packages and NixOS options.
 - [nixpkgs documentation](https://nixos.org/manual/nixpkgs/stable/)
 - [NixOS documentation](https://nixos.org/manual/nixos/stable/)
 - [nix (the tool) documentation](https://nix.dev/manual/nix/stable/)
 All of the three above make up the official documentation with all technical
 details about the different pieces that makes up NixOS.
 - [The official NixOS wiki](https://wiki.nixos.org)
 User-contributed guides, tips and tricks, and whatever else.
 - [nix.dev](https://nix.dev)
 Additional stuff
 - [Noogle](https://noogle.dev)
 This is useful when looking for nix functions and packaging helpers.
 ## Testing and deploying changes
 After editing the nix files on a certain branch, you will want to test and deploy the changes to the machines.
 Unfortunately, we don't really have a good setup for testing for runtime correctness locally, but we can at least
 make sure that the code evaluates and builds correctly before deploying.
 To just check that the code evaluates without errors, you can run:
 ```bash
 nix flake check
 # Or if you want to keep getting all errors before it quits:
 nix flake check --keep-going
 ```
 > [!NOTE]
 > If you are making changes that involves creating new nix files, remember to `git add` those files before running
 > any nix commands. Nix refuses to acknowledge files that are not either commited or at least staged. It will spit
 > out an error message about not finding the file in question.
 ### Building machine configurations
 To build any specific machine configuration and look at the output, you can run:
 ```bash
 nix build .#nixosConfigurations.<machine-name>.config.system.build.toplevel
 # or just
 nix build .#<machine-name>
 ```
 This will create a symlink name `./result` to a directory containing the built NixOS system. It is oftentimes
 the case that config files for certain services only end up in the nix store without being put into `/etc`. If you wish
 to read those files, you can often find them by looking at the systemd unit files in `./result/etc/systemd/system/`.
 (if you are using vim, `gf` or go-to-file while the cursor is over a file path is a useful trick while doing this).
 If you have edited something that affects multiple machines, you can also build all important machines at once by running:
 ```bash
 nix build .#
 ```
 > [!NOTE]
 > Building all machines at once can take a long time, depending on what has changed and whether you have already
 > built some of the machines recently. Be prepared to wait for up to an hour to build all machines from scratch
 > if this is the first time.
 ### Forcefully reset to `main`
 If you ever want to reset a machine to the `main` branch, you can do so by running:
 ```bash
 nixos-rebuild switch --update-input nixpkgs --update-input nixpkgs-unstable --no-write-lock-file --refresh --upgrade --flake git+https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git
 ```
 This will ignore the current branch and just pull the latest `main` from the git repository directly from gitea.
 You can also use this command if there are updates on the `main` branch that you want to deploy to the machine without
 waiting for the nightly rebuild.
--- a/docs/secret-management.md
+++ b/docs/secret-management.md
@@ -1,160 +0,0 @@
 # Secret management and `sops-nix`
 Nix config is love, nix config is life, and publishing said config to the
 internet is not only a good deed and kinda cool, but also encourages properly
 secured configuration as opposed to [security through obscurity](https://en.wikipedia.org/wiki/Security_through_obscurity).
 That being said, there are some details of the config that we really shouldn't
 share with the general public. In particular, there are so-called *secrets*, that is
 API keys, passwords, tokens, cookie secrets, salts, peppers and jalapenos that we'd
 rather keep to ourselves. However, it is not entirely trivial to do so in the NixOS config.
 For one, we'd have to keep these secrets out of the public git repo somehow, and secondly
 everything that is configured via nix ends up as world readable files (i.e. any user on the
 system can read the file) in `/nix/store`.
 In order to solve this, we use a NixOS module called [`sops-nix`](https://github.com/Mic92/sops-nix)
 which uses a technology called [`sops`](https://github.com/getsops/sops) behind the scenes.
 The idea is simple: we encrypt these secrets with a bunch of different keys and store the
 encrypted files in the git repo. First of all, we encrypt the secrets a bunch of time with
 PVV maintenance member's keys, so that we can decrypt and edit the contents. Secondly, we
 encrypt the secrets with the [host keys]() of the NixOS machines, so that they can decrypt
 the secrets. The secrets will be decrypted and stored in a well-known location (usually `/run/secrets`)
 so that they do not end up in the nix store, and are not world readable.
 This way, we can both keep the secrets in the git repository and let multiple people edit them,
 but also ensure that they don't end up in the wrong hands.
 ## Adding a new machine
 In order to add a new machine to the nix-sops setup, you should do the following:
 ```console
 # Create host keys (if they don't already exist)
 ssh-keygen -A -b 4096
 # Derive an age-key from the public host key
 nix-shell -p ssh-to-age --run 'cat /etc/ssh/ssh_host_ed25519_key.pub | ssh-to-age'
 # Register the age key in .sops.yaml
 vim .sops.yaml
 ```
 The contents of `.sops.yaml` should look like this:
 ```yaml
 keys:
  # Users
  ...
  # Hosts
  ...
  - &host_<machine_name> <public_age_key>
 creation_rules:
  ...
  - path_regex: secrets/<machine_name>/[^/]+\.yaml$
    key_groups:
    - age:
      - *host_<machine_name>
      - ... user keys
    - pgp:
      - ... user keys
 ```
 > [!NOTE]
 > Take care that all the keys in the `age` and `pgp` sections are prefixed
 > with a `-`, or else sops might try to encrypt the secrets in a way where
 > you need both keys present to decrypt the content. Also, it tends to throw
 > interesting errors when it fails to do so.
 ```console
 # While cd-ed into the repository, run this to get a shell with the `sops` tool present
 nix-shell
 ```
 Now you should also be able to edit secrets for this machine by running:
 ```
 sops secrets/<machine_name>/<machine_name>.yaml
 ```
 ## Adding a user
 Adding a user is quite similar to adding a new machine.
 This guide assumes you have already set up SSH keys.
 ```
 # Derive an age-key from your key
 # (edit the path to the key if it is named something else)
 nix-shell -p ssh-to-age --run 'cat ~/.ssh/id_ed25519.pub | ssh-to-age'
 # Register the age key in .sops.yaml
 vim .sops.yaml
 ```
 The contents of `.sops.yaml` should look like this:
 ```yaml
 keys:
  # Users
  ...
  - &user_<user_name> <public_age_key>
  # Hosts
  ...
 creation_rules:
  ...
  # Do this for all the machines you are planning to edit
  # (or just do it for all machines)
  - path_regex: secrets/<machine_name>/[^/]+\.yaml$
    key_groups:
    - age:
      - *host_<machine_name>
      - ... user keys
      - *host_<user_name>
    - pgp:
      - ... user keys
 ```
 Now that sops is properly configured to recognize the key, you need someone
 who already has access to decrypt all the secrets and re-encrypt them with your
 key. At this point, you should probably [open a PR](https://docs.gitea.com/usage/issues-prs/pull-request)
 and ask someone in PVV maintenance if they can checkout the PR branch, run the following
 command and push the diff back into the PR (and maybe even ask them to merge if you're feeling
 particularly needy).
 ```console
 sops updatekeys secrets/*/*.yaml
 ```
 ## Updating keys
 > [!NOTE]
 > At some point, we found this flag called `sops -r` that seemed to be described to do what
 > `sops updatekeys` does, do not be fooled. This only rotates the "inner key" for those who
 > already have the secrets encrypted with their key.
 Updating keys is done with this command:
 ```console
 sops updatekeys secrets/*/*.yaml
 ```
 However, there is a small catch. [oysteikt](https://git.pvv.ntnu.no/oysteikt) has kinda been
 getting gray hairs lately, and refuses to use modern technology - he is still stuck using GPG.
 This means that to be able to re-encrypt the sops secrets, you will need to have a gpg keychain
 with his latest public key available. The key has an expiry date, so if he forgets to update it,
 you should send him and angry email and tag him a bunch of times in a gitea issue. If the key
 is up to date, you can do the following:
 ```console
 # Fetch gpg (unless you have it already)
 nix shell nixpkgs#gnupg
 # Import oysteikts key to the gpg keychain
 gpg --import ./keys/oysteikt.pub
 ```
 Now you should be able to run the `sops updatekeys` command again.
--- a/docs/users.md
+++ b/docs/users.md
@@ -1,50 +0,0 @@
 # User management
 Due to some complications with how NixOS creates users compared to how we used to
 create users with the salt-based setup, the NixOS machine users are created and
 managed separately. We tend to create users on-demand, whenever someone in PVV
 maintenance want to work on the NixOS machines.
 ## Setting up a new user
 You can find the files for the existing users, and thereby examples of user files
 in the [`users`](../users) directory. When creating a new file here, you should name it
 `your-username.nix`, and add *at least* the following contents:
 ```nix
 { pkgs, ... }:
 {
  users.users."<username>" = {
    isNormalUser = true;
    extraGroups = [
      "wheel" # In case you wanna use sudo (you probably do)
      "nix-builder-users" # Arbitrary access to write to the nix store
    ];
    # Any packages you frequently use to manage servers go here.
    # Please don't pull gigantonormous packages here unless you
    # absolutely need them, and remember that any package can be
    # pulled via nix-shell if you only use it once in a blue moon.
    packages = with pkgs; [
      bottom
      eza
    ];
    # Not strictly needed, but we recommend adding your public SSH
    # key here. If it is not present, you will have to log into the
    # machine as 'root' before setting your password for every NixOS
    # machine you have not logged into yet.
    openssh.authorizedKeys.keys = [
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIjiQ0wg4lpC7YBMAAHoGmgwqHOBi+EUz5mmCymGlIyT my-key"
    ];
  };
 }
 ```
 The file will be picked up automatically, so creating the file and adding the
 contents should be enough to get you registered. You should
 [open a PR](https://docs.gitea.com/usage/issues-prs/pull-request) with the new
 code so the machines will be rebuilt with your user present.
 See also [Secret Management](./secret-management.md) for how to add your keys to the
 system that lets us add secrets (API keys, password, etc.) to the NixOS config.
--- a/flake.lock
+++ b/flake.lock
@@ -1,26 +1,5 @@
 {
  "nodes": {
    "dibbler": {
      "inputs": {
        "nixpkgs": [
          "nixpkgs"
        ]
      },
      "locked": {
        "lastModified": 1770133120,
        "narHash": "sha256-RuAWONXb+U3omSsuIPCrPcgj0XYqv+2djG0cnPGEyKg=",
        "ref": "main",
        "rev": "3123b8b474319bc75ee780e0357dcdea69dc85e6",
        "revCount": 244,
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Projects/dibbler.git"
      },
      "original": {
        "ref": "main",
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Projects/dibbler.git"
      }
    },
    "disko": {
      "inputs": {
        "nixpkgs": [
@@ -28,38 +7,19 @@
        ]
      },
      "locked": {
-        "lastModified": 1736864502,
+        "lastModified": 1764627417,
-        "narHash": "sha256-ItkIZyebGvNH2dK9jVGzJHGPtb6BSWLN8Gmef16NeY0=",
+        "narHash": "sha256-D6xc3Rl8Ab6wucJWdvjNsGYGSxNjQHzRc2EZ6eeQ6l4=",
        "owner": "nix-community",
        "repo": "disko",
-        "rev": "0141aabed359f063de7413f80d906e1d98c0c123",
+        "rev": "5a88a6eceb8fd732b983e72b732f6f4b8269bef3",
        "type": "github"
      },
      "original": {
        "owner": "nix-community",
        "ref": "v1.11.0",
        "repo": "disko",
        "type": "github"
      }
    },
    "flake-parts": {
      "inputs": {
        "nixpkgs-lib": "nixpkgs-lib"
      },
      "locked": {
        "lastModified": 1765835352,
        "narHash": "sha256-XswHlK/Qtjasvhd1nOa1e8MgZ8GS//jBoTqWtrS1Giw=",
        "owner": "hercules-ci",
        "repo": "flake-parts",
        "rev": "a34fae9c08a15ad73f295041fec82323541400a9",
        "type": "github"
      },
      "original": {
        "owner": "hercules-ci",
        "repo": "flake-parts",
        "type": "github"
      }
    },
    "gergle": {
      "inputs": {
        "nixpkgs": [
@@ -67,16 +27,15 @@
        ]
      },
      "locked": {
-        "lastModified": 1767906545,
+        "lastModified": 1764868579,
-        "narHash": "sha256-LOf08pcjEQFLs3dLPuep5d1bAXWOFcdfxuk3YMb5KWw=",
+        "narHash": "sha256-rfTUOIc0wnC4+19gLVfPbHfXx/ilfuUix6bWY+yaM2U=",
-        "ref": "main",
+        "ref": "refs/heads/main",
-        "rev": "e55cbe0ce0b20fc5952ed491fa8a553c8afb1bdd",
+        "rev": "9c923d1d50daa6a3b28c3214ad2300bfaf6c8fcd",
-        "revCount": 23,
+        "revCount": 22,
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Grzegorz/gergle.git"
      },
      "original": {
        "ref": "main",
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Grzegorz/gergle.git"
      }
@@ -89,16 +48,15 @@
        "rust-overlay": "rust-overlay"
      },
      "locked": {
-        "lastModified": 1767906494,
+        "lastModified": 1764868843,
-        "narHash": "sha256-Dd6gtdZfRMAD6JhdX0GdJwIHVaBikePSpQXhIdwLlWI=",
+        "narHash": "sha256-ZXYLXKO+VjAJr2f5zz+7SuKFICfI2eZnmTgS/626YE0=",
-        "ref": "main",
+        "ref": "refs/heads/main",
-        "rev": "7258822e2e90fea2ea00b13b5542f63699e33a9e",
+        "rev": "c095533c50e80dd18ac48046f1479cf4d83c631c",
-        "revCount": 61,
+        "revCount": 52,
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Grzegorz/greg-ng.git"
      },
      "original": {
        "ref": "main",
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Grzegorz/greg-ng.git"
      }
@@ -112,14 +70,13 @@
      "locked": {
        "lastModified": 1764867811,
        "narHash": "sha256-UWHiwr8tIcGcVxMLvAdNxDbQ8QuHf3REHboyxvFkYEI=",
-        "ref": "master",
+        "ref": "refs/heads/master",
        "rev": "c9983e947efe047ea9d6f97157a1f90e49d0eab3",
        "revCount": 81,
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Grzegorz/grzegorz-clients.git"
      },
      "original": {
        "ref": "master",
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Grzegorz/grzegorz-clients.git"
      }
@@ -149,20 +106,18 @@
      "inputs": {
        "nixpkgs": [
          "nixpkgs"
-        ],
+        ]
        "rust-overlay": "rust-overlay_2"
      },
      "locked": {
-        "lastModified": 1767906976,
+        "lastModified": 1756124334,
-        "narHash": "sha256-igCg8I83eO+noF00raXVJqDxzLS2SrZN8fK5bnvO+xI=",
+        "narHash": "sha256-DXFmSpgI8FrqcdqY7wg5l/lpssWjslHq5ufvyp/5k4o=",
-        "ref": "main",
+        "ref": "refs/heads/main",
-        "rev": "626bc9b6bae6a997b347cdbe84080240884f2955",
+        "rev": "83760b1ebcd9722ddf58a4117d29555da65538ad",
-        "revCount": 17,
+        "revCount": 13,
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Projects/minecraft-heatmap.git"
      },
      "original": {
        "ref": "main",
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Projects/minecraft-heatmap.git"
      }
@@ -174,16 +129,15 @@
        ]
      },
      "locked": {
-        "lastModified": 1769500363,
+        "lastModified": 1765903589,
-        "narHash": "sha256-vFxmdsLBPdTy5j2bf54gbTQi1XnWbZDmeR/BBh8MFrw=",
+        "narHash": "sha256-JRLmckeM4G2hkH2V3VdfjHrrsWgJ8j7rZDYYjHTkRqA=",
-        "ref": "main",
+        "ref": "refs/heads/main",
-        "rev": "2618e434e40e109eaab6a0693313c7e0de7324a3",
+        "rev": "7c86d342e68506fcd83cb74af3336f99ff522a0a",
-        "revCount": 47,
+        "revCount": 24,
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Projects/minecraft-kartverket.git"
      },
      "original": {
        "ref": "main",
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Projects/minecraft-kartverket.git"
      }
@@ -195,77 +149,39 @@
        ]
      },
      "locked": {
-        "lastModified": 1767906352,
+        "lastModified": 1743881366,
-        "narHash": "sha256-wYsH9MMAPFG3XTL+3DwI39XMG0F2fTmn/5lt265a3Es=",
+        "narHash": "sha256-ScGA2IHPk9ugf9bqEZnp+YB/OJgrkZblnG/XLEKvJAo=",
-        "ref": "main",
+        "ref": "refs/heads/main",
-        "rev": "d054c5d064b8ed6d53a0adb0cf6c0a72febe212e",
+        "rev": "db2e4becf1b11e5dfd33de12a90a7d089fcf68ec",
-        "revCount": 13,
+        "revCount": 11,
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Drift/nix-gitea-themes.git"
      },
      "original": {
        "ref": "main",
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Drift/nix-gitea-themes.git"
      }
    },
    "nix-topology": {
      "inputs": {
        "flake-parts": "flake-parts",
        "nixpkgs": [
          "nixpkgs"
        ]
      },
      "locked": {
        "lastModified": 1769018862,
        "narHash": "sha256-x3eMpPQhZwEDunyaUos084Hx41XwYTi2uHY4Yc4YNlk=",
        "owner": "oddlama",
        "repo": "nix-topology",
        "rev": "a15cac71d3399a4c2d1a3482ae62040a3a0aa07f",
        "type": "github"
      },
      "original": {
        "owner": "oddlama",
        "ref": "main",
        "repo": "nix-topology",
        "type": "github"
      }
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1769724120,
+        "lastModified": 1764806471,
-        "narHash": "sha256-oQBM04hQk1kotfv4qmIG1tHmuwODd1+hqRJE5TELeCE=",
+        "narHash": "sha256-Qk0SArnS83KqyS9wNt1YoTkkYKDraNrjRWKUtB9DKoM=",
-        "rev": "8ec59ed5093c2a742d7744e9ecf58f358aa4a87d",
+        "rev": "6707b1809330d0f912f5813963bb29f6f194ee81",
        "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/25.11-small/nixos-25.11.4961.8ec59ed5093c/nixexprs.tar.xz"
+        "url": "https://releases.nixos.org/nixos/25.11-small/nixos-25.11.896.6707b1809330/nixexprs.tar.xz"
      },
      "original": {
        "type": "tarball",
        "url": "https://nixos.org/channels/nixos-25.11-small/nixexprs.tar.xz"
      }
    },
    "nixpkgs-lib": {
      "locked": {
        "lastModified": 1765674936,
        "narHash": "sha256-k00uTP4JNfmejrCLJOwdObYC9jHRrr/5M/a/8L2EIdo=",
        "owner": "nix-community",
        "repo": "nixpkgs.lib",
        "rev": "2075416fcb47225d9b68ac469a5c4801a9c4dd85",
        "type": "github"
      },
      "original": {
        "owner": "nix-community",
        "repo": "nixpkgs.lib",
        "type": "github"
      }
    },
    "nixpkgs-unstable": {
      "locked": {
-        "lastModified": 1769813739,
+        "lastModified": 1764854611,
-        "narHash": "sha256-RmNWW1DQczvDwBHu11P0hGwJZxbngdoymVu7qkwq/2M=",
+        "narHash": "sha256-MVzFp4ZKwdh6U1wy4fJe/GY3Hb4cvvyJbAZOhaeBQoo=",
-        "rev": "16a3cae5c2487b1afa240e5f2c1811f172419558",
+        "rev": "3a4b875aef660bbd148e86b92cffea2a360c3275",
        "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/unstable-small/nixos-26.05pre937548.16a3cae5c248/nixexprs.tar.xz"
+        "url": "https://releases.nixos.org/nixos/unstable-small/nixos-26.05pre906534.3a4b875aef66/nixexprs.tar.xz"
      },
      "original": {
        "type": "tarball",
@@ -281,14 +197,13 @@
      "locked": {
        "lastModified": 1764869785,
        "narHash": "sha256-FGTIpC7gB4lbeL0bfYzn1Ge0PaCpd7VqWBLhJBx0i4A=",
-        "ref": "main",
+        "ref": "refs/heads/main",
        "rev": "8ce7fb0b1918bdb3d1489a40d73895693955e8b2",
        "revCount": 23,
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Projects/calendar-bot.git"
      },
      "original": {
        "ref": "main",
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Projects/calendar-bot.git"
      }
@@ -300,44 +215,21 @@
        ]
      },
      "locked": {
-        "lastModified": 1769009806,
+        "lastModified": 1757332682,
-        "narHash": "sha256-52xTtAOc9B+MBRMRZ8HI6ybNsRLMlHHLh+qwAbaJjRY=",
+        "narHash": "sha256-4p4aVQWs7jHu3xb6TJlGik20lqbUU/Fc0/EHpzoRlO0=",
-        "ref": "main",
+        "ref": "refs/heads/main",
-        "rev": "aa8adfc6a4d5b6222752e2d15d4a6d3b3b85252e",
+        "rev": "da1113341ad9881d8d333d1e29790317bd7701e7",
-        "revCount": 575,
+        "revCount": 518,
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Projects/nettsiden.git"
      },
      "original": {
        "ref": "main",
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Projects/nettsiden.git"
      }
    },
    "qotd": {
      "inputs": {
        "nixpkgs": [
          "nixpkgs"
        ]
      },
      "locked": {
        "lastModified": 1768684204,
        "narHash": "sha256-TErBiXxTRPUtZ/Mw8a5p+KCeGCFXa0o8fzwGoo75//Y=",
        "ref": "main",
        "rev": "a86f361bb8cfac3845b96d49fcbb2faea669844f",
        "revCount": 11,
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Projects/qotd.git"
      },
      "original": {
        "ref": "main",
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Projects/qotd.git"
      }
    },
    "root": {
      "inputs": {
        "dibbler": "dibbler",
        "disko": "disko",
        "gergle": "gergle",
        "greg-ng": "greg-ng",
@@ -346,38 +238,13 @@
        "minecraft-heatmap": "minecraft-heatmap",
        "minecraft-kartverket": "minecraft-kartverket",
        "nix-gitea-themes": "nix-gitea-themes",
        "nix-topology": "nix-topology",
        "nixpkgs": "nixpkgs",
        "nixpkgs-unstable": "nixpkgs-unstable",
        "pvv-calendar-bot": "pvv-calendar-bot",
        "pvv-nettsiden": "pvv-nettsiden",
        "qotd": "qotd",
        "roowho2": "roowho2",
        "sops-nix": "sops-nix"
      }
    },
    "roowho2": {
      "inputs": {
        "nixpkgs": [
          "nixpkgs"
        ],
        "rust-overlay": "rust-overlay_3"
      },
      "locked": {
        "lastModified": 1769834595,
        "narHash": "sha256-P1jrO7BxHyIKDuOXHuUb7bi4H2TuYnACW5eqf1gG47g=",
        "ref": "main",
        "rev": "def4eec2d59a69b4638b3f25d6d713b703b2fa56",
        "revCount": 49,
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Projects/roowho2.git"
      },
      "original": {
        "ref": "main",
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Projects/roowho2.git"
      }
    },
    "rust-overlay": {
      "inputs": {
        "nixpkgs": [
@@ -386,53 +253,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1767840362,
+        "lastModified": 1764816035,
-        "narHash": "sha256-ZtsFqUhilubohNZ1TgpQIFsi4biZTwRH9rjZsDRDik8=",
+        "narHash": "sha256-F0IQSmSj4t2ThkbWZooAhkCTO+YpZSd2Pqiv2uoYEHo=",
        "owner": "oxalica",
        "repo": "rust-overlay",
-        "rev": "d159ea1fc321c60f88a616ac28bab660092a227d",
+        "rev": "74d9abb7c5c030469f90d97a67d127cc5d76c238",
        "type": "github"
      },
      "original": {
        "owner": "oxalica",
        "repo": "rust-overlay",
        "type": "github"
      }
    },
    "rust-overlay_2": {
      "inputs": {
        "nixpkgs": [
          "minecraft-heatmap",
          "nixpkgs"
        ]
      },
      "locked": {
        "lastModified": 1766371695,
        "narHash": "sha256-W7CX9vy7H2Jj3E8NI4djHyF8iHSxKpb2c/7uNQ/vGFU=",
        "owner": "oxalica",
        "repo": "rust-overlay",
        "rev": "d81285ba8199b00dc31847258cae3c655b605e8c",
        "type": "github"
      },
      "original": {
        "owner": "oxalica",
        "repo": "rust-overlay",
        "type": "github"
      }
    },
    "rust-overlay_3": {
      "inputs": {
        "nixpkgs": [
          "roowho2",
          "nixpkgs"
        ]
      },
      "locked": {
        "lastModified": 1769309768,
        "narHash": "sha256-AbOIlNO+JoqRJkK1VrnDXhxuX6CrdtIu2hSuy4pxi3g=",
        "owner": "oxalica",
        "repo": "rust-overlay",
        "rev": "140c9dc582cb73ada2d63a2180524fcaa744fad5",
        "type": "github"
      },
      "original": {
@@ -448,16 +273,15 @@
        ]
      },
      "locked": {
-        "lastModified": 1769469829,
+        "lastModified": 1764483358,
-        "narHash": "sha256-wFcr32ZqspCxk4+FvIxIL0AZktRs6DuF8oOsLt59YBU=",
+        "narHash": "sha256-EyyvCzXoHrbL467YSsQBTWWg4sR96MH1sPpKoSOelB4=",
        "owner": "Mic92",
        "repo": "sops-nix",
-        "rev": "c5eebd4eb2e3372fe12a8d70a248a6ee9dd02eff",
+        "rev": "5aca6ff67264321d47856a2ed183729271107c9c",
        "type": "github"
      },
      "original": {
        "owner": "Mic92",
        "ref": "master",
        "repo": "sops-nix",
        "type": "github"
      }
--- a/flake.nix
+++ b/flake.nix
@@ -5,48 +5,36 @@
    nixpkgs.url = "https://nixos.org/channels/nixos-25.11-small/nixexprs.tar.xz";
    nixpkgs-unstable.url = "https://nixos.org/channels/nixos-unstable-small/nixexprs.tar.xz";
-    sops-nix.url = "github:Mic92/sops-nix/master";
+    sops-nix.url = "github:Mic92/sops-nix";
    sops-nix.inputs.nixpkgs.follows = "nixpkgs";
-    disko.url = "github:nix-community/disko/v1.11.0";
+    disko.url = "github:nix-community/disko";
    disko.inputs.nixpkgs.follows = "nixpkgs";
-    nix-topology.url = "github:oddlama/nix-topology/main";
+    pvv-nettsiden.url = "git+https://git.pvv.ntnu.no/Projects/nettsiden.git";
    nix-topology.inputs.nixpkgs.follows = "nixpkgs";
    pvv-nettsiden.url = "git+https://git.pvv.ntnu.no/Projects/nettsiden.git?ref=main";
    pvv-nettsiden.inputs.nixpkgs.follows = "nixpkgs";
-    pvv-calendar-bot.url = "git+https://git.pvv.ntnu.no/Projects/calendar-bot.git?ref=main";
+    pvv-calendar-bot.url = "git+https://git.pvv.ntnu.no/Projects/calendar-bot.git";
    pvv-calendar-bot.inputs.nixpkgs.follows = "nixpkgs";
    dibbler.url = "git+https://git.pvv.ntnu.no/Projects/dibbler.git?ref=main";
    dibbler.inputs.nixpkgs.follows = "nixpkgs";
    matrix-next.url = "github:dali99/nixos-matrix-modules/v0.8.0";
    matrix-next.inputs.nixpkgs.follows = "nixpkgs";
-    nix-gitea-themes.url = "git+https://git.pvv.ntnu.no/Drift/nix-gitea-themes.git?ref=main";
+    nix-gitea-themes.url = "git+https://git.pvv.ntnu.no/Drift/nix-gitea-themes.git";
    nix-gitea-themes.inputs.nixpkgs.follows = "nixpkgs";
-    minecraft-heatmap.url = "git+https://git.pvv.ntnu.no/Projects/minecraft-heatmap.git?ref=main";
+    minecraft-heatmap.url = "git+https://git.pvv.ntnu.no/Projects/minecraft-heatmap.git";
    minecraft-heatmap.inputs.nixpkgs.follows = "nixpkgs";
-    roowho2.url = "git+https://git.pvv.ntnu.no/Projects/roowho2.git?ref=main";
+    greg-ng.url = "git+https://git.pvv.ntnu.no/Grzegorz/greg-ng.git";
    roowho2.inputs.nixpkgs.follows = "nixpkgs";
    greg-ng.url = "git+https://git.pvv.ntnu.no/Grzegorz/greg-ng.git?ref=main";
    greg-ng.inputs.nixpkgs.follows = "nixpkgs";
-    gergle.url = "git+https://git.pvv.ntnu.no/Grzegorz/gergle.git?ref=main";
+    gergle.url = "git+https://git.pvv.ntnu.no/Grzegorz/gergle.git";
    gergle.inputs.nixpkgs.follows = "nixpkgs";
-    grzegorz-clients.url = "git+https://git.pvv.ntnu.no/Grzegorz/grzegorz-clients.git?ref=master";
+    grzegorz-clients.url = "git+https://git.pvv.ntnu.no/Grzegorz/grzegorz-clients.git";
    grzegorz-clients.inputs.nixpkgs.follows = "nixpkgs";
-    minecraft-kartverket.url = "git+https://git.pvv.ntnu.no/Projects/minecraft-kartverket.git?ref=main";
+    minecraft-kartverket.url = "git+https://git.pvv.ntnu.no/Projects/minecraft-kartverket.git";
    minecraft-kartverket.inputs.nixpkgs.follows = "nixpkgs";
    qotd.url = "git+https://git.pvv.ntnu.no/Projects/qotd.git?ref=main";
    qotd.inputs.nixpkgs.follows = "nixpkgs";
  };
  outputs = { self, nixpkgs, nixpkgs-unstable, sops-nix, disko, ... }@inputs:
@@ -69,87 +57,53 @@
  in {
    inputs = lib.mapAttrs (_: src: src.outPath) inputs;
    pkgs = forAllSystems (system: import nixpkgs {
      inherit system;
      config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg)
        [
          "nvidia-x11"
          "nvidia-settings"
        ];
    });
    nixosConfigurations = let
      unstablePkgs = nixpkgs-unstable.legacyPackages.x86_64-linux;
      nixosConfig =
        nixpkgs:
        name:
        configurationPath:
-        extraArgs@{
+        extraArgs:
-          localSystem ? "x86_64-linux", # buildPlatform
+        lib.nixosSystem (lib.recursiveUpdate
-          crossSystem ? "x86_64-linux", # hostPlatform
+        (let
-          specialArgs ? { },
+          system = "x86_64-linux";
-          modules ? [ ],
+        in {
-          overlays ? [ ],
+          inherit system;
-          enableDefaults ? true,
+
-          ...
+          specialArgs = {
-        }:
+            inherit unstablePkgs inputs;
-        let
+            values = import ./values.nix;
-          commonPkgsConfig = {
+            fp = path: ./${path};
-            inherit localSystem crossSystem;
+          } // extraArgs.specialArgs or { };
          modules = [
            configurationPath
            sops-nix.nixosModules.sops
          ] ++ extraArgs.modules or [];
          pkgs = import nixpkgs {
            inherit system;
            config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg)
              [
                "nvidia-x11"
                "nvidia-settings"
              ];
-            overlays = (lib.optionals enableDefaults [
+            overlays = [
              # Global overlays go here
-              inputs.roowho2.overlays.default
+            ] ++ extraArgs.overlays or [ ];
            ]) ++ overlays;
          };
-
+        })
          pkgs = import nixpkgs commonPkgsConfig;
          unstablePkgs = import nixpkgs-unstable commonPkgsConfig;
        in
        lib.nixosSystem (lib.recursiveUpdate
        {
          system = crossSystem;
          inherit pkgs;
          specialArgs = {
            inherit inputs unstablePkgs;
            values = import ./values.nix;
            fp = path: ./${path};
          } // specialArgs;
          modules = [
            {
              networking.hostName = lib.mkDefault name;
            }
            configurationPath
          ] ++ (lib.optionals enableDefaults [
            sops-nix.nixosModules.sops
            inputs.roowho2.nixosModules.default
            self.nixosModules.rsync-pull-targets
          ]) ++ modules;
        }
        (builtins.removeAttrs extraArgs [
          "localSystem"
          "crossSystem"
          "modules"
          "overlays"
          "specialArgs"
          "enableDefaults"
        ])
      );
      stableNixosConfig = name: extraArgs:
          nixosConfig nixpkgs name ./hosts/${name}/configuration.nix extraArgs;
    in {
      bakke = stableNixosConfig "bakke" {
        modules = [
          inputs.disko.nixosModules.disko
        ];
      };
      bicep = stableNixosConfig "bicep" {
        modules = [
          inputs.matrix-next.nixosModules.default
@@ -162,32 +116,28 @@
          inputs.pvv-calendar-bot.overlays.default
          inputs.minecraft-heatmap.overlays.default
          (final: prev: {
-            inherit (self.packages.${prev.stdenv.hostPlatform.system}) out-of-your-element;
+            inherit (self.packages.${prev.system}) out-of-your-element;
          })
        ];
      };
      bekkalokk = stableNixosConfig "bekkalokk" {
        overlays = [
          (final: prev: {
            heimdal = unstablePkgs.heimdal;
            mediawiki-extensions = final.callPackage ./packages/mediawiki-extensions { };
            simplesamlphp = final.callPackage ./packages/simplesamlphp { };
            bluemap = final.callPackage ./packages/bluemap.nix { };
          })
          inputs.pvv-nettsiden.overlays.default
          inputs.qotd.overlays.default
        ];
        modules = [
          inputs.pvv-nettsiden.nixosModules.default
          self.nixosModules.bluemap
          inputs.qotd.nixosModules.default
        ];
      };
      ildkule = stableNixosConfig "ildkule" { };
      #ildkule-unstable = unstableNixosConfig "ildkule" { };
      shark = stableNixosConfig "shark" { };
      wenche = stableNixosConfig "wenche" { };
      temmie = stableNixosConfig "temmie" { };
      gluttony = stableNixosConfig "gluttony" { };
      kommode = stableNixosConfig "kommode" {
        overlays = [
@@ -195,7 +145,6 @@
        ];
        modules = [
          inputs.nix-gitea-themes.nixosModules.default
          inputs.disko.nixosModules.disko
        ];
      };
@@ -229,38 +178,6 @@
      };
    }
    //
    (let
      skrottConfig = {
        modules = [
          (nixpkgs + "/nixos/modules/installer/sd-card/sd-image-aarch64.nix")
          inputs.dibbler.nixosModules.default
        ];
        overlays = [
          inputs.dibbler.overlays.default
          (final: prev: {
            # NOTE: Yeetus (these break crosscompile ¯\_(ツ)_/¯)
            atool = prev.emptyDirectory;
            micro = prev.emptyDirectory;
            ncdu = prev.emptyDirectory;
          })
        ];
      };
    in {
      skrott = self.nixosConfigurations.skrott-native;
      skrott-native = stableNixosConfig "skrott" (skrottConfig // {
        localSystem = "aarch64-linux";
        crossSystem = "aarch64-linux";
      });
      skrott-cross = stableNixosConfig "skrott" (skrottConfig // {
        localSystem = "x86_64-linux";
        crossSystem = "aarch64-linux";
      });
      skrott-x86_64 = stableNixosConfig "skrott" (skrottConfig // {
        localSystem = "x86_64-linux";
        crossSystem = "x86_64-linux";
      });
    })
    //
    (let
      machineNames = map (i: "lupine-${toString i}") (lib.range 1 5);
      stableLupineNixosConfig = name: extraArgs:
@@ -271,26 +188,15 @@
    }));
    nixosModules = {
      bluemap = ./modules/bluemap.nix;
      gickup = ./modules/gickup;
      matrix-ooye = ./modules/matrix-ooye.nix;
      robots-txt = ./modules/robots-txt.nix;
      rsync-pull-targets = ./modules/rsync-pull-targets.nix;
      snakeoil-certs = ./modules/snakeoil-certs.nix;
      snappymail = ./modules/snappymail.nix;
      robots-txt = ./modules/robots-txt.nix;
      gickup = ./modules/gickup;
      matrix-ooye = ./modules/matrix-ooye.nix;
    };
    devShells = forAllSystems (system: {
-      default = let
+      default = nixpkgs-unstable.legacyPackages.${system}.callPackage ./shell.nix { };
        pkgs = import nixpkgs-unstable {
          inherit system;
          overlays = [
            (final: prev: {
              inherit (inputs.disko.packages.${system}) disko;
            })
          ];
        };
      in pkgs.callPackage ./shell.nix { };
      cuda = let
        cuda-pkgs = import nixpkgs-unstable {
          inherit system;
@@ -304,86 +210,25 @@
    packages = {
      "x86_64-linux" = let
-        system = "x86_64-linux";
+        pkgs = nixpkgs.legacyPackages."x86_64-linux";
        pkgs = nixpkgs.legacyPackages.${system};
      in rec {
        default = important-machines;
        important-machines = pkgs.linkFarm "important-machines"
-          (lib.getAttrs importantMachines self.packages.${system});
+          (lib.getAttrs importantMachines self.packages.x86_64-linux);
        all-machines = pkgs.linkFarm "all-machines"
-          (lib.getAttrs allMachines self.packages.${system});
+          (lib.getAttrs allMachines self.packages.x86_64-linux);
        simplesamlphp = pkgs.callPackage ./packages/simplesamlphp { };
-        bluemap = pkgs.callPackage ./packages/bluemap.nix { };
+        out-of-your-element = pkgs.callPackage ./packages/out-of-your-element.nix { };
-
+      } //
        out-of-your-element = pkgs.callPackage ./packages/ooye/package.nix { };
      }
      //
      # Mediawiki extensions
      (lib.pipe null [
        (_: pkgs.callPackage ./packages/mediawiki-extensions { })
        (lib.flip builtins.removeAttrs ["override" "overrideDerivation"])
        (lib.mapAttrs' (name: lib.nameValuePair "mediawiki-${name}"))
      ])
-      //
+      // lib.genAttrs allMachines
-      # Machines
+        (machine: self.nixosConfigurations.${machine}.config.system.build.toplevel);
      lib.genAttrs allMachines
        (machine: self.nixosConfigurations.${machine}.config.system.build.toplevel)
      //
      # Skrott is exception
      {
        skrott = self.packages.${system}.skrott-native-sd;
        skrott-native = self.nixosConfigurations.skrott-native.config.system.build.toplevel;
        skrott-native-sd = self.nixosConfigurations.skrott-native.config.system.build.sdImage;
        skrott-cross = self.nixosConfigurations.skrott-cross.config.system.build.toplevel;
        skrott-cross-sd = self.nixosConfigurations.skrott-cross.config.system.build.sdImage;
        skrott-x86_64 = self.nixosConfigurations.skrott-x86_64.config.system.build.toplevel;
      }
      //
      # Nix-topology
      (let
        topology' = import inputs.nix-topology {
          pkgs = import nixpkgs {
            inherit system;
            overlays = [
              inputs.nix-topology.overlays.default
              (final: prev: {
                inherit (nixpkgs-unstable.legacyPackages.${system}) super-tiny-icons;
              })
            ];
          };
          specialArgs = {
            values = import ./values.nix;
          };
          modules = [
            ./topology
            {
              nixosConfigurations = lib.mapAttrs (_name: nixosCfg: nixosCfg.extendModules {
                modules = [
                  inputs.nix-topology.nixosModules.default
                  ./topology/service-extractors/greg-ng.nix
                  ./topology/service-extractors/postgresql.nix
                  ./topology/service-extractors/mysql.nix
                  ./topology/service-extractors/gitea-runners.nix
                ];
              }) self.nixosConfigurations;
            }
          ];
        };
      in {
        topology = topology'.config.output;
        topology-png = pkgs.runCommand "pvv-config-topology-png" {
          nativeBuildInputs = [ pkgs.writableTmpDirAsHomeHook ];
        } ''
          mkdir -p "$out"
          for file in '${topology'.config.output}'/*.svg; do
            ${lib.getExe pkgs.imagemagick} -density 300 -background none "$file" "$out"/"$(basename "''${file%.svg}.png")"
          done
        '';
      });
    };
  };
 }
--- a/hosts/bakke/configuration.nix
+++ b/hosts/bakke/configuration.nix
@@ -1,18 +0,0 @@
 { config, pkgs, values, ... }:
 {
  imports = [
      ./hardware-configuration.nix
      ../../base
      ./filesystems.nix
    ];
  networking.hostId = "99609ffc";
  systemd.network.networks."30-enp2s0" = values.defaultNetworkConfig // {
    matchConfig.Name = "enp2s0";
    address = with values.hosts.bakke; [ (ipv4 + "/25") (ipv6 + "/64") ];
  };
  # Don't change (even during upgrades) unless you know what you are doing.
  # See https://search.nixos.org/options?show=system.stateVersion
  system.stateVersion = "24.05";
 }
--- a/hosts/bakke/disks.nix
+++ b/hosts/bakke/disks.nix
@@ -1,83 +0,0 @@
 {
  # https://github.com/nix-community/disko/blob/master/example/boot-raid1.nix
  # Note: Disko was used to create the initial md raid, but is no longer in active use on this host.
  disko.devices = {
    disk = {
      one = {
        type = "disk";
        device = "/dev/disk/by-id/ata-WDC_WD40EFRX-68WT0N0_WD-WCC4E2EER6N6";
        content = {
          type = "gpt";
          partitions = {
            ESP = {
              size = "500M";
              type = "EF00";
              content = {
                type = "mdraid";
                name = "boot";
              };
            };
            mdadm = {
              size = "100%";
              content = {
                type = "mdraid";
                name = "raid1";
              };
            };
          };
        };
      };
      two = {
        type = "disk";
        device = "/dev/disk/by-id/ata-WDC_WD40EFRX-68WT0N0_WD-WCC4E7LPLU71";
        content = {
          type = "gpt";
          partitions = {
            ESP = {
              size = "500M";
              type = "EF00";
              content = {
                type = "mdraid";
                name = "boot";
              };
            };
            mdadm = {
              size = "100%";
              content = {
                type = "mdraid";
                name = "raid1";
              };
            };
          };
        };
      };
    };
    mdadm = {
      boot = {
        type = "mdadm";
        level = 1;
        metadata = "1.0";
        content = {
          type = "filesystem";
          format = "vfat";
          mountpoint = "/boot";
        };
      };
      raid1 = {
        type = "mdadm";
        level = 1;
        content = {
          type = "gpt";
          partitions.primary = {
            size = "100%";
            content = {
              type = "filesystem";
              format = "ext4";
              mountpoint = "/";
            };
          };
        };
      };
    };
  };
 }
--- a/hosts/bakke/filesystems.nix
+++ b/hosts/bakke/filesystems.nix
@@ -1,26 +0,0 @@
 { pkgs,... }:
 {
  # Boot drives:
  boot.swraid.enable = true;
  # ZFS Data pool:
  boot = {
    zfs = {
      extraPools = [ "tank" ];
      requestEncryptionCredentials = false;
    };
    supportedFilesystems.zfs = true;
    # Use stable linux packages, these work with zfs
    kernelPackages = pkgs.linuxPackages;
  };
  services.zfs.autoScrub = {
    enable = true;
    interval = "Wed *-*-8..14 00:00:00";
  };
  # NFS Exports:
  #TODO
  # NFS Import mounts:
  #TODO
 }
--- a/hosts/bakke/hardware-configuration.nix
+++ b/hosts/bakke/hardware-configuration.nix
@@ -1,52 +0,0 @@
 # Do not modify this file!  It was generated by 'nixos-generate-config'
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
 { config, lib, pkgs, modulesPath, ... }:
 {
  imports =
    [ (modulesPath + "/installer/scan/not-detected.nix")
    ];
  boot.initrd.availableKernelModules = [ "ehci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
  boot.initrd.kernelModules = [ ];
  boot.kernelModules = [ "kvm-intel" ];
  boot.extraModulePackages = [ ];
  fileSystems."/" =
    { device = "/dev/disk/by-uuid/0f63c3d2-fc12-4ed5-a5a5-141bfd67a571";
      fsType = "btrfs";
      options = [ "subvol=root" ];
    };
  fileSystems."/home" =
    { device = "/dev/disk/by-uuid/0f63c3d2-fc12-4ed5-a5a5-141bfd67a571";
      fsType = "btrfs";
      options = [ "subvol=home" ];
    };
  fileSystems."/nix" =
    { device = "/dev/disk/by-uuid/0f63c3d2-fc12-4ed5-a5a5-141bfd67a571";
      fsType = "btrfs";
      options = [ "subvol=nix" "noatime" ];
    };
  fileSystems."/boot" =
    { device = "/dev/sdc2";
      fsType = "vfat";
      options = [ "fmask=0022" "dmask=0022" ];
    };
  swapDevices = [ ];
  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
  # (the default) this is the recommended approach. When using systemd-networkd it's
  # still possible to use this option, but it's recommended to use it in conjunction
  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
  networking.useDHCP = lib.mkDefault false;
  # networking.interfaces.eno1.useDHCP = lib.mkDefault true;
  # networking.interfaces.enp2s0.useDHCP = lib.mkDefault true;
  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }
--- a/hosts/bekkalokk/configuration.nix
+++ b/hosts/bekkalokk/configuration.nix
@@ -4,11 +4,11 @@
    ./hardware-configuration.nix
    (fp /base)
    (fp /misc/metrics-exporters.nix)
-    ./services/alps.nix
+    ./services/bluemap/default.nix
    ./services/bluemap.nix
    ./services/idp-simplesamlphp
-    ./services/kerberos.nix
+    ./services/kerberos
    ./services/mediawiki
    ./services/nginx.nix
    ./services/phpfpm.nix
@@ -16,9 +16,18 @@
    ./services/webmail
    ./services/website
    ./services/well-known
    ./services/qotd
  ];
  sops.defaultSopsFile = fp /secrets/bekkalokk/bekkalokk.yaml;
  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
  sops.age.generateKey = true;
  boot.loader.systemd-boot.enable = true;
  boot.loader.efi.canTouchEfiVariables = true;
  networking.hostName = "bekkalokk";
  systemd.network.networks."30-enp2s0" = values.defaultNetworkConfig // {
    matchConfig.Name = "enp2s0";
    address = with values.hosts.bekkalokk; [ (ipv4 + "/25") (ipv6 + "/64") ];
@@ -26,7 +35,7 @@
  services.btrfs.autoScrub.enable = true;
-  # Don't change (even during upgrades) unless you know what you are doing.
+  # Do not change, even during upgrades.
  # See https://search.nixos.org/options?show=system.stateVersion
-  system.stateVersion = "25.11";
+  system.stateVersion = "22.11";
 }
--- a/hosts/bekkalokk/hardware-configuration.nix
+++ b/hosts/bekkalokk/hardware-configuration.nix
@@ -1,4 +1,4 @@
-# Do not modify this file!  It was generated by 'nixos-generate-config'
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
 { config, lib, pkgs, modulesPath, ... }:
--- a/hosts/bekkalokk/services/alps.nix
+++ b/hosts/bekkalokk/services/alps.nix
@@ -1,22 +0,0 @@
 { config, lib, ... }:
 let
  cfg = config.services.alps;
 in
 {
  services.alps = {
    enable = true;
    theme = "sourcehut";
    smtps.host = "smtp.pvv.ntnu.no";
    imaps.host = "imap.pvv.ntnu.no";
    bindIP = "127.0.0.1";
  };
  services.nginx.virtualHosts."alps.pvv.ntnu.no" = lib.mkIf cfg.enable {
    enableACME = true;
    forceSSL = true;
    kTLS = true;
    locations."/" = {
      proxyPass = "http://${cfg.bindIP}:${toString cfg.port}";
    };
  };
 }
--- a/hosts/bekkalokk/services/bluemap/default.nix
+++ b/hosts/bekkalokk/services/bluemap/default.nix
@@ -3,7 +3,10 @@ let
  vanillaSurvival = "/var/lib/bluemap/vanilla_survival_world";
  format = pkgs.formats.hocon { };
 in {
-  # NOTE: our versino of the module gets added in flake.nix
+  imports = [
    ./module.nix # From danio, pending upstreaming
  ];
  disabledModules = [ "services/web-apps/bluemap.nix" ];
  sops.secrets."bluemap/ssh-key" = { };
@@ -11,6 +14,7 @@ in {
  services.bluemap = {
    enable = true;
    package = pkgs.callPackage ./package.nix { };
    eula = true;
    onCalendar = "*-*-* 05:45:00"; # a little over an hour after auto-upgrade
@@ -21,101 +25,71 @@ in {
      inherit (inputs.minecraft-kartverket.packages.${pkgs.stdenv.hostPlatform.system}) bluemap-export;
    in {
      "verden" = {
        extraHoconMarkersFile = "${bluemap-export}/overworld.hocon";
        settings = {
          world = vanillaSurvival;
          dimension = "minecraft:overworld";
          name = "Verden";
          sorting = 0;
          start-pos = {
            x = 0;
            z = 0;
          };
          ambient-light = 0.1;
          cave-detection-ocean-floor = -5;
          marker-sets = {
            _includes = [ (format.lib.mkInclude "${bluemap-export}/overworld.hocon") ];
          };
        };
      };
      "underverden" = {
        extraHoconMarkersFile = "${bluemap-export}/nether.hocon";
        settings = {
-          world = vanillaSurvival;
+          world = "${vanillaSurvival}/DIM-1";
          dimension = "minecraft:the_nether";
          name = "Underverden";
          sorting = 100;
          start-pos = {
            x = 0;
            z = 0;
          };
          sky-color = "#290000";
          void-color = "#150000";
          sky-light = 1;
          ambient-light = 0.6;
          world-sky-light = 0;
          remove-caves-below-y = -10000;
          cave-detection-ocean-floor = -5;
          cave-detection-uses-block-light = true;
-          render-mask = [{
+          max-y = 90;
-            max-y = 90;
+          marker-sets = {
-          }];
+            _includes = [ (format.lib.mkInclude "${bluemap-export}/nether.hocon") ];
          };
        };
      };
      "enden" = {
        extraHoconMarkersFile = "${bluemap-export}/the-end.hocon";
        settings = {
-          world = vanillaSurvival;
+          world = "${vanillaSurvival}/DIM1";
          dimension = "minecraft:the_end";
          name = "Enden";
          sorting = 200;
          start-pos = {
            x = 0;
            z = 0;
          };
          sky-color = "#080010";
          void-color = "#080010";
          sky-light = 1;
          ambient-light = 0.6;
          world-sky-light = 0;
          remove-caves-below-y = -10000;
          cave-detection-ocean-floor = -5;
          marker-sets = {
            _includes = [ (format.lib.mkInclude "${bluemap-export}/the-end.hocon") ];
          };
        };
      };
    };
  };
  systemd.services."render-bluemap-maps" = {
    serviceConfig = {
      StateDirectory = [ "bluemap/world" ];
      ExecStartPre = let
        rsyncArgs = lib.cli.toCommandLineShellGNU { } {
          archive = true;
          compress = true;
          verbose = true;
          no-owner = true;
          no-group = true;
          rsh = "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=%d/ssh-known-hosts -i %d/sshkey";
        };
      in "${lib.getExe pkgs.rsync} ${rsyncArgs} root@innovation.pvv.ntnu.no:/ ${vanillaSurvival}";
      LoadCredential = [
        "sshkey:${config.sops.secrets."bluemap/ssh-key".path}"
        "ssh-known-hosts:${config.sops.secrets."bluemap/ssh-known-hosts".path}"
      ];
    };
  };
  services.nginx.virtualHosts."minecraft.pvv.ntnu.no" = {
    enableACME = true;
    forceSSL = true;
    kTLS = true;
    http3 = true;
    quic = true;
    http3_hq = true;
    extraConfig = ''
      # Enabling QUIC 0-RTT
      ssl_early_data on;
      quic_gso on;
      quic_retry on;
      add_header Alt-Svc 'h3=":$server_port"; ma=86400';
    '';
  };
-  networking.firewall.allowedUDPPorts = [ 443 ];
+  # TODO: render somewhere else lmao
  systemd.services."render-bluemap-maps" = {
    preStart = ''
      mkdir -p /var/lib/bluemap/world
      ${pkgs.rsync}/bin/rsync \
        -e "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=$CREDENTIALS_DIRECTORY/ssh-known-hosts -i $CREDENTIALS_DIRECTORY/sshkey" \
        -avz --no-owner --no-group \
        root@innovation.pvv.ntnu.no:/ \
        ${vanillaSurvival}
    '';
    serviceConfig = {
      LoadCredential = [
        "sshkey:${config.sops.secrets."bluemap/ssh-key".path}"
        "ssh-known-hosts:${config.sops.secrets."bluemap/ssh-known-hosts".path}"
      ];
    };
  };
 }
--- a/hosts/bekkalokk/services/bluemap/module.nix
+++ b/hosts/bekkalokk/services/bluemap/module.nix
@@ -13,32 +13,11 @@ let
        (format.generate "${name}.conf" value))
      cfg.storage);
-  generateMapConfigWithMarkerData = name: { extraHoconMarkersFile, settings, ... }:
+  mapsFolder = pkgs.linkFarm "maps"
-    assert (extraHoconMarkersFile == null) != ((settings.marker-sets or { }) == { });
+    (lib.attrsets.mapAttrs' (name: value:
-    lib.pipe settings (
+      lib.nameValuePair "${name}.conf"
-      (lib.optionals (extraHoconMarkersFile != null) [
+        (format.generate "${name}.conf" value.settings))
-        (settings: lib.recursiveUpdate settings {
+      cfg.maps);
          marker-placeholder = "###ASDF###";
        })
      ]) ++ [
        (format.generate "${name}.conf")
      ] ++ (lib.optionals (extraHoconMarkersFile != null) [
        (hoconFile: pkgs.runCommand "${name}-patched.conf" { } ''
          mkdir -p "$(dirname "$out")"
          cp '${hoconFile}' "$out"
          substituteInPlace "$out" \
            --replace-fail '"marker-placeholder" = "###ASDF###"' "\"marker-sets\" = $(cat '${extraHoconMarkersFile}')"
        '')
      ])
    );
  mapsFolder = lib.pipe cfg.maps [
    (lib.attrsets.mapAttrs' (name: value: {
      name = "${name}.conf";
      value = generateMapConfigWithMarkerData name value;
    }))
    (pkgs.linkFarm "maps")
  ];
  webappConfigFolder = pkgs.linkFarm "bluemap-config" {
    "maps" = mapsFolder;
@@ -46,18 +25,18 @@ let
    "core.conf" = coreConfig;
    "webapp.conf" = webappConfig;
    "webserver.conf" = webserverConfig;
-    "packs" = cfg.packs;
+    "packs" = cfg.resourcepacks;
  };
  renderConfigFolder = name: value: pkgs.linkFarm "bluemap-${name}-config" {
    "maps" = pkgs.linkFarm "maps" {
-      "${name}.conf" = generateMapConfigWithMarkerData name value;
+      "${name}.conf" = (format.generate "${name}.conf" value.settings);
    };
    "storages" = storageFolder;
    "core.conf" = coreConfig;
    "webapp.conf" = format.generate "webapp.conf" (cfg.webappSettings // { "update-settings-file" = false; });
    "webserver.conf" = webserverConfig;
-    "packs" = value.packs;
+    "packs" = value.resourcepacks;
  };
  inherit (lib) mkOption;
@@ -131,7 +110,7 @@ in {
          metrics = lib.mkEnableOption "Sending usage metrics containing the version of bluemap in use";
        };
      };
-      description = "Settings for the core.conf file, [see upstream docs](https://github.com/BlueMap-Minecraft/BlueMap/blob/master/common/src/main/resources/de/bluecolored/bluemap/config/core.conf).";
+      description = "Settings for the core.conf file, [see upstream docs](https://github.com/BlueMap-Minecraft/BlueMap/blob/master/BlueMapCommon/src/main/resources/de/bluecolored/bluemap/config/core.conf).";
    };
    webappSettings = mkOption {
@@ -148,7 +127,7 @@ in {
          webroot = config.services.bluemap.webRoot;
        }
      '';
-      description = "Settings for the webapp.conf file, see [upstream docs](https://github.com/BlueMap-Minecraft/BlueMap/blob/master/common/src/main/resources/de/bluecolored/bluemap/config/webapp.conf).";
+      description = "Settings for the webapp.conf file, see [upstream docs](https://github.com/BlueMap-Minecraft/BlueMap/blob/master/BlueMapCommon/src/main/resources/de/bluecolored/bluemap/config/webapp.conf).";
    };
    webserverSettings = mkOption {
@@ -168,31 +147,19 @@ in {
      default = { };
      description = ''
        Settings for the webserver.conf file, usually not required.
-        [See upstream docs](https://github.com/BlueMap-Minecraft/BlueMap/blob/master/common/src/main/resources/de/bluecolored/bluemap/config/webserver.conf).
+        [See upstream docs](https://github.com/BlueMap-Minecraft/BlueMap/blob/master/BlueMapCommon/src/main/resources/de/bluecolored/bluemap/config/webserver.conf).
      '';
    };
    maps = mkOption {
-      type = lib.types.attrsOf (lib.types.submodule ({ name, ... }: {
+      type = lib.types.attrsOf (lib.types.submodule {
        options = {
-          packs = mkOption {
+          resourcepacks = mkOption {
            type = lib.types.path;
-            default = cfg.packs;
+            default = cfg.resourcepacks;
-            defaultText = lib.literalExpression "config.services.bluemap.packs";
+            defaultText = lib.literalExpression "config.services.bluemap.resourcepacks";
-            description = "A set of resourcepacks, datapacks, and mods to extract resources from, loaded in alphabetical order.";
+            description = "A set of resourcepacks/mods/bluemap-addons to extract models from loaded in alphabetical order";
          };
          extraHoconMarkersFile = mkOption {
            type = lib.types.nullOr lib.types.path;
            default = null;
            description = ''
              Path to a hocon file containing marker data.
              The content of this file will be injected into the map config file in a separate derivation.
              DO NOT SEND THIS TO NIXPKGS, IT'S AN UGLY HACK.
            '';
          };
          settings = mkOption {
            type = (lib.types.submodule {
              freeformType = format.type;
@@ -201,74 +168,43 @@ in {
                  type = lib.types.path;
                  description = "Path to world folder containing the dimension to render";
                };
                name = mkOption {
                  type = lib.types.str;
                  description = "The display name of this map (how this map will be named on the webapp)";
                  default = name;
                  defaultText = lib.literalExpression "<name>";
                };
                render-mask = mkOption {
                  type = with lib.types; listOf (attrsOf format.type);
                  description = "Limits for the map render";
                  default = [ ];
                  example = [
                    {
                      min-x = -4000;
                      max-x = 4000;
                      min-z = -4000;
                      max-z = 4000;
                      min-y = 50;
                      max-y = 100;
                    }
                    {
                      subtract = true;
                      min-y = 90;
                      max-y = 127;
                    }
                  ];
                };
              };
            });
            description = ''
              Settings for files in `maps/`.
              See the default for an example with good options for the different world types.
-              For valid values [consult upstream docs](https://github.com/BlueMap-Minecraft/BlueMap/blob/master/common/src/main/resources/de/bluecolored/bluemap/config/maps/map.conf).
+              For valid values [consult upstream docs](https://github.com/BlueMap-Minecraft/BlueMap/blob/master/BlueMapCommon/src/main/resources/de/bluecolored/bluemap/config/maps/map.conf).
            '';
          };
        };
-      }));
+      });
      default = {
        "overworld".settings = {
-          world = cfg.defaultWorld;
+          world = "${cfg.defaultWorld}";
          dimension = "minecraft:overworld";
          name = "Overworld";
          ambient-light = 0.1;
          cave-detection-ocean-floor = -5;
        };
        "nether".settings = {
-          world = cfg.defaultWorld;
+          world = "${cfg.defaultWorld}/DIM-1";
          dimension = "minecraft:the_nether";
          name = "Nether";
          sorting = 100;
          sky-color = "#290000";
          void-color = "#150000";
          sky-light = 1;
          ambient-light = 0.6;
          world-sky-light = 0;
          remove-caves-below-y = -10000;
          cave-detection-ocean-floor = -5;
          cave-detection-uses-block-light = true;
          max-y = 90;
        };
        "end".settings = {
-          world = cfg.defaultWorld;
+          world = "${cfg.defaultWorld}/DIM1";
          dimension = "minecraft:the_end";
          name = "The End";
          sorting = 200;
          sky-color = "#080010";
          void-color = "#080010";
          sky-light = 1;
          ambient-light = 0.6;
          world-sky-light = 0;
          remove-caves-below-y = -10000;
          cave-detection-ocean-floor = -5;
        };
@@ -276,36 +212,31 @@ in {
      defaultText = lib.literalExpression ''
        {
          "overworld".settings = {
-            world = cfg.defaultWorld;
+            world = "''${cfg.defaultWorld}";
            name = "Overworld";
            dimension = "minecraft:overworld";
            ambient-light = 0.1;
            cave-detection-ocean-floor = -5;
          };
          "nether".settings = {
-            world = cfg.defaultWorld;
+            world = "''${cfg.defaultWorld}/DIM-1";
            dimension = "minecraft:the_nether";
            name = "Nether";
            sorting = 100;
            sky-color = "#290000";
            void-color = "#150000";
            sky-light = 1;
            ambient-light = 0.6;
            world-sky-light = 0;
            remove-caves-below-y = -10000;
            cave-detection-ocean-floor = -5;
            cave-detection-uses-block-light = true;
            max-y = 90;
          };
          "end".settings = {
-            world = cfg.defaultWorld;
+            world = "''${cfg.defaultWorld}/DIM1";
            name = "The End";
            dimension = "minecraft:the_end";
            sorting = 200;
            sky-color = "#080010";
            void-color = "#080010";
            sky-light = 1;
            ambient-light = 0.6;
            world-sky-light = 0;
            remove-caves-below-y = -10000;
            cave-detection-ocean-floor = -5;
          };
@@ -333,7 +264,7 @@ in {
      description = ''
        Where the rendered map will be stored.
        Unless you are doing something advanced you should probably leave this alone and configure webRoot instead.
-        [See upstream docs](https://github.com/BlueMap-Minecraft/BlueMap/tree/master/common/src/main/resources/de/bluecolored/bluemap/config/storages)
+        [See upstream docs](https://github.com/BlueMap-Minecraft/BlueMap/tree/master/BlueMapCommon/src/main/resources/de/bluecolored/bluemap/config/storages)
      '';
      default = {
        "file" = {
@@ -349,12 +280,12 @@ in {
      '';
    };
-    packs = mkOption {
+    resourcepacks = mkOption {
      type = lib.types.path;
-      default = pkgs.linkFarm "packs" { };
+      default = pkgs.linkFarm "resourcepacks" { };
      description = ''
-        A set of resourcepacks, datapacks, and mods to extract resources from, loaded in alphabetical order.
+        A set of resourcepacks/mods to extract models from loaded in alphabetical order.
-        Can be overriden on a per-map basis with `services.bluemap.maps.<name>.packs`.
+        Can be overriden on a per-map basis with `services.bluemap.maps.<name>.resourcepacks`.
      '';
    };
  };
@@ -375,23 +306,21 @@ in {
    systemd.services."render-bluemap-maps" = lib.mkIf cfg.enableRender {
      serviceConfig = {
        Type = "oneshot";
        CPUSchedulingPolicy = "batch";
        Group = "nginx";
        UMask = "026";
        ExecStart = [
          # If web folder doesnt exist generate it
          ''|test -f "${cfg.webRoot}" || ${lib.getExe cfg.package} -c ${webappConfigFolder} -gs''
        ]
        ++
          # Render each minecraft map
          lib.attrsets.mapAttrsToList
            (name: value: "${lib.getExe cfg.package} -c ${renderConfigFolder name value} -r")
            cfg.maps
        ++ [
          # Generate updated webapp
          "${lib.getExe cfg.package} -c ${webappConfigFolder} -gs"
        ];
      };
      script = ''
        # If web folder doesnt exist generate it
        test -f "${cfg.webRoot}" || ${lib.getExe cfg.package} -c ${webappConfigFolder} -gs
        # Render each minecraft map
        ${lib.strings.concatStringsSep "\n" (lib.attrsets.mapAttrsToList
          (name: value: "${lib.getExe cfg.package} -c ${renderConfigFolder name value} -r")
          cfg.maps)}
        # Generate updated webapp
        ${lib.getExe cfg.package} -c ${webappConfigFolder} -gs
      '';
    };
    systemd.timers."render-bluemap-maps" = lib.mkIf cfg.enableRender {
--- a/hosts/bekkalokk/services/bluemap/package.nix
+++ b/hosts/bekkalokk/services/bluemap/package.nix
@@ -0,0 +1,30 @@
 { lib, stdenvNoCC, fetchurl, makeWrapper, jre }:
 stdenvNoCC.mkDerivation rec {
  pname = "bluemap";
  version = "5.7";
  src = fetchurl {
    url = "https://github.com/BlueMap-Minecraft/BlueMap/releases/download/v${version}/BlueMap-${version}-cli.jar";
    hash = "sha256-8udZYJgrr4bi2mjRYrASd8JwUoUVZW1tZpOLRgafAIw=";
  };
  dontUnpack = true;
  nativeBuildInputs = [ makeWrapper ];
  installPhase = ''
    runHook preInstall
    makeWrapper ${jre}/bin/java $out/bin/bluemap --add-flags "-jar $src"
    runHook postInstall
  '';
  meta = {
    description = "3D minecraft map renderer";
    homepage = "https://bluemap.bluecolored.de/";
    sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ dandellion h7x4 ];
    mainProgram = "bluemap";
  };
 }
--- a/hosts/bekkalokk/services/kerberos/default.nix
+++ b/hosts/bekkalokk/services/kerberos/default.nix
--- a/hosts/bekkalokk/services/kerberos/krb5-conf-format.nix
+++ b/hosts/bekkalokk/services/kerberos/krb5-conf-format.nix
@@ -0,0 +1,88 @@
 { pkgs, lib, ... }:
 # Based on
 # - https://web.mit.edu/kerberos/krb5-1.12/doc/admin/conf_files/krb5_conf.html
 # - https://manpages.debian.org/unstable/heimdal-docs/krb5.conf.5heimdal.en.html
 let
  inherit (lib) boolToString concatMapStringsSep concatStringsSep filter
    isAttrs isBool isList mapAttrsToList mdDoc mkOption singleton splitString;
  inherit (lib.types) attrsOf bool coercedTo either int listOf oneOf path
    str submodule;
 in
 { }: {
  type = let
    section = attrsOf relation;
    relation = either (attrsOf value) value;
    value = either (listOf atom) atom;
    atom = oneOf [int str bool];
  in submodule {
    freeformType = attrsOf section;
    options = {
      include = mkOption {
        default = [ ];
        description = mdDoc ''
          Files to include in the Kerberos configuration.
        '';
        type = coercedTo path singleton (listOf path);
      };
      includedir = mkOption {
        default = [ ];
        description = mdDoc ''
          Directories containing files to include in the Kerberos configuration.
        '';
        type = coercedTo path singleton (listOf path);
      };
      module = mkOption {
        default = [ ];
        description = mdDoc ''
          Modules to obtain Kerberos configuration from.
        '';
        type = coercedTo path singleton (listOf path);
      };
    };
  };
  generate = let
    indent = str: concatMapStringsSep "\n" (line: "  " + line) (splitString "\n" str);
    formatToplevel = args @ {
      include ? [ ],
      includedir ? [ ],
      module ? [ ],
      ...
    }: let
      sections = removeAttrs args [ "include" "includedir" "module" ];
    in concatStringsSep "\n" (filter (x: x != "") [
      (concatStringsSep "\n" (mapAttrsToList formatSection sections))
      (concatMapStringsSep "\n" (m: "module ${m}") module)
      (concatMapStringsSep "\n" (i: "include ${i}") include)
      (concatMapStringsSep "\n" (i: "includedir ${i}") includedir)
    ]);
    formatSection = name: section: ''
      [${name}]
      ${indent (concatStringsSep "\n" (mapAttrsToList formatRelation section))}
    '';
    formatRelation = name: relation:
      if isAttrs relation
      then ''
        ${name} = {
        ${indent (concatStringsSep "\n" (mapAttrsToList formatValue relation))}
        }''
      else formatValue name relation;
    formatValue = name: value:
      if isList value
      then concatMapStringsSep "\n" (formatAtom name) value
      else formatAtom name value;
    formatAtom = name: atom: let
      v = if isBool atom then boolToString atom else toString atom;
    in "${name} = ${v}";
  in
    name: value: pkgs.writeText name ''
      ${formatToplevel value}
    '';
 }
--- a/hosts/bekkalokk/services/kerberos/krb5.nix
+++ b/hosts/bekkalokk/services/kerberos/krb5.nix
@@ -0,0 +1,90 @@
 { config, lib, pkgs, ... }:
 let
  inherit (lib) mdDoc mkIf mkOption mkPackageOption mkRemovedOptionModule;
  inherit (lib.types) bool;
  mkRemovedOptionModule' = name: reason: mkRemovedOptionModule ["krb5" name] reason;
  mkRemovedOptionModuleCfg = name: mkRemovedOptionModule' name ''
    The option `krb5.${name}' has been removed. Use
    `security.krb5.settings.${name}' for structured configuration.
  '';
  cfg = config.security.krb5;
  format = import ./krb5-conf-format.nix { inherit pkgs lib; } { };
 in {
  imports = [
    (mkRemovedOptionModuleCfg "libdefaults")
    (mkRemovedOptionModuleCfg "realms")
    (mkRemovedOptionModuleCfg "domain_realm")
    (mkRemovedOptionModuleCfg "capaths")
    (mkRemovedOptionModuleCfg "appdefaults")
    (mkRemovedOptionModuleCfg "plugins")
    (mkRemovedOptionModuleCfg "config")
    (mkRemovedOptionModuleCfg "extraConfig")
    (mkRemovedOptionModule' "kerberos" ''
      The option `krb5.kerberos' has been moved to `security.krb5.package'.
    '')
  ];
  options = {
    security.krb5 = {
      enable = mkOption {
        default = false;
        description = mdDoc "Enable and configure Kerberos utilities";
        type = bool;
      };
      package = mkPackageOption pkgs "krb5" {
        example = "heimdal";
      };
      settings = mkOption {
        default = { };
        type = format.type;
        description = mdDoc ''
          Structured contents of the {file}`krb5.conf` file. See
          {manpage}`krb5.conf(5)` for details about configuration.
        '';
        example = {
          include = [ "/run/secrets/secret-krb5.conf" ];
          includedir = [ "/run/secrets/secret-krb5.conf.d" ];
          libdefaults = {
            default_realm = "ATHENA.MIT.EDU";
          };
          realms = {
            "ATHENA.MIT.EDU" = {
              admin_server = "athena.mit.edu";
              kdc = [
                "athena01.mit.edu"
                "athena02.mit.edu"
              ];
            };
          };
          domain_realm = {
            "mit.edu" = "ATHENA.MIT.EDU";
          };
          logging = {
            kdc = "SYSLOG:NOTICE";
            admin_server = "SYSLOG:NOTICE";
            default = "SYSLOG:NOTICE";
          };
        };
      };
    };
  };
  config = mkIf cfg.enable {
    environment = {
      systemPackages = [ cfg.package ];
      etc."krb5.conf".source = format.generate "krb5.conf" cfg.settings;
    };
  };
  meta.maintainers = builtins.attrValues {
    inherit (lib.maintainers) dblsaiko h7x4;
  };
 }
--- a/hosts/bekkalokk/services/kerberos/pam.nix
+++ b/hosts/bekkalokk/services/kerberos/pam.nix
--- a/hosts/bekkalokk/services/mediawiki/default.nix
+++ b/hosts/bekkalokk/services/mediawiki/default.nix
@@ -1,4 +1,4 @@
-{ pkgs, lib, fp, config, values, ... }: let
+{ pkgs, lib, fp, config, values, pkgs-unstable, ... }: let
  cfg = config.services.mediawiki;
  # "mediawiki"
@@ -34,7 +34,6 @@ in {
  services.idp.sp-remote-metadata = [ "https://wiki.pvv.ntnu.no/simplesaml/" ];
  sops.secrets = lib.pipe [
    "mediawiki/secret-key"
    "mediawiki/password"
    "mediawiki/postgres_password"
    "mediawiki/simplesamlphp/postgres_password"
@@ -49,23 +48,6 @@ in {
    lib.listToAttrs
  ];
  services.rsync-pull-targets = {
    enable = true;
    locations.${cfg.uploadsDir} = {
      user = "root";
      rrsyncArgs.ro = true;
      authorizedKeysAttrs = [
        "restrict"
        "from=\"principal.pvv.ntnu.no,${values.hosts.principal.ipv6},${values.hosts.principal.ipv4}\""
        "no-agent-forwarding"
        "no-port-forwarding"
        "no-pty"
        "no-X11-forwarding"
      ];
      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICHFHa3Iq1oKPhbKCAIHgOoWOTkLmIc7yqxeTbut7ig/ mediawiki rsync backup";
    };
  };
  services.mediawiki = {
    enable = true;
    name = "Programvareverkstedet";
@@ -148,12 +130,6 @@ in {
      $wgVectorDefaultSidebarVisibleForAnonymousUser = true;
      $wgVectorResponsive = true;
      # Experimental dark mode support for Vector 2022
      $wgVectorNightMode['beta'] = true;
      $wgVectorNightMode['logged_out'] = true;
      $wgVectorNightMode['logged_in'] = true;
      $wgDefaultUserOptions['vector-theme'] = 'os';
      # Misc
      $wgEmergencyContact = "${cfg.passwordSender}";
      $wgUseTeX = false;
@@ -162,24 +138,6 @@ in {
      $wgDBserver = "${toString cfg.database.host}";
      $wgAllowCopyUploads = true;
      # Files
      $wgFileExtensions = [
        'bmp',
        'gif',
        'jpeg',
        'jpg',
        'mp3',
        'odg',
        'odp',
        'ods',
        'odt',
        'pdf',
        'png',
        'tiff',
        'webm',
        'webp',
      ];
      # Misc program paths
      $wgFFmpegLocation = '${pkgs.ffmpeg}/bin/ffmpeg';
      $wgExiftool = '${pkgs.exiftool}/bin/exiftool';
@@ -215,15 +173,15 @@ in {
  # Cache directory for simplesamlphp
  # systemd.services.phpfpm-mediawiki.serviceConfig.CacheDirectory = "mediawiki/simplesamlphp";
-  systemd.tmpfiles.settings."10-mediawiki"."/var/cache/mediawiki/simplesamlphp".d = lib.mkIf cfg.enable {
+  systemd.tmpfiles.settings."10-mediawiki"."/var/cache/mediawiki/simplesamlphp".d = {
    user = "mediawiki";
    group = "mediawiki";
    mode = "0770";
  };
-  users.groups.mediawiki.members = lib.mkIf cfg.enable [ "nginx" ];
+  users.groups.mediawiki.members = [ "nginx" ];
-  services.nginx.virtualHosts."wiki.pvv.ntnu.no" = lib.mkIf cfg.enable {
+  services.nginx.virtualHosts."wiki.pvv.ntnu.no" = {
    kTLS = true;
    forceSSL = true;
    enableACME = true;
@@ -269,22 +227,4 @@ in {
    };
  };
  systemd.services.mediawiki-init = lib.mkIf cfg.enable {
    after = [ "sops-install-secrets.service" ];
    serviceConfig = {
      BindReadOnlyPaths = [ "/run/credentials/mediawiki-init.service/secret-key:/var/lib/mediawiki/secret.key" ];
      LoadCredential = [ "secret-key:${config.sops.secrets."mediawiki/secret-key".path}" ];
      UMask = lib.mkForce "0007";
    };
  };
  systemd.services.phpfpm-mediawiki = lib.mkIf cfg.enable {
    after = [ "sops-install-secrets.service" ];
    serviceConfig = {
      BindReadOnlyPaths = [ "/run/credentials/phpfpm-mediawiki.service/secret-key:/var/lib/mediawiki/secret.key" ];
      LoadCredential = [ "secret-key:${config.sops.secrets."mediawiki/secret-key".path}" ];
      UMask = lib.mkForce "0007";
    };
  };
 }
--- a/hosts/bekkalokk/services/qotd/default.nix
+++ b/hosts/bekkalokk/services/qotd/default.nix
@@ -1,6 +0,0 @@
 {
  services.qotd = {
    enable = true;
    quotes = builtins.fromJSON (builtins.readFile ./quotes.json);
  };
 }
--- a/hosts/bekkalokk/services/qotd/quotes.json
+++ b/hosts/bekkalokk/services/qotd/quotes.json
@@ -1 +0,0 @@
 ["quote 1", "quote 2"]
--- a/hosts/bekkalokk/services/vaultwarden.nix
+++ b/hosts/bekkalokk/services/vaultwarden.nix
@@ -1,4 +1,4 @@
-{ config, pkgs, lib, values, ... }:
+{ config, pkgs, lib, ... }:
 let
  cfg = config.services.vaultwarden;
  domain = "pw.pvv.ntnu.no";
@@ -99,21 +99,4 @@ in {
      ];
    };
  };
  services.rsync-pull-targets = {
    enable = true;
    locations."/var/lib/vaultwarden" = {
      user = "root";
      rrsyncArgs.ro = true;
      authorizedKeysAttrs = [
        "restrict"
        "from=\"principal.pvv.ntnu.no,${values.hosts.principal.ipv6},${values.hosts.principal.ipv4}\""
        "no-agent-forwarding"
        "no-port-forwarding"
        "no-pty"
        "no-X11-forwarding"
      ];
      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB2cDaW52gBtLVaNqoGijvN2ZAVkAWlII5AXUzT3Dswj vaultwarden rsync backup";
    };
  };
 }
--- a/hosts/bekkalokk/services/webmail/snappymail.nix
+++ b/hosts/bekkalokk/services/webmail/snappymail.nix
@@ -1,4 +1,4 @@
-{ config, lib, fp, pkgs, values, ... }:
+{ config, lib, fp, pkgs, ... }:
 let
  cfg = config.services.snappymail;
 in {
@@ -14,21 +14,5 @@ in {
    enableACME = true;
    kTLS = true;
  };
  services.rsync-pull-targets = {
    enable = true;
    locations.${cfg.dataDir} = {
      user = "root";
      rrsyncArgs.ro = true;
      authorizedKeysAttrs = [
        "restrict"
        "from=\"principal.pvv.ntnu.no,${values.hosts.principal.ipv6},${values.hosts.principal.ipv4}\""
        "no-agent-forwarding"
        "no-port-forwarding"
        "no-pty"
        "no-X11-forwarding"
      ];
      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJENMnuNsHEeA91oX+cj7Qpex2defSXP/lxznxCAqV03 snappymail rsync backup";
    };
  };
 }
--- a/hosts/bekkalokk/services/website/default.nix
+++ b/hosts/bekkalokk/services/website/default.nix
@@ -18,16 +18,11 @@ in {
    restartUnits = [ "phpfpm-pvv-nettsiden.service" ];
  });
  security.acme.certs."www.pvv.ntnu.no" = {
    extraDomainNames = [
      "pvv.ntnu.no"
      "www.pvv.org"
      "pvv.org"
    ];
  };
  services.idp.sp-remote-metadata = [
    "https://www.pvv.ntnu.no/simplesaml/"
    "https://pvv.ntnu.no/simplesaml/"
    "https://www.pvv.org/simplesaml/"
    "https://pvv.org/simplesaml/"
  ];
  services.pvv-nettsiden = {
@@ -60,8 +55,10 @@ in {
      DOOR_SECRET = includeFromSops "door_secret";
      DB = {
-        DSN = "mysql:dbname=www-data_nettside;host=mysql.pvv.ntnu.no";
+        # DSN = "mysql:dbname=www-data_nettside;host=mysql.pvv.ntnu.no";
-        USER = "www-data_nettsi";
+        # USER = "www-data_nettsi";
        DSN = "pgsql:dbname=pvv_nettsiden;host=postgres.pvv.ntnu.no";
        USER = "pvv_nettsiden";
        PASS = includeFromSops "mysql_password";
      };
@@ -74,39 +71,28 @@ in {
        ADMIN_PASSWORD = includeFromSops "simplesamlphp/admin_password";
        TRUSTED_DOMAINS = [
          "www.pvv.ntnu.no"
          "pvv.ntnu.no"
          "www.pvv.org"
          "pvv.org"
        ];
      };
    };
  };
  services.phpfpm.pools."pvv-nettsiden".settings = {
-    # "php_admin_value[error_log]" = "stderr";
+    "php_flag[display_errors]" = true;
    "php_admin_value[error_log]" = "syslog";
    "php_admin_flag[log_errors]" = true;
    "catch_workers_output" = true;
  };
  services.nginx.virtualHosts."pvv.ntnu.no" = {
    globalRedirect = cfg.domainName;
    redirectCode = 307;
    forceSSL = true;
    useACMEHost = "www.pvv.ntnu.no";
  };
  services.nginx.virtualHosts."www.pvv.org" = {
    globalRedirect = cfg.domainName;
    redirectCode = 307;
    forceSSL = true;
    useACMEHost = "www.pvv.ntnu.no";
  };
  services.nginx.virtualHosts."pvv.org" = {
    globalRedirect = cfg.domainName;
    redirectCode = 307;
    forceSSL = true;
    useACMEHost = "www.pvv.ntnu.no";
  };
  services.nginx.virtualHosts.${cfg.domainName} = {
    serverAliases = [
      "pvv.ntnu.no"
      "www.pvv.org"
      "pvv.org"
    ];
    locations = {
      # Proxy home directories
      "^~ /~" = {
--- a/hosts/bekkalokk/services/website/fetch-gallery.nix
+++ b/hosts/bekkalokk/services/website/fetch-gallery.nix
@@ -1,30 +1,15 @@
-{ pkgs, lib, config, values, ... }:
+{ pkgs, lib, config, ... }:
 let
  galleryDir = config.services.pvv-nettsiden.settings.GALLERY.DIR;
  transferDir = "${config.services.pvv-nettsiden.settings.GALLERY.DIR}-transfer";
 in {
  users.users.${config.services.pvv-nettsiden.user} = {
    # NOTE: the user unfortunately needs a registered shell for rrsync to function...
    #       is there anything we can do to remove this?
    useDefaultShell = true;
  };
-  # This is pushed from microbel:/var/www/www-gallery/build-gallery.sh
+    # This is pushed from microbel:/var/www/www-gallery/build-gallery.sh
-  services.rsync-pull-targets = {
+    openssh.authorizedKeys.keys = [
-    enable = true;
+    ''command="${pkgs.rrsync}/bin/rrsync -wo ${transferDir}",restrict,no-agent-forwarding,no-port-forwarding,no-pty,no-X11-forwarding ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIjHhC2dikhWs/gG+m7qP1eSohWzTehn4ToNzDSOImyR gallery-publish''
-    locations.${transferDir} = {
+    ];
      user = config.services.pvv-nettsiden.user;
      rrsyncArgs.wo = true;
      authorizedKeysAttrs = [
        "restrict"
        "from=\"microbel.pvv.ntnu.no,${values.hosts.microbel.ipv6},${values.hosts.microbel.ipv4}\""
        "no-agent-forwarding"
        "no-port-forwarding"
        "no-pty"
        "no-X11-forwarding"
      ];
      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIjHhC2dikhWs/gG+m7qP1eSohWzTehn4ToNzDSOImyR gallery-publish";
    };
  };
  systemd.paths.pvv-nettsiden-gallery-update = {
@@ -47,8 +32,8 @@ in {
      }}
      # Delete files and directories that exists in the gallery that don't exist in the tarball
-      filesToRemove=$(uniq -u <(sort <(find . -not -path "./.thumbnails*") <(tar -tf "${transferDir}/gallery.tar.gz" | sed 's|/$||')))
+      filesToRemove=$(uniq -u <(sort <(find . -not -path "./.thumbnails*") <(tar -tf ${transferDir}/gallery.tar.gz | sed 's|/$||')))
-      while IFS= read -r fname; do
+      while IFS= read fname; do
        rm -f "$fname" ||:
        rm -f ".thumbnails/$fname.png" ||:
      done <<< "$filesToRemove"
@@ -58,7 +43,7 @@ in {
      mkdir -p .thumbnails
      images=$(find . -type f -not -path "./.thumbnails*")
-      while IFS= read -r fname; do
+      while IFS= read fname; do
        # Skip this file if an up-to-date thumbnail already exists
        if [ -f ".thumbnails/$fname.png" ] && \
          [ "$(date -R -r "$fname")" == "$(date -R -r ".thumbnails/$fname.png")" ]
@@ -67,7 +52,7 @@ in {
        fi
        echo "Creating thumbnail for $fname"
-        mkdir -p "$(dirname ".thumbnails/$fname")"
+        mkdir -p $(dirname ".thumbnails/$fname")
        magick -define jpeg:size=200x200 "$fname" -thumbnail 300 -auto-orient ".thumbnails/$fname.png" ||:
        touch -m -d "$(date -R -r "$fname")" ".thumbnails/$fname.png"
      done <<< "$images"
--- a/hosts/bekkalokk/services/well-known/default.nix
+++ b/hosts/bekkalokk/services/well-known/default.nix
@@ -1,25 +1,18 @@
-{ lib, ... }:
+{ ... }:
 {
-  services.nginx.virtualHosts = lib.genAttrs [
+  services.nginx.virtualHosts."www.pvv.ntnu.no".locations = {
-    "pvv.ntnu.no"
+    "^~ /.well-known/" = {
-    "www.pvv.ntnu.no"
+      alias = (toString ./root) + "/";
    "pvv.org"
    "www.pvv.org"
  ] (_: {
    locations = {
      "^~ /.well-known/" = {
        alias = (toString ./root) + "/";
      };
      # Proxy the matrix well-known files
      # Host has be set before proxy_pass
      # The header must be set so nginx on the other side routes it to the right place
      "^~ /.well-known/matrix/" = {
        extraConfig = ''
          proxy_set_header Host matrix.pvv.ntnu.no;
          proxy_pass https://matrix.pvv.ntnu.no/.well-known/matrix/;
        '';
      };
    };
-  });
+
    # Proxy the matrix well-known files
    # Host has be set before proxy_pass
    # The header must be set so nginx on the other side routes it to the right place
    "^~ /.well-known/matrix/" = {
      extraConfig = ''
        proxy_set_header Host matrix.pvv.ntnu.no;
        proxy_pass https://matrix.pvv.ntnu.no/.well-known/matrix/;
      '';
    };
  };
 }
--- a/hosts/bekkalokk/services/well-known/root/security.txt
+++ b/hosts/bekkalokk/services/well-known/root/security.txt
@@ -6,11 +6,7 @@ Contact: mailto:cert@pvv.ntnu.no
 Preferred-Languages: no, en
 Expires: 2032-12-31T23:59:59.000Z
-# This file was last updated 2026-02-27.
+# This file was last updated 2024-09-14.
 # You can find a wikipage for our security policies at:
 # https://wiki.pvv.ntnu.no/wiki/CERT
 # Please note that we are a student organization, and unfortunately we do not
 # have a bug bounty program or offer monetary compensation for disclosure of
 # security vulnerabilities.
--- a/hosts/bicep/configuration.nix
+++ b/hosts/bicep/configuration.nix
@@ -4,17 +4,28 @@
    ./hardware-configuration.nix
    (fp /base)
    (fp /misc/metrics-exporters.nix)
    ./services/nginx
    ./services/calendar-bot.nix
    #./services/git-mirrors
-    ./services/minecraft-heatmap.nix
+    #./services/minecraft-heatmap.nix
-    ./services/mysql
+    ./services/mysql.nix
-    ./services/postgresql
+    ./services/postgres.nix
    ./services/matrix
  ];
  sops.defaultSopsFile = fp /secrets/bicep/bicep.yaml;
  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
  sops.age.generateKey = true;
  boot.loader.systemd-boot.enable = true;
  boot.loader.efi.canTouchEfiVariables = true;
  networking.hostName = "bicep";
  #systemd.network.networks."30-enp6s0f0" = values.defaultNetworkConfig // {
  systemd.network.networks."30-ens18" = values.defaultNetworkConfig // {
    #matchConfig.Name = "enp6s0f0";
@@ -26,9 +37,17 @@
    anyInterface = true;
  };
  # There are no smart devices
  services.smartd.enable = false;
  # we are a vm now
  services.qemuGuest.enable = true;
-  # Don't change (even during upgrades) unless you know what you are doing.
+  # Enable the OpenSSH daemon.
  services.openssh.enable = true;
  services.sshguard.enable = true;
  # Do not change, even during upgrades.
  # See https://search.nixos.org/options?show=system.stateVersion
-  system.stateVersion = "25.11";
+  system.stateVersion = "22.11";
 }
--- a/hosts/bicep/hardware-configuration.nix
+++ b/hosts/bicep/hardware-configuration.nix
@@ -1,4 +1,4 @@
-# Do not modify this file!  It was generated by 'nixos-generate-config'
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
 { config, lib, pkgs, modulesPath, ... }:
--- a/hosts/bicep/services/git-mirrors/default.nix
+++ b/hosts/bicep/services/git-mirrors/default.nix
@@ -66,7 +66,6 @@ in
      package = pkgs.callPackage (fp /packages/cgit.nix) { };
      group = "gickup";
      scanPath = "${cfg.dataDir}/linktree";
      gitHttpBackend.checkExportOkFiles = false;
      settings = {
        enable-commit-graph = true;
        enable-follow-links = true;
--- a/hosts/bicep/services/matrix/coturn.nix
+++ b/hosts/bicep/services/matrix/coturn.nix
@@ -1,26 +1,22 @@
 { config, lib, fp, pkgs, secrets, values, ... }:
 {
  sops.secrets."matrix/synapse/turnconfig" = {
    sopsFile = fp /secrets/bicep/matrix.yaml;
    key = "synapse/turnconfig";
    owner = config.users.users.matrix-synapse.name;
    group = config.users.users.matrix-synapse.group;
  };
  sops.secrets."matrix/coturn/static-auth-secret" = {
    sopsFile = fp /secrets/bicep/matrix.yaml;
    key = "coturn/static-auth-secret";
    owner = config.users.users.turnserver.name;
    group = config.users.users.turnserver.group;
    restartUnits = [ "coturn.service" ];
  };
  sops.templates."matrix-synapse-turnconfig" = {
    owner = config.users.users.matrix-synapse.name;
    group = config.users.users.matrix-synapse.group;
    content = ''
      turn_shared_secret: ${config.sops.placeholder."matrix/coturn/static-auth-secret"}
    '';
    restartUnits = [ "matrix-synapse.target" ];
  };
  services.matrix-synapse-next = {
    extraConfigFiles = [
-      config.sops.templates."matrix-synapse-turnconfig".path
+      config.sops.secrets."matrix/synapse/turnconfig".path
    ];
    settings = {
@@ -46,7 +42,7 @@
  security.acme.certs.${config.services.coturn.realm} = {
    email = "drift@pvv.ntnu.no";
-    listenHTTP = "${values.services.turn.ipv4}:80";
+    listenHTTP = "129.241.210.213:80";
    reloadServices = [ "coturn.service" ];
  };
--- a/hosts/bicep/services/matrix/default.nix
+++ b/hosts/bicep/services/matrix/default.nix
@@ -1,17 +1,19 @@
 { config, ... }:
 {
  imports = [
    ./synapse-admin.nix
    ./synapse-auto-compressor.nix
    ./synapse.nix
    ./synapse-admin.nix
    ./element.nix
    ./coturn.nix
    ./livekit.nix
    ./mjolnir.nix
    ./well-known.nix
    # ./discord.nix
    ./out-of-your-element.nix
    ./hookshot
  ];
 }
--- a/hosts/bicep/services/matrix/element.nix
+++ b/hosts/bicep/services/matrix/element.nix
@@ -2,13 +2,6 @@
 let
  synapse-cfg = config.services.matrix-synapse-next;
 in {
  services.pvv-matrix-well-known.client = {
    "m.homeserver" = {
      base_url = "https://matrix.pvv.ntnu.no";
      server_name = "pvv.ntnu.no";
    };
  };
  services.nginx.virtualHosts."chat.pvv.ntnu.no" = {
    enableACME = true;
    forceSSL = true;
@@ -16,10 +9,10 @@ in {
    root = pkgs.element-web.override {
      conf = {
-        # Tries to look up well-known first, else uses bundled config.
+        default_server_config."m.homeserver" = {
-        default_server_name = "matrix.pvv.ntnu.no";
+          base_url = "https://matrix.pvv.ntnu.no";
-        default_server_config = config.services.pvv-matrix-well-known.client;
+          server_name = "pvv.ntnu.no";
-
+        };
        disable_3pid_login = true;
 #        integrations_ui_url = "https://dimension.dodsorf.as/riot";
 #        integrations_rest_url = "https://dimension.dodsorf.as/api/v1/scalar";
@@ -37,7 +30,6 @@ in {
          # element call group calls
          feature_group_calls = true;
        };
        default_country_code = "NO";
        default_theme = "dark";
        # Servers in this list should provide some sort of valuable scoping
        # matrix.org is not useful compared to matrixrooms.info,
--- a/hosts/bicep/services/matrix/hookshot/default.nix
+++ b/hosts/bicep/services/matrix/hookshot/default.nix
@@ -14,15 +14,10 @@ in
    sopsFile = fp /secrets/bicep/matrix.yaml;
    key = "hookshot/hs_token";
  };
  sops.secrets."matrix/hookshot/passkey" = {
    sopsFile = fp /secrets/bicep/matrix.yaml;
    key = "hookshot/passkey";
  };
  sops.templates."hookshot-registration.yaml" = {
    owner = config.users.users.matrix-synapse.name;
    group = config.users.groups.keys-matrix-registrations.name;
    restartUnits = [ "matrix-hookshot.service" ];
    content = ''
      id: matrix-hookshot
      as_token: "${config.sops.placeholder."matrix/hookshot/as_token"}"
@@ -48,14 +43,9 @@ in
  };
  systemd.services.matrix-hookshot = {
-    serviceConfig = {
+    serviceConfig.SupplementaryGroups = [
-      SupplementaryGroups = [
+      config.users.groups.keys-matrix-registrations.name
-        config.users.groups.keys-matrix-registrations.name
+    ];
      ];
      LoadCredential = [
        "passkey.pem:${config.sops.secrets."matrix/hookshot/passkey".path}"
      ];
    };
  };
  services.matrix-hookshot = {
@@ -63,8 +53,6 @@ in
    package = unstablePkgs.matrix-hookshot;
    registrationFile = config.sops.templates."hookshot-registration.yaml".path;
    settings = {
      passFile = "/run/credentials/matrix-hookshot.service/passkey.pem";
      bridge = {
        bindAddress = "127.0.0.1";
        domain = "pvv.ntnu.no";
@@ -72,7 +60,6 @@ in
        mediaUrl = "https://matrix.pvv.ntnu.no";
        port = 9993;
      };
      listeners = [
        {
          bindAddress = webhookListenAddress;
@@ -85,7 +72,6 @@ in
          ];
        }
      ];
      generic = {
        enabled = true;
        outbound = true;
--- a/hosts/bicep/services/matrix/livekit.nix
+++ b/hosts/bicep/services/matrix/livekit.nix
@@ -1,67 +0,0 @@
 { config, lib, fp, ... }:
 let
  synapseConfig = config.services.matrix-synapse-next;
  matrixDomain = "matrix.pvv.ntnu.no";
  cfg = config.services.livekit;
 in
 {
  sops.secrets."matrix/livekit/keyfile/lk-jwt-service" = {
    sopsFile = fp /secrets/bicep/matrix.yaml;
    key = "livekit/keyfile/lk-jwt-service";
  };
  sops.templates."matrix-livekit-keyfile" = {
    restartUnits = [
      "livekit.service"
      "lk-jwt-service.service"
    ];
    content = ''
      lk-jwt-service: ${config.sops.placeholder."matrix/livekit/keyfile/lk-jwt-service"}
    '';
  };
  services.pvv-matrix-well-known.client = lib.mkIf cfg.enable {
    "org.matrix.msc4143.rtc_foci" = [{
      type = "livekit";
      livekit_service_url = "https://${matrixDomain}/livekit/jwt";
    }];
  };
  services.livekit = {
    enable = true;
    openFirewall = true;
    keyFile = config.sops.templates."matrix-livekit-keyfile".path;
    # NOTE: needed for ingress/egress workers
    # redis.createLocally = true;
    # settings.room.auto_create = false;
  };
  services.lk-jwt-service = lib.mkIf cfg.enable {
    enable = true;
    livekitUrl = "wss://${matrixDomain}/livekit/sfu";
    keyFile = config.sops.templates."matrix-livekit-keyfile".path;
  };
  systemd.services.lk-jwt-service.environment.LIVEKIT_FULL_ACCESS_HOMESERVERS = lib.mkIf cfg.enable matrixDomain;
  services.nginx.virtualHosts.${matrixDomain} = lib.mkIf cfg.enable {
    locations."^~ /livekit/jwt/" = {
      proxyPass = "http://localhost:${toString config.services.lk-jwt-service.port}/";
    };
    # TODO: load balance to multiple livekit ingress/egress workers
    locations."^~ /livekit/sfu/" = {
      proxyPass = "http://localhost:${toString config.services.livekit.settings.port}/";
      proxyWebsockets = true;
      extraConfig = ''
        proxy_send_timeout 120;
        proxy_read_timeout 120;
        proxy_buffering off;
        proxy_set_header Accept-Encoding gzip;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
      '';
    };
  };
 }
--- a/hosts/bicep/services/matrix/mjolnir.nix
+++ b/hosts/bicep/services/matrix/mjolnir.nix
@@ -6,7 +6,6 @@
    key = "mjolnir/access_token";
    owner = config.users.users.mjolnir.name;
    group = config.users.users.mjolnir.group;
    restartUnits = [ "mjolnir.service" ];
  };
  services.mjolnir = {
--- a/hosts/bicep/services/matrix/out-of-your-element.nix
+++ b/hosts/bicep/services/matrix/out-of-your-element.nix
@@ -9,22 +9,18 @@ in
    "matrix/ooye/as_token" = {
      sopsFile = fp /secrets/bicep/matrix.yaml;
      key = "ooye/as_token";
      restartUnits = [ "matrix-ooye.service" ];
    };
    "matrix/ooye/hs_token" = {
      sopsFile = fp /secrets/bicep/matrix.yaml;
      key = "ooye/hs_token";
      restartUnits = [ "matrix-ooye.service" ];
    };
    "matrix/ooye/discord_token" = {
      sopsFile = fp /secrets/bicep/matrix.yaml;
      key = "ooye/discord_token";
      restartUnits = [ "matrix-ooye.service" ];
    };
    "matrix/ooye/discord_client_secret" = {
      sopsFile = fp /secrets/bicep/matrix.yaml;
      key = "ooye/discord_client_secret";
      restartUnits = [ "matrix-ooye.service" ];
    };
  };
--- a/hosts/bicep/services/matrix/synapse-auto-compressor.nix
+++ b/hosts/bicep/services/matrix/synapse-auto-compressor.nix
@@ -1,56 +0,0 @@
 { config, lib, utils, ... }:
 let
  cfg = config.services.synapse-auto-compressor;
 in
 {
  services.synapse-auto-compressor = {
    # enable = true;
    postgresUrl = "postgresql://matrix-synapse@/synapse?host=/run/postgresql";
  };
  # NOTE: nixpkgs has some broken asserts, vendored the entire unit
  systemd.services.synapse-auto-compressor = {
    description = "synapse-auto-compressor";
    requires = [
      "postgresql.target"
    ];
    inherit (cfg) startAt;
    serviceConfig = {
      Type = "oneshot";
      DynamicUser = true;
      User = "matrix-synapse";
      PrivateTmp = true;
      ExecStart = utils.escapeSystemdExecArgs [
        "${cfg.package}/bin/synapse_auto_compressor"
        "-p"
        cfg.postgresUrl
        "-c"
        cfg.settings.chunk_size
        "-n"
        cfg.settings.chunks_to_compress
        "-l"
        (lib.concatStringsSep "," (map toString cfg.settings.levels))
      ];
      LockPersonality = true;
      MemoryDenyWriteExecute = true;
      NoNewPrivileges = true;
      PrivateDevices = true;
      PrivateMounts = true;
      PrivateUsers = true;
      RemoveIPC = true;
      RestrictNamespaces = true;
      RestrictRealtime = true;
      RestrictSUIDSGID = true;
      ProcSubset = "pid";
      ProtectProc = "invisible";
      ProtectSystem = "strict";
      ProtectHome = true;
      ProtectHostname = true;
      ProtectClock = true;
      ProtectKernelTunables = true;
      ProtectKernelModules = true;
      ProtectKernelLogs = true;
      ProtectControlGroups = true;
    };
  };
 }
--- a/hosts/bicep/services/matrix/synapse.nix
+++ b/hosts/bicep/services/matrix/synapse.nix
@@ -15,33 +15,11 @@ in {
    group = config.users.users.matrix-synapse.group;
  };
-  sops.secrets."matrix/synapse/user_registration/registration_shared_secret" = {
+  sops.secrets."matrix/synapse/user_registration" = {
    sopsFile = fp /secrets/bicep/matrix.yaml;
-    key = "synapse/user_registration/registration_shared_secret";
+    key = "synapse/signing_key";
  };
  sops.templates."matrix-synapse-user-registration" = {
    owner = config.users.users.matrix-synapse.name;
    group = config.users.users.matrix-synapse.group;
    content = ''
      registration_shared_secret: ${config.sops.placeholder."matrix/synapse/user_registration/registration_shared_secret"}
    '';
  };
  services.rsync-pull-targets = {
    enable = true;
    locations.${cfg.settings.media_store_path} = {
      user = "root";
      rrsyncArgs.ro = true;
      authorizedKeysAttrs = [
        "restrict"
        "from=\"principal.pvv.ntnu.no,${values.hosts.principal.ipv6},${values.hosts.principal.ipv4}\""
        "no-agent-forwarding"
        "no-port-forwarding"
        "no-pty"
        "no-X11-forwarding"
      ];
      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIASnjI9b3j4ZS3BL/D1ggHfws1BkE8iS0v0cGpEmbG+k matrix_media_store rsync backup";
    };
  };
  services.matrix-synapse-next = {
@@ -105,7 +83,7 @@ in {
      mau_stats_only = true;
      enable_registration = false;
-      registration_shared_secret_path = config.sops.templates."matrix-synapse-user-registration".path;
+      registration_shared_secret_path = config.sops.secrets."matrix/synapse/user_registration".path;
      password_config.enabled = true;
@@ -117,32 +95,6 @@ in {
        }
      ];
      experimental_features = {
        # MSC3266: Room summary API. Used for knocking over federation
        msc3266_enabled = true;
        # MSC4222 needed for syncv2 state_after. This allow clients to
        # correctly track the state of the room.
        msc4222_enabled = true;
      };
      # The maximum allowed duration by which sent events can be delayed, as
      # per MSC4140.
      max_event_delay_duration = "24h";
      rc_message = {
        # This needs to match at least e2ee key sharing frequency plus a bit of headroom
        # Note key sharing events are bursty
        per_second = 0.5;
        burst_count = 30;
      };
      rc_delayed_event_mgmt = {
        # This needs to match at least the heart-beat frequency plus a bit of headroom
        # Currently the heart-beat is every 5 seconds which translates into a rate of 0.2s
        per_second = 1;
        burst_count = 20;
      };
      trusted_key_servers = [
        { server_name = "matrix.org"; }
        { server_name = "dodsorf.as"; }
@@ -172,20 +124,29 @@ in {
        "fec0::/10"
        # NTNU
-        values.ntnu.ipv4-space
+        "129.241.0.0/16"
-        values.ntnu.ipv6-space
+        "2001:700:300::/44"
      ];
    };
  };
  services.redis.servers."".enable = true;
  services.pvv-matrix-well-known.server."m.server" = "matrix.pvv.ntnu.no:443";
  services.nginx.virtualHosts."matrix.pvv.ntnu.no" = lib.mkMerge [
  {
    kTLS = true;
  }
  {
    locations."/.well-known/matrix/server" = {
      return = ''
        200 '{"m.server": "matrix.pvv.ntnu.no:443"}'
      '';
      extraConfig = ''
        default_type application/json;
        add_header Access-Control-Allow-Origin *;
      '';
    };
  }
  {
    locations."/_synapse/admin" = {
      proxyPass = "http://$synapse_backend";
--- a/hosts/bicep/services/matrix/well-known.nix
+++ b/hosts/bicep/services/matrix/well-known.nix
@@ -1,44 +0,0 @@
 { config, pkgs, lib, ... }:
 let
  cfg = config.services.pvv-matrix-well-known;
  format = pkgs.formats.json { };
  matrixDomain = "matrix.pvv.ntnu.no";
 in
 {
  options.services.pvv-matrix-well-known = {
    client = lib.mkOption {
      type = lib.types.submodule { freeformType = format.type; };
      default = { };
      example = {
        "m.homeserver".base_url = "https://${matrixDomain}/";
      };
    };
    server = lib.mkOption {
      type = lib.types.submodule { freeformType = format.type; };
      default = { };
      example = {
        "m.server" = "https://${matrixDomain}/";
      };
    };
  };
  config = {
    services.nginx.virtualHosts.${matrixDomain} = {
      locations."= /.well-known/matrix/client" = lib.mkIf (cfg.client != { }) {
        alias = format.generate "nginx-well-known-matrix-server.json" cfg.client;
        extraConfig = ''
          default_type application/json;
          add_header Access-Control-Allow-Origin *;
        '';
      };
      locations."= /.well-known/matrix/server" = lib.mkIf (cfg.server != { }) {
        alias = format.generate "nginx-well-known-matrix-server.json" cfg.server;
        extraConfig = ''
          default_type application/json;
          add_header Access-Control-Allow-Origin *;
        '';
      };
    };
  };
 }
--- a/hosts/bicep/services/minecraft-heatmap.nix
+++ b/hosts/bicep/services/minecraft-heatmap.nix
@@ -22,7 +22,7 @@ in
    };
  };
-  systemd.services.minecraft-heatmap-ingest-logs = lib.mkIf cfg.enable {
+  systemd.services.minecraft-heatmap-ingest-logs = {
    serviceConfig.LoadCredential = [
      "sshkey:${config.sops.secrets."minecraft-heatmap/ssh-key/private".path}"
    ];
--- a/hosts/bicep/services/mysql/default.nix
+++ b/hosts/bicep/services/mysql/default.nix
@@ -1,11 +1,5 @@
-{ config, pkgs, lib, values, ... }:
+{ pkgs, lib, config, values, ... }:
 let
  cfg = config.services.mysql;
  dataDir = "/data/mysql";
 in
 {
  imports = [ ./backup.nix ];
  sops.secrets."mysql/password" = {
    owner = "mysql";
    group = "mysql";
@@ -15,7 +9,8 @@ in
  services.mysql = {
    enable = true;
-    package = pkgs.mariadb_118;
+    dataDir = "/data/mysql";
    package = pkgs.mariadb;
    settings = {
      mysqld = {
        # PVV allows a lot of connections at the same time
@@ -26,9 +21,6 @@ in
        # This was needed in order to be able to use all of the old users
        # during migration from knakelibrak to bicep in Sep. 2023
        secure_auth = 0;
        slow-query-log = 1;
        slow-query-log-file = "/var/log/mysql/mysql-slow.log";
      };
    };
@@ -44,31 +36,18 @@ in
    }];
  };
-  networking.firewall.allowedTCPPorts = lib.mkIf cfg.enable [ 3306 ];
+  services.mysqlBackup = {
-
+    enable = true;
-  systemd.tmpfiles.settings."10-mysql".${dataDir}.d = lib.mkIf cfg.enable {
+    location = "/var/lib/mysql/backups";
    inherit (cfg) user group;
    mode = "0700";
  };
-  systemd.services.mysql = lib.mkIf cfg.enable {
+  networking.firewall.allowedTCPPorts = [ 3306 ];
-    after = [
+
-      "systemd-tmpfiles-setup.service"
+  systemd.services.mysql.serviceConfig = {
-      "systemd-tmpfiles-resetup.service"
+    IPAddressDeny = "any";
    IPAddressAllow = [
      values.ipv4-space
      values.ipv6-space
    ];
    serviceConfig = {
      BindPaths = [ "${dataDir}:${cfg.dataDir}" ];
      LogsDirectory = "mysql";
      IPAddressDeny = "any";
      IPAddressAllow = [
        values.ipv4-space
        values.ipv6-space
        values.hosts.ildkule.ipv4
        values.hosts.ildkule.ipv6
      ];
    };
  };
 }
--- a/hosts/bicep/services/mysql/backup.nix
+++ b/hosts/bicep/services/mysql/backup.nix
@@ -1,83 +0,0 @@
 { config, lib, pkgs, values, ... }:
 let
  cfg = config.services.mysql;
  backupDir = "/data/mysql-backups";
 in
 {
  # services.mysqlBackup = lib.mkIf cfg.enable {
  #   enable = true;
  #   location = "/var/lib/mysql-backups";
  # };
  systemd.tmpfiles.settings."10-mysql-backups".${backupDir}.d = {
 	  user = "mysql";
 	  group = "mysql";
 	  mode = "700";
 	};
  services.rsync-pull-targets = lib.mkIf cfg.enable {
    enable = true;
    locations.${backupDir} = {
      user = "root";
      rrsyncArgs.ro = true;
      authorizedKeysAttrs = [
        "restrict"
        "from=\"principal.pvv.ntnu.no,${values.hosts.principal.ipv6},${values.hosts.principal.ipv4}\""
        "no-agent-forwarding"
        "no-port-forwarding"
        "no-pty"
        "no-X11-forwarding"
      ];
      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJgj55/7Cnj4cYMJ5sIkl+OwcGeBe039kXJTOf2wvo9j mysql rsync backup";
    };
  };
  # NOTE: instead of having the upstream nixpkgs postgres backup unit trigger
  #       another unit, it was easier to just make one ourselves.
  systemd.services."backup-mysql" = lib.mkIf cfg.enable {
    description = "Backup MySQL data";
    requires = [ "mysql.service" ];
    path = with pkgs; [
      cfg.package
      coreutils
      zstd
    ];
    script = let
      rotations = 2;
    in ''
      set -euo pipefail
      OUT_FILE="$STATE_DIRECTORY/mysql-dump-$(date --iso-8601).sql.zst"
      mysqldump --all-databases | zstd --compress -9 --rsyncable -o "$OUT_FILE"
      # NOTE: this needs to be a hardlink for rrsync to allow sending it
      rm "$STATE_DIRECTORY/mysql-dump-latest.sql.zst" ||:
      ln -T "$OUT_FILE" "$STATE_DIRECTORY/mysql-dump-latest.sql.zst"
      while [ "$(find "$STATE_DIRECTORY" -type f -printf '.' | wc -c)" -gt "${toString (rotations + 1)}" ]; do
        rm "$(find "$STATE_DIRECTORY" -type f -printf '%T+ %p\n' | sort | head -n 1 | cut -d' ' -f2)"
      done
    '';
    serviceConfig = {
      Type = "oneshot";
      User = "mysql";
      Group = "mysql";
      UMask = "0077";
      Nice = 19;
      IOSchedulingClass = "best-effort";
      IOSchedulingPriority = 7;
      StateDirectory = [ "mysql-backups" ];
      BindPaths = [ "${backupDir}:/var/lib/mysql-backups" ];
      # TODO: hardening
    };
    startAt = "*-*-* 02:15:00";
  };
 }
--- a/hosts/bicep/services/postgresql/default.nix
+++ b/hosts/bicep/services/postgresql/default.nix
@@ -1,20 +1,15 @@
-{ config, lib, pkgs, values, ... }:
+{ config, pkgs, ... }:
 let
  cfg = config.services.postgresql;
 in
 {
  imports = [ ./backup.nix ];
  services.postgresql = {
    enable = true;
-    package = pkgs.postgresql_18;
+    package = pkgs.postgresql_15;
    enableTCPIP = true;
    dataDir = "/data/postgresql";
    authentication = ''
-      host all all ${values.ipv4-space} md5
+      host all all 129.241.210.128/25 md5
-      host all all ${values.ipv6-space} md5
+      host all all 2001:700:300:1900::/64 md5
      host all all ${values.hosts.ildkule.ipv4}/32 md5
      host all all ${values.hosts.ildkule.ipv6}/32 md5
    '';
    # Hilsen https://pgconfigurator.cybertec-postgresql.com/
@@ -79,48 +74,25 @@ in
    };
  };
-  systemd.tmpfiles.settings."10-postgresql"."/data/postgresql".d = lib.mkIf cfg.enable {
+  systemd.services.postgresql.serviceConfig = {
-    user = config.systemd.services.postgresql.serviceConfig.User;
+    LoadCredential = [
-    group = config.systemd.services.postgresql.serviceConfig.Group;
+      "cert:/etc/certs/postgres.crt"
-    mode = "0700";
+      "key:/etc/certs/postgres.key"
  };
  systemd.services.postgresql-setup = lib.mkIf cfg.enable {
    after = [
      "systemd-tmpfiles-setup.service"
      "systemd-tmpfiles-resetup.service"
    ];
    serviceConfig = {
      LoadCredential = [
        "cert:/etc/certs/postgres.crt"
        "key:/etc/certs/postgres.key"
      ];
      BindPaths = [ "/data/postgresql:/var/lib/postgresql" ];
    };
  };
-  systemd.services.postgresql = lib.mkIf cfg.enable {
+  environment.snakeoil-certs."/etc/certs/postgres" = {
    after = [
      "systemd-tmpfiles-setup.service"
      "systemd-tmpfiles-resetup.service"
    ];
    serviceConfig = {
      LoadCredential = [
        "cert:/etc/certs/postgres.crt"
        "key:/etc/certs/postgres.key"
      ];
      BindPaths = [ "/data/postgresql:/var/lib/postgresql" ];
    };
  };
  environment.snakeoil-certs."/etc/certs/postgres" = lib.mkIf cfg.enable {
    owner = "postgres";
    group = "postgres";
    subject = "/C=NO/O=Programvareverkstedet/CN=postgres.pvv.ntnu.no/emailAddress=drift@pvv.ntnu.no";
  };
-  networking.firewall.allowedTCPPorts = lib.mkIf cfg.enable [ 5432 ];
+  networking.firewall.allowedTCPPorts = [ 5432 ];
-  networking.firewall.allowedUDPPorts = lib.mkIf cfg.enable [ 5432 ];
+  networking.firewall.allowedUDPPorts = [ 5432 ];
  services.postgresqlBackup = {
    enable = true;
    location = "/var/lib/postgres/backups";
    backupAll = true;
  };
 }
--- a/hosts/bicep/services/postgresql/backup.nix
+++ b/hosts/bicep/services/postgresql/backup.nix
@@ -1,84 +0,0 @@
 { config, lib, pkgs, values, ... }:
 let
  cfg = config.services.postgresql;
  backupDir = "/data/postgresql-backups";
 in
 {
  # services.postgresqlBackup = lib.mkIf cfg.enable {
  #   enable = true;
  #   location = "/var/lib/postgresql-backups";
  #   backupAll = true;
  # };
  systemd.tmpfiles.settings."10-postgresql-backups".${backupDir}.d = {
 	  user = "postgres";
 	  group = "postgres";
 	  mode = "700";
 	};
  services.rsync-pull-targets = lib.mkIf cfg.enable {
    enable = true;
    locations.${backupDir} = {
      user = "root";
      rrsyncArgs.ro = true;
      authorizedKeysAttrs = [
        "restrict"
        "from=\"principal.pvv.ntnu.no,${values.hosts.principal.ipv6},${values.hosts.principal.ipv4}\""
        "no-agent-forwarding"
        "no-port-forwarding"
        "no-pty"
        "no-X11-forwarding"
      ];
      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGvO7QX7QmwSiGLXEsaxPIOpAqnJP3M+qqQRe5dzf8gJ postgresql rsync backup";
    };
  };
  # NOTE: instead of having the upstream nixpkgs postgres backup unit trigger
  #       another unit, it was easier to just make one ourselves
  systemd.services."backup-postgresql" = {
    description = "Backup PostgreSQL data";
    requires = [ "postgresql.service" ];
    path = with pkgs; [
      coreutils
      zstd
      cfg.package
    ];
    script = let
      rotations = 2;
    in ''
      set -euo pipefail
      OUT_FILE="$STATE_DIRECTORY/postgresql-dump-$(date --iso-8601).sql.zst"
      pg_dumpall -U postgres | zstd --compress -9 --rsyncable -o "$OUT_FILE"
      # NOTE: this needs to be a hardlink for rrsync to allow sending it
      rm "$STATE_DIRECTORY/postgresql-dump-latest.sql.zst" ||:
      ln -T "$OUT_FILE" "$STATE_DIRECTORY/postgresql-dump-latest.sql.zst"
      while [ "$(find "$STATE_DIRECTORY" -type f -printf '.' | wc -c)" -gt "${toString (rotations + 1)}" ]; do
        rm "$(find "$STATE_DIRECTORY" -type f -printf '%T+ %p\n' | sort | head -n 1 | cut -d' ' -f2)"
      done
    '';
    serviceConfig = {
      Type = "oneshot";
      User = "postgres";
      Group = "postgres";
      UMask = "0077";
      Nice = 19;
      IOSchedulingClass = "best-effort";
      IOSchedulingPriority = 7;
      StateDirectory = [ "postgresql-backups" ];
      BindPaths = [ "${backupDir}:/var/lib/postgresql-backups" ];
      # TODO: hardening
    };
    startAt = "*-*-* 01:15:00";
  };
 }
--- a/hosts/bikkje/configuration.nix
+++ b/hosts/bikkje/configuration.nix
@@ -1,6 +1,6 @@
 { config, pkgs, values, ... }:
 {
-  networking.nat = {
+    networking.nat = {
    enable = true;
    internalInterfaces = ["ve-+"];
    externalInterface = "ens3";
@@ -25,7 +25,6 @@
      ];
      networking = {
        hostName = "bikkje";
        firewall = {
          enable = true;
          # Allow SSH and HTTP and ports for email and irc
@@ -37,11 +36,9 @@
        useHostResolvConf = mkForce false;
      };
      services.resolved.enable = true;
      # Don't change (even during upgrades) unless you know what you are doing.
      # See https://search.nixos.org/options?show=system.stateVersion
      system.stateVersion = "23.11";
      services.resolved.enable = true;
    };
  };
 };
--- a/hosts/brzeczyszczykiewicz/configuration.nix
+++ b/hosts/brzeczyszczykiewicz/configuration.nix
@@ -4,18 +4,33 @@
      # Include the results of the hardware scan.
      ./hardware-configuration.nix
      (fp /base)
      (fp /misc/metrics-exporters.nix)
      ./services/grzegorz.nix
    ];
  boot.loader.systemd-boot.enable = true;
  boot.loader.efi.canTouchEfiVariables = true;
  networking.hostName = "brzeczyszczykiewicz";
  systemd.network.networks."30-eno1" = values.defaultNetworkConfig // {
    matchConfig.Name = "eno1";
    address = with values.hosts.brzeczyszczykiewicz; [ (ipv4 + "/25") (ipv6 + "/64") ];
  };
-  fonts.fontconfig.enable = true;
+  # List packages installed in system profile
  environment.systemPackages = with pkgs; [
  ];
  # List services that you want to enable:
  # This value determines the NixOS release from which the default
  # settings for stateful data, like file locations and database versions
  # on your system were taken. It‘s perfectly fine and recommended to leave
  # this value at the release version of the first install of this system.
  # Before changing this value read the documentation for this option
  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
  system.stateVersion = "23.05"; # Did you read the comment?
  # Don't change (even during upgrades) unless you know what you are doing.
  # See https://search.nixos.org/options?show=system.stateVersion
  system.stateVersion = "25.11";
 }
--- a/hosts/brzeczyszczykiewicz/hardware-configuration.nix
+++ b/hosts/brzeczyszczykiewicz/hardware-configuration.nix
@@ -1,4 +1,4 @@
-# Do not modify this file!  It was generated by 'nixos-generate-config'
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
 { config, lib, pkgs, modulesPath, ... }:
--- a/hosts/georg/configuration.nix
+++ b/hosts/georg/configuration.nix
@@ -4,15 +4,29 @@
      # Include the results of the hardware scan.
      ./hardware-configuration.nix
      (fp /base)
      (fp /misc/metrics-exporters.nix)
      (fp /modules/grzegorz.nix)
    ];
  boot.loader.systemd-boot.enable = true;
  boot.loader.efi.canTouchEfiVariables = true;
  networking.hostName = "georg";
  systemd.network.networks."30-eno1" = values.defaultNetworkConfig // {
    matchConfig.Name = "eno1";
    address = with values.hosts.georg; [ (ipv4 + "/25") (ipv6 + "/64") ];
  };
  # List packages installed in system profile
  environment.systemPackages = with pkgs; [
  ];
  # List services that you want to enable:
  services.spotifyd = {
    enable = true;
    settings.global = {
@@ -28,9 +42,15 @@
    5353 # spotifyd is its own mDNS service wtf
  ];
  fonts.fontconfig.enable = true;
-  # Don't change (even during upgrades) unless you know what you are doing.
+
-  # See https://search.nixos.org/options?show=system.stateVersion
+
-  system.stateVersion = "25.11";
+  # This value determines the NixOS release from which the default
  # settings for stateful data, like file locations and database versions
  # on your system were taken. It‘s perfectly fine and recommended to leave
  # this value at the release version of the first install of this system.
  # Before changing this value read the documentation for this option
  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
  system.stateVersion = "23.05"; # Did you read the comment?
 }
--- a/hosts/georg/hardware-configuration.nix
+++ b/hosts/georg/hardware-configuration.nix
@@ -1,4 +1,4 @@
-# Do not modify this file!  It was generated by 'nixos-generate-config'
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
 { config, lib, pkgs, modulesPath, ... }:
--- a/hosts/gluttony/configuration.nix
+++ b/hosts/gluttony/configuration.nix
@@ -1,60 +0,0 @@
 {
  fp,
  lib,
  values,
  ...
 }:
 {
  imports = [
    ./hardware-configuration.nix
    (fp /base)
  ];
  systemd.network.enable = lib.mkForce false;
  boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
  boot.loader = {
    systemd-boot.enable = false; # no uefi support on this device
    grub.device = "/dev/sda";
    grub.enable = true;
  };
  boot.tmp.cleanOnBoot = true;
  networking =
    let
      hostConf = values.hosts.gluttony;
    in
    {
      tempAddresses = "disabled";
      useDHCP = false;
      search = values.defaultNetworkConfig.domains;
      nameservers = values.defaultNetworkConfig.dns;
      defaultGateway.address = hostConf.ipv4_internal_gw;
      interfaces."ens3" = {
        ipv4.addresses = [
          {
            address = hostConf.ipv4;
            prefixLength = 32;
          }
          {
            address = hostConf.ipv4_internal;
            prefixLength = 24;
          }
        ];
        ipv6.addresses = [
          {
            address = hostConf.ipv6;
            prefixLength = 64;
          }
        ];
      };
    };
  services.qemuGuest.enable = true;
  # Don't change (even during upgrades) unless you know what you are doing.
  # See https://search.nixos.org/options?show=system.stateVersion
  system.stateVersion = "25.11";
 }
--- a/hosts/gluttony/hardware-configuration.nix
+++ b/hosts/gluttony/hardware-configuration.nix
@@ -1,50 +0,0 @@
 # Do not modify this file!  It was generated by 'nixos-generate-config'
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
 {
  config,
  lib,
  pkgs,
  modulesPath,
  ...
 }:
 {
  imports = [
    (modulesPath + "/profiles/qemu-guest.nix")
  ];
  boot.initrd.availableKernelModules = [
    "ata_piix"
    "uhci_hcd"
    "virtio_pci"
    "virtio_scsi"
    "sd_mod"
  ];
  boot.initrd.kernelModules = [ "dm-snapshot" ];
  boot.kernelModules = [ ];
  boot.extraModulePackages = [ ];
  fileSystems."/" = {
    device = "/dev/mapper/pool-root";
    fsType = "ext4";
  };
  fileSystems."/boot" = {
    device = "/dev/disk/by-uuid/933A-3005";
    fsType = "vfat";
    options = [
      "fmask=0077"
      "dmask=0077"
    ];
  };
  swapDevices = [
    {
      device = "/var/lib/swapfile";
      size = 8 * 1024;
    }
  ];
  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
 }
--- a/hosts/ildkule/configuration.nix
+++ b/hosts/ildkule/configuration.nix
@@ -4,13 +4,17 @@
      # Include the results of the hardware scan.
      ./hardware-configuration.nix
      (fp /base)
      (fp /misc/metrics-exporters.nix)
      ./services/monitoring
      ./services/nginx
      ./services/journald-remote.nix
    ];
-  boot.loader.systemd-boot.enable = false;
+  sops.defaultSopsFile = fp /secrets/ildkule/ildkule.yaml;
  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
  sops.age.generateKey = true;
  boot.loader.grub.device = "/dev/vda";
  boot.tmp.cleanOnBoot = true;
  zramSwap.enable = true;
@@ -20,6 +24,7 @@
  networking = let
    hostConf = values.hosts.ildkule;
  in {
    hostName = "ildkule";
    tempAddresses = "disabled";
    useDHCP = lib.mkForce true;
@@ -38,9 +43,13 @@
    };
  };
-  services.qemuGuest.enable = true;
+  # List packages installed in system profile
  environment.systemPackages = with pkgs; [
  ];
  # No devices with SMART
  services.smartd.enable = false;
  system.stateVersion = "23.11"; # Did you read the comment?
  # Don't change (even during upgrades) unless you know what you are doing.
  # See https://search.nixos.org/options?show=system.stateVersion
  system.stateVersion = "23.11";
 }
--- a/hosts/ildkule/services/journald-remote.nix
+++ b/hosts/ildkule/services/journald-remote.nix
@@ -1,58 +0,0 @@
 { config, lib, values, ... }:
 let
  cfg = config.services.journald.remote;
  domainName = "journald.pvv.ntnu.no";
 in
 {
  security.acme.certs.${domainName} = {
    webroot = "/var/lib/acme/acme-challenge/";
    group = config.services.nginx.group;
  };
  services.nginx = {
    enable = true;
    virtualHosts.${domainName} = {
      forceSSL = true;
      useACMEHost = "${domainName}";
      locations."/.well-known/".root = "/var/lib/acme/acme-challenge/";
    };
  };
  services.journald.upload.enable = lib.mkForce false;
  services.journald.remote = {
    enable = true;
    settings.Remote = let
      inherit (config.security.acme.certs.${domainName}) directory;
    in {
      ServerKeyFile = "/run/credentials/systemd-journal-remote.service/key.pem";
      ServerCertificateFile = "/run/credentials/systemd-journal-remote.service/cert.pem";
      TrustedCertificateFile = "-";
    };
  };
  systemd.sockets."systemd-journal-remote" = {
    socketConfig = {
      IPAddressDeny = "any";
      IPAddressAllow = [
        "127.0.0.1"
        "::1"
        values.ipv4-space
        values.ipv6-space
      ];
    };
  };
  networking.firewall.allowedTCPPorts = [ cfg.port ];
  systemd.services."systemd-journal-remote" = {
    serviceConfig = {
      LoadCredential = let
        inherit (config.security.acme.certs.${domainName}) directory;
      in [
        "key.pem:${directory}/key.pem"
        "cert.pem:${directory}/cert.pem"
      ];
    };
  };
 }
--- a/hosts/ildkule/services/monitoring/dashboards/go-processes.json
+++ b/hosts/ildkule/services/monitoring/dashboards/go-processes.json
--- a/hosts/ildkule/services/monitoring/dashboards/mysql.json
+++ b/hosts/ildkule/services/monitoring/dashboards/mysql.json
@@ -13,7 +13,7 @@
    ]
  },
  "description": "",
-  "editable": false,
+  "editable": true,
  "gnetId": 11323,
  "graphTooltip": 1,
  "id": 31,
@@ -3690,7 +3690,7 @@
        },
        "hide": 0,
        "includeAll": false,
-        "label": "Data source",
+        "label": "Data Source",
        "multi": false,
        "name": "datasource",
        "options": [],
@@ -3713,12 +3713,12 @@
        "definition": "label_values(mysql_up, job)",
        "hide": 0,
        "includeAll": true,
-        "label": "Job",
+        "label": "job",
        "multi": true,
        "name": "job",
        "options": [],
        "query": "label_values(mysql_up, job)",
-        "refresh": 2,
+        "refresh": 1,
        "regex": "",
        "skipUrlSync": false,
        "sort": 0,
@@ -3742,12 +3742,12 @@
        "definition": "label_values(mysql_up, instance)",
        "hide": 0,
        "includeAll": true,
-        "label": "Instance",
+        "label": "instance",
        "multi": true,
        "name": "instance",
        "options": [],
        "query": "label_values(mysql_up, instance)",
-        "refresh": 2,
+        "refresh": 1,
        "regex": "",
        "skipUrlSync": false,
        "sort": 0,
--- a/hosts/ildkule/services/monitoring/dashboards/node-exporter-full.json
+++ b/hosts/ildkule/services/monitoring/dashboards/node-exporter-full.json
--- a/hosts/ildkule/services/monitoring/dashboards/postgres.json
+++ b/hosts/ildkule/services/monitoring/dashboards/postgres.json
@@ -328,7 +328,7 @@
        "rgba(50, 172, 45, 0.97)"
      ],
      "datasource": "${DS_PROMETHEUS}",
-      "format": "short",
+      "format": "decbytes",
      "gauge": {
        "maxValue": 100,
        "minValue": 0,
@@ -411,7 +411,7 @@
        "rgba(50, 172, 45, 0.97)"
      ],
      "datasource": "${DS_PROMETHEUS}",
-      "format": "short",
+      "format": "decbytes",
      "gauge": {
        "maxValue": 100,
        "minValue": 0,
@@ -1410,7 +1410,7 @@
      "tableColumn": "",
      "targets": [
        {
-          "expr": "pg_settings_seq_page_cost{instance=\"$instance\"}",
+          "expr": "pg_settings_seq_page_cost",
          "format": "time_series",
          "intervalFactor": 1,
          "refId": "A"
@@ -1872,7 +1872,7 @@
      },
      "yaxes": [
        {
-          "format": "short",
+          "format": "bytes",
          "label": null,
          "logBase": 1,
          "max": null,
@@ -1966,7 +1966,7 @@
      },
      "yaxes": [
        {
-          "format": "short",
+          "format": "bytes",
          "label": null,
          "logBase": 1,
          "max": null,
@@ -2060,7 +2060,7 @@
      },
      "yaxes": [
        {
-          "format": "short",
+          "format": "bytes",
          "label": null,
          "logBase": 1,
          "max": null,
@@ -2251,7 +2251,7 @@
      },
      "yaxes": [
        {
-          "format": "short",
+          "format": "bytes",
          "label": null,
          "logBase": 1,
          "max": null,
@@ -2439,7 +2439,7 @@
      },
      "yaxes": [
        {
-          "format": "short",
+          "format": "bytes",
          "label": null,
          "logBase": 1,
          "max": null,
@@ -2589,35 +2589,35 @@
      "steppedLine": false,
      "targets": [
        {
-          "expr": "irate(pg_stat_bgwriter_buffers_backend_total{instance=\"$instance\"}[5m])",
+          "expr": "irate(pg_stat_bgwriter_buffers_backend{instance=\"$instance\"}[5m])",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "buffers_backend",
          "refId": "A"
        },
        {
-          "expr": "irate(pg_stat_bgwriter_buffers_alloc_total{instance=\"$instance\"}[5m])",
+          "expr": "irate(pg_stat_bgwriter_buffers_alloc{instance=\"$instance\"}[5m])",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "buffers_alloc",
          "refId": "B"
        },
        {
-          "expr": "irate(pg_stat_bgwriter_buffers_backend_fsync_total{instance=\"$instance\"}[5m])",
+          "expr": "irate(pg_stat_bgwriter_buffers_backend_fsync{instance=\"$instance\"}[5m])",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "backend_fsync",
          "refId": "C"
        },
        {
-          "expr": "irate(pg_stat_bgwriter_buffers_checkpoint_total{instance=\"$instance\"}[5m])",
+          "expr": "irate(pg_stat_bgwriter_buffers_checkpoint{instance=\"$instance\"}[5m])",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "buffers_checkpoint",
          "refId": "D"
        },
        {
-          "expr": "irate(pg_stat_bgwriter_buffers_clean_total{instance=\"$instance\"}[5m])",
+          "expr": "irate(pg_stat_bgwriter_buffers_clean{instance=\"$instance\"}[5m])",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "buffers_clean",
@@ -2886,14 +2886,14 @@
      "steppedLine": false,
      "targets": [
        {
-          "expr": "irate(pg_stat_bgwriter_checkpoint_write_time_total{instance=\"$instance\"}[5m])",
+          "expr": "irate(pg_stat_bgwriter_checkpoint_write_time{instance=\"$instance\"}[5m])",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "write_time - Total amount of time that has been spent in the portion of checkpoint processing where files are written to disk.",
          "refId": "B"
        },
        {
-          "expr": "irate(pg_stat_bgwriter_checkpoint_sync_time_total{instance=\"$instance\"}[5m])",
+          "expr": "irate(pg_stat_bgwriter_checkpoint_sync_time{instance=\"$instance\"}[5m])",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "sync_time - Total amount of time that has been spent in the portion of checkpoint processing where files are synchronized to disk.",
--- a/hosts/ildkule/services/monitoring/dashboards/synapse.json
+++ b/hosts/ildkule/services/monitoring/dashboards/synapse.json
--- a/hosts/ildkule/services/monitoring/grafana.nix
+++ b/hosts/ildkule/services/monitoring/grafana.nix
@@ -47,13 +47,13 @@ in {
        {
          name = "Node Exporter Full";
          type = "file";
-          url = "https://grafana.com/api/dashboards/1860/revisions/42/download";
+          url = "https://grafana.com/api/dashboards/1860/revisions/29/download";
          options.path = dashboards/node-exporter-full.json;
        }
        {
          name = "Matrix Synapse";
          type = "file";
-          url = "https://github.com/element-hq/synapse/raw/refs/heads/develop/contrib/grafana/synapse.json";
+          url = "https://raw.githubusercontent.com/matrix-org/synapse/develop/contrib/grafana/synapse.json";
          options.path = dashboards/synapse.json;
        }
        {
@@ -65,9 +65,15 @@ in {
        {
          name = "Postgresql";
          type = "file";
-          url = "https://grafana.com/api/dashboards/9628/revisions/8/download";
+          url = "https://grafana.com/api/dashboards/9628/revisions/7/download";
          options.path = dashboards/postgres.json;
        }
        {
          name = "Go Processes (gogs)";
          type = "file";
          url = "https://grafana.com/api/dashboards/240/revisions/3/download";
          options.path = dashboards/go-processes.json;
        }
        {
          name = "Gitea Dashboard";
          type = "file";
--- a/hosts/ildkule/services/monitoring/prometheus/machines.nix
+++ b/hosts/ildkule/services/monitoring/prometheus/machines.nix
@@ -19,18 +19,15 @@ in {
      (mkHostScrapeConfig "bicep" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
      (mkHostScrapeConfig "brzeczyszczykiewicz" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
      (mkHostScrapeConfig "georg" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
      (mkHostScrapeConfig "gluttony" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
      (mkHostScrapeConfig "kommode" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
      (mkHostScrapeConfig "lupine-1" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
      (mkHostScrapeConfig "lupine-2" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
      (mkHostScrapeConfig "lupine-3" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
      (mkHostScrapeConfig "lupine-4" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
      (mkHostScrapeConfig "lupine-5" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
      (mkHostScrapeConfig "temmie" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
      (mkHostScrapeConfig "ustetind" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
      (mkHostScrapeConfig "wenche" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
-      (mkHostScrapeConfig "skrott" [ defaultNodeExporterPort defaultSystemdExporterPort ])
+      (mkHostScrapeConfig "lupine-1" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
      # (mkHostScrapeConfig "lupine-2" [ defaultNodeExporterPort defaultSystemdExporterPort ])
      (mkHostScrapeConfig "lupine-3" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
      (mkHostScrapeConfig "lupine-4" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
      (mkHostScrapeConfig "lupine-5" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
      (mkHostScrapeConfig "hildring" [ defaultNodeExporterPort ])
      (mkHostScrapeConfig "isvegg" [ defaultNodeExporterPort ])
--- a/hosts/ildkule/services/monitoring/prometheus/mysqld.nix
+++ b/hosts/ildkule/services/monitoring/prometheus/mysqld.nix
@@ -10,7 +10,7 @@ in {
        inherit (config.sops) placeholder;
      in ''
        [client]
-        host = mysql.pvv.ntnu.no
+        host = bicep.pvv.ntnu.no
        port = 3306
        user = prometheus_mysqld_exporter
        password = ${placeholder."config/mysqld_exporter_password"}
--- a/hosts/kommode/configuration.nix
+++ b/hosts/kommode/configuration.nix
@@ -4,12 +4,22 @@
    # Include the results of the hardware scan.
    ./hardware-configuration.nix
    (fp /base)
-    ./disks.nix
+    (fp /misc/metrics-exporters.nix)
    ./services/gitea
    ./services/nginx.nix
  ];
  sops.defaultSopsFile = fp /secrets/kommode/kommode.yaml;
  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
  sops.age.generateKey = true;
  boot.loader.systemd-boot.enable = true;
  boot.loader.efi.canTouchEfiVariables = true;
  networking.hostName = "kommode"; # Define your hostname.
  systemd.network.networks."30-ens18" = values.defaultNetworkConfig // {
    matchConfig.Name = "ens18";
    address = with values.hosts.kommode; [ (ipv4 + "/25") (ipv6 + "/64") ];
@@ -17,9 +27,8 @@
  services.btrfs.autoScrub.enable = true;
-  services.qemuGuest.enable = true;
+  environment.systemPackages = with pkgs; [];
  # Don't change (even during upgrades) unless you know what you are doing.
  # See https://search.nixos.org/options?show=system.stateVersion
  system.stateVersion = "24.11";
 }
--- a/hosts/kommode/disks.nix
+++ b/hosts/kommode/disks.nix
@@ -1,80 +0,0 @@
 { lib, ... }:
 {
  disko.devices = {
    disk = {
      sda = {
        type = "disk";
        device = "/dev/sda";
        content = {
          type = "gpt";
          partitions = {
            root = {
              name = "root";
              label = "root";
              start = "1MiB";
              end = "-5G";
              content = {
                type = "btrfs";
                extraArgs = [ "-f" ]; # Override existing partition
                # subvolumes = let
                #   makeSnapshottable = subvolPath: mountOptions: let
                #     name = lib.replaceString "/" "-" subvolPath;
                #   in {
                #     "@${name}/active" = {
                #       mountpoint = subvolPath;
                #       inherit mountOptions;
                #     };
                #     "@${name}/snapshots" = {
                #       mountpoint = "${subvolPath}/.snapshots";
                #       inherit mountOptions;
                #     };
                #   };
                # in {
                #   "@" = { };
                #   "@/swap" = {
                #     mountpoint = "/.swapvol";
                #     swap.swapfile.size = "4G";
                #   };
                #   "@/root" = {
                #     mountpoint = "/";
                #     mountOptions = [ "compress=zstd" "noatime" ];
                #   };
                # }
                # // (makeSnapshottable "/home" [ "compress=zstd" "noatime" ])
                # // (makeSnapshottable "/nix" [ "compress=zstd" "noatime" ])
                # // (makeSnapshottable "/var/lib" [ "compress=zstd" "noatime" ])
                # // (makeSnapshottable "/var/log" [ "compress=zstd" "noatime" ])
                # // (makeSnapshottable "/var/cache" [ "compress=zstd" "noatime" ]);
                # swap.swapfile.size = "4G";
                mountpoint = "/";
              };
            };
            swap = {
              name = "swap";
              label = "swap";
              start = "-5G";
              end = "-1G";
              content.type = "swap";
            };
            ESP = {
              name = "ESP";
              label = "ESP";
              start = "-1G";
              end = "100%";
              type = "EF00";
              content = {
                type = "filesystem";
                format = "vfat";
                mountpoint = "/boot";
                mountOptions = [ "umask=0077" ];
              };
            };
          };
        };
      };
    };
  };
 }
--- a/hosts/kommode/hardware-configuration.nix
+++ b/hosts/kommode/hardware-configuration.nix
@@ -1,4 +1,4 @@
-# Do not modify this file!  It was generated by 'nixos-generate-config'
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
 { config, lib, pkgs, modulesPath, ... }:
@@ -13,6 +13,21 @@
  boot.kernelModules = [ ];
  boot.extraModulePackages = [ ];
  fileSystems."/" =
    { device = "/dev/disk/by-uuid/d421538f-a260-44ae-8e03-47cac369dcc1";
      fsType = "btrfs";
    };
  fileSystems."/boot" =
    { device = "/dev/disk/by-uuid/86CD-4C23";
      fsType = "vfat";
      options = [ "fmask=0077" "dmask=0077" ];
    };
  swapDevices =
    [ { device = "/dev/disk/by-uuid/4cfbb41e-801f-40dd-8c58-0a0c1a6025f6"; }
    ];
  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
  # (the default) this is the recommended approach. When using systemd-networkd it's
  # still possible to use this option, but it's recommended to use it in conjunction
--- a/hosts/kommode/services/gitea/customization/default.nix
+++ b/hosts/kommode/services/gitea/customization/default.nix
@@ -24,15 +24,10 @@ in
    script = let
      logo-svg = fp /assets/logo_blue_regular.svg;
      logo-png = fp /assets/logo_blue_regular.png;
      extraLinks = pkgs.writeText "gitea-extra-links.tmpl" ''
        <a class="item" href="https://git.pvv.ntnu.no/Drift/-/projects/4">Tokyo Drift Issues</a>
      '';
      extraLinksFooter = pkgs.writeText "gitea-extra-links-footer.tmpl" ''
        <a class="item" href="https://www.pvv.ntnu.no/">PVV</a>
        <a class="item" href="https://wiki.pvv.ntnu.no/">Wiki</a>
-        <a class="item" href="https://wiki.pvv.ntnu.no/wiki/Tjenester/Kodelager">PVV Gitea Howto</a>
+        <a class="item" href="https://git.pvv.ntnu.no/Drift/-/projects/4">Tokyo Drift Issues</a>
      '';
      project-labels = (pkgs.formats.yaml { }).generate "gitea-project-labels.yaml" {
@@ -50,14 +45,13 @@ in
        sed -i -e 's/24/60/g' "$out/repo/icon.tmpl"
      '';
    in ''
-      install -Dm444 ${logo-svg} "${cfg.customDir}/public/assets/img/logo.svg"
+      install -Dm444 ${logo-svg} ${cfg.customDir}/public/assets/img/logo.svg
-      install -Dm444 ${logo-png} "${cfg.customDir}/public/assets/img/logo.png"
+      install -Dm444 ${logo-png} ${cfg.customDir}/public/assets/img/logo.png
-      install -Dm444 ${./loading.apng} "${cfg.customDir}/public/assets/img/loading.png"
+      install -Dm444 ${./loading.apng} ${cfg.customDir}/public/assets/img/loading.png
-      install -Dm444 ${extraLinks} "${cfg.customDir}/templates/custom/extra_links.tmpl"
+      install -Dm444 ${extraLinks} ${cfg.customDir}/templates/custom/extra_links.tmpl
-      install -Dm444 ${extraLinksFooter} "${cfg.customDir}/templates/custom/extra_links_footer.tmpl"
+      install -Dm444 ${project-labels} ${cfg.customDir}/options/label/project-labels.yaml
      install -Dm444 ${project-labels} "${cfg.customDir}/options/label/project-labels.yaml"
-      "${lib.getExe pkgs.rsync}" -a "${customTemplates}/" "${cfg.customDir}/templates/"
+      "${lib.getExe pkgs.rsync}" -a "${customTemplates}/" ${cfg.customDir}/templates/
    '';
  };
 }
--- a/hosts/kommode/services/gitea/customization/labels/projects.json
+++ b/hosts/kommode/services/gitea/customization/labels/projects.json
@@ -35,12 +35,6 @@
    "color": "#ed1111",
    "description": "Report an oopsie"
  },
  {
    "name": "developer experience",
    "exclusive": false,
    "color": "#eb6420",
    "description": "Think about the developers"
  },
  {
    "name": "disputed",
    "exclusive": false,
--- a/hosts/kommode/services/gitea/default.nix
+++ b/hosts/kommode/services/gitea/default.nix
@@ -15,7 +15,6 @@ in {
    defaultConfig = {
      owner = "gitea";
      group = "gitea";
      restartUnits = [ "gitea.service" ];
    };
  in {
    "gitea/database" = defaultConfig;
@@ -195,23 +194,6 @@ in {
  networking.firewall.allowedTCPPorts = [ sshPort ];
  services.rsync-pull-targets = {
    enable = true;
    locations.${cfg.dump.backupDir} = {
      user = "root";
      rrsyncArgs.ro = true;
      authorizedKeysAttrs = [
        "restrict"
        "from=\"principal.pvv.ntnu.no,${values.hosts.principal.ipv6},${values.hosts.principal.ipv4}\""
        "no-agent-forwarding"
        "no-port-forwarding"
        "no-pty"
        "no-X11-forwarding"
      ];
      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGpMVrOppyqYaDiAhqmAuOaRsubFvcQGBGyz+NHB6+0o gitea rsync backup";
    };
  };
  systemd.services.gitea-dump = {
    serviceConfig.ExecStart = let
      args = lib.cli.toGNUCommandLineShell { } {
--- a/hosts/kommode/services/gitea/gpg.nix
+++ b/hosts/kommode/services/gitea/gpg.nix
@@ -4,23 +4,9 @@ let
  GNUPGHOME = "${config.users.users.gitea.home}/gnupg";
 in
 {
-  sops.secrets = {
+  sops.secrets."gitea/gpg-signing-key" = {
-    "gitea/gpg-signing-key-public" = {
+    owner = cfg.user;
-      owner = cfg.user;
+    inherit (cfg) group;
      inherit (cfg) group;
      restartUnits = [
        "gitea.service"
        "gitea-ensure-gnupg-homedir.service"
      ];
    };
    "gitea/gpg-signing-key-private" = {
      owner = cfg.user;
      inherit (cfg) group;
      restartUnits = [
        "gitea.service"
        "gitea-ensure-gnupg-homedir.service"
      ];
    };
  };
  systemd.services.gitea.environment = { inherit GNUPGHOME; };
@@ -32,7 +18,6 @@ in
  systemd.services.gitea-ensure-gnupg-homedir = {
    description = "Import gpg key for gitea";
    before = [ "gitea.service" ];
    environment = { inherit GNUPGHOME; };
    serviceConfig = {
      Type = "oneshot";
@@ -40,8 +25,7 @@ in
      PrivateNetwork = true;
    };
    script = ''
-      ${lib.getExe pkgs.gnupg} --import ${config.sops.secrets."gitea/gpg-signing-key-public".path}
+      ${lib.getExe pkgs.gnupg} --import ${config.sops.secrets."gitea/gpg-signing-key".path}
      ${lib.getExe pkgs.gnupg} --import ${config.sops.secrets."gitea/gpg-signing-key-private".path}
    '';
  };
@@ -50,6 +34,5 @@ in
    SIGNING_NAME = "PVV Git";
    SIGNING_EMAIL = "gitea@git.pvv.ntnu.no";
    INITIAL_COMMIT = "always";
    WIKI = "always";
  };
 }
--- a/hosts/kommode/services/gitea/web-secret-provider/default.nix
+++ b/hosts/kommode/services/gitea/web-secret-provider/default.nix
@@ -28,7 +28,7 @@ in
  users.users."gitea-web" = {
    group = "gitea-web";
    isSystemUser = true;
-    useDefaultShell = true;
+    shell = pkgs.bash;
  };
  sops.secrets."gitea/web-secret-provider/token" = {
--- a/hosts/lupine/configuration.nix
+++ b/hosts/lupine/configuration.nix
@@ -4,11 +4,18 @@
    ./hardware-configuration/${lupineName}.nix
    (fp /base)
    (fp /misc/metrics-exporters.nix)
    ./services/gitea-runner.nix
  ];
  sops.defaultSopsFile = fp /secrets/lupine/lupine.yaml;
  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
  sops.age.generateKey = true;
  boot.loader.systemd-boot.enable = true;
  boot.loader.efi.canTouchEfiVariables = true;
  systemd.network.networks."30-enp0s31f6" = values.defaultNetworkConfig // {
    matchConfig.Name = "enp0s31f6";
@@ -22,7 +29,7 @@
  # There are no smart devices
  services.smartd.enable = false;
-  # Don't change (even during upgrades) unless you know what you are doing.
+  # Do not change, even during upgrades.
  # See https://search.nixos.org/options?show=system.stateVersion
  system.stateVersion = "25.05";
 }
--- a/hosts/lupine/hardware-configuration/lupine-1.nix
+++ b/hosts/lupine/hardware-configuration/lupine-1.nix
@@ -1,4 +1,4 @@
-# Do not modify this file!  It was generated by 'nixos-generate-config'
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
 { config, lib, pkgs, modulesPath, ... }:
--- a/hosts/lupine/hardware-configuration/lupine-2.nix
+++ b/hosts/lupine/hardware-configuration/lupine-2.nix
@@ -1,4 +1,4 @@
-# Do not modify this file!  It was generated by 'nixos-generate-config'
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
 { config, lib, pkgs, modulesPath, ... }:
--- a/hosts/lupine/hardware-configuration/lupine-3.nix
+++ b/hosts/lupine/hardware-configuration/lupine-3.nix
@@ -1,4 +1,4 @@
-# Do not modify this file!  It was generated by 'nixos-generate-config'
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
 { config, lib, pkgs, modulesPath, ... }:
--- a/hosts/lupine/hardware-configuration/lupine-4.nix
+++ b/hosts/lupine/hardware-configuration/lupine-4.nix
@@ -1,4 +1,4 @@
-# Do not modify this file!  It was generated by 'nixos-generate-config'
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
 { config, lib, pkgs, modulesPath, ... }:
--- a/hosts/lupine/hardware-configuration/lupine-5.nix
+++ b/hosts/lupine/hardware-configuration/lupine-5.nix
@@ -1,4 +1,4 @@
-# Do not modify this file!  It was generated by 'nixos-generate-config'
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
 { config, lib, pkgs, modulesPath, ... }:
--- a/hosts/shark/configuration.nix
+++ b/hosts/shark/configuration.nix
@@ -4,16 +4,36 @@
      # Include the results of the hardware scan.
      ./hardware-configuration.nix
      (fp /base)
      (fp /misc/metrics-exporters.nix)
    ];
  sops.defaultSopsFile = fp /secrets/shark/shark.yaml;
  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
  sops.age.generateKey = true;
  boot.loader.systemd-boot.enable = true;
  boot.loader.efi.canTouchEfiVariables = true;
  networking.hostName = "shark"; # Define your hostname.
  systemd.network.networks."30-ens18" = values.defaultNetworkConfig // {
    matchConfig.Name = "ens18";
    address = with values.hosts.shark; [ (ipv4 + "/25") (ipv6 + "/64") ];
  };
-  services.qemuGuest.enable = true;
+  # List packages installed in system profile
  environment.systemPackages = with pkgs; [
  ];
  # List services that you want to enable:
  # This value determines the NixOS release from which the default
  # settings for stateful data, like file locations and database versions
  # on your system were taken. It‘s perfectly fine and recommended to leave
  # this value at the release version of the first install of this system.
  # Before changing this value read the documentation for this option
  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
  system.stateVersion = "23.05"; # Did you read the comment?
  # Don't change (even during upgrades) unless you know what you are doing.
  # See https://search.nixos.org/options?show=system.stateVersion
  system.stateVersion = "25.11";
 }
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Øystein Tveit	f580a3ddce	WIP All checks were successful Eval nix flake / evals (push) Successful in 6m8s Details	2025-12-16 17:49:23 +01:00
h7x4	91f02c7b75	flake.lock: bump minecraft-kartverket Some checks failed Eval nix flake / evals (push) Has been cancelled Details	2025-12-17 01:48:32 +09:00