WIP

Fix gitea runners, add 2 more
The gitea runners are now activated correctly, has support for both debian and ubuntu based systems, and can will connect to the gitea server through the loopback interface
2023-09-17 23:18:16 +02:00 · 2023-09-17 04:05:08 +02:00 · 2023-09-17 00:28:28 +02:00 · 2023-09-16 22:38:23 +02:00 · 2023-09-16 22:38:15 +02:00 · 2023-09-16 22:31:22 +02:00
55 changed files with 6181 additions and 1471 deletions
--- a/.sops.yaml
+++ b/.sops.yaml
@ -7,7 +7,7 @@ keys:
  # Hosts
  - &host_jokum age1gp8ye4g2mmw3may5xg0zsy7mm04glfz3788mmdx9cvcsdxs9hg0s0cc9kt
  - &host_ildkule age1hn45n46ypyrvypv0mwfnpt9ddrlmw34dwlpf33n8v67jexr3lucq6ahc9x
-  - &host_bekkalokk age13t2nnr6yukmtda6wn2uggfcj0dmwce8347y8w6xzt4yje6wlgscqnahuqm
+  - &host_bekkalokk age12nj59tguy9wg882updc2vjdusx5srnxmjyfaqve4zx6jnnsaw3qsyjq6zd
  - &host_bicep age1sl43gc9cw939z5tgha2lpwf0xxxgcnlw7w4xem4sqgmt2pt264vq0dmwx2

 creation_rules:
@ -49,3 +49,12 @@ creation_rules:
      - *user_felixalb
      pgp:
      - *user_oysteikt
+  
+  - path_regex: secrets/bicep/[^/]+\.yaml$
+    key_groups:
+    - age:
+      - *host_bicep
+      - *user_danio
+      - *user_felixalb
+      pgp:
+      - *user_oysteikt
--- a/README.MD
+++ b/README.MD
@ -4,9 +4,13 @@

 Før du endrer på ting husk å ikke putte ting som skal være hemmelig uten å først lese seksjonen for hemmeligheter!

-Etter å ha klonet prosjektet ned og gjort endringer kan du bygge med:
+Etter å ha klonet prosjektet ned og gjort endringer kan du evaluere configene med:

-`nix build .#nixosConfigurations.jokum.config.system.build.toplevel`
+`nix flake check --keep-going`
+
+før du bygger en maskin med:
+
+`nix build .#nixosConfigurations.<maskinavn>.config.system.build.toplevel`

 Husk å hvertfall stage nye filer om du har laget dem!

--- a/assets/logo_blue_regular.png
+++ b/assets/logo_blue_regular.png
--- a/assets/logo_blue_regular.svg
+++ b/assets/logo_blue_regular.svg
@ -0,0 +1,172 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<!-- Created with Inkscape (http://www.inkscape.org/) -->
+
+<svg
+   width="200mm"
+   height="200mm"
+   viewBox="0 0 200 200"
+   version="1.1"
+   id="svg5"
+   inkscape:version="1.1.2 (b8e25be833, 2022-02-05)"
+   sodipodi:docname="logo_blue_thicc.svg"
+   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
+   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
+   xmlns="http://www.w3.org/2000/svg"
+   xmlns:svg="http://www.w3.org/2000/svg">
+  <sodipodi:namedview
+     id="namedview7"
+     pagecolor="#505050"
+     bordercolor="#ffffff"
+     borderopacity="1"
+     inkscape:pageshadow="0"
+     inkscape:pageopacity="0"
+     inkscape:pagecheckerboard="1"
+     inkscape:document-units="mm"
+     showgrid="false"
+     inkscape:zoom="3.9730533"
+     inkscape:cx="359.54715"
+     inkscape:cy="690.40101"
+     inkscape:window-width="1920"
+     inkscape:window-height="1057"
+     inkscape:window-x="-8"
+     inkscape:window-y="-8"
+     inkscape:window-maximized="1"
+     inkscape:current-layer="Layer_4"
+     width="200mm" />
+  <defs
+     id="defs2" />
+  <g
+     inkscape:label="Layer 1"
+     inkscape:groupmode="layer"
+     id="layer1">
+    <g
+       id="g98"
+       transform="scale(0.25)">
+      <g
+         id="Layer_2"
+         style="fill:#283681;fill-opacity:1">
+        <rect
+           y="0"
+           class="st0"
+           width="800"
+           height="800"
+           id="rect4"
+           x="0"
+           style="fill:#283681;fill-opacity:1"
+           inkscape:export-filename="C:\Users\al3xk\OneDrive - NTNU\PVV\Gogs\PR\logoer\logo_blue.png"
+           inkscape:export-xdpi="480"
+           inkscape:export-ydpi="480" />
+      </g>
+      <g
+         id="Layer_4"
+         style="fill:#283681;fill-opacity:0;stroke:#ffffff;stroke-width:4.2;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1">
+        <line
+           class="st1"
+           x1="478.39999"
+           y1="720.29999"
+           x2="313.20001"
+           y2="720.29999"
+           id="line9"
+           style="fill:#283681;fill-opacity:0;stroke:#ffffff;stroke-width:4.2;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
+        <path
+           class="st1"
+           d="M 478.4,720.3"
+           id="path11"
+           style="fill:#283681;fill-opacity:0;stroke:#ffffff;stroke-width:4.2;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
+        <polyline
+           class="st2"
+           points="717.1,223.3 717.1,720.3 497.3,720.3  "
+           id="polyline13"
+           style="fill:#283681;fill-opacity:0;stroke:#ffffff;stroke-width:4.2;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
+        <path
+           class="st2"
+           d="m 498.39888,720.3 c 0,-5.6 -4.5,-10.1 -10.1,-10.1 -5.6,0 -10.1,4.5 -10.1,10.1 h -163.8 c 0,-5.6 -4.5,-10.1 -10.1,-10.1 -5.6,0 -10.1,4.5 -10.1,10.1 -69.7592,0 -145.68417,0 -217.599996,0 V 79.7 H 717.09888 v 120 0 h -17.3 v 24.8 h 17.3"
+           id="path15"
+           style="fill:#283681;fill-opacity:0;stroke:#ffffff;stroke-width:4.2;stroke-linecap:square;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+           sodipodi:nodetypes="csccsccccccccc" />
+      </g>
+      <g
+         id="Layer_3"
+         style="fill:#283681;fill-opacity:0;stroke:#ffffff;stroke-width:4.2;stroke-miterlimit:10;stroke-dasharray:none;stroke-opacity:1">
+        <circle
+           class="st2"
+           cx="396.79999"
+           cy="400"
+           id="circle18"
+           style="fill:#283681;fill-opacity:0;stroke:#ffffff;stroke-width:4.2;stroke-miterlimit:10;stroke-dasharray:none;stroke-opacity:1"
+           r="320.29999" />
+      </g>
+      <g
+         id="Layer_1"
+         style="fill:#283681;fill-opacity:0;stroke:#ffffff;stroke-width:4.2;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1">
+        <polyline
+           class="st2"
+           points="514.5,173.5 170.2,173.5 170.3,626.6 623.3,626.5 623.3,215.7 584.4,173.4 557,173.4 548,180.6    526.5,180.7  "
+           id="polyline21"
+           style="fill:#283681;fill-opacity:0;stroke:#ffffff;stroke-width:4.2;stroke-linejoin:bevel;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
+        <path
+           class="st2"
+           d="m 526.5,331.8 c 0,7.6 -5.4,13.7 -12,13.7 H 227.7 c -6.6,0 -12,-6.1 -12,-13.7 V 187.2 c 0,-7.6 5.4,-13.7 12,-13.7 h 286.8 c 6.6,0 12,6.1 12,13.7 z"
+           id="path27"
+           style="fill:#283681;fill-opacity:0;stroke:#ffffff;stroke-width:4.2;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
+        <path
+           class="st2"
+           d="m 526.7,333.6 c 0,6.6 -5.4,12 -12,12 H 296.8 c -6.6,0 -12,-5.4 -12,-12 V 185.5 c 0,-6.6 5.4,-12 12,-12 h 217.9 c 6.6,0 12,5.4 12,12 z"
+           id="path29"
+           style="fill:#283681;fill-opacity:0;stroke:#ffffff;stroke-width:4.2;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
+        <path
+           class="st2"
+           d="m 577.9,613.7 c 0,6.6 -5.4,12 -12,12 H 227.7 c -6.6,0 -12,-5.4 -12,-12 V 381.1 c 0,-6.6 5.4,-12 12,-12 h 338.2 c 6.6,0 12,5.4 12,12 z"
+           id="path31"
+           style="fill:#283681;fill-opacity:0;stroke:#ffffff;stroke-width:4.2;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
+        <rect
+           x="179.89999"
+           y="590.20001"
+           class="st2"
+           width="25.700001"
+           height="23"
+           id="rect33"
+           style="fill:#283681;fill-opacity:0;stroke:#ffffff;stroke-width:4.2;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
+        <rect
+           x="587.59998"
+           y="590.20001"
+           class="st2"
+           width="25.700001"
+           height="23"
+           id="rect35"
+           style="fill:#283681;fill-opacity:0;stroke:#ffffff;stroke-width:4.2;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
+        <rect
+           x="433.60001"
+           y="193.5"
+           class="st2"
+           width="64.900002"
+           height="137.8"
+           id="rect37"
+           style="fill:#283681;fill-opacity:0;stroke:#ffffff;stroke-width:4.2;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
+      </g>
+      <path
+         d="m 274.9401,541.572 c 0,3.528 2.772,6.426 6.3,6.426 3.528,0 6.426,-2.898 6.426,-6.426 v -30.996 h 30.87 c 10.458,0 19.152,-8.694 19.152,-19.152 v -22.68 c 0,-10.332 -8.694,-19.026 -19.152,-19.026 h -43.596 z m 12.726,-43.722 v -35.406 h 30.87 c 3.276,0 6.426,2.898 6.426,6.3 v 22.68 c 0,3.528 -3.024,6.426 -6.426,6.426 z"
+         style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:126px;font-family:OCRA;-inkscape-font-specification:OCRA;fill:#ffffff;stroke:#ffffff;stroke-width:4.2;stroke-miterlimit:10;stroke-dasharray:none;stroke-opacity:1"
+         id="path55-2" />
+      <path
+         d="m 365.99479,478.824 25.326,65.142 c 1.008,2.394 3.276,4.032 6.048,4.032 2.646,0 4.914,-1.638 5.922,-4.032 l 25.452,-65.268 v -22.68 c 0,-3.402 -2.898,-6.3 -6.426,-6.3 -3.528,0 -6.3,2.898 -6.3,6.3 v 20.286 l -18.648,47.628 -18.648,-47.628 v -20.286 c 0,-3.402 -2.898,-6.3 -6.426,-6.3 -3.528,0 -6.3,2.898 -6.3,6.3 z"
+         style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:126px;font-family:OCRA;-inkscape-font-specification:OCRA;fill:#ffffff;stroke:#ffffff;stroke-width:4.2;stroke-miterlimit:10;stroke-dasharray:none;stroke-opacity:1"
+         id="path57-8" />
+      <path
+         d="m 457.04947,478.824 25.326,65.142 c 1.008,2.394 3.276,4.032 6.048,4.032 2.646,0 4.914,-1.638 5.922,-4.032 l 25.452,-65.268 v -22.68 c 0,-3.402 -2.898,-6.3 -6.426,-6.3 -3.528,0 -6.3,2.898 -6.3,6.3 v 20.286 l -18.648,47.628 -18.648,-47.628 v -20.286 c 0,-3.402 -2.898,-6.3 -6.426,-6.3 -3.528,0 -6.3,2.898 -6.3,6.3 z"
+         style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:126px;font-family:OCRA;-inkscape-font-specification:OCRA;fill:#ffffff;stroke:#ffffff;stroke-width:4.2;stroke-miterlimit:10;stroke-dasharray:none;stroke-opacity:1"
+         id="path59-1" />
+    </g>
+  </g>
+  <style
+     type="text/css"
+     id="style2">
+	.st0{fill:#ffffff;}
+	.st1{fill:none;stroke:#ffffff;stroke-width:2;stroke-miterlimit:10;}
+	.st2{fill:none;stroke:#000000;stroke-width:2;stroke-miterlimit:10;}
+	.st3{fill:none;}
+	.st4{stroke:#000000;stroke-miterlimit:10;}
+	.st5{font-family:'OCRAStd';}
+	.st6{font-size:126px;}
+</style>
+</svg>
--- a/base.nix
+++ b/base.nix
@ -13,7 +13,7 @@
  # networking.defaultGateway = values.hosts.gateway;

  systemd.network.enable = true;
-  
+
  services.resolved = {
    enable = lib.mkDefault true;
    dnssec = "false"; # Supposdly this keeps breaking and the default is to allow downgrades anyways...
@ -67,14 +67,16 @@
    kitty.terminfo
  ];

+  programs.zsh.enable = true;
+
  users.groups."drift".name = "drift";

  services.openssh = {
    enable = true;
-    permitRootLogin = "yes";
    extraConfig = ''
      PubkeyAcceptedAlgorithms=+ssh-rsa
    '';
+    settings.PermitRootLogin = "yes";
  };


--- a/flake.lock
+++ b/flake.lock
@ -5,11 +5,11 @@
        "nixpkgs-lib": "nixpkgs-lib"
      },
      "locked": {
-        "lastModified": 1676674799,
-        "narHash": "sha256-NaZWOgNrco5OT0J5VrWg02SCkKz8RV1sxRjh0/MWMEc=",
+        "lastModified": 1694383459,
+        "narHash": "sha256-Y7VuBz74Go1QlvSLGXsXzPgOeeV73bbsDou3uXX9oa8=",
        "owner": "dali99",
        "repo": "nixos-matrix-modules",
-        "rev": "362496f4aacb680406db3fad36f98d38e8285b30",
+        "rev": "66ff528912d95e6a2ee0aea6404a6b7e0d7fd83c",
        "type": "github"
      },
      "original": {
@ -20,16 +20,16 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1680879128,
-        "narHash": "sha256-ISFCCZ3/Dw5WK/6kFKwqA6gIEaOjqU/5NoB6Vge87sE=",
+        "lastModified": 1694526311,
+        "narHash": "sha256-Y9LCYQBNX7McW0o8x6wT9tx2qy9TVuF84fe62zrQzyA=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "fa98075869eb8264052548dde5c2ce9e68cf4cf1",
+        "rev": "36bee398beca22e2428074e0a2e068d87f801718",
        "type": "github"
      },
      "original": {
        "owner": "NixOS",
-        "ref": "nixos-22.11-small",
+        "ref": "nixos-23.05-small",
        "repo": "nixpkgs",
        "type": "github"
      }
@ -51,24 +51,45 @@
    },
    "nixpkgs-stable": {
      "locked": {
-        "lastModified": 1680390120,
-        "narHash": "sha256-RyDJcG/7mfimadlo8vO0QjW22mvYH1+cCqMuigUntr8=",
+        "lastModified": 1693675694,
+        "narHash": "sha256-2pIOyQwGyy2FtFAUIb8YeKVmOCcPOTVphbAvmshudLE=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "c1e2efaca8d8a3db6a36f652765d6c6ba7bb8fae",
+        "rev": "5601118d39ca9105f8e7b39d4c221d3388c0419d",
        "type": "github"
      },
      "original": {
        "owner": "NixOS",
-        "ref": "release-22.11",
+        "ref": "release-23.05",
        "repo": "nixpkgs",
        "type": "github"
      }
    },
+    "pvv-calendar-bot": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1693136143,
+        "narHash": "sha256-amHprjftc3y/bg8yf4hITCLa+ez5HIi0yGfR7TU6UIc=",
+        "ref": "refs/heads/main",
+        "rev": "a32894b305f042d561500f5799226afd1faf5abb",
+        "revCount": 9,
+        "type": "git",
+        "url": "https://git.pvv.ntnu.no/Projects/calendar-bot.git"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://git.pvv.ntnu.no/Projects/calendar-bot.git"
+      }
+    },
    "root": {
      "inputs": {
        "matrix-next": "matrix-next",
        "nixpkgs": "nixpkgs",
+        "pvv-calendar-bot": "pvv-calendar-bot",
        "sops-nix": "sops-nix",
        "unstable": "unstable"
      }
@ -81,11 +102,11 @@
        "nixpkgs-stable": "nixpkgs-stable"
      },
      "locked": {
-        "lastModified": 1680404136,
-        "narHash": "sha256-06D8HJmRv4DdpEQGblMhx2Vm81SBWM61XBBIx7QQfo0=",
+        "lastModified": 1694495315,
+        "narHash": "sha256-sZEYXs9T1NVHZSSbMqBEtEm2PGa7dEDcx0ttQkArORc=",
        "owner": "Mic92",
        "repo": "sops-nix",
-        "rev": "b93eb910f768f9788737bfed596a598557e5625d",
+        "rev": "ea208e55f8742fdcc0986b256bdfa8986f5e4415",
        "type": "github"
      },
      "original": {
@ -96,11 +117,11 @@
    },
    "unstable": {
      "locked": {
-        "lastModified": 1680882415,
-        "narHash": "sha256-trt2pwLDu1+kEtp3bx2DiYgg8CFWNbes+ujdAtSBO/U=",
+        "lastModified": 1694534540,
+        "narHash": "sha256-Cc0Ku0qJZDDx/0kII+0xD94L25EKw4EQzOLm0R9iZO4=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "cd07e0258cf73e1bcbd0c9abc5513baa091ee801",
+        "rev": "f22a472661d66c655eae5b0a01ada71e4e13e405",
        "type": "github"
      },
      "original": {
--- a/flake.nix
+++ b/flake.nix
@ -2,47 +2,70 @@
  description = "PVV System flake";

  inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-22.11-small";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-23.05-small";
    unstable.url = "github:NixOS/nixpkgs/nixos-unstable-small";

    sops-nix.url = "github:Mic92/sops-nix";
    sops-nix.inputs.nixpkgs.follows = "nixpkgs";

+    pvv-calendar-bot.url = "git+https://git.pvv.ntnu.no/Projects/calendar-bot.git";
+    pvv-calendar-bot.inputs.nixpkgs.follows = "nixpkgs";
+
    matrix-next.url = "github:dali99/nixos-matrix-modules";
  };

-  outputs = { self, nixpkgs, matrix-next, unstable, sops-nix, ... }@inputs: 
+  outputs = { self, nixpkgs, matrix-next, pvv-calendar-bot, unstable, sops-nix, ... }@inputs:
  let
    systems = [
      "x86_64-linux"
      "aarch64-linux"
+      "aarch64-darwin"
    ];
    forAllSystems = f: nixpkgs.lib.genAttrs systems (system: f system);
  in {
    nixosConfigurations = let
-      nixosConfig = name: config: nixpkgs.lib.nixosSystem (nixpkgs.lib.recursiveUpdate
-        config
+      nixosConfig = nixpkgs: name: config: nixpkgs.lib.nixosSystem (nixpkgs.lib.recursiveUpdate
        rec {
          system = "x86_64-linux";
          specialArgs = {
            inherit unstable inputs;
            values = import ./values.nix;
          };
+
          modules = [
            ./hosts/${name}/configuration.nix
            sops-nix.nixosModules.sops
-            matrix-next.nixosModules.synapse
          ];
-        });

+          pkgs = import nixpkgs {
+            inherit system;
+            overlays = [
+              (final: prev: {
+                mx-puppet-discord = prev.mx-puppet-discord.override { nodejs_14 = final.nodejs_18; };
+              })
+              pvv-calendar-bot.overlays.${system}.default
+            ];
+          };
+        }
+        config
+      );
+
+      stableNixosConfig = nixosConfig nixpkgs;
+      unstableNixosConfig = nixosConfig unstable;
    in {
-      bicep = nixosConfig "bicep" { };
-      bekkalokk = nixosConfig "bekkalokk" { };
-      greddost = nixosConfig "greddost" { };
-      ildkule = nixosConfig "ildkule" { };
-      jokum = nixosConfig "jokum" {
-        modules = [ matrix-next.nixosModules.synapse ];
+      bicep = stableNixosConfig "bicep" {
+        modules = [
+          ./hosts/bicep/configuration.nix
+          sops-nix.nixosModules.sops
+
+          matrix-next.nixosModules.synapse
+          pvv-calendar-bot.nixosModules.default
+        ];
      };
+      bekkalokk = stableNixosConfig "bekkalokk" { };
+      ildkule = stableNixosConfig "ildkule" { };
+      #ildkule-unstable = unstableNixosConfig "ildkule" { };
+      shark = stableNixosConfig "shark" { };
    };

    devShells = forAllSystems (system: {
--- a/hosts/bekkalokk/configuration.nix
+++ b/hosts/bekkalokk/configuration.nix
@ -4,12 +4,15 @@
    ./hardware-configuration.nix

    ../../base.nix
+    ../../misc/metrics-exporters.nix
+
+    #./services/keycloak.nix

    # TODO: set up authentication for the following:
-    # ./services/website/website.nix
-    # ./services/website/nginx.nix
-    # ./services/website/gitea.nix
-    # ./services/website/mediawiki.nix
+    # ./services/website.nix
+    ./services/nginx.nix
+    ./services/gitea/default.nix
+    ./services/mediawiki.nix
  ];

  sops.defaultSopsFile = ../../secrets/bekkalokk/bekkalokk.yaml;
@ -20,10 +23,12 @@
  boot.loader.systemd-boot.enable = true;
  boot.loader.efi.canTouchEfiVariables = true;

+  virtualisation.podman.enable = true;
+
  networking.hostName = "bekkalokk";

-  systemd.network.networks."30-ens33" = values.defaultNetworkConfig // {
-    matchConfig.Name = "ens33";
+  systemd.network.networks."30-enp2s0" = values.defaultNetworkConfig // {
+    matchConfig.Name = "enp2s0";
    address = with values.hosts.bekkalokk; [ (ipv4 + "/25") (ipv6 + "/64") ];
  };

--- a/hosts/bekkalokk/hardware-configuration.nix
+++ b/hosts/bekkalokk/hardware-configuration.nix
@ -4,25 +4,27 @@
 { config, lib, pkgs, modulesPath, ... }:

 {
-  imports = [ ];
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];

-  boot.initrd.availableKernelModules = [ "ata_piix" "mptspi" "uhci_hcd" "ehci_pci" "sd_mod" "sr_mod" ];
+  boot.initrd.availableKernelModules = [ "ehci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
  boot.extraModulePackages = [ ];

  fileSystems."/" =
-    { device = "/dev/disk/by-uuid/cdcafe3a-01d8-4bdf-9a3d-78705b581090";
-      fsType = "ext4";
+    { device = "/dev/sda1";
+      fsType = "btrfs";
    };

  fileSystems."/boot" =
-    { device = "/dev/disk/by-uuid/1CB4-280D";
+    { device = "/dev/disk/by-uuid/CE63-3B9B";
      fsType = "vfat";
    };

  swapDevices =
-    [ { device = "/dev/disk/by-uuid/3eaace48-91ec-4d46-be86-fd26877d8b86"; }
+    [ { device = "/dev/disk/by-uuid/2df10c7b-0dec-45c6-a728-533f7da7f4b9"; }
    ];

  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
@ -30,7 +32,8 @@
  # still possible to use this option, but it's recommended to use it in conjunction
  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.ens33.useDHCP = lib.mkDefault true;
+  # networking.interfaces.eno1.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp2s0.useDHCP = lib.mkDefault true;

  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
--- a/hosts/bekkalokk/services/gitea/ci.nix
+++ b/hosts/bekkalokk/services/gitea/ci.nix
@ -0,0 +1,30 @@
+{ config, lib, values, ... }:
+let
+  mkRunner = name: {
+    # This is unfortunately state, and has to be generated one at a time :(
+    # To do that, comment out all except one of the runners, fill in its token
+    # inside the sops file, rebuild the system, and only after this runner has
+    # successfully registered will gitea give you the next token.
+    # - oysteikt Sep 2023
+    sops.secrets."gitea/runners/${name}".restartUnits = [
+      "gitea-runner-${name}.service"
+    ];
+
+    services.gitea-actions-runner.instances = {
+      ${name} = {
+        enable = true;
+        name = "git-runner-${name}"; url = "https://git.pvv.ntnu.no";
+        labels = [
+	  "debian-latest:docker://node:18-bullseye"
+	  "ubuntu-latest:docker://node:18-bullseye"
+	];
+        tokenFile = config.sops.secrets."gitea/runners/${name}".path;
+      };
+    };
+  };
+in
+lib.mkMerge [
+  (mkRunner "alpha")
+  (mkRunner "beta")
+  (mkRunner "epsilon")
+]
--- a/hosts/bekkalokk/services/gitea/default.nix
+++ b/hosts/bekkalokk/services/gitea/default.nix
@ -0,0 +1,105 @@
+{ config, values, pkgs, ... }:
+let
+  cfg = config.services.gitea;
+  domain = "git.pvv.ntnu.no";
+  sshPort  = 2222;
+in {
+  imports = [
+    ./ci.nix
+  ];
+
+  sops.secrets = {
+    "gitea/database" = {
+      owner = "gitea";
+      group = "gitea";
+    };
+    "gitea/passwd-ssh-key" = { };
+    "gitea/ssh-known-hosts" = { };
+    "gitea/import-user-env" = { };
+  };
+
+  services.gitea = {
+    enable = true;
+    stateDir = "/data/gitea";
+    appName = "PVV Git";
+
+    database = {
+      type = "postgres";
+      host = "postgres.pvv.ntnu.no";
+      port = config.services.postgresql.port;
+      passwordFile = config.sops.secrets."gitea/database".path;
+      createDatabase = false;
+    };
+
+    settings = {
+      server = {
+        DOMAIN   = domain;
+        ROOT_URL = "https://${domain}/";
+        PROTOCOL = "http+unix";
+        SSH_PORT = sshPort;
+	      START_SSH_SERVER = true;
+      };
+      indexer.REPO_INDEXER_ENABLED = true;
+      service.DISABLE_REGISTRATION = true;
+      session.COOKIE_SECURE = true;
+      database.LOG_SQL = false;
+      picture = {
+        DISABLE_GRAVATAR = true;
+        ENABLE_FEDERATED_AVATAR = false;
+      };
+      actions.ENABLED = true;
+      "ui.meta".DESCRIPTION = "Bokstavelig talt programvareverkstedet";
+    };
+  };
+
+  environment.systemPackages = [ cfg.package ];
+
+  services.nginx.virtualHosts."${domain}" = {
+    forceSSL = true;
+    enableACME = true;
+    locations."/" = {
+      proxyPass = "http://unix:${cfg.settings.server.HTTP_ADDR}";
+      recommendedProxySettings = true;
+      extraConfig = ''
+        client_max_body_size 512M;
+      '';
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = [ sshPort ];
+
+  # Automatically import users
+  systemd.services.gitea-import-users = {
+    enable = true;
+    preStart=''${pkgs.rsync}/bin/rsync -e "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=$CREDENTIALS_DIRECTORY/ssh-known-hosts -i $CREDENTIALS_DIRECTORY/sshkey" -a pvv@smtp.pvv.ntnu.no:/etc/passwd /tmp/passwd-import'';
+    serviceConfig = {
+      ExecStart = pkgs.writers.writePython3 "gitea-import-users" { libraries = [ pkgs.python3Packages.requests ]; } (builtins.readFile ./gitea-import-users.py);
+      LoadCredential=[
+        "sshkey:${config.sops.secrets."gitea/passwd-ssh-key".path}"
+        "ssh-known-hosts:${config.sops.secrets."gitea/ssh-known-hosts".path}"
+      ];
+      DynamicUser="yes";
+      EnvironmentFile=config.sops.secrets."gitea/import-user-env".path;
+    };
+  };
+
+  systemd.timers.gitea-import-users = {
+    enable = true;
+    requires = [ "gitea.service" ];
+    after = [ "gitea.service" ];
+    timerConfig = {
+      OnCalendar = "*-*-* 02:00:00";
+      Persistent = true;
+      Unit = "gitea-import-users.service";
+    };
+  };
+
+  system.activationScripts.linkGiteaLogo.text = let
+    logo-svg = ../../../../assets/logo_blue_regular.svg;
+    logo-png = ../../../../assets/logo_blue_regular.png;
+  in ''
+    install -Dm444 ${logo-svg} ${cfg.stateDir}/custom/public/img/logo.svg
+    install -Dm444 ${logo-png} ${cfg.stateDir}/custom/public/img/logo.png
+    install -Dm444 ${./loading.apng} ${cfg.stateDir}/custom/public/img/loading.png
+  '';
+}
--- a/hosts/bekkalokk/services/gitea/gitea-import-users.py
+++ b/hosts/bekkalokk/services/gitea/gitea-import-users.py
@ -0,0 +1,94 @@
+import requests
+import secrets
+import os
+
+EMAIL_DOMAIN = os.getenv('EMAIL_DOMAIN')
+if EMAIL_DOMAIN is None:
+    EMAIL_DOMAIN = 'pvv.ntnu.no'
+
+API_TOKEN = os.getenv('API_TOKEN')
+if API_TOKEN is None:
+    raise Exception('API_TOKEN not set')
+
+GITEA_API_URL = os.getenv('GITEA_API_URL')
+if GITEA_API_URL is None:
+    GITEA_API_URL = 'https://git.pvv.ntnu.no/api/v1'
+
+BANNED_SHELLS = [
+    "/usr/bin/nologin",
+    "/usr/sbin/nologin",
+    "/sbin/nologin",
+    "/bin/false",
+    "/bin/msgsh",
+]
+
+existing_users = {}
+
+
+# This function should only ever be called when adding users
+# from the passwd file
+def add_user(username, name):
+    user = {
+            "full_name": name,
+            "username": username,
+            "login_name": username,
+            "visibility": "public",
+            "source_id": 1,  # 1 = SMTP
+    }
+
+    if username not in existing_users:
+        user["password"] = secrets.token_urlsafe(32)
+        user["must_change_password"] = False
+        user["visibility"] = "private"
+        user["email"] = username + '@' + EMAIL_DOMAIN
+
+        r = requests.post(GITEA_API_URL + '/admin/users', json=user,
+                          headers={'Authorization': 'token ' + API_TOKEN})
+        if r.status_code != 201:
+            print('ERR: Failed to create user ' + username + ': ' + r.text)
+            return
+
+        print('Created user ' + username)
+        existing_users[username] = user
+
+    else:
+        r = requests.patch(GITEA_API_URL + f'/admin/users/{username}',
+                           json=user,
+                           headers={'Authorization': 'token ' + API_TOKEN})
+        if r.status_code != 200:
+            print('ERR: Failed to update user ' + username + ': ' + r.text)
+            return
+
+        print('Updated user ' + username)
+
+
+def main():
+    # Fetch existing users
+    r = requests.get(GITEA_API_URL + '/admin/users',
+                     headers={'Authorization': 'token ' + API_TOKEN})
+
+    if r.status_code != 200:
+        raise Exception('Failed to get users: ' + r.text)
+
+    for user in r.json():
+        existing_users[user['login']] = user
+
+    # Read the file, add each user
+    with open("/tmp/passwd-import", 'r') as f:
+        for line in f.readlines():
+            uid = int(line.split(':')[2])
+            if uid < 1000:
+                continue
+
+            shell = line.split(':')[-1]
+            if shell in BANNED_SHELLS:
+                continue
+
+            username = line.split(':')[0]
+            name = line.split(':')[4].split(',')[0]
+
+            add_user(username, name)
+
+
+if __name__ == '__main__':
+    main()
--- a/hosts/bekkalokk/services/gitea/loading.apng
+++ b/hosts/bekkalokk/services/gitea/loading.apng
--- a/hosts/bekkalokk/services/keycloak.nix
+++ b/hosts/bekkalokk/services/keycloak.nix
@ -0,0 +1,24 @@
+{ pkgs, config, values, ... }:
+{
+  sops.secrets."keys/postgres/keycloak" = {
+    owner = "keycloak";
+    group = "keycloak";
+    restartUnits = [ "keycloak.service" ];
+  };
+
+  services.keycloak = {
+    enable = true;
+
+    settings = {
+      hostname = "auth.pvv.ntnu.no";
+      # hostname-strict-backchannel = true;
+    };
+
+    database = {
+      host = values.hosts.bicep.ipv4;
+      createLocally = false;
+      passwordFile = config.sops.secrets."keys/postgres/keycloak".path;
+      caCert = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
+    };
+  };
+}
--- a/hosts/bekkalokk/services/mediawiki.nix
+++ b/hosts/bekkalokk/services/mediawiki.nix
@ -0,0 +1,153 @@
+{ pkgs, lib, config, values, ... }: let
+  cfg = config.services.mediawiki;
+
+  # "mediawiki"
+  user = config.systemd.services.mediawiki-init.serviceConfig.User;
+
+  # "mediawiki"
+  group = config.users.users.${user}.group;
+in {
+  sops.secrets = let
+    secret = opts: {
+      restartUnits = [ "mediawiki-init.service" "phpfpm-mediawiki.service" ];
+      owner = user;
+      group = group;
+    } // opts;
+  in {
+    "mediawiki/password" = secret { };
+    "mediawiki/database" = secret { };
+    "mediawiki/oidc/clientsecret" = secret { };
+  };
+
+  services.mediawiki = {
+    enable = true;
+    name = "Programvareverkstedet";
+    passwordFile = config.sops.secrets."mediawiki/password".path;
+    passwordSender = "drift@pvv.ntnu.no";
+
+    database = {
+      type = "mysql";
+      host = "mysql.pvv.ntnu.no";
+      createLocally = false;
+      user = "bekkalokk_mediawiki_test";
+      name = "bekkalokk_mediawiki_test";
+      passwordFile = config.sops.secrets."mediawiki/database".path;
+    };
+
+    # Host through nginx
+    webserver = "none";
+    poolConfig = let
+      listenUser = config.services.nginx.user;
+      listenGroup = config.services.nginx.group;
+    in {
+      # Worker settings
+      "pm" = "dynamic";
+      "pm.max_children" = 32;
+      "pm.max_requests" = 500;
+      "pm.start_servers" = 2;
+      "pm.min_spare_servers" = 2;
+      "pm.max_spare_servers" = 4;
+
+      # Socket settings
+      "listen.owner" = listenUser;
+      "listen.group" = listenGroup;
+
+      # Misc
+      "env[PATH]" = lib.makeBinPath [ pkgs.php ];
+      # to accept *.html file
+      "security.limit_extensions" = "";
+      inherit user group;
+
+      # Debug logging
+      "catch_workers_output" = "yes";
+      "php_flag[display_errors]" = "on";
+      "php_admin_value[error_log]" = "stderr";
+      "php_admin_flag[log_errors]" = "on";
+    };
+
+    extensions = {
+      DeleteBatch = pkgs.fetchzip {
+        url = "https://extdist.wmflabs.org/dist/extensions/DeleteBatch-REL1_40-6852fb7.tar.gz";
+        hash = "sha256-m6l8Cs6mFLu1qfovBFO2l8HhtYZXnpZkajWXNob2wbU=";
+      };
+      UserMerge = pkgs.fetchzip {
+        url = "https://extdist.wmflabs.org/dist/extensions/UserMerge-REL1_40-56f6dcf.tar.gz";
+        hash = "sha256-zO7ti7fZPlJp3TXSJbYrXPRyElwO57zoU+RH7LBwVGU=";
+      };
+      PluggableAuth = pkgs.fetchzip {
+        url = "https://extdist.wmflabs.org/dist/extensions/PluggableAuth-REL1_40-8104ed9.tar.gz";
+        hash = "sha256-fFz9+pJ/Ucdg340I/JWe4S/W05oVSfns9EF84rxN8yI=";
+      };
+      OpenIDConnect = pkgs.fetchzip {
+        url = "https://extdist.wmflabs.org/dist/extensions/OpenIDConnect-REL1_40-3edc735.tar.gz";
+        hash = "sha256-Osp4m2Sp9uGNt3QEmRsw0LA3KQCQzqJosgy3AFs11hY=";
+      };
+    };
+
+    extraConfig = ''
+      $wgServer = "https://bekkalokk.pvv.ntnu.no";
+      $wgLocaltimezone = "Europe/Oslo";
+
+      # Only allow login through SSO
+      $wgEnableEmail = false;
+      $wgEnableUserEmail = false;
+      $wgEmailAuthentication = false;
+      $wgGroupPermissions['*']['createaccount'] = false;
+      $wgGroupPermissions['*']['autocreateaccount'] = true;
+      $wgPluggableAuth_EnableAutoLogin = false;
+
+      # SSO config
+      $wgPluggableAuth_Config[] = [
+          'plugin' => 'OpenIDConnect',
+          'data' => [
+              'providerURL' => 'https://git.pvv.ntnu.no/login/oauth/authorize',
+              'clientID' => 'be86ec39-d89c-4973-a163-633339539db2',
+              'clientsecret' => file_get_contents('${config.sops.secrets."mediawiki/oidc/clientsecret".path}')
+          ]
+      ];
+
+      # Disable anonymous editing
+      $wgGroupPermissions['*']['edit'] = false;
+
+      # Styling
+      $wgLogos = [
+        'svg' => "${../../../assets/logo_blue_regular.svg}",
+      ];
+      $wgDefaultSkin = "monobook";
+
+      # Enable debugging
+      error_reporting( -1 );
+      ini_set( 'display_errors', 1 );
+
+      # Misc
+      $wgEmergencyContact = "${cfg.passwordSender}";
+      $wgShowIPinHeader = false;
+      $wgUseTeX = false;
+      $wgLocalInterwiki = $wgSitename;
+
+      # Fix https://github.com/NixOS/nixpkgs/issues/183097
+      $wgDBserver = "${toString cfg.database.host}";
+    '';
+  };
+
+  # services.nginx.virtualHosts."wiki.pvv.ntnu.no" = {
+  services.nginx.virtualHosts."bekkalokk.pvv.ntnu.no" = {
+    forceSSL = true;
+    enableACME = true;
+    root = "${cfg.finalPackage}/share/mediawiki";
+    locations = {
+      "/" = {
+        recommendedProxySettings = true;
+        extraConfig = ''
+          fastcgi_split_path_info ^(.+\.php)(/.+)$;
+          fastcgi_index index.php;
+          fastcgi_pass unix:${config.services.phpfpm.pools.mediawiki.socket};
+          include ${pkgs.nginx}/conf/fastcgi_params;
+          include ${pkgs.nginx}/conf/fastcgi.conf;
+        '';
+      };
+      "/images".root = config.services.mediawiki.uploadsDir;
+    };
+    
+  };
+}
--- a/hosts/bekkalokk/services/nginx.nix
+++ b/hosts/bekkalokk/services/nginx.nix
@ -0,0 +1,18 @@
+{ pkgs, config, ... }:
+{
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "drift@pvv.ntnu.no";
+  };
+
+  services.nginx = {
+    enable = true;
+
+    recommendedTlsSettings = true;
+    recommendedProxySettings = true;
+    recommendedOptimisation = true;
+    recommendedGzipSettings = true;
+  };
+
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
+}
--- a/hosts/bekkalokk/services/website/website.nix
+++ b/hosts/bekkalokk/services/website/website.nix
--- a/hosts/bekkalokk/services/website/gitea.nix
+++ b/hosts/bekkalokk/services/website/gitea.nix
@ -1,26 +0,0 @@
-{ config, values, ... }:
-{
-  sops.secrets."postgres/gitea/password" = { };
-
-  services.gitea = {
-    enable = true;
-    rootUrl = "https://git2.pvv.ntnu.no/";
-    stateDir = "/data/gitea";
-    appName = "PVV Git";
-
-    enableUnixSocket = true;
-
-    database = {
-      type = "postgres";
-      host = values.bicep.ipv4;
-      port = config.services.postgresql.port;
-      passwordFile = config.sops.secrets."postgres/gitea/password".path;
-      createDatabase = false;
-    };
-
-    settings = {
-      service.DISABLE_REGISTRATION = true;
-      session.COOKIE_SECURE = true;
-    };
-  };
-}
--- a/hosts/bekkalokk/services/website/mediawiki.nix
+++ b/hosts/bekkalokk/services/website/mediawiki.nix
@ -1,23 +0,0 @@
-{ values, config, ... }:
-{
-  sops.secrets = {
-    "mediawiki/password" = { };
-    "postgres/mediawiki/password" = { };
-  };
-
-  services.mediawiki = {
-    enable = true;
-    name = "PVV";
-    passwordFile = config.sops.secrets."mediawiki/password".path;
-
-    virtualHost = {
-    };
-
-    database = {
-      type = "postgres";
-      host = values.bicep.ipv4;
-      port = config.services.postgresql.port;
-      passwordFile = config.sops.secrets."postgres/mediawiki/password".path;
-    };
-  };
-}
--- a/hosts/bekkalokk/services/website/nginx.nix
+++ b/hosts/bekkalokk/services/website/nginx.nix
@ -1,30 +0,0 @@
-{ config, ... }:
-{
-  services.nginx = {
-    enable = true;
-
-    recommendedTlsSettings = true;
-    recommendedProxySettings = true;
-    recommendedOptimisation = true;
-    recommendedGzipSettings = true;
-
-    virtualHosts = {
-      "www.pvv.ntnu.no" = {
-        forceSSL = true;
-
-        locations = {
-          "/pvv" = {
-            proxyPass = "http://localhost:${config.services.mediawiki.virtualHost.listen.pvv.port}";
-          };
-        };
-      };
-
-      "git.pvv.ntnu.no" = {
-        locations."/" = {
-          proxyPass = "http://unix:${config.services.gitea.settings.server.HTTP_ADDR}";
-          proxyWebsockets = true;
-        };
-      };
-    };
-  };
-}
--- a/hosts/bicep/acmeCert.nix
+++ b/hosts/bicep/acmeCert.nix
@ -0,0 +1,24 @@
+{ values, ... }:
+{
+  users.groups.acme.members = [ "nginx" ];
+
+  security.acme.certs."postgres.pvv.ntnu.no" = {
+    group = "acme";
+    extraDomainNames = [
+      # "postgres.pvv.org"
+      "bicep.pvv.ntnu.no"
+      # "bicep.pvv.org"
+      # values.hosts.bicep.ipv4
+      # values.hosts.bicep.ipv6
+    ];
+  };
+
+  services.nginx = {
+    enable = true;
+    virtualHosts."postgres.pvv.ntnu.no" = {
+      forceSSL = true;
+      enableACME = true;
+      # useACMEHost = "postgres.pvv.ntnu.no";
+    };
+  };
+}
--- a/hosts/bicep/configuration.nix
+++ b/hosts/bicep/configuration.nix
@ -4,9 +4,17 @@
    ./hardware-configuration.nix

    ../../base.nix
+    ../../misc/metrics-exporters.nix
+    ./services/nginx

+    ./acmeCert.nix
+
+    ./services/mysql.nix
    ./services/postgres.nix
-    ./services/jokum.nix
+    ./services/mysql.nix
+    ./services/calendar-bot.nix
+
+    ./services/matrix
  ];

  sops.defaultSopsFile = ../../secrets/bicep/bicep.yaml;
@ -15,17 +23,16 @@
  sops.age.generateKey = true;

  boot.loader.grub.enable = true;
-  boot.loader.grub.version = 2;
  boot.loader.grub.device = "/dev/disk/by-id/scsi-3600508b1001cb1a8751c137b30610682";

  networking.hostName = "bicep";

  systemd.network.networks."30-enp6s0f0" = values.defaultNetworkConfig // {
    matchConfig.Name = "enp6s0f0";
-    address = with values.hosts.bicep; [ (ipv4 + "/25") (ipv6 + "/64") ];
+    address = with values.hosts.bicep; [ (ipv4 + "/25") (ipv6 + "/64") ]
+      ++ (with values.services.turn; [ (ipv4 + "/25") (ipv6 + "/64") ]);
  };
  systemd.network.wait-online = {
-    ignoredInterfaces = [ "enp6s0f1" ];
    anyInterface = true;
  };

--- a/hosts/bicep/services/calendar-bot.nix
+++ b/hosts/bicep/services/calendar-bot.nix
@ -0,0 +1,25 @@
+{ config, lib, pkgs, ... }:
+let
+  cfg = config.services.pvv-calendar-bot;
+in {
+  sops.secrets."calendar-bot/matrix_token" = {
+    sopsFile = ../../../secrets/bicep/bicep.yaml;
+    key = "calendar-bot/matrix_token";
+    owner = cfg.user;
+    group = cfg.group;
+  };
+
+  services.pvv-calendar-bot = {
+    enable = true;
+
+    settings = {
+      matrix = {
+        homeserver = "https://matrix.pvv.ntnu.no";
+        user = "@bot_calendar:pvv.ntnu.no";
+        channel = "!gkNLUIhYVpEyLatcRz:pvv.ntnu.no";
+      };
+      secretsFile = config.sops.secrets."calendar-bot/matrix_token".path;
+      onCalendar = "*-*-* 09:00:00";
+    };
+  };
+}
--- a/hosts/bicep/services/jokum.nix
+++ b/hosts/bicep/services/jokum.nix
@ -1,51 +0,0 @@
-{config, lib, pkgs, inputs, values, ...}:
-
-{
-  # lfmao
-  containers.jokum = {
-    autoStart = true;
-    # wtf
-    #path = inputs.self.nixosConfigurations.jokum.config.system.build.toplevel;
-    interfaces = [ "enp6s0f1" ];
-    bindMounts = {
-      "/data" = { hostPath = "/data/jokum"; isReadOnly = false; };
-    };
-    config = {config, pkgs, ...}: let
-      inherit values inputs;
-    in {
-      imports = [
-        inputs.sops-nix.nixosModules.sops
-        inputs.matrix-next.nixosModules.synapse
-
-        ../../jokum/services/matrix
-        ../../jokum/services/nginx
-      ];
-
-      _module.args = {
-        inherit values inputs;
-      };
-
-      sops.defaultSopsFile = ../../../secrets/jokum/jokum.yaml;
-      sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
-      sops.age.keyFile = "/var/lib/sops-nix/key.txt";
-      sops.age.generateKey = true;
-
-      services.openssh = {
-        enable = true;
-        permitRootLogin = "yes";
-      };
-
-      systemd.network.enable = true;
-
-      networking.useHostResolvConf = false;
-
-      systemd.network.networks."30-enp6s0f1" = values.defaultNetworkConfig // {
-        matchConfig.Name = "enp6s0f1";
-        address = with values.hosts.jokum; [ (ipv4 + "/25") (ipv6 + "/64") ]
-          ++ (with values.services.turn; [ (ipv4 + "/25") (ipv6 + "/64") ]);
-      };
-
-      system.stateVersion = "21.05";
-    };
-  };
-}
--- a/hosts/bicep/services/matrix/coturn.nix
+++ b/hosts/bicep/services/matrix/coturn.nix
@ -2,10 +2,14 @@

 {
  sops.secrets."matrix/synapse/turnconfig" = {
+    sopsFile = ../../../../secrets/bicep/matrix.yaml;
+    key = "synapse/turnconfig";
    owner = config.users.users.matrix-synapse.name;
    group = config.users.users.matrix-synapse.group;
  };
  sops.secrets."matrix/coturn/static-auth-secret" = {
+    sopsFile = ../../../../secrets/bicep/matrix.yaml;
+    key = "coturn/static-auth-secret";
    owner = config.users.users.turnserver.name;
    group = config.users.users.turnserver.group;
  };
@ -114,7 +118,7 @@
  };
  
  networking.firewall = {
-    interfaces.ens18 = let
+    interfaces.enp6s0f0 = let
      range = with config.services.coturn; [ {
      from = min-port;
      to = max-port;
--- a/hosts/bicep/services/matrix/default.nix
+++ b/hosts/bicep/services/matrix/default.nix
--- a/hosts/bicep/services/matrix/discord.nix
+++ b/hosts/bicep/services/matrix/discord.nix
@ -7,6 +7,8 @@ in
  users.groups.keys-matrix-registrations = { };

  sops.secrets."matrix/registrations/mx-puppet-discord" = {
+    sopsFile = ../../../../secrets/bicep/matrix.yaml;
+    key = "registrations/mx-puppet-discord";
    owner = config.users.users.matrix-synapse.name;
    group = config.users.groups.keys-matrix-registrations.name;
  };
@ -30,6 +32,9 @@ in
  services.mx-puppet-discord.serviceDependencies = [ "matrix-synapse.target" "nginx.service" ];


-  services.matrix-synapse-next.settings.app_service_config_files = [ config.sops.secrets."matrix/registrations/mx-puppet-discord".path ];
+  services.matrix-synapse-next.settings = {
+    app_service_config_files = [ config.sops.secrets."matrix/registrations/mx-puppet-discord".path ];
+    use_appservice_legacy_authorization = true;
+  };

 }
--- a/hosts/bicep/services/matrix/element.nix
+++ b/hosts/bicep/services/matrix/element.nix
--- a/hosts/bicep/services/matrix/mjolnir.nix
+++ b/hosts/bicep/services/matrix/mjolnir.nix
@ -2,6 +2,8 @@

 {
  sops.secrets."matrix/mjolnir/access_token" = {
+    sopsFile = ../../../../secrets/bicep/matrix.yaml;
+    key = "mjolnir/access_token";
    owner = config.users.users.mjolnir.name;
    group = config.users.users.mjolnir.group;
  };
--- a/hosts/bicep/services/matrix/synapse-admin.nix
+++ b/hosts/bicep/services/matrix/synapse-admin.nix
--- a/hosts/bicep/services/matrix/synapse.nix
+++ b/hosts/bicep/services/matrix/synapse.nix
@ -8,17 +8,16 @@ let
  imap0Attrs = with lib; f: set:
    listToAttrs (imap0 (i: attr: nameValuePair attr (f i attr set.${attr})) (attrNames set));
 in {
-  sops.secrets."matrix/synapse/dbconfig" = {
-    owner = config.users.users.matrix-synapse.name;
-    group = config.users.users.matrix-synapse.group;
-  };
-
  sops.secrets."matrix/synapse/signing_key" = {
+    key = "synapse/signing_key";
+    sopsFile = ../../../../secrets/bicep/matrix.yaml;
    owner = config.users.users.matrix-synapse.name;
    group = config.users.users.matrix-synapse.group;
  };

  sops.secrets."matrix/synapse/user_registration" = {
+    sopsFile = ../../../../secrets/bicep/matrix.yaml;
+    key = "synapse/signing_key";
    owner = config.users.users.matrix-synapse.name;
    group = config.users.users.matrix-synapse.group;
  };
@ -37,11 +36,6 @@ in {

    enableNginx = true;

-    extraConfigFiles = [
-      config.sops.secrets."matrix/synapse/dbconfig".path
-      config.sops.secrets."matrix/synapse/user_registration".path
-    ];
-
    settings = {
      server_name = "pvv.ntnu.no";
      public_baseurl = "https://matrix.pvv.ntnu.no";
@ -50,8 +44,20 @@ in {

      media_store_path =  "${cfg.dataDir}/media";

+      database = {
+        name = "psycopg2";
+        args = {
+          host = "/var/run/postgresql";
+          dbname = "synapse";
+          user = "matrix-synapse";
+          cp_min = 1;
+          cp_max = 5;
+        };
+      };
+
      presence.enabled = false;

+      event_cache_size = "20K"; # Default is 10K but I can't find the factor for this cache
      caches = {
        per_cache_factors = {
          _event_auth_cache = 2.0;
@ -73,6 +79,7 @@ in {
      mau_stats_only = true;

      enable_registration = false;
+      registration_shared_secret_path = config.sops.secrets."matrix/synapse/user_registration".path;

      password_config.enabled = lib.mkForce false;

--- a/hosts/bicep/services/mysql.nix
+++ b/hosts/bicep/services/mysql.nix
@ -0,0 +1,53 @@
+{ pkgs, lib, config, values, ... }:
+{
+  sops.secrets."mysql/password" = {
+    owner = "mysql";
+    group = "mysql";
+  };
+
+  users.mysql.passwordFile = config.sops.secrets."mysql/password".path;
+
+  services.mysql = {
+    enable = true;
+    dataDir = "/data/mysql";
+    package = pkgs.mariadb;
+    settings = {
+      mysqld = {
+        # PVV allows a lot of connections at the same time
+        max_connect_errors = 10000;
+	bind-address = values.services.mysql.ipv4;
+	skip-networking = 0;
+
+	# This was needed in order to be able to use all of the old users
+	# during migration from knakelibrak to bicep in Sep. 2023
+	secure_auth = 0;
+      };
+    };
+
+    # Note: This user also has MAX_USER_CONNECTIONS set to 3, and
+    #       a password which can be found in /secrets/ildkule/ildkule.yaml
+    #       We have also changed both the host and auth plugin of this user
+    #       to be 'ildkule.pvv.ntnu.no' and 'mysql_native_password' respectively.
+    ensureUsers = [{
+      name = "prometheus_mysqld_exporter";
+      ensurePermissions = {
+        "*.*" = "PROCESS, REPLICATION CLIENT, SELECT, SLAVE MONITOR";
+      };
+    }];
+  };
+
+  services.mysqlBackup = {
+    enable = true;
+    location = "/var/lib/mysql/backups";
+  };
+
+  networking.firewall.allowedTCPPorts = [ 3306 ];
+
+  systemd.services.mysql.serviceConfig = {
+    IPAddressDeny = "any";
+    IPAddressAllow = [
+      values.ipv4-space
+      values.ipv6-space
+    ];
+  };
+}
--- a/hosts/bicep/services/nginx/default.nix
+++ b/hosts/bicep/services/nginx/default.nix
@ -11,19 +11,35 @@
    enableReload = true;

    defaultListenAddresses = [
-      values.hosts.jokum.ipv4
-      "[${values.hosts.jokum.ipv6}]"
+      values.hosts.bicep.ipv4
+      "[${values.hosts.bicep.ipv6}]"

      "127.0.0.1"
      "127.0.0.2"
      "[::1]"
    ];

+    appendConfig = ''
+      pcre_jit on;
+      worker_processes 8;
+      worker_rlimit_nofile 8192;
+    '';
+
+    eventsConfig = ''
+      multi_accept on;
+      worker_connections 4096;
+    '';
+
    recommendedProxySettings = true;
    recommendedTlsSettings = true;
    recommendedGzipSettings = true;
+    recommendedBrotliSettings = true;
    recommendedOptimisation = true;
  };

  networking.firewall.allowedTCPPorts = [ 80 443 ];
+
+  systemd.services.nginx.serviceConfig = {
+    LimitNOFILE = 65536;
+  };
 }
--- a/hosts/bicep/services/postgres.nix
+++ b/hosts/bicep/services/postgres.nix
@ -1,4 +1,7 @@
-{ pkgs, ... }:
+{ config, pkgs, ... }:
+let
+  sslCert = config.security.acme.certs."postgres.pvv.ntnu.no";
+in
 {
  services.postgresql = {
    enable = true;
@ -19,10 +22,10 @@
      superuser_reserved_connections = 3;

      # Memory Settings
-      shared_buffers = "2048 MB";
+      shared_buffers = "8192 MB";
      work_mem = "32 MB";
-      maintenance_work_mem = "320 MB";
-      effective_cache_size = "6 GB";
+      maintenance_work_mem = "420 MB";
+      effective_cache_size = "22 GB";
      effective_io_concurrency = 100;
      random_page_cost = 1.25;

@ -62,14 +65,33 @@
      # Advanced features
      enable_partitionwise_join = true;
      enable_partitionwise_aggregate = true;
-      jit = true;
      max_slot_wal_keep_size = "1000 MB";
      track_wal_io_timing = true;
      maintenance_io_concurrency = 100;
      wal_recycle = true;
+
+      # SSL
+      ssl = true;
+      ssl_cert_file = "/run/credentials/postgresql.service/cert";
+      ssl_key_file = "/run/credentials/postgresql.service/key";
    };
  };

+  systemd.services.postgresql.serviceConfig = {
+    LoadCredential = [
+      "cert:${sslCert.directory}/cert.pem"
+      "key:${sslCert.directory}/key.pem"
+    ];
+  };
+
+  users.groups.acme.members = [ "postgres" ];
+
  networking.firewall.allowedTCPPorts = [ 5432 ];
  networking.firewall.allowedUDPPorts = [ 5432 ];
+
+  services.postgresqlBackup = {
+    enable = true;
+    location = "/var/lib/postgres/backups";
+    backupAll = true;
+  };
 }
--- a/hosts/greddost/configuration.nix
+++ b/hosts/greddost/configuration.nix
@ -1,66 +0,0 @@
-# Edit this configuration file to define what should be installed on
-# your system.  Help is available in the configuration.nix(5) man page
-# and in the NixOS manual (accessible by running ‘nixos-help’).
-
-{ config, pkgs, ... }:
-
-{
-  imports =
-    [ # Include the results of the hardware scan.
-      ../../hardware-configuration.nix
-
-      ../../base.nix
-
-      ../../services/minecraft
-    ];
-
-  nixpkgs.config.packageOverrides = pkgs: {
-    unstable = (import <nixos-unstable>) { };
-  };
-
-  # Use the GRUB 2 boot loader.
-  boot.loader.grub.enable = true;
-  boot.loader.grub.version = 2;
-  # boot.loader.grub.efiSupport = true;
-  # boot.loader.grub.efiInstallAsRemovable = true;
-  # boot.loader.efi.efiSysMountPoint = "/boot/efi";
-  # Define on which hard drive you want to install Grub.
-  boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only
-
-  networking.hostName = "greddost"; # Define your hostname.
-
-  networking.interfaces.ens18.useDHCP = false;
-
-  networking.defaultGateway = "129.241.210.129";
-  networking.interfaces.ens18.ipv4 = {
-    addresses = [
-      {
-        address = "129.241.210.174";
-        prefixLength = 25;
-      }
-    ];
-  };
-  networking.interfaces.ens18.ipv6 = {
-    addresses = [
-      {
-        address = "2001:700:300:1900::174";
-        prefixLength = 64;
-      }
-    ];
-  };
-  networking.nameservers = [ "129.241.0.200" "129.241.0.201" ];
-
-  # Open ports in the firewall.
-  networking.firewall.allowedTCPPorts = [ 25565 ];
-  networking.firewall.allowedUDPPorts = [ 25565 ];
-
-  # This value determines the NixOS release from which the default
-  # settings for stateful data, like file locations and database versions
-  # on your system were taken. It‘s perfectly fine and recommended to leave
-  # this value at the release version of the first install of this system.
-  # Before changing this value read the documentation for this option
-  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
-  system.stateVersion = "21.11"; # Did you read the comment?
-
-}
-
--- a/hosts/greddost/services/minecraft/default.nix
+++ b/hosts/greddost/services/minecraft/default.nix
@ -1,158 +0,0 @@
-{config, lib, pkgs, ... }:
-
-{
-
-  imports = [ ./minecraft-server-fabric.nix ];
-
-  environment.systemPackages = with pkgs; [
-    mcron
-  ];
-
-  pvv.minecraft-server-fabric = {
-    enable = true;
-    eula = true;
-
-    package = pkgs.callPackage ../../pkgs/minecraft-server-fabric { minecraft-server = (pkgs.callPackage ../../pkgs/minecraft-server/1_18_1.nix { }); };
-    jvmOpts = "-Xms10G -Xmx10G -XX:+UnlockExperimentalVMOptions -XX:+UseZGC  -XX:+DisableExplicitGC  -XX:+AlwaysPreTouch -XX:+ParallelRefProcEnabled";
-
-    serverProperties = {
-      view-distance = 12;
-      simulation-distance = 12;
-
-      enable-command-block = true;
-
-      gamemode = "survival";
-      difficulty = "normal";
-      
-      white-list = true;
-
-      enable-rcon = true;
-      "rcon.password" = "pvv";
-    };
-
-    dataDir = "/fast/minecraft-pvv";
-
-    mods = [
-      (pkgs.fetchurl { # Fabric API is a common dependency for fabric based mods
-        url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/0.44.0+1.18/fabric-api-0.44.0+1.18.jar";
-        sha256 = "0mlmj7mj073a48s8zgc1km0jwkphz01c1fvivn4mw37lbm2p4834";
-      })
-      (pkgs.fetchurl { # Lithium is a 100% vanilla compatible optimization mod
-        url = "https://cdn.modrinth.com/data/gvQqBUqZ/versions/mc1.18.1-0.7.6/lithium-fabric-mc1.18.1-0.7.6.jar";
-        sha256 = "1fw1ikg578v4i6bmry7810a3q53h8yspxa3awdz7d746g91g8lf7";
-      })
-      (pkgs.fetchurl { # Starlight is the lighting engine of papermc
-        url = "https://cdn.modrinth.com/data/H8CaAYZC/versions/Starlight%201.0.0%201.18.x/starlight-1.0.0+fabric.d0a3220.jar";
-        sha256 = "0bv9im45hhc8n6x57lakh2rms0g5qb7qfx8qpx8n6mbrjjz6gla1";
-      })
-      (pkgs.fetchurl { # Krypton is a linux optimized optimizer for minecrafts networking system
-        url = "https://cdn.modrinth.com/data/fQEb0iXm/versions/0.1.6/krypton-0.1.6.jar";
-        sha256 = "1ribvbww4msrfdnzlxipk8kpzz7fnwnd4q6ln6mpjlhihcjb3hni";
-      })
-      (pkgs.fetchurl { # C2ME is a parallelizer for chunk loading and generation, experimental!!!
-        url = "https://cdn.modrinth.com/data/VSNURh3q/versions/0.2.0+alpha.5.104%201.18.1/c2me-fabric-mc1.18.1-0.2.0+alpha.5.104-all.jar";
-        sha256 = "13zrpsg61fynqnnlm7dvy3ihxk8khlcqsif68ak14z7kgm4py6nw";
-      })
-      (pkgs.fetchurl { # Spark is a profiler for minecraft
-        url = "https://ci.lucko.me/job/spark/251/artifact/spark-fabric/build/libs/spark-fabric.jar";
-        sha256 = "1clvi5v7a14ba23jbka9baz99h6wcfjbadc8kkj712fmy2h0sx07";
-      })
-      #(pkgs.fetchurl { # Carpetmod gives you tps views in the tab menu,
-      #  # but also adds a lot of optional serverside vanilla+ features (which we arent using).
-      #  # So probably want something else
-      #  url = "https://github.com/gnembon/fabric-carpet/releases/download/1.4.56/fabric-carpet-1.18-1.4.56+v211130.jar";
-      #  sha256 = "0rvl2yb8xymla8c052j07gqkqfkz4h5pxf6aip2v9v0h8r84p9hf";
-      #})
-    ];
-
-    whitelist = {
-      gunalx = "913a21ae-3a11-4178-a192-401490ca0891";
-      eirikwitt = "1689e626-1cc8-4b91-81c4-0632fd34eb19";
-      Rockj = "202c0c91-a4e0-4b45-8c1b-fc51a8956c0a";
-      paddishar = "326845aa-4b45-4cd9-8108-7816e10a9828";
-      nordyorn = "f253cddf-a520-42ab-85d3-713992746e42";
-      hell04 = "c681df2a-6a30-4c66-b70d-742eb68bbc04";
-      steinarh = "bd8c419e-e6dc-4fc5-ac62-b92f98c1abc9";
-      EastTown2000 = "f273ed2e-d3ba-43fc-aff4-3e800cdf25e1";
-      DirDanner = "5b5476a2-1138-476b-9ff1-1f39f834a428";
-      asgeirbj = "dbd5d89f-3d8a-4662-ad15-6c4802d0098f";
-      Linke03 = "0dbc661d-898a-47ff-a371-32b7bd76b78b";
-      somaen = "cc0bdd13-4304-4160-80e7-8f043446fa83";
-      einaman = "39f45df3-423d-4274-9ef9-c9b7575e3804";
-      liseu = "c8f4d9d8-3140-4c35-9f66-22bc351bb7e6";
-      torsteno = "ae1e7b15-a0de-4244-9f73-25b68427e34a";
-      simtind = "39c03c95-d628-4ccc-843d-ce1332462d9e";
-      aellaie = "c585605d-24bb-4d75-ba9c-0064f6a39328";
-      PerKjelsvik = "5df69f17-27c9-4426-bcae-88b435dfae73";
-      CelestialCry = "9e34d192-364e-4566-883a-afc868c4224d";
-      terjesc = "993d70e8-6f9b-4094-813c-050d1a90be62";
-      maxelost = "bf465915-871a-4e3e-a80c-061117b86b23";
-      "4ce1" = "8a9b4926-0de8-43f0-bcde-df1442dee1d0";
-      exponential = "1ebcca9d-0964-48f3-9154-126a9a7e64f6";
-      Dodsorbot = "3baa9d58-32e4-465e-80bc-9dcb34e23e1d";
-      HFANTOM = "cd74d407-7fb0-4454-b3f4-c0b4341fde18";
-      Ghostmaker = "96465eee-e665-49ab-9346-f12d5a040624";
-      soonhalle = "61a8e674-7c7a-4120-80d1-4453a5993350";
-      MasterMocca = "481e6dac-9a17-4212-9664-645c3abe232f";
-      soulprayfree = "cfb1fb23-5115-4fe2-9af9-00a02aea9bf8";
-      calibwam = "0d5d5209-bb7c-4006-9451-fb85d7d52618";
-      Skuggen = "f0ccee0b-741a-413a-b8e6-d04552b9d78a";
-      Sivertsen3 = "cefac1a6-52a7-4781-be80-e7520f758554";
-      vafflonaut = "4d864d5c-74e2-4f29-b57d-50dea76aaabd";
-      Dhila = "c71d6c23-14d7-4daf-ae59-cbf0caf45681";
-      remorino = "2972ab22-96b3-462d-ab4d-9b6b1775b9bb";
-      SamuelxJackson = "f140e4aa-0a19-48ab-b892-79b24bd82c1e";
-      ToanBuiDuc = "a3c54742-4caf-4334-8bbb-6402a8eb4268";
-      Joces123 = "ecbcfbf9-9bcc-49f0-9435-f2ac2b3217c1";
-      brunsviken = "75ff5f0e-8adf-4807-a7f0-4cb66f81cb7f";
-      oscarsb1 = "9460015a-65cc-4a2f-9f91-b940b6ce7996";
-      CVi = "6f5691ce-9f9c-4310-84aa-759d2f9e138e";
-      Tawos = "0b98e55c-10cf-4b23-85d3-d15407431ace";
-      evenhunn = "8751581b-cc5f-4f8b-ae1e-34d90127e074";
-      q41 = "a080e5b4-10ee-4d6f-957e-aa5053bb1046";
-      jesper001 = "fbdf3ceb-eaa9-4aeb-94c2-a587cde41774";
-      finninde = "f58afd00-28cd-48dd-a74a-6c1d76b57f66";
-      GameGuru999 = "535f2188-a4a4-4e54-bec6-74977bee09ab";
-      MinusOneKelvin = "b6b973bf-1e35-4a58-803b-a555fd90a172";
-      SuperRagna = "e2c32136-e510-41b1-84c0-41baeccfb0b9";
-      Zamazaki = "d4411eca-401a-4565-9451-5ced6f48f23f";
-      supertheodor = "610c4e86-0ecc-4e7a-bffc-35a2e7d90aa6";
-      Minelost = "22ae2a1f-cfd9-4f10-9e41-e7becd34aba8";
-      Bjand = "aed136b6-17f7-4ce1-8a7b-a09eb1694ccf";
-      Dandellion = "f393413b-59fc-49d7-a5c4-83a5d177132c";
-      Shogori = "f9d571bd-5754-46e8-aef8-e89b38a6be9b";
-      Caragath = "f8d34f3a-55c3-4adc-b8d8-73a277f979e8";
-      Shmaapqueen = "425f2eef-1a9d-4626-9ba3-cd58156943dc";
-      Liquidlif3 = "420482b3-885f-4951-ba1e-30c22438a7e0";
-      newtonseple = "7d8bf9ca-0499-4cb7-9d6a-daabf80482b6";
-      nainis = "2eaf3736-decc-4e11-9a44-af2df0ee7c81";
-      Devolan = "87016228-76b2-434f-a963-33b005ae9e42";
-      zSkyler = "c92169e4-ca14-4bd5-9ea2-410fe956abe2";
-      Cryovat = "7127d743-873e-464b-927a-d23b9ad5b74a";
-      cybrhuman = "14a67926-cff0-4542-a111-7f557d10cc67";
-      stinl = "3a08be01-1e74-4d68-88d1-07d0eb23356f";
-      Mirithing = "7b327f51-4f1b-4606-88c7-378eff1b92b1";
-      "_dextra" = "4b7b4ee7-eb5b-48fd-88c3-1cc68f06acda";
-      Soraryuu = "0d5ffe48-e64f-4d6d-9432-f374ea8ec10c";
-      klarken1 = "d6967cb8-2bc6-4db7-a093-f0770cce47df";
-    };
-  };
-
-  networking.firewall.allowedTCPPorts = [ 25565 ];
-  networking.firewall.allowedUDPPorts = [ 25565 ];
-
-  systemd.services."minecraft-backup" = {
-    serviceConfig.Type = "oneshot";
-    script = ''
-      ${pkgs.mcrcon}/bin/mcrcon -p pvv "say Starting Backup" "save-off" "save-all"
-      ${pkgs.rsync}/bin/rsync -aiz --delete ${config.pvv.minecraft-server-fabric.dataDir}/world /fast/backup # Where to put backup
-      ${pkgs.mcrcon}/bin/mcrcon -p pvv "save-all" "say Completed Backup" "save-on" "save-all"
-    '';
-  };
-
-  systemd.timers."minecraft-backup" = {
-    wantedBy = ["timers.target"];
-    timerConfig.OnCalendar = [ "hourly" ];
-  };
-
-}
--- a/hosts/greddost/services/minecraft/minecraft-server-fabric.nix
+++ b/hosts/greddost/services/minecraft/minecraft-server-fabric.nix
@ -1,180 +0,0 @@
-{ lib, pkgs, config, ... }:
-
-with lib;
-
-let
-  cfg = config.pvv.minecraft-server-fabric;
-  
-  # We don't allow eula=false anyways
-  eulaFile = builtins.toFile "eula.txt" ''
-    # eula.txt managed by NixOS Configuration
-    eula=true
-  '';
-  
-  whitelistFile = pkgs.writeText "whitelist.json"
-    (builtins.toJSON
-      (mapAttrsToList (n: v: { name = n; uuid = v; }) cfg.whitelist));
-
-  cfgToString = v: if builtins.isBool v then boolToString v else toString v;
-  
-  serverPropertiesFile = pkgs.writeText "server.properties" (''
-    # server.properties managed by NixOS configuration
-  '' + concatStringsSep "\n" (mapAttrsToList
-    (n: v: "${n}=${cfgToString v}") cfg.serverProperties));
-  
-  defaultServerPort = 25565;
-
-  serverPort = cfg.serverProperties.server-port or defaultServerPort;
-
-  rconPort = if cfg.serverProperties.enable-rcon or false
-    then cfg.serverProperties."rcon.port" or 25575
-    else null;
-
-  queryPort = if cfg.serverProperties.enable-query or false
-    then cfg.serverProperties."query.port" or 25565
-    else null;
-
-in
-{
-
-  options.pvv.minecraft-server-fabric = {
-    enable = mkEnableOption "minecraft-server-fabric";
-
-    package = mkOption {
-      type = types.package;
-    };
-
-    eula = mkOption {
-      type = types.bool;
-      default = false;
-      description = ''
-        Whether you agree to
-        <link xlink:href="https://account.mojang.com/documents/minecraft_eula">
-        Mojangs EULA</link>. This option must be set to
-        <literal>true</literal> to run Minecraft server.
-      '';
-    };
-
-    dataDir = mkOption {
-      type = types.path;
-      default = "/var/lib/minecraft-fabric";
-      description = ''
-        Directory to store Minecraft database and other state/data files.
-      '';
-    };
-
-
-    whitelist = mkOption {
-      type = let
-        minecraftUUID = types.strMatching
-          "[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}" // {
-            description = "Minecraft UUID";
-          };
-        in types.attrsOf minecraftUUID;
-      default = {};
-      description = ''
-        Whitelisted players, only has an effect when
-        <option>services.minecraft-server.declarative</option> is
-        <literal>true</literal> and the whitelist is enabled
-        via <option>services.minecraft-server.serverProperties</option> by
-        setting <literal>white-list</literal> to <literal>true</literal>.
-        This is a mapping from Minecraft usernames to UUIDs.
-        You can use <link xlink:href="https://mcuuid.net/"/> to get a
-        Minecraft UUID for a username.
-      '';
-      example = literalExpression ''
-        {
-          username1 = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx";
-          username2 = "yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy";
-        };
-      '';
-    };
-
-    serverProperties = mkOption {
-      type = with types; attrsOf (oneOf [ bool int str ]);
-      default = {};
-      example = literalExpression ''
-        {
-          server-port = 43000;
-          difficulty = 3;
-          gamemode = 1;
-          max-players = 5;
-          motd = "NixOS Minecraft server!";
-          white-list = true;
-          enable-rcon = true;
-          "rcon.password" = "hunter2";
-        }
-      '';
-      description = ''
-        Minecraft server properties for the server.properties file. Only has
-        an effect when <option>services.minecraft-server.declarative</option>
-        is set to <literal>true</literal>. See
-        <link xlink:href="https://minecraft.gamepedia.com/Server.properties#Java_Edition_3"/>
-        for documentation on these values.
-      '';
-    };
-
-    jvmOpts = mkOption {
-      type = types.separatedString " ";
-      default = "-Xmx2048M -Xms2048M";
-      # Example options from https://minecraft.gamepedia.com/Tutorials/Server_startup_script
-      example = "-Xmx2048M -Xms4092M -XX:+UseG1GC -XX:+CMSIncrementalPacing "
-        + "-XX:+CMSClassUnloadingEnabled -XX:ParallelGCThreads=2 "
-        + "-XX:MinHeapFreeRatio=5 -XX:MaxHeapFreeRatio=10";
-      description = "JVM options for the Minecraft server.";
-    };
-
-    mods = mkOption {
-      type = types.listOf types.package;
-      example = literalExpression ''
-        [
-          (pkgs.fetchurl {
-            url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/0.44.0+1.18/fabric-api-0.44.0+1.18.jar";
-            sha256 = "0mlmj7mj073a48s8zgc1km0jwkphz01c1fvivn4mw37lbm2p4834";
-          })
-        ];
-      '';
-      description = "List of mods to put in the mods folder";
-    };
-  };
-
-  config = mkIf cfg.enable {
-    users.users.minecraft = {
-      description     = "Minecraft server service user";
-      home            = cfg.dataDir;
-      createHome      = true;
-      isSystemUser    = true;
-      group           = "minecraft";
-    };
-    users.groups.minecraft = {};
-
-    systemd.services.minecraft-server-fabric = {
-      description   = "Minecraft Server Service";
-      wantedBy      = [ "multi-user.target" ];
-      after         = [ "network.target" ];
-
-      serviceConfig = {
-        ExecStart = "${cfg.package}/bin/minecraft-server ${cfg.jvmOpts}";
-        Restart = "always";
-        User = "minecraft";
-        WorkingDirectory = cfg.dataDir;
-      };
-
-      preStart = ''
-        ln -sf ${eulaFile} eula.txt
-        ln -sf ${whitelistFile} whitelist.json
-        cp -f ${serverPropertiesFile} server.properties
-
-        ln -sfn ${pkgs.linkFarmFromDrvs "fabric-mods" cfg.mods} mods
-      '';
-    };
-
-    assertions = [
-      { assertion = cfg.eula;
-        message = "You must agree to Mojangs EULA to run minecraft-server."
-          + " Read https://account.mojang.com/documents/minecraft_eula and"
-          + " set `services.minecraft-server.eula` to `true` if you agree.";
-      }
-    ]; 
-  };
-}
--- a/hosts/ildkule/services/metrics/dashboards/mysql.json
+++ b/hosts/ildkule/services/metrics/dashboards/mysql.json
--- a/hosts/ildkule/services/metrics/dashboards/synapse.json
+++ b/hosts/ildkule/services/metrics/dashboards/synapse.json
--- a/hosts/ildkule/services/metrics/grafana.nix
+++ b/hosts/ildkule/services/metrics/grafana.nix
@ -64,6 +64,13 @@ in {
          url = "https://raw.githubusercontent.com/matrix-org/synapse/develop/contrib/grafana/synapse.json";
          options.path = dashboards/synapse.json;
        }
+	# TODO: enable once https://github.com/NixOS/nixpkgs/pull/242365 gets merged
+	# {
+	#   name = "MySQL";
+	#   type = "file";
+	#   url = "https://raw.githubusercontent.com/prometheus/mysqld_exporter/main/mysqld-mixin/dashboards/mysql-overview.json";
+	#   options.path = dashboards/mysql.json;
+	# }
        {
          name = "Postgresql";
          type = "file";
--- a/hosts/ildkule/services/metrics/prometheus/default.nix
+++ b/hosts/ildkule/services/metrics/prometheus/default.nix
@ -1,9 +1,11 @@
 { config, ... }: {
  imports = [
-    ./node.nix
-    ./matrix-synapse.nix
-    ./postgres.nix
    ./gogs.nix
+    ./matrix-synapse.nix
+    # TODO: enable once https://github.com/NixOS/nixpkgs/pull/242365 gets merged
+    # ./mysqld.nix
+    ./node.nix
+    ./postgres.nix
  ];

  services.prometheus = {
--- a/hosts/ildkule/services/metrics/prometheus/mysqld.nix
+++ b/hosts/ildkule/services/metrics/prometheus/mysqld.nix
@ -0,0 +1,25 @@
+{ config, unstable, ... }: let
+  cfg = config.services.prometheus;
+in {
+  sops.secrets."config/mysqld_exporter" = { };
+
+  services.prometheus = {
+    scrapeConfigs = [{
+      job_name = "mysql";
+      scheme = "http";
+      metrics_path = cfg.exporters.mysqld.telemetryPath;
+      static_configs = [
+        {
+          targets = [
+            "localhost:${toString cfg.exporters.mysqld.port}"
+          ];
+        }
+      ];
+    }];
+
+    exporters.mysqld = {
+      enable = true;
+      configFilePath = config.sops.secrets."config/mysqld_exporter".path;
+    };
+  };
+}
--- a/hosts/ildkule/services/metrics/prometheus/node.nix
+++ b/hosts/ildkule/services/metrics/prometheus/node.nix
@ -12,9 +12,9 @@ in {
          "knakelibrak.pvv.ntnu.no:9100"
          "hildring.pvv.ntnu.no:9100"
          "bicep.pvv.ntnu.no:9100"
-          "jokum.pvv.ntnu.no:9100"
          "essendrop.pvv.ntnu.no:9100"
          "andresbu.pvv.ntnu.no:9100"
+          "bekkalokk.pvv.ntnu.no:9100"
        ];
      }
    ];
--- a/hosts/jokum/configuration.nix
+++ b/hosts/jokum/configuration.nix
@ -1,43 +0,0 @@
-{ config, pkgs, values, ... }:
-{
-  imports = [
-      ../../base.nix
-#      ../../misc/metrics-exporters.nix
-      ../../misc/rust-motd.nix
-
-#      ./services/matrix
-#      ./services/nginx
-    ];
-
-#  sops.defaultSopsFile = ../../secrets/jokum/jokum.yaml;
-#  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
-#  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
-#  sops.age.generateKey = true;
-
-  boot.kernel.enable = false;
-  boot.isContainer = true;
-  boot.loader.initScript.enable = true;
-  networking.useHostResolvConf = false;
-
-  networking.hostName = "jokum"; # Define your hostname.
-
-  systemd.network.networks."30-enp6s0f1" = values.defaultNetworkConfig // {
-    matchConfig.Name = "ens10f1";
-    address = with values.hosts.jokum; [ (ipv4 + "/25") (ipv6 + "/64") ]
-      ++ (with values.services.turn; [ (ipv4 + "/25") (ipv6 + "/64") ]);
-  };
-
-  # List packages installed in system profile
-  environment.systemPackages = with pkgs; [
-  ];
-
-  # List services that you want to enable:
-
-  # This value determines the NixOS release from which the default
-  # settings for stateful data, like file locations and database versions
-  # on your system were taken. It‘s perfectly fine and recommended to leave
-  # this value at the release version of the first install of this system.
-  # Before changing this value read the documentation for this option
-  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
-  system.stateVersion = "21.05"; # Did you read the comment?
-}
--- a/hosts/shark/configuration.nix
+++ b/hosts/shark/configuration.nix
@ -0,0 +1,39 @@
+{ config, pkgs, values, ... }:
+{
+  imports = [
+      # Include the results of the hardware scan.
+      ./hardware-configuration.nix
+      ../../base.nix
+      ../../misc/metrics-exporters.nix
+    ];
+
+  sops.defaultSopsFile = ../../secrets/shark/shark.yaml;
+  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
+  sops.age.generateKey = true;
+
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  networking.hostName = "shark"; # Define your hostname.
+
+  systemd.network.networks."30-ens18" = values.defaultNetworkConfig // {
+    matchConfig.Name = "ens18";
+    address = with values.hosts.shark; [ (ipv4 + "/25") (ipv6 + "/64") ];
+  };
+
+  # List packages installed in system profile
+  environment.systemPackages = with pkgs; [
+  ];
+
+  # List services that you want to enable:
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "23.05"; # Did you read the comment?
+
+}
--- a/hosts/shark/hardware-configuration.nix
+++ b/hosts/shark/hardware-configuration.nix
@ -0,0 +1,38 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/profiles/qemu-guest.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/224c45db-9fdc-45d4-b3ad-aaf20b3efa8a";
+      fsType = "ext4";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/CC37-F5FE";
+      fsType = "vfat";
+    };
+
+  swapDevices =
+    [ { device = "/dev/disk/by-uuid/a1ce3234-78b1-4565-9643-f4a05004424f"; }
+    ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.ens18.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}
--- a/secrets/bekkalokk/bekkalokk.yaml
+++ b/secrets/bekkalokk/bekkalokk.yaml
@ -0,0 +1,75 @@
+gitea:
+    password: ENC[AES256_GCM,data:hlNzdU1ope0t50/3aztyLeXjMHd2vFPpwURX+Iu8f49DOqgSnEMtV+KtLA==,iv:qljRnSnchL5cFmaUAfCH9GQYQxcy5cyWejgk1x6bFgI=,tag:tIhboFU5kZsj5oAQR3hLbw==,type:str]
+    database: ENC[AES256_GCM,data:UlS33IdCEyeSvT6ngpmnkBWHuSEqsB//DT+3b7C+UwbD8UXWJlsLf1X8/w==,iv:mPRW5ldyZaHP+y/0vC2JGSLZmlkhgmkvXPk4LazkSDs=,tag:gGk6Z/nbPvzE1zG+tJC8Sw==,type:str]
+    passwd-ssh-key: ENC[AES256_GCM,data:L0lF0wvpayss1NU9m3A45cH0bCMQzODTFVrq6EPd1JHx54wIcoaRBYLmxXKXASzBlCg9zlwXMUIk3OQcS3kdzMKL0iqcSL2iicAcKjFIHyrWLqXgwV5pRSP/tRPcVw8KW8gz0bh33EgESs5ReddZ3VZ0Cy1s2YupMRQvBXr89k1+Hv70OWB6P06hvxhv/zKcMGI1N/dWLroMgrQuT9imw4+/Q1RqwzTYeEU+eUn24AM9GjcBg4qf3OI+6g0nXUat/upIYE28iF5J3lbUSmDSmirBLc8xgHLdOyyJPTObWYWYxlSL78T7IqiMm9lI3rtBlpJDDcn/YxZpVqN5bg2154GISNK+uR0TVSLdJ+drdGHIfIX3G78XSxf2L9rbJyRn8MQlgStfdBIQicLavQKVMrmj+XQfvEMez23WbPLjH4oViBQFI+GrOHOGy/f16cz8Sn4n+69OcsOeTxs3tKYdfq6r1XLYSJ/fe/zvxBpaZiyGXljsuyEdIyBL2A8D6uSXe3Nd3/DAdBtceFfIdN1olCdutixzVWgxaJnrel161z5A/4w=,iv:Uy46yY3jFYSvpxrgCHxRMUksnWfhf5DViLMvCXVMMl4=,tag:wFEJ5+icFrOKkc56gY0A5g==,type:str]
+    ssh-known-hosts: ENC[AES256_GCM,data:zlRLoelQeumMxGqPmgMTB69X1RVWXIs2jWwc67lk0wrdNOHUs5UzV5TUA1JnQ43RslBU92+js7DkyvE5enGzw7zZE5F1ZYdGv/eCgvkTMC9BoLfzHzP6OzayPLYEt3xJ5PRocN8JUAD55cuu4LgsuebuydHPi2oWOfpbSUBKSeCh6dvk5Pp1XRDprPS5SzGLW8Xjq98QlzmfGv50meI9CDJZVF9Wq/72gkyfgtb3YVdr,iv:AF06TBitHegfWk6w07CdkHklh4ripQCmA45vswDQgss=,tag:zKh7WVXMJN2o9ZIwIkby3Q==,type:str]
+    import-user-env: ENC[AES256_GCM,data:vfaqjGEnUM9VtOPvBurz7nFwzGZt3L2EqijrQej4wiOcGCrRA4tN6kBV6NmhHqlFPsw=,iv:viPGkyOOacCWcgTu25da4qH7DC4wz2qdeC1W2WcMUdI=,tag:BllNqGQoaxqUo3lTz9LGnw==,type:str]
+    runners:
+        alpha: ENC[AES256_GCM,data:gARxCufePz+EMVwEwRsL2iZUfh9HUowWqtb7Juz3fImeeAdbt+k3DvL/Nwgegg==,iv:3fEaWd7v7uLGTy2J7EFQGfN0ztI0uCOJRz5Mw8V5UOU=,tag:Aa6LwWeW2hfDz1SqEhUJpA==,type:str]
+        beta: ENC[AES256_GCM,data:DVjS78IKWiWgf+PuijCZKx4ZaEJGhQr7vl+lc7QOg1JlA4p9Kux/tOD8+f2+jA==,iv:tk3Xk7lKWNdZ035+QVIhxXy2iJbHwunI4jRFM4It46E=,tag:9Mr6o//svYEyYhSvzkOXMg==,type:str]
+        epsilon: ENC[AES256_GCM,data:JMnZVBdiy+5oPyXgDpfYvy7qLzIEfHy09fQSBDpNG4zDXTil2pSKBKxk09h5xg==,iv:/8oXKJW6+sMBjDt51MqVAWjQPM5nk02Lv5QqbZsZ5ms=,tag:+Rx7ursfVWc0EcExCLgLhQ==,type:str]
+mediawiki:
+    password: ENC[AES256_GCM,data:HsBuA1E7187roGnKuFPfPDYxA16GFjAUucgUtrdUFmcOzmTNiFH+NWY2ZQ==,iv:vDYUmmZftcrkDtJxNYKAJSx9j+AQcmQarC62QRHR4IM=,tag:3TKjNrGRivFWoK3djC748g==,type:str]
+    database: ENC[AES256_GCM,data:EvVK3Mo6cZiIZS+gTxixU4r9SXN41VqwaWOtortZRNH+WPJ4xcYvzYMJNg==,iv:JtFTRLn3fzKIfgAPRqRgQjct7EdkEHtiyQKPy8/sZ2Q=,tag:nqzseG6BC0X5UNI/3kZZ3A==,type:str]
+    oidc:
+        clientsecret: ENC[AES256_GCM,data:bh016Qlijs5hoNY1iYsx6uEa5oEG9aX4T9BMiqnDRhSh7iVXpj9A6glcr8OGmWN7Om7yXE4AdlY=,iv:BnZjxbK6oB1eALx3RidpkwzU8xz1x0luwZC7ioqTjQE=,tag:HX8uUevimnAcqBH8NaMQXA==,type:str]
+keycloak:
+    database: ENC[AES256_GCM,data:76+AZnNR5EiturTP7BdOCKE90bFFkfGlRtviSP5NHxPbb3RfFPJEMlwtzA==,iv:nS7VTossHdlrHjPeethhX+Ysp9ukrb5JD7kjG28OFpY=,tag:OMpiEv9nQA7v6lWJfNxEEw==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age12nj59tguy9wg882updc2vjdusx5srnxmjyfaqve4zx6jnnsaw3qsyjq6zd
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDbDc0NXZqYko1Z25qYkhq
+            T2p4cGZ1bTZRS25YdjJ0K3JhSklCT1NwSHhzCi9MVnM2YTRuUERwTVlaM2lxNEtp
+            Mk9hcDREcTErZXJtSEI0aE1PV2NDV1EKLS0tIDY2MEN6a3NWb3JpeU5JVkhoOFVR
+            MjVqdHg0SnF5N3VEV2U4a2dvbTZjem8K8J6KQMJwpiC8gqlgi29x3dpSORAmuVQ6
+            cX5jXggOoz5vME6BMQ3s/bglZG2pdEgWpGZVbc4x2iMwUWgJLHdgXg==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age17tagmpwqjk3mdy45rfesrfey6h863x8wfq38wh33tkrlrywxducs0k6tpq
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1SHMrVmxsL0orQlk3dy9H
+            NDMzWEZYMXhkamVkTy84VGEzUm1BU3lNY2dNCkNwOGJteVQzYlZESGlScTg0RnFx
+            emNXbmZhL3BHWThPRUI4MVIzMU1POTgKLS0tIHRmQ0llR1NCSm9KMHZsOGJXYmxk
+            eGpDUlFHdEZmWkZHTEw4Mmk2UWRnUU0Ki5GK2mzDIc2iTryjn6lf5lMqVZcCcxQ2
+            a3Y/o/NMFDhMZpLlEljuWQVnuOyJZ3RSDCFN9BSEkxg05PaoSluUzQ==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1mrnldl334l2nszuta6ywvewng0fswv2dz9l5g4qcwe3nj4yxf92qjskdx6
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZY2ZiazhzdkxNZFZldjBV
+            SjBCR2lXdFZZUUpJTnJVWUVMNTcybGQvbmpNClVDOEdMK0JIOUEvaVYxcm4yeVp4
+            dVY5b292WVE5L2JXNGQvSENiTjBWVkkKLS0tIGIvdzBxMVNYbGN4ZXBBNDg1bFNB
+            akVjeTNTeGorZjJQOVlMeCtPRUVYL3MK+VMvGxrbzGz4Q3sdaDDWjal+OiK+JYKX
+            GHiMXVHQJZu/RrlxMjHKN6V3iaqxZpuvLAEJ2Lzy5EOHPtuiiRyeHQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2023-09-17T21:12:05Z"
+    mac: ENC[AES256_GCM,data:wfq3FTwwJh2eHbw5PW32IEp4jWeSQLaBLJzrbgfXUPP8VuPK3Q7puQtchsQ3Xrv2+c9FI536luhwaUPfgn+/JE8rn8KEhabMPrX2lYMVH8I4OkCYEivpbWNfmm3gfNU2SrEFZ2jBBLLCWDgBAA7SfyApiQiyZ3qpJ2aZCfgaUoM=,iv:5/R2tnjiQ6BPgU+eAChm2EsWuGurqumnzl4pfjZclLw=,tag:xdECs8muNv9c/68IRbWzCw==,type:str]
+    pgp:
+        - created_at: "2023-05-21T00:28:40Z"
+          enc: |
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA0av/duuklWYAQ//TewS5bITIo3bx0HEM0p8bwnSJAmNqGJmuILXg4k8eszF
+            JHS9eCfU/Vz4Z8eMDJjntFIWvNCl0QOycvp37uNaqPedDE3v1nNpCxOZ76vLT9I5
+            smXKpRmfgYxQAkWQRJ6aUV+DoVjSY/hT9JWD7u4uWgavG5D7/3SwiJC3uM0/8mxM
+            gwbp5eVEO0mTvXZsmqIRJ00NKX+RIMuUZFvzu3ajGywZfQxFs7zUhx7Lc6ry/MYI
+            FFrbXssgpH8U9dHMgBsGzeyQS4qQLGFHJuNBBzz48U+Dr5EgHqZ2ZXZschW+40qX
+            TH8d4qyOROTiHKpKp3+nUoRiz1JPkJ0rqHg+9hOrFNpl1NZQ6w1UOc+0Ki6ZAwMd
+            yNF733/I+OaI2b4nxhG+la6U9Z1fOat3BPRoxp8ZlLRrPq8ljxV78TMVfv7/lPO6
+            MZopBmSOeV19t/QypYi2pl+QYRaVs2QaBFotulob+KbKpWC4T2tMEMnPngsTxOhk
+            26VY5ahIp01QbewPxylpY6r1jx1tb8KcMmsGlaLrgOo9Q526bh5QGRDx9NCj064c
+            uJ2ed7hY9tNHs6qN/94rcr1hOAq5kVh+36UvJBZYQuxwIXIws4Xw+obzoKVAAqEC
+            qEZWL1NB0hXynom7Vc2e2MzT2guogXDHvlCDHjtt9ekGcmU+tQ/JdgTOJ93hEInS
+            XgEjcd1xpnzebDo9SpNBq/J/uSKAKLPOI2y+LZzvs6oiFtc4QLcgGors38x9SiAP
+            JSiQnUAC9XZtiugGdCOVy6MG1x3smAafW6kcH7yr+vWoJoQLbbF60PhuhAJ0N4Q=
+            =3iQC
+            -----END PGP MESSAGE-----
+          fp: F7D37890228A907440E1FD4846B9228E814A2AAC
+    unencrypted_suffix: _unencrypted
+    version: 3.7.3
--- a/secrets/bekkalokk/bekkalokk/bekkalokk.yaml
+++ b/secrets/bekkalokk/bekkalokk/bekkalokk.yaml
@ -1,66 +0,0 @@
-gitea:
-    password: ENC[AES256_GCM,data:hlNzdU1ope0t50/3aztyLeXjMHd2vFPpwURX+Iu8f49DOqgSnEMtV+KtLA==,iv:qljRnSnchL5cFmaUAfCH9GQYQxcy5cyWejgk1x6bFgI=,tag:tIhboFU5kZsj5oAQR3hLbw==,type:str]
-mediawiki:
-    password: ENC[AES256_GCM,data:HsBuA1E7187roGnKuFPfPDYxA16GFjAUucgUtrdUFmcOzmTNiFH+NWY2ZQ==,iv:vDYUmmZftcrkDtJxNYKAJSx9j+AQcmQarC62QRHR4IM=,tag:3TKjNrGRivFWoK3djC748g==,type:str]
-keys:
-    postgres:
-        gitea: ENC[AES256_GCM,data:lG4P8kzp7Zq94WftN7p1RJqM65esPuTFZ2JJWkFFXTzlid2DRZPsG2FGIA==,iv:JvHQUgwwb7wJTNMxjLjOUw5sKKWlyMJafVaUOLUu9Sk=,tag:qE0+gDFU/YtghqCv/d2Qgw==,type:str]
-        mediawiki: ENC[AES256_GCM,data:p+s/uQ3ywQY9RpImFWTxjt1orzl905i9kTQPzsAIs6hAK5t3B00XVzKZgQ==,iv:xp3PRrjCGFxCsRZOlJGIonBOKWJ+3/1CByc4q7O3vDw=,tag:bfKlU2Pcoq0cQjbhp+UXag==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age1mrnldl334l2nszuta6ywvewng0fswv2dz9l5g4qcwe3nj4yxf92qjskdx6
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSYUR4TjA3WU96TzV6R1V5
-            TFpPUW1CdnRZck50bzJSb3VnUXFYUDhxM2hJCmI2Q0p3ZVZGS0U4UmNaQ0Z3Vmgv
-            MkNyS1hVUWs5UjZ3cTJRU0pWbmFSeEkKLS0tIGlIRGYxTjgzWmVWbXRwTjhHdnRx
-            U3JMU1ZUT1ZhT2xSbHRLVXgzODB1NXcKJ2LTJB2oKffW+aZgkEEwp+xhAY0FpnBl
-            5GqUdZrgkNOV0pvgVAOoXMyCdZbndYLS+dUzggnF91HJOr87wRH4uw==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age17tagmpwqjk3mdy45rfesrfey6h863x8wfq38wh33tkrlrywxducs0k6tpq
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzUmpzTVdlRlg0OHBFQ2lq
-            eDdmOUlxbzcxakFsS2JHK3JqU0tNTC9mOGhRCjNCbFcxWTFzeTkxcHZLQjBpb2c1
-            V3VHeGhuTkhNbGlsVVlMallPcTVIK0kKLS0tIHRISitSQXBENVY3ejdYa3pXRmJ1
-            TVNBRXQvUmRPdlMreGtzZUNUcnM4aEkKAp/Ofix26q1eeHszIJa4yYF9ycwWodeV
-            216hz9YUYb9aZCoJJzGPceb/ER17yvqFHQlhgEb9EiKaH3vbIu+WRQ==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age13t2nnr6yukmtda6wn2uggfcj0dmwce8347y8w6xzt4yje6wlgscqnahuqm
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUVC9Cd01HaWpyUm5mdTh4
-            Uk5mSlBLQTlydkpQc0Irakxmalg1WU92U0JjCnhFbDFNaThIVEVNMldiT3BtL2cw
-            UU4rNEhvTXkzWXlMWUZGeEdJaTg0WjQKLS0tIEZlWkI3SzFOT1NoQWpIM2poMXE4
-            RHN4RDJWWGV2ZDJzVUo1VVorNzhlMGMKCwdWOZOnibpbB5mZSCBGhj+yUZvk/vuK
-            hsiDo74vmsmNZ/zmN6cw60hNwhZ4NgtfXcKG8Axe+1rPUwEcrvWHIQ==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-01-28T23:33:14Z"
-    mac: ENC[AES256_GCM,data:c7YytaXdAPQmCiZHH2cojJqcZna2ilGXzpnkgxgYUOSQ0n3tryOK45uVp2JDN9OJ9gS5QsLf62AlqidE0wkYYuRC6HZnwhmlMuoY3kl2sr0/Y4kJqGeODRlZoGzUIOahHkphK1Y5GBs8GW6OYk46U54wi9+BF062pYxuOCoPwD4=,iv:ZLueZpRdaD/7uvmimDUELCAtM3e9169vmoXcHz4OKfQ=,tag:Ya8tMbUBhuypXJeZ8GQmWA==,type:str]
-    pgp:
-        - created_at: "2023-01-28T23:37:44Z"
-          enc: |
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA0av/duuklWYAQ//foXRhar7kfr0PbxVjk2uWzGBoXpffjZPCoaM3D8RhIM8
-            kod/LMqUUkCvGjBFrmKiN2BCKf3SLDjnZp55J7zQ8x3Go133JdOAB/zZDaT+oxv1
-            kGQneeXRqeD51/25nFTq+ZZSzBP8fXJgmlsR/1ZM1/IjKF5m5JzD2duqNKV3fqto
-            IwdiqvrkMiCQICmvKxwwtbdP8+29eUbnfdOi9MO8wcXuObwz84mmpgjT30mNCWF8
-            Ha7PlcdjpRpYHwUp66+yO4uZ9nOAs7ygzcxKLOMwyaHDv9QJYHtXDUvLv50Jnucw
-            KhukMJHTURzeNgUEtTu7kR0WCEBl4IyZ6GUJhc2bX3JEbYi9xZqMHgh+lf1usd1q
-            bDPe3xUEKKgAPXeZRzqCQoy/MuIPErMWpqAQePtL3KOafX+vTve0lfPtLKKbne8+
-            Tv3eaj3chC255wq6CaJjHO+PI1nt2k29KC6XXxTzkwbRxgT6wVP9uIszeRdREpyX
-            +//TCsvnAwd2l3ojzXwIEv3F6/xeYpj7hur59BopDRX3yEUNZhgfDa+l6+BIHoDZ
-            TY3ocQrIxH40CF4IxL6dDR8OOut9vlDpfZTora7MLiQbTU1t5huGY0zBH1LpQ4u9
-            B/DnBKIuEhZf6eoH5DNHLnzuFYT6Q8QUHfHsM5KOnSEtx2oS2Txd/Ag7dS4FTPPS
-            XgEe6r+BP6ItZlDVBHN9EPkgS96xpQ5EIacTxX7qmA0ToGySIyMC3PVJkO8muIIK
-            /Lmmp6yaBOQN0kqQ26dTuVOMfMzI8zqnOW03Lm35nGnl3x8mGDH48j4Y05pS85k=
-            =t11j
-            -----END PGP MESSAGE-----
-          fp: F7D37890228A907440E1FD4846B9228E814A2AAC
-    unencrypted_suffix: _unencrypted
-    version: 3.7.3
--- a/secrets/bicep/bicep.yaml
+++ b/secrets/bicep/bicep.yaml
@ -0,0 +1,62 @@
+calendar-bot:
+    matrix_token: ENC[AES256_GCM,data:zJv9sw6pEzb9hxKT682wsD87HC9iejbps2wl2Z5QW1XZUSBHdcqyg1pxd+jFKTeKGQ==,iv:zDbvF1H98NsECjCtGXS+Y9HIhXowzz9HF9mltqnArog=,tag:/ftcOSQ13ElkVJBxYIMUGQ==,type:str]
+mysql:
+    password: ENC[AES256_GCM,data:KqEe0TVdeMIzPKsmFg9x0X9xWijnOk306ycyXTm2Tpqo/O0F,iv:Y+hlQ8n1ZIP9ncXBzd2kCSs/DWVTWhiEluFVwZFKRCA=,tag:xlaUk0Wftk62LpYE5pKNQw==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1sl43gc9cw939z5tgha2lpwf0xxxgcnlw7w4xem4sqgmt2pt264vq0dmwx2
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2RFpLOEtUQ0ZLeUdmTGxl
+            VXlTOG82Ly8vdjdldnB0dGFzTkdxUHNML1VJCmxDWHhyMHYrbmtMVWVJYTdrWjVn
+            aE5qWWtHWSszYnNWc3l2VmFwUGl4R3MKLS0tIG9ocThFNm1pcUtMNHNlMlFsS2lx
+            MDhubWVxamxlSVk0dUtIWnhyUlBNM00KRunPljgLCHkwn4HCPGpkNbLitCIF7hYL
+            jRYVzu+Wddd13A4QfvHvAI7bJB5Zsv/xwmggVlICG1pky7gPNDwGcA==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age17tagmpwqjk3mdy45rfesrfey6h863x8wfq38wh33tkrlrywxducs0k6tpq
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvem5LODRyU0VlcElOS0tY
+            a1FaNHc0SDJLQ1llalBqQ2VEQjZpbUFyd0hNCldQNUpTdFZ5NTlxWU9icXN2Mm5a
+            S0JQOUkvdEZRK3NBOGpEZkJleTB1TXMKLS0tIHdVcFRETFlBVWI3TTZYZGJMMkcv
+            RkRXTTVURDRFNjFvci8zRVpqbkxVclEKW86hoVO0grt2x5YMt/YnmDI6J0QFKjZZ
+            Mnmd/Z1S6a+rajCy0GkeM+Q8AbBqBrNei2H5Xp1PlxNyicGib6+Ngg==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1mrnldl334l2nszuta6ywvewng0fswv2dz9l5g4qcwe3nj4yxf92qjskdx6
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4bHNiY3ZCNHZsYlUrOHMy
+            OG55QjVmQVUxbXl0bkdNQ0FEais5Sng0ZkRBCm5KdmMvNmN6VmdsREZrbGd4ZFpM
+            VVpsQk43MlBxU042ZkE4L1hHK1R4RVEKLS0tIGttL01XcG1IUnBMbUVqKzJMK09o
+            QmVlRnJhSk4xYWFVbGVxdlFxSDlXSGMKJvjMDaX4Aa98gT+GPjGaKKdnG67jNG3C
+            nLsbxU4vNpFvjF4WI5vdvIQe5UGzoCYQZp3oHFnGq+Jp/hJ1HFF0GQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2023-09-05T23:28:56Z"
+    mac: ENC[AES256_GCM,data:pCWTkmCQgBOqhejK2sCLQ3H8bRXmXlToQxYmOG0IWDo2eGiZOLuIkZ1/1grYgfxAGiD4ysJod0nJuvo+eAsMeYAy6QJVtrOqO2d9V2NEdzLckXyYvwyJyZoFbNC5EW9471V0m4jLRSh5821ckNo/wtWFR11wfO15tI3MqtD1rtA=,iv:QDnckPl0LegaH0b7V4WAtmVXaL4LN+k3uKHQI2dkW7E=,tag:mScUQBR0ZHl1pi/YztrvFg==,type:str]
+    pgp:
+        - created_at: "2023-08-27T00:12:42Z"
+          enc: |
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA0av/duuklWYAQ//edQVXnTS4Xarwt14tF6yyhWM9/JFSVWW97lTO6xTNe5S
+            jNROmF/tHl29IPX0/QHXj/d4jMF/nteHdD53nD9s312CPOBv3SEwl4e7hfMf3rUN
+            4YOahX9J4ryoB+ZleK5leoYSsWaVBDJfERMkYT9Ta/xv4EC5zHBTlZDpLRuS04eZ
+            W5MG57TKBC0oifPvhCuv22OURNUp9t/bysSuKgU1v0Czu6ozuVgw9AO8G+PstFpW
+            7lyIMUNJQ7g3hiKDrrPPYcrKTeBbhxTINObe29nv00y0lycnfx3PxWrXpBoyv82y
+            xRgtalVvlYre1w6IFkqDFtpJD6N3zPFnPq4ZQ0nHN7A943Kxli5JnlkRH9Ak098K
+            PuykZ+V2X+qFNf4LS+Gnjx9wZKaLEChMaDhILUDKuUcwPIU5EiaaBOS1Y8NQ4Lha
+            pzyWzvpejV87Qvg2iog9UYLsK33GuxcFzYaklnknrI+9SotM7LRGQTVkVOwykh86
+            8d+Sake0J/1xjOcxUNbaYreTA3myyklVlvoybyNOdSzxGveEq3KvGgcORnQxYwe3
+            QDoCdVNTmU5ELwDPALVMenDr7VixN085oJkYqZJ6v5E0K1Bhtrb6PItoC5Kea55s
+            zWP+0rYxFx884cqpf8/JuC1Jbs1DpljqMMW9aD6A0htzOwEyHzDKWxy7zxCJrgjS
+            XgFHIr6sG1geqUzIhw8NzUpdOkdlQ6YFKP3MsUfxIqPHWVQWt1+LLvA5BX/wXIe6
+            kPTa9qXwmK7Hrh5TyPPEjrO16qT3UE0nvRAI0s79L6U+99xXfhKIXhg2OMSZCR8=
+            =xnr5
+            -----END PGP MESSAGE-----
+          fp: F7D37890228A907440E1FD4846B9228E814A2AAC
+    unencrypted_suffix: _unencrypted
+    version: 3.7.3
--- a/secrets/bicep/matrix.yaml
+++ b/secrets/bicep/matrix.yaml
@ -0,0 +1,68 @@
+synapse:
+    turnconfig: ENC[AES256_GCM,data:mASRjYa4C9WRow4x0XYRrlCE5LMJUYaId+o62r1qhsyJPa2LzrI=,iv:5vYdubvMDjLS6soiWx2DzkEAATb9NFbSS/Jhuuz1yI8=,tag:wOW07CQMDbOiZNervee/pg==,type:str]
+    user_registration: ENC[AES256_GCM,data:ZDZfEEvyw8pg0WzhrdC8747ed+ZR2ZA8/WypJd/iDkmIy2RmxOeI0sE=,iv:l61mOlvzpCql4fC/eubBSU6px21et2WcpxQ6rFl14iw=,tag:sVDEAa3xipKIi/6isCjWew==,type:str]
+    signing_key: ENC[AES256_GCM,data:6UpfiRlX9pRM7zhdm7Mc8y8EItLzugWkHSgE0tGpEmudCTa1wc60oNbYfhKDWU81DT/U148pZOoX1A==,iv:UlqCPicPm5eNBz1xBMI3A3Rn4t/GtldNIDdMH5MMnLw=,tag:HHaw6iMjEAv5b9mjHSVpwA==,type:str]
+coturn:
+    static-auth-secret: ENC[AES256_GCM,data:y5cG/LyrorkDH+8YrgcV7DY=,iv:ca90q2J3+NOy51mUBy4TMKfYMgWL4hxWDdsKIuxRBgU=,tag:hpFCns1lpi07paHyGB7tGQ==,type:str]
+mjolnir:
+    access_token: ENC[AES256_GCM,data:ERFqZjK7MRD0xWt91FNCIxP1YC6Qj54QgnckHlCTtcQVLWaM1h2h9lHS+K8=,iv:1d7vmFkXAPcsmumzlmOT31amdrKLWtL5sJiS8G9g+LE=,tag:2l0vWzJ6P12ofuBdf5CCWw==,type:str]
+registrations:
+    mx-puppet-discord: ENC[AES256_GCM,data:FleyXxgOmc05nTP6M2DBJlacufN3p/05eZm4kB8+K4ci0k24o3zli988wlM/kyeZmxu4pgQlJ3lNLte4uip2hBXHWG5t5Ldzmr7bNCUD+r7nM+I1lfNkrDROPZ54bHysmn9O5CHpEa16rSo6RJgncIPqsLJxTwjC7qZlkOpzqvMhkq/MHCVOpvg0M/6AUR+AlSZoggujBMoXLznQNQapN13foEsbuo/QxjszM/ObGmhYMVyaS+TDBXzQLA8Yuj50Q/gZCIINWZ4G2qmgsGxxNR4I+usUQml/jxCtIXS4zn/ettXfL9G4Fdm2F9u1v11DehtTGa5xoxDq94M9rIxOqeJpvgEQEyyKAyFUIrlINfGl7tAj4Zu7+9Z8JTRAnppjM1q8iInwn/Z2L9KgB0YFi/Go1whgXly+TH6hpreo7m5klXV/ff/aV3ghOgFCGA8nBrZFqE8Uw268q9tV1s1dxCb6TbpGf19V5c9MD6BsCIVeoq+j9I/I8iZpzg2Reb4IlHhMDwbwsL2w2ks30wiZ9XO/CFrXDY4uBlI=,iv:3vvkGvldS8Raibg6tzlV8VY1O9NCLxSuNX/lwi1QgiA=,tag:D/noIsE3xlOiYM6Pk+cc8Q==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1sl43gc9cw939z5tgha2lpwf0xxxgcnlw7w4xem4sqgmt2pt264vq0dmwx2
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSZ1dKNy93WmNTVkNzOE50
+            SGQ3d1NvcXlMeW9LQ3JCT05aQk5qSTNIUVR3CmlDeE1wTUUzQVZrREdEeDZSeW15
+            dEsyd0w5OUpabEZHNm54UDlmaU41V00KLS0tIGJZTXhVdUJJS0VIdGdnV21DUlhL
+            MjNrRytKUXBXZWhPN2dpUk4wYUJyemsK5sspkZA7AOkVtq4e8p7QhtG2yLZE2TG0
+            qOhodWBMqi9VWnwg6HTKtQK6hfZ17McB93J4wtciCFGB7Pa8d79TFw==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age17tagmpwqjk3mdy45rfesrfey6h863x8wfq38wh33tkrlrywxducs0k6tpq
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEZ1l6SDdpdXl2cFNubjBn
+            eTU0UCtGTWhFYWIybk0yaGswKyt2clJQekhZCkVkbXdrM1QwaGZ4TXFpOTE1eEJJ
+            dUZKampwMjFzQXJqUUx0RTVwQzFoVnMKLS0tIEErNjhFZzhrVTJucXgwSVp2RlFi
+            QllFM3MxbXBBbFNTQkNKWHhyQ09EVGcKJIJ3DB8YmhlL+6sNhp38PojDBcDItsR1
+            SKyJC3nTJjwtPD/8P0LivCTn9Gi0Yjd5HVIXq/76RF4aB85HLZLgSg==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1mrnldl334l2nszuta6ywvewng0fswv2dz9l5g4qcwe3nj4yxf92qjskdx6
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwY2VLT3Ara1dXTk5EVXBi
+            b1l6ekd2cEp0TzgrclVNMmR6bXBtZ2Z5V3k0CjRkd0JIUzBCd2NvWDJDU0FyRzR6
+            MHJUSis3RHlBSm1raFRSaUY2NHpmWlkKLS0tIEk3VDhLSnU5YjRzNWFtb1ZMcy9o
+            cGxZVnFhdXRka2drTGdkVk1iM0pFL1kK2ry7b2cLYPfntWi/BV3K2O+mHt3242Ef
+            sI2JLLQYHeAhxjFdCzP1RDR+Wu/pRxZje6xuTZ9I9TKNmm+LhAXHQw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2023-09-15T04:40:21Z"
+    mac: ENC[AES256_GCM,data:ZJVHLbpSu/nIzl5FJfRdg2ymRN5M+zJXNUpi1hBt2MBmvK+1ed2ElhMe5x7pyasSDdaUtXDo7ghkUF7vE46Wo6Z9dvlAvhwWm7Y2AWfUe5SFVwzqlOCjSKRPFrQrL7PcDBtMj4twtwhc4XsfJoUSuigWW2m21BKtEZSuuxLRqLA=,iv:ufFbfMaNHydbkwq6lxN1dQJldkAbtqais/CZFkoDhb4=,tag:uMj0LaiU0obIlw/+HJJdKg==,type:str]
+    pgp:
+        - created_at: "2023-05-06T21:31:39Z"
+          enc: |
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA0av/duuklWYARAAmj8qTRTeTXx9PNtqOFwCGmLlKGhj860JPE3BUR2n3QOE
+            h9fdVJa9yqK7Lshyuf2t1HbgG+Ah4p4BaO5gYGsMLV9ybZpyNFuCgSZ3DZ4zSfxM
+            GSqelcHJF5qbV5gwoJvtyVFV3qtKD9FpOJwh9MfEVe98VkoISCQsPl3CHDH4ot0l
+            zKa56vOReHRmaCid2LNsN0nHlh1KPpwn7HdgaKyiPFexMFe4L/Q56UrlZx9XyPOb
+            AJ91ayfI6jWH8Hj0xxyqx0shdA74nJ/Y6ZB3JxLXnGuPvAlC3XJRQUImqYsa7p11
+            4Hus4hRAGEJGpmpxhazInHkWOT5ECtzxMd5LlUSq0AGYlEWJL+jtnrvy86HqpYRj
+            jpMfwsuwY7dJ0Tll05+goWqn0zB0yZjax71Ynky/ie5Iv8FKaUHHh2HWAzqjUaKg
+            6Yp3hzmMdP61fAm7ka4mxQLXQ0lrUbVnOk+pkaTrVrhcQial3W3lIgIhyo0EVi2V
+            Z7yEFkec7XZieMklhkL7tq9SJlWJYG1T+bavD7JSWjOXu+NlSP1hLKytM7xjp5jH
+            qZMEsjOaUEPvIO8Kd1f8MpLLe/+EhtmQJJMN8lwA8t/N+aOVYsW1GCspwX5mI+Ob
+            ZCIPkmeBz+UhJvqFD9QwWB44VWH7429VCg9hL+iWR2UfIUQHQhRFWD3604QBppzS
+            XgHEqjgLremZkvBsTAZsaLrTFlm7KwgjZsAkA5k+RZR5SH7xCXoSUSMnM8pWTway
+            24M8mPHKyshggzR5B50YME5BY1qVKtOMEmTjwN5gpn4CQDcsQ7A3eafZg7uGd64=
+            =4DU6
+            -----END PGP MESSAGE-----
+          fp: F7D37890228A907440E1FD4846B9228E814A2AAC
+    unencrypted_suffix: _unencrypted
+    version: 3.7.3
--- a/secrets/ildkule/ildkule.yaml
+++ b/secrets/ildkule/ildkule.yaml
@ -8,6 +8,8 @@
 #ENC[AES256_GCM,data:IVFSM6VOWnR0YDRfecsDPlYr,iv:Jxe8pq3lxw5QUGKyspB8tWSquDSMo3mAJBAsQGKxSec=,tag:7bffwY98iTX4/De0coUIxA==,type:comment]
 #ENC[AES256_GCM,data:pHSDnojWTLYXIKk=,iv:ph2xCpxbP3OiWm+B/MDboykPa2gtCWpP0b3j96YCDh4=,tag:u5hmvxHaa/m8GaSeYvONmg==,type:comment]
 #ENC[AES256_GCM,data:Q0fCyyP0DJqUyJPo,iv:qwBE3c2VqF52Yq8POXhy2Qv2xJd82wL1aX4eVY6wL1w=,tag:IwmbD7XqIkemOTODBKpS0g==,type:comment]
+config:
+    mysqld_exporter: ENC[AES256_GCM,data:w4muNsWmsW1fPx9nqtDGPCZ9faO3W5Pagn/DfWrb5yf88GQOzOsN4z7TH3QeW0Xs6I5jDIktGmFml6RDxCjD8UX9eer1pvC7Kxyl2DQKLHwmsgx1DUFNTRUzE1Sgx8rZAJ8HM7DO7L/6aXS0ndY4J+huyhDDVd+cIetgiQ==,iv:Q4cZD9CKd/EDOm4bjAE2EOstwKpwexF2pxhMEF0/5/k=,tag:S0rOLJS+b9ualtxcHKdHlw==,type:str]
 keys:
    grafana:
        secret_key: ENC[AES256_GCM,data:+WoAJbDBEgKs0RoHT+7oEELAVQ+/2Xt+5RTMSXg23moCqVRx+Gzll9P5Drw=,iv:AkRn/Y20iEe5i1T+84wAgLCTFtAox2G3giyawAkltAw=,tag:BZbt5Wb5lYLIJBm/pfP4GQ==,type:str]
@ -49,8 +51,8 @@ sops:
            a2hQVVprakt5NURpNXdQUjREczJKWTgKn60yrLqco9brlqigAolO8rEkww9z3y3u
            KmefLVZCGfoko+fnKLVE9UKFS/tAowqgPS1qE76u1Mmkk6yqZoG9rg==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-01-26T00:16:54Z"
-    mac: ENC[AES256_GCM,data:T13TG5fwXgAXUD4I8yIsdUQTA4MKZdEWkpVP1H734YBt5c0J0FJ5Ppxvf1n3hPcC6dcyCJ1NonbmmDBeKn0JUlxTlrK645O33RHLHlsMZGVijYyLyvxCxGo22SfdT2OdPv7tggyat9Cpd9bVLd7YdhPxTYDnZ3eNbIwx+5Fnw48=,iv:bYz6k1f30nlCjOuTRu3F2OE9iQIMd2eBGezXQx901zE=,tag:GHGGNlNg+huP6F3uyrbncQ==,type:str]
+    lastmodified: "2023-07-08T12:46:19Z"
+    mac: ENC[AES256_GCM,data:bQWG/GgSIv5LdhGTsyx3ENOAywtYVKjzK6nxOnUEZvD+RSi6jxj9Wze7qOhXvgjKWCz/cZj5oSuMQNRyoI8p8xJdxf0+UNdX8uPT05HiKuF7CBcXzprjKri/H6yFp87epOM9fMdn7ZUACn/iT1IZBo+5OuMtDnqVUm/GEmMcsog=,iv:ll/vEeiXsD3crbbxEFsJlxGbm9dZDUPC4GeO95RZZX4=,tag:TGCA721vK9EY3xlY6zIeIg==,type:str]
    pgp:
        - created_at: "2023-01-21T19:52:08Z"
          enc: |
--- a/users/amalieem.nix
+++ b/users/amalieem.nix
@ -0,0 +1,12 @@
+{pkgs, ...}:
+
+{
+  users.users.amalieem = {
+    isNormalUser = true;
+    extraGroups = [ "wheel" ]; 
+    shell = pkgs.zsh;
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPsMtFIj4Dem/onwMoWYbosOcU4y7A5nTjVwqWaU33E1 amalieem@matey-aug22"
+    ];
+  };
+}
--- a/users/felixalb.nix
+++ b/users/felixalb.nix
@ -6,6 +6,7 @@
    shell = pkgs.zsh;
    openssh.authorizedKeys.keys = [
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDKzPICGew7uN0cmvRmbwkwTCodTBUgEhkoftQnZuO4Q felixalbrigtsen@gmail.com"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBTXSL0w7OUcz1LzEt1T3I3K5RgyNV+MYz0x/1RbpDHQ felixalb@worf"
    ];
  };
 }
--- a/users/oysteikt.nix
+++ b/users/oysteikt.nix
@ -2,16 +2,17 @@
 {
  users.users.oysteikt = {
    isNormalUser = true;
+    description = "basement dweller";
    extraGroups = [
      "wheel"
      "drift"
    ];

-    shell = pkgs.zsh;
    packages = with pkgs; [
      bottom
      exa
      neovim
+      diskonaut
      ripgrep
      tmux
    ];
--- a/values.nix
+++ b/values.nix
@ -3,12 +3,20 @@ let
  pvv-ipv4 = suffix: "129.241.210.${toString suffix}";
  pvv-ipv6 = suffix: "2001:700:300:1900::${toString suffix}";
 in rec {
+  ipv4-space = pvv-ipv4 "128/25";
+  ipv6-space = pvv-ipv4 "/64";
+
  services = {
    matrix = {
-      ipv4 = hosts.jokum.ipv4;
-      ipv6 = hosts.jokum.ipv6;
+      inherit (hosts.bicep) ipv4 ipv6;
    };
-    # Also on jokum
+    postgres = {
+      inherit (hosts.bicep) ipv4 ipv6;
+    };
+    mysql = {
+      inherit (hosts.bicep) ipv4 ipv6;
+    };
+    # Also on bicep
    turn = {
      ipv4 = pvv-ipv4 213;
      ipv6 = pvv-ipv6 213;
@ -21,10 +29,6 @@ in rec {
      ipv4 = pvv-ipv4 168;
      ipv6 = pvv-ipv6 168;
    };
-    jokum = {
-      ipv4 = pvv-ipv4 169;
-      ipv6 = pvv-ipv6 169; 
-    };
    ildkule = {
      ipv4 = pvv-ipv4 187;
      ipv6 = pvv-ipv6 "1:187";
@ -33,6 +37,10 @@ in rec {
      ipv4 = pvv-ipv4 209;
      ipv6 = pvv-ipv6 209;
    };
+    shark = {
+      ipv4 = pvv-ipv4 196;
+      ipv6 = pvv-ipv6 196;
+    };
  };

  defaultNetworkConfig = {
Author	SHA1	Message	Date
h7x4	68f4eca6e4	WIP	2023-09-17 23:18:16 +02:00
h7x4	5c529a0233	Fix gitea runners, add 2 more The gitea runners are now activated correctly, has support for both debian and ubuntu based systems, and can will connect to the gitea server through the loopback interface	2023-09-17 04:05:08 +02:00
h7x4	b9388a31cf	bekkalokk/gitea-runners: fix token env file	2023-09-17 00:28:28 +02:00
Oystein Kristoffer Tveit	bc678b5d51	Merge pull request 'Bekkalokk: Enable podman' (#11 ) from add-gitea-ci into main Reviewed-on: Drift/pvv-nixos-config#11	2023-09-16 22:38:23 +02:00
Amalie Mansåker	ade2f6f5c9	Bekkalokk: Enable podman	2023-09-16 22:38:15 +02:00
Oystein Kristoffer Tveit	5c37b71646	Merge pull request 'Setup gitea action runner' (#10 ) from add-gitea-ci into main Reviewed-on: Drift/pvv-nixos-config#10	2023-09-16 22:31:22 +02:00
Amalie Mansåker	76f18b459c	Setup gitea action runner	2023-09-16 22:26:44 +02:00
Oystein Kristoffer Tveit	97cd5a235f	Merge pull request 'Gitea enabled actions' (#9 ) from add-gitea-ci into main Reviewed-on: Drift/pvv-nixos-config#9	2023-09-16 21:51:43 +02:00
Amalie Mansåker	e5fac39ce8	Enabled actions	2023-09-16 21:51:13 +02:00
Daniel Olsen	f53c0c6eb5	bicep/synapse: Move database configuration out of secrets	2023-09-16 21:38:39 +02:00
Oystein Kristoffer Tveit	d4bcdeb3b3	Merge pull request 'Added user amalieem' (#8 ) from add-gitea-ci into main Reviewed-on: Drift/pvv-nixos-config#8	2023-09-16 20:31:21 +02:00
Amalie Mansåker	b080ade4be	Added user amalieem	2023-09-16 20:19:15 +02:00
Daniel Olsen	7cd5b42f12	bicep/matrix/synapse: use fewer connections	2023-09-13 11:02:52 +02:00
Daniel Olsen	816997b74f	bicep/nginx: increase workers and enable modern compression Should decrease latency	2023-09-13 11:01:09 +02:00
Daniel Olsen	06322a26fc	bicep/postgres: enable jit again, make more memory available	2023-09-13 05:22:23 +02:00
Daniel Olsen	a58101bfbc	Remove deprecated hosts and clean up	2023-09-13 05:03:57 +02:00
Daniel Olsen	57d1dfd121	flake update	2023-09-13 05:01:18 +02:00
Daniel Olsen	d3b363b028	bicep: Remove deprecated grub version option	2023-09-13 04:54:46 +02:00
Daniel Olsen	4a6ea9be2d	bicep/synapse: define registration secret properly	2023-09-13 04:53:56 +02:00
Daniel Olsen	f92ebbee16	bicep/synapse: use postgres unix socket	2023-09-13 04:16:22 +02:00
Daniel Olsen	201e3d306b	bicep: Revert postgres socket stuff	2023-09-13 03:58:29 +02:00
Daniel Olsen	437219bb68	bicep/postgres: Enable unix socket auth	2023-09-13 00:52:27 +02:00
Daniel Olsen	b5075f48c6	bicep/matrix/synapse: switch database connection to socket	2023-09-13 00:17:10 +02:00
Felix Albrigtsen	d96c30bbd5	Fix calendar-bot timer	2023-09-12 18:23:20 +02:00
Felix Albrigtsen	36b768b3b2	( ͡° ͜ʖ ͡°)	2023-09-08 02:33:22 +02:00
Felix Albrigtsen	9f36bd86a8	Update calendar bot details	2023-09-08 02:25:23 +02:00
Felix Albrigtsen	1370ccddf8	Initialize host: shark	2023-09-08 02:11:02 +02:00
Daniel Lovbrotte Olsen	cfcd230678	Merge pull request 'Fix gitea on bekkalokk' (#7 ) from configure-gitea into main Reviewed-on: Drift/pvv-nixos-config#7	2023-09-07 18:54:24 +02:00
h7x4	1afc8841a9	bekkalokk/nginx: remove commented virtualhost for mediawiki	2023-09-07 18:53:05 +02:00
h7x4	b4b6b4971a	bekkalokk/gitea: misc changes - change domain from git2 to git1 - enable internal SSH serer - enable code search - add custom logos - update import-user-script to ignore GECOS fields	2023-09-07 18:53:05 +02:00
h7x4	f567199604	bekkalokk/gitea: update API key for import-user-script	2023-09-07 18:41:41 +02:00
oysteikt	b52753987d	bicep: use mysql on bicep as production server	2023-09-07 18:40:13 +02:00
h7x4	6a75dbae47	Add PVV logo to repository	2023-09-07 18:39:21 +02:00
Felix Albrigtsen	3beb76e411	Add pvv-calendar-bot to bicep	2023-08-27 02:36:01 +02:00
Daniel Olsen	bfe94003c4	bicep/matrix/discord: enable legacy authorization because old mx-puppet-discord 😭	2023-08-18 00:54:06 +02:00
Felix Albrigtsen	6d6987c87a	felixalb: Add SSH key	2023-08-17 22:07:00 +02:00
Felix Albrigtsen	a230914ebd	Add aarch64-darwin to devShell	2023-08-17 22:05:28 +02:00
oysteikt	a5c83866ca	bicep: setup ACME cert for postgres	2023-08-12 02:55:20 +02:00
Daniel Olsen	fa67504275	Update flake inputs Mainly to update the matrix module	2023-07-13 04:36:43 +02:00
oysteikt	bb9f1c8b2f	flake.nix: add func to build using nixpkgs unstable	2023-07-12 16:16:10 +02:00
oysteikt	34a16149f8	ildkule: add config for prometheus_mysqld_exporter There's a PR waiting to add this module to nixpkgs, so we should enable this once it gets merged.	2023-07-10 00:06:27 +02:00
oysteikt	998e66db65	bicep: enable mysql	2023-07-10 00:06:09 +02:00
Daniel Olsen	699569249a	ildkule: adjust matrix version annotations for nixos matrix module	2023-06-20 14:01:44 +02:00
Daniel Olsen	e73b7d2cd1	ildule: fix upstream dashboard variables	2023-06-20 13:46:00 +02:00
Daniel Olsen	ff30477e86	ildule: Update matrix dashboard from upstream	2023-06-20 13:20:42 +02:00
Felix Albrigtsen	8f55ef3193	Bekkalokk: Configure Gitea, clean web services Update bekkalokk secrets format Update gitea keys and firewall rules Create gitea-user-import script Fix SSH host key verification Gitea-import-users bug squashification Fix Gitea-import SSH problems	2023-06-05 19:41:25 +02:00
h7x4	db44bcf4bc	Upgrade to nixpkgs 23.05	2023-05-31 11:04:38 +02:00
Daniel Olsen	d694724f5c	bicep/synapse: Set event cache to 20K This is double the cache from default changed because we're seeing periodic cpu spikes with this cache beeing the main one missing	2023-05-26 02:22:18 +02:00
Daniel Olsen	68ce7acebb	Revert "bicep: Emergency fix for matrix postgres auth" This reverts commit `fdbcd8c884`. This was not it	2023-05-23 05:12:46 +02:00
Daniel Olsen	fdbcd8c884	bicep: Emergency fix for matrix postgres auth I think	2023-05-23 04:59:34 +02:00
Daniel Olsen	815063744b	bicep/postgres: Remove jit setting The nixos build of postgres doesn't support it anyways	2023-05-23 04:57:18 +02:00
Daniel Olsen	ede76faa79	Document nix flake check	2023-05-23 04:55:14 +02:00
Daniel Olsen	2752c26675	fix nixosConfig override	2023-05-23 04:43:39 +02:00
Daniel Olsen	dfd827ee74	Clean up jokum removal	2023-05-23 04:29:45 +02:00
Felix Albrigtsen	9ccfb6cbed	Merge branch 'bekkalokk-metrics'	2023-05-21 04:04:29 +02:00
Felix Albrigtsen	1335ab1d4b	Add metrics exporters to bekkalokk	2023-05-21 04:03:14 +02:00
felixalb	69be23712f	Merge branch 'bicep-metrics' of Drift/pvv-nixos-config into main	2023-05-21 03:47:53 +02:00
Felix Albrigtsen	ce58f91e16	Add metrics exporters to bicep	2023-05-21 03:47:02 +02:00
felixalb	360f873c31	Merge branch 'bekkalokk-baremetal' of Drift/pvv-nixos-config into main	2023-05-21 02:31:39 +02:00
Felix Albrigtsen	8ccf9e9298	Update keys and re-enable web services	2023-05-21 02:29:14 +02:00
Felix Albrigtsen	8b70d84f41	bekkalokk: hardware-config for baremetal	2023-05-21 00:06:25 +02:00
h7x4	cd0c8c8198	bekkalokk: continue work on mediawiki service	2023-05-19 03:03:47 +02:00
h7x4	c11a804097	bicep: set up mysql/mariadb	2023-05-18 15:40:13 +02:00
h7x4	45ada78304	oysteikt: edit user settings	2023-05-17 15:38:42 +02:00
Daniel Olsen	4ff5da28c4	bicep: nginx listen on bicep ip	2023-05-08 03:38:59 +02:00
Daniel Olsen	ee73a964be	move matrix to bicep	2023-05-08 03:38:59 +02:00
h7x4	dcbe6871da	bekkalokk: setup keycloak	2023-05-07 00:34:42 +02:00
h7x4	0e75e0a5b9	bicep: add backup service	2023-05-06 19:07:10 +02:00