Update from updated-inputs-2024-07-22-01-03

Update nixpkgs 2024-07-22-01-03
Update from updated-inputs-2024-07-21-01-03
2024-07-22 03:04:07 +02:00 · 2024-07-22 03:04:05 +02:00 · 2024-07-21 03:03:05 +02:00 · 2024-07-21 03:03:03 +02:00 · 2024-07-20 03:04:59 +02:00 · 2024-07-20 03:04:56 +02:00
33 changed files with 42 additions and 540 deletions
--- a/configuration/common/default.nix
+++ b/configuration/common/default.nix
@@ -9,7 +9,6 @@
    ./nix.nix
    ./programs.nix
    ./ssh.nix
-    ./systemd.nix
    ./user.nix
    ./web.nix
  ];
--- a/configuration/common/nix.nix
+++ b/configuration/common/nix.nix
@@ -39,8 +39,8 @@
  # Pin current nixpkgs channel and flake registry to the nixpkgs version
  # the host got build with
  nix.nixPath = lib.mkForce [ "nixpkgs=${lib.cleanSource pkgs.path}" ];
-  nix.registry = {
-    "nixpkgs" = lib.mkForce {
+  nix.registry = lib.mkForce {
+    "nixpkgs" = {
       from = {
         type = "indirect";
         id = "nixpkgs";
--- a/configuration/common/systemd.nix
+++ b/configuration/common/systemd.nix
@@ -1,9 +0,0 @@
-{ ... }:
-
-{
-
-  services.journald.extraConfig = ''
-    MaxRetentionSec=7days
-  '';
-
-}
--- a/configuration/desktop/fonts.nix
+++ b/configuration/desktop/fonts.nix
@@ -9,6 +9,5 @@
    noto-fonts
    noto-fonts-cjk
    noto-fonts-emoji
-    comfortaa
  ];
 }
--- a/configuration/desktop/gnome.nix
+++ b/configuration/desktop/gnome.nix
@@ -6,23 +6,23 @@
    tracker.enable = false;
  };

-  environment.gnome.excludePackages = with pkgs; [
-    baobab
-    epiphany
-    gnome-calendar
+  environment.gnome.excludePackages = with pkgs.gnome; [
+    pkgs.baobab
+    pkgs.epiphany
+    pkgs.gnome-calendar
    gnome-clocks
-    gnome-console
+    pkgs.gnome-console
    gnome-contacts
    gnome-logs
    gnome-maps
    gnome-music
-    gnome-tour
-    gnome-photos
+    pkgs.gnome-tour
+    pkgs.gnome-photos
    gnome-weather
-    gnome-connections
-    simple-scan
-    yelp
-    geary
+    pkgs.gnome-connections
+    pkgs.simple-scan
+    pkgs.yelp
+    pkgs.geary
  ];

  environment.systemPackages = with pkgs; [
--- a/configuration/gpg-ssh/default.nix
+++ b/configuration/gpg-ssh/default.nix
@@ -11,7 +11,6 @@
  environment.systemPackages = with pkgs; [
    gnupg
    yubikey-personalization
-    openpgp-card-tools

    # Add wrapper around ssh that takes the gnupg ssh-agent
    # instead of gnome-keyring
--- a/flake.lock
+++ b/flake.lock
@@ -7,11 +7,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1721567085,
-        "narHash": "sha256-CxWzsNy2dy4zvn2Wi91C/PF+Wyxi3JLOPudc5FoZrhg=",
+        "lastModified": 1721558703,
+        "narHash": "sha256-m6qmlGq1U2945q247p/Ha4oT99moSJBJu3ptrmssaeo=",
        "ref": "refs/heads/main",
-        "rev": "0c3142cc8f6396fce7cb4c5fe14137d831315986",
-        "revCount": 11,
+        "rev": "bd86ab8b521e5da68d901485faff6af06a121951",
+        "revCount": 10,
        "type": "git",
        "url": "https://git.clerie.de/clerie/berlinerbaeder-exporter.git"
      },
@@ -27,11 +27,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1724513039,
-        "narHash": "sha256-YdBuRgXEU9CcxPd2EjuvDKcfgxL1kk9Gv8nFVVjIros=",
+        "lastModified": 1712512137,
+        "narHash": "sha256-crxzFc3lc/ViHYVK+IKmIbifxF6zyHgSwhBKd0lLgWE=",
        "ref": "refs/heads/main",
-        "rev": "202f4a1a5791c74a9b7d69a4e63e631bdbe36ba6",
-        "revCount": 4,
+        "rev": "221052d8465f0a4437cb8cae3cc9998c87e88f68",
+        "revCount": 2,
        "type": "git",
        "url": "https://git.clerie.de/clerie/bij.git"
      },
@@ -288,11 +288,11 @@
    },
    "nixpkgs_3": {
      "locked": {
-        "lastModified": 1725983898,
-        "narHash": "sha256-4b3A9zPpxAxLnkF9MawJNHDtOOl6ruL0r6Og1TEDGCE=",
+        "lastModified": 1721379653,
+        "narHash": "sha256-8MUgifkJ7lkZs3u99UDZMB4kbOxvMEXQZ31FO3SopZ0=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "1355a0cbfeac61d785b7183c0caaec1f97361b43",
+        "rev": "1d9c2c9b3e71b9ee663d11c5d298727dace8d374",
        "type": "github"
      },
      "original": {
@@ -302,26 +302,6 @@
        "type": "github"
      }
    },
-    "nurausstieg": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1722174167,
-        "narHash": "sha256-u9ef1BNaXHEnuQEFgqqBLEVZqd5T/sqRBysN71gFOKg=",
-        "ref": "refs/heads/main",
-        "rev": "7f2e0febf3a430e4ba4f6cf1cf1c5ca10c5dd04d",
-        "revCount": 20,
-        "type": "git",
-        "url": "https://git.clerie.de/clerie/nurausstieg.git"
-      },
-      "original": {
-        "type": "git",
-        "url": "https://git.clerie.de/clerie/nurausstieg.git"
-      }
-    },
    "root": {
      "inputs": {
        "berlinerbaeder-exporter": "berlinerbaeder-exporter",
@@ -333,7 +313,6 @@
        "nixos-exporter": "nixos-exporter",
        "nixos-hardware": "nixos-hardware",
        "nixpkgs": "nixpkgs_3",
-        "nurausstieg": "nurausstieg",
        "solid-xmpp-alarm": "solid-xmpp-alarm",
        "sops-nix": "sops-nix",
        "ssh-to-age": "ssh-to-age"
--- a/flake.nix
+++ b/flake.nix
@@ -27,10 +27,6 @@
      url = "git+https://git.clerie.de/clerie/nixos-exporter.git";
      inputs.nixpkgs.follows = "nixpkgs";
    };
-    nurausstieg = {
-      url = "git+https://git.clerie.de/clerie/nurausstieg.git";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
    solid-xmpp-alarm = {
      url = "git+https://git.clerie.de/clerie/solid-xmpp-alarm.git";
      inputs.nixpkgs.follows = "nixpkgs";
@@ -123,7 +119,6 @@
        clerie-sops-edit
        chromium-incognito
        git-checkout-github-pr
-        git-diff-word
        iot-data
        nix-remove-result-links
        nixfiles-auto-install
@@ -131,7 +126,6 @@
        nixfiles-generate-backup-secrets
        nixfiles-update-ssh-host-keys
        print-afra
-        run-with-docker-group
        ssh-gpg
        update-from-hydra
        uptimestatus;
--- a/flake/overlay.nix
+++ b/flake/overlay.nix
@@ -3,7 +3,6 @@
 , bij
 , chaosevents
 , harmonia
-, nurausstieg
 , ssh-to-age
 , ...
 }@inputs:
@@ -17,8 +16,6 @@ final: prev: {
  harmonia = harmonia.packages.${final.system}.harmonia.override {
    nixForHarmonia = final.nixVersions.nix_2_21;
  };
-  inherit (nurausstieg.packages.${final.system})
-    nurausstieg;
  inherit (ssh-to-age.packages.${final.system})
    ssh-to-age;
 }
--- a/hosts/carbon/configuration.nix
+++ b/hosts/carbon/configuration.nix
@@ -10,13 +10,9 @@
      ./net-dsl.nix
      ./net-gastnetz.nix
      ./net-heimnetz.nix
-      ./net-iot.nix
      ./net-lte.nix
-      ./net-mgmt.nix
      ./net-voip.nix
-      ./ntp.nix
      ./ppp.nix
-      ./wg-clerie.nix
    ];

  boot.kernelParams = [ "console=ttyS0,115200n8" ];
@@ -56,22 +52,6 @@
    };
  };

-  systemd.services.kea-dhcp4-server = {
-    after = [
-      "network-setup.service"
-    ];
-    requires = [
-      "network-setup.service"
-    ];
-  };
-
-  systemd.services."system-reboot" = {
-    script = ''
-      ${pkgs.systemd}/bin/reboot
-    '';
-    startAt = "*-*-* 1/3:13:14";
-  };
-
  clerie.firewall.enable = true;

  clerie.monitoring = {
--- a/hosts/carbon/net-gastnetz.nix
+++ b/hosts/carbon/net-gastnetz.nix
@@ -7,23 +7,18 @@
    id = 202;
    interface = "enp1s0";
  };
-  networking.bridges."net-gastnetz".interfaces = [
-    "enp1s0.202"
-  ];
-  networking.interfaces."net-gastnetz".ipv6.addresses = [
+  networking.interfaces."enp1s0.202".ipv6.addresses = [
    { address = "fd00:3214:9453:4920::1"; prefixLength = 64; }
+    { address = "2001:4cd8:100:1313::1"; prefixLength = 64; } # public IPs for local network
  ];
-  networking.interfaces."net-gastnetz".ipv4.addresses = [
+  networking.interfaces."enp1s0.202".ipv4.addresses = [
    { address = "192.168.32.1"; prefixLength = 24; }
  ];

  services.radvd.config = ''
-    interface net-gastnetz {
+    interface enp1s0.202 {
      AdvSendAdvert on;
-      prefix ::/64 {
-        AdvValidLifetime 60;
-        AdvPreferredLifetime 30;
-      };
+      prefix 2001:4cd8:100:1313::/64 {};
      RDNSS 2620:fe::fe 2620:fe::9 {}; # Quad 9
    };
  '';
@@ -31,7 +26,7 @@
  services.kea.dhcp4 = {
    settings = {
      interfaces-config = {
-        interfaces = [ "net-gastnetz" ];
+        interfaces = [ "enp1s0.202" ];
      };
      subnet4 = [
        # Gastnetz
@@ -60,9 +55,9 @@

  # net-gastnetz can only access internet
  clerie.firewall.extraForwardFilterCommands = ''
-    ip46tables -A forward-filter -i net-gastnetz -o ppp-dtagdsl -j ACCEPT
-    ip46tables -A forward-filter -i net-gastnetz -j DROP
-    ip46tables -A forward-filter -o net-gastnetz -j DROP
+    ip46tables -A forward-filter -i enp1s0.202 -o ppp-dtagdsl -j ACCEPT
+    ip46tables -A forward-filter -i enp1s0.202 -j DROP
+    ip46tables -A forward-filter -o enp1s0.202 -j DROP
  '';

 }
--- a/hosts/carbon/net-heimnetz.nix
+++ b/hosts/carbon/net-heimnetz.nix
@@ -14,6 +14,7 @@
  networking.interfaces."net-heimnetz".ipv6.addresses = [
    { address = "fe80::1"; prefixLength = 64; }
    { address = "fd00:152:152:4::1"; prefixLength = 64; }
+    { address = "2001:4cd8:100:1337::1"; prefixLength = 64; } # public IPs for local network
  ];
  networking.interfaces."net-heimnetz".ipv4.addresses = [
    { address = "10.152.4.1"; prefixLength = 24; }
@@ -22,10 +23,7 @@
  services.radvd.config = ''
    interface net-heimnetz {
      AdvSendAdvert on;
-      prefix ::/64 {
-        AdvValidLifetime 60;
-        AdvPreferredLifetime 30;
-      };
+      prefix 2001:4cd8:100:1337::/64 {};
      RDNSS fd00:152:152::1 {};
      DNSSL net.clerie.de {};
    };
--- a/hosts/carbon/net-iot.nix
+++ b/hosts/carbon/net-iot.nix
@@ -1,79 +0,0 @@
-{ ... }:
-
-{
-
-  networking.vlans."enp1s0.205" = {
-    id = 205;
-    interface = "enp1s0";
-  };
-  networking.bridges."net-iot".interfaces = [
-    "enp1s0.205"
-  ];
-  networking.interfaces."net-iot".ipv6.addresses = [
-    { address = "fe80::1"; prefixLength = 64; }
-    { address = "fd00:152:152:205::1"; prefixLength = 64; }
-  ];
-  networking.interfaces."net-iot".ipv4.addresses = [
-    { address = "10.152.205.1"; prefixLength = 24; }
-  ];
-
-  # Enable NTP
-  networking.firewall.interfaces."net-iot".allowedUDPPorts = [ 123 ];
-
-  services.radvd.config = ''
-    interface net-iot {
-      AdvSendAdvert on;
-      prefix ::/64 {
-        AdvValidLifetime 60;
-        AdvPreferredLifetime 30;
-      };
-      RDNSS fd00:152:152::1 {};
-      DNSSL iot.clerie.de {};
-    };
-  '';
-
-  services.kea.dhcp4 = {
-    settings = {
-      interfaces-config = {
-        interfaces = [ "net-iot" ];
-      };
-      subnet4 = [
-        {
-          id = 205;
-          subnet = "10.152.205.0/24";
-          pools = [
-            {
-              pool = "10.152.205.100 - 10.152.205.240";
-            }
-          ];
-          option-data = [
-            {
-              name = "routers";
-              data = "10.152.205.1";
-            }
-            {
-              name = "domain-name-servers";
-              data = "10.152.0.1";
-            }
-            {
-              name = "domain-name";
-              data = "iot.clerie.de";
-            }
-            {
-              name = "time-servers";
-              data = "10.152.0.1";
-            }
-          ];
-        }
-      ];
-    };
-  };
-
-  clerie.firewall.extraForwardFilterCommands = ''
-    # Allow access from Heimnetz to IOT devices
-    ip46tables -A forward-filter -i net-heimnetz -o net-iot -j ACCEPT
-    ip46tables -A forward-filter -i net-iot -j DROP
-    ip46tables -A forward-filter -o net-iot -j DROP
-  '';
-
-}
--- a/hosts/carbon/net-mgmt.nix
+++ b/hosts/carbon/net-mgmt.nix
@@ -1,62 +0,0 @@
-{ ... }:
-
-{
-
-  networking.vlans."enp1s0.203" = {
-    id = 203;
-    interface = "enp1s0";
-  };
-  networking.bridges."net-mgmt".interfaces = [
-    "enp1s0.203"
-  ];
-  networking.interfaces."net-mgmt".ipv6.addresses = [
-    { address = "fe80::1"; prefixLength = 64; }
-    { address = "fd00:152:152:203::1"; prefixLength = 64; }
-  ];
-  networking.interfaces."net-mgmt".ipv4.addresses = [
-    { address = "10.152.203.1"; prefixLength = 24; }
-  ];
-
-  services.radvd.config = ''
-    interface net-mgmt {
-      AdvSendAdvert on;
-      prefix ::/64 {
-        AdvValidLifetime 60;
-        AdvPreferredLifetime 30;
-      };
-    };
-  '';
-
-  services.kea.dhcp4 = {
-    settings = {
-      interfaces-config = {
-        interfaces = [ "net-mgmt" ];
-      };
-      subnet4 = [
-        {
-          id = 203;
-          subnet = "10.152.203.0/24";
-          pools = [
-            {
-              pool = "10.152.203.100 - 10.152.203.240";
-            }
-          ];
-          option-data = [
-            {
-              name = "routers";
-              data = "10.152.203.1";
-            }
-          ];
-        }
-      ];
-    };
-  };
-
-  clerie.firewall.extraForwardFilterCommands = ''
-    # Allow access from Heimnetz to MGMT network
-    ip46tables -A forward-filter -i net-heimnetz -o net-mgmt -j ACCEPT
-    ip46tables -A forward-filter -i net-mgmt -j DROP
-    ip46tables -A forward-filter -o net-mgmt -j DROP
-  '';
-
-}
--- a/hosts/carbon/ntp.nix
+++ b/hosts/carbon/ntp.nix
@@ -1,15 +0,0 @@
-{ ... }:
-
-{
-
-  services.chrony = {
-    enable = true;
-    extraConfig = ''
-      # Enable NTP server mode
-      allow
-      bindaddress fd00:152:152::1
-      bindaddress 10.152.0.1
-    '';
-  };
-
-}
--- a/hosts/carbon/ppp.nix
+++ b/hosts/carbon/ppp.nix
@@ -15,7 +15,7 @@
        noipdefault
        lcp-echo-interval 20
        lcp-echo-failure 3
-        mtu 1492
+        mtu 14592
        hide-password
        defaultroute
        +ipv6
@@ -57,28 +57,4 @@
    ip46tables -t mangle -A forward-mangle -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1416
  '';

-  networking.dhcpcd-prefixdelegation = {
-    enable = true;
-    interfaces = {
-      "ppp-dtagdsl" = {
-        iaid = 1;
-        interfaces = {
-          "net-heimnetz" = {
-            sla_id = 201;
-            prefix_len = 64;
-          };
-        };
-      };
-    };
-  };
-
-  environment.etc."ppp/ipv6-up" = {
-    text = ''
-      #!${pkgs.runtimeShell}
-
-      set -euo pipefail
-
-      ${pkgs.dhcpcd}/bin/dhcpcd --renew $1
-    '';
-  };
 }
--- a/hosts/carbon/secrets.json
+++ b/hosts/carbon/secrets.json
@@ -2,7 +2,6 @@
 	"wg-monitoring": "ENC[AES256_GCM,data:+k5MgBrj/psMCE1T2jDtCCJI9Q7L+wJ3j83inNkeGp3LSUjoAPtBp4YoyL4=,iv:C19g/Lqi+cWAyiJBMNDtgLc3SDNI9bMBrBPWn+26mVY=,tag:9zIoawuGeGCMbOX1HKR/sQ==,type:str]",
 	"pppd-dtagdsl-username": "ENC[AES256_GCM,data:JC7EyyMoN0p5YwnS9W5I0G5Omhk5usw28UiJrCfifGr+2FUgMrtFYAHQdrtWAELvYNBQDPgrHMmQjGQLhpqqK0hH,iv:/q+Fm63GVBApGInyS8i39V/lo6iv+I2omVh47deq+o8=,tag:LkR+1zTDNWuYkhH2iWT7SA==,type:str]",
 	"pppd-dtagdsl-secrets": "ENC[AES256_GCM,data:c5pOb8It1py/9NXNTgLvt9zmsBVbSLHJt4iXWiNA+Osvomw3r7pgoO/JJh9ujomPMnOlDwN7g+pJ,iv:W36gA8E1mWchN6+8hdMdt2epv/RdS91T5ANB/JTcHCE=,tag:7eZ3fZkjERCVJCXYrABnlQ==,type:str]",
-	"wg-clerie": "ENC[AES256_GCM,data:OEZg8ZoLAdVhKkvB0ai13ID3gPnVUU/xkOjZ4KiJ9MnRbcFu5HBd7Nw6iNwh,iv:edPuaehya2ZvYKkiBqNUbXVDAxAT6yNgETnWtd6it94=,tag:cX12szdQfAcC6cij6zk6Dw==,type:str]",
 	"sops": {
 		"kms": null,
 		"gcp_kms": null,
@@ -14,8 +13,8 @@
 				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3Rkd5WFE3aE5EQzY5ZXV4\nbXVGYmxTdVg1ekRpVjlRUnozY2tMTGloL21RCktjZW95OU9ZZ2owTCtMR1NxaXJn\na2VYS2ttb3VhSjNXOG84UUJtYU04QjAKLS0tIGd3aHM0RldFYnVFdDRVS0Vhc3BF\nckJhYmN6a1FJUC9ibks1cGlRaU1zbFkKE4ClunQ3XGAILwluC6iYFs+rlR02PdhK\njOmPbOlS0aNG0hoC7Z6aetgpj689AkJgl68QVcyvm+ecHH7TOT7l1A==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
-		"lastmodified": "2024-08-13T14:06:43Z",
-		"mac": "ENC[AES256_GCM,data:yGKY0fi3KQWGHBeyNtQ8EJ6561dKRZ5aAjO9zq3odDtX75i2RSjORIlNjBsVvegBzeo8AkwwnzxNPt2sHl6MKDZfEsysWAi8Wolh4UvHk087AnR/uKvtG6t4uUaNIWej2DEzxUtTQ8QP1afsdqGCf0vZVruNcJ4u2xiQbN2vJPc=,iv:CDXJ5/P+h0Enq/0EL1su1Mw55FVYLy4XPSoUCkRkt+U=,tag:AvRfEDYMBunyIQIVCPbXag==,type:str]",
+		"lastmodified": "2024-07-13T21:56:57Z",
+		"mac": "ENC[AES256_GCM,data:/jZ/aIQUxYrF0deBTJOyc009yPKfshiYnAB2GR5SRTi00Ls5efKzhjDJaEWvAkgBTFz5/a8fy2k+vXEDsDlrgcgWqMS8/Az5LRf9RWUBWkerDyoBJ2UZRdt7UVPfkN8ObKQpfFqxhzkm4zio+MwSbqSMZil6fGaxz6lyUkwaphg=,iv:KStinEtV1DTaEl0ebMEw8lSMvrE5rtxqfTbzssC9oGY=,tag:YOr8T3wqqxyv0mpO1wMDEg==,type:str]",
 		"pgp": [
 			{
 				"created_at": "2024-05-10T13:05:56Z",
--- a/hosts/carbon/wg-clerie.nix
+++ b/hosts/carbon/wg-clerie.nix
@@ -1,9 +0,0 @@
-{ ... }:
-
-{
-  services.wg-clerie = {
-    enable = true;
-    ipv6s = [ "2a01:4f8:c0c:15f1::8111/128" ];
-    ipv4s = [ "10.20.30.111/32" ];
-  };
-}
--- a/hosts/gatekeeper/configuration.nix
+++ b/hosts/gatekeeper/configuration.nix
@@ -109,11 +109,6 @@
          allowedIPs = [ "2a01:4f8:c0c:15f1::8110/128" "10.20.30.110/32" ];
          publicKey = "kn6ZtViagKGSyfQJQW6csQE/5r7uKlbC1rbInlQ33xs=";
        }
-        {
-          # carbon
-          allowedIPs = [ "2a01:4f8:c0c:15f1::8111/128" "10.20.30.111/32" ];
-          publicKey = "o6qxGKIoW2ZSFhXeNRXd4G9BRFeYyjZsrUPulB3KhTI=";
-        }
      ];
      listenPort = 51820;
      allowedIPsAsRoutes = false;
--- a/hosts/krypton/android.nix
+++ b/hosts/krypton/android.nix
@@ -1,9 +0,0 @@
-{ pkgs, ... }:
-
-{
-
-  services.udev.packages = [
-    pkgs.android-udev-rules
-  ];
-
-}
--- a/hosts/krypton/configuration.nix
+++ b/hosts/krypton/configuration.nix
@@ -7,7 +7,6 @@

      ../../configuration/desktop

-      ./android.nix
      ./backup.nix
      #./initrd.nix
      ./network.nix
--- a/hosts/krypton/programs.nix
+++ b/hosts/krypton/programs.nix
@@ -19,7 +19,6 @@
    onlyoffice-bin

    krita
-    inkscape

    wireshark
    tcpdump
--- a/hosts/monitoring-3/grafana.nix
+++ b/hosts/monitoring-3/grafana.nix
@@ -7,7 +7,7 @@
        domain = "grafana.monitoring.clerie.de";
        root_url = "https://grafana.monitoring.clerie.de";
        http_port = 3001;
-        http_addr = "::1";
+        http_addr = "[::1]";
      };
      "auth.anonymous" = {
        enabled = true;
--- a/hosts/web-2/configuration.nix
+++ b/hosts/web-2/configuration.nix
@@ -20,7 +20,6 @@
      ./mitel-ommclient2.nix
      ./nix-install.nix
      ./nogo2024.nix
-      ./nurausstieg.nix
      ./ping.nix
      ./public.nix
      ./radicale.nix
--- a/hosts/web-2/gitea.nix
+++ b/hosts/web-2/gitea.nix
@@ -15,7 +15,7 @@
    lfs.enable = true;
    settings = {
      log = {
-        LEVEL = "Warn";
+        LEVEL = "Info";
      };
      database = {
        CHARSET = "utf8";
@@ -28,7 +28,7 @@
      server = {
        ROOT_URL = "https://git.clerie.de/";
        DOMAIN = "git.clerie.de";
-        HTTP_ADDRESS = "::1";
+        HTTP_ADDRESS = "127.0.0.1";
        HTTP_PORT = 3000;
        OFFLINE_MODE = true;
        LANDING_PAGE = "explore";
@@ -80,7 +80,7 @@
      forceSSL = true;
      locations = {
        "/" = {
-          proxyPass = "http://[::1]:3000";
+          proxyPass = "http://localhost:3000";
        };
      };
      extraConfig = ''
--- a/hosts/web-2/nurausstieg.nix
+++ b/hosts/web-2/nurausstieg.nix
@@ -1,41 +0,0 @@
-{ pkgs, ... }:
-
-{
-
-  systemd.tmpfiles.rules = [
-    "d /var/cache/nginx/nurausstieg - nginx nginx - -"
-  ];
-
-  services.nginx = {
-    commonHttpConfig = ''
-      proxy_cache_path /var/cache/nginx/nurausstieg levels=1:2 use_temp_path=off keys_zone=nurausstieg:1m max_size=10m;
-    '';
-
-    virtualHosts."nurausstieg.clerie.de" = {
-      enableACME = true;
-      forceSSL = true;
-      locations."/" = {
-        proxyPass = "http://[::1]:44384";
-        extraConfig = ''
-          proxy_cache nurausstieg;
-          # Ignore upstream cache hints
-          proxy_ignore_headers Cache-Control;
-          # Force cache 200 and 500 responses for one minute
-          proxy_cache_valid 200 500 1m;
-          # Only do a single fetch for missing entries and let other sessions wait
-          proxy_cache_lock on;
-        '';
-      };
-    };
-  };
-
-  systemd.services.nurausstieg = {
-    wantedBy = [ "multi-user.target" ];
-    serviceConfig = {
-      DynamicUser = true;
-    };
-    path = with pkgs; [ nurausstieg ];
-    script = "nurausstieg --listen [::1]:44384";
-  };
-
-}
--- a/modules/default.nix
+++ b/modules/default.nix
@@ -8,7 +8,6 @@
    ./clerie-firewall
    ./clerie-gc-dir
    ./clerie-system-upgrade
-    ./dhcpcd-prefixdelegation
    ./minecraft-server
    ./monitoring
    ./nginx-port-forward
--- a/modules/dhcpcd-prefixdelegation/default.nix
+++ b/modules/dhcpcd-prefixdelegation/default.nix
@@ -1,144 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-with lib;
-
-let
-
-  cfg = config.networking.dhcpcd-prefixdelegation;
-
-  downstreamInterfaceConfig = name: opts: "${name}${
-    optionalString (opts.sla_id != null) "/${builtins.toString opts.sla_id}${
-      optionalString (opts.prefix_len != null) "/${builtins.toString opts.prefix_len}${
-        optionalString (opts.suffix != null) "/${opts.suffix}"
-      }"
-    }"
-  }";
-
-  interfaceConfig = name: opts: ''
-    interface ${name}
-      ipv6rs
-      ia_pd ${builtins.toString opts.iaid}${
-        optionalString (opts.prefix != null) "/${opts.prefix}${
-          optionalString (opts.prefix_len != null) "/${builtins.toString opts.prefix_len}"
-        }"
-      } ${concatMapStringsSep " " ({name, value}: downstreamInterfaceConfig name value) (attrsToList opts.interfaces)}
-  '';
-
-
-  dhcpcdConf = pkgs.writeText "dhcpcd.conf" ''
-    duid
-    noipv6rs
-    waitip 6
-    ipv6only
-
-    allowinterfaces ${concatStringsSep " " (builtins.attrNames cfg.interfaces)} ${concatMapStringsSep " " ({name, value}: concatStringsSep "" (builtins.attrNames value.interfaces)) (attrsToList cfg.interfaces)}
-
-    ${concatMapStringsSep "\n" ({name, value}: interfaceConfig name value) (attrsToList cfg.interfaces)}
-  '';
-
-  downstreamInterfaceOpts = { ... }: {
-    options = {
-      sla_id = mkOption {
-        type = with types; nullOr ints.unsigned;
-        default = null;
-      };
-
-      prefix_len = mkOption {
-        type = with types; nullOr ints.unsigned;
-        default = null;
-      };
-
-      suffix = mkOption {
-        type = with types; nullOr str;
-        default = null;
-      };
-    };
-  };
-
-  interfaceOpts = { ... }: {
-    options = {
-      iaid = mkOption {
-        type = with types; ints.unsigned;
-        description = ''
-          Request a delegated prefix with this IAID on this interface
-        '';
-      };
-
-      prefix = mkOption {
-        type = with types; nullOr str;
-        default = null;
-      };
-
-      prefix_len = mkOption {
-        type = with types; nullOr ints.unsigned;
-        default = null;
-      };
-
-      interfaces = mkOption {
-        type = with types; attrsOf (submodule downstreamInterfaceOpts);
-        default = {};
-        description =''
-          Interfaces to assign IPv6 prefixes to
-        '';
-      };
-    };
-  };
-
-in
-
-{
-
-  options = {
-
-    networking.dhcpcd-prefixdelegation = {
-      enable = mkEnableOption "dhcpcd for prefixdelegation";
-
-      interfaces = mkOption {
-        type = with types; attrsOf (submodule interfaceOpts);
-        default = {};
-        description = ''
-          Interfaces to request IPv6 prefixes from
-        '';
-      };
-    };
-  };
-
-  config = mkIf cfg.enable {
-
-    environment.etc."dhcpcd.conf".source = dhcpcdConf;
-
-    systemd.services.dhcpcd-prefixdelegation = {
-        description = "DHCP Client for IPv6 Prefix Delegation";
-
-        wantedBy = [ "multi-user.target" ];
-        wants = [ "network.target" ];
-        before = [ "network-online.target" ];
-
-        # Stopping dhcpcd during a reconfiguration is undesirable
-        # because it brings down the network interfaces configured by
-        # dhcpcd.  So do a "systemctl restart" instead.
-        stopIfChanged = false;
-
-        path = [ pkgs.dhcpcd ];
-
-        unitConfig.ConditionCapability = "CAP_NET_ADMIN";
-
-        serviceConfig =
-          { Type = "forking";
-            PIDFile = "/run/dhcpcd/pid";
-            RuntimeDirectory = "dhcpcd";
-            ExecStart = "@${pkgs.dhcpcd}/sbin/dhcpcd dhcpcd --quiet --config ${dhcpcdConf}";
-            ExecReload = "${pkgs.dhcpcd}/sbin/dhcpcd --rebind";
-            Restart = "always";
-          };
-      };
-
-    users.users.dhcpcd = {
-      isSystemUser = true;
-      group = "dhcpcd";
-    };
-    users.groups.dhcpcd = {};
-
-  };
-
-}
--- a/pkgs/git-diff-word/default.nix
+++ b/pkgs/git-diff-word/default.nix
@@ -1,9 +0,0 @@
-{ pkgs, ... }:
-
-pkgs.writeShellApplication {
-  name = "git-diff-word";
-  text = builtins.readFile ./git-diff-word.sh;
-  runtimeInputs = with pkgs; [
-    git
-  ];
-}
--- a/pkgs/git-diff-word/git-diff-word.sh
+++ b/pkgs/git-diff-word/git-diff-word.sh
@@ -1,5 +0,0 @@
-#!/usr/bin/env bash
-
-set -euo pipefail
-
-git diff --word-diff=color --word-diff-regex="." "$@"
--- a/pkgs/overlay.nix
+++ b/pkgs/overlay.nix
@@ -8,7 +8,6 @@ final: prev: {
  clerie-update-nixfiles = final.callPackage ./clerie-update-nixfiles/clerie-update-nixfiles.nix {};
  chromium-incognito = final.callPackage ./chromium-incognito {};
  git-checkout-github-pr = final.callPackage ./git-checkout-github-pr {};
-  git-diff-word = final.callPackage ./git-diff-word {};
  iot-data = final.python3.pkgs.callPackage ./iot-data {};
  nix-remove-result-links = final.callPackage ./nix-remove-result-links {};
  nixfiles-auto-install = final.callPackage ./nixfiles/nixfiles-auto-install.nix {};
@@ -16,7 +15,6 @@ final: prev: {
  nixfiles-generate-backup-secrets = final.callPackage ./nixfiles/nixfiles-generate-backup-secrets.nix {};
  nixfiles-update-ssh-host-keys = final.callPackage ./nixfiles/nixfiles-update-ssh-host-keys.nix {};
  print-afra = final.callPackage ./print-afra {};
-  run-with-docker-group = final.callPackage ./run-with-docker-group {};
  ssh-gpg = final.callPackage ./ssh-gpg {};
  update-from-hydra = final.callPackage ./update-from-hydra {};
  uptimestatus = final.python3.pkgs.callPackage ./uptimestatus {};
--- a/pkgs/run-with-docker-group/default.nix
+++ b/pkgs/run-with-docker-group/default.nix
@@ -1,6 +0,0 @@
-{ pkgs, ... }:
-
-pkgs.writeShellApplication {
-  name = "run-with-docker-group";
-  text = builtins.readFile ./run-with-docker-group.sh;
-}
--- a/pkgs/run-with-docker-group/run-with-docker-group.sh
+++ b/pkgs/run-with-docker-group/run-with-docker-group.sh
@@ -1,14 +0,0 @@
-#!/usr/bin/env bash
-
-set -euo pipefail
-
-if [[ $# -eq 0 ]]; then
-	set -- "${SHELL}"
-fi
-
-exec systemd-run \
-	"--property=User=$(id -un)" \
-	"--property=SupplementaryGroups=docker" \
-	"--pty" "--same-dir" "--wait" "--collect" "--service-type=exec" \
-	"--quiet" \
-	"$@"