Update from updated-inputs-2024-11-22-02-03

configuration/common/backup.nix

@@ -4,8 +4,8 @@
 
   clerie.backup = {
     targets = {
-      cyan.serverUrl = "https://cyan.backup.clerie.de";
-      magenta.serverUrl = "https://magenta.backup.clerie.de";
+      cyan.serverName = "cyan.backup.clerie.de";
+      magenta.serverName = "magenta.backup.clerie.de";
     };
   };
 

configuration/common/certificates.nix

@@ -1,11 +0,0 @@
-{ config, lib, ... }:
-
-with lib;
-
-{
-
-  environment.sessionVariables = {
-    REQUESTS_CA_BUNDLE = mkDefault config.security.pki.caBundle;
-  };
-
-}

configuration/common/default.nix

@@ -3,14 +3,15 @@
 {
   imports = [
     ./backup.nix
-    ./certificates.nix
     ./initrd.nix
     ./locale.nix
     ./networking.nix
+    ./nix.nix
     ./programs.nix
     ./ssh.nix
     ./systemd.nix
     ./user.nix
+    ./web.nix
   ];
 
   services.fstrim.enable = true;

configuration/common/nix.nix

@@ -0,0 +1,72 @@
+{ lib, pkgs, ... }:
+
+{
+
+  clerie.nixfiles.enable = true;
+
+  clerie.system-auto-upgrade.enable = true;
+
+  nix.settings = {
+    trusted-users = [ "@wheel" "@guests" ];
+    auto-optimise-store = true;
+    # Keep buildtime dependencies
+    keep-outputs = true;
+    # Build local, when caches are broken
+    fallback = true;
+  };
+
+  nix.gc = lib.mkDefault {
+    automatic = true;
+    dates = "weekly";
+    options = "--delete-older-than 30d";
+  };
+
+
+  nix.settings = {
+    experimental-features = [
+      "flakes"
+      "nix-command"
+    ];
+    substituters = [
+      "https://nix-cache.clerie.de"
+    ];
+    trusted-public-keys = [
+      "nix-cache.clerie.de:bAt1GJTS9BOTcXFWj3nURrSlcjqikCev9yDvqArMP5g="
+    ];
+  };
+
+  # Pin current nixpkgs channel and flake registry to the nixpkgs version
+  # the host got build with
+  nix.nixPath = lib.mkForce [ "nixpkgs=${lib.cleanSource pkgs.path}" ];
+  nix.registry = {
+    "nixpkgs" = lib.mkForce {
+       from = {
+         type = "indirect";
+         id = "nixpkgs";
+       };
+       to = {
+         type = "path";
+         path = lib.cleanSource pkgs.path;
+       };
+       exact = true;
+    };
+    "templates" = {
+       from = {
+         type = "indirect";
+         id = "templates";
+       };
+       to = {
+         type = "git";
+         url = "https://git.clerie.de/clerie/flake-templates.git";
+       };
+    };
+  };
+
+  nix.package = lib.mkDefault pkgs.nixVersions.nix_2_18;
+
+  documentation.doc.enable = false;
+
+  environment.systemPackages = with pkgs; [
+    nix-remove-result-links
+  ];
+}

configuration/common/programs.nix

@@ -6,7 +6,6 @@
     # My system is fucked
     gptfdisk
     parted
-    grow-last-partition-and-filesystem
 
     # Normal usage
     htop

configuration/common/web.nix

@@ -0,0 +1,50 @@
+{ ... }:
+
+{
+  services.nginx = {
+    enableReload = true;
+    recommendedGzipSettings = true;
+    recommendedOptimisation = true;
+    recommendedProxySettings = true;
+    recommendedTlsSettings = true;
+
+    commonHttpConfig = ''
+      server_names_hash_bucket_size 64;
+      map $remote_addr $remote_addr_anon {
+        ~(?P<ip>\d+\.\d+\.\d+)\.          $ip.0;
+        ~(?P<ip>[^:]*:[^:]*(:[^:]*)?):    $ip::;
+        default                           ::;
+      }
+      log_format combined_anon '$remote_addr_anon - $remote_user [$time_local] '
+                               '"$request" $status $body_bytes_sent '
+                               '"$http_referer" "$http_user_agent"';
+      log_format vcombined_anon '$host: $remote_addr_anon - $remote_user [$time_local] '
+                                '"$request" $status $body_bytes_sent '
+                                '"$http_referer" "$http_user_agent"';
+      access_log /var/log/nginx/access.log vcombined_anon;
+    '';
+
+    virtualHosts = {
+      "default" = {
+        default = true;
+        rejectSSL = true;
+        locations."/" = {
+          return = ''200 "Some piece of infrastructure\n"'';
+          extraConfig = ''
+            types { } default_type "text/plain; charset=utf-8";
+          '';
+        };
+      };
+    };
+  };
+
+  services.logrotate.settings.nginx = {
+    frequency = "daily";
+    maxage = 14;
+  };
+
+  security.acme = {
+    defaults.email = "letsencrypt@clerie.de";
+    acceptTerms = true;
+  };
+}

configuration/desktop/audio.nix

@@ -0,0 +1,19 @@
+{ ... }:
+
+{
+
+  hardware.pulseaudio.enable = false;
+
+  security.rtkit.enable = true;
+  services.pipewire = {
+    enable = true;
+    alsa = {
+      enable = true;
+      support32Bit = true;
+    };
+    pulse = {
+      enable = true;
+    };
+  };
+
+}

configuration/desktop/default.nix

@@ -0,0 +1,19 @@
+{ ... }:
+
+{
+  imports = [
+    ./audio.nix
+    ./firmware.nix
+    ./fonts.nix
+    ./gnome.nix
+    ./inputs.nix
+    ./networking.nix
+    ./polkit.nix
+    ./power.nix
+    ./printing.nix
+    ./ssh.nix
+    ./xserver.nix
+  ];
+
+  security.sudo.wheelNeedsPassword = true;
+}

configuration/desktop/firmware.nix

@@ -0,0 +1,7 @@
+{ ... }:
+
+{
+
+  services.fwupd.enable = true;
+
+}

configuration/desktop/fonts.nix

@@ -0,0 +1,13 @@
+{ pkgs, ... }:
+
+{
+
+  fonts.enableDefaultPackages = true;
+  fonts.packages = with pkgs; [
+    roboto
+    roboto-mono
+    noto-fonts
+    noto-fonts-emoji
+    comfortaa
+  ] ++ (if pkgs ? "noto-fonts-cjk-sans" then [ pkgs.noto-fonts-cjk-sans ] else [ pkgs.noto-fonts-cjk ]);
+}

configuration/desktop/gnome.nix

@@ -0,0 +1,61 @@
+{ pkgs, ... }:
+
+{
+  services.gnome = {
+    tracker-miners.enable = false;
+    tracker.enable = false;
+  };
+
+  environment.gnome.excludePackages = with pkgs; [
+    baobab
+    epiphany
+    gnome-calendar
+    gnome-clocks
+    gnome-console
+    gnome-contacts
+    gnome-logs
+    gnome-maps
+    gnome-music
+    gnome-tour
+    gnome-photos
+    gnome-weather
+    gnome-connections
+    simple-scan
+    yelp
+    geary
+  ];
+
+  environment.systemPackages = with pkgs; [
+    evolution
+    gnome-terminal
+    gnome-tweaks
+  ];
+
+  services.gnome.evolution-data-server.enable = true;
+
+  programs.dconf.profiles = {
+    user.databases = [
+      {
+        settings = {
+          "org/gnome/desktop/calendar" = {
+            show-weekdate = true;
+          };
+          "org/gnome/desktop/interface" = {
+            enable-hot-corners = false;
+            show-battery-percentage = true;
+          };
+          "org/gnome/desktop/notifications" = {
+            show-in-lock-screen = false;
+          };
+          "org/gnome/desktop/sound" = {
+            event-sounds = false;
+          };
+          "org/gnome/gnome-system-monitor" = {
+            network-in-bits = true;
+            network-total-in-bits = true;
+          };
+        };
+      }
+    ];
+  };
+}

configuration/desktop/inputs.nix

@@ -0,0 +1,42 @@
+{ ... }:
+
+{
+  programs.dconf.profiles = {
+    user.databases = [
+      {
+        settings = {
+          "org/gnome/desktop/peripherals/touchpad" = {
+            disable-while-typing = false;
+            edge-scrolling-enabled = false;
+            natural-scroll = true;
+            tap-to-click = true;
+            two-finger-scrolling-enabled = true;
+          };
+          "org/gnome/settings-daemon/plugins/media-keys" = {
+            custom-keybindings = [
+              "/org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/terminal/"
+            ];
+          };
+          "org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/terminal" = {
+            name = "Terminal";
+            binding = "<Primary><Alt>t";
+            command = "gnome-terminal";
+          };
+        };
+      }
+    ];
+    gdm.databases = [
+      {
+        settings = {
+          "org/gnome/desktop/peripherals/touchpad" = {
+            disable-while-typing = false;
+            edge-scrolling-enabled = false;
+            natural-scroll = true;
+            tap-to-click = true;
+            two-finger-scrolling-enabled = true;
+          };
+        };
+      }
+    ];
+  };
+}

configuration/desktop/networking.nix

@@ -0,0 +1,14 @@
+{ ... }:
+
+{
+
+  networking.networkmanager.settings = {
+    connectivity = {
+      uri = "http://ping.clerie.de/nm-check.txt";
+    };
+    global-dns = {
+      searches = "net.clerie.de";
+    };
+  };
+
+}

configuration/desktop/polkit.nix

@@ -0,0 +1,7 @@
+{ ... }:
+
+{
+
+  security.polkit.enable = true;
+
+}

configuration/desktop/power.nix

@@ -0,0 +1,36 @@
+{ lib, config, ... }:
+
+{
+  boot.resumeDevice = lib.optionalString ((lib.length config.swapDevices) > 0) (lib.head config.swapDevices).device;
+  services.logind = {
+    lidSwitch = "suspend-then-hibernate";
+  };
+  systemd.sleep.extraConfig = ''
+    HibernateDelaySec=30m
+  '';
+
+  programs.dconf.profiles = {
+    user.databases = [
+      {
+        settings = {
+          "org/gnome/settings-daemon/plugins/power" = {
+            power-button-action = "hibernate";
+            power-saver-profile-on-low-battery = false;
+            sleep-inactive-ac-type = "nothing";
+          };
+        };
+      }
+    ];
+    gdm.databases = [
+      {
+        settings = {
+          "org/gnome/settings-daemon/plugins/power" = {
+            power-button-action = "hibernate";
+            power-saver-profile-on-low-battery = false;
+            sleep-inactive-ac-type = "nothing";
+          };
+        };
+      }
+    ];
+  };
+}

configuration/desktop/printing.nix

@@ -0,0 +1,7 @@
+{ ... }:
+
+{
+  services.printing.enable = true;
+  services.avahi.enable = true;
+  services.avahi.nssmdns4 = true;
+}

configuration/desktop/ssh.nix

@@ -0,0 +1,34 @@
+{ pkgs, ... }:
+
+{
+
+  imports = [
+    ../../configuration/gpg-ssh
+  ];
+  programs.gnupg.agent = {
+    pinentryPackage = pkgs.pinentry-gtk2;
+  };
+
+  # Do not disable ssh-agent of gnome-keyring, because
+  # gnupg ssh-agent can't handle normal SSH keys properly
+  /*
+  # Disable ssh-agent of gnome-keyring
+  nixpkgs.overlays = [
+    (final: prev: {
+      gnome = prev.gnome // {
+        gnome-keyring = prev.runCommand "gnome-keyring-ssh-disabled-autostart" {} ''
+          mkdir -p $out
+
+          # Symlink all gnome-keyring binaries
+          ${final.xorg.lndir}/bin/lndir -silent ${prev.gnome.gnome-keyring} $out
+
+          # Disable autostart for ssh
+          rm $out/etc/xdg/autostart/gnome-keyring-ssh.desktop
+          cat ${prev.gnome.gnome-keyring}/etc/xdg/autostart/gnome-keyring-ssh.desktop > $out/etc/xdg/autostart/gnome-keyring-ssh.desktop
+          echo "Hidden=true" >> $out/etc/xdg/autostart/gnome-keyring-ssh.desktop
+        '';
+      };
+    })
+  ];
+  */
+}

configuration/desktop/xserver.nix

@@ -0,0 +1,11 @@
+{ pkgs, ... }:
+
+{
+  services.xserver.enable = true;
+  services.xserver.displayManager.gdm.enable = true;
+  services.xserver.desktopManager.gnome.enable = true;
+
+  services.xserver.excludePackages = with pkgs; [
+    xterm
+  ];
+}

configuration/dn42/default.nix

@@ -0,0 +1,22 @@
+{ pkgs, ... }:
+
+{
+  environment.systemPackages = with pkgs; [
+    wireguard-tools
+  ];
+
+  boot.kernel.sysctl = {
+    "net.ipv4.ip_forward" = true;
+    "net.ipv6.conf.all.forwarding" = true;
+  };
+
+  networking.firewall.checkReversePath = false;
+
+  # Open Firewall for BGP
+  networking.firewall.allowedTCPPorts = [ 179 ];
+  # Open Fireall for OSPF
+  networking.firewall.extraCommands = ''
+  ip6tables -A INPUT -p ospfigp -j ACCEPT
+  iptables -A INPUT -p ospfigp -j ACCEPT
+  '';
+}

configuration/gpg-ssh/default.nix

@@ -0,0 +1,51 @@
+{ pkgs, lib, ... }:
+
+let
+
+  custom_gnupg = pkgs.gnupg.overrideAttrs (final: prev: {
+    configureFlags = prev.configureFlags ++ [
+      # Make sure scdaemon never ever again tries to use its own ccid driver
+      "--disable-ccid-driver"
+    ];
+  });
+
+in {
+
+  programs.gnupg.package = custom_gnupg;
+  programs.gnupg.agent = {
+    enable = true;
+    enableSSHSupport = true;
+    pinentryPackage = lib.mkDefault pkgs.pinentry-curses;
+  };
+
+  environment.systemPackages = with pkgs; [
+    custom_gnupg
+    yubikey-personalization
+    openpgp-card-tools
+
+    # Add wrapper around ssh that takes the gnupg ssh-agent
+    # instead of gnome-keyring
+    ssh-gpg
+  ];
+
+  services.pcscd.enable = true;
+
+  # pcscd sometimes breaks and seem to need a manual restart
+  # so we allow users to restart that service themself
+  security.polkit.extraConfig = ''
+    polkit.addRule(function(action, subject) {
+        if (
+            action.id == "org.freedesktop.systemd1.manage-units"
+            && action.lookup("unit") == "pcscd.service"
+            && action.lookup("verb") == "restart"
+            && subject.isInGroup("users")
+        ) {
+            return polkit.Result.YES;
+        }
+    });
+  '';
+
+  services.udev.packages = with pkgs; [
+    yubikey-personalization
+  ];
+}

configuration/hetzner-cloud/default.nix

@@ -0,0 +1,8 @@
+{ ... }:
+
+{
+  networking.useDHCP = false;
+  networking.defaultGateway6 = { address = "fe80::1"; interface = "ens3"; };
+  networking.defaultGateway = { address = "172.31.1.1"; interface = "ens3"; };
+  networking.nameservers = [ "2a01:4ff:ff00::add:2" "2a01:4ff:ff00::add:1" "185.12.64.2" "185.12.64.1" ];
+}

configuration/hydra-build-machine/default.nix

@@ -0,0 +1,16 @@
+{ ... }:
+
+{
+
+  # Allow Hydra to fetch remote URLs in restricted mode
+  nix.settings.allowed-uris = "http: https: git+https: github:";
+
+  services.openssh.settings= {
+   PermitRootLogin = "yes";
+  };
+
+  users.extraUsers.root.openssh.authorizedKeys.keys = [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMv8Lbca/CR4das3HJ2F/sQ9dA7kdGS1hSVTt5lX4diP root@hydra-1"
+  ];
+
+}

configuration/proxmox-vm/default.nix

@@ -0,0 +1,5 @@
+{ ... }:
+
+{
+  services.qemuGuest.enable = true;
+}

configuration/router/default.nix

@@ -0,0 +1,27 @@
+{ pkgs, ... }:
+
+{
+  environment.systemPackages = with pkgs; [
+    wireguard-tools
+    tcpdump
+  ];
+
+  boot.kernel.sysctl = {
+    "net.ipv4.ip_forward" = true;
+    "net.ipv6.conf.all.forwarding" = true;
+  };
+
+  networking.firewall.checkReversePath = false;
+
+  networking.firewall.allowedTCPPorts = [
+    # Open Firewall for BGP
+    179
+  ];
+
+  networking.firewall.extraCommands = ''
+    # Open fireall for OSPF
+    ip46tables -A nixos-fw -p ospfigp -j nixos-fw-accept
+    # Open firewall for GRE
+    ip46tables -A nixos-fw -p gre -j nixos-fw-accept
+  '';
+}

flake.lock

@@ -27,11 +27,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1748808701,
-        "narHash": "sha256-IEer4ypv/tL2zzo7nkgyg7xdK6P+Mc/22oPctEgwhiw=",
+        "lastModified": 1724513039,
+        "narHash": "sha256-YdBuRgXEU9CcxPd2EjuvDKcfgxL1kk9Gv8nFVVjIros=",
         "ref": "refs/heads/main",
-        "rev": "5f3748df43e6b6e49cc0a23557a378ef37952483",
-        "revCount": 5,
+        "rev": "202f4a1a5791c74a9b7d69a4e63e631bdbe36ba6",
+        "revCount": 4,
         "type": "git",
         "url": "https://git.clerie.de/clerie/bij.git"
       },
@@ -58,36 +58,19 @@
         "url": "https://git.clerie.de/clerie/chaosevents.git"
       }
     },
-    "communities": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1739635166,
-        "narHash": "sha256-0ZONcN3ctsZgMVM//UMp+9iQfhODJNFHOhyWwx0EoTg=",
-        "owner": "NLNOG",
-        "repo": "lg.ring.nlnog.net",
-        "rev": "686adbfd5222b830ba4fee998188cc8d96c09169",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NLNOG",
-        "repo": "lg.ring.nlnog.net",
-        "type": "github"
-      }
-    },
     "fernglas": {
       "inputs": {
-        "communities": "communities",
         "flake-utils": "flake-utils",
         "nixpkgs": [
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1741172718,
-        "narHash": "sha256-YDEJVlmPzOuKfG26iYuJVOlxFvKBVeb8DbAI9WOtnBU=",
+        "lastModified": 1700408128,
+        "narHash": "sha256-PLb/q8kIq0wOinkgADHNY6uOB3b3lXQEbLu6ToIFPsU=",
         "owner": "wobcom",
         "repo": "fernglas",
-        "rev": "64e2f9af8aefeeaa63431477066dcc0236d111e0",
+        "rev": "407325681e3ad344f6fd05334984a40074aa6347",
         "type": "github"
       },
       "original": {
@@ -115,37 +98,6 @@
         "url": "https://git.clerie.de/clerie/fieldpoc.git"
       }
     },
-    "flake-compat": {
-      "locked": {
-        "lastModified": 1746162366,
-        "narHash": "sha256-5SSSZ/oQkwfcAz/o/6TlejlVGqeK08wyREBQ5qFFPhM=",
-        "owner": "nix-community",
-        "repo": "flake-compat",
-        "rev": "0f158086a2ecdbb138cd0429410e44994f1b7e4b",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "flake-compat",
-        "type": "github"
-      }
-    },
-    "flake-compat_2": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1696426674,
-        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
-        "owner": "edolstra",
-        "repo": "flake-compat",
-        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
-        "type": "github"
-      },
-      "original": {
-        "owner": "edolstra",
-        "repo": "flake-compat",
-        "type": "github"
-      }
-    },
     "flake-parts": {
       "inputs": {
         "nixpkgs-lib": [
@@ -154,11 +106,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1733312601,
-        "narHash": "sha256-4pDvzqnegAfRkPwO3wmwBhVi/Sye1mzps0zHWYnP88c=",
+        "lastModified": 1712014858,
+        "narHash": "sha256-sB4SWl2lX95bExY2gMFG5HIzvva5AVMJd4Igm+GpZNw=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "205b12d8b7cd4802fbcb8e8ef6a0f1408781a4f9",
+        "rev": "9126214d0a59633752a136528f5f3b9aa8565b7d",
         "type": "github"
       },
       "original": {
@@ -193,11 +145,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1731533236,
-        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "lastModified": 1694529238,
+        "narHash": "sha256-zsNZZGTGnMOf9YpHKJqMSsa0dXbfmxeoJ7xHlrt+xmY=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "rev": "ff7b65b44d01cf9ba6a71320833626af21126384",
         "type": "github"
       },
       "original": {
@@ -206,39 +158,6 @@
         "type": "github"
       }
     },
-    "flake-utils_2": {
-      "inputs": {
-        "systems": "systems_2"
-      },
-      "locked": {
-        "lastModified": 1731533236,
-        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "flakey-profile": {
-      "locked": {
-        "lastModified": 1712898590,
-        "narHash": "sha256-FhGIEU93VHAChKEXx905TSiPZKga69bWl1VB37FK//I=",
-        "owner": "lf-",
-        "repo": "flakey-profile",
-        "rev": "243c903fd8eadc0f63d205665a92d4df91d42d9d",
-        "type": "github"
-      },
-      "original": {
-        "owner": "lf-",
-        "repo": "flakey-profile",
-        "type": "github"
-      }
-    },
     "harmonia": {
       "inputs": {
         "flake-parts": "flake-parts",
@@ -248,141 +167,20 @@
         "treefmt-nix": "treefmt-nix"
       },
       "locked": {
-        "lastModified": 1733771848,
-        "narHash": "sha256-tqkTzUdwnTfVuCrcFag7YKgGkiR9srR45e4v0XMXVCY=",
+        "lastModified": 1727121740,
+        "narHash": "sha256-72nDVSvUfZsLa2HbyricOpA0Eb8gxs/VST25b6DNBpM=",
         "owner": "nix-community",
         "repo": "harmonia",
-        "rev": "c26731351ca38f4953a23ef5490358ffba955ab6",
+        "rev": "ff44006a30f93ac40d76c786e15149d901946c2b",
         "type": "github"
       },
       "original": {
         "owner": "nix-community",
-        "ref": "harmonia-v2.0.1",
+        "ref": "harmonia-v1.0.2",
         "repo": "harmonia",
         "type": "github"
       }
     },
-    "hydra": {
-      "inputs": {
-        "flake-compat": "flake-compat",
-        "lix": "lix",
-        "nixpkgs": "nixpkgs_3"
-      },
-      "locked": {
-        "lastModified": 1751801455,
-        "narHash": "sha256-hUJqtS88SbNQQSEJAPFyY2vLMh8yA8rQ6jbul50p64M=",
-        "ref": "lix-2.93",
-        "rev": "b940aca430a7ca41f70bdb320659dd62026fe0e9",
-        "revCount": 4261,
-        "type": "git",
-        "url": "https://git.lix.systems/lix-project/hydra.git"
-      },
-      "original": {
-        "ref": "lix-2.93",
-        "type": "git",
-        "url": "https://git.lix.systems/lix-project/hydra.git"
-      }
-    },
-    "lix": {
-      "inputs": {
-        "flake-compat": [
-          "hydra",
-          "flake-compat"
-        ],
-        "nix2container": "nix2container",
-        "nix_2_18": [
-          "hydra"
-        ],
-        "nixpkgs": [
-          "hydra",
-          "nixpkgs"
-        ],
-        "nixpkgs-regression": "nixpkgs-regression",
-        "pre-commit-hooks": "pre-commit-hooks"
-      },
-      "locked": {
-        "lastModified": 1751235704,
-        "narHash": "sha256-Jzm3KPZ2gL+0Nl3Mw/2E0B3vqDDi1Xt5+9VCXghUDZ8=",
-        "ref": "release-2.93",
-        "rev": "f3a7bbe5f8d1a8504ddb6362d50106904523e440",
-        "revCount": 17874,
-        "type": "git",
-        "url": "https://git.lix.systems/lix-project/lix"
-      },
-      "original": {
-        "ref": "release-2.93",
-        "type": "git",
-        "url": "https://git.lix.systems/lix-project/lix"
-      }
-    },
-    "lix-module": {
-      "inputs": {
-        "flake-utils": "flake-utils_2",
-        "flakey-profile": "flakey-profile",
-        "lix": [
-          "lix"
-        ],
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1753282722,
-        "narHash": "sha256-KYMUrTV7H/RR5/HRnjV5R3rRIuBXMemyJzTLi50NFTs=",
-        "ref": "release-2.93",
-        "rev": "46a9e8fcfe4be72b4c7c8082ee11d2c42da1e873",
-        "revCount": 149,
-        "type": "git",
-        "url": "https://git.lix.systems/lix-project/nixos-module.git"
-      },
-      "original": {
-        "ref": "release-2.93",
-        "type": "git",
-        "url": "https://git.lix.systems/lix-project/nixos-module.git"
-      }
-    },
-    "lix_2": {
-      "inputs": {
-        "flake-compat": "flake-compat_2",
-        "nix2container": "nix2container_2",
-        "nix_2_18": "nix_2_18",
-        "nixpkgs": [
-          "nixpkgs"
-        ],
-        "nixpkgs-regression": "nixpkgs-regression_2",
-        "pre-commit-hooks": "pre-commit-hooks_2"
-      },
-      "locked": {
-        "lastModified": 1753306924,
-        "narHash": "sha256-jLCEW0FvjFhC+c4RHzH+xbkSOxrnpFHnhjOw6sudhx0=",
-        "ref": "release-2.93",
-        "rev": "1a4393d0aac31aba21f5737ede1b171e11336d77",
-        "revCount": 17884,
-        "type": "git",
-        "url": "https://git.lix.systems/lix-project/lix.git"
-      },
-      "original": {
-        "ref": "release-2.93",
-        "type": "git",
-        "url": "https://git.lix.systems/lix-project/lix.git"
-      }
-    },
-    "lowdown-src": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1633514407,
-        "narHash": "sha256-Dw32tiMjdK9t3ETl5fzGrutQTzh2rufgZV4A/BbxuD4=",
-        "owner": "kristapsdz",
-        "repo": "lowdown",
-        "rev": "d2c2b44ff6c27b936ec27358a2653caaef8f73b8",
-        "type": "github"
-      },
-      "original": {
-        "owner": "kristapsdz",
-        "repo": "lowdown",
-        "type": "github"
-      }
-    },
     "mitel-ommclient2": {
       "inputs": {
         "nixpkgs": [
@@ -404,66 +202,6 @@
         "url": "https://git.clerie.de/clerie/mitel_ommclient2.git"
       }
     },
-    "nix2container": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1724996935,
-        "narHash": "sha256-njRK9vvZ1JJsP8oV2OgkBrpJhgQezI03S7gzskCcHos=",
-        "owner": "nlewo",
-        "repo": "nix2container",
-        "rev": "fa6bb0a1159f55d071ba99331355955ae30b3401",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nlewo",
-        "repo": "nix2container",
-        "type": "github"
-      }
-    },
-    "nix2container_2": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1724996935,
-        "narHash": "sha256-njRK9vvZ1JJsP8oV2OgkBrpJhgQezI03S7gzskCcHos=",
-        "owner": "nlewo",
-        "repo": "nix2container",
-        "rev": "fa6bb0a1159f55d071ba99331355955ae30b3401",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nlewo",
-        "repo": "nix2container",
-        "type": "github"
-      }
-    },
-    "nix_2_18": {
-      "inputs": {
-        "flake-compat": [
-          "lix",
-          "flake-compat"
-        ],
-        "lowdown-src": "lowdown-src",
-        "nixpkgs": "nixpkgs_4",
-        "nixpkgs-regression": [
-          "lix",
-          "nixpkgs-regression"
-        ]
-      },
-      "locked": {
-        "lastModified": 1730375271,
-        "narHash": "sha256-RrOFlDGmRXcVRV2p2HqHGqvzGNyWoD0Dado/BNlJ1SI=",
-        "owner": "NixOS",
-        "repo": "nix",
-        "rev": "0f665ff6779454f2117dcc32e44380cda7f45523",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "2.18.9",
-        "repo": "nix",
-        "type": "github"
-      }
-    },
     "nixos-exporter": {
       "inputs": {
         "nixpkgs": [
@@ -471,11 +209,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1746733297,
-        "narHash": "sha256-CPo/F6oJq3tswg2YT6DsWDFPYXOjw00/3m45JN84PVY=",
+        "lastModified": 1683625533,
+        "narHash": "sha256-GvKE97JdQuEZ697TLSMRTNABbVJfGVnJ0vfzK4AIFyI=",
         "ref": "refs/heads/main",
-        "rev": "f1a832f445c9994d9729a6fa1862b8d4a123bd31",
-        "revCount": 22,
+        "rev": "5e86139ee4af27f84228708fd32903bb0c4230f0",
+        "revCount": 19,
         "type": "git",
         "url": "https://git.clerie.de/clerie/nixos-exporter.git"
       },
@@ -516,70 +254,6 @@
         "type": "github"
       }
     },
-    "nixpkgs-0dc1c7": {
-      "locked": {
-        "lastModified": 1725718979,
-        "narHash": "sha256-TNj62uDY5ilnYu0Jne8/IIunfh1kf6kDPY9KdS+Eotw=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "0dc1c7294c13f5d1dd6eccab4f75d268d7296efe",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "0dc1c7294c13f5d1dd6eccab4f75d268d7296efe",
-        "type": "github"
-      }
-    },
-    "nixpkgs-carbon": {
-      "locked": {
-        "lastModified": 1751206202,
-        "narHash": "sha256-VjK8pEv4cfDpCTh4KW1go98kP25j7KdTNEce342Bh/Y=",
-        "owner": "clerie",
-        "repo": "nixpkgs",
-        "rev": "ac4ac98609c1b30c378458ab7207a9a5b5148457",
-        "type": "github"
-      },
-      "original": {
-        "owner": "clerie",
-        "ref": "clerie/always-setup-netdevs",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs-regression": {
-      "locked": {
-        "lastModified": 1643052045,
-        "narHash": "sha256-uGJ0VXIhWKGXxkeNnq4TvV3CIOkUJ3PAoLZ3HMzNVMw=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "215d4d0fd80ca5163643b03a33fde804a29cc1e2",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "215d4d0fd80ca5163643b03a33fde804a29cc1e2",
-        "type": "github"
-      }
-    },
-    "nixpkgs-regression_2": {
-      "locked": {
-        "lastModified": 1643052045,
-        "narHash": "sha256-uGJ0VXIhWKGXxkeNnq4TvV3CIOkUJ3PAoLZ3HMzNVMw=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "215d4d0fd80ca5163643b03a33fde804a29cc1e2",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "215d4d0fd80ca5163643b03a33fde804a29cc1e2",
-        "type": "github"
-      }
-    },
     "nixpkgs-stable": {
       "locked": {
         "lastModified": 1713434076,
@@ -614,43 +288,11 @@
     },
     "nixpkgs_3": {
       "locked": {
-        "lastModified": 1751582995,
-        "narHash": "sha256-u7ubvtxdTnFPpV27AHpgoKn7qHuE7sgWgza/1oj5nzA=",
+        "lastModified": 1732014248,
+        "narHash": "sha256-y/MEyuJ5oBWrWAic/14LaIr/u5E0wRVzyYsouYY3W6w=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "7a732ed41ca0dd64b4b71b563ab9805a80a7d693",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-25.05",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_4": {
-      "locked": {
-        "lastModified": 1705033721,
-        "narHash": "sha256-K5eJHmL1/kev6WuqyqqbS1cdNnSidIZ3jeqJ7GbrYnQ=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "a1982c92d8980a0114372973cbdfe0a307f1bdea",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-23.05-small",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_5": {
-      "locked": {
-        "lastModified": 1756542300,
-        "narHash": "sha256-tlOn88coG5fzdyqz6R93SQL5Gpq+m/DsWpekNFhqPQk=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "d7600c775f877cd87b4f5a831c28aa94137377aa",
+        "rev": "23e89b7da85c3640bbc2173fe04f4bd114342367",
         "type": "github"
       },
       "original": {
@@ -680,58 +322,6 @@
         "url": "https://git.clerie.de/clerie/nurausstieg.git"
       }
     },
-    "pre-commit-hooks": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1733318908,
-        "narHash": "sha256-SVQVsbafSM1dJ4fpgyBqLZ+Lft+jcQuMtEL3lQWx2Sk=",
-        "owner": "cachix",
-        "repo": "git-hooks.nix",
-        "rev": "6f4e2a2112050951a314d2733a994fbab94864c6",
-        "type": "github"
-      },
-      "original": {
-        "owner": "cachix",
-        "repo": "git-hooks.nix",
-        "type": "github"
-      }
-    },
-    "pre-commit-hooks_2": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1733318908,
-        "narHash": "sha256-SVQVsbafSM1dJ4fpgyBqLZ+Lft+jcQuMtEL3lQWx2Sk=",
-        "owner": "cachix",
-        "repo": "git-hooks.nix",
-        "rev": "6f4e2a2112050951a314d2733a994fbab94864c6",
-        "type": "github"
-      },
-      "original": {
-        "owner": "cachix",
-        "repo": "git-hooks.nix",
-        "type": "github"
-      }
-    },
-    "rainbowrss": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1745667868,
-        "narHash": "sha256-T67ZRk+cuFI2P6qJeu8RwbpJD00OORulHGuXebpg9Nw=",
-        "ref": "refs/heads/main",
-        "rev": "e43037aa525e36d7a3da187a8fc6baeb71db7fd6",
-        "revCount": 15,
-        "type": "git",
-        "url": "https://git.clerie.de/clerie/rainbowrss.git"
-      },
-      "original": {
-        "type": "git",
-        "url": "https://git.clerie.de/clerie/rainbowrss.git"
-      }
-    },
     "root": {
       "inputs": {
         "berlinerbaeder-exporter": "berlinerbaeder-exporter",
@@ -740,41 +330,13 @@
         "fernglas": "fernglas",
         "fieldpoc": "fieldpoc",
         "harmonia": "harmonia",
-        "hydra": "hydra",
-        "lix": "lix_2",
-        "lix-module": "lix-module",
         "nixos-exporter": "nixos-exporter",
         "nixos-hardware": "nixos-hardware",
-        "nixpkgs": "nixpkgs_5",
-        "nixpkgs-0dc1c7": "nixpkgs-0dc1c7",
-        "nixpkgs-carbon": "nixpkgs-carbon",
+        "nixpkgs": "nixpkgs_3",
         "nurausstieg": "nurausstieg",
-        "rainbowrss": "rainbowrss",
-        "scan-to-gpg": "scan-to-gpg",
         "solid-xmpp-alarm": "solid-xmpp-alarm",
         "sops-nix": "sops-nix",
-        "ssh-to-age": "ssh-to-age",
-        "traveldrafter": "traveldrafter"
-      }
-    },
-    "scan-to-gpg": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1736606141,
-        "narHash": "sha256-cIGSrY3tNwOamqt41IPRRw5SPlBtljWZvcXDfCkreUc=",
-        "ref": "refs/heads/main",
-        "rev": "9f1aa15509c9b0284774be95ef020f612c385353",
-        "revCount": 18,
-        "type": "git",
-        "url": "https://git.clerie.de/clerie/scan-to-gpg.git"
-      },
-      "original": {
-        "type": "git",
-        "url": "https://git.clerie.de/clerie/scan-to-gpg.git"
+        "ssh-to-age": "ssh-to-age"
       }
     },
     "solid-xmpp-alarm": {
@@ -784,11 +346,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1734450899,
-        "narHash": "sha256-SyUOl5YUl/nlZNNM2/vSuFWFdxOCKmTO4BxjIxwVcjQ=",
+        "lastModified": 1675686574,
+        "narHash": "sha256-+Xww9mfKbUP4VRPtAJKZ6+YdBYL/0vgGoBXVC9AvmQw=",
         "ref": "refs/heads/main",
-        "rev": "4bfa8ec27b99e774906c82e6d51d13b32a3ff161",
-        "revCount": 6,
+        "rev": "79730bd7df798d80c526c42bbd526506f0235ea3",
+        "revCount": 4,
         "type": "git",
         "url": "https://git.clerie.de/clerie/solid-xmpp-alarm.git"
       },
@@ -854,41 +416,6 @@
         "type": "github"
       }
     },
-    "systems_2": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    },
-    "traveldrafter": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1751817360,
-        "narHash": "sha256-HzOhsPvzCaFeiz8nPq5MkYnYHpUzVaU/P5sxG+Njt+8=",
-        "ref": "refs/heads/main",
-        "rev": "b6610d70f363ecf9704352b1ef39244a816bd34f",
-        "revCount": 22,
-        "type": "git",
-        "url": "https://git.clerie.de/clerie/traveldrafter.git"
-      },
-      "original": {
-        "type": "git",
-        "url": "https://git.clerie.de/clerie/traveldrafter.git"
-      }
-    },
     "treefmt-nix": {
       "inputs": {
         "nixpkgs": [
@@ -897,11 +424,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1733662930,
-        "narHash": "sha256-9qOp6jNdezzLMxwwXaXZWPXosHbNqno+f7Ii/xftqZ8=",
+        "lastModified": 1711963903,
+        "narHash": "sha256-N3QDhoaX+paWXHbEXZapqd1r95mdshxToGowtjtYkGI=",
         "owner": "numtide",
         "repo": "treefmt-nix",
-        "rev": "357cda84af1d74626afb7fb3bc12d6957167cda9",
+        "rev": "49dc4a92b02b8e68798abd99184f228243b6e3ac",
         "type": "github"
       },
       "original": {

flake.nix

@@ -1,9 +1,6 @@
 {
   inputs = {
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
-    nixpkgs-carbon.url = "github:clerie/nixpkgs/clerie/always-setup-netdevs";
-    # for etesync-dav
-    nixpkgs-0dc1c7.url = "github:NixOS/nixpkgs/0dc1c7294c13f5d1dd6eccab4f75d268d7296efe";
     nixos-hardware.url = "github:NixOS/nixos-hardware/master";
     berlinerbaeder-exporter = {
       url = "git+https://git.clerie.de/clerie/berlinerbaeder-exporter.git";
@@ -22,21 +19,7 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
     harmonia = {
-      url = "github:nix-community/harmonia/harmonia-v2.0.1";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-    hydra = {
-      url = "git+https://git.lix.systems/lix-project/hydra.git?ref=lix-2.93";
-      #inputs.lix.follows = "lix";
-      #inputs.nixpkgs.follows = "nixpkgs";
-    };
-    lix = {
-      url = "git+https://git.lix.systems/lix-project/lix.git?ref=release-2.93";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-    lix-module = {
-      url = "git+https://git.lix.systems/lix-project/nixos-module.git?ref=release-2.93";
-      inputs.lix.follows = "lix";
+      url = "github:nix-community/harmonia/harmonia-v1.0.2";
       inputs.nixpkgs.follows = "nixpkgs";
     };
     fieldpoc.url = "git+https://git.clerie.de/clerie/fieldpoc.git";
@@ -48,14 +31,6 @@
       url = "git+https://git.clerie.de/clerie/nurausstieg.git";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    rainbowrss = {
-      url = "git+https://git.clerie.de/clerie/rainbowrss.git";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-    scan-to-gpg = {
-      url = "git+https://git.clerie.de/clerie/scan-to-gpg.git";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
     solid-xmpp-alarm = {
       url = "git+https://git.clerie.de/clerie/solid-xmpp-alarm.git";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -68,13 +43,11 @@
       url = "github:Mic92/ssh-to-age";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    traveldrafter = {
-      url = "git+https://git.clerie.de/clerie/traveldrafter.git";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
   };
   outputs = { self, nixpkgs, nixos-hardware, chaosevents, fernglas, nixos-exporter, solid-xmpp-alarm, ssh-to-age, ... }@inputs: let
     lib = import ./lib inputs;
+    helper = lib.flake-helper;
+    localNixpkgs = import ./flake/nixpkgs.nix inputs;
   in {
     clerie.hosts = {
       aluminium = {
@@ -112,12 +85,7 @@
       osmium = {};
       palladium = {};
       porter = {};
-      storage-2 = {
-        modules = [
-          ./users/frank
-        ];
-      };
-      tungsten = {};
+      storage-2 = {};
       web-2 = {};
       zinc = {
         modules = [
@@ -133,29 +101,43 @@
     nixosModules = {
       nixfilesInputs = import ./flake/modules.nix inputs;
       clerie = import ./modules;
-      profiles = import ./profiles;
       default = self.nixosModules.clerie;
     };
 
     overlays = {
-      clerie-inputs = import ./flake/inputs-overlay.nix inputs;
-      clerie-pkgs = import ./pkgs/overlay.nix;
-      clerie-build-support = import ./pkgs/build-support/overlay.nix;
-      clerie-overrides = import ./pkgs/overrides/overlay.nix;
+      nixfilesInputs = import ./flake/overlay.nix inputs;
+      clerie = import ./pkgs/overlay.nix;
+      default = self.overlays.clerie;
     };
 
-    nixpkgs = nixpkgs.lib.genAttrs [ "x86_64-linux" "aarch64-linux" ] (system:
-      lib.mkNixpkgs {
-        inherit system;
-      }
-    );
-
-    packages = nixpkgs.lib.genAttrs [ "x86_64-linux" "aarch64-linux" ] (system:
-      nixpkgs.lib.genAttrs (
-        (builtins.attrNames (self.overlays.clerie-pkgs null null))
-        ++ (builtins.attrNames (self.overlays.clerie-overrides null null))
-      ) (name: self.nixpkgs."${system}"."${name}")
-    );
+    packages = nixpkgs.lib.genAttrs [ "x86_64-linux" "aarch64-linux" ] (system: let
+      pkgs = localNixpkgs.${system};
+    in {
+      inherit (pkgs)
+        clerie-keys
+        clerie-system-upgrade
+        clerie-merge-nixfiles-update
+        clerie-update-nixfiles
+        clerie-sops
+        clerie-sops-config
+        clerie-sops-edit
+        chromium-incognito
+        git-checkout-github-pr
+        git-diff-word
+        git-pp
+        harmonia
+        iot-data
+        nix-remove-result-links
+        nixfiles-auto-install
+        nixfiles-generate-config
+        nixfiles-generate-backup-secrets
+        nixfiles-update-ssh-host-keys
+        print-afra
+        run-with-docker-group
+        ssh-gpg
+        update-from-hydra
+        uptimestatus;
+    });
 
     inherit lib self;
 

flake/hydraJobs.nix

@@ -10,12 +10,6 @@ let
 in {
   inherit (self)
     packages;
-  extraTrackedPackages = nixpkgs.lib.genAttrs [ "x86_64-linux" "aarch64-linux" ] (system:
-    nixpkgs.lib.genAttrs [
-      "hydra"
-      "lix"
-    ] (name: self.nixpkgs."${system}"."${name}")
-  );
   nixosConfigurations = buildHosts self.nixosConfigurations;
   iso = self.nixosConfigurations._iso.config.system.build.isoImage;
 }

flake/modules.nix

@@ -1,9 +1,7 @@
 { self
 , fernglas
 , fieldpoc
-, lix-module
 , nixos-exporter
-, scan-to-gpg
 , solid-xmpp-alarm
 , sops-nix
 , ...
@@ -14,9 +12,7 @@
   imports = [
     fernglas.nixosModules.default
     fieldpoc.nixosModules.default
-    lix-module.nixosModules.default
     nixos-exporter.nixosModules.default
-    scan-to-gpg.nixosModules.scan-to-gpg
     solid-xmpp-alarm.nixosModules.solid-xmpp-alarm
     sops-nix.nixosModules.sops
   ];

flake/nixosConfigurations.nix

@@ -11,14 +11,32 @@ let
     modules ? [],
   }: let
     localNixpkgs = nixpkgs.lib.attrByPath [ "nixpkgs-${name}" ] nixpkgs inputs;
-  in self.lib.nixosSystem {
+  in localNixpkgs.lib.nixosSystem {
     system = system;
-    nixpkgs = localNixpkgs;
     modules = modules ++ [
+      self.nixosModules.nixfilesInputs
+      self.nixosModules.clerie
+
       ({ config, lib, ... }: {
         # Set hostname
         networking.hostName = lib.mkDefault name;
 
+        # Apply overlays
+        nixpkgs.overlays = [
+          self.overlays.nixfilesInputs
+          self.overlays.clerie
+        ];
+
+        /*
+          Make the contents of the flake availiable to modules.
+          Useful for having the monitoring server scraping the
+          target config from all other servers automatically.
+        */
+        _module.args = {
+          inputs = inputs;
+          _nixfiles = self;
+        };
+
         # Expose host group to monitoring
         clerie.monitoring = nixpkgs.lib.attrsets.optionalAttrs (group != null) { serviceLevel = group; };
 
@@ -33,9 +51,6 @@ let
             {};
         in
           secrets;
-
-        # Enable clerie common config
-        profiles.clerie.common.enable = true;
       })
 
       # Config to be applied to every host

flake/nixpkgs.nix

@@ -0,0 +1,17 @@
+{ self
+, nixpkgs
+, ...
+}@inputs:
+
+let
+  mkNixpkgs = { system, ... }@args: 
+    import nixpkgs {
+      inherit system;
+      overlays = [
+        self.overlays.nixfilesInputs
+        self.overlays.clerie
+      ];
+    };
+
+in
+  nixpkgs.lib.genAttrs [ "x86_64-linux" "aarch64-linux" ] (system: mkNixpkgs { inherit system; })

flake/overlay.nix

@@ -1,38 +1,24 @@
 { self
-, nixpkgs-0dc1c7
 , berlinerbaeder-exporter
 , bij
 , chaosevents
 , harmonia
-, hydra
 , nurausstieg
-, rainbowrss
-, scan-to-gpg
 , ssh-to-age
-, traveldrafter
 , ...
 }@inputs:
 final: prev: {
-  inherit (nixpkgs-0dc1c7.legacyPackages.${final.system})
-    etesync-dav;
   inherit (berlinerbaeder-exporter.packages.${final.system})
     berlinerbaeder-exporter;
   inherit (bij.packages.${final.system})
     bij;
   inherit (chaosevents.packages.${final.system})
     chaosevents;
-  inherit (harmonia.packages.${final.system})
-    harmonia;
-  inherit (hydra.packages.${final.system})
-    hydra;
+  harmonia = harmonia.packages.${final.system}.harmonia.override {
+    nixForHarmonia = final.nixVersions.nix_2_23;
+  };
   inherit (nurausstieg.packages.${final.system})
     nurausstieg;
-  inherit (rainbowrss.packages.${final.system})
-    rainbowrss;
-  inherit (scan-to-gpg.packages.${final.system})
-    scan-to-gpg;
   inherit (ssh-to-age.packages.${final.system})
     ssh-to-age;
-  inherit (traveldrafter.packages.${final.system})
-    traveldrafter;
 }

hosts/_iso/configuration.nix

@@ -1,30 +1,15 @@
-{ pkgs, lib, modulesPath, config, ... }:
+{ pkgs, lib, modulesPath, ... }:
 
 {
   imports = [
     (modulesPath + "/installer/cd-dvd/installation-cd-base.nix")
+    ../../configuration/gpg-ssh
   ];
 
-  profiles.clerie.gpg-ssh.enable = true;
-  profiles.clerie.network-fallback-dhcp.enable = true;
-
-  # systemd in initrd is broken with ISOs
-  # Failed to mount /sysroot/iso
-  # https://github.com/NixOS/nixpkgs/issues/327187
-  boot.initrd.systemd.enable = false;
-
   networking.hostName = "isowo";
-  isoImage.isoBaseName = lib.mkForce "nixos-isowo";
+  isoImage.isoBaseName = "nixos-isowo";
 
   environment.systemPackages = with pkgs; [
     nixfiles-auto-install
   ];
-
-  # Allow user clerie to log in as root directly with ssh keys
-  users.users.root.openssh.authorizedKeys.keys = config.users.users.clerie.openssh.authorizedKeys.keys;
-
-  services.openssh.settings = {
-    PermitRootLogin = lib.mkForce "yes";
-  };
-
 }

hosts/aluminium/configuration.nix

@@ -18,7 +18,7 @@
     terminal_output serial
   ";
 
-  profiles.clerie.wg-clerie = {
+  services.wg-clerie = {
     enable = true;
     ipv6s = [ "2a01:4f8:c0c:15f1::8106/128" ];
     ipv4s = [ "10.20.30.106/32" ];

hosts/astatine/configuration.nix

@@ -4,21 +4,30 @@
   imports =
     [
       ./hardware-configuration.nix
-    ];
 
-  profiles.clerie.network-fallback-dhcp.enable = true;
+      ./ppp.nix
+      ./programs.nix
+      ./users.nix
+    ];
 
   boot.kernelParams = [ "console=ttyS0,115200n8" ];
 
+  # Use the GRUB 2 boot loader.
   boot.loader.grub.enable = true;
-  boot.loader.grub.device = "/dev/sda";
+  # boot.loader.grub.efiSupport = true;
+  # boot.loader.grub.efiInstallAsRemovable = true;
+  # boot.loader.efi.efiSysMountPoint = "/boot/efi";
+  # Define on which hard drive you want to install Grub.
+  boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only
   boot.loader.grub.extraConfig = "
     serial --speed=115200 --unit=0 --word=8 --parity=no --stop=1
     terminal_input serial
     terminal_output serial
   ";
 
-  profiles.clerie.wg-clerie = {
+  #networking.firewall.enable = false;
+
+  services.wg-clerie = {
     enable = true;
     ipv6s = [ "2a01:4f8:c0c:15f1::8108/128" ];
     ipv4s = [ "10.20.30.108/32" ];

hosts/astatine/ppp.nix

@@ -0,0 +1,90 @@
+{ pkgs, ... }:
+
+{
+  # Make space for VLAN header in containing ethernet segment
+  networking.interfaces."enp1s0".mtu = 1518;
+
+  ## DSL-Uplink
+  networking.vlans."enp1s0.7" = {
+    id = 7;
+    interface = "enp1s0";
+  };
+
+  services.pppd = {
+    enable = true;
+    peers.lns-test = {
+      config = ''
+        plugin pppoe.so enp1s0.7
+        user "criese#regiotest@bsa-vdsl"
+        ifname ppp-lns-test
+        persist
+        maxfail 0
+        holdoff 5
+        noipdefault
+        lcp-echo-interval 20
+        lcp-echo-failure 3
+        hide-password
+        nodefaultroute
+        +ipv6
+        debug
+      '';
+    };
+  };
+
+  /*
+  networking.interfaces.lo.useDHCP = true;
+  networking.interfaces.ppp-lns-test.useDHCP = true;
+
+  networking.dhcpcd = {
+    enable = true;
+    extraConfig = ''
+      interface ppp-lns-test
+        ipv6rs
+        ia_pd 0 lo/0
+    '';
+  };*/
+
+  environment.etc."ppp/ip-up" = {
+    text = ''
+      #! ${pkgs.runtimeShell} -e
+
+      ${pkgs.iproute2}/bin/ip route flush table 20001 || true
+      ${pkgs.iproute2}/bin/ip route add default dev ppp-lns-test table 20001
+    '';
+    mode = "555";
+  };
+  environment.etc."ppp/ip-down" = {
+    text = ''
+      #! ${pkgs.runtimeShell} -e
+
+      ${pkgs.iproute2}/bin/ip route flush table 20001 || true
+    '';
+    mode = "555";
+  };
+  environment.etc."ppp/ipv6-up" = {
+    text = ''
+      #! ${pkgs.runtimeShell} -e
+
+      ${pkgs.iproute2}/bin/ip -6 route flush table 20001 || true
+      ${pkgs.iproute2}/bin/ip -6 route add default dev ppp-lns-test table 20001
+    '';
+    mode = "555";
+  };
+  environment.etc."ppp/ipv6-down" = {
+    text = ''
+      #! ${pkgs.runtimeShell} -e
+
+      ${pkgs.iproute2}/bin/ip -6 route flush table 20001 || true
+    '';
+    mode = "555";
+  };
+
+  petabyte.policyrouting = {
+    enable = true;
+    rules4 = [
+      { rule = "from 212.218.16.237/32 lookup 20001"; prio = 19000; }
+      { rule = "from 212.218.16.237/32  unreachable"; prio = 19001; }
+    ];
+  };
+
+}

hosts/astatine/programs.nix

@@ -0,0 +1,9 @@
+{ pkgs, ... }:
+
+{
+
+  environment.systemPackages = with pkgs; [
+    tcpdump # for remote wireshark
+  ];
+
+}

hosts/astatine/users.nix

@@ -0,0 +1,10 @@
+{ ... }:
+
+{
+  users.users.criese-nethinks = {
+    extraGroups = [
+      "wheel"
+    ];
+  };
+
+}

hosts/backup-4/configuration.nix

@@ -4,32 +4,19 @@
   imports =
     [
       ./hardware-configuration.nix
+      ../../configuration/proxmox-vm
 
       ./backup.nix
-      ./replication.nix
       ./restic-server.nix
-      ./wg-b-palladium.nix
     ];
 
-  profiles.clerie.mercury-vm.enable = true;
-
   boot.loader.grub.enable = true;
   boot.loader.grub.device = "/dev/vda";
 
   networking.useDHCP = false;
-  systemd.network.enable = true;
-
-  systemd.network.networks."10-wan" = {
-    matchConfig.Name = "ens18";
-    address = [
-      "2001:638:904:ffcb::c/64"
-    ];
-    routes = [
-      { Gateway = "2001:638:904:ffcb::1"; }
-    ];
-    linkConfig.RequiredForOnline = "routable";
-    ipv6AcceptRAConfig.DHCPv6Client = "no";
-  };
+  networking.interfaces.ens18.ipv6.addresses = [ { address = "2001:638:904:ffcb::c"; prefixLength = 64; } ];
+  networking.defaultGateway6 = { address = "2001:638:904:ffcb::1"; interface = "ens18"; };
+  networking.nameservers = [ "2001:638:904:ffcc::3" "2001:638:904:ffcc::4" "141.24.40.3" "141.24.40.4" ];
 
   services.nginx.enable = true;
 

hosts/backup-4/replication.nix

@@ -1,20 +0,0 @@
-{ lib, ... }:
-
-with lib;
-
-{
-  clerie.backup = {
-    enable = true;
-    targets = mkForce {
-      palladium.serverUrl = "http://[fd90:37fd:ddec:d921::2]:43242";
-    };
-    jobs.replication = {
-      paths = [
-        "/mnt/backup-4/magenta"
-      ];
-      exclude = [
-        "/mnt/backup-4/magenta/.htpasswd"
-      ];
-    };
-  };
-}

hosts/backup-4/secrets.json

@@ -1,8 +1,5 @@
 {
-	"clerie-backup-job-replication": "ENC[AES256_GCM,data:BxOj/jT/GFBNSLc=,iv:zKDmEqUpOUWbU3fEeKDLniZ8D1yzs4kdGjoFLeNZOpo=,tag:iKAxHnIUpvtZwVO+eJW3Xw==,type:str]",
-	"clerie-backup-target-palladium": "ENC[AES256_GCM,data:OaszucYAp4n/ds59nF8D4Qn3U9a6L+ONcbPa+BmSz/EprW7E3kCoJ6+EceahPemTnR53mkP6zAndWaXaBTFfdg==,iv:pqi4+LuLPhtmKucm7JqN6d2hwXzNVx8IPimTL6FgHHg=,tag:+91GgLQNKD/lI7uWojCwjA==,type:str]",
-	"restic-server-magenta-htpasswd": "ENC[AES256_GCM,data:gfvmAd7z+jQwoYDJf/Hv2sR9ISJT+Hw4jrHmvW64PXjoETy+LjdsmqEPuRyq/YhrGA2rqW+YodPlkh/eE4crdTL2eNim+ij/OUubliUwBMyJuxsdGKuDUMc+txqN2x6Q24MnnU88P08SKpsm3jciMhz7JEg62W77jhesWlkzsuJDmg9oTlA9SeYOEac3pIKpekfRyE77GSFVUflwwCA+xvcEg5xyuRosFzBWGGEC3kDNB0licF0X6epz3HtlqhCLd/mkuEkftjpkNOFm9oJYzdwYv5PwVNg7G7JOgsUx9e5I29mwWPfhinX1yEFNwxKeB1FbUhYOKhRhdqWD6THVLkDzU0zP8vrm5FXTaxLHZr5+EpKit8/MJS5UBVvpSTDQ0cLExJyonWP2T+zr6rxKwU/q1jQRvsU6DJ7Bt8+9chrXBNOeyPM9xzWN1Zyyrntm9j5Ufj1YFwyrDT5ve2rOgNHA4KoS28+vsP1fcVO8XlLR24zFx5+/1BPG25qSECTPn6KkcL+yV+WS4oOnu4Oo0GVPEz+4SfyYIEVmaV61KC61pKa/6ACeUd6nABcDbReMqPXU7/bksM4sTDoFSmmiAycnxT4xavbaFdfbYIOXVQwYAIjaR1tAqQ6gYVCQ/LtKhIHCGCg10xRXNV3qkPqOUvJ7JnRcre+pQVDVLg==,iv:tvhvTPzhHoG4yG3C+o9s8yh4DafMpPb67nNxbUZcFxQ=,tag:8P5lYeP2EB5AfKgeeBISLg==,type:str]",
-	"wg-b-palladium": "ENC[AES256_GCM,data:XTenrGQFLDndt/XPaDGRLQthVq1UFKJ2mWK3Z+YfT54YpnWO81cslrMMtPc=,iv:tW8NHOcNj3Q26BJBIz7UPR3bmw3nrb0UkkD+gqngw/w=,tag:XDYkIqj6z2Jvhaoiqeyn0g==,type:str]",
+	"restic-server-magenta-htpasswd": "ENC[AES256_GCM,data:QxdmemBB/iuU+fvc2QRRkbOHO5Ef8ZJqfTdFCnlOqKog5krZ2oIpURuttH9YeggJXV2Cr+kJDGI0b9Ca6BtCkOhahfWicTeFhuODJsSyZJqzw36Ba8pX3nIpqoa7StTydK1Dx5chOi2g8oB4895SvWqDa/qP10yDtBQAYURHYfodb9/tiKzfjJAGDlqsR2h+qmdbAkvR3/oAquBO8Nb493G2sixs20XIG85moYv6l0MPnZtWEXhDT8lM5tw0PCgpSfYaUeMWnmFuzFBj3MQSo3zAjGPeOSYVFlbwbLqFWL507z0dlRgzsxMYB1F4OL38nOpO2CP2/VvbidgbQZjKCfiHMJtWLQfzZIfNEhcF8kq2uhhOwRSKN3G7u1/ezzu+9UlUVMV6PY2jjbZHJ79Knu5SJ3KqphygjjIhdHufqI03BP/aJa0QkE/mGg9is3H0myW5rG9ElA1C4stF,iv:1Ue/H48af3ECUZ5GC0hrMMBfOuCZSuX9wOSAd5XG7Fk=,tag:HchM/ZJEDG4pWQdDanC9cA==,type:str]",
 	"wg-monitoring": "ENC[AES256_GCM,data:lCuE2EgUo3ER9NNg1rD24Z4cZS+VZ4KmDojnfCsb/LyBsfyu6uOJ4IVtxOE=,iv:KHRP1pXYXk8Fi23cjUZVUUadu9yWoJ2ddxj2fMJJYE0=,tag:TiFlekXM7WLLHAPlmYbP8w==,type:str]",
 	"sops": {
 		"kms": null,
@@ -15,8 +12,8 @@
 				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpdFREUEVzb2JFd3hSaG9y\neVA2a2Fodko0OTI4ZGM0NlZxRmNtYmFDY1hVCm9ncXdWYTJlSU1FSG1WdlNBZ3VW\nM2VtRmZiWldzalRsRWJ0UkV1L1hSMkEKLS0tIGVLQU9kQXhZbC9SUW9CS2JnWGlJ\nQ3RoeXVkRXNkUWNaZ0VQOW1hcEJnNjAKHgZ48PERJlfkkh2TyCLl52zUZY674BXW\n4zPtmhZrb4xlExetINrOd4hZtL7S7qn5GnTxhoxvCddeU+JPPsfWoQ==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
-		"lastmodified": "2025-04-18T08:37:08Z",
-		"mac": "ENC[AES256_GCM,data:50NF4BI0QUhe622J6nwIF89pLlTdgxVB/MWbO5nWKgQI5xuNrnFghs5yVgZIV7FeONcu2pYykp28fSrFKhvbPt+B90i4HvaaIHdZGDepbEV9ZwK4AU66zZW4KCCPxv4NTYh+AuSi7HTHusXUrNIvRhYvAXjESi7nK7JPm3BTfUk=,iv:fvtTaSXNx6IL6D9DdEa5ovymNYeWJObCBiRiIsG7KeE=,tag:LdfXiAuMHLCb0biThHh1GQ==,type:str]",
+		"lastmodified": "2024-06-03T18:16:25Z",
+		"mac": "ENC[AES256_GCM,data:hWCI1hWTbbasov9Si0JDI39rUuBOEqrz+qxTKrNN4S/r9Ktofrk46b3rxSQF3+bC03HrbCMLk9/7XkvIFJXQj5pa9I1aG8MuMbgF0Z8Ft/uNdHPUUyLJwo/4aav4zXVpdg7zNtPdwjk66pw7iRO5XBmYgnQlnXotHM6S9s7RzuA=,iv:VJmLD1SImGtreceQP+DofnzOGp3sm12iCzbPsqzw6SI=,tag:aUryi0xUG7sd/EOmqrMQCg==,type:str]",
 		"pgp": [
 			{
 				"created_at": "2024-05-04T12:30:52Z",
@@ -25,6 +22,6 @@
 			}
 		],
 		"unencrypted_suffix": "_unencrypted",
-		"version": "3.9.4"
+		"version": "3.8.1"
 	}
 }

hosts/backup-4/wg-b-palladium.nix

@@ -1,40 +0,0 @@
-{ config, ... }:
-
-{
-
-  sops = {
-    secrets.wg-b-palladium = {
-      owner = "systemd-network";
-      group = "systemd-network";
-    };
-  };
-
-  systemd.network.netdevs."10-wg-b-palladium" = {
-    netdevConfig = {
-      Kind = "wireguard";
-      Name = "wg-b-palladium";
-    };
-    wireguardConfig = {
-      PrivateKeyFile = config.sops.secrets.wg-b-palladium.path;
-      ListenPort = 51844;
-    };
-    wireguardPeers = [
-      {
-        PublicKey = "YMTOhRAKWfFX1UVBoROPvgcQxTSN4tny35brAocdnwo=";
-        AllowedIPs = [ "fd90:37fd:ddec:d921::/64" ];
-        PersistentKeepalive = 25;
-      }
-    ];
-  };
-
-  systemd.network.networks."10-wg-b-palladium" = {
-    matchConfig.Name = "wg-b-palladium";
-    address = [
-      "fd90:37fd:ddec:d921::1/64"
-    ];
-    linkConfig.RequiredForOnline = "no";
-  };
-
-  networking.firewall.allowedUDPPorts = [ 51844 ];
-
-}

hosts/beryllium/configuration.nix

@@ -6,8 +6,6 @@
       ./hardware-configuration.nix
     ];
 
-  profiles.clerie.network-fallback-dhcp.enable = true;
-
   boot.kernelParams = [ "console=ttyS0,115200n8" ];
 
   boot.loader.grub.enable = true;
@@ -22,11 +20,39 @@
 
   networking.firewall.enable = false;
 
-  profiles.clerie.wg-clerie = {
+  networking.iproute2.enable = true;
+  networking.iproute2.rttablesExtraConfig = ''
+    200 wg-clerie
+  '';
+
+  petabyte.policyrouting = {
     enable = true;
-    ipv6s = [ "2a01:4f8:c0c:15f1::8107/128" ];
-    ipv4s = [ "10.20.30.107/32" ];
-    privateKeyFile = "/var/src/secrets/wireguard/wg-clerie";
+    rules6 = [
+      { rule = "from 2a01:4f8:c0c:15f1::8107/128 lookup wg-clerie"; prio = 20000; }
+      { rule = "from 2a01:4f8:c0c:15f1::8107/128 unreachable"; prio = 20001; }
+    ];
+    rules4 = [
+      { rule = "from 10.20.30.107/32 lookup wg-clerie"; prio = 20000; }
+      { rule = "from 10.20.30.107/32 unreachable"; prio = 20001; }
+    ];
+  };
+
+
+  networking.wireguard.enable = true;
+  networking.wireguard.interfaces = {
+    wg-clerie = {
+      ips = [ "2a01:4f8:c0c:15f1::8107/128" "10.20.30.107/32" ];
+      table = "wg-clerie";
+      peers = [
+        {
+          endpoint = "vpn.clerie.de:51820";
+          persistentKeepalive = 25;
+          allowedIPs = [ "0.0.0.0/0" "::/0" "10.20.30.0/24" "2a01:4f8:c0c:15f1::/113" ];
+          publicKey = "2p1Jqs3bkXbXHFWE6vp1yxHIFoUaZQEARS2nJzbkuBA=";
+        }
+      ];
+      privateKeyFile = "/var/src/secrets/wireguard/wg-clerie";
+    };
   };
 
   clerie.monitoring = {

hosts/carbon/configuration.nix

@@ -4,6 +4,7 @@
   imports =
     [
       ./hardware-configuration.nix
+      ../../configuration/router
 
       ./dns.nix
       ./mdns.nix
@@ -13,17 +14,12 @@
       ./net-iot.nix
       ./net-lte.nix
       ./net-mgmt.nix
-      ./net-printer.nix
       ./net-voip.nix
       ./ntp.nix
       ./ppp.nix
-      ./scan-to-gpg.nix
       ./wg-clerie.nix
     ];
 
-  profiles.clerie.common-networking.enable = false;
-  profiles.clerie.router.enable = true;
-
   boot.kernelParams = [ "console=ttyS0,115200n8" ];
 
   boot.loader.grub.enable = true;
@@ -63,10 +59,10 @@
 
   systemd.services.kea-dhcp4-server = {
     after = [
-      "network.target"
+      "network-setup.service"
     ];
-    wants = [
-      "network.target"
+    requires = [
+      "network-setup.service"
     ];
   };
 

hosts/carbon/net-printer.nix

@@ -1,51 +0,0 @@
-{ ... }:
-
-{
-  networking.vlans."enp1s0.206" = {
-    id = 206;
-    interface = "enp1s0";
-  };
-  networking.bridges."net-printer".interfaces = [
-    "enp1s0.206"
-  ];
-  networking.interfaces."net-printer".ipv4.addresses = [
-    { address = "10.152.206.1"; prefixLength = 24; }
-  ];
-
-  services.kea.dhcp4 = {
-    settings = {
-      interfaces-config = {
-        interfaces = [ "net-printer" ];
-      };
-      subnet4 = [
-        {
-          id = 206;
-          subnet = "10.152.206.0/24";
-          pools = [
-            {
-              pool = "10.152.206.100 - 10.152.206.240";
-            }
-          ];
-          option-data = [
-            {
-              name = "routers";
-              data = "10.152.206.1";
-            }
-          ];
-        }
-      ];
-    };
-  };
-
-  # Enable scan-to-gpg
-  networking.firewall.interfaces."net-printer".allowedTCPPorts = [ 2121 ];
-  networking.firewall.interfaces."net-printer".allowedTCPPortRanges = [ { from = 2130; to = 2134; } ];
-
-  clerie.firewall.extraForwardFilterCommands = ''
-    # Allow access from Heimnetz to printer
-    ip46tables -A forward-filter -i net-heimnetz -o net-printer -j ACCEPT
-    ip46tables -A forward-filter -i net-printer -j DROP
-    ip46tables -A forward-filter -o net-printer -j DROP
-  '';
-
-}

hosts/carbon/ppp.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, lib, ... }:
+{ config, pkgs, utils, ... }:
 
 {
 
@@ -44,15 +44,12 @@
       cat ${config.sops.secrets.pppd-dtagdsl-secrets.path} > /etc/ppp/chap-secrets
     '';
 
-    preStartFile = pkgs.writeShellApplication {
-      name = "pppd-dtagdsl-pre-start";
-      text = preStart;
-    };
+    preStartFile = utils.systemdUtils.lib.makeJobScript "pppd-dtagdsl-pre-start" preStart;
   in {
     EnvironmentFile = config.sops.secrets.pppd-dtagdsl-username.path;
     ExecStartPre = [
       # "+" marks script to be executed without priviledge restrictions
-      "+${lib.getExe preStartFile}"
+      "+${preStartFile}"
     ];
   };
 

hosts/carbon/scan-to-gpg.nix

@@ -1,11 +0,0 @@
-{ pkgs, ... }:
-
-{
-
-  services.scan-to-gpg = {
-    enable = true;
-    gpgkey = "${pkgs.clerie-keys}/gpg/clerie@clerie.de.asc";
-  };
-
-  users.users."clerie".extraGroups = [ "scan-to-gpg" ];
-}

hosts/clerie-backup/configuration.nix

@@ -4,26 +4,20 @@
   imports =
     [
       ./hardware-configuration.nix
+      ../../configuration/proxmox-vm
 
       ./restic-server.nix
     ];
 
-  profiles.clerie.ruby-vm.enable = true;
-
   boot.loader.grub.enable = true;
   boot.loader.grub.device = "/dev/vda";
 
-  systemd.network.networks."10-wan" = {
-    matchConfig.Name = "ens18";
-    address = [
-      "2a00:fe0:1:21f::a/64"
-    ];
-    routes = [
-      { Gateway ="2a00:fe0:1:21f::1"; }
-    ];
-    linkConfig.RequiredForOnline = "routable";
-    ipv6AcceptRAConfig.DHCPv6Client = "no";
-  };
+  boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
+
+  networking.useDHCP = false;
+  networking.interfaces.ens18.ipv6.addresses = [ { address = "2001:638:904:ffc1::6"; prefixLength = 64; } ];
+  networking.defaultGateway6 = { address = "2001:638:904:ffc1::1"; interface = "ens18"; };
+  networking.nameservers = [ "2001:638:904:ffcc::3" "2001:638:904:ffcc::4" "141.24.40.3" "141.24.40.4" ];
 
   services.nginx.enable = true;
 
@@ -34,6 +28,10 @@
       authorizedKeys = [ "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCiUWufpvAj/Rdxt/frAjs5Q4+/lzaN2jmf5+W3Gazjzw+CH+Agplux6op+LlzF7kAA32yP+lwQto8Rz92NzReDssXd+0JhgAAHrSMrPOPnQbZrierKOfVvDOteklEM4k5JXqZ+xHIMtNomuMV3wCFc18nvwc8t95pDBOI/HwzAwn2mGhVBod0CNXZs8EyMeQJNKLCRwpUrddOX6fz5x/fbPYO4KB3iPkC0X+e/d5SuBvrmwFdnpr2RkCboMPdd6i/0AsY4MLdMV54arS9Ed2jaFKqYCQR5wRdLxndn+aByyVQHQxVU0gVfO9+53NOgiVzhOFzXm6K2KcC/HZR5uj1r ceea@olbers.uberspace.de" ];
       path = "/mnt/clerie-backup/uberspace-ceea";
     };
+    uberspace-cleriewi = {
+      authorizedKeys = [ "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDAeU+YezmGNNnntAkOL143NlkADi6ekEcaW9yf9yegdkDxwyIyxaWC89B110kRkNe+6KP+LDwrp9vnFJZjst8Gv+dMs0h9U0IdUafhO7TcbbkqynqmtzIwiSGsLby2K9XOYTMlAa2JOfeNScPWccZ8KgXsIBqRGjo3yQfCHXZu9U/8CGXvYPsTGY5QYNeAw5Uaikuf565GHy4ROx2BN7LGug9lK42Hfv8i1lhCLi7wkhQ0EPGBRPkscjz/0Kb2iABMzyUf6uMrDJX/usKrChxkLfidIM9C5YR1E+wXlmy9lijuNP85NpXUEyVTAp9/XLCp1vskfCjsBLO0l+40XNIt cleriewi@biela.uberspace.de" ];
+      path = "/mnt/clerie-backup/uberspace-cleriewi";
+    };
   };
 
   # fix borgbackup primary grouping
@@ -53,6 +51,62 @@
       compression = "auto,lzma";
       startAt = "*-*-* 04:07:00";
     };
+    backup-replication-palladium = {
+      paths = [
+        "/mnt/clerie-backup"
+      ];
+      doInit = true;
+      repo =  "borg@palladium.net.clerie.de:." ;
+      encryption = {
+        mode = "none";
+      };
+      environment = { BORG_RSH = "ssh -i /var/src/secrets/ssh/borg-backup-replication-palladium"; };
+      compression = "auto,lzma";
+      startAt = "*-*-* 06:23:00";
+    };
+    backup-replication-external-drive = {
+      paths = [
+        "/mnt/clerie-backup"
+      ];
+      doInit = true;
+      repo =  "borg@palladium.net.clerie.de:." ;
+      encryption = {
+        mode = "none";
+      };
+      environment = {
+        BORG_RSH = "ssh -i /var/src/secrets/ssh/borg-backup-replication-external-drive";
+        BORG_UNKNOWN_UNENCRYPTED_REPO_ACCESS_IS_OK = "yes";
+        BORG_RELOCATED_REPO_ACCESS_IS_OK = "yes";
+      };
+      compression = "auto,lzma";
+      startAt = "*-*-* 08:37:00";
+    };
+  };
+
+  users.users.backup-replication = {
+    isNormalUser = true;
+    group = "backup-replication";
+    openssh.authorizedKeys.keys = [
+      "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC8kCLiDfVFKgoNvEoMb34jp2n1lQG+k7wigzc4qGmrROlWkJ46/Ym4UrSeQJAd6hwHTcKTZkeOrqDAjZZ+jlidpncJHT5VMW5Ah965pxbBq6Qh1Yz5tKj7nLAQ/+bwEH4qqBFNd796876n3pY/FqhwAHWONqWhLKzMXpFursMSITUPmRXcaPwJrgS9DIYspZ9bBhhRSdQ5N1SiGtaszOQwdevLnNYqdtFOBG4rt9SO6IBIHtaiTIHrrMGS2Lt3NMwkq+O+N+TGaKLjbwqtfUPfPOCmY0XH12OawjxHP9hZ+WH3dPtcu5p+VORciSybPvyh9qzXUrDeO4HDuii2GEFU8JFELYXdT/qBwdIMp82tkgww0zKbTJuc0y/9eR7LCXop4OALhR8+8xWDI9c1ccxu3T7S7zUI1OmTlR9i8rx85D4sz2dtp1jirDoW2KVuIdwe6G3NLfTL95FZRmveEQM3MO8MPpfzZ4EvaMbiQQd/c4VAmGovtSLQhySTpT6qSv0= root@backup-4"
+      #"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDRANmJ2LYUr0Mavz/JJ7j+7p1zkqvizf6ZLt5XOJ2fj0enDuK7Dc5fxiESLGYTsLRVWuY4hNXVIL7aeJUj1LPf6LEX87APP4hb95t+TFxcES87tFfnFO48eiBbSd25Av2jmHGb6/wY2viYBxfk/vrLjPR6RgICqFsWFcz20bsWmc48FdzXYJCGJfKjHiW+Ut95VL+M/AlGBQHo33FNDyPXV4zh+MeWVkOFicwfh0k+4NH7Psj5n93m9szAlz306t5YZ32HnhSlvObkMk1Ugy6AzPKXrgKBu11pmatf7sFRx1ikYGUiKiezGjatt/8lYZfE8rQKQjwH+6LPt3ZPv06ncfKpH2vbZfonM0KhSsm1OIhJTse+X7ZMxizO6QqYM+BRJJGMbhH1g+6kFRsdlwakHNPE9YvG4NxZ1NxWTUr6F0gPhUEy61LkTnznt3ct1hgQR02KDQ+9i8PvaYeIIzZzRKufv4tV7OZkDLbN97tvAMkgpLjF+8fCg3qjn2Lckzc= root@palladium"
+    ];
+  };
+
+  users.groups.backup-replication = {};
+
+  environment.systemPackages = with pkgs; [
+    bindfs
+  ];
+
+  fileSystems."/clerie-backup-replication" = {
+    device = "/mnt/clerie-backup";
+    fsType = "fuse.bindfs";
+    options = [
+      "ro"
+      "force-user=backup-replication"
+      "force-group=backup-replication"
+      "perms=0000:ug=rD"
+    ];
   };
 
   clerie.monitoring = {

hosts/clerie-backup/hardware-configuration.nix

@@ -8,7 +8,7 @@
     [ (modulesPath + "/profiles/qemu-guest.nix")
     ];
 
-  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" "virtio_blk" ];
+  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "sr_mod" "virtio_blk" ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ "kvm-intel" ];
   boot.extraModulePackages = [ ];
@@ -19,7 +19,7 @@
     };
 
   fileSystems."/mnt/clerie-backup" =
-    { device = "/dev/disk/by-uuid/15a42e2e-57dc-43ff-a50d-8b73952d4558";
+    { device = "/dev/disk/by-uuid/69e75b00-23e1-4775-98a6-061a79d806cf";
       fsType = "ext4";
     };
 
@@ -33,7 +33,4 @@
   # networking.interfaces.ens18.useDHCP = lib.mkDefault true;
 
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-  boot.swraid.enable = true;
-
-
 }

hosts/clerie-backup/secrets.json

@@ -1,5 +1,5 @@
 {
-	"restic-server-cyan-htpasswd": "ENC[AES256_GCM,data:Fe6lcXXy0Hu27Y2LtwQRbk+78+unSGkII144jtstOgK0pyjlJqG2mo8ZG7L+3mmthuu+leZ6XXadEcRGpby3eCwyVEYd3lDr930pPC8hChWYMC5mGkkRUAobYED63iVxcsc36PVFQYMCDbYvtcPk8uQTXfQmhs9kSzCrONrL1Id0L9D+sGoU0snpE+eCNXyiLwuyc1qocchhuHIwkGi4dyVJWgMsKGummF5Pf9zK4KzHmT6RuPouEUAfwHkdPwtOSJ8OqZof/C/CuPYmJQyfOFAqtw8xD9OXUpvyxjC1Kta89sL5cRAE0R15oPvNUmYGaXputm9iMycPjMacpouycx1TXMTEDB0caryX9uEFAyTfPm7keHT86qA1UfImWqEE9QqJ3uCeiwW698SbTZVeKLDBqDCPP+nP/L+N412d+HHyGugPOnTj1gXY50xeOay8Wryw87iDZ9rnJxcn0u5D4+JjOIbjWvydqBXacMD/o0NG2CcQu6LVRAHRiDKoSQWEwx25tzVwn2dsgFV8c3oQ0xQI7050R11Z3M9QWOvPmOZCvYV5VSoxu7r1jMu5asrcPbbhXKatbrabEHCAbDGsBpDkqts3BVUfUaHwboXVR0DxqOC6CHVE34J99SVTGI0kIHXyNqpeUJ36tCXFg7eNPNsu8cra9whjyUUHtw==,iv:Gfg3t3YPw2hz0LJ5hovPftMYOADN2Xjc93VmT2fFVQI=,tag:k6KH4qDPrFYIU2PGgW3F9Q==,type:str]",
+	"restic-server-cyan-htpasswd": "ENC[AES256_GCM,data:ZKrEv/bU1X+iO7GLlxsM8HhUy6B2+EXRA8JO2X8E8X5nt8Ydwa+wAqTea3hGyW/QNFrNg/nnAFaVg+VNa6UEqOuF0eg4Nf0LOYTtTpNt4uqDHomfFpvFxDfVCbk4a3fnjnJzk51XnZqeVlvuH2JKg9uD6QzTghTuZfysdGePZdD4WRfY+qHsZg2jREgA26WKsRnD1zU4ZnbRAA1s0Lzf5gG4kFciIzovt0x5MYEiVERFeM+HG1a117EvSlsijPNJVLTaFRLTVOlTOYLKXt4KcRJq9KwoZR/LgEz++rUE4DN5f7iQs+Sb9epH9sV/V06R6AKE5ZFcyi5Y+ipt8B4sWX8PQUeFxNlpljXHro8szGNnLnSxxieg10SEwfIEw+nTGVMHToUpvybzdoI4VPUHZGF+kpqv8ejEzhrKZXyPrd7ZCWGDsTdl8gGSefimpEUR8IwuPqImgu2UU8gT,iv:Y/G/odtZ4enBtNc2Wj7bZjsJ3nur5huYAqlu1PgnWlo=,tag:tg3ut7R2jJd+TVvYHIiTdA==,type:str]",
 	"wg-monitoring": "ENC[AES256_GCM,data:rOpBlDt9K//zlgWo1Bw9IX5jmpLbnit5zi60Ulz8f6tHwqVsKJv5NkxYc9A=,iv:Jlo0QZP6R1CEE20iLa7M/LV/ZX2/33oMv/FzBBo6nvY=,tag:Ttqo7BKd6RuUiMksW6rZnw==,type:str]",
 	"sops": {
 		"kms": null,
@@ -12,8 +12,8 @@
 				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0UCtUZ3NZQWxOK1FUNDhL\nbWhaanN2OEJIVmpMOURzWU1vcGhuODdtcDJnCm9Nb01NaVVpWDJ6Q3JCbXRkRUJP\nUVdFaGVScUdxRnlpSnRNOG1RalNRaFUKLS0tICs0cW1WR0JMUmdaVWVzdTh2bjFm\nenBzaERpb1hCS1E3TUo3cmxpZFUxWmcKcLL5/YTGyZEVLwHSpbEI5XfWGklkI7h+\n0uhCww8Wh23EpUYFslZ0Nnbf5HX5/Z34qBwf20cvN8eLToTAQvTdeg==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
-		"lastmodified": "2025-02-16T18:13:34Z",
-		"mac": "ENC[AES256_GCM,data:io2WVxTxHSlxrk7JaN6/fUI7YotvPfgbXTD1lEf1tN7QhuGRH/iZrji/VQlhJ8tk2dAS1Pe0rsTuxCMXcXcxRIh4EYbQky5IZj5jpfPcslQOquTcXzmPYdijPUWSqu6leGc0GG/7KccjSFD8TfwAgeuVrc2Br57yfqKoPf+M0fY=,iv:iYp73PrFnLZoI9014mbqQQERhFtfhb5YmzV6HiUi+YM=,tag:2AZEzhVVdEos5FLkg8cr5w==,type:str]",
+		"lastmodified": "2024-06-03T18:16:18Z",
+		"mac": "ENC[AES256_GCM,data:kWeyNv82yc6H+FJjhTh8vkuxjZ4YFEqmZbqzZr+pEXxXeMUEGi9hr7cauGDNxnRMgWJz9KG1M4tzUyEK8rfVQWLc+Wcf/5Pjsxn1Zg0yJiJAxVFV7AcvGdKUeQuBKgOT5L+Z5+cFdvq9+CU/0M+6/e8jB6OdQWcuy0emBaCut4U=,iv:3w5arXHKapwwo7kgLtHcKfO+dhH22opVP+fjagize0c=,tag:+cCaX2FUG+5UYqutE9IsAA==,type:str]",
 		"pgp": [
 			{
 				"created_at": "2024-05-05T12:12:27Z",

hosts/dn42-il-gw1/configuration.nix

@@ -4,43 +4,49 @@
   imports =
     [
       ./hardware-configuration.nix
+      ../../configuration/proxmox-vm
+      ../../configuration/dn42
     ];
 
-  profiles.clerie.mercury-vm.enable = true;
-
   boot.loader.grub.enable = true;
   boot.loader.grub.device = "/dev/vda";
 
-  systemd.network.networks."10-wan" = {
-    matchConfig.Name = "ens20";
-    address = [
-      "2001:638:904:ffc9::7/64"
-    ];
-    routes = [
-      { Gateway = "2001:638:904:ffc9::1"; }
-    ];
-    linkConfig.RequiredForOnline = "routable";
-    ipv6AcceptRAConfig.DHCPv6Client = "no";
-  };
-  systemd.network.networks."10-nat-netz-mercury" = {
-    matchConfig.Name = "ens18";
-    address = [
-      "192.168.10.23/24"
-    ];
-    routes = [
-      { Gateway = "192.168.10.1"; }
-    ];
-    linkConfig.RequiredForOnline = "routable";
-    ipv6AcceptRAConfig.DHCPv6Client = "no";
-  };
-  systemd.network.networks."10-dn42-ospf-netz" = {
-    matchConfig.Name = "ens19";
-    linkConfig.RequiredForOnline = "no";
-    ipv6AcceptRAConfig.DHCPv6Client = "no";
-  };
+  networking.useDHCP = false;
+  networking.interfaces.lo.ipv6.addresses = [ { address = "fd56:4902:eca0:1::1"; prefixLength = 64; } ];
+  # VM Nat Netz mercury
+  networking.interfaces.ens18.ipv4.addresses = [ { address = "192.168.10.23"; prefixLength = 24; } ];
+  # OSPF Netz
+  networking.interfaces.ens19 = {};
+  # IPv6 Uplink
+  networking.interfaces.ens20.ipv6.addresses = [ { address = "2001:638:904:ffc9::7"; prefixLength = 64; } ];
+
+  networking.defaultGateway = { address = "192.168.10.1"; interface = "ens18"; };
+  networking.defaultGateway6 = { address = "2001:638:904:ffc9::1"; interface = "ens20"; };
+  networking.nameservers = [ "2001:638:904:ffcc::3" "2001:638:904:ffcc::4" "141.24.40.3" "141.24.40.4" ];
 
   networking.wireguard.enable = true;
   networking.wireguard.interfaces = {
+    # n0emis
+    wg0197 = {
+      ips = [
+        "fe80::42:1/128"
+        # peer fe80::42:42:1/128
+      ];
+      postSetup = ''
+      ip -6 route flush dev wg0197
+      ip addr del dev wg0197 fe80::42:1/128 && ip addr add dev wg0197 fe80::42:1/128 peer fe80::42:42:1/128
+      '';
+      listenPort = 50197;
+      allowedIPsAsRoutes = false;
+      peers = [
+        {
+          allowedIPs = [ "fe80::/10" "fd00::/8" ];
+          endpoint = "himalia.dn42.n0emis.eu:52574";
+          publicKey = "ObF+xGC6DdddJer0IUw6nzC0RqzeKWwEiQU0ieowzhg=";
+        }
+      ];
+      privateKeyFile = config.sops.secrets.wg0197.path;
+    };
     # e1mo
     wg0565 = {
       ips = [
@@ -120,6 +126,27 @@
       ];
       privateKeyFile = config.sops.secrets.wg1280.path;
     };
+    # perflyst
+    wg1302 = {
+      ips = [
+        "fe80::a14e/128"
+        # peer fe80::a14d/128
+      ];
+      postSetup = ''
+      ip -6 route flush dev wg1302
+      ip addr del dev wg1302 fe80::a14e/128 && ip addr add dev wg1302 fe80::a14e/128 peer fe80::a14d/128
+      '';
+      listenPort = 51302;
+      allowedIPsAsRoutes = false;
+      peers = [
+        {
+          allowedIPs = [ "fe80::/10" "fd00::/8" ];
+          endpoint = "[2a03:4000:6:f6ed::1]:22574";
+          publicKey = "TSPvvpMY8dCFk6gd58aYtkibtqUn8EzIF6dXP52b3y8=";
+        }
+      ];
+      privateKeyFile = config.sops.secrets.wg1302.path;
+    };
     # lutoma
     wg4719 = {
       ips = [
@@ -140,104 +167,167 @@
       ];
       privateKeyFile = config.sops.secrets.wg4719.path;
     };
-    # zaphyra
-    wg1718 = {
-      ips = [
-        "fe80::2574/128"
-        # peer fe80::6b61/64
-      ];
-      postSetup = ''
-      ip addr replace dev wg1718 fe80::2574/128 peer fe80::6b61/128
-      '';
-      listenPort = 51718;
-      allowedIPsAsRoutes = false;
-      peers = [
-        {
-          allowedIPs = [ "fe80::/10" "fd00::/8" ];
-          endpoint = "router-a.dn42.zaphyra.eu:51831";
-          publicKey = "Knm6uEpMsTfZAK68Pl98mHORtb8TtswBfYFGznpHUCI=";
-        }
-      ];
-      privateKeyFile = config.sops.secrets.wg1718.path;
-    };
   };
 
-  networking.firewall.allowedUDPPorts = [
-    50565 # wg0565
-    51271 # wg1271
-    51272 # wg1272
-    51280 # wg1280
-    54719 # wg4719
-    51718 # wg1718
-  ];
-
-  profiles.clerie.dn42-router = {
+  petabyte.policyrouting = {
     enable = true;
-    loopbackIp = "fd56:4902:eca0:1::1";
-    routerId = "192.168.10.23";
-
-    ospfInterfaces = [
-      "ens19"
-    ];
-
-    ibgpPeers = [
-      {
-        peerName = "gw5";
-        remoteAddress = "fd56:4902:eca0:5::1";
-      }
-      {
-        peerName = "gw6";
-        remoteAddress = "fd56:4902:eca0:6::1";
-      }
-    ];
-
-    wireguardPeers = [
-      {
-        peerName = "peer_0565";
-        remoteAddress = "fe80::565";
-        interfaceName = "wg0565";
-        remoteAsn = "4242420565";
-        localAddress = "fe80::2574";
-      }
-      {
-        peerName = "peer_1271_north";
-        remoteAddress = "fe80::2";
-        interfaceName = "wg1271";
-        remoteAsn = "4242421271";
-        localAddress = "fe80::1";
-      }
-      {
-        peerName = "peer_1271_south";
-        remoteAddress = "fe80::1:2";
-        interfaceName = "wg1272";
-        remoteAsn = "4242421271";
-        localAddress = "fe80::1:1";
-      }
-      {
-        peerName = "peer_1280_wg1";
-        remoteAddress = "fde3:4c0d:2836:ff00::20";
-        interfaceName = "wg1280";
-        remoteAsn = "4242421280";
-        localAddress = "fde3:4c0d:2836:ff00::21";
-      }
-      {
-        peerName = "peer_4719";
-        remoteAddress = "fe80::acab";
-        interfaceName = "wg4719";
-        remoteAsn = "64719";
-        localAddress = "fe80::1";
-      }
-      {
-        peerName = "peer_1718";
-        remoteAddress = "fe80::6b61";
-        interfaceName = "wg1718";
-        remoteAsn = "4242421718";
-        localAddress = "fe80::2574";
-      }
+    rules6 = [
+      { rule = "from all to fd56:4902:eca0::/48 lookup 1337"; prio = 10000; }
+      { rule = "from all to all lookup 2342"; prio = 10000; }
+      { rule = "from all to fd56:4902:eca0::/48 unreachable"; prio = 20000; }
+      { rule = "from fd56:4902:eca0::/48 to all unreachable"; prio = 20000; }
     ];
   };
 
-  services.bijwerken = {
+  services.bird2.enable = true;
+  services.bird2.config = ''
+  router id ${ (lib.head config.networking.interfaces.ens18.ipv4.addresses).address };
+
+  ipv6 table ospf6;
+  ipv6 table bgp6;
+
+  protocol direct {
+          interface "lo";
+          ipv6 {
+                  table ospf6;
+          };
+  }
+
+  protocol static {
+          ipv6 {
+                  table bgp6;
+          };
+          route fd56:4902:eca0::/48 via "lo";
+          route fd56:4902:eca0::/52 via "lo";
+  }
+
+  protocol kernel {
+          ipv6 {
+                  table ospf6;
+                  export filter {
+                          krt_prefsrc=fd56:4902:eca0:1::1;
+                          accept;
+                  };
+                  import none;
+          };
+          kernel table 1337;
+  }
+
+  protocol kernel {
+          ipv6 {
+                  table bgp6;
+                  export filter {
+                          krt_prefsrc=fd56:4902:eca0:1::1;
+                          accept;
+                  };
+                  import none;
+          };
+          kernel table 2342;
+  }
+
+  protocol ospf v3 {
+          ipv6 {
+                  table ospf6;
+                  import all;
+                  export all;
+          };
+          area 0 {
+                  interface "ens19" {
+                          cost 80;
+                          type broadcast;
+                  };
+          };
+  }
+
+  protocol bgp gw5 {
+          local as 4242422574;
+          graceful restart on;
+          neighbor fd56:4902:eca0:5::1 as 4242422574;
+          source address fd56:4902:eca0:1::1;
+          ipv6 {
+                  table bgp6;
+                  igp table ospf6;
+                  next hop self;
+                  import keep filtered;
+                  import all;
+                  export all;
+          };
+  }
+
+  protocol bgp gw6 {
+          local as 4242422574;
+          graceful restart on;
+          neighbor fd56:4902:eca0:6::1 as 4242422574;
+          source address fd56:4902:eca0:1::1;
+          ipv6 {
+                  table bgp6;
+                  igp table ospf6;
+                  next hop self;
+                  import keep filtered;
+                  import all;
+                  export all;
+          };
+  }
+
+  template bgp bgp_peer {
+  	local as 4242422574;
+  	graceful restart on;
+  	ipv6 {
+  		table bgp6;
+  		next hop self;
+  		import keep filtered;
+  		import filter {
+  			if net ~ [fd00::/8{48,64}] then accept;
+  			reject;
+  		};
+  		export filter {
+  			if net ~ [fd00::/8{48,64}] then accept;
+  			reject;
+  		};
+  	};
+  }
+
+  protocol bgp peer_0197_himalia from bgp_peer {
+          neighbor fe80::42:42:1%wg0197 as 4242420197;
+          source address fe80::42:1;
+  }
+
+  protocol bgp peer_0565 from bgp_peer {
+	neighbor fe80::565%wg0565 as 4242420565;
+	source address fe80::2574;
+  }
+
+  protocol bgp peer_1271_north from bgp_peer {
+  	neighbor fe80::2%wg1271 as 4242421271;
+  	source address fe80::1;
+  }
+
+  protocol bgp peer_1271_south from bgp_peer {
+  	neighbor fe80::1:2%wg1272 as 4242421271;
+  	source address fe80::1:1;
+  }
+
+  protocol bgp peer_1280_wg1 from bgp_peer {
+  	neighbor fde3:4c0d:2836:ff00::20%wg1280 as 4242421280;
+  	source address fde3:4c0d:2836:ff00::21;
+  }
+
+  protocol bgp peer_1302 from bgp_peer {
+  	neighbor fe80::a14d%wg1302 as 4242421302;
+  	source address fe80::a14e;
+  }
+
+  protocol bgp peer_4719 from bgp_peer {
+    neighbor fe80::acab%wg4719 as 64719;
+  }
+
+  protocol device {
+          scan time 10;
+  }
+  '';
+
+  clerie.system-auto-upgrade = {
+    allowReboot = true;
     autoUpgrade = true;
   };
 

hosts/dn42-il-gw1/secrets.json

@@ -5,18 +5,21 @@
 	"wg1272": "ENC[AES256_GCM,data:LU6jtNkNn2Xs+0OH8cD1HJnbHsNNnqlY83lDFa11/dHwVgdFxMtDXMqIMEc=,iv:/A8rWGR6jExa4ms7jTYC0eZVGCvlKw1I58Co41gw3TU=,tag:tIBRkQzFFpEEzflnDrpcOA==,type:str]",
 	"wg1280": "ENC[AES256_GCM,data:F4KLY6jiZNl52ko32nM0iTER0DyHvaCSmxeYAKB0MLUD8l9u1Ugk6kYZnUc=,iv:XcaxnvxM1kE/ahNFX+BH7Jmr9q2Py1vHHqOjFUqs5O8=,tag:a1up4gGFqyHz2lmDRJl3bA==,type:str]",
 	"wg1302": "ENC[AES256_GCM,data:+MzuBPg3ql0/MEnpVvhQTsPIkKB9xnHN9Fk4VlZwK4ijKl+26d6oTSM7/R0=,iv:bPPmhenQLaKTGaDo4rBlKkrXrS1YysRuntbKq6zi2aQ=,tag:lztaTfDGT4kAq+HZMLl0Dw==,type:str]",
-	"wg1718": "ENC[AES256_GCM,data:lB+j2O15O7ogdB+QdutD3V/h8IREMMlpCsnMJWNPXlz196KM6WNNYCV2v5M=,iv:AwrRPQIFu8A14Vs5A9slkCPMkgU3VZxL1YupJnriEHc=,tag:Vpt0C6SFzUXGotdfc1ocmg==,type:str]",
 	"wg4719": "ENC[AES256_GCM,data:hoOOCUGdYFaAQZ6wkgmQl65M1qArvXa826IeJl+BUGf7UX0vxx9J0C2epTE=,iv:+1JcOgzClehkE0Ihd2mmoenPk51OBZMF0bMqapWah/c=,tag:xI5FU+GJU6BER9/n04ccLA==,type:str]",
 	"wg-monitoring": "ENC[AES256_GCM,data:aw11Ygfll6llabXkuxtbTcCn1eb4NZX1IwArcXoRJCJSgwDrQZ3HLatov3w=,iv:J2VD5XS+BrIKeFb0NW1UYZUuGPkbjFmooZ93PVK31gw=,tag:2XLSa/2s6LRq3L7UdrTs/g==,type:str]",
 	"sops": {
+		"kms": null,
+		"gcp_kms": null,
+		"azure_kv": null,
+		"hc_vault": null,
 		"age": [
 			{
 				"recipient": "age1f0hscql4f4w7vyukzeu693xfedsl596dpjekc23q77ylp92zsvcqf9u75t",
 				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3QWdFYjFjTmRVRlV3U3p4\nTSsyc1E0dWtiYjNtVkV2SXJEWkxnTDhLN1Y0Cng4aGlidjhydUVGaFcvK215aGdq\nN0FGajYwa1lPUCsva0tmNkErUGtlOWsKLS0tIG9pLzJEUDA2WWUzd1kzSVZrdVRX\nbUxjQzBCd3p0R1dWTTJaRmZNQjJEUVkKPz6OUQHpYrhRxMdQzpZRR3exVqkG2JvX\nI32PwvbeQK8cgpYwKLGar8U8aiPPm0Y64pID1wedDsNZzLqLOrS3wQ==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
-		"lastmodified": "2025-06-10T20:51:10Z",
-		"mac": "ENC[AES256_GCM,data:9lF4HV0oJyGHXdtYdMxR7+ev7JLAQVr6kE55nLoZcrbC92MHJzQpgM9XAhIynvwdAmC7ARd3orCn6eYkQJDdNX0JjMtebsBE+H4B7mEUCz8wtTN0iHS+oHmQxrqjnoSw2uHh9udgqAJa+sd6VGU3t2XUuuKtVHPwzROqVgvas9M=,iv:KT+BlFeXGZQc5pbBX+XOsmKEydUtir1LuPvseDkFeqw=,tag:hlRskY6b5EAZkUYs7ph/JA==,type:str]",
+		"lastmodified": "2024-04-28T09:28:04Z",
+		"mac": "ENC[AES256_GCM,data:PHdhyie0Ya/nN9Kqj4z+zPyyKZFvGkznkv8Uf3LNSdPKWVtXARZc8Xodm4MjI2HvooryyyMFHkW75Aln02Rlvk3R8oI7rfFZC7s2P+LotumsYgRFf0JOUMxsxOtKW0ehuLy83Bw0rMJQo1gzTgBykcvdc2pkMmALF/vU/1VqgJ4=,iv:0JwcY0Q+8VAiVHYjynhcpsobQXOkK8EBe3QUJ8YUwFE=,tag:9xAcoxAPGxTvHVBydf3u9Q==,type:str]",
 		"pgp": [
 			{
 				"created_at": "2024-04-28T09:25:37Z",
@@ -25,6 +28,6 @@
 			}
 		],
 		"unencrypted_suffix": "_unencrypted",
-		"version": "3.10.2"
+		"version": "3.8.1"
 	}
-}
+}

hosts/dn42-il-gw5/configuration.nix

@@ -4,114 +4,184 @@
   imports =
     [
       ./hardware-configuration.nix
+      ../../configuration/proxmox-vm
+      ../../configuration/dn42
     ];
 
-  profiles.clerie.mercury-vm.enable = true;
-
   boot.loader.grub.enable = true;
   boot.loader.grub.device = "/dev/vda";
 
-  systemd.network.networks."10-wan" = {
-    matchConfig.Name = "ens21";
-    address = [
-      "2001:638:904:ffc9::a/64"
-    ];
-    routes = [
-      { Gateway = "2001:638:904:ffc9::1"; }
-    ];
-    linkConfig.RequiredForOnline = "routable";
-    ipv6AcceptRAConfig.DHCPv6Client = "no";
-  };
-  systemd.network.networks."10-nat-netz-mercury" = {
-    matchConfig.Name = "ens18";
-    address = [
-      "192.168.10.25/24"
-    ];
-    routes = [
-      { Gateway = "192.168.10.1"; }
-    ];
-    linkConfig.RequiredForOnline = "routable";
-    ipv6AcceptRAConfig.DHCPv6Client = "no";
-  };
-  systemd.network.networks."10-dn42-ospf-netz" = {
-    matchConfig.Name = "ens19";
-    linkConfig.RequiredForOnline = "no";
-    ipv6AcceptRAConfig.DHCPv6Client = "no";
-  };
-  systemd.network.networks."10-dn42-lokales-netz" = {
-    # Aktuell nicht verwendet, da in lo-dn42 umgezogen
-    matchConfig.Name = "ens20";
-    linkConfig.RequiredForOnline = "no";
-    ipv6AcceptRAConfig.DHCPv6Client = "no";
-  };
-  systemd.network.networks."10-dn42-ildix" = {
-    matchConfig.Name = "ens22";
-    address = [
-      "fd81:edb3:71d8:ffff:2574::5/64"
-    ];
-    linkConfig.RequiredForOnline = "no";
-    ipv6AcceptRAConfig.DHCPv6Client = "no";
-  };
+  networking.useDHCP = false;
+  # VM Nat Netz mercury
+  networking.interfaces.ens18.ipv4.addresses = [ { address = "192.168.10.25"; prefixLength = 24; } ];
+  # OSPF Netz
+  networking.interfaces.ens19 = {};
+  # Lokales Netz
+  networking.interfaces.ens20.ipv6.addresses = [ { address = "fd56:4902:eca0:5::1"; prefixLength = 64; } ];
+  # IPv6 Uplink
+  networking.interfaces.ens21.ipv6.addresses = [ { address = "2001:638:904:ffc9::a"; prefixLength = 64; } ];
+  # Ildix
+  networking.interfaces.ens22.ipv6.addresses = [ { address = "fd81:edb3:71d8:ffff:2574::5"; prefixLength = 64; } ];
 
-  profiles.clerie.dn42-router = {
+  networking.defaultGateway = { address = "192.168.10.1"; interface = "ens18"; };
+  networking.defaultGateway6 = { address = "2001:638:904:ffc9::1"; interface = "ens21"; };
+  networking.nameservers = [ "2001:638:904:ffcc::3" "2001:638:904:ffcc::4" "141.24.40.3" "141.24.40.4" ];
+
+  petabyte.policyrouting = {
     enable = true;
-    loopbackIp = "fd56:4902:eca0:5::1";
-    routerId = "192.168.10.25";
-
-    ospfInterfaces = [
-      "ens19"
+    rules6 = [
+      { rule = "from all to fd56:4902:eca0::/48 lookup 1337"; prio = 10000; }
+      { rule = "from all to all lookup 2342"; prio = 10000; }
+      { rule = "from all to fd56:4902:eca0::/48 unreachable"; prio = 20000; }
+      { rule = "from fd56:4902:eca0::/48 to all unreachable"; prio = 20000; }
     ];
-
-    ibgpPeers = [
-      {
-        peerName = "gw1";
-        remoteAddress = "fd56:4902:eca0:1::1";
-      }
-      {
-        peerName = "gw6";
-        remoteAddress = "fd56:4902:eca0:6::1";
-      }
-    ];
-
-    bgpPeers = [
-      {
-        peerName = "peer_ildix_clerie";
-        localAddress = "fd81:edb3:71d8:ffff:2574::5";
-        remoteAddress = "fd81:edb3:71d8:ffff::13";
-        remoteAsn = "4242422953";
-      }
-      {
-        peerName = "peer_ildix_nex";
-        localAddress = "fd81:edb3:71d8:ffff:2574::5";
-        remoteAddress = "fd81:edb3:71d8:ffff::14";
-        remoteAsn = "4242422953";
-      }
-    ];
-
-    birdExtraConfig = ''
-      # Internal
-      protocol bgp peer_2953_dn42_ildix_service {
-        local as 4242422574;
-        neighbor fd81:edb3:71d8:ffff:2953::1 port 1179 as 4242422953;
-        source address fd81:edb3:71d8:ffff:2574::5;
-        multihop 64;
-        ipv6 {
-          table bgp6;
-          igp table ospf6;
-          next hop keep;
-          add paths tx;
-          import filter {
-            reject;
-          };
-          export filter {
-            accept;
-          };
-        };
-      }
-    '';
   };
 
-  services.bijwerken = {
+  services.bird2.enable = true;
+  services.bird2.config = ''
+  router id ${ (lib.head config.networking.interfaces.ens18.ipv4.addresses).address };
+
+  ipv6 table ospf6;
+  ipv6 table bgp6;
+
+  protocol direct {
+    interface "ens20";
+    ipv6 {
+      table ospf6;
+    };
+  }
+
+  protocol static {
+          ipv6 {
+                  table bgp6;
+          };
+          route fd56:4902:eca0::/48 via "lo";
+          route fd56:4902:eca0::/52 via "lo";
+  }
+
+  protocol kernel {
+    ipv6 {
+      table ospf6;
+      export filter {
+        krt_prefsrc=fd56:4902:eca0:5::1;
+        accept;
+      };
+      import none;
+    };
+    kernel table 1337;
+  }
+
+  protocol kernel {
+          ipv6 {
+                  table bgp6;
+                  export filter {
+                          krt_prefsrc=fd56:4902:eca0:5::1;
+        accept;
+                  };
+                  import none;
+          };
+    kernel table 2342;
+  }
+
+  protocol ospf v3 {
+    ipv6 {
+      table ospf6;
+      import all;
+      export all;
+    };
+    area 0 {
+      interface "ens19" {
+        cost 80;
+        type broadcast;
+      };
+    };
+  }
+
+  protocol bgp gw1 {
+          local as 4242422574;
+          graceful restart on;
+          neighbor fd56:4902:eca0:1::1 as 4242422574;
+          source address fd56:4902:eca0:5::1;
+          ipv6 {
+                  table bgp6;
+                  igp table ospf6;
+                  next hop self;
+                  import keep filtered;
+                  import all;
+                  export all;
+          };
+  }
+
+  protocol bgp gw6 {
+          local as 4242422574;
+          graceful restart on;
+          neighbor fd56:4902:eca0:6::1 as 4242422574;
+          source address fd56:4902:eca0:5::1;
+          ipv6 {
+      table bgp6;
+      igp table ospf6;
+                  next hop self;
+                  import keep filtered;
+                  import all;
+                  export all;
+          };
+  }
+
+  template bgp ildix {
+    local as 4242422574;
+    graceful restart on;
+    source address fd81:edb3:71d8:ffff:2574::5;
+    ipv6 {
+      table bgp6;
+      igp table ospf6;
+      next hop self;
+      import keep filtered;
+      import filter {
+        if net ~ [fd00::/8{8,64}] then accept;
+        reject;
+      };
+      export filter {
+        if net ~ [fd00::/8{8,64}] then accept;
+        reject;
+      };
+    };
+  }
+
+  protocol bgp peer_ildix_clerie from ildix {
+    neighbor fd81:edb3:71d8:ffff::13 as 4242422953;
+  }
+
+  protocol bgp peer_ildix_nex from ildix {
+    neighbor fd81:edb3:71d8:ffff::14 as 4242422953;
+  }
+
+  # Internal
+  protocol bgp peer_2953_dn42_ildix_service {
+    local as 4242422574;
+    neighbor fd81:edb3:71d8:ffff:2953::1 port 1179 as 4242422953;
+    source address fd81:edb3:71d8:ffff:2574::5;
+    multihop 64;
+    ipv6 {
+      table bgp6;
+      igp table ospf6;
+      next hop keep;
+      add paths tx;
+      import filter {
+        reject;
+      };
+      export filter {
+        accept;
+      };
+    };
+  }
+
+  protocol device {
+    scan time 10;
+  }
+  '';
+
+  clerie.system-auto-upgrade = {
+    allowReboot = true;
     autoUpgrade = true;
     startAt = "*-*-* 06:22:00";
   };

hosts/dn42-il-gw6/configuration.nix

@@ -4,108 +4,184 @@
   imports =
     [
       ./hardware-configuration.nix
+      ../../configuration/proxmox-vm
+      ../../configuration/dn42
     ];
 
-  profiles.clerie.cybercluster-vm.enable = true;
-
   boot.loader.grub.enable = true;
   boot.loader.grub.device = "/dev/vda";
 
-  systemd.network.networks."10-wan" = {
-    matchConfig.Name = "ens18";
-    address = [
-      "2001:638:904:ffc9::9/64"
-    ];
-    routes = [
-      { Gateway = "2001:638:904:ffc9::1"; }
-    ];
-    linkConfig.RequiredForOnline = "routable";
-    ipv6AcceptRAConfig.DHCPv6Client = "no";
-  };
-  systemd.network.networks."10-nat-netz-mercury" = {
-    matchConfig.Name = "ens20";
-    address = [
-      "192.168.10.26/24"
-    ];
-    routes = [
-      { Gateway = "192.168.10.1"; }
-    ];
-    linkConfig.RequiredForOnline = "routable";
-    ipv6AcceptRAConfig.DHCPv6Client = "no";
-  };
-  systemd.network.networks."10-dn42-ospf-netz" = {
-    matchConfig.Name = "ens21";
-    linkConfig.RequiredForOnline = "no";
-    ipv6AcceptRAConfig.DHCPv6Client = "no";
-  };
-  systemd.network.networks."10-dn42-ildix" = {
-    matchConfig.Name = "ens19";
-    address = [
-      "fd81:edb3:71d8:ffff:2574::6/64"
-    ];
-    linkConfig.RequiredForOnline = "no";
-    ipv6AcceptRAConfig.DHCPv6Client = "no";
-  };
+  networking.useDHCP = false;
+  networking.interfaces.lo.ipv6.addresses = [ { address = "fd56:4902:eca0:6::1"; prefixLength = 64; } ];
+  # IPv6 Uplink
+  networking.interfaces.ens18.ipv6.addresses = [ { address = "2001:638:904:ffc9::9"; prefixLength = 64; } ];
+  # Ildix
+  networking.interfaces.ens19.ipv6.addresses = [ { address = "fd81:edb3:71d8:ffff:2574::6"; prefixLength = 64; } ];
+  # VM Nat Netz mercury
+  networking.interfaces.ens20.ipv4.addresses = [ { address = "192.168.10.26"; prefixLength = 24; } ];
+  # OSPF Netz
+  networking.interfaces.ens21 = {};
 
-  profiles.clerie.dn42-router = {
+
+  networking.defaultGateway = { address = "192.168.10.1"; interface = "ens20"; };
+  networking.defaultGateway6 = { address = "2001:638:904:ffc9::1"; interface = "ens18"; };
+  networking.nameservers = [ "2001:638:904:ffcc::3" "2001:638:904:ffcc::4" "141.24.40.3" "141.24.40.4" ];
+
+  petabyte.policyrouting = {
     enable = true;
-    loopbackIp = "fd56:4902:eca0:6::1";
-    routerId = "192.168.10.26";
-
-    ospfInterfaces = [
-      "ens21"
+    rules6 = [
+      { rule = "from all to fd56:4902:eca0::/48 lookup 1337"; prio = 10000; }
+      { rule = "from all to all lookup 2342"; prio = 10000; }
+      { rule = "from all to fd56:4902:eca0::/48 unreachable"; prio = 20000; }
+      { rule = "from fd56:4902:eca0::/48 to all unreachable"; prio = 20000; }
     ];
-
-    ibgpPeers = [
-      {
-        peerName = "gw1";
-        remoteAddress = "fd56:4902:eca0:1::1";
-      }
-      {
-        peerName = "gw5";
-        remoteAddress = "fd56:4902:eca0:5::1";
-      }
-    ];
-
-    bgpPeers = [
-      {
-        peerName = "peer_ildix_clerie";
-        localAddress = "fd81:edb3:71d8:ffff:2574::6";
-        remoteAddress = "fd81:edb3:71d8:ffff::13";
-        remoteAsn = "4242422953";
-      }
-      {
-        peerName = "peer_ildix_nex";
-        localAddress = "fd81:edb3:71d8:ffff:2574::6";
-        remoteAddress = "fd81:edb3:71d8:ffff::14";
-        remoteAsn = "4242422953";
-      }
-    ];
-
-    birdExtraConfig = ''
-      # Internal
-      protocol bgp peer_2953_dn42_ildix_service {
-        local as 4242422574;
-        neighbor fd81:edb3:71d8:ffff:2953::1 port 1179 as 4242422953;
-        source address fd81:edb3:71d8:ffff:2574::6;
-        multihop 64;
-        ipv6 {
-          table bgp6;
-          igp table ospf6;
-          next hop keep;
-          add paths tx;
-          import filter {
-            reject;
-          };
-          export filter {
-            accept;
-          };
-        };
-      }
-    '';
   };
 
-  services.bijwerken = {
+  services.bird2.enable = true;
+  services.bird2.config = ''
+  router id ${ (lib.head config.networking.interfaces.ens20.ipv4.addresses).address };
+
+  ipv6 table ospf6;
+  ipv6 table bgp6;
+
+  protocol direct {
+    interface "lo";
+    ipv6 {
+      table ospf6;
+    };
+  }
+
+  protocol static {
+          ipv6 {
+                  table bgp6;
+          };
+          #route fd56:4902:eca0::/48 via "lo";
+          #route fd56:4902:eca0::/52 via "lo";
+  }
+
+  protocol kernel {
+          ipv6 {
+                  table ospf6;
+                  export filter {
+                          krt_prefsrc=fd56:4902:eca0:6::1;
+  			accept;
+                  };
+                  import none;
+          };
+  	kernel table 1337;
+  }
+
+  protocol kernel {
+          ipv6 {
+                  table bgp6;
+                  export filter {
+                          krt_prefsrc=fd56:4902:eca0:6::1;
+  			accept;
+                  };
+                  import none;
+          };
+          kernel table 2342;
+  }
+
+  protocol ospf v3 {
+          ipv6 {
+                  table ospf6;
+                  import all;
+                  export all;
+          };
+          area 0 {
+                  interface "ens21" {
+                          cost 80;
+                          type broadcast;
+                  };
+          };
+  }
+
+  protocol bgp gw1 {
+          local as 4242422574;
+          graceful restart on;
+          neighbor fd56:4902:eca0:1::1 as 4242422574;
+          source address fd56:4902:eca0:6::1;
+          ipv6 {
+                  table bgp6;
+                  igp table ospf6;
+                  next hop self;
+                  import keep filtered;
+                  import all;
+                  export all;
+          };
+  }
+
+  protocol bgp gw5 {
+          local as 4242422574;
+          graceful restart on;
+          neighbor fd56:4902:eca0:5::1 as 4242422574;
+          source address fd56:4902:eca0:6::1;
+          ipv6 {
+                  table bgp6;
+  		igp table ospf6;
+  		next hop self;
+                  import keep filtered;
+                  import all;
+                  export all;
+          };
+  }
+
+  template bgp ildix {
+    local as 4242422574;
+    graceful restart on;
+    source address fd81:edb3:71d8:ffff:2574::6;
+    ipv6 {
+      table bgp6;
+      igp table ospf6;
+      next hop self;
+      import keep filtered;
+      import filter {
+        if net ~ [fd00::/8{8,64}] then accept;
+        reject;
+      };
+      export filter {
+        if net ~ [fd00::/8{8,64}] then accept;
+        reject;
+      };
+    };
+  }
+
+  protocol bgp peer_ildix_clerie from ildix {
+    neighbor fd81:edb3:71d8:ffff::13 as 4242422953;
+  }
+
+  protocol bgp peer_ildix_nex from ildix {
+    neighbor fd81:edb3:71d8:ffff::14 as 4242422953;
+  }
+
+  # Internal
+  protocol bgp peer_2953_dn42_ildix_service {
+    local as 4242422574;
+    neighbor fd81:edb3:71d8:ffff:2953::1 port 1179 as 4242422953;
+    source address fd81:edb3:71d8:ffff:2574::6;
+    multihop 64;
+    ipv6 {
+      table bgp6;
+      igp table ospf6;
+      next hop keep;
+      add paths tx;
+      import filter {
+        reject;
+      };
+      export filter {
+        accept;
+      };
+    };
+  }
+
+  protocol device {
+          scan time 10;
+  }
+  '';
+
+  clerie.system-auto-upgrade = {
+    allowReboot = true;
     autoUpgrade = true;
     startAt = "*-*-* 07:22:00";
   };

hosts/dn42-ildix-clerie/configuration.nix

@@ -4,47 +4,26 @@
   imports =
     [
       ./hardware-configuration.nix
+      ../../configuration/proxmox-vm
     ];
 
-  profiles.clerie.mercury-vm.enable = true;
-
   boot.loader.grub.enable = true;
   boot.loader.grub.device = "/dev/vda";
 
-  systemd.network.networks."10-wan" = {
-    matchConfig.Name = "ens20";
-    address = [
-      "2001:638:904:ffcb::4/64"
-    ];
-    routes = [
-      { Gateway = "2001:638:904:ffcb::1"; }
-    ];
-    linkConfig.RequiredForOnline = "routable";
-    ipv6AcceptRAConfig.DHCPv6Client = "no";
-  };
-  systemd.network.networks."10-nat-netz-mercury" = {
-    matchConfig.Name = "ens18";
-    address = [
-      "192.168.10.27/24"
-    ];
-    routes = [
-      { Gateway = "192.168.10.1"; }
-    ];
-    linkConfig.RequiredForOnline = "routable";
-    ipv6AcceptRAConfig.DHCPv6Client = "no";
-  };
-  systemd.network.networks."10-dn42-ildix" = {
-    matchConfig.Name = "ens19";
-    address = [
-      "fd81:edb3:71d8:ffff::13/64"
-    ];
-    routes = [
-      # Route to dn42-ildix-service
-      { Destination = "fd81:edb3:71d8::/48"; Gateway = "fd81:edb3:71d8:ffff:2953::1"; }
-    ];
-    linkConfig.RequiredForOnline = "no";
-    ipv6AcceptRAConfig.DHCPv6Client = "no";
-  };
+  networking.useDHCP = false;
+  # VM Nat Netz mercury
+  networking.interfaces.ens18.ipv4.addresses = [ { address = "192.168.10.27"; prefixLength = 24; } ];
+  # Ildix
+  networking.interfaces.ens19.ipv6.addresses = [ { address = "fd81:edb3:71d8:ffff::13"; prefixLength = 64; } ];
+  # Route to dn42-ildix-service
+  networking.interfaces.ens19.ipv6.routes = [ { address = "fd81:edb3:71d8::"; prefixLength = 48; via = "fd81:edb3:71d8:ffff:2953::1"; } ];
+
+  # public address
+  networking.interfaces.ens20.ipv6.addresses = [ { address = "2001:638:904:ffcb::4"; prefixLength = 64; } ];
+
+  networking.defaultGateway6 = { address = "2001:638:904:ffcb::1"; interface = "ens20"; };
+  networking.defaultGateway = { address = "192.168.10.1"; interface = "ens18"; };
+  networking.nameservers = [ "2001:638:904:ffcc::3" "2001:638:904:ffcc::4" "141.24.40.3" "141.24.40.4" ];
 
   # Open Firewall for BGP
   networking.firewall.allowedTCPPorts = [ 179 ];
@@ -54,10 +33,9 @@
   iptables -A INPUT -p ospfigp -j ACCEPT
   '';
 
-  services.bird.enable = true;
-  services.bird.package = pkgs.bird2;
-  services.bird.config = ''
-  router id 192.168.10.27;
+  services.bird2.enable = true;
+  services.bird2.config = ''
+  router id ${ (lib.head config.networking.interfaces.ens18.ipv4.addresses).address };
 
   protocol direct {
     interface "ens19";
@@ -161,7 +139,8 @@
   }
   '';
 
-  services.bijwerken = {
+  clerie.system-auto-upgrade = {
+    allowReboot = true;
     autoUpgrade = true;
   };
 

hosts/dn42-ildix-service/bird.nix

@@ -1,13 +1,12 @@
-{ config, lib, pkgs, ... }:
+{ config, lib, ... }:
 
 {
   networking.firewall.allowedTCPPorts = [ 179 ];
 
   # something doesn't work right
-  services.bird.enable = false;
-  services.bird.package = pkgs.bird2;
-  services.bird.config = ''
-  router id 192.168.10.28;
+  services.bird2.enable = false;
+  services.bird2.config = ''
+  router id ${(lib.head config.networking.interfaces.ens18.ipv4.addresses).address};
 
   ipv6 table bgp6;
 
@@ -22,7 +21,7 @@
     ipv6 {
       table bgp6;
       export filter {
-        krt_prefsrc=fd81:edb3:71d8::1;
+        krt_prefsrc=${(lib.head config.networking.interfaces.lo.ipv6.addresses).address};
         accept;
       };
       import none;

hosts/dn42-ildix-service/configuration.nix

@@ -4,13 +4,11 @@
   imports =
     [
       ./hardware-configuration.nix
-
+      ../../configuration/proxmox-vm
       ./bird.nix
       ./fernglas.nix
     ];
 
-  profiles.clerie.mercury-vm.enable = true;
-
   # Use the GRUB 2 boot loader.
   boot.loader.grub.enable = true;
   # boot.loader.grub.efiSupport = true;
@@ -19,58 +17,28 @@
   # Define on which hard drive you want to install Grub.
   boot.loader.grub.device = "/dev/vda"; # or "nodev" for efi only
 
-  systemd.network.netdevs."10-lo-dn42" = {
-    netdevConfig = {
-      Kind = "dummy";
-      Name = "lo-dn42";
-    };
-  };
+  networking.useDHCP = false;
+  networking.interfaces.lo.ipv6.addresses = [
+    { address = "fd81:edb3:71d8::1"; prefixLength = 128; }
+    { address = "fd81:edb3:71d8::53"; prefixLength = 128; }
+  ];
+  # VM Nat Netz mercury
+  networking.interfaces.ens18.ipv4.addresses = [ { address = "192.168.10.28"; prefixLength = 24; } ];
+  # ildix peering lan
+  networking.interfaces.ens19.ipv6.addresses = [ { address = "fd81:edb3:71d8:ffff:2953::1"; prefixLength = 64; } ];
+  # IPv6 Uplink
+  networking.interfaces.ens20.ipv6.addresses = [ { address = "2001:638:904:ffc9::c"; prefixLength = 64; } ];
 
-  systemd.network.networks."10-lo-dn42" = {
-    matchConfig.Name = "lo-dn42";
-    address = [
-      "fd81:edb3:71d8::1/128"
-      "fd81:edb3:71d8::53/128"
-    ];
-    linkConfig.RequiredForOnline = "no";
-    ipv6AcceptRAConfig.DHCPv6Client = "no";
-  };
-  systemd.network.networks."10-wan" = {
-    matchConfig.Name = "ens20";
-    address = [
-      "2001:638:904:ffc9::c/64"
-    ];
-    routes = [
-      { Gateway = "2001:638:904:ffc9::1"; }
-    ];
-    linkConfig.RequiredForOnline = "routable";
-    ipv6AcceptRAConfig.DHCPv6Client = "no";
-  };
-  systemd.network.networks."10-nat-netz-mercury" = {
-    matchConfig.Name = "ens18";
-    address = [
-      "192.168.10.28/24"
-    ];
-    routes = [
-      { Gateway = "192.168.10.1"; }
-    ];
-    linkConfig.RequiredForOnline = "routable";
-    ipv6AcceptRAConfig.DHCPv6Client = "no";
-  };
-  systemd.network.networks."10-dn42-ildix" = {
-    matchConfig.Name = "ens19";
-    address = [
-      "fd81:edb3:71d8:ffff:2953::1/64"
-    ];
-    linkConfig.RequiredForOnline = "no";
-    ipv6AcceptRAConfig.DHCPv6Client = "no";
-  };
+  networking.defaultGateway6 = { address = "2001:638:904:ffc9::1"; interface = "ens20"; };
+  networking.defaultGateway = { address = "192.168.10.1"; interface = "ens18"; };
+  networking.nameservers = [ "2001:638:904:ffcc::3" "2001:638:904:ffcc::4" "141.24.40.3" "141.24.40.4" ];
 
   services.nginx.enable = true;
 
   networking.firewall.allowedTCPPorts = [ 80 443 ];
 
-  services.bijwerken = {
+  clerie.system-auto-upgrade = {
+    allowReboot = true;
     autoUpgrade = true;
   };
 

hosts/dn42-ildix-service/fernglas.nix

@@ -5,21 +5,20 @@
 
   services.fernglas = {
     enable = true;
-    useMimalloc = false;
     settings = {
       api.bind = "[::1]:3000";
-      collectors = {
-        bgp_any = {
+      collectors = [
+        {
           collector_type = "Bgp";
           bind = "[::]:1179";
           default_peer_config = {
             asn = 4242422953;
-            router_id = "192.168.10.28";
+            router_id = "${(lib.head config.networking.interfaces.ens18.ipv4.addresses).address}";
             route_state = "Accepted";
             add_path = true;
           };
-        };
-      };
+        }
+      ];
     };
   };
 

hosts/gatekeeper/configuration.nix

@@ -4,20 +4,19 @@
   imports =
     [
       ./hardware-configuration.nix
+      ../../configuration/router
     ];
 
-  profiles.clerie.hetzner-cloud.enable = true;
-  profiles.clerie.router.enable = true;
-
   boot.loader.grub.enable = true;
   boot.loader.grub.device = "/dev/sda";
 
-  systemd.network.networks."10-wan" = {
-    address = [
-      "2a01:4f8:c0c:15f1::1/64"
-      "78.47.183.82/32"
-    ];
-  };
+  networking.useDHCP = false;
+  # Network
+  networking.interfaces.ens3.ipv4.addresses = [ { address = "78.47.183.82"; prefixLength = 32; } ];
+  networking.interfaces.ens3.ipv6.addresses = [ { address = "2a01:4f8:c0c:15f1::1"; prefixLength = 64; } ];
+  networking.defaultGateway = { address = "172.31.1.1"; interface = "ens3"; };
+  networking.defaultGateway6 = { address = "fe80::1"; interface = "ens3"; };
+  networking.nameservers = [ "213.133.98.98" "213.133.99.99" "213.133.100.100" ];
 
   networking.nat = {
     enable = true;
@@ -74,7 +73,7 @@
         {
           # palladium
           allowedIPs = [ "2a01:4f8:c0c:15f1::8103/128" "10.20.30.103/32" ];
-          publicKey = "AetxArlP6uiPEPnrk9Yx+ofhBOgOY4NLTqcKM/EA9mk=";
+          publicKey = "kxn69ynVyPJeShsAlVz5Xnd7U74GmCAw181b0+/qj3k=";
         }
         #{
         #  allowedIPs = [ "2a01:4f8:c0c:15f1::8104/128" "10.20.30.104/32" ];
@@ -115,11 +114,6 @@
           allowedIPs = [ "2a01:4f8:c0c:15f1::8111/128" "10.20.30.111/32" ];
           publicKey = "o6qxGKIoW2ZSFhXeNRXd4G9BRFeYyjZsrUPulB3KhTI=";
         }
-        {
-          # tungsten
-          allowedIPs = [ "2a01:4f8:c0c:15f1::8112/128" "10.20.30.112/32" ];
-          publicKey = "OI5/psr3ShrwRqKTTr3Kv92OVRietTcMFNVXtsYybRo=";
-        }
       ];
       listenPort = 51820;
       allowedIPsAsRoutes = false;
@@ -131,7 +125,6 @@
 
   clerie.nginx-port-forward = {
     enable = true;
-    resolver = "127.0.0.53";
     tcpPorts."443" = {
       host = "localhost";
       port = 22;

hosts/hydra-1/configuration.nix

@@ -4,15 +4,14 @@
   imports =
     [
       ./hardware-configuration.nix
+      ../../configuration/proxmox-vm
+      ../../configuration/hydra-build-machine
 
       ./build-machines.nix
       ./hydra.nix
       ./nix-cache.nix
     ];
 
-  profiles.clerie.mercury-vm.enable = true;
-  profiles.clerie.hydra-build-machine.enable = true;
-
   boot.loader.grub.enable = true;
   boot.loader.grub.device = "/dev/vda";
   
@@ -22,28 +21,12 @@
     "aarch64-linux"
   ];
 
-  systemd.network.networks."10-wan" = {
-    matchConfig.Name = "ens18";
-    address = [
-      "2001:638:904:ffcb::a/64"
-    ];
-    routes = [
-      { Gateway = "2001:638:904:ffcb::1"; }
-    ];
-    linkConfig.RequiredForOnline = "routable";
-    ipv6AcceptRAConfig.DHCPv6Client = "no";
-  };
-  systemd.network.networks."10-nat-netz-mercury" = {
-    matchConfig.Name = "ens19";
-    address = [
-      "192.168.10.36/24"
-    ];
-    routes = [
-      { Gateway = "192.168.10.1"; }
-    ];
-    linkConfig.RequiredForOnline = "routable";
-    ipv6AcceptRAConfig.DHCPv6Client = "no";
-  };
+  networking.useDHCP = false;
+  networking.interfaces.ens18.ipv6.addresses = [ { address = "2001:638:904:ffcb::a"; prefixLength = 64; } ];
+  networking.interfaces.ens19.ipv4.addresses = [ { address = "192.168.10.36"; prefixLength = 24; } ];
+  networking.defaultGateway6 = { address = "2001:638:904:ffcb::1"; interface = "ens18"; };
+  networking.defaultGateway = { address = "192.168.10.1"; interface = "ens19"; };
+  networking.nameservers = [ "2001:638:904:ffcc::3" "2001:638:904:ffcc::4" "141.24.40.3" "141.24.40.4" ];
 
   services.nginx.enable = true;
 

hosts/hydra-2/configuration.nix

@@ -4,11 +4,10 @@
   imports =
     [
       ./hardware-configuration.nix
+      ../../configuration/proxmox-vm
+      ../../configuration/hydra-build-machine
     ];
 
-  profiles.clerie.cybercluster-vm.enable = true;
-  profiles.clerie.hydra-build-machine.enable = true;
-
   boot.loader.grub.enable = true;
   boot.loader.grub.device = "/dev/vda";
 
@@ -18,19 +17,12 @@
     "aarch64-linux"
   ];
 
-  systemd.network.networks."10-wan" = {
-    matchConfig.Name = "ens18";
-    address = [
-      "2001:638:904:ffc1::100/64"
-      "141.24.50.112/24"
-    ];
-    routes = [
-      { Gateway = "2001:638:904:ffc1::1"; }
-      { Gateway = "141.24.50.1"; }
-    ];
-    linkConfig.RequiredForOnline = "routable";
-    ipv6AcceptRAConfig.DHCPv6Client = "no";
-  };
+  networking.useDHCP = false;
+  networking.interfaces.ens18.ipv6.addresses = [ { address = "2001:638:904:ffc1::100"; prefixLength = 64; } ];
+  networking.interfaces.ens18.ipv4.addresses = [ { address = "141.24.50.112"; prefixLength = 24; } ];
+  networking.defaultGateway6 = { address = "2001:638:904:ffc1::1"; interface = "ens18"; };
+  networking.defaultGateway = { address = "141.24.50.1"; interface = "ens18"; };
+  networking.nameservers = [ "2001:638:904:ffcc::3" "2001:638:904:ffcc::4" "141.24.40.3" "141.24.40.4" ];
 
   clerie.monitoring = {
     enable = true;

hosts/krypton/configuration.nix

@@ -5,16 +5,15 @@
     [
       ./hardware-configuration.nix
 
+      ../../configuration/desktop
+
       ./android.nix
       ./backup.nix
-      ./etesync-dav.nix
       #./initrd.nix
       ./network.nix
       ./programs.nix
     ];
 
-  profiles.clerie.desktop.enable = true;
-
   # Use the systemd-boot EFI boot loader.
   boot.loader.systemd-boot.enable = true;
   boot.loader.efi.canTouchEfiVariables = true;

hosts/krypton/etesync-dav.nix

@@ -1,10 +0,0 @@
-{ ... }:
-
-{
-
-  services.etesync-dav = {
-    enable = true;
-    apiUrl = "https://etebase.clerie.de";
-  };
-
-}

hosts/krypton/network.nix

@@ -1,7 +1,7 @@
 { ... }:
 
 {
-  profiles.clerie.wg-clerie = {
+  services.wg-clerie = {
     enable = true;
     ipv6s = [ "2a01:4f8:c0c:15f1::8011/128" ];
     ipv4s = [ "10.20.30.11/32" ];

hosts/krypton/programs.nix

@@ -1,7 +1,9 @@
 { pkgs, ... }:
 
 {
-  profiles.clerie.firefox.enable = true;
+  environment.systemPackages = with pkgs; [
+    firefox-wayland
+  ];
 
   users.users.clerie.packages = with pkgs; [
     keepassxc
@@ -14,23 +16,19 @@
 
     tio
     xournalpp
-    libreoffice
+    onlyoffice-bin
 
     krita
     inkscape
-    dune3d
 
     wireshark
     tcpdump
     nmap
 
-    kdePackages.okular
+    okular
     chromium-incognito
 
     print-afra
-    git-show-link
-
-    factorio-launcher
   ];
 
   # Wireshark

hosts/mail-2/configuration.nix

@@ -4,21 +4,16 @@
   imports =
     [
       ./hardware-configuration.nix
+      ../../configuration/hetzner-cloud
 
       ./mailcow.nix
     ];
 
-  profiles.clerie.hetzner-cloud.enable = true;
-
   boot.loader.grub.enable = true;
   boot.loader.grub.device = "/dev/sda";
 
-  systemd.network.networks."10-wan" = {
-    address = [
-      "2a01:4f8:1c1c:9577::1/64"
-      "5.75.187.112/32"
-    ];
-  };
+  networking.interfaces.ens3.ipv6.addresses = [ { address = "2a01:4f8:1c1c:9577::1"; prefixLength = 64; } ];
+  networking.interfaces.ens3.ipv4.addresses = [ { address = "5.75.187.112"; prefixLength = 32; } ];
 
   clerie.backup = {
     enable = true;

hosts/monitoring-3/alertmanager.nix

@@ -63,18 +63,6 @@
             "instance"
           ];
         }
-        {
-          target_matchers = [
-            ''alertname = "StorageAlmostFull"''
-          ];
-          source_matchers = [
-            ''alertname = "StorageFull"''
-          ];
-          equal = [
-            "instance"
-            "mountpoint"
-          ];
-        }
       ];
     };
   };

hosts/monitoring-3/blackbox.nix

@@ -25,48 +25,6 @@
             fail_if_not_ssl: true
             fail_if_body_not_matches_regexp:
               - "Synapse is running"
-            headers:
-              User-Agent: "monitoring.clerie.de, blackbox exporter"
-        http4:
-          prober: http
-          http:
-            preferred_ip_protocol: ip4
-            ip_protocol_fallback: false
-            fail_if_ssl: true
-            follow_redirects: false
-            valid_status_codes: [ 200, 204, 301, 302, 303, 307, 308 ]
-            headers:
-              User-Agent: "monitoring.clerie.de, blackbox exporter"
-        http6:
-          prober: http
-          http:
-            preferred_ip_protocol: ip6
-            ip_protocol_fallback: false
-            fail_if_ssl: true
-            follow_redirects: false
-            valid_status_codes: [ 200, 204, 301, 302, 303, 307, 308 ]
-            headers:
-              User-Agent: "monitoring.clerie.de, blackbox exporter"
-        https4:
-          prober: http
-          http:
-            preferred_ip_protocol: ip4
-            ip_protocol_fallback: false
-            fail_if_not_ssl: true
-            follow_redirects: false
-            valid_status_codes: [ 200, 204, 301, 302, 303, 307, 308 ]
-            headers:
-              User-Agent: "monitoring.clerie.de, blackbox exporter"
-        https6:
-          prober: http
-          http:
-            preferred_ip_protocol: ip6
-            ip_protocol_fallback: false
-            fail_if_not_ssl: true
-            follow_redirects: false
-            valid_status_codes: [ 200, 204, 301, 302, 303, 307, 308 ]
-            headers:
-              User-Agent: "monitoring.clerie.de, blackbox exporter"
     '';
   };
 }

hosts/monitoring-3/configuration.nix

@@ -4,43 +4,25 @@
   imports =
     [
       ./hardware-configuration.nix
+      ../../configuration/proxmox-vm
       ./alertmanager.nix
       ./berlinerbaeder-exporter.nix
       ./blackbox.nix
       ./grafana.nix
       ./nixos-validator.nix
       ./prometheus.nix
-      ./targets.nix
       ./uptimestatus.nix
     ];
 
-  profiles.clerie.mercury-vm.enable = true;
-
   boot.loader.grub.enable = true;
   boot.loader.grub.device = "/dev/sda";
 
-  systemd.network.networks."10-wan" = {
-    matchConfig.Name = "ens19";
-    address = [
-      "2001:638:904:ffca::7/64"
-    ];
-    routes = [
-      { Gateway = "2001:638:904:ffca::1"; }
-    ];
-    linkConfig.RequiredForOnline = "routable";
-    ipv6AcceptRAConfig.DHCPv6Client = "no";
-  };
-  systemd.network.networks."10-nat-netz-mercury" = {
-    matchConfig.Name = "ens18";
-    address = [
-      "192.168.10.32/24"
-    ];
-    routes = [
-      { Gateway = "192.168.10.1"; }
-    ];
-    linkConfig.RequiredForOnline = "routable";
-    ipv6AcceptRAConfig.DHCPv6Client = "no";
-  };
+  networking.useDHCP = false;
+  networking.interfaces.ens18.ipv4.addresses = [ { address = "192.168.10.32"; prefixLength = 24; } ];
+  networking.interfaces.ens19.ipv6.addresses = [ { address = "2001:638:904:ffca::7"; prefixLength = 64; } ];
+  networking.defaultGateway = { address = "192.168.10.1"; interface = "ens18"; };
+  networking.defaultGateway6 = { address = "2001:638:904:ffca::1"; interface = "ens19"; };
+  networking.nameservers = [ "2001:638:904:ffcc::3" "2001:638:904:ffcc::4" "141.24.40.3" "141.24.40.4" ];
 
   services.prometheus.exporters.node.enable = true;
 

hosts/monitoring-3/dashboards/home.json

@@ -1,77 +0,0 @@
-{
-  "annotations": {
-    "list": [
-      {
-        "builtIn": 1,
-        "datasource": {
-          "type": "datasource",
-          "uid": "grafana"
-        },
-        "enable": true,
-        "hide": true,
-        "iconColor": "rgba(0, 211, 255, 1)",
-        "name": "Annotations & Alerts",
-        "target": {
-          "limit": 100,
-          "matchAny": false,
-          "tags": [],
-          "type": "dashboard"
-        },
-        "type": "dashboard"
-      }
-    ]
-  },
-  "editable": true,
-  "fiscalYearStartMonth": 0,
-  "graphTooltip": 0,
-  "id": 10,
-  "links": [],
-  "panels": [
-    {
-      "fieldConfig": {
-        "defaults": {},
-        "overrides": []
-      },
-      "gridPos": {
-        "h": 11,
-        "w": 24,
-        "x": 0,
-        "y": 0
-      },
-      "id": 2,
-      "options": {
-        "includeVars": false,
-        "keepTime": false,
-        "maxItems": 10,
-        "query": "",
-        "showFolderNames": true,
-        "showHeadings": false,
-        "showRecentlyViewed": false,
-        "showSearch": true,
-        "showStarred": false,
-        "tags": []
-      },
-      "pluginVersion": "12.0.2+security-01",
-      "title": "Dashboards",
-      "type": "dashlist"
-    }
-  ],
-  "preload": false,
-  "refresh": "",
-  "schemaVersion": 41,
-  "tags": [],
-  "templating": {
-    "list": []
-  },
-  "time": {
-    "from": "now-6h",
-    "to": "now"
-  },
-  "timepicker": {
-    "hidden": true
-  },
-  "timezone": "browser",
-  "title": "Home",
-  "uid": "OqTN9p2nz",
-  "version": 1
-}

hosts/monitoring-3/dashboards/nginx-exporter.json

@@ -1,355 +0,0 @@
-{
-  "annotations": {
-    "list": [
-      {
-        "builtIn": 1,
-        "datasource": {
-          "type": "grafana",
-          "uid": "-- Grafana --"
-        },
-        "enable": true,
-        "hide": true,
-        "iconColor": "rgba(0, 211, 255, 1)",
-        "name": "Annotations & Alerts",
-        "type": "dashboard"
-      }
-    ]
-  },
-  "editable": true,
-  "fiscalYearStartMonth": 0,
-  "graphTooltip": 0,
-  "id": 16,
-  "links": [],
-  "panels": [
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "PBFA97CFB590B2093"
-      },
-      "fieldConfig": {
-        "defaults": {
-          "color": {
-            "mode": "palette-classic"
-          },
-          "custom": {
-            "axisBorderShow": false,
-            "axisCenteredZero": false,
-            "axisColorMode": "text",
-            "axisLabel": "",
-            "axisPlacement": "auto",
-            "barAlignment": 0,
-            "barWidthFactor": 0.6,
-            "drawStyle": "line",
-            "fillOpacity": 0,
-            "gradientMode": "none",
-            "hideFrom": {
-              "legend": false,
-              "tooltip": false,
-              "viz": false
-            },
-            "insertNulls": false,
-            "lineInterpolation": "linear",
-            "lineWidth": 1,
-            "pointSize": 5,
-            "scaleDistribution": {
-              "type": "linear"
-            },
-            "showPoints": "auto",
-            "spanNulls": false,
-            "stacking": {
-              "group": "A",
-              "mode": "none"
-            },
-            "thresholdsStyle": {
-              "mode": "off"
-            }
-          },
-          "mappings": [],
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "color": "green"
-              }
-            ]
-          },
-          "unit": "reqps"
-        },
-        "overrides": []
-      },
-      "gridPos": {
-        "h": 10,
-        "w": 12,
-        "x": 0,
-        "y": 0
-      },
-      "id": 1,
-      "options": {
-        "legend": {
-          "calcs": [],
-          "displayMode": "list",
-          "placement": "bottom",
-          "showLegend": true
-        },
-        "tooltip": {
-          "hideZeros": false,
-          "mode": "single",
-          "sort": "none"
-        }
-      },
-      "pluginVersion": "12.0.2+security-01",
-      "targets": [
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${DS_PROMETHEUS}"
-          },
-          "disableTextWrap": false,
-          "editorMode": "builder",
-          "expr": "sum by(server_name) (rate(nginxlog_http_response_count_total{server_name=~\"$server_name\"}[5m]))",
-          "fullMetaSearch": false,
-          "includeNullMetadata": true,
-          "legendFormat": "__auto",
-          "range": true,
-          "refId": "A",
-          "useBackend": false
-        }
-      ],
-      "title": "Total requests",
-      "type": "timeseries"
-    },
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "PBFA97CFB590B2093"
-      },
-      "fieldConfig": {
-        "defaults": {
-          "color": {
-            "mode": "palette-classic"
-          },
-          "custom": {
-            "axisBorderShow": false,
-            "axisCenteredZero": false,
-            "axisColorMode": "text",
-            "axisLabel": "",
-            "axisPlacement": "auto",
-            "barAlignment": 0,
-            "barWidthFactor": 0.6,
-            "drawStyle": "line",
-            "fillOpacity": 0,
-            "gradientMode": "none",
-            "hideFrom": {
-              "legend": false,
-              "tooltip": false,
-              "viz": false
-            },
-            "insertNulls": false,
-            "lineInterpolation": "linear",
-            "lineWidth": 1,
-            "pointSize": 5,
-            "scaleDistribution": {
-              "type": "linear"
-            },
-            "showPoints": "auto",
-            "spanNulls": false,
-            "stacking": {
-              "group": "A",
-              "mode": "none"
-            },
-            "thresholdsStyle": {
-              "mode": "off"
-            }
-          },
-          "mappings": [],
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "color": "green"
-              }
-            ]
-          },
-          "unit": "reqps"
-        },
-        "overrides": []
-      },
-      "gridPos": {
-        "h": 10,
-        "w": 12,
-        "x": 12,
-        "y": 0
-      },
-      "id": 2,
-      "options": {
-        "legend": {
-          "calcs": [],
-          "displayMode": "list",
-          "placement": "bottom",
-          "showLegend": true
-        },
-        "tooltip": {
-          "hideZeros": false,
-          "mode": "single",
-          "sort": "none"
-        }
-      },
-      "pluginVersion": "12.0.2+security-01",
-      "targets": [
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${DS_PROMETHEUS}"
-          },
-          "disableTextWrap": false,
-          "editorMode": "builder",
-          "expr": "sum by(server_name, method) (rate(nginxlog_http_response_count_total{server_name=~\"$server_name\"}[5m]))",
-          "fullMetaSearch": false,
-          "includeNullMetadata": true,
-          "legendFormat": "{{server_name}}: {{method}}",
-          "range": true,
-          "refId": "A",
-          "useBackend": false
-        }
-      ],
-      "title": "Status codes",
-      "type": "timeseries"
-    },
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "PBFA97CFB590B2093"
-      },
-      "fieldConfig": {
-        "defaults": {
-          "color": {
-            "mode": "palette-classic"
-          },
-          "custom": {
-            "axisBorderShow": false,
-            "axisCenteredZero": false,
-            "axisColorMode": "text",
-            "axisLabel": "",
-            "axisPlacement": "auto",
-            "barAlignment": 0,
-            "barWidthFactor": 0.6,
-            "drawStyle": "line",
-            "fillOpacity": 0,
-            "gradientMode": "none",
-            "hideFrom": {
-              "legend": false,
-              "tooltip": false,
-              "viz": false
-            },
-            "insertNulls": false,
-            "lineInterpolation": "linear",
-            "lineWidth": 1,
-            "pointSize": 5,
-            "scaleDistribution": {
-              "type": "linear"
-            },
-            "showPoints": "auto",
-            "spanNulls": false,
-            "stacking": {
-              "group": "A",
-              "mode": "none"
-            },
-            "thresholdsStyle": {
-              "mode": "off"
-            }
-          },
-          "mappings": [],
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "color": "green"
-              }
-            ]
-          },
-          "unit": "reqps"
-        },
-        "overrides": []
-      },
-      "gridPos": {
-        "h": 10,
-        "w": 12,
-        "x": 0,
-        "y": 10
-      },
-      "id": 3,
-      "options": {
-        "legend": {
-          "calcs": [],
-          "displayMode": "list",
-          "placement": "bottom",
-          "showLegend": true
-        },
-        "tooltip": {
-          "hideZeros": false,
-          "mode": "single",
-          "sort": "none"
-        }
-      },
-      "pluginVersion": "12.0.2+security-01",
-      "targets": [
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${DS_PROMETHEUS}"
-          },
-          "disableTextWrap": false,
-          "editorMode": "builder",
-          "expr": "sum by(server_name, status) (rate(nginxlog_http_response_count_total{server_name=~\"$server_name\"}[5m]))",
-          "fullMetaSearch": false,
-          "includeNullMetadata": true,
-          "legendFormat": "{{server_name}}: HTTP {{status}}",
-          "range": true,
-          "refId": "A",
-          "useBackend": false
-        }
-      ],
-      "title": "Response codes",
-      "type": "timeseries"
-    }
-  ],
-  "preload": false,
-  "refresh": "30s",
-  "schemaVersion": 41,
-  "tags": [],
-  "templating": {
-    "list": [
-      {
-        "current": {
-          "text": "All",
-          "value": [
-            "$__all"
-          ]
-        },
-        "definition": "label_values(nginxlog_http_response_count_total,server_name)",
-        "includeAll": true,
-        "label": "vHost",
-        "multi": true,
-        "name": "server_name",
-        "options": [],
-        "query": {
-          "qryType": 1,
-          "query": "label_values(nginxlog_http_response_count_total,server_name)",
-          "refId": "PrometheusVariableQueryEditor-VariableQuery"
-        },
-        "refresh": 1,
-        "regex": "",
-        "type": "query"
-      }
-    ]
-  },
-  "time": {
-    "from": "now-3h",
-    "to": "now"
-  },
-  "timepicker": {},
-  "timezone": "browser",
-  "title": "Nginx Exporter",
-  "uid": "b042a880-3cb0-4dd3-ae48-4745a58af698",
-  "version": 7
-}

hosts/monitoring-3/dashboards/nixos-status.json

@@ -1,135 +0,0 @@
-{
-  "annotations": {
-    "list": [
-      {
-        "builtIn": 1,
-        "datasource": {
-          "type": "grafana",
-          "uid": "-- Grafana --"
-        },
-        "enable": true,
-        "hide": true,
-        "iconColor": "rgba(0, 211, 255, 1)",
-        "name": "Annotations & Alerts",
-        "target": {
-          "limit": 100,
-          "matchAny": false,
-          "tags": [],
-          "type": "dashboard"
-        },
-        "type": "dashboard"
-      }
-    ]
-  },
-  "editable": true,
-  "fiscalYearStartMonth": 0,
-  "graphTooltip": 0,
-  "id": 15,
-  "links": [],
-  "panels": [
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "PBFA97CFB590B2093"
-      },
-      "fieldConfig": {
-        "defaults": {
-          "color": {
-            "mode": "continuous-RdYlGr"
-          },
-          "custom": {
-            "axisPlacement": "auto",
-            "fillOpacity": 70,
-            "hideFrom": {
-              "legend": false,
-              "tooltip": false,
-              "viz": false
-            },
-            "insertNulls": false,
-            "lineWidth": 0,
-            "spanNulls": false
-          },
-          "mappings": [
-            {
-              "options": {
-                "0": {
-                  "index": 1,
-                  "text": "mismatch"
-                },
-                "1": {
-                  "index": 0,
-                  "text": "sync"
-                }
-              },
-              "type": "value"
-            }
-          ],
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "color": "red"
-              }
-            ]
-          }
-        },
-        "overrides": []
-      },
-      "gridPos": {
-        "h": 23,
-        "w": 24,
-        "x": 0,
-        "y": 0
-      },
-      "id": 2,
-      "options": {
-        "alignValue": "left",
-        "legend": {
-          "displayMode": "list",
-          "placement": "bottom",
-          "showLegend": true
-        },
-        "mergeValues": true,
-        "rowHeight": 0.9,
-        "showValue": "auto",
-        "tooltip": {
-          "hideZeros": false,
-          "mode": "single",
-          "sort": "none"
-        }
-      },
-      "pluginVersion": "12.0.2+security-01",
-      "targets": [
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "PBFA97CFB590B2093"
-          },
-          "editorMode": "builder",
-          "expr": "nixos_current_system_is_sync",
-          "legendFormat": "{{instance}}",
-          "range": true,
-          "refId": "A"
-        }
-      ],
-      "title": "Config is Sync",
-      "type": "state-timeline"
-    }
-  ],
-  "preload": false,
-  "refresh": "5m",
-  "schemaVersion": 41,
-  "tags": [],
-  "templating": {
-    "list": []
-  },
-  "time": {
-    "from": "now-7d",
-    "to": "now"
-  },
-  "timepicker": {},
-  "timezone": "",
-  "title": "NixOS Status",
-  "uid": "W4j3nz1Vz",
-  "version": 3
-}

hosts/monitoring-3/dashboards/smokeping.json

@@ -1,211 +0,0 @@
-{
-  "annotations": {
-    "list": [
-      {
-        "builtIn": 1,
-        "datasource": {
-          "type": "datasource",
-          "uid": "grafana"
-        },
-        "enable": true,
-        "hide": true,
-        "iconColor": "rgba(0, 211, 255, 1)",
-        "name": "Annotations & Alerts",
-        "target": {
-          "limit": 100,
-          "matchAny": false,
-          "tags": [],
-          "type": "dashboard"
-        },
-        "type": "dashboard"
-      }
-    ]
-  },
-  "editable": true,
-  "fiscalYearStartMonth": 0,
-  "graphTooltip": 0,
-  "id": 11,
-  "links": [],
-  "panels": [
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "PBFA97CFB590B2093"
-      },
-      "fieldConfig": {
-        "defaults": {
-          "color": {
-            "mode": "palette-classic"
-          },
-          "custom": {
-            "axisBorderShow": false,
-            "axisCenteredZero": false,
-            "axisColorMode": "text",
-            "axisLabel": "",
-            "axisPlacement": "auto",
-            "barAlignment": 0,
-            "barWidthFactor": 0.6,
-            "drawStyle": "line",
-            "fillOpacity": 0,
-            "gradientMode": "none",
-            "hideFrom": {
-              "legend": false,
-              "tooltip": false,
-              "viz": false
-            },
-            "insertNulls": false,
-            "lineInterpolation": "linear",
-            "lineWidth": 1,
-            "pointSize": 5,
-            "scaleDistribution": {
-              "type": "linear"
-            },
-            "showPoints": "auto",
-            "spanNulls": false,
-            "stacking": {
-              "group": "A",
-              "mode": "none"
-            },
-            "thresholdsStyle": {
-              "mode": "off"
-            }
-          },
-          "mappings": [],
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "color": "green"
-              },
-              {
-                "color": "red",
-                "value": 80
-              }
-            ]
-          },
-          "unit": "s"
-        },
-        "overrides": []
-      },
-      "gridPos": {
-        "h": 22,
-        "w": 24,
-        "x": 0,
-        "y": 0
-      },
-      "id": 2,
-      "options": {
-        "legend": {
-          "calcs": [],
-          "displayMode": "list",
-          "placement": "bottom",
-          "showLegend": true
-        },
-        "tooltip": {
-          "hideZeros": false,
-          "mode": "single",
-          "sort": "none"
-        }
-      },
-      "pluginVersion": "12.0.2+security-01",
-      "targets": [
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "PBFA97CFB590B2093"
-          },
-          "editorMode": "code",
-          "exemplar": true,
-          "expr": "probe_icmp_duration_seconds{job=\"blackbox_icmp6\", target=~\"$target\", instance=~\"$instance\", phase=\"rtt\"} > 0 ",
-          "interval": "",
-          "legendFormat": "IPv6 {{target}} ({{instance}})",
-          "range": true,
-          "refId": "A"
-        },
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "PBFA97CFB590B2093"
-          },
-          "editorMode": "code",
-          "exemplar": true,
-          "expr": "probe_icmp_duration_seconds{job=\"blackbox_icmp4\", target=~\"$target\", instance=~\"$instance\", phase=\"rtt\"} > 0",
-          "hide": false,
-          "interval": "",
-          "legendFormat": "IPv4 {{target}} ({{instance}})",
-          "range": true,
-          "refId": "B"
-        }
-      ],
-      "title": "Smokeping",
-      "type": "timeseries"
-    }
-  ],
-  "preload": false,
-  "refresh": "",
-  "schemaVersion": 41,
-  "tags": [],
-  "templating": {
-    "list": [
-      {
-        "current": {
-          "text": "All",
-          "value": "$__all"
-        },
-        "datasource": {
-          "type": "prometheus",
-          "uid": "PBFA97CFB590B2093"
-        },
-        "definition": "label_values(probe_icmp_duration_seconds{phase=\"rtt\"}, target)",
-        "includeAll": true,
-        "label": "Target:",
-        "multi": true,
-        "name": "target",
-        "options": [],
-        "query": {
-          "query": "label_values(probe_icmp_duration_seconds{phase=\"rtt\"}, target)",
-          "refId": "StandardVariableQuery"
-        },
-        "refresh": 1,
-        "regex": "",
-        "type": "query"
-      },
-      {
-        "current": {
-          "text": [
-            "All"
-          ],
-          "value": [
-            "$__all"
-          ]
-        },
-        "datasource": {
-          "type": "prometheus",
-          "uid": "PBFA97CFB590B2093"
-        },
-        "definition": "label_values(probe_icmp_duration_seconds{phase=\"rtt\"}, instance)",
-        "includeAll": true,
-        "label": "Instance:",
-        "multi": true,
-        "name": "instance",
-        "options": [],
-        "query": {
-          "query": "label_values(probe_icmp_duration_seconds{phase=\"rtt\"}, instance)",
-          "refId": "StandardVariableQuery"
-        },
-        "refresh": 1,
-        "regex": "",
-        "type": "query"
-      }
-    ]
-  },
-  "time": {
-    "from": "now-30m",
-    "to": "now"
-  },
-  "timepicker": {},
-  "timezone": "",
-  "title": "Smokeping",
-  "uid": "IytTVZL7z",
-  "version": 9
-}

hosts/monitoring-3/grafana.nix

@@ -38,10 +38,6 @@
         enableACME = true;
         forceSSL   = true;
         locations."/".proxyPass = "http://[::1]:3001/";
-        locations."= /api/live/ws" = {
-          proxyPass = "http://[::1]:3001";
-          proxyWebsockets = true;
-        };
       };
     };
   };

hosts/monitoring-3/prometheus.nix

@@ -52,20 +52,9 @@ let
     attrByPath ["clerie" "monitoring" "blackbox"] false host.config)
     monitoringHosts);
 
-  nginxlogMonitoringTargets = mapAttrsToList (name: host:
-    "${host.config.networking.hostName}.mon.clerie.de:9117")
-    (filterAttrs (name: host:
-    attrByPath ["services" "prometheus" "exporters" "nginxlog" "enable"] false host.config)
-    monitoringHosts);
-
   eachWithEachOther = (f: x: y: lib.lists.flatten (lib.lists.forEach x (a: lib.lists.forEach y (b: f a b))));
 
 in {
-  sops.secrets.uberspace-monitor-password = {
-    owner = "prometheus";
-    group = "prometheus";
-  };
-
   networking.hosts = {
     "::1" = [ "monitoring-3.mon.clerie.de" ]; # fd00:327:327:327::1
   }
@@ -110,21 +99,6 @@ in {
           relabelAddressToInstance
         ];
       }
-      {
-        job_name = "alertmanager";
-        scrape_interval = "20s";
-        scheme = "http";
-        static_configs = [
-          {
-            targets = [
-              "monitoring-3.mon.clerie.de:9093"
-            ];
-          }
-        ];
-        relabel_configs = [
-          relabelAddressToInstance
-        ];
-      }
       {
         job_name = "node-exporter";
         scrape_interval = "20s";
@@ -152,42 +126,6 @@ in {
           relabelAddressToInstance
         ];
       }
-      {
-        job_name = "node-exporter-uberspace";
-        scrape_interval = "20s";
-        metrics_path = "/.node-exporter/metrics";
-        basic_auth = {
-          username = "monitor";
-          password_file = config.sops.secrets.uberspace-monitor-password.path;
-        };
-        static_configs = [
-          {
-            targets = map (target: "${target};infra") config.profiles.clerie.monitoring-server.probeTargets.node-exporter-uberspace;
-          }
-        ];
-        relabel_configs = [
-          {
-            source_labels = [ "__address__" ];
-            regex = "(.+);(.+)";
-            target_label = "service_level";
-            replacement = "\${2}";
-          }
-          {
-            source_labels = [ "__address__" ];
-            regex = "(.+);(.+)";
-            target_label = "__address__";
-            replacement = "\${1}";
-          }
-          {
-            source_labels = [ "__address__" ];
-            target_label = "instance";
-          }
-          {
-            target_label = "job";
-            replacement = "node-exporter";
-          }
-        ];
-      }
       {
         job_name = "nixos-exporter";
         scrape_interval = "1m";
@@ -218,7 +156,7 @@ in {
           relabelAddressToInstance
           {
             target_label = "__address__";
-            replacement = "monitoring-3.mon.clerie.de:9153";
+            replacement = "[::1]:9153";
           }
         ];
       }
@@ -243,7 +181,17 @@ in {
         };
         static_configs = [
           {
-            targets = eachWithEachOther (instance: target: "${instance};${target}") blackboxMonitoringTargets config.profiles.clerie.monitoring-server.probeTargets.blackbox-icmp6;
+            targets = eachWithEachOther (instance: target: "${instance};${target}") blackboxMonitoringTargets [
+              "clerie.de"
+              "tagesschau.de"
+              "google.com"
+              "achtbaan.nikhef.nl"
+              "fluorine.net.clerie.de"
+              "www.fem.tu-ilmenau.de"
+              "www.heise.de"
+              "dyon.net.entr0py.de"
+              "matrix.fachschaften.org"
+            ];
           }
         ];
         relabel_configs = [
@@ -275,7 +223,18 @@ in {
         };
         static_configs = [
           {
-            targets = eachWithEachOther (instance: target: "${instance};${target}") blackboxMonitoringTargets config.profiles.clerie.monitoring-server.probeTargets.blackbox-icmp4;
+            targets = eachWithEachOther (instance: target: "${instance};${target}") blackboxMonitoringTargets [
+              "clerie.de"
+              "tagesschau.de"
+              "google.com"
+              "achtbaan.nikhef.nl"
+              "www.fem.tu-ilmenau.de"
+              "www.heise.de"
+              "matrix.bau-ha.us"
+              "dyon.net.entr0py.de"
+              "matrix.entr0py.de"
+              "matrix.fachschaften.org"
+            ];
           }
         ];
         relabel_configs = [
@@ -307,7 +266,10 @@ in {
         };
         static_configs = [
           {
-            targets = config.profiles.clerie.monitoring-server.probeTargets.blackbox-local-synapse;
+            targets = [
+              "matrix.entr0py.de"
+              "matrix.fachschaften.org"
+            ];
           }
         ];
         relabel_configs = [
@@ -387,122 +349,6 @@ in {
           relabelAddressToInstance
         ];
       }
-      {
-        job_name = "blackbox_local_http6";
-        scrape_interval = "100s";
-        metrics_path = "/probe";
-        params = {
-          module = [ "http6" ];
-        };
-        static_configs = [
-          {
-            targets = config.profiles.clerie.monitoring-server.probeTargets.blackbox-local-http6;
-          }
-        ];
-        relabel_configs = [
-          {
-            source_labels = [ "__address__" ];
-            target_label = "__param_target";
-            replacement = "http://\${1}";
-          }
-          {
-            source_labels = [ "__address__" ];
-            target_label = "target";
-          }
-          {
-            target_label = "__address__";
-            replacement = "monitoring-3.mon.clerie.de:9115";
-          }
-          relabelAddressToInstance
-        ];
-      }
-      {
-        job_name = "blackbox_local_http4";
-        scrape_interval = "100s";
-        metrics_path = "/probe";
-        params = {
-          module = [ "http4" ];
-        };
-        static_configs = [
-          {
-            targets = config.profiles.clerie.monitoring-server.probeTargets.blackbox-local-http4;
-          }
-        ];
-        relabel_configs = [
-          {
-            source_labels = [ "__address__" ];
-            target_label = "__param_target";
-            replacement = "http://\${1}";
-          }
-          {
-            source_labels = [ "__address__" ];
-            target_label = "target";
-          }
-          {
-            target_label = "__address__";
-            replacement = "monitoring-3.mon.clerie.de:9115";
-          }
-          relabelAddressToInstance
-        ];
-      }
-      {
-        job_name = "blackbox_local_https6";
-        scrape_interval = "100s";
-        metrics_path = "/probe";
-        params = {
-          module = [ "https6" ];
-        };
-        static_configs = [
-          {
-            targets = config.profiles.clerie.monitoring-server.probeTargets.blackbox-local-http6;
-          }
-        ];
-        relabel_configs = [
-          {
-            source_labels = [ "__address__" ];
-            target_label = "__param_target";
-            replacement = "https://\${1}";
-          }
-          {
-            source_labels = [ "__address__" ];
-            target_label = "target";
-          }
-          {
-            target_label = "__address__";
-            replacement = "monitoring-3.mon.clerie.de:9115";
-          }
-          relabelAddressToInstance
-        ];
-      }
-      {
-        job_name = "blackbox_local_https4";
-        scrape_interval = "100s";
-        metrics_path = "/probe";
-        params = {
-          module = [ "https4" ];
-        };
-        static_configs = [
-          {
-            targets = config.profiles.clerie.monitoring-server.probeTargets.blackbox-local-http4;
-          }
-        ];
-        relabel_configs = [
-          {
-            source_labels = [ "__address__" ];
-            target_label = "__param_target";
-            replacement = "https://\${1}";
-          }
-          {
-            source_labels = [ "__address__" ];
-            target_label = "target";
-          }
-          {
-            target_label = "__address__";
-            replacement = "monitoring-3.mon.clerie.de:9115";
-          }
-          relabelAddressToInstance
-        ];
-      }
       {
         job_name = "hydra";
         scrape_interval = "20s";
@@ -529,37 +375,12 @@ in {
           relabelAddressToInstance
         ];
       }
-      {
-        job_name = "clerie_keys";
-        scrape_interval = "5m";
-        scheme = "https";
-        metrics_path = "/gpg/clerie@clerie.de.metrics.txt";
-        static_configs = [
-          {
-            targets = [
-              "clerie.de"
-            ];
-          }
-        ];
-      }
-      {
-        job_name = "nginxlog-exporter";
-        scrape_interval = "20s";
-        static_configs = [
-          {
-            targets = nginxlogMonitoringTargets;
-          }
-        ];
-        relabel_configs = [
-          relabelAddressToInstance
-        ];
-      }
     ];
     alertmanagers = [
       {
         static_configs = [ {
           targets = [
-            "monitoring-3.mon.clerie.de:9093"
+            "[::1]:9093"
           ];
         } ];
       }

hosts/monitoring-3/rules.yml

@@ -17,22 +17,14 @@ groups:
     annotations:
       summary: "Current system of {{ $labels.instance }} not in sync with config"
       description: "The current system hash of {{ $labels.instance }} does not match the one generated by hydra based on the current config"
-  - alert: StorageFull
-    expr: ((last_over_time(node_filesystem_avail_bytes{job="node-exporter", mountpoint!="/nix/store"}[5m]) / last_over_time(node_filesystem_size_bytes{job="node-exporter", mountpoint!="/nix/store"}[5m])) * 100) < 5
+  - alert: BackupStorageFull
+    expr: ((last_over_time(node_filesystem_avail_bytes{job="node-exporter"}[5m]) / last_over_time(node_filesystem_size_bytes{job="node-exporter"}[5m])) * 100) < 5
     for: 30m
     labels:
       severity: critical
     annotations:
       summary: "Storage of {{ $labels.instance }} is full"
       description: "Storage of {{ $labels.instance }} for {{ $labels.mountpoint }} on {{ $labels.device }} is full"
-  - alert: StorageAlmostFull
-    expr: ((last_over_time(node_filesystem_avail_bytes{job="node-exporter", mountpoint!="/nix/store"}[5m]) / last_over_time(node_filesystem_size_bytes{job="node-exporter", mountpoint!="/nix/store"}[5m])) * 100) < 10
-    for: 30m
-    labels:
-      severity: warning
-    annotations:
-      summary: "Storage of {{ $labels.instance }} is almost full"
-      description: "Storage of {{ $labels.instance }} for {{ $labels.mountpoint }} on {{ $labels.device }} is almost full"
   - alert: ClerieBackupJobLastSuccessfulRunBehind
     expr: time() - last_over_time(clerie_backup_last_successful_run_time{}[5m]) >= 9000
     for: 5m
@@ -73,40 +65,3 @@ groups:
     annotations:
       summary: "Synapse of {{ $labels.target }} unavailable"
       description: "The Synapse backend of {{ $labels.target }} is unreachable or returns garbage"
-  - alert: ClerieKeysExpire
-    expr: last_over_time(clerie_keys_gpg_key_expire_time[15m]) - time() < 1209600
-    labels:
-      severity: critical
-    annotations:
-      summary: "GPG {{ $labels.fingerprint }} is expiring"
-      description: "GPG with fingerprint {{ $labels.fingerprint }} is expiring in less then two weeks"
-  - alert: ClerieKeysAlmostExpire
-    expr: last_over_time(clerie_keys_gpg_key_expire_time[15m]) - time() < 3628800
-    labels:
-      severity: warning
-    annotations:
-      summary: "GPG {{ $labels.fingerprint }} is expiring soon"
-      description: "GPG with fingerprint {{ $labels.fingerprint }} is expiring in less then six weeks"
-  - alert: NadjaTopIPv4ProxyBroken
-    expr: probe_success{job="blackbox_local_http6", target="blog.nadja.top"} != on (target) probe_success{job="blackbox_local_http4", target="blog.nadja.top"}
-    for: 15m
-    labels:
-      severity: critical
-    annotations:
-      summary: "blog.nadja.top unreachable via IPv4"
-      description: "blog.nadja.top unreachable IPv4, but reachable via IPv6"
-  - alert: AlertmanagerNotificationRequestsFailed
-    expr: rate(alertmanager_notification_requests_failed_total[5m]) > 0
-    labels:
-      severity: critical
-    annotations:
-      summary: "Too many notification requests failed"
-      description: "Too many notification requests to Alertmanager integration {{ $labels.integration }} failed"
-  - alert: FemSocialDown
-    expr: min(probe_success{target="fem.social", job=~"blackbox_local_http.*"}) == 0
-    for: 5m
-    labels:
-      severity: critical
-    annotations:
-      summary: "fem.social unavailable via HTTP"
-      description: "fem.social is not fully reachable via HTTP"

hosts/monitoring-3/secrets.json

@@ -1,5 +1,4 @@
 {
-	"uberspace-monitor-password": "ENC[AES256_GCM,data:NfM9jxZAMkSGFlPYxreP7LJkr9gA2llyVw96okIKNUQ=,iv:z/LW643T36HpKo/xhHcVnF0EqhEXdoiEkDMH6NQzN9A=,tag:KXR2+kizv3To0EvZ66ak9w==,type:str]",
 	"wg-monitoring": "ENC[AES256_GCM,data:kYFhMbqL7b0rwE2XIaR4QVT8ahoODmpXKzK5gvkODFJVklubwCmq2bLJk94=,iv:eR+VjxdtS4et9I4okzHyA+if1Rxj2/MuiC0CrWXd0Bg=,tag:rMaYMTvO6gWw6WegehDBFQ==,type:str]",
 	"xmpp-password": "ENC[AES256_GCM,data:eBZsBYqo+juLrYZjBqTcKFirHViRsul+wt6kkOmMhCp4xU7Ou8eJAPCOuhvHcUGxRE44L0yIyUObhRgAj0T5QA==,iv:DsLJ3qCZyrdolJBZFT9FJUNQ75pc8Vz32K2a8RJHuLc=,tag:wOxs2Ulw1aSMadWfjGSKsw==,type:str]",
 	"sops": {
@@ -13,8 +12,8 @@
 				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxOGNMcm9vRWxMZjBwcmVS\nVGVoS2kwSmZjOHdGMXQwUmlzV3hhbGhhOVhzCkljQi94aUtORldKOFdqeVNXYnJQ\ndS9Vc0hRRisyL1dESk1NOTQ1dVJyMDgKLS0tIE54VlU1cVRXWXRlVGU5RzR5dXkv\nSEZJeElpWDdJYW9WNWxGLzdjdGR1YUUKGZwFPOc4MD97FBRtj1Py4A9Tz/HlzHcK\nX6nYgkYSUycM4g4d3+N+1NKutfWJ7KheuTlhNRDftyLYmmo5wyEtrw==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
-		"lastmodified": "2025-03-07T20:23:25Z",
-		"mac": "ENC[AES256_GCM,data:6GY06rVSKtQqaV5kLgTU4Wlu+e+dkNhxaPkJqKE8hrfJzO85WU6/iLvuv4ai0u+cUeWcOZatskzUeaVL/NjrRZnsNnxUqWbljLs8//0uUln71D/DWE4Vpb6Uz9I2iHG2Gftv3iyYF3nucrHiSTvyLzb9fDL+eGv0CHa/KmYk97g=,iv:f6xqDtHoBy7h7KRr2J0kYcaf6indqnRrJsYdcv9EHJs=,tag:uliCg2x92qY9SN9hg08Iuw==,type:str]",
+		"lastmodified": "2024-04-21T17:08:58Z",
+		"mac": "ENC[AES256_GCM,data:UucT7OiO9S3FcO9b1UKPQYXi7v3Ak7/J/VkDN4P9fssS4nky6PyX4oV5UvGcuR3p0pxLAHGJ4rOXj5QbnOqwDqmHfCnoqdItAlXRT1YPdSrelQ/gHyOfexsuV1XLOUS/OXJoYEi3ymKtza4rMIZow+du0YkRxrJQjwM0y8XSa3I=,iv:mDBaVhbHCLdxx5DC7urPPDdVPsCPYqKgLRwfqjLFdnU=,tag:Wpq6ihxIr/eceG12gpOJwQ==,type:str]",
 		"pgp": [
 			{
 				"created_at": "2024-04-21T17:08:30Z",
@@ -23,6 +22,6 @@
 			}
 		],
 		"unencrypted_suffix": "_unencrypted",
-		"version": "3.9.4"
+		"version": "3.8.1"
 	}
 }

hosts/monitoring-3/targets.nix

@@ -1,7 +0,0 @@
-{ ... }:
-
-{
-
-  profiles.clerie.monitoring-server.targets = builtins.fromJSON (builtins.readFile ../../monitoring/targets.json);
-
-}

hosts/nonat/configuration.nix

@@ -4,33 +4,28 @@
   imports =
     [
       ./hardware-configuration.nix
+      ../../configuration/proxmox-vm
+      ../../configuration/router
     ];
 
-  profiles.clerie.mercury-vm.enable = true;
-  profiles.clerie.router.enable = true;
-
   boot.loader.grub.enable = true;
   boot.loader.grub.device = "/dev/vda";
 
-  systemd.network.networks."10-wan" = {
-    matchConfig.Name = "ens18";
-    address = [
-      "2001:638:904:ffca::6/64"
-      "141.24.46.169/24"
-    ];
-    routes = [
-      { Gateway = "141.24.46.1"; }
-      { Gateway = "2001:638:904:ffca::1"; }
-    ];
-    linkConfig.RequiredForOnline = "routable";
-  };
-  systemd.network.networks."10-nat-netz-mercury" = {
-    matchConfig.Name = "ens19";
-    address = [
-      "192.168.10.1/24"
-    ];
-    linkConfig.RequiredForOnline = "no";
-  };
+  networking.useDHCP = false;
+  # Network
+  networking.interfaces.ens18.ipv4.addresses = [
+    { address = "141.24.46.169"; prefixLength = 24; }
+  ];
+  networking.interfaces.ens18.ipv6.addresses = [
+    { address = "2001:638:904:ffca::6"; prefixLength = 64; }
+  ];
+  networking.defaultGateway = { address = "141.24.46.1"; interface = "ens18"; };
+  networking.defaultGateway6 = { address = "2001:638:904:ffca::1"; interface = "ens18"; };
+  networking.nameservers = [ "2001:638:904:ffcc::3" "2001:638:904:ffcc::4" "141.24.40.3" "141.24.40.4" ];
+
+  networking.interfaces.ens19.ipv4.addresses = [
+    { address = "192.168.10.1"; prefixLength = 24; }
+  ];
 
   networking.nat = {
     enableIPv6 = true;
@@ -41,7 +36,8 @@
 
   networking.firewall.allowedUDPPorts = [];
 
-  services.bijwerken = {
+  clerie.system-auto-upgrade = {
+    allowReboot = true;
     autoUpgrade = true;
   };
 

hosts/osmium/configuration.nix

@@ -4,13 +4,12 @@
   imports =
     [
       ./hardware-configuration.nix
+      ../../configuration/proxmox-vm
 
       ./nixfiles-updated-inputs.nix
       ./polkit-test.nix
     ];
 
-  profiles.clerie.mercury-vm.enable = true;
-
   boot.loader.grub.enable = true;
   boot.loader.grub.device = "/dev/vda";
 
@@ -20,28 +19,12 @@
     "aarch64-linux"
   ];
 
-  systemd.network.networks."10-wan" = {
-    matchConfig.Name = "ens19";
-    address = [
-      "2001:638:904:ffc7::6/64"
-    ];
-    routes = [
-      { Gateway = "2001:638:904:ffc7::1"; }
-    ];
-    linkConfig.RequiredForOnline = "routable";
-    ipv6AcceptRAConfig.DHCPv6Client = "no";
-  };
-  systemd.network.networks."10-nat-netz-mercury" = {
-    matchConfig.Name = "ens18";
-    address = [
-      "192.168.10.29/24"
-    ];
-    routes = [
-      { Gateway = "192.168.10.1"; }
-    ];
-    linkConfig.RequiredForOnline = "routable";
-    ipv6AcceptRAConfig.DHCPv6Client = "no";
-  };
+  networking.useDHCP = false;
+  networking.interfaces.ens18.ipv4.addresses = [ { address = "192.168.10.29"; prefixLength = 24; } ];
+  networking.interfaces.ens19.ipv6.addresses = [ { address = "2001:638:904:ffc7::6"; prefixLength = 64; } ];
+  networking.defaultGateway = { address = "192.168.10.1"; interface = "ens18"; };
+  networking.defaultGateway6 = { address = "2001:638:904:ffc7::1"; interface = "ens19"; };
+  networking.nameservers = [ "2001:638:904:ffcc::3" "2001:638:904:ffcc::4" "141.24.40.3" "141.24.40.4" ];
 
   environment.systemPackages = with pkgs; [
     git

hosts/palladium/backup-scripts.nix

@@ -0,0 +1,44 @@
+{ pkgs, ... }:
+
+let
+  cb-mount = pkgs.writeScriptBin "cb-mount" ''
+  #!${pkgs.bash}/bin/bash
+
+  DEVICE=/dev/disk/by-path/pci-0000:00:12.0-ata-2-part1
+
+  ${pkgs.cryptsetup}/bin/cryptsetup luksOpen ''${DEVICE} external-drive
+  mkdir -p /mnt/external-drive
+  mount /dev/mapper/external-drive /mnt/external-drive
+
+  mkdir -p /mnt/external-drive/clerie-backup
+  chown borg:borg -R /mnt/external-drive/clerie-backup
+  '';
+
+  cb-unmount = pkgs.writeScriptBin "cb-unmount" ''
+  #!${pkgs.bash}/bin/bash
+
+  umount /mnt/external-drive
+  ${pkgs.cryptsetup}/bin/cryptsetup luksClose external-drive
+  '';
+
+  cb-prepare = pkgs.writeScriptBin "cb-prepare" ''
+  echo "Formatting disk"
+  sgdisk -Z /dev/disk/by-path/pci-0000:00:12.0-ata-2
+  sgdisk -N 1 /dev/disk/by-path/pci-0000:00:12.0-ata-2
+  partprobe /dev/disk/by-path/pci-0000:00:12.0-ata-2
+
+  echo "Creating encrypted partition"
+  ${pkgs.cryptsetup}/bin/cryptsetup luksFormat -c aes-xts-plain64 --hash=sha256 -s 256 /dev/disk/by-path/pci-0000:00:12.0-ata-2-part1
+
+  echo "Opening encrypted partition"
+  ${pkgs.cryptsetup}/bin/cryptsetup luksOpen /dev/disk/by-path/pci-0000:00:12.0-ata-2-part1 external-drive
+
+  echo "Creating file system"
+  mkfs.ext4 /dev/mapper/external-drive
+
+  echo "Closing encrypted partition"
+  ${pkgs.cryptsetup}/bin/cryptsetup luksClose external-drive
+  '';
+in {
+  environment.systemPackages = [ cb-mount cb-unmount cb-prepare ];
+}

hosts/palladium/configuration.nix

@@ -5,61 +5,52 @@
     [
       ./hardware-configuration.nix
 
-      ./restic-server.nix
-      ./wg-b-palladium.nix
+      ./backup-scripts.nix
     ];
 
-  boot.kernelParams = [ "console=ttyS0,115200n8" ];
-
-  boot.loader.grub.enable = true;
-  boot.loader.grub.device = "nodev";
-  boot.loader.grub.efiSupport = true;
+  boot.loader.systemd-boot.enable = true;
   boot.loader.efi.canTouchEfiVariables = true;
-  boot.loader.grub.extraConfig = "
-    serial --speed=115200 --unit=0 --word=8 --parity=no --stop=1
-    terminal_input console serial
-    terminal_output gfxterm serial
-  ";
 
-  boot.initrd.luks = {
-    devices.lvm = {
-      device = "/dev/disk/by-uuid/f5597381-b59b-4f19-94b7-fd69aac43d6f";
-      bypassWorkqueues = true;
-    };
-    devices.crypt-storage-palladium = {
-      device = "/dev/disk/by-uuid/c54396c0-b5d3-4e61-9ef7-483fa2b4a56d";
-    };
-  };
-
-  boot.swraid.enable = true;
-
-  systemd.network.networks."10-wan" = {
-    matchConfig.Name = "enp3s0";
-    address = [
-      "fd00:152:152:4::11/64"
-    ];
-    networkConfig.DHCP = true;
-    linkConfig.RequiredForOnline = "routable";
-    ipv6AcceptRAConfig.DHCPv6Client = "no";
-  };
+  networking.useDHCP = false;
+  networking.interfaces.enp3s0.ipv6.addresses = [
+    { address = "fd00:152:152:4::11"; prefixLength = 64; }
+    { address = "2001:4cd8:100:1337::11"; prefixLength = 64; }
+  ];
+  networking.defaultGateway6 = { address = "fe80::1"; interface = "enp3s0"; };
+  networking.nameservers = [ "fd00:152:152::1" ];
 
   # Keeping the harddrives quiet
   services.udev.extraRules = ''
     KERNEL=="sd?[0-9]", ENV{ID_MODEL}=="ST1000DM003-1SB102", ACTION=="add", RUN+="${pkgs.hdparm}/sbin/hdparm -S 24 /dev/%k"
   '';
 
-  profiles.clerie.wg-clerie = {
-    enable = true;
-    ipv6s = [ "2a01:4f8:c0c:15f1::8103/128" ];
-    ipv4s = [ "10.20.30.103/32" ];
+  services.borgbackup.repos = {
+    clerie-backup = {
+      path = "/mnt/palladium/clerie-backup";
+      authorizedKeysAppendOnly = [
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFyk716RnbenPMkhLolyIkU8ywUSg8x7hjsXFFQoJx4I root@clerie-backup"
+      ];
+    };
+    external-drive = {
+      path = "/mnt/external-drive/clerie-backup";
+      authorizedKeysAppendOnly = [
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPuh74Esdp8JPgIZzM372DaCwtAl2QNtRratnIFG0NRB root@clerie-backup"
+      ];
+    };
   };
 
+  # Disable automatic directory creation for external-drive repo
+  # The directory gets created by the disk formatting script
+  # Correct permissons will be set right after mounting
+  # This prevents borg from filling up the root drive when no drive is mounted
+  systemd.services.borgbackup-repo-external-drive.enable = false;
+
   clerie.monitoring = {
     enable = true;
     id = "206";
-    pubkey = "2Q8mO4Y09Oi9CCfUUvWpZ8yIQezwtE94tz6ZbA0EDwE=";
+    pubkey = "fHOYNZ5I3E2JPrd9dUrNBmu75weX4KbDih5q+GCk8Xk=";
   };
 
-  system.stateVersion = "25.05";
+  system.stateVersion = "21.03";
 
 }

hosts/palladium/hardware-configuration.nix

@@ -9,37 +9,26 @@
     ];
 
   boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "usbhid" "usb_storage" "sd_mod" ];
-  boot.initrd.kernelModules = [ "dm-snapshot" ];
+  boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ "kvm-intel" ];
   boot.extraModulePackages = [ ];
 
   fileSystems."/" =
-    { device = "/dev/disk/by-uuid/fbd14cd4-e402-4ad6-b801-8826d6cfc0fb";
+    { device = "/dev/disk/by-uuid/b217f1e1-1337-4ef0-bad5-15829ba32c7a";
       fsType = "ext4";
     };
 
   fileSystems."/boot" =
-    { device = "/dev/disk/by-uuid/8B45-EBB4";
+    { device = "/dev/disk/by-uuid/7A6B-3444";
       fsType = "vfat";
-      options = [ "fmask=0022" "dmask=0022" ];
     };
 
-  fileSystems."/data" =
-    { device = "/dev/disk/by-uuid/e7c41c4d-89d8-4083-ac6e-abbccbebf551";
+  fileSystems."/mnt/palladium" =
+    { device = "/dev/disk/by-uuid/f20d20ca-6be5-4b16-81fe-e66f31ffd108";
       fsType = "ext4";
     };
 
-  swapDevices =
-    [ { device = "/dev/disk/by-uuid/6ca5e48f-9b99-4722-b21b-c6f298610157"; }
-    ];
+  swapDevices = [ ];
 
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.enp3s0.useDHCP = lib.mkDefault true;
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+  powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
 }

hosts/palladium/restic-server.nix

@@ -1,20 +0,0 @@
-{ ... }:
-
-{
-  services.restic.server = {
-    enable = true;
-    privateRepos = true;
-    dataDir = "/data/backup";
-    listenAddress = "[::]:43242";
-  };
-
-  # restic rest server does not support --htpasswd-file in the current version of nixpkgs
-  # until then we copy the secrets to the common location
-  sops.secrets.restic-server-backup-htpasswd = {
-    path = "/data/backup/.htpasswd";
-    owner = "restic";
-    group = "restic";
-  };
-
-  networking.firewall.interfaces.wg-b-palladium.allowedTCPPorts = [ 43242 ];
-}

hosts/palladium/secrets.json

@@ -1,8 +1,5 @@
 {
-	"restic-server-backup-htpasswd": "ENC[AES256_GCM,data:ouHDwNJ3UQID54qq+6tEc9Zmpa/i5jDMvzIw5baBV4oGy27JI+f40A6tqmQlbRRsX68XhMhfRcpczfTDmf2tFV7TcWB4yA==,iv:PkjCOHFQxbBvYdmOhARJUNUUsAbJiEDnLDM1UWZhHXA=,tag:3cGdkx0xNdtse9hHPa9mUQ==,type:str]",
-	"wg-b-palladium": "ENC[AES256_GCM,data:VBDyrDYwICbiND8jfkiIr/3oDtP1X9817WhonFYXNSTPZHziEY7U886/DFc=,iv:syqo77FROChv4WKgiGWCUa2ziH2Ds14CT5vVRxGmEvQ=,tag:X2G3JUrabXYmsKPBltOafw==,type:str]",
-	"wg-clerie": "ENC[AES256_GCM,data:fLGZCRbnDrSWQ+9Q/7l3DUKOgw7blcHpd8svHMZFEKMoTfGeZCc37oKAOKU=,iv:GlPXkeVnzSzAnpdSGIydZP+hhEshJ3X/N1fhwJk5Ol4=,tag:0E9RhBPha0Gun6KUNtvYUg==,type:str]",
-	"wg-monitoring": "ENC[AES256_GCM,data:3RHk/VI8t9ba/qiWqLkwIxaOt+e0yXw7+f1qpIVdr3JE2NzkVvX6aeP3o2Q=,iv:f4VIK1oyaUilCia1EfEiL18a3zk4+7Ol4ihyhzPounw=,tag:XeTI3iL4qIPS+Z+PDJRGrA==,type:str]",
+	"wg-monitoring": "ENC[AES256_GCM,data:ip6L61RXAVxaPqizhNTr6zVvKgd40CAsgeNFoAXMARM1nl146ayHK2q7mhc=,iv:G4WLmcPpJOxTcW0bHuEwWmth6u8fYoH7GmpkMo8Z3TQ=,tag:xJ+wCVEUMdqfXPcwgr9WSw==,type:str]",
 	"sops": {
 		"kms": null,
 		"gcp_kms": null,
@@ -10,20 +7,20 @@
 		"hc_vault": null,
 		"age": [
 			{
-				"recipient": "age1s3f9hxcd89dk3st2r5funjw7cjcq85nuz4gq8w0aplky9v2wqy7qwukagx",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpY3p1Mi85WTNxK2U5bFVP\ncmlFRXNlK2dWMUt1eW1abzIrb0liR043VHpnClIvaHZ1VWxRSFR3ajc0MmJyMFAw\nSWdVclB2OGJqUjNXTmI4MktXVTVQbncKLS0tIFpJTTZJRmJGeE1xNFFScE81R29J\nR3MzOGY1cVhmalNEaHdyWjkyaHVRTDAKXyz/+WdHsC2AppYNf3/W1xx2Zcfg4p50\nCAamBntNMUK8zYLdhoSBT54qVYJJuYZ6eD6WOIZrdCK4HKGy0d13uw==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1tl2cd730ctn6jcgg0vf8c5gg9722umk30zwvcwxhejh26p3gt3ds92msyx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsNHllOHpoYkNyQXMwL002\nRDR4eFVRemc4bW8vYS9GWHFkcmpRbWFFc2tzCmFjV1ZNTzhOYjM4VWltRGhaQ0RP\naC9vN2hrM3NSTDlSd1ZJTldXamJ4NUUKLS0tIDFuUzRKWWQrUFU1SXNqdEV2R1lM\nWXU1by9rYTBINTVralo0TTJmSEZHMm8KYEggCHnOyMcQSdJ9+Ujf61OANuja0ZIf\n+wa9ugc2OZrOYepkjN5X/bETdKfU33pIAL208N9HcOttfhcZq70yUQ==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
-		"lastmodified": "2025-04-18T08:56:54Z",
-		"mac": "ENC[AES256_GCM,data:QEEcjNqO+tXpl/4TWx+r8WT+ZsdoBw/CBiz6XpG8rsIl0prBWtQ8YW/DeYAxLPMOlb55HuDsneLEpR2DsBB1x6b0lSyjES/hgMRkweKczFLRxrhHh3qXff/wK9sDaEPLvEzvH99x63+1dAZh7z8CVESDTt8QLKK1qCxOf36QNdc=,iv:NbYc0qz0AUGKWpwKg/1QCuTnZ1+m+e6tQxWAuDogVrw=,tag:JEPtLP7V3N+Lx/quMGq/AQ==,type:str]",
+		"lastmodified": "2024-05-10T13:25:28Z",
+		"mac": "ENC[AES256_GCM,data:fLw0q9h+rlAAiXjtCJeGPi0COEt/UvApRiOpE+ydSrD/jXy+vh2OVW57UZPRBCP1mWtqfUJLiT1BZyOWor7dsPfTvaxCQmYhGcKBLucFEaiUovGgVjxJloD8hDJvSG9SJnlIiDobMsG87MsEWpi70oAbQu3/d4JT1BPSaRpvsjI=,iv:iS7tFqZMa0OzA5ASKPS6CSNTJYYJ0zhjLmBcipjLapg=,tag:Lspazw8Pi5Dxqcrk35A6tA==,type:str]",
 		"pgp": [
 			{
-				"created_at": "2025-04-15T17:32:56Z",
-				"enc": "-----BEGIN PGP MESSAGE-----\n\nhQIMA5OzEzXewpmPAQ//aQe91iy/RiR2PJqXhrZVyovraUmm4ivCjPSoookMCHhY\n5HGNdyzttnBjzHNqT8OFo43nu1VPlOYllgQXNbwEj7rSQN5CZQTx35Fhkc2q9q1N\ns3uI+o/RfCLiZMvr5S80lFvmw25hpopGoF0i3sHrORbh5ennzGV2Dsn2RfcQx5Ji\n11kO4QBDNs37cqZEBP4N4R5xEWFMrWPqxVrRuGZkzxR0MPLy+zCSjic0OIXWxi5G\nSTO3rPGn06s3gbMmFgAPVBMR/nyT2kPDwQFbvv7SWNqnyZ1z5S5C7eSpcEa+49IZ\ngHo3hRa0O30bvgc+yhQ9TxhyFmlgk+HWRsc7p1c7B+HK+mwxxnoixfHQLpWEwiQz\nfT32rTG/v4MqNokiyMCvUqffGwBy57YQ0Koggm8kv3GYPbCSXFuGgdxBCUufaIkj\n5n6WmMfjESOEq0+wRw1FZPp6hl1vtCpldlYqm7raOWyzncULvPKbD8AHj7g0QgP/\ndmcVV2ca1V3vklb+FsuiUOJDkGnvue+uUjQ2f/t4JqLYy1dHlfPSX3X+WEJ4U/Nw\nZtpPb7XdgbWLbcDUTpEUGMhlnrLhdjt9w8iDKjZ+kN95fFfR9J4jTyUANIHd0sW1\nuLGphdWX62nmldEIJeselBaVhwiv5qQduNCdDssgZaMlmmdvZUHiABYh8rqKByOF\nAgwDvZ9WSAhwutIBD/4kxHpGFsX6wsP5dfJHGbh6dakqXjidwgkfbgq9eWd3nM9B\nYbmUZNz4vjdWGFIg/zitxpV6SRHItPPLkF0HEqecKrwBC41iczkMTXJsCN19zCEG\nGyMFtiTgYrkLZiN3yMViKbv5sOwm+38dQCE3tL6TZl8Rqi2Wm390DQ/dFSJSdJFb\nLZmOEvUkyChFvS+C6aCIsChoPSRnoqpxzrpJLoozS3EKGb5hKa7SN7zuSyNbUJgR\n4DaruQGNbbSKmInsigqJWtlUbJsYxbOxRGojw2waMRHEvWJfIN6NdsFuCBCMqHA7\nsil+siC7BXqef7nD9UcsjVBPyl7UAtvBAvWpfA83vYwtvSCR8tBPZ7EifyOWplfS\ntdJQFDd14ZGs/kO6j9Ck5d49Y6NuPEfa+wjs8vZGBevWGiErf+RlN7yYRLmX9pr1\nR72U0jC5rhA7+X1JZHEx1DdpNfGDj8MUokXf82aTzQPpOJPPUXOnJP9a6oHFW3Uv\nWmfTSjVbw//B9i/KM5XmVNgp3TyNZmszU36d79W23tnNQhSFpLNz4E/yr+vhvoO1\neowV8gi0BYxNGnUeM+QOFxdvoW4pNyTwVGFbqrJ7xY0m2gYiRpjxf1qpAP5pzm4Z\nrc4c+en8/71oI3Pt2D1IOHMA1VoJbemCxQKjXMb45RJxtSMZTX6kUMeWgXFLvIUC\nDAM1GWv08EiACgEP/RRLSlzAyA297eWSKzDehvMeuf3XL6EgwGo3W4VUjFQLy/k7\nzgJyzmClLaWxoUnhJY26ciaUVX5xzlyamzsuOk+S/Ke/UxHctFhT4jiSfpCj7SJU\n5E+fl4Q1vaH9CwolP/TppYRHw2PrBFHw62+/5o5PzOuSnOQ9M1Yen0sEv3aK1FYb\nCH5lDD12eZ8Qn+aTQUc4DfHGYUZckKp/yWSOYA3/O80bIimSYWjq73CclNQMXeXU\nE520z43xKArHcmbSVcJhxH+tkG+BNJ16l5XQaiKK9p9LlkPyouVvSmedXLsKdt4U\njYGywDAWh39UiepzTNc8I26eM4XcbDZjfF2D9EoNttTXWaHQpIyP/DyzJwShpVGF\nj5l1FmiCXvBxUXUJHP+4ONRtnEjMTQB/6IMWQJ5etVku+8eFRAqrn5J9B5w5/qqj\nf+99lXlORQXo9RDSANinCn6l/zORCUmNqgqfjnuVgsFPJFnUycbyzFsPgZXyF83H\nc/bqAYkjqSlMWzNuhOTgHuDJzt/SPhmbJXJmBH/ZKR52lQRlYonon9+hNE6Ti1aP\nBUdxIpMl89Cj8IPyg24cWlRIRGssIR/7e2iim76lH8VY5QT0M3qUye7KOtKOiJv/\n38kIftzORJ4PQwJnSl2TFqjs/mYSHEx0xc3WednF5ZCDicMYTjkePKJRMHuT0l4B\nYc0BSK8isG7x9SUNSxXUrb26d67ABWRmik+K+B9o7HeQRbPQuPV65m+qBxVEueVu\nYTi+79/6X2pmj/54NbN6Lqaj9SPthnhyDUrduulMRQBvxC2n9gVQ/+UnxEMy\n=Sp14\n-----END PGP MESSAGE-----",
+				"created_at": "2024-05-10T13:25:16Z",
+				"enc": "-----BEGIN PGP MESSAGE-----\n\nhQIMA5OzEzXewpmPAQ/+KsEUiNCgfajBMEEFsqHqNG3utLNQSLOd6VX/Rk56CjT9\nUtfiCdZCSzrtyT3Anu72auTJ+PHNAVhhHPcDiUcwY9JYXEXNETzEn0U/byS+kvOD\nNTpcpR1gSxJCj1aDqDDpfQQ02hSpKO4iw0B71gKcekUXcD2AQeeW0Djq60CusWVk\nRgC3odnyTr1CN1+JRtKVZKIa78rfOkyhmFP2G2gvsSHhUBd5RtMhJdfYVUTMIKXO\nQFB2IGCoIzE0zDitCcAZ8q6Dc8lBuAvNSiVkFanJn7e7etU3JwDhYsZKRO7jvNX3\nmjHnQ9vf0idCWAi0oabZQ1OGdwPbtjssxmQkzzR8R/paw+iRB50i1UG3/5ehXTV4\nTp/2rEwrsF8jO1bahTcrJirR7RPLEy2BvJ4ALzmEYrIoEwWuCIexrY+e2C2rXpy5\nK2+9Ch0YCaz8sc700bgO5ZkyvnmnbVJxGCaMGQtT9LXiEWvc36sUXhbEGJ0K782Z\n7uVFRs4xWsrUQHo8lFTfW/vLZDq7FvkGnDf5xnoEJp4BNYvYmMmsFiaygkbbqEdH\n2aHRCam9q5zcuBq+aA40KI1P4adIFgij+fijwQ+019JrfaMEXcmwgtOfkb2OZNOF\nXQ3tRgYLaxSae7BYJA4uTaFq60kpp1c8qgxw3WKPEiHywtl/SaPcx1XD9VJoVTGF\nAgwDvZ9WSAhwutIBD/9O0inQ/HmpwtD1AnE89SuZNuGQty71LVhX2PQQWsUdQOuz\ndKZN1wy6UxIImFGisBodUH+48k1DjbkDjL5cLSAUOt9OhAxW2Ubp6HA6wDJPqWj1\nYQMHKmHlf2zh5G1qTUXV3NNw6hSaWejVDS73WNODv1WfUFXrPN9DVLaPsS/RJo2Q\nAoDG/iedeQhIIBwrLIcQ8ttjv9MTI1GzsNRC/CjxQpDnHabqQzFzenjnVRLDXcmr\nwfw0HeTPeNh+pLYb+sBqzGUP0j1GWui99/6NUeo/TloBWJbIung4wq23gYZbHn+K\nbWJSxSy980mvjCXiRukzXlNJMwLZDVoBlPQSbe/pOApHM9HTScZ+3VcLlYOPjgZk\nhnCvFNm+4/00ZgF+tcvLOugIfqwxvOuqW4gGGhNAycHinJZuSfDHYe6zCfEiqc7t\nnHlbhNvlhC8zDu+fOurC2ju5eGv8LqFiobfsBFVdKpl9Gj7yg00S+QmjBcz0lkE9\n1BftwEQaj+r4EDa4cJHSgP+K76utv4Xzt9hHZZJo7hvii+lGxFI7rBm0xbV5bSuY\ntOhN6d98HH2++AoXufIW5vmnydGk2NXu7O8vi6sQWzoqed84ZHbJDWLQawQ8YQlR\nkbht2PzH4+rq1oOVHbLslxWkYF9WMsQRUef6ALNpys/Dj8N54gEN4RTV+SxIVoUC\nDAM1GWv08EiACgEP/1eiG0aASQogSByxl8ZbRjRg768YVR1fwTa8GG5tE7wfcGiI\njZF2TI+yQWt7gRS4AKNm1gfWEEjCH1tBOj53/Wfwn9ZuGoNqboA2jgsh2rnVVSXR\nOdXK3is/FMh9JREr669be83nnQ8fNP8nIz3snEvKVYVGcdsdkDXBz4GKmJx52NNb\nauL+4w14/0PydCVH/njsFY8FyWqP9lUFgpJU8jHjX28oTB3khwWrDs0THwqilTFn\nhFjgeCy555zeh5rDpBDPdPbLUNd094RB15zaKzn2dC15F8DMCLoA9ASNET7S/+u3\n1SjvI4XnOpxK9hyETcwjzbWJc2gV7U38VqxhQW9Vch3AvXOufMMTm6cobLjiwxjF\nl3XTMJ5GvHDZXCwrGEapy9GbHQjbd9yi0iFgfSGV4nkNmCj1jtAMUngdCqELDVU2\nZe3a8IeJswlTteGlXAM5mwnDaegMsiD/vwsq5Rtl0gs3iI3uIN4RFXuvxP+UeJ/c\ndJWqpF8vcQI4qGN3kxgB30I7mUiz1aggv5uw6nDWRJHTQKLeOkV8ssTq4FLs4XYL\n4z4qmMT5i+8bGu575py/LRDjvXBldeitnQj1jAN2y/uPNVWsZqU3S+OkEosYIgSQ\njAe3N0EyH5k3j7j43x91toYOCAkulAuPkox6GyUKKq4dCPWxg9fqQ8u4PaSN1GYB\nCQIQ3+GP0DNWupTIkTS4Bk1LwbT99lyr2DyExqb2pgXmzn05Qs6CE4+jcIxXnmUQ\nzCl6PLiw+DJ1nq5gKtTrkO96HtHGyfPiUunDZXty1/zNltYjedk7ebkWF3LNXBhE\nK38c6yE=\n=w0Nn\n-----END PGP MESSAGE-----",
 				"fp": "0C982F87B7AFBA0F504F90A2629E741947C87928"
 			}
 		],
 		"unencrypted_suffix": "_unencrypted",
-		"version": "3.9.4"
+		"version": "3.8.1"
 	}
 }

hosts/palladium/ssh.pub

@@ -1 +1 @@
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF0ZrGvZqxqsGEl2+YNnL5JNpeRc3y0DgqZAkuayfeso
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBc/YTf80MjyVeApOecOlxORIlwCaWtJNWtfggc0B374

hosts/palladium/wg-b-palladium.nix

@@ -1,38 +0,0 @@
-{ config, ... }:
-
-{
-
-  sops = {
-    secrets.wg-b-palladium = {
-      owner = "systemd-network";
-      group = "systemd-network";
-    };
-  };
-
-  systemd.network.netdevs."10-wg-b-palladium" = {
-    netdevConfig = {
-      Kind = "wireguard";
-      Name = "wg-b-palladium";
-    };
-    wireguardConfig = {
-      PrivateKeyFile = config.sops.secrets.wg-b-palladium.path;
-    };
-    wireguardPeers = [
-      {
-        PublicKey = "VstE42L1SmZCIShH5sOqcpVQOV0Xb9cFgljD0lhvKFQ=";
-        AllowedIPs = [ "fd90:37fd:ddec:d921::/64" ];
-        PersistentKeepalive = 25;
-        Endpoint = "backup-4.net.clerie.de:51844";
-      }
-    ];
-  };
-
-  systemd.network.networks."10-wg-b-palladium" = {
-    matchConfig.Name = "wg-b-palladium";
-    address = [
-      "fd90:37fd:ddec:d921::2/64"
-    ];
-    linkConfig.RequiredForOnline = "no";
-  };
-
-}

hosts/porter/configuration.nix

@@ -4,51 +4,22 @@
   imports =
     [
       ./hardware-configuration.nix
+      ../../configuration/router
     ];
 
-  profiles.clerie.netcup.enable = true;
-  profiles.clerie.router.enable = true;
-
   boot.loader.grub.enable = true;
   boot.loader.grub.device = "/dev/sda";
 
-  systemd.network.networks."10-wan" = {
-    matchConfig.Name = "ens3";
-    address = [
-      "2a03:4000:6:48d::1/64"
-      "5.45.100.191/22"
-    ];
-    routes = [
-      { Gateway = "fe80::1"; }
-      { Gateway = "5.45.100.1"; }
-    ];
-    linkConfig.RequiredForOnline = "routable";
-    ipv6AcceptRAConfig.DHCPv6Client = "no";
-  };
-
-  profiles.clerie.common-webserver.httpDefaultVirtualHost = false;
-
-  services.unbound = {
-    enable = true;
-    resolveLocalQueries = false;
-    settings = {
-      server = {
-        interface = [ "127.0.0.1" ];
-      };
-    };
-  };
+  networking.useDHCP = false;
+  # Network
+  networking.interfaces.ens3.ipv4.addresses = [ { address = "5.45.100.191"; prefixLength = 22; } ];
+  networking.interfaces.ens3.ipv6.addresses = [ { address = "2a03:4000:6:48d::1"; prefixLength = 64; } ];
+  networking.defaultGateway = { address = "5.45.100.1"; interface = "ens3"; };
+  networking.defaultGateway6 = { address = "fe80::1"; interface = "ens3"; };
+  networking.nameservers = [ "46.38.255.230" "46.38.252.230" ];
 
   clerie.nginx-port-forward = {
     enable = true;
-    resolver = "127.0.0.1";
-    tcpPorts."80" = {
-      host = "baikonur.dyn.weimarnetz.de";
-      port = 80;
-    };
-    tcpPorts."443" = {
-      host = "baikonur.dyn.weimarnetz.de";
-      port = 443;
-    };
     tcpPorts."2022" = {
       host = "nonat.net.clerie.de";
       port = 22;
@@ -58,10 +29,6 @@
   networking.firewall.allowedTCPPorts = [ 80 443 ];
   networking.firewall.allowedUDPPorts = [];
 
-  services.bijwerken = {
-    autoUpgrade = true;
-  };
-
   clerie.monitoring = {
     enable = true;
     id = "102";

hosts/storage-2/configuration.nix

@@ -4,40 +4,22 @@
   imports =
     [
       ./hardware-configuration.nix
-      ./em.nix
+      ../../configuration/proxmox-vm
       ./firmware.nix
       ./mixcloud.nix
       ./syncthing.nix
       ./users.nix
     ];
 
-  profiles.clerie.mercury-vm.enable = true;
-
   boot.loader.grub.enable = true;
   boot.loader.grub.device = "/dev/vda";
 
-  systemd.network.networks."10-wan" = {
-    matchConfig.Name = "ens18";
-    address = [
-      "2001:638:904:ffc0::4/64"
-    ];
-    routes = [
-      { Gateway = "2001:638:904:ffc0::1"; }
-    ];
-    linkConfig.RequiredForOnline = "routable";
-    ipv6AcceptRAConfig.DHCPv6Client = "no";
-  };
-  systemd.network.networks."10-nat-netz-mercury" = {
-    matchConfig.Name = "ens19";
-    address = [
-      "192.168.10.35/24"
-    ];
-    routes = [
-      { Gateway = "192.168.10.1"; }
-    ];
-    linkConfig.RequiredForOnline = "routable";
-    ipv6AcceptRAConfig.DHCPv6Client = "no";
-  };
+  networking.useDHCP = false;
+  networking.interfaces.ens19.ipv4.addresses = [ { address = "192.168.10.35"; prefixLength = 24; } ];
+  networking.interfaces.ens18.ipv6.addresses = [ { address = "2001:638:904:ffc0::4"; prefixLength = 64; } ];
+  networking.defaultGateway = { address = "192.168.10.1"; interface = "ens19"; };
+  networking.defaultGateway6 = { address = "2001:638:904:ffc0::1"; interface = "ens18"; };
+  networking.nameservers = [ "2001:638:904:ffcc::3" "2001:638:904:ffcc::4" "141.24.40.3" "141.24.40.4" ];
 
   services.nginx.enable = true;
 
@@ -52,7 +34,8 @@
     };
   };
 
-  services.bijwerken = {
+  clerie.system-auto-upgrade = {
+    allowReboot = true;
     autoUpgrade = true;
   };
 

hosts/storage-2/em.nix

@@ -1,17 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-with lib;
-
-{
-  users.users.data-em = {
-    group = "data-em";
-    home = "/data/em";
-    useDefaultShell = true;
-    isSystemUser = true;
-  };
-  users.groups.data-em = {};
-
-  systemd.tmpfiles.rules = [
-    "d /data/em - data-em data-em - -"
-  ];
-}

hosts/storage-2/users.nix

@@ -2,5 +2,4 @@
 
 {
   users.users.clerie.extraGroups = [ "data-firmware" ];
-  users.users.frank.extraGroups = [ "data-em" ];
 }

hosts/tungsten/configuration.nix

@@ -1,38 +0,0 @@
-{ config, pkgs, lib, ... }:
-
-{
-  imports =
-    [
-      ./hardware-configuration.nix
-    ];
-
-  profiles.clerie.network-fallback-dhcp.enable = true;
-
-  boot.kernelParams = [ "console=ttyS0,115200n8" ];
-
-  boot.loader.grub.enable = true;
-  boot.loader.grub.device = "/dev/disk/by-id/ata-InnoDisk_Corp._DRPS-08GJ30AC1QS-A88_20120705AAB200000505";
-  boot.loader.grub.extraConfig = "
-    serial --speed=115200 --unit=0 --word=8 --parity=no --stop=1
-    terminal_input serial
-    terminal_output serial
-  ";
-
-  networking.hostName = "tungsten";
-
-  profiles.clerie.wg-clerie = {
-    enable = true;
-    ipv6s = [ "2a01:4f8:c0c:15f1::8112/128" ];
-    ipv4s = [ "10.20.30.112/32" ];
-  };
-
-  clerie.monitoring = {
-    enable = true;
-    id = "216";
-    pubkey = "bDmf4xndBNwzcvIGCMq6dhyzjdEZOV2ckhv/37V/PWg=";
-    serviceLevel = "event";
-  };
-
-  system.stateVersion = "25.05";
-}
-

hosts/tungsten/hardware-configuration.nix

@@ -1,46 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
-
-{
-  imports =
-    [ (modulesPath + "/installer/scan/not-detected.nix")
-    ];
-
-  boot.initrd.availableKernelModules = [ "ahci" "ohci_pci" "ehci_pci" "usbhid" "sd_mod" ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ "kvm-amd" ];
-  boot.extraModulePackages = [ ];
-
-  fileSystems."/" =
-    { device = "/dev/disk/by-uuid/7ed9e29c-d771-49a1-ae8a-8894f347c648";
-      fsType = "ext4";
-    };
-
-  boot.initrd.luks.devices."root".device = "/dev/disk/by-uuid/95122f15-5621-457c-972c-c057ca416212";
-
-  fileSystems."/boot" =
-    { device = "/dev/disk/by-uuid/02a2afe4-ee00-4d3d-884a-e195b9814bfd";
-      fsType = "ext4";
-    };
-
-  fileSystems."/mnt/storage-tungsten" =
-    { device = "/dev/disk/by-uuid/3d386e15-9d64-42a6-8d6d-571272d5e78e";
-      fsType = "ext4";
-    };
-
-  boot.initrd.luks.devices."crypt-storage-tungsten".device = "/dev/disk/by-uuid/e4142245-4c69-42e6-9b1f-fa4dc7fef7d8";
-
-  swapDevices = [ ];
-
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.enp1s0.useDHCP = lib.mkDefault true;
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-}

hosts/tungsten/secrets.json

@@ -1,27 +0,0 @@
-{
-	"wg-clerie": "ENC[AES256_GCM,data:OtSzmacWH9leDuykr7Tp5lR2FDoNGQ61V/9z6xBD1eCDSLOvt8UdILMETJU=,iv:NNGqR7UG3bZWETpZRwEdS4O1nRO4cBT72fljpqSbtyc=,tag:mea+5E8B655ljRzk63IDOw==,type:str]",
-	"wg-monitoring": "ENC[AES256_GCM,data:+k7ATUbPnEfb4O4lUs8d4ZlvMPlsxC5mrCi1bXOje47XDcpioDwzRTQNPrU=,iv:p4JdSMbBcb/8Uh/9RuUSs64VBRQJHu6k5FB50UsxXVU=,tag:NRyBs1CO77AV4CbD6a6gig==,type:str]",
-	"sops": {
-		"kms": null,
-		"gcp_kms": null,
-		"azure_kv": null,
-		"hc_vault": null,
-		"age": [
-			{
-				"recipient": "age1dvl2pylf9vs4vt27g8z8nzpuwt88zl5fj7a68papsmenze7gd3mstyalks",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkOGRQMDhycnViTVR5M1Aw\nbjFGbXBINTJsTEdKU1ZoMDVIMUQrU1R2M2hFCk9XY0NxMlZoZXJhMVIvZ1hLUXJt\nSVdzWEpraGc3aUFBUWU2Uk9WK2J1cncKLS0tIEZPUVY1V2Z0RDhJR2VweVFsZnY5\nREp1cERaVzcrTTRhL0tpVWpMc1pCdWcKB3ZbqB8tGdXgXra3fRL/gw4IEpNHBqp+\nKnw9XYYV2MDiL02+HF+bABVHbjngG85EGDRTDZMWnJtlxV4l+vzTVw==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2025-02-25T17:46:27Z",
-		"mac": "ENC[AES256_GCM,data:EvbkM81pIqbYkvcBSWtyov5GN8D0PauWAiMmRYgWl2fijlH7zEpsCh0XU544prqpb7vh8ShAuCecVpWsdWUIAIT62ToB28NdefDhX2HDl4B1XeIy2X9i+jhnaXLjbwc+r8IhTHOJ/uWeVrNQyb4g9nOaijzDGVJbwKnJ6M+O7fU=,iv:WAIwdemTsTHLnGtFtg/KgyjId3+RpivNDc1LFZjG3jY=,tag:YmaYFT9smKChwd5vVisfLQ==,type:str]",
-		"pgp": [
-			{
-				"created_at": "2025-02-25T17:27:17Z",
-				"enc": "-----BEGIN PGP MESSAGE-----\n\nhQIMA5OzEzXewpmPAQ/+In2YZByknfnhl2zYmOUTQCrjpiyXbf8/ai0Ko8TZZCRy\nhrpxyvKP+/u7CMS+giouoxKJ4XLDbHacoz06qF1I9i9iSVelXxQ5epSHk4BLLocw\nP5S6ZnE3jQO4G5goC/LU7nARN2IMwYq2rRZe8o8SLDMTZqGnlk9vBihcE4rN4lpd\nLbSb+cT6wDba32xKNZuP9IRPU2gqjOAg99gbh7Se2zB4Q7AxpgUl6EZZ7OMqVl/C\nbgSQFgwJxFPoH8KBS4wICbHTyWGvg2iEQyh1zNElUwbW112kyfBxGHKFukfEapIj\n2Cv0+Jme3VA750rZmJ4xcOZeoz0n7THBHdFjE122dkXhUdkQmohKzjngIZySUqDI\nuaDf43ebi6tPgCdC6gKLbYUUml+WEOmIRcgmIEswG9iRF/vjOYLK9OxclAKLDDar\nN9zgRFW1qR0HZhAbC61L1CqhKZzjQpNpjYn2pwmR+NnU/DDrlSdJLnHnrMdPeG6l\nBVp7oLhct2DwrypEYOvccrEwRakJSjCyC6cPWbUv7upjovTvcSAh21XNLnHJaMsY\n+sbJf5vshnALIkEXRyMBa5to7RZQvWx9qdklykjbXUEheM9RQATjGdnFQHuM05LI\npWKX038xlEaPe4nJa4PBGub23GZ1zuP3zE+N0W4XTR3r3ZGsMncqntiPJaaBgzWF\nAgwDvZ9WSAhwutIBEADMfdHvINLP6Gu7/DeLUboRnTHpP8x+rfTy9lcIW2RmQHbz\nLeAwBbeqyvLUi9ObjwclVWvPHqbPyGwibt96mTgGnkAEwXCgcXfWz/vCRZ0UHcvT\nimFM4H+ecOKws7t+sf31PAMPE0eSSJIYXVU9pej0qaKzR3zMBvQi6CsB0F1e2Fkz\n0HbilJMELaKFbJJsTXtDyl9Afi8OtVcBoG8P/1ImM/gcJLU548WTwPtzYUufHt5q\nkb45PjEId3m/g6CF6nh4GCQtRwOWjah49Zsk5cuI1aO/Q0gPyndgzFL5fYOfPlGN\nPTQ2KFMUh1dkvVVzyNFFC1vqXx2KH5l2gdTRkzaFQ3Qjjx1kluM5AlEl2Ynx4sbQ\nVaFZHFjQnoFtDn08BzNS7Cu/5SOdXejihen4sg0bGjEz6aVGwHXQJcp0BigH2y3f\n/OtnCK5KjFSQsdgTV5trstQgFQMqbMiVEqd3u+3lTxGJ/dQ7NXerFroITUC4J3Uu\n3VRdWTlgPED8hiA1NQaOiy2bbMzAgaR86qHK6JhxnP/6ETaByPPb27Oisblhhq9p\nCDw4eNGws1WsAyjZkyatzLZwUs2zOt4ZKjDlim8EikdGJpDcHnameRtI97QgPDO/\nzA5zHMrDuMN1iMw92WIAQyEQtJgyy4m3YvUsnlpHqKOgSNpwG/8j1zXHLH2p1IUC\nDAM1GWv08EiACgEQALEoa50qGjadZkaHI2tXFVv8RF1d8nR+L946DyMImjuMObei\n6Sx/Nc3bHzHSMsf27T120EUU0yUERdncoOQTRWBemMoB6tWYGTIAG0uDhrHl6rzW\nOUC5G7023H3cHStXbFFBp+JargnE1XgcapHM0p29GgUCE21UDBXzm7MB6x+9AKdd\nsc6qXD1xNPWc7RSqLL6anvcT/eLZW5Y1Ep2T7r5gQ81Fbxh4RicCphmApDC91Dii\nfZ/Va3JUeFm/82edeE4FqJUO9Akk2sPmVnXBYWPRq55/Uyk61J8u2b8tY7OcLSmr\nw/eaJq2bgDda3MBVzF3G9nr3BGhl8g7lCSCPS3gCFfs7C3Djp/YP0L8rMsH2ym1Q\nEj7rWC3K1xwtqowDx+EcYDMwmUtJqkia6o3WVM1qJM25QuCg2mnv9anMTgWuLpQo\nk1Av4FR+zV6aK3A7mxxjG0BsSUGjrrzoJC5DV1DSZ335lqlZxmthJoF0mda02nbh\nUlzpHEpG3/eWXjfDSbEYU8iVK2HWX9/i2gnXbpREuEnt5xpuSQ/sBT6tmit1FwK2\ntYZ+wtCMjWKkeZtvbP9Fx0nLYhVyMXvLhR1VLosCymKqWCIBj8VINagmPLiToEMd\nfpVs8m35neD4258CZOvBgqFvmxlGb9e27p8PHmlg9UNb/v7sYmSgm4IH0zi11GgB\nCQIQbpoXf1EJlriSHiqcUZCIvY/H37TWSJ6+tCcUSUipA+dLgt4pnKBjeM6RFSPG\n81eTm0AZIpmRDx/i31knPNh5JL6RYm5t66ncM46VkO1FIatkdKDfJbYe9J6ezWCs\nMDYTejoBhQ==\n=EuYe\n-----END PGP MESSAGE-----",
-				"fp": "0C982F87B7AFBA0F504F90A2629E741947C87928"
-			}
-		],
-		"unencrypted_suffix": "_unencrypted",
-		"version": "3.9.2"
-	}
-}

hosts/tungsten/ssh.pub

@@ -1 +0,0 @@
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJq5WWALjFHvmUdcWdKN5BBRS1F/EWaBet6oftrbxt1F

hosts/web-2/blocked-prefixes.txt

@@ -1,195 +0,0 @@
-ip6tables -I nixos-fw -s 2400:3200::/48 -j nixos-fw-refuse
-ip6tables -I nixos-fw -s 2400:3200:baba::/48 -j nixos-fw-refuse
-ip6tables -I nixos-fw -s 2400:b200:4100::/46 -j nixos-fw-refuse
-ip6tables -I nixos-fw -s 2401:8680:4100::/48 -j nixos-fw-refuse
-ip6tables -I nixos-fw -s 2401:b180:4100::/48 -j nixos-fw-refuse
-ip6tables -I nixos-fw -s 2404:2280:1000::/36 -j nixos-fw-refuse
-ip6tables -I nixos-fw -s 2404:2280:2000::/35 -j nixos-fw-refuse
-ip6tables -I nixos-fw -s 2404:2280:4000::/36 -j nixos-fw-refuse
-ip6tables -I nixos-fw -s 2408:4000:1000::/48 -j nixos-fw-refuse
-ip6tables -I nixos-fw -s 2408:4009:500::/48 -j nixos-fw-refuse
-ip6tables -I nixos-fw -s 240b:4000::/31 -j nixos-fw-refuse
-ip6tables -I nixos-fw -s 240b:4002::/32 -j nixos-fw-refuse
-ip6tables -I nixos-fw -s 240b:4004::/31 -j nixos-fw-refuse
-ip6tables -I nixos-fw -s 240b:4006::/48 -j nixos-fw-refuse
-ip6tables -I nixos-fw -s 240b:4006:1000::/43 -j nixos-fw-refuse
-ip6tables -I nixos-fw -s 240b:4006:1020::/44 -j nixos-fw-refuse
-ip6tables -I nixos-fw -s 240b:4007::/32 -j nixos-fw-refuse
-ip6tables -I nixos-fw -s 240b:4009::/32 -j nixos-fw-refuse
-ip6tables -I nixos-fw -s 240b:400b::/32 -j nixos-fw-refuse
-ip6tables -I nixos-fw -s 240b:400c::/30 -j nixos-fw-refuse
-ip6tables -I nixos-fw -s 240b:4011::/32 -j nixos-fw-refuse
-ip6tables -I nixos-fw -s 240b:4012::/48 -j nixos-fw-refuse
-ip6tables -I nixos-fw -s 240b:4013::/32 -j nixos-fw-refuse
-ip6tables -I nixos-fw -s 240b:4014::/32 -j nixos-fw-refuse
-iptables -I nixos-fw -s 5.181.224.0/23 -j nixos-fw-refuse
-iptables -I nixos-fw -s 8.208.0.0/16 -j nixos-fw-refuse
-iptables -I nixos-fw -s 8.209.0.0/19 -j nixos-fw-refuse
-iptables -I nixos-fw -s 8.209.36.0/22 -j nixos-fw-refuse
-iptables -I nixos-fw -s 8.209.40.0/21 -j nixos-fw-refuse
-iptables -I nixos-fw -s 8.209.48.0/20 -j nixos-fw-refuse
-iptables -I nixos-fw -s 8.209.64.0/18 -j nixos-fw-refuse
-iptables -I nixos-fw -s 8.209.128.0/17 -j nixos-fw-refuse
-iptables -I nixos-fw -s 8.210.0.0/15 -j nixos-fw-refuse
-iptables -I nixos-fw -s 8.212.0.0/16 -j nixos-fw-refuse
-iptables -I nixos-fw -s 8.213.0.0/17 -j nixos-fw-refuse
-iptables -I nixos-fw -s 8.213.128.0/19 -j nixos-fw-refuse
-iptables -I nixos-fw -s 8.213.160.0/21 -j nixos-fw-refuse
-iptables -I nixos-fw -s 8.213.176.0/20 -j nixos-fw-refuse
-iptables -I nixos-fw -s 8.213.192.0/18 -j nixos-fw-refuse
-iptables -I nixos-fw -s 8.214.0.0/15 -j nixos-fw-refuse
-iptables -I nixos-fw -s 8.216.0.0/14 -j nixos-fw-refuse
-iptables -I nixos-fw -s 8.220.64.0/18 -j nixos-fw-refuse
-iptables -I nixos-fw -s 8.220.128.0/17 -j nixos-fw-refuse
-iptables -I nixos-fw -s 8.221.0.0/16 -j nixos-fw-refuse
-iptables -I nixos-fw -s 8.222.0.0/15 -j nixos-fw-refuse
-iptables -I nixos-fw -s 14.1.112.0/22 -j nixos-fw-refuse
-iptables -I nixos-fw -s 43.91.0.0/16 -j nixos-fw-refuse
-iptables -I nixos-fw -s 43.96.1.0/24 -j nixos-fw-refuse
-iptables -I nixos-fw -s 43.96.2.0/23 -j nixos-fw-refuse
-iptables -I nixos-fw -s 43.96.4.0/23 -j nixos-fw-refuse
-iptables -I nixos-fw -s 43.96.7.0/24 -j nixos-fw-refuse
-iptables -I nixos-fw -s 43.96.8.0/22 -j nixos-fw-refuse
-iptables -I nixos-fw -s 43.96.17.0/24 -j nixos-fw-refuse
-iptables -I nixos-fw -s 43.96.19.0/24 -j nixos-fw-refuse
-iptables -I nixos-fw -s 43.96.20.0/22 -j nixos-fw-refuse
-iptables -I nixos-fw -s 43.96.24.0/23 -j nixos-fw-refuse
-iptables -I nixos-fw -s 43.96.27.0/24 -j nixos-fw-refuse
-iptables -I nixos-fw -s 43.96.28.0/23 -j nixos-fw-refuse
-iptables -I nixos-fw -s 43.96.32.0/22 -j nixos-fw-refuse
-iptables -I nixos-fw -s 43.96.40.0/24 -j nixos-fw-refuse
-iptables -I nixos-fw -s 43.96.52.0/24 -j nixos-fw-refuse
-iptables -I nixos-fw -s 43.96.56.0/24 -j nixos-fw-refuse
-iptables -I nixos-fw -s 43.96.58.0/24 -j nixos-fw-refuse
-iptables -I nixos-fw -s 43.96.66.0/23 -j nixos-fw-refuse
-iptables -I nixos-fw -s 43.96.68.0/22 -j nixos-fw-refuse
-iptables -I nixos-fw -s 43.96.72.0/22 -j nixos-fw-refuse
-iptables -I nixos-fw -s 43.96.78.0/24 -j nixos-fw-refuse
-iptables -I nixos-fw -s 43.96.80.0/23 -j nixos-fw-refuse
-iptables -I nixos-fw -s 43.96.84.0/23 -j nixos-fw-refuse
-iptables -I nixos-fw -s 43.96.86.0/24 -j nixos-fw-refuse
-iptables -I nixos-fw -s 43.96.88.0/24 -j nixos-fw-refuse
-iptables -I nixos-fw -s 43.96.96.0/23 -j nixos-fw-refuse
-iptables -I nixos-fw -s 43.96.100.0/23 -j nixos-fw-refuse
-iptables -I nixos-fw -s 43.96.102.0/24 -j nixos-fw-refuse
-iptables -I nixos-fw -s 43.96.104.0/24 -j nixos-fw-refuse
-iptables -I nixos-fw -s 43.96.106.0/24 -j nixos-fw-refuse
-iptables -I nixos-fw -s 43.98.0.0/15 -j nixos-fw-refuse
-iptables -I nixos-fw -s 43.100.0.0/15 -j nixos-fw-refuse
-iptables -I nixos-fw -s 43.102.0.0/17 -j nixos-fw-refuse
-iptables -I nixos-fw -s 43.103.0.0/17 -j nixos-fw-refuse
-iptables -I nixos-fw -s 43.104.0.0/15 -j nixos-fw-refuse
-iptables -I nixos-fw -s 43.108.0.0/17 -j nixos-fw-refuse
-iptables -I nixos-fw -s 45.196.28.0/24 -j nixos-fw-refuse
-iptables -I nixos-fw -s 45.199.179.0/24 -j nixos-fw-refuse
-iptables -I nixos-fw -s 47.52.0.0/16 -j nixos-fw-refuse
-iptables -I nixos-fw -s 47.56.0.0/15 -j nixos-fw-refuse
-iptables -I nixos-fw -s 47.74.0.0/15 -j nixos-fw-refuse
-iptables -I nixos-fw -s 47.76.0.0/16 -j nixos-fw-refuse
-iptables -I nixos-fw -s 47.77.0.0/20 -j nixos-fw-refuse
-iptables -I nixos-fw -s 47.77.16.0/21 -j nixos-fw-refuse
-iptables -I nixos-fw -s 47.77.24.0/22 -j nixos-fw-refuse
-iptables -I nixos-fw -s 47.77.32.0/19 -j nixos-fw-refuse
-iptables -I nixos-fw -s 47.77.64.0/19 -j nixos-fw-refuse
-iptables -I nixos-fw -s 47.77.96.0/20 -j nixos-fw-refuse
-iptables -I nixos-fw -s 47.77.128.0/17 -j nixos-fw-refuse
-iptables -I nixos-fw -s 47.78.0.0/16 -j nixos-fw-refuse
-iptables -I nixos-fw -s 47.79.0.0/17 -j nixos-fw-refuse
-iptables -I nixos-fw -s 47.79.128.0/19 -j nixos-fw-refuse
-iptables -I nixos-fw -s 47.79.192.0/18 -j nixos-fw-refuse
-iptables -I nixos-fw -s 47.80.0.0/14 -j nixos-fw-refuse
-iptables -I nixos-fw -s 47.84.0.0/15 -j nixos-fw-refuse
-iptables -I nixos-fw -s 47.86.0.0/16 -j nixos-fw-refuse
-iptables -I nixos-fw -s 47.87.0.0/17 -j nixos-fw-refuse
-iptables -I nixos-fw -s 47.87.128.0/18 -j nixos-fw-refuse
-iptables -I nixos-fw -s 47.87.192.0/19 -j nixos-fw-refuse
-iptables -I nixos-fw -s 47.87.224.0/21 -j nixos-fw-refuse
-iptables -I nixos-fw -s 47.87.232.0/22 -j nixos-fw-refuse
-iptables -I nixos-fw -s 47.88.0.0/16 -j nixos-fw-refuse
-iptables -I nixos-fw -s 47.89.0.0/18 -j nixos-fw-refuse
-iptables -I nixos-fw -s 47.89.72.0/21 -j nixos-fw-refuse
-iptables -I nixos-fw -s 47.89.80.0/22 -j nixos-fw-refuse
-iptables -I nixos-fw -s 47.89.84.0/24 -j nixos-fw-refuse
-iptables -I nixos-fw -s 47.89.88.0/21 -j nixos-fw-refuse
-iptables -I nixos-fw -s 47.89.96.0/20 -j nixos-fw-refuse
-iptables -I nixos-fw -s 47.89.122.0/23 -j nixos-fw-refuse
-iptables -I nixos-fw -s 47.89.124.0/23 -j nixos-fw-refuse
-iptables -I nixos-fw -s 47.89.128.0/17 -j nixos-fw-refuse
-iptables -I nixos-fw -s 47.90.0.0/15 -j nixos-fw-refuse
-iptables -I nixos-fw -s 47.235.0.0/21 -j nixos-fw-refuse
-iptables -I nixos-fw -s 47.235.8.0/22 -j nixos-fw-refuse
-iptables -I nixos-fw -s 47.235.12.0/23 -j nixos-fw-refuse
-iptables -I nixos-fw -s 47.235.16.0/20 -j nixos-fw-refuse
-iptables -I nixos-fw -s 47.236.0.0/14 -j nixos-fw-refuse
-iptables -I nixos-fw -s 47.240.0.0/14 -j nixos-fw-refuse
-iptables -I nixos-fw -s 47.244.0.0/15 -j nixos-fw-refuse
-iptables -I nixos-fw -s 47.246.32.0/22 -j nixos-fw-refuse
-iptables -I nixos-fw -s 47.246.66.0/23 -j nixos-fw-refuse
-iptables -I nixos-fw -s 47.246.68.0/23 -j nixos-fw-refuse
-iptables -I nixos-fw -s 47.246.72.0/21 -j nixos-fw-refuse
-iptables -I nixos-fw -s 47.246.80.0/24 -j nixos-fw-refuse
-iptables -I nixos-fw -s 47.246.82.0/23 -j nixos-fw-refuse
-iptables -I nixos-fw -s 47.246.84.0/22 -j nixos-fw-refuse
-iptables -I nixos-fw -s 47.246.88.0/22 -j nixos-fw-refuse
-iptables -I nixos-fw -s 47.246.92.0/23 -j nixos-fw-refuse
-iptables -I nixos-fw -s 47.246.96.0/20 -j nixos-fw-refuse
-iptables -I nixos-fw -s 47.246.120.0/24 -j nixos-fw-refuse
-iptables -I nixos-fw -s 47.246.122.0/23 -j nixos-fw-refuse
-iptables -I nixos-fw -s 47.246.124.0/23 -j nixos-fw-refuse
-iptables -I nixos-fw -s 47.246.128.0/20 -j nixos-fw-refuse
-iptables -I nixos-fw -s 47.246.144.0/22 -j nixos-fw-refuse
-iptables -I nixos-fw -s 47.246.150.0/23 -j nixos-fw-refuse
-iptables -I nixos-fw -s 47.246.152.0/21 -j nixos-fw-refuse
-iptables -I nixos-fw -s 47.246.160.0/19 -j nixos-fw-refuse
-iptables -I nixos-fw -s 47.246.192.0/21 -j nixos-fw-refuse
-iptables -I nixos-fw -s 47.250.0.0/15 -j nixos-fw-refuse
-iptables -I nixos-fw -s 47.252.0.0/15 -j nixos-fw-refuse
-iptables -I nixos-fw -s 47.254.0.0/16 -j nixos-fw-refuse
-iptables -I nixos-fw -s 59.82.136.0/23 -j nixos-fw-refuse
-iptables -I nixos-fw -s 103.81.186.0/23 -j nixos-fw-refuse
-iptables -I nixos-fw -s 110.76.21.0/24 -j nixos-fw-refuse
-iptables -I nixos-fw -s 110.76.23.0/24 -j nixos-fw-refuse
-iptables -I nixos-fw -s 116.251.64.0/18 -j nixos-fw-refuse
-iptables -I nixos-fw -s 139.95.0.0/20 -j nixos-fw-refuse
-iptables -I nixos-fw -s 139.95.16.0/22 -j nixos-fw-refuse
-iptables -I nixos-fw -s 139.95.64.0/24 -j nixos-fw-refuse
-iptables -I nixos-fw -s 140.205.1.0/24 -j nixos-fw-refuse
-iptables -I nixos-fw -s 140.205.122.0/24 -j nixos-fw-refuse
-iptables -I nixos-fw -s 147.139.0.0/16 -j nixos-fw-refuse
-iptables -I nixos-fw -s 149.129.0.0/20 -j nixos-fw-refuse
-iptables -I nixos-fw -s 149.129.16.0/23 -j nixos-fw-refuse
-iptables -I nixos-fw -s 149.129.32.0/19 -j nixos-fw-refuse
-iptables -I nixos-fw -s 149.129.64.0/18 -j nixos-fw-refuse
-iptables -I nixos-fw -s 149.129.192.0/18 -j nixos-fw-refuse
-iptables -I nixos-fw -s 156.227.20.0/24 -j nixos-fw-refuse
-iptables -I nixos-fw -s 156.236.12.0/24 -j nixos-fw-refuse
-iptables -I nixos-fw -s 156.236.17.0/24 -j nixos-fw-refuse
-iptables -I nixos-fw -s 156.240.76.0/23 -j nixos-fw-refuse
-iptables -I nixos-fw -s 156.245.1.0/24 -j nixos-fw-refuse
-iptables -I nixos-fw -s 161.117.0.0/16 -j nixos-fw-refuse
-iptables -I nixos-fw -s 170.33.24.0/24 -j nixos-fw-refuse
-iptables -I nixos-fw -s 170.33.29.0/24 -j nixos-fw-refuse
-iptables -I nixos-fw -s 170.33.30.0/23 -j nixos-fw-refuse
-iptables -I nixos-fw -s 170.33.32.0/22 -j nixos-fw-refuse
-iptables -I nixos-fw -s 170.33.64.0/23 -j nixos-fw-refuse
-iptables -I nixos-fw -s 170.33.66.0/24 -j nixos-fw-refuse
-iptables -I nixos-fw -s 170.33.68.0/23 -j nixos-fw-refuse
-iptables -I nixos-fw -s 170.33.72.0/23 -j nixos-fw-refuse
-iptables -I nixos-fw -s 170.33.76.0/22 -j nixos-fw-refuse
-iptables -I nixos-fw -s 170.33.80.0/22 -j nixos-fw-refuse
-iptables -I nixos-fw -s 170.33.84.0/23 -j nixos-fw-refuse
-iptables -I nixos-fw -s 170.33.86.0/24 -j nixos-fw-refuse
-iptables -I nixos-fw -s 170.33.88.0/24 -j nixos-fw-refuse
-iptables -I nixos-fw -s 170.33.90.0/24 -j nixos-fw-refuse
-iptables -I nixos-fw -s 170.33.92.0/23 -j nixos-fw-refuse
-iptables -I nixos-fw -s 170.33.104.0/22 -j nixos-fw-refuse
-iptables -I nixos-fw -s 170.33.136.0/23 -j nixos-fw-refuse
-iptables -I nixos-fw -s 170.33.138.0/24 -j nixos-fw-refuse
-iptables -I nixos-fw -s 185.78.106.0/23 -j nixos-fw-refuse
-iptables -I nixos-fw -s 198.11.128.0/18 -j nixos-fw-refuse
-iptables -I nixos-fw -s 202.144.199.0/24 -j nixos-fw-refuse
-iptables -I nixos-fw -s 203.107.64.0/22 -j nixos-fw-refuse
-iptables -I nixos-fw -s 203.107.68.0/24 -j nixos-fw-refuse
-iptables -I nixos-fw -s 205.204.96.0/19 -j nixos-fw-refuse
-iptables -I nixos-fw -s 223.5.5.0/24 -j nixos-fw-refuse
-iptables -I nixos-fw -s 223.6.6.0/24 -j nixos-fw-refuse

hosts/web-2/clerie.nix

@@ -27,13 +27,18 @@
         root = pkgs.clerie-keys;
       };
       locations."= /ssh/known_hosts" = {
-        alias = pkgs.clerie-ssh-known-hosts + "/known_hosts";
+        alias = pkgs.writeText "known_hosts" (import ../../lib/ssh-known-hosts.nix);
         extraConfig = ''
           types { }
           default_type "text/plain; charset=utf-8";
         '';
       };
       locations."/gpg" = {
+        extraConfig = ''
+          types {
+            text/plain asc;
+          }
+        '';
         root = pkgs.clerie-keys;
       };
       locations."~ ^/.well-known/openpgpkey/hu/[a-z0-9]+/?$" = {
@@ -53,6 +58,9 @@
         '';
         return = "200 ''";
       };
+      extraConfig = ''
+        access_log /var/log/nginx/clerie.de.log combined_anon;
+      '';
     };
   };
 }

hosts/web-2/configuration.nix

@@ -9,8 +9,6 @@
       ./chaosevents.nix
       ./clerie.nix
       ./drop.nix
-      ./etebase.nix
-      ./feeds.nix
       ./fieldpoc.nix
       ./gitea.nix
       ./ip.nix
@@ -24,22 +22,20 @@
       ./public.nix
       ./radicale.nix
       ./reichartstrasse.nix
-      ./traveldrafter.nix
       ./uptimestatus.nix
       ./wetter.nix
     ];
 
-  profiles.clerie.hetzner-cloud.enable = true;
-
   boot.loader.grub.enable = true;
   boot.loader.grub.device = "/dev/sda";
 
-  systemd.network.networks."10-wan" = {
-    address = [
-      "2a01:4f8:c0c:c580::1/64"
-      "88.99.187.135/32"
-    ];
-  };
+  networking.useDHCP = false;
+  # Network
+  networking.interfaces.ens3.ipv4.addresses = [ { address = "88.99.187.135"; prefixLength = 32; } ];
+  networking.interfaces.ens3.ipv6.addresses = [ { address = "2a01:4f8:c0c:c580::1"; prefixLength = 64; } ];
+  networking.defaultGateway = { address = "172.31.1.1"; interface = "ens3"; };
+  networking.defaultGateway6 = { address = "fe80::1"; interface = "ens3"; };
+  networking.nameservers = [ "213.133.98.98" "213.133.99.99" "213.133.100.100" ];
 
   services.nginx = {
     enable = true;
@@ -52,11 +48,9 @@
 
   networking.firewall.allowedTCPPorts = [ 80 443 ];
 
-  networking.firewall.extraCommands = builtins.readFile ./blocked-prefixes.txt;
-
   services.postgresql = {
     enable = true;
-    package = pkgs.postgresql_16;
+    package = pkgs.postgresql_12;
   };
 
   clerie.backup = {

hosts/web-2/etebase.nix

@@ -1,26 +0,0 @@
-{ ... }:
-
-{
-  services.etebase-server = {
-    enable = true;
-    port = 8001;
-    settings.allowed_hosts.allowed_host1 = "etebase.clerie.de";
-  };
-
-  services.nginx.virtualHosts = {
-    "etebase.clerie.de" = {
-      enableACME = true;
-      forceSSL = true;
-      locations = {
-        "= /" = {
-          return = ''302 "/admin/"'';
-        };
-      };
-      locations = {
-        "/" = {
-          proxyPass = "http://127.0.0.1:8001";
-        };
-      };
-    };
-  };
-}

hosts/web-2/feeds.nix

@@ -1,49 +0,0 @@
-{ pkgs, ... }:
-
-{
-  users.users."feeds" = {
-    isSystemUser = true;
-    group = "feeds";
-  };
-
-  users.groups."feeds" = {};
-
-  systemd.tmpfiles.rules = [
-      "d /data/feeds 0775 root users - -"
-      "d /var/lib/feeds - feeds feeds - -"
-  ];
-
-  services.nginx = {
-    virtualHosts."feeds.clerie.de" = {
-      enableACME = true;
-      forceSSL = true;
-      root = "/var/lib/feeds";
-    };
-  };
-
-  systemd.services."feeds" = {
-    wantedBy = [ "multi-user.target" ];
-    requires = [ "network.target" ];
-    after = [ "network.target" ];
-    serviceConfig = {
-      Type = "oneshot";
-      WorkingDirectory = "/var/lib/feeds";
-      RuntimeDirectory = "feeds";
-      User = "feeds";
-      Group = "feeds";
-      ExecStart = ''
-        ${pkgs.feeds-dir}/bin/feeds-dir /data/feeds
-      '';
-    };
-  };
-
-  systemd.timers."feeds" = {
-    wantedBy = [ "timers.target" ];
-    timerConfig = {
-      OnCalendar = "hourly";
-      RandomizedDelaySec = "1h";
-    };
-    requires = [ "network-online.target" ];
-    after = [ "network-online.target" ];
-  };
-}

hosts/web-2/gitea.nix

@@ -83,6 +83,9 @@
           proxyPass = "http://[::1]:3000";
         };
       };
+      extraConfig = ''
+        access_log /var/log/nginx/git.clerie.de.log combined_anon;
+      '';
     };
   };
 }