fix: rekey all secrets

fix: add secrets to nougat-2
feat: add nougat-2 to pub.solar/infra branch
2023-07-30 03:04:01 +02:00 · 2023-07-30 02:14:14 +02:00 · 2023-07-29 23:40:41 +02:00 · 2023-07-20 20:14:31 +02:00 · 2023-07-20 20:10:02 +02:00 · 2023-07-20 19:57:03 +02:00
52 changed files with 2572 additions and 237 deletions
--- a/.drone.yml
+++ b/.drone.yml
@ -17,7 +17,7 @@ steps:
      - nix $$NIX_FLAGS develop --command nix flake show
      - nix $$NIX_FLAGS develop --command treefmt --fail-on-change
      - nix $$NIX_FLAGS develop --command editorconfig-checker
-      - nix $$NIX_FLAGS build ".#nixosConfigurations.PubSolarOS.config.system.build.toplevel"
+      - nix $$NIX_FLAGS build ".#nixosConfigurations.flora-6.config.system.build.toplevel"
 ---
 kind: pipeline
@ -44,7 +44,7 @@ steps:
        from_secret: private_ssh_key
      MANTA_USER: pub_solar
      MANTA_URL: https://eu-central.manta.greenbaum.cloud
-      MANTA_KEY_ID: "5d:5f:3d:22:8d:37:1f:e6:d6:ab:06:18:d9:a2:04:67"
+      MANTA_KEY_ID: "59:9f:5a:6f:c4:e2:3b:32:7f:13:1f:de:b7:59:80:85"
    commands:
      - export TARGET_DIR="ci/$${DRONE_REPO}/$${DRONE_BUILD_NUMBER}"
      - echo env var TARGET_DIR is set to $$TARGET_DIR
@ -149,6 +149,6 @@ volumes:
 ---
 kind: signature
-hmac: a116f78a0b22188052893bdb46aa40f8de66438826c10ced362ea183d7644d67
+hmac: 17811add241edae457584ba78389886df02b5e51820d826ef5fb2d97de2430e2
 ...
--- a/flake.lock
+++ b/flake.lock
@ -30,11 +30,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1696360011,
+        "lastModified": 1688307440,
-        "narHash": "sha256-HpPv27qMuPou4acXcZ8Klm7Zt0Elv9dgDvSJaomWb9Y=",
+        "narHash": "sha256-7PTjbN+/+b799YN7Tk2SS5Vh8A0L3gBo8hmB7Y0VXug=",
        "owner": "LnL7",
        "repo": "nix-darwin",
-        "rev": "8b6ea26d5d2e8359d06278364f41fbc4b903b28a",
+        "rev": "b06bab83bdf285ea0ae3c8e145a081eb95959047",
        "type": "github"
      },
      "original": {
@ -54,11 +54,11 @@
        "utils": "utils"
      },
      "locked": {
-        "lastModified": 1695052866,
+        "lastModified": 1686747123,
-        "narHash": "sha256-agn7F9Oww4oU6nPiw+YiYI9Xb4vOOE73w8PAoBRP4AA=",
+        "narHash": "sha256-XUQK9kwHpTeilHoad7L4LjMCCyY13Oq383CoFADecRE=",
        "owner": "serokell",
        "repo": "deploy-rs",
-        "rev": "e3f41832680801d0ee9e2ed33eb63af398b090e9",
+        "rev": "724463b5a94daa810abfc64a4f87faef4e00f984",
        "type": "github"
      },
      "original": {
@ -89,6 +89,28 @@
        "type": "github"
      }
    },
    "devshell_2": {
      "inputs": {
        "nixpkgs": [
          "keycloak-theme-pub-solar",
          "nixpkgs"
        ],
        "systems": "systems"
      },
      "locked": {
        "lastModified": 1688380630,
        "narHash": "sha256-8ilApWVb1mAi4439zS3iFeIT0ODlbrifm/fegWwgHjA=",
        "owner": "numtide",
        "repo": "devshell",
        "rev": "f9238ec3d75cefbb2b42a44948c4e8fb1ae9a205",
        "type": "github"
      },
      "original": {
        "owner": "numtide",
        "repo": "devshell",
        "type": "github"
      }
    },
    "digga": {
      "inputs": {
        "darwin": [
@ -197,19 +219,54 @@
        "type": "github"
      }
    },
-    "fork": {
+    "flake-utils_3": {
      "inputs": {
        "systems": "systems_2"
      },
      "locked": {
-        "lastModified": 1692960587,
+        "lastModified": 1689068808,
-        "narHash": "sha256-39SKGdhn8jKKkdqhULbCvQOpdUPE9NNJpy5HTB++Jvg=",
+        "narHash": "sha256-6ixXo3wt24N/melDWjq70UuHQLxGV8jZvooRanIHXw0=",
-        "owner": "teutat3s",
+        "owner": "numtide",
-        "repo": "nixpkgs",
+        "repo": "flake-utils",
-        "rev": "312709dd70684f52496580e533d58645526b1c90",
+        "rev": "919d646de7be200f3bf08cb76ae1f09402b6f9b4",
        "type": "github"
      },
      "original": {
-        "owner": "teutat3s",
+        "owner": "numtide",
-        "ref": "nvfetcher-fix",
+        "repo": "flake-utils",
-        "repo": "nixpkgs",
+        "type": "github"
      }
    },
    "flake-utils_4": {
      "inputs": {
        "systems": "systems_3"
      },
      "locked": {
        "lastModified": 1687171271,
        "narHash": "sha256-BJlq+ozK2B1sJDQXS3tzJM5a+oVZmi1q0FlBK/Xqv7M=",
        "owner": "numtide",
        "repo": "flake-utils",
        "rev": "abfb11bd1aec8ced1c9bb9adfe68018230f4fb3c",
        "type": "github"
      },
      "original": {
        "owner": "numtide",
        "repo": "flake-utils",
        "type": "github"
      }
    },
    "flake-utils_5": {
      "locked": {
        "lastModified": 1653893745,
        "narHash": "sha256-0jntwV3Z8//YwuOjzhV2sgJJPt+HY6KhU7VZUL0fKZQ=",
        "owner": "numtide",
        "repo": "flake-utils",
        "rev": "1ed9fb1935d260de5fe1c2f7ee0ebaae17ed2fa1",
        "type": "github"
      },
      "original": {
        "owner": "numtide",
        "repo": "flake-utils",
        "type": "github"
      }
    },
@ -220,11 +277,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1695108154,
+        "lastModified": 1687871164,
-        "narHash": "sha256-gSg7UTVtls2yO9lKtP0yb66XBHT1Fx5qZSZbGMpSn2c=",
+        "narHash": "sha256-bBFlPthuYX322xOlpJvkjUBz0C+MOBjZdDOOJJ+G2jU=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "07682fff75d41f18327a871088d20af2710d4744",
+        "rev": "07c347bb50994691d7b0095f45ebd8838cf6bc38",
        "type": "github"
      },
      "original": {
@ -234,13 +291,36 @@
        "type": "github"
      }
    },
    "keycloak-theme-pub-solar": {
      "inputs": {
        "devshell": "devshell_2",
        "flake-utils": "flake-utils_3",
        "nixpkgs": [
          "nixos"
        ]
      },
      "locked": {
        "lastModified": 1689875310,
        "narHash": "sha256-gJxh8fVX24nZXBxstZcrzZhMRFG9jyOnQEfkgoRr39I=",
        "ref": "main",
        "rev": "c2c86bbf9855f16a231a596b75b443232a7b9395",
        "revCount": 24,
        "type": "git",
        "url": "https://git.pub.solar/pub-solar/keycloak-theme"
      },
      "original": {
        "ref": "main",
        "type": "git",
        "url": "https://git.pub.solar/pub-solar/keycloak-theme"
      }
    },
    "latest": {
      "locked": {
-        "lastModified": 1696604326,
+        "lastModified": 1689192006,
-        "narHash": "sha256-YXUNI0kLEcI5g8lqGMb0nh67fY9f2YoJsILafh6zlMo=",
+        "narHash": "sha256-QM0f0d8oPphOTYJebsHioR9+FzJcy1QNIzREyubB91U=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "87828a0e03d1418e848d3dd3f3014a632e4a4f64",
+        "rev": "2de8efefb6ce7f5e4e75bdf57376a96555986841",
        "type": "github"
      },
      "original": {
@ -252,11 +332,11 @@
    },
    "nixos": {
      "locked": {
-        "lastModified": 1696697597,
+        "lastModified": 1689209875,
-        "narHash": "sha256-q26Qv4DQ+h6IeozF2o1secyQG0jt2VUT3V0K58jr3pg=",
+        "narHash": "sha256-8AVcBV1DiszaZzHFd5iLc8HSLfxRAuqcU0QdfBEF3Ag=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "5a237aecb57296f67276ac9ab296a41c23981f56",
+        "rev": "fcc147b1e9358a8386b2c4368bd928e1f63a7df2",
        "type": "github"
      },
      "original": {
@ -268,11 +348,11 @@
    },
    "nixos-hardware": {
      "locked": {
-        "lastModified": 1696614066,
+        "lastModified": 1686838567,
-        "narHash": "sha256-nAyYhO7TCr1tikacP37O9FnGr2USOsVBD3IgvndUYjM=",
+        "narHash": "sha256-aqKCUD126dRlVSKV6vWuDCitfjFrZlkwNuvj5LtjRRU=",
        "owner": "nixos",
        "repo": "nixos-hardware",
-        "rev": "bb2db418b616fea536b1be7f6ee72fb45c11afe0",
+        "rev": "429f232fe1dc398c5afea19a51aad6931ee0fb89",
        "type": "github"
      },
      "original": {
@ -297,6 +377,30 @@
        "type": "github"
      }
    },
    "nvfetcher": {
      "inputs": {
        "flake-compat": [
          "flake-compat"
        ],
        "flake-utils": "flake-utils_4",
        "nixpkgs": [
          "nixos"
        ]
      },
      "locked": {
        "lastModified": 1687440270,
        "narHash": "sha256-aOAXvfVn+MBSkU+xlQEiyoGpRaF6NvQdpWIhw5OH/Dc=",
        "owner": "berberman",
        "repo": "nvfetcher",
        "rev": "44196458acc2c28c32e456c50277d6148e71e708",
        "type": "github"
      },
      "original": {
        "owner": "berberman",
        "repo": "nvfetcher",
        "type": "github"
      }
    },
    "root": {
      "inputs": {
        "agenix": "agenix",
@ -304,11 +408,82 @@
        "deploy": "deploy",
        "digga": "digga",
        "flake-compat": "flake-compat",
        "fork": "fork",
        "home": "home",
        "keycloak-theme-pub-solar": "keycloak-theme-pub-solar",
        "latest": "latest",
        "nixos": "nixos",
-        "nixos-hardware": "nixos-hardware"
+        "nixos-hardware": "nixos-hardware",
        "nvfetcher": "nvfetcher",
        "triton-vmtools": "triton-vmtools"
      }
    },
    "systems": {
      "locked": {
        "lastModified": 1681028828,
        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
        "owner": "nix-systems",
        "repo": "default",
        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
        "type": "github"
      },
      "original": {
        "owner": "nix-systems",
        "repo": "default",
        "type": "github"
      }
    },
    "systems_2": {
      "locked": {
        "lastModified": 1681028828,
        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
        "owner": "nix-systems",
        "repo": "default",
        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
        "type": "github"
      },
      "original": {
        "owner": "nix-systems",
        "repo": "default",
        "type": "github"
      }
    },
    "systems_3": {
      "locked": {
        "lastModified": 1681028828,
        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
        "owner": "nix-systems",
        "repo": "default",
        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
        "type": "github"
      },
      "original": {
        "owner": "nix-systems",
        "repo": "default",
        "type": "github"
      }
    },
    "triton-vmtools": {
      "inputs": {
        "flake-utils": "flake-utils_5",
        "nixpkgs": [
          "nixos"
        ]
      },
      "locked": {
        "dir": "vmtools",
        "lastModified": 1669648111,
        "narHash": "sha256-EKh7iM4fCyZ7L6+HmGn3QkZ1HuG9zMEkziOH3K13SbY=",
        "ref": "main",
        "rev": "d78c4afe040440437949ce581ae0dcdc5893553c",
        "revCount": 28,
        "type": "git",
        "url": "https://git.b12f.io/pub-solar/infra?dir=vmtools"
      },
      "original": {
        "dir": "vmtools",
        "ref": "main",
        "type": "git",
        "url": "https://git.b12f.io/pub-solar/infra?dir=vmtools"
      }
    },
    "utils": {
--- a/flake.nix
+++ b/flake.nix
@ -8,8 +8,6 @@
    nixos.url = "github:nixos/nixpkgs/nixos-23.05";
    latest.url = "github:nixos/nixpkgs/nixos-unstable";
    fork.url = "github:teutat3s/nixpkgs/nvfetcher-fix";
    flake-compat.url = "github:edolstra/flake-compat";
    flake-compat.flake = false;
@ -36,6 +34,16 @@
    agenix.inputs.darwin.follows = "darwin";
    nixos-hardware.url = "github:nixos/nixos-hardware";
    nvfetcher.url = "github:berberman/nvfetcher";
    nvfetcher.inputs.nixpkgs.follows = "nixos";
    nvfetcher.inputs.flake-compat.follows = "flake-compat";
    triton-vmtools.url = "git+https://git.b12f.io/pub-solar/infra?ref=main&dir=vmtools";
    triton-vmtools.inputs.nixpkgs.follows = "nixos";
    keycloak-theme-pub-solar.url = "git+https://git.pub.solar/pub-solar/keycloak-theme?ref=main";
    keycloak-theme-pub-solar.inputs.nixpkgs.follows = "nixos";
  };
  outputs = {
@ -46,6 +54,9 @@
    nixos-hardware,
    agenix,
    deploy,
    nvfetcher,
    triton-vmtools,
    keycloak-theme-pub-solar,
    ...
  } @ inputs:
    digga.lib.mkFlake
@ -71,7 +82,6 @@
          ];
        };
        latest = {};
        fork = {};
      };
      lib = import ./lib {lib = digga.lib // nixos.lib;};
@ -84,6 +94,7 @@
          });
        })
        agenix.overlays.default
        nvfetcher.overlays.default
        (import ./pkgs)
      ];
@ -114,12 +125,14 @@
            ];
          };
          PubSolarOS = {
-            tests = [
+            # Broken since https://github.com/NixOS/nixpkgs/commit/5bcef4224928fe45312f0ee321ddf0f0e8feeb7b
            # Needs a fix in https://github.com/divnix/digga/blob/main/src/tests.nix#L12-L21
            #tests = [
            #  (import ./tests/first-test.nix {
            #    pkgs = nixos.legacyPackages.x86_64-linux;
            #    lib = nixos.lib;
            #  })
-            ];
+            #];
          };
        };
        importables = rec {
@ -150,6 +163,11 @@
          pub-solar = {suites, ...}: {
            imports = suites.base;
            home.stateVersion = "21.03";
          };
          barkeeper = {suites, ...}: {
            imports = suites.base;
            home.stateVersion = "21.03";
          };
        }; # digga.lib.importers.rakeLeaves ./users/hm;
@ -160,6 +178,27 @@
      homeConfigurations = digga.lib.mkHomeConfigurations self.nixosConfigurations;
      deploy.nodes = digga.lib.mkDeployNodes self.nixosConfigurations {
        flora-6 = {
          sshUser = "barkeeper";
          hostname = "flora-6.pub.solar";
          fastConnect = true;
          profilesOrder = ["system" "direnv"];
          profiles.direnv = {
            user = "barkeeper";
            path = self.pkgs.x86_64-linux.nixos.deploy-rs.lib.activate.home-manager self.homeConfigurationsPortable.x86_64-linux.barkeeper;
          };
        };
        nougat-2 = {
          sshUser = "barkeeper";
          hostname = "nougat-2.b12f.io";
          fastConnect = true;
          profilesOrder = ["system" "direnv"];
          profiles.direnv = {
            user = "barkeeper";
            path = self.pkgs.x86_64-linux.nixos.deploy-rs.lib.activate.home-manager self.homeConfigurationsPortable.x86_64-linux.barkeeper;
          };
        };
        #example = {
        #  hostname = "example.com:22";
        #  sshUser = "bartender";
--- a/hosts/flora-6/README.md
+++ b/hosts/flora-6/README.md
@ -0,0 +1,16 @@
 # Mailman on NixOS docs
 - add reverse DNS record for IP
 Manual setup done for mailman, adapted from https://nixos.wiki/wiki/Mailman:
 ```
 # Add DNS records in infra repo using terraform:
 # https://git.pub.solar/pub-solar/infra/commit/db234cdb5b55758a3d74387ada0760e06e166b9d
 # Generate initial postfix_domains.db and postfix_lmtp.db databases for Postfix
 sudo -u mailman mailman aliases
 # Create a django superuser account
 sudo -u mailman-web mailman-web createsuperuser
 # Followed outlined steps in web UI
 ```
--- a/hosts/flora-6/caddy.nix
+++ b/hosts/flora-6/caddy.nix
@ -0,0 +1,140 @@
 {
  config,
  lib,
  pkgs,
  self,
  ...
 }: {
  systemd.tmpfiles.rules = [
    "d '/data/srv/www/os/download/' 0750 hakkonaut hakkonaut - -"
  ];
  services.caddy = {
    enable = lib.mkForce true;
    group = "hakkonaut";
    email = "admins@pub.solar";
    enableReload = true;
    globalConfig = lib.mkForce ''
      grace_period 60s
    '';
    virtualHosts = {
      "pub.solar" = {
        logFormat = lib.mkForce ''
          output discard
        '';
        extraConfig = ''
          # Named matcher, used below for Mastodon webfinger
          @query query resource=*
          # PubSolarOS images
          handle /os/download/* {
            root * /data/srv/www
            file_server /os/download/* browse
          }
          # serve base domain pub.solar for mastodon.pub.solar
          # https://masto.host/mastodon-usernames-different-from-the-domain-used-for-installation/
          handle /.well-known/host-meta {
            redir https://mastodon.pub.solar{uri}
          }
          # Tailscale OIDC webfinger requirement plus Mastodon webfinger redirect
          handle /.well-known/webfinger {
            # Redirect requests that match /.well-known/webfinger?resource=* to Mastodon
            handle @query {
              redir https://mastodon.pub.solar{uri}
            }
            respond 200 {
              body `{
                "subject": "acct:admins@pub.solar",
                "links": [
                  {
                    "rel": "http://openid.net/specs/connect/1.0/issuer",
                    "href": "https://auth.pub.solar/realms/pub.solar"
                  }
                ]
              }`
            }
          }
          # redirect to statutes
          redir /satzung https://cloud.pub.solar/s/2tRCP9aZFCiWxQy temporary
          # pub.solar website
          handle {
            root * /srv/www/pub.solar
            try_files {path}.html {path}
            file_server
          }
          # minimal error handling, respond with status code and text
          handle_errors {
            respond "{http.error.status_code} {http.error.status_text}"
          }
        '';
      };
      "www.pub.solar" = {
        logFormat = lib.mkForce ''
          output discard
        '';
        extraConfig = ''
          redir https://pub.solar{uri}
        '';
      };
      "auth.pub.solar" = {
        logFormat = lib.mkForce ''
          output discard
        '';
        extraConfig = ''
          redir / /realms/pub.solar/account temporary
          reverse_proxy :8080
        '';
      };
      "git.pub.solar" = {
        logFormat = lib.mkForce ''
          output discard
        '';
        extraConfig = ''
          redir /user/login /user/oauth2/keycloak temporary
          reverse_proxy :3000
        '';
      };
      "ci.pub.solar" = {
        logFormat = lib.mkForce ''
          output discard
        '';
        extraConfig = ''
          reverse_proxy :4000
        '';
      };
      "stream.pub.solar" = {
        logFormat = lib.mkForce ''
          output discard
        '';
        extraConfig = ''
          reverse_proxy :5000
        '';
      };
      "list.pub.solar" = {
        logFormat = lib.mkForce ''
          output discard
        '';
        extraConfig = ''
          handle_path /static/* {
            root * /var/lib/mailman-web-static
            file_server
          }
          reverse_proxy :18507
        '';
      };
      "obs-portal.pub.solar" = {
        logFormat = lib.mkForce ''
          output discard
        '';
        extraConfig = ''
          reverse_proxy obs-portal.svc.e5756d08-36fd-424b-f8bc-acdb92ca7b82.lev-1.int.greenbaum.zone:3000
        '';
      };
    };
  };
  networking.firewall.allowedTCPPorts = [80 443];
 }
--- a/hosts/flora-6/default.nix
+++ b/hosts/flora-6/default.nix
@ -0,0 +1,5 @@
 {...}: {
  imports = [
    ./flora-6.nix
  ];
 }
--- a/hosts/flora-6/drone.nix
+++ b/hosts/flora-6/drone.nix
@ -0,0 +1,114 @@
 {
  config,
  lib,
  pkgs,
  self,
  ...
 }: {
  age.secrets.drone-secrets = {
    file = "${self}/secrets/drone-secrets.age";
    mode = "600";
    owner = "drone";
  };
  age.secrets.drone-db-secrets = {
    file = "${self}/secrets/drone-db-secrets.age";
    mode = "600";
    owner = "drone";
  };
  users.users.drone = {
    description = "Drone Service";
    home = "/var/lib/drone";
    useDefaultShell = true;
    uid = 994;
    group = "drone";
    isSystemUser = true;
  };
  users.groups.drone = {};
  systemd.tmpfiles.rules = [
    "d '/var/lib/drone-db' 0750 drone drone - -"
  ];
  systemd.services."docker-network-drone" = let
    docker = config.virtualisation.oci-containers.backend;
    dockerBin = "${pkgs.${docker}}/bin/${docker}";
  in {
    serviceConfig.Type = "oneshot";
    before = ["docker-drone-server.service"];
    script = ''
      ${dockerBin} network inspect drone-net >/dev/null 2>&1 || ${dockerBin} network create drone-net --subnet 172.20.0.0/24
    '';
  };
  virtualisation = {
    docker = {
      enable = true; # sadly podman is not supported rightnow
      extraOptions = ''
        --data-root /data/docker
      '';
    };
    oci-containers = {
      backend = "docker";
      containers."drone-db" = {
        image = "postgres:14";
        autoStart = true;
        user = "994";
        volumes = [
          "/var/lib/drone-db:/var/lib/postgresql/data"
        ];
        extraOptions = [
          "--network=drone-net"
        ];
        environmentFiles = [
          config.age.secrets.drone-db-secrets.path
        ];
      };
      containers."drone-server" = {
        image = "drone/drone:2";
        autoStart = true;
        user = "994";
        ports = [
          "4000:80"
        ];
        dependsOn = ["drone-db"];
        extraOptions = [
          "--network=drone-net"
        ];
        environment = {
          DRONE_GITEA_SERVER = "https://git.pub.solar";
          DRONE_SERVER_HOST = "ci.pub.solar";
          DRONE_SERVER_PROTO = "https";
          DRONE_DATABASE_DRIVER = "postgres";
        };
        environmentFiles = [
          config.age.secrets.drone-secrets.path
        ];
      };
      containers."drone-docker-runner" = {
        image = "drone/drone-runner-docker:1";
        autoStart = true;
        # needs to run as root
        #user = "994";
        volumes = [
          "/var/run/docker.sock:/var/run/docker.sock"
        ];
        dependsOn = ["drone-db"];
        extraOptions = [
          "--network=drone-net"
        ];
        environment = {
          DRONE_RPC_HOST = "ci.pub.solar";
          DRONE_RPC_PROTO = "https";
          DRONE_RUNNER_CAPACITY = "2";
          DRONE_RUNNER_NAME = "flora-6-docker-runner";
        };
        environmentFiles = [
          config.age.secrets.drone-secrets.path
        ];
      };
    };
  };
 }
--- a/hosts/flora-6/flora-6.nix
+++ b/hosts/flora-6/flora-6.nix
@ -0,0 +1,167 @@
 {
  config,
  latestModulesPath,
  lib,
  inputs,
  pkgs,
  profiles,
  self,
  ...
 }: let
  psCfg = config.pub-solar;
 in {
  imports = [
    # Include the results of the hardware scan.
    ./hardware-configuration.nix
    ./triton-vmtools.nix
    ./caddy.nix
    ./drone.nix
    ./keycloak.nix
    ./gitea.nix
    ./mailman.nix
    ./owncast.nix
    profiles.base-user
    profiles.users.root # make sure to configure ssh keys
    profiles.users.barkeeper
    "${latestModulesPath}/services/misc/gitea.nix"
    "${latestModulesPath}/services/web-servers/caddy/default.nix"
  ];
  disabledModules = [
    "services/misc/gitea.nix"
    "services/web-servers/caddy/default.nix"
  ];
  config = {
    # # #
    # # # pub.solar options
    # # #
    pub-solar.core = {
      disk-encryption-active = false;
      iso-options.enable = true;
      lite = true;
    };
    # Allow sudo without a password for the barkeeper user
    security.sudo.extraRules = [
      {
        users = ["${psCfg.user.name}"];
        commands = [
          {
            command = "ALL";
            options = ["NOPASSWD"];
          }
        ];
      }
    ];
    # Override nix.conf for more agressive garbage collection
    nix.extraOptions = lib.mkForce ''
      min-free = 536870912
      keep-outputs = false
      keep-derivations = false
      fallback = true
    '';
    # Machine user for CI pipelines
    users.users.hakkonaut = {
      description = "CI and automation user";
      home = "/var/nix/iso-cache";
      useDefaultShell = true;
      uid = 998;
      group = "hakkonaut";
      isSystemUser = true;
      openssh.authorizedKeys.keys = [
        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGP5MvCwNRtCcP1pSDrn0XZTNlpOqYnjHDm9/OI4hECW hakkonaut@flora-6"
      ];
    };
    users.groups.hakkonaut = {};
    # # #
    # # # Triton host specific options
    # # # DO NOT ALTER below this line, changes might render system unbootable
    # # #
    # Use the systemd-boot EFI boot loader.
    boot.loader.systemd-boot.enable = true;
    boot.loader.efi.canTouchEfiVariables = true;
    # Force getting the hostname from cloud-init
    networking.hostName = lib.mkDefault "";
    # Set your time zone.
    time.timeZone = "Europe/Berlin";
    # Select internationalisation properties.
    console = {
      font = "Lat2-Terminus16";
      keyMap = "us";
    };
    # List packages installed in system profile. To search, run:
    # $ nix search wget
    environment.systemPackages = with pkgs; [
      git
      vim
      wget
    ];
    # Some programs need SUID wrappers, can be configured further or are
    # started in user sessions.
    # programs.mtr.enable = true;
    # programs.gnupg.agent = {
    #   enable = true;
    #   enableSSHSupport = true;
    # };
    # List services that you want to enable:
    services.cloud-init.enable = true;
    services.cloud-init.ext4.enable = true;
    services.cloud-init.network.enable = true;
    # use the default NixOS cloud-init config, but add some SmartOS customization to it
    environment.etc."cloud/cloud.cfg.d/90_smartos.cfg".text = ''
      datasource_list: [ SmartOS ]
      # Do not create the centos/ubuntu/debian user
      users: [ ]
      # mount second disk with label ephemeral0, gets formated by cloud-init
      # this will fail to get added to /etc/fstab as it's read-only, but should
      # mount at boot anyway
      mounts:
      - [ vdb, /data, auto, "defaults,nofail" ]
    '';
    # Enable the OpenSSH daemon.
    services.openssh = {
      enable = true;
      settings = {
        PasswordAuthentication = false;
        PermitRootLogin = "no";
        Macs = [
          "hmac-sha2-512-etm@openssh.com"
          "hmac-sha2-256-etm@openssh.com"
          "umac-128-etm@openssh.com"
          "hmac-sha2-512"
          "hmac-sha2-256"
          "umac-128@openssh.com"
        ];
      };
    };
    # We manage the firewall with nix, too
    # altough triton can also manage firewall rules via the triton fwrule subcommand
    networking.firewall.enable = true;
    # This value determines the NixOS release from which the default
    # settings for stateful data, like file locations and database versions
    # on your system were taken. It‘s perfectly fine and recommended to leave
    # this value at the release version of the first install of this system.
    # Before changing this value read the documentation for this option
    # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
    system.stateVersion = "22.05"; # Did you read the comment?
  };
 }
--- a/hosts/flora-6/gitea.nix
+++ b/hosts/flora-6/gitea.nix
@ -0,0 +1,82 @@
 {
  config,
  lib,
  pkgs,
  self,
  ...
 }: {
  age.secrets.gitea-database-password = {
    file = "${self}/secrets/gitea-database-password.age";
    mode = "600";
    owner = "gitea";
  };
  age.secrets.gitea-mailer-password = {
    file = "${self}/secrets/gitea-mailer-password.age";
    mode = "600";
    owner = "gitea";
  };
  # gitea
  services.gitea = {
    enable = true;
    package = pkgs.forgejo;
    appName = "pub.solar git server";
    database = {
      type = "postgres";
      passwordFile = config.age.secrets.gitea-database-password.path;
    };
    lfs.enable = true;
    mailerPasswordFile = config.age.secrets.gitea-mailer-password.path;
    settings = {
      server = {
        ROOT_URL = "https://git.pub.solar";
        DOMAIN = "git.pub.solar";
        HTTP_ADDR = "127.0.0.1";
        HTTP_PORT = 3000;
      };
      mailer = {
        ENABLED = true;
        PROTOCOL = "smtps";
        SMTP_ADDR = "mx2.greenbaum.cloud";
        SMTP_PORT = 465;
        FROM = ''"pub.solar git server" <gitea@pub.solar>'';
        USER = "admins@pub.solar";
      };
      "repository.signing" = {
        SIGNING_KEY = "default";
        MERGES = "always";
      };
      openid = {
        ENABLE_OPENID_SIGNIN = true;
        ENABLE_OPENID_SIGNUP = true;
      };
      # uncomment after initial deployment, first user is admin user
      # required to setup SSO (oauth openid-connect, keycloak auth provider)
      service.ALLOW_ONLY_EXTERNAL_REGISTRATION = true;
      service.ENABLE_NOTIFY_MAIL = true;
      session.COOKIE_SECURE = lib.mkForce true;
    };
  };
  # See: https://docs.gitea.io/en-us/signing/#installing-and-generating-a-gpg-key-for-gitea
  # Required for gitea server side gpg signatures
  # configured/setup manually in:
  # /var/lib/gitea/data/home/.gitconfig
  # /var/lib/gitea/data/home/.gnupg/
  # sudo su gitea
  # export GNUPGHOME=/var/lib/gitea/data/home/.gnupg
  # gpg --quick-gen-key 'pub.solar gitea <gitea@pub.solar>' ed25519
  # TODO: implement declarative GPG key generation and
  # gitea gitconfig
  programs.gnupg.agent = {
    enable = true;
    pinentryFlavor = "curses";
  };
  # Required to make gpg work without a graphical environment?
  # otherwise generating a new gpg key fails with this error:
  # gpg: agent_genkey failed: No pinentry
  # see: https://github.com/NixOS/nixpkgs/issues/97861#issuecomment-827951675
  environment.variables = {
    GPG_TTY = "$(tty)";
  };
 }
--- a/hosts/flora-6/hardware-configuration.nix
+++ b/hosts/flora-6/hardware-configuration.nix
@ -0,0 +1,44 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
 {
  config,
  lib,
  pkgs,
  modulesPath,
  ...
 }: {
  imports = [];
  boot.initrd.availableKernelModules = ["ahci" "virtio_pci" "xhci_pci" "sr_mod" "virtio_blk"];
  boot.initrd.kernelModules = [];
  boot.kernelModules = [];
  boot.extraModulePackages = [];
  fileSystems."/" = {
    device = "/dev/disk/by-label/nixos";
    autoResize = true;
    fsType = "ext4";
  };
  fileSystems."/boot" = {
    device = "/dev/disk/by-label/boot";
    fsType = "vfat";
  };
  fileSystems."/data" = {
    device = "/dev/disk/by-label/ephemeral0";
    fsType = "ext4";
    options = [
      "defaults"
      "nofail"
    ];
  };
  swapDevices = [];
  networking.useDHCP = lib.mkDefault false;
  networking.networkmanager.enable = lib.mkForce false;
  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }
--- a/hosts/flora-6/keycloak.nix
+++ b/hosts/flora-6/keycloak.nix
@ -0,0 +1,30 @@
 {
  config,
  lib,
  inputs,
  pkgs,
  self,
  ...
 }: {
  age.secrets.keycloak-database-password = {
    file = "${self}/secrets/keycloak-database-password.age";
    mode = "700";
    #owner = "keycloak";
  };
  # keycloak
  services.keycloak = {
    enable = true;
    database.passwordFile = config.age.secrets.keycloak-database-password.path;
    settings = {
      hostname = "auth.pub.solar";
      http-host = "127.0.0.1";
      http-port = 8080;
      proxy = "edge";
      features = "declarative-user-profile";
    };
    themes = {
      "pub.solar" = inputs.keycloak-theme-pub-solar.legacyPackages.${pkgs.system}.keycloak-theme-pub-solar;
    };
  };
 }
--- a/hosts/flora-6/mailman.nix
+++ b/hosts/flora-6/mailman.nix
@ -0,0 +1,102 @@
 {
  config,
  lib,
  pkgs,
  self,
  ...
 }: let
  # Source: https://github.com/NixOS/nixpkgs/blob/nixos-22.11/nixos/modules/services/mail/mailman.nix#L9C10-L10
  # webEnv is required by the mailman-uwsgi systemd service
  inherit (pkgs.mailmanPackages.buildEnvs {}) webEnv;
 in {
  networking.firewall.allowedTCPPorts = [25];
  services.postfix = {
    enable = true;
    relayDomains = ["hash:/var/lib/mailman/data/postfix_domains"];
    # get TLS certs for list.pub.solar from caddy
    # TODO: when caddy renews certs, postfix doesn't know about it
    # implement custom built caddy with events exec handler or systemd-reload
    # hook so postfix reloads, too
    sslCert = "/var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/list.pub.solar/list.pub.solar.crt";
    sslKey = "/var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/list.pub.solar/list.pub.solar.key";
    config = {
      transport_maps = ["hash:/var/lib/mailman/data/postfix_lmtp"];
      local_recipient_maps = ["hash:/var/lib/mailman/data/postfix_lmtp"];
    };
    rootAlias = "admins@pub.solar";
    postmasterAlias = "admins@pub.solar";
    hostname = "list.pub.solar";
  };
  systemd.paths.watcher-caddy-ssl-file = {
    description = "Watches for changes in caddy's TLS cert file (after renewals) to reload postfix";
    documentation = ["systemd.path(5)"];
    partOf = ["postfix-reload.service"];
    pathConfig = {
      PathChanged = "/var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/list.pub.solar/list.pub.solar.crt";
      Unit = "postfix-reload.service";
    };
    wantedBy = ["multi-user.target"];
  };
  systemd.services."postfix-reload" = {
    description = "Reloads postfix config, e.g. after TLS certs change, notified by watcher-caddy-ssl-file.path";
    documentation = ["systemd.path(5)"];
    requires = ["postfix.service"];
    after = ["postfix.service"];
    startLimitIntervalSec = 10;
    startLimitBurst = 5;
    serviceConfig.Type = "oneshot";
    script = ''
      ${pkgs.systemd}/bin/systemctl reload postfix
    '';
    wantedBy = ["multi-user.target"];
  };
  services.mailman = {
    enable = true;
    # We use caddy instead of nginx
    #serve.enable = true;
    hyperkitty.enable = true;
    webHosts = ["list.pub.solar"];
    siteOwner = "admins@pub.solar";
  };
  # TODO add django-keycloak as auth provider
  # https://django-keycloak.readthedocs.io/en/latest/
  ## Extend settings.py directly since this can't be done via JSON
  ## settings (services.mailman.webSettings)
  #environment.etc."mailman3/settings.py".text = ''
  #  INSTALLED_APPS.extend([
  #    "allauth.socialaccount.providers.github",
  #    "allauth.socialaccount.providers.gitlab"
  #  ])
  #'';
  systemd.services.mailman-uwsgi = let
    uwsgiConfig.uwsgi = {
      type = "normal";
      plugins = ["python3"];
      home = webEnv;
      manage-script-name = true;
      mount = "/=mailman_web.wsgi:application";
      http = "127.0.0.1:18507";
    };
    uwsgiConfigFile = pkgs.writeText "uwsgi-mailman.json" (builtins.toJSON uwsgiConfig);
  in {
    wantedBy = ["multi-user.target"];
    after = ["postgresql.service"];
    requires = ["mailman-web-setup.service" "postgresql.service"];
    restartTriggers = [config.environment.etc."mailman3/settings.py".source];
    serviceConfig = {
      # Since the mailman-web settings.py obstinately creates a logs
      # dir in the cwd, change to the (writable) runtime directory before
      # starting uwsgi.
      ExecStart = "${pkgs.coreutils}/bin/env -C $RUNTIME_DIRECTORY ${pkgs.uwsgi.override {plugins = ["python3"];}}/bin/uwsgi --json ${uwsgiConfigFile}";
      User = "mailman-web";
      Group = "mailman";
      RuntimeDirectory = "mailman-uwsgi";
    };
  };
 }
--- a/hosts/flora-6/owncast.nix
+++ b/hosts/flora-6/owncast.nix
@ -0,0 +1,24 @@
 {
  config,
  lib,
  pkgs,
  self,
  ...
 }: {
  # owncast
  services.owncast = {
    enable = true;
    user = "owncast";
    group = "owncast";
    # The directory where owncast stores its data files.
    dataDir = "/var/lib/owncast";
    # Open the appropriate ports in the firewall for owncast.
    openFirewall = true;
    # The IP address to bind the owncast web server to.
    listen = "127.0.0.1";
    # TCP port where owncast rtmp service listens.
    rtmp-port = 1935;
    # TCP port where owncast web-gui listens.
    port = 5000;
  };
 }
--- a/hosts/flora-6/triton-vmtools.nix
+++ b/hosts/flora-6/triton-vmtools.nix
@ -0,0 +1,9 @@
 {
  pkgs,
  inputs,
  ...
 }: {
  environment.systemPackages = with pkgs; [
    inputs.triton-vmtools.packages.${pkgs.system}.default
  ];
 }
--- a/hosts/nougat-2/acme.nix
+++ b/hosts/nougat-2/acme.nix
@ -0,0 +1,79 @@
 {
  config,
  lib,
  pkgs,
  self,
  ...
 }: let
  exDomain = (import ./ex-domain.nix) lib;
  pubsolarDomain = import ./pubsolar-domain.nix;
  hostingdeProviderConf = {
    dnsProvider = "hostingde";
    credentialsFile = "${pkgs.writeText "hostingde-creds" ''
      HOSTINGDE_API_KEY_FILE=${config.age.secrets."hosting.de-api-key.age".path}
    ''}";
  };
 in {
  age.secrets."hosting.de-api-key.age" = {
    file = "${self}/secrets/hosting.de-api-key.age";
    mode = "440";
    group = "acme";
  };
  systemd.tmpfiles.rules = [
    "d '/data/acme' 0750 root acme - -"
  ];
  users.groups.acme = {};
  ids.uids.acme = 997;
  ids.gids.acme = 997;
  containers.acme = {
    autoStart = true;
    privateNetwork = true;
    hostAddress = "192.168.101.0";
    localAddress = "192.168.106.0";
    hostAddress6 = "fc00::1";
    localAddress6 = "fc00::6";
    bindMounts = {
      "/var/lib/acme" = {
        hostPath = "/data/acme";
        isReadOnly = false;
      };
      "${config.age.secrets."hosting.de-api-key.age".path}" = {
        hostPath = "${config.age.secrets."hosting.de-api-key.age".path}";
        isReadOnly = true;
      };
    };
    config = {
      networking.nameservers = ["1.1.1.1"];
      users.groups.acme = config.users.groups.acme;
      security.acme = {
        acceptTerms = true;
        defaults.email = "acme@benjaminbaedorf.eu";
        defaults.server = "https://acme-staging-v02.api.letsencrypt.org/directory";
        defaults.group = "acme";
        certs."b12f.io" = hostingdeProviderConf;
        certs."mail.b12f.io" = hostingdeProviderConf;
        certs."transmission.b12f.io" = hostingdeProviderConf;
        certs."${exDomain}" = hostingdeProviderConf;
        certs."mail.${exDomain}" = hostingdeProviderConf;
        certs."${pubsolarDomain}" = hostingdeProviderConf;
        certs."www.${pubsolarDomain}" = hostingdeProviderConf;
        certs."auth.${pubsolarDomain}" = hostingdeProviderConf;
        certs."git.${pubsolarDomain}" = hostingdeProviderConf;
        certs."ci.${pubsolarDomain}" = hostingdeProviderConf;
        certs."list.${pubsolarDomain}" = hostingdeProviderConf;
        certs."obs-portal.${pubsolarDomain}" = hostingdeProviderConf;
      };
    };
  };
 }
--- a/hosts/nougat-2/caddy.nix
+++ b/hosts/nougat-2/caddy.nix
@ -0,0 +1,181 @@
 {
  config,
  lib,
  pkgs,
  self,
  ...
 }: let
  pubsolarDomain = import ./pubsolar-domain.nix;
  # Machine user for CI pipelines
 in {
  networking.firewall.allowedTCPPorts = [80 443];
  networking.networkmanager.unmanaged = ["interface-name:ve-caddy"];
  networking.nat = {
    enable = true;
    internalInterfaces = ["ve-caddy"];
    externalInterface = "enp0s31f6";
    # Lazy IPv6 connectivity for the container
    enableIPv6 = true;
  };
  systemd.tmpfiles.rules = [
    "d '/data/www' 0750 root www - -"
    "d '/data/caddy' 0750 root caddy - -"
  ];
  users.groups.caddy = {};
  users.groups.www = {};
  users.users.hakkonaut.extraGroups = ["www"];
  ids.uids.www = 996;
  ids.gids.www = 996;
  fileSystems."/var/lib/caddy" = {
    device = "/data/caddy";
    options = ["bind"];
  };
  fileSystems."/srv/www" = {
    device = "/data/www";
    options = ["bind"];
  };
  containers.caddy = {
    autoStart = true;
    privateNetwork = true;
    hostAddress = "192.168.101.0";
    localAddress = "192.168.103.0";
    hostAddress6 = "fc00::1";
    localAddress6 = "fc00::3";
    forwardPorts = [
      {
        containerPort = 443;
        hostPort = 443;
        protocol = "tcp";
      }
      {
        containerPort = 80;
        hostPort = 80;
        protocol = "tcp";
      }
    ];
    bindMounts = {
      "/srv/www/" = {
        hostPath = "/data/www";
        isReadOnly = false;
      };
      "/var/lib/caddy/" = {
        hostPath = "/data/caddy";
        isReadOnly = false;
      };
      "/var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory" = {
        hostPath = "/data/acme";
        isReadOnly = false;
      };
    };
    config = {
      users.groups.caddy = {};
      users.groups.www = {};
      users.groups.acme = {};
      users.users.caddy.extraGroups = ["www" "acme"];
      networking.firewall.allowedTCPPorts = [80 443];
      environment.etc."resolv.conf".text = "nameserver 1.1.1.0";
      services.caddy = {
        enable = lib.mkForce true;
        globalConfig = lib.mkForce ''
          auto_https disable_certs
        '';
        virtualHosts = {
          "dashboard.nougat-2.b12f.io" = {
            extraConfig = ''
              reverse_proxy :2019
            '';
          };
          "www.b12f.io" = {
            extraConfig = ''
              redir https://pub.solar{uri}
            '';
          };
          "mail.b12f.io" = {
            extraConfig = ''
              redir / /realms/pub.solar/account temporary
              reverse_proxy :8080
            '';
          };
          "${pubsolarDomain}" = {
            logFormat = lib.mkForce ''
              output discard
            '';
            extraConfig = ''
              # PubSolarOS images
              handle /os/download/* {
                root * /srv/www
                file_server /os/download/* browse
              }
              # serve base domain pub.solar for mastodon.pub.solar
              # https://masto.host/mastodon-usernames-different-from-the-domain-used-for-installation/
              handle /.well-known/host-meta {
                redir https://mastodon.${pubsolarDomain}{uri}
              }
              # pub.solar website
              handle {
                root * /srv/www/pub.solar
                try_files {path}.html {path}
                file_server
              }
              # minimal error handling, respond with status code and text
              handle_errors {
                respond "{http.error.status_code} {http.error.status_text}"
              }
            '';
          };
          "www.${pubsolarDomain}" = {
            logFormat = lib.mkForce ''
              output discard
            '';
            extraConfig = ''
              redir https://${pubsolarDomain}{uri}
            '';
          };
          "auth.${pubsolarDomain}" = {
            logFormat = lib.mkForce ''
              output discard
            '';
            extraConfig = ''
              redir / /realms/${pubsolarDomain}/account temporary
              reverse_proxy 192.168.104.0:8080
            '';
          };
          "git.${pubsolarDomain}" = {
            logFormat = lib.mkForce ''
              output discard
            '';
            extraConfig = ''
              redir /user/login /user/oauth2/keycloak temporary
              reverse_proxy 192.168.105.0:3000
            '';
          };
          "ci.${pubsolarDomain}" = {
            logFormat = lib.mkForce ''
              output discard
            '';
            extraConfig = ''
              reverse_proxy 192.168.101.0:8080
            '';
          };
        };
      };
    };
  };
 }
--- a/hosts/nougat-2/concourse.nix
+++ b/hosts/nougat-2/concourse.nix
@ -0,0 +1,137 @@
 {
  config,
  lib,
  pkgs,
  self,
  ...
 }: let
  pubsolarDomain = import ./pubsolar-domain.nix;
  getSecret = name:
    lib.attrsets.setAttrByPath [name] {
      file = "${self}/secrets/${name}.age";
      mode = "600";
      owner = "concourse";
    };
  keys = [
    "concourse-session-signing-key"
    "concourse-worker-key"
    "concourse-tsa-host-key"
  ];
  secrets =
    [
      "concourse-secrets"
      "concourse-db-secrets"
    ]
    ++ keys;
 in {
  age.secrets = lib.lists.foldl (a: b: a // getSecret b) {} secrets;
  users.users.concourse = {
    description = "Concourse Service";
    home = "/var/lib/concourse";
    useDefaultShell = true;
    group = "concourse";
    isSystemUser = true;
  };
  users.groups.concourse = {};
  users.groups.postgres = {};
  ids.uids.concourse = 995;
  ids.gids.concourse = 995;
  systemd.tmpfiles.rules = [
    "d '/data/concourse/db' 0770 root postgres - -"
  ];
  system.activationScripts.mkConcourseNet = let
    docker = config.virtualisation.oci-containers.backend;
    dockerBin = "${pkgs.${docker}}/bin/${docker}";
  in ''
    ${dockerBin} network inspect concourse-net >/dev/null 2>&1 || ${dockerBin} network create concourse-net --subnet 172.20.0.0/24
  '';
  containers.concourse = {
    autoStart = true;
    privateNetwork = true;
    hostAddress = "192.168.101.0";
    localAddress = "192.168.107.0";
    hostAddress6 = "fc00::1";
    localAddress6 = "fc00::7";
    bindMounts = {
      "/var/lib/postgresql/14" = {
        hostPath = "/data/concourse/db";
        isReadOnly = false;
      };
      "${config.age.secrets.keycloak-database-password.path}" = {
        hostPath = "${config.age.secrets.keycloak-database-password.path}";
        isReadOnly = true;
      };
    };
    config = {
      networking.nameservers = ["1.1.1.1"];
  virtualisation.oci-containers = {
    containers."concourse-db" = {
      image = "postgres:14";
      autoStart = true;
      user = builtins.toString config.ids.uids.postgres;
      volumes = [
        "/data/concourse/db:/var/lib/postgresql/data"
      ];
      extraOptions = [
        "--network=concourse-net"
      ];
      environmentFiles = [
        config.age.secrets.concourse-db-secrets.path
      ];
    };
    containers."concourse" = {
      image = "concourse/concourse:7.9.1";
      autoStart = true;
      user = builtins.toString config.ids.uids.concourse;
      ports = [
        "8080:8080"
      ];
      dependsOn = ["concourse-db"];
      extraOptions = [
        "--network=concourse-net"
      ];
      volumes = [
        "${config.age.secrets.concourse-session-signing-key.path}:/keys/session_signing_key"
        "${config.age.secrets.concourse-worker-key.path}:/keys/worker_key"
        "${config.age.secrets.concourse-tsa-host-key.path}:/keys/tsa_host_key"
      ];
      environment = {
        CONCOURSE_EXTERNAL_URL = "https://ci.${pubsolarDomain}";
        CONCOURSE_ADD_LOCAL_USER = "crew:changeme";
        CONCOURSE_MAIN_TEAM_LOCAL_USER = "crew";
        # instead of relying on the default "detect"
        CONCOURSE_WORKER_BAGGAGECLAIM_DRIVER = "overlay";
        CONCOURSE_X_FRAME_OPTIONS = "allow";
        CONCOURSE_CONTENT_SECURITY_POLICY = "*";
        CONCOURSE_CLUSTER_NAME = "pub.solar";
        CONCOURSE_WORKER_CONTAINERD_DNS_SERVER = "8.8.8.8";
        CONCOURSE_SESSION_SIGNING_KEY = "/keys/session_signing_key";
        CONCOURSE_TSA_HOST_KEY = "/keys/tsa_host_key";
        CONCOURSE_TSA_AUTHORIZED_KEYS = "/keys/worker_key";
        # For ARM-based machine, change the Concourse runtime to "houdini"
        CONCOURSE_WORKER_RUNTIME = "containerd";
      };
      environmentFiles = [
        config.age.secrets.concourse-secrets.path
      ];
    };
  };
 }
--- a/hosts/nougat-2/configuration.nix
+++ b/hosts/nougat-2/configuration.nix
@ -0,0 +1,136 @@
 # Edit this configuration file to define what should be installed on
 # your system.  Help is available in the configuration.nix(5) man page
 # and in the NixOS manual (accessible by running ‘nixos-help’).
 {
  config,
  pkgs,
  lib,
  ...
 }: let
  psCfg = config.pub-solar;
 in {
  imports = [
    # Include the results of the hardware scan.
    ./hardware-configuration.nix
  ];
  boot.loader.systemd-boot.enable = true;
  boot.loader.efi.canTouchEfiVariables = true;
  boot.kernelParams = [
    "boot.shell_on_fail=1"
    "ip=135.181.179.123::135.181.179.65:255.255.255.192:nougat-2.b12f.io::off"
  ];
  networking.hostName = "nougat-2";
  # The mdadm RAID1s were created with 'mdadm --create ... --homehost=hetzner',
  # but the hostname for each machine may be different, and mdadm's HOMEHOST
  # setting defaults to '<system>' (using the system hostname).
  # This results mdadm considering such disks as "foreign" as opposed to
  # "local", and showing them as e.g. '/dev/md/hetzner:root0'
  # instead of '/dev/md/root0'.
  # This is mdadm's protection against accidentally putting a RAID disk
  # into the wrong machine and corrupting data by accidental sync, see
  # https://bugzilla.redhat.com/show_bug.cgi?id=606481#c14 and onward.
  # We do not worry about plugging disks into the wrong machine because
  # we will never exchange disks between machines, so we tell mdadm to
  # ignore the homehost entirely.
  environment.etc."mdadm.conf".text = ''
    HOMEHOST <ignore>
    ARRAY /dev/md/SSD metadata=1.2 name=nixos:SSD UUID=f8189c09:cb247cc7:22b79b5f:df888705
    ARRAY /dev/md/HDD metadata=1.2 name=nixos:HDD UUID=85ed8a8e:9ddc5f09:c6ef6110:c00728fa
  '';
  # The RAIDs are assembled in stage1, so we need to make the config
  # available there.
  boot.initrd.services.swraid.enable = true;
  boot.initrd.services.swraid.mdadmConf = config.environment.etc."mdadm.conf".text;
  boot.initrd.network.enable = true;
  boot.initrd.network.ssh = {
    enable = true;
    port = 22;
    authorizedKeys =
      if psCfg.user.publicKeys != null
      then psCfg.user.publicKeys
      else [];
    hostKeys = ["/etc/secrets/initrd/ssh_host_ed25519_key"];
  };
  # Network (Hetzner uses static IP assignments, and we don't use DHCP here)
  networking.useDHCP = false;
  networking.interfaces."enp0s31f6".ipv4.addresses = [
    {
      address = "135.181.179.123";
      prefixLength = 26;
    }
  ];
  networking.defaultGateway = "135.181.179.65";
  networking.interfaces."enp0s31f6".ipv6.addresses = [
    {
      address = "2a01:4f9:3a:2170::1";
      prefixLength = 64;
    }
  ];
  networking.defaultGateway6 = {
    address = "fe80::1";
    interface = "enp0s31f6";
  };
  networking.nameservers = ["1.1.1.1"];
  # Initial empty root password for easy login:
  users.users.root.initialHashedPassword = "";
  users.users.root.openssh.authorizedKeys.keys =
    if psCfg.user.publicKeys != null
    then psCfg.user.publicKeys
    else [];
  users.users.hakkonaut = {
    home = "/home/hakkonaut";
    description = "CI and automation user";
    useDefaultShell = true;
    group = "hakkonaut";
    isSystemUser = true;
    openssh.authorizedKeys.keys = [
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGP5MvCwNRtCcP1pSDrn0XZTNlpOqYnjHDm9/OI4hECW hakkonaut@flora-6"
    ];
  };
  users.groups.hakkonaut = {};
  ids.uids.hakkonaut = 998;
  ids.gids.hakkonaut = 998;
  services.openssh.enable = true;
  services.openssh.settings.PermitRootLogin = "prohibit-password";
  pub-solar.core.disk-encryption-active = false;
  pub-solar.core.lite = true;
  virtualisation = {
    docker = {
      enable = true;
    };
    oci-containers = {
      backend = "docker";
    };
  };
  security.sudo.extraRules = [
    {
      users = ["${psCfg.user.name}"];
      commands = [
        {
          command = "ALL";
          options = ["NOPASSWD"];
        }
      ];
    }
  ];
  # This value determines the NixOS release with which your system is to be
  # compatible, in order to avoid breaking some software such as database
  # servers. You should change this only after NixOS release notes say you
  # should.
  system.stateVersion = "23.05"; # Did you read the comment?
 }
--- a/hosts/nougat-2/default.nix
+++ b/hosts/nougat-2/default.nix
@ -0,0 +1,5 @@
 {...}: {
  imports = [
    ./nougat-2.nix
  ];
 }
--- a/hosts/nougat-2/ex-domain.nix
+++ b/hosts/nougat-2/ex-domain.nix
@ -0,0 +1 @@
 lib: lib.concatStrings (lib.lists.reverseList ["et" ".n" "zz" "wd" "h"])
--- a/hosts/nougat-2/gitea.nix
+++ b/hosts/nougat-2/gitea.nix
@ -0,0 +1,124 @@
 {
  config,
  lib,
  pkgs,
  self,
  ...
 }: let
  pubsolarDomain = import ./pubsolar-domain.nix;
 in {
  age.secrets.gitea-database-password = {
    file = "${self}/secrets/gitea-database-password.age";
    mode = "600";
    group = "gitea";
  };
  # age.secrets.gitea-mailer-password = {
  #   file = "${self}/secrets/gitea-mailer-password.age";
  #   mode = "600";
  #   owner = "gitea";
  # };
  systemd.tmpfiles.rules = [
    "d '/data/gitea/db' 0770 root postgres - -"
    "d '/data/gitea/gitea' 0770 root gitea - -"
  ];
  users.groups.postgres = {};
  users.groups.gitea = {};
  ids.uids.gitea = 994;
  ids.gids.gitea = 994;
  containers.gitea = {
    autoStart = true;
    privateNetwork = true;
    hostAddress = "192.168.101.0";
    localAddress = "192.168.105.0";
    hostAddress6 = "fc00::1";
    localAddress6 = "fc00::5";
    bindMounts = {
      "/var/lib/postgresql/14" = {
        hostPath = "/data/gitea/db";
        isReadOnly = false;
      };
      "/var/lib/gitea" = {
        hostPath = "/data/gitea/gitea";
        isReadOnly = false;
      };
      "${config.age.secrets.gitea-database-password.path}" = {
        hostPath = "${config.age.secrets.gitea-database-password.path}";
        isReadOnly = true;
      };
    };
    config = {
      networking.nameservers = ["1.1.1.1"];
      services.gitea = {
        enable = true;
        package = pkgs.forgejo;
        appName = "pub.solar git server";
        database = {
          type = "postgres";
          passwordFile = config.age.secrets.gitea-database-password.path;
        };
        lfs.enable = true;
        # mailerPasswordFile = config.age.secrets.gitea-mailer-password.path;
        settings = {
          server = {
            DOMAIN = "git.${pubsolarDomain}";
            HTTP_ADDR = "127.0.0.1";
            HTTP_PORT = 3000;
            ROOT_URL = "https://git.${pubsolarDomain}";
          };
          mailer = {
            ENABLED = false;
            PROTOCOL = "smtps";
            SMTP_ADDR = "mx2.greenbaum.cloud";
            SMTP_PORT = 465;
            FROM = ''"pub.solar git server" <gitea@pub.solar>'';
            USER = "admins@pub.solar";
          };
          "repository.signing" = {
            SIGNING_KEY = "default";
            MERGES = "always";
          };
          openid = {
            ENABLE_OPENID_SIGNIN = true;
            ENABLE_OPENID_SIGNUP = true;
          };
          # uncomment after initial deployment, first user is admin user
          # required to setup SSO (oauth openid-connect, keycloak auth provider)
          service.ALLOW_ONLY_EXTERNAL_REGISTRATION = true;
          service.ENABLE_NOTIFY_MAIL = true;
          session.COOKIE_SECURE = lib.mkForce true;
        };
      };
      # See: https://docs.gitea.io/en-us/signing/#installing-and-generating-a-gpg-key-for-gitea
      # Required for gitea server side gpg signatures
      # configured/setup manually in:
      # /var/lib/gitea/data/home/.gitconfig
      # /var/lib/gitea/data/home/.gnupg/
      # sudo su gitea
      # export GNUPGHOME=/var/lib/gitea/data/home/.gnupg
      # gpg --quick-gen-key 'pub.solar gitea <gitea@pub.solar>' ed25519
      # TODO: implement declarative GPG key generation and
      # gitea gitconfig
      programs.gnupg.agent = {
        enable = true;
        pinentryFlavor = "curses";
      };
      # Required to make gpg work without a graphical environment?
      # otherwise generating a new gpg key fails with this error:
      # gpg: agent_genkey failed: No pinentry
      # see: https://github.com/NixOS/nixpkgs/issues/97861#issuecomment-827951675
      environment.variables = {
        GPG_TTY = "$(tty)";
      };
    };
  };
 }
--- a/hosts/nougat-2/hardware-configuration.nix
+++ b/hosts/nougat-2/hardware-configuration.nix
@ -0,0 +1,64 @@
 {
  config,
  lib,
  pkgs,
  modulesPath,
  ...
 }: {
  imports = [
    (modulesPath + "/installer/scan/not-detected.nix")
  ];
  boot.initrd.availableKernelModules = [
    "dm-snapshot"
    "xhci_pci"
    "ahci"
    "nvme"
    "usbhid"
    "usb_storage"
    "sd_mod"
    "dm-raid"
    "e1000e"
  ];
  boot.initrd.kernelModules = [];
  boot.kernelModules = ["kvm-intel"];
  boot.extraModulePackages = [];
  boot.initrd.luks.devices."ssd" = {
    device = "/dev/disk/by-id/md-uuid-f8189c09:cb247cc7:22b79b5f:df888705";
  };
  boot.initrd.luks.devices."hdd" = {
    device = "/dev/disk/by-id/md-uuid-85ed8a8e:9ddc5f09:c6ef6110:c00728fa";
  };
  fileSystems."/" = {
    device = "/dev/disk/by-uuid/cb88e8b9-be51-43eb-a51a-cd021c90771c";
    fsType = "ext4";
  };
  fileSystems."/boot" = {
    device = "/dev/disk/by-uuid/3F6D-065E";
    fsType = "vfat";
  };
  fileSystems."/data" = {
    device = "/dev/disk/by-uuid/824341f0-fd56-4db7-bb7e-4f161d94144b";
    fsType = "ext4";
  };
  swapDevices = [
    {device = "/dev/disk/by-uuid/f37e9f96-0174-4cac-a0bb-b63b2a67a4ad";}
  ];
  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
  # (the default) this is the recommended approach. When using systemd-networkd it's
  # still possible to use this option, but it's recommended to use it in conjunction
  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
  networking.useDHCP = lib.mkDefault true;
  # networking.interfaces.eno1.useDHCP = lib.mkDefault true;
  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
  powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }
--- a/hosts/nougat-2/keycloak.nix
+++ b/hosts/nougat-2/keycloak.nix
@ -0,0 +1,64 @@
 {
  config,
  lib,
  inputs,
  pkgs,
  self,
  ...
 }: let
  pubsolarDomain = import ./pubsolar-domain.nix;
 in {
  age.secrets.keycloak-database-password = {
    file = "${self}/secrets/keycloak-database-password.age";
    mode = "770";
    group = "keycloak";
  };
  systemd.tmpfiles.rules = [
    "d '/data/keycloak/db' 0770 root postgres - -"
  ];
  users.groups.postgres = {};
  users.groups.keycloak = {};
  ids.uids.keycloak = 993;
  ids.gids.keycloak = 993;
  containers.keycloak = {
    autoStart = true;
    privateNetwork = true;
    hostAddress = "192.168.101.0";
    localAddress = "192.168.104.0";
    hostAddress6 = "fc00::1";
    localAddress6 = "fc00::4";
    bindMounts = {
      "/var/lib/postgresql/14" = {
        hostPath = "/data/keycloak/db";
        isReadOnly = false;
      };
      "${config.age.secrets.keycloak-database-password.path}" = {
        hostPath = "${config.age.secrets.keycloak-database-password.path}";
        isReadOnly = true;
      };
    };
    config = {
      networking.nameservers = ["1.1.1.1"];
      services.keycloak = {
        enable = true;
        database.passwordFile = config.age.secrets.keycloak-database-password.path;
        settings = {
          hostname = "auth.${pubsolarDomain}";
          http-host = "0.0.0.0";
          http-port = 8080;
          proxy = "edge";
        };
        themes = {
          "pub.solar" = inputs.keycloak-theme-pub-solar.legacyPackages.${pkgs.system}.keycloak-theme-pub-solar;
        };
      };
    };
  };
 }
--- a/hosts/nougat-2/nougat-2.nix
+++ b/hosts/nougat-2/nougat-2.nix
@ -0,0 +1,29 @@
 {
  config,
  pkgs,
  lib,
  self,
  profiles,
  fix-atomic-container-restartsModulesPath,
  ...
 }:
 with lib; let
  psCfg = config.pub-solar;
  xdg = config.home-manager.users."${psCfg.user.name}".xdg;
 in {
  imports = [
    ./configuration.nix
    profiles.base-user
    profiles.users.root # make sure to configure ssh keys
    profiles.users.barkeeper
    ./acme.nix
    ./caddy.nix
    ./keycloak.nix
    ./gitea.nix
    # ./concourse.nix
    # "${fix-atomic-container-restartsModulesPath}/virtualisation/nixos-containers.nix"
  ];
 }
--- a/hosts/nougat-2/pubsolar-domain.nix
+++ b/hosts/nougat-2/pubsolar-domain.nix
@ -0,0 +1 @@
 "pub.solar.b12f.io"
--- a/modules/docker/default.nix
+++ b/modules/docker/default.nix
@ -14,7 +14,6 @@ in {
  config = mkIf cfg.enable {
    virtualisation.docker.enable = true;
    virtualisation.docker.package = pkgs.docker_24;
    users.users = with pkgs;
      pkgs.lib.setAttrByPath [psCfg.user.name] {
        extraGroups = ["docker"];
--- a/modules/graphical/network-manager-applet.service.nix
+++ b/modules/graphical/network-manager-applet.service.nix
@ -1,6 +1,6 @@
 pkgs: {
  Unit = {
-    Description = "Network Manager applet";
+    Description = "Lightweight Wayland notification daemon";
    BindsTo = ["sway-session.target"];
    After = ["sway-session.target"];
    # ConditionEnvironment requires systemd v247 to work correctly
--- a/modules/sway/config/config.d/custom-keybindings.conf
+++ b/modules/sway/config/config.d/custom-keybindings.conf
@ -18,6 +18,9 @@ bindsym $mod+Shift+h exec psos help
 bindsym $mod+F2 exec firefox
 bindsym $mod+F3 exec $term -e vifm
 bindsym $mod+Shift+F3 exec gksu $term -e vifm
 bindsym $mod+F4 exec nautilus -w
 bindsym $mod+Shift+F4 exec signal-desktop --use-tray-icon
--- a/modules/terminal-life/bash/default.nix
+++ b/modules/terminal-life/bash/default.nix
@ -100,6 +100,8 @@ in {
    mutt = "neomutt";
    ls = "exa";
    la = "exa --group-directories-first -lag";
    fm = "vifm .";
    vifm = "vifm .";
    wget = "wget --hsts-file=$XDG_CACHE_HOME/wget-hsts";
    irssi = "irssi --config=$XDG_CONFIG_HOME/irssi/config --home=$XDG_DATA_HOME/irssi";
    drone = "DRONE_TOKEN=$(secret-tool lookup drone token) drone";
@ -107,6 +109,5 @@ in {
    # fix nixos-option
    nixos-option = "nixos-option -I nixpkgs=${self}/lib/compat";
    myip = "dig +short myip.opendns.com @208.67.222.222 2>&1";
    nnn = "nnn -d -e -H -r";
  };
 }
--- a/modules/terminal-life/default.nix
+++ b/modules/terminal-life/default.nix
@ -25,6 +25,11 @@ in {
    programs.command-not-found.enable = false;
    environment.systemPackages = with pkgs; [
      ack
      bat
      exa
      fd
      neovim
      screen
    ];
@ -47,15 +52,10 @@ in {
          gh
          glow
          jump
-          (nnn.overrideAttrs (o: {
+          nnn
            patches =
              (o.patches or [])
              ++ [
                ./nnn/0001-feat-use-wasd-keybindings-for-jkli.patch
              ];
          }))
          powerline
          silver-searcher
          vifm
          watson
        ];
--- a/modules/terminal-life/nnn/0001-feat-use-wasd-keybindings-for-jkli.patch
+++ b/modules/terminal-life/nnn/0001-feat-use-wasd-keybindings-for-jkli.patch
@ -1,38 +0,0 @@
 From a81ee68923412c0fb8fab46f2f918a7ec865b384 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Benjamin=20B=C3=A4dorf?= <hello@benjaminbaedorf.eu>
 Date: Sun, 9 Jul 2023 04:19:51 +0200
 Subject: [PATCH] feat: use wasd keybindings for jkli
 ---
 src/nnn.h | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)
 diff --git a/src/nnn.h b/src/nnn.h
 index d476ddd2..5f106987 100644
 --- a/src/nnn.h
 +++ b/src/nnn.h
@@ -131,7 +131,7 @@ struct key {
 static struct key bindings[] = {
 	/* Back */
 	{ KEY_LEFT,       SEL_BACK },
 -	{ 'h',            SEL_BACK },
 +	{ 'j',            SEL_BACK },
 	/* Inside or select */
 	{ KEY_ENTER,      SEL_OPEN },
 	{ '\r',           SEL_OPEN },
@@ -139,10 +139,10 @@ static struct key bindings[] = {
 	{ KEY_RIGHT,      SEL_NAV_IN },
 	{ 'l',            SEL_NAV_IN },
 	/* Next */
 -	{ 'j',            SEL_NEXT },
 +	{ 'k',            SEL_NEXT },
 	{ KEY_DOWN,       SEL_NEXT },
 	/* Previous */
 -	{ 'k',            SEL_PREV },
 +	{ 'i',            SEL_PREV },
 	{ KEY_UP,         SEL_PREV },
 	/* Page down */
 	{ KEY_NPAGE,      SEL_PGDN },
 -- 
 2.40.1
--- a/modules/terminal-life/nvim/default.nix
+++ b/modules/terminal-life/nvim/default.nix
@ -47,130 +47,62 @@ in {
  plugins = with pkgs.vimPlugins;
    []
    ++ lib.optionals (!cfg.lite) [
      (pkgs.vimPlugins.nvim-treesitter.withPlugins (p: [
        p.ini
        p.json
        p.json5
        p.markdown
        p.nix
        p.toml
        p.yaml
        p.css
        p.graphql
        p.html
        p.javascript
        p.scss
        p.tsx
        p.typescript
        p.vue
        p.c
        p.cpp
        p.go
        p.gomod
        p.gosum
        p.haskell
        p.lua
        p.php
        p.python
        p.ruby
        p.rust
        p.vim
        p.vimdoc
        p.passwd
        p.sql
        p.diff
        p.gitcommit
        p.gitignore
        p.git_config
        p.gitattributes
        p.git_rebase
        p.bash
        p.dockerfile
        p.make
        p.ninja
        p.terraform
      ]))
      # Dependencies for nvim-lspconfig
      nvim-cmp
      cmp-nvim-lsp
      cmp_luasnip
      luasnip
      # Quickstart configs for neovim LSP
      lsp_extensions-nvim
      nvim-lspconfig
      # Collaborative editing in Neovim using built-in capabilities
      instant-nvim-nvfetcher
      # Search functionality behind :Ack
      ack-vim
      # The status bar in the bottom of the screen with the mode indication and file location
      vim-airline
      # Automatically load editorconfig files in repos to configure nvim settings
      editorconfig-vim
      # File browser. Use <leader>n to access
      nnn-vim
      # Highlight characters when using f, F, t, and T
      quick-scope
      # Get sudo in vim; :SudaWrite <optional filename>
      suda-vim
-
+      syntastic
-      # Undo history etc. per project
+      vim-gutentags
      vim-vinegar
      vim-workspace-nvfetcher
      # JSON schemas
      SchemaStore-nvim
      # Work with tags files
      vim-gutentags
      # Neovim colorschemes / themes
      sonokai
      vim-hybrid-material
      vim-airline-themes
      vim-apprentice-nvfetcher
      # Git integrations
      # A Git wrapper so awesome, it should be illegal
      fugitive
      # Shows git diff markers in the sign column
      vim-gitgutter
      # GitHub extension for fugitive
      vim-rhubarb
      # Ease your git workflow within Vim
      vimagit-nvfetcher
      # FZF fuzzy finder
      fzf-vim
      fzfWrapper
      # Make the yanked region apparent
      vim-highlightedyank
      # :Beautify Code beautifier
      vim-beautify-nvfetcher
      vim-surround
      # Unload, delete or wipe a buffer without closing the window
      vim-bufkill
      # Defaults everyone can agree on
      vim-sensible
-      # emmet for vim: http://emmet.io/
+      ansible-vim
      emmet-vim
-      # Caddyfile syntax support for Vim
+      rust-vim
      vim-caddyfile-nvfetcher
      vim-go
      vim-javascript
      vim-json
      SchemaStore-nvim
      vim-markdown
      vim-nix
      vim-nixhash
      vim-ruby
      vim-toml
      vim-vue
      yats-vim
    ];
  extraConfig = builtins.concatStringsSep "\n" [
--- a/modules/terminal-life/nvim/init.vim
+++ b/modules/terminal-life/nvim/init.vim
@ -101,6 +101,3 @@ if has("autocmd")
  au BufReadPost * if line("'\"") > 1 && line("'\"") <= line("$") | exe "normal! g'\"" | endif
 endif
 nmap - :NnnPicker %<CR>
 nmap <leader>n :NnnPicker %<CR>
 nmap <leader>N :NnnPicker<CR>
--- a/modules/terminal-life/nvim/plugins.vim
+++ b/modules/terminal-life/nvim/plugins.vim
@ -83,5 +83,3 @@ if executable('ag')
  let g:ackprg = 'ag --vimgrep'
 endif
 " nnn
 let g:nnn#command = 'nnn -d -e -H -r'
--- a/overlays/overrides.nix
+++ b/overlays/overrides.nix
@ -4,12 +4,6 @@ channels: final: prev: {
  inherit
    (channels.latest)
    nixd
    docker_24
    ;
  inherit
    (channels.fork)
    nvfetcher
    ;
  haskellPackages =
--- a/pkgs/_sources/generated.nix
+++ b/pkgs/_sources/generated.nix
@ -3,17 +3,17 @@
 {
  blesh-nvfetcher = {
    pname = "blesh-nvfetcher";
-    version = "9d84b424daf31b192891c06275fff316fa5ddd35";
+    version = "4089c4e1cb411121472180189953664b978d8972";
    src = fetchFromGitHub {
      owner = "akinomyoga";
      repo = "ble.sh";
-      rev = "9d84b424daf31b192891c06275fff316fa5ddd35";
+      rev = "4089c4e1cb411121472180189953664b978d8972";
      fetchSubmodules = true;
      deepClone = false;
      leaveDotGit = true;
-      sha256 = "sha256-7aX5UtDB9pUHHeOi9n+qWsM2KGenHVL6O18vG9W8tmQ=";
+      sha256 = "sha256-ZLkiBm3vsRe42crLffM9Z8F5yzKvNRV2/AqK9RkuU+8=";
    };
-    date = "2023-10-02";
+    date = "2023-07-18";
  };
  instant-nvim-nvfetcher = {
    pname = "instant-nvim-nvfetcher";
--- a/profiles/base-user/.config/git/gitmessage.nix
+++ b/profiles/base-user/.config/git/gitmessage.nix
@ -6,27 +6,19 @@
  user = config.pub-solar.user;
  xdg = config.home-manager.users."${user.name}".xdg;
 in ''
-# What happened?
+  # Title: Summary, imperative, start upper case, don't end with a period
-#
+  # No more than 50 chars. #### 50 chars is here:  #
 # fix feat build chore ci docs style refactor perf test
 #
 # type!(optional scope): <summary> --------------#
  #
-# ^\n
+  # ^ Remember ending with an extra blank line
-# What exactly was done and why? --------------------------------------#
+  # Body: Explain *what* and *why* (not *how*). Include issue number.
  # Wrap at 72 chars. ################################## which is here:  #
  #
-# ^\n
+  # ^ Remember ending with an extra blank line
-#
+  # At the end: Include Co-authored-by for all contributors.
 # Any issue numbers or links?
 #
 # Ref: #123
 # ^\n
  #
  # Co-authored-by: Example Name <email@example.com>
 ''
--- a/profiles/base-user/.config/vifm/colors/base16.vifm
+++ b/profiles/base-user/.config/vifm/colors/base16.vifm
@ -0,0 +1,26 @@
 " Reset all styles first
 highlight clear
 highlight Border	cterm=none	ctermfg=235	ctermbg=0
 highlight TopLine	cterm=none	ctermfg=20	ctermbg=18
 highlight TopLineSel	cterm=none	ctermfg=1	ctermbg=18
 highlight Win		cterm=none	ctermfg=188	ctermbg=0
 highlight Directory	cterm=bold	ctermfg=4	ctermbg=0
 highlight CurrLine	cterm=none	ctermfg=3	ctermbg=19
 highlight OtherLine	cterm=none	ctermfg=3	ctermbg=19
 highlight Selected	cterm=none	ctermfg=5	ctermbg=19
 highlight JobLine	cterm=bold	ctermfg=0	ctermbg=18
 highlight StatusLine	cterm=bold	ctermfg=0	ctermbg=18
 highlight ErrorMsg	cterm=bold	ctermfg=0	ctermbg=18
 highlight WildMenu	cterm=bold	ctermfg=0	ctermbg=18
 highlight CmdLine	cterm=none	ctermfg=20	ctermbg=0
 highlight Executable	cterm=bold	ctermfg=2	ctermbg=0
 highlight Link		cterm=none	ctermfg=9	ctermbg=0
 highlight BrokenLink	cterm=none	ctermfg=1	ctermbg=0
 highlight Device	cterm=none	ctermfg=228	ctermbg=0
 highlight Fifo		cterm=none	ctermfg=109	ctermbg=0
 highlight Socket	cterm=none	ctermfg=110	ctermbg=0
--- a/profiles/base-user/.config/vifm/vifmrc
+++ b/profiles/base-user/.config/vifm/vifmrc
@ -0,0 +1,495 @@
 " vim: filetype=vifm :
 " Sample configuration file for vifm (last updated: 2 June, 2019)
 " You can edit this file by hand.
 " The " character at the beginning of a line comments out the line.
 " Blank lines are ignored.
 " The basic format for each item is shown with an example.
 " ------------------------------------------------------------------------------
 " Command used to edit files in various contexts.  The default is vim.
 " If you would like to use another vi clone such as Elvis or Vile
 " you will need to change this setting.
 set vicmd=nvim
 " set vicmd=elvis\ -G\ termcap
 " set vicmd=vile
 " This makes vifm perform file operations on its own instead of relying on
 " standard utilities like `cp`.  While using `cp` and alike is a more universal
 " solution, it's also much slower when processing large amounts of files and
 " doesn't support progress measuring.
 set syscalls
 " Trash Directory
 " The default is to move files that are deleted with dd or :d to
 " the trash directory.  If you change this you will not be able to move
 " files by deleting them and then using p to put the file in the new location.
 " I recommend not changing this until you are familiar with vifm.
 " This probably shouldn't be an option.
 set trash
 " This is how many directories to store in the directory history.
 set history=100
 " Automatically resolve symbolic links on l or Enter.
 set nofollowlinks
 " With this option turned on you can run partially entered commands with
 " unambiguous beginning using :! (e.g. :!Te instead of :!Terminal or :!Te<tab>).
 " set fastrun
 " Natural sort of (version) numbers within text.
 set sortnumbers
 " Maximum number of changes that can be undone.
 set undolevels=100
 " Use Vim's format of help file (has highlighting and "hyperlinks").
 " If you would rather use a plain text help file set novimhelp.
 set vimhelp
 " If you would like to run an executable file when you
 " press return on the file name set this.
 set norunexec
 " Selected color scheme
 colorscheme base16
 " Format for displaying time in file list. For example:
 " TIME_STAMP_FORMAT=%m/%d-%H:%M
 " See man date or man strftime for details.
 set timefmt=%m/%d\ %H:%M
 " Show list of matches on tab completion in command-line mode
 set wildmenu
 " Display completions in a form of popup with descriptions of the matches
 set wildstyle=popup
 " Display suggestions in normal, visual and view modes for keys, marks and
 " registers (at most 5 files).  In other view, when available.
 set suggestoptions=normal,visual,view,otherpane,keys,marks,registers
 " Ignore case in search patterns unless it contains at least one uppercase
 " letter
 set ignorecase
 set smartcase
 " Don't highlight search results automatically
 set nohlsearch
 " Use increment searching (search while typing)
 set incsearch
 " Try to leave some space from cursor to upper/lower border in lists
 set scrolloff=4
 " Don't do too many requests to slow file systems
 if !has('win')
    set slowfs=curlftpfs
 endif
 " Set custom status line look
 set statusline="  Hint: %z%= %A %10u:%-7g %15s %20d  "
 " ------------------------------------------------------------------------------
 " :mark mark /full/directory/path [filename]
 mark b ~/bin/
 mark h ~/
 " ------------------------------------------------------------------------------
 " :com[mand][!] command_name action
 " The following macros can be used in a command
 " %a is replaced with the user arguments.
 " %c the current file under the cursor.
 " %C the current file under the cursor in the other directory.
 " %f the current selected file, or files.
 " %F the current selected file, or files in the other directory.
 " %b same as %f %F.
 " %d the current directory name.
 " %D the other window directory name.
 " %m run the command in a menu window
 command! df df -h %m 2> /dev/null
 command! diff vim -d %f %F
 command! zip zip -r %f.zip %f
 command! unzip unzip %c %c.extracted
 command! run !! ./%f
 command! make !!make %a
 command! mkcd :mkdir %a | cd %a
 command! vgrep vim "+grep %a"
 command! reload :write | restart
 " ------------------------------------------------------------------------------
 " The file type is for the default programs to be used with
 " a file extension.
 " :filetype pattern1,pattern2 defaultprogram,program2
 " :fileviewer pattern1,pattern2 consoleviewer
 " The other programs for the file type can be accessed with the :file command
 " The command macros %f, %F, %d, %F may be used in the commands.
 " The %a macro is ignored.  To use a % you must put %%.
 " For automated FUSE mounts, you must register an extension with :file[x]type
 " in one of following formats:
 "
 " :filetype extensions FUSE_MOUNT|some_mount_command using %SOURCE_FILE and %DESTINATION_DIR variables
 " %SOURCE_FILE and %DESTINATION_DIR are filled in by vifm at runtime.
 " A sample line might look like this:
 " :filetype *.zip,*.jar,*.war,*.ear FUSE_MOUNT|fuse-zip %SOURCE_FILE %DESTINATION_DIR
 "
 " :filetype extensions FUSE_MOUNT2|some_mount_command using %PARAM and %DESTINATION_DIR variables
 " %PARAM and %DESTINATION_DIR are filled in by vifm at runtime.
 " A sample line might look like this:
 " :filetype *.ssh FUSE_MOUNT2|sshfs %PARAM %DESTINATION_DIR
 " %PARAM value is filled from the first line of file (whole line).
 " Example first line for SshMount filetype: root@127.0.0.1:/
 "
 " You can also add %CLEAR if you want to clear screen before running FUSE
 " program.
 " Pdf
 filextype *.pdf epdfview %c %i &, apvlv %c, xpdf %c
 fileviewer *.pdf
        \ vifmimg pdfpreview %px %py %pw %ph %c
        \ %pc
        \ vifmimg clear
        " \ pdftotext -nopgbrk %c -
 " PostScript
 filextype *.ps,*.eps,*.ps.gz
        \ {View in zathura}
        \ zathura %f,
        \ {View in gv}
        \ gv %c %i &,
 " Djvu
 filextype *.djvu
        \ {View in zathura}
        \ zathura %f,
        \ {View in apvlv}
        \ apvlv %f,
 " Audio
 filetype *.wav,*.mp3,*.flac,*.m4a,*.wma,*.ape,*.ac3,*.og[agx],*.spx,*.opus
        \ {Play using vlc}
        \ vlc %c,
        \ {Play using ffplay}
        \ ffplay -nodisp -autoexit %c,
 fileviewer *.mp3 mp3info
 fileviewer *.flac soxi
 " Video
 filextype *.avi,*.mp4,*.wmv,*.dat,*.3gp,*.ogv,*.mkv,*.mpg,*.mpeg,*.vob,
        \*.fl[icv],*.m2v,*.mov,*.webm,*.ts,*.mts,*.m4v,*.r[am],*.qt,*.divx,
        \*.as[fx]
        \ {View using vlc}
        \ vlc %f,
        \ {View using ffplay}
        \ ffplay -fs -autoexit %f,
 fileviewer *.avi,*.mp4,*.wmv,*.dat,*.3gp,*.ogv,*.mkv,*.mpg,*.mpeg,*.vob,
        \*.fl[icv],*.m2v,*.mov,*.webm,*.ts,*.mts,*.m4v,*.r[am],*.qt,*.divx,
        \*.as[fx]
        \ vifmimg videopreview %px %py %pw %ph %c
        \ %pc
        \ vifmimg clear
        " \ ffprobe -pretty %c 2>&1
 " Web
 filextype *.html,*.htm
        \ {Open with vim}
        \ nvim %f,
        \ {Open with firefox}
        \ firefox %f &,
 filetype *.html,*.htm links, lynx
 " Object
 filetype *.o nm %f | less
 " Man page
 filetype *.[1-8] man ./%c
 fileviewer *.[1-8] man ./%c | col -b
 " Images
 filextype *.bmp,*.jpg,*.jpeg,*.png,*.gif,*.xpm
        \ {View in viewnior}
        \ viewnior %f,
 fileviewer *.bmp,*.jpg,*.jpeg,*.png,*.xpm
        \ vifmimg draw %px %py %pw %ph %c
        \ %pc
        \ vifmimg clear
        " Get w3m image previews inside vifm
        " \ imgt %px %py %pw %ph %c
        " \ %pc
        " \ imgc %px %py %pw %ph   NOT NEEDED IN XTERM
 fileviewer *.gif
        \ vifmimg gifpreview %px %py %pw %ph %c
        \ %pc
        \ vifmimg clear
 " OpenRaster
 filextype *.ora
        \ {Edit in MyPaint}
        \ mypaint %f,
 " Mindmap
 filextype *.vym
        \ {Open with VYM}
        \ vym %f &,
 " MD5
 filetype *.md5
        \ {Check MD5 hash sum}
        \ md5sum -c %f %S,
 " SHA1
 filetype *.sha1
        \ {Check SHA1 hash sum}
        \ sha1sum -c %f %S,
 " SHA256
 filetype *.sha256
        \ {Check SHA256 hash sum}
        \ sha256sum -c %f %S,
 " SHA512
 filetype *.sha512
        \ {Check SHA512 hash sum}
        \ sha512sum -c %f %S,
 " GPG signature
 filetype *.asc
        \ {Check signature}
        \ !!gpg --verify %c,
 " Torrent
 filetype *.torrent ktorrent %f &
 fileviewer *.torrent dumptorrent -v %c
 " FuseZipMount
 filetype *.zip,*.jar,*.war,*.ear,*.oxt,*.apkg
        \ {Mount with fuse-zip}
        \ FUSE_MOUNT|fuse-zip %SOURCE_FILE %DESTINATION_DIR,
        \ {View contents}
        \ zip -sf %c | less,
        \ {Extract here}
        \ tar -xf %c,
 fileviewer *.zip,*.jar,*.war,*.ear,*.oxt zip -sf %c
 " ArchiveMount
 filetype *.tar,*.tar.bz2,*.tbz2,*.tgz,*.tar.gz,*.tar.xz,*.txz
        \ {Mount with archivemount}
        \ FUSE_MOUNT|archivemount %SOURCE_FILE %DESTINATION_DIR,
 fileviewer *.tgz,*.tar.gz tar -tzf %c
 fileviewer *.tar.bz2,*.tbz2 tar -tjf %c
 fileviewer *.tar.txz,*.txz xz --list %c
 fileviewer *.tar tar -tf %c
 " Rar2FsMount and rar archives
 filetype *.rar
        \ {Mount with rar2fs}
        \ FUSE_MOUNT|rar2fs %SOURCE_FILE %DESTINATION_DIR,
 fileviewer *.rar unrar v %c
 " IsoMount
 filetype *.iso
        \ {Mount with fuseiso}
        \ FUSE_MOUNT|fuseiso %SOURCE_FILE %DESTINATION_DIR,
 " SshMount
 filetype *.ssh
        \ {Mount with sshfs}
        \ FUSE_MOUNT2|sshfs %PARAM %DESTINATION_DIR %FOREGROUND,
 " FtpMount
 filetype *.ftp
        \ {Mount with curlftpfs}
        \ FUSE_MOUNT2|curlftpfs -o ftp_port=-,,disable_eprt %PARAM %DESTINATION_DIR %FOREGROUND,
 " Fuse7z and 7z archives
 filetype *.7z
        \ {Mount with fuse-7z}
        \ FUSE_MOUNT|fuse-7z %SOURCE_FILE %DESTINATION_DIR,
 fileviewer *.7z 7z l %c
 " Office files
 filextype *.odt,*.doc,*.docx,*.xls,*.xlsx,*.odp,*.pptx libreoffice %f &
 fileviewer *.doc catdoc %c
 fileviewer *.docx docx2txt.pl %f -
 " TuDu files
 filetype *.tudu tudu -f %c
 " Qt projects
 filextype *.pro qtcreator %f &
 " All others
 filetype *.ts,*.js,*.css,*.sass,*.scss,*.go,*.rs,*.py,*.html,*.xhtml,*.json,*.jsx,*.tsx,*.vue,*.svelte,*.sql
        \ {Open in editor}
        \ nvim %c,
 fileviewer *.ts,*.js,*.css,*.sass,*.scss,*.go,*.rs,*.py,*.html,*.xhtml,*.json,*.jsx,*.tsx,*.vue,*.svelte,*.sql bat %c
 " Directories
 filextype */
        \ {View in thunar}
        \ Thunar %f &,
 " Syntax highlighting in preview
 "
 " Explicitly set highlight type for some extensions
 "
 " 256-color terminal
 " fileviewer *.[ch],*.[ch]pp highlight -O xterm256 -s dante --syntax c %c
 " fileviewer Makefile,Makefile.* highlight -O xterm256 -s dante --syntax make %c
 "
 " 16-color terminal
 " fileviewer *.c,*.h highlight -O ansi -s dante %c
 "
 " Or leave it for automatic detection
 "
 " fileviewer *[^/] pygmentize -O style=monokai -f console256 -g
 " Displaying pictures in terminal
 "
 " fileviewer *.jpg,*.png shellpic %c
 " Open all other files with default system programs (you can also remove all
 " :file[x]type commands above to ensure they don't interfere with system-wide
 " settings).  By default all unknown files are opened with 'vi[x]cmd'
 " uncommenting one of lines below will result in ignoring 'vi[x]cmd' option
 " for unknown file types.
 " For *nix:
 " filetype * xdg-open
 " For OS X:
 " filetype * open
 " For Windows:
 " filetype * start, explorer
 " ------------------------------------------------------------------------------
 " What should be saved automatically between vifm sessions.  Drop "savedirs"
 " value if you don't want vifm to remember last visited directories for you.
 set vifminfo=dhistory,savedirs,chistory,state,tui,shistory,
    \phistory,fhistory,dirstack,registers,bookmarks,bmarks
 " ------------------------------------------------------------------------------
 " Examples of configuring both panels
 " Customize view columns a bit (enable ellipsis for truncated file names)
 "
 " set viewcolumns=-{name}..,6{}.
 " Filter-out build and temporary files
 "
 " filter! /^.*\.(lo|o|d|class|py[co])$|.*~$/
 " ------------------------------------------------------------------------------
 " Sample mappings
 " Start shell in current directory
 nnoremap s :shell<cr>
 " Display sorting dialog
 nnoremap S :sort<cr>
 " Toggle visibility of preview window
 nnoremap w :view<cr>
 vnoremap w :view<cr>gv
 " Open file in existing instance of nvim
 nnoremap o :!vim %f<cr>
 " Open file in new instance of vim
 nnoremap O :!vim %f<cr>
 " Open file in the background using its default program
 nnoremap gb :file &<cr>l
 " Interaction with system clipboard
 if has('win')
    " Yank current directory path to Windows clipboard with forward slashes
    nnoremap yp :!echo %"d:gs!\!/! %i | clip<cr>
    " Yank path to current file to Windows clipboard with forward slashes
    nnoremap yf :!echo %"c:gs!\!/! %i | clip<cr>
 elseif executable('xclip')
    " Yank current directory path into the clipboard
    nnoremap yd :!echo %d | xclip %i<cr>
    " Yank current file path into the clipboard
    nnoremap yf :!echo %c:p | xclip %i<cr>
 elseif executable('xsel')
    " Yank current directory path into primary and selection clipboards
    nnoremap yd :!echo -n %d | xsel --input --primary %i &&
                \ echo -n %d | xsel --clipboard --input %i<cr>
    " Yank current file path into into primary and selection clipboards
    nnoremap yf :!echo -n %c:p | xsel --input --primary %i &&
                \ echo -n %c:p | xsel --clipboard --input %i<cr>
 endif
 " Mappings for faster renaming
 nnoremap I cw<c-a>
 nnoremap cc cw<c-u>
 nnoremap A cw
 " Open console in current directory
 nnoremap ,t :!xterm &<cr>
 " Open editor to edit vifmrc and apply settings after returning to vifm
 nnoremap ,c :write | edit $MYVIFMRC | restart<cr>
 " Open gvim to edit vifmrc
 nnoremap ,C :!gvim --remote-tab-silent $MYVIFMRC &<cr>
 " Toggle wrap setting on ,w key
 nnoremap ,w :set wrap!<cr>
 " Example of standard two-panel file managers mappings
 nnoremap <f3> :!less %f<cr>
 nnoremap <f4> :edit<cr>
 nnoremap <f5> :copy<cr>
 nnoremap <f6> :move<cr>
 nnoremap <f7> :mkdir<space>
 nnoremap <f8> :delete<cr>
 " Arrow remapping
 map i <Up>
 map j <Left>
 map k <Down>
 noremap h i
 vnoremap K L
 vnoremap I H
 vnoremap H I
 nnoremap K L
 nnoremap I H
 nnoremap H I
 " Escape overwrite
 cmap jj <Esc>
 " fzf
 command! FZFfind :set noquickview | :execute 'goto "'.system('fd --hidden --exclude .git --exclude node_modules | fzf --preview "ls -lhA --group-directories-first --color=always {}" --preview-window wrap 2>/dev/tty ').'"%IU' | redraw
 nnoremap <c-p> :FZFfind<cr>
--- a/profiles/base-user/home.nix
+++ b/profiles/base-user/home.nix
@ -61,6 +61,8 @@ in {
    xdg.configFile."user-dirs.locale".source = ./.config/user-dirs.locale;
    xdg.configFile."xsettingsd/xsettingsd.conf".source = ./.config/xsettingsd/xsettingsd.conf;
    xdg.configFile."mako/config".source = ./.config/mako/config;
    xdg.configFile."vifm/vifmrc".source = ./.config/vifm/vifmrc;
    xdg.configFile."vifm/colors/base16.vifm".source = ./.config/vifm/colors/base16.vifm;
    xdg.configFile."libinput-gestures.conf".source = ./.config/libinput-gestures.conf;
    xdg.configFile."waybar/config".source = ./.config/waybar/config;
    xdg.configFile."waybar/style.css".source = ./.config/waybar/style.css;
--- a/profiles/base-user/session-variables.nix
+++ b/profiles/base-user/session-variables.nix
@ -7,6 +7,13 @@
  psCfg = config.pub-solar;
  wlroots = psCfg.graphical.wayland;
  xdg = config.home-manager.users."${psCfg.user.name}".xdg;
  globalVariables = {
    EDITOR = "/run/current-system/sw/bin/nvim";
    VISUAL = "/run/current-system/sw/bin/nvim";
    # Make sure virsh runs without root
    LIBVIRT_DEFAULT_URI = "qemu:///system";
  };
  variables = {
    XDG_CONFIG_HOME = xdg.configHome;
    XDG_CACHE_HOME = xdg.cacheHome;
@ -25,11 +32,8 @@
      then "pixman"
      else "gles2";
    EDITOR = "/etc/profiles/per-user/${psCfg.user.name}/bin/nvim";
    VISUAL = "/etc/profiles/per-user/${psCfg.user.name}/bin/nvim";
    # fix "xdg-open fork-bomb" your preferred browser from here
-    BROWSER = "${pkgs.firefox-wayland}/bin/firefox";
+    BROWSER = "firefox";
    # node
    NODE_REPL_HISTORY = "${xdg.dataHome}/node_repl_history";
@ -41,9 +45,6 @@
    NPM_CONFIG_CACHE = "${xdg.configHome}/npm";
    # TODO: used to be XDG_RUNTIME_DIR NPM_CONFIG_TMP = "/tmp/npm";
    # Make sure virsh runs without root
    LIBVIRT_DEFAULT_URI = "qemu:///system";
    # wine
    WINEPREFIX = "${xdg.dataHome}/wineprefixes/default";
@ -86,23 +87,6 @@
    # FZF shell history widget default colors
    FZF_DEFAULT_OPTS = lib.mkForce "--color=bg+:#2d2a2e,bg:#1a181a,spinner:#ef9062,hl:#7accd7 --color=fg:#d3d1d4,header:#7accd7,info:#e5c463,pointer:#ef9062 --color=marker:#ef9062,fg+:#d3d1d4,prompt:#e5c463,hl+:#7accd7";
    # nnn theme colors
    NNN_FCOLORS = let
      BLK = "04";
      CHR = "04";
      DIR = "04";
      EXE = "02";
      REG = "00";
      HARDLINK = "01";
      SYMLINK = "01";
      MISSING = "01";
      ORPHAN = "07";
      FIFO = "05";
      SOCK = "05";
      OTHER = "02";
    in
      BLK + CHR + DIR + EXE + REG + HARDLINK + SYMLINK + MISSING + ORPHAN + FIFO + SOCK + OTHER;
  };
  envListNames = lib.attrsets.mapAttrsToList (name: value: name) variables;
@ -120,5 +104,5 @@ in {
    systemd.user.sessionVariables = variablesWithMeta;
  };
-  environment.variables = variablesWithMeta;
+  environment.variables = globalVariables;
 }
--- a/secrets/drone-db-secrets.age
+++ b/secrets/drone-db-secrets.age
@ -0,0 +1,24 @@
 age-encryption.org/v1
 -> ssh-ed25519 Y0ZZaw 4IYDRUd6wQzWDLzyFLPzy/t8L1V1UT/KwgfMLvDn5GQ
 4lKiqrafTVNtmcbbWdDsEkPSaN0/1Ud1k+rW1p0Wi0I
 -> ssh-ed25519 BVsyTA 5kVXS829ZZONa7iqxXQXpcQ4eoKEH14Aah6Oo6plWjE
 Rv06OqEOnVjrlwBy8JtfV+v+arbqrO2Cv6paIx0Bzf0
 -> ssh-rsa kFDS0A
 dvnz72ZtLpuBJfJEoXBb9TyQuEtNK1VZBXtSq9X7RL4fg4rbvGWRiGwl+IH1u8Tp
 6TPephD603lGkxhglh9KlmVp7vqZ4ILRN9836b4Ic0kPttK7iCWoRQsLzHMpwQyD
 Lb8ViRCIj+a2ZWfThaxjSXjXgDR5ZJGrnSwHhxsK9R3A4YUhT8jLvVRCfrUYhtPu
 9AhhT3P9FceflBJzIrD0lozYyaFi5eV4dySAgGyuuBzPXmdWZiOoEbArV9M/N1ss
 LJ/Nf23Ki39qe8w6YelcbhZTi6D2zfOA34Rd+QO8xzZFKKk0iZVSJ0ODk0I42itY
 rxiOQFX3Mpv2/FoqOzJY9WeFHHw61pfZid5UkjFLaongel60a0QSrJvhNoz8J5Jp
 k1GitKbBJl9V69XDY8RqQyDspImOkf7M7497C3OjdUtQkzC2cHzIfbDIi36Oifyp
 254KLVyCtArCqKZClnwcXAl9KtP4d9FM1TL7vSsJM67wfSpWakm5gptSM3WyYsZy
 Y2NkVU/Mk1AQLyrYKz+jtEwTmcrGo8zUFwKQZrXkytNV+vlWxwUAjZupNef5Ih7F
 6okWpmRTjozIZzdJgAHSJ96nnbu5QZt0GmmJ+LtCfIZ+1W3M156hODwCaN9Qg6Ki
 30MR/njAjWE7o5TB+gI6iV2OYxd0/Yqyy9lIdEEllFk
 -> ssh-ed25519 cakP9w usfEkp11W/3dAIKp0EcTL0NJe8cMHLJamShjSEbc+EA
 cVK/YSYLIvcXeZWpqEUHkwufHxOIR4uYOvZGi2eMNz4
 -> ym-grease
 INN4gag+EYKDUsKFd8N2CrLBWtRGC/BKP4IEfaAt4a5L1FFUAeEaRRAfuQ5ZWvnG
 vV0T8ASMwsMJ07X2X2faghc
 --- 7BrGKq+40E31/Jz0C6jg7Jequ0k4W+71wjLGLdR+9vg
 †Ì"	Ñ‡dRY$†ñ œîŽÌÚZüä“w2«	£AKà MŒÜ./ÀžÌàU!ûÐÖj'$¡û¥šâ 8n`<60>û5ÛDØñ0J<Û<>¸ßˆëÂ*¹YÎ>“†›³R¹fÍ•²Š|/ôlS‰ÄòJÚëÊ`2‘á[§ƒ í™ì
--- a/secrets/drone-secrets.age
+++ b/secrets/drone-secrets.age
--- a/secrets/gitea-database-password.age
+++ b/secrets/gitea-database-password.age
--- a/secrets/gitea-mailer-password.age
+++ b/secrets/gitea-mailer-password.age
@ -0,0 +1,23 @@
 age-encryption.org/v1
 -> ssh-ed25519 Y0ZZaw KuyePsvWNh4rYXs8Eiq7JXZdVOUzewtQ9jEcOqTOTCs
 69jfk3fZ9gTJyq1dIJmi9KGAhlZ307fQLSgPmDm7/yQ
 -> ssh-ed25519 BVsyTA V9RtiFn2g/7PPL3ragEn51VIiRyKlW889Uc1fAqkc0I
 IQv7b2Rei0rdp0MJEsSqwQmjUmWlNcUHjzvsEk/anro
 -> ssh-rsa kFDS0A
 RfWK33SKHaI2/gw3/1h76dhJq/0z1fgl8JVjsKmPgj/K+TPH05DoObBmKG2wAwcg
 xA48ejVh4zIHhQkbTrnfOYUo32WJvtxEzDZcgwi2ZOJlhrZ8p8aIcoGVgcNiPI8V
 S2hN52aCjKtnz6+zzBaEsbsNEyqlAD6hIvjnBDgQUNy9tVSWhPZbbkkLD7vZ24iH
 MilVTDV6jUAxlgq+Yb3bxIyYhFlb0ACkc9D3XxmKp4Ukcag9HJ1dn0OPw2NEdEnO
 KCydY9aHqcw8nbTpDLzwXPgh6HPKXa7aNrfvKRrM6B6nA4Cy8hr+QcxBCEYBsVdm
 dzojEhJm/SccBhEbzPRyla1dUsdfM8tQzy4hg/4bAvmSb3sSqZX3LUhE8NhPML4c
 Vb5+0GUOyQ8zPZfORoT6L7785d5eeWJ9SbKnr2rteEJfzOLeHdM/IdJNXgP0u6ee
 BMaf/Jo3A6JPpYurHvUCWPulyEsic7LuVrEi6HnQmzeX342B7Gn/srL6YzsfGeV+
 j1G1AIUv+QHdz4bX3oqGgqwVGaPbcRClZDnB/Gq+a3E+zJVEGnFagoBSDE2/jpC0
 KXAzaS3CaZ4wqKRZJA/GGWu+KZXA7F87Gr1I84jwdhyn6Dr1l51z0s4NFx6gmYW2
 Nz7QUZz15DNcIXLdpz3XJqSpJ1sinkcVkCdQykv+miI
 -> ssh-ed25519 cakP9w Ghr10m5/sD5g4yyMtOrPiO3SEbmhrXMjtRVQf8c4I3E
 hbb4UOdZ7E2u7ImAAkyr4FV/pACSEopucguPLjQYo98
 -> 7=-grease <]_?g0s
 --- 2SbSEW2lbLlhNC7fPB52ZLLfhV1kywGzsLKFhZHRZaE
 ÔîæqX›yónÃ}øqÍ
¥ïzYv1tc¢nÚp¨v“Þ!ðÎ»OÑè§ƒâ>
--- a/secrets/hosting.de-api-key.age
+++ b/secrets/hosting.de-api-key.age
@ -0,0 +1,24 @@
 age-encryption.org/v1
 -> ssh-ed25519 Y0ZZaw 20k6EMk3iFO98VaGMQVxAxLuCIKp8M8DN3SucCtNNlM
 Za5+geQFA/CVkj/IADKmrj3EIsKcj4l9jETuvQbApCE
 -> ssh-ed25519 BVsyTA vqpU3pzGierKMAKK0Gn/xvEkdebGgfahP5CmRE8tZTY
 ZsmYvYgFzOL2PL1mLJ8vwoWiT1bngJq1Y4P3MBYcbbI
 -> ssh-rsa kFDS0A
 chQyiXGW3eND86nYKKZVX3Tr3MKVYJXoQccbYn5yGEmXw17U67z2YgbgXcKJGszE
 FiOKe6fWCbrnCi/GkktM+bbnbJtfCOFK/J2VlVQrHScibel0z4+yd0aeH02EVHla
 34vcv2Tdi09BVn5Me2Gh94/CKgzAiIIHmvDfYFsBZNQOalAbn0PvpHFJcVnf2DsR
 bVgOKL8l4mHz/gihI5cCr5snz3ClhHv/aFbTR2QpHPKAfz5aRi0pe9phpqv9TDb9
 3taeIDZ2dIVpASyqIBxzxzep6liJrupldmQQGpzleKpRfqPWrM5BAmMHr6/LiP24
 caHaP7SOVTr1s1wo4Qh8x97LrXYe2AEmJogteoLJddYYgqYhJuoCS62dDbyry32D
 3BHJTcxl2OsgFDP9Q9uABhwNExdu9z7ohbvyOwZ3ZkgEbpFOKPAOExKK0FV6C5R3
 nKox0yPZGIsTP0wjjyWlZAwUkNIj1m5gXL6l3h4930EnPZFe7vg+lfC/4v2V21pE
 l5U1a+LqBzOk7qCgVgtbAZZEIvK8s0kZYLmPmtMyjIm/mnl6yxY80Kwf6oTlb6KN
 bFopzuBfmCZk3hVzkrVDmpxpWTcFclSG7H/R+1SSibHOL0RcLuULhrVHd4qOPYrQ
 I4jDt3nmUKU1si1IhOQe20NKG3DokMGDQk3balKIMfU
 -> ssh-ed25519 cakP9w zXYz3ME+JJqwpWGFlnHzTxNTvpGMXAZB00rrh0MN1wc
 tgNVf1JJWPkU7TxYcakGE+omp1fNqwXVzyQBpPAdVCU
 -> Sq|yWUT-grease N>}A9
 TvMfldFuvLXmFvEmgZTd8zXY2iH9Sw
 --- jyypo7T4RplBaZ94/suJgMliWbt4tQNMhrDUv/YMaYE
 ž ÒS=Š8¶¨å¹Æ¸k®C¶³UÜŽ<C39C>2eõX}$G-oØžCÖl=ýÛQ¥û_§áÞ¡r)ädâyHûiÇ<69>[*aµÄ R®ã
 X
--- a/secrets/keycloak-database-password.age
+++ b/secrets/keycloak-database-password.age
--- a/secrets/mailman-core-secrets.age
+++ b/secrets/mailman-core-secrets.age
@ -0,0 +1,23 @@
 age-encryption.org/v1
 -> ssh-ed25519 Y0ZZaw gkhWIVF4XyeitN9y4jhIplrFAzkT+vUIXyyQKh/7IwU
 DWi5ZfTdf9QzqTFLD++3ctckO9DiBOynHqWfhyc4InI
 -> ssh-ed25519 BVsyTA afwxuuU7CZIzOZeN0aNDsPm3GQc1/pK1PJ9Yc6DnoHk
 2wkHEvDZb8FoRygCn08arkh2GZh5nxMO2ag5y7nAdzA
 -> ssh-rsa kFDS0A
 KZRclxsJja35rXgVUlFqBe3tOEryUTePT748oNs5LJoAi/h9PnRwIW4K/pzgFqVL
 ADcMb5T8WBqDJ/JvZKkOXOERIj9K2KGx2ETCYat0wgB/ojB8ER7NIsEaVmcbKyY0
 5x7DP07DGdkdkzfPNaRhsFBL4xoF8LxrR3ZjKR++c0ICMQ6WKOuXB0J6spBv15rR
 IE4yOpV+vhYoUh1X9tGKfNthxKnV40FtJX6ucSmIoGbRAzdZUACRDRVjWgNVJc+x
 ucbOnJE1UA1T/ttxFRkjIFg7jPyv75YPAUO+/u+0xrxQfsDhXY4zuvz+2Ze9gwue
 WQWHR2kKrv5udYCMLCug1f1QpgeBiysW+EzseR0sgLfSNGH/sssB8RNnXU2hruc0
 oMvnsSNTfLCD+xzMbDhJbELI415sVfbJ9Lm29Sv60k03aW7HagTdNGwQJ8qJeeeX
 XM+z089encgbej/iuruH4JVDAdiNzuEZMgCKWhmcX2VKQxunWTWCdUGpuotL4mL/
 xHxjmz2eEKF3KuSSmEuvtqMkVVJYRbpIjj7p1cMGE2DsA/sTWEd49hSBkkfV12pt
 lxyk1/0bPRI90qQb6slRm9R9DRwJp1v9Cht/ZEmNvOdXskTgBT3hyi6/8ykYZlvT
 ogX3qz4OF7KftBA+5YHWvA99tvKmUKN6bcCWVbFwtDo
 -> ssh-ed25519 cakP9w hMZotYYfld14w9/8QGj7D0iTeXJ3CZ6h08PF1mjrqmQ
 9ZJMVHwwU/a0AJNmSXHf9q/4Ap1tJvhXCsga0nY2REw
 -> ukh-grease
 k5f1OA
 --- qmDVJB1ai7/Ps+Wb2fXtyM5rIvH9e/2u6dDbf1/EefE
 ³lö—ƒj£C$ŽÁ”Î ý£ïð·X™¤ü—mË)(-bôIÙ1
pÀÊý&ˆI¶DºÞQ?cvŠ	’y‹\†¾>cAïãÞwJ)Ÿxme^,¿y±ÉÓÚÂænv\ÍE®º`…¹ô³3²â™LÑÍxŸ„úÁ%ü6rŒ).öx.¶Bü Ó|W£6ù½Àœóüä0%t.YyÆ4u½¯R±Ãe±Ó*‚	/Wi!PKj3‚½tG‘¬nôüüIoVÍ-ÂIá„¤<E2809E>6e‰€G6$Õ|(>]ißt½ÎÚ<C38E>k1ue»ª·,jómÆl,~Ïß×#fY>quÏz¤`íø4{ÙÜÝVj¢ÊÒï/ž’:3zºÜãj	?yË¦€Aq!ÊªÁ\N3žò.¡áïë ŽW•®¢œ«  p˜9˜µ‘¼å®ŒÛ
--- a/secrets/mailman-db-secrets.age
+++ b/secrets/mailman-db-secrets.age
@ -0,0 +1,23 @@
 age-encryption.org/v1
 -> ssh-ed25519 Y0ZZaw vcObihtzXJ3+hQDnNQ37nWiv6I+aSfX6u5U/KAxO+Rk
 hrcPHjL0qMaFN6Rj0AqO73L0EpH6H1AjC6cHwoJiDa4
 -> ssh-ed25519 BVsyTA O7ALAsno95CTjlrHpYeUhw5avBHYzVZLP/c8nPg+BCY
 mx3H5mB6Q1WavsjIIuUIC6pe/YHTE45bRh6SDbTZEhQ
 -> ssh-rsa kFDS0A
 pj+13dL6H7gPkh/b3vZOztRM7VdSElkeB4SjsfZh2lZoMpjhuiQuUauxJl+pAAXZ
 37evEIcAmDnrl2+tBXq/9krry4DbpYRL7Mz4TYjYmSn2sRDDd4q/Tv1bXdLwuZ8G
 svq1qWhDkAsL6rxzpOV+EsE2EyZxtGx0Odgp7GMmAJq1Vrm8NUF/+Nh3V8LtDmtz
 08tgebfKoWDRFnDbWN7Du+TN9TUp4MlpMPUqjJPDVmsVsVsKTRvck+M8iTaf9HPv
 GJ9TNPwDN9ZvL+0jFd+v440MqXsejsrxIxPHQ/KsgnOciiW58Drn2vNyBL3FVYxG
 C+JzKsRl3AQpP6qoXv5I1pwitI9yLXf+7aSyVUANUWU3ZG8M1KIGtIBTMHAh4w+B
 yJl5qwY2Ty3FKbi3alT7SdWBlRK/m6Lqh6qFSa9kptpgIQ6D3nzWOhrs8tdRFuYm
 6ilwarYuDXD+eLukBJ63l1OL1jVicLpMJXp40v2iQisDR3ifW7dHRXyadGIBvbHl
 6c9ZQP6WritVR3CCZIHSBoxnUD5pGV+KbfbHh0Q1E2goV4SOGyivG4q9iXKIGk6A
 S1Yl5/kwA+/gzc0VdgQmcr9dFe8jC4n5SsaFRAzr+2e+IjH2EhinJlERFwxDJ6+q
 ADeLbCApDA2mKNBiZ2c1p12F+iL7Vk07xLV0owHvNOw
 -> ssh-ed25519 cakP9w ay0pLMA3UdI/7XtF9GgftyKavJe89NqdpzYVP4+Trgk
 ptOrYOEC7NgQPXF3EnuUaySQqJqP30Ez1lY+0RmXUTg
 -> ma-grease (S#' ?5>*(YT
 N6grE/WR7SJGCaVJcWYSVxeeiA
 --- +u1sOmxTLHDiBiOFP0aI7VQvxQX3NYnq586q4LhJk1Q
 »?S ÿ¿…¹aª“à_²ÑcÄY-ù Å®$¦{]s]<7F>…<EFBFBD>ª2µÎQbÁXˆ|Å^µÿ:Xþ"õðøã§rÐÅÝ‰p”w±I=WUúØdBÈ‰ÄC òž
2¿¹Ê„+àI\a¬ú¸ù5ì$TG[òè=ËÖ ?_¶ p™¢°‘â²™d^ó%Ô&èTÎ”¥ÿàNÚ
--- a/secrets/mailman-web-secrets.age
+++ b/secrets/mailman-web-secrets.age
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@ -1,8 +1,31 @@
 let
  # set ssh public keys here for your system and user
-  system = "";
+  b12f-bbcom = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCmXpOU6vzQiVSSYCoxHYv7wDxC63Qg3dxlAMR6AOzwIABCU5PFFNcO0NWYms/YR7MOViorl+19LCLRABar9JgHU1n+uqxKV6eGph3OPeMp5sN8LAh7C9N+TZj8iJzBxQ3ch+Z/LdmLRwYNJ7KSUI+gwGK6xRS3+z1022Y4P0G0sx7IeCBl4lealQEIIF10ZOfjUdBcLQar7XTc5AxyGKnHCerXHRtccCoadLQujk0AvPXbv3Ma4JwX9X++AnCWRWakqS5UInu2tGuZ/6Hrjd2a9AKWjTaBVDcbYqCvY4XVuMj2/A2bCceFBaoi41apybSk26FSFTU4qiEUNQ6lxeOwG4+1NCXyHe2bGI4VyoxinDYa8vLLzXIRfTRA0qoGfCweXNeWPf0jMqASkUKaSOH5Ot7O5ps34r0j9pWzavDid8QeKJPyhxKuF1a5G4iBEZ0O9vuti60dPSjJPci9oTxbune2/jb7Sa0yO06DtLFJ2ncr5f70s/BDxKk4XIwQLy+KsvzlQEGdY8yA6xv28bOGxL3sQ0HE2pDTsvIbAisVOKzdJeolStL9MM5W8Hg0r/KkGj2bg0TfoRp1xHV9hjKkvJrsQ6okaPvNFeZq0HXzPhWMOVQ+/46z80uaQ1ByRLr3FTwuWJ7F/73ndfxiq6bDE4z2Ji0vOjeWJm6HCxTdGw==";
-  user = "";
+  teutat3s-dumpyourvms = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHcU6KPy4b1MQXd6EJhcYwbJu7E+0IrBZF/IP6T7gbMf teutat3s@dumpyourvms";
-  allKeys = [system user];
+  flora-6 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGP1InpTBN4AlF/4V8HHumAMLJzeO8DpzjUv9Co/+J09 root@pub-solar-infra-vm-1";
  nougat-2-host = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINELr5Bvr15GqCHevg9QP8oYFgmaRUUHcPFf4MZho9gI root@nougat-2";
  allKeys = [
    flora-6
    teutat3s-dumpyourvms
    b12f-bbcom
    nougat-2-host
  ];
  deployKeys = [
    flora-6
    teutat3s-dumpyourvms
    b12f-bbcom
    nougat-2-host
  ];
 in {
-  "secret.age".publicKeys = allKeys;
+  "gitea-database-password.age".publicKeys = deployKeys;
  "gitea-mailer-password.age".publicKeys = deployKeys;
  "keycloak-database-password.age".publicKeys = deployKeys;
  "drone-secrets.age".publicKeys = deployKeys;
  "drone-db-secrets.age".publicKeys = deployKeys;
  "mailman-core-secrets.age".publicKeys = deployKeys;
  "mailman-web-secrets.age".publicKeys = deployKeys;
  "mailman-db-secrets.age".publicKeys = deployKeys;
  "hosting.de-api-key.age".publicKeys = deployKeys;
 }
--- a/users/barkeeper/default.nix
+++ b/users/barkeeper/default.nix
@ -0,0 +1,42 @@
 {
  config,
  hmUsers,
  pkgs,
  lib,
  ...
 }: let
  psCfg = config.pub-solar;
 in {
  config = {
    home-manager.users = {inherit (hmUsers) barkeeper;};
    pub-solar = {
      # These are your personal settings
      # The only required settings are `name` and `password`,
      # The rest is used for programs like git
      user = {
        name = "barkeeper";
        description = "pub.solar infra user";
        password = "$6$MCJ28kLwfNl9SNDq$Oh9eT6Sn6z4xGrQsLlIBI7cvJzX3P5As59OSZ.hoeBWc79Un2YdwH/hRIC.4ZDOuwQp0lHI82dNn/xeTaCn631";
        fullName = "pub.solar infra barkeeper";
        email = "admins@pub.solar";
        gpgKeyId = "";
        publicKeys = [
          "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCmiF8ndGhnx2YAWbPDq14fftAwcJ0xnjJIVTotI12OO4SPX/SwH5Yp8C8Kf002qN9FbFmaONzq3s8TYpej13JubhfsQywNuFKZuZvJeHzmOwxsANW86RVrWT0WZmYx9a/a1TF9rPQpibDVt60wX8yLdExaJc5F1SvIIuyz1kxYpz36wItfR6hcwoLGh1emFCmfCpebJmp3hsrMDTTtTW/YNhyeSZW74ckyvZyjCYtRCJ8uF0ZmOSKRdillv4Ztg8MsUubGn+vaMl6V6x/QuDuehEPoM/3wBx9o22nf+QVbk7S1PC8EdT/K5vskn4/pfR7mDCyQOq1hB4w4Oyn0dsfX pi@ssrtc"
          "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBHx4A8rLYmFgTOp1fDGbbONN8SOT0l5wWrUSYFUcVzMPTyfdT23ZVIdVD5yZCySgi/7PSh5mVmyLIZVIXlNrZJg= @b12f Yubi Main"
          "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEST9eyAY3nzGYNnqDYfWHu+89LZsOjyKHMqCFvtP7vrgB7F7JbbECjdjAXEOfPDSCVwtMMpq8JJXeRMjpsD0rw= @b12f Yubi Backup"
          "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBFro/k4Mgqyh8yV/7Zwjc0dv60ZM7bROBU9JNd99P/4co6fxPt1pJiU/pEz2Dax/HODxgcO+jFZfvPEuLMCeAl0= YubiKey #10593996 PIV Slot 9a @teutat3s"
          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII/58A18EtxnLYHu63c/+AyTSkJQSso/VVdHUFGp1CTk cardno:FFFE34353135 @hensoko"
          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAqkqMYgncrnczcW/0PY+Z+FmNXXpgw6D9JWTTwiainy hensoko@hensoko-tp-work"
          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEbaQdxp7Flz6ttELe63rn+Nt9g43qJOLih6VCMP4gPb @hensoko"
          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIKa5elEXgBc2luVBOHVWZisJgt0epFQOercPi0tZzPU root@cloud.pub.solar"
          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMNeQYLFauAbzDyIbKC86NUh9yZfiyBm/BtIdkcpZnSU axeman@tuxnix"
        ];
      };
    };
  };
 }
		`@ -0,0 +1 @@`
							`lib: lib.concatStrings (lib.lists.reverseList ["et" ".n" "zz" "wd" "h"])`