config/hosts/forgejo/forgejo.nix

@@ -3,6 +3,7 @@
   services.forgejo = {
     enable = true;
     database.type = "postgres";
+    mailerPasswordFile = "/secrets/forgejo-mailer-password.secret";
 
     settings = {
       DEFAULT = {
@@ -59,6 +60,5 @@
         HOST = "redis+socket:///run/redis-forgejo/redis.sock";
       };
     };
-    secrets.mailer.PASSWD = "/secrets/forgejo-mailer-password.secret";
   };
 }

config/hosts/keycloak/keycloak.nix

@@ -3,10 +3,10 @@
   services.keycloak = {
     enable = true;
     settings = {
-      hostname = "https://id.nekover.se";
+      hostname = "id.nekover.se";
-      hostname-admin = "https://keycloak-admin.nekover.se";
+      hostname-admin = "keycloak-admin.nekover.se";
-      proxy-headers = "forwarded";
+      hostname-strict-backchannel = true;
-      http-enabled = true;
+      proxy = "edge";
       http-host = "127.0.0.1";
       http-port = 8080;
     };

config/hosts/mail-1/configuration.nix

@@ -15,20 +15,28 @@
         ];
         routes = [
           {
+            routeConfig = {
               Gateway = "10.202.41.1";
               Destination = "10.201.0.0/16";
+            };
           }
           {
+            routeConfig = {
               Gateway = "10.202.41.1";
               Destination = "10.202.0.0/16";
+            };
           }
           {
+            routeConfig = {
               Gateway = "10.202.41.1";
               Destination = "172.21.87.0/24";
+            };
           }
           {
+            routeConfig = {
               Gateway = "10.202.41.1";
               Destination = "212.53.203.19/32";
+            };
           }
         ];
         linkConfig.RequiredForOnline = "routable";
@@ -54,11 +62,13 @@
           PrivateKeyFile = "/secrets/wireguard-mail-1-wg0-privatekey.secret";
         };
         wireguardPeers = [{
+          wireguardPeerConfig = {
             PublicKey = "ik480irMZtGBs1AFpf1KGzDBekjdziD3ck7XK8r1WXQ=";
             PresharedKeyFile = "/secrets/wireguard-valkyrie-mail-1-mail-1-psk.secret";
             Endpoint = "212.53.203.19:51822";
             AllowedIPs = [ "0.0.0.0/0" ];
             PersistentKeepalive = 25;
+          };
         }];
       };
     };

config/hosts/mail-2/configuration.nix

@@ -15,20 +15,28 @@
         ];
         routes = [
           {
+            routeConfig = {
               Gateway = "10.201.41.1";
               Destination = "10.201.0.0/16";
+            };
           }
           {
+            routeConfig = {
               Gateway = "10.201.41.1";
               Destination = "10.202.0.0/16";
+            };
           }
           {
+            routeConfig = {
               Gateway = "10.201.41.1";
               Destination = "172.21.87.0/24";
+            };
           }
           {
+            routeConfig = {
               Gateway = "10.201.41.1";
               Destination = "217.160.117.160/32";
+            };
           }
         ];
         linkConfig.RequiredForOnline = "routable";
@@ -54,11 +62,13 @@
           PrivateKeyFile = "/secrets/wireguard-mail-2-wg0-privatekey.secret";
         };
         wireguardPeers = [{
+          wireguardPeerConfig = {
             PublicKey = "Nnf7x+Yd+l8ZkK2BTq1lK3iiTYgdrgL9PQ/je8smug4=";
             PresharedKeyFile = "/secrets/wireguard-lifeline-mail-2-mail-2-psk.secret";
             Endpoint = "217.160.117.160:51820";
             AllowedIPs = [ "0.0.0.0/0" ];
             PersistentKeepalive = 25;
+          };
         }];
       };
     };

config/hosts/nextcloud/nextcloud.nix

@@ -2,7 +2,7 @@
 {
   services.nextcloud = {
     enable = true;
-    package = pkgs.nextcloud30;
+    package = pkgs.nextcloud29;
     hostName = "cloud.nekover.se";
     https = true;
     config = {

config/hosts/torrent/configuration.nix

@@ -25,5 +25,5 @@
     };
   };
 
-  system.stateVersion = "24.11";
+  system.stateVersion = "23.11";
 }

config/hosts/torrent/sonarr.nix

@@ -1,19 +1,8 @@
-{ ... }:
+{ nixpkgs-unstable, ... }:
 {
-  # The sonarr package is dependend on .NET 6 which is marked as insecure.
-  # It doesn't seem to build with the later .NET versions.
-  # In the meantime allow the installation of these insecure packages since sonarr is only reachable locally.
-  nixpkgs.config = {
-    permittedInsecurePackages = [
-      "aspnetcore-runtime-wrapped-6.0.36"
-      "aspnetcore-runtime-6.0.36"
-      "dotnet-sdk-wrapped-6.0.428"
-      "dotnet-sdk-6.0.428"
-    ];
-  };
-
   services.sonarr = {
     enable = true;
+    package = nixpkgs-unstable.legacyPackages."x86_64-linux".sonarr;
     user = "torrent";
     group = "torrent";
   };

flake.lock

@@ -34,11 +34,11 @@
     },
     "nixlib": {
       "locked": {
-        "lastModified": 1732410305,
+        "lastModified": 1731805462,
-        "narHash": "sha256-/hxIKRTBsdrnudJWDGaBN8wIjHovqVAVxXdi8ByVtck=",
+        "narHash": "sha256-yhEMW4MBi+IAyEJyiKbnFvY1uARyMKJpLUhkczI49wk=",
         "owner": "nix-community",
         "repo": "nixpkgs.lib",
-        "rev": "87b6978992e2eb605732fba842cad0a7e14b2047",
+        "rev": "b9f04e3cf71c23bea21d2768051e6b3068d44734",
         "type": "github"
       },
       "original": {
@@ -55,11 +55,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1732496924,
+        "lastModified": 1732151224,
-        "narHash": "sha256-/MNhZLR0eh9z/d3l+ammq+F5XxHln0RHgO4Bhtjr0IM=",
+        "narHash": "sha256-5IgpueM8SGLOadzUJK6Gk37zEBXGd56BkNOtoWmnZos=",
         "owner": "nix-community",
         "repo": "nixos-generators",
-        "rev": "098e8b6ff72c86944a8d54b64ddd7b7e6635830a",
+        "rev": "3280fdde8c8f0276c9f5286ad5c0f433dfa5d56c",
         "type": "github"
       },
       "original": {
@@ -70,16 +70,16 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1732954812,
+        "lastModified": 1732244845,
-        "narHash": "sha256-RvyWCxT6O9ugSqSXHAMaFTIZtKS7SBHdUHKLoPW1/xg=",
+        "narHash": "sha256-aspop5sCDNpDMS23BplGFtQDadwkSb/sOxpuC3lafvo=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "809802e9ab4b56e7a3db576832e95e3f7b74781a",
+        "rev": "df94f897ffe1af1bcd60cb68697c5d8e6431346e",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-24.11-small",
+        "ref": "nixos-24.05-small",
         "repo": "nixpkgs",
         "type": "github"
       }
@@ -101,11 +101,11 @@
     },
     "nixpkgs-master": {
       "locked": {
-        "lastModified": 1732997066,
+        "lastModified": 1732479666,
-        "narHash": "sha256-9Vvu3a1ep1LB6F/kVE2hHH2HQzhSFtUyJYiJRkUkC4Q=",
+        "narHash": "sha256-1wRCB9ZbD+9fQ/JL2nllb4vH6J3ojSHew6FazRPjqqc=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "33b9d57c656e65a9c88c5f34e4eb00b83e2b0ca9",
+        "rev": "4a58b6f6b83d29354def3125c45530d7e1bda0fd",
         "type": "github"
       },
       "original": {
@@ -117,11 +117,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1732951447,
+        "lastModified": 1732446744,
-        "narHash": "sha256-ndq0dD5E6FkqwmNYFS1wUAHa/5HixS3jLjulogM+7/E=",
+        "narHash": "sha256-yXqgr+GiC/RBr8n/6Bn9eRagitXbKXNcoSaZUCovuwI=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "57feb2a16f705eeffb075888d92a986e66473012",
+        "rev": "2570b87e71ea16daadf0a93f1eae2d3ad4478a94",
         "type": "github"
       },
       "original": {

flake.nix

@@ -1,6 +1,6 @@
 {
   inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.11-small";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.05-small";
     nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixos-unstable-small";
     nixpkgs-master.url = "github:NixOS/nixpkgs/master";
     nixos-generators = {

hosts.nix

@@ -92,7 +92,6 @@ in
       environment = "proxmox";
     };
     torrent = {
-      hostNixpkgs = nixpkgs-unstable;
       site = "vs";
       environment = "proxmox";
     };