From 2a8f0b0564172c7e00c2c1bb3172127a3509bdbb Mon Sep 17 00:00:00 2001 From: Fiona Grzebien Date: Sat, 16 May 2026 22:49:13 +0200 Subject: [PATCH 1/7] Add sops-nix --- flake.nix | 6 +++++- hosts.nix | 3 ++- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/flake.nix b/flake.nix index 2841638..7ea486c 100644 --- a/flake.nix +++ b/flake.nix @@ -8,9 +8,13 @@ inputs.nixpkgs.follows = "nixpkgs"; }; simple-nixos-mailserver.url = "gitlab:simple-nixos-mailserver/nixos-mailserver/nixos-25.11"; + sops-nix = { + url = "github:Mic92/sops-nix"; + inputs.nixpkgs.follows = "nixpkgs"; + }; }; - outputs = { self, nixpkgs, nixpkgs-unstable, nixpkgs-master, nixos-generators, simple-nixos-mailserver, ... }@inputs: + outputs = { self, nixpkgs, nixpkgs-unstable, nixpkgs-master, nixos-generators, simple-nixos-mailserver, sops-nix, ... }@inputs: let hosts = import ./hosts.nix inputs; helper = import ./helper.nix inputs; diff --git a/hosts.nix b/hosts.nix index b59e3d5..86d65e2 100644 --- a/hosts.nix +++ b/hosts.nix @@ -1,4 +1,4 @@ -{ nixpkgs, nixpkgs-unstable, nixpkgs-master, ... }: +{ nixpkgs, nixpkgs-unstable, nixpkgs-master, sops-nix, ... }: let # Set of environment specific modules environments = { @@ -22,6 +22,7 @@ let modules = [ ./config/common ./config/hosts/${name} + sops-nix.nixosModules.sops ] ++ (if environment != "" then environments.${environment} else []); }) hosts; in From 37df75b8cb0b39adf06b488e316510a1ba9301e9 Mon Sep 17 00:00:00 2001 From: Fiona Grzebien Date: Sat, 16 May 2026 22:50:29 +0200 Subject: [PATCH 2/7] flake.lock: Update MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Flake lock file updates: • Updated input 'nixpkgs': 'github:NixOS/nixpkgs/a3c34a1dd63140ab2150ebb4fa290bbbae58193b?narHash=sha256-wVKu7ZYV3ikh7RVDY1TVlaKwPTFvfkYnOzQGn3IqT4o%3D' (2026-05-15) → 'github:NixOS/nixpkgs/30f30521f3fce93c4c22bb43941cdf8e2d90d311?narHash=sha256-/VER73JyDAsvWXmEk6Qph%2Bq1cXLof4iXtxgwKsj3cP8%3D' (2026-05-16) • Updated input 'nixpkgs-master': 'github:NixOS/nixpkgs/b0415a300a8d2daf19019ef418f0b019ee38cf47?narHash=sha256-NZ9yg%2BVJy6RftGD3YXeqCEEVsPZH9hPu6yWm/bAuqLM%3D' (2026-05-15) → 'github:NixOS/nixpkgs/183fe40a77b6860ddd8ed01433d0f4f2f5343e7b?narHash=sha256-W9Dm45lszeihc0BZIHeLMVAJzOETAZtgQQbPhqyLPA0%3D' (2026-05-16) • Updated input 'nixpkgs-unstable': 'github:NixOS/nixpkgs/758b562bc257084aef30b8e3efbdd61d292806c3?narHash=sha256-BxYhb8H0aVtiM1kGRt%2BS49NbsJMUMIHvOXxziE9u0nY%3D' (2026-05-15) → 'github:NixOS/nixpkgs/5a51fe22e18a6ce886b3cffa4c255378c151323c?narHash=sha256-FqqcYr0c5in/HRL5bkRWykAGp/Q10Vj/zUiSr1P8URE%3D' (2026-05-16) • Added input 'sops-nix': 'github:Mic92/sops-nix/c591bf665727040c6cc5cb409079acb22dcce33c?narHash=sha256-VfGRo1qTBKOe3s2gOv8LSoA6Fk19PvBlwQ1ECN0Evn8%3D' (2026-05-05) • Added input 'sops-nix/nixpkgs': follows 'nixpkgs' --- flake.lock | 41 +++++++++++++++++++++++++++++++---------- 1 file changed, 31 insertions(+), 10 deletions(-) diff --git a/flake.lock b/flake.lock index 4ef9f2a..9140b1e 100644 --- a/flake.lock +++ b/flake.lock @@ -118,11 +118,11 @@ }, "nixpkgs": { "locked": { - "lastModified": 1778830137, - "narHash": "sha256-wVKu7ZYV3ikh7RVDY1TVlaKwPTFvfkYnOzQGn3IqT4o=", + "lastModified": 1778917931, + "narHash": "sha256-/VER73JyDAsvWXmEk6Qph+q1cXLof4iXtxgwKsj3cP8=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "a3c34a1dd63140ab2150ebb4fa290bbbae58193b", + "rev": "30f30521f3fce93c4c22bb43941cdf8e2d90d311", "type": "github" }, "original": { @@ -134,11 +134,11 @@ }, "nixpkgs-master": { "locked": { - "lastModified": 1778877216, - "narHash": "sha256-NZ9yg+VJy6RftGD3YXeqCEEVsPZH9hPu6yWm/bAuqLM=", + "lastModified": 1778964530, + "narHash": "sha256-W9Dm45lszeihc0BZIHeLMVAJzOETAZtgQQbPhqyLPA0=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "b0415a300a8d2daf19019ef418f0b019ee38cf47", + "rev": "183fe40a77b6860ddd8ed01433d0f4f2f5343e7b", "type": "github" }, "original": { @@ -150,11 +150,11 @@ }, "nixpkgs-unstable": { "locked": { - "lastModified": 1778843877, - "narHash": "sha256-BxYhb8H0aVtiM1kGRt+S49NbsJMUMIHvOXxziE9u0nY=", + "lastModified": 1778930970, + "narHash": "sha256-FqqcYr0c5in/HRL5bkRWykAGp/Q10Vj/zUiSr1P8URE=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "758b562bc257084aef30b8e3efbdd61d292806c3", + "rev": "5a51fe22e18a6ce886b3cffa4c255378c151323c", "type": "github" }, "original": { @@ -186,7 +186,8 @@ "nixpkgs": "nixpkgs", "nixpkgs-master": "nixpkgs-master", "nixpkgs-unstable": "nixpkgs-unstable", - "simple-nixos-mailserver": "simple-nixos-mailserver" + "simple-nixos-mailserver": "simple-nixos-mailserver", + "sops-nix": "sops-nix" } }, "simple-nixos-mailserver": { @@ -210,6 +211,26 @@ "repo": "nixos-mailserver", "type": "gitlab" } + }, + "sops-nix": { + "inputs": { + "nixpkgs": [ + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1777944972, + "narHash": "sha256-VfGRo1qTBKOe3s2gOv8LSoA6Fk19PvBlwQ1ECN0Evn8=", + "owner": "Mic92", + "repo": "sops-nix", + "rev": "c591bf665727040c6cc5cb409079acb22dcce33c", + "type": "github" + }, + "original": { + "owner": "Mic92", + "repo": "sops-nix", + "type": "github" + } } }, "root": "root", From 668f2ef4d87b27cae4825242a08356094da5d0f2 Mon Sep 17 00:00:00 2001 From: Fiona Grzebien Date: Sat, 16 May 2026 23:41:15 +0200 Subject: [PATCH 3/7] Add ssh-to-age --- config/common/default.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/config/common/default.nix b/config/common/default.nix index 459289f..0fa2d0b 100644 --- a/config/common/default.nix +++ b/config/common/default.nix @@ -35,6 +35,7 @@ parted tmux nano + ssh-to-age tcpdump ]; From bff3401adaf70282958dc867d968c09c86baa4c7 Mon Sep 17 00:00:00 2001 From: Fiona Grzebien Date: Sun, 17 May 2026 00:19:55 +0200 Subject: [PATCH 4/7] Migrate ikiwiki to sops-nix --- .sops.yaml | 12 ++++++++++++ config/hosts/ikiwiki/default.nix | 1 + config/hosts/ikiwiki/nginx.nix | 9 ++++++++- config/hosts/ikiwiki/secrets.nix | 11 ----------- config/hosts/ikiwiki/secrets.yaml | 25 +++++++++++++++++++++++++ config/hosts/ikiwiki/sops.nix | 6 ++++++ 6 files changed, 52 insertions(+), 12 deletions(-) create mode 100644 .sops.yaml delete mode 100644 config/hosts/ikiwiki/secrets.nix create mode 100644 config/hosts/ikiwiki/secrets.yaml create mode 100644 config/hosts/ikiwiki/sops.nix diff --git a/.sops.yaml b/.sops.yaml new file mode 100644 index 0000000..76cda7e --- /dev/null +++ b/.sops.yaml @@ -0,0 +1,12 @@ +keys: + - &admin_age_fi age1tf38ae8yzzzmtjp5cjyemf0a8cksq62dz0x0hsntyhsjk5pq6s6q3v9nm7 + - &host_age_ikiwiki age1st5axcrn2s09effsjp6gl89rnwd967y007pzpzamlqydrpf7yeeqjwtnx0 +creation_rules: + - path_regex: config/hosts/ikiwiki/.* + key_groups: + - age: + - *admin_age_fi + - *host_age_ikiwiki +stores: + yaml: + indent: 2 diff --git a/config/hosts/ikiwiki/default.nix b/config/hosts/ikiwiki/default.nix index bc9766c..32d16c7 100644 --- a/config/hosts/ikiwiki/default.nix +++ b/config/hosts/ikiwiki/default.nix @@ -4,5 +4,6 @@ ./configuration.nix ./ikiwiki.nix ./nginx.nix + ./sops.nix ]; } diff --git a/config/hosts/ikiwiki/nginx.nix b/config/hosts/ikiwiki/nginx.nix index 9f6462e..6b09cb0 100644 --- a/config/hosts/ikiwiki/nginx.nix +++ b/config/hosts/ikiwiki/nginx.nix @@ -26,7 +26,7 @@ in tryFiles = "$uri $uri/ =404"; }; "~ .cgi" = { - basicAuthFile = "/secrets/ikiwiki-auth-file.secret"; + basicAuthFile = "/run/secrets/auth_file"; extraConfig = '' gzip off; fastcgi_pass unix:${config.services.fcgiwrap.instances."ikiwiki".socket.address}; @@ -45,4 +45,11 @@ in ''; }; }; + + sops.secrets."auth_file" = { + mode = "0440"; + owner = "nginx"; + group = "nginx"; + restartUnits = [ "nginx.service" ]; + }; } diff --git a/config/hosts/ikiwiki/secrets.nix b/config/hosts/ikiwiki/secrets.nix deleted file mode 100644 index d366c75..0000000 --- a/config/hosts/ikiwiki/secrets.nix +++ /dev/null @@ -1,11 +0,0 @@ -{ keyCommandEnv, ... }: -{ - deployment.keys."ikiwiki-auth-file.secret" = { - keyCommand = keyCommandEnv ++ [ "pass" "ikiwiki/auth-file" ]; - destDir = "/secrets"; - user = "nginx"; - group = "nginx"; - permissions = "0640"; - uploadAt = "pre-activation"; - }; -} diff --git a/config/hosts/ikiwiki/secrets.yaml b/config/hosts/ikiwiki/secrets.yaml new file mode 100644 index 0000000..a707f57 --- /dev/null +++ b/config/hosts/ikiwiki/secrets.yaml @@ -0,0 +1,25 @@ +auth_file: ENC[AES256_GCM,data:5/uT1sIOI95LNA9YFWh3I9J2PCZmz/J38YxVsKVWFHfJdZUOQpSW6ekjX7StP/svtv6Tp0AonnvcKfRcyPYn,iv:NKdWae+EihasTMV24Hk+dKJG8032mWu+RWItWs0b6RE=,tag:WBM6pXlKaDXOMnBWGBLJWg==,type:str] +sops: + age: + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArNDZLcEFGRHczMHg3S0w3 + eTNvNGI5TXBWTTc1eXAzZStlSmZTQ3NkdTA4CmlYVEF1NWhldVZuZmwzTUU0NG5j + UFhvU3Q3Q1BvVHhrODJWc296UUo0TmMKLS0tIFFlUGRYVDNNYm40cXhlZ004eFk5 + b3BnLzBjZFpjVDN2clZaTGlWV29NVUEKsdK4V5Og+bK26Gl6HTkOBtFrHfr1RFYu + zWNGQ3skkvATO/ypa0zFf3+qnupCTTO5emwscoRK8ZZFVgSswdnbIA== + -----END AGE ENCRYPTED FILE----- + recipient: age1tf38ae8yzzzmtjp5cjyemf0a8cksq62dz0x0hsntyhsjk5pq6s6q3v9nm7 + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPOUJXWW95OXlEZFFwbHlp + RzJJMDFJU2pUTjltZ1JaWjE5c0xPY0hvNUdZCk5uWk9kdlRWNTNVUUVmT3VVeE9j + ajNNeVlZcEw4WFdqZ2QwTXl2MlhVZ2cKLS0tIFVVUXJtWkhtREFsdXp5ODZkOTA1 + b1h3THFYSU1yblM0WmdxTUVtZG1OYVUK5tmcOX+jOdbSD1YCPqcAeoGF8ny61lWY + xwguejMeVZ/pCjO/qf3tb+MUlInPMXva59FelGd3nz6cbVqbeWtxSQ== + -----END AGE ENCRYPTED FILE----- + recipient: age1st5axcrn2s09effsjp6gl89rnwd967y007pzpzamlqydrpf7yeeqjwtnx0 + lastmodified: "2026-05-16T22:13:21Z" + mac: ENC[AES256_GCM,data:McAN1DueAhDBAY8kloB5l8M0pLIeswtnCxBtMYFyzBaY2Z43gNetBwdpzs5sL4nEmAZGPJ9AjXJVSmjb1tOn3BF8X5n6/9F7DzvHT7ukpIjumGC0KeB0QfaIGgKJyo7koISIVlGFZAwgcf1fQwaKZsYzfOGelj7UNrzFCjArK+Y=,iv:oZUmzcEr08jROw24J2fXQ4EjEJH3vzYysdy51vEtUNM=,tag:QJjNb/YvuZrZtQD9QE1Z3g==,type:str] + unencrypted_suffix: _unencrypted + version: 3.13.0 diff --git a/config/hosts/ikiwiki/sops.nix b/config/hosts/ikiwiki/sops.nix new file mode 100644 index 0000000..78dc2c8 --- /dev/null +++ b/config/hosts/ikiwiki/sops.nix @@ -0,0 +1,6 @@ +{ ... }: +{ + sops = { + defaultSopsFile = ./secrets.yaml; + }; +} From a28f7a5848b95dc08a96eaa38511963aef5ca722 Mon Sep 17 00:00:00 2001 From: Fiona Grzebien Date: Sun, 17 May 2026 01:17:20 +0200 Subject: [PATCH 5/7] Migrate coturn to sops-nix --- .sops.yaml | 6 ++++++ config/hosts/coturn/coturn.nix | 9 ++++++++- config/hosts/coturn/default.nix | 1 + config/hosts/coturn/secrets.nix | 11 ----------- config/hosts/coturn/secrets.yaml | 25 +++++++++++++++++++++++++ config/hosts/coturn/sops.nix | 6 ++++++ 6 files changed, 46 insertions(+), 12 deletions(-) delete mode 100644 config/hosts/coturn/secrets.nix create mode 100644 config/hosts/coturn/secrets.yaml create mode 100644 config/hosts/coturn/sops.nix diff --git a/.sops.yaml b/.sops.yaml index 76cda7e..a0912e8 100644 --- a/.sops.yaml +++ b/.sops.yaml @@ -1,7 +1,13 @@ keys: - &admin_age_fi age1tf38ae8yzzzmtjp5cjyemf0a8cksq62dz0x0hsntyhsjk5pq6s6q3v9nm7 + - &host_age_coturn age1vnrtarxwmqxflh2sxe2s49ldfzkve268hx62x4ltv38h3emv8dqspu028l - &host_age_ikiwiki age1st5axcrn2s09effsjp6gl89rnwd967y007pzpzamlqydrpf7yeeqjwtnx0 creation_rules: + - path_regex: config/hosts/coturn/.* + key_groups: + - age: + - *admin_age_fi + - *host_age_coturn - path_regex: config/hosts/ikiwiki/.* key_groups: - age: diff --git a/config/hosts/coturn/coturn.nix b/config/hosts/coturn/coturn.nix index 719c872..0b266ba 100644 --- a/config/hosts/coturn/coturn.nix +++ b/config/hosts/coturn/coturn.nix @@ -5,7 +5,7 @@ min-port = 49200; max-port = 49500; use-auth-secret = true; - static-auth-secret-file = "/secrets/static-auth-secret.secret"; + static-auth-secret-file = "/run/secrets/static-auth-secret"; realm = "turn.nekover.se"; cert = "${config.security.acme.certs."turn.nekover.se".directory}/fullchain.pem"; pkey = "${config.security.acme.certs."turn.nekover.se".directory}/key.pem"; @@ -42,4 +42,11 @@ total-quota=1200 ''; }; + + sops.secrets."static-auth-secret" = { + mode = "0440"; + owner = "turnserver"; + group = "turnserver"; + restartUnits = [ "coturn.service" ]; + }; } diff --git a/config/hosts/coturn/default.nix b/config/hosts/coturn/default.nix index bc32a3d..36644a0 100644 --- a/config/hosts/coturn/default.nix +++ b/config/hosts/coturn/default.nix @@ -4,5 +4,6 @@ ./configuration.nix ./acme.nix ./coturn.nix + ./sops.nix ]; } diff --git a/config/hosts/coturn/secrets.nix b/config/hosts/coturn/secrets.nix deleted file mode 100644 index 48fd211..0000000 --- a/config/hosts/coturn/secrets.nix +++ /dev/null @@ -1,11 +0,0 @@ -{ keyCommandEnv,... }: -{ - deployment.keys."static-auth-secret.secret" = { - keyCommand = keyCommandEnv ++ [ "pass" "coturn/static-auth-secret" ]; - destDir = "/secrets"; - user = "turnserver"; - group = "turnserver"; - permissions = "0640"; - uploadAt = "pre-activation"; - }; -} diff --git a/config/hosts/coturn/secrets.yaml b/config/hosts/coturn/secrets.yaml new file mode 100644 index 0000000..d90c1c5 --- /dev/null +++ b/config/hosts/coturn/secrets.yaml @@ -0,0 +1,25 @@ +static-auth-secret: ENC[AES256_GCM,data:af5cjUSeiCEtYki85h+XoJW5FKY4X18i6zOBZnH64Ju/LwA/yUemA8co17TG5cQnc/sw1pz6LySL2DOq/Gj42g==,iv:Yne84/VLN0jCSulA5OQ0UKbQWkqWBmHYogDuAngAp48=,tag:wJ/4yGnbypjTo/akV3P9ZA==,type:str] +sops: + age: + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLMXRScDR1NzhzZGRXYUZQ + ZGpRYUlOUWZTVHQvdUlrSG5SRWM2ME9sdUVZCldCZkZ0SXdqUjBVNlRnckg3N0dS + S0s2NkRnQys2SGJKSTdiUWlnbTg1dkEKLS0tIGthb0FESjAyMjlEbnV4S0lPOHda + S1ZBOWdTSmNRQXMvUGJnd05sK1Q2Qk0KHseEBDVLeSWHdgrYyITRuJyp3orrjwwS + 04ORMniHR7ymHzRPvm3oX/jkFD0iJEmk8clgm/Gcn2AQ7xXeJO7Vnw== + -----END AGE ENCRYPTED FILE----- + recipient: age1tf38ae8yzzzmtjp5cjyemf0a8cksq62dz0x0hsntyhsjk5pq6s6q3v9nm7 + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmemxWRnFLMFVEcVZCb3BT + MStWU21kcnF5enpleWt3dFdaMHo3RzJGaENNClU2M2tmdE0zd2pXWUJHQkV5Mkhi + a0lIbHJmWDN6UXhVeTZId3RhcEd5TWcKLS0tIFRlSUNQN0pGYmtiOGxJS0pJY0tQ + YjFzS205QklRZWdPbklIRzVzbFFPT2sKCXra+DUchbomy9pe2HJAbhAF1mstgUcv + NalettWmuLXe2B0WjC9fAy2AAJS6kysEbUh960suzSPLTqTce0MGfA== + -----END AGE ENCRYPTED FILE----- + recipient: age1vnrtarxwmqxflh2sxe2s49ldfzkve268hx62x4ltv38h3emv8dqspu028l + lastmodified: "2026-05-16T23:13:15Z" + mac: ENC[AES256_GCM,data:PxX20JAaYhj3DE1KjakVmVucL7jjZU0vh5vnSNmKLgqedJiV2ZqEXpF4s1WPgYTY723aLiWDLw/8kTF/VmvMs8zOdGSkIhojWIWFE6I2yq1MjlawXuUhGpe6C1XGQ+w0KTqzyJLxyIsUSH24GqPHmLRMStE7bYdr0a4lRBHEyqE=,iv:6tXoqhG1XqDAz4SZSIxFCi01Be76/dV4vFPwv3lkcps=,tag:ytLoh7gJ+Iuqv5AwhDElrw==,type:str] + unencrypted_suffix: _unencrypted + version: 3.13.0 diff --git a/config/hosts/coturn/sops.nix b/config/hosts/coturn/sops.nix new file mode 100644 index 0000000..78dc2c8 --- /dev/null +++ b/config/hosts/coturn/sops.nix @@ -0,0 +1,6 @@ +{ ... }: +{ + sops = { + defaultSopsFile = ./secrets.yaml; + }; +} From 5b44c4516cad957ff76448f09566c6d5bbab23bb Mon Sep 17 00:00:00 2001 From: Fiona Grzebien Date: Sun, 17 May 2026 01:24:09 +0200 Subject: [PATCH 6/7] Remove hydra host --- config/hosts/hydra/configuration.nix | 51 ---------------------------- config/hosts/hydra/default.nix | 9 ----- config/hosts/hydra/hydra.nix | 14 -------- config/hosts/hydra/nginx.nix | 44 ------------------------ config/hosts/hydra/nix-serve.nix | 9 ----- config/hosts/hydra/secrets.nix | 11 ------ config/hosts/valkyrie/nginx.nix | 1 - config/hosts/web-public-2/nginx.nix | 1 - flake.nix | 6 ---- hosts.nix | 4 --- 10 files changed, 150 deletions(-) delete mode 100644 config/hosts/hydra/configuration.nix delete mode 100644 config/hosts/hydra/default.nix delete mode 100644 config/hosts/hydra/hydra.nix delete mode 100644 config/hosts/hydra/nginx.nix delete mode 100644 config/hosts/hydra/nix-serve.nix delete mode 100644 config/hosts/hydra/secrets.nix diff --git a/config/hosts/hydra/configuration.nix b/config/hosts/hydra/configuration.nix deleted file mode 100644 index 9b554d8..0000000 --- a/config/hosts/hydra/configuration.nix +++ /dev/null @@ -1,51 +0,0 @@ -{ ... }: -{ - boot = { - loader.grub = { - enable = true; - device = "/dev/vda"; - }; - - binfmt.emulatedSystems = [ - "armv6l-linux" - "armv7l-linux" - "aarch64-linux" - ]; - }; - - networking = { - hostName = "hydra"; - firewall = { - enable = true; - allowedTCPPorts = [ 8443 ]; - }; - }; - - users.users.builder = { - isNormalUser = true; - openssh.authorizedKeys.keys = [ - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK/plZfxF/RtB+pJsUYx9HUgRcB56EoO0uj+j3AGzZta root@cherry" - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKeIiHkHA5c6/jZx+BB28c5wchdzlFI7R1gbvNmPyoOg root@kiara" - ]; - }; - - nix = { - settings = { - trusted-users = [ "builder" ]; - allowed-uris = "http:// https://"; - }; - buildMachines = [ - { - hostName = "localhost"; - systems = [ - "x86_64-linux" - "armv6l-linux" - "armv7l-linux" - "aarch64-linux" - ]; - } - ]; - }; - - system.stateVersion = "23.05"; -} diff --git a/config/hosts/hydra/default.nix b/config/hosts/hydra/default.nix deleted file mode 100644 index aeffee1..0000000 --- a/config/hosts/hydra/default.nix +++ /dev/null @@ -1,9 +0,0 @@ -{ ... }: -{ - imports = [ - ./configuration.nix - ./hydra.nix - ./nix-serve.nix - ./nginx.nix - ]; -} diff --git a/config/hosts/hydra/hydra.nix b/config/hosts/hydra/hydra.nix deleted file mode 100644 index c8d4c3f..0000000 --- a/config/hosts/hydra/hydra.nix +++ /dev/null @@ -1,14 +0,0 @@ -{ ... }: -{ - services.hydra = { - enable = true; - hydraURL = "https://hydra.nekover.se"; - listenHost = "localhost"; - port = 3001; - useSubstitutes = true; - notificationSender = "hydra@robot.grzb.de"; - extraConfig = " - binary_cache_public_uri = https://nix-cache.nekover.se - "; - }; -} diff --git a/config/hosts/hydra/nginx.nix b/config/hosts/hydra/nginx.nix deleted file mode 100644 index 9aadd25..0000000 --- a/config/hosts/hydra/nginx.nix +++ /dev/null @@ -1,44 +0,0 @@ -{ ... }: -{ - services.nginx = { - enable = true; - virtualHosts = { - "hydra.nekover.se" = { - forceSSL = true; - enableACME = true; - listen = [{ - addr = "0.0.0.0"; - port = 80; - }]; - locations."/" = { - proxyPass = "http://localhost:3001"; - }; - extraConfig = '' - listen 0.0.0.0:8443 http2 ssl proxy_protocol; - - set_real_ip_from 10.202.41.100; # IPv4 from web-public-2 - set_real_ip_from 10.203.10.3; # IPv6 from valkyrie - real_ip_header proxy_protocol; - ''; - }; - "nix-cache.nekover.se" = { - forceSSL = true; - enableACME = true; - listen = [ { - addr = "0.0.0.0"; - port = 80; - }]; - locations."/" = { - proxyPass = "http://localhost:5005"; - }; - extraConfig = '' - listen 0.0.0.0:8443 http2 ssl proxy_protocol; - - set_real_ip_from 10.202.41.100; # IPv4 from web-public-2 - set_real_ip_from 10.203.10.3; # IPv6 from valkyrie - real_ip_header proxy_protocol; - ''; - }; - }; - }; -} diff --git a/config/hosts/hydra/nix-serve.nix b/config/hosts/hydra/nix-serve.nix deleted file mode 100644 index 75c18cb..0000000 --- a/config/hosts/hydra/nix-serve.nix +++ /dev/null @@ -1,9 +0,0 @@ -{ ... }: -{ - services.nix-serve = { - enable = true; - port = 5005; - bindAddress = "localhost"; - secretKeyFile = "/secrets/signing-key.secret"; - }; -} diff --git a/config/hosts/hydra/secrets.nix b/config/hosts/hydra/secrets.nix deleted file mode 100644 index 43329f7..0000000 --- a/config/hosts/hydra/secrets.nix +++ /dev/null @@ -1,11 +0,0 @@ -{ keyCommandEnv, ... }: -{ - deployment.keys."signing-key.secret" = { - keyCommand = keyCommandEnv ++ [ "pass" "hydra/signing-key" ]; - destDir = "/secrets"; - user = "root"; - group = "root"; - permissions = "0640"; - uploadAt = "pre-activation"; - }; -} diff --git a/config/hosts/valkyrie/nginx.nix b/config/hosts/valkyrie/nginx.nix index ab96419..2ea8db8 100644 --- a/config/hosts/valkyrie/nginx.nix +++ b/config/hosts/valkyrie/nginx.nix @@ -41,7 +41,6 @@ element-admin.nekover.se 10.202.41.100:8443; fi.nekover.se 10.202.41.125:8443; git.nekover.se 10.202.41.106:8443; - hydra.nekover.se 10.202.41.121:8443; id.nekover.se 10.202.41.124:8443; mas.nekover.se 10.202.41.112:8443; matrix.nekover.se 10.202.41.112:8443; diff --git a/config/hosts/web-public-2/nginx.nix b/config/hosts/web-public-2/nginx.nix index 3217be8..87a1ec9 100644 --- a/config/hosts/web-public-2/nginx.nix +++ b/config/hosts/web-public-2/nginx.nix @@ -21,7 +21,6 @@ element-admin.nekover.se 10.202.41.100:8443; fi.nekover.se 10.202.41.125:8443; git.nekover.se 10.202.41.106:8443; - hydra.nekover.se 10.202.41.121:8443; id.nekover.se 10.202.41.124:8443; mas.nekover.se 10.202.41.112:8443; matrix.nekover.se 10.202.41.112:8443; diff --git a/flake.nix b/flake.nix index 7ea486c..0e09394 100644 --- a/flake.nix +++ b/flake.nix @@ -40,12 +40,6 @@ }; } // builtins.mapAttrs (helper.generateColmenaHost) hosts; - hydraJobs = { - nixConfigurations = builtins.mapAttrs (host: helper.generateNixConfiguration host { - inherit nixpkgs-unstable nixpkgs-master hosts simple-nixos-mailserver; - }) hosts; - }; - # Generate a base VM image for Proxmox with `nix build .#base-proxmox` packages.x86_64-linux = { base-proxmox = nixos-generators.nixosGenerate { diff --git a/hosts.nix b/hosts.nix index 86d65e2..83e3a63 100644 --- a/hosts.nix +++ b/hosts.nix @@ -27,10 +27,6 @@ let }) hosts; in generateDefaults { - hydra = { - site = "vs"; - environment = "proxmox"; - }; ikiwiki = { site = "vs"; environment = "proxmox"; From 8d107286a9792bb4e63389541895f780d0be5389 Mon Sep 17 00:00:00 2001 From: Fiona Grzebien Date: Sun, 17 May 2026 01:26:48 +0200 Subject: [PATCH 7/7] flake.lock: Update MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Flake lock file updates: • Updated input 'nixpkgs': 'github:NixOS/nixpkgs/30f30521f3fce93c4c22bb43941cdf8e2d90d311?narHash=sha256-/VER73JyDAsvWXmEk6Qph%2Bq1cXLof4iXtxgwKsj3cP8%3D' (2026-05-16) → 'github:NixOS/nixpkgs/ff5e747c5f45865599ba7387244212420558e83c?narHash=sha256-z1PIyRIm5nlh6sB4I4ObT42O6IT5zuFzQK0RtvRoL/c%3D' (2026-05-16) • Updated input 'nixpkgs-master': 'github:NixOS/nixpkgs/183fe40a77b6860ddd8ed01433d0f4f2f5343e7b?narHash=sha256-W9Dm45lszeihc0BZIHeLMVAJzOETAZtgQQbPhqyLPA0%3D' (2026-05-16) → 'github:NixOS/nixpkgs/b6aac1076920329e7863e9fb607d4d1811ea16f3?narHash=sha256-gnglqTdKUK1UlKfq%2BZRXmxWW%2BMRhbpOi3DzjTp2zqRU%3D' (2026-05-16) --- flake.lock | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/flake.lock b/flake.lock index 9140b1e..548d0bc 100644 --- a/flake.lock +++ b/flake.lock @@ -118,11 +118,11 @@ }, "nixpkgs": { "locked": { - "lastModified": 1778917931, - "narHash": "sha256-/VER73JyDAsvWXmEk6Qph+q1cXLof4iXtxgwKsj3cP8=", + "lastModified": 1778947228, + "narHash": "sha256-z1PIyRIm5nlh6sB4I4ObT42O6IT5zuFzQK0RtvRoL/c=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "30f30521f3fce93c4c22bb43941cdf8e2d90d311", + "rev": "ff5e747c5f45865599ba7387244212420558e83c", "type": "github" }, "original": { @@ -134,11 +134,11 @@ }, "nixpkgs-master": { "locked": { - "lastModified": 1778964530, - "narHash": "sha256-W9Dm45lszeihc0BZIHeLMVAJzOETAZtgQQbPhqyLPA0=", + "lastModified": 1778973839, + "narHash": "sha256-gnglqTdKUK1UlKfq+ZRXmxWW+MRhbpOi3DzjTp2zqRU=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "183fe40a77b6860ddd8ed01433d0f4f2f5343e7b", + "rev": "b6aac1076920329e7863e9fb607d4d1811ea16f3", "type": "github" }, "original": {