chore: remove vm-gitlab which is no longer in use

.gitlab-ci.yml

@@ -1,23 +0,0 @@
-stages:
-  - eval
-  - build
-  - push
-
-"Evaluate for builds":
-  stage: eval
-  tags:
-    - kubernetes
-  image: "$CI_REGISTRY/greg/ci-images/builder:latest"
-  artifacts:
-    paths:
-      - gitlab-ci-continue.yml
-  script: nix run ".#gen-build" > gitlab-ci-continue.yml
-
-"Trigger builds":
-  stage: build
-  trigger:
-    include:
-      - artifact: gitlab-ci-continue.yml
-        job: "Evaluate for builds"
-  variables:
-    PARENT_PIPELINE_ID: $CI_PIPELINE_ID

home/baseline/nushell/functions.nu

@@ -1,5 +1,5 @@
 # vim: set filetype=nushell :
-let servers = [isaiah jeremiah zeke genesis vm-gitlab]
+let servers = [isaiah jeremiah zeke genesis]
 
 def par-map [ items: list, c: closure ] {
   let results = $items | par-each -k $c

home/baseline/xonsh_footer.xsh

@@ -38,11 +38,6 @@ def _ivr2(args):
     vpn("gregory_hellings@ra.ivrtechnology.com", "IVR Technology")
 aliases['ivr2'] = _ivr2
 
-def _glrestart(args):
-    sudo nixos-container run gitlab -- systemctl restart gitlab
-    sudo nixos-container run gitlab -- systemctl restart nginx
-aliases['glrestart'] = _glrestart
-
 def _aws_creds(args):
     $AWS_ACCESS_KEY_ID=$(bw get username "AWS Access Key")
     $AWS_SECRET_ACCESS_KEY=$(bw get password "AWS Access Key")

hosts/default.nix

@@ -45,16 +45,6 @@ in
     })
   )
 )
-// (lib.genAttrs
-  (builtins.attrNames (lib.filterAttrs (_: v: v == "directory") (builtins.readDir ./vm)))
-  (
-    name:
-    (unstable {
-      inherit name;
-      extraMods = [ ./vm/${name} ];
-    })
-  )
-)
 // {
   # nix build '.#nixosConfigurations.wsl.config.system.build.installer'
   #nixos = wsl { name = "wsl"; };
@@ -63,26 +53,4 @@ in
   #  name = "wsl";
   #  system = "aarch64-linux";
   #};
-
-  builder-aarch = lib.nixosSystem {
-    system = "aarch64-linux";
-    modules = [
-      "${top.nixunstable}/nixos/modules/profiles/nix-builder-vm.nix"
-      {
-        virtualisation.host.pkgs = import top.nixunstable { system = "aarch64-darwin"; };
-        boot.loader.grub.devices = [ "/dev/vda" ];
-      }
-    ];
-  };
-
-  builder-x86 = lib.nixosSystem {
-    system = "x86_64-linux";
-    modules = [
-      "${top.nixunstable}/nixos/modules/profiles/nix-builder-vm.nix"
-      {
-        virtualisation.host.pkgs = import top.nixunstable { system = "aarch64-darwin"; };
-        boot.loader.grub.devices = [ "/dev/vda" ];
-      }
-    ];
-  };
 }

hosts/unstable/exodus/default.nix

@@ -43,10 +43,6 @@
       enable = true;
       tags = [ "mobile" ];
     };
-    runner = {
-      enable = true;
-      qemu = true;
-    };
   };
 
   hardware = {

hosts/unstable/genesis/net/hosts

@@ -22,8 +22,6 @@
 
 # VMs
 10.42.4.1 matrix matrix.thehellings.lan
-#10.42.4.2 vm-jellyfin vm-jellyfin.thehellings.lan
-10.42.4.3 git gitlab git.thehellings.lan gitlab.thehellings.lan
 
 # VIP
 10.42.5.1 longhorn.cluster matrix.cluster pgadmin.cluter postgres.cluster immich.cluster
@@ -37,7 +35,6 @@
 100.88.91.27 dns.home
 100.70.99.91 exodus.home exodus.shire-zebra.ts.net
 100.96.198.104 genesis.home genesis.shire-zebra.ts.net smart.home zwave.home nixcache.home gitcache.home dashy.home uptime.home speed.home
-100.117.28.111 gitlab.home gitlab.shire-zebra.ts.net gitlab.thehellings.lan registry.thehellings.lan git.thehellings.lan
 100.68.203.1 hosea.home hosea.shire-zebra.ts.net grafana.home
 100.84.183.79 isaiah.home isaiah.shire-zebra.ts.net pgadmin.kubernetes longhorn.kubernetes
 100.102.186.39 jeremiah.home jeremiah.shire-zebra.ts.net matrix.kubernetes immich.kubernetes postgres.kubernetes buildbot.home

hosts/unstable/isaiah/default.nix

@@ -43,10 +43,6 @@
       tags = [ "home" ];
     };
     remote-builder.enable = true;
-    runner = {
-      enable = true;
-      qemu = true;
-    };
     gitea-runner = {
       enable = true;
       extraLabels = [ "bare-metal:host" ];

hosts/unstable/jeremiah/default.nix

@@ -22,8 +22,6 @@ in
   ];
 
   age.secrets = {
-    runner-reg.file = ../../../secrets/gitlab/nixos-qemu-shell.age;
-
     gitea-buildbotWorkersFile = mk ../../../secrets/gitea/buildbotWorkersFile.age;
     gitea-oauthToken = mk ../../../secrets/gitea/oauthToken.age;
     gitea-oauthSecret = mk ../../../secrets/gitea/oauthSecret.age;
@@ -95,11 +93,6 @@ in
       tags = [ "home" ];
     };
     remote-builder.enable = true;
-    runner = {
-      enable = true;
-      threads = 3;
-      qemu = true;
-    };
   };
 
   hardware = {

hosts/unstable/linode/default.nix

@@ -66,20 +66,4 @@
       immichUrl = "https://immich.shire-zebra.ts.net";
     };
   };
-
-  security.sudo.extraRules = [
-    {
-      users = [ "gitlab-runner" ];
-      commands = [
-        {
-          command = "/run/current-system/sw/bin/systemctl";
-          options = [ "NOPASSWD" ];
-        }
-        {
-          command = "/run/current-system/sw/bin/podman";
-          options = [ "NOPASSWD" ];
-        }
-      ];
-    }
-  ];
 }

hosts/unstable/linode/nginx.nix

@@ -24,7 +24,6 @@ in
   virtualisation.oci-containers = {
     backend = "podman";
     containers."homepage" = {
-      # needs explicit port to match what gitlab-runner sees when pulling
       image = "registry.thehellings.com:443/greg/homepage/gregs-homepage:latest";
       ports = [ "${homepage}:80" ];
     };

hosts/unstable/zeke/default.nix

@@ -28,10 +28,6 @@
     };
     nebula.enable = true;
     remote-builder.enable = true;
-    runner = {
-      enable = true;
-      vbox = false;
-    };
     tailscale = {
       enable = true;
       tags = [ "home" ];

hosts/vm/gitlab/default.nix

@@ -1,273 +0,0 @@
-# Edit this configuration file to define what should be installed on
-# your system.  Help is available in the configuration.nix(5) man page
-# and in the NixOS manual (accessible by running ‘nixos-help’).
-
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}:
-
-let
-  registryPort = 5000;
-  vpnIp = "100.117.28.111";
-in
-{
-  imports = [
-    ./hardware-configuration.nix
-  ];
-
-  age.secrets =
-    let
-      cfg = n: {
-        file = ../../../secrets/gitlab/${n}.age;
-        owner = "gitlab";
-        group = "gitlab";
-        mode = "0444";
-      };
-    in
-    {
-      gitlab-secret = cfg "secret";
-      gitlab-otp = cfg "otp";
-      gitlab-db = cfg "db";
-      gitlab-db-password = cfg "db-password";
-      gitlab-jws = cfg "jws";
-      gitlab-key = cfg "key";
-      gitlab-cert = cfg "cert";
-      gitlab-salt = cfg "salt";
-      gitlab-primary-key = cfg "primary-key";
-      gitlab-deterministic-key = cfg "deterministic-key";
-
-      minio_access_key_id = {
-        file = ../../../secrets/minio_access_key_id.age;
-        owner = "gitlab";
-        group = "gitlab";
-        mode = "0444";
-      };
-      minio_secret_access_key = {
-        file = ../../../secrets/minio_secret_access_key.age;
-        owner = "gitlab";
-        group = "gitlab";
-        mode = "0444";
-      };
-    };
-
-  greg = {
-    backup.jobs.nas-backup = {
-      src = "/var/gitlab/state/backup/";
-      dest = "gitlab";
-    };
-    home = true;
-    tailscale = {
-      enable = true;
-      tags = [ "home" ];
-    };
-  };
-
-  networking = {
-    hostName = "gitlab"; # Define your hostname.
-    firewall.allowedTCPPorts = [
-      80
-      registryPort
-    ];
-  };
-
-  services = {
-    gitlab = {
-      enable = true;
-      backup = {
-        keepTime = 288;
-        startAt = [ "03:00" ];
-      };
-      databaseHost = "postgres.kubernetes";
-      databaseName = "gitlab";
-      databaseUsername = "gitlab";
-      databasePasswordFile = config.age.secrets.gitlab-db-password.path;
-      databaseCreateLocally = false;
-      extraConfig = {
-        registry.port = null;
-        gitlab = {
-          trustedProxies = [
-            "${vpnIp}/32" # The system itself
-            "100.109.86.8/32" # Public server's IP
-          ];
-        };
-        object_store = {
-          enabled = true;
-          proxy_download = true; # Tell them to reach out to object storage themselves!
-          connection = {
-            provider = "AWS";
-            endpoint = "http://s3.thehellings.lan:9000";
-            region = "us-east-1";
-            aws_access_key_id = {
-              _secret = config.age.secrets.minio_access_key_id.path;
-            };
-            aws_secret_access_key = {
-              _secret = config.age.secrets.minio_secret_access_key.path;
-            };
-            path_style = true; # True for MinIO
-            aws_signature_version = 2;
-          };
-          #storage_options = ...;
-          objects = builtins.listToAttrs (
-            builtins.map
-              (
-                x: lib.attrsets.nameValuePair x { bucket = "gitlab-${builtins.replaceStrings [ "_" ] [ "-" ] x}"; }
-              )
-              [
-                "artifacts"
-                "ci_secure_files"
-                "dependency_proxy"
-                "external_diffs"
-                "lfs"
-                "packages"
-                "pages"
-                "terraform_state"
-                "uploads"
-              ]
-          );
-        };
-      };
-      host = "src.thehellings.com";
-      https = true;
-      initialRootEmail = "greg@thehellings.com";
-      initialRootPasswordFile = pkgs.writeText "initialRootPassword" "root_password";
-      pages = {
-        enable = true;
-        settings.pages-domain = "pages.thehellings.com";
-      };
-      port = 443;
-      puma = {
-        threadsMax = 6;
-        threadsMin = 2;
-        workers = 6;
-      };
-      redisUrl = "unix:${config.services.redis.servers.gitlab.unixSocket}";
-      registry = {
-        enable = true;
-        certFile = config.age.secrets.gitlab-cert.path;
-        keyFile = config.age.secrets.gitlab-key.path;
-        externalAddress = "registry.thehellings.com";
-        externalPort = 443;
-      };
-      secrets = {
-        activeRecordDeterministicKeyFile = config.age.secrets.gitlab-deterministic-key.path;
-        activeRecordPrimaryKeyFile = config.age.secrets.gitlab-primary-key.path;
-        activeRecordSaltFile = config.age.secrets.gitlab-salt.path;
-        dbFile = config.age.secrets.gitlab-db.path;
-        jwsFile = config.age.secrets.gitlab-jws.path;
-        otpFile = config.age.secrets.gitlab-otp.path;
-        secretFile = config.age.secrets.gitlab-secret.path;
-      };
-    };
-
-    nginx = {
-      enable = true;
-      clientMaxBodySize = "25000m";
-      virtualHosts = {
-        "vm-gitlab.shire-zebra.ts.net" = {
-          listen = [
-            {
-              addr = "0.0.0.0";
-              port = 443;
-              ssl = true;
-            }
-          ];
-          locations."/" = {
-            proxyPass = "http://unix:/run/gitlab/gitlab-workhorse.socket";
-            recommendedProxySettings = true;
-          };
-          extraConfig = ''
-            ssl_certificate /etc/certs/vm-gitlab.shire-zebra.ts.net.crt ;
-            ssl_certificate_key /etc/certs/vm-gitlab.shire-zebra.ts.net.key ;
-            client_max_body_size 10000m ;
-          '';
-        };
-        "registry" = {
-          listen = [
-            {
-              addr = "0.0.0.0";
-              port = registryPort;
-              ssl = true;
-            }
-          ];
-          locations."/" = {
-            proxyPass = "http://127.0.0.1:4567/";
-            recommendedProxySettings = true;
-          };
-          extraConfig = ''
-            ssl_certificate /etc/certs/vm-gitlab.shire-zebra.ts.net.crt ;
-            ssl_certificate_key /etc/certs/vm-gitlab.shire-zebra.ts.net.key ;
-            client_max_body_size 25000m ;
-          '';
-          serverAliases = [
-            "vm-gitlab.shire-zebra.ts.net"
-          ];
-        };
-      };
-    };
-
-    openssh.enable = true;
-
-    postgresql.enable = true;
-
-    qemuGuest.enable = true;
-
-    redis.servers.gitlab = {
-      enable = true;
-    };
-
-    #resolved.enable = true;
-  };
-
-  # Do not start nginx until we have tailscaled up and running, so it can bind
-  # to the 100.* addresses
-  systemd = {
-    services = {
-      certRefresh =
-        let
-          script = pkgs.writeShellApplication {
-            name = "cert-refresh";
-            runtimeInputs = [ pkgs.tailscale ];
-
-            text = ''
-              cd /etc/certs
-              tailscale cert vm-gitlab.shire-zebra.ts.net
-              chown nginx ./*
-              systemctl reload nginx
-            '';
-          };
-        in
-        {
-          script = lib.getExe script;
-          serviceConfig = {
-            Type = "oneshot";
-            User = "root";
-          };
-        };
-
-      nginx = rec {
-        after = [ "network-online.target" ];
-        requires = [ "network-online.target" ];
-        wants = after;
-        serviceConfig = {
-          RestartMaxDelaySec = "30s";
-          RestartSteps = "5";
-        };
-      };
-      tailscaled.partOf = [ "network-online.target" ];
-    };
-
-    timers = {
-      "cert-refresh" = {
-        wantedBy = [ "cert-refresh.service" ];
-        timerConfig = {
-          OnCalendar = "monthly";
-          Persistent = true;
-        };
-      };
-    };
-  };
-  system.stateVersion = lib.mkForce "24.11";
-}

hosts/vm/gitlab/hardware-configuration.nix

@@ -1,58 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{
-  lib,
-  modulesPath,
-  ...
-}:
-
-{
-  imports = [
-    (modulesPath + "/profiles/qemu-guest.nix")
-  ];
-
-  # Bootloader.
-  boot = {
-    extraModulePackages = [ ];
-    initrd = {
-      availableKernelModules = [
-        "uhci_hcd"
-        "ehci_pci"
-        "ahci"
-        "virtio_pci"
-        "virtio_scsi"
-        "sd_mod"
-        "sr_mod"
-      ];
-      kernelModules = [ ];
-    };
-    loader = {
-      efi.canTouchEfiVariables = true;
-      systemd-boot.enable = true;
-    };
-  };
-
-  fileSystems."/" = {
-    device = lib.mkDefault "/dev/disk/by-uuid/1fdbe86e-ce6f-4af3-a876-aec35731adab";
-    fsType = "ext4";
-  };
-
-  fileSystems."/boot" = {
-    device = "/dev/disk/by-uuid/1E6A-C3BB";
-    fsType = "vfat";
-    options = [
-      "fmask=0077"
-      "dmask=0077"
-    ];
-  };
-
-  swapDevices = [ ];
-
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.enp6s18.useDHCP = lib.mkDefault true;
-}

manifests/bitwarden/deployment.yaml

@@ -21,9 +21,6 @@ spec:
     spec:
       containers:
         - name: bitwarden-cli
-          # Since my gitlab instance depends on the database hosted in k3s, and
-          # the database depends on this image, I need a way to bootstrap the
-          # system if # I am doing disaster recovery. And this is it.
           image: "ghcr.io/greg-hellings/nixos-config/img-bitwarden:latest"
           #image: >-
           #  registry.thehellings.com/greg/nixos-config/img-bitwarden:latest

manifests/databases/ingress.yaml

@@ -14,14 +14,12 @@ spec:
       - 100.88.91.27 # dns?
       - 100.80.99.48 # exodus
       - 100.88.91.27 # genesis
-      - 100.117.28.111 # gitlab
       - 100.68.203.1 # hosea
       - 100.84.183.79 # isaiah
       - 100.102.186.39 # jeremiah
       - 100.90.74.19 # zeke
       - 100.115.57.8 # linode
       - 100.65.5.38 # matrix
-      #- 100.127.55.22 # jellyfin
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRouteTCP

manifests/databases/kustomization.yaml

@@ -4,7 +4,6 @@ resources:
   - namespace.yaml
   - secrets.yaml
   - postgres-cluster.yaml
-  - postgres-gitlab.yaml
   - postgres-pgadmin.yaml
   - postgres-matrix.yaml
   - ingress.yaml

manifests/databases/postgres-cluster.yaml

@@ -11,13 +11,6 @@ spec:
 
   managed:
     roles:
-      - name: gitlab
-        ensure: present
-        comment: Gitlab user
-        login: true
-        superuser: false
-        passwordSecret:
-          name: postgres-user-gitlab
       - name: pgadmin
         ensure: present
         comment: PG Admin user

manifests/databases/postgres-gitlab.yaml

@@ -1,9 +0,0 @@
-apiVersion: postgresql.cnpg.io/v1
-kind: Database
-metadata:
-  name: database-gitlab
-spec:
-  name: gitlab
-  owner: gitlab
-  cluster:
-    name: postgres

manifests/databases/secrets.yaml

@@ -1,39 +1,5 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
-metadata:
-  name: postgres-user-gitlab
-  namespace: db
-spec:
-  target:
-    name: postgres-user-gitlab
-    deletionPolicy: Delete
-    template:
-      type: Opaque
-      data:
-        username: |-
-          {{ .username }}
-        password: |-
-          {{ .password }}
-  data:
-    - secretKey: username
-      sourceRef:
-        storeRef:
-          name: bitwarden-login
-          kind: ClusterSecretStore
-      remoteRef:
-        key: 5282ad16-c2dc-49d3-8fb3-b2e9012bab57
-        property: username
-    - secretKey: password
-      sourceRef:
-        storeRef:
-          name: bitwarden-login
-          kind: ClusterSecretStore
-      remoteRef:
-        key: 5282ad16-c2dc-49d3-8fb3-b2e9012bab57
-        property: password
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
 metadata:
   name: postgres-user-matrix
   namespace: db

manifests/gitlab-runner/chart.yaml

@@ -1,64 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: gitlab-runner
-spec:
-  interval: "24h"
-  url: https://charts.gitlab.io
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: gitlab-runner
-spec:
-  interval: 10m
-  chart:
-    spec:
-      chart: gitlab-runner
-      version: "0.83.1"
-      sourceRef:
-        kind: HelmRepository
-        name: gitlab-runner
-      interval: "1h"
-  dependsOn:
-    - name: external-secrets
-      namespace: external-secrets
-    - name: tailscae
-      namespace: tailscale
-  values:
-    crds:
-      create: true
-    includeCRDs: true
-    gitlabUrl: https://src.thehellings.com
-    runners:
-      secret: gitlab-runner
-    imagePullSecrets:
-      - name: image-pull-secrets
-    rbac:
-      create: true
-    serviceAccount:
-      create: true
-    metrics:
-      enabled: true
-    extraEnv:
-      CACHE_TYPE: s3
-      CACHE_SHARED: "true"
-      CACHE_S3_BUCKET_NAME: gitlab-runner-cache
-      CACHE_S3_INSECURE: "true"
-    extraEnvFrom:
-      PACKER_GITHUB_API_TOKEN:
-        secretKeyRef:
-          name: gitlab-runner
-          key: PACKER_GITHUB_API_TOKEN
-      CACHE_S3_SERVER_ADDRESS:
-        secretKeyRef:
-          name: gitlab-runner
-          key: CACHE_S3_SERVER_ADDRESS
-      CACHE_S3_ACCESS_KEY:
-        secretKeyRef:
-          name: s3-access
-          key: username
-      CACHE_S3_SECRET_KEY:
-        secretKeyRef:
-          name: s3-access
-          key: password

manifests/gitlab-runner/kustomization.yaml

@@ -1,6 +0,0 @@
-namespace: gitlab-runner
-
-resources:
-  - namespace.yaml
-  - secrets.yaml
-  - chart.yaml

manifests/gitlab-runner/namespace.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: gitlab-runner

manifests/gitlab-runner/secrets.yaml

@@ -1,101 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: gitlab-runner
-  namespace: gitlab-runner
-spec:
-  secretStoreRef:
-    name: bitwarden-fields
-    kind: ClusterSecretStore
-  target:
-    name: gitlab-runner
-    deletionPolicy: Delete
-    template:
-      type: Opaque
-      data:
-        runner-registration-token: ""
-        runner-token: "{{ .runnerToken }}"
-        PACKER_GITHUB_API_TOKEN: "{{ .PACKER_GITHUB_API_TOKEN }}"
-        CACHE_S3_SERVER_ADDRESS: "{{ .CACHE_S3_SERVER_ADDRESS }}"
-  data:
-    - secretKey: runnerToken
-      remoteRef:
-        key: &key 53719920-b100-4355-8c80-b2f9002fad22
-        property: CI_SERVER_TOKEN
-    - secretKey: PACKER_GITHUB_API_TOKEN
-      remoteRef:
-        key: *key
-        property: PACKER_GITHUB_API_TOKEN
-    - secretKey: CACHE_S3_SERVER_ADDRESS
-      remoteRef:
-        key: *key
-        property: CACHE_S3_SERVER_ADDRESS
-        # Includes
-        # CI_SERVER_TOKEN
-        # PACKER_GITHUB_API_TOKEN
-        # CACHE_S3_SERVER_ADDRESS
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: s3-access
-  namespace: gitlab-runner
-spec:
-  secretStoreRef:
-    name: bitwarden-login
-    kind: ClusterSecretStore
-  target:
-    name: s3-access
-    deletionPolicy: Delete
-  data:
-    - secretKey: username
-      remoteRef:
-        key: &key 04dd39c2-268d-4a33-aa4c-b1550166139f
-        property: username
-    - secretKey: password
-      remoteRef:
-        key: *key
-        property: password
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: image-pull-secrets
-  namespace: gitlab-runner
-spec:
-  secretStoreRef:
-    name: bitwarden-login
-    kind: ClusterSecretStore
-  target:
-    deletionPolicy: Delete
-    template:
-      type: kubernetes.io/dockerconfigjson
-      data:
-        .dockerconfigjson: >-
-          {
-            "auths": {
-              "https://index.docker.io/v1/": {
-                "username": "{{ .user }}",
-                "password": "{{ .password }}",
-                "email": "greg.hellings@gmail.com",
-                "auth": "{{ .auth }}"
-              }
-            }
-          }
-  data:
-    - secretKey: user
-      remoteRef:
-        key: &key f560ae38-368c-4e58-898c-aeb90012d597
-        property: username
-    - secretKey: password
-      remoteRef:
-        key: *key
-        property: password
-    - secretKey: auth
-      sourceRef:
-        storeRef:
-          name: bitwarden-fields
-          kind: ClusterSecretStore
-      remoteRef:
-        key: *key
-        property: auth

manifests/kustomization.yaml

@@ -7,7 +7,6 @@ resources:
   - mariadb-operator
   - databases
   - matrix
-  #- gitlab-runner
   - immich
   - monitoring
   - pinchflat

modules/nixos/default.nix

@@ -10,7 +10,6 @@
     ./ceph.nix
     ./db.nix
     ./gitea-runner.nix
-    ./gitlab-runner.nix
     ./gnome.nix
     ./home.nix
     ./kde.nix

modules/nixos/gitlab-runner.nix

@@ -1,82 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-let
-  cfg = config.greg.runner;
-  environmentVariables = {
-    EFI_DIR = "${pkgs.OVMF.fd}/FV/";
-    STORAGE_URL = "s3.thehellings.lan:9000";
-  };
-  runnerCfg = file: {
-    inherit environmentVariables;
-    authenticationTokenConfigFile = file;
-    executor = "shell";
-    limit = cfg.threads;
-  };
-in
-# We want exactly one of these to be true, but not both. Neither can both be false
-{
-  options.greg.runner = {
-    enable = lib.mkEnableOption "Enable as a gitlab-runner with both libvirt and virtualbox";
-
-    threads = lib.mkOption {
-      default = 5;
-      type = lib.types.int;
-      description = "The maximum number of concurrent jobs";
-    };
-
-    qemu = lib.mkEnableOption "Enable the qemu host (mutually exclusive with vbox)";
-    vbox = lib.mkEnableOption "Enable the vbox host (mutually exclusive with qemu)";
-  };
-
-  config = lib.mkIf cfg.enable ({
-    # assertions = [
-    #   {
-    #     assertion = cfg.qemu || cfg.vbox && (cfg.qemu != cfg.vbox);
-    #     message = "You must enable exactly one of qemu or vbox";
-    #   }
-    # ];
-    # Shared configurations
-    age.secrets = {
-      qemu.file = ../../secrets/gitlab/nixos-qemu-shell.age;
-      vbox.file = ../../secrets/gitlab/nixos-vbox-shell.age;
-    };
-
-    services.gitlab-runner = {
-      enable = false;
-      settings.concurrent = cfg.threads;
-      services = {
-        qemu = lib.mkIf cfg.qemu (runnerCfg config.age.secrets.qemu.path);
-        vbox = lib.mkIf cfg.vbox (runnerCfg config.age.secrets.vbox.path);
-      };
-    };
-
-    systemd.services.gitlab-runner = {
-      serviceConfig = {
-        DevicePolicy = lib.mkForce "auto";
-        User = "root";
-        DynamicUser = lib.mkForce false;
-      };
-    };
-
-    users.extraGroups.vboxusers.members = lib.optional cfg.vbox "greg";
-
-    virtualisation = {
-      libvirtd = lib.mkIf cfg.qemu {
-        enable = true;
-        allowedBridges = [
-          "br0"
-          "virbr0"
-        ];
-        onBoot = "ignore"; # only restart VMs labeled 'autostart'
-      };
-      virtualbox.host = lib.mkIf cfg.vbox {
-        enable = true;
-        enableExtensionPack = true;
-      };
-    };
-  });
-}

modules/nixos/syncthing.nix

@@ -18,7 +18,6 @@ with lib;
         devices = {
           chronicles.id = "7FI6Y3M-C7YQEDI-IB345L6-RKLXMB6-AEIV57Y-3J2RCXQ-MK6QRNK-EINPXAE";
           genesis.id = "YDTH4SD-GUAC5AA-SSYWYPZ-YMJW5LK-LE7PZKJ-GV2UJFZ-CU7LZAD-GTYWCQK";
-          gitlab.id = "GKNOZWI-CNC2Q2F-R5GGGDX-RYFGHK4-CCC37LC-GVOEMJI-46QPC6G-AWFEOQE";
           linode.id = "IJMMXPR-WNALZBD-FMJH5W5-WV7XGJY-HLJTKGT-5TKHJIH-75LT56D-UUZCYQE";
         };
         options = {

network.json

@@ -121,9 +121,6 @@
       "external": true,
       "system": "x86_64-linux"
     },
-    "gitlab": {
-      "system": "x86_64-linux"
-    },
     "wsl": {
       "external": true,
       "system": "aarch64-linux"

secrets/gitlab/db-password.age

@@ -1,37 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 87huqg Eh2E7tXjZj6ydDOSsFD8UKMjSjLWW6YZg/5bzcdMaSU
-0vXZ9AGU3N8Jbep6TRijGKoo89jK0yauG1LmErtdT70
--> ssh-ed25519 8UnW5Q UxbfpTqUcjkdevd0WwFtUxifEtDvedj8l+V2wFVjThw
-6aYQDmzFj1fin7G7e0cUCn55PBU8bDolkw4l+5A25qY
--> ssh-ed25519 UFfTmg Dfm/r13wimRQT2hQSWKhyr14BZliLrLGn/sZq3G3yTY
-qzZLiowHu+HnSY31yXBOFPEYn2lJSJ5MyWvKSe2QZcI
--> ssh-ed25519 xNtnoA AltIha0Z9BqZY4V8LOzCcr5KPWAvoNoyktReER3Glgs
-ac51BT1NGldAn6N/s7KEkNrRLhmntwx09SguGdZRR5o
--> ssh-ed25519 aY2AXA EmE9Bjzme13LSSMZDnJsPFvpXGamtc/H3DOziP+d+Cg
-VN5z1+EzLF6N232QwkO5TT5Kf9NpoPDL2T50qCpCfgc
--> ssh-ed25519 AQhf1g Z3Ezie7ikLb/8u+iNALI8x327lFqLN1NRIqHLfjqNFs
-QQDDH6Dio4zc0FCsLDRWl3ywaEdkp4zwGG+Iaegmi3I
--> ssh-ed25519 mOmPfg mSW3OSIm9/8myqUxEJlsf0LT7vCO9i6/D3WkWKCD7l4
-U6TkEVyzxnb+9B2wLeEkQ4g6w5s31Q30/Q4ehQplf3c
--> ssh-ed25519 YJiRbw Gs9VBwzEPr1QA1PcaQUCUwS+jwXYVniqe5TaZBjrJmQ
-rFS24MN8bzA+vj6/sJHuEC4yYglpf0OJT0GgUVm0HTs
--> ssh-ed25519 0/WsKg MbcckXyUg5JfGafnhidk4dH6mEuhZOPac4YncYeYOR4
-oeFwgCrjDPauQSCgE1Q1/Smz6SI44TVfuNH0oP9WcdM
--> ssh-ed25519 Nl/5yA 9xL4/5nxpciN9HFFO/X3xQ1oMe+EvLohnI6631amwhw
-n4As363EPOxuzN5f5RNuUrlEDFgmhVvjtEosQKTPVII
--> ssh-ed25519 GdLgCQ P+jwMHdoS74jIdGQjOx4sDngWs+zxNpnzSgrDXD7Vkk
-NuGd8agrw/8PT+dw9RirCYATZRPnF5rKDSfyDaJ17iw
--> ssh-ed25519 tOH/HQ u7gM8oYWpfFFW54TqoisGDEeX5MKxaVxT+ozl4miF0I
-avmdzbzCSDv4ovYMMmqx//G5FVEuz+hOJpr9/49w1Rk
--> ssh-ed25519 FpzvfQ 3bDfVBMNavjfMFaKO8C5VvXiDMQxfB4WYp9mJ1LnIQI
-bl1KwNL5M8gJlqE/R5/lY7UlLOgeftiwinyC8yDb71A
--> ssh-ed25519 kdPvzQ 2Y9lCbnjBhF3N0BTzhBqxJ/NDe7Z9/Vpkd8bbL29D0k
-pL4VMb6jnQv4bwt5SjcORlTWsvSWOhTNZXNYEkCZH5E
--> ssh-ed25519 onmXpg 2Nw16oXRct8XDRqs6TRiOK6tBk9kNZcR2VDLy9GvOkM
-N95+6Ia9lpbKenojMDDAuLrT4cqjENsWzrwplcBKiUs
--> ssh-ed25519 CnhD0g j7udTMCoQHrqYnH/mxGgRzor7RaTm2HjaSwuoVQqCGw
-ivg32RGKKCqe2yBjq58ym8shWlrYNfcvuK7xy1F2mmg
--> ssh-ed25519 4ep2UA bBdPC5asgGcu60Y/i0yVKvAQc9U+7Jruik0xT8rDUA0
-ul6uiMBstdXVVmuIpgsZPSt6MQiyklPGYSbxOTLndeQ
---- 5mAFqAG9hgU00QxYRKkhNl3fJ1KwDevvTnUhf0xYUog
-TW"	ȧ]h|nÁdÇ„Œô¡QFWv¬à©»®¨oµiÅZÂSŸŽ‡ÑG–í`|Д "�¬ó8n}:Î:ú6”

secrets/gitlab/db.age

@@ -1,37 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 87huqg KMaYb+ubBiCqBKr08lmrIhiuNcvH/WnnEDYYvdgnvgk
-lJM8dGwT3LYvI9NtPZOzY94bFhk6sxO6F4NCMJBDBuA
--> ssh-ed25519 8UnW5Q rUXfXe6S1jgTfJJGhT3NfIGhvYaf4aUAuD7wAa5GaxU
-OCe5kE+IM1MHqMPfLpgO5spYxDm1SDp5euubLkOF6K4
--> ssh-ed25519 UFfTmg 8ZIBc9wr/hoQE/ItltZhSbqlZ3qEQMyLajy0cORbOQo
-DocUbgXT5m8CgExF1ICAJv+Nu4rBogwaYz5vJKNRQhs
--> ssh-ed25519 xNtnoA x0uU0K78XzA9yYXg+jR6MIJASRxsJ9eMZctm276tP08
-SGZYFFkfbQpLVqV9OUQMMbOmv+0qNS3bO7IkWWjqohE
--> ssh-ed25519 aY2AXA D5xP6cDYNLUsGeLgLO2x2gkBzfPByR58G2PjjGs/rxA
-wiqNVVjyQPnZop7q0PXmOOw7cJr8WKQVl1mk7zL+/cM
--> ssh-ed25519 AQhf1g MJuVLCVIdZ7fKnXVvtJvSLriX1Q+2u20Y+aNI7N75hM
-EocXr6NlaanErb3Nmc9R+3DSdfoCAyHa5gDYzBX+xJk
--> ssh-ed25519 mOmPfg wbQrmVm8CEeAHpJIjCyFI7Mfhn3i9bER7FppanAneTQ
-jAvjziCLYUl//6ZlZ5d3gE1ONRjhEnPLTabvTJEhFg4
--> ssh-ed25519 YJiRbw 6ZAb7+mWKPCkYZrpcW1g1JoL9Q72rWwLIEZJtPx4ayY
-WtKeYr7wxCVisATDyejwnasFcVRtGa175wJoXNzhyKk
--> ssh-ed25519 0/WsKg yyQBUeYAFIJUuH6xsMYztjO8zeswUWFCgqiNoMqxijY
-y5azJJfyU9NgyY8kuIoWRfY1kMJUzgxx8UtqJ3XBNvI
--> ssh-ed25519 Nl/5yA Ffb3McX/NVo56cJXA51n9yrpeSTvD5/0S9n7ObeYrXA
-Wg1EhU0nk/Wh3Jf3+LY6dVLXBNbAM8miuC8gYdabIwY
--> ssh-ed25519 GdLgCQ x/k3xO9fHAPFeOdeAwgWVNqWtU9u6RVXXNUnhUXk1B8
-aNeOSmnUILJTjof6+7sN8h2zA+pqBmU6cpmD81xcmtw
--> ssh-ed25519 tOH/HQ ZEBu38T0q6tZkZSZIbGc3Kn9acTGqSbquPC6xlXt90o
-LPvS9dVaPUiE5nxVV8LsAjfRdyKBNmCwGTxOcyCxWMA
--> ssh-ed25519 FpzvfQ iU+7myrJIbc+xbVZf7OxGSBy7Vq+FqItVYECvrvV7V4
-YkMvBRDnkGf+zznWTVSbFbR/2BaqOT1ja7piiyRL+uM
--> ssh-ed25519 kdPvzQ cuzIgrPaJK1SY4soXT2lQkF8Ji7GZq+ihH2vYmbyDXY
-E7cA3PDHBsqm7Z9SbflHXQXMzv7B0uxYR4UQv9NHZ70
--> ssh-ed25519 onmXpg aNcwAfrg7CfnC9Whp/qjikADbZzeSVM0m+kLkjExg1A
-1RWx1F4Q6zA91UHxBmvuxqABv+mZZwNayAVAz0EqGQg
--> ssh-ed25519 CnhD0g LrFzQX5UKZAizqYkDCT/k6CWdFZYFqPguyLjgfcfQ2U
-O7Ta5mpAcLI2XswerqtW2fC0evmy/gdSQqLgW7L99zo
--> ssh-ed25519 4ep2UA 8B0v6mE+hB0iKaZNrkvdlI4E2y4lWNR4zJ8oJS75jR0
-l5M6WSWKGuHMCiL5V5PCyDfFCElGNmR5UIkXRivSl5Y
---- 1PM/nhbi3rtn26S1rtNwUT97plbJJvHOmPNzIYAsK4w
-W'SàeÚäß>pÎ_­Çª´vcHN›×9¥Å¡àè6�L,_ž[
3Ì␍_ìaØí¬¤Õ¦‚>¶¯D0Þ„lô‡F4.Ó’‰µ5±:�úà�0ò±É

secrets/gitlab/jws.age

@@ -1,37 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 87huqg 3CNYW4sCTBsHWQaRdsyRomLXQ5V9jjzV+V9vHcKtqjc
-ZjGxC8Fqddlzmdd4uZxQWs9aAut+COJ9zWXZFQvRdG8
--> ssh-ed25519 8UnW5Q rgmZ4hwUDXX8VdQQWxZn5NO70j4IuJ1l9aD6uXjAWiE
-SfmW+u09bGEP164j1awAoGpvchg9UZS7tgtSdLeepB8
--> ssh-ed25519 UFfTmg MPZCtrzXXzusawPkfZ+fBWepH7MZihKXlz9ztfp/bBU
-RkLU9HPTJjyiaRczJU3sYMT0RT+oSvL3TozGRxOZM6s
--> ssh-ed25519 xNtnoA HqhyTh67Yww4wHVR9i5+K7388nvAYwkPr1T95Sn3WDk
-entg7nxJXWqq+N0LMUwv+psL+O6ivZjnGo+KbgKthxM
--> ssh-ed25519 aY2AXA XTpM0SssYVVEtnWPCfooazXvVccdO4IX+Zmp7dxoDUY
-mz6v4rzOpLT4fu+XYC5BwkXndNoBbEpazUt2wh0tutk
--> ssh-ed25519 AQhf1g bUAsCyBen89j8JqUV3qAVTZ5QrxluYOmUO7D68Sd50k
-14ebyL+xFEK8NMBzxAArVaxCPZwBPLNBLdalC9TGB/I
--> ssh-ed25519 mOmPfg Mv+p2kGC4PunQGSVD28emoEDra/ohZHK/xxTQVhafTM
-gUrUjDQCxMfgcjWkbGWmi1A2GF5X07pUKdZuuaXWdcE
--> ssh-ed25519 YJiRbw 0jxrJSU71zCnF1bDUieGOsc/TAeR9gv/1ks2kPN2sD0
-yho+rheLys+ET7uKrrlsljQZQ8VuUnzg5eUj7gVMgAk
--> ssh-ed25519 0/WsKg yxsm0H6tRCron9th/e9KfX+zFl5T3DH0/B602ak0s28
-kkmfbZ1SyXLJxlM/EeBRJEf0Rb+15w3nXZEZ35xuCug
--> ssh-ed25519 Nl/5yA IoFwKIz+jrNUm4PB3wX5okeqtPKANPP+/lcZaJ+mZ00
-0ChPqTpzLCCz7die5lgOnO+Yz8JQIqjTX5oLwXv/IbU
--> ssh-ed25519 GdLgCQ Fo9YJGiJMTpnhRQKd2cQ7XfQXLvOQ8+V5rlZvqOhWgQ
-Lhie4dV3210DbNvbkBWFStgycrH3xgE3tt5PYF0OjEU
--> ssh-ed25519 tOH/HQ 7BXNJ/wYMc9HIswKCTkXQF42UXKXCCqcD7/RQINx5g0
-G2HbqhnEuoCGmuowye/EWQJ1UWojp1cFLoyu6b5AaGA
--> ssh-ed25519 FpzvfQ l5jORObNye/4CGt9D0pkP7CAqhWZPPlEhCSmuc5JxVE
-5P/S8vQEzlYgXcM+TxlQnlyO6fK0lUkxBElfTZ8dR14
--> ssh-ed25519 kdPvzQ rbwguFPeDqBJye6fzNAR+zqo3vA13o8VBqTDMtq/xF0
-0wjGYDkSgeB1H4GvjFfM5HIxCFs1s6R/6US0TFv/o0I
--> ssh-ed25519 onmXpg GB5Hi8wAOxRaoyzcDuHK96+JNd/zfBdmR6oJdpYkmi8
-svDcX5tYRR8IzuQi36TpxqKu/vKiDj290e1Hx/RoBAs
--> ssh-ed25519 CnhD0g 4vM1+uQTV/dYAbYP7Nsj9DZFjFVc1yFqNzKxWyz1OWQ
-G7ifv77YIefxMqK1vSEzxPCxQaf8Sd2cdpyoy3DxGZg
--> ssh-ed25519 4ep2UA V+2q8xrX8eAQzuNV8Se/BUtut4EbkRsy/svnbRVO1TM
-WYJTqLxIqFC3a4z3UtMp4z7CAXEZ2NJUGzxftIvgoeQ
---- t27r1Bedv2MW11oCtfWXl0ijG9/aiiWMdEbgymIqdSY
-§66^¹‹�§ÌVUÃuï6°â$	ÜQ[a²U�W*©Ò&s9Iª23HœR÷ÖOJŠüÒ§É)CXeRýŽXi¾6yØB:b<tWÓ­¹nÀ>\+ûî

secrets/gitlab/otp.age

@@ -1,37 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 87huqg 6Yf7i221QUp6qN/CZOSjHzaycZUgAGSwTRjlKZ8Pw3g
-xQWKonF6dDP5hXg3tFNPim6zb6XxcJ7T96+YQ16ziMo
--> ssh-ed25519 8UnW5Q 8dkjCC6pl0z5l/ZB/M3JC9eUOyB6WipF08rJB7Sa40I
-kVuyfXIBCR1iu6tp/a8CBOQcXHv0Pvn/7PXuFvpnKQo
--> ssh-ed25519 UFfTmg Sa/x4f5tvvQjI1ZdEhklMIimXiDkId/6nXJwlo5z3Gs
-jXkH3gVRv7f1dsZMdVDHMh2BQ5Or66eIrwfoHm/C/Os
--> ssh-ed25519 xNtnoA GueQcHnvRtnftKkVehS9GeL4YVe6PonxbY6hMGdGhmc
-lM3gdP9edOI2mBJrHnD91g7R1ucR4xP3IfDLLrMeizY
--> ssh-ed25519 aY2AXA 42K0aTzZIKipmq7d8XGGgyIMB/dJALos4AZsl4tQaBo
-/k8yNXeksAXy7EzNVXQTGNJ18lVc7SxJDJhr9E5F15Q
--> ssh-ed25519 AQhf1g ql3uiFEScr0CbIALP0oD3+X56ti/egAjj4T6usJfkjM
-S3ZgjLc0ALm1PsSgxqAYECRDzqRF9BOCGZhT95Nin2c
--> ssh-ed25519 mOmPfg 70rXi96dEVYo+Vb0ekr0POh1RWWVE7QcySWIHmfNol4
-iGuntLq8pBbrOpdrfrhSfBHpnPxadDD0F28yeyFehmA
--> ssh-ed25519 YJiRbw 0e6SH2cQmLZStVR8zMixESrCnHFGiuFNvY5rr5cKgkQ
-mQDjego0IL9bATA5BkNjWhMRj+zwgjyZsrDDnV+d/5Y
--> ssh-ed25519 0/WsKg 0kLNpZmoY18kHQHcnfmcl9jbCuXhCwHObsUtSXK7IlA
-P73mC2PUI4LODn+0c5UBZvDmUqb4nuvNq07aqI5oR/I
--> ssh-ed25519 Nl/5yA bVpuj8uhAEKFTD04b3irvAJWcNOdFQzaUY/5LlyT8BY
-wLUHnoHvzRiYGd7WlYBamPzbsKnUYOxLgoQbp0f4S1Y
--> ssh-ed25519 GdLgCQ 9m6Y7d3PFFeOw7DngkZIFqBl86lL20cBr+IiNMTc4XE
-I9cHA5tTpUeTkglotot2aBetRhJrpTHEl629/I6GImA
--> ssh-ed25519 tOH/HQ yH4uXFXonl3GdB6qNMI1Bai9Dm7TAjbuHkpipGQJC0Y
-E7WK4YWwR+CzoO3827NhburCB0O6U8ioFZrvlnzvm+c
--> ssh-ed25519 FpzvfQ qKBmiRCSDG1P/ijVqIv3vMI/3k3Owf4faDzh0DBKMWE
-cAbGPLI6b1+2juLbY/eB8zr2/1hKPD/G++igdkWF06c
--> ssh-ed25519 kdPvzQ cCSoUaZSwYd03DAblZp8lVF1KqKgH/0Tgm9EnveJ80E
-FcLYsv9JmE9RuK+080kJxSj+/5trUIj0EDPf75bl/BU
--> ssh-ed25519 onmXpg h2aRUyrSFBupqLERDanFEVXReOut4Y94aq7EVmj4JgM
-yfDYFFI6p/M4bWcvHBSFe449WDg/0FlCCGeFkGgUWNk
--> ssh-ed25519 CnhD0g amEQyS8R7p/qJIlKNOdsHgukKMCVj1ypsPqWTsnuoCk
-+ZRH39P3lLs0W7S5iuLPBs9UIPmp7tw/gXvJhhPXahg
--> ssh-ed25519 4ep2UA hjodTPrxShfnJJpHLK7qD4f4m+jR2Pc43s3bRASoHg0
-GXiO0cSAG/aes2yqq9abdWqKH/9ZIk04TAVdiLpg1uY
---- JGKP15sCEBNrbkcbzcQmkNjSUvyuONGaM2SiRGK3WW4
-€ãÀUíñfÏ2&YìmŽ�k*¶Ü£c4�T”Ê«?„ÒÎ.\<í	ÇX²z,—Ó©þNþhXRðÉ16À¬áhþürˆ1‚ÆMŽÔfJVùØÜÎí¡Rvç*

secrets/gitlab/primary-key.age

@@ -1,37 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 87huqg pxinVlRwRapBcR4go0sPkLXzqQoGfqnXy2xFdTsiclo
-iik2P9JMR6rE7Dz7eACovjT6OCG07AD6kxbuAmKrPqw
--> ssh-ed25519 8UnW5Q 2dDafRkl6O3JY4dg1fEF0OVAAkHTXxOvn7L0wyeJmXw
-0tj+wY2S8G26Lpvn6wWGxx888VRNqvHC0+d7pfaZqDI
--> ssh-ed25519 UFfTmg 4pP9ht7a/ZcQkpZTacUBK0euaUbI6z13l74vpjpDgS8
-1kiQcsgUBhc5wDAzQqeHHtaNBQ0NgOa/nWzdvKqjgKM
--> ssh-ed25519 xNtnoA is0caVhVtHiGINKHJaXYn018HtF78KcXGzlGYnRhehY
-BBe830cvdSS4WHn+2AGZ4SuxspBaVErw1Pu95d9Zw5o
--> ssh-ed25519 aY2AXA VDMqxKqzMo1BrcSnc26pkXhlisxnfo0jEKyKKQ70sl4
-km1hfV+9sx2WDtDQMdA1Q2KdQ3lw/nmaUAOL0v4bQe4
--> ssh-ed25519 AQhf1g ye8KsZ7/Qmmo3gMmTRxCRux+0X/TDIkMfJfwEF56CwM
-ZWTF/Wl3G1pVPIxCBoLpq4eWuf4pcKSoQM7+p7vsJOg
--> ssh-ed25519 mOmPfg d5I0xYKepGdgVQ4f9A0+FLwxA0XRpyjpZ4YQoQ12/2Q
-e9O2/ROORHHuDhnZgn0KegO8QqXNycBu06ZD00qIZRk
--> ssh-ed25519 YJiRbw oydLfhPROsG3AIjcaSR/3rRXJCnljtQ33t7p2OFMYSY
-Q+7cbIZ+E2S591aIB/zcDmOnPHto3zxRlEYwRejOTjM
--> ssh-ed25519 0/WsKg RFPRDaH1bWOqy9T+IfTkeehB+b1xr+3VzHnMJy1ezAE
-DRxwHAcJ5g7aryUFiE9YzgMBXGlwCrzfspeB9ZLZCto
--> ssh-ed25519 Nl/5yA XBWei39hiN3SKNmXUKkv2ve5Us78lRLq4qsdQ5uoXTY
-HSiYWXkHhsT9aVJBVYJn7lAU6mkuDoO4pZj4TKHs3CM
--> ssh-ed25519 GdLgCQ FmskZXs0zQizSLjetVFUeekOB5MffZQu34kgzhpdX04
-b1P7JaVmwPqPQZohFHmDoe9n6WtSvOBD3/Puon7N81Q
--> ssh-ed25519 tOH/HQ MrCEOqQbdQktOmeC4sEEy7vX6SjhqunMpmnZ+ogDahU
-XDxLRZ2aiaEnq+t12SgSCbv3ZZclkJFmeFX47TzM38M
--> ssh-ed25519 FpzvfQ MlDNZs1/L8sAdDv0iAHiAKHC0ORn1XnS5st6l7Nd3kg
-kcZEp5WRPtZATThbThjiSLU21Xmfu6BwiB03kTUOTRE
--> ssh-ed25519 kdPvzQ dUWPf++1B9TU3jpaC3O2aFXCMlF4YvzZCAjASc5Rjwo
-5Hg9oalicLh09YSb7FokQSqkBcLMZ3ePGnzKCMCjjcE
--> ssh-ed25519 onmXpg 9WQusW0nfo/gUChf6plb3xQLAdu8Zdovlt+SHFFP+Fk
-RYHWttktn30aUkTSpRiY6jvVp6kZGDru6Ce7FWpYUmE
--> ssh-ed25519 CnhD0g etVMbgOUosTxt5J+oO2z4f4Zaf9XmzKZKiYzyRON0Eo
-bjo0/trYvXCNG4nFSl4VmKke2Dr2sJvD2Ps3KVnz9K0
--> ssh-ed25519 4ep2UA W9MEIlu/M1bQQFT/F0ns78lBvyVonXBpCSQysMV0hyc
-oH3V4KxWtL2eJvqxjxKcd/pGgaNilwxStNpKo29wPFs
---- +nY/B5L7D+piJGp7RbzbFeAw3EM0X5QJ6aEAlaVU1Mo
-#°y¬‡!c*WåÀ␍èÈ4R2,ˆÇ^ë ˜`m¨~Ã¥$LJóü�ÏíÌs»*pÚ.+L‰þ{]=uš¡Sö™øç 

secrets/gitlab/salt.age

@@ -1,37 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 87huqg WtxBR7tl7c5kqqNY5RZrQIthLIG58hZx/ngR8cYdURs
-G7+mhXcqFOdOioKJFdykwOrakVbhtK5efxtisd11yw8
--> ssh-ed25519 8UnW5Q s8GNXAmhc1a+luGrtXDj/AvIm+YwIpZwKyKhkFx6dSU
-AvE+KIJzNJxSWHOCqp7lt3yqal7lt0EyqzvFlOi93qI
--> ssh-ed25519 UFfTmg a2kAjGgd44RH5l782bx+ZE5kyoOychrl0HNR4CMNtCM
-4fzO1n99/S4hjrKGUPcQ6RDfNOp03hW9TSLvXm9Gmvk
--> ssh-ed25519 xNtnoA AQHswbi52dxuyx0xcNQszHZiqmWYet408Vk4xwdAAWE
-TbtKqouXNL4ibrA/5ysqRukgrlVpQva0qBYW+lNg/lg
--> ssh-ed25519 aY2AXA am3EZYO/A2NgPgSfXmv4oBWG31Ylneo5aAhE3fxyrDA
-FD87d17FaaP4Zxc6bUW7EPOdlNbpZW6nL2SLL3pvuzs
--> ssh-ed25519 AQhf1g lpI5cpau4ld8sKIeL2rUzvfMgoKpYFL3K1x05tI0hAo
-9FS6CCEh+ozunq1b+wb6/4XJTDD4a/FclmfEPXJ17bM
--> ssh-ed25519 mOmPfg Na+4qv+953ioMI8SBAqWkZoiOFwddLrQbQ9ht8OQ4HM
-0Wy3e5+Qbu/A/vTX9c87c0AWB0d/oCB16b73OZ/QvAE
--> ssh-ed25519 YJiRbw y0sOGLFgINIwTMOvwHbf2UF7CmtjeQh78CauAbdpKTQ
-FjQigm97STgQnCzvKJTHfmIc1dd5ipECzi/0mCG2x1A
--> ssh-ed25519 0/WsKg rpxWL89TERJ3QVc7eU/aKTt4hkEXuwaCsGLxc/MWVmM
-ywI9bG65CcNTtWizrPL56jE3kF0bkM+3Y4JY8d8FY8M
--> ssh-ed25519 Nl/5yA tawS9A4aoCw63qALl3cnNLXEpHafDqQTwcfkfk6BOVQ
-FcJYQu54IgibrjK8TMK+MijSxylmIITv60jHhi4xrq4
--> ssh-ed25519 GdLgCQ HazAqkEjG3n/zJ1OKI30EtVjuLh7N1ThOlI/KUOZF0k
-YJNWVPWB+2ega6CPQd4VX7dKwt+/jsd6zgwujO/rep0
--> ssh-ed25519 tOH/HQ BD4L9RxVDyhrGs314dbl85VKVWwG8gV+mUo9il6c3Wg
-SNG3HFG0rEXasfabMWxzOS7hU0H64a4jz93hJhVHLIw
--> ssh-ed25519 FpzvfQ OuagwUFjEkdwuE7CvhxG6rX4cHhULqJiiXe8A0YkjAk
-XZxhnisJC9vin1t5EBkAYk2UFvGiqhkQAwtW+MD/ZUQ
--> ssh-ed25519 kdPvzQ INs91qrXdBsMfPq4rFlqXBOaAH/YGNB3krOzl6+UNhA
-0cZTjvo84WMFDLo9MOhRt/tY3xfBLl9WKVapgA2ecRg
--> ssh-ed25519 onmXpg mIwVuIwLVOHfs81bmScGFc+ztwYLoL7nXtw79lGhW2U
-SYgy4giBk8C+OrOj5TGCyn0Bh/jWciT1mtUTsu5B6T4
--> ssh-ed25519 CnhD0g 080GDLh3bH6ils+v/Yh2wTM5mNTiLDKeOGAEtvLC0x8
-IHMimypNNW5BYk0rJhlrLS5pcVXiAsgSrcWE9jflQBg
--> ssh-ed25519 4ep2UA SyPq6Akc95C785pmpa0jn/FUDDXIw/W5StmtbPKk7mE
-lxa5YbmvxvO1OPmT6BHSRWw+VYZL5irA2Hxrl3bbTwo
---- oPPMefKWvJVhcKuSHDg9Lk34q9+GKM4LHU5ejAp9hTU
-�Ï6IÁ’Õ!üòE‹k7WzŒypš˜?ÍÎ3_ ïÄ[UD²g¡åÅM)ÃÏ\á[+Ž£i”™gâµh¶4HÎ

secrets/secrets.nix

@@ -8,14 +8,12 @@ let
   # jude = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOos0zQePsa+T6Z2dsKbPOvEdrBQ8a6mx3s7pN6ysCI0 root@jude";
   # isaiah = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHleYKtfV4W1Z63Ysu9w5Rbglqlz4F92YcZoMkucoTNf";
   # genesis = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEI9jbTPmEWQ0F2bLYmnIOLmBnag1fkKxHRjz3X8lB/k root@genesis";
-  # gitlab = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC7hesFWwlmSbWPJWUiF8fIppy5a83yXw84O0Ytz+Zyq";
   # hosea = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKLIwkTTXA56sUlUjEulXXZRvZy5H4a5ZwgKWLlpkQDz";
   # jeremiah = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOjQjXq9WYU2Ki27BR9WwJ4ZruS/lJXbjC1b0Q42Adi0";
   # matrix = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMIbvNNYrsT9sSBSwIL9c0LiHDaOiztlTJZAGgTDGUHq root@vm-matrix";
   # exodus = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFxmnCj2E9DxcnefPW+n4yCuLShxqr0p024riogdeXA3";
 
   # systems = [
-  #   gitlab
   #   genesis
   #   linode
   #   jude
@@ -36,7 +34,6 @@ let
     )
   );
 
-  user_gitlab = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEwX8DZRRbZ+Iwo90dROg/61lisazAAGK/W8aqWfWcJr greg@nixos";
   user_genesis_virt = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFWPSFQT0AH77wrwRhiskcBS0w4ZakBRdJywYYBsnm3S greg@genesis";
   user_ivr = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMYzms+KIe5/bYF3uCyFjA5e1AgMPLIA3c4k417coqBe gregory.hellings@ls23003";
   user_jude = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINnRc/kBhxcjpUtiRQY+BXnSObdp0jFL1395wAQxJip7 greg@jude";
@@ -48,7 +45,6 @@ let
   user_exodus = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC189EnvWjNUp3xSzPMAtw85oQEsvP1tQR1TK640nLx6 greg@exodus";
 
   users = [
-    user_gitlab
     user_genesis_virt
     user_ivr
     user_jude
@@ -104,23 +100,6 @@ in
   "gitea/workerPassword.age".publicKeys = everyone;
   "gitea/runner-isaiah-podman.age".publicKeys = everyone;
 
-  "gitlab/secret.age".publicKeys = everyone;
-  "gitlab/otp.age".publicKeys = everyone;
-  "gitlab/db.age".publicKeys = everyone;
-  "gitlab/db-password.age".publicKeys = everyone;
-  "gitlab/jws.age".publicKeys = everyone;
-  # openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.crt -days 365 -nodes -subj '/CN=issuer'
-  # Then pipe the resulting files to agenix -e <foo>
-  "gitlab/key.age".publicKeys = everyone;
-  "gitlab/cert.age".publicKeys = everyone;
-  "gitlab/salt.age".publicKeys = everyone;
-  "gitlab/primary-key.age".publicKeys = everyone;
-  "gitlab/deterministic-key.age".publicKeys = everyone;
-  "gitlab/nixos-qemu-shell.age".publicKeys = everyone;
-  "gitlab/nixos-vbox-shell.age".publicKeys = everyone;
-  "gitlab/kubernetes-k3s-local.age".publicKeys = everyone;
-  "gitlab/linode-deployer-runner-reg.age".publicKeys = everyone;
-
   "acme_password.age".publicKeys = everyone;
   "ca/intermediate_key.age".publicKeys = everyone;
   "ca/root_key.age".publicKeys = everyone;