Merge remote-tracking branch 'origin/main'

README.md

@@ -1,3 +1,5 @@
+[![built with garnix](https://img.shields.io/endpoint.svg?url=https%3A%2F%2Fgarnix.io%2Fapi%2Fbadges%2Fgreg-hellings%2Fnixos-config%3Fbranch%3Dmain)](https://garnix.io)
+
 This is a unified repo to contain my personal configurations for NixOS machines.
 
 # How To Use This
@@ -11,22 +13,12 @@ Go through the normal process to setup a NixOS system during installation.
    /etc/nixos folder
 5. Run the configuration generator. It should only genreate the hardware-configuration.nix
    file, which this repo gitignores
-6. Symlink the folder for the appropriate host to the location 'host' as such:
+6. Create a folder and file with the machine name in `hosts/<machine>/default.nix`
-   `ln -s hosts/myhost host`.
+7. Add `hosts/default.nix` an appropriate entry for the machine you are building
-7. Run the nixos installation command
+8. Create a file `home/hosts/<machine>/default.nix` with the new machine name as well
 
 # Adding new hosts
 
 To add a new host, create a folder in the directory `hosts/` that matches the name of
 the target system. Each host must contain, minimally, a `default.nix` file that serves
 as the basis of configuring that host.
-
-## Profiles
-
-Certain shared characteristics can be created in the `profiles/` folder and included in
-a particular host's configuration. For instance, any hosts that are running on a
-Raspsberry Pi 4 should include the `profiles/rpi4.nix` file to properly configure things
-like the kernel and boot parameters. Since I live in the "America/Chicago" timezone, hosts
-that run in my home will also include `profiles/home.nix`. That file will also set the
-domain that I use for my hosts at home. This allows shared content to be reused across
-multiple machines without the need to repeat it.

garnix.yaml

@@ -1,8 +1,7 @@
 builds:
   include:
-    - '*.x86_64-linux.*'
-    - '*.aarch64-linux.*'
-    - nixosConfigurations.*
     - darwinConfigurations.*
     - devShell.x86_64-linux
     - devShell.aarch64-linux
+    - homeConfigurations.greghellings.activationPackage
+    - nixosConfigurations.*

home/default.nix

@@ -4,8 +4,8 @@
 	...
 }:
 
-{
+rec {
-	"gregory.hellings" = 
+	greghellings = 
 	let
 		system = "x86_64-linux";
 		pkgs = (import inputs.nixunstable { inherit system overlays; });
@@ -20,4 +20,6 @@
 			username = "gregory.hellings";
 		};
 	};
+
+	"gregory.hellings" = greghellings;
 }

home/hosts/ls23003/default.nix

@@ -0,0 +1,4 @@
+{ ... }:
+{
+
+}

home/ssh.nix

@@ -27,7 +27,7 @@
 			"chronicles.thehellings.lan" = lib.hm.dag.entryBefore [ "*.thehellings.lan"] nas;
 
 			gh = { user = "git"; hostname = "github.com"; };
-			"src" = { user = "gitea"; hostname = "src.thehellings.com"; };
+			"src" = { user = "forgejo"; hostname = "src.thehellings.com"; };
 
 			"*.thehellings.lan" = owned;
 			"10.42.*" = owned;

hosts/default.nix

@@ -49,7 +49,6 @@ in {
 	};
 	icdm-root = unstable { name = "icdm-root"; };
 	linode = machine { name = "linode"; };
-	lappy = machine { name = "lappy"; };
 	mm = unstable { name = "mm"; };
 	myself = unstable { name = "myself"; };
 	iso = machine { name = "iso"; };

hosts/genesis/networking.nix

@@ -7,29 +7,30 @@ let
 	routerIP = "10.42.1.2";
 	extraHosts = builtins.concatStringsSep "\n" [
 		# Local hosts
-		"10.42.0.1 switch"
+		"10.42.0.1 switch switch.thehellings.lan"
 		"10.42.1.1 pve1.thehellings.lan"
 		"10.42.1.2 opnsense router opnsense.thehellings.lan router.thehellings.lan"
-		"10.42.1.3 printer"
+		"10.42.1.3 printer.thehellings.lan"
-		"10.42.1.4 chronicles nas"
+		"10.42.1.4 chronicles chronicles.thehellings.lan nas.thehellings.lan"
 		"10.42.1.5 genesis genesis.thehellings.lan dns dns.thehellings.lan smart smart.thehellings.lan jellyfin jellyfin.thehellings.lan"
+		"10.42.1.6 isaiah isaiah.thehellings.lan"
 		"10.42.1.12 tv"
 
+		"10.42.100.6 isaiahbmc isaiahbmc.thehellings.lan"
+
 		# Tailscale hosts
-		"100.90.74.19 jude.shire-zebra.ts.net"
+		"100.90.74.19 jude.home"
-		"100.88.91.27 dns.shire-zebra.ts.net"
+		"100.88.91.27 dns.home"
-		"100.119.228.115 chronicles.shire-zebra.ts.net"
+		"100.119.228.115 chronicles.home nas.home"
-		"100.115.57.8 linode.shire-zebra.ts.net"
+		"100.115.57.8 linode.home"
-		"100.88.91.27 genesis.shire-zebra.ts.net jellyfin.home smart.home zwave.home"
+		"100.88.91.27 genesis.home jellyfin.home smart.home zwave.home"
-		"100.78.16.88 mm.shire-zebra.ts.net"
+		"100.78.16.88 mm.home"
+		"100.84.183.79 myself.home myself.shire-zebra.ts.net git.thehellings.lan"
 
 		# Dev hosts
 		"10.42.101.1 icdm.lan wiki.icdm.lan *.icdm.lan"
 	];
 
-	extraConfig = builtins.concatStringsSep "\n" [
-	];
-
 	adblockUpdate = pkgs.writeShellScriptBin "adblockUpdate" (builtins.readFile ./adblockUpdate.sh);
 	proxyPort = 3128;
 	dnsPort = 53;
@@ -87,9 +88,9 @@ in {
 			];
 		};
 		nftables.enable = true;
-		extraHosts = "${extraHosts}";
 	};
 
+	environment.etc."hosts.d/local".text = extraHosts;
 
 	fileSystems."/media" = {
 		device = "10.42.1.4:/volume1/video/";
@@ -148,6 +149,7 @@ in {
 				dhcp-host = [
 					# Static IPs for personal work
 					"00:00:de:ad:be:ef,10.42.2.254"
+					"01:a8:a1:59:c7:8a:12,10.42.2.253"  # BMC management interface for isaiah
 
 					# Static IPs for things in the IOT range
 					"b4:b0:24:9a:02:4a,192.168.66.5"  # LD125
@@ -181,10 +183,11 @@ in {
 				expand-hosts = true;
 				log-dhcp = true;
 				log-queries = true;
+				no-hosts = true;  # Do not read /etc/hosts, which makes genesis resolve to 127.0.0.2
 				addn-hosts = "/etc/adblock_hosts";
+				hostsdir = "/etc/hosts.d/";
 				server = dnsServers;
 			};
-			extraConfig = "${extraConfig}";
 		};
 
 		# Update adblock list
@@ -206,6 +209,8 @@ in {
 	#};
 
 	environment.systemPackages = with pkgs; [
+		bind
 		curl  # Used by dnsmasq fetching
+		sqlite
 	];
 }

hosts/myself/container-git.nix

@@ -0,0 +1,95 @@
+{ inputs, registryPort, ...}:
+{ config, pkgs, lib, ... }: {
+	imports = [
+		inputs.agenix.nixosModules.default
+		../../modules-linux/proxy.nix
+	];
+
+	age.identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+	age.secretsMountPoint = "/run/derp";
+	age.secrets = let
+		cfg = n: { file = ../../secrets/gitlab/${n}.age; owner = "github"; mode = "0444"; };
+	in {
+		gitlab-secret = cfg "secret";
+		gitlab-otp = cfg "otp";
+		gitlab-db = cfg "db";
+		gitlab-jws = cfg "jws";
+		gitlab-key = cfg "key";
+		gitlab-cert = cfg "cert";
+	};
+
+	networking = {
+		firewall = {
+			enable = true;
+			allowedTCPPorts = [ 80 registryPort ];
+		};
+		useHostResolvConf = lib.mkForce false;
+	};
+
+	greg.proxies."192.168.200.2".target = "http://unix:/run/gitlab/gitlab-workhorse.socket";
+
+	services = {
+		resolved.enable = true;
+		openssh.enable = true;
+		gitlab = {
+			enable = true;
+			backup = {
+				keepTime = 288;
+				startAt = [ "03:00" ];
+			};
+			host = "src.thehellings.com";
+			https = true;
+			port = 443;
+			extraConfig = {
+				gitlab = {
+					trustedProxies = [ "192.168.200.1/32" ];
+				};
+			};
+			initialRootEmail = "greg@thehellings.com";
+			initialRootPasswordFile = pkgs.writeText "initialRootPassword" "root_password";
+			pages = {
+				enable = true;
+				settings.pages-domain = "pages.thehellings.com";
+			};
+			puma = {
+				threadsMax = 6;
+				threadsMin = 2;
+				workers = 6;
+			};
+			redisUrl = "unix:${config.services.redis.servers.gitlab.unixSocket}";
+			registry = {
+				enable = true;
+				certFile = config.age.secrets.gitlab-cert.path;
+				keyFile = config.age.secrets.gitlab-key.path;
+				externalPort = registryPort;
+			};
+			secrets = {
+				secretFile = config.age.secrets.gitlab-secret.path;
+				otpFile    = config.age.secrets.gitlab-otp.path;
+				dbFile     = config.age.secrets.gitlab-db.path;
+				jwsFile    = config.age.secrets.gitlab-jws.path;
+			};
+		};
+
+		postgresql = {
+			enable = true;
+			checkConfig = true;
+			ensureDatabases = [ "gitlab" ];
+			ensureUsers = [ {
+				name = "gitlab";
+				ensureDBOwnership = true;
+			} ];
+			settings = {
+				log_connections = true;
+				log_statement = "all";
+				logging_collector = true;
+				log_filename = "postgresql.log";
+			};
+		};
+
+		redis.servers.gitlab = {
+			enable = true;
+		};
+	};
+	system.stateVersion = "24.05";
+}

hosts/myself/container-runner-qemu.nix

@@ -0,0 +1,63 @@
+inputs:
+{ config, pkgs, ... }:
+let
+	extraPackages = with pkgs; [
+		curl
+		gawk
+		git
+		packer
+		pup
+		(python3.withPackages (p: with p; [ pip pyyaml virtualenv ]))
+		qemu_full
+		qemu_kvm
+		shellcheck
+		xonsh
+		xorriso
+	];
+in {
+	imports = [
+		inputs.agenix.nixosModules.default
+	];
+	age.identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+	age.secrets = let
+		file = num: {
+			file = ../../secrets/gitlab/myself-qemu-runner-reg-${num}.age;
+			owner = "gitlab-runner";
+		};
+	in {
+		qemu-runner-reg-1 = file "1";
+		qemu-runner-reg-2 = file "2";
+		qemu-runner-reg-3 = file "3";
+		qemu-runner-reg-4 = file "4";
+		qemu-runner-reg-5 = file "5";
+	};
+
+	networking.useHostResolvConf = pkgs.lib.mkForce false;
+	networking.nameservers = [ "100.100.100.100" ];
+	services.resolved.enable = true;
+
+	environment.systemPackages = extraPackages;
+
+	services.gitlab-runner = {
+		enable = true;
+		settings.concurrent = 5;
+		services = let
+			r = num: {
+				executor = "shell";
+				registrationConfigFile = config.age.secrets."qemu-runner-reg-${num}".path;
+				tagList = [ "shell" "qemu" ];
+			};
+		in {
+			shell1 = r "1";
+			shell2 = r "2";
+			shell3 = r "3";
+			shell4 = r "4";
+			shell5 = r "5";
+		};
+	};
+
+	systemd.services.gitlab-runner.wants = [ "network-online.target" ];
+	systemd.services.gitlab-runner.after = [ "network.target" "network-online.target" ];
+
+	system.stateVersion = "24.05";
+}

hosts/myself/container-runner-vbox.nix

@@ -0,0 +1,84 @@
+{ inputs, name, extra}:
+
+({ config, pkgs, lib, ... }:
+let
+	py = (pkgs.python3.withPackages (p: with p; [
+		pip
+		pyyaml
+		virtualenv
+	]));
+in (
+	lib.attrsets.recursiveUpdate {
+
+		imports = [
+			inputs.agenix.nixosModules.default
+		];
+
+		age = {
+			identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+			secrets.runner-reg = {
+				file = ../../secrets/gitlab/myself-${name}-runner-reg.age;
+				owner = "gitlab-runner";
+			};
+		};
+
+		environment.systemPackages = with pkgs; [
+			curl
+			gawk
+			git
+			packer
+			pup
+			py
+			shellcheck
+			xorriso
+		];
+
+		networking = {
+			useHostResolvConf = pkgs.lib.mkForce false;
+			nameservers = [ "100.100.100.100" ];
+		};
+
+		nixpkgs.config.allowUnfree = true;
+
+		services = {
+			gitlab-runner = {
+				enable = true;
+				settings.concurrent = 5;
+				services = {
+					shell = {
+						executor = "shell";
+						limit = 5;
+						registrationConfigFile = config.age.secrets.runner-reg.path;
+						tagList = [ "shell" name ];
+					};
+				};
+			};
+			resolved.enable = true;
+		};
+
+		systemd.services.gitlab-runner = {
+			wants = [ "network-online.target" ];
+			after = [ "network.target" "network-online.target" ];
+			serviceConfig = {
+				User = "root";
+				DynamicUser = lib.mkForce false;
+			};
+		};
+
+		system.stateVersion = "24.05";
+		users.users.gitlab-runner = {
+			isNormalUser = true;
+			group = "gitlab-runner";
+			extraGroups = [
+				"root"
+				"sudo"
+				"vboxusers"
+				"wheel"
+			];
+		};
+		users.groups.gitlab-runner = {};
+	}
+
+	extra
+)  # End of attrsets.recursiveUpdate
+)  # End of outter function wrapper

hosts/myself/default.nix

@@ -36,16 +36,6 @@
 			"10.42.1.5"
 		];
 	};
-	virtualisation = {
-		libvirtd = {
-			enable = false;
-			onBoot = "ignore";
-		};
-		virtualbox.host = {
-			enable = true;
-			enableExtensionPack = true;
-		};
-	};
 	users = {
 		users = {
 			greg = {

hosts/myself/git.nix

@@ -1,22 +1,15 @@
 { config, pkgs, lib, inputs, ... }:
 
 let
-	extraPackages = with pkgs; [
-		config.virtualisation.virtualbox.host.package
-		curl
-		gawk
-		packer
-		pup
-		(python3.withPackages (p: with p; [ pip virtualenv ]))
-		qemu_full
-		qemu_kvm
-		xonsh
-		xorriso
-	];
 
 	gitlabStateDir = "/var/lib/gitlab";
 
 	registryPort = 8001;
+
+	container = input: (lib.attrsets.recursiveUpdate {
+		bindMounts."/etc/ssh".hostPath = "/etc/ssh";  # For agenix secrets
+		privateNetwork = true;
+	} input);
 in  {
 	networking = {
 		firewall = {
@@ -30,108 +23,92 @@ in  {
 		};
 	};
 
-	greg.proxies."isaiah.thehellings.lan".target = "http://192.168.200.2";
+	greg.proxies."git.thehellings.lan".target = "http://192.168.200.2";
 	
 	system.activationScripts.makeGitlabDir = lib.stringAfter [ "var" ] "mkdir -p ${gitlabStateDir} && touch ${gitlabStateDir}/touch";
 
-	containers.gitlab = {
+	containers.gitlab = container {
 		autoStart = true;
 		bindMounts = {
 			"/var/gitlab/state" = {
 				hostPath = gitlabStateDir;
 				isReadOnly = false;
 			};
-			"/etc/ssh".hostPath = "/etc/ssh";
 		};
-		privateNetwork = true;
+		forwardPorts = [{
+			hostPort = 2222;
+			containerPort = 22;
+		}];
 		hostAddress = "192.168.200.1";
 		localAddress = "192.168.200.2";
-		config = { config, pkgs, ... }: {
+		config = ((import ./container-git.nix) { inherit inputs registryPort; });
-			imports = [
+	};
-				inputs.agenix.nixosModules.default
-				../../modules-linux/proxy.nix
-			];
 
-			age.identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+	systemd.services."container@gitlab-runner-qemu".serviceConfig = {
-			age.secretsMountPoint = "/run/derp";
+		DevicePolicy = lib.mkForce "auto";
-			age.secrets = let
+		ExecPostStop = [
-				cfg = n: { file = ../../secrets/gitlab/${n}.age; owner = "github"; mode = "0444"; };
+			"rmmod kvm_amd kvm"
-			in {
+		];
-				gitlab-secret = cfg "secret";
+		ExecPreStart = [
-				gitlab-otp = cfg "otp";
+			"modprobe kvm"
-				gitlab-db = cfg "db";
+		];
-				gitlab-jws = cfg "jws";
+	};
-				gitlab-key = cfg "key";
+	systemd.services."container@gitlab-runner-qemu".conflicts = [ "container@gitlab-runner-vbox.service" ];
-				gitlab-cert = cfg "cert";
+
+	containers.gitlab-runner-qemu = container {
+		bindMounts = {
+			"/dev/kvm" = {
+				hostPath = "/dev/kvm";
+				isReadOnly = false;
 			};
-
-			networking = {
-				firewall = {
-					enable = true;
-					allowedTCPPorts = [ 80 registryPort ];
-				};
-				useHostResolvConf = lib.mkForce false;
-			};
-
-			greg.proxies."192.168.200.2".target = "http://unix:/run/gitlab/gitlab-workhorse.socket";
-
-			services = {
-				resolved.enable = true;
-				gitlab = {
-					enable = true;
-					backup = {
-						keepTime = 288;
-						startAt = [ "03:00" ];
-					};
-					host = "isaiah.thehellings.lan";  # Just for now...
-					https = false;
-					initialRootEmail = "greg@thehellings.com";
-					initialRootPasswordFile = pkgs.writeText "initialRootPassword" "root_password";
-					pages = {
-						enable = true;
-						settings.pages-domain = "pages.thehellings.com";
-					};
-					puma = {
-						threadsMax = 6;
-						threadsMin = 2;
-						workers = 6;
-					};
-					redisUrl = "unix:${config.services.redis.servers.gitlab.unixSocket}";
-					registry = {
-						enable = true;
-						certFile = config.age.secrets.gitlab-cert.path;
-						keyFile = config.age.secrets.gitlab-key.path;
-						externalPort = registryPort;
-					};
-					secrets = {
-						secretFile = config.age.secrets.gitlab-secret.path;
-						otpFile    = config.age.secrets.gitlab-otp.path;
-						dbFile     = config.age.secrets.gitlab-db.path;
-						jwsFile    = config.age.secrets.gitlab-jws.path;
-					};
-				};
-
-				postgresql = {
-					enable = true;
-					checkConfig = true;
-					ensureDatabases = [ "gitlab" ];
-					ensureUsers = [ {
-						name = "gitlab";
-						ensureDBOwnership = true;
-					} ];
-					settings = {
-						log_connections = true;
-						log_statement = "all";
-						logging_collector = true;
-						log_filename = "postgresql.log";
-					};
-				};
-
-				redis.servers.gitlab = {
-					enable = true;
-				};
-			};
-			system.stateVersion = "24.05";
 		};
+		extraFlags = [
+			"--property=DeviceAllow=/dev/kvm"
+		];
+		hostAddress = "192.168.201.1";
+		localAddress = "192.168.201.2";
+		config = ((import ./container-runner-qemu.nix) inputs);
+	};
+
+	systemd.services."container@gitlab-runner-vbox".serviceConfig = {
+		DevicePolicy = lib.mkForce "auto";
+		ExecPostStop = [
+			"rmmod vboxnetadp vboxnetflt vboxdrv"
+		];
+		ExecPreStart = [
+			"modprobe vboxdrv vboxnetadp vboxnetflt"
+		];
+	};
+	systemd.services."container@gitlab-runner-vbox".conflicts = [ "container@gitlab-runner-qemu.service" ];
+
+	containers.gitlab-runner-vbox = container {
+		bindMounts = {
+			"/dev/vboxdrv" = {
+				hostPath = "/dev/vboxdrv";
+				isReadOnly = false;
+			};
+			"/dev/vboxdrvu" = {
+				hostPath = "/dev/vboxdrvu";
+				isReadOnly = false;
+			};
+			"/dev/vboxnetctl" = {
+				hostPath = "/dev/vboxnetctl";
+				isReadOnly = false;
+			};
+		};
+		hostAddress = "192.168.202.1";
+		localAddress = "192.168.202.2";
+		config = ((import ./container-runner-vbox.nix) {
+			inherit inputs;
+			name = "vbox";
+			extra = {
+				virtualisation.virtualbox.host = {
+					enable = true;
+					enableExtensionPack = true;
+					enableHardening = false;
+					headless = true;
+				};
+			};
+		});
 	};
 }

modules-linux/default.nix

@@ -30,7 +30,7 @@
 	networking = {
 		search = [
 			"thehellings.lan"
-			"shire-zebra.ts.net"
+			"home"
 		];
 		networkmanager.enable = true;
 	};

secrets/gitlab/myself-qemu-runner-reg-1.age

@@ -0,0 +1,21 @@
+age-encryption.org/v1
+-> ssh-ed25519 mOmPfg yedBTcoEi6XUymLmQdhQfMwPz6ZMhsMEfOgZCUZ/OiE
+UFU8QhdzixX/f6nAypvKHdkQ9tdGdHP+PsVUphOJODo
+-> ssh-ed25519 YJiRbw nHmyayy1IKwaQ9wkWIa92TeW/MHJoFyqzOnphmsUWHg
+cEMhQ/owjFoReZm+SJ2u4iUrocSBNkZxn8Bu8JiU5LY
+-> ssh-ed25519 aY2AXA nu7sv2QwvlbtRCYv84hIwCf9GY6TIHq2psDBATisjUI
+sm6+2g+fcmiACyxSnVxGnqaBDCSInGGevnC9Nwd/1rU
+-> ssh-ed25519 Nl/5yA 5xIPsvRdo7qHHIH+zNLk6RwgKmjD7s8HigfHrvMD+WQ
+tDqT7o6cenlB+Pkc6q5SnHHwvd4qWSm7V1LzvObDKrY
+-> ssh-ed25519 GdLgCQ qG1wePre+Vn3nDQtIX+Q4LQ46Xntt/1Xq5yk7iMWwBc
+rrIqq70J/8drLZ2V2R8KtAjdnLlMmFEbF1BcAxXkMpA
+-> ssh-ed25519 tOH/HQ 8diwiaQwh8w+6U9hiNnOzgbUogeuH9CG6obxIeZQa1k
+EfT5VDbmRVrITEDE9YPnvSg4W8cKk/Db3jD9XrxF9nw
+-> ssh-ed25519 FpzvfQ xPe0pDhsxlA9NPZN6Ss24dQgWQowpkexwfxyZSbBjEI
+JZxyu3y+bjf5mwwOSZZmDwnQUJ6Ql9hFHjWln/x/iew
+-> ssh-ed25519 kdPvzQ Uzftnj2exQJMgjkoO9I6DZYjCXYUtPZqwf3023rmAWQ
+8fWu2mZbPoJlLhKJN7Ns9RhKXHGuOy6RQFHISZn4Pcg
+-> ZOzxv-grease 1>wp U@ D2
+BaR+f/XM20cT+Ybw35peBoaM
+--- zeE8ObGuQdkRECFv6jGTom/xGVE0h1AQJJlGECUGcKw
+¾ª,©Îs␍dV™"¦èYæ)<©¢8Ø@z�Ì×\&ÕÔW	d ¹ríæ+±r‡;Îð_:yôì…±%÷z*þG'ó©Øw{Z½Wäï`6'
.ŠM¼tŒ¶”óöat7öíäK¢�¶%ºåÕÓµv^žÖÁJ

secrets/gitlab/myself-qemu-runner-reg-2.age

@@ -0,0 +1,23 @@
+age-encryption.org/v1
+-> ssh-ed25519 mOmPfg QRKinSglUT5mjchw4/mDO91hAUm8oEXGrUkrQTjcPic
+/NB/ucCSX6dNmHYLO4HMxucilwt7hxTHeUIKDc8kuh0
+-> ssh-ed25519 YJiRbw yE7YWVJ3jgW7sPlygMTezfkeS6TAjRdGxdV53K5JOVY
+QdwrGrM0oUyIN2KXFFTmw+wcbLASirz54wLtrsyTf38
+-> ssh-ed25519 aY2AXA kY842plwuQkpLhVF/NSF0fgibmy4fDKT29BI8QPSuFY
+52hfgDE3BE5BlMeoXEL7DbFpKx8WiGHFj+g1GCNHo/o
+-> ssh-ed25519 Nl/5yA aXblBrmFnTOYlaDt5ULrxBSudS1lkc5Y4GRBDzYEwE0
+sh+dbHuQ/GPViOEu/iwrQVmwMEFZt2U4cd8fqtBhips
+-> ssh-ed25519 GdLgCQ qOepkvfW8tb5zx8mx0ZEfHlsTQqbAVuSNzltRtFXyBI
+T4dHO/iGupNu7QpJB88AyfWGUiy18lUlBjEMEE1TBNc
+-> ssh-ed25519 tOH/HQ 58lz7Qw3cMgSQuSbRfLwvv+RLtqyZCmKiSQuStmVCDg
+lZ4PpHldp9Kmh9u+JuUuHp5CtBEQ0s8qcrhJY+qL1ro
+-> ssh-ed25519 FpzvfQ pIu/O2EfGHOdIIv9C5RudJe0wE0tF2a2zN+uBFwqpWg
+FwU79gBV4WXtPK3XO/EEcMagF5MX66qIZekgdh6VxIg
+-> ssh-ed25519 kdPvzQ WgoFNx6cxQ3OaneO3s9wjAJhU8r232rsEmSekU1GXAk
+LagJMqiT6t21PfgXaz1c9Vb3Us2mxB+rUByBUhD5SyM
+-> XWz-grease ~X,$Oko
+qcqccJwfeg
+--- Q+UD1YpBDrJ3Ltv283DDrr3AY/MN46qqU/DHb3EcMj0
+æïå¬
+o”½8¥éÏêú缹lOX"aÐq"¬ýE(…†æ_´•fÉ—ÙÎ,t±¦º4¸pN°J½Y¨X{ì‚oÙ�^º„Á
œM½
+œ¾çýªÐ†þ‚±wÉâýs 8¯5—yý‡ÜÙ�›éò¸l£¼

secrets/gitlab/myself-qemu-runner-reg-5.age

@@ -0,0 +1,21 @@
+age-encryption.org/v1
+-> ssh-ed25519 mOmPfg w03rWuYjifXp2/Kdv39PU6Fx8ttD+BcPMVZkJdfRWEE
+iXmxJd9pW1Xc8XtvMF6wOtyjvPzGeDiaKuF28W0+MiM
+-> ssh-ed25519 YJiRbw YDx0gI3Gk5YBLImABvTh+Vl8WVURbPjdZbme0zNmkXI
+OMty1bEO4Mlr01GSwZ9Ig3DBylsObUcck67B6kE7zEk
+-> ssh-ed25519 aY2AXA 57Mvd6nFNFw7Sh8JOm4kuaetSNatG8f6J+ExIsHp03s
+pCqA6SmOWvPaP/ydWz24ZeFqP+Z11hm94F1Bey4s+uk
+-> ssh-ed25519 Nl/5yA TwMhEFDBL9Y8jSgF6F2SE+QunjaVWGm+LCdEuLEl/j0
+oinaKzMAlTejndkZUjCMnIgS7FLxWOfO/w24TCS3IrA
+-> ssh-ed25519 GdLgCQ aMAkHj3LfAobDICK4OMaAeyYFMLt1Evx5WmVl1bBMHg
+/cVfO29x1jTdyeSpauhKNzt1C9+T4z1kIujIPORtn/c
+-> ssh-ed25519 tOH/HQ daRvGZwMGnFRFKAxHcOR3Pgb2E+h8y7cQK5G+vDXVls
+olWk4ahhkH/dNPyUhxI8iWTlNca6hpxVZqkbvJCU9mQ
+-> ssh-ed25519 FpzvfQ zcUzSRK67CLrn6KBe2AHIb0hop3smip4y2+2rC3yznU
+ea3y+ZhzzT7Kk37g84G6Lm5Hmo+7l8wxuwmnatIM5xo
+-> ssh-ed25519 kdPvzQ f7bGPzHX2pxUSxMI78M15deiV3rXN+v3p2E52v6JiS4
+UETYJIs0xo4UakXgqjf+gthl6L2VuTBeQTRyv7/C3k0
+-> I-grease nF)
+EyWKPe3DezYJKTUV/fFxjTZ0MEVYnEWmuSH7bGzqqEBLfoI
+--- manrceW5TDDoWUUWloP3bIGIkk1jXY4YA8vI82W8P04
+Æ�£PüdÙ•ÔÞµÃ%1|'åîZšÑþÒK¯'¥[½@—yF¯?¼Ó'®¬…iÚé¿ï{Á»‚Ð!Áf>êbðÛt~‘z¦à q$“Š$Œ£µ]HçBÛÍçRLµÚ#ôóé‚äËr€¦¨+„@\àóð

secrets/gitlab/myself-vbox-runner-reg.age

@@ -0,0 +1,22 @@
+age-encryption.org/v1
+-> ssh-ed25519 mOmPfg 1+SrnSmUVltI+CShLbsLlXukVf3L/W4Zewwu6kYS020
+AYynTBanXxis2sadfTbCEfbK071mbYAp52H0GgdswO0
+-> ssh-ed25519 YJiRbw ++Rpjl9AUg1iiKueeoPwceiuAUsmhEzHNKj6zAwrQFo
+oKRmh0LZS8XOGsQ55BvIvLFvybWkTuOj8ZN+f4FcqN8
+-> ssh-ed25519 aY2AXA IUkslHupkzLK2oXpcj17LfzsCdJ5RaIt2V13OKQEnzw
+VLHEbGXmIPiJa49/oS1FCzpIQWjlG2XJ3SnVRyPcdZg
+-> ssh-ed25519 Nl/5yA HWZHuESxYQIX0Ol1Cd0SQGHsAlBSCcvt6zyKtyROIy0
+kNDdxcZ+MA+CDk2fU1wLu0iCL/6528gVIGy3EyrgX7Y
+-> ssh-ed25519 GdLgCQ ZQgnEBjjWXo9CKvA8VayduzEqzhu2LL5OzKbF6R8PmE
+6BMycP8rCP9xb2tLscpiC7o0ORXju3EVPhge6O8o7QU
+-> ssh-ed25519 tOH/HQ Pw0XAGp2pCJEGH8KqjBbPFZqecUaOBJTBWc7Vbbe4T0
+IOsaS11c6MF0uAJAAkeE4vn63mLCaqlOG8/2G2XtAsk
+-> ssh-ed25519 FpzvfQ nG48AJt+9ArEPeFSfhbem4H8Oxd7d7oOMNm15oosF20
+IslIFcLR9d4wfGgdOhzHd8O2Vpc+WTW4h1YNnPy1oyI
+-> ssh-ed25519 kdPvzQ 7CUogLrCwPqHowodCayIUKVebjrTP5/NNoJXFCEegXo
+ep+5sIDKuoxY50DlWUMS2MgKUwoG8PjgHaTeBKmd87o
+-> x+-grease 1 Wd/1m/
+Fmb8Vc497/c5m3sWBtcg11fdQsK/YTDXBEg+DToWFvA8C8GMYGk2VIaCcC4IHH3y
+6onJXg9p9e6P825Tavxbdgu74ZAcsIZtvkt7
+--- +spumB58VEThrLeLalw56bfovG0jxH+AZhRwyM7O8lQ
+„«ëH­“ÖdJÌDhˆòLxÄ1¾…H¯æDÄxê·Ÿ#òy!uüßëA'[¨§óCºx¨SÖ7Ý]îÖë‹à"‚â<˜\]{2ÛêIôHew␍;ƒ67®!¯tUúlÞb)r²Ô�Ž×ö`
e±Æ�{7az‹

secrets/secrets.nix

@@ -49,4 +49,10 @@ in
 	# Then pipe the resulting files to agenix -e <foo>
 	"gitlab/key.age".publicKeys = everyone;
 	"gitlab/cert.age".publicKeys = everyone;
+	"gitlab/myself-qemu-runner-reg-1.age".publicKeys = everyone;
+	"gitlab/myself-qemu-runner-reg-2.age".publicKeys = everyone;
+	"gitlab/myself-qemu-runner-reg-3.age".publicKeys = everyone;
+	"gitlab/myself-qemu-runner-reg-4.age".publicKeys = everyone;
+	"gitlab/myself-qemu-runner-reg-5.age".publicKeys = everyone;
+	"gitlab/myself-vbox-runner-reg.age".publicKeys = everyone;
 }