chore: update flake.lock 2026-08-09

Reviewed-on: #32

flake.lock

@@ -31,11 +31,11 @@
         "treefmt-nix": "treefmt-nix"
       },
       "locked": {
-        "lastModified": 1783833875,
+        "lastModified": 1785648274,
-        "narHash": "sha256-G+hRtNJ/Nnr6VFMQp2UZdx/ckJDR/RJoK0Fy/yx1/YY=",
+        "narHash": "sha256-25piX3cCXleOWo3L1TVc+/tNVDSDGctGTREcMKzp0KA=",
         "owner": "nix-community",
         "repo": "buildbot-nix",
-        "rev": "147af587241e2af85399402da60a4f44fdb1e5d7",
+        "rev": "9a8ea9a47dfccbdf08d5a9cad7b99e6212d4027a",
         "type": "github"
       },
       "original": {
@@ -53,11 +53,11 @@
         "stable": "stable"
       },
       "locked": {
-        "lastModified": 1783909498,
+        "lastModified": 1785930890,
-        "narHash": "sha256-T9OfLPLuh1Bf1xojlpWXwooJ6IXapxvb8GM0p3YNy8g=",
+        "narHash": "sha256-QN4Oy1B4Vma9DiMyXiyssrpgMuIPgkNyO8jb6k2H4oY=",
         "owner": "zhaofengli",
         "repo": "colmena",
-        "rev": "76ba0daa542880b730faec81f4e87efcaa63bc57",
+        "rev": "a156fd9146e69a577fe6f5542a7c6ed83a6888ce",
         "type": "github"
       },
       "original": {
@@ -95,11 +95,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1784362797,
+        "lastModified": 1785389976,
-        "narHash": "sha256-EP9b9b+OXDxHBPefFwMYCIaLq0fn3UkmrbfzbLUT7kQ=",
+        "narHash": "sha256-0tLW8Ff5yt8AH97jw4ZpFJ0OCJ122zIlgWGDmOfU/VU=",
         "owner": "lnl7",
         "repo": "nix-darwin",
-        "rev": "b4cccbd4bc299c1f71ae185b79c3cf99aa82805c",
+        "rev": "15abb8c98f336cd8bd840d71059adebabe60bf04",
         "type": "github"
       },
       "original": {
@@ -162,11 +162,11 @@
         "nixpkgs-lib": "nixpkgs-lib"
       },
       "locked": {
-        "lastModified": 1782949081,
+        "lastModified": 1785627969,
-        "narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=",
+        "narHash": "sha256-4dtXQk/NMePegK/nWp5NSeuZKLATItOq61lpEvmXqGw=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e",
+        "rev": "427bf4bd9435fdf21321c8cc628c24efc14c0f7a",
         "type": "github"
       },
       "original": {
@@ -242,11 +242,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1784407317,
+        "lastModified": 1786031233,
-        "narHash": "sha256-iZrxHToDJWnvt+5LGAtvuQMTy1NZYlNEKbKaVtBJNcc=",
+        "narHash": "sha256-TIDlLTLI1/pB7IqgjzcKQjpODQsZE2oII4XGG9B6KjI=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "39411a8e12a5526d992e65bc7e3dc9a4414d6713",
+        "rev": "7834e82588860aaf780cec1366524456a70898d7",
         "type": "github"
       },
       "original": {
@@ -284,11 +284,11 @@
         "systems": "systems_3"
       },
       "locked": {
-        "lastModified": 1784344393,
+        "lastModified": 1786154692,
-        "narHash": "sha256-yAo2ZzSIdeBZg7cOKUpQxwflL+DRYN+1DMObZk2lP2Q=",
+        "narHash": "sha256-+KyMg7tMfMcfFjUg59BD3OMUzehv9xsNK7ZMY3ZepGc=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "7297d14c52ec8ef39c6aeff2c1818541fd030473",
+        "rev": "fad712d66c18a08c582214c3f52c3d12e0cc16f9",
         "type": "github"
       },
       "original": {
@@ -303,11 +303,11 @@
         "treefmt-nix": "treefmt-nix_2"
       },
       "locked": {
-        "lastModified": 1784016977,
+        "lastModified": 1786014695,
-        "narHash": "sha256-TydDba3YD2u15uS0L+PDs7lMqPopnzWggljTKDqOCSw=",
+        "narHash": "sha256-to1UGPixvqyQwl1UC05/e+o3MYiIJ1DZ6m48xovDsq0=",
         "owner": "Mic92",
         "repo": "niks3",
-        "rev": "b306808bf381e7e66e33de1e9446a1be0935f4e3",
+        "rev": "76cb73a99911bef6a395cf331c36e6f4e620c6a9",
         "type": "github"
       },
       "original": {
@@ -342,11 +342,11 @@
         "nixpkgs": "nixpkgs_4"
       },
       "locked": {
-        "lastModified": 1784310968,
+        "lastModified": 1785232496,
-        "narHash": "sha256-rkSPTePrKqs4dg+i7ZFCq93+HrClac6oSwXX927SVjA=",
+        "narHash": "sha256-65EQYIRRpTdpH8lUiB6Mvo5uBkG60aBIzAJuALfx+O0=",
         "owner": "nixos",
         "repo": "nixos-hardware",
-        "rev": "779c32a00155994c86cde8213a8dd4df139d4355",
+        "rev": "2e790b0a6be8ec2b76174ac0931b8ff11919ec98",
         "type": "github"
       },
       "original": {
@@ -373,11 +373,11 @@
     },
     "nixpkgs-lib": {
       "locked": {
-        "lastModified": 1782614948,
+        "lastModified": 1785031560,
-        "narHash": "sha256-ePjCwr1sNm9NYUqywL7QfK3JnlS015msC+eBu2zKlp8=",
+        "narHash": "sha256-OmshNvn2vupOFpYinLUu+1Dnpu4n7Q5N3ggGVNHpkUI=",
         "owner": "nix-community",
         "repo": "nixpkgs.lib",
-        "rev": "db3f255737b94216eb71cce308e2912cf6bc2d7c",
+        "rev": "0e79af5e3d4dcfcd676ab5ba3f95d2e3352e078c",
         "type": "github"
       },
       "original": {
@@ -388,11 +388,11 @@
     },
     "nixpkgs-lib_2": {
       "locked": {
-        "lastModified": 1783821755,
+        "lastModified": 1785636265,
-        "narHash": "sha256-eMPX9S6MKPyUnaOgeRfrG7OKUiAlc1AlcRinMbSB0WA=",
+        "narHash": "sha256-trTbhoc8hhPiGVDpNGGYA4scDV/4d01iNH/cFemblEg=",
         "owner": "nix-community",
         "repo": "nixpkgs.lib",
-        "rev": "228ab8523d81526e57a6ca342e1a919fb6d246a8",
+        "rev": "77a147ce329a5800bc001a45b356fad3397ee184",
         "type": "github"
       },
       "original": {
@@ -419,11 +419,11 @@
     },
     "nixpkgs_3": {
       "locked": {
-        "lastModified": 1783978241,
+        "lastModified": 1785708545,
-        "narHash": "sha256-7kK0Y/fIV2NTKArkd/eZGaFg+dEmgP8KDRsGK2vB5M4=",
+        "narHash": "sha256-Kx+ica895RPt90eYPC99xe54mKse9FmfbIVZV1rE+9E=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "a8b81d3cc8d35af7bc98694696bea61ad4f8fca7",
+        "rev": "ccdb97fdbee71215dbcff68dcab5ea9991020651",
         "type": "github"
       },
       "original": {
@@ -448,11 +448,11 @@
     },
     "nixpkgs_5": {
       "locked": {
-        "lastModified": 1783915482,
+        "lastModified": 1784555310,
-        "narHash": "sha256-FmieJB8/OUvNxbkboi7+IGfIuSXY3nF/hZQm8kD0r50=",
+        "narHash": "sha256-/FCliTPgiuV1owejZFNx3Ch9irdvkOfOFl+HHZ+DrtM=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "6cdc7fc76e8bf7fde9fa43a849fcaaa70e230dee",
+        "rev": "421eebfd0ec7bccd4abe826ce62d7e6e83129493",
         "type": "github"
       },
       "original": {
@@ -464,11 +464,11 @@
     },
     "nixpkgs_6": {
       "locked": {
-        "lastModified": 1784356753,
+        "lastModified": 1786106723,
-        "narHash": "sha256-12KrbMiWLcf8m7pCvAtZh1ZrgF85ZXDXvfR/fWTKy84=",
+        "narHash": "sha256-zDSUbpoeo/9ZmD2+wXnzxoo1+uhL8vxc0b8yuYMKYq0=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "61b7c44c4073f0b827768aff0049561b5110ea5a",
+        "rev": "f13ff45afd1bb73e640eaa08a7066dbed07e3238",
         "type": "github"
       },
       "original": {
@@ -480,27 +480,27 @@
     },
     "nixpkgs_7": {
       "locked": {
-        "lastModified": 1777207419,
+        "lastModified": 1784564315,
-        "narHash": "sha256-V3bmPWAajDiC+1ClDOp55gianW2EyRJSJOyu1RUQibc=",
+        "narHash": "sha256-7OpsHHIZFUBLbeHNQ0oC40DZRQjsmGWodXge+OqgPgk=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "a7ecea3deccfbdbf22945a89984fcc5a169da8aa",
+        "rev": "0c2094806c9e542f31785ef3569ab9e900e3ce9c",
         "type": "github"
       },
       "original": {
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "a7ecea3deccfbdbf22945a89984fcc5a169da8aa",
+        "rev": "0c2094806c9e542f31785ef3569ab9e900e3ce9c",
         "type": "github"
       }
     },
     "nixunstable": {
       "locked": {
-        "lastModified": 1784700541,
+        "lastModified": 1785349197,
         "narHash": "sha256-LcCdjhqwjFVrFTNW6tHm3KNYRrD1TA6bYRea30yIIjw=",
         "owner": "geri1701",
         "repo": "nixpkgs",
-        "rev": "3c598184d1f70c5d0beeea8b95d01ab0179e4ef7",
+        "rev": "af4902d1e79cbeade8e0d9e10e7a9ada4dce01b5",
         "type": "github"
       },
       "original": {
@@ -517,11 +517,11 @@
         "systems": "systems_4"
       },
       "locked": {
-        "lastModified": 1784057377,
+        "lastModified": 1785763201,
-        "narHash": "sha256-yycNej5//EsRbV10moBoh+/63vXEwZD1ZFEiRm6C9rQ=",
+        "narHash": "sha256-wA373y/B9orM3HatLu9oS+Ke5lmdZyBl/bdjd2gLMq4=",
         "owner": "nix-community",
         "repo": "nixvim",
-        "rev": "07180a087e4a00720dc0731cbcd8dec796974381",
+        "rev": "c7be49306b23a952c0151cf4bbeacd944ed82f2a",
         "type": "github"
       },
       "original": {
@@ -537,11 +537,11 @@
         "nixpkgs": "nixpkgs_6"
       },
       "locked": {
-        "lastModified": 1784417922,
+        "lastModified": 1786233186,
-        "narHash": "sha256-19XZ56wJXArMKxjY25pKXkNp/FrYHGoo+HuQtW6teSM=",
+        "narHash": "sha256-sqDu3uQvU1LimxIZ907iFGqwVEBBZIB5ZSgGlb7zKqY=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "2c806d314605495dd7fd75b5950003a062e2b47a",
+        "rev": "317f059fb7463680165802d82ddad2126fabf8d3",
         "type": "github"
       },
       "original": {
@@ -654,11 +654,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1780220602,
+        "lastModified": 1785360170,
-        "narHash": "sha256-eynAfOmbmxJnkp7YewvCEbShNnnYJ9gLLqkzsYtBPeM=",
+        "narHash": "sha256-XE1lKgQ3eIO3E7zWryqcRsax+mYXod/5RHBn4YaR9YE=",
         "owner": "numtide",
         "repo": "treefmt-nix",
-        "rev": "db947814a175b7ca6ded66e21383d938df01c227",
+        "rev": "d1187f8bc71fb8aab02395869ec3f5c1920f75c0",
         "type": "github"
       },
       "original": {
@@ -675,11 +675,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1780220602,
+        "lastModified": 1785360170,
-        "narHash": "sha256-eynAfOmbmxJnkp7YewvCEbShNnnYJ9gLLqkzsYtBPeM=",
+        "narHash": "sha256-XE1lKgQ3eIO3E7zWryqcRsax+mYXod/5RHBn4YaR9YE=",
         "owner": "numtide",
         "repo": "treefmt-nix",
-        "rev": "db947814a175b7ca6ded66e21383d938df01c227",
+        "rev": "d1187f8bc71fb8aab02395869ec3f5c1920f75c0",
         "type": "github"
       },
       "original": {
@@ -693,11 +693,11 @@
         "nixpkgs": "nixpkgs_7"
       },
       "locked": {
-        "lastModified": 1784343266,
+        "lastModified": 1786154646,
-        "narHash": "sha256-EGkegdTz2n6ESyih8s3dUuPyJQWlYfPp7U41J05g8PY=",
+        "narHash": "sha256-MDOvpk7B1eImC2TQbz4KoqKtYnnXOznGHx+2KaTLJBE=",
         "owner": "nix-community",
         "repo": "nix-vscode-extensions",
-        "rev": "472a3e862c76c64ac3ad75a24d332cb5cdd5f1bb",
+        "rev": "7c0ca0a27c2e7338e2c7d61599c0de4873081d7c",
         "type": "github"
       },
       "original": {
@@ -714,11 +714,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1784058842,
+        "lastModified": 1784642409,
-        "narHash": "sha256-3u3tvbCIAid3Mv7RrJx13jusIEQC/HeKYhO/SUSxR3A=",
+        "narHash": "sha256-hcbDqFuySAJawljt5r0sKBCJKYnbtGD0T/ZIozH1Dq0=",
         "owner": "nix-community",
         "repo": "NixOS-WSL",
-        "rev": "24c8dc8e0f2170e1a377be24dfadc7d9d21dc1ad",
+        "rev": "eaeb18da90024448a60eb1ec7132eafa4003404e",
         "type": "github"
       },
       "original": {

flake.nix

@@ -101,7 +101,7 @@
                 {
                   deployment = {
                     inherit (v) tags;
-                    targetHost = if (v ? "nebulaIp") then v.nebulaIp else v.ts;
+                    targetHost = if (v ? "connectAddr") then v.connectAddr else v.nebulaIp;
                     targetUser = "greg";
                   };
                 }

hosts/unstable/builder2/default.nix

@@ -1,60 +0,0 @@
-{
-  config,
-  metadata,
-  modulesPath,
-  ...
-}:
-{
-  # Then build nixosConfiguration.<host>.config.system.build.images.proxmox
-  # SCP that to /var/lib/vz/dumps on the Proxmox host
-  imports = [ "${modulesPath}/virtualisation/proxmox-image.nix" ];
-  greg = {
-    home = true;
-    nebula.enable = true;
-  };
-  networking = {
-    defaultGateway = metadata.infra.gw;
-    nameservers = [ metadata.infra.dns ];
-    interfaces.ens18 = {
-      useDHCP = false;
-      ipv4.addresses = [
-        {
-          address = metadata.hosts."${config.networking.hostName}".ip;
-          prefixLength = 16;
-        }
-      ];
-    };
-  };
-  virtualisation.diskSize = 20480; # Size in mebbibytes for the base disk image
-  # Use these instead of the above to run an LXC image
-  # The main reason I wouldn't use these is because Proxmox LXC does
-  # not seem to be well supported by either Nebula VPN or Tailscale,
-  # both of which I use for my mesh networking. If there isn't a need
-  # for the service to run on those networks, then by all means go ahead
-  # and use LXC!
-  # imports = [ (modulesPath + "/virtualisation/proxmox-lxc.nix") ];
-  # proxmoxLXC = {
-  #   manageNetwork = false;
-  #   privileged = true;
-  # };
-  # systemd.suppressedSystemUnits = [
-  #   "dev-mqueue.mount"
-  #   "sys-kernel-debug.mount"
-  #   "sys-fs-fuse-connections.mount"
-  # ];
-  nix.settings = {
-    sandbox = false;
-  };
-  services = {
-    fstrim.enable = false; # Let Proxmox host handle fstrim
-    openssh = {
-      enable = true;
-      openFirewall = true;
-      settings = {
-        PermitRootLogin = "yes";
-        PasswordAuthentication = true;
-        PermitEmptyPasswords = "yes";
-      };
-    };
-  };
-}

hosts/unstable/genesis/net/hosts

@@ -1,12 +1,11 @@
 # Local hosts
 10.42.0.1 switch switch.thehellings.lan  # Core switch for the network
 10.42.0.3 ap ap.thehellings.lan  # OpenWRT access point (static IP)
-10.42.0.4 joel.thehellings.lan  # Proxmox
+10.42.0.4 pve1.thehellings.lan  # Proxmox
 10.42.0.5 sanswitch.thehellings.lan  # Core switch for the SAN
 
 # Home servers
-10.42.1.1 pve1.thehellings.lan
+10.42.1.1 udm router udm.thehellings.lan router.thehellings.lan  # Ubiquiti UDM gateway
-10.42.1.2 opnsense router opnsense.thehellings.lan router.thehellings.lan
 10.42.1.3 printer.thehellings.lan
 10.42.1.4 chronicles chronicles.thehellings.lan nas.thehellings.lan s3.thehellings.lan
 10.42.1.5 genesis genesis.thehellings.lan dns dns.thehellings.lan smart smart.thehellings.lan speedtest.thehellings.lan nixcache.thehellings.lan gitcache.thehellings.lan

hosts/unstable/genesis/networking.nix

@@ -77,7 +77,7 @@ in
       };
     };
     firewall = {
-      enable = false;
+      enable = true;
       allowedUDPPorts = [
         dhcpPort
         dnsPort
@@ -88,7 +88,7 @@ in
         80
       ];
     };
-    nftables.enable = false;
+    nftables.enable = true;
   };
 
   environment.etc."hosts.d/local".text = extraHosts;

hosts/unstable/genesis/networking/dhcp.nix

@@ -60,7 +60,7 @@
         reservations = [
           # Static IPs for personal work
           {
-            hw-address = "00:23:24:72:64:32"; # Joel
+            hw-address = "00:23:24:72:64:32"; # PVE1
             ip-address = "10.42.0.4";
           }
           {
@@ -76,10 +76,6 @@
             #ip-address = "10.42.2.253";
             ip-address = "10.42.100.6";
           }
-          {
-            hw-address = "7c:83:34:b9:ee:ec"; # PVE1
-            ip-address = "10.42.1.1";
-          }
           {
             hw-address = "74:ee:2a:66:b3:51"; # printer
             ip-address = "10.42.1.3";

hosts/unstable/isaiah/default.nix

@@ -47,6 +47,10 @@
       enable = true;
       extraLabels = [ "bare-metal:host" ];
     };
+    vmdev = {
+      enable = true;
+      host = "libvirt";
+    };
   };
 
   networking = {

hosts/unstable/linode/default.nix

@@ -1,8 +1,9 @@
 {
+  config,
+  lib,
+  metadata,
   pkgs,
   pkgs',
-  lib,
-  config,
   ...
 }:
 
@@ -10,6 +11,21 @@ let
   homepage = "127.0.0.1:30080";
   nextcloudPort = 8080;
   sshPort = 2222;
+  matrixServer = pkgs.writeText "matrix_server" (
+    builtins.toJSON {
+      "m.server" = "matrix.thehellings.com:443";
+    }
+  );
+  matrixClient = pkgs.writeText "matrix_client" (
+    builtins.toJSON {
+      "m.homeserver" = {
+        base_url = "https://matrix.thehellings.com";
+      };
+      "m.identity_server" = {
+        base_url = "https://vector.im";
+      };
+    }
+  );
 in
 {
   imports = [
@@ -60,9 +76,10 @@ in
     };
     gitea-runner = {
       enable = true;
-      extraLabels = [
+      labels = [
         "vps:host"
         "blog:host"
+        "nixos-linode:host"
       ];
     };
     home = false;
@@ -70,6 +87,12 @@ in
     nebula = {
       enable = true;
       isLighthouse = true;
+      unsafeRoutes = [
+        {
+          route = "10.42.0.0/16";
+          via = metadata.hosts.genesis.nebulaIp;
+        }
+      ];
     };
     tailscale.enable = true;
   };
@@ -126,7 +149,7 @@ in
             COOKIE_DOMAIN = "thehellings.com";
             SERVE_ROBOTS_TXT = true;
             SLOG_LEVEL = "DEBUG";
-            TARGET = "http://git.k3s.nebula.thehellings.com";
+            TARGET = "http://git.k3s.thehellings.lan";
           };
         };
       };
@@ -149,9 +172,9 @@ in
           bind *:${toString sshPort}
           timeout client 1h
           mode tcp
-          server git-isaiah isaiah.nebula.thehellings.com:32222
+          server git-isaiah isaiah.thehellings.lan:32222
-          server git-jeremiah jeremiah.nebula.thehellings.com:32222
+          server git-jeremiah jeremiah.thehellings.lan:32222
-          server git-zeke zeke.nebula.thehellings.com:32222
+          server git-zeke zeke.thehellings.lan:32222
 
         frontend https
           bind *:80
@@ -175,6 +198,8 @@ in
           use_backend next if { req_ssl_sni -i next.thehellings.com }
           use_backend matrix if { hdr(host) -i matrix.thehellings.com }
           use_backend matrix if { req_ssl_sni -i matrix.thehellings.com }
+          use_backend immich if { hdr(host) -i immich.thehellings.com }
+          use_backend immich if { req_ssl_sni -i immich.thehellings.com }
           use_backend web if { hdr(host) -i thehellings.com }
           use_backend web if { req_ssl_sni -i thehellings.com }
 
@@ -184,10 +209,18 @@ in
           option accept-unsafe-violations-in-http-response
           retries 3
           option forwardfor
-          http-request set-header Host git.k3s.nebula.thehellings.com
+          http-request set-header Host git.k3s.thehellings.lan
-          server git-isaiah isaiah.nebula.thehellings.com:80
+          server git-isaiah isaiah.thehellings.lan:80
-          server git-jeremiah jeremiah.nebula.thehellings.com:80
+          server git-jeremiah jeremiah.thehellings.lan:80
-          server git-zeke zeke.nebula.thehellings.com:80
+          server git-zeke zeke.thehellings.lan:80
+
+        backend immich
+          mode http
+          balance roundrobin
+          option accept-unsafe-violations-in-http-response
+          retries 3
+          option forwardfor
+          server immich-proxy 127.0.0.1:${builtins.toString config.services.immich-public-proxy.port}
 
         backend matrix
           mode http
@@ -195,10 +228,10 @@ in
           option accept-unsafe-violations-in-http-response
           retries 3
           option forwardfor
-          http-request set-header Host matrix.k3s.nebula.thehellings.com
+          http-request set-header Host matrix.k3s.thehellings.lan
-          server git-isaiah isaiah.nebula.thehellings.com:80
+          server git-isaiah isaiah.thehellings.lan:80
-          server git-jeremiah jeremiah.nebula.thehellings.com:80
+          server git-jeremiah jeremiah.thehellings.lan:80
-          server git-zeke zeke.nebula.thehellings.com:80
+          server git-zeke zeke.thehellings.lan:80
 
         backend web
           mode http
@@ -206,6 +239,8 @@ in
           option accept-unsafe-violations-in-http-response
           retries 3
           option forwardfor
+          http-request return status 200 content-type "application/json" file ${matrixClient} hdr "cache-control" "no-cache" if { path /.well-known/matrix/client }
+          http-request return status 200 content-type "application/json" file ${matrixServer} hdr "cache-control" "no-cache" if { path /.well-known/matrix/server }
           server web-container ${homepage}
 
         backend next
@@ -222,7 +257,7 @@ in
 
     immich-public-proxy = {
       enable = true;
-      immichUrl = "https://immich.shire-zebra.ts.net";
+      immichUrl = "http://immich.k3s.thehellings.lan";
     };
 
     logrotate = {
@@ -245,7 +280,7 @@ in
       enable = true;
       package = pkgs.nextcloud33;
       appstoreEnable = true;
-      hostName = "localhost";
+      hostName = "127.0.0.1";
       https = false;
       config = {
         adminpassFile = config.age.secrets.nextcloudadmin.path;

hosts/unstable/zeke/default.nix

@@ -32,6 +32,10 @@
       enable = true;
       tags = [ "home" ];
     };
+    vmdev = {
+      enable = true;
+      host = "vbox";
+    };
   };
 
   hardware = {
@@ -71,10 +75,4 @@
   users.users.greg.extraGroups = [
     "podman"
   ];
-
-  # virtualisation.virtualbox.host = {
-  #   enableExtensionPack = true;
-  #   headless = true;
-  #   enableWebService = true;
-  # };
 }

manifests/gitea/chart.yaml

@@ -67,7 +67,7 @@ spec:
           RUN_MODE: dev
         server:
           DOMAIN: "shire-zebra.ts.net"
-          ROOT_URL: "https://gitea.shire-zebra.ts.net"
+          ROOT_URL: "https://git.k3s.thehellings.lan"
           SSH_PORT: "2222"
         database:
           DB_TYPE: postgres
@@ -93,7 +93,7 @@ spec:
           MINIO_USE_SSL: "false"
           MINIO_INSECURE_SKIP_VERIFY: "true"
         security:
-          ALLOWED_HOST_LIST: loopback,private,*.shire-zebra.ts.net,*.nebula.thehellings.com
+          ALLOWED_HOST_LIST: loopback,private,*.shire-zebra.ts.net,*.nebula.thehellings.com,*.thehellings.lan
 
       metrics:
         enabled: false

manifests/gitea/ingress.yaml

@@ -19,7 +19,7 @@ metadata:
   name: gitea-direct
 spec:
   rules:
-    - host: git.k3s.nebula.thehellings.com
+    - host: git.k3s.thehellings.lan
       http:
         paths:
           - path: /

manifests/immich/ingress.yaml

@@ -24,6 +24,8 @@ spec:
                   name: http
     - <<: *host
       host: immich.k3s.nebula.thehellings.com
+    - <<: *host
+      host: immich.k3s.thehellings.lan
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress

manifests/matrix/ingress.yaml

@@ -20,7 +20,7 @@ metadata:
   name: matrix-direct
 spec:
   rules:
-    - host: matrix.k3s.nebula.thehellings.com
+    - host: matrix.k3s.thehellings.lan
       http:
         paths:
           - path: /

manifests/monitoring/config.yaml

@@ -51,8 +51,8 @@ data:
         static_configs:
           - targets:
               - "10.42.0.3"    # OpenWRT access point
-              - "10.42.0.4"    # Joel (Proxmox)
+              - "10.42.0.4"    # pve1 (Proxmox)
-              - "10.42.1.1"    # pve1 (Proxmox)
+              - "10.42.1.1"    # UDM gateway (Ubiquiti)
               - "10.42.1.4"    # chronicles (Synology NAS)
               - "10.42.1.14"   # nas1 (TrueNAS)
               - "10.42.2.57"   # odoo

modules/hm/gui/bookmarks.nix

@@ -230,7 +230,7 @@
             bookmarks = [
               {
                 name = "PVE1";
-                url = "https://10.42.1.1:8006/";
+                url = "https://10.42.0.4:8006/";
               }
               {
                 name = "Jeremiah";

modules/nixos/gitea-runner.nix

@@ -98,6 +98,19 @@ in
         inherit labels;
         inherit (cfg) name;
         enable = true;
+        hostPackages = with pkgs; [
+          bash
+          buildah
+          coreutils
+          curl
+          gawk
+          gitMinimal
+          gnused
+          nix
+          nodejs
+          podman
+          wget
+        ];
         url = cfg.instanceURL;
         tokenFile = config.age.secrets."gitea-runner-${host}-podman".path;
         settings = {

modules/nixos/kubernetes.nix

@@ -15,8 +15,6 @@ let
     sha256 = "sha256-Qs1qJmgZm8q9xZsORjT/N/wzpbWVVODXtzDpjnAYMuQ=";
   };
   keepaliveIp = "10.42.5.1";
-  nebulaName = "k3s.nebula.thehellings.com";
-  nebulaIp = "10.157.100.1";
 in
 {
   options.greg = {
@@ -46,13 +44,6 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    assertions = [
-      {
-        assertion = config.greg.nebula.enable;
-        message = "Configure Nebula for this host, first";
-      }
-    ];
-
     age.secrets = {
       bw_secret.file = ../../secrets/kubernetes/bw_secret.age;
       dendrite_key.file = ../../secrets/dendrite_key.age;
@@ -106,8 +97,6 @@ in
           "--tls-san ${config.networking.hostName}.thehellings.lan"
           "--tls-san ${config.networking.hostName}.shire-zebra.ts.net"
           "--tls-san ${keepaliveIp}"
-          "--tls-san ${nebulaName}"
-          "--tls-san ${nebulaIp}"
         ];
         manifests = {
           cert-manager.source = cert-manager;
@@ -139,21 +128,6 @@ in
               advert_int 1
             '';
           };
-          k3s-nebula = {
-            interface = "nebula0";
-            priority = 1;
-            state = if (config.networking.hostName == "isaiah") then "MASTER" else "BACKUP";
-            virtualIps = [
-              {
-                addr = "${nebulaIp}/16";
-                dev = "nebula0";
-              }
-            ];
-            virtualRouterId = 78;
-            extraConfig = ''
-              advert_int 1
-            '';
-          };
         };
       };
       openiscsi = {

modules/nixos/vmdev.nix

@@ -23,6 +23,13 @@ with lib;
         type = types.str;
         description = "Kernel module type to install - amd, intel, etc";
       };
+      host = mkOption {
+        type = types.enum [
+          "libvirt"
+          "vbox"
+        ];
+        description = "Which VM hosting type to configure";
+      };
     };
   };
 
@@ -35,7 +42,6 @@ with lib;
       nixos-generators
       packer
       swtpm
-      virt-manager
       virtio-win
       xorriso
     ];
@@ -44,7 +50,7 @@ with lib;
 
     # Enable the virtualisation services
     virtualisation = {
-      libvirtd = {
+      libvirtd = mkIf (cfg.host == "libvirt") {
         enable = true;
         onBoot = "ignore"; # Do not auto-restart VMs on boot, unless they are marked autostart
         qemu = {
@@ -54,6 +60,11 @@ with lib;
           };
         };
       };
+      virtualbox.host = mkIf (cfg.host == "vbox") {
+        enable = true;
+        enableExtensionPack = true;
+        headless = true;
+      };
     };
 
     boot.extraModprobeConfig = "options kvm_${cfg.system} nested=1";

network.json

@@ -86,6 +86,7 @@
       "system": "aarch64-darwin"
     },
     "linode": {
+      "connectAddr": "thehellings.com",
       "ip": null,
       "pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMv9Zud3kZOl86gtmkn+uj3D4kiXWDPtyUL02VVLNR4Q",
       "ts": "100.109.86.8",
@@ -134,9 +135,6 @@
       "pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILFYyzz/9i5rXprCQj9IL1ulrbQ6E9BOSeOcvf4D/b0G",
       "tags": ["server"]
     },
-    "joel": {
-      "ip": "10.42.0.4"
-    },
     "k3s": {
       "aliases": ["*.k3s"],
       "ip": "10.42.5.1",
@@ -150,6 +148,9 @@
     "printer": {
       "ip": "10.42.1.3"
     },
+    "pve1": {
+      "ip": "10.42.0.4"
+    },
     "pve2": {
       "ip": "10.42.1.15"
     },

secrets/nebula/isaiah.crt

@@ -1,6 +1,6 @@
 -----BEGIN NEBULA CERTIFICATE V2-----
-MIGsoEaABmlzYWlhaKEOBAUKnQAEEAQFCp1kARCFBGplFeuGBGuuvKWHIIOJTGBg
+MIGloD+ABmlzYWlhaKEHBAUKnQAEEIUEanOBO4YEa668pYcgg4lMYGB2VakRFO6b
-dlWpERTumyvbx0i842abqoQVUOzEXjsFB0CsgiDoVBJV1aKswyKPq1E4ZH9H21tx
+K9vHSLzjZpuqhBVQ7MReOwUHQKyCIOhUElXVoqzDIo+rUThkf0fbW3HYgHSkp8So
-2IB0pKfEqNVdOLVedYNAjZSaY/IreMGnplY6txmSNuqSpFe1UTEDu4MOGSeZTKsO
+1V04tV51g0AXR6vPKFhC1rfiDtslbhxwBNYgiUrRDxcNiAYAQFCyjTijj2+tqxyD
-71y33z4AWsexnDD2ItFLT2rA5EgbApacaYF0AxtSCQ==
+pwL29i7NlcW+QgBxmtiSf8UW06MbzOkF
 -----END NEBULA CERTIFICATE V2-----

secrets/nebula/jeremiah.crt

@@ -1,6 +1,6 @@
 -----BEGIN NEBULA CERTIFICATE V2-----
-MIGuoEiACGplcmVtaWFooQ4EBQqdAAUQBAUKnWQBEIUEamUYxYYEa668pYcgg4lM
+MIGnoEGACGplcmVtaWFooQcEBQqdAAUQhQRqc4EPhgRrrrylhyCDiUxgYHZVqREU
-YGB2VakRFO6bK9vHSLzjZpuqhBVQ7MReOwUHQKyCIBHK000U9B0TVjuoTaMhQZFi
+7psr28dIvONmm6qEFVDsxF47BQdArIIgEcrTTRT0HRNWO6hNoyFBkWLxwrK3DyKz
-8cKytw8is2cqUW4XAENBg0CLM+fuJcMVMbk6VHmRhko4KUTaQzWG2dggEwskTWCf
+ZypRbhcAQ0GDQNX6euu+o8qczoXIHt7hfpbVc57YvtYQZ1v350iiyNhM0I0oZsV9
-IPXiTY2L/hInHSGFynIIe+Ux9hSRJ1W1KF4J8jq5LBwN
+oVEBR9rg39/lsXjFX6UtC/H3RKo+arlhDQ4=
 -----END NEBULA CERTIFICATE V2-----

secrets/nebula/zeke.crt

@@ -1,6 +1,6 @@
 -----BEGIN NEBULA CERTIFICATE V2-----
-MIGqoESABHpla2WhDgQFCp0ABhAEBQqdZAEQhQRqZRi1hgRrrrylhyCDiUxgYHZV
+MIGjoD2ABHpla2WhBwQFCp0ABhCFBGpzgSyGBGuuvKWHIIOJTGBgdlWpERTumyvb
-qREU7psr28dIvONmm6qEFVDsxF47BQdArIIg+FmKGTcvIvUcFdcguETRybn3jh58
+x0i842abqoQVUOzEXjsFB0CsgiD4WYoZNy8i9RwV1yC4RNHJufeOHnyMkvpfkEdy
-jJL6X5BHcmrxOWODQCfB4+92Zs/315a6I60PXsUaw3Jk0MQPLUuHykTO19imWsYa
+avE5Y4NAVS1PQZIausgi1JekcdvwJ/+G64bLjzjznKD72u4XJfl7WKaO1O+RYOf7
-DyKFlk26ePhczGlhO2svq9J8p0zce0w+TPveOw8=
+/2YdsUCODDzoGjdEtrQVftiz8RxRBg==
 -----END NEBULA CERTIFICATE V2-----