fix: restore immich access

chore: default actions packages
Pass traffic through genesis
2026-08-06 21:43:28 -05:00 · 2026-08-06 20:36:41 -05:00 · 2026-08-05 22:57:58 -05:00 · 2026-08-05 20:07:35 -05:00 · 2026-08-04 10:14:56 -05:00 · 2026-08-04 09:26:28 -05:00
44 changed files with 148 additions and 564 deletions
@@ -101,7 +101,7 @@
                {
                  deployment = {
                    inherit (v) tags;
-                    targetHost = if (v ? "nebulaIp") then v.nebulaIp else v.ts;
+                    targetHost = if (v ? "connectAddr") then v.connectAddr else v.nebulaIp;
                    targetUser = "greg";
                  };
                }
@@ -77,7 +77,7 @@ in
      };
    };
    firewall = {
-      enable = false;
+      enable = true;
      allowedUDPPorts = [
        dhcpPort
        dnsPort
@@ -88,7 +88,7 @@ in
        80
      ];
    };
-    nftables.enable = false;
+    nftables.enable = true;
  };

  environment.etc."hosts.d/local".text = extraHosts;
@@ -47,6 +47,10 @@
      enable = true;
      extraLabels = [ "bare-metal:host" ];
    };
+    vmdev = {
+      enable = true;
+      host = "libvirt";
+    };
  };

  networking = {
@@ -1,8 +1,9 @@
 {
+  config,
+  lib,
+  metadata,
  pkgs,
  pkgs',
-  lib,
-  config,
  ...
 }:

@@ -59,10 +60,11 @@ in
      };
    };
    gitea-runner = {
-      enable = false;
-      extraLabels = [
+      enable = true;
+      labels = [
        "vps:host"
        "blog:host"
+        "nixos-linode:host"
      ];
    };
    home = false;
@@ -70,6 +72,12 @@ in
    nebula = {
      enable = true;
      isLighthouse = true;
+      unsafeRoutes = [
+        {
+          route = "10.42.0.0/16";
+          via = metadata.hosts.genesis.nebulaIp;
+        }
+      ];
    };
    tailscale.enable = true;
  };
@@ -126,7 +134,7 @@ in
            COOKIE_DOMAIN = "thehellings.com";
            SERVE_ROBOTS_TXT = true;
            SLOG_LEVEL = "DEBUG";
-            TARGET = "http://git.k3s.nebula.thehellings.com";
+            TARGET = "http://git.k3s.thehellings.lan";
          };
        };
      };
@@ -149,9 +157,9 @@ in
          bind *:${toString sshPort}
          timeout client 1h
          mode tcp
-          server git-isaiah isaiah.nebula.thehellings.com:32222
-          server git-jeremiah jeremiah.nebula.thehellings.com:32222
-          server git-zeke zeke.nebula.thehellings.com:32222
+          server git-isaiah isaiah.thehellings.lan:32222
+          server git-jeremiah jeremiah.thehellings.lan:32222
+          server git-zeke zeke.thehellings.lan:32222

        frontend https
          bind *:80
@@ -175,6 +183,8 @@ in
          use_backend next if { req_ssl_sni -i next.thehellings.com }
          use_backend matrix if { hdr(host) -i matrix.thehellings.com }
          use_backend matrix if { req_ssl_sni -i matrix.thehellings.com }
+          use_backend immich if { hdr(host) -i immich.thehellings.com }
+          use_backend immich if { req_ssl_sni -i immich.thehellings.com }
          use_backend web if { hdr(host) -i thehellings.com }
          use_backend web if { req_ssl_sni -i thehellings.com }

@@ -184,10 +194,18 @@ in
          option accept-unsafe-violations-in-http-response
          retries 3
          option forwardfor
-          http-request set-header Host git.k3s.nebula.thehellings.com
-          server git-isaiah isaiah.nebula.thehellings.com:80
-          server git-jeremiah jeremiah.nebula.thehellings.com:80
-          server git-zeke zeke.nebula.thehellings.com:80
+          http-request set-header Host git.k3s.thehellings.lan
+          server git-isaiah isaiah.thehellings.lan:80
+          server git-jeremiah jeremiah.thehellings.lan:80
+          server git-zeke zeke.thehellings.lan:80
+
+        backend immich
+          mode http
+          balance roundrobin
+          option accept-unsafe-violations-in-http-response
+          retries 3
+          option forwardfor
+          server immich-proxy 127.0.0.1:${builtins.toString config.services.immich-public-proxy.port}

        backend matrix
          mode http
@@ -195,10 +213,10 @@ in
          option accept-unsafe-violations-in-http-response
          retries 3
          option forwardfor
-          http-request set-header Host matrix.k3s.nebula.thehellings.com
-          server git-isaiah isaiah.nebula.thehellings.com:80
-          server git-jeremiah jeremiah.nebula.thehellings.com:80
-          server git-zeke zeke.nebula.thehellings.com:80
+          http-request set-header Host matrix.k3s.thehellings.lan
+          server git-isaiah isaiah.thehellings.lan:80
+          server git-jeremiah jeremiah.thehellings.lan:80
+          server git-zeke zeke.thehellings.lan:80

        backend web
          mode http
@@ -222,7 +240,7 @@ in

    immich-public-proxy = {
      enable = true;
-      immichUrl = "https://immich.shire-zebra.ts.net";
+      immichUrl = "http://immich.k3s.thehellings.lan";
    };

    logrotate = {
@@ -326,7 +344,7 @@ in
  virtualisation.oci-containers = {
    backend = "podman";
    containers."homepage" = {
-      image = "registry.thehellings.com:443/greg/homepage/gregs-homepage:latest";
+      image = "src.thehellings.com/greg/homepage:latest";
      ports = [ "${homepage}:80" ];
    };
  };
@@ -32,6 +32,10 @@
      enable = true;
      tags = [ "home" ];
    };
+    vmdev = {
+      enable = true;
+      host = "vbox";
+    };
  };

  hardware = {
@@ -71,10 +75,4 @@
  users.users.greg.extraGroups = [
    "podman"
  ];
-
-  # virtualisation.virtualbox.host = {
-  #   enableExtensionPack = true;
-  #   headless = true;
-  #   enableWebService = true;
-  # };
 }
@@ -1,79 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: donetick-config
-  namespace: donetick
-data:
-  # Value pulled from
-  # https://github.com/donetick/donetick/blob/main/config/selfhosted.yaml
-  selfhosted.yaml: |-
-    name: "selfhosted"
-    is_done_tick_dot_com: false
-    is_user_creation_disabled: false
-    telegram:
-      token: ""
-    pushover:
-      token: ""
-    database:
-      type: "sqlite"
-      migration: true
-      # these are only required for postgres
-      host: "secret"
-      port: 5432
-      user: "secret"
-      password: "secret"
-      name: "secret"
-    jwt:
-      secret: "This is really a secure JWT secret now!"
-      session_time: 168h
-      max_refresh: 168h
-    server:
-      port: 2021
-      read_timeout: 10s
-      write_timeout: 10s
-      rate_period: 60s
-      rate_limit: 300
-      cors_allow_origins:
-        - "http://localhost:5173"
-        - "http://localhost:7926"
-        # the below are required for the android app to work
-        - "https://localhost"
-        - "capacitor://localhost"
-      serve_frontend: true
-    logging:
-      level: "info"
-      encoding: "json"
-      development: false
-    scheduler_jobs:
-      due_job: 30m
-      overdue_job: 3h
-      pre_due_job: 3h
-    email:
-      host:
-      port:
-      key:
-      email:
-      appHost:
-    oauth2:
-      client_id:
-      client_secret:
-      auth_url:
-      token_url:
-      user_info_url:
-      redirect_url:
-      name:
-    # Real-time configuration
-    realtime:
-      enabled: true
-      sse_enabled: true
-      heartbeat_interval: 60s
-      connection_timeout: 120s
-      max_connections: 1000
-      max_connections_per_user: 5
-      event_queue_size: 2048
-      cleanup_interval: 2m
-      stale_threshold: 5m
-      enable_compression: true
-      enable_stats: true
-      allowed_origins:
-        - "*"
@@ -1,38 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: donetick
-  namespace: donetick
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: donetick
-  template:
-    metadata:
-      labels:
-        app: donetick
-    spec:
-      containers:
-        - name: donetick
-          image: donetick/donetick
-          ports:
-            - containerPort: 2021
-              name: http
-          env:
-            - name: DT_ENV
-              value: "selfhosted"
-            - name: DT_SQLITE_PATH
-              value: "/data/donetick.db"
-          volumeMounts:
-            - name: config
-              mountPath: /config
-            - name: data
-              mountPath: /data
-      volumes:
-        - name: config
-          configMap:
-            name: donetick-config
-        - name: data
-          persistentVolumeClaim:
-            claimName: donetick-data
@@ -1,15 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: donetick-tailscale
-  namespace: donetick
-spec:
-  ingressClassName: tailscale
-  defaultBackend:
-    service:
-      name: donetick
-      port:
-        number: 2021
-  tls:
-    - hosts:
-        - todo
@@ -1,9 +0,0 @@
-namespace: donetick
-
-resources:
-  - namespace.yaml
-  - configmap.yaml
-  - pvc.yaml
-  - deployment.yaml
-  - service.yaml
-  - ingress.yaml
@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: donetick
@@ -1,11 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: donetick-data
-  namespace: donetick
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 5Gi
@@ -1,13 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: donetick
-  namespace: donetick
-spec:
-  selector:
-    app: donetick
-  ports:
-    - name: http
-      port: 2021
-      targetPort: 2021
-      protocol: TCP
@@ -1,56 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: gitea
-spec:
-  interval: "24h"
-  url: https://dl.gitea.com/charts/
---
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: gitea-runner
-  namespace: gitea-runner
-spec:
-  interval: 10m
-  chart:
-    spec:
-      chart: actions
-      version: "0.0.4"
-      sourceRef:
-        kind: HelmRepository
-        name: gitea
-      interval: "1h"
-  values:
-    rbac:
-      create: true
-    serviceAccount:
-      create: true
-    gitea:
-      instanceURL: https://src.thehellings.com
-      runnerToken:
-        existingSecret: gitea-runner
-        existingSecretKey: token
-    imagePullSecrets:
-      - name: image-pull-secrets
-    config:
-      runner:
-        labels:
-          # Ubuntu
-          - "ubuntu-22.04:docker://ubuntu:22.04"
-          - "ubuntu-24.04:docker://ubuntu:24.04"
-          - "ubuntu-24.10:docker://ubuntu:24.10"
-          # Fedora
-          - "fedora-41:docker://fedora:41"
-          - "fedora-42:docker://fedora:42"
-          # CentOS Stream
-          - "centos-stream-9:docker://quay.io/centos/centos:stream9"
-          - "centos-stream-10:docker://quay.io/centos/centos:stream10"
-          # Nix
-          - "nix:docker://nixos/nix:latest"
-          # ci-images (internal registry: src.thehellings.com/greg)
-          - "ci-builder:docker://src.thehellings.com/greg/builder:latest"
-          - "ci-vm-test:docker://src.thehellings.com/greg/vm-test:latest"
-          - "ci-sword:docker://src.thehellings.com/greg/sword-container-builder:latest"
-          - "ci-bitwarden:docker://src.thehellings.com/greg/bitwarden:latest"
-          - "ci-immich:docker://src.thehellings.com/greg/immich:latest"
@@ -1,6 +0,0 @@
-namespace: gitea-runner
-
-resources:
-  - namespace.yaml
-  - secrets.yaml
-  - chart.yaml
@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: gitea-runner
@@ -1,18 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: gitea-runner
-  namespace: gitea-runner
-spec:
-  refreshInterval: 1h
-  secretStoreRef:
-    name: bitwarden-login
-    kind: ClusterSecretStore
-  target:
-    name: gitea-runner
-    creationPolicy: Owner
-  data:
-    - secretKey: token
-      remoteRef:
-        key: 11419680-5338-4f19-bdd9-b422007046af
-        property: password
@@ -15,7 +15,7 @@ spec:
  chart:
    spec:
      chart: gitea
-      version: "12.6.0"
+      version: "12.7.0"
      sourceRef:
        kind: HelmRepository
        name: gitea-repository
@@ -35,7 +35,7 @@ spec:
      storageClass: longhorn-default

    image:
-      tag: "1.26.2"
+      tag: "1.27.1"

    replicaCount: 1

@@ -85,15 +85,15 @@ spec:
          DISABLE_REGISTRATION: "true"
        storage:
          STORAGE_TYPE: minio
-          MINIO_ENDPOINT: "nas1.shire-zebra.ts.net:9000"
+          MINIO_ENDPOINT: "nas1.shire-zebra.ts.net:30188"
          MINIO_BUCKET: gitea
-          MINIO_LOCATION: us-east-1
+          MINIO_LOCATION: garage
          # MINIO_ACCESS_KEY_ID: ""
          # MINIO_SECRET_ACCESS_KEY: ""
          MINIO_USE_SSL: "false"
          MINIO_INSECURE_SKIP_VERIFY: "true"
-        webhook:
-          ALLOWED_HOST_LIST: loopback,private,*.shire-zebra.ts.net
+        security:
+          ALLOWED_HOST_LIST: loopback,private,*.shire-zebra.ts.net,*.nebula.thehellings.com,*.thehellings.lan

      metrics:
        enabled: false
@@ -102,8 +102,8 @@ spec:

    persistence:
      enabled: true
-      storageClass: longhorn-default
-      size: "50Gi"
+      create: false
+      claimName: gitea-new

    # I will manage my Postgres externally
    postgresql:
@@ -18,12 +18,12 @@ spec:
          volumes:
            - name: gitea-data
              persistentVolumeClaim:
-                claimName: gitea-shared-storage
+                claimName: gitea-new
            - name: dump-staging
              emptyDir: {}
          initContainers:
            - name: gitea-dump
-              image: "gitea/gitea:1.25.4"
+              image: "gitea/gitea:1.27.1"
              command:
                - /bin/sh
                - "-c"
@@ -51,12 +51,12 @@ spec:
                - |
                  set -e
                  # Configure mc alias for MinIO
-                  mc alias set nas1 http://nas1.shire-zebra.ts.net:9000 \
+                  mc alias set nas1 http://nas1.shire-zebra.ts.net:30188 \
                    "${MINIO_ACCESS_KEY}" "${MINIO_SECRET_KEY}"
                  # Upload dump to backup-gitea bucket
                  DUMP_FILE=$(ls /dump-staging/gitea-dump-*.zip | head -1)
-                  mc cp "${DUMP_FILE}" "nas1/backup-gitea/$(basename ${DUMP_FILE})"
-                  echo "Uploaded $(basename ${DUMP_FILE}) to backup-gitea"
+                  mc cp "${DUMP_FILE}" "nas1/gitea-backup/$(basename ${DUMP_FILE})"
+                  echo "Uploaded $(basename ${DUMP_FILE}) to gitea-backup"
                  # Set 30-day lifecycle on the bucket (idempotent)
                  mc ilm rule add --expire-days 30 nas1/backup-gitea 2>/dev/null || true
              volumeMounts:
@@ -69,10 +69,10 @@ spec:
                - name: MINIO_ACCESS_KEY
                  valueFrom:
                    secretKeyRef:
-                      name: gitea-config
+                      name: gitea-backup
                      key: minio_key
                - name: MINIO_SECRET_KEY
                  valueFrom:
                    secretKeyRef:
-                      name: gitea-config
+                      name: gitea-backup
                      key: minio_secret
@@ -19,7 +19,7 @@ metadata:
  name: gitea-direct
 spec:
  rules:
-    - host: git.k3s.nebula.thehellings.com
+    - host: git.k3s.thehellings.lan
      http:
        paths:
          - path: /
@@ -1,5 +1,32 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
+metadata:
+  name: gitea-backup
+spec:
+  target:
+    name: gitea-backup
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        minio_key: "{{ .minio_key }}"
+        minio_secret: "{{ .minio_secret }}"
+  secretStoreRef:
+    name: bitwarden-login
+    kind: ClusterSecretStore
+  data:
+    # MinIO credentials
+    - secretKey: minio_key
+      remoteRef:
+        key: dfb2f0c8-110d-4e96-83a7-b49c001c0897
+        property: username
+    - secretKey: minio_secret
+      remoteRef:
+        key: dfb2f0c8-110d-4e96-83a7-b49c001c0897
+        property: password
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
 metadata:
  name: gitea-config
 spec:
@@ -21,23 +48,14 @@ spec:
    name: bitwarden-login
    kind: ClusterSecretStore
  data:
-    # MinIO credentials
-    - secretKey: minio_key
-      remoteRef:
-        key: dcbcf704-7dce-48d7-bbd1-b3a801875b3d
-        property: username
-    - secretKey: minio_secret
-      remoteRef:
-        key: dcbcf704-7dce-48d7-bbd1-b3a801875b3d
-        property: password
    # MinIO credentials for NAS1
    - secretKey: minio_nas1_key
      remoteRef:
-        key: c4c66ab3-2ade-4086-9c0d-b3a80172b1ba
+        key: 33e8e4e0-eb90-484c-9ec9-b3a8018077a3
        property: username
    - secretKey: minio_nas1_secret
      remoteRef:
-        key: c4c66ab3-2ade-4086-9c0d-b3a80172b1ba
+        key: 33e8e4e0-eb90-484c-9ec9-b3a8018077a3
        property: password
    # Postgres credentials
    - secretKey: dbuser
@@ -27,7 +27,7 @@ spec:
  chart:
    spec:
      chart: longhorn
-      version: "1.11.2"
+      version: "1.11.3"
      sourceRef:
        kind: HelmRepository
        name: longhorn
@@ -141,6 +141,10 @@ spec:
                  number: 80
    - <<: *host
      host: longhorn.kubernetes
+    - <<: *host
+      host: longhorn.k3s.nebula.thehellings.com
+    - <<: *host
+      host: longhorn.k3s.thehellings.lan
 ---
 apiVersion: storage.k8s.io/v1
 kind: StorageClass
@@ -33,24 +33,24 @@ spec:
        access-key: "{{ .minio_key }}"
        secret-key: "{{ .minio_secret }}"
        rclone.conf: |
-          [nas1minio]
+          [garage]
          type = s3
          provider = Minio
-          endpoint = http://nas1.shire-zebra.ts.net:9000
+          endpoint = http://nas1.shire-zebra.ts.net:30188
          access_key_id = {{ .minio_key }}
          secret_access_key = {{ .minio_secret }}
-          region = us-east-1
+          region = garage
  secretStoreRef:
    name: bitwarden-login
    kind: ClusterSecretStore
  data:
    - secretKey: minio_key
      remoteRef:
-        key: c4c66ab3-2ade-4086-9c0d-b3a80172b1ba
+        key: 8fce2750-aa62-4892-b90c-b49c001f494b
        property: username
    - secretKey: minio_secret
      remoteRef:
-        key: c4c66ab3-2ade-4086-9c0d-b3a80172b1ba
+        key: 8fce2750-aa62-4892-b90c-b49c001f494b
        property: password
 ---
 apiVersion: v1
@@ -128,7 +128,7 @@ spec:
                    --progress \
                    --transfers 4 \
                    --checkers 8 \
-                    /staging nas1minio:immich
+                    /staging garage:immich
              volumeMounts:
                - name: staging
                  mountPath: /staging
@@ -32,7 +32,7 @@ spec:
        containers:
          main:
            image:
-              tag: v2.7.5
+              tag: v3.1.0
            env:
              DB_HOSTNAME: immich-rw
              DB_DATABASE_NAME: immich
@@ -22,6 +22,10 @@ spec:
                name: immich-server
                port:
                  name: http
+    - <<: *host
+      host: immich.k3s.nebula.thehellings.com
+    - <<: *host
+      host: immich.k3s.thehellings.lan
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
@@ -10,7 +10,4 @@ resources:
  - immich
  - monitoring
  - pinchflat
-  - smokeping
-  - uptimekuma
-  - donetick
  - gitea
@@ -20,7 +20,7 @@ metadata:
  name: matrix-direct
 spec:
  rules:
-    - host: matrix.k3s.nebula.thehellings.com
+    - host: matrix.k3s.thehellings.lan
      http:
        paths:
          - path: /
@@ -1,50 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: smokeping
-  labels:
-    app: smokeping
-spec:
-  replicas: 1
-  strategy:
-    type: Recreate
-  selector:
-    matchLabels:
-      app: smokeping
-  template:
-    metadata:
-      labels:
-        app: smokeping
-    spec:
-      containers:
-        - name: smokeping
-          image: docker.io/linuxserver/smokeping:2.9.0
-          imagePullPolicy: IfNotPresent
-          ports:
-            - name: http
-              containerPort: 80
-              protocol: TCP
-          volumeMounts:
-            - name: config
-              mountPath: /config
-            - name: data
-              mountPath: /data
-          env:
-            - name: PUID
-              value: "1000"
-            - name: PGID
-              value: "1000"
-            - name: TZ
-              value: "America/Chicago"
-            #- name: MASTER_URL
-            #  value: "https://ping.shire-zebra.ts.net"
-            # SHARED_SECRET if you want to run a cluster
-            # CACHE_DIR if you need to explicitly state that
-      restartPolicy: Always
-      volumes:
-        - name: config
-          persistentVolumeClaim:
-            claimName: smokeping-config
-        - name: data
-          persistentVolumeClaim:
-            claimName: smokeping-data
@@ -1,14 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: smokeping-tailscale
-spec:
-  ingressClassName: tailscale
-  defaultBackend:
-    service:
-      name: smokeping
-      port:
-        name: http
-  tls:
-    - hosts:
-        - ping
@@ -1,8 +0,0 @@
-namespace: smokeping
-
-resources:
-  - namespace.yaml
-  - pvc.yaml
-  - deployment.yaml
-  - service.yaml
-  - ingress.yaml
@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: smokeping
@@ -1,23 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: smokeping-config
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: longhorn-default
-  resources:
-    requests:
-      storage: 1Gi
---
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: smokeping-data
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: longhorn-default
-  resources:
-    requests:
-      storage: 25Gi
@@ -1,15 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: smokeping
-  labels:
-    app: smokeping
-spec:
-  type: ClusterIP
-  ports:
-    - port: 80
-      targetPort: http
-      protocol: TCP
-      name: http
-  selector:
-    app: smokeping
@@ -1,38 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: uptime-kuma
-  namespace: uptime-kuma
-spec:
-  interval: "24h"
-  url: "https://helm.irsigler.cloud"
---
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: uptime-kuma
-  namespace: uptime-kuma
-spec:
-  interval: 10m
-  chart:
-    spec:
-      chart: uptime-kuma
-      sourceRef:
-        kind: HelmRepository
-        name: uptime-kuma
-      interval: "1h"
-  dependsOn:
-    - name: longhorn
-      namespace: longhorn-system
-    - name: mariadb-cluster
-      namespace: mariadb-operator
-  values:
-    volume:
-      storageClassName: longhorn-default
-    image:
-      tag: "2.0.2"
-    externalDatabase:
-      enabled: true
-      hostname: mariadb-cluster.mariadb-operator.svc.cluster.local
-      database: uptimekuma
-      existingSecret: uptimekuma-mariadb-password
@@ -1,15 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: uptime-kuma-tailscale
-  namespace: uptime-kuma
-spec:
-  ingressClassName: tailscale
-  defaultBackend:
-    service:
-      name: uptime-kuma
-      port:
-        number: 3001
-  tls:
-    - hosts:
-        - kuma
@@ -1,7 +0,0 @@
-namespace: uptimekuma
-
-resources:
-  - namespace.yaml
-  - secrets.yaml
-  - chart.yaml
-  - ingress.yaml
@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: uptimekuma
@@ -1,27 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: uptimekuma-mariadb-password
-spec:
-  target:
-    name: uptimekuma-mariadb-password
-    deletionPolicy: Delete
-    template:
-      type: kubernetes.io/basic-auth
-      data:
-        username: |-
-          {{ .username }}
-        password: |-
-          {{ .password }}
-  secretStoreRef:
-    name: bitwarden-login
-    kind: ClusterSecretStore
-  data:
-    - secretKey: username
-      remoteRef:
-        key: 4df95656-9f9c-4916-8e34-b3a200376365
-        property: username
-    - secretKey: password
-      remoteRef:
-        key: 4df95656-9f9c-4916-8e34-b3a200376365
-        property: password
@@ -98,6 +98,19 @@ in
        inherit labels;
        inherit (cfg) name;
        enable = true;
+        hostPackages = with pkgs; [
+          bash
+          buildah
+          coreutils
+          curl
+          gawk
+          gitMinimal
+          gnused
+          nix
+          nodejs
+          podman
+          wget
+        ];
        url = cfg.instanceURL;
        tokenFile = config.age.secrets."gitea-runner-${host}-podman".path;
        settings = {
@@ -15,8 +15,6 @@ let
    sha256 = "sha256-Qs1qJmgZm8q9xZsORjT/N/wzpbWVVODXtzDpjnAYMuQ=";
  };
  keepaliveIp = "10.42.5.1";
-  nebulaName = "k3s.nebula.thehellings.com";
-  nebulaIp = "10.157.100.1";
 in
 {
  options.greg = {
@@ -46,13 +44,6 @@ in
  };

  config = lib.mkIf cfg.enable {
-    assertions = [
-      {
-        assertion = config.greg.nebula.enable;
-        message = "Configure Nebula for this host, first";
-      }
-    ];
-
    age.secrets = {
      bw_secret.file = ../../secrets/kubernetes/bw_secret.age;
      dendrite_key.file = ../../secrets/dendrite_key.age;
@@ -106,8 +97,6 @@ in
          "--tls-san ${config.networking.hostName}.thehellings.lan"
          "--tls-san ${config.networking.hostName}.shire-zebra.ts.net"
          "--tls-san ${keepaliveIp}"
-          "--tls-san ${nebulaName}"
-          "--tls-san ${nebulaIp}"
        ];
        manifests = {
          cert-manager.source = cert-manager;
@@ -139,21 +128,6 @@ in
              advert_int 1
            '';
          };
-          k3s-nebula = {
-            interface = "nebula0";
-            priority = 1;
-            state = if (config.networking.hostName == "isaiah") then "MASTER" else "BACKUP";
-            virtualIps = [
-              {
-                addr = "${nebulaIp}/16";
-                dev = "nebula0";
-              }
-            ];
-            virtualRouterId = 78;
-            extraConfig = ''
-              advert_int 1
-            '';
-          };
        };
      };
      openiscsi = {
@@ -23,6 +23,13 @@ with lib;
        type = types.str;
        description = "Kernel module type to install - amd, intel, etc";
      };
+      host = mkOption {
+        type = types.enum [
+          "libvirt"
+          "vbox"
+        ];
+        description = "Which VM hosting type to configure";
+      };
    };
  };

@@ -35,7 +42,6 @@ with lib;
      nixos-generators
      packer
      swtpm
-      virt-manager
      virtio-win
      xorriso
    ];
@@ -44,7 +50,7 @@ with lib;

    # Enable the virtualisation services
    virtualisation = {
-      libvirtd = {
+      libvirtd = mkIf (cfg.host == "libvirt") {
        enable = true;
        onBoot = "ignore"; # Do not auto-restart VMs on boot, unless they are marked autostart
        qemu = {
@@ -54,6 +60,11 @@ with lib;
          };
        };
      };
+      virtualbox.host = mkIf (cfg.host == "vbox") {
+        enable = true;
+        enableExtensionPack = true;
+        headless = true;
+      };
    };

    boot.extraModprobeConfig = "options kvm_${cfg.system} nested=1";
@@ -86,6 +86,7 @@
      "system": "aarch64-darwin"
    },
    "linode": {
+      "connectAddr": "thehellings.com",
      "ip": null,
      "pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMv9Zud3kZOl86gtmkn+uj3D4kiXWDPtyUL02VVLNR4Q",
      "ts": "100.109.86.8",
@@ -1,6 +1,6 @@
 -----BEGIN NEBULA CERTIFICATE V2-----
-MIGsoEaABmlzYWlhaKEOBAUKnQAEEAQFCp1kARCFBGplFeuGBGuuvKWHIIOJTGBg
-dlWpERTumyvbx0i842abqoQVUOzEXjsFB0CsgiDoVBJV1aKswyKPq1E4ZH9H21tx
-2IB0pKfEqNVdOLVedYNAjZSaY/IreMGnplY6txmSNuqSpFe1UTEDu4MOGSeZTKsO
-71y33z4AWsexnDD2ItFLT2rA5EgbApacaYF0AxtSCQ==
+MIGloD+ABmlzYWlhaKEHBAUKnQAEEIUEanOBO4YEa668pYcgg4lMYGB2VakRFO6b
+K9vHSLzjZpuqhBVQ7MReOwUHQKyCIOhUElXVoqzDIo+rUThkf0fbW3HYgHSkp8So
+1V04tV51g0AXR6vPKFhC1rfiDtslbhxwBNYgiUrRDxcNiAYAQFCyjTijj2+tqxyD
+pwL29i7NlcW+QgBxmtiSf8UW06MbzOkF
 -----END NEBULA CERTIFICATE V2-----
@@ -1,6 +1,6 @@
 -----BEGIN NEBULA CERTIFICATE V2-----
-MIGuoEiACGplcmVtaWFooQ4EBQqdAAUQBAUKnWQBEIUEamUYxYYEa668pYcgg4lM
-YGB2VakRFO6bK9vHSLzjZpuqhBVQ7MReOwUHQKyCIBHK000U9B0TVjuoTaMhQZFi
-8cKytw8is2cqUW4XAENBg0CLM+fuJcMVMbk6VHmRhko4KUTaQzWG2dggEwskTWCf
-IPXiTY2L/hInHSGFynIIe+Ux9hSRJ1W1KF4J8jq5LBwN
+MIGnoEGACGplcmVtaWFooQcEBQqdAAUQhQRqc4EPhgRrrrylhyCDiUxgYHZVqREU
+7psr28dIvONmm6qEFVDsxF47BQdArIIgEcrTTRT0HRNWO6hNoyFBkWLxwrK3DyKz
+ZypRbhcAQ0GDQNX6euu+o8qczoXIHt7hfpbVc57YvtYQZ1v350iiyNhM0I0oZsV9
+oVEBR9rg39/lsXjFX6UtC/H3RKo+arlhDQ4=
 -----END NEBULA CERTIFICATE V2-----
@@ -1,6 +1,6 @@
 -----BEGIN NEBULA CERTIFICATE V2-----
-MIGqoESABHpla2WhDgQFCp0ABhAEBQqdZAEQhQRqZRi1hgRrrrylhyCDiUxgYHZV
-qREU7psr28dIvONmm6qEFVDsxF47BQdArIIg+FmKGTcvIvUcFdcguETRybn3jh58
-jJL6X5BHcmrxOWODQCfB4+92Zs/315a6I60PXsUaw3Jk0MQPLUuHykTO19imWsYa
-DyKFlk26ePhczGlhO2svq9J8p0zce0w+TPveOw8=
+MIGjoD2ABHpla2WhBwQFCp0ABhCFBGpzgSyGBGuuvKWHIIOJTGBgdlWpERTumyvb
+x0i842abqoQVUOzEXjsFB0CsgiD4WYoZNy8i9RwV1yC4RNHJufeOHnyMkvpfkEdy
+avE5Y4NAVS1PQZIausgi1JekcdvwJ/+G64bLjzjznKD72u4XJfl7WKaO1O+RYOf7
+/2YdsUCODDzoGjdEtrQVftiz8RxRBg==
 -----END NEBULA CERTIFICATE V2-----
Author	SHA1	Message	Date
Greg Hellings	6bf0bcc0ef	fix: restore immich access buildbot/nix-eval Build done. (1 warning) Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-builder2 Build done. Details buildbot/nix-build Build done. Details	2026-08-06 21:43:28 -05:00
Greg Hellings	7619bf6258	chore: default actions packages	2026-08-06 20:36:41 -05:00
Greg Hellings	029b71d0d4	Pass traffic through genesis * keepalived does not work with Nebula VPN * update Genesis firewall to allow passing through local traffic * target all traffic directly to the LAN IP using genesis's routing	2026-08-05 22:57:58 -05:00
Greg Hellings	d779d275f2	Expose kubernetes on LAN	2026-08-05 20:07:35 -05:00
Greg Hellings	0196f1fd07	chore: re-enable linode gitea-runner buildbot/nix-eval Build done. (1 warning) Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-builder2 Build done. Details buildbot/nix-build Build done. Details	2026-08-04 10:14:56 -05:00
Greg Hellings	6a13d843d7	chore: point homepage to new registry url buildbot/nix-eval Build done. (1 warning) Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-builder2 Build done. Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-hosea Build done. Details buildbot/nix-build Build done. Details	2026-08-04 09:26:28 -05:00
Greg Hellings	8673d6193b	chore: immich backup to Garage	2026-08-04 09:19:53 -05:00
Greg Hellings	bbdfe1e1de	chore: update Gitea to backup to Garage	2026-08-03 20:46:48 -05:00
Greg Hellings	71486e9ab3	chore: update Longhorn version	2026-08-03 20:46:20 -05:00
Greg Hellings	8a8664287f	chore: remove gitea-runner	2026-08-03 18:56:23 -05:00
Greg Hellings	4965d42e59	chore: remove smokeping and donetick from k8s	2026-08-03 18:55:07 -05:00
Greg Hellings	03e174367d	chore: uptimekuma migrated to NixOS	2026-08-03 18:52:01 -05:00