chore: update flake.lock 2026-08-02

flake.lock

@@ -31,11 +31,11 @@
         "treefmt-nix": "treefmt-nix"
       },
       "locked": {
-        "lastModified": 1785648274,
+        "lastModified": 1784438381,
-        "narHash": "sha256-25piX3cCXleOWo3L1TVc+/tNVDSDGctGTREcMKzp0KA=",
+        "narHash": "sha256-OuKnPzVTpGYaUQp/GjR7NFY8ezVRlR2V2CUxkHkI2UU=",
         "owner": "nix-community",
         "repo": "buildbot-nix",
-        "rev": "9a8ea9a47dfccbdf08d5a9cad7b99e6212d4027a",
+        "rev": "72e12f1a1381321e07279b18f3d401c29871b50e",
         "type": "github"
       },
       "original": {
@@ -53,11 +53,11 @@
         "stable": "stable"
       },
       "locked": {
-        "lastModified": 1785930890,
+        "lastModified": 1785582945,
-        "narHash": "sha256-QN4Oy1B4Vma9DiMyXiyssrpgMuIPgkNyO8jb6k2H4oY=",
+        "narHash": "sha256-PI+qji1xkJm3PV7l7/PKJDumFz0fbA4etXE614jRnls=",
         "owner": "zhaofengli",
         "repo": "colmena",
-        "rev": "a156fd9146e69a577fe6f5542a7c6ed83a6888ce",
+        "rev": "84d419ad080477ed2f31fbf3866551393df647a7",
         "type": "github"
       },
       "original": {
@@ -242,11 +242,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1786031233,
+        "lastModified": 1785531816,
-        "narHash": "sha256-TIDlLTLI1/pB7IqgjzcKQjpODQsZE2oII4XGG9B6KjI=",
+        "narHash": "sha256-vkMnV0JIyw+g/NmcfoajlGaAO+9a0ezia+FZohQJrik=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "7834e82588860aaf780cec1366524456a70898d7",
+        "rev": "bf9ce9fec78f95f374e8dd3b503863a3ec128ebe",
         "type": "github"
       },
       "original": {
@@ -284,11 +284,11 @@
         "systems": "systems_3"
       },
       "locked": {
-        "lastModified": 1786154692,
+        "lastModified": 1785555369,
-        "narHash": "sha256-+KyMg7tMfMcfFjUg59BD3OMUzehv9xsNK7ZMY3ZepGc=",
+        "narHash": "sha256-KUHFKv51VoV1wpyIreeusIkFsgycjeuRA9vDsBmCUu0=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "fad712d66c18a08c582214c3f52c3d12e0cc16f9",
+        "rev": "76a82a08c36423e5ff627c62f55797de52c3061b",
         "type": "github"
       },
       "original": {
@@ -303,11 +303,11 @@
         "treefmt-nix": "treefmt-nix_2"
       },
       "locked": {
-        "lastModified": 1786014695,
+        "lastModified": 1785226690,
-        "narHash": "sha256-to1UGPixvqyQwl1UC05/e+o3MYiIJ1DZ6m48xovDsq0=",
+        "narHash": "sha256-H7lhfp4ja6vysomufDgVoRgiBUyEcQDnN6rGB9yDIDM=",
         "owner": "Mic92",
         "repo": "niks3",
-        "rev": "76cb73a99911bef6a395cf331c36e6f4e620c6a9",
+        "rev": "ce7cd4b0462c634802a9faf0cb19f4718d115ec8",
         "type": "github"
       },
       "original": {
@@ -388,11 +388,11 @@
     },
     "nixpkgs-lib_2": {
       "locked": {
-        "lastModified": 1785636265,
+        "lastModified": 1785031560,
-        "narHash": "sha256-trTbhoc8hhPiGVDpNGGYA4scDV/4d01iNH/cFemblEg=",
+        "narHash": "sha256-OmshNvn2vupOFpYinLUu+1Dnpu4n7Q5N3ggGVNHpkUI=",
         "owner": "nix-community",
         "repo": "nixpkgs.lib",
-        "rev": "77a147ce329a5800bc001a45b356fad3397ee184",
+        "rev": "0e79af5e3d4dcfcd676ab5ba3f95d2e3352e078c",
         "type": "github"
       },
       "original": {
@@ -419,11 +419,11 @@
     },
     "nixpkgs_3": {
       "locked": {
-        "lastModified": 1785708545,
+        "lastModified": 1783978241,
-        "narHash": "sha256-Kx+ica895RPt90eYPC99xe54mKse9FmfbIVZV1rE+9E=",
+        "narHash": "sha256-7kK0Y/fIV2NTKArkd/eZGaFg+dEmgP8KDRsGK2vB5M4=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "ccdb97fdbee71215dbcff68dcab5ea9991020651",
+        "rev": "a8b81d3cc8d35af7bc98694696bea61ad4f8fca7",
         "type": "github"
       },
       "original": {
@@ -464,11 +464,11 @@
     },
     "nixpkgs_6": {
       "locked": {
-        "lastModified": 1786106723,
+        "lastModified": 1785571196,
-        "narHash": "sha256-zDSUbpoeo/9ZmD2+wXnzxoo1+uhL8vxc0b8yuYMKYq0=",
+        "narHash": "sha256-KoTsyMQqnXQZq8deCEnu4QkyldkwH/bpMMhUcfMdGIw=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "f13ff45afd1bb73e640eaa08a7066dbed07e3238",
+        "rev": "148bab9c1c3c53136ecb44a6ea356a0ed5b39b06",
         "type": "github"
       },
       "original": {
@@ -517,11 +517,11 @@
         "systems": "systems_4"
       },
       "locked": {
-        "lastModified": 1785763201,
+        "lastModified": 1785527278,
-        "narHash": "sha256-wA373y/B9orM3HatLu9oS+Ke5lmdZyBl/bdjd2gLMq4=",
+        "narHash": "sha256-rYFSM491MFFA1V6oax5PngXbevGt6n0o8sKhwFoItE0=",
         "owner": "nix-community",
         "repo": "nixvim",
-        "rev": "c7be49306b23a952c0151cf4bbeacd944ed82f2a",
+        "rev": "a19efae6c1afe426e8243d79f6dfbab186be6df8",
         "type": "github"
       },
       "original": {
@@ -537,11 +537,11 @@
         "nixpkgs": "nixpkgs_6"
       },
       "locked": {
-        "lastModified": 1786233186,
+        "lastModified": 1785627680,
-        "narHash": "sha256-sqDu3uQvU1LimxIZ907iFGqwVEBBZIB5ZSgGlb7zKqY=",
+        "narHash": "sha256-uWtMa2bwZdK3GPIaSRikEezgHK/dvpawxzjqm4BIHfk=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "317f059fb7463680165802d82ddad2126fabf8d3",
+        "rev": "b4d9d89f110d52db3cf336cb9f8b4448e6648e87",
         "type": "github"
       },
       "original": {
@@ -654,11 +654,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1785360170,
+        "lastModified": 1784369104,
-        "narHash": "sha256-XE1lKgQ3eIO3E7zWryqcRsax+mYXod/5RHBn4YaR9YE=",
+        "narHash": "sha256-47cxbcZODibHv3rELFQ9vZly0vUNkND/atn/U7HLeb0=",
         "owner": "numtide",
         "repo": "treefmt-nix",
-        "rev": "d1187f8bc71fb8aab02395869ec3f5c1920f75c0",
+        "rev": "df3c0640565d04a0261253cdd89fce78ec50168a",
         "type": "github"
       },
       "original": {
@@ -675,11 +675,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1785360170,
+        "lastModified": 1780220602,
-        "narHash": "sha256-XE1lKgQ3eIO3E7zWryqcRsax+mYXod/5RHBn4YaR9YE=",
+        "narHash": "sha256-eynAfOmbmxJnkp7YewvCEbShNnnYJ9gLLqkzsYtBPeM=",
         "owner": "numtide",
         "repo": "treefmt-nix",
-        "rev": "d1187f8bc71fb8aab02395869ec3f5c1920f75c0",
+        "rev": "db947814a175b7ca6ded66e21383d938df01c227",
         "type": "github"
       },
       "original": {
@@ -693,11 +693,11 @@
         "nixpkgs": "nixpkgs_7"
       },
       "locked": {
-        "lastModified": 1786154646,
+        "lastModified": 1785555171,
-        "narHash": "sha256-MDOvpk7B1eImC2TQbz4KoqKtYnnXOznGHx+2KaTLJBE=",
+        "narHash": "sha256-MLBtKBAbLXB81qm5UZq7w0IFnP/fh6QWhfU55dA8uFo=",
         "owner": "nix-community",
         "repo": "nix-vscode-extensions",
-        "rev": "7c0ca0a27c2e7338e2c7d61599c0de4873081d7c",
+        "rev": "730fe1d38d63878df9cf6b46b36308d197a9334e",
         "type": "github"
       },
       "original": {

flake.nix

@@ -101,7 +101,7 @@
                 {
                   deployment = {
                     inherit (v) tags;
-                    targetHost = if (v ? "connectAddr") then v.connectAddr else v.nebulaIp;
+                    targetHost = if (v ? "nebulaIp") then v.nebulaIp else v.ts;
                     targetUser = "greg";
                   };
                 }

hosts/unstable/builder2/default.nix

@@ -0,0 +1,60 @@
+{
+  config,
+  metadata,
+  modulesPath,
+  ...
+}:
+{
+  # Then build nixosConfiguration.<host>.config.system.build.images.proxmox
+  # SCP that to /var/lib/vz/dumps on the Proxmox host
+  imports = [ "${modulesPath}/virtualisation/proxmox-image.nix" ];
+  greg = {
+    home = true;
+    nebula.enable = true;
+  };
+  networking = {
+    defaultGateway = metadata.infra.gw;
+    nameservers = [ metadata.infra.dns ];
+    interfaces.ens18 = {
+      useDHCP = false;
+      ipv4.addresses = [
+        {
+          address = metadata.hosts."${config.networking.hostName}".ip;
+          prefixLength = 16;
+        }
+      ];
+    };
+  };
+  virtualisation.diskSize = 20480; # Size in mebbibytes for the base disk image
+  # Use these instead of the above to run an LXC image
+  # The main reason I wouldn't use these is because Proxmox LXC does
+  # not seem to be well supported by either Nebula VPN or Tailscale,
+  # both of which I use for my mesh networking. If there isn't a need
+  # for the service to run on those networks, then by all means go ahead
+  # and use LXC!
+  # imports = [ (modulesPath + "/virtualisation/proxmox-lxc.nix") ];
+  # proxmoxLXC = {
+  #   manageNetwork = false;
+  #   privileged = true;
+  # };
+  # systemd.suppressedSystemUnits = [
+  #   "dev-mqueue.mount"
+  #   "sys-kernel-debug.mount"
+  #   "sys-fs-fuse-connections.mount"
+  # ];
+  nix.settings = {
+    sandbox = false;
+  };
+  services = {
+    fstrim.enable = false; # Let Proxmox host handle fstrim
+    openssh = {
+      enable = true;
+      openFirewall = true;
+      settings = {
+        PermitRootLogin = "yes";
+        PasswordAuthentication = true;
+        PermitEmptyPasswords = "yes";
+      };
+    };
+  };
+}

hosts/unstable/genesis/net/hosts

@@ -1,11 +1,12 @@
 # Local hosts
 10.42.0.1 switch switch.thehellings.lan  # Core switch for the network
 10.42.0.3 ap ap.thehellings.lan  # OpenWRT access point (static IP)
-10.42.0.4 pve1.thehellings.lan  # Proxmox
+10.42.0.4 joel.thehellings.lan  # Proxmox
 10.42.0.5 sanswitch.thehellings.lan  # Core switch for the SAN
 
 # Home servers
-10.42.1.1 udm router udm.thehellings.lan router.thehellings.lan  # Ubiquiti UDM gateway
+10.42.1.1 pve1.thehellings.lan
+10.42.1.2 opnsense router opnsense.thehellings.lan router.thehellings.lan
 10.42.1.3 printer.thehellings.lan
 10.42.1.4 chronicles chronicles.thehellings.lan nas.thehellings.lan s3.thehellings.lan
 10.42.1.5 genesis genesis.thehellings.lan dns dns.thehellings.lan smart smart.thehellings.lan speedtest.thehellings.lan nixcache.thehellings.lan gitcache.thehellings.lan

hosts/unstable/genesis/networking.nix

@@ -77,7 +77,7 @@ in
       };
     };
     firewall = {
-      enable = true;
+      enable = false;
       allowedUDPPorts = [
         dhcpPort
         dnsPort
@@ -88,7 +88,7 @@ in
         80
       ];
     };
-    nftables.enable = true;
+    nftables.enable = false;
   };
 
   environment.etc."hosts.d/local".text = extraHosts;

hosts/unstable/genesis/networking/dhcp.nix

@@ -60,7 +60,7 @@
         reservations = [
           # Static IPs for personal work
           {
-            hw-address = "00:23:24:72:64:32"; # PVE1
+            hw-address = "00:23:24:72:64:32"; # Joel
             ip-address = "10.42.0.4";
           }
           {
@@ -76,6 +76,10 @@
             #ip-address = "10.42.2.253";
             ip-address = "10.42.100.6";
           }
+          {
+            hw-address = "7c:83:34:b9:ee:ec"; # PVE1
+            ip-address = "10.42.1.1";
+          }
           {
             hw-address = "74:ee:2a:66:b3:51"; # printer
             ip-address = "10.42.1.3";

hosts/unstable/isaiah/default.nix

@@ -47,10 +47,6 @@
       enable = true;
       extraLabels = [ "bare-metal:host" ];
     };
-    vmdev = {
-      enable = true;
-      host = "libvirt";
-    };
   };
 
   networking = {

hosts/unstable/linode/default.nix

@@ -1,9 +1,8 @@
 {
-  config,
-  lib,
-  metadata,
   pkgs,
   pkgs',
+  lib,
+  config,
   ...
 }:
 
@@ -11,21 +10,6 @@ let
   homepage = "127.0.0.1:30080";
   nextcloudPort = 8080;
   sshPort = 2222;
-  matrixServer = pkgs.writeText "matrix_server" (
-    builtins.toJSON {
-      "m.server" = "matrix.thehellings.com:443";
-    }
-  );
-  matrixClient = pkgs.writeText "matrix_client" (
-    builtins.toJSON {
-      "m.homeserver" = {
-        base_url = "https://matrix.thehellings.com";
-      };
-      "m.identity_server" = {
-        base_url = "https://vector.im";
-      };
-    }
-  );
 in
 {
   imports = [
@@ -75,11 +59,10 @@ in
       };
     };
     gitea-runner = {
-      enable = true;
+      enable = false;
-      labels = [
+      extraLabels = [
         "vps:host"
         "blog:host"
-        "nixos-linode:host"
       ];
     };
     home = false;
@@ -87,12 +70,6 @@ in
     nebula = {
       enable = true;
       isLighthouse = true;
-      unsafeRoutes = [
-        {
-          route = "10.42.0.0/16";
-          via = metadata.hosts.genesis.nebulaIp;
-        }
-      ];
     };
     tailscale.enable = true;
   };
@@ -149,7 +126,7 @@ in
             COOKIE_DOMAIN = "thehellings.com";
             SERVE_ROBOTS_TXT = true;
             SLOG_LEVEL = "DEBUG";
-            TARGET = "http://git.k3s.thehellings.lan";
+            TARGET = "http://git.k3s.nebula.thehellings.com";
           };
         };
       };
@@ -172,9 +149,9 @@ in
           bind *:${toString sshPort}
           timeout client 1h
           mode tcp
-          server git-isaiah isaiah.thehellings.lan:32222
+          server git-isaiah isaiah.nebula.thehellings.com:32222
-          server git-jeremiah jeremiah.thehellings.lan:32222
+          server git-jeremiah jeremiah.nebula.thehellings.com:32222
-          server git-zeke zeke.thehellings.lan:32222
+          server git-zeke zeke.nebula.thehellings.com:32222
 
         frontend https
           bind *:80
@@ -198,8 +175,6 @@ in
           use_backend next if { req_ssl_sni -i next.thehellings.com }
           use_backend matrix if { hdr(host) -i matrix.thehellings.com }
           use_backend matrix if { req_ssl_sni -i matrix.thehellings.com }
-          use_backend immich if { hdr(host) -i immich.thehellings.com }
-          use_backend immich if { req_ssl_sni -i immich.thehellings.com }
           use_backend web if { hdr(host) -i thehellings.com }
           use_backend web if { req_ssl_sni -i thehellings.com }
 
@@ -209,18 +184,10 @@ in
           option accept-unsafe-violations-in-http-response
           retries 3
           option forwardfor
-          http-request set-header Host git.k3s.thehellings.lan
+          http-request set-header Host git.k3s.nebula.thehellings.com
-          server git-isaiah isaiah.thehellings.lan:80
+          server git-isaiah isaiah.nebula.thehellings.com:80
-          server git-jeremiah jeremiah.thehellings.lan:80
+          server git-jeremiah jeremiah.nebula.thehellings.com:80
-          server git-zeke zeke.thehellings.lan:80
+          server git-zeke zeke.nebula.thehellings.com:80
-
-        backend immich
-          mode http
-          balance roundrobin
-          option accept-unsafe-violations-in-http-response
-          retries 3
-          option forwardfor
-          server immich-proxy 127.0.0.1:${builtins.toString config.services.immich-public-proxy.port}
 
         backend matrix
           mode http
@@ -228,10 +195,10 @@ in
           option accept-unsafe-violations-in-http-response
           retries 3
           option forwardfor
-          http-request set-header Host matrix.k3s.thehellings.lan
+          http-request set-header Host matrix.k3s.nebula.thehellings.com
-          server git-isaiah isaiah.thehellings.lan:80
+          server git-isaiah isaiah.nebula.thehellings.com:80
-          server git-jeremiah jeremiah.thehellings.lan:80
+          server git-jeremiah jeremiah.nebula.thehellings.com:80
-          server git-zeke zeke.thehellings.lan:80
+          server git-zeke zeke.nebula.thehellings.com:80
 
         backend web
           mode http
@@ -239,8 +206,6 @@ in
           option accept-unsafe-violations-in-http-response
           retries 3
           option forwardfor
-          http-request return status 200 content-type "application/json" file ${matrixClient} hdr "cache-control" "no-cache" if { path /.well-known/matrix/client }
-          http-request return status 200 content-type "application/json" file ${matrixServer} hdr "cache-control" "no-cache" if { path /.well-known/matrix/server }
           server web-container ${homepage}
 
         backend next
@@ -257,7 +222,7 @@ in
 
     immich-public-proxy = {
       enable = true;
-      immichUrl = "http://immich.k3s.thehellings.lan";
+      immichUrl = "https://immich.shire-zebra.ts.net";
     };
 
     logrotate = {
@@ -280,7 +245,7 @@ in
       enable = true;
       package = pkgs.nextcloud33;
       appstoreEnable = true;
-      hostName = "127.0.0.1";
+      hostName = "localhost";
       https = false;
       config = {
         adminpassFile = config.age.secrets.nextcloudadmin.path;
@@ -361,7 +326,7 @@ in
   virtualisation.oci-containers = {
     backend = "podman";
     containers."homepage" = {
-      image = "src.thehellings.com/greg/homepage:latest";
+      image = "registry.thehellings.com:443/greg/homepage/gregs-homepage:latest";
       ports = [ "${homepage}:80" ];
     };
   };

hosts/unstable/zeke/default.nix

@@ -32,10 +32,6 @@
       enable = true;
       tags = [ "home" ];
     };
-    vmdev = {
-      enable = true;
-      host = "vbox";
-    };
   };
 
   hardware = {
@@ -75,4 +71,10 @@
   users.users.greg.extraGroups = [
     "podman"
   ];
+
+  # virtualisation.virtualbox.host = {
+  #   enableExtensionPack = true;
+  #   headless = true;
+  #   enableWebService = true;
+  # };
 }

manifests/donetick/configmap.yaml

@@ -0,0 +1,79 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: donetick-config
+  namespace: donetick
+data:
+  # Value pulled from
+  # https://github.com/donetick/donetick/blob/main/config/selfhosted.yaml
+  selfhosted.yaml: |-
+    name: "selfhosted"
+    is_done_tick_dot_com: false
+    is_user_creation_disabled: false
+    telegram:
+      token: ""
+    pushover:
+      token: ""
+    database:
+      type: "sqlite"
+      migration: true
+      # these are only required for postgres
+      host: "secret"
+      port: 5432
+      user: "secret"
+      password: "secret"
+      name: "secret"
+    jwt:
+      secret: "This is really a secure JWT secret now!"
+      session_time: 168h
+      max_refresh: 168h
+    server:
+      port: 2021
+      read_timeout: 10s
+      write_timeout: 10s
+      rate_period: 60s
+      rate_limit: 300
+      cors_allow_origins:
+        - "http://localhost:5173"
+        - "http://localhost:7926"
+        # the below are required for the android app to work
+        - "https://localhost"
+        - "capacitor://localhost"
+      serve_frontend: true
+    logging:
+      level: "info"
+      encoding: "json"
+      development: false
+    scheduler_jobs:
+      due_job: 30m
+      overdue_job: 3h
+      pre_due_job: 3h
+    email:
+      host:
+      port:
+      key:
+      email:
+      appHost:
+    oauth2:
+      client_id:
+      client_secret:
+      auth_url:
+      token_url:
+      user_info_url:
+      redirect_url:
+      name:
+    # Real-time configuration
+    realtime:
+      enabled: true
+      sse_enabled: true
+      heartbeat_interval: 60s
+      connection_timeout: 120s
+      max_connections: 1000
+      max_connections_per_user: 5
+      event_queue_size: 2048
+      cleanup_interval: 2m
+      stale_threshold: 5m
+      enable_compression: true
+      enable_stats: true
+      allowed_origins:
+        - "*"

manifests/donetick/deployment.yaml

@@ -0,0 +1,38 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: donetick
+  namespace: donetick
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: donetick
+  template:
+    metadata:
+      labels:
+        app: donetick
+    spec:
+      containers:
+        - name: donetick
+          image: donetick/donetick
+          ports:
+            - containerPort: 2021
+              name: http
+          env:
+            - name: DT_ENV
+              value: "selfhosted"
+            - name: DT_SQLITE_PATH
+              value: "/data/donetick.db"
+          volumeMounts:
+            - name: config
+              mountPath: /config
+            - name: data
+              mountPath: /data
+      volumes:
+        - name: config
+          configMap:
+            name: donetick-config
+        - name: data
+          persistentVolumeClaim:
+            claimName: donetick-data

manifests/donetick/ingress.yaml

@@ -0,0 +1,15 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: donetick-tailscale
+  namespace: donetick
+spec:
+  ingressClassName: tailscale
+  defaultBackend:
+    service:
+      name: donetick
+      port:
+        number: 2021
+  tls:
+    - hosts:
+        - todo

manifests/donetick/kustomization.yaml

@@ -0,0 +1,9 @@
+namespace: donetick
+
+resources:
+  - namespace.yaml
+  - configmap.yaml
+  - pvc.yaml
+  - deployment.yaml
+  - service.yaml
+  - ingress.yaml

manifests/donetick/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: donetick

manifests/donetick/pvc.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: donetick-data
+  namespace: donetick
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 5Gi

manifests/donetick/service.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: donetick
+  namespace: donetick
+spec:
+  selector:
+    app: donetick
+  ports:
+    - name: http
+      port: 2021
+      targetPort: 2021
+      protocol: TCP

manifests/gitea-runner/chart.yaml

@@ -0,0 +1,56 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: gitea
+spec:
+  interval: "24h"
+  url: https://dl.gitea.com/charts/
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: gitea-runner
+  namespace: gitea-runner
+spec:
+  interval: 10m
+  chart:
+    spec:
+      chart: actions
+      version: "0.0.4"
+      sourceRef:
+        kind: HelmRepository
+        name: gitea
+      interval: "1h"
+  values:
+    rbac:
+      create: true
+    serviceAccount:
+      create: true
+    gitea:
+      instanceURL: https://src.thehellings.com
+      runnerToken:
+        existingSecret: gitea-runner
+        existingSecretKey: token
+    imagePullSecrets:
+      - name: image-pull-secrets
+    config:
+      runner:
+        labels:
+          # Ubuntu
+          - "ubuntu-22.04:docker://ubuntu:22.04"
+          - "ubuntu-24.04:docker://ubuntu:24.04"
+          - "ubuntu-24.10:docker://ubuntu:24.10"
+          # Fedora
+          - "fedora-41:docker://fedora:41"
+          - "fedora-42:docker://fedora:42"
+          # CentOS Stream
+          - "centos-stream-9:docker://quay.io/centos/centos:stream9"
+          - "centos-stream-10:docker://quay.io/centos/centos:stream10"
+          # Nix
+          - "nix:docker://nixos/nix:latest"
+          # ci-images (internal registry: src.thehellings.com/greg)
+          - "ci-builder:docker://src.thehellings.com/greg/builder:latest"
+          - "ci-vm-test:docker://src.thehellings.com/greg/vm-test:latest"
+          - "ci-sword:docker://src.thehellings.com/greg/sword-container-builder:latest"
+          - "ci-bitwarden:docker://src.thehellings.com/greg/bitwarden:latest"
+          - "ci-immich:docker://src.thehellings.com/greg/immich:latest"

manifests/gitea-runner/kustomization.yaml

@@ -0,0 +1,6 @@
+namespace: gitea-runner
+
+resources:
+  - namespace.yaml
+  - secrets.yaml
+  - chart.yaml

manifests/gitea-runner/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: gitea-runner

manifests/gitea-runner/secrets.yaml

@@ -0,0 +1,18 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: gitea-runner
+  namespace: gitea-runner
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: bitwarden-login
+    kind: ClusterSecretStore
+  target:
+    name: gitea-runner
+    creationPolicy: Owner
+  data:
+    - secretKey: token
+      remoteRef:
+        key: 11419680-5338-4f19-bdd9-b422007046af
+        property: password

manifests/gitea/chart.yaml

@@ -15,7 +15,7 @@ spec:
   chart:
     spec:
       chart: gitea
-      version: "12.7.0"
+      version: "12.6.0"
       sourceRef:
         kind: HelmRepository
         name: gitea-repository
@@ -35,7 +35,7 @@ spec:
       storageClass: longhorn-default
 
     image:
-      tag: "1.27.1"
+      tag: "1.26.2"
 
     replicaCount: 1
 
@@ -67,7 +67,7 @@ spec:
           RUN_MODE: dev
         server:
           DOMAIN: "shire-zebra.ts.net"
-          ROOT_URL: "https://git.k3s.thehellings.lan"
+          ROOT_URL: "https://gitea.shire-zebra.ts.net"
           SSH_PORT: "2222"
         database:
           DB_TYPE: postgres
@@ -85,15 +85,15 @@ spec:
           DISABLE_REGISTRATION: "true"
         storage:
           STORAGE_TYPE: minio
-          MINIO_ENDPOINT: "nas1.shire-zebra.ts.net:30188"
+          MINIO_ENDPOINT: "nas1.shire-zebra.ts.net:9000"
           MINIO_BUCKET: gitea
-          MINIO_LOCATION: garage
+          MINIO_LOCATION: us-east-1
           # MINIO_ACCESS_KEY_ID: ""
           # MINIO_SECRET_ACCESS_KEY: ""
           MINIO_USE_SSL: "false"
           MINIO_INSECURE_SKIP_VERIFY: "true"
-        security:
+        webhook:
-          ALLOWED_HOST_LIST: loopback,private,*.shire-zebra.ts.net,*.nebula.thehellings.com,*.thehellings.lan
+          ALLOWED_HOST_LIST: loopback,private,*.shire-zebra.ts.net
 
       metrics:
         enabled: false
@@ -102,8 +102,8 @@ spec:
 
     persistence:
       enabled: true
-      create: false
+      storageClass: longhorn-default
-      claimName: gitea-new
+      size: "50Gi"
 
     # I will manage my Postgres externally
     postgresql:

manifests/gitea/dump-cronjob.yaml

@@ -18,12 +18,12 @@ spec:
           volumes:
             - name: gitea-data
               persistentVolumeClaim:
-                claimName: gitea-new
+                claimName: gitea-shared-storage
             - name: dump-staging
               emptyDir: {}
           initContainers:
             - name: gitea-dump
-              image: "gitea/gitea:1.27.1"
+              image: "gitea/gitea:1.25.4"
               command:
                 - /bin/sh
                 - "-c"
@@ -51,12 +51,12 @@ spec:
                 - |
                   set -e
                   # Configure mc alias for MinIO
-                  mc alias set nas1 http://nas1.shire-zebra.ts.net:30188 \
+                  mc alias set nas1 http://nas1.shire-zebra.ts.net:9000 \
                     "${MINIO_ACCESS_KEY}" "${MINIO_SECRET_KEY}"
                   # Upload dump to backup-gitea bucket
                   DUMP_FILE=$(ls /dump-staging/gitea-dump-*.zip | head -1)
-                  mc cp "${DUMP_FILE}" "nas1/gitea-backup/$(basename ${DUMP_FILE})"
+                  mc cp "${DUMP_FILE}" "nas1/backup-gitea/$(basename ${DUMP_FILE})"
-                  echo "Uploaded $(basename ${DUMP_FILE}) to gitea-backup"
+                  echo "Uploaded $(basename ${DUMP_FILE}) to backup-gitea"
                   # Set 30-day lifecycle on the bucket (idempotent)
                   mc ilm rule add --expire-days 30 nas1/backup-gitea 2>/dev/null || true
               volumeMounts:
@@ -69,10 +69,10 @@ spec:
                 - name: MINIO_ACCESS_KEY
                   valueFrom:
                     secretKeyRef:
-                      name: gitea-backup
+                      name: gitea-config
                       key: minio_key
                 - name: MINIO_SECRET_KEY
                   valueFrom:
                     secretKeyRef:
-                      name: gitea-backup
+                      name: gitea-config
                       key: minio_secret

manifests/gitea/ingress.yaml

@@ -19,7 +19,7 @@ metadata:
   name: gitea-direct
 spec:
   rules:
-    - host: git.k3s.thehellings.lan
+    - host: git.k3s.nebula.thehellings.com
       http:
         paths:
           - path: /

manifests/gitea/secrets.yaml

@@ -1,32 +1,5 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
-metadata:
-  name: gitea-backup
-spec:
-  target:
-    name: gitea-backup
-    deletionPolicy: Delete
-    template:
-      type: Opaque
-      data:
-        minio_key: "{{ .minio_key }}"
-        minio_secret: "{{ .minio_secret }}"
-  secretStoreRef:
-    name: bitwarden-login
-    kind: ClusterSecretStore
-  data:
-    # MinIO credentials
-    - secretKey: minio_key
-      remoteRef:
-        key: dfb2f0c8-110d-4e96-83a7-b49c001c0897
-        property: username
-    - secretKey: minio_secret
-      remoteRef:
-        key: dfb2f0c8-110d-4e96-83a7-b49c001c0897
-        property: password
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
 metadata:
   name: gitea-config
 spec:
@@ -48,14 +21,23 @@ spec:
     name: bitwarden-login
     kind: ClusterSecretStore
   data:
+    # MinIO credentials
+    - secretKey: minio_key
+      remoteRef:
+        key: dcbcf704-7dce-48d7-bbd1-b3a801875b3d
+        property: username
+    - secretKey: minio_secret
+      remoteRef:
+        key: dcbcf704-7dce-48d7-bbd1-b3a801875b3d
+        property: password
     # MinIO credentials for NAS1
     - secretKey: minio_nas1_key
       remoteRef:
-        key: 33e8e4e0-eb90-484c-9ec9-b3a8018077a3
+        key: c4c66ab3-2ade-4086-9c0d-b3a80172b1ba
         property: username
     - secretKey: minio_nas1_secret
       remoteRef:
-        key: 33e8e4e0-eb90-484c-9ec9-b3a8018077a3
+        key: c4c66ab3-2ade-4086-9c0d-b3a80172b1ba
         property: password
     # Postgres credentials
     - secretKey: dbuser

manifests/helm/longhorn.yaml

@@ -27,7 +27,7 @@ spec:
   chart:
     spec:
       chart: longhorn
-      version: "1.11.3"
+      version: "1.11.2"
       sourceRef:
         kind: HelmRepository
         name: longhorn
@@ -141,10 +141,6 @@ spec:
                   number: 80
     - <<: *host
       host: longhorn.kubernetes
-    - <<: *host
-      host: longhorn.k3s.nebula.thehellings.com
-    - <<: *host
-      host: longhorn.k3s.thehellings.lan
 ---
 apiVersion: storage.k8s.io/v1
 kind: StorageClass

manifests/immich/backup.yaml

@@ -33,24 +33,24 @@ spec:
         access-key: "{{ .minio_key }}"
         secret-key: "{{ .minio_secret }}"
         rclone.conf: |
-          [garage]
+          [nas1minio]
           type = s3
           provider = Minio
-          endpoint = http://nas1.shire-zebra.ts.net:30188
+          endpoint = http://nas1.shire-zebra.ts.net:9000
           access_key_id = {{ .minio_key }}
           secret_access_key = {{ .minio_secret }}
-          region = garage
+          region = us-east-1
   secretStoreRef:
     name: bitwarden-login
     kind: ClusterSecretStore
   data:
     - secretKey: minio_key
       remoteRef:
-        key: 8fce2750-aa62-4892-b90c-b49c001f494b
+        key: c4c66ab3-2ade-4086-9c0d-b3a80172b1ba
         property: username
     - secretKey: minio_secret
       remoteRef:
-        key: 8fce2750-aa62-4892-b90c-b49c001f494b
+        key: c4c66ab3-2ade-4086-9c0d-b3a80172b1ba
         property: password
 ---
 apiVersion: v1
@@ -128,7 +128,7 @@ spec:
                     --progress \
                     --transfers 4 \
                     --checkers 8 \
-                    /staging garage:immich
+                    /staging nas1minio:immich
               volumeMounts:
                 - name: staging
                   mountPath: /staging

manifests/immich/chart.yaml

@@ -32,7 +32,7 @@ spec:
         containers:
           main:
             image:
-              tag: v3.1.0
+              tag: v2.7.5
             env:
               DB_HOSTNAME: immich-rw
               DB_DATABASE_NAME: immich

manifests/immich/ingress.yaml

@@ -22,10 +22,6 @@ spec:
                 name: immich-server
                 port:
                   name: http
-    - <<: *host
-      host: immich.k3s.nebula.thehellings.com
-    - <<: *host
-      host: immich.k3s.thehellings.lan
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress

manifests/kustomization.yaml

@@ -10,4 +10,7 @@ resources:
   - immich
   - monitoring
   - pinchflat
+  - smokeping
+  - uptimekuma
+  - donetick
   - gitea

manifests/matrix/ingress.yaml

@@ -20,7 +20,7 @@ metadata:
   name: matrix-direct
 spec:
   rules:
-    - host: matrix.k3s.thehellings.lan
+    - host: matrix.k3s.nebula.thehellings.com
       http:
         paths:
           - path: /

manifests/monitoring/config.yaml

@@ -51,8 +51,8 @@ data:
         static_configs:
           - targets:
               - "10.42.0.3"    # OpenWRT access point
-              - "10.42.0.4"    # pve1 (Proxmox)
+              - "10.42.0.4"    # Joel (Proxmox)
-              - "10.42.1.1"    # UDM gateway (Ubiquiti)
+              - "10.42.1.1"    # pve1 (Proxmox)
               - "10.42.1.4"    # chronicles (Synology NAS)
               - "10.42.1.14"   # nas1 (TrueNAS)
               - "10.42.2.57"   # odoo

manifests/smokeping/deployment.yaml

@@ -0,0 +1,50 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: smokeping
+  labels:
+    app: smokeping
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: smokeping
+  template:
+    metadata:
+      labels:
+        app: smokeping
+    spec:
+      containers:
+        - name: smokeping
+          image: docker.io/linuxserver/smokeping:2.9.0
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: http
+              containerPort: 80
+              protocol: TCP
+          volumeMounts:
+            - name: config
+              mountPath: /config
+            - name: data
+              mountPath: /data
+          env:
+            - name: PUID
+              value: "1000"
+            - name: PGID
+              value: "1000"
+            - name: TZ
+              value: "America/Chicago"
+            #- name: MASTER_URL
+            #  value: "https://ping.shire-zebra.ts.net"
+            # SHARED_SECRET if you want to run a cluster
+            # CACHE_DIR if you need to explicitly state that
+      restartPolicy: Always
+      volumes:
+        - name: config
+          persistentVolumeClaim:
+            claimName: smokeping-config
+        - name: data
+          persistentVolumeClaim:
+            claimName: smokeping-data

manifests/smokeping/ingress.yaml

@@ -0,0 +1,14 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: smokeping-tailscale
+spec:
+  ingressClassName: tailscale
+  defaultBackend:
+    service:
+      name: smokeping
+      port:
+        name: http
+  tls:
+    - hosts:
+        - ping

manifests/smokeping/kustomization.yaml

@@ -0,0 +1,8 @@
+namespace: smokeping
+
+resources:
+  - namespace.yaml
+  - pvc.yaml
+  - deployment.yaml
+  - service.yaml
+  - ingress.yaml

manifests/smokeping/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: smokeping

manifests/smokeping/pvc.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: smokeping-config
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn-default
+  resources:
+    requests:
+      storage: 1Gi
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: smokeping-data
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn-default
+  resources:
+    requests:
+      storage: 25Gi

manifests/smokeping/service.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: smokeping
+  labels:
+    app: smokeping
+spec:
+  type: ClusterIP
+  ports:
+    - port: 80
+      targetPort: http
+      protocol: TCP
+      name: http
+  selector:
+    app: smokeping

manifests/uptimekuma/chart.yaml

@@ -0,0 +1,38 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: uptime-kuma
+  namespace: uptime-kuma
+spec:
+  interval: "24h"
+  url: "https://helm.irsigler.cloud"
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: uptime-kuma
+  namespace: uptime-kuma
+spec:
+  interval: 10m
+  chart:
+    spec:
+      chart: uptime-kuma
+      sourceRef:
+        kind: HelmRepository
+        name: uptime-kuma
+      interval: "1h"
+  dependsOn:
+    - name: longhorn
+      namespace: longhorn-system
+    - name: mariadb-cluster
+      namespace: mariadb-operator
+  values:
+    volume:
+      storageClassName: longhorn-default
+    image:
+      tag: "2.0.2"
+    externalDatabase:
+      enabled: true
+      hostname: mariadb-cluster.mariadb-operator.svc.cluster.local
+      database: uptimekuma
+      existingSecret: uptimekuma-mariadb-password

manifests/uptimekuma/ingress.yaml

@@ -0,0 +1,15 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: uptime-kuma-tailscale
+  namespace: uptime-kuma
+spec:
+  ingressClassName: tailscale
+  defaultBackend:
+    service:
+      name: uptime-kuma
+      port:
+        number: 3001
+  tls:
+    - hosts:
+        - kuma

manifests/uptimekuma/kustomization.yaml

@@ -0,0 +1,7 @@
+namespace: uptimekuma
+
+resources:
+  - namespace.yaml
+  - secrets.yaml
+  - chart.yaml
+  - ingress.yaml

manifests/uptimekuma/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: uptimekuma

manifests/uptimekuma/secrets.yaml

@@ -0,0 +1,27 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: uptimekuma-mariadb-password
+spec:
+  target:
+    name: uptimekuma-mariadb-password
+    deletionPolicy: Delete
+    template:
+      type: kubernetes.io/basic-auth
+      data:
+        username: |-
+          {{ .username }}
+        password: |-
+          {{ .password }}
+  secretStoreRef:
+    name: bitwarden-login
+    kind: ClusterSecretStore
+  data:
+    - secretKey: username
+      remoteRef:
+        key: 4df95656-9f9c-4916-8e34-b3a200376365
+        property: username
+    - secretKey: password
+      remoteRef:
+        key: 4df95656-9f9c-4916-8e34-b3a200376365
+        property: password

modules/hm/gui/bookmarks.nix

@@ -230,7 +230,7 @@
             bookmarks = [
               {
                 name = "PVE1";
-                url = "https://10.42.0.4:8006/";
+                url = "https://10.42.1.1:8006/";
               }
               {
                 name = "Jeremiah";

modules/nixos/gitea-runner.nix

@@ -98,19 +98,6 @@ in
         inherit labels;
         inherit (cfg) name;
         enable = true;
-        hostPackages = with pkgs; [
-          bash
-          buildah
-          coreutils
-          curl
-          gawk
-          gitMinimal
-          gnused
-          nix
-          nodejs
-          podman
-          wget
-        ];
         url = cfg.instanceURL;
         tokenFile = config.age.secrets."gitea-runner-${host}-podman".path;
         settings = {

modules/nixos/kubernetes.nix

@@ -15,6 +15,8 @@ let
     sha256 = "sha256-Qs1qJmgZm8q9xZsORjT/N/wzpbWVVODXtzDpjnAYMuQ=";
   };
   keepaliveIp = "10.42.5.1";
+  nebulaName = "k3s.nebula.thehellings.com";
+  nebulaIp = "10.157.100.1";
 in
 {
   options.greg = {
@@ -44,6 +46,13 @@ in
   };
 
   config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = config.greg.nebula.enable;
+        message = "Configure Nebula for this host, first";
+      }
+    ];
+
     age.secrets = {
       bw_secret.file = ../../secrets/kubernetes/bw_secret.age;
       dendrite_key.file = ../../secrets/dendrite_key.age;
@@ -97,6 +106,8 @@ in
           "--tls-san ${config.networking.hostName}.thehellings.lan"
           "--tls-san ${config.networking.hostName}.shire-zebra.ts.net"
           "--tls-san ${keepaliveIp}"
+          "--tls-san ${nebulaName}"
+          "--tls-san ${nebulaIp}"
         ];
         manifests = {
           cert-manager.source = cert-manager;
@@ -128,6 +139,21 @@ in
               advert_int 1
             '';
           };
+          k3s-nebula = {
+            interface = "nebula0";
+            priority = 1;
+            state = if (config.networking.hostName == "isaiah") then "MASTER" else "BACKUP";
+            virtualIps = [
+              {
+                addr = "${nebulaIp}/16";
+                dev = "nebula0";
+              }
+            ];
+            virtualRouterId = 78;
+            extraConfig = ''
+              advert_int 1
+            '';
+          };
         };
       };
       openiscsi = {

modules/nixos/vmdev.nix

@@ -23,13 +23,6 @@ with lib;
         type = types.str;
         description = "Kernel module type to install - amd, intel, etc";
       };
-      host = mkOption {
-        type = types.enum [
-          "libvirt"
-          "vbox"
-        ];
-        description = "Which VM hosting type to configure";
-      };
     };
   };
 
@@ -42,6 +35,7 @@ with lib;
       nixos-generators
       packer
       swtpm
+      virt-manager
       virtio-win
       xorriso
     ];
@@ -50,7 +44,7 @@ with lib;
 
     # Enable the virtualisation services
     virtualisation = {
-      libvirtd = mkIf (cfg.host == "libvirt") {
+      libvirtd = {
         enable = true;
         onBoot = "ignore"; # Do not auto-restart VMs on boot, unless they are marked autostart
         qemu = {
@@ -60,11 +54,6 @@ with lib;
           };
         };
       };
-      virtualbox.host = mkIf (cfg.host == "vbox") {
-        enable = true;
-        enableExtensionPack = true;
-        headless = true;
-      };
     };
 
     boot.extraModprobeConfig = "options kvm_${cfg.system} nested=1";

network.json

@@ -86,7 +86,6 @@
       "system": "aarch64-darwin"
     },
     "linode": {
-      "connectAddr": "thehellings.com",
       "ip": null,
       "pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMv9Zud3kZOl86gtmkn+uj3D4kiXWDPtyUL02VVLNR4Q",
       "ts": "100.109.86.8",
@@ -135,6 +134,9 @@
       "pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILFYyzz/9i5rXprCQj9IL1ulrbQ6E9BOSeOcvf4D/b0G",
       "tags": ["server"]
     },
+    "joel": {
+      "ip": "10.42.0.4"
+    },
     "k3s": {
       "aliases": ["*.k3s"],
       "ip": "10.42.5.1",
@@ -148,9 +150,6 @@
     "printer": {
       "ip": "10.42.1.3"
     },
-    "pve1": {
-      "ip": "10.42.0.4"
-    },
     "pve2": {
       "ip": "10.42.1.15"
     },

secrets/nebula/isaiah.crt

@@ -1,6 +1,6 @@
 -----BEGIN NEBULA CERTIFICATE V2-----
-MIGloD+ABmlzYWlhaKEHBAUKnQAEEIUEanOBO4YEa668pYcgg4lMYGB2VakRFO6b
+MIGsoEaABmlzYWlhaKEOBAUKnQAEEAQFCp1kARCFBGplFeuGBGuuvKWHIIOJTGBg
-K9vHSLzjZpuqhBVQ7MReOwUHQKyCIOhUElXVoqzDIo+rUThkf0fbW3HYgHSkp8So
+dlWpERTumyvbx0i842abqoQVUOzEXjsFB0CsgiDoVBJV1aKswyKPq1E4ZH9H21tx
-1V04tV51g0AXR6vPKFhC1rfiDtslbhxwBNYgiUrRDxcNiAYAQFCyjTijj2+tqxyD
+2IB0pKfEqNVdOLVedYNAjZSaY/IreMGnplY6txmSNuqSpFe1UTEDu4MOGSeZTKsO
-pwL29i7NlcW+QgBxmtiSf8UW06MbzOkF
+71y33z4AWsexnDD2ItFLT2rA5EgbApacaYF0AxtSCQ==
 -----END NEBULA CERTIFICATE V2-----

secrets/nebula/jeremiah.crt

@@ -1,6 +1,6 @@
 -----BEGIN NEBULA CERTIFICATE V2-----
-MIGnoEGACGplcmVtaWFooQcEBQqdAAUQhQRqc4EPhgRrrrylhyCDiUxgYHZVqREU
+MIGuoEiACGplcmVtaWFooQ4EBQqdAAUQBAUKnWQBEIUEamUYxYYEa668pYcgg4lM
-7psr28dIvONmm6qEFVDsxF47BQdArIIgEcrTTRT0HRNWO6hNoyFBkWLxwrK3DyKz
+YGB2VakRFO6bK9vHSLzjZpuqhBVQ7MReOwUHQKyCIBHK000U9B0TVjuoTaMhQZFi
-ZypRbhcAQ0GDQNX6euu+o8qczoXIHt7hfpbVc57YvtYQZ1v350iiyNhM0I0oZsV9
+8cKytw8is2cqUW4XAENBg0CLM+fuJcMVMbk6VHmRhko4KUTaQzWG2dggEwskTWCf
-oVEBR9rg39/lsXjFX6UtC/H3RKo+arlhDQ4=
+IPXiTY2L/hInHSGFynIIe+Ux9hSRJ1W1KF4J8jq5LBwN
 -----END NEBULA CERTIFICATE V2-----

secrets/nebula/zeke.crt

@@ -1,6 +1,6 @@
 -----BEGIN NEBULA CERTIFICATE V2-----
-MIGjoD2ABHpla2WhBwQFCp0ABhCFBGpzgSyGBGuuvKWHIIOJTGBgdlWpERTumyvb
+MIGqoESABHpla2WhDgQFCp0ABhAEBQqdZAEQhQRqZRi1hgRrrrylhyCDiUxgYHZV
-x0i842abqoQVUOzEXjsFB0CsgiD4WYoZNy8i9RwV1yC4RNHJufeOHnyMkvpfkEdy
+qREU7psr28dIvONmm6qEFVDsxF47BQdArIIg+FmKGTcvIvUcFdcguETRybn3jh58
-avE5Y4NAVS1PQZIausgi1JekcdvwJ/+G64bLjzjznKD72u4XJfl7WKaO1O+RYOf7
+jJL6X5BHcmrxOWODQCfB4+92Zs/315a6I60PXsUaw3Jk0MQPLUuHykTO19imWsYa
-/2YdsUCODDzoGjdEtrQVftiz8RxRBg==
+DyKFlk26ePhczGlhO2svq9J8p0zce0w+TPveOw8=
 -----END NEBULA CERTIFICATE V2-----