feat: Gitea Actions shell runners + flake-lock workflow

- Add modules/nixos/gitea-runner.nix: NixOS module for act_runner in
  shell mode, with options for enable, instanceURL, name, labels, and
  tokenFile (agenix secret path).
- Deploy gitea-runner to jeremiah, isaiah, zeke, and linode with
  appropriate labels. Agenix secret placeholders left with TODOs.
- Add .gitea/workflows/update-flake-lock.yaml: weekly workflow (Sunday
  midnight) that runs nix flake update and opens a PR if flake.lock
  changed, using GITEA_TOKEN secret for authentication.

Closes part of #15 (NixOS shell runners + flake-lock workflow).

.gitea/workflows/update-flake-lock.yaml

@@ -1,51 +1,57 @@
 name: Update flake.lock
 
-"on":
+on:
   schedule:
-    - cron: "0 0 * * 0"  # Every Sunday at midnight UTC
+    - cron: '0 0 * * 0'  # Every Sunday at midnight UTC
   workflow_dispatch:
 
 jobs:
   update-flake-lock:
-    runs-on: nix-latest
+    runs-on: [self-hosted, bare-metal]
+    container:
+      image: nixos/nix:latest
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Configure Nix
+        run: |
+          mkdir -p /etc/nix
+          echo "experimental-features = nix-command flakes" >> /etc/nix/nix.conf
+
       - name: Update flake.lock
         run: nix flake update
 
-      - name: Create PR if changed
+      - name: Check for changes
-        env:
+        id: changes
-          GITEA_TOKEN: ${{ secrets.KLAATU_TOKEN }}
-          GITEA_URL: https://src.thehellings.com
-          REPO: greg/nixos
         run: |
           if git diff --quiet flake.lock; then
-            echo "flake.lock unchanged, nothing to do"
+            echo "changed=false" >> "$GITHUB_OUTPUT"
-            exit 0
+          else
+            echo "changed=true" >> "$GITHUB_OUTPUT"
           fi
 
-          BRANCH="auto/update-flake-lock-$(date +%Y%m%d)"
+      - name: Commit and open PR
-          git config user.email "klaatu@thehellings.com"
+        if: steps.changes.outputs.changed == 'true'
+        env:
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+        run: |
+          BRANCH="automated/flake-lock-$(date +%Y%m%d)"
           git config user.name "klaatu"
+          git config user.email "klaatu@thehellings.com"
           git checkout -b "$BRANCH"
           git add flake.lock
-          git commit -m "chore: update flake.lock $(date +%Y-%m-%d)"
+          git commit -m "chore: update flake.lock"
-
-          # Push branch using token auth
-          git remote set-url origin "https://klaatu:${GITEA_TOKEN}@${GITEA_URL#https://}/${REPO}.git"
           git push origin "$BRANCH"
 
-          # Create PR via Gitea API
+          # Open PR via Gitea API
           curl -s -X POST \
             -H "Authorization: token ${GITEA_TOKEN}" \
             -H "Content-Type: application/json" \
-            "${GITEA_URL}/api/v1/repos/${REPO}/pulls" \
             -d "{
-              \"title\": \"chore: update flake.lock $(date +%Y-%m-%d)\",
+              \"title\": \"chore: update flake.lock\",
-              \"head\": \"$BRANCH\",
+              \"head\": \"${BRANCH}\",
               \"base\": \"main\",
-              \"body\": \"Automated weekly flake.lock update.\\n\\nGenerated by Gitea Actions.\",
+              \"body\": \"Automated weekly flake.lock update.\n\nGenerated by the update-flake-lock workflow.\"
-              \"assignees\": [\"greg\"]
+            }" \
-            }"
+            "${GITHUB_SERVER_URL%/}/api/v1/repos/${GITHUB_REPOSITORY}/pulls"

.gitea/workflows/update-manifests.yaml

@@ -1,58 +0,0 @@
-name: Update manifest chart versions
-
-on:
-  schedule:
-    - cron: "0 0 * * 1"  # Every Monday at midnight UTC
-  workflow_dispatch:
-
-jobs:
-  update-manifests:
-    runs-on: [bare-metal, nix-latest]
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Scan manifests for chart version updates
-        run: |
-          echo "TODO: implement manifest update scanning"
-          echo ""
-          echo "Planned implementation:"
-          echo "  1. Parse each manifests/*/chart.yaml for HelmRelease chart versions"
-          echo "  2. Query artifact hub or helm repo for latest versions"
-          echo "  3. Emit a diff of available updates"
-          echo ""
-          echo "Scanned manifests directories:"
-          ls manifests/
-
-      - name: Create PR if changes found
-        env:
-          GITEA_TOKEN: ${{ secrets.KLAATU_TOKEN }}
-          GITEA_URL: https://src.thehellings.com
-          REPO: greg/nixos
-        run: |
-          if git diff --quiet; then
-            echo "No manifest changes, nothing to do"
-            exit 0
-          fi
-
-          BRANCH="auto/update-manifests-$(date +%Y%m%d)"
-          git config user.email "klaatu@thehellings.com"
-          git config user.name "klaatu"
-          git checkout -b "$BRANCH"
-          git add manifests/
-          git commit -m "chore: update manifest chart versions $(date +%Y-%m-%d)"
-
-          git remote set-url origin "https://klaatu:${GITEA_TOKEN}@${GITEA_URL#https://}/${REPO}.git"
-          git push origin "$BRANCH"
-
-          curl -s -X POST \
-            -H "Authorization: token ${GITEA_TOKEN}" \
-            -H "Content-Type: application/json" \
-            "${GITEA_URL}/api/v1/repos/${REPO}/pulls" \
-            -d "{
-              \"title\": \"chore: update manifest chart versions $(date +%Y-%m-%d)\",
-              \"head\": \"$BRANCH\",
-              \"base\": \"main\",
-              \"body\": \"Automated weekly manifest chart version update.\\n\\nGenerated by Gitea Actions.\",
-              \"assignees\": [\"greg\"]
-            }"

.gitea/workflows/update-zims.yaml

@@ -1,51 +0,0 @@
-name: Update zims pin
-
-"on":
-  schedule:
-    - cron: "0 2 1 * *"  # 0200 on the first of every month
-  workflow_dispatch:
-
-jobs:
-  update-flake-lock:
-    runs-on: nix-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Update flake.lock
-        run: nix run .#zim-updater -- --output pkgs/zim/blobs.json
-
-      - name: Create PR if changed
-        env:
-          GITEA_TOKEN: ${{ secrets.KLAATU_TOKEN }}
-          GITEA_URL: https://src.thehellings.com
-          REPO: greg/nixos
-        run: |
-          if git diff --quiet pkgs/zim/blobs.json; then
-            echo "blobs.json unchanged, nothing to do"
-            exit 0
-          fi
-
-          BRANCH="auto/update-zims-$(date +%Y%m%d)"
-          git config user.email "klaatu@thehellings.com"
-          git config user.name "klaatu"
-          git checkout -b "$BRANCH"
-          git add pkgs/zim/blobs.json
-          git commit -m "chore: update zim blobs.json $(date +%Y-%m-%d)"
-
-          # Push branch using token auth
-          git remote set-url origin "https://klaatu:${GITEA_TOKEN}@${GITEA_URL#https://}/${REPO}.git"
-          git push origin "$BRANCH"
-
-          # Create PR via Gitea API
-          curl -s -X POST \
-            -H "Authorization: token ${GITEA_TOKEN}" \
-            -H "Content-Type: application/json" \
-            "${GITEA_URL}/api/v1/repos/${REPO}/pulls" \
-            -d "{
-              \"title\": \"chore: update zims $(date +%Y-%m-%d)\",
-              \"head\": \"$BRANCH\",
-              \"base\": \"main\",
-              \"body\": \"Automated monthly zims update.\\n\\nGenerated by Gitea Actions.\",
-              \"assignees\": [\"greg\"]
-            }"

.gitlab-ci.yml

@@ -0,0 +1,23 @@
+stages:
+  - eval
+  - build
+  - push
+
+"Evaluate for builds":
+  stage: eval
+  tags:
+    - kubernetes
+  image: "$CI_REGISTRY/greg/ci-images/builder:latest"
+  artifacts:
+    paths:
+      - gitlab-ci-continue.yml
+  script: nix run ".#gen-build" > gitlab-ci-continue.yml
+
+"Trigger builds":
+  stage: build
+  trigger:
+    include:
+      - artifact: gitlab-ci-continue.yml
+        job: "Evaluate for builds"
+  variables:
+    PARENT_PIPELINE_ID: $CI_PIPELINE_ID

.pre-commit-config.yaml

@@ -17,7 +17,7 @@ repos:
       - id: mixed-line-ending
       - id: trailing-whitespace
   - repo: https://github.com/adrienverge/yamllint.git
-    rev: v1.38.0
+    rev: v1.37.1
     hooks:
       - id: yamllint
         args:
@@ -30,9 +30,8 @@ repos:
               comments: false
               comments-indentation: false
               document-start: false
-              line-length: false
   - repo: https://github.com/NixOS/nixfmt
-    rev: v1.2.0
+    rev: v1.1.0
     hooks:
       - id: nixfmt-nix
   - repo: https://github.com/astro/deadnix

ca/intermediate_ca.crt

@@ -0,0 +1,12 @@
+-----BEGIN CERTIFICATE-----
+MIIByDCCAW+gAwIBAgIRANS+dPEH5Vqug7OWhCMmcx4wCgYIKoZIzj0EAwIwLjER
+MA8GA1UEChMISGVsbGluZ3MxGTAXBgNVBAMTEEhlbGxpbmdzIFJvb3QgQ0EwHhcN
+MjQwMjIwMjEyNzIxWhcNMzQwMjE3MjEyNzIxWjA2MREwDwYDVQQKEwhIZWxsaW5n
+czEhMB8GA1UEAxMYSGVsbGluZ3MgSW50ZXJtZWRpYXRlIENBMFkwEwYHKoZIzj0C
+AQYIKoZIzj0DAQcDQgAErZUhPfx5MpNbNVyqHDrIgUGnb6Hitl8hXlpH+kgjBzCi
+7I/+TQnl9Tc0VVNOFOYLOfBi7hV3/QudUtLGk0FKeaNmMGQwDgYDVR0PAQH/BAQD
+AgEGMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0OBBYEFMZR8LDd+hNy+TmtEHvt
+zRzXboh2MB8GA1UdIwQYMBaAFAlH11TwIFGB/K75qZ3e0S+fN3JUMAoGCCqGSM49
+BAMCA0cAMEQCIBxHK6r8pMX5hrTwYKRfMmRIt44m0KtNejA2T5t09hs+AiBfvmHb
+LfoE4qoC6NgpvXorAbx+O7xkem/9svF0Ob+RsA==
+-----END CERTIFICATE-----

ca/root_ca.crt

@@ -0,0 +1,11 @@
+-----BEGIN CERTIFICATE-----
+MIIBoTCCAUagAwIBAgIRAL/1mvE8+73nRFGsvzaaVSAwCgYIKoZIzj0EAwIwLjER
+MA8GA1UEChMISGVsbGluZ3MxGTAXBgNVBAMTEEhlbGxpbmdzIFJvb3QgQ0EwHhcN
+MjQwMjIwMjEyNzIwWhcNMzQwMjE3MjEyNzIwWjAuMREwDwYDVQQKEwhIZWxsaW5n
+czEZMBcGA1UEAxMQSGVsbGluZ3MgUm9vdCBDQTBZMBMGByqGSM49AgEGCCqGSM49
+AwEHA0IABEgNBjlT/7gmzNp9vKJvGPJn9/IizuMGVpucdrN9+J1u1ABkLNRzj5p2
+g7s3e/BG+EJnnTf/2tuq3p/wPqmQkdujRTBDMA4GA1UdDwEB/wQEAwIBBjASBgNV
+HRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQWBBQJR9dU8CBRgfyu+amd3tEvnzdyVDAK
+BggqhkjOPQQDAgNJADBGAiEA/uBclcFCOpkEgAeBAVurktYB82sMdIyyDGHcjlwi
+pvkCIQC2kuZ/nXRjibeIebQIVTBskQ1LxlLxnx7zNSjtr3kFfQ==
+-----END CERTIFICATE-----

compose/attic.yaml

@@ -0,0 +1,54 @@
+services:
+  attic:
+    container_name: attic
+    image: ghcr.io/zhaofengli/attic:latest
+    command: ["-f", "/attic/server.toml"]
+    restart: unless-stopped
+    ports:
+      - 8080:8080
+    networks:
+      attic:
+      pgattic:
+    volumes:
+      - /mnt/all/configs/attic/server.toml:/attic/server.toml
+      - /mnt/all/containers/attic/data:/attic/storage
+    env_file:
+      - stack.env
+    depends_on:
+      pgattic:
+        condition: service_healthy
+    healthcheck:
+      test:
+        [
+          "CMD-SHELL",
+          "wget --no-verbose --tries=1 --spider http://attic:8080 || exit 1",
+        ]
+      interval: 15s
+      timeout: 10s
+      retries: 10
+      start_period: 15s
+    deploy:
+      resources:
+        reservations:
+          cpus: 1.0
+
+  pgattic:
+    container_name: pgattic
+    image: postgres:17.6-alpine
+    restart: unless-stopped
+    ports: []
+    networks:
+      pgattic:
+    volumes:
+      - /mnt/all/containers/attic/postgres:/var/lib/postgresql/data
+    env_file:
+      - stack.env
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U $${POSTGRES_USER} -d $${POSTGRES_DB}"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+networks:
+  attic:
+  pgattic:

compose/pinchflat.yaml

@@ -0,0 +1,9 @@
+services:
+  pinchflat:
+    image: ghcr.io/kieraneglin/pinchflat:latest
+    ports:
+      - "8945:8945"
+    volumes:
+      - "/mnt/all/configs/pinchflat:/config"
+      - "/mnt/all/video/yt:/downloads"
+    restart: unless-stopped

compose/restic.yaml

@@ -0,0 +1,19 @@
+# Demo of rest-server with prometheus and grafana
+version: "2"
+
+services:
+  restserver:
+    image: "restic/rest-server:0.14.0"
+    volumes:
+      - /mnt/all/backups:/data
+      - /mnt/all/configs/certs:/certs
+    environment:
+      OPTIONS: >-
+        --tls
+        --tls-cert /certs/nas1.shire-zebra.ts.net.crt
+        --tls-key /certs/nas1.shire-zebra.ts.net.key
+        --path /data
+        --prometheus
+        --debug
+    ports:
+      - "30248:8000"

darwin/baseline.nix

@@ -1,82 +1,53 @@
 {
+  lib,
   pkgs,
-  pkgs',
   top,
   ...
 }:
 let
-  system = builtins.replaceStrings [ "darwin" ] [ "linux" ] pkgs.stdenv.hostPlatform.system;
+  builder-config = {
-  builderConfig = top.nixunstable.lib.nixosSystem {
+    darwin-aarch-builder = top.self.nixosConfigurations.builder-aarch;
-    inherit system;
+    darwin-x86-builder = top.self.nixosConfigurations.builder-x86;
-    modules = [
-      "${top.nixunstable}/nixos/modules/profiles/nix-builder-vm.nix"
-      {
-        virtualisation = {
-          host.pkgs = pkgs;
-          darwin-builder = {
-            workingDirectory = "/var/lib/darwin-builder";
-            hostPort = 22;
-          };
-        };
-      }
-    ];
   };
-  builder = {
+  builder = arch: let
-    command = "${builderConfig.config.system.build.macos-builder-installer}/bin/create-builder";
+    b = builder-config."darwin-${arch}-builder";
+  in {
+    command = "${b.config.system.build.macos-builder-installer}/bin/create-builder";
     serviceConfig = {
       KeepAlive = true;
       RunAtLoad = true;
-      StandardOutPath = "/var/log/builder-vm-${system}.log";
+      StandardOutPath = "/var/log/builder-vm-${arch}.log";
-      StandardErrorPath = "/var/log/builder-vm-${system}.stderr.log";
+      StandardErrorPath = "/var/log/builder-vm-${arch}.stderr.log";
     };
   };
 in
 {
-  environment = {
+  environment.systemPackages = with pkgs; [
-    launchDaemons = {
+    hms
-      "limit.maxfiles.plist" = {
+  ];
-        enable = true;
-        text = ''
-        <?xml version="1.0" encoding="UTF-8"?>
-        <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-        <plist version="1.0">
-          <dict>
-            <key>Label</key>
-            <string>limit.maxfiles</string>
-            <key>ProgramArguments</key>
-            <array>
-              <string>launchctl</string>
-              <string>limit</string>
-              <string>maxfiles</string>
-              <string>524288</string>
-              <string>524288</string>
-            </array>
-            <key>RunAtLoad</key>
-            <true/>
-          </dict>
-        </plist>
-        '';
-      };
-    };
-    systemPackages = with pkgs; [
-      agenix
-      pkgs'.hms
-      procps  # Includes tools like `watch`, `kill`, and `ps`
-    ];
-  };
 
   fonts.packages = with pkgs; [
     dejavu_fonts
     nerd-fonts.hack
   ];
 
-  #launchd.daemons.darwin-builder = builder;
+  launchd.daemons = lib.genAttrs' [ "x86" "aarch" ] (arch: lib.nameValuePair "builder-${arch}-machine" (builder arch));
 
   nix = {
-    #buildMachines = [ { systems = ["aarch64-linux"]; sshUser = "builder"; sshKey = "/etc/nix/builder_ed25519"; hostName = "localhost:31022"; protocol = "ssh-ng"; }];
     enable = true;
+    buildMachines = [
+      {
+        hostName = "ssh-ng://builder@localhost";
+        system = "aarch64-linux";
+        maxJobs = 4;
+        supportedFeatures = [
+          "kvm"
+          "benchmarch"
+          "big-parallel"
+        ];
+      }
+    ];
     gc.interval.Hour = 3;
-    #linux-builder.enable = true;
     settings.auto-optimise-store = false; # Darwin bugs?
   };
 

darwin/default.nix

@@ -19,7 +19,6 @@ let
       specialArgs = {
         inherit metadata top;
         inherit (top) self;
-        pkgs' = top.self.packages.${system};
       };
       modules = [
         {
@@ -38,4 +37,7 @@ let
       ++ lib.optionals (builtins.pathExists ./hosts/${name}) [ ./hosts/${name} ];
     };
 in
-(lib.genAttrs (builtins.attrNames (builtins.readDir ./hosts)) (name: mac { inherit name; }))
+{
+  "MacBook-Pro" = mac { name = "ivr"; };
+  "MacBook-Prolocal" = mac { name = "ivr"; };
+}

darwin/hosts/MacBook-Prolocal

@@ -1 +0,0 @@
-gregory

darwin/hosts/gregory.hellings-mbp

@@ -1 +0,0 @@
-gregory

darwin/hosts/ivr

@@ -1 +0,0 @@
-gregory/

darwin/hosts/ivr/default.nix

@@ -31,7 +31,6 @@ in
       "bitwarden"
       "bruno"
       "chromium"
-      "claude"
       "dbeaver-community"
       "ghostty"
       "firefox"

darwin/hosts/li

@@ -1 +0,0 @@
-lithic/

darwin/hosts/lithic/default.nix

@@ -1,53 +0,0 @@
-{ ... }:
-let
-  username = "greg";
-in
-{
-  greg = {
-    nix.cache = false;
-  };
-
-  homebrew = {
-    enable = true;
-    brews = [
-      "bitwarden-cli"
-      "colima"
-      "direnv"
-      "github-mcp-server"
-      {
-        name = "libvirt";
-        restart_service = true;
-      }
-      "mcp-atlassian"
-      "notion-mcp-server"
-      "nushell"
-      "qemu"
-      "slack-mcp-server"
-      "zlib"
-    ];
-    casks = [
-      "alt-tab"
-      "audacity"
-      "bitwarden"
-      "bruno"
-      "chromium"
-      "claude-code"
-      "dbeaver-community"
-      "ghostty"
-      "firefox"
-      "notion"
-      "notunes"
-      "onlyoffice"
-      "tabby"
-      "zed"
-    ];
-    user = username;
-  };
-
-  system.primaryUser = username;
-
-  users.users."${username}" = {
-    name = username;
-    home = "/Users/${username}";
-  };
-}

flake.lock

@@ -25,17 +25,19 @@
     },
     "buildbot": {
       "inputs": {
+        "flake-parts": "flake-parts",
+        "hercules-ci-effects": "hercules-ci-effects",
         "nixpkgs": [
           "nixunstable"
         ],
         "treefmt-nix": "treefmt-nix"
       },
       "locked": {
-        "lastModified": 1783833875,
+        "lastModified": 1772467670,
-        "narHash": "sha256-G+hRtNJ/Nnr6VFMQp2UZdx/ckJDR/RJoK0Fy/yx1/YY=",
+        "narHash": "sha256-DF/1VCg7Qmw5iaFhBeKBysOSTDCxZlKJHdbJc7Q2e1k=",
         "owner": "nix-community",
         "repo": "buildbot-nix",
-        "rev": "147af587241e2af85399402da60a4f44fdb1e5d7",
+        "rev": "f927795b97474875738ac134525af560b2d4a8a5",
         "type": "github"
       },
       "original": {
@@ -44,20 +46,44 @@
         "type": "github"
       }
     },
+    "charts": {
+      "inputs": {
+        "flake-utils": "flake-utils",
+        "haumea": "haumea",
+        "nix-kube-generators": "nix-kube-generators",
+        "nixpkgs": "nixpkgs",
+        "pyproject-build-systems": "pyproject-build-systems",
+        "pyproject-nix": "pyproject-nix",
+        "uv2nix": "uv2nix"
+      },
+      "locked": {
+        "lastModified": 1772676442,
+        "narHash": "sha256-bPxUBXS2mdT4BjMAmTap5TkXnUX807qo4Uho2oVb2Fg=",
+        "owner": "nix-community",
+        "repo": "nixhelm",
+        "rev": "19cdbb3a03554059165a25a18b32bd253e62c883",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nixhelm",
+        "type": "github"
+      }
+    },
     "colmena": {
       "inputs": {
         "flake-compat": "flake-compat",
-        "flake-utils": "flake-utils",
+        "flake-utils": "flake-utils_2",
         "nix-github-actions": "nix-github-actions",
-        "nixpkgs": "nixpkgs",
+        "nixpkgs": "nixpkgs_2",
         "stable": "stable"
       },
       "locked": {
-        "lastModified": 1783909498,
+        "lastModified": 1762034856,
-        "narHash": "sha256-T9OfLPLuh1Bf1xojlpWXwooJ6IXapxvb8GM0p3YNy8g=",
+        "narHash": "sha256-QVey3iP3UEoiFVXgypyjTvCrsIlA4ecx6Acaz5C8/PQ=",
         "owner": "zhaofengli",
         "repo": "colmena",
-        "rev": "76ba0daa542880b730faec81f4e87efcaa63bc57",
+        "rev": "349b035a5027f23d88eeb3bc41085d7ee29f18ed",
         "type": "github"
       },
       "original": {
@@ -95,11 +121,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1784362797,
+        "lastModified": 1772379624,
-        "narHash": "sha256-EP9b9b+OXDxHBPefFwMYCIaLq0fn3UkmrbfzbLUT7kQ=",
+        "narHash": "sha256-NG9LLTWlz4YiaTAiRGChbrzbVxBfX+Auq4Ab/SWmk4A=",
         "owner": "lnl7",
         "repo": "nix-darwin",
-        "rev": "b4cccbd4bc299c1f71ae185b79c3cf99aa82805c",
+        "rev": "52d061516108769656a8bd9c6e811c677ec5b462",
         "type": "github"
       },
       "original": {
@@ -112,11 +138,11 @@
     "flake-compat": {
       "flake": false,
       "locked": {
-        "lastModified": 1767039857,
+        "lastModified": 1650374568,
-        "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
+        "narHash": "sha256-Z+s0J8/r907g149rllvwhb4pKi8Wam5ij0st8PwAh+E=",
         "owner": "edolstra",
         "repo": "flake-compat",
-        "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
+        "rev": "b4a34015c698c7793d592d66adbab377907a2be8",
         "type": "github"
       },
       "original": {
@@ -126,22 +152,6 @@
       }
     },
     "flake-compat_2": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1747046372,
-        "narHash": "sha256-CIVLLkVgvHYbgI2UpXvIIBJ12HWgX+fjA8Xf8PUmqCY=",
-        "owner": "edolstra",
-        "repo": "flake-compat",
-        "rev": "9100a0f413b0c601e0533d1d94ffd501ce2e7885",
-        "type": "github"
-      },
-      "original": {
-        "owner": "edolstra",
-        "repo": "flake-compat",
-        "type": "github"
-      }
-    },
-    "flake-compat_3": {
       "flake": false,
       "locked": {
         "lastModified": 1767039857,
@@ -159,14 +169,17 @@
     },
     "flake-parts": {
       "inputs": {
-        "nixpkgs-lib": "nixpkgs-lib"
+        "nixpkgs-lib": [
+          "buildbot",
+          "nixpkgs"
+        ]
       },
       "locked": {
-        "lastModified": 1782949081,
+        "lastModified": 1769996383,
-        "narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=",
+        "narHash": "sha256-AnYjnFWgS49RlqX7LrC4uA+sCCDBj0Ry/WOJ5XWAsa0=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e",
+        "rev": "57928607ea566b5db3ad13af0e57e921e6b12381",
         "type": "github"
       },
       "original": {
@@ -177,17 +190,14 @@
     },
     "flake-parts_2": {
       "inputs": {
-        "nixpkgs-lib": [
+        "nixpkgs-lib": "nixpkgs-lib"
-          "nixvimunstable",
-          "nixpkgs"
-        ]
       },
       "locked": {
-        "lastModified": 1782949081,
+        "lastModified": 1772408722,
-        "narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=",
+        "narHash": "sha256-rHuJtdcOjK7rAHpHphUb1iCvgkU3GpfvicLMwwnfMT0=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e",
+        "rev": "f20dc5d9b8027381c474144ecabc9034d6a839a3",
         "type": "github"
       },
       "original": {
@@ -197,6 +207,27 @@
       }
     },
     "flake-parts_3": {
+      "inputs": {
+        "nixpkgs-lib": [
+          "nixvimunstable",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1769996383,
+        "narHash": "sha256-AnYjnFWgS49RlqX7LrC4uA+sCCDBj0Ry/WOJ5XWAsa0=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "57928607ea566b5db3ad13af0e57e921e6b12381",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
+    "flake-parts_4": {
       "inputs": {
         "nixpkgs-lib": [
           "nurpkgs",
@@ -235,6 +266,68 @@
         "type": "github"
       }
     },
+    "flake-utils_2": {
+      "locked": {
+        "lastModified": 1659877975,
+        "narHash": "sha256-zllb8aq3YO3h8B/U0/J1WBgAL8EX5yWf5pMj3G0NAmc=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "c0e246b9b83f637f4681389ecabcb2681b4f3af0",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "haumea": {
+      "inputs": {
+        "nixpkgs": [
+          "charts",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1685133229,
+        "narHash": "sha256-FePm/Gi9PBSNwiDFq3N+DWdfxFq0UKsVVTJS3cQPn94=",
+        "owner": "nix-community",
+        "repo": "haumea",
+        "rev": "34dd58385092a23018748b50f9b23de6266dffc2",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "ref": "v0.2.2",
+        "repo": "haumea",
+        "type": "github"
+      }
+    },
+    "hercules-ci-effects": {
+      "inputs": {
+        "flake-parts": [
+          "buildbot",
+          "flake-parts"
+        ],
+        "nixpkgs": [
+          "buildbot",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1771131391,
+        "narHash": "sha256-HPBNYf7HiKtBVy7/69vKpLYHX6wTcUxndxmybzDlXP8=",
+        "owner": "hercules-ci",
+        "repo": "hercules-ci-effects",
+        "rev": "0b152e0f7c5cc265a529cd63374b80e2771b207b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "hercules-ci-effects",
+        "type": "github"
+      }
+    },
     "hmunstable": {
       "inputs": {
         "nixpkgs": [
@@ -242,11 +335,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1784407317,
+        "lastModified": 1772633327,
-        "narHash": "sha256-iZrxHToDJWnvt+5LGAtvuQMTy1NZYlNEKbKaVtBJNcc=",
+        "narHash": "sha256-jl+DJB2DUx7EbWLRng+6HNWW/1/VQOnf0NsQB4PlA7I=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "39411a8e12a5526d992e65bc7e3dc9a4414d6713",
+        "rev": "5a75730e6f21ee624cbf86f4915c6e7489c74acc",
         "type": "github"
       },
       "original": {
@@ -277,45 +370,6 @@
         "type": "github"
       }
     },
-    "minecraft": {
-      "inputs": {
-        "flake-compat": "flake-compat_2",
-        "nixpkgs": "nixpkgs_2",
-        "systems": "systems_3"
-      },
-      "locked": {
-        "lastModified": 1784344393,
-        "narHash": "sha256-yAo2ZzSIdeBZg7cOKUpQxwflL+DRYN+1DMObZk2lP2Q=",
-        "owner": "Infinidoge",
-        "repo": "nix-minecraft",
-        "rev": "7297d14c52ec8ef39c6aeff2c1818541fd030473",
-        "type": "github"
-      },
-      "original": {
-        "owner": "Infinidoge",
-        "repo": "nix-minecraft",
-        "type": "github"
-      }
-    },
-    "niks3": {
-      "inputs": {
-        "nixpkgs": "nixpkgs_3",
-        "treefmt-nix": "treefmt-nix_2"
-      },
-      "locked": {
-        "lastModified": 1784016977,
-        "narHash": "sha256-TydDba3YD2u15uS0L+PDs7lMqPopnzWggljTKDqOCSw=",
-        "owner": "Mic92",
-        "repo": "niks3",
-        "rev": "b306808bf381e7e66e33de1e9446a1be0935f4e3",
-        "type": "github"
-      },
-      "original": {
-        "owner": "Mic92",
-        "repo": "niks3",
-        "type": "github"
-      }
-    },
     "nix-github-actions": {
       "inputs": {
         "nixpkgs": [
@@ -324,11 +378,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1737420293,
+        "lastModified": 1729742964,
-        "narHash": "sha256-F1G5ifvqTpJq7fdkT34e/Jy9VCyzd5XfJ9TO8fHhJWE=",
+        "narHash": "sha256-B4mzTcQ0FZHdpeWcpDYPERtyjJd/NIuaQ9+BV1h+MpA=",
         "owner": "nix-community",
         "repo": "nix-github-actions",
-        "rev": "f4158fa080ef4503c8f4c820967d946c2af31ec9",
+        "rev": "e04df33f62cdcf93d73e9a04142464753a16db67",
         "type": "github"
       },
       "original": {
@@ -338,15 +392,12 @@
       }
     },
     "nix-hardware": {
-      "inputs": {
-        "nixpkgs": "nixpkgs_4"
-      },
       "locked": {
-        "lastModified": 1784310968,
+        "lastModified": 1771969195,
-        "narHash": "sha256-rkSPTePrKqs4dg+i7ZFCq93+HrClac6oSwXX927SVjA=",
+        "narHash": "sha256-qwcDBtrRvJbrrnv1lf/pREQi8t2hWZxVAyeMo7/E9sw=",
         "owner": "nixos",
         "repo": "nixos-hardware",
-        "rev": "779c32a00155994c86cde8213a8dd4df139d4355",
+        "rev": "41c6b421bdc301b2624486e11905c9af7b8ec68e",
         "type": "github"
       },
       "original": {
@@ -355,13 +406,28 @@
         "type": "github"
       }
     },
+    "nix-kube-generators": {
+      "locked": {
+        "lastModified": 1762437901,
+        "narHash": "sha256-5yuJODagAq+aMXQAT2c0gfXKLqapmA6eUHR33jKNHuU=",
+        "owner": "farcaller",
+        "repo": "nix-kube-generators",
+        "rev": "810dcf792081790648ba9ae705b9a2286115ace8",
+        "type": "github"
+      },
+      "original": {
+        "owner": "farcaller",
+        "repo": "nix-kube-generators",
+        "type": "github"
+      }
+    },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1783224372,
+        "lastModified": 1767767207,
-        "narHash": "sha256-8i/87eeoqiGE4yOTjwSA3Eh/ziJRQEmd/unYU+K27sk=",
+        "narHash": "sha256-Mj3d3PfwltLmukFal5i3fFt27L6NiKXdBezC1EBuZs4=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "d407951447dcd00442e97087bf374aad70c04cea",
+        "rev": "5912c1772a44e31bf1c63c0390b90501e5026886",
         "type": "github"
       },
       "original": {
@@ -373,26 +439,11 @@
     },
     "nixpkgs-lib": {
       "locked": {
-        "lastModified": 1782614948,
+        "lastModified": 1772328832,
-        "narHash": "sha256-ePjCwr1sNm9NYUqywL7QfK3JnlS015msC+eBu2zKlp8=",
+        "narHash": "sha256-e+/T/pmEkLP6BHhYjx6GmwP5ivonQQn0bJdH9YrRB+Q=",
         "owner": "nix-community",
         "repo": "nixpkgs.lib",
-        "rev": "db3f255737b94216eb71cce308e2912cf6bc2d7c",
+        "rev": "c185c7a5e5dd8f9add5b2f8ebeff00888b070742",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "nixpkgs.lib",
-        "type": "github"
-      }
-    },
-    "nixpkgs-lib_2": {
-      "locked": {
-        "lastModified": 1783821755,
-        "narHash": "sha256-eMPX9S6MKPyUnaOgeRfrG7OKUiAlc1AlcRinMbSB0WA=",
-        "owner": "nix-community",
-        "repo": "nixpkgs.lib",
-        "rev": "228ab8523d81526e57a6ca342e1a919fb6d246a8",
         "type": "github"
       },
       "original": {
@@ -403,15 +454,15 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1769461804,
+        "lastModified": 1750134718,
-        "narHash": "sha256-msG8SU5WsBUfVVa/9RPLaymvi5bI8edTavbIq3vRlhI=",
+        "narHash": "sha256-v263g4GbxXv87hMXMCpjkIxd/viIF7p3JpJrwgKdNiI=",
-        "owner": "nixos",
+        "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "bfc1b8a4574108ceef22f02bafcf6611380c100d",
+        "rev": "9e83b64f727c88a7711a2c463a7b16eedb69a84c",
         "type": "github"
       },
       "original": {
-        "owner": "nixos",
+        "owner": "NixOS",
         "ref": "nixos-unstable",
         "repo": "nixpkgs",
         "type": "github"
@@ -419,56 +470,11 @@
     },
     "nixpkgs_3": {
       "locked": {
-        "lastModified": 1783978241,
+        "lastModified": 1772624091,
-        "narHash": "sha256-7kK0Y/fIV2NTKArkd/eZGaFg+dEmgP8KDRsGK2vB5M4=",
+        "narHash": "sha256-QKyJ0QGWBn6r0invrMAK8dmJoBYWoOWy7lN+UHzW1jc=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "a8b81d3cc8d35af7bc98694696bea61ad4f8fca7",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-unstable-small",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_4": {
-      "locked": {
-        "lastModified": 1767892417,
-        "narHash": "sha256-8bW3q88CEg2u4hSP66Vf4lpbLonHz7hqDNBMcCY7E9U=",
-        "rev": "3497aa5c9457a9d88d71fa93a4a8368816fbeeba",
-        "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.05pre924538.3497aa5c9457/nixexprs.tar.xz"
-      },
-      "original": {
-        "type": "tarball",
-        "url": "https://channels.nixos.org/nixos-unstable/nixexprs.tar.xz"
-      }
-    },
-    "nixpkgs_5": {
-      "locked": {
-        "lastModified": 1783915482,
-        "narHash": "sha256-FmieJB8/OUvNxbkboi7+IGfIuSXY3nF/hZQm8kD0r50=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "6cdc7fc76e8bf7fde9fa43a849fcaaa70e230dee",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixpkgs-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_6": {
-      "locked": {
-        "lastModified": 1784356753,
-        "narHash": "sha256-12KrbMiWLcf8m7pCvAtZh1ZrgF85ZXDXvfR/fWTKy84=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "61b7c44c4073f0b827768aff0049561b5110ea5a",
+        "rev": "80bdc1e5ce51f56b19791b52b2901187931f5353",
         "type": "github"
       },
       "original": {
@@ -478,50 +484,52 @@
         "type": "github"
       }
     },
-    "nixpkgs_7": {
+    "nixpkgs_4": {
       "locked": {
-        "lastModified": 1777207419,
+        "lastModified": 1766025857,
-        "narHash": "sha256-V3bmPWAajDiC+1ClDOp55gianW2EyRJSJOyu1RUQibc=",
+        "narHash": "sha256-Lav5jJazCW4mdg1iHcROpuXqmM94BWJvabLFWaJVJp0=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "a7ecea3deccfbdbf22945a89984fcc5a169da8aa",
+        "rev": "def3da69945bbe338c373fddad5a1bb49cf199ce",
         "type": "github"
       },
       "original": {
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "a7ecea3deccfbdbf22945a89984fcc5a169da8aa",
+        "rev": "def3da69945bbe338c373fddad5a1bb49cf199ce",
         "type": "github"
       }
     },
     "nixunstable": {
       "locked": {
-        "lastModified": 1784700541,
+        "lastModified": 1772963539,
-        "narHash": "sha256-LcCdjhqwjFVrFTNW6tHm3KNYRrD1TA6bYRea30yIIjw=",
+        "narHash": "sha256-9jVDGZnvCckTGdYT53d/EfznygLskyLQXYwJLKMPsZs=",
-        "owner": "geri1701",
+        "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "3c598184d1f70c5d0beeea8b95d01ab0179e4ef7",
+        "rev": "9dcb002ca1690658be4a04645215baea8b95f31d",
         "type": "github"
       },
       "original": {
-        "owner": "geri1701",
+        "owner": "nixos",
-        "ref": "lego-v5-acme-spike",
+        "ref": "nixos-unstable",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
     "nixvimunstable": {
       "inputs": {
-        "flake-parts": "flake-parts_2",
+        "flake-parts": "flake-parts_3",
-        "nixpkgs": "nixpkgs_5",
+        "nixpkgs": [
-        "systems": "systems_4"
+          "nixunstable"
+        ],
+        "systems": "systems_3"
       },
       "locked": {
-        "lastModified": 1784057377,
+        "lastModified": 1772402258,
-        "narHash": "sha256-yycNej5//EsRbV10moBoh+/63vXEwZD1ZFEiRm6C9rQ=",
+        "narHash": "sha256-3DmCFOdmbkFML1/G9gj8Wb+rCCZFPOQtNoMCpqOF8SA=",
         "owner": "nix-community",
         "repo": "nixvim",
-        "rev": "07180a087e4a00720dc0731cbcd8dec796974381",
+        "rev": "21ae25e13b01d3b4cdc750b5f9e7bad68b150c10",
         "type": "github"
       },
       "original": {
@@ -533,15 +541,15 @@
     },
     "nurpkgs": {
       "inputs": {
-        "flake-parts": "flake-parts_3",
+        "flake-parts": "flake-parts_4",
-        "nixpkgs": "nixpkgs_6"
+        "nixpkgs": "nixpkgs_3"
       },
       "locked": {
-        "lastModified": 1784417922,
+        "lastModified": 1772717146,
-        "narHash": "sha256-19XZ56wJXArMKxjY25pKXkNp/FrYHGoo+HuQtW6teSM=",
+        "narHash": "sha256-x2nJlzpiHWHLkGDBvaiO1ysLhaxjQCLsG3XieRueJ/c=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "2c806d314605495dd7fd75b5950003a062e2b47a",
+        "rev": "2e1bffbdde931c4300a59418d0150c7457022f2d",
         "type": "github"
       },
       "original": {
@@ -550,18 +558,66 @@
         "type": "github"
       }
     },
+    "pyproject-build-systems": {
+      "inputs": {
+        "nixpkgs": [
+          "charts",
+          "nixpkgs"
+        ],
+        "pyproject-nix": [
+          "charts",
+          "pyproject-nix"
+        ],
+        "uv2nix": [
+          "charts",
+          "uv2nix"
+        ]
+      },
+      "locked": {
+        "lastModified": 1763662255,
+        "narHash": "sha256-4bocaOyLa3AfiS8KrWjZQYu+IAta05u3gYZzZ6zXbT0=",
+        "owner": "pyproject-nix",
+        "repo": "build-system-pkgs",
+        "rev": "042904167604c681a090c07eb6967b4dd4dae88c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "pyproject-nix",
+        "repo": "build-system-pkgs",
+        "type": "github"
+      }
+    },
+    "pyproject-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "charts",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1764134915,
+        "narHash": "sha256-xaKvtPx6YAnA3HQVp5LwyYG1MaN4LLehpQI8xEdBvBY=",
+        "owner": "pyproject-nix",
+        "repo": "pyproject.nix",
+        "rev": "2c8df1383b32e5443c921f61224b198a2282a657",
+        "type": "github"
+      },
+      "original": {
+        "owner": "pyproject-nix",
+        "repo": "pyproject.nix",
+        "type": "github"
+      }
+    },
     "root": {
       "inputs": {
         "agenix": "agenix",
         "buildbot": "buildbot",
+        "charts": "charts",
         "colmena": "colmena",
         "darwin": "darwin_2",
-        "flake-parts": "flake-parts",
+        "flake-parts": "flake-parts_2",
         "hmunstable": "hmunstable",
-        "minecraft": "minecraft",
-        "niks3": "niks3",
         "nix-hardware": "nix-hardware",
-        "nixpkgs-lib": "nixpkgs-lib_2",
         "nixunstable": "nixunstable",
         "nixvimunstable": "nixvimunstable",
         "nurpkgs": "nurpkgs",
@@ -571,16 +627,16 @@
     },
     "stable": {
       "locked": {
-        "lastModified": 1783625654,
+        "lastModified": 1750133334,
-        "narHash": "sha256-pI1244/PJfTyKhlAr2QYQC55vR6UQdnGA0rJUgtO2IQ=",
+        "narHash": "sha256-urV51uWH7fVnhIvsZIELIYalMYsyr2FCalvlRTzqWRw=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "a0230bd8d5cbd13893b2263918d396a2c7dd0407",
+        "rev": "36ab78dab7da2e4e27911007033713bab534187b",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "release-26.05",
+        "ref": "nixos-25.05",
         "repo": "nixpkgs",
         "type": "github"
       }
@@ -630,22 +686,6 @@
         "type": "github"
       }
     },
-    "systems_4": {
-      "locked": {
-        "lastModified": 1774449309,
-        "narHash": "sha256-brhZ8DmuGtzkCYHJg4HEd602amKm89Y9ytsFZ5uWD1w=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "c29398b59d2048c4ab79345812849c9bd15e9150",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "ref": "future-26.11",
-        "repo": "default",
-        "type": "github"
-      }
-    },
     "treefmt-nix": {
       "inputs": {
         "nixpkgs": [
@@ -654,11 +694,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1780220602,
+        "lastModified": 1770228511,
-        "narHash": "sha256-eynAfOmbmxJnkp7YewvCEbShNnnYJ9gLLqkzsYtBPeM=",
+        "narHash": "sha256-wQ6NJSuFqAEmIg2VMnLdCnUc0b7vslUohqqGGD+Fyxk=",
         "owner": "numtide",
         "repo": "treefmt-nix",
-        "rev": "db947814a175b7ca6ded66e21383d938df01c227",
+        "rev": "337a4fe074be1042a35086f15481d763b8ddc0e7",
         "type": "github"
       },
       "original": {
@@ -667,37 +707,41 @@
         "type": "github"
       }
     },
-    "treefmt-nix_2": {
+    "uv2nix": {
       "inputs": {
         "nixpkgs": [
-          "niks3",
+          "charts",
           "nixpkgs"
+        ],
+        "pyproject-nix": [
+          "charts",
+          "pyproject-nix"
         ]
       },
       "locked": {
-        "lastModified": 1780220602,
+        "lastModified": 1767701098,
-        "narHash": "sha256-eynAfOmbmxJnkp7YewvCEbShNnnYJ9gLLqkzsYtBPeM=",
+        "narHash": "sha256-CJhKZnWb3gumR9oTRjFvCg/6lYTGbZRU7xtvcyWIRwU=",
-        "owner": "numtide",
+        "owner": "pyproject-nix",
-        "repo": "treefmt-nix",
+        "repo": "uv2nix",
-        "rev": "db947814a175b7ca6ded66e21383d938df01c227",
+        "rev": "9d357f0d2ce6f5f35ec7959d7e704452352eb4da",
         "type": "github"
       },
       "original": {
-        "owner": "numtide",
+        "owner": "pyproject-nix",
-        "repo": "treefmt-nix",
+        "repo": "uv2nix",
         "type": "github"
       }
     },
     "vsext": {
       "inputs": {
-        "nixpkgs": "nixpkgs_7"
+        "nixpkgs": "nixpkgs_4"
       },
       "locked": {
-        "lastModified": 1784343266,
+        "lastModified": 1772678592,
-        "narHash": "sha256-EGkegdTz2n6ESyih8s3dUuPyJQWlYfPp7U41J05g8PY=",
+        "narHash": "sha256-1VZ1hg1YHW+WyBXIOfrQ9Oq+qLL0w93lkdKAiRRHEuI=",
         "owner": "nix-community",
         "repo": "nix-vscode-extensions",
-        "rev": "472a3e862c76c64ac3ad75a24d332cb5cdd5f1bb",
+        "rev": "5521856f37c3d2654fe9b20b03331a6594f855c6",
         "type": "github"
       },
       "original": {
@@ -708,17 +752,17 @@
     },
     "wsl": {
       "inputs": {
-        "flake-compat": "flake-compat_3",
+        "flake-compat": "flake-compat_2",
         "nixpkgs": [
           "nixunstable"
         ]
       },
       "locked": {
-        "lastModified": 1784058842,
+        "lastModified": 1772386632,
-        "narHash": "sha256-3u3tvbCIAid3Mv7RrJx13jusIEQC/HeKYhO/SUSxR3A=",
+        "narHash": "sha256-sm6OpWZuoDwR53KNlsY482YOoHFWlWYwt0wHmqLkRGE=",
         "owner": "nix-community",
         "repo": "NixOS-WSL",
-        "rev": "24c8dc8e0f2170e1a377be24dfadc7d9d21dc1ad",
+        "rev": "be894604b2aa2184c0b3d3b44995acd0da14dc0c",
         "type": "github"
       },
       "original": {

flake.nix

@@ -13,6 +13,9 @@
       url = "github:nix-community/buildbot-nix";
       inputs.nixpkgs.follows = "nixunstable";
     };
+    charts = {
+      url = "github:nix-community/nixhelm";
+    };
     colmena.url = "github:zhaofengli/colmena";
     darwin = {
       url = "github:lnl7/nix-darwin/master";
@@ -23,13 +26,12 @@
       url = "github:nix-community/home-manager/master";
       inputs.nixpkgs.follows = "nixunstable";
     };
-    minecraft.url = "github:Infinidoge/nix-minecraft";
-    niks3.url = "github:Mic92/niks3";
     nix-hardware.url = "github:nixos/nixos-hardware";
-    nixpkgs-lib.url = "github:nix-community/nixpkgs.lib";
+    nixvimunstable = {
-    nixvimunstable.url = "github:nix-community/nixvim/main";
+      url = "github:nix-community/nixvim/main";
-    #nixunstable.url = "github:nixos/nixpkgs/nixos-unstable";
+      inputs.nixpkgs.follows = "nixunstable";
-    nixunstable.url = "github:geri1701/nixpkgs/lego-v5-acme-spike";
+    };
+    nixunstable.url = "github:nixos/nixpkgs/nixos-unstable";
     nurpkgs.url = "github:nix-community/NUR";
     vsext.url = "github:nix-community/nix-vscode-extensions";
     wsl = {
@@ -48,7 +50,6 @@
         top.nixvimunstable.overlays.default
         top.nurpkgs.overlays.default
         top.vsext.overlays.default
-        top.minecraft.overlay
       ];
       metadata = builtins.fromJSON (builtins.readFile ./network.json);
       systems = [
@@ -63,14 +64,10 @@
           config = {
             allowUnfree = true;
             allowUnfreePredicate = _: true;
-            permittedInsecurePackages = [
+            permittedInsecurePackages = [ "ventoy-1.1.05" ];
-              "ventoy-1.1.05"
-              "electron-39.8.10"
-            ];
           };
         }
       );
-      lib' = import ./lib { inherit (top.nixunstable) lib; };
     in
     top.flake-parts.lib.mkFlake { inputs = top; } {
       inherit systems;
@@ -82,12 +79,10 @@
               nixpkgs = imported_packages.x86_64-linux;
               specialArgs = {
                 inherit
-                  lib'
                   metadata
                   self
                   top
                   ;
-                pkgs' = top.self.packages.x86_64-linux;
               };
             };
           }
@@ -101,7 +96,7 @@
                 {
                   deployment = {
                     inherit (v) tags;
-                    targetHost = if (v ? "connectAddr") then v.connectAddr else v.nebulaIp;
+                    targetHost = v.ts;
                     targetUser = "greg";
                   };
                 }
@@ -120,7 +115,7 @@
 
         nixosConfigurations = (
           import ./hosts {
-            inherit top metadata lib';
+            inherit top metadata;
             nixpkgs = imported_packages;
           }
         );
@@ -149,17 +144,16 @@
             pkgs = imported_packages.${system};
           };
 
-          packages = (import ./pkgs { inherit pkgs top; });
+          packages = (import ./pkgs { inherit pkgs; });
 
           checks = import ./checks.nix {
             inherit system top self';
-            inherit (top.nixpkgs-lib) lib;
+            inherit (pkgs) lib;
           };
 
           devShells = import ./shells.nix {
             inherit pkgs;
             inherit (top) colmena;
-            inherit (self') packages;
           };
         };
     };

garnix.yaml

@@ -1,23 +1,23 @@
 builds:
-  # Exclude most things, as I locally build x86_64-linux and aarch64-linux
+  exclude:
-  - exclude:
+    - "homeConfigurations.*"
-      - "homeConfigurations.*"
+    - "nixosConfigurations.*"
-      - "nixosConfigurations.*"
+    - "packages.*"
-      - "packages.*"
+    # bitwarden-cli package is broken on aarch64-darwin
-      # These are just images which I will build when
+    - "packages.aarch64-darwin.img-bitwarden"
-      # I feel like it
+    # kmod-31 is not a thing on Darwin
-      - "devShells.*"
+    - "packages.aarch64-darwin.qemu-hook"
-    include:
+    - "packages.aarch64-darwin.vfio_shutdown"
-      - "packages.aarch64-darwin.*"
+    - "packages.aarch64-darwin.vfio_startup"
-      - darwinConfigurations.MacBook-Pro
+    # This one is a bit of a beast and shouldn't take up Garnix time
-      - darwinConfigurations.MacBook-Prolocal
+    - "packages.aarch64-darwin.zim"
-      - darwinConfigurations.li
+    # These are just images which I will build when
-  # Some specific includes which are not specific enough to override the rules
+    # I feel like it
-  # above, due to the intrepretation of the glob excludes, but which I still
+    - "devShells.*"
-  # need included
+  include:
-  - include:
+    - "packages.aarch64-darwin.*"
-      # These are Mac homeConfigurations, which I do not have the infra
+    - homeConfigurations.exodus
-      # to build at home
+    - darwinConfigurations.MacBook-Pro
-      - homeConfigurations."gregory.hellings-mbp"
+    - darwinConfigurations.MacBook-Prolocal
-      - homeConfigurations.gregs-MacBook-Pro-16-inch-Nov-2024
+    - nixosConfigurations.builder-x86
-      - homeConfigurations.ivr
+    - nixosConfigurations.builder-aarch

home/baseline/nushell/functions.nu

@@ -1,5 +1,5 @@
 # vim: set filetype=nushell :
-let servers = [isaiah jeremiah zeke genesis hosea]
+let servers = [isaiah jeremiah zeke genesis vm-gitlab]
 
 def par-map [ items: list, c: closure ] {
   let results = $items | par-each -k $c
@@ -12,55 +12,15 @@ def --env unlock [] {
     }
 }
 
-def nebulaIps [] {
+def rebuild [] {
-    open /etc/nixos/network.json | get hosts | items { |h, e| $e.nebulaIp? } | where $it != null | sort
-}
-
-def localIps [] {
-    open /etc/nixos/network.json | get hosts | items { |h, e| $e.ip? } | where $it != null | sort
-}
-
-def genNebulaCert [ --ips: string, --name: string ] {
-    let public = $'~/SynologyDrive/nebula/($name).key.pub' | path expand
-    let private = $'~/SynologyDrive/nebula/($name).key' | path expand
-    let cert = $'/etc/nixos/secrets/nebula/($name).crt'
-    let ca_cert = '~/SynologyDrive/nebula/ca.crt' | path expand
-    let ca_key = '~/SynologyDrive/nebula/ca.key' | path expand
-
-    # Generate public key if there isn't one already
-    if ( not ($public | path exists) ) {
-        nebula-cert keygen -out-key $private -out-pub $public
-    }
-    # Clear old cert if there is one
-    if ( $cert | path exists) {
-        rm $cert
-    }
-
-    # Create and sign certs
-    (nebula-cert sign
-        -ca-crt $ca_cert
-        -ca-key $ca_key
-        -name $name
-        -networks $ips
-        -out-crt $cert
-        -in-pub $public
-    )
-
-    # Agenix update
-    cd /etc/nixos/secrets
-    cat $private | agenix -e $'nebula/($name).key.age'
-}
-
-
-def rebuild [ $target: string = "switch" ] {
     if (uname | get operating-system) == "Darwin" {
-        sudo darwin-rebuild $target
+        sudo darwin-rebuild switch
     } else {
         let hostname = uname | get nodename
         let build = ^nom build --keep-going $"/etc/nixos#nixosConfigurations.($hostname).config.system.build.toplevel"
         if $env.LAST_EXIT_CODE == 0 {
             nvd diff /run/current-system result
-            run0 result/bin/switch-to-configuration $target
+            run0 result/bin/switch-to-configuration switch
         } else {
             print "Error during build"
         }
@@ -75,8 +35,7 @@ def deploy [ $host: string, $build: string = "" ] {
     if $buildhost == "linode" or $buildhost == "genesis" {
         $buildhost = "isaiah"
     }
-    colmena apply --on $host
+    nixos-rebuild switch --sudo --use-substitutes --target-host $host --build-host $buildhost
-    #nixos-rebuild switch --sudo --use-substitutes --target-host $host --build-host $buildhost
 }
 
 def ff [ $file: string ] {
@@ -113,4 +72,3 @@ def dc [ $cmd: string = "sh" ] {
 if ("/usr/local/bin" | path exists) {
     $env.PATH = $env.PATH | append "/usr/local/bin"
 }
-$env.PATH = $env.PATH | prepend "~/.local/bin"

home/baseline/shell.nix

@@ -26,7 +26,6 @@
       nixcopy = "nix copy --to \"s3://binary-cache/?profile=default&endpoint=nas.home%3A9000&scheme=http\"";
       r = "run0";
       updateScript = "nix-shell maintainers/scripts/update.nix --argstr package";
-      p = "${lib.getExe pkgs.podman-tui}";
 
       # General
       k = "kubectl";

home/baseline/ssh.nix

@@ -5,7 +5,7 @@
   # This allows things like SSH in distrobox to read the config file just fine
   home.file.".ssh/config" = {
     target = ".ssh/config_source";
-    onChange = "cat ~/.ssh/config_source > ~/.ssh/config && chmod 600 ~/.ssh/config";
+    onChange = ''cat ~/.ssh/config_source > ~/.ssh/config && chmod 600 ~/.ssh/config'';
   };
   programs.ssh = {
     enable = true;
@@ -13,25 +13,24 @@
     includes = [ "config.local" ];
     enableDefaultConfig = false;
 
-    settings =
+    matchBlocks =
       let
         nas = {
-          User = "admin";
+          user = "admin";
         };
         owned = {
-          User = "greg";
+          user = "greg";
         };
       in
       {
         inherit nas;
 
         "*" = {
-          DynamicForward = [ "10240" ];
+          dynamicForwards = [ { port = 10240; } ];
-          ForwardAgent = "yes";
+          serverAliveInterval = 60;
-          LogLevel = "error";
+          extraOptions = {
-          ServerAliveInterval = 60;
+            LogLevel = "error";
-          SetEnv = {
+            SetEnv = "TERM=xterm-256color";
-            TERM = "xterm-256color";
           };
         };
 
@@ -42,46 +41,46 @@
         "chronicles.thehellings.lan" = lib.hm.dag.entryBefore [ "*.thehellings.lan" ] nas;
 
         gh = {
-          User = "git";
+          user = "git";
-          Hostname = "github.com";
+          hostname = "github.com";
         };
         "src" = {
-          User = "git";
+          user = "git";
-          Hostname = "jeremiah.shire-zebra.ts.net";
+          hostname = "jeremiah.shire-zebra.ts.net";
-          Port = 32222;
+          port = 32222;
         };
         srcpub = {
-          User = "git";
+          user = "git";
-          Hostname = "src.thehellings.com";
+          hostname = "src.thehellings.com";
-          Port = 2222;
+          port = 2222;
         };
         ivr = {
-          User = "git";
+          user = "git";
-          Hostname = "gitlab.com";
+          hostname = "gitlab.com";
         };
 
         "ivr.thehellings.lan" = lib.hm.dag.entryBefore [ "ivr" ] {
-          User = "gregory.hellings";
+          user = "gregory.hellings";
         };
 
         "*.thehellings.lan" = owned;
         "10.42.*" = owned;
 
         "host.crosswire.org crosswire" = {
-          Hostname = "host.crosswire.org";
+          hostname = "host.crosswire.org";
-          User = "ghellings";
+          user = "ghellings";
         };
 
         fedpeople = {
-          Hostname = "fedorapeople.org";
+          hostname = "fedorapeople.org";
-          User = "greghellings";
+          user = "greghellings";
         };
 
         "src.fedoraproject.org pkgs.fedoraproject.org" = {
-          User = "greghellings";
+          user = "greghellings";
         };
 
-        "127.*" = {
+        "127.*".extraOptions = {
           PubkeyAcceptedAlgorithms = "+ssh-rsa";
           HostkeyAlgorithms = "+ssh-rsa";
         };

home/baseline/tools.nix

@@ -8,10 +8,11 @@
   home.packages =
     with pkgs;
     [
+      attic-client
       dig
       jqp
       kubernetes-helm
-      #iamb
+      iamb
       lazyssh
       rainfrog
       tenere

home/baseline/xonsh_footer.xsh

@@ -38,6 +38,11 @@ def _ivr2(args):
     vpn("gregory_hellings@ra.ivrtechnology.com", "IVR Technology")
 aliases['ivr2'] = _ivr2
 
+def _glrestart(args):
+    sudo nixos-container run gitlab -- systemctl restart gitlab
+    sudo nixos-container run gitlab -- systemctl restart nginx
+aliases['glrestart'] = _glrestart
+
 def _aws_creds(args):
     $AWS_ACCESS_KEY_ID=$(bw get username "AWS Access Key")
     $AWS_SECRET_ACCESS_KEY=$(bw get password "AWS Access Key")

home/default.nix

@@ -4,15 +4,11 @@
   top,
 }:
 let
-  inherit (top.nixunstable) lib;
   user =
-    host:
+    host: username:
     let
       inherit (metadata.hosts.${host}) system;
       pkgs = nixpkgs.${system};
-      pkgs' = top.self.packages.${system};
-      username =
-        if builtins.hasAttr "user" metadata.hosts.${host} then metadata.hosts.${host}.user else "greg";
     in
     top.hmunstable.lib.homeManagerConfiguration {
       inherit pkgs;
@@ -26,12 +22,25 @@ let
           host
           username
           metadata
-          pkgs'
           ;
         nixvim = top.nixvimunstable;
         gui = false;
         gnome = false;
       };
     };
+  greg = host: (user host "greg");
 in
-(lib.genAttrs (builtins.attrNames (builtins.readDir ./hosts)) user)
+{
+  "MacBook-Pro.local" = user "ivr" "gregory.hellings";
+  "MacBook-Prolocal.local" = user "ivr" "gregory.hellings";
+  "MacBook-Pro.thehellings.lan" = user "ivr" "gregory.hellings";
+  "gregory.hellings-mbp" = user "ivr" "gregory.hellings";
+  genesis = greg "genesis";
+  exodus = greg "exodus";
+  zeke = greg "zeke";
+  isaiah = greg "isaiah";
+  jeremiah = greg "jeremiah";
+  linode = greg "linode";
+  hosea = greg "hosea";
+  gitlab = greg "gitlab";
+}

home/home.nix

@@ -1,6 +1,5 @@
 {
   pkgs,
-  pkgs',
   lib,
   host ? "most",
   top,
@@ -20,14 +19,9 @@ in
   imports = [
     top.nixvimunstable.homeModules.nixvim
     top.self.modules.homeManagerModule
-    top.agenix.homeManagerModules.default
     ./baseline
   ]
-  ++ lib.optionals (builtins.pathExists ./hosts/${host}/default.nix) [ ./hosts/${host} ];
+  ++ lib.optionals (builtins.pathExists ./hosts/${host}) [ ./hosts/${host} ];
-
-  age = {
-    identityPaths = [ "${homeDirectory}/.ssh/id_ed25519" ];
-  };
 
   home = {
     inherit homeDirectory username;
@@ -39,7 +33,7 @@ in
       gh
       git
       gnupatch
-      pkgs'.hms
+      hms
       btop
       inetutils
       jq
@@ -47,7 +41,7 @@ in
       nix-prefetch
       nmap
       openssl
-      pkgs'.setup-ssh
+      setup-ssh
       tmux
       tree
       unzip

home/hosts/builder2/default.nix

@@ -1 +0,0 @@
-{...}: {}

home/hosts/exodus/default.nix

@@ -1,4 +1,4 @@
-{ lib, pkgs, ... }:
+{ pkgs, ... }:
 
 {
   greg = {
@@ -21,32 +21,11 @@
     kubectl
     kubectl-cnpg
     mattermost-desktop
-    minio-client
     mumble
-    nebula
-    nix-index
-    adoptopenjdk-icedtea-web
     pre-commit
-    prismlauncher
-    rclone
     restic
     restic-browser
     tea
     wineWow64Packages.stable
   ];
-  programs = {
-    discord = {
-      enable = true;
-      settings.SKIP_HOST_UPDATE = true;
-    };
-  };
-  xdg.desktopEntries = {
-    prismlauncher = {
-      name = "Prism Launcher - Minecraft";
-      actions.minecraft = {
-        name = "Minecraft";
-        exec = lib.getExe pkgs.prismlauncher;
-      };
-    };
-  };
 }

home/hosts/gregs-MacBook-Pro-16-inch-Nov-2024

@@ -1 +0,0 @@
-lithic/

home/hosts/icdm-root/default.nix

@@ -0,0 +1,4 @@
+{ ... }:
+
+{
+}

home/hosts/ivr

@@ -1 +0,0 @@
-gregory.hellings-mbp/

home/hosts/ivr/default.nix

@@ -1,10 +1,21 @@
 {
   pkgs,
-  pkgs',
   lib,
-  username,
   ...
 }:
+let
+  username = "gregory.hellings";
+  x = pkgs.xonsh.override {
+    extraPackages = (
+      ps: [
+        pkgs.nur.repos.xonsh-xontribs.xonsh-direnv
+        pkgs.nur.repos.xonsh-xontribs.xontrib-vox
+        ps.xonsh-apipenv
+        pkgs.pipenv-ivr
+      ]
+    );
+  };
+in
 {
   # Disables hitting local cache
   _module.args.cache = lib.mkForce false;
@@ -17,43 +28,43 @@
 
   home = {
     packages = with pkgs; [
+      aacs
       ansible
-      claude-code
       direnv
       home-manager
-      pkgs'.dockerCompat
       python3Packages.ipython
       just
-      glab
       go
       gopls
+      k9s
+      kubectl
       mariadb
+      minikube
+      mise
+      nil
       nixVersions.stable
+      pipenv-ivr
       pre-commit
       python311
       python3Packages.flake8
+      skaffold
       twine
+      x
     ];
     file = {
       ".pip/pip.conf".text = ''
         [global]
         retries = 1
-        index-url = https://pypi.python.org/
+        index-url = https://pypi.python.org/simple
         extra-index-url =
-            https://pypidev.ivrtechnology.com/
+            https://pypidev.ivrtechnology.com/simple/
       '';
       ".config/uv/uv.toml".text = ''
-        index-strategy = "unsafe-first-match"
         [[index]]
-        url = "https://pypidev.ivrtechnology.com/"
+        url = "https://pypidev.ivrtechnology.com/simple/"
         name = "pypidev"
-        ignore-error-codes = [403]
       '';
     };
-    sessionVariables = {
-      BW_GITLAB_ITEM = "7d3da4e9-5f9a-49d0-8e14-b39c010a4001";
-      BW_ANTHROPIC_ITEM = "e122fd08-3506-4f21-9c6a-b42b00fe5be1";
-    };
     username = username;
     homeDirectory = "/Users/${username}";
   };
@@ -97,5 +108,6 @@
           "web4"
         ]
     );
+    tmux.shell = (lib.getExe x);
   };
 }

home/hosts/lithic/default.nix

@@ -1,80 +0,0 @@
-{
-  pkgs,
-  pkgs',
-  lib,
-  ...
-}:
-let
-  python = pkgs.python312.withPackages (
-    p: with p; [
-      ipython
-    ]
-  );
-in
-{
-  # Disables hitting local cache
-  _module.args.cache = lib.mkForce false;
-
-  greg = {
-    development = true;
-    gui = true;
-    nix.cache = false;
-    zed = true;
-  };
-
-  home = {
-    packages = with pkgs; [
-      ansible
-      awscli2
-      cargo
-      clippy
-      direnv
-      docker
-      docker-compose
-      docker-buildx
-      go
-      home-manager
-      just
-      mcp-grafana
-      nil
-      nixVersions.stable
-      poetry
-      pre-commit
-      (pulumi.withPackages (
-        p: with p; [
-          pulumi-aws-native
-          pulumi-command
-          pulumi-go
-          pulumi-nodejs
-          pulumi-python
-        ]
-      ))
-      python
-      rustc
-      rustfmt
-      terraform
-    ];
-  };
-
-  programs = {
-    direnv = {
-      enable = true;
-      enableNushellIntegration = true;
-    };
-    nushell = {
-      enable = true;
-    };
-    starship = {
-      enable = true;
-      enableNushellIntegration = true;
-      settings = {
-        directory = {
-          home_symbol = "~";
-          truncate_to_repo = false;
-          truncation_length = 0;
-          use_os_path_sep = true;
-        };
-      };
-    };
-  };
-}

home/hosts/work/default.nix

@@ -0,0 +1,7 @@
+{ pkgs, ... }:
+
+{
+  greg.vscodium.enable = false;
+
+  home.packages = with pkgs; [ brew ];
+}

hosts/baseline.nix

@@ -3,24 +3,19 @@
   lib,
   metadata,
   pkgs,
-  top,
   ...
 }:
 {
   imports = [
     ../modules/nix-conf.nix
-    top.niks3.nixosModules.niks3-auto-upload
   ];
 
-  age.secrets.niks3-api-token.file = ../secrets/niks3/api_token.age;
-
   console = {
     font = "Lat2-Terminus16";
     keyMap = "us";
   };
 
   environment.systemPackages = with pkgs; [
-    top.niks3.packages.${pkgs.stdenv.hostPlatform.system}.niks3
     agenix
     bitwarden-cli
     bmon
@@ -31,9 +26,10 @@
     efibootmgr
     findutils
     file
+    gcc-tune
     git
     gnupatch
-    top.self.packages.${pkgs.stdenv.hostPlatform.system}.hms # My own home manager switcher
+    hms # My own home manager switcher
     iperf
     killall
     nano
@@ -57,25 +53,9 @@
 
   # Network Manager pulls in too many deps
   networking = {
-    extraHosts =
-      let
-        onNetwork =
-          attr: _k: v:
-          (builtins.hasAttr attr v) && v.${attr} != null;
-        getIPs =
-          attr: domain:
-          (lib.mapAttrsToList (host: v: "${builtins.getAttr attr v} ${host}.${domain}") (
-            lib.filterAttrs (onNetwork attr) metadata.hosts
-          ));
-      in
-      builtins.concatStringsSep "\n" (
-        (getIPs "ts" "shire-zebra.ts.net")
-        ++ (getIPs "nebulaIp" "nebula.thehellings.com")
-        ++ (getIPs "nebulaIp" "nebula")
-        ++ (getIPs "ip" "thehellings.lan")
-      );
     search = [
-      "nebula.thehellings.com"
+      "thehellings.lan"
+      "home"
     ];
     networkmanager.enable = false;
   };
@@ -101,12 +81,6 @@
   # Enable the OpenSSH daemon for remote control
   services = {
     locate.enable = true;
-    niks3-auto-upload = {
-      enable = config.greg.nix.cache;
-      authTokenFile = config.age.secrets.niks3-api-token.path;
-      serverUrl = "http://hosea.nebula.thehellings.com:5751";
-      verifyS3Integrity = true;
-    };
     openssh = {
       enable = true;
       settings.X11Forwarding = true;
@@ -140,23 +114,17 @@
     };
   };
 
-  security = {
+  security.sudo.extraRules = [
-    sudo-rs = {
+    {
-      enable = true;
+      users = [ "greg" ];
-      extraRules = [
+      commands = [
         {
-          users = [ "greg" ];
+          command = "ALL";
-          commands = [
+          options = [ "NOPASSWD" ];
-            {
-              command = "ALL";
-              options = [ "NOPASSWD" ];
-            }
-          ];
         }
       ];
-    };
+    }
-    sudo.enable = false;
+  ];
-  };
 
   # Define a user account. Don't forget to set a password with ‘passwd’.
   users.users.greg = {

hosts/default.nix

@@ -1,6 +1,5 @@
 {
   top,
-  lib',
   metadata,
   nixpkgs,
 }:
@@ -15,22 +14,15 @@ let
     }:
     let
       inherit (metadata.hosts.${name}) system;
-      pkgs' = top.self.packages.${system};
     in
     channel.lib.nixosSystem {
       pkgs = nixpkgs.${system};
       specialArgs = {
-        inherit
+        inherit metadata top;
-          metadata
-          top
-          lib'
-          pkgs'
-          ;
       };
       modules = [
         {
           nixpkgs.hostPlatform = system;
-          networking.hostName = name;
         }
         # Imported ones
         top.agenix.nixosModules.default
@@ -52,6 +44,16 @@ in
     })
   )
 )
+// (lib.genAttrs
+  (builtins.attrNames (lib.filterAttrs (_: v: v == "directory") (builtins.readDir ./vm)))
+  (
+    name:
+    (unstable {
+      inherit name;
+      extraMods = [ ./vm/${name} ];
+    })
+  )
+)
 // {
   # nix build '.#nixosConfigurations.wsl.config.system.build.installer'
   #nixos = wsl { name = "wsl"; };
@@ -60,4 +62,26 @@ in
   #  name = "wsl";
   #  system = "aarch64-linux";
   #};
+
+  builder-aarch = lib.nixosSystem {
+    system = "aarch64-linux";
+    modules = [
+      "${top.nixunstable}/nixos/modules/profiles/nix-builder-vm.nix"
+      {
+        virtualisation.host.pkgs = import top.nixunstable { system = "aarch64-darwin"; };
+        boot.loader.grub.devices = [ "/dev/vda" ];
+      }
+    ];
+  };
+
+  builder-x86 = lib.nixosSystem {
+    system = "x86_64-linux";
+    modules = [
+      "${top.nixunstable}/nixos/modules/profiles/nix-builder-vm.nix"
+      {
+        virtualisation.host.pkgs = import top.nixunstable { system = "aarch64-darwin"; };
+        boot.loader.grub.devices = [ "/dev/vda" ];
+      }
+    ];
+  };
 }

hosts/unstable/exodus/default.nix

@@ -9,16 +9,16 @@
 {
   imports = [
     ./hardware-configuration.nix
-    top.nix-hardware.nixosModules.framework-intel-core-ultra-series1
+    top.nix-hardware.nixosModules.framework-11th-gen-intel
   ];
 
+  age.secrets = {
+    compose-attic.file = ../../../secrets/compose/attic.env.age;
+  };
+
   boot = {
     loader = {
-      systemd-boot = {
+      systemd-boot.enable = true;
-        enable = true;
-        memtest86.enable = true;
-        netbootxyz.enable = true;
-      };
       efi.canTouchEfiVariables = true;
     };
     binfmt.emulatedSystems = [
@@ -39,6 +39,10 @@
       enable = true;
       tags = [ "mobile" ];
     };
+    runner = {
+      enable = true;
+      qemu = true;
+    };
   };
 
   hardware = {

hosts/unstable/genesis/default.nix

@@ -2,23 +2,48 @@
 # your system.  Help is available in the configuration.nix(5) man page
 # and in the NixOS manual (accessible by running ‘nixos-help’).
 
-{
+{ lib, pkgs, ... }:
-  top,
+
-  pkgs,
+let
-  pkgs',
+  adblockUpdate = pkgs.writeShellApplication {
-  ...
+    name = "adblock-update";
-}:
+    runtimeInputs = with pkgs; [
+      curl
+      gnused
+      systemd
+    ];
+    text = ''
+      curl -s https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts | sed '1,33d' > /etc/adblock_hosts
+      curl -s https://adaway.org/hosts.txt | sed '1,24d' | sed 's/127.0.0.1/0.0.0.0/' >> /etc/adblock_hosts
+
+      # Custom domains that I need to preserve for some reason
+      for f in "segment.com" "segment.io" "branch.io" "dev.visualwebsiteoptimizer.com" "click.discord.com"; do
+       	sed -i -e "/''${f}/d" /etc/adblock_hosts  # Blocks Trelly content for house investors
+      done
+
+      systemctl restart dnsmasq
+    '';
+  };
+in
 {
   imports = [
     # Include the results of the hardware scan.
     ./hardware-configuration.nix
     ./networking.nix
-    top.minecraft.nixosModules.minecraft-servers
   ];
 
   greg = {
     home = true;
     gnome.enable = false;
+    nebula = {
+      enable = true;
+      # genesis IS the routing node for the home LAN — it does not route through itself.
+      # Override the module default (which points at genesis) to avoid a routing loop.
+      unsafeRoutes = [ ];
+      # genesis routes the home LAN (10.42.0.0/16) into the Nebula overlay.
+      # Sign genesis's cert with -subnets '10.42.0.0/16' (see secrets/nebula/README.md).
+      routesSubnet = "10.42.0.0/16";
+    };
     proxies = {
     };
   };
@@ -36,121 +61,26 @@
   };
 
   environment.systemPackages = with pkgs; [
-    pkgs'.create_ssl
+    create_ssl
     step-ca
   ];
 
   networking.hostName = "genesis"; # Define your hostname.
 
-  services = {
+  systemd = {
-    minecraft-servers = {
+    services.adblock-update = {
-      enable = true;
+      after = [ "network-online.target" ];
-      eula = true;
+      requires = [ "network-online.target" ];
-      openFirewall = true;
+      script = lib.getExe adblockUpdate;
-
+      serviceConfig.Type = "oneshot";
-      servers = {
+    };
-        maya = {
+    timers.adblock-update = {
-          enable = true;
+      wantedBy = [ "multi-user.target" ];
-          operators = {
+      after = [ "network-online.target" ];
-            Almec = {
+      requires = [ "network-online.target" ];
-              bypassesPlayerLimit = true;
+      timerConfig = {
-              uuid = "7884dc5a-ae21-43d5-9506-a934d59be19a";
+        OnCalendar = "daily";
-            };
+        Unit = "adblock-update.service";
-          };
-          package = pkgs.fabricServers.fabric.override { jre_headless = pkgs.openjdk25_headless; };
-
-          serverProperties = {
-            allow-flight = true;
-            motd = "Maya's Minecraft World";
-            online-mode = true;
-          };
-          whitelist = { };
-
-          jvmOpts = "-Xms4092M -Xmx4092M";
-
-          symlinks = {
-            mods = pkgs.linkFarmFromDrvs "mods" (
-              builtins.attrValues {
-                # Health info
-                appleskin = pkgs.fetchurl {
-                  url = "https://cdn.modrinth.com/data/EsAfCjCV/versions/HwaLJe3v/appleskin-fabric-mc26.1-3.0.9.jar";
-                  hash = "sha256-iNCycR/oxqFpbPGfIcfgfWOm7PzPiIu5AmBWb8asTb4=";
-                };
-                # Needed by survivalfly
-                balm = pkgs.fetchurl {
-                  url = "https://mediafilez.forgecdn.net/files/7959/843/balm-fabric-26.1.2-26.1.2.4.jar";
-                  hash = "sha256-zDtDxkxOftpW0wUIap7l6abGCjXNczwrF2wLZDztyA0=";
-                };
-                # Adds more diverse biomes
-                # https://www.curseforge.com/minecraft/mc-mods/biomes-o-plenty
-                biomes = pkgs.fetchurl {
-                  url = "https://mediafilez.forgecdn.net/files/7977/180/BiomesOPlenty-fabric-26.1.2-26.1.2.0.3.jar";
-                  hash = "sha256-0aPtsRep0ftbkKqbp69PgUnNJyOBLY9vcPsB1mhOy/M=";
-                };
-                # Automation engines
-                # https://www.curseforge.com/minecraft/mc-mods/create
-                #create = pkgs.fetchurl {
-                #  url = "https://mediafilez.forgecdn.net/files/7963/363/create-1.21.1-6.0.10.jar";
-                #  hash = "sha256-74f+Vwnxuh9bi7IKKSW1r7RmnheP1ti/EMFndZ7v43o=";
-                #};
-                fabric_api = pkgs.fetchurl {
-                  url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/tnmuHGZA/fabric-api-0.146.1%2B26.1.2.jar";
-                  hash = "sha256-8Jy/xmxRtw4z4GJ+38wwbXHVn4NGYp4w/mFvW9cmvKg=";
-                };
-                # Required by biomes-o-plenty
-                # https://www.curseforge.com/minecraft/mc-mods/glitchcore
-                glitchcore = pkgs.fetchurl {
-                  url = "https://mediafilez.forgecdn.net/files/7975/608/GlitchCore-fabric-26.1.2-26.1.2.0.0.jar";
-                  hash = "sha256-IDz+TblWvgt4UxFg3L3DhFMEESoX7y5cTOvXhyccQm8=";
-                };
-                # Tooltips
-                # https://www.curseforge.com/minecraft/mc-mods/jade/
-                jade = pkgs.fetchurl {
-                  url = "https://mediafilez.forgecdn.net/files/7886/518/Jade-mc26.1-Fabric-26.0.8.jar";
-                  hash = "sha256-Pc3R5eO4Jf+94mNMPtY/vvpbomp+S+qnAUAVbQk1r2Y=";
-                };
-                # Gives info on crafting recipes
-                # https://www.curseforge.com/minecraft/mc-mods/jei
-                jei = pkgs.fetchurl {
-                  url = "https://mediafilez.forgecdn.net/files/7920/925/jei-26.1.2-fabric-29.5.0.26.jar";
-                  hash = "sha256-7nF7fXYPIg9the/mxi6pUYEmKtosZO6yL2b0Dgf8+fI=";
-                };
-                # Machines
-                # https://www.curseforge.com/minecraft/mc-mods/mekanism
-                #mekanism = pkgs.fetchurl {
-                #  url = "https://mediafilez.forgecdn.net/files/7904/58/Mekanism-1.21.1-10.7.19.85.jar";
-                #  hash = "sha256-AE28nzEG9NGSrqoe4RkN0W7JyoBZ7T0JO4ADT0xXT0M=";
-                #};
-                # Shows installed mods
-                modmenu = pkgs.fetchurl {
-                  url = "https://cdn.modrinth.com/data/mOgUt4GM/versions/jvjwXH6l/modmenu-18.0.0-alpha.8.jar";
-                  hash = "sha256-u0gtCOVAnNxyHcslo+y9l/jCGsFb+U/Y8soiUilhZDA=";
-                };
-                # Better storage engines
-                # https://www.curseforge.com/minecraft/mc-mods/refined-storage
-                refined-storage = pkgs.fetchurl {
-                  url = "https://mediafilez.forgecdn.net/files/8086/588/refinedstorage-fabric-3.0.0.jar";
-                  hash = "sha256-LuOF0aYQon78AQeD5fQ8OXHCnekfa+PNKpH7cqimFNs=";
-                };
-                # https://www.curseforge.com/minecraft/mc-mods/storage-drawers
-                #storagedrawers = pkgs.fetchurl {
-                #url = "https://mediafilez.forgecdn.net/files/7352/799/StorageDrawers-fabric-1.21.11-20.0.0.jar";
-                #hash = "sha256-eBKCmAtjAhdAjOyLMRneu/NZnNt+orIezxPy6V8g/S8=";
-                #};
-                survivalfly = pkgs.fetchurl {
-                  url = "https://mediafilez.forgecdn.net/files/7870/312/survivalfly-1.3_fabric-mc26.1.1.jar";
-                  hash = "sha256-Kai4wSxckpXbs1yLp8wJ4BmmjNkdDbeqerqWGIz3+Zk=";
-                };
-                # Also needed by biomes
-                # https://www.curseforge.com/minecraft/mc-mods/terrablender-fabric
-                terrablender = pkgs.fetchurl {
-                  url = "https://mediafilez.forgecdn.net/files/7933/873/TerraBlender-fabric-26.1.2-26.1.2.0.1.jar";
-                  hash = "sha256-lUrkmMIod54Qj78H0rzT4EYoEeiBG7w6sVOJlRvsnQ4=";
-                };
-              }
-            );
-          };
-        };
       };
     };
   };

hosts/unstable/genesis/net/hosts

@@ -1,11 +1,12 @@
 # Local hosts
 10.42.0.1 switch switch.thehellings.lan  # Core switch for the network
 10.42.0.3 ap ap.thehellings.lan  # OpenWRT access point (static IP)
-10.42.0.4 pve1.thehellings.lan  # Proxmox
+10.42.0.4 joel.thehellings.lan  # Proxmox
 10.42.0.5 sanswitch.thehellings.lan  # Core switch for the SAN
 
 # Home servers
-10.42.1.1 udm router udm.thehellings.lan router.thehellings.lan  # Ubiquiti UDM gateway
+10.42.1.1 pve1.thehellings.lan
+10.42.1.2 opnsense router opnsense.thehellings.lan router.thehellings.lan
 10.42.1.3 printer.thehellings.lan
 10.42.1.4 chronicles chronicles.thehellings.lan nas.thehellings.lan s3.thehellings.lan
 10.42.1.5 genesis genesis.thehellings.lan dns dns.thehellings.lan smart smart.thehellings.lan speedtest.thehellings.lan nixcache.thehellings.lan gitcache.thehellings.lan
@@ -21,6 +22,8 @@
 
 # VMs
 10.42.4.1 matrix matrix.thehellings.lan
+#10.42.4.2 vm-jellyfin vm-jellyfin.thehellings.lan
+10.42.4.3 git gitlab git.thehellings.lan gitlab.thehellings.lan
 
 # VIP
 10.42.5.1 longhorn.cluster matrix.cluster pgadmin.cluter postgres.cluster immich.cluster
@@ -34,6 +37,7 @@
 100.88.91.27 dns.home
 100.70.99.91 exodus.home exodus.shire-zebra.ts.net
 100.96.198.104 genesis.home genesis.shire-zebra.ts.net smart.home zwave.home nixcache.home gitcache.home dashy.home uptime.home speed.home
+100.117.28.111 gitlab.home gitlab.shire-zebra.ts.net gitlab.thehellings.lan registry.thehellings.lan git.thehellings.lan
 100.68.203.1 hosea.home hosea.shire-zebra.ts.net grafana.home
 100.84.183.79 isaiah.home isaiah.shire-zebra.ts.net pgadmin.kubernetes longhorn.kubernetes
 100.102.186.39 jeremiah.home jeremiah.shire-zebra.ts.net matrix.kubernetes immich.kubernetes postgres.kubernetes buildbot.home

hosts/unstable/genesis/networking.nix

@@ -1,9 +1,7 @@
 {
   config,
-  lib,
-  lib',
-  metadata,
   pkgs,
+  metadata,
   ...
 }:
 let
@@ -11,6 +9,7 @@ let
   lanIP = metadata.hosts.${config.networking.hostName}.ip;
   iot = "enp2s0";
   iotIP = "192.168.66.250";
+  #routerIP = metadata.infra.gw;
   extraHosts = builtins.readFile ./net/hosts;
 
   proxyPort = 3128;
@@ -22,24 +21,12 @@ let
     #"1.0.0.1" # Cloudflare
     #"149.112.112.112" # Quad 9
     metadata.infra.gw # Currently using our UniFi router for DNS as well
-    "100.100.100.100"
   ];
 in
 {
-  greg = {
+  greg.tailscale = {
-    nebula = {
+    enable = true;
-      enable = true;
+    tags = [ "home" ];
-      # genesis IS the routing node for the home LAN — it does not route through itself.
-      # Override the module default (which points at genesis) to avoid a routing loop.
-      unsafeRoutes = [ ];
-      # genesis routes the home LAN (10.42.0.0/16) into the Nebula overlay.
-      # Sign genesis's cert with -subnets '10.42.0.0/16' (see secrets/nebula/README.md).
-      routesSubnet = "10.42.0.0/16";
-    };
-    tailscale = {
-      enable = true;
-      tags = [ "home" ];
-    };
   };
 
   # Really, why do I still have to force-disable this crap?
@@ -77,7 +64,7 @@ in
       };
     };
     firewall = {
-      enable = true;
+      enable = false;
       allowedUDPPorts = [
         dhcpPort
         dnsPort
@@ -88,7 +75,7 @@ in
         80
       ];
     };
-    nftables.enable = true;
+    nftables.enable = false;
   };
 
   environment.etc."hosts.d/local".text = extraHosts;
@@ -97,48 +84,33 @@ in
     #########
     # dnsmasq config
     ########
-    bind = {
+    dnsmasq = {
       enable = true;
-      cacheNetworks = [
+      settings = {
-        metadata.infra.lan
+        domain = "thehellings.lan";
-        metadata.infra.tailscale
+        expand-hosts = true;
-        metadata.infra.nebula
+        log-queries = true;
-        "127.0.0.0/8"
+        no-hosts = true; # Do not read /etc/hosts, which makes genesis resolve to 127.0.0.2
-      ];
+        addn-hosts = "/etc/adblock_hosts";
-      zones =
+        hostsdir = "/etc/hosts.d/";
-        let
+        server = dnsServers;
-          makeZoneFile =
+      };
-            hosts: domain:
+    };
-            let
+
-              preamble = [
+    prometheus.exporters = {
-                "$ORIGIN\t${domain}."
+      dnsmasq.enable = true;
-                "$TTL\t1h"
+      blackbox = {
-                "@\tIN\tSOA\t${config.networking.hostName}\tgreg@thehellings.com (1 1m 1m 1m 1m)"
+        enable = true;
-                "\tIN\tNS\t${config.networking.hostName}"
+        openFirewall = true;
-              ];
+        configFile = pkgs.writeText "blackbox.yml" ''
-              makeHost =
+          modules:
-                host:
+            icmp:
-                [ "${host.name}\tIN\tA\t${host.address}" ]
+              prober: icmp
-                ++ lib.map (a: "${a}\tIN\tA\t${host.address}") (
+              timeout: 5s
-                  if builtins.hasAttr "aliases" host then host.aliases else [ ]
+              icmp:
-                );
+                preferred_ip_protocol: ip4
-            in
+        '';
-            pkgs.writeText "${domain}" (
+      };
-              builtins.concatStringsSep "\n" (preamble ++ (lib.flatten (lib.map makeHost hosts)) ++ [ "" ])
-            );
-        in
-        lib.mapAttrs
-          (domain: net: {
-            master = true;
-            file = makeZoneFile (lib'.hostsByNet net (metadata.hosts // metadata.external)) domain;
-          })
-          {
-            "shire-zebra.ts.net" = "tailscale";
-            "nebula.thehellings.com" = "nebula";
-            nebula = "nebula";
-            "thehellings.lan" = "lan";
-            lan = "lan";
-          };
     };
   }; # End of services configuration
 

hosts/unstable/genesis/networking/dhcp.nix

@@ -60,7 +60,7 @@
         reservations = [
           # Static IPs for personal work
           {
-            hw-address = "00:23:24:72:64:32"; # PVE1
+            hw-address = "00:23:24:72:64:32"; # Joel
             ip-address = "10.42.0.4";
           }
           {
@@ -76,6 +76,10 @@
             #ip-address = "10.42.2.253";
             ip-address = "10.42.100.6";
           }
+          {
+            hw-address = "7c:83:34:b9:ee:ec"; # PVE1
+            ip-address = "10.42.1.1";
+          }
           {
             hw-address = "74:ee:2a:66:b3:51"; # printer
             ip-address = "10.42.1.3";

hosts/unstable/hosea/arr.nix

@@ -0,0 +1,70 @@
+{
+  lib,
+  metadata,
+  pkgs,
+  ...
+}:
+let
+  ips = lib.filterAttrs (_k: v: v ? "ip" && v.ip != null) metadata.hosts;
+  tps = lib.filterAttrs (_k: v: v ? "ts" && v.ts != null) metadata.hosts;
+  get = field: set: lib.mapAttrsToList (_k: v: v.${field}) set;
+  getTS = get "ts" tps;
+  getIP = get "ip" ips;
+  whitelists = builtins.concatStringsSep "," (
+    [
+      "localhost"
+      "127.0.0.1"
+    ]
+    ++ getTS
+    ++ getIP
+  );
+in
+{
+  services = {
+    prowlarr = {
+      enable = true;
+      dataDir = "/arr/prowlarr";
+      openFirewall = true;
+    };
+    radarr = {
+      enable = true;
+      openFirewall = true;
+    };
+    transmission = {
+      enable = true;
+      openPeerPorts = true;
+      openRPCPort = true;
+      package = pkgs.transmission_4;
+      settings = {
+        download-dir = "/arr/transmission/downloads";
+        rpc-bind-address = "0.0.0.0";
+        rpc-host-whitelist = whitelists;
+        rpc-host-whitelist-enabled = false;
+        rpc-whitelist = whitelists;
+        rpc-whitelist-enabled = false;
+        watch-dir-enabled = true;
+        watch-dir = "/arr/transmission/incoming";
+      };
+    };
+  };
+
+  systemd.mounts =
+    let
+      nfs = name: {
+        what = "nas1.shire-zebra.ts.net:/mnt/all/${name}";
+        type = "nfs";
+        name = "${name}.mount";
+        where = "/${name}";
+        requires = [ "tailscaled-autoconnect.service" ];
+        after = [ "tailscaled-autoconnect.service" ];
+        wantedBy = [ "multi-user.target" ];
+        mountConfig.Options = "_netdev,noexec,timeo=50,retrans=5,soft";
+      };
+    in
+    [
+      (nfs "arr")
+      (nfs "music")
+      (nfs "photos")
+      (nfs "video")
+    ];
+}

hosts/unstable/hosea/default.nix

@@ -6,7 +6,6 @@
   config,
   metadata,
   pkgs,
-  top,
   ...
 }:
 let
@@ -18,31 +17,13 @@ in
 {
   imports = [
     # Include the results of the hardware scan.
+    ./arr.nix
     ./hardware-configuration.nix
-    top.niks3.nixosModules.niks3
   ];
 
-  age.secrets = {
+  age.secrets.grafana-secret-key = {
-    cache-private-key = {
+    file = ../../../secrets/grafana-secret-key.age;
-      file = ../../../secrets/cache-private-key.age;
+    owner = "grafana";
-      owner = "niks3";
-    };
-    grafana-secret-key = {
-      file = ../../../secrets/grafana-secret-key.age;
-      owner = "grafana";
-    };
-    niks3-access-key-id = {
-      file = ../../../secrets/niks3/access_key_id.age;
-      owner = "niks3";
-    };
-    niks3-api-token = {
-      file = ../../../secrets/niks3/api_token.age;
-      owner = "niks3";
-    };
-    niks3-secret-access-key = {
-      file = ../../../secrets/niks3/secret_access_key.age;
-      owner = "niks3";
-    };
   };
 
   # Bootloader
@@ -117,7 +98,6 @@ in
         ];
       };
     };
-    firewall.interfaces.nebula0.allowedTCPPorts = [ 5751 ];
     nameservers = [ metadata.infra.dns ];
   };
 
@@ -170,27 +150,6 @@ in
         analytics.reporting_enabled = false;
       };
     };
-    niks3 = {
-      enable = true;
-
-      apiTokenFile = config.age.secrets.niks3-api-token.path;
-      gc.enable = false;
-      httpAddr = "${metadata.hosts.hosea.nebulaIp}:5751";
-      nginx = {
-        enable = true;
-        domain = "hosea.nebula";
-        enableACME = false;
-        forceSSL = false;
-      };
-      s3 = {
-        accessKeyFile = config.age.secrets.niks3-access-key-id.path;
-        bucket = "niks3";
-        endpoint = "nas1.shire-zebra.ts.net:30188";
-        secretKeyFile = config.age.secrets.niks3-secret-access-key.path;
-        useSSL = false;
-      };
-      signKeyFiles = [ config.age.secrets.cache-private-key.path ];
-    };
     prometheus.exporters.graphite.enable = true;
     # Configure keymap
     xserver.xkb = {
@@ -199,25 +158,6 @@ in
     };
   };
 
-  systemd.mounts =
-    let
-      nfs = name: {
-        what = "nas1.shire-zebra.ts.net:/mnt/all/${name}";
-        type = "nfs";
-        name = "${name}.mount";
-        where = "/${name}";
-        requires = [ "tailscaled-autoconnect.service" ];
-        after = [ "tailscaled-autoconnect.service" ];
-        wantedBy = [ "multi-user.target" ];
-        mountConfig.Options = "_netdev,noexec,timeo=50,retrans=5,soft";
-      };
-    in
-    [
-      (nfs "music")
-      (nfs "photos")
-      (nfs "video")
-    ];
-
   # After first deploy: create a Grafana service account + API token for Klaatu
   # via the Grafana UI, then encrypt it: agenix -e secrets/grafana-api-token.age
   age.secrets.grafana-api-token = {

hosts/unstable/icdm-root/boot.nix

@@ -0,0 +1,11 @@
+{ ... }:
+
+{
+  # Bootloader.
+  boot = {
+    loader.grub = {
+      enable = true;
+      device = "/dev/sda";
+    };
+  };
+}

hosts/unstable/icdm-root/default.nix

@@ -0,0 +1,28 @@
+# Edit this configuration file to define what should be installed on
+# your system.  Help is available in the configuration.nix(5) man page
+# and in the NixOS manual (accessible by running ‘nixos-help’).
+
+{ pkgs, ... }:
+
+{
+  imports = [
+    # Include the results of the hardware scan.
+    ./hardware-configuration.nix
+    ./boot.nix
+    ./filesystem.nix
+    ./location.nix
+    ./networking.nix
+    ./wiki.nix
+  ];
+
+  # Define a user account. Don't forget to set a password with ‘passwd’.
+  users.users.greg = {
+    isNormalUser = true;
+    description = "Gregory Hellings";
+    extraGroups = [
+      "networkmanager"
+      "wheel"
+    ];
+    packages = with pkgs; [ ];
+  };
+}

hosts/unstable/icdm-root/filesystem.nix

@@ -0,0 +1,13 @@
+{ ... }:
+
+let
+in
+{
+  fileSystems."serve" = {
+    #device = "10.42.1.4:/volume1/icdm-mysql/";
+    #fsType = "nfs";
+    device = "/dev/sdb1";
+    fsType = "auto";
+    mountPoint = "/srv";
+  };
+}

hosts/unstable/icdm-root/hardware-configuration.nix

@@ -0,0 +1,53 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  config,
+  lib,
+  modulesPath,
+  ...
+}:
+
+{
+  imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
+
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "ehci_pci"
+    "ahci"
+    "usbhid"
+    "usb_storage"
+    "sd_mod"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/dab0d455-e25e-4445-8fa4-5320047d7e7b";
+    fsType = "btrfs";
+    options = [ "subvol=@" ];
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/5aedbb07-5761-423b-909d-2560405eae32";
+    fsType = "ext4";
+  };
+
+  fileSystems."/var" = {
+    device = "/dev/disk/by-uuid/57968536-c29d-417d-997e-85223d1d1f65";
+    fsType = "btrfs";
+  };
+
+  swapDevices = [ { device = "/dev/disk/by-uuid/09691dce-375a-43c6-8d40-4498d20a6d9a"; } ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.eno1.useDHCP = lib.mkDefault true;
+  # networking.interfaces.wlp2s0.useDHCP = lib.mkDefault true;
+
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/unstable/icdm-root/location.nix

@@ -0,0 +1,15 @@
+{ ... }:
+
+{
+  # Set your time zone.
+  time.timeZone = "America/Chicago";
+
+  # Select internationalisation properties.
+  i18n.defaultLocale = "en_US.UTF-8";
+
+  # Configure keymap in X11
+  services.xserver.xkb = {
+    layout = "us";
+    variant = "";
+  };
+}

hosts/unstable/icdm-root/networking.nix

@@ -0,0 +1,63 @@
+{ ... }:
+let
+  dnsHosts = builtins.concatStringsSep "\n" [ "wiki.icdm.lan 10.42.101.1" ];
+in
+{
+  # If we have to do proxying in Bayonnais, we can start to work on that here
+  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
+  networking = {
+    hostName = "icdm-root";
+    useDHCP = false;
+    defaultGateway = "10.42.1.1";
+    nameservers = [
+      "100.100.100.100"
+      "10.42.1.2"
+    ];
+    enableIPv6 = false;
+
+    interfaces = {
+      eno1.ipv4.addresses = [
+        {
+          address = "10.42.101.1";
+          prefixLength = 16;
+        }
+        {
+          address = "10.77.1.2";
+          prefixLength = 16;
+        }
+      ];
+    };
+    # Allow traffic through
+    firewall = {
+      enable = true;
+      allowedTCPPorts = [ 53 ];
+      allowedUDPPorts = [
+        53
+        67
+      ];
+    };
+
+    extraHosts = "${dnsHosts}";
+  };
+
+  services.dnsmasq = {
+    enable = true;
+    settings = {
+      domain = "icdm.lan";
+      dhcp-range = [ "eno1,10.77.1.10,10.77.1.255,255.255.0.0,12h" ];
+      dhcp-option = [
+        "eno1,option:router,10.77.1.1"
+        "eno1,option:dns-server,10.77.1.2,1.1.1.1"
+        "eno1,option:domain-search,icdm.lan"
+      ];
+      expand-hosts = true;
+      log-dhcp = true;
+      log-queries = true;
+      # Upstream servers
+      server = [
+        "1.1.1.1"
+        "8.8.4.4"
+      ];
+    };
+  };
+}

hosts/unstable/icdm-root/wiki.nix

@@ -0,0 +1,17 @@
+{ pkgs, ... }:
+let
+  wikiHost = "wiki.icdm.lan";
+  kiwixport = 8080;
+in
+{
+  services.kiwix-serve = {
+    enable = true;
+    port = kiwixport;
+    library = {
+      inherit (pkgs) zim;
+    };
+  };
+
+  greg.proxies."${wikiHost}".target = "http://localhost:${toString kiwixport}";
+  networking.firewall.allowedTCPPorts = [ 80 ];
+}

hosts/unstable/isaiah/default.nix

@@ -9,6 +9,14 @@
     ./hardware-configuration.nix
   ];
 
+  age.secrets = {
+    gitea-runner-isaiah-podman.file = ../../../secrets/gitea/runner-isaiah-podman.age;
+    gitea-workerPassword.file = ../../../secrets/gitea/workerPassword.age;
+    runner-reg.file = ../../../secrets/gitlab/kubernetes-k3s-local.age;
+    # TODO: Greg add agenix secret at secrets/gitea-runner-isaiah.age
+    # gitea-runner-isaiah.file = ../../../secrets/gitea-runner-isaiah.age;
+  };
+
   boot = {
     binfmt.emulatedSystems = [ "aarch64-linux" ];
     extraModprobeConfig = "options kvm_amd nested=1";
@@ -43,13 +51,15 @@
       tags = [ "home" ];
     };
     remote-builder.enable = true;
+    runner = {
+      enable = true;
+      qemu = true;
+    };
     gitea-runner = {
       enable = true;
-      extraLabels = [ "bare-metal:host" ];
+      labels = [ "self-hosted" "bare-metal" "host:isaiah" ];
-    };
+      # TODO: Greg add agenix secret at secrets/gitea-runner-isaiah.age
-    vmdev = {
+      # tokenFile = config.age.secrets.gitea-runner-isaiah.path;
-      enable = true;
-      host = "libvirt";
     };
   };
 
@@ -65,6 +75,41 @@
   };
 
   services = {
+    gitea-actions-runner.instances.podman = {
+      enable = true;
+      labels = [
+        "debian-latest:docker://node:25-trixie"
+
+        "ubuntu-latest:docker://docker.gitea.com/runner-images:ubuntu-latest"
+        "ubuntu-24.04:docker://docker.gitea.com/runner-images:ubuntu-24.04"
+        "ubuntu-22.04:docker://docker.gitea.com/runner-images:ubuntu-22.04"
+
+        "ubuntu-full-latest:docker://ghcr.io/catthehacker/ubuntu:full-latest"
+        "ubuntu-full-24.04:docker://ghcr.io/catthehacker/ubuntu:full-24.04"
+        "ubuntu-full-22.04:docker://ghcr.io/catthehacker/ubuntu:full-22.04"
+
+        "ubuntu-act-latest:docker://ghcr.io/catthehacker/ubuntu:act-latest"
+        "ubuntu-act-24.04:docker://ghcr.io/catthehacker/ubuntu:act-24.04"
+        "ubuntu-act-22.04:docker://ghcr.io/catthehacker/ubuntu:act-22.04"
+
+        "ubuntu-runner-latest:docker://ghcr.io/catthehacker/ubuntu:runner-latest"
+        "ubuntu-runner-24.04:docker://ghcr.io/catthehacker/ubuntu:runner-24.04"
+        "ubuntu-runner-22.04:docker://ghcr.io/catthehacker/ubuntu:runner-22.04"
+
+        "ubuntu-rust-latest:docker://ghcr.io/catthehacker/ubuntu:rust-latest"
+        "ubuntu-rust-24.04:docker://ghcr.io/catthehacker/ubuntu:rust-24.04"
+        "ubuntu-rust-22.04:docker://ghcr.io/catthehacker/ubuntu:rust-22.04"
+
+        "nix-latest:docker://src.thehellings.com/greg/builder:latest"
+      ];
+      name = "isaiah-podman";
+      settings = {
+        container.force_pull = true;
+        runner.capacity = 7;
+      };
+      tokenFile = config.age.secrets.gitea-runner-isaiah-podman.path;
+      url = "https://gitea.shire-zebra.ts.net";
+    };
     k3s.clusterInit = true; # This is the first node in the cluster
     openssh = {
       enable = true;

hosts/unstable/jeremiah/default.nix

@@ -22,11 +22,15 @@ in
   ];
 
   age.secrets = {
+    runner-reg.file = ../../../secrets/gitlab/nixos-qemu-shell.age;
+
     gitea-buildbotWorkersFile = mk ../../../secrets/gitea/buildbotWorkersFile.age;
     gitea-oauthToken = mk ../../../secrets/gitea/oauthToken.age;
     gitea-oauthSecret = mk ../../../secrets/gitea/oauthSecret.age;
     gitea-webhookSecret = mk ../../../secrets/gitea/webhookSecret.age;
     gitea-workerPassword = mk ../../../secrets/gitea/workerPassword.age;
+    # TODO: Greg add agenix secret at secrets/gitea-runner-jeremiah.age
+    # gitea-runner-jeremiah.file = ../../../secrets/gitea-runner-jeremiah.age;
   };
 
   # Bootloader.
@@ -76,10 +80,6 @@ in
   };
 
   greg = {
-    gitea-runner = {
-      enable = true;
-      extraLabels = [ "bare-metal:host" ];
-    };
     home = true;
     kubernetes = {
       enable = true;
@@ -88,12 +88,22 @@ in
       priority = 254;
     };
     nebula.enable = true;
-    proxies."buildbot.nebula.thehellings.com".target = "http://buildbot.nebula.thehellings.com:8010/";
     tailscale = {
       enable = true;
       tags = [ "home" ];
     };
     remote-builder.enable = true;
+    runner = {
+      enable = true;
+      threads = 3;
+      qemu = true;
+    };
+    gitea-runner = {
+      enable = true;
+      labels = [ "self-hosted" "bare-metal" "host:jeremiah" ];
+      # TODO: Greg add agenix secret at secrets/gitea-runner-jeremiah.age
+      # tokenFile = config.age.secrets.gitea-runner-jeremiah.path;
+    };
   };
 
   hardware = {
@@ -143,7 +153,7 @@ in
             updateOutputs = false;
           };
         };
-        domain = "buildbot.nebula.thehellings.com:8010";
+        domain = "${config.networking.hostName}.shire-zebra.ts.net";
         evalMaxMemorySize = 8192;
         evalWorkerCount = 4;
         gitea = {
@@ -156,7 +166,7 @@ in
           webhookSecretFile = config.age.secrets.gitea-webhookSecret.path;
         };
         showTrace = true;
-        #webhookBaseUrl = "http://${config.networking.hostName}.nebula.thehellings.com:8010";
+        #webhookBaseUrl = "http://${config.networking.hostName}.shire-zebra.ts.net:8010";
         workersFile = config.age.secrets.gitea-buildbotWorkersFile.path;
       };
       worker = {

hosts/unstable/kuma/default.nix

@@ -1,76 +0,0 @@
-{
-  config,
-  metadata,
-  modulesPath,
-  pkgs,
-  ...
-}:
-{
-  imports = [ "${modulesPath}/virtualisation/proxmox-image.nix" ];
-  greg = {
-    home = true;
-    nebula.enable = true;
-    proxies =
-      let
-        tgt = {
-          target = "http://localhost:${config.services.uptime-kuma.settings.PORT}";
-          genAliases = false;
-        };
-      in
-      {
-        "kuma.nebula.thehellings.com" = tgt;
-        "kuma.thehellings.lan" = tgt;
-        "kuma.shire-zebra.ts.net" = tgt;
-      };
-  };
-  nix.settings = {
-    sandbox = false;
-  };
-  networking = {
-    defaultGateway = metadata.infra.gw;
-    nameservers = [ metadata.infra.dns ];
-    interfaces.ens18 = {
-      useDHCP = false;
-      ipv4.addresses = [
-        {
-          address = metadata.hosts."${config.networking.hostName}".ip;
-          prefixLength = 16;
-        }
-      ];
-    };
-  };
-  proxmox.cloudInit.enable = false;
-  services = {
-    fstrim.enable = true;
-    mysql = {
-      enable = true;
-      ensureDatabases = [
-        config.services.uptime-kuma.settings.UPTIME_KUMA_DB_NAME
-      ];
-      ensureUsers = [
-        {
-          name = config.services.uptime-kuma.settings.UPTIME_KUMA_DB_USERNAME;
-          ensurePermissions = {
-            "uptimekuma.*" = "ALL PRIVILEGES";
-          };
-        }
-      ];
-      package = pkgs.mariadb;
-    };
-    openssh = {
-      enable = true;
-      openFirewall = true;
-    };
-    uptime-kuma = {
-      enable = true;
-      settings = {
-        PORT = "3001"; # Default, but this allows us to explicitly use it elsewhere
-        UPTIME_KUMA_DB_TYPE = "mariadb";
-        UPTIME_KUMA_DB_SOCKET = "/run/mysqld/mysqld.sock";
-        UPTIME_KUMA_DB_NAME = "uptimekuma";
-        UPTIME_KUMA_DB_USERNAME = "uptimekuma";
-        UPTIME_KUMA_DB_PASSWORD = "uptimekuma";
-      };
-    };
-  };
-}

hosts/unstable/linode/default.nix

@@ -1,115 +1,59 @@
 {
-  config,
-  lib,
-  metadata,
   pkgs,
-  pkgs',
+  lib,
+  config,
   ...
 }:
 
-let
-  homepage = "127.0.0.1:30080";
-  nextcloudPort = 8080;
-  sshPort = 2222;
-  matrixServer = pkgs.writeText "matrix_server" (
-    builtins.toJSON {
-      "m.server" = "matrix.thehellings.com:443";
-    }
-  );
-  matrixClient = pkgs.writeText "matrix_client" (
-    builtins.toJSON {
-      "m.homeserver" = {
-        base_url = "https://matrix.thehellings.com";
-      };
-      "m.identity_server" = {
-        base_url = "https://vector.im";
-      };
-    }
-  );
-in
 {
   imports = [
+    ./git.nix
     ./hardware-configuration.nix
+    ./podman.nix
+    ./matrix.nix
+    ./nextcloud.nix
+    ./nginx.nix
+    ./postgres.nix
   ];
 
-  age.secrets = {
-    acme.file = ../../../secrets/acme.age;
-    nextcloudadmin = {
-      file = ../../../secrets/nextcloudadmin.age;
-      owner = "nextcloud";
-    };
-  };
-
   environment.systemPackages = with pkgs; [
     bind
     graphviz
     nix-du
     pgloader
-    podman-compose
-    pkgs'.upgrade-pg-cluster
   ];
 
+  age.secrets = {
+    # TODO: Greg add agenix secret at secrets/gitea-runner-linode.age
+    # gitea-runner-linode.file = ../../../secrets/gitea-runner-linode.age;
+  };
+
   greg = {
-    backup.jobs = {
-      nextcloud-bkup = {
-        src = "/var/lib/nextcloud";
-        dest = "nextcloud-backup";
-        pre = lib.getExe (
-          pkgs.writeShellApplication {
-            name = "nextcloud-backup-pre";
-            runtimeInputs = [ config.services.nextcloud.occ ];
-            text = "nextcloud-occ maintenance:mode --on";
-          }
-        );
-        post = lib.getExe (
-          pkgs.writeShellApplication {
-            name = "nextcloud-backup-post";
-            runtimeInputs = [ config.services.nextcloud.occ ];
-            text = "nextcloud-occ maintenance:mode --off";
-          }
-        );
-      };
-      greg-postgresql-backup = {
-        src = config.services.postgresqlBackup.location;
-        dest = "linode-postgres";
-      };
-    };
-    gitea-runner = {
-      enable = true;
-      labels = [
-        "vps:host"
-        "blog:host"
-        "nixos-linode:host"
-      ];
-    };
     home = false;
     linode.enable = true;
     nebula = {
       enable = true;
       isLighthouse = true;
-      unsafeRoutes = [
+    };
-        {
+    proxies."immich.thehellings.com" = {
-          route = "10.42.0.0/16";
+      genAliases = false;
-          via = metadata.hosts.genesis.nebulaIp;
+      target = "http://localhost:${builtins.toString config.services.immich-public-proxy.port}";
-        }
+      ssl = true;
-      ];
     };
     tailscale.enable = true;
+    gitea-runner = {
+      enable = true;
+      labels = [ "self-hosted" "host:linode" ];
+      # TODO: Greg add agenix secret at secrets/gitea-runner-linode.age
+      # tokenFile = config.age.secrets.gitea-runner-linode.path;
+    };
   };
 
   networking = {
-    domain = "thehellings.com";
-    firewall.allowedTCPPorts = [
-      sshPort
-      80
-      443
-    ];
-    hostName = "linode";
-    nameservers = [
-      "10.157.0.2"
-      "100.96.198.104"
-    ];
     networkmanager.enable = lib.mkForce false;
+    hostName = "linode";
+    domain = "thehellings.com";
+    nameservers = [ "100.88.91.27" ];
   };
 
   programs.ssh.extraConfig = lib.strings.concatStringsSep "\n" [
@@ -120,254 +64,26 @@ in
     "    UserKnownHostsFile /dev/null"
   ];
 
-  security.acme = {
-    acceptTerms = true;
-    defaults = {
-      dnsPropagationCheck = false;
-      dnsResolver = "92.123.95.3:53,92.123.94.3:53,92.123.94.2:53,92.123.95.4:53,92.123.95.2:53";
-      email = "greg.hellings@gmail.com";
-      extraLegoRunFlags = [ "--ipv4only" ]; # Force IPv4 only
-      #server = "https://acme-staging-v02.api.letsencrypt.org/directory";
-    };
-    certs."thehellings.com" = {
-      dnsProvider = "linode";
-      environmentFile = config.age.secrets.acme.path;
-      extraDomainNames = [
-        "*.thehellings.com"
-      ];
-    };
-  };
-
   services = {
-
-    anubis = {
-      instances = {
-        git = {
-          enable = true;
-          settings = {
-            BIND = "/run/anubis/anubis-git/anubis.sock";
-            COOKIE_DOMAIN = "thehellings.com";
-            SERVE_ROBOTS_TXT = true;
-            SLOG_LEVEL = "DEBUG";
-            TARGET = "http://git.k3s.thehellings.lan";
-          };
-        };
-      };
-    };
-
-    haproxy = {
-      enable = true;
-      config = ''
-        global
-          nbthread 4
-          maxconn 80
-          log /dev/log local0
-
-        defaults
-          timeout connect 500s
-          timeout client 500s
-          timeout server 1h
-
-        listen gitsshd
-          bind *:${toString sshPort}
-          timeout client 1h
-          mode tcp
-          server git-isaiah isaiah.thehellings.lan:32222
-          server git-jeremiah jeremiah.thehellings.lan:32222
-          server git-zeke zeke.thehellings.lan:32222
-
-        frontend https
-          bind *:80
-          bind *:443 ssl crt ${config.security.acme.certs."thehellings.com".directory}/full.pem
-
-          http-request redirect scheme https unless { ssl_fc }
-          http-request add-header X-Forwarded-Proto https
-
-          http-response replace-header ^Set-Cookie:\ (.*) Set-Cookie \1;\ Secure
-
-          option http-server-close
-          option http-keep-alive
-
-          #option httplog
-          #declare capture response len 80
-          #http-response capture res.hdr(Location) id 0
-
-          use_backend git if { hdr(host) -i src.thehellings.com }
-          use_backend git if { req_ssl_sni -i src.thehellings.com }
-          use_backend next if { hdr(host) -i next.thehellings.com }
-          use_backend next if { req_ssl_sni -i next.thehellings.com }
-          use_backend matrix if { hdr(host) -i matrix.thehellings.com }
-          use_backend matrix if { req_ssl_sni -i matrix.thehellings.com }
-          use_backend immich if { hdr(host) -i immich.thehellings.com }
-          use_backend immich if { req_ssl_sni -i immich.thehellings.com }
-          use_backend web if { hdr(host) -i thehellings.com }
-          use_backend web if { req_ssl_sni -i thehellings.com }
-
-        backend git
-          mode http
-          balance roundrobin
-          option accept-unsafe-violations-in-http-response
-          retries 3
-          option forwardfor
-          http-request set-header Host git.k3s.thehellings.lan
-          server git-isaiah isaiah.thehellings.lan:80
-          server git-jeremiah jeremiah.thehellings.lan:80
-          server git-zeke zeke.thehellings.lan:80
-
-        backend immich
-          mode http
-          balance roundrobin
-          option accept-unsafe-violations-in-http-response
-          retries 3
-          option forwardfor
-          server immich-proxy 127.0.0.1:${builtins.toString config.services.immich-public-proxy.port}
-
-        backend matrix
-          mode http
-          balance roundrobin
-          option accept-unsafe-violations-in-http-response
-          retries 3
-          option forwardfor
-          http-request set-header Host matrix.k3s.thehellings.lan
-          server git-isaiah isaiah.thehellings.lan:80
-          server git-jeremiah jeremiah.thehellings.lan:80
-          server git-zeke zeke.thehellings.lan:80
-
-        backend web
-          mode http
-          balance roundrobin
-          option accept-unsafe-violations-in-http-response
-          retries 3
-          option forwardfor
-          http-request return status 200 content-type "application/json" file ${matrixClient} hdr "cache-control" "no-cache" if { path /.well-known/matrix/client }
-          http-request return status 200 content-type "application/json" file ${matrixServer} hdr "cache-control" "no-cache" if { path /.well-known/matrix/server }
-          server web-container ${homepage}
-
-        backend next
-          log global
-          mode http
-          balance roundrobin
-          option accept-unsafe-violations-in-http-response
-          retries 3
-          option forwardfor
-          #http-response replace-value Location http://localhost:${builtins.toString nextcloudPort}/(.*) https://next.thehellings.com/\2
-          server nextcloud 127.0.0.1:${builtins.toString nextcloudPort}
-      '';
-    };
-
     immich-public-proxy = {
       enable = true;
-      immichUrl = "http://immich.k3s.thehellings.lan";
+      immichUrl = "https://immich.shire-zebra.ts.net";
     };
+  };
 
-    logrotate = {
+  security.sudo.extraRules = [
-      enable = true;
+    {
-      settings = {
+      users = [ "gitlab-runner" ];
-        postgresBackup = {
+      commands = [
-          enable = true;
-          files = "${config.services.postgresqlBackup.location}/*.gz";
-        };
-        postgresLog = {
-          enable = true;
-          files = "/var/lib/postgresql/*/log/*.log";
-          compress = true;
-          compresscmd = "${pkgs.xz}/bin/xz";
-        };
-      };
-    };
-
-    nextcloud = {
-      enable = true;
-      package = pkgs.nextcloud33;
-      appstoreEnable = true;
-      hostName = "127.0.0.1";
-      https = false;
-      config = {
-        adminpassFile = config.age.secrets.nextcloudadmin.path;
-        adminuser = "greg";
-        dbhost = "/run/postgresql";
-        dbtype = "pgsql";
-      };
-      settings = {
-        default_phone_region = "US";
-        overwriteprotocol = "http";
-        trusted_domains = [ "next.thehellings.com" ];
-        trusted_proxies = [
-          "localhost"
-          "127.0.0.1"
-        ];
-      };
-    };
-
-    # Move to :8080 so that we can run haproxy as the primary HTTP service
-    nginx.virtualHosts."${config.services.nextcloud.hostName}".listen = [
-      {
-        addr = "127.0.0.1";
-        port = nextcloudPort;
-      }
-    ];
-
-    openssh.settings.PasswordAuthentication = false;
-
-    postgresql = {
-      enable = true;
-      package = pkgs.postgresql_15;
-      checkConfig = true;
-      ensureDatabases = [ "nextcloud" ];
-      #initialScript = pkgs.writeText "create-matrix-db.sql" ''
-      #	CREATE ROLE "matrix-synapse" WITH LOGIN;
-      #	CREATE DATABASE "synapse" WITH OWNER "matrix-synapse" TEMPLATE template0 LC_COLLATE = "C" LC_CTYPE = "C";
-      #	GRANT ALL PRIVILEGES ON DATABASE "synapse" TO "matrix-synapse";
-      #'';  # These are done manually in order to set the LC_COLLATE values properly
-      ensureUsers = [
         {
-          name = "nextcloud";
+          command = "/run/current-system/sw/bin/systemctl";
-          ensureDBOwnership = true;
+          options = [ "NOPASSWD" ];
+        }
+        {
+          command = "/run/current-system/sw/bin/podman";
+          options = [ "NOPASSWD" ];
         }
       ];
-      settings = {
+    }
-        log_connections = true;
+  ];
-        log_statement = "all";
-        logging_collector = true;
-        log_filename = "postgresql.log";
-      };
-      identMap = ''
-        root root postgres
-      '';
-    };
-
-    postgresqlBackup = {
-      enable = true;
-      databases = [ "nextcloud" ];
-    };
-  };
-
-  systemd.services = {
-    haproxy = {
-      after = [
-        "nextcloud.service"
-        "network-online.target"
-      ];
-      wants = [
-        "nextcloud.service"
-        "network-online.target"
-      ];
-    };
-  };
-
-  users.users.haproxy.extraGroups = [ config.security.acme.certs."thehellings.com".group ];
-
-  # Actually serve the content from here
-  virtualisation.oci-containers = {
-    backend = "podman";
-    containers."homepage" = {
-      image = "src.thehellings.com/greg/homepage:latest";
-      ports = [ "${homepage}:80" ];
-    };
-  };
-  virtualisation.podman = {
-    enable = true;
-    dockerCompat = true;
-    dockerSocket.enable = true;
-  };
 }

hosts/unstable/linode/git.nix

@@ -0,0 +1,122 @@
+{ ... }:
+
+let
+  srcDomain = "src.thehellings.com";
+  sshPort = 2222;
+in
+{
+  greg.proxies."${srcDomain}" = {
+    target = "https://gitea.shire-zebra.ts.net";
+    ssl = true;
+    genAliases = false;
+    extraConfig = ''
+      proxy_ssl_verify off;
+      proxy_ssl_server_name on;
+      proxy_set_header X-Forwarded-Proto $scheme;
+      proxy_set_header X-Forwarded-Ssl on;
+      client_max_body_size 100000m;
+      # Ultimate AI Block List v1.7 20250924
+      # https://perishablepress.com/ultimate-ai-block-list/
+
+      if ($http_user_agent ~* "(openai\.com|\.ai|-ai|_ai|ai\.|ai-|ai_|ai=|AddSearchBot|Agentic|AgentQL|Agent\ 3|Agent\ API|AI\ Agent|AI\ Article\ Writer|AI\ Chat|AI\ Content\ Detector|AI\ Detection|AI\ Dungeon|AI\ Journalist|AI\ Legion)") {
+        return 444;
+      }
+      if ($http_user_agent ~* "(AI\ RAG|AI\ Search|AI\ SEO\ Crawler|AI\ Training|AI\ Web|AI\ Writer|AI2|AIBot|aiHitBot|AIMatrix|AISearch|AITraining|Alexa|Alice\ Yandex|AliGenie|AliyunSec|Alpha\ AI|AlphaAI|Amazon|Amelia)") {
+        return 444;
+      }
+      if ($http_user_agent ~* "(AndersPinkBot|AndiBot|Anonymous\ AI|Anthropic|AnyPicker|Anyword|Applebot|Aria\ AI|Aria\ Browse|Articoolo|Ask\ AI|AutoGen|AutoGLM|Automated\ Writer|AutoML|Autonomous\ RAG|AwarioRssBot|AwarioSmartBot|AWS\ Trainium|Azure)") {
+        return 444;
+      }
+      if ($http_user_agent ~* "(BabyAGI|BabyCatAGI|BardBot|Basic\ RAG|Bedrock|Big\ Sur|Bigsur|Botsonic|Brightbot|Browser\ MCP\ Agent|Browser\ Use|Bytebot|ByteDance|Bytespider|CarynAI|CatBoost|CC-Crawler|CCBot|Chai|Character)") {
+        return 444;
+      }
+      if ($http_user_agent ~* "(Charstar\ AI|Chatbot|ChatGLM|Chatsonic|ChatUser|Chinchilla|Claude|ClearScope|Clearview|Cognitive\ AI|Cohere|Common\ Crawl|CommonCrawl|Content\ Harmony|Content\ King|Content\ Optimizer|Content\ Samurai|ContentAtScale|ContentBot|Contentedge)") {
+        return 444;
+      }
+      if ($http_user_agent ~* "(ContentShake|Conversion\ AI|Copilot|CopyAI|Copymatic|Copyscape|CoreWeave|Corrective\ RAG|Cotoyogi|CRAB|Crawl4AI|CrawlQ\ AI|Crawlspace|Crew\ AI|CrewAI|Crushon\ AI|DALL-E|DarkBard|DataFor|DataProvider)") {
+        return 444;
+      }
+      if ($http_user_agent ~* "(Datenbank\ Crawler|DeepAI|Deep\ AI|DeepL|DeepMind|Deep\ Research|DeepResearch|DeepSeek|Devin|Diffbot|Doubao\ AI|DuckAssistBot|DuckDuckGo\ Chat|DuckDuckGo-Enhanced|Echobot|Echobox|Elixir|FacebookBot|FacebookExternalHit|Factset)") {
+        return 444;
+      }
+      if ($http_user_agent ~* "(Falcon|FIRE-1|Firebase|Firecrawl|Flux|Flyriver|Frase\ AI|FriendlyCrawler|Gato|Gemini|Gemma|Gen\ AI|GenAI|Generative|Genspark|Gentoo-chat|Ghostwriter|GigaChat|GLM|GodMode)") {
+        return 444;
+      }
+      if ($http_user_agent ~* "(Goose|GPT|Grammarly|Grendizer|Grok|GT\ Bot|GTBot|GTP|Hemingway\ Editor|Hetzner|Hugging|Hunyuan|Hybrid\ Search\ RAG|Hypotenuse\ AI|iAsk|ICC-Crawler|ImageGen|ImagesiftBot|img2dataset|imgproxy)") {
+        return 444;
+      }
+      if ($http_user_agent ~* "(INK\ Editor|INKforall|Instructor|IntelliSeek|Inferkit|ISSCyberRiskCrawler|Janitor\ AI|Jasper|Jenni\ AI|Julius\ AI|Kafkai|Kaggle|Kangaroo|Keyword\ Density\ AI|Kimi|Knowledge|KomoBot|Kruti|LangChain|Le\ Chat)") {
+        return 444;
+      }
+      if ($http_user_agent ~* "(Lensa|Lightpanda|LinerBot|LLaMA|LLM|Local\ RAG\ Agent|Lovable|Magistral|magpie-crawler|Manus|MarketMuse|Meltwater|Meta-AI|Meta-External|Meta-Webindexer|Meta\ AI|MetaAI|MetaTagBot|Middleware|Midjourney)") {
+        return 444;
+      }
+      if ($http_user_agent ~* "(Mini\ AGI|MiniMax|Mintlify|Mistral|Mixtral|model-training|Monica|Narrative|NeevaBot|netEstate|Neural\ Text|NeuralSEO|NinjaAI|NodeZero|Nova\ Act|NovaAct|OAI-SearchBot|OAI\ SearchBot|OASIS|Olivia)") {
+        return 444;
+      }
+      if ($http_user_agent ~* "(Omgili|Open\ AI|Open\ Interpreter|OpenAGI|OpenAI|OpenBot|OpenPi|OpenRouter|OpenText\ AI|Operator|Outwrite|Page\ Analyzer\ AI|PanguBot|Panscient|Paperlibot|Paraphraser\.io|peer39_crawler|Perflexity|Perplexity|Petal)") {
+        return 444;
+      }
+      if ($http_user_agent ~* "(Phind|PiplBot|PoeBot|PoeSearchBot|ProWritingAid|Proximic|Puppeteer|Python\ AI|Qualified|Quark|QuillBot|Qopywriter|Qwen|RAG\ Agent|RAG\ Azure\ AI|RAG\ Chatbot|RAG\ Database|RAG\ IS|RAG\ Pipeline|RAG\ Search)") {
+        return 444;
+      }
+      if ($http_user_agent ~* "(RAG\ with|RAG-|RAG_|Raptor|React\ Agent|Redis\ AI\ RAG|RobotSpider|Rytr|SaplingAI|SBIntuitionsBot|Scala|Scalenut|Scrap|ScriptBook|Seekr|SEObot|SEO\ Content\ Machine|SEO\ Robot|SemrushBot|Sentibot)") {
+        return 444;
+      }
+      if ($http_user_agent ~* "(Serper|ShapBot|Sidetrade|Simplified\ AI|Sitefinity|Skydancer|SlickWrite|SmartBot|Sonic|Sora|Spider/2|SpiderCreator|Spin\ Rewrite|Spinbot|Stability|StableDiffusionBot|Sudowrite|SummalyBot|Super\ Agent|Superagent)") {
+        return 444;
+      }
+      if ($http_user_agent ~* "(SuperAGI|Surfer\ AI|TerraCotta|Text\ Blaze|TextCortex|Thinkbot|Thordata|TikTokSpider|Timpibot|Tinybird|Together\ AI|Traefik|TurnitinBot|uAgents|VelenPublicWebCrawler|Venus\ Chub\ AI|Vidnami\ AI|Vision\ RAG|WebSurfer|WebText)") {
+        return 444;
+      }
+      if ($http_user_agent ~* "(Webzio|WeChat|Whisper|WordAI|Wordtune|WPBot|Writecream|WriterZen|Writescope|Writesonic|xAI|xBot|YaML|YandexAdditional|YouBot|Zendesk|Zero|Zhipu|Zhuque\ AI|Zimm)") {
+        return 444;
+      }
+    '';
+  };
+  #greg.proxies."registry.thehellings.com" = {
+  #target = "https://gitea.shire-zebra.ts.net:5000";
+  #ssl = true;
+  #genAliases = false;
+  #extraConfig = ''
+  #proxy_set_header X-Forwarded-Proto https;
+  #proxy_set_header X-Forwarded-Ssl on;
+  #client_max_body_size 25000m;
+  #'';
+  #};
+
+  networking.firewall.allowedTCPPorts = [ sshPort ];
+
+  systemd.services = {
+    haproxy = {
+      after = [
+        "network-online.target"
+      ];
+      wants = [
+        "network-online.target"
+      ];
+    };
+  };
+
+  services.haproxy = {
+    enable = true;
+    config = ''
+      global
+        daemon
+        maxconn 20
+
+      defaults
+        timeout connect 500s
+        timeout client 500s
+        timeout server 1h
+
+      listen gitsshd
+        bind *:${toString sshPort}
+        timeout client 1h
+        mode tcp
+        server git-isaiah isaiah.shire-zebra.ts.net:32222
+        server git-jeremiah jeremiah.shire-zebra.ts.net:32222
+        server git-zeke zeke.shire-zebra.ts.net:32222
+    '';
+  };
+}

hosts/unstable/linode/matrix.nix

@@ -0,0 +1,88 @@
+# Registration of new users is disabled for the public, but I can create
+# them by the following commands:
+# nix run nixpkgs.matrix-synapse
+# register_new_matrix_user -k "B9EoPr2WV9hzwc7uL2Sx1JmvCeKDEOGCpB0uginQcQtEH4wzRtkSIdo7lltrjSQa" http://localhost:8448
+{ config, lib, ... }:
+let
+  domain = "${config.networking.domain}";
+  fqdn = "matrix.${domain}";
+in
+{
+  services.nginx = {
+    virtualHosts = {
+      # Server the '.well-known' files to find the Matrix API server
+      "${domain}" = {
+        enableACME = true;
+        forceSSL = true;
+        # This is needed so that servers contacting hellings.com can find
+        # the actual application server at matrix.thehellings.com
+        locations."= /.well-known/matrix/server".extraConfig =
+          let
+            server = {
+              "m.server" = "${fqdn}:443";
+            };
+          in
+          ''
+            add_header Content-Type application/json;
+            return 200 '${builtins.toJSON server}';
+          '';
+
+        locations."= /.well-known/matrix/client".extraConfig =
+          let
+            client = {
+              "m.homeserver" = {
+                "base_url" = "https://${fqdn}";
+              };
+              "m.identity_server" = {
+                "base_url" = "https://vector.im";
+              };
+            };
+          in
+          ''
+            add_header Content-Type application/json;
+            add_header Access-Control-Allow-Origin *;
+            return 200 '${builtins.toJSON client}';
+          '';
+      };
+
+      # Reverse proxy in front of the actual Matrix server
+      "${fqdn}" = {
+        enableACME = true;
+        forceSSL = true;
+
+        extraConfig = ''
+          error_log /var/log/nginx/debug.log debug;
+        '';
+
+        # Not the appropriate place for the chat client
+        locations =
+          (builtins.listToAttrs (
+            builtins.map
+              (
+                val:
+                lib.nameValuePair "/_${val}" {
+                  proxyPass = "http://matrix.kubernetes";
+                }
+              )
+              [
+                "matrix"
+                "synapse"
+                "dendrite"
+              ]
+          ))
+          // {
+            "/".extraConfig = "return 404;";
+          };
+      };
+    };
+  };
+
+  # Open networking ports for the server
+  networking.firewall = {
+    enable = true;
+    allowedTCPPorts = [
+      80
+      443
+    ];
+  };
+}

hosts/unstable/linode/nextcloud.nix

@@ -0,0 +1,58 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  age.secrets.nextcloudadmin = {
+    file = ../../../secrets/nextcloudadmin.age;
+    owner = "nextcloud";
+  };
+
+  services.nextcloud = {
+    enable = true;
+    package = pkgs.nextcloud32;
+    appstoreEnable = true;
+    hostName = "next.${config.networking.domain}";
+    https = true;
+    config = {
+      adminpassFile = config.age.secrets.nextcloudadmin.path;
+      adminuser = "greg";
+      dbhost = "/run/postgresql";
+      dbtype = "pgsql";
+    };
+    settings = {
+      default_phone_region = "US";
+      overwriteprotocol = "https";
+    };
+  };
+
+  services.nginx.virtualHosts."next.thehellings.com" = {
+    forceSSL = true;
+    enableACME = true;
+  };
+
+  # Otherwise nginx errors looking for the nextcloud sock file
+  systemd.services.nginx.after = [ "nextcloud.service" ];
+
+  greg.backup.jobs.nextcloud-bkup = {
+    src = "/var/lib/nextcloud";
+    dest = "nextcloud-backup";
+    pre = lib.getExe (
+      pkgs.writeShellApplication {
+        name = "nextcloud-backup-pre";
+        runtimeInputs = [ config.services.nextcloud.occ ];
+        text = "nextcloud-occ maintenance:mode --on";
+      }
+    );
+    post = lib.getExe (
+      pkgs.writeShellApplication {
+        name = "nextcloud-backup-post";
+        runtimeInputs = [ config.services.nextcloud.occ ];
+        text = "nextcloud-occ maintenance:mode --off";
+      }
+    );
+  };
+}

hosts/unstable/linode/nginx.nix

@@ -0,0 +1,44 @@
+{ ... }:
+let
+  homepage = "127.0.0.1:30080";
+in
+{
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "greg.hellings@gmail.com";
+  };
+
+  services.nginx = {
+    enable = true;
+
+    clientMaxBodySize = "25000m"; # To help with uploading container images
+    # If there are recommended settings, let's use them!
+    recommendedGzipSettings = true;
+    recommendedOptimisation = true;
+    recommendedProxySettings = true;
+    recommendedTlsSettings = true;
+  };
+
+  # Actually serve the content from here
+  virtualisation.podman.enable = true;
+  virtualisation.oci-containers = {
+    backend = "podman";
+    containers."homepage" = {
+      # needs explicit port to match what gitlab-runner sees when pulling
+      image = "registry.thehellings.com:443/greg/homepage/gregs-homepage:latest";
+      ports = [ "${homepage}:80" ];
+    };
+  };
+  greg.proxies = {
+    "thehellings.com" = {
+      target = "http://${homepage}/";
+      ssl = true;
+      genAliases = false;
+    };
+    "doubles.thehellings.com" = {
+      target = "http://localhost:8081";
+      ssl = true;
+      genAliases = false;
+    };
+  };
+}

hosts/unstable/linode/podman.nix

@@ -0,0 +1,13 @@
+{ pkgs, ... }:
+
+{
+  environment.systemPackages = with pkgs; [
+    podman-compose
+  ];
+
+  virtualisation.podman = {
+    enable = true;
+    dockerCompat = true;
+    dockerSocket.enable = true;
+  };
+}

hosts/unstable/linode/postgres.nix

@@ -0,0 +1,58 @@
+{ config, pkgs, ... }:
+
+{
+  environment.systemPackages = [ pkgs.upgrade-pg-cluster ];
+
+  services.postgresql = {
+    enable = true;
+    package = pkgs.postgresql_15;
+    checkConfig = true;
+    ensureDatabases = [ "nextcloud" ];
+    #initialScript = pkgs.writeText "create-matrix-db.sql" ''
+    #	CREATE ROLE "matrix-synapse" WITH LOGIN;
+    #	CREATE DATABASE "synapse" WITH OWNER "matrix-synapse" TEMPLATE template0 LC_COLLATE = "C" LC_CTYPE = "C";
+    #	GRANT ALL PRIVILEGES ON DATABASE "synapse" TO "matrix-synapse";
+    #'';  # These are done manually in order to set the LC_COLLATE values properly
+    ensureUsers = [
+      {
+        name = "nextcloud";
+        ensureDBOwnership = true;
+      }
+    ];
+    settings = {
+      log_connections = true;
+      log_statement = "all";
+      logging_collector = true;
+      log_filename = "postgresql.log";
+    };
+    identMap = ''
+      root root postgres
+    '';
+  };
+
+  services.postgresqlBackup = {
+    enable = true;
+    databases = [ "nextcloud" ];
+  };
+
+  services.logrotate = {
+    enable = true;
+    settings = {
+      postgresBackup = {
+        enable = true;
+        files = "${config.services.postgresqlBackup.location}/*.gz";
+      };
+      postgresLog = {
+        enable = true;
+        files = "/var/lib/postgresql/*/log/*.log";
+        compress = true;
+        compresscmd = "${pkgs.xz}/bin/xz";
+      };
+    };
+  };
+
+  greg.backup.jobs.greg-postgresql-backup = {
+    src = config.services.postgresqlBackup.location;
+    dest = "linode-postgres";
+  };
+}

hosts/unstable/proxmoxtemplate/default.nix

@@ -0,0 +1,60 @@
+# Edit this configuration file to define what should be installed on
+# your system.  Help is available in the configuration.nix(5) man page
+# and in the NixOS manual (accessible by running ‘nixos-help’).
+
+{ pkgs, ... }:
+
+{
+  imports = [
+    # Include the results of the hardware scan.
+    ./hardware-configuration.nix
+  ];
+
+  # Bootloader.
+  boot.loader = {
+    systemd-boot.enable = true;
+    efi.canTouchEfiVariables = true;
+  };
+
+  environment.systemPackages = with pkgs; [
+  ];
+
+  greg = {
+    home = true;
+    tailscale = {
+      enable = true;
+      tags = [ "home" ];
+    };
+  };
+
+  networking = {
+    hostName = "proxmoxtemplate"; # Define your hostname.
+    # defaultGateway = {
+    #   address = " 10.42.1.2";
+    #   interface = "enp6s18";
+    # };
+    # interfaces = {
+    #   enp6s18 = {
+    #     ipv4.addresses = [
+    #       {
+    #         address = "10.42.1.8";
+    #         prefixLength = 16;
+    #       }
+    #     ];
+    #   };
+    # };
+    nameservers = [ "10.42.1.5" ];
+  };
+
+  services.qemuGuest.enable = true;
+
+  system.stateVersion = "24.11"; # Did you read the comment?
+
+  # Define a user account. Don't forget to set a password with ‘passwd’.
+  users.users.greg = {
+    isNormalUser = true;
+    description = "Greg Hellings";
+    extraGroups = [ "wheel" ];
+    packages = with pkgs; [ ];
+  };
+}

hosts/unstable/proxmoxtemplate/hardware-configuration.nix

@@ -0,0 +1,50 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  lib,
+  modulesPath,
+  ...
+}:
+
+{
+  imports = [
+    (modulesPath + "/profiles/qemu-guest.nix")
+  ];
+
+  boot.initrd.availableKernelModules = [
+    "uhci_hcd"
+    "ehci_pci"
+    "ahci"
+    "virtio_pci"
+    "virtio_scsi"
+    "sd_mod"
+    "sr_mod"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/507251f1-efe7-448d-8de8-91ee582a9afb";
+    fsType = "ext4";
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/7115-EFA6";
+    fsType = "vfat";
+    options = [
+      "fmask=0077"
+      "dmask=0077"
+    ];
+  };
+
+  swapDevices = [ ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp6s18.useDHCP = lib.mkDefault true;
+}

hosts/unstable/zeke/default.nix

@@ -14,13 +14,15 @@
     top.nix-hardware.nixosModules.system76
   ];
 
+  age.secrets = {
+    gitea-workerPassword.file = ../../../secrets/gitea/workerPassword.age;
+    # TODO: Greg add agenix secret at secrets/gitea-runner-zeke.age
+    # gitea-runner-zeke.file = ../../../secrets/gitea-runner-zeke.age;
+  };
+
   boot.extraModulePackages = [ config.boot.kernelPackages.v4l2loopback ];
 
   greg = {
-    gitea-runner = {
-      enable = true;
-      extraLabels = [ "bare-metal:host" ];
-    };
     kubernetes = {
       enable = true;
       vipInterface = "enp12s0";
@@ -28,14 +30,20 @@
     };
     nebula.enable = true;
     remote-builder.enable = true;
+    runner = {
+      enable = true;
+      vbox = false;
+    };
+    gitea-runner = {
+      enable = true;
+      labels = [ "self-hosted" "bare-metal" "host:zeke" ];
+      # TODO: Greg add agenix secret at secrets/gitea-runner-zeke.age
+      # tokenFile = config.age.secrets.gitea-runner-zeke.path;
+    };
     tailscale = {
       enable = true;
       tags = [ "home" ];
     };
-    vmdev = {
-      enable = true;
-      host = "vbox";
-    };
   };
 
   hardware = {
@@ -75,4 +83,10 @@
   users.users.greg.extraGroups = [
     "podman"
   ];
+
+  # virtualisation.virtualbox.host = {
+  #   enableExtensionPack = true;
+  #   headless = true;
+  #   enableWebService = true;
+  # };
 }

hosts/unstable/zeke/hardware-configuration.nix

@@ -35,11 +35,10 @@
       device = "/dev/nvme0n1p1";
       fsType = "auto";
     };
-    "/mnt/disk1" = {
+    #"/mnt/disk1" = {
-      device = "/dev/disk/by-uuid/bd04e868-034e-46e8-84ae-cd7347448bbd";
+    #device = "/dev/disk/by-uuid/0bb64e76-8811-499a-b60e-cc97808f2b0e";
-      fsType = "xfs";
+    #fsType = "btrfs";
-      options = [ "nofail" ];
+    #};
-    };
   };
 
   swapDevices = [ ];

hosts/vm/gitlab/default.nix

@@ -0,0 +1,273 @@
+# Edit this configuration file to define what should be installed on
+# your system.  Help is available in the configuration.nix(5) man page
+# and in the NixOS manual (accessible by running ‘nixos-help’).
+
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+
+let
+  registryPort = 5000;
+  vpnIp = "100.117.28.111";
+in
+{
+  imports = [
+    ./hardware-configuration.nix
+  ];
+
+  age.secrets =
+    let
+      cfg = n: {
+        file = ../../../secrets/gitlab/${n}.age;
+        owner = "gitlab";
+        group = "gitlab";
+        mode = "0444";
+      };
+    in
+    {
+      gitlab-secret = cfg "secret";
+      gitlab-otp = cfg "otp";
+      gitlab-db = cfg "db";
+      gitlab-db-password = cfg "db-password";
+      gitlab-jws = cfg "jws";
+      gitlab-key = cfg "key";
+      gitlab-cert = cfg "cert";
+      gitlab-salt = cfg "salt";
+      gitlab-primary-key = cfg "primary-key";
+      gitlab-deterministic-key = cfg "deterministic-key";
+
+      minio_access_key_id = {
+        file = ../../../secrets/minio_access_key_id.age;
+        owner = "gitlab";
+        group = "gitlab";
+        mode = "0444";
+      };
+      minio_secret_access_key = {
+        file = ../../../secrets/minio_secret_access_key.age;
+        owner = "gitlab";
+        group = "gitlab";
+        mode = "0444";
+      };
+    };
+
+  greg = {
+    backup.jobs.nas-backup = {
+      src = "/var/gitlab/state/backup/";
+      dest = "gitlab";
+    };
+    home = true;
+    tailscale = {
+      enable = true;
+      tags = [ "home" ];
+    };
+  };
+
+  networking = {
+    hostName = "gitlab"; # Define your hostname.
+    firewall.allowedTCPPorts = [
+      80
+      registryPort
+    ];
+  };
+
+  services = {
+    gitlab = {
+      enable = true;
+      backup = {
+        keepTime = 288;
+        startAt = [ "03:00" ];
+      };
+      databaseHost = "postgres.kubernetes";
+      databaseName = "gitlab";
+      databaseUsername = "gitlab";
+      databasePasswordFile = config.age.secrets.gitlab-db-password.path;
+      databaseCreateLocally = false;
+      extraConfig = {
+        registry.port = null;
+        gitlab = {
+          trustedProxies = [
+            "${vpnIp}/32" # The system itself
+            "100.109.86.8/32" # Public server's IP
+          ];
+        };
+        object_store = {
+          enabled = true;
+          proxy_download = true; # Tell them to reach out to object storage themselves!
+          connection = {
+            provider = "AWS";
+            endpoint = "http://s3.thehellings.lan:9000";
+            region = "us-east-1";
+            aws_access_key_id = {
+              _secret = config.age.secrets.minio_access_key_id.path;
+            };
+            aws_secret_access_key = {
+              _secret = config.age.secrets.minio_secret_access_key.path;
+            };
+            path_style = true; # True for MinIO
+            aws_signature_version = 2;
+          };
+          #storage_options = ...;
+          objects = builtins.listToAttrs (
+            builtins.map
+              (
+                x: lib.attrsets.nameValuePair x { bucket = "gitlab-${builtins.replaceStrings [ "_" ] [ "-" ] x}"; }
+              )
+              [
+                "artifacts"
+                "ci_secure_files"
+                "dependency_proxy"
+                "external_diffs"
+                "lfs"
+                "packages"
+                "pages"
+                "terraform_state"
+                "uploads"
+              ]
+          );
+        };
+      };
+      host = "src.thehellings.com";
+      https = true;
+      initialRootEmail = "greg@thehellings.com";
+      initialRootPasswordFile = pkgs.writeText "initialRootPassword" "root_password";
+      pages = {
+        enable = true;
+        settings.pages-domain = "pages.thehellings.com";
+      };
+      port = 443;
+      puma = {
+        threadsMax = 6;
+        threadsMin = 2;
+        workers = 6;
+      };
+      redisUrl = "unix:${config.services.redis.servers.gitlab.unixSocket}";
+      registry = {
+        enable = true;
+        certFile = config.age.secrets.gitlab-cert.path;
+        keyFile = config.age.secrets.gitlab-key.path;
+        externalAddress = "registry.thehellings.com";
+        externalPort = 443;
+      };
+      secrets = {
+        activeRecordDeterministicKeyFile = config.age.secrets.gitlab-deterministic-key.path;
+        activeRecordPrimaryKeyFile = config.age.secrets.gitlab-primary-key.path;
+        activeRecordSaltFile = config.age.secrets.gitlab-salt.path;
+        dbFile = config.age.secrets.gitlab-db.path;
+        jwsFile = config.age.secrets.gitlab-jws.path;
+        otpFile = config.age.secrets.gitlab-otp.path;
+        secretFile = config.age.secrets.gitlab-secret.path;
+      };
+    };
+
+    nginx = {
+      enable = true;
+      clientMaxBodySize = "25000m";
+      virtualHosts = {
+        "vm-gitlab.shire-zebra.ts.net" = {
+          listen = [
+            {
+              addr = "0.0.0.0";
+              port = 443;
+              ssl = true;
+            }
+          ];
+          locations."/" = {
+            proxyPass = "http://unix:/run/gitlab/gitlab-workhorse.socket";
+            recommendedProxySettings = true;
+          };
+          extraConfig = ''
+            ssl_certificate /etc/certs/vm-gitlab.shire-zebra.ts.net.crt ;
+            ssl_certificate_key /etc/certs/vm-gitlab.shire-zebra.ts.net.key ;
+            client_max_body_size 10000m ;
+          '';
+        };
+        "registry" = {
+          listen = [
+            {
+              addr = "0.0.0.0";
+              port = registryPort;
+              ssl = true;
+            }
+          ];
+          locations."/" = {
+            proxyPass = "http://127.0.0.1:4567/";
+            recommendedProxySettings = true;
+          };
+          extraConfig = ''
+            ssl_certificate /etc/certs/vm-gitlab.shire-zebra.ts.net.crt ;
+            ssl_certificate_key /etc/certs/vm-gitlab.shire-zebra.ts.net.key ;
+            client_max_body_size 25000m ;
+          '';
+          serverAliases = [
+            "vm-gitlab.shire-zebra.ts.net"
+          ];
+        };
+      };
+    };
+
+    openssh.enable = true;
+
+    postgresql.enable = true;
+
+    qemuGuest.enable = true;
+
+    redis.servers.gitlab = {
+      enable = true;
+    };
+
+    #resolved.enable = true;
+  };
+
+  # Do not start nginx until we have tailscaled up and running, so it can bind
+  # to the 100.* addresses
+  systemd = {
+    services = {
+      certRefresh =
+        let
+          script = pkgs.writeShellApplication {
+            name = "cert-refresh";
+            runtimeInputs = [ pkgs.tailscale ];
+
+            text = ''
+              cd /etc/certs
+              tailscale cert vm-gitlab.shire-zebra.ts.net
+              chown nginx ./*
+              systemctl reload nginx
+            '';
+          };
+        in
+        {
+          script = lib.getExe script;
+          serviceConfig = {
+            Type = "oneshot";
+            User = "root";
+          };
+        };
+
+      nginx = rec {
+        after = [ "network-online.target" ];
+        requires = [ "network-online.target" ];
+        wants = after;
+        serviceConfig = {
+          RestartMaxDelaySec = "30s";
+          RestartSteps = "5";
+        };
+      };
+      tailscaled.partOf = [ "network-online.target" ];
+    };
+
+    timers = {
+      "cert-refresh" = {
+        wantedBy = [ "cert-refresh.service" ];
+        timerConfig = {
+          OnCalendar = "monthly";
+          Persistent = true;
+        };
+      };
+    };
+  };
+  system.stateVersion = lib.mkForce "24.11";
+}

hosts/vm/gitlab/hardware-configuration.nix

@@ -0,0 +1,58 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  lib,
+  modulesPath,
+  ...
+}:
+
+{
+  imports = [
+    (modulesPath + "/profiles/qemu-guest.nix")
+  ];
+
+  # Bootloader.
+  boot = {
+    extraModulePackages = [ ];
+    initrd = {
+      availableKernelModules = [
+        "uhci_hcd"
+        "ehci_pci"
+        "ahci"
+        "virtio_pci"
+        "virtio_scsi"
+        "sd_mod"
+        "sr_mod"
+      ];
+      kernelModules = [ ];
+    };
+    loader = {
+      efi.canTouchEfiVariables = true;
+      systemd-boot.enable = true;
+    };
+  };
+
+  fileSystems."/" = {
+    device = lib.mkDefault "/dev/disk/by-uuid/1fdbe86e-ce6f-4af3-a876-aec35731adab";
+    fsType = "ext4";
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/1E6A-C3BB";
+    fsType = "vfat";
+    options = [
+      "fmask=0077"
+      "dmask=0077"
+    ];
+  };
+
+  swapDevices = [ ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp6s18.useDHCP = lib.mkDefault true;
+}

lib/default.nix

@@ -1,25 +0,0 @@
-{ lib, ... }:
-{
-  hostsByNet =
-    net: hosts:
-    let
-      netAttr =
-        {
-          lan = "ip";
-          nebula = "nebulaIp";
-          tailscale = "ts";
-        }
-        .${net};
-    in
-    lib.mapAttrsToList
-      (name: value: {
-        inherit name;
-        address = builtins.getAttr netAttr value;
-        aliases = lib.optionals (builtins.hasAttr "aliases" value) (builtins.getAttr "aliases" value);
-      })
-      (
-        lib.filterAttrs (
-          _host: settings: (builtins.hasAttr netAttr settings) && (builtins.getAttr netAttr settings) != null
-        ) hosts
-      );
-}

manifests/auto/nodes.yaml

@@ -40,7 +40,7 @@ metadata:
         },
         {
           "path": "/mnt/disk1",
-          "allowScheduling": true,
+          "allowScheduling": false,
           "tags": ["hdd", "large"]
         }
       ]

manifests/auto/operator-oauth.yaml

@@ -1,36 +1,3 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: tailscale
----
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: tailscale
-  namespace: tailscale
-spec:
-  interval: "24h"
-  url: "https://pkgs.tailscale.com/helmcharts"
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: tailscale
-  namespace: tailscale
-spec:
-  interval: 10m
-  dependsOn:
-    - name: external-secrets
-      namespace: external-secrets
-  chart:
-    spec:
-      chart: tailscale-operator
-      version: "1.96.5"
-      sourceRef:
-        kind: HelmRepository
-        name: tailscale
-      interval: "1h"
----
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:

manifests/bitwarden/deployment.yaml

@@ -21,6 +21,9 @@ spec:
     spec:
       containers:
         - name: bitwarden-cli
+          # Since my gitlab instance depends on the database hosted in k3s, and
+          # the database depends on this image, I need a way to bootstrap the
+          # system if # I am doing disaster recovery. And this is it.
           image: "ghcr.io/greg-hellings/nixos-config/img-bitwarden:latest"
           #image: >-
           #  registry.thehellings.com/greg/nixos-config/img-bitwarden:latest

manifests/dashboard/chart.yaml

@@ -1,21 +1,32 @@
 apiVersion: source.toolkit.fluxcd.io/v1
 kind: HelmRepository
 metadata:
-  name: headlamp
+  name: kubernetes-dashboard
 spec:
-  url: "https://kubernetes-sigs.github.io/headlamp/"
+  url: https://kubernetes.github.io/dashboard/
   interval: "24h"
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
-  name: headlamp
+  name: kubernetes-dashboard
 spec:
   interval: "24h"
   chart:
     spec:
-      chart: headlamp
+      chart: kubernetes-dashboard
       sourceRef:
         kind: HelmRepository
-        name: headlamp
+        name: kubernetes-dashboard
       interval: "24h"
+  values:
+    app:
+      settings:
+        global:
+          clusterName: Hellings Home
+          itemsPerPage: 25
+      ingress:
+        enabled: true
+        hosts:
+          - dashboard.shire-zebra.ts.net
+        ingressClassName: tailscale

manifests/dashboard/kustomization.yaml

@@ -4,4 +4,3 @@ resources:
   - namespace.yaml
   - chart.yaml
   - user.yaml
-  - ingress.yaml

manifests/databases/immich.yaml

@@ -0,0 +1,89 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: immich
+spec:
+  imageName: "ghcr.io/corentingiraud/cnpg-pgvector-vectorchord:16-migration"
+  #imageName: "ghcr.io/tensorchord/cloudnative-pgvecto.rs:16-v0.3.0"
+  #postgresUID: 1
+  instances: 1
+  storage:
+    size: 60Gi
+  primaryUpdateStrategy: unsupervised
+  postgresql:
+    shared_preload_libraries:
+      - vectors.so
+      - vchord.so
+
+  bootstrap:
+    recovery:
+      source: origin
+    # initdb:
+    #   database: immich
+    #   owner: immich
+    #   secret:
+    #     name: postgres-user-immich
+    #   dataChecksums: true
+    #   postInitApplicationSQL:
+    #     - ALTER SYSTEM SET search_path TO "$user", public, vectors;
+    #     - SET search_path TO "$user", public, vectors;
+    #     - CREATE EXTENSION IF NOT EXISTS "cube";
+    #     - CREATE EXTENSION IF NOT EXISTS "earthdistance";
+    #     - GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO "immich";
+
+  externalClusters:
+    - name: origin
+      plugin:
+        name: barman-cloud.cloudnative-pg.io
+        parameters:
+          barmanObjectName: k3sbackup-objectstore
+          serverName: pgvector
+
+  managed:
+    roles:
+      - name: immich
+        ensure: present
+        comment: Immich DB user
+        login: true
+        superuser: true
+        passwordSecret:
+          name: postgres-user-immich
+
+  plugins:
+    - name: barman-cloud.cloudnative-pg.io
+      isWALArchiver: true
+      parameters:
+        barmanObjectName: k3sbackup-objectstore
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Database
+metadata:
+  name: database-immich
+spec:
+  name: immich
+  owner: immich
+  cluster:
+    name: immich
+  extensions:
+    - name: vectors
+      ensure: present
+    - name: vectorchord
+      ensure: present
+    - name: cube
+      ensure: present
+    - name: earthdistance
+      ensure: present
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: ScheduledBackup
+metadata:
+  name: immich-backup
+spec:
+  immediate: true # Create one when this is added to the cluster
+  schedule: "0 2 0 * * *" # 1AM, nightly
+  backupOwnerReference: self
+  cluster:
+    name: immich
+  method: plugin
+  pluginConfiguration:
+    name: barman-cloud.cloudnative-pg.io

manifests/databases/ingress.yaml

@@ -14,12 +14,14 @@ spec:
       - 100.88.91.27 # dns?
       - 100.80.99.48 # exodus
       - 100.88.91.27 # genesis
+      - 100.117.28.111 # gitlab
       - 100.68.203.1 # hosea
       - 100.84.183.79 # isaiah
       - 100.102.186.39 # jeremiah
       - 100.90.74.19 # zeke
       - 100.115.57.8 # linode
       - 100.65.5.38 # matrix
+      #- 100.127.55.22 # jellyfin
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRouteTCP

manifests/databases/kustomization.yaml

@@ -4,6 +4,8 @@ resources:
   - namespace.yaml
   - secrets.yaml
   - postgres-cluster.yaml
+  - postgres-gitlab.yaml
   - postgres-pgadmin.yaml
   - postgres-matrix.yaml
+  - immich.yaml
   - ingress.yaml

manifests/databases/postgres-cluster.yaml

@@ -11,6 +11,13 @@ spec:
 
   managed:
     roles:
+      - name: gitlab
+        ensure: present
+        comment: Gitlab user
+        login: true
+        superuser: false
+        passwordSecret:
+          name: postgres-user-gitlab
       - name: pgadmin
         ensure: present
         comment: PG Admin user

manifests/databases/postgres-gitlab.yaml

@@ -0,0 +1,9 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Database
+metadata:
+  name: database-gitlab
+spec:
+  name: gitlab
+  owner: gitlab
+  cluster:
+    name: postgres

manifests/databases/secrets.yaml

@@ -1,5 +1,39 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
+metadata:
+  name: postgres-user-gitlab
+  namespace: db
+spec:
+  target:
+    name: postgres-user-gitlab
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        username: |-
+          {{ .username }}
+        password: |-
+          {{ .password }}
+  data:
+    - secretKey: username
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: 5282ad16-c2dc-49d3-8fb3-b2e9012bab57
+        property: username
+    - secretKey: password
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: 5282ad16-c2dc-49d3-8fb3-b2e9012bab57
+        property: password
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
 metadata:
   name: postgres-user-matrix
   namespace: db
@@ -99,3 +133,37 @@ spec:
       remoteRef:
         key: 685b29c6-9264-4e60-ba4a-b2ea005a5d7b
         property: password
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: postgres-user-immich
+  namespace: db
+spec:
+  target:
+    name: postgres-user-immich
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        username: |-
+          {{ .username }}
+        password: |-
+          {{ .password }}
+  data:
+    - secretKey: username
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: 5ce63e26-dd7f-46d4-b7ed-b310002ef93f
+        property: username
+    - secretKey: password
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: 5ce63e26-dd7f-46d4-b7ed-b310002ef93f
+        property: password

manifests/donetick/configmap.yaml

@@ -0,0 +1,79 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: donetick-config
+  namespace: donetick
+data:
+  # Value pulled from
+  # https://github.com/donetick/donetick/blob/main/config/selfhosted.yaml
+  selfhosted.yaml: |-
+    name: "selfhosted"
+    is_done_tick_dot_com: false
+    is_user_creation_disabled: false
+    telegram:
+      token: ""
+    pushover:
+      token: ""
+    database:
+      type: "sqlite"
+      migration: true
+      # these are only required for postgres
+      host: "secret"
+      port: 5432
+      user: "secret"
+      password: "secret"
+      name: "secret"
+    jwt:
+      secret: "This is really a secure JWT secret now!"
+      session_time: 168h
+      max_refresh: 168h
+    server:
+      port: 2021
+      read_timeout: 10s
+      write_timeout: 10s
+      rate_period: 60s
+      rate_limit: 300
+      cors_allow_origins:
+        - "http://localhost:5173"
+        - "http://localhost:7926"
+        # the below are required for the android app to work
+        - "https://localhost"
+        - "capacitor://localhost"
+      serve_frontend: true
+    logging:
+      level: "info"
+      encoding: "json"
+      development: false
+    scheduler_jobs:
+      due_job: 30m
+      overdue_job: 3h
+      pre_due_job: 3h
+    email:
+      host:
+      port:
+      key:
+      email:
+      appHost:
+    oauth2:
+      client_id:
+      client_secret:
+      auth_url:
+      token_url:
+      user_info_url:
+      redirect_url:
+      name:
+    # Real-time configuration
+    realtime:
+      enabled: true
+      sse_enabled: true
+      heartbeat_interval: 60s
+      connection_timeout: 120s
+      max_connections: 1000
+      max_connections_per_user: 5
+      event_queue_size: 2048
+      cleanup_interval: 2m
+      stale_threshold: 5m
+      enable_compression: true
+      enable_stats: true
+      allowed_origins:
+        - "*"

manifests/donetick/deployment.yaml

@@ -0,0 +1,38 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: donetick
+  namespace: donetick
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: donetick
+  template:
+    metadata:
+      labels:
+        app: donetick
+    spec:
+      containers:
+        - name: donetick
+          image: donetick/donetick
+          ports:
+            - containerPort: 2021
+              name: http
+          env:
+            - name: DT_ENV
+              value: "selfhosted"
+            - name: DT_SQLITE_PATH
+              value: "/data/donetick.db"
+          volumeMounts:
+            - name: config
+              mountPath: /config
+            - name: data
+              mountPath: /data
+      volumes:
+        - name: config
+          configMap:
+            name: donetick-config
+        - name: data
+          persistentVolumeClaim:
+            claimName: donetick-data

manifests/donetick/ingress.yaml

@@ -0,0 +1,15 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: donetick-tailscale
+  namespace: donetick
+spec:
+  ingressClassName: tailscale
+  defaultBackend:
+    service:
+      name: donetick
+      port:
+        number: 2021
+  tls:
+    - hosts:
+        - todo

manifests/donetick/kustomization.yaml

@@ -0,0 +1,9 @@
+namespace: donetick
+
+resources:
+  - namespace.yaml
+  - configmap.yaml
+  - pvc.yaml
+  - deployment.yaml
+  - service.yaml
+  - ingress.yaml

manifests/donetick/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: donetick

manifests/donetick/pvc.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: donetick-data
+  namespace: donetick
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 5Gi

manifests/donetick/service.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: donetick
+  namespace: donetick
+spec:
+  selector:
+    app: donetick
+  ports:
+    - name: http
+      port: 2021
+      targetPort: 2021
+      protocol: TCP

manifests/gitea/chart.yaml

@@ -15,7 +15,7 @@ spec:
   chart:
     spec:
       chart: gitea
-      version: "12.7.0"
+      version: "12.5.0"
       sourceRef:
         kind: HelmRepository
         name: gitea-repository
@@ -35,7 +35,7 @@ spec:
       storageClass: longhorn-default
 
     image:
-      tag: "1.27.1"
+      tag: "1.25.4"
 
     replicaCount: 1
 
@@ -66,8 +66,8 @@ spec:
           APP_NAME: "Gitea: Greg's Cup of Git"
           RUN_MODE: dev
         server:
-          DOMAIN: "shire-zebra.ts.net"
+          DOMAIN: "thehellings.com"
-          ROOT_URL: "https://git.k3s.thehellings.lan"
+          ROOT_URL: "https://src.thehellings.com"
           SSH_PORT: "2222"
         database:
           DB_TYPE: postgres
@@ -85,15 +85,15 @@ spec:
           DISABLE_REGISTRATION: "true"
         storage:
           STORAGE_TYPE: minio
-          MINIO_ENDPOINT: "nas1.shire-zebra.ts.net:30188"
+          MINIO_ENDPOINT: "nas1.shire-zebra.ts.net:9000"
           MINIO_BUCKET: gitea
-          MINIO_LOCATION: garage
+          MINIO_LOCATION: us-east-1
           # MINIO_ACCESS_KEY_ID: ""
           # MINIO_SECRET_ACCESS_KEY: ""
           MINIO_USE_SSL: "false"
           MINIO_INSECURE_SKIP_VERIFY: "true"
-        security:
+        webhook:
-          ALLOWED_HOST_LIST: loopback,private,*.shire-zebra.ts.net,*.nebula.thehellings.com,*.thehellings.lan
+          ALLOWED_HOST_LIST: loopback,private,*.shire-zebra.ts.net
 
       metrics:
         enabled: false
@@ -102,8 +102,8 @@ spec:
 
     persistence:
       enabled: true
-      create: false
+      storageClass: longhorn-default
-      claimName: gitea-new
+      size: "50Gi"
 
     # I will manage my Postgres externally
     postgresql:

manifests/gitea/dump-cronjob.yaml

@@ -18,12 +18,12 @@ spec:
           volumes:
             - name: gitea-data
               persistentVolumeClaim:
-                claimName: gitea-new
+                claimName: gitea-shared-storage
             - name: dump-staging
               emptyDir: {}
           initContainers:
             - name: gitea-dump
-              image: "gitea/gitea:1.27.1"
+              image: "gitea/gitea:1.25.4"
               command:
                 - /bin/sh
                 - "-c"
@@ -51,12 +51,12 @@ spec:
                 - |
                   set -e
                   # Configure mc alias for MinIO
-                  mc alias set nas1 http://nas1.shire-zebra.ts.net:30188 \
+                  mc alias set nas1 http://nas1.shire-zebra.ts.net:9000 \
                     "${MINIO_ACCESS_KEY}" "${MINIO_SECRET_KEY}"
                   # Upload dump to backup-gitea bucket
                   DUMP_FILE=$(ls /dump-staging/gitea-dump-*.zip | head -1)
-                  mc cp "${DUMP_FILE}" "nas1/gitea-backup/$(basename ${DUMP_FILE})"
+                  mc cp "${DUMP_FILE}" "nas1/backup-gitea/$(basename ${DUMP_FILE})"
-                  echo "Uploaded $(basename ${DUMP_FILE}) to gitea-backup"
+                  echo "Uploaded $(basename ${DUMP_FILE}) to backup-gitea"
                   # Set 30-day lifecycle on the bucket (idempotent)
                   mc ilm rule add --expire-days 30 nas1/backup-gitea 2>/dev/null || true
               volumeMounts:
@@ -64,15 +64,13 @@ spec:
                   mountPath: /dump-staging
                   readOnly: true
               env:
-                - name: MC_CONFIG_DIR
-                  value: /tmp/.mc
                 - name: MINIO_ACCESS_KEY
                   valueFrom:
                     secretKeyRef:
-                      name: gitea-backup
+                      name: gitea-config
                       key: minio_key
                 - name: MINIO_SECRET_KEY
                   valueFrom:
                     secretKeyRef:
-                      name: gitea-backup
+                      name: gitea-config
                       key: minio_secret

manifests/gitea/ingress.yaml

@@ -12,20 +12,3 @@ spec:
   tls:
     - hosts:
         - gitea
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: gitea-direct
-spec:
-  rules:
-    - host: git.k3s.thehellings.lan
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: gitea-release-http
-                port:
-                  name: http

manifests/gitea/secrets.yaml

@@ -1,32 +1,5 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
-metadata:
-  name: gitea-backup
-spec:
-  target:
-    name: gitea-backup
-    deletionPolicy: Delete
-    template:
-      type: Opaque
-      data:
-        minio_key: "{{ .minio_key }}"
-        minio_secret: "{{ .minio_secret }}"
-  secretStoreRef:
-    name: bitwarden-login
-    kind: ClusterSecretStore
-  data:
-    # MinIO credentials
-    - secretKey: minio_key
-      remoteRef:
-        key: dfb2f0c8-110d-4e96-83a7-b49c001c0897
-        property: username
-    - secretKey: minio_secret
-      remoteRef:
-        key: dfb2f0c8-110d-4e96-83a7-b49c001c0897
-        property: password
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
 metadata:
   name: gitea-config
 spec:
@@ -40,22 +13,22 @@ spec:
           USER={{ .dbuser }}
           PASSWD="""{{ .dbpass }}"""
         storage: |-
-          MINIO_ACCESS_KEY_ID={{ .minio_nas1_key }}
+          MINIO_ACCESS_KEY_ID={{ .minio_key }}
-          MINIO_SECRET_ACCESS_KEY={{ .minio_nas1_secret }}
+          MINIO_SECRET_ACCESS_KEY={{ .minio_secret }}
-        #minio_key: "{{ .minio_nas1_key }}"
+        minio_key: "{{ .minio_key }}"
-        #minio_secret: "{{ .minio_nas1_secret }}"
+        minio_secret: "{{ .minio_secret }}"
   secretStoreRef:
     name: bitwarden-login
     kind: ClusterSecretStore
   data:
-    # MinIO credentials for NAS1
+    # MinIO credentials
-    - secretKey: minio_nas1_key
+    - secretKey: minio_key
       remoteRef:
-        key: 33e8e4e0-eb90-484c-9ec9-b3a8018077a3
+        key: dcbcf704-7dce-48d7-bbd1-b3a801875b3d
         property: username
-    - secretKey: minio_nas1_secret
+    - secretKey: minio_secret
       remoteRef:
-        key: 33e8e4e0-eb90-484c-9ec9-b3a8018077a3
+        key: dcbcf704-7dce-48d7-bbd1-b3a801875b3d
         property: password
     # Postgres credentials
     - secretKey: dbuser

manifests/gitlab-runner/chart.yaml

@@ -0,0 +1,64 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: gitlab-runner
+spec:
+  interval: "24h"
+  url: https://charts.gitlab.io
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: gitlab-runner
+spec:
+  interval: 10m
+  chart:
+    spec:
+      chart: gitlab-runner
+      version: "0.83.1"
+      sourceRef:
+        kind: HelmRepository
+        name: gitlab-runner
+      interval: "1h"
+  dependsOn:
+    - name: external-secrets
+      namespace: external-secrets
+    - name: tailscae
+      namespace: tailscale
+  values:
+    crds:
+      create: true
+    includeCRDs: true
+    gitlabUrl: https://src.thehellings.com
+    runners:
+      secret: gitlab-runner
+    imagePullSecrets:
+      - name: image-pull-secrets
+    rbac:
+      create: true
+    serviceAccount:
+      create: true
+    metrics:
+      enabled: true
+    extraEnv:
+      CACHE_TYPE: s3
+      CACHE_SHARED: "true"
+      CACHE_S3_BUCKET_NAME: gitlab-runner-cache
+      CACHE_S3_INSECURE: "true"
+    extraEnvFrom:
+      PACKER_GITHUB_API_TOKEN:
+        secretKeyRef:
+          name: gitlab-runner
+          key: PACKER_GITHUB_API_TOKEN
+      CACHE_S3_SERVER_ADDRESS:
+        secretKeyRef:
+          name: gitlab-runner
+          key: CACHE_S3_SERVER_ADDRESS
+      CACHE_S3_ACCESS_KEY:
+        secretKeyRef:
+          name: s3-access
+          key: username
+      CACHE_S3_SECRET_KEY:
+        secretKeyRef:
+          name: s3-access
+          key: password

manifests/gitlab-runner/kustomization.yaml

@@ -0,0 +1,6 @@
+namespace: gitlab-runner
+
+resources:
+  - namespace.yaml
+  - secrets.yaml
+  - chart.yaml

manifests/gitlab-runner/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: gitlab-runner

manifests/gitlab-runner/secrets.yaml

@@ -0,0 +1,101 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: gitlab-runner
+  namespace: gitlab-runner
+spec:
+  secretStoreRef:
+    name: bitwarden-fields
+    kind: ClusterSecretStore
+  target:
+    name: gitlab-runner
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        runner-registration-token: ""
+        runner-token: "{{ .runnerToken }}"
+        PACKER_GITHUB_API_TOKEN: "{{ .PACKER_GITHUB_API_TOKEN }}"
+        CACHE_S3_SERVER_ADDRESS: "{{ .CACHE_S3_SERVER_ADDRESS }}"
+  data:
+    - secretKey: runnerToken
+      remoteRef:
+        key: &key 53719920-b100-4355-8c80-b2f9002fad22
+        property: CI_SERVER_TOKEN
+    - secretKey: PACKER_GITHUB_API_TOKEN
+      remoteRef:
+        key: *key
+        property: PACKER_GITHUB_API_TOKEN
+    - secretKey: CACHE_S3_SERVER_ADDRESS
+      remoteRef:
+        key: *key
+        property: CACHE_S3_SERVER_ADDRESS
+        # Includes
+        # CI_SERVER_TOKEN
+        # PACKER_GITHUB_API_TOKEN
+        # CACHE_S3_SERVER_ADDRESS
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: s3-access
+  namespace: gitlab-runner
+spec:
+  secretStoreRef:
+    name: bitwarden-login
+    kind: ClusterSecretStore
+  target:
+    name: s3-access
+    deletionPolicy: Delete
+  data:
+    - secretKey: username
+      remoteRef:
+        key: &key 04dd39c2-268d-4a33-aa4c-b1550166139f
+        property: username
+    - secretKey: password
+      remoteRef:
+        key: *key
+        property: password
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: image-pull-secrets
+  namespace: gitlab-runner
+spec:
+  secretStoreRef:
+    name: bitwarden-login
+    kind: ClusterSecretStore
+  target:
+    deletionPolicy: Delete
+    template:
+      type: kubernetes.io/dockerconfigjson
+      data:
+        .dockerconfigjson: >-
+          {
+            "auths": {
+              "https://index.docker.io/v1/": {
+                "username": "{{ .user }}",
+                "password": "{{ .password }}",
+                "email": "greg.hellings@gmail.com",
+                "auth": "{{ .auth }}"
+              }
+            }
+          }
+  data:
+    - secretKey: user
+      remoteRef:
+        key: &key f560ae38-368c-4e58-898c-aeb90012d597
+        property: username
+    - secretKey: password
+      remoteRef:
+        key: *key
+        property: password
+    - secretKey: auth
+      sourceRef:
+        storeRef:
+          name: bitwarden-fields
+          kind: ClusterSecretStore
+      remoteRef:
+        key: *key
+        property: auth

manifests/helm/external-secrets.yaml

@@ -1,36 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: external-secrets
----
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: external-secrets
-  namespace: external-secrets
-spec:
-  interval: "24h"
-  url: "https://charts.external-secrets.io/"
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: external-secrets
-  namespace: external-secrets
-spec:
-  interval: 10m
-  chart:
-    spec:
-      chart: external-secrets
-      version: "2.3.0"
-      sourceRef:
-        kind: HelmRepository
-        name: external-secrets
-      interval: "1h"
-  values:
-    crds:
-      create: true
-    includeCRDs: true
-    webhook:
-      certManager:
-        enable: true

manifests/helm/kustomization.yaml

@@ -1,6 +1,3 @@
 resources:
-  - kyverno.yaml
-  - external-secrets.yaml
-  - tailscale.yaml
   - longhorn.yaml # Needed for storage
   - traefik.yaml

manifests/helm/kyverno.yaml

@@ -1,40 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: kyverno-system
----
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: kyverno
-  namespace: kyverno-system
-spec:
-  interval: "24h"
-  url: "https://kyverno.github.io/kyverno/"
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: kyverno
-  namespace: kyverno-system
-spec:
-  interval: 10m
-  chart:
-    spec:
-      chart: kyverno
-      version: "3.7.1"
-      sourceRef:
-        kind: HelmRepository
-        name: kyverno
-      interval: "1h"
-  values:
-    admissionController:
-      replicas: 3
-    backgroundController:
-      replicas: 3
-    cleanupController:
-      replicas: 2
-    reportsController:
-      replicas: 2
-    crds:
-      install: true

manifests/helm/longhorn.yaml

@@ -19,15 +19,10 @@ metadata:
   namespace: longhorn-system
 spec:
   interval: 10m
-  dependsOn:
-    - name: tailscale
-      namespace: tailscale
-    - name: kyverno
-      namespace: kyverno-system
   chart:
     spec:
       chart: longhorn
-      version: "1.11.3"
+      version: "1.10.2"
       sourceRef:
         kind: HelmRepository
         name: longhorn
@@ -141,10 +136,6 @@ spec:
                   number: 80
     - <<: *host
       host: longhorn.kubernetes
-    - <<: *host
-      host: longhorn.k3s.nebula.thehellings.com
-    - <<: *host
-      host: longhorn.k3s.thehellings.lan
 ---
 apiVersion: storage.k8s.io/v1
 kind: StorageClass