remove obsolete infra

16 files changed, 0 insertions, 764 deletions

diff --git a/hosts/cirrus/configuration.nix b/hosts/cirrus/configuration.nix
deleted file mode 100644
index bfdf7f5..0000000
--- a/hosts/cirrus/configuration.nix
+++ /dev/null
@@ -1,64 +0,0 @@
-# Edit this configuration file to define what should be installed on
-# your system.  Help is available in the configuration.nix(5) man page
-# and in the NixOS manual (accessible by running ‘nixos-help’).
-
-{ config, pkgs, ... }:
-
-{
-  # Use the GRUB 2 boot loader.
-  boot.loader.grub.enable = true;
-  boot.loader.grub.efiSupport = true;
-  boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only
-
-  zramSwap = { enable = true; algorithm = "zstd"; };
-
-  networking = {
-    hostName = "cirrus"; # Define your hostname.
-  };
-
-  systemd.network = {
-    enable = true;
-    networks."uplink" = {
-      matchConfig = { Name = "enp1s0"; };
-      networkConfig = {
-        Address = "95.216.166.21/32";
-        DNS = "9.9.9.9";
-      };
-      routes = [
-        {
-          routeConfig = {
-            Gateway = "172.31.1.1";
-            GatewayOnLink = true;
-            Destination = "0.0.0.0/0";
-          };
-        }
-      ];
-    };
-  };
-
-
-  # Set your time zone.
-  time.timeZone = "Europe/Amsterdam";
-
-  # Select internationalisation properties.
-  i18n.defaultLocale = "en_US.UTF-8";
-  # Open ports in the firewall.
-  networking.firewall.enable = true;
-  # networking.firewall.allowedUDPPorts = [ ... ];
-  # Or disable the firewall altogether.
-
-  # Copy the NixOS configuration file and link it from the resulting system
-  # (/run/current-system/configuration.nix). This is useful in case you
-  # accidentally delete configuration.nix.
-  # system.copySystemConfiguration = true;
-
-  # This value determines the NixOS release from which the default
-  # settings for stateful data, like file locations and database versions
-  # on your system were taken. It‘s perfectly fine and recommended to leave
-  # this value at the release version of the first install of this system.
-  # Before changing this value read the documentation for this option
-  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
-  system.stateVersion = "22.05"; # Did you read the comment?
-
-}
-
diff --git a/hosts/cirrus/default.nix b/hosts/cirrus/default.nix
deleted file mode 100644
index d205721..0000000
--- a/hosts/cirrus/default.nix
+++ /dev/null
@@ -1,9 +0,0 @@
-{
-  imports = [
-    ./configuration.nix
-    ./hardware-configuration.nix
-    ./nextcloud-proxy.nix
-    ./secrets.nix
-    ./wireguard-server.nix
-  ];
-}
diff --git a/hosts/cirrus/hardware-configuration.nix b/hosts/cirrus/hardware-configuration.nix
deleted file mode 100644
index 0bd3907..0000000
--- a/hosts/cirrus/hardware-configuration.nix
+++ /dev/null
@@ -1,39 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
-
-{
-  imports =
-    [
-      (modulesPath + "/profiles/qemu-guest.nix")
-    ];
-
-  boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "virtio_pci" "sd_mod" "sr_mod" ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ ];
-  boot.extraModulePackages = [ ];
-
-  fileSystems."/" =
-    {
-      device = "/dev/disk/by-uuid/627952eb-107a-43c3-8223-bfea9af92837";
-      fsType = "ext4";
-    };
-
-  fileSystems."/boot" =
-    {
-      device = "/dev/disk/by-uuid/5CA6-CCE4";
-      fsType = "vfat";
-    };
-
-  swapDevices = [ ];
-
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault false;
-  networking.interfaces.enp1s0.useDHCP = lib.mkDefault false;
-
-  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-}
diff --git a/hosts/cirrus/irc.nix b/hosts/cirrus/irc.nix
deleted file mode 100644
index 6bda646..0000000
--- a/hosts/cirrus/irc.nix
+++ /dev/null
@@ -1,46 +0,0 @@
-{ pkgs, config, ... }: {
-  services.nginx = {
-    # reverse-proxy irc traffic on 7000
-    streamConfig = ''
-      upstream soju {
-        server 127.0.0.1:6667;
-      }
-
-      server {
-        listen 7000 ssl;
-        listen [::]:7000 ssl;
-
-        ssl_certificate /var/lib/acme/mrbouncy.oxapentane.com/fullchain.pem;
-        ssl_certificate_key /var/lib/acme/mrbouncy.oxapentane.com/key.pem;
-        ssl_trusted_certificate /var/lib/acme/mrbouncy.oxapentane.com/chain.pem;
-
-        proxy_pass soju;
-      }
-    '';
-    # just here to get the cert for irc reverse proxy
-    virtualHosts = {
-      "mrbouncy.oxapentane.com" = {
-        enableACME = true;
-        forceSSL = true;
-        locations = {
-          "/" = {
-            # no content for now, here just for no-boilerplate cert
-            return = "204";
-          };
-        };
-      };
-    };
-  };
-
-  services.soju = {
-    hostName = "mrbouncy.oxapentane.com";
-    listen = [ "irc+insecure://127.0.0.1:6667" ];
-    enable = true;
-    enableMessageLogging = true;
-    acceptProxyIP = [ "localhost" ];
-  };
-
-  environment.systemPackages = [ pkgs.soju ]; # expose soju mgmt commands
-
-  networking.firewall.allowedTCPPorts = [ 7000 ];
-}
diff --git a/hosts/cirrus/nextcloud-proxy.nix b/hosts/cirrus/nextcloud-proxy.nix
deleted file mode 100644
index 3b5166a..0000000
--- a/hosts/cirrus/nextcloud-proxy.nix
+++ /dev/null
@@ -1,64 +0,0 @@
-{ config, pkgs, ... }: {
-  security.acme = {
-    defaults.email = "acme@oxapentane.com";
-    acceptTerms = true;
-  };
-
-  networking.firewall.allowedTCPPorts = [ 80 443 ];
-
-  services.nginx = {
-    enable = true;
-    recommendedProxySettings = true;
-    recommendedGzipSettings = true;
-    recommendedTlsSettings = true;
-    recommendedOptimisation = true;
-
-    sslCiphers = "AES256+EECDH:AES256+EDH:!aNULL";
-  };
-
-  services.nginx.virtualHosts = {
-    "nc.oxapentane.com" = {
-      enableACME = true;
-      forceSSL = true;
-      extraConfig = ''
-        client_max_body_size 512M;
-      '';
-      locations = {
-        "/" = {
-          proxyPass = "http://10.34.45.100:8080";
-        };
-        "/well-known/carddav" = {
-          return = "301 $scheme://$host/remote.php/dav";
-        };
-        "/well-known/caldav" = {
-          return = "301 $scheme://$host/remote.php/dav";
-        };
-      };
-    };
-
-    "music.oxapentane.com" = {
-      enableACME = true;
-      forceSSL = true;
-      extraConfig = ''
-        client_max_body_size 32M;
-      '';
-      locations = {
-        "/" = {
-          proxyPass = "http://10.34.45.101:4533";
-        };
-      };
-    };
-    "news.oxapentane.com" = {
-      enableACME = true;
-      forceSSL = true;
-      extraConfig = ''
-        client_max_body_size 32M;
-      '';
-      locations = {
-        "/" = {
-          proxyPass = "http://10.34.45.102:8080";
-        };
-      };
-    };
-  };
-}
diff --git a/hosts/cirrus/secrets.nix b/hosts/cirrus/secrets.nix
deleted file mode 100644
index df095a7..0000000
--- a/hosts/cirrus/secrets.nix
+++ /dev/null
@@ -1,14 +0,0 @@
-{ config, ... }:
-{
-  sops.defaultSopsFile = ../../secrets/cirrus/secrets.yaml;
-  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
-
-  sops.secrets = {
-    "wg/oxalab-seckey" = {
-      owner = config.users.users.systemd-network.name;
-    };
-    "wg/oxaproxy-seckey" = {
-      owner = config.users.users.systemd-network.name;
-    };
-  };
-}
diff --git a/hosts/cirrus/wireguard-server.nix b/hosts/cirrus/wireguard-server.nix
deleted file mode 100644
index 74e6091..0000000
--- a/hosts/cirrus/wireguard-server.nix
+++ /dev/null
@@ -1,123 +0,0 @@
-{ config, ... }:
-{
-  networking.firewall = {
-    allowedUDPPorts = [
-      # wireguards
-      51820
-      51821
-      34197
-    ];
-    allowedTCPPorts = [
-      # port forward ssh to music
-      2020
-    ];
-    # port-forward ssh to the music machine
-    extraCommands = ''
-      iptables -t nat -I PREROUTING -p tcp --dport 2020 -j DNAT --to-destination 10.34.45.101:22
-      iptables -t nat -I PREROUTING -p udp --dport 34197 -j DNAT --to-destination 10.34.45.111:34197
-      iptables ! -o lo -t nat -A POSTROUTING -j MASQUERADE
-    '';
-    extraStopCommands = ''
-      iptables -t nat -D PREROUTING -p tcp --dport 2020 -j DNAT --to-destination 10.34.45.101:22 || true
-      iptables -t nat -D PREROUTING -p udp --dport 34197 -j DNAT --to-destination 10.34.45.111:34197 || true
-    '';
-  };
-
-
-  networking.wireguard.enable = true;
-
-  systemd.network = {
-    # oxalab
-    netdevs."oxalab" = {
-      netdevConfig = {
-        Kind = "wireguard";
-        Name = "oxalab";
-        Description = "oxa's enterprise network";
-      };
-      wireguardConfig = {
-        PrivateKeyFile = config.sops.secrets."wg/oxalab-seckey".path;
-        ListenPort = 51820;
-        # own pubkey: 5nCVC21BL+1r70OGwA4Q6Z/gcPLC3+ZF8sTurdn7N0E=
-      };
-      wireguardPeers = [
-        {
-          # microwave
-          wireguardPeerConfig = {
-            PublicKey = "0zpfcNrmbsNwwbnDDX4SMl4BVTB0zuhGKixT9TJQoHc=";
-            AllowedIPs = [ "10.66.66.10/32" ];
-            PersistentKeepalive = 25;
-          };
-        }
-        {
-          # Dishwasher
-          wireguardPeerConfig = {
-            PublicKey = "AdWUBbyeRkxdP9HUu25PpISoxbgQ8oeCw3BmV93xtAw=";
-            AllowedIPs = [ "10.66.66.100/32" ];
-            PersistentKeepalive = 25;
-          };
-        }
-      ];
-    };
-    networks."oxalab" = {
-      matchConfig.Name = "oxalab";
-      networkConfig = {
-        Address = "10.66.66.1/24";
-        IPForward = "ipv4";
-      };
-    };
-
-
-    # oxaproxy
-    netdevs."oxaproxy" = {
-      netdevConfig = {
-        Kind = "wireguard";
-        Name = "oxaproxy";
-        Description = "oxa's enterprise reverse-proxy network";
-      };
-      wireguardConfig = {
-        PrivateKeyFile = config.sops.secrets."wg/oxaproxy-seckey".path;
-        #own pubkey 0KMtL2fQOrrCH6c2a2l4FKiM73G86sUuyaNj4FarzVM=
-        ListenPort = 51821;
-      };
-      wireguardPeers = [
-        # nextcloud
-        {
-          wireguardPeerConfig = {
-            PublicKey = "KCYoGx7TGei4X79EZo2NONCcmQjPzBUN1Ds6I9lQbz0=";
-            AllowedIPs = [ "10.34.45.100/32" ];
-            PersistentKeepalive = 25;
-          };
-        }
-        # music
-        {
-          wireguardPeerConfig = {
-            PublicKey = "vQNkp51S9qLsu97dLPj0/EqFwvVtRFZpMHufgKhxum0=";
-            AllowedIPs = [ "10.34.45.101/32" ];
-            PersistentKeepalive = 25;
-          };
-        }
-        # news
-        {
-          wireguardPeerConfig = {
-            PublicKey = "guzNmsPcQw4EGSLU3X0SP+WPKAcoMc+xv9SLWdHV1V0=";
-            AllowedIPs = [ "10.34.45.102/32" ];
-            PersistentKeepalive = 25;
-          };
-        }
-        {
-          wireguardPeerConfig = {
-            PublicKey = "6rwSThPEfTyYvMVSnHNcNPRntCHEQFyscF2SodI8A34=";
-            AllowedIPs = [ "10.34.45.111/32" ];
-            PersistentKeepalive = 25;
-          };
-        }
-      ];
-    };
-    networks."oxaproxy" = {
-      matchConfig.Name = "oxaproxy";
-      networkConfig = {
-        Address = "10.34.45.1/24";
-      };
-    };
-  };
-}
diff --git a/hosts/dishwasher/configuration.nix b/hosts/dishwasher/configuration.nix
deleted file mode 100644
index 2f8fad0..0000000
--- a/hosts/dishwasher/configuration.nix
+++ /dev/null
@@ -1,88 +0,0 @@
-# Edit this configuration file to define what should be installed on
-# your system.  Help is available in the configuration.nix(5) man page
-# and in the NixOS manual (accessible by running ‘nixos-help’).
-
-{ config, pkgs, ... }:
-
-{
-  imports =
-    [
-      # Include the results of the hardware scan.
-      ./hardware-configuration.nix
-    ];
-
-  # Use the systemd-boot EFI boot loader.
-  boot.loader.systemd-boot.enable = true;
-  boot.loader.efi.canTouchEfiVariables = true;
-
-  networking = {
-    hostName = "dishwasher"; # Define your hostname.
-    useNetworkd = true;
-    firewall.enable = true;
-  };
-
-  time.timeZone = "Europe/Amsterdam";
-
-  # fix wait-online target
-  systemd.services.systemd-networkd-wait-online.serviceConfig.ExecStart = [
-    "" # clear old command
-    "${config.systemd.package}/lib/systemd/systemd-networkd-wait-online --any"
-  ];
-
-  systemd.network = {
-
-    enable = true;
-
-    networks."ether" = {
-      matchConfig = {
-        Name = "enp53s0";
-      };
-      networkConfig = {
-        DHCP = "yes";
-        LinkLocalAddressing = "ipv6";
-        IPv6AcceptRA = "yes";
-      };
-      dhcpV6Config = {
-        WithoutRA = "solicit";
-      };
-      ipv6AcceptRAConfig = {
-        DHCPv6Client = "yes";
-      };
-    };
-    networks."aer" = {
-      matchConfig.Name = "wlan0";
-      networkConfig = {
-        DHCP = "yes";
-      };
-    };
-  };
-
-  services.resolved = {
-    enable = true;
-    fallbackDns = [
-      "8.8.8.8"
-      "2001:4860:4860::8844"
-    ];
-  };
-
-
-  i18n = {
-    defaultLocale = "en_US.UTF-8";
-    supportedLocales = [ "all" ];
-  };
-
-  # Copy the NixOS configuration file and link it from the resulting system
-  # (/run/current-system/configuration.nix). This is useful in case you
-  # accidentally delete configuration.nix.
-  # system.copySystemConfiguration = true;
-
-  # This value determines the NixOS release from which the default
-  # settings for stateful data, like file locations and database versions
-  # on your system were taken. It‘s perfectly fine and recommended to leave
-  # this value at the release version of the first install of this system.
-  # Before changing this value read the documentation for this option
-  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
-  system.stateVersion = "22.05"; # Did you read the comment?
-
-}
-
diff --git a/hosts/dishwasher/default.nix b/hosts/dishwasher/default.nix
deleted file mode 100644
index f6e7a79..0000000
--- a/hosts/dishwasher/default.nix
+++ /dev/null
@@ -1,10 +0,0 @@
-{
-  imports = [
-    ./configuration.nix
-    ./hardware-configuration.nix
-    ./secrets.nix
-    ./oxalab.nix
-    ./mcvm-network.nix
-    ./microvms.nix
-  ];
-}
diff --git a/hosts/dishwasher/hardware-configuration.nix b/hosts/dishwasher/hardware-configuration.nix
deleted file mode 100644
index 653c31c..0000000
--- a/hosts/dishwasher/hardware-configuration.nix
+++ /dev/null
@@ -1,112 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
-
-{
-  imports =
-    [
-      (modulesPath + "/installer/scan/not-detected.nix")
-    ];
-
-  boot.initrd.availableKernelModules = [ "xhci_pci" "thunderbolt" "nvme" "usb_storage" "sd_mod" "rtsx_pci_sdmmc" "r8169" ];
-  boot.initrd.kernelModules = [ "r8169" ];
-  boot.kernelModules = [ "kvm-intel" "r8169"  ];
-  boot.extraModulePackages = [ ];
-
-  fileSystems."/" =
-    {
-      device = "rpool/nixos";
-      fsType = "zfs";
-      options = [ "zfsutil" ];
-    };
-
-  fileSystems."/nix" =
-    {
-      device = "rpool/nixos/nix";
-      fsType = "zfs";
-      options = [ "zfsutil" ];
-    };
-
-  fileSystems."/home" =
-    {
-      device = "rpool/userdata/home";
-      fsType = "zfs";
-      options = [ "zfsutil" ];
-    };
-
-  fileSystems."/var/lib" =
-    {
-      device = "rpool/userdata/var-lib";
-      fsType = "zfs";
-      options = [ "zfsutil" ];
-    };
-
-  fileSystems."/boot" =
-    {
-      device = "/dev/disk/by-uuid/A8AA-1CC4";
-      fsType = "vfat";
-      options = [ "X-mount.mkdir" ];
-    };
-
-  swapDevices =
-    [{
-      device = "/dev/disk/by-partuuid/f9712640-96a5-46e1-b07d-53b0cba19057";
-      randomEncryption = true;
-    }];
-
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
-  networking.interfaces.enp53s0.useDHCP = lib.mkDefault true;
-  networking.interfaces.wlan0.useDHCP = lib.mkDefault true;
-
-  # hostId for zfs
-  networking.hostId = "7da4f1e6";
-
-  # extra zfs settings
-  boot = {
-    loader = {
-      efi.canTouchEfiVariables = true;
-      systemd-boot.enable = true;
-    };
-    supportedFilesystems = [ "zfs" ];
-    kernelPackages = pkgs.zfs.latestCompatibleLinuxPackages;
-    kernelParams = [ "nohibernate" ];
-    zfs.devNodes = "/dev/";
-    plymouth.enable = false;
-    tmp.useTmpfs = true;
-  };
-
-  # remote unlock
-  boot.initrd.network = {
-    enable = true;
-    ssh = {
-      enable = true;
-      port = 2222;
-      hostKeys = [ "/etc/initrd-ssh/key" ];
-      authorizedKeys = [ "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDP6xE2ey0C8XXfvniiiHiqXsCC277jKI9RXEA+s2LQLUI5zl7v350i3Oa8H3NCcPj39lfMreqE6ncxcOhqYyzahPrrMkOqgbPAoRvq8H3ophLK+56O3xdHoKwLBwRD1yoGACjqG4UTiTrmnN2ateENgYcnTEY1e4vDw1qMj1drUXCsZ/6mkBBmHJiFfCaR4yCMt1r4gGi/dAC7ifnBP3oSyV/lJEwPxYYkGlbOBIvX/7Ar98pJS6xYPB3jHs9gwyNNON63d0fNYrwBojXPPCnGGaRZNOkBTzex3zZYp12ThINQ2xl8tRp9D8qpZ7vrLjhTD6AXkOBRzmDj+NsCeEaeTuWajqUM93iKncYUI+JxR1t7q8gA2pBMFzLesMXnx7R+5Kw7QDtSJM7a4GMIfsocPwf64BH6rzxEz68rXFE3P+J77PPM9CuaYw90JXHo3z220zYw2nMQ/1qjATVZw/hiVrLmQMVfmFJIufnGjTBs2sy3IoNyzvYm/oDeNNg1cdSV9gyyRKZhK08fxjXN5GSf9vZkfZa9tHtqaZ99HI40GQBHUVx1K2/NQJY8TVTSA+v16SFnJK8BIbmp/WFCuvDcMkgLIbqiYtDASe7P2mKIib86uOENT+P820egeLiTQ06kFw/gfUa8t69d5qEcjiQZ+lxCeYIs/E9KrEXHvRUWew== cardno:16 811 34" ];
-    };
-  };
-
-  services.zfs = {
-    trim.enable = true;
-    autoScrub = {
-      enable = true;
-      pools = [ "rpool" ];
-    };
-    autoSnapshot.enable = true;
-  };
-
-   # update the microcode
-   hardware.cpu.intel.updateMicrocode = true;
-   nixpkgs.config.allowUnfree = true;
-   hardware.enableAllFirmware = true;
-
-   services.logind.lidSwitch = "ignore";
-
-   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-   powerManagement.cpuFreqGovernor = lib.mkDefault "performance";
- }
diff --git a/hosts/dishwasher/mcvm-network.nix b/hosts/dishwasher/mcvm-network.nix
deleted file mode 100644
index a45699a..0000000
--- a/hosts/dishwasher/mcvm-network.nix
+++ /dev/null
@@ -1,55 +0,0 @@
-{ ... }:
-{
-  systemd.network = {
-    netdevs."microvm-bridge".netdevConfig = {
-      Kind = "bridge";
-      Name = "microvm-bridge";
-    };
-
-    networks."0-microvm-bridge" = {
-      matchConfig.Name = "microvm-bridge";
-      networkConfig = {
-        DHCPServer = false;
-        IPv6SendRA = true;
-      };
-      addresses = [
-        {
-          addressConfig.Address = "10.99.99.1/24";
-        }
-        {
-          addressConfig.Address = "fd12:3456:789a::1/64";
-        }
-      ];
-      ipv6Prefixes = [{
-        ipv6PrefixConfig.Prefix = "fd12:3456:789a::/64";
-      }];
-      # networkConfig = {
-      #   Address = "10.99.99.1/24";
-      #   IPForward = "ipv4";
-      # };
-      # routes = [{
-      #   routeConfig = {
-      #   GatewayOnLink = true;
-      # };}];
-      # IPForward = "ipv4";
-      # DHCPServer = true;
-      # IPv6SendRA = true;
-      # addresses = [{
-      #   addressConfig.Address = "10.99.99.1/24";
-      # }];
-    };
-
-    networks."1-microvm-bridge" = {
-      matchConfig.Name = "vm-*";
-      networkConfig.Bridge = "microvm-bridge";
-    };
-  };
-
-  networking.nat = {
-    enable = true;
-    enableIPv6 = true;
-    externalInterface = "enp53s0";
-    internalInterfaces = [ "microvm-bridge" ];
-  };
-
-}
diff --git a/hosts/dishwasher/microvms.nix b/hosts/dishwasher/microvms.nix
deleted file mode 100644
index e5cc7c8..0000000
--- a/hosts/dishwasher/microvms.nix
+++ /dev/null
@@ -1,16 +0,0 @@
-{ inputs, ... }: {
-  microvm.vms = {
-    nextcloud = {
-      flake = inputs.self;
-      updateFlake = "github:oxapentane/nix-config/master";
-    };
-    music = {
-      flake = inputs.self;
-      updateFlake = "github:oxapentane/nix-config/master";
-    };
-    news = {
-      flake = inputs.self;
-      updateFlake = "github:oxapentane/nix-config/master";
-    };
-  };
-}
diff --git a/hosts/dishwasher/oxalab.nix b/hosts/dishwasher/oxalab.nix
deleted file mode 100644
index 7e79971..0000000
--- a/hosts/dishwasher/oxalab.nix
+++ /dev/null
@@ -1,33 +0,0 @@
-{ config, ... }:
-{
-  networking.wireguard.enable = true;
-  systemd.network = {
-    netdevs."oxalab" = {
-      netdevConfig = {
-        Kind = "wireguard";
-        Name = "oxalab";
-        Description = "oxa's enterprise network";
-      };
-      wireguardConfig = {
-        PrivateKeyFile = config.sops.secrets."wg/oxalab-seckey".path;
-      };
-      wireguardPeers = [
-        {
-          # cirrus
-          wireguardPeerConfig = {
-            PublicKey = "5nCVC21BL+1r70OGwA4Q6Z/gcPLC3+ZF8sTurdn7N0E=";
-            AllowedIPs = [ "10.66.66.0/24" ];
-            Endpoint = [ "95.216.166.21:51820" ];
-            PersistentKeepalive = 25;
-          };
-        }
-      ];
-    };
-    networks."oxalab" = {
-      matchConfig.Name = "oxalab";
-      networkConfig = {
-        Address = "10.66.66.100/24";
-      };
-    };
-  };
-}
diff --git a/hosts/dishwasher/secrets.nix b/hosts/dishwasher/secrets.nix
deleted file mode 100644
index be33eaf..0000000
--- a/hosts/dishwasher/secrets.nix
+++ /dev/null
@@ -1,11 +0,0 @@
-{ config, ... }:
-{
-  sops.defaultSopsFile = ../../secrets/dishwasher/secrets.yaml;
-  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
-
-  sops.secrets = {
-    "wg/oxalab-seckey" = {
-      owner = config.users.users.systemd-network.name;
-    };
-  };
-}
diff --git a/hosts/noctilucent/default.nix b/hosts/noctilucent/default.nix
deleted file mode 100644
index 89f04ef..0000000
--- a/hosts/noctilucent/default.nix
+++ /dev/null
@@ -1,55 +0,0 @@
-{ config, pkgs, ... }:
-
-{
-
-  imports = [
-    ./hardware-configuration.nix
-  ];
-  # Use the GRUB 2 boot loader.
-  boot.loader.grub.enable = true;
-  boot.loader.grub.efiSupport = true;
-  boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only
-
-  zramSwap = { enable = true; algorithm = "zstd"; };
-
-  networking = {
-    hostName = "noctilucent"; # Define your hostname.
-  };
-
-  systemd.network = {
-    enable = true;
-    networks."uplink" = {
-      matchConfig = { Name = "enp1s0"; };
-      networkConfig = {
-        Address = "91.107.193.99/32";
-        DNS = "9.9.9.9";
-      };
-      routes = [
-        {
-          routeConfig = {
-            Gateway = "172.31.1.1";
-            GatewayOnLink = true;
-            Destination = "0.0.0.0/0";
-          };
-        }
-      ];
-    };
-  };
-
-
-  time.timeZone = "Europe/Amsterdam";
-
-  i18n.defaultLocale = "en_US.UTF-8";
-
-  networking.firewall.enable = true;
-
-  # This value determines the NixOS release from which the default
-  # settings for stateful data, like file locations and database versions
-  # on your system were taken. It‘s perfectly fine and recommended to leave
-  # this value at the release version of the first install of this system.
-  # Before changing this value read the documentation for this option
-  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
-  system.stateVersion = "23.05"; # Did you read the comment?
-
-}
-
diff --git a/hosts/noctilucent/hardware-configuration.nix b/hosts/noctilucent/hardware-configuration.nix
deleted file mode 100644
index 8c35b3c..0000000
--- a/hosts/noctilucent/hardware-configuration.nix
+++ /dev/null
@@ -1,25 +0,0 @@
-{ modulesPath, lib, ... }:
-{
-  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
-  boot.loader.grub.device = "/dev/sda";
-  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "xen_blkfront" "vmw_pvscsi" ];
-  boot.initrd.kernelModules = [ "nvme" ];
-
-  fileSystems."/" = {
-    device = "/dev/disk/by-uuid/e9356185-9812-4873-8822-13c8aef59948";
-    fsType = "ext4";
-  };
-  fileSystems."/boot" = {
-    device = "dev/disk/by-uuid/6F78-D438";
-    fsType = "vfat";
-  };
-
-  swapDevices = [ ];
-
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault false;
-  networking.interfaces.enp1s0.useDHCP = lib.mkDefault false;
-}