summaryrefslogtreecommitdiff
path: root/hosts
diff options
context:
space:
mode:
Diffstat (limited to 'hosts')
-rw-r--r--hosts/auth/authentik.nix17
-rw-r--r--hosts/auth/default.nix78
-rw-r--r--hosts/auth/secrets.yaml39
-rw-r--r--hosts/forgejo/default.nix78
-rw-r--r--hosts/forgejo/forgejo.nix70
-rw-r--r--hosts/forgejo/secrets.yaml37
-rw-r--r--hosts/immich/default.nix78
-rw-r--r--hosts/immich/immich.nix23
-rw-r--r--hosts/immich/immich.yaml49
-rw-r--r--hosts/immich/secrets.yaml37
-rw-r--r--hosts/miniflux/default.nix78
-rw-r--r--hosts/miniflux/miniflux.nix22
-rw-r--r--hosts/miniflux/secrets.yaml38
-rw-r--r--hosts/stream/default.nix77
-rw-r--r--hosts/stream/navidrome.nix16
-rw-r--r--hosts/stream/secrets.yaml37
16 files changed, 0 insertions, 774 deletions
diff --git a/hosts/auth/authentik.nix b/hosts/auth/authentik.nix
deleted file mode 100644
index a1257ee..0000000
--- a/hosts/auth/authentik.nix
+++ /dev/null
@@ -1,17 +0,0 @@
-{ config, inputs, ... }:
-{
- imports = [
- inputs.authentik-nix.nixosModules.default
- ];
- sops.secrets."authentik/env" = { };
- services.authentik = {
- enable = true;
- environmentFile = config.sops.secrets."authentik/env".path;
- settings = {
- log_level = "debug";
- disable_startup_analytics = true;
- avatars = "initials";
- postgresql.host = "/run/postgresql";
- };
- };
-}
diff --git a/hosts/auth/default.nix b/hosts/auth/default.nix
deleted file mode 100644
index 734ef43..0000000
--- a/hosts/auth/default.nix
+++ /dev/null
@@ -1,78 +0,0 @@
-{ config, lib, ... }:
-let
- mac = "02:00:00:00:00:01";
-in
-{
- imports = [
- ./authentik.nix
- ];
- sops.defaultSopsFile = ./secrets.yaml;
- sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
-
- sops.secrets = {
- "wg/0xa-proxy" = {
- owner = config.users.users.systemd-network.name;
- };
- };
-
- microvm = {
- hypervisor = "cloud-hypervisor";
- vsock.cid = 3 + 1;
- mem = 2 * 1024;
- vcpu = 2;
- interfaces = [
- {
- type = "tap";
- id = "uvm-auth";
- mac = mac;
- }
- ];
- shares = [
- {
- source = "/nix/store";
- mountPoint = "/nix/.ro-store";
- tag = "store";
- proto = "virtiofs";
- socket = "store.socket";
- }
- ]
- ++
- map
- (dir: {
- source = dir;
- mountPoint = "/${dir}";
- tag = dir;
- proto = "virtiofs";
- socket = "${dir}.socket";
- })
- [
- "etc"
- "var"
- "home"
- ];
- };
-
- networking.useNetworkd = true;
- networking.firewall.enable = lib.mkForce false; # firewalling done by the host
-
- systemd.network = {
- enable = true;
- networks."11-host" = {
- matchConfig.MACAddress = mac;
- networkConfig = {
- Address = "10.99.99.11/24";
- DHCP = "no";
- };
- routes = [
- {
- Gateway = "10.99.99.1";
- Destination = "0.0.0.0/0";
- Metric = 1024;
- }
- ];
- };
- };
-
- networking.hostName = "auth";
- system.stateVersion = "24.11";
-}
diff --git a/hosts/auth/secrets.yaml b/hosts/auth/secrets.yaml
deleted file mode 100644
index 87d2f31..0000000
--- a/hosts/auth/secrets.yaml
+++ /dev/null
@@ -1,39 +0,0 @@
-authentik:
- env: ENC[AES256_GCM,data:XNA4bZPi9yzHrUXOIs18i9LnlsG2/jGBKgc9zPN/3ECzvvX1Q1eejKG657PgOIvuDkqyNdn4cD7iYEl8q4vX45BMb7+hCqKm5eCuOlf2z8HeqU7Jmvh+++92RIyLiv2D9LIWDIBY,iv:J3eXfDZHmxK+10uMJu6hGUEwXSTMKt/M4fsaoJr7eL4=,tag:98swY3PkL//2mCPcHZjp1A==,type:str]
-wg:
- 0xa-proxy: ENC[AES256_GCM,data:q6vpJZy1Cb54MhMRj0nm8QEX1a38S7Adxymex6gMtwkA6A9V3nLTHPfdJAc=,iv:EsRkUqrpUXoFVkZ8SGE2jp22SeqTlvBx8OTBCRxOjDA=,tag:JLv73iYYV6ZvJiODQOqfEQ==,type:str]
-sops:
- age:
- - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJl9iYG5oHBq/poBn7Jf1/FGWWbAnbx+NKjs7qtT3uAK
- enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IHowb2lXdyBkSkFE
- NXBuRDFSM2VPMThnUm5GUFE1dGMvc2lOZllEVlpxeEtWOVl0TWl3CnNzdzdwa281
- QjlDcEYwQ2sybllRSnBOSDZiNE9manVNTGN6bzAxMkpka0UKLS0tIGRnVXRreENQ
- QXE3STV3dk9vWTU5RldTRGRvSXhlMjZobHk3YUMvZmoraHcKVzGIc+T5EJFC5tPl
- W2xBG90+KNHicTX/OkUg2qnUq3Kdbb4DVda/rYIfpjq5NzHP6G7csJvJYhVheive
- wWGaYQ==
- -----END AGE ENCRYPTED FILE-----
- - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAXrwZsBChUhVuF5gFEfj8GwQlnrqEttAytS5jVCfuE4 0xa@frituurpan
- enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFlJOElMUSBtSGRU
- TG4wMUVrSEpwRi9PZS9xRExEN2d0SkZLKy9XVHJRVFp2SzhWTDAwCllHczFyVnc1
- eW9HMVRJTkh6M09JbzNnRGcxNjFuYnkyWUd5ZWRRL09YbFkKLS0tIHR4OWFnZGdY
- WGMvdld3clZlUUZTa3l4VUcxN0NxVVZ5MnhuV0NEZHhnYjQKOcL30dTkKrxUAPWY
- eJF58GBz4FPMJz2MDUj8UmO2IXQciV45nXSRrMXO0KspXr33N5fRKQcg2NH80wdV
- iaiVrA==
- -----END AGE ENCRYPTED FILE-----
- - recipient: age1vzwz5s35w9g8ck9l5zaq5skrnl3mqzf3hsnc9w22sj4k8tu8kqfstpg2a8
- enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByNXAxSDk3dVNRK01VdnZt
- TDZWWVRFZmtzUzN3Nkh3azllRWhDenhRdDFjCjR1VnFGcWYybFhpME9pODh6OFFk
- OUJLWTRvSFlKMEFzTEp3eHhoRXc2eUEKLS0tIFJIcXFCbTRVRUFsR05EaGJrS214
- V2puZzZ4djZrMTRzZzdSL2c0aHpGd2cKAGr3Gac1BcKlmpYG9S1m7RgAsEZEFvHN
- 8Uf40hHABXEKB1LXo7D8CxxLWTU+w4LOLAblaG1Rcp/mM6NYvmxhFA==
- -----END AGE ENCRYPTED FILE-----
- lastmodified: "2025-01-21T00:19:40Z"
- mac: ENC[AES256_GCM,data:oqKBofuW0pUMjQ5vvKSj/DO4AqkZTRoDuD/KahzI9Q20Jyoj0lNTzxh872ngWdKhIizoB3yiWW9GUS0zWp8rj1yzwFmvvNXBnk2sWHbskDFIEgfom6jfmz7csmXQXaU0kFNEmTvyxnsTrhvdcETO6lZBTooFN955ECrcoxspsbA=,iv:JU7AtvTluophE0IIZJJiVvdpctxzkaWLFGwUWFcufvM=,tag:ro6Kf8QaFJq7wWtx9oOWBA==,type:str]
- unencrypted_suffix: _unencrypted
- version: 3.9.3
diff --git a/hosts/forgejo/default.nix b/hosts/forgejo/default.nix
deleted file mode 100644
index 4e59c1b..0000000
--- a/hosts/forgejo/default.nix
+++ /dev/null
@@ -1,78 +0,0 @@
-{ config, lib, ... }:
-let
- mac = "02:00:00:00:00:05";
-in
-{
- imports = [
- ./forgejo.nix
- ];
- sops.defaultSopsFile = ./secrets.yaml;
- sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
-
- sops.secrets = {
- "wg/0xa-proxy" = {
- owner = config.users.users.systemd-network.name;
- };
- };
-
- microvm = {
- hypervisor = "cloud-hypervisor";
- vsock.cid = 3 + 5;
- mem = 3 * 1024;
- vcpu = 4;
- interfaces = [
- {
- type = "tap";
- id = "uvm-forgejo";
- mac = mac;
- }
- ];
- shares = [
- {
- source = "/nix/store";
- mountPoint = "/nix/.ro-store";
- tag = "store";
- proto = "virtiofs";
- socket = "store.socket";
- }
- ]
- ++
- map
- (dir: {
- source = dir;
- mountPoint = "/${dir}";
- tag = dir;
- proto = "virtiofs";
- socket = "${dir}.socket";
- })
- [
- "etc"
- "var"
- "home"
- ];
- };
-
- networking.useNetworkd = true;
- networking.firewall.enable = lib.mkForce false; # firewalling done by the host
-
- systemd.network = {
- enable = true;
- networks."11-host" = {
- matchConfig.MACAddress = mac;
- networkConfig = {
- Address = "10.99.99.15/24";
- DHCP = "no";
- };
- routes = [
- {
- Gateway = "10.99.99.1";
- Destination = "0.0.0.0/0";
- Metric = 1024;
- }
- ];
- };
- };
-
- networking.hostName = "forgejo";
- system.stateVersion = "24.11";
-}
diff --git a/hosts/forgejo/forgejo.nix b/hosts/forgejo/forgejo.nix
deleted file mode 100644
index 965354f..0000000
--- a/hosts/forgejo/forgejo.nix
+++ /dev/null
@@ -1,70 +0,0 @@
-{
- config,
- pkgs,
- lib,
- ...
-}:
-{
- services.forgejo = {
- enable = true;
- package = pkgs.forgejo;
- useWizard = false;
- database = {
- type = "postgres";
- createDatabase = true;
- };
- lfs.enable = true;
- settings = {
- DEFAULT.APP_NAME = "0xa's compilable shitposts";
- actions.ENABLED = false;
- database.LOG_SQL = false;
- indexer.REPO_INDEXER_ENABLED = true;
- mailer.ENABLED = false;
- packages.ENABLED = false;
- session.COOKIE_SECURE = true;
- server = {
- DOMAIN = "git.oxapentane.com";
- SSH_DOMAIN = "git.oxapentane.com";
- ROOT_URL = "https://git.oxapentane.com/";
- PROTOCOL = "http";
- START_SSH_SERVER = true;
- BUILTIN_SSH_SERVER_USER = "git";
- SSH_LISTEN_PORT = 2222;
- };
- repository = {
- DEFAULT_REPO_UNITS = "repo.code,repo.releases,repo.issues,repo.pulls";
- ENABLE_PUSH_CREATE_USER = true;
- };
- service = {
- REGISTER_EMAIL_CONFIRM = false;
- DISABLE_REGISTRATION = true;
- };
- oauth2_client = {
- ENABLE_AUTO_REGISTRATION = true;
- USERNAME = "nickname";
- ACCOUNT_LINKING = "login";
- };
- };
- };
-
- # expose forgejo cli
- environment.systemPackages =
- let
- cfg = config.services.forgejo;
- forgejo-cli = pkgs.writeScriptBin "forgejo-cli" ''
- #!${pkgs.runtimeShell}
- cd ${cfg.stateDir}
- sudo=exec
- if [[ "$USER" != forgejo ]]; then
- sudo='exec /run/wrappers/bin/sudo -u ${cfg.user} -g ${cfg.group} --preserve-env=GITEA_WORK_DIR --preserve-env=GITEA_CUSTOM'
- fi
- # Note that these variable names will change
- export GITEA_WORK_DIR=${cfg.stateDir}
- export GITEA_CUSTOM=${cfg.customDir}
- $sudo ${lib.getExe cfg.package} "$@"
- '';
- in
- [
- forgejo-cli
- ];
-}
diff --git a/hosts/forgejo/secrets.yaml b/hosts/forgejo/secrets.yaml
deleted file mode 100644
index a3d42af..0000000
--- a/hosts/forgejo/secrets.yaml
+++ /dev/null
@@ -1,37 +0,0 @@
-wg:
- 0xa-proxy: ENC[AES256_GCM,data:DZB/1S2Ev71DbnN+8C/K0mjIf/13Ki1f6vOIOdhsS6qyXKr5OwpbNb9KA0k=,iv:Gnd32DRJtP8LsC1P9GyS98oCLq/MBSCNcxrZngVXF6g=,tag:gyrzJOx9CS+1Kw5JRONIAw==,type:str]
-sops:
- age:
- - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJl9iYG5oHBq/poBn7Jf1/FGWWbAnbx+NKjs7qtT3uAK
- enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IHowb2lXdyB2OXBT
- QkRaOERCYmJPdTViMXBqc2FUbGUxZjNkNmlqa2pCQzZ5R1JYT2xjCm51THQ2cTMx
- WkV6b2QvWmQ0SHo5Sk0xTFB3NHpXUVRuWExzcy9wQUNQdUEKLS0tIGpvRnFRbUpy
- Q3pqbGszM2p1eXFueTF3YXh4T1hzV0ZnOXdYODFRZ0JQcEkKZfPbYqMxfD1Qvu31
- F7nESte4mN8YtUPnMTWHR0uNXWeUBAW2l/pjOOH40B8xHwmG/+4jv5fBVQJc2GKr
- 9REjvg==
- -----END AGE ENCRYPTED FILE-----
- - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAXrwZsBChUhVuF5gFEfj8GwQlnrqEttAytS5jVCfuE4 0xa@frituurpan
- enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFlJOElMUSBjRU9t
- MWRoTEFsSFpUb1F4Mis5U0o4N3BldzlkSU53L3EwVTdkY2ZnUkZFCldvTmRNbjhD
- eERYOTVob1o1c2xyVzNlbHd6ak5mbnk3dHc5YTB5SXNuR2cKLS0tIGpMRnRORy9k
- N1F6a2lsQ2JCTFVHTXFtRTRJZHlUL1ZwVXhhNE9PUm15QlEK7Udv/Nx6FKfhjkBs
- /hLzhzbZ3lwjexNhuyER+rpeZ70LtYmKm8EpcVnPdP3H0w5kyVyK31gv4iabpAUv
- vNW+Wg==
- -----END AGE ENCRYPTED FILE-----
- - recipient: age1gknaqevzuq7dtqalng3547w5qflk9a0kugymea5h54eg6twu43pqpkr4zt
- enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByT05nL1Vla1k5S0VpVzY2
- ZXgvOHlycnljMFYrb1g4ZGI0YTBzMytTZWxVCmNKRW9LWld5enNyL2lKVEQyZFlw
- RUVOQlFsOXFvaW91VUJUS0w4RWR2ZW8KLS0tIHVpVU8waXVYY1hKTHhneVV5NlVD
- TnQ3SFFsd2ZYdlRhQ2MyNzV6SzZJS3MKlAJNMzDPlxBYcyl/AyvApsq825FnOS1s
- Etv58L70JbhMgOuJY6tu/4uBAQd2dLphTb8lm4slAQxxtp40pXZ3IA==
- -----END AGE ENCRYPTED FILE-----
- lastmodified: "2025-02-03T18:25:04Z"
- mac: ENC[AES256_GCM,data:sSG52AUXjzVo5klAx+t9rhWn/alKAETF6bPUSYP5Dz7WH3vcY5bs87RCm+BdxzlueHMTn4HBQ5iZ2V4e34403GPJsQMYgWSkKapbWGBRurT0xBO5aCJhxZWpvjFSPdehOGNODKGtYFgBVd81PwZRWFdx3MrkwIItyYEq4TAtIyI=,iv:p+t0QmQKDaSiwtuHfLzR31AzmmS39NFq1nn1BAG5YTk=,tag:FSm77zDvPbHCarkGZCgtmg==,type:str]
- unencrypted_suffix: _unencrypted
- version: 3.9.4
diff --git a/hosts/immich/default.nix b/hosts/immich/default.nix
deleted file mode 100644
index 9e635d9..0000000
--- a/hosts/immich/default.nix
+++ /dev/null
@@ -1,78 +0,0 @@
-{ config, lib, ... }:
-let
- mac = "02:00:00:00:00:03";
-in
-{
- imports = [
- ./immich.nix
- ];
- sops.defaultSopsFile = ./secrets.yaml;
- sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
-
- sops.secrets = {
- "wg/0xa-proxy" = {
- owner = config.users.users.systemd-network.name;
- };
- };
-
- microvm = {
- hypervisor = "cloud-hypervisor";
- vsock.cid = 3 + 3;
- mem = 3 * 1024;
- vcpu = 2;
- interfaces = [
- {
- type = "tap";
- id = "uvm-immich";
- mac = mac;
- }
- ];
- shares = [
- {
- source = "/nix/store";
- mountPoint = "/nix/.ro-store";
- tag = "store";
- proto = "virtiofs";
- socket = "store.socket";
- }
- ]
- ++
- map
- (dir: {
- source = dir;
- mountPoint = "/${dir}";
- tag = dir;
- proto = "virtiofs";
- socket = "${dir}.socket";
- })
- [
- "etc"
- "var"
- "home"
- ];
- };
-
- networking.useNetworkd = true;
- networking.firewall.enable = lib.mkForce false; # firewalling done by the host
-
- systemd.network = {
- enable = true;
- networks."11-host" = {
- matchConfig.MACAddress = mac;
- networkConfig = {
- Address = "10.99.99.13/24";
- DHCP = "no";
- };
- routes = [
- {
- Gateway = "10.99.99.1";
- Destination = "0.0.0.0/0";
- Metric = 1024;
- }
- ];
- };
- };
-
- networking.hostName = "immich";
- system.stateVersion = "24.11";
-}
diff --git a/hosts/immich/immich.nix b/hosts/immich/immich.nix
deleted file mode 100644
index bd17dd4..0000000
--- a/hosts/immich/immich.nix
+++ /dev/null
@@ -1,23 +0,0 @@
-{
- config,
- ...
-}:
-{
- sops.secrets."immich.yaml" = {
- sopsFile = ./immich.yaml;
- owner = config.services.immich.user;
- key = "";
- };
-
- services.immich = {
- enable = true;
- host = "10.89.88.13";
- redis.enable = true;
- database.createDB = true;
- machine-learning.enable = true;
- settings = null; # has to contain secrets https://github.com/immich-app/immich/discussions/14815
- environment = {
- IMMICH_CONFIG_FILE = config.sops.secrets."immich.yaml".path;
- };
- };
-}
diff --git a/hosts/immich/immich.yaml b/hosts/immich/immich.yaml
deleted file mode 100644
index 54075df..0000000
--- a/hosts/immich/immich.yaml
+++ /dev/null
@@ -1,49 +0,0 @@
-server:
- externalDomain: ENC[AES256_GCM,data:kkgCpF1B7CP9e5q1Z9mjRpnF1A4Vb3cbwq1FSxo=,iv:1QlSv8fHoYr+jZ57AQmGsD7VrR9e64PLHqqgvPPuj/E=,tag:WV55mQh/sAStV69tVHiizw==,type:str]
-oauth:
- enabled: ENC[AES256_GCM,data:QwT42Q==,iv:BJyMLRvXaz7p9ErktlYVWAHC9Z/q+TymoxlAwuXnJzM=,tag:kguUPvrO6ZVvjvIhT7P/sg==,type:bool]
- autoLaunch: ENC[AES256_GCM,data:FmnAGw==,iv:0MhmkDPl7T03PyazLvdAvrAHLulwpuNLfGCK1xR5qr0=,tag:5hsgWYWF/iigMvs+DNeCnA==,type:bool]
- autoRegister: ENC[AES256_GCM,data:EkaAlw==,iv:DdzbFyxhowt44kktxNjWDpe/ZhGtKGcviL5TbI9zFSA=,tag:gRtqFAsJWmbmDxXW/e4cjQ==,type:bool]
- clientId: ENC[AES256_GCM,data:/ZX0Ez5X499VjzqsfGnNEt2k626EltpLY9TjK6UAalpPJVZ6Qr9O3A==,iv:/EmJ5GCs00FJyZSU5rYlCOUl4FlyuIDwtE8oR9pGwo0=,tag:CTHuJ7hhSFfzndeZL2mk4A==,type:str]
- clientSecret: ENC[AES256_GCM,data:+orm+5TLYZ7ogjTNW6TS622/h6bYOc/iRHUc2gpEcLTHNw3ngnLP+omVJ4kCHPIaRWI44b6rnMuq9jDb4ILMSYQeFjK7Xk1TQU3qyMoT/Z8tekqRJ+bfjOA+aF4Tb8dxR6lmwX3iREtG19MYhknc6qYSj450tuB6dFdwigAa5nc=,iv:EsySo7SVy7FdW/s5qstissUCHKh1kyjAxCMF4fXZkrY=,tag:7t9NQdCPljsC8JvuVA7k+g==,type:str]
- issuerUrl: ENC[AES256_GCM,data:fxqkJaCp48JrY0xoZ9nqlGUY1ymU5jKMkWDTJc+R3CLzhDdEUhf2ZYCLIwLAWRvXnw==,iv:1Qev2B5XDp9X6TaAJJKA7FPMwUNFtMQE8nzvbRdAyjI=,tag:BJIAty86QYxO/ClWo90R8g==,type:str]
-sops:
- kms: []
- gcp_kms: []
- azure_kv: []
- hc_vault: []
- age:
- - recipient: age1afyntwvj672lcq2e4dpxmw3syplzurnnd8q8j3265843jeedpveqkp465z
- enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0VmE5d3NPM05kblJNbzFS
- aWpheFB0dS9QT0RuOERqU3BRdlUrTkRMUjNjCmRKSHNXK29hS1BlWTlBVjVKdkZT
- cmd1TGZDOFpYa2txUEdJL1RHYXdrdmMKLS0tIERaMFN3Q3E5UkZabU0xd0ZtUHBZ
- Lzd6bFk2ZFZldmpKVEs3aGVJUmozdEEKv8cl7EqA42vUrlUQyisiEKyErjr+cOF9
- 7zBcA9qgwdGDTLaOIdeWd6SrEDBtxqYVW2Clx28CTqEsO+nbHDVRzg==
- -----END AGE ENCRYPTED FILE-----
- lastmodified: "2025-01-24T20:10:57Z"
- mac: ENC[AES256_GCM,data:+nClWkdsMKGgFqJ9v801/GfF193jNT0NN57NdbF6tDfEiWmM34FP9EQVEUThzA8U+qzBkq1iEyoPA9OdIJnu1EOPT72a7C/cqzfBOoomZS7E+gvp+MhVkoqk2Id4AHSYly0VFjtIiDEY60Z6nvzr5w3rfOZMI3MaHn6cwt+gYZE=,iv:+OmqDPh8ISFoVccgvR+sN7kfXhGT3lSOG5enP3ys/JY=,tag:kCZWLD75TNMb2NodHZKmnQ==,type:str]
- pgp:
- - created_at: "2025-01-24T20:02:34Z"
- enc: |-
- -----BEGIN PGP MESSAGE-----
-
- hQIMA7zUOKwzpAE7AQ/8DMoRyd4MkIT7CwtVMskspJYWRseML+0bZe2POGa5CFqb
- UoypBr+Isvml0RKdZgrZyGAgcU5OM9uTvPWf/9V4CGGxNn5yM3wpBYO1HNTLrTc1
- c9Xdl3Lj0nOmwyC4oVtKbl2wrLCrfewIoI3Q9AnQuNtnFbgjPvrCCKeHPzE7nOXF
- 0Xy6Sy7Wk2HoFrEhztzB8sLEr9UxnMie9Z3p7nKbGoF2mLSoHrUVrVIK/6k+FcIx
- tGPGXtysDAIMgkzksicFqM/6y3wcRVhbOJenFczIqb8Rfqeyen7PY53ozHoQpDr7
- 3uBNb8DD+9knqE/Y2fAsZhY39QwiSFR+QB9cePdpq2HlsqOqtD+48p8yBL/DeJ4K
- fawzjP7NhgN0r92iMMmSsjUWM9HtXtONPiwwOptPxvWwSicN4fE9+JGQ7BNwtnvZ
- 5QepbU33P6PNfEulUCr9+kRVP4apwGP6qWqyZaup4iiKil6AzLS/TBkJmj9eLtUC
- /lh2Joih13YZJ5mCUqDuD4HCoZaDkbCgnufUc6u0H9Ox/1hri/V96wuXLT9IBh9U
- 6nga/GVhf9T3yAHDaKeJA5/0fFqhh5mTZZuq6fOYQxih4Xmq7cx+F1Qc0NrFWSMb
- pj725EzSXfrGCkdL3AT07JgK8DrLFtMu9yOWknZtP+wybKM6NUGevJ8+HUB9hFLS
- XgFwgysGIBtTCo86/n/g/F2IIBSHtJ3607fuOHgI/MdC640fBrqcPJ6aznfOcNeX
- ZMA2WN1XJTg4oTDKifS658fcN9peXe4ujwVkmTf+2gZUxr9lwOXCrXpAG6xrFHU=
- =sCmm
- -----END PGP MESSAGE-----
- fp: DD0998E6CDF294537FC604F991FA5E5BF9AA901C
- unencrypted_suffix: _unencrypted
- version: 3.9.2
diff --git a/hosts/immich/secrets.yaml b/hosts/immich/secrets.yaml
deleted file mode 100644
index 45637d4..0000000
--- a/hosts/immich/secrets.yaml
+++ /dev/null
@@ -1,37 +0,0 @@
-wg:
- 0xa-proxy: ENC[AES256_GCM,data:4sJGq0MnoKwca2/CHGDzjxqNK9UH2lxByt/xZzhYVzgsmpjl8J5HLbb/xvY=,iv:SOlqtNMxlSp18AQ1j+B9xA8R+0xURkmrtgnACvG4n8s=,tag:5ittu905Pz6go/Otm5ZrBQ==,type:str]
-sops:
- age:
- - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJl9iYG5oHBq/poBn7Jf1/FGWWbAnbx+NKjs7qtT3uAK
- enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IHowb2lXdyBxbGRo
- emhsNnkrYm8vNWhObGNVQnRJb1BaTzdrbDRmUktYMjRXSGlLQlVnCkd6dHR6Umpt
- SXU4TzVMVWxYbDFIcEZPaUVjQURYQStjL1FKdnlXUGxZSlUKLS0tIE9yMEI4bEkw
- aVl5Vm9FQUZjZWZIUEZVcTE4OWpUS0VEU1NVMjBvNmNDemMKXSDvFyMt+CiQj+Mo
- WMWtregXZ2jMYk8Z9bJDeGQvymJxoUf98qvaTYSDXs1kCvVBrrOToGYHXwZ9j0cf
- Uyib0A==
- -----END AGE ENCRYPTED FILE-----
- - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAXrwZsBChUhVuF5gFEfj8GwQlnrqEttAytS5jVCfuE4 0xa@frituurpan
- enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFlJOElMUSB2WXNs
- dkdyZmtHYU9TYU1LQTNOUk9WYi92NFdBa1ljYll0ZVhGQVQ3WUJNCndCMkZPUmVq
- SEhxS25KTEJoS0RPb3lVNVJhUXl0dnkyc0xzUDROazRVM0kKLS0tIEorVnZYbTVa
- dkZwWWJhNnJUSGVqMXVJZHFmSGRKYmVXUWRWOGVEbnV2cUUKP4Nuqb4O7kP1okS5
- 9AbA9GC/eu7jXdXQeboEDY40U1yl+nZoCc0PcP5kXKGiMycP/4eaJtyTWVOCAFHq
- 4aYVOg==
- -----END AGE ENCRYPTED FILE-----
- - recipient: age1afyntwvj672lcq2e4dpxmw3syplzurnnd8q8j3265843jeedpveqkp465z
- enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6eWFzdE05aCtjQkhZU2V5
- Y3VtRURLbWp3M0NOcG95L09SZktvbHFUNDNvCkVoM3kxYjFRTkw3SU1ZSkFqOUwr
- ZHV0R1lNbVdaek5rRXlTODU1N3RCUm8KLS0tIEVYZHVrK0dGTFh6YmQxU09Hd3Az
- SXB2bTJQYzRVZ3AwWXdlUjhJRUJWMG8KObHGuGc9xuGGsJhrD7SztKDxMmT28OnA
- QtM7P1hEEtlC9uxvB6OXGRstHN7WRBj66hkEObuKuCJepTQE1pMV9w==
- -----END AGE ENCRYPTED FILE-----
- lastmodified: "2025-01-21T17:43:24Z"
- mac: ENC[AES256_GCM,data:oSaH4N4EDusCP76dupUzPMzNLZtqUHhmBHdA6sVkwx3kJilj/U+fQjLuBwD2XMxM5Z194yKnSzT+ZCP9b0V0NiOQyVp/ry/e3Hgs3aW0NPAFBPF126/iYts5fenDdonFO9Z85ge8ovorLVrziXLP6QQYCvfJdwh/p4faJdtkhWo=,iv:N7qCXhJFHyw8WNTATXlcwgGHh3d4i3Vr7fABOo8L4P0=,tag:4pZmCPrWxI6NkqkixgLHDg==,type:str]
- unencrypted_suffix: _unencrypted
- version: 3.9.3
diff --git a/hosts/miniflux/default.nix b/hosts/miniflux/default.nix
deleted file mode 100644
index d2f024f..0000000
--- a/hosts/miniflux/default.nix
+++ /dev/null
@@ -1,78 +0,0 @@
-{ config, lib, ... }:
-let
- mac = "02:00:00:00:00:04";
-in
-{
- imports = [
- ./miniflux.nix
- ];
- sops.defaultSopsFile = ./secrets.yaml;
- sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
-
- sops.secrets = {
- "wg/0xa-proxy" = {
- owner = config.users.users.systemd-network.name;
- };
- };
-
- microvm = {
- hypervisor = "cloud-hypervisor";
- vsock.cid = 3 + 4;
- mem = 1 * 1024;
- vcpu = 2;
- interfaces = [
- {
- type = "tap";
- id = "uvm-miniflux";
- mac = mac;
- }
- ];
- shares = [
- {
- source = "/nix/store";
- mountPoint = "/nix/.ro-store";
- tag = "store";
- proto = "virtiofs";
- socket = "store.socket";
- }
- ]
- ++
- map
- (dir: {
- source = dir;
- mountPoint = "/${dir}";
- tag = dir;
- proto = "virtiofs";
- socket = "${dir}.socket";
- })
- [
- "etc"
- "var"
- "home"
- ];
- };
-
- networking.useNetworkd = true;
- networking.firewall.enable = lib.mkForce false; # firewalling done by the host
-
- systemd.network = {
- enable = true;
- networks."11-host" = {
- matchConfig.MACAddress = mac;
- networkConfig = {
- Address = "10.99.99.14/24";
- DHCP = "no";
- };
- routes = [
- {
- Gateway = "10.99.99.1";
- Destination = "0.0.0.0/0";
- Metric = 1024;
- }
- ];
- };
- };
-
- networking.hostName = "miniflux";
- system.stateVersion = "24.11";
-}
diff --git a/hosts/miniflux/miniflux.nix b/hosts/miniflux/miniflux.nix
deleted file mode 100644
index 9afbe29..0000000
--- a/hosts/miniflux/miniflux.nix
+++ /dev/null
@@ -1,22 +0,0 @@
-{ config, ... }:
-{
- sops.secrets."miniflux" = { };
-
- services.miniflux = {
- enable = true;
- createDatabaseLocally = true;
- adminCredentialsFile = config.sops.secrets."miniflux".path;
- config = {
- LISTEN_ADDR = "10.89.88.14:8080";
- BASE_URL = "https://news.oxapentane.com";
- # oauth
- DISABLE_LOCAL_AUTH = 1;
- CREATE_ADMIN = 0;
- OAUTH2_OIDC_DISCOVERY_ENDPOINT = "https://auth.oxapentane.com/application/o/miniflux/";
- OAUTH2_PROVIDER = "oidc";
- OAUTH2_REDIRECT_URL = "https://news.oxapentane.com/oauth2/oidc/callback";
- OAUTH2_USER_CREATION = 1;
- POLLING_FREQUENCY = 37;
- };
- };
-}
diff --git a/hosts/miniflux/secrets.yaml b/hosts/miniflux/secrets.yaml
deleted file mode 100644
index 39cb3b9..0000000
--- a/hosts/miniflux/secrets.yaml
+++ /dev/null
@@ -1,38 +0,0 @@
-wg:
- 0xa-proxy: ENC[AES256_GCM,data:v8YxaUUnPuNAUU+3zvy5UzxNNMztaq5q1zli20JkAFdbgN+6SXzJeBcxs7M=,iv:0iPIrKtZzgxMMy2S+zLhEumitEEm8go1pfaN9D/e5C8=,tag:pw6DZFiFaL7skPxfUAGZ/A==,type:str]
-miniflux: ENC[AES256_GCM,data:KggPU65HAQbkBwebFw/CibolkenAUfZacz0tXruHQhExMwuHALOuxVVeATjp6nQoNfa3XNYN5w9EPhNWwvx0k98o7vxdg1pCQs1zu7UM9QiFykwYNlZQcbTMvBCoZkPwcjukvIwW25WrwDQREPv84kL7HvXPg6J8lM4x4WMbxW2t2qDjOt4SQE7bbXHZOliAW0YYb9KG8V2Mcg7GnPL/aWv7t0qur3ZACR0GgVFJIV90+qtVmr8wsOo60TtwDxOXkLFeHDdH67LxqQWry6v9RQ==,iv:Sv62ohd8tY9SMC/i3W4o/QP59Ka7w/5kk+R0Rhu3X0E=,tag:a5Ksf6V/lmLcqLZa4Qo+7Q==,type:str]
-sops:
- age:
- - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJl9iYG5oHBq/poBn7Jf1/FGWWbAnbx+NKjs7qtT3uAK
- enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IHowb2lXdyBZcEJZ
- cTFGMmhjN29zWHQ4WURmWXgzZEZkRml0a0F0Y2dKU3ppcEJmd1FnCkdOYk5ObEFI
- QWFHT3MrQlI2TkVEd1VYOVcwbjM5Z0xpV1BsUmExd3J2STgKLS0tIDVnemRKc01X
- ekxGS0NLYjZLMm9UVm5Zc2NZY0hxSFNtRGlJYlpBZk0zQW8Kzv4W9yy8qWP4EQbr
- KA4BncMHEWQ6xcnD1l3iFHIUeG8EqvH3N3eOZ/8OrPfZDkYHcbVMmtmQl5sDOv9P
- 3b+TwA==
- -----END AGE ENCRYPTED FILE-----
- - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAXrwZsBChUhVuF5gFEfj8GwQlnrqEttAytS5jVCfuE4 0xa@frituurpan
- enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFlJOElMUSAzZWJj
- YVBnYmNqV1drdDhIMnpBTE9BVCtpcmRvUVJkSHU5clNkNVBhaFJBCnlsU2M0Z0tl
- dE53V0graVBMNTVQT0o4bDVueGtQUkM1aGJzMUFEbVVmd3MKLS0tIE51SkdYNWVa
- SFo0K00wUXRhaXI0Tkw0SnlhZ01oRExkcVAwWkovblplY2MKp+F3ai1mKWgHVjx8
- Qr72eoyQJ4+OjzKV1eqGNGLqb8H+qP6ynAQeLpQuhs/rLUxM/nZy47uPE5mllIoN
- 4/39SQ==
- -----END AGE ENCRYPTED FILE-----
- - recipient: age15ja22wd9tt60vn32sk59pp6c7vtjsn8y3rypn8qfnvxthug8sp0q6f72uh
- enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLQjNONFc0T1JxSHB6S0F5
- bWVZQzlyZXY3VmRWNllWL29jNEVXNWxoeGlZCkdtOFRCakd5bVFTSzVlVFpFV3M5
- VmlWRFV5U0F5QXZwMU9IT3NWeWx1cjQKLS0tIEpwaVdZVTA1ZzllbE9YOFZvMVdS
- ZU1pN0pLZTRXb0NKNFlWakY1L0x0ZHMKMmhFFufDWZMPxjB9eIf0rJmdIzabQWKk
- 4NcZwriNtTHRPKnqHF/eoV7jOjN17A9mzz1Ln1LZDwFg5iFtIrjNYw==
- -----END AGE ENCRYPTED FILE-----
- lastmodified: "2025-01-25T01:09:45Z"
- mac: ENC[AES256_GCM,data:euRvs3gMaxqcTzDhacFdBVPprggN0eNki0g7BKuCr85se52CzpSCj13OF5LJE4Wl3vVOuGbpOsGUKjKKHANGddgPRPvs+zGYKrtcI1fYLE7XJXm5CwxvCcnTqmDCx+8WtXLhFhXVTCXOOx3miB03IC+i8kdZ0LLTTig2oWEFxZo=,iv:tVZPvRsX0XTwBxjuKCP8mGCMmKWTjFKUTMdCgddM9SE=,tag:AywLDckO/ZjORRXxbjQ14w==,type:str]
- unencrypted_suffix: _unencrypted
- version: 3.9.2
diff --git a/hosts/stream/default.nix b/hosts/stream/default.nix
deleted file mode 100644
index 2cad795..0000000
--- a/hosts/stream/default.nix
+++ /dev/null
@@ -1,77 +0,0 @@
-{ config, lib, ... }:
-let
- mac = "02:00:00:00:00:07";
-in
-{
- imports = [
- ./navidrome.nix
- ];
-
- sops.defaultSopsFile = ./secrets.yaml;
- sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
-
- sops.secrets = {
- "wg/0xa-proxy" = {
- owner = config.users.users.systemd-network.name;
- };
- };
-
- microvm = {
- hypervisor = "cloud-hypervisor";
- vsock.cid = 3 + 7;
- mem = 3 * 1024;
- vcpu = 2;
- interfaces = [
- {
- type = "tap";
- id = "uvm-stream";
- mac = mac;
- }
- ];
- shares = [
- {
- source = "/nix/store";
- mountPoint = "/nix/.ro-store";
- tag = "store";
- proto = "virtiofs";
- }
- ]
- ++
- map
- (dir: {
- source = dir;
- mountPoint = "/${dir}";
- tag = dir;
- proto = "virtiofs";
- })
- [
- "etc"
- "var"
- "home"
- ];
- };
-
- networking.useNetworkd = true;
- networking.firewall.enable = lib.mkForce false; # firewalling done by the host
-
- systemd.network = {
- enable = true;
- networks."11-host" = {
- matchConfig.MACAddress = mac;
- networkConfig = {
- Address = "10.99.99.17/24";
- DHCP = "no";
- };
- routes = [
- {
- Gateway = "10.99.99.1";
- Destination = "0.0.0.0/0";
- Metric = 1024;
- }
- ];
- };
- };
-
- networking.hostName = "stream";
- system.stateVersion = "25.05";
-}
diff --git a/hosts/stream/navidrome.nix b/hosts/stream/navidrome.nix
deleted file mode 100644
index 0b1cd07..0000000
--- a/hosts/stream/navidrome.nix
+++ /dev/null
@@ -1,16 +0,0 @@
-{ ... }:
-{
- services.navidrome = {
- enable = true;
- settings = {
- Address = "10.89.88.17";
- BaseUrl = "/";
- EnableExternalServices = false;
- MusicFolder = "/var/lib/navidrome/music";
- Port = 4533;
- ScanSchedule = "@every 11m";
- TranscodingCacheSize = "11GiB";
- ReverseProxyWhitelist = "10.89.88.1/24";
- };
- };
-}
diff --git a/hosts/stream/secrets.yaml b/hosts/stream/secrets.yaml
deleted file mode 100644
index d26d805..0000000
--- a/hosts/stream/secrets.yaml
+++ /dev/null
@@ -1,37 +0,0 @@
-wg:
- 0xa-proxy: ENC[AES256_GCM,data:uZfFc4elxCAVZvdIHJ7lgoPs9qKkD9ZvLhcYbexDcqn0alaMzIr++CY52FI=,iv:CREMt6GrLHs4Jwj/55awDFHh9hQlJPEi4ZQ7ZLMPvRA=,tag:iJAGdqzQbyezmDj+tzjdNQ==,type:str]
-sops:
- age:
- - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJl9iYG5oHBq/poBn7Jf1/FGWWbAnbx+NKjs7qtT3uAK
- enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IHowb2lXdyB5Zytw
- K1ZKTHBFYy83WU94N3Izczh1RnE4Ry9iRkEvMUxLUUNaTW52MW1ZCjIxWFI3NTJ6
- eXlXYXVVbHQ5Qjkxc0YwSU1MUjRVRi9abFl2dm1QSkx4N00KLS0tIEtaeXgyUzAv
- UWhnSjR0TlJyMkpEVlJkaEdNZURXNUhQdXpkcWRYMmxFNDAKFIoZevnllkATCBog
- 5R7ntMPrAlub8WnOjZVT5QdMgU3dRmxUnnfXY4PY7QpLNKyjEUxQ/5zvEeogYOSZ
- IUVfhA==
- -----END AGE ENCRYPTED FILE-----
- - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAXrwZsBChUhVuF5gFEfj8GwQlnrqEttAytS5jVCfuE4 0xa@frituurpan
- enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFlJOElMUSBuVVJO
- ZS9Ed3NrVEl4ZGRpZURZZVRaZ3pwcTZVRmJmQ3lrdHlQaWYzSjFvCkJQTXNDR2xm
- WkhxdnA3RlhPRkpnMWIvS0RzcTRJdEFISlpUb0NaYXVoMlUKLS0tIGZDSGw5QjRG
- bW9vUzRSRWk5ZG5rc0tjYjFzSzFuVWpJTExEVDhmdXloZzQKzJrWm1z3KRLSLkxt
- ZsmunVoD55HjrFsvPNnVear40c9JB+U3+m1pjdL5eax27lrX/rlvXx7rhzOhtTkN
- 9IDAjg==
- -----END AGE ENCRYPTED FILE-----
- - recipient: age148r2q3cy9sjem37rvgtcc4qjx8usxkdg77pqexa56gmcexn58aaslh3cnj
- enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLNG9vM1FqTVVBSTFYaGt2
- Rkpvci9ibXJyL3ZVbHNYbmF4Umk5ZHJ1bURFCmVjalI0S084R1dsdzdHQ0lZbmcr
- SjBXSDRUUGtUQ21wN2kzUmxwZmdKWUkKLS0tIHNjM1pkemxJbWZDNGZ4T01GZVli
- b05oNElQQjUrUklpYkR1TCsrTU5uUHMKWB5XybfmmjTfk/c+mRT2PNgsI4q8tbac
- nV6pFb97477fcnHH/vpbBD24bixFt/X8A90G3ilbjqL+1rd4G+K7jA==
- -----END AGE ENCRYPTED FILE-----
- lastmodified: "2025-06-12T22:54:11Z"
- mac: ENC[AES256_GCM,data:15EU9VupWfvR8CrfKrX3nhpD60hYB2LY3vuAPvdqzKLliqSqolNj956fOFicfSHvmW/s+7x+M+5FROnOzSbToTZotFtvALQihHH999veGZMx8Q8oIyljT1PBw/SU9djXPI1KjG/zzYOAwu7y/Ffm0QKhMRziH7CQLn30KR0o2w0=,iv:ghdyTvcpgnBi2L9s4UrzwWwt9TeU0WkGquZ64+w9IN8=,tag:4m4hYFgejlEaQROB/OEi6g==,type:str]
- unencrypted_suffix: _unencrypted
- version: 3.10.2
generated by cgit v1.3.1 (git 2.54.0) at 2026-07-28 03:11:58 +0000