16 files changed, 774 insertions, 0 deletions
diff --git a/microvms/auth/authentik.nix b/microvms/auth/authentik.nix
new file mode 100644
index 0000000..a1257ee
--- /dev/null
+++ b/microvms/auth/authentik.nix
@@ -0,0 +1,17 @@
+{ config, inputs, ... }:
+{
+  imports = [
+    inputs.authentik-nix.nixosModules.default
+  ];
+  sops.secrets."authentik/env" = { };
+  services.authentik = {
+    enable = true;
+    environmentFile = config.sops.secrets."authentik/env".path;
+    settings = {
+      log_level = "debug";
+      disable_startup_analytics = true;
+      avatars = "initials";
+      postgresql.host = "/run/postgresql";
+    };
+  };
+}
diff --git a/microvms/auth/default.nix b/microvms/auth/default.nix
new file mode 100644
index 0000000..734ef43
--- /dev/null
+++ b/microvms/auth/default.nix
@@ -0,0 +1,78 @@
+{ config, lib, ... }:
+let
+  mac = "02:00:00:00:00:01";
+in
+{
+  imports = [
+    ./authentik.nix
+  ];
+  sops.defaultSopsFile = ./secrets.yaml;
+  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+
+  sops.secrets = {
+    "wg/0xa-proxy" = {
+      owner = config.users.users.systemd-network.name;
+    };
+  };
+
+  microvm = {
+    hypervisor = "cloud-hypervisor";
+    vsock.cid = 3 + 1;
+    mem = 2 * 1024;
+    vcpu = 2;
+    interfaces = [
+      {
+        type = "tap";
+        id = "uvm-auth";
+        mac = mac;
+      }
+    ];
+    shares = [
+      {
+        source = "/nix/store";
+        mountPoint = "/nix/.ro-store";
+        tag = "store";
+        proto = "virtiofs";
+        socket = "store.socket";
+      }
+    ]
+    ++
+      map
+        (dir: {
+          source = dir;
+          mountPoint = "/${dir}";
+          tag = dir;
+          proto = "virtiofs";
+          socket = "${dir}.socket";
+        })
+        [
+          "etc"
+          "var"
+          "home"
+        ];
+  };
+
+  networking.useNetworkd = true;
+  networking.firewall.enable = lib.mkForce false; # firewalling done by the host
+
+  systemd.network = {
+    enable = true;
+    networks."11-host" = {
+      matchConfig.MACAddress = mac;
+      networkConfig = {
+        Address = "10.99.99.11/24";
+        DHCP = "no";
+      };
+      routes = [
+        {
+          Gateway = "10.99.99.1";
+          Destination = "0.0.0.0/0";
+          Metric = 1024;
+        }
+      ];
+    };
+  };
+
+  networking.hostName = "auth";
+  system.stateVersion = "24.11";
+}
diff --git a/microvms/auth/secrets.yaml b/microvms/auth/secrets.yaml
new file mode 100644
index 0000000..87d2f31
--- /dev/null
+++ b/microvms/auth/secrets.yaml
@@ -0,0 +1,39 @@
+authentik:
+    env: ENC[AES256_GCM,data:XNA4bZPi9yzHrUXOIs18i9LnlsG2/jGBKgc9zPN/3ECzvvX1Q1eejKG657PgOIvuDkqyNdn4cD7iYEl8q4vX45BMb7+hCqKm5eCuOlf2z8HeqU7Jmvh+++92RIyLiv2D9LIWDIBY,iv:J3eXfDZHmxK+10uMJu6hGUEwXSTMKt/M4fsaoJr7eL4=,tag:98swY3PkL//2mCPcHZjp1A==,type:str]
+wg:
+    0xa-proxy: ENC[AES256_GCM,data:q6vpJZy1Cb54MhMRj0nm8QEX1a38S7Adxymex6gMtwkA6A9V3nLTHPfdJAc=,iv:EsRkUqrpUXoFVkZ8SGE2jp22SeqTlvBx8OTBCRxOjDA=,tag:JLv73iYYV6ZvJiODQOqfEQ==,type:str]
+sops:
+    age:
+        - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJl9iYG5oHBq/poBn7Jf1/FGWWbAnbx+NKjs7qtT3uAK
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IHowb2lXdyBkSkFE
+            NXBuRDFSM2VPMThnUm5GUFE1dGMvc2lOZllEVlpxeEtWOVl0TWl3CnNzdzdwa281
+            QjlDcEYwQ2sybllRSnBOSDZiNE9manVNTGN6bzAxMkpka0UKLS0tIGRnVXRreENQ
+            QXE3STV3dk9vWTU5RldTRGRvSXhlMjZobHk3YUMvZmoraHcKVzGIc+T5EJFC5tPl
+            W2xBG90+KNHicTX/OkUg2qnUq3Kdbb4DVda/rYIfpjq5NzHP6G7csJvJYhVheive
+            wWGaYQ==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAXrwZsBChUhVuF5gFEfj8GwQlnrqEttAytS5jVCfuE4 0xa@frituurpan
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFlJOElMUSBtSGRU
+            TG4wMUVrSEpwRi9PZS9xRExEN2d0SkZLKy9XVHJRVFp2SzhWTDAwCllHczFyVnc1
+            eW9HMVRJTkh6M09JbzNnRGcxNjFuYnkyWUd5ZWRRL09YbFkKLS0tIHR4OWFnZGdY
+            WGMvdld3clZlUUZTa3l4VUcxN0NxVVZ5MnhuV0NEZHhnYjQKOcL30dTkKrxUAPWY
+            eJF58GBz4FPMJz2MDUj8UmO2IXQciV45nXSRrMXO0KspXr33N5fRKQcg2NH80wdV
+            iaiVrA==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1vzwz5s35w9g8ck9l5zaq5skrnl3mqzf3hsnc9w22sj4k8tu8kqfstpg2a8
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByNXAxSDk3dVNRK01VdnZt
+            TDZWWVRFZmtzUzN3Nkh3azllRWhDenhRdDFjCjR1VnFGcWYybFhpME9pODh6OFFk
+            OUJLWTRvSFlKMEFzTEp3eHhoRXc2eUEKLS0tIFJIcXFCbTRVRUFsR05EaGJrS214
+            V2puZzZ4djZrMTRzZzdSL2c0aHpGd2cKAGr3Gac1BcKlmpYG9S1m7RgAsEZEFvHN
+            8Uf40hHABXEKB1LXo7D8CxxLWTU+w4LOLAblaG1Rcp/mM6NYvmxhFA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-01-21T00:19:40Z"
+    mac: ENC[AES256_GCM,data:oqKBofuW0pUMjQ5vvKSj/DO4AqkZTRoDuD/KahzI9Q20Jyoj0lNTzxh872ngWdKhIizoB3yiWW9GUS0zWp8rj1yzwFmvvNXBnk2sWHbskDFIEgfom6jfmz7csmXQXaU0kFNEmTvyxnsTrhvdcETO6lZBTooFN955ECrcoxspsbA=,iv:JU7AtvTluophE0IIZJJiVvdpctxzkaWLFGwUWFcufvM=,tag:ro6Kf8QaFJq7wWtx9oOWBA==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.9.3
diff --git a/microvms/forgejo/default.nix b/microvms/forgejo/default.nix
new file mode 100644
index 0000000..4e59c1b
--- /dev/null
+++ b/microvms/forgejo/default.nix
@@ -0,0 +1,78 @@
+{ config, lib, ... }:
+let
+  mac = "02:00:00:00:00:05";
+in
+{
+  imports = [
+    ./forgejo.nix
+  ];
+  sops.defaultSopsFile = ./secrets.yaml;
+  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+
+  sops.secrets = {
+    "wg/0xa-proxy" = {
+      owner = config.users.users.systemd-network.name;
+    };
+  };
+
+  microvm = {
+    hypervisor = "cloud-hypervisor";
+    vsock.cid = 3 + 5;
+    mem = 3 * 1024;
+    vcpu = 4;
+    interfaces = [
+      {
+        type = "tap";
+        id = "uvm-forgejo";
+        mac = mac;
+      }
+    ];
+    shares = [
+      {
+        source = "/nix/store";
+        mountPoint = "/nix/.ro-store";
+        tag = "store";
+        proto = "virtiofs";
+        socket = "store.socket";
+      }
+    ]
+    ++
+      map
+        (dir: {
+          source = dir;
+          mountPoint = "/${dir}";
+          tag = dir;
+          proto = "virtiofs";
+          socket = "${dir}.socket";
+        })
+        [
+          "etc"
+          "var"
+          "home"
+        ];
+  };
+
+  networking.useNetworkd = true;
+  networking.firewall.enable = lib.mkForce false; # firewalling done by the host
+
+  systemd.network = {
+    enable = true;
+    networks."11-host" = {
+      matchConfig.MACAddress = mac;
+      networkConfig = {
+        Address = "10.99.99.15/24";
+        DHCP = "no";
+      };
+      routes = [
+        {
+          Gateway = "10.99.99.1";
+          Destination = "0.0.0.0/0";
+          Metric = 1024;
+        }
+      ];
+    };
+  };
+
+  networking.hostName = "forgejo";
+  system.stateVersion = "24.11";
+}
diff --git a/microvms/forgejo/forgejo.nix b/microvms/forgejo/forgejo.nix
new file mode 100644
index 0000000..965354f
--- /dev/null
+++ b/microvms/forgejo/forgejo.nix
@@ -0,0 +1,70 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+{
+  services.forgejo = {
+    enable = true;
+    package = pkgs.forgejo;
+    useWizard = false;
+    database = {
+      type = "postgres";
+      createDatabase = true;
+    };
+    lfs.enable = true;
+    settings = {
+      DEFAULT.APP_NAME = "0xa's compilable shitposts";
+      actions.ENABLED = false;
+      database.LOG_SQL = false;
+      indexer.REPO_INDEXER_ENABLED = true;
+      mailer.ENABLED = false;
+      packages.ENABLED = false;
+      session.COOKIE_SECURE = true;
+      server = {
+        DOMAIN = "git.oxapentane.com";
+        SSH_DOMAIN = "git.oxapentane.com";
+        ROOT_URL = "https://git.oxapentane.com/";
+        PROTOCOL = "http";
+        START_SSH_SERVER = true;
+        BUILTIN_SSH_SERVER_USER = "git";
+        SSH_LISTEN_PORT = 2222;
+      };
+      repository = {
+        DEFAULT_REPO_UNITS = "repo.code,repo.releases,repo.issues,repo.pulls";
+        ENABLE_PUSH_CREATE_USER = true;
+      };
+      service = {
+        REGISTER_EMAIL_CONFIRM = false;
+        DISABLE_REGISTRATION = true;
+      };
+      oauth2_client = {
+        ENABLE_AUTO_REGISTRATION = true;
+        USERNAME = "nickname";
+        ACCOUNT_LINKING = "login";
+      };
+    };
+  };
+
+  # expose forgejo cli
+  environment.systemPackages =
+    let
+      cfg = config.services.forgejo;
+      forgejo-cli = pkgs.writeScriptBin "forgejo-cli" ''
+        #!${pkgs.runtimeShell}
+        cd ${cfg.stateDir}
+        sudo=exec
+        if [[ "$USER" != forgejo ]]; then
+          sudo='exec /run/wrappers/bin/sudo -u ${cfg.user} -g ${cfg.group} --preserve-env=GITEA_WORK_DIR --preserve-env=GITEA_CUSTOM'
+        fi
+        # Note that these variable names will change
+        export GITEA_WORK_DIR=${cfg.stateDir}
+        export GITEA_CUSTOM=${cfg.customDir}
+        $sudo ${lib.getExe cfg.package} "$@"
+      '';
+    in
+    [
+      forgejo-cli
+    ];
+}
diff --git a/microvms/forgejo/secrets.yaml b/microvms/forgejo/secrets.yaml
new file mode 100644
index 0000000..a3d42af
--- /dev/null
+++ b/microvms/forgejo/secrets.yaml
@@ -0,0 +1,37 @@
+wg:
+    0xa-proxy: ENC[AES256_GCM,data:DZB/1S2Ev71DbnN+8C/K0mjIf/13Ki1f6vOIOdhsS6qyXKr5OwpbNb9KA0k=,iv:Gnd32DRJtP8LsC1P9GyS98oCLq/MBSCNcxrZngVXF6g=,tag:gyrzJOx9CS+1Kw5JRONIAw==,type:str]
+sops:
+    age:
+        - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJl9iYG5oHBq/poBn7Jf1/FGWWbAnbx+NKjs7qtT3uAK
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IHowb2lXdyB2OXBT
+            QkRaOERCYmJPdTViMXBqc2FUbGUxZjNkNmlqa2pCQzZ5R1JYT2xjCm51THQ2cTMx
+            WkV6b2QvWmQ0SHo5Sk0xTFB3NHpXUVRuWExzcy9wQUNQdUEKLS0tIGpvRnFRbUpy
+            Q3pqbGszM2p1eXFueTF3YXh4T1hzV0ZnOXdYODFRZ0JQcEkKZfPbYqMxfD1Qvu31
+            F7nESte4mN8YtUPnMTWHR0uNXWeUBAW2l/pjOOH40B8xHwmG/+4jv5fBVQJc2GKr
+            9REjvg==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAXrwZsBChUhVuF5gFEfj8GwQlnrqEttAytS5jVCfuE4 0xa@frituurpan
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFlJOElMUSBjRU9t
+            MWRoTEFsSFpUb1F4Mis5U0o4N3BldzlkSU53L3EwVTdkY2ZnUkZFCldvTmRNbjhD
+            eERYOTVob1o1c2xyVzNlbHd6ak5mbnk3dHc5YTB5SXNuR2cKLS0tIGpMRnRORy9k
+            N1F6a2lsQ2JCTFVHTXFtRTRJZHlUL1ZwVXhhNE9PUm15QlEK7Udv/Nx6FKfhjkBs
+            /hLzhzbZ3lwjexNhuyER+rpeZ70LtYmKm8EpcVnPdP3H0w5kyVyK31gv4iabpAUv
+            vNW+Wg==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1gknaqevzuq7dtqalng3547w5qflk9a0kugymea5h54eg6twu43pqpkr4zt
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByT05nL1Vla1k5S0VpVzY2
+            ZXgvOHlycnljMFYrb1g4ZGI0YTBzMytTZWxVCmNKRW9LWld5enNyL2lKVEQyZFlw
+            RUVOQlFsOXFvaW91VUJUS0w4RWR2ZW8KLS0tIHVpVU8waXVYY1hKTHhneVV5NlVD
+            TnQ3SFFsd2ZYdlRhQ2MyNzV6SzZJS3MKlAJNMzDPlxBYcyl/AyvApsq825FnOS1s
+            Etv58L70JbhMgOuJY6tu/4uBAQd2dLphTb8lm4slAQxxtp40pXZ3IA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-02-03T18:25:04Z"
+    mac: ENC[AES256_GCM,data:sSG52AUXjzVo5klAx+t9rhWn/alKAETF6bPUSYP5Dz7WH3vcY5bs87RCm+BdxzlueHMTn4HBQ5iZ2V4e34403GPJsQMYgWSkKapbWGBRurT0xBO5aCJhxZWpvjFSPdehOGNODKGtYFgBVd81PwZRWFdx3MrkwIItyYEq4TAtIyI=,iv:p+t0QmQKDaSiwtuHfLzR31AzmmS39NFq1nn1BAG5YTk=,tag:FSm77zDvPbHCarkGZCgtmg==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.9.4
diff --git a/microvms/immich/default.nix b/microvms/immich/default.nix
new file mode 100644
index 0000000..9e635d9
--- /dev/null
+++ b/microvms/immich/default.nix
@@ -0,0 +1,78 @@
+{ config, lib, ... }:
+let
+  mac = "02:00:00:00:00:03";
+in
+{
+  imports = [
+    ./immich.nix
+  ];
+  sops.defaultSopsFile = ./secrets.yaml;
+  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+
+  sops.secrets = {
+    "wg/0xa-proxy" = {
+      owner = config.users.users.systemd-network.name;
+    };
+  };
+
+  microvm = {
+    hypervisor = "cloud-hypervisor";
+    vsock.cid = 3 + 3;
+    mem = 3 * 1024;
+    vcpu = 2;
+    interfaces = [
+      {
+        type = "tap";
+        id = "uvm-immich";
+        mac = mac;
+      }
+    ];
+    shares = [
+      {
+        source = "/nix/store";
+        mountPoint = "/nix/.ro-store";
+        tag = "store";
+        proto = "virtiofs";
+        socket = "store.socket";
+      }
+    ]
+    ++
+      map
+        (dir: {
+          source = dir;
+          mountPoint = "/${dir}";
+          tag = dir;
+          proto = "virtiofs";
+          socket = "${dir}.socket";
+        })
+        [
+          "etc"
+          "var"
+          "home"
+        ];
+  };
+
+  networking.useNetworkd = true;
+  networking.firewall.enable = lib.mkForce false; # firewalling done by the host
+
+  systemd.network = {
+    enable = true;
+    networks."11-host" = {
+      matchConfig.MACAddress = mac;
+      networkConfig = {
+        Address = "10.99.99.13/24";
+        DHCP = "no";
+      };
+      routes = [
+        {
+          Gateway = "10.99.99.1";
+          Destination = "0.0.0.0/0";
+          Metric = 1024;
+        }
+      ];
+    };
+  };
+
+  networking.hostName = "immich";
+  system.stateVersion = "24.11";
+}
diff --git a/microvms/immich/immich.nix b/microvms/immich/immich.nix
new file mode 100644
index 0000000..bd17dd4
--- /dev/null
+++ b/microvms/immich/immich.nix
@@ -0,0 +1,23 @@
+{
+  config,
+  ...
+}:
+{
+  sops.secrets."immich.yaml" = {
+    sopsFile = ./immich.yaml;
+    owner = config.services.immich.user;
+    key = "";
+  };
+
+  services.immich = {
+    enable = true;
+    host = "10.89.88.13";
+    redis.enable = true;
+    database.createDB = true;
+    machine-learning.enable = true;
+    settings = null; # has to contain secrets https://github.com/immich-app/immich/discussions/14815
+    environment = {
+      IMMICH_CONFIG_FILE = config.sops.secrets."immich.yaml".path;
+    };
+  };
+}
diff --git a/microvms/immich/immich.yaml b/microvms/immich/immich.yaml
new file mode 100644
index 0000000..54075df
--- /dev/null
+++ b/microvms/immich/immich.yaml
@@ -0,0 +1,49 @@
+server:
+    externalDomain: ENC[AES256_GCM,data:kkgCpF1B7CP9e5q1Z9mjRpnF1A4Vb3cbwq1FSxo=,iv:1QlSv8fHoYr+jZ57AQmGsD7VrR9e64PLHqqgvPPuj/E=,tag:WV55mQh/sAStV69tVHiizw==,type:str]
+oauth:
+    enabled: ENC[AES256_GCM,data:QwT42Q==,iv:BJyMLRvXaz7p9ErktlYVWAHC9Z/q+TymoxlAwuXnJzM=,tag:kguUPvrO6ZVvjvIhT7P/sg==,type:bool]
+    autoLaunch: ENC[AES256_GCM,data:FmnAGw==,iv:0MhmkDPl7T03PyazLvdAvrAHLulwpuNLfGCK1xR5qr0=,tag:5hsgWYWF/iigMvs+DNeCnA==,type:bool]
+    autoRegister: ENC[AES256_GCM,data:EkaAlw==,iv:DdzbFyxhowt44kktxNjWDpe/ZhGtKGcviL5TbI9zFSA=,tag:gRtqFAsJWmbmDxXW/e4cjQ==,type:bool]
+    clientId: ENC[AES256_GCM,data:/ZX0Ez5X499VjzqsfGnNEt2k626EltpLY9TjK6UAalpPJVZ6Qr9O3A==,iv:/EmJ5GCs00FJyZSU5rYlCOUl4FlyuIDwtE8oR9pGwo0=,tag:CTHuJ7hhSFfzndeZL2mk4A==,type:str]
+    clientSecret: ENC[AES256_GCM,data:+orm+5TLYZ7ogjTNW6TS622/h6bYOc/iRHUc2gpEcLTHNw3ngnLP+omVJ4kCHPIaRWI44b6rnMuq9jDb4ILMSYQeFjK7Xk1TQU3qyMoT/Z8tekqRJ+bfjOA+aF4Tb8dxR6lmwX3iREtG19MYhknc6qYSj450tuB6dFdwigAa5nc=,iv:EsySo7SVy7FdW/s5qstissUCHKh1kyjAxCMF4fXZkrY=,tag:7t9NQdCPljsC8JvuVA7k+g==,type:str]
+    issuerUrl: ENC[AES256_GCM,data:fxqkJaCp48JrY0xoZ9nqlGUY1ymU5jKMkWDTJc+R3CLzhDdEUhf2ZYCLIwLAWRvXnw==,iv:1Qev2B5XDp9X6TaAJJKA7FPMwUNFtMQE8nzvbRdAyjI=,tag:BJIAty86QYxO/ClWo90R8g==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1afyntwvj672lcq2e4dpxmw3syplzurnnd8q8j3265843jeedpveqkp465z
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0VmE5d3NPM05kblJNbzFS
+            aWpheFB0dS9QT0RuOERqU3BRdlUrTkRMUjNjCmRKSHNXK29hS1BlWTlBVjVKdkZT
+            cmd1TGZDOFpYa2txUEdJL1RHYXdrdmMKLS0tIERaMFN3Q3E5UkZabU0xd0ZtUHBZ
+            Lzd6bFk2ZFZldmpKVEs3aGVJUmozdEEKv8cl7EqA42vUrlUQyisiEKyErjr+cOF9
+            7zBcA9qgwdGDTLaOIdeWd6SrEDBtxqYVW2Clx28CTqEsO+nbHDVRzg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-01-24T20:10:57Z"
+    mac: ENC[AES256_GCM,data:+nClWkdsMKGgFqJ9v801/GfF193jNT0NN57NdbF6tDfEiWmM34FP9EQVEUThzA8U+qzBkq1iEyoPA9OdIJnu1EOPT72a7C/cqzfBOoomZS7E+gvp+MhVkoqk2Id4AHSYly0VFjtIiDEY60Z6nvzr5w3rfOZMI3MaHn6cwt+gYZE=,iv:+OmqDPh8ISFoVccgvR+sN7kfXhGT3lSOG5enP3ys/JY=,tag:kCZWLD75TNMb2NodHZKmnQ==,type:str]
+    pgp:
+        - created_at: "2025-01-24T20:02:34Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7zUOKwzpAE7AQ/8DMoRyd4MkIT7CwtVMskspJYWRseML+0bZe2POGa5CFqb
+            UoypBr+Isvml0RKdZgrZyGAgcU5OM9uTvPWf/9V4CGGxNn5yM3wpBYO1HNTLrTc1
+            c9Xdl3Lj0nOmwyC4oVtKbl2wrLCrfewIoI3Q9AnQuNtnFbgjPvrCCKeHPzE7nOXF
+            0Xy6Sy7Wk2HoFrEhztzB8sLEr9UxnMie9Z3p7nKbGoF2mLSoHrUVrVIK/6k+FcIx
+            tGPGXtysDAIMgkzksicFqM/6y3wcRVhbOJenFczIqb8Rfqeyen7PY53ozHoQpDr7
+            3uBNb8DD+9knqE/Y2fAsZhY39QwiSFR+QB9cePdpq2HlsqOqtD+48p8yBL/DeJ4K
+            fawzjP7NhgN0r92iMMmSsjUWM9HtXtONPiwwOptPxvWwSicN4fE9+JGQ7BNwtnvZ
+            5QepbU33P6PNfEulUCr9+kRVP4apwGP6qWqyZaup4iiKil6AzLS/TBkJmj9eLtUC
+            /lh2Joih13YZJ5mCUqDuD4HCoZaDkbCgnufUc6u0H9Ox/1hri/V96wuXLT9IBh9U
+            6nga/GVhf9T3yAHDaKeJA5/0fFqhh5mTZZuq6fOYQxih4Xmq7cx+F1Qc0NrFWSMb
+            pj725EzSXfrGCkdL3AT07JgK8DrLFtMu9yOWknZtP+wybKM6NUGevJ8+HUB9hFLS
+            XgFwgysGIBtTCo86/n/g/F2IIBSHtJ3607fuOHgI/MdC640fBrqcPJ6aznfOcNeX
+            ZMA2WN1XJTg4oTDKifS658fcN9peXe4ujwVkmTf+2gZUxr9lwOXCrXpAG6xrFHU=
+            =sCmm
+            -----END PGP MESSAGE-----
+          fp: DD0998E6CDF294537FC604F991FA5E5BF9AA901C
+    unencrypted_suffix: _unencrypted
+    version: 3.9.2
diff --git a/microvms/immich/secrets.yaml b/microvms/immich/secrets.yaml
new file mode 100644
index 0000000..45637d4
--- /dev/null
+++ b/microvms/immich/secrets.yaml
@@ -0,0 +1,37 @@
+wg:
+    0xa-proxy: ENC[AES256_GCM,data:4sJGq0MnoKwca2/CHGDzjxqNK9UH2lxByt/xZzhYVzgsmpjl8J5HLbb/xvY=,iv:SOlqtNMxlSp18AQ1j+B9xA8R+0xURkmrtgnACvG4n8s=,tag:5ittu905Pz6go/Otm5ZrBQ==,type:str]
+sops:
+    age:
+        - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJl9iYG5oHBq/poBn7Jf1/FGWWbAnbx+NKjs7qtT3uAK
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IHowb2lXdyBxbGRo
+            emhsNnkrYm8vNWhObGNVQnRJb1BaTzdrbDRmUktYMjRXSGlLQlVnCkd6dHR6Umpt
+            SXU4TzVMVWxYbDFIcEZPaUVjQURYQStjL1FKdnlXUGxZSlUKLS0tIE9yMEI4bEkw
+            aVl5Vm9FQUZjZWZIUEZVcTE4OWpUS0VEU1NVMjBvNmNDemMKXSDvFyMt+CiQj+Mo
+            WMWtregXZ2jMYk8Z9bJDeGQvymJxoUf98qvaTYSDXs1kCvVBrrOToGYHXwZ9j0cf
+            Uyib0A==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAXrwZsBChUhVuF5gFEfj8GwQlnrqEttAytS5jVCfuE4 0xa@frituurpan
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFlJOElMUSB2WXNs
+            dkdyZmtHYU9TYU1LQTNOUk9WYi92NFdBa1ljYll0ZVhGQVQ3WUJNCndCMkZPUmVq
+            SEhxS25KTEJoS0RPb3lVNVJhUXl0dnkyc0xzUDROazRVM0kKLS0tIEorVnZYbTVa
+            dkZwWWJhNnJUSGVqMXVJZHFmSGRKYmVXUWRWOGVEbnV2cUUKP4Nuqb4O7kP1okS5
+            9AbA9GC/eu7jXdXQeboEDY40U1yl+nZoCc0PcP5kXKGiMycP/4eaJtyTWVOCAFHq
+            4aYVOg==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1afyntwvj672lcq2e4dpxmw3syplzurnnd8q8j3265843jeedpveqkp465z
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6eWFzdE05aCtjQkhZU2V5
+            Y3VtRURLbWp3M0NOcG95L09SZktvbHFUNDNvCkVoM3kxYjFRTkw3SU1ZSkFqOUwr
+            ZHV0R1lNbVdaek5rRXlTODU1N3RCUm8KLS0tIEVYZHVrK0dGTFh6YmQxU09Hd3Az
+            SXB2bTJQYzRVZ3AwWXdlUjhJRUJWMG8KObHGuGc9xuGGsJhrD7SztKDxMmT28OnA
+            QtM7P1hEEtlC9uxvB6OXGRstHN7WRBj66hkEObuKuCJepTQE1pMV9w==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-01-21T17:43:24Z"
+    mac: ENC[AES256_GCM,data:oSaH4N4EDusCP76dupUzPMzNLZtqUHhmBHdA6sVkwx3kJilj/U+fQjLuBwD2XMxM5Z194yKnSzT+ZCP9b0V0NiOQyVp/ry/e3Hgs3aW0NPAFBPF126/iYts5fenDdonFO9Z85ge8ovorLVrziXLP6QQYCvfJdwh/p4faJdtkhWo=,iv:N7qCXhJFHyw8WNTATXlcwgGHh3d4i3Vr7fABOo8L4P0=,tag:4pZmCPrWxI6NkqkixgLHDg==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.9.3
diff --git a/microvms/miniflux/default.nix b/microvms/miniflux/default.nix
new file mode 100644
index 0000000..d2f024f
--- /dev/null
+++ b/microvms/miniflux/default.nix
@@ -0,0 +1,78 @@
+{ config, lib, ... }:
+let
+  mac = "02:00:00:00:00:04";
+in
+{
+  imports = [
+    ./miniflux.nix
+  ];
+  sops.defaultSopsFile = ./secrets.yaml;
+  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+
+  sops.secrets = {
+    "wg/0xa-proxy" = {
+      owner = config.users.users.systemd-network.name;
+    };
+  };
+
+  microvm = {
+    hypervisor = "cloud-hypervisor";
+    vsock.cid = 3 + 4;
+    mem = 1 * 1024;
+    vcpu = 2;
+    interfaces = [
+      {
+        type = "tap";
+        id = "uvm-miniflux";
+        mac = mac;
+      }
+    ];
+    shares = [
+      {
+        source = "/nix/store";
+        mountPoint = "/nix/.ro-store";
+        tag = "store";
+        proto = "virtiofs";
+        socket = "store.socket";
+      }
+    ]
+    ++
+      map
+        (dir: {
+          source = dir;
+          mountPoint = "/${dir}";
+          tag = dir;
+          proto = "virtiofs";
+          socket = "${dir}.socket";
+        })
+        [
+          "etc"
+          "var"
+          "home"
+        ];
+  };
+
+  networking.useNetworkd = true;
+  networking.firewall.enable = lib.mkForce false; # firewalling done by the host
+
+  systemd.network = {
+    enable = true;
+    networks."11-host" = {
+      matchConfig.MACAddress = mac;
+      networkConfig = {
+        Address = "10.99.99.14/24";
+        DHCP = "no";
+      };
+      routes = [
+        {
+          Gateway = "10.99.99.1";
+          Destination = "0.0.0.0/0";
+          Metric = 1024;
+        }
+      ];
+    };
+  };
+
+  networking.hostName = "miniflux";
+  system.stateVersion = "24.11";
+}
diff --git a/microvms/miniflux/miniflux.nix b/microvms/miniflux/miniflux.nix
new file mode 100644
index 0000000..9afbe29
--- /dev/null
+++ b/microvms/miniflux/miniflux.nix
@@ -0,0 +1,22 @@
+{ config, ... }:
+{
+  sops.secrets."miniflux" = { };
+
+  services.miniflux = {
+    enable = true;
+    createDatabaseLocally = true;
+    adminCredentialsFile = config.sops.secrets."miniflux".path;
+    config = {
+      LISTEN_ADDR = "10.89.88.14:8080";
+      BASE_URL = "https://news.oxapentane.com";
+      # oauth
+      DISABLE_LOCAL_AUTH = 1;
+      CREATE_ADMIN = 0;
+      OAUTH2_OIDC_DISCOVERY_ENDPOINT = "https://auth.oxapentane.com/application/o/miniflux/";
+      OAUTH2_PROVIDER = "oidc";
+      OAUTH2_REDIRECT_URL = "https://news.oxapentane.com/oauth2/oidc/callback";
+      OAUTH2_USER_CREATION = 1;
+      POLLING_FREQUENCY = 37;
+    };
+  };
+}
diff --git a/microvms/miniflux/secrets.yaml b/microvms/miniflux/secrets.yaml
new file mode 100644
index 0000000..39cb3b9
--- /dev/null
+++ b/microvms/miniflux/secrets.yaml
@@ -0,0 +1,38 @@
+wg:
+    0xa-proxy: ENC[AES256_GCM,data:v8YxaUUnPuNAUU+3zvy5UzxNNMztaq5q1zli20JkAFdbgN+6SXzJeBcxs7M=,iv:0iPIrKtZzgxMMy2S+zLhEumitEEm8go1pfaN9D/e5C8=,tag:pw6DZFiFaL7skPxfUAGZ/A==,type:str]
+miniflux: ENC[AES256_GCM,data:KggPU65HAQbkBwebFw/CibolkenAUfZacz0tXruHQhExMwuHALOuxVVeATjp6nQoNfa3XNYN5w9EPhNWwvx0k98o7vxdg1pCQs1zu7UM9QiFykwYNlZQcbTMvBCoZkPwcjukvIwW25WrwDQREPv84kL7HvXPg6J8lM4x4WMbxW2t2qDjOt4SQE7bbXHZOliAW0YYb9KG8V2Mcg7GnPL/aWv7t0qur3ZACR0GgVFJIV90+qtVmr8wsOo60TtwDxOXkLFeHDdH67LxqQWry6v9RQ==,iv:Sv62ohd8tY9SMC/i3W4o/QP59Ka7w/5kk+R0Rhu3X0E=,tag:a5Ksf6V/lmLcqLZa4Qo+7Q==,type:str]
+sops:
+    age:
+        - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJl9iYG5oHBq/poBn7Jf1/FGWWbAnbx+NKjs7qtT3uAK
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IHowb2lXdyBZcEJZ
+            cTFGMmhjN29zWHQ4WURmWXgzZEZkRml0a0F0Y2dKU3ppcEJmd1FnCkdOYk5ObEFI
+            QWFHT3MrQlI2TkVEd1VYOVcwbjM5Z0xpV1BsUmExd3J2STgKLS0tIDVnemRKc01X
+            ekxGS0NLYjZLMm9UVm5Zc2NZY0hxSFNtRGlJYlpBZk0zQW8Kzv4W9yy8qWP4EQbr
+            KA4BncMHEWQ6xcnD1l3iFHIUeG8EqvH3N3eOZ/8OrPfZDkYHcbVMmtmQl5sDOv9P
+            3b+TwA==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAXrwZsBChUhVuF5gFEfj8GwQlnrqEttAytS5jVCfuE4 0xa@frituurpan
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFlJOElMUSAzZWJj
+            YVBnYmNqV1drdDhIMnpBTE9BVCtpcmRvUVJkSHU5clNkNVBhaFJBCnlsU2M0Z0tl
+            dE53V0graVBMNTVQT0o4bDVueGtQUkM1aGJzMUFEbVVmd3MKLS0tIE51SkdYNWVa
+            SFo0K00wUXRhaXI0Tkw0SnlhZ01oRExkcVAwWkovblplY2MKp+F3ai1mKWgHVjx8
+            Qr72eoyQJ4+OjzKV1eqGNGLqb8H+qP6ynAQeLpQuhs/rLUxM/nZy47uPE5mllIoN
+            4/39SQ==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age15ja22wd9tt60vn32sk59pp6c7vtjsn8y3rypn8qfnvxthug8sp0q6f72uh
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLQjNONFc0T1JxSHB6S0F5
+            bWVZQzlyZXY3VmRWNllWL29jNEVXNWxoeGlZCkdtOFRCakd5bVFTSzVlVFpFV3M5
+            VmlWRFV5U0F5QXZwMU9IT3NWeWx1cjQKLS0tIEpwaVdZVTA1ZzllbE9YOFZvMVdS
+            ZU1pN0pLZTRXb0NKNFlWakY1L0x0ZHMKMmhFFufDWZMPxjB9eIf0rJmdIzabQWKk
+            4NcZwriNtTHRPKnqHF/eoV7jOjN17A9mzz1Ln1LZDwFg5iFtIrjNYw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-01-25T01:09:45Z"
+    mac: ENC[AES256_GCM,data:euRvs3gMaxqcTzDhacFdBVPprggN0eNki0g7BKuCr85se52CzpSCj13OF5LJE4Wl3vVOuGbpOsGUKjKKHANGddgPRPvs+zGYKrtcI1fYLE7XJXm5CwxvCcnTqmDCx+8WtXLhFhXVTCXOOx3miB03IC+i8kdZ0LLTTig2oWEFxZo=,iv:tVZPvRsX0XTwBxjuKCP8mGCMmKWTjFKUTMdCgddM9SE=,tag:AywLDckO/ZjORRXxbjQ14w==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.9.2
diff --git a/microvms/stream/default.nix b/microvms/stream/default.nix
new file mode 100644
index 0000000..2cad795
--- /dev/null
+++ b/microvms/stream/default.nix
@@ -0,0 +1,77 @@
+{ config, lib, ... }:
+let
+  mac = "02:00:00:00:00:07";
+in
+{
+  imports = [
+    ./navidrome.nix
+  ];
+
+  sops.defaultSopsFile = ./secrets.yaml;
+  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+
+  sops.secrets = {
+    "wg/0xa-proxy" = {
+      owner = config.users.users.systemd-network.name;
+    };
+  };
+
+  microvm = {
+    hypervisor = "cloud-hypervisor";
+    vsock.cid = 3 + 7;
+    mem = 3 * 1024;
+    vcpu = 2;
+    interfaces = [
+      {
+        type = "tap";
+        id = "uvm-stream";
+        mac = mac;
+      }
+    ];
+    shares = [
+      {
+        source = "/nix/store";
+        mountPoint = "/nix/.ro-store";
+        tag = "store";
+        proto = "virtiofs";
+      }
+    ]
+    ++
+      map
+        (dir: {
+          source = dir;
+          mountPoint = "/${dir}";
+          tag = dir;
+          proto = "virtiofs";
+        })
+        [
+          "etc"
+          "var"
+          "home"
+        ];
+  };
+
+  networking.useNetworkd = true;
+  networking.firewall.enable = lib.mkForce false; # firewalling done by the host
+
+  systemd.network = {
+    enable = true;
+    networks."11-host" = {
+      matchConfig.MACAddress = mac;
+      networkConfig = {
+        Address = "10.99.99.17/24";
+        DHCP = "no";
+      };
+      routes = [
+        {
+          Gateway = "10.99.99.1";
+          Destination = "0.0.0.0/0";
+          Metric = 1024;
+        }
+      ];
+    };
+  };
+
+  networking.hostName = "stream";
+  system.stateVersion = "25.05";
+}
diff --git a/microvms/stream/navidrome.nix b/microvms/stream/navidrome.nix
new file mode 100644
index 0000000..0b1cd07
--- /dev/null
+++ b/microvms/stream/navidrome.nix
@@ -0,0 +1,16 @@
+{ ... }:
+{
+  services.navidrome = {
+    enable = true;
+    settings = {
+      Address = "10.89.88.17";
+      BaseUrl = "/";
+      EnableExternalServices = false;
+      MusicFolder = "/var/lib/navidrome/music";
+      Port = 4533;
+      ScanSchedule = "@every 11m";
+      TranscodingCacheSize = "11GiB";
+      ReverseProxyWhitelist = "10.89.88.1/24";
+    };
+  };
+}
diff --git a/microvms/stream/secrets.yaml b/microvms/stream/secrets.yaml
new file mode 100644
index 0000000..d26d805
--- /dev/null
+++ b/microvms/stream/secrets.yaml
@@ -0,0 +1,37 @@
+wg:
+    0xa-proxy: ENC[AES256_GCM,data:uZfFc4elxCAVZvdIHJ7lgoPs9qKkD9ZvLhcYbexDcqn0alaMzIr++CY52FI=,iv:CREMt6GrLHs4Jwj/55awDFHh9hQlJPEi4ZQ7ZLMPvRA=,tag:iJAGdqzQbyezmDj+tzjdNQ==,type:str]
+sops:
+    age:
+        - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJl9iYG5oHBq/poBn7Jf1/FGWWbAnbx+NKjs7qtT3uAK
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IHowb2lXdyB5Zytw
+            K1ZKTHBFYy83WU94N3Izczh1RnE4Ry9iRkEvMUxLUUNaTW52MW1ZCjIxWFI3NTJ6
+            eXlXYXVVbHQ5Qjkxc0YwSU1MUjRVRi9abFl2dm1QSkx4N00KLS0tIEtaeXgyUzAv
+            UWhnSjR0TlJyMkpEVlJkaEdNZURXNUhQdXpkcWRYMmxFNDAKFIoZevnllkATCBog
+            5R7ntMPrAlub8WnOjZVT5QdMgU3dRmxUnnfXY4PY7QpLNKyjEUxQ/5zvEeogYOSZ
+            IUVfhA==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAXrwZsBChUhVuF5gFEfj8GwQlnrqEttAytS5jVCfuE4 0xa@frituurpan
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFlJOElMUSBuVVJO
+            ZS9Ed3NrVEl4ZGRpZURZZVRaZ3pwcTZVRmJmQ3lrdHlQaWYzSjFvCkJQTXNDR2xm
+            WkhxdnA3RlhPRkpnMWIvS0RzcTRJdEFISlpUb0NaYXVoMlUKLS0tIGZDSGw5QjRG
+            bW9vUzRSRWk5ZG5rc0tjYjFzSzFuVWpJTExEVDhmdXloZzQKzJrWm1z3KRLSLkxt
+            ZsmunVoD55HjrFsvPNnVear40c9JB+U3+m1pjdL5eax27lrX/rlvXx7rhzOhtTkN
+            9IDAjg==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age148r2q3cy9sjem37rvgtcc4qjx8usxkdg77pqexa56gmcexn58aaslh3cnj
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLNG9vM1FqTVVBSTFYaGt2
+            Rkpvci9ibXJyL3ZVbHNYbmF4Umk5ZHJ1bURFCmVjalI0S084R1dsdzdHQ0lZbmcr
+            SjBXSDRUUGtUQ21wN2kzUmxwZmdKWUkKLS0tIHNjM1pkemxJbWZDNGZ4T01GZVli
+            b05oNElQQjUrUklpYkR1TCsrTU5uUHMKWB5XybfmmjTfk/c+mRT2PNgsI4q8tbac
+            nV6pFb97477fcnHH/vpbBD24bixFt/X8A90G3ilbjqL+1rd4G+K7jA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-06-12T22:54:11Z"
+    mac: ENC[AES256_GCM,data:15EU9VupWfvR8CrfKrX3nhpD60hYB2LY3vuAPvdqzKLliqSqolNj956fOFicfSHvmW/s+7x+M+5FROnOzSbToTZotFtvALQihHH999veGZMx8Q8oIyljT1PBw/SU9djXPI1KjG/zzYOAwu7y/Ffm0QKhMRziH7CQLn30KR0o2w0=,iv:ghdyTvcpgnBi2L9s4UrzwWwt9TeU0WkGquZ64+w9IN8=,tag:4m4hYFgejlEaQROB/OEi6g==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.10.2