minipc

2026-07-12 08:17:45 +02:00 · 2026-05-28 14:57:18 +02:00 · 2026-05-28 14:57:18 +02:00 · 9dd5ae6698
commit 9dd5ae6698
parent 131a282338
44 changed files with 353 additions and 79 deletions
--- a/nix/hive.nix
+++ b/nix/hive.nix
@ -66,7 +66,7 @@
            wg = {
              privateIP = "10.0.0.3";
              publicKey = "pdUxG1vhmYraKzIIEFxTRAMhGwGztBL/Ly5icJUV3g0=";
-              peers = [ "vps1" "vps2" "vps4" "vps5" "dns1" "dns2" ];
+              peers = [ "vps1" "vps2" "vps4" "vps5" "dns1" "dns2" "minipc" ];
            };
            tags = [ "apps" ];
          };
@ -92,6 +92,17 @@
            };
            tags = [ "apps" ];
          };
+          minipc = {
+            publicIPv4 = null;
+            publicIPv6 = null;
+            wg = {
+              privateIP = "10.0.2.1";
+              publicKey = "ecYfTot7RrJyNebSZTQ1wciOhvrpNSSbkR15twpSSl4=";
+              peers = [ "vps3" ];
+              noEndpoint = true;
+            };
+            tags = [ "home" ];
+          };
        };
      };

@ -300,4 +311,16 @@

      system.stateVersion = "23.11";
    };
+  minipc = { name, nodes, modulesPath, config, pkgs, lib, ... }: {
+    imports = [
+      ./modules/minipc
+      ./modules/wg-mesh
+      ./modules/nas-mount
+      ./modules/postgres
+      ./modules/immich
+      ./modules/tailscale
+    ];
+
+    system.stateVersion = "25.05";
+  };
 }
--- a/nix/modules/default/default.nix
+++ b/nix/modules/default/default.nix
@ -2,9 +2,12 @@
 let
  pretense = import (pkgs.fetchFromGitHub my-projects-versions.pretense.fetchFromGitHub);
  quotdd = import (pkgs.fetchFromGitHub my-projects-versions.quotdd.fetchFromGitHub);
+  networkConfig = networkingConfig."${name}";
 in
 {
-  deployment.targetHost = "${name}.infra.noratrieb.dev";
+  deployment.targetHost =
+    if networkConfig.publicIPv4 == null
+    then name else "${name}.infra.noratrieb.dev";

  # TODO: ensure that the rust programs have frame pointers

@ -20,6 +23,8 @@ in
    nixPath = [ "nixpkgs=${nixpkgs-path}" ];
  };

+  nixpkgs.config.allowUnfree = true;
+
  environment.systemPackages = with pkgs; [
    vim
    wget
@ -27,10 +32,14 @@ in
    traceroute
    dnsutils
    nftables
+    htop
  ];

  networking.hostName = name;

+  # Swiss german console tty keyboard layout
+  console.keyMap = "sg";
+
  time.timeZone = "Europe/Zurich";
  users.users.root.openssh.authorizedKeys.keys = [ ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG0n1ikUG9rYqobh7WpAyXrqZqxQoQ2zNJrFPj12gTpP nilsh@PC-Nils'' ];

--- a/nix/modules/immich/default.nix
+++ b/nix/modules/immich/default.nix
@ -0,0 +1,29 @@
+{ config, pkgs, ... }: {
+  age.secrets.immich_secrets.file = ../../secrets/immich_secrets.age;
+
+  services.immich = {
+    enable = true;
+    mediaLocation = "/mnt/nas/HEY/_Nora/immich";
+    secretsFile = config.age.secrets.immich_secrets.path;
+    host = "0.0.0.0";
+    database = {
+      enableVectors = false;
+      enableVectorChord = true;
+    };
+    openFirewall = true;
+  };
+
+  services.postgresql = {
+    ensureDatabases = [ "immich" ];
+    ensureUsers = [
+      {
+        name = "immich";
+        ensureDBOwnership = true;
+      }
+    ];
+    authentication = pkgs.lib.mkForce ''
+      #type database  DBuser  auth-method
+      local all       all     peer
+    '';
+  };
+}
--- a/nix/modules/minipc/default.nix
+++ b/nix/modules/minipc/default.nix
@ -0,0 +1,8 @@
+{ ... }: {
+  imports = [ ./hardware-configuration.nix ];
+
+  networking.networkmanager.enable = true;
+
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+}
--- a/nix/modules/minipc/hardware-configuration.nix
+++ b/nix/modules/minipc/hardware-configuration.nix
@ -0,0 +1,42 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [
+      (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usbhid" "usb_storage" "sd_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    {
+      device = "/dev/disk/by-uuid/9327fdbf-f6d2-41ae-b69f-6dbb97ab388a";
+      fsType = "ext4";
+    };
+
+  fileSystems."/boot" =
+    {
+      device = "/dev/disk/by-uuid/2A59-D3C9";
+      fsType = "vfat";
+      options = [ "fmask=0077" "dmask=0077" ];
+    };
+
+  swapDevices =
+    [{ device = "/dev/disk/by-uuid/db30dd66-fa2a-46a4-b81a-b0fc935db5ac"; }];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp2s0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}
--- a/nix/modules/nas-mount/default.nix
+++ b/nix/modules/nas-mount/default.nix
@ -0,0 +1,6 @@
+{ ... }: {
+  fileSystems."/mnt/nas" = {
+    device = "nas:/volume1/homes";
+    fsType = "nfs";
+  };
+}
--- a/nix/modules/postgres/default.nix
+++ b/nix/modules/postgres/default.nix
@ -0,0 +1,6 @@
+{ pkgs, ... }: {
+  config.services.postgresql = {
+    enable = true;
+    package = pkgs.postgresql_18;
+  };
+}
--- a/nix/modules/tailscale/default.nix
+++ b/nix/modules/tailscale/default.nix
@ -0,0 +1,13 @@
+{ ... }: {
+  networking.nftables.enable = true;
+
+  services.tailscale = {
+    enable = true;
+    extraUpFlags = [ "--advertise-exit-node" ];
+    useRoutingFeatures = "server";
+  };
+
+  systemd.services.tailscaled.serviceConfig.Environment = [
+    "TS_DEBUG_FIREWALL_MODE=nftables"
+  ];
+}
--- a/nix/modules/wg-mesh/default.nix
+++ b/nix/modules/wg-mesh/default.nix
@ -35,7 +35,9 @@ in
          let peerConfig = (builtins.getAttr peer networkingConfig).wg;
          in {
            inherit (peerConfig) publicKey;
-            endpoint = "${peer}.infra.noratrieb.dev:${toString listenPort}";
+            endpoint =
+              if !(builtins.hasAttr "noEndpoint" peerConfig) || !peerConfig.noEndpoint
+              then "${peer}.infra.noratrieb.dev:${toString listenPort}" else null;
            allowedIPs = [ "${peerConfig.privateIP}/32" ];
            # sometimes there's some weirdness....??
            persistentKeepalive = 25;
--- a/nix/secrets/backup_s3_secret.age
+++ b/nix/secrets/backup_s3_secret.age
@ -1,13 +1,14 @@
 age-encryption.org/v1
-> ssh-ed25519 qM6TYg Iwzv4FA1pIES6SynmQejkarTCRc3xwqJhbPK+U197BI
-0F6drTGs14E6tf0/eDcWu2y9b9yYLXjkAkHV0hT01MQ
-> ssh-ed25519 91VHug NhInO02XlDKVDYeEk+Y4jmaAG03YO1yy50R9vnUGPWU
-0lgqjusLVxCLIQA8BSQveTNKEQf7uyEctRX+TDqipj4
-> ssh-ed25519 XzACZQ vtBUTFyr4gjqcUsn3WCYOPspjnVwL19izhKYGX4kiy4
-bW6zwWar6COr58s/U6GJZsOPicAECUJr2VQZ0nOneF0
-> ssh-ed25519 51bcvA itN8U0WXocUWmsO7Hy3a94j+aUyH83BN4iG9RK/9lCk
-Eyuawwp7+bv9/f2UOihOqFLcETsFgPS+iJRrLID6jT0
-> ssh-ed25519 vT7ExA tJoU7e9muJvOLU1a50SI7+KgbHYke/vaMn77u9gAyTw
-p0Ofeh74R/UTpaBRDITNjwwXkUs/grBnsHiSvzUxCKU
--- EsDITASaNlbxImI3s/hCMpOM6Up4UrZgez1fTJlRT1M
-:Ž,ß<>¥²ì Õn.<2E>|*ƒ#<23>ü‘C¿a%ùI¿ýíw$`î<¡øÚÁM_AÑZZorýiêm\Ö^×/#\:(8*’´×?½åfˆEVÑWm¦Šaó†~ËõEâ5±ÒÕÈ«h¯©½¨h<C2A8>SÛdx&Â‹K²Ûº¼9¦€†·3\–P¢2ò¾d§Û_mýŠ‚©+\ý8dyj
+-> ssh-ed25519 qM6TYg vf1l0o7K8ZIZGEBx2x7EzWKG7UKFQtuOhBqj/Nyq6xU
+8b0863lHC83pZZ/dIkKS3f7L+PE0I+m0f2zqtef4tuU
+-> ssh-ed25519 91VHug r5WkIt9V+TM/zupGjYH7FrIz2ZSctKh0cWixaaL8vH8
+c0J8wy8gRmgoA5vEA3AeXa8orH2amWdIgxJJDaBSjTQ
+-> ssh-ed25519 XzACZQ Z6z3pornKWMM08RxpWV4YjWs8qKF9xn8lNS6S3SpFSI
+1O4YNGfKjiY/BJDKwm1J3ZOhpPrMAiTdUHfZ305mSco
+-> ssh-ed25519 51bcvA cxBUjrD7stWdK400O/2HJM3YcKGjDGpWZt4Yq1sVdVg
+mw2xRTGFWiWI959J8GOCTp/kiV85+k2/+bYJpw95/ew
+-> ssh-ed25519 vT7ExA 8bQ4LWtqj2AodnJHcV8lEk+3EcZBfWHUVHQKcG4nCwI
+dIfddL4LTMun+EQQuPdLJNkGVysvTPm2059vQUUnEGk
+--- VIlkl9DdBWVgTiJvBK3jgdpsLgGkvv/dFfbZLEYMmT0
+ ‰ù£
GE=ù0bþÊ®ÀäP±*èäÏ&<26>ó^V)?‹0,ö½¦vpaÈ§}‰pç¬†<C2AC>¾YÇÇ[ˆ±;Ìž²@Š[o
g»$xÜ¶³9g
+ä{Y}ö_ƒˆ!ÄÆøðÜ¿©(‡‹[R¡·VÜÏ	U'q’¥–ŸC%SZëw ŸTC=ì5âaÄ²<C384>xFÿ›Æÿ´)Jà
--- a/nix/secrets/caddy_s3_key_secret.age
+++ b/nix/secrets/caddy_s3_key_secret.age
--- a/nix/secrets/docker_registry_password.age
+++ b/nix/secrets/docker_registry_password.age
@ -1,7 +1,5 @@
 age-encryption.org/v1
-> ssh-ed25519 qM6TYg 8d5Jze4wRBsRqy+/ifnIMf5IhQZrn2Hs0k4/RCJoAko
-IUgnzcCHmQhsrJfUuOG5s7nl98/X+ycpr0JWQeqc1Ps
--- dNJXPA7jEVJs5yQmvcaidVnJoN5pRMbh6okQsjjDabc
-–Ñf˜… ï<ŠSœs—[<5B>‰‹-iõMp”cî
-a5KÑ
-S‹ü`U¦Â$öEC8t^Jˆ•¥"
+-> ssh-ed25519 qM6TYg I4FIet5K6KGjWaCvKbhK7UV4LFJthRpRVDO/FoARzxw
+F/KQtQI78KlLe1jT84oxdg4UG8QuG8xAVAutzVM+kJw
+--- TEgDiZeZQL2K8Nq/xqUKrkPKSXyO5NgRbx8SkfGl62o
+(L× *‡2þ¿ëÊÚƒjö¥E‹D*
È¹Å^ä¥¶Ä²s<C2B2>´<EFBFBD>yð:…7
o†Reâ
--- a/nix/secrets/does_it_build_private_key.age
+++ b/nix/secrets/does_it_build_private_key.age
--- a/nix/secrets/forgejo_s3_key_secret.age
+++ b/nix/secrets/forgejo_s3_key_secret.age
@ -1,6 +1,5 @@
 age-encryption.org/v1
-> ssh-ed25519 qM6TYg oDQzYAbe3UasUjgyw2AAtcYaID6nKD+j6C2R05R8Bw0
-NnPZ81p1PafEEfYHP+MafDdrhq83aJ2NuH8iYz2Uk/Q
--- FM0robN+6H2uAp+ASaCVxlLmD6xVp5oNHHAz1BE8/+A
-6K×(6ÁF	Ys#+\á,\’LíÓâê¨:RøÖ@Øtüç³†Bž¸ƒìp
-.±6<C2B1>Š>L·çÓøê}`Q¹ÚDÓ5†ÅQÑæ-i<19>ŽÓ§F	<09>Çš— ¿”1‡VÃÑ
+-> ssh-ed25519 qM6TYg pA28Ib4AvSxoAZuGE7ZDW7CpA1GQkYm77WKNahcUFEE
+HjzZ2b/iVig4reIgU3z0O1El+tct50LS5fp+SiQB+Pk
+--- ExFpE2FxaqSuuSMtQTU+kzVz4rI2SriLKhcy0JHZXPo
+KÀ¦îÐz)`Q=¥ýgXŒµgì èµ}<7D>|ÿ
øªR—!Ùw›D6ˆÖï¿é?^4ÜùHÎ³MV]¸`7L0TŒÏ6ã1×ûNãøŒd<>1\¬Ø×¥C~Ï<>êF±¶Š«ü›
--- a/nix/secrets/garage_secrets.age
+++ b/nix/secrets/garage_secrets.age
--- a/nix/secrets/generic_backup_password.age
+++ b/nix/secrets/generic_backup_password.age
@ -1,13 +1,13 @@
 age-encryption.org/v1
-> ssh-ed25519 qM6TYg EOynzb0Op5bNKRZ1jRaS+ZZDowhMmGYkv4u0OjWqJjE
-po5rR/gfWwB24nNa3w5VqW8o8AGEqTk40yQTTxNUfEI
-> ssh-ed25519 91VHug /NK1O4g1DWl6xNwHgkizeLJoFomY2zy/heEMChzrwWQ
-yc+fwswX7at6eEcAjJrcYhdGlJwHJa6ZFpbBhntVtsA
-> ssh-ed25519 XzACZQ RUMXGNZ6fpgmOVGKuspoOf5cgGUvjyzCmBipU64BikI
-XID++wcObepaGXScGD8KJwSHyX45UjrT2oRlh/VYGHs
-> ssh-ed25519 51bcvA TmB9sS4plGSx0ScZxYr2sWCo0UesyceyYPKWi+rVUy0
-yZrk2FbXpqb7XZoullu0JivQ97yTQLBiDv8BOox3evc
-> ssh-ed25519 vT7ExA n0kaB8lgH4OWR9l3hxlMT7tSjYZzNNlQLZJXnzHKf2Q
-kswoozAAVll/lFIG66Iikzu086tnzGF523fVnAGLFbw
--- Sa3qvrEI+FxIoDUmXRW4tEcNjdhWPw4U15Xy197wb6w
-8q¢9þ‹3lx~JŠ/’’üÔÎVñdœhoIL{`O!76·ØìÒºË´6Ze.¥_lÿãœ?JrÒf¯É4
+-> ssh-ed25519 qM6TYg AcP/Za8jdEONeSNcC2fm0rZg1VOMvqCreXdpd/iDKDY
+dgBlpFUcvP/n86idjIWuKsx7jX6xEWQJKY+pdGG8XVY
+-> ssh-ed25519 91VHug R4SIqnNLIoIVGIR0XnUsh3RCz+20M3pWoQGJta4y2CM
+s4O6GBECMUQpUX7yhx9CrNgedDn6yomCg8Bkke+4vu8
+-> ssh-ed25519 XzACZQ OVHPNsSR5IfrAslyKuIMAZakz+k12GUGNYsGc7e5WQ4
+IQKyRtlh7lkwIdH79IYCYod93+qAqap6rGL/VJ04Mdo
+-> ssh-ed25519 51bcvA NYivGhQwqPbjLY+Bb08ow38Rb1SBfbEotPwdDr/v7gE
+VRT0QUnImc0unH4DoEg07+PhQ0a3IsJRrJIcgDzBtjU
+-> ssh-ed25519 vT7ExA 6gW6MAGGmz7wqrE1cNgAJqhLyLBDnAkh3IFB/EJf7Us
+nhE8i7G/n/CnLTOUYsprFFjWCA+v/CmOpYRB8dAAjaE
+--- WvW+S65yf7YP+UsQH7VY1CSRqIFyNQAMBzVDCKcgk28
+²±¬wBÑ<EFBFBD>*çN¿%uz>¦Î9`?T7…LÈìÈ?)Ñ:<3A>ÅgâºÕ0é°ô7Þµ
‚LËbxµ…aÕñÞ·$‡?±ä
--- a/nix/secrets/grafana_admin_password.age
+++ b/nix/secrets/grafana_admin_password.age
--- a/nix/secrets/hugochat_db_password.age
+++ b/nix/secrets/hugochat_db_password.age
--- a/nix/secrets/immich_secrets.age
+++ b/nix/secrets/immich_secrets.age
@ -0,0 +1,5 @@
+age-encryption.org/v1
+-> ssh-ed25519 yMKb8Q wDQ9QOIpJMfsxGr63x9PozZEVfy1M0XvW9MvIjBjlSo
+eAbDN8ZB52vcC1zEXKqjWUYb+vvIJVQ+f9CZmk1Jcos
+--- ZRGd4IncBO5g0BIoezzfvCxNMAVP3cgmsF8Co06u+fc
+Ui¨,ž•¥Wÿb%dõ9º:˜dŽ¤Úq¹¦È{û
À®€Å½Lš[M<>£	,Ýd™š§8{6
--- a/nix/secrets/killua_env.age
+++ b/nix/secrets/killua_env.age
@ -1,5 +1,6 @@
 age-encryption.org/v1
-> ssh-ed25519 qM6TYg bPkp8HZ9R6dGxYgND2mPKC85fyDhuNyhlnobEZnGRmw
-xFKtdyfAEQyFQt8c0hKB5uB+YYVow4nEJkejcDBl5Ls
--- xSKVxbaHOvIFnprTjxfV1rv1L1jc/Y2PkB7TLbWam3E
-_Tîfv@Î$&kèÿc*s£L]™v"ÞF½‡¿t!Õ4Šq<C5A0>Û‰ð‚2éæ7´Ò"db8¦~0äº<C3A4>ØxyJûÎÖð¦`(nb]ÈÝr8äˆºâµ{<7B>¨å$tŸÊYÞqua€^W9¾6úöÊåóxé)û
+-> ssh-ed25519 qM6TYg 4XizqcJTul2c4nKebIgHNBlX1wfNM6ZdJIi+uD4STCI
+wLKLC8dfC1jVWNLQR2pmJM3+yvlILUkn6be+x/l1Se4
+--- kgeOkLbbLqXAK8urZUOVhqPKn4AWulo4hGbOkgr+fOU
+þþ§¨BøòáSæXN<LÃåãµ†|sÏ®à;Ã<>Évî|»¿p`9ª"ˆèh€ÂUÕiçn8¤ûÅêdêŸUÕY¬¸àèžÇ«œoPuVë¦àJg‚Ô7áH)#ÌG
+ä«Â¿îu
--- a/nix/secrets/loki_env.age
+++ b/nix/secrets/loki_env.age
--- a/nix/secrets/minio_env_file.age
+++ b/nix/secrets/minio_env_file.age
@ -1,9 +1,7 @@
 age-encryption.org/v1
-> ssh-ed25519 qM6TYg LSDtwlm9BBqnpzsXoeCQnJ7YImkiMJvqfet0MROaBFA
-h/efW4ApyMTnp/p+3tUa8RaMreI00/T5Q4Gh71lFeTk
-> ssh-ed25519 XzACZQ of8qdZPKfTtCKNMA+eHgX+WijYZHrHrzq0alH1mTJyE
-rVW21YZw3kbe1TCQj/Ch1krrJt0o6PXThAV/eUbY8B8
--- gWUT/+evFTR4ARdKZK01i8qgDCjt/EKnpKCAS5fCt1w
-é(H
¹ûAt_Ã¯
-5–oÃÎJV.DÍ€¥#lG”‹u#É‰¬K!-ÏT~"ksÒ–±oüŠÇ£¿ïþipñÝ1>
-Ãð—£«iDÜ6<0F>‰ÿyèPOia€¿<E282AC>$<24>ò/Õ]ª:dk]œA3
+-> ssh-ed25519 qM6TYg bv3MPWeJTJj/lrwKDBAv4T+OrRdD3ViwX8HLCmCKghE
+MGP87vT3Rmf+aqhMMXyZIs4OeMkS+uc+je6Zkod0hrY
+-> ssh-ed25519 XzACZQ cUkJyWCO6HkdxCqSnv9onmEUhEQY+Pj4seR/lH8KSAg
+qTUgF/iT2IoJf7UOleaayWbkJbn5dgSVHKctKWnqfIw
+--- BOvXie+k6OIewLDVF+Rx2YzkpytshqkFGCL/uYgljNQ
+…}ËpˆŽSS  íy*Sp*>ŸÝ–Å
¹uí¯:0bŸŽ:=)t…¶ÍS\HNœbòµ9_m‰ØÙ<C398>‘jµÚ{<7B>‹)˜º(<»3&Ó˜`ÑR<>	õ¸[«{aÜ“Øô!Àòó
--- a/nix/secrets/openolat_db_password.age
+++ b/nix/secrets/openolat_db_password.age
@ -1,5 +1,7 @@
 age-encryption.org/v1
-> ssh-ed25519 qM6TYg ONh+83MLxToMgANja31F4qVxE47NVjXat06RLj4qG0E
-9vRKxWSdW2Bvc/KsWqbbi5mGhLekViT87WhGnPf5ZUM
--- m/MMUEWaa8RewCOG6fOBQpu8M+pgFMWUs67NQcnI4c8
-J¬±ÂÜ%Ï»ÙîlNÔB¸×™šÅ#¸^Ã@äƒfT¬¨Àrâxt=‹…If&§óIæC‰ÀÀ¥Ž¶l@Ññ–œ´Š	Ò/å¢ïD8c¶‚{MäRÉÂÔ3…9æ“»—÷<E28094>Õ¶3ñ`·Ÿõ;¯…å$höøõãýÛÚ¾ö÷Ã™ãœ>ÚsOœŸí•…!<21>¯U}
+-> ssh-ed25519 qM6TYg 7Nt/x/IT9ofXjrRRV7coT6nrrCSOCkqUqflm1oXLXTk
+BafDaEiVpuT3SDVXvuD31WIKe0QlvAGoyn4MzUm9LfQ
+--- BsY9/meRTzX5oCBD+w9f+2TO/TdPD936xOjgtQMWuag
+RN|å-ò
+–[¯6Š‡ùq
+rú7ìˆÎd% è¥¡¬[3K`‹I{Š!™u5™¨‹èÆƒnÇè<C387>ÓºMvo÷dÿò§z A…Ì~á‹åâ“ûò<18>ó–Ç<E28093>Tƒ	QñåóG¸h?N¯“w/YBëQn•_ñ`¦ÜÕÃÍ_‘€,¿ýZ‰€ƒšF”VÆ8yw‹
--- a/nix/secrets/pyroscope_s3_secret.age
+++ b/nix/secrets/pyroscope_s3_secret.age
@ -1,5 +1,5 @@
 age-encryption.org/v1
-> ssh-ed25519 XzACZQ m7q/k7PLJpNDFEFxm1SNobF2abWhncqxWri+CbVqkCc
-3NB/uTmOdkPH3N+kZrSep7u0A57KpQzI4tlzyT6Z5rg
--- cI9WvpISFVi7fXb5pcNgyu3rH+4L8o5dZUnAxhQ1x4Y
-W‚¡j; lx»Ï8ðýmÂŠÌqþßß®ˆô´Xˆ+‚µMJSzÕ¡Ë4Íã`à=´8<>ÿ$9`Ò}µwÿ~âÚ‰×©a“6øtÛ«ÓJtu"|p`T“b³("ájÃ:˜<>I<EFBFBD>5P’ärSúd3é%ùÍØ[„ äÍÕok´!gõÜc\¾™6s©„® ©dõ5ã†é2%jµ
+-> ssh-ed25519 XzACZQ ver7uyV552D1F9hTxFYb61szNWPeIxsTr4M6RWZH1DY
+BF2bL0xu6rAx21EQkGF8KNc/4+jqo/0E6O89vZ8WhfQ
+--- b3peeNoZ70tv7mAtQokJ8IUgE6nTGPvUkSf8p6jika8
+庭<E<>ﾋ7L{Wﾟ<57>鵡燐aｫ躇	ﾏ<>ｶﾖLﾋ<4C>｡[Чdﾛ-!0ﾊﾁﾆ4U<34>?无C酵ｾ營1l
ｫｽeﾄﾂ1<EFBE82>!_I単ｺｾ2Ce剋ﾘ1滉Wｮz寇<7A>VR}ﾚkA<18>從ﾍﾕ腓ｧﾍb<EFBE8D>)%ﾌｪｶｩｺR跨wｿ<77>AﾗﾖwA6ﾜ6Zｩｺ畳kql葹gz=ﾖK<EFBE96><4B>
--- a/nix/secrets/registry_htpasswd.age
+++ b/nix/secrets/registry_htpasswd.age
--- a/nix/secrets/registry_s3_key_secret.age
+++ b/nix/secrets/registry_s3_key_secret.age
@ -1,5 +1,6 @@
 age-encryption.org/v1
-> ssh-ed25519 qM6TYg zUespYByALhutVeTKDYRCXpskuwotOzfTjWCVtGcXTg
-LxTqOV8sk6zOQv1eAIvSfUoeCfpus5lB4VwQV7joMks
--- bCKKLMK0Alw89Sh6HB4EW76P29aNUC5btlNFHDBTsQk
-¦å4m†ŠXA/‰µu ØÒU’Ÿ´”ÁÑ}Öhöz¾Ç<¯5f2ž<¶Ý¾jÊãµYO=FW÷IW%ú%8f~`Žü vl€@:1Ä¾µçÛk¨Ywa“ÊL:\³öùê:ýGãš¢»HÇÙr¯ðkbÊEbt/N}v-x‚ÜÅMë©Xñ£ãÄËÜ¿òt°GûRpt°ÇÇ.°hòbÔ“8›š´íx5L†ÜF"qaG<xðr
+-> ssh-ed25519 qM6TYg /73Z7R1RE4lfUfVSeJqZjbGA5yjygfrxKi5iuMMxrno
+tsbPaW/x9HFT/tG+5F3n/3SsuhmswVIfHVLNRAzdiP0
+--- jHapfTz6oq7gdrgBn+XNQdMZ67DbrFPBY6KKzb+wfjE
+œÅÇU1ör(RßMN8<14>ÑOlè$ùüÔDN¦u±ÿ³·ØÆðŒ´¿3ê¨Jo<4A>în‚ÜBOc%ÿATµ~RV##–[‡‘íù;3*½¶±Þ6˜/Ð5gD€]ƒö˜2À¿žñÿŽÿñ¢%Õfü)fxv“
+¼›]Ìé¥höî<C3B6>†…:ßd¥{_O½~Ñ2Œ‘t¤iŒz28¡Ï ÒW>ÐêBT(aõ%<25>—ŠŒ•™¢Í‰l`é³\õ
--- a/nix/secrets/restic_backup.age
+++ b/nix/secrets/restic_backup.age
--- a/nix/secrets/s3_mc_admin_client.age
+++ b/nix/secrets/s3_mc_admin_client.age
--- a/nix/secrets/secrets.nix
+++ b/nix/secrets/secrets.nix
@ -6,6 +6,7 @@ let
  vps3 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHvupo7d9YMZw56qhjB+tZPijxiG1dKChLpkOWZN0Y7C";
  vps4 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMpoLgBTWj1BcNxXVdM26jDBZl+BCtUTj20Wv4sZdCHz";
  vps5 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBWbIznvWQSqRF1E9Gv9y7JXMy3LZxMAWj6K0Nq91kyZ";
+  minipc = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINApZRrvK4RC1SU5m4OLbill7HZYPQtuvh/m/AB4q5dG";
 in
 {
  "widetom_bot_token.age".publicKeys = [ vps1 ];
@ -30,6 +31,7 @@ in
  "generic_backup_password.age".publicKeys = [ vps1 vps2 vps3 vps4 vps5 ];
  "website_s3_key_write.age".publicKeys = [ vps1 ]; # only used by Noratrieb/website GHA
  "does_it_build_private_key.age".publicKeys = [ vps4 ];
+  "immich_secrets.age".publicKeys = [ minipc ];
  "wg_private_dns1.age".publicKeys = [ dns1 ];
  "wg_private_dns2.age".publicKeys = [ dns2 ];
  "wg_private_vps1.age".publicKeys = [ vps1 ];
@ -37,4 +39,5 @@ in
  "wg_private_vps3.age".publicKeys = [ vps3 ];
  "wg_private_vps4.age".publicKeys = [ vps4 ];
  "wg_private_vps5.age".publicKeys = [ vps5 ];
+  "wg_private_minipc.age".publicKeys = [ minipc ];
 }
--- a/nix/secrets/upload_files_s3_secret.age
+++ b/nix/secrets/upload_files_s3_secret.age
--- a/nix/secrets/website_s3_key_write.age
+++ b/nix/secrets/website_s3_key_write.age
--- a/nix/secrets/wg_private_dns1.age
+++ b/nix/secrets/wg_private_dns1.age
@ -1,5 +1,5 @@
 age-encryption.org/v1
-> ssh-ed25519 LZU5Eg T16scfWokKj/4TaHvplWuIdHCs/oR4t3V9x4hFo9yhU
-h8RoAXndXCwUBskJlJTLWoXapWMUTF0yPnqUV9u7qt8
--- qGJTnOXdnz8D9eA8AKtYarVa1l75x10SqjhsKchfQ+E
-a›Ò¿ú/Žõã}Ã=7_ç¢r^<5E>rÔ•?‰yÖÈ×"oõØ˜;U`*Ö¢’(”„Z®†·tz7ñ¢·úÍÅãs“Üôï¼Œî¨»$^k`
+-> ssh-ed25519 LZU5Eg 3Bde2BfrG8qdngKCIg4xeXnkqqdrtcAZfW0REYwkmWc
+0Js204/ZpkBK9mDZwhYOY1IGW8yA5L/iMAmrZR1r940
+--- V7Xj3KkcueKzPhl6wjk12zRrEmFPMpUcQd799p0Dqr4
+Ö~”TO80}	ó‰¥ÕQ.<2E><0B>…{°„q6ÑÚQuˆù×†ú%NÒ6¢ÐŒÁaÛ|”—41Ö€åZòÕ€Ò;DözÏ*»^©ÉôÑ»
--- a/nix/secrets/wg_private_dns2.age
+++ b/nix/secrets/wg_private_dns2.age
@ -1,5 +1,6 @@
 age-encryption.org/v1
-> ssh-ed25519 5bWSnQ eiSLsSWrjQldff9ZbhjhrvGgNGWxmxKu1JfsWmjo0Qg
-cCLcVTC9hzN79cOMOuuOMo5VpwlBKraqxqeQuvVzqqU
--- bgLRe7t+KD2ehc2gAp4RERJ3nN5pGLA04L06KHVeQvw
-¥nsª4¼!nt3…Ü»ú:#ši›”?š ÆJ¡Ê·	¨Ó'1d!Öö¡? $/Œ{u…XÙÒÓ6e¯rL.æÍ]„Çî[
+-> ssh-ed25519 5bWSnQ V/5bLxQqdZEF9tgSPGgm7nEpnyNGScgSVfjS3KOvxA0
+oKHKz5IIZNdsWhBCTCqvHVLAJGC+LEC7RuMgQHI9Wkk
+--- 71jtq96kfCYsB8UGSccc2F6qWtj7DO658MeVWSD+L64
+UÂ”XĄd2ŮC<C5AE>¬lEV~FgŮđiíďčöpŢă%áN6ů
+ŮÖt%Í˘Ĺ»{LZş@˛ÂB9$ŕ{Żg&PŮBHQ¸Ű<C2B8>%4
--- a/nix/secrets/wg_private_minipc.age
+++ b/nix/secrets/wg_private_minipc.age
@ -0,0 +1,5 @@
+age-encryption.org/v1
+-> ssh-ed25519 yMKb8Q o1qLnZBL+o8wrQYM6bo01DsCKVmA/NCzLe84aO4NSlI
+iEnVZGcr4wyMN5b5f9Qzt1lmycZVe+km/8ApNvq6ME4
+--- MiV3GRLz1rEy283zGsbTtrAbQgmdW0pobJE83BmPrmU
+<EFBFBD>¶ƒéƒG^÷ì%L˜ûj,´¶sC€ÖIC&@Ö>#¢t<C2A2>$.2ÏÿRñ+p.‹µ4ðù
¡•ªkÃeüÍÇ^+”sCg–õn-šz©{
--- a/nix/secrets/wg_private_vps1.age
+++ b/nix/secrets/wg_private_vps1.age
--- a/nix/secrets/wg_private_vps2.age
+++ b/nix/secrets/wg_private_vps2.age
--- a/nix/secrets/wg_private_vps3.age
+++ b/nix/secrets/wg_private_vps3.age
@ -1,5 +1,6 @@
 age-encryption.org/v1
-> ssh-ed25519 XzACZQ EsFwUOjtcoWVd5gJxu0vAfcXxGZovBBKcGuin+TE6kY
-51vzn9SvfX8WCDe8f5dtblAhFykUIxLkvsNK6XjMSuQ
--- VTYLeqYga9RKPLxjB6JotAMC4StSGh9PNNnG3+kq6vs
-…]#A š›*R1*´{TM¸ÉÚ<C389>Ãq2~pGJ<03>ÃÙù#¹ƒRÕW•ârWàõCð
µÒ·¤ê‰#ƒÇÅàü	¨3^Í—ƒ
+-> ssh-ed25519 XzACZQ JO+9ZDfv/rjpGHSL8WBm286V164a2CwppavSZ4+L+Ws
+hqfAaluHnH5XHzI/oc71q7HlKioHMAbKP9cg9wRJ6kw
+--- maAUQCFkFuMs55Yr6wX+2q+VUM/c3h8rNb6u+VrJnEM
+)<>ïWþFþºäj³
+ö„}ÃÇ,ÂØÁê·ÛE\G¤Óá–Ý&xï÷@¯,·ˆ[r+<ÿ—v·ð²wº¤Ÿ,Ält¥F±tº.³O¹j
--- a/nix/secrets/wg_private_vps4.age
+++ b/nix/secrets/wg_private_vps4.age
@ -1,6 +1,5 @@
 age-encryption.org/v1
-> ssh-ed25519 51bcvA 14yVvUnmbYRhz0jbTEsj5bEZnJleq6ZT3NgOqVybzFk
-F0cCQQhghlR3rHDEiBwIWdBXv6Cfac+JL9MArEXOHuY
--- bB7RaiP/rNyTpjpoa2qXmZw7RCa73b2FEy2WN+CTpfk
-M<EFBFBD>):<3A>8&<26>=$<24>8.<2E><>U<EFBFBD><55><1E><>7<1F>~<7E><>j<EFBFBD><6A>]<5D><>QHC$^"˿<><CBBF>
-W<EFBFBD>C<EFBFBD>Z#<23><18>u<EFBFBD>A<EFBFBD><41>!d<><64>Xpx"<22>1<EFBFBD>c
+-> ssh-ed25519 51bcvA CkaPksfSDKWRMaL4FV7vI4VZ2c8Fd2RlyRW8DEkOkgM
+NrvBSSPDrwNL+YKgBTHqQuLhKgGy1+/H51JTsA70Dww
+--- 6qkEageKcIweJ7wWcqb2HZp9zJNTyLcoQ+Gv/+O6CJA
+(¦©,¸Ê<08><>›zfßðD8¸Ÿ)Šü]¥Î|P+Úáaƒƒ‰
ñ{n·•ƒ$ ¸Añ<41>x"Ã‚•ù¢]ç¶¤©è…Kî‹æÕð
--- a/nix/secrets/wg_private_vps5.age
+++ b/nix/secrets/wg_private_vps5.age
--- a/nix/secrets/widetom_bot_token.age
+++ b/nix/secrets/widetom_bot_token.age
--- a/nix/secrets/widetom_config_toml.age
+++ b/nix/secrets/widetom_config_toml.age