From 9dd5ae6698f0181b3ac5836f525d31a627ca489a Mon Sep 17 00:00:00 2001 From: Noratrieb <48135649+Noratrieb@users.noreply.github.com> Date: Thu, 28 May 2026 14:57:18 +0200 Subject: [PATCH 1/3] minipc --- minipc-config/configuration.nix | 122 ++++++++++++++++++ nix/hive.nix | 25 +++- nix/modules/default/default.nix | 11 +- nix/modules/immich/default.nix | 29 +++++ nix/modules/minipc/default.nix | 8 ++ nix/modules/minipc/hardware-configuration.nix | 42 ++++++ nix/modules/nas-mount/default.nix | 6 + nix/modules/postgres/default.nix | 6 + nix/modules/tailscale/default.nix | 13 ++ nix/modules/wg-mesh/default.nix | 4 +- nix/secrets/backup_s3_secret.age | 25 ++-- nix/secrets/caddy_s3_key_secret.age | Bin 904 -> 904 bytes nix/secrets/docker_registry_password.age | 10 +- nix/secrets/does_it_build_private_key.age | Bin 1916 -> 1916 bytes nix/secrets/forgejo_s3_key_secret.age | 9 +- nix/secrets/garage_secrets.age | Bin 819 -> 819 bytes nix/secrets/generic_backup_password.age | 24 ++-- nix/secrets/grafana_admin_password.age | Bin 282 -> 282 bytes nix/secrets/hugochat_db_password.age | Bin 339 -> 339 bytes nix/secrets/immich_secrets.age | 5 + nix/secrets/killua_env.age | 9 +- nix/secrets/loki_env.age | Bin 326 -> 326 bytes nix/secrets/minio_env_file.age | 14 +- nix/secrets/openolat_db_password.age | 10 +- nix/secrets/pyroscope_s3_secret.age | 8 +- nix/secrets/registry_htpasswd.age | Bin 278 -> 278 bytes nix/secrets/registry_s3_key_secret.age | 9 +- nix/secrets/restic_backup.age | Bin 784 -> 784 bytes nix/secrets/s3_mc_admin_client.age | Bin 912 -> 912 bytes nix/secrets/secrets.nix | 3 + nix/secrets/upload_files_s3_secret.age | Bin 474 -> 474 bytes nix/secrets/website_s3_key_write.age | Bin 344 -> 344 bytes nix/secrets/wg_private_dns1.age | 8 +- nix/secrets/wg_private_dns2.age | 9 +- nix/secrets/wg_private_minipc.age | 5 + nix/secrets/wg_private_vps1.age | Bin 257 -> 257 bytes nix/secrets/wg_private_vps2.age | Bin 257 -> 257 bytes nix/secrets/wg_private_vps3.age | 9 +- nix/secrets/wg_private_vps4.age | 9 +- nix/secrets/wg_private_vps5.age | Bin 256 -> 256 bytes nix/secrets/widetom_bot_token.age | Bin 272 -> 272 bytes nix/secrets/widetom_config_toml.age | Bin 4006 -> 4006 bytes secrets-git-crypt/immich_secrets | Bin 0 -> 51 bytes secrets-git-crypt/wg_private_minipc | Bin 0 -> 66 bytes 44 files changed, 353 insertions(+), 79 deletions(-) create mode 100644 minipc-config/configuration.nix create mode 100644 nix/modules/immich/default.nix create mode 100644 nix/modules/minipc/default.nix create mode 100644 nix/modules/minipc/hardware-configuration.nix create mode 100644 nix/modules/nas-mount/default.nix create mode 100644 nix/modules/postgres/default.nix create mode 100644 nix/modules/tailscale/default.nix create mode 100644 nix/secrets/immich_secrets.age create mode 100644 nix/secrets/wg_private_minipc.age create mode 100644 secrets-git-crypt/immich_secrets create mode 100644 secrets-git-crypt/wg_private_minipc diff --git a/minipc-config/configuration.nix b/minipc-config/configuration.nix new file mode 100644 index 0000000..442b500 --- /dev/null +++ b/minipc-config/configuration.nix @@ -0,0 +1,122 @@ +# Edit this configuration file to define what should be installed on +# your system. Help is available in the configuration.nix(5) man page +# and in the NixOS manual (accessible by running ‘nixos-help’). + +{ config, pkgs, ... }: { + services.openssh.enable = true; + programs.vim.enable = true; + + imports = + [ # Include the results of the hardware scan. + ./hardware-configuration.nix + ]; + + # Bootloader. + boot.loader.systemd-boot.enable = true; + boot.loader.efi.canTouchEfiVariables = true; + + networking.hostName = "minipc"; # Define your hostname. + # networking.wireless.enable = true; # Enables wireless support via wpa_supplicant. + + # Configure network proxy if necessary + # networking.proxy.default = "http://user:password@proxy:port/"; + # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain"; + + # Enable networking + networking.networkmanager.enable = true; + + # Set your time zone. + time.timeZone = "Europe/Zurich"; + + # Select internationalisation properties. + i18n.defaultLocale = "en_US.UTF-8"; + + # Enable the X11 windowing system. + services.xserver.enable = true; + + # Enable the GNOME Desktop Environment. + services.xserver.displayManager.gdm.enable = true; + services.xserver.desktopManager.gnome.enable = true; + + # Configure keymap in X11 + services.xserver.xkb = { + layout = "ch"; + variant = ""; + }; + + # Configure console keymap + console.keyMap = "sg"; + + # Enable CUPS to print documents. + services.printing.enable = true; + + # Enable sound with pipewire. + services.pulseaudio.enable = false; + security.rtkit.enable = true; + services.pipewire = { + enable = true; + alsa.enable = true; + alsa.support32Bit = true; + pulse.enable = true; + # If you want to use JACK applications, uncomment this + #jack.enable = true; + + # use the example session manager (no others are packaged yet so this is enabled by default, + # no need to redefine it in your config for now) + #media-session.enable = true; + }; + + # Enable touchpad support (enabled default in most desktopManager). + # services.xserver.libinput.enable = true; + + # Define a user account. Don't forget to set a password with ‘passwd’. + users.users.nora = { + isNormalUser = true; + description = "nora"; + extraGroups = [ "networkmanager" "wheel" ]; + packages = with pkgs; [ + # thunderbird + ]; + }; + + # Install firefox. + programs.firefox.enable = true; + + # Allow unfree packages + nixpkgs.config.allowUnfree = true; + + # List packages installed in system profile. To search, run: + # $ nix search wget + environment.systemPackages = with pkgs; [ + # vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default. + # wget + ]; + + # Some programs need SUID wrappers, can be configured further or are + # started in user sessions. + # programs.mtr.enable = true; + # programs.gnupg.agent = { + # enable = true; + # enableSSHSupport = true; + # }; + + # List services that you want to enable: + + # Enable the OpenSSH daemon. + # services.openssh.enable = true; + + # Open ports in the firewall. + # networking.firewall.allowedTCPPorts = [ ... ]; + # networking.firewall.allowedUDPPorts = [ ... ]; + # Or disable the firewall altogether. + # networking.firewall.enable = false; + + # This value determines the NixOS release from which the default + # settings for stateful data, like file locations and database versions + # on your system were taken. It‘s perfectly fine and recommended to leave + # this value at the release version of the first install of this system. + # Before changing this value read the documentation for this option + # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html). + system.stateVersion = "25.05"; # Did you read the comment? + +} diff --git a/nix/hive.nix b/nix/hive.nix index 3406272..92d7186 100644 --- a/nix/hive.nix +++ b/nix/hive.nix @@ -66,7 +66,7 @@ wg = { privateIP = "10.0.0.3"; publicKey = "pdUxG1vhmYraKzIIEFxTRAMhGwGztBL/Ly5icJUV3g0="; - peers = [ "vps1" "vps2" "vps4" "vps5" "dns1" "dns2" ]; + peers = [ "vps1" "vps2" "vps4" "vps5" "dns1" "dns2" "minipc" ]; }; tags = [ "apps" ]; }; @@ -92,6 +92,17 @@ }; tags = [ "apps" ]; }; + minipc = { + publicIPv4 = null; + publicIPv6 = null; + wg = { + privateIP = "10.0.2.1"; + publicKey = "ecYfTot7RrJyNebSZTQ1wciOhvrpNSSbkR15twpSSl4="; + peers = [ "vps3" ]; + noEndpoint = true; + }; + tags = [ "home" ]; + }; }; }; @@ -300,4 +311,16 @@ system.stateVersion = "23.11"; }; + minipc = { name, nodes, modulesPath, config, pkgs, lib, ... }: { + imports = [ + ./modules/minipc + ./modules/wg-mesh + ./modules/nas-mount + ./modules/postgres + ./modules/immich + ./modules/tailscale + ]; + + system.stateVersion = "25.05"; + }; } diff --git a/nix/modules/default/default.nix b/nix/modules/default/default.nix index 260523c..e3b668a 100644 --- a/nix/modules/default/default.nix +++ b/nix/modules/default/default.nix @@ -2,9 +2,12 @@ let pretense = import (pkgs.fetchFromGitHub my-projects-versions.pretense.fetchFromGitHub); quotdd = import (pkgs.fetchFromGitHub my-projects-versions.quotdd.fetchFromGitHub); + networkConfig = networkingConfig."${name}"; in { - deployment.targetHost = "${name}.infra.noratrieb.dev"; + deployment.targetHost = + if networkConfig.publicIPv4 == null + then name else "${name}.infra.noratrieb.dev"; # TODO: ensure that the rust programs have frame pointers @@ -20,6 +23,8 @@ in nixPath = [ "nixpkgs=${nixpkgs-path}" ]; }; + nixpkgs.config.allowUnfree = true; + environment.systemPackages = with pkgs; [ vim wget @@ -27,10 +32,14 @@ in traceroute dnsutils nftables + htop ]; networking.hostName = name; + # Swiss german console tty keyboard layout + console.keyMap = "sg"; + time.timeZone = "Europe/Zurich"; users.users.root.openssh.authorizedKeys.keys = [ ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG0n1ikUG9rYqobh7WpAyXrqZqxQoQ2zNJrFPj12gTpP nilsh@PC-Nils'' ]; diff --git a/nix/modules/immich/default.nix b/nix/modules/immich/default.nix new file mode 100644 index 0000000..a681d93 --- /dev/null +++ b/nix/modules/immich/default.nix @@ -0,0 +1,29 @@ +{ config, pkgs, ... }: { + age.secrets.immich_secrets.file = ../../secrets/immich_secrets.age; + + services.immich = { + enable = true; + mediaLocation = "/mnt/nas/HEY/_Nora/immich"; + secretsFile = config.age.secrets.immich_secrets.path; + host = "0.0.0.0"; + database = { + enableVectors = false; + enableVectorChord = true; + }; + openFirewall = true; + }; + + services.postgresql = { + ensureDatabases = [ "immich" ]; + ensureUsers = [ + { + name = "immich"; + ensureDBOwnership = true; + } + ]; + authentication = pkgs.lib.mkForce '' + #type database DBuser auth-method + local all all peer + ''; + }; +} diff --git a/nix/modules/minipc/default.nix b/nix/modules/minipc/default.nix new file mode 100644 index 0000000..39adc61 --- /dev/null +++ b/nix/modules/minipc/default.nix @@ -0,0 +1,8 @@ +{ ... }: { + imports = [ ./hardware-configuration.nix ]; + + networking.networkmanager.enable = true; + + boot.loader.systemd-boot.enable = true; + boot.loader.efi.canTouchEfiVariables = true; +} diff --git a/nix/modules/minipc/hardware-configuration.nix b/nix/modules/minipc/hardware-configuration.nix new file mode 100644 index 0000000..b8476f3 --- /dev/null +++ b/nix/modules/minipc/hardware-configuration.nix @@ -0,0 +1,42 @@ +# Do not modify this file! It was generated by ‘nixos-generate-config’ +# and may be overwritten by future invocations. Please make changes +# to /etc/nixos/configuration.nix instead. +{ config, lib, pkgs, modulesPath, ... }: + +{ + imports = + [ + (modulesPath + "/installer/scan/not-detected.nix") + ]; + + boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usbhid" "usb_storage" "sd_mod" ]; + boot.initrd.kernelModules = [ ]; + boot.kernelModules = [ "kvm-intel" ]; + boot.extraModulePackages = [ ]; + + fileSystems."/" = + { + device = "/dev/disk/by-uuid/9327fdbf-f6d2-41ae-b69f-6dbb97ab388a"; + fsType = "ext4"; + }; + + fileSystems."/boot" = + { + device = "/dev/disk/by-uuid/2A59-D3C9"; + fsType = "vfat"; + options = [ "fmask=0077" "dmask=0077" ]; + }; + + swapDevices = + [{ device = "/dev/disk/by-uuid/db30dd66-fa2a-46a4-b81a-b0fc935db5ac"; }]; + + # Enables DHCP on each ethernet and wireless interface. In case of scripted networking + # (the default) this is the recommended approach. When using systemd-networkd it's + # still possible to use this option, but it's recommended to use it in conjunction + # with explicit per-interface declarations with `networking.interfaces..useDHCP`. + networking.useDHCP = lib.mkDefault true; + # networking.interfaces.enp2s0.useDHCP = lib.mkDefault true; + + nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; + hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; +} diff --git a/nix/modules/nas-mount/default.nix b/nix/modules/nas-mount/default.nix new file mode 100644 index 0000000..0379576 --- /dev/null +++ b/nix/modules/nas-mount/default.nix @@ -0,0 +1,6 @@ +{ ... }: { + fileSystems."/mnt/nas" = { + device = "nas:/volume1/homes"; + fsType = "nfs"; + }; +} diff --git a/nix/modules/postgres/default.nix b/nix/modules/postgres/default.nix new file mode 100644 index 0000000..79f0e6a --- /dev/null +++ b/nix/modules/postgres/default.nix @@ -0,0 +1,6 @@ +{ pkgs, ... }: { + config.services.postgresql = { + enable = true; + package = pkgs.postgresql_18; + }; +} diff --git a/nix/modules/tailscale/default.nix b/nix/modules/tailscale/default.nix new file mode 100644 index 0000000..9756f48 --- /dev/null +++ b/nix/modules/tailscale/default.nix @@ -0,0 +1,13 @@ +{ ... }: { + networking.nftables.enable = true; + + services.tailscale = { + enable = true; + extraUpFlags = [ "--advertise-exit-node" ]; + useRoutingFeatures = "server"; + }; + + systemd.services.tailscaled.serviceConfig.Environment = [ + "TS_DEBUG_FIREWALL_MODE=nftables" + ]; +} diff --git a/nix/modules/wg-mesh/default.nix b/nix/modules/wg-mesh/default.nix index abb904a..636dc13 100644 --- a/nix/modules/wg-mesh/default.nix +++ b/nix/modules/wg-mesh/default.nix @@ -35,7 +35,9 @@ in let peerConfig = (builtins.getAttr peer networkingConfig).wg; in { inherit (peerConfig) publicKey; - endpoint = "${peer}.infra.noratrieb.dev:${toString listenPort}"; + endpoint = + if !(builtins.hasAttr "noEndpoint" peerConfig) || !peerConfig.noEndpoint + then "${peer}.infra.noratrieb.dev:${toString listenPort}" else null; allowedIPs = [ "${peerConfig.privateIP}/32" ]; # sometimes there's some weirdness....?? persistentKeepalive = 25; diff --git a/nix/secrets/backup_s3_secret.age b/nix/secrets/backup_s3_secret.age index 1aba70f..72aa71e 100644 --- a/nix/secrets/backup_s3_secret.age +++ b/nix/secrets/backup_s3_secret.age @@ -1,13 +1,14 @@ age-encryption.org/v1 --> ssh-ed25519 qM6TYg Iwzv4FA1pIES6SynmQejkarTCRc3xwqJhbPK+U197BI -0F6drTGs14E6tf0/eDcWu2y9b9yYLXjkAkHV0hT01MQ --> ssh-ed25519 91VHug NhInO02XlDKVDYeEk+Y4jmaAG03YO1yy50R9vnUGPWU -0lgqjusLVxCLIQA8BSQveTNKEQf7uyEctRX+TDqipj4 --> ssh-ed25519 XzACZQ vtBUTFyr4gjqcUsn3WCYOPspjnVwL19izhKYGX4kiy4 -bW6zwWar6COr58s/U6GJZsOPicAECUJr2VQZ0nOneF0 --> ssh-ed25519 51bcvA itN8U0WXocUWmsO7Hy3a94j+aUyH83BN4iG9RK/9lCk -Eyuawwp7+bv9/f2UOihOqFLcETsFgPS+iJRrLID6jT0 --> ssh-ed25519 vT7ExA tJoU7e9muJvOLU1a50SI7+KgbHYke/vaMn77u9gAyTw -p0Ofeh74R/UTpaBRDITNjwwXkUs/grBnsHiSvzUxCKU ---- EsDITASaNlbxImI3s/hCMpOM6Up4UrZgez1fTJlRT1M -:,ߐ n.|*#Ca%Iw$` ssh-ed25519 qM6TYg vf1l0o7K8ZIZGEBx2x7EzWKG7UKFQtuOhBqj/Nyq6xU +8b0863lHC83pZZ/dIkKS3f7L+PE0I+m0f2zqtef4tuU +-> ssh-ed25519 91VHug r5WkIt9V+TM/zupGjYH7FrIz2ZSctKh0cWixaaL8vH8 +c0J8wy8gRmgoA5vEA3AeXa8orH2amWdIgxJJDaBSjTQ +-> ssh-ed25519 XzACZQ Z6z3pornKWMM08RxpWV4YjWs8qKF9xn8lNS6S3SpFSI +1O4YNGfKjiY/BJDKwm1J3ZOhpPrMAiTdUHfZ305mSco +-> ssh-ed25519 51bcvA cxBUjrD7stWdK400O/2HJM3YcKGjDGpWZt4Yq1sVdVg +mw2xRTGFWiWI959J8GOCTp/kiV85+k2/+bYJpw95/ew +-> ssh-ed25519 vT7ExA 8bQ4LWtqj2AodnJHcV8lEk+3EcZBfWHUVHQKcG4nCwI +dIfddL4LTMun+EQQuPdLJNkGVysvTPm2059vQUUnEGk +--- VIlkl9DdBWVgTiJvBK3jgdpsLgGkvv/dFfbZLEYMmT0 + GE=0bʮP*&^V)?0,vpaȧ}p笆Yǭ[;̞@[o g$xܶ9g +{Y}_!([RV U'qC%SZwTC=5aIJxF)J \ No newline at end of file diff --git a/nix/secrets/caddy_s3_key_secret.age b/nix/secrets/caddy_s3_key_secret.age index e3d4cf9073b472dd4e0da5bae69081e7a695f546..d734f8e50e294220306da65e608c68da766d6337 100644 GIT binary patch delta 816 zcmeBR?_i&xQy(6b>!_dSom1(ZobBQizU`6VQLW+UJ&Z*9FXN~ z!sQ=fqHR=?>S|`5VV)UT?4MF<=$;nnT&bU3;9g;B;h7n1n66*uR^{dB%cX0lP+Xj$ zo0?)|YHDbyU}+fUQJSvc>Ft|S98~P>R*`6&;%Sj%>6U3|kXYuTUv5@pk(*IfT$Soy z;%MQNoty2-rJrb-8xWrC8|r74<>(h>sh?!7pC4Er8eEc55S-;ykXlmdUzDv~;pLe< z@uPTnR76@*xqGHDa(m!(GBtBE2g@ zBg36N1HvqgA_AN(Li~KWbaizV$|_QPB8@7Na|2Ry%|im+3Jcvm%*x9gQ%$_9j7%zh z9U~&@%_4Kcd@_Qvx!Clja&$LjrvLsu+jmB#6R(7v@acM{MWrSNiC;yyJkDNY+$Ng+ zKuh}1v72^kXSdvZExhTYe;l`|pZz!6s+Q`xijN~$Z+x8izwn#f_R0#^yl9=BR&p~! z{r#@b;5;7ns73M^%hh>nnDm!q+w8x7*JHBSPlh$}y!Gqlrkq-5F8!qONs-u&h-3}! z_=5#&CRvL#GvqFCjPH(UT&hysz17Oyd(YM{M{h^996e{qxA*0hnuSZJ9lZEk@Y`8t`6T1lJyWgJw_RE9dUj@-n&?;0gKCD1b8fEt z@?P-B5seP@Gg^N$)mIsaFBY5dFw@+WP5S5C->F{<-n9H(CHBLwb>7PVj*nJKUH)jF HC*}tL*CaJ^ delta 816 zcmeBR?_i&xQy*27=^W-^?wM!q65(i?9^qx|U!Iv&*XIQH3>sXNOtDhMW8t#$fV;E6ZmFrsN;pGrAbq#I zRO4iy5W_H!qO{`Vz$nMWlqwVNlHfpN;~ewEz>37OT!T=qZ2e^K%97$jeaHOLtPGPt z1B>$Tg0jG<3XBoxoOWkuLTwED-t~&xo&*4h~GbLs@+a*<4xT!y}b6C83z3~h;#aoQ!ur){oxV=!986K zGA9bcYtOve)?4ZrmG)oc!>>NO-J9cP*M81eRrJt<|3UZ~SH<67r_4GkUFR(?rMyBg zNIfWZMf3~5;K>g}XROn{ GED->rZ8+Zm diff --git a/nix/secrets/docker_registry_password.age b/nix/secrets/docker_registry_password.age index 602f634..f97c5fb 100644 --- a/nix/secrets/docker_registry_password.age +++ b/nix/secrets/docker_registry_password.age @@ -1,7 +1,5 @@ age-encryption.org/v1 --> ssh-ed25519 qM6TYg 8d5Jze4wRBsRqy+/ifnIMf5IhQZrn2Hs0k4/RCJoAko -IUgnzcCHmQhsrJfUuOG5s7nl98/X+ycpr0JWQeqc1Ps ---- dNJXPA7jEVJs5yQmvcaidVnJoN5pRMbh6okQsjjDabc -f ssh-ed25519 qM6TYg I4FIet5K6KGjWaCvKbhK7UV4LFJthRpRVDO/FoARzxw +F/KQtQI78KlLe1jT84oxdg4UG8QuG8xAVAutzVM+kJw +--- TEgDiZeZQL2K8Nq/xqUKrkPKSXyO5NgRbx8SkfGl62o +(Lנ* 2ڃjED* ȹ^䥶IJsy:7 oRe \ No newline at end of file diff --git a/nix/secrets/does_it_build_private_key.age b/nix/secrets/does_it_build_private_key.age index bf6bc35db49d1c643d0182a4fe52e8e1afccdab3..babd21b4e73aa04a131cc0c9c9fbf6ca05f86ccb 100644 GIT binary patch delta 1893 zcmeyv_lIwSPQ9T)kz=rSxpuN|X<($AYk*f)Nm8guaHU(ZkGogCOK@PWzoA>9r;(e1 zD_6LeNpMt>d3v^qWrT5dWR!18YDq~_a!GiEZ*ECtMShrtnOljWu~W8RAeXMLu7bOV zdy=-JnRmXkslHcIm3OdlVraIBxszj9esZRPV`*wsR((lfQks8pW-?dg)f^RrqoIc$ zZ+))y`jyc9&fVv_n#BI@*dyPwWJZI{lz>qCub$j&4F+?o0_yAMD4a=_7LyZ|s()vH zx+i0rrqR;v^~!txbg_24OYZ!AoA*G?<@5d3=Y{uuceZ)v$dS0R);mP|BA4u={K+Cu zG82{5E-3ESdDmIL&dmSh40nk+sk}cz!#46ixoLDyYe~zpR|~q9f4i$)%xS-JbIul@ zF9nQgr%#uB`pvRXTmNU8^3;#=Ve@Zlz1k?dZ`wlN_mx{uH_xcL`n-O@kD3b_m(o0? z-I|^$%iXE1l05Q{$I`HwyoXQkh16*n->3y zPzRqcs+kkctvr3c*k#7H`wAaI4;t}?=bt(msrLGxMEjY?d}kj#YSPsFsre#Xwwn3m zC*__Uvio~&+_wnqS(NzqbKd;G&}sD&hEsG6rnxp<+LQQLuJ%vG0mn@BLq{c#Pkyyj ze63vT;Zi+I^A+A3H0}7+dp-&<2t>92yb%A(Igo3igT*A(@?((=T1o*|{I9tCyR2FM zUXgE(vz5!=f5G?X_eVYZcjQCWe~XfoZ7j#{Tb^rsreQK8KDs+;#pay{^u?+z9#-GC zs6Xx)^2(_)_4>*kvi?tgo!^uD^UVK$v5fJDcHZ@kS&g^uMq0S8{v^5~ z$G5<9#VnzxE1%vv60>L5w~Q@zd?&LD)r@X)zs>2ocr{_JUg5N3-($+$vy=0M&pRHR zSba{fbdH~~?Wt%}*ChKdEq^}V=h+bF#hCIY%-ZBry&Uf>+sZ{XN|{1mDwp{PUOQ!S zY_m>?gFNabSIMcw^c76&oxk&)De9y!qwsD{I_O-aB?G zKxJP3uE#UWJ*;$rROf<9mh$ z*W|C* zWmMy`mU}E6p3!%@XJ5NzwRX*sH(#}n$kvA3>DQB(ZocqfS8!_L@-Js(CG3AY9jJSA zsQ!fMjF8(GWyJR7B<^~&fMvbXHwFd1MmOEn%==y+Ueac9UXwq!@a&y{w5Ena@eZS_ zHx^D*&;P3RxnuE~g{LjcwZ9b_Eq(dyI>U=(UjL~Nq{G?UryGjCbZGK@tMcL8-=(W= zCpWlU;|||nR66bW0ggVqMGJ+d?hQ-P*5;NkSbjsKzC*s9Bi2;yr2hY`jkE291ZuvW zb==9{Q?ZcCt=N?H<%~Wy;J!vF1s-Oi=k=ht|XNsai=?i`Yk0SmQFRE zudr|4g_CV8n>{S+-psA}erS28kx|F1uhIuHdN$n=5O+B_)0-bEg^xY9wd!%1o2Yv0?%l|m5N?5sj;)19 z(q5JYGNssBW!`MiS(-V=)@EOY*Sy+mk}FcCSlp|rG2QYpplG-7C%=%Q(;JU-YG_S^tG7o9Kic|z z?T&f*Gc2R_x95G|?jX~aap+Y{?wXIbYRlF-Wjc733QglJ# zOYsWH9&Jw)J5aapV1j6t?yH=*sfSKzcXRkKZGD}jd?4sNo6aA}1ryHi7F3+KYqNaU zvj|?LrLK{R3%n|lds;4d${lNIFm0@AR%%ZQVhwg)uxPSVo!jGE24-{Dy;+}m+3R}S T3pKO$?3A}Fj!4b^D|HP3V)&Pr delta 1893 zcmeyv_lIwSPJLmHQ>atAOG<=APH~WSdb+EAfJs!Dc3`+kiJ_TqNvc;+j=5`OR*^}i z0atc-VP1ZChIfI9g-57kk&%(5Nt&}yxm$TonX^w+SZGvAaY}HSTcBxxE0?aWu0pzn zwtsnXSiY-4S#WSfRA`uorDJ$%VX<#{c222FL8*RbYQ1wvPH><{wkua&J-3^I=fa0d zug_d4PcXZ`k~{3_iWR-@SIcflk)O0c*6X8c%-PJ!o;CB*cLx5JI-(dS^R54v@XdSDob#N`MNYUK&0b&HwM*3Pbz{KIX|Zy7>EHA;W~`uRh;r@!#6_epiqF4}R-4GnJ~OSG-qIy3IcA z(}sJOe>3)m^h}soCgUi#$h3C`*Xp|U9f7U3_syPe_th;|dbMEP)xNlQ+~Ed|%At~9 z9mQULIFU~kBiknQ%XJ9w+-+z|LZ|KW?fFXuTH6@6%MIN_2iwy(KVQqVswYs&aRXoZ5pSdsR&i5UXjLEiweH_Iu6`oht zT&Z82v7rCVHtTC)$u(kocs|TzKULpVf5d2So6VYnCDWJl8Qoyq>sGpcT_sD&j8r{4 z;k2?froS|m=7-*Yc=oW6(-AS>ef3ip*FO4KyEI@=N87yuVP(t4bBC_HnDj|P;NFtx z>SWW+`EyHOTvuNNtV2>W3#w z^y|5z*_$p4iZG-+o@$8ov!W9R3myWxGBq{Qtc1WmBE{ z5|xj3hfam=yLml#o%79!7J}y_*StG0qx*Jl%lB4c({oA2v7xFD^yDVg3P_&sm>aM! zD&zajEf;vZE`}UDUo7-njnqRwBq*EwDt`c0Dtn%%gJp{3jEOho`Q8=q-{~XHID}yO6D`R;ZN~q!Y!%|3_3{vhlhP-W}K0 z+J@?~Z=76_t?yRg7?_JD=l*=Od@^2krlxQ|BK}NSM)B-J7<%%bV?AudH#pACna4BlljG-z)9s z$&^0iw~t|nR(KcO$D_98b|qViaQZ}#=`Wc|^Oar;+UI+H{pB8+P@naNb2dYaBTJTl zyw8vD{6|}!&VA8z#rXZtLl5W7VtD*Iu2%hR%j4Q}dYsWKG7GbwTwwRH4XiO{yL)l9 z&aO)nE-#UFymWrr({+nW{x4~Hdezm#`pv9G?3HWmm(9F1>&d2v$+zteOgEnN(`@pQ zg6z1u%UbgV3~sComwkOO-JIw9)cS@Uk`|NH{r}f%O)1_I#BN!8Xcd~!Y{0*vwT(ZSdHw(MQIBL39VIqh6r3NyyWs4WRa5623KlW1 ze{=nR#;Ti>65lOIUDE6LyhFpWQE&_QGS^_^r$^ZsEdQO*`&PInv#eaS#dd0F&L@|C z)~mm^ofFyaFP!$uOmuIp_|2)Q%OAby{c3+Q^^=vS!p7I)jbhSUjy;l#dpGm^5%o-# zRc8+wITaty{KLp`Vp-RnQ;Cn0 zx$5zTpDdLR|9fxAYyW=7_S*UaiOx@NHf-27M{~jVnB8J4SMfc1vvl|C4_aRBhp%V- zzqoqUbPI{J#*m#_r7Q>2^viA+MLIudclR&3=_39|;P`mKUAFP-t zCgRe*bwPJz{mH$R(K?=P@6?uly*KZh98<%)dmYb{C3Y-*nUUmTmva2+h2s$sR&Ro8 zd0tQA+g9Sav+7mOmixQkO}To^By{TUUy{!IzH)y1%k48EQ}z0TMib= z@32`X`eKHvy5xcM6y~dHQKzN^1Q+z~*>~o+`JcN&La z({H9&@-_a<6Fd3num-10SVzwBDVO7v-&+)&aLK)CIwz8)hIOjr{NvTF6}fRoepMbf zc@f=UzjEnW&y~k=L ssh-ed25519 qM6TYg oDQzYAbe3UasUjgyw2AAtcYaID6nKD+j6C2R05R8Bw0 -NnPZ81p1PafEEfYHP+MafDdrhq83aJ2NuH8iYz2Uk/Q ---- FM0robN+6H2uAp+ASaCVxlLmD6xVp5oNHHAz1BE8/+A -6K(6F Ys#+\,\L:R@t糆Bp -.6> L}`QD 5Q-iӧF 1V \ No newline at end of file +-> ssh-ed25519 qM6TYg pA28Ib4AvSxoAZuGE7ZDW7CpA1GQkYm77WKNahcUFEE +HjzZ2b/iVig4reIgU3z0O1El+tct50LS5fp+SiQB+Pk +--- ExFpE2FxaqSuuSMtQTU+kzVz4rI2SriLKhcy0JHZXPo +Kz)`Q= gXg}| R!wD6?^4HγMV]`7L0T61Nd1 \ץC~ϝF \ No newline at end of file diff --git a/nix/secrets/garage_secrets.age b/nix/secrets/garage_secrets.age index 96d1e66d2671e23286e8b0806c866e900fbb17b3..0da71d3087bb3146420e55ae4b31d135a815528f 100644 GIT binary patch delta 730 zcmdnYwwY~$PQ7DRS!HfiWspT)Ub#z@r(>#xMOBcIYmq@pUSUMCvuQ{~x{Ggwn~`N` zGFNVHWMx%GV6J6>d67q0X{L9okzZ~~U`3IUhijsCxO<*kTDfPrQ({s^HkYoQLUD11 zZfc5=si~o*f~8@YM`^l3XlZ_AntoV>QE^p(S$V#9h+A4^iDOQhez=cMdXT4nmanOk zcUVr4nPFZemr;a4PP)0iN4|-%U#OFlwoy=tuX9F0nTJofZ<2YLqhFYBrkQqjp0j@T z#E;_PChnRsMmc zrBQ)th8{VAiEgQ;`r1`4CZ=9~Y2_w?hMw*fP8sFFDIs|lS(*8h;~B-nvw{tByu+RH zJVQeL3X(ITLPLx^bJI;6vnvwa9E*dDi!7Y{%)$y&{j+_!{EDm0y)7f1{mV@}T=d=2 z^(&2%EIp0FjVr>l0-f`s%nHNHEQ%{KT#F4RpJf!UH}g$NGx3gaF$hj7^4HG`57IA7 zwoFPZ_9`p3@Gs5tGN~%AG)Xfv&&hP<(l!n+aZa`{ERQtt@+(ZQaLy|*&M`|%b2jix z%#HM{axY3X%QY}cx9~~k($&>f$PIPY4$m;~H1H@)H*^flG7Is`Eh;j})AuhiaH{YL z^$IemFAB17$}<5d}Uq59{R@+GtGv*!I{j$@2X3X*!y$&;Tt`p!vizNgMIwsi{+{r@LoLR(7y!iIYJ|hP!roj$yEq zFPBq(s9QuvRHbQAxKXlUWU78hk$XW|NLYDVRF0X4exy-eq-k!JqoZqzE0?aFLUD11 zZfc5=si~o*f~8@YM`^l3pn+Rhc%E@_c!*zFK|z{(rdvgzXI^$$N@-+acD9Fhk#?qc zL8?cwdytbSS3$6Qc!+^{W@TbdRd}ICcwV`7NwTwkW|e1YW_D1KMVfzlNk)igo>!*h z#E;_P>49OTCh3`ZDVa%@WoaqNd6nTAPUR+kIbq3;Med1Nq52j@Nf`z?ULomR&XK9U zeo^6prCHt)NuDK9QK2a*l}Y;HiAIGkZh0Z)hM6wO`X%~)$f2r)LvD+?+!*3R=!j7$r5b}UW{bPW%SG)Z z%!~4@_s=fYcC0ig=dy_{)nBz^^8ZVpel$(`d`x`C*Fv^6HP>RV3M9w@Q>a0FB(5(lPcRq*N5M2o)h}o%RlS$bGO$w@4g6p&%Et`seq+a|K;>ohXl?g zCBENdwEctmmKW^)YdGyP`5$lJXn$jh1V>M7O66CRrB+(8Gad+hP;uhis}@?jI?_D( V!jrW-vWg}*Z-3oC=Plc87XULI7WM!D diff --git a/nix/secrets/generic_backup_password.age b/nix/secrets/generic_backup_password.age index 1e72b6f..a3789b1 100644 --- a/nix/secrets/generic_backup_password.age +++ b/nix/secrets/generic_backup_password.age @@ -1,13 +1,13 @@ age-encryption.org/v1 --> ssh-ed25519 qM6TYg EOynzb0Op5bNKRZ1jRaS+ZZDowhMmGYkv4u0OjWqJjE -po5rR/gfWwB24nNa3w5VqW8o8AGEqTk40yQTTxNUfEI --> ssh-ed25519 91VHug /NK1O4g1DWl6xNwHgkizeLJoFomY2zy/heEMChzrwWQ -yc+fwswX7at6eEcAjJrcYhdGlJwHJa6ZFpbBhntVtsA --> ssh-ed25519 XzACZQ RUMXGNZ6fpgmOVGKuspoOf5cgGUvjyzCmBipU64BikI -XID++wcObepaGXScGD8KJwSHyX45UjrT2oRlh/VYGHs --> ssh-ed25519 51bcvA TmB9sS4plGSx0ScZxYr2sWCo0UesyceyYPKWi+rVUy0 -yZrk2FbXpqb7XZoullu0JivQ97yTQLBiDv8BOox3evc --> ssh-ed25519 vT7ExA n0kaB8lgH4OWR9l3hxlMT7tSjYZzNNlQLZJXnzHKf2Q -kswoozAAVll/lFIG66Iikzu086tnzGF523fVnAGLFbw ---- Sa3qvrEI+FxIoDUmXRW4tEcNjdhWPw4U15Xy197wb6w -8q93lx~J/VdhoIL{`O!76Һ6Ze._l?Jrf4 \ No newline at end of file +-> ssh-ed25519 qM6TYg AcP/Za8jdEONeSNcC2fm0rZg1VOMvqCreXdpd/iDKDY +dgBlpFUcvP/n86idjIWuKsx7jX6xEWQJKY+pdGG8XVY +-> ssh-ed25519 91VHug R4SIqnNLIoIVGIR0XnUsh3RCz+20M3pWoQGJta4y2CM +s4O6GBECMUQpUX7yhx9CrNgedDn6yomCg8Bkke+4vu8 +-> ssh-ed25519 XzACZQ OVHPNsSR5IfrAslyKuIMAZakz+k12GUGNYsGc7e5WQ4 +IQKyRtlh7lkwIdH79IYCYod93+qAqap6rGL/VJ04Mdo +-> ssh-ed25519 51bcvA NYivGhQwqPbjLY+Bb08ow38Rb1SBfbEotPwdDr/v7gE +VRT0QUnImc0unH4DoEg07+PhQ0a3IsJRrJIcgDzBtjU +-> ssh-ed25519 vT7ExA 6gW6MAGGmz7wqrE1cNgAJqhLyLBDnAkh3IFB/EJf7Us +nhE8i7G/n/CnLTOUYsprFFjWCA+v/CmOpYRB8dAAjaE +--- WvW+S65yf7YP+UsQH7VY1CSRqIFyNQAMBzVDCKcgk28 +wBэ*N%uz>9`?T7L?):g07޵ Lbxa޷$ ? \ No newline at end of file diff --git a/nix/secrets/grafana_admin_password.age b/nix/secrets/grafana_admin_password.age index 18d4ced877abe8545910fcd92c730fb7d8c9c222..75986947808d41dc6a8ca5a55be72e601082f9e8 100644 GIT binary patch delta 246 zcmbQmG>d71PQ7uSOMtgiZgF;Lh+|o?mt$d8P>N@GWsp;Dl}V9Vae$+Dc6w;3iA#8x z30Ig$PG(kGn6qz6d4_pdQE60mPD)snYgE3UPhws~MWKGBOI2=Wl$&Q_K9{bpu0nc_ zqg$y-X?c>VSGI9-aHYSqQ@B@=iBp59;Qc|sI=RDrma^(k> zKM}m{lz;1V=9-)pfesNZ&UKYaQ(LP7OoFd;HSLVZs10CVba>h2TMI2$|9A@kFYINK delta 246 zcmbQmG>d71PQACgSCxlvW~pJSnVWuYSz2mTiG`bAxvRTNm8olSg zHkYYaXu3tFi<^^UUVurqZ-AkTL6C7`VML*iM{<%|L1?gxxpq;mQ&@4n374*}u0oYT zRFQjrX1TVfd6utpa9Dbv1wY6SAJl5WN@laXf{`9(VmNk52+?p z+>V=VK2t8dC*SXy8$%8&yL#_Swrj1!JIyq{NqMjPh95c y5y||p(AKAUYu>U8nLD>;{yV+r>gjb(jzatH8gR9IQgQ4!|4S)1`_J^{<_`hV=VEmL diff --git a/nix/secrets/hugochat_db_password.age b/nix/secrets/hugochat_db_password.age index 07af7262f626ac41d6a207af710426a77b89aa08..a0c5bdeb1f901d7c0b02956dc2aec8f88af083dc 100644 GIT binary patch delta 304 zcmcc2beU;_PQ6)Wg;9k|rk}BUainopQc8KYv$k_VgomR`sc~6wYHof&u6I>Igtu7a0q zl%cDouSr&(v#+*Am5a8ilSP!Xw`;z)MP6C5X`-Q*QN5#Yg{4nXkS|x2XwLRX;V|Rq zKRU;Sc`c8+YE1Soy0I%W*-!BNQ;RP9C954ePk;4sIu&qL;CQ_Lk;-+Cr$qBVU3s)N zTWwmfz!ZK5->-9{uRe-gGxxWhN@-e3?5l#H2RGtp{@Jp`{@F8O&Eq;xBg$WNY@KCg z%w{5|_ccsErR%BY3WdVz*vycIyszGuzPcLdm-glE`*!`3!J*|-eA|STRK!#rww+$j HtF{vW$E ssh-ed25519 yMKb8Q wDQ9QOIpJMfsxGr63x9PozZEVfy1M0XvW9MvIjBjlSo +eAbDN8ZB52vcC1zEXKqjWUYb+vvIJVQ+f9CZmk1Jcos +--- ZRGd4IncBO5g0BIoezzfvCxNMAVP3cgmsF8Co06u+fc +Ui,W b%d9:dq{ ŽL[M ,d8{6 \ No newline at end of file diff --git a/nix/secrets/killua_env.age b/nix/secrets/killua_env.age index 30a6d95..531b5e3 100644 --- a/nix/secrets/killua_env.age +++ b/nix/secrets/killua_env.age @@ -1,5 +1,6 @@ age-encryption.org/v1 --> ssh-ed25519 qM6TYg bPkp8HZ9R6dGxYgND2mPKC85fyDhuNyhlnobEZnGRmw -xFKtdyfAEQyFQt8c0hKB5uB+YYVow4nEJkejcDBl5Ls ---- xSKVxbaHOvIFnprTjxfV1rv1L1jc/Y2PkB7TLbWam3E -_Tfv@$&kc* s L]v"Ft!4qۉ27"db8~0亁xyJ`(nb]r8䈺{$tYqua^W96x) \ No newline at end of file +-> ssh-ed25519 qM6TYg 4XizqcJTul2c4nKebIgHNBlX1wfNM6ZdJIi+uD4STCI +wLKLC8dfC1jVWNLQR2pmJM3+yvlILUkn6be+x/l1Se4 +--- kgeOkLbbLqXAK8urZUOVhqPKn4AWulo4hGbOkgr+fOU +BSXN+u%C}%WtMS;abc-fVL@(oNJ?^0 zI+vqkN@}2Ma79>NS&peoR$*p@NvW|#wvV?-nu%+$Pl$(WS(bljl&M=zF_*5cu7YQ9 zXh?~dPl#z@et}O&QNFoxZkbDHV4;~oR;9jCrCCLqbG>)Dv1PG^X&~3L;(cp8S3Gxm zSbX)<4hH_oX?=P}`^i=s-}I%M!grA~RQo<0Y`D7Tp8#9dRiD=;Tfge%6ij(jn0aiy w+pQ-Sk~@A%avZCFFC%ha;-x~eR{=xl!Jn5daG%<}@lc|0#&+J4=f7?M041k>_y7O^ delta 291 zcmX@cbc|_&PQ68WvPW`GuA^m&pKqprNJenJV_wIsacdoiHVu9qib=pnSV~AQB-(detnp`xpqW>K`7VFGfNvdvKo23 zoo_epjkm0>$jb_H(Nul?`q$@8s&QZITHak*>g5=7aEgBvf8>*uX4iQV++KNkTyML# zV(|j0&NkVL`t6(a?q27*)zrQ3ecYx)7rRfL{$sxT>%(n_Vmn2)hAgtU{5Q?-%wy%x u9CQ91p3pFT%Y)KtnS1x1^_b4Kueez%T3p|HlP|c>;){0zYxV1Qfgb?ZKYwlj diff --git a/nix/secrets/minio_env_file.age b/nix/secrets/minio_env_file.age index b23894b..180971c 100644 --- a/nix/secrets/minio_env_file.age +++ b/nix/secrets/minio_env_file.age @@ -1,9 +1,7 @@ age-encryption.org/v1 --> ssh-ed25519 qM6TYg LSDtwlm9BBqnpzsXoeCQnJ7YImkiMJvqfet0MROaBFA -h/efW4ApyMTnp/p+3tUa8RaMreI00/T5Q4Gh71lFeTk --> ssh-ed25519 XzACZQ of8qdZPKfTtCKNMA+eHgX+WijYZHrHrzq0alH1mTJyE -rVW21YZw3kbe1TCQj/Ch1krrJt0o6PXThAV/eUbY8B8 ---- gWUT/+evFTR4ARdKZK01i8qgDCjt/EKnpKCAS5fCt1w -(H At_ï -5oJV.D̀#lGu#ɉK!-T~"ksҖoǣip1> -𗣫iD6yPOia$/]:dk]A3 \ No newline at end of file +-> ssh-ed25519 qM6TYg bv3MPWeJTJj/lrwKDBAv4T+OrRdD3ViwX8HLCmCKghE +MGP87vT3Rmf+aqhMMXyZIs4OeMkS+uc+je6Zkod0hrY +-> ssh-ed25519 XzACZQ cUkJyWCO6HkdxCqSnv9onmEUhEQY+Pj4seR/lH8KSAg +qTUgF/iT2IoJf7UOleaayWbkJbn5dgSVHKctKWnqfIw +--- BOvXie+k6OIewLDVF+Rx2YzkpytshqkFGCL/uYgljNQ +}pSS y*Sp*>ݖ  u:0b:=)tS\HNb9_mٝj{)(<3&Ә`R [{aܓ! \ No newline at end of file diff --git a/nix/secrets/openolat_db_password.age b/nix/secrets/openolat_db_password.age index 29aa8ee..cc08707 100644 --- a/nix/secrets/openolat_db_password.age +++ b/nix/secrets/openolat_db_password.age @@ -1,5 +1,7 @@ age-encryption.org/v1 --> ssh-ed25519 qM6TYg ONh+83MLxToMgANja31F4qVxE47NVjXat06RLj4qG0E -9vRKxWSdW2Bvc/KsWqbbi5mGhLekViT87WhGnPf5ZUM ---- m/MMUEWaa8RewCOG6fOBQpu8M+pgFMWUs67NQcnI4c8 -J%ϻlNBי#^@fTrxt=If&ICl@ /D8c{MR39擻ն3`;$hھ>sO핅! U} \ No newline at end of file +-> ssh-ed25519 qM6TYg 7Nt/x/IT9ofXjrRRV7coT6nrrCSOCkqUqflm1oXLXTk +BafDaEiVpuT3SDVXvuD31WIKe0QlvAGoyn4MzUm9LfQ +--- BsY9/meRTzX5oCBD+w9f+2TO/TdPD936xOjgtQMWuag +RN|- +[6q +r7d% [3K`I{!u5ƃnӺMvodz A~ǍT QGh?Nw/YBQn_`_,ZFV8yw \ No newline at end of file diff --git a/nix/secrets/pyroscope_s3_secret.age b/nix/secrets/pyroscope_s3_secret.age index 58f14dc..e96d5b8 100644 --- a/nix/secrets/pyroscope_s3_secret.age +++ b/nix/secrets/pyroscope_s3_secret.age @@ -1,5 +1,5 @@ age-encryption.org/v1 --> ssh-ed25519 XzACZQ m7q/k7PLJpNDFEFxm1SNobF2abWhncqxWri+CbVqkCc -3NB/uTmOdkPH3N+kZrSep7u0A57KpQzI4tlzyT6Z5rg ---- cI9WvpISFVi7fXb5pcNgyu3rH+4L8o5dZUnAxhQ1x4Y -Wj;lx8m Šq߮X+MJSzա4`=8$9`}w~ډשa6t۫Jtu"|p`Tb("j:I5PrSd3%[ok!gc\6sd52%j \ No newline at end of file +-> ssh-ed25519 XzACZQ ver7uyV552D1F9hTxFYb61szNWPeIxsTr4M6RWZH1DY +BF2bL0xu6rAx21EQkGF8KNc/4+jqo/0E6O89vZ8WhfQ +--- b3peeNoZ70tv7mAtQokJ8IUgE6nTGPvUkSf8p6jika8 +<E7L{WJaO oL֡[Xd-!04U?Cyz1l e1e!_IP2Ce1WzVR}kAVnCb)%̪RwhAwA66Zkqlgz=K \ No newline at end of file diff --git a/nix/secrets/registry_htpasswd.age b/nix/secrets/registry_htpasswd.age index a2098a673dc4d0ec9da553c12abe3fa34a7d4427..dce3ea840df7183eb91ce1a733f7700b83dc4ff2 100644 GIT binary patch delta 242 zcmbQnG>vJ3PQ7=zmw~BoNU2v|SVo|Ut5K9esZ&K@l2^D%d110kS!hm*OR-O-Q$u}?{QQJGV=fpbb=vTJ7{_tY`)RKD1+U delta 242 zcmbQnG>vJ3PJKy;Wu$Yyp|6{{p}T&5nz43)nNwkrsaKhszK^G6o@roZxJPDySGHw( zAeVo+mse<3a-oNFN<=}Tqf1U%W|~E&cR{{kxu=sse!i2rMPQJLrC~spCzr0Su0mi? zzIIN2nP;U@hG&3laFs!Te^_Ovrkok%CxH@|Pgejx#utFK&I vGbJXA%07Lkv#&b!R=4l(%nKiGvfCWGwQSqjLW7wJM;<;uae3N8IoAvTb1PyF diff --git a/nix/secrets/registry_s3_key_secret.age b/nix/secrets/registry_s3_key_secret.age index 11c6e78..5649f2f 100644 --- a/nix/secrets/registry_s3_key_secret.age +++ b/nix/secrets/registry_s3_key_secret.age @@ -1,5 +1,6 @@ age-encryption.org/v1 --> ssh-ed25519 qM6TYg zUespYByALhutVeTKDYRCXpskuwotOzfTjWCVtGcXTg -LxTqOV8sk6zOQv1eAIvSfUoeCfpus5lB4VwQV7joMks ---- bCKKLMK0Alw89Sh6HB4EW76P29aNUC5btlNFHDBTsQk -4mXA/u U}hz <5f2<jYO=FWIW%%8f~` vl@:1ľkYwaL:\:G㚢H٭rkbEbt/N}v-xMXܿtGRptǭ.hbԓ8x5LF"qaG ssh-ed25519 qM6TYg /73Z7R1RE4lfUfVSeJqZjbGA5yjygfrxKi5iuMMxrno +tsbPaW/x9HFT/tG+5F3n/3SsuhmswVIfHVLNRAzdiP0 +--- jHapfTz6oq7gdrgBn+XNQdMZ67DbrFPBY6KKzb+wfjE +U1r(RMN8Ol$DNu3JonBOc%AT~RV##[;3*6/5gD]2%f)fxv +]h:d{_O~2tiz28 W>BT(a%͉l`\ \ No newline at end of file diff --git a/nix/secrets/restic_backup.age b/nix/secrets/restic_backup.age index bce219620893904dfb3c6cc51864833be9f6fc61..c968ff04bb49dbfed9dc395368bedfbd6ede363e 100644 GIT binary patch delta 695 zcmbQhHi2z|PQA9XWmT1DrhcBUlT%5NYp!c(ex*yLNrrD~NwIfQikZKsYekqvUYfs0 zAeVN zP98<3CK2Z0xrvq8SylQ4o~fCh1{G03S&n{TK_Mvt$%Ta;zJ(&5LmK$#aX0$g+rZcQto3k1#fHO-)HL z@NjguOb&PPaW*wC@JTn}($&>fh;SK7)5+`W1TXWr{GY+Yc!BA}A3NPL-KNy(&XQd*?-hB} z?e7UDMx9qYmc3_FAmg4n;*MQ=H_VXw^6=x@>}w0|ea#Dz>)YG0o$00hq;i(*4Ud{m zTB={D?YsJ-$UgJC(z1Ko8ImlQwzpA!hGkxWr*?XJk+xfzV`WM}QDQ)7VW>-H zI#-gBYfzMFQCftjw@Y|{Yhk64d777(zq?C`eww9|zka%QVYqWhQc1b9FPE;JLUD11 zZfc5=si~o*f~8@YM`^l3Nw|fvewwRMm`|8{cD{Rtwp*29wrO&tQJG0VQCNAln|5VL zmYJWIcX4JqS9o|-QeJV0S(bUSrK^8HW|mu!g?WgfuccX(NkmR)hqQ(Z~}Lj8=xL&7W~lU)2lQ@nEmvZ^wpoD2fF!t#w>0xbfyogH)ilQKe6 z3v;~+N;178{lblNE4*_(-IIMBU9*DqgS;arpJf!U_scbN&r7KYam{qn_cu2%u#7VH zHw-pS3NKCZ2=MU8cJmBMNp_ENE)LG-%E>9oDMng($&>fFbhd>GAN7mjY_Y|PR}cG3@>o;@vR8XF)=bRb`L0Y zbPGzVcP|Z%D)q=Q;kt8V`d!iXljYXJK{md;>#iP4QM$NscJidBMYG>*UVpPsVrtj7 zR8^086C*x6*D3GkSKymkXLIjg`^H^o_sP5OJjNv_Dbm%iax0iK#N@T<7568;8R2&W zxnE2ZIoYcg`a483WdG?al^>_y-69=g!w?X_d409^4NJYuyX#+UG1yYf;dbZX!E;h) jlp+e$ZM1cQTlJEK`uvLC+_zLMoUCwID0grE?oS2)Vu$(% diff --git a/nix/secrets/s3_mc_admin_client.age b/nix/secrets/s3_mc_admin_client.age index 17f25f5e6c998f2f28f6927bd621d1724ad15514..e64d1a44751ad9bb2956ee36fbde58cc646a86b8 100644 GIT binary patch delta 824 zcmbQhK7oCLPQ6KXNtV7#igtFTMTL2uM_9Q*Vz@;{R$+2hYQArnWqMFpnY(FPu4!gS zK9^~6L|R^!mr12hn!A}tMq#jXa)xtcslS=8o3C%KySAZ^dr)vrc9ogF1(&X!LUD11 zZfc5=si~o*f~8@YM`^l3NN};4p=YRhl6O!=Rfc}Ki<`bzut}I#SW#G&n?Y)&Td0Y# zv8ADfiD{4tSDw3BMM!2@Kv+apa;R^(rB6^;X0VHKX=ZA9MMzPii&MBqP>O$4T2ylW z#E;_Pk?F2ZPLX~gW+{c?KHh1T{vIJ|iREEg9$t=lo`ycfA=v@`1)lyPxfSVLo~GuN zi7BN?+AfX(sg@pr$v$poiAMUlu0@$ePI=zBAteEZNgmpXCi&%);~B-nJ)A?!JSy{| z%3UkmT!Ipf416qua`k;f^34nUoy`)<%H6^(T*KUw%qxAl(tIN$3PQpoiUR!&JxmRK zOv)n-Ox!|CGs~k)Q@uP5!kjF9v_s9!j2tZ{pJf!U4=yfB&oCf$PEZDN;h__bT2du^Yaf(GSD`xDl-rBF3pHC5Ao0P z@d(YXFAps$tO`v}=JL6zGtqY8q(XN);~=x6&&pDw+$;75?ftym^sM0q!$+!p8y1S? zBz`|ZCa{({Wc`?eN>28!+z#V+n#OR4rav@n5XMK;qWy4 zpE-M#^plQ{2h66)y^+c}rhk0p>WYuMp1N$g*WC-PabQEEt;SB^Jw|8)gFw&{}&owSRKOnNB(4p@TI66vx}=NmV8{WER#1~ zK7HYi#VZ?ky>Pm&ZuBhZ5bLf@m#nM`{y#e*G^;n_hH|{b%Qx?yi+=p^=wm`a%$42G zg*g7F?Ci-gx;%A3fj);AS6Qyw`Ah9fcH5qt-&4M;e8B|%(4zY4g05rhXKwOSJ+vp| Q+3EGk;?rJz%BkH906qdf82|tP delta 824 zcmbQhK7oCLPJLx@Qoco^XHIxlfO()>m0v+chNWe2zGq~LtF}*7NMTMyOXh_X=sYRPe6%rh_+*8ibt|@AeXM4LUD11 zZfc5=si~o*f~8@YM`^l3Qg*O=saJkbaE`BeN?4`2yIZlRg==O+SfWv7L}GBDL1{^r zf38oFYhYzMS5{6{cA=w}X^5$RN>zk^d2+I^S)ymCrK3TJQD~55sk^I1a%g&nSC*IS z#E;_Psh)Y2;Z-RaMuyr3K`#EDMgdO#ZWg(z$!=~rDaobY8IEQ8iTNJhr5Pq%2KoV| zF2Vlc<&OE;QE47|W~K(oAx7n%nIVo9mRZ^%CVpNKe)(zU=1zf=;~B-nz4J}nU5pDX z43nKxwLQZvD@v0J+;crma>CQo^76yv-Hah zHTCr?Of)S@GdE6gOfd`0k2EjKE6DWa3i7E+F)Ar3^v?6rj<5_Vw5)J5&NlY3O!p4+ zs7fm^P0#bl$nZ7{PtGyn($&>fD9y}u3h@gr%6BdDG&P9Ia7(sG%PAz!q+DAx0pgg|eeM7{B!`er0DK0hgmb2OWgyGhMV-;PG9j@%( zFS2jevA@^z=4V(GWWFgh^N`$BJ=J~o^@*vg3j9lsNnNjh@6Mn7LuuxH&z=QoH=PbI zf3PklLan>>=sKBx-%YE&Z)@bcWz@X#ka?6&&;O-yDnYgU4N224C^B1hnl!o}irX~5 z%;e$oO%J#q=%2awm9ZhCcb@;(<@bvB@bS*het%!vO7Cv4(+;;3iM=MJOo!fc)*L;o zv^ge9z;Ac$@f&i*uk;`A)uvsKTpID|q^)w{{>0cJs5jVUwjt@eF>b478&t*vY4 QJ^CRo!PCC^UdWXB04^~^=l}o! diff --git a/nix/secrets/secrets.nix b/nix/secrets/secrets.nix index 287aa86..22ecaff 100644 --- a/nix/secrets/secrets.nix +++ b/nix/secrets/secrets.nix @@ -6,6 +6,7 @@ let vps3 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHvupo7d9YMZw56qhjB+tZPijxiG1dKChLpkOWZN0Y7C"; vps4 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMpoLgBTWj1BcNxXVdM26jDBZl+BCtUTj20Wv4sZdCHz"; vps5 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBWbIznvWQSqRF1E9Gv9y7JXMy3LZxMAWj6K0Nq91kyZ"; + minipc = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINApZRrvK4RC1SU5m4OLbill7HZYPQtuvh/m/AB4q5dG"; in { "widetom_bot_token.age".publicKeys = [ vps1 ]; @@ -30,6 +31,7 @@ in "generic_backup_password.age".publicKeys = [ vps1 vps2 vps3 vps4 vps5 ]; "website_s3_key_write.age".publicKeys = [ vps1 ]; # only used by Noratrieb/website GHA "does_it_build_private_key.age".publicKeys = [ vps4 ]; + "immich_secrets.age".publicKeys = [ minipc ]; "wg_private_dns1.age".publicKeys = [ dns1 ]; "wg_private_dns2.age".publicKeys = [ dns2 ]; "wg_private_vps1.age".publicKeys = [ vps1 ]; @@ -37,4 +39,5 @@ in "wg_private_vps3.age".publicKeys = [ vps3 ]; "wg_private_vps4.age".publicKeys = [ vps4 ]; "wg_private_vps5.age".publicKeys = [ vps5 ]; + "wg_private_minipc.age".publicKeys = [ minipc ]; } diff --git a/nix/secrets/upload_files_s3_secret.age b/nix/secrets/upload_files_s3_secret.age index 255fdc33acfbdec71c529fff737f2aaa96c88522..50ec7d6a2ad423cac91555e4d5810def9d70b3a9 100644 GIT binary patch delta 440 zcmcb`e2aO4PJNbtrC+&4dReh+ny+(}p?^exi)WyVfuonXcX@JgP*s^%aHwCBtG<7T z0arw5MwCHLR(N@ZcCc}Bs&SHjcuqlxqjyk5mZ_I#M3%9;U!J#idR0MXIhU@ku0l{! zU}9QEdX!smfSXxaKygT+i+iPqQDt~}x>;_8wqL4yP`z8eX+fH|S0LBQds9^dI`7Hy zo4LNP@MnFWdQ5-Sf#p9|?ux#{81=7%XY0KK0+BMO*XW zm?ZhDbGLHvmR;J`S1$2Alq%p{mQwl4;LY3WENzu`fkn?#_^r;XJv6$a7jXT+ls6(K zo#zdA>_2KgrSEh6`gshD1y6K@40o-ZvQeN`!DbzghFijgh;!Vjt62;eMGEkn_;xQZ vx&P>xOO%d5#-(-@J=$Bj?|sQ_)9*jKZshAfX%JbxY~DTqJx;?I delta 440 zcmcb`e2aO4PQ7KQrAb<8n0CHFMY36BUVd4Sr;&wgrdMf^WwJq9p`*5IhZnQM-rcX*(CW>%tssY`*EaY(7FZ%8F7{FF}3 z`_ha4#ZS}U@HA+n;)w|-e0!`lTX)I#({rSPKD)P_{t_h48;TY^-I>p_D)Y2U!11~pDIC%O9p1&| diff --git a/nix/secrets/website_s3_key_write.age b/nix/secrets/website_s3_key_write.age index c42418f0258f196ed9db80fae143904d4e823874..96b92cb19f93e747d1c2813d300d7f31c8d63131 100644 GIT binary patch delta 309 zcmcb?bc1PvPQ8DMR19EN@$s3 zHkUmma!_$`nY(YEd6BnUPDQXqX>qneMSWhRwxxcCelZtYjE~FzeD0u# z6H{Xn;$1x_@}IC`O4}2{W14>~!qd8b_tKEmCDmH-P9_HxyB(9xHus-CDL-?ywR>I4 zJ*N5_^R~LYXPRuvA8;afPOh%Ud!adRS$LGXJ|6!oq0AuKw{-2*WI=<&yALN!JsNj; zNnzxy7w6;nmu}T_T=yyV?U8pO7oR2bF04*^x9-HW4xU#+!fVsiX8hjT-tc>ohcWL~ MHDy!tN?#{60K#;AmH+?% delta 309 zcmcb?bc1PvPQ6FCXPQsAM}${aL~@y#iNASvR(@Jmn0unPvtf>9NTrjrv5RGuTaIV8 z375WKmTz)oL6E<>kAF(r374*}u7aMIIW!>uMyjQ1Ht?y1Ko`3!9eg~)1uNU{NUN|{Ih?no&=eK`67e#&Z|MjN)+b*S7 zHXf%#S8+vi85DHtZEoIw#BUOJud23dWa5*VesY3uZnVDRGx~3O@XmF?w)`XR{9;#J N%~k$Z*jP=S1OOS>f4l$y diff --git a/nix/secrets/wg_private_dns1.age b/nix/secrets/wg_private_dns1.age index 8d422bf..76fd998 100644 --- a/nix/secrets/wg_private_dns1.age +++ b/nix/secrets/wg_private_dns1.age @@ -1,5 +1,5 @@ age-encryption.org/v1 --> ssh-ed25519 LZU5Eg T16scfWokKj/4TaHvplWuIdHCs/oR4t3V9x4hFo9yhU -h8RoAXndXCwUBskJlJTLWoXapWMUTF0yPnqUV9u7qt8 ---- qGJTnOXdnz8D9eA8AKtYarVa1l75x10SqjhsKchfQ+E -aҿ/}=7_r^rԕ?y"oؘ;U`*(Ztz7s ，$^k` \ No newline at end of file +-> ssh-ed25519 LZU5Eg 3Bde2BfrG8qdngKCIg4xeXnkqqdrtcAZfW0REYwkmWc +0Js204/ZpkBK9mDZwhYOY1IGW8yA5L/iMAmrZR1r940 +--- V7Xj3KkcueKzPhl6wjk12zRrEmFPMpUcQd799p0Dqr4 +~TO80} Q. {q6Qu׆%N6Ќa|41րZՀ;Dz*^ѻ \ No newline at end of file diff --git a/nix/secrets/wg_private_dns2.age b/nix/secrets/wg_private_dns2.age index cfca638..1c04d1b 100644 --- a/nix/secrets/wg_private_dns2.age +++ b/nix/secrets/wg_private_dns2.age @@ -1,5 +1,6 @@ age-encryption.org/v1 --> ssh-ed25519 5bWSnQ eiSLsSWrjQldff9ZbhjhrvGgNGWxmxKu1JfsWmjo0Qg -cCLcVTC9hzN79cOMOuuOMo5VpwlBKraqxqeQuvVzqqU ---- bgLRe7t+KD2ehc2gAp4RERJ3nN5pGLA04L06KHVeQvw -ns4!nt3ܻ:#i? Jʷ '1d!? $/{uX6erL.][ \ No newline at end of file +-> ssh-ed25519 5bWSnQ V/5bLxQqdZEF9tgSPGgm7nEpnyNGScgSVfjS3KOvxA0 +oKHKz5IIZNdsWhBCTCqvHVLAJGC+LEC7RuMgQHI9Wkk +--- 71jtq96kfCYsB8UGSccc2F6qWtj7DO658MeVWSD+L64 +UXd2ClEV~Fgip%N6 +t%͢Ż{LZ@B9${g&PBHQہ%4 \ No newline at end of file diff --git a/nix/secrets/wg_private_minipc.age b/nix/secrets/wg_private_minipc.age new file mode 100644 index 0000000..b5f0470 --- /dev/null +++ b/nix/secrets/wg_private_minipc.age @@ -0,0 +1,5 @@ +age-encryption.org/v1 +-> ssh-ed25519 yMKb8Q o1qLnZBL+o8wrQYM6bo01DsCKVmA/NCzLe84aO4NSlI +iEnVZGcr4wyMN5b5f9Qzt1lmycZVe+km/8ApNvq6ME4 +--- MiV3GRLz1rEy283zGsbTtrAbQgmdW0pobJE83BmPrmU +G^%Lj,sCIC&@>#t$.2R+p.4 ke^+sCgn-z{ \ No newline at end of file diff --git a/nix/secrets/wg_private_vps1.age b/nix/secrets/wg_private_vps1.age index ff02844e38aa68e204ff8326b04b01657cf651bc..c186827a391b40d78823b17623332594a6988942 100644 GIT binary patch delta 221 zcmZoKmSE8k(DDV&H1#l%k)doe@^(nO{ delta 221 zcmZo+7iRQd#LzkZbPkn^79&<7Jc7D9Q z&Q)d*Vwsudlb_+`?h#OBU=ZPFY7|gX>Fycf9hh5ESm7UH=8>9WnV+Fw&ZVoXt5D@^ z9_e0GnpPH=oRVm0Vq_T};qCA3VVLQw@8V?OYHDQZ7UrZ~9-fq9lFa48+M6e^w0F^z z0KNZO1~2Y}FBH1Hf$wsc@T9YHAJ^Qz>a%U$DgT*QcO4R+S(F-}Q2J1Nr_tKXJ0E8- Z%sIY7y|Zu*SHyYIY@1hEhMQ-a0syTxQ=k9< diff --git a/nix/secrets/wg_private_vps2.age b/nix/secrets/wg_private_vps2.age index aa84c780699e849e07d41cd0a8c1b9e921f89a5c..7b8faa9505dd2996c8be4f17302139742ca7f18f 100644 GIT binary patch delta 221 zcmZo5^$|?(9?^;q94jloyni9${&aRu~qT*5mO9>{g|*7VNaedbel z?l~dXxc*m~uHp6?4~y$ZUP?Jlln7lT7|ZndNS4sczC(o~M*kT-&A#8BX1=-7$!CMf YkpF delta 221 zcmZoyK~l^gDy8(bNg=I4}KaMTvUlXv`pt^x5!x}j0QDbK)c^nh diff --git a/nix/secrets/wg_private_vps3.age b/nix/secrets/wg_private_vps3.age index a874cea..50d20a4 100644 --- a/nix/secrets/wg_private_vps3.age +++ b/nix/secrets/wg_private_vps3.age @@ -1,5 +1,6 @@ age-encryption.org/v1 --> ssh-ed25519 XzACZQ EsFwUOjtcoWVd5gJxu0vAfcXxGZovBBKcGuin+TE6kY -51vzn9SvfX8WCDe8f5dtblAhFykUIxLkvsNK6XjMSuQ ---- VTYLeqYga9RKPLxjB6JotAMC4StSGh9PNNnG3+kq6vs -]#A *R1*{TMڍíq2~pGJ#RWrWC ҷ# 3^͗ \ No newline at end of file +-> ssh-ed25519 XzACZQ JO+9ZDfv/rjpGHSL8WBm286V164a2CwppavSZ4+L+Ws +hqfAaluHnH5XHzI/oc71q7HlKioHMAbKP9cg9wRJ6kw +--- maAUQCFkFuMs55Yr6wX+2q+VUM/c3h8rNb6u+VrJnEM +)WFj +},E\G&x@,[r+ ssh-ed25519 51bcvA 14yVvUnmbYRhz0jbTEsj5bEZnJleq6ZT3NgOqVybzFk -F0cCQQhghlR3rHDEiBwIWdBXv6Cfac+JL9MArEXOHuY ---- bB7RaiP/rNyTpjpoa2qXmZw7RCa73b2FEy2WN+CTpfk -M):8&=$8.U7~j]QHC$^"˿ -WCZ#uA!dXpx"1c \ No newline at end of file +-> ssh-ed25519 51bcvA CkaPksfSDKWRMaL4FV7vI4VZ2c8Fd2RlyRW8DEkOkgM +NrvBSSPDrwNL+YKgBTHqQuLhKgGy1+/H51JTsA70Dww +--- 6qkEageKcIweJ7wWcqb2HZp9zJNTyLcoQ+Gv/+O6CJA +(,zfD8)]|P+a {n$ Ax"Â]K \ No newline at end of file diff --git a/nix/secrets/wg_private_vps5.age b/nix/secrets/wg_private_vps5.age index 6f2383b0459c1fe76f93a0d8620d856fb7ac1ec9..3f4dbff24b270648ed8918c639b9f7ff5d5e3f1a 100644 GIT binary patch delta 220 zcmZo*YG9h6Q*Y>`A6DUGnw0BYSem0gxF@n5#G zEwk1#E?d4)*!zyM=6~*^=ex}>NA7wreN$3E&|qssdBg>`w2QX`KRxajb<19p@UdF= WROjT%70pWgb|Qr_ZeLX6n-~C#=~6QQ delta 220 zcmZo*YG9h6Q=gKXmaA>)YF^}Ko*9;2mE%)s>Xw$~Z<1qLo?05}Tw3Ymn-q{!?&(@y z&Q+A1SMKVQY@l80=$jf^73O4I;B4un@9R?OotGL=mXZ{iS>_oY91s$i&!wxYt5A^? z;plJSnQK(+9vWO3l9%h~5|LPHXl@*w?iE%LnUdlb8R}t{9Z_zOY{K=_NVP$2|C-s3 za%c1Qb_$1mlwIrRy}&2y8F9hlW3{%r|8TlJ*%@93TzNraz&qOntISW;wuNr+2Cj%l!YRf?0PzEhHciC=KGPnnxzm~U8+ z1(#D*Zl!C8VMtLym1n4bwpq5TadB>HQiZp3q;pYGK9{bpu7Y!p zXI@~Yc42XZVQy-$SzuDKSEQSVS7BD5iFt~Dk+Wk+PHJeDp;=CrwkMZ>``f5vM?;L} zi!b%Avzlq~VOsxb&v&2RzC5lo{n!2fRw7KT3@LhC>yjDe_8|T zl3w?pGfrLlIWqML%TKf3c%eU6HXY{6d17ob$7OGEp~(-!$>;8`m6)?Q>Qi<1-sz8@ oOuOxV@Xg*`u1$e2_ukuFZ)$8QwyaGdQTMFQGDjx<hCj0G3}|`~Uy| diff --git a/nix/secrets/widetom_config_toml.age b/nix/secrets/widetom_config_toml.age index cf9ff8dd43d06bd4c1371b68bc18be371735cb8c..fea9a10a006f3a7499b727380dc1b99c3b8bac64 100644 GIT binary patch delta 4000 zcmZ1`zf69DPQ6iXn!i(0kV`;TWMyiZiK(|wnYVF@tC?3=az(z6Ws1K=sJpqRaj>a- zAXi3FNmaO?zEO6DrJydPCzr0Su7Z!B zTSR4Ou8UbtMsiq4l3BiGxOah{Tcm|YsB21jVNqh4Uww{`Q-GVcu`k!zLXT;`-^+*? zid$ScQEMvldb(E9PuqZUY4fL6|Mf#1f1BU7dVcMIM3L~d=QEyc*c`R4_+!gC)#pB2 z56O1-Ik9AGy;&f##{5|l!?8$r$IBe=gIjJtQ~Kz4Rp^?Q*nD0Yq2)_2FdS6#`r8+4 z{pxJVeFdI7sxKAm`);MRe*DvrTkhj%QD$R0OM=(ufmF*J=HT_bTNddw-1^nBLUHB< z_mzQ9{#C8`nm$MF@Vg^QGIg!(3*CI9j+b;+ubyu8y34!dT=D&X*$XCZ7XER?-QZNf z*$c<^KdbACTP53hcf!522@hA+H3 zY~S`-4j(1I-e0BsO0v>*4!iOenInlg!Bd}YE)3W9|MuYF0W>ue)OTr{eZ}!0!=Hzi{Fau#g&LIRzq5$n8ggA# zI;hq0p8M`of8CyMc+}O<>b#MoD>GOjx920z{jVQ?Em?Yb=aTG#n|H3fIpQgHM5R+i z>f62mt;7`vTf2VOJ?cAq_BW4!{(U>f%;1{zJ-W;vU;O{Kp1EZA!jj~JT|uddhq;c_ z=iaospb

S19qg_ugnGy$`!2UKN~Ln7T~f<&uTIP@5Gh)*jOC($ca0&Xz#&u`<6{+ zc09Z*(A&P}!-1SfN0nq9%hv65*s`fG;&fJFrnE%8?6l?FAxoYuIhV&RK56-p2R0|? z9`pM(X$8-OVAYvR9~?QJwmB%RecxF%;ryBUGcJGB+F;M~;F$Yt$-635x3@W_S~aL> zi?nj@ZL<6HuZ-X3rj>$yw%g%F-S;HfRJ(j;FMhC?E9YRwbkd_^2i`8cCu%X3*{QO?;ZT#$%ev;DB`?^;pt&ZpGrk$Ac)#~tE^{MJxA68|YwYv67oH4QaRlV6o7nhiQ*Oz=g zbNtX6`P))U_SNV2S$g?5bse2`@Xe=W>#YUHA0#lx_OCjYkbEGsK3^zM`b#CvCFMh7e7Oc&S zlVdP6IHYjk=Kf!l{y5Q6*%3Tc$~B3&1(L&e{ajRv-Sm>H2;%1cU+}* zTHl8&rItx&41Tp;+@LjS=hh85C*7T!+g%GiZ@F)sUC|NOxT0&Cy4wd2vyTTeA9489 z$1Fbn&T`qyszYhrPx9nEFD`6!d1MrM$;XnP%Zp3tSMa;k72AUAC)nRuRC1wl_%Vs`t0M2Mf;!1Mf`Ao&A79ArOE2| zUuvwC$^>$|JDk|}oNtnUa_}#2z`3H`&$>(Y_N=(V6**shF*C=dmku!|tLE9X>t#JN zJ8p1WInLbW^_qIC*4sS$7SD>fWjKA8=qG=n&cLW?6&Be)rT>QBzkg)ODc;l1W={!o zh;2TUHuH(sbH1DjGTaybvFa615V;klb?(~p*3bnZtCSb5yYPIE;~V$cR)4khSD(DY z6m?Vc)ZFyEoKFm&68=uPcX*bgpxpuX)U7wapEnUPTf-}$7C)ECrK>(f>4v=5^1o*; zaDC7HZa=%M_iawl-Fv>thqudZUjC`F_t%jW&MPMIHj`f5nY(xvSM!a_oqt&BW^0^# zPSxVrw*&3dh4}7T zMsNPFJcY|3{G7ZTxo0XNk5^*nNzn;Y3I)UYBZ~P!npa>kIO$a^3G3cka@7^ z?ac-GEN?$Yt-2?qfAOmUzq*>#u>+QIH|hmlTO1{_8*efuTI`&$%v$XAyX7&f&rT~` zXrwb;w7*r=%|+Ck^Y5(_;d|%m6fb!7dG@@Bec>YYJZw=?C3W1>7k_&-E#08{>Wb&B zpOh2i<|IXG9(S}8h@ZkxWPQDKYi1*WuEpa<(Sh8*Qg=?__Qx{FGbg%_3u-{m+ol{t9e(Msl%u;NnP`nOa8Qg@=L2Hf0AJT zA;QP`vedg?Mbl}0h=`;B&kX-XnJOQiTH0zjo;Y!4`Ba5JH{a(ym=VYLBv1RLmYLSk z90N_mUJcHP((^>j_IfwGXSnWmI`9dj%qOdk!UUuG+qx#=`^8V!@7lTJhlr*s*TF{5 z(2ifzKW%SNGV2SU7r!&SP_Tf%?DMRv9PRcsex8-NulYYSY}-^aK_RC7vrT)Q!I8Z5 zKQCsxY)j4iHji`G+sHE$12_A;?fh(-7TM1g))_eFo3>Lce z2bi<(wqBE5uXJwNi!GN|W!4{GkaIBDWeeNsMJA<}MD$8`ajdaE@x${-abtIr_MI5M zxk6f3h2~DxWQgQQZwjjENX*-_^RB91_KXm@dLfBV3p@TV5L#ZJaP>cXipP<>%NG+5 z-d)ezEG@UlUTdH0%aWWqLL3Yq`CooN{zN#oeB-?zYdPP=b1oG>y?)s;mz$X<>UZm> z3f(V}ns>jY=TJigL(jGYH$L;tyqo#x?E8~VX-Vu;xdM1K4zu{LzIiEW+LH4B%Tv{s z=3L^lyb+eM!&ievt2>a>_;lpj2aFma?^PGPj&#|U+jurUKFU&bw=B!1-M=pBPqpZ|T)Mz#~(0w-Nf?2-fHYpk|*3TQEw8=rcV(k~shO>>9N z;vn`P8?ExU&y{zddNK2;e7zHoQT5VHN9nTzTA|nZ>r0=IwUhQB|#aZuV|b+py{FX6xtg@w#+#R?j;Az(?tm zW*DxIoX#uvo%@T(7tY|kFE#m_k{>=h9~mYt&gUFFV@#WAQdU9wRqTY_mI;&!J0+XCGuQ zXVX5?yU#Jf+*#+(vX?*Wljf|Rv~Y7$*7}aG$=R`Qlp9scdm}FL?5kz(-XAG%@yFAC z^BtZoa@SY7t@QD3Yze%%l5dvGKgEMN3~}`*=Xt(a=RIrR`sh_Vf9yZ`&LS&5sPXI_ zfs`^qnbkXwOl4-Gxw!KrFS84xzC5wJ*{X1Qw zl6B8lf2^}uRGz`2_vA#?XCHl*3(PyBlRy%S2UQ|GN`t9_{lfSLw-liN#6Zr}OT3^?Bz0`PmL%wAJr^tKK7IG{wd>PAM-{ zZ0b9m{oKz?UbY>a`E5b{4v)`ezkj}CVJ$r8^6ScnrjAd++hPmSr^jt*KdV`%cJ84W zzk}IfgL8+YdHoBoP7N!SQ53hSS-aP%FDG7l@qE>_`b`Y#rEgC;{ZEKzIik9ralhIW ze&ugh109<;P5&H`mXw#azUIr}^uG-my6;Bq$eEV`CN-x zAMnkxa0$tS) zJ4U~^*5>>_jvK$P1lhM<*R#&)bTDEH%(%H{OMJ!ZQ+6&TIh^9He_w9< z&&C>cL{4<#cGXovzx%rT7tZ^zdH$W(K~D}p?|L%bg*{;R&1X_-wsG}aB*e1(Z)+Is zcW;pt`D%Fd%N^mAJFyHhac36)?7q0Cg{S9fr%&{q*9*(ar@dd=`f1aaB#rrbKaQl$ zG~AbT`pIvu!WlBf9idG>58ta?yK}LR5x>i{iHy4L(#HZ7e*K%f?BK4>e@;`SUwrDn zWE^C7YvHRp{k>e`oA14CIMkuuzO9}uvoXSCcfho!S-GxL4OLjx-xTWYQ)b?}(=X-7 zwwH`c9pd)R*kSTQ>wf#pl!*>#^p?Ar3LtYze3*qn9XMe?NHZHDI8Vpm!nX;ZRtdhCA2#royug^zWz&vu)2 z)N9Q+_Vuk@m8;`dA2qAnHEf-e66&trCg_s0h7_pUb`i&EB2Nx-~MF! z+=KUA#Lr~JF@AaVm`lra-m^`;#-hcGO|_q2HdmP<8hw9D%}J#x--REjYy6*+B`xKp zdpmkYiQ{3Gy#AyvttmZB%T!~R_pMsNYj$l{go;UhxUC&Wd-B5I=nB&&t3Jg=pPnq7r5~ub>ZR1Bx6iM=N* zXSBck9;$yawEmmZjbn=zs|j5H!JxP1%Bh+>m+Wny`5XV7@8OEKFy6OlU8#J{ z?K$I~1sL0L7GbC=$ht)sxHZNefzp8@0Ghy*6TTQOZ-Spj( zJk2F3)yl{~u;T15QSJR^!8h}Q1uY%3Sb9~iabK3Nu`5`=f2_FBhMwsx#WrS&_FSqL}UMhwsj3V^$uX)R0%Y>&3b>+uSbJp?LWO!%a?O$F#w-pvui%3%#2V$(D*B7mh3Zxb7hjz;>(c9*Xr65eeMjq#%=o!jOX$?Ao)4#=+TPqCR8_XI z<1MSotNuh-SH9_j2!{Jl(aM-u&BnnfcVF&;KKE#DA#0|JbI2c`;(DF253{3(v1v(-T~?!L(zcq~*PgACJyx zO5EF%@~vrZpd!ous>WIWdhc1jn!n6KcgyMaTT|37o$)gXlRaxX{k_J84;Q^MAD^vU zW}ABA!@Fq~l8?&yzcB}Uaj0Y*oLFBhq*T*h;vu%fchC7;*V8^bBo7}Bv(h-Oc=y*6 zsg0Kpt%#Y#r|fZX;d$q}DS5^6*A50+On8*oa`XF@3HL6>zy6|Y;s34R;?}IbyKguC zoY=U~H^OJjeaSXPw#*EhuzOG6J(%{>_LZBw=7pQ7Z8kku4AQ@D{&J}+F(B%f*{3US zPS>{|zE#XGli67uxN22>P-ijw8JlC<1dq+0d6jqCA?3pdPq^IGED+LG4*PAqCnx*f z^vUm(d|YM*vghsn$Mfeg$N%>hlI1*J#+M}L-CnaH!Qj&LS1Sxk8z%3Oo-G_cQO8*P zm>1ufds5$>)6EvoFNr@`utqZB$i>{nzdNjI|JwZaufKAk{xrKn&+*04kK_~|b;a=2 z#0a@2Z*{mFVXeRapSI=KdmUdBBbsJ^d-VItnX@Z{8@6jrzb$FKb)U*(E}g{E*$khK zuUzT6$YI{I0E-W0#hESd%&KoEzuzkVf9?5KUUD1)!JB37-u7mlJn`Z5m77$(MW!s9 zAAa|^@#gCD9}@rY)O)V#NqNpbJ52x2_jznZPs}F%{9oF?#?WupZU*k+O(!Q@;Pf<` zI5S%1p%jPerKj~#?kvwJyfQO*8YKUV3ru9~^$@3N(~E7p5mk6Nt0yWd>D z??B#!-Wxn8ID@=q1a5n^UGlcqzr(Y_ES9W%xHvZBv~I2V#pIcvy|t%y*Bffw6%=`W z|H5+iCCjJQY&Bi=u(aZ;m)y5Fq2pT8n*yT#EA}igO`i3)By_`N2H^(%cj7-cuKzlH zLj9%m%F~@2DkYgx6IXP-yy#k|l6*K%a7$;NwjgVfuV_Yz|5u)=bMO9|_Fd(T_)K}F zEfx9VIw1=@rkk7%+_dG(-=lj&{>I#{f4xOs+W&#q%#&}n1$Kwz)cS|=v@9!m7ro0i zL;d`wCu|q)DH?0$EZ^>8b>*vxd-bWehd#Ey?_m%xIK1G(!3CS%SIg;d-I!`Rwa?|Y zykv^k-}#R=?(tbW-Tl;_vJ&N#&ugFQ>rQ&8b-bggaq^n_fXFjlcc(5*ujF+)wjyE%KPu@AveKMt0&3-;S44 zCC;9Cw^g~g;c=>}#7tfT=4a-cE=in_cx%P{p85XupFwIo4g7s^o%MGz+l~ftRBiBL zS+zjccY%p?v*yl8xg{~IV!qqBj)eAR*5;h7&W%;weP-sFrkRO~U*;)Y*3z+9QoE8z z>-B~@oyTvumpf*9I9~nuif8}ogunkBDz?eI>)8_;{;R5aVuXgyYL|1irs@Y39bMs=cTOut2PDIUp(Cs_G8gK>D>=HME^{%n_NH5UTCV2TB8zEz8#C= zsyW;GO;pm>W`6Wzx}%D8P) zOukOEe7f}bieR282QGKUYHTU!zq~c3-gfgz-!<2NY_q$jCu%r1b1M7c4UJk|k7Vn= zZ$2h+>i36V#lbhs7k>4RaqF5eC%@yI&AGYrKQ1?3(5o@CI^#++3%{d}*ecs`skBlRmyb-4-BvnEl!MjUEwme!8y?dl{zQ zADne-@2s$oZ@$i2Y`!*^z0k*Hy50rLsUNw!xFqV;u1OV`o>t`#Dg08L_4#3|?u?in zD`wAk()n;9p!MX@AYRYKRvBH9E_%*EvIb6G+VRd84JIs~`$_t*jJf2APwifA4R@sz z8=m!Zn_m~MKKS-V{fjTwKU@4R%+1{T>Dld+B&q#&0!wmEZ~f=oX3=TT;ZWSu-)(00 z)oIa=zn;1N^%HHA%(qAQ*&OlzEEhjNc?WNYuHBMEZcu6>lcR4+)v+WEqT1wP+*{1Ll5sd=v59KU&Xjcjbc)#je{2y<9AVXjHm z<%Wr2$(Js>wVH|VmJ*aFxJ_ z%ssd7=C!=nOSsM!WJ|BuBW75?#{OTtiS^7G_f~&?_&aaUFW3Ip2{W!gTLcek#MELfiZP}HaD%gZ|#Hf&fJZ(3j@wM~9G%m01@&wc%S=C29ce%r&S zdu2!&gY+IZ`|I;&zi;==oESXe*cweaHvR^wM=MPFX3R2_*phdT_eH6g$(ityLf3j8 z?mH2_0m3$-LT?uAeP;D!w`TFQj)qnBN@@C6vJD!8npVG^B Ibhifs0O;!!MF0Q* literal 0 HcmV?d00001 diff --git a/secrets-git-crypt/wg_private_minipc b/secrets-git-crypt/wg_private_minipc new file mode 100644 index 0000000000000000000000000000000000000000..73a8795170ed4d79e835e6d240344812d64f5eef GIT binary patch literal 66 zcmZQ@_Y83kiVO&0sC{*+?Jq|=+XD`_x;ReeG?{bD`&R~BxqbT}V~vZ2>&-rauXfLh YPQBgn Date: Thu, 28 May 2026 15:16:54 +0200 Subject: [PATCH 2/3] update --- nix/modules/caddy/default.nix | 2 +- nix/modules/immich/default.nix | 5 +++++ nix/modules/prometheus/default.nix | 7 +++++++ nix/nixpkgs.json | 4 ++-- 4 files changed, 15 insertions(+), 3 deletions(-) diff --git a/nix/modules/caddy/default.nix b/nix/modules/caddy/default.nix index 13f445e..463b85f 100644 --- a/nix/modules/caddy/default.nix +++ b/nix/modules/caddy/default.nix @@ -6,7 +6,7 @@ let "github.com/noratrieb-mirrors/certmagic-s3@v1.1.3" "github.com/sagikazarmark/caddy-fs-s3@v0.10.0" ]; - hash = "sha256-mrsiXQi+5SIA/vhRuyiPUE5EXmLgUHCC5I+L8ARFDDg="; + hash = "sha256-m5RHlrheqzoGqKQxixq+xTd2hlnCTets9zCT7aFka8g="; }; in { diff --git a/nix/modules/immich/default.nix b/nix/modules/immich/default.nix index a681d93..9d3b52c 100644 --- a/nix/modules/immich/default.nix +++ b/nix/modules/immich/default.nix @@ -10,6 +10,9 @@ enableVectors = false; enableVectorChord = true; }; + environment = { + IMMICH_TELEMETRY_INCLUDE = "all"; + }; openFirewall = true; }; @@ -26,4 +29,6 @@ local all all peer ''; }; + + networking.firewall.interfaces.wg0.allowedTCPPorts = [ 8081 8082 ]; } diff --git a/nix/modules/prometheus/default.nix b/nix/modules/prometheus/default.nix index d0e67a1..ef04088 100644 --- a/nix/modules/prometheus/default.nix +++ b/nix/modules/prometheus/default.nix @@ -85,6 +85,13 @@ scrape_interval = "1h"; static_configs = [{ targets = [ "localhost:7846" ]; }]; } + { + job_name = "immich"; + static_configs = [ + { targets = [ "minipc.local:8081" ]; labels = { server = "minipc"; }; } + { targets = [ "minipc.local:8082" ]; labels = { server = "minipc"; }; } + ]; + } ]; }; diff --git a/nix/nixpkgs.json b/nix/nixpkgs.json index 10dd445..8d760b2 100644 --- a/nix/nixpkgs.json +++ b/nix/nixpkgs.json @@ -1,6 +1,6 @@ { "nixos-25.11": { - "lastUpdated": "2026-05-10T14:35:41.703Z", - "commit": "0c88e1f2bdb93d5999019e99cb0e61e1fe2af4c5" + "lastUpdated": "2026-05-28T12:57:27.843Z", + "commit": "b77b3de8775677f84492abe84635f87b0e153f0f" } } From 1df84d34b63f53ace23f9adf07dbcc95e526e549 Mon Sep 17 00:00:00 2001 From: Noratrieb <48135649+Noratrieb@users.noreply.github.com> Date: Thu, 28 May 2026 15:21:24 +0200 Subject: [PATCH 3/3] cleanup --- minipc-config/configuration.nix | 122 -------------------------------- 1 file changed, 122 deletions(-) delete mode 100644 minipc-config/configuration.nix diff --git a/minipc-config/configuration.nix b/minipc-config/configuration.nix deleted file mode 100644 index 442b500..0000000 --- a/minipc-config/configuration.nix +++ /dev/null @@ -1,122 +0,0 @@ -# Edit this configuration file to define what should be installed on -# your system. Help is available in the configuration.nix(5) man page -# and in the NixOS manual (accessible by running ‘nixos-help’). - -{ config, pkgs, ... }: { - services.openssh.enable = true; - programs.vim.enable = true; - - imports = - [ # Include the results of the hardware scan. - ./hardware-configuration.nix - ]; - - # Bootloader. - boot.loader.systemd-boot.enable = true; - boot.loader.efi.canTouchEfiVariables = true; - - networking.hostName = "minipc"; # Define your hostname. - # networking.wireless.enable = true; # Enables wireless support via wpa_supplicant. - - # Configure network proxy if necessary - # networking.proxy.default = "http://user:password@proxy:port/"; - # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain"; - - # Enable networking - networking.networkmanager.enable = true; - - # Set your time zone. - time.timeZone = "Europe/Zurich"; - - # Select internationalisation properties. - i18n.defaultLocale = "en_US.UTF-8"; - - # Enable the X11 windowing system. - services.xserver.enable = true; - - # Enable the GNOME Desktop Environment. - services.xserver.displayManager.gdm.enable = true; - services.xserver.desktopManager.gnome.enable = true; - - # Configure keymap in X11 - services.xserver.xkb = { - layout = "ch"; - variant = ""; - }; - - # Configure console keymap - console.keyMap = "sg"; - - # Enable CUPS to print documents. - services.printing.enable = true; - - # Enable sound with pipewire. - services.pulseaudio.enable = false; - security.rtkit.enable = true; - services.pipewire = { - enable = true; - alsa.enable = true; - alsa.support32Bit = true; - pulse.enable = true; - # If you want to use JACK applications, uncomment this - #jack.enable = true; - - # use the example session manager (no others are packaged yet so this is enabled by default, - # no need to redefine it in your config for now) - #media-session.enable = true; - }; - - # Enable touchpad support (enabled default in most desktopManager). - # services.xserver.libinput.enable = true; - - # Define a user account. Don't forget to set a password with ‘passwd’. - users.users.nora = { - isNormalUser = true; - description = "nora"; - extraGroups = [ "networkmanager" "wheel" ]; - packages = with pkgs; [ - # thunderbird - ]; - }; - - # Install firefox. - programs.firefox.enable = true; - - # Allow unfree packages - nixpkgs.config.allowUnfree = true; - - # List packages installed in system profile. To search, run: - # $ nix search wget - environment.systemPackages = with pkgs; [ - # vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default. - # wget - ]; - - # Some programs need SUID wrappers, can be configured further or are - # started in user sessions. - # programs.mtr.enable = true; - # programs.gnupg.agent = { - # enable = true; - # enableSSHSupport = true; - # }; - - # List services that you want to enable: - - # Enable the OpenSSH daemon. - # services.openssh.enable = true; - - # Open ports in the firewall. - # networking.firewall.allowedTCPPorts = [ ... ]; - # networking.firewall.allowedUDPPorts = [ ... ]; - # Or disable the firewall altogether. - # networking.firewall.enable = false; - - # This value determines the NixOS release from which the default - # settings for stateful data, like file locations and database versions - # on your system were taken. It‘s perfectly fine and recommended to leave - # this value at the release version of the first install of this system. - # Before changing this value read the documentation for this option - # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html). - system.stateVersion = "25.05"; # Did you read the comment? - -}