rename virtual machine folder

virtual-machines/.sops.yaml

@@ -0,0 +1,14 @@
+keys:
+  hosts:
+    - &laptop age1zad0qu648dhjav4pzjhkc6vswnqtacuv9230xcgle8wmv56r8ykqn0ud7y
+    - &desktop age1rwugh86469664fwhgrj9xuhjxs9vpflx3r0ftuvd0glphf2gecfs8thxsj
+    - &nixos-homelab-00 age16ht8xkm70pmhl28m6g5fr3gl7xtsec37y57wauee6jqu06678ctqfw87ml
+    - &nixos-homelab-00-user age1hzaf8j6djfc4yc98m3kqjzzdj4tcskf9kdzvjmje2xuqcfmrz5lqdtn5w7
+creation_rules:
+  - path_regex: '.*/secrets/[^/]+\.(yaml|json|env|ini)$'
+    key_groups:
+      - age:
+          - *laptop
+          - *desktop
+          - *nixos-homelab-00
+          - *nixos-homelab-00-user

virtual-machines/vm-test/flake.lock

@@ -0,0 +1,79 @@
+{
+  "nodes": {
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1789542786,
+        "narHash": "sha256-ajQuqcxnj6RYnwCjA/9FTCnrdR2+BDzstE8UembXf60=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "4c7870105e7f1fdf9c48688c8d7efc21abf0688a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-26.05",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1789114715,
+        "narHash": "sha256-ugpsyk3NM2s87vXfUiIIiibbJ4Pp0JPS5p/3mfs+q+c=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "21a67dc470149f337cecafbe965d8d252a390518",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-26.05",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "postgresql-db": {
+      "inputs": {
+        "nixpkgs": "nixpkgs_2"
+      },
+      "locked": {
+        "path": "../../homelab-services/postgresql-db",
+        "type": "path"
+      },
+      "original": {
+        "path": "../../homelab-services/postgresql-db",
+        "type": "path"
+      },
+      "parent": []
+    },
+    "root": {
+      "inputs": {
+        "nixpkgs": "nixpkgs",
+        "postgresql-db": "postgresql-db",
+        "sops-nix": "sops-nix"
+      }
+    },
+    "sops-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1789691124,
+        "narHash": "sha256-k+I+R6uwHX3VcJ7326qLV6vCahZUgsVl+i8sSU/Stxk=",
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "rev": "1e73e8f7176d65e1b55e324de099bbfff4b2c574",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "type": "github"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

virtual-machines/vm-test/flake.nix

@@ -0,0 +1,30 @@
+{
+  description = "Flake to run services on a VM powered by incus";
+
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05";
+    postgresql-db.url = "path:../../homelab-services/postgresql-db";
+  };
+
+  outputs =
+    {
+      self,
+      nixpkgs,
+      sops-nix,
+      postgresql-db,
+    }@inputs:
+    {
+      nixosConfigurations = {
+        vm = nixpkgs.lib.nixosSystem {
+          system = "x86_64-linux";
+          modules = [
+            ./virtual.nix
+            postgresql-db.nixosModules.postgresql-db
+
+            # declare the vm output
+            "${inputs.nixpkgs}/nixos/modules/virtualisation/incus-virtual-machine.nix"
+          ];
+        };
+      };
+    };
+}

virtual-machines/vm-test/secrets/psql.yaml

@@ -0,0 +1,43 @@
+credentials: ENC[AES256_GCM,data:T/Kzi6zxovx5/xFZ9RU5g8qrCs+g7O2CNyRmpHbNLQ==,iv:ZExSJqPOq5u+YCAbFnqkonhMC47LQYFkRYwe6d799e0=,tag:mZ0WQaMMTBnUwlsOs/dS4Q==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4UitrR2Y3WitTK3BNN3l4
+            anBRMnBmNnlsSnFYMzZSTkorTXdhMzMrQlQ4Ck1hbExpcEhUdlNwRkZUcDlQTmYy
+            WG9OaVFQVVhnc25TWkdwYysvd1VOSWcKLS0tIFBDZmlRNjc1VFRXR1JoR09TOWI4
+            R0h3QkNSRDZjNDlSQkZhMjRUcy9CK3cKDW65gGvBAWVfd1ir2ri3Kd+ISESCAZB6
+            B45JhFGzbi0DZ6OY1ehVT7cQZBnz9pBDw7I/mcu5Rx1kvYkxPRgFAg==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1zad0qu648dhjav4pzjhkc6vswnqtacuv9230xcgle8wmv56r8ykqn0ud7y
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaRFJRTkszTnNUbGF6aG5m
+            RW1PTzBzMEdBT1Q2RFpoc1BnNi9MNFVFdFZZCkpKanNaUURSNStxQ3NKQWtjUi9N
+            QlVKeWFacUVXdjRzSHVPazFCODRPbjAKLS0tIDdhN1NSTUJseFNaVTJOZTY5MmhM
+            TGVqa0V6WnprZlhrOC9oS2I3WVBiVjQKTQ/7m3lg5YwcSdyanuqHsPwyoDJdrfRc
+            XX+vVpPChmM5Mne/Bgb6TyLqYuhj0vcd748rnoVmRGBIvGE9xBtCbg==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1rwugh86469664fwhgrj9xuhjxs9vpflx3r0ftuvd0glphf2gecfs8thxsj
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyOVErNmJXRUxZQ0Q3eHd6
+            VitvY0R1clMxenpKUnhYeUt2ekI1YkozWWhRCmppOSs0c1ZUdW5LL1p0WElLRnRz
+            MmFVYW5hRXJya3hyMzFxVzBpUFVJOVUKLS0tIGtPYjliMWpYS1hMYmpaenM1YVRo
+            UDBHS1JPRXNhdlRWU01xNDJuQUk2RlkK8nLganJJZR4OkhtjDuQEIERV+HBrZkso
+            6ikhW5GMtxyMur8Wj9PoF+98EU3qn9qmLeXrLeB/xgLtCp39bi+6Vg==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age16ht8xkm70pmhl28m6g5fr3gl7xtsec37y57wauee6jqu06678ctqfw87ml
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZU0JxUmJBQ1pweWJkVjln
+            OUlsZkhuVjgxQnQ3N3RIcjdUZ1JzblNLS1ZrClozOHZNNlh0clBxSzd5SGpoN1Vj
+            Nm5ydkg4K1RiTWczSDE3SWV0SjEvMDAKLS0tIGNJL3dpMHpsaWl6dnVCRVdMTXg0
+            NFU4QkhrVWFGdlhpVGkzcE9vVGNIc3cKiM41U2ctBiHgrIGPb3ApoAcqgcls0Sjp
+            Wlwsl8I8AwyUYcuLBGTk8WvXRpJI598im/54tZ8sPa7tmokOOilF7w==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1hzaf8j6djfc4yc98m3kqjzzdj4tcskf9kdzvjmje2xuqcfmrz5lqdtn5w7
+    lastmodified: "2026-09-18T02:51:05Z"
+    mac: ENC[AES256_GCM,data:Cz1+2ZKOZPX58lHM+U0JyHiSaOO3hzH4FzyxepksuAZNxFCZt8EtsXx99Afb4VCYid3+BWfmwAfd2XAgD0UR3rBCm6BwPd0wujOvv5YpZaDYKHcqVn8JaTuxQldDCArnf0Duks2iAyw6HCgL9LHABX3JRoQgNvz9Kp6oYW1Fsjk=,iv:HBTNsUL5O1YYqADvJfY4Kz1rCbDHHtuDffM2Y7AAXo4=,tag:CpCSMvCVKHT6FohctSOD/g==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.3

virtual-machines/vm-test/virtual.nix

@@ -0,0 +1,86 @@
+{
+  config,
+  pkgs,
+  meta,
+  ...
+}:
+{
+
+  nix.settings.experimental-features = [
+    "nix-command"
+    "flakes"
+  ];
+
+  nixpkgs.config.allowUnfree = true;
+
+  # Allow login and remote control of VM
+  users.users.admin = {
+    isNormalUser = true;
+    hashedPassword = "$y$j9T$WI7E.NXw4qar1DXodrVWG/$gUErw1R6W8k1UFm49C5.vEc9MT5RcKW0BKitURNqbl/";
+    extraGroups = [ "wheel" ];
+
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAcofS7u0BYzRBn0i4RuXPHWpnvk3nEbGo9B9ghsR4oL roydumblauskas@gmail.com"
+    ];
+  };
+
+  # Don't allow password login
+  services.openssh = {
+    enable = true;
+
+    settings = {
+      PasswordAuthentication = false;
+      KbdInteractiveAuthentication = false;
+    };
+  };
+
+  # Packages
+  environment.systemPackages = with pkgs; [
+    curl
+    kitty
+    kubectl
+    nginx
+    tmux
+    vim
+    wget
+  ];
+
+  # ================================ #
+  #            K3S SERVICE           #
+  # ================================ #
+
+  services.k3s = {
+    enable = true;
+    disable = [ "traefik" ];
+    role = "server";
+
+    # only enable the service on k3s when roughly finalized
+    # Until then use a vm, as k3s is persisted
+    extraFlags = [
+      "--data-dir=/var/lib/rancher/k3s"
+      "--cluster-cidr=10.42.0.0/20"
+    ];
+  };
+
+  # ================================ #
+  #           PSQL SERVICE           #
+  # ================================ #
+
+  # Postgresql/postgrest for row storage (not on k3s)
+  services.postgresql-db = {
+    enable = true;
+    dataDir = "/var/lib/postgresql";
+    port = 5432;
+    credentialsFile = "";
+    databases = [
+      "test"
+    ];
+    ipMasks = [
+      "10.42.0.0/20" # k3s pod mask
+    ];
+  };
+
+  # To stop the complaining
+  system.stateVersion = "26.05";
+
+}