update gitea

test-vms/vm-test/flake.nix

@@ -4,10 +4,6 @@
   inputs = {
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05";
     postgresql-db.url = "path:../../homelab-services/postgresql-db";
-    sops-nix = {
-      url = "github:Mic92/sops-nix";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
   };
 
   outputs =
@@ -24,7 +20,6 @@
           modules = [
             ./virtual.nix
             postgresql-db.nixosModules.postgresql-db
-            sops-nix.nixosModules.sops
 
             # declare the vm output
             "${inputs.nixpkgs}/nixos/modules/virtualisation/incus-virtual-machine.nix"

test-vms/vm-test/virtual.nix

@@ -4,6 +4,10 @@
   meta,
   ...
 }:
+# Decrypt credentials to use in VM
+# This exposes them in the VM. Images should be considered 'confidential'
+# Though all secrets here should really only be able to access things inside the VM
+
 {
 
   nix.settings.experimental-features = [
@@ -44,33 +48,6 @@
     wget
   ];
 
-  # ================================ #
-  #               SOPS               #
-  # ================================ #
-
-  sops = {
-    # make sure that the age key is generated from the persisted host key
-    age = {
-      sshKeyPaths = [ "/persist/etc/ssh/ssh_host_ed25519_key" ];
-      keyFile = "/persist/var/lib/sops-nix/key.txt";
-      generateKey = true;
-    };
-
-    defaultSopsFormat = "yaml";
-
-    secrets = {
-      "postgresql-credentials" = {
-        sopsFile = ./secrets/psql.yaml;
-        key = "credentials";
-        format = "yaml";
-        owner = "postgres";
-        group = "postgres";
-      };
-    };
-  };
-
-  systemd.user.services.mbsync.unitConfig.After = [ "sops-nix.service" ];
-
   # ================================ #
   #            K3S SERVICE           #
   # ================================ #
@@ -97,7 +74,7 @@
     enable = true;
     dataDir = "/var/lib/postgresql";
     port = 5432;
-    credentialsFile = config.sops.secrets."postgresql-credentials".path;
+    credentialsFile = "";
     databases = [
       "test"
     ];