update gitea

homelab-services/gitea/flake.lock

@@ -2,11 +2,11 @@
   "nodes": {
     "nixpkgs": {
       "locked": {
-        "lastModified": 1787525875,
+        "lastModified": 1790340521,
-        "narHash": "sha256-sKbMlkDCBVmAjUVT94LwhVtET/YEMtZaFdn5UduWxz8=",
+        "narHash": "sha256-cRrWlIjVRJ6BHDr9caUdXsZ3owzWIKYHpNmGPHBInIU=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "a3b98866eecd08edac6e61a3081e69540a35020f",
+        "rev": "f5c082a40f7571c266e74e80ae2e68aadd8a9fc7",
         "type": "github"
       },
       "original": {

homelab-services/gitea/k3s/deployment.yaml

@@ -19,7 +19,7 @@ spec:
     spec:
       containers:
         - name: gitea
-          image: docker.gitea.com/gitea:1.27.2
+          image: docker.gitea.com/gitea:1.27.3
 
           ports:
             - name: http

test-vms/vm-test/flake.nix

@@ -4,10 +4,6 @@
   inputs = {
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05";
     postgresql-db.url = "path:../../homelab-services/postgresql-db";
-    sops-nix = {
-      url = "github:Mic92/sops-nix";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
   };
 
   outputs =
@@ -24,7 +20,6 @@
           modules = [
             ./virtual.nix
             postgresql-db.nixosModules.postgresql-db
-            sops-nix.nixosModules.sops
 
             # declare the vm output
             "${inputs.nixpkgs}/nixos/modules/virtualisation/incus-virtual-machine.nix"

test-vms/vm-test/virtual.nix

@@ -4,6 +4,10 @@
   meta,
   ...
 }:
+# Decrypt credentials to use in VM
+# This exposes them in the VM. Images should be considered 'confidential'
+# Though all secrets here should really only be able to access things inside the VM
+
 {
 
   nix.settings.experimental-features = [
@@ -44,33 +48,6 @@
     wget
   ];
 
-  # ================================ #
-  #               SOPS               #
-  # ================================ #
-
-  sops = {
-    # make sure that the age key is generated from the persisted host key
-    age = {
-      sshKeyPaths = [ "/persist/etc/ssh/ssh_host_ed25519_key" ];
-      keyFile = "/persist/var/lib/sops-nix/key.txt";
-      generateKey = true;
-    };
-
-    defaultSopsFormat = "yaml";
-
-    secrets = {
-      "postgresql-credentials" = {
-        sopsFile = ./secrets/psql.yaml;
-        key = "credentials";
-        format = "yaml";
-        owner = "postgres";
-        group = "postgres";
-      };
-    };
-  };
-
-  systemd.user.services.mbsync.unitConfig.After = [ "sops-nix.service" ];
-
   # ================================ #
   #            K3S SERVICE           #
   # ================================ #
@@ -97,7 +74,7 @@
     enable = true;
     dataDir = "/var/lib/postgresql";
     port = 5432;
-    credentialsFile = config.sops.secrets."postgresql-credentials".path;
+    credentialsFile = "";
     databases = [
       "test"
     ];