add gc

.gitignore

@@ -1,3 +1,4 @@
 server-info.txt
 nixos/out
 nixos/error
+virtual-machines/*/result

homelab-services/gitea/flake.lock

@@ -2,11 +2,11 @@
   "nodes": {
     "nixpkgs": {
       "locked": {
-        "lastModified": 1787525875,
-        "narHash": "sha256-sKbMlkDCBVmAjUVT94LwhVtET/YEMtZaFdn5UduWxz8=",
+        "lastModified": 1791883866,
+        "narHash": "sha256-yvkDdToRZ4IgPc9tSBzzCYJvTLf8n5eE3rgUkpCuD5A=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "a3b98866eecd08edac6e61a3081e69540a35020f",
+        "rev": "a033e66ab94a6bedf2c3d58d93a36319d3cbbbaf",
         "type": "github"
       },
       "original": {

homelab-services/gitea/k3s/deployment.yaml

@@ -19,7 +19,7 @@ spec:
     spec:
       containers:
         - name: gitea
-          image: docker.gitea.com/gitea:1.27.2
+          image: docker.gitea.com/gitea:28.1.0
 
           ports:
             - name: http
@@ -34,6 +34,9 @@ spec:
             - name: GITEA__database__DB_TYPE
               value: postgres
 
+            - name: GITEA__ui__SHOW_USER_EMAIL
+              value: "false"
+
             - name: GITEA__database__HOST
               value: '{{ (datasource "config").db_hostname }}'
 

homelab-services/mc-service/flake.lock

@@ -23,11 +23,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1782091909,
-        "narHash": "sha256-q9ygpiowWPeS/FzBz7gekF4uUamJSXH/TTMf4y0j23I=",
+        "lastModified": 1792037708,
+        "narHash": "sha256-GRr9/PgqxNUJ85rvRqkwuogkB+ZQ7ZmVRFlUKZH8qEg=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "794884dacd31b251bce5abf2cf324be3659d5322",
+        "rev": "d2cfe9817846307f4046dd273d847975f5ef02fd",
         "type": "github"
       },
       "original": {
@@ -54,11 +54,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1781808408,
-        "narHash": "sha256-0sOb6OIaD/K1zHxBhpmlKvkADfe0n8+l4Jj2e1Q0r3w=",
+        "lastModified": 1791883866,
+        "narHash": "sha256-yvkDdToRZ4IgPc9tSBzzCYJvTLf8n5eE3rgUkpCuD5A=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "e8210c649915deed7080033cdbabcc19e40bb899",
+        "rev": "a033e66ab94a6bedf2c3d58d93a36319d3cbbbaf",
         "type": "github"
       },
       "original": {

homelab-services/mc-service/flake.nix

@@ -82,8 +82,6 @@
                 motd = "Home MC Server";
                 white-list = true;
                 spawn-protection = 0;
-                enable-rcon = true;
-                "rcon.password" = "CHANGE_THIS_SECRET";
               };
 
               package = pkgs.fabricServers.fabric-26_2.override {

homelab-services/minio-service/flake.lock

@@ -1,27 +0,0 @@
-{
-  "nodes": {
-    "nixpkgs": {
-      "locked": {
-        "lastModified": 1781216227,
-        "narHash": "sha256-9mUW6gNwoN2SWc/l0fW4svPNOulXLl8ijqKyeSOGgJE=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "a0374025a863d007d98e3297f6aa46cc3141c2f0",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-26.05",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "root": {
-      "inputs": {
-        "nixpkgs": "nixpkgs"
-      }
-    }
-  },
-  "root": "root",
-  "version": 7
-}

homelab-services/minio-service/flake.nix

@@ -1,245 +0,0 @@
-{
-  description = "minio service for storing images with api access";
-
-  inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05";
-  };
-
-  outputs =
-    { ... }:
-    {
-      nixosModules.minio-service =
-        {
-          config,
-          lib,
-          pkgs,
-          ...
-        }:
-        let
-          opts = config.services.minio-service;
-        in
-        {
-          options.services.minio-service = {
-            enable = lib.mkEnableOption "MinIO object storage server";
-
-            dataDir = lib.mkOption {
-              type = lib.types.path;
-              default = "/var/lib/minio";
-              description = "Directory to store MinIO data.";
-            };
-
-            dataPort = lib.mkOption {
-              type = lib.types.port;
-              default = 9000;
-              description = "MinIO S3 API port.";
-            };
-
-            consolePort = lib.mkOption {
-              type = lib.types.port;
-              default = 9001;
-              description = "MinIO Admin Console port.";
-            };
-
-            credentialsFile = lib.mkOption {
-              type = lib.types.path;
-              description = "File containing MinIO credentials.";
-            };
-
-            bootstrap-minio = {
-              enable = lib.mkEnableOption "Enable bootstrapping minio creds";
-              environments = lib.mkOption {
-                type = lib.types.listOf lib.types.str;
-                default = [ ];
-                description = "list of environments to bootstrap (dev, prod, stage, etc)";
-              };
-            };
-
-            default-nginx = {
-              enable = lib.mkEnableOption "Enable nginx reverse proxy for MinIO";
-              hostname = lib.mkOption {
-                type = lib.types.str;
-                default = "localhost";
-                description = "Hostname for nginx reverse proxy.";
-              };
-            };
-          };
-
-          config = lib.mkIf opts.enable {
-            users.groups.minio = { };
-            users.users.minio = {
-              isSystemUser = true;
-              createHome = true;
-              home = "${opts.dataDir}";
-              group = "minio";
-            };
-
-            systemd.services.minio = {
-              description = "MinIO S3-compatible object storage";
-              after = [ "network.target" ];
-              wantedBy = [ "multi-user.target" ];
-
-              serviceConfig = {
-                ExecStart = ''
-                  ${pkgs.minio}/bin/minio server ${opts.dataDir} \
-                    --address ":${toString opts.dataPort}" \
-                    --console-address ":${toString opts.consolePort}"
-                '';
-
-                User = "minio";
-                Group = "minio";
-                # This breaks the local browser access
-                # Environment = ''
-                #   MINIO_BROWSER_REDIRECT_URL=https://${opts.default-nginx.hostname}/console
-                # '';
-                EnvironmentFile = "${opts.credentialsFile}";
-                Restart = "always";
-              };
-            };
-
-            systemd.services.bootstrap-minio = lib.mkIf opts.bootstrap-minio.enable {
-              description = "Minio bootstrap users, policies, buckets";
-              after = [ "minio.service" ];
-              requires = [ "minio.service" ];
-              wantedBy = [ "multi-user.target" ];
-
-              serviceConfig = {
-                Type = "oneshot";
-                ExecStart = pkgs.writeShellScript "bootstrap-minio" ''
-
-                                  set -euo pipefail
-
-                                  alias_name="local"
-                                  mc_bin=${pkgs.minio-client}/bin/mc
-
-                                  # Delete alias if it already exists
-                                  $mc_bin alias rm "$alias_name" || true
-
-                                  # Point mc at the local minio instance
-                                  $mc_bin alias set "$alias_name" http://localhost:${toString opts.dataPort} \
-                                    "$MINIO_ROOT_USER" "$MINIO_ROOT_PASSWORD"
-
-                                  # Loop through requested environments
-                                  for env in ${lib.escapeShellArgs opts.bootstrap-minio.environments}; do
-                                    bucket="$env"
-                                    user_var="MINIO_''${env^^}_USER"
-                                    pass_var="MINIO_''${env^^}_PASSWORD"
-
-                                    # expand env var names dynamically
-                                    user_val=$(eval "echo \''${$user_var:-}")
-                                    pass_val=$(eval "echo \''${$pass_var:-}")
-
-                                    if [ -z "$user_val" ] || [ -z "$pass_val" ]; then
-                                      echo "Missing credentials for $env ($user_var / $pass_var)" >&2
-                                      exit 1
-                                    fi
-
-                                    policy="policy-$env"
-
-                                    echo "Bootstrapping environment: $env"
-
-                                    # Create bucket if not exists
-                                    $mc_bin mb --ignore-existing "$alias_name/$bucket"
-
-                                    # Set bucket limit in future
-                                    # $mc_bin bucket quota is deprecated
-
-                                    # Create policy JSON (full access to that bucket)
-                                    policy_file=$(mktemp)
-                                    cat > "$policy_file" <<EOF
-                  {
-                    "Version": "2012-10-17",
-                    "Statement": [
-                      {
-                        "Effect": "Allow",
-                        "Action": ["s3:*"],
-                        "Resource": [
-                          "arn:aws:s3:::$bucket",
-                          "arn:aws:s3:::$bucket/*"
-                        ]
-                      }
-                    ]
-                  }
-                  EOF
-
-                                    # Apply policy
-                                    $mc_bin admin policy create "$alias_name" "$policy" "$policy_file"
-
-                                    # Create or update user
-                                    if ! $mc_bin admin user info "$alias_name" "$user_val" >/dev/null 2>&1; then
-                                      $mc_bin admin user add "$alias_name" "$user_val" "$pass_val"
-                                      echo "Created user $user_val"
-                                    fi
-
-                                    # Attach policy
-                                    $mc_bin admin policy attach "$alias_name" "$policy" --user "''${user_val}"
-
-                                    # Cleanup
-                                    rm -f "$policy_file"
-
-                                  done
-                '';
-                User = "minio";
-                Group = "minio";
-                EnvironmentFile = "${opts.credentialsFile}";
-
-              };
-            };
-
-            services.nginx = lib.mkIf opts.default-nginx.enable {
-              enable = true;
-
-              virtualHosts.${opts.default-nginx.hostname} = {
-                forceSSL = true;
-
-                # Parse TLD from hostname to use wildcard cert (just takes last two elements separated by a period)
-                useACMEHost =
-                  let
-                    b = builtins;
-                    s = lib.strings;
-                    fl = s.splitString "." "${opts.default-nginx.hostname}";
-                  in
-                  b.concatStringsSep "." [
-                    (b.elemAt fl (b.length fl - 2))
-                    (b.elemAt fl (b.length fl - 1))
-                  ];
-
-                # This does not work even with the MINIO_BROWSER_REDIRECT_URL set
-                locations."/console" = {
-                  proxyPass = "http://localhost:${toString opts.consolePort}";
-                  extraConfig = ''
-                    proxy_set_header Host $host;
-                    proxy_set_header X-Real-IP $remote_addr;
-                    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-                    proxy_set_header X-Forwarded-Proto $scheme;
-                  '';
-                };
-
-                # Add directive for s3like queries, which only accept root path allegedly
-                locations."/" = {
-                  proxyPass = "http://localhost:${toString opts.dataPort}";
-                  extraConfig = ''
-                    proxy_set_header Host $host;
-                    proxy_set_header X-Real-IP $remote_addr;
-                    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-                    proxy_set_header X-Forwarded-Proto $scheme;
-                    client_max_body_size 0;
-                    proxy_buffering off;
-                  '';
-                };
-              };
-            };
-
-            networking.firewall.allowedTCPPorts = lib.mkMerge [
-              (lib.mkIf opts.enable [
-                opts.dataPort
-                opts.consolePort
-              ])
-              (lib.mkIf opts.default-nginx.enable [
-                80
-                443
-              ])
-            ];
-          };
-        };
-    };
-}

homelab-services/nimh-static/flake.lock

@@ -2,11 +2,11 @@
   "nodes": {
     "nixpkgs": {
       "locked": {
-        "lastModified": 1781216227,
-        "narHash": "sha256-9mUW6gNwoN2SWc/l0fW4svPNOulXLl8ijqKyeSOGgJE=",
+        "lastModified": 1791883866,
+        "narHash": "sha256-yvkDdToRZ4IgPc9tSBzzCYJvTLf8n5eE3rgUkpCuD5A=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "a0374025a863d007d98e3297f6aa46cc3141c2f0",
+        "rev": "a033e66ab94a6bedf2c3d58d93a36319d3cbbbaf",
         "type": "github"
       },
       "original": {

homelab-services/postgresql-db/flake.lock

@@ -2,11 +2,11 @@
   "nodes": {
     "nixpkgs": {
       "locked": {
-        "lastModified": 1789114715,
-        "narHash": "sha256-ugpsyk3NM2s87vXfUiIIiibbJ4Pp0JPS5p/3mfs+q+c=",
+        "lastModified": 1791883866,
+        "narHash": "sha256-yvkDdToRZ4IgPc9tSBzzCYJvTLf8n5eE3rgUkpCuD5A=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "21a67dc470149f337cecafbe965d8d252a390518",
+        "rev": "a033e66ab94a6bedf2c3d58d93a36319d3cbbbaf",
         "type": "github"
       },
       "original": {

nixos/configuration.nix

@@ -7,10 +7,20 @@
 {
   imports = [ ];
 
-  nix.settings.experimental-features = [
-    "nix-command"
-    "flakes"
-  ];
+  nix = {
+    settings.experimental-features = [
+      "nix-command"
+      "flakes"
+    ];
+
+    gc = {
+      automatic = true;
+      persistent = true;
+      dates = [ "daily" ];
+      options = "--delete-older-than 7d";
+    };
+  };
+
   nixpkgs.config.allowUnfree = true;
 
   # Secret Management
@@ -206,6 +216,11 @@
   # Init with `incus admin init --minimal`
   virtualisation.incus.enable = true;
 
+  # allow sandboxes to see my temp keys
+  nix.settings.extra-sandbox-paths = [
+    "/run/sops-virtual-key.txt=/run/sops-virtual/virtual-key.txt"
+  ];
+
   networking = {
     hostName = meta.hostname;
     hostId = meta.hostId;
@@ -220,8 +235,6 @@
       enable = true;
       allowedTCPPorts = [
         22
-        80
-        443
         6443 # k3s
       ];
 
@@ -274,6 +287,7 @@
       "/var/lib/nixos"
       "/var/db/sudo/lectured"
       "/var/lib/acme"
+      "/run/sops-virtual"
     ];
   };
 
@@ -320,6 +334,12 @@
         path = "/persist/etc/ssh/ssh_host_rsa_key";
       }
     ];
+
+    # Don't allow remote password login
+    settings = {
+      PasswordAuthentication = false;
+      KbdInteractiveAuthentication = false;
+    };
   };
 
   # INITIAL system version

nixos/flake.lock

@@ -7,11 +7,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1781152676,
-        "narHash": "sha256-RxWs5ND31KzTG7wvMM+PMfUjyNpmIEr999lqNARaM5o=",
+        "lastModified": 1789770686,
+        "narHash": "sha256-uZkBR7yHdIKUFB5SZdfgh1qkGfI3XmYmI/lTiquxbck=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "ff8702b4de27f72b4c78573dfb89ec74e36abdf1",
+        "rev": "725ea35e410ad83be4931d1bff7e090eacaf3563",
         "type": "github"
       },
       "original": {
@@ -28,11 +28,11 @@
       },
       "locked": {
         "dir": "pkgs/firefox-addons",
-        "lastModified": 1789185767,
-        "narHash": "sha256-jaWL9beN3ifjNzNEBxo0abA+TSi0n7Q8LRQvZTxEqaM=",
+        "lastModified": 1792036980,
+        "narHash": "sha256-y28wLbzsIbBDeToXHhAdoTs+lcH/d7/1Pky40N6/CoI=",
         "owner": "rycee",
         "repo": "nur-expressions",
-        "rev": "811170bb74b11f3b9489618ce77487cc58c79067",
+        "rev": "cbf0380669792dd8f6dbb891d3be33aae8fa4625",
         "type": "gitlab"
       },
       "original": {
@@ -81,7 +81,9 @@
     },
     "gitea": {
       "inputs": {
-        "nixpkgs": "nixpkgs"
+        "nixpkgs": [
+          "nixpkgs"
+        ]
       },
       "locked": {
         "path": "../homelab-services/gitea",
@@ -100,11 +102,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1789182507,
-        "narHash": "sha256-9nt4W0HNNP84B+b37yRs9Zxat1ZR5guJxEZDEjAgex4=",
+        "lastModified": 1791938526,
+        "narHash": "sha256-yNYK2pdk3bCtJrpblrNYA6hZKdybWUeyTtx74+OEJFo=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "b1d1b60084970f9d1e2b72662639dab6d039be71",
+        "rev": "32904dfe1cf86039f3c8c9f41f94e1cfd76dbb34",
         "type": "github"
       },
       "original": {
@@ -138,7 +140,7 @@
     "impermanence": {
       "inputs": {
         "home-manager": "home-manager_2",
-        "nixpkgs": "nixpkgs_2"
+        "nixpkgs": "nixpkgs"
       },
       "locked": {
         "lastModified": 1769548169,
@@ -157,7 +159,9 @@
     "mc-service": {
       "inputs": {
         "nix-minecraft": "nix-minecraft",
-        "nixpkgs": "nixpkgs_4"
+        "nixpkgs": [
+          "nixpkgs"
+        ]
       },
       "locked": {
         "path": "../homelab-services/mc-service",
@@ -171,7 +175,9 @@
     },
     "nimh-static": {
       "inputs": {
-        "nixpkgs": "nixpkgs_5"
+        "nixpkgs": [
+          "nixpkgs"
+        ]
       },
       "locked": {
         "path": "../homelab-services/nimh-static",
@@ -186,15 +192,15 @@
     "nix-minecraft": {
       "inputs": {
         "flake-compat": "flake-compat",
-        "nixpkgs": "nixpkgs_3",
+        "nixpkgs": "nixpkgs_2",
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1782091909,
-        "narHash": "sha256-q9ygpiowWPeS/FzBz7gekF4uUamJSXH/TTMf4y0j23I=",
+        "lastModified": 1792037708,
+        "narHash": "sha256-GRr9/PgqxNUJ85rvRqkwuogkB+ZQ7ZmVRFlUKZH8qEg=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "794884dacd31b251bce5abf2cf324be3659d5322",
+        "rev": "d2cfe9817846307f4046dd273d847975f5ef02fd",
         "type": "github"
       },
       "original": {
@@ -204,22 +210,6 @@
       }
     },
     "nixpkgs": {
-      "locked": {
-        "lastModified": 1787525875,
-        "narHash": "sha256-sKbMlkDCBVmAjUVT94LwhVtET/YEMtZaFdn5UduWxz8=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "a3b98866eecd08edac6e61a3081e69540a35020f",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-26.05",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_2": {
       "locked": {
         "lastModified": 1768564909,
         "narHash": "sha256-Kell/SpJYVkHWMvnhqJz/8DqQg2b6PguxVWOuadbHCc=",
@@ -235,7 +225,7 @@
         "type": "github"
       }
     },
-    "nixpkgs_3": {
+    "nixpkgs_2": {
       "locked": {
         "lastModified": 1769461804,
         "narHash": "sha256-msG8SU5WsBUfVVa/9RPLaymvi5bI8edTavbIq3vRlhI=",
@@ -251,77 +241,29 @@
         "type": "github"
       }
     },
+    "nixpkgs_3": {
+      "locked": {
+        "lastModified": 1791883866,
+        "narHash": "sha256-yvkDdToRZ4IgPc9tSBzzCYJvTLf8n5eE3rgUkpCuD5A=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "a033e66ab94a6bedf2c3d58d93a36319d3cbbbaf",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-26.05",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
     "nixpkgs_4": {
       "locked": {
-        "lastModified": 1781808408,
-        "narHash": "sha256-0sOb6OIaD/K1zHxBhpmlKvkADfe0n8+l4Jj2e1Q0r3w=",
+        "lastModified": 1789749394,
+        "narHash": "sha256-cFTsMQz8Hzn8MT49oaeLSHg62tE86NykugCWkeM2ypk=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "e8210c649915deed7080033cdbabcc19e40bb899",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-26.05",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_5": {
-      "locked": {
-        "lastModified": 1781216227,
-        "narHash": "sha256-9mUW6gNwoN2SWc/l0fW4svPNOulXLl8ijqKyeSOGgJE=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "a0374025a863d007d98e3297f6aa46cc3141c2f0",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-26.05",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_6": {
-      "locked": {
-        "lastModified": 1789114715,
-        "narHash": "sha256-ugpsyk3NM2s87vXfUiIIiibbJ4Pp0JPS5p/3mfs+q+c=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "21a67dc470149f337cecafbe965d8d252a390518",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-26.05",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_7": {
-      "locked": {
-        "lastModified": 1788405554,
-        "narHash": "sha256-r2f1oUwixlgq9zOdYLqJLfS/lWBT60/IITjhTKI59JU=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "a5cc6f2c37bf518436dc8d1c288ccd0c43c2f4c4",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-26.05",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_8": {
-      "locked": {
-        "lastModified": 1789114715,
-        "narHash": "sha256-ugpsyk3NM2s87vXfUiIIiibbJ4Pp0JPS5p/3mfs+q+c=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "21a67dc470149f337cecafbe965d8d252a390518",
+        "rev": "cf9d2fb3e50fa1cd5114c47505ea9177f7ff5f49",
         "type": "github"
       },
       "original": {
@@ -334,15 +276,15 @@
     "nixvim": {
       "inputs": {
         "flake-parts": "flake-parts",
-        "nixpkgs": "nixpkgs_7",
+        "nixpkgs": "nixpkgs_4",
         "systems": "systems_2"
       },
       "locked": {
-        "lastModified": 1788623321,
-        "narHash": "sha256-i8v07Plhfpx/nVFMvnMSC6P05RQ43mbLQsS5grni4Vk=",
+        "lastModified": 1789959143,
+        "narHash": "sha256-9oBHyJtUyunZL+6v0Ub8Y759cXcejQiTHpXtGcx5RLs=",
         "owner": "nix-community",
         "repo": "nixvim",
-        "rev": "68c2edd2787f055d9c306bcfe726f3b8f11b9441",
+        "rev": "4836e77b1798cd42e2de28593bec4c1788da08f5",
         "type": "github"
       },
       "original": {
@@ -354,7 +296,9 @@
     },
     "postgresql-db": {
       "inputs": {
-        "nixpkgs": "nixpkgs_8"
+        "nixpkgs": [
+          "nixpkgs"
+        ]
       },
       "locked": {
         "path": "../homelab-services/postgresql-db",
@@ -391,7 +335,7 @@
         "impermanence": "impermanence",
         "mc-service": "mc-service",
         "nimh-static": "nimh-static",
-        "nixpkgs": "nixpkgs_6",
+        "nixpkgs": "nixpkgs_3",
         "nixvim": "nixvim",
         "postgresql-db": "postgresql-db",
         "quasiSecrets": "quasiSecrets",
@@ -405,11 +349,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1788914643,
-        "narHash": "sha256-4GuMPW90JSxXWDPUB9M+1m7fYbe3H0apOd86/zBQ2Kw=",
+        "lastModified": 1792056300,
+        "narHash": "sha256-YU1LjDe1o2Ymg5zEiCHbmMXLkDCtxHQRiVqZ3nC5GGk=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "13616fff713a9f94055c66f15687ebdc17a335df",
+        "rev": "44931708c62937c2b1bf7953902989fa5bb9ee1b",
         "type": "github"
       },
       "original": {

nixos/flake.nix

@@ -25,12 +25,23 @@
     # This is a path to the services I've declared.
     # It just happens to be stored in the same repository (relative),
     # but could well be a separate repository
-    nimh-static.url = "path:../homelab-services/nimh-static";
-    # MINIO IS DEPRECATED, KEEPING CODE FOR REFERENCE. MOVE TO GARAGE/SEAWEEDFS
-    # minio-service.url = "path:../homelab-services/minio-service";
-    mc-service.url = "path:../homelab-services/mc-service";
-    postgresql-db.url = "path:../homelab-services/postgresql-db";
-    gitea.url = "path:../homelab-services/gitea";
+    # follow nixpkgs on all, otherwise each builds its own version ("derivation" maybe, idk)
+    nimh-static = {
+      url = "path:../homelab-services/nimh-static";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    mc-service = {
+      url = "path:../homelab-services/mc-service";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    postgresql-db = {
+      url = "path:../homelab-services/postgresql-db";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    gitea = {
+      url = "path:../homelab-services/gitea";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
   outputs =

nixos/home-manager/home.nix

@@ -12,7 +12,6 @@
 
   home.packages = with pkgs; [
     age
-    awscli2
     dig
     discord
     ffmpeg_6
@@ -24,7 +23,6 @@
     incus
     jq
     kdePackages.gwenview
-    minio-client
     nodejs_22
     postman
     prismlauncher
@@ -42,6 +40,7 @@
     woeusb
     wofi
     xrandr
+    yq
     zip
   ];
 

test-vms/vm-test/flake.nix

@@ -1,29 +0,0 @@
-{
-  description = "Flake to run services on a VM powered by incus";
-
-  inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05";
-    postgresql-db.url = "path:../homelab-services/postgresql-db";
-  };
-
-  outputs =
-    {
-      self,
-      nixpkgs,
-      postgresql-db,
-    }@inputs:
-    {
-      nixosConfigurations = {
-        virtual-env = nixpkgs.lib.nixosSystem {
-          system = "x86_64-linux";
-          modules = [
-            ./virtual.nix
-            postgresql-db.nixosModules.postgresql-db
-
-            # declare the vm output
-            "${inputs.nixpkgs}/nixos/modules/virtualisation/incus-virtual-machine.nix"
-          ];
-        };
-      };
-    };
-}

test-vms/vm-test/secrets/psql.yaml

@@ -1,43 +0,0 @@
-credentials: ENC[AES256_GCM,data:T/Kzi6zxovx5/xFZ9RU5g8qrCs+g7O2CNyRmpHbNLQ==,iv:ZExSJqPOq5u+YCAbFnqkonhMC47LQYFkRYwe6d799e0=,tag:mZ0WQaMMTBnUwlsOs/dS4Q==,type:str]
-sops:
-    age:
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4UitrR2Y3WitTK3BNN3l4
-            anBRMnBmNnlsSnFYMzZSTkorTXdhMzMrQlQ4Ck1hbExpcEhUdlNwRkZUcDlQTmYy
-            WG9OaVFQVVhnc25TWkdwYysvd1VOSWcKLS0tIFBDZmlRNjc1VFRXR1JoR09TOWI4
-            R0h3QkNSRDZjNDlSQkZhMjRUcy9CK3cKDW65gGvBAWVfd1ir2ri3Kd+ISESCAZB6
-            B45JhFGzbi0DZ6OY1ehVT7cQZBnz9pBDw7I/mcu5Rx1kvYkxPRgFAg==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1zad0qu648dhjav4pzjhkc6vswnqtacuv9230xcgle8wmv56r8ykqn0ud7y
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaRFJRTkszTnNUbGF6aG5m
-            RW1PTzBzMEdBT1Q2RFpoc1BnNi9MNFVFdFZZCkpKanNaUURSNStxQ3NKQWtjUi9N
-            QlVKeWFacUVXdjRzSHVPazFCODRPbjAKLS0tIDdhN1NSTUJseFNaVTJOZTY5MmhM
-            TGVqa0V6WnprZlhrOC9oS2I3WVBiVjQKTQ/7m3lg5YwcSdyanuqHsPwyoDJdrfRc
-            XX+vVpPChmM5Mne/Bgb6TyLqYuhj0vcd748rnoVmRGBIvGE9xBtCbg==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1rwugh86469664fwhgrj9xuhjxs9vpflx3r0ftuvd0glphf2gecfs8thxsj
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyOVErNmJXRUxZQ0Q3eHd6
-            VitvY0R1clMxenpKUnhYeUt2ekI1YkozWWhRCmppOSs0c1ZUdW5LL1p0WElLRnRz
-            MmFVYW5hRXJya3hyMzFxVzBpUFVJOVUKLS0tIGtPYjliMWpYS1hMYmpaenM1YVRo
-            UDBHS1JPRXNhdlRWU01xNDJuQUk2RlkK8nLganJJZR4OkhtjDuQEIERV+HBrZkso
-            6ikhW5GMtxyMur8Wj9PoF+98EU3qn9qmLeXrLeB/xgLtCp39bi+6Vg==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age16ht8xkm70pmhl28m6g5fr3gl7xtsec37y57wauee6jqu06678ctqfw87ml
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZU0JxUmJBQ1pweWJkVjln
-            OUlsZkhuVjgxQnQ3N3RIcjdUZ1JzblNLS1ZrClozOHZNNlh0clBxSzd5SGpoN1Vj
-            Nm5ydkg4K1RiTWczSDE3SWV0SjEvMDAKLS0tIGNJL3dpMHpsaWl6dnVCRVdMTXg0
-            NFU4QkhrVWFGdlhpVGkzcE9vVGNIc3cKiM41U2ctBiHgrIGPb3ApoAcqgcls0Sjp
-            Wlwsl8I8AwyUYcuLBGTk8WvXRpJI598im/54tZ8sPa7tmokOOilF7w==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1hzaf8j6djfc4yc98m3kqjzzdj4tcskf9kdzvjmje2xuqcfmrz5lqdtn5w7
-    lastmodified: "2026-09-18T02:51:05Z"
-    mac: ENC[AES256_GCM,data:Cz1+2ZKOZPX58lHM+U0JyHiSaOO3hzH4FzyxepksuAZNxFCZt8EtsXx99Afb4VCYid3+BWfmwAfd2XAgD0UR3rBCm6BwPd0wujOvv5YpZaDYKHcqVn8JaTuxQldDCArnf0Duks2iAyw6HCgL9LHABX3JRoQgNvz9Kp6oYW1Fsjk=,iv:HBTNsUL5O1YYqADvJfY4Kz1rCbDHHtuDffM2Y7AAXo4=,tag:CpCSMvCVKHT6FohctSOD/g==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.13.3

virtual-machines/.sops.yaml

@@ -2,8 +2,7 @@ keys:
   hosts:
     - &laptop age1zad0qu648dhjav4pzjhkc6vswnqtacuv9230xcgle8wmv56r8ykqn0ud7y
     - &desktop age1rwugh86469664fwhgrj9xuhjxs9vpflx3r0ftuvd0glphf2gecfs8thxsj
-    - &nixos-homelab-00 age16ht8xkm70pmhl28m6g5fr3gl7xtsec37y57wauee6jqu06678ctqfw87ml
-    - &nixos-homelab-00-user age1hzaf8j6djfc4yc98m3kqjzzdj4tcskf9kdzvjmje2xuqcfmrz5lqdtn5w7
+    - &nixos-homelab-00 age1hzaf8j6djfc4yc98m3kqjzzdj4tcskf9kdzvjmje2xuqcfmrz5lqdtn5w7
 creation_rules:
   - path_regex: '.*/secrets/[^/]+\.(yaml|json|env|ini)$'
     key_groups:
@@ -11,4 +10,3 @@ creation_rules:
           - *laptop
           - *desktop
           - *nixos-homelab-00
-          - *nixos-homelab-00-user

virtual-machines/build-image.sh

@@ -0,0 +1,196 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+# Usage:
+#   ./build-image.sh <vm-folder> <alias> [vmname]
+#
+# Example:
+#   ./build-image.sh vm-test nixos/custom/jellybean
+#
+# Run from anywhere; all project operations use virtual-machines/.
+
+SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+cd "$SCRIPT_DIR"
+
+if [[ $# -lt 2 || $# -gt 3 ]]; then
+    echo "Usage: $0 <vm-folder> <alias> [vmname]"
+    exit 1
+fi
+
+VM_FOLDER="$1"
+ALIAS="$2"
+VMNAME="${3:-vm}"
+
+VM_DIR="$SCRIPT_DIR/$VM_FOLDER"
+SOPS_CONFIG="$SCRIPT_DIR/.sops.yaml"
+AGE_DIR="/run/sops-virtual"
+AGE_KEY="$AGE_DIR/virtual-key.txt"
+SANDBOX_KEY="/run/sops-virtual-key.txt"
+
+for cmd in age-keygen sops yq nix incus sudo; do
+    command -v "$cmd" >/dev/null 2>&1 || {
+        echo "Missing required command: $cmd" >&2
+        exit 1
+    }
+done
+
+[[ -d "$VM_DIR" ]] || {
+    echo "VM directory not found: $VM_DIR" >&2
+    exit 1
+}
+
+[[ -f "$VM_DIR/flake.nix" ]] || {
+    echo "No flake.nix found in $VM_DIR" >&2
+    exit 1
+}
+
+[[ -f "$SOPS_CONFIG" ]] || {
+    echo "SOPS config not found: $SOPS_CONFIG" >&2
+    exit 1
+}
+
+[[ -d "$VM_DIR/secrets" ]] || {
+    echo "Secrets directory not found: $VM_DIR/secrets" >&2
+    exit 1
+}
+
+# Refuse to overwrite a key that may belong to another running build.
+if sudo test -e "$AGE_KEY"; then
+    echo "Temporary key already exists: $AGE_KEY" >&2
+    echo "Remove it or investigate the previous build before continuing." >&2
+    exit 1
+fi
+
+SOPS_BACKUP="$(mktemp)"
+AGE_TEMP="$(mktemp)"
+rm -f "$AGE_TEMP"
+
+cp -p "$SOPS_CONFIG" "$SOPS_BACKUP"
+
+CLEANED_UP=0
+
+cleanup() {
+    local status=$?
+
+    if [[ "$CLEANED_UP" -eq 1 ]]; then
+        return
+    fi
+    CLEANED_UP=1
+
+    # Restore the original SOPS configuration.
+    cp "$SOPS_BACKUP" "$SOPS_CONFIG"
+
+    # Remove the temporary recipient from encrypted secrets.
+    # Do this while the original recipients are restored.
+    if [[ -d "$VM_DIR/secrets" ]]; then
+        shopt -s nullglob
+        local secret_files=("$VM_DIR"/secrets/*)
+        shopt -u nullglob
+
+        for secret in "${secret_files[@]}"; do
+            [[ -f "$secret" ]] || continue
+            echo "Restoring SOPS recipients: ${secret#"$SCRIPT_DIR"/}"
+            if ! sops updatekeys --yes "$secret"; then
+                echo "WARNING: Failed to restore recipients in $secret" >&2
+                status=1
+            fi
+        done
+    fi
+
+    rm -f "$SOPS_BACKUP" "$AGE_TEMP"
+
+    # Remove the temporary private key after recipient metadata is restored.
+    sudo rm -f "$AGE_KEY"
+
+    echo "Temporary age key removed."
+    return "$status"
+}
+
+trap cleanup EXIT
+trap 'exit 130' INT
+trap 'exit 143' TERM
+
+echo "Generating temporary age identity..."
+
+age-keygen -o "$AGE_TEMP"
+AGE_PUBLIC_KEY="$(age-keygen -y "$AGE_TEMP")"
+
+# Make the key readable by Nix build users, but not ordinary users.
+sudo install -d -o root -g nixbld -m 0750 "$AGE_DIR"
+sudo install -o root -g nixbld -m 0440 \
+    "$AGE_TEMP" "$AGE_KEY"
+
+# Update age recipients in the SOPS creation rules temporarily.
+# Requires mikefarah/yq v4 and simple comma-separated age fields.
+export AGE_PUBLIC_KEY
+
+# Confirm at least one age key group exists.
+if ! yq -e '
+  [.creation_rules[].key_groups[] | select(.age != null)] | length > 0
+' "$SOPS_CONFIG" >/dev/null; then
+    echo "No creation_rules with key_groups.age found in .sops.yaml" >&2
+    exit 1
+fi
+
+# Add the temporary public key to each age recipient list.
+yq -y -i '
+  (.creation_rules[].key_groups[] | select(.age != null).age) |=
+    (. + [env.AGE_PUBLIC_KEY] | unique)
+' "$SOPS_CONFIG"
+
+echo "Updating SOPS recipients for secrets in $VM_FOLDER..."
+
+shopt -s nullglob
+SECRET_FILES=("$VM_DIR"/secrets/*)
+shopt -u nullglob
+
+if [[ ${#SECRET_FILES[@]} -eq 0 ]]; then
+    echo "No secret files found in $VM_DIR/secrets" >&2
+    exit 1
+fi
+
+for secret in "${SECRET_FILES[@]}"; do
+    [[ -f "$secret" ]] || continue
+    echo "Updating recipients: ${secret#"$SCRIPT_DIR"/}"
+    sops updatekeys --yes "$secret"
+done
+
+echo "Building VM metadata..."
+
+TARBALL_DIR="$(nix build \
+    "./$VM_FOLDER#nixosConfigurations.${VMNAME}.config.system.build.metadata" \
+    --print-out-paths)"
+
+TARBALL="$(find "$TARBALL_DIR" -type f -name '*.tar.xz' -print -quit)"
+
+if [[ -z "$TARBALL" ]]; then
+    echo "Could not find a .tar.xz tarball in: $TARBALL_DIR" >&2
+    exit 1
+fi
+
+echo "Metadata tarball: $TARBALL"
+
+echo "Building QEMU disk image..."
+
+QCOW2_DIR="$(nix build \
+    "./$VM_FOLDER#nixosConfigurations.${VMNAME}.config.system.build.qemuImage" \
+    --print-out-paths)"
+
+QCOW2="$QCOW2_DIR/nixos.qcow2"
+
+if [[ ! -f "$QCOW2" ]]; then
+    echo "QEMU image not found: $QCOW2" >&2
+    exit 1
+fi
+
+echo "QEMU image: $QCOW2"
+
+echo "Importing image into Incus..."
+
+incus image import \
+    --alias "$ALIAS" \
+    "$TARBALL" \
+    "$QCOW2"
+
+echo "Successfully imported image: $ALIAS"
+

virtual-machines/vm-test/flake.lock

@@ -1,28 +1,28 @@
 {
   "nodes": {
-    "nixpkgs": {
+    "gitea": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
       "locked": {
-        "lastModified": 1789344334,
-        "narHash": "sha256-vdhpDJ3Lr24lkZ+fDCjmBRRtw9/vcSzkqGJOJyF5h2U=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "c3eea5b2156db11c7eeeada3dc737711255b253e",
-        "type": "github"
+        "path": "../../homelab-services/gitea",
+        "type": "path"
       },
       "original": {
-        "owner": "NixOS",
-        "ref": "nixos-26.05",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
+        "path": "../../homelab-services/gitea",
+        "type": "path"
+      },
+      "parent": []
     },
-    "nixpkgs_2": {
+    "nixpkgs": {
       "locked": {
-        "lastModified": 1789114715,
-        "narHash": "sha256-ugpsyk3NM2s87vXfUiIIiibbJ4Pp0JPS5p/3mfs+q+c=",
+        "lastModified": 1792503283,
+        "narHash": "sha256-vhe2jyvRCgufWPqDuDq1S3t3ypE+ka46IFutV02xKso=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "21a67dc470149f337cecafbe965d8d252a390518",
+        "rev": "cd4ea8d57de16f4810bc5f14207bac45fbf19f67",
         "type": "github"
       },
       "original": {
@@ -34,20 +34,23 @@
     },
     "postgresql-db": {
       "inputs": {
-        "nixpkgs": "nixpkgs_2"
+        "nixpkgs": [
+          "nixpkgs"
+        ]
       },
       "locked": {
-        "path": "../postgresql-db",
+        "path": "../../homelab-services/postgresql-db",
         "type": "path"
       },
       "original": {
-        "path": "../postgresql-db",
+        "path": "../../homelab-services/postgresql-db",
         "type": "path"
       },
       "parent": []
     },
     "root": {
       "inputs": {
+        "gitea": "gitea",
         "nixpkgs": "nixpkgs",
         "postgresql-db": "postgresql-db"
       }

virtual-machines/vm-test/flake.nix

@@ -0,0 +1,61 @@
+{
+  description = "Flake to run services on a VM powered by incus";
+
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05";
+    postgresql-db = {
+      url = "path:../../homelab-services/postgresql-db";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    gitea = {
+      url = "path:../../homelab-services/gitea";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+  };
+
+  outputs =
+    {
+      self,
+      nixpkgs,
+      postgresql-db,
+      gitea,
+    }@inputs:
+    let
+      system = "x86_64-linux";
+      pkgs = import nixpkgs {
+        inherit system;
+      };
+      credentials = builtins.listToAttrs (
+        map (filename: {
+          name = builtins.replaceStrings [ ".env" ] [ "-env" ] filename;
+          value =
+            pkgs.runCommand "sops-decrypt-${filename}"
+              {
+                # Use special separate injectable key that can only decrypt these dummy secrets
+                SOPS_AGE_KEY_FILE = "/run/sops-virtual-key.txt";
+              }
+              ''
+                ${pkgs.sops}/bin/sops -d ${./secrets}/${filename} > $out
+              '';
+        }) (builtins.attrNames (builtins.readDir ./secrets))
+      );
+    in
+    {
+      nixosConfigurations = {
+        vm = nixpkgs.lib.nixosSystem {
+          system = system;
+          specialArgs = {
+            inherit credentials;
+          };
+          modules = [
+            ./virtual.nix
+            postgresql-db.nixosModules.postgresql-db
+            gitea.nixosModules.hl-gitea
+
+            # declare the vm output
+            "${inputs.nixpkgs}/nixos/modules/virtualisation/incus-virtual-machine.nix"
+          ];
+        };
+      };
+    };
+}

virtual-machines/vm-test/secrets/gitea.env

@@ -0,0 +1,13 @@
+GITEA_DB_NAME=ENC[AES256_GCM,data:zEhMvGo=,iv:HxxKDckuk8wzV9k1be2kbhWWwKN5C36Mciaj+RbNfRQ=,tag:l2JTkvzVSiSD8RmMWPY/pw==,type:str]
+GITEA_DB_USER=ENC[AES256_GCM,data:I7w/mZ7yq9yeHA==,iv:N3hT4f6BcH4xt0Z+YowTSM/MLIV4C1afM+2MYMFYAlg=,tag:tiUDZ9UvE/Rzmfcw69kK9Q==,type:str]
+GITEA_DB_PASS=ENC[AES256_GCM,data:TRG6S/fCrJ8=,iv:gAmGfL0vapgSIf7Gyhm12ibKRmBurN5IBJIcRVki/PY=,tag:Zinc2oTv+jlZ+E+wgEvIwQ==,type:str]
+sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTWXBOSDViRVc1YVpRd2tZ\naDRvU2t0Ti8zTkoxdG1PbGR3UmNrQzlzOFVFCmlHZHNZL0VVdk81NzlVdGJsdjgy\ndFM1WmY3cXN6WHNXZjlBTGFWYnFoZjgKLS0tIHFJakgyTXhtcHYzbG9OWTJXRkMx\nK0Y4SGhnRmMyNWplTExQQmp1ZEk2VFEKwfxoGZ5q5ZTfe4+u0sm0VW6RSIZMIhPW\nCjXwHVuN9i06EH2CZ57zddjsVmXDJG6bsx7htEauxBA4TipwIrDcZQ==\n-----END AGE ENCRYPTED FILE-----\n
+sops_age__list_0__map_recipient=age1zad0qu648dhjav4pzjhkc6vswnqtacuv9230xcgle8wmv56r8ykqn0ud7y
+sops_age__list_1__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWbEZ4MUpONlh4MnJPWHBF\nU2I4T3BObm9IOStGZVFIOGp1anNZY3FGNG1vCnlHYVN5d1V3clFpeW9wTi94Uy93\nVmlmeU41bU1jM1NoZ3V1VE9UQWlmYkUKLS0tIDhhZk5YRFhGblRhWDFaL3AydHJy\nTVVheGxuUnh1NXduNUxod1k0blh2V0kKZSRFcP5R2wTjIi76KhTNNKSFXPbF7fES\nLvbs56t74WVJyCxAk9Vw5UESvTXiEAvBVZ9N7N0efhAEk8iIcykrGQ==\n-----END AGE ENCRYPTED FILE-----\n
+sops_age__list_1__map_recipient=age1rwugh86469664fwhgrj9xuhjxs9vpflx3r0ftuvd0glphf2gecfs8thxsj
+sops_age__list_2__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWNGlMMWlkTEZCRVdqNXJY\nWHFQWjJSZWhRMEtoOCtVOGRHSGlzZm52RWdBCmFuUWpjeW1ab0IwVlplRHQ1RXVo\nejVrekUzYzV1cHZnaDV2UUhDUjNmNXMKLS0tIGRzelliOFVLZ293Z09rOFhhazJ0\nRi9GNkxnYnZkYXdJOFIvZUo4MDVEUUkKgBXWzRcjCQP+GkH2kI2PjDa1hPlx/F2m\nVsyaL4bAt7EQj23DkYYoJ0rMcksSOVtID5CbC/JYy7pTl8n0l3vOIw==\n-----END AGE ENCRYPTED FILE-----\n
+sops_age__list_2__map_recipient=age1hzaf8j6djfc4yc98m3kqjzzdj4tcskf9kdzvjmje2xuqcfmrz5lqdtn5w7
+sops_lastmodified=2026-10-21T04:55:18Z
+sops_mac=ENC[AES256_GCM,data:f79R0ImdGWtaPQ7S8U6/sSUArI17sOBHZYfRFs9oft4rg7nF84Umpy9Tjsy4whjRHQjpPy5iQIWORAkdVsZ4ecW0KTwDTzXAjuXYlxxoTqKkyWQOOF2X2uhZalwpw4e+RM+vkXL6qatlkFcKz3STG7/T3i4NvOa+fmMh6+vZnCc=,iv:GQU2vsU4AS629V62rCVAU8gsT+vuXFamx7/3MBhEsTA=,tag:ZkkTD7Ku0FGwyDJia1SsAQ==,type:str]
+sops_unencrypted_suffix=_unencrypted
+sops_version=3.13.3

virtual-machines/vm-test/secrets/psql.env

@@ -0,0 +1,11 @@
+PSQL_GITEA_PASSWORD=ENC[AES256_GCM,data:tT/Uym0M6GY=,iv:4+UJmz6AD7K4qn4HfPNFafV0Bqi17Pr1LU+wARn9X44=,tag:wyD7gdV+vibdgFnExyooMw==,type:str]
+sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnRnpUOFRiemJnVFcyVUdi\ndllyZklUd1BGcUlzaEV5cVdCUEoyM1BOYVNnCnFXUTRjdmVnNVp2RkFhM2plMHBz\nblI5SWJSVGdnTzI5M08xcS9na0xTQVEKLS0tIFYvRVVpWWlPQ3g0YTNnMVQ5MzNl\nWjVZdkNTT0U1aHpNbGpkdzlZZEk3SVUKuZYSue3+1HZrlv/DD/rIcL7jbUuAmfR4\nXOwRzwpfC2Pwf+d9pTCRQ9v+AephLE9fLQp9EpT9qUlUxd8MH4zEIA==\n-----END AGE ENCRYPTED FILE-----\n
+sops_age__list_0__map_recipient=age1zad0qu648dhjav4pzjhkc6vswnqtacuv9230xcgle8wmv56r8ykqn0ud7y
+sops_age__list_1__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2MXhmRGMwVWttWitKNDhT\nOG5pNkNjMGVjWDl2Ylp4WHRXVy9rRGFTSFVRClloaGcrQnZnYUF4WW1FSWRZbXd5\na2M5ZXNSWmVkTjlmbHpWc2hjT3pBS2MKLS0tIGoxNExVYk1xV1RmL0dDM3Y1cER5\nUmVkSGQ5OURPRWRqMWhpUmJ2V2h3OFEK5lB3GIEjnnTKZqdN6dAEMu4bM9Ywu+BB\nfS6wf1H8e2KRyaFy6jyoQfTDJr+yRjCPW4cTmbHXlhe8z3K1hPMWwg==\n-----END AGE ENCRYPTED FILE-----\n
+sops_age__list_1__map_recipient=age1rwugh86469664fwhgrj9xuhjxs9vpflx3r0ftuvd0glphf2gecfs8thxsj
+sops_age__list_2__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3K2x4MVR4ZmRUN2l2d2dw\nRGFQU3d4c2I2Q0k2WFg1WUQ5aXJqR2hOdVJzCmVHZjRqZGYwSUVUcmFtc3ZFaWpk\nNi9BNCttRzZuVnVUbkdHU2VMeWN5SlEKLS0tIDV4Q3M2Y2ZLT24zd2xvRTR5MkRi\nb3k4N21lQlgwbktQNm9PYlhQdmNFOUEKbMNZwxJ7vbZr6KhkzKkL6X1R4iqGJOJa\nSFYTWMzONRiymBWKnxqqSWyzgjV3kZbUljdngpvYZ9eoDrzQ/wtV8w==\n-----END AGE ENCRYPTED FILE-----\n
+sops_age__list_2__map_recipient=age1hzaf8j6djfc4yc98m3kqjzzdj4tcskf9kdzvjmje2xuqcfmrz5lqdtn5w7
+sops_lastmodified=2026-10-21T04:55:45Z
+sops_mac=ENC[AES256_GCM,data:444WNcnJjuE09R9ERw5VV5vGXEo1coHKaa37luYKejcV/TNpzaeyJu9b+5UmMVJuYNm878l6tX/gmoTfliocn6Z4RaoWnNP0H5VkUw9khA3zksnrxUfpaG1CIR53BP0ZhuqMDhpvYYA1crhHUJhT0PRBdAlDluivlt627K8L4Sc=,iv:oObMPvFlsnGmseVJNAj/mMHCeyaFp4JvjedYVmz+PBA=,tag:HtV1wM+vyhpZv+x1Yd47Ww==,type:str]
+sops_unencrypted_suffix=_unencrypted
+sops_version=3.13.3

virtual-machines/vm-test/virtual.nix

@@ -2,10 +2,18 @@
   config,
   pkgs,
   meta,
+  credentials,
   ...
 }:
 {
 
+  nix.settings.experimental-features = [
+    "nix-command"
+    "flakes"
+  ];
+
+  nixpkgs.config.allowUnfree = true;
+
   # Allow login and remote control of VM
   users.users.admin = {
     isNormalUser = true;
@@ -27,30 +35,32 @@
     };
   };
 
-  # ================================ #
-  #               SOPS               #
-  # ================================ #
-
-  sops = {
-    # make sure that the age key is generated from the persisted host key
-    age = {
-      sshKeyPaths = [ "/persist/etc/ssh/ssh_host_ed25519_key" ];
-      keyFile = "/persist/var/lib/sops-nix/key.txt";
-      generateKey = true;
+  # Networking
+  networking = {
+    nftables.enable = true;
+    firewall = {
+      enable = true;
+      allowedTCPPorts = [
+        22
+        80 # gitea routing not enabled, open firewall here
+        443 # gitea routing not enabled, open firewall here
+        30222 # gitea routing not enabled, open firewall here
+        6443 # k3s
+      ];
     };
-
-    defaultSopsFormat = "yaml";
-
-    "postgresql-credentials" = {
-      sopsFile = ./secrets/psql.yaml;
-      key = "credentials";
-      format = "yaml";
-      owner = "postgres";
-      group = "postgres";
-    };
-
   };
 
+  # Packages
+  environment.systemPackages = with pkgs; [
+    curl
+    kitty
+    kubectl
+    nginx
+    tmux
+    vim
+    wget
+  ];
+
   # ================================ #
   #            K3S SERVICE           #
   # ================================ #
@@ -68,6 +78,20 @@
     ];
   };
 
+  # ================================ #
+  #           GITEA SERVICE          #
+  # ================================ #
+
+  services.hl-gitea = {
+    enable = true;
+    credentialsFile = credentials.gitea-env;
+    database-hostname = "192.168.8.180:5432";
+
+    default-nginx = {
+      enable = false;
+    };
+  };
+
   # ================================ #
   #           PSQL SERVICE           #
   # ================================ #
@@ -77,13 +101,16 @@
     enable = true;
     dataDir = "/var/lib/postgresql";
     port = 5432;
-    credentialsFile = config.sops.secrets."postgresql-credentials".path;
+    credentialsFile = credentials.psql-env;
     databases = [
-      "test"
+      "gitea"
     ];
     ipMasks = [
       "10.42.0.0/20" # k3s pod mask
     ];
   };
 
+  # To stop the complaining
+  system.stateVersion = "26.05";
+
 }