fix persistent mount path

homelab-services/gitea/k3s/deployment.yaml

@@ -52,9 +52,15 @@ spec:
             - name: GITEA__server__SSH_PORT
               value: "30222"
 
+            - name: GITEA__repository__MAX_CREATION_LIMIT
+              value: "0"
+
+            - name: GITEA__security__INSTALL_LOCK
+              value: "true"
+
           volumeMounts:
             - name: gitea-data
-              mountPath: /var/lib/gitea
+              mountPath: /data
 
       volumes:
         - name: gitea-data

homelab-services/postgresql-db/flake.lock

@@ -2,11 +2,11 @@
   "nodes": {
     "nixpkgs": {
       "locked": {
-        "lastModified": 1787525875,
+        "lastModified": 1789114715,
-        "narHash": "sha256-sKbMlkDCBVmAjUVT94LwhVtET/YEMtZaFdn5UduWxz8=",
+        "narHash": "sha256-ugpsyk3NM2s87vXfUiIIiibbJ4Pp0JPS5p/3mfs+q+c=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "a3b98866eecd08edac6e61a3081e69540a35020f",
+        "rev": "21a67dc470149f337cecafbe965d8d252a390518",
         "type": "github"
       },
       "original": {

homelab-services/postgresql-db/flake.nix

@@ -90,19 +90,17 @@
 
                 # Prod can be connected via local machine and declared masks
                 ${lib.concatStringsSep "" (
-                  map (db: "host ${db} ${db}_produser 127.0.0.1/32 scram-sha-256\n") opts.databases
+                  map (db: "host ${db} ${db}_user 127.0.0.1/32 scram-sha-256\n") opts.databases
                 )}
                 ${lib.concatStringsSep "" (
-                  map (db: "host ${db} ${db}_produser ::1/128 scram-sha-256\n") opts.databases
+                  map (db: "host ${db} ${db}_user ::1/128 scram-sha-256\n") opts.databases
                 )}
                 # configurable list of subnets allowed to connect (for example k3s pods subnet)
                 # will allow connection to all declared ips. fine for now
                 ${lib.concatStringsSep "" (
                   map (
                     db:
-                    lib.concatStringsSep "" (
+                    lib.concatStringsSep "" (map (mask: "host ${db} ${db}_user ${mask} scram-sha-256\n") opts.ipMasks)
-                      map (mask: "host ${db} ${db}_produser ${opts.ipMasks} scram-sha-256\n") opts.ipMasks
-                    )
                   ) opts.databases
                 )}
               '';
@@ -129,9 +127,8 @@
                     db_upper="''${db^^}"
 
                     pass_var="PSQL_''${db_upper}_PASSWORD"
-                    dev_pass_var="PSQL_''${db_upper}_DEV_PASSWORD"
 
-                    user_val="$db"_produser
+                    user_val="$db"_user
                     pass_val=$(eval "echo \''${$pass_var:-}")
 
                     if [ -z "$pass_val" ]; then

nixos/configuration.nix

@@ -67,9 +67,9 @@
     acceptTerms = true;
     defaults = {
       # use staging for testing
-      server = "https://acme-staging-v02.api.letsencrypt.org/directory";
+      # server = "https://acme-staging-v02.api.letsencrypt.org/directory";
       # use prod for deploy
-      # server = "https://acme-v02.api.letsencrypt.org/directory";
+      server = "https://acme-v02.api.letsencrypt.org/directory";
       email = "roydumblauskas@gmail.com";
       dnsProvider = "cloudflare";
       # When the service CHECKS to see if certs are near expiry (< 30 days)
@@ -110,9 +110,11 @@
     disable = [ "traefik" ];
     role = "server";
 
+    # only enable the service on k3s when roughly finalized
+    # Until then use a vm, as k3s is persisted
     extraFlags = [
-      "--data-dir=/var/lib/rancher/k3s"
+      "--data-dir=/persist/var/lib/rancher/k3s"
-      "--cluster-cidr 10.42.0.0/20" # allow this subnet to connect to psql
+      "--cluster-cidr=10.42.0.0/20"
     ];
   };
 
@@ -141,52 +143,31 @@
   #           BLOG SERVICE           #
   # ================================ #
 
-  # Fullstack sourcecode
+  # fullstack code. Dev hosted via VMs (incus)
 
-  /*
+  # ================================ #
-    MINIO DEPRECATED
+  #         END BLOG SERVICE         #
-    services.minio-service = {
+  # ================================ #
-      enable = true;
+  # ================================ #
-
+  #           PSQL SERVICE           #
-      # Persist (or don't) the data inside of database
+  # ================================ #
-      dataDir = "/var/data/minio";
-      credentialsFile = config.sops.secrets."minio-credentials".path;
-
-      dataPort = 9000; # S3 API access
-      consolePort = 9001; # Admin console access
-
-      bootstrap-minio = {
-        enable = true;
-        environments = [
-          "dev"
-          "prod"
-        ];
-      };
-
-      default-nginx = {
-        enable = true;
-        hostname = "imgs.roypository.com";
-      };
-    };
-  */
 
   # Postgresql/postgrest for row storage (not on k3s)
   services.postgresql-db = {
     enable = true;
-    dataDir = "/var/lib/postgresql";
+    dataDir = "/persist/var/lib/postgresql";
     port = 5432;
     credentialsFile = config.sops.secrets."postgresql-credentials".path;
     databases = [
-      "rdblog"
       "gitea"
     ];
     ipMasks = [
-      "10.42.0.0/20" # k3s cluster mask
+      "10.42.0.0/20" # k3s pod mask
     ];
   };
 
   # ================================ #
-  #         END BLOG SERVICE         #
+  #         END PSQL SERVICE         #
   # ================================ #
 
   # ================================ #
@@ -238,6 +219,10 @@
     };
   };
 
+  # Setup Incus daemon on boot
+  # Init with `incus admin init --minimal`
+  virtualisation.incus.enable = true;
+
   networking = {
     hostName = meta.hostname;
     hostId = meta.hostId;
@@ -246,6 +231,7 @@
       "1.1.1.1"
       "1.0.0.1"
     ];
+    nftables.enable = true;
 
     firewall = {
       enable = true;
@@ -255,6 +241,9 @@
         443
         6443 # k3s
       ];
+
+      # Trust all incusVMs (on this network interface)
+      trustedInterfaces = [ "incusbr0" ];
     };
 
     interfaces.eth0.ipv4.addresses = [
@@ -268,40 +257,16 @@
   # Set your time zone.
   time.timeZone = "America/Chicago";
 
-  # Configure network proxy if necessary
-  # networking.proxy.default = "http://user:password@proxy:port/";
-  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
-
-  # Select internationalisation properties.
-  # i18n.defaultLocale = "en_US.UTF-8";
-  # console = {
-  #   font = "Lat2-Terminus16";
-  #   keyMap = "us";
-  #   useXkbConfig = true; # use xkb.options in tty.
-  # };
-
-  # Enable the X11 windowing system.
-  # services.xserver.enable = true;
-
-  # Configure keymap in X11
-  # services.xserver.xkb.layout = "us";
-  # services.xserver.xkb.options = "eurosign:e,caps:escape";
-
   # Enable CUPS to print documents.
   services.printing.enable = true;
 
-  # Enable sound.
-  # hardware.pulseaudio.enable = true;
-  # OR
-  # services.pipewire = {
-  #   enable = true;
-  #   pulse.enable = true;
-  # };
-
   # Define a user account. Don't forget to set a password with ‘passwd’.
   users.users.roy = {
     isNormalUser = true;
-    extraGroups = [ "wheel" ];
+    extraGroups = [
+      "wheel"
+      "incus-admin"
+    ];
     hashedPassword = "$y$j9T$qHYfvijvytC69cjEWTHYA/$YF6ig1hNvkTQi0UffZP1dpilS.8O28qEY4bfdvRTXYA";
     # laptop and desktop
     openssh.authorizedKeys.keys = [
@@ -328,8 +293,7 @@
     ];
   };
 
-  # List packages installed in system profile. To search, run:
+  # List packages installed in system profile
-  # $ nix search wget
   environment.systemPackages = with pkgs; [
     curl
     kitty
@@ -358,14 +322,6 @@
     EDITOR = "nvim";
   };
 
-  # Some programs need SUID wrappers, can be configured further or are
-  # started in user sessions.
-  # programs.mtr.enable = true;
-  # programs.gnupg.agent = {
-  #   enable = true;
-  #   enableSSHSupport = true;
-  # };
-
   # List services that you want to enable:
   services.openssh = {
     enable = true;

nixos/flake.lock

@@ -28,11 +28,11 @@
       },
       "locked": {
         "dir": "pkgs/firefox-addons",
-        "lastModified": 1788408179,
+        "lastModified": 1789185767,
-        "narHash": "sha256-c9H5yvtmigYSyu/+FlctcQ1W8LV5y7g2aumHNovywp4=",
+        "narHash": "sha256-jaWL9beN3ifjNzNEBxo0abA+TSi0n7Q8LRQvZTxEqaM=",
         "owner": "rycee",
         "repo": "nur-expressions",
-        "rev": "ba178ebb105382ab382ab497ca5a977a2fbe3cfd",
+        "rev": "811170bb74b11f3b9489618ce77487cc58c79067",
         "type": "gitlab"
       },
       "original": {
@@ -66,11 +66,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1785627969,
+        "lastModified": 1788450739,
-        "narHash": "sha256-4dtXQk/NMePegK/nWp5NSeuZKLATItOq61lpEvmXqGw=",
+        "narHash": "sha256-glZLQlzIn1fXH6PazR2iUmTo7kzzyYSshrWhLS9TqCU=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "427bf4bd9435fdf21321c8cc628c24efc14c0f7a",
+        "rev": "31729ca8cbdb4fa927b34e5f4353e6a83f39e993",
         "type": "github"
       },
       "original": {
@@ -100,11 +100,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1787377438,
+        "lastModified": 1789182507,
-        "narHash": "sha256-Sxu1NLTD/Ern6hFGLlZmtKCSct3YQXZI/lls8RE1XeM=",
+        "narHash": "sha256-9nt4W0HNNP84B+b37yRs9Zxat1ZR5guJxEZDEjAgex4=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "65258d5c65a250189fde2e35f490d15e064c4c62",
+        "rev": "b1d1b60084970f9d1e2b72662639dab6d039be71",
         "type": "github"
       },
       "original": {
@@ -284,6 +284,22 @@
       }
     },
     "nixpkgs_6": {
+      "locked": {
+        "lastModified": 1789114715,
+        "narHash": "sha256-ugpsyk3NM2s87vXfUiIIiibbJ4Pp0JPS5p/3mfs+q+c=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "21a67dc470149f337cecafbe965d8d252a390518",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-26.05",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_7": {
       "locked": {
         "lastModified": 1788405554,
         "narHash": "sha256-r2f1oUwixlgq9zOdYLqJLfS/lWBT60/IITjhTKI59JU=",
@@ -299,29 +315,13 @@
         "type": "github"
       }
     },
-    "nixpkgs_7": {
-      "locked": {
-        "lastModified": 1787204541,
-        "narHash": "sha256-OURZPknrTjQrlNyxPdqzyqmU/81Wes1CUP/Ft1Rv/YI=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "5880666fd9eb563038431edb35c2d0aa595884e6",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-26.05",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
     "nixpkgs_8": {
       "locked": {
-        "lastModified": 1787525875,
+        "lastModified": 1789114715,
-        "narHash": "sha256-sKbMlkDCBVmAjUVT94LwhVtET/YEMtZaFdn5UduWxz8=",
+        "narHash": "sha256-ugpsyk3NM2s87vXfUiIIiibbJ4Pp0JPS5p/3mfs+q+c=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "a3b98866eecd08edac6e61a3081e69540a35020f",
+        "rev": "21a67dc470149f337cecafbe965d8d252a390518",
         "type": "github"
       },
       "original": {
@@ -338,11 +338,11 @@
         "systems": "systems_2"
       },
       "locked": {
-        "lastModified": 1787536726,
+        "lastModified": 1788623321,
-        "narHash": "sha256-aBh5Yk9tX8ZV4k10BJr2fvTq0/+iWGegaCMUOU7YKas=",
+        "narHash": "sha256-i8v07Plhfpx/nVFMvnMSC6P05RQ43mbLQsS5grni4Vk=",
         "owner": "nix-community",
         "repo": "nixvim",
-        "rev": "e2c3f9f36326d07340626847543c557e2b95fb50",
+        "rev": "68c2edd2787f055d9c306bcfe726f3b8f11b9441",
         "type": "github"
       },
       "original": {
@@ -405,11 +405,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1788337237,
+        "lastModified": 1788914643,
-        "narHash": "sha256-gkSH8VUtCo6hnysNmb9DbTuDepH2t5pv+QWjP75xKAk=",
+        "narHash": "sha256-4GuMPW90JSxXWDPUB9M+1m7fYbe3H0apOd86/zBQ2Kw=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "fbf759290e0cb0a98dfc813a4eb7d53ad1dacb57",
+        "rev": "13616fff713a9f94055c66f15687ebdc17a335df",
         "type": "github"
       },
       "original": {

nixos/home-manager/programs/fish.nix

@@ -10,7 +10,7 @@
       gpr = "git pull --rebase";
       gl = "git log";
       shypr = "start-hyprland";
-      nixrb = "sudo nixos-rebuild switch --flake";
+      nixrb = "sudo nixos-rebuild switch --flake .#$hostname";
     };
 
     functions = {

nixos/secrets/gitea.yaml

@@ -1,4 +1,4 @@
-credentials: ENC[AES256_GCM,data:3F9YE18X4zRqppoVSnoiwBJPNuxbB6hlntXIiNV8yWhomVP6TRwhadSC3J3t/rqzD6TdbnweInDlU9U9JtfDM6H+MTXd5eVynG/aR4c=,iv:yjm4TU8AqcpY2mn+cl1/Ya9e5FHWsUVAkcyvmFxaLVU=,tag:lx/ACG2g0H/eoiJ6AVEbjQ==,type:str]
+credentials: ENC[AES256_GCM,data:cl7lN8VFcGid6N0I9if2rnHXxfzcSpi9WuDOgr8Zw3YcMObU0Vu9F+FxnNNJ6/ISCWHsYCJg9dOqQwBmWwHNz7rsglL1+M51UynrjOhqGex3OCocvPkWTHk/QBxjum3rn3dZ2p40Zl0ZLmi8JO+2qBa62nwqqQGtsAfI2M2FjEPGMSqaDwv9zsGdiyfz/GEoel+mBCoe4simf3KZFmAcGs3Rwqj1YtuQy/x6+txK2lur+4Fp6Pj0VV7UQ0AXlvkn8z5EO+aieK+1PKOqSeV66rs/a8q2x05hEmOtaneGnc176B0iIweE+dQLr3GMfp4LeTQaUE2xyjjHgjGpKQhHxHf75icJDtOU/1KsNruOpYS2Bkp3/kv3tx1XUMt+dS4TWXq4FWCQ41B+NDjFAiFGJgKTCbD0kebOnhNYsg==,iv:4UkxIypVzO1lBTgWLcOjkfHy323K3sbmyu+kW4kAvxk=,tag:6hspoY9AJhe3//vgyC/HCQ==,type:str]
 sops:
     age:
         - enc: |
@@ -37,7 +37,7 @@ sops:
             o+m9XdwX6u7OaazWx7J9tWOS+O1sJoNGMpAj/K5N6OjoNGT4Lu8t+w==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1hzaf8j6djfc4yc98m3kqjzzdj4tcskf9kdzvjmje2xuqcfmrz5lqdtn5w7
-    lastmodified: "2026-09-12T19:58:39Z"
+    lastmodified: "2026-09-12T21:53:45Z"
-    mac: ENC[AES256_GCM,data:nWWObv95W+Ewp49Ygqrsat3yFlY15d8jcmjZusk8gCb1ollX8ulifP/SCt8GTOTQootbXpKxJc+BqBYcdR46gxMZert0ok2o9B7ks5zI7a0pH54mLDclN1ONmAyHRC0IqSfe7XSn70dgjLchjpCSjeTaylzidwBAUfKbkZtzjG8=,iv:jLqbj1XJaZNPKDNRUafxAexHeKQh9GqEeaIr+vzqGCc=,tag:QBir2cmH8M0zSjpAkQrHwQ==,type:str]
+    mac: ENC[AES256_GCM,data:CWlbmhzYuTFTvC6hczXOqPQ7gFaKU0hwxx1/5w5IoESlJQwoKYWI55ZpXgT2Ynx26BZU3l+v04ytB23SkBhaY3w6Cs2AP4O7RNyTXc4Q9xkaq2qrLNRvIIsotAVhKULd0NRFkG0E8Urcf8ciK5iPbKhaovbGEQRtfB+EJFC6KNM=,iv:4ta099T9Fn7WcfCdaXYzZ94b5B1imnWxlJ/je9kI69w=,tag:sWytXiE10+3S/axircaApA==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.13.3

nixos/secrets/psql.yaml

@@ -1,4 +1,4 @@
-credentials: ENC[AES256_GCM,data:No2VCubcIimFbkhwnD4sGuaR5OehpxvOj5Ln7bXydTrn6RcgrgkmHYBHAMajcL13XHom4IY30fBpiNQ=,iv:0UMfuCJyuXkO1vBrH2d7UtV5qZJatdef8C8RskrlQ74=,tag:G7zcM1J1G53nH5O9X2PMoA==,type:str]
+credentials: ENC[AES256_GCM,data:utwbvinGqNWCe0Pydl/afBw2T4VTnxhkRf9XApduUeNbReiiz6OkQhyB1rCUbqKCOlVu/ahJAwT2rT+HQRzjeFMWFUUbZpFG8q54u1uLHuNB1QsLXHwC7aZS6L9IdLUe5Tf+uzlT9047o5QgpZkNdsuQg43JWHxuA9nAjPR78R7q2eCNEsfEaoZmz34utabkKhWRGf9CpiDYYO2nLNXFFpSrRWk0nyU3CmqX9XROYphLwZw2obHs2EP6vUDK+1FsPa8Lza2TG7pF/NegSE9yMdnWmlzpj1f6B1+w5GLPweAPedTm6mRxsG8OfPLIwNrhfIP8XmsTQZ+JOsNq3boVaALgAacGd0ZOw7oB8/GsEjSEnkKETw==,iv:OsTSCYMoc6rMt+IqiKxZw9nWhXseA5wYHTUwgCqE9ZA=,tag:SWHAGuqkDYSuKxLb4oFf/A==,type:str]
 sops:
     age:
         - enc: |
@@ -37,7 +37,7 @@ sops:
             1WiDsujdVQkAp1WtBFc9KHexaEJ1DjKVOKsIIjj/YlmKz5P0S7Sm0w==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1hzaf8j6djfc4yc98m3kqjzzdj4tcskf9kdzvjmje2xuqcfmrz5lqdtn5w7
-    lastmodified: "2026-09-12T19:58:55Z"
+    lastmodified: "2026-09-12T21:53:27Z"
-    mac: ENC[AES256_GCM,data:zplquNejJ1M8dBYF7h2yPmHzO2gFDPr3VFCLEszJE/0LxBQmon0/IaOUrvbShIgkOh7eq06vrNSpp42/r37sv1Uoy4j/E0OLCtB8NYEsP5aW5joSKJZlzdQJUEbB38Zf7vM7FFNKBYeAtJflhbI/A3qyq7Xs4qTKWj8IJY4nx78=,iv:fQJfqsQcUVPB/Q6HxdG8gM1IDTvjQniIqDs+dFvGt7o=,tag:eTllYOsgCtCsQCBxr3pbpw==,type:str]
+    mac: ENC[AES256_GCM,data:QRouK5Vp5NGC8n3nh4per1ytbbKkSXV+kpXByrkR3BmZ3mOymyeOX4XfGbZdTgkRc+16mlMLM1dwTvbeWj8XOt65xH8uMw8oW2cRs68qyrSDq6+Ai/bovf+szAR1gx+mLk7FdqzyuslnXHzpJFS6vLPFt29DBj1fQFWslew+SoY=,iv:D0qaTYdPNm2AmlXq6HnvbIpgCKTzvXOtrsA1C8gZ9P4=,tag:TAVTUr5inXbvrWUdJnlOkA==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.13.3