add gc

.gitignore

@@ -1,4 +1,4 @@
 server-info.txt
 nixos/out
 nixos/error
-virtual-machines/*/result/
+virtual-machines/*/result

nixos/configuration.nix

@@ -7,10 +7,20 @@
 {
   imports = [ ];
 
-  nix.settings.experimental-features = [
+  nix = {
-    "nix-command"
+    settings.experimental-features = [
-    "flakes"
+      "nix-command"
-  ];
+      "flakes"
+    ];
+
+    gc = {
+      automatic = true;
+      persistent = true;
+      dates = [ "daily" ];
+      options = "--delete-older-than 7d";
+    };
+  };
+
   nixpkgs.config.allowUnfree = true;
 
   # Secret Management
@@ -206,6 +216,11 @@
   # Init with `incus admin init --minimal`
   virtualisation.incus.enable = true;
 
+  # allow sandboxes to see my temp keys
+  nix.settings.extra-sandbox-paths = [
+    "/run/sops-virtual-key.txt=/run/sops-virtual/virtual-key.txt"
+  ];
+
   networking = {
     hostName = meta.hostname;
     hostId = meta.hostId;
@@ -220,8 +235,6 @@
       enable = true;
       allowedTCPPorts = [
         22
-        80
-        443
         6443 # k3s
       ];
 
@@ -274,6 +287,7 @@
       "/var/lib/nixos"
       "/var/db/sudo/lectured"
       "/var/lib/acme"
+      "/run/sops-virtual"
     ];
   };
 
@@ -320,6 +334,12 @@
         path = "/persist/etc/ssh/ssh_host_rsa_key";
       }
     ];
+
+    # Don't allow remote password login
+    settings = {
+      PasswordAuthentication = false;
+      KbdInteractiveAuthentication = false;
+    };
   };
 
   # INITIAL system version

nixos/home-manager/home.nix

@@ -40,6 +40,7 @@
     woeusb
     wofi
     xrandr
+    yq
     zip
   ];
 

virtual-machines/.sops.yaml

@@ -3,7 +3,6 @@ keys:
     - &laptop age1zad0qu648dhjav4pzjhkc6vswnqtacuv9230xcgle8wmv56r8ykqn0ud7y
     - &desktop age1rwugh86469664fwhgrj9xuhjxs9vpflx3r0ftuvd0glphf2gecfs8thxsj
     - &nixos-homelab-00 age1hzaf8j6djfc4yc98m3kqjzzdj4tcskf9kdzvjmje2xuqcfmrz5lqdtn5w7
-    - &virtual age1q5zwds8g47j7xsqhp8tk995l3n4a5z876vff7wgx4sztwgdsa3yq7eu6xk
 creation_rules:
   - path_regex: '.*/secrets/[^/]+\.(yaml|json|env|ini)$'
     key_groups:
@@ -11,4 +10,3 @@ creation_rules:
           - *laptop
           - *desktop
           - *nixos-homelab-00
-          - *virtual

virtual-machines/build-image.sh

@@ -0,0 +1,196 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+# Usage:
+#   ./build-image.sh <vm-folder> <alias> [vmname]
+#
+# Example:
+#   ./build-image.sh vm-test nixos/custom/jellybean
+#
+# Run from anywhere; all project operations use virtual-machines/.
+
+SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+cd "$SCRIPT_DIR"
+
+if [[ $# -lt 2 || $# -gt 3 ]]; then
+    echo "Usage: $0 <vm-folder> <alias> [vmname]"
+    exit 1
+fi
+
+VM_FOLDER="$1"
+ALIAS="$2"
+VMNAME="${3:-vm}"
+
+VM_DIR="$SCRIPT_DIR/$VM_FOLDER"
+SOPS_CONFIG="$SCRIPT_DIR/.sops.yaml"
+AGE_DIR="/run/sops-virtual"
+AGE_KEY="$AGE_DIR/virtual-key.txt"
+SANDBOX_KEY="/run/sops-virtual-key.txt"
+
+for cmd in age-keygen sops yq nix incus sudo; do
+    command -v "$cmd" >/dev/null 2>&1 || {
+        echo "Missing required command: $cmd" >&2
+        exit 1
+    }
+done
+
+[[ -d "$VM_DIR" ]] || {
+    echo "VM directory not found: $VM_DIR" >&2
+    exit 1
+}
+
+[[ -f "$VM_DIR/flake.nix" ]] || {
+    echo "No flake.nix found in $VM_DIR" >&2
+    exit 1
+}
+
+[[ -f "$SOPS_CONFIG" ]] || {
+    echo "SOPS config not found: $SOPS_CONFIG" >&2
+    exit 1
+}
+
+[[ -d "$VM_DIR/secrets" ]] || {
+    echo "Secrets directory not found: $VM_DIR/secrets" >&2
+    exit 1
+}
+
+# Refuse to overwrite a key that may belong to another running build.
+if sudo test -e "$AGE_KEY"; then
+    echo "Temporary key already exists: $AGE_KEY" >&2
+    echo "Remove it or investigate the previous build before continuing." >&2
+    exit 1
+fi
+
+SOPS_BACKUP="$(mktemp)"
+AGE_TEMP="$(mktemp)"
+rm -f "$AGE_TEMP"
+
+cp -p "$SOPS_CONFIG" "$SOPS_BACKUP"
+
+CLEANED_UP=0
+
+cleanup() {
+    local status=$?
+
+    if [[ "$CLEANED_UP" -eq 1 ]]; then
+        return
+    fi
+    CLEANED_UP=1
+
+    # Restore the original SOPS configuration.
+    cp "$SOPS_BACKUP" "$SOPS_CONFIG"
+
+    # Remove the temporary recipient from encrypted secrets.
+    # Do this while the original recipients are restored.
+    if [[ -d "$VM_DIR/secrets" ]]; then
+        shopt -s nullglob
+        local secret_files=("$VM_DIR"/secrets/*)
+        shopt -u nullglob
+
+        for secret in "${secret_files[@]}"; do
+            [[ -f "$secret" ]] || continue
+            echo "Restoring SOPS recipients: ${secret#"$SCRIPT_DIR"/}"
+            if ! sops updatekeys --yes "$secret"; then
+                echo "WARNING: Failed to restore recipients in $secret" >&2
+                status=1
+            fi
+        done
+    fi
+
+    rm -f "$SOPS_BACKUP" "$AGE_TEMP"
+
+    # Remove the temporary private key after recipient metadata is restored.
+    sudo rm -f "$AGE_KEY"
+
+    echo "Temporary age key removed."
+    return "$status"
+}
+
+trap cleanup EXIT
+trap 'exit 130' INT
+trap 'exit 143' TERM
+
+echo "Generating temporary age identity..."
+
+age-keygen -o "$AGE_TEMP"
+AGE_PUBLIC_KEY="$(age-keygen -y "$AGE_TEMP")"
+
+# Make the key readable by Nix build users, but not ordinary users.
+sudo install -d -o root -g nixbld -m 0750 "$AGE_DIR"
+sudo install -o root -g nixbld -m 0440 \
+    "$AGE_TEMP" "$AGE_KEY"
+
+# Update age recipients in the SOPS creation rules temporarily.
+# Requires mikefarah/yq v4 and simple comma-separated age fields.
+export AGE_PUBLIC_KEY
+
+# Confirm at least one age key group exists.
+if ! yq -e '
+  [.creation_rules[].key_groups[] | select(.age != null)] | length > 0
+' "$SOPS_CONFIG" >/dev/null; then
+    echo "No creation_rules with key_groups.age found in .sops.yaml" >&2
+    exit 1
+fi
+
+# Add the temporary public key to each age recipient list.
+yq -y -i '
+  (.creation_rules[].key_groups[] | select(.age != null).age) |=
+    (. + [env.AGE_PUBLIC_KEY] | unique)
+' "$SOPS_CONFIG"
+
+echo "Updating SOPS recipients for secrets in $VM_FOLDER..."
+
+shopt -s nullglob
+SECRET_FILES=("$VM_DIR"/secrets/*)
+shopt -u nullglob
+
+if [[ ${#SECRET_FILES[@]} -eq 0 ]]; then
+    echo "No secret files found in $VM_DIR/secrets" >&2
+    exit 1
+fi
+
+for secret in "${SECRET_FILES[@]}"; do
+    [[ -f "$secret" ]] || continue
+    echo "Updating recipients: ${secret#"$SCRIPT_DIR"/}"
+    sops updatekeys --yes "$secret"
+done
+
+echo "Building VM metadata..."
+
+TARBALL_DIR="$(nix build \
+    "./$VM_FOLDER#nixosConfigurations.${VMNAME}.config.system.build.metadata" \
+    --print-out-paths)"
+
+TARBALL="$(find "$TARBALL_DIR" -type f -name '*.tar.xz' -print -quit)"
+
+if [[ -z "$TARBALL" ]]; then
+    echo "Could not find a .tar.xz tarball in: $TARBALL_DIR" >&2
+    exit 1
+fi
+
+echo "Metadata tarball: $TARBALL"
+
+echo "Building QEMU disk image..."
+
+QCOW2_DIR="$(nix build \
+    "./$VM_FOLDER#nixosConfigurations.${VMNAME}.config.system.build.qemuImage" \
+    --print-out-paths)"
+
+QCOW2="$QCOW2_DIR/nixos.qcow2"
+
+if [[ ! -f "$QCOW2" ]]; then
+    echo "QEMU image not found: $QCOW2" >&2
+    exit 1
+fi
+
+echo "QEMU image: $QCOW2"
+
+echo "Importing image into Incus..."
+
+incus image import \
+    --alias "$ALIAS" \
+    "$TARBALL" \
+    "$QCOW2"
+
+echo "Successfully imported image: $ALIAS"
+

virtual-machines/vm-test/build-image.sh

@@ -1,61 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-# Usage:
-#   ./build-image.sh <alias> [vmname]
-#
-# Examples:
-#   ./build-image.sh nixos/custom/vm
-#   ./build-image.sh nixos/custom/my-vm my-vm
-
-if [[ $# -lt 1 || $# -gt 2 ]]; then
-    echo "Usage: $0 <alias> [vmname]"
-    echo
-    echo "  alias   Required Incus image alias"
-    echo "  vmname  NixOS configuration name (default: vm)"
-    exit 1
-fi
-
-ALIAS="$1"
-VMNAME="${2:-vm}"
-
-# Build the NixOS LXC metadata tarball
-TARBALL_DIR="$(nix build \
-    ".#nixosConfigurations.${VMNAME}.config.system.build.metadata" \
-    --print-out-paths)"
-
-# Find the tarball
-TARBALL="$(find "$TARBALL_DIR" -type f -name '*.tar.xz' -print -quit)"
-
-if [[ -z "$TARBALL" ]]; then
-    echo "Could not find a .tar.xz tarball in: $TARBALL_DIR"
-    exit 1
-fi
-
-echo "Metadata tarball: $TARBALL"
-
-# Build the QEMU disk image
-QCOW2_DIR="$(nix build \
-    ".#nixosConfigurations.${VMNAME}.config.system.build.qemuImage" \
-    --print-out-paths)"
-
-QCOW2="$QCOW2_DIR/nixos.qcow2"
-
-if [[ ! -f "$QCOW2" ]]; then
-    echo "QEMU image not found: $QCOW2"
-    exit 1
-fi
-
-echo "Found QEMU image: $QCOW2"
-
-echo
-echo "Importing image into Incus..."
-
-incus image import \
-    --alias "$ALIAS" \
-    "$TARBALL" \
-    "$QCOW2"
-
-echo
-echo "Successfully imported image: $ALIAS"
-

virtual-machines/vm-test/flake.lock

@@ -1,12 +1,28 @@
 {
   "nodes": {
+    "gitea": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "path": "../../homelab-services/gitea",
+        "type": "path"
+      },
+      "original": {
+        "path": "../../homelab-services/gitea",
+        "type": "path"
+      },
+      "parent": []
+    },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1790340521,
+        "lastModified": 1792503283,
-        "narHash": "sha256-cRrWlIjVRJ6BHDr9caUdXsZ3owzWIKYHpNmGPHBInIU=",
+        "narHash": "sha256-vhe2jyvRCgufWPqDuDq1S3t3ypE+ka46IFutV02xKso=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "f5c082a40f7571c266e74e80ae2e68aadd8a9fc7",
+        "rev": "cd4ea8d57de16f4810bc5f14207bac45fbf19f67",
         "type": "github"
       },
       "original": {
@@ -34,6 +50,7 @@
     },
     "root": {
       "inputs": {
+        "gitea": "gitea",
         "nixpkgs": "nixpkgs",
         "postgresql-db": "postgresql-db"
       }

virtual-machines/vm-test/flake.nix

@@ -7,6 +7,10 @@
       url = "path:../../homelab-services/postgresql-db";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    gitea = {
+      url = "path:../../homelab-services/gitea";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
   outputs =
@@ -14,6 +18,7 @@
       self,
       nixpkgs,
       postgresql-db,
+      gitea,
     }@inputs:
     let
       system = "x86_64-linux";
@@ -27,9 +32,7 @@
             pkgs.runCommand "sops-decrypt-${filename}"
               {
                 # Use special separate injectable key that can only decrypt these dummy secrets
-                SOPS_AGE_KEY_FILE = "/home/roy/.config/sops/age/virtual-key.txt";
+                SOPS_AGE_KEY_FILE = "/run/sops-virtual-key.txt";
-
-                __noChroot = true;
               }
               ''
                 ${pkgs.sops}/bin/sops -d ${./secrets}/${filename} > $out
@@ -47,6 +50,7 @@
           modules = [
             ./virtual.nix
             postgresql-db.nixosModules.postgresql-db
+            gitea.nixosModules.hl-gitea
 
             # declare the vm output
             "${inputs.nixpkgs}/nixos/modules/virtualisation/incus-virtual-machine.nix"

virtual-machines/vm-test/secrets/gitea.env

@@ -0,0 +1,13 @@
+GITEA_DB_NAME=ENC[AES256_GCM,data:zEhMvGo=,iv:HxxKDckuk8wzV9k1be2kbhWWwKN5C36Mciaj+RbNfRQ=,tag:l2JTkvzVSiSD8RmMWPY/pw==,type:str]
+GITEA_DB_USER=ENC[AES256_GCM,data:I7w/mZ7yq9yeHA==,iv:N3hT4f6BcH4xt0Z+YowTSM/MLIV4C1afM+2MYMFYAlg=,tag:tiUDZ9UvE/Rzmfcw69kK9Q==,type:str]
+GITEA_DB_PASS=ENC[AES256_GCM,data:TRG6S/fCrJ8=,iv:gAmGfL0vapgSIf7Gyhm12ibKRmBurN5IBJIcRVki/PY=,tag:Zinc2oTv+jlZ+E+wgEvIwQ==,type:str]
+sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTWXBOSDViRVc1YVpRd2tZ\naDRvU2t0Ti8zTkoxdG1PbGR3UmNrQzlzOFVFCmlHZHNZL0VVdk81NzlVdGJsdjgy\ndFM1WmY3cXN6WHNXZjlBTGFWYnFoZjgKLS0tIHFJakgyTXhtcHYzbG9OWTJXRkMx\nK0Y4SGhnRmMyNWplTExQQmp1ZEk2VFEKwfxoGZ5q5ZTfe4+u0sm0VW6RSIZMIhPW\nCjXwHVuN9i06EH2CZ57zddjsVmXDJG6bsx7htEauxBA4TipwIrDcZQ==\n-----END AGE ENCRYPTED FILE-----\n
+sops_age__list_0__map_recipient=age1zad0qu648dhjav4pzjhkc6vswnqtacuv9230xcgle8wmv56r8ykqn0ud7y
+sops_age__list_1__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWbEZ4MUpONlh4MnJPWHBF\nU2I4T3BObm9IOStGZVFIOGp1anNZY3FGNG1vCnlHYVN5d1V3clFpeW9wTi94Uy93\nVmlmeU41bU1jM1NoZ3V1VE9UQWlmYkUKLS0tIDhhZk5YRFhGblRhWDFaL3AydHJy\nTVVheGxuUnh1NXduNUxod1k0blh2V0kKZSRFcP5R2wTjIi76KhTNNKSFXPbF7fES\nLvbs56t74WVJyCxAk9Vw5UESvTXiEAvBVZ9N7N0efhAEk8iIcykrGQ==\n-----END AGE ENCRYPTED FILE-----\n
+sops_age__list_1__map_recipient=age1rwugh86469664fwhgrj9xuhjxs9vpflx3r0ftuvd0glphf2gecfs8thxsj
+sops_age__list_2__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWNGlMMWlkTEZCRVdqNXJY\nWHFQWjJSZWhRMEtoOCtVOGRHSGlzZm52RWdBCmFuUWpjeW1ab0IwVlplRHQ1RXVo\nejVrekUzYzV1cHZnaDV2UUhDUjNmNXMKLS0tIGRzelliOFVLZ293Z09rOFhhazJ0\nRi9GNkxnYnZkYXdJOFIvZUo4MDVEUUkKgBXWzRcjCQP+GkH2kI2PjDa1hPlx/F2m\nVsyaL4bAt7EQj23DkYYoJ0rMcksSOVtID5CbC/JYy7pTl8n0l3vOIw==\n-----END AGE ENCRYPTED FILE-----\n
+sops_age__list_2__map_recipient=age1hzaf8j6djfc4yc98m3kqjzzdj4tcskf9kdzvjmje2xuqcfmrz5lqdtn5w7
+sops_lastmodified=2026-10-21T04:55:18Z
+sops_mac=ENC[AES256_GCM,data:f79R0ImdGWtaPQ7S8U6/sSUArI17sOBHZYfRFs9oft4rg7nF84Umpy9Tjsy4whjRHQjpPy5iQIWORAkdVsZ4ecW0KTwDTzXAjuXYlxxoTqKkyWQOOF2X2uhZalwpw4e+RM+vkXL6qatlkFcKz3STG7/T3i4NvOa+fmMh6+vZnCc=,iv:GQU2vsU4AS629V62rCVAU8gsT+vuXFamx7/3MBhEsTA=,tag:ZkkTD7Ku0FGwyDJia1SsAQ==,type:str]
+sops_unencrypted_suffix=_unencrypted
+sops_version=3.13.3

virtual-machines/vm-test/secrets/psql.env

@@ -1,13 +1,11 @@
-PSQL_TEST_PASSWORD=ENC[AES256_GCM,data:23yfH/WahP629zM=,iv:d7MCyz1OD/Ns1D4KMMtOhMMnG3WVXG406sUA5Xv0eFw=,tag:QTa5Akrd/co03MZn5C2VPA==,type:str]
+PSQL_GITEA_PASSWORD=ENC[AES256_GCM,data:tT/Uym0M6GY=,iv:4+UJmz6AD7K4qn4HfPNFafV0Bqi17Pr1LU+wARn9X44=,tag:wyD7gdV+vibdgFnExyooMw==,type:str]
-sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiVkRsaGJDUU4vWUtXUSth\naFNNbWNQNXh1WHNHS0EwUUYwY0tGTzJrclRRCjNIK2RxYnc5VU45UVFjMEhHVGtD\ncjQ1eHBRUHhId0dYRU5UTCsxMzFOaTgKLS0tIHQxUFVnSjl3Rjk1WmJWVlJZNGtn\ndk5MWit0T09ZZnBzT3AzUndPRWVkV00KYw64NyJ5YB2pkUdhAmGouk0rtf/J2RfZ\nAh7p5Nozm7d7Cx4hNXFV3sd1IpNnDYL4Tv+0+0Rp7SpXSVQagzdiwQ==\n-----END AGE ENCRYPTED FILE-----\n
+sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnRnpUOFRiemJnVFcyVUdi\ndllyZklUd1BGcUlzaEV5cVdCUEoyM1BOYVNnCnFXUTRjdmVnNVp2RkFhM2plMHBz\nblI5SWJSVGdnTzI5M08xcS9na0xTQVEKLS0tIFYvRVVpWWlPQ3g0YTNnMVQ5MzNl\nWjVZdkNTT0U1aHpNbGpkdzlZZEk3SVUKuZYSue3+1HZrlv/DD/rIcL7jbUuAmfR4\nXOwRzwpfC2Pwf+d9pTCRQ9v+AephLE9fLQp9EpT9qUlUxd8MH4zEIA==\n-----END AGE ENCRYPTED FILE-----\n
 sops_age__list_0__map_recipient=age1zad0qu648dhjav4pzjhkc6vswnqtacuv9230xcgle8wmv56r8ykqn0ud7y
-sops_age__list_1__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCdTVJVVczbmFEWlRnU0Rt\naVpIYmhwQXpPQk9abzlBQUlGVCtVeHhZTkQwCjAxMDF4SmRNUDRpNU9BK0hmcmV2\nSFkyUWZLekhWN1JRYjdXWk53Nkd1dTAKLS0tIGtxODlrWWlLV0loeHQzWjRaYkJI\nSnNnY280cXlhcDZmeVJqaENVV1pYNkUKQNdY1baew90hV1lqTrEqDuql1uY4F1/o\nupm8cuUIYh2Og70arMXfi8C7VfTgCF93q0V3MLXKmaWyeC0YcH9qsw==\n-----END AGE ENCRYPTED FILE-----\n
+sops_age__list_1__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2MXhmRGMwVWttWitKNDhT\nOG5pNkNjMGVjWDl2Ylp4WHRXVy9rRGFTSFVRClloaGcrQnZnYUF4WW1FSWRZbXd5\na2M5ZXNSWmVkTjlmbHpWc2hjT3pBS2MKLS0tIGoxNExVYk1xV1RmL0dDM3Y1cER5\nUmVkSGQ5OURPRWRqMWhpUmJ2V2h3OFEK5lB3GIEjnnTKZqdN6dAEMu4bM9Ywu+BB\nfS6wf1H8e2KRyaFy6jyoQfTDJr+yRjCPW4cTmbHXlhe8z3K1hPMWwg==\n-----END AGE ENCRYPTED FILE-----\n
 sops_age__list_1__map_recipient=age1rwugh86469664fwhgrj9xuhjxs9vpflx3r0ftuvd0glphf2gecfs8thxsj
-sops_age__list_2__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwVGJiOWhPUTlUa0F2SWNm\ndFd1MDM3Mno1Nm1kOWlkVnYxTDhweVB5ZWh3CnFjbE5OcEEwYzZEUFg1VVg5R1ZR\nT09YTEkvR2lSSUVuNnVER1dEeTBvZlkKLS0tIGxUVGRJUitLSDVHNDJSNXlERGZN\nR05FdVlQWkJyeTcwQ1A1ekZyVmJZY0UKJe75gpOUYrRTRSzfG9GX7pD0nNgiP79Q\n+mKco3+6UAS3Lvx/fdHsAQBlL8NfF1K2WTtNXoTjqVFLK4BMXkYkVQ==\n-----END AGE ENCRYPTED FILE-----\n
+sops_age__list_2__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3K2x4MVR4ZmRUN2l2d2dw\nRGFQU3d4c2I2Q0k2WFg1WUQ5aXJqR2hOdVJzCmVHZjRqZGYwSUVUcmFtc3ZFaWpk\nNi9BNCttRzZuVnVUbkdHU2VMeWN5SlEKLS0tIDV4Q3M2Y2ZLT24zd2xvRTR5MkRi\nb3k4N21lQlgwbktQNm9PYlhQdmNFOUEKbMNZwxJ7vbZr6KhkzKkL6X1R4iqGJOJa\nSFYTWMzONRiymBWKnxqqSWyzgjV3kZbUljdngpvYZ9eoDrzQ/wtV8w==\n-----END AGE ENCRYPTED FILE-----\n
 sops_age__list_2__map_recipient=age1hzaf8j6djfc4yc98m3kqjzzdj4tcskf9kdzvjmje2xuqcfmrz5lqdtn5w7
-sops_age__list_3__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTaTdnYjc1SDgvNW9hMUc4\nQ3M0cnBQTThycEdtKzdhZUxDN1lRbEd0U0g0Cml4M2JFTUlIdEMxKzZ6Q09IOGRH\nRWpTUXRpWkV1cmdkY2Z1SVJWaERGaEEKLS0tIENVS3dVVVN2allaZXE1bmh4eU4w\nVFNpdWZrT200NzVxZ3owSnVhdm42RGcKH+01ReDxA0ZusdMKhxl7S+f65Lla3RHa\nuHBPXStwk6Q5YmC4AtV22YgQ/V0qRDrhQM49zX7WFGVo9HxmQ7AqHA==\n-----END AGE ENCRYPTED FILE-----\n
+sops_lastmodified=2026-10-21T04:55:45Z
-sops_age__list_3__map_recipient=age1q5zwds8g47j7xsqhp8tk995l3n4a5z876vff7wgx4sztwgdsa3yq7eu6xk
+sops_mac=ENC[AES256_GCM,data:444WNcnJjuE09R9ERw5VV5vGXEo1coHKaa37luYKejcV/TNpzaeyJu9b+5UmMVJuYNm878l6tX/gmoTfliocn6Z4RaoWnNP0H5VkUw9khA3zksnrxUfpaG1CIR53BP0ZhuqMDhpvYYA1crhHUJhT0PRBdAlDluivlt627K8L4Sc=,iv:oObMPvFlsnGmseVJNAj/mMHCeyaFp4JvjedYVmz+PBA=,tag:HtV1wM+vyhpZv+x1Yd47Ww==,type:str]
-sops_lastmodified=2026-09-26T06:04:51Z
-sops_mac=ENC[AES256_GCM,data:Q4AhgLZLR6hSSiwextwm53DHKKeSN+YSLKyQGNfZG/sb/c+4QOQxYXZD2YXShbOei1Og+IqcVCkJy+CaYAE6roz04AxnQgis3anVOSOAMAcezFndXU/f80pqkikj/o14O6ueOi/2gQMJND9HHEZSJBAwpJbsX1CLru16Uv2gkaY=,iv:nItKXHq2sgw8ijA5d/DxeTAafkwIUuxJXyXOP8gDuL0=,tag:oNYfflLLKhhQN8H1DRBVUQ==,type:str]
 sops_unencrypted_suffix=_unencrypted
 sops_version=3.13.3

virtual-machines/vm-test/virtual.nix

@@ -35,6 +35,21 @@
     };
   };
 
+  # Networking
+  networking = {
+    nftables.enable = true;
+    firewall = {
+      enable = true;
+      allowedTCPPorts = [
+        22
+        80 # gitea routing not enabled, open firewall here
+        443 # gitea routing not enabled, open firewall here
+        30222 # gitea routing not enabled, open firewall here
+        6443 # k3s
+      ];
+    };
+  };
+
   # Packages
   environment.systemPackages = with pkgs; [
     curl
@@ -63,6 +78,20 @@
     ];
   };
 
+  # ================================ #
+  #           GITEA SERVICE          #
+  # ================================ #
+
+  services.hl-gitea = {
+    enable = true;
+    credentialsFile = credentials.gitea-env;
+    database-hostname = "192.168.8.180:5432";
+
+    default-nginx = {
+      enable = false;
+    };
+  };
+
   # ================================ #
   #           PSQL SERVICE           #
   # ================================ #
@@ -74,7 +103,7 @@
     port = 5432;
     credentialsFile = credentials.psql-env;
     databases = [
-      "test"
+      "gitea"
     ];
     ipMasks = [
       "10.42.0.0/20" # k3s pod mask