add gc

nixos/configuration.nix

@@ -7,10 +7,20 @@
 {
   imports = [ ];
 
-  nix.settings.experimental-features = [
-    "nix-command"
-    "flakes"
-  ];
+  nix = {
+    settings.experimental-features = [
+      "nix-command"
+      "flakes"
+    ];
+
+    gc = {
+      automatic = true;
+      persistent = true;
+      dates = [ "daily" ];
+      options = "--delete-older-than 7d";
+    };
+  };
+
   nixpkgs.config.allowUnfree = true;
 
   # Secret Management
@@ -225,8 +235,6 @@
       enable = true;
       allowedTCPPorts = [
         22
-        80
-        443
         6443 # k3s
       ];
 
@@ -279,6 +287,7 @@
       "/var/lib/nixos"
       "/var/db/sudo/lectured"
       "/var/lib/acme"
+      "/run/sops-virtual"
     ];
   };
 
@@ -325,6 +334,12 @@
         path = "/persist/etc/ssh/ssh_host_rsa_key";
       }
     ];
+
+    # Don't allow remote password login
+    settings = {
+      PasswordAuthentication = false;
+      KbdInteractiveAuthentication = false;
+    };
   };
 
   # INITIAL system version

nixos/home-manager/home.nix

@@ -40,6 +40,7 @@
     woeusb
     wofi
     xrandr
+    yq
     zip
   ];
 

virtual-machines/.sops.yaml

@@ -3,7 +3,6 @@ keys:
     - &laptop age1zad0qu648dhjav4pzjhkc6vswnqtacuv9230xcgle8wmv56r8ykqn0ud7y
     - &desktop age1rwugh86469664fwhgrj9xuhjxs9vpflx3r0ftuvd0glphf2gecfs8thxsj
     - &nixos-homelab-00 age1hzaf8j6djfc4yc98m3kqjzzdj4tcskf9kdzvjmje2xuqcfmrz5lqdtn5w7
-    - &virtual age1q5zwds8g47j7xsqhp8tk995l3n4a5z876vff7wgx4sztwgdsa3yq7eu6xk
 creation_rules:
   - path_regex: '.*/secrets/[^/]+\.(yaml|json|env|ini)$'
     key_groups:
@@ -11,4 +10,3 @@ creation_rules:
           - *laptop
           - *desktop
           - *nixos-homelab-00
-          - *virtual

virtual-machines/build-image.sh

@@ -63,6 +63,8 @@ fi
 
 SOPS_BACKUP="$(mktemp)"
 AGE_TEMP="$(mktemp)"
+rm -f "$AGE_TEMP"
+
 cp -p "$SOPS_CONFIG" "$SOPS_BACKUP"
 
 CLEANED_UP=0
@@ -75,16 +77,32 @@ cleanup() {
     fi
     CLEANED_UP=1
 
-    # Restore the repository's original SOPS configuration.
+    # Restore the original SOPS configuration.
     cp "$SOPS_BACKUP" "$SOPS_CONFIG"
+
+    # Remove the temporary recipient from encrypted secrets.
+    # Do this while the original recipients are restored.
+    if [[ -d "$VM_DIR/secrets" ]]; then
+        shopt -s nullglob
+        local secret_files=("$VM_DIR"/secrets/*)
+        shopt -u nullglob
+
+        for secret in "${secret_files[@]}"; do
+            [[ -f "$secret" ]] || continue
+            echo "Restoring SOPS recipients: ${secret#"$SCRIPT_DIR"/}"
+            if ! sops updatekeys --yes "$secret"; then
+                echo "WARNING: Failed to restore recipients in $secret" >&2
+                status=1
+            fi
+        done
+    fi
+
     rm -f "$SOPS_BACKUP" "$AGE_TEMP"
 
-    # Remove the temporary private key, even if the build failed.
+    # Remove the temporary private key after recipient metadata is restored.
     sudo rm -f "$AGE_KEY"
-    sudo rmdir "$AGE_DIR" 2>/dev/null || true
 
     echo "Temporary age key removed."
-
     return "$status"
 }
 
@@ -106,22 +124,18 @@ sudo install -o root -g nixbld -m 0440 \
 # Requires mikefarah/yq v4 and simple comma-separated age fields.
 export AGE_PUBLIC_KEY
 
-if ! yq -e \
-    '.creation_rules | any(.[]; has("age"))' \
-    "$SOPS_CONFIG" >/dev/null; then
-    echo "No creation_rules with an age field found in .sops.yaml" >&2
+# Confirm at least one age key group exists.
+if ! yq -e '
+  [.creation_rules[].key_groups[] | select(.age != null)] | length > 0
+' "$SOPS_CONFIG" >/dev/null; then
+    echo "No creation_rules with key_groups.age found in .sops.yaml" >&2
     exit 1
 fi
 
-yq -i '
-    (.creation_rules[] | select(has("age")) | .age) |= (
-        split(",")
-        | map(trim)
-        | map(select(. != ""))
-        | . + [strenv(AGE_PUBLIC_KEY)]
-        | unique
-        | join(",")
-    )
+# Add the temporary public key to each age recipient list.
+yq -y -i '
+  (.creation_rules[].key_groups[] | select(.age != null).age) |=
+    (. + [env.AGE_PUBLIC_KEY] | unique)
 ' "$SOPS_CONFIG"
 
 echo "Updating SOPS recipients for secrets in $VM_FOLDER..."

virtual-machines/vm-test/flake.lock

@@ -1,12 +1,28 @@
 {
   "nodes": {
+    "gitea": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "path": "../../homelab-services/gitea",
+        "type": "path"
+      },
+      "original": {
+        "path": "../../homelab-services/gitea",
+        "type": "path"
+      },
+      "parent": []
+    },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1790340521,
-        "narHash": "sha256-cRrWlIjVRJ6BHDr9caUdXsZ3owzWIKYHpNmGPHBInIU=",
+        "lastModified": 1792503283,
+        "narHash": "sha256-vhe2jyvRCgufWPqDuDq1S3t3ypE+ka46IFutV02xKso=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "f5c082a40f7571c266e74e80ae2e68aadd8a9fc7",
+        "rev": "cd4ea8d57de16f4810bc5f14207bac45fbf19f67",
         "type": "github"
       },
       "original": {
@@ -34,6 +50,7 @@
     },
     "root": {
       "inputs": {
+        "gitea": "gitea",
         "nixpkgs": "nixpkgs",
         "postgresql-db": "postgresql-db"
       }

virtual-machines/vm-test/flake.nix

@@ -7,6 +7,10 @@
       url = "path:../../homelab-services/postgresql-db";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    gitea = {
+      url = "path:../../homelab-services/gitea";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
   outputs =
@@ -14,6 +18,7 @@
       self,
       nixpkgs,
       postgresql-db,
+      gitea,
     }@inputs:
     let
       system = "x86_64-linux";
@@ -45,6 +50,7 @@
           modules = [
             ./virtual.nix
             postgresql-db.nixosModules.postgresql-db
+            gitea.nixosModules.hl-gitea
 
             # declare the vm output
             "${inputs.nixpkgs}/nixos/modules/virtualisation/incus-virtual-machine.nix"

virtual-machines/vm-test/secrets/gitea.env

@@ -0,0 +1,13 @@
+GITEA_DB_NAME=ENC[AES256_GCM,data:zEhMvGo=,iv:HxxKDckuk8wzV9k1be2kbhWWwKN5C36Mciaj+RbNfRQ=,tag:l2JTkvzVSiSD8RmMWPY/pw==,type:str]
+GITEA_DB_USER=ENC[AES256_GCM,data:I7w/mZ7yq9yeHA==,iv:N3hT4f6BcH4xt0Z+YowTSM/MLIV4C1afM+2MYMFYAlg=,tag:tiUDZ9UvE/Rzmfcw69kK9Q==,type:str]
+GITEA_DB_PASS=ENC[AES256_GCM,data:TRG6S/fCrJ8=,iv:gAmGfL0vapgSIf7Gyhm12ibKRmBurN5IBJIcRVki/PY=,tag:Zinc2oTv+jlZ+E+wgEvIwQ==,type:str]
+sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTWXBOSDViRVc1YVpRd2tZ\naDRvU2t0Ti8zTkoxdG1PbGR3UmNrQzlzOFVFCmlHZHNZL0VVdk81NzlVdGJsdjgy\ndFM1WmY3cXN6WHNXZjlBTGFWYnFoZjgKLS0tIHFJakgyTXhtcHYzbG9OWTJXRkMx\nK0Y4SGhnRmMyNWplTExQQmp1ZEk2VFEKwfxoGZ5q5ZTfe4+u0sm0VW6RSIZMIhPW\nCjXwHVuN9i06EH2CZ57zddjsVmXDJG6bsx7htEauxBA4TipwIrDcZQ==\n-----END AGE ENCRYPTED FILE-----\n
+sops_age__list_0__map_recipient=age1zad0qu648dhjav4pzjhkc6vswnqtacuv9230xcgle8wmv56r8ykqn0ud7y
+sops_age__list_1__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWbEZ4MUpONlh4MnJPWHBF\nU2I4T3BObm9IOStGZVFIOGp1anNZY3FGNG1vCnlHYVN5d1V3clFpeW9wTi94Uy93\nVmlmeU41bU1jM1NoZ3V1VE9UQWlmYkUKLS0tIDhhZk5YRFhGblRhWDFaL3AydHJy\nTVVheGxuUnh1NXduNUxod1k0blh2V0kKZSRFcP5R2wTjIi76KhTNNKSFXPbF7fES\nLvbs56t74WVJyCxAk9Vw5UESvTXiEAvBVZ9N7N0efhAEk8iIcykrGQ==\n-----END AGE ENCRYPTED FILE-----\n
+sops_age__list_1__map_recipient=age1rwugh86469664fwhgrj9xuhjxs9vpflx3r0ftuvd0glphf2gecfs8thxsj
+sops_age__list_2__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWNGlMMWlkTEZCRVdqNXJY\nWHFQWjJSZWhRMEtoOCtVOGRHSGlzZm52RWdBCmFuUWpjeW1ab0IwVlplRHQ1RXVo\nejVrekUzYzV1cHZnaDV2UUhDUjNmNXMKLS0tIGRzelliOFVLZ293Z09rOFhhazJ0\nRi9GNkxnYnZkYXdJOFIvZUo4MDVEUUkKgBXWzRcjCQP+GkH2kI2PjDa1hPlx/F2m\nVsyaL4bAt7EQj23DkYYoJ0rMcksSOVtID5CbC/JYy7pTl8n0l3vOIw==\n-----END AGE ENCRYPTED FILE-----\n
+sops_age__list_2__map_recipient=age1hzaf8j6djfc4yc98m3kqjzzdj4tcskf9kdzvjmje2xuqcfmrz5lqdtn5w7
+sops_lastmodified=2026-10-21T04:55:18Z
+sops_mac=ENC[AES256_GCM,data:f79R0ImdGWtaPQ7S8U6/sSUArI17sOBHZYfRFs9oft4rg7nF84Umpy9Tjsy4whjRHQjpPy5iQIWORAkdVsZ4ecW0KTwDTzXAjuXYlxxoTqKkyWQOOF2X2uhZalwpw4e+RM+vkXL6qatlkFcKz3STG7/T3i4NvOa+fmMh6+vZnCc=,iv:GQU2vsU4AS629V62rCVAU8gsT+vuXFamx7/3MBhEsTA=,tag:ZkkTD7Ku0FGwyDJia1SsAQ==,type:str]
+sops_unencrypted_suffix=_unencrypted
+sops_version=3.13.3

virtual-machines/vm-test/secrets/psql.env

@@ -1,13 +1,11 @@
-PSQL_TEST_PASSWORD=ENC[AES256_GCM,data:23yfH/WahP629zM=,iv:d7MCyz1OD/Ns1D4KMMtOhMMnG3WVXG406sUA5Xv0eFw=,tag:QTa5Akrd/co03MZn5C2VPA==,type:str]
-sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiVkRsaGJDUU4vWUtXUSth\naFNNbWNQNXh1WHNHS0EwUUYwY0tGTzJrclRRCjNIK2RxYnc5VU45UVFjMEhHVGtD\ncjQ1eHBRUHhId0dYRU5UTCsxMzFOaTgKLS0tIHQxUFVnSjl3Rjk1WmJWVlJZNGtn\ndk5MWit0T09ZZnBzT3AzUndPRWVkV00KYw64NyJ5YB2pkUdhAmGouk0rtf/J2RfZ\nAh7p5Nozm7d7Cx4hNXFV3sd1IpNnDYL4Tv+0+0Rp7SpXSVQagzdiwQ==\n-----END AGE ENCRYPTED FILE-----\n
+PSQL_GITEA_PASSWORD=ENC[AES256_GCM,data:tT/Uym0M6GY=,iv:4+UJmz6AD7K4qn4HfPNFafV0Bqi17Pr1LU+wARn9X44=,tag:wyD7gdV+vibdgFnExyooMw==,type:str]
+sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnRnpUOFRiemJnVFcyVUdi\ndllyZklUd1BGcUlzaEV5cVdCUEoyM1BOYVNnCnFXUTRjdmVnNVp2RkFhM2plMHBz\nblI5SWJSVGdnTzI5M08xcS9na0xTQVEKLS0tIFYvRVVpWWlPQ3g0YTNnMVQ5MzNl\nWjVZdkNTT0U1aHpNbGpkdzlZZEk3SVUKuZYSue3+1HZrlv/DD/rIcL7jbUuAmfR4\nXOwRzwpfC2Pwf+d9pTCRQ9v+AephLE9fLQp9EpT9qUlUxd8MH4zEIA==\n-----END AGE ENCRYPTED FILE-----\n
 sops_age__list_0__map_recipient=age1zad0qu648dhjav4pzjhkc6vswnqtacuv9230xcgle8wmv56r8ykqn0ud7y
-sops_age__list_1__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCdTVJVVczbmFEWlRnU0Rt\naVpIYmhwQXpPQk9abzlBQUlGVCtVeHhZTkQwCjAxMDF4SmRNUDRpNU9BK0hmcmV2\nSFkyUWZLekhWN1JRYjdXWk53Nkd1dTAKLS0tIGtxODlrWWlLV0loeHQzWjRaYkJI\nSnNnY280cXlhcDZmeVJqaENVV1pYNkUKQNdY1baew90hV1lqTrEqDuql1uY4F1/o\nupm8cuUIYh2Og70arMXfi8C7VfTgCF93q0V3MLXKmaWyeC0YcH9qsw==\n-----END AGE ENCRYPTED FILE-----\n
+sops_age__list_1__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2MXhmRGMwVWttWitKNDhT\nOG5pNkNjMGVjWDl2Ylp4WHRXVy9rRGFTSFVRClloaGcrQnZnYUF4WW1FSWRZbXd5\na2M5ZXNSWmVkTjlmbHpWc2hjT3pBS2MKLS0tIGoxNExVYk1xV1RmL0dDM3Y1cER5\nUmVkSGQ5OURPRWRqMWhpUmJ2V2h3OFEK5lB3GIEjnnTKZqdN6dAEMu4bM9Ywu+BB\nfS6wf1H8e2KRyaFy6jyoQfTDJr+yRjCPW4cTmbHXlhe8z3K1hPMWwg==\n-----END AGE ENCRYPTED FILE-----\n
 sops_age__list_1__map_recipient=age1rwugh86469664fwhgrj9xuhjxs9vpflx3r0ftuvd0glphf2gecfs8thxsj
-sops_age__list_2__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwVGJiOWhPUTlUa0F2SWNm\ndFd1MDM3Mno1Nm1kOWlkVnYxTDhweVB5ZWh3CnFjbE5OcEEwYzZEUFg1VVg5R1ZR\nT09YTEkvR2lSSUVuNnVER1dEeTBvZlkKLS0tIGxUVGRJUitLSDVHNDJSNXlERGZN\nR05FdVlQWkJyeTcwQ1A1ekZyVmJZY0UKJe75gpOUYrRTRSzfG9GX7pD0nNgiP79Q\n+mKco3+6UAS3Lvx/fdHsAQBlL8NfF1K2WTtNXoTjqVFLK4BMXkYkVQ==\n-----END AGE ENCRYPTED FILE-----\n
+sops_age__list_2__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3K2x4MVR4ZmRUN2l2d2dw\nRGFQU3d4c2I2Q0k2WFg1WUQ5aXJqR2hOdVJzCmVHZjRqZGYwSUVUcmFtc3ZFaWpk\nNi9BNCttRzZuVnVUbkdHU2VMeWN5SlEKLS0tIDV4Q3M2Y2ZLT24zd2xvRTR5MkRi\nb3k4N21lQlgwbktQNm9PYlhQdmNFOUEKbMNZwxJ7vbZr6KhkzKkL6X1R4iqGJOJa\nSFYTWMzONRiymBWKnxqqSWyzgjV3kZbUljdngpvYZ9eoDrzQ/wtV8w==\n-----END AGE ENCRYPTED FILE-----\n
 sops_age__list_2__map_recipient=age1hzaf8j6djfc4yc98m3kqjzzdj4tcskf9kdzvjmje2xuqcfmrz5lqdtn5w7
-sops_age__list_3__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTaTdnYjc1SDgvNW9hMUc4\nQ3M0cnBQTThycEdtKzdhZUxDN1lRbEd0U0g0Cml4M2JFTUlIdEMxKzZ6Q09IOGRH\nRWpTUXRpWkV1cmdkY2Z1SVJWaERGaEEKLS0tIENVS3dVVVN2allaZXE1bmh4eU4w\nVFNpdWZrT200NzVxZ3owSnVhdm42RGcKH+01ReDxA0ZusdMKhxl7S+f65Lla3RHa\nuHBPXStwk6Q5YmC4AtV22YgQ/V0qRDrhQM49zX7WFGVo9HxmQ7AqHA==\n-----END AGE ENCRYPTED FILE-----\n
-sops_age__list_3__map_recipient=age1q5zwds8g47j7xsqhp8tk995l3n4a5z876vff7wgx4sztwgdsa3yq7eu6xk
-sops_lastmodified=2026-09-26T06:04:51Z
-sops_mac=ENC[AES256_GCM,data:Q4AhgLZLR6hSSiwextwm53DHKKeSN+YSLKyQGNfZG/sb/c+4QOQxYXZD2YXShbOei1Og+IqcVCkJy+CaYAE6roz04AxnQgis3anVOSOAMAcezFndXU/f80pqkikj/o14O6ueOi/2gQMJND9HHEZSJBAwpJbsX1CLru16Uv2gkaY=,iv:nItKXHq2sgw8ijA5d/DxeTAafkwIUuxJXyXOP8gDuL0=,tag:oNYfflLLKhhQN8H1DRBVUQ==,type:str]
+sops_lastmodified=2026-10-21T04:55:45Z
+sops_mac=ENC[AES256_GCM,data:444WNcnJjuE09R9ERw5VV5vGXEo1coHKaa37luYKejcV/TNpzaeyJu9b+5UmMVJuYNm878l6tX/gmoTfliocn6Z4RaoWnNP0H5VkUw9khA3zksnrxUfpaG1CIR53BP0ZhuqMDhpvYYA1crhHUJhT0PRBdAlDluivlt627K8L4Sc=,iv:oObMPvFlsnGmseVJNAj/mMHCeyaFp4JvjedYVmz+PBA=,tag:HtV1wM+vyhpZv+x1Yd47Ww==,type:str]
 sops_unencrypted_suffix=_unencrypted
 sops_version=3.13.3

virtual-machines/vm-test/virtual.nix

@@ -35,6 +35,21 @@
     };
   };
 
+  # Networking
+  networking = {
+    nftables.enable = true;
+    firewall = {
+      enable = true;
+      allowedTCPPorts = [
+        22
+        80 # gitea routing not enabled, open firewall here
+        443 # gitea routing not enabled, open firewall here
+        30222 # gitea routing not enabled, open firewall here
+        6443 # k3s
+      ];
+    };
+  };
+
   # Packages
   environment.systemPackages = with pkgs; [
     curl
@@ -63,6 +78,20 @@
     ];
   };
 
+  # ================================ #
+  #           GITEA SERVICE          #
+  # ================================ #
+
+  services.hl-gitea = {
+    enable = true;
+    credentialsFile = credentials.gitea-env;
+    database-hostname = "192.168.8.180:5432";
+
+    default-nginx = {
+      enable = false;
+    };
+  };
+
   # ================================ #
   #           PSQL SERVICE           #
   # ================================ #
@@ -74,7 +103,7 @@
     port = 5432;
     credentialsFile = credentials.psql-env;
     databases = [
-      "test"
+      "gitea"
     ];
     ipMasks = [
       "10.42.0.0/20" # k3s pod mask