feat(infra): showcase the declarative bucket feature

Signed-off-by: Ryan Lahfa <ryan@dgnum.eu>
feat(infra): add S3 declarative buckets
2024-10-10 17:59:00 +02:00 · 2024-10-10 17:59:00 +02:00 · 2024-10-10 17:53:00 +02:00
132 changed files with 3655 additions and 2389 deletions
--- a/.credentials/admin-environment.age
+++ b/.credentials/admin-environment.age
--- a/.credentials/secrets.nix
+++ b/.credentials/secrets.nix
@ -0,0 +1,6 @@
+let
+  keys = import ../keys;
+in
+{
+  "admin-environment.age".publicKeys = keys.rootKeys;
+}
--- a/.envrc
+++ b/.envrc
@ -1,2 +1 @@
-watch_file workflows/*
 use nix
--- a/.forgejo/workflows/check-meta.yaml
+++ b/.forgejo/workflows/check-meta.yaml
@ -1,21 +1,25 @@
-jobs:
-  check_dns:
-    runs-on: nix
-    steps:
-    - uses: actions/checkout@v3
-    - name: Check the validity of the DNS configuration
-      run: nix-build meta/verify.nix -A dns
-  check_meta:
-    runs-on: nix
-    steps:
-    - uses: actions/checkout@v3
-    - name: Check the validity of meta options
-      run: nix-build meta/verify.nix -A meta
 name: Check meta
 on:
  pull_request:
    branches:
-    - main
+      - main
  push:
    paths:
-    - meta/*
+      - 'meta/*'
+
+jobs:
+  check_meta:
+    runs-on: nix
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Check the validity of meta options
+        run: nix-build meta/verify.nix -A meta
+
+  check_dns:
+    runs-on: nix
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Check the validity of the DNS configuration
+        run: nix-build meta/verify.nix -A dns --no-out-link
--- a/.forgejo/workflows/check-workflows.yaml
+++ b/.forgejo/workflows/check-workflows.yaml
@ -1,16 +0,0 @@
-jobs:
-  check_workflows:
-    runs-on: nix
-    steps:
-    - uses: actions/checkout@v3
-    - name: Check that the workflows are up to date
-      run: nix-shell -A check-workflows --run '[ $(git status --porcelain | wc -l)
-        -eq 0 ]'
-name: Check workflows
-on:
-  pull_request:
-    branches:
-    - main
-  push:
-    paths:
-    - workflows/*
--- a/.forgejo/workflows/ds-fr.yaml
+++ b/.forgejo/workflows/ds-fr.yaml
@ -0,0 +1,56 @@
+name: ds-fr update
+on:
+  schedule:
+    - cron: "26 18 * * wed"
+
+jobs:
+  npins_update:
+    runs-on: nix
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          token: ${{ secrets.TEA_DGNUM_CHORES_TOKEN }}
+
+      - name: Update DS and open PR if necessary
+        run: |
+          # Fetch the latest release tag
+          VERSION=$(curl -L \
+            -H "Accept: application/vnd.github+json" \
+            -H "X-GitHub-Api-Version: 2022-11-28" \
+            https://api.github.com/repos/demarches-simplifiees/demarches-simplifiees.fr/releases/latest \
+          | jq -r '.tag_name')
+
+          # Move to the ds-fr directory
+          cd machines/compute01/ds-fr/package
+
+          # Run the update script
+          ./update.sh -v "$VERSION"
+
+          if [ ! -z "$(git diff --name-only)" ]; then
+            echo "[+] Changes detected, pushing updates."
+
+            git switch -C ds-update
+
+            git add .
+
+            git config user.name "DGNum Chores"
+            git config user.email "tech@dgnum.eu"
+
+            git commit --message "chore(ds-fr): Update"
+            git push --set-upstream origin ds-update --force
+
+            # Connect to the server with the cli
+            tea login add \
+              -n dgnum-chores \
+              -t '${{ secrets.TEA_DGNUM_CHORES_TOKEN }}' \
+              -u https://git.dgnum.eu
+
+            # Create a pull request if needed
+            # i.e. no PR with the same title exists
+            if [ -z "$(tea pr ls -f='title,author' -o simple | grep 'chore(ds-fr): Update dgnum-chores')" ]; then
+              tea pr create \
+                --description "Automatic ds-fr update" \
+                --title "chore(ds-fr): Update" \
+                --head ds-update
+            fi
+          fi
--- a/.forgejo/workflows/eval-nodes.yaml
+++ b/.forgejo/workflows/eval-nodes.yaml
@ -1,119 +0,0 @@
-jobs:
-  bridge01:
-    runs-on: nix
-    steps:
-    - uses: actions/checkout@v3
-    - env:
-        BUILD_NODE: bridge01
-        STORE_ENDPOINT: https://tvix-store.dgnum.eu/infra-signing/
-        STORE_PASSWORD: ${{ secrets.STORE_PASSWORD }}
-        STORE_USER: admin
-      name: Build and cache bridge01
-      run: nix-shell -A eval-nodes --run cache-node
-  compute01:
-    runs-on: nix
-    steps:
-    - uses: actions/checkout@v3
-    - env:
-        BUILD_NODE: compute01
-        STORE_ENDPOINT: https://tvix-store.dgnum.eu/infra-signing/
-        STORE_PASSWORD: ${{ secrets.STORE_PASSWORD }}
-        STORE_USER: admin
-      name: Build and cache compute01
-      run: nix-shell -A eval-nodes --run cache-node
-  geo01:
-    runs-on: nix
-    steps:
-    - uses: actions/checkout@v3
-    - env:
-        BUILD_NODE: geo01
-        STORE_ENDPOINT: https://tvix-store.dgnum.eu/infra-signing/
-        STORE_PASSWORD: ${{ secrets.STORE_PASSWORD }}
-        STORE_USER: admin
-      name: Build and cache geo01
-      run: nix-shell -A eval-nodes --run cache-node
-  geo02:
-    runs-on: nix
-    steps:
-    - uses: actions/checkout@v3
-    - env:
-        BUILD_NODE: geo02
-        STORE_ENDPOINT: https://tvix-store.dgnum.eu/infra-signing/
-        STORE_PASSWORD: ${{ secrets.STORE_PASSWORD }}
-        STORE_USER: admin
-      name: Build and cache geo02
-      run: nix-shell -A eval-nodes --run cache-node
-  rescue01:
-    runs-on: nix
-    steps:
-    - uses: actions/checkout@v3
-    - env:
-        BUILD_NODE: rescue01
-        STORE_ENDPOINT: https://tvix-store.dgnum.eu/infra-signing/
-        STORE_PASSWORD: ${{ secrets.STORE_PASSWORD }}
-        STORE_USER: admin
-      name: Build and cache rescue01
-      run: nix-shell -A eval-nodes --run cache-node
-  storage01:
-    runs-on: nix
-    steps:
-    - uses: actions/checkout@v3
-    - env:
-        BUILD_NODE: storage01
-        STORE_ENDPOINT: https://tvix-store.dgnum.eu/infra-signing/
-        STORE_PASSWORD: ${{ secrets.STORE_PASSWORD }}
-        STORE_USER: admin
-      name: Build and cache storage01
-      run: nix-shell -A eval-nodes --run cache-node
-  vault01:
-    runs-on: nix
-    steps:
-    - uses: actions/checkout@v3
-    - env:
-        BUILD_NODE: vault01
-        STORE_ENDPOINT: https://tvix-store.dgnum.eu/infra-signing/
-        STORE_PASSWORD: ${{ secrets.STORE_PASSWORD }}
-        STORE_USER: admin
-      name: Build and cache vault01
-      run: nix-shell -A eval-nodes --run cache-node
-  web01:
-    runs-on: nix
-    steps:
-    - uses: actions/checkout@v3
-    - env:
-        BUILD_NODE: web01
-        STORE_ENDPOINT: https://tvix-store.dgnum.eu/infra-signing/
-        STORE_PASSWORD: ${{ secrets.STORE_PASSWORD }}
-        STORE_USER: admin
-      name: Build and cache web01
-      run: nix-shell -A eval-nodes --run cache-node
-  web02:
-    runs-on: nix
-    steps:
-    - uses: actions/checkout@v3
-    - env:
-        BUILD_NODE: web02
-        STORE_ENDPOINT: https://tvix-store.dgnum.eu/infra-signing/
-        STORE_PASSWORD: ${{ secrets.STORE_PASSWORD }}
-        STORE_USER: admin
-      name: Build and cache web02
-      run: nix-shell -A eval-nodes --run cache-node
-  web03:
-    runs-on: nix
-    steps:
-    - uses: actions/checkout@v3
-    - env:
-        BUILD_NODE: web03
-        STORE_ENDPOINT: https://tvix-store.dgnum.eu/infra-signing/
-        STORE_PASSWORD: ${{ secrets.STORE_PASSWORD }}
-        STORE_USER: admin
-      name: Build and cache web03
-      run: nix-shell -A eval-nodes --run cache-node
-name: Build all the nodes
-on:
-  pull_request:
-    branches:
-    - main
-  push:
-    branches:
-    - main
--- a/.forgejo/workflows/eval.yaml
+++ b/.forgejo/workflows/eval.yaml
@ -0,0 +1,200 @@
+name: build configuration
+on:
+  pull_request:
+    types: [opened, synchronize, edited, reopened]
+    branches:
+      - main
+  push:
+    branches:
+      - main
+
+jobs:
+  build_and_cache_krz01:
+    runs-on: nix
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Build and cache the node
+        run: nix-shell --run cache-node
+        env:
+          STORE_ENDPOINT: "https://tvix-store.dgnum.eu/infra-signing/"
+          STORE_USER: "admin"
+          STORE_PASSWORD: ${{ secrets.STORE_PASSWORD }}
+          BUILD_NODE: "krz01"
+
+      - uses: actions/upload-artifact@v3
+        if: always()
+        with:
+          name: outputs_krz01
+          path: paths.txt
+
+  build_and_cache_compute01:
+    runs-on: nix
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Build and cache the node
+        run: nix-shell --run cache-node
+        env:
+          STORE_ENDPOINT: "https://tvix-store.dgnum.eu/infra-signing/"
+          STORE_USER: "admin"
+          STORE_PASSWORD: ${{ secrets.STORE_PASSWORD }}
+          BUILD_NODE: "compute01"
+
+      - uses: actions/upload-artifact@v3
+        if: always()
+        with:
+          name: outputs_compute01
+          path: paths.txt
+
+  build_and_cache_storage01:
+    runs-on: nix
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Build and cache the node
+        run: nix-shell --run cache-node
+        env:
+          STORE_ENDPOINT: "https://tvix-store.dgnum.eu/infra-signing/"
+          STORE_USER: "admin"
+          STORE_PASSWORD: ${{ secrets.STORE_PASSWORD }}
+          BUILD_NODE: "storage01"
+
+      - uses: actions/upload-artifact@v3
+        if: always()
+        with:
+          name: outputs_storage01
+          path: paths.txt
+
+  build_and_cache_rescue01:
+    runs-on: nix
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Build and cache the node
+        run: nix-shell --run cache-node
+        env:
+          STORE_ENDPOINT: "https://tvix-store.dgnum.eu/infra-signing/"
+          STORE_USER: "admin"
+          STORE_PASSWORD: ${{ secrets.STORE_PASSWORD }}
+          BUILD_NODE: "rescue01"
+
+      - uses: actions/upload-artifact@v3
+        if: always()
+        with:
+          name: outputs_rescue01
+          path: paths.txt
+
+  build_and_cache_geo01:
+    runs-on: nix
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Build and cache the node
+        run: nix-shell --run cache-node
+        env:
+          STORE_ENDPOINT: "https://tvix-store.dgnum.eu/infra-signing/"
+          STORE_USER: "admin"
+          STORE_PASSWORD: ${{ secrets.STORE_PASSWORD }}
+          BUILD_NODE: "geo01"
+
+      - uses: actions/upload-artifact@v3
+        if: always()
+        with:
+          name: outputs_geo01
+          path: paths.txt
+
+  build_and_cache_geo02:
+    runs-on: nix
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Build and cache the node
+        run: nix-shell --run cache-node
+        env:
+          STORE_ENDPOINT: "https://tvix-store.dgnum.eu/infra-signing/"
+          STORE_USER: "admin"
+          STORE_PASSWORD: ${{ secrets.STORE_PASSWORD }}
+          BUILD_NODE: "geo02"
+
+      - uses: actions/upload-artifact@v3
+        if: always()
+        with:
+          name: outputs_geo02
+          path: paths.txt
+
+  build_and_cache_vault01:
+    runs-on: nix
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Build and cache the node
+        run: nix-shell --run cache-node
+        env:
+          STORE_ENDPOINT: "https://tvix-store.dgnum.eu/infra-signing/"
+          STORE_USER: "admin"
+          STORE_PASSWORD: ${{ secrets.STORE_PASSWORD }}
+          BUILD_NODE: "vault01"
+
+      - uses: actions/upload-artifact@v3
+        if: always()
+        with:
+          name: outputs_vault01
+          path: paths.txt
+
+  build_and_cache_web01:
+    runs-on: nix
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Build and cache the node
+        run: nix-shell --run cache-node
+        env:
+          STORE_ENDPOINT: "https://tvix-store.dgnum.eu/infra-signing/"
+          STORE_USER: "admin"
+          STORE_PASSWORD: ${{ secrets.STORE_PASSWORD }}
+          BUILD_NODE: "web01"
+
+      - uses: actions/upload-artifact@v3
+        if: always()
+        with:
+          name: outputs_web01
+          path: paths.txt
+
+  build_and_cache_web02:
+    runs-on: nix
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Build and cache the node
+        run: nix-shell --run cache-node
+        env:
+          STORE_ENDPOINT: "https://tvix-store.dgnum.eu/infra-signing/"
+          STORE_USER: "admin"
+          STORE_PASSWORD: ${{ secrets.STORE_PASSWORD }}
+          BUILD_NODE: "web02"
+
+      - uses: actions/upload-artifact@v3
+        if: always()
+        with:
+          name: outputs_web02
+          path: paths.txt
+
+  build_and_cache_bridge01:
+    runs-on: nix
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Build and cache the node
+        run: nix-shell --run cache-node
+        env:
+          STORE_ENDPOINT: "https://tvix-store.dgnum.eu/infra-signing/"
+          STORE_USER: "admin"
+          STORE_PASSWORD: ${{ secrets.STORE_PASSWORD }}
+          BUILD_NODE: "bridge01"
+
+      - uses: actions/upload-artifact@v3
+        if: always()
+        with:
+          name: outputs_web02
+          path: paths.txt
--- a/.forgejo/workflows/lint.yaml
+++ b/.forgejo/workflows/lint.yaml
@ -0,0 +1,11 @@
+name: lint
+on: [push, pull_request]
+
+jobs:
+  check:
+    runs-on: nix
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Run pre-commit on all files
+        run: nix-shell --run 'pre-commit run --all-files --hook-stage pre-push --show-diff-on-failure' -A shells.pre-commit ./.
--- a/.forgejo/workflows/npins-update.yaml
+++ b/.forgejo/workflows/npins-update.yaml
@ -1,25 +0,0 @@
-jobs:
-  npins_update:
-    runs-on: nix
-    steps:
-    - uses: actions/checkout@v3
-      with:
-        depth: 0
-        token: ${{ secrets.TEA_DGNUM_CHORES_TOKEN }}
-    - name: Update dependencies and open PR if necessary
-      run: "npins update\n\nif [ ! -z \"$(git diff --name-only)\" ]; then\n  echo
-        \"[+] Changes detected, pushing updates.\"\n\n  git switch -C npins-update\n\
-        \n  git add npins\n\n  git config user.name \"DGNum Chores\"\n  git config
-        user.email \"tech@dgnum.eu\"\n\n  git commit --message \"chore(npins): Update\"\
-        \n  git push --set-upstream origin npins-update --force\n\n  # Connect to
-        the server with the cli\n  tea login add \\\n    -n dgnum-chores \\\n    -t
-        \"${{ secrets.TEA_DGNUM_CHORES_TOKEN }}\" \\\n    -u https://git.dgnum.eu\n\
-        \n  # Create a pull request if needed\n  # i.e. no PR with the same title
-        exists\n  if [ -z \"$(tea pr ls -f='title,author' -o simple | grep 'chore(npins):
-        Update dgnum-chores')\" ]; then\n    tea pr create \\\n      --description
-        \"Automatic npins update\" \\\n      --title \"chore(npins): Update\" \\\n\
-        \      --head npins-update\n  fi\nfi\n"
-name: npins update
-on:
-  schedule:
-  - cron: 25 15 * * *
--- a/.forgejo/workflows/npins.yaml
+++ b/.forgejo/workflows/npins.yaml
@ -1,24 +1,31 @@
-{
-  name = "npins update";
-  on.schedule = [
+name: npins update
+on:
+  schedule:
    # Run at 11 o'clock every wednesday
-    { cron = "25 15 * * *"; }
-  ];
+    - cron: "25 15 * * *"

-  jobs.npins_update = {
-    runs-on = "nix";
-    steps = [
-      {
-        uses = "actions/checkout@v3";
-        "with" = {
-          depth = 0;
-          token = "\${{ secrets.TEA_DGNUM_CHORES_TOKEN }}";
-        };
-      }
+jobs:
+  npins_update:
+    runs-on: nix
+    steps:
+      # - name: Install applications
+      #   run: apt-get update && apt-get install sudo
+      #
+      - uses: actions/checkout@v3
+        with:
+          depth: 0
+          token: ${{ secrets.TEA_DGNUM_CHORES_TOKEN }}
+      #
+      # - uses: https://github.com/cachix/install-nix-action@v22
+      #   with:
+      #     nix_path: nixpkgs=channel:nixos-unstable

-      {
-        name = "Update dependencies and open PR if necessary";
-        run = ''
+      # - name: Install tea
+      #   run: |
+      #     nix-env -f '<nixpkgs>' -i tea
+
+      - name: Update dependencies and open PR if necessary
+        run: |
          npins update

          if [ ! -z "$(git diff --name-only)" ]; then
@ -37,7 +44,7 @@
            # Connect to the server with the cli
            tea login add \
              -n dgnum-chores \
-              -t "''${{ secrets.TEA_DGNUM_CHORES_TOKEN }}" \
+              -t '${{ secrets.TEA_DGNUM_CHORES_TOKEN }}' \
              -u https://git.dgnum.eu

            # Create a pull request if needed
@ -49,8 +56,3 @@
                --head npins-update
            fi
          fi
-        '';
-      }
-    ];
-  };
-}
--- a/.forgejo/workflows/pre-commit.yaml
+++ b/.forgejo/workflows/pre-commit.yaml
@ -1,12 +0,0 @@
-jobs:
-  check:
-    runs-on: nix
-    steps:
-    - uses: actions/checkout@v3
-    - name: Run pre-commit on all files
-      run: nix-shell -A pre-commit --run 'pre-commit run --all-files --hook-stage
-        pre-push --show-diff-on-failure'
-name: Run pre-commit on all files
-on:
- push
- pull_request
--- a/.gitignore
+++ b/.gitignore
@ -9,3 +9,9 @@ result-*
 *.qcow2
 .gcroots
 .pre-commit-config.yaml
+
+# Ignore Terraform configuration file
+config.tf.json
+
+# Ignore Terraform stuff
+.terraform
--- a/.terraform.lock.hcl
+++ b/.terraform.lock.hcl
@ -0,0 +1,38 @@
+# This file is maintained automatically by "tofu init".
+# Manual edits may be lost in future updates.
+
+provider "registry.opentofu.org/numtide/secret" {
+  version     = "1.2.1"
+  constraints = "~> 1.2.1"
+  hashes = [
+    "h1:t2z3CjxVsXjKb3g59WGkLtvDIR4NzLU7UFEcyAgF2C0=",
+    "zh:17cbc7f3b90ee2b3ae5adfc3bd9cb70166a5ffbd8e642e64afa7cb0e32a34bae",
+    "zh:5d66ce2aea25fc3c12cec6fc569b8ff314df6d773b9c3449983a4e9cde8347c7",
+    "zh:67d02e96bf0d07f2fcf16ce9427a7a26f53e695676405d0c2b815808f950411d",
+    "zh:77c3c05681ce199e6b0e2e5a2dfe418f61ae8863d527e7a7d47a9699d912683b",
+    "zh:7f37e633b4f94ba9f347cfe68d44f80fe066188feb954b13ee0f621caae4121d",
+    "zh:ea16bbe494c6ddd0af7bbea9554474c387517db4e7f0d15513bb29ff893871bc",
+  ]
+}
+
+provider "registry.opentofu.org/raitobezarius/garage" {
+  version     = "1.0.3"
+  constraints = "~> 1.0.3"
+  hashes = [
+    "h1:QKbZcU7u9OG1t/h4S3+pXS3sOUfVMmfLTiYh5L5j1rE=",
+    "zh:04f220a2baf4bd1bae07888a1c311cacd6076c209de83adbe573525fc50f2ea4",
+    "zh:078938d5fa07e024d779c664823427af28935bbeb77e0ff940bac3e7bc41f1e8",
+    "zh:2dd58a2d82094a1b07ff1b6de57e4a0d96e1f20abecd4f70a6469079b46b76d9",
+    "zh:325da7a74b1c84f934b38134d7c419253292aeed6f6836a2fb37f42d13a8ff67",
+    "zh:3ca9230ef87e70691b24fd83d40bb5b6a08f0b91ab26cbb2e692f92155b6d179",
+    "zh:45ef683a18a5053c93c691d08f3903fd4918467dfa056b1c274207de8a6aeb74",
+    "zh:4c9ee6c34b07c209c5daf1e9ff182f828667e54a90a683bc11cdcea86e4f8ef7",
+    "zh:5f0bb6524b2fffa606e0e3585af93dfc31b611c7abf55e4371ae5fc36e85972c",
+    "zh:7a3495dc211164c7d4042769c20d7111c767d0fd5908742e0766281c70d7d184",
+    "zh:7ce79867cdd4b1f7028da811cd5cb271a46820c79c0328a1221dd3bb6215c631",
+    "zh:93278861ee6bcb64e23bd1268f79b02035fba4fca0a98607a98f46abf8dfdf83",
+    "zh:937e681beea8b0dd899557f2a194c8128bd8810417ff04954bc9958ff826e980",
+    "zh:cae6e1598dd32f23f3900c41e50a6ece7d9456dbd033d855bb238ac21539d67b",
+    "zh:f6f7556ba7d5578604290170a709e00140be6d7f8a510a20bce49a9a23d75e5f",
+  ]
+}
--- a/default.nix
+++ b/default.nix
@ -41,15 +41,7 @@
 }:

 let
-  inherit (pkgs.lib)
-    isFunction
-    mapAttrs
-    mapAttrs'
-    nameValuePair
-    removeSuffix
-    ;
-
-  git-checks = (import sources.git-hooks).run {
+  git-checks = (import (builtins.storePath sources.git-hooks)).run {
    src = ./.;

    hooks = {
@ -76,24 +68,17 @@ let
    };
  };

-  workflows = (import sources.nix-actions { inherit pkgs; }).install {
-    src = ./.;
-
-    workflows = mapAttrs' (
-      name: _:
-      nameValuePair (removeSuffix ".nix" name) (
-        let
-          w = import ./workflows/${name};
-        in
-        if isFunction w then w { inherit (pkgs) lib; } else w
-      )
-    ) (builtins.readDir ./workflows);
+  terranixConfig = import "${sources.terranix}/core" {
+    inherit pkgs;
+    strip_nulls = true;
+    terranix_config.imports = [ ./terranix ];
  };
-
-  scripts = import ./scripts { inherit pkgs; };
+  terranixConfigFile = (pkgs.formats.json { }).generate "config.tf.json" terranixConfig.config;
 in

 {
+  inherit terranixConfigFile terranixConfig;
+
  nodes = builtins.mapAttrs (
    host: { site, ... }: "${host}.${site}.infra.dgnum.eu"
  ) (import ./meta/nodes.nix);
@ -102,35 +87,63 @@ in

  mkCacheSettings = import ./machines/storage01/tvix-cache/cache-settings.nix;

-  devShell = pkgs.mkShell {
-    name = "dgnum-infra";
+  shells = {
+    default = pkgs.mkShell {
+      name = "dgnum-infra";

-    packages = [
-      (pkgs.nixos-generators.overrideAttrs (_: {
-        version = "1.8.0-unstable";
-        src = sources.nixos-generators;
-      }))
-      pkgs.npins
+      packages = [
+        (pkgs.writeShellScriptBin "tf" ''
+          set -eo pipefail
+          ln -snf ${terranixConfigFile} config.tf.json
+          exec ${pkgs.lib.getExe pkgs.opentofu} "$@"
+        '')
+        (pkgs.writeShellScriptBin "decryptAndSourceEnvironment" ''
+          set -eo pipefail

-      (pkgs.callPackage ./lib/colmena { inherit (nix-pkgs) colmena; })
-      (pkgs.callPackage "${sources.agenix}/pkgs/agenix.nix" { })
-      (pkgs.callPackage "${sources.lon}/nix/packages/lon.nix" { })
-    ] ++ (builtins.attrValues scripts);
+          # TODO: don't hardcode me.
+          SECRET_FILE=".credentials/admin-environment.age"
+          IDENTITIES=()
+          for identity in [ "$HOME/.ssh/id_ed25519" "$HOME/.ssh/id_rsa" ]; do
+            test -r "$identity" || continue
+            IDENTITIES+=(-i)
+            IDENTITIES+=("$identity")
+          done

-    shellHook = ''
-      ${git-checks.shellHook}
-      ${workflows.shellHook}
-    '';
+          test "''${#IDENTITIES[@]}" -eq 0 && echo "[agenix-shell] WARNING: no readable identities found!"

-    preferLocalBuild = true;
+          test -f "$SECRET_FILE" || echo "[agenix-shell] WARNING: encrypted environment file $SECRET_FILE not found!"
+          export eval $(${pkgs.lib.getExe pkgs.rage} --decrypt "''${IDENTITIES[@]}" -o - $SECRET_FILE)

-    ###
-    # Alternative shells
+          echo "[agenix-shell] Repository-wide secrets loaded in the environment."
+        '')
+        (pkgs.nixos-generators.overrideAttrs (_: {
+          version = "1.8.0-unstable";
+          src = builtins.storePath sources.nixos-generators;
+        }))
+        pkgs.npins
+        pkgs.rage

-    passthru = mapAttrs (name: value: pkgs.mkShell (value // { inherit name; })) {
-      pre-commit.shellHook = git-checks.shellHook;
-      check-workflows.shellHook = workflows.shellHook;
-      eval-nodes.packages = [ scripts.cache-node ];
+        (pkgs.callPackage ./lib/colmena { inherit (nix-pkgs) colmena; })
+        (pkgs.callPackage "${sources.agenix}/pkgs/agenix.nix" { })
+        (pkgs.callPackage "${sources.lon}/nix/packages/lon.nix" { })
+
+      ] ++ (import ./scripts { inherit pkgs; });
+
+      shellHook = ''
+        ${git-checks.shellHook}
+        # If we want to export these environments, we need to source it, not call it.
+        source $(which decryptAndSourceEnvironment)
+      '';
+
+      preferLocalBuild = true;
+    };
+
+    pre-commit = pkgs.mkShell {
+      name = "pre-commit-shell";
+
+      shellHook = ''
+        ${git-checks.shellHook}
+      '';
    };
  };
 }
--- a/hive.nix
+++ b/hive.nix
@ -64,12 +64,23 @@ in
  };

  defaults =
-    { name, nodeMeta, ... }:
+    {
+      pkgs,
+      name,
+      nodeMeta,
+      ...
+    }:
    {
      # Import the default modules
      imports = [
        ./modules
-        (import "${sources.lix-module}/module.nix" { inherit (sources) lix; })
+        (import "${sources.lix-module}/module.nix" {
+          lix = pkgs.applyPatches {
+            name = "lix-2.90.patched";
+            src = sources.lix;
+            patches = [ ./patches/00-disable-installChecks-lix.patch ];
+          };
+        })
      ];

      # Include default secrets
--- a/keys/default.nix
+++ b/keys/default.nix
@ -17,23 +17,17 @@ rec {
    compute01 = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE/YluSVS+4h3oV8CIUj0OmquyJXju8aEQy0Jz210vTu" ];
    geo01 = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEl6Pubbau+usQkemymoSKrTBbrX8JU5m5qpZbhNx8p4" ];
    geo02 = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFNXaCS0/Nsu5npqQk1TP6wMHCVIOaj4pblp2tIg6Ket" ];
+    krz01 = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP4o65gWOgNrxbSd3kiQIGZUM+YD6kuZOQtblvzUGsfB" ];
    rescue01 = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEJa02Annu8o7ggPjTH/9ttotdNGyghlWfU9E8pnuLUf" ];
    storage01 = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA0s+rPcEcfWCqZ4B2oJiWT/60awOI8ijL1rtDM2glXZ" ];
    vault01 = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAJA6VA7LENvTRlKdcrqt8DxDOPvX3bg3Gjy9mNkdFEW" ];
    web01 = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPR+lewuJ/zhCyizJGJOH1UaAB699ItNKEaeuoK57LY5" ];
    web02 = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID+QDE+GgZs6zONHvzRW15BzGJNW69k2BFZgB/Zh/tLX" ];
-    web03 = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICrWsMEfK86iaO9SubMqE2UvZNtHkLY5VUod/bbqKC0L" ];

    # SSH keys of the DGNum members
-    agroudiev = [
-      "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDgyt3ntpcoI/I2n97R1hzjBiNL6R98S73fSi7pkSE/8mQbI8r9GzsPUBcxQ+tIg0FgwkLxTwF8DwLf0E+Le/rPznxBS5LUQaAktSQSrxz/IIID1+jN8b03vf5PjfKS8H2Tu3Q8jZXa8HNsj3cpySpGMqGrE3ieUmknd/YfppRRf+wM4CsGKZeS3ZhB9oZi3Jn22A0U/17AOJTnv4seq+mRZWRQt3pvQvpp8/2M7kEqizie/gTr/DnwxUr45wisqYYH4tat9Cw6iDr7LK10VCrK37BfFagMIZ08Hkh3c46jghjYNQWe+mBUWJByWYhTJ0AtYrbaYeUV1HVYbsRJ6bNx25K6794QQPaE/vc2Z/VK/ILgvJ+9myFSAWVylCWdyYpwUu07RH/jDBl2aqH62ESwAG7SDUUcte6h9N+EryAQLWc8OhsGAYLpshhBpiqZwzX90m+nkbhx1SqMbtt6TS+RPDEHKFYn8E6FBrf1FK34482ndq/hHXZ88mqzGb1nOnM="
-    ];
    catvayor = [
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAA16foz+XzwKwyIR4wFgNIAE3Y7AfXyEsUZFVVz8Rie catvayor@katvayor"
    ];
-    cst1 = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKrijwPlb7KQkYPLznMPVzPPT69cLzhEsJzZi9tmxzTh cst1@x270"
-    ];
    ecoppens = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIGmU7yEOCGuGNt4PlQbzd0Cms1RePpo8yEA7Ij/+TdA" ];
    gdd = [
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICE7TN5NQKGojNGIeTFiHjLHTDQGT8i05JFqX/zLW2zc"
@ -47,10 +41,8 @@ rec {
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDMBW7rTtfZL9wtrpCVgariKdpN60/VeAzXkh9w3MwbO julien@enigma"
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGa+7n7kNzb86pTqaMn554KiPrkHRGeTJ0asY1NjSbpr julien@tower"
    ];
-    mboyer = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGYnwZaFYvUxtJeNvpaA20rLfq8fOO4dFp7cIXsD8YNx" ];
    mdebray = [
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEpwF+XD3HgX64kqD42pcEZRNYAWoO4YNiOm5KO4tH6o maurice@polaris"
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFdDnSl3cyWil+S5JiyGqOvBR3wVh+lduw58S5WvraoL maurice@fekda"
    ];
    raito = [
      "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDcEkYM1r8QVNM/G5CxJInEdoBCWjEHHDdHlzDYNSUIdHHsn04QY+XI67AdMCm8w30GZnLUIj5RiJEWXREUApby0GrfxGGcy8otforygfgtmuUKAUEHdU2MMwrQI7RtTZ8oQ0USRGuqvmegxz3l5caVU7qGvBllJ4NUHXrkZSja2/51vq80RF4MKkDGiz7xUTixI2UcBwQBCA/kQedKV9G28EH+1XfvePqmMivZjl+7VyHsgUVj9eRGA1XWFw59UPZG8a7VkxO/Eb3K9NF297HUAcFMcbY6cPFi9AaBgu3VC4eetDnoN/+xT1owiHi7BReQhGAy/6cdf7C/my5ehZwD"
--- a/lib/nix-lib/default.nix
+++ b/lib/nix-lib/default.nix
@ -190,11 +190,8 @@ rec {
    recursiveFuse [
      (enableModules enabledModules)

-      {
-        imports =
-          (extraConfig.imports or [ ]) ++ (mkImports root ([ "_hardware-configuration" ] ++ enabledServices));
-      }
+      { imports = mkImports root ([ "_hardware-configuration" ] ++ enabledServices); }

-      (removeAttrs extraConfig [ "imports" ])
+      extraConfig
    ];
 }
--- a/machines/compute01/ds-fr/default.nix
+++ b/machines/compute01/ds-fr/default.nix
@ -1,35 +1,14 @@
-{
-  config,
-  pkgs,
-  sources,
-  ...
-}:
+{ config, ... }:

 let
  host = "demarches.dgnum.eu";
-
-  dgn-id = "fca8f72cd60c00e74d7735ec13e4e3a22e8e1244";
 in
 {
  imports = [ ./module.nix ];

-  dgn-web.internalPorts.ds-fr = 3000;
-
  services.demarches-simplifiees = {
    enable = true;

-    package =
-      ((import sources.nix-pkgs { inherit pkgs; }).demarches-simplifiees.override {
-        initialDeploymentDate = "20230923";
-      }).overrideAttrs
-        (old: {
-          dsModules = old.dsModules.overrideAttrs {
-            prePatch = ''
-              ${pkgs.lib.getExe pkgs.git} apply -p1 < ${builtins.fetchurl "https://git.dgnum.eu/DGNum/demarches-normaliennes/commit/${dgn-id}.patch"}
-            '';
-          };
-        });
-
    secretFile = config.age.secrets."ds-fr-secret_file".path;

    initialDeploymentDate = "20230923";
--- a/machines/compute01/grafana.nix
+++ b/machines/compute01/grafana.nix
@ -69,11 +69,17 @@ in
        }
      ];
    };
-  };

-  dgn-web.simpleProxies.grafana = {
-    inherit host port;
-    proxyWebsockets = true;
+    nginx.virtualHosts.${host} = {
+      enableACME = true;
+      forceSSL = true;
+
+      locations."/" = {
+        proxyPass = "http://127.0.0.1:${builtins.toString port}";
+        proxyWebsockets = true;
+        recommendedProxySettings = true;
+      };
+    };
  };

  age-secrets.autoMatch = [ "grafana" ];
--- a/machines/compute01/hedgedoc.nix
+++ b/machines/compute01/hedgedoc.nix
@ -29,6 +29,16 @@ in
      };
    };

+    nginx.virtualHosts.${host} = {
+      forceSSL = true;
+      enableACME = true;
+
+      locations."/" = {
+        proxyPass = "http://127.0.0.1:${builtins.toString port}";
+        proxyWebsockets = true;
+      };
+    };
+
    postgresql = {
      enable = true;

@ -43,11 +53,6 @@ in
    };
  };

-  dgn-web.simpleProxies.hedgedoc = {
-    inherit host port;
-    proxyWebsockets = true;
-  };
-
  systemd.services.hedgedoc.serviceConfig.StateDirectory = lib.mkForce [
    "hedgedoc"
    "hedgedoc/uploads"
--- a/machines/compute01/kanidm/default.nix
+++ b/machines/compute01/kanidm/default.nix
@ -1,22 +1,14 @@
 {
  config,
  lib,
-  meta,
+  nixpkgs,
  ...
 }:

 let
-  inherit (lib)
-    attrValues
-    catAttrs
-    escapeRegex
-    concatStringsSep
-    mapAttrs'
-    nameValuePair
-    ;
+  inherit (lib) escapeRegex concatStringsSep;

  domain = "sso.dgnum.eu";
-  port = 8443;

  cert = config.security.acme.certs.${domain};

@ -35,21 +27,19 @@ let
      "netbird-beta.hubrecht.ovh"
    ]
  );
-
-  usernameFor = member: meta.organization.members.${member}.username;
 in
 {
  services.kanidm = {
    enableServer = true;

-    # package = nixpkgs.unstable.kanidm;
+    package = nixpkgs.unstable.kanidm;

    serverSettings = {
      inherit domain;

      origin = "https://${domain}";

-      bindaddress = "127.0.0.1:${builtins.toString port}";
+      bindaddress = "127.0.0.1:8443";
      ldapbindaddress = "0.0.0.0:636";

      trust_x_forward_for = true;
@ -57,113 +47,10 @@ in
      tls_chain = "${cert.directory}/fullchain.pem";
      tls_key = "${cert.directory}/key.pem";
    };
-
-    provision = {
-      enable = true;
-
-      persons = mapAttrs' (
-        _:
-        {
-          email,
-          name,
-          username,
-          ...
-        }:
-        nameValuePair username {
-          displayName = name;
-          mailAddresses = [ email ];
-        }
-      ) meta.organization.members;
-
-      groups =
-        {
-          grp_active.members = catAttrs "username" (attrValues meta.organization.members);
-        }
-        // (mapAttrs' (
-          name: members: nameValuePair "grp_${name}" { members = builtins.map usernameFor members; }
-        ) meta.organization.groups);
-
-      # INFO: The authentication resources declared here can only be for internal services,
-      #       as regular members cannot be statically known.
-      systems.oauth2 = {
-        dgn_grafana = {
-          displayName = "Grafana [Analysis]";
-          originLanding = "https://grafana.dgnum.eu";
-          originUrl = "https://grafana.dgnum.eu/";
-          preferShortUsername = true;
-
-          scopeMaps.grp_active = [
-            "openid"
-            "profile"
-            "email"
-          ];
-        };
-
-        dgn_librenms = {
-          allowInsecureClientDisablePkce = true;
-          displayName = "LibreNMS [Network]";
-          enableLegacyCrypto = true;
-          originLanding = "https://nms.dgnum.eu";
-          originUrl = "https://nms.dgnum.eu/";
-          preferShortUsername = true;
-
-          scopeMaps.grp_active = [
-            "openid"
-            "profile"
-            "email"
-          ];
-        };
-
-        dgn_netbird = {
-          displayName = "Netbird [VPN]";
-          enableLocalhostRedirects = true;
-          originLanding = "https://netbird.dgnum.eu";
-          originUrl = "https://netbird.dgnum.eu/";
-          preferShortUsername = true;
-          public = true;
-
-          scopeMaps.grp_active = [
-            "openid"
-            "profile"
-            "email"
-          ];
-        };
-
-        dgn_netbox = {
-          allowInsecureClientDisablePkce = true;
-          displayName = "Netbox [Inventory]";
-          enableLegacyCrypto = true;
-          originLanding = "https://netbox.dgnum.eu";
-          originUrl = "https://netbox.dgnum.eu/";
-          preferShortUsername = true;
-
-          scopeMaps.grp_active = [
-            "openid"
-            "profile"
-            "email"
-          ];
-        };
-
-        dgn_outline = {
-          displayName = "Outline [Docs]";
-          originUrl = "https://docs.dgnum.eu/";
-          originLanding = "https://docs.dgnum.eu";
-          preferShortUsername = true;
-
-          scopeMaps.grp_active = [
-            "openid"
-            "profile"
-            "email"
-          ];
-        };
-      };
-    };
  };

  users.users.kanidm.extraGroups = [ cert.group ];

-  dgn-web.internalPorts.kanidm = port;
-
  services.nginx = {
    enable = true;

@ -171,7 +58,7 @@ in
      enableACME = true;
      forceSSL = true;
      locations."/" = {
-        proxyPass = "https://127.0.0.1:${builtins.toString port}";
+        proxyPass = "https://127.0.0.1:8443";

        extraConfig = ''
          if ( $request_method !~ ^(GET|POST|HEAD|OPTIONS|PUT|PATCH|DELETE)$ ) {
--- a/machines/compute01/nextcloud.nix
+++ b/machines/compute01/nextcloud.nix
@ -3,8 +3,6 @@
 let
  host = "cloud.dgnum.eu";
  nextcloud-occ = "${config.services.nextcloud.occ}/bin/nextcloud-occ";
-
-  port = 9980;
 in
 {
  services.nextcloud = {
@ -106,7 +104,7 @@ in
        imageDigest = "sha256:07da8a191b37058514dfdf921ea8c2270c6634fa659acee774cf8594f86950e4";
        sha256 = "sha256-5oaz07NQScHUVN/HznzZGQ2bGrU/V1GhI+9btXHz0GM=";
      };
-      ports = [ "${builtins.toString port}:${builtins.toString port}" ];
+      ports = [ "9980:9980" ];
      environment = {
        domain = "cloud.dgnum.eu";
        extra_params = "--o:ssl.enable=false --o:ssl.termination=true --o:remote_font_config.url=https://cloud.dgnum.eu/apps/richdocuments/settings/fonts.json";
@ -121,8 +119,6 @@ in
    };
  };

-  dgn-web.internalPorts.collabora = port;
-
  services.nginx.virtualHosts = {
    ${host} = {
      enableACME = true;
@ -140,25 +136,25 @@ in
      extraConfig = ''
        # static files
        location ^~ /browser {
-          proxy_pass http://127.0.0.1:${builtins.toString port};
+          proxy_pass http://127.0.0.1:9980;
          proxy_set_header Host $host;
        }

        # WOPI discovery URL
        location ^~ /hosting/discovery {
-          proxy_pass http://127.0.0.1:${builtins.toString port};
+          proxy_pass http://127.0.0.1:9980;
          proxy_set_header Host $host;
        }

        # Capabilities
        location ^~ /hosting/capabilities {
-          proxy_pass http://127.0.0.1:${builtins.toString port};
+          proxy_pass http://127.0.0.1:9980;
          proxy_set_header Host $host;
        }

        # main websocket
        location ~ ^/cool/(.*)/ws$ {
-          proxy_pass http://127.0.0.1:${builtins.toString port};
+          proxy_pass http://127.0.0.1:9980;
          proxy_set_header Upgrade $http_upgrade;
          proxy_set_header Connection "Upgrade";
          proxy_set_header Host $host;
@ -167,13 +163,13 @@ in

        # download, presentation and image upload
        location ~ ^/(c|l)ool {
-          proxy_pass http://127.0.0.1:${builtins.toString port};
+          proxy_pass http://127.0.0.1:9980;
          proxy_set_header Host $host;
        }

        # Admin Console websocket
        location ^~ /cool/adminws {
-          proxy_pass http://127.0.0.1:${builtins.toString port};
+          proxy_pass http://127.0.0.1:9980;
          proxy_set_header Upgrade $http_upgrade;
          proxy_set_header Connection "Upgrade";
          proxy_set_header Host $host;
--- a/machines/compute01/ollama-proxy.nix
+++ b/machines/compute01/ollama-proxy.nix
@ -1,15 +1,27 @@
-{ pkgs, ... }:
+{
+  pkgs,
+  nodes,
+  meta,
+  ...
+}:
 {
  services.nginx = {
+    enable = true;
+    recommendedProxySettings = true;
    virtualHosts."ollama01.beta.dgnum.eu" = {
      enableACME = true;
      forceSSL = true;
      locations."/" = {
-        proxyPass = "http://100.80.103.206:11434";
+        proxyPass = "http://${meta.network.krz01.netbirdIp}:${toString nodes.krz01.config.services.ollama.port}";
        basicAuthFile = pkgs.writeText "ollama-htpasswd" ''
          raito:$y$j9T$UDEHpLtM52hRGK0I4qT6M0$N75AhENLqgtJnTGaPzq51imhjZvuPr.ow81Co1ZTcX2
        '';
      };
    };
  };
+
+  networking.firewall.allowedTCPPorts = [
+    80
+    443
+  ];
 }
--- a/machines/compute01/outline.nix
+++ b/machines/compute01/outline.nix
@ -2,7 +2,6 @@

 let
  host = "docs.dgnum.eu";
-  port = 3003;
 in
 {
  services.outline = {
@ -36,12 +35,21 @@ in
    defaultLanguage = "fr_FR";

    forceHttps = false;
-    inherit port;
+    port = 3003;
  };

-  dgn-web.simpleProxies.outline = {
-    inherit host port;
-    vhostConfig.locations."/robots.txt".return = ''200 "User-agent: *\nDisallow: /s/demarches-normaliennes/\n"'';
+  services.nginx.virtualHosts.${host} = {
+    enableACME = true;
+    forceSSL = true;
+
+    locations."/" = {
+      proxyPass = "http://localhost:3003";
+      proxyWebsockets = true;
+    };
+
+    locations."/robots.txt" = {
+      return = ''200 "User-agent: *\nDisallow: /s/demarches-normaliennes/\n"'';
+    };
  };

  age-secrets.autoMatch = [ "outline" ];
--- a/machines/compute01/plausible.nix
+++ b/machines/compute01/plausible.nix
@ -38,7 +38,16 @@ in
    };
  };

-  dgn-web.simpleProxies.plausible = {
-    inherit host port;
+  services.nginx = {
+    enable = true;
+
+    virtualHosts.${host} = {
+      enableACME = true;
+      forceSSL = true;
+
+      locations."/" = {
+        proxyPass = "http://127.0.0.1:${builtins.toString port}";
+      };
+    };
  };
 }
--- a/machines/compute01/satosa/default.nix
+++ b/machines/compute01/satosa/default.nix
@ -2,15 +2,16 @@

 let
  host = "saml-idp.dgnum.eu";
-  port = 8090;
 in
 {
+
  imports = [ ./module.nix ];

  services.satosa = {
    enable = true;

-    inherit host port;
+    inherit host;
+    port = 8090;

    envFile = config.age.secrets."satosa-env_file".path;

@ -147,8 +148,9 @@ in
    };
  };

-  dgn-web.simpleProxies.satosa = {
-    inherit host port;
+  services.nginx.virtualHosts.${host} = {
+    enableACME = true;
+    forceSSL = true;
  };

  age-secrets.autoMatch = [ "satosa" ];
--- a/machines/compute01/satosa/module.nix
+++ b/machines/compute01/satosa/module.nix
@ -190,6 +190,14 @@ in
      };
    };

+    services.nginx = mkIf cfg.configureNginx {
+      enable = true;
+
+      virtualHosts.${cfg.host} = {
+        locations."/".proxyPass = "http://127.0.0.1:${builtins.toString cfg.port}";
+      };
+    };
+
    users.users.satosa = {
      isSystemUser = true;
      group = "satosa";
--- a/machines/compute01/stirling-pdf/default.nix
+++ b/machines/compute01/stirling-pdf/default.nix
@ -10,13 +10,10 @@ let
  # - push to a new branch dgn-v0.A.B where A.B is the new version
  # - finally, update the commit hash of the customization patch

-  dgn-id = "d73e347b1cefe23092bfcb2d3f8a23903410203e";
-  port = 8084;
+  dgn-id = "8f19cb1c9623f8da71f6512c1528d83acc35db57";
 in

 {
-  dgn-web.internalPorts.stirling-pdf = port;
-
  services.stirling-pdf = {
    enable = true;

@ -27,7 +24,7 @@ in
    });

    domain = "pdf.dgnum.eu";
-    inherit port;
+    port = 8084;

    nginx = {
      enableACME = true;
--- a/machines/compute01/vaultwarden.nix
+++ b/machines/compute01/vaultwarden.nix
@ -2,8 +2,6 @@

 let
  host = "pass.dgnum.eu";
-  port = 10501;
-  wsPort = 10500;
 in
 {
  services.vaultwarden = {
@ -12,9 +10,9 @@ in
    config = {
      DOMAIN = "https://${host}";
      WEBSOCKET_ENABLED = true;
-      WEBSOCKET_PORT = wsPort;
+      WEBSOCKET_PORT = 10500;
      SIGNUPS_DOMAINS_WHITELIST = "dgnum.eu,ens.fr,ens.psl.eu";
-      ROCKET_PORT = port;
+      ROCKET_PORT = 10501;
      ROCKET_ADDRESS = "127.0.0.1";
      SIGNUPS_VERIFY = true;
      USE_SYSLOG = true;
@ -33,38 +31,45 @@ in
    environmentFile = config.age.secrets."vaultwarden-environment_file".path;
  };

-  dgn-web = {
-    internalPorts.vaultwarden-websockets = wsPort;
+  services = {
+    nginx = {
+      enable = true;

-    simpleProxies.vaultwarden = {
-      inherit host port;
-      proxyWebsockets = true;
+      virtualHosts.${host} = {
+        forceSSL = true;
+        enableACME = true;

-      vhostConfig.locations = {
-        "/notifications/hub" = {
-          proxyPass = "http://127.0.0.1:${builtins.toString port}";
-          proxyWebsockets = true;
-        };
+        locations = {
+          "/" = {
+            proxyPass = "http://127.0.0.1:10501";
+            proxyWebsockets = true;
+          };

-        "/notifications/hub/negotiate" = {
-          proxyPass = "http://127.0.0.1:${builtins.toString wsPort}";
-          proxyWebsockets = true;
+          "/notifications/hub" = {
+            proxyPass = "http://127.0.0.1:10500";
+            proxyWebsockets = true;
+          };
+
+          "/notifications/hub/negotiate" = {
+            proxyPass = "http://127.0.0.1:10501";
+            proxyWebsockets = true;
+          };
        };
      };
    };
-  };

-  services.postgresql = {
-    enable = true;
+    postgresql = {
+      enable = true;

-    ensureDatabases = [ "vaultwarden" ];
+      ensureDatabases = [ "vaultwarden" ];

-    ensureUsers = [
-      {
-        name = "vaultwarden";
-        ensureDBOwnership = true;
-      }
-    ];
+      ensureUsers = [
+        {
+          name = "vaultwarden";
+          ensureDBOwnership = true;
+        }
+      ];
+    };
  };

  dgn-backups.jobs.vaultwarden.settings.paths = [ "/var/lib/bitwarden_rs" ];
--- a/machines/krz01/K80-support.patch
+++ b/machines/krz01/K80-support.patch
@ -0,0 +1,179 @@
+From 2abd226ff3093c5a9e18a618fba466853e7ebaf7 Mon Sep 17 00:00:00 2001
+From: Raito Bezarius <masterancpp@gmail.com>
+Date: Tue, 8 Oct 2024 18:27:41 +0200
+Subject: [PATCH] K80 support
+
+Signed-off-by: Raito Bezarius <masterancpp@gmail.com>
+---
+ docs/development.md     |  6 +++-
+ docs/gpu.md             |  1 +
+ gpu/amd_linux.go        |  6 +++-
+ gpu/gpu.go              | 63 ++++++++++++++++++++++++++++++++++++-----
+ scripts/build_docker.sh |  2 +-
+ scripts/build_linux.sh  |  2 +-
+ 6 files changed, 69 insertions(+), 11 deletions(-)
+
+diff --git a/docs/development.md b/docs/development.md
+index 2f7b9ecf..9da35931 100644
+--- a/docs/development.md
+++ b/docs/development.md
+@@ -51,7 +51,11 @@ Typically the build scripts will auto-detect CUDA, however, if your Linux distro
+ or installation approach uses unusual paths, you can specify the location by
+ specifying an environment variable `CUDA_LIB_DIR` to the location of the shared
+ libraries, and `CUDACXX` to the location of the nvcc compiler. You can customize
+-a set of target CUDA architectures by setting `CMAKE_CUDA_ARCHITECTURES` (e.g. "50;60;70")
+a set of target CUDA architectures by setting `CMAKE_CUDA_ARCHITECTURES` (e.g. "35;37;50;60;70")
+
+To support GPUs older than Compute Capability 5.0, you will need to use an older version of
+the Driver from [Unix Driver Archive](https://www.nvidia.com/en-us/drivers/unix/) (tested with 470) and [CUDA Toolkit Archive](https://developer.nvidia.com/cuda-toolkit-archive) (tested with cuda V11).  When you build Ollama, you will need to set two environment variable to adjust the minimum compute capability Ollama supports via `export GOFLAGS="'-ldflags=-w -s \"-X=github.com/ollama/ollama/gpu.CudaComputeMajorMin=3\" \"-X=github.com/ollama/ollama/gpu.CudaComputeMinorMin=5\"'"` and the `CMAKE_CUDA_ARCHITECTURES`.  To find the Compute Capability of your older GPU, refer to [GPU Compute Capability](https://developer.nvidia.com/cuda-gpus).
+
+ 
+ Then generate dependencies:
+ 
+diff --git a/docs/gpu.md b/docs/gpu.md
+index a6b559f0..66627611 100644
+--- a/docs/gpu.md
+++ b/docs/gpu.md
+@@ -28,6 +28,7 @@ Check your compute compatibility to see if your card is supported:
+ | 5.0                | GeForce GTX         | `GTX 750 Ti` `GTX 750` `NVS 810`                                                                            |
+ |                    | Quadro              | `K2200` `K1200` `K620` `M1200` `M520` `M5000M` `M4000M` `M3000M` `M2000M` `M1000M` `K620M` `M600M` `M500M`  |
+ 
+For building locally to support older GPUs, see [developer.md](./development.md#linux-cuda-nvidia)
+ 
+ ### GPU Selection
+ 
+diff --git a/gpu/amd_linux.go b/gpu/amd_linux.go
+index 6b08ac2e..768fb97a 100644
+--- a/gpu/amd_linux.go
+++ b/gpu/amd_linux.go
+@@ -159,7 +159,11 @@ func AMDGetGPUInfo() []GpuInfo {
+ 			return []GpuInfo{}
+ 		}
+ 
+-		if int(major) < RocmComputeMin {
+		minVer, err := strconv.Atoi(RocmComputeMajorMin)
+		if err != nil {
+			slog.Error("invalid RocmComputeMajorMin setting", "value", RocmComputeMajorMin, "error", err)
+		}
+		if int(major) < minVer {
+ 			slog.Warn(fmt.Sprintf("amdgpu too old gfx%d%x%x", major, minor, patch), "gpu", gpuID)
+ 			continue
+ 		}
+diff --git a/gpu/gpu.go b/gpu/gpu.go
+index 781e23df..60d68c33 100644
+--- a/gpu/gpu.go
+++ b/gpu/gpu.go
+@@ -16,6 +16,7 @@ import (
+ 	"os"
+ 	"path/filepath"
+ 	"runtime"
+	"strconv"
+ 	"strings"
+ 	"sync"
+ 	"unsafe"
+@@ -38,9 +39,11 @@ const (
+ var gpuMutex sync.Mutex
+ 
+ // With our current CUDA compile flags, older than 5.0 will not work properly
+-var CudaComputeMin = [2]C.int{5, 0}
+// (string values used to allow ldflags overrides at build time)
+var CudaComputeMajorMin = "5"
+var CudaComputeMinorMin = "0"
+ 
+-var RocmComputeMin = 9
+var RocmComputeMajorMin = "9"
+ 
+ // TODO find a better way to detect iGPU instead of minimum memory
+ const IGPUMemLimit = 1 * format.GibiByte // 512G is what they typically report, so anything less than 1G must be iGPU
+@@ -175,11 +178,57 @@ func GetGPUInfo() GpuInfoList {
+ 	var memInfo C.mem_info_t
+ 	resp := []GpuInfo{}
+ 
+-	// NVIDIA first
+-	for i := 0; i < gpuHandles.deviceCount; i++ {
+-		// TODO once we support CPU compilation variants of GPU libraries refine this...
+-		if cpuVariant == "" && runtime.GOARCH == "amd64" {
+-			continue
+	// Load ALL libraries
+	cHandles = initCudaHandles()
+	minMajorVer, err := strconv.Atoi(CudaComputeMajorMin)
+	if err != nil {
+		slog.Error("invalid CudaComputeMajorMin setting", "value", CudaComputeMajorMin, "error", err)
+	}
+	minMinorVer, err := strconv.Atoi(CudaComputeMinorMin)
+	if err != nil {
+		slog.Error("invalid CudaComputeMinorMin setting", "value", CudaComputeMinorMin, "error", err)
+	}
+
+	// NVIDIA
+	for i := range cHandles.deviceCount {
+		if cHandles.cudart != nil || cHandles.nvcuda != nil {
+			gpuInfo := CudaGPUInfo{
+				GpuInfo: GpuInfo{
+					Library: "cuda",
+				},
+				index: i,
+			}
+			var driverMajor int
+			var driverMinor int
+			if cHandles.cudart != nil {
+				C.cudart_bootstrap(*cHandles.cudart, C.int(i), &memInfo)
+			} else {
+				C.nvcuda_bootstrap(*cHandles.nvcuda, C.int(i), &memInfo)
+				driverMajor = int(cHandles.nvcuda.driver_major)
+				driverMinor = int(cHandles.nvcuda.driver_minor)
+			}
+			if memInfo.err != nil {
+				slog.Info("error looking up nvidia GPU memory", "error", C.GoString(memInfo.err))
+				C.free(unsafe.Pointer(memInfo.err))
+				continue
+			}
+
+			if int(memInfo.major) < minMajorVer || (int(memInfo.major) == minMajorVer && int(memInfo.minor) < minMinorVer) {
+				slog.Info(fmt.Sprintf("[%d] CUDA GPU is too old. Compute Capability detected: %d.%d", i, memInfo.major, memInfo.minor))
+				continue
+			}
+			gpuInfo.TotalMemory = uint64(memInfo.total)
+			gpuInfo.FreeMemory = uint64(memInfo.free)
+			gpuInfo.ID = C.GoString(&memInfo.gpu_id[0])
+			gpuInfo.Compute = fmt.Sprintf("%d.%d", memInfo.major, memInfo.minor)
+			gpuInfo.MinimumMemory = cudaMinimumMemory
+			gpuInfo.DependencyPath = depPath
+			gpuInfo.Name = C.GoString(&memInfo.gpu_name[0])
+			gpuInfo.DriverMajor = driverMajor
+			gpuInfo.DriverMinor = driverMinor
+
+			// TODO potentially sort on our own algorithm instead of what the underlying GPU library does...
+			cudaGPUs = append(cudaGPUs, gpuInfo)
+ 		}
+ 		gpuInfo := GpuInfo{
+ 			Library: "cuda",
+diff --git a/scripts/build_docker.sh b/scripts/build_docker.sh
+index e91c56ed..c03bc25f 100755
+--- a/scripts/build_docker.sh
+++ b/scripts/build_docker.sh
+@@ -3,7 +3,7 @@
+ set -eu
+ 
+ export VERSION=${VERSION:-$(git describe --tags --first-parent --abbrev=7 --long --dirty --always | sed -e "s/^v//g")}
+-export GOFLAGS="'-ldflags=-w -s \"-X=github.com/ollama/ollama/version.Version=$VERSION\" \"-X=github.com/ollama/ollama/server.mode=release\"'"
+export GOFLAGS=${GOFLAGS:-"'-ldflags=-w -s \"-X=github.com/ollama/ollama/version.Version=$VERSION\" \"-X=github.com/ollama/ollama/server.mode=release\"'"}
+ 
+ # We use 2 different image repositories to handle combining architecture images into multiarch manifest
+ # (The ROCm image is x86 only and is not a multiarch manifest)
+diff --git a/scripts/build_linux.sh b/scripts/build_linux.sh
+index 27c4ff1f..e7e6d0dd 100755
+--- a/scripts/build_linux.sh
+++ b/scripts/build_linux.sh
+@@ -3,7 +3,7 @@
+ set -eu
+ 
+ export VERSION=${VERSION:-$(git describe --tags --first-parent --abbrev=7 --long --dirty --always | sed -e "s/^v//g")}
+-export GOFLAGS="'-ldflags=-w -s \"-X=github.com/ollama/ollama/version.Version=$VERSION\" \"-X=github.com/ollama/ollama/server.mode=release\"'"
+export GOFLAGS=${GOFLAGS:-"'-ldflags=-w -s \"-X=github.com/ollama/ollama/version.Version=$VERSION\" \"-X=github.com/ollama/ollama/server.mode=release\"'"}
+ 
+ BUILD_ARCH=${BUILD_ARCH:-"amd64 arm64"}
+ export AMDGPU_TARGETS=${AMDGPU_TARGETS:=""}
+-- 
+2.46.0
+
--- a/machines/krz01/_configuration.nix
+++ b/machines/krz01/_configuration.nix
@ -0,0 +1,79 @@
+{
+  config,
+  lib,
+  pkgs,
+  meta,
+  name,
+  ...
+}:
+
+lib.extra.mkConfig {
+  enabledModules = [
+    # INFO: This list needs to stay sorted alphabetically
+  ];
+
+  enabledServices = [
+    # INFO: This list needs to stay sorted alphabetically
+    # Machine learning API machine
+    "microvm-ml01"
+    "microvm-router01"
+    "nvidia-tesla-k80"
+    "proxmox"
+  ];
+
+  extraConfig = {
+    microvm = {
+      host.enable = true;
+    };
+    dgn-hardware = {
+      useZfs = true;
+      zfsPools = [
+        "dpool"
+        "ppool0"
+      ];
+    };
+
+    services.netbird.enable = true;
+
+    # We are going to use CUDA here.
+    nixpkgs.config.cudaSupport = true;
+    hardware.graphics.enable = true;
+    environment.systemPackages = [
+      ((pkgs.openai-whisper-cpp.override { cudaPackages = pkgs.cudaPackages_11; }).overrideAttrs (old: {
+        src = pkgs.fetchFromGitHub {
+          owner = "ggerganov";
+          repo = "whisper.cpp";
+          rev = "v1.7.1";
+          hash = "sha256-EDFUVjud79ZRCzGbOh9L9NcXfN3ikvsqkVSOME9F9oo=";
+        };
+        env = {
+          WHISPER_CUBLAS = "";
+          GGML_CUDA = "1";
+        };
+        # We only need Compute Capability 3.7.
+        CUDA_ARCH_FLAGS = [ "sm_37" ];
+        # We are GPU-only anyway.
+        patches = (old.patches or [ ]) ++ [
+          ./no-weird-microarch.patch
+          ./all-nvcc-arch.patch
+        ];
+      }))
+    ];
+
+    services = {
+      ollama = {
+        enable = true;
+        host = meta.network.${name}.netbirdIp;
+        package = pkgs.callPackage ./ollama.nix {
+          cudaPackages = pkgs.cudaPackages_11;
+          # We need to thread our nvidia x11 driver for CUDA.
+          extraLibraries = [ config.hardware.nvidia.package ];
+        };
+      };
+    };
+
+    networking.firewall.interfaces.wt0.allowedTCPPorts = [ config.services.ollama.port ];
+  };
+
+  root = ./.;
+}
--- a/machines/krz01/_hardware-configuration.nix
+++ b/machines/krz01/_hardware-configuration.nix
@ -0,0 +1,50 @@
+{
+  config,
+  lib,
+  modulesPath,
+  ...
+}:
+
+{
+  imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
+
+  boot = {
+    initrd = {
+      availableKernelModules = [
+        "ehci_pci"
+        "ahci"
+        "mpt3sas"
+        "usbhid"
+        "sd_mod"
+      ];
+      kernelModules = [ ];
+    };
+    kernelModules = [ "kvm-intel" ];
+    extraModulePackages = [ ];
+  };
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/92bf4d66-2693-4eca-9b26-f86ae09d468d";
+    fsType = "ext4";
+  };
+
+  boot.initrd.luks.devices."mainfs" = {
+    device = "/dev/disk/by-uuid/26f9737b-28aa-4c3f-bd3b-b028283cef88";
+    keyFileSize = 1;
+    keyFile = "/dev/zero";
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/280C-8844";
+    fsType = "vfat";
+    options = [
+      "fmask=0022"
+      "dmask=0022"
+    ];
+  };
+
+  swapDevices = [ ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}
--- a/machines/krz01/all-nvcc-arch.patch
+++ b/machines/krz01/all-nvcc-arch.patch
@ -0,0 +1,26 @@
+From 2278389ef9ac9231349440aa68f9544ddc69cdc7 Mon Sep 17 00:00:00 2001
+From: Raito Bezarius <masterancpp@gmail.com>
+Date: Wed, 9 Oct 2024 13:37:08 +0200
+Subject: [PATCH] fix: sm_37 for nvcc
+
+Signed-off-by: Raito Bezarius <masterancpp@gmail.com>
+---
+ Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Makefile b/Makefile
+index 2ccb750..70dfd9b 100644
+--- a/Makefile
+++ b/Makefile
+@@ -537,7 +537,7 @@ endif #GGML_CUDA_NVCC
+ ifdef CUDA_DOCKER_ARCH
+ 	MK_NVCCFLAGS += -Wno-deprecated-gpu-targets -arch=$(CUDA_DOCKER_ARCH)
+ else ifndef CUDA_POWER_ARCH
+-	MK_NVCCFLAGS += -arch=native
+	MK_NVCCFLAGS += -arch=sm_37
+ endif # CUDA_DOCKER_ARCH
+ 
+ ifdef GGML_CUDA_FORCE_DMMV
+-- 
+2.46.0
+
--- a/machines/krz01/disable-git.patch
+++ b/machines/krz01/disable-git.patch
@ -0,0 +1,20 @@
+diff --git c/llm/generate/gen_common.sh i/llm/generate/gen_common.sh
+index 3825c155..238a74a7 100644
+--- c/llm/generate/gen_common.sh
+++ i/llm/generate/gen_common.sh
+@@ -69,6 +69,7 @@ git_module_setup() {
+ }
+ 
+ apply_patches() {
+    return
+     # apply temporary patches until fix is upstream
+     for patch in ../patches/*.patch; do
+         git -c 'user.name=nobody' -c 'user.email=<>' -C ${LLAMACPP_DIR} am ${patch}
+@@ -133,6 +134,7 @@ install() {
+ 
+ # Keep the local tree clean after we're done with the build
+ cleanup() {
+    return
+     (cd ${LLAMACPP_DIR}/ && git checkout CMakeLists.txt)
+ 
+     if [ -n "$(ls -A ../patches/*.diff)" ]; then
--- a/machines/krz01/microvm-ml01.nix
+++ b/machines/krz01/microvm-ml01.nix
@ -0,0 +1,22 @@
+_: {
+  microvm.autostart = [ "ml01" ];
+  microvm.vms.ml01 = {
+    config = {
+      networking.hostName = "ml01";
+      microvm = {
+        hypervisor = "cloud-hypervisor";
+        vcpu = 4;
+        mem = 4096;
+        balloonMem = 2048;
+        shares = [
+          {
+            source = "/nix/store";
+            mountPoint = "/nix/.ro-store";
+            tag = "ro-store";
+            proto = "virtiofs";
+          }
+        ];
+      };
+    };
+  };
+}
--- a/machines/krz01/microvm-router01.nix
+++ b/machines/krz01/microvm-router01.nix
@ -0,0 +1,16 @@
+_: {
+  microvm.autostart = [ "router01" ];
+  microvm.vms.router01 = {
+    config = {
+      networking.hostName = "router01";
+      microvm.shares = [
+        {
+          source = "/nix/store";
+          mountPoint = "/nix/.ro-store";
+          tag = "ro-store";
+          proto = "virtiofs";
+        }
+      ];
+    };
+  };
+}
--- a/machines/krz01/no-weird-microarch.patch
+++ b/machines/krz01/no-weird-microarch.patch
@ -0,0 +1,34 @@
+From 51568b61ef63ecd97867562571411082c32751d3 Mon Sep 17 00:00:00 2001
+From: Raito Bezarius <masterancpp@gmail.com>
+Date: Wed, 9 Oct 2024 13:36:51 +0200
+Subject: [PATCH] fix: avx & f16c in Makefile
+
+Signed-off-by: Raito Bezarius <masterancpp@gmail.com>
+---
+ Makefile | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/Makefile b/Makefile
+index 32b7cbb..2ccb750 100644
+--- a/Makefile
+++ b/Makefile
+@@ -361,12 +361,12 @@ ifndef RISCV
+ 
+ ifeq ($(UNAME_M),$(filter $(UNAME_M),x86_64 i686 amd64))
+ 	# Use all CPU extensions that are available:
+-	MK_CFLAGS     += -march=native -mtune=native
+-	HOST_CXXFLAGS += -march=native -mtune=native
+	# MK_CFLAGS     += -march=native -mtune=native
+	# HOST_CXXFLAGS += -march=native -mtune=native
+ 
+ 	# Usage AVX-only
+-	#MK_CFLAGS   += -mfma -mf16c -mavx
+-	#MK_CXXFLAGS += -mfma -mf16c -mavx
+	MK_CFLAGS   += -mf16c -mavx
+	MK_CXXFLAGS += -mf16c -mavx
+ 
+ 	# Usage SSSE3-only (Not is SSE3!)
+ 	#MK_CFLAGS   += -mssse3
+-- 
+2.46.0
+
--- a/machines/krz01/nvidia-tesla-k80.nix
+++ b/machines/krz01/nvidia-tesla-k80.nix
@ -0,0 +1,8 @@
+{ config, ... }:
+{
+  nixpkgs.config.nvidia.acceptLicense = true;
+  # Tesla K80 is not supported by the latest driver.
+  hardware.nvidia.package = config.boot.kernelPackages.nvidia_x11_legacy470;
+  # Don't ask.
+  services.xserver.videoDrivers = [ "nvidia" ];
+}
--- a/machines/krz01/ollama.nix
+++ b/machines/krz01/ollama.nix
@ -0,0 +1,243 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  buildEnv,
+  linkFarm,
+  overrideCC,
+  makeWrapper,
+  stdenv,
+  addDriverRunpath,
+  nix-update-script,
+
+  cmake,
+  gcc11,
+  clblast,
+  libdrm,
+  rocmPackages,
+  cudaPackages,
+  darwin,
+  autoAddDriverRunpath,
+  extraLibraries ? [ ],
+
+  nixosTests,
+  testers,
+  ollama,
+  ollama-rocm,
+  ollama-cuda,
+
+  config,
+  # one of `[ null false "rocm" "cuda" ]`
+  acceleration ? null,
+}:
+
+assert builtins.elem acceleration [
+  null
+  false
+  "rocm"
+  "cuda"
+];
+
+let
+  pname = "ollama";
+  version = "2024-09-10-cc35";
+
+  src = fetchFromGitHub {
+    owner = "aliotard";
+    repo = "ollama";
+    rev = "34827c01f7723c7f5f9f5e392fe85f5a4a5d5fc0";
+    hash = "sha256-xFNuqcW7YWeyCyw5QLBnCHHTSMITR6LJkJT0CXZC+Y8=";
+    fetchSubmodules = true;
+  };
+
+  vendorHash = "sha256-hSxcREAujhvzHVNwnRTfhi0MKI3s8HNavER2VLz6SYk=";
+
+  validateFallback = lib.warnIf (config.rocmSupport && config.cudaSupport) (lib.concatStrings [
+    "both `nixpkgs.config.rocmSupport` and `nixpkgs.config.cudaSupport` are enabled, "
+    "but they are mutually exclusive; falling back to cpu"
+  ]) (!(config.rocmSupport && config.cudaSupport));
+  shouldEnable =
+    mode: fallback: (acceleration == mode) || (fallback && acceleration == null && validateFallback);
+
+  rocmRequested = shouldEnable "rocm" config.rocmSupport;
+  cudaRequested = shouldEnable "cuda" config.cudaSupport;
+
+  enableRocm = rocmRequested && stdenv.isLinux;
+  enableCuda = cudaRequested && stdenv.isLinux;
+
+  rocmLibs = [
+    rocmPackages.clr
+    rocmPackages.hipblas
+    rocmPackages.rocblas
+    rocmPackages.rocsolver
+    rocmPackages.rocsparse
+    rocmPackages.rocm-device-libs
+    rocmPackages.rocm-smi
+  ];
+  rocmClang = linkFarm "rocm-clang" { llvm = rocmPackages.llvm.clang; };
+  rocmPath = buildEnv {
+    name = "rocm-path";
+    paths = rocmLibs ++ [ rocmClang ];
+  };
+
+  cudaLibs = [
+    cudaPackages.cuda_cudart
+    cudaPackages.libcublas
+    cudaPackages.cuda_cccl
+  ];
+  cudaToolkit = buildEnv {
+    name = "cuda-merged";
+    paths = map lib.getLib cudaLibs ++ [
+      (lib.getOutput "static" cudaPackages.cuda_cudart)
+      (lib.getBin (cudaPackages.cuda_nvcc.__spliced.buildHost or cudaPackages.cuda_nvcc))
+    ];
+  };
+
+  metalFrameworks = with darwin.apple_sdk_11_0.frameworks; [
+    Accelerate
+    Metal
+    MetalKit
+    MetalPerformanceShaders
+  ];
+
+  wrapperOptions =
+    [
+      # ollama embeds llama-cpp binaries which actually run the ai models
+      # these llama-cpp binaries are unaffected by the ollama binary's DT_RUNPATH
+      # LD_LIBRARY_PATH is temporarily required to use the gpu
+      # until these llama-cpp binaries can have their runpath patched
+      "--suffix LD_LIBRARY_PATH : '${addDriverRunpath.driverLink}/lib'"
+      "--suffix LD_LIBRARY_PATH : '${lib.makeLibraryPath (map lib.getLib extraLibraries)}'"
+    ]
+    ++ lib.optionals enableRocm [
+      "--suffix LD_LIBRARY_PATH : '${rocmPath}/lib'"
+      "--set-default HIP_PATH '${rocmPath}'"
+    ]
+    ++ lib.optionals enableCuda [
+      "--suffix LD_LIBRARY_PATH : '${lib.makeLibraryPath (map lib.getLib cudaLibs)}'"
+    ];
+  wrapperArgs = builtins.concatStringsSep " " wrapperOptions;
+
+  goBuild =
+    if enableCuda then buildGoModule.override { stdenv = overrideCC stdenv gcc11; } else buildGoModule;
+  inherit (lib) licenses platforms maintainers;
+in
+goBuild {
+  inherit
+    pname
+    version
+    src
+    vendorHash
+    ;
+
+  env =
+    lib.optionalAttrs enableRocm {
+      ROCM_PATH = rocmPath;
+      CLBlast_DIR = "${clblast}/lib/cmake/CLBlast";
+    }
+    // lib.optionalAttrs enableCuda { CUDA_LIB_DIR = "${cudaToolkit}/lib"; }
+    // {
+      CMAKE_CUDA_ARCHITECTURES = "35;37";
+    };
+
+  nativeBuildInputs =
+    [ cmake ]
+    ++ lib.optionals enableRocm [ rocmPackages.llvm.bintools ]
+    ++ lib.optionals enableCuda [ cudaPackages.cuda_nvcc ]
+    ++ lib.optionals (enableRocm || enableCuda) [
+      makeWrapper
+      autoAddDriverRunpath
+    ]
+    ++ lib.optionals stdenv.isDarwin metalFrameworks;
+
+  buildInputs =
+    lib.optionals enableRocm (rocmLibs ++ [ libdrm ])
+    ++ lib.optionals enableCuda cudaLibs
+    ++ lib.optionals stdenv.isDarwin metalFrameworks;
+
+  patches = [
+    # disable uses of `git` in the `go generate` script
+    # ollama's build script assumes the source is a git repo, but nix removes the git directory
+    # this also disables necessary patches contained in `ollama/llm/patches/`
+    # those patches are applied in `postPatch`
+    ./disable-git.patch
+  ];
+
+  postPatch = ''
+    # replace inaccurate version number with actual release version
+    substituteInPlace version/version.go --replace-fail 0.0.0 '${version}'
+
+    # apply ollama's patches to `llama.cpp` submodule
+    for diff in llm/patches/*; do
+      patch -p1 -d llm/llama.cpp < $diff
+    done
+  '';
+
+  overrideModAttrs = _: _: {
+    # don't run llama.cpp build in the module fetch phase
+    preBuild = "";
+  };
+
+  preBuild = ''
+    # disable uses of `git`, since nix removes the git directory
+    export OLLAMA_SKIP_PATCHING=true
+    # build llama.cpp libraries for ollama
+    go generate ./...
+  '';
+
+  postFixup =
+    ''
+      # the app doesn't appear functional at the moment, so hide it
+      mv "$out/bin/app" "$out/bin/.ollama-app"
+    ''
+    + lib.optionalString (enableRocm || enableCuda) ''
+      # expose runtime libraries necessary to use the gpu
+      wrapProgram "$out/bin/ollama" ${wrapperArgs}
+    '';
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X=github.com/ollama/ollama/version.Version=${version}"
+    "-X=github.com/ollama/ollama/server.mode=release"
+    "-X=github.com/ollama/ollama/gpu.CudaComputeMajorMin=3"
+    "-X=github.com/ollama/ollama/gpu.CudaComputeMinorMin=5"
+  ];
+
+  passthru = {
+    tests =
+      {
+        inherit ollama;
+        version = testers.testVersion {
+          inherit version;
+          package = ollama;
+        };
+      }
+      // lib.optionalAttrs stdenv.isLinux {
+        inherit ollama-rocm ollama-cuda;
+        service = nixosTests.ollama;
+        service-cuda = nixosTests.ollama-cuda;
+        service-rocm = nixosTests.ollama-rocm;
+      };
+
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description =
+      "Get up and running with large language models locally"
+      + lib.optionalString rocmRequested ", using ROCm for AMD GPU acceleration"
+      + lib.optionalString cudaRequested ", using CUDA for NVIDIA GPU acceleration";
+    homepage = "https://github.com/ollama/ollama";
+    changelog = "https://github.com/ollama/ollama/releases/tag/v${version}";
+    license = licenses.mit;
+    platforms = if (rocmRequested || cudaRequested) then platforms.linux else platforms.unix;
+    mainProgram = "ollama";
+    maintainers = with maintainers; [
+      abysssol
+      dit7ya
+      elohmeier
+      roydubnium
+    ];
+  };
+}
--- a/machines/krz01/proxmox/default.nix
+++ b/machines/krz01/proxmox/default.nix
@ -0,0 +1,14 @@
+{ sources, lib, ... }:
+let
+  proxmox-nixos = import sources.proxmox-nixos;
+in
+{
+  imports = [ proxmox-nixos.nixosModules.proxmox-ve ];
+  services.proxmox-ve.enable = true;
+  nixpkgs.overlays = [ proxmox-nixos.overlays.x86_64-linux ];
+  networking.firewall = {
+    trustedInterfaces = [ "wt0" ];
+    allowedTCPPorts = lib.mkForce [ 22 ];
+  };
+
+}
--- a/machines/krz01/secrets/secrets.nix
+++ b/machines/krz01/secrets/secrets.nix
@ -0,0 +1,3 @@
+(import ../../../keys).mkSecrets [ "krz01" ] [
+  # List of secrets for krz01
+]
--- a/machines/rescue01/_configuration.nix
+++ b/machines/rescue01/_configuration.nix
@ -3,7 +3,6 @@
 lib.extra.mkConfig {
  enabledModules = [
    # List of modules to enable
-    "dgn-web"
  ];

  enabledServices = [
--- a/machines/rescue01/uptime-kuma.nix
+++ b/machines/rescue01/uptime-kuma.nix
@ -46,16 +46,6 @@ let
        accepted_statuscodes = [ "401" ];
      };

-      "ollama01.beta.dgnum.eu" = {
-        type = mkForce "http";
-        accepted_statuscodes = [ "401" ];
-      };
-
-      "s3-admin.dgnum.eu" = {
-        type = mkForce "http";
-        accepted_statuscodes = [ "400" ];
-      };
-
      "api.meet.dgnum.eu" = {
        keyword = "Crab Fit API";
      };
@ -132,11 +122,24 @@ in

  services.uptime-kuma.enable = true;

-  dgn-web.simpleProxies.uptime-kuma = {
-    inherit host port;
-    proxyWebsockets = true;
+  services.nginx = {
+    enable = true;
+
+    virtualHosts.${host} = {
+      enableACME = true;
+      forceSSL = true;
+      locations."/" = {
+        proxyPass = "http://127.0.0.1:${builtins.toString port}";
+        proxyWebsockets = true;
+      };
+    };
  };

+  networking.firewall.allowedTCPPorts = [
+    80
+    443
+  ];
+
  statelessUptimeKuma = {
    probesConfig = mkMerge [
      pingProbes
--- a/machines/storage01/_configuration.nix
+++ b/machines/storage01/_configuration.nix
@ -18,7 +18,6 @@ lib.extra.mkConfig {
    "peertube"
    "prometheus"
    "redirections"
-    "victoria-metrics"
  ];

  extraConfig = {
--- a/machines/storage01/forgejo-runners.nix
+++ b/machines/storage01/forgejo-runners.nix
@ -1,4 +1,10 @@
-{ config, pkgs, ... }:
+{
+  config,
+  pkgs,
+  nixpkgs,
+  sources,
+  ...
+}:

 let
  url = "https://git.dgnum.eu";
@ -24,6 +30,8 @@ let
        options = "--cpus=4";
      };
    };
+
+  nix-pkgs = import sources.nix-pkgs { inherit pkgs; };
 in
 {
  services.forgejo-nix-runners = {
@ -31,12 +39,14 @@ in

    inherit url;

-    storePath = "/data/slow";
+    storePath = "/data/slow/nix";
    tokenFile = config.age.secrets."forgejo_runners-token_file".path;

    dependencies = [
+      nix-pkgs.colmena
      pkgs.npins
      pkgs.tea
+      nixpkgs.unstable.nixfmt-rfc-style
    ];

    containerOptions = [ "--cpus=4" ];
--- a/machines/storage01/forgejo.nix
+++ b/machines/storage01/forgejo.nix
@ -31,7 +31,6 @@ in

        admin = {
          DEFAULT_EMAIL_NOTIFICATIONS = "enabled";
-          SEND_NOTIFICATION_EMAIL_ON_NEW_USER = true;
        };

        log.LEVEL = "Warn";
@ -45,11 +44,6 @@ in
          USER = "web-services@infra.dgnum.eu";
        };

-        session = {
-          SESSION_LIFE_TIME = 24 * 3600 * 7;
-          GC_INTERVAL_TIME = 24 * 3600 * 7;
-        };
-
        server = {
          ROOT_URL = "https://${host}/";
          DOMAIN = host;
@ -61,7 +55,6 @@ in

        service = {
          EMAIL_DOMAIN_ALLOWLIST = "dgnum.eu,*";
-          EMAIL_DOMAIN_BLOCKLIST = "*.shop,*.online,*.store";
          ENABLE_NOTIFY_MAIL = true;

          DISABLE_REGISTRATION = false;
@ -78,10 +71,18 @@ in

      mailerPasswordFile = config.age.secrets."forgejo-mailer_password_file".path;
    };
-  };

-  dgn-web.simpleProxies.forgejo = {
-    inherit host port;
+    nginx = {
+      enable = true;
+
+      virtualHosts.${host} = {
+        enableACME = true;
+        forceSSL = true;
+        locations."/" = {
+          proxyPass = "http://127.0.0.1:${toString port}";
+        };
+      };
+    };
  };

  users.users.git = {
--- a/machines/storage01/garage.nix
+++ b/machines/storage01/garage.nix
@ -1,13 +1,6 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
+{ config, pkgs, ... }:

 let
-  inherit (lib) mapAttrs' nameValuePair;
-
  host = "s3.dgnum.eu";
  webHost = "cdn.dgnum.eu";

@ -32,18 +25,8 @@ let
  ] ++ domains;

  mkHosted = host: builtins.map (b: "${b}.${host}");
-
-  ports = {
-    admin_api = 3903;
-    k2v_api = 3904;
-    rpc = 3901;
-    s3_api = 3900;
-    s3_web = 3902;
-  };
 in
 {
-  dgn-web.internalPorts = mapAttrs' (name: nameValuePair "garage-${name}") ports;
-
  services.garage = {
    enable = true;

@ -57,24 +40,24 @@ in
      replication_mode = "none"; # TODO: deprecated
      compression_level = 7;

-      rpc_bind_addr = "[::]:${toString ports.rpc}";
-      rpc_public_addr = "127.0.0.1:${toString ports.rpc}";
+      rpc_bind_addr = "[::]:3901";
+      rpc_public_addr = "127.0.0.1:3901";

      s3_api = {
        s3_region = "garage";
-        api_bind_addr = "127.0.0.1:${toString ports.s3_api}";
+        api_bind_addr = "127.0.0.1:3900";
        root_domain = ".${host}";
      };

      s3_web = {
-        bind_addr = "127.0.0.1:${toString ports.s3_web}";
+        bind_addr = "127.0.0.1:3902";
        root_domain = ".${webHost}";
        index = "index.html";
      };

-      k2v_api.api_bind_addr = "[::]:${toString ports.k2v_api}";
+      k2v_api.api_bind_addr = "[::]:3904";

-      admin.api_bind_addr = "127.0.0.1:${toString ports.admin_api}";
+      admin.api_bind_addr = "127.0.0.1:3903";
    };

    environmentFile = config.age.secrets."garage-environment_file".path;
@ -101,7 +84,7 @@ in
      forceSSL = true;

      locations."/".extraConfig = ''
-        proxy_pass http://127.0.0.1:${toString ports.admin_api};
+        proxy_pass http://127.0.0.1:3903;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Host $host;
      '';
@ -114,7 +97,7 @@ in
      serverAliases = mkHosted host buckets;

      locations."/".extraConfig = ''
-        proxy_pass http://127.0.0.1:${toString ports.s3_api};
+        proxy_pass http://127.0.0.1:3900;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Host $host;
        # Disable buffering to a temporary file.
@ -130,7 +113,7 @@ in
      serverAliases = domains ++ (mkHosted webHost buckets);

      locations."/".extraConfig = ''
-        proxy_pass http://127.0.0.1:${toString ports.s3_web};
+        proxy_pass http://127.0.0.1:3902;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Host $host;
      '';
--- a/machines/storage01/influxdb.nix
+++ b/machines/storage01/influxdb.nix
@ -5,7 +5,6 @@ let
  token = user: secret "${user}_token_file";

  host = "influx.dgnum.eu";
-  port = 8086;
 in

 {
@ -42,8 +41,13 @@ in
    };
  };

-  dgn-web.simpleProxies.influxdb = {
-    inherit host port;
+  services.nginx.virtualHosts.${host} = {
+    enableACME = true;
+    forceSSL = true;
+
+    locations."/" = {
+      proxyPass = "http://127.0.0.1:8086";
+    };
  };

  age-secrets.autoMatch = [ "influxdb2" ];
--- a/machines/storage01/netbird.nix
+++ b/machines/storage01/netbird.nix
@ -1,82 +0,0 @@
-{
-  config,
-  lib,
-  nixpkgs,
-  ...
-}:
-
-let
-  domain = "netbird.dgnum.eu";
-
-  s = name: config.age.secrets.${name}.path;
-in
-{
-  services = {
-    netbird.server = {
-      enable = true;
-
-      package = nixpkgs.unstable.netbird;
-
-      inherit domain;
-
-      enableNginx = true;
-
-      coturn.enable = lib.mkForce false;
-
-      relay = {
-        environmentFile = s "netbird-relay_environment_file";
-        metricsPort = 9094;
-      };
-
-      dashboard = {
-        settings = {
-          AUTH_AUTHORITY = "https://sso.dgnum.eu/oauth2/openid/dgn_netbird";
-          AUTH_AUDIENCE = "dgn_netbird";
-          AUTH_CLIENT_ID = "dgn_netbird";
-        };
-      };
-
-      management = {
-        oidcConfigEndpoint = "https://sso.dgnum.eu/oauth2/openid/dgn_netbird/.well-known/openid-configuration";
-
-        dnsDomain = "dgnum";
-
-        metricsPort = 9092;
-
-        settings = {
-          DataStoreEncryptionKey._secret = s "netbird-data_store_encryption_key_file";
-
-          PKCEAuthorizationFlow.ProviderConfig = {
-            Audience = "dgn_netbird";
-            ClientID = "dgn_netbird";
-            AuthorizationEndpoint = "https://sso.dgnum.eu/ui/oauth2";
-            TokenEndpoint = "https://sso.dgnum.eu/oauth2/token";
-          };
-
-          IdpManagerConfig.ClientConfig.ClientID = "dgn_netbird";
-
-          DeviceAuthorizationFlow = {
-            Provider = "none";
-            ProviderConfig = {
-              Audience = "dgn_netbird";
-              ClientID = "dgn_netbird";
-            };
-          };
-
-          Relay = {
-            Addresses = [ "rels://${domain}:443" ];
-            CredentialsTTL = "24h";
-            Secret._secret = s "netbird-relay_secret_file";
-          };
-        };
-      };
-    };
-
-    nginx.virtualHosts.${domain} = {
-      enableACME = true;
-      forceSSL = true;
-    };
-  };
-
-  dgn-backups.jobs.netbird.settings.paths = [ "/var/lib/netbird-mgmt" ];
-}
--- a/machines/storage01/netbird/default.nix
+++ b/machines/storage01/netbird/default.nix
@ -0,0 +1,47 @@
+{ config, ... }:
+
+let
+  domain = "netbird.dgnum.eu";
+in
+{
+  imports = [ ./module.nix ];
+
+  services.netbird-server = {
+    enable = true;
+
+    logLevel = "DEBUG";
+    enableDeviceAuthorizationFlow = false;
+    enableNginx = true;
+    enableCoturn = true;
+    setupAutoOidc = true;
+
+    management.dnsDomain = "dgnum";
+
+    secretFiles.AUTH_CLIENT_SECRET = config.age.secrets."netbird-auth_client_secret_file".path;
+
+    settings = {
+      NETBIRD_DOMAIN = domain;
+
+      TURN_PASSWORD = "tototest1234";
+
+      NETBIRD_AUTH_OIDC_CONFIGURATION_ENDPOINT = "https://sso.dgnum.eu/oauth2/openid/netbird_dgn/.well-known/openid-configuration";
+      NETBIRD_AUTH_PKCE_USE_ID_TOKEN = true;
+
+      NETBIRD_AUTH_AUDIENCE = "netbird_dgn";
+      NETBIRD_AUTH_CLIENT_ID = "netbird_dgn";
+      NETBIRD_AUTH_USER_ID_CLAIM = "sub";
+      # Updates the preference to use id tokens instead of access token on dashboard
+      # Okta and Gitlab IDPs can benefit from this
+      NETBIRD_TOKEN_SOURCE = "idToken";
+
+      # NETBIRD_AUTH_PKCE_REDIRECT_URLS = builtins.map (p: "http://localhost:${p}") [
+      #   "53000"
+      #   "54000"
+      # ];
+
+      NETBIRD_STORE_CONFIG_ENGINE = "sqlite";
+    };
+  };
+
+  dgn-backups.jobs.netbird.settings.paths = [ "/var/lib/netbird-mgmt" ];
+}
--- a/machines/storage01/netbird/module.nix
+++ b/machines/storage01/netbird/module.nix
@ -0,0 +1,643 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  inherit (lib)
+    filterAttrs
+    literalExpression
+    maintainers
+    mkDefault
+    mkEnableOption
+    mkIf
+    mkMerge
+    mkOption
+    optionalAttrs
+    optionalString
+    optionals
+    types
+    ;
+
+  inherit ((import ./package { inherit pkgs; })) dashboard;
+
+  cfg = config.services.netbird-server;
+
+  stateDir = "/var/lib/netbird-mgmt";
+
+  settingsFormat = pkgs.formats.keyValue { };
+  managementFormat = pkgs.formats.json { };
+
+  settingsFile = settingsFormat.generate "setup.env" (
+    builtins.mapAttrs (
+      _: val: if builtins.isList val then ''"${builtins.concatStringsSep " " val}"'' else val
+    ) settings
+  );
+
+  managementFile = managementFormat.generate "config.json" cfg.managementConfig;
+
+  settings =
+    rec {
+      TURN_DOMAIN = cfg.settings.NETBIRD_DOMAIN;
+      TURN_PORT = 3478;
+      TURN_USER = "netbird";
+      TURN_MIN_PORT = 49152;
+      TURN_MAX_PORT = 65535;
+      TURN_PASSWORD = if cfg.secretFiles.TURN_PASSWORD != null then "$TURN_PASSWORD" else null;
+      TURN_SECRET = if cfg.secretFiles.TURN_SECRET != null then "$TURN_SECRET" else "secret";
+
+      STUN_USERNAME = "";
+      STUN_PASSWORD = if cfg.secretFiles.STUN_PASSWORD != null then "$STUN_PASSWORD" else null;
+
+      NETBIRD_DASHBOARD_ENDPOINT = "https://${cfg.settings.NETBIRD_DOMAIN}:443";
+      NETBIRD_MGMT_API_ENDPOINT = "https://${cfg.settings.NETBIRD_DOMAIN}:${
+        builtins.toString cfg.settings.NETBIRD_MGMT_API_PORT or NETBIRD_MGMT_API_PORT
+      }";
+      NETBIRD_SIGNAL_ENDPOINT = "https://${cfg.settings.NETBIRD_DOMAIN}:${
+        builtins.toString cfg.settings.NETBIRD_SIGNAL_PORT or NETBIRD_SIGNAL_PORT
+      }";
+
+      NETBIRD_SIGNAL_PROTOCOL = "https";
+      NETBIRD_SIGNAL_PORT = 443;
+
+      NETBIRD_AUTH_USER_ID_CLAIM = "sub";
+      NETBIRD_AUTH_CLIENT_SECRET =
+        if cfg.secretFiles.AUTH_CLIENT_SECRET != null then "$AUTH_CLIENT_SECRET" else "";
+      NETBIRD_AUTH_SUPPORTED_SCOPES = [
+        "openid"
+        "profile"
+        "email"
+        "offline_access"
+        "api"
+      ];
+
+      NETBIRD_AUTH_REDIRECT_URI = "";
+      NETBIRD_AUTH_SILENT_REDIRECT_URI = "";
+
+      NETBIRD_AUTH_DEVICE_AUTH_PROVIDER = "none";
+      NETBIRD_AUTH_DEVICE_AUTH_CLIENT_ID = cfg.settings.NETBIRD_AUTH_CLIENT_ID;
+      NETBIRD_AUTH_DEVICE_AUTH_AUDIENCE = cfg.settings.NETBIRD_AUTH_AUDIENCE;
+      NETBIRD_AUTH_DEVICE_AUTH_SCOPE = [
+        "openid"
+        "profile"
+        "email"
+        "offline_access"
+        "api"
+      ];
+      NETBIRD_AUTH_DEVICE_AUTH_USE_ID_TOKEN = false;
+
+      NETBIRD_MGMT_API_PORT = 443;
+
+      NETBIRD_MGMT_IDP = "none";
+      NETBIRD_IDP_MGMT_CLIENT_ID = cfg.settings.NETBIRD_AUTH_CLIENT_ID;
+      NETBIRD_IDP_MGMT_CLIENT_SECRET =
+        if cfg.secretFiles.IDP_MGMT_CLIENT_SECRET != null then
+          "$IDP_MGMT_CLIENT_SECRET"
+        else
+          cfg.settings.NETBIRD_AUTH_CLIENT_SECRET;
+      NETBIRD_IDP_MGMT_GRANT_TYPE = "client_credentials";
+
+      NETBIRD_TOKEN_SOURCE = "accessToken";
+      NETBIRD_DRAG_QUERY_PARAMS = false;
+
+      NETBIRD_USE_AUTH0 = false;
+
+      NETBIRD_AUTH_DEVICE_AUTH_ENDPOINT = "";
+
+      NETBIRD_AUTH_PKCE_REDIRECT_URL_PORTS = [ "53000" ];
+      NETBIRD_AUTH_PKCE_REDIRECT_URLS = builtins.map (
+        p: "http://localhost:${p}"
+      ) cfg.settings.NETBIRD_AUTH_PKCE_REDIRECT_URL_PORTS or NETBIRD_AUTH_PKCE_REDIRECT_URL_PORTS;
+    }
+    // (optionalAttrs cfg.setupAutoOidc {
+      NETBIRD_AUTH_PKCE_AUTHORIZATION_ENDPOINT = "$NETBIRD_AUTH_PKCE_AUTHORIZATION_ENDPOINT";
+      NETBIRD_AUTH_DEVICE_AUTH_ENDPOINT = "$NETBIRD_AUTH_DEVICE_AUTH_ENDPOINT";
+      NETBIRD_AUTH_TOKEN_ENDPOINT = "$NETBIRD_AUTH_TOKEN_ENDPOINT";
+      NETBIRD_AUTH_JWT_CERTS = "$NETBIRD_AUTH_JWT_CERTS";
+      NETBIRD_AUTH_AUTHORITY = "$NETBIRD_AUTH_AUTHORITY";
+    })
+    // cfg.settings;
+in
+{
+  meta = {
+    maintainers = with maintainers; [ thubrecht ];
+  };
+
+  options.services.netbird-server = {
+    enable = mkEnableOption (lib.mdDoc "netbird management service.");
+
+    package = mkOption {
+      type = types.package;
+      default = pkgs.netbird;
+      defaultText = literalExpression "pkgs.netbird";
+      description = lib.mdDoc "The package to use for netbird";
+    };
+
+    settings = mkOption {
+      type =
+        with types;
+        attrsOf (
+          nullOr (oneOf [
+            (listOf str)
+            bool
+            int
+            float
+            str
+          ])
+        );
+      defaultText = lib.literalExpression ''
+        {
+          TURN_DOMAIN = cfg.settings.NETBIRD_DOMAIN;
+          TURN_PORT = 3478;
+          TURN_USER = "netbird";
+          TURN_MIN_PORT = 49152;
+          TURN_MAX_PORT = 65535;
+          TURN_PASSWORD = if cfg.secretFiles.TURN_PASSWORD != null then "$TURN_PASSWORD" else null;
+          TURN_SECRET = if cfg.secretFiles.TURN_SECRET != null then "$TURN_SECRET" else "secret";
+
+          STUN_USERNAME = "";
+          STUN_PASSWORD = if cfg.secretFiles.STUN_PASSWORD != null then "$STUN_PASSWORD" else null;
+
+          NETBIRD_DASHBOARD_ENDPOINT = "https://''${cfg.settings.NETBIRD_DOMAIN}:443";
+          NETBIRD_MGMT_API_ENDPOINT = "https://''${cfg.settings.NETBIRD_DOMAIN}:''${builtins.toString cfg.settings.NETBIRD_MGMT_API_PORT or NETBIRD_MGMT_API_PORT}";
+          NETBIRD_SIGNAL_ENDPOINT = "https://''${cfg.settings.NETBIRD_DOMAIN}:''${builtins.toString cfg.settings.NETBIRD_SIGNAL_PORT or NETBIRD_SIGNAL_PORT}";
+
+          NETBIRD_SIGNAL_PROTOCOL = "https";
+          NETBIRD_SIGNAL_PORT = 443;
+
+          NETBIRD_AUTH_USER_ID_CLAIM = "sub";
+          NETBIRD_AUTH_CLIENT_SECRET = if cfg.secretFiles.AUTH_CLIENT_SECRET != null then "$AUTH_CLIENT_SECRET" else "";
+          NETBIRD_AUTH_SUPPORTED_SCOPES = [ "openid" "profile" "email" "offline_access" "api" ];
+
+          NETBIRD_AUTH_REDIRECT_URI = "";
+          NETBIRD_AUTH_SILENT_REDIRECT_URI = "";
+
+          NETBIRD_AUTH_DEVICE_AUTH_PROVIDER = "none";
+          NETBIRD_AUTH_DEVICE_AUTH_CLIENT_ID = cfg.settings.NETBIRD_AUTH_CLIENT_ID;
+          NETBIRD_AUTH_DEVICE_AUTH_AUDIENCE = cfg.settings.NETBIRD_AUTH_AUDIENCE;
+          NETBIRD_AUTH_DEVICE_AUTH_SCOPE = [ "openid" "profile" "email" "offline_access" "api" ];
+          NETBIRD_AUTH_DEVICE_AUTH_USE_ID_TOKEN = false;
+
+          NETBIRD_MGMT_API_PORT = 443;
+
+          NETBIRD_MGMT_IDP = "none";
+          NETBIRD_IDP_MGMT_CLIENT_ID = cfg.settings.NETBIRD_AUTH_CLIENT_ID;
+          NETBIRD_IDP_MGMT_CLIENT_SECRET = if cfg.secretFiles.IDP_MGMT_CLIENT_SECRET != null then "$IDP_MGMT_CLIENT_SECRET" else cfg.settings.NETBIRD_AUTH_CLIENT_SECRET;
+          NETBIRD_IDP_MGMT_GRANT_TYPE = "client_credentials";
+
+          NETBIRD_TOKEN_SOURCE = "accessToken";
+          NETBIRD_DRAG_QUERY_PARAMS = false;
+
+          NETBIRD_USE_AUTH0 = false;
+
+          NETBIRD_AUTH_DEVICE_AUTH_ENDPOINT = "";
+
+          NETBIRD_AUTH_PKCE_REDIRECT_URL_PORTS = [ "53000" ];
+          NETBIRD_AUTH_PKCE_REDIRECT_URLS = builtins.map (p: "http://localhost:''${p}") cfg.settings.NETBIRD_AUTH_PKCE_REDIRECT_URL_PORTS or NETBIRD_AUTH_PKCE_REDIRECT_URL_PORTS;
+        }
+      '';
+      description = lib.mdDoc ''
+        Configuration settings for netbird.
+        Example config values can be found in [setup.env.example](https://github.com/netbirdio/netbird/blob/main/infrastructure_files/setup.env.example)
+        List of strings [ a b ] will be concatenated as "a b", useful for setting the supported scopes.
+      '';
+    };
+
+    managementConfig = mkOption {
+      inherit (managementFormat) type;
+      description = lib.mdDoc "Configuration of the netbird management server.";
+    };
+
+    idpManagerExtraConfig = mkOption {
+      type = types.attrsOf types.str;
+      default = { };
+      description = lib.mdDoc "Extra options passed to the IdpManagerConfig.";
+    };
+
+    ports.management = mkOption {
+      type = types.port;
+      default = 8011;
+      description = lib.mdDoc "Internal port of the management server.";
+    };
+
+    ports.signal = mkOption {
+      type = types.port;
+      default = 8012;
+      description = lib.mdDoc "Internal port of the signal server.";
+    };
+
+    logLevel = mkOption {
+      type = types.enum [
+        "ERROR"
+        "WARN"
+        "INFO"
+        "DEBUG"
+      ];
+      default = "INFO";
+      description = lib.mdDoc "Log level of the netbird services.";
+    };
+
+    enableDeviceAuthorizationFlow = mkEnableOption "device authorization flow for netbird." // {
+      default = true;
+    };
+
+    enableNginx = mkEnableOption "NGINX reverse-proxy for the netbird server.";
+
+    enableCoturn = mkEnableOption "a Coturn server used for Netbird.";
+
+    setupAutoOidc = mkEnableOption "the automatic setup of the OIDC.";
+
+    management = {
+
+      dnsDomain = mkOption {
+        type = types.str;
+        default = "netbird.selfhosted";
+        description = lib.mdDoc "Domain used for peer resolution.";
+      };
+
+      singleAccountModeDomain = mkOption {
+        type = types.str;
+        default = "netbird.selfhosted";
+        description = lib.mdDoc ''
+          Enables single account mode.
+          This means that all the users will be under the same account grouped by the specified domain.
+          If the installation has more than one account, the property is ineffective.
+        '';
+      };
+
+      disableAnonymousMetrics = mkOption {
+        type = types.bool;
+        default = true;
+        description = lib.mdDoc "Disables push of anonymous usage metrics to NetBird.";
+      };
+
+      disableSingleAccountMode = mkOption {
+        type = types.bool;
+        default = false;
+        description = lib.mdDoc ''
+          If set to true, disables single account mode.
+          The `singleAccountModeDomain` property will be ignored and every new user will have a separate NetBird account.
+        '';
+      };
+    };
+
+    secretFiles = {
+      TURN_PASSWORD = mkOption {
+        type = with types; nullOr path;
+        default = null;
+        description = lib.mdDoc "Path to a file containing the secret TURN_PASSWORD.";
+      };
+
+      TURN_SECRET = mkOption {
+        type = with types; nullOr path;
+        default = null;
+        description = lib.mdDoc "Path to a file containing the secret TURN_SECRET.";
+      };
+
+      STUN_PASSWORD = mkOption {
+        type = with types; nullOr path;
+        default = null;
+        description = lib.mdDoc "Path to a file containing the secret STUN_PASSWORD.";
+      };
+
+      AUTH_CLIENT_SECRET = mkOption {
+        type = with types; nullOr path;
+        default = null;
+        description = lib.mdDoc "Path to a file containing the secret NETBIRD_AUTH_CLIENT_SECRET.";
+      };
+
+      IDP_MGMT_CLIENT_SECRET = mkOption {
+        type = with types; nullOr path;
+        default = cfg.secretFiles.AUTH_CLIENT_SECRET;
+        defaultText = lib.literalExpression "cfg.secretFiles.AUTH_CLIENT_SECRET;";
+        description = lib.mdDoc "Path to a file containing the secret NETBIRD_IDP_MGMT_CLIENT_SECRET.";
+      };
+    };
+  };
+
+  config = mkMerge [
+    (mkIf cfg.enable {
+      services.netbird-server.managementConfig = with settings; {
+        Stuns = mkDefault [
+          {
+            Proto = "udp";
+            URI = "stun:${TURN_DOMAIN}:${builtins.toString TURN_PORT}";
+            Username = STUN_USERNAME;
+            Password = STUN_PASSWORD;
+          }
+        ];
+        TURNConfig = {
+          Turns = [
+            {
+              Proto = "udp";
+              URI = "turn:${TURN_DOMAIN}:${builtins.toString TURN_PORT}";
+              Username = TURN_USER;
+              Password = TURN_PASSWORD;
+            }
+          ];
+          CredentialsTTL = "12h";
+          Secret = TURN_SECRET;
+          TimeBasedCredentials = false;
+        };
+        Signal = {
+          Proto = NETBIRD_SIGNAL_PROTOCOL;
+          URI = "${NETBIRD_DOMAIN}:${builtins.toString NETBIRD_SIGNAL_PORT}";
+          Username = "";
+          Password = null;
+        };
+        Datadir = "${stateDir}/data";
+        HttpConfig = {
+          Address = "127.0.0.1:${builtins.toString cfg.ports.management}";
+          AuthIssuer = NETBIRD_AUTH_AUTHORITY;
+          AuthAudience = NETBIRD_AUTH_AUDIENCE;
+          AuthKeysLocation = NETBIRD_AUTH_JWT_CERTS;
+          AuthUserIDClaim = NETBIRD_AUTH_USER_ID_CLAIM;
+          OIDCConfigEndpoint = NETBIRD_AUTH_OIDC_CONFIGURATION_ENDPOINT;
+        };
+        IdpManagerConfig = {
+          ManagerType = NETBIRD_MGMT_IDP;
+          ClientConfig = {
+            Issuer = NETBIRD_AUTH_AUTHORITY;
+            TokenEndpoint = NETBIRD_AUTH_TOKEN_ENDPOINT;
+            ClientID = NETBIRD_IDP_MGMT_CLIENT_ID;
+            ClientSecret = NETBIRD_IDP_MGMT_CLIENT_SECRET;
+            GrantType = NETBIRD_IDP_MGMT_GRANT_TYPE;
+          };
+          ExtraConfig = cfg.idpManagerExtraConfig;
+        };
+        DeviceAuthorizationFlow = mkIf cfg.enableDeviceAuthorizationFlow {
+          Provider = NETBIRD_AUTH_DEVICE_AUTH_PROVIDER;
+          ProviderConfig = {
+            Audience = NETBIRD_AUTH_DEVICE_AUTH_AUDIENCE;
+            Domain = NETBIRD_AUTH_AUTHORITY;
+            ClientID = NETBIRD_AUTH_DEVICE_AUTH_CLIENT_ID;
+            TokenEndpoint = NETBIRD_AUTH_TOKEN_ENDPOINT;
+            DeviceAuthEndpoint = NETBIRD_AUTH_DEVICE_AUTH_ENDPOINT;
+            Scope = builtins.concatStringsSep " " NETBIRD_AUTH_DEVICE_AUTH_SCOPE;
+            UseIDToken = NETBIRD_AUTH_DEVICE_AUTH_USE_ID_TOKEN;
+          };
+        };
+        PKCEAuthorizationFlow = {
+          ProviderConfig = {
+            Audience = NETBIRD_AUTH_AUDIENCE;
+            ClientID = NETBIRD_AUTH_CLIENT_ID;
+            ClientSecret = NETBIRD_AUTH_CLIENT_SECRET;
+            AuthorizationEndpoint = NETBIRD_AUTH_PKCE_AUTHORIZATION_ENDPOINT;
+            TokenEndpoint = NETBIRD_AUTH_TOKEN_ENDPOINT;
+            Scope = builtins.concatStringsSep " " NETBIRD_AUTH_SUPPORTED_SCOPES;
+            RedirectURLs = NETBIRD_AUTH_PKCE_REDIRECT_URLS;
+            UseIDToken = NETBIRD_AUTH_PKCE_USE_ID_TOKEN;
+          };
+        };
+      };
+
+      services.nginx.virtualHosts = mkIf cfg.enableNginx {
+        ${cfg.settings.NETBIRD_DOMAIN} = {
+          forceSSL = true;
+          enableACME = true;
+
+          locations = {
+            "/" = {
+              root = "${stateDir}/web-ui/";
+              tryFiles = "$uri /index.html";
+            };
+
+            "/signalexchange.SignalExchange/".extraConfig = ''
+              grpc_pass grpc://localhost:${builtins.toString cfg.ports.signal};
+              grpc_read_timeout 1d;
+              grpc_send_timeout 1d;
+              grpc_socket_keepalive on;
+            '';
+
+            "/api".proxyPass = "http://localhost:${builtins.toString cfg.ports.management}";
+
+            "/management.ManagementService/".extraConfig = ''
+              grpc_pass grpc://localhost:${builtins.toString cfg.ports.management};
+              grpc_read_timeout 1d;
+              grpc_send_timeout 1d;
+              grpc_socket_keepalive on;
+            '';
+          };
+        };
+      };
+
+      systemd.services = {
+        netbird-setup = {
+          wantedBy = [
+            "netbird-management.service"
+            "netbird-signal.service"
+            "multi-user.target"
+          ];
+          serviceConfig = {
+            Type = "oneshot";
+            RuntimeDirectory = "netbird-mgmt";
+            StateDirectory = "netbird-mgmt";
+            WorkingDirectory = stateDir;
+            EnvironmentFile = [ settingsFile ];
+          };
+          unitConfig = {
+            StartLimitInterval = 5;
+            StartLimitBurst = 10;
+          };
+
+          path =
+            (with pkgs; [
+              coreutils
+              findutils
+              gettext
+              gnused
+            ])
+            ++ (optionals cfg.setupAutoOidc (
+              with pkgs;
+              [
+                curl
+                jq
+              ]
+            ));
+
+          script =
+            ''
+              cp ${managementFile} ${stateDir}/management.json.copy
+            ''
+            + (optionalString cfg.setupAutoOidc ''
+              mv ${stateDir}/management.json.copy ${stateDir}/management.json
+              echo "loading OpenID configuration from $NETBIRD_AUTH_OIDC_CONFIGURATION_ENDPOINT to the openid-configuration.json file"
+              curl "$NETBIRD_AUTH_OIDC_CONFIGURATION_ENDPOINT" -q -o ${stateDir}/openid-configuration.json
+
+              export NETBIRD_AUTH_AUTHORITY=$(jq -r '.issuer' ${stateDir}/openid-configuration.json)
+              export NETBIRD_AUTH_JWT_CERTS=$(jq -r '.jwks_uri' ${stateDir}/openid-configuration.json)
+              export NETBIRD_AUTH_TOKEN_ENDPOINT=$(jq -r '.token_endpoint' ${stateDir}/openid-configuration.json)
+              export NETBIRD_AUTH_DEVICE_AUTH_ENDPOINT=$(jq -r '.device_authorization_endpoint' ${stateDir}/openid-configuration.json)
+              export NETBIRD_AUTH_PKCE_AUTHORIZATION_ENDPOINT=$(jq -r '.authorization_endpoint' ${stateDir}/openid-configuration.json)
+
+              envsubst '$NETBIRD_AUTH_AUTHORITY $NETBIRD_AUTH_JWT_CERTS $NETBIRD_AUTH_TOKEN_ENDPOINT $NETBIRD_AUTH_DEVICE_AUTH_ENDPOINT $NETBIRD_AUTH_PKCE_AUTHORIZATION_ENDPOINT' < ${stateDir}/management.json > ${stateDir}/management.json.copy
+            '')
+            + ''
+              # Update secrets in management.json
+              ${builtins.concatStringsSep "\n" (
+                builtins.attrValues (
+                  builtins.mapAttrs (name: path: "export ${name}=$(cat ${path})") (
+                    filterAttrs (_: p: p != null) cfg.secretFiles
+                  )
+                )
+              )}
+
+              envsubst '$TURN_PASSWORD $TURN_SECRET $STUN_PASSWORD $AUTH_CLIENT_SECRET $IDP_MGMT_CLIENT_SECRET' < ${stateDir}/management.json.copy > ${stateDir}/management.json
+
+              rm -rf ${stateDir}/web-ui
+              mkdir -p ${stateDir}/web-ui
+              cp -R ${dashboard}/* ${stateDir}/web-ui
+
+              export AUTH_AUTHORITY="$NETBIRD_AUTH_AUTHORITY"
+              export AUTH_CLIENT_ID="$NETBIRD_AUTH_CLIENT_ID"
+              ${optionalString (
+                cfg.secretFiles.AUTH_CLIENT_SECRET == null
+              ) ''export AUTH_CLIENT_SECRET="$NETBIRD_AUTH_CLIENT_SECRET"''}
+              export AUTH_AUDIENCE="$NETBIRD_AUTH_AUDIENCE"
+              export AUTH_REDIRECT_URI="$NETBIRD_AUTH_REDIRECT_URI"
+              export AUTH_SILENT_REDIRECT_URI="$NETBIRD_AUTH_SILENT_REDIRECT_URI"
+              export USE_AUTH0="$NETBIRD_USE_AUTH0"
+              export AUTH_SUPPORTED_SCOPES=$(echo $NETBIRD_AUTH_SUPPORTED_SCOPES | sed -E 's/"//g')
+
+              export NETBIRD_MGMT_API_ENDPOINT=$(echo $NETBIRD_MGMT_API_ENDPOINT | sed -E 's/(:80|:443)$//')
+
+              MAIN_JS=$(find ${stateDir}/web-ui/static/js/main.*js)
+              OIDC_TRUSTED_DOMAINS=${stateDir}/web-ui/OidcTrustedDomains.js
+              mv "$MAIN_JS" "$MAIN_JS".copy
+              envsubst '$USE_AUTH0 $AUTH_AUTHORITY $AUTH_CLIENT_ID $AUTH_CLIENT_SECRET $AUTH_SUPPORTED_SCOPES $AUTH_AUDIENCE $NETBIRD_MGMT_API_ENDPOINT $NETBIRD_MGMT_GRPC_API_ENDPOINT $NETBIRD_HOTJAR_TRACK_ID $AUTH_REDIRECT_URI $AUTH_SILENT_REDIRECT_URI $NETBIRD_TOKEN_SOURCE $NETBIRD_DRAG_QUERY_PARAMS' < "$MAIN_JS".copy > "$MAIN_JS"
+              envsubst '$NETBIRD_MGMT_API_ENDPOINT' < "$OIDC_TRUSTED_DOMAINS".tmpl > "$OIDC_TRUSTED_DOMAINS"
+            '';
+        };
+
+        netbird-signal = {
+          after = [ "network.target" ];
+          wantedBy = [ "netbird-management.service" ];
+          restartTriggers = [
+            settingsFile
+            managementFile
+          ];
+
+          serviceConfig = {
+            ExecStart = ''
+              ${cfg.package}/bin/netbird-signal run \
+                --port ${builtins.toString cfg.ports.signal} \
+                --log-file console \
+                --log-level ${cfg.logLevel}
+            '';
+            Restart = "always";
+            RuntimeDirectory = "netbird-mgmt";
+            StateDirectory = "netbird-mgmt";
+            WorkingDirectory = stateDir;
+          };
+          unitConfig = {
+            StartLimitInterval = 5;
+            StartLimitBurst = 10;
+          };
+          stopIfChanged = false;
+        };
+
+        netbird-management = {
+          description = "The management server for Netbird, a wireguard VPN";
+          documentation = [ "https://netbird.io/docs/" ];
+          after = [
+            "network.target"
+            "netbird-setup.service"
+          ];
+          wantedBy = [ "multi-user.target" ];
+          wants = [
+            "netbird-signal.service"
+            "netbird-setup.service"
+          ];
+          restartTriggers = [
+            settingsFile
+            managementFile
+          ];
+
+          serviceConfig = {
+            ExecStart = ''
+              ${cfg.package}/bin/netbird-mgmt management \
+                --config ${stateDir}/management.json \
+                --datadir ${stateDir}/data \
+                ${optionalString cfg.management.disableAnonymousMetrics "--disable-anonymous-metrics"} \
+                ${optionalString cfg.management.disableSingleAccountMode "--disable-single-account-mode"} \
+                --dns-domain ${cfg.management.dnsDomain} \
+                --single-account-mode-domain ${cfg.management.singleAccountModeDomain} \
+                --idp-sign-key-refresh-enabled \
+                --port ${builtins.toString cfg.ports.management} \
+                --log-file console \
+                --log-level ${cfg.logLevel}
+            '';
+            Restart = "always";
+            RuntimeDirectory = "netbird-mgmt";
+            StateDirectory = [
+              "netbird-mgmt"
+              "netbird-mgmt/data"
+            ];
+            WorkingDirectory = stateDir;
+          };
+          unitConfig = {
+            StartLimitInterval = 5;
+            StartLimitBurst = 10;
+          };
+          stopIfChanged = false;
+        };
+      };
+    })
+
+    (mkIf cfg.enableCoturn {
+      services.coturn = {
+        enable = true;
+
+        realm = settings.NETBIRD_DOMAIN;
+        lt-cred-mech = true;
+        no-cli = true;
+
+        extraConfig = ''
+          fingerprint
+
+          user=${settings.TURN_USER}:${builtins.toString settings.TURN_PASSWORD}
+          no-software-attribute
+        '';
+      };
+
+      networking.firewall = {
+        allowedUDPPorts = with settings; [
+          TURN_PORT
+          (TURN_PORT + 1)
+          5349
+          5350
+        ];
+        allowedTCPPorts = with settings; [
+          TURN_PORT
+          (TURN_PORT + 1)
+        ];
+        allowedUDPPortRanges = [
+          {
+            from = settings.TURN_MIN_PORT;
+            to = settings.TURN_MAX_PORT;
+          }
+        ];
+      };
+    })
+
+    (mkIf (cfg.enableNginx && cfg.enableCoturn) {
+      services.coturn =
+        let
+          cert = config.security.acme.certs.${settings.TURN_DOMAIN};
+        in
+        {
+          cert = "${cert.directory}/fullchain.pem";
+          pkey = "${cert.directory}/key.pem";
+        };
+
+      users.users.nginx.extraGroups = [ "turnserver" ];
+
+      # share certs with coturn and restart on renewal
+      security.acme.certs.${settings.TURN_DOMAIN} = {
+        group = "turnserver";
+        postRun = "systemctl reload nginx.service; systemctl restart coturn.service";
+      };
+    })
+  ];
+}
--- a/machines/storage01/netbird/package/dashboard.nix
+++ b/machines/storage01/netbird/package/dashboard.nix
@ -0,0 +1,31 @@
+{
+  lib,
+  buildNpmPackage,
+  fetchFromGitHub,
+}:
+
+buildNpmPackage rec {
+  pname = "netbird-dashboard";
+  version = "1.17.6";
+
+  src = fetchFromGitHub {
+    owner = "netbirdio";
+    repo = "dashboard";
+    rev = "v${version}";
+    hash = "sha256-MDxN/58dv6OqPYnNgDVZ+YRzfw2dER7x8mEWe14rQ40=";
+  };
+
+  npmDepsHash = "sha256-x7YyzBPAiXyxaIcAvUrXBexYaw0TaYnKgQKT3KadW8w=";
+  npmFlags = [ "--legacy-peer-deps" ];
+
+  installPhase = ''
+    cp -R build $out
+  '';
+
+  meta = with lib; {
+    description = "NetBird Management Service Web UI Panel";
+    homepage = "https://github.com/netbirdio/dashboard";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ thubrecht ];
+  };
+}
--- a/machines/storage01/netbird/package/default.nix
+++ b/machines/storage01/netbird/package/default.nix
@ -0,0 +1,7 @@
+{
+  pkgs ? import <nixpkgs> { },
+}:
+
+{
+  dashboard = pkgs.callPackage ./dashboard.nix { };
+}
--- a/machines/storage01/peertube.nix
+++ b/machines/storage01/peertube.nix
@ -4,8 +4,6 @@ let
  host = "videos.dgnum.eu";
 in
 {
-  dgn-web.internalPorts.peertube = config.services.peertube.listenHttp;
-
  services.peertube = {
    enable = true;

--- a/machines/storage01/prometheus.nix
+++ b/machines/storage01/prometheus.nix
@ -77,9 +77,15 @@ in
    ];
  };

-  dgn-web.simpleProxies.prometheus = {
-    inherit host port;
-    proxyWebsockets = true;
+  services.nginx.virtualHosts.${host} = {
+    enableACME = true;
+    forceSSL = true;
+
+    locations."/" = {
+      proxyPass = "http://127.0.0.1:${builtins.toString port}";
+      proxyWebsockets = true;
+      recommendedProxySettings = true;
+    };
  };

  age-secrets.autoMatch = [ "prometheus" ];
--- a/machines/storage01/secrets/netbird-auth_client_secret_file
+++ b/machines/storage01/secrets/netbird-auth_client_secret_file
--- a/machines/storage01/secrets/netbird-data_store_encryption_key_file
+++ b/machines/storage01/secrets/netbird-data_store_encryption_key_file
@ -1,30 +0,0 @@
-age-encryption.org/v1
-> ssh-ed25519 jIXfPA xId0d57S+YmTeZzTTNOs7Pt3RPQ7MLNiKg6Mox2MEFo
-hFUYZMNoxZQBEKz4SYDC4nLDDXRftXtUtCLCX2kvwZ8
-> ssh-ed25519 QlRB9Q kmsgaV+FRbqcKkhttlbmY22M6pO6kMCqLUYsq1yGSyA
-VmprdWLh380qm6aarum1q17pDrMF0KLyXV/PN1OmEO8
-> ssh-ed25519 r+nK/Q XVeZFVNLv0FlL/lPhXrvVJcHAubE1tTfSxl5iiixtF0
-Udm/qZMOzNcg2LMffkns+jUlrtXAC8Mk8ofCSD6zf/0
-> ssh-rsa krWCLQ
-OJlswMZEz2ONsqvFH8aMo4cRXzNiSkqtOmNQuWbRcAI4sXKCNuNtNcv6WPcpBMPZ
-8eTvoIOf8triUwGBWLZ9oRvYOeoucyWCqx0zf11VwOclRBeziRPOQ5Uon+5gpsg2
-H1FO7Sk0sVjME/2INUjd1Q4TlPF9tlUOcEDBgyc81cLI0JrR7S2D6Hl/rAN9Gees
-D9c+q5PJkvbw7KQPEu7WOxPNCi1gRyHSlKv5ef5gToNOl/c8GAJR5FutO/bTgTTl
-P+yLysKXK+r2IwNNMHGFBDVbsp09IjQ+H623Sfr6H0pR7FYShohfzcM6JA3ydztN
-Gy5MiJasx3nWCUYJZUL1Fw
-> ssh-ed25519 /vwQcQ OelREEMNnpUXuJ8BA1VPVM8yqEd8PS9m81sw5gaq8U8
-wPUQOWxzsj55/hii7Cd4+P1eFWVDQANwIcImOliOqog
-> ssh-ed25519 0R97PA 9NzXGY3sZb8srqaVWWbZhbNJdDfCfeZIhJHPWy9U4FU
-+LvE5cI8heO8XhsejCWaJrwaRGYGCziymPZLrYTOXtg
-> ssh-ed25519 JGx7Ng 1jWoS1sqmY9MxZT7fAMsg5QbokAMNlTg9jmpxzr1ekQ
-7MndRQ0ruZP2/cOKaid60rQg8Q3ljy2oknf0czOLGSo
-> ssh-ed25519 5SY7Kg Bm19KVQA8DkrDxiYsVRdKVubML7J9L/apLoUs+otehk
-kQMv/7uijZlyGDbDt2aNF85vp4nYM9o3fIetvnykX6I
-> ssh-ed25519 p/Mg4Q /vhTds9k+5uwSDjLyKp18ge+bu/Aeg72nHx2joWUTw0
-zeim4NPL7floIvZ296vYuyk5XAVFCCaWRc0iRQQxbyg
-> ssh-ed25519 rHotTw YbKb6NyxsknA125fdWj5/RJjmaY22yDwNx+bLKV6ZW4
-jJw+YJqQC/B+UMLYAtTAIZuON2hiZAY171ovJ0ceKjg
-> @K'k$-grease x>ie }CH4sS h|s
-bVzOpc2vPj8ldZskVlQSmOE7wHR2q/dXcdC6vrPXSvYWCKK8Rg
--- uDaSBMjg5lvDnZyTKHqveb5B+y71HjrDzOqtsJycuBs
-1Ò¨Rq¢<>nýµ{”ýT°5?HXH1¢ Ê%‘)Í01’RGr×¿fÖNT4å2B(í);ìíÿ‰íÁœ
--- a/machines/storage01/secrets/netbird-relay_environment_file
+++ b/machines/storage01/secrets/netbird-relay_environment_file
--- a/machines/storage01/secrets/netbird-relay_secret_file
+++ b/machines/storage01/secrets/netbird-relay_secret_file
@ -1,31 +0,0 @@
-age-encryption.org/v1
-> ssh-ed25519 jIXfPA lI9DxAFp/gbF+77Sofv9KIrs3kMTYTLEm8C6AsZBPyI
-8RFGt1aJnZbd7Lpr4iy1VlMr3yzpPf6sI79cik5X77c
-> ssh-ed25519 QlRB9Q eMENLAMY+eNXJhduTnJoyPimbThM7VA+4m6BrnZa8RE
-NpwcJhh0U8pMU1hnXFz2bfwSmCQra1CI5Tr2cbXGMT0
-> ssh-ed25519 r+nK/Q eyuD/hYyYmG96AcPEZVNsohXgK9WD+g+ZyMpIyaiYjY
-Ef+R/eXkqvOmYJvjz4muTjGamkXzgHzD31vXDXsgo3M
-> ssh-rsa krWCLQ
-BuBMUp5uijNV71OYvMGS9NhBBplfFugJy14EOHclJ2TKjQ19RVKHPj0wX0AxuPCT
-iV6j6Po/oKSsGuoKy6JMTLKjYtROPF70Ld8PlC4tFI5i0xQagEFhKONfk1Rd/mF0
-2qGriQhSUMvkMirbkhE3CxrAzSqcjuoGji+ZWwpz2LYUVsF89nnoLsTRri+Sg5ZW
-4qhoo23UTU+IlrVtqjB7W1rNAwHKhWPZnjc08x1x/qnLATemmDMsFmTEGljJNGMR
-kEg+oUdwdvLjDsnGBWkE+Ck/mrEGwjcsDTmZmCYcH/Q11EMdj5hnCfG68PRhLF9K
-b28fHveM3i5/jHrrTxWbrA
-> ssh-ed25519 /vwQcQ 1xQWlLW6xCrheirHSKcGEu+KM644y8NP1KYvwOganQc
-IFVYj83X1uLvgIRlnDvnLiaoZNM9viLT7X11vIHdLxY
-> ssh-ed25519 0R97PA I8K03IKgC59zmHqVr8h8TaxuuTSbmYsyap830JyhIhw
-AGxW9sq7PQNgs9WFcbINI2CnE3lJJ0rDmseN83YSeT0
-> ssh-ed25519 JGx7Ng syz/pzdj3Lg1VwulZhT8UQncgXjOH1nlbtqHgASLAws
-IKaU32zbjFc319PctmGPtHt4RXjgzun0K+9HeuGS3FU
-> ssh-ed25519 5SY7Kg 06EjOyKw1zIWcdZGC7EfNt9mFix+fVcy1iS+SBhPgCQ
-ZxcNbC1QmTPJkWlwBnD9YjuzekGZtSDeI7RYxq0uwgw
-> ssh-ed25519 p/Mg4Q uCbjjN5S0ZoZtsj5jva9mTrlZ2UE02A3DysxV1PZ/lM
-7jWWiWp4ei5VjftKZz29osbaFxfpId+X3GLzgWZ9Wgo
-> ssh-ed25519 rHotTw Q1/zZpGbUCbXiEELad5710uNkllrFuQlhonSLfIoQVo
-h6iW26rADPn1MRqNoD33ZVVDRDr2DBoNK+BjrDxwZik
-> ss-grease
-A3WDPMHgipAaXF0MStKGx8CAbFTqks74CRTKButwwJYvgnMFp2Yglx3D2NOWTdJm
-yde7gp5XInweYf2TjvQK88l0MD0VYlG9Lu7+wbWGFElCpQ
--- 0d/8UVX6ubUZpKG3LzJsFKbsZNRKUwQq7LuWMiyezKo
-P?j@¦Hˆ´ßš¥¼ówgêìÚ©L¥_ã+ì|Î¶ãÙ¦Ö#‘“fu#cæ¶¯„IæS†|¨À²å 4Š
--- a/machines/storage01/secrets/secrets.nix
+++ b/machines/storage01/secrets/secrets.nix
@ -8,9 +8,7 @@
  "influxdb2-initial_password_file"
  "influxdb2-initial_token_file"
  "influxdb2-telegraf_token_file"
-  "netbird-data_store_encryption_key_file"
-  "netbird-relay_environment_file"
-  "netbird-relay_secret_file"
+  "netbird-auth_client_secret_file"
  "nginx-tvix-store-password"
  "nginx-tvix-store-password-ci"
  "peertube-secrets_file"
--- a/machines/storage01/tvix-cache/default.nix
+++ b/machines/storage01/tvix-cache/default.nix
@ -135,11 +135,10 @@ in
  systemd.services."tvix-store" = {
    wantedBy = [ "multi-user.target" ];
    environment = {
-      RUST_LOG = "info";
+      RUST_LOG = "debug";
    };
    serviceConfig = {
      UMask = "007";
-      LimitNOFILE = 1048576;
      ExecStart = "${package}/bin/multitier-tvix-cache --endpoints-config ${toml.endpoints} --store-composition ${toml.composition}";
      StateDirectory = "tvix-store";
      RuntimeDirectory = "tvix-store";
--- a/machines/storage01/victoria-metrics.nix
+++ b/machines/storage01/victoria-metrics.nix
@ -1,16 +0,0 @@
-let
-  host = "victoria-metrics.dgnum.eu";
-  port = 9099;
-in
-
-{
-  services.victoriametrics = {
-    enable = true;
-
-    listenAddress = "127.0.0.1:${builtins.toString port}";
-  };
-
-  dgn-web.simpleProxies.victoria-metrics = {
-    inherit host port;
-  };
-}
--- a/machines/vault01/networking.nix
+++ b/machines/vault01/networking.nix
@ -239,7 +239,7 @@ in
          chain postrouting {
            type nat hook postrouting priority 100;
            ip saddr 10.0.0.0/16 ip saddr != 10.0.255.0/24 snat ip to 129.199.195.130-129.199.195.158
-            ether saddr { e0:2e:0b:bd:97:73, e8:d5:2b:0d:fe:4a } snat to 129.199.195.130 comment "Elias"
+            ether saddr e0:2b:e9:b5:b4:cc snat to 129.199.195.130 comment "Elias"
            ether saddr { 1c:1b:b5:14:9c:e5, e6:ce:e2:b6:e3:82 } snat to 129.199.195.131 comment "Lubin"
            ether saddr d0:49:7c:46:f6:39 snat to 129.199.195.132 comment "Jean-Marc"
            ether saddr { 5c:64:8e:f4:09:06 } snat to 129.199.195.158 comment "APs"
--- a/machines/web01/crabfit/default.nix
+++ b/machines/web01/crabfit/default.nix
@ -12,12 +12,25 @@

  dgn-backups.postgresDatabases = [ "crabfit" ];

-  dgn-web.simpleProxies = {
-    crabfit-api = {
-      inherit (config.services.crabfit.api) host port;
+  services.nginx =
+    let
+      cfg = config.services.crabfit;
+    in
+    {
+      enable = true;
+
+      virtualHosts.${cfg.frontend.host} = {
+        enableACME = true;
+        forceSSL = true;
+
+        locations."/".proxyPass = "http://127.0.0.1:${builtins.toString cfg.frontend.port}";
+      };
+
+      virtualHosts.${cfg.api.host} = {
+        enableACME = true;
+        forceSSL = true;
+
+        locations."/".proxyPass = "http://127.0.0.1:${builtins.toString cfg.api.port}";
+      };
    };
-    crabfit-frontend = {
-      inherit (config.services.crabfit.frontend) host port;
-    };
-  };
 }
--- a/machines/web01/linkal/module.nix
+++ b/machines/web01/linkal/module.nix
@ -101,13 +101,20 @@ in
    #   };
    # };

-    dgn-web.simpleProxies = mapAttrs' (
-      name:
-      { port, ... }:
-      nameValuePair "linkal-${name}" {
-        inherit port;
-        host = "${name}.${cfg.domain}";
-      }
-    ) cfg.calendarGroups;
+    services.nginx = {
+      enable = true;
+
+      virtualHosts = mapAttrs' (
+        name:
+        { port, ... }:
+        nameValuePair "${name}.${cfg.domain}" {
+          enableACME = true;
+          # acmeRoot = null; # Use DNS-01 validation
+          forceSSL = true;
+
+          locations."/".proxyPass = "http://127.0.0.1:${builtins.toString port}/";
+        }
+      ) cfg.calendarGroups;
+    };
  };
 }
--- a/machines/web01/metis/default.nix
+++ b/machines/web01/metis/default.nix
@ -6,35 +6,30 @@
 }:

 let
-  inherit (lib) mapAttrsToList match;
-
  metis = import sources.metis { inherit pkgs; };
+
+  inherit (metis) providers;
 in
 {
  services.nginx.virtualHosts."calendrier.dgnum.eu" = {
    enableACME = true;
    forceSSL = true;
-    root = metis.package;
+    root = metis.production;

    locations = lib.mapAttrs' (
-      name: domain:
+      name: value:
      lib.nameValuePair "/cal/${name}/" {
        extraConfig = ''
          proxy_set_header X-Forwarded-Host $host;
          proxy_set_header X-Forwarded-Server $host;
          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-          proxy_pass https://${domain}/remote.php/dav/public-calendars/;
+          proxy_pass ${value};
        '';
      }
-    ) metis.providers;
+    ) providers;

    extraConfig = ''
      rewrite ^/calendrier(.*)$ $1 permanent;
    '';
  };
-
-  assertions = mapAttrsToList (name: domain: {
-    assertion = (match "[a-z-]+" name == [ ]) && (match "[a-z.-]+" domain == [ ]);
-    message = "The provider `${name}` associated to the domain `${domain}` seems to have an incorrect definition.";
-  }) metis.providers;
 }
--- a/machines/web01/netbox.nix
+++ b/machines/web01/netbox.nix
@ -13,7 +13,7 @@ in
  services = {
    netbox = {
      enable = true;
-      package = nixpkgs.unstable.netbox_4_1;
+      package = nixpkgs.unstable.netbox_3_7;
      secretKeyFile = "/dev/null";
      listenAddress = "127.0.0.1";
      plugins = p: [ p.netbox-qrcode ];
@ -39,6 +39,17 @@ in
        SOCIAL_AUTH_OIDC_SECRET = env["NETBOX_OIDC_SECRET"]
      '';
    };
+
+    nginx = {
+      enable = true;
+      virtualHosts."netbox.dgnum.eu" = {
+        enableACME = true;
+        forceSSL = true;
+
+        locations."/".proxyPass = "http://${config.services.netbox.listenAddress}:${builtins.toString config.services.netbox.port}";
+        locations."/static/".alias = "${config.services.netbox.dataDir}/static/";
+      };
+    };
  };

  systemd.services = {
@ -58,12 +69,10 @@ in
  };

  users.users.nginx.extraGroups = [ "netbox" ];
-
-  dgn-web.simpleProxies.netbox = {
-    inherit (config.services.netbox) port;
-    host = "netbox.dgnum.eu";
-    vhostConfig.locations."/static/".alias = "${config.services.netbox.dataDir}/static/";
-  };
+  networking.firewall.allowedTCPPorts = [
+    443
+    80
+  ];

  dgn-backups.jobs.netbox.settings.paths = [ "/var/lib/netbox" ];
  dgn-backups.postgresDatabases = [ "netbox" ];
--- a/machines/web01/ntfy-sh.nix
+++ b/machines/web01/ntfy-sh.nix
@ -2,7 +2,6 @@

 let
  host = "push.dgnum.eu";
-  port = 2586;
 in
 {
  services.ntfy-sh = {
@ -18,9 +17,14 @@ in
    };
  };

-  dgn-web.simpleProxies.ntfy-sh = {
-    inherit host port;
-    proxyWebsockets = true;
+  services.nginx.virtualHosts.${host} = {
+    enableACME = true;
+    forceSSL = true;
+
+    locations."/" = {
+      proxyPass = "http://127.0.0.1:2586";
+      proxyWebsockets = true;
+    };
  };

  systemd.services.ntfy-sh.serviceConfig.EnvironmentFile = [
--- a/machines/web01/redirections.nix
+++ b/machines/web01/redirections.nix
@ -29,6 +29,7 @@ in
      "bds.wp.dgnum.eu" = "bds.ens.fr";
      "www.tuteurs.ens.fr" = "tuteurs.ens.fr";
      "www.interq.ens.fr" = "interq.ens.fr";
+      "www.lanuit.ens.fr" = "lanuit.ens.fr";
    };

    temporary = {
--- a/machines/web02/cas-eleves/default.nix
+++ b/machines/web02/cas-eleves/default.nix
@ -9,7 +9,6 @@
 let
  inherit (lib) mapAttrsToList;

-  host = "cas.eleves.ens.fr";
  port = 9889;

  python3 =
@ -129,24 +128,28 @@ in

  dgn-redirections.permanent."cas-eleves.dgnum.eu" = "cas.eleves.ens.fr";

-  dgn-web.simpleProxies.cas-eleves = {
-    inherit host port;
-    vhostConfig = {
+  services = {
+    postgresql = {
+      ensureDatabases = [ "cas_server" ];
+      ensureUsers = [
+        {
+          name = "cas_server";
+          ensureDBOwnership = true;
+        }
+      ];
+    };
+
+    nginx.virtualHosts."cas.eleves.ens.fr" = {
+      enableACME = true;
+      forceSSL = true;
+
      serverAliases = [ "cas-eleves.dgnum.eu" ];
+
      locations = {
+        "/".proxyPass = "http://127.0.0.1:${builtins.toString port}";
        "/static/".root = staticDrv;
        "= /robots.txt".root = "${staticDrv}/static";
      };
    };
  };
-
-  services.postgresql = {
-    ensureDatabases = [ "cas_server" ];
-    ensureUsers = [
-      {
-        name = "cas_server";
-        ensureDBOwnership = true;
-      }
-    ];
-  };
 }
--- a/machines/web02/kadenios/default.nix
+++ b/machines/web02/kadenios/default.nix
@ -9,7 +9,6 @@
 let
  inherit (lib) mapAttrsToList optionals;

-  host = "vote.dgnum.eu";
  port = 9888;

  python3 =
@ -169,18 +168,25 @@ in
    };
  };

-  dgn-web.simpleProxies.kadenios = {
-    inherit host port;
-    vhostConfig.locations."/static/".root = staticDrv;
-  };
+  services = {
+    postgresql = {
+      ensureDatabases = [ "kadenios" ];
+      ensureUsers = [
+        {
+          name = "kadenios";
+          ensureDBOwnership = true;
+        }
+      ];
+    };

-  services.postgresql = {
-    ensureDatabases = [ "kadenios" ];
-    ensureUsers = [
-      {
-        name = "kadenios";
-        ensureDBOwnership = true;
-      }
-    ];
+    nginx.virtualHosts."vote.dgnum.eu" = {
+      enableACME = true;
+      forceSSL = true;
+
+      locations = {
+        "/".proxyPass = "http://127.0.0.1:${builtins.toString port}";
+        "/static/".root = staticDrv;
+      };
+    };
  };
 }
--- a/machines/web03/_configuration.nix
+++ b/machines/web03/_configuration.nix
@ -1,19 +0,0 @@
-{ lib, ... }:
-
-lib.extra.mkConfig {
-  enabledModules = [
-    # List of modules to enable
-    "dgn-web"
-  ];
-
-  enabledServices = [
-    # List of services to enable
-    "django-apps"
-  ];
-
-  extraConfig = {
-    services.netbird.enable = true;
-  };
-
-  root = ./.;
-}
--- a/machines/web03/_hardware-configuration.nix
+++ b/machines/web03/_hardware-configuration.nix
@ -1,45 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{ modulesPath, ... }:
-
-{
-  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
-
-  boot = {
-    initrd = {
-      availableKernelModules = [
-        "ahci"
-        "xhci_pci"
-        "virtio_pci"
-        "sr_mod"
-        "virtio_blk"
-      ];
-      kernelModules = [ ];
-
-      luks.devices."main" = {
-        device = "/dev/disk/by-uuid/21a5fa9b-35d2-49c9-80f8-5161c652bdc8";
-        tryEmptyPassphrase = true;
-      };
-    };
-
-    kernelModules = [ "kvm-intel" ];
-    extraModulePackages = [ ];
-  };
-
-  fileSystems."/" = {
-    device = "/dev/disk/by-uuid/9069a0a6-2f9f-4219-a2c4-248de932da6f";
-    fsType = "ext4";
-  };
-
-  fileSystems."/boot" = {
-    device = "/dev/disk/by-uuid/9826-E466";
-    fsType = "vfat";
-    options = [
-      "fmask=0022"
-      "dmask=0022"
-    ];
-  };
-
-  swapDevices = [ { device = "/dev/disk/by-uuid/a91c29b4-9b1b-477e-820f-3cf610158e2a"; } ];
-}
--- a/machines/web03/django-apps/annuaire.nix
+++ b/machines/web03/django-apps/annuaire.nix
@ -1,57 +0,0 @@
-{
-  pkgs,
-  sources,
-  config,
-  ...
-}:
-
-let
-  nix-pkgs = import sources.nix-pkgs { inherit pkgs; };
-in
-
-{
-  services.django-apps.sites.annuaire = {
-    source = "https://git.dgnum.eu/DGNum/annuaire-eleves";
-    branch = "main";
-    domain = "annuaire-ens.webapps.dgnum.eu";
-
-    nginx = {
-      enableACME = true;
-      forceSSL = true;
-    };
-
-    webHookSecret = config.age.secrets."webhook-annuaire_token".path;
-
-    python = pkgs.python3.override {
-      packageOverrides = _: _: { inherit (nix-pkgs) authens loadcredential; };
-    };
-
-    dependencies = ps: [
-      ps.django
-      ps.pillow
-      ps.loadcredential
-      ps.authens
-      ps.python-dateutil
-    ];
-
-    credentials = {
-      SECRET_KEY = config.age.secrets."dj_annuaire-secret_key_file".path;
-    };
-
-    environment = {
-      ANNUAIRE_ALLOWED_HOSTS = [ "annuaire-ens.webapps.dgnum.eu" ];
-      ANNUAIRE_LDAP = {
-        SPI = {
-          PROTOCOL = "ldaps";
-          URL = "ldap.spi.ens.fr";
-          PORT = 636;
-        };
-        CRI = {
-          PROTOCOL = "ldaps";
-          URL = "annuaire.ens.fr";
-          PORT = 636;
-        };
-      };
-    };
-  };
-}
--- a/machines/web03/django-apps/bocal.nix
+++ b/machines/web03/django-apps/bocal.nix
@ -1,49 +0,0 @@
-{
-  pkgs,
-  sources,
-  config,
-  ...
-}:
-
-let
-  nix-pkgs = import sources.nix-pkgs { inherit pkgs; };
-in
-
-{
-  services.django-apps.sites.bocal = {
-    source = "https://git.dgnum.eu/DGNum/www-bocal";
-    branch = "main";
-    domain = "bocal.webapps.dgnum.eu";
-
-    nginx = {
-      enableACME = true;
-      forceSSL = true;
-    };
-
-    webHookSecret = config.age.secrets."webhook-bocal_token".path;
-
-    python = pkgs.python3.override {
-      packageOverrides = _: _: { inherit (nix-pkgs) django-cas-ng django-solo loadcredential; };
-    };
-
-    dependencies = ps: [
-      ps.django
-      ps.django-cas-ng
-      ps.django-markdownx
-      ps.django-solo
-      ps.markdown
-      ps.pillow
-      ps.loadcredential
-    ];
-
-    credentials = {
-      SECRET_KEY = config.age.secrets."dj_bocal-secret_key_file".path;
-    };
-
-    environment = {
-      DJANGO_SETTINGS_MODULE = "app.settings";
-      BOCAL_ALLOWED_HOSTS = [ "bocal.webapps.dgnum.eu" ];
-      BOCAL_RHOSTS_PATH = "/var/lib/django-apps/bocal/.rhosts";
-    };
-  };
-}
--- a/machines/web03/django-apps/default.nix
+++ b/machines/web03/django-apps/default.nix
@ -1,22 +0,0 @@
-{
-  imports = [
-    ./annuaire.nix
-    ./bocal.nix
-    ./gestiojeux.nix
-    ./interludes.nix
-    ./wikiens.nix
-  ];
-
-  services.django-apps = {
-    enable = true;
-
-    webhook = {
-      domain = "apps-webhook.dgnum.eu";
-
-      nginx = {
-        enableACME = true;
-        forceSSL = true;
-      };
-    };
-  };
-}
--- a/machines/web03/django-apps/gestiojeux.nix
+++ b/machines/web03/django-apps/gestiojeux.nix
@ -1,74 +0,0 @@
-{
-  pkgs,
-  sources,
-  config,
-  ...
-}:
-
-let
-  nix-pkgs = import sources.nix-pkgs { inherit pkgs; };
-in
-
-{
-  services.django-apps.sites.gestiojeux = {
-    source = "https://git.dgnum.eu/DGNum/gestiojeux";
-    branch = "production";
-    domain = "gestiojeux.webapps.dgnum.eu";
-
-    nginx = {
-      enableACME = true;
-      forceSSL = true;
-    };
-
-    webHookSecret = config.age.secrets."webhook-gestiojeux_token".path;
-
-    application = {
-      type = "wsgi";
-      module = "gestiojeux";
-    };
-
-    python = pkgs.python3.override {
-      packageOverrides = _: _: {
-        inherit (nix-pkgs)
-          django-autoslug
-          django-cas-ng
-          loadcredential
-          markdown-icons
-          ;
-      };
-    };
-
-    django = ps: ps.django_4;
-    dependencies = ps: [
-      ps.django-autoslug
-      ps.loadcredential
-      ps.django-cas-ng
-      ps.django-cleanup
-      ps.django-haystack
-      ps.django-markdownx
-      ps.django-tables2
-      ps.pillow
-      ps.psycopg2
-      ps.whoosh
-
-      # Django haystack is drunk
-      ps.setuptools
-    ];
-
-    staticDirectory = "source/public/static";
-    mediaDirectory = "source/public/media";
-
-    credentials = {
-      SECRET_KEY = config.age.secrets."dj_gestiojeux-secret_key_file".path;
-    };
-
-    environment = {
-      GESTIOJEUX_ALLOWED_HOSTS = [ "gestiojeux.webapps.dgnum.eu" ];
-      GESTIOJEUX_EMAIL_HOST_USER = "web-services@infra.dgnum.eu";
-      GESTIOJEUX_DEFAULT_FROM_EMAIL = "Kadenios <web-services@infra.dgnum.eu>";
-      GESTIOJEUX_SERVER_EMAIL = "webapps@infra.dgnum.eu";
-      GESTIOJEUX_DB_NAME = "dj-gestiojeux";
-      GESTIOJEUX_DB_USER = "dj-gestiojeux";
-    };
-  };
-}
--- a/machines/web03/django-apps/interludes.nix
+++ b/machines/web03/django-apps/interludes.nix
@ -1,66 +0,0 @@
-{
-  config,
-  pkgs,
-  sources,
-  ...
-}:
-
-let
-  nix-pkgs = import sources.nix-pkgs { inherit pkgs; };
-in
-
-{
-  services.webhook.extraArgs = [ "-debug" ];
-  services.django-apps.sites.interludes = {
-    source = "https://git.eleves.ens.fr/dlesbre/site-interludes";
-    branch = "master";
-    domain = "interludes.ens.fr";
-
-    nginx = {
-      enableACME = true;
-      forceSSL = true;
-
-      serverAliases = [ "interludes.webapps.dgnum.eu" ];
-    };
-
-    webHookSecret = config.age.secrets."webhook-interludes_token".path;
-
-    application = {
-      type = "wsgi";
-      module = "interludes";
-    };
-
-    dbType = "sqlite";
-
-    python = pkgs.python3.override {
-      packageOverrides = _: _: { inherit (nix-pkgs) python-cas loadcredential; };
-    };
-
-    django = ps: ps.django_4;
-    dependencies = ps: [
-      ps.loadcredential
-      ps.python-ldap
-      ps.python-cas
-    ];
-
-    credentials = {
-      SECRET_KEY = config.age.secrets."dj_interludes-secret_key_file".path;
-      EMAIL_HOST_PASSWORD = config.age.secrets."dj_interludes-email_host_password_file".path;
-    };
-
-    environment = {
-      INTERLUDES_ALLOWED_HOSTS = [
-        "interludes.ens.fr"
-        "interludes.webapps.dgnum.eu"
-      ];
-
-      # E-mail configuration
-      INTERLUDES_SERVER_EMAIL = "noreply-interludes-admin@ens.fr";
-      INTERLUDES_DEFAULT_FROM_EMAIL = "noreply-interludes@ens.fr";
-      INTERLUDES_EMAIL_HOST = "clipper.ens.fr";
-      INTERLUDES_EMAIL_PORT = 465;
-      INTERLUDES_EMAIL_HOST_USER = "interludes";
-      INTERLUDES_DEBUG = false;
-    };
-  };
-}
--- a/machines/web03/django-apps/wikiens.nix
+++ b/machines/web03/django-apps/wikiens.nix
@ -1,55 +0,0 @@
-{
-  pkgs,
-  sources,
-  config,
-  ...
-}:
-
-let
-  nix-pkgs = import sources.nix-pkgs { inherit pkgs; };
-in
-
-{
-  services.django-apps.sites.wikiens = {
-    source = "https://git.dgnum.eu/DGNum/wiki-eleves";
-    branch = "main";
-    domain = "wiki.eleves.ens.fr";
-
-    nginx = {
-      enableACME = true;
-      forceSSL = true;
-    };
-
-    webHookSecret = config.age.secrets."webhook-wikiens_token".path;
-
-    python = pkgs.python3.override {
-      packageOverrides = _: _: {
-        inherit (nix-pkgs)
-          django-allauth
-          django-allauth-ens
-          django-wiki
-          loadcredential
-          ;
-      };
-    };
-
-    dependencies =
-      ps:
-      [
-        ps.django
-        ps.django-allauth-ens
-        ps.django-wiki
-        ps.loadcredential
-        ps.tinycss2
-      ]
-      ++ ps.django-allauth.optional-dependencies.socialaccount;
-
-    credentials = {
-      SECRET_KEY = config.age.secrets."dj_wikiens-secret_key_file".path;
-    };
-
-    environment = {
-      WIKIENS_ALLOWED_HOSTS = [ "wiki.eleves.ens.fr" ];
-    };
-  };
-}
--- a/machines/web03/secrets/dj_annuaire-secret_key_file
+++ b/machines/web03/secrets/dj_annuaire-secret_key_file
--- a/machines/web03/secrets/dj_bocal-secret_key_file
+++ b/machines/web03/secrets/dj_bocal-secret_key_file
@ -1,30 +0,0 @@
-age-encryption.org/v1
-> ssh-ed25519 jIXfPA HF+w4Kuk7Wo2s94SeNxAB3zFZhKNn1fPabJhUK/xGH0
-KY5tknNrICYq0HTfNRX760OPyWPJ8B4Sasq8BjN9a6k
-> ssh-ed25519 QlRB9Q OGcCe/S1aIQckJGzt4Wz+DFebTZpNV+YCevnVOPDMXQ
-keDckjD4Vjhj3gmQnW0V8nJ1Soubkhb9WP28fsanhMA
-> ssh-ed25519 r+nK/Q lO6xwuhfQ6gMlJzFBF5J9c2elEg1J3leAt5x1uTYGSk
-HQG0VQXvn72CIOqe6FRGrSX8TIa7sBB3cOZZQzXBl8w
-> ssh-rsa krWCLQ
-pvF18GVS3dHr2jiss4sn00UqVVM2f/6BmkpYMgAVQ3FNpgnimQGsgCssuBo3Hjrc
-BTO4v2U6cQ28LTUsruWdPhRChT0zfGRtx1QIn0tPzy3XKUxjt2XkBeblxtLhCHmI
-muQ0yA15bP+aQfZn0dE1Eb4krw1unKWE4f82L/BQ5Y/i1P2rubhyBhBoQRb6atHv
-S2EWBafaNr3orbFl9FPMjhWW3WZX/zKJxlu0saN88I6ZU2967mdR4PogMpL9iqST
-atraraA1jG6mR9Ojloyrf8FG6wTlplDlZk8Sgtg88FD1iHMN1q0DQv1LwRoD3QUa
-ywIn9MABMufNXQ+jm/DQpw
-> ssh-ed25519 /vwQcQ 83MxgOJhIBBGU6IRcTQPtxtyR4MapAxhdKT634w/em4
-scNxodN5j1HXOIPCB3glvc08Gb4wW9gmZ5gkWMCbm4E
-> ssh-ed25519 0R97PA LBFUS7zx26+rjiWqVwQ4UBqRxr+3Sx+j+GGrRaBbz08
-fnFwvJz36SiKnEoJr+0+enNVcT7wduZUrYe7bWhyxfE
-> ssh-ed25519 JGx7Ng iXjAn4Y7+yHASx4ZbIrvFffLzgX52DbQy9hIcTScHAs
-6AJZoV33mBryiCaquKTAkw8yB1NQs38QlG2p4LIcoMc
-> ssh-ed25519 bUjjig 0cqMXUVHqhyYhygR7meIyWRr/c7H8ZGB5eO7tTHhRUk
-GYKKGB02ElJXpObmBJKF4Bvoswd3o83vvVYIHIpDprg
-> ssh-ed25519 VQSaNw xHhzKnYeKxrN2MJz84v7Mjg3Nh69UJ6Q/eAyVAvC3V0
-/bvauGesQw9/tl4DhCNFY9Rq+qWv12O4TcqzdxTCWzk
-> T:){{-grease NuQ <}vLGT%
-0JSFYPMWs6LXpWacfiHNdwqvs/eHecFwj6cg0eLZEQe96shxy8/WSUBMpgasKufB
-Nc4tpfiOVWVRGm4arhunwJ+1sgg37X35PWde89Qpg5g
--- Y6N6GuCpRLdD25EWW+05qbUAadrT3z2Pzc5golCBHJw
-ßNê¯3'8ú³€@/¨0,zWêS¦‘ï;ßñì)§e<C2A7>ßÉïèÞí
-qMj’ÏŒrçHB–ÇR2šš–E2H+d%¶Ò–®
--- a/machines/web03/secrets/dj_gestiojeux-secret_key_file
+++ b/machines/web03/secrets/dj_gestiojeux-secret_key_file
@ -1,30 +0,0 @@
-age-encryption.org/v1
-> ssh-ed25519 jIXfPA tuq63SvMOBnLOZNkIA5RenFt0DTg6bwCX4zJ8ISYRxc
-B1K+kEO/JC0t2EL+2od+UiVNlzBbpRg29lsp2L1DhHw
-> ssh-ed25519 QlRB9Q r3M3DQi3xJiP+3nTpwm+2PQipnAaRyaWSH+mb0es6kE
-codqvk7AgptYBRyz2BFVH0FcQ7ebZGGdJ6PJmoWWXTk
-> ssh-ed25519 r+nK/Q Ah4Oim/N0Tdkz1KPbQiHJQaqx614/jjlMqCxtYqjBy0
-aTrlmm3TbWN6pyDEHf9uGy9H9CyyChXGKL0RZr7U3W4
-> ssh-rsa krWCLQ
-ZbbBqvj7L2XFfJBCQrn799m7FQDrFDg96Moev+Uab/U5caQoJIljMldkfD7VphEt
-56dyeJ7IdKdnwyt07213ua2gZ8Cmjyffi4b0mYhHkvRI5aSmfUtfiomXU0HkgZvK
-rk4+AVQYXTLZKlGaq5KkTt4i0ltwzjA9ECNirciqi5JmORkUD1T41xBKCSb+7N5b
-34Z/uka+oacxt7q27GnSonyFQIm7/owS4bTWV7vxoWLoOYTJcg4Oki/Op4gE9GkK
-1y4RDpdVsHcRZbi7ewB9UKbvMzH44TN5VJARUf0mFQ/OHUo5IJcm/glS898fSLu/
-mrjVT6XGAmPELB8uaVhSkg
-> ssh-ed25519 /vwQcQ 2mD6dstuZmOkYlBajNevQkeCYAGWshp0h0F1TzdcJSY
-pzjxW+RZDSqPAHm+c5cMJZOdIfkwTmSLw2BktGh/kHk
-> ssh-ed25519 0R97PA /vOiTSDwQVYTX+tFuJD0M8Enk+4b0ViZUnrZ/WhUKiI
-83r35uyZ/XELwTXZXzlU1yq+xzsNTUYNwK9aGGlOSAA
-> ssh-ed25519 JGx7Ng V6Xnn5q1hSvWHjiWtWJAD7as5N2fdtWNKWi3JwhfYgQ
-aL3fX67spVrgguVtNNrfJ20fy3LRaDgMZldw5D1fKuE
-> ssh-ed25519 bUjjig RdTpxQYpmEtG2Cn1EACf85/ZynfPbZhGfoSF+sfw1AA
-YovrKYRtwRPco3luRBVA0IA1qAq1jKxoS1UdoouhLGE
-> ssh-ed25519 VQSaNw F4hYo2UaLzV8leVHx/oY9aIcZkZ9Fap5HiuTvZy+Hko
-Qwf9JDKqLXmIzId7gAtG5ERirfwZlQWCV6YiKgbexS4
-> v>[->`-grease O {|u& 2o9 {w&!Ev
-jZPBNd6e20KQYli80kXK9D+qfmIVbOw9Y0aKXB3uvyNJPWDOoYTbzanjeXLuJdN+
-pB/fgMX7znIg+VP87n2qMR5jFVj/x4g4vNgKTUtglw
--- j4kt4DFy3r3y6IMvNakNkmlkeb6iHYI5xAK8CZtbPD4
-EWS¦|p^/<2F> Ž?„<7F>Np%‚åeFU/>Ží¸0bccývr(ˆ‰Œº
-“.èýVŸdgðáAÇ±3"® ‡Ù(½\5Ó§q<
--- a/machines/web03/secrets/dj_interludes-email_host_password_file
+++ b/machines/web03/secrets/dj_interludes-email_host_password_file
@ -1,29 +0,0 @@
-age-encryption.org/v1
-> ssh-ed25519 jIXfPA iJSzsbA8RiEhUIyhlKWCASQKoSQstjK4drMYl+PsChw
-8THrknrBu0WGFEb4xTZiJxEY26q7sW83rwViDjyTE24
-> ssh-ed25519 QlRB9Q e7PRE212Ggt8nO6Bb+BabO85FOARsJGs9cPJmZNI9kg
-ubKIBxI1ZBXttA7TWj401siKNT1HyB+N2MsZ+ldkgb8
-> ssh-ed25519 r+nK/Q EWV24Emm9hENa+yUAuQpkuJ0uJ0zIv+vRIbWpM4Wtg4
-J59wnHRytgNqpX4+5HaJ9KZ5GvhckgtRK6TzfX7Ci8Y
-> ssh-rsa krWCLQ
-AvmrzShR+XTpUpKaScoqvgFQ40PTSqh8p383p98xjG5LIz5kqJoWBnxJK7JabBpq
-JkqVeq5XdH5RX4weobieG4KYUV8EDheLfOMXH5BrPgeJO4yhJ1rzH+oHBw4TwvFM
-UvEZEAVgi3G1/suPfJAkO7QRkZjE7fRppEo5RAI0gMlM43YyJavrfqVIqB40Uugk
-h0b0ybChUbKpXlZjqhYAAMN45jTAvW1emO0DMeIk6dbmnbZNdibul8f+NNdWKbI1
-9NN5iH2IzuqTdc6gkE4912hdDeUJ4NZ6x/Fxp1/u3d1z/Yg7daUQUXUIoDX0Hyvb
-+01dH0D/7kzRhEdNLO2NXA
-> ssh-ed25519 /vwQcQ GAsAj2i65KDQeFhe69YR2ycdGskop1wu3Lzrxp59sTg
-wCSUqEtWv0i6sNg1RVtHI/jZh3VeNX3qtnbagXoNGT4
-> ssh-ed25519 0R97PA mFZ3q/3jd1guXl8bhRWyYjgsgE4JErJEels6vdmpfCs
-7oIAT0MTsaKxbf26PSDBk7KqfyFgcBq09FGJ9v/rXqE
-> ssh-ed25519 JGx7Ng tpslfMWMJMUH46EGycbLiXotVdXlP4xmK0slb7XKYS8
-wLLfX4jX4mIxzI8zr2GBlpBcPztTrHqKngi/ON0TExg
-> ssh-ed25519 bUjjig zLoniLfwKGH9Ctu34103WHBvjIyImtPyKx8O+5UMLUU
-sYsterVGvCg6JWA0z3AO5sSlj9DBfj8u5o5jH9K2xeA
-> ssh-ed25519 VQSaNw oHzU9Lc/7p+MZAjVylzC63h586vOcffXkkpAi4XB8Q0
-7T8CREpaCxM58KMYW28FY2i+ELjrx3eC3K7xaBy7O6A
-> (_o61>U-grease .P>ZRrj~ -=7S;N
-6vnQVKKZwp4JowIwVb4klrhaR6NZjwlZYnngVQ0wqVenMZPj9oyhIXthLRqE1Q6/
-k+sGxA
--- +yT0o8oZJS+32MeUAl8T9zREh31rq77pSVsSoFjHO5A
-è™ñÎ—´ä!î^ûØÖ8Ô‚zøÑaÒÓÐàÔ@Ö¡s\ ˜_ÃÃúoÖö<C396>wõÖ¥Cr)¾€fû¿AÃ'•3D€â
--- a/machines/web03/secrets/dj_interludes-secret_key_file
+++ b/machines/web03/secrets/dj_interludes-secret_key_file
@ -1,29 +0,0 @@
-age-encryption.org/v1
-> ssh-ed25519 jIXfPA 7v2qJ+2ZSp0tf4m6gcK2ShFF9ulNm/g3aHu3Wqe4Sxo
-ZyVqTqBCK51/U5yxtp23nywprQv46yL90zwx6+DqKRg
-> ssh-ed25519 QlRB9Q IePmluoRImtaDplOoVqNiwfTQMKF1CuF4M6AzurXGRY
-JjtOeyvARlc9t5Q+LS2+TZwAUgV4Qn2L8SFkw9YLnaU
-> ssh-ed25519 r+nK/Q LGPI7PmVPnZDQe6Su5MZQauxRHZkBKehyNbMq+BKlGQ
-3RvcfLAFKaScusYKf47zFNAtnot7wySvytuD81s6TwM
-> ssh-rsa krWCLQ
-xGH7rl+r8L5HEp6JUlAm04ktn9rQsWfBBlSRp7UsOi6ojwCfjjIA91yUrYw8TYRs
-Ci60uoLS7cuMtSE/jQVU/FuVtR5kwjhOkWmQDHrC7rUWb6CufusxPIVJ0xanp3wo
-cc2t+EfSdpVyGIx5N8BEMhQ6sR2EfERHGfUrnKCpcL5hM5L8ZHnVh6CkRBtvZaq0
-Zy44Ob4pqH6fDz7EziM1hBkfg9myN+/Iqfvg5OUnfSrqooLZ8l0gDvGafS5fok91
-uqb0PGDiv6lwzpaj87jKUCaXAF3ag2KAa6j8sbZ4+fSsQeB/jhH7hTlWcAR/oEFW
-fuPQDFKxMucAsPjv1H1iaQ
-> ssh-ed25519 /vwQcQ +5+xDNQyRwBWXT6c593S01OG9IemNul/81G4ie1hTVg
-Tzkq0toOCqdHOZNPiy/rUrO2eQXTDHi7g+jKbrWU/hU
-> ssh-ed25519 0R97PA WEMs0phnuvw1kQaqeSkovwFUL6w7J6wh+V7D82NxfDs
-V5npmkeTPVcnaNwDtoy7PqBRllPTuQjvF9Qu14V59os
-> ssh-ed25519 JGx7Ng 3bty0WCf+ElvPEFt7fSpgYf5MeFUPaZ4vVGWPUAjn0I
-ggl5CgXaUx4T6qbA9EG1oaF9NbfFYye4davm7lKqUvI
-> ssh-ed25519 bUjjig zFlaOVzFEkPG+J3Yz7alPgSiCVbC/7u/hCTVIP8X/Ho
-3PBIRu9ZKfb9lkzijw6kKjX0ztXBkiwVaQUx8rxuYJc
-> ssh-ed25519 VQSaNw btusrepFF5Jhl3x2YWs6wVrHwzb6qBXfDXESclQJAXo
-HwfOU3tyP9OsNjTkaMMmJnd4b+0ZfxJLkP6xe5jsAZE
-> Tp-grease s03Py `u6"4 E|5 _
-3CvcQ6NEZKLY1F6y0cTMQPwV9mJvHB0T7dauvWJAYKkfb95TymqfDYGWwW1veND2
-n1XD/arAJHVwva95K7TaQdsNLPGo8/VePQGUnYqi
--- qe75UTWqdDd0gGg0nm054SFZ2AgqVBw/bbycvcZSfQY
-ãñêÕ]¹¦zÂg©;Ê¡îñ˜öÓ´0éÅYëÀHãŒ!@ìpö¸T«?£iÞ‰áèÚ>I^ü‚l·o5”¯ë:{¬gJk£vø>€W8ði
--- a/machines/web03/secrets/dj_wikiens-secret_key_file
+++ b/machines/web03/secrets/dj_wikiens-secret_key_file
--- a/machines/web03/secrets/secrets.nix
+++ b/machines/web03/secrets/secrets.nix
@ -1,14 +0,0 @@
-(import ../../../keys).mkSecrets [ "web03" ] [
-  # List of secrets for web03
-  "dj_annuaire-secret_key_file"
-  "dj_bocal-secret_key_file"
-  "dj_gestiojeux-secret_key_file"
-  "dj_interludes-email_host_password_file"
-  "dj_interludes-secret_key_file"
-  "dj_wikiens-secret_key_file"
-  "webhook-annuaire_token"
-  "webhook-bocal_token"
-  "webhook-gestiojeux_token"
-  "webhook-interludes_token"
-  "webhook-wikiens_token"
-]
--- a/machines/web03/secrets/webhook-annuaire_token
+++ b/machines/web03/secrets/webhook-annuaire_token
@ -1,29 +0,0 @@
-age-encryption.org/v1
-> ssh-ed25519 jIXfPA NovhLzllQnEbnI7bno+zDoSRFJyZMfVVYPQMReUIymw
-sefGtZ8fbYVqtKgMhrEj9AlwP70YM5MGkQ+o8Dmfb/Q
-> ssh-ed25519 QlRB9Q 9mh3vQVo5tPorLYBVCcZUJOlcEftQKA94PxNhh+pDwg
-GXM67qitYqnxbFoHbsfa1lNNLIahPqshosIY7h0fDBA
-> ssh-ed25519 r+nK/Q BOXck7k9AH+KvmoicI/fmGzWcna0nwnJ+uyteUjIukE
-Hyts1/6EAdruuBilhifl/HwPTWEBe+Kr1RL6SDjHaaM
-> ssh-rsa krWCLQ
-1ROqUHCkbkEgRTQUha0cVJVAqLu0nvfKik9yI392sbEQYgmpuf7F0gzA97BXcoi3
-2BdZWu/cJ6m6bfMvXdZ04cUjRcNrnpPHsoqie3G9s9p6aa9XIrLO5K6kH7S6f5DZ
-pZdOqfSYldtJKRx7F8k0D/pscN5qB1Tb1x0CIULJVo7uKf9X1MnZwapOOCY2q40U
-Ip2aefr40h3EO7jBlswx2/fB8aqW95BR4JQzJZ/uiIsBUQDqvn39GU7R0JaLdAPB
-6kJXaJ3ORaDDtslcaAVZWLqFbOlINXYHr/mqYNTZMubE4BmNjvJL3aRozQQWraoJ
-q5rDvgwUXVhpGpcaNf4/xw
-> ssh-ed25519 /vwQcQ FHYnfCad1imFiV5tRIfe9mtJ2ouiu2l19th2UD7j3gw
-Xu+Sk9GEQ9Wyf7iU790yxv80vLYHp2StArPkfRqfRhI
-> ssh-ed25519 0R97PA etwCsiGmvzufJGMw8aDN+M931lPlE9fTUBQmk0X4DFk
-o6xJbfNjQ3Lko1MSJ9JBu6FefZ8267dZ+vL1Gpd1eH8
-> ssh-ed25519 JGx7Ng h0XzejD/c5F2M7sWS4vTQL9OoRG73ACwlWCtK51Dcyo
-diMDy201IpwL6Ec+Zb4pH5f1yyMOMHT3jg6yriopCRU
-> ssh-ed25519 bUjjig 2Oh5FhWfrbA9c5TisXuxasyYF41YOlNdurZR9QowETA
-706/MLiPT9+9xHZPZQYtvKm8zbN5qS/9XJ+TK15etIs
-> ssh-ed25519 VQSaNw YbtnCoySon7jNBq7IFOl8UfxuJXRjzLrgXp238q4RRE
-10au0QwFP9ntPMU4u2bMl3KLYBIPy09xVoKNLxWvpw0
-> Vu-grease !oqb p1-QmV
-i1WmaOmxmdAX/se60fnUL41n57c8tN1gnUjjBjSV7GkQGzhKnxTplJTUpifP9Js3
-8D+xe86sN2l2JQ5R9QFOAbsvSa5eXSo
--- JE+yvBRH9Jz6Sdz46AzWuhVI0kXWObODKSiNWz5L9As
-_n´(I	6ÔÃPèCa\³U¼=é@ “†?6—P[Tò³ñˆjk<6A>0ãrÒ…°“ƒ¼-É(]/³a¿É
õ8¶=é¤i²<69>
--- a/machines/web03/secrets/webhook-bocal_token
+++ b/machines/web03/secrets/webhook-bocal_token
@ -1,29 +0,0 @@
-age-encryption.org/v1
-> ssh-ed25519 jIXfPA Ju7YL9wvvYr9VPLmYtYTniyuj9JTVqe2V8eRLISkIH8
-EJjZPLOhspyyrx7a+fYlPPH+1pr93KzW7E2Ztkic0cY
-> ssh-ed25519 QlRB9Q X+TAfiEk1d67rkz6CgIO66bBrahY39ZTnmj0cBGGrSo
-kBLFu6DnN7rIzP3mSlPEc+yBN+yU5toLeA069vuNW6g
-> ssh-ed25519 r+nK/Q wcXXCuAS9bOp3GM6c0pU7sxpylFEHFPmnibQTEwJ1x4
-fR41b7fhZCzuNP1jst3vx3wUjIkBDsz54VzubwNX6+M
-> ssh-rsa krWCLQ
-ySG+OgB3gMW/ijdWqlGr1LnkfqeFD53ChxkOUfAe4+Z1VsK0FkVaBmqvW38SFMw9
-S4dcOkO6Km8umsaZBZi2QaItm+p8Rf/j7+W2WZPoyoKE1l1KW1ic/wGOY7uqeucn
-YZRq7rWX+DaH2VLbkl12wUlVgYwJGcH6VrpRizbq2z0jcdTak6hgzcXo7WhcNAit
-DY8W8X5Zv34mpj1VO7n2LJs5V7gzfSLq+KVMIi++QphVv2VkFpvaOqlEP2neVXnV
-C3YNJTkVx+R6wANCao+9a5VHC261Bkm81dKgzceW2OCHkwOP6XTbDpj59sMRxRuU
-B7jrvre5S1WZN9jc16Dv/Q
-> ssh-ed25519 /vwQcQ TW560PIrbJV3ZB55w+EvH2PEYOoYM93x3aaeeShYKE8
-LC6pydBK3yCq/Vs7MUoa0xjDSn3WjRaZuqwvhX24YJQ
-> ssh-ed25519 0R97PA zyerO6EIwW90XVSBVP3Y/7Q8hK+7uPe6kKENGCdDJRw
-WEpgo8Y64YXnat1OJU5qtpecf+Zu2P2LmB7DEtmUuAU
-> ssh-ed25519 JGx7Ng 7h4q8ztQ0BFJSfavV4l1pKjbNRZveOPIJG0KF98vh28
-mYcUEL4n2+bkjpvJylIvzXSxoa71YZKMSgN21ONnvko
-> ssh-ed25519 bUjjig 9wKWtLWD+9LlAOO24iQiOdvpSDIWpL6Xo0Wt3QOLIQY
-Kq2QLFB7E5tiqZQlsn5pZRM52v8XqUyYsvwNHXZspRs
-> ssh-ed25519 VQSaNw 3tJNtvi0WK9iAzx3Q7Q0Ogj1TGH0Zrm5v0ERhQILBVk
-4232/j+xnbhQpId7ZS6+xAQBDxtumeOp4c1HVeMRqB4
-> Pug13&(-grease 'w0JG}JF .t`9lMF v)8}4qW
-yRriwE//abKvQgu962F7URbOAiHDFMipnsq22itGkLDvmwIRY6Bi83xOzx72EV4y
-27GNdxQOni+z8NPt0YTskqq4fHfZky/EMFUvXTfteB7izYxEliHLRKA
--- JNvexaDwzwOIUCxanJRLunfhBh1/PE8ssFCytr8nPjo
-TX¹Þ‚xòšd˜~KS?ìIò…Ceþ—3ÑJõ	¹ŸýCíÓF6qœv~Dùq¢T<>©55€bjˆf›Õ5”ñëã"ø£ÅŽp
--- a/machines/web03/secrets/webhook-gestiojeux_token
+++ b/machines/web03/secrets/webhook-gestiojeux_token
@ -1,29 +0,0 @@
-age-encryption.org/v1
-> ssh-ed25519 jIXfPA dBBF9o4SBTHNv495PFZa6dszbs9nEARwg0EfOlfFwhc
-GkqX8sjLqFHGm4UA+zyVRB7FGGgAxilFYHarEQB0YAk
-> ssh-ed25519 QlRB9Q DEu91DA+qho3Zs3gSQbWH/hOKUfgP5Qd90+9ZzYs1So
-aIw1ygo/e0tpqW2N27Fl8WRe362ronzqy52vSzD35Tc
-> ssh-ed25519 r+nK/Q JUurf12UYuJKvKusUh/GOJryFbA8lWaS8v+/pRb0kys
-VsgsBSwjBXTD+tmP3jxCPVeDY7AHVFx5o57y+ubEjts
-> ssh-rsa krWCLQ
-o08ZnFZIj37p5hpWgl8FXwPwHKjoBD7Z0UxMRsF4CUF0sLOpwVHD4L57hAA8a80S
-063e48OJ5OsrtueqqJwPT+wjXfmEarLUqC+rP0X+JDW8OLwSImBcYC5DQJZLUFSK
-doF8S8Bo0MbuB4eKnXUAJlhdZOk/iqYK8TYuuSIwWQxHwF/fT43hrYIkj6lmqdmG
-IqSXA04KpQFoL15INIAtsnj5xXJlI0gCPp0pxMNUmVyTTrNLfaEiKH191D+Elmjd
-xcdvMX1yzIPI/mI/+/OjeYspijY0XpRHLJ9ljfEK7E2N8IgpyzBx2BzxYhRHoQmi
-6SbZu9Tirw+yv5wv8oIaHA
-> ssh-ed25519 /vwQcQ M6QID8DMaFMnF97UWwbSYJ7Sh0wvj/fq7cszu82/oHI
-T+aT4NCbVfGXnvPK7w8fbojAwDTE41h40q0tDwnGyhE
-> ssh-ed25519 0R97PA XyZvyy80nv2tGe1fBzM0LeiIAGuyV22CzBoCPFMMrw8
-9VPiRV3GCWbH1So5LBrjBeRzEtErPM7BwOF/zaD/yGk
-> ssh-ed25519 JGx7Ng OPlQBKO+Wub+PPMNPoRGWTeSZfGF3kYCD8HLbLbPR0k
-ZhBUT5ig0FnLCau+da9bfEkVjFxfZXG0mXW1o0yZ+JQ
-> ssh-ed25519 bUjjig T5/dZtIRaXmNg8pajSAM76cVANM7MvQ7f32fz2fEqx0
-+6kRffMJX+8QAOf5jA5acGihgw4q8yJda0EzVGePD+I
-> ssh-ed25519 VQSaNw InflFPtAwYwQFWqd+KK+ILwMa0XTNkVB+xEMtUXW8Us
-XZ6LVMCpvq+QBo0EHAlnC8uBhQssixTLVCpul6ov4Dk
-> YKmn+c&-grease EA5d$ ="1d }cP
-3u46NE2SdfO9ugNN/41PeU/65CRgmDiO54B9ZQLNRQtVyyLlcmvaYHCQach+s+Rs
-tE0Gc8MD23hPw5ZhWj0nq7xF8VHtRQSTLQ
--- UkbfAVgnLkeg6Zdb3bsdPtx9Wh6HOjdB+qmTvrAWFuE
-5_E¼ñ/e)±žÑÊC×7Ú›ÈY<C388>wPŽöTÃ¡št6>l_0:[èP»ÎH5·¼j—<6A>€PË¸â=vèFýÉIÄ4¹ÿÏDìª˜ýp£§
--- a/machines/web03/secrets/webhook-interludes_token
+++ b/machines/web03/secrets/webhook-interludes_token
--- a/machines/web03/secrets/webhook-wikiens_token
+++ b/machines/web03/secrets/webhook-wikiens_token
--- a/meta/dns.nix
+++ b/meta/dns.nix
@ -1,7 +1,7 @@
 { lib, dns, ... }:

 let
-  inherit (lib) mapAttrs' nameValuePair optional;
+  inherit (lib) mapAttrs' nameValuePair;
  inherit (lib.extra) fuseAttrs mapSingleFuse;

  inherit (dns.lib.combinators) mx spf ttl;
@ -80,12 +80,12 @@ let
        ];

        storage01.dual = [
+          "cachix" # Attic
          "tvix-store" # tvix store
          "git" # Forgejo
          "influx" # InfluxDB
          "netbird" # Netbird
          "prometheus" # Prometheus
-          "victoria-metrics" # Victoria Metrics
          "videos" # Peertube

          # Garage S3
@ -132,15 +132,8 @@ let
        ];

        web02.dual = [
-          "cas-eleves" # CAS server
-          "chat" # Mattermost
-          "vote" # Kadenios
-        ];
-
-        web03.dual = [
-          # Django Apps
-          "*.webapps"
-          "apps-webhook"
+          "cas-eleves"
+          "vote"
        ];
      }
    )
@ -217,19 +210,17 @@ in
        subdomains = mapAttrs' (
          host:
          { site, ... }:
-          let
-            net = meta.network.${host};
-            inherit (net.addresses) ipv4 ipv6;
-          in
-          nameValuePair "${host}.${site}" {
-            A = ipv4;
-            AAAA = ipv6;
-            subdomains = {
-              v4.A = ipv4;
-              v6.AAAA = ipv6;
-              private.A = optional (net.netbirdIp != null) net.netbirdIp;
-            };
-          }
+          nameValuePair "${host}.${site}" (
+            with meta.network.${host}.addresses;
+            {
+              A = ipv4;
+              AAAA = ipv6;
+              subdomains = {
+                v4.A = ipv4;
+                v6.AAAA = ipv6;
+              };
+            }
+          )
        ) meta.nodes;
      };
    };
--- a/meta/network.nix
+++ b/meta/network.nix
@ -29,6 +29,29 @@
    netbirdIp = "100.80.75.197";
  };

+  krz01 = {
+    interfaces = {
+      eno1 = {
+        ipv4 = [
+          {
+            address = "129.199.146.21";
+            prefixLength = 24;
+          }
+          {
+            address = "192.168.1.145";
+            prefixLength = 24;
+          }
+        ];
+
+        gateways = [ "129.199.146.254" ];
+        enableDefaultDNS = true;
+      };
+    };
+
+    hostId = "bd11e8fc";
+    netbirdIp = "100.80.103.206";
+  };
+
  geo01 = {
    interfaces = {
      eno1 = {
@ -155,25 +178,6 @@
    netbirdIp = null; # web02 is not to be connected on the VPN
  };

-  web03 = {
-    interfaces = {
-      enp1s0 = {
-        ipv4 = [
-          {
-            address = "129.199.129.223";
-            prefixLength = 24;
-          }
-        ];
-
-        gateways = [ "129.199.129.1" ];
-        enableDefaultDNS = true;
-      };
-    };
-
-    hostId = "8afc7749";
-    netbirdIp = "100.80.157.46";
-  };
-
  rescue01 = {
    interfaces = {
      ens18 = {
--- a/meta/nodes.nix
+++ b/meta/nodes.nix
@ -37,6 +37,19 @@
    };
  };

+  web01 = {
+    site = "rat01";
+
+    deployment.tags = [ "web" ];
+
+    hashedPassword = "$y$j9T$9YqXO93VJE/GP3z8Sh4h51$hrBsEPL2O1eP/wBZTrNT8XV906V4JKbQ0g04IWBcyd2";
+
+    stateVersion = "23.05";
+    vm-cluster = "Hyperviseur NPS";
+
+    nixpkgs = "24.05";
+  };
+
  compute01 = {
    site = "pav01";

@ -67,15 +80,15 @@
    nixpkgs = "24.05";
  };

-  rescue01 = {
-    site = "luj01";
+  krz01 = {
+    site = "pav01";

-    deployment.targetHost = "v6.rescue01.luj01.infra.dgnum.eu";
+    hashedPassword = "$y$j9T$eNZQgDN.J5y7KTG2hXgat1$J1i5tjx5dnSZu.C9B7swXi5zMFIkUnmRrnmyLHFAt8/";

-    hashedPassword = "$y$j9T$nqoMMu/axrD0m8AlUFdbs.$UFVmIdPAOHBe2jJv5HJJTcDgINC7LTnSGRQNs9zS1mC";
+    stateVersion = "24.05";
+    nixpkgs = "unstable";

-    stateVersion = "23.11";
-    vm-cluster = "Hyperviseur Luj";
+    adminGroups = [ "lab" ];
  };

  storage01 = {
@ -86,10 +99,7 @@
    stateVersion = "23.11";
    nixpkgs = "24.05";

-    nix-modules = [
-      "services/forgejo-nix-runners"
-      "services/netbird/server.nix"
-    ];
+    nix-modules = [ "services/forgejo-nix-runners" ];
  };

  vault01 = {
@ -104,19 +114,6 @@
    adminGroups = [ "fai" ];
  };

-  web01 = {
-    site = "rat01";
-
-    deployment.tags = [ "web" ];
-
-    hashedPassword = "$y$j9T$9YqXO93VJE/GP3z8Sh4h51$hrBsEPL2O1eP/wBZTrNT8XV906V4JKbQ0g04IWBcyd2";
-
-    stateVersion = "23.05";
-    vm-cluster = "Hyperviseur NPS";
-
-    nixpkgs = "24.05";
-  };
-
  web02 = {
    site = "rat01";

@ -127,15 +124,14 @@
    vm-cluster = "Hyperviseur NPS";
  };

-  web03 = {
-    site = "rat01";
+  rescue01 = {
+    site = "luj01";

-    hashedPassword = "$y$j9T$Un/tcX5SPKNXG.sy/BcTa.$kyNHELjb1GAOWnauJfcjyVi5tacWcuEBKflZDCUC6x4";
+    deployment.targetHost = "v6.rescue01.luj01.infra.dgnum.eu";

-    nix-modules = [ "services/django-apps" ];
+    hashedPassword = "$y$j9T$nqoMMu/axrD0m8AlUFdbs.$UFVmIdPAOHBe2jJv5HJJTcDgINC7LTnSGRQNs9zS1mC";

-    stateVersion = "24.05";
-    nixpkgs = "unstable";
-    vm-cluster = "Hyperviseur NPS";
+    stateVersion = "23.11";
+    vm-cluster = "Hyperviseur Luj";
  };
 }
--- a/meta/options.nix
+++ b/meta/options.nix
@ -41,37 +41,23 @@ in
  options = {
    organization = {
      members = mkOption {
-        type = attrsOf (
-          submodule (
-            { name, ... }:
-            {
-              options = {
-                name = mkOption {
-                  type = str;
-                  description = ''
-                    Name of the member.
-                  '';
-                };
+        type = attrsOf (submodule {
+          options = {
+            name = mkOption {
+              type = str;
+              description = ''
+                Name of the member.
+              '';
+            };

-                email = mkOption {
-                  type = str;
-                  description = ''
-                    Main e-mail address of the member.
-                  '';
-                };
-
-                username = mkOption {
-                  type = str;
-                  default = name;
-                  description = ''
-                    The username used for authentication.
-                    WARNING: Must be the same as the ens login!
-                  '';
-                };
-              };
-            }
-          )
-        );
+            email = mkOption {
+              type = str;
+              description = ''
+                Main e-mail address of the member.
+              '';
+            };
+          };
+        });

        description = ''
          Members of the DGNum organization.
--- a/meta/organization.nix
+++ b/meta/organization.nix
@ -5,21 +5,9 @@

 {
  members = {
-    agroudiev = {
-      name = "Antoine Groudiev";
-      email = "antoine.groudiev@dgnum.eu";
-    };
-
    catvayor = {
      name = "Lubin Bailly";
      email = "catvayor@dgnum.eu";
-      username = "lbailly";
-    };
-
-    cst1 = {
-      name = "Constantin Gierczak--Galle";
-      email = "cst1@dgnum.eu";
-      username = "cgierczakgalle";
    };

    ecoppens = {
@ -30,19 +18,11 @@
    jemagius = {
      name = "Jean-Marc Gailis";
      email = "jm@dgnum.eu";
-      username = "jgailis";
    };

    luj = {
      name = "Julien Malka";
      email = "luj@dgnum.eu";
-      username = "jmalka";
-    };
-
-    mboyer = {
-      name = "Matthieu Boyer";
-      email = "matthieu.boyer@dgnum.eu";
-      username = "mboyer02";
    };

    mdebray = {
@ -53,7 +33,6 @@
    raito = {
      name = "Ryan Lahfa";
      email = "ryan@dgnum.eu";
-      username = "rlahfa";
    };

    thubrecht = {
@ -68,6 +47,7 @@
      "thubrecht"
      "raito"
      "mdebray"
+      "luj"
    ];

    # members of this group are root on the fai infrastructure
@ -78,7 +58,6 @@

    lab = [
      "catvayor"
-      "cst1"
      "ecoppens"
    ];

--- a/modules/dgn-netbox-agent/01-batch-filter.patch
+++ b/modules/dgn-netbox-agent/01-batch-filter.patch
@ -0,0 +1,35 @@
+diff --git a/netbox_agent/network.py b/netbox_agent/network.py
+index 673dfc1..8ef60aa 100644
+--- a/netbox_agent/network.py
+++ b/netbox_agent/network.py
+@@ -1,7 +1,7 @@
+ import logging
+ import os
+ import re
+-from itertools import chain
+from itertools import chain, islice
+ 
+ import netifaces
+ from netaddr import IPAddress
+@@ -413,11 +413,17 @@ class Network(object):
+ 
+         # delete IP on netbox that are not known on this server
+         if len(nb_nics):
+-            netbox_ips = nb.ipam.ip_addresses.filter(
+-                **{self.intf_type: [x.id for x in nb_nics]}
+-            )
+
+            def batched(it, n):
+              while batch := tuple(islice(it, n)):
+                yield batch
+
+            netbox_ips = []
+            for ids in batched((x.id for x in nb_nics), 25):
+                netbox_ips += list(
+                    nb.ipam.ip_addresses.filter(**{self.intf_type: ids})
+                )
+ 
+-            netbox_ips = list(netbox_ips)
+             all_local_ips = list(chain.from_iterable([
+                 x['ip'] for x in self.nics if x['ip'] is not None
+             ]))
--- a/modules/dgn-netbox-agent/default.nix
+++ b/modules/dgn-netbox-agent/default.nix
@ -7,17 +7,23 @@
 let
  inherit (config.networking) hostName domain;
 in
-
 {
-  imports = [ ./module.nix ];

  options.dgn-netbox-agent = {
    enable = lib.mkEnableOption "DGNum netbox agent setup." // {
-      default = false;
+      default = true;
    };
  };

  config = lib.mkIf config.dgn-netbox-agent.enable {
+    nixpkgs.overlays = [
+      (_: super: {
+        netbox-agent = super.netbox-agent.overrideAttrs (old: {
+          patches = (old.patches or [ ]) ++ [ ./01-batch-filter.patch ];
+        });
+      })
+    ];
+
    services.netbox-agent = {
      enable = true;

@ -45,7 +51,6 @@ in
      randomizedDelaySec = "3h";
      environmentFile = config.age.secrets."netbox-agent".path;
    };
-
-    age-secrets.sources = [ ./secrets ];
+    age-secrets.sources = [ ./. ];
  };
 }
--- a/modules/dgn-netbox-agent/module.nix
+++ b/modules/dgn-netbox-agent/module.nix
@ -1,115 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  utils,
-  ...
-}:
-
-let
-  inherit (lib)
-    getExe
-    mkEnableOption
-    mkIf
-    mkOption
-    mkPackageOption
-    ;
-
-  inherit (lib.types)
-    either
-    listOf
-    nullOr
-    path
-    str
-    ;
-
-  settingsFormat = pkgs.formats.yaml { };
-
-  cfg = config.services.netbox-agent;
-in
-{
-  options.services.netbox-agent = {
-    enable = mkEnableOption "Netbox-agent";
-
-    package = (mkPackageOption pkgs "netbox-agent" { }) // {
-      default = pkgs.callPackage ./package.nix { };
-    };
-
-    startAt = mkOption {
-      type = either str (listOf str);
-      default = "*-*-* 00:00:00";
-      description = ''
-        Automatically start this unit at the given date/time, which
-        must be in the format described in
-        {manpage}`systemd.time(7)`.
-      '';
-    };
-
-    randomizedDelaySec = mkOption {
-      type = str;
-      default = "0";
-      example = "45min";
-      description = ''
-        Add a randomized delay before each netbox-agent runs.
-        The delay will be chosen between zero and this value.
-        This value must be a time span in the format specified by
-        {manpage}`systemd.time(7)`
-      '';
-    };
-
-    settings = mkOption {
-      inherit (settingsFormat) type;
-      description = ''
-        Settings to be passed to the netbox agent. Will be converted to a YAML
-        config file
-      '';
-      default = { };
-    };
-
-    environmentFile = mkOption {
-      type = nullOr path;
-      default = null;
-      description = ''
-        Environment file to pass to netbox-agent. See `netbox-agent --help` for
-        possible environment variables
-      '';
-    };
-  };
-
-  config = mkIf cfg.enable {
-    systemd.services.netbox-agent = {
-      description = "Netbox-agent service. It generates an existing infrastructure on Netbox and have the ability to update it regularly through this service.";
-      wants = [ "network-online.target" ];
-      after = [ "network-online.target" ];
-
-      serviceConfig = {
-        Type = "oneshot";
-        # We could link directly into pkgs.tzdata, but at least timedatectl seems
-        # to expect the symlink to point directly to a file in etc.
-        # Setting the "debian timezone file" to point at /dev/null stops it doing anything.
-        ExecStart = utils.escapeSystemdExecArgs [
-          (getExe cfg.package)
-          "-c"
-          (settingsFormat.generate "config.yaml" cfg.settings)
-        ];
-        EnvironmentFile = cfg.environmentFile;
-        LockPersonality = true;
-        MemoryDenyWriteExecute = true;
-        NoNewPrivileges = true;
-        PrivateTmp = true;
-        ProtectControlGroups = true;
-        ProtectHome = true;
-        ProtectKernelModules = true;
-        ProtectKernelTunables = true;
-        ProtectSystem = "strict";
-        RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6 AF_NETLINK";
-        RestrictNamespaces = true;
-        RestrictRealtime = true;
-        RestrictSUIDSGID = true;
-      };
-      inherit (cfg) startAt;
-    };
-
-    systemd.timers.netbox-agent.timerConfig.RandomizedDelaySec = cfg.randomizedDelaySec;
-  };
-}
--- a/Show more
+++ b/Show more
Author	SHA1	Message	Date
Ryan Lahfa	2ce8c125d4	feat(infra): showcase the declarative bucket feature All checks were successful Check meta / check_dns (pull_request) Successful in 20s Details Check meta / check_meta (pull_request) Successful in 20s Details lint / check (push) Successful in 28s Details lint / check (pull_request) Successful in 24s Details build configuration / build_and_cache_compute01 (pull_request) Successful in 1m30s Details build configuration / build_and_cache_geo01 (pull_request) Successful in 1m9s Details build configuration / build_and_cache_storage01 (pull_request) Successful in 1m17s Details build configuration / build_and_cache_rescue01 (pull_request) Successful in 1m15s Details build configuration / build_and_cache_krz01 (pull_request) Successful in 2m7s Details build configuration / build_and_cache_geo02 (pull_request) Successful in 1m8s Details build configuration / build_and_cache_vault01 (pull_request) Successful in 1m22s Details build configuration / build_and_cache_bridge01 (pull_request) Successful in 1m5s Details build configuration / build_and_cache_web02 (pull_request) Successful in 1m15s Details build configuration / build_and_cache_web01 (pull_request) Successful in 1m45s Details Signed-off-by: Ryan Lahfa <ryan@dgnum.eu>	2024-10-10 17:59:00 +02:00
Ryan Lahfa	3e6a3afd95	feat(infra): add S3 declarative buckets A very simple basic support for it, which requires a S3 admin token. Signed-off-by: Ryan Lahfa <ryan@dgnum.eu>	2024-10-10 17:59:00 +02:00
Ryan Lahfa	4d68bfda2a	feat(infra): introduce Terranix This requires the support for monorepo-terraform-state.s3.dgnum.eu being available. `.credentials/` is age-encrypted using only my key for now until we figure out the right mechanism. Signed-off-by: Ryan Lahfa <ryan@dgnum.eu>	2024-10-10 17:53:00 +02:00