authorizedKeys.nix

@@ -3,5 +3,4 @@
 [
   "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCy7X5ByG4/9y2XkQSnXcpMGnV5WPGUd+B6FaYCDNmPQ7xIZEteS+kCpu9oiMP6C/H/FT+i9DZvCflkzgdFAyujYLKRYaZbZ3K6F60qN0rkJ0z/ZO5c6rqwIwR6BEoB7dq5inkyH9fZ8/SI+PXxELmeWF9ehT7kkQC+o9Ujpcjd7ZuZllbAz4UQZFRbbpwdVJCEDenu9/63yuYbvMupgGk0edaTiFT0Q9MSzs/3pNP8xlAxmmZ3HzSjeF7gUzBF7CaIroTeguiUjSVybUEx48P8fy878t7dUZf4anEno9MS0B3aqfZvCKuuPdAUdeBfCbFHRqN7GuCylFIXGPe95Mxl grimmauld@grimmauld-nixos"
   "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQClLZhya2A7SoRSX2DNNM6OWgnGhtOFUor/WdyY59L0l6u5tEo9VyX5bCR84eo+uN4jyahSiGD1WC3RGIoNtHuSkKPxr0rqQhlbuyxraHGj7hOLhcGWRd2eIdsntbma7uPsn4zC0skKjpVNR7PU4LfSxti0gBhgq6uQhMtlfywwJshmwt55q7oT/zC449Uz2vyviy7sQ53R9YoOWEjB/+vU8jHxGlqLatXhOGKlBtrQxKm8PZ6jBYxAC6sGA4APIHWC3KC0S0X7wlmi42Dx9bbBm0rUjy095vRZ22fkE8x9OSTKDY/vFTLw5vwVMa8dACfA1Kc0+EpgOK77lZddeTvD grimmauld.de"
-  "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJhM1Fk5ix4OZAdlfCxL891KxeEKpyIFrP5yYkC9mg7E grimmauld@grimmauld-nixos"
 ]

configuration.nix

@@ -1,29 +1,16 @@
 { lib, config, inputs, pkgs, ... }:
 let
-  inherit (config.networking) domain;
+  root_host = "grimmauld.de";
+
+  # git add --intent-to-add email.txt ; git update-index --assume-unchanged email.txt
+  root_email = (builtins.elemAt (lib.strings.match "[[:space:]]*([^[:space:]]+)[[:space:]]*" (builtins.readFile ./email.txt)) 0);
+
 in {
   imports = [
     ./hardware-configuration.nix    
   ];
 
-  boot.kernelPackages = pkgs.linuxPackages_latest;
+  boot.kernelPackages = pkgs.linuxPackages_hardened;
-  services.logrotate.checkConfig = false; # needed or this explodes
-
-  time.timeZone = "Europe/Berlin";
-  # Select internationalisation properties.
-  i18n.defaultLocale = "en_US.UTF-8";
-
-  i18n.extraLocaleSettings = {
-    LC_ADDRESS = "de_DE.UTF-8";
-    LC_IDENTIFICATION = "de_DE.UTF-8";
-    LC_MEASUREMENT = "de_DE.UTF-8";
-    LC_MONETARY = "de_DE.UTF-8";
-    LC_NAME = "de_DE.UTF-8";
-    LC_NUMERIC = "de_DE.UTF-8";
-    LC_PAPER = "de_DE.UTF-8";
-    LC_TELEPHONE = "de_DE.UTF-8";
-    LC_TIME = "de_DE.UTF-8";
-  };
 
   users.users.grimmauld = {
     isNormalUser = true;
@@ -31,6 +18,7 @@ in {
     extraGroups = [ "wheel" "docker" ];
     shell = pkgs.xonsh;
     packages = with pkgs; [
+      hyfetch
     ];
     openssh.authorizedKeys.keys = (import ./authorizedKeys.nix);
   };
@@ -38,35 +26,39 @@ in {
   programs.xonsh.enable = true;
   environment.systemPackages = with pkgs; [
     wget
-    hyfetch
+    vulnix
-    vulnix #
     tree
+    git
     file
+    git-lfs
     util-linux
     btop
+    mkpasswd
     linuxPackages.perf
+    gitea
+    matrix-synapse-tools.synadm
+    matrix-synapse
+#    ffmpeg-full
+
+    pufferpanel
+    (writeShellScriptBin "pufferpanel-nix" "pufferpanel --workDir /var/lib/pufferpanel $@")
+    (writeShellScriptBin "nix-referrers" "nix-store --query --referrers $@")
   ];
 
   environment.sessionVariables = {
     NIXPKGS_ALLOW_UNFREE="1";
-    OMP_NUM_THREADS = "8";
+    OMP_NUM_THREADS = "4";
   };
 
   networking.firewall = {
     enable = true;
+    allowedTCPPorts = [ 80 443 ];
     allowPing = true;
     allowedUDPPortRanges = [];
   };
   
-
+#  services.nginx.package = pkgs.nginxStable.override { openssl = pkgs.libressl; };
-  networking.firewall.allowedTCPPorts = [ 80 443 ];
-  networking.hostName = "grimmauld-nixos-server";
-  networking.domain = "grimmauld.de";
-  services.openssh.enable = true;
-  system.stateVersion = "23.11";
-
   services.nginx = {
-    # package = pkgs.nginxStable.override { openssl = pkgs.libressl; };
     enable = true;
     recommendedGzipSettings = true;
     recommendedOptimisation = true;
@@ -74,21 +66,24 @@ in {
     recommendedTlsSettings = true;
     sslCiphers = "AES256+EECDH:AES256+EDH:!aNULL";
 
-    virtualHosts."${domain}" = {
+    virtualHosts."${root_host}" = {
       forceSSL = true;
-      enableACME = lib.mkForce false; # use the correct cert, not some weird one that matrix-synapse module supplies
+      enableACME = lib.mkForce false; # use the cert above, not some weird one that matrix-synapse module supplies
-      useACMEHost = domain;
+      useACMEHost = root_host;
       locations."/" = {
-          root = "/var/www/${domain}"; 
+          root = "/var/www/grimmauld.duckdns.org"; 
       };
     };
   };
 
   nix.settings.experimental-features = [ "nix-command" "flakes" ];
+  system.stateVersion = "unstable";
   nixpkgs.config.allowUnfree = true;
-  boot.tmp.cleanOnBoot = true;
-  
-  zramSwap.enable = true;
 
-  #  users.users.root.openssh.authorizedKeys.keys = (import ./authorizedKeys.nix);
+  boot.tmp.cleanOnBoot = true;
+  zramSwap.enable = true;
+  networking.hostName = "grimmauld-nixos-server";
+  networking.domain = "";
+  services.openssh.enable = true;
+#  users.users.root.openssh.authorizedKeys.keys = (import ./authorizedKeys.nix);
 }

flake.lock

@@ -8,11 +8,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1715101957,
+        "lastModified": 1703433843,
-        "narHash": "sha256-fs5uVQFTfgb4L9pnhldeyTHNcYwn1U4nKYoCBJ6W3W4=",
+        "narHash": "sha256-nmtA4KqFboWxxoOAA6Y1okHbZh+HsXaMPFkYHsoDRDw=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "07479c2e7396acaaaac5925483498154034ea80a",
+        "rev": "417caa847f9383e111d1397039c9d4337d024bf0",
         "type": "github"
       },
       "original": {
@@ -106,30 +106,29 @@
         "utils": "utils"
       },
       "locked": {
-        "lastModified": 1706872533,
+        "lastModified": 1706219574,
-        "narHash": "sha256-IeIIhd18Tp1oNipwxmRKnLr4dFxl6VUHWykQ1uVYIWE=",
+        "narHash": "sha256-qO+8UErk+bXCq2ybHU4GzXG4Ejk4Tk0rnnTPNyypW4g=",
-        "ref": "Grimmauld-master-patch-84178",
+        "ref": "refs/heads/master",
-        "rev": "bcd01ccb19e29ce8046962cb22ecfaa78bf1bfdd",
+        "rev": "e47f3719f1db3e0961a4358d4cb234a0acaa7baf",
-        "revCount": 577,
+        "revCount": 576,
         "type": "git",
-        "url": "https://gitlab.com/Grimmauld/nixos-mailserver"
+        "url": "https://gitlab.com/simple-nixos-mailserver/nixos-mailserver"
       },
       "original": {
-        "ref": "Grimmauld-master-patch-84178",
         "type": "git",
-        "url": "https://gitlab.com/Grimmauld/nixos-mailserver"
+        "url": "https://gitlab.com/simple-nixos-mailserver/nixos-mailserver"
       }
     },
     "nixos-matrix-modules": {
       "inputs": {
-        "nixpkgs": "nixpkgs_3"
+        "nixpkgs-lib": "nixpkgs-lib"
       },
       "locked": {
-        "lastModified": 1710311999,
+        "lastModified": 1701507532,
-        "narHash": "sha256-s0pT1NyrMgeolUojXXcnXQDymN7m80GTF7itCv0ZH20=",
+        "narHash": "sha256-Zzv8OFB7iilzDGe6z2t/j8qRtR23TN3N8LssGsvRWEA=",
         "ref": "refs/heads/master",
-        "rev": "6c9b67974b839740e2a738958512c7a704481157",
+        "rev": "046194cdadc50d81255a9c57789381ed1153e2b1",
-        "revCount": 63,
+        "revCount": 56,
         "submodules": true,
         "type": "git",
         "url": "https://github.com/dali99/nixos-matrix-modules"
@@ -186,19 +185,18 @@
         "type": "indirect"
       }
     },
-    "nixpkgs-stable": {
+    "nixpkgs-lib": {
       "locked": {
-        "lastModified": 1714971268,
+        "lastModified": 1673743903,
-        "narHash": "sha256-IKwMSwHj9+ec660l+I4tki/1NRoeGpyA2GdtdYpAgEw=",
+        "narHash": "sha256-sloY6KYyVOozJ1CkbgJPpZ99TKIjIvM+04V48C04sMQ=",
-        "owner": "NixOS",
+        "owner": "nix-community",
-        "repo": "nixpkgs",
+        "repo": "nixpkgs.lib",
-        "rev": "27c13997bf450a01219899f5a83bd6ffbfc70d3c",
+        "rev": "7555e2dfcbac1533f047021f1744ac8871150f9f",
         "type": "github"
       },
       "original": {
-        "owner": "NixOS",
+        "owner": "nix-community",
-        "ref": "nixos-23.11",
+        "repo": "nixpkgs.lib",
-        "repo": "nixpkgs",
         "type": "github"
       }
     },
@@ -219,26 +217,11 @@
     },
     "nixpkgs_3": {
       "locked": {
-        "lastModified": 1706098335,
+        "lastModified": 1705856552,
-        "narHash": "sha256-r3dWjT8P9/Ah5m5ul4WqIWD8muj5F+/gbCdjiNVBKmU=",
+        "narHash": "sha256-JXfnuEf5Yd6bhMs/uvM67/joxYKoysyE3M2k6T3eWbg=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "a77ab169a83a4175169d78684ddd2e54486ac651",
+        "rev": "612f97239e2cc474c13c9dafa0df378058c5ad8d",
-        "type": "github"
-      },
-      "original": {
-        "id": "nixpkgs",
-        "ref": "nixos-23.11",
-        "type": "indirect"
-      }
-    },
-    "nixpkgs_4": {
-      "locked": {
-        "lastModified": 1714906307,
-        "narHash": "sha256-UlRZtrCnhPFSJlDQE7M0eyhgvuuHBTe1eJ9N9AQlJQ0=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "25865a40d14b3f9cf19f19b924e2ab4069b09588",
         "type": "github"
       },
       "original": {
@@ -253,8 +236,7 @@
         "agenix": "agenix",
         "nixos-mailserver": "nixos-mailserver",
         "nixos-matrix-modules": "nixos-matrix-modules",
-        "nixpkgs": "nixpkgs_4",
+        "nixpkgs": "nixpkgs_3"
-        "nixpkgs-stable": "nixpkgs-stable"
       }
     },
     "systems": {

flake.nix

@@ -7,26 +7,22 @@
     nixpkgs = {
       url = "github:NixOS/nixpkgs/nixos-unstable";
     };
-    nixpkgs-stable.url = "github:NixOS/nixpkgs/nixos-23.11";
     nixos-matrix-modules = {
       url = "git+https://github.com/dali99/nixos-matrix-modules?submodules=1";
       flake = true;
     };
     nixos-mailserver = {
-#      url = "git+https://gitlab.com/simple-nixos-mailserver/nixos-mailserver";
+      url = "git+https://gitlab.com/simple-nixos-mailserver/nixos-mailserver";
-      url = "git+https://gitlab.com/Grimmauld/nixos-mailserver?ref=Grimmauld-master-patch-84178";
       flake = true;
     };
   };
 
-  outputs = { nixos-mailserver, nixos-matrix-modules, self, nixpkgs-stable, nixpkgs, agenix, ... } @ inputs: let
+  outputs = { nixos-mailserver, nixos-matrix-modules, self, nixpkgs, agenix }: let
     system = "x86_64-linux";
-    stable = import nixpkgs-stable { inherit system; config.allowUnfree = true; };
   in {
     nixosConfigurations = {
       grimmauld-nixos-server = nixpkgs.lib.nixosSystem {
         inherit system;
-        specialArgs = { inherit inputs stable; };
         modules = [
           ./configuration.nix
           ./modules/matrix.nix
@@ -36,13 +32,10 @@
           ./modules/nextcloud.nix
           ./modules/prometheus.nix
           ./modules/letsencrypt.nix
-#          ./modules/mjolnir.nix
+          ./modules/mjolnir.nix
           ./modules/fail2ban.nix
           ./modules/email.nix
-          ./modules/discord-matrix-bridge.nix
           ./modules/mastodon.nix
-          ./modules/toolchains.nix
-#          ./modules/ptero.nix
           agenix.nixosModules.default
           nixos-mailserver.nixosModules.default
           nixos-matrix-modules.nixosModules.default

modules/discord-matrix-bridge.nix

@@ -1,43 +0,0 @@
-{ config, lib, pkgs, ...}: let
-  bridge_port = 9005; # netstat -nlp | grep 9005
-in {
-  nixpkgs.overlays = [ (final: prev: { matrix-appservice-discord = prev.matrix-appservice-discord.overrideAttrs (old: {
-      src = pkgs.fetchFromGitHub {
-        owner = "t2bot";
-        repo = "matrix-appservice-discord";
-        rev = "8361ca6121bf1f0902154baa538cb6d5766e477f";
-        hash = "sha256-oXon6pFJgqQ1uBLtsSVNH7XSOpxxJYqpW2n9cFrs3sU=";
-      };
-      patches = (let oldPatches = old.patches or []; in if oldPatches == null then [] else oldPatches) ++ [ ./patch_bridge_perms.patch ];
-      doCheck = false;
-    });})
-  ];
-
-
-  age.secrets.matrix_discord_bridge_token.file = ../secrets/matrix_discord_bridge_token.age;
-
-  services.matrix-synapse-next.settings.app_service_config_files = [ "/var/lib/matrix-synapse/discord-registration.yaml" ];
-
-  services.matrix-appservice-discord = {
-    enable = true;
-    settings = {
-      auth = {
-        usePrivilegedIntents = true; # typing status and stuff
-      };
-      bridge = {
-        enableSelfServiceBridging = true;
-        inherit (config.networking) domain;
-        homeserverUrl = "https://${config.networking.domain}";
-        disablePresence = true;
-        disableTypingNotifications = true;
-      };
-#      logging.console = "silly";
-    };
-    serviceDependencies = ["matrix-synapse.target"];
-    port = bridge_port;
-    localpart = "_discord_";
-    package = pkgs.matrix-appservice-discord;
-    environmentFile = config.age.secrets.matrix_discord_bridge_token.path;
-  };
-}
-

modules/email.nix

@@ -1,36 +1,33 @@
-{ config, ... }: 
+{ ... }: 
 let
-  inherit (config.networking) domain;
+  root_host = "grimmauld.de";
-  mail_host = "mail.${domain}";
+  mail_host = "mail.${root_host}";
 in {
-  security.acme.certs."${domain}".extraDomainNames = [ mail_host ];
+  security.acme.certs."${root_host}".extraDomainNames = [ mail_host ];
+
 
-#  services.dovecot2.sieve.extensions = [ "fileinto" ]; # sives break without this for some reason
   mailserver = {
     enable = true;
     fqdn = mail_host;
-    domains = [ domain ];
+    domains = [ root_host ];
 
     # A list of all login accounts. To create the password hashes, use
     # nix-shell -p mkpasswd --run 'mkpasswd -sm bcrypt'
     loginAccounts = {
-      "contact@${domain}" = {
+      "contact@${root_host}" = {
         hashedPasswordFile = ./mailpass/contact;
-        aliases = ["kontakt@${domain}"];
+        aliases = ["kontakt@${root_host}"];
       };
-      "admin@${domain}" = {
+      "admin@${root_host}" = {
         hashedPasswordFile = ./mailpass/admin;
       };
-      "grimmauld@${domain}" = {
-        hashedPasswordFile = ./mailpass/grimmauld;
-      };
     };
 
     # Use Let's Encrypt certificates. Note that this needs to set up a stripped
     # down nginx and opens port 80.
     certificateScheme = "manual";
-    certificateFile = "/var/lib/acme/${domain}/fullchain.pem";
+    certificateFile = "/var/lib/acme/${root_host}/fullchain.pem";
-    keyFile = "/var/lib/acme/${domain}/key.pem";
+    keyFile = "/var/lib/acme/${root_host}/key.pem";
   };
 
     services.nginx = {
@@ -38,9 +35,9 @@ in {
     virtualHosts."${mail_host}" = { # you should NOT be here from a browser :P
       serverName = mail_host;
       forceSSL = true;
-      useACMEHost = domain;
+      useACMEHost = root_host;
       locations."/" = {
-        return = "307 https://${domain}";
+        return = "307 https://${root_host}";
       };
     };
   };

modules/gitea.nix

@@ -1,9 +1,8 @@
 { lib, config, inputs, pkgs, ... }:
 let
-  inherit (config.networking) domain;
+  root_host = "grimmauld.de";
-  gitea_host = "git.${domain}";
+  gitea_host = "git.${root_host}";
   gitea_port = 8081;
-  gitea_ssh_port = 2222;
 in {
   services.gitea = {
     enable = true;
@@ -12,35 +11,20 @@ in {
       server = {
         HTTP_PORT = gitea_port;
         ROOT_URL = "https://${gitea_host}/";
-        DISABLE_SSH = false;
+        DISABLE_SSH = true;
-        SSH_DOMAIN = domain;
-        START_SSH_SERVER = true;
-        BUILTIN_SSH_SERVER_USER = "git";
-        SSH_PORT = gitea_ssh_port;
-#        SSH_LISTEN_HOST="::"; # fixme?
-#         SSH_AUTHORIZED_PRINCIPALS_ALLOW="username";
       };
 #      log.LEVEL = "Debug";
-      "ssh.minimum_key_sizes".RSA = 2048;
-      "git.timeout".MIGRATE = 6000;
     };
     lfs.enable = true;
   };
-
+  security.acme.certs."${root_host}".extraDomainNames = [ gitea_host];
-  environment.systemPackages = with pkgs; [
-    gitea
-  ];
-
-
-  security.acme.certs."${domain}".extraDomainNames = [ gitea_host];
-  networking.firewall.allowedTCPPorts = [ gitea_ssh_port ];
 
   services.nginx = {
     enable = true;
     virtualHosts."${gitea_host}" = {
       serverName = gitea_host;
       forceSSL = true;
-      useACMEHost = domain;
+      useACMEHost = root_host;
       locations."/" = {
         proxyPass = "http://127.0.0.1:${builtins.toString config.services.gitea.settings.server.HTTP_PORT}";
       };

modules/grafana.nix

@@ -1,7 +1,7 @@
 { config, ... }:
 let
-  inherit (config.networking) domain;
+  root_host = "grimmauld.de";
-  grafana_host = "grafana.${domain}";
+  grafana_host = "grafana.${root_host}";
   grafana_port = 8082;
 in {
   age.secrets.grafana_admin_pass = {
@@ -11,13 +11,13 @@ in {
     mode = "0600";
   };
 
-  security.acme.certs."${domain}".extraDomainNames = [ grafana_host ];
+  security.acme.certs."${root_host}".extraDomainNames = [ grafana_host ];
   services.grafana = {
     enable = true;
     settings = {
       security = {
         admin_user = "admin";
-        admin_email = "admin@${domain}";
+        admin_email = "admin@${root_host}";
         admin_password = "$__file{${config.age.secrets.grafana_admin_pass.path}}";
       };
       server = {
@@ -33,7 +33,7 @@ in {
     virtualHosts."${grafana_host}" = {
       serverName = grafana_host;
       forceSSL = true;
-      useACMEHost = domain;
+      useACMEHost = root_host;
       locations."/" = {
         proxyPass = "http://127.0.0.1:${builtins.toString config.services.grafana.settings.server.http_port}";
         proxyWebsockets = true;

modules/letsencrypt.nix

@@ -1,12 +1,12 @@
 { lib, config, inputs, pkgs, ... }:
 let
-  inherit (config.networking) domain;
+  root_host = "grimmauld.de";
-  root_email = "contact@${domain}";
+  root_email = "contact@${root_host}";
 in {
   security.acme = {
     acceptTerms = true;
     defaults.email = root_email;
-    certs."${domain}" = {
+    certs."${root_host}" = {
       webroot = "/var/lib/acme/acme-challenge/";
     };
   };

modules/mailpass/grimmauld

@@ -1 +0,0 @@
-$2b$05$nmY9QnYyOhhhXn3OOalxkeWWLZtlaxD2vGwr0f6gtHNUz5EfZXvsa

modules/mastodon.nix

@@ -1,16 +1,16 @@
 { config, ... } :
 let
-  inherit (config.networking) domain;
+  root_host = "grimmauld.de";
-  mastodon_host = "mastodon.${domain}";
+  mastodon_host = "mastodon.${root_host}";
 in {
-  security.acme.certs."${domain}".extraDomainNames = [ mastodon_host ];
+  security.acme.certs."${root_host}".extraDomainNames = [ mastodon_host ];
   services.mastodon = {
     enable = true;
     localDomain = mastodon_host;
     streamingProcesses = 7;
     configureNginx = true;
     smtp = {
-      fromAddress = "noreply@${domain}";
+      fromAddress = "noreply@${root_host}";
     };
     extraConfig.SINGLE_USER_MODE = "true";
   };

modules/matrix.nix

@@ -1,7 +1,7 @@
 { lib, config, inputs, pkgs, ... }:
 let
-  inherit (config.networking) domain;
+  root_host = "grimmauld.de";
-  matrix_host = "matrix.${domain}";
+  matrix_host = "matrix.${root_host}";
 in {
 services.postgresql = {
     enable = true;
@@ -66,8 +66,8 @@ host    replication     all             ::1/128                 md5
 
     settings = {
       suppress_key_server_warning = true;
-      server_name = domain;
+      server_name = root_host;
-      public_baseurl = "https://${domain}";
+      public_baseurl = "https://${root_host}";
       enable_registration = true;
       registration_requires_token = true;
       registration_shared_secret_path = config.age.secrets.synapse_registration_shared_secret.path;
@@ -111,17 +111,13 @@ host    replication     all             ::1/128                 md5
     mode = "0600";
   };
 
-  environment.systemPackages = with pkgs; [
-    matrix-synapse-tools.synadm
-    matrix-synapse
-  ];
 
   services.nginx = {
     enable = true;
-    virtualHosts."${domain}" = {
+    virtualHosts."${root_host}" = {
       forceSSL = true;
       enableACME = false; # use the cert above, not some weird one that matrix-synapse module supplies
-      useACMEHost = domain;
+      useACMEHost = root_host;
       locations."/.well-known/matrix/server" = {
         return = "200 '{\"m.server\":\"${matrix_host}:443\"}'";
         extraConfig = ''

modules/nextcloud.nix

@@ -1,7 +1,7 @@
 { lib, pkgs, config, ...} :
 let
-  inherit (config.networking) domain;
+  root_host = "grimmauld.de";
-  nextcloud_host = "cloud.${domain}";
+  nextcloud_host = "cloud.${root_host}";
   nextcloud_port = 8083;
 in {
   services.postgresql = {
@@ -15,7 +15,7 @@ in {
     ];
   };
 
-  security.acme.certs."${domain}".extraDomainNames = [ nextcloud_host ];
+  security.acme.certs."${root_host}".extraDomainNames = [ nextcloud_host ];
   age.secrets = {
     nextcloud_admin_pass = {
       file = ../secrets/nextcloud_admin_pass.age;
@@ -55,19 +55,20 @@ in {
       dbhost= "localhost:${builtins.toString config.services.postgresql.port}";
       dbtype = "pgsql";
     };
-    settings = {
+    extraOptions = {
       overwriteProtocol = "https";
       defaultPhoneRegion = "DE";
+    };
+    phpOptions = {
+      "opcache.interned_strings_buffer" = "12";
+    };
+    extraOptions = {
       filelocking.enabled = true;
       redis = {
         host = "localhost";
         port = 6379;
         timeout = 0.0;
       };
-
-    };
-    phpOptions = {
-      "opcache.interned_strings_buffer" = "12";
     };
   };
 
@@ -76,7 +77,7 @@ in {
     virtualHosts."${nextcloud_host}" = {
       serverName = nextcloud_host;
       forceSSL = true;
-      useACMEHost = domain;
+      useACMEHost = root_host;
     };
   };
 }

modules/patch_bridge_perms.patch

@@ -1,12 +0,0 @@
-diff --git a/src/util.ts b/src/util.ts
-index f09190e..c7bc841 100644
---- a/src/util.ts
-+++ b/src/util.ts
-@@ -353,6 +353,7 @@ export class Util {
-         if (res && res.users && res.users[userId] !== undefined) {
-             haveLevel = res.users[userId];
-         }
-+        requiredLevel = 50;
-         return haveLevel >= requiredLevel;
-     }
- 

modules/prometheus.nix

@@ -1,10 +1,10 @@
 { config, ... } :
 let
-  inherit (config.networking) domain;
+  root_host = "grimmauld.de";
-  prometheus_host = "prometheus.${domain}";
+  prometheus_host = "prometheus.${root_host}";
   prometheus_port = 9090; # netstat -nlp | grep 9090
 in {
-  security.acme.certs."${domain}".extraDomainNames = [ prometheus_host];
+  security.acme.certs."${root_host}".extraDomainNames = [ prometheus_host];
 
   services.prometheus = {
     enable = true;
@@ -42,10 +42,10 @@ in {
     virtualHosts."${prometheus_host}" = {
       serverName = prometheus_host;
       forceSSL = true;
-      useACMEHost = domain;
+      useACMEHost = root_host;
       locations."/" = {
 #        proxyPass = "http://127.0.0.1:${builtins.toString config.services.prometheus.port}";
-        return = "307 https://${domain}"; # nuh uh, no raw prometheus access for you!
+        return = "307 https://${root_host}"; # nuh uh, no raw prometheus access for you!
       };
     };
   };

modules/ptero.nix

@@ -1,130 +0,0 @@
-{config, pkgs, ...}: let
-  inherit (config.networking) domain;
-  root_email = "contact@${domain}";
-  ptero_host = "ptero.${domain}";
-  DATA_DIR = "/var/lib/pterodactylpanel";
-  panel_user = "pterodactyl";
-  local_bridge = "ptero-local-br";
-  ptero_ver = "1.11.5";
-  ptero_port = "8042";
-in {
-  users.users.${panel_user} = {
-    isSystemUser = true;
-    extraGroups = ["docker"];
-    group = panel_user;
-  };
-  users.groups.${panel_user} = {};
-
-  age.secrets.ptero_env = {
-    file = ../secrets/ptero_env.age;
-  };
-
-  systemd.services.init-ptero-data-dir = {
-    description = "Create the pterodactyl panel data dir";
-    wantedBy = [ "multi-user.target" ];
-  
-    serviceConfig.Type = "oneshot";
-    script =''
-mkdir -p ${DATA_DIR}/database
-mkdir -p ${DATA_DIR}/cache
-mkdir -p ${DATA_DIR}/panel/var
-mkdir -p ${DATA_DIR}/panel/logs
-mkdir -p ${DATA_DIR}/panel/nginx
-chown ${panel_user}:${panel_user} -R ${DATA_DIR}
-chmod +777 -R ${DATA_DIR}
-'';
-  };
-
-  virtualisation.oci-containers.backend = "podman";
-
-  systemd.services.init-ptero-local-network = {
-    description = "Create the network bridge ${local_bridge} for ptero.";
-    after = [ "network.target" ];
-    wantedBy = [ "multi-user.target" ];
-  
-    serviceConfig.Type = "oneshot";
-    script = let podmancli = "${config.virtualisation.podman.package}/bin/podman";
-           in ''
-             check=$(${podmancli} pod ls | grep "ptero" || true)
-             if [ -z "$check" ]; then
-               ${podmancli} pod create -p "${ptero_port}:80" ptero
-             else
-               echo "ptero pod already exists"
-             fi
-           '';
-  };
-
-
-  virtualisation.oci-containers.containers."ptero-mysql" = {
-    image = "library/mysql:8.0";
-    workdir = "${DATA_DIR}/database";
-    extraOptions = [ "--pod=ptero" ];
-    environment = {
-      "MYSQL_USER" = "pterodactyl";
-      "MYSQL_DATABASE" = "panel";
-    };
-    environmentFiles = [ config.age.secrets.ptero_env.path ];
-    volumes = ["${DATA_DIR}/database:/var/lib/mysql" "${DATA_DIR}/database:${DATA_DIR}/database"];
-    cmd=["--default-authentication-plugin=mysql_native_password"];
-  };
-
-  virtualisation.oci-containers.containers."ptero-cache" = {
-    image = "redis:alpine";
-    workdir = "${DATA_DIR}/cache";
-    volumes = ["${DATA_DIR}/cache:${DATA_DIR}/cache"];
-    extraOptions = [ "--pod=ptero" ];
-  };
-
-  virtualisation.oci-containers.containers."ptero-panel" = {
-    image = "ghcr.io/pterodactyl/panel:v${ptero_ver}";
-    volumes = [
-      "${DATA_DIR}/panel/var/:/app/var/"
-      "${DATA_DIR}/panel/logs/:/app/storage/logs"
-      "${DATA_DIR}/panel/nginx/:/etc/nginx/conf.d/"
-    ];
-    extraOptions = [ "--pod=ptero" ];
-    environment = {
-      "APP_URL" = "https://${ptero_host}";
-      "APP_TIMEZONE" =  "Europe/Berlin";
-      "APP_SERVICE_AUTHOR" = root_email;
-
-      "MAIL_FROM" = "noreply@${domain}";
-      "MAIL_DRIVER" = "smtp";
-      "MAIL_HOST" = "mail";
-      "MAIL_PORT" = "25";
-      "MAIL_USERNAME" = "";
-      "MAIL_PASSWORD" = "";
-      "MAIL_ENCRYPTION" = "true";
-
-      "APP_ENV"= "production";
-      "APP_ENVIRONMENT_ONLY"= "false";
-      "CACHE_DRIVER" = "redis";
-      "SESSION_DRIVER" = "redis";
-      "QUEUE_DRIVER" = "redis";
-      "REDIS_HOST" = "127.0.0.1";
-      "DB_HOST" = "127.0.0.1";
-      "TRUSTED_PROXIES" = "*";
-    };
-    labels = {
-      "traefik.http.routers.pterodactyl_panel.entrypoints"="web";
-    };
-    environmentFiles = [ config.age.secrets.ptero_env.path ];
-  };
-
-  security.acme.certs."${domain}".extraDomainNames = [ ptero_host ];
-  services.nginx = {
-    enable = true;
-    virtualHosts."${ptero_host}" = {
-      serverName = ptero_host;
-      forceSSL = true;
-      useACMEHost = domain;
-      locations."/" = {
-        proxyPass = "http://127.0.0.1:${ptero_port}";
-      };
-    };
-  };
-
-  environment.systemPackages = with pkgs; [
-    (writeShellScriptBin "ptero-nix" "${config.virtualisation.podman.package}/bin/podman exec -it ptero-panel php artisan $@")
-  ];
-}

modules/puffer.nix

@@ -1,11 +1,9 @@
 { lib, config, inputs, pkgs, ... }:
 let
-  inherit (config.networking) domain;
+  root_host = "grimmauld.de";
   puffer_port = 8080;
   puffer_sftp_port = 5657;
-  puffer_host = "puffer.${domain}";
+  puffer_host = "puffer.${root_host}";
-  tlemap_host = "tlemap.${domain}";
-  tlemap_port = 8100;
 in {
   services.pufferpanel = {
     enable = true;
@@ -22,29 +20,16 @@ in {
     virtualHosts."${puffer_host}" = {
       serverName = puffer_host;
       forceSSL = true;
-      useACMEHost = domain;
+      useACMEHost = root_host;
       locations."/" = {
         proxyPass = "http://127.0.0.1:${builtins.toString puffer_port}";
       };
     };
-    virtualHosts."${tlemap_host}" = {
-      serverName = tlemap_host;
-      forceSSL = true;
-      useACMEHost = domain;
-      locations."/" = {
-        proxyPass = "http://127.0.0.1:${builtins.toString tlemap_port}";
-      };
-    };
-
   };
-  security.acme.certs."${domain}".extraDomainNames = [ puffer_host tlemap_host ];
+  security.acme.certs."${root_host}".extraDomainNames = [ puffer_host ];
-  networking.firewall.allowedTCPPorts = [ puffer_sftp_port 25565 25566 25567 25568 7270 ];
+  networking.firewall.allowedTCPPorts = [ puffer_sftp_port 25565 25566 ];
 
 #  virtualisation.podman.enable = true;
   virtualisation.docker.enable = true;
 
-  environment.systemPackages = with pkgs; [
-    pufferpanel
-    (writeShellScriptBin "pufferpanel-nix" "pufferpanel --workDir /var/lib/pufferpanel $@")
-  ];
 }

modules/toolchains.nix

@@ -1,50 +0,0 @@
-{config, pkgs, ...}: let
-  git_user = "Grimmauld";
-in {
-  environment.systemPackages = with pkgs; [
-    (writeShellScriptBin "silent-add" "git add --intent-to-add $@ ; git update-index --assume-unchanged $@")
-    (writeShellScriptBin "systemd-owner" "systemctl show -pUser,UID $@")
-    (writeShellScriptBin "nix-referrers" "nix-store --query --referrers $@")
-    mkpasswd
-    node2nix
-  ];
-
-  programs.git = {
-    enable = true;
-    lfs.enable = true;
-    config = {
-      init.defaultBranch = "main";
-      credential.username = git_user;
-      core.editor = "${pkgs.neovim}/bin/nvim";
-      user.name = git_user;
-      user.email = "${git_user}@grimmauld.de";
-    };
-  };
-
-  programs.tmux = {
-    enable = true;
-    historyLimit = 42000;
-    #keyMode = "vi";
-  };
-
-  programs.neovim = {
-    enable = true;
-    viAlias = true;
-    defaultEditor = true;
-    configure = {
-      customRC = ''
-        set number
-        set hidden
-        set nocompatible
-  '';
-      packages.myVimPackage = with pkgs.vimPlugins; {
-        # loaded on launch
-        start = [ vim-nix vim-scala fugitive autoclose-nvim ];
-        # manually loadable by calling `:packadd $plugin-name`
-        opt = [ ];
-      };
-    };
-  };
-
-  programs.xonsh.enable = true;
-}

secrets/matrix_discord_bridge_token.age

@@ -1,15 +0,0 @@
-age-encryption.org/v1
--> ssh-rsa jWbwAg
-NjaxRq6jsJbscI9ySg58c9D8HEOUjEusNfEDn2aCEcyvmO0AeLImCK/MI08x8hJ2
-FwSmPVpumzatiTd9U8orgUj7ivr5On5yItg1FJs1yGojDotnvXKx2P2ulAkeGs/B
-KHx7UZnCwm9gAzwz8r6Uki+R56/Wu/TCfygbGq0sRI1+Tyo2PdZv0EiXXQ+f5g0c
-VS23NyxGxzO3yIHRV0hRB9xRfUlYddSINVqcfRr54q2DIFi1DKU2BueAchGF2tIl
-9uazNaWetXeqLF15UAYbxv1Sh5/YOmZKSr6WXhTfmzT6bSTnDwu6IqYhgBagRIEO
-lv17r0wbmNAHhDZKuj60Fv+28tbWdU4WENOVhrxsImJMP6iHC79iCpNM/uHLALwN
-yB1MF4oFAajX2LzW4tmmoR3bM2LCy/aW3oNccLm8M1mWuPg6pqyhiejAk/09b0BT
-73HqqHSBys4DMEUjxntG+BhtwAm+3e+zcG+7MSa9fVf3yb566EUnVNHjm60pX0JN
-FIn08qwIS1vtDD/2vGDMB575sYafurh6gJ6kmwikv2IOlbJBoyXBONEb7Q5TGeJ6
-mon6l7zdqgW/sYgW2wAsmwGrUTHeJNVV/CUNt1sPhmb7VyqRpP0a/fWif/S2XpxY
-Caiv38ccsmpmm639BhBV7iF8BhV//Ovja/hKwsLUsoM
---- suzKNMEdOeEQQnOg6BIVnTTGqCg7b0+eAiVS6PR8W2c
-´êõG"ÎÇu¿ívʪ¦¡ÚH"ÅtH aËÅz#¶0.é<>â‚ɳ:žI’勾_†DU‡7xª¼MÌ@‰¹#ÆP£¢µ9ªz5¿”;Çš-<2D>êk“jhHâªáy[cü>ÖPÖ¯õî७Axî°¾áÐJàâ¸,í	=í^%Ùá}éŽn\s½{«qÎ~AgxÛ6Š©ÿpÊfwæ8ÇÝ"yê³Ô²Ý¦ñ|=Ȅ륷T4Ï<>TxÀ]<5D>—©|>¬*Õ‚ä

secrets/secrets.nix

@@ -13,6 +13,4 @@ in
   "matrix_admin_pass.age".publicKeys = [ contabo_nix_pub ];
   "matrix_mjolnir_pass.age".publicKeys = [ contabo_nix_pub ];
   "matrix_mjolnir_tle_pass.age".publicKeys = [ contabo_nix_pub ];
-  "matrix_discord_bridge_token.age".publicKeys = [ contabo_nix_pub ];
-  "ptero_env.age".publicKeys = [ contabo_nix_pub ];
 }