[pi4] Added Forgejo client to realmFile

.sops.yaml

@@ -2,7 +2,6 @@ keys:
   - &thinkpad age1j66v6z6hlsgqjfv5fz7fldm5q9jay4j5v5du6ymfda6hv40nsqesg89g7p
   - &desktop age1fxr5s6d6ar0xy5pr63kpq93tk7jha5k96jcxnyquj6s2mw8mmcpss8w29w
   - &pi4 age1xlnprpvshv93eerthxzg6cahklsfc4efh8dd6u8dte9u6cl0u5qsz48qlt
-  - &nidaros age1sf8tspnmyj2cn6gmzdfuh2vt00tmeqa0vf23rn5s44s9avafsd7sz6wgql
 creation_rules:
   - path_regex: shared/secrets/secrets.yaml$
     key_groups:
@@ -10,4 +9,3 @@ creation_rules:
           - *thinkpad
           - *desktop
           - *pi4
-          - *nidaros

flake.lock

@@ -206,11 +206,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1759439645,
-        "narHash": "sha256-oiAyQaRilPk525Z5aTtTNWNzSrcdJ7IXM0/PL3CGlbI=",
+        "lastModified": 1757020766,
+        "narHash": "sha256-PLoSjHRa2bUbi1x9HoXgTx2AiuzNXs54c8omhadyvp0=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "879bd460b3d3e8571354ce172128fbcbac1ed633",
+        "rev": "fe83bbdde2ccdc2cb9573aa846abe8363f79a97a",
         "type": "github"
       },
       "original": {
@@ -316,11 +316,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1759444170,
-        "narHash": "sha256-b5ShONncU4Gf39QtaL5OySC9G2o612rTE/TCwx3kMeM=",
+        "lastModified": 1756614537,
+        "narHash": "sha256-qyszmZO9CEKAlj5NBQo1AIIADm5Fgqs5ZggW1sU1TVo=",
         "owner": "Gerg-L",
         "repo": "spicetify-nix",
-        "rev": "e13267e8f3eb1664329fcb78a43b38b985f96f6f",
+        "rev": "374eb5d97092b97f7aaafd58a2012943b388c0df",
         "type": "github"
       },
       "original": {
@@ -350,11 +350,11 @@
         "nixpkgs": "nixpkgs_4"
       },
       "locked": {
-        "lastModified": 1759584043,
-        "narHash": "sha256-YCuCmg9nRLrtTz7Zex94C8kYzh8hoSzPOA72kMLpuxM=",
+        "lastModified": 1757142986,
+        "narHash": "sha256-HB01usaR5wg5LK3lV6S7Za2x4AfKrNceOnun/mlpChk=",
         "owner": "0xc000022070",
         "repo": "zen-browser-flake",
-        "rev": "176555a4128ce90461354142ab85c7f536bfd267",
+        "rev": "ed4bfefc49ef23e55b4f6e39d2e297a79f5ab2df",
         "type": "github"
       },
       "original": {

flake.nix

@@ -66,20 +66,53 @@
       lib = nixpkgs.lib.extend customLib;
       libHm = home-manager.lib.extend customLib;
 
-      systems = import ./systems.nix {
-        inherit common;
+      systems = builtins.map (config: defaultAttrs // config) [
+        {
+          hostName = "desktop";
+          nvidia.enable = true;
+          ssh.publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMSzXyTuQyTrWsfORQbvgrqt/33+hfSUDXeMg6D1T2wz";
+        }
+        {
+          hostName = "thinkpad";
+          ssh.publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILNlHKE/BD8kKfhJD7GBk1A3whZf3gTjk9VEgGAj3qsH";
+        }
+        {
+          hostName = "pi4";
+          system = "aarch64-linux";
+          wayland.enable = false;
+          ssh.publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJE9m7YiITe1sDqSZ7Pa8luIw3WToLsypixZEqE4wCQE";
+          address.private = common.localIpAddr 188;
+        }
+        {
+          hostName = "homelab";
+          wayland.enable = false;
+          ssh.publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIARDv5nRlfPDXdV+Db4FaqeSJZ3/3MO0frYGzuVeqYAl";
+          address.private = common.localIpAddr 231;
+          address.tailnet = common.tailnetAddr "admin";
+        }
+      ];
+
+      defaultAttrs = {
+        hostName = builtins.abort "hostName is required";
+        system = "x86_64-linux";
+        username = common.username;
+        version = common.system.version;
+        wayland.enable = true;
+        nvidia.enable = false;
       };
 
-      knownSystems = {
-        # Samsung S23 FE
-        localhost-y4maoyqm = {
+      knownSystems = [
+        {
+          # Samsung S23 FE
+          hostName = "localhost-y4maoyqm";
           ssh.publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII7SSjiqnjif1Kko60iXVTKJ7a1/lRlR8TFNtoclNcnQ";
-        };
-        # OnePlus 8
-        localhost-4izgka9k = {
+        }
+        {
+          # OnePlus 8
+          hostName = "localhost-4izgka9k";
           ssh.publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIALtulVgLrUEpKnpfPFQTHjaEXTxs2Q818NC18eLx0bj";
-        };
-      };
+        }
+      ];
 
     in
     {
@@ -92,71 +125,75 @@
       #
       # ========= Host Configurations =========
       #
-      nixosConfigurations = builtins.mapAttrs (
-        hostName:
-        {
-          system,
-          username,
-          ...
-        }@systemConfig:
+      nixosConfigurations = builtins.listToAttrs (
+        builtins.map (
+          {
+            hostName,
+            system,
+            username,
+            ...
+          }@systemConfig:
 
-        nixpkgs.lib.nixosSystem {
-          inherit system;
-          specialArgs = {
-            inherit
-              outputs
-              inputs
-              common
-              theme
-              lib
-              hostName
-              systemConfig
-              systems
-              knownSystems
-              ;
-            isDarwin = false;
-          };
-          modules = [
-            ./hosts/${hostName}
-            home-manager.nixosModules.home-manager
-            {
-              home-manager = {
-                # Backups conflicting files in case of error
-                backupFileExtension = "bkp";
-                useGlobalPkgs = true;
-                useUserPackages = true;
-                extraSpecialArgs = {
-                  inherit
-                    inputs
-                    common
-                    theme
-                    libHm
-                    systemConfig
-                    systems
-                    ;
-                };
-                users.${username} = import ./hosts/${hostName}/home-manager;
+          {
+            name = hostName;
+            value = nixpkgs.lib.nixosSystem {
+              inherit system;
+              specialArgs = {
+                inherit
+                  outputs
+                  inputs
+                  common
+                  theme
+                  lib
+                  systemConfig
+                  systems
+                  knownSystems
+                  ;
+                isDarwin = false;
               };
-            }
-            {
-              nixpkgs.overlays = [
-                # TODO temp fix for tailscale: https://github.com/tailscale/tailscale/issues/16966#issuecomment-3239543750
-                (_: prev: {
-                  tailscale = prev.tailscale.overrideAttrs (old: {
-                    checkFlags = builtins.map (
-                      flag:
-                      if prev.lib.hasPrefix "-skip=" flag then
-                        flag + "|^TestGetList$|^TestIgnoreLocallyBoundPorts$|^TestPoller$"
-                      else
-                        flag
-                    ) old.checkFlags;
-                  });
-                })
+              modules = [
+                ./hosts/${hostName}
+                home-manager.nixosModules.home-manager
+                {
+                  home-manager = {
+                    # Backups conflicting files in case of error
+                    backupFileExtension = "bkp";
+                    useGlobalPkgs = true;
+                    useUserPackages = true;
+                    extraSpecialArgs = {
+                      inherit
+                        inputs
+                        common
+                        theme
+                        libHm
+                        systemConfig
+                        systems
+                        ;
+                    };
+                    users.${username} = import ./hosts/${hostName}/home-manager;
+                  };
+                }
+                {
+                  nixpkgs.overlays = [
+                    # TODO temp fix for tailscale: https://github.com/tailscale/tailscale/issues/16966#issuecomment-3239543750
+                    (_: prev: {
+                      tailscale = prev.tailscale.overrideAttrs (old: {
+                        checkFlags = builtins.map (
+                          flag:
+                          if prev.lib.hasPrefix "-skip=" flag then
+                            flag + "|^TestGetList$|^TestIgnoreLocallyBoundPorts$|^TestPoller$"
+                          else
+                            flag
+                        ) old.checkFlags;
+                      });
+                    })
+                  ];
+                }
               ];
-            }
-          ];
-        }
-      ) systems;
+            };
+          }
+        ) systems
+      );
 
       #
       # ========= Formatting =========

hosts/desktop/home-manager/default.nix

@@ -9,4 +9,6 @@
     ./hyprpaper.nix
     ./settings.nix
   ];
+
+  programs.git.signing.key = "706F53DD087A91DE";
 }

hosts/nidaros/boot.nix

@@ -1,6 +0,0 @@
-{
-  boot.loader = {
-    systemd-boot.enable = true;
-    efi.canTouchEfiVariables = true;
-  };
-}

hosts/nidaros/default.nix

@@ -1,14 +0,0 @@
-{ lib, ... }:
-
-{
-  imports = with lib.custom; [
-    (relativeToBase "modules")
-    ./boot.nix
-    ./forgejo.nix
-    ./hardware.nix
-    ./keycloak.nix
-    ./podman.nix
-    ./postgres.nix
-    ./security
-  ];
-}

hosts/nidaros/forgejo.nix

@@ -1,73 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  common,
-  ...
-}:
-let
-  domain = "beta.code.${common.domain}";
-  passwordKey = "forgejo/admin-pass";
-  runnerTokenKey = "forgejo/runner-token";
-in
-{
-  services = {
-    forgejo = {
-      enable = true;
-      database.type = "postgres";
-      # Enable support for Git Large File Storage
-      lfs.enable = true;
-
-      settings = {
-        server = {
-          DOMAIN = domain;
-          # You need to specify this to remove the port from URLs in the web UI.
-          ROOT_URL = "https://${domain}/";
-          HTTP_PORT = 8002;
-        };
-        # You can temporarily allow registration to create an admin user.
-        service.DISABLE_REGISTRATION = true;
-        # Add support for actions, based on act: https://github.com/nektos/act
-        actions = {
-          ENABLED = true;
-          DEFAULT_ACTIONS_URL = "github";
-        };
-        # TODO set up mailer
-      };
-    };
-    gitea-actions-runner = {
-      package = pkgs.forgejo-actions-runner;
-      instances.default = {
-        enable = true;
-        name = "monolith";
-        url = "https://${domain}";
-        # Obtaining the path to the runner token file may differ
-        # tokenFile should be in format TOKEN=<secret>, since it's EnvironmentFile for systemd
-        tokenFile = config.sops.secrets.${runnerTokenKey}.path;
-        labels = [
-          "docker:docker://node:22-bullseye"
-          "native:host"
-        ];
-      };
-    };
-  };
-
-  sops.secrets = {
-    ${passwordKey}.owner = "forgejo";
-    ${runnerTokenKey}.owner = "forgejo";
-  };
-
-  # Create a single admin user / update password if exists
-  systemd.services.forgejo.preStart =
-    let
-      adminCmd = "${lib.getExe config.services.forgejo.package} admin user";
-      pwd = config.sops.secrets.${passwordKey};
-      user = "martin"; # Note, Forgejo doesn't allow creation of an account named "admin"
-      email = "git@${common.domain}";
-    in
-    ''
-      ${adminCmd} create --admin --email "${email}" --username ${user} --password "$(tr -d '\n' < ${pwd.path})" || true
-      ## Alter an existing user. Will prompt new password on login
-      # ${adminCmd} change-password --username ${user} --password "$(tr -d '\n' < ${pwd.path})" || true
-    '';
-}

hosts/nidaros/hardware.nix

@@ -1,53 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{
-  config,
-  lib,
-  modulesPath,
-  ...
-}:
-
-{
-  imports = [
-    (modulesPath + "/installer/scan/not-detected.nix")
-  ];
-
-  boot.initrd.availableKernelModules = [
-    "xhci_pci"
-    "ahci"
-    "nvme"
-    "usb_storage"
-    "usbhid"
-    "sd_mod"
-  ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ "kvm-intel" ];
-  boot.extraModulePackages = [ ];
-
-  fileSystems."/" = {
-    device = "/dev/disk/by-uuid/dfade67a-9cbe-4002-990a-2cd22b8e57fa";
-    fsType = "ext4";
-  };
-
-  fileSystems."/boot" = {
-    device = "/dev/disk/by-uuid/66F7-BE0A";
-    fsType = "vfat";
-    options = [
-      "fmask=0077"
-      "dmask=0077"
-    ];
-  };
-
-  swapDevices = [ ];
-
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.eno1.useDHCP = lib.mkDefault true;
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-}

hosts/nidaros/home-manager/default.nix

@@ -1,7 +0,0 @@
-{ lib, ... }:
-
-{
-  imports = with lib.custom; [
-    (relativeToBase "home-manager")
-  ];
-}

hosts/nidaros/keycloak.nix

@@ -1,27 +0,0 @@
-{ config, common, ... }:
-let
-  port = 8081;
-  domain = "iam.${common.domain}";
-  dbPassKey = "keycloak/database-pass";
-in
-{
-
-  services = {
-    keycloak = {
-      enable = true;
-      settings = {
-        hostname = "https://${domain}";
-        http-port = port;
-        http-enabled = true;
-      };
-      database = {
-        type = "postgresql";
-        createLocally = true;
-        port = config.services.postgresql.settings.port;
-        passwordFile = config.sops.secrets.${dbPassKey}.path;
-      };
-      initialAdminPassword = "changeme";
-    };
-  };
-  sops.secrets.${dbPassKey} = { };
-}

hosts/nidaros/podman.nix

@@ -1,23 +0,0 @@
-{ pkgs, ... }:
-
-{
-  virtualisation = {
-    # Enable common container config files in /etc/containers
-    containers.enable = true;
-    podman = {
-      enable = true;
-
-      # Create a `docker` alias for podman, to use it as a drop-in replacement
-      dockerCompat = true;
-
-      # Required for containers under podman-compose to be able to talk to each other.
-      defaultNetwork.settings.dns_enabled = true;
-    };
-  };
-
-  # Useful other development tools
-  environment.systemPackages = with pkgs; [
-    podman-tui # status of containers in the terminal
-    podman-compose # start group of containers for dev
-  ];
-}

hosts/nidaros/postgres.nix

@@ -1,13 +0,0 @@
-{ pkgs, ... }:
-
-{
-  services.postgresql = {
-    enable = true;
-    authentication = pkgs.lib.mkOverride 10 ''
-      #type  database  DBuser  url            auth-method
-      local  all       all                    trust
-      # ipv4
-      host   all       all     127.0.0.1/32   trust
-    '';
-  };
-}

hosts/nidaros/security/default.nix

@@ -1,22 +0,0 @@
-{ systemConfig, ... }:
-
-{
-  imports = [
-    ./firewall.nix
-  ];
-
-  security.sudo.extraRules = [
-    {
-      users = [ systemConfig.username ];
-      runAs = "ALL:ALL";
-      commands = [
-        {
-          command = "ALL";
-          options = [ "NOPASSWD" ];
-        }
-      ];
-    }
-  ];
-
-  services.pcscd.enable = true;
-}

hosts/nidaros/security/firewall.nix

@@ -1,17 +0,0 @@
-{ common, ... }:
-
-{
-  networking = {
-    firewall = {
-      enable = true;
-      allowedTCPPorts = [
-        80
-        443
-      ];
-      extraInputRules = ''
-        ip saddr ${common.localIpRange} accept
-      '';
-    };
-    nftables.enable = true;
-  };
-}

hosts/pi4/home-manager/default.nix

@@ -4,4 +4,6 @@
   imports = with lib.custom; [
     (relativeToBase "home-manager")
   ];
+
+  programs.git.signing.key = "E3FA0E995C0D0E5E";
 }

hosts/pi4/keycloak.nix

@@ -1,8 +1,14 @@
-{ config, common, ... }:
+{
+  config,
+  common,
+  pkgs,
+  ...
+}:
 let
   port = 8086;
   domain = "beta.auth.${common.domain}";
   dbPassKey = "keycloak/database-pass";
+  forgejoClientSecretKey = "keycloak/realms/forgejo/client/secret";
 in
 {
 
@@ -21,6 +27,97 @@ in
         passwordFile = config.sops.secrets.${dbPassKey}.path;
       };
       initialAdminPassword = "changeme";
+      realmFiles = [
+        # (
+        #   let
+        #     name = "Default";
+        #   in
+        #   pkgs.writeText "${name}.json" (
+        #     builtins.toJSON {
+        #       realm = name;
+        #       enabled = true;
+        #       clients = [
+        #         rec {
+        #           enabled = true;
+        #           clientId = "forgejo";
+        #           name = "Forgejo Beta";
+        #           description = "";
+        #           rootUrl = "https://${config.services.forgejo.settings.server.DOMAIN}";
+        #           adminUrl = rootUrl;
+        #           baseUrl = rootUrl;
+        #           surrogateAuthRequired = false;
+        #           alwaysDisplayInConsole = true;
+        #           clientAuthenticatorType = "client-secret";
+        #           # secret = readFile config.sops.secrets.${forgejoClientSecretKey}.path;
+        #           redirectUris = [ "${rootUrl}/*" ];
+        #           webOrigins = [ rootUrl ];
+        #           notBefore = 0;
+        #           bearerOnly = false;
+        #           consentRequired = false;
+        #           standardFlowEnabled = true;
+        #           implicitFlowEnabled = false;
+        #           directAccessGrantsEnabled = false;
+        #           serviceAccountsEnabled = false;
+        #           publicClient = false;
+        #           frontchannelLogout = true;
+        #           protocol = "openid-connect";
+        #           attributes = {
+        #             "realm_client" = "false";
+        #             "oidc.ciba.grant.enabled" = "false";
+        #             "client.secret.creation.time" = "1758824229";
+        #             "backchannel.logout.session.required" = "true";
+        #             "standard.token.exchange.enabled" = "false";
+        #             "frontchannel.logout.session.required" = "true";
+        #             "display.on.consent.screen" = "false";
+        #             "oauth2.device.authorization.grant.enabled" = "false";
+        #             "backchannel.logout.revoke.offline.tokens" = "false";
+        #           };
+        #           authenticationFlowBindingOverrides = { };
+        #           fullScopeAllowed = true;
+        #           nodeReRegistrationTimeout = -1;
+        #           defaultClientScopes = [
+        #             "web-origins"
+        #             "offline_access"
+        #             "profile"
+        #             "roles"
+        #             "basic"
+        #             "email"
+        #           ];
+        #           optionalClientScopes = [
+        #             "acr"
+        #             "address"
+        #             "phone"
+        #             "organization"
+        #             "microprofile-jwt"
+        #           ];
+        #           access = {
+        #             view = true;
+        #             configure = true;
+        #             manage = true;
+        #           };
+
+        #         }
+        #       ];
+        #       users = [
+        #         {
+        #           enabled = true;
+        #           firstName = "Christian";
+        #           lastName = "Bauer";
+        #           username = "cbauer";
+        #           email = "cbauer@localhost";
+        #           credentials = [
+        #             {
+        #               type = "password";
+        #               temporary = false;
+        #               value = "changeme";
+        #             }
+        #           ];
+        #         }
+        #       ];
+        #     }
+        #   )
+        # )
+      ];
     };
 
     nginx.virtualHosts.${domain} = {
@@ -29,5 +126,8 @@ in
       locations."/".proxyPass = "http://localhost:${toString port}";
     };
   };
-  sops.secrets.${dbPassKey} = { };
+  sops.secrets = {
+    ${dbPassKey} = { };
+    ${forgejoClientSecretKey} = { };
+  };
 }

hosts/pi4/nginx.nix

@@ -15,9 +15,7 @@ let
     inherit locations;
   };
   homelab = "http://${common.localIpAddr 231}";
-  nidaros = "http://${common.localIpAddr 228}";
-  homelabProxy = proxyTo homelab; # TODO get local ip from systems attrSet
-  nidarosProxy = proxyTo nidaros;
+  homelabProxy = proxyTo homelab; # TODO get homelab local ip from systems
   redirect = subdomain: {
     enableACME = true;
     forceSSL = true;
@@ -87,7 +85,6 @@ in
       # Donetick
       "chore.${domain}" = homelabProxy 2021;
       "recurring-events-api.${domain}" = homelabProxy 8095;
-      "iam.${domain}" = nidarosProxy 8081;
     };
   };
 

hosts/thinkpad/home-manager/default.nix

@@ -9,4 +9,6 @@
     ./hyprland
     ./zen
   ];
+
+  programs.git.signing.key = "848D71DE0590C199";
 }

justfile

@@ -69,11 +69,11 @@ generate-ssh:
 # Generate a new age key from an existing ssh key (without passphrase)
 generate-age-from-ssh:
     mkdir -p ~/.config/sops/age
-    nix run nixpkgs#ssh-to-age --experimental-features 'nix-command flakes' -- -private-key -i ~/.ssh/id_ed25519 > ~/.config/sops/age/keys.txt
+    nix run nixpkgs#ssh-to-age -- -private-key -i ~/.ssh/id_ed25519 > ~/.config/sops/age/keys.txt
 
 # Get a public age key from an existing age private key
 get-public-age-key:
-    nix shell nixpkgs#age --experimental-features 'nix-command flakes' -c age-keygen -y ~/.config/sops/age/keys.txt
+    nix shell nixpkgs#age -c age-keygen -y ~/.config/sops/age/keys.txt
 
 # Get the public ssh key from the current user
 get-public-ssh-key:
@@ -81,7 +81,7 @@ get-public-ssh-key:
 
 # Edit the SOPS secrets file
 edit-secrets:
-    nix run nixpkgs#sops --experimental-features 'nix-command flakes' -- shared/secrets/secrets.yaml
+    nix run nixpkgs#sops -- shared/secrets/secrets.yaml
 
 # Hash a string using the mkpasswd command
 hash PASS:

shared/base/home-manager/development/git.nix

@@ -1,9 +1,4 @@
-{
-  pkgs,
-  common,
-  systemConfig,
-  ...
-}:
+{ pkgs, common, ... }:
 
 {
   home.packages = with pkgs; [
@@ -28,14 +23,9 @@
         p = "push";
       };
 
-      signing = {
-        signByDefault = true;
-        key = systemConfig.git.signing.key;
-      };
+      signing.signByDefault = true;
 
       extraConfig = {
-        init.defaultBranch = "main";
-        advice.defaultBranchName = false;
         pull.rebase = true;
         push.autoSetupRemote = true;
         safe.directory = "/etc/nixos";

shared/base/home-manager/ssh.nix

@@ -5,24 +5,28 @@
   common,
   ...
 }:
+with builtins;
 
 {
   programs.ssh = {
     enable = true;
-    matchBlocks = builtins.mapAttrs (
-      hostName: system:
-      let
-        _hostName =
-          if (system ? address && system.address ? tailnet) then
-            system.address.tailnet
-          else
-            common.tailnetAddr hostName;
-      in
-      {
-        port = 22;
-        user = systemConfig.username;
-        hostname = _hostName;
-      }
-    ) systems;
+    matchBlocks = listToAttrs (
+      map (system: {
+        name = system.hostName;
+        value =
+          let
+            hostName =
+              if (system ? address && system.address ? tailnet) then
+                system.address.tailnet
+              else
+                common.tailnetAddr system.hostName;
+          in
+          {
+            port = 22;
+            user = systemConfig.username;
+            hostname = hostName;
+          };
+      }) systems
+    );
   };
 }

shared/base/modules/networking.nix

@@ -1,4 +1,4 @@
-{ pkgs, hostName, ... }:
+{ pkgs, systemConfig, ... }:
 
 {
   environment.systemPackages = with pkgs; [
@@ -7,7 +7,7 @@
 
   networking = {
     networkmanager.enable = true;
-    hostName = hostName;
+    hostName = systemConfig.hostName;
   };
 
   programs.ssh.enableAskPassword = false;

shared/base/modules/security/ssh.nix

@@ -1,28 +1,33 @@
 # /nix/store/<hash>/etc/ssh/ssh_config & /nix/store/<hash>/etc/ssh/authorized_keys
 {
-  lib,
   systemConfig,
   systems,
   knownSystems,
   common,
   ...
 }:
+with builtins;
 let
-  allSystems = knownSystems // systems;
+  allSystems = knownSystems ++ systems;
 in
 {
-  programs.ssh.knownHosts = builtins.mapAttrs (hostName: system: {
-    extraHostNames = [
-      (
-        if (system ? address && system.address ? tailnet) then
-          system.address.tailnet
-        else
-          common.tailnetAddr hostName
-      )
-    ];
-    publicKey = system.ssh.publicKey;
-  }) allSystems;
+  programs.ssh.knownHosts = listToAttrs (
+    map (system: {
+      name = system.hostName;
+      value = {
+        extraHostNames = [
+          (
+            if (system ? address && system.address ? tailnet) then
+              system.address.tailnet
+            else
+              common.tailnetAddr system.hostName
+          )
+        ];
+        publicKey = system.ssh.publicKey;
+      };
+    }) allSystems
+  );
   users.users.${systemConfig.username}.openssh.authorizedKeys.keys = (
-    lib.mapAttrsToList (_hostName: system: system.ssh.publicKey) allSystems
+    map (system: system.ssh.publicKey) allSystems
   );
 }

shared/secrets/secrets.yaml

@@ -1,55 +1,50 @@
 cloudflare:
-    api-token: ENC[AES256_GCM,data:vmmPUCCJJPa1ElN9njBHKjESGrE34oycJIjTmZfScN+zI3VpYeNi0A==,iv:P3m6zrFMdPSiPJn5sdCTw/2vr+R4s98tycyO7I/qKZU=,tag:zuqrLvkjV7v5iO5tA+Rq+A==,type:str]
+    api-token: ENC[AES256_GCM,data:UfTphnoN4REAue0bP5JKPfgvq36Jlxndl7dD46BKwg7ygW2Mj4mm4w==,iv:vS223ZAqACt1ZHJHCeztCVm+BghMhVYJfTuvBlySf+o=,tag:mxf6jL7/ItsxPOHb7S5upQ==,type:str]
 forgejo:
-    admin-pass: ENC[AES256_GCM,data:7QSF0usRgM59fTV8pf3pJdDA,iv:51Eud+ge4AXVOUNubXaY6hPYAbEL8Ue+aGlnWoJUO1g=,tag:VYtxk39yJ1NS8V3EMvZFAw==,type:str]
-    #ENC[AES256_GCM,data:QcBVOZQp1IZIICQMvYxn9NrbifM7iSvxslZWsuA6nfL/lw4=,iv:hZ0tRwf3GNCQ1+lolOdIEgXhAN2N4W4V9jV9hsDJ0iA=,tag:4TsivDKERKez8GPYPqzGaw==,type:comment]
-    runner-token: ENC[AES256_GCM,data:mhneM6PkXTOov1yE3Q0/c3YwwZuwfoQbcTnVj2X0AtsNnoPZcn1fw9/nTZCoAQ==,iv:T0Z0db9vJCBlgp22K4l28a/reohsEybuV+KVg4MyNcI=,tag:VIbD9W2JJtkTimBxZKUbcg==,type:str]
+    admin-pass: ENC[AES256_GCM,data:RGTOw0Yo5rJGEVLGsQgyk9Wc,iv:SuN770eAgFIVd4pJ6vmPIvVCMqTW/2sBUYUbqym2cHo=,tag:YlyNR/fFchdBwzCuIsWGMA==,type:str]
+    #ENC[AES256_GCM,data:oMpYBQ30sdCTtgxEZvYxTd9oi9QM0bYp5NisMdQHYT/nF2k=,iv:H9/g7XttJScVXV38+yHdbgWNFDhBYyudjK5BKHTt5wo=,tag:FNfkKfkKWDBUAXiGXkDchw==,type:comment]
+    runner-token: ENC[AES256_GCM,data:xbULBWrqosktW7XHViLH7Sk76upH31RFQNsBcXWWN7bpRadF3tpBA/hksMyEdg==,iv:v3vzUb5wsWeKWRYWT+ks4ZWGXQRhZ+td3N3bpuwoVc8=,tag:rEVoEw/QOSs8puujsRBxXQ==,type:str]
 keycloak:
-    database-pass: ENC[AES256_GCM,data:DkJPELSSrFDb4CkKCP3l+yWy,iv:y8U+31rPGDygl8HSnKyzgSGjZ7KiIw5nFA6C349nHFc=,tag:7IiU+GJAjHJjNHg//2TjYw==,type:str]
-password-hash: ENC[AES256_GCM,data:vauLFR3MW4gkQdSxZiGEp+0ZN2mZH+xPGZmwqR8BgLIRBmjx6Ufq3rQwtefEwJDGTw+/fvOeaUFtj1bphKnyTf0448D2L+Uytg==,iv:45l7Vvr0ycDQScADihDuou9FJrdUgC5PxOmsIqB2J0U=,tag:/KBo0CcGYsrmkGxOR8QqTQ==,type:str]
+    database-pass: ENC[AES256_GCM,data:+1lXS/wmBg/klmRqmSW3bZiZ,iv:iFYNIrBzYPBwjusHlPJj6EKDmGgGFmDLhiL+SEq6gHE=,tag:8CoF/94nyhaTHpkij59NGQ==,type:str]
+    realms:
+        forgejo:
+            client:
+                secret: ENC[AES256_GCM,data:CkjdtBemZd+JryPNoLA6MsGJKvYeoziOITJlZG1YhPA=,iv:yXi55RDYiwfwFde8W0EiNuo5T+ZNuuJdTOT2ydEpIXc=,tag:epXzDVifVGdasN6uHqmV+g==,type:str]
+password-hash: ENC[AES256_GCM,data:FsGHBAw/z4tcBRObVlo//UotWHyHns0+vdJVgt2lfGiIfQG+1I60g2Tzgv/O+gz3oz41NIwAYf61SR9AfXhpnc1AxiZRlCBwMQ==,iv:oiJndSVZQ+00UPz0TuJXV+T8x9mtecrNDUaablOGffU=,tag:wQuow7C8KqelJOE9KqCxMA==,type:str]
 mailserver:
-    password-hash: ENC[AES256_GCM,data:zQ242cSWVoGgN92oo1NSGkfUGpQ1vnwbAunFH18fwj36FgtrMgpFNKVhijB4az4LOQPYafat9XAoOpDc,iv:e7I3l0SLIoQbQs2fvFG3iyfiFP5zfo1egebkZMcaADM=,tag:jUww/lsREg4tbzqk9j7eUA==,type:str]
+    password-hash: ENC[AES256_GCM,data:H5PlCVuwUxIjtWbNsxb/ROkY2KiNhSwvWDvTLBfR596ijRTkaH0xtltsvHiiNHmfKERfcAXKO9EyGNHc,iv:qev1fs0PPydz8cm9D7hLp6ULgUEQJm+E0Pg86bor1to=,tag:zFnJ23NDCXeur+kvNSQV6w==,type:str]
 nextcloud:
-    admin-pass: ENC[AES256_GCM,data:K/rdgJ3sp96RoLsTIvcWjA==,iv:E7P+kvX1FnY09EyLdRtLw+pQEuAQKpnxsY7qOpOQJXA=,tag:XPbHOnwIN3HZrkZSuaIhvg==,type:str]
+    admin-pass: ENC[AES256_GCM,data:RBuuNc7J/CCJXG8n73B5cw==,iv:uKNj40SdJn6LbZoV1i9fq+5TGmRDPYVhCxAUghV4vqs=,tag:wUHBPo5T+2tyjsQFlUXDEQ==,type:str]
 sops:
     age:
         - recipient: age1j66v6z6hlsgqjfv5fz7fldm5q9jay4j5v5du6ymfda6hv40nsqesg89g7p
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRMXVLK0Z3ZXBnUm9DR09v
-            Q3JTODkrbkcvS0I0WUF1NWkwdGpjSEgxUTJjCmowUUNYRTUyVjBMQlM4TjF1cGxG
-            dGZHZm5hU2FYa2JMbWIvbVYwOVNkR28KLS0tIGVwVlJMTjYrSjlYRlphSkZhTTJI
-            T0dGQW9rRTUzRytYcGVjRW9wTExvUDQKKM8nkeIHJ7RKj1/8Qvmvck+dkln+bWEn
-            dsob0NlalJQGqNOeM7vib4MV/CAjP4Sq7nU4u9PQ3r/Y1FZ6Tg1l3Q==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyMHl6emFJdE4rVGduT2V1
+            Y1hFdlRxVHJ1NlV0R2JRZm5SMVVzVmpRQlM0CjhUN0dqajNpQXg4a29Ca1VLMDJ1
+            UmpsMFRJd254TlpGNzdDV2ZQTU9icDAKLS0tIG0wSVppUmU5TVdlMHhsQ3pMNDhJ
+            TFkrWitpb3h3UDhFNUN5Yi80YXlLbjQKxdG0m3CZ+elvzSNC9+aD15AOejkT5hJR
+            hhjtn+aUF8JvAIgggLqE1qU1XYIkbzk5//TWz5FaKeszinv9x8plvA==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1fxr5s6d6ar0xy5pr63kpq93tk7jha5k96jcxnyquj6s2mw8mmcpss8w29w
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0QzlmM1hBU21iWkFWRTlz
-            NXFEWjdlMzNpa1hmWFNnWHhwUGE2RGphK1JnCnUzYWt6NE5HK1RKeTc0YXdab254
-            Y1NYMUdaNFlMVVcyeEQzelZiU3ZQdHcKLS0tIExmcFk3akN6K3NZWVZtdmgvUjU5
-            bms3SG1hdDJsLzdDZmgycDM1cjJVbDAKnF+v5T1deA4z2er2hk4G2Kk56KapEgI+
-            n2e4yi4A5Uv0oJG2lp8ya1PZeK5z4LFi3HnYqNsCZtjzG6hsAVmvLQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzRGNSYjM2Qkx5M294QWVS
+            ZkJzR0VuTzdOR1FIc2c2bWx0akVPZVB0T1hvCmxuMjZWWlVmSUhKUys0QlMxMDV3
+            ZCt1ZjJNZlV5K0Zpd3NGcldhWDFDcjgKLS0tIG9mSHA1Um5Hb2NtVm5XRFdvVHVT
+            NHp1WThrcU1hOEI5RExCbVlnV2VYNlEKV4DSgHYs/zhF34h14RX2rvVXNo2uxCpD
+            uUiwU4and1T5Q09MOjqdbs2e7QM+VjKB4P/w34KkcqXTkJeR/IBF/g==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1xlnprpvshv93eerthxzg6cahklsfc4efh8dd6u8dte9u6cl0u5qsz48qlt
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRaVJxOGsrR2tkME9md0Qz
-            c0xDMDBVYWhBMzBRRWZybXN6THIwbXl4em1RCmoxenJKYVBMNThtNzFaS1NLS2l3
-            bXBnMlEvZklSZ1hnTCtDSFhSYUVOMlUKLS0tIEFJdCt2S0dBMmZic29ReGxZK0Ji
-            WkNIdzh5cERpN0JpMzVRME54bmdleXMKr6+azEKtBSSk+RzMRjrmedIEDnkr5rBY
-            /gWNWadyu6zGHGnaEsHy4ikQx3++tGfB6O3MjN2mncKLCICO6vCSYg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1c3p0N0c2RGJZMmxzcUgw
+            bHZhcnlnWlczSGJRMVJRNitqVmV6YThIRWlBCitWUzVCN25JbzhJeG9haEVORUk5
+            QmhIc0R0c0diNmNPc0dYM2YyNVdScVUKLS0tIG1waU1QYXNVMXU4bC9rNUxwUDIz
+            SGdNMnVlQlNEeVJkWmZEM1FRT2JJMGMKbZ/znJM6tFhzhHariRXMLgH/4CRZZKrb
+            YtmSdeL/Pd5YIecCpjDHDn4vQ0TBAmLaX+zVbNbRKmMZoY7777ywfA==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age1sf8tspnmyj2cn6gmzdfuh2vt00tmeqa0vf23rn5s44s9avafsd7sz6wgql
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmb0xmcDNqS0V0N3hGbjNK
-            anRIWElhWDBUbFd2TFpsMVNZTTBqZEtzTVZvCklvSEJ0dWNwYnR5NkNZVnJRTFhL
-            MVZDdWE4bEhSdVlpRTRDTlRWYmJaeU0KLS0tIEp2NjVUVFBPME1VNFVuQ3FSdVBY
-            YldpMnlOQWpvQ3NNVkJ3a043WGwybWsKnvMrgShgLuorobePyJii5AbZZ9L37Zwc
-            OjLaX7UhBx/gLUjDXKUJML0iulCWjPCrCdcd+UD2/Rk7t1G3SSMlQw==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-10-14T17:27:38Z"
-    mac: ENC[AES256_GCM,data:1jS6zxeavAd+u5iYB34Ds9zOfo8m1PXEwLhJzAhflwBrdpsp27U8A35O0SGfjrUNyyB2Rhl4CU0ImzuS4U3YDsVobl+4/nrVB/uNTjzpmSTiNTsGua1OxZXGyWwD8A0caWfwhMGIRsr8qgxyql+ezJOrA/BrGErb01HZ/7p8eu8=,iv:o/Q/CEUfWilnRHBK43QU3A+VOMJIVe5rXZjtzQXFe/c=,tag:FEheN+rvrdTG31R/PEGVUw==,type:str]
+    lastmodified: "2025-09-30T16:56:04Z"
+    mac: ENC[AES256_GCM,data:BFdEyBs/0hhgldAKVJ/E9gldpU8nyvNuRPP/Ye/ke3aqk+oWvcXJn9oOX47sFwaDQAlrM4E97/baygzIJFH+jkOPZYhlAxLA31KumB+d5WQedPP+yWrHfzwQCIIs6ye9Hl6VljVkMP8OMjGD+oNrm2XqfUkBL+Y3Mxpi0zdksFc=,iv:WXGVtK9EBIS2F1JNr3Nk0hy2fUsNlKkhpRJFR5u/H9U=,tag:JouBIk5rK5ZDdTvw2WWW1g==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.10.2

systems.nix

@@ -1,39 +0,0 @@
-{ common, ... }:
-let
-  defaultConfig = {
-    system = "x86_64-linux";
-    username = common.username;
-    version = common.system.version;
-    wayland.enable = true;
-    nvidia.enable = false;
-  };
-in
-builtins.mapAttrs (_hostName: systemConfig: defaultConfig // systemConfig) {
-  desktop = {
-    nvidia.enable = true;
-    ssh.publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMSzXyTuQyTrWsfORQbvgrqt/33+hfSUDXeMg6D1T2wz";
-    git.signing.key = "706F53DD087A91DE";
-  };
-  thinkpad = {
-    ssh.publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILNlHKE/BD8kKfhJD7GBk1A3whZf3gTjk9VEgGAj3qsH";
-    git.signing.key = "848D71DE0590C199";
-  };
-  pi4 = {
-    system = "aarch64-linux";
-    wayland.enable = false;
-    ssh.publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJE9m7YiITe1sDqSZ7Pa8luIw3WToLsypixZEqE4wCQE";
-    address.private = common.localIpAddr 188;
-    git.signing.key = "E3FA0E995C0D0E5E";
-  };
-  homelab = {
-    ssh.publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIARDv5nRlfPDXdV+Db4FaqeSJZ3/3MO0frYGzuVeqYAl";
-    address.private = common.localIpAddr 231;
-    address.tailnet = common.tailnetAddr "admin";
-  };
-  nidaros = {
-    wayland.enable = false;
-    ssh.publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILw1iNuPnX9NGt+UAvBDzkk26d1e4nF+XX2FMm+IRWtt";
-    address.private = common.localIpAddr 228;
-    git.signing.key = "4E323F914029E976";
-  };
-}