WIP: gitea: Migrate to forgejo

.sops.yaml

@@ -1,7 +1,7 @@
 keys:
   - &tlater 535B61015823443941C744DD12264F6BBDFABA89
   - &server_tlaternet 8a3737d48f1035fe6c3a0a8fd6a1976ca74c7f3b
-  - &server_staging 7762ec55a5727cabada621d961e53f94caa314e4
+  - &server_staging 2f5caa73e7ceea4fcc8d2881fde587e6737d2dbc
 
 creation_rules:
   - path_regex: keys/production.yaml

configuration/hardware-specific/vm.nix

@@ -16,6 +16,22 @@
     networkConfig.DHCP = "yes";
   };
 
+  # Both so we have a predictable key for the staging env, as well as
+  # to have a static key for decrypting the sops secrets for the
+  # staging env.
+  environment.etc."staging.key" = {
+    mode = "0400";
+    source = ../../keys/hosts/staging.key;
+  };
+
+  services.openssh.hostKeys = lib.mkForce [
+    {
+      type = "rsa";
+      bits = 4096;
+      path = "/etc/staging.key";
+    }
+  ];
+
   # # Set up VM settings to match real VPS
   # virtualisation.memorySize = 3941;
   # virtualisation.cores = 2;

configuration/services/gitea.nix

@@ -6,12 +6,10 @@
 }: let
   domain = "gitea.${config.services.nginx.domain}";
 in {
-  services.gitea = {
+  services.forgejo = {
     enable = true;
     database.type = "postgres";
 
-    appName = "Gitea: Git with a cup of tea";
-
     settings = {
       server = {
         DOMAIN = domain;
@@ -29,18 +27,18 @@ in {
     };
   };
 
-  systemd.services.gitea.serviceConfig.ExecStartPre = let
+  systemd.services.forgejo.serviceConfig.ExecStartPre = let
     replaceSecretBin = "${pkgs.replace-secret}/bin/replace-secret";
-    secretPath = config.sops.secrets."gitea/metrics-token".path;
+    secretPath = config.sops.secrets."forgejo/metrics-token".path;
-    runConfig = "${config.services.gitea.customDir}/conf/app.ini";
+    runConfig = "${config.services.forgejo.customDir}/conf/app.ini";
   in [
     "+${replaceSecretBin} '#metricstoken#' '${secretPath}' '${runConfig}'"
   ];
 
   # Set up SSL
   services.nginx.virtualHosts."${domain}" = let
-    httpAddress = config.services.gitea.settings.server.HTTP_ADDR;
+    httpAddress = config.services.forgejo.settings.server.HTTP_ADDR;
-    httpPort = config.services.gitea.settings.server.HTTP_PORT;
+    httpPort = config.services.forgejo.settings.server.HTTP_PORT;
   in {
     forceSSL = true;
     enableACME = true;
@@ -62,40 +60,39 @@ in {
 
   # Block repeated failed login attempts
   #
-  # TODO(tlater): Update to the new regex, since apparently this one
+  # TODO(tlater): Update this - we switched to forgejo, who knows what
-  # is deprecated (but the new one doesn't work on the current version
+  # the new matches are.
-  # of gitea yet): https://docs.gitea.io/en-us/fail2ban-setup/
+  # environment.etc = {
-  environment.etc = {
+  #   "fail2ban/filter.d/gitea.conf".text = ''
-    "fail2ban/filter.d/gitea.conf".text = ''
+  #     [Definition]
-      [Definition]
+  #     failregex = .*(Failed authentication attempt|invalid credentials|Attempted access of unknown user).* from <HOST>
-      failregex = .*(Failed authentication attempt|invalid credentials|Attempted access of unknown user).* from <HOST>
+  #     journalmatch = _SYSTEMD_UNIT=forgejo.service + _COMM=forgejo + SYSLOG_IDENTIFIER=forgejo
-      journalmatch = _SYSTEMD_UNIT=gitea.service + _COMM=gitea + SYSLOG_IDENTIFIER=gitea
+  #   '';
-    '';
+  # };
-  };
 
-  services.fail2ban.jails = {
+  # services.fail2ban.jails = {
-    gitea = ''
+  #   gitea = ''
-      enabled = true
+  #     enabled = true
-    '';
+  #   '';
-  };
+  # };
 
-  services.backups.gitea = {
+  # services.backups.forgejo = {
-    user = "gitea";
+  #   user = "forgejo";
-    paths = [
+  #   paths = [
-      "/var/lib/gitea/gitea-db.sql"
+  #     "/var/lib/forgejo/forgejo-db.sql"
-      "/var/lib/gitea/repositories/"
+  #     "/var/lib/forgejo/repositories/"
-      "/var/lib/gitea/data/"
+  #     "/var/lib/forgejo/data/"
-      "/var/lib/gitea/custom/"
+  #     "/var/lib/forgejo/custom/"
-      # Conf is backed up via nix
+  #     # Conf is backed up via nix
-    ];
+  #   ];
-    preparation = {
+  #   preparation = {
-      packages = [config.services.postgresql.package];
+  #     packages = [config.services.postgresql.package];
-      text = "pg_dump ${config.services.gitea.database.name} --file=/var/lib/gitea/gitea-db.sql";
+  #     text = "pg_dump ${config.services.forgejo.database.name} --file=/var/lib/forgejo/forgejo-db.sql";
-    };
+  #   };
-    cleanup = {
+  #   cleanup = {
-      packages = [pkgs.coreutils];
+  #     packages = [pkgs.coreutils];
-      text = "rm /var/lib/gitea/gitea-db.sql";
+  #     text = "rm /var/lib/forgejo/forgejo-db.sql";
-    };
+  #   };
-    pauseServices = ["gitea.service"];
+  #   pauseServices = ["forgejo.service"];
-  };
+  # };
 }

configuration/services/metrics/victoriametrics.nix

@@ -6,9 +6,9 @@
     ];
 
     scrapeConfigs = {
-      gitea = {
+      forgejo = {
-        targets = ["127.0.0.1:${toString config.services.gitea.settings.server.HTTP_PORT}"];
+        targets = ["127.0.0.1:${toString config.services.forgejo.settings.server.HTTP_PORT}"];
-        extraSettings.authorization.credentials_file = config.sops.secrets."gitea/metrics-token".path;
+        extraSettings.authorization.credentials_file = config.sops.secrets."forgejo/metrics-token".path;
       };
       coturn.targets = ["127.0.0.1:9641"];
     };

configuration/services/nextcloud.nix

@@ -11,7 +11,6 @@ in {
     inherit hostName;
 
     package = nextcloud;
-    enableBrokenCiphersForSSE = false;
     enable = true;
     maxUploadSize = "2G";
     https = true;
@@ -30,11 +29,9 @@ in {
       defaultPhoneRegion = "AT";
     };
 
-    phpOptions =
+    phpOptions = {
-      options.services.nextcloud.phpOptions.default
+      "opcache.interned_strings_buffer" = "16";
-      // {
+    };
-        "opcache.interned_strings_buffer" = "16";
-      };
 
     extraApps = {
       inherit (pkgs.local) bookmarks calendar contacts cookbook news notes;

configuration/services/postgres.nix

@@ -18,15 +18,11 @@
     ensureUsers = [
       {
         name = "grafana";
-        ensurePermissions = {
+        ensureDBOwnership = true;
-          "DATABASE grafana" = "ALL PRIVILEGES";
-        };
       }
       {
         name = "nextcloud";
-        ensurePermissions = {
+        ensureDBOwnership = true;
-          "DATABASE nextcloud" = "ALL PRIVILEGES";
-        };
       }
     ];
 

configuration/sops.nix

@@ -4,8 +4,8 @@
 
     secrets = {
       # Gitea
-      "gitea/metrics-token" = {
+      "forgejo/metrics-token" = {
-        owner = "gitea";
+        owner = "forgejo";
         group = "metrics";
         mode = "0440";
       };

flake.lock

@@ -41,11 +41,11 @@
         "utils": "utils"
       },
       "locked": {
-        "lastModified": 1694513707,
+        "lastModified": 1703087360,
-        "narHash": "sha256-wE5kHco3+FQjc+MwTPwLVqYz4hM7uno2CgXDXUFMCpc=",
+        "narHash": "sha256-0VUbWBW8VyiDRuimMuLsEO4elGuUw/nc2WDeuO1eN1M=",
         "owner": "serokell",
         "repo": "deploy-rs",
-        "rev": "31c32fb2959103a796e07bbe47e0a5e287c343a8",
+        "rev": "b709d63debafce9f5645a5ba550c9e0983b3d1f7",
         "type": "github"
       },
       "original": {
@@ -160,11 +160,11 @@
     "flake-compat": {
       "flake": false,
       "locked": {
-        "lastModified": 1668681692,
+        "lastModified": 1696426674,
-        "narHash": "sha256-Ht91NGdewz8IQLtWZ9LCeNXMSXHUss+9COoqu6JLmXU=",
+        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
         "owner": "edolstra",
         "repo": "flake-compat",
-        "rev": "009399224d5e398d03b22badca40a37ac85412a1",
+        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
         "type": "github"
       },
       "original": {
@@ -229,7 +229,7 @@
     },
     "flake-utils": {
       "inputs": {
-        "systems": "systems"
+        "systems": "systems_2"
       },
       "locked": {
         "lastModified": 1692799911,
@@ -267,11 +267,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1691701569,
+        "lastModified": 1701473318,
-        "narHash": "sha256-7TK+sO+JC37OGTQDTiz9TriqbB5yTgoo7fyPyLtWvd8=",
+        "narHash": "sha256-QdCJN8GeNl/V8wMjrvNkrWzNXnahgfjBfCSya4qQdrc=",
         "owner": "reckenrode",
         "repo": "nix-foundryvtt",
-        "rev": "3358ccef0ea3e06faabe8c54761fb8a0862b80d4",
+        "rev": "f624c0ceabe13dd876ecff871e0dc7f55f96e993",
         "type": "github"
       },
       "original": {
@@ -345,11 +345,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1671417167,
+        "lastModified": 1702272962,
-        "narHash": "sha256-JkHam6WQOwZN1t2C2sbp1TqMv3TVRjzrdoejqfefwrM=",
+        "narHash": "sha256-D+zHwkwPc6oYQ4G3A1HuadopqRwUY/JkMwHz1YF7j4Q=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "bb31220cca6d044baa6dc2715b07497a2a7c4bc7",
+        "rev": "e97b3e4186bcadf0ef1b6be22b8558eab1cdeb5d",
         "type": "github"
       },
       "original": {
@@ -361,11 +361,11 @@
     },
     "nixpkgs-stable": {
       "locked": {
-        "lastModified": 1693675694,
+        "lastModified": 1703351344,
-        "narHash": "sha256-2pIOyQwGyy2FtFAUIb8YeKVmOCcPOTVphbAvmshudLE=",
+        "narHash": "sha256-9FEelzftkE9UaJ5nqxidaJJPEhe9TPhbypLHmc2Mysc=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "5601118d39ca9105f8e7b39d4c221d3388c0419d",
+        "rev": "7790e078f8979a9fcd543f9a47427eeaba38f268",
         "type": "github"
       },
       "original": {
@@ -377,11 +377,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1694767346,
+        "lastModified": 1703637592,
-        "narHash": "sha256-5uH27SiVFUwsTsqC5rs3kS7pBoNhtoy9QfTP9BmknGk=",
+        "narHash": "sha256-8MXjxU0RfFfzl57Zy3OfXCITS0qWDNLzlBAdwxGZwfY=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "ace5093e36ab1e95cb9463863491bee90d5a4183",
+        "rev": "cfc3698c31b1fb9cdcf10f36c9643460264d0ca8",
         "type": "github"
       },
       "original": {
@@ -408,16 +408,16 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1694937365,
+        "lastModified": 1703467016,
-        "narHash": "sha256-iHZSGrb9gVpZRR4B2ishUN/1LRKWtSHZNO37C8z1SmA=",
+        "narHash": "sha256-/5A/dNPhbQx/Oa2d+Get174eNI3LERQ7u6WTWOlR1eQ=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "5d017a8822e0907fb96f7700a319f9fe2434de02",
+        "rev": "d02d818f22c777aa4e854efc3242ec451e5d462a",
         "type": "github"
       },
       "original": {
         "owner": "nixos",
-        "ref": "nixos-23.05",
+        "ref": "nixos-23.11",
         "repo": "nixpkgs",
         "type": "github"
       }
@@ -556,11 +556,11 @@
         "nixpkgs-stable": "nixpkgs-stable"
       },
       "locked": {
-        "lastModified": 1694495315,
+        "lastModified": 1703387502,
-        "narHash": "sha256-sZEYXs9T1NVHZSSbMqBEtEm2PGa7dEDcx0ttQkArORc=",
+        "narHash": "sha256-JnWuQmyanPtF8c5yAEFXVWzaIlMxA3EAZCh8XNvnVqE=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "ea208e55f8742fdcc0986b256bdfa8986f5e4415",
+        "rev": "e523e89763ff45f0a6cf15bcb1092636b1da9ed3",
         "type": "github"
       },
       "original": {
@@ -584,6 +584,21 @@
         "type": "github"
       }
     },
+    "systems_2": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
     "tlaternet-webserver": {
       "inputs": {
         "dream2nix": "dream2nix",
@@ -607,12 +622,15 @@
       }
     },
     "utils": {
+      "inputs": {
+        "systems": "systems"
+      },
       "locked": {
-        "lastModified": 1667395993,
+        "lastModified": 1701680307,
-        "narHash": "sha256-nuEHfE/LcWyuSWnS8t12N1wc105Qtau+/OdUAjtQ0rA=",
+        "narHash": "sha256-kAuep2h5ajznlPMD9rnQyffWG8EM/C73lejGofXvdM8=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "5aed5285a952e0b949eb3ba02c12fa4fcfef535f",
+        "rev": "4022d587cbbfd70fe950c1e2083a02621806a725",
         "type": "github"
       },
       "original": {

flake.nix

@@ -2,7 +2,7 @@
   description = "tlater.net host configuration";
 
   inputs = {
-    nixpkgs.url = "github:nixos/nixpkgs/nixos-23.05";
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-23.11";
     nixpkgs-unstable.url = "github:nixos/nixpkgs/nixos-unstable";
     deploy-rs.url = "github:serokell/deploy-rs";
     sops-nix = {

keys/hosts/staging.asc

@@ -1,28 +1,28 @@
 -----BEGIN PGP PUBLIC KEY BLOCK-----
 
-xsFNBAAAAAABEAC32/CXnt4LDPdPZppQ0GcJAxVFHFu8SCl5WnU/PVPEnwgRkV8V
+xsFNBAAAAAABEADFaVmT5Xt4+nCM2hZ+Zq7Uybg26TISSrpU/3nZ+qxZSC65mqfB
-ZeyQN4qgT5LPWgPYyDyAqUHBUwRxvVcguw0fOlDBZ3nECKQxZ53OVlay7xfhgXO1
+qWNR1kCpJpDvhwUhaTC2x00L/ckRoPcF60AqYR632owQ0AgyuG+xR0HJR5rpWzRs
-luNu657u5VYtxfLqx7lVHfY/TWp5DBOOEpOtoKfz031Zbg11+kdxW5eEg2ypCTvn
+cMINk1NOLQ4Vw9IaRykfx5YtKL3mPo8iLNQom6SkFG1hPqwoAzzWNLBLKMfKrDtW
-+MVQgRH9AQI+0+jegQ9On3X9UaVdc8etuY/F8BAEwLCCbYpLUEUXwOo4YLB36Kg3
+uBnsbGLrkAB/2eJBw9xDmpMpLV5f2lJDA89RQYV8YQhe4TBL9B0WSSc9CqX9TP6m
-P27q15Nl6g5P/oFEdS3fhHbh9636lJnxJcTTjAfJaDoQJ5rGDASiT8HJnkNWfrf/
+30zY6jCWvfYL+Hi+YiR2K+dp9qXB55ViYcw8hRG99n5fSyZSB0hyttnIV76G0I27
-yzLMOiy6fRRIz8HTXKeZNeRvCPu1uHaWYi0RprWMu1HZ0cLzr5N2lHKcWgL8En5b
+McFueWu6LzZ/lMEJM8OeFVgyMJFMVXHCBxLYHLqlJvxk4tV43Jkl4IOn4gBgG2oS
-fPyqldFfJBlY36L59F7hTk10QBgqFhibcXB44iK96jnYw6LgSuFkbfrJr7fx67JN
+7Sk1woz57UNug/AGcGAHL/YAbk+WcEut2RiwoTUEyQpRrP4QPnZivEkeTs0H4lf3
-lM2Xi4WXvzkp3gboDxd2Xy3ChQrQXmXcVAl8XNs78f5AQh5MJP6iC7ayiIsHq4aH
+3SHW6snMdcCDkjO6VCo9DTsSpX8eNLj9hW8UMuUMsU3jLtV4L2TMoDnqRHO7icbC
-rGVLhbncfKpw4OL9jVNTyRinwpvl5qibLAJbDA7arn8XqT6FT0KjeLa91jTFLHGn
+r+3CIi/yA5EWry/AReOPTFY+etX3XrVUUdA/SJL/OXLB8QD2jW0XbVeaHLgdhlt5
-9IkJol+L0/zYrpyiid5ZKNJMousxJoXymzRkeYllr+nLjKNLv0L3MCnsiPEZ23iL
+UeDwSWDYHn4LXYr8SXa3YKC2OmIAU8yNInPCGizHPm8IZVG4zjzPNjM3BihxpZjj
-y2/UZ6Vcjrs50L46VuiewCEaVbBp1H9Ps5eUa2YoJ65sfe7wnscXI8oOpQARAQAB
+IVajFe07INd8sM6RXE+YA0QTmEDoGW2QcltRyHdAPz5XVkRypbV5ONZLTQARAQAB
 zSlyb290IChJbXBvcnRlZCBmcm9tIFNTSCkgPHJvb3RAbG9jYWxob3N0PsLBYgQT
-AQgAFgUCAAAAAAkQYeU/lMqjFOQCGw8CGQEAAEKvEABZo9JRHnwrKr7UGmynctmF
+AQgAFgUCAAAAAAkQ/eWH5nN9LbwCGw8CGQEAAM6kEACsZmMOZd5qMOOJReo/cu5p
-aR+1KApeWrqahhobgfvMjJLfnUV7UDSeiuf3juoZC+L1d8LqEp0czcqU1YuGtjTT
+8JcXZ1c3wAUGm/Nw7xN68AGxHHWqUJqs5hGqICqSxnjtDD95H5tb9ahrEIxszfVd
-Yk/4WDwc7G9MjHDgVXPZlQ/qxSYBFwowbUkfhj49UA4Np2PW3yLtoZnBHLz6tmaD
+fj/CR1XRu4Scu7MZ45u4q/whLIwe1vqROmL1G0bR52WVvaHjcS+2h3NlxauO8bld
-mTtdNjzEw+L0GQ9Wi2pQYSUV4I9URF/NH7NGmurNl8Y5SHb3rqFQ4CPGXk5UQYL5
+uCwwQrCEBv86XjCZNtcVWEjqBffIfJQYAywyprqL3LGB5ypuW1tb/fnTZSd/1k9D
-s0ZdArwgWNH+ceC1Kq0baKu5WJINFfCIJbJajATBqgPy6FPEmhUdgt8awOp01oEc
+3LZ26FRvPd8XsBAZ5zSilpTdE9yhDPQb49VLP4iVwPkIjbw0us1KxlGJapU1nYfx
-zs2930sc6YY5GJVEGnxR/qBLTA5lANS1mpqHd9s4YF7jj8h/q8SV4iegTeKHrLox
+pX23F1f3tRGah/QOuZYa9J2dnr8A9FJQ+x616nrxnJ4DIRsS/mG+ES1HiVKa9u+2
-v1bP+QzHquCn7BpO9V6GD/eaqBKfx6k6+HDb5YmKnBvBV/c3yJ6wiv1H32nauWs1
+ZHxXqRHY+eb2QYaWI25F4BYrADOMcDLHvNL4T8E21Nt7QJ0hUeTeMCROICoVOtF9
-CgiJNYV+A/+YnWf0uPRqelAzT06JUtnSBZ0ppKLR68X3IKisXVNzW/3pM/ZWWfFM
+JNaHwD7AhOIwZHA28WNcrDoOpYmXXeRd+Vohvx5LO0loq/3dQdr5KMH/VGVP0VzK
-uKHCoppH2iuStn2wPkdjJD4UHduAFyF1oj1jFwP9r+EuhhPH1qr40405jRdOR98P
+YgPjh+z7HT66oMUz1fOeWtIqzLj7Un6rfodfq50OouDwhkAGseupDHnY2MBrfi6v
-RuPhrSkLBdWiUlNintDOyFzNbKXMZlreZeATeT5y/H+IF3CDvgAhBo7KqhfBfgUK
+fexpttnBuOx5NSeuYYxkWK8cUfAFVFO5bFCb3MW1e2waaiceS1vq3dXiZx3l23Pr
-6P/1xk8DozTmlsKY/cOsK0aL47CJcg8LU6tHrxa8uP6qV2HbUD31WbCRr1eL8k2G
+qOs7Ahdz5P4/GZGjIDKNrdLid5tfBI12hxFOSuXoF7G9Ak24a77A9qks40NL6TMi
-xszxEVPuKG8ckw58WpT4vA==
+hK7IB8p3wuRzngwa0WY3QQ==
-=kJ/7
+=6Ym/
------END PGP PUBLIC KEY BLOCK-----
+-----END PGP PUBLIC KEY BLOCK-----

keys/hosts/staging.key

@@ -0,0 +1,49 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAACFwAAAAdzc2gtcn
+NhAAAAAwEAAQAAAgEAxWlZk+V7ePpwjNoWfmau1Mm4NukyEkq6VP952fqsWUguuZqnwalj
+UdZAqSaQ74cFIWkwtsdNC/3JEaD3BetAKmEet9qMENAIMrhvsUdByUea6Vs0bHDCDZNTTi
+0OFcPSGkcpH8eWLSi95j6PIizUKJukpBRtYT6sKAM81jSwSyjHyqw7VrgZ7Gxi65AAf9ni
+QcPcQ5qTKS1eX9pSQwPPUUGFfGEIXuEwS/QdFkknPQql/Uz+pt9M2Oowlr32C/h4vmIkdi
+vnafalweeVYmHMPIURvfZ+X0smUgdIcrbZyFe+htCNuzHBbnlrui82f5TBCTPDnhVYMjCR
+TFVxwgcS2By6pSb8ZOLVeNyZJeCDp+IAYBtqEu0pNcKM+e1DboPwBnBgBy/2AG5PlnBLrd
+kYsKE1BMkKUaz+ED52YrxJHk7NB+JX990h1urJzHXAg5IzulQqPQ07EqV/HjS4/YVvFDLl
+DLFN4y7VeC9kzKA56kRzu4nGwq/twiIv8gORFq8vwEXjj0xWPnrV9161VFHQP0iS/zlywf
+EA9o1tF21Xmhy4HYZbeVHg8Elg2B5+C12K/El2t2CgtjpiAFPMjSJzwhosxz5vCGVRuM48
+zzYzNwYocaWY4yFWoxXtOyDXfLDOkVxPmANEE5hA6BltkHJbUch3QD8+V1ZEcqW1eTjWS0
+0AAAdAO1rPtDtaz7QAAAAHc3NoLXJzYQAAAgEAxWlZk+V7ePpwjNoWfmau1Mm4NukyEkq6
+VP952fqsWUguuZqnwaljUdZAqSaQ74cFIWkwtsdNC/3JEaD3BetAKmEet9qMENAIMrhvsU
+dByUea6Vs0bHDCDZNTTi0OFcPSGkcpH8eWLSi95j6PIizUKJukpBRtYT6sKAM81jSwSyjH
+yqw7VrgZ7Gxi65AAf9niQcPcQ5qTKS1eX9pSQwPPUUGFfGEIXuEwS/QdFkknPQql/Uz+pt
+9M2Oowlr32C/h4vmIkdivnafalweeVYmHMPIURvfZ+X0smUgdIcrbZyFe+htCNuzHBbnlr
+ui82f5TBCTPDnhVYMjCRTFVxwgcS2By6pSb8ZOLVeNyZJeCDp+IAYBtqEu0pNcKM+e1Dbo
+PwBnBgBy/2AG5PlnBLrdkYsKE1BMkKUaz+ED52YrxJHk7NB+JX990h1urJzHXAg5IzulQq
+PQ07EqV/HjS4/YVvFDLlDLFN4y7VeC9kzKA56kRzu4nGwq/twiIv8gORFq8vwEXjj0xWPn
+rV9161VFHQP0iS/zlywfEA9o1tF21Xmhy4HYZbeVHg8Elg2B5+C12K/El2t2CgtjpiAFPM
+jSJzwhosxz5vCGVRuM48zzYzNwYocaWY4yFWoxXtOyDXfLDOkVxPmANEE5hA6BltkHJbUc
+h3QD8+V1ZEcqW1eTjWS00AAAADAQABAAACAFMv1CQK+U9e9UudYQotufGH+V0GQmfL3p4P
+s+jDhZnv3WSwA44Lk4M6TjAZRMzysBpGqdTzwgdSD8cidcWkPvs8xsWBzjENgM7iwopJNT
+Mcve4k1T/2+gbfdKTGPp+0T1ZscytlnuZzuyYJaaZkjph4EdZklzz5vHD2AE5hkIJzclF4
+515hIOdsOvj5ywQVLA87ehdwzR92c0TgCncb5WJfwmDJwM2+hewTt6ga9nJ2CMFnDw4Bne
+/wK75x2PttXnAXijbTxGX2Hh5KOLxm6rn79yB9/P2p/MFnOUPBwp72Pp6vxnHCAzlK6Dbi
+S0xSwk9e5Uk5xFsN9URd4xx4f5scwxyk8RQCh/sMqn3JIOwodNwVjv+AWc3YNFR+aP+qXR
+wggXSypKDbVIAp2+cGKCobktNBiM/fEPMHe20Ssn+SBclUSeAYMpjRrn8Kxwb2oSMASrsV
+1ykyY+/j+Xb3jC2V+/XTV+5WtKt4SW4RV45g/+C65H+zy+56BoyPqJKyI8d3FB0dp/ICwo
+zfrmo/X00XF77d3ZThLoapSnOVeaNIiFtG5Ia635gNUyr/81xNhOeX5NMBUHSqdxrtZfC2
+PeuBcspWOg2tp/6UPjBppwrT3VnM/K27lqmDx9jPE4tMY4kl55KdSJ4uBr7H5Lu6w2zNnZ
+zGYToWbhXNDHqm9PqPAAABAQCCBatZmvEyP+7+qBFkvU1t8nseupa/Lu6Va5qV9ZLvUI0Q
+8nMYMZ/lMMB6TROyy9OJY59srkCjyF7COqNH6A/eo2XBCVdkAEBpUta8gzbLTtzRaDY+tH
+64tzDJYTLPumfE1M2IfztVwVgJuwrz/t6eAtakXfjNRG8nKVlTI5UALRLIIqVK5ReDs5NU
+7FbO5MwYtrsVHmpiXqNA8d1pZkjXNmU+I67DblPTCWraNnEC6mcIgau9n+mGuQjrHzpUqn
+kbQF3GSJTwgJSlKhkNGLyH4qrFsK0yemCkxKtzi1fXy/iLKXUG2A1uovuugXwQZmV7nHRM
++oDKZz13CWk14kDtAAABAQD07kRtO22XTklTf3w/cC67aVj+Ltifl0bVwbsFgY9zu0F7yl
+odYYfxV/rDn639V80JoAaTZ3lSuBvOwgtGWr298rwkkkV4CLKu7+bTLdS2L9YScKmKL8N+
+FGoYgVCTZZxaUe49eUdLaUcjxYTPC5FWGFCztLG7uAvydIbTFKG6++j4poow6q2AwejC8f
+ZiO2r0srZM1ouYW5j+6YCbLCKKcgJdZvZFBhDXyHwQXF5rCtB8htg6BgsTu3Fx6oZR3PXc
+RoO5A2CmoZ3bUSAzUOH4g80yB6Fq0dvpFr1CtzzNCda5TLNS6ediLqlP62NEez+wduv+Rs
+Xd+EhFect0lmETAAABAQDOVU7PqTLZFTxUx++JVFmdrd5FqTHwOrnEYWo8Hzx8X4RomIBg
+kY4oIGLXsBfZINyWKOKjQqhfh+nRgsCR7OQ9IjeWh/0eRma6b9kjBQT4UKYvylBjchoVci
+6DrxXWhwbRTCV2Vxpn/+Bx2JexUJx5oQ8yZ7a/H/w9J5GjgT3OR6d/ogzHr3FqdeAnvUle
+PBlaCZUQxuI2ADmdWpzxwmCalAxrLQiUCdRtY6X8TWYi35DWvGgVU1nz5VWYRvI1/+pQdt
+Qe9lP4uFNOpc05G7xcloEe+wE4aIqL4fLGVOrOqtHOps1W62Owk8iU7OFXw6Aoc4yjNWcj
+SEsRv2HtGI4fAAAACnRsYXRlckB5dWk=
+-----END OPENSSH PRIVATE KEY-----

keys/hosts/staging.key.pub

@@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDFaVmT5Xt4+nCM2hZ+Zq7Uybg26TISSrpU/3nZ+qxZSC65mqfBqWNR1kCpJpDvhwUhaTC2x00L/ckRoPcF60AqYR632owQ0AgyuG+xR0HJR5rpWzRscMINk1NOLQ4Vw9IaRykfx5YtKL3mPo8iLNQom6SkFG1hPqwoAzzWNLBLKMfKrDtWuBnsbGLrkAB/2eJBw9xDmpMpLV5f2lJDA89RQYV8YQhe4TBL9B0WSSc9CqX9TP6m30zY6jCWvfYL+Hi+YiR2K+dp9qXB55ViYcw8hRG99n5fSyZSB0hyttnIV76G0I27McFueWu6LzZ/lMEJM8OeFVgyMJFMVXHCBxLYHLqlJvxk4tV43Jkl4IOn4gBgG2oS7Sk1woz57UNug/AGcGAHL/YAbk+WcEut2RiwoTUEyQpRrP4QPnZivEkeTs0H4lf33SHW6snMdcCDkjO6VCo9DTsSpX8eNLj9hW8UMuUMsU3jLtV4L2TMoDnqRHO7icbCr+3CIi/yA5EWry/AReOPTFY+etX3XrVUUdA/SJL/OXLB8QD2jW0XbVeaHLgdhlt5UeDwSWDYHn4LXYr8SXa3YKC2OmIAU8yNInPCGizHPm8IZVG4zjzPNjM3BihxpZjjIVajFe07INd8sM6RXE+YA0QTmEDoGW2QcltRyHdAPz5XVkRypbV5ONZLTQ== tlater@yui

keys/production.yaml

@@ -1,5 +1,5 @@
-gitea:
+forgejo:
-    metrics-token: ENC[AES256_GCM,data:/7/zvVl2ZOBoekrJR32vl/QQcG5XqTmltgpHEMUpbXVeqwnq29idzE2Qyjau96ZHObmSI73/ZtW95uXF6LH9Qw==,iv:iWZECCZSh1CN7wMBqstXR5QWtriR7QLKVqhekGnpXl0=,tag:HEr9km8VYmruBzf0I/5HuA==,type:str]
+    metrics-token: ENC[AES256_GCM,data:WVbD5JloJlHNjeEwe1uEd4Haj6L3ilj1Pnux6yrelUQP18ZPAh90aDO1OIZHaPJR7tTeyATr8BIzZL1zkNhCuA==,iv:eTYXN3hymIN3bTX1YxNGkAYE0KVDbdz2ds8UQAHlALE=,tag:A61loGdu0pfsiez96u2Qsg==,type:str]
 grafana:
     adminPassword: ENC[AES256_GCM,data:/qw//J7cOkIGa58bG4GgdzndvKof32AmQeWB00IX8WhA22PDCOc4VdUEoB3wVJJqI/ucoHFInYyhg2rFYoYBesBjAt0QS3+O+8WblIunUuYeqlBuYJJK1TLhy6ql6+aqvfiW/rJLm4LpgA7CboyDD2OYHcAbvGSD2GWwFcHTR/Y=,iv:KK6p8GKzc9SBDZZFkEwCdIjSxriPGNMDNcr97tfbwTI=,tag:gLRNSGdJWFD+V9K5TfJvXw==,type:str]
     secretKey: ENC[AES256_GCM,data:OUXWOE6I3a26SrFEOczWNIwyR3Rx62fbsRBBcfh0xyEbxOIPhexH6lIqlVG9Ltwra9+rAldNM4/0BydtxIDj7A==,iv:fiNO/or5yZnhpDPMANDnEC5dtXmbKBZsV+BPmvCN/HI=,tag:Q0M0OtLWdWAJgQmUlL//fg==,type:str]
@@ -26,8 +26,8 @@ sops:
     azure_kv: []
     hc_vault: []
     age: []
-    lastmodified: "2023-10-12T18:40:26Z"
+    lastmodified: "2023-12-28T00:07:08Z"
-    mac: ENC[AES256_GCM,data:F+yQ20jCtLRKeQDFVKoqrYCgtwGkXxrK6aQO0MFZTIMJAnbTVPM2ZJGQ1RxXb+Zs4T+44EEc2xN4LjeANvgpE6MfOz2VTw+sEEjcYwUyB6RcXHia9XlFLa8lh7/Wx/9DxlSFjjSrxmDkNB6r+n5UF81cdRXF2E9ibdH346ST98A=,iv:xVxFN1IDKrLskaGqnWvOWx1zUII0jRSjQxEsaTf2GNw=,tag:lnp1AvgMOXXlg1vFjHEWUQ==,type:str]
+    mac: ENC[AES256_GCM,data:P2bNJLjzn69Kg2bJHXmofER7J8wbEj9C4jq9ePWewXBOt45GEiqgnqIaISwZkyzQmm9cxZd95Lr780ICwoKDFdtSCCcC7CdYxYEfyyhnvU3W2qzEghvkypL8JbiEtPSlQ9xOlCk7p41A9eRrV+JziIVSv5UEUs4NubrG9Mkwv3k=,iv:Yq2gANTTgx6cFxkdustUZ1MPszxGSkao/bS1KHAkzJc=,tag:kqJibocgRQXkxTJze6O5MA==,type:str]
     pgp:
         - created_at: "2022-10-12T00:46:51Z"
           enc: |
@@ -65,4 +65,4 @@ sops:
             -----END PGP MESSAGE-----
           fp: 8a3737d48f1035fe6c3a0a8fd6a1976ca74c7f3b
     unencrypted_suffix: _unencrypted
-    version: 3.7.3
+    version: 3.8.1

keys/staging.yaml

@@ -1,5 +1,5 @@
-gitea:
+forgejo:
-    metrics-token: ENC[AES256_GCM,data:J4QdfI1wKyM=,iv:8fqCbftyhj90eIVFxjEp9RXKC1y1IaLnV1r2MOdY15M=,tag:8W/juv1OZh4hJco02qXO6g==,type:str]
+    metrics-token: ENC[AES256_GCM,data:HEDV/GK/WtI=,iv:ihPEusEGVUNZjjjxz2ys6Nfag/og4n7Cqmd4rroT6Ww=,tag:Brcv7XW6HfzzgF3emtuT2A==,type:str]
 grafana:
     adminPassword: ENC[AES256_GCM,data:dYfaxUpQpzA=,iv:j5wSem8C5+V4c5qRzXQJhsU7/FOtpvrnaEyFBmW6zJ4=,tag:oc8n3TkEbjF2gjuOobZuLA==,type:str]
     secretKey: ENC[AES256_GCM,data:Atruvh2MsNY=,iv:y2MaCUCEzGIydHp6G0DJHfk289S1is0twKm2oUYwDhM=,tag:nAWeg+YqaYqk6k22oBkAhQ==,type:str]
@@ -26,43 +26,43 @@ sops:
     azure_kv: []
     hc_vault: []
     age: []
-    lastmodified: "2023-10-07T02:17:50Z"
+    lastmodified: "2023-12-30T14:09:03Z"
-    mac: ENC[AES256_GCM,data:vZDq33YIn0Nf1FQ2+ySezox6igiw6zNFCu3l3kaIsBKo1797pohmAxj2Lcc+OmlBjj98khaBIlbQuA5ULM+uPN5ILaz3NuXD5PZtsV+rL2PsLNMW9FBSmJ0m0YQrt0nZ0tpzifn12XghcSK2IXv+FnxlfrAJCxDvr5tRm90uUwU=,iv:ct8CzIWjaoJ1UjZcdFSr8lZ626vA0RvM883V6H5plWc=,tag:waJNtp/UbRDOfyzNElrung==,type:str]
+    mac: ENC[AES256_GCM,data:kuyzVV1Dhlb2LemqRzw2xPr9jtTWqSbFMv70LUEbRmsDpjwQsAIARgoaj32EXdDRTHYXBplTYieR7KvmxykL/8rkj0g4+IuRLY1TcbRS31Gi74FiXvV2apscHhQWXhHPHIHMbwZAfDSHdMrf8hPu28SC9QdbP3SXYNt28Imstrc=,iv:UALUiWGHlWEBmIVWeSyEa16ZdcDZvgtlpHETDV2CcRY=,tag:rxbd3ph+pPf11jup/CMEzw==,type:str]
     pgp:
-        - created_at: "2022-10-12T16:48:23Z"
+        - created_at: "2023-12-29T15:25:27Z"
           enc: |
             -----BEGIN PGP MESSAGE-----
 
-            hQEMA7x7stsXx45CAQf/QKXxlgFzUn5ZS02JDiOLds6wjsiTbwQeIy+den+qH9KF
+            hQEMA7x7stsXx45CAQf/RWxP6z7xjV5TqiA6lFhtygjrH9x3y1DUWG9aUb/dO+xH
-            CyfC/8WhxojyhliG0zUzQ7oHtYYkbknF2DyrR7J4+S3SyvMS6MDGTUUn5dIcGwBO
+            zDbGMYqGe9RPlgi5sWPstdKXvCgs+AKNj93qJYMwEtaasJOinYXCGeAQmzg90+pt
-            2/Q2bt4ayOJFNTPePA0IfuMYNUiMl5B/0GCFRV9DE+gG/dcsOzM5q1Uya/yJ1966
+            bS6SoBHhGIxAvvLKKPtYx0V50I2reYR+32ux9bcrnzwIsV0P7/SSp1Cl8H+sotB8
-            RndWwbnE4j5yP4Nj2o3OiZFhlNi6W6UffYB0hsTTPmmebIZltDRbmLSSpKcfNEYw
+            yf+0ULXcpC+SYECmZqzR9qQ3S+3I6/+QS+QgWj4NsyF+apxnE9oQDcBLdYP4aKgR
-            h3st3WaJ0BCuQC5i/kvYTfJyBCoYnvFrb3RmXm3h+MvW0JZwHzfbST3nJCBHh5XJ
+            JHERA9HYfDTKoS137pFHxgINqHkFRY6lhoZdz1yDzOjiPxd8YVfPdKyf022Rg+cX
-            fVquF17oDJzn5S7EdWMhUbWwHgZwz2J6sZMgGEQ6WdJeAf2IlCuRYGjQMcB1WhxH
+            J/Q2P+OhNZEG3gapNATp6wH3niovA89KwZKSmbTZOdJeAZ6NV6TiUP+TgGg5+CmV
-            GCgbzUGoOGrxT3euzz9R1J98d1HQqtpFgeg9JgWndUdhoF80+AU7Wpyy6qOg2n/4
+            pSLaGel2NZRnFVNdDFi0dsOwhHv3FpKhIpALJh08/jsmAAslfE7vVlcEnaoUJPTS
-            wCcb4pcqG1OqFezauEu8+sFdE07vfLoWzxJIark8WA==
+            3v86AACUC5D/gUxmFrrED1qoxbELCmZ17xTwjQzxwg==
-            =pc2z
+            =KzdF
             -----END PGP MESSAGE-----
           fp: 535B61015823443941C744DD12264F6BBDFABA89
-        - created_at: "2022-10-12T16:48:23Z"
+        - created_at: "2023-12-29T15:25:27Z"
           enc: |
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA2HlP5TKoxTkARAAl+2Y+pd5oraYLgiiJ0CbMFef0zCpFwBwUCyzykMOICGa
+            hQIMA/3lh+ZzfS28ARAAm729dMouF7juUeHAb+aHMoyZVKsXapxnxebkjE/LSIbz
-            TWCYs8K6hChjepe0p8+oZnp0wi8U1qrmgRtFljQfHoXq5EXDYKydkz8XHHDI7/W7
+            IEZwegTNrtxQJLclV4Km2gUaBTcE4vLJCpB7YxZvk7JV9OdVKi97o9PcXUXbz9ej
-            1BmETajv9Mx7j4BFNB3z0XvLJTPeNhygemuHhox5pA8CUt5FkYahpzYR9AlLiAwx
+            /WomnEvFyyxTZGTiHU+L4kNudl8UAKhTt3P4fR3PLpTily75Kn53tzLFJuCO8fAY
-            NtU+csrcGUqYllT5WYIKFVIwFk07IvgK/7vj3filO5G2GMiH7lsV6p7W/MYqCFTV
+            I/YwQAzayxhPcxk3FuPsD/ONiG7mW8n2ZwfwgOkKXwnrlJv7DreKJRYzu/EeuvX/
-            grE383/bGCT18XmHpe3Uu0NcotexiqKSXpnFNntWOgd/KynBn8Oa/DMr8ci/4QSF
+            d4oz+k+xofniOeZmQjZllzR7/++MBg/e1U9VocN1EAWpWHP5taLiThfnVSGDhlQM
-            rEV4+IGJSmfAzQYaIfzNRGyTQJKBFiXWQv53GWT9Y5EbdEYEBhyqlIaV5fp/61X+
+            +4WT5ezH6EuUQlAyQNpDaCincBvCHInhrNlUPOpW51nHMb0y3n4x2hMtZA0JbYEu
-            8zhLz3b6QMkNkI6mNVVLK96g2p0dhVoq+R3Wlj/RIVDw/BzH+vJIArQhc8T2NEOX
+            mkWTYDe65cHjImHXQk9oO2/v4oIyq7ywHX7g2hqVbbiLHZqqTaGfV8lP30+r6/UQ
-            lmLFTMoTRXPrw/UZKMoO+JSDwt2p3WI0sb/ThS+bd7eymxt5lFW1Ikc4Jgd/iHHu
+            29iAdWac1hY5HDzwbqpY6b38i60j4bkiS83xqrGYBy037bCFk1oHJqwxp5P7vrzr
-            JtUZ78i8jAV/nBJPaAYXoRxfpcAMFqJCnxTwCoF7vYP6hHeYW9PPqsClPxQ97TrO
+            rTv5NBr95BlwF+s8xPEPZneaEu7N3UnhhSzDWp1jgsCxN9b/XHarchNt70xEt2VS
-            /Ei01e9YSfdtIzKcwkOThffRr+7hxwEGQ3EZ+2ShOW9ASfLkIo4MgoLtDAoHCK5E
+            xpgs9GEXhsJcbrFNPYqTkFb8vjLFI+poGPTfadW17j4Pp5ftIBRNdKvDG0ni/AIp
-            vc2JGWP+vlylTVnZ46Hp8BMRlSjdkS/qGU0lSTPC3q+PllCF2gkN6ZcdLv5L2DDS
+            K98R/nvaHEFuX31SkL8ZUIRqhJm3JVqilFxLAJrqGuSN3jA6wKrimUYpK+t+64jS
-            UAFD70TIN2QAiYEZW6jxg2UtO9ULLT5NgrvfHD9aGAk7jIxeY+nH3S7KqFgmA21c
+            WAEN9jHYFQDTVHix3g15S5YTGh5ROyqxouDhvSDFTmGtbm5W/HYgnkZmh53TgVeJ
-            IkNZJSX/J85d13+kJADms3vI7uMOcSUiInaQHy9Cqjrr
+            Rph/O9QptculzTN+nEqshBhbjhl/uDsLsjLYo/O1AyCwTUSd3OKn6uU=
-            =fnOr
+            =zThh
             -----END PGP MESSAGE-----
-          fp: 7762ec55a5727cabada621d961e53f94caa314e4
+          fp: 2f5caa73e7ceea4fcc8d2881fde587e6737d2dbc
     unencrypted_suffix: _unencrypted
-    version: 3.7.3
+    version: 3.8.1

pkgs/mkNextcloudApp.nix

@@ -5,4 +5,5 @@
 fetchNextcloudApp {
   url = source.src.url;
   sha256 = source.src.sha256;
+  license = "unlicense"; # Blatant lie
 }