flake.lock

@@ -68,48 +68,10 @@
         "type": "github"
       }
     },
-    "nixpkgs_26_05": {
-      "locked": {
-        "lastModified": 1791143449,
-        "narHash": "sha256-9+n3ReS2y9xS199LoJjKUWHwZrISGHWgkD/LUZTDZyA=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "0d9e9b832d03ac387417e16ce1febf73b2e631e1",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-26.05",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
     "root": {
       "inputs": {
         "nix-minecraft": "nix-minecraft",
-        "nixpkgs": "nixpkgs_2",
+        "nixpkgs": "nixpkgs_2"
-        "nixpkgs_26_05": "nixpkgs_26_05",
-        "sops-nix": "sops-nix"
-      }
-    },
-    "sops-nix": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs_26_05"
-        ]
-      },
-      "locked": {
-        "lastModified": 1791103873,
-        "narHash": "sha256-nFxM+pKoZ8LJAEnUXARyCaOAloWgaW9kZQOSjWzKcTE=",
-        "owner": "Mic92",
-        "repo": "sops-nix",
-        "rev": "dcd241ba97088c22569d1573286e1b9daad340c0",
-        "type": "github"
-      },
-      "original": {
-        "owner": "Mic92",
-        "repo": "sops-nix",
-        "type": "github"
       }
     },
     "systems": {

flake.nix

@@ -3,17 +3,12 @@
 
   inputs = {
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
-    nixpkgs_26_05.url = "github:NixOS/nixpkgs/nixos-26.05";
-    sops-nix.url = "github:Mic92/sops-nix";
-    sops-nix.inputs.nixpkgs.follows = "nixpkgs_26_05";
     nix-minecraft.url = "github:Infinidoge/nix-minecraft";
   };
 
   outputs = inputs @ {
     self,
     nixpkgs,
-    nixpkgs_26_05,
-    sops-nix,
     nix-minecraft,
     ...
   }: let
@@ -60,12 +55,9 @@
         modules = [./nix-system-configs/modules/system/traefik.nix];
       };
 
-      "nixos-build-machine" = nixpkgs_26_05.lib.nixosSystem {
+      "nixos-build-machine" = nixpkgs.lib.nixosSystem {
         inherit system;
-        modules = [
+        modules = [./nix-system-configs/modules/system/build_machine.nix];
-          sops-nix.nixosModules.sops
-          ./nix-system-configs/modules/system/build_machine.nix
-        ];
       };
 
       "nixos-logs" = nixpkgs.lib.nixosSystem {

nix-system-configs/modules/scripts/pull.zsh

@@ -210,15 +210,12 @@ fi
 # Step 4: Rebuild system using local flake
 # Compute repository root (three levels up from this script: .../nix-system-configs/modules/scripts -> repo root)
 FLAKE_ROOT="$(cd "${SCRIPT_DIR}/../../.." && pwd)"
-# Map repository configuration filenames to flake nixosConfigurations names.
+# Normalize selected system name to flake nixosConfigurations naming convention (prefix with 'nixos-' if missing)
-# Normalise the snake-cases as dashes.
+if [[ "${selected_system}" == nixos-* ]]; then
-case "${selected_system}" in
+    flake_name="${selected_system}"
-    blank_system_USE_THIS_AS_COPY) flake_name="nixos-blank" ;;
+else
-    gramethus) flake_name="nixos-logs" ;;
+    flake_name="nixos-${selected_system}"
-    wireguard_server) flake_name="nixos-local-wireguard-server" ;;
+fi
-    nixos-*) flake_name="${selected_system}" ;;
-    *) flake_name="nixos-${selected_system//_/-}" ;;
-esac
 
 # If the selected system is the database module, use the standard non-flake rebuild
 if [[ "${selected_system}" == "database" ]]; then

nix-system-configs/modules/scripts/push.zsh

@@ -102,14 +102,12 @@ echo ""
 # Step 1: Rebuild system
 print_info "Rebuilding NixOS system..."
 
-# Map repository configuration filenames to flake nixosConfigurations names.
+# Normalize selected system name to flake nixosConfigurations naming convention (prefix with 'nixos-' if missing)
-case "${selected_system}" in
+if [[ "${selected_system}" == nixos-* ]]; then
-    blank_system_USE_THIS_AS_COPY) flake_name="nixos-blank" ;;
+    flake_name="${selected_system}"
-    gramethus) flake_name="nixos-logs" ;;
+else
-    wireguard_server) flake_name="nixos-local-wireguard-server" ;;
+    flake_name="nixos-${selected_system}"
-    nixos-*) flake_name="${selected_system}" ;;
+fi
-    *) flake_name="nixos-${selected_system//_/-}" ;;
-esac
 
 echo ""
 if sudo NIX_CONFIG='experimental-features = nix-command flakes' nixos-rebuild switch --upgrade-all --flake "${PWD}#${flake_name}"; then

nix-system-configs/modules/secrets-config/sops-build-machine.nix

@@ -4,7 +4,18 @@
   lib,
   ...
 }: {
-  # This will add secrets.yml to the Nix store
+  imports = let
+    # replace this with an actual commit id or tag
+    commit = "17eea6f3816ba6568b8c81db8a4e6ca438b30b7c";
+  in [
+    "${builtins.fetchTarball {
+      url = "https://github.com/Mic92/sops-nix/archive/${commit}.tar.gz";
+      # replace this with an actual hash
+      sha256 = "ktjWTq+D5MTXQcL9N6cDZXUf9kX8JBLLBLT0ZyOTSYY=";
+    }}/modules/sops"
+  ];
+
+  # This will add secrets.yml to the nix store
   # You can avoid this by adding a string to the full path instead, i.e.
   # sops.defaultSopsFile = "/root/.sops/secrets/example.yaml";
   sops.defaultSopsFile = ../../secrets/build_machine/secrets.yaml;
@@ -23,12 +34,4 @@
     owner = "root";
     mode = "0400";
   };
-
-  sops.secrets."github_runner_token" = {
-    format = "yaml";
-    sopsFile = ../../secrets/build_machine/secrets.yaml;
-    owner = "root";
-    mode = "0400";
-    restartUnits = ["github-runner-build-machine.service"];
-  };
 }

nix-system-configs/modules/system/build_machine.nix

@@ -191,7 +191,6 @@ in {
       }
     ];
     networking.defaultGateway = "10.1.1.1";
-    networking.resolvconf.enable = false;
     environment.etc."resolv.conf".text = ''
       nameserver 10.1.1.2
     '';
@@ -219,52 +218,6 @@ in {
       };
     };
 
-    users.groups.github-runner = {};
-    users.users.github-runner = {
-      isSystemUser = true;
-      group = "github-runner";
-      home = "/var/lib/github-runner";
-      createHome = true;
-    };
-
-    services.github-runners.build-machine = {
-      enable = true;
-      user = "github-runner";
-      group = "github-runner";
-      name = "nixos-build-machine";
-      url = "https://github.com/bitcoin-dev-tools";
-      tokenFile = "/run/github-runner-token";
-      ephemeral = true;
-      replace = true;
-      extraLabels = ["nixos" "build-machine"];
-    };
-
-    systemd.services.github-runner-build-machine = {
-      requires = ["sops-nix.service"];
-      after = ["sops-nix.service"];
-      serviceConfig.ExecStartPre = lib.mkBefore [
-        "+${pkgs.writeShellScript "prepare-github-runner-token" ''
-          set -eu
-          token="$(<${config.sops.secrets.github_runner_token.path})"
-          case "$token" in
-            TOKEN=*) token="''${token#TOKEN=}" ;;
-            *)
-              echo "GitHub runner token secret must use TOKEN=<token> format" >&2
-              exit 1
-              ;;
-          esac
-          if [ -z "$token" ] || [[ "$token" == *$'\n'* ]]; then
-            echo "GitHub runner token secret must contain one non-empty token" >&2
-            exit 1
-          fi
-          token_file=/run/github-runner-token
-          printf '%s' "$token" > "$token_file.tmp"
-          chmod 0400 "$token_file.tmp"
-          mv -f "$token_file.tmp" "$token_file"
-        ''}"
-      ];
-    };
-
     # This value determines the NixOS release from which the default
     # settings for stateful data, like file locations and database versions
     # on your system were taken. It‘s perfectly fine and recommended to leave

nix-system-configs/secrets/build_machine/secrets.yaml

@@ -1,8 +1,8 @@
 runner_token: ENC[AES256_GCM,data:SEN4lL2cxkM/cExdasB2zIV3EDJcBIZOAr1ab6aLagPVReZ8UTaFKgMctnLIkA==,iv:EMUQW8ufCnbCeN3PmSoxBsHLukwS4yNSA3xor89uNxE=,tag:V8RDaeGMI4ReZrGTw9V2Qw==,type:str]
-github_runner_token: ENC[AES256_GCM,data:zu1nICWyNdZF5om9Mi3sRbaeBWPfB/J52sSTDeSii5sVVZg=,iv:CZE/TXVX3NfYfj9xCTTHkiqTN50sEISRhypGAPQdzEg=,tag:uqq9IYbYuKIcLPm4BMkT6A==,type:str]
 sops:
     age:
-        - enc: |
+        - recipient: age1746rvsvsc3snxfl7cndm222wd5kck4aqj3x7nednlegq0gdjhfcqx0qv7m
+          enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1WEE5MUJiK0tUSmZMMXVq
             LzdON0trT0NYbXZXdkluak9xQVlHM0F2OVI4CnFmaEpEdEVMalgxQjJMalp3Mjl3
@@ -10,8 +10,8 @@ sops:
             TFZpeGwrM2V3aWRybGE2WVNQRW5QV0kKdJb7svK5k5rYMtfiTsJy5QE3+1MP04jz
             zadKKK+kDaK+h4AmkFGLRoKLpJoEU2nEUo2FD4LxiGOOvSXmeOUxbw==
             -----END AGE ENCRYPTED FILE-----
-          recipient: age1746rvsvsc3snxfl7cndm222wd5kck4aqj3x7nednlegq0gdjhfcqx0qv7m
+        - recipient: age1xtsm7kmql8794756ls53eu8pusyadk4lauadxx867tgsjhd38y5sj7elca
-        - enc: |
+          enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGUEdoMkVyMjVsOG1LYkRW
             M08xemlxRHU4THRidWZXZFhEdXFBV05YUFZRCjlpeERUbWVjY0cxMlk5elk1VHFn
@@ -19,8 +19,7 @@ sops:
             U3hva2JqWUdjR2JzTmpFanppUk5MTmsKwD8rlnddUQkgtuZLTgpmS4jGRmgNReUN
             mEx0pxnWIIrLUGRgwE3WDbBVRTqVo1ai6BZY3FzBCnXU6zbNwYhqIg==
             -----END AGE ENCRYPTED FILE-----
-          recipient: age1xtsm7kmql8794756ls53eu8pusyadk4lauadxx867tgsjhd38y5sj7elca
+    lastmodified: "2026-02-12T17:12:42Z"
-    lastmodified: "2026-10-05T09:26:20Z"
+    mac: ENC[AES256_GCM,data:Z888IrMcNO0VwoliGoLS8SsZPffXvH2yY6w9y3i7laepvrq2dW2a3fx+urwzgYfpJBLMJQNJ10SauBINlgIYp5KYf1dMRSsLBbwIsJi90lmqmRSNmNdQmkJdwi4MhmQxbZmHpwrxwFrx9EAkWdWXKlMBCkO2WJxNVQdYVty2bNs=,iv:FssN2HByfcbgFY5NKEyadyrrdidFx5iHaEXX2rDLYvw=,tag:bRGpOVzv26kjOswlQC7aoA==,type:str]
-    mac: ENC[AES256_GCM,data:oM69M815SR0TDzUOrMbXanXd5vikDgADhFmXvY6VrhWSoRwweApiLsKjT1IxdH3yQCQVLdsGIhU8/0+Ke3ZZ64TBYYi8cBp+7Uua4UHqCz1ouwXVSO7/aVOQciySMxV2+fftZu0tUn8rdvAdpdPrucadgYLGmF9vJM4hSo7xy+4=,iv:Y19E6AftjLw3FRmxC2LykwSgVnv6UOK6K+3UyVaBTZg=,tag:D7AFDR5+hxm4YSFydLetVg==,type:str]
     unencrypted_suffix: _unencrypted
-    version: 3.13.3
+    version: 3.11.0