Add build-modules.yml for Nix module dry-run workflow

.forgejo/workflows/build-modules.yml

@@ -0,0 +1,23 @@
+name: Build Nix modules (dry-run)
+
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  build-modules:
+    runs-on: docker
+    container:
+      image: lix:latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Run Dry Run (dry-run)
+        env:
+          NIX_CONFIG: experimental-features = nix-command flakes
+        run: |
+          set -eux
+          ./dry_run.zsh
+

.sops.yaml

@@ -3,6 +3,7 @@ keys:
   - &server_songsheet age1la8yjuc2ws9pyx70rc83jd2084v5e08v8fvh6muvfzrl2ulp8fms6frs86
   - &server_traefik age1rdcs8y4fjfyagwt2q9599ax329thceersh6dg2f0p6nsghm5xufq00qu0p
   - &server_database age1k9ddvzypz986a7dt403ja6evql2agz0gehll79mx64zceteya38smxph8m
+  - &server_build_machine age1xtsm7kmql8794756ls53eu8pusyadk4lauadxx867tgsjhd38y5sj7elca
   - &server_christine age1kzsrlz86y5nqe4vaufv8chupq2hrf3avlmxsp3d5p9t5xj593deszslkmp
 creation_rules:
   - path_regex: nix-system-configs/secrets/songsheet/[^/]+\.(yaml|json|env|ini)$
@@ -29,3 +30,8 @@ creation_rules:
     key_groups:
       - age:
           - *admin_christine
+  - path_regex: nix-system-configs/secrets/build_machine/[^/]+\.(yaml|json|env|ini)$
+    key_groups:
+      - age:
+          - *admin_christine
+          - *server_build_machine

documentation_titlepage.md

@@ -171,6 +171,46 @@ Synchronizes local system changes back to the repository. This script:
 5. Syncs changes from `/etc/nixos/modules` back to the repository
 6. Stages, commits, and pushes changes to the remote git repository with a timestamped commit message
 
+## Adding New Systems
+
+To add a new system configuration to the infrastructure:
+
+1. **Create the configuration file** in `nix-system-configs/modules/system/`:
+   ```bash
+   cp nix-system-configs/modules/system/blank_system_USE_THIS_AS_COPY.nix \
+      nix-system-configs/modules/system/your-new-system.nix
+   ```
+
+2. **Edit the configuration** to set your system's unique properties:
+   ```nix
+   config = {
+     local.hostname = "nixos-your-system";
+     local.username = "yourusername";
+     local.userDescription = "Your System Description";
+     local.address = "10.XXX.XXX.XXX";  # Choose an available IP
+     
+     system.stateVersion = "25.11";
+   };
+   ```
+
+3. **Register in `flake.nix`** to make it available for builds:
+   ```nix
+   nixosConfigurations = {
+     # ...existing configurations...
+     
+     "nixos-your-system" = nixpkgs.lib.nixosSystem {
+       inherit system;
+       modules = [ ./nix-system-configs/modules/system/your-new-system.nix ];
+     };
+   };
+   ```
+4. ***IF YOU WANT TO CHECK IT MANUALLY*** - **Test the configuration** before deploying, change the `nixos-your-system` accordingly:
+   ```bash
+   nix build .#nixosConfigurations.nixos-your-system.config.system.build.toplevel
+   ```
+
+Once the build succeeds, the configuration is ready for deployment using the `pull.zsh` script on the target machine.
+
 ## How to maintain the local machines
 
 > [!NOTE] The following maintenance scripts should be made less unwieldy to use, so they will be changed in the next 

dry_run.zsh

@@ -0,0 +1,28 @@
+#!/usr/bin/env zsh
+
+export NIX_CONFIG="experimental-features = nix-command flakes"
+
+echo "=== nix --version ==="
+nix --version
+echo
+
+configs=(
+  "nixos-local-wireguard-server"
+  "nixos-blank"
+  "nixos-songsheet"
+  "nixos-database"
+  "nixos-forgejo"
+  "nixos-teamspeak"
+  "nixos-traefik"
+  "nixos-build-machine"
+)
+
+if [[ -n "$1" ]]; then
+  configs=("$1")
+fi
+
+for config in "${configs[@]}"; do
+  echo "=== Dry-run: $config ==="
+  nix build --dry-run ".#nixosConfigurations.${config}.config.system.build.toplevel" || true
+  echo
+done

flake.lock

@@ -0,0 +1,27 @@
+{
+  "nodes": {
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1770770419,
+        "narHash": "sha256-iKZMkr6Cm9JzWlRYW/VPoL0A9jVKtZYiU4zSrVeetIs=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "6c5e707c6b5339359a9a9e215c5e66d6d802fd7a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-25.11",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "nixpkgs": "nixpkgs"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

flake.nix

@@ -0,0 +1,57 @@
+{
+  description = "PRG Server Infrastructure - NixOS Configurations";
+
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
+  };
+
+  outputs = {
+    self,
+    nixpkgs,
+    ...
+  }: let
+    system = "x86_64-linux";
+  in {
+    nixosConfigurations = {
+      "nixos-local-wireguard-server" = nixpkgs.lib.nixosSystem {
+        inherit system;
+        modules = [./nix-system-configs/modules/system/wireguard_server.nix];
+      };
+
+      "nixos-blank" = nixpkgs.lib.nixosSystem {
+        inherit system;
+        modules = [./nix-system-configs/modules/system/blank_system_USE_THIS_AS_COPY.nix];
+      };
+
+      "nixos-songsheet" = nixpkgs.lib.nixosSystem {
+        inherit system;
+        modules = [./nix-system-configs/modules/system/compose-songsheet.nix];
+      };
+
+      "nixos-database" = nixpkgs.lib.nixosSystem {
+        inherit system;
+        modules = [./nix-system-configs/modules/system/database.nix];
+      };
+
+      "nixos-forgejo" = nixpkgs.lib.nixosSystem {
+        inherit system;
+        modules = [./nix-system-configs/modules/system/forgejo.nix];
+      };
+
+      "nixos-teamspeak" = nixpkgs.lib.nixosSystem {
+        inherit system;
+        modules = [./nix-system-configs/modules/system/teamspeak.nix];
+      };
+
+      "nixos-traefik" = nixpkgs.lib.nixosSystem {
+        inherit system;
+        modules = [./nix-system-configs/modules/system/traefik.nix];
+      };
+
+      "nixos-build-machine" = nixpkgs.lib.nixosSystem {
+        inherit system;
+        modules = [./nix-system-configs/modules/system/build_machine.nix];
+      };
+    };
+  };
+}

nix-system-configs/modules/desktop-manager/sway_greetd_homemanager.nix

@@ -4,7 +4,10 @@
   lib,
   ...
 }: let
-  home-manager = builtins.fetchTarball "https://github.com/nix-community/home-manager/archive/release-25.11.tar.gz";
+  home-manager = builtins.fetchTarball {
+    url = "https://github.com/nix-community/home-manager/archive/release-25.11.tar.gz";
+    sha256 = "1kqxy6r4ahnbazmpa4pncdp62najdikdaw8hvrv8nl6qxvbmf9fy";
+  };
   cfg = config.services.forgejo;
   srv = cfg.settings.server;
 in {

nix-system-configs/modules/secrets-config/notes.md

@@ -1,6 +1,7 @@
 To generate the keys beforehand
 ```ssh
 nix-shell -p age
-/var/lib/sops-nix/key.txt
+sudo mkdir /var/lib/sops-nix
+age-keygen -o /var/lib/sops-nix/key.txt
 ```
 And then update the .sops.yaml in the project directory accordingly.

nix-system-configs/modules/secrets-config/sops-build-machine.nix

@@ -0,0 +1,38 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}: {
+  imports = let
+    # replace this with an actual commit id or tag
+    commit = "17eea6f3816ba6568b8c81db8a4e6ca438b30b7c";
+  in [
+    "${builtins.fetchTarball {
+      url = "https://github.com/Mic92/sops-nix/archive/${commit}.tar.gz";
+      # replace this with an actual hash
+      sha256 = "ktjWTq+D5MTXQcL9N6cDZXUf9kX8JBLLBLT0ZyOTSYY=";
+    }}/modules/sops"
+  ];
+
+  # This will add secrets.yml to the nix store
+  # You can avoid this by adding a string to the full path instead, i.e.
+  # sops.defaultSopsFile = "/root/.sops/secrets/example.yaml";
+  sops.defaultSopsFile = ../../secrets/build_machine/secrets.yaml;
+  # This will automatically import SSH keys as age keys
+  #sops.age.sshKeyPaths = ["/home/nixosdd/.ssh/id_ed25519"];
+  # This is using an age key that is expected to already be in the filesystem
+  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
+  # This will generate a new key if the key specified above does not exist
+  sops.age.generateKey = true;
+
+  # Export individual WireGuard keys from the SOPS YAML as text secrets so they
+  # are available both as strings and as files (.path)
+  sops.secrets."runner_token" = {
+    format = "yaml";
+    sopsFile = ../../secrets/build_machine/secrets.yaml;
+    owner = "root";
+    mode = "0400";
+  };
+
+}

nix-system-configs/modules/secrets-config/sops-wireguard.nix

@@ -0,0 +1,51 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}: {
+  imports = let
+    # replace this with an actual commit id or tag
+    commit = "17eea6f3816ba6568b8c81db8a4e6ca438b30b7c";
+  in [
+    "${builtins.fetchTarball {
+      url = "https://github.com/Mic92/sops-nix/archive/${commit}.tar.gz";
+      # replace this with an actual hash
+      sha256 = "ktjWTq+D5MTXQcL9N6cDZXUf9kX8JBLLBLT0ZyOTSYY=";
+    }}/modules/sops"
+  ];
+
+  # This will add secrets.yml to the nix store
+  # You can avoid this by adding a string to the full path instead, i.e.
+  # sops.defaultSopsFile = "/root/.sops/secrets/example.yaml";
+  sops.defaultSopsFile = ../../secrets/wireguard/secrets.yaml;
+  # This will automatically import SSH keys as age keys
+  #sops.age.sshKeyPaths = ["/home/nixosdd/.ssh/id_ed25519"];
+  # This is using an age key that is expected to already be in the filesystem
+  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
+  # This will generate a new key if the key specified above does not exist
+  sops.age.generateKey = true;
+
+  # Export individual WireGuard keys from the SOPS YAML as text secrets so they
+  # are available both as strings and as files (.path)
+  sops.secrets."wireguard_private" = {
+    format = "yaml";
+    sopsFile = ../../secrets/wireguard/secrets.yaml;
+    owner = "root";
+    mode = "0400";
+  };
+
+  sops.secrets."wireguard_preshared" = {
+    format = "yaml";
+    sopsFile = ../../secrets/wireguard/secrets.yaml;
+    owner = "root";
+    mode = "0400";
+  };
+
+  sops.secrets."wireguard_public" = {
+    format = "yaml";
+    sopsFile = ../../secrets/wireguard/secrets.yaml;
+    owner = "root";
+    mode = "0444";
+  };
+}

nix-system-configs/modules/system/blank_system_USE_THIS_AS_COPY.nix

@@ -3,7 +3,9 @@
   pkgs,
   lib,
   ...
-}: {
+}: let
+  choose = paths: builtins.head (builtins.filter (p: builtins.pathExists p) paths);
+in {
   options.local = {
     hostname = lib.mkOption {
       type = lib.types.str;
@@ -28,14 +30,11 @@
   };
 
   imports = [
-    ./modules/desktop-manager/sway_greetd_homemanager.nix
+    (choose [ ./modules/local/hostname_username.nix ../local/hostname_username.nix ])
-    ./modules/local/hostname_username.nix
+    (choose [ ./modules/local/networking_local.nix ../local/networking_local.nix ])
-    ./modules/local/networking_local.nix
+    (choose [ ./modules/bootloader/seabios-assigned-iso-at-birth.nix ../bootloader/seabios-assigned-iso-at-birth.nix ])
-    ./modules/bootloader/seabios-assigned-iso-at-birth.nix
+    (choose [ ./modules/lix-default.nix ../lix-default.nix ])
-    ./modules/lix-default.nix
+    (choose [ ./modules/secrets-config/sops-the-blank-system.nix ../secrets-config/sops-the-blank-system.nix ])
-    # Optionally to enable remote building: ./modules/toolsets/remote_building.nix
-    #./modules/songsheet/wavelog/docker-compose.nix
-    #./modules/secrets-config/sops-the-blank-system.nix
   ];
 
   config = {

nix-system-configs/modules/system/build_machine.nix

@@ -0,0 +1,262 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}: let
+  choose = paths: builtins.head (builtins.filter (p: builtins.pathExists p) paths);
+in {
+  options.local = {
+    hostname = lib.mkOption {
+      type = lib.types.str;
+      default = "nixos-build-machine";
+      description = "System hostname";
+    };
+    username = lib.mkOption {
+      type = lib.types.str;
+      default = "nixosbm";
+      description = "Primary user username";
+    };
+    userDescription = lib.mkOption {
+      type = lib.types.str;
+      default = "NixOS Build Machine";
+      description = "Primary user description";
+    };
+    address = lib.mkOption {
+      type = lib.types.str;
+      default = "10.1.1.3";
+      description = "Static IP address";
+    };
+  };
+
+  imports = [
+    (choose [ ./modules/local/hostname_username.nix ../local/hostname_username.nix ])
+    (choose [ ./modules/local/networking_local.nix ../local/networking_local.nix ])
+    (choose [ ./modules/lix-default.nix ../lix-default.nix ])
+    (choose [ ./modules/secrets-config/sops-build-machine.nix ../secrets-config/sops-build-machine.nix ])
+    ## TODO: Make this more elegant and less risky for unexpected errors happening.
+  ] ++ lib.optional (builtins.pathExists ./hardware-configuration.nix) ./hardware-configuration.nix;
+
+  config = {
+    # Local metadata
+    local.hostname = "nixos-build-machine";
+    local.username = "nixosbm";
+    local.userDescription = "NixOS Build Machine";
+    local.address = "10.1.1.3";
+
+    # Enable Rsync
+    services.rsync.enable = true;
+
+    # Passwordless sudo for wheel group
+    security.sudo.wheelNeedsPassword = false;
+
+    # Hardware U2F support - Passwordless sudo with hardware key
+    security.pam.u2f = {
+      enable = true;
+      settings = {
+        authfile = "/etc/u2f_keys";
+        cue = true;
+        pinverification = 0; # No PIN verification
+        userpresence = 1; # Require user presence (touch)
+      };
+    };
+
+    # Optimize builds
+    nix.settings = {
+      # Enable parallel building
+      max-jobs = "auto";
+      cores = 0; # Use all available cores
+
+      # Optimize store operations
+      auto-optimise-store = true;
+
+      # Build settings
+      sandbox = true;
+      keep-outputs = true;
+      keep-derivations = true;
+    };
+
+    # Enable distributed builds (optional, for your VM setup)
+    nix.buildMachines = [];
+    nix.distributedBuilds = false;
+
+    # Optimize garbage collection
+    nix.gc = {
+      automatic = true;
+      dates = "weekly";
+      options = "--delete-older-than 30d";
+    };
+
+    # Increase build speed with tmpfs for builds (if you have enough RAM)
+    # Comment out if low on memory
+    systemd.services.nix-daemon.environment = {
+      TMPDIR = "/tmp";
+    };
+    boot.tmp.useTmpfs = true;
+    boot.tmp.tmpfsSize = "50%"; # Adjust based on your 62GB RAM
+
+    # SSH Agent authentication
+    security.pam.sshAgentAuth.enable = true;
+
+    # Automatic upgrades
+    system.autoUpgrade = {
+      enable = true; # Set to true for automatic updates
+      dates = "daily";
+      allowReboot = false;
+    };
+
+    # Bootloader fallback settings are provided by the seabios import
+    # (seabios-assigned-iso-at-birth.nix)
+
+    # Replicate systemd-boot configuration from the deprecated configuration
+    # so the system is bootable (matches build-deprecated/configuration.nix).
+    boot.loader.systemd-boot.enable = true;
+    boot.loader.efi.canTouchEfiVariables = true;
+
+    # Enable Tailscale
+    services.tailscale.enable = true;
+
+    # Define a user account. Don't forget to set a password with ‘passwd’.
+    users.users.nixosbm = {
+      isNormalUser = true;
+      description = "NixOS Build Machine";
+      extraGroups = ["networkmanager" "wheel"];
+      packages = with pkgs; [];
+    };
+
+    # Remote builder server setup
+    users.users.nixremote = {
+      isNormalUser = true;
+      description = "Nix Remote Builder";
+      home = "/home/nixremote";
+      createHome = true;
+
+      # SSH key for remote builds
+      openssh.authorizedKeys.keys = [
+        # Add the public key from your client machines here
+        # Example: "ssh-ed25519 AAAAC3... root@client-machine"
+      ];
+    };
+
+    systemd.tmpfiles.rules = [
+      "z /home/nixremote 0555 nixremote nixremote - -"
+      "z /home/nixremote/.ssh 0555 nixremote nixremote - -"
+    ];
+
+    # Allow unfree packages
+    nixpkgs.config.allowUnfree = true;
+
+    # List packages installed in system profile. To search, run:
+    # $ nix search wget
+    environment.systemPackages = with pkgs; [
+      wget
+      fastfetch
+      hyfetch
+      helix
+    ];
+
+    programs.gnupg.agent = {
+      enable = true;
+      enableSSHSupport = true;
+    };
+
+    # Enable the OpenSSH daemon.
+    services.openssh.enable = true;
+
+# Enable Podman for Gitea Actions Runner
+    virtualisation.podman = {
+      enable = true;
+      dockerCompat = true;
+      defaultNetwork.settings.dns_enabled = true;
+    };
+
+
+    # Network configuration for the build machine on the Proxmox bridge
+    networking.interfaces.ens18.ipv4.addresses = [
+      {
+        address = config.local.address;
+        #dns = "10.1.1.2";
+        prefixLength = 24;
+      }
+    ];
+    networking.defaultGateway = "10.1.1.1";
+    environment.etc."resolv.conf".text = ''
+      nameserver 10.1.1.2
+    '';
+
+    services.gitea-actions-runner = {
+      package = pkgs.forgejo-runner;
+      instances.default = {
+        enable = true;
+        name = "monolith";
+        url = "https://git.prg-radio.org";
+        # Obtaining the path to the runner token file may differ
+        # tokenFile should be in format TOKEN=<secret>, since it's EnvironmentFile for systemd
+        tokenFile = config.sops.secrets.runner_token.path;
+        labels = [
+          "lix:docker://git.lix.systems/lix-project/lix:latest"
+          "nix:docker://git.lix.systems/lix-project/lix:latest"
+          "ubuntu-bleeding-edge:docker://ubuntu:resolute"
+          "ubuntu-latest:docker://ubuntu:plucky"
+          "ubuntu-24.04:docker://ubuntu:noble"
+          "alpine:docker://alpine:edge"
+          "rust:docker://rust:trixie"
+          "python-315:docker://python:3.15.0a6-slim-trixie"
+        ];
+      };
+    };
+
+    # This value determines the NixOS release from which the default
+    # settings for stateful data, like file locations and database versions
+    # on your system were taken. It‘s perfectly fine and recommended to leave
+    # this value at the release version of the first install of this system.
+    # Before changing this value read the documentation for this option
+    # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+    system.stateVersion = "25.11"; # Did you read the comment?
+
+    # Helpful commented examples for remote-build configuration retained from original
+    # THE FOLLOWING CODE BLOCK IS FOR COPYING TO OTHER CONFIGURATIONS, NOT FOR THIS FILE
+    #  nix.distributedBuilds = true;
+    #  nix.buildMachines = [
+    #    {
+    #      hostName = "nixos-build-machine";
+    #      system = "x86_64-linux";
+    #      sshUser = "nixremote";
+    #      sshKey = "/root/.ssh/nixremote";
+    #      maxJobs = 4;
+    #      speedFactor = 2;
+    #          supportedFeatures = [ "nixos-test" "benchmark" "big-parallel" "kvm" ];
+    #    }
+    #  ];
+    #
+    # Generate SSH key for remote building
+    #systemd.services.generate-nixremote-key = {
+    #  description = "Generate SSH key for remote Nix builds";
+    #  wantedBy = [ "multi-user.target" ];
+    #  serviceConfig = {
+    #    Type = "oneshot";
+    #    RemainAfterExit = true;
+    #  };
+    #  script = ''
+    #    if [ ! -f /root/.ssh/nixremote ]; then
+    #      ${pkgs.openssh}/bin/ssh-keygen -t ed25519 -f /root/.ssh/nixremote -N "" -C "nix-remote-builder"
+    #    fi
+    #  '';
+    #};
+    #
+    #programs.ssh.extraConfig = ''
+    #  Host nixos-build-machine
+    #    HostName 192.168.1.175
+    #    IdentitiesOnly yes;
+    #    IdentityFile /root/.ssh/nixremote
+    #    User nixremoteStrictHostKeyChecking accept-new
+    #'';
+    #
+    # Manual step required: After rebuilding the client, copy /root/.ssh/nixremote.pub
+    # from the client to the build machine's users.users.nixremote.openssh.authorizedKeys.keys list,
+    # then rebuild the build machine.
+    # i.e on the client: run "cat /root.ssh/nixremote.pub"
+    # and copy the output to the build machine's configuration.nix
+  };
+}
+

nix-system-configs/modules/system/compose-songsheet.nix

@@ -3,7 +3,9 @@
   pkgs,
   lib,
   ...
-}: {
+}: let
+  choose = paths: builtins.head (builtins.filter (p: builtins.pathExists p) paths);
+in {
   options.local = {
     hostname = lib.mkOption {
       type = lib.types.str;
@@ -28,17 +30,16 @@
   };
 
   imports = [
-    ./modules/desktop-manager/sway_greetd_homemanager.nix
+    (choose [ ./modules/desktop-manager/sway_greetd_homemanager.nix ../desktop-manager/sway_greetd_homemanager.nix ])
-    ./modules/local/hostname_username.nix
+    (choose [ ./modules/local/hostname_username.nix ../local/hostname_username.nix ])
-    ./modules/local/networking_local.nix
+    (choose [ ./modules/local/networking_local.nix ../local/networking_local.nix ])
-    ./modules/bootloader/seabios-assigned-iso-at-birth.nix
+    (choose [ ./modules/bootloader/seabios-assigned-iso-at-birth.nix ../bootloader/seabios-assigned-iso-at-birth.nix ])
-    ./modules/lix-default.nix
+    (choose [ ./modules/lix-default.nix ../lix-default.nix ])
-    # Optionally: ./modules/toolsets/remote_building.nix
+    # Optionally: (choose [ ./modules/toolsets/remote_building.nix ../toolsets/remote_building.nix ])
-    #
+
-    #
     ## Compose modules for Portainer service
-    ./modules/songsheet/wavelog/docker-compose.nix
+    (choose [ ./modules/songsheet/wavelog/docker-compose.nix ../songsheet/wavelog/docker-compose.nix ])
-    ./modules/secrets-config/sops-composesongsheet.nix
+    (choose [ ./modules/secrets-config/sops-composesongsheet.nix ../secrets-config/sops-composesongsheet.nix ])
   ];
 
   config = {

nix-system-configs/modules/system/database.nix

@@ -3,7 +3,9 @@
   pkgs,
   lib,
   ...
-}: {
+}: let
+  choose = paths: builtins.head (builtins.filter (p: builtins.pathExists p) paths);
+in {
   options.local = {
     hostname = lib.mkOption {
       type = lib.types.str;
@@ -28,14 +30,15 @@
   };
 
   imports = [
-    ./modules/desktop-manager/gnome.nix
+    (choose [ ./modules/desktop-manager/gnome.nix ../desktop-manager/gnome.nix ])
-    ./modules/local/hostname_username.nix
+    (choose [ ./modules/local/hostname_username.nix ../local/hostname_username.nix ])
-    ./modules/local/networking_local.nix
+    (choose [ ./modules/local/networking_local.nix ../local/networking_local.nix ])
-    ./modules/lix-default.nix
+    (choose [ ./modules/bootloader/seabios-assigned-iso-at-birth.nix ../bootloader/seabios-assigned-iso-at-birth.nix ])
-    ./modules/secrets-config/sops-database.nix
+    (choose [ ./modules/lix-default.nix ../lix-default.nix ])
-    ./modules/system_scripts/gcloud_backup.nix
+    (choose [ ./modules/secrets-config/sops-database.nix ../secrets-config/sops-database.nix ])
-    ./hardware-configuration.nix
+    (choose [ ./modules/system_scripts/gcloud_backup.nix ../system_scripts/gcloud_backup.nix ])
-  ];
+    ## TODO: Make this more elegant and less risky for unexpected errors happening.
+  ] ++ lib.optional (builtins.pathExists ./hardware-configuration.nix) ./hardware-configuration.nix;
 
   config = {
     local.hostname = "nixosdd";

nix-system-configs/modules/system/forgejo.nix

@@ -7,6 +7,7 @@
   home-manager = builtins.fetchTarball "https://github.com/nix-community/home-manager/archive/release-25.11.tar.gz";
   cfg = config.services.forgejo;
   srv = cfg.settings.server;
+  choose = paths: builtins.head (builtins.filter (p: builtins.pathExists p) paths);
 in {
   options.local = {
     hostname = lib.mkOption {
@@ -32,12 +33,12 @@ in {
   };
 
   imports = [
-    ./modules/desktop-manager/sway_greetd_homemanager.nix
+    (choose [ ./modules/desktop-manager/sway_greetd_homemanager.nix ../desktop-manager/sway_greetd_homemanager.nix ])
-    ./modules/local/hostname_username.nix
+    (choose [ ./modules/local/hostname_username.nix ../local/hostname_username.nix ])
-    ./modules/local/networking_local.nix
+    (choose [ ./modules/local/networking_local.nix ../local/networking_local.nix ])
-    ./modules/toolsets/remote_building.nix
+    (choose [ ./modules/toolsets/remote_building.nix ../toolsets/remote_building.nix ])
-    ./modules/bootloader/seabios-assigned-proxmox-at-birth.nix
+    (choose [ ./modules/bootloader/seabios-assigned-proxmox-at-birth.nix ../bootloader/seabios-assigned-proxmox-at-birth.nix ])
-    ./modules/lix-default.nix
+    (choose [ ./modules/lix-default.nix ../lix-default.nix ])
   ];
 
   config = {

nix-system-configs/modules/system/teamspeak.nix

@@ -3,7 +3,9 @@
   pkgs,
   lib,
   ...
-}: {
+}: let
+  choose = paths: builtins.head (builtins.filter (p: builtins.pathExists p) paths);
+in {
   options.local = {
     hostname = lib.mkOption {
       type = lib.types.str;
@@ -28,17 +30,15 @@
   };
 
   imports = [
-    ./modules/desktop-manager/sway_greetd_homemanager.nix
+    (choose [ ./modules/desktop-manager/sway_greetd_homemanager.nix ../desktop-manager/sway_greetd_homemanager.nix ])
-    ./modules/local/hostname_username.nix
+    (choose [ ./modules/local/hostname_username.nix ../local/hostname_username.nix ])
-    ./modules/local/networking_local.nix
+    (choose [ ./modules/local/networking_local.nix ../local/networking_local.nix ])
-    ./modules/bootloader/seabios-assigned-iso-at-birth.nix
+    (choose [ ./modules/bootloader/seabios-assigned-iso-at-birth.nix ../bootloader/seabios-assigned-iso-at-birth.nix ])
-    ./modules/lix-default.nix
+    (choose [ ./modules/lix-default.nix ../lix-default.nix ])
-    # Optionally: ./modules/toolsets/remote_building.nix
+    # Optionally: (choose [ ./modules/toolsets/remote_building.nix ../toolsets/remote_building.nix ])
-    #
-    #
     ## Compose modules for Portainer service
-    ./modules/songsheet/wavelog/docker-compose.nix
+    (choose [ ./modules/songsheet/wavelog/docker-compose.nix ../songsheet/wavelog/docker-compose.nix ])
-    ./modules/secrets-config/sops-composesongsheet.nix
+    (choose [ ./modules/secrets-config/sops-composesongsheet.nix ../secrets-config/sops-composesongsheet.nix ])
   ];
 
   config = {

nix-system-configs/modules/system/traefik.nix

@@ -3,7 +3,9 @@
   pkgs,
   lib,
   ...
-}: {
+}: let
+  choose = paths: builtins.head (builtins.filter (p: builtins.pathExists p) paths);
+in {
   options.local = {
     hostname = lib.mkOption {
       type = lib.types.str;
@@ -28,12 +30,12 @@
   };
 
   imports = [
-    ./modules/desktop-manager/sway_greetd_homemanager.nix
+    (choose [ ./modules/desktop-manager/sway_greetd_homemanager.nix ../desktop-manager/sway_greetd_homemanager.nix ])
-    ./modules/local/hostname_username.nix
+    (choose [ ./modules/local/hostname_username.nix ../local/hostname_username.nix ])
-    ./modules/local/networking_local.nix
+    (choose [ ./modules/local/networking_local.nix ../local/networking_local.nix ])
-    ./modules/bootloader/seabios-assigned-iso-at-birth.nix
+    (choose [ ./modules/bootloader/seabios-assigned-iso-at-birth.nix ../bootloader/seabios-assigned-iso-at-birth.nix ])
-    ./modules/lix-default.nix
+    (choose [ ./modules/lix-default.nix ../lix-default.nix ])
-    # Optionally: ./modules/toolsets/remote_building.nix
+    # Optionally: (choose [ ./modules/toolsets/remote_building.nix ../toolsets/remote_building.nix ])
   ];
 
   config = {

nix-system-configs/modules/system/wireguard_server.nix

@@ -3,7 +3,9 @@
   pkgs,
   lib,
   ...
-}: {
+}: let
+  choose = paths: builtins.head (builtins.filter (p: builtins.pathExists p) paths);
+in {
   options.local = {
     hostname = lib.mkOption {
       type = lib.types.str;
@@ -28,11 +30,12 @@
   };
 
   imports = [
-    ./modules/desktop-manager/sway_greetd_homemanager.nix
+    (choose [ ./modules/desktop-manager/sway_greetd_homemanager.nix ../desktop-manager/sway_greetd_homemanager.nix ])
-    ./modules/local/hostname_username.nix
+    (choose [ ./modules/local/hostname_username.nix ../local/hostname_username.nix ])
-    ./modules/local/networking_local.nix
+    (choose [ ./modules/local/networking_local.nix ../local/networking_local.nix ])
-    ./modules/bootloader/seabios-assigned-iso-at-birth.nix
+    (choose [ ./modules/bootloader/seabios-assigned-iso-at-birth.nix ../bootloader/seabios-assigned-iso-at-birth.nix ])
-    ./modules/lix-default.nix
+    (choose [ ./modules/lix-default.nix ../lix-default.nix ])
+    (choose [ ./modules/secrets-config/sops-wireguard.nix ../secrets-config/sops-wireguard.nix ])
     # Optionally to enable remote building: ./modules/toolsets/remote_building.nix
     #./modules/songsheet/wavelog/docker-compose.nix
     #./modules/secrets-config/sops-the-blank-system.nix
@@ -76,18 +79,19 @@
         # Why 5182(0)? WireGuard server is running on port 51820,
         # thus we can use the "5182" infix in the IPv6 prefix to make it more memorable and less likely to cause confusion
         # with other local network services in the future.
-        postUp = ''
+        postSetup = ''
           ${pkgs.iptables}/bin/ip6tables -A FORWARD -i wg0 -j ACCEPT
           ${pkgs.iptables}/bin/ip6tables -t nat -A POSTROUTING -s fc00:5182::1:1/112  -o eth0 -j MASQUERADE
         '';
 
         # Undo the above
-        preDown = ''
+        postShutdown = ''
           ${pkgs.iptables}/bin/ip6tables -D FORWARD -i wg0 -j ACCEPT
           ${pkgs.iptables}/bin/ip6tables -t nat -D POSTROUTING -s fc00:5182::1:1/112 -o eth0 -j MASQUERADE
         '';
 
         privateKeyFile = config.sops.secrets.wireguard_private.path;
+        #presharedKeyFile = config.sops.secrets.wireguard_preshared.path;
       };
     };
 

nix-system-configs/secrets/build_machine/secrets.yaml

@@ -0,0 +1,25 @@
+runner_token: ENC[AES256_GCM,data:SEN4lL2cxkM/cExdasB2zIV3EDJcBIZOAr1ab6aLagPVReZ8UTaFKgMctnLIkA==,iv:EMUQW8ufCnbCeN3PmSoxBsHLukwS4yNSA3xor89uNxE=,tag:V8RDaeGMI4ReZrGTw9V2Qw==,type:str]
+sops:
+    age:
+        - recipient: age1746rvsvsc3snxfl7cndm222wd5kck4aqj3x7nednlegq0gdjhfcqx0qv7m
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1WEE5MUJiK0tUSmZMMXVq
+            LzdON0trT0NYbXZXdkluak9xQVlHM0F2OVI4CnFmaEpEdEVMalgxQjJMalp3Mjl3
+            M3l2WXpQVnZjYmtNSEJIWVR5cWlUbEEKLS0tIDNtVHRnRVl5RWdmRmNXYVFRbkNq
+            TFZpeGwrM2V3aWRybGE2WVNQRW5QV0kKdJb7svK5k5rYMtfiTsJy5QE3+1MP04jz
+            zadKKK+kDaK+h4AmkFGLRoKLpJoEU2nEUo2FD4LxiGOOvSXmeOUxbw==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1xtsm7kmql8794756ls53eu8pusyadk4lauadxx867tgsjhd38y5sj7elca
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGUEdoMkVyMjVsOG1LYkRW
+            M08xemlxRHU4THRidWZXZFhEdXFBV05YUFZRCjlpeERUbWVjY0cxMlk5elk1VHFn
+            UXgzNmVhbWh3MytRNXlJdkJ0ak4vQXcKLS0tIGZ1eEU2UjIxcmw1ZnVwTFVZSHMx
+            U3hva2JqWUdjR2JzTmpFanppUk5MTmsKwD8rlnddUQkgtuZLTgpmS4jGRmgNReUN
+            mEx0pxnWIIrLUGRgwE3WDbBVRTqVo1ai6BZY3FzBCnXU6zbNwYhqIg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-02-12T17:12:42Z"
+    mac: ENC[AES256_GCM,data:Z888IrMcNO0VwoliGoLS8SsZPffXvH2yY6w9y3i7laepvrq2dW2a3fx+urwzgYfpJBLMJQNJ10SauBINlgIYp5KYf1dMRSsLBbwIsJi90lmqmRSNmNdQmkJdwi4MhmQxbZmHpwrxwFrx9EAkWdWXKlMBCkO2WJxNVQdYVty2bNs=,iv:FssN2HByfcbgFY5NKEyadyrrdidFx5iHaEXX2rDLYvw=,tag:bRGpOVzv26kjOswlQC7aoA==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.11.0