.forgejo/workflows/build-modules.yml

@@ -1,23 +0,0 @@
-name: Build Nix modules (dry-run)
-
-on:
-  push:
-    branches:
-      - main
-
-jobs:
-  build-modules:
-    runs-on: docker
-    container:
-      image: lix:latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Run Dry Run (dry-run)
-        env:
-          NIX_CONFIG: experimental-features = nix-command flakes
-        run: |
-          set -eux
-          ./dry_run.zsh
-

.sops.yaml

@@ -3,7 +3,6 @@ keys:
   - &server_songsheet age1la8yjuc2ws9pyx70rc83jd2084v5e08v8fvh6muvfzrl2ulp8fms6frs86
   - &server_traefik age1rdcs8y4fjfyagwt2q9599ax329thceersh6dg2f0p6nsghm5xufq00qu0p
   - &server_database age1k9ddvzypz986a7dt403ja6evql2agz0gehll79mx64zceteya38smxph8m
-  - &server_build_machine age1xtsm7kmql8794756ls53eu8pusyadk4lauadxx867tgsjhd38y5sj7elca
   - &server_christine age1kzsrlz86y5nqe4vaufv8chupq2hrf3avlmxsp3d5p9t5xj593deszslkmp
 creation_rules:
   - path_regex: nix-system-configs/secrets/songsheet/[^/]+\.(yaml|json|env|ini)$
@@ -30,8 +29,3 @@ creation_rules:
     key_groups:
       - age:
           - *admin_christine
-  - path_regex: nix-system-configs/secrets/build_machine/[^/]+\.(yaml|json|env|ini)$
-    key_groups:
-      - age:
-          - *admin_christine
-          - *server_build_machine

documentation_titlepage.md

@@ -171,46 +171,6 @@ Synchronizes local system changes back to the repository. This script:
 5. Syncs changes from `/etc/nixos/modules` back to the repository
 6. Stages, commits, and pushes changes to the remote git repository with a timestamped commit message
 
-## Adding New Systems
-
-To add a new system configuration to the infrastructure:
-
-1. **Create the configuration file** in `nix-system-configs/modules/system/`:
-   ```bash
-   cp nix-system-configs/modules/system/blank_system_USE_THIS_AS_COPY.nix \
-      nix-system-configs/modules/system/your-new-system.nix
-   ```
-
-2. **Edit the configuration** to set your system's unique properties:
-   ```nix
-   config = {
-     local.hostname = "nixos-your-system";
-     local.username = "yourusername";
-     local.userDescription = "Your System Description";
-     local.address = "10.XXX.XXX.XXX";  # Choose an available IP
-     
-     system.stateVersion = "25.11";
-   };
-   ```
-
-3. **Register in `flake.nix`** to make it available for builds:
-   ```nix
-   nixosConfigurations = {
-     # ...existing configurations...
-     
-     "nixos-your-system" = nixpkgs.lib.nixosSystem {
-       inherit system;
-       modules = [ ./nix-system-configs/modules/system/your-new-system.nix ];
-     };
-   };
-   ```
-4. ***IF YOU WANT TO CHECK IT MANUALLY*** - **Test the configuration** before deploying, change the `nixos-your-system` accordingly:
-   ```bash
-   nix build .#nixosConfigurations.nixos-your-system.config.system.build.toplevel
-   ```
-
-Once the build succeeds, the configuration is ready for deployment using the `pull.zsh` script on the target machine.
-
 ## How to maintain the local machines
 
 > [!NOTE] The following maintenance scripts should be made less unwieldy to use, so they will be changed in the next 

dry_run.zsh

@@ -1,28 +0,0 @@
-#!/usr/bin/env zsh
-
-export NIX_CONFIG="experimental-features = nix-command flakes"
-
-echo "=== nix --version ==="
-nix --version
-echo
-
-configs=(
-  "nixos-local-wireguard-server"
-  "nixos-blank"
-  "nixos-songsheet"
-  "nixos-database"
-  "nixos-forgejo"
-  "nixos-teamspeak"
-  "nixos-traefik"
-  "nixos-build-machine"
-)
-
-if [[ -n "$1" ]]; then
-  configs=("$1")
-fi
-
-for config in "${configs[@]}"; do
-  echo "=== Dry-run: $config ==="
-  nix build --dry-run ".#nixosConfigurations.${config}.config.system.build.toplevel" || true
-  echo
-done

flake.lock

@@ -1,27 +0,0 @@
-{
-  "nodes": {
-    "nixpkgs": {
-      "locked": {
-        "lastModified": 1770770419,
-        "narHash": "sha256-iKZMkr6Cm9JzWlRYW/VPoL0A9jVKtZYiU4zSrVeetIs=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "6c5e707c6b5339359a9a9e215c5e66d6d802fd7a",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-25.11",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "root": {
-      "inputs": {
-        "nixpkgs": "nixpkgs"
-      }
-    }
-  },
-  "root": "root",
-  "version": 7
-}

flake.nix

@@ -1,57 +0,0 @@
-{
-  description = "PRG Server Infrastructure - NixOS Configurations";
-
-  inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
-  };
-
-  outputs = {
-    self,
-    nixpkgs,
-    ...
-  }: let
-    system = "x86_64-linux";
-  in {
-    nixosConfigurations = {
-      "nixos-local-wireguard-server" = nixpkgs.lib.nixosSystem {
-        inherit system;
-        modules = [./nix-system-configs/modules/system/wireguard_server.nix];
-      };
-
-      "nixos-blank" = nixpkgs.lib.nixosSystem {
-        inherit system;
-        modules = [./nix-system-configs/modules/system/blank_system_USE_THIS_AS_COPY.nix];
-      };
-
-      "nixos-songsheet" = nixpkgs.lib.nixosSystem {
-        inherit system;
-        modules = [./nix-system-configs/modules/system/compose-songsheet.nix];
-      };
-
-      "nixos-database" = nixpkgs.lib.nixosSystem {
-        inherit system;
-        modules = [./nix-system-configs/modules/system/database.nix];
-      };
-
-      "nixos-forgejo" = nixpkgs.lib.nixosSystem {
-        inherit system;
-        modules = [./nix-system-configs/modules/system/forgejo.nix];
-      };
-
-      "nixos-teamspeak" = nixpkgs.lib.nixosSystem {
-        inherit system;
-        modules = [./nix-system-configs/modules/system/teamspeak.nix];
-      };
-
-      "nixos-traefik" = nixpkgs.lib.nixosSystem {
-        inherit system;
-        modules = [./nix-system-configs/modules/system/traefik.nix];
-      };
-
-      "nixos-build-machine" = nixpkgs.lib.nixosSystem {
-        inherit system;
-        modules = [./nix-system-configs/modules/system/build_machine.nix];
-      };
-    };
-  };
-}

nix-system-configs/modules/desktop-manager/sway_greetd_homemanager.nix

@@ -4,10 +4,7 @@
   lib,
   ...
 }: let
-  home-manager = builtins.fetchTarball {
+  home-manager = builtins.fetchTarball "https://github.com/nix-community/home-manager/archive/release-25.11.tar.gz";
-    url = "https://github.com/nix-community/home-manager/archive/release-25.11.tar.gz";
-    sha256 = "1kqxy6r4ahnbazmpa4pncdp62najdikdaw8hvrv8nl6qxvbmf9fy";
-  };
   cfg = config.services.forgejo;
   srv = cfg.settings.server;
 in {

nix-system-configs/modules/secrets-config/notes.md

@@ -1,7 +1,6 @@
 To generate the keys beforehand
 ```ssh
 nix-shell -p age
-sudo mkdir /var/lib/sops-nix
+/var/lib/sops-nix/key.txt
-age-keygen -o /var/lib/sops-nix/key.txt
 ```
 And then update the .sops.yaml in the project directory accordingly.

nix-system-configs/modules/secrets-config/sops-build-machine.nix

@@ -1,38 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: {
-  imports = let
-    # replace this with an actual commit id or tag
-    commit = "17eea6f3816ba6568b8c81db8a4e6ca438b30b7c";
-  in [
-    "${builtins.fetchTarball {
-      url = "https://github.com/Mic92/sops-nix/archive/${commit}.tar.gz";
-      # replace this with an actual hash
-      sha256 = "ktjWTq+D5MTXQcL9N6cDZXUf9kX8JBLLBLT0ZyOTSYY=";
-    }}/modules/sops"
-  ];
-
-  # This will add secrets.yml to the nix store
-  # You can avoid this by adding a string to the full path instead, i.e.
-  # sops.defaultSopsFile = "/root/.sops/secrets/example.yaml";
-  sops.defaultSopsFile = ../../secrets/build_machine/secrets.yaml;
-  # This will automatically import SSH keys as age keys
-  #sops.age.sshKeyPaths = ["/home/nixosdd/.ssh/id_ed25519"];
-  # This is using an age key that is expected to already be in the filesystem
-  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
-  # This will generate a new key if the key specified above does not exist
-  sops.age.generateKey = true;
-
-  # Export individual WireGuard keys from the SOPS YAML as text secrets so they
-  # are available both as strings and as files (.path)
-  sops.secrets."runner_token" = {
-    format = "yaml";
-    sopsFile = ../../secrets/build_machine/secrets.yaml;
-    owner = "root";
-    mode = "0400";
-  };
-
-}

nix-system-configs/modules/secrets-config/sops-wireguard.nix

@@ -1,51 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: {
-  imports = let
-    # replace this with an actual commit id or tag
-    commit = "17eea6f3816ba6568b8c81db8a4e6ca438b30b7c";
-  in [
-    "${builtins.fetchTarball {
-      url = "https://github.com/Mic92/sops-nix/archive/${commit}.tar.gz";
-      # replace this with an actual hash
-      sha256 = "ktjWTq+D5MTXQcL9N6cDZXUf9kX8JBLLBLT0ZyOTSYY=";
-    }}/modules/sops"
-  ];
-
-  # This will add secrets.yml to the nix store
-  # You can avoid this by adding a string to the full path instead, i.e.
-  # sops.defaultSopsFile = "/root/.sops/secrets/example.yaml";
-  sops.defaultSopsFile = ../../secrets/wireguard/secrets.yaml;
-  # This will automatically import SSH keys as age keys
-  #sops.age.sshKeyPaths = ["/home/nixosdd/.ssh/id_ed25519"];
-  # This is using an age key that is expected to already be in the filesystem
-  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
-  # This will generate a new key if the key specified above does not exist
-  sops.age.generateKey = true;
-
-  # Export individual WireGuard keys from the SOPS YAML as text secrets so they
-  # are available both as strings and as files (.path)
-  sops.secrets."wireguard_private" = {
-    format = "yaml";
-    sopsFile = ../../secrets/wireguard/secrets.yaml;
-    owner = "root";
-    mode = "0400";
-  };
-
-  sops.secrets."wireguard_preshared" = {
-    format = "yaml";
-    sopsFile = ../../secrets/wireguard/secrets.yaml;
-    owner = "root";
-    mode = "0400";
-  };
-
-  sops.secrets."wireguard_public" = {
-    format = "yaml";
-    sopsFile = ../../secrets/wireguard/secrets.yaml;
-    owner = "root";
-    mode = "0444";
-  };
-}

nix-system-configs/modules/system/blank_system_USE_THIS_AS_COPY.nix

@@ -3,9 +3,7 @@
   pkgs,
   lib,
   ...
-}: let
+}: {
-  choose = paths: builtins.head (builtins.filter (p: builtins.pathExists p) paths);
-in {
   options.local = {
     hostname = lib.mkOption {
       type = lib.types.str;
@@ -30,11 +28,14 @@ in {
   };
 
   imports = [
-    (choose [ ./modules/local/hostname_username.nix ../local/hostname_username.nix ])
+    ./modules/desktop-manager/sway_greetd_homemanager.nix
-    (choose [ ./modules/local/networking_local.nix ../local/networking_local.nix ])
+    ./modules/local/hostname_username.nix
-    (choose [ ./modules/bootloader/seabios-assigned-iso-at-birth.nix ../bootloader/seabios-assigned-iso-at-birth.nix ])
+    ./modules/local/networking_local.nix
-    (choose [ ./modules/lix-default.nix ../lix-default.nix ])
+    ./modules/bootloader/seabios-assigned-iso-at-birth.nix
-    (choose [ ./modules/secrets-config/sops-the-blank-system.nix ../secrets-config/sops-the-blank-system.nix ])
+    ./modules/lix-default.nix
+    # Optionally to enable remote building: ./modules/toolsets/remote_building.nix
+    #./modules/songsheet/wavelog/docker-compose.nix
+    #./modules/secrets-config/sops-the-blank-system.nix
   ];
 
   config = {

nix-system-configs/modules/system/build_machine.nix

@@ -1,262 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: let
-  choose = paths: builtins.head (builtins.filter (p: builtins.pathExists p) paths);
-in {
-  options.local = {
-    hostname = lib.mkOption {
-      type = lib.types.str;
-      default = "nixos-build-machine";
-      description = "System hostname";
-    };
-    username = lib.mkOption {
-      type = lib.types.str;
-      default = "nixosbm";
-      description = "Primary user username";
-    };
-    userDescription = lib.mkOption {
-      type = lib.types.str;
-      default = "NixOS Build Machine";
-      description = "Primary user description";
-    };
-    address = lib.mkOption {
-      type = lib.types.str;
-      default = "10.1.1.3";
-      description = "Static IP address";
-    };
-  };
-
-  imports = [
-    (choose [ ./modules/local/hostname_username.nix ../local/hostname_username.nix ])
-    (choose [ ./modules/local/networking_local.nix ../local/networking_local.nix ])
-    (choose [ ./modules/lix-default.nix ../lix-default.nix ])
-    (choose [ ./modules/secrets-config/sops-build-machine.nix ../secrets-config/sops-build-machine.nix ])
-    ## TODO: Make this more elegant and less risky for unexpected errors happening.
-  ] ++ lib.optional (builtins.pathExists ./hardware-configuration.nix) ./hardware-configuration.nix;
-
-  config = {
-    # Local metadata
-    local.hostname = "nixos-build-machine";
-    local.username = "nixosbm";
-    local.userDescription = "NixOS Build Machine";
-    local.address = "10.1.1.3";
-
-    # Enable Rsync
-    services.rsync.enable = true;
-
-    # Passwordless sudo for wheel group
-    security.sudo.wheelNeedsPassword = false;
-
-    # Hardware U2F support - Passwordless sudo with hardware key
-    security.pam.u2f = {
-      enable = true;
-      settings = {
-        authfile = "/etc/u2f_keys";
-        cue = true;
-        pinverification = 0; # No PIN verification
-        userpresence = 1; # Require user presence (touch)
-      };
-    };
-
-    # Optimize builds
-    nix.settings = {
-      # Enable parallel building
-      max-jobs = "auto";
-      cores = 0; # Use all available cores
-
-      # Optimize store operations
-      auto-optimise-store = true;
-
-      # Build settings
-      sandbox = true;
-      keep-outputs = true;
-      keep-derivations = true;
-    };
-
-    # Enable distributed builds (optional, for your VM setup)
-    nix.buildMachines = [];
-    nix.distributedBuilds = false;
-
-    # Optimize garbage collection
-    nix.gc = {
-      automatic = true;
-      dates = "weekly";
-      options = "--delete-older-than 30d";
-    };
-
-    # Increase build speed with tmpfs for builds (if you have enough RAM)
-    # Comment out if low on memory
-    systemd.services.nix-daemon.environment = {
-      TMPDIR = "/tmp";
-    };
-    boot.tmp.useTmpfs = true;
-    boot.tmp.tmpfsSize = "50%"; # Adjust based on your 62GB RAM
-
-    # SSH Agent authentication
-    security.pam.sshAgentAuth.enable = true;
-
-    # Automatic upgrades
-    system.autoUpgrade = {
-      enable = true; # Set to true for automatic updates
-      dates = "daily";
-      allowReboot = false;
-    };
-
-    # Bootloader fallback settings are provided by the seabios import
-    # (seabios-assigned-iso-at-birth.nix)
-
-    # Replicate systemd-boot configuration from the deprecated configuration
-    # so the system is bootable (matches build-deprecated/configuration.nix).
-    boot.loader.systemd-boot.enable = true;
-    boot.loader.efi.canTouchEfiVariables = true;
-
-    # Enable Tailscale
-    services.tailscale.enable = true;
-
-    # Define a user account. Don't forget to set a password with ‘passwd’.
-    users.users.nixosbm = {
-      isNormalUser = true;
-      description = "NixOS Build Machine";
-      extraGroups = ["networkmanager" "wheel"];
-      packages = with pkgs; [];
-    };
-
-    # Remote builder server setup
-    users.users.nixremote = {
-      isNormalUser = true;
-      description = "Nix Remote Builder";
-      home = "/home/nixremote";
-      createHome = true;
-
-      # SSH key for remote builds
-      openssh.authorizedKeys.keys = [
-        # Add the public key from your client machines here
-        # Example: "ssh-ed25519 AAAAC3... root@client-machine"
-      ];
-    };
-
-    systemd.tmpfiles.rules = [
-      "z /home/nixremote 0555 nixremote nixremote - -"
-      "z /home/nixremote/.ssh 0555 nixremote nixremote - -"
-    ];
-
-    # Allow unfree packages
-    nixpkgs.config.allowUnfree = true;
-
-    # List packages installed in system profile. To search, run:
-    # $ nix search wget
-    environment.systemPackages = with pkgs; [
-      wget
-      fastfetch
-      hyfetch
-      helix
-    ];
-
-    programs.gnupg.agent = {
-      enable = true;
-      enableSSHSupport = true;
-    };
-
-    # Enable the OpenSSH daemon.
-    services.openssh.enable = true;
-
-# Enable Podman for Gitea Actions Runner
-    virtualisation.podman = {
-      enable = true;
-      dockerCompat = true;
-      defaultNetwork.settings.dns_enabled = true;
-    };
-
-
-    # Network configuration for the build machine on the Proxmox bridge
-    networking.interfaces.ens18.ipv4.addresses = [
-      {
-        address = config.local.address;
-        #dns = "10.1.1.2";
-        prefixLength = 24;
-      }
-    ];
-    networking.defaultGateway = "10.1.1.1";
-    environment.etc."resolv.conf".text = ''
-      nameserver 10.1.1.2
-    '';
-
-    services.gitea-actions-runner = {
-      package = pkgs.forgejo-runner;
-      instances.default = {
-        enable = true;
-        name = "monolith";
-        url = "https://git.prg-radio.org";
-        # Obtaining the path to the runner token file may differ
-        # tokenFile should be in format TOKEN=<secret>, since it's EnvironmentFile for systemd
-        tokenFile = config.sops.secrets.runner_token.path;
-        labels = [
-          "lix:docker://git.lix.systems/lix-project/lix:latest"
-          "nix:docker://git.lix.systems/lix-project/lix:latest"
-          "ubuntu-bleeding-edge:docker://ubuntu:resolute"
-          "ubuntu-latest:docker://ubuntu:plucky"
-          "ubuntu-24.04:docker://ubuntu:noble"
-          "alpine:docker://alpine:edge"
-          "rust:docker://rust:trixie"
-          "python-315:docker://python:3.15.0a6-slim-trixie"
-        ];
-      };
-    };
-
-    # This value determines the NixOS release from which the default
-    # settings for stateful data, like file locations and database versions
-    # on your system were taken. It‘s perfectly fine and recommended to leave
-    # this value at the release version of the first install of this system.
-    # Before changing this value read the documentation for this option
-    # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
-    system.stateVersion = "25.11"; # Did you read the comment?
-
-    # Helpful commented examples for remote-build configuration retained from original
-    # THE FOLLOWING CODE BLOCK IS FOR COPYING TO OTHER CONFIGURATIONS, NOT FOR THIS FILE
-    #  nix.distributedBuilds = true;
-    #  nix.buildMachines = [
-    #    {
-    #      hostName = "nixos-build-machine";
-    #      system = "x86_64-linux";
-    #      sshUser = "nixremote";
-    #      sshKey = "/root/.ssh/nixremote";
-    #      maxJobs = 4;
-    #      speedFactor = 2;
-    #          supportedFeatures = [ "nixos-test" "benchmark" "big-parallel" "kvm" ];
-    #    }
-    #  ];
-    #
-    # Generate SSH key for remote building
-    #systemd.services.generate-nixremote-key = {
-    #  description = "Generate SSH key for remote Nix builds";
-    #  wantedBy = [ "multi-user.target" ];
-    #  serviceConfig = {
-    #    Type = "oneshot";
-    #    RemainAfterExit = true;
-    #  };
-    #  script = ''
-    #    if [ ! -f /root/.ssh/nixremote ]; then
-    #      ${pkgs.openssh}/bin/ssh-keygen -t ed25519 -f /root/.ssh/nixremote -N "" -C "nix-remote-builder"
-    #    fi
-    #  '';
-    #};
-    #
-    #programs.ssh.extraConfig = ''
-    #  Host nixos-build-machine
-    #    HostName 192.168.1.175
-    #    IdentitiesOnly yes;
-    #    IdentityFile /root/.ssh/nixremote
-    #    User nixremoteStrictHostKeyChecking accept-new
-    #'';
-    #
-    # Manual step required: After rebuilding the client, copy /root/.ssh/nixremote.pub
-    # from the client to the build machine's users.users.nixremote.openssh.authorizedKeys.keys list,
-    # then rebuild the build machine.
-    # i.e on the client: run "cat /root.ssh/nixremote.pub"
-    # and copy the output to the build machine's configuration.nix
-  };
-}
-

nix-system-configs/modules/system/compose-songsheet.nix

@@ -3,9 +3,7 @@
   pkgs,
   lib,
   ...
-}: let
+}: {
-  choose = paths: builtins.head (builtins.filter (p: builtins.pathExists p) paths);
-in {
   options.local = {
     hostname = lib.mkOption {
       type = lib.types.str;
@@ -30,16 +28,17 @@ in {
   };
 
   imports = [
-    (choose [ ./modules/desktop-manager/sway_greetd_homemanager.nix ../desktop-manager/sway_greetd_homemanager.nix ])
+    ./modules/desktop-manager/sway_greetd_homemanager.nix
-    (choose [ ./modules/local/hostname_username.nix ../local/hostname_username.nix ])
+    ./modules/local/hostname_username.nix
-    (choose [ ./modules/local/networking_local.nix ../local/networking_local.nix ])
+    ./modules/local/networking_local.nix
-    (choose [ ./modules/bootloader/seabios-assigned-iso-at-birth.nix ../bootloader/seabios-assigned-iso-at-birth.nix ])
+    ./modules/bootloader/seabios-assigned-iso-at-birth.nix
-    (choose [ ./modules/lix-default.nix ../lix-default.nix ])
+    ./modules/lix-default.nix
-    # Optionally: (choose [ ./modules/toolsets/remote_building.nix ../toolsets/remote_building.nix ])
+    # Optionally: ./modules/toolsets/remote_building.nix
-
+    #
+    #
     ## Compose modules for Portainer service
-    (choose [ ./modules/songsheet/wavelog/docker-compose.nix ../songsheet/wavelog/docker-compose.nix ])
+    ./modules/songsheet/wavelog/docker-compose.nix
-    (choose [ ./modules/secrets-config/sops-composesongsheet.nix ../secrets-config/sops-composesongsheet.nix ])
+    ./modules/secrets-config/sops-composesongsheet.nix
   ];
 
   config = {

nix-system-configs/modules/system/database.nix

@@ -3,9 +3,7 @@
   pkgs,
   lib,
   ...
-}: let
+}: {
-  choose = paths: builtins.head (builtins.filter (p: builtins.pathExists p) paths);
-in {
   options.local = {
     hostname = lib.mkOption {
       type = lib.types.str;
@@ -30,15 +28,14 @@ in {
   };
 
   imports = [
-    (choose [ ./modules/desktop-manager/gnome.nix ../desktop-manager/gnome.nix ])
+    ./modules/desktop-manager/gnome.nix
-    (choose [ ./modules/local/hostname_username.nix ../local/hostname_username.nix ])
+    ./modules/local/hostname_username.nix
-    (choose [ ./modules/local/networking_local.nix ../local/networking_local.nix ])
+    ./modules/local/networking_local.nix
-    (choose [ ./modules/bootloader/seabios-assigned-iso-at-birth.nix ../bootloader/seabios-assigned-iso-at-birth.nix ])
+    ./modules/lix-default.nix
-    (choose [ ./modules/lix-default.nix ../lix-default.nix ])
+    ./modules/secrets-config/sops-database.nix
-    (choose [ ./modules/secrets-config/sops-database.nix ../secrets-config/sops-database.nix ])
+    ./modules/system_scripts/gcloud_backup.nix
-    (choose [ ./modules/system_scripts/gcloud_backup.nix ../system_scripts/gcloud_backup.nix ])
+    ./hardware-configuration.nix
-    ## TODO: Make this more elegant and less risky for unexpected errors happening.
+  ];
-  ] ++ lib.optional (builtins.pathExists ./hardware-configuration.nix) ./hardware-configuration.nix;
 
   config = {
     local.hostname = "nixosdd";

nix-system-configs/modules/system/forgejo.nix

@@ -7,7 +7,6 @@
   home-manager = builtins.fetchTarball "https://github.com/nix-community/home-manager/archive/release-25.11.tar.gz";
   cfg = config.services.forgejo;
   srv = cfg.settings.server;
-  choose = paths: builtins.head (builtins.filter (p: builtins.pathExists p) paths);
 in {
   options.local = {
     hostname = lib.mkOption {
@@ -33,12 +32,12 @@ in {
   };
 
   imports = [
-    (choose [ ./modules/desktop-manager/sway_greetd_homemanager.nix ../desktop-manager/sway_greetd_homemanager.nix ])
+    ./modules/desktop-manager/sway_greetd_homemanager.nix
-    (choose [ ./modules/local/hostname_username.nix ../local/hostname_username.nix ])
+    ./modules/local/hostname_username.nix
-    (choose [ ./modules/local/networking_local.nix ../local/networking_local.nix ])
+    ./modules/local/networking_local.nix
-    (choose [ ./modules/toolsets/remote_building.nix ../toolsets/remote_building.nix ])
+    ./modules/toolsets/remote_building.nix
-    (choose [ ./modules/bootloader/seabios-assigned-proxmox-at-birth.nix ../bootloader/seabios-assigned-proxmox-at-birth.nix ])
+    ./modules/bootloader/seabios-assigned-proxmox-at-birth.nix
-    (choose [ ./modules/lix-default.nix ../lix-default.nix ])
+    ./modules/lix-default.nix
   ];
 
   config = {

nix-system-configs/modules/system/teamspeak.nix

@@ -3,9 +3,7 @@
   pkgs,
   lib,
   ...
-}: let
+}: {
-  choose = paths: builtins.head (builtins.filter (p: builtins.pathExists p) paths);
-in {
   options.local = {
     hostname = lib.mkOption {
       type = lib.types.str;
@@ -30,15 +28,17 @@ in {
   };
 
   imports = [
-    (choose [ ./modules/desktop-manager/sway_greetd_homemanager.nix ../desktop-manager/sway_greetd_homemanager.nix ])
+    ./modules/desktop-manager/sway_greetd_homemanager.nix
-    (choose [ ./modules/local/hostname_username.nix ../local/hostname_username.nix ])
+    ./modules/local/hostname_username.nix
-    (choose [ ./modules/local/networking_local.nix ../local/networking_local.nix ])
+    ./modules/local/networking_local.nix
-    (choose [ ./modules/bootloader/seabios-assigned-iso-at-birth.nix ../bootloader/seabios-assigned-iso-at-birth.nix ])
+    ./modules/bootloader/seabios-assigned-iso-at-birth.nix
-    (choose [ ./modules/lix-default.nix ../lix-default.nix ])
+    ./modules/lix-default.nix
-    # Optionally: (choose [ ./modules/toolsets/remote_building.nix ../toolsets/remote_building.nix ])
+    # Optionally: ./modules/toolsets/remote_building.nix
+    #
+    #
     ## Compose modules for Portainer service
-    (choose [ ./modules/songsheet/wavelog/docker-compose.nix ../songsheet/wavelog/docker-compose.nix ])
+    ./modules/songsheet/wavelog/docker-compose.nix
-    (choose [ ./modules/secrets-config/sops-composesongsheet.nix ../secrets-config/sops-composesongsheet.nix ])
+    ./modules/secrets-config/sops-composesongsheet.nix
   ];
 
   config = {

nix-system-configs/modules/system/traefik.nix

@@ -3,9 +3,7 @@
   pkgs,
   lib,
   ...
-}: let
+}: {
-  choose = paths: builtins.head (builtins.filter (p: builtins.pathExists p) paths);
-in {
   options.local = {
     hostname = lib.mkOption {
       type = lib.types.str;
@@ -30,12 +28,12 @@ in {
   };
 
   imports = [
-    (choose [ ./modules/desktop-manager/sway_greetd_homemanager.nix ../desktop-manager/sway_greetd_homemanager.nix ])
+    ./modules/desktop-manager/sway_greetd_homemanager.nix
-    (choose [ ./modules/local/hostname_username.nix ../local/hostname_username.nix ])
+    ./modules/local/hostname_username.nix
-    (choose [ ./modules/local/networking_local.nix ../local/networking_local.nix ])
+    ./modules/local/networking_local.nix
-    (choose [ ./modules/bootloader/seabios-assigned-iso-at-birth.nix ../bootloader/seabios-assigned-iso-at-birth.nix ])
+    ./modules/bootloader/seabios-assigned-iso-at-birth.nix
-    (choose [ ./modules/lix-default.nix ../lix-default.nix ])
+    ./modules/lix-default.nix
-    # Optionally: (choose [ ./modules/toolsets/remote_building.nix ../toolsets/remote_building.nix ])
+    # Optionally: ./modules/toolsets/remote_building.nix
   ];
 
   config = {

nix-system-configs/modules/system/wireguard_server.nix

@@ -3,9 +3,7 @@
   pkgs,
   lib,
   ...
-}: let
+}: {
-  choose = paths: builtins.head (builtins.filter (p: builtins.pathExists p) paths);
-in {
   options.local = {
     hostname = lib.mkOption {
       type = lib.types.str;
@@ -30,12 +28,11 @@ in {
   };
 
   imports = [
-    (choose [ ./modules/desktop-manager/sway_greetd_homemanager.nix ../desktop-manager/sway_greetd_homemanager.nix ])
+    ./modules/desktop-manager/sway_greetd_homemanager.nix
-    (choose [ ./modules/local/hostname_username.nix ../local/hostname_username.nix ])
+    ./modules/local/hostname_username.nix
-    (choose [ ./modules/local/networking_local.nix ../local/networking_local.nix ])
+    ./modules/local/networking_local.nix
-    (choose [ ./modules/bootloader/seabios-assigned-iso-at-birth.nix ../bootloader/seabios-assigned-iso-at-birth.nix ])
+    ./modules/bootloader/seabios-assigned-iso-at-birth.nix
-    (choose [ ./modules/lix-default.nix ../lix-default.nix ])
+    ./modules/lix-default.nix
-    (choose [ ./modules/secrets-config/sops-wireguard.nix ../secrets-config/sops-wireguard.nix ])
     # Optionally to enable remote building: ./modules/toolsets/remote_building.nix
     #./modules/songsheet/wavelog/docker-compose.nix
     #./modules/secrets-config/sops-the-blank-system.nix
@@ -79,19 +76,18 @@ in {
         # Why 5182(0)? WireGuard server is running on port 51820,
         # thus we can use the "5182" infix in the IPv6 prefix to make it more memorable and less likely to cause confusion
         # with other local network services in the future.
-        postSetup = ''
+        postUp = ''
           ${pkgs.iptables}/bin/ip6tables -A FORWARD -i wg0 -j ACCEPT
           ${pkgs.iptables}/bin/ip6tables -t nat -A POSTROUTING -s fc00:5182::1:1/112  -o eth0 -j MASQUERADE
         '';
 
         # Undo the above
-        postShutdown = ''
+        preDown = ''
           ${pkgs.iptables}/bin/ip6tables -D FORWARD -i wg0 -j ACCEPT
           ${pkgs.iptables}/bin/ip6tables -t nat -D POSTROUTING -s fc00:5182::1:1/112 -o eth0 -j MASQUERADE
         '';
 
         privateKeyFile = config.sops.secrets.wireguard_private.path;
-        #presharedKeyFile = config.sops.secrets.wireguard_preshared.path;
       };
     };
 

nix-system-configs/secrets/build_machine/secrets.yaml

@@ -1,25 +0,0 @@
-runner_token: ENC[AES256_GCM,data:SEN4lL2cxkM/cExdasB2zIV3EDJcBIZOAr1ab6aLagPVReZ8UTaFKgMctnLIkA==,iv:EMUQW8ufCnbCeN3PmSoxBsHLukwS4yNSA3xor89uNxE=,tag:V8RDaeGMI4ReZrGTw9V2Qw==,type:str]
-sops:
-    age:
-        - recipient: age1746rvsvsc3snxfl7cndm222wd5kck4aqj3x7nednlegq0gdjhfcqx0qv7m
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1WEE5MUJiK0tUSmZMMXVq
-            LzdON0trT0NYbXZXdkluak9xQVlHM0F2OVI4CnFmaEpEdEVMalgxQjJMalp3Mjl3
-            M3l2WXpQVnZjYmtNSEJIWVR5cWlUbEEKLS0tIDNtVHRnRVl5RWdmRmNXYVFRbkNq
-            TFZpeGwrM2V3aWRybGE2WVNQRW5QV0kKdJb7svK5k5rYMtfiTsJy5QE3+1MP04jz
-            zadKKK+kDaK+h4AmkFGLRoKLpJoEU2nEUo2FD4LxiGOOvSXmeOUxbw==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1xtsm7kmql8794756ls53eu8pusyadk4lauadxx867tgsjhd38y5sj7elca
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGUEdoMkVyMjVsOG1LYkRW
-            M08xemlxRHU4THRidWZXZFhEdXFBV05YUFZRCjlpeERUbWVjY0cxMlk5elk1VHFn
-            UXgzNmVhbWh3MytRNXlJdkJ0ak4vQXcKLS0tIGZ1eEU2UjIxcmw1ZnVwTFVZSHMx
-            U3hva2JqWUdjR2JzTmpFanppUk5MTmsKwD8rlnddUQkgtuZLTgpmS4jGRmgNReUN
-            mEx0pxnWIIrLUGRgwE3WDbBVRTqVo1ai6BZY3FzBCnXU6zbNwYhqIg==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-02-12T17:12:42Z"
-    mac: ENC[AES256_GCM,data:Z888IrMcNO0VwoliGoLS8SsZPffXvH2yY6w9y3i7laepvrq2dW2a3fx+urwzgYfpJBLMJQNJ10SauBINlgIYp5KYf1dMRSsLBbwIsJi90lmqmRSNmNdQmkJdwi4MhmQxbZmHpwrxwFrx9EAkWdWXKlMBCkO2WJxNVQdYVty2bNs=,iv:FssN2HByfcbgFY5NKEyadyrrdidFx5iHaEXX2rDLYvw=,tag:bRGpOVzv26kjOswlQC7aoA==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.11.0