.sops.yaml

@@ -1,7 +0,0 @@
-keys:
-  - &sv1 age1zr5m64rzl8r5pk5cnwcfycc8ze09lx4xqa6s0cpkf24gwwxxpy2sltfsug
-creation_rules:
-  - path_regex: library/secrets/.*.yaml
-    key_groups:
-      - age:
-        - *sv1

library/default.nix

@@ -3,5 +3,4 @@
 
   nixosSystems = lib.callFragment ./nixosSystems.nix {};
   sshKeys = lib.callFragment ./sshKeys.nix {};
-  secrets = lib.callFragment ./secrets {};
 }

library/secrets/default.nix

@@ -1,3 +0,0 @@
-{
-  sb1 = ./sb1.yaml;
-}

library/secrets/sb1.yaml

@@ -1,22 +0,0 @@
-sb1-username: ENC[AES256_GCM,data:c5Myt2AdnA==,iv:q36larVwGrBiCHBaUu54QdJggeL22QzOwkfiJfQjsVE=,tag:qsVj/akHjHZwjvnvaJRBEw==,type:str]
-sb1-password: ENC[AES256_GCM,data:766xhD3hcwFM9pyu53uYMg==,iv:HYtfnUvl46N/z5UUTIz337rq/kAHJcvgAcMbVnluik0=,tag:1oSSB1UqQIWmh7PJGO+YfQ==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age1zr5m64rzl8r5pk5cnwcfycc8ze09lx4xqa6s0cpkf24gwwxxpy2sltfsug
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFdlpSYXhOdndtS0Y0QTRz
-            N2pxczhIQVBWSnV1dnY3WDVVRlErYnh4OWdnClRUSjVXeWMrTmxWVEVGT0V6YUMr
-            V2ovSVhpcmRIN3ljWUx0cmJnSnBzMzAKLS0tIHBNalN3emcrbjZZcytoVFgyQTh2
-            elREcXRxeGdVTW1TZGtKelVURkdlWW8KSWpXIAL0Vb1a3un8WIcjMNbIbR41VcK2
-            604AZYjooB6OzX2sOkGOOAIvB17S2nesL/nQUobWkM8bQSuH/TgR5g==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-01-01T22:35:24Z"
-    mac: ENC[AES256_GCM,data:PH0lfE79d1ZuE0YyMZuWhpZNu1OHh+9JMNbr66RJoRRPpLa134Y6mQE+PzZXOZ0PR2mT+VOrkNhNRhzEhr79oScM0d3ahBfKVY8VcNpvP34Llb9PQWPAZpQ5moa9o6g850bLrXl3XolLPEMpZg4BVa5EzFjo9BXNbuSY/zoW2x0=,iv:my+mb+qbjDs3iHdmaEptylgHbNu7a6zwHx2NEhlwi1Q=,tag:YfEYhl4QOulNbKALLB8ylg==,type:str]
-    pgp: []
-    unencrypted_suffix: _unencrypted
-    version: 3.8.1

modules/sv1.nix

@@ -1,13 +1,11 @@
 {
   lib,
-  config,
   pkgs,
   ...
 }: {
   imports = with lib.nixosModules; [
     disko
     impermanence
-    sops
   ];
 
   disko.devices.disk.NixOS = {
@@ -100,34 +98,6 @@
   fileSystems = {
     "/persist".neededForBoot = true;
     "/var/log".neededForBoot = true;
-    "/mnt/sb1" = {
-      device = "//u424050.your-storagebox.de/backup";
-      fsType = "cifs";
-      options = [
-        "x-systemd.automount"
-        "noauto"
-        "x-systemd.idle-timeout=60"
-        "x-systemd.device-timeout=5s"
-        "x-systemd.mount-timeout=5s"
-        "credentials=${config.sops.templates.sb1-credentials.path}"
-      ];
-    };
-  };
-
-  sops = {
-    gnupg.sshKeyPaths = [];
-    age = {
-      sshKeyPaths = [];
-      keyFile = "/persist/sops.age";
-    };
-    secrets = {
-      sb1-username.sopsFile = lib.secrets.sb1;
-      sb1-password.sopsFile = lib.secrets.sb1;
-    };
-    templates.sb1-credentials.content = ''
-      username=${config.sops.placeholder.sb1-username}
-      password=${config.sops.placeholder.sb1-password}
-    '';
   };
 
   boot = {
@@ -182,19 +152,6 @@
   networking = {
     hostName = "sv1";
     networkmanager.enable = true;
-    firewall.allowedTCPPorts = [
-      80
-      443
-    ];
-  };
-
-  security.acme = {
-    acceptTerms = true;
-    defaults.email = "acme.evict519@simplelogin.com";
-    certs."dylanblades.com".extraDomainNames = [
-      "gitea.dylanblades.com"
-      "jellyfin.dylanblades.com"
-    ];
   };
 
   time.timeZone = "Europe/London";
@@ -222,114 +179,18 @@
     };
   };
 
-  services = {
-    openssh = {
-      enable = true;
-      settings.PermitRootLogin = "without-password";
-    };
-    gitea = {
-      enable = true;
-      useWizard = true;
-      appName = "Gitea";
-      settings = {
-        service.DISABLE_REGISTRATION = true;
-        server = {
-          DOMAIN = "gitea.dylanblades.com";
-          ROOT_URL = "https://gitea.dylanblades.com/";
-        };
-        ui.DEFAULT_THEME = "gitea-dark";
-      };
-    };
-    jellyfin.enable = true;
-    nginx = {
-      enable = true;
-      virtualHosts = {
-        "dylanblades.com" = {
-          forceSSL = true;
-          enableACME = true;
-          root = pkgs.my-site;
-        };
-        "gitea.dylanblades.com" = {
-          forceSSL = true;
-          useACMEHost = "dylanblades.com";
-          locations."/" = {
-            proxyPass = "http://localhost:3000";
-            extraConfig = ''
-              client_max_body_size 512M;
-              proxy_set_header Connection $http_connection;
-              proxy_set_header Upgrade $http_upgrade;
-              proxy_set_header Host $host;
-              proxy_set_header X-Real-IP $remote_addr;
-              proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-              proxy_set_header X-Forwarded-Proto $scheme;
-            '';
-          };
-        };
-        "jellyfin.dylanblades.com" = {
-          forceSSL = true;
-          useACMEHost = "dylanblades.com";
-          locations = {
-            "/" = {
-              proxyPass = "http://localhost:8096";
-              extraConfig = ''
-                client_max_body_size 20M;
-                proxy_set_header Host $host;
-                proxy_set_header X-Real-IP $remote_addr;
-                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-                proxy_set_header X-Forwarded-Proto $scheme;
-                proxy_set_header X-Forwarded-Protocol $scheme;
-                proxy_set_header X-Forwarded-Host $http_host;
-                proxy_buffering off;
-              '';
-            };
-            "/socket" = {
-              proxyPass = "http://localhost:8096";
-              extraConfig = ''
-                client_max_body_size 20M;
-                proxy_http_version 1.1;
-                proxy_set_header Upgrade $http_upgrade;
-                proxy_set_header Connection "upgrade";
-                proxy_set_header Host $host;
-                proxy_set_header X-Real-IP $remote_addr;
-                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-                proxy_set_header X-Forwarded-Proto $scheme;
-                proxy_set_header X-Forwarded-Protocol $scheme;
-                proxy_set_header X-Forwarded-Host $http_host;
-              '';
-            };
-          };
-        };
-      };
-    };
+  services.openssh = {
+    enable = true;
+    settings.PermitRootLogin = "without-password";
   };
 
   nixpkgs.overlays = [lib.overlays.pkgs];
   environment = {
     persistence."/persist" = {
       hideMounts = true;
-      directories = [
-        {
-          directory = "/var/lib/nixos";
-          user = "root";
-          group = "root";
-          mode = "u=rwx,g=rx,o=rx";
-        }
-        {
-          directory = "/var/lib/gitea";
-          user = "gitea";
-          group = "gitea";
-          mode = "u=rwx,g=rx,o=";
-        }
-        {
-          directory = "/var/lib/jellyfin";
-          user = "jellyfin";
-          group = "jellyfin";
-          mode = "u=rwx,g=rx,o=";
-        }
-      ];
+      directories = ["/var/lib/nixos"];
     };
     systemPackages = with pkgs; [
-      cifs-utils
       git
       my-vim
     ];

packages/default.nix

@@ -1,4 +1,3 @@
 {pkgs}: {
   my-vim = pkgs.callPackage ./my-vim {};
-  my-site = pkgs.callPackage ./my-site {};
 }

packages/my-site/default.nix

@@ -1,2 +0,0 @@
-{writeTextDir}:
-writeTextDir "index.html" "my-site"