rp5: add nixos-hardware for config

Reviewed-on: #9

.envrc

@@ -0,0 +1 @@
+export SOPS_AGE_KEY=$(ssh-to-age -i ~/.ssh/id_ed25519 -private-key)

.sops.yaml

@@ -1,5 +1,7 @@
 keys:
   - &primary age1amdd4hu6k0czf3mtlhd03yj3yzkdaynl7q5fdlqmjzpe9pwgxfjs3j0c85
+  - &yggdrasil age1xxv54tzxz6n4cp4undmejl2lyd7k7s3yh9q0z6ed83evfuz6asqsqhaduv
+  - &loptland age13xshg5e6ucvnu3vqgn344mxpk5kcqutv2lf4gdffvwadq0ku5ewqy4cck6
 creation_rules:
   - path_regex: secrets/secrets.yaml$
     key_groups: 
@@ -10,8 +12,10 @@ creation_rules:
     key_groups: 
     - age:
       - *primary
+      - *yggdrasil
       
   - path_regex: secrets/secrets-loptland.yaml$
     key_groups: 
     - age:
       - *primary
+      - *loptland

flake.lock

@@ -741,6 +741,40 @@
         "type": "github"
       }
     },
+    "libcamera-src": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1725630279,
+        "narHash": "sha256-KH30jmHfxXq4j2CL7kv18DYECJRp9ECuWNPnqPZajPA=",
+        "owner": "raspberrypi",
+        "repo": "libcamera",
+        "rev": "69a894c4adad524d3063dd027f5c4774485cf9db",
+        "type": "github"
+      },
+      "original": {
+        "owner": "raspberrypi",
+        "repo": "libcamera",
+        "rev": "69a894c4adad524d3063dd027f5c4774485cf9db",
+        "type": "github"
+      }
+    },
+    "libpisp-src": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1724944683,
+        "narHash": "sha256-Fo2UJmQHS855YSSKKmGrsQnJzXog1cdpkIOO72yYAM4=",
+        "owner": "raspberrypi",
+        "repo": "libpisp",
+        "rev": "28196ed6edcfeda88d23cc5f213d51aa6fa17bb3",
+        "type": "github"
+      },
+      "original": {
+        "owner": "raspberrypi",
+        "ref": "v1.0.7",
+        "repo": "libpisp",
+        "type": "github"
+      }
+    },
     "nix-ld": {
       "inputs": {
         "nixpkgs": [
@@ -816,17 +850,17 @@
     },
     "nixpkgs-latest-factorio": {
       "locked": {
-        "lastModified": 1730638571,
-        "narHash": "sha256-z9Wy1jmhFrABK3cEyiVmQtUwOuQW1YPwA8+HMnbEpnE=",
+        "lastModified": 1731242709,
+        "narHash": "sha256-zGhhtd4U3AxjA5dqzbHhD10q74Ychyu5mNGI7ic+Yng=",
         "owner": "Daholli",
         "repo": "nixpkgs",
-        "rev": "d941e9aa2d89f377d45516c5edd765fef15ea90a",
+        "rev": "2adc4d1f11c5abcf654ed50c2cbce897c6e78ccc",
         "type": "github"
       },
       "original": {
         "owner": "Daholli",
         "repo": "nixpkgs",
-        "rev": "d941e9aa2d89f377d45516c5edd765fef15ea90a",
+        "rev": "2adc4d1f11c5abcf654ed50c2cbce897c6e78ccc",
         "type": "github"
       }
     },
@@ -1026,6 +1060,35 @@
         "type": "github"
       }
     },
+    "raspberry-pi-nix": {
+      "inputs": {
+        "libcamera-src": "libcamera-src",
+        "libpisp-src": "libpisp-src",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "rpi-bluez-firmware-src": "rpi-bluez-firmware-src",
+        "rpi-firmware-nonfree-src": "rpi-firmware-nonfree-src",
+        "rpi-firmware-src": "rpi-firmware-src",
+        "rpi-linux-6_10_12-src": "rpi-linux-6_10_12-src",
+        "rpi-linux-6_6_54-src": "rpi-linux-6_6_54-src",
+        "rpicam-apps-src": "rpicam-apps-src",
+        "u-boot-src": "u-boot-src"
+      },
+      "locked": {
+        "lastModified": 1731941843,
+        "narHash": "sha256-/QG4C9WVP79A7jRFC3Ci1q1l6ah7gr3/SF/MWUk/hhM=",
+        "owner": "nix-community",
+        "repo": "raspberry-pi-nix",
+        "rev": "aaec735faf81ff05356d65c7408136d2c1522d34",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "raspberry-pi-nix",
+        "type": "github"
+      }
+    },
     "root": {
       "inputs": {
         "fenix": "fenix",
@@ -1045,12 +1108,115 @@
         "nixpkgs-latest-factorio": "nixpkgs-latest-factorio",
         "nixpkgs-master": "nixpkgs-master",
         "nixpkgs-unstable": "nixpkgs-unstable",
+        "raspberry-pi-nix": "raspberry-pi-nix",
         "snowfall-flake": "snowfall-flake",
         "snowfall-lib": "snowfall-lib_2",
         "sops-nix": "sops-nix",
         "zen-browser": "zen-browser"
       }
     },
+    "rpi-bluez-firmware-src": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1708969706,
+        "narHash": "sha256-KakKnOBeWxh0exu44beZ7cbr5ni4RA9vkWYb9sGMb8Q=",
+        "owner": "RPi-Distro",
+        "repo": "bluez-firmware",
+        "rev": "78d6a07730e2d20c035899521ab67726dc028e1c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "RPi-Distro",
+        "ref": "bookworm",
+        "repo": "bluez-firmware",
+        "type": "github"
+      }
+    },
+    "rpi-firmware-nonfree-src": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1723266537,
+        "narHash": "sha256-T7eTKXqY9cxEMdab8Snda4CEOrEihy5uOhA6Fy+Mhnw=",
+        "owner": "RPi-Distro",
+        "repo": "firmware-nonfree",
+        "rev": "4b356e134e8333d073bd3802d767a825adec3807",
+        "type": "github"
+      },
+      "original": {
+        "owner": "RPi-Distro",
+        "ref": "bookworm",
+        "repo": "firmware-nonfree",
+        "type": "github"
+      }
+    },
+    "rpi-firmware-src": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1727798811,
+        "narHash": "sha256-eavbshXGYmkYR33y9FLcQMJoAYdYTESVEy0g/RRXnb0=",
+        "owner": "raspberrypi",
+        "repo": "firmware",
+        "rev": "287e6a6c2d3b50eee3e2c5b2eacdd907e5cbe09a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "raspberrypi",
+        "ref": "1.20241001",
+        "repo": "firmware",
+        "type": "github"
+      }
+    },
+    "rpi-linux-6_10_12-src": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1728305462,
+        "narHash": "sha256-LtvNmGD1D5YYv+C9xxxddAeHw69o3OX/H9M7F663L74=",
+        "owner": "raspberrypi",
+        "repo": "linux",
+        "rev": "26ee50d56618c2d98100b1bc672fd201aed4d00f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "raspberrypi",
+        "ref": "rpi-6.10.y",
+        "repo": "linux",
+        "type": "github"
+      }
+    },
+    "rpi-linux-6_6_54-src": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1728155174,
+        "narHash": "sha256-/8RjW35XQMnshjAE4Ey8j3oWzE2GOntnBYY6PlvZGhs=",
+        "owner": "raspberrypi",
+        "repo": "linux",
+        "rev": "12f0f28db3afe451a81a34c5a444f6841c10067c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "raspberrypi",
+        "ref": "rpi-6.6.y",
+        "repo": "linux",
+        "type": "github"
+      }
+    },
+    "rpicam-apps-src": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1727515047,
+        "narHash": "sha256-qCYGrcibOeGztxf+sd44lD6VAOGoUNwRqZDdAmcTa/U=",
+        "owner": "raspberrypi",
+        "repo": "rpicam-apps",
+        "rev": "a8ccf9f3cd9df49875dfb834a2b490d41d226031",
+        "type": "github"
+      },
+      "original": {
+        "owner": "raspberrypi",
+        "ref": "v1.5.2",
+        "repo": "rpicam-apps",
+        "type": "github"
+      }
+    },
     "rust-analyzer-src": {
       "flake": false,
       "locked": {
@@ -1280,6 +1446,19 @@
         "type": "github"
       }
     },
+    "u-boot-src": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1719857238,
+        "narHash": "sha256-mJ2TBy0Y5ZtcGFgtU5RKr0UDUp5FWzojbFb+o/ebRJU=",
+        "type": "tarball",
+        "url": "https://ftp.denx.de/pub/u-boot/u-boot-2024.07.tar.bz2"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://ftp.denx.de/pub/u-boot/u-boot-2024.07.tar.bz2"
+      }
+    },
     "xdph": {
       "inputs": {
         "hyprland-protocols": [

flake.nix

@@ -7,7 +7,7 @@
     nixpkgs-unstable.url = "github:nixos/nixpkgs/nixos-unstable";
 
     nixpkgs-master.url = "github:nixos/nixpkgs/master";
-    nixpkgs-latest-factorio.url = "github:Daholli/nixpkgs/d941e9aa2d89f377d45516c5edd765fef15ea90a";
+    nixpkgs-latest-factorio.url = "github:Daholli/nixpkgs/2adc4d1f11c5abcf654ed50c2cbce897c6e78ccc";
 
     home-manager = {
       url = "github:nix-community/home-manager/master";
@@ -78,6 +78,11 @@
     ## temporary
     zen-browser.url = "github:ch4og/zen-browser-flake";
 
+    raspberry-pi-nix = {
+      url = "github:nix-community/raspberry-pi-nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
     ################
     ## inputs for dev shells
 
@@ -124,6 +129,11 @@
         sops-nix.nixosModules.sops
       ];
 
+      systems.hosts.nixberry.modules = with inputs; [
+        raspberry-pi-nix.nixosModules.raspberry-pi
+        raspberry-pi-nix.nixosModules.sd-image
+      ];
+
       systems.hosts.wsl.modules = with inputs; [ nixos-wsl.nixosModules.default ];
     }
     // {

homes/aarch64-linux/cholli@nixberry/default.nix

@@ -0,0 +1,22 @@
+{
+  lib,
+  pkgs,
+  config,
+  osConfig ? { },
+  format ? "unknown",
+  ...
+}:
+with lib.wyrdgard;
+{
+  wyrdgard = {
+    apps = {
+      kitty = enabled;
+    };
+
+    tools = {
+      direnv = enabled;
+    };
+  };
+
+  home.stateVersion = "24.11";
+}

homes/x86_64-linux/cholli@loptland/default.nix

@@ -17,6 +17,4 @@ with lib.wyrdgard;
       direnv = enabled;
     };
   };
-
-  home.stateVersion = "24.11";
 }

homes/x86_64-linux/cholli@wsl/default.nix

@@ -17,4 +17,6 @@ with lib.wyrdgard;
       direnv = enabled;
     };
   };
+
+  home.stateVersion = "24.05";
 }

homes/x86_64-linux/cholli@yggdrasil/default.nix

@@ -2,11 +2,12 @@
   lib,
   pkgs,
   config,
+  namespace,
   osConfig ? { },
   format ? "unknown",
   ...
 }:
-with lib.wyrdgard;
+with lib.${namespace};
 {
   wyrdgard = {
     apps = {
@@ -17,6 +18,4 @@ with lib.wyrdgard;
       direnv = enabled;
     };
   };
-
-  home.stateVersion = "23.11";
 }

modules/nixos/apps/cli-apps/helix/default.nix

@@ -8,7 +8,7 @@
   ...
 }:
 let
-  inherit (lib) mkIf mkEnableOption;
+  inherit (lib) mkIf mkEnableOption mkOption;
   cfg = config.${namespace}.apps.cli-apps.helix;
 
   cachix-url = "https://helix.cachix.org";
@@ -19,13 +19,17 @@ in
 {
   options.${namespace}.apps.cli-apps.helix = {
     enable = mkEnableOption "Whether to enable helix or not";
+    pkg = mkOption {
+      type = lib.types.package;
+      default = helix-pkg;
+      description = "Which helix pacakge to use";
+    };
   };
 
   config = mkIf cfg.enable {
     environment = {
       systemPackages = [
-        helix-pkg
-        pkgs.wl-clipboard
+        cfg.pkg
       ];
     };
 

modules/nixos/desktop/addons/hypridle/default.nix

@@ -7,10 +7,7 @@
 }:
 let
   inherit (lib) mkIf mkEnableOption;
-
   cfg = config.${namespace}.desktop.addons.hypridle;
-
-  username = config.${namespace}.user.name;
 in
 {
   options.${namespace}.desktop.addons.hypridle = {
@@ -18,7 +15,7 @@ in
   };
 
   config = mkIf cfg.enable {
-    snowfallorg.users.${username}.home.config = {
+    ${namespace}.home.extraOptions = {
       services.hypridle = {
         enable = true;
         settings = {

modules/nixos/home/default.nix

@@ -20,15 +20,15 @@ in
   };
 
   config = {
-    ${namespace}.home.extraOptions = {
-      home.stateVersion = config.system.stateVersion;
-      home.file = mkAliasDefinitions options.${namespace}.home.file;
-      xdg.enable = true;
-      xdg.configFile = mkAliasDefinitions options.${namespace}.home.configFile;
-    };
-
-    snowfallorg.users.${config.${namespace}.user.name}.home.config =
-      config.${namespace}.home.extraOptions;
+    snowfallorg.users.${config.${namespace}.user.name}.home.config = mkMerge [
+      {
+        home.stateVersion = config.system.stateVersion;
+        home.file = mkAliasDefinitions options.${namespace}.home.file;
+        xdg.enable = true;
+        xdg.configFile = mkAliasDefinitions options.${namespace}.home.configFile;
+      }
+      config.${namespace}.home.extraOptions
+    ];
 
     home-manager = {
       useUserPackages = true;

modules/nixos/security/acme/default.nix

@@ -26,15 +26,15 @@ in
   config = mkIf cfg.enable {
     sops = {
       secrets = {
-        netcup_customer_number = {
+        "netcup/customer_number" = {
           inherit (cfg) sopsFile;
         };
 
-        netcup_api_key = {
+        "netcup/api/key" = {
           inherit (cfg) sopsFile;
         };
 
-        netcup_api_password = {
+        "netcup/api/password" = {
           inherit (cfg) sopsFile;
         };
       };
@@ -42,9 +42,9 @@ in
       templates = {
         "netcup.env" = {
           content = ''
-            NETCUP_CUSTOMER_NUMBER=${config.sops.placeholder.netcup_customer_number}
-            NETCUP_API_KEY=${config.sops.placeholder.netcup_api_key}
-            NETCUP_API_PASSWORD=${config.sops.placeholder.netcup_api_password}
+            NETCUP_CUSTOMER_NUMBER=${config.sops.placeholder."netcup/customer_number"}
+            NETCUP_API_KEY=${config.sops.placeholder."netcup/api/key"}
+            NETCUP_API_PASSWORD=${config.sops.placeholder."netcup/api/password"}
             NETCUP_PROPAGATION_TIMEOUT=1200
           '';
         };

modules/nixos/security/sops/default.nix

@@ -19,13 +19,15 @@ in
     environment.systemPackages = with pkgs; [
       sops
       age
+      ssh-to-age
     ];
 
     sops = {
       defaultSopsFile = lib.snowfall.fs.get-file "secrets/secrets.yaml";
       defaultSopsFormat = "yaml";
 
-      age.keyFile = "/home/cholli/.config/sops/age/keys.txt";
+      # age.keyFile = "/home/cholli/.config/sops/age/keys.txt";
+      age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
     };
   };
 }

modules/nixos/services/factorio-server/default.nix

@@ -24,15 +24,15 @@ in
     environment.systemPackages = [ pkgs.factorio-headless ];
     sops = {
       secrets = {
-        factorio_token = {
+        "factorio/token" = {
           restartUnits = [ "factorio.service" ];
           inherit (cfg) sopsFile;
         };
-        factorio_username = {
+        "factorio/username" = {
           restartUnits = [ "factorio.service" ];
           inherit (cfg) sopsFile;
         };
-        factorio_game_password = {
+        "factorio/game_password" = {
           restartUnits = [ "factorio.service" ];
           inherit (cfg) sopsFile;
         };
@@ -43,12 +43,12 @@ in
           "description": "Trying to run a factorio-headless-server on my nix system",
           "tags": ["vanilla"],
           "max_players": 10,
-          "game_password": "${config.sops.placeholder.factorio_game_password}",
+          "game_password": "${config.sops.placeholder."factorio/game_password"}",
           "allow_commands": "admins-only",
           "autosave_slots": 5,
           "ignore_player_limit_for_returning_players": true,
-          "username" : "${config.sops.placeholder.factorio_username}",
-          "token": "${config.sops.placeholder.factorio_token}"
+          "username" : "${config.sops.placeholder."factorio/username"}",
+          "token": "${config.sops.placeholder."factorio/token"}"
         }
       '';
       templates."extraSettingsFile.json".mode = "0444";

modules/nixos/tools/git/default.nix

@@ -34,7 +34,7 @@ in
         lfs.enable = true;
         signing = {
           key = cfg.signingKey;
-          signByDefault = mkIf gpg.enable true;
+          signByDefault = true;
         };
         extraConfig = {
           init = {

modules/nixos/user/default.nix

@@ -2,7 +2,6 @@
   config,
   lib,
   namespace,
-  options,
   pkgs,
   ...
 }:
@@ -11,33 +10,6 @@ with lib.${namespace};
 let
   cfg = config.${namespace}.user;
   defaultIconFileName = "profile.png";
-  defaultIcon = pkgs.stdenvNoCC.mkDerivation {
-    name = "default-icon";
-    src = ./. + "/${defaultIconFileName}";
-
-    dontUnpack = true;
-
-    installPhase = ''
-      cp $src $out
-    '';
-
-    passthru = {
-      fileName = defaultIconFileName;
-    };
-  };
-  propagatedIcon =
-    pkgs.runCommandNoCC "propagated-icon"
-      {
-        passthru = {
-          inherit (fileName) ;
-        };
-      }
-      ''
-        local target="$out/share/${namespace}-icons/user/${cfg.name}"
-        mkdir -p "$target"
-
-        cp ${cfg.icon} "$target/${cfg.icon.fileName}"
-      '';
 in
 {
   options.${namespace}.user = with types; {
@@ -45,7 +17,7 @@ in
     fullName = mkOpt str "Christoph Hollizeck" "The full name of the user.";
     email = mkOpt str "christoph.hollizeck@hey.com" "The email of the user.";
     initialPassword = mkOpt str "asdf" "The initial password to use when the user is first created.";
-    icon = mkOpt (nullOr package) defaultIcon "The profile picture to use for the user.";
+    icon = mkOpt (nullOr path) ./${defaultIconFileName} "The profile picture to use for the user.";
     extraGroups = mkOpt (listOf str) [ ] "Groups for the user to be assigned.";
     extraOptions = mkOpt attrs { } (mdDoc "Extra options passed to `users.users.<name>`.");
     trustedPublicKeys = mkOption {
@@ -78,7 +50,7 @@ in
         "Videos/.keep".text = "";
         "projects/.keep".text = "";
         ".face".source = cfg.icon;
-        "Pictures/${cfg.icon.fileName or (builtins.baseNameOf cfg.icon)}".source = cfg.icon;
+        "Pictures/${defaultIconFileName}".source = cfg.icon;
       };
     };
 

secrets/secrets-loptland.yaml

@@ -1,13 +1,15 @@
-#ENC[AES256_GCM,data:Cgp+gOU81+rvdlY=,iv:8DxJxnCslDoEu0bxtlTjmNiAUCdiAV/8VYKTb4yqQ50=,tag:ZTkK7WCOBh1It6GuKPUXdg==,type:comment]
-factorio_username: ENC[AES256_GCM,data:egV5kXtAiw==,iv:Hay0PC2yol5FAJGcWxLkxzNdwpD1V4UfDDnkhsjvjVQ=,tag:QBDS6eAeOswQoHBoi4Gj6A==,type:str]
-factorio_token: ENC[AES256_GCM,data:whruEJQCNIqqfMA0A3yQdwwrzpIJBt815Lvex4Au,iv:hh3zZt+UxV9ltSHIAjpTRwtDvPgPU5APrB/1bXtKUkE=,tag:AgUmBYWp+Oyxm8O7yD8vlA==,type:str]
-factorio_game_password: ENC[AES256_GCM,data:Gu/p0+Sbd6Y=,iv:6AB1T3JdleiUnusU7hw/0wOFNSBsAsBgP2yD9FB7zXk=,tag:DMgD4csthynuBon+KNZtOw==,type:str]
-#ENC[AES256_GCM,data:15i2BBxM4iM=,iv:JV6Lsk8jUZl/eIJWkH/w5I2NraB9J9+0ggsENBGgbdI=,tag:HDwGheUv7dFIztQoJBjGmQ==,type:comment]
-forgejo_db_password: ENC[AES256_GCM,data:CFsvko1AXRymDBC6WiOBs98rvFM=,iv:Wemhu8URxA6HsWQyYcPSwJzuMP4myrDC3rU3GEDVt7c=,tag:6wcNlDFVdnjez8hzi4E2cw==,type:str]
-#ENC[AES256_GCM,data:nQnLBl7v,iv:HORr/Uvw4eUXfW5uS6rWr+6FkFF9bTNpMYGaRpVITRY=,tag:/r4n/xpqp7EPecGxDj4N+w==,type:comment]
-netcup_customer_number: ENC[AES256_GCM,data:pRooJa3O,iv:0U/ONcWa2eqcsT1UpgXmLpAvJndaU8zln2g1HMbBQYE=,tag:+pu8EBl/dnm6DoLAtrjZBQ==,type:str]
-netcup_api_key: ENC[AES256_GCM,data:nlkDz1VV2NIXxv/tIROWDHN9DLI0lVq9n9l2FlDwt+3H4G4gg6yCeZjGtR+pTCNfwio=,iv:x8HLL10ww52UJDkz7Yi02KBg7jbuLFHAlG0iMYDd8hk=,tag:pcuka4/Hu/QFIwS0b8GlxQ==,type:str]
-netcup_api_password: ENC[AES256_GCM,data:k2mdQp57x5ZTypRCHbVlq1fembJ0uj5D0rb72K5rac43p888y3TFyiYVuDTosxR66mo=,iv:0OhtKWD/LWeV5ZWN9fbPozebSxvaFRdSn1AkX97ffAM=,tag:uY6A4jBL/9mtGy7++Yvn0A==,type:str]
+factorio:
+    username: ENC[AES256_GCM,data:aFRsUMsoaw==,iv:8EGn99WbgJxUyEKuOcwV6U8awOl7bDfmui+M3mDBoCg=,tag:BzMvGS3lfTsXToI/I5dguQ==,type:str]
+    token: ENC[AES256_GCM,data:WP6FTOBOBuNF6+pzi090wXsXpL2XsU34dQ2ZMzmw,iv:uKM4hLyx3vdyk9F0SyKu4x+2sl442GWXwEKbdgo/Dug=,tag:Xw3BJ7wxuft6hOG9cGtW0g==,type:str]
+    game_password: ENC[AES256_GCM,data:GtLNoCdQH1M=,iv:dxOMtXscLeMdsQxWjNgrIMb08vL2wAswvd1oM6pEWPA=,tag:a55ciDtw9mjLM9x5YQBTwQ==,type:str]
+forgejo:
+    db:
+        password: ENC[AES256_GCM,data:CicLsCG2WCtiKMcz3DF5eVVaT8A=,iv:SPO1H4AZwo5FjJWkf1OS7aPOrpTGxqsAj4q3cuuWAbA=,tag:0snK8RyAd8heNvui2sbSNw==,type:str]
+netcup:
+    customer_number: ENC[AES256_GCM,data:9+QboNg1,iv:Tg9ylJUM8L/kzqFmk2uIsD9noqnp5wIxr5GVXMsZwB8=,tag:2qRggSIkPHuCQYDWCfka5Q==,type:str]
+    api:
+        key: ENC[AES256_GCM,data:eYTKtJSSXmZfkRjlj65OHi99mpD3Iom8dPc8v34pwJIQSBbxVaqdgb7Gqzhse1c9L+U=,iv:9gmsBwlJ+NQIGY5NBA6Fi/1EQium2pcfQkF7x/fHyFU=,tag:v25eeqT6/WEMG9za7LVWAg==,type:str]
+        password: ENC[AES256_GCM,data:VTW4XGDg19AbE4EM6kS0u89Sz6718vHXvZZmQlkhGJe/4/LQJHmF1FetAClxkLZ9Za0=,iv:sWHvjHEsMXBbtFmkEdAOeSlQ6VTabRJ28kH3iP3GDaY=,tag:5k6NXFXwXHorUGKe+sAbbg==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -17,14 +19,23 @@ sops:
         - recipient: age1amdd4hu6k0czf3mtlhd03yj3yzkdaynl7q5fdlqmjzpe9pwgxfjs3j0c85
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3NFlTd2hOTHBtUDhuT0lF
-            amtLclY2ZTN0SStZQjFSNkZUd1RmMkdJZ0dJCnB2WU04dk41Qk45aGphMW9GQVJ4
-            b2VWQVlOVFFLaGJWaU9FVU5ZUWtlRncKLS0tIGVPYW5DQnJMeW1qdWtINDNlQWFo
-            NmhrdXhpbVlmUFNsT1VaQjZyYkZkdzgKhL2BKXfPWNWUbFavpmtBQpnNEm/x0xH6
-            NsjiV05AcrqPmGjj2kjvTv4ULPSoHiHiC5McUMfFTYIrCJgNvUbmMg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBleDhiRlplSndCcUhaMXV3
+            ZUR5QXVyemQ2VlhaQ1JjampwaWV5emhnVGt3ClBWRlJJbmx4cldDWmI3cUd2M0Z5
+            YTl5ODVTbmZjM2UxQkhGZ3hvRWVqWmMKLS0tIFlDZXJTQi9wTGxRWElvcDRPVStj
+            MGV3VDBEMWkxNkV4TGV6dTFWaDhLWXMKg2Xt5PJe7etU1yp+IgnwTnLl7AXaN1MA
+            5RymeKYjdNipJtxSNxzTjkNpENtHyXLcjVEBTH3IjGujtyGPMpk3eg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-11-07T14:40:34Z"
-    mac: ENC[AES256_GCM,data:uk2AeOA9pnhekuofIjXavCGy9ZaO0ObprkvnGhJg5lPr/hyT9l7YcZtMQ7wckKDLS03I1hCAcNg0w/EmSUeU2+EHLb6Z1IUj3l0HBUPtPIJwJZifkrzp9iQwGwlK+i6nfREEgPGeuNMj/rnD67MECO4NRHTzGBzH7ZImoDpu0Us=,iv:ss8Q7i75UOQDMJfw4dQCT0qxPUGwfHizX0c/TUej+vc=,tag:iufeO6sfaToNcJg6E8tuxA==,type:str]
+        - recipient: age13xshg5e6ucvnu3vqgn344mxpk5kcqutv2lf4gdffvwadq0ku5ewqy4cck6
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArRTBLR09YS0tuM212a25G
+            cWV5bnR5ZytjQWIvd2txSmdEWjExeWRSbTNvClQwMjc4VnhtdnpKQmQ3Z0JOTEFW
+            OEtEZ0h2bDlPb3UrNTZFVFdCajdzSGcKLS0tIG16UFNqRVpWOHJNTE03TkFTUDF1
+            UllqSDR1YWl6aU1jSnY2WE9oczg5Q28KfN15tFxXHrJmOHySK+cyLi2bFqArg244
+            bNTYyuBUtBW1Y/EuNpbyLjSNQpKZWFz7grE64uxrNQHP865N3wv0gg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-11-12T14:29:12Z"
+    mac: ENC[AES256_GCM,data:lKx1qAe689wkWkrMRvqHpE0zmv+ShLwpApBw2C4+JEuuHnoN1W7aoB/GQRkWzmImCCy9odzM2yoUa0mJogl0i+bddblrl+ZS0uPmPQrm3pM0sl876pelogxKuNpQWS8PRNDe24z3m06f0TozhfPF9D2ywH30tFH8naZONfWTTUU=,iv:tDhJVlWnTHnjZak32pgnUZ8XtM6TK9o2gZ0X3tcQD4Q=,tag:PcMS/5DpEkDkk+U0GG918w==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
     version: 3.9.1

systems/aarch64-linux/nixberry/default.nix

@@ -1,8 +1,9 @@
 {
+  inputs,
   lib,
   modulesPath,
-  inputs,
   namespace,
+  pkgs,
   ...
 }:
 
@@ -13,22 +14,63 @@ in
 {
   imports = with inputs.nixos-hardware.nixosModules; [
     (modulesPath + "/installer/scan/not-detected.nix")
-    (modulesPath + "/installer/sd-card/sd-image-aarch64.nix")
     raspberry-pi-5
   ];
 
-  ${namespace} = {
+  raspberry-pi-nix.board = "bcm2711";
 
+  hardware = {
+    raspberry-pi = {
+      config = {
+        all = {
+          base-dt-params = {
+            BOOT_UART = {
+              value = 1;
+              enable = true;
+            };
+            uart_2ndstage = {
+              value = 1;
+              enable = true;
+            };
+          };
+          dt-overlays = {
+            disable-bt = {
+              enable = true;
+              params = { };
+            };
+          };
+        };
+      };
+    };
+  };
+
+  services.openssh = {
+    enable = true;
+    settings = {
+      PasswordAuthentication = false;
+      KbdInteractiveAuthentication = false;
+    };
+  };
+
+  ${namespace} = {
     submodules = {
       basics = enabled;
     };
 
+    apps.cli-apps.helix = {
+      pkg = pkgs.helix;
+    };
+
     system = {
       boot = {
         # Raspberry Pi requires a specific bootloader.
         enable = mkForce false;
       };
     };
+
+    user.trustedPublicKeys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHFrDiO5+vMfD5MimkzN32iw3MnSMLZ0mHvOrHVVmLD0"
+    ];
   };
 
   # This value determines the NixOS release from which the default
@@ -37,5 +79,5 @@ in
   # this value at the release version of the first install of this system.
   # Before changing this value read the documentation for this option
   # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
-  system.stateVersion = "24.05"; # Did you read the comment?
+  system.stateVersion = "24.11"; # Did you read the comment?
 }

systems/x86_64-linux/loptland/default.nix

@@ -23,7 +23,7 @@ in
 
   sops = {
     secrets = {
-      forgejo_db_password = {
+      "forgejo/db/password" = {
         inherit sopsFile;
       };
     };
@@ -71,7 +71,7 @@ in
     database.type = "postgres";
     lfs.enable = true;
     database = {
-      passwordFile = config.sops.secrets.forgejo_db_password.path;
+      passwordFile = config.sops.secrets."forgejo/db/password".path;
     };
 
     settings = {
@@ -111,8 +111,8 @@ in
     };
 
     user.trustedPublicKeys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHFrDiO5+vMfD5MimkzN32iw3MnSMLZ0mHvOrHVVmLD0"
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII4Pr7p0jizrvIl0UhcvrmL5SHRQQQWIcHLAnRFyUZS6"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHFrDiO5+vMfD5MimkzN32iw3MnSMLZ0mHvOrHVVmLD0" # yggdrasil
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII4Pr7p0jizrvIl0UhcvrmL5SHRQQQWIcHLAnRFyUZS6" # Phone
     ];
   };
 

systems/x86_64-linux/yggdrasil/default.nix

@@ -28,6 +28,9 @@ in
   programs.ssh.extraConfig = ''
     AddressFamily inet
   '';
+  home-manager = {
+    backupFileExtension = ".bak";
+  };
 
   nix = {
     buildMachines = [
@@ -46,8 +49,15 @@ in
     ];
 
     distributedBuilds = true;
-
+    settings = {
+      trusted-users = [
+        "@wheel"
+        "remotebuild"
+      ];
+      trusted-public-keys = [ "nixberry:25s8/rxsolAXg4skjnecCeqcfkxYE9FGCPG5UcXsFlw=" ];
+    };
   };
+
   ${namespace} = {
     archetypes = {
       gaming.enable = true;