.sops.yaml

@@ -31,15 +31,6 @@ creation_rules:
           - *mail-01
         pgp:
           - *lander
-  - path_regex: hosts/servers/common.yaml$
-    key_groups:
-      - age:
-          - *db-01
-          - *hosting-01
-          - *hosting-02
-          - *mail-01
-        pgp:
-          - *lander
   - path_regex: hosts/db-01/secrets.yam?l$
     key_groups:
       - age:

flake.lock

@@ -35,25 +35,23 @@
         "type": "github"
       }
     },
-    "colmena": {
+    "deploy-rs": {
       "inputs": {
         "flake-compat": "flake-compat",
-        "flake-utils": "flake-utils",
-        "nix-github-actions": "nix-github-actions",
         "nixpkgs": "nixpkgs_2",
-        "stable": "stable"
+        "utils": "utils"
       },
       "locked": {
-        "lastModified": 1755272288,
+        "lastModified": 1756719547,
-        "narHash": "sha256-ypTPb2eKcOBbOoyvPV0j4ZOXs4kayo73/2KI456QnE0=",
+        "narHash": "sha256-N9gBKUmjwRKPxAafXEk1EGadfk2qDZPBQp4vXWPHINQ=",
-        "owner": "zhaofengli",
+        "owner": "serokell",
-        "repo": "colmena",
+        "repo": "deploy-rs",
-        "rev": "5bf4ce6a24adba74a5184f4a9bef01d545a09473",
+        "rev": "125ae9e3ecf62fb2c0fd4f2d894eb971f1ecaed2",
         "type": "github"
       },
       "original": {
-        "owner": "zhaofengli",
+        "owner": "serokell",
-        "repo": "colmena",
+        "repo": "deploy-rs",
         "type": "github"
       }
     },
@@ -117,11 +115,11 @@
     "flake-compat": {
       "flake": false,
       "locked": {
-        "lastModified": 1650374568,
+        "lastModified": 1733328505,
-        "narHash": "sha256-Z+s0J8/r907g149rllvwhb4pKi8Wam5ij0st8PwAh+E=",
+        "narHash": "sha256-NeCCThCEP3eCl2l/+27kNNK7QrwZB1IJCrXfrbv5oqU=",
         "owner": "edolstra",
         "repo": "flake-compat",
-        "rev": "b4a34015c698c7793d592d66adbab377907a2be8",
+        "rev": "ff81ac966bb2cae68946d5ed5fc4994f96d0ffec",
         "type": "github"
       },
       "original": {
@@ -219,23 +217,8 @@
       }
     },
     "flake-utils": {
-      "locked": {
-        "lastModified": 1659877975,
-        "narHash": "sha256-zllb8aq3YO3h8B/U0/J1WBgAL8EX5yWf5pMj3G0NAmc=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "c0e246b9b83f637f4681389ecabcb2681b4f3af0",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "flake-utils_2": {
       "inputs": {
-        "systems": "systems"
+        "systems": "systems_2"
       },
       "locked": {
         "lastModified": 1731533236,
@@ -251,9 +234,9 @@
         "type": "github"
       }
     },
-    "flake-utils_3": {
+    "flake-utils_2": {
       "inputs": {
-        "systems": "systems_2"
+        "systems": "systems_3"
       },
       "locked": {
         "lastModified": 1731533236,
@@ -342,7 +325,7 @@
     "headplane": {
       "inputs": {
         "devshell": "devshell",
-        "flake-utils": "flake-utils_2",
+        "flake-utils": "flake-utils",
         "nixpkgs": [
           "nixpkgs"
         ]
@@ -412,27 +395,6 @@
         "type": "github"
       }
     },
-    "nix-github-actions": {
-      "inputs": {
-        "nixpkgs": [
-          "colmena",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1729742964,
-        "narHash": "sha256-B4mzTcQ0FZHdpeWcpDYPERtyjJd/NIuaQ9+BV1h+MpA=",
-        "owner": "nix-community",
-        "repo": "nix-github-actions",
-        "rev": "e04df33f62cdcf93d73e9a04142464753a16db67",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "nix-github-actions",
-        "type": "github"
-      }
-    },
     "nixos-mailserver": {
       "inputs": {
         "blobs": "blobs",
@@ -543,16 +505,16 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1750134718,
+        "lastModified": 1743014863,
-        "narHash": "sha256-v263g4GbxXv87hMXMCpjkIxd/viIF7p3JpJrwgKdNiI=",
+        "narHash": "sha256-jAIUqsiN2r3hCuHji80U7NNEafpIMBXiwKlSrjWMlpg=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "9e83b64f727c88a7711a2c463a7b16eedb69a84c",
+        "rev": "bd3bac8bfb542dbde7ffffb6987a1a1f9d41699f",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-unstable",
+        "ref": "nixpkgs-unstable",
         "repo": "nixpkgs",
         "type": "github"
       }
@@ -679,7 +641,7 @@
         "flake-parts": "flake-parts_2",
         "nixpkgs": "nixpkgs_6",
         "nuschtosSearch": "nuschtosSearch",
-        "systems": "systems_3"
+        "systems": "systems_4"
       },
       "locked": {
         "lastModified": 1751144320,
@@ -697,7 +659,7 @@
     },
     "nuschtosSearch": {
       "inputs": {
-        "flake-utils": "flake-utils_3",
+        "flake-utils": "flake-utils_2",
         "ixx": "ixx",
         "nixpkgs": [
           "nixvim",
@@ -742,7 +704,7 @@
     "root": {
       "inputs": {
         "catppuccin": "catppuccin",
-        "colmena": "colmena",
+        "deploy-rs": "deploy-rs",
         "disko": "disko",
         "headplane": "headplane",
         "home-manager": "home-manager",
@@ -775,22 +737,6 @@
         "type": "github"
       }
     },
-    "stable": {
-      "locked": {
-        "lastModified": 1750133334,
-        "narHash": "sha256-urV51uWH7fVnhIvsZIELIYalMYsyr2FCalvlRTzqWRw=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "36ab78dab7da2e4e27911007033713bab534187b",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-25.05",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
     "superdirt-src": {
       "flake": false,
       "locked": {
@@ -852,6 +798,21 @@
         "type": "github"
       }
     },
+    "systems_4": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
     "tidal-src": {
       "flake": false,
       "locked": {
@@ -892,6 +853,24 @@
         "type": "github"
       }
     },
+    "utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
     "vim-tidal-src": {
       "flake": false,
       "locked": {

flake.nix

@@ -23,8 +23,8 @@
     home-manager.url = "github:nix-community/home-manager/release-25.05";
     home-manager.inputs.nixpkgs.follows = "nixpkgs";
 
-    # colmena
+    # deploy-rs
-    colmena.url = "github:zhaofengli/colmena";
+    deploy-rs.url = "github:serokell/deploy-rs";
 
     # nixos-wsl
     nixos-wsl.url = "github:nix-community/NixOS-WSL/main";
@@ -57,7 +57,7 @@
       self,
       nixpkgs,
       tidalcycles,
-      colmena,
+      deploy-rs,
       ...
     }@inputs:
     let
@@ -92,20 +92,6 @@
       nixosModules = import ./modules/nixos;
       homeManagerModules = import ./modules/home-manager;
 
-      devShells = forAllSystems (
-        system:
-        let
-          pkgs = nixpkgs.legacyPackages.${system};
-        in
-        {
-          default = pkgs.mkShell {
-            buildInputs = [
-              colmena.packages.${system}.colmena
-            ];
-          };
-        }
-      );
-
       nixosConfigurations =
         let
           hetzner = import ./lib/hetzner.nix { inherit inputs nixpkgs; };
@@ -150,7 +136,7 @@
           };
 
           # servers
-          db-01 = hetzner.mkMachine "db-01" {
+          db-01 = hetzner.mkHetznerMachine "db-01" {
             ipv6Address = "2a01:4f8:c012:15d4::/64";
           };
           hosting-01 = nixpkgs.lib.nixosSystem {
@@ -160,7 +146,7 @@
               ./hosts/hosting-01
             ];
           };
-          hosting-02 = hetzner.mkMachine "hosting-02" {
+          hosting-02 = hetzner.mkHetznerMachine "hosting-02" {
             ipv6Address = "2a01:4f8:c013:7fc0::/64";
           };
           mail-01 = nixpkgs.lib.nixosSystem {
@@ -172,53 +158,14 @@
           };
         };
 
-      colmenaHive =
+      deploy.nodes = nixpkgs.lib.mapAttrs (name: config: {
-        let
+        hostname = "${name}.escapeangle.com";
-          servers = builtins.map (file: nixpkgs.lib.removeSuffix ".nix" file) (
+        profiles.system = {
-            builtins.filter (file: file != "common.nix" && nixpkgs.lib.hasSuffix ".nix" file) (
+          user = "root";
-              builtins.attrNames (builtins.readDir ./hosts/servers)
+          path = deploy-rs.lib.aarch64-linux.activate.nixos config;
-            )
-          );
-
-          colmenaConfig = nixpkgs.lib.genAttrs servers (
-            name:
-            { ... }:
-            let
-              diskConfig = import ./lib/disk-config.nix { inherit nixpkgs; };
-              machineConfig = import ./hosts/servers/${name}.nix;
-            in
-            {
-              imports = [
-                inputs.disko.nixosModules.disko
-                inputs.sops-nix.nixosModules.sops
-                inputs.self.nixosModules.namespaced-vpn
-                inputs.self.nixosModules.storagebox
-
-                ./hosts/servers/common.nix
-
-                diskConfig
-                machineConfig
-              ];
-
-              deployment = {
-                targetHost = "${name}.escapeangle.com";
-                targetPort = 22;
-                targetUser = "root";
-                buildOnTarget = true;
         };
-            }
+      }) { inherit (self.nixosConfigurations) db-01 hosting-02; };
-          );
+
-        in
+      checks = builtins.mapAttrs (system: deployLib: deployLib.deployChecks self.deploy) deploy-rs.lib;
-        colmena.lib.makeHive (
-          {
-            meta = {
-              nixpkgs = import nixpkgs {
-                system = "aarch64-linux";
-                overlays = [ ];
-              };
-            };
-          }
-          // colmenaConfig
-        );
     };
 }

hosts/servers/common.nix

@@ -1,104 +0,0 @@
-{
-  config,
-  lib,
-  modulesPath,
-  pkgs,
-  ...
-}:
-{
-  imports = [
-    (modulesPath + "/installer/scan/not-detected.nix")
-    (modulesPath + "/profiles/qemu-guest.nix")
-  ];
-
-  boot = {
-    loader.grub = {
-      devices = [ "/dev/sda" ];
-      efiSupport = true;
-      efiInstallAsRemovable = true;
-    };
-
-    initrd.kernelModules = [ "virtio_gpu" ];
-
-    kernelParams = [ "console=tty" ];
-  };
-
-  time.timeZone = lib.mkDefault "Europe/Berlin";
-
-  networking = {
-    useNetworkd = true;
-  };
-
-  systemd.network = {
-    enable = true;
-
-    networks = {
-      "30-wan" = {
-        matchConfig.Name = "enp1s0";
-        networkConfig.DHCP = "ipv4";
-        routes = [
-          { Gateway = "fe80::1"; }
-        ];
-      };
-    };
-  };
-
-  services.openssh = {
-    enable = true;
-    settings.PasswordAuthentication = false;
-    extraConfig = ''
-      PrintLastLog no
-    '';
-  };
-
-  sops.secrets.tailscale-authkey = {
-    owner = "root";
-    group = "root";
-    sopsFile = ./common.yaml;
-  };
-
-  services.tailscale = {
-    enable = true;
-    openFirewall = false;
-    extraUpFlags = [
-      "--login-server=https://headscale.escapeangle.com"
-    ];
-    authKeyFile = config.sops.secrets.tailscale-authkey.path;
-  };
-
-  programs.zsh.enable = true;
-  environment.pathsToLink = [ "/share/zsh" ];
-  environment.shells = [ pkgs.zsh ];
-  environment.enableAllTerminfo = true;
-
-  users.users.lander = {
-    isNormalUser = true;
-    shell = pkgs.zsh;
-    extraGroups = [
-      "wheel"
-    ];
-    openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPnthKtz0fE4yQ/X10cJgKVCjYCNkRNoqV28xAhD7h2M cardno:22_498_026"
-    ];
-  };
-
-  users.users.root.openssh.authorizedKeys.keys = [
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPnthKtz0fE4yQ/X10cJgKVCjYCNkRNoqV28xAhD7h2M cardno:22_498_026"
-  ];
-
-  nix = {
-    settings = {
-      trusted-users = [ "lander" ];
-      accept-flake-config = true;
-      auto-optimise-store = true;
-    };
-
-    package = pkgs.nixVersions.stable;
-    extraOptions = ''experimental-features = nix-command flakes'';
-
-    gc = {
-      automatic = true;
-      options = "--delete-older-than 7d";
-    };
-  };
-}

hosts/servers/common.yaml

@@ -1,55 +0,0 @@
-tailscale-authkey: ENC[AES256_GCM,data:5gGzPfdHWB8dYJ0/pyy1ZLXgpTy0Vb3J+RDcRnSPBp9aS11iZJHBp+drNmrKGIzM,iv:bvKua+uX8jbfPAD5LwcEX+lDmCQpKImK7bfw9kKeDt4=,tag:XSTe6iLDWwPQG7ohCTjHIQ==,type:str]
-sops:
-    age:
-        - recipient: age1a5zz4cyda0aqh0hgf8svpyh9ktwy6z5x3gnnu5ysvpvek9rn03csx7dyqn
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0TUNKT0JtZEs3M0hEUjVt
-            WWJRUkFNSm9pVjRlVkk3RzVPeVZkNytUYVJRCnhzd0syd25HLzBTTFRBN3pXQUVW
-            VXJxakRZdzdGL3U0aFNrVEdTRVNBZUkKLS0tIDFrOC8ySVVYV3pLbDlDakpRZHhh
-            SzlLWGwrYjVNcGFLVGNTTmhleXNZMEEKabv69KbHpVEGpknnuEO+1OgdWCtvdkP6
-            fP55S4jIHjkONG1upwIxHj3YJO55nI5kA4XAx+5AOSntwN1iAXRciA==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age18g4z53ykxzq35dsjq3a2np4f88xwat0kwtax229l3zn0ykhlpvqqy8fgtv
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOTGFJTE5oU2tUcU1XcTVy
-            ZDBiSTQ5bGppOGRjUEV4WG9lc2xFN1RIQTNzCmZuelNkUjhyZWtqSTNZWHhIRjhT
-            UEpyeE9wdC9wSVZLckVzMVdQSXlhOTAKLS0tIGRBeXlWNHRyQkFpS2l2WlJHTnBI
-            WVRHWmE0QU1qK0NpT1QyL1ZZWXpmc3cK4UKRpOatiXqt2DvJmMlB2D+En4ufBXhe
-            vdxhnMZgMlMhN0F+KkOEt8JD1jrbOQ0fn1KdDcsjqO4MBJJK1smB9Q==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1hvrssz7k9akz66evj4kja53zvdtrss8k2ljxsh5myh2mru62sggqznlzrt
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDZGNYQW9pbEVQdTl3WEo2
-            ZWtHOHZzRmRMNkZHS1FjN1UrN0VGc0swc0JZClN3ckNrcXZoWTBpRGpGa0NSMkVY
-            K2ZVSmhuaHlQWUtqakRNTGVacDhScUkKLS0tIDl3czNRYUpra3Y2enlkMkRxUzlN
-            cDdhVlUyZGhsdHMzZ0E5andLVHVoNkkKocZp5EicX0pu1xaX+wYFfLqMoXxn5KiL
-            DsNPjAG//EslXpYq2UxXnWYaUKBq8fUr4moMG8omaoZ6KWgG8u1PeQ==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1u2a7wakgsyct6ed7ah2pksymh7jjl08ankedeyl5pa5jcs8r0uks02jpza
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIdkpsYUlwVlFJVjBRQjJn
-            TWhpZlluTEYwV0I2cDVUYytUZisrL0lWWTBnCnc3THNqT1BzeGkraDUyV0dMWGFr
-            NEo0aEtkUGVxVmttc09RMXJjblRNQUUKLS0tIENIN0hFbVFsbnIwRnYxdmVqVHlN
-            ZWFpdkxVVFpOUzRnUUFYYkIvcG0xa00Ktrrn8R69OF8wwsz9RuvKAiVtS+thbbNp
-            5DnmezbVOr6g3bNLnRQ/GDfesHqvCWTQ+Lv2t8tnXXbjXrNWcxOTgw==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-09-09T21:18:09Z"
-    mac: ENC[AES256_GCM,data:+GzVY/9R89YOL1dm0q1q3VSdsBa8krphFk8vOup+0XRn2BaLjwCIvOXQMBycVuRgMUHf77p1ETgpoj9quTDwJK8JDcP8pT6gfa/1mLuFz1I34cVk5f7Vx2BnX2Oh0LN+PXiMggbuySiNk3huOhgnrVCwwukT6PfvOXlYY5DVPPg=,iv:mp07YVgO0Xpp/XtOvD70hF+4ZGQJbn5EXxwPh2fXPMQ=,tag:dVwF6Y73DFeaNlYWLrqJWw==,type:str]
-    pgp:
-        - created_at: "2025-09-09T21:20:01Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hF4DARdpY4woM6wSAQdAqzNqNtPjbYWAx9XIB+bdZjhIIfCTOm1hUrpCu7emwgMw
-            WKfVFLeKJg+d/3PrR5hBoEfsj/IFUXiXDNrlpfr+VQCwd0XLMAM0WvFeod2gPe+1
-            0l4BXxWsyWzDdukiLzqtHelEvaJk8UU3LfhqsmdmQoApbx0AkLGUAQLgiHWtDkj6
-            w+QeYq0CJbO5kCLO+kNCVSNoWDyGOokKqcMxglyaIjlkjodf/Xw56HAeF1BuxPmV
-            =BwAM
-            -----END PGP MESSAGE-----
-          fp: 4BE1257015580BAB9F4B9D5FCA5B1C34E649BF92
-    unencrypted_suffix: _unencrypted
-    version: 3.10.2

hosts/servers/hosting-02.nix

@@ -34,39 +34,6 @@
     passFile = config.sops.secrets.storageboxCryptKey.path;
   };
 
-  services.slskd = {
-    enable = true;
-    domain = "slsk.escapeangle.com";
-    environmentFile = config.sops.secrets.slskdEnvFile.path;
-    settings = {
-      shares.directories = [ "/data/slsk/share" ];
-      directories = {
-        downloads = "/data/slsk/downloads";
-        incomplete = "/data/slsk/incomplete";
-      };
-    };
-  };
-
-  systemd.services.slskd.serviceConfig = {
-    UMask = "0002";
-    NetworkNamespacePath = "/run/netns/vpn";
-  };
-
-  users.groups.storage = {
-    name = "storage";
-    gid = 491729;
-    members = [ "slskd" ];
-  };
-
-  services.nginx.virtualHosts."sls.escapeangle.com" = {
-    forceSSL = true;
-    enableACME = true;
-    locations."/" = {
-      proxyPass = "http://10.10.10.2:${toString config.services.slskd.settings.web.port}";
-      proxyWebsockets = true;
-    };
-  };
-
   sops = {
     defaultSopsFile = ./hosting-02.yaml;
     secrets = {
@@ -79,9 +46,6 @@
       storageboxCryptKey = {
         owner = "root";
       };
-      slskdEnvFile = {
-        owner = config.services.slskd.user;
-      };
     };
   };
 

hosts/servers/hosting-02.yaml

@@ -1,7 +1,6 @@
 wireguardKey: ENC[AES256_GCM,data:Z239oQMzOp4C33pBePuANX3aPkmjTcrT+Z/UY0dnUCmMOs2Oy3iktS6Fgsw=,iv:21XLXpgsoYpvz887ZlLJW/A6IOJwEX5YwJrnO725M5U=,tag:VDGjOiYqFN8tMhf8s2YV6g==,type:str]
 storageboxKey: ENC[AES256_GCM,data:uWDkiWIk3OePRfoaqjllVlRVzW5+ryE4sIOs8qm6cS8JN/+YFbnkCsT5sdFeXSpJyQ7ymgD6uJJ75RWH6Y/iIARbmZN/x/9hnB3LORHSl/C0F3xMHUf6prXtYyPNLWe+ghCMygaLyvBuCBiEhleevRQANXLUJCysiODepSkXwyasAHKTKuKQUPU/T+1R7eXaQPDMehzD4/0o8SdLkqcZXBQzs3VRp+CbQyl7dx6znwoPWckmFH2W+9fZCE+AxFxBP3jPVjBPuOC3BviTYFSvZPEkmtH+lxYv+PXFAPpgYwmAEjCwWyDMDRy6bNVQIG6TKHn60TJv+GCfRwPJ46mVtbruyil23d7g/V7dhu8btPbgtvcBx/8EexJ0PHAVWcIZ1FJwr7inMCAghbSDD3CkGpOV8btaYgUZtosqfg9r5cd75jB+7RZPwyb8/1mrLWE3eL9Za2lZ6bC7a9AeIn1q3Cn6+aoMKqXp8q/sVwozNpUJj73yhjR146MGjCGpqoKJqK453qc3VCC50OZTOULV,iv:sEwA6zrK6FFqTmVJOMD77g0OuDjCHDLRBlirjhZBx/0=,tag:z1fX+7goXk4U6Di+4EK6Fw==,type:str]
 storageboxCryptKey: ENC[AES256_GCM,data:ryYOzFvdPaVkOHmypYbqw+KU6aB2OQutLw==,iv:FL4c7P36qxYR1KJlg7t0dvFHlKGMIrTlQG+CDkeJu9U=,tag:Ia4mhV9Ed/m1rRMCNnHqXw==,type:str]
-slskdEnvFile: ENC[AES256_GCM,data:K1S1PXQMiBoEdbuM/NTBUYRrUSnAC/KBhm/PFzoCJATiLLPsstzgqzbe9vG8tnULb2driAH4Ytd03cmROp30V+9vW6J9eyCofWySWZNEYriRfY1y7y5AR8W13zQL0FGZOewUy/1T7YRvN8FjZFh4n7S3c0GREX3FSSNrmaHwOqgueDs=,iv:VziNMRpC2clhFyOMG8LRReMGUxhYqjUaZeA8gh599aM=,tag:H1tQBZ8nSgATSJB6nFSdlA==,type:str]
 sops:
     age:
         - recipient: age1hvrssz7k9akz66evj4kja53zvdtrss8k2ljxsh5myh2mru62sggqznlzrt
@@ -13,8 +12,8 @@ sops:
             b1ZqUzZLUkFwNHJyVlhmK0FOZ1JFYUEKDU4NmBCHRY+ZK+RFK/LioGzjJTaOE1ky
             MC6jxt7Y5RkCk0BBqeoEVLaNXNViPjwakbvyfH0w0P6l0KDJ4mNlYQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-09-20T23:35:47Z"
+    lastmodified: "2025-09-18T21:32:51Z"
-    mac: ENC[AES256_GCM,data:idOk0S4lGYWOPHayOgqX0oKk8cWmm9YUXbAIDlojOmroE8qL45nBMNpb6npuA7wGoHWsg8kYCidi8v8Gz+dGnEMURdcT7NoqcgtDWisYxyw5sMQ52Wc+pNQzct34FGnIVcuQl/kFWEc5s7+jsXCiF5o0YbJLeyr6tyl1D2rWKkw=,iv:6n69rCiyETkV3hnGvAhxd3o+DcDI/Se7JMIs4fsDdag=,tag:Lf7lXw0dhgRqb7lnbJ2H6g==,type:str]
+    mac: ENC[AES256_GCM,data:y3iMxGNyJfkmJZebiJ/iW/fhX3758Bz8/z8GfzvBiosjHOE6Awka70uQ7rFvHrLIFATDCrWW09ERD16/EIGL7bZMBKeXmjpkTe9WrmqYu4aS9qj1A/UzcW9zkxj6kKSZlgbdh2RaPXj9VcVfdYs/WDp8cxAuNmFLLEpY9Ar0SSY=,iv:rSGm4Y9XWrYmA2rL3t63NfSgHd6wBPWbtvfGivj6Qq0=,tag:gdHWOS0NO5piFK3fQiCSrw==,type:str]
     pgp:
         - created_at: "2025-09-18T21:32:42Z"
           enc: |-

lib/hetzner.nix

@@ -4,7 +4,7 @@
   ...
 }:
 {
-  mkMachine =
+  mkHetznerMachine =
     hostname:
     {
       system ? "aarch64-linux",
@@ -154,23 +154,4 @@
         machineConfig
       ] ++ extraModules;
     };
-
-  mkColmena =
-    {
-      system ? "aarch64-linux",
-      user ? "lander",
-      timeZone ? "Europe/Berlin",
-      disks ? [ "/dev/sda" ],
-      ipv6Address,
-      tailscale ? true,
-      extraModules ? [ ],
-    }:
-    {
-      deployment = {
-        targetHost = "hosting-02.escapeangle.com";
-        targetPort = 22;
-        targetUser = "root";
-        buildOnTarget = true;
-      };
-    };
 }

modules/nixos/storagebox.nix

@@ -61,10 +61,10 @@ in
         "defaults"
         "_netdev"
         "allow_other"
+        "default_permissions"
         "port=23"
         "compression=no"
         "reconnect"
-        "umask=000"
         "ServerAliveInterval=15"
         "IdentityFile=${cfg.sshKeyFile}"
       ];