fix: reenable tailcale on colmena nodes

Signed-off-by: Lander Van den Bulcke <landervandenbulcke@gmail.com>

.sops.yaml

@@ -31,6 +31,15 @@ creation_rules:
           - *mail-01
         pgp:
           - *lander
+  - path_regex: hosts/servers/common.yaml$
+    key_groups:
+      - age:
+          - *db-01
+          - *hosting-01
+          - *hosting-02
+          - *mail-01
+        pgp:
+          - *lander
   - path_regex: hosts/db-01/secrets.yam?l$
     key_groups:
       - age:

flake.lock

@@ -35,23 +35,25 @@
         "type": "github"
       }
     },
-    "deploy-rs": {
+    "colmena": {
       "inputs": {
         "flake-compat": "flake-compat",
+        "flake-utils": "flake-utils",
+        "nix-github-actions": "nix-github-actions",
         "nixpkgs": "nixpkgs_2",
-        "utils": "utils"
+        "stable": "stable"
       },
       "locked": {
-        "lastModified": 1756719547,
+        "lastModified": 1755272288,
-        "narHash": "sha256-N9gBKUmjwRKPxAafXEk1EGadfk2qDZPBQp4vXWPHINQ=",
+        "narHash": "sha256-ypTPb2eKcOBbOoyvPV0j4ZOXs4kayo73/2KI456QnE0=",
-        "owner": "serokell",
+        "owner": "zhaofengli",
-        "repo": "deploy-rs",
+        "repo": "colmena",
-        "rev": "125ae9e3ecf62fb2c0fd4f2d894eb971f1ecaed2",
+        "rev": "5bf4ce6a24adba74a5184f4a9bef01d545a09473",
         "type": "github"
       },
       "original": {
-        "owner": "serokell",
+        "owner": "zhaofengli",
-        "repo": "deploy-rs",
+        "repo": "colmena",
         "type": "github"
       }
     },
@@ -115,11 +117,11 @@
     "flake-compat": {
       "flake": false,
       "locked": {
-        "lastModified": 1733328505,
+        "lastModified": 1650374568,
-        "narHash": "sha256-NeCCThCEP3eCl2l/+27kNNK7QrwZB1IJCrXfrbv5oqU=",
+        "narHash": "sha256-Z+s0J8/r907g149rllvwhb4pKi8Wam5ij0st8PwAh+E=",
         "owner": "edolstra",
         "repo": "flake-compat",
-        "rev": "ff81ac966bb2cae68946d5ed5fc4994f96d0ffec",
+        "rev": "b4a34015c698c7793d592d66adbab377907a2be8",
         "type": "github"
       },
       "original": {
@@ -217,8 +219,23 @@
       }
     },
     "flake-utils": {
+      "locked": {
+        "lastModified": 1659877975,
+        "narHash": "sha256-zllb8aq3YO3h8B/U0/J1WBgAL8EX5yWf5pMj3G0NAmc=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "c0e246b9b83f637f4681389ecabcb2681b4f3af0",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_2": {
       "inputs": {
-        "systems": "systems_2"
+        "systems": "systems"
       },
       "locked": {
         "lastModified": 1731533236,
@@ -234,9 +251,9 @@
         "type": "github"
       }
     },
-    "flake-utils_2": {
+    "flake-utils_3": {
       "inputs": {
-        "systems": "systems_3"
+        "systems": "systems_2"
       },
       "locked": {
         "lastModified": 1731533236,
@@ -325,7 +342,7 @@
     "headplane": {
       "inputs": {
         "devshell": "devshell",
-        "flake-utils": "flake-utils",
+        "flake-utils": "flake-utils_2",
         "nixpkgs": [
           "nixpkgs"
         ]
@@ -395,6 +412,27 @@
         "type": "github"
       }
     },
+    "nix-github-actions": {
+      "inputs": {
+        "nixpkgs": [
+          "colmena",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1729742964,
+        "narHash": "sha256-B4mzTcQ0FZHdpeWcpDYPERtyjJd/NIuaQ9+BV1h+MpA=",
+        "owner": "nix-community",
+        "repo": "nix-github-actions",
+        "rev": "e04df33f62cdcf93d73e9a04142464753a16db67",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nix-github-actions",
+        "type": "github"
+      }
+    },
     "nixos-mailserver": {
       "inputs": {
         "blobs": "blobs",
@@ -505,16 +543,16 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1743014863,
+        "lastModified": 1750134718,
-        "narHash": "sha256-jAIUqsiN2r3hCuHji80U7NNEafpIMBXiwKlSrjWMlpg=",
+        "narHash": "sha256-v263g4GbxXv87hMXMCpjkIxd/viIF7p3JpJrwgKdNiI=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "bd3bac8bfb542dbde7ffffb6987a1a1f9d41699f",
+        "rev": "9e83b64f727c88a7711a2c463a7b16eedb69a84c",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixpkgs-unstable",
+        "ref": "nixos-unstable",
         "repo": "nixpkgs",
         "type": "github"
       }
@@ -641,7 +679,7 @@
         "flake-parts": "flake-parts_2",
         "nixpkgs": "nixpkgs_6",
         "nuschtosSearch": "nuschtosSearch",
-        "systems": "systems_4"
+        "systems": "systems_3"
       },
       "locked": {
         "lastModified": 1751144320,
@@ -659,7 +697,7 @@
     },
     "nuschtosSearch": {
       "inputs": {
-        "flake-utils": "flake-utils_2",
+        "flake-utils": "flake-utils_3",
         "ixx": "ixx",
         "nixpkgs": [
           "nixvim",
@@ -704,7 +742,7 @@
     "root": {
       "inputs": {
         "catppuccin": "catppuccin",
-        "deploy-rs": "deploy-rs",
+        "colmena": "colmena",
         "disko": "disko",
         "headplane": "headplane",
         "home-manager": "home-manager",
@@ -737,6 +775,22 @@
         "type": "github"
       }
     },
+    "stable": {
+      "locked": {
+        "lastModified": 1750133334,
+        "narHash": "sha256-urV51uWH7fVnhIvsZIELIYalMYsyr2FCalvlRTzqWRw=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "36ab78dab7da2e4e27911007033713bab534187b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-25.05",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
     "superdirt-src": {
       "flake": false,
       "locked": {
@@ -798,21 +852,6 @@
         "type": "github"
       }
     },
-    "systems_4": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    },
     "tidal-src": {
       "flake": false,
       "locked": {
@@ -853,24 +892,6 @@
         "type": "github"
       }
     },
-    "utils": {
-      "inputs": {
-        "systems": "systems"
-      },
-      "locked": {
-        "lastModified": 1731533236,
-        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
     "vim-tidal-src": {
       "flake": false,
       "locked": {

flake.nix

@@ -23,8 +23,8 @@
     home-manager.url = "github:nix-community/home-manager/release-25.05";
     home-manager.inputs.nixpkgs.follows = "nixpkgs";
 
-    # deploy-rs
+    # colmena
-    deploy-rs.url = "github:serokell/deploy-rs";
+    colmena.url = "github:zhaofengli/colmena";
 
     # nixos-wsl
     nixos-wsl.url = "github:nix-community/NixOS-WSL/main";
@@ -57,7 +57,7 @@
       self,
       nixpkgs,
       tidalcycles,
-      deploy-rs,
+      colmena,
       ...
     }@inputs:
     let
@@ -92,6 +92,20 @@
       nixosModules = import ./modules/nixos;
       homeManagerModules = import ./modules/home-manager;
 
+      devShells = forAllSystems (
+        system:
+        let
+          pkgs = nixpkgs.legacyPackages.${system};
+        in
+        {
+          default = pkgs.mkShell {
+            buildInputs = [
+              colmena.packages.${system}.colmena
+            ];
+          };
+        }
+      );
+
       nixosConfigurations =
         let
           hetzner = import ./lib/hetzner.nix { inherit inputs nixpkgs; };
@@ -136,7 +150,7 @@
           };
 
           # servers
-          db-01 = hetzner.mkHetznerMachine "db-01" {
+          db-01 = hetzner.mkMachine "db-01" {
             ipv6Address = "2a01:4f8:c012:15d4::/64";
           };
           hosting-01 = nixpkgs.lib.nixosSystem {
@@ -146,7 +160,7 @@
               ./hosts/hosting-01
             ];
           };
-          hosting-02 = hetzner.mkHetznerMachine "hosting-02" {
+          hosting-02 = hetzner.mkMachine "hosting-02" {
             ipv6Address = "2a01:4f8:c013:7fc0::/64";
           };
           mail-01 = nixpkgs.lib.nixosSystem {
@@ -158,14 +172,53 @@
           };
         };
 
-      deploy.nodes = nixpkgs.lib.mapAttrs (name: config: {
+      colmenaHive =
-        hostname = "${name}.escapeangle.com";
+        let
-        profiles.system = {
+          servers = builtins.map (file: nixpkgs.lib.removeSuffix ".nix" file) (
-          user = "root";
+            builtins.filter (file: file != "common.nix" && nixpkgs.lib.hasSuffix ".nix" file) (
-          path = deploy-rs.lib.aarch64-linux.activate.nixos config;
+              builtins.attrNames (builtins.readDir ./hosts/servers)
-        };
+            )
-      }) { inherit (self.nixosConfigurations) db-01 hosting-02; };
+          );
 
-      checks = builtins.mapAttrs (system: deployLib: deployLib.deployChecks self.deploy) deploy-rs.lib;
+          colmenaConfig = nixpkgs.lib.genAttrs servers (
+            name:
+            { ... }:
+            let
+              diskConfig = import ./lib/disk-config.nix { inherit nixpkgs; };
+              machineConfig = import ./hosts/servers/${name}.nix;
+            in
+            {
+              imports = [
+                inputs.disko.nixosModules.disko
+                inputs.sops-nix.nixosModules.sops
+                inputs.self.nixosModules.namespaced-vpn
+                inputs.self.nixosModules.storagebox
+
+                ./hosts/servers/common.nix
+
+                diskConfig
+                machineConfig
+              ];
+
+              deployment = {
+                targetHost = "${name}.escapeangle.com";
+                targetPort = 22;
+                targetUser = "root";
+                buildOnTarget = true;
+              };
+            }
+          );
+        in
+        colmena.lib.makeHive (
+          {
+            meta = {
+              nixpkgs = import nixpkgs {
+                system = "aarch64-linux";
+                overlays = [ ];
+              };
+            };
+          }
+          // colmenaConfig
+        );
     };
 }

hosts/servers/common.nix

@@ -0,0 +1,104 @@
+{
+  config,
+  lib,
+  modulesPath,
+  pkgs,
+  ...
+}:
+{
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+    (modulesPath + "/profiles/qemu-guest.nix")
+  ];
+
+  boot = {
+    loader.grub = {
+      devices = [ "/dev/sda" ];
+      efiSupport = true;
+      efiInstallAsRemovable = true;
+    };
+
+    initrd.kernelModules = [ "virtio_gpu" ];
+
+    kernelParams = [ "console=tty" ];
+  };
+
+  time.timeZone = lib.mkDefault "Europe/Berlin";
+
+  networking = {
+    useNetworkd = true;
+  };
+
+  systemd.network = {
+    enable = true;
+
+    networks = {
+      "30-wan" = {
+        matchConfig.Name = "enp1s0";
+        networkConfig.DHCP = "ipv4";
+        routes = [
+          { Gateway = "fe80::1"; }
+        ];
+      };
+    };
+  };
+
+  services.openssh = {
+    enable = true;
+    settings.PasswordAuthentication = false;
+    extraConfig = ''
+      PrintLastLog no
+    '';
+  };
+
+  sops.secrets.tailscale-authkey = {
+    owner = "root";
+    group = "root";
+    sopsFile = ./common.yaml;
+  };
+
+  services.tailscale = {
+    enable = true;
+    openFirewall = false;
+    extraUpFlags = [
+      "--login-server=https://headscale.escapeangle.com"
+    ];
+    authKeyFile = config.sops.secrets.tailscale-authkey.path;
+  };
+
+  programs.zsh.enable = true;
+  environment.pathsToLink = [ "/share/zsh" ];
+  environment.shells = [ pkgs.zsh ];
+  environment.enableAllTerminfo = true;
+
+  users.users.lander = {
+    isNormalUser = true;
+    shell = pkgs.zsh;
+    extraGroups = [
+      "wheel"
+    ];
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPnthKtz0fE4yQ/X10cJgKVCjYCNkRNoqV28xAhD7h2M cardno:22_498_026"
+    ];
+  };
+
+  users.users.root.openssh.authorizedKeys.keys = [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPnthKtz0fE4yQ/X10cJgKVCjYCNkRNoqV28xAhD7h2M cardno:22_498_026"
+  ];
+
+  nix = {
+    settings = {
+      trusted-users = [ "lander" ];
+      accept-flake-config = true;
+      auto-optimise-store = true;
+    };
+
+    package = pkgs.nixVersions.stable;
+    extraOptions = ''experimental-features = nix-command flakes'';
+
+    gc = {
+      automatic = true;
+      options = "--delete-older-than 7d";
+    };
+  };
+}

hosts/servers/common.yaml

@@ -0,0 +1,55 @@
+tailscale-authkey: ENC[AES256_GCM,data:5gGzPfdHWB8dYJ0/pyy1ZLXgpTy0Vb3J+RDcRnSPBp9aS11iZJHBp+drNmrKGIzM,iv:bvKua+uX8jbfPAD5LwcEX+lDmCQpKImK7bfw9kKeDt4=,tag:XSTe6iLDWwPQG7ohCTjHIQ==,type:str]
+sops:
+    age:
+        - recipient: age1a5zz4cyda0aqh0hgf8svpyh9ktwy6z5x3gnnu5ysvpvek9rn03csx7dyqn
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0TUNKT0JtZEs3M0hEUjVt
+            WWJRUkFNSm9pVjRlVkk3RzVPeVZkNytUYVJRCnhzd0syd25HLzBTTFRBN3pXQUVW
+            VXJxakRZdzdGL3U0aFNrVEdTRVNBZUkKLS0tIDFrOC8ySVVYV3pLbDlDakpRZHhh
+            SzlLWGwrYjVNcGFLVGNTTmhleXNZMEEKabv69KbHpVEGpknnuEO+1OgdWCtvdkP6
+            fP55S4jIHjkONG1upwIxHj3YJO55nI5kA4XAx+5AOSntwN1iAXRciA==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age18g4z53ykxzq35dsjq3a2np4f88xwat0kwtax229l3zn0ykhlpvqqy8fgtv
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOTGFJTE5oU2tUcU1XcTVy
+            ZDBiSTQ5bGppOGRjUEV4WG9lc2xFN1RIQTNzCmZuelNkUjhyZWtqSTNZWHhIRjhT
+            UEpyeE9wdC9wSVZLckVzMVdQSXlhOTAKLS0tIGRBeXlWNHRyQkFpS2l2WlJHTnBI
+            WVRHWmE0QU1qK0NpT1QyL1ZZWXpmc3cK4UKRpOatiXqt2DvJmMlB2D+En4ufBXhe
+            vdxhnMZgMlMhN0F+KkOEt8JD1jrbOQ0fn1KdDcsjqO4MBJJK1smB9Q==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1hvrssz7k9akz66evj4kja53zvdtrss8k2ljxsh5myh2mru62sggqznlzrt
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDZGNYQW9pbEVQdTl3WEo2
+            ZWtHOHZzRmRMNkZHS1FjN1UrN0VGc0swc0JZClN3ckNrcXZoWTBpRGpGa0NSMkVY
+            K2ZVSmhuaHlQWUtqakRNTGVacDhScUkKLS0tIDl3czNRYUpra3Y2enlkMkRxUzlN
+            cDdhVlUyZGhsdHMzZ0E5andLVHVoNkkKocZp5EicX0pu1xaX+wYFfLqMoXxn5KiL
+            DsNPjAG//EslXpYq2UxXnWYaUKBq8fUr4moMG8omaoZ6KWgG8u1PeQ==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1u2a7wakgsyct6ed7ah2pksymh7jjl08ankedeyl5pa5jcs8r0uks02jpza
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIdkpsYUlwVlFJVjBRQjJn
+            TWhpZlluTEYwV0I2cDVUYytUZisrL0lWWTBnCnc3THNqT1BzeGkraDUyV0dMWGFr
+            NEo0aEtkUGVxVmttc09RMXJjblRNQUUKLS0tIENIN0hFbVFsbnIwRnYxdmVqVHlN
+            ZWFpdkxVVFpOUzRnUUFYYkIvcG0xa00Ktrrn8R69OF8wwsz9RuvKAiVtS+thbbNp
+            5DnmezbVOr6g3bNLnRQ/GDfesHqvCWTQ+Lv2t8tnXXbjXrNWcxOTgw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-09-09T21:18:09Z"
+    mac: ENC[AES256_GCM,data:+GzVY/9R89YOL1dm0q1q3VSdsBa8krphFk8vOup+0XRn2BaLjwCIvOXQMBycVuRgMUHf77p1ETgpoj9quTDwJK8JDcP8pT6gfa/1mLuFz1I34cVk5f7Vx2BnX2Oh0LN+PXiMggbuySiNk3huOhgnrVCwwukT6PfvOXlYY5DVPPg=,iv:mp07YVgO0Xpp/XtOvD70hF+4ZGQJbn5EXxwPh2fXPMQ=,tag:dVwF6Y73DFeaNlYWLrqJWw==,type:str]
+    pgp:
+        - created_at: "2025-09-09T21:20:01Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hF4DARdpY4woM6wSAQdAqzNqNtPjbYWAx9XIB+bdZjhIIfCTOm1hUrpCu7emwgMw
+            WKfVFLeKJg+d/3PrR5hBoEfsj/IFUXiXDNrlpfr+VQCwd0XLMAM0WvFeod2gPe+1
+            0l4BXxWsyWzDdukiLzqtHelEvaJk8UU3LfhqsmdmQoApbx0AkLGUAQLgiHWtDkj6
+            w+QeYq0CJbO5kCLO+kNCVSNoWDyGOokKqcMxglyaIjlkjodf/Xw56HAeF1BuxPmV
+            =BwAM
+            -----END PGP MESSAGE-----
+          fp: 4BE1257015580BAB9F4B9D5FCA5B1C34E649BF92
+    unencrypted_suffix: _unencrypted
+    version: 3.10.2

hosts/servers/hosting-02.nix

@@ -34,6 +34,39 @@
     passFile = config.sops.secrets.storageboxCryptKey.path;
   };
 
+  services.slskd = {
+    enable = true;
+    domain = "slsk.escapeangle.com";
+    environmentFile = config.sops.secrets.slskdEnvFile.path;
+    settings = {
+      shares.directories = [ "/data/slsk/share" ];
+      directories = {
+        downloads = "/data/slsk/downloads";
+        incomplete = "/data/slsk/incomplete";
+      };
+    };
+  };
+
+  systemd.services.slskd.serviceConfig = {
+    UMask = "0002";
+    NetworkNamespacePath = "/run/netns/vpn";
+  };
+
+  users.groups.storage = {
+    name = "storage";
+    gid = 491729;
+    members = [ "slskd" ];
+  };
+
+  services.nginx.virtualHosts."sls.escapeangle.com" = {
+    forceSSL = true;
+    enableACME = true;
+    locations."/" = {
+      proxyPass = "http://10.10.10.2:${toString config.services.slskd.settings.web.port}";
+      proxyWebsockets = true;
+    };
+  };
+
   sops = {
     defaultSopsFile = ./hosting-02.yaml;
     secrets = {
@@ -46,6 +79,9 @@
       storageboxCryptKey = {
         owner = "root";
       };
+      slskdEnvFile = {
+        owner = config.services.slskd.user;
+      };
     };
   };
 

hosts/servers/hosting-02.yaml

@@ -1,6 +1,7 @@
 wireguardKey: ENC[AES256_GCM,data:Z239oQMzOp4C33pBePuANX3aPkmjTcrT+Z/UY0dnUCmMOs2Oy3iktS6Fgsw=,iv:21XLXpgsoYpvz887ZlLJW/A6IOJwEX5YwJrnO725M5U=,tag:VDGjOiYqFN8tMhf8s2YV6g==,type:str]
 storageboxKey: ENC[AES256_GCM,data:uWDkiWIk3OePRfoaqjllVlRVzW5+ryE4sIOs8qm6cS8JN/+YFbnkCsT5sdFeXSpJyQ7ymgD6uJJ75RWH6Y/iIARbmZN/x/9hnB3LORHSl/C0F3xMHUf6prXtYyPNLWe+ghCMygaLyvBuCBiEhleevRQANXLUJCysiODepSkXwyasAHKTKuKQUPU/T+1R7eXaQPDMehzD4/0o8SdLkqcZXBQzs3VRp+CbQyl7dx6znwoPWckmFH2W+9fZCE+AxFxBP3jPVjBPuOC3BviTYFSvZPEkmtH+lxYv+PXFAPpgYwmAEjCwWyDMDRy6bNVQIG6TKHn60TJv+GCfRwPJ46mVtbruyil23d7g/V7dhu8btPbgtvcBx/8EexJ0PHAVWcIZ1FJwr7inMCAghbSDD3CkGpOV8btaYgUZtosqfg9r5cd75jB+7RZPwyb8/1mrLWE3eL9Za2lZ6bC7a9AeIn1q3Cn6+aoMKqXp8q/sVwozNpUJj73yhjR146MGjCGpqoKJqK453qc3VCC50OZTOULV,iv:sEwA6zrK6FFqTmVJOMD77g0OuDjCHDLRBlirjhZBx/0=,tag:z1fX+7goXk4U6Di+4EK6Fw==,type:str]
 storageboxCryptKey: ENC[AES256_GCM,data:ryYOzFvdPaVkOHmypYbqw+KU6aB2OQutLw==,iv:FL4c7P36qxYR1KJlg7t0dvFHlKGMIrTlQG+CDkeJu9U=,tag:Ia4mhV9Ed/m1rRMCNnHqXw==,type:str]
+slskdEnvFile: ENC[AES256_GCM,data:K1S1PXQMiBoEdbuM/NTBUYRrUSnAC/KBhm/PFzoCJATiLLPsstzgqzbe9vG8tnULb2driAH4Ytd03cmROp30V+9vW6J9eyCofWySWZNEYriRfY1y7y5AR8W13zQL0FGZOewUy/1T7YRvN8FjZFh4n7S3c0GREX3FSSNrmaHwOqgueDs=,iv:VziNMRpC2clhFyOMG8LRReMGUxhYqjUaZeA8gh599aM=,tag:H1tQBZ8nSgATSJB6nFSdlA==,type:str]
 sops:
     age:
         - recipient: age1hvrssz7k9akz66evj4kja53zvdtrss8k2ljxsh5myh2mru62sggqznlzrt
@@ -12,8 +13,8 @@ sops:
             b1ZqUzZLUkFwNHJyVlhmK0FOZ1JFYUEKDU4NmBCHRY+ZK+RFK/LioGzjJTaOE1ky
             MC6jxt7Y5RkCk0BBqeoEVLaNXNViPjwakbvyfH0w0P6l0KDJ4mNlYQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-09-18T21:32:51Z"
+    lastmodified: "2025-09-20T23:35:47Z"
-    mac: ENC[AES256_GCM,data:y3iMxGNyJfkmJZebiJ/iW/fhX3758Bz8/z8GfzvBiosjHOE6Awka70uQ7rFvHrLIFATDCrWW09ERD16/EIGL7bZMBKeXmjpkTe9WrmqYu4aS9qj1A/UzcW9zkxj6kKSZlgbdh2RaPXj9VcVfdYs/WDp8cxAuNmFLLEpY9Ar0SSY=,iv:rSGm4Y9XWrYmA2rL3t63NfSgHd6wBPWbtvfGivj6Qq0=,tag:gdHWOS0NO5piFK3fQiCSrw==,type:str]
+    mac: ENC[AES256_GCM,data:idOk0S4lGYWOPHayOgqX0oKk8cWmm9YUXbAIDlojOmroE8qL45nBMNpb6npuA7wGoHWsg8kYCidi8v8Gz+dGnEMURdcT7NoqcgtDWisYxyw5sMQ52Wc+pNQzct34FGnIVcuQl/kFWEc5s7+jsXCiF5o0YbJLeyr6tyl1D2rWKkw=,iv:6n69rCiyETkV3hnGvAhxd3o+DcDI/Se7JMIs4fsDdag=,tag:Lf7lXw0dhgRqb7lnbJ2H6g==,type:str]
     pgp:
         - created_at: "2025-09-18T21:32:42Z"
           enc: |-

lib/hetzner.nix

@@ -4,7 +4,7 @@
   ...
 }:
 {
-  mkHetznerMachine =
+  mkMachine =
     hostname:
     {
       system ? "aarch64-linux",
@@ -154,4 +154,23 @@
         machineConfig
       ] ++ extraModules;
     };
+
+  mkColmena =
+    {
+      system ? "aarch64-linux",
+      user ? "lander",
+      timeZone ? "Europe/Berlin",
+      disks ? [ "/dev/sda" ],
+      ipv6Address,
+      tailscale ? true,
+      extraModules ? [ ],
+    }:
+    {
+      deployment = {
+        targetHost = "hosting-02.escapeangle.com";
+        targetPort = 22;
+        targetUser = "root";
+        buildOnTarget = true;
+      };
+    };
 }

modules/nixos/storagebox.nix

@@ -61,10 +61,10 @@ in
         "defaults"
         "_netdev"
         "allow_other"
-        "default_permissions"
         "port=23"
         "compression=no"
         "reconnect"
+        "umask=000"
         "ServerAliveInterval=15"
         "IdentityFile=${cfg.sshKeyFile}"
       ];