flake.lock

@@ -61,27 +61,6 @@
         "type": "github"
       }
     },
-    "crowdsec": {
-      "inputs": {
-        "flake-utils": "flake-utils_2",
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1742920128,
-        "narHash": "sha256-VPjnjtAksihLezhc+ZmnqGu18mHr4QVKa1kSZQ8rJL4=",
-        "ref": "refs/heads/main",
-        "rev": "40e937689d318ee85b1d9763189a65e6f0b4028d",
-        "revCount": 40,
-        "type": "git",
-        "url": "https://codeberg.org/kampka/nix-flake-crowdsec.git"
-      },
-      "original": {
-        "type": "git",
-        "url": "https://codeberg.org/kampka/nix-flake-crowdsec.git"
-      }
-    },
     "darwin": {
       "inputs": {
         "nixpkgs": [
@@ -136,8 +115,9 @@
         "type": "github"
       },
       "original": {
-        "id": "flake-utils",
+        "owner": "numtide",
-        "type": "indirect"
+        "repo": "flake-utils",
+        "type": "github"
       }
     },
     "home-manager": {
@@ -169,11 +149,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1743387206,
+        "lastModified": 1739757849,
-        "narHash": "sha256-24N3NAuZZbYqZ39NgToZgHUw6M7xHrtrAm18kv0+2Wo=",
+        "narHash": "sha256-Gs076ot1YuAAsYVcyidLKUMIc4ooOaRGO0PqTY7sBzA=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "15c5f9d04fabd176f30286c8f52bbdb2c853a146",
+        "rev": "9d3d080aec2a35e05a15cedd281c2384767c2cfe",
         "type": "github"
       },
       "original": {
@@ -183,6 +163,28 @@
         "type": "github"
       }
     },
+    "microvm": {
+      "inputs": {
+        "flake-utils": "flake-utils_2",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "spectrum": "spectrum"
+      },
+      "locked": {
+        "lastModified": 1741275356,
+        "narHash": "sha256-VMeqnLv2O6Lg3/pka1tUzzbOjSmEb6RQOp9OuJRcx0A=",
+        "owner": "astro",
+        "repo": "microvm.nix",
+        "rev": "5e1b3dba5b52405dab79412392b9c799d49bd8c0",
+        "type": "github"
+      },
+      "original": {
+        "owner": "astro",
+        "repo": "microvm.nix",
+        "type": "github"
+      }
+    },
     "nixpkgs": {
       "locked": {
         "lastModified": 1741379970,
@@ -201,11 +203,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1743576891,
+        "lastModified": 1741600792,
-        "narHash": "sha256-vXiKURtntURybE6FMNFAVpRPr8+e8KoLPrYs9TGuAKc=",
+        "narHash": "sha256-yfDy6chHcM7pXpMF4wycuuV+ILSTG486Z/vLx/Bdi6Y=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "44a69ed688786e98a101f02b712c313f1ade37ab",
+        "rev": "ebe2788eafd539477f83775ef93c3c7e244421d3",
         "type": "github"
       },
       "original": {
@@ -218,8 +220,8 @@
     "root": {
       "inputs": {
         "agenix": "agenix",
-        "crowdsec": "crowdsec",
         "home-manager": "home-manager_2",
+        "microvm": "microvm",
         "nixpkgs": "nixpkgs_2"
       }
     },
@@ -244,6 +246,22 @@
         "type": "github"
       }
     },
+    "spectrum": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1733308308,
+        "narHash": "sha256-+RcbMAjSxV1wW5UpS9abIG1lFZC8bITPiFIKNnE7RLs=",
+        "ref": "refs/heads/main",
+        "rev": "80c9e9830d460c944c8f730065f18bb733bc7ee2",
+        "revCount": 792,
+        "type": "git",
+        "url": "https://spectrum-os.org/git/spectrum"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://spectrum-os.org/git/spectrum"
+      }
+    },
     "systems": {
       "locked": {
         "lastModified": 1681028828,

flake.nix

@@ -7,8 +7,8 @@
       url = "github:nix-community/home-manager/release-24.11";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    crowdsec = {
+    microvm = {
-      url = "git+https://codeberg.org/kampka/nix-flake-crowdsec.git";
+      url = "github:astro/microvm.nix";
       inputs.nixpkgs.follows = "nixpkgs";
     };
     agenix.url = "github:yaxitech/ragenix";
@@ -18,48 +18,69 @@
     self,
     nixpkgs,
     home-manager,
+    microvm,
     agenix,
-    crowdsec,
     ...
   }: let
     system = "x86_64-linux";
     username = "tbarnouin";
     proxy_host = "192.168.1.40";
     pgsql_host = "192.168.1.13";
-    pkgs = import nixpkgs {inherit system;};
   in {
     nixosConfigurations = {
-      nginx = nixpkgs.lib.nixosSystem {
+      nixmox-curiosity = nixpkgs.lib.nixosSystem {
+        inherit system;
+        modules = [
+          agenix.nixosModules.default
+          ./hosts/nixmox-curiosity/configuration.nix
+          {
+            networking.hostName = "nixmox-curiosity";
+          }
+          home-manager.nixosModules.home-manager
+          {
+            home-manager.useGlobalPkgs = true;
+            home-manager.useUserPackages = true;
+            home-manager.users.${username} = import ./hosts/nixmox-curiosity/home.nix;
+          }
+          microvm.nixosModules.host
+          {
+            microvm = {
+              autostart = [];
+              vms = {};
+            };
+          }
+        ];
+
+        specialArgs = {
+          inherit inputs;
+          inherit username;
+          inherit proxy_host;
+          inherit pgsql_host;
+          inherit system;
+        };
+      };
+      nginx = nixpkgs.lib.nixosSystem {
         inherit system;
-        specialArgs = { inherit inputs; };
         modules = [
           agenix.nixosModules.default
-          crowdsec.nixosModules.crowdsec-firewall-bouncer
           "${inputs.nixpkgs}/nixos/modules/virtualisation/proxmox-lxc.nix"
           "${inputs.self}/systems/minimalLXCConfig.nix"
           "${inputs.self}/services"
-          "${inputs.self}/modules"
           {
             networking.hostName = "nginx";
-            services = {
+            services.vm_nginx = {
-              vm_nginx = {
               enable = true;
-                proxy_ip = proxy_host;
-              };
             };
           }
         ];
       };
       pgsql = nixpkgs.lib.nixosSystem {
         inherit system;
-        specialArgs = { inherit inputs; };
         modules = [
           agenix.nixosModules.default
-          crowdsec.nixosModules.crowdsec-firewall-bouncer
           "${inputs.nixpkgs}/nixos/modules/virtualisation/proxmox-lxc.nix"
           "${inputs.self}/systems/minimalLXCConfig.nix"
           "${inputs.self}/services"
-          "${inputs.self}/modules"
           {
             networking.hostName = "pgsql";
             services.vm_postgresql = {
@@ -68,16 +89,44 @@
           }
         ];
       };
-      forgejo = nixpkgs.lib.nixosSystem {
+      onlyoffice = nixpkgs.lib.nixosSystem {
+        inherit system;
+        modules = [
+          agenix.nixosModules.default
+          "${inputs.nixpkgs}/nixos/modules/virtualisation/proxmox-lxc.nix"
+          "${inputs.self}/systems/minimalLXCConfig.nix"
+          "${inputs.self}/services"
+          {
+            networking.hostName = "onlyoffice";
+            services.vm_onlyoffice = {
+              enable = true;
+              pgsql_ip = pgsql_host;
+            };
+          }
+        ];
+      };
+      collabora = nixpkgs.lib.nixosSystem {
+        inherit system;
+        modules = [
+          agenix.nixosModules.default
+          "${inputs.nixpkgs}/nixos/modules/virtualisation/proxmox-lxc.nix"
+          "${inputs.self}/systems/minimalLXCConfig.nix"
+          "${inputs.self}/services"
+          {
+            networking.hostName = "collabora";
+            services.vm_collabora = {
+              enable = true;
+            };
+          }
+        ];
+      };
+      forgejo = nixpkgs.lib.nixosSystem {
         inherit system;
-        specialArgs = { inherit inputs; };
         modules = [
           agenix.nixosModules.default
-          crowdsec.nixosModules.crowdsec-firewall-bouncer
           "${inputs.nixpkgs}/nixos/modules/virtualisation/proxmox-lxc.nix"
           "${inputs.self}/systems/minimalLXCConfig.nix"
           "${inputs.self}/services"
-          "${inputs.self}/modules"
           {
             networking.hostName = "forgejo";
             services.vm_forgejo = {
@@ -87,29 +136,23 @@
           }
         ];
       };
-      template = nixpkgs.lib.nixosSystem {
+#      template = nixpkgs.lib.nixosSystem {
-        inherit system;
+#        inherit system;
-        specialArgs = { inherit inputs; };
+#        modules = [
-        modules = [
+#          agenix.nixosModules.default
-          agenix.nixosModules.default
+#          "${inputs.self}/systems/minimalVMConfig.nix"
-          crowdsec.nixosModules.crowdsec-firewall-bouncer
+#          {
-          "${inputs.nixpkgs}/nixos/modules/virtualisation/proxmox-image.nix"
+#            networking.hostName = "nixos";
-          "${inputs.self}/systems/minimalVMConfig.nix"
+#          }
-          {
+#        ];
-            networking.hostName = "nixos";
+#      };
-          }
-        ];
-      };
       jellyfin = nixpkgs.lib.nixosSystem {
         inherit system;
-        specialArgs = { inherit inputs; };
         modules = [
           agenix.nixosModules.default
-          crowdsec.nixosModules.crowdsec-firewall-bouncer
+          microvm.nixosModules.microvm
-          "${inputs.nixpkgs}/nixos/modules/virtualisation/proxmox-image.nix"
           "${inputs.self}/systems/minimalVMConfig.nix"
           "${inputs.self}/services"
-          "${inputs.self}/modules"
           {
             services.vm_jellyfin = {
               enable = true;
@@ -119,14 +162,11 @@
       };
       redis = nixpkgs.lib.nixosSystem {
         inherit system;
-        specialArgs = { inherit inputs; };
         modules = [
           agenix.nixosModules.default
-          crowdsec.nixosModules.crowdsec-firewall-bouncer
           "${inputs.nixpkgs}/nixos/modules/virtualisation/proxmox-lxc.nix"
           "${inputs.self}/systems/minimalLXCConfig.nix"
           "${inputs.self}/services"
-          "${inputs.self}/modules"
           {
             networking.hostName = "redis";
             services.vm_redis = {
@@ -137,14 +177,11 @@
       };
       grafana-lxc = nixpkgs.lib.nixosSystem {
         inherit system;
-        specialArgs = { inherit inputs; };
         modules = [
           agenix.nixosModules.default
-          crowdsec.nixosModules.crowdsec-firewall-bouncer
           "${inputs.nixpkgs}/nixos/modules/virtualisation/proxmox-lxc.nix"
           "${inputs.self}/systems/minimalLXCConfig.nix"
           "${inputs.self}/services"
-          "${inputs.self}/modules"
           {
             services.vm_grafana = {
               enable = true;
@@ -155,6 +192,31 @@
           }
         ];
       };
+      grafana = nixpkgs.lib.nixosSystem {
+        inherit system;
+        modules = [
+          agenix.nixosModules.default
+          microvm.nixosModules.microvm
+          "${inputs.self}/systems/minimalMicrovmConfig.nix"
+          "${inputs.self}/services"
+          {
+            services.vm_grafana = {
+              enable = true;
+              vm_ip = "192.168.1.27";
+              proxy_ip = proxy_host;
+              pgsql_ip = pgsql_host;
+            };
+            services.micro_vm = {
+              enable = true;
+              hostname = "grafana";
+              vm_ip = "192.168.1.20";
+              vm_cpu = 1;
+              vm_mem = 512;
+              macAddr = "02:00:00:00:00:20";
+            };
+          }
+        ];
+      };
     };
   };
 }

modules/crowdsec.nix

@@ -602,14 +602,14 @@ in
             console_path = mkDefault consoleFile;
             profiles_path = mkDefault localProfilesFile;
 
-            #online_client = mkDefault {
+            online_client = mkDefault {
-            #  sharing = mkDefault true;
+              sharing = mkDefault true;
-            #  pull = mkDefault {
+              pull = mkDefault {
-            #    community = mkDefault true;
+                community = mkDefault true;
-            #    blocklists = mkDefault true;
+                blocklists = mkDefault true;
-            #  };
+              };
-            #  credentials_path = cfg.settings.capi.credentialsFile;
+              credentials_path = cfg.settings.capi.credentialsFile;
-            #};
+            };
           };
         };
         prometheus = {

modules/default.nix

@@ -1,5 +0,0 @@
-{inputs, ...}: {
-  imports = [
-    ./crowdsec.nix
-  ];
-}

packages/cs-firewall-bouncer/default.nix

@@ -1,28 +0,0 @@
-{
-  lib,
-  buildGoModule,
-  fetchFromGitHub,
-}:
-buildGoModule rec {
-  pname = "cs-firewall-bouncer";
-  version = "0.0.31";
-
-  src = fetchFromGitHub {
-    owner = "crowdsecurity";
-    repo = pname;
-    rev = "v${version}";
-    hash = "sha256-59MWll8v00CF4WA53gjHZSTFc8hpYaHENg9O7LgTCrA=";
-  };
-
-  vendorHash = "sha256-7Jxvg8UEjUxnIz1llvXyI2AefJ31OVdNzhWD/C8wU/Y=";
-
-  meta = with lib; {
-    homepage = "https://crowdsec.net/";
-    changelog = "https://github.com/crowdsecurity/${pname}/releases/tag/v${version}";
-    description = "Crowdsec bouncer for firewalls.";
-    longDescription = ''
-      crowdsec-firewall-bouncer will fetch new and old decisions from a CrowdSec API to add them in a blocklist used by supported firewalls.
-    '';
-    license = licenses.mit;
-  };
-}

secrets/cs-lapi-key.age

@@ -1,23 +0,0 @@
------BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE9Xa1ZYdyBLZUNM
-VWJ2TVRoSVp0amJaQmhpZGdKRXpHc0ErM1BoRlhNODJGa3VDWG1ZCnVycGRWQnhP
-SU14VUpRanNUc1lzT3dXak5tMGVROVJOVXFaNjh1MUZjcFUKLT4gc3NoLWVkMjU1
-MTkgd25FVXB3IE16anVFaFFGRmlZVkY5SDlyWW1nckxoZUd3Z1YvdStEOGNXdS9O
-WkNlUVkKZHYrZ05QeGc5bS9UWFRLellPQnptem5TQ21NY0NXUFVJSkY0RHdsdHNy
-UQotPiBzc2gtZWQyNTUxOSBubUtTK0EgRkk2MWU5b0lPMEFlTXNRWWNWaTFaS0NL
-RkN4eitLbnp2OTRlOHFvVVRDdwozR2p4SEJoNndobTBQeWRLYy9ONGxXcEZTZU5L
-bW1remcyUDRqRDBGdDhjCi0+IHNzaC1lZDI1NTE5IHNpbmd2USBBQXk0b1BCTkgz
-VG1CbDB6QVBreXFIQS9wRG9nYUUxWnF4YzhGM1NFTTFJCk55UkF6NWdPeVUvL3ZC
-anFSdTFFaGJQQjJtQ0l1ZEpUQmZkS3BVc1c5aUkKLT4gc3NoLWVkMjU1MTkgeHFt
-eWpBIDMvOGJZV1o1aE5jYWdVUDhRR3BZd2pxY1FvQVJUS1JTZktrbThjS3BRMkEK
-R2dXcHN6MVk0UGlNZERRbHpiWFBuVkw2KzJwejJCV1FSbG5JTVg4WnVRNAotPiBz
-c2gtZWQyNTUxOSBtdTBmbkEgaU8zcGVhK1BrUWplcVJIRGh1R0N5U1VGZTA5Tlpj
-R2g4RWhBYnBNQVltNAp1Lzc1WlpSWjc1RGdCenVEQ2x2cTZtY3ZwTnFuVkR2RjRI
-d0xYM25MSGFnCi0+IDdYSyV+QT5OLWdyZWFzZSBDJCdsIGxaZnsKMXZFY0x4Q0hT
-QVNXd1RHWFpJZml0ZzBsbHhNWmNORVZjUWxmQ2ltZGxFUm1WdmVsMENSMDFmRGJ5
-dVpsUDlGSwprSTA1Q0JSczloNjFuT3B2Ci0tLSBEWGFMYTU1aTJvdE53dk1qRlpu
-Y2tOVDVUcDRIaG52bmhMa2N5Z0xNWUI0Cjy/5eYpl5iwNd2YwC0o1lO2eTr2ggPs
-Xq2JxNg5IbFYkBqMiw68yEtMmQf243rvGn8h9jQxL1VnSi+wpueZqxgczICzcqGn
-OPOa08liEIvA+UtU4+z11c2fIiZ/BdfzF/s0wzB9uEChpOHSOf0SX8hrwlkq6fIr
-w4z9OXceDiUQ5ITlBCl+Kaeb
------END AGE ENCRYPTED FILE-----

secrets/initialPassword.age

@@ -1,21 +1,18 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE9Xa1ZYdyA1QzZE
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE9Xa1ZYdyBkcDhX
-cHhwUnk5dm8xU29CNlhlU1JsV0tYaDVHV3g2MzI1dnZsVUxVODNNCjFwanh0aUhT
+WHFGRlJFUll0TFlEVzBiUmkxd3duVHFEdFU0K3hta2JGZzdENzJrCnNBcVRtUkkz
-c016dUpONndPL0pRVUtBY2dNZCtYMk1Va2hoaUpsL3I4cjAKLT4gc3NoLWVkMjU1
+NFFoamExVjNhOXh0UjBJS3p0WmtBOWFGZTNkTTdlMm9aMWsKLT4gc3NoLWVkMjU1
-MTkgd25FVXB3IFhIVExqYlhTTWt1Q2l5T0RFRWdPN3dRdXVrbjNZTFFXV3pVZ0p5
+MTkgd25FVXB3IGpKemJpTGJlMU0zU0hPaFpVd2pZcGFlNUhYTHdxS1NlemlwaWY0
-TldNU0kKZXdpZ3I1MEk1VzVsNXBuMmlZZjl6YmVKTmNwMDU2VFVSYUhMeURJSjh1
+UFRBMDAKbm9CSlpxZE1JNnNsZHdtL0R6U2Q3STVLbGQxd1F1ZzY1VkNXeWlSQk55
-NAotPiBzc2gtZWQyNTUxOSBubUtTK0EgSVpFeUpySkdsTldpamFqdGJaV3d3ZmU3
+TQotPiBzc2gtZWQyNTUxOSBubUtTK0EgUzMyMGJXczlic2NUOUl1d1N6MGhxZlZ6
-S1VvU3JkTzAyZk5vRXMranIxSQpQYTFRcmlYWFFldFJKelNEVU0rQU5zNDN6bjVq
+UXlPNEVMYk1zR3UxZkozcXVTbwpyd1UyK0dGSWhIcXpPTk5TU2ZRTjFadGRXRVlY
-ZkxBL0E1UTNVVC9DK1hrCi0+IHNzaC1lZDI1NTE5IHNpbmd2USBsVWhhdUVxUnBB
+OG9tbVhvZzNLcjlQL3FZCi0+IHNzaC1lZDI1NTE5IHNpbmd2USA4a0JFRmlBQjV4
-Nzk0OEJrY1V4UkpMNlVvWG95Z0hlSDNIaWQzNjNReXl3Cm1RdlJxRzBNaTQvUmlP
+VTNhbCtMVUE2YzFwTTFwT09HT240RHRGUFdsUFNsN25nCi9zdllEcHRudmFRTC84
-V0hhZXNhVUJrRklNc3U4dURsYkpjdHErNUljTUkKLT4gc3NoLWVkMjU1MTkgeHFt
+c2QrbjR6eThUdW0zclBFdzVXRTRPU0R1YzlTb2cKLT4gc3NoLWVkMjU1MTkgeHFt
-eWpBIDVKdjA5S0Z5cU5OeTMzL2crN2c4bW9VQm12SUJiMGZ2ZUI0bFB6emNyM2sK
+eWpBIGR5ZlljUVZSZHFFZThIcHJJc1J1R2o3eGpyQ3A5T1Q2ODRyTFFqN0JyU0EK
-T2o4UUJBYTNzNlp2L0IwSE9yZVJQWnJJdVh4Q0c0ZlcvMSswOHJJM1VzZwotPiBz
+TFBpdTVjdTQzUmdRUUVkZDVOSlh4KzM1T1FDUXhaMVAwM2t1ZHFhdmhHVQotPiA9
-c2gtZWQyNTUxOSBtdTBmbkEgellndXoxbmRyV2YrLzZNTnBTeHF6Q2RhQnE4R0NB
+LWdyZWFzZSBlc2h8UitCIHsyIC41KS4gX1JBdnwKdUpQSm1tdXQwUFZPb0FMNENj
-L0VSOGVLaDRzYlcyNAplbnNtb1JzN2hUOThQT1ZFcHNvNUlJeVZnT1dudjI1RDdC
+TFZRM3o0Wk1lN3RobHpxZUVnZHFiT2hWcmoKLS0tIDV0d3NTWUZFNHFpQTJqNGh4
-T0hSakZ5Qk1nCi0+ID40MHUtZ3JlYXNlIHcjSCwgQApBWERhZXJKbEFsN0NUdjRp
+UFdtVGJ2ZFFBMkVpaDdKN0hFcC9tSGwrWTAKSJMImvBdD1SGCFOYFpEqj0xcohO4
-M3RJbWtUV1dSZVBNQWtTbFIrZEhHZmRpVW9TckR5U0RVeDZvSWZDN0o4VTY5T3Ew
+9Eb1cfj6OeUsC5GMsXXJ78/XSjYtCu1wtWBml3HeQzg=
-CjlORWpkOUhVdkFYTWpSNUdoVHA5VVAyK1dSYlc3RnhKSmcKLS0tIGlqcnAxK1da
-QkFqdG0zOVgvWmhmUVNacVZnaUliSUpEeEN2U3Q1cXZHV3cK/UjHuI4IFTOckk9c
-KvePereu3ontxUGl393gcI9x1Eacg0b9HZEfwnDKT4dIX2vGXx2aMLo=
 -----END AGE ENCRYPTED FILE-----

secrets/secrets.nix

@@ -6,9 +6,8 @@ let
   onlyoffice = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAEHTFFQoi8PtzkdTEeA5lGELFS01J51GLLjrnySJM7R root@onlyoffice";
   postgresql = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJW7qA7j1sICuu1RAfs9ifR9dmOlHq45tKu1ga7CKaob root@pgsql";
   forgejo = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILMf3Cc/S0p/LFcW+RLMEqpxOOv8q/HrKO4I9joHmRxl root@forgejo";
-  nginx = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKX2wkS9bpMy1+ITPtQclRkthOwksWBZOLa3bT9oLAe1 root@nixos-nginx";
 
-  systems = [grafana onlyoffice postgresql forgejo nginx];
+  systems = [grafana onlyoffice postgresql forgejo];
 in {
   "secrets/initialPassword.age".publicKeys = users ++ systems;
 
@@ -26,8 +25,4 @@ in {
   "services/postgresql/secrets/authentikDBPass.age".publicKeys = [tbarnouin postgresql];
   "services/postgresql/secrets/grafanaDBPass.age".publicKeys = [tbarnouin postgresql];
   "services/postgresql/secrets/onlyofficeDBPass.age".publicKeys = [tbarnouin postgresql];
-
-  "services/nginx/secrets/cs-lapi-key.age".publicKeys = [tbarnouin nginx];
-  "services/minimalConfig/secrets/cs-lapi-key.age".publicKeys = users ++ systems;
-  "secrets/cs-lapi-key.age".publicKeys = users ++ systems;
 }

services/forgejo/secrets/forgejoDBPass.age

@@ -1,12 +1,12 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE9Xa1ZYdyB2R1B1
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE9Xa1ZYdyBibzZy
-TXQzcHZLOVpqeXU4dE4rdks5S0tRVjlpVGF0K0w4U2hsRlBJU1VrCnNmSGdNNmxt
+TVF2MnoyblpvVmJtNEsvQnR1Y1YxMkNPakpUWmNUdzcyY283MFM0CnpkaDkxcFp5
-TlRhbzdWSzlnbDk4dTZPSitpT1NoU2cwWWlmd3FSSGdmek0KLT4gc3NoLWVkMjU1
+VGc1aWZFUkF0bTZMU2tHV05ZYk1JSnpPWmpzbXhHNFlQNUEKLT4gc3NoLWVkMjU1
-MTkgeHFteWpBIDZjZU5uWWlHME1OVFAzV1QvVjdaS1I2UjNyaTFYS090TUJUaWQx
+MTkgeHFteWpBIG82LzhFd2JsaVpHZVA5cFE2ekwwTU9JZ3hoc3ZoWDliUHdmK3R1
-TGJZUm8KdlVNM1dKQzdKcTEwZHRvWWQvVTVXT1huYkZqalF5cWZ5dkNCU2Q2YUp4
+V293VUEKSWpUYk9iQkpXSXNKcnhQSVJJbkR6RXdnK0lIWUdJbHZWUm9Fc1ZpZ1hq
-SQotPiB7VD9eMCwiXC1ncmVhc2UgIkhYIENabi1iYTogOUoKaEo2N0QvZUVzTGY0
+RQotPiBiQnZNWy4tZ3JlYXNlIDMmID00QyMuV2ggQQpGRk1TT3FhVFBldWpvRXpr
-eEhyTFp6QWNCQ3YxcmtacXJqZnpRYnhjRmdZdGl1ckNNSGxxU01HcDdWZ255QXFX
+Sk81d0RIYi9obUQ0cUxraXBDYmJaSWlKVDFPVWVHSVQ0dlNySjZLNG1HRktaNGVN
-M3YrZgpDVVVWbjlmQmY1Zk9mTXZIZ3ZTTG9aaUExZwotLS0gb3A5RUpiYkVxVzRW
+CndEaHNNdVdqVFEKLS0tIG8rdEJ1VXpxRnJLUGkxblRwaXBJUVBLaGNrWXM0TkJH
-Tm1NMkJjMW5yQ2x3MzhvQWNGbXhyVEFEN1BJUS94OAqqLC4vCYHEG5CWZjtEdAu8
+REYveDhLTmFyZUEK4ptpcutNLxsjRtwUIq95en3faY2H6GuLjtmDKP3Cp+gdOL31
-ekrBlJWaVOdA1nV2rCOciHc+p0/QI74zmzQ1eA==
+D0wzCw14zDU=
 -----END AGE ENCRYPTED FILE-----

services/grafana/default.nix

@@ -33,24 +33,7 @@ in {
       };
       kuma-token.file = ./secrets/kuma-token.age;
     };
-    services = {
+    services.rsyslogd = {
-      crowdsec = {
-        hub.collections = [
-          "LePresidente/grafana"
-        ];
-        localConfig = {
-          acquisitions = [
-            {
-              source = "journalctl";
-              journalctl_filter = [ "_SYSTEMD_UNIT=grafana.service" ];
-              labels = {
-                type = "syslog";
-              };
-            }
-          ];
-        };
-      };
-      rsyslogd = {
       enable = true;
       extraConfig = ''
         ruleset(name="remote"){
@@ -64,10 +47,10 @@ in {
         input(type="imtcp" port="514" ruleset="remote")
       '';
     };
-      influxdb2 = {
+    services.influxdb2 = {
       enable = true;
     };
-      grafana = {
+    services.grafana = {
       enable = true;
       settings = {
         server = {
@@ -100,7 +83,7 @@ in {
         };
       };
     };
-      prometheus = {
+    services.prometheus = {
       enable = true;
       port = 9001;
       scrapeConfigs = [
@@ -132,14 +115,6 @@ in {
             }
           ];
         }
-          {
-            job_name = "crowdsec_authentik";
-            static_configs = [
-              {
-                targets = ["192.168.1.125:6060"];
-              }
-            ];
-          }
         {
           job_name = "nginx";
           static_configs = [
@@ -148,14 +123,6 @@ in {
             }
           ];
         }
-          {
-            job_name = "crowdsec_nginx";
-            static_configs = [
-              {
-                targets = ["${cfg.proxy_ip}:6060"];
-              }
-            ];
-          }
         {
           job_name = "redis";
           static_configs = [
@@ -176,7 +143,7 @@ in {
           job_name = "gitea";
           static_configs = [
             {
-                targets = ["192.168.1.14:9002"];
+              targets = ["192.168.1.14:9100"];
             }
           ];
         }
@@ -184,7 +151,7 @@ in {
           job_name = "postgresql";
           static_configs = [
             {
-                targets = ["192.168.1.13:9002"];
+              targets = ["192.168.1.13:9100"];
             }
           ];
         }
@@ -204,6 +171,14 @@ in {
             }
           ];
         }
+        {
+          job_name = "deluge";
+          static_configs = [
+            {
+              targets = ["192.168.1.18:9100"];
+            }
+          ];
+        }
         {
           job_name = "jellyfin";
           static_configs = [
@@ -222,7 +197,7 @@ in {
         }
       ];
     };
-      loki = {
+    services.loki = {
       enable = true;
       configuration = {
         server.http_listen_port = 3100;
@@ -230,7 +205,7 @@ in {
         auth_enabled = false;
         ingester = {
           lifecycler = {
-              address = "192.168.1.27";
+            address = "127.0.0.1";
             ring = {
               kvstore = {
                 store = "inmemory";
@@ -289,7 +264,7 @@ in {
         };
       };
     };
-      promtail = {
+    services.promtail = {
       enable = true;
       configuration = {
         server = {
@@ -345,7 +320,6 @@ in {
         ];
       };
     };
-    };
 
     # Open ports in the firewall.
     networking.firewall.allowedTCPPorts = [3000 3100 3101 8086 9001 1514 514];

services/grafana/secrets/grafana-db.age

@@ -1,11 +1,10 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE9Xa1ZYdyBTTDNK
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE9Xa1ZYdyB2Mmts
-K3Z0alIwY0FzQlBCeTQwTS9oQ3U4dThSUUZMSXBIcU55em1KSmdnCnBWN2FaZnhs
+SGNkcnhPak5uei90a3ZoTlZyakxTUUZUV0xaQnBZKy82YStDbHhzCmw0Rk5MN2E3
-N1NLdk0xQ09PMTFwb1FEMjJDNzg4bzBEL0p5aGh1MEs4b0UKLT4gc3NoLWVkMjU1
+WFdsQ3NOSXJXY1RqQTJvMFh4Y29NblhPOUxGZWFwRFl5ZzgKLT4gc3NoLWVkMjU1
-MTkgd25FVXB3IEIyL2VrYlVrazJTdktJbUVOUzZySlhZbnNvNlIrY0dlckZrdlE4
+MTkgd25FVXB3IFNMaC91cFZaNk53anZ6cWFSRmVYYm1DVFFEanJXejQreE5yKzFV
-Q2E1RFkKZFFlUUZoRmUxck5OZjZwVmZQbklzdDZ5Q0xpd3dyTTVEdjFOQ3pGMGxN
+bU13VmsKclpQQ2tvZGtERmRBam9DUXVrRkd3amt4V2psUkhaY0ZNUXBLeHFhSExj
-ZwotPiBVLWdyZWFzZSBHbiA7OApIeEE5RWx1ZjFkZ3Z6TDMwcnRJSGNFVXo2UUdT
+MAotPiBoLWdyZWFzZSBQbGUnfHhDXQpzcXdteFZrKzFEQWFmVmcKLS0tIHRYOXMy
-VVdNaTJQUmllSnVWeng0SmVmaCtiUXMKLS0tIC9GVjdhQWFyK09xcmQ3OFZWUUdT
+cXNnaUk0c3QrUHRaUXVNNWN1dTJVcWM4UWIyWEtuYWxRdk4rUTQKyaaS0dtamqzZ
-cG5OTWs5QU9JOHorMFhuYUkraWFVc2sKXuXtNqrwCgD4SmTo9caBnH5Ieaotok43
+dPOcuIxUDx/G/lzes6ABI1gB2i+vr20/DvtTaNklcXHQY2BO4Q==
-rzPGYHVRNma0rlEZpXh4K1RiC4GPDw==
 -----END AGE ENCRYPTED FILE-----

services/grafana/secrets/grafana-oauth_secret.age

@@ -1,14 +1,14 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE9Xa1ZYdyA5K1k4
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE9Xa1ZYdyBtM3Fu
-eTYzME9YYkVKc09uL0IwSkVoL2tXODdJSWt4MEdSR29QOXZMWkdrCnJqS1pYa3d4
+K0RUSmtPd0sxd2Z0dEZkN1FpVTBjTkJhYWI3V2dJR3FnZk1vaXo4CkgrRUNRc0ZO
-TUJUN3d1N0tPNTN0eDd6Z1B5RXlVWFkxMk10STF1Zi9jY1kKLT4gc3NoLWVkMjU1
+TXdhTGhkWVpobUY2eENGT0h3aDVpNGt1dVJJM2JrQ3pERkkKLT4gc3NoLWVkMjU1
-MTkgd25FVXB3IDZqVDh0YS9iWDFMbmtDamZQYjc3MGk0QXZJVnlKRmR3MmI5bGNH
+MTkgd25FVXB3IGhNYmZwdWp0YXB4VWdmbHh1TjlSNEljNFFSajRNbkpkaElwS0dj
-bEkzUWcKTkZpejZkRTcxbEw2dk8xaEFQempHekRtcnROR0FHTi9BMjhhZnZBWnlY
+VTZTVGMKYkU3ZC9KZW54ZVFqTFk0S1dTL2JnVEFPNVBCR3JscjBLUWVWb2ZYNXJO
-cwotPiA5OHYtZ3JlYXNlIEQ/IDcmIE1WICIKWEF1VC8zOXdkdlpZMEV3SlF6RDg5
+QQotPiBEVVpNLWdyZWFzZSBKN24yXCBcVnYrXkcKcmptQ09wRlRLWEI2WlA3bnBo
-Z3k1V3lzclVVbkplYkdoTlhOL3VSUFk2a0g5TlpyTzB2WGE2QQotLS0gb1ByMTZT
+NExuM1YwTWZsd1JmN05mMG1wMjVmbW5RTWpncVZ0YUpwVjA4b3Urajk5TjJnCi0t
-V2NyRnJ5ZVpqc3NGbTNhTFhZK0gvTUN5YStzVXUyMmlwMDlBWQoCsJBEa8QT1b3E
+LSB0Q1NRYjJBb0ZpNVQ3Q2dSZVFwYXN5ZG93N0JMWENjQU11QWxQWC8zZEI0Cpi4
-8uCGIuxq1OvWfq3CHSnIHtVPPPz9Dwdp2XZ9XGN1mwGOcDWvnn6xVedeHXk95vNw
+5dU4RfIEAsKkX79fe3Vjt7EAO5Qmszzy0N0Jlkagn/ZxAsn8Y4NVH/WmD4l3xyTO
-79Dx6bMfB9O3TmS4CyQ4UdFKt7ysjuDXw5LIe3FvpjmbRRJGKw+t8pDNFUi7MGif
+pzq5Cc6zL/TU9LMjcq1hXzwbQuueWkQTrVop+pfa5KRH1PCh4ntVVMIXBmlHpjoL
-/y00Ss8yI9xEatUXBUCfO8pMqoBqbzA2xfsAZ+FTYOELZppZhlp6c1+b30gyzNEx
+pfx7k1PzTMwO0ACw2sClHM40kafeGG0Rb0SgmyyfcQtO/JpdgC1rLFAO+4lM+UlC
-+QdkVxVX9g==
+4CR3D2IfaeL1ojFGKHgU
 -----END AGE ENCRYPTED FILE-----

services/grafana/secrets/kuma-token.age

@@ -1,11 +1,12 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE9Xa1ZYdyBPbktx
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE9Xa1ZYdyBMY0Z6
-UWlmTXJOYnFDSjBMUUZJZzN1R09ldWpHdlVONzJOR0NwODdsRzFJCkdPT1R6b1lx
+STRvMWVUVDRMM2I3bkFsUEo3OFJyNDVPQzlWcHRFSVplUXEyaW13CnJoclhhL2Vo
-dThHczN0WWJaOENiTW0wRnI0OG5PeTllVXBUWkhVVVlkeFEKLT4gc3NoLWVkMjU1
+d1M1cVhLcXVpNEZzdmtsZUlTZjVMamJHdC8xekNzM01oWE0KLT4gc3NoLWVkMjU1
-MTkgd25FVXB3IFJrV0FkUERiZkVJNmZWUUZWRytHTTM0RHN4MzczalM4VDVsMmtt
+MTkgd25FVXB3IGYyeTlEeEpTWkZsMFdvVzhlU2p0Yk0zMmtRL1ZRTHp5YzEwNk5q
-S2dVVkkKdXZFRitOYSt1M1IwbXlZNDNCOEpkbDA5MzVrV3NPWHA1a3NXSXhVM0Vw
+ZGNHMEkKaFNMQW1RTXJkLzlYR0Zjd09YNlhVVlhPV0tpWkJOLzIva0NsWGtGbHk5
-UQotPiBgby1ncmVhc2UgRiw3Cktud3Izd21LNGJiMXVrQi9sWVB5T1VoMVhEZ1JX
+dwotPiBmeyVXdS1ncmVhc2UgPF9kIyNNNm4geidlbUMgL1R6Xz5YCk1rMnZPYnI2
-bVh6eWZMWHN3Ci0tLSBId2M0T1d1ZkxQK0ZMcHJBRHRwQ2drT1RHSWhJbnd6YTR0
+Q1Q4RGlDRDIxRmFaMStqakxud244d2YrMWttUUxGWVBuZVBrTHZMbVdHN3p6ZnYr
-T0tGNmtCTE44CiymjrDgkjwfLRhDCKZin3sV5je3Ho3fUyMu6vHp1ybmlYZxPXa9
+eUEKLS0tIGVOUlJaZU01UGpTVXBxSjZjL3RuL3JlQWlDVkIreHZJdEZRTVExeGRi
-996BaKlD5RQWjAXyWRFVFQzVwnP8iNULxA0Uo3a5SUxQ5YlQPf+V
+OHMKBgnrlp1sTW9RJkzeHCgKExVm909fmlzm4J0OkaJDTNBeehEZsRLg72J7G8Em
+u4FvLjakI+VMbsOJ5HmDsCXTGDLSJevK9e45o3Ik3sw=
 -----END AGE ENCRYPTED FILE-----

services/minimalConfig/default.nix

@@ -91,13 +91,6 @@
     ];
   };
 
-  age.secrets = {
-    cs-lapi-key = {
-      file = ./secrets/cs-lapi-key.age;
-      owner = "crowdsec";
-    };
-  };
-
   services = {
     openssh = {
       enable = true;
@@ -114,21 +107,6 @@
     fail2ban = {
       enable = true;
     };
-    crowdsec = {
-      enable = true;
-      package = pkgs.crowdsec;
-      autoUpdateService = false;
-      openFirewall = true;
-      settings = {
-        general = {
-          prometheus.listen_addr = "0.0.0.0";
-        };
-        lapi.credentialsFile = "${config.age.secrets.cs-lapi-key.path}";
-      };
-      hub.collections = [
-        "crowdsecurity/linux"
-      ];
-    };
     rsyslogd = {
       enable = true;
       extraConfig = "*.*@192.168.1.27:514;RSYSLOG_SyslogProtocol23Format";

services/minimalConfig/secrets/cs-lapi-key.age

@@ -1,22 +0,0 @@
------BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE9Xa1ZYdyB3eCs0
-Nk9UMzBuKzh0MHdNQW9sM2JRZUFjS3lXRm13U2F0SmxwM0szcG04CmkrMm1BRlls
-bXZacTIyR3RWMWlGSUMxcytYRGUzSExYd055emNEQTVuc00KLT4gc3NoLWVkMjU1
-MTkgd25FVXB3IGNuRmFFa1lYd0xsV0d2WkRhYmFEVjlkc1g4NWJURitnNzBhMHBj
-WWhnWFEKSkw1K0V2WXdpT2krQ3ZtbHJZT0hGczJ3ck00SC92TFZVdWIwYmoxRDlP
-NAotPiBzc2gtZWQyNTUxOSBubUtTK0EgcGJyTXpoTkF1Z212ZHUrVDFoVXFualNM
-MkNyQXpNWmJReGoxWGF6N2dHMAppY0ZiVWVMNkp4eVB0VGsxUmRmaDN1RG0wRXM0
-QkhyYUF1OGdPdHN4dUpJCi0+IHNzaC1lZDI1NTE5IHNpbmd2USBuSHpPaG91UXZG
-YmdvQUNVQTlEeG5DTWtiSDJCQ3dzeWM3RXlCQW9kMXpFCkw0bUxuVzZlMThXUytT
-Znd1MlE1WnpOQlg2bCtnT21pVGwyYTdjb2xGNlkKLT4gc3NoLWVkMjU1MTkgeHFt
-eWpBIHNqUUxQM2QvSkV6Y0FucU5kSWd5SURObXN4czJiN29ISW11UTJjOTB4azQK
-ekN0RUkwVWsxSHhqelNueGNGOTNoMWExNkxRd3RaVkluNmpIYnk1WXY3awotPiBz
-c2gtZWQyNTUxOSBtdTBmbkEgSm50VlB2NEh5ZzBmNVpaTE5sbHZEcnE2ek43T2RH
-M1hwOFRIN3ZXcmx4YwoyK3QzeU1ZT2F5MUM3blg3aytLTGsxSmtxZ3VDUkNFVjZs
-eFdjMTBSeHVFCi0+IDk4cFViLWdyZWFzZSBYekczVnVnbCBpfXpGIC5HClRvVDlB
-R09XcDYxQzNWOVBhU256a2MwRHlxK3VJd25teDJZMDBRCi0tLSBBZXdLcy9sVTFn
-TEpESU1IWE1aOGowcjlGQW5wZEhwZjFMaWxMZmN2MC93Cic+Mcw6l7P3Pog/UL3J
-M2HIcSjqjtLKtk52uNIb8b7A/fOdrUhogyYVfAt7nWhQ0CCE+cE/Z+JnI3g8skG5
-4ZGF/r9Y+9orKLdskFdrkWBYX1jx3Xcwme+Kg86AO9P3Os3thXo8iDctAFFiAWvo
-AgOOjmobsPfXKQfRZw84nDB1CXzFZkDngYrB
------END AGE ENCRYPTED FILE-----

services/nginx/default.nix

@@ -2,17 +2,12 @@
   config,
   pkgs,
   lib,
-  inputs,
   ...
 }: let
   cfg = config.services.vm_nginx;
 in {
   options.services.vm_nginx = {
     enable = lib.mkEnableOption "Enable minimal config";
-    proxy_ip = lib.mkOption {
-      type = lib.types.str;
-      description = "The Nginx proxy IP address";
-    };
   };
   config = lib.mkIf cfg.enable {
     security.acme = {
@@ -23,59 +18,7 @@ in {
       ];
     };
     services = {
-      crowdsec-firewall-bouncer = {
-        enable = true;
-        package = inputs.crowdsec.packages."x86_64-linux".crowdsec-firewall-bouncer;
-        settings = {
-          api_key = "XIgNVuxdP74m+UPbd3WJnHHJdLhRiTbhuH6z2mPRIFg";
-          api_url = "http://${cfg.proxy_ip}:8080";
-        };
-      };
-      crowdsec = {
-        settings = {
-          general = {
-            api = {
-              server = {
-                enable = true;
-                listen_uri = "${cfg.proxy_ip}:8080";
-              };
-            };
-          };
-        };
-        hub.collections = [
-          "firix/authentik"
-          "crowdsecurity/sshd"
-          "crowdsecurity/linux"
-          "crowdsecurity/nginx"
-          "crowdsecurity/http-cve"
-          "crowdsecurity/base-http-scenarios"
-        ];
-        localConfig = {
-          acquisitions = [
-            {
-              source = "journalctl";
-              journalctl_filter = [ "_SYSTEMD_UNIT=nginx.service" ];
-              labels = {
-                type = "syslog";
-              };
-            }
-          ];
-          parsers.s02Enrich = [
-            {
-              name = "gateway";
-              description = "Whitelist Gateway IP for VPN access";
-              whitelist = {
-                reason = "Gateway IP";
-                ip = [
-                  "192.168.1.1"
-                ];
-              };
-            }
-          ];
-        };
-      };
       fail2ban = {
-        enable = lib.mkForce false;
         jails = {
           nginx-http-auth = ''
             enabled  = true
@@ -187,6 +130,24 @@ in {
               recommendedProxySettings = true;
             };
           };
+          "office.le43.eu" = {
+            forceSSL = true;
+            enableACME = true;
+            locations."/" = {
+              proxyPass = "http://192.168.1.125:8000";
+              proxyWebsockets = true;
+              recommendedProxySettings = true;
+            };
+          };
+          "collabora.le43.eu" = {
+            forceSSL = true;
+            enableACME = true;
+            locations."/" = {
+              proxyPass = "http://192.168.1.19:9980";
+              proxyWebsockets = true;
+              recommendedProxySettings = true;
+            };
+          };
           "git.le43.eu" = {
             forceSSL = true;
             enableACME = true;

services/nginx/secrets/cs-lapi-key.age

@@ -1,14 +0,0 @@
------BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE9Xa1ZYdyBCRlBx
-TDRERktFbE1xSXNpUXd4UE5vdHJpWmRNQUdjZ3hLejlmaWVjd2lRCm10aStweldV
-aE5lWnJ4T3l3dTFlYWR2eUtjZHYrdTJ1VmFQMFc2UlIxUWcKLT4gc3NoLWVkMjU1
-MTkgbXUwZm5BIFh5dDY0c1hMTDE5aTFsRU5JbERvTXlWSDZwZGgzaExraitLSmQr
-Ukp5VkEKT0ZQS1AzQTFWRGJneWVjaU5sbHVaME83RnZuQzBPNCtzb20yNWtNR0Rk
-ZwotPiBwdygwZ11ZLWdyZWFzZSBEXGFWV2JvCjZPenNoMVhjbHZycjhqZURQWExi
-NmZkZDdJaTQ5NkFCZmtmWU1zZEdrQndnSnBkNmZhY1dOeENqeTNpL3BlcXMKN0VQ
-VmgvaWdONzF2TWFuS0tTQ2Y5M0NUMGJkOFVaMi85K01vdHNRRUJ3d1VLbmxUN0cv
-SVIvcwotLS0gOW9sZjBuUmxRK1JMZ1NYWlRiL1BMZGd1SmJML0I5SlpLMWlOakhR
-L01DdwpzAKzZ6lqTmdlFPWlj3ElxZJhWKZI9iPpP9QW/TzrAAAmHivSmSfLrAKwE
-uBgXo+unc+c9KUCypY8z1nMzbmijDKhMrryBsj7++IyfG5cqhX4J+Y73mdutKtfY
-JzsfH7ku3cvSxl1MypQdj7+F//7hkcn5IoSKLT/AcTqqFEcoUorf5QYaD5Rnrg==
------END AGE ENCRYPTED FILE-----

services/onlyoffice/secrets/office-dbpass.age

@@ -1,11 +1,11 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE9Xa1ZYdyBlRXJL
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE9Xa1ZYdyA0YWdJ
-U09lMEFhTm14UDBvK0RneU1rUEExOW1XLzBYaFVIUE11WnhXT2pnCkVSYTlxT0pC
+cnphWUxTeldXM25FZGg3NC9sVlppbHE4N2szS00vK2VQL1VPendJCmhTME1MUzhI
-dEdhTlp6MnhVVGdjaU5sNkw4UEJqRDh0S2VjMXFpbVdDaE0KLT4gc3NoLWVkMjU1
+MTZRSG0rcVFvdjllZ05Ockkwam1kYVpObnJSdEYydGgyN3cKLT4gc3NoLWVkMjU1
-MTkgbm1LUytBIFEzTldxVFNPQ0k4anI3eGtROHh5K2NDNE9vbGRKdGpZdmZONFJF
+MTkgbm1LUytBIGM5NCtPVGZJWVhNR1ZvTGVGODF0M2N3aXdzeVVDYU10aGc5bkVO
-Z3E4aE0KeFlSTkliYldSeGkvOWJtVGNJaDIrbnFWT3kzUVh3T3pRMEFQVUptSDhs
+ZmNPd2MKa2xiZy94cjEyOFRBU1NvSHpvckQweWh3OGRQejhQQVpqMnJLQjI1RVQx
-YwotPiBrd3ZcWDBdeC1ncmVhc2UgfApURFdhNmlIOVR0T1c5ZFhHbURNbkx3YnhS
+QQotPiBcJC1ncmVhc2UgXDFcUyAqfV53PyArZSFFc0sgenxXek0KdTh0UFU2V25T
-L1ZMWjg5dGlZM0FCZUJ3WVpYTU5HRjV6cTllYkxmcVNXWFJQeUlOCnlKcwotLS0g
+bWNoSWsrUmpkbzNabmdJZ2t5OHh1RTgzY0ExaGNLS09hZHl0eXM3MXB4RwotLS0g
-RUIxbW1BVW05WGlRZlVJcDNINGRQTU8zSytqZGU3aVNldkNGakdFYllRVQpyT8qx
+UkxxWURhVzg5Q09EUGtObEhOeWN3MXk4U1ZxeXZWLzFXVURpQWNrYzBmWQqn7LYQ
-VmPmwWiaRIx1JjhOPLnLnK3x2h2FepWW37HPANVrD51o8x9PPzbzpe/j+DI=
+6fgnb/DRZjA8yhMgTSIcIJSm4t/+y6fGTOMmWK9Sjsjx+bK1kazPnPZgp6A=
 -----END AGE ENCRYPTED FILE-----

services/onlyoffice/secrets/office-jwtpass.age

@@ -1,12 +1,12 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE9Xa1ZYdyB6YTZF
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE9Xa1ZYdyA1QnNv
-SSt4bEFvY0xCT1ZTUldNSkdveG44cWZYei9DdDhRQnlId2xnM1M0Cnp1T0dlWFZz
+L1U2eUljam4wM01lOURXQ2luRkVGbk96OVFuVm9kS1NxaFJ0N0QwCmZxak82eW1w
-b2FBOUMwT2dKaEpxU0c4aWQvRTBaVFV5L2ZWdDYzUjQvaTQKLT4gc3NoLWVkMjU1
+SVBMeEZWUDh3a3lmRkJhSkcxcW5kSUg3R1RiVUxpMTlPZE0KLT4gc3NoLWVkMjU1
-MTkgbm1LUytBIGl1VHJLN0JOZUhuUmtQbnF5b3Q5QVF6eEFvREFSaG5VTS9yWDJP
+MTkgbm1LUytBIENxbWI5ZG4rbVFEb3lvQVZLMW1tUFo5N2hzYzQyN1hSZnZUdHlv
-TXdDSFUKS1k1M211ZWNLeXVHYWlzeDJwQWJBLzlZUWI3TkNzVTVyTHNWdkxlWkRN
+Q2hDUlUKdDdmd2JyREdPYWdLSFBUN3orOUJkSk9WK1JYTElhV2JyaWR1cUJLM3BI
-TQotPiBaP2E+MlctZ3JlYXNlIFNzYiBjKnI1fkEgO1pgIDw+CkN2aktUQ1FoMDlv
+QQotPiBWYSo7KlItZ3JlYXNlIHBJXCYgNWZjb1RjIGVPOT87JF0yCkFkbVFkTWlN
-VHpHSEVuaW1ORE14dWRyS0U1amY5Ny9HV3hpODVnNUY5T3lXdGdMMS8zNy9xUXVV
+bXk5b0VZdmNza09JanVXbFlCUkNVdkNZZ243TzRLMTB1bkkzTGJzS1pIdkdmQnNt
-QUhXNEsKekR2SytYcWlHY0VScXZhWUw0Ty9Qd2t6VWcKLS0tIFRCWW9KTWUxNXJv
+T2liSWdjdjQKbnBITzM5L0JlS283MndTenE1UTMveHRXL0UwCi0tLSA0eHZFQnhQ
-NC9rTWpnNTdPbitqL1RtQWRxTFYyaXVzcmptdWpVaVUKHjTjNodh7Gq5bTJ0WXAo
+ajd1SkNvanNuQTQ2VWpKYU0vbGRmVkZJWUZURG5xbnh0UDhJCtVjowaW++5XN5JY
-DbfiQMUsv90ipf+og4AkLfVzSkcNrpNeREzCj7wZvPE6LA==
+pZSLB0peh5Zu7P/yeAmDvnjO2BhfgQ+9sZzNzAcVwM8We03Tr8M=
 -----END AGE ENCRYPTED FILE-----

services/postgresql/secrets/authentikDBPass.age

@@ -1,11 +1,10 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE9Xa1ZYdyBnSGtm
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE9Xa1ZYdyAxVEMw
-R1dGQlBySDlVTy9Mb1QraTZLRFFPSmRqYUF3cTNRbmNnV2VUQlVzCkxKcjRHN0p3
+KzViTWJzNEtlb3NiZ1F3Rk1ud2V5dU05VzZLWjVCcnpCNnI1eENZCmQvWE9OUU1M
-SUlnSUpXVXc5VURRSEVMWEF0bHZkRGQ0VHZLcnJPV3pkMVEKLT4gc3NoLWVkMjU1
+c0xFVjMwUHZCMzJHMjZXYy8vR3g4VXNQUjd0SExGVzFTSm8KLT4gc3NoLWVkMjU1
-MTkgc2luZ3ZRIEJGUlB4N3l1Zlc4bkNQRVBxK0QyNU1GZUQrQmw4d3NHYkNDelR3
+MTkgc2luZ3ZRIEk1YWFub1VHVkE0cWpVNG9mL0g4bk82cnFPM2NQaDI0cnAwdTZE
-QmVGUWcKSGJ3MUZLNjZqbWUrc0l5aEpHYWNyY0p5SWpGcGxqMG4rd1BaaG8vQUlD
+eUxiQzgKS3g3S2JOWnE3eVpweGEzczlHaFlSdG1jbTczOU51TjRoTG5KMExBMXdY
-OAotPiAsOTV1LWdyZWFzZSAoU3tAUUIgIjx1IEpeIHkmXU8KNlpiUC9ZNVR0a2Uw
+SQotPiAhLWdyZWFzZSBJfShjciQxIDpxayBiYyAiXk5FSzYKMlA5MEQ0VUo1UncK
-NHp5dC9oRUZQMWRPT2lMRHZXWUFMZjhVQW04NUlsNWd3YjRzc1h2bGQ1QmdEaDgK
+LS0tIEMzaFpMRGo5cTBMczBOeUMrSlhMWS85WVQ3UDRSeXM5RlJWS1dWR2VhTXcK
-LS0tIGk5dXBuV3hsOEUxUWtmbjFsTVNqUXdlaSthd0VBMFh1NkFYQ0hGZXhaOEEK
+a3qm9ASifZqqohCsRoGnW9ijFoy2bb1Myg/jaZBD1P9/2KQ4yHV92nap271Sq86R
-xLmozB0O+dnzu9y/M0BNrl+FrZlxFfZUTaGRpD4VhQF+xmA5JhRFDre0fflnBkZF
 -----END AGE ENCRYPTED FILE-----

services/postgresql/secrets/giteaDBPass.age

@@ -1,13 +1,13 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE9Xa1ZYdyB6K3RY
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE9Xa1ZYdyBhSllo
-Qy9yU0ZkVG9mSGRvOFQ5aUozNHNGVUpMTGUvOGU4US9yeWExaWtnCnkyTDlXQUE4
+UjhSeHFNangxcWVlQVR4NGJxRXU0cDB2NjdyU1FTUmZZcmg4ZUZZCjNJVjB3UnB2
-K01scktWMTJkWldUOTQzUUZNWHQrcHlNeElwVG1vL0hDQlUKLT4gc3NoLWVkMjU1
+dmhoRncrTTR1dURtbHVHeTByaWZwYTRha3dTWnZMRWdCVjAKLT4gc3NoLWVkMjU1
-MTkgc2luZ3ZRIE1qclVJYlQ3UHhXaE5ub3JWNDVUVTB4c0Y1c2NSSno2aDNkVCts
+MTkgc2luZ3ZRIERLL1l5R0VVWTRlMDNCYXpTb09zWWdhTmlLQTdIMVhPZXM0ZFdX
-S054RzAKclljZkJoSUhtUXp2dng2eDJlUkphMXRFbXJQdUxPYm1OTUtMQkxZaWcz
+N3VpeE0KUE9rWFNJL2dpK2VGMkNucTZWZDVqcGt5NlVkOXJ3amhybmFQR3ZVVjNP
-OAotPiAmbi1ncmVhc2UgU2NUIHluCnp4TjhnVk01OWRVZUJVMnlPNmlzNWNJZk5J
+VQotPiAubyNQcXtpfC1ncmVhc2UgKyRRTFl8VkkgZEgKRWFjTDdzL1ordGg0czFQ
-OHpsTnpGLzA4eE0zNitKSWF5d05BcEhjU0xCd2lRMXpLVXB1TlgKLzB2VFMzcmJo
+Q3NtWjdLK2tNVUhsaCtXZGxCRysxYjU1YTNDNDJnZHc2a0kyQVNGVjZOYndGYjBS
-aThSMDQrU0JaSWNUMVZnOXRUNlhDVVoyVkRRTndUS1pnMUhhSTQwKzdXVFIwTFFi
+ZApNM1JJQmE2WXpXaEJGcnNCbVk5WnQrMHdrMEgzMGRqL21WSGUzWFM0WlREVVdO
-NkdTYkZScQpaRHp6Ci0tLSBRVFlXSGpLYzd1QXNkRlJjdDFkejdyM1ZzelRIN05o
+T0Z4MUEKLS0tIGcxcVZWQWMzS0FlclNJYW9jSldoc3huUXl2eXVoQ1dzdVc5YVBa
-UkR4a3JTSWhIQlN3CtTJA3S9lKiHg1j+GiDIZtbLjWlnCQG6R8XbApPIWPPNm+wt
+aGRvcmsK9L6wCJ22CZeAuJQWW8t/i7M5ysRJJUjvzOAKvI+gO5G9hagP2t+qEK9e
-mtCq8RC9uHH+
+hvE=
 -----END AGE ENCRYPTED FILE-----

services/postgresql/secrets/grafanaDBPass.age

@@ -1,11 +1,11 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE9Xa1ZYdyBneXc1
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE9Xa1ZYdyBPTW1I
-enhZNFEwV0xNbWhqVTl0VlUvZ1E4V3RlZElDNEFTeUh5alFqdkg0CmxjV0d6QXJm
+Skp5c0oxTmk1VWRPM3ZuelNBblF2UkZOYWUvOGNXTGJPRGlISGxzCmhCVWlCSUZZ
-cXovM25wM1VHdG5wbVJhZytMUEpSU3VvYXUvaGpJTC9ocDgKLT4gc3NoLWVkMjU1
+UkR5RW5SWjN3SzlneXA5ZDJUL21LS2lXcndidmxnWUtpMlkKLT4gc3NoLWVkMjU1
-MTkgc2luZ3ZRIDY2OGJGUENPckxrcnNKMFlWNC8yOGgwUDJUcDMyS1VnSC93dXpw
+MTkgc2luZ3ZRIFN4MHplVDJZbEozMEtYZ3N2amZDdHpLTmpOUlhMNXUzMHZFSFRT
-UWo0U1kKbnQ1TUlZc2RrbTRuRmVhVlNwUVpBMkc3Ukl1dXR1RzNKK3ovUnR6UWln
+amhCMDgKMDUzc042UklCSUs4YUVTY2xjZUFaRlRBM09TTEhwQmNKQVA3YkgxZVly
-cwotPiBwSlU2ci1ncmVhc2UgPFRSdjkgKlAzUyBQYXhVN3MgQGwKMWdWOWYyRUFK
+OAotPiAraXswWVwlaS1ncmVhc2UgNGdhM30gZ0xHRE11KEYgM2pMPy8uTQptMWYy
-MC9ETEg0QgotLS0gZGtTdHVBbm9KeUxDYVUvQjlTb3Q5UllFb2F5YU5wUXhEc1Bs
+T2JMVTB0b29lNHpqN0dPdXNMZEtwTWtOb1dxQ2Q0S1c4WFpLVExaczQrNjhVTEJH
-RTJXaUI2RQoYkHT7kLqp50j9knk/D14UTvt0FJQO7NpmhISbCoeXQ+X9Y7td4P4J
+Ci0tLSA2MjUwM1pqWTZWd3RndHd6N3krenYyUkM4aDd2WFVsQVllZEg3S09ZSFlF
-s8VDQLEe
+CiDdh9xPzRx0vUkFn+5DHSXNOd3aF4DJHS2+Rc5bBvJsik+E9gBcBHN5eawHmJg=
 -----END AGE ENCRYPTED FILE-----

services/postgresql/secrets/nextcloudDBPass.age

@@ -1,11 +1,12 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE9Xa1ZYdyA4Wm9k
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE9Xa1ZYdyBicitL
-YlJJbUswNjcrQkVHdk0wc0g0ampYb1Mvbzd4Rk5IVW9ZS0RSTlZrCjdjK3BhYjdV
+VnR4WFh6TGZkZnhpZEZ1MFZjditqeXFzSXFOUW9ienhjdHFsam1JCnkvY254cmZN
-cWQ1NUh3bi9ZakxOajIxbDRST0FwQ0R0c3BHY1BGNXY5UHcKLT4gc3NoLWVkMjU1
+cTNYRDdtWUNHQkNmMzFCU1N1dllqQTdvTm4xamhvS2F6RjAKLT4gc3NoLWVkMjU1
-MTkgc2luZ3ZRIGtDSlZkUm5DTEpPdXJsTCtQSHA2ejdtRU9WU3ZJdGtaRVdScUNj
+MTkgc2luZ3ZRIHhDcERwWkl5QXgzamdlNlgrOXlMWkpSb0JWSUtSTmwraHFTdEwy
-TFg1VDAKcWs0S0s5REgreG5PZDZkM0lGQ0RBdDR3R2kwY2tmK1RmaWE0R2pJb05j
+U0Ixa2cKMS9zUVR1WDdDYlBic3RIbXd3d3JGVHlNVmVsRHY0elNWZ0o5aWVUazgw
-UQotPiA5OVMxUkVhXy1ncmVhc2UgK0xfdnUoOgpnbVFETkc1ZS81Kyt4U1NoOWJv
+ZwotPiAsSjwtZ3JlYXNlIF8xcCBKU3oKb1RoZnFyOENMWHQxSUlUS2xmN0RWQWxV
-L1NVM1BzeGdQRDg0Ci0tLSA3VnpKZTRBbWN6NGMxWnNobHVEdDUyRTJORTlabXRH
+UXFlTFhmdVZRVXY0ekJYQmRBWWxJYWovcW1EQjRHSHloWnRqaTEwTQpnZDNmMktm
-UllITmVGVHlrSGlNCoMnkbrU86Cjj6jnsZjSPwKIzLpdyzxYBQDxoj9mv139Rdae
+b2xWUFRFamtvTVRoYjJRYwotLS0gMlNvRC9nY1pTWWx1ZHlJMmE3ZkpQUGgrclAw
-bFLdtG8sIabo6hNIxg==
+bERjMVhMa1RpVzZwUHA3TQrcYKrxC2Ij+0RmtDozhBTBh3Th8NehZ+FUSl3Okyol
+XX4KB2lT5urYECGsan+HOKo=
 -----END AGE ENCRYPTED FILE-----

services/postgresql/secrets/onlyofficeDBPass.age

@@ -1,12 +1,11 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE9Xa1ZYdyBvWEZM
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE9Xa1ZYdyBuS0xp
-MTJGUzQ2a3Q2SE9QeE1hWUxDRmMvODhxRVFOQlcxaVYvZEFaNFRnCnZWME02QVlH
+Znc2ajhKemNNSFJpUDdvdFBVbW93SDFmaEpaRXBIck9PcXJxang4CnlzZzJ0MXdT
-TU1lUUt4TnhabzBkNGJVS2pxaytPY0tic1NRR29Ka0k5em8KLT4gc3NoLWVkMjU1
+V2U4Ykl4aTlydGRaeHIxRmZkVHg0dWpnV1dtOS9WdXkxZXcKLT4gc3NoLWVkMjU1
-MTkgc2luZ3ZRIDAvTVFwR3VOWUVpZk5xUkJsZW9CMVhzYkd1ejhwUHhGejNQc1hG
+MTkgc2luZ3ZRIDJnS0xoWFAvTVJXdnJBSDc2dis4bWcrTEhmdmE0aEJJZzFZSm1z
-eXVqbXcKM282Z3JlUS9yMURSa3lnaitpZ3NhMTVvamR4MGV2USttcmp1bDNEYXVP
+akU0Z3cKMGZNcG5ZNWVrdWVWQjhWQXVIL1RtcExBcFhJUU9pa2ZaOGdqaFdWc1pL
-bwotPiB7MHlWLWdyZWFzZSBqW2hxWm0/SSA2Klh8OyBOOiBtbFlTJjAKVkhZcFla
+YwotPiA3LWA2RXs7LWdyZWFzZSBESUoKd25SMDg0czBNcmRIb0JGVDRLdEZ5OGph
-VVdsbnRlRUI1bzdNWEJUNjNEdWpZY3JBWlduQUxrRU4xdG1kWU8zSjExbUd6UlNG
+eDJRZjJodXgKLS0tIExLTDlPSE1Kd0lXMlo5YzhpeEI4K3BDUGtrem41cFdsYTVz
-clZYQTVMVkNFNAp5dlcwZmhxQTNKN1h0dUhUM1prCi0tLSB1UXlaQUd3b1JkM29K
+QjQ3OWdJVjQKEnu24xPsxg8m+TYOsFp02Rv1lm61lwFsPgVEvfq+siEm2bvJiCut
-bjFJTVpzUTk1MjZIbEhmTkVXYlNtN3k0OW50TTJBCoB7YGQ+R1yzNbS9ZiTcgoZk
+LQBgsEpiyzvv
-LGeyAB/x+izkhu54XzrxpjQKeXAQftnHks6lzzqZ5w==
 -----END AGE ENCRYPTED FILE-----

systems/minimalLXCConfig.nix

@@ -98,12 +98,6 @@
       netcat-openbsd
     ];
   };
-  age.secrets = {
-    cs-lapi-key = {
-      file = ../secrets/cs-lapi-key.age;
-      owner = "crowdsec";
-    };
-  };
 
   services = {
     openssh = {
@@ -121,21 +115,6 @@
     fail2ban = {
       enable = true;
     };
-    crowdsec = {
-      enable = true;
-      package = pkgs.crowdsec;
-      autoUpdateService = false;
-      openFirewall = true;
-      settings = {
-        general = {
-          prometheus.listen_addr = "0.0.0.0";
-        };
-        lapi.credentialsFile = "${config.age.secrets.cs-lapi-key.path}";
-      };
-      hub.collections = [
-        "crowdsecurity/linux"
-      ];
-    };
     rsyslogd = {
       enable = true;
       extraConfig = "*.*@192.168.1.27:514;RSYSLOG_SyslogProtocol23Format";