From 67c183f6123903274f26189fd6205d5a7b8a42df Mon Sep 17 00:00:00 2001
From: "Ricardo (XenGi) Band" <email@ricardo.band>
Date: Wed, 12 Aug 2026 02:10:01 +0200
Subject: [PATCH 01/11] fix calendar in staging

---
 hosts/www/nginx.nix | 27 +++++++++++++++++++++------
 1 file changed, 21 insertions(+), 6 deletions(-)

diff --git a/hosts/www/nginx.nix b/hosts/www/nginx.nix
index c84f18c..f957fdd 100644
--- a/hosts/www/nginx.nix
+++ b/hosts/www/nginx.nix
@@ -78,7 +78,7 @@ in
           '';
         };
         "/all.ics" = {
-          return = "301 https://www.berlin.ccc.de/calendars/all.ics";
+          return = "301 https://www.${config.networking.domain}/calendars/all.ics";
         };
         "~ ^/calendars/([^/]+\.ics)$" = {
           alias = "/srv/http/calendars/$1";
@@ -97,11 +97,26 @@ in
       kTLS = true;
       forceSSL = true;
       enableACME = true;
-      locations."/" = {
-        basicAuthFile = config.age.secrets.www-staging-htpasswd.path;
-        root = "/srv/http/www-staging";
-        index = "index.html";
-        tryFiles = "$uri $uri/ $uri.html =404";
+      locations = {
+        "/" = {
+          basicAuthFile = config.age.secrets.www-staging-htpasswd.path;
+          root = "/srv/http/www-staging";
+          index = "index.html";
+          tryFiles = "$uri $uri/ $uri.html =404";
+        };
+        "/all.ics" = {
+          return = "301 https://staging.${config.networking.domain}/calendars/all.ics";
+        };
+        "~ ^/calendars/([^/]+\.ics)$" = {
+          alias = "/srv/http/calendars/$1";
+          extraConfig = ''
+            add_header Cache-Control "no-cache";
+            types {
+              text/calendar ics;
+            }
+            default_type text/calendar;
+          '';
+        };
       };
     };
   };

From 1a3aeafc0c574bae594b0e08e120992781a4a8e9 Mon Sep 17 00:00:00 2001
From: "Ricardo (XenGi) Band" <email@ricardo.band>
Date: Wed, 12 Aug 2026 02:18:41 +0200
Subject: [PATCH 02/11] add CORS

---
 hosts/www/nginx.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/hosts/www/nginx.nix b/hosts/www/nginx.nix
index f957fdd..50d6d70 100644
--- a/hosts/www/nginx.nix
+++ b/hosts/www/nginx.nix
@@ -83,6 +83,9 @@ in
         "~ ^/calendars/([^/]+\.ics)$" = {
           alias = "/srv/http/calendars/$1";
           extraConfig = ''
+            if ($http_origin ~ '^https://(www\.)?berlin\.ccc\.de$') {
+              add_header Access-Control-Allow-Origin $http_origin always;
+            }
             add_header Cache-Control "no-cache";
             types {
               text/calendar ics;

From 209acd0a3e40540058d4456c4d23cd858eec7c30 Mon Sep 17 00:00:00 2001
From: "Ricardo (XenGi) Band" <email@ricardo.band>
Date: Wed, 12 Aug 2026 02:20:48 +0200
Subject: [PATCH 03/11] remove CORS

---
 hosts/www/nginx.nix | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/hosts/www/nginx.nix b/hosts/www/nginx.nix
index 50d6d70..f957fdd 100644
--- a/hosts/www/nginx.nix
+++ b/hosts/www/nginx.nix
@@ -83,9 +83,6 @@ in
         "~ ^/calendars/([^/]+\.ics)$" = {
           alias = "/srv/http/calendars/$1";
           extraConfig = ''
-            if ($http_origin ~ '^https://(www\.)?berlin\.ccc\.de$') {
-              add_header Access-Control-Allow-Origin $http_origin always;
-            }
             add_header Cache-Control "no-cache";
             types {
               text/calendar ics;

From 3ead0723b8e7186c6da185bac033d5d274077639 Mon Sep 17 00:00:00 2001
From: "Ricardo (XenGi) Band" <email@ricardo.band>
Date: Wed, 12 Aug 2026 02:23:58 +0200
Subject: [PATCH 04/11] fix redir

---
 hosts/www/nginx.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hosts/www/nginx.nix b/hosts/www/nginx.nix
index f957fdd..f8afa8e 100644
--- a/hosts/www/nginx.nix
+++ b/hosts/www/nginx.nix
@@ -78,7 +78,7 @@ in
           '';
         };
         "/all.ics" = {
-          return = "301 https://www.${config.networking.domain}/calendars/all.ics";
+          return = "301 https://$host/calendars/all.ics";
         };
         "~ ^/calendars/([^/]+\.ics)$" = {
           alias = "/srv/http/calendars/$1";
@@ -105,7 +105,7 @@ in
           tryFiles = "$uri $uri/ $uri.html =404";
         };
         "/all.ics" = {
-          return = "301 https://staging.${config.networking.domain}/calendars/all.ics";
+          return = "301 https://$host/calendars/all.ics";
         };
         "~ ^/calendars/([^/]+\.ics)$" = {
           alias = "/srv/http/calendars/$1";

From 7b628ebe041a88477cacaf9f068bab695199fedf Mon Sep 17 00:00:00 2001
From: "Ricardo (XenGi) Band" <email@ricardo.band>
Date: Thu, 13 Aug 2026 16:46:44 +0200
Subject: [PATCH 05/11] add missing token

---
 flake.nix | 38 +++++++++++++++++++++++++++++---------
 1 file changed, 29 insertions(+), 9 deletions(-)

diff --git a/flake.nix b/flake.nix
index c03d5d2..9ecce5a 100644
--- a/flake.nix
+++ b/flake.nix
@@ -23,15 +23,29 @@
     in
     {
       formatter.${system} = pkgs.nixfmt-tree;
-      apps.nixos-diff = {
-        type = "app";
-        program = "${pkgs.writeShellScript "nixos-diff.sh" ''
-          ${pkgs.git}/bin/git checkout flake.lock
-          ${pkgs.git}/bin/git pull --ff-only
-          ${pkgs.nix}/bin/nix flake update
-          ${pkgs.nixos-rebuild}/bin/nixos-rebuild build --log-format internal-json -v |& ${pkgs.nix-output-monitor}/bin/nom --json
-          ${pkgs.nvd}/bin/nvd diff /run/current-system ./result
-        ''}";
+      apps = {
+        nixos-diff = {
+          type = "app";
+          program = "${pkgs.writeShellScript "nixos-diff.sh" ''
+            ${pkgs.git}/bin/git checkout flake.lock
+            ${pkgs.git}/bin/git pull --ff-only
+            ${pkgs.nix}/bin/nix flake update
+            ${pkgs.nixos-rebuild}/bin/nixos-rebuild build --log-format internal-json -v |& ${pkgs.nix-output-monitor}/bin/nom --json
+            ${pkgs.nvd}/bin/nvd diff /run/current-system ./result
+          ''}";
+        };
+        deploy = {
+          type = "app";
+          program = "${pkgs.writeShellScript "deploy.sh" ''
+            set -e
+            host="''${1:?usage: nix run .#apps.deploy -- <host>}"
+            ${pkgs.openssh}/bin/ssh -t "$host" 'bash -s' <<'EOF'
+            set -e
+            cd /etc/nixos
+            nix run .#apps.nixos-diff && nixos-rebuild switch
+            EOF
+          ''}";
+        };
       };
       devShells.${system}.default = pkgs.mkShell {
         packages = [
@@ -256,6 +270,12 @@
                 group = "forgejo";
                 mode = "0440";
               };
+              forgejo-oauth2-jwt-token = {
+                file = ./secrets/forgejo-oauth2-jwt-token.age;
+                owner = "forgejo";
+                group = "forgejo";
+                mode = "0440";
+              };
               forgejo-runner-token-snowden = {
                 file = ./secrets/forgejo-runner-token-snowden.age;
                 owner = "root";

From d6c730f5156d4f255917ffc38935f0830bba605b Mon Sep 17 00:00:00 2001
From: "Ricardo (XenGi) Band" <email@ricardo.band>
Date: Thu, 13 Aug 2026 16:47:45 +0200
Subject: [PATCH 06/11] fix secret

---
 hosts/git/forgejo.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hosts/git/forgejo.nix b/hosts/git/forgejo.nix
index 523f3d8..c35b604 100644
--- a/hosts/git/forgejo.nix
+++ b/hosts/git/forgejo.nix
@@ -23,7 +23,7 @@ in
           SECRET_KEY = lib.mkDefault config.age.secrets.forgejo-secret-key.path;
           INTERNAL_TOKEN = lib.mkDefault config.age.secrets.forgejo-internal-token.path;
         };
-        oauth2.JWT_SECRET = config.age.secrets.forgejo-oauth2-jwt-token.path;
+        oauth2.JWT_SECRET = lib.mkDefault config.age.secrets.forgejo-oauth2-jwt-token.path;
       };
       settings = {
         security.GLOBAL_TWO_FACTOR_REQUIREMENT = "all";

From 92d7055072384e5b8de773f30beb4b07b3b2420a Mon Sep 17 00:00:00 2001
From: "Ricardo (XenGi) Band" <email@ricardo.band>
Date: Thu, 13 Aug 2026 16:49:25 +0200
Subject: [PATCH 07/11] fix secret

---
 flake.nix             | 4 ++--
 hosts/git/forgejo.nix | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/flake.nix b/flake.nix
index 9ecce5a..ee607cc 100644
--- a/flake.nix
+++ b/flake.nix
@@ -270,8 +270,8 @@
                 group = "forgejo";
                 mode = "0440";
               };
-              forgejo-oauth2-jwt-token = {
-                file = ./secrets/forgejo-oauth2-jwt-token.age;
+              forgejo-oauth2-jwt-secret = {
+                file = ./secrets/forgejo-oauth2-jwt-secret.age;
                 owner = "forgejo";
                 group = "forgejo";
                 mode = "0440";
diff --git a/hosts/git/forgejo.nix b/hosts/git/forgejo.nix
index c35b604..0235292 100644
--- a/hosts/git/forgejo.nix
+++ b/hosts/git/forgejo.nix
@@ -23,7 +23,7 @@ in
           SECRET_KEY = lib.mkDefault config.age.secrets.forgejo-secret-key.path;
           INTERNAL_TOKEN = lib.mkDefault config.age.secrets.forgejo-internal-token.path;
         };
-        oauth2.JWT_SECRET = lib.mkDefault config.age.secrets.forgejo-oauth2-jwt-token.path;
+        oauth2.JWT_SECRET = lib.mkDefault config.age.secrets.forgejo-oauth2-jwt-secret.path;
       };
       settings = {
         security.GLOBAL_TWO_FACTOR_REQUIREMENT = "all";

From e1cf8570656d974abc2402231e1bdfd89f857601 Mon Sep 17 00:00:00 2001
From: "Ricardo (XenGi) Band" <email@ricardo.band>
Date: Thu, 13 Aug 2026 16:56:22 +0200
Subject: [PATCH 08/11] fix sshd

---
 hosts/git/default.nix |  2 +-
 hosts/git/forgejo.nix |  6 ------
 hosts/git/openssh.nix | 14 ++++++++++++++
 3 files changed, 15 insertions(+), 7 deletions(-)
 create mode 100644 hosts/git/openssh.nix

diff --git a/hosts/git/default.nix b/hosts/git/default.nix
index 5ccac8b..0788cce 100644
--- a/hosts/git/default.nix
+++ b/hosts/git/default.nix
@@ -3,7 +3,7 @@
 {
   imports = [
     ../common.nix
-    ../../services/openssh.nix
+    ./openssh.nix
     ../../services/prometheus-node.nix
     ./forgejo.nix
     #./forgejo-runner.nix
diff --git a/hosts/git/forgejo.nix b/hosts/git/forgejo.nix
index 0235292..f48ec7f 100644
--- a/hosts/git/forgejo.nix
+++ b/hosts/git/forgejo.nix
@@ -78,12 +78,6 @@ in
       };
     };
 
-    openssh.extraConfig = ''
-      Match User forgejo
-        AcceptEnv GIT_PROTOCOL
-        PerSourcePenalties no
-    '';
-
     nginx.virtualHosts."${fqdn}" = {
       quic = true;
       kTLS = true;
diff --git a/hosts/git/openssh.nix b/hosts/git/openssh.nix
new file mode 100644
index 0000000..bc983a9
--- /dev/null
+++ b/hosts/git/openssh.nix
@@ -0,0 +1,14 @@
+{ ... }:
+
+{
+  imports = [ ../../services/openssh.nix ];
+
+  services.openssh = {
+    settings.PerSourcePenalties = false;
+    extraConfig = ''
+      Match User forgejo
+        AcceptEnv GIT_PROTOCOL
+    '';
+  };
+}
+

From ef81fe1809fd754dabf4f9696e9d84bab258b682 Mon Sep 17 00:00:00 2001
From: "Ricardo (XenGi) Band" <email@ricardo.band>
Date: Thu, 13 Aug 2026 17:05:03 +0200
Subject: [PATCH 09/11] fix sshd

---
 hosts/git/default.nix |  2 +-
 hosts/git/openssh.nix | 14 --------------
 2 files changed, 1 insertion(+), 15 deletions(-)
 delete mode 100644 hosts/git/openssh.nix

diff --git a/hosts/git/default.nix b/hosts/git/default.nix
index 0788cce..5ccac8b 100644
--- a/hosts/git/default.nix
+++ b/hosts/git/default.nix
@@ -3,7 +3,7 @@
 {
   imports = [
     ../common.nix
-    ./openssh.nix
+    ../../services/openssh.nix
     ../../services/prometheus-node.nix
     ./forgejo.nix
     #./forgejo-runner.nix
diff --git a/hosts/git/openssh.nix b/hosts/git/openssh.nix
deleted file mode 100644
index bc983a9..0000000
--- a/hosts/git/openssh.nix
+++ /dev/null
@@ -1,14 +0,0 @@
-{ ... }:
-
-{
-  imports = [ ../../services/openssh.nix ];
-
-  services.openssh = {
-    settings.PerSourcePenalties = false;
-    extraConfig = ''
-      Match User forgejo
-        AcceptEnv GIT_PROTOCOL
-    '';
-  };
-}
-

From d60d2f7276d0f230dbeecdcb56610b5edb34cfec Mon Sep 17 00:00:00 2001
From: "Ricardo (XenGi) Band" <email@ricardo.band>
Date: Tue, 18 Aug 2026 19:13:59 +0200
Subject: [PATCH 10/11] disable 2fa requirement

---
 hosts/git/forgejo.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/hosts/git/forgejo.nix b/hosts/git/forgejo.nix
index f48ec7f..60af999 100644
--- a/hosts/git/forgejo.nix
+++ b/hosts/git/forgejo.nix
@@ -26,7 +26,6 @@ in
         oauth2.JWT_SECRET = lib.mkDefault config.age.secrets.forgejo-oauth2-jwt-secret.path;
       };
       settings = {
-        security.GLOBAL_TWO_FACTOR_REQUIREMENT = "all";
         session.COOKIE_SECURE = true;
         log.LEVEL = "Warn";
         server = {

From ee0fea854cb80fcfc8e143895840fc719e3e0efe Mon Sep 17 00:00:00 2001
From: "Ricardo (XenGi) Band" <email@ricardo.band>
Date: Tue, 18 Aug 2026 19:14:42 +0200
Subject: [PATCH 11/11] fix state version

---
 hosts/git/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hosts/git/default.nix b/hosts/git/default.nix
index 5ccac8b..3d01d5c 100644
--- a/hosts/git/default.nix
+++ b/hosts/git/default.nix
@@ -40,5 +40,5 @@
   '';
   services.openssh.settings.Banner = "/etc/ssh/banner";
 
-  system.stateVersion = "25.11";
+  system.stateVersion = "26.05";
 }