foo

.editorconfig

@@ -10,4 +10,4 @@ charset = utf-8
 [*.nix]
 indent_style = space
 indent_size = 2
-
+insert_final_newline = false

.gitignore

@@ -1,7 +1,5 @@
-result
+# Created by https://www.toptal.com/developers/gitignore/api/linux,windows,macos,direnv,pycharm+all,vim
-
+# Edit at https://www.toptal.com/developers/gitignore?templates=linux,windows,macos,direnv,pycharm+all,vim
-# Created by https://www.toptal.com/developers/gitignore/api/linux,windows,macos,vim,direnv
-# Edit at https://www.toptal.com/developers/gitignore?templates=linux,windows,macos,vim,direnv,nix
 
 ### direnv ###
 .direnv
@@ -54,7 +52,93 @@ Temporary Items
 # iCloud generated files
 *.icloud
 
-#!! ERROR: nix is undefined. Use list command to see defined gitignore types !!#
+### PyCharm+all ###
+# Covers JetBrains IDEs: IntelliJ, RubyMine, PhpStorm, AppCode, PyCharm, CLion, Android Studio, WebStorm and Rider
+# Reference: https://intellij-support.jetbrains.com/hc/en-us/articles/206544839
+
+# User-specific stuff
+.idea/**/workspace.xml
+.idea/**/tasks.xml
+.idea/**/usage.statistics.xml
+.idea/**/dictionaries
+.idea/**/shelf
+
+# AWS User-specific
+.idea/**/aws.xml
+
+# Generated files
+.idea/**/contentModel.xml
+
+# Sensitive or high-churn files
+.idea/**/dataSources/
+.idea/**/dataSources.ids
+.idea/**/dataSources.local.xml
+.idea/**/sqlDataSources.xml
+.idea/**/dynamic.xml
+.idea/**/uiDesigner.xml
+.idea/**/dbnavigator.xml
+
+# Gradle
+.idea/**/gradle.xml
+.idea/**/libraries
+
+# Gradle and Maven with auto-import
+# When using Gradle or Maven with auto-import, you should exclude module files,
+# since they will be recreated, and may cause churn.  Uncomment if using
+# auto-import.
+# .idea/artifacts
+# .idea/compiler.xml
+# .idea/jarRepositories.xml
+# .idea/modules.xml
+# .idea/*.iml
+# .idea/modules
+# *.iml
+# *.ipr
+
+# CMake
+cmake-build-*/
+
+# Mongo Explorer plugin
+.idea/**/mongoSettings.xml
+
+# File-based project format
+*.iws
+
+# IntelliJ
+out/
+
+# mpeltonen/sbt-idea plugin
+.idea_modules/
+
+# JIRA plugin
+atlassian-ide-plugin.xml
+
+# Cursive Clojure plugin
+.idea/replstate.xml
+
+# SonarLint plugin
+.idea/sonarlint/
+
+# Crashlytics plugin (for Android Studio and IntelliJ)
+com_crashlytics_export_strings.xml
+crashlytics.properties
+crashlytics-build.properties
+fabric.properties
+
+# Editor-based Rest Client
+.idea/httpRequests
+
+# Android studio 3.1+ serialized cache file
+.idea/caches/build_file_checksums.ser
+
+### PyCharm+all Patch ###
+# Ignore everything but code style settings and run configurations
+# that are supposed to be shared within teams.
+
+.idea/*
+
+!.idea/codeStyles
+!.idea/runConfigurations
 
 ### Vim ###
 # Swap
@@ -102,4 +186,4 @@ $RECYCLE.BIN/
 # Windows shortcuts
 *.lnk
 
-# End of https://www.toptal.com/developers/gitignore/api/linux,windows,macos,vim,direnv,nix
+# End of https://www.toptal.com/developers/gitignore/api/linux,windows,macos,direnv,pycharm+all,vim

flake.lock

@@ -45,6 +45,24 @@
         "type": "github"
       }
     },
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems_2"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
     "home-manager": {
       "inputs": {
         "nixpkgs": [
@@ -68,16 +86,16 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1784432872,
+        "lastModified": 1789233862,
-        "narHash": "sha256-n3gKTBIV4ZA5VQpUakffBe3KGu4+mhPoA34rrqS0GkA=",
+        "narHash": "sha256-mka8SFIzRsHoxBh6LGCFizdp8N1B81clSSe3wzid6Yc=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "fd1462031fdee08f65fd0b4c6b64e22239a77870",
+        "rev": "6eb0f007b69f39ababe79d7025d8d0484553d163",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-26.05",
+        "ref": "nixos-26.05-small",
         "repo": "nixpkgs",
         "type": "github"
       }
@@ -85,6 +103,7 @@
     "root": {
       "inputs": {
         "agenix": "agenix",
+        "flake-utils": "flake-utils",
         "nixpkgs": "nixpkgs"
       }
     },
@@ -102,6 +121,21 @@
         "repo": "default",
         "type": "github"
       }
+    },
+    "systems_2": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
     }
   },
   "root": "root",

flake.nix

@@ -2,7 +2,7 @@
   description = "CCCB services";
   inputs = {
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05-small";
-    #flake-utils.url = "github:numtide/flake-utils";
+    flake-utils.url = "github:numtide/flake-utils";
     agenix = {
       url = "github:ryantm/agenix";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -12,313 +12,302 @@
     {
       self,
       nixpkgs,
-      #flake-utils,
+      flake-utils,
       agenix,
     }:
-    #flake-utils.lib.eachDefaultSystem (
+    flake-utils.lib.eachDefaultSystem (
-    #  system:
+      system:
-    let
+      let
-      pkgs = import nixpkgs { inherit system; };
+        pkgs = import nixpkgs { inherit system; };
-      system = "x86_64-linux";
+      in
-    in
+      {
-    {
+        formatter = pkgs.nixfmt-tree;
-      formatter.${system} = pkgs.nixfmt-tree;
+        apps = {
-      apps.${system} = {
+          nixos-diff = {
-        nixos-diff = {
+            meta.description = "Compare the current system with the configuration from the updated flake";
-          type = "app";
+            type = "app";
-          program = "${pkgs.writeShellScript "nixos-diff.sh" ''
+            program = "${pkgs.writeShellScript "nixos-diff.sh" ''
-            ${pkgs.git}/bin/git checkout flake.lock
+              ${pkgs.git}/bin/git checkout flake.lock
-            ${pkgs.git}/bin/git pull --ff-only
+              ${pkgs.git}/bin/git pull --ff-only
-            ${pkgs.nix}/bin/nix flake update
+              ${pkgs.nix}/bin/nix flake update
-            ${pkgs.nixos-rebuild}/bin/nixos-rebuild build --log-format internal-json -v |& ${pkgs.nix-output-monitor}/bin/nom --json
+              ${pkgs.nixos-rebuild}/bin/nixos-rebuild build --log-format internal-json -v |& ${pkgs.nix-output-monitor}/bin/nom --json
-            ${pkgs.nvd}/bin/nvd diff /run/current-system ./result
+              ${pkgs.nvd}/bin/nvd diff /run/current-system ./result
-          ''}";
+            ''}";
+          };
+          deploy = {
+            meta.description = "Deploy a NixOS configuration to a remote host";
+            type = "app";
+            program = "${pkgs.writeShellScript "deploy.sh" ''
+              set -e
+              host="''${1:?usage: nix run .#deploy -- <host>}"
+              ${pkgs.openssh}/bin/ssh -tt "$host" 'bash -s' <<'EOF'
+              set -e
+              cd /etc/nixos
+              nix run .#nixos-diff && nixos-rebuild switch
+              EOF
+            ''}";
+          };
         };
-        deploy = {
+        devShells.default = pkgs.mkShell {
-          type = "app";
+          packages = [
-          program = "${pkgs.writeShellScript "deploy.sh" ''
+            (agenix.packages.${system}.default)
-            set -e
+            pkgs.age
-            host="''${1:?usage: nix run .#apps.deploy -- <host>}"
+          ];
-            ${pkgs.openssh}/bin/ssh -t "$host" 'bash -s' <<'EOF'
-            set -e
-            cd /etc/nixos
-            nix run .#apps.nixos-diff && nixos-rebuild switch
-            EOF
-          ''}";
         };
-      };
+      }
-      devShells.${system}.default = pkgs.mkShell {
+    )
-        packages = [
+    // {
-          (agenix.packages.${system}.default)
+      nixosConfigurations = {
-          pkgs.age
+        matrix = nixpkgs.lib.nixosSystem {
-        ];
+          system = "x86_64-linux";
-      };
+          modules = [
-      nixosConfigurations."matrix" = nixpkgs.lib.nixosSystem {
+            agenix.nixosModules.default
-        #system = "x86_64-linux";d
+            { environment.systemPackages = [ (agenix.packages.x86_64-linux.default) ]; }
-        #pkgs = import nixpkgs { inherit system; };
+            {
-        inherit system;
+              age.secrets = {
-        modules = [
+                matrix_registration_shared_secret = {
-          agenix.nixosModules.default
+                  file = ./secrets/matrix_registration_shared_secret.age;
-          { environment.systemPackages = [ (agenix.packages.${system}.default) ]; }
+                  mode = "440";
-          {
+                  owner = "matrix-synapse";
-            age.secrets = {
+                  group = "matrix-synapse";
-              matrix_registration_shared_secret = {
+                };
-                file = ./secrets/matrix_registration_shared_secret.age;
+                matrix_signing_key = {
-                mode = "440";
+                  file = ./secrets/matrix_signing_key.age;
-                owner = "matrix-synapse";
+                  mode = "440";
-                group = "matrix-synapse";
+                  owner = "matrix-synapse";
+                  group = "matrix-synapse";
+                };
+                matrix_db_password = {
+                  file = ./secrets/matrix_db_password.age;
+                  mode = "440";
+                  owner = "matrix-synapse";
+                  group = "matrix-synapse";
+                };
+                draupnir_access_token = {
+                  file = ./secrets/draupnir_access_token.age;
+                  mode = "440";
+                  owner = "root";
+                  group = "root";
+                };
               };
-              matrix_signing_key = {
+            }
-                file = ./secrets/matrix_signing_key.age;
+            ./hosts/matrix
-                mode = "440";
+          ];
-                owner = "matrix-synapse";
+        };
-                group = "matrix-synapse";
+        md = nixpkgs.lib.nixosSystem {
-              };
+          system = "x86_64-linux";
-              matrix_db_password = {
+          modules = [
-                file = ./secrets/matrix_db_password.age;
+            agenix.nixosModules.default
-                mode = "440";
+            { environment.systemPackages = [ (agenix.packages.x86_64-linux.default) ]; }
-                owner = "matrix-synapse";
+            {
-                group = "matrix-synapse";
+              age.secrets.hedgedoc_db_password = {
-              };
+                file = ./secrets/hedgedoc_db_password.age;
-              draupnir_access_token = {
+                owner = "hedgedoc";
-                file = ./secrets/draupnir_access_token.age;
+                group = "hedgedoc";
-                mode = "440";
-                owner = "root";
-                group = "root";
-              };
-            };
-          }
-          ./hosts/matrix
-        ];
-      };
-      nixosConfigurations."md" = nixpkgs.lib.nixosSystem {
-        #system = "x86_64-linux";
-        #pkgs = import nixpkgs { inherit system; };
-        inherit system;
-        modules = [
-          agenix.nixosModules.default
-          { environment.systemPackages = [ (agenix.packages.${system}.default) ]; }
-          {
-            age.secrets.hedgedoc_db_password = {
-              file = ./secrets/hedgedoc_db_password.age;
-              owner = "hedgedoc";
-              group = "hedgedoc";
-              mode = "0440";
-            };
-          }
-          ./hosts/md
-        ];
-      };
-      nixosConfigurations."www" = nixpkgs.lib.nixosSystem {
-        #system = "x86_64-linux";
-        #pkgs = import nixpkgs { inherit system; };
-        inherit system;
-        modules = [
-          agenix.nixosModules.default
-          { environment.systemPackages = [ (agenix.packages.${system}.default) ]; }
-          {
-            age.secrets = {
-              www-staging-htpasswd = {
-                file = ./secrets/www-staging-htpasswd.age;
-                owner = "nginx";
-                group = "nginx";
                 mode = "0440";
               };
-              caldav-export-config = {
+            }
-                file = ./secrets/caldav-export-config.age;
+            ./hosts/md
-                owner = "root";
+          ];
-                group = "root";
+        };
-                mode = "0440";
+        www = nixpkgs.lib.nixosSystem {
+          system = "x86_64-linux";
+          modules = [
+            agenix.nixosModules.default
+            { environment.systemPackages = [ (agenix.packages.x86_64-linux.default) ]; }
+            {
+              age.secrets = {
+                www-staging-htpasswd = {
+                  file = ./secrets/www-staging-htpasswd.age;
+                  owner = "nginx";
+                  group = "nginx";
+                  mode = "0440";
+                };
+                caldav-export-config = {
+                  file = ./secrets/caldav-export-config.age;
+                  owner = "root";
+                  group = "root";
+                  mode = "0440";
+                };
               };
-            };
+            }
-          }
+            ./hosts/www
-          ./hosts/www
+          ];
-        ];
+        };
-      };
+        monitoring = nixpkgs.lib.nixosSystem {
-      nixosConfigurations."monitoring" = nixpkgs.lib.nixosSystem {
+          system = "x86_64-linux";
-        #system = "x86_64-linux";
+          modules = [
-        #pkgs = import nixpkgs { inherit system; };
+            agenix.nixosModules.default
-        inherit system;
+            { environment.systemPackages = [ (agenix.packages.x86_64-linux.default) ]; }
-        modules = [
+            {
-          agenix.nixosModules.default
+              age.secrets = {
-          { environment.systemPackages = [ (agenix.packages.${system}.default) ]; }
+                grafana_secret_key = {
-          {
+                  file = ./secrets/grafana_secret_key.age;
-            age.secrets = {
+                  mode = "440";
-              grafana_secret_key = {
+                  owner = "grafana";
-                file = ./secrets/grafana_secret_key.age;
+                  group = "grafana";
-                mode = "440";
+                };
-                owner = "grafana";
+                grafana_admin_password = {
-                group = "grafana";
+                  file = ./secrets/grafana_admin_password.age;
+                  mode = "440";
+                  owner = "grafana";
+                  group = "grafana";
+                };
+                grafana_basic_auth = {
+                  file = ./secrets/grafana_basic_auth.age;
+                  mode = "440";
+                  owner = "nginx";
+                  group = "nginx";
+                };
+                postgres-grafana = {
+                  file = ./secrets/postgres-grafana.age;
+                  mode = "440";
+                  owner = "grafana";
+                  group = "grafana";
+                };
+                pve-exporter = {
+                  file = ./secrets/pve-exporter.age;
+                  mode = "440";
+                  owner = "prometheus";
+                  group = "prometheus";
+                };
               };
-              grafana_admin_password = {
+            }
-                file = ./secrets/grafana_admin_password.age;
+            ./hosts/monitoring
-                mode = "440";
+          ];
-                owner = "grafana";
+        };
-                group = "grafana";
+        sql = nixpkgs.lib.nixosSystem {
+          system = "x86_64-linux";
+          modules = [
+            agenix.nixosModules.default
+            { environment.systemPackages = [ (agenix.packages.x86_64-linux.default) ]; }
+            {
+              age.secrets = {
+                postgres-matrix-synapse = {
+                  file = ./secrets/postgres-matrix-synapse.age;
+                  owner = "postgres";
+                  group = "postgres";
+                  mode = "0400";
+                };
+                postgres-hedgedoc = {
+                  file = ./secrets/postgres-hedgedoc.age;
+                  owner = "postgres";
+                  group = "postgres";
+                  mode = "0400";
+                };
+                postgres-grafana = {
+                  file = ./secrets/postgres-grafana.age;
+                  owner = "postgres";
+                  group = "postgres";
+                  mode = "0400";
+                };
+                postgres-forgejo = {
+                  file = ./secrets/postgres-forgejo.age;
+                  owner = "postgres";
+                  group = "postgres";
+                  mode = "0400";
+                };
+                postgres-baikal = {
+                  file = ./secrets/postgres-baikal.age;
+                  owner = "postgres";
+                  group = "postgres";
+                  mode = "0400";
+                };
               };
-              grafana_basic_auth = {
+            }
-                file = ./secrets/grafana_basic_auth.age;
+            ./hosts/sql
-                mode = "440";
+          ];
-                owner = "nginx";
+        };
-                group = "nginx";
+        dav = nixpkgs.lib.nixosSystem {
+          system = "x86_64-linux";
+          modules = [
+            agenix.nixosModules.default
+            { environment.systemPackages = [ (agenix.packages.x86_64-linux.default) ]; }
+            {
+              age.secrets = {
+                #radicale-htpasswd = {
+                #  file = ./secrets/radicale_htpasswd.age;
+                #  owner = "radicale";
+                #  group = "radicale";
+                #  mode = "0400";
+                #};
               };
-              postgres-grafana = {
+            }
-                file = ./secrets/postgres-grafana.age;
+            ./hosts/dav
-                mode = "440";
+          ];
-                owner = "grafana";
+        };
-                group = "grafana";
+        git = nixpkgs.lib.nixosSystem {
+          system = "x86_64-linux";
+          modules = [
+            agenix.nixosModules.default
+            { environment.systemPackages = [ (agenix.packages.x86_64-linux.default) ]; }
+            {
+              age.secrets = {
+                postgres-forgejo = {
+                  file = ./secrets/postgres-forgejo.age;
+                  owner = "forgejo";
+                  group = "forgejo";
+                  mode = "0400";
+                };
+                forgejo-internal-token = {
+                  file = ./secrets/forgejo-internal-token.age;
+                  owner = "forgejo";
+                  group = "forgejo";
+                  mode = "0440";
+                };
+                forgejo-secret-key = {
+                  file = ./secrets/forgejo-secret-key.age;
+                  owner = "forgejo";
+                  group = "forgejo";
+                  mode = "0440";
+                };
+                forgejo-oauth2-jwt-secret = {
+                  file = ./secrets/forgejo-oauth2-jwt-secret.age;
+                  owner = "forgejo";
+                  group = "forgejo";
+                  mode = "0440";
+                };
+                forgejo-runner-token-snowden = {
+                  file = ./secrets/forgejo-runner-token-snowden.age;
+                  owner = "root";
+                  group = "root";
+                  mode = "0444";
+                };
+                forgejo-runner-token-snowden-env = {
+                  file = ./secrets/forgejo-runner-token-snowden-env.age;
+                  owner = "root";
+                  group = "root";
+                  mode = "0444";
+                };
               };
-              pve-exporter = {
+            }
-                file = ./secrets/pve-exporter.age;
+            ./hosts/git
-                mode = "440";
+          ];
-                owner = "prometheus";
+        };
-                group = "prometheus";
+        forgejo-runner = nixpkgs.lib.nixosSystem {
+          system = "x86_64-linux";
+          modules = [
+            agenix.nixosModules.default
+            { environment.systemPackages = [ (agenix.packages.x86_64-linux.default) ]; }
+            {
+              age.secrets = {
+                forgejo-runner-token = {
+                  file = ./secrets/forgejo-runner-token-snowden.age;
+                  owner = "root";
+                  group = "root";
+                  mode = "0444";
+                };
+                forgejo-runner-token-env = {
+                  file = ./secrets/forgejo-runner-token-snowden-env.age;
+                  owner = "root";
+                  group = "root";
+                  mode = "0444";
+                };
               };
-            };
+            }
-          }
+            ./hosts/forgejo-runner
-          ./hosts/monitoring
+          ];
-        ];
+        };
-      };
-      nixosConfigurations."sql" = nixpkgs.lib.nixosSystem {
-        #system = "x86_64-linux";
-        #pkgs = import nixpkgs { inherit system; };
-        inherit system;
-        modules = [
-          agenix.nixosModules.default
-          { environment.systemPackages = [ (agenix.packages.${system}.default) ]; }
-          {
-            age.secrets = {
-              postgres-matrix-synapse = {
-                file = ./secrets/postgres-matrix-synapse.age;
-                owner = "postgres";
-                group = "postgres";
-                mode = "0400";
-              };
-              postgres-hedgedoc = {
-                file = ./secrets/postgres-hedgedoc.age;
-                owner = "postgres";
-                group = "postgres";
-                mode = "0400";
-              };
-              postgres-grafana = {
-                file = ./secrets/postgres-grafana.age;
-                owner = "postgres";
-                group = "postgres";
-                mode = "0400";
-              };
-              postgres-forgejo = {
-                file = ./secrets/postgres-forgejo.age;
-                owner = "postgres";
-                group = "postgres";
-                mode = "0400";
-              };
-              postgres-baikal = {
-                file = ./secrets/postgres-baikal.age;
-                owner = "postgres";
-                group = "postgres";
-                mode = "0400";
-              };
-            };
-          }
-          ./hosts/sql
-        ];
-      };
-      nixosConfigurations."dav" = nixpkgs.lib.nixosSystem {
-        #system = "x86_64-linux";
-        #pkgs = import nixpkgs { inherit system; };
-        inherit system;
-        modules = [
-          agenix.nixosModules.default
-          { environment.systemPackages = [ (agenix.packages.${system}.default) ]; }
-          {
-            age.secrets = {
-              #radicale-htpasswd = {
-              #  file = ./secrets/radicale_htpasswd.age;
-              #  owner = "radicale";
-              #  group = "radicale";
-              #  mode = "0400";
-              #};
-            };
-          }
-          ./hosts/dav
-        ];
-      };
-      nixosConfigurations."git" = nixpkgs.lib.nixosSystem {
-        #system = "x86_64-linux";
-        #pkgs = import nixpkgs { inherit system; };
-        inherit system;
-        modules = [
-          agenix.nixosModules.default
-          { environment.systemPackages = [ (agenix.packages.${system}.default) ]; }
-          {
-            age.secrets = {
-              postgres-forgejo = {
-                file = ./secrets/postgres-forgejo.age;
-                owner = "forgejo";
-                group = "forgejo";
-                mode = "0400";
-              };
-              forgejo-internal-token = {
-                file = ./secrets/forgejo-internal-token.age;
-                owner = "forgejo";
-                group = "forgejo";
-                mode = "0440";
-              };
-              forgejo-secret-key = {
-                file = ./secrets/forgejo-secret-key.age;
-                owner = "forgejo";
-                group = "forgejo";
-                mode = "0440";
-              };
-              forgejo-oauth2-jwt-secret = {
-                file = ./secrets/forgejo-oauth2-jwt-secret.age;
-                owner = "forgejo";
-                group = "forgejo";
-                mode = "0440";
-              };
-              forgejo-runner-token-snowden = {
-                file = ./secrets/forgejo-runner-token-snowden.age;
-                owner = "root";
-                group = "root";
-                mode = "0444";
-              };
-              forgejo-runner-token-snowden-env = {
-                file = ./secrets/forgejo-runner-token-snowden-env.age;
-                owner = "root";
-                group = "root";
-                mode = "0444";
-              };
-            };
-          }
-          ./hosts/git
-        ];
-      };
-      nixosConfigurations."forgejo-runner" = nixpkgs.lib.nixosSystem {
-        #system = "x86_64-linux";
-        #pkgs = import nixpkgs { inherit system; };
-        inherit system;
-        modules = [
-          agenix.nixosModules.default
-          { environment.systemPackages = [ (agenix.packages.${system}.default) ]; }
-          {
-            age.secrets = {
-              forgejo-runner-token = {
-                file = ./secrets/forgejo-runner-token-snowden.age;
-                owner = "root";
-                group = "root";
-                mode = "0444";
-              };
-              forgejo-runner-token-env = {
-                file = ./secrets/forgejo-runner-token-snowden-env.age;
-                owner = "root";
-                group = "root";
-                mode = "0444";
-              };
-            };
-          }
-          ./hosts/forgejo-runner
-        ];
       };
     };
-  #);
 }