move old hosts to single file

flake.lock

@@ -9,11 +9,11 @@
         "utils": "utils"
       },
       "locked": {
-        "lastModified": 1788879443,
+        "lastModified": 1789404474,
-        "narHash": "sha256-qb9sL86UCUEd3SYAda4ItN1NV0vhMSdbpA64WckvVI0=",
+        "narHash": "sha256-UXFQ7tFiwn8sPz0EV4CBB2PCf/ZiGIHWn/6MXk81Lxs=",
         "owner": "serokell",
         "repo": "deploy-rs",
-        "rev": "414ac5f35d79aabe5a0bf52451d8cf61eadf6c88",
+        "rev": "e760371d631165e7d8de5b0dcf148e21ec4c16f0",
         "type": "github"
       },
       "original": {
@@ -22,23 +22,6 @@
         "type": "github"
       }
     },
-    "disko": {
-      "inputs": {
-        "nixpkgs": "nixpkgs"
-      },
-      "locked": {
-        "lastModified": 1781152676,
-        "narHash": "sha256-RxWs5ND31KzTG7wvMM+PMfUjyNpmIEr999lqNARaM5o=",
-        "owner": "nix-community",
-        "repo": "disko",
-        "rev": "ff8702b4de27f72b4c78573dfb89ec74e36abdf1",
-        "type": "github"
-      },
-      "original": {
-        "id": "disko",
-        "type": "indirect"
-      }
-    },
     "flake-compat": {
       "flake": false,
       "locked": {
@@ -79,11 +62,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1789182507,
+        "lastModified": 1789267039,
-        "narHash": "sha256-9nt4W0HNNP84B+b37yRs9Zxat1ZR5guJxEZDEjAgex4=",
+        "narHash": "sha256-LWiBv9yAYFi2LPbUhDGHPGKYskJQjj2fw12OlyO1uQo=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "b1d1b60084970f9d1e2b72662639dab6d039be71",
+        "rev": "ec172013fa62135f58fb58dd17ae9651e8f39727",
         "type": "github"
       },
       "original": {
@@ -95,27 +78,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1780930886,
+        "lastModified": 1789998861,
-        "narHash": "sha256-rppURzHviaQN131F+nLiLdGfcb0uCd9gGP0E5+iw9MI=",
+        "narHash": "sha256-62XMQD4WLdMAfdT0/8gJmPH2dKeTw908ryNloAplTr8=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "8c3cede7ddc26bd659d2d383b5610efbd2c7a16e",
+        "rev": "1e8bc658fc985ef27ccd66d107d767b32bb7ef98",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixpkgs-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_2": {
-      "locked": {
-        "lastModified": 1789114715,
-        "narHash": "sha256-ugpsyk3NM2s87vXfUiIIiibbJ4Pp0JPS5p/3mfs+q+c=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "21a67dc470149f337cecafbe965d8d252a390518",
         "type": "github"
       },
       "original": {
@@ -125,47 +92,12 @@
         "type": "github"
       }
     },
-    "nixpkgs_3": {
-      "locked": {
-        "lastModified": 1782175435,
-        "narHash": "sha256-EMzXKmnOtBQ2MnvpiNOm7E+kOMvdPrIKaeg52Tip2Uk=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "89570f24e97e614aa34aa9ab1c927b6578a43775",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixpkgs-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
     "root": {
       "inputs": {
         "deploy-rs": "deploy-rs",
-        "disko": "disko",
         "grasswren": "grasswren",
         "home-manager": "home-manager",
-        "nixpkgs": "nixpkgs_2",
+        "nixpkgs": "nixpkgs"
-        "sops-nix": "sops-nix"
-      }
-    },
-    "sops-nix": {
-      "inputs": {
-        "nixpkgs": "nixpkgs_3"
-      },
-      "locked": {
-        "lastModified": 1788914643,
-        "narHash": "sha256-4GuMPW90JSxXWDPUB9M+1m7fYbe3H0apOd86/zBQ2Kw=",
-        "owner": "Mic92",
-        "repo": "sops-nix",
-        "rev": "13616fff713a9f94055c66f15687ebdc17a335df",
-        "type": "github"
-      },
-      "original": {
-        "id": "sops-nix",
-        "type": "indirect"
       }
     },
     "systems": {

flake.nix

@@ -12,7 +12,7 @@
     grasswren.flake = false;
   };
 
-  outputs = inputs@{ self, nixpkgs, deploy-rs, disko, home-manager, sops-nix, grasswren, ... }: 
+  outputs = inputs@{ self, nixpkgs, deploy-rs, home-manager, grasswren, ... }: 
   {
     nixosConfigurations = {
       laptop = nixpkgs.lib.nixosSystem {
@@ -20,7 +20,7 @@
         specialArgs = { inherit inputs; };
         modules = [
           home-manager.nixosModules.home-manager
-          ./hosts/laptop/default.nix
+          ./hosts/laptop.nix
         ];
       };
 
@@ -29,7 +29,7 @@
         specialArgs = { inherit inputs; };
         modules = [
           home-manager.nixosModules.home-manager
-          ./hosts/desktop/default.nix
+          ./hosts/desktop.nix
         ];
       };
 
@@ -38,7 +38,7 @@
         specialArgs = { inherit inputs; };
         modules = [
           home-manager.nixosModules.home-manager
-          ./hosts/vps/default.nix
+          ./hosts/vps.nix
         ];
       };
 
@@ -47,7 +47,7 @@
         specialArgs = { inherit inputs; };
         modules = [
           home-manager.nixosModules.home-manager
-          ./hosts/backup/default.nix
+          ./hosts/backup.nix
         ];
       };
     };

hosts/backup.nix

@@ -0,0 +1,102 @@
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+
+    ../modules/backup-server.nix
+    ../modules/ssh.nix
+
+    ../lilac.nix
+  ];
+
+  networking.hostName = "backup";
+
+  time.timeZone = "America/Winnipeg";
+
+  systemd.sleep.settings.Sleep = {
+    AllowSuspend = "no";
+    AllowHibernation = "no";
+    AllowHybridSleep = "no";
+    AllowSuspendThenHibernate = "no";
+  };
+
+  i18n.defaultLocale = "en_US.UTF-8";
+  i18n.extraLocaleSettings = {
+    LC_ADDRESS = "en_US.UTF-8";
+    LC_IDENTIFICATION = "en_US.UTF-8";
+    LC_MEASUREMENT = "en_US.UTF-8";
+    LC_MONETARY = "en_US.UTF-8";
+    LC_NAME = "en_US.UTF-8";
+    LC_NUMERIC = "en_US.UTF-8";
+    LC_PAPER = "en_US.UTF-8";
+    LC_TELEPHONE = "en_US.UTF-8";
+    LC_TIME = "en_US.UTF-8";
+  };
+
+  services.xserver.enable = true;
+  services.displayManager.sddm.enable = true;
+  services.desktopManager.plasma6.enable = true;
+  services.xserver.xkb = {
+    layout = "us";
+    variant = "";
+  };
+
+  services.pulseaudio.enable = false;
+  security.rtkit.enable = true;
+  services.pipewire = {
+    enable = true;
+    alsa.enable = true;
+    alsa.support32Bit = true;
+    pulse.enable = true;
+  };
+
+  networking.wireless.enable = true;
+  networking.networkmanager.enable = true;
+
+  networking = {
+    firewall = {
+      enable = true;
+      allowedUDPPorts = [ 51820 ];
+      trustedInterfaces = [ "wg0" ];
+    };
+
+    wireguard.interfaces."wg0" = {
+      ips = [ "10.0.0.4/32" ];
+      generatePrivateKeyFile = true;
+      privateKeyFile = "/var/lib/wireguard/wg0.key";
+      peers = [{
+        publicKey = "Tst6SiqoGLSoOAF9l5vT2vvR2RGJ/mFcoBL3BL5n90k=";
+        allowedIPs = [ "10.0.0.0/24" ];
+        endpoint = "216.128.177.13:51820";
+        persistentKeepalive = 25;
+      }];
+    };
+  };
+
+  nixpkgs.config.allowUnfree = true;
+  nix.settings.experimental-features = [ "nix-command" "flakes" ];
+  system.stateVersion = "26.05";
+
+  boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usb_storage" "sd_mod" "sdhci_pci" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+  boot.kernelPackages = pkgs.linuxPackages_latest;
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/61b493e0-8c91-b7d1-4e336da06ff0";
+    fsType = "ext4";
+  };
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/E157-E223";
+    fsType = "vfat";
+    options = [ "fmask=0077" "dmask=0077" ];
+  };
+  swapDevices = [ ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/backup/default.nix

@@ -1,90 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-{
-  imports = [
-    ./hardware-configuration.nix
-
-    ../../modules/backup-server.nix
-    ../../modules/ssh.nix
-
-    ../../lilac.nix
-  ];
-
-  networking.hostName = "backup";
-
-  time.timeZone = "America/Winnipeg";
-
-  systemd.sleep.settings.Sleep = {
-    AllowSuspend = "no";
-    AllowHibernation = "no";
-    AllowHybridSleep = "no";
-    AllowSuspendThenHibernate = "no";
-  };
-
-  i18n.defaultLocale = "en_US.UTF-8";
-  i18n.extraLocaleSettings = {
-    LC_ADDRESS = "en_US.UTF-8";
-    LC_IDENTIFICATION = "en_US.UTF-8";
-    LC_MEASUREMENT = "en_US.UTF-8";
-    LC_MONETARY = "en_US.UTF-8";
-    LC_NAME = "en_US.UTF-8";
-    LC_NUMERIC = "en_US.UTF-8";
-    LC_PAPER = "en_US.UTF-8";
-    LC_TELEPHONE = "en_US.UTF-8";
-    LC_TIME = "en_US.UTF-8";
-  };
-
-  services.xserver.enable = true;
-  services.displayManager.sddm.enable = true;
-  services.desktopManager.plasma6.enable = true;
-  services.xserver.xkb = {
-    layout = "us";
-    variant = "";
-  };
-
-  services.pulseaudio.enable = false;
-  security.rtkit.enable = true;
-  services.pipewire = {
-    enable = true;
-    alsa.enable = true;
-    alsa.support32Bit = true;
-    pulse.enable = true;
-  };
-
-  environment.systemPackages = with pkgs; [
-    whipper
-  flac
-  tor-browser
-  ];
-
-  networking.wireless.enable = true;
-  networking.networkmanager.enable = true;
-
-  services.timesyncd.enable = true;    # optional
-
-networking = {
-    firewall = {
-    enable = true;
-    allowedUDPPorts = [ 51820 ];
-    trustedInterfaces = [ "wg0" ];
-  };
-
-  wireguard.interfaces."wg0" = {
-      ips = [ "10.0.0.4/24" ];
-    generatePrivateKeyFile = true;
-    privateKeyFile = "/var/lib/wireguard/wg0.key";
-    peers = [{
-        publicKey = "Tst6SiqoGLSoOAF9l5vT2vvR2RGJ/mFcoBL3BL5n90k=";
-    allowedIPs = [ "10.0.0.0/24" ];
-    endpoint = "216.128.177.13:51820";
-    persistentKeepalive = 25;
-    }];
-  };
-  };
-
-  nixpkgs.config.allowUnfree = true;
-  nix.settings.experimental-features = [ "nix-command" "flakes" ];
-  system.stateVersion = "26.05";
-
-  networking.firewall.interfaces.wg0.allowedTCPPorts = [ 8000 ];
-}

hosts/backup/hardware-configuration.nix

@@ -1,32 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
-
-{
-  imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
-
-  boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usb_storage" "sd_mod" "sdhci_pci" ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ "kvm-intel" ];
-  boot.extraModulePackages = [ ];
-  boot.loader.systemd-boot.enable = true;
-  boot.loader.efi.canTouchEfiVariables = true;
-  boot.kernelPackages = pkgs.linuxPackages_latest;
-
-  fileSystems."/" = {
-    device = "/dev/disk/by-uuid/61b493e0-8c91-b7d1-4e336da06ff0";
-    fsType = "ext4";
-  };
-
-  fileSystems."/boot" =
-    { device = "/dev/disk/by-uuid/E157-E223";
-      fsType = "vfat";
-      options = [ "fmask=0077" "dmask=0077" ];
-    };
-
-  swapDevices = [ ];
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-}

hosts/desktop.nix

@@ -1,19 +1,19 @@
-{ config, lib, pkgs, ... }:
+{ config, lib, pkgs, modulesPath, ... }:
 
 {
   imports = [
-    ./hardware-configuration.nix
+    (modulesPath + "/installer/scan/not-detected.nix")
 
-    ../../modules/backup.nix
+    ../modules/backup.nix
-    ../../modules/blog.nix
+    ../modules/blog.nix
-    ../../modules/code.nix
+    ../modules/code.nix
-    ../../modules/mail.nix
+    ../modules/mail.nix
-    ../../modules/music.nix
+    ../modules/music.nix
-    ../../modules/photo.nix
+    ../modules/photo.nix
-    ../../modules/ssh.nix
+    ../modules/ssh.nix
-    ../../modules/vault.nix
+    ../modules/vault.nix
 
-    ../../lilac.nix
+    ../lilac.nix
   ];
 
   networking.hostName = "desktop";
@@ -50,14 +50,6 @@
     pulse.enable = true;
   };
 
-  services.sunshine = {
-    enable = true;
-    autoStart = true;
-    capSysAdmin = true;
-    openFirewall = true;
-  };
-  networking.firewall.interfaces.wg0.allowedTCPPorts = [ 47984 47989 47990 48010 ];
-  networking.firewall.interfaces.wg0.allowedUDPPorts = [ 47998 47999 48000 48002 48010 ];
   services.displayManager.autoLogin.enable = true;
   services.displayManager.autoLogin.user = "lilac";
 
@@ -88,34 +80,55 @@
 
   environment.systemPackages = with pkgs; [
     whipper
-  flac
+    restic
-  tor-browser
-  restic
   ];
 
   programs.steam.enable = true;
 
   networking = {
     firewall = {
-    enable = true;
+      enable = true;
-    allowedUDPPorts = [ 51820 ];
+      allowedUDPPorts = [ 51820 ];
-    trustedInterfaces = [ "wg0" ];
+      trustedInterfaces = [ "wg0" ];
-  };
+    };
 
-  wireguard.interfaces."wg0" = {
+    wireguard.interfaces."wg0" = {
-      ips = [ "10.0.0.2/24" ];
+      ips = [ "10.0.0.2/32" ];
-    generatePrivateKeyFile = true;
+      generatePrivateKeyFile = true;
-    privateKeyFile = "/var/lib/wireguard/wg0.key";
+      privateKeyFile = "/var/lib/wireguard/wg0.key";
-    peers = [{
+      peers = [{
         publicKey = "Tst6SiqoGLSoOAF9l5vT2vvR2RGJ/mFcoBL3BL5n90k=";
-    allowedIPs = [ "10.0.0.0/24" ];
+        allowedIPs = [ "10.0.0.0/24" ];
-    endpoint = "216.128.177.13:51820";
+        endpoint = "216.128.177.13:51820";
-    persistentKeepalive = 25;
+        persistentKeepalive = 25;
-    }];
+      }];
-  };
+    };
   };
 
   nixpkgs.config.allowUnfree = true;
   nix.settings.experimental-features = [ "nix-command" "flakes" ];
   system.stateVersion = "26.05";
+
+  boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usbhid" "sd_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+  boot.kernelPackages = pkgs.linuxPackages_latest;
+  boot.kernelParams = [ "amdgpu.runpm=0" ];
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/d7450680-7d53-4842-83c5-7fc32526dff1";
+    fsType = "ext4";
+  };
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/D148-4AB8";
+    fsType = "vfat";
+    options = [ "fmask=0077" "dmask=0077" ];
+  };
+  swapDevices = [ ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }

hosts/desktop/hardware-configuration.nix

@@ -1,38 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
-
-{
-  imports =
-    [ (modulesPath + "/installer/scan/not-detected.nix")
-    ];
-
-  boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usbhid" "sd_mod" ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ ];
-  boot.extraModulePackages = [ ];
-  boot.loader.systemd-boot.enable = true;
-  boot.loader.efi.canTouchEfiVariables = true;
-  boot.kernelPackages = pkgs.linuxPackages_latest;
-
-  boot.kernelParams = [
-    "amdgpu.runpm=0"
-  ];
-
-  fileSystems."/" =
-    { device = "/dev/disk/by-uuid/d7450680-7d53-4842-83c5-7fc32526dff1";
-      fsType = "ext4";
-    };
-
-  fileSystems."/boot" =
-    { device = "/dev/disk/by-uuid/D148-4AB8";
-      fsType = "vfat";
-      options = [ "fmask=0077" "dmask=0077" ];
-    };
-
-  swapDevices = [ ];
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-}

hosts/laptop.nix

@@ -1,10 +1,10 @@
-{ config, pkgs, ... }:
+{ config, lib, pkgs, modulesPath, ... }:
 
 {
   imports = [
-    ./hardware-configuration.nix
+    (modulesPath + "/installer/scan/not-detected.nix")
     
-    ../../lilac.nix
+    ../lilac.nix
   ];
 
   boot.loader.systemd-boot.enable = true;
@@ -67,7 +67,7 @@
     };
 
     wireguard.interfaces."wg0" = {
-      ips = [ "10.0.0.1/24" ];
+      ips = [ "10.0.0.1/32" ];
       generatePrivateKeyFile = true;
       privateKeyFile = "/var/lib/wireguard/wg0.key";
       peers = [{
@@ -83,4 +83,23 @@
 
   nixpkgs.config.allowUnfree = true;
   system.stateVersion = "26.05";
+
+  boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "thunderbolt" "usb_storage" "sd_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-amd" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/379e6dd2-af45-4abc-8ff0-802791f76636";
+    fsType = "ext4";
+  };
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/D852-8C36";
+    fsType = "vfat";
+    options = [ "fmask=0077" "dmask=0077" ];
+  };
+  swapDevices = [ ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }

hosts/laptop/hardware-configuration.nix

@@ -1,31 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
-
-{
-  imports =
-    [ (modulesPath + "/installer/scan/not-detected.nix")
-    ];
-
-  boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "thunderbolt" "usb_storage" "sd_mod" ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ "kvm-amd" ];
-  boot.extraModulePackages = [ ];
-
-  fileSystems."/" =
-    { device = "/dev/disk/by-uuid/379e6dd2-af45-4abc-8ff0-802791f76636";
-      fsType = "ext4";
-    };
-
-  fileSystems."/boot" =
-    { device = "/dev/disk/by-uuid/D852-8C36";
-      fsType = "vfat";
-      options = [ "fmask=0077" "dmask=0077" ];
-    };
-
-  swapDevices = [ ];
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-}

hosts/vps.nix

@@ -0,0 +1,82 @@
+{ config, lib, pkgs, ... }:
+
+{
+  imports = [
+    ../modules/ssh.nix
+
+    ../lilac.nix
+  ];
+
+  networking.hostName = "vps";
+
+  # forwarding inbound network traffic over wireguard
+  networking = {
+    firewall = {
+      enable = true;
+      allowedTCPPorts = [ 80 443 ];
+      allowedUDPPorts = [ 51820 ];
+      trustedInterfaces = [ "wg0" ];
+    };
+
+    wireguard.interfaces."wg0" = {
+      ips = [ "10.0.0.3/32" ];
+      listenPort = 51820;
+      generatePrivateKeyFile = true;
+      privateKeyFile = "/var/lib/wireguard/wg0.key";
+      peers = [
+        {
+          allowedIPs = [ "10.0.0.1/32" ];
+          publicKey = "guKFJGQW946HXWjca/biMYH1nJKw0fguLjzGXKZ7Bxw=";
+        }
+        {
+          allowedIPs = [ "10.0.0.2/32" ];
+          publicKey = "7BcwtszpzS4ABDwKwMaiJ7F35sJRa89fBbuh80Sk8Uk=";
+        }
+        {
+          allowedIPs = [ "10.0.0.4/32" ];
+          publicKey = "XjuV3wzkP03UUjYSJfY3OG3WWLRtoQBN7GokDEWhdhQ=";
+        }
+      ];
+    };
+
+    nftables = {
+      enable = true;
+      tables.nat = {
+        family = "ip";
+        content = ''
+          chain prerouting {
+            type nat hook prerouting priority dstnat; policy accept;
+            iifname "enp1s0" tcp dport { 80, 443 } dnat to 10.0.0.2
+          }
+          chain postrouting {
+            type nat hook postrouting priority srcnat; policy accept;
+            oifname "wg0" masquerade
+          }
+        '';
+      };
+    };
+  };
+
+  boot.kernel.sysctl = {
+    "net.ipv4.ip_forward" = 1;
+  };
+
+  nix.settings.experimental-features = [ "nix-command" "flakes" ];
+  system.stateVersion = "26.05";
+
+  boot = {
+    initrd.availableKernelModules = [ "ahci" "xhci_pci" "virtio_pci" "sr_mod" "virtio_blk" ];
+    kernelModules = [ ];
+    extraModulePackages = [ ];
+    loader.systemd-boot.enable = true;
+    loader.efi.canTouchEfiVariables = true;
+    loader.efi.efiSysMountPoint = "/boot/efi";
+  };
+
+  fileSystems."/" = { device = "/dev/vda2"; fsType = "ext4"; };
+  fileSystems."/boot/efi" = { device = "/dev/vda1"; fsType = "vfat"; };
+  swapDevices = [ ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  virtualisation.hypervGuest.enable = true;
+}

hosts/vps/default.nix

@@ -1,65 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-{
-  imports = [
-    ./hardware-configuration.nix
-
-    ../../modules/ssh.nix
-
-    ../../lilac.nix
-  ];
-
-  networking.hostName = "vps";
-
-  # forwarding inbound network traffic over wireguard
-  networking = {
-    firewall = {
-    enable = true;
-    allowedTCPPorts = [ 80 443 ];
-    allowedUDPPorts = [ 51820 ];
-    trustedInterfaces = [ "wg0" ];
-  };
-  wireguard.interfaces."wg0" = {
-      ips = [ "10.0.0.3/24" ];
-    listenPort = 51820;
-    generatePrivateKeyFile = true;
-    privateKeyFile = "/var/lib/wireguard/wg0.key";
-    peers = [
-      {
-      allowedIPs = [ "10.0.0.1/32" ];
-          publicKey = "guKFJGQW946HXWjca/biMYH1nJKw0fguLjzGXKZ7Bxw=";
-    }
-    {
-          allowedIPs = [ "10.0.0.2/32" ];
-      publicKey = "7BcwtszpzS4ABDwKwMaiJ7F35sJRa89fBbuh80Sk8Uk=";
-    }
-    {
-      allowedIPs = [ "10.0.0.4/32" ];
-      publicKey = "XjuV3wzkP03UUjYSJfY3OG3WWLRtoQBN7GokDEWhdhQ=";
-    }
-      ];
-  };
-  nftables = {
-    enable = true;
-    tables.nat = {
-      family = "ip";
-    content = ''
-          chain prerouting {
-            type nat hook prerouting priority dstnat; policy accept;
-            iifname "enp1s0" tcp dport { 80, 443 } dnat to 10.0.0.2
-          }
-        chain postrouting {
-            type nat hook postrouting priority srcnat; policy accept;
-            oifname "wg0" masquerade
-          }
-        '';
-      };
-  };
-  };
-  boot.kernel.sysctl = {
-    "net.ipv4.ip_forward" = 1;
-  };
-
-  nix.settings.experimental-features = [ "nix-command" "flakes" ];
-  system.stateVersion = "26.05";
-}

hosts/vps/hardware-configuration.nix

@@ -1,19 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-{
-  boot = {
-    initrd.availableKernelModules = [ "ahci" "xhci_pci" "virtio_pci" "sr_mod" "virtio_blk" ];
-  kernelModules = [ ];
-  extraModulePackages = [ ];
-    loader.systemd-boot.enable = true;
-    loader.efi.canTouchEfiVariables = true;
-    loader.efi.efiSysMountPoint = "/boot/efi";
-  };
-
-  fileSystems."/" = { device = "/dev/vda2"; fsType = "ext4"; };
-  fileSystems."/boot/efi" = { device = "/dev/vda1"; fsType = "vfat"; };
-  swapDevices = [ ];
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-  virtualisation.hypervGuest.enable = true;
-}

modules/vault.nix

@@ -5,7 +5,7 @@
     enable = true;
     backupDir = "/var/lib/vault-backup";
     config = {
-      DOMAIN = "https://vault.example.com";
+      DOMAIN = "https://vault.grasswren.net";
       SIGNUPS_ALLOWED = false;
       ROCKET_ADDRESS = "127.0.0.1";
       ROCKET_PORT = 8222;