From a7a3cbbc7a8f0c0c91f74c4f0dcfc69d9639ca82 Mon Sep 17 00:00:00 2001
From: JuliusFreudenberger <julius+git@jfreudenberger.de>
Date: Fri, 8 Aug 2025 16:56:37 +0200
Subject: [PATCH 01/29] Add basic new server config

Includes sshd for easy connecting in local virtualized environment.
---
 flake.lock                                    | 30 +++++------
 flake.nix                                     | 12 +++++
 hosts/nixos-server-test/default.nix           | 51 +++++++++++++++++++
 .../hardware-configuration.nix                | 31 +++++++++++
 modules/sshd.nix                              | 13 +++++
 5 files changed, 122 insertions(+), 15 deletions(-)
 create mode 100644 hosts/nixos-server-test/default.nix
 create mode 100644 hosts/nixos-server-test/hardware-configuration.nix
 create mode 100644 modules/sshd.nix

diff --git a/flake.lock b/flake.lock
index 000b4f1..88bab71 100644
--- a/flake.lock
+++ b/flake.lock
@@ -7,11 +7,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1748372346,
-        "narHash": "sha256-7y7NZ6uW0GbT0h4gqfD2xvRuJj5IlPGw32oIc9Twga8=",
+        "lastModified": 1752998173,
+        "narHash": "sha256-ZlYpBp2WOe03UrpjJGz5KTOL/pp7A452hJO/Vc8C4/0=",
         "owner": "AdnanHodzic",
         "repo": "auto-cpufreq",
-        "rev": "becd5b89963fa54fef3566147f3fd2087f8a5842",
+        "rev": "562278377ffa96f3c1af49c7b499df028ce8d8bd",
         "type": "github"
       },
       "original": {
@@ -65,11 +65,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1749154018,
-        "narHash": "sha256-gjN3j7joRvT3a8Zgcylnd4NFsnXeDBumqiu4HmY1RIg=",
+        "lastModified": 1753592768,
+        "narHash": "sha256-oV695RvbAE4+R9pcsT9shmp6zE/+IZe6evHWX63f2Qg=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "7aae0ee71a17b19708b93b3ed448a1a0952bf111",
+        "rev": "fc3add429f21450359369af74c2375cb34a2d204",
         "type": "github"
       },
       "original": {
@@ -87,11 +87,11 @@
         "pre-commit-hooks": "pre-commit-hooks"
       },
       "locked": {
-        "lastModified": 1746906641,
-        "narHash": "sha256-b6few4tkqN2TWdrZTwWOjsWxA11rle7y9pcc0/ynuoE=",
+        "lastModified": 1752585957,
+        "narHash": "sha256-ogQo/MMNSIM4U4VQMieIrpLhjkgSbev3VR24foJ/h/U=",
         "owner": "~rycee",
         "repo": "lazy-apps",
-        "rev": "0b30a0bf524a661f9657c441d021aaa5724f12ff",
+        "rev": "3c3ce5001e24b6c12496a5920eee28a96f8d49d6",
         "type": "sourcehut"
       },
       "original": {
@@ -102,11 +102,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1749195551,
-        "narHash": "sha256-W5GKQHgunda/OP9sbKENBZhMBDNu2QahoIPwnsF6CeM=",
+        "lastModified": 1754229794,
+        "narHash": "sha256-yOl7REX6O/1mh+tpscJPKgjK6nmXSMOB1xhmDNAMUZM=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "4602f7e1d3f197b3cb540d5accf5669121629628",
+        "rev": "a872d985392ee5b19d8409bfcc3f106de2070070",
         "type": "github"
       },
       "original": {
@@ -118,11 +118,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1749086602,
-        "narHash": "sha256-DJcgJMekoxVesl9kKjfLPix2Nbr42i7cpEHJiTnBUwU=",
+        "lastModified": 1754028485,
+        "narHash": "sha256-IiiXB3BDTi6UqzAZcf2S797hWEPCRZOwyNThJIYhUfk=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "4792576cb003c994bd7cc1edada3129def20b27d",
+        "rev": "59e69648d345d6e8fef86158c555730fa12af9de",
         "type": "github"
       },
       "original": {
diff --git a/flake.nix b/flake.nix
index 558ac71..8adf2e8 100644
--- a/flake.nix
+++ b/flake.nix
@@ -90,6 +90,18 @@
           ./hosts/backup-raspberrypi
         ];
       };
+
+      server = nixpkgs.lib.nixosSystem rec {
+        system = "x86_64-linux";
+
+        specialArgs = {
+          inherit inputs outputs;
+        };
+
+        modules = [
+          ./hosts/nixos-server-test
+        ];
+      };
     };
   };
 }
diff --git a/hosts/nixos-server-test/default.nix b/hosts/nixos-server-test/default.nix
new file mode 100644
index 0000000..a4421da
--- /dev/null
+++ b/hosts/nixos-server-test/default.nix
@@ -0,0 +1,51 @@
+{ inputs, outputs, config, lib, pkgs, ... }:
+
+{
+  imports =
+    [
+      ../../modules/nix.nix
+      ../../modules/network-server.nix
+      ../../modules/locale.nix
+      ../../modules/server-cli.nix
+      ../../modules/nix.nix
+      ../../modules/sshd.nix
+      # Include the results of the hardware scan.
+      ./hardware-configuration.nix
+    ];
+  # Use the GRUB 2 boot loader.
+  boot = {
+    loader.grub = {
+      enable = true;
+      device = "/dev/vda";
+    };
+    tmp.useTmpfs = true;
+  };
+  networking.hostName = "nixos-server"; # Define your hostname.
+  users = {
+    users = {
+      julius = {
+        isNormalUser = true;
+        uid = 1000;
+        extraGroups = [ "wheel" "julius" ];
+      };
+    };
+    groups = {
+      julius = {
+        gid = 1000;
+      };
+    };
+  };
+  # This option defines the first version of NixOS you have installed on this particular machine,
+  # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
+  # Most users should NEVER change this value after the initial install, for any reason,
+  # even if you've upgraded your system to a new NixOS release.
+  # This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
+  # so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how
+  # to actually do that.
+  # This value being lower than the current NixOS release does NOT mean your system is
+  # out of date, out of support, or vulnerable.
+  # Do NOT change this value unless you have manually inspected all the changes it would make to your configuration,
+  # and migrated your data accordingly.
+  # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion .
+  system.stateVersion = "25.05"; # Did you read the comment?
+}
diff --git a/hosts/nixos-server-test/hardware-configuration.nix b/hosts/nixos-server-test/hardware-configuration.nix
new file mode 100644
index 0000000..6dfd7c4
--- /dev/null
+++ b/hosts/nixos-server-test/hardware-configuration.nix
@@ -0,0 +1,31 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/profiles/qemu-guest.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "virtio_pci" "sr_mod" "virtio_blk" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/e46c412a-8b6d-41b8-b53c-65d7a8fc39ed";
+      fsType = "ext4";
+    };
+
+  swapDevices = [ ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp1s0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}
diff --git a/modules/sshd.nix b/modules/sshd.nix
new file mode 100644
index 0000000..49af4a5
--- /dev/null
+++ b/modules/sshd.nix
@@ -0,0 +1,13 @@
+{
+  pkgs,
+  lib,
+  ...
+}: {
+  services.openssh = {
+    enable = true;
+    settings = {
+      PasswordAuthentication = false;
+      PermitRootLogin = "no";
+    };
+  };
+}

From 82bb877bfbde832ad0cf964a2eb1895ef430369f Mon Sep 17 00:00:00 2001
From: JuliusFreudenberger <julius+git@jfreudenberger.de>
Date: Sat, 9 Aug 2025 10:21:16 +0200
Subject: [PATCH 02/29] Add proxmox-nixos

---
 flake.lock                          | 102 +++++++++++++++++++++++++++-
 flake.nix                           |   9 +++
 hosts/nixos-server-test/default.nix |   6 ++
 3 files changed, 116 insertions(+), 1 deletion(-)

diff --git a/flake.lock b/flake.lock
index 88bab71..48507a1 100644
--- a/flake.lock
+++ b/flake.lock
@@ -36,6 +36,21 @@
         "type": "github"
       }
     },
+    "flake-compat_2": {
+      "locked": {
+        "lastModified": 1696426674,
+        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
     "gitignore": {
       "inputs": {
         "nixpkgs": [
@@ -148,6 +163,36 @@
         "type": "github"
       }
     },
+    "nixpkgs-stable_2": {
+      "locked": {
+        "lastModified": 1748437600,
+        "narHash": "sha256-hYKMs3ilp09anGO7xzfGs3JqEgUqFMnZ8GMAqI6/k04=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "7282cb574e0607e65224d33be8241eae7cfe0979",
+        "type": "github"
+      },
+      "original": {
+        "id": "nixpkgs",
+        "ref": "nixos-25.05",
+        "type": "indirect"
+      }
+    },
+    "nixpkgs-unstable": {
+      "locked": {
+        "lastModified": 1723637854,
+        "narHash": "sha256-med8+5DSWa2UnOqtdICndjDAEjxr5D7zaIiK4pn0Q7c=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "c3aa7b8938b17aebd2deecf7be0636000d62a2b9",
+        "type": "github"
+      },
+      "original": {
+        "id": "nixpkgs",
+        "ref": "nixos-unstable",
+        "type": "indirect"
+      }
+    },
     "pre-commit-hooks": {
       "inputs": {
         "flake-compat": "flake-compat",
@@ -172,6 +217,27 @@
         "type": "github"
       }
     },
+    "proxmox-nixos": {
+      "inputs": {
+        "flake-compat": "flake-compat_2",
+        "nixpkgs-stable": "nixpkgs-stable_2",
+        "nixpkgs-unstable": "nixpkgs-unstable",
+        "utils": "utils"
+      },
+      "locked": {
+        "lastModified": 1754428470,
+        "narHash": "sha256-Sxf8gf+vfGeFaJMW3D+8pwH/+WwYTQOg47Lrm42+kTc=",
+        "owner": "SaumonNet",
+        "repo": "proxmox-nixos",
+        "rev": "6faed2845ef5f0bb05c9519b75097bbe7fb39327",
+        "type": "github"
+      },
+      "original": {
+        "owner": "SaumonNet",
+        "repo": "proxmox-nixos",
+        "type": "github"
+      }
+    },
     "root": {
       "inputs": {
         "auto-cpufreq": "auto-cpufreq",
@@ -179,10 +245,26 @@
         "lazy-apps": "lazy-apps",
         "nixos-hardware": "nixos-hardware",
         "nixpkgs": "nixpkgs",
-        "systems": "systems"
+        "proxmox-nixos": "proxmox-nixos",
+        "systems": "systems_2"
       }
     },
     "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_2": {
       "locked": {
         "lastModified": 1689347949,
         "narHash": "sha256-12tWmuL2zgBgZkdoB6qXZsgJEH9LR3oUgpaQq2RbI80=",
@@ -196,6 +278,24 @@
         "repo": "default-linux",
         "type": "github"
       }
+    },
+    "utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1710146030,
+        "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
     }
   },
   "root": "root",
diff --git a/flake.nix b/flake.nix
index 8adf2e8..867eeb5 100644
--- a/flake.nix
+++ b/flake.nix
@@ -17,6 +17,7 @@
       url = "sourcehut:~rycee/lazy-apps";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    proxmox-nixos.url = "github:SaumonNet/proxmox-nixos";
 
     systems.url = "github:nix-systems/default-linux";
   };
@@ -28,6 +29,7 @@
     nixos-hardware,
     home-manager,
     auto-cpufreq,
+    proxmox-nixos,
     systems,
     ...
   } @ inputs: let
@@ -100,6 +102,13 @@
 
         modules = [
           ./hosts/nixos-server-test
+          proxmox-nixos.nixosModules.proxmox-ve
+
+          ({...}: {
+            nixpkgs.overlays = [
+              proxmox-nixos.overlays.${system}
+            ];
+          })
         ];
       };
     };
diff --git a/hosts/nixos-server-test/default.nix b/hosts/nixos-server-test/default.nix
index a4421da..c52fb8a 100644
--- a/hosts/nixos-server-test/default.nix
+++ b/hosts/nixos-server-test/default.nix
@@ -35,6 +35,12 @@
       };
     };
   };
+
+  services.proxmox-ve = {
+    enable = true;
+    ipAddress = "192.168.122.42";
+  };
+
   # This option defines the first version of NixOS you have installed on this particular machine,
   # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
   # Most users should NEVER change this value after the initial install, for any reason,

From 8e15acd0c6a4107df3d5f424cf9b0d0631d8160f Mon Sep 17 00:00:00 2001
From: JuliusFreudenberger <julius+git@jfreudenberger.de>
Date: Sun, 10 Aug 2025 23:24:39 +0200
Subject: [PATCH 03/29] Add network bridge config

---
 hosts/nixos-server-test/default.nix | 28 +++++++++++++++++++++++++++-
 1 file changed, 27 insertions(+), 1 deletion(-)

diff --git a/hosts/nixos-server-test/default.nix b/hosts/nixos-server-test/default.nix
index c52fb8a..f37aca5 100644
--- a/hosts/nixos-server-test/default.nix
+++ b/hosts/nixos-server-test/default.nix
@@ -7,7 +7,6 @@
       ../../modules/network-server.nix
       ../../modules/locale.nix
       ../../modules/server-cli.nix
-      ../../modules/nix.nix
       ../../modules/sshd.nix
       # Include the results of the hardware scan.
       ./hardware-configuration.nix
@@ -39,6 +38,33 @@
   services.proxmox-ve = {
     enable = true;
     ipAddress = "192.168.122.42";
+
+    # Make vmbr0 bridge visible in Proxmox web interface
+    bridges = [ "vmbr0" ];
+  };
+
+  # Actually set up the vmbr0 bridge
+  systemd.network.networks."10-lan" = {
+    matchConfig.Name = [ "ens18" ];
+    networkConfig = {
+      Bridge = "vmbr0";
+    };
+  };
+
+  systemd.network.netdevs."vmbr0" = {
+    netdevConfig = {
+      Name = "vmbr0";
+      Kind = "bridge";
+    };
+  };
+
+  systemd.network.networks."10-lan-bridge" = {
+    matchConfig.Name = "vmbr0";
+    networkConfig = {
+      IPv6AcceptRA = true;
+      DHCP = "ipv4";
+    };
+    linkConfig.RequiredForOnline = "routable";
   };
 
   # This option defines the first version of NixOS you have installed on this particular machine,

From f7c3edf779a2691474986f836a185989571c13d9 Mon Sep 17 00:00:00 2001
From: JuliusFreudenberger <julius+git@jfreudenberger.de>
Date: Mon, 11 Aug 2025 23:34:35 +0200
Subject: [PATCH 04/29] Actually apply systemd-networkd configuration

Also disable networking.* options
---
 hosts/nixos-server-test/default.nix | 63 ++++++++++++++++++++---------
 1 file changed, 43 insertions(+), 20 deletions(-)

diff --git a/hosts/nixos-server-test/default.nix b/hosts/nixos-server-test/default.nix
index f37aca5..b92920a 100644
--- a/hosts/nixos-server-test/default.nix
+++ b/hosts/nixos-server-test/default.nix
@@ -4,7 +4,6 @@
   imports =
     [
       ../../modules/nix.nix
-      ../../modules/network-server.nix
       ../../modules/locale.nix
       ../../modules/server-cli.nix
       ../../modules/sshd.nix
@@ -43,28 +42,52 @@
     bridges = [ "vmbr0" ];
   };
 
-  # Actually set up the vmbr0 bridge
-  systemd.network.networks."10-lan" = {
-    matchConfig.Name = [ "ens18" ];
-    networkConfig = {
-      Bridge = "vmbr0";
-    };
-  };
+  networking.useDHCP = false;
 
-  systemd.network.netdevs."vmbr0" = {
-    netdevConfig = {
-      Name = "vmbr0";
-      Kind = "bridge";
-    };
-  };
+  systemd.network = {
+    enable = true;
 
-  systemd.network.networks."10-lan-bridge" = {
-    matchConfig.Name = "vmbr0";
-    networkConfig = {
-      IPv6AcceptRA = true;
-      DHCP = "ipv4";
+    links."10-wan" = {
+        matchConfig.Path = "pci-0000:01:00.0";
+        linkConfig.Name = "wan";
+    };
+
+    networks."10-wan" = {
+      matchConfig.Name = "enp1s0";
+      networkConfig = {
+        # start a DHCP Client for IPv4 Addressing/Routing
+        DHCP = "ipv4";
+        # accept Router Advertisements for Stateless IPv6 Autoconfiguraton (SLAAC)
+        IPv6AcceptRA = true;
+      };
+      # make routing on this interface a dependency for network-online.target
+      linkConfig.RequiredForOnline = "routable";
+    };
+
+
+    # Actually set up the vmbr0 bridge
+    networks."10-lan" = {
+      matchConfig.Name = [ "ens18" ];
+      networkConfig = {
+        Bridge = "vmbr0";
+      };
+    };
+
+    netdevs."vmbr0" = {
+      netdevConfig = {
+        Name = "vmbr0";
+        Kind = "bridge";
+      };
+    };
+
+    networks."10-lan-bridge" = {
+      matchConfig.Name = "vmbr0";
+      networkConfig = {
+        IPv6AcceptRA = true;
+        DHCP = "ipv4";
+      };
+      linkConfig.RequiredForOnline = "routable";
     };
-    linkConfig.RequiredForOnline = "routable";
   };
 
   # This option defines the first version of NixOS you have installed on this particular machine,

From c790a14db1f2bbf0220dfdbcbd02453d4b25b8f3 Mon Sep 17 00:00:00 2001
From: JuliusFreudenberger <julius+git@jfreudenberger.de>
Date: Tue, 12 Aug 2025 00:05:42 +0200
Subject: [PATCH 05/29] Migrate bridge config to networking.*

---
 hosts/nixos-server-test/default.nix | 50 +++--------------------------
 1 file changed, 4 insertions(+), 46 deletions(-)

diff --git a/hosts/nixos-server-test/default.nix b/hosts/nixos-server-test/default.nix
index b92920a..00afad0 100644
--- a/hosts/nixos-server-test/default.nix
+++ b/hosts/nixos-server-test/default.nix
@@ -42,52 +42,10 @@
     bridges = [ "vmbr0" ];
   };
 
-  networking.useDHCP = false;
-
-  systemd.network = {
-    enable = true;
-
-    links."10-wan" = {
-        matchConfig.Path = "pci-0000:01:00.0";
-        linkConfig.Name = "wan";
-    };
-
-    networks."10-wan" = {
-      matchConfig.Name = "enp1s0";
-      networkConfig = {
-        # start a DHCP Client for IPv4 Addressing/Routing
-        DHCP = "ipv4";
-        # accept Router Advertisements for Stateless IPv6 Autoconfiguraton (SLAAC)
-        IPv6AcceptRA = true;
-      };
-      # make routing on this interface a dependency for network-online.target
-      linkConfig.RequiredForOnline = "routable";
-    };
-
-
-    # Actually set up the vmbr0 bridge
-    networks."10-lan" = {
-      matchConfig.Name = [ "ens18" ];
-      networkConfig = {
-        Bridge = "vmbr0";
-      };
-    };
-
-    netdevs."vmbr0" = {
-      netdevConfig = {
-        Name = "vmbr0";
-        Kind = "bridge";
-      };
-    };
-
-    networks."10-lan-bridge" = {
-      matchConfig.Name = "vmbr0";
-      networkConfig = {
-        IPv6AcceptRA = true;
-        DHCP = "ipv4";
-      };
-      linkConfig.RequiredForOnline = "routable";
-    };
+  # Actually set up the vmbr0 bridge
+  networking = {
+    bridges.vmbr0.interfaces = [ "enp1s0" ];
+    interfaces.vmbr0.useDHCP = lib.mkDefault true;
   };
 
   # This option defines the first version of NixOS you have installed on this particular machine,

From 7bce6df38b0e08a495858ca70f96585b2b4894a7 Mon Sep 17 00:00:00 2001
From: JuliusFreudenberger <julius+git@jfreudenberger.de>
Date: Tue, 12 Aug 2025 00:39:41 +0200
Subject: [PATCH 06/29] Working bridge configuration using systemd-networkd

---
 hosts/nixos-server-test/default.nix | 33 ++++++++++++++++++++++++-----
 1 file changed, 28 insertions(+), 5 deletions(-)

diff --git a/hosts/nixos-server-test/default.nix b/hosts/nixos-server-test/default.nix
index 00afad0..9b7f27d 100644
--- a/hosts/nixos-server-test/default.nix
+++ b/hosts/nixos-server-test/default.nix
@@ -36,16 +36,39 @@
 
   services.proxmox-ve = {
     enable = true;
-    ipAddress = "192.168.122.42";
+    ipAddress = "192.168.122.71";
 
     # Make vmbr0 bridge visible in Proxmox web interface
     bridges = [ "vmbr0" ];
   };
 
-  # Actually set up the vmbr0 bridge
-  networking = {
-    bridges.vmbr0.interfaces = [ "enp1s0" ];
-    interfaces.vmbr0.useDHCP = lib.mkDefault true;
+  networking.useDHCP = false;
+
+  systemd.network = {
+    enable = true;
+
+    networks."10-lan" = {
+      matchConfig.Name = [ "enp1s0" ];
+      networkConfig = {
+        Bridge = "vmbr0";
+      };
+    };
+
+    netdevs."vmbr0" = {
+      netdevConfig = {
+        Name = "vmbr0";
+        Kind = "bridge";
+      };
+    };
+
+    networks."10-lan-bridge" = {
+      matchConfig.Name = "vmbr0";
+      networkConfig = {
+        IPv6AcceptRA = true;
+        DHCP = "ipv4";
+      };
+      linkConfig.RequiredForOnline = "routable";
+    };
   };
 
   # This option defines the first version of NixOS you have installed on this particular machine,

From 2f19307456d659f10326d4be8ad9e6ab20405c96 Mon Sep 17 00:00:00 2001
From: JuliusFreudenberger <julius+git@jfreudenberger.de>
Date: Tue, 12 Aug 2025 02:27:42 +0200
Subject: [PATCH 07/29] Configure proxmox-nixos cache

---
 hosts/nixos-server-test/default.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/hosts/nixos-server-test/default.nix b/hosts/nixos-server-test/default.nix
index 9b7f27d..409e2fa 100644
--- a/hosts/nixos-server-test/default.nix
+++ b/hosts/nixos-server-test/default.nix
@@ -34,6 +34,15 @@
     };
   };
 
+  nix.settings = {
+    substituters = [
+      "https://cache.saumon.network/proxmox-nixos"
+    ];
+    trusted-public-keys = [
+      "proxmox-nixos:D9RYSWpQQC/msZUWphOY2I5RLH5Dd6yQcaHIuug7dWM="
+    ];
+  };
+
   services.proxmox-ve = {
     enable = true;
     ipAddress = "192.168.122.71";

From 1038d8a24840dce1d337b3304e7e2fcce52f0490 Mon Sep 17 00:00:00 2001
From: JuliusFreudenberger <julius+git@jfreudenberger.de>
Date: Sat, 16 Aug 2025 22:07:11 +0200
Subject: [PATCH 08/29] Add disko

---
 flake.lock | 33 +++++++++++++++++++++++++++------
 flake.nix  | 20 ++++++++++++++++++++
 2 files changed, 47 insertions(+), 6 deletions(-)

diff --git a/flake.lock b/flake.lock
index 48507a1..97db651 100644
--- a/flake.lock
+++ b/flake.lock
@@ -20,6 +20,26 @@
         "type": "github"
       }
     },
+    "disko": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1753140376,
+        "narHash": "sha256-7lrVrE0jSvZHrxEzvnfHFE/Wkk9DDqb+mYCodI5uuB8=",
+        "owner": "nix-community",
+        "repo": "disko",
+        "rev": "545aba02960caa78a31bd9a8709a0ad4b6320a5c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "disko",
+        "type": "github"
+      }
+    },
     "flake-compat": {
       "flake": false,
       "locked": {
@@ -117,11 +137,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1754229794,
-        "narHash": "sha256-yOl7REX6O/1mh+tpscJPKgjK6nmXSMOB1xhmDNAMUZM=",
+        "lastModified": 1754564048,
+        "narHash": "sha256-dz303vGuzWjzOPOaYkS9xSW+B93PSAJxvBd6CambXVA=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "a872d985392ee5b19d8409bfcc3f106de2070070",
+        "rev": "26ed7a0d4b8741fe1ef1ee6fa64453ca056ce113",
         "type": "github"
       },
       "original": {
@@ -133,11 +153,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1754028485,
-        "narHash": "sha256-IiiXB3BDTi6UqzAZcf2S797hWEPCRZOwyNThJIYhUfk=",
+        "lastModified": 1754767907,
+        "narHash": "sha256-8OnUzRQZkqtUol9vuUuQC30hzpMreKptNyET2T9lB6g=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "59e69648d345d6e8fef86158c555730fa12af9de",
+        "rev": "c5f08b62ed75415439d48152c2a784e36909b1bc",
         "type": "github"
       },
       "original": {
@@ -241,6 +261,7 @@
     "root": {
       "inputs": {
         "auto-cpufreq": "auto-cpufreq",
+        "disko": "disko",
         "home-manager": "home-manager",
         "lazy-apps": "lazy-apps",
         "nixos-hardware": "nixos-hardware",
diff --git a/flake.nix b/flake.nix
index 867eeb5..2204722 100644
--- a/flake.nix
+++ b/flake.nix
@@ -18,6 +18,10 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
     proxmox-nixos.url = "github:SaumonNet/proxmox-nixos";
+    disko = {
+      url = "github:nix-community/disko";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
 
     systems.url = "github:nix-systems/default-linux";
   };
@@ -30,6 +34,7 @@
     home-manager,
     auto-cpufreq,
     proxmox-nixos,
+    disko,
     systems,
     ...
   } @ inputs: let
@@ -111,6 +116,21 @@
           })
         ];
       };
+
+      kube01 = nixpkgs.lib.nixosSystem rec {
+        system = "x86_64-linux";
+
+        specialArgs = {
+          inherit inputs outputs;
+        };
+
+        modules = [
+          disko.nixosModules.disko
+          ./hosts/kube01/disko-config.nix
+          ./hosts/kube01
+        ];
+      };
+
     };
   };
 }

From 21582cbf81003981178f7b7844d326ef348e9461 Mon Sep 17 00:00:00 2001
From: JuliusFreudenberger <julius+git@jfreudenberger.de>
Date: Sat, 16 Aug 2025 22:07:27 +0200
Subject: [PATCH 09/29] Add configuration for kubernetes host kube01

---
 hosts/kube01/default.nix                | 60 +++++++++++++++++++++++++
 hosts/kube01/disko-config.nix           | 56 +++++++++++++++++++++++
 hosts/kube01/hardware-configuration.nix | 24 ++++++++++
 modules/k3s.nix                         | 27 +++++++++++
 4 files changed, 167 insertions(+)
 create mode 100644 hosts/kube01/default.nix
 create mode 100644 hosts/kube01/disko-config.nix
 create mode 100644 hosts/kube01/hardware-configuration.nix
 create mode 100644 modules/k3s.nix

diff --git a/hosts/kube01/default.nix b/hosts/kube01/default.nix
new file mode 100644
index 0000000..a19be4d
--- /dev/null
+++ b/hosts/kube01/default.nix
@@ -0,0 +1,60 @@
+{ inputs, outputs, config, lib, pkgs, ... }:
+
+{
+  imports =
+    [
+      ../../modules/nix.nix
+      ../../modules/network-server.nix
+      ../../modules/locale.nix
+      ../../modules/server-cli.nix
+      ../../modules/sshd.nix
+      ../../modules/k3s.nix
+      # Include the results of the hardware scan.
+      ./hardware-configuration.nix
+    ];
+
+  boot = {
+    loader = {
+      systemd-boot = {
+        enable = true;
+      };
+      efi.canTouchEfiVariables = true;
+    };
+    tmp.useTmpfs = true;
+  };
+
+  networking.hostName = "kube01"; # Define your hostname.
+
+  users = {
+    users = {
+      julius = {
+        initialPassword = "password";
+        isNormalUser = true;
+        uid = 1000;
+        extraGroups = [ "wheel" "julius" ];
+        openssh.authorizedKeys.keys = [
+          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOiZXFM8XFkReb9HuGcY5rtPXsGuZ2eDnBBpI0kcHa6c julius@julius-framework"
+        ];
+      };
+    };
+    groups = {
+      julius = {
+        gid = 1000;
+      };
+    };
+  };
+
+  # This option defines the first version of NixOS you have installed on this particular machine,
+  # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
+  # Most users should NEVER change this value after the initial install, for any reason,
+  # even if you've upgraded your system to a new NixOS release.
+  # This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
+  # so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how
+  # to actually do that.
+  # This value being lower than the current NixOS release does NOT mean your system is
+  # out of date, out of support, or vulnerable.
+  # Do NOT change this value unless you have manually inspected all the changes it would make to your configuration,
+  # and migrated your data accordingly.
+  # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion .
+  system.stateVersion = "25.05"; # Did you read the comment?
+}
diff --git a/hosts/kube01/disko-config.nix b/hosts/kube01/disko-config.nix
new file mode 100644
index 0000000..24ffe29
--- /dev/null
+++ b/hosts/kube01/disko-config.nix
@@ -0,0 +1,56 @@
+{
+  disko.devices = {
+    disk = {
+      vdb = {
+        type = "disk";
+        device = "/dev/sda";
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              priority = 1;
+              name = "ESP";
+              start = "1M";
+              end = "128M";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+              };
+            };
+            root = {
+              size = "100%";
+              content = {
+                type = "btrfs";
+                extraArgs = [ "-f" ]; # Override existing partition
+                # Subvolumes must set a mountpoint in order to be mounted,
+                # unless their parent is mounted
+                subvolumes = {
+                  # Subvolume name is different from mountpoint
+                  "/rootfs" = {
+                    mountpoint = "/";
+                  };
+                  # Subvolume name is the same as the mountpoint
+                  "/home" = {
+                    mountOptions = [ "compress=zstd" ];
+                    mountpoint = "/home";
+                  };
+                  # Sub(sub)volume doesn't need a mountpoint as its parent is mounted
+                  "/home/julius" = { };
+                  # Parent is not mounted so the mountpoint must be set
+                  "/nix" = {
+                    mountOptions = [ "compress=zstd" "noatime" ];
+                    mountpoint = "/nix";
+                  };
+                };
+
+                mountpoint = "/partition-root";
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+}
diff --git a/hosts/kube01/hardware-configuration.nix b/hosts/kube01/hardware-configuration.nix
new file mode 100644
index 0000000..f198f81
--- /dev/null
+++ b/hosts/kube01/hardware-configuration.nix
@@ -0,0 +1,24 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/profiles/qemu-guest.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "virtio_pci" "sr_mod" "virtio_blk" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp1s0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}
diff --git a/modules/k3s.nix b/modules/k3s.nix
new file mode 100644
index 0000000..940355e
--- /dev/null
+++ b/modules/k3s.nix
@@ -0,0 +1,27 @@
+{
+  pkgs,
+  lib,
+  ...
+}: {
+
+  services.k3s = {
+    enable = true;
+    role = "server";
+    clusterInit = true;
+    token = "verysecrettoken";
+    extraFlags = toString ([
+      "--write-kubeconfig-mode \"0644\""
+      "--disable servicelb"
+      "--disable traefik"
+      "--disable local-storage"
+    ]);
+  };
+
+  networking.firewall.allowedTCPPorts = [
+    6443
+  ];
+  networking.firewall.allowedUDPPorts = [
+    8472
+  ];
+
+}

From 59506dac35118b701d618c7866c0d7ffe72364b3 Mon Sep 17 00:00:00 2001
From: JuliusFreudenberger <julius+git@jfreudenberger.de>
Date: Sat, 16 Aug 2025 22:18:20 +0200
Subject: [PATCH 10/29] Move disko configuration to modules

---
 flake.nix                                                       | 1 -
 hosts/kube01/default.nix                                        | 2 ++
 .../kube01/disko-config.nix => modules/disko/efi-full-btrfs.nix | 2 +-
 3 files changed, 3 insertions(+), 2 deletions(-)
 rename hosts/kube01/disko-config.nix => modules/disko/efi-full-btrfs.nix (99%)

diff --git a/flake.nix b/flake.nix
index 2204722..527a41f 100644
--- a/flake.nix
+++ b/flake.nix
@@ -126,7 +126,6 @@
 
         modules = [
           disko.nixosModules.disko
-          ./hosts/kube01/disko-config.nix
           ./hosts/kube01
         ];
       };
diff --git a/hosts/kube01/default.nix b/hosts/kube01/default.nix
index a19be4d..53f1ac3 100644
--- a/hosts/kube01/default.nix
+++ b/hosts/kube01/default.nix
@@ -3,6 +3,8 @@
 {
   imports =
     [
+      ../../modules/disko/efi-full-btrfs.nix
+
       ../../modules/nix.nix
       ../../modules/network-server.nix
       ../../modules/locale.nix
diff --git a/hosts/kube01/disko-config.nix b/modules/disko/efi-full-btrfs.nix
similarity index 99%
rename from hosts/kube01/disko-config.nix
rename to modules/disko/efi-full-btrfs.nix
index 24ffe29..5dcb78c 100644
--- a/hosts/kube01/disko-config.nix
+++ b/modules/disko/efi-full-btrfs.nix
@@ -1,7 +1,7 @@
 {
   disko.devices = {
     disk = {
-      vdb = {
+      sda = {
         type = "disk";
         device = "/dev/sda";
         content = {

From 544930ff2d0f4cfdcb1d5b169b669f70c2c70f12 Mon Sep 17 00:00:00 2001
From: JuliusFreudenberger <julius+git@jfreudenberger.de>
Date: Sun, 17 Aug 2025 01:34:38 +0200
Subject: [PATCH 11/29] Externalize systemd-boot module

---
 hosts/kube01/default.nix | 10 +---------
 modules/systemd-boot.nix | 15 +++++++++++++++
 2 files changed, 16 insertions(+), 9 deletions(-)
 create mode 100644 modules/systemd-boot.nix

diff --git a/hosts/kube01/default.nix b/hosts/kube01/default.nix
index 53f1ac3..e50f156 100644
--- a/hosts/kube01/default.nix
+++ b/hosts/kube01/default.nix
@@ -4,6 +4,7 @@
   imports =
     [
       ../../modules/disko/efi-full-btrfs.nix
+      ../../modules/systemd-boot.nix
 
       ../../modules/nix.nix
       ../../modules/network-server.nix
@@ -15,15 +16,6 @@
       ./hardware-configuration.nix
     ];
 
-  boot = {
-    loader = {
-      systemd-boot = {
-        enable = true;
-      };
-      efi.canTouchEfiVariables = true;
-    };
-    tmp.useTmpfs = true;
-  };
 
   networking.hostName = "kube01"; # Define your hostname.
 
diff --git a/modules/systemd-boot.nix b/modules/systemd-boot.nix
new file mode 100644
index 0000000..02f515d
--- /dev/null
+++ b/modules/systemd-boot.nix
@@ -0,0 +1,15 @@
+{
+  ...
+}: {
+
+  boot = {
+    loader = {
+      systemd-boot = {
+        enable = true;
+      };
+      efi.canTouchEfiVariables = true;
+    };
+    tmp.useTmpfs = true;
+  };
+
+}

From 18b28c2e9d3053d27536cf79a9f8d9d4d67a0660 Mon Sep 17 00:00:00 2001
From: JuliusFreudenberger <julius+git@jfreudenberger.de>
Date: Sun, 17 Aug 2025 01:35:09 +0200
Subject: [PATCH 12/29] Add qemu-guest-utils module

---
 hosts/kube01/default.nix | 1 +
 modules/qemu-guest.nix   | 7 +++++++
 2 files changed, 8 insertions(+)
 create mode 100644 modules/qemu-guest.nix

diff --git a/hosts/kube01/default.nix b/hosts/kube01/default.nix
index e50f156..7b69d12 100644
--- a/hosts/kube01/default.nix
+++ b/hosts/kube01/default.nix
@@ -12,6 +12,7 @@
       ../../modules/server-cli.nix
       ../../modules/sshd.nix
       ../../modules/k3s.nix
+      ../../modules/qemu-guest.nix
       # Include the results of the hardware scan.
       ./hardware-configuration.nix
     ];
diff --git a/modules/qemu-guest.nix b/modules/qemu-guest.nix
new file mode 100644
index 0000000..97e2081
--- /dev/null
+++ b/modules/qemu-guest.nix
@@ -0,0 +1,7 @@
+{
+  ...
+}: {
+
+  services.qemuGuest.enable = true;
+
+}

From 75d4187baa7afe1741fc8f7d2aa73637bc69ab74 Mon Sep 17 00:00:00 2001
From: JuliusFreudenberger <julius+git@jfreudenberger.de>
Date: Sun, 17 Aug 2025 01:36:10 +0200
Subject: [PATCH 13/29] Add nixos-server user module

---
 hosts/kube01/default.nix      | 19 +------------------
 users/julius/nixos-server.nix | 23 +++++++++++++++++++++++
 2 files changed, 24 insertions(+), 18 deletions(-)
 create mode 100644 users/julius/nixos-server.nix

diff --git a/hosts/kube01/default.nix b/hosts/kube01/default.nix
index 7b69d12..2fe7891 100644
--- a/hosts/kube01/default.nix
+++ b/hosts/kube01/default.nix
@@ -6,6 +6,7 @@
       ../../modules/disko/efi-full-btrfs.nix
       ../../modules/systemd-boot.nix
 
+      ../../users/julius/nixos-server.nix
       ../../modules/nix.nix
       ../../modules/network-server.nix
       ../../modules/locale.nix
@@ -20,24 +21,6 @@
 
   networking.hostName = "kube01"; # Define your hostname.
 
-  users = {
-    users = {
-      julius = {
-        initialPassword = "password";
-        isNormalUser = true;
-        uid = 1000;
-        extraGroups = [ "wheel" "julius" ];
-        openssh.authorizedKeys.keys = [
-          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOiZXFM8XFkReb9HuGcY5rtPXsGuZ2eDnBBpI0kcHa6c julius@julius-framework"
-        ];
-      };
-    };
-    groups = {
-      julius = {
-        gid = 1000;
-      };
-    };
-  };
 
   # This option defines the first version of NixOS you have installed on this particular machine,
   # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
diff --git a/users/julius/nixos-server.nix b/users/julius/nixos-server.nix
new file mode 100644
index 0000000..5802f86
--- /dev/null
+++ b/users/julius/nixos-server.nix
@@ -0,0 +1,23 @@
+{
+  ...
+}: {
+
+  users = {
+    users = {
+      julius = {
+        initialPassword = "password";
+        isNormalUser = true;
+        uid = 1000;
+        group = "julius";
+        extraGroups = [ "wheel" ];
+      };
+    };
+    groups = {
+      julius = {
+        gid = 1000;
+      };
+    };
+  };
+
+  nix.settings.trusted-users = [ "julius" ];
+}

From 31267fa34ca1147e7fe77f144776f953dca69c5f Mon Sep 17 00:00:00 2001
From: JuliusFreudenberger <julius+git@jfreudenberger.de>
Date: Sun, 17 Aug 2025 01:46:17 +0200
Subject: [PATCH 14/29] Add more kube nodes

---
 flake.nix                               | 26 +++++++++++++++++
 hosts/kube02/default.nix                | 36 +++++++++++++++++++++++
 hosts/kube02/hardware-configuration.nix | 24 ++++++++++++++++
 hosts/kube03/default.nix                | 38 +++++++++++++++++++++++++
 hosts/kube03/hardware-configuration.nix | 24 ++++++++++++++++
 5 files changed, 148 insertions(+)
 create mode 100644 hosts/kube02/default.nix
 create mode 100644 hosts/kube02/hardware-configuration.nix
 create mode 100644 hosts/kube03/default.nix
 create mode 100644 hosts/kube03/hardware-configuration.nix

diff --git a/flake.nix b/flake.nix
index 527a41f..a27ec37 100644
--- a/flake.nix
+++ b/flake.nix
@@ -130,6 +130,32 @@
         ];
       };
 
+      kube02 = nixpkgs.lib.nixosSystem rec {
+        system = "x86_64-linux";
+
+        specialArgs = {
+          inherit inputs outputs;
+        };
+
+        modules = [
+          disko.nixosModules.disko
+          ./hosts/kube02
+        ];
+      };
+
+      kube03 = nixpkgs.lib.nixosSystem rec {
+        system = "x86_64-linux";
+
+        specialArgs = {
+          inherit inputs outputs;
+        };
+
+        modules = [
+          disko.nixosModules.disko
+          ./hosts/kube03
+        ];
+      };
+
     };
   };
 }
diff --git a/hosts/kube02/default.nix b/hosts/kube02/default.nix
new file mode 100644
index 0000000..cf65b75
--- /dev/null
+++ b/hosts/kube02/default.nix
@@ -0,0 +1,36 @@
+{ inputs, outputs, config, lib, pkgs, ... }:
+
+{
+  imports =
+    [
+      ../../modules/disko/efi-full-btrfs.nix
+      ../../modules/systemd-boot.nix
+
+      ../../users/julius/nixos-server.nix
+      ../../modules/nix.nix
+      ../../modules/network-server.nix
+      ../../modules/locale.nix
+      ../../modules/server-cli.nix
+      ../../modules/sshd.nix
+      ../../modules/k3s.nix
+      ../../modules/qemu-guest.nix
+      # Include the results of the hardware scan.
+      ./hardware-configuration.nix
+    ];
+
+  networking.hostName = "kube02"; # Define your hostname.
+
+  # This option defines the first version of NixOS you have installed on this particular machine,
+  # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
+  # Most users should NEVER change this value after the initial install, for any reason,
+  # even if you've upgraded your system to a new NixOS release.
+  # This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
+  # so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how
+  # to actually do that.
+  # This value being lower than the current NixOS release does NOT mean your system is
+  # out of date, out of support, or vulnerable.
+  # Do NOT change this value unless you have manually inspected all the changes it would make to your configuration,
+  # and migrated your data accordingly.
+  # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion .
+  system.stateVersion = "25.05"; # Did you read the comment?
+}
diff --git a/hosts/kube02/hardware-configuration.nix b/hosts/kube02/hardware-configuration.nix
new file mode 100644
index 0000000..f198f81
--- /dev/null
+++ b/hosts/kube02/hardware-configuration.nix
@@ -0,0 +1,24 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/profiles/qemu-guest.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "virtio_pci" "sr_mod" "virtio_blk" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp1s0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}
diff --git a/hosts/kube03/default.nix b/hosts/kube03/default.nix
new file mode 100644
index 0000000..8eda858
--- /dev/null
+++ b/hosts/kube03/default.nix
@@ -0,0 +1,38 @@
+{ inputs, outputs, config, lib, pkgs, ... }:
+
+{
+  imports =
+    [
+      ../../modules/disko/efi-full-btrfs.nix
+      ../../modules/systemd-boot.nix
+
+      ../../users/julius/nixos-server.nix
+      ../../modules/nix.nix
+      ../../modules/network-server.nix
+      ../../modules/locale.nix
+      ../../modules/server-cli.nix
+      ../../modules/sshd.nix
+      ../../modules/k3s.nix
+      ../../modules/qemu-guest.nix
+      # Include the results of the hardware scan.
+      ./hardware-configuration.nix
+    ];
+
+
+  networking.hostName = "kube03"; # Define your hostname.
+
+
+  # This option defines the first version of NixOS you have installed on this particular machine,
+  # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
+  # Most users should NEVER change this value after the initial install, for any reason,
+  # even if you've upgraded your system to a new NixOS release.
+  # This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
+  # so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how
+  # to actually do that.
+  # This value being lower than the current NixOS release does NOT mean your system is
+  # out of date, out of support, or vulnerable.
+  # Do NOT change this value unless you have manually inspected all the changes it would make to your configuration,
+  # and migrated your data accordingly.
+  # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion .
+  system.stateVersion = "25.05"; # Did you read the comment?
+}
diff --git a/hosts/kube03/hardware-configuration.nix b/hosts/kube03/hardware-configuration.nix
new file mode 100644
index 0000000..f198f81
--- /dev/null
+++ b/hosts/kube03/hardware-configuration.nix
@@ -0,0 +1,24 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/profiles/qemu-guest.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "virtio_pci" "sr_mod" "virtio_blk" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp1s0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}

From 2249b4cc5819ddf8820dca20340e9ff3a2af6007 Mon Sep 17 00:00:00 2001
From: JuliusFreudenberger <julius+git@jfreudenberger.de>
Date: Sun, 17 Aug 2025 02:53:39 +0200
Subject: [PATCH 15/29] Configure clustering with k3s

---
 hosts/kube01/default.nix | 3 +++
 hosts/kube02/default.nix | 5 +++++
 hosts/kube03/default.nix | 4 ++++
 modules/k3s.nix          | 3 ++-
 4 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/hosts/kube01/default.nix b/hosts/kube01/default.nix
index 2fe7891..a72dee8 100644
--- a/hosts/kube01/default.nix
+++ b/hosts/kube01/default.nix
@@ -21,6 +21,9 @@
 
   networking.hostName = "kube01"; # Define your hostname.
 
+  services.k3s = {
+    clusterInit = true;
+  };
 
   # This option defines the first version of NixOS you have installed on this particular machine,
   # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
diff --git a/hosts/kube02/default.nix b/hosts/kube02/default.nix
index cf65b75..504afef 100644
--- a/hosts/kube02/default.nix
+++ b/hosts/kube02/default.nix
@@ -20,6 +20,11 @@
 
   networking.hostName = "kube02"; # Define your hostname.
 
+  services.k3s = {
+    serverAddr = "https://kube01:6443";
+    clusterInit = false;
+  };
+
   # This option defines the first version of NixOS you have installed on this particular machine,
   # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
   # Most users should NEVER change this value after the initial install, for any reason,
diff --git a/hosts/kube03/default.nix b/hosts/kube03/default.nix
index 8eda858..12884e5 100644
--- a/hosts/kube03/default.nix
+++ b/hosts/kube03/default.nix
@@ -21,6 +21,10 @@
 
   networking.hostName = "kube03"; # Define your hostname.
 
+  services.k3s = {
+    serverAddr = "https://kube01:6443";
+    clusterInit = false;
+  };
 
   # This option defines the first version of NixOS you have installed on this particular machine,
   # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
diff --git a/modules/k3s.nix b/modules/k3s.nix
index 940355e..2dab28a 100644
--- a/modules/k3s.nix
+++ b/modules/k3s.nix
@@ -7,7 +7,6 @@
   services.k3s = {
     enable = true;
     role = "server";
-    clusterInit = true;
     token = "verysecrettoken";
     extraFlags = toString ([
       "--write-kubeconfig-mode \"0644\""
@@ -19,6 +18,8 @@
 
   networking.firewall.allowedTCPPorts = [
     6443
+    2379
+    2380
   ];
   networking.firewall.allowedUDPPorts = [
     8472

From db8b0f1d5fd5e87d27159588752351a714623c80 Mon Sep 17 00:00:00 2001
From: JuliusFreudenberger <julius+git@jfreudenberger.de>
Date: Mon, 18 Aug 2025 23:12:46 +0200
Subject: [PATCH 16/29] Add srv01.hf as docker host

---
 flake.nix                                 | 13 ++++++++
 hosts/srv01.hf/default.nix                | 37 +++++++++++++++++++++++
 hosts/srv01.hf/hardware-configuration.nix | 24 +++++++++++++++
 3 files changed, 74 insertions(+)
 create mode 100644 hosts/srv01.hf/default.nix
 create mode 100644 hosts/srv01.hf/hardware-configuration.nix

diff --git a/flake.nix b/flake.nix
index a27ec37..a4ec7a2 100644
--- a/flake.nix
+++ b/flake.nix
@@ -117,6 +117,19 @@
         ];
       };
 
+      srv01-hf = nixpkgs.lib.nixosSystem rec {
+        system = "x86_64-linux";
+
+        specialArgs = {
+          inherit inputs outputs;
+        };
+
+        modules = [
+          disko.nixosModules.disko
+          ./hosts/srv01.hf
+        ];
+      };
+
       kube01 = nixpkgs.lib.nixosSystem rec {
         system = "x86_64-linux";
 
diff --git a/hosts/srv01.hf/default.nix b/hosts/srv01.hf/default.nix
new file mode 100644
index 0000000..d341361
--- /dev/null
+++ b/hosts/srv01.hf/default.nix
@@ -0,0 +1,37 @@
+{ inputs, outputs, config, lib, pkgs, ... }:
+
+{
+  imports =
+    [
+      ../../modules/disko/efi-full-btrfs.nix
+      ../../modules/systemd-boot.nix
+
+      ../../users/julius/nixos-server.nix
+      ../../modules/nix.nix
+      ../../modules/network-server.nix
+      ../../modules/locale.nix
+      ../../modules/server-cli.nix
+      ../../modules/sshd.nix
+      ../../modules/qemu-guest.nix
+      ../../modules/docker.nix
+      # Include the results of the hardware scan.
+      ./hardware-configuration.nix
+    ];
+
+
+  networking.hostName = "srv01-hf"; # Define your hostname.
+
+  # This option defines the first version of NixOS you have installed on this particular machine,
+  # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
+  # Most users should NEVER change this value after the initial install, for any reason,
+  # even if you've upgraded your system to a new NixOS release.
+  # This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
+  # so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how
+  # to actually do that.
+  # This value being lower than the current NixOS release does NOT mean your system is
+  # out of date, out of support, or vulnerable.
+  # Do NOT change this value unless you have manually inspected all the changes it would make to your configuration,
+  # and migrated your data accordingly.
+  # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion .
+  system.stateVersion = "25.05"; # Did you read the comment?
+}
diff --git a/hosts/srv01.hf/hardware-configuration.nix b/hosts/srv01.hf/hardware-configuration.nix
new file mode 100644
index 0000000..d152a40
--- /dev/null
+++ b/hosts/srv01.hf/hardware-configuration.nix
@@ -0,0 +1,24 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/profiles/qemu-guest.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "uhci_hcd" "ehci_pci" "ahci" "sr_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp1s0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}

From c4ec22b3806ab2b925a970c201ef8ceb6d79baef Mon Sep 17 00:00:00 2001
From: JuliusFreudenberger <julius+git@jfreudenberger.de>
Date: Mon, 18 Aug 2025 23:40:53 +0200
Subject: [PATCH 17/29] Change bootloader to grub for srv01-hf

---
 hosts/srv01.hf/default.nix | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/hosts/srv01.hf/default.nix b/hosts/srv01.hf/default.nix
index d341361..868a71b 100644
--- a/hosts/srv01.hf/default.nix
+++ b/hosts/srv01.hf/default.nix
@@ -4,7 +4,6 @@
   imports =
     [
       ../../modules/disko/efi-full-btrfs.nix
-      ../../modules/systemd-boot.nix
 
       ../../users/julius/nixos-server.nix
       ../../modules/nix.nix
@@ -18,6 +17,13 @@
       ./hardware-configuration.nix
     ];
 
+  boot = {
+    loader.grub = {
+      enable = true;
+      device = "/dev/sda";
+    };
+    tmp.useTmpfs = true;
+  };
 
   networking.hostName = "srv01-hf"; # Define your hostname.
 

From a8f632ed50515b179401751a0cb48fe9d7bc56c0 Mon Sep 17 00:00:00 2001
From: JuliusFreudenberger <julius+git@jfreudenberger.de>
Date: Tue, 19 Aug 2025 01:39:43 +0200
Subject: [PATCH 18/29] Enable hybrid boot for disko module

---
 hosts/srv01.hf/default.nix       | 7 -------
 modules/disko/efi-full-btrfs.nix | 9 +++++++--
 2 files changed, 7 insertions(+), 9 deletions(-)

diff --git a/hosts/srv01.hf/default.nix b/hosts/srv01.hf/default.nix
index 868a71b..a7a3540 100644
--- a/hosts/srv01.hf/default.nix
+++ b/hosts/srv01.hf/default.nix
@@ -17,13 +17,6 @@
       ./hardware-configuration.nix
     ];
 
-  boot = {
-    loader.grub = {
-      enable = true;
-      device = "/dev/sda";
-    };
-    tmp.useTmpfs = true;
-  };
 
   networking.hostName = "srv01-hf"; # Define your hostname.
 
diff --git a/modules/disko/efi-full-btrfs.nix b/modules/disko/efi-full-btrfs.nix
index 5dcb78c..59e8b26 100644
--- a/modules/disko/efi-full-btrfs.nix
+++ b/modules/disko/efi-full-btrfs.nix
@@ -7,16 +7,21 @@
         content = {
           type = "gpt";
           partitions = {
+            MBR = {
+              type = "EF02"; # for grub MBR
+              size = "1M";
+              priority = 1; # Needs to be first partition
+            };
             ESP = {
               priority = 1;
               name = "ESP";
-              start = "1M";
-              end = "128M";
+              size = "500M";
               type = "EF00";
               content = {
                 type = "filesystem";
                 format = "vfat";
                 mountpoint = "/boot";
+                mountOptions = [ "umask=0077" ];
               };
             };
             root = {

From 6989f4be08aeae7ad1e97f61fe38db49322b65ae Mon Sep 17 00:00:00 2001
From: JuliusFreudenberger <julius+git@jfreudenberger.de>
Date: Tue, 19 Aug 2025 16:44:48 +0200
Subject: [PATCH 19/29] Add static network configuration to srv01-hf

---
 hosts/srv01.hf/default.nix | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/hosts/srv01.hf/default.nix b/hosts/srv01.hf/default.nix
index a7a3540..19d5ca9 100644
--- a/hosts/srv01.hf/default.nix
+++ b/hosts/srv01.hf/default.nix
@@ -17,6 +17,25 @@
       ./hardware-configuration.nix
     ];
 
+  systemd.network = {
+    enable = true;
+      networks."10-wan" = {
+      matchConfig.Name = "ens18";
+      networkConfig.DHCP = "no";
+      address = [
+        "77.90.17.93/24"
+        "2a06:de00:100:63::2/64"
+      ];
+      routes = [
+        { Gateway = "77.90.17.1"; }
+        { Gateway = "2a06:de00:100::1"; GatewayOnLink = true; }
+      ];
+      dns = [ "9.9.9.9" ];
+    };
+  };
+
+  # Disable classic networking configuration
+  networking.useDHCP = lib.mkForce false;
 
   networking.hostName = "srv01-hf"; # Define your hostname.
 

From 962ee20628dfcfab60a3244238923957257c8539 Mon Sep 17 00:00:00 2001
From: JuliusFreudenberger <julius+git@jfreudenberger.de>
Date: Tue, 19 Aug 2025 17:00:45 +0200
Subject: [PATCH 20/29] Enable auto-update on srv01-hf

---
 hosts/srv01.hf/default.nix |  1 +
 modules/auto-upgrade.nix   | 15 +++++++++++++++
 2 files changed, 16 insertions(+)
 create mode 100644 modules/auto-upgrade.nix

diff --git a/hosts/srv01.hf/default.nix b/hosts/srv01.hf/default.nix
index 19d5ca9..193fe35 100644
--- a/hosts/srv01.hf/default.nix
+++ b/hosts/srv01.hf/default.nix
@@ -13,6 +13,7 @@
       ../../modules/sshd.nix
       ../../modules/qemu-guest.nix
       ../../modules/docker.nix
+      ../../modules/auto-upgrade.nix
       # Include the results of the hardware scan.
       ./hardware-configuration.nix
     ];
diff --git a/modules/auto-upgrade.nix b/modules/auto-upgrade.nix
new file mode 100644
index 0000000..5ed134e
--- /dev/null
+++ b/modules/auto-upgrade.nix
@@ -0,0 +1,15 @@
+{
+  inputs,
+  ...
+}: {
+  system.autoUpgrade = {
+    enable = true;
+    flags = [
+      "--recreate-lock-file" # Deprecated, but will hopefully be reintroduced
+      "-L"
+    ];
+    flake = inputs.self.outPath;
+    dates = "02:00";
+    randomizedDelaySec = "45min";
+  };
+}

From ea01c0abf388cb37d7f99db8e0da0d8a165204b4 Mon Sep 17 00:00:00 2001
From: JuliusFreudenberger <julius+git@jfreudenberger.de>
Date: Mon, 25 Aug 2025 09:46:56 +0200
Subject: [PATCH 21/29] Add nixremote user for remote building

---
 hosts/srv01.hf/default.nix |  1 +
 users/nixremote.nix        | 12 ++++++++++++
 2 files changed, 13 insertions(+)
 create mode 100644 users/nixremote.nix

diff --git a/hosts/srv01.hf/default.nix b/hosts/srv01.hf/default.nix
index 193fe35..63062a8 100644
--- a/hosts/srv01.hf/default.nix
+++ b/hosts/srv01.hf/default.nix
@@ -6,6 +6,7 @@
       ../../modules/disko/efi-full-btrfs.nix
 
       ../../users/julius/nixos-server.nix
+      ../../users/nixremote.nix
       ../../modules/nix.nix
       ../../modules/network-server.nix
       ../../modules/locale.nix
diff --git a/users/nixremote.nix b/users/nixremote.nix
new file mode 100644
index 0000000..78eac6a
--- /dev/null
+++ b/users/nixremote.nix
@@ -0,0 +1,12 @@
+{
+  ...
+}: {
+  users.users = {
+    nixremote = {
+      isNormalUser = true;
+      uid = 1100;
+      group = "users";
+      expires = "1970-01-01";
+    }
+  };
+}

From aa4d1f11c923302fd37347ed55b04e0498daf082 Mon Sep 17 00:00:00 2001
From: JuliusFreudenberger <julius+git@jfreudenberger.de>
Date: Wed, 17 Sep 2025 00:03:34 +0200
Subject: [PATCH 22/29] Add rebootWindow for auto upgrades

---
 modules/auto-upgrade.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/modules/auto-upgrade.nix b/modules/auto-upgrade.nix
index 5ed134e..4d1a468 100644
--- a/modules/auto-upgrade.nix
+++ b/modules/auto-upgrade.nix
@@ -11,5 +11,10 @@
     flake = inputs.self.outPath;
     dates = "02:00";
     randomizedDelaySec = "45min";
+    allowReboot = true;
+    rebootWindow = {
+      lower = "01:00";
+      upper = "05:00";
+    };
   };
 }

From 3c17de5929beee77eabc5b05309563b086b30aee Mon Sep 17 00:00:00 2001
From: JuliusFreudenberger <julius+git@jfreudenberger.de>
Date: Wed, 17 Sep 2025 00:04:01 +0200
Subject: [PATCH 23/29] Make nixremote trusted and not expire

---
 users/nixremote.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/users/nixremote.nix b/users/nixremote.nix
index 78eac6a..b0075cb 100644
--- a/users/nixremote.nix
+++ b/users/nixremote.nix
@@ -6,7 +6,8 @@
       isNormalUser = true;
       uid = 1100;
       group = "users";
-      expires = "1970-01-01";
-    }
+    };
   };
+
+  nix.settings.trusted-users = [ "nixremote" ];
 }

From 739b50349c9d7f3f76329fdcaf56fb7ff957a487 Mon Sep 17 00:00:00 2001
From: JuliusFreudenberger <julius+git@jfreudenberger.de>
Date: Wed, 17 Sep 2025 00:05:36 +0200
Subject: [PATCH 24/29] Set oci-backend to docker

This can be used to start containers declaratively.
Use docker when it is enabled for this.
---
 modules/docker.nix | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/modules/docker.nix b/modules/docker.nix
index b9f7aa1..d216ec2 100644
--- a/modules/docker.nix
+++ b/modules/docker.nix
@@ -4,8 +4,11 @@
   ...
 }: {
 
-  virtualisation.docker = {
-    enable = true;
+  virtualisation = {
+    docker = {
+      enable = true;
+    };
+    oci-containers.backend = "docker";
   };
 
 }

From eee7d2ddcf5e404abb779b4ac6626325b43721ba Mon Sep 17 00:00:00 2001
From: JuliusFreudenberger <julius+git@jfreudenberger.de>
Date: Wed, 17 Sep 2025 23:51:27 +0200
Subject: [PATCH 25/29] Add secret management with agenix

---
 flake.lock                 | 113 +++++++++++++++++++++++++++++++------
 flake.nix                  |  14 ++++-
 hosts/srv01.hf/default.nix |   1 +
 hosts/srv01.hf/secrets.nix |   7 +++
 4 files changed, 116 insertions(+), 19 deletions(-)
 create mode 100644 hosts/srv01.hf/secrets.nix

diff --git a/flake.lock b/flake.lock
index 97db651..8a290db 100644
--- a/flake.lock
+++ b/flake.lock
@@ -1,5 +1,28 @@
 {
   "nodes": {
+    "agenix": {
+      "inputs": {
+        "darwin": [],
+        "home-manager": "home-manager",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1754433428,
+        "narHash": "sha256-NA/FT2hVhKDftbHSwVnoRTFhes62+7dxZbxj5Gxvghs=",
+        "owner": "ryantm",
+        "repo": "agenix",
+        "rev": "9edb1787864c4f59ae5074ad498b6272b3ec308d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ryantm",
+        "repo": "agenix",
+        "type": "github"
+      }
+    },
     "auto-cpufreq": {
       "inputs": {
         "nixpkgs": [
@@ -7,11 +30,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1752998173,
-        "narHash": "sha256-ZlYpBp2WOe03UrpjJGz5KTOL/pp7A452hJO/Vc8C4/0=",
+        "lastModified": 1758056808,
+        "narHash": "sha256-7I4duKo9OdQ7sldgjoYBlpZ+xykszDj/IVz5hlJOaeg=",
         "owner": "AdnanHodzic",
         "repo": "auto-cpufreq",
-        "rev": "562278377ffa96f3c1af49c7b499df028ce8d8bd",
+        "rev": "9f86acc38dca4299b70ea55ae6c52902da5c903c",
         "type": "github"
       },
       "original": {
@@ -27,11 +50,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1753140376,
-        "narHash": "sha256-7lrVrE0jSvZHrxEzvnfHFE/Wkk9DDqb+mYCodI5uuB8=",
+        "lastModified": 1757508292,
+        "narHash": "sha256-7lVWL5bC6xBIMWWDal41LlGAG+9u2zUorqo3QCUL4p4=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "545aba02960caa78a31bd9a8709a0ad4b6320a5c",
+        "rev": "146f45bee02b8bd88812cfce6ffc0f933788875a",
         "type": "github"
       },
       "original": {
@@ -96,15 +119,36 @@
     "home-manager": {
       "inputs": {
         "nixpkgs": [
+          "agenix",
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1753592768,
-        "narHash": "sha256-oV695RvbAE4+R9pcsT9shmp6zE/+IZe6evHWX63f2Qg=",
+        "lastModified": 1745494811,
+        "narHash": "sha256-YZCh2o9Ua1n9uCvrvi5pRxtuVNml8X2a03qIFfRKpFs=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "fc3add429f21450359369af74c2375cb34a2d204",
+        "rev": "abfad3d2958c9e6300a883bd443512c55dfeb1be",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "type": "github"
+      }
+    },
+    "home-manager_2": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1757808926,
+        "narHash": "sha256-K6PEI5PYY94TVMH0mX3MbZNYFme7oNRKml/85BpRRAo=",
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "rev": "f21d9167782c086a33ad53e2311854a8f13c281e",
         "type": "github"
       },
       "original": {
@@ -137,11 +181,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1754564048,
-        "narHash": "sha256-dz303vGuzWjzOPOaYkS9xSW+B93PSAJxvBd6CambXVA=",
+        "lastModified": 1757943327,
+        "narHash": "sha256-w6cDExPBqbq7fTLo4dZ1ozDGeq3yV6dSN4n/sAaS6OM=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "26ed7a0d4b8741fe1ef1ee6fa64453ca056ce113",
+        "rev": "67a709cfe5d0643dafd798b0b613ed579de8be05",
         "type": "github"
       },
       "original": {
@@ -153,11 +197,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1754767907,
-        "narHash": "sha256-8OnUzRQZkqtUol9vuUuQC30hzpMreKptNyET2T9lB6g=",
+        "lastModified": 1758070117,
+        "narHash": "sha256-uLwwHFCZnT1c3N3biVe/0hCkag2GSrf9+M56+Okf+WY=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "c5f08b62ed75415439d48152c2a784e36909b1bc",
+        "rev": "e9b7f2ff62b35f711568b1f0866243c7c302028d",
         "type": "github"
       },
       "original": {
@@ -260,14 +304,32 @@
     },
     "root": {
       "inputs": {
+        "agenix": "agenix",
         "auto-cpufreq": "auto-cpufreq",
         "disko": "disko",
-        "home-manager": "home-manager",
+        "home-manager": "home-manager_2",
         "lazy-apps": "lazy-apps",
         "nixos-hardware": "nixos-hardware",
         "nixpkgs": "nixpkgs",
         "proxmox-nixos": "proxmox-nixos",
-        "systems": "systems_2"
+        "secrets": "secrets",
+        "systems": "systems_3"
+      }
+    },
+    "secrets": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1758144826,
+        "narHash": "sha256-iP17+7kzDVsMa66W1RmAx6LQzQVCSYj7QemyhuZMUFQ=",
+        "ref": "refs/heads/main",
+        "rev": "8ed4ae40d7b203880e368f5822260f0cd2ed0229",
+        "revCount": 2,
+        "type": "git",
+        "url": "ssh://git@git.jfreudenberger.de/JuliusFreudenberger/nix-private.git"
+      },
+      "original": {
+        "type": "git",
+        "url": "ssh://git@git.jfreudenberger.de/JuliusFreudenberger/nix-private.git"
       }
     },
     "systems": {
@@ -286,6 +348,21 @@
       }
     },
     "systems_2": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_3": {
       "locked": {
         "lastModified": 1689347949,
         "narHash": "sha256-12tWmuL2zgBgZkdoB6qXZsgJEH9LR3oUgpaQq2RbI80=",
@@ -302,7 +379,7 @@
     },
     "utils": {
       "inputs": {
-        "systems": "systems"
+        "systems": "systems_2"
       },
       "locked": {
         "lastModified": 1710146030,
diff --git a/flake.nix b/flake.nix
index a4ec7a2..fab5bf0 100644
--- a/flake.nix
+++ b/flake.nix
@@ -22,7 +22,17 @@
       url = "github:nix-community/disko";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-
+    agenix = {
+      url = "github:ryantm/agenix";
+      inputs = {
+        nixpkgs.follows = "nixpkgs";
+        darwin.follows = "";
+      };
+    };
+    secrets = {
+      url = "git+ssh://git@git.jfreudenberger.de/JuliusFreudenberger/nix-private.git";
+      flake = false;
+    };
     systems.url = "github:nix-systems/default-linux";
   };
 
@@ -34,6 +44,7 @@
     home-manager,
     auto-cpufreq,
     proxmox-nixos,
+    agenix,
     disko,
     systems,
     ...
@@ -126,6 +137,7 @@
 
         modules = [
           disko.nixosModules.disko
+          agenix.nixosModules.default
           ./hosts/srv01.hf
         ];
       };
diff --git a/hosts/srv01.hf/default.nix b/hosts/srv01.hf/default.nix
index 63062a8..1cea677 100644
--- a/hosts/srv01.hf/default.nix
+++ b/hosts/srv01.hf/default.nix
@@ -4,6 +4,7 @@
   imports =
     [
       ../../modules/disko/efi-full-btrfs.nix
+      ./secrets.nix
 
       ../../users/julius/nixos-server.nix
       ../../users/nixremote.nix
diff --git a/hosts/srv01.hf/secrets.nix b/hosts/srv01.hf/secrets.nix
new file mode 100644
index 0000000..9b8fb86
--- /dev/null
+++ b/hosts/srv01.hf/secrets.nix
@@ -0,0 +1,7 @@
+{ inputs, ... }:
+{
+  age.secrets = {
+    teleport-ca_pin.file = "${inputs.secrets}/secrets/teleport/ca_pin";
+    teleport-join_token.file = "${inputs.secrets}/secrets/srv01-hf/teleport_auth_token";
+  };
+}

From abf81609e426ae6cc101439b8825a34e54f60dfe Mon Sep 17 00:00:00 2001
From: JuliusFreudenberger <julius+git@jfreudenberger.de>
Date: Thu, 18 Sep 2025 01:07:36 +0200
Subject: [PATCH 26/29] Add ssh connection settings to nix-private repo for
 auto-upgrade

---
 modules/auto-upgrade.nix | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/modules/auto-upgrade.nix b/modules/auto-upgrade.nix
index 4d1a468..3dc9849 100644
--- a/modules/auto-upgrade.nix
+++ b/modules/auto-upgrade.nix
@@ -1,5 +1,6 @@
 {
   inputs,
+  pkgs,
   ...
 }: {
   system.autoUpgrade = {
@@ -17,4 +18,20 @@
       upper = "05:00";
     };
   };
+
+  # Also needs access to the nix-private repo which contains the encrypted secrets
+  programs.ssh = {
+    extraConfig = "
+      Host git.jfreudenberger.de
+        Port 222
+        User git
+        IdentityFile /etc/ssh/ssh_host_ed25519_key
+    ";
+    knownHostsFiles = [
+      (pkgs.writeText "forgejo.keys" ''[git.jfreudenberger.de]:222 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK+uqIeb9+AoqwD0Z6xLKI2dsRoS9Qh/VwboYfGpBJd+
+[git.jfreudenberger.de]:222 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC8GDSt4LsCzOoIZkqZRLgXyTLyHoJu62cFFP88i8GpSadyV6mJPkK5p2mgBzN/BM9I/G2VWfvqdM8Fy/7p3S8kDhmmkOk1AK7C/+qaQKsKcQauJuzNXlwMHG1Ivath80TO9PIQc9jYakP9xl8SACd5bwkvfEm3rS5awZ8T2hWgnsgO8pFHFOFmFnVbujXZk58FVTCxpgyPqjFv76JSYxpHk1VtiQ52jScsreOImEOWWg88f9IM9etWcshuxte4zudaqc2KjjAB6pYMuVj7O6cwMXKjCUxTzyomWjr2JoEruIslifbZ6bJGgswg5ENJSKURuMPgTuGM6Nrjp75V/yFD
+[git.jfreudenberger.de]:222 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBOS447cAWRZgHPs6MOoRS6/J66oY753QPiM7BI63/qNDd5qrCan153dJd5lBGwDR0vMWiV/0cmzuACfP5QS1Lv8=
+    '')
+    ];
+  };
 }

From fadfd47e3f265e4382f302f7449e211ef878507e Mon Sep 17 00:00:00 2001
From: JuliusFreudenberger <julius+git@jfreudenberger.de>
Date: Thu, 18 Sep 2025 01:11:06 +0200
Subject: [PATCH 27/29] Configure teleport on srv01-hf

---
 hosts/srv01.hf/default.nix | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/hosts/srv01.hf/default.nix b/hosts/srv01.hf/default.nix
index 1cea677..f8a2c5b 100644
--- a/hosts/srv01.hf/default.nix
+++ b/hosts/srv01.hf/default.nix
@@ -15,11 +15,21 @@
       ../../modules/sshd.nix
       ../../modules/qemu-guest.nix
       ../../modules/docker.nix
+      ../../modules/teleport.nix
       ../../modules/auto-upgrade.nix
       # Include the results of the hardware scan.
       ./hardware-configuration.nix
     ];
 
+  services.openssh.openFirewall = false;
+  services.teleport = {
+    enable = true;
+    settings.teleport = {
+      ca_pin = config.age.secrets."teleport-ca_pin".path;
+      auth_token = config.age.secrets."teleport-join_token".path;
+    };
+  };
+
   systemd.network = {
     enable = true;
       networks."10-wan" = {

From cfc8f986b7e9a6680039358f03789f35395e5e22 Mon Sep 17 00:00:00 2001
From: JuliusFreudenberger <julius+git@jfreudenberger.de>
Date: Thu, 18 Sep 2025 01:11:57 +0200
Subject: [PATCH 28/29] Add portainer_agent module and configure srv01-hf for
 it

---
 hosts/srv01.hf/default.nix  |  3 +++
 hosts/srv01.hf/secrets.nix  |  1 +
 modules/portainer_agent.nix | 21 +++++++++++++++++++++
 3 files changed, 25 insertions(+)
 create mode 100644 modules/portainer_agent.nix

diff --git a/hosts/srv01.hf/default.nix b/hosts/srv01.hf/default.nix
index f8a2c5b..feb2183 100644
--- a/hosts/srv01.hf/default.nix
+++ b/hosts/srv01.hf/default.nix
@@ -16,6 +16,7 @@
       ../../modules/qemu-guest.nix
       ../../modules/docker.nix
       ../../modules/teleport.nix
+      ../../modules/portainer_agent.nix
       ../../modules/auto-upgrade.nix
       # Include the results of the hardware scan.
       ./hardware-configuration.nix
@@ -30,6 +31,8 @@
     };
   };
 
+  virtualisation.oci-containers.containers.portainer_agent.environmentFiles = [ config.age.secrets."portainer-join_token".path ];
+
   systemd.network = {
     enable = true;
       networks."10-wan" = {
diff --git a/hosts/srv01.hf/secrets.nix b/hosts/srv01.hf/secrets.nix
index 9b8fb86..8697e77 100644
--- a/hosts/srv01.hf/secrets.nix
+++ b/hosts/srv01.hf/secrets.nix
@@ -3,5 +3,6 @@
   age.secrets = {
     teleport-ca_pin.file = "${inputs.secrets}/secrets/teleport/ca_pin";
     teleport-join_token.file = "${inputs.secrets}/secrets/srv01-hf/teleport_auth_token";
+    portainer-join_token.file = "${inputs.secrets}/secrets/srv01-hf/portainer_join_token";
   };
 }
diff --git a/modules/portainer_agent.nix b/modules/portainer_agent.nix
new file mode 100644
index 0000000..8bebd6c
--- /dev/null
+++ b/modules/portainer_agent.nix
@@ -0,0 +1,21 @@
+{
+  ...
+}: {
+  virtualisation.oci-containers.containers = {
+    portainer_agent = {
+      image = "portainer/agent:2.33.1";
+      volumes = [
+        "/var/run/docker.sock:/var/run/docker.sock"
+        "/var/lib/docker/volumes:/var/lib/docker/volumes"
+        "/:/host"
+      ];
+      environment = {
+        EDGE = "1";
+        CAP_HOST_MANAGEMENT = "1";
+      };
+      extraOptions = [
+        ''--mount=type=volume,source=portainer_agent,target=/data,volume-driver=local''
+      ];
+    };
+  };
+}

From 0b336f6058bd1aad6c4057d0b6cd6e8a05cb97be Mon Sep 17 00:00:00 2001
From: JuliusFreudenberger <julius+git@jfreudenberger.de>
Date: Thu, 18 Sep 2025 01:12:18 +0200
Subject: [PATCH 29/29] Update flake.lock

---
 flake.lock | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/flake.lock b/flake.lock
index 8a290db..9a46a8b 100644
--- a/flake.lock
+++ b/flake.lock
@@ -319,11 +319,11 @@
     "secrets": {
       "flake": false,
       "locked": {
-        "lastModified": 1758144826,
-        "narHash": "sha256-iP17+7kzDVsMa66W1RmAx6LQzQVCSYj7QemyhuZMUFQ=",
+        "lastModified": 1758149260,
+        "narHash": "sha256-Pgw5Krmc27t+7On6fwHJWx0nuoLRu0XqwN5MHaZ5kys=",
         "ref": "refs/heads/main",
-        "rev": "8ed4ae40d7b203880e368f5822260f0cd2ed0229",
-        "revCount": 2,
+        "rev": "50fd7d5277505cbb3235aae9719d3b8b0c7fe692",
+        "revCount": 5,
         "type": "git",
         "url": "ssh://git@git.jfreudenberger.de/JuliusFreudenberger/nix-private.git"
       },