add .envrc files

fix settings and add dummy view
This introduces customisation to `settings.py` that - allow controlling the relevant parameters from our systemd wrapper (more brittle and non-obvious than it should be, see TODOs) - correctly configure SASS processing and static file compression (not as easy as it sounds)
2025-02-13 14:48:21 +01:00 · 2025-02-13 00:26:28 +01:00 · 2025-02-13 00:26:28 +01:00 · 2025-02-13 00:26:28 +01:00 · 2025-02-10 15:05:21 +01:00 · 2025-02-10 15:03:49 +01:00
58 changed files with 1474 additions and 895 deletions
--- a/.envrc
+++ b/.envrc
@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+# the shebang is ignored, but nice for editors
+
+# shellcheck shell=bash
+if type -P lorri &>/dev/null; then
+  eval "$(lorri direnv --flake .)"
+else
+  echo 'while direnv evaluated .envrc, could not find the command "lorri" [https://github.com/nix-community/lorri]'
+  use flake
+fi
--- a/.gitignore
+++ b/.gitignore
@ -6,7 +6,6 @@ tmp/
 .proxmox
 /.pre-commit-config.yaml
 nixos.qcow2
-.envrc
 .direnv
 result*
 .nixos-test-history
--- a/README.md
+++ b/README.md
@ -24,10 +24,6 @@ details as to what they are for. As an overview:
 - [`secrets/`](./secrets) contains the secrets that need to get injected into
  machine configurations.

- [`server/`](./server) contains the configuration of the VM hosting the
-  website. This should be integrated into `infra/` shortly in the future, as
-  tracked in https://git.fediversity.eu/Fediversity/Fediversity/issues/31.
-
 - [`services/`](./services) contains our effort to make Fediverse applications
  work seemlessly together in our specific setting.

--- a/deployment/proxmox/provision.sh
+++ b/deployment/proxmox/provision.sh
@ -178,7 +178,11 @@ upload_iso () {
 ## Remove ISO

 remove_iso () {
-  printf 'Removing ISO for VM %d... unsupported for now. (FIXME)\n' $1
+  printf 'Removing ISO for VM %d...\n' $1
+
+  proxmox_sync DELETE $apiurl/nodes/$node/storage/local/content/local:iso/installer-fedi$1.iso
+
+  printf 'done removing ISO for VM %d.\n' $1
 }

 ################################################################################
--- a/flake.lock
+++ b/flake.lock
@ -8,11 +8,11 @@
        "systems": "systems"
      },
      "locked": {
-        "lastModified": 1723293904,
-        "narHash": "sha256-b+uqzj+Wa6xgMS9aNbX4I+sXeb5biPDi39VgvSFqFvU=",
+        "lastModified": 1736955230,
+        "narHash": "sha256-uenf8fv2eG5bKM8C/UvFaiJMZ4IpUFaQxk9OH5t/1gA=",
        "owner": "ryantm",
        "repo": "agenix",
-        "rev": "f6291c5935fdc4e0bef208cfc0dcab7e3f7a1c41",
+        "rev": "e600439ec4c273cf11e06fe4d9d906fb98fa097c",
        "type": "github"
      },
      "original": {
@ -41,16 +41,16 @@
    "crane_2": {
      "flake": false,
      "locked": {
-        "lastModified": 1699217310,
-        "narHash": "sha256-xpW3VFUG7yE6UE6Wl0dhqencuENSkV7qpnpe9I8VbPw=",
+        "lastModified": 1727316705,
+        "narHash": "sha256-/mumx8AQ5xFuCJqxCIOFCHTVlxHkMT21idpbgbm/TIE=",
        "owner": "ipetkov",
        "repo": "crane",
-        "rev": "d535642bbe6f377077f7c23f0febb78b1463f449",
+        "rev": "5b03654ce046b5167e7b0bccbd8244cb56c16f0e",
        "type": "github"
      },
      "original": {
        "owner": "ipetkov",
-        "ref": "v0.15.0",
+        "ref": "v0.19.0",
        "repo": "crane",
        "type": "github"
      }
@ -82,11 +82,11 @@
        "nixpkgs": "nixpkgs_2"
      },
      "locked": {
-        "lastModified": 1731274291,
-        "narHash": "sha256-cZ0QMpv5p2a6WEE+o9uu0a4ma6RzQDOQTbm7PbixWz8=",
+        "lastModified": 1738148035,
+        "narHash": "sha256-KYOATYEwaKysL3HdHdS5kbQMXvzS4iPJzJrML+3TKAo=",
        "owner": "nix-community",
        "repo": "disko",
-        "rev": "486250f404f4a4f4f33f8f669d83ca5f6e6b7dfc",
+        "rev": "18d0a984cc2bc82cf61df19523a34ad463aa7f54",
        "type": "github"
      },
      "original": {
@ -106,11 +106,11 @@
        "pyproject-nix": "pyproject-nix"
      },
      "locked": {
-        "lastModified": 1732214960,
-        "narHash": "sha256-ViyEMSYwaza6y55XTDrsRi2K4YKCLsefMTorjWSE27s=",
+        "lastModified": 1735160684,
+        "narHash": "sha256-n5CwhmqKxifuD4Sq4WuRP/h5LO6f23cGnSAuJemnd/4=",
        "owner": "nix-community",
        "repo": "dream2nix",
-        "rev": "a8dac99db44307fdecead13a39c584b97812d0d4",
+        "rev": "8ce6284ff58208ed8961681276f82c2f8f978ef4",
        "type": "github"
      },
      "original": {
@ -123,6 +123,7 @@
      "inputs": {
        "nixpkgs": [
          "nixops4-nixos",
+          "nixops4",
          "nix-cargo-integration",
          "nixpkgs"
        ],
@ -130,11 +131,11 @@
        "pyproject-nix": "pyproject-nix_2"
      },
      "locked": {
-        "lastModified": 1722526955,
-        "narHash": "sha256-fFS8aDnfK9Qfm2FLnQ8pqWk8FzvFEv5LvTuZTZLREnc=",
+        "lastModified": 1735160684,
+        "narHash": "sha256-n5CwhmqKxifuD4Sq4WuRP/h5LO6f23cGnSAuJemnd/4=",
        "owner": "nix-community",
        "repo": "dream2nix",
-        "rev": "3fd4c14d3683baac8d1f94286ae14fe160888b51",
+        "rev": "8ce6284ff58208ed8961681276f82c2f8f978ef4",
        "type": "github"
      },
      "original": {
@ -162,11 +163,11 @@
    "flake-compat_2": {
      "flake": false,
      "locked": {
-        "lastModified": 1696426674,
-        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
+        "lastModified": 1733328505,
+        "narHash": "sha256-NeCCThCEP3eCl2l/+27kNNK7QrwZB1IJCrXfrbv5oqU=",
        "owner": "edolstra",
        "repo": "flake-compat",
-        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
+        "rev": "ff81ac966bb2cae68946d5ed5fc4994f96d0ffec",
        "type": "github"
      },
      "original": {
@ -207,16 +208,48 @@
        "type": "github"
      }
    },
+    "flake-compat_5": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1733328505,
+        "narHash": "sha256-NeCCThCEP3eCl2l/+27kNNK7QrwZB1IJCrXfrbv5oqU=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "ff81ac966bb2cae68946d5ed5fc4994f96d0ffec",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "flake-compat_6": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1696426674,
+        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
    "flake-parts": {
      "inputs": {
        "nixpkgs-lib": "nixpkgs-lib"
      },
      "locked": {
-        "lastModified": 1730504689,
-        "narHash": "sha256-hgmguH29K2fvs9szpq2r3pz2/8cJd2LPS+b4tfNFCwE=",
+        "lastModified": 1736143030,
+        "narHash": "sha256-+hu54pAoLDEZT9pjHlqL9DNzWz0NbUn8NEAHP7PQPzU=",
        "owner": "hercules-ci",
        "repo": "flake-parts",
-        "rev": "506278e768c2a08bec68eb62932193e341f55c90",
+        "rev": "b905f6fc23a9051a6e1b741e1438dbfc0634c6de",
        "type": "github"
      },
      "original": {
@ -230,11 +263,11 @@
        "nixpkgs-lib": "nixpkgs-lib_2"
      },
      "locked": {
-        "lastModified": 1730504689,
-        "narHash": "sha256-hgmguH29K2fvs9szpq2r3pz2/8cJd2LPS+b4tfNFCwE=",
+        "lastModified": 1736143030,
+        "narHash": "sha256-+hu54pAoLDEZT9pjHlqL9DNzWz0NbUn8NEAHP7PQPzU=",
        "owner": "hercules-ci",
        "repo": "flake-parts",
-        "rev": "506278e768c2a08bec68eb62932193e341f55c90",
+        "rev": "b905f6fc23a9051a6e1b741e1438dbfc0634c6de",
        "type": "github"
      },
      "original": {
@ -252,11 +285,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1719994518,
-        "narHash": "sha256-pQMhCCHyQGRzdfAkdJ4cIWiw+JNuWsTX7f0ZYSyz0VY=",
+        "lastModified": 1733312601,
+        "narHash": "sha256-4pDvzqnegAfRkPwO3wmwBhVi/Sye1mzps0zHWYnP88c=",
        "owner": "hercules-ci",
        "repo": "flake-parts",
-        "rev": "9227223f6d922fee3c7b190b2cc238a99527bbb7",
+        "rev": "205b12d8b7cd4802fbcb8e8ef6a0f1408781a4f9",
        "type": "github"
      },
      "original": {
@ -284,19 +317,38 @@
      }
    },
    "flake-parts_5": {
+      "inputs": {
+        "nixpkgs-lib": "nixpkgs-lib_4"
+      },
+      "locked": {
+        "lastModified": 1736143030,
+        "narHash": "sha256-+hu54pAoLDEZT9pjHlqL9DNzWz0NbUn8NEAHP7PQPzU=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "b905f6fc23a9051a6e1b741e1438dbfc0634c6de",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
+    "flake-parts_6": {
      "inputs": {
        "nixpkgs-lib": [
          "nixops4-nixos",
+          "nixops4",
          "nix",
          "nixpkgs"
        ]
      },
      "locked": {
-        "lastModified": 1719994518,
-        "narHash": "sha256-pQMhCCHyQGRzdfAkdJ4cIWiw+JNuWsTX7f0ZYSyz0VY=",
+        "lastModified": 1733312601,
+        "narHash": "sha256-4pDvzqnegAfRkPwO3wmwBhVi/Sye1mzps0zHWYnP88c=",
        "owner": "hercules-ci",
        "repo": "flake-parts",
-        "rev": "9227223f6d922fee3c7b190b2cc238a99527bbb7",
+        "rev": "205b12d8b7cd4802fbcb8e8ef6a0f1408781a4f9",
        "type": "github"
      },
      "original": {
@ -309,15 +361,14 @@
      "inputs": {
        "flake-compat": "flake-compat",
        "gitignore": "gitignore",
-        "nixpkgs": "nixpkgs_3",
-        "nixpkgs-stable": "nixpkgs-stable"
+        "nixpkgs": "nixpkgs_3"
      },
      "locked": {
-        "lastModified": 1730814269,
-        "narHash": "sha256-fWPHyhYE6xvMI1eGY3pwBTq85wcy1YXqdzTZF+06nOg=",
+        "lastModified": 1737465171,
+        "narHash": "sha256-R10v2hoJRLq8jcL4syVFag7nIGE7m13qO48wRIukWNg=",
        "owner": "cachix",
        "repo": "git-hooks.nix",
-        "rev": "d70155fdc00df4628446352fc58adc640cd705c2",
+        "rev": "9364dc02281ce2d37a1f55b6e51f7c0f65a75f17",
        "type": "github"
      },
      "original": {
@ -348,11 +399,70 @@
        ]
      },
      "locked": {
-        "lastModified": 1721042469,
-        "narHash": "sha256-6FPUl7HVtvRHCCBQne7Ylp4p+dpP3P/OYuzjztZ4s70=",
+        "lastModified": 1734279981,
+        "narHash": "sha256-NdaCraHPp8iYMWzdXAt5Nv6sA3MUzlCiGiR586TCwo0=",
        "owner": "cachix",
        "repo": "git-hooks.nix",
-        "rev": "f451c19376071a90d8c58ab1a953c6e9840527fd",
+        "rev": "aa9f40c906904ebd83da78e7f328cd8aeaeae785",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "type": "github"
+      }
+    },
+    "git-hooks-nix_2": {
+      "inputs": {
+        "flake-compat": "flake-compat_4",
+        "gitignore": "gitignore_2",
+        "nixpkgs": "nixpkgs_5"
+      },
+      "locked": {
+        "lastModified": 1737465171,
+        "narHash": "sha256-R10v2hoJRLq8jcL4syVFag7nIGE7m13qO48wRIukWNg=",
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "rev": "9364dc02281ce2d37a1f55b6e51f7c0f65a75f17",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "type": "github"
+      }
+    },
+    "git-hooks-nix_3": {
+      "inputs": {
+        "flake-compat": [
+          "nixops4-nixos",
+          "nixops4",
+          "nix"
+        ],
+        "gitignore": [
+          "nixops4-nixos",
+          "nixops4",
+          "nix"
+        ],
+        "nixpkgs": [
+          "nixops4-nixos",
+          "nixops4",
+          "nix",
+          "nixpkgs"
+        ],
+        "nixpkgs-stable": [
+          "nixops4-nixos",
+          "nixops4",
+          "nix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1734279981,
+        "narHash": "sha256-NdaCraHPp8iYMWzdXAt5Nv6sA3MUzlCiGiR586TCwo0=",
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "rev": "aa9f40c906904ebd83da78e7f328cd8aeaeae785",
        "type": "github"
      },
      "original": {
@ -382,6 +492,28 @@
        "type": "github"
      }
    },
+    "gitignore_2": {
+      "inputs": {
+        "nixpkgs": [
+          "nixops4-nixos",
+          "git-hooks-nix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1709087332,
+        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "type": "github"
+      }
+    },
    "home-manager": {
      "inputs": {
        "nixpkgs": [
@ -403,39 +535,6 @@
        "type": "github"
      }
    },
-    "libgit2": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1715853528,
-        "narHash": "sha256-J2rCxTecyLbbDdsyBWn9w7r3pbKRMkI9E7RvRgAqBdY=",
-        "owner": "libgit2",
-        "repo": "libgit2",
-        "rev": "36f7e21ad757a3dacc58cf7944329da6bc1d6e96",
-        "type": "github"
-      },
-      "original": {
-        "owner": "libgit2",
-        "ref": "v1.8.1",
-        "repo": "libgit2",
-        "type": "github"
-      }
-    },
-    "libgit2_2": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1724328629,
-        "narHash": "sha256-7SuD4k+ORwFPwDm5Qr5eSV6GMVWjMfFed9KYi8riUQo=",
-        "owner": "libgit2",
-        "repo": "libgit2",
-        "rev": "782e29c906f6e44b120843356f286b6a97d89f88",
-        "type": "github"
-      },
-      "original": {
-        "owner": "libgit2",
-        "repo": "libgit2",
-        "type": "github"
-      }
-    },
    "mk-naked-shell": {
      "flake": false,
      "locked": {
@ -473,7 +572,6 @@
        "flake-compat": "flake-compat_2",
        "flake-parts": "flake-parts_3",
        "git-hooks-nix": "git-hooks-nix",
-        "libgit2": "libgit2",
        "nixpkgs": [
          "nixops4",
          "nixpkgs"
@ -482,11 +580,11 @@
        "nixpkgs-regression": "nixpkgs-regression"
      },
      "locked": {
-        "lastModified": 1732892090,
-        "narHash": "sha256-Ka/uNdaqpTAiVL++4MPHg8fG5o1tiJeY6G2t5UiKhd8=",
+        "lastModified": 1736342444,
+        "narHash": "sha256-u6OD0BH+UxyfrWMMpBfM5cz/TDWU9lxJOujgzqBnN9A=",
        "owner": "NixOS",
        "repo": "nix",
-        "rev": "64000481168d1da9d2519f055dd1fdee22275c21",
+        "rev": "5230d3ecc4cd3a3d965902a56b5a21bcc99821c3",
        "type": "github"
      },
      "original": {
@ -510,11 +608,11 @@
        "treefmt": "treefmt"
      },
      "locked": {
-        "lastModified": 1733033761,
-        "narHash": "sha256-g7TCUozMeW3q5Uc+wmZI64yzFucQ3SYlZQepo7prarA=",
+        "lastModified": 1736316962,
+        "narHash": "sha256-nOWLP6pSblYrCipiBb7/SQpGhNe7AHT8m9f++b8/Ni4=",
        "owner": "yusdacra",
        "repo": "nix-cargo-integration",
-        "rev": "413617712f5189397cdf602485f89bf2b0a0e4af",
+        "rev": "1ce1f666c955e73f65de74f3a8c3ca2c3e5d741b",
        "type": "github"
      },
      "original": {
@ -530,6 +628,7 @@
        "mk-naked-shell": "mk-naked-shell_2",
        "nixpkgs": [
          "nixops4-nixos",
+          "nixops4",
          "nixpkgs"
        ],
        "parts": "parts_2",
@ -537,11 +636,11 @@
        "treefmt": "treefmt_2"
      },
      "locked": {
-        "lastModified": 1724393640,
-        "narHash": "sha256-fjwO6Pv3d35F6UErY42hc7zXJr6ek0LhSZlgEu+eI04=",
+        "lastModified": 1736316962,
+        "narHash": "sha256-nOWLP6pSblYrCipiBb7/SQpGhNe7AHT8m9f++b8/Ni4=",
        "owner": "yusdacra",
        "repo": "nix-cargo-integration",
-        "rev": "3a8e3bb661db28522aa2d4a55f1fccf9f95ec33e",
+        "rev": "1ce1f666c955e73f65de74f3a8c3ca2c3e5d741b",
        "type": "github"
      },
      "original": {
@ -552,29 +651,29 @@
    },
    "nix_2": {
      "inputs": {
-        "flake-compat": "flake-compat_4",
-        "flake-parts": "flake-parts_5",
-        "libgit2": "libgit2_2",
+        "flake-compat": "flake-compat_5",
+        "flake-parts": "flake-parts_6",
+        "git-hooks-nix": "git-hooks-nix_3",
        "nixpkgs": [
          "nixops4-nixos",
+          "nixops4",
          "nixpkgs"
        ],
        "nixpkgs-23-11": "nixpkgs-23-11_2",
-        "nixpkgs-regression": "nixpkgs-regression_2",
-        "pre-commit-hooks": "pre-commit-hooks"
+        "nixpkgs-regression": "nixpkgs-regression_2"
      },
      "locked": {
-        "lastModified": 1719448136,
-        "narHash": "sha256-ya0iofP+QysNzN7Gx7Btfe83ZW1YLpSdkccUNMnbBFQ=",
+        "lastModified": 1736342444,
+        "narHash": "sha256-u6OD0BH+UxyfrWMMpBfM5cz/TDWU9lxJOujgzqBnN9A=",
        "owner": "NixOS",
        "repo": "nix",
-        "rev": "ed129267dcd7dd2cce48c09b17aefd6cfc488bcd",
+        "rev": "5230d3ecc4cd3a3d965902a56b5a21bcc99821c3",
        "type": "github"
      },
      "original": {
        "owner": "NixOS",
+        "ref": "master",
        "repo": "nix",
-        "rev": "ed129267dcd7dd2cce48c09b17aefd6cfc488bcd",
        "type": "github"
      }
    },
@ -587,11 +686,11 @@
        "nixpkgs-old": "nixpkgs-old"
      },
      "locked": {
-        "lastModified": 1733171846,
-        "narHash": "sha256-MmWzxuH9bwBIM7/LQsJc6x/7S2YofWWPqwzLaqqudDQ=",
+        "lastModified": 1738308843,
+        "narHash": "sha256-I/+T3qhlcHDP628UjWqugdFKHEsjIA3blWqnoPxQTQ0=",
        "owner": "nixops4",
        "repo": "nixops4",
-        "rev": "b9dc536b7a0ea6dd947949c59c545e7fa604351a",
+        "rev": "7e83532e61aa70bccffea93d82e311e0ce07a4d1",
        "type": "github"
      },
      "original": {
@ -603,21 +702,49 @@
    "nixops4-nixos": {
      "inputs": {
        "flake-parts": "flake-parts_4",
-        "nix": "nix_2",
-        "nix-cargo-integration": "nix-cargo-integration_2",
-        "nixpkgs": "nixpkgs_5"
+        "git-hooks-nix": "git-hooks-nix_2",
+        "nixops4": "nixops4_2",
+        "nixops4-nixos": [
+          "nixops4-nixos"
+        ],
+        "nixpkgs": [
+          "nixops4-nixos",
+          "nixops4",
+          "nixpkgs"
+        ]
      },
      "locked": {
-        "lastModified": 1727424043,
-        "narHash": "sha256-00Tm2hCF8xBZk4HmzsaoPGtvRVamq3OujE5xWyHm8FI=",
+        "lastModified": 1738310839,
+        "narHash": "sha256-dWTVaxENWTq6s7mO7xDxt2ml7pEHSYfHkm5h4yCQnIA=",
        "owner": "nixops4",
-        "repo": "nixops4",
-        "rev": "924af9b0f3666f22c638c02a21bc73a2ba002674",
+        "repo": "nixops4-nixos",
+        "rev": "65fe4b132fe299e03ee387d67d3fee1eb4593f4f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixops4",
+        "repo": "nixops4-nixos",
+        "type": "github"
+      }
+    },
+    "nixops4_2": {
+      "inputs": {
+        "flake-parts": "flake-parts_5",
+        "nix": "nix_2",
+        "nix-cargo-integration": "nix-cargo-integration_2",
+        "nixpkgs": "nixpkgs_6",
+        "nixpkgs-old": "nixpkgs-old_2"
+      },
+      "locked": {
+        "lastModified": 1738308843,
+        "narHash": "sha256-I/+T3qhlcHDP628UjWqugdFKHEsjIA3blWqnoPxQTQ0=",
+        "owner": "nixops4",
+        "repo": "nixops4",
+        "rev": "7e83532e61aa70bccffea93d82e311e0ce07a4d1",
        "type": "github"
      },
      "original": {
        "owner": "nixops4",
-        "ref": "eval",
        "repo": "nixops4",
        "type": "github"
      }
@ -672,26 +799,26 @@
    },
    "nixpkgs-lib": {
      "locked": {
-        "lastModified": 1730504152,
-        "narHash": "sha256-lXvH/vOfb4aGYyvFmZK/HlsNsr/0CVWlwYvo2rxJk3s=",
+        "lastModified": 1735774519,
+        "narHash": "sha256-CewEm1o2eVAnoqb6Ml+Qi9Gg/EfNAxbRx1lANGVyoLI=",
        "type": "tarball",
-        "url": "https://github.com/NixOS/nixpkgs/archive/cc2f28000298e1269cea6612cd06ec9979dd5d7f.tar.gz"
+        "url": "https://github.com/NixOS/nixpkgs/archive/e9b51731911566bbf7e4895475a87fe06961de0b.tar.gz"
      },
      "original": {
        "type": "tarball",
-        "url": "https://github.com/NixOS/nixpkgs/archive/cc2f28000298e1269cea6612cd06ec9979dd5d7f.tar.gz"
+        "url": "https://github.com/NixOS/nixpkgs/archive/e9b51731911566bbf7e4895475a87fe06961de0b.tar.gz"
      }
    },
    "nixpkgs-lib_2": {
      "locked": {
-        "lastModified": 1730504152,
-        "narHash": "sha256-lXvH/vOfb4aGYyvFmZK/HlsNsr/0CVWlwYvo2rxJk3s=",
+        "lastModified": 1735774519,
+        "narHash": "sha256-CewEm1o2eVAnoqb6Ml+Qi9Gg/EfNAxbRx1lANGVyoLI=",
        "type": "tarball",
-        "url": "https://github.com/NixOS/nixpkgs/archive/cc2f28000298e1269cea6612cd06ec9979dd5d7f.tar.gz"
+        "url": "https://github.com/NixOS/nixpkgs/archive/e9b51731911566bbf7e4895475a87fe06961de0b.tar.gz"
      },
      "original": {
        "type": "tarball",
-        "url": "https://github.com/NixOS/nixpkgs/archive/cc2f28000298e1269cea6612cd06ec9979dd5d7f.tar.gz"
+        "url": "https://github.com/NixOS/nixpkgs/archive/e9b51731911566bbf7e4895475a87fe06961de0b.tar.gz"
      }
    },
    "nixpkgs-lib_3": {
@ -706,13 +833,41 @@
        "url": "https://github.com/NixOS/nixpkgs/archive/356624c12086a18f2ea2825fed34523d60ccc4e3.tar.gz"
      }
    },
+    "nixpkgs-lib_4": {
+      "locked": {
+        "lastModified": 1735774519,
+        "narHash": "sha256-CewEm1o2eVAnoqb6Ml+Qi9Gg/EfNAxbRx1lANGVyoLI=",
+        "type": "tarball",
+        "url": "https://github.com/NixOS/nixpkgs/archive/e9b51731911566bbf7e4895475a87fe06961de0b.tar.gz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://github.com/NixOS/nixpkgs/archive/e9b51731911566bbf7e4895475a87fe06961de0b.tar.gz"
+      }
+    },
    "nixpkgs-old": {
      "locked": {
-        "lastModified": 1733016324,
-        "narHash": "sha256-8qwPSE2g1othR1u4uP86NXxm6i7E9nHPyJX3m3lx7Q4=",
+        "lastModified": 1735563628,
+        "narHash": "sha256-OnSAY7XDSx7CtDoqNh8jwVwh4xNL/2HaJxGjryLWzX8=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "7e1ca67996afd8233d9033edd26e442836cc2ad6",
+        "rev": "b134951a4c9f3c995fd7be05f3243f8ecd65d798",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-24.05",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs-old_2": {
+      "locked": {
+        "lastModified": 1735563628,
+        "narHash": "sha256-OnSAY7XDSx7CtDoqNh8jwVwh4xNL/2HaJxGjryLWzX8=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "b134951a4c9f3c995fd7be05f3243f8ecd65d798",
        "type": "github"
      },
      "original": {
@ -754,29 +909,13 @@
        "type": "github"
      }
    },
-    "nixpkgs-stable": {
-      "locked": {
-        "lastModified": 1730741070,
-        "narHash": "sha256-edm8WG19kWozJ/GqyYx2VjW99EdhjKwbY3ZwdlPAAlo=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "d063c1dd113c91ab27959ba540c0d9753409edf3",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-24.05",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
    "nixpkgs_2": {
      "locked": {
-        "lastModified": 1730958623,
-        "narHash": "sha256-JwQZIGSYnRNOgDDoIgqKITrPVil+RMWHsZH1eE1VGN0=",
+        "lastModified": 1737879851,
+        "narHash": "sha256-H+FXIKj//kmFHTTW4DFeOjR7F1z2/3eb2iwN6Me4YZk=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "85f7e662eda4fa3a995556527c87b2524b691933",
+        "rev": "5d3221fd57cc442a1a522a15eb5f58230f45a304",
        "type": "github"
      },
      "original": {
@ -788,11 +927,11 @@
    },
    "nixpkgs_3": {
      "locked": {
-        "lastModified": 1730958623,
-        "narHash": "sha256-JwQZIGSYnRNOgDDoIgqKITrPVil+RMWHsZH1eE1VGN0=",
+        "lastModified": 1730768919,
+        "narHash": "sha256-8AKquNnnSaJRXZxc5YmF/WfmxiHX6MMZZasRP6RRQkE=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "85f7e662eda4fa3a995556527c87b2524b691933",
+        "rev": "a04d33c0c3f1a59a2c1cb0c6e34cd24500e5a1dc",
        "type": "github"
      },
      "original": {
@ -804,11 +943,11 @@
    },
    "nixpkgs_4": {
      "locked": {
-        "lastModified": 1732837521,
-        "narHash": "sha256-jNRNr49UiuIwaarqijgdTR2qLPifxsVhlJrKzQ8XUIE=",
+        "lastModified": 1737469691,
+        "narHash": "sha256-nmKOgAU48S41dTPIXAq0AHZSehWUn6ZPrUKijHAMmIk=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "970e93b9f82e2a0f3675757eb0bfc73297cc6370",
+        "rev": "9e4d5190a9482a1fb9d18adf0bdb83c6e506eaab",
        "type": "github"
      },
      "original": {
@ -820,11 +959,27 @@
    },
    "nixpkgs_5": {
      "locked": {
-        "lastModified": 1724819573,
-        "narHash": "sha256-GnR7/ibgIH1vhoy8cYdmXE6iyZqKqFxQSVkFgosBh6w=",
+        "lastModified": 1730768919,
+        "narHash": "sha256-8AKquNnnSaJRXZxc5YmF/WfmxiHX6MMZZasRP6RRQkE=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "71e91c409d1e654808b2621f28a327acfdad8dc2",
+        "rev": "a04d33c0c3f1a59a2c1cb0c6e34cd24500e5a1dc",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixpkgs-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_6": {
+      "locked": {
+        "lastModified": 1737469691,
+        "narHash": "sha256-nmKOgAU48S41dTPIXAq0AHZSehWUn6ZPrUKijHAMmIk=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "9e4d5190a9482a1fb9d18adf0bdb83c6e506eaab",
        "type": "github"
      },
      "original": {
@ -834,13 +989,13 @@
        "type": "github"
      }
    },
-    "nixpkgs_6": {
+    "nixpkgs_7": {
      "locked": {
-        "lastModified": 1734323986,
-        "narHash": "sha256-m/lh6hYMIWDYHCAsn81CDAiXoT3gmxXI9J987W5tZrE=",
+        "lastModified": 1738163270,
+        "narHash": "sha256-B/7Y1v4y+msFFBW1JAdFjNvVthvNdJKiN6EGRPnqfno=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "394571358ce82dff7411395829aa6a3aad45b907",
+        "rev": "59e618d90c065f55ae48446f307e8c09565d5ab0",
        "type": "github"
      },
      "original": {
@ -859,11 +1014,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1730504689,
-        "narHash": "sha256-hgmguH29K2fvs9szpq2r3pz2/8cJd2LPS+b4tfNFCwE=",
+        "lastModified": 1736143030,
+        "narHash": "sha256-+hu54pAoLDEZT9pjHlqL9DNzWz0NbUn8NEAHP7PQPzU=",
        "owner": "hercules-ci",
        "repo": "flake-parts",
-        "rev": "506278e768c2a08bec68eb62932193e341f55c90",
+        "rev": "b905f6fc23a9051a6e1b741e1438dbfc0634c6de",
        "type": "github"
      },
      "original": {
@ -876,16 +1031,17 @@
      "inputs": {
        "nixpkgs-lib": [
          "nixops4-nixos",
+          "nixops4",
          "nix-cargo-integration",
          "nixpkgs"
        ]
      },
      "locked": {
-        "lastModified": 1722555600,
-        "narHash": "sha256-XOQkdLafnb/p9ij77byFQjDf5m5QYl9b2REiVClC+x4=",
+        "lastModified": 1736143030,
+        "narHash": "sha256-+hu54pAoLDEZT9pjHlqL9DNzWz0NbUn8NEAHP7PQPzU=",
        "owner": "hercules-ci",
        "repo": "flake-parts",
-        "rev": "8471fe90ad337a8074e957b69ca4d0089218391d",
+        "rev": "b905f6fc23a9051a6e1b741e1438dbfc0634c6de",
        "type": "github"
      },
      "original": {
@ -894,41 +1050,6 @@
        "type": "github"
      }
    },
-    "pre-commit-hooks": {
-      "inputs": {
-        "flake-compat": [
-          "nixops4-nixos",
-          "nix"
-        ],
-        "gitignore": [
-          "nixops4-nixos",
-          "nix"
-        ],
-        "nixpkgs": [
-          "nixops4-nixos",
-          "nix",
-          "nixpkgs"
-        ],
-        "nixpkgs-stable": [
-          "nixops4-nixos",
-          "nix",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1724857454,
-        "narHash": "sha256-Qyl9Q4QMTLZnnBb/8OuQ9LSkzWjBU1T5l5zIzTxkkhk=",
-        "owner": "cachix",
-        "repo": "pre-commit-hooks.nix",
-        "rev": "4509ca64f1084e73bc7a721b20c669a8d4c5ebe6",
-        "type": "github"
-      },
-      "original": {
-        "owner": "cachix",
-        "repo": "pre-commit-hooks.nix",
-        "type": "github"
-      }
-    },
    "purescript-overlay": {
      "inputs": {
        "flake-compat": "flake-compat_3",
@ -956,8 +1077,10 @@
    },
    "purescript-overlay_2": {
      "inputs": {
+        "flake-compat": "flake-compat_6",
        "nixpkgs": [
          "nixops4-nixos",
+          "nixops4",
          "nix-cargo-integration",
          "dream2nix",
          "nixpkgs"
@ -965,11 +1088,11 @@
        "slimlock": "slimlock_2"
      },
      "locked": {
-        "lastModified": 1696022621,
-        "narHash": "sha256-eMjFmsj2G1E0Q5XiibUNgFjTiSz0GxIeSSzzVdoN730=",
+        "lastModified": 1728546539,
+        "narHash": "sha256-Sws7w0tlnjD+Bjck1nv29NjC5DbL6nH5auL9Ex9Iz2A=",
        "owner": "thomashoneyman",
        "repo": "purescript-overlay",
-        "rev": "047c7933abd6da8aa239904422e22d190ce55ead",
+        "rev": "4ad4c15d07bd899d7346b331f377606631eb0ee4",
        "type": "github"
      },
      "original": {
@ -1020,7 +1143,7 @@
        "git-hooks": "git-hooks",
        "nixops4": "nixops4",
        "nixops4-nixos": "nixops4-nixos",
-        "nixpkgs": "nixpkgs_6"
+        "nixpkgs": "nixpkgs_7"
      }
    },
    "rust-overlay": {
@ -1032,11 +1155,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1733020719,
-        "narHash": "sha256-Chv9+3zrf1DhdB9JyskjoV0vJbCQEgkVqrU3p4RPLv8=",
+        "lastModified": 1736303309,
+        "narHash": "sha256-IKrk7RL+Q/2NC6+Ql6dwwCNZI6T6JH2grTdJaVWHF0A=",
        "owner": "oxalica",
        "repo": "rust-overlay",
-        "rev": "8e18f10703112e6c33e1c0d8b93e8305f6f0a75c",
+        "rev": "a0b81d4fa349d9af1765b0f0b4a899c13776f706",
        "type": "github"
      },
      "original": {
@ -1046,13 +1169,20 @@
      }
    },
    "rust-overlay_2": {
-      "flake": false,
+      "inputs": {
+        "nixpkgs": [
+          "nixops4-nixos",
+          "nixops4",
+          "nix-cargo-integration",
+          "nixpkgs"
+        ]
+      },
      "locked": {
-        "lastModified": 1724379657,
-        "narHash": "sha256-+CFDh1FUgyY7q0FiWhKJpHS7LlD3KbiqN5Z4Z+4bGmc=",
+        "lastModified": 1736303309,
+        "narHash": "sha256-IKrk7RL+Q/2NC6+Ql6dwwCNZI6T6JH2grTdJaVWHF0A=",
        "owner": "oxalica",
        "repo": "rust-overlay",
-        "rev": "a18034322c7703fcfe5d7352a77981ba4a936a61",
+        "rev": "a0b81d4fa349d9af1765b0f0b4a899c13776f706",
        "type": "github"
      },
      "original": {
@ -1089,6 +1219,7 @@
      "inputs": {
        "nixpkgs": [
          "nixops4-nixos",
+          "nixops4",
          "nix-cargo-integration",
          "dream2nix",
          "purescript-overlay",
@ -1096,11 +1227,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1688610262,
-        "narHash": "sha256-Wg0ViDotFWGWqKIQzyYCgayeH8s4U1OZcTiWTQYdAp4=",
+        "lastModified": 1688756706,
+        "narHash": "sha256-xzkkMv3neJJJ89zo3o2ojp7nFeaZc2G0fYwNXNJRFlo=",
        "owner": "thomashoneyman",
        "repo": "slimlock",
-        "rev": "b5c6cdcaf636ebbebd0a1f32520929394493f1a6",
+        "rev": "cf72723f59e2340d24881fd7bf61cb113b4c407c",
        "type": "github"
      },
      "original": {
@ -1133,11 +1264,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1732894027,
-        "narHash": "sha256-2qbdorpq0TXHBWbVXaTqKoikN4bqAtAplTwGuII+oAc=",
+        "lastModified": 1736154270,
+        "narHash": "sha256-p2r8xhQZ3TYIEKBoiEhllKWQqWNJNoT9v64Vmg4q8Zw=",
        "owner": "numtide",
        "repo": "treefmt-nix",
-        "rev": "6209c381904cab55796c5d7350e89681d3b2a8ef",
+        "rev": "13c913f5deb3a5c08bb810efd89dc8cb24dd968b",
        "type": "github"
      },
      "original": {
@ -1150,16 +1281,17 @@
      "inputs": {
        "nixpkgs": [
          "nixops4-nixos",
+          "nixops4",
          "nix-cargo-integration",
          "nixpkgs"
        ]
      },
      "locked": {
-        "lastModified": 1724338379,
-        "narHash": "sha256-kKJtaiU5Ou+e/0Qs7SICXF22DLx4V/WhG1P6+k4yeOE=",
+        "lastModified": 1736154270,
+        "narHash": "sha256-p2r8xhQZ3TYIEKBoiEhllKWQqWNJNoT9v64Vmg4q8Zw=",
        "owner": "numtide",
        "repo": "treefmt-nix",
-        "rev": "070f834771efa715f3e74cd8ab93ecc96fabc951",
+        "rev": "13c913f5deb3a5c08bb810efd89dc8cb24dd968b",
        "type": "github"
      },
      "original": {
--- a/flake.nix
+++ b/flake.nix
@ -8,7 +8,7 @@
    disko.url = "github:nix-community/disko";

    nixops4.url = "github:nixops4/nixops4";
-    nixops4-nixos.url = "github:nixops4/nixops4/eval";
+    nixops4-nixos.url = "github:nixops4/nixops4-nixos";
  };

  outputs =
@ -23,13 +23,11 @@

      imports = [
        inputs.git-hooks.flakeModule
-        inputs.nixops4-nixos.modules.flake.default
+        inputs.nixops4.modules.flake.default

        ./deployment/flake-part.nix
        ./infra/flake-part.nix
-        ./keys/flake-part.nix
        ./services/flake-part.nix
-        ./secrets/flake-part.nix
      ];

      perSystem =
@ -53,6 +51,7 @@
                "keys"
                "secrets"
                "services"
+                "panel"
              ];
              files = "^((" + concatStringsSep "|" optin + ")/.*\\.nix|[^/]*\\.nix)$";
            in
--- a/infra/README.org
+++ b/infra/README.org
@ -1,26 +1,49 @@
 #+title: Infra

 This directory contains the definition of the VMs that host our infrastructure.
+
+* NixOps4
+
 Their configuration can be updated via NixOps4. Run

 #+begin_src sh
 nixops4 deployments list
 #+end_src

-to see the available deployments. Given a deployment (eg. ~git~), run
+to see the available deployments. This should be done from the root of the
+repository, otherwise NixOps4 will fail with something like:
+
+#+begin_src
+nixops4 error: evaluation: error:
+       … while calling the 'getFlake' builtin
+
+       error: path '/nix/store/05nn7krhvi8wkcyl6bsysznlv60g5rrf-source/flake.nix' does not exist, evaluation: error:
+       … while calling the 'getFlake' builtin
+
+       error: path '/nix/store/05nn7krhvi8wkcyl6bsysznlv60g5rrf-source/flake.nix' does not exist
+#+end_src
+
+Then, given a deployment (eg. ~git~), run

 #+begin_src sh
 nixops4 apply <deployment>
 #+end_src

+Alternatively, to run the ~default~ deployment, run
+
+#+begin_src sh
+nixops4 apply
+#+end_src
+
 * Deployments

+- default :: Contains everything
 - ~git~ :: Machines hosting our Git infrastructure, eg. Forgejo and its actions
  runners
 - ~web~ :: Machines hosting our online content, eg. the website or the wiki
 - ~other~ :: Machines without a specific purpose

-* Procolix machines
+* Machines

 These machines are hosted on the Procolix Proxmox instance, to which
 non-Procolix members of the project do not have access. They host our stable
--- a/infra/common/nixos/default.nix
+++ b/infra/common/nixos/default.nix
--- a/infra/common/nixos/hardware.nix
+++ b/infra/common/nixos/hardware.nix
--- a/infra/common/nixos/networking.nix
+++ b/infra/common/nixos/networking.nix
@ -1,18 +1,10 @@
 { config, lib, ... }:

 let
-  inherit (lib) mkOption mkDefault;
+  inherit (lib) mkDefault;

 in
 {
-  options = {
-    procolix.vm = {
-      name = mkOption { };
-      ip4 = mkOption { };
-      ip6 = mkOption { };
-    };
-  };
-
  config = {
    services.openssh = {
      enable = true;
@ -20,8 +12,8 @@ in
    };

    networking = {
-      hostName = config.procolix.vm.name;
-      domain = "procolix.com";
+      hostName = config.procolixVm.name;
+      domain = config.procolixVm.domain;

      ## REVIEW: Do we actually need that, considering that we have static IPs?
      useDHCP = mkDefault true;
@ -31,16 +23,14 @@ in
          ipv4 = {
            addresses = [
              {
-                address = config.procolix.vm.ip4;
-                prefixLength = 24;
+                inherit (config.procolixVm.ipv4) address prefixLength;
              }
            ];
          };
          ipv6 = {
            addresses = [
              {
-                address = config.procolix.vm.ip6;
-                prefixLength = 64;
+                inherit (config.procolixVm.ipv6) address prefixLength;
              }
            ];
          };
@ -48,11 +38,11 @@ in
      };

      defaultGateway = {
-        address = "185.206.232.1";
+        address = config.procolixVm.ipv4.gateway;
        interface = "eth0";
      };
      defaultGateway6 = {
-        address = "2a00:51c0:12:1201::1";
+        address = config.procolixVm.ipv6.gateway;
        interface = "eth0";
      };

--- a/infra/common/nixos/nftables-ruleset.nft
+++ b/infra/common/nixos/nftables-ruleset.nft
--- a/infra/common/nixos/users.nix
+++ b/infra/common/nixos/users.nix
@ -30,11 +30,4 @@
  security.sudo.wheelNeedsPassword = false;

  nix.settings.trusted-users = [ "@wheel" ];
-
-  ## FIXME: Remove direct root authentication once NixOps4 supports users with
-  ## password-less sudo.
-  users.users.root.openssh.authorizedKeys.keys = [
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEElREJN0AC7lbp+5X204pQ5r030IbgCllsIxyU3iiKY"
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJg5TlS1NGCRZwMjDgBkXeFUXqooqRlM8fJdBAQ4buPg"
-  ];
 }
--- a/infra/common/options.nix
+++ b/infra/common/options.nix
@ -0,0 +1,81 @@
+{ lib, ... }:
+
+let
+  inherit (lib) mkOption;
+
+in
+{
+  options.procolixVm = {
+    name = mkOption {
+      description = ''
+        The name of the machine. Most of the time, this will look like `vm02XXX`
+        or `fediYYY`.
+      '';
+    };
+
+    domain = mkOption {
+      description = ''
+        The domain hosting the machine. Most of the time, this will be either of
+        `procolix.com`, `fediversity.eu` or `abundos.eu`.
+      '';
+      default = "procolix.com";
+    };
+
+    ipv4 = {
+      address = mkOption {
+        description = ''
+          The IP address of the machine, version 4. It will be injected as a
+          value in `networking.interfaces.eth0`, but it will also be used to
+          communicate with the machine via NixOps4.
+        '';
+      };
+
+      prefixLength = mkOption {
+        description = ''
+          The subnet mask of the interface, specified as the number of bits in
+          the prefix.
+        '';
+        default = 24;
+      };
+
+      gateway = mkOption {
+        description = ''
+          The IP address of the default gateway.
+        '';
+        default = "185.206.232.1"; # FIXME: compute default from `address` and `prefixLength`.
+      };
+    };
+
+    ipv6 = {
+      address = mkOption {
+        description = ''
+          The IP address of the machine, version 6. It will be injected as a
+          value in `networking.interfaces.eth0`, but it will also be used to
+          communicate with the machine via NixOps4.
+        '';
+      };
+
+      prefixLength = mkOption {
+        description = ''
+          The subnet mask of the interface, specified as the number of bits in
+          the prefix.
+        '';
+        default = 64;
+      };
+
+      gateway = mkOption {
+        description = ''
+          The IP address of the default gateway.
+        '';
+        default = "2a00:51c0:12:1201::1"; # FIXME: compute default from `address` and `prefixLength`.
+      };
+    };
+
+    hostPublicKey = mkOption {
+      description = ''
+        The host public key of the machine. It is used to filter Age secrets and
+        only keep the relevant ones, and to feed to NixOps4.
+      '';
+    };
+  };
+}
--- a/infra/common/resource.nix
+++ b/infra/common/resource.nix
@ -0,0 +1,57 @@
+{
+  inputs,
+  lib,
+  config,
+  ...
+}:
+
+let
+  inherit (lib) attrValues elem;
+  inherit (lib.attrsets) concatMapAttrs optionalAttrs;
+  inherit (lib.strings) removeSuffix;
+
+  secretsPrefix = ../../secrets;
+  secrets = import (secretsPrefix + "/secrets.nix");
+  keys = import ../../keys;
+  hostPublicKey = keys.systems.${config.procolixVm.name};
+
+in
+{
+  imports = [ ./options.nix ];
+
+  ssh = {
+    host = config.procolixVm.ipv4.address;
+    hostPublicKey = hostPublicKey;
+  };
+
+  nixpkgs = inputs.nixpkgs;
+
+  ## The configuration of the machine. We strive to keep in this file only the
+  ## options that really need to be injected from the resource. Everything else
+  ## should go into the `./nixos` subdirectory.
+  nixos.module = {
+    imports = [
+      inputs.agenix.nixosModules.default
+      ./options.nix
+      ./nixos
+    ];
+
+    ## Inject the shared options from the resource's `config` into the NixOS
+    ## configuration.
+    procolixVm = config.procolixVm;
+
+    ## Read all the secrets, filter the ones that are supposed to be readable
+    ## with this host's public key, and add them correctly to the configuration
+    ## as `age.secrets.<name>.file`.
+    age.secrets = concatMapAttrs (
+      name: secret:
+      optionalAttrs (elem hostPublicKey secret.publicKeys) ({
+        ${removeSuffix ".age" name}.file = secretsPrefix + "/${name}";
+      })
+    ) secrets;
+
+    ## FIXME: Remove direct root authentication once the NixOps4 NixOS provider
+    ## supports users with password-less sudo.
+    users.users.root.openssh.authorizedKeys.keys = attrValues keys.contributors;
+  };
+}
--- a/infra/fedi300/default.nix
+++ b/infra/fedi300/default.nix
@ -1,34 +1,34 @@
-{ lib, ... }:
-
 {
-  imports = [
-    ../common
-    ./forgejo-actions-runner.nix
-  ];
+  procolixVm = {
+    domain = "fediversity.eu";

-  procolix.vm = {
-    name = "fedi300";
-    ip4 = "95.215.187.30";
-    ip6 = "2a00:51c0:12:1305::30";
+    ipv4 = {
+      address = "95.215.187.30";
+      gateway = "95.215.187.1";
+    };
+    ipv6 = {
+      address = "2a00:51c0:12:1305::30";
+      gateway = "2a00:51c0:13:1305::1";
+    };
  };

-  ## FIXME: We should just have an option under `procolix.vm` to distinguish
-  ## between Procolix VMs and Fediversity ones.
-  networking.domain = lib.mkForce "fediversity.eu";
-  networking.defaultGateway.address = lib.mkForce "95.215.187.1";
-  networking.defaultGateway6.address = lib.mkForce "2a00:51c0:13:1305::1";
-
-  fileSystems."/" = {
-    device = "/dev/disk/by-uuid/cbcfaf6b-39bd-4328-9f53-dea8a9d32ecc";
-    fsType = "ext4";
-  };
-
-  fileSystems."/boot" = {
-    device = "/dev/disk/by-uuid/1A4E-07F4";
-    fsType = "vfat";
-    options = [
-      "fmask=0022"
-      "dmask=0022"
+  nixos.module = {
+    imports = [
+      ./forgejo-actions-runner.nix
    ];
+
+    fileSystems."/" = {
+      device = "/dev/disk/by-uuid/cbcfaf6b-39bd-4328-9f53-dea8a9d32ecc";
+      fsType = "ext4";
+    };
+
+    fileSystems."/boot" = {
+      device = "/dev/disk/by-uuid/1A4E-07F4";
+      fsType = "vfat";
+      options = [
+        "fmask=0022"
+        "dmask=0022"
+      ];
+    };
  };
 }
--- a/infra/flake-part.nix
+++ b/infra/flake-part.nix
@ -1,117 +1,45 @@
-{ self, inputs, ... }:
-
 {
-  nixops4Deployments.git =
+  inputs,
+  lib,
+  ...
+}:
+
+let
+  inherit (lib) attrValues concatLists mapAttrs;
+  inherit (lib.attrsets) genAttrs;
+
+  addDefaultDeployment =
+    deployments: deployments // { default = concatLists (attrValues deployments); };
+
+  makeDeployments = mapAttrs (
+    _: vmNames:
    { providers, ... }:
    {
-      providers.local = inputs.nixops4-nixos.modules.nixops4Provider.local;
+      providers.local = inputs.nixops4.modules.nixops4Provider.local;
+      resources = genAttrs vmNames (vmName: {
+        _module.args = { inherit inputs; };
+        type = providers.local.exec;
+        imports = [
+          inputs.nixops4-nixos.modules.nixops4Resource.nixos
+          ./common/resource.nix
+          (./. + "/${vmName}")
+        ];
+        procolixVm.name = vmName;
+      });
+    }
+  );

-      resources = {
-        vm02116 = {
-          type = providers.local.exec;
-          imports = [ inputs.nixops4-nixos.modules.nixops4Resource.nixos ];
-          ssh = {
-            host = "185.206.232.34";
-            opts = "";
-            hostPublicKey = self.keys.systems.vm02116;
-          };
-          nixpkgs = inputs.nixpkgs;
-          nixos.module = {
-            imports = [
-              ./vm02116
-              self.nixosModules.ageSecrets
-              { fediversity.hostPublicKey = self.keys.systems.vm02116; }
-            ];
-          };
-        };
-
-        fedi300 = {
-          type = providers.local.exec;
-          imports = [ inputs.nixops4-nixos.modules.nixops4Resource.nixos ];
-          ssh = {
-            host = "95.215.187.30";
-            opts = "";
-            hostPublicKey = self.keys.systems.fedi300;
-          };
-          nixpkgs = inputs.nixpkgs;
-          nixos.module = {
-            imports = [
-              ./fedi300
-              self.nixosModules.ageSecrets
-              { fediversity.hostPublicKey = self.keys.systems.fedi300; }
-            ];
-          };
-        };
-      };
-    };
-
-  nixops4Deployments.web =
-    { providers, ... }:
-    {
-      providers.local = inputs.nixops4-nixos.modules.nixops4Provider.local;
-
-      resources = {
-        vm02187 = {
-          type = providers.local.exec;
-          imports = [ inputs.nixops4-nixos.modules.nixops4Resource.nixos ];
-          ssh = {
-            host = "185.206.232.187";
-            opts = "";
-            hostPublicKey = self.keys.systems.vm02187;
-          };
-          nixpkgs = inputs.nixpkgs;
-          nixos.module = {
-            imports = [
-              ./vm02187
-              self.nixosModules.ageSecrets
-              { fediversity.hostPublicKey = self.keys.systems.vm02187; }
-            ];
-          };
-        };
-      };
-    };
-
-  nixops4Deployments.other =
-    { providers, ... }:
-    {
-      providers.local = inputs.nixops4-nixos.modules.nixops4Provider.local;
-
-      resources = {
-        vm02179 = {
-          type = providers.local.exec;
-          imports = [ inputs.nixops4-nixos.modules.nixops4Resource.nixos ];
-          ssh = {
-            host = "185.206.232.179";
-            opts = "";
-            hostPublicKey = self.keys.systems.vm02179;
-          };
-          nixpkgs = inputs.nixpkgs;
-          nixos.module = {
-            imports = [
-              ./vm02179
-              self.nixosModules.ageSecrets
-              { fediversity.hostPublicKey = self.keys.systems.vm02179; }
-            ];
-          };
-        };
-
-        vm02186 = {
-          type = providers.local.exec;
-          imports = [ inputs.nixops4-nixos.modules.nixops4Resource.nixos ];
-          ssh = {
-            host = "185.206.232.186";
-            opts = "";
-            hostPublicKey = self.keys.systems.vm02186;
-          };
-          nixpkgs = inputs.nixpkgs;
-          nixos.module = {
-            imports = [
-              ./vm02186
-              self.nixosModules.ageSecrets
-              { fediversity.hostPublicKey = self.keys.systems.vm02186; }
-            ];
-          };
-        };
-      };
-    };
+in
+{
+  nixops4Deployments = makeDeployments (addDefaultDeployment {
+    git = [
+      "vm02116"
+      "fedi300"
+    ];
+    web = [ "vm02187" ];
+    other = [
+      "vm02179"
+      "vm02186"
+    ];
+  });
 }
--- a/infra/vm02116/default.nix
+++ b/infra/vm02116/default.nix
@ -1,28 +1,28 @@
 {
-  imports = [
-    ../common
-    ./forgejo.nix
-  ];
-
-  procolix.vm = {
-    name = "vm02116";
-    ip4 = "185.206.232.34";
-    ip6 = "2a00:51c0:12:1201::20";
+  procolixVm = {
+    ipv4.address = "185.206.232.34";
+    ipv6.address = "2a00:51c0:12:1201::20";
  };

-  ## vm02116 is running on old hardware based on a Xen VM environment, so it
-  ## needs these extra options. Once the VM gets moved to a newer node, these
-  ## two options can safely be removed.
-  boot.initrd.availableKernelModules = [ "xen_blkfront" ];
-  services.xe-guest-utilities.enable = true;
+  nixos.module = {
+    imports = [
+      ./forgejo.nix
+    ];

-  fileSystems."/" = {
-    device = "/dev/disk/by-uuid/3802a66d-e31a-4650-86f3-b51b11918853";
-    fsType = "ext4";
-  };
+    ## vm02116 is running on old hardware based on a Xen VM environment, so it
+    ## needs these extra options. Once the VM gets moved to a newer node, these
+    ## two options can safely be removed.
+    boot.initrd.availableKernelModules = [ "xen_blkfront" ];
+    services.xe-guest-utilities.enable = true;

-  fileSystems."/boot" = {
-    device = "/dev/disk/by-uuid/2CE2-1173";
-    fsType = "vfat";
+    fileSystems."/" = {
+      device = "/dev/disk/by-uuid/3802a66d-e31a-4650-86f3-b51b11918853";
+      fsType = "ext4";
+    };
+
+    fileSystems."/boot" = {
+      device = "/dev/disk/by-uuid/2CE2-1173";
+      fsType = "vfat";
+    };
  };
 }
--- a/infra/vm02179/default.nix
+++ b/infra/vm02179/default.nix
@ -1,25 +1,22 @@
 {
-  imports = [
-    ../common
-  ];
-
-  procolix.vm = {
-    name = "vm02179";
-    ip4 = "185.206.232.179";
-    ip6 = "2a00:51c0:12:1201::179";
+  procolixVm = {
+    ipv4.address = "185.206.232.179";
+    ipv6.address = "2a00:51c0:12:1201::179";
  };

-  fileSystems."/" = {
-    device = "/dev/disk/by-uuid/119863f8-55cf-4e2f-ac17-27599a63f241";
-    fsType = "ext4";
-  };
+  nixos.module = {
+    fileSystems."/" = {
+      device = "/dev/disk/by-uuid/119863f8-55cf-4e2f-ac17-27599a63f241";
+      fsType = "ext4";
+    };

-  fileSystems."/boot" = {
-    device = "/dev/disk/by-uuid/D9F4-9BF0";
-    fsType = "vfat";
-    options = [
-      "fmask=0022"
-      "dmask=0022"
-    ];
+    fileSystems."/boot" = {
+      device = "/dev/disk/by-uuid/D9F4-9BF0";
+      fsType = "vfat";
+      options = [
+        "fmask=0022"
+        "dmask=0022"
+      ];
+    };
  };
 }
--- a/infra/vm02186/default.nix
+++ b/infra/vm02186/default.nix
@ -1,25 +1,22 @@
 {
-  imports = [
-    ../common
-  ];
-
-  procolix.vm = {
-    name = "vm02186";
-    ip4 = "185.206.232.186";
-    ip6 = "2a00:51c0:12:1201::186";
+  procolixVm = {
+    ipv4.address = "185.206.232.186";
+    ipv6.address = "2a00:51c0:12:1201::186";
  };

-  fileSystems."/" = {
-    device = "/dev/disk/by-uuid/833ac0f9-ad8c-45ae-a9bf-5844e378c44a";
-    fsType = "ext4";
-  };
+  nixos.module = {
+    fileSystems."/" = {
+      device = "/dev/disk/by-uuid/833ac0f9-ad8c-45ae-a9bf-5844e378c44a";
+      fsType = "ext4";
+    };

-  fileSystems."/boot" = {
-    device = "/dev/disk/by-uuid/B4D5-3AF9";
-    fsType = "vfat";
-    options = [
-      "fmask=0022"
-      "dmask=0022"
-    ];
+    fileSystems."/boot" = {
+      device = "/dev/disk/by-uuid/B4D5-3AF9";
+      fsType = "vfat";
+      options = [
+        "fmask=0022"
+        "dmask=0022"
+      ];
+    };
  };
 }
--- a/infra/vm02187/default.nix
+++ b/infra/vm02187/default.nix
@ -1,26 +1,26 @@
 {
-  imports = [
-    ../common
-    ./wiki.nix
-  ];
-
-  procolix.vm = {
-    name = "vm02187";
-    ip4 = "185.206.232.187";
-    ip6 = "2a00:51c0:12:1201::187";
+  procolixVm = {
+    ipv4.address = "185.206.232.187";
+    ipv6.address = "2a00:51c0:12:1201::187";
  };

-  fileSystems."/" = {
-    device = "/dev/disk/by-uuid/a46a9c46-e32b-4216-a4aa-8819b2cd0d49";
-    fsType = "ext4";
-  };
-
-  fileSystems."/boot" = {
-    device = "/dev/disk/by-uuid/6AB5-4FA8";
-    fsType = "vfat";
-    options = [
-      "fmask=0022"
-      "dmask=0022"
+  nixos.module = {
+    imports = [
+      ./wiki.nix
    ];
+
+    fileSystems."/" = {
+      device = "/dev/disk/by-uuid/a46a9c46-e32b-4216-a4aa-8819b2cd0d49";
+      fsType = "ext4";
+    };
+
+    fileSystems."/boot" = {
+      device = "/dev/disk/by-uuid/6AB5-4FA8";
+      fsType = "vfat";
+      options = [
+        "fmask=0022"
+        "dmask=0022"
+      ];
+    };
  };
 }
--- a/keys/README.md
+++ b/keys/README.md
@ -0,0 +1,32 @@
+# Keys
+
+This directory contains the SSH public keys of both contributors to the projects
+and systems that we administrate. Keys are used both for [secrets](../secrets)
+decryption and [infra](../infra) management.
+
+Which private keys can be used to decrypt secrets is defined in
+[`secrets.nix`](../secrets/secrets.nix) as _all the contributors_ as well as the
+specific systems that need access to the secret in question. Adding a
+contributor of system's key to a secret requires rekeying the secret, which can
+only be done by some key that had already access to it. (Alternatively, one can
+overwrite a secret without knowing its contents.)
+
+In infra management, the systems' keys are used for security reasons; they
+identify the machine that we are talking to. The contributor keys are used to
+give access to the `root` user on these machines, which allows, among other
+things, to deploy their configurations with NixOps4.
+
+## Adding a contributor
+
+Adding a contributor consists of three steps:
+
+1. The contributor in question adds a file with their key to the
+   `./contributors` directory, and opens a pull request with it.
+
+2. An already-existing contributor uses their keys to [re-key the secrets](../secrets#adding-a-contributor), taking that new key into
+   account.
+
+3. An already-existing contributor redeploys the [infrastructure](../infra) to take into
+   account the new access.
+
+4. The pull request is accepted and merged.
--- a/keys/contributors/kevin
+++ b/keys/contributors/kevin
@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINpebsCsP+GUMZ2SeVKsuDMwLTQ8H1Ny3oVgf73jsgMg hedgehog 2025
--- a/keys/contributors/kiara
+++ b/keys/contributors/kiara
@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDHTIqF4CAylSxKPiSo5JOPuocn0y2z38wOSsQ1MUaZ2 kiara@procolix.eu
--- a/keys/flake-part.nix
+++ b/keys/flake-part.nix
@ -1,3 +0,0 @@
-{
-  flake.keys = import ./.;
-}
--- a/keys/systems/vm02117.pub
+++ b/keys/systems/vm02117.pub
@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOrmZ9eMPLDSiayphFhPi7vry5P2VlEr7BvIjtnpN7Td
--- a/website/npins/default.nix
+++ b/website/npins/default.nix
--- a/website/npins/sources.json
+++ b/website/npins/sources.json
--- a/panel/.envrc
+++ b/panel/.envrc
@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+# the shebang is ignored, but nice for editors
+
+# shellcheck shell=bash
+if type -P lorri &>/dev/null; then
+  eval "$(lorri direnv)"
+else
+  echo 'while direnv evaluated .envrc, could not find the command "lorri" [https://github.com/nix-community/lorri]'
+  use_nix
+fi
--- a/panel/.gitignore
+++ b/panel/.gitignore
@ -0,0 +1,13 @@
+# Nix
+.direnv
+result*
+
+# Python
+*.pyc
+__pycache__
+
+# Django, application-specific
+db.sqlite3
+src/db.sqlite3
+src/static
+.credentials
--- a/panel/README.md
+++ b/panel/README.md
@ -0,0 +1,46 @@
+# Fediversity Panel
+
+The Fediversity Panel is a web service for managing Fediversity deployments with a graphical user interface, written in Django.
+
+## Development
+
+- To obtain all tools related to this project, enter the development environment with `nix-shell`.
+
+  If you want to do that automatically on entering this directory:
+
+  - [Set up `direnv`](https://github.com/nix-community/nix-direnv#installation)
+  - Run `direnv allow` in the directory where repository is stored on your machine
+
+    > **Note**
+    >
+    > This is a security boundary, and allows automatically running code from this repository on your machine.
+
+- Run NixOS integration tests and Django unit tests:
+
+  ```bash
+  nix-build -A tests
+  ```
+
+- List all available Django management commands with:
+
+  ```shell-session
+  manage
+  ```
+
+- Run the server locally
+
+  ```shell-session
+  manage runserver
+  ```
+
+- Whenever you add a field in the database schema, run:
+
+  ```console
+  manage makemigrations
+  ```
+
+  Then before starting the server again, run:
+
+  ```
+  manage migrate
+  ```
--- a/panel/default.nix
+++ b/panel/default.nix
@ -0,0 +1,53 @@
+{
+  system ? builtins.currentSystem,
+  sources ? import ../npins,
+  pkgs ? import sources.nixpkgs {
+    inherit system;
+    config = { };
+    overlays = [ ];
+  },
+}:
+let
+  package =
+    let
+      callPackage = pkgs.lib.callPackageWith (pkgs // pkgs.python3.pkgs);
+    in
+    callPackage ./nix/package.nix { };
+
+  pkgs' = pkgs.extend (_final: _prev: { panel = package; });
+
+  manage = pkgs.writeScriptBin "manage" ''
+    exec ${pkgs.lib.getExe pkgs.python3} ${toString ./src/manage.py} $@
+  '';
+in
+{
+  shell = pkgs.mkShellNoCC {
+    inputsFrom = [ package ];
+    packages = [
+      pkgs.npins
+      manage
+    ];
+    env = {
+      NPINS_DIRECTORY = toString ../npins;
+    };
+    shellHook = ''
+      # in production, secrets are passed via CREDENTIALS_DIRECTORY by systemd.
+      # use this directory for testing with local secrets
+      mkdir -p .credentials
+      echo secret > ${builtins.toString ./.credentials}/SECRET_KEY
+      export CREDENTIALS_DIRECTORY=${builtins.toString ./.credentials}
+      export DATABASE_URL="sqlite:///${toString ./src}/db.sqlite3"
+    '';
+  };
+
+  tests = pkgs'.callPackage ./nix/tests.nix { };
+  inherit package;
+
+  # re-export inputs so they can be overridden granularly
+  # (they can't be accessed from the outside any other way)
+  inherit
+    sources
+    system
+    pkgs
+    ;
+}
--- a/panel/nix/configuration.nix
+++ b/panel/nix/configuration.nix
@ -0,0 +1,199 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  inherit (lib)
+    concatStringsSep
+    mapAttrsToList
+    mkDefault
+    mkEnableOption
+    mkIf
+    mkOption
+    mkPackageOption
+    optionalString
+    types
+    ;
+  inherit (pkgs) writeShellApplication;
+
+  # TODO: configure the name globally for everywhere it's used
+  name = "panel";
+
+  cfg = config.services.${name};
+
+  database-url = "sqlite:////var/lib/${name}/db.sqlite3";
+
+  python-environment = pkgs.python3.withPackages (
+    ps: with ps; [
+      cfg.package
+      uvicorn
+    ]
+  );
+
+  configFile = pkgs.concatText "configuration.py" [
+    ((pkgs.formats.pythonVars { }).generate "settings.py" cfg.settings)
+    (builtins.toFile "extra-settings.py" cfg.extra-settings)
+  ];
+
+  manage-service = writeShellApplication {
+    name = "manage";
+    text = ''exec ${cfg.package}/bin/manage.py "$@"'';
+  };
+
+  manage-admin = writeShellApplication {
+    # This allows running the `manage` command in the system environment, e.g. to initialise an admin user
+    # Executing
+    name = "manage";
+    text =
+      ''
+        systemd-run --pty \
+          --same-dir \
+          --wait \
+          --collect \
+          --service-type=exec \
+          --unit "manage-${name}.service" \
+          --property "User=${name}" \
+          --property "Group=${name}" \
+          --property "Environment=DATABASE_URL=${database-url} USER_SETTINGS_FILE=${configFile}" \
+      ''
+      + optionalString (credentials != [ ]) (
+        (concatStringsSep " \\\n" (map (cred: "--property 'LoadCredential=${cred}'") credentials)) + " \\\n"
+      )
+      + ''
+        ${lib.getExe manage-service} "$@"
+      '';
+  };
+
+  credentials = mapAttrsToList (name: secretPath: "${name}:${secretPath}") cfg.secrets;
+in
+# TODO: for a more clever and generic way of running Django services:
+#       https://git.dgnum.eu/mdebray/djangonix/
+#       unlicensed at the time of writing, but surely worth taking some inspiration from...
+{
+  options.services.${name} = {
+    enable = mkEnableOption "Service configuration for `${name}`";
+    # NOTE: this requires that the package is present in `pkgs`
+    package = mkPackageOption pkgs name { };
+    production = mkOption {
+      type = types.bool;
+      default = true;
+    };
+    restart = mkOption {
+      description = "systemd restart behavior";
+      type = types.enum [
+        "no"
+        "on-success"
+        "on-failure"
+        "on-abnormal"
+        "on-abort"
+        "always"
+      ];
+      default = "always";
+    };
+    domain = mkOption { type = types.str; };
+    host = mkOption {
+      type = types.str;
+      default = "127.0.0.1";
+    };
+    port = mkOption {
+      type = types.port;
+      default = 8000;
+    };
+    settings = mkOption {
+      type = types.attrsOf types.anything;
+      default = {
+        STATIC_ROOT = mkDefault "/var/lib/${name}/static";
+        DEBUG = mkDefault false;
+        ALLOWED_HOSTS = mkDefault [
+          cfg.domain
+          cfg.host
+          "localhost"
+          "[::1]"
+        ];
+        CSRF_TRUSTED_ORIGINS = mkDefault [ "https://${cfg.domain}" ];
+        COMPRESS_OFFLINE = true;
+        LIBSASS_OUTPUT_STYLE = "compressed";
+      };
+      description = ''
+        Django configuration as an attribute set.
+        Name-value pairs will be converted to Python variable assignments.
+      '';
+    };
+    extra-settings = mkOption {
+      type = types.lines;
+      default = "";
+      description = ''
+        Django configuration written in Python verbatim.
+        Contents will be appended to the definitions in `settings`.
+      '';
+    };
+    secrets = mkOption {
+      type = types.attrsOf types.path;
+      default = { };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    environment.systemPackages = [ manage-admin ];
+
+    services = {
+      nginx.enable = true;
+      nginx.virtualHosts = {
+        ${cfg.domain} =
+          {
+            locations = {
+              "/".proxyPass = "http://localhost:${toString cfg.port}";
+              "/static/".alias = "/var/lib/${name}/static/";
+            };
+          }
+          // lib.optionalAttrs cfg.production {
+            enableACME = true;
+            forceSSL = true;
+          };
+      };
+    };
+
+    users.users.${name} = {
+      isSystemUser = true;
+      group = name;
+    };
+
+    users.groups.${name} = { };
+    systemd.services.${name} = {
+      description = "${name} ASGI server";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      path = [
+        python-environment
+        manage-service
+      ];
+      preStart = ''
+        # Auto-migrate on first run or if the package has changed
+        versionFile="/var/lib/${name}/package-version"
+        if [[ $(cat "$versionFile" 2>/dev/null) != ${cfg.package} ]]; then
+          manage migrate --no-input
+          manage collectstatic --no-input --clear
+          manage compress --force
+          echo ${cfg.package} > "$versionFile"
+        fi
+      '';
+      script = ''
+        uvicorn ${name}.asgi:application --host ${cfg.host} --port ${toString cfg.port}
+      '';
+      serviceConfig = {
+        Restart = "always";
+        User = name;
+        WorkingDirectory = "/var/lib/${name}";
+        StateDirectory = name;
+        RuntimeDirectory = name;
+        LogsDirectory = name;
+      } // lib.optionalAttrs (credentials != [ ]) { LoadCredential = credentials; };
+      environment = {
+        USER_SETTINGS_FILE = "${configFile}";
+        DATABASE_URL = database-url;
+      };
+    };
+  };
+}
--- a/panel/nix/package.nix
+++ b/panel/nix/package.nix
@ -0,0 +1,57 @@
+{
+  lib,
+  buildPythonPackage,
+  setuptools,
+  django_4,
+  django-compressor,
+  django-libsass,
+  dj-database-url,
+}:
+let
+  src =
+    with lib.fileset;
+    toSource {
+      root = ../src;
+      fileset = intersection (gitTracked ../../.) ../src;
+    };
+  pyproject = with lib; fromTOML pyproject-toml;
+  # TODO: define this globally
+  name = "panel";
+  # TODO: we may want this in a file so it's easier to read statically
+  version = "0.0.0";
+  pyproject-toml = ''
+    [project]
+    name = "Fediversity-Panel"
+    version = "${version}"
+
+    [tool.setuptools]
+    packages = [ "${name}" ]
+    include-package-data = true
+  '';
+in
+buildPythonPackage {
+  pname = name;
+  inherit (pyproject.project) version;
+  pyproject = true;
+  inherit src;
+
+  preBuild = ''
+    echo "recursive-include ${name} *" > MANIFEST.in
+    cp ${builtins.toFile "source" pyproject-toml} pyproject.toml
+  '';
+
+  propagatedBuildInputs = [
+    setuptools
+    django_4
+    django-compressor
+    django-libsass
+    dj-database-url
+  ];
+
+  postInstall = ''
+    mkdir -p $out/bin
+    cp -v ${src}/manage.py $out/bin/manage.py
+    chmod +x $out/bin/manage.py
+    wrapProgram $out/bin/manage.py --prefix PYTHONPATH : "$PYTHONPATH"
+  '';
+}
--- a/panel/nix/tests.nix
+++ b/panel/nix/tests.nix
@ -0,0 +1,62 @@
+{ lib, pkgs }:
+let
+  # TODO: specify project/service name globally
+  name = "panel";
+  defaults = {
+    services.${name} = {
+      enable = true;
+      production = false;
+      restart = "no";
+      domain = "example.com";
+      secrets = {
+        SECRET_KEY = pkgs.writeText "SECRET_KEY" "secret";
+      };
+    };
+
+    virtualisation = {
+      memorySize = 2048;
+      cores = 2;
+    };
+  };
+in
+lib.mapAttrs (name: test: pkgs.testers.runNixOSTest (test // { inherit name; })) {
+  application-tests = {
+    inherit defaults;
+    nodes.server = _: { imports = [ ./configuration.nix ]; };
+    # run all application-level tests managed by Django
+    # https://docs.djangoproject.com/en/5.0/topics/testing/overview/
+    testScript = ''
+      server.succeed("manage test")
+    '';
+  };
+  admin = {
+    inherit defaults;
+    nodes.server = _: { imports = [ ./configuration.nix ]; };
+    # check that the admin interface is served
+    testScript = ''
+      server.wait_for_unit("multi-user.target")
+      server.wait_for_unit("${name}.service")
+      server.wait_for_open_port(8000)
+      server.succeed("curl --fail -L -H 'Host: example.org' http://localhost/admin")
+    '';
+  };
+
+  sass-processing = {
+    inherit defaults;
+    nodes.server = _: { imports = [ ./configuration.nix ]; };
+    extraPythonPackages = ps: with ps; [ beautifulsoup4 ];
+    skipTypeCheck = true;
+    # check that stylesheets are pre-processed and served
+    testScript = ''
+      from bs4 import BeautifulSoup
+      server.wait_for_unit("multi-user.target")
+      server.wait_for_unit("${name}.service")
+      server.wait_for_open_port(8000)
+      stdout = server.succeed("curl --fail -H 'Host: example.org' http://localhost")
+      # the CSS is auto-generated with a hash in the file name
+      html = BeautifulSoup(stdout, 'html.parser')
+      css = html.find('link', type="text/css")['href']
+      server.succeed(f"curl --fail -H 'Host: example.org' http://localhost/{css}")
+    '';
+  };
+}
--- a/server/shell.nix
+++ b/server/shell.nix
--- a/panel/src/manage.py
+++ b/panel/src/manage.py
@ -0,0 +1,22 @@
+#!/nix/store/px2nj16i5gc3d4mnw5l1nclfdxhry61p-python3-3.12.7/bin/python
+"""Django's command-line utility for administrative tasks."""
+import os
+import sys
+
+
+def main():
+    """Run administrative tasks."""
+    os.environ.setdefault('DJANGO_SETTINGS_MODULE', 'panel.settings')
+    try:
+        from django.core.management import execute_from_command_line
+    except ImportError as exc:
+        raise ImportError(
+            "Couldn't import Django. Are you sure it's installed and "
+            "available on your PYTHONPATH environment variable? Did you "
+            "forget to activate a virtual environment?"
+        ) from exc
+    execute_from_command_line(sys.argv)
+
+
+if __name__ == '__main__':
+    main()
--- a/panel/src/panel/init.py
+++ b/panel/src/panel/init.py
--- a/panel/src/panel/asgi.py
+++ b/panel/src/panel/asgi.py
@ -0,0 +1,16 @@
+"""
+ASGI config for panel project.
+
+It exposes the ASGI callable as a module-level variable named ``application``.
+
+For more information on this file, see
+https://docs.djangoproject.com/en/4.2/howto/deployment/asgi/
+"""
+
+import os
+
+from django.core.asgi import get_asgi_application
+
+os.environ.setdefault('DJANGO_SETTINGS_MODULE', 'panel.settings')
+
+application = get_asgi_application()
--- a/panel/src/panel/settings.py
+++ b/panel/src/panel/settings.py
@ -0,0 +1,171 @@
+"""
+Django settings for panel project.
+
+Generated by 'django-admin startproject' using Django 4.2.16.
+
+For more information on this file, see
+https://docs.djangoproject.com/en/4.2/topics/settings/
+
+For the full list of settings and their values, see
+https://docs.djangoproject.com/en/4.2/ref/settings/
+"""
+
+import sys
+import os
+import importlib.util
+import dj_database_url
+
+from os import environ as env
+from pathlib import Path
+
+# Build paths inside the project like this: BASE_DIR / 'subdir'.
+BASE_DIR = Path(__file__).resolve().parent.parent
+
+
+# Quick-start development settings - unsuitable for production
+# See https://docs.djangoproject.com/en/4.2/howto/deployment/checklist/
+
+def get_secret(name: str, encoding: str = "utf-8") -> str:
+    credentials_dir = env.get("CREDENTIALS_DIRECTORY")
+
+    if credentials_dir is None:
+        raise RuntimeError("No credentials directory available.")
+
+    try:
+        with open(f"{credentials_dir}/{name}", encoding=encoding) as f:
+            secret = f.read().removesuffix("\n")
+    except FileNotFoundError:
+        raise RuntimeError(f"No secret named {name} found in {credentials_dir}.")
+
+    return secret
+
+# SECURITY WARNING: keep the secret key used in production secret!
+SECRET_KEY = get_secret("SECRET_KEY")
+
+# SECURITY WARNING: don't run with debug turned on in production!
+DEBUG = True
+
+ALLOWED_HOSTS = []
+
+
+# Application definition
+
+INSTALLED_APPS = [
+    "panel",
+    'django.contrib.admin',
+    'django.contrib.auth',
+    'django.contrib.contenttypes',
+    'django.contrib.sessions',
+    'django.contrib.messages',
+    'django.contrib.staticfiles',
+    'compressor',
+]
+
+MIDDLEWARE = [
+    'django.middleware.security.SecurityMiddleware',
+    'django.contrib.sessions.middleware.SessionMiddleware',
+    'django.middleware.common.CommonMiddleware',
+    'django.middleware.csrf.CsrfViewMiddleware',
+    'django.contrib.auth.middleware.AuthenticationMiddleware',
+    'django.contrib.messages.middleware.MessageMiddleware',
+    'django.middleware.clickjacking.XFrameOptionsMiddleware',
+]
+
+ROOT_URLCONF = 'panel.urls'
+
+TEMPLATES = [
+    {
+        'BACKEND': 'django.template.backends.django.DjangoTemplates',
+        'DIRS': [],
+        'APP_DIRS': True,
+        'OPTIONS': {
+            'context_processors': [
+                'django.template.context_processors.debug',
+                'django.template.context_processors.request',
+                'django.contrib.auth.context_processors.auth',
+                'django.contrib.messages.context_processors.messages',
+            ],
+        },
+    },
+]
+
+WSGI_APPLICATION = 'panel.wsgi.application'
+
+
+# Database
+# https://docs.djangoproject.com/en/4.2/ref/settings/#databases
+# https://github.com/jazzband/dj-database-url
+
+DATABASES = {
+    'default': dj_database_url.config(),
+}
+
+
+# Password validation
+# https://docs.djangoproject.com/en/4.2/ref/settings/#auth-password-validators
+
+AUTH_PASSWORD_VALIDATORS = [
+    {
+        'NAME': 'django.contrib.auth.password_validation.UserAttributeSimilarityValidator',
+    },
+    {
+        'NAME': 'django.contrib.auth.password_validation.MinimumLengthValidator',
+    },
+    {
+        'NAME': 'django.contrib.auth.password_validation.CommonPasswordValidator',
+    },
+    {
+        'NAME': 'django.contrib.auth.password_validation.NumericPasswordValidator',
+    },
+]
+
+
+# Internationalization
+# https://docs.djangoproject.com/en/4.2/topics/i18n/
+
+LANGUAGE_CODE = 'en-us'
+
+TIME_ZONE = 'UTC'
+
+USE_I18N = True
+
+USE_TZ = True
+
+
+# Static files (CSS, JavaScript, Images)
+# https://docs.djangoproject.com/en/4.2/howto/static-files/
+
+STATIC_URL = 'static/'
+
+STATIC_ROOT = os.path.join(BASE_DIR, "static/")
+
+STATICFILES_FINDERS = [
+    "django.contrib.staticfiles.finders.FileSystemFinder",
+    "django.contrib.staticfiles.finders.AppDirectoriesFinder",
+    "compressor.finders.CompressorFinder",
+]
+
+STATICFILES_STORAGE = 'django.contrib.staticfiles.storage.ManifestStaticFilesStorage'
+
+COMPRESS_PRECOMPILERS = [
+    ("text/x-sass", "django_libsass.SassCompiler"),
+]
+
+# Default primary key field type
+# https://docs.djangoproject.com/en/4.2/ref/settings/#default-auto-field
+
+DEFAULT_AUTO_FIELD = 'django.db.models.BigAutoField'
+
+# Customization via user settings
+# This must be at the end, as it must be able to override the above
+# TODO: we may want to do this with a flat environment instead, and get all values from `os.environ.get()`.
+#       this would make it more obvious which moving parts there are, if that environment is specified for development/staging/production in a visible place.
+user_settings_file = env.get("USER_SETTINGS_FILE", None)
+if user_settings_file is not None:
+    spec = importlib.util.spec_from_file_location("user_settings", user_settings_file)
+    if spec is None or spec.loader is None:
+        raise RuntimeError("User settings specification failed!")
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    sys.modules["user_settings"] = module
+    from user_settings import *  # noqa: F403 # pyright: ignore [reportMissingImports]
--- a/panel/src/panel/static/style.sass
+++ b/panel/src/panel/static/style.sass
@ -0,0 +1,5 @@
+body
+  padding: 0
+  margin: 0
+  font-family: sans-serif
+  box-sizing: border-box
--- a/panel/src/panel/templates/base.html
+++ b/panel/src/panel/templates/base.html
@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<html lang="en">
+  <head>
+    <title>{% block title %}Fediversity Panel{% endblock %}</title>
+    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
+    <meta http-equiv="X-UA-Compatible" content="IE=edge" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+
+    {% load compress %}
+    {% compress css %}
+    <link rel="stylesheet" type="text/x-sass" href="/static/style.sass" />
+    {% endcompress %}
+
+    {% block extra_head %}{% endblock extra_head %}
+  </head>
+
+  <body>
+    {% block navigation %}
+    <nav>
+    </nav>
+    {% endblock navigation %}
+
+    {% block layout %}
+    <article>
+      {% block content %}{% endblock content %}
+    </article>
+    {% endblock layout %}
+  </body>
+</html>
--- a/panel/src/panel/templates/index.html
+++ b/panel/src/panel/templates/index.html
@ -0,0 +1,7 @@
+{% extends "base.html" %}
+
+{% block content %}
+<h1>Fediversity Panel</h1>
+
+<p>Hello world!</p>
+{% endblock %}
--- a/panel/src/panel/urls.py
+++ b/panel/src/panel/urls.py
@ -0,0 +1,24 @@
+"""
+URL configuration for panel project.
+
+The `urlpatterns` list routes URLs to views. For more information please see:
+    https://docs.djangoproject.com/en/4.2/topics/http/urls/
+Examples:
+Function views
+    1. Add an import:  from my_app import views
+    2. Add a URL to urlpatterns:  path('', views.home, name='home')
+Class-based views
+    1. Add an import:  from other_app.views import Home
+    2. Add a URL to urlpatterns:  path('', Home.as_view(), name='home')
+Including another URLconf
+    1. Import the include() function: from django.urls import include, path
+    2. Add a URL to urlpatterns:  path('blog/', include('blog.urls'))
+"""
+from django.contrib import admin
+from django.urls import path
+from panel import views
+
+urlpatterns = [
+    path('admin/', admin.site.urls),
+    path('', views.Index.as_view(), name='index'),
+]
--- a/panel/src/panel/views.py
+++ b/panel/src/panel/views.py
@ -0,0 +1,4 @@
+from django.views.generic import TemplateView
+
+class Index(TemplateView):
+    template_name = 'index.html'
--- a/panel/src/panel/wsgi.py
+++ b/panel/src/panel/wsgi.py
@ -0,0 +1,16 @@
+"""
+WSGI config for panel project.
+
+It exposes the WSGI callable as a module-level variable named ``application``.
+
+For more information on this file, see
+https://docs.djangoproject.com/en/4.2/howto/deployment/wsgi/
+"""
+
+import os
+
+from django.core.wsgi import get_wsgi_application
+
+os.environ.setdefault('DJANGO_SETTINGS_MODULE', 'panel.settings')
+
+application = get_wsgi_application()
--- a/secrets/README.md
+++ b/secrets/README.md
@ -49,3 +49,8 @@ As an example, let us add a secret in a file “cheeses” whose content should
   service that you are using must be able to read from a file at runtime, and
   if the NixOS default module options do not provide that, you must find a way
   around it.
+
+### Adding a contributor
+
+Rekeying can be done by running `agenix --rekey` (or `-r` for
+short) in the current directory. This requires access to the secrets using [contributor keys](../keys).
--- a/secrets/flake-part.nix
+++ b/secrets/flake-part.nix
@ -1,39 +0,0 @@
-{
-  inputs,
-  lib,
-  ...
-}:
-
-let
-  inherit (builtins) elem;
-  inherit (lib.attrsets) concatMapAttrs optionalAttrs;
-  inherit (lib.strings) removeSuffix;
-
-  secrets = import ./secrets.nix;
-in
-{
-  flake = {
-    inherit secrets;
-
-    nixosModules.ageSecrets = (
-      { config, ... }:
-      {
-        imports = [ inputs.agenix.nixosModules.default ];
-
-        options.fediversity.hostPublicKey = lib.mkOption {
-          description = ''
-            The host public key of the machine. It is used in particular
-            to filter Age secrets and only keep the relevant ones.
-          '';
-        };
-
-        config.age.secrets = concatMapAttrs (
-          name: secret:
-          optionalAttrs (elem config.fediversity.hostPublicKey secret.publicKeys) ({
-            ${removeSuffix ".age" name}.file = ./. + "/${name}";
-          })
-        ) secrets;
-      }
-    );
-  };
-}
--- a/secrets/forgejo-database-password.age
+++ b/secrets/forgejo-database-password.age
--- a/secrets/forgejo-email-password.age
+++ b/secrets/forgejo-email-password.age
@ -1,8 +1,11 @@
 age-encryption.org/v1
-> ssh-ed25519 1MUEqQ Y+wylE1yiRBPh5aX3LNeX7/5YQ/EfPOplCBmIoR69yA
-Vfvi1DZo927okyWLcfoVhVOada5bVdgcLXWzroIycGU
-> ssh-ed25519 Fa25Dw PFDPqt30lbvvf1Mu/AVMKfv/XyC2fIfnpvKrmyjDiRw
-S9Qn+jNMpS4T5OlTIq0SFMTyKlq4Sz7ADdtKDuQoGB4
--- 8/wxDtoP6ZfHqvQS8ld264jPEunSzbFP7Yqy664fyQ0
-~ó<>õCÉs±<73>%}+Õ	xÎ¥NX¤^‚Ø»ŞË
-s<EFBFBD>$bİbæÙ<C3A6>ò€õ©‘N
+-> ssh-ed25519 ofQnlg dmH3/gWbrhiYDSEzfEvwto/7ULietn9DHs7bqNRLuDE
+na8BTt4OCwwwJb/NNkUU1NWZKzsMyW84REcaz0bEX7c
+-> ssh-ed25519 COspvA bk/ixd0gon+sxmhW+OBGY9sRaCVOZ267TELGFkkuUxs
+Y+XnlUVETv4fqA5uGd3VaHIs4mAJQQw+xmGweWPOP70
+-> ssh-ed25519 1MUEqQ /mf6QgPlFqYGdQJHJbe2TEIusTxw0ftsemWst07nW3I
+SLzAtO31Evm/mOheVhMmV6QKoaNG0KYnIUaeThrp3CU
+-> ssh-ed25519 Fa25Dw HzNVxKLwujLVxs37JczAImZwE3CsSVbBbN7yCvvvQQU
+yHh5wFtGdHgCZsuY70VVCeW+q3Tj3pJKclkVFXKZiPU
+--- bi4B3ePG1HS3N5Y3civ4tvTZTk5dERKu4+LJwsN7Los
+ƒ%ŠåÚ;"Úq1v}Öþ¾ü:iÑê]â™ØjA0.ÓeåÇ°q÷À9¢®<7F>
--- a/secrets/forgejo-runner-token.age
+++ b/secrets/forgejo-runner-token.age
@ -1,7 +1,11 @@
 age-encryption.org/v1
-> ssh-ed25519 1MUEqQ QbrQLCnwsw79a0fjmKK0nSHl6n/+qRGg9E2vwufiCDM
-z7SiyeLgJK7ueDyox4eXLxYNjJUPD2N4V+2IyV6Yibc
-> ssh-ed25519 rJoYaw jn0foZgtavsFhVVoXKHkp+1ZU1SeFqkff2D89I5k3iQ
-YA58TNYkEhBvNHuSBfZv1uxaeJoQ1T4Wb+VswWgi5ck
--- crnhqJNO+eMBMgAgJjQsS0EOxee/UazYlssOXxlcp1g
-—šU$1ÓÈ±{²Ëôil©Î_èâÖyŸG´äå)(·<1D>ñ“D\òY÷ã`ß¿³ð2<C3B0>½/lÆ¢w–å•‚Ân¸ŸO«C³
+-> ssh-ed25519 ofQnlg 42Tz44DFTDA7OdAqynPLKsAYJctXivj3wWkkIwYTInM
+pQ5rW2TH4IK/kjcLNOmkLgKMAuD/yzw9nOZn2NZNOv8
+-> ssh-ed25519 COspvA iYtbO/GMmP2g+82xxPrvDsye2p+FpqGpG1a+Fr1jql0
+LYTL9v1c5UcikMIN2ivCLzzAtlKaY7z3PVJW/8OxrLM
+-> ssh-ed25519 1MUEqQ 2JWKsR0gWXjustfZtj5Zg6aEflw+tMJ+Ii0k1FtdKVQ
+lo534OLXItxUMRN/hZ351PLTYVYC9KjXJ8WrlqP4XVM
+-> ssh-ed25519 rJoYaw ePSTkrq9Nxk9kzAZR0O6P2KU8WZ40+/X7gI587WqRhk
+pQC9YAZdnKIyZ6ueN9iM+iAL9fkt0Dzo9WGfhTRABG4
+--- CWPCtLLBJ+OYjuocYoSgOd0r7/nUIewTeMWbQx8MHXQ
+>";ýùc¹LSm’{Òžô/ðšHÂ*"¾ß´.rÍ<72>bVo+WZO^§–~òÀÉ‹”w]1h=™¡ªHÚ·Sî‘tˆÐš,Erg¢—›n
--- a/secrets/wiki-basicauth-htpasswd.age
+++ b/secrets/wiki-basicauth-htpasswd.age
--- a/secrets/wiki-password.age
+++ b/secrets/wiki-password.age
@ -1,7 +1,11 @@
 age-encryption.org/v1
-> ssh-ed25519 1MUEqQ yJ53uyB0OqgbyZS+0Qu/glWZGqx8ALEr2Z0hKUrQgUg
-Ewvye5oREhNCASqyql56m2mNbAGnK69fVkjZ0N2ILMk
-> ssh-ed25519 dgBsjw glI8t7C/N4BqpnuZlCnv6TFb+YUQn+0oAjbJI7GrzWw
-qFxxFVt2R6FkupbP7qErZ+VFHYwEHVmY4iC6hyEf+Vg
--- fQbt68Fdj7wk8mWFx0W0Z1iRbkWxxK7+zIKw/v+BCE0
-¢OÕ+Q±×‹‰F¾^0ç¸¿9ãÕ?\TeË–B(ügs½³°¹'—™7…ì§ÁˆŒ(ÁO=>³<)h`qè&<26>^
+-> ssh-ed25519 ofQnlg fc4Kx1F73+x5k20ZAr+nwJ2//MKSbW0XrPwidaw3O34
+/sVyDyaHqBqWgB4aEBYCB9n0cVzEWUTdgqKvM4aAzJ8
+-> ssh-ed25519 COspvA pfbE6BX+5WeYtuCfL1kRdnD3tVOV33fEJR4G0EndGBA
+ssywMgaFasyglxpIMjn9xxQViV5srAz8qS7t3aIJjnM
+-> ssh-ed25519 1MUEqQ sqw/QOSTfTBzC2YOEDLzkB51VnGPZcz9JX5JYZ+/hjg
+p2pa5eakbFbNDhOfDZaXvb69ACh/F/2lFDTUQc4WlZ4
+-> ssh-ed25519 dgBsjw QaKOQLbsEpD71x7Hk3ZoZV3/xgxv4+jG1wWiKmrhOik
+wyJP3apJB9jBcAOMK0D72lD7FqCkBEuwX0UyCvqOUJc
+--- J/CTHVy20+V7iS/R0LeeUNzIxE6dU3lnVWAFHyEjbE8
+^TG™ÃÔUë•9óÁ)	]6èn<C3A8>…<CíýÐ|ñ¥€If…Ä1ò³*9ä&MJS–=	TÔÆXéKol{I
--- a/secrets/wiki-smtp-password.age
+++ b/secrets/wiki-smtp-password.age
--- a/server/README.md
+++ b/server/README.md
@ -1,15 +0,0 @@
-# fediversity.eu webserver
-
-This directory contains the configuration for the server hosting https://fediversity.eu
-
-Build the configuration:
-
-```bash
-nix-build -A machine
-```
-
-Deploy via SSH:
-
-```bash
-env SSH_OPTS="..." nix-shell --run deploy-webserver
-```
--- a/server/configuration.nix
+++ b/server/configuration.nix
@ -1,275 +0,0 @@
-# Edit this configuration file to define what should be installed on
-# your system.  Help is available in the configuration.nix(5) man page
-# and in the NixOS manual (accessible by running ‘nixos-help’).
-
-{ config, pkgs, ... }:
-
-{
-  imports =
-    [
-      # Include the results of the hardware scan.
-      ./hardware-configuration.nix
-    ];
-
-  # Use the systemd-boot EFI boot loader.
-  boot.loader.systemd-boot.enable = true;
-  boot.loader.efi.canTouchEfiVariables = true;
-
-  services.nginx.enable = true;
-  services.nginx.virtualHosts."www.oid.foundation" = {
-    useACMEHost = "oid.foundation";
-    forceSSL = true;
-    globalRedirect = "oid.foundation";
-  };
-  services.nginx.virtualHosts."oid.foundation" = {
-    enableACME = true;
-    forceSSL = true;
-    root = "/var/www/oid.foundation";
-
-  };
-  services.nginx.virtualHosts."fediversity.eu" = {
-    useACMEHost = "www.fediversity.eu";
-    forceSSL = true;
-    globalRedirect = "www.fediversity.eu";
-    locations."/.well-known/matrix/client" = {
-      extraConfig = ''
-        	return 200 '{"m.homeserver": {"base_url": "https://matrix.fediversity.eu", "public_baseurl": "https://matrix.fediversity.eu"}}';
-        	default_type application/json;
-        	add_header Access-Control-Allow-Origin "*";
-        	add_header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS";
-        	add_header Access-Control-Allow-Headers "Origin, X-Requested-With, Content-Type, Accept, Authorization";
-      '';
-    };
-    locations."/.well-known/matrix/server" = {
-      extraConfig = ''
-        	return 200 '{"m.server": "matrix.fediversity.eu:443"}';
-        	default_type application/json;
-        	add_header Access-Control-Allow-Origin "*";
-        	add_header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS";
-        	add_header Access-Control-Allow-Headers "Origin, X-Requested-With, Content-Type, Accept, Authorization";
-      '';
-    };
-  };
-  services.nginx.virtualHosts."www.fediversity.eu" = {
-    enableACME = true;
-    forceSSL = true;
-    root = "${(import ../website { }).build}";
-    locations."/.well-known/matrix/client" = {
-      extraConfig = ''
-        	return 200 '{"m.homeserver": {"base_url": "https://matrix.fediversity.eu", "public_baseurl": "https://matrix.fediversity.eu"}}';
-        	default_type application/json;
-        	add_header Access-Control-Allow-Origin "*";
-        	add_header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS";
-        	add_header Access-Control-Allow-Headers "Origin, X-Requested-With, Content-Type, Accept, Authorization";
-      '';
-    };
-    locations."/.well-known/matrix/server" = {
-      extraConfig = ''
-        	return 200 '{"m.server": "matrix.fediversity.eu:443"}';
-        	default_type application/json;
-        	add_header Access-Control-Allow-Origin "*";
-        	add_header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS";
-        	add_header Access-Control-Allow-Headers "Origin, X-Requested-With, Content-Type, Accept, Authorization";
-      '';
-    };
-  };
-  security.acme = {
-    acceptTerms = true;
-    defaults.email = "beheer@procolix.com";
-    certs."www.fediversity.eu".extraDomainNames = [ "fediversity.eu" ];
-    certs."oid.foundation".extraDomainNames = [ "www.oid.foundation" ];
-  };
-
-  networking = {
-    hostName = "vm02117";
-    domain = "procolix.com";
-    interfaces = {
-      eth0 = {
-        ipv4 = {
-          addresses = [
-            {
-              address = "185.206.232.106";
-              prefixLength = 24;
-            }
-          ];
-        };
-        ipv6 = {
-          addresses = [
-            {
-              address = "2a00:51c0:12:1201::106";
-              prefixLength = 64;
-            }
-          ];
-        };
-      };
-    };
-    defaultGateway = {
-      address = "185.206.232.1";
-      interface = "eth0";
-    };
-    defaultGateway6 = {
-      address = "2a00:51c0:12:1201::1";
-      interface = "eth0";
-    };
-    nameservers = [ "95.215.185.6" "95.215.185.7" ];
-    firewall.enable = false;
-    nftables = {
-      enable = true;
-      ruleset = ''
-        #!/usr/sbin/nft -f
-
-        flush ruleset
-
-        ########### define usefull variables here #####################
-        define wan        = eth0
-        define ssh_allow  = {
-                    83.161.147.127/32, # host801 ipv4
-                    95.215.185.92/32,  # host088 ipv4
-                    95.215.185.211/32, # host089 ipv4
-                    95.215.185.34/32,  # nagios2 ipv4
-                    95.215.185.181/32, # ansible.procolix.com
-                    95.215.185.235,        # ansible-hq
-                    185.206.232.76,    # vpn4
-                }
-        define snmp_allow = {
-                    95.215.185.31/32,   # cacti ipv4
-                }
-        define nrpe_allow = {
-                    95.215.185.34/32,   # nagios2 ipv4
-                }
-
-        ########### here starts the automated bit #####################
-        table inet filter {
-            chain input {
-                type filter hook input priority 0;
-                policy drop;
-
-                # established/related connections
-                ct state established,related accept
-                ct state invalid drop
-
-                # Limit ping requests.
-                ip protocol icmp icmp type echo-request limit rate over 10/second burst 50 packets drop
-                ip6 nexthdr icmpv6 icmpv6 type echo-request limit rate over 10/second burst 50 packets drop
-
-                # loopback interface
-                iifname lo accept
-
-                # icmp
-                ip protocol icmp icmp type { destination-unreachable, echo-reply, echo-request, source-quench, time-exceeded } accept
-                # Without the nd-* ones ipv6 will not work.
-                ip6 nexthdr icmpv6 icmpv6 type { destination-unreachable, echo-reply, echo-request, nd-neighbor-solicit,  nd-router-advert, nd-neighbor-advert, packet-too-big, parameter-problem, time-exceeded } accept
-
-                # open tcp ports: sshd (22)
-                ip saddr $ssh_allow tcp dport {ssh} accept
-
-                # open tcp ports: snmp (161)
-                ip saddr $snmp_allow udp dport {snmp} accept
-
-                # open tcp ports: nrpe (5666)
-                ip saddr $nrpe_allow tcp dport {nrpe} accept
-
-                # open tcp ports: http (80,443)
-                tcp dport {http,https} accept
-            }
-            chain forward {
-                type filter hook forward priority 0;
-            }
-            chain output {
-                type filter hook output priority 0;
-            }
-        }
-
-        table ip nat {
-            chain postrouting {
-            }
-            chain prerouting {
-            }
-        }
-      '';
-    };
-  };
-
-
-  # Set your time zone.
-  time.timeZone = "Europe/Amsterdam";
-
-  # Select internationalisation properties.
-  i18n.defaultLocale = "en_US.UTF-8";
-
-  security.sudo.wheelNeedsPassword = false;
-  # Define a user account. Don't forget to set a password with ‘passwd’.
-  users.users.procolix = {
-    isNormalUser = true;
-    extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
-    openssh.authorizedKeys.keys = [
-      "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAotfCIjLoDlHOe+++kVS1xiBPaS8mC5FypgrxDrDVst6SHxMTca2+IScMajzUZajenvNAoZOwIsyAPacT8OHeyFvV5Y7G874Qa+cZVqJxLht9gdXxr1GNabU3RfhhCh272dUeIKIqfgsRsM2HzdnZCMDavS1Yo+f+RhhHhnJIua+NdVFo21vPrpsz+Cd0M1NhojARLajrTHvEXW0KskUnkbfgxT0vL9jeRZxdgMS+a9ZoR5dbzOxQHWfbP8N04Xc+7CweMlvKwlWuAE/xDb5XLNHorfGWFvZuVhptJN8jPaaVS25wsmsF5IbaAuSZfzCtBdFQhIloUhy0L6ZisubHjQ== procolix@sshnode1"
-      "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAuT3C0f3nyQ7SwUvXcFmEYEgwL+crY6iK0Bhoi9yfn4soz3fhfMKyKSwc/0RIlRnrz3xnkyJiV0vFeU7AC1ixbGCS3T9uc0G1x0Yedd9n2yR8ZJmkdyfjZ5KE4YvqZ3f6UZn5Mtj+7tGmyp+ee+clLSHzsqeyDiX0FIgFmqiiAVJD6qeKPFAHeWz9b2MOXIBIw+fSLOpx0rosCgesOmPc8lgFvo+dMKpSlPkCuGLBPj2ObT4sLjc98NC5z8sNJMu3o5bMbiCDR9JWgx9nKj+NlALwk3Y/nzHSL/DNcnP5vz2zbX2CBKjx6ju0IXh6YKlJJVyMsH9QjwYkgDQVmy8amQ== procolix@sshnode2"
-    ];
-    packages = with pkgs; [
-    ];
-  };
-  users.users.laurens = {
-    isNormalUser = true;
-    extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
-    openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBbK4ZB0Xnpf8yyK4QOI2HvjgQINI3GKi7/O2VEsYXUb laurenshof@Laurenss-MacBook-Air.local"
-    ];
-    packages = with pkgs; [
-    ];
-  };
-  users.users.valentin = {
-    isNormalUser = true;
-    extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
-    openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJg5TlS1NGCRZwMjDgBkXeFUXqooqRlM8fJdBAQ4buPg"
-    ];
-    packages = with pkgs; [
-    ];
-  };
-  users.users.niols = {
-    isNormalUser = true;
-    extraGroups = [ "wheel" ];
-    openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEElREJN0AC7lbp+5X204pQ5r030IbgCllsIxyU3iiKY"
-    ];
-  };
-  # List packages installed in system profile. To search, run:
-  # $ nix search wget
-  environment.systemPackages = with pkgs; [
-    (pkgs.vim_configurable.customize {
-      name = "vim";
-      vimrcConfig.packages.myplugins = with pkgs.vimPlugins; {
-        start = [ vim-nix ]; # load plugin on startup
-      };
-      vimrcConfig.customRC = ''
-        " your custom vimrc
-        set nocompatible
-        set backspace=indent,eol,start
-        " Turn on syntax highlighting by default
-        syntax on
-        " ...
-      '';
-    })
-    wget
-    git
-  ];
-
-  # List services that you want to enable:
-
-  # Enable the OpenSSH daemon.
-  services.openssh.enable = true;
-  services.openssh.settings.PasswordAuthentication = false;
-
-  # Enable xe-guest-utilities
-  services.xe-guest-utilities.enable = true;
-
-  # This value determines the NixOS release from which the default
-  # settings for stateful data, like file locations and database versions
-  # on your system were taken. It‘s perfectly fine and recommended to leave
-  # this value at the release version of the first install of this system.
-  # Before changing this value read the documentation for this option
-  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
-  system.stateVersion = "23.11"; # Did you read the comment?
-
-}
--- a/server/default.nix
+++ b/server/default.nix
@ -1,46 +0,0 @@
-{ sources ? import ../website/npins
-, system ? builtins.currentSystem
-, pkgs ? import sources.nixpkgs {
-    inherit system;
-    config = { };
-    overlays = [ ];
-  }
-, lib ? import "${sources.nixpkgs}/lib"
-}:
-let
-  # TODO: don't hard code target hosts; wire all of it up with NixOps4
-  host = "vm02117.procolix.com";
-  deploy = pkgs.writeShellApplication {
-    name = "deploy-webserver";
-    text = ''
-      # HACK: decouple system evaluation from shell evaluation
-      # the structured way for using this hack is encoded in https://github.com/fricklerhandwerk/lazy-drv
-      result="$(nix-build ${toString ./.} -A machine --no-out-link --eval-store auto --store ssh-ng://${host})"
-      # shellcheck disable=SC2087
-      ssh ${host} << EOF
-      sudo nix-env -p /nix/var/nix/profiles/system --set "$result"
-      sudo "$result"/bin/switch-to-configuration switch
-      EOF
-    '';
-  };
-  nixos-configuration = config:
-    import "${pkgs.path}/nixos/lib/eval-config.nix" {
-      modules = [
-        config
-      ];
-      system = null;
-    };
-in
-rec {
-  nixos = nixos-configuration ./configuration.nix;
-  machine = nixos.config.system.build.toplevel;
-  shell = pkgs.mkShellNoCC {
-    packages = with pkgs; [
-      deploy
-    ];
-    env = {
-      # TODO: reusing other pins for now; wire up the whole repo to use the same dependencies
-      NPINS_DIRECTORY = toString ../website/npins;
-    };
-  };
-}
--- a/server/hardware-configuration.nix
+++ b/server/hardware-configuration.nix
@ -1,34 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
-
-{
-  imports = [ ];
-
-  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "sr_mod" "xen_blkfront" ];
-  boot.initrd.kernelModules = [ "dm-snapshot" ];
-  boot.kernelModules = [ ];
-  boot.extraModulePackages = [ ];
-
-  fileSystems."/" =
-    { device = "/dev/disk/by-uuid/5aa392a8-c9ba-4181-976f-b3b30db350a1";
-      fsType = "ext4";
-    };
-
-  fileSystems."/boot" =
-    { device = "/dev/disk/by-uuid/FC6D-610F";
-      fsType = "vfat";
-    };
-
-  swapDevices = [ ];
-
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.enX0.useDHCP = lib.mkDefault true;
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-}
--- a/website/default.nix
+++ b/website/default.nix
@ -1,4 +1,4 @@
-{ sources ? import ./npins
+{ sources ? import ../npins
 , system ? builtins.currentSystem
 , pkgs ? import sources.nixpkgs {
    inherit system;
@ -65,12 +65,12 @@ rec {
  tests = with pkgs; with lib;
    let
      source = fileset.toSource {
-        root = ./.;
+        root = ../.;
        fileset = fileset.unions [
          ./default.nix
          ./tests.nix
          ./lib.nix
-          ./npins
+          ../npins
        ];
      };
    in
@ -86,7 +86,7 @@ rec {
        # adding it verbatim will result in <hash'>-<hash>-source, so rename it first
        cp -r ${sources.nixpkgs} source
        nix-store --add --store "$HOME" source
-        ${getExe nix-unit} --gc-roots-dir "$HOME" --store "$HOME" ${source}/tests.nix "$@"
+        ${getExe nix-unit} --gc-roots-dir "$HOME" --store "$HOME" ${source}/website/tests.nix "$@"
        touch $out
      '';
 }
Author	SHA1	Message	Date
Kiara Grouwstra	ec4e802124	add .envrc files	2025-02-13 14:48:21 +01:00
Valentin Gagarin	f97dc7e121	fix settings and add dummy view This introduces customisation to `settings.py` that - allow controlling the relevant parameters from our systemd wrapper (more brittle and non-obvious than it should be, see TODOs) - correctly configure SASS processing and static file compression (not as easy as it sounds)	2025-02-13 00:26:28 +01:00
Valentin Gagarin	7c33e8aaf3	scaffold Django web service This setup is greatly inspired by the one used for [0], although with notable modifications, such as: - a SASS preprocessor and CSS compressor - more streamlined NixOS integration tests - cleaned up service configuration - a few notes on how to do things better in the future [0]: https://github.com/Nix-Security-WG/nix-security-tracker/ Apart from cloning the Nix setup, there were additional steps: - Create an empty `src` directory, since the package requires it - In the development shell, run `django-admin startproject panel src` Note that while you can already do ```bash manage migrate manage runserver ``` the NixOS integration tests will fail, since `settings.py` needs careful massaging to expose knobs that can be turned from our systemd wrapper. The required changes are introduced in the next commit to make them observable. Noteworthy related work: - https://github.com/sephii/django.nix Rather mature setup with a clean interface, uses Caddy as reverse proxy. - https://git.dgnum.eu/mdebray/djangonix A work-in-progress attempt to capture more moving parts through the module system, in particular secrets. - https://github.com/DavHau/django-nixos Out of date and somewhat simplistic, but serves as a reasonable example for what can be done I chose the variant I'm intimately familiar with in order to be able to pass on knowledge or help with maintenance. But for the future I strongly recommend picking the good bits from the other implementations that control complexity in static configuration parts through Nix expressions.	2025-02-13 00:26:28 +01:00
Valentin Gagarin	3bbd6acf4f	re-use global pins	2025-02-13 00:26:28 +01:00
fricklerhandwerk	84871c6ef9	docs: fix broken links	2025-02-10 15:05:21 +01:00
fricklerhandwerk	bac184c53d	docs: fix broken link	2025-02-10 15:03:49 +01:00
Nicolas “Niols” Jeannerod	1b8be1da27	keys: add contributor kiara (#97 )	2025-02-04 12:54:10 +01:00
Nicolas “Niols” Jeannerod	93e21f188a	Rekey secrets	2025-02-04 12:46:12 +01:00
Nicolas “Niols” Jeannerod	0c56c89f74	Document adding a contributor	2025-02-04 12:45:47 +01:00
Kiara Grouwstra	9f4e2a00b8	keys: add contributor kiara	2025-02-04 11:18:05 +01:00
Nicolas “Niols” Jeannerod	12ab424a89	Rework `infra` to handle sharing options between resource and NixOS configuration (#96 )	2025-02-03 10:06:59 +01:00
Nicolas “Niols” Jeannerod	0e6c96a2be	Document the `procolixVm` options	2025-01-31 17:23:12 +01:00
Nicolas “Niols” Jeannerod	4d00635e69	Move old `procolix.vm` options to new `procolixVm` ones	2025-01-31 17:15:12 +01:00
Nicolas “Niols” Jeannerod	eaad4daa39	Cleaner resource definition	2025-01-31 16:57:21 +01:00
Nicolas “Niols” Jeannerod	e0b4dd4d5b	Shorter name	2025-01-31 16:48:08 +01:00
Nicolas “Niols” Jeannerod	54194cd494	Share options between resource and config	2025-01-31 16:47:33 +01:00
Nicolas “Niols” Jeannerod	8cfc943297	Cleanup	2025-01-31 16:36:18 +01:00
Nicolas “Niols” Jeannerod	ba97ed26d0	Get rid of useless `self` and `providers` arguments	2025-01-31 16:34:21 +01:00
Nicolas “Niols” Jeannerod	564938e52d	Clean up handling of secrets in infra	2025-01-31 16:29:31 +01:00
Nicolas “Niols” Jeannerod	8fa7bd4df5	Add a `default` deployment containing everything	2025-01-31 15:24:41 +01:00
Nicolas “Niols” Jeannerod	9c85431a22	Move everything into `common` with better names	2025-01-31 15:22:28 +01:00
Nicolas “Niols” Jeannerod	dedd70dc0e	Make `vm*/default.nix` resources	2025-01-31 15:19:55 +01:00
Nicolas “Niols” Jeannerod	4f761bfc1f	Start building a `procolixVm` resource module	2025-01-31 15:08:47 +01:00
Nicolas “Niols” Jeannerod	aed74dc599	Bump other flake inputs	2025-01-31 14:39:28 +01:00
Nicolas “Niols” Jeannerod	1d05993127	Bump NixOps4 in particular, follow the split of `nixops4-nixos` to its own repository.	2025-01-31 14:11:46 +01:00
Nicolas “Niols” Jeannerod	1f2ea73e69	Clean up resource definition	2025-01-31 14:03:37 +01:00
Nicolas “Niols” Jeannerod	232680c9bf	Document failure when running NixOps4 not from the repo's root	2025-01-31 12:15:27 +01:00
Nicolas “Niols” Jeannerod	d121cd6a5b	Remove `vm02117` Machine was running on the old supervisor and was decommissioned manually.	2025-01-31 11:06:23 +01:00
Nicolas “Niols” Jeannerod	a7848beda0	Revert "`nix flake update`" This reverts commit `f7537f3e00`.	2025-01-31 10:59:55 +01:00
Nicolas “Niols” Jeannerod	873a1c9177	Automatically git `root` access to all contributors	2025-01-31 10:59:36 +01:00
kevin	d92d5f40ae	added Kevin's SSH public key to the contributors (#88 ) Co-authored-by: Nicolas “Niols” Jeannerod <nicolas.jeannerod@moduscreate.com> Reviewed-on: Fediversity/Fediversity#88 Reviewed-by: Valentin Gagarin <valentin.gagarin@tweag.io> Co-authored-by: kevin <kevin@procolix.com> Co-committed-by: kevin <kevin@procolix.com>	2025-01-31 10:46:14 +01:00
Nicolas “Niols” Jeannerod	f7537f3e00	`nix flake update`	2025-01-30 16:27:18 +01:00
Nicolas “Niols” Jeannerod	004131dec6	Factorise infra resource definitions (#82 )	2025-01-30 13:22:41 +01:00
Nicolas “Niols” Jeannerod	5522595296	Factorise the deployment definition	2025-01-30 12:57:11 +01:00
Nicolas “Niols” Jeannerod	34eb7263cc	Factorise the resource definition	2025-01-30 09:53:45 +01:00
Nicolas “Niols” Jeannerod	2bb1590d54	Remove ISOs after provisioning (#81 )	2025-01-29 15:36:13 +01:00
Nicolas “Niols” Jeannerod	f547f451e1	Remove ISOs after provisioning	2025-01-29 15:35:49 +01:00
Nicolas “Niols” Jeannerod	3f39f6ebd0	Move web server definition to `infra` (#67 )	2025-01-29 15:34:58 +01:00
Nicolas “Niols” Jeannerod	d4e1760c70	vm02117 is not the web server anymore	2025-01-29 15:34:48 +01:00
Nicolas “Niols” Jeannerod	f475b1f56c	Move web server definition to `infra`	2025-01-29 15:34:48 +01:00
				`@ -0,0 +1 @@`
				`ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINpebsCsP+GUMZ2SeVKsuDMwLTQ8H1Ny3oVgf73jsgMg hedgehog 2025`
				`@ -0,0 +1 @@`
				`ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDHTIqF4CAylSxKPiSo5JOPuocn0y2z38wOSsQ1MUaZ2 kiara@procolix.eu`
				`@ -0,0 +1 @@`
				`ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOrmZ9eMPLDSiayphFhPi7vry5P2VlEr7BvIjtnpN7Td`