diff --git a/.sops.yaml b/.sops.yaml index f625073..dc4ec9b 100644 --- a/.sops.yaml +++ b/.sops.yaml @@ -7,20 +7,17 @@ keys: - &linode-gui age1hrx8qj02fj2ea6d4g9vqhyj9hl7fppkjqfdx2l37py3h6pdkr95s8n8rvs - &linode-minimal age1e7l8dusgmgfzd2cxrrzwepzjxt69hzqj4epee0cs27u6yg4kxcuqm34ncx - &linode-nix-cache age1jcx3yajjhghn8qh8za3yeu8nxykzlg3p4nrv03vnfvzl0mzayg2qmg940e - - &linode-server age1sweerhrga9yf8x6sv0apz4ed4g48rnlcq34rpv20t0rcelwgpgeqwvndzz - &linode-tailscale-router age1f7usptjx9rv4rxauasve200gxtdt9jkqhhdqstlf20wvlm7u75rsjfw50m - &lxc-docker age17jqc66x9yeshfgd9v78mj483r4zzarqdtuxtrkxe4x5mw679gphshd94th - &lxc-minimal age1px0h5l9zp2dww0m8fncrc82kfdmzplsfv2ltat7sna28xpg09pqqcl3s2k - &lxc-nix-cache age1ufg390ydrmma849t9xfkxxl5xvdkk6mngnlzhmy7mvuaje8sgcmsmnq6l7 - &lxc-pxe-boot age16j42pdc5dr6wnj7xayhkqdj2rny9u68fcqejs50hqq42scssh4gsnrrnlt - - &lxc-server age1nruncs4l0ufk7yuc4des8p99c0alfndl0lhsws8tycl5pplfp56s30af5f - &lxc-tailscale-router age1k7d2du5mejsmv5rzavm4xwgpthqvcfsehduquv28nzs53zppa3kqngfxq2 - &lxc-tor-relay age16kqfmvz4e23hmdlqresnyw69ej604s320mmd49h4hm3fhqchtgyqrws0k2 - &proxmox-docker age1arhf2q45zw6wf2uevju4savp575x3m2tfvved5zzq3ay92ynua9s3cm92c - &proxmox-gui age19mn8zrxl8zpps9yvrh4euquvygpp4fp8queg7xc6qhtnl4ng8c9qx02qwn - &proxmox-nix-cache age1jlltcv5jcnm40z5k0q6hv053k2rqpqvemtuecdwn527uw8uqz4es3x7m68 - &proxmox-pxe-boot age1ug787sgt6st6k82fgkrug2lzltw4qsukrrqqs3w27ewwqj8rg4hsxcmylz - - &proxmox-server age1529taqdwr6t0w7cvzmty0d5y5593wffl0krt48j6uc4u39k56g2qf6ywtp - &proxmox-tailscale-router age1zhfyuzlq40reuqlr34gf77852nhs3t6mqfzrqmas8z6sxk7tcfhsungrm0 - &proxmox-ha-server-1 age1k73g8x47hs93wcv7qh92n3htz8pl295g49hyvlrf3570mts0hgys5g04d6 - &proxmox-ha-server-2 age1fefy6dk8zn5c3edwmrs9vwx79quftnt784m628t9e34q3ft3cehqz8u72r @@ -41,20 +38,17 @@ creation_rules: - *linode-gui - *linode-minimal - *linode-nix-cache - - *linode-server - *linode-tailscale-router - *lxc-docker - *lxc-minimal - *lxc-nix-cache - *lxc-pxe-boot - - *lxc-server - *lxc-tailscale-router - *lxc-tor-relay - *proxmox-docker - *proxmox-gui - *proxmox-nix-cache - *proxmox-pxe-boot - - *proxmox-server - *proxmox-tailscale-router - *proxmox-ha-server-1 - *proxmox-ha-server-2 @@ -67,14 +61,6 @@ creation_rules: - *lxc-nix-cache - *proxmox-nix-cache - - path_regex: secrets/server\.yaml$ - key_groups: - - age: - - *admin - - *linode-server - - *lxc-server - - *proxmox-server - - path_regex: secrets/tor-relay\.yaml$ key_groups: - age: @@ -174,14 +160,6 @@ creation_rules: - *proxmox-gui - *linode-gui - - path_regex: secrets/server\.keytab$ - key_groups: - - age: - - *admin - - *linode-server - - *lxc-server - - *proxmox-server - - path_regex: secrets/docker\.keytab$ key_groups: - age: diff --git a/docs/ip-addressing.md b/docs/ip-addressing.md index 408f523..b57aad4 100644 --- a/docs/ip-addressing.md +++ b/docs/ip-addressing.md @@ -80,10 +80,10 @@ failover transparently without reconfiguration. | `ha-server-1.storage.home` | `192.168.20.228` | HA node 1 storage-client NIC (ens20 / vmbr2) | | `ha-server-2.storage.home` | `192.168.20.227` | HA node 2 storage-client NIC (ens20 / vmbr2) | | `docker.storage.home` | `192.168.20.225` | Docker host storage-client NIC (eth1 / vmbr2) | -| `server.storage.home` | `192.168.20.226` | server VM storage-client NIC (temporary) | +| `server.storage.home` | `192.168.20.226` | server VM storage-client NIC (decommissioned — remove DNS record after VM is destroyed) | -PTR records exist for all five. `server.storage.home` and its PTR should be -removed when server.sweet.home is decommissioned (Stage 6d). +PTR records exist for all five. Remove `server.storage.home`, `server.sweet.home`, +and their PTRs from FreeIPA DNS once the server VM is destroyed. --- @@ -131,7 +131,7 @@ All VMs and LXC containers run on pve1. | `192.168.2.229` | ha-vip-lan | HA file server LAN floating VIP (Pacemaker `vip-lan`) — LAN iSCSI + NFS | Active | | `192.168.2.228` | ha-node1 | HA file server node 1 — management NIC | Active | | `192.168.2.227` | ha-node2 | HA file server node 2 — management NIC | Active | -| `192.168.2.226` | server | Current NFS/ZFS file server — retires when HA is live | Retiring | +| `192.168.2.226` | server | Former NFS/ZFS file server — decommissioned | Removed from flake | | `192.168.2.225` | docker | Docker / Traefik stack | Active | | `192.168.2.224` | nix-cache | Nix binary cache + remote builder | Active | | `192.168.2.223` | pxe-boot | PXE / TFTP / HTTP netboot server | Active | @@ -174,7 +174,7 @@ Internal to pve1 only. Proxmox bridge `vmbr2`, no physical NIC attached. | `192.168.20.229` | ha-vip-storage | Pacemaker floating VIP — NFS + iSCSI endpoint | | `192.168.20.228` | ha-node1 | Storage-client NIC (ens20 / vmbr2) | | `192.168.20.227` | ha-node2 | Storage-client NIC (ens20 / vmbr2) | -| `192.168.20.226` | server | Storage-client NIC (ens19 / vmbr2) — temporary, for final rsync before decommission | +| `192.168.20.226` | server | Storage-client NIC (ens19 / vmbr2) — decommissioned | | `192.168.20.225` | docker | Storage-client NIC (eth1 / vmbr2) — NFS client | | — | no gateway | Isolated — not routed to LAN or internet | diff --git a/flake.nix b/flake.nix index c0aa52d..31a26e1 100644 --- a/flake.nix +++ b/flake.nix @@ -109,9 +109,6 @@ proxmox-nix-cache = mkTarget { platform = "proxmox"; buildType = "nix-cache"; hostPath = ./hosts/nix-cache/host.nix; }; lxc-nix-cache = mkTarget { platform = "lxc"; buildType = "nix-cache"; hostPath = ./hosts/nix-cache/host.nix; }; - linode-server = mkTarget { platform = "linode"; buildType = "server"; hostPath = ./hosts/server/host.nix; }; - proxmox-server = mkTarget { platform = "proxmox"; buildType = "server"; hostPath = ./hosts/server/host.nix; }; - lxc-server = mkTarget { platform = "lxc"; buildType = "server"; hostPath = ./hosts/server/host.nix; }; linode-docker = mkTarget { platform = "linode"; buildType = "docker"; hostPath = ./hosts/docker/host.nix; }; proxmox-docker = mkTarget { platform = "proxmox"; buildType = "docker"; hostPath = ./hosts/docker/host.nix; }; diff --git a/hosts/server/host.nix b/hosts/server/host.nix deleted file mode 100644 index 9da974e..0000000 --- a/hosts/server/host.nix +++ /dev/null @@ -1,24 +0,0 @@ -{ vars, ... }: - -{ - networking = { - hostName = vars.nfsServerHost; - hostId = "6689f93e"; - useDHCP = false; - interfaces = { - ${vars.vmLanInterface}.ipv4.addresses = [{ address = vars.serverIp; prefixLength = vars.lanPrefixLength; }]; - ${vars.vmStorageInterface}.ipv4.addresses = [{ address = vars.serverStorageIp; prefixLength = vars.haClientPrefixLength; }]; - }; - defaultGateway = { address = vars.lanGateway; interface = vars.vmLanInterface; }; - nameservers = [ vars.domainControllerIp ]; - }; - - services.beszel.agent.environment = { - EXTRA_FILESYSTEMS = "${vars.storageRoot}/${vars.nfsShares.dockerVolumes.subpath}"; - LOG_LEVEL = "debug"; - }; - - # Preserved from the pre-refactor `server` target — stateVersion must never - # be bumped on an already-installed machine. - system.stateVersion = "25.05"; -} diff --git a/modules/build-types/server.nix b/modules/build-types/server.nix deleted file mode 100644 index 1a5d4b1..0000000 --- a/modules/build-types/server.nix +++ /dev/null @@ -1,121 +0,0 @@ -{ vars, lib, pkgs, ... }: - -let - poolName = lib.removePrefix "/" vars.storageRoot; - - # For each NFS share subpath, generate every ancestor path so ZFS datasets - # are created parent-first. e.g. "docker/config" → ["docker" "docker/config"] - ancestors = path: - let parts = lib.splitString "/" path; - in lib.imap1 (i: _: lib.concatStringsSep "/" (lib.take i parts)) parts; - - poolDatasets = lib.unique ( - lib.concatMap (share: ancestors share.subpath) - (lib.filter builtins.isAttrs (lib.attrValues vars.nfsShares)) - ); - - # Generates /etc/exports lines for all nfsShares data entries (every - # attrset value — excludes the bare `options` string). Both server and - # ha-server export the same share set from different storage roots, so - # this helper is the single source of truth for the export line format. - mkNfsExports = storageRoot: - lib.concatMapStrings - (share: " ${storageRoot}/${share.subpath} ${vars.lanCidr}${vars.nfsShares.options}\n") - (lib.filter builtins.isAttrs (lib.attrValues vars.nfsShares)); -in -{ - imports = [ - ../beszel/enable-agent.nix - ../services/zfs/enable-service.nix - ]; - - boot.zfs.extraPools = [ poolName ]; - - # On a fresh image deploy the data disk (scsi1) starts blank — no pool - # exists yet, so zfs-import-tank.service would spin for 60 s and fail. - # This service runs first: if the pool is already present it exits instantly; - # otherwise it creates it (with all required datasets) so the standard - # import service finds it ready on the very first boot. - systemd.services."zfs-init-${poolName}" = { - description = "Initialize '${poolName}' ZFS pool on first boot if not present"; - wantedBy = [ "zfs-import-${poolName}.service" ]; - before = [ "zfs-import-${poolName}.service" ]; - after = [ "systemd-udev-settle.service" ]; - unitConfig.DefaultDependencies = false; - serviceConfig = { - Type = "oneshot"; - RemainAfterExit = true; - }; - path = [ pkgs.zfs_unstable ]; - script = '' - # Already imported — nothing to do. - if zpool list "${poolName}" >/dev/null 2>&1; then - exit 0 - fi - - # Locate the data disk first — used for both the fallback import - # attempt and, only if the disk is genuinely blank, pool creation. - DATA_DISK="" - for candidate in /dev/disk/by-id/scsi-*drive-scsi1; do - [[ "$candidate" == *-part* ]] && continue - [ -b "$candidate" ] && DATA_DISK="$candidate" && break - done - - if [ -z "$DATA_DISK" ]; then - echo "zfs-init-${poolName}: no data disk found (expected /dev/disk/by-id/scsi-*drive-scsi1)" >&2 - exit 1 - fi - - # Try importing via the by-id symlink directory first (normal path), - # then fall back to scanning the disk directly. The two-step exists - # because of a udev race: systemd-udev-settle.service can clear before - # /dev/disk/by-id/ entries are fully populated, causing the first - # import to fail even when the pool is intact on the disk. - if zpool import -d /dev/disk/by-id -N "${poolName}" 2>/dev/null; then - exit 0 - fi - if zpool import -d "$DATA_DISK" -N "${poolName}" 2>/dev/null; then - exit 0 - fi - - # Both import attempts failed. Before creating a new pool, verify the - # disk is genuinely blank — if ZFS label metadata is present the import - # failed for some other reason and we must not clobber existing data. - if zdb -l "$DATA_DISK" 2>/dev/null | grep -q "name: '${poolName}'"; then - echo "zfs-init-${poolName}: $DATA_DISK has ZFS pool '${poolName}' metadata but import failed — refusing to overwrite existing data. Run 'zpool import -d $DATA_DISK ${poolName}' manually to investigate." >&2 - exit 1 - fi - - # Disk is genuinely blank: create the pool. -f is intentionally - # omitted so that if we somehow reach this point with an existing pool - # on the disk, zpool refuses rather than silently destroying data. - echo "zfs-init-${poolName}: creating pool on $DATA_DISK" - zpool create "${poolName}" "$DATA_DISK" - ${lib.concatMapStrings (ds: '' - zfs create "${poolName}/${ds}" - '') poolDatasets} - ''; - }; - - systemd.services.nfs-server = { - after = [ "zfs-mount.service" ]; - requires = [ "zfs-mount.service" ]; - }; - - # rpc-svcgssd handles Kerberos/GSS-API for NFS. Not needed: exports use - # standard auth, not sec=krb5. On IPA-joined hosts the keytab exists (host/ - # principal only) but has no nfs/ principal, causing spurious failure. - # Mask it so nfs-server's Wants= can't pull it in. - systemd.services.rpc-svcgssd.enable = false; - - services.nfs.server = { - enable = true; - exports = mkNfsExports vars.storageRoot; - }; - - # mountd (20048) is needed for showmount/NFSv3 mount protocol — without it - # clients can reach portmapper (111) and get the mountd port back, then - # time out trying to connect to it. All three ports need TCP and UDP. - networking.firewall.allowedTCPPorts = [ vars.ports.nfsRpcbind vars.ports.nfsd vars.ports.nfsMountd ]; - networking.firewall.allowedUDPPorts = [ vars.ports.nfsRpcbind vars.ports.nfsd vars.ports.nfsMountd ]; -} diff --git a/secrets/server.keytab b/secrets/server.keytab deleted file mode 100644 index 8e6a135..0000000 --- a/secrets/server.keytab +++ /dev/null @@ -1,26 +0,0 @@ -{ - "data": "ENC[AES256_GCM,data:aqlMnoVkGtH9z3fJRweeC0OYf7LGqJU2sWA9Q25dKK6NuNyJd4BvjPtpfeg/WhVtJsaOtcbwVm4WAhVK9FARE8g8j+vmq0f6BAU4s6mx0ZIhl+mP+/hIpt//LOdd+9YezelJxdpzUyZbdAngU99rsTluLRe2XmZ7Fquxd8yH/OHenSDY6dizp9+5jfEi8EU+EmuXvuWMPY59xnlnqYNPfSFxs43/pS402LzJoJ5H+cBPprddkUBVzy4cBQvMnrRFUSjnqp74ovZkfIWFqDWQ5YgSU2PjatBg18oulZ7wNRhQ6OLqj6gsu+xrMjNFwnp7rMlA3X//hIidxTkVcYITycXd8KzuMIaofUpnwoyT34fy6+H35/39iiEyG4LRTrOOKRDzXkY2rhJUxFSZ8GlhNhMd0RlkmLngVYrtjsswJ9meIwoAFLPYt7BC61PJf0TXdtk=,iv:mCA819J9LpAOj8QxFAkrHI9wFJIy8qVxv31D6IwWFnk=,tag:qqMtM0eyHbQEyl6ND/wf7g==,type:str]", - "sops": { - "age": [ - { - "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOZVpRYmNMQ1E4ZlFXMDVq\nbW1FcnYzWTBHQmdhSjlsZUtZK3dzNUZjY1FvCkV4VXU4MTcwNVZoZUpVVS9JeHE5\nbGk3UzE3YmpZQ1JISHV0RHJqSG9ZNXcKLS0tIHhBdnIvMjJkeWlVRE9Fb0FhWjNX\nUjBVWDltK2w0akkwOTJaTGNSWWNrRXMKqZRNnHiXvn1QBoSGdABp7vOqNlsEN6Xr\nDp3NByXow6PuRuWvQXHzd+WC+ADkwNaaiT6TUrbZcd/Pl8Ges9kcZg==\n-----END AGE ENCRYPTED FILE-----\n", - "recipient": "age1njap586hc0q43kr03g6c8eqhdsmk8zcafkl3f83xwlc2gqhlmfgs4tmwad" - }, - { - "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2VFBxc2ZMUFp0YkJhVFhW\nc0ZNbnJUcGtkT1VLR2YrVGhRRFVTZFlyZXlJCmVnblNBNGxIdHh4Q0IweWR1b0dq\nRWFyOURuWkdkRE1RTnJRMEpXdk9HaUUKLS0tIFhKV3FoWW1zRk1pMlhuWWlhV2E5\nQzJTRHAyc0JtSjd2NHlJODZVbndaVDgKFA4565X/4FqNq/fZDZTg81/55hZi4c7b\nTti2AnyE3OcY/kurXJFHRinVMqURQf1fx9MxqUYRitiCz4qe5zFF+A==\n-----END AGE ENCRYPTED FILE-----\n", - "recipient": "age1sweerhrga9yf8x6sv0apz4ed4g48rnlcq34rpv20t0rcelwgpgeqwvndzz" - }, - { - "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwRWlKTFNocnBRN01pZ0hm\na3pyRUkxMWM3dE1iTkZZcGRYUFcyb1RDb2h3Ckt4blpGZHBjcnZ4SVE5UnF4cmY4\nWW0rZG5wUkZINVk5a2lmSzN2L3JJY1kKLS0tIExpWGlBRFZJVGpGbFhxRE5ZYjBo\nQVliTlFIZ1U5dE9xbDhHMUtxenpBSm8KY6sIFEfK8p+70IXsC4Jwb9Lm/pd9+V6K\n4JAzGrpA6mAuIwwSNnbdcA5j8FmBhCpK6nLBWmFhGm9Y+MRTaM7Jrw==\n-----END AGE ENCRYPTED FILE-----\n", - "recipient": "age1nruncs4l0ufk7yuc4des8p99c0alfndl0lhsws8tycl5pplfp56s30af5f" - }, - { - "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoV0pIUXlyOFFTUHVTdllu\neG10VENOYWl5Wk0ycnpLUytTbnlrQ25pMkFRCnhyRU5xWW9vQXJJOHdFMGZqMkR1\nSktqT3lOdVVPRUN4YTlveGp0NXpqd0kKLS0tIGRaTktra0ZtSVpzSHBrY3VSSUph\nRVRZOSsxTTNmMmltMlJnVy9oT2VEWU0Krxf49B1BsrWn05fqg+cZ0k0PtfJJNfn0\nUL44RUWXWbK2igQHaIct9DfYe7DEonBJeROuxDYm8g7yNOv15S+P4Q==\n-----END AGE ENCRYPTED FILE-----\n", - "recipient": "age1529taqdwr6t0w7cvzmty0d5y5593wffl0krt48j6uc4u39k56g2qf6ywtp" - } - ], - "lastmodified": "2026-07-28T01:44:26Z", - "mac": "ENC[AES256_GCM,data:eyOSn03dzHSgkshPzLVwc95382eEFaDQarHs9l83dtcsb1Ui9CjkKipl2DVSUb6bdMUH1qKYmXqJhwFnAZbFZFjT4VTKtutNtM+OkhVXfT+fJs+1+u7k+ZUYFL9HuxKA6AWpwX3eJ8vmJDJZaAayJbm4PRzOyJywvKeneQqdUS0=,iv:QRKltR4qzVofo/Elt2Us/lrHlD7BenX605X31x+Ng78=,tag:SZ97CcfgMJeu3yqNk8Y/cA==,type:str]", - "version": "3.13.2" - } -} diff --git a/variables.nix b/variables.nix index 4feb863..533de75 100644 --- a/variables.nix +++ b/variables.nix @@ -15,7 +15,6 @@ nixCacheIp = "192.168.2.224"; # nix-cache LXC container LAN IP tailscaleRouterIp = "192.168.2.222"; # tailscale-router LXC container LAN IP torRelayIp = "192.168.2.221"; # tor-relay LXC container LAN IP - serverIp = "192.168.2.226"; # server (NFS/ZFS) Proxmox VM LAN IP dockerIp = "192.168.2.225"; # docker Proxmox VM LAN IP pbsIp = "192.168.2.244"; # Proxmox Backup Server LAN IP (not NixOS-managed) domainControllerIp = "192.168.2.253"; # FreeIPA domain controller — authoritative DNS for sweet.home (not NixOS-managed) @@ -124,7 +123,6 @@ haServerVip = "192.168.20.229"; # storage-client floating VIP on vmbr2 (Pacemaker IPaddr2 vip-storage, VLAN 20) haServerLanVip = "192.168.2.229"; # LAN floating VIP on vmbr0 (Pacemaker IPaddr2 vip-lan) — NFS access dockerStorageIp = "192.168.20.225"; # docker CT storage-client IP (vmbr2 / eth1, VLAN 20) - serverStorageIp = "192.168.20.226"; # server VM storage-client IP (vmbr2 / ens19, VLAN 20) — temporary, for final rsync haClientCidr = "192.168.20.0/24"; # storage-client subnet — VLAN 20, internal to pve1 only haClientPrefixLength = 24; # storage-client subnet prefix length (/24) haStorageRoot = "/srv/ha-data"; # XFS-over-DRBD mount point on the Active node diff --git a/vars/per-machine/linode-server/openssh/ssh_host_ed25519_key.pub/value b/vars/per-machine/linode-server/openssh/ssh_host_ed25519_key.pub/value deleted file mode 100644 index 7a0e2f5..0000000 --- a/vars/per-machine/linode-server/openssh/ssh_host_ed25519_key.pub/value +++ /dev/null @@ -1 +0,0 @@ -ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPW/X9Mdrqs0wLR7XbEDTihk7TEkNZ3LcCeXoa2ITSDA linode-server diff --git a/vars/per-machine/linode-server/openssh/ssh_host_ed25519_key/secret b/vars/per-machine/linode-server/openssh/ssh_host_ed25519_key/secret deleted file mode 100644 index 48bc555..0000000 --- a/vars/per-machine/linode-server/openssh/ssh_host_ed25519_key/secret +++ /dev/null @@ -1,14 +0,0 @@ -{ - "data": "ENC[AES256_GCM,data:hzI2cJ81+Psv35MMZO06UHpC8F9FLVkfUzn0ReuR+WoUds8D5zhDFbQHeR6ByeHTuK8Hlj712okhoXh6Vm7l3WmhLJZkr8IGLsV9W+P2PYityjuOtBPrphrKUeSqxJfjQ31/EhZLOqw/508XUmQDNcs1/n2g0TtQ2UQSTAuO8r1OlRfRSPizvVdj7lu+Vqg3dDBRETSOJAYIh8XQXoQWl3M4dS7jOYUvgc4EsYOWrvPPPS+8xXzctBPeToasY0IyWtLzoeNajCs5EpH5u7S5K9S40/vFPa45Ic2IxEkb1HHClyN6lXWbnc5QlJ5HPrq+2YBU2y9dJHd9DQiwEbcEBIvR3/Lo9puVDppXx9kez7i4XR1UHU7WVu39nQZuP50BQQazj+eM0/HJapXfjoqtaaq0qAGN4onnmRd0vEmrZZl4WMXmx8m9HhxdNJoZ4C2Wb2skdHZok88tPzjd4r7xKzVhAbB+wqS4LML6FmCNk+m0USQXa25USXs0JDV7lgiTFQJPE/67JGa820WFicGs,iv:YmOeK2Ha3yBXumVO9strgLgqNmPOcnqwUDJv5QNR1WM=,tag:Z7kZvQLDOKx3uX4dRXJqeQ==,type:str]", - "sops": { - "age": [ - { - "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOSWl5ajRSVndlMHJJQTFp\nYzRRU3RQMEVzazB0Sm5FdWZmMzBRaUl5RUFvCjgwRUZWdUpvUjkzWHFVdThIZ1ZV\nM2RMNy9pUWF4VVBCVHBGWHgwakhKQ2cKLS0tIERIOTVVZm55QWkvL25SRGZkZmtI\nT2o3ZEJNQ2hmTDNoRUx2Z3UxcmlyekUKLOajmvRfLdCJL74PKSgBtIXDuAVd8NwM\nh4BtDs0hONOz82JaBqFw8Uz28hVFG/gcS80br1o2klqPd2gN62PCVw==\n-----END AGE ENCRYPTED FILE-----\n", - "recipient": "age1njap586hc0q43kr03g6c8eqhdsmk8zcafkl3f83xwlc2gqhlmfgs4tmwad" - } - ], - "lastmodified": "2026-07-25T11:45:33Z", - "mac": "ENC[AES256_GCM,data:JJC+12gTCsDVvMWRtL5cj50kf1n6Xn2j1hNBnwvZXUA9Pdd96SXt61U/Q80h8GZ7Ycs/slsV7h5f3g6+8tV0PcdBM/vy0vPM5qX1zMySyMv2p+dkJb9MwQpPg2xAQ9jjYM9237p5n9nysgu74h4V7ccBqmBzp764bL9wx6hEzS4=,iv:U6u1GFvoxaqxmHv1zCht24nW0ZMJR2b4pZqCG3bGNzs=,tag:MocwywOBg/1rUuoSADuJVA==,type:str]", - "version": "3.13.2" - } -} diff --git a/vars/per-machine/lxc-server/openssh/ssh_host_ed25519_key.pub/value b/vars/per-machine/lxc-server/openssh/ssh_host_ed25519_key.pub/value deleted file mode 100644 index 606d4f1..0000000 --- a/vars/per-machine/lxc-server/openssh/ssh_host_ed25519_key.pub/value +++ /dev/null @@ -1 +0,0 @@ -ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILVRdEddGd+AMNe4kXbmA9UXK8JRsPEuxPx1vhNT9ZG8 lxc-server diff --git a/vars/per-machine/lxc-server/openssh/ssh_host_ed25519_key/secret b/vars/per-machine/lxc-server/openssh/ssh_host_ed25519_key/secret deleted file mode 100644 index 43bae66..0000000 --- a/vars/per-machine/lxc-server/openssh/ssh_host_ed25519_key/secret +++ /dev/null @@ -1,14 +0,0 @@ -{ - "data": "ENC[AES256_GCM,data:JTmbN++hNMddBdMKIdzqZ6hLD1So9hyAzwbce/QvqWBsa1At85cMRUx+P1Yi4Sq2aXCg1Tf2g8XC9DXsVfMusUGEHrHbJApwkia/xHNMcFOohscUkPltXnm/lRilm4hwJUv6ay6UyLvIqMQAzzC8YWebHkKo00rxRxQWQ77wjmUG4dJeujlK5wMH0zTXUkrf7tIdJ20Zzg1BrAU6s4FYLvRvcUSW2ROu+sF2Sxgy1qVNJfDrRnY4REh9013tTSB5IlgJzUSQLs1vHr7EpIfmA5MCCSkZjplGCKvxkcNHB3aaOkrxkGa18JeWoklRen31UPU9zMUhTjAZ6VbbIagxzaFGKVP27cOiHQPNpEIMXwaRzoprjBX2PJ/Bs6pxe6hBpmiKOb40XdtxFQx2rofPcbQwklTpM5SFwvK+/bgawy1m8O3NHMhcw1qvd+6KjUdqy++/ivFC2Nyy+VfUDyGu0JLK3X+YqU6JXXMcUWOq79pVQIL3q1ofbhVHQ8p17+V3wQQUB3kPo4EEcKikI7Z9,iv:TVYVDOiTsgXaIcuJdnd3djPWXCMDDGjpefAW0MR+7Es=,tag:jIYO1oatbvInp77d4fC8mQ==,type:str]", - "sops": { - "age": [ - { - "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5QlNzNEFqSkhKTVhWVisr\nS21zdVBZSnpITDdrb243c0pUdDR5WXl1bFVrCmkxaWR6U01sLzhLL0MwRGh1VG5D\nNEFiU1FtNXRBdGtPellFTXYraitCUTgKLS0tIFdwWGFnMWFCN1ZvK2VBMWR2VTJZ\nRlQ4dEpmczA4bEdvUkNhaC93OXhDTkEK0QBkaLV1mbTMlSnjmN4x+qljGipHM/DQ\nUlmBYyi3nEOrI36I/Mm8yoBZai/qWqdg6IG+sxDE49ZOLp9PhpAWww==\n-----END AGE ENCRYPTED FILE-----\n", - "recipient": "age1njap586hc0q43kr03g6c8eqhdsmk8zcafkl3f83xwlc2gqhlmfgs4tmwad" - } - ], - "lastmodified": "2026-07-25T11:45:44Z", - "mac": "ENC[AES256_GCM,data:/l6pa3LE7+kFYqH2pv2RIcYBycLrZfpb92Al3SIU2tMeFUUvh+C8q8P9CgmAaiQuQ8S2dfYIJVx67zc7cRqI/UL/dFvDSv0YaMTGQ8Wn4fIXSh01EL0f/QVaIfb+uuvyEsdjy2ScWTWcCf2ICnC/zaMmp+xP+MmR1DRBM8KPIkY=,iv:xsmaYZ6dyHLU3BVfT3jxbfWWeBvYKMT+D9MtRxF9jlo=,tag:VzOiutHQJGHqb5UCI+cxSA==,type:str]", - "version": "3.13.2" - } -} diff --git a/vars/per-machine/proxmox-server/openssh/ssh_host_ed25519_key.pub/value b/vars/per-machine/proxmox-server/openssh/ssh_host_ed25519_key.pub/value deleted file mode 100644 index 3394e06..0000000 --- a/vars/per-machine/proxmox-server/openssh/ssh_host_ed25519_key.pub/value +++ /dev/null @@ -1 +0,0 @@ -ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGQHSubxjvaIV9Xp5ABJSKsajCZBGyGmjsdaA2TWCFP8 proxmox-server diff --git a/vars/per-machine/proxmox-server/openssh/ssh_host_ed25519_key/secret b/vars/per-machine/proxmox-server/openssh/ssh_host_ed25519_key/secret deleted file mode 100644 index dbae6bf..0000000 --- a/vars/per-machine/proxmox-server/openssh/ssh_host_ed25519_key/secret +++ /dev/null @@ -1,14 +0,0 @@ -{ - "data": "ENC[AES256_GCM,data:GdVHSekFtRtppf8xxMPsDE0cu8Hwq3ol0iJTfrwKwaAB0IW8YS8TFAeRnfOI5AE3P1JUaGDZ1Od4UXu4Jk2+uYCgwz074qc1WukzUsd8Q3G03ojdrTA13uH8YCUTRsm3bQfB+kmH5qefn9j88UJq7TYiTLe3U0DUU/B83lgyiFIygP8CKWDgFH3jWZOWPmyVa4Z1fMWVsiNhjO4hHduamN/I2FOY7U2TI5+zcYgGeunjnniLHcQdiO0iK9TOP5SckOVPZOy6daKzGcckEq03NV4y+miSucEUHlcQqMUyvsJwETIaCq28xR2MDTyDz42SL2HIodb7FyREtxd91W6gPN1j51yUZxt4WA9R8/WczDcUgmROK+HInPp+ktjWqv2ymXXV5xidxh7m+vrGTPC+YQqyFD4eIp3+h2S/vyzHimBa2rdEp9NNXTQlH3CfL2aLC95FOme+uKTDqWA2PHfB0rQ5uhHAuAgaX5vb/GTiQii5dq4k2O4MDf9u+fdPuOSCaGdlirWmSE45SvaXLJ3M2zQq7M/UTE+wSFyc,iv:EaIsYnGxf42LWQ3hzBU/HsBda/FHInhjZkwsPLcZMEY=,tag:16OuAs3Ram+xd4RfWEBXkw==,type:str]", - "sops": { - "age": [ - { - "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBETE4vOHhldGRFRjdYaXpi\nSmgzTFlqL3Qzak1CelRBR29jZzR1V0pOQWw0CkhSWDkvbkJWaDVHMzlKNDZUdzhH\nWGoyWXQ1KzJZQU1kQzFvaDk2V2lWQmsKLS0tIHlTY2tua2F1TXBhamsvcDZ0bmI1\nZVFwUGtQWW1HNTM3UUs4bHRZU0xKRDgKBG2iI9JP0lhU5VCWXrpN1b2rYEYk8sOZ\n9FUO14KKMg9QRfSa2iHOa84DByx2hxVRc9wLukBUpkKOAjGSxeGMeg==\n-----END AGE ENCRYPTED FILE-----\n", - "recipient": "age1njap586hc0q43kr03g6c8eqhdsmk8zcafkl3f83xwlc2gqhlmfgs4tmwad" - } - ], - "lastmodified": "2026-07-25T11:45:58Z", - "mac": "ENC[AES256_GCM,data:jG7ohweKKndoadidquejYG/1w9iL+9Xb5/IsU/C9fn/Tq5RXEjrxO37COY8sAD7dvQf7iBNsly7upsjtHaMK8ybjQDaa6IQhoGBlfSOA2O968klaJZRQRiLPzCRet252KXzOtvDscrBvyYItvyqjnW5qBbw7lfT4y2J4OA2ieC0=,iv:mMo7Y6XEjQcchNOY6eaw5LOmjFKaQKx84o9bnGNXCKI=,tag:aHkPjs7uVfv8h0REHN8YmA==,type:str]", - "version": "3.13.2" - } -}