beszel

configurations/nixos/pureintent/default.nix

@@ -12,6 +12,7 @@ in
   imports = [
     self.nixosModules.default
     ./configuration.nix
+    (self + /modules/nixos/linux/beszel.nix)
   ];
 
   users.users.${flake.config.me.username}.linger = true;
@@ -36,6 +37,11 @@ in
   ];
 
   nix.settings.sandbox = "relaxed";
+  nix.gc = {
+    automatic = true;
+    dates = "weekly";
+    options = "--delete-older-than 30d";
+  };
 
   zramSwap.enable = true;
   swapDevices = [{
@@ -43,6 +49,11 @@ in
     size = 32 * 1024; # 32GB in megabytes
   }];
 
+  services.glances = {
+    enable = true;
+    openFirewall = true;
+  };
+
   services.openssh.enable = true;
   services.tailscale.enable = true;
   networking.firewall.allowedTCPPorts = [

modules/nixos/linux/beszel.nix

@@ -0,0 +1,25 @@
+# Beszel monitoring - local-only setup (hub + agent on same machine)
+#
+# Secret file (beszel-agent-key.age) should contain:
+#   KEY=ssh-ed25519 AAAA...
+# Get the KEY from beszel hub web UI (http://localhost:8090) when adding a system.
+{ flake, config, ... }:
+
+let
+  inherit (flake.inputs) self;
+in
+{
+  age.secrets."beszel-agent-key.age".file = self + /secrets/beszel-agent-key.age;
+
+  services.beszel = {
+    hub = {
+      enable = true;
+      host = "0.0.0.0";
+      port = 8090;
+    };
+    agent = {
+      enable = true;
+      environmentFile = config.age.secrets."beszel-agent-key.age".path;
+    };
+  };
+}

secrets/github-nix-ci/srid.token.age

@@ -1,11 +1,9 @@
 age-encryption.org/v1
--> ssh-ed25519 96IXNQ V6z62p+pW3kgBssNzyKXgeSkg1Wd8RL6G1UrumXTIWY
-Ct4rp8A1Gg9ExzUyE63JgzgHD5aaeqakZ6ROAPm/XRE
--> ssh-ed25519 It7HZQ +Hfd+DFL1cxlRFHSfLC2iiEbQ52cir2KgsIAQsgWLj8
-pCD9VDE0GWsr23NRHRCmiZJDrdNN3zKJFY6zNTpzPqg
--> ssh-ed25519 Ysxvmg NzAhvPK21VdhfbEAD5Fk9VSqqeKjE8n5T9yurBeGohs
-qRZzel60SENc1ewUbubi48zRyhxbpGK85Y2j871YPwY
---- R2HwRQqDwwfnDYltxQsw+s8fhBHhXVY+t93Uwh4PNYw
-Ò/´Ý¹³øù{¨Œã?bå¿^i#W©Æ
-’as}ëîÈ­jã„é×
-¹p¨$ç'Dµ°ÿöA•ì›@Èù½6ÅÓ2O<š¸<1A>“0‹D†ó2Ëó½c@Ò¦·)뙀ÿ®7„^?Ï娨§ô–ÄÂlVÑÕ0¾ó5ýöXe8
+-> ssh-ed25519 96IXNQ mx7/eE4DEfCt9BxsJnthcGnR/OO+25hm4yryO/TZvGc
++TiFwUdsSm5CP9APEDnNZ2m6NSHk87WwpNv1fGrRzP0
+-> ssh-ed25519 It7HZQ TjB6x48XJJJCw0fd/EPLhsgPHSxT27YcoVBcMP7z7TQ
+9sMA8uDJlrq0X1Cw/OTQlRGLKCGj9A4BMckCVydoQEU
+-> ssh-ed25519 96tIZg BiOqFUjYKDibqjlwZMzno6rWR9Slwjrj761Izu3aIHk
+umsE6YUJVagwI6AiOtPQhTuLTdWZHPxIEU3VhDM6f3o
+--- rnVRzKjo30T3lQ/4ZUjvV5cTCInwNsFsettECi26aT4
+ü¢%ÓÀO$ó¯ùTÃxdk¶åøêÂúùÞ\ùÖ¤Ûlh;§‡_þªeñyÇ žlŒY–&,…ãÂL<C382>§¿‘¢×#<23>.S» ÓÓ‚¹ZAŽùâHº¡?Ø=&·ýQ$
øòÅ	ÍÇd°z<ßÖ~B¸È(grs³Vý 3¦

secrets/hackage-password.age

@@ -1,10 +1,10 @@
 age-encryption.org/v1
--> ssh-ed25519 96IXNQ nHWK3DGvD5svfKFD/QiyGUyE94MfiIAGvwtowQfB8CE
-HKw+5SB99G+BVO1t6dggH+LFfjWSExUXaPA6TgbXkjo
--> ssh-ed25519 It7HZQ tN1niOfw1WOTti0NAg9IlBSnAkTGloTE5dZGJ3rdXR0
-xw9DqdaqI3o0JuXslaOWcHwN4eLqz4g/lzQPmqZIpLU
--> ssh-ed25519 Ysxvmg K7Taxefo/m7ObS0f62lowOnSNkN4kRO51A68N9tFmGM
-sOEEjMpzH2CPwnmk7X5fbLKJ3Yw/Tr2P33UHM676y8A
---- FrVEGbyKNFknaLXq05sb5gD7cZqPv+UZUcuD+sj/SPA
-œcˆÄŠx=âwj»”¿½@±[
-—ðyª²µ}Ãh”8#‹MÜ .N)Æó•DÑ+‹
+-> ssh-ed25519 96IXNQ HmkQjnB89LYi1B9uuKijjY+2rbasHwwjwCepD13ki1Y
+79ieKetZcWLKMB7QpalExQ8JUksNM4TM/UzACoJzL88
+-> ssh-ed25519 It7HZQ CpSuqMO/s9X2gBccHbWD4h40O2WSfaXlXRlZlUum6Uc
+TMhDOLjCz/UpOgMAtf0vBih2uEZnBz2VkGqaOD+4Xtk
+-> ssh-ed25519 96tIZg Op6i6DAXYghLEBDGR4VXmfPgnDoA7c96jE6jRv9GcWA
+s/FbEOowcWHLuH/3mmONgADTsfU7b8gniLgvXkHQ+yg
+--- xFxBJUQOZ88Z5f+vIPb0LGWDSyYjUWEk4faoVAob/x0
+p_öœu‹R¦^`lÚÐK.
+Í^:‚ñ‚.wt˜yÛ 9àði<C3B0>â$½ž<C2BD>*!;ÿ?Í

secrets/juspay-anthropic-api-key.age

@@ -1,9 +1,9 @@
 age-encryption.org/v1
--> ssh-ed25519 96IXNQ y9xfS/LgeA97ofunk5sm6a9yPMTQXoiqKzhSQ5xFJxM
-Jj2xw854u6AsRXHaHl50D40Hpct9mBRD5vusndtWlRU
--> ssh-ed25519 It7HZQ Ac3LWqNFln9fK7aYeqmG8yQfDl5nG0H8J4fCfk13xFE
-7A9aSpzne7sFYLzQusalxg5d/fyM2/kwEJxZ7rCEJ6c
--> ssh-ed25519 Ysxvmg pK+ZzeQpLoA0tvTbcOK4lmU111XN0h0U0/k6n3oj9X0
-ubUmOeCFczTjKgnzxA3ePnWb0WH8YKcI+WCJWUfcmEo
---- cuWCm/u/ZHJxHTvKFujn9RvQM90gCkjnGcWm1azYBGc
-<ûBµÜKwíºn
P9’¹¦&Vû­@/¹ˆÓœ¼5[2aën‚â^c=T2;Èÿäb&¨w®[F
+-> ssh-ed25519 96IXNQ htUePAVPstdIelYURI4fLB3p2rbQl/oVgdymtOnikjQ
+pnEPOw7C17qEL5GLbSOUzhTS+TQjPKt8yn6DZnW93r0
+-> ssh-ed25519 It7HZQ VhHvmCe0xXx/aINQZZdGyfuQdAowuX6zrh+d6IzNqgQ
+wDugkAqRt/Sbej2UTpIpjvitYk1WON4DuVecQqsQMP8
+-> ssh-ed25519 96tIZg LcgBZtB1BCjjWQVOQcCsOkRBTyi5HF88l1vLSdSyRVU
+YC+uduqOuAAtlrFlLeSuaNzQC/OL9XW8vcjp8WKOKhY
+--- pupMpTgDxQAt6CcB99LwNArx0wyxZGDu/ehh1Mikppk
+ß±¸#Ø”±bÀå)HˆQ.v<>â%‰ØEÖ<1E>fø1¿œì‰ð0ë¾@GÆaáƒ^D®Iä
¹hæO/±Ñ

secrets/pureintent-basic-auth.age

@@ -1,9 +1,9 @@
 age-encryption.org/v1
--> ssh-ed25519 96IXNQ 2fAb4UaMDzIvV6al6FJhaLubphtiSuCpVOaeN+HwGVo
-bP/J1UYVBhjV2aquWSsTytU19R76+9Vlof5/V9CUBZU
--> ssh-ed25519 It7HZQ /UlpuPliwqF04HPG87ldFPCjxWim6EuCxUUax8h51TQ
-rbQBDdCtd1N2IEuCSZeeusVtkogL3MOr0Mxue/Gwiso
--> ssh-ed25519 Ysxvmg A81MyiFDefSbX6u7p4bN9vCREgGcp/frzguX1uwXYVM
-KiicSyou3NiK9znW2/MEJi3ElLfsqkCLfMuPbqTLoJs
---- ArMgx+hzGLdzksx0CEXhb7N//pSq+ovYS/SPS3mQBcs
-bQAü[iz´§/¤%VA‹<41>Ÿ´Exìôò.£šˆº‚‹‚bæZMIsÒ¨1ŒâÙTeq«þõ̦Sïúò“,ÚJ÷ÛàÓ­Ê2ÞS¤•ä«á(øTùú6FkÀDÖ.Q¯ìÞR[
+-> ssh-ed25519 96IXNQ d7wXeB4PTqliQUEgQxysva34qimZh8Fw3YimMmmCqkw
+taOzZDVk2k7GYUo91uMfgGxU2+aWn8AWDMhnonD9Dy8
+-> ssh-ed25519 It7HZQ 8jeI9aR89Bn5xmypNz2jYsAB/vCjCssh4+TEHEqtDX0
+vmG3sL20z8lpXSM44At/HiBEiMd3FLlZ4rVFFEJu0j4
+-> ssh-ed25519 96tIZg ICbhKedcqc21jBVGnd3MkRFrQ2UaE1VsHAWQnV2+oxc
+IkPX7iYYUpt+MMkmOe4DeGy5DXcMzFjylxVliuyzeas
+--- XUds2rgdSivHfQmQ30q3Olz4ky9F4KU1gH8S83ooz1w
+MòÑy³59¾j0¡â’ú|Ÿ„Äâct9.ÉJŵaâ<61>•ÛupkÈ#Î'°ÉIê¶QuÖ6³ÑX“ô»ÚYžUò j"[)5[‡Ðæ“Ê”8—H<E28094>•K$˜Õ'•J×

secrets/secrets.nix

@@ -6,7 +6,7 @@ let
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJYQQXPMHYBtRcPzSkjQ3oqyje8T4UlCpbr6XjrlzzlK srid@zest"
   ];
 
-  pureintent = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICkY5feaNt4elPqRQimB9h3OFxtFAzp98p1H+JezBv92 root@nixos";
+  pureintent = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJUzYd7ys2gzx0Zu7yZDjZaRdUHDZIVahyVgaU2w2Ms8 root@nixos";
   systems = [
     pureintent
   ];
@@ -19,4 +19,5 @@ in
   "gmail-app-password.age".publicKeys = users ++ systems;
   "hackage-password.age".publicKeys = users ++ systems;
   "juspay-anthropic-api-key.age".publicKeys = users ++ systems;
+  "beszel-agent-key.age".publicKeys = users ++ systems;
 }