29 files changed, 186 insertions, 91 deletions
diff --git a/pkgs/update_pkgs.sh b/pkgs/update_pkgs.sh
index 17f97a35..d4478895 100755
--- a/pkgs/update_pkgs.sh
+++ b/pkgs/update_pkgs.sh
@@ -1,15 +1,5 @@
 #!/usr/bin/env sh
 
-# nixos-config - My current NixOS configuration
-#
-# Copyright (C) 2025 Benedikt Peetz <benedikt.peetz@b-peetz.de>
-# SPDX-License-Identifier: GPL-3.0-or-later
-#
-# This file is part of my nixos-config.
-#
-# You should have received a copy of the License along with this program.
-# If not, see <https://www.gnu.org/licenses/gpl-3.0.txt>.
-
 die() {
     printf "\033[31;1mError: \033[0m%s\n" "$1"
     exit 1
diff --git a/scripts/build.sh b/scripts/build.sh
index d6a81754..9cc4e46b 100755
--- a/scripts/build.sh
+++ b/scripts/build.sh
@@ -1,45 +1,15 @@
-#!/usr/bin/env sh
-
-# nixos-config - My current NixOS configuration
-#
-# Copyright (C) 2025 Benedikt Peetz <benedikt.peetz@b-peetz.de>
-# SPDX-License-Identifier: GPL-3.0-or-later
-#
-# This file is part of my nixos-config.
-#
-# You should have received a copy of the License along with this program.
-# If not, see <https://www.gnu.org/licenses/gpl-3.0.txt>.
-
-host="${1-$(hostname)}"
-[ "$#" -gt 0 ] && shift 1
-
-root="$(git rev-parse --show-toplevel)"
-
-SYSTEM_OUT="$root/result-system"
-HOME_OUT="$root/result-home-soispha"
-
-check() {
-    file="$1"
-    if [ -s "$file" ]; then
-        rm "$file"
-    elif ! [ -e "$file" ]; then
-        rm "$file" || {
-            : "Ignore not existing files"
-        }
-    else
-        echo "ERROR: '$file' is not a symlink. Not removing it." 1>&2
-        exit 1
-    fi
-}
+#! /usr/bin/env sh
+set -eu
 
 build_system() {
-    if [ -n "$BUILD_PAR" ]; then
-        max_jobs="8"
-    else
-        max_jobs="1"
+    host="$1"
+
+    show_trace_arg=""
+    if [ "$show_trace" = true ]; then
+        show_trace_arg="--show-trace"
     fi
 
-    _val="$(nix build ".#nixosConfigurations.$host.config.system.build.toplevel" --print-out-paths --no-link --option max-jobs "$max_jobs" "$@")"
+    _val="$(nix build ".#nixosConfigurations.$host.config.system.build.toplevel" --print-out-paths --no-link --option max-jobs 1 $show_trace_arg)"
     exit_val="$?"
 
     if [ "$exit_val" -ne 0 ]; then
@@ -49,17 +19,79 @@ build_system() {
         printf "%s" "$_val"
     fi
 }
+remove_symlink() {
+    link="$1"
+    if [ -s "$link" ]; then
+        rm "$link"
+    elif ! [ -e "$link" ]; then
+        rm "$link" || {
+            : "Ignore not existing files"
+        }
+    else
+        echo "ERROR: '$link' is not a symlink. Not removing it." 1>&2
+        exit 1
+    fi
+}
 
-system="$(build_system "$@")"
-[ "$system" = "1" ] && exit 1
+root="$(git rev-parse --show-toplevel)"
+use_dirty=true
+show_trace=false
 
-check "$SYSTEM_OUT"
-ln --symbolic "$system" "$SYSTEM_OUT"
+while [ "$#" -ne 0 ]; do
+    case "$1" in
+    --dirty)
+        use_dirty=true
+        ;;
+    --clean)
+        use_dirty=false
+        ;;
+    --show-trace)
+        show_trace=true
+        ;;
+    --* | -*)
+        echo "arg '$1' is not known."
+        exit 2
+        ;;
+    *)
+        # We reached the hosts
+        break
+        ;;
+    esac
+    shift 1
+done
 
-home="$(grep ExecStart= "$SYSTEM_OUT/etc/systemd/system/home-manager-soispha.service" | awk '{print $2}')"
-check "$HOME_OUT"
-ln --symbolic "$home" "$HOME_OUT"
+if [ "$use_dirty" = "false" ]; then
+    tmp="$(mktemp -d -t "server_build_script_XXXXX")"
+    trap 'rm -r "$tmp"' EXIT
 
-nvd diff /run/current-system "$SYSTEM_OUT"
+    git archive --format=tar.gz HEAD | {
+        cd "$tmp"
+        tar -xz
+    }
 
+    cd "$tmp"
+fi
+
+for host in "$@"; do
+    system="$(build_system "$host")"
+    [ "$system" = "1" ] && exit 1
+
+    result_link="$root/result-$host"
+    remove_symlink "$result_link"
+    nix-store --add-root "$result_link" --realise "$(readlink -f "$system")"
+
+    # Try to also provide an easy link for potential home manager outputs.
+    fd "home-manager-\w*.service" "$result_link/etc/systemd/system" | while read -r hm; do
+        home_generation_link="$(grep ExecStart= "$hm" | awk '{print $2}')"
+        user_name="$(basename "$hm" | sed 's/home-manager-\(.*\)\.service/\1/')"
+        home_link="$root/result-$host-hm-$user_name"
+
+        remove_symlink "$home_link"
+        ln --symbolic "$home_generation_link" "$home_link"
+    done
+
+    if [ "$host" = "$(hostname)" ]; then
+        nvd diff /run/current-system "$result_link"
+    fi
+done
 # vim: ft=sh
diff --git a/secrets.nix b/secrets.nix
index 443ed562..2e68bdba 100644
--- a/secrets.nix
+++ b/secrets.nix
@@ -1,27 +1,85 @@
-# nixos-config - My current NixOS configuration
-#
-# Copyright (C) 2025 Benedikt Peetz <benedikt.peetz@b-peetz.de>
-# SPDX-License-Identifier: GPL-3.0-or-later
-#
-# This file is part of my nixos-config.
-#
-# You should have received a copy of the License along with this program.
-# If not, see <https://www.gnu.org/licenses/gpl-3.0.txt>.
 let
   soispha = "age1mshh4ynzhhzhff25tqwkg4j054g3xwrfznh98ycchludj9wjj48qn2uffn";
+  jaki = "age1vuhaey7kd9l76y6f9weeqmde3s4kjw38869ju6u3027yece2r3rqssjxst";
 
-  tiamat = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMD87QQIUXdEv3TaNRrI9clD9VgpsuVLFg2CrNGa5lVB";
-  apzu = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBivF5b6PyxsR/t+4Qg4IEDXHVXrjmZpslTUNXpvcVbO";
-in {
-  "modules/by-name/at/atuin/secrets/encryption_key.age".publicKeys = [soispha tiamat apzu];
-  "modules/by-name/at/atuin/secrets/user_id.age".publicKeys = [soispha tiamat apzu];
+  tiamatHostKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMD87QQIUXdEv3TaNRrI9clD9VgpsuVLFg2CrNGa5lVB";
+  apzuHostKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBivF5b6PyxsR/t+4Qg4IEDXHVXrjmZpslTUNXpvcVbO";
 
-  "modules/by-name/ta/taskwarrior/secrets/sync_server_encryption_key.age".publicKeys = [soispha tiamat apzu];
+  server2HostKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL1TUFoCTplkqTVbXQ6qDCyeo2h8+C0vjrIlKu6vmq5f";
+  server3HostKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP3s4FjGx7LEVf/GE3WeCl8TmCtPt8gW1J0mp0fUJBNm";
 
-  "modules/by-name/ba/backup/secrets/storagebox/ssh_key.age".publicKeys = [soispha tiamat apzu];
-  "modules/by-name/ba/backup/secrets/storagebox/repository_password.age".publicKeys = [soispha tiamat apzu];
-  "modules/by-name/ba/backup/secrets/local/repository_password.age".publicKeys = [soispha tiamat apzu];
+  # WARNING(@bpeetz): ONLY use this key on age files that are meant to be public! <2025-02-23>
+  testingKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILxdvBk/PC9fC7B5vqe9TvygZKY6LgDQ2mXRdVrthBM/";
 
-  "modules/by-name/se/serverphone/private_keys/ca.key".publicKeys = [soispha tiamat apzu];
-  "modules/by-name/se/serverphone/private_keys/server.key".publicKeys = [soispha tiamat apzu];
-}
+  publicKeys = {
+    "tiamat" = [
+      soispha
+      tiamatHostKey
+    ];
+    "apzu" = [
+      soispha
+      apzuHostKey
+    ];
+
+    "server2" = [
+      soispha
+      jaki
+      server2HostKey
+    ];
+    "server3" = [
+      soispha
+      jaki
+      server3HostKey
+    ];
+  };
+
+  sources = import ./unflake.nix;
+  extra_lib = sources.library.nixLib;
+  pkgs-unstable = sources.nixpkgs-unstable.legacyPackages."x86_64-linux";
+  inherit (pkgs-unstable) lib;
+
+  secrets = let
+    base = extra_lib.mkByName {
+      useShards = false;
+      fileName = "secrets";
+      baseDirectory = ./hosts/by-name;
+    };
+    secrets = builtins.mapAttrs (name: value:
+      extra_lib.mkByName {
+        relativePaths = true;
+        useShards = false;
+        fileRegex = "^.*\\.age$";
+        baseDirectory = value;
+      })
+    base;
+    allSecretPaths = builtins.mapAttrs (serverName: secrets:
+      lib.lists.flatten (
+        lib.attrsets.mapAttrsToList
+        (service: fileNames: builtins.map (fileName: "./hosts/by-name/${serverName}/secrets/${service}/${fileName}") fileNames)
+        secrets
+      ))
+    secrets;
+  in
+    # We should be able to merge with the `//` operator here because all attribute paths
+    # must be unique (they were files previously)
+    builtins.foldl' (acc: elem: acc // elem) {} (
+      builtins.attrValues (builtins.mapAttrs (serverName: secretPaths:
+        builtins.listToAttrs (
+          builtins.map
+          (secretPath: {
+            name = secretPath;
+            value.publicKeys = publicKeys."${serverName}";
+          })
+          secretPaths
+        ))
+      allSecretPaths)
+    );
+in
+  secrets
+  // {
+    "tests/common/email/dkim/alice.com/private.age".publicKeys = [soispha jaki testingKey];
+    "tests/common/email/dkim/bob.com/private.age".publicKeys = [soispha jaki testingKey];
+    "tests/common/email/dkim/mail1.server.com/private.age".publicKeys = [soispha jaki testingKey];
+    "tests/common/email/dkim/mail2.server.com/private.age".publicKeys = [soispha jaki testingKey];
+    "./tests/by-name/ro/rocie/secrets/login.age".publicKeys = [soispha jaki testingKey];
+  }
diff --git a/secrets.nix.old b/secrets.nix.old
new file mode 100644
index 00000000..443ed562
--- /dev/null
+++ b/secrets.nix.old
@@ -0,0 +1,27 @@
+# nixos-config - My current NixOS configuration
+#
+# Copyright (C) 2025 Benedikt Peetz <benedikt.peetz@b-peetz.de>
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# This file is part of my nixos-config.
+#
+# You should have received a copy of the License along with this program.
+# If not, see <https://www.gnu.org/licenses/gpl-3.0.txt>.
+let
+  soispha = "age1mshh4ynzhhzhff25tqwkg4j054g3xwrfznh98ycchludj9wjj48qn2uffn";
+
+  tiamat = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMD87QQIUXdEv3TaNRrI9clD9VgpsuVLFg2CrNGa5lVB";
+  apzu = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBivF5b6PyxsR/t+4Qg4IEDXHVXrjmZpslTUNXpvcVbO";
+in {
+  "modules/by-name/at/atuin/secrets/encryption_key.age".publicKeys = [soispha tiamat apzu];
+  "modules/by-name/at/atuin/secrets/user_id.age".publicKeys = [soispha tiamat apzu];
+
+  "modules/by-name/ta/taskwarrior/secrets/sync_server_encryption_key.age".publicKeys = [soispha tiamat apzu];
+
+  "modules/by-name/ba/backup/secrets/storagebox/ssh_key.age".publicKeys = [soispha tiamat apzu];
+  "modules/by-name/ba/backup/secrets/storagebox/repository_password.age".publicKeys = [soispha tiamat apzu];
+  "modules/by-name/ba/backup/secrets/local/repository_password.age".publicKeys = [soispha tiamat apzu];
+
+  "modules/by-name/se/serverphone/private_keys/ca.key".publicKeys = [soispha tiamat apzu];
+  "modules/by-name/se/serverphone/private_keys/server.key".publicKeys = [soispha tiamat apzu];
+}
diff --git a/tests/README.md b/tests/old/README.md
index 34dc9255..34dc9255 100644
--- a/tests/README.md
+++ b/tests/old/README.md
diff --git a/tests/by-name/le/less/data/test.file b/tests/old/by-name/le/less/data/test.file
index 9e9f8931..9e9f8931 100644
--- a/tests/by-name/le/less/data/test.file
+++ b/tests/old/by-name/le/less/data/test.file
diff --git a/tests/by-name/le/less/data/test.file.license b/tests/old/by-name/le/less/data/test.file.license
index eae6a84c..eae6a84c 100644
--- a/tests/by-name/le/less/data/test.file.license
+++ b/tests/old/by-name/le/less/data/test.file.license
diff --git a/tests/by-name/le/less/test.desc b/tests/old/by-name/le/less/test.desc
index a0c49e7b..a0c49e7b 100644
--- a/tests/by-name/le/less/test.desc
+++ b/tests/old/by-name/le/less/test.desc
diff --git a/tests/by-name/le/less/test.desc.license b/tests/old/by-name/le/less/test.desc.license
index eae6a84c..eae6a84c 100644
--- a/tests/by-name/le/less/test.desc.license
+++ b/tests/old/by-name/le/less/test.desc.license
diff --git a/tests/by-name/le/less/test.nix b/tests/old/by-name/le/less/test.nix
index c9716ffc..c9716ffc 100644
--- a/tests/by-name/le/less/test.nix
+++ b/tests/old/by-name/le/less/test.nix
diff --git a/tests/by-name/nv/nvim-checkhealth/test.desc b/tests/old/by-name/nv/nvim-checkhealth/test.desc
index 169cf49f..169cf49f 100644
--- a/tests/by-name/nv/nvim-checkhealth/test.desc
+++ b/tests/old/by-name/nv/nvim-checkhealth/test.desc
diff --git a/tests/by-name/nv/nvim-checkhealth/test.desc.license b/tests/old/by-name/nv/nvim-checkhealth/test.desc.license
index eae6a84c..eae6a84c 100644
--- a/tests/by-name/nv/nvim-checkhealth/test.desc.license
+++ b/tests/old/by-name/nv/nvim-checkhealth/test.desc.license
diff --git a/tests/by-name/nv/nvim-checkhealth/test.nix b/tests/old/by-name/nv/nvim-checkhealth/test.nix
index cb04e758..cb04e758 100644
--- a/tests/by-name/nv/nvim-checkhealth/test.nix
+++ b/tests/old/by-name/nv/nvim-checkhealth/test.nix
diff --git a/tests/by-name/nv/nvim-neorg/data/index.norg b/tests/old/by-name/nv/nvim-neorg/data/index.norg
index 4d643019..4d643019 100644
--- a/tests/by-name/nv/nvim-neorg/data/index.norg
+++ b/tests/old/by-name/nv/nvim-neorg/data/index.norg
diff --git a/tests/by-name/nv/nvim-neorg/data/index.norg.license b/tests/old/by-name/nv/nvim-neorg/data/index.norg.license
index eae6a84c..eae6a84c 100644
--- a/tests/by-name/nv/nvim-neorg/data/index.norg.license
+++ b/tests/old/by-name/nv/nvim-neorg/data/index.norg.license
diff --git a/tests/by-name/nv/nvim-neorg/data/reference.norg b/tests/old/by-name/nv/nvim-neorg/data/reference.norg
index b572a469..b572a469 100644
--- a/tests/by-name/nv/nvim-neorg/data/reference.norg
+++ b/tests/old/by-name/nv/nvim-neorg/data/reference.norg
diff --git a/tests/by-name/nv/nvim-neorg/data/reference.norg.license b/tests/old/by-name/nv/nvim-neorg/data/reference.norg.license
index eae6a84c..eae6a84c 100644
--- a/tests/by-name/nv/nvim-neorg/data/reference.norg.license
+++ b/tests/old/by-name/nv/nvim-neorg/data/reference.norg.license
diff --git a/tests/by-name/nv/nvim-neorg/test.desc b/tests/old/by-name/nv/nvim-neorg/test.desc
index bd1e8f49..bd1e8f49 100644
--- a/tests/by-name/nv/nvim-neorg/test.desc
+++ b/tests/old/by-name/nv/nvim-neorg/test.desc
diff --git a/tests/by-name/nv/nvim-neorg/test.desc.license b/tests/old/by-name/nv/nvim-neorg/test.desc.license
index eae6a84c..eae6a84c 100644
--- a/tests/by-name/nv/nvim-neorg/test.desc.license
+++ b/tests/old/by-name/nv/nvim-neorg/test.desc.license
diff --git a/tests/by-name/nv/nvim-neorg/test.nix b/tests/old/by-name/nv/nvim-neorg/test.nix
index 9f160df5..9f160df5 100644
--- a/tests/by-name/nv/nvim-neorg/test.nix
+++ b/tests/old/by-name/nv/nvim-neorg/test.nix
diff --git a/tests/by-name/ya/yambar/test.desc b/tests/old/by-name/ya/yambar/test.desc
index 067c201e..067c201e 100644
--- a/tests/by-name/ya/yambar/test.desc
+++ b/tests/old/by-name/ya/yambar/test.desc
diff --git a/tests/by-name/ya/yambar/test.desc.license b/tests/old/by-name/ya/yambar/test.desc.license
index eae6a84c..eae6a84c 100644
--- a/tests/by-name/ya/yambar/test.desc.license
+++ b/tests/old/by-name/ya/yambar/test.desc.license
diff --git a/tests/by-name/ya/yambar/test.nix b/tests/old/by-name/ya/yambar/test.nix
index 0e4d0033..0e4d0033 100644
--- a/tests/by-name/ya/yambar/test.nix
+++ b/tests/old/by-name/ya/yambar/test.nix
diff --git a/tests/default.nix b/tests/old/default.nix
index d13723b4..d13723b4 100644
--- a/tests/default.nix
+++ b/tests/old/default.nix
diff --git a/tests/infrastructure/clean.awk b/tests/old/infrastructure/clean.awk
index 0362d38b..0362d38b 100644
--- a/tests/infrastructure/clean.awk
+++ b/tests/old/infrastructure/clean.awk
diff --git a/tests/infrastructure/default.nix b/tests/old/infrastructure/default.nix
index cd21198c..cd21198c 100644
--- a/tests/infrastructure/default.nix
+++ b/tests/old/infrastructure/default.nix
diff --git a/tests/infrastructure/driver.sh b/tests/old/infrastructure/driver.sh
index a8b241d2..a8b241d2 100644
--- a/tests/infrastructure/driver.sh
+++ b/tests/old/infrastructure/driver.sh
diff --git a/tests/infrastructure/run.nix b/tests/old/infrastructure/run.nix
index 3148a2d9..3148a2d9 100644
--- a/tests/infrastructure/run.nix
+++ b/tests/old/infrastructure/run.nix
diff --git a/update.sh b/update.sh
index 19522e59..90086c48 100755
--- a/update.sh
+++ b/update.sh
@@ -1,15 +1,4 @@
 #!/usr/bin/env sh
-
-# nixos-config - My current NixOS configuration
-#
-# Copyright (C) 2025 Benedikt Peetz <benedikt.peetz@b-peetz.de>
-# SPDX-License-Identifier: GPL-3.0-or-later
-#
-# This file is part of my nixos-config.
-#
-# You should have received a copy of the License along with this program.
-# If not, see <https://www.gnu.org/licenses/gpl-3.0.txt>.
-
 __update_sh_run() {
     __update_sh_command="$1"
     shift 1
@@ -27,9 +16,8 @@ __update_sh_run() {
 __update_sh_run unflake.sh --backend=nix
 __update_sh_run ./pkgs/update_pkgs.sh "$@"
 
-# __update_sh_run nix flake check
 __update_sh_run build.sh
+__update_sh_run check.sh
 
-printf "\033[31;1m%s\033[0m\033[33;1m%s\033[0m\n" "Also update out-of-tree dependencies, like " "yt" 2>&1
-
+printf "\033[31;1m%s\033[0m\033[33;1m%s\033[0m\n" "Also update out-of-tree dependencies, like " "the external rust binaries" 2>&1
 # vim: ft=sh