From 10041af092821467cdf8c9994d5d87f757b5d0ae Mon Sep 17 00:00:00 2001
From: Lilith <liv@benstem.de>
Date: Sun, 21 Jun 2026 17:58:06 +0200
Subject: [PATCH] sops

---
 home/lilith/ssh.nix                      |  5 ++---
 hosts/lilith-lab/secrets/networking.yaml | 13 ++++++++-----
 server/nfs-server.nix                    |  5 +++--
 system/core/nix.nix                      | 22 ++++++++++++++++++++--
 4 files changed, 33 insertions(+), 12 deletions(-)

diff --git a/home/lilith/ssh.nix b/home/lilith/ssh.nix
index 030ad61..c98e237 100644
--- a/home/lilith/ssh.nix
+++ b/home/lilith/ssh.nix
@@ -1,5 +1,4 @@
-{ ... }:
-{
+{ ... }: {
   services.ssh-agent = {
     enable = true;
   };
@@ -8,7 +7,7 @@
     enable = true;
     enableDefaultConfig = false;
 
-    matchBlocks = {
+    settings = {
       "hpc" = {
         user = "benstem";
         hostname = "login1.hpc.uni-potsdam.de";
diff --git a/hosts/lilith-lab/secrets/networking.yaml b/hosts/lilith-lab/secrets/networking.yaml
index 54fdf41..f599c9e 100644
--- a/hosts/lilith-lab/secrets/networking.yaml
+++ b/hosts/lilith-lab/secrets/networking.yaml
@@ -4,6 +4,9 @@ wireguard:
     preshared:
         lilith-phone: ENC[AES256_GCM,data:4FV8Q6A/3zRwPpUMJG4XAkY5d2PvBP/2waEWM0D3A+plgcSE50Ng2lzP5Ak=,iv:bSDfxsDiEyOeZst6lyQsMJQt9cHVbWkZaw8PuFdAUjs=,tag:eLBKYidmZXhkfcXa0ZiueA==,type:str]
         lilith-pad: ENC[AES256_GCM,data:enQk/mPhrWBHEAkzIe6WLVx1ipCX5Tthq9ets7J3A470VRAWrfNotajQTGU=,iv:+V3maDCwYizOH2d7jBW6m4Eu+3nefqAgZ3c+81vMOks=,tag:Y99BMLLjJZZ8Fw8KE8QiTA==,type:str]
+    bridge:
+        private: ENC[AES256_GCM,data:V2OpAesZlptd959kpbiEaA1MeaT+Abk9Q9YpWb8kLyNWD04CuLNBJQfRkx4=,iv:t3UBhd3olU3LU7HfIUKWVpn33on4i5vkvnPkwh+ox0k=,tag:97XHMaxK43XCBTWXpvPJjQ==,type:str]
+        public: ENC[AES256_GCM,data:ZjcYxBDeEt9RN+hW+vvkVoQPPVxw/XhV5odqgG2AixR8e+MwB0VjDVa3aig=,iv:jrP04x2ZtMne63EqQUiJqYvxGHq4GNDMVONPcEn1K0M=,tag:9UuQS3IoVJKZOpMCmqJsmg==,type:str]
 wireguard-bridge:
     private: ENC[AES256_GCM,data:Z/Bf0u+Dgqidq6QB1QymhW7dyK4E8/aTUFjVTQaYEl8K3xU3LByzUu16FV4=,iv:frID3D1VSLQSxwxrV4jX02CG1OYYCJo53SPIBtTWozI=,tag:yD6LeGW9XQuFsFzoDhRBrA==,type:str]
     public: ENC[AES256_GCM,data:j2UyFO/ynMAXHqoJh5yUdvTWRxhI3NT4mopfvTBT65E7eULMx+/N6BzcydY=,iv:xZyVkk+dKrpu30vnrq98FEfpK5l7A0u2FpDhFScTG/4=,tag:OVSo1r7DG8WXfvSkhIm2zw==,type:str]
@@ -15,8 +18,7 @@ home-assistant:
         hass: ENC[AES256_GCM,data:yzm/ETAQ7y5nCtR40IL0fvnjMyVHMTbF7qpVm5upMqs3v+wdV5H0/bsmTKl3r6PduumU9bT5XrbBHZoBWDfKiCHzCNOLvFCvKxE8pvvMg13nbWYT/5Iq3iqdUpjiQWdAPzN/jgHkOyClkL5JjNki6Q==,iv:Er/sEpydmTyW9CnaObc2XxsgAx2D41K+NWATgsUwiu8=,tag:1Fuu0S7LYnZEQMztdgId+w==,type:str]
 sops:
     age:
-        - recipient: age1aqks8n6temvwfnqqk8pua56du4xz8krz8edmslg69pu8hpkla96q5hfxp6
-          enc: |
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3WTJvK3RRcjRPVkVoZkEy
             bUVTSy9yS2ovOXNxS25KYTNBRjc2R3g3bnlJCjdTdmp2WExaQmV2eWFyN0hQYUtK
@@ -24,8 +26,9 @@ sops:
             VUJxWUhnbEpGUkFUbDBveEpCTkYrQjAKVrVBFELhFvmLdUc2yIqdHCSUWQUToTGV
             qBiwM4u9hjpwTr5zCHWEvXOXoDHuBMy8Ud4ha8wshbgf0iD/axXjOQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-10-17T12:29:14Z"
-    mac: ENC[AES256_GCM,data:xsh2nmx1M+eCT6sVwJ0JBeBh5d8mz3pmxpSn5RgIWmARfIbnt4Q4ysLNV6SAbJvtHLvOQKZsboHGRjAEpu3H+g3pSB3hu+s+uSNiPUcBO2eq0jA/d0DwtckPMS+9bs/eEKAyPcGbxe5H3erISgZUr3+WtZCnd7XwjCD3mKG+8iw=,iv:DIOnx+6RJ3eYTgaYNI0arzG3R9L0uJu3tlPNsyDZQ8k=,tag:MD6/b/5dugTb3jayL1/VyQ==,type:str]
+          recipient: age1aqks8n6temvwfnqqk8pua56du4xz8krz8edmslg69pu8hpkla96q5hfxp6
+    lastmodified: "2026-06-21T15:09:42Z"
+    mac: ENC[AES256_GCM,data:FKAt5oMbGgbRwhaI+2wBKDmMnj3XaAEEqGYPzIBD17ze2Hk3KF+/jUFCAJSy44F/UGdfMvuhzLxxF7M0+JuMbnh1s6i8yeWU9kN49LR4Q9L4LK9+GqCIE4M7l48ZdVZxqDpPs8TyDZYxKwwso/bf47oxofYZWMQOIR5+SAxi8YQ=,iv:vTk8HHpHCt3TQm6cCCGkAA94w5HUeZ0CgLQLxMKJpZM=,tag:jILDk4DSoS9FhtDATFfZMg==,type:str]
     pgp:
         - created_at: "2025-10-17T12:29:08Z"
           enc: |-
@@ -39,4 +42,4 @@ sops:
             -----END PGP MESSAGE-----
           fp: 35FA53C3B39A778CBD0F0ADD0A0316EDDEDCA368
     unencrypted_suffix: _unencrypted
-    version: 3.10.2
+    version: 3.13.1
diff --git a/server/nfs-server.nix b/server/nfs-server.nix
index fd0150c..1ed4aaf 100644
--- a/server/nfs-server.nix
+++ b/server/nfs-server.nix
@@ -1,5 +1,4 @@
-{ lib, config, ... }:
-{
+{ lib, config, ... }: {
   options.server.nfs.enable = lib.mkEnableOption "Enable NFS shares";
 
   config = lib.mkIf config.server.nfs.enable {
@@ -20,11 +19,13 @@
 
     fileSystems."/export/share" = {
       device = "/data/share";
+      fsType = "nfs";
       options = [ "bind" ];
     };
 
     fileSystems."/export/torrent" = {
       device = "/data/torrent";
+      fsType = "nfs";
       options = [ "bind" ];
     };
 
diff --git a/system/core/nix.nix b/system/core/nix.nix
index ed5cc9c..2767c43 100644
--- a/system/core/nix.nix
+++ b/system/core/nix.nix
@@ -1,5 +1,4 @@
-{ ... }:
-{
+{ ... }: {
   nix = {
     gc = {
       automatic = true;
@@ -36,6 +35,7 @@
         protocol = "ssh-ng";
 
         speedFactor = 4;
+        maxJobs = 16;
         supportedFeatures = [
           "kvm"
           "big-parallel"
@@ -51,6 +51,7 @@
         protocol = "ssh-ng";
 
         speedFactor = 8;
+        maxJobs = 32;
         supportedFeatures = [
           "kvm"
           "big-parallel"
@@ -66,6 +67,23 @@
         protocol = "ssh-ng";
 
         speedFactor = 1;
+        maxJobs = 4;
+        supportedFeatures = [
+          "kvm"
+          "big-parallel"
+          "nixos-test"
+          "benchmark"
+        ];
+      }
+      {
+        hostName = "lilith-lab-builder";
+        sshUser = "nixremote";
+        sshKey = "/root/.ssh/nixremote";
+        system = "x86_64-linux";
+        protocol = "ssh-ng";
+
+        speedFactor = 1;
+        maxJobs = 2;
         supportedFeatures = [
           "kvm"
           "big-parallel"