add host

.sops.yaml

@@ -2,6 +2,7 @@ keys:
   - &admin_yubikey1 age1yubikey1qvy5y8kxqc63y7fk0tfv43u499a8z8q332ff087lythry9cc6hdxxkznc6t
   - &host_x1g13 age12g85cuvg4kjfr79lqf5fx2k0d82tchrgv88xgkt7ukk2cfcsw98s2rjyat
   - &host_ops age18rtm2dq2r62zvnhwdq0gkm24hu85r7zyleyk3jqv22zpdtw064eq7ay7dl
+  - &host_internal-app-01 age1mcp5gma7y0k59equhzqfsnn0ed335ljjtn0k08ua77htlxf0x54qsravch
 creation_rules:
   - path_regex: ^secrets/common/[^/]+\.ya?ml$
     key_groups:
@@ -9,6 +10,7 @@ creation_rules:
           - *admin_yubikey1
           - *host_x1g13
           - *host_ops
+          - *host_internal-app-01
   - path_regex: ^secrets/hosts/x1g13/[^/]+\.ya?ml$
     key_groups:
       - age:

hosts/internal-app-01/hardware-configuration.nix

@@ -0,0 +1,40 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ lib, modulesPath, ... }:
+
+{
+  imports = [
+    (modulesPath + "/profiles/qemu-guest.nix")
+  ];
+
+  boot.initrd.availableKernelModules = [
+    "ata_piix"
+    "uhci_hcd"
+    "virtio_pci"
+    "virtio_scsi"
+    "sd_mod"
+    "sr_mod"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/1b12ab98-2537-4207-a3f4-bb8ba7b53b00";
+    fsType = "ext4";
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/8365-C778";
+    fsType = "vfat";
+    options = [
+      "fmask=0077"
+      "dmask=0077"
+    ];
+  };
+
+  swapDevices = [ ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}

secrets/common/system.yaml

@@ -5,32 +5,41 @@ sops:
   age:
     - enc: |
         -----BEGIN AGE ENCRYPTED FILE-----
-        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IGxWc2NMZyBBNERDOVU2
-        WkRMb05iS3Bmb3NxSnIrNEhDdTdrR25XZFB5aksweWtKRGxyNwpPWlpReXJCUVI4
-        NzJMM1JKYTV0MTNxTkpxak9MRmdnaGpabHpTVHl2bUNBCi0tLSBwbnVKSnB6bnI2
-        VVlrQ3p3d3ZtT3o4b3lxaVJpd0NCUkQ4VkE0bVMzYmpZCqArP2/pKAH3EuD4dPAU
-        Q8YWwWwtPWcANud8Ry1jSzg2HCOfrdv3AXaSlXdTbuIr3Q0yREM9YtCvxxYbXpt8
-        Gpg=
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IGxWc2NMZyBBbEttK0xB
+        ZVVDWk03alZnR3lGZEY4VlJMdTRTMXNDdHR6QW5YekgwZ3B0SQordFdPRUh4YU80
+        MmxMNFdKbTNMVXZPMVVNY3ZKdjczWnhWTzYxbUV6NC9rCi0tLSBDSGlUWC9SVW1T
+        MitabjYrWG1FVG5xUGhqSVZDekgrQmcxSUZGSklFdU5vCu3bLs7yVM7vxFX2q3pt
+        W/4VEsxzYZN2aITrRfbVWCgwVyYBh3WbcImU8oLOhZ2nfgqfcQ5x2LVu1IzuCSdd
+        cjo=
         -----END AGE ENCRYPTED FILE-----
       recipient: age1yubikey1qvy5y8kxqc63y7fk0tfv43u499a8z8q332ff087lythry9cc6hdxxkznc6t
     - enc: |
         -----BEGIN AGE ENCRYPTED FILE-----
-        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxSmhCZU5kOGpNY1ZUNVFP
-        aFFBVWU0Vk14d1FHWmFvK0hjY21KcWdWZ2dJCmZvRDQ5aFRYRVFld3hZckIvcjJ3
-        NUN2SERTOHQ3SEFFdXJXRFdpVGttVkEKLS0tIGp3aUI4TG9KU2NsbVlteG9lUGRv
-        SndsRCtpTUlFYWpJQ1NuSm40V0V1NWcKjMsZkKuDxsF3TH5G/rgilApv3BD/fqs5
-        VucqOyeJXXv7ErkxFKm6EynSOzUiA82mDzyW+cF+0GFxheKfOlXKGw==
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVaWxxVWFSTUxDNy9KaGlE
+        ZVBWVHF2eEFXZnJLaXdiSW5kMUJpYiswVGhjCmFkcUhTMXhuRFpLTG9Udkd1UXI2
+        MkN5VXJSNUNiQUp2MzFIbzhhbVZ3aGsKLS0tIGE3ZXlsMjdRb2RBM1lVMHRSY0I4
+        SUVnNjFZVFQzZ3Y4UjlaK3ZNOXdGRXcKyrd86CUWYi13i+M7ESKQH3W41M2/pc60
+        04Px/7G7urIlgjfEV/wXaVIyeSU8Eb65uI/AOseJwH3v4IbW6Nd6bw==
         -----END AGE ENCRYPTED FILE-----
       recipient: age12g85cuvg4kjfr79lqf5fx2k0d82tchrgv88xgkt7ukk2cfcsw98s2rjyat
     - enc: |
         -----BEGIN AGE ENCRYPTED FILE-----
-        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUc29ucGhmODQvak9zL2NR
-        N3RUUzJYaC9idVl5bFB2c0ZDWlFIQ2Z0M21RCnRiaDl0aU5wSVdkalBXeW44RW9M
-        MlFFZ0RzUTVJL1YrN2JwRmtLRHBsem8KLS0tIGhVLzNIbmhrcGR2MWludFo1WGlF
-        ZCtCSXZyTE93Ull5VlkySnNTVGt0QncKqy+8NsS6tLWR31gJgOMDT49+vu4ZQRhS
-        13XPPrRqxaaTRG+CTAQyu25FtGt8sH3rOs0VNfMj7TAtHZPGjn0L4A==
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2UDU4VFJ1d3VDa2lDNURW
+        RDFMQWFzNWRwcUFqT25KR29MU0x2NW9GMkFZCjJwUExKOFRPRW9kZWxVSisreVRo
+        Y2Era2dHZk1QR04xMkNGcnROR2R3eHcKLS0tIGh4alhBamJzVnMyczBMK0l4TEUr
+        WjF2R2N2RHdkMGh3VkdwKy9kb0VZOXMKCC3bEZROBi45aydfI5UL4oPP+ce91/UK
+        tOuHzwituiYZdJ79a/wXRJMFPg9eCiziSR3uLeP8279oLM417Drwxg==
         -----END AGE ENCRYPTED FILE-----
       recipient: age18rtm2dq2r62zvnhwdq0gkm24hu85r7zyleyk3jqv22zpdtw064eq7ay7dl
+    - enc: |
+        -----BEGIN AGE ENCRYPTED FILE-----
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYZlNDTnhFSi9iOXZEcHdQ
+        U1kreStxZ2dJd0g4dE1rdDQrSk5QTUhMbm5JCmRNc0k4K2VrTTFnaFNFSkd1em1J
+        SGczRnFzK2RlSzFPQnVUWHZUdzYyL2MKLS0tICtBbk9Zc0tYaXJ6a3FXcUQ5R0xv
+        MVZxUGZTaHJyeGNjS1B2SVhJLzAyNFkKNGE5sNLodP5TcXqvW//JLRW/5g8I0Hzc
+        cAgBXe+70HqFzEHQF1X7jHSZarTwclaNsjQPVyEaQfxYf+mLh+bTaA==
+        -----END AGE ENCRYPTED FILE-----
+      recipient: age1mcp5gma7y0k59equhzqfsnn0ed335ljjtn0k08ua77htlxf0x54qsravch
   lastmodified: "2026-06-15T10:20:19Z"
   mac: ENC[AES256_GCM,data:Tw58FneoksiOuol1aUOFXoAnFiTzddmFfYAA0B0RfPPyj6UKQbBvRYJhOMuOMRE1fVlDhqxxDiqZI5y14vJg8gLusAZt1JKi7ODR7MqcImvxboaee8DIj4uIcN254g0c0cmZWsGrt7yTYoSLDUc3QdAxj9/Az/CMls6XjM+RL8E=,iv:XGgWgbexCUxzuJzRVG3V2GZGwmwjAtowgz+NRPxk1+o=,tag:FwYJXfwS2f70okl0bhS+Sw==,type:str]
   unencrypted_suffix: _unencrypted