bump vidhar

6 files changed, 56 insertions, 68 deletions

diff --git a/hosts/vidhar/default.nix b/hosts/vidhar/default.nix
index 9639cbd3..f15dfebe 100644
--- a/hosts/vidhar/default.nix
+++ b/hosts/vidhar/default.nix
@@ -296,41 +296,6 @@ with lib;
         "ASSUME_NO_MOVING_GC_UNSAFE_RISK_IT_WITH=go1.19"
       ];
     };
-    services.promtail = {
-      enable = true;
-      configuration = {
-        server = {
-          http_listen_port = 9080;
-          grpc_listen_port = 0;
-        };
-        clients = [
-          { url = "http://localhost:9094/loki/api/v1/push"; }
-        ];
-        scrape_configs = [
-          { job_name = "journal";
-            journal = {
-              json = true;
-              max_age = "12h";
-              path = "/var/log/journal";
-              labels = {
-                job = "systemd-journal";
-              };
-            };
-            relabel_configs = [
-              { source_labels = ["__journal__systemd_unit"];
-                target_label = "unit";
-              }
-              { source_labels = ["__journal__hostname"];
-                target_label = "nodename";
-              }
-            ];
-          }
-        ];
-      };
-    };
-    systemd.services.promtail.serviceConfig.Environment = [
-      "ASSUME_NO_MOVING_GC_UNSAFE_RISK_IT_WITH=go1.19"
-    ];
 
     services.apcupsd = {
       enable = true;
diff --git a/hosts/vidhar/network/default.nix b/hosts/vidhar/network/default.nix
index 02a8d648..3b48a7fc 100644
--- a/hosts/vidhar/network/default.nix
+++ b/hosts/vidhar/network/default.nix
@@ -3,7 +3,7 @@
 with lib;
 
 {
-  imports = [ ./pppoe.nix ./bifrost ./dhcp ];
+  imports = [ ./pppoe ./bifrost ./dhcp ];
 
   config = {
     networking = {
@@ -132,6 +132,7 @@ with lib;
       "/srv/nfs/nix-store" = {
         device = "/nix/store";
         options = [ "bind" ];
+        fsType = "none";
       };
     };
   };
diff --git a/hosts/vidhar/network/pppoe.nix b/hosts/vidhar/network/pppoe/default.nix
index 7b342b69..36bf4f49 100644
--- a/hosts/vidhar/network/pppoe.nix
+++ b/hosts/vidhar/network/pppoe/default.nix
@@ -27,7 +27,37 @@ in {
           ./no-double-timeout.patch
         ];
       });
-      peers.telekom.config = ''
+      peers = {
+        o2.config = ''
+          user DSL0004874856014@s93.bbi-o2.de
+        '';
+      };
+    };
+    systemd.services."pppd-o2" = {
+      stopIfChanged = true;
+
+      restartTriggers = with config; [
+        environment.etc."ppp/pap-secrets".source
+        environment.etc."ppp/options".source
+        environment.etc."ppp/ip-pre-up".source
+        environment.etc."ppp/ip-up".source
+        environment.etc."ppp/ip-down".source
+      ];
+
+      serviceConfig.LoadCredential = [
+        "password:${config.sops.secrets."o2-password".path}"
+      ];
+
+      bindsTo = [ "sys-subsystem-net-devices-telekom.device" ];
+      after = [ "sys-subsystem-net-devices-telekom.device" ];
+    };
+    sops.secrets."o2-password" = {
+      format = "binary";
+      sopsFile = ./o2-password;
+    };
+
+    environment.etc = {
+      "ppp/options".text = ''
         nodefaultroute
         ifname ${pppInterface}
         lcp-echo-adaptive
@@ -39,29 +69,14 @@ in {
         plugin pppoe.so
         pppoe-padi-timeout 1
         pppoe-padi-attempts 10
-        user congstar
-        password congstar
         nic-telekom
         debug
         +ipv6
       '';
-    };
-    systemd.services."pppd-telekom" = {
-      stopIfChanged = true;
-
-      serviceConfig = {
-        Type = lib.mkForce "notify";
-        ExecStart = lib.mkForce "${getBin config.services.pppd.package}/sbin/pppd call telekom up_sdnotify nolog";
-        PIDFile = "/run/pppd/${pppInterface}.pid";
-      };
-      restartTriggers = with config; [
-        environment.etc."ppp/ip-pre-up".source
-        environment.etc."ppp/ip-up".source
-        environment.etc."ppp/ip-down".source
-      ];
-    };
-
-    environment.etc = {
+      "ppp/pap-secrets".text = ''
+        congstar * congstar *
+        DSL0004874856014@s93.bbi-o2.de * @/run/credentials/pppd-o2.service/password *
+      '';
       "ppp/ip-pre-up".source = pkgs.resholve.writeScript "ip-pre-up" {
         interpreter = pkgs.runtimeShell;
         inputs = [ pkgs.iproute2 pkgs.ethtool ];
@@ -137,9 +152,5 @@ in {
       "net.core.rmem_max" = 4194304;
       "net.core.wmem_max" = 4194304;
     };
-    systemd.services."pppd-telekom" = {
-      bindsTo = [ "sys-subsystem-net-devices-telekom.device" ];
-      after = [ "sys-subsystem-net-devices-telekom.device" ];
-    };
   };
 }
diff --git a/hosts/vidhar/network/no-double-timeout.patch b/hosts/vidhar/network/pppoe/no-double-timeout.patch
index 53f41ae1..53f41ae1 100644
--- a/hosts/vidhar/network/no-double-timeout.patch
+++ b/hosts/vidhar/network/pppoe/no-double-timeout.patch
diff --git a/hosts/vidhar/network/pppoe/o2-password b/hosts/vidhar/network/pppoe/o2-password
new file mode 100644
index 00000000..cd3aed78
--- /dev/null
+++ b/hosts/vidhar/network/pppoe/o2-password
@@ -0,0 +1,18 @@
+{
+        "data": "ENC[AES256_GCM,data:mxHA3rrs5Sc50jAP,iv:iW1ua7wjZR8rPwXw21TdFK+fbfosc1CmnrTG34OJ2zM=,tag:pZ/FAHupnKy0wHtF6RN7yA==,type:str]",
+        "sops": {
+                "age": [
+                        {
+                                "recipient": "age1rmmhetcmllq0ahl5qznlr0eya2zdxwl9h6y5wnl97d2wtyx5t99sm2u866",
+                                "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpUzAvSlJkSFhhRTFLY0VO\nU1VYbFhpMEpxaFhlb2NyS0xDNU5oMm9EZzJnCm5vbTM4c3lFMU5EajhwTGd6MTVx\nZTFmNVlyaVZuRy9hL2VnWFR0TTNEemsKLS0tIDdTemNMTTllQ1pmb0JNTlVGcTlU\nWjQ2MW4yVmtvRng3TlRDbmpHdmRkbUEKtIVAq4aZD6rhtX7+67EE5eOKAtGsVpBg\nPkfjkyV8ifBEx/lwDaJSHpLPfkbI9oArTL8BloodJEEGql5PXZxtvg==\n-----END AGE ENCRYPTED FILE-----\n"
+                        },
+                        {
+                                "recipient": "age1qffdqvy9arld9zd5a5cylt0n98xhcns5shxhrhwjq5g4qa844ejselaa4l",
+                                "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmUk1oZGdjL25YbGRzdFFh\nRllkcU1IM0x6a2M2S0JicDBFYnBxMWluaEFzCjJ3WHozNkw0RThCMG5BNE5uUkZa\nTnV1OHpaSkMrTk9XM1NRWmxlTmRuUFkKLS0tIE9qdXVWOG9CL0MyS1JXbzhmbVdC\nZlRBWm1SSTZWYzBDc1U4ci94a0hMcHcKLgbJSAMUJ9VaXVmYQe+Uj13KrWFe4QvJ\nRcibCyOJH/VO3rmxU8RAkx0jaH448h9klWhs583Od5yNg7GleC+/qg==\n-----END AGE ENCRYPTED FILE-----\n"
+                        }
+                ],
+                "lastmodified": "2026-04-14T15:24:19Z",
+                "mac": "ENC[AES256_GCM,data:/dr0bXAf0v5K9LdKw7RzTTL8Qw/WqiHqLk0EbahDnFg3cVplV0s+ImCnxmhutv3hxdtMZ2dmLBfb8CYb/ZLc4HtNT/K2iKGQM7pF4+XxIjS35Q1JUcXxLrsGZcpARuCZ0AJnKo8yFgtM64dYcbxHlRwGG4u4Ds9fEHHLUMigNM0=,iv:jfFlfscUB7S1JjL/uBeW3uD4bugCT9Cj/vigGvGXrlA=,tag:suol02QD4jRH/QulWoV21A==,type:str]",
+                "version": "3.12.2"
+        }
+}
diff --git a/hosts/vidhar/prometheus/default.nix b/hosts/vidhar/prometheus/default.nix
index 35942c53..c0941688 100644
--- a/hosts/vidhar/prometheus/default.nix
+++ b/hosts/vidhar/prometheus/default.nix
@@ -59,7 +59,7 @@ in {
         systemd = {
           enable = true;
           extraFlags = [
-            "--systemd.collector.unit-include=(dhcpcd|pppd-telekom|radvd|ndppd)\.service"
+            "--systemd.collector.unit-include=(dhcpcd|pppd-.+|radvd|ndppd)\.service"
             "--systemd.collector.enable-restart-count"
             "--systemd.collector.enable-ip-accounting"
           ];
@@ -202,13 +202,6 @@ in {
           relabel_configs = relabelHosts;
           scrape_interval = "1s";
         }
-        { job_name = "promtail";
-          static_configs = [
-            { targets = ["localhost:9080"]; }
-          ];
-          relabel_configs = relabelHosts;
-          scrape_interval = "1s";
-        }
         { job_name = "apcupsd";
           static_configs = [
             { targets = ["localhost:${toString config.services.prometheus.exporters.apcupsd.port}"]; }