@@ -27,6 +27,16 @@ builder = {
         system = "x86_64-linux";
       };
     };
+    ulme = {
+      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINnjmkEFf/eZ4o1YmawRK8KoPcL8c+4cf05NZFwNEWRM";
+      domains = [
+        tailnet
+        pubnethosts
+      ];
+      builder = {
+        system = "x86_64-linux";
+      };
+    };
     prefect = {
       publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGmHQIaiJAz9EZwu0anojtj9lO4gXN2YtWqk37WAROKW";
       domains = [

@@ -165,6 +165,15 @@ ./packages/modules/nixos/bark.nix
             ./system/hosts/hasel.nix
           ];
         };
+        ulme = nixosSystem {
+          system = "x86_64-linux";
+          modules = [
+            srvos.nixosModules.server
+            agenix.nixosModules.default
+            ./packages/modules/nixos/bark.nix
+            ./system/hosts/ulme.nix
+          ];
+        };
       };
       darwinConfigurations = {
         marvin = darwin.lib.darwinSystem {

@@ -1,14 +1,11 @@
 age-encryption.org/v1
--> ssh-ed25519 J6Hb1Q dLjanlxJGxUpZfzz4kq/IVyYJeCJKuHgxo4JfsjS4kU
-Z6OLb/34WPsqaarFZPvIkDTyz/7E+qqHmvDkbTg9bJY
--> ssh-ed25519 knHzXw g3X+WfSFxZqB5cFISRhFGmcap1aQ5hfAI0e8Er/VXkE
-tk96A8mkL4r8Q7ocxLQfepbX2HUVftWBgj0qjKefTlQ
--> ssh-ed25519 Ao4N5w Ogd+523BZ1QqZxPoZhnO4is3L5wFFL2nC3aoNFwrnSo
-9rZWo1zeOeJanrcjy4eoSbXkBDqQpFpOOWy7hIh7T5s
--> piv-p256 VBDKjg A7JJr/0lgASsXKbeltZyVkjeFNnD4XLyguyT+PBuVpuc
-wqY5RXyvYbOVQTKDlSYewB2Q/XJAq+ik/0vZE0RCIpY
---- 7X3midHsPKrQg+FnzD6SoCjAgUHFLc9fGXfXab79dBo
-+/����<���Ǚy� B�?�8��2,9����c!ɛ��<Ή����m���V���_W������\��Ni
u��,
�V
-����PBG53�=��o�z����1b�������s[W��KA���)6�쯊G1)��T���7DK˄�� ���ƾ�ũ�B3u�y��ݢ�bb�4�v�;���]ʝ�a��VK*
-j��ɽi�%s�O6�/��v��'�?<���`���s5	Ӏ[N�.��9	�`/E�[���@�=)W�kv��Pqx`�;�T-�I�ԫ>ȒTR����U
�����2�]��3�}.mv[��>,Ƞx�ZO�&uӘ���x�:/m�\xl���N��
-�
r��xG�KQ�t���ͨ���d_,KX~�ʼS{����bq��,NH~��+-> ssh-ed25519 J6Hb1Q QzWpLyWgpsnr8BCovVN2hGecV8XH8kC5+5/9pHjY6i4
+NlTL2kdJaqD1AMyQtH7Ol2rb8EkZqsFURaaIIZhosvs
+-> ssh-ed25519 Ao4N5w ot+qJUdanO+KE2wmdxfP0Rwcu9zHETnP+FC1sS8X3zE
+De8dQfYS7v0cwR97n0yriHL8qeAxhfzV0fqn6Nkjzas
+-> ssh-ed25519 c9lWww Hi0L11iSkqoIYlLh1mXlIdPu/IKnzA1ZZgcvheSCUAo
+kgerS5i/QuS6z/Az2BP8W1n5tdDh0QfxmIZLEMoPTvE
+-> piv-p256 VBDKjg A+VjAYECmMIszCpDT2f4KiQzfxXsFLu0VrRgp+atu/0V
+KmTXZtoaG3+swlLIKtrt6zff3TEmzhQHBe33mDeSkIc
+--- xAsCoU1dou3vu2ZC4aNdOweE5j0cbqUWJnwBcwZwwdw
+7��d�cK�1���٬5kt�Fj��\O}r�u�ǖ��Sb{��π��&9q�r)�E�O=�������F�^�A1�3�.i����_��/JcJ�?��$j�}W�Iَw��d���+;oCa87���A�E�Ҥ�;���\ϫ~X6}����¼"C���b"rz�E/�f:3�f���gd	B��~��d�Y=�K㎺���&%~=�q��@��f���P��ْ;��(U��Gj�ب���«��U$�A��K

�b�?�ו�f�ztS+*]ܝ���1��`�Cۙ^��A��}��K䞤����c�y�w"�����k{��xBO���[�tz�	e�dc����2,����(C-�\@��D"�h8/�!x1�b
{��hzm�[kv0��9q���>�3/i

Not showing binary file.

@@ -12,6 +12,7 @@ secrets = with machines; {
     acme = [
       hasel
       r5
+      ulme
     ];
 
     redis-website = [
@@ -21,6 +22,7 @@
     caddy = [
       r5
       hasel
+      ulme
     ];
     pocket-id = [
       hasel

@@ -0,0 +1,30 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/profiles/qemu-guest.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_blk" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-amd" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/6d7c73c7-8799-4fac-8eda-58338f46f14a";
+      fsType = "ext4";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/A025-EFFE";
+      fsType = "vfat";
+      options = [ "fmask=0077" "dmask=0077" ];
+    };
+
+  swapDevices = [ ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}

@@ -0,0 +1,57 @@
+let
+  interface = "ens6";
+in
+{
+  imports = [
+    ./ulme-hardware.nix
+    ../roles/remote.nix
+    ../roles/server.nix
+
+    ../roles/uptime-monitor.nix
+    ../roles/webserver/reverse-proxy.nix
+  ];
+  system.stateVersion = "26.05";
+
+  boot.loader = {
+    timeout = 1;
+    systemd-boot.enable = true;
+    efi.canTouchEfiVariables = true;
+  };
+  services.qemuGuest.enable = true;
+
+  networking = {
+    hostName = "ulme";
+    defaultGateway6 = {
+      address = "fe80::1";
+      inherit interface;
+    };
+    interfaces = {
+      ${interface} = {
+        ipv4 = {
+          addresses = [
+            {
+              address = "217.154.218.62";
+              prefixLength = 32;
+            }
+          ];
+          routes = [
+            {
+              # `networking.defaultGateway` doesn't allow specifying the `onlink` option
+              address = "0.0.0.0";
+              prefixLength = 0;
+
+              via = "217.154.218.1";
+              options.onlink = true;
+            }
+          ];
+        };
+        ipv6.addresses = [
+          {
+            address = "2a01:239:4a4:3500::1";
+            prefixLength = 128;
+          }
+        ];
+      };
+    };
+  };
+}