biotite: move all services to biotite except kanidm

machines/massicot/default.nix

@@ -15,18 +15,9 @@
     defaultSopsFile = ./secrets.yaml;
     age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
     secrets = {
-      storage_box_mount = {
-        owner = "root";
-      };
       gts_env = {
         owner = "gotosocial";
       };
-      "miniflux/oauth2_secret" = {
-        owner = "root";
-      };
-      "forgejo/env" = {
-        owner = "forgejo";
-      };
     };
   };
 

machines/massicot/kanidm-provision.nix

@@ -1,10 +1,12 @@
-{ pkgs, ... }:
+{ pkgs, config, ... }:
 let
   inherit (config.my-lib.settings)
     gotosocialUrl
     minifluxUrl
     hedgedocDomain
     forgejoDomain
+    grafanaUrl
+    synapseDelegateUrl
     ;
 in
 {
@@ -200,8 +202,8 @@ in
       };
       grafana = {
         displayName = "Grafana";
-        originUrl = "https://grafana.xinyang.life/login/generic_oauth";
-        originLanding = "https://grafana.xinyang.life/";
+        originUrl = "${grafanaUrl}/login/generic_oauth";
+        originLanding = "${grafanaUrl}/";
         scopeMaps = {
           grafana-users = [
             "openid"
@@ -223,8 +225,8 @@ in
       };
       synapse = {
         displayName = "Synapse";
-        originUrl = "https://synapse.xiny.li/_synapse/client/oidc/callback";
-        originLanding = "https://synapse.xiny.li/";
+        originUrl = "${synapseDelegateUrl}/_synapse/client/oidc/callback";
+        originLanding = "${synapseDelegateUrl}/";
         scopeMaps = {
           synapse-users = [
             "openid"

machines/massicot/services/restic.nix

@@ -34,13 +34,6 @@ in
     ];
   };
 
-  services.postgresqlBackup = {
-    enable = true;
-    compression = "zstd";
-    compressionLevel = 9;
-    location = "/backup/postgresql";
-  };
-
   services.restic.backups.${config.networking.hostName} = {
     extraBackupArgs = [
       "--limit-upload=1024"