refactor(ops): Split //ops/nixos into different locations r/2482

Splits //ops/nixos into:

* //ops/nixos.nix - utility functions for building systems
* //ops/machines - shared machine definitions (read by readTree)
* //ops/modules - shared NixOS modules (skipped by readTree)

This simplifies working with the configuration fixpoint in whitby, and
is overall a bit more in line with how NixOS systems in user folders
currently work.

Change-Id: I1322ec5cc76c0207c099c05d44828a3df0b3ffc1
Reviewed-on: https://cl.tvl.fyi/c/depot/+/2931
Tested-by: BuildkiteCI
Reviewed-by: sterni <sternenseemann@systemli.org>
Reviewed-by: glittershark <grfn@gws.fyi>

31 files changed, 0 insertions, 1616 deletions

diff --git a/ops/nixos/.gitignore b/ops/nixos/.gitignore
deleted file mode 100644
index 773fa1667019..000000000000
--- a/ops/nixos/.gitignore
+++ /dev/null
@@ -1,3 +0,0 @@
-hardware-configuration.nix
-local-configuration.nix
-result
diff --git a/ops/nixos/.skip-subtree b/ops/nixos/.skip-subtree
deleted file mode 100644
index 09520f8c831f..000000000000
--- a/ops/nixos/.skip-subtree
+++ /dev/null
@@ -1 +0,0 @@
-NixOS modules are not readTree compatible.
diff --git a/ops/nixos/README.md b/ops/nixos/README.md
deleted file mode 100644
index 595b4c3344c6..000000000000
--- a/ops/nixos/README.md
+++ /dev/null
@@ -1,7 +0,0 @@
-NixOS modules
-=============
-
-This folder contains various NixOS modules shared by our NixOS
-configurations.
-
-It is not read by `readTree`.
diff --git a/ops/nixos/all-systems.nix b/ops/nixos/all-systems.nix
deleted file mode 100644
index 05a89e05ab70..000000000000
--- a/ops/nixos/all-systems.nix
+++ /dev/null
@@ -1,16 +0,0 @@
-{ depot, ... }:
-
-(with depot.ops.nixos; [
-  whitby
-]) ++
-
-(with depot.users.tazjin.nixos; [
-  camden
-  frog
-  tverskoy
-]) ++
-
-(with depot.users.glittershark.system.system; [
-  chupacabra
-  yeren
-])
diff --git a/ops/nixos/clbot.nix b/ops/nixos/clbot.nix
deleted file mode 100644
index ad33e25a4d54..000000000000
--- a/ops/nixos/clbot.nix
+++ /dev/null
@@ -1,75 +0,0 @@
-# Module that configures CLBot, our Gerrit->IRC info bridge.
-{ depot, config, lib, pkgs, ... }:
-
-let
-  inherit (builtins) attrValues concatStringsSep mapAttrs readFile;
-  inherit (pkgs) runCommandNoCC;
-
-  inherit (lib)
-    listToAttrs
-    mkEnableOption
-    mkIf
-    mkOption
-    removeSuffix
-    types;
-
-  description = "Bot to forward CL notifications";
-  cfg = config.services.depot.clbot;
-
-  mkFlags = flags:
-    concatStringsSep " "
-      (attrValues (mapAttrs (key: value: "-${key} \"${toString value}\"") flags));
-
-  # Escapes a unit name for use in systemd
-  systemdEscape = name: removeSuffix "\n" (readFile (runCommandNoCC "unit-name" {} ''
-    ${pkgs.systemd}/bin/systemd-escape '${name}' >> $out
-  ''));
-
-  mkUnit = flags: channel: {
-    name = "clbot-${systemdEscape channel}";
-    value = {
-      description = "${description} to ${channel}";
-      wantedBy = [ "multi-user.target" ];
-
-      script = "${depot.fun.clbot}/bin/clbot ${mkFlags (cfg.flags // {
-        irc_channel = channel;
-      })} -alsologtostderr";
-
-      serviceConfig = {
-        User = "clbot";
-        EnvironmentFile = "/etc/secrets/clbot";
-        Restart = "always";
-      };
-    };
-  };
-in {
-  options.services.depot.clbot = {
-    enable = mkEnableOption description;
-
-    flags = mkOption {
-      type = types.attrsOf types.str;
-      description = "Key value pairs for command line flags";
-    };
-
-    channels = mkOption {
-      type = with types; listOf str;
-      description = "Channels in which to post (generates one unit per channel)";
-    };
-  };
-
-  config = mkIf cfg.enable {
-    # This does not use DynamicUser because we need to make some files
-    # (notably the SSH private key) readable by this user outside of
-    # the module.
-    users = {
-      groups.clbot = {};
-
-      users.clbot = {
-        group = "clbot";
-        isNormalUser = false;
-      };
-    };
-
-    systemd.services = listToAttrs (map (mkUnit cfg.flags) cfg.channels);
-  };
-}
diff --git a/ops/nixos/default.nix b/ops/nixos/default.nix
deleted file mode 100644
index 8be700b104a7..000000000000
--- a/ops/nixos/default.nix
+++ /dev/null
@@ -1,61 +0,0 @@
-# Most of the Nix expressions in this folder are NixOS modules, which
-# are not readTree compatible.
-#
-# Some things (such as system configurations) are, and we import them
-# here manually.
-#
-# TODO(tazjin): Find a more elegant solution for the whole module
-# situation.
-{ depot, lib, pkgs, ... }@args:
-
-let inherit (lib) findFirst isAttrs;
-in rec {
-  whitby = import ./whitby/default.nix args;
-
-  # System installation
-
-  allSystems = import ./all-systems.nix args;
-
-  # This provides our standard set of arguments to all NixOS modules.
-  baseModule = { ... }: {
-    _module.args = {
-      inherit (args) depot;
-    };
-  };
-
-  nixosFor = configuration: (depot.third_party.nixos {
-    configuration = { ... }: {
-      imports = [
-        baseModule
-        configuration
-      ];
-    };
-  });
-
-  findSystem = hostname:
-    (findFirst
-      (system: system.config.networking.hostName == hostname)
-      (throw "${hostname} is not a known NixOS host")
-      (map nixosFor allSystems));
-
-  rebuild-system = pkgs.writeShellScriptBin "rebuild-system" ''
-    set -ue
-    if [[ $EUID -ne 0 ]]; then
-      echo "Oh no! Only root is allowed to rebuild the system!" >&2
-      exit 1
-    fi
-
-    echo "Rebuilding NixOS for $HOSTNAME"
-    system=$(nix-build -E "((import ${toString depot.depotPath} {}).ops.nixos.findSystem \"$HOSTNAME\").system" --no-out-link --show-trace)
-
-    nix-env -p /nix/var/nix/profiles/system --set $system
-    $system/bin/switch-to-configuration switch
-  '';
-
-  # Systems that should be built in CI
-  #
-  # TODO(tazjin): Refactor the whole systems setup, it's a bit
-  # inconsistent at the moment.
-  whitbySystem = (nixosFor whitby).system;
-  meta.targets = [ "whitbySystem" ];
-}
diff --git a/ops/nixos/irccat.nix b/ops/nixos/irccat.nix
deleted file mode 100644
index e4b30b73553e..000000000000
--- a/ops/nixos/irccat.nix
+++ /dev/null
@@ -1,49 +0,0 @@
-{ depot, config, lib, pkgs, ... }:
-
-let
-  cfg = config.services.depot.irccat;
-  description = "irccat - forward messages to IRC";
-
-  # irccat expects to read its configuration from the *current
-  # directory*, and its configuration contains secrets.
-  #
-  # To make this work we construct the JSON configuration file and
-  # then recursively merge it with an on-disk secret using jq on
-  # service launch.
-  configJson = pkgs.writeText "irccat.json" (builtins.toJSON cfg.config);
-  configMerge = pkgs.writeShellScript "merge-irccat-config" ''
-    if [ ! -f "/etc/secrets/irccat.json" ]; then
-      echo "irccat secrets file is missing"
-      exit 1
-    fi
-
-    # jq's * is the recursive merge operator
-    ${pkgs.jq}/bin/jq -s '.[0] * .[1]' ${configJson} /etc/secrets/irccat.json \
-      > /var/lib/irccat/irccat.json
-  '';
-in {
-  options.services.depot.irccat = {
-    enable = lib.mkEnableOption description;
-
-    config = lib.mkOption {
-      type = lib.types.attrs; # varying value types
-      description = "Configuration structure (unchecked!)";
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    systemd.services.irccat = {
-      inherit description;
-      preStart = "${configMerge}";
-      script = "${depot.third_party.irccat}/bin/irccat";
-      wantedBy = [ "multi-user.target" ];
-
-      serviceConfig = {
-        DynamicUser = true;
-        StateDirectory = "irccat";
-        WorkingDirectory = "/var/lib/irccat";
-        Restart = "always";
-      };
-    };
-  };
-}
diff --git a/ops/nixos/monorepo-gerrit.nix b/ops/nixos/monorepo-gerrit.nix
deleted file mode 100644
index eaea386ecd11..000000000000
--- a/ops/nixos/monorepo-gerrit.nix
+++ /dev/null
@@ -1,128 +0,0 @@
-# Gerrit configuration for the TVL monorepo
-{ depot, pkgs, config, lib, ... }:
-
-let
-  cfg = config.services.gerrit;
-  gerritHooks = pkgs.runCommandNoCC "gerrit-hooks" {} ''
-    mkdir -p $out
-    ln -s ${depot.ops.besadii}/bin/besadii $out/ref-updated
-  '';
-in {
-  services.gerrit = {
-    enable = true;
-    listenAddress = "[::]:4778"; # 4778 - grrt
-    serverId = "4fdfa107-4df9-4596-8e0a-1d2bbdd96e36";
-    builtinPlugins = [
-      "download-commands"
-      "hooks"
-    ];
-
-    plugins = with depot.third_party.gerrit_plugins; [
-      owners
-      oauth
-      depot.ops.gerrit-tvl
-    ];
-
-    package = depot.third_party.gerrit;
-
-    jvmHeapLimit = "4g";
-
-    settings = {
-      core.packedGitLimit = "100m";
-      log.jsonLogging = true;
-      log.textLogging = false;
-      sshd.advertisedAddress = "code.tvl.fyi:29418";
-      hooks.path = "${gerritHooks}";
-      cache.web_sessions.maxAge = "3 months";
-      plugins.allowRemoteAdmin = false;
-      change.enableAttentionSet = true;
-      change.enableAssignee = false;
-
-      # Configures gerrit for being reverse-proxied by nginx as per
-      # https://gerrit-review.googlesource.com/Documentation/config-reverseproxy.html
-      gerrit = {
-        canonicalWebUrl = "https://cl.tvl.fyi";
-        docUrl = "/Documentation";
-      };
-
-      httpd.listenUrl = "proxy-https://${cfg.listenAddress}";
-
-      download.command = [
-        "checkout"
-        "cherry_pick"
-        "format_patch"
-        "pull"
-      ];
-
-      # Configure for cgit.
-      gitweb = {
-        type = "custom";
-        url = "https://code.tvl.fyi";
-        project = "/";
-        revision = "/commit/?id=\${commit}";
-        branch = "/log/?h=\${branch}";
-        tag = "/tag/?h=\${tag}";
-        roottree = "/tree/?h=\${commit}";
-        file = "/tree/\${file}?h=\${commit}";
-        filehistory = "/log/\${file}?h=\${branch}";
-        linkname = "cgit";
-      };
-
-      # Auto-link panettone bug links
-      commentlink.panettone = {
-        match = "b/(\\\\d+)";
-        html = "<a href=\"https://b.tvl.fyi/issues/$1\">b/$1</a>";
-      };
-
-      # Auto-link other CLs
-      commentlink.gerrit = {
-        match = "cl/(\\\\d+)";
-        html = "<a href=\"https://cl.tvl.fyi/$1\">cl/$1</a>";
-      };
-
-      # Configures integration with CAS, which then integrates with a variety
-      # of backends.
-      auth.type = "OAUTH";
-      plugin.gerrit-oauth-provider-cas-oauth = {
-        root-url = "https://login.tvl.fyi";
-        client-id = "OAUTH-TVL-gerrit-Fv0d8Aizz5";
-        # client-secret is set in /var/lib/gerrit/etc/secure.config.
-      };
-
-      # Use Gerrit's built-in HTTP passwords, rather than trying to use the
-      # password against the backing OAuth provider.
-      auth.gitBasicAuthPolicy = "HTTP";
-
-      # Email sending (emails are relayed via the tazj.in domain's
-      # GSuite currently).
-      #
-      # Note that sendemail.smtpPass is stored in
-      # $site_path/etc/secure.config and is *not* controlled by Nix.
-      #
-      # Receiving email is not currently supported.
-      sendemail = {
-        enable = true;
-        html = false;
-        connectTimeout = "10sec";
-        from = "TVL Code Review <tvlbot@tazj.in>";
-        includeDiff = true;
-        smtpEncryption = "none";
-        smtpServer = "localhost";
-        smtpServerPort = 2525;
-      };
-    };
-  };
-
-  systemd.services.gerrit = {
-    serviceConfig = {
-      # There seems to be no easy way to get `DynamicUser` to play
-      # well with other services (e.g. by using SupplementaryGroups,
-      # which seem to have no effect) so we force the DynamicUser
-      # setting for the Gerrit service to be disabled and reuse the
-      # existing 'git' user.
-      DynamicUser = lib.mkForce false;
-      User = "git";
-      Group = "git";
-    };
-  };
-}
diff --git a/ops/nixos/panettone.nix b/ops/nixos/panettone.nix
deleted file mode 100644
index 51a7468578f4..000000000000
--- a/ops/nixos/panettone.nix
+++ /dev/null
@@ -1,103 +0,0 @@
-{ depot, config, lib, pkgs, ... }:
-
-let
-  cfg = config.services.depot.panettone;
-in {
-  options.services.depot.panettone = with lib; {
-    enable = mkEnableOption "Panettone issue tracker";
-
-    port = mkOption {
-      description = "Port on which Panettone should listen";
-      type = types.int;
-      default = 7268;
-    };
-
-    dbHost = mkOption {
-      description = "Postgresql host to connect to for Panettone";
-      type = types.str;
-      default = "localhost";
-    };
-
-    dbName = mkOption {
-      description = "Name of the database for Panettone";
-      type = types.str;
-      default = "panettone";
-    };
-
-    dbUser = mkOption {
-      description = "Name of the database user for Panettone";
-      type = types.str;
-      default = "panettone";
-    };
-
-    secretsFile = mkOption {
-      description = ''
-        Path to a file containing secrets, in the format accepted
-        by systemd's EnvironmentFile
-      '';
-      type = types.str;
-    };
-
-    irccatHost = mkOption {
-      description = "Hostname for the irccat instance";
-      type = types.str;
-      default = "localhost";
-    };
-
-    irccatPort = mkOption {
-      description = "Port for the irccat instance";
-      type = types.int;
-      default = 4722;
-    };
-
-    irccatChannel = mkOption {
-      description = "IRC channels to post to via irccat";
-      type = types.str;
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    assertions = [{
-      assertion =
-        cfg.dbHost != "localhost" || config.services.postgresql.enable;
-      message = "Panettone requires a postgresql database";
-    } {
-      assertion =
-        cfg.dbHost != "localhost" || config.services.postgresql.enableTCPIP;
-      message = "Panettone can only connect to the postgresql database over TCP";
-    } {
-      assertion =
-        cfg.dbHost != "localhost" || (lib.any
-          (user: user.name == cfg.dbUser)
-          config.services.postgresql.ensureUsers);
-      message = "Panettone requires a database user";
-    } {
-      assertion =
-        cfg.dbHost != "localhost" || (lib.any
-          (db: db == cfg.dbName)
-          config.services.postgresql.ensureDatabases);
-      message = "Panettone requires a database";
-    }];
-
-    systemd.services.panettone = {
-      wantedBy = [ "multi-user.target" ];
-      script = "${depot.web.panettone}/bin/panettone";
-
-      serviceConfig = {
-        DynamicUser = true;
-        Restart = "always";
-        EnvironmentFile = cfg.secretsFile;
-      };
-
-      environment = {
-        PANETTONE_PORT = toString cfg.port;
-        PGHOST = "localhost";
-        PGUSER = cfg.dbUser;
-        PGDATABASE = cfg.dbName;
-        IRCCATHOST = cfg.irccatHost;
-        IRCCATPORT = toString cfg.irccatPort;
-        ISSUECHANNEL = cfg.irccatChannel;
-      };
-    };
-  };
-}
diff --git a/ops/nixos/paroxysm.nix b/ops/nixos/paroxysm.nix
deleted file mode 100644
index cd9cd3866e47..000000000000
--- a/ops/nixos/paroxysm.nix
+++ /dev/null
@@ -1,27 +0,0 @@
-{ depot, config, lib, pkgs, ... }:
-
-let
-  cfg = config.services.depot.paroxysm;
-  description = "TVL's majestic IRC bot";
-in {
-  options.services.depot.paroxysm.enable = lib.mkEnableOption description;
-
-  config = lib.mkIf cfg.enable {
-    systemd.services.paroxysm = {
-      inherit description;
-      script = "${depot.fun.paroxysm}/bin/paroxysm";
-      wantedBy = [ "multi-user.target" ];
-
-      environment = {
-        PARX_DATABASE_URL = "postgresql://tvldb:tvldb@localhost/tvldb";
-        PARX_IRC_CONFIG_PATH = "/var/lib/paroxysm/irc.toml";
-      };
-
-      serviceConfig = {
-        DynamicUser = true;
-        StateDirectory = "paroxysm";
-        Restart = "always";
-      };
-    };
-  };
-}
diff --git a/ops/nixos/quassel.nix b/ops/nixos/quassel.nix
deleted file mode 100644
index df26a3945532..000000000000
--- a/ops/nixos/quassel.nix
+++ /dev/null
@@ -1,76 +0,0 @@
-# A more modern module for running Quassel.
-{ config, lib, pkgs, ... }:
-
-let
-  cfg = config.services.depot.quassel;
-  quasselDaemon = pkgs.quassel.override {
-    monolithic = false;
-    enableDaemon = true;
-    withKDE = false;
-  };
-in {
-  options.services.depot.quassel = with lib; {
-    enable = mkEnableOption "Quassel IRC daemon";
-
-    acmeHost = mkOption {
-      description = "ACME host to use for the Quassel TLS certificate";
-      type = lib.types.str;
-    };
-
-    bindAddresses = mkOption {
-      description = "Addresses Quassel will bind to/listen on";
-      default = [ "127.0.0.1" ];
-    };
-
-    logLevel = mkOption {
-      description = "Log level for Quassel Core";
-      default = "Info";
-      type = lib.types.enum [
-        "Debug"
-        "Info"
-        "Warning"
-        "Error"
-      ];
-    };
-
-    port = mkOption {
-      default = 6698;
-      description = ''
-        The port number the Quassel daemon will be listening to.
-      '';
-    };
-  };
-
-  config = with lib; mkIf cfg.enable {
-    systemd.services.quassel = {
-      description = "Quassel IRC daemon";
-      wantedBy = [ "multi-user.target" ];
-
-      script = concatStringsSep " " [
-        "${quasselDaemon}/bin/quasselcore"
-        "--listen=${concatStringsSep "," cfg.bindAddresses}"
-        "--port=${toString cfg.port}"
-        "--configdir=/var/lib/quassel"
-        "--require-ssl"
-        "--ssl-cert=/var/lib/acme/${cfg.acmeHost}/full.pem"
-        "--loglevel=${cfg.logLevel}"
-      ];
-
-      serviceConfig = {
-        Restart = "always";
-        User = "quassel";
-        Group = "quassel";
-        StateDirectory = "quassel";
-      };
-    };
-
-    users = {
-      users.quassel = {
-        isNormalUser = false;
-        group = "quassel";
-      };
-
-      groups.quassel = {};
-    };
-  };
-}
diff --git a/ops/nixos/smtprelay.nix b/ops/nixos/smtprelay.nix
deleted file mode 100644
index d8e03b5794b0..000000000000
--- a/ops/nixos/smtprelay.nix
+++ /dev/null
@@ -1,53 +0,0 @@
-# NixOS module for configuring the simple SMTP relay.
-{ depot, pkgs, config, lib, ... }:
-
-let
-  inherit (builtins) attrValues mapAttrs;
-  inherit (lib)
-    concatStringsSep
-    mkEnableOption
-    mkIf
-    mkOption
-    types
-;
-
-  cfg = config.services.depot.smtprelay;
-  description = "Simple SMTP relay";
-
-  # Configuration values that are always overridden. In particular,
-  # `config` is specified to always load $StateDirectory/secure.config
-  # (so that passwords can be loaded from there) and logging is pinned
-  # to stdout for journald compatibility.
-  overrideArgs = {
-    logfile = "";
-    config = "/var/lib/smtprelay/secure.config";
-  };
-
-  # Creates the command line argument string for the service.
-  prepareArgs = args:
-    concatStringsSep " "
-      (attrValues (mapAttrs (key: value: "-${key} '${toString value}'")
-                            (args // overrideArgs)));
-in {
-  options.services.depot.smtprelay = {
-    enable = mkEnableOption description;
-    args = mkOption {
-      type = types.attrsOf types.str;
-      description = "Key value pairs for command line arguments";
-    };
-  };
-
-  config = mkIf cfg.enable {
-    systemd.services.smtprelay = {
-      inherit description;
-      script = "${depot.third_party.smtprelay}/bin/smtprelay ${prepareArgs cfg.args}";
-      wantedBy = [ "multi-user.target" ];
-
-      serviceConfig = {
-        Restart = "always";
-        StateDirectory = "smtprelay";
-        DynamicUser = true;
-      };
-    };
-  };
-}
diff --git a/ops/nixos/sourcegraph.nix b/ops/nixos/sourcegraph.nix
deleted file mode 100644
index a24328f3e366..000000000000
--- a/ops/nixos/sourcegraph.nix
+++ /dev/null
@@ -1,51 +0,0 @@
-# Run sourcegraph, including its entire machinery, in a container.
-# Running it outside of a container is a futile endeavour for now.
-{ depot, config, pkgs, lib, ... }:
-
-let
-  cfg = config.services.depot.sourcegraph;
-in {
-  options.services.depot.sourcegraph = with lib; {
-    enable = mkEnableOption "SourceGraph code search engine";
-
-    port = mkOption {
-      description = "Port on which SourceGraph should listen";
-      type = types.int;
-      default = 3463;
-    };
-
-    cheddarPort = mkOption {
-      description = "Port on which cheddar should listen";
-      type = types.int;
-      default = 4238;
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    # Run a cheddar syntax highlighting server
-    systemd.services.cheddar-server = {
-      wantedBy = [ "multi-user.target" ];
-      script = "${depot.tools.cheddar}/bin/cheddar --listen 0.0.0.0:${toString cfg.cheddarPort} --sourcegraph-server";
-
-      serviceConfig = {
-        DynamicUser = true;
-        Restart = "always";
-      };
-    };
-
-    virtualisation.oci-containers.containers.sourcegraph = {
-      image = "sourcegraph/server:3.26.0";
-
-      ports = [
-        "127.0.0.1:${toString cfg.port}:7080"
-      ];
-
-      volumes = [
-        "/var/lib/sourcegraph/etc:/etc/sourcegraph"
-        "/var/lib/sourcegraph/data:/var/opt/sourcegraph"
-      ];
-
-      environment.SRC_SYNTECT_SERVER = "http://172.17.0.1:${toString cfg.cheddarPort}";
-    };
-  };
-}
diff --git a/ops/nixos/tvl-buildkite.nix b/ops/nixos/tvl-buildkite.nix
deleted file mode 100644
index 2aa3b81811f4..000000000000
--- a/ops/nixos/tvl-buildkite.nix
+++ /dev/null
@@ -1,48 +0,0 @@
-# Configuration for the TVL buildkite agents.
-{ config, depot, pkgs, lib, ... }:
-
-let
-  cfg = config.services.depot.buildkite;
-  agents = lib.range 1 cfg.agentCount;
-  description = "Buildkite agents for TVL";
-
-  # All Buildkite hooks are actually besadii, but it's being invoked
-  # with different names.
-  buildkiteHooks = pkgs.runCommandNoCC "buildkite-hooks" {} ''
-    mkdir -p $out/bin
-    ln -s ${depot.ops.besadii}/bin/besadii $out/bin/post-command
-  '';
-in {
-  options.services.depot.buildkite = {
-    enable = lib.mkEnableOption description;
-    agentCount = lib.mkOption {
-      type = lib.types.int;
-      description = "Number of Buildkite agents to launch";
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    # Run the Buildkite agents using the default upstream module.
-    services.buildkite-agents = builtins.listToAttrs (map (n: rec {
-      name = "whitby-${toString n}";
-      value = {
-        inherit name;
-        enable = true;
-        tokenPath = "/etc/secrets/buildkite-agent-token";
-        hooks.post-command = "${buildkiteHooks}/bin/post-command";
-      };
-    }) agents);
-
-    # Set up a group for all Buildkite agent users
-    users = {
-      groups.buildkite-agents = {};
-      users = builtins.listToAttrs (map (n: rec {
-        name = "buildkite-agent-whitby-${toString n}";
-        value = {
-          group = lib.mkForce "buildkite-agents";
-          extraGroups = [ name ];
-        };
-      }) agents);
-    };
-  };
-}
diff --git a/ops/nixos/tvl-slapd/default.nix b/ops/nixos/tvl-slapd/default.nix
deleted file mode 100644
index ae99fced7499..000000000000
--- a/ops/nixos/tvl-slapd/default.nix
+++ /dev/null
@@ -1,89 +0,0 @@
-# Configures an OpenLDAP instance for TVL
-#
-# TODO(tazjin): Configure ldaps://
-{ depot, lib, pkgs, ... }:
-
-with depot.nix.yants;
-
-let
-  user = struct {
-    username = string;
-    email = string;
-    password = string;
-    displayName = option string;
-  };
-
-  toLdif = defun [ user string ] (u: ''
-    dn: cn=${u.username},ou=users,dc=tvl,dc=fyi
-    objectClass: organizationalPerson
-    objectClass: inetOrgPerson
-    sn: ${u.username}
-    cn: ${u.username}
-    displayName: ${u.displayName or u.username}
-    mail: ${u.email}
-    userPassword: ${u.password}
-  '');
-
-  inherit (depot.ops) users;
-
-in {
-  # Use our patched OpenLDAP derivation which enables stronger password hashing.
-  #
-  # Unfortunately the module for OpenLDAP has no package option, so we
-  # need to override it system-wide. Be aware that this triggers a
-  # *large* number of rebuilds of packages such as GPG and Python.
-  nixpkgs.overlays = [
-    (_: _: {
-      inherit (depot.third_party) openldap;
-    })
-  ];
-
-  services.openldap = {
-    enable = true;
-    dataDir = "/var/lib/openldap";
-    database = "mdb";
-    suffix = "dc=tvl,dc=fyi";
-    rootdn = "cn=admin,dc=tvl,dc=fyi";
-    rootpw = "{ARGON2}$argon2id$v=19$m=65536,t=2,p=1$OfcgkOQ96VQ3aJj7NfA9vQ$oS6HQOkYl/bUYg4SejpltQYy7kvqx/RUxvoR4zo1vXU";
-
-    settings.children = {
-      "olcDatabase={1}mdb".attrs = {
-        objectClass = [ "olcDatabaseConfig" "olcMdbConfig" ];
-        olcDatabase = "{1}mdb";
-        olcSuffix = "dc=tvl,dc=fyi";
-        olcAccess = "to *  by * read";
-      };
-
-      "cn=module{0}".attrs = {
-        objectClass = "olcModuleList";
-        olcModuleLoad = "pw-argon2";
-      };
-    };
-
-    # Contents are immutable at runtime, and adding user accounts etc.
-    # is done statically in the LDIF-formatted contents in this folder.
-    declarativeContents."dc=tvl,dc=fyi" = ''
-      dn: dc=tvl,dc=fyi
-      dc: tvl
-      o: TVL LDAP server
-      description: Root entry for tvl.fyi
-      objectClass: top
-      objectClass: dcObject
-      objectClass: organization
-
-      dn: ou=users,dc=tvl,dc=fyi
-      ou: users
-      description: All users in TVL
-      objectClass: top
-      objectClass: organizationalUnit
-
-      dn: ou=groups,dc=tvl,dc=fyi
-      ou: groups
-      description: All groups in TVL
-      objectClass: top
-      objectClass: organizationalUnit
-
-      ${lib.concatStringsSep "\n" (map toLdif users)}
-    '';
-  };
-}
diff --git a/ops/nixos/tvl-sso/default.nix b/ops/nixos/tvl-sso/default.nix
deleted file mode 100644
index 8e33c708b7f3..000000000000
--- a/ops/nixos/tvl-sso/default.nix
+++ /dev/null
@@ -1,24 +0,0 @@
-# Configures an Apereo CAS instance for TVL SSO
-{ depot, ... }:
-
-let
-  inherit (depot.third_party) apereo-cas;
-in {
-  config = {
-    environment.systemPackages = [ apereo-cas ];
-    systemd.services.apereo-cas = {
-      description = "Apereo CAS Single Sign On server";
-      wantedBy = [ "multi-user.target" ];
-      after = [ "network.target" ];
-      serviceConfig = {
-        User = "apereo-cas";
-        Group = "apereo-cas";
-        ExecStart = "${apereo-cas}/bin/cas";
-        EnvironmentFile = "/etc/cas/secrets";
-        Restart = "always";
-      };
-    };
-    users.users.apereo-cas = {};
-    users.groups.apereo-cas = {};
-  };
-}
diff --git a/ops/nixos/v4l2loopback.nix b/ops/nixos/v4l2loopback.nix
deleted file mode 100644
index 636b2ff6cf27..000000000000
--- a/ops/nixos/v4l2loopback.nix
+++ /dev/null
@@ -1,12 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-{
-  boot = {
-    extraModulePackages = [ config.boot.kernelPackages.v4l2loopback ];
-    kernelModules = [ "v4l2loopback" ];
-    extraModprobeConfig = ''
-      options v4l2loopback exclusive_caps=1
-    '';
-  };
-}
-
diff --git a/ops/nixos/whitby/OWNERS b/ops/nixos/whitby/OWNERS
deleted file mode 100644
index b1b749e871e1..000000000000
--- a/ops/nixos/whitby/OWNERS
+++ /dev/null
@@ -1,6 +0,0 @@
-inherited: false
-
-# Want in on this list? Try paying!
-owners:
-  - lukegb
-  - tazjin
diff --git a/ops/nixos/whitby/README.md b/ops/nixos/whitby/README.md
deleted file mode 100644
index 55287c541256..000000000000
--- a/ops/nixos/whitby/README.md
+++ /dev/null
@@ -1,5 +0,0 @@
-whitby
-======
-
-`whitby.tvl.fyi` is our dedicated server providing continuous
-integration services and other random nonsense.
diff --git a/ops/nixos/whitby/default.nix b/ops/nixos/whitby/default.nix
deleted file mode 100644
index 394b79c21ba1..000000000000
--- a/ops/nixos/whitby/default.nix
+++ /dev/null
@@ -1,458 +0,0 @@
-{ depot, lib, pkgs, ... }:
-
-let
-  inherit (builtins) listToAttrs;
-  inherit (lib) range;
-in lib.fix(self: {
-  imports = [
-    "${depot.depotPath}/ops/nixos/clbot.nix"
-    "${depot.depotPath}/ops/nixos/irccat.nix"
-    "${depot.depotPath}/ops/nixos/monorepo-gerrit.nix"
-    "${depot.depotPath}/ops/nixos/panettone.nix"
-    "${depot.depotPath}/ops/nixos/paroxysm.nix"
-    "${depot.depotPath}/ops/nixos/smtprelay.nix"
-    "${depot.depotPath}/ops/nixos/sourcegraph.nix"
-    "${depot.depotPath}/ops/nixos/tvl-buildkite.nix"
-    "${depot.depotPath}/ops/nixos/tvl-slapd/default.nix"
-    "${depot.depotPath}/ops/nixos/tvl-sso/default.nix"
-    "${depot.depotPath}/ops/nixos/www/b.tvl.fyi.nix"
-    "${depot.depotPath}/ops/nixos/www/cache.tvl.su.nix"
-    "${depot.depotPath}/ops/nixos/www/cl.tvl.fyi.nix"
-    "${depot.depotPath}/ops/nixos/www/code.tvl.fyi.nix"
-    "${depot.depotPath}/ops/nixos/www/cs.tvl.fyi.nix"
-    "${depot.depotPath}/ops/nixos/www/login.tvl.fyi.nix"
-    "${depot.depotPath}/ops/nixos/www/tazj.in.nix"
-    "${depot.depotPath}/ops/nixos/www/todo.tvl.fyi.nix"
-    "${depot.depotPath}/ops/nixos/www/tvl.fyi.nix"
-    "${depot.depotPath}/ops/nixos/www/wigglydonke.rs.nix"
-    "${pkgs.path}/nixos/modules/services/web-apps/gerrit.nix"
-  ];
-
-  hardware = {
-    enableRedistributableFirmware = true;
-    cpu.amd.updateMicrocode = true;
-  };
-
-  boot = {
-    tmpOnTmpfs = true;
-    kernelModules = [ "kvm-amd" ];
-    supportedFilesystems = [ "zfs" ];
-
-    initrd = {
-      availableKernelModules = [
-        "igb" "xhci_pci" "nvme" "ahci" "usbhid" "usb_storage" "sr_mod"
-      ];
-
-      # Enable SSH in the initrd so that we can enter disk encryption
-      # passwords remotely.
-      network = {
-        enable = true;
-        ssh = {
-          enable = true;
-          port = 2222;
-          authorizedKeys =
-            depot.users.tazjin.keys.all
-            ++ depot.users.lukegb.keys.all
-            ++ [ depot.users.glittershark.keys.whitby ];
-
-          hostKeys = [
-            /etc/secrets/initrd_host_ed25519_key
-          ];
-        };
-
-        # this will launch the zfs password prompt on login and kill the
-        # other prompt
-        postCommands = ''
-          echo "zfs load-key -a && killall zfs" >> /root/.profile
-        '';
-      };
-    };
-
-    kernel.sysctl = {
-      "net.ipv4.tcp_congestion_control" = "bbr";
-    };
-
-    loader.grub = {
-      enable = true;
-      version = 2;
-      efiSupport = true;
-      efiInstallAsRemovable = true;
-      device = "/dev/disk/by-id/nvme-SAMSUNG_MZQLB1T9HAJR-00007_S439NA0N201620";
-    };
-
-    zfs.requestEncryptionCredentials = true;
-  };
-
-  fileSystems = {
-    "/" = {
-      device = "zroot/root";
-      fsType = "zfs";
-    };
-
-    "/boot" = {
-      device = "/dev/disk/by-uuid/073E-7FBD";
-      fsType = "vfat";
-    };
-
-    "/nix" = {
-      device = "zroot/nix";
-      fsType = "zfs";
-    };
-
-    "/home" = {
-      device = "zroot/home";
-      fsType = "zfs";
-    };
-  };
-
-  networking = {
-    # Glass is boring, but Luke doesn't like Wapping - the Prospect of
-    # Whitby, however, is quite a pleasant establishment.
-    hostName = "whitby";
-    domain = "tvl.fyi";
-    hostId = "b38ca543";
-    useDHCP = false;
-
-    # Don't use Hetzner's DNS servers.
-    nameservers = [
-      "8.8.8.8"
-      "8.8.4.4"
-    ];
-
-    defaultGateway6 = {
-      address = "fe80::1";
-      interface = "enp196s0";
-    };
-
-    firewall.allowedTCPPorts = [ 22 80 443 4238 29418 ];
-
-    interfaces.enp196s0.useDHCP = true;
-    interfaces.enp196s0.ipv6.addresses = [
-      {
-        address = "2a01:04f8:0242:5b21::feed:edef:beef";
-        prefixLength = 64;
-      }
-    ];
-  };
-
-  # Generate an immutable /etc/resolv.conf from the nameserver settings
-  # above (otherwise DHCP overwrites it):
-  environment.etc."resolv.conf" = with lib; {
-    source = pkgs.writeText "resolv.conf" ''
-      ${concatStringsSep "\n" (map (ns: "nameserver ${ns}") self.networking.nameservers)}
-      options edns0
-    '';
-  };
-
-  # Disable background git gc system-wide, as it has a tendency to break CI.
-  environment.etc."gitconfig".source = pkgs.writeText "gitconfig" ''
-    [gc]
-    autoDetach = false
-  '';
-
-  time.timeZone = "UTC";
-
-  nix = {
-    nrBuildUsers = 256;
-    maxJobs = lib.mkDefault 64;
-    extraOptions = ''
-      secret-key-files = /etc/secrets/nix-cache-privkey
-    '';
-
-    trustedUsers = [
-      "grfn"
-      "lukegb"
-      "tazjin"
-      "sterni"
-    ];
-
-    sshServe = {
-      enable = true;
-      keys = with depot.users;
-        tazjin.keys.all
-        ++ lukegb.keys.all
-        ++ [ glittershark.keys.whitby ]
-        ++ sterni.keys.all
-        ;
-    };
-  };
-
-  programs.mtr.enable = true;
-  programs.mosh.enable = true;
-  services.openssh = {
-    enable = true;
-    passwordAuthentication = false;
-    challengeResponseAuthentication = false;
-  };
-
-  # Run a handful of Buildkite agents to support parallel builds.
-  services.depot.buildkite = {
-    enable = true;
-    agentCount = 32;
-  };
-
-  # Start a local SMTP relay to Gmail (used by gerrit)
-  services.depot.smtprelay = {
-    enable = true;
-    args = {
-      listen = ":2525";
-      remote_host = "smtp.gmail.com:587";
-      remote_auth = "plain";
-      remote_user = "tvlbot@tazj.in";
-    };
-  };
-
-  # Start the Gerrit->IRC bot
-  services.depot.clbot = {
-    enable = true;
-
-    # Almost all configuration values are already correct (well, duh),
-    # see //fun/clbot for details.
-    flags = {
-      gerrit_host = "cl.tvl.fyi:29418";
-      gerrit_ssh_auth_username = "clbot";
-      gerrit_ssh_auth_key = "/etc/secrets/clbot-key";
-      irc_server = "znc.lukegb.com:6697";
-
-      notify_branches = "canon,refs/meta/config";
-      notify_repo = "depot";
-
-      # This secret is read from an environment variable, which is
-      # populated from /etc/secrets/clbot
-      irc_pass = "$CLBOT_PASS";
-    };
-
-    channels = [
-      "##tvl"
-      "##tvl-dev"
-    ];
-  };
-
-  services.depot = {
-    # Run a SourceGraph code search instance
-    sourcegraph.enable = true;
-
-    # Run the Panettone issue tracker
-    panettone = {
-      enable = true;
-      dbUser = "panettone";
-      dbName = "panettone";
-      secretsFile = "/etc/secrets/panettone";
-      irccatChannel = "##tvl,##tvl-dev";
-    };
-
-    # Run the first cursed bot (quote bot)
-    paroxysm.enable = true;
-
-    # Run irccat to forward messages to IRC
-    irccat = {
-      enable = true;
-      config = {
-        tcp.listen = ":4722"; # "ircc"
-        irc = {
-          server = "chat.freenode.net:6697";
-          tls = true;
-          nick = "tvlbot";
-          realname = "TVL Bot";
-          channels = [
-            "##tvl"
-            "##tvl-dev"
-          ];
-        };
-      };
-    };
-  };
-
-  services.postgresql = {
-    enable = true;
-    enableTCPIP = true;
-
-    authentication = lib.mkForce ''
-      local all all trust
-      host all all 127.0.0.1/32 password
-      host all all ::1/128 password
-      hostnossl all all 127.0.0.1/32 password
-      hostnossl all all ::1/128  password
-    '';
-
-    ensureDatabases = [
-      "panettone"
-    ];
-
-    ensureUsers = [{
-      name = "panettone";
-      ensurePermissions = {
-        "DATABASE panettone" = "ALL PRIVILEGES";
-      };
-    }];
-  };
-
-  services.postgresqlBackup = {
-    enable = true;
-    databases = [
-      "tvldb"
-      "panettone"
-    ];
-  };
-
-  services.nix-serve = {
-    enable = true;
-    port = 6443;
-    secretKeyFile = "/etc/secrets/nix-cache-key.sec";
-    bindAddress = "localhost";
-  };
-
-  environment.systemPackages = with pkgs; [
-    bb
-    curl
-    emacs-nox
-    git
-    htop
-    nano
-    rxvt_unicode.terminfo
-    vim
-    zfs
-    zfstools
-  ];
-
-  # Run cgit for the depot. The onion here is nginx(thttpd(cgit)).
-  systemd.services.cgit = {
-    wantedBy = [ "multi-user.target" ];
-    script = "${depot.web.cgit-taz}/bin/cgit-launch";
-
-    serviceConfig = {
-      Restart = "on-failure";
-      User = "git";
-      Group = "git";
-    };
-  };
-
-  # Regularly back up whitby to Google Cloud Storage.
-  systemd.services.restic = {
-    description = "Backups to Google Cloud Storage";
-    script = "${pkgs.restic}/bin/restic backup /var/lib/gerrit /var/backup/postgresql";
-
-    environment = {
-      GOOGLE_PROJECT_ID = "tazjins-infrastructure";
-      GOOGLE_APPLICATION_CREDENTIALS = "/var/backup/restic/gcp-key.json";
-      RESTIC_REPOSITORY = "gs:tvl-fyi-backups:/whitby";
-      RESTIC_PASSWORD_FILE = "/var/backup/restic/secret";
-      RESTIC_CACHE_DIR = "/var/backup/restic/cache";
-      RESTIC_EXCLUDE_FILE = builtins.toFile "exclude-files" ''
-        /var/lib/gerrit/tmp
-      '';
-    };
-  };
-
-  systemd.timers.restic = {
-    wantedBy = [ "multi-user.target" ];
-    timerConfig.OnCalendar = "hourly";
-  };
-
-  services.journaldriver = {
-    enable = true;
-    googleCloudProject = "tvl-fyi";
-    logStream = "whitby";
-    applicationCredentials = "/var/lib/journaldriver/key.json";
-  };
-
-  security.sudo.extraRules = [
-    {
-      groups = ["wheel"];
-      commands = [{ command = "ALL"; options = ["NOPASSWD"]; }];
-    }
-  ];
-
-  users = {
-    users.tazjin = {
-      isNormalUser = true;
-      extraGroups = [ "git" "wheel" ];
-      shell = pkgs.fish;
-      openssh.authorizedKeys.keys = depot.users.tazjin.keys.all;
-    };
-
-    users.lukegb = {
-      isNormalUser = true;
-      extraGroups = [ "git" "wheel" ];
-      openssh.authorizedKeys.keys = depot.users.lukegb.keys.all;
-    };
-
-    users.grfn = {
-      isNormalUser = true;
-      extraGroups = [ "git" "wheel" ];
-      openssh.authorizedKeys.keys = [
-        depot.users.glittershark.keys.whitby
-      ];
-    };
-
-    users.isomer = {
-      isNormalUser = true;
-      extraGroups = [ "git" ];
-      openssh.authorizedKeys.keys = depot.users.isomer.keys.all;
-    };
-
-    users.riking = {
-      isNormalUser = true;
-      extraGroups = [ "git" ];
-      openssh.authorizedKeys.keys = depot.users.riking.keys.u2f ++ depot.users.riking.keys.passworded;
-    };
-
-    users.edef = {
-      isNormalUser = true;
-      extraGroups = [ "git" ];
-      openssh.authorizedKeys.keys = depot.users.edef.keys.all;
-    };
-
-    users.qyliss = {
-      isNormalUser = true;
-      extraGroups = [ "git" ];
-      openssh.authorizedKeys.keys = depot.users.qyliss.keys.all;
-    };
-
-    users.eta = {
-      isNormalUser = true;
-      extraGroups = [ "git" ];
-      openssh.authorizedKeys.keys = depot.users.eta.keys.whitby;
-    };
-
-    users.cynthia = {
-      isNormalUser = true; # I'm normal OwO :3
-      extraGroups = [ "git" ];
-      openssh.authorizedKeys.keys = depot.users.cynthia.keys.all;
-    };
-
-    users.firefly = {
-      isNormalUser = true;
-      extraGroups = [ "git" ];
-      openssh.authorizedKeys.keys = depot.users.firefly.keys.whitby;
-    };
-
-    users.sterni = {
-      isNormalUser = true;
-      extraGroups = [ "git" ];
-      openssh.authorizedKeys.keys = depot.users.sterni.keys.all;
-    };
-
-    users.flokli = {
-      isNormalUser = true;
-      extraGroups = [ "git" ];
-      openssh.authorizedKeys.keys = depot.users.flokli.keys.all;
-    };
-
-    # Set up a user & group for git shenanigans
-    groups.git = {};
-    users.git = {
-      group = "git";
-      isNormalUser = false;
-      createHome = true;
-      home = "/var/lib/git";
-    };
-  };
-
-  security.acme = {
-    acceptTerms = true;
-    email = "certs@tvl.fyi";
-  };
-
-  system.stateVersion = "20.03";
-})
diff --git a/ops/nixos/www/b.tvl.fyi.nix b/ops/nixos/www/b.tvl.fyi.nix
deleted file mode 100644
index 45f6c6ed5141..000000000000
--- a/ops/nixos/www/b.tvl.fyi.nix
+++ /dev/null
@@ -1,32 +0,0 @@
-{ config, ... }:
-
-{
-  imports = [
-    ./base.nix
-  ];
-
-  config = {
-    services.nginx.virtualHosts."b-shortlink" = {
-      serverName = "b";
-      extraConfig = "return 302 https://b.tvl.fyi$request_uri;";
-    };
-
-    services.nginx.virtualHosts."b.tvl.fyi" = {
-      serverName = "b.tvl.fyi";
-      serverAliases = [ "b.tvl.su" ];
-      enableACME = true;
-      forceSSL = true;
-
-      extraConfig = ''
-        # Forward short links to issues to the issue itself (b/32)
-        location ~ ^/(\d+)$ {
-          return 302 https://b.tvl.fyi/issues$request_uri;
-        }
-
-        location / {
-          proxy_pass http://localhost:${toString config.services.depot.panettone.port};
-        }
-      '';
-    };
-  };
-}
diff --git a/ops/nixos/www/base.nix b/ops/nixos/www/base.nix
deleted file mode 100644
index 4b956cd95ef1..000000000000
--- a/ops/nixos/www/base.nix
+++ /dev/null
@@ -1,36 +0,0 @@
-{ config, pkgs, ... }:
-
-{
-  config = {
-    services.nginx = {
-      enable = true;
-      enableReload = true;
-
-      recommendedTlsSettings = true;
-      recommendedGzipSettings = true;
-      recommendedProxySettings = true;
-    };
-
-    # NixOS 20.03 broke nginx and I can't be bothered to debug it
-    # anymore, all solution attempts have failed, so here's a
-    # brute-force fix.
-    #
-    # TODO(tazjin): Find a link to the upstream issue and see if
-    # they've sorted it after ~20.09
-    systemd.services.fix-nginx = {
-      script = "${pkgs.coreutils}/bin/chown -f -R nginx: /var/spool/nginx /var/cache/nginx";
-
-      serviceConfig = {
-        User = "root";
-        Type = "oneshot";
-      };
-    };
-
-    systemd.timers.fix-nginx = {
-      wantedBy = [ "multi-user.target" ];
-      timerConfig = {
-        OnCalendar = "minutely";
-      };
-    };
-  };
-}
diff --git a/ops/nixos/www/cache.tvl.su.nix b/ops/nixos/www/cache.tvl.su.nix
deleted file mode 100644
index 182306bebff1..000000000000
--- a/ops/nixos/www/cache.tvl.su.nix
+++ /dev/null
@@ -1,26 +0,0 @@
-{ config, ... }:
-
-{
-  imports = [
-    ./base.nix
-  ];
-
-  config = {
-    services.nginx.virtualHosts."cache.tvl.su" = {
-      serverName = "cache.tvl.su";
-      serverAliases = [ "cache.tvl.fyi" ];
-      enableACME = true;
-      forceSSL = true;
-
-      extraConfig = ''
-        location = /cache-key.pub {
-          alias /etc/secrets/nix-cache-key.pub;
-        }
-
-        location / {
-          proxy_pass http://localhost:${toString config.services.nix-serve.port};
-        }
-      '';
-    };
-  };
-}
diff --git a/ops/nixos/www/cl.tvl.fyi.nix b/ops/nixos/www/cl.tvl.fyi.nix
deleted file mode 100644
index 470122c395ea..000000000000
--- a/ops/nixos/www/cl.tvl.fyi.nix
+++ /dev/null
@@ -1,30 +0,0 @@
-{ config, ... }:
-
-{
-  imports = [
-    ./base.nix
-  ];
-
-  config = {
-    services.nginx.virtualHosts."cl-shortlink" = {
-      serverName = "cl";
-      extraConfig = "return 302 https://cl.tvl.fyi$request_uri;";
-    };
-
-    services.nginx.virtualHosts.gerrit = {
-      serverName = "cl.tvl.fyi";
-      serverAliases = [ "cl.tvl.su" ];
-      enableACME = true;
-      forceSSL = true;
-
-      extraConfig = ''
-        location / {
-          proxy_pass http://localhost:4778;
-          proxy_set_header  X-Forwarded-For $remote_addr;
-          # The :443 suffix is a workaround for https://b.tvl.fyi/issues/88.
-          proxy_set_header  Host $host:443;
-        }
-      '';
-    };
-  };
-}
diff --git a/ops/nixos/www/code.tvl.fyi.nix b/ops/nixos/www/code.tvl.fyi.nix
deleted file mode 100644
index c8a4b27b1b52..000000000000
--- a/ops/nixos/www/code.tvl.fyi.nix
+++ /dev/null
@@ -1,35 +0,0 @@
-{ depot, ... }:
-
-{
-  imports = [
-    ./base.nix
-  ];
-
-  config = {
-    services.nginx.virtualHosts.cgit = {
-      serverName = "code.tvl.fyi";
-      serverAliases = [ "code.tvl.su" ];
-      enableACME = true;
-      forceSSL = true;
-
-      extraConfig = ''
-        # Serve the rendered Tvix component SVG.
-        #
-        # TODO(tazjin): Implement a way of serving this dynamically
-        location = /about/tvix/docs/component-flow.svg {
-            alias ${depot.tvix.docs.svg}/component-flow.svg;
-        }
-
-        # Static assets must always hit the root.
-        location ~ ^/(favicon\.ico|cgit\.(css|png))$ {
-           proxy_pass http://localhost:2448;
-        }
-
-        # Everything else hits the depot directly.
-        location / {
-            proxy_pass http://localhost:2448/cgit.cgi/depot/;
-        }
-      '';
-    };
-  };
-}
diff --git a/ops/nixos/www/cs.tvl.fyi.nix b/ops/nixos/www/cs.tvl.fyi.nix
deleted file mode 100644
index fac814baf064..000000000000
--- a/ops/nixos/www/cs.tvl.fyi.nix
+++ /dev/null
@@ -1,31 +0,0 @@
-{ config, ... }:
-
-{
-  imports = [
-    ./base.nix
-  ];
-
-  config = {
-    services.nginx.virtualHosts."cs.tvl.fyi" = {
-      serverName = "cs.tvl.fyi";
-      serverAliases = [ "cs.tvl.su" ];
-      enableACME = true;
-      forceSSL = true;
-
-      extraConfig = ''
-        location = / {
-          return 301 https://cs.tvl.fyi/depot;
-        }
-
-        location / {
-          proxy_set_header X-Sg-Auth "Anonymous";
-          proxy_pass http://localhost:${toString config.services.depot.sourcegraph.port};
-        }
-
-        location /users/Anonymous/settings {
-          return 301 https://cs.tvl.fyi;
-        }
-      '';
-    };
-  };
-}
diff --git a/ops/nixos/www/login.tvl.fyi.nix b/ops/nixos/www/login.tvl.fyi.nix
deleted file mode 100644
index 05b7cee25338..000000000000
--- a/ops/nixos/www/login.tvl.fyi.nix
+++ /dev/null
@@ -1,24 +0,0 @@
-{ ... }:
-
-{
-  imports = [
-    ./base.nix
-  ];
-
-  config = {
-    services.nginx.virtualHosts."login.tvl.fyi" = {
-      serverName = "login.tvl.fyi";
-      enableACME = true;
-      forceSSL = true;
-
-      extraConfig = ''
-        location / {
-          proxy_pass http://localhost:8443;
-          proxy_set_header X-Forwarded-For $remote_addr;
-          proxy_set_header X-Forwarded-Proto https;
-          proxy_set_header Host $host;
-        }
-      '';
-    };
-  };
-}
diff --git a/ops/nixos/www/tazj.in.nix b/ops/nixos/www/tazj.in.nix
deleted file mode 100644
index 7d658a5ec4c1..000000000000
--- a/ops/nixos/www/tazj.in.nix
+++ /dev/null
@@ -1,40 +0,0 @@
-# serve tazjin's website & blog
-{ depot, config, lib, pkgs, ... }:
-
-{
-  imports = [
-    ./base.nix
-  ];
-
-  config = {
-    services.nginx.virtualHosts."tazj.in" = {
-      enableACME = true;
-      forceSSL = true;
-      root = depot.users.tazjin.homepage;
-
-      extraConfig = ''
-        ${depot.users.tazjin.blog.oldRedirects}
-        location /blog/ {
-          alias ${depot.users.tazjin.blog.rendered}/;
-
-          if ($request_uri ~ ^/(.*)\.html$) {
-            return 302 /$1;
-          }
-
-          try_files $uri $uri.html $uri/ =404;
-        }
-
-        # Temporary place for serving static files.
-        location /blobs/ {
-          alias /var/lib/tazjins-blobs/;
-        }
-      '';
-    };
-
-    services.nginx.virtualHosts."git.tazj.in" = {
-      enableACME = true;
-      forceSSL = true;
-      extraConfig = "return 301 https://code.tvl.fyi$request_uri;";
-    };
-  };
-}
diff --git a/ops/nixos/www/todo.tvl.fyi.nix b/ops/nixos/www/todo.tvl.fyi.nix
deleted file mode 100644
index b53f5437e7ab..000000000000
--- a/ops/nixos/www/todo.tvl.fyi.nix
+++ /dev/null
@@ -1,25 +0,0 @@
-{ depot, ... }:
-
-{
-  imports = [
-    ./base.nix
-  ];
-
-  config = {
-    services.nginx.virtualHosts."todo.tvl.fyi" = {
-      serverName = "todo.tvl.fyi";
-      serverAliases = [ "todo.tvl.su" ];
-      root = depot.web.todolist;
-      enableACME = true;
-      forceSSL = true;
-
-      extraConfig = ''
-        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
-
-        location ~* \.(webp|woff2)$ {
-          add_header Cache-Control "public, max-age=31536000";
-        }
-      '';
-    };
-  };
-}
diff --git a/ops/nixos/www/tvl.fyi.nix b/ops/nixos/www/tvl.fyi.nix
deleted file mode 100644
index 45fd35803de7..000000000000
--- a/ops/nixos/www/tvl.fyi.nix
+++ /dev/null
@@ -1,30 +0,0 @@
-{ depot, ... }:
-
-{
-  imports = [
-    ./base.nix
-  ];
-
-  config = {
-    services.nginx.virtualHosts."tvl.fyi" = {
-      serverName = "tvl.fyi";
-      root = depot.web.tvl;
-      enableACME = true;
-      forceSSL = true;
-
-      extraConfig = ''
-        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
-
-        rewrite ^/builds/?$ https://buildkite.com/tvl/depot/ last;
-
-        rewrite ^/monorepo-doc/?$ https://docs.google.com/document/d/1nnyByXcH0F6GOmEezNOUa2RFelpeRpDToBLYD_CtjWE/edit?usp=sharing last;
-
-        rewrite ^/irc/?$ ircs://chat.freenode.net:6697/##tvl last;
-
-        location ~* \.(webp|woff2)$ {
-          add_header Cache-Control "public, max-age=31536000";
-        }
-      '';
-    };
-  };
-}
diff --git a/ops/nixos/www/wigglydonke.rs.nix b/ops/nixos/www/wigglydonke.rs.nix
deleted file mode 100644
index 0bc67898c633..000000000000
--- a/ops/nixos/www/wigglydonke.rs.nix
+++ /dev/null
@@ -1,15 +0,0 @@
-{ depot, lib, pkgs, ... }:
-
-{
-  imports = [
-    ./base.nix
-  ];
-
-  config = {
-    services.nginx.virtualHosts."wigglydonke.rs" = {
-      enableACME = true;
-      forceSSL = true;
-      root = "${depot.depotPath}/users/glittershark/wigglydonke.rs";
-    };
-  };
-}