mob next [ci-skip] [ci skip] [skip ci]

lastFile:vars/per-machine/rigel/yggdrasil/yggdrasil-secret/secret

machines/neptune/configuration.nix

@@ -0,0 +1,13 @@
+{ inputs, config, ... }:
+{
+  imports = [
+    # (inputs.import-tree ./services)
+  ];
+  nixpkgs.hostPlatform = {
+    system = "x86_64-linux";
+  };
+  system.stateVersion = "25.11";
+  clan.core.sops.defaultGroups = [ "admins" ];
+  clan.core.networking.targetHost = "root@[${config.clan.core.vars.generators.zerotier.files.zerotier-ip.value}]";
+
+}

machines/neptune/disko.nix

@@ -0,0 +1,90 @@
+{ ... }:
+let
+  hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
+  os = "/dev/disk/by-id/mmc-CUTB42_0x9d59499c";
+in
+{
+
+  boot.loader = {
+    systemd-boot = {
+      enable = true;
+    };
+    efi = {
+      canTouchEfiVariables = true;
+    };
+  };
+
+  disko.devices = {
+    disk = {
+      "os-${hashDisk os}" = {
+        type = "disk";
+        device = os;
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              size = "1G";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [ "nofail" ];
+              };
+            };
+            system = {
+              size = "100%";
+              content = {
+                type = "zfs";
+                pool = "zroot";
+              };
+            };
+            swap = {
+              size = "16G";
+              content = {
+                type = "swap";
+              };
+            };
+          };
+        };
+      };
+    };
+    zpool = {
+      zroot = {
+        type = "zpool";
+        rootFsOptions = {
+          mountpoint = "none";
+          compression = "lz4";
+          acltype = "posixacl";
+          xattr = "sa";
+          "com.sun:auto-snapshot" = "true";
+        };
+        options.ashift = "12";
+        datasets = {
+          "root" = {
+            type = "zfs_fs";
+            options.mountpoint = "none";
+          };
+          "root/nixos" = {
+            type = "zfs_fs";
+            options.mountpoint = "/";
+            mountpoint = "/";
+          };
+          "root/home" = {
+            type = "zfs_fs";
+            options.mountpoint = "/home";
+            mountpoint = "/home";
+          };
+          "root/tmp" = {
+            type = "zfs_fs";
+            mountpoint = "/tmp";
+            options = {
+              mountpoint = "/tmp";
+              sync = "disabled";
+            };
+          };
+        };
+      };
+    };
+  };
+}

machines/rigel/configuration.nix

@@ -8,6 +8,7 @@
         "2bd36db8cc" # kurogeek-thinkpad
       ];
     })
+    # ./networking.nix
   ];
 
   system.stateVersion = "25.11";

machines/rigel/networking.nix

@@ -0,0 +1,91 @@
+{ lib, config, ... }:
+let
+  ata-interface = "enp2s0";
+
+  ipv6Subnet = lib.elemAt (lib.splitString "/" config.clan.core.vars.generators.yggdrasil.files.yggdrasil-subnet.value) 0;
+  ipv6Prefix = lib.elemAt (lib.splitString "/" config.clan.core.vars.generators.yggdrasil.files.yggdrasil-subnet.value) 1;
+in
+{
+  # clan.core.vars.generators.networking.files.ata-interface.secret = false;
+
+  networking.interfaces = {
+    ${ata-interface} = {
+      useDHCP = false;
+      ipv4.addresses = [
+        {
+          address = "192.168.254.1";
+          prefixLength = 24;
+        }
+      ];
+      ipv6.addresses = [
+        {
+          address = ipv6Subnet + "1";
+          prefixLength = lib.toInt ipv6Prefix;
+        }
+      ];
+      ipv6.routes = [
+        {
+          address = "200::";
+          prefixLength = 7;
+          # via = "${ipv6Subnet}1";
+        }
+      ];
+    };
+  };
+
+  services.dnsmasq = {
+    enable = true;
+
+    settings = {
+      bind-interfaces = true;
+      server = [
+        "1.1.1.1"
+        "8.8.8.8"
+      ];
+      # enable-ra = true;
+      domain-needed = true;
+      domain = "localhost";
+      dhcp-range = [
+        "192.168.254.100,192.168.254.100,255.255.255.0,24h"
+      ];
+      dhcp-option = [
+        "3,192.168.254.1"
+        "6,8.8.8.8,8.8.4.4"
+        "option6:information-refresh-time,3600"
+      ];
+      interface = [ ata-interface ];
+    };
+  };
+
+  services.nginx = {
+    enable = true;
+    virtualHosts = {
+      "_" = {
+        locations."/" = {
+          proxyPass = "http://192.168.254.100";
+        };
+      };
+    };
+  };
+
+  boot.kernel.sysctl = {
+    "net.ipv6.conf.all.forwarding" = true;
+  };
+
+  networking.firewall.allowedUDPPortRanges = [
+    {
+      from = 10000;
+      to = 20000;
+    }
+  ];
+
+  networking.firewall.allowedUDPPorts = [
+    53
+    67
+  ];
+  networking.firewall.allowedTCPPorts = [
+    53
+    80
+    443
+  ];
+}