mob next [ci-skip] [ci skip] [skip ci]

lastFile:vars/per-machine/rigel/yggdrasil/yggdrasil-secret/secret

machines/neptune/configuration.nix

@@ -0,0 +1,22 @@
+{ inputs, config, ... }:
+{
+  imports = [
+    # (inputs.import-tree ./services)
+  ];
+  nixpkgs.hostPlatform = {
+    system = "x86_64-linux";
+  };
+  boot.loader.grub.devices = [ "/dev/disk/by-id/FIXME" ];
+  fileSystems = {
+    "/".device = "/dev/FIXME";
+  };
+  networking.fqdn = "b4l.co.th";
+  system.stateVersion = "25.11";
+  clan.core.sops.defaultGroups = [ "admins" ];
+
+  security.acme.defaults.email = "admin@b4l.co.th";
+  security.acme.acceptTerms = true;
+  services.nginx.virtualHosts."${config.networking.fqdn}" = {
+    enableACME = true;
+  };
+}

machines/rigel/configuration.nix

@@ -8,6 +8,7 @@
         "2bd36db8cc" # kurogeek-thinkpad
       ];
     })
+    ./networking.nix
   ];
 
   system.stateVersion = "25.11";

machines/rigel/networking.nix

@@ -0,0 +1,79 @@
+let
+  ata-interface = "enp2s0";
+in
+{
+  # clan.core.vars.generators.networking.files.ata-interface.secret = false;
+
+  networking.interfaces = {
+    ${ata-interface} = {
+      useDHCP = false;
+      ipv4.addresses = [
+        {
+          address = "192.168.254.1";
+          prefixLength = 24;
+        }
+      ];
+      ipv6.addresses = [
+        {
+          address = "fdab:c002:36cb::1";
+          prefixLength = 64;
+        }
+      ];
+      ipv6.routes = [
+        {
+          address = "fdab:c002:36cb::";
+          prefixLength = 64;
+        }
+        {
+          address = "";
+        }
+      ];
+    };
+  };
+
+  services.dnsmasq = {
+    enable = true;
+
+    settings = {
+      bind-interfaces = true;
+      server = [
+        "1.1.1.1"
+        "8.8.8.8"
+      ];
+      # enable-ra = true;
+      domain-needed = true;
+      domain = "localhost";
+      dhcp-range = [
+        "192.168.254.10,192.168.254.240,255.255.255.0,24h"
+        "fdab:c002:36cb::10,fdab:c002:36cb::240,slaac"
+      ];
+      dhcp-option = [
+        "3,192.168.254.1"
+        "6,8.8.8.8,8.8.4.4"
+        "option6:information-refresh-time,3600"
+      ];
+      interface = [ ata-interface ];
+    };
+  };
+
+  services.nginx = {
+    enable = true;
+    virtualHosts = {
+      "_" = {
+        locations."/" = {
+          proxyPass = "http://192.168.254.96";
+        };
+      };
+    };
+  };
+
+  networking.firewall.allowedUDPPorts = [
+    53
+    67
+  ];
+  networking.firewall.allowedTCPPorts = [
+    53
+    80
+    443
+  ];
+}