nix fmt

dunno how to reliably ensure the mpd service is ordered after each
binds_to address is bound (& so bind(3)able)

inventories/default.nix

@@ -169,6 +169,32 @@
           };
           roles.default.machines.b4l = { };
         };
+        pulse-stream = {
+          module = {
+            name = "pulse-stream";
+            input = "self";
+          };
+          roles.default.machines.neptune = {
+            settings.client-ip-ranges = [
+              "10.0.0.0/24"
+            ];
+          };
+        };
+        jukebox = {
+          module = {
+            name = "jukebox";
+            input = "self";
+          };
+          roles.default.machines.neptune = {
+            settings = {
+              binds = [ "wlp1s0" ];
+              disks.m3 = {
+                uuid = "105D-319E";
+                mountOptions = [ "utf8" ];
+              };
+            };
+          };
+        };
       };
     };
   };

machines/neptune/configuration.nix

@@ -12,6 +12,44 @@
   clan.core.sops.defaultGroups = [ "admins" ];
   clan.core.networking.targetHost = "root@[${config.clan.core.vars.generators.zerotier.files.zerotier-ip.value}]";
 
+  networking.interfaces.enx00e04c106368.useDHCP = true; # recovery
+
+  clan.core.vars.generators.wireless-credentials = {
+    files = {
+      essid.secret = false;
+      psk.secret = true;
+    };
+    prompts = {
+      essid.persist = true;
+      psk.persist = true;
+    };
+    script = ''
+      cat "$prompts"/essid > $out/essid
+      prompt_psk=$(cat "$prompts"/psk)
+      echo "psk=$prompt_psk" > $out/psk
+    '';
+  };
+
+  networking.wireless =
+    let
+      credentials = config.clan.core.vars.generators.wireless-credentials.files;
+    in
+    {
+      enable = true;
+      secretsFile = credentials.psk.path;
+      networks.${credentials.essid.value}.pskRaw = "ext:psk";
+    };
+
+  networking.interfaces.wlp1s0 = {
+    useDHCP = false;
+    ipv4.addresses = [
+      {
+        address = "10.0.0.9";
+        prefixLength = 24;
+      }
+    ];
+  };
+
   services.yggdrasil.settings.Peers = lib.mkForce [
     "tcp://newt.barry.town:1337"
     "tls://yg-hkg.magicum.net:32333"

modules/clan/jukebox/default.nix

@@ -0,0 +1,133 @@
+{ ... }:
+{
+  _class = "clan.service";
+  manifest.name = "jukebox";
+  manifest.description = "mpd server, library on removable disks";
+  manifest.categories = [ "System" ];
+
+  roles.default = {
+    interface =
+      { lib, ... }:
+      {
+        options = {
+          baseDir = lib.mkOption {
+            type = lib.types.str;
+            default = "/mnt/jukebox";
+          };
+          binds = lib.mkOption {
+            type = with lib.types; listOf str;
+            default = [ ];
+          };
+          disks = lib.mkOption {
+            type =
+              with lib.types;
+              attrsOf (
+                submodule (
+                  { name, ... }:
+                  {
+                    options = {
+                      name = lib.mkOption {
+                        type = str;
+                        default = name;
+                      };
+                      uuid = lib.mkOption {
+                        type = str;
+                      };
+                      mountOptions = lib.mkOption {
+                        type = listOf str;
+                        default = [ ];
+                      };
+                    };
+                  }
+                )
+              );
+            default = { };
+            description = "disks comprising library";
+          };
+        };
+      };
+    perInstance =
+      {
+        settings,
+        ...
+      }:
+      {
+        nixosModule =
+          {
+            config,
+            lib,
+            pkgs,
+            ...
+          }:
+          {
+            services.pulseaudio.enable = true;
+
+            # workaround cookie permissions
+            services.pulseaudio.tcp.enable = true;
+            services.pulseaudio.tcp.anonymousClients = {
+              allowedIpRanges = [ "127.0.0.1" ];
+              allowAll = true;
+            };
+
+            systemd.tmpfiles.rules = [
+              "d ${settings.baseDir} 0755 root root"
+            ];
+
+            fileSystems =
+              let
+                disk2fs =
+                  {
+                    name,
+                    uuid,
+                    mountOptions,
+                    ...
+                  }:
+                  lib.nameValuePair "${settings.baseDir}/${name}" {
+                    device = "/dev/disk/by-uuid/${uuid}";
+                    fsType = "auto";
+                    options = [
+                      "noauto"
+                      "nofail"
+                    ]
+                    ++ mountOptions;
+                  };
+              in
+              lib.listToAttrs (lib.mapAttrsToList (_: disk2fs) settings.disks);
+
+            services.udev.extraRules =
+              let
+                translate-prefix = path: (lib.removePrefix "-" (lib.replaceStrings [ "/" ] [ "-" ] path));
+                mount-name = name: "${translate-prefix settings.baseDir}-${name}.mount";
+                disk2rule =
+                  { name, uuid, ... }:
+                  lib.concatStringsSep ", " [
+                    ''ACTION=="add"''
+                    ''SUBSYSTEM=="block"''
+                    ''ENV{DEVLINKS}=="*/dev/disk/by-uuid/${uuid}*"''
+                    ''ENV{SYSTEMD_WANTS}="${mount-name name}"''
+                  ];
+              in
+              lib.concatMapStringsSep "\n" disk2rule (lib.attrValues settings.disks);
+
+            services.mpd = {
+              enable = true;
+              musicDirectory = settings.baseDir;
+              network.listenAddress = "any";
+              extraConfig = ''
+                audio_output {
+                  type "pulse"
+                  name "jukebox"
+                  server "localhost"
+                }
+              '';
+            };
+
+            networking.firewall.interfaces = lib.genAttrs settings.binds (_: {
+              allowedTCPPorts = [ config.services.mpd.network.port ];
+            });
+
+            environment.systemPackages = [ pkgs.mpc ];
+          };
+      };
+  };
+}

modules/clan/jukebox/flake-module.nix

@@ -0,0 +1,9 @@
+{ lib, ... }:
+let
+  module = lib.modules.importApply ./default.nix { };
+in
+{
+  clan.modules = {
+    jukebox = module;
+  };
+}

modules/clan/phonebox/default.nix

@@ -26,6 +26,7 @@
           {
             lib,
             config,
+            pkgs,
             ...
           }:
           let
@@ -316,6 +317,30 @@
                     + serverConf;
                 };
             };
+
+            systemd.services.asterisk-watcher = {
+              enable = true;
+              description = "Asterisk Configuration files watcher";
+
+              requires = [ "asterisk.service" ];
+              after = [ "network.target" ];
+              wantedBy = [ "multi-user.target" ];
+              path = with pkgs; [
+                inotify-tools
+                asterisk
+              ];
+              script = ''
+                inotifywait -m -e move /etc/asterisk |
+                while read path action file; do
+                  case "$file" in
+                    pjsip.conf)
+                      echo "restarting pjsip"
+                      asterisk -rx "pjsip reload"
+                      ;;
+                  esac
+                done
+              '';
+            };
           };
       };
   };

modules/clan/pulse-stream/default.nix

@@ -0,0 +1,42 @@
+{ ... }:
+{
+  _class = "clan.service";
+  manifest.name = "pulse-stream";
+  manifest.description = "stream audio to attached speakers";
+  manifest.categories = [ "System" ];
+
+  roles.default = {
+    interface =
+      { lib, ... }:
+      {
+        options.client-ip-ranges = lib.mkOption {
+          type = lib.types.listOf lib.types.str;
+          description = "ip subnets permitted to stream to the server";
+          default = [ ];
+        };
+      };
+    perInstance =
+      {
+        roles,
+        settings,
+        ...
+      }:
+      {
+        nixosModule =
+          { ... }:
+          {
+            services.pulseaudio = {
+              enable = true;
+              systemWide = true;
+              tcp = {
+                enable = true;
+                anonymousClients.allowedIpRanges = settings.client-ip-ranges;
+                anonymousClients.allowAll = true;
+              };
+              zeroconf.publish.enable = true;
+            };
+            networking.firewall.allowedTCPPorts = [ 4713 ];
+          };
+      };
+  };
+}

modules/clan/pulse-stream/flake-module.nix

@@ -0,0 +1,9 @@
+{ lib, ... }:
+let
+  module = lib.modules.importApply ./default.nix { };
+in
+{
+  clan.modules = {
+    pulse-stream = module;
+  };
+}

vars/per-machine/neptune/wireless-credentials/essid/value

@@ -0,0 +1 @@
+fnord

vars/per-machine/neptune/wireless-credentials/psk/groups/admins

@@ -0,0 +1 @@
+../../../../../../sops/groups/admins

vars/per-machine/neptune/wireless-credentials/psk/machines/neptune

@@ -0,0 +1 @@
+../../../../../../sops/machines/neptune

vars/per-machine/neptune/wireless-credentials/psk/secret

@@ -0,0 +1,50 @@
+{
+	"data": "ENC[AES256_GCM,data:IED8nXjriEH+TG2Sih5hkD5OMTWR,iv:mcRLxgIqJL/xw7V3wGz3gXI5B4YFnSmkqSazmoK3N0E=,tag:Y8ICPgw9/V0S0Rm2QkhISg==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArcHBESFB5UkpBQlV5bkQ5\nVWhmdkhOK1Bxc0FXQnNnY0N6TXIrbC95QzB3Cm9yMFhNeStYRDliUllKa001aGNv\nNHNBTkZNRmtST2ZhWWVIY1NHa0hna3cKLS0tIFpERDN4VlI1NUVSeXhwNGV4ZDVQ\nNjZ0MzhXU3dMaUo2Nkk3dVk0cS9ZeEUKN6ob+mUG3w6z9Gbg5PRKbHtxXoMzOG1L\n3w2RQHUwC6ppes5qc5NbR3ViIGAVmLyJbkCp/sZ3XeO0wUX81ZTjHg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age14x2fatvz802dyvnfukgkxfu30khuqml5ang9smm3pr9lc95eqpjs2ywxxf",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzU21naGNWVzRRZXE1UC84\nMyttU1hqcStaNHBDMGlTaCs4Vm1EM0NweXlFCmxNUjc2cTVELzZCc0hZVEJ5QTFn\nRGFZS1VsaHYyY3VsUHcyL0tuSlVOMHMKLS0tIGxNS2MrcWpVeFNkRytMc1oyYTI1\nSDlaaXUzelJURDZvVG1Jcm8zTlJWVEEK3jRlrYayyGG6yFwJDWb2Zu7fQIlIdtUl\nJ46i8q+Vvdpeuj81bB6L5toQySTzvwbCTDvpG7fwz6l9fxWUqb6FpA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsUXRIU0dGR3UzZHFzZFhD\nTTFwci9uMUZUYnQ0MWRWOWdjK3RrdUlzOGt3CjFac25MTzRBM1NSQ2VjODRscmYv\nUjcvQWNFd1FtMWRndTRnbHBBaVBHSDgKLS0tIERwamhvN1U3Z3k3SytYTjFDRUJC\nTFRmK2NkKzZCbWRGUXNNZGphTExhQjQKeLyRHdPv4fgCUQcIGn+sWjD7fvLGuLJC\ngJaSesV7cklBttb1f5bu+ShviwV/djMCKMVGl1CaJDfL/2dFJJvPQg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEtJT1VuMEN3\nMFVEUk5CaG1oNmoxRmc4cTYwNTYrcnlkS21uV0dYVUNDbmMgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQoyaEdVbkUzdnFRWnBuMHB2anViTUcx\nZ2RRSFBUZ1dMS2ZFQ1lhcGVrUkFVCi0tLSA5NzQwbVZXbWo0NmNIUkZQclNUbkNX\nMERQTmhyNXRGdXhpZ1M0MWRsckVnCs5ny3po5OfA+CacrRTZtcjxfYtdRCRko5LW\n+vAqyiAiTGD4azdPt0x7gt0/Y5IoblcqHa+quaRda/geMDQ6v2k=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIE5weXFaZHVQ\na2FzUUJYZ1FQaGw3ZWlrdktJdnJIenEydWVWdjl5RUJYRjQgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpzbExnSmU3NUd0cTNGYy9OcEFpQnNS\nY1pZRnlRdlorSVRYdm9UK0dhTDhZCi0tLSBuYzdhQnRtRmRJZEFJU1RuWFFxM2hE\nSlF0Ky9Jc1pxNXlYbTZLdmNGQ0U4CjZ0F7LDJV0tIbcJI3BJYfZshqQzfm2hHwjm\n9Bea/w2MM9ndHKXuIuSByfLPN2PHcl5+cy+tv6mYbZudRZbotFw=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIG1tNit6eG4r\nN3YyZEVmbVhFNytqUTlza3A4V2prNW1sTE96NzhpWU8vbGMgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZworVnloaklDOFpoN0hQTDdISzBXWU84\ndFgvY1lBd3pDa2I2YXhQYjd6eEZRCi0tLSBOSUJZNWRrQUJOVEYzWEZ4aDY2ODZk\nckQrdnJrckxiNzNJTjduRlJyRGxJCmHC1hTGZXrhGVqqThHQW6WWAcyXzC4oQ/ti\nGJol/gOmHzrcx4MtHty6CzG3rmkceAZ/OfGgcfXqkN8pa9e1nMI=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpTmkvTENpNXhMRkhQNHJz\nTjhhZ2EraVVYeEVUUXNzdFFvNkNhbXNkVDAwCnJmTlFLRWVZdXR5RUlVVXhId2dJ\nSStlSjR3dEh6UWsxcHc4QXZ0c2pab28KLS0tIDJDbUIyelJ4bFpXNDZEOWRicEtC\nd0Vydm5EMGwxUCtzT3RpdUZpUUtMSEkKG84plq3fKKN+lT5D6deK5DOzrU+VmWiV\nDfiALns8ZrgCKP5/d62VHEJW+fb+gVAcyWzjGzXYlVAmZTDmeR8c8w==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMaFhhUkVCTDBZczJJZDVp\ndDhCSlF6TkQ0TS85aVhGWmxBUEdvSnlPUnhRCi9hTUpGcDF1VmIxQUMxY09MTlN4\nZnZKQklBUkhwTXUxQjZIWjNTUHFmMDAKLS0tIDFnaDBmUTFmTUlEa2QyMDlRRzdM\nVEVqeWZ4eE82Z09pWFVySWtCaHVXencKd9yXoosySJG95I4lCzVpQ+gKU+7XGzts\nG2MaKqfald62Pvp9OAJLNNzHbam36c7EeRABwMH2myhRrpiwxz1PPg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKVjdEM2RFS0xzbStVTCt2\nOWhNRlpNdFNvSkprTDIvUlk1RENTSHp3ZlgwCnVDamJTL2htTXdsdEtHdGtUT1VG\nelRhL1BQTG1FNzBPSXpMMk1WanRGMm8KLS0tIGpCL3IydDJ4MWxjQWp2dkp5TzUx\nRlNacWw3Z3RhT1NEdjAwbG4ySUFRNFkKj2Y6gg6JwA4QtYVnsAD5uFSo4C+Z8IZ3\nCV7AgZ8PN8vxHpRxuM1ZKjNA1klpPxeYEggvF9PGDRlev8z1d3Kq1w==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRUUV0WXo5NzVqYUNyS1NG\nWjArUjJjSjBoOHV6U1pzN1oxdnp2VFF2a2pZCkxHNkEvd3VRZ3RuYnpQNUxBQjJQ\nWFpWMjBVOWRJWlJ1SHhVMWRVOXEydG8KLS0tIDQrNTF2R29vNE5xZ0RKRzJOTVdm\ndnFvdTJ4cnJyUE5XaTFiYzEyRnk0YmcKwpTTaBnWHoZqLEXHMOEvhRb520jSouIY\nql8C1fG8a6hVWTszzjkdT0FGxUniDM5IXdy2PWHhKR5SZu+Kszea1w==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-12-09T15:29:36Z",
+		"mac": "ENC[AES256_GCM,data:L4UKnns7jaubOZje2i8IZ/jETBlN+xnJ2JugZy+chw2rPamD28e7uuVF0/cUOOkc7inuPhgKih8bqlA6vJmSAO6825V/M5VnCaanw7rMtk52+nTtCE8iZgrTU4MUJnC8tBj6i/qCL0EbklQeTYsuy3MCRnaZu78QoLkeIF/3Kf8=,iv:2wz0D+nPfTUcqcv3BckhIj0Fd2//jh63MvcySsTAmXM=,tag:OE5cPZGitJrYOLJtgqUnOw==,type:str]",
+		"version": "3.11.0"
+	}
+}

vars/per-machine/neptune/wireless-credentials/psk/users/vi

@@ -0,0 +1 @@
+../../../../../../sops/users/vi