mob next [ci-skip] [ci skip] [skip ci]

lastFile:machines/b4l/services/gitea.nix

.gitignore

@@ -2,5 +2,4 @@
 # Ignore build outputs from performing a nix-build or `nix build` command
 result
 result-*
-run-vm-*
+
-.nixos-test-history

flake.nix

@@ -7,12 +7,6 @@
       inputs.treefmt-nix.follows = "treefmt-nix";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    clan-community = {
-      url = "git+https://git.clan.lol/clan/clan-community";
-      inputs.clan-core.follows = "clan-core";
-      inputs.flake-parts.follows = "flake-parts";
-      inputs.treefmt-nix.follows = "treefmt-nix";
-    };
     devshell = {
       url = "github:numtide/devshell";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -21,53 +15,12 @@
       inputs.nixpkgs-lib.follows = "nixpkgs";
       url = "github:hercules-ci/flake-parts";
     };
-    home-manager = {
-      inputs.nixpkgs.follows = "nixpkgs";
-      url = "github:nix-community/home-manager";
-    };
-    plasma-manager = {
-      url = "github:nix-community/plasma-manager";
-      inputs.nixpkgs.follows = "nixpkgs";
-      inputs.home-manager.follows = "home-manager";
-    };
     import-tree.url = "github:vic/import-tree";
     nixpkgs.url = "github:nixos/nixpkgs/nixpkgs-unstable";
     treefmt-nix = {
       url = "github:numtide/treefmt-nix";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    liminix = {
-      url = "git+https://gti.telent.net/dan/liminix";
-      flake = false;
-    };
-    frappix = {
-      url = "github:kurogeek/frappix";
-      inputs.nixpkgs.follows = "nixpkgs";
-      inputs.devshell.follows = "devshell";
-    };
-
-    nixos-images = {
-      url = "github:nix-community/nixos-images";
-      inputs.nixos-unstable.follows = "nixpkgs";
-      inputs.nixos-stable.follows = "nixpkgs";
-    };
-
-    matthew-hardware = {
-      url = "git+https://codeberg.org/matthewcroughan/matthew-hardware?ref=mc/wip";
-      inputs.flake-parts.follows = "flake-parts";
-      inputs.nixpkgs.follows = "nixpkgs";
-      inputs.disko.follows = "clan-core/disko";
-    };
-
-    # `router` clan service (site gateway: PPPoE, VLAN bridge, Kea/Blocky,
-    # nftables). Consumed via `module.input = "cnx-network"` in inventories/router.nix.
-    cnx-network = {
-      url = "git+https://git.b4l.co.th/B4L/cnx-network-clan?ref=clanService-router-ai";
-      inputs.clan-core.follows = "clan-core";
-      inputs.nixpkgs.follows = "nixpkgs";
-      inputs.flake-parts.follows = "flake-parts";
-      inputs.treefmt-nix.follows = "treefmt-nix";
-    };
   };
   outputs =
     {
@@ -84,43 +37,10 @@
           ./fmt.nix
           ./shell.nix
 
-          ./overlays
           ./machines
-          ./routers
           ./inventories
-          ./overlays
-          ./tests
           ./modules/clan/flake-module.nix
-          ./modules/nixos/flake-module.nix
         ];
-        perSystem =
-          { pkgs, system, ... }:
-          {
-            _module.args.pkgs = import inputs.nixpkgs {
-              inherit system;
-              overlays = [
-                inputs.self.overlays.packagesOverlay
-              ];
-              config = { };
-            };
-            packages.think = pkgs.think-gtcm;
-            packages.think-be = pkgs.think-backend-gtcm;
-            packages.file-uploader = pkgs.gtcm-file-uploader;
-            packages.installer =
-              (pkgs.nixos [
-                inputs.nixos-images.nixosModules.image-installer
-                {
-                  users.users.root.openssh.authorizedKeys.keys = [
-                    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAB/raxJR8gASmquP63weHelbi+da2WBJR1DgzHPNz/f"
-                    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDuhpzDHBPvn8nv8RH1MRomDOaXyP4GziQm7r3MZ1Syk"
-                    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEcZ/p1Ofa9liwIzPWzNtONhJ7+FUWd2lCz33r81t8+w kurogeek@kurogeek"
-                    "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIOJDRQfb1+7VK5tOe8W40iryfBWYRO6Uf1r2viDjmsJtAAAABHNzaDo="
-                    "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIDgsWq+G/tcr6eUQYT7+sJeBtRmOMabgFiIgIV44XNc6AAAABHNzaDo="
-                    "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIJMi3TAuwDtIeO4MsORlBZ31HzaV5bji1fFBPcC9/tWuAAAABHNzaDo="
-                  ];
-                }
-              ]).config.system.build.isoImage;
-          };
       }
     );
 }

inventories/default.nix

@@ -1,562 +1,102 @@
 {
-  imports = [
+  inputs,
-    ./personal-computer.nix
+  self,
-    ./emmie.nix
+  lib,
-    ./router.nix
+  pkgs,
-  ];
+  ...
+}:
+{
   clan = {
     inventory = {
 
-      tags = {
+      machines = {
-        glom = [
+        rigel.deploy.targetHost = "root@rigel.local";
-          "vega"
-          "ramus"
-          "canopus"
-        ];
-        poy = [
-          "deneb"
-          "bosona"
-        ];
-        w = [
-          "sirius"
-          "stellio"
-        ];
-        b4l = [
-          "rigel"
-          "rana"
-          "petra"
-          "alasia"
-        ];
-        phonebox = [
-          "rigel"
-          "almach"
-          "alpheratz"
-          "mirach"
-          "adhil"
-          "buna"
-        ];
-
-        prometheus = [
-          "cursa"
-          "rigel"
-          "vega"
-          "buna"
-        ];
-
-        dm-bootstrapper = [
-          "rigel"
-          "cursa"
-          "deneb"
-          "bosona"
-          "canopus"
-        ];
-
-        dm-pull-deploy = [
-          "rana"
-          "rigel"
-          "vega"
-        ];
       };
 
       instances = {
-
+        admin = {
-        borgbackup = {
           module = {
-            name = "borgbackup";
+            name = "admin";
-            input = "clan-core";
-          };
-          roles.client.machines."cursa".settings.destinations = {
-            alex = {
-              repo = "ssh://borg@10.0.10.225:2222/backup/cursa/backup";
-              rsh = "ssh -i /run/secrets/vars/borgbackup/borgbackup.ssh";
-            };
-          };
-          roles.client.machines."hadar".settings.destinations = {
-            alex = {
-              repo = "ssh://borg@10.0.10.225:2222/backup/hadar/backup";
-              rsh = "ssh -i /run/secrets/vars/borgbackup/borgbackup.ssh";
-            };
-          };
-          roles.client.machines."procyon".settings.destinations = {
-            alex = {
-              repo = "ssh://borg@10.0.10.225:2222/backup/procyon/backup";
-              rsh = "ssh -i /run/secrets/vars/borgbackup/borgbackup.ssh";
-            };
-          };
-          roles.client.machines."bosona".settings.destinations = {
-            alex = {
-              repo = "ssh://borg@10.0.10.225:2222/backup/bosona/backup";
-              rsh = "ssh -i /run/secrets/vars/borgbackup/borgbackup.ssh";
-            };
-          };
-          roles.client.machines."canopus".settings.destinations = {
-            alex = {
-              repo = "ssh://borg@10.0.10.225:2222/backup/canopus/backup";
-              rsh = "ssh -i /run/secrets/vars/borgbackup/borgbackup.ssh";
-            };
-          };
-          roles.client.machines."deneb".settings.destinations = {
-            alex = {
-              repo = "ssh://borg@10.0.10.225:2222/backup/deneb/backup";
-              rsh = "ssh -i /run/secrets/vars/borgbackup/borgbackup.ssh";
-            };
-          };
-          roles.client.machines."alasia".settings.destinations = {
-            alex = {
-              repo = "ssh://borg@10.0.10.225:2222/backup/alasia/backup";
-              rsh = "ssh -i /run/secrets/vars/borgbackup/borgbackup.ssh";
-            };
-          };
-        };
-
-        data-mesher = {
-          module = {
-            name = "data-mesher";
-            input = "clan-core";
-          };
-          roles.bootstrap.tags = [ "dm-bootstrapper" ];
-          roles.default.tags = [ "all" ];
-          roles.default.settings.interfaces = [ "ygg" ];
-        };
-
-        auto-pull-update = {
-          module = {
-            name = "dm-pull-deploy";
-            input = "clan-community";
-          };
-          roles.push.machines."rigel".settings = {
-            gitUrl = "https://git.b4l.co.th/newedge/infra.git";
-            branch = "main";
-          };
-          roles.push.extraModules = [
-            (
-              { pkgs, config, ... }:
-              {
-                # work around until upstream is fixed
-                environment.systemPackages = [
-                  (pkgs.writeShellApplication {
-                    name = "custom-dm-send-deploy";
-                    runtimeInputs = [
-                      config.services.data-mesher.package
-                      pkgs.git
-                      pkgs.nix
-                      pkgs.jq
-                    ];
-                    text =
-                      let
-                        settings.gitUrl = "https://git.b4l.co.th/newedge/infra.git";
-                        settings.branch = "main";
-                      in
-                      ''
-                        if [ $# -gt 1 ]; then
-                          echo "Usage: dm-send-deploy [<flake-ref>]"
-                          echo "Without arguments, sends the latest commit on '${settings.branch}' from ${settings.gitUrl}"
-                          echo "Example: dm-send-deploy git+https://example.com/repo.git?rev=abc123..."
-                          exit 1
-                        fi
-
-                        KEY="${config.clan.core.vars.generators.dm-pull-deploy-signing-key.files."signing.key".path}"
-                        if [ ! -r "$KEY" ]; then
-                          echo "Error: cannot read signing key at $KEY (are you root?)"
-                          exit 1
-                        fi
-
-                        if [ $# -eq 1 ]; then
-                          FLAKE_REF="$1"
-                        else
-                          REV=$(git ls-remote "${settings.gitUrl}" "refs/heads/${settings.branch}" | cut -f1)
-                          if [ -z "$REV" ]; then
-                            echo "Error: could not determine latest commit on ${settings.branch} from ${settings.gitUrl}"
-                            exit 1
-                          fi
-                          FLAKE_REF="git+${settings.gitUrl}?rev=$REV"
-                        fi
-
-                        TMPFILE=$(mktemp)
-                        trap 'rm -f "$TMPFILE"' EXIT
-
-                        printf '%s' "$FLAKE_REF" > "$TMPFILE"
-
-                        NETWORK_ID="${config.clan.core.vars.generators.data-mesher-network.files."network.pub".path}"
-
-                        data-mesher file update "$TMPFILE" \
-                          --url http://localhost:7331 \
-                          --network-id "$NETWORK_ID" \
-                          --key "$KEY" \
-                          --name "dm_pull_deploy/target"
-
-                        echo "Deployment target pushed: $FLAKE_REF"
-                      '';
-                  })
-                ];
-              }
-            )
-          ];
-          roles.default.tags = [ "dm-pull-deploy" ];
-          roles.default.settings.action = "switch";
-        };
-
-        sshd = {
-          roles.server.tags."all" = { };
-          roles.server.settings = {
-            authorizedKeys = {
-              "berwn" = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAB/raxJR8gASmquP63weHelbi+da2WBJR1DgzHPNz/f";
-              "davhau" = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDuhpzDHBPvn8nv8RH1MRomDOaXyP4GziQm7r3MZ1Syk";
-              "kurogeek" =
-                "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEcZ/p1Ofa9liwIzPWzNtONhJ7+FUWd2lCz33r81t8+w kurogeek@kurogeek";
-              "matthewcroughan" =
-                "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIOJDRQfb1+7VK5tOe8W40iryfBWYRO6Uf1r2viDjmsJtAAAABHNzaDo=";
-              "matthewcroughan-1" =
-                "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIDgsWq+G/tcr6eUQYT7+sJeBtRmOMabgFiIgIV44XNc6AAAABHNzaDo=";
-              "matthewcroughan-2" =
-                "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIJMi3TAuwDtIeO4MsORlBZ31HzaV5bji1fFBPcC9/tWuAAAABHNzaDo=";
-            };
-          };
-        };
-
-        root-password = {
-          module = {
-            name = "users";
             input = "clan-core";
           };
           roles.default.tags."all" = { };
-          roles.default.settings = {
+          roles.default.settings.allowedKeys = {
-            user = "root";
+            "kurogeek" =
+              "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEcZ/p1Ofa9liwIzPWzNtONhJ7+FUWd2lCz33r81t8+w kurogeek@kurogeek";
           };
         };
 
-        tor = {
+        pocket-id = {
           module = {
-            name = "tor";
+            name = "pocket-id";
-            input = "clan-core";
-          };
-          roles.server.tags."nixos" = { };
-        };
-
-        w-network = {
-          module = {
-            name = "zerotier";
-            input = "clan-core";
-          };
-          roles.controller.machines."sirius" = {
-            settings.allowedIps = [
-              #kurogeek
-              "fdfe:7bf:a795:4524:4c99:932b:d36d:b8cc"
-            ];
-          };
-          roles.peer.tags.w = { };
-        };
-
-        glom-network = {
-          module = {
-            name = "zerotier";
-            input = "clan-core";
-          };
-          roles.controller.machines."vega" = {
-            settings.allowedIds = [
-              "dbe44c0287" # Alex-gateway
-              "b0e0b84fd3" # Alex
-              "2bd36db8cc" # kurogeek-thinkpad
-            ];
-          };
-          roles.peer.tags.glom = { };
-        };
-
-        b4l-network = {
-          module = {
-            name = "zerotier";
-            input = "clan-core";
-          };
-          roles.controller.machines."rigel" = {
-            settings.allowedIds = [
-              "dbe44c0287" # Alex-gateway
-              "b0e0b84fd3" # Alex
-              "2bd36db8cc" # kurogeek-thinkpad
-            ];
-          };
-          roles.peer.tags.b4l = { };
-        };
-
-        poy-network = {
-          module = {
-            name = "zerotier";
-            input = "clan-core";
-          };
-          roles.controller.machines."deneb" = {
-            settings.allowedIps = [
-              #kurogeek
-              "fdfe:7bf:a795:4524:4c99:932b:d36d:b8cc"
-            ];
-          };
-          roles.peer.tags."poy" = { };
-        };
-
-        internet = {
-          module.name = "internet";
-          roles.default.machines = {
-            ramus.settings.host = "5.223.63.55";
-            tangra.settings.host = "5.223.65.50";
-          };
-        };
-
-        yggdrasil-global-network = {
-          module = {
-            name = "yggdrasil";
-            input = "clan-core";
-          };
-          roles.default.tags."all" = { };
-          roles.default.settings.extraYggdrasilIPs = [
-            # kurogeek's laptop
-            "200:c8db:ea9b:5bdc:44ed:ad87:462a:6bd0"
-          ];
-          roles.default.settings.extraPeers = [
-            "tls://ygg.jjolly.dev:3443"
-            "tls://[2602:fc24:18:7a42::1]:993"
-            "tcp://leo.node.3dt.net:9002"
-            "tcp://ygg-kcmo.incognet.io:8883"
-          ];
-        };
-
-        newedge-headscale = {
-          module = {
-            name = "headscale";
             input = "self";
           };
-          roles.server.machines."alasia".settings = {
+          roles.default.machines.b4l = { };
-            public_url = "tailvpn.public.newedge.house";
-            advertise_routes = [ "10.0.10.0/24" ];
-            dns = {
-              magic_dns = true;
-              base_domain = "tailvpn.newedge.house";
-              nameservers = [
-                "10.0.10.82"
-                "1.1.1.1"
-                "8.8.8.8"
-              ];
-              extra_records = [
-                {
-                  name = "poyerp.newedge.house";
-                  type = "A";
-                  value = "10.0.10.1";
-                }
-                {
-                  name = "glomerp.newedge.house";
-                  type = "A";
-                  value = "10.0.10.1";
-                }
-              ];
-            };
-          };
         };
-
+        nextcloud = {
-        phonebox = {
           module = {
-            name = "phonebox";
+            name = "nextcloud";
             input = "self";
           };
-          roles.default.tags."phonebox" = { };
+          roles.default.machines.b4l = { };
-          roles.default.machines."adhil".settings = {
-            ata-ethernet-iface = "end0";
-          };
-          roles.default.machines."rigel".settings = {
-            extraClientNumbers = [
-              "01"
-              "02"
-            ];
-            extraFixedIPClient = { };
-          };
-        };
 
-        pulse-stream = {
+        };
+        stirling-pdf = {
           module = {
-            name = "pulse-stream";
+            name = "stirling-pdf";
             input = "self";
           };
-          roles.default.machines.neptune = {
+          roles.default.machines.b4l = { };
-            settings.client-ip-ranges = [
-              "10.0.0.0/24"
-            ];
-          };
         };
-        jukebox = {
+        actual-budget = {
           module = {
-            name = "jukebox";
+            name = "actual-budget";
             input = "self";
           };
-          roles.default.machines.neptune = {
+          roles.default.machines.b4l = { };
-            settings = {
-              binds = [ "wlp1s0" ];
-              disks.m3 = {
-                uuid = "105D-319E";
-                mountOptions = [ "utf8" ];
-              };
-            };
-          };
         };
-        git-daemon = {
+        victoriametrics = {
           module = {
-            name = "git-daemon";
+            name = "victoriametrics";
             input = "self";
           };
-          roles.default.machines.neptune = {
+          roles.default.machines.b4l = { };
-            settings.repositories =
-              let
-                defaults = rec {
-                  write-access = [
-                    "10.0.0.0/24"
-                    "200:d7b1:c5d5:ea7:27ad:6837:40f6:404d/128"
-                  ];
-                  read-access = write-access;
-                };
-                PUBLIC = {
-                  read-access = [
-                    "10.0.0.0/24"
-                    "0200::/7"
-                  ];
-                };
-              in
-              builtins.mapAttrs (_: override: defaults // override) {
-                "9e" = PUBLIC;
-                archive-dl = { };
-                barrytown = { };
-                cleanroom = PUBLIC;
-                community-memory = { };
-                eris = { };
-                ftdi-sd-spi = { };
-                go-go-gadget = { };
-                hacking-the-kindle = { };
-                islands = PUBLIC;
-                kt = { };
-                legba = { };
-                llb = PUBLIC;
-                llc = PUBLIC;
-                lora = { };
-                mute = { };
-                navi = { };
-                notmuch-memoryhole = PUBLIC;
-                pms5003 = { };
-                thinc = PUBLIC;
-                toad = { };
-                yggdrasil-erlang = { };
-              };
-          };
         };
-
+        vikunja = {
-        samba = {
           module = {
-            name = "samba";
+            name = "vikunja";
             input = "self";
           };
-          roles.server.machines."sirius".settings = {
+          roles.default.machines.b4l = { };
-            globalUsers = {
-              w.writePerm = true;
-            };
-            sharedFolders = {
-              WHITEHOUSE = {
-                allowedGuest = true;
-              };
-            };
-            dataDir = "/mnt/hdd/samba";
-          };
         };
-
+        grafana = {
-        wordpress = {
           module = {
-            name = "wordpress";
+            name = "grafana";
             input = "self";
           };
-          roles.server.machines."tangra".settings = {
+          roles.default.machines.b4l = { };
-            tenants = [
-              "poyfestival.com"
-            ];
-            phpfpmOptions = ''
-              upload_max_filesize=64M
-              post_max_size=128M
-            '';
-            wpExtraConfig = ''
-              define('WP_MEMORY_LIMIT', '256M');
-              define('WP_DEBUG', false);
-              define('WP_DEBUG_DISPLAY', false);
-              define('WP_DEBUG_LOG', false);
-            '';
-          };
         };
-
+        pingvin = {
-        prometheus-monitoring = {
           module = {
-            name = "prometheus";
+            name = "pingvin";
             input = "self";
           };
-          roles.server.machines."cursa".settings = {
+          roles.default.machines.b4l = { };
-            matrix-alertmanager = {
-              enable = true;
-              homeserverUrl = "https://matrix-client.matrix.org";
-              matrixUser = "@nixapollo:matrix.org";
-              matrixRooms = [
-                {
-                  receivers = [
-                    "matrix"
-                  ];
-                  roomId = "!rqIrWqPvsXqMgYpcNZ:matrix.org";
-                }
-              ];
-            };
-          };
-
-          roles.nodes.machines = {
-            vega.settings = {
-              exporters.smartctl = { };
-              exporters.zfs = { };
-            };
-            rigel.settings = {
-              exporters.smartctl = { };
-            };
-            sirius.settings = {
-              exporters.smartctl = { };
-              exporters.zfs = { };
-            };
-            buna.settings = {
-              exporters.smartctl = { };
-            };
-            mirach.settings = {
-              exporters.smartctl = { };
-            };
-            almach.settings = {
-              exporters.smartctl = { };
-            };
-          };
         };
-
+        paperless = {
-        wifi =
+          module = {
-          let
+            name = "paperless";
-            networks = {
+            input = "self";
-              home = { };
-              glom = { };
-            };
-          in
-          {
-            module.name = "wifi";
-            module.input = "clan-community";
-
-            roles.default = {
-              machines."buna".settings = { inherit networks; };
-
-              extraModules = [
-                (
-                  { lib, ... }:
-                  {
-                    # profile names match the network attr names above;
-                    # 0 = retry forever for both (defaults: 4 autoconnect attempts, 3 auth attempts)
-                    networking.networkmanager.ensureProfiles.profiles = lib.mapAttrs (_: _: {
-                      connection.autoconnect-retries = 0;
-                      connection.auth-retries = 0;
-                    }) networks;
-                  }
-                )
-              ];
-            };
           };
-
+          roles.default.machines.b4l = { };
+        };
+        gitea = {
+          module = {
+            name = "gitea";
+            input = "self";
+          };
+          roles.default.machines.b4l = { };
+        };
       };
     };
   };

inventories/emmie.nix

@@ -1,43 +0,0 @@
-{ config, ... }:
-let
-  username = "emmie";
-  userhome = "/home/${username}";
-in
-{
-  clan.inventory = {
-    tags = {
-      emmie = [ "rana" ];
-    };
-
-    instances = {
-      emmie-syncthing = {
-        module = {
-          name = "syncthing";
-          input = "clan-core";
-        };
-        roles.peer.tags.emmie = { };
-        roles.peer.settings = {
-          folders = {
-            Syncthing.path = "${userhome}/Share/Syncthing";
-            Desktop.path = "${userhome}/Desktop";
-          };
-          extraDevices = {
-            pixel7a = {
-              id = "CEUJMEG-SOHXIJF-G2FT5QB-6MZW3EN-PONI3QN-HPEIOSU-IMSLGW7-XUU6BQK";
-              name = "eris";
-              addresses = [ "dynamic" ];
-            };
-          };
-        };
-        roles.peer.extraModules = [
-          {
-            config.services.syncthing = {
-              user = username;
-              dataDir = "${userhome}/Share";
-            };
-          }
-        ];
-      };
-    };
-  };
-}

inventories/personal-computer.nix

@@ -1,50 +0,0 @@
-{
-  clan.inventory = {
-    tags = {
-      kde-desktop = [
-        "rana"
-        "petra"
-      ];
-      personal-computer = [
-        "rana"
-        "petra"
-      ];
-    };
-
-    instances = {
-      emmie-home = {
-        module = {
-          name = "emmie-home";
-          input = "self";
-        };
-        roles.default.machines."rana" = { };
-      };
-      chocolate-home = {
-        module = {
-          name = "home-user";
-          input = "self";
-        };
-        roles.default.settings = {
-          username = "chocolate";
-          kbLayout = "us,th";
-          kbOptions = "grp:win_space_toggle,grp:alt_shift_toggle";
-        };
-        roles.default.machines."petra" = { };
-      };
-      personal-computer = {
-        module = {
-          name = "personal-computer";
-          input = "self";
-        };
-        roles.default.tags."personal-computer" = { };
-      };
-      kde = {
-        module = {
-          name = "kde";
-          input = "clan-core";
-        };
-        roles.default.tags."kde-desktop" = { };
-      };
-    };
-  };
-}

inventories/router.nix

@@ -1,88 +0,0 @@
-# Site gateways: the `router` clan service from cnx-network-clan (see
-# flake.nix input `cnx-network`, and that repo's modules/clan/router/README.md).
-# One instance for the fleet; each site adds its gateway machine with the
-# site's port / VLAN layout. `clan vars generate <gw>` then prompts for the
-# PPPoE username/password.
-{ lib, ... }:
-let
-  # Admin mesh = the site's ZeroTier network. The service only opens SSH,
-  # metrics and iperf3 to this prefix, so the gateway must also be a peer of
-  # the same network (tag membership in default.nix). Prefix derivation as in
-  # cnx-network's modules/mesh-hosts.nix: fd + 8-byte network id + 0x9993,
-  # /88 covers every peer.
-  meshSubnet =
-    instance:
-    let
-      networkId = lib.fileContents ../vars/shared/zerotier-network-${instance}/network-id/value;
-      full = "fd" + networkId + "9993";
-      hextet = i: builtins.substring (i * 4) 4 full;
-    in
-    "${hextet 0}:${hextet 1}:${hextet 2}:${hextet 3}:${hextet 4}:${builtins.substring 20 2 full}00::/88";
-in
-{
-  clan.inventory.instances.router = {
-    module = {
-      name = "router";
-      input = "cnx-network";
-    };
-
-    roles.default.settings.mesh.subnet = meshSubnet "w-network";
-
-    # stellio: GL.iNet Flint 2 (GL-MT6000, MT7986a). Ports as named by the
-    # device tree in matthew-hardware: eth1 = the 2.5G "WAN" port, lan1 = the
-    # 2.5G LAN port, lan2-lan5 = the 1G LAN ports (DSA on the MT7531 switch).
-    roles.default.machines.stellio.settings = {
-      site = "white-house";
-      siteId = 8;
-
-      # PPPoE on the ISP's VLAN 10, as on the liminix router it replaces
-      # (routers/white-house); set to null if the ISP runs PPPoE untagged.
-      wan.interface = "end1";
-      wan.vlanId = 10;
-
-      # lan1 (2.5G): untagged mgmt port for on-site recovery. lan2-lan4 (1G):
-      # untagged client ports on lan. lan5 is the pre-cutover staging uplink:
-      # DHCP client into the old LAN (routers/white-house), SSH only, no VLAN
-      # membership; set stagingPort = null at cutover.
-      accessPorts = {
-        lan1 = "mgmt";
-        lan2 = "lan";
-        lan3 = "lan";
-        lan4 = "lan";
-      };
-      stagingPort = "lan5";
-
-      # Both MT7976 radios broadcast the site SSID (same name and passphrase
-      # as the liminix router's "WhiteHouse"/"WhiteHouse-5", merged into one
-      # dual-band SSID) as an untagged access port on lan. Passphrase is the
-      # `wifi-WhiteHouse-passphrase` vars prompt. Channels as on the old
-      # router. Check the band mapping with `iw phy` (mt7986: phy0/wlan0 =
-      # 2.4 GHz, phy1/wlan1 = 5 GHz).
-      wifi = {
-        enable = true;
-        countryCode = "TH";
-        networks.WhiteHouse.vlan = "lan";
-        radios = {
-          wlan0 = {
-            band = "2g";
-            channel = 2;
-            wifi6 = true;
-            networks = [ "WhiteHouse" ];
-          };
-          wlan1 = {
-            band = "5g";
-            channel = 36;
-            wifi6 = true;
-            networks = [ "WhiteHouse" ];
-          };
-        };
-      };
-
-      # 10.1.<id>.0/24, router .1, DHCP pool .100-.199.
-      vlans = {
-        mgmt.id = 10;
-        lan.id = 20;
-      };
-    };
-  };
-}

inventory.json

@@ -1,58 +1 @@
-{
+{}
-  "machines": {
-    "ramus": {
-      "installedAt": 1764139649
-    },
-    "alpheratz": {
-      "installedAt": 1764741499
-    },
-    "mirach": {
-      "installedAt": 1764744666
-    },
-    "almach": {
-      "installedAt": 1764745787
-    },
-    "neptune": {
-      "installedAt": 1762147067
-    },
-    "adhil": {
-      "installedAt": 1765277591
-    },
-    "buna": {
-      "installedAt": 1787123510
-    },
-    "rana": {
-      "installedAt": 1773134236
-    },
-    "petra": {
-      "installedAt": 1769064458
-    },
-    "sirius": {
-      "installedAt": 1770974584
-    },
-    "deneb": {
-      "installedAt": 1775718970
-    },
-    "canopus": {
-      "installedAt": 1775793532
-    },
-    "hadar": {
-      "installedAt": 1774427255
-    },
-    "procyon": {
-      "installedAt": 1775458442
-    },
-    "alasia": {
-      "installedAt": 1778661666
-    },
-    "bosona": {
-      "installedAt": 1779098893
-    },
-    "tangra": {
-      "installedAt": 1779958921
-    },
-    "cursa": {
-      "installedAt": 1782187627
-    }
-  }
-}

lib/auto-accept-zerotier-members.nix

@@ -1,21 +0,0 @@
-{
-  memberIds,
-}:
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-{
-  systemd.services.zerotier-accept-external = {
-    wantedBy = [ "multi-user.target" ];
-    after = [ "zerotierone.service" ];
-    path = [ config.clan.core.clanPkgs.zerotierone ];
-    serviceConfig.ExecStart = pkgs.writeShellScript "zerotier-inventory-autoaccept" ''
-      ${lib.concatMapStringsSep "\n" (zerotier-id: ''
-        ${config.clan.core.clanPkgs.zerotier-members}/bin/zerotier-members allow ${zerotier-id}
-      '') memberIds}
-    '';
-  };
-}

machines/adhil/configuration.nix

@@ -1,14 +0,0 @@
-{ ... }:
-{
-  nixpkgs.hostPlatform = {
-    system = "aarch64-linux";
-  };
-  system.stateVersion = "25.11";
-  clan.core.sops.defaultGroups = [ "admins" ];
-  # clan.core.networking.targetHost = "root@";
-
-  clan.core.settings.name = "adhil";
-  clan.core.settings.machine.description =
-    "Raspberry Pi 4 SBC board for one of w phone network. (With w office)";
-
-}

machines/adhil/disko.nix

@@ -1,56 +0,0 @@
-{ ... }:
-let
-  hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
-  os = "/dev/disk/by-id/mmc-SD64G_0xfb330ff6";
-in
-{
-
-  boot.loader = {
-    systemd-boot = {
-      enable = true;
-    };
-    efi = {
-      canTouchEfiVariables = true;
-    };
-  };
-
-  disko.devices = {
-    disk = {
-      "os-${hashDisk os}" = {
-        type = "disk";
-        device = os;
-        content = {
-          type = "gpt";
-          partitions = {
-            ESP = {
-              end = "500M";
-              type = "EF00";
-              content = {
-                type = "filesystem";
-                format = "vfat";
-                mountpoint = "/boot";
-                mountOptions = [ "umask=0077" ];
-              };
-            };
-            root = {
-              name = "root";
-              end = "-0";
-              content = {
-                type = "filesystem";
-                format = "f2fs";
-                mountpoint = "/";
-                extraArgs = [
-                  "-O"
-                  "extra_attr,inode_checksum,sb_checksum,compression"
-                ];
-                mountOptions = [
-                  "compress_algorithm=zstd:6,compress_chksum,atgc,gc_merge,lazytime,nodiscard"
-                ];
-              };
-            };
-          };
-        };
-      };
-    };
-  };
-}

machines/alasia/configuration.nix

@@ -1,15 +0,0 @@
-{
-  clan.core.settings.machine.description = "VM machine to host headplane instance";
-
-  nixpkgs.hostPlatform = {
-    system = "x86_64-linux";
-  };
-
-  networking.firewall.allowedTCPPorts = [
-    80
-    443
-  ];
-
-  system.stateVersion = "25.11";
-  clan.core.sops.defaultGroups = [ "admins" ];
-}

machines/alasia/disko.nix

@@ -1,85 +0,0 @@
-let
-  hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
-  os = "/dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0";
-in
-{
-
-  boot.loader = {
-    systemd-boot = {
-      enable = true;
-    };
-    efi = {
-      canTouchEfiVariables = true;
-    };
-  };
-
-  boot.zfs.forceImportRoot = false;
-
-  disko.devices = {
-    disk = {
-      "os-${hashDisk os}" = {
-        type = "disk";
-        device = os;
-        content = {
-          type = "gpt";
-          partitions = {
-            ESP = {
-              size = "1G";
-              type = "EF00";
-              content = {
-                type = "filesystem";
-                format = "vfat";
-                mountpoint = "/boot";
-                mountOptions = [ "nofail" ];
-              };
-            };
-            system = {
-              size = "100%";
-              content = {
-                type = "zfs";
-                pool = "zroot";
-              };
-            };
-          };
-        };
-      };
-    };
-    zpool = {
-      zroot = {
-        type = "zpool";
-        rootFsOptions = {
-          mountpoint = "none";
-          compression = "lz4";
-          acltype = "posixacl";
-          xattr = "sa";
-          "com.sun:auto-snapshot" = "true";
-        };
-        options.ashift = "12";
-        datasets = {
-          "root" = {
-            type = "zfs_fs";
-            options.mountpoint = "none";
-          };
-          "root/nixos" = {
-            type = "zfs_fs";
-            options.mountpoint = "/";
-            mountpoint = "/";
-          };
-          "root/home" = {
-            type = "zfs_fs";
-            options.mountpoint = "/home";
-            mountpoint = "/home";
-          };
-          "root/tmp" = {
-            type = "zfs_fs";
-            mountpoint = "/tmp";
-            options = {
-              mountpoint = "/tmp";
-              sync = "disabled";
-            };
-          };
-        };
-      };
-    };
-  };
-}

machines/almach/configuration.nix

@@ -1,13 +0,0 @@
-{ config, ... }:
-{
-  nixpkgs.hostPlatform = {
-    system = "x86_64-linux";
-  };
-  system.stateVersion = "25.11";
-  clan.core.sops.defaultGroups = [ "admins" ];
-  # clan.core.networking.targetHost = "root@";
-
-  clan.core.settings.name = "almach";
-  clan.core.settings.machine.description = "Radxa X4 SBC board for one of w phone network.";
-
-}

machines/almach/disko.nix

@@ -1,92 +0,0 @@
-{ ... }:
-let
-  hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
-  os = "/dev/disk/by-id/mmc-CUTB42_0x95d64f17";
-in
-{
-
-  boot.loader = {
-    systemd-boot = {
-      enable = true;
-    };
-    efi = {
-      canTouchEfiVariables = true;
-    };
-  };
-
-  boot.zfs.forceImportRoot = true;
-
-  disko.devices = {
-    disk = {
-      "os-${hashDisk os}" = {
-        type = "disk";
-        device = os;
-        content = {
-          type = "gpt";
-          partitions = {
-            ESP = {
-              size = "1G";
-              type = "EF00";
-              content = {
-                type = "filesystem";
-                format = "vfat";
-                mountpoint = "/boot";
-                mountOptions = [ "nofail" ];
-              };
-            };
-            system = {
-              size = "100%";
-              content = {
-                type = "zfs";
-                pool = "zroot";
-              };
-            };
-            swap = {
-              size = "4G";
-              content = {
-                type = "swap";
-              };
-            };
-          };
-        };
-      };
-    };
-    zpool = {
-      zroot = {
-        type = "zpool";
-        rootFsOptions = {
-          mountpoint = "none";
-          compression = "lz4";
-          acltype = "posixacl";
-          xattr = "sa";
-          "com.sun:auto-snapshot" = "true";
-        };
-        options.ashift = "12";
-        datasets = {
-          "root" = {
-            type = "zfs_fs";
-            options.mountpoint = "none";
-          };
-          "root/nixos" = {
-            type = "zfs_fs";
-            options.mountpoint = "/";
-            mountpoint = "/";
-          };
-          "root/home" = {
-            type = "zfs_fs";
-            options.mountpoint = "/home";
-            mountpoint = "/home";
-          };
-          "root/tmp" = {
-            type = "zfs_fs";
-            mountpoint = "/tmp";
-            options = {
-              mountpoint = "/tmp";
-              sync = "disabled";
-            };
-          };
-        };
-      };
-    };
-  };
-}

machines/alpheratz/configuration.nix

@@ -1,13 +0,0 @@
-{ config, ... }:
-{
-  nixpkgs.hostPlatform = {
-    system = "x86_64-linux";
-  };
-  system.stateVersion = "25.11";
-  clan.core.sops.defaultGroups = [ "admins" ];
-  # clan.core.networking.targetHost = "root@";
-
-  clan.core.settings.name = "alpheratz";
-  clan.core.settings.machine.description = "Radxa X4 SBC board for one of w phone network.";
-
-}

machines/alpheratz/disko.nix

@@ -1,92 +0,0 @@
-{ ... }:
-let
-  hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
-  os = "/dev/disk/by-id/mmc-CUTB42_0xaedcfa8b";
-in
-{
-
-  boot.loader = {
-    systemd-boot = {
-      enable = true;
-    };
-    efi = {
-      canTouchEfiVariables = true;
-    };
-  };
-
-  boot.zfs.forceImportRoot = true;
-
-  disko.devices = {
-    disk = {
-      "os-${hashDisk os}" = {
-        type = "disk";
-        device = os;
-        content = {
-          type = "gpt";
-          partitions = {
-            ESP = {
-              size = "1G";
-              type = "EF00";
-              content = {
-                type = "filesystem";
-                format = "vfat";
-                mountpoint = "/boot";
-                mountOptions = [ "nofail" ];
-              };
-            };
-            system = {
-              size = "100%";
-              content = {
-                type = "zfs";
-                pool = "zroot";
-              };
-            };
-            swap = {
-              size = "4G";
-              content = {
-                type = "swap";
-              };
-            };
-          };
-        };
-      };
-    };
-    zpool = {
-      zroot = {
-        type = "zpool";
-        rootFsOptions = {
-          mountpoint = "none";
-          compression = "lz4";
-          acltype = "posixacl";
-          xattr = "sa";
-          "com.sun:auto-snapshot" = "true";
-        };
-        options.ashift = "12";
-        datasets = {
-          "root" = {
-            type = "zfs_fs";
-            options.mountpoint = "none";
-          };
-          "root/nixos" = {
-            type = "zfs_fs";
-            options.mountpoint = "/";
-            mountpoint = "/";
-          };
-          "root/home" = {
-            type = "zfs_fs";
-            options.mountpoint = "/home";
-            mountpoint = "/home";
-          };
-          "root/tmp" = {
-            type = "zfs_fs";
-            mountpoint = "/tmp";
-            options = {
-              mountpoint = "/tmp";
-              sync = "disabled";
-            };
-          };
-        };
-      };
-    };
-  };
-}

machines/b4l/configuration.nix

@@ -0,0 +1,21 @@
+{ inputs, config, ... }:
+{
+  imports = [
+    (inputs.import-tree ./services)
+  ];
+  nixpkgs.hostPlatform = {
+    system = "x86_64-linux";
+  };
+  boot.loader.grub.devices = [ "/dev/disk/by-id/FIXME" ];
+  fileSystems = {
+    "/".device = "/dev/FIXME";
+  };
+  networking.fqdn = "b4l.co.th";
+  system.stateVersion = "25.11";
+
+  security.acme.defaults.email = "admin@b4l.co.th";
+  security.acme.acceptTerms = true;
+  services.nginx.virtualHosts."${config.networking.fqdn}" = {
+    enableACME = true;
+  };
+}

machines/b4l/services/actual-budget.nix

@@ -0,0 +1,36 @@
+{ config, ... }:
+let
+  abDomain = "${config.clan.core.vars.generators.b4l-actual-budget.files.subdomain.value}.${config.networking.fqdn}";
+in
+{
+  clan.core.vars.generators.b4l-actual-budget = {
+    files.subdomain.secret = false;
+
+    prompts = {
+      subdomain = {
+        persist = true;
+        type = "line";
+        description = "Sub-domain for Actual Budget app. Default:(budget)";
+      };
+    };
+
+    script = ''cat $prompts/subdomain || echo -n "budget" > $out/subdomain'';
+  };
+
+  services.actual = {
+    settings = {
+      allowedLoginMethods = [
+        "password"
+        "openid"
+      ];
+      trustedProxies = [ "127.0.0.1" ];
+    };
+  };
+  services.nginx.virtualHosts."${abDomain}" = {
+    useACMEHost = "${config.networking.fqdn}";
+    forceSSL = true;
+    locations."/" = {
+      proxyPass = "http://localhost:${builtins.toString config.services.actual.settings.port}";
+    };
+  };
+}

machines/b4l/services/gitea.nix

@@ -0,0 +1,2 @@
+{
+}

machines/b4l/services/grafana.nix

@@ -0,0 +1,79 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}:
+with lib;
+let
+  serviceName = "${config.networking.hostName}-grafana";
+  gfDomain = "${
+    config.clan.core.vars.generators."${serviceName}".files.subdomain.value
+  }.${config.networking.fqdn}";
+
+  settingsFormatIni = pkgs.formats.ini {
+    listToValue = concatMapStringsSep " " (generators.mkValueStringDefault { });
+    mkKeyValue = generators.mkKeyValueDefault {
+      mkValueString = v: if v == null then "" else generators.mkValueStringDefault { } v;
+    } "=";
+  };
+  configFile = settingsFormatIni.generate "config.ini" config.services.grafana.settings;
+in
+{
+  clan.core.vars.generators."${serviceName}" = {
+    files = {
+      adminpassword.secret = true;
+      subdomain.secret = false;
+    };
+    prompts = {
+      subdomain = {
+        persist = true;
+        type = "line";
+        description = "Sub-domain for Grafana. Default:(grafana)";
+      };
+      adminpassword = {
+        persist = true;
+        type = "hidden";
+        description = "Password for the admin user. Leave empty to auto-generate.";
+      };
+    };
+
+    runtimeInputs = [
+      pkgs.xkcdpass
+      pkgs.coreutils
+    ];
+
+    script = ''
+      prompt_domain=$(cat "$prompts"/subdomain)
+      if [[ -n "''${prompt_domain-}" ]]; then
+        echo $prompt_domain | tr -d "\n" > "$out"/subdomain
+      else
+        echo -n "grafana" > "$out"/subdomain
+      fi
+
+      prompt_password=$(cat "$prompts"/adminpassword)
+      if [[ -n "''${prompt_password-}" ]]; then
+        echo "$prompt_password" | tr -d "\n" > "$out"/adminpassword
+      else
+        xkcdpass --numwords 4 --delimiter - --count 1 | tr -d "\n" > "$out"/adminpassword
+      fi
+    '';
+  };
+
+  systemd.services.grafana.serviceConfig.ExecStartPre = [
+    "+${pkgs.writeShellScript "grafana-set-password" ''
+      ${pkgs.grafana}/bin/grafana cli --homepath ${config.services.grafana.dataDir} --config ${configFile} admin reset-admin-password $(cat ${
+        config.clan.core.vars.generators."${serviceName}".files.adminpassword.path
+      })
+    ''}"
+  ];
+
+  services.nginx.virtualHosts."${gfDomain}" = {
+    forceSSL = true;
+    useACMEHost = "${config.networking.fqdn}";
+    locations."/" = {
+      proxyPass = "http://localhost:${builtins.toString config.services.grafana.settings.server.http_port}";
+    };
+  };
+
+}

machines/b4l/services/nextcloud.nix

@@ -0,0 +1,35 @@
+{ config, pkgs, ... }:
+let
+  ncDomain = "${config.clan.core.vars.generators.b4l-nextcloud.files.subdomain.value}.${config.networking.fqdn}";
+in
+{
+  clan.core.vars.generators.b4l-nextcloud = {
+    files.subdomain.secret = false;
+
+    prompts = {
+      subdomain = {
+        persist = true;
+        type = "line";
+        description = "Sub-domain for Nextcloud app. Default:(cloud)";
+      };
+    };
+
+    script = ''cat $prompts/subdomain || echo -n "cloud" > $out/subdomain'';
+  };
+
+  services.nextcloud = {
+    hostName = ncDomain;
+    package = pkgs.nextcloud31;
+
+    settings = {
+
+      overwriteprotocol = "https";
+      trusted_domains = [ ];
+      trusted_proxies = [ ];
+    };
+  };
+  services.nginx.virtualHosts."${ncDomain}" = {
+    useACMEHost = "${config.networking.fqdn}";
+    forceSSL = true;
+  };
+}

machines/b4l/services/paperless.nix

@@ -0,0 +1,67 @@
+{ config, pkgs, ... }:
+let
+  serviceName = "${config.networking.hostName}-paperless";
+  domain-name = "${
+    config.clan.core.vars.generators."${serviceName}".files.subdomain.value
+  }.${config.networking.fqdn}";
+in
+{
+  clan.core.vars.generators."${serviceName}" = {
+    files = {
+      subdomain.secret = false;
+      adminpassword = {
+        secret = true;
+        owner = config.services.paperless.user;
+        group = config.services.paperless.user;
+      };
+    };
+    prompts = {
+      subdomain = {
+        persist = true;
+        type = "line";
+        description = "Sub-domain for Paperless. Default:(paperless)";
+      };
+      adminpassword = {
+        persist = true;
+        type = "hidden";
+        description = "Password for the admin user. Leave empty to auto-generate.";
+      };
+    };
+
+    runtimeInputs = [
+      pkgs.xkcdpass
+      pkgs.coreutils
+    ];
+
+    script = ''
+      prompt_domain=$(cat "$prompts"/subdomain)
+      if [[ -n "''${prompt_domain-}" ]]; then
+        echo $prompt_domain | tr -d "\n" > "$out"/subdomain
+      else
+        echo -n "paperless" > "$out"/subdomain
+      fi
+
+      prompt_password=$(cat "$prompts"/adminpassword)
+      if [[ -n "''${prompt_password-}" ]]; then
+        echo "$prompt_password" | tr -d "\n" > "$out"/adminpassword
+      else
+        xkcdpass --numwords 4 --delimiter - --count 1 | tr -d "\n" > "$out"/adminpassword
+      fi
+    '';
+  };
+
+  environment.systemPackages = [ pkgs.toybox ];
+
+  services.paperless = {
+    passwordFile = config.clan.core.vars.generators."${serviceName}".files.adminpassword.path;
+  };
+
+  services.nginx.virtualHosts."${domain-name}" = {
+    forceSSL = true;
+    useACMEHost = "${config.networking.fqdn}";
+    locations."/" = {
+      proxyPass = "http://localhost:${builtins.toString config.services.paperless.port}";
+    };
+  };
+
+}

machines/b4l/services/pingvin.nix

@@ -0,0 +1,45 @@
+{
+  pkgs,
+  config,
+  ...
+}:
+let
+  serviceName = "${config.networking.hostName}-pingvin";
+  domain-name = "${
+    config.clan.core.vars.generators."${serviceName}".files.subdomain.value
+  }.${config.networking.fqdn}";
+in
+{
+  clan.core.vars.generators."${serviceName}" = {
+    files = {
+      subdomain.secret = false;
+    };
+    prompts = {
+      subdomain = {
+        persist = true;
+        type = "line";
+        description = "Sub-domain for Pingvin. Default:(share)";
+      };
+    };
+
+    runtimeInputs = [
+      pkgs.xkcdpass
+      pkgs.coreutils
+    ];
+
+    script = ''
+      prompt_domain=$(cat "$prompts"/subdomain)
+      if [[ -n "''${prompt_domain-}" ]]; then
+        echo $prompt_domain | tr -d "\n" > "$out"/subdomain
+      else
+        echo -n "share" > "$out"/subdomain
+      fi
+    '';
+  };
+
+  services.pingvin-share = {
+    nginx.enable = true;
+    https = true;
+    hostname = domain-name;
+  };
+}

machines/b4l/services/pocket-id.nix

@@ -0,0 +1,35 @@
+{ config, ... }:
+let
+  pidDomain = "${config.clan.core.vars.generators.b4l-pocket-id.files.subdomain.value}.${config.networking.fqdn}";
+in
+{
+  clan.core.vars.generators.b4l-pocket-id = {
+    files.subdomain.secret = false;
+
+    prompts = {
+      subdomain = {
+        persist = true;
+        type = "line";
+        description = "Sub-domain for Pocket-ID app. Default:(auth)";
+      };
+    };
+
+    script = ''cat $prompts/subdomain || echo -n "auth" > $out/subdomain'';
+  };
+
+  services.pocket-id = {
+    settings = {
+      APP_ENV = "production";
+      APP_URL = "https://${pidDomain}";
+      TRUST_PROXY = true;
+    };
+  };
+
+  services.nginx.virtualHosts."${pidDomain}" = {
+    useACMEHost = "${config.networking.fqdn}";
+    forceSSL = true;
+    locations."/" = {
+      proxyPass = "http://localhost:${builtins.toString config.services.pocket-id.settings.PORT}";
+    };
+  };
+}

machines/b4l/services/stirling-pdf.nix

@@ -0,0 +1,26 @@
+{ config, ... }:
+let
+  stDomain = "${config.clan.core.vars.generators.b4l-stirling-pdf.files.subdomain.value}.${config.networking.fqdn}";
+in
+{
+  clan.core.vars.generators.b4l-stirling-pdf = {
+    files.subdomain.secret = false;
+
+    prompts = {
+      subdomain = {
+        persist = true;
+        type = "line";
+        description = "Sub-domain for Stirling PDF app. Default:(pdf)";
+      };
+    };
+    script = ''cat $prompts/subdomain || echo -n "pdf" > $out/subdomain'';
+  };
+
+  services.nginx.virtualHosts."${stDomain}" = {
+    forceSSL = true;
+    useACMEHost = "${config.networking.fqdn}";
+    locations."/" = {
+      proxyPass = "http://localhost:${builtins.toString config.services.stirling-pdf.environment.SERVER_PORT}";
+    };
+  };
+}

machines/b4l/services/victoriametrics.nix

@@ -0,0 +1,73 @@
+{ config, pkgs, ... }:
+let
+  vmDomain = "${config.clan.core.vars.generators.b4l-victoriametrics.files.subdomain.value}.${config.networking.fqdn}";
+in
+{
+  clan.core.vars.generators.b4l-victoriametrics = {
+    files.subdomain.secret = false;
+    files.adminuser.secret = false;
+    files.adminpassword.secret = true;
+
+    prompts = {
+      subdomain = {
+        persist = true;
+        type = "line";
+        description = "Sub-domain for Victoria Metrics app. Default:(metrics)";
+      };
+      adminuser = {
+        persist = true;
+        type = "line";
+        description = "Username for an admin user. Default:(admin)";
+      };
+      adminpassword = {
+        persist = true;
+        type = "hidden";
+        description = "Password for the admin user. Leave empty to auto-generate.";
+      };
+    };
+
+    runtimeInputs = [
+      pkgs.xkcdpass
+      pkgs.coreutils
+    ];
+
+    script = ''
+      prompt_domain=$(cat "$prompts"/subdomain)
+      if [[ -n "''${prompt_domain-}" ]]; then
+        echo $prompt_domain | tr -d "\n" > "$out"/subdomain
+      else
+        echo -n "metrics" > "$out"/subdomain
+      fi
+
+      prompt_adminuser=$(cat "$prompts"/adminuser)
+      if [[ -n "''${prompt_adminuser-}" ]]; then
+        echo $prompt_adminuser | tr -d "\n" > "$out"/adminuser
+      else
+        echo -n "admin" > "$out"/adminuser
+      fi
+
+      prompt_password=$(cat "$prompts"/adminpassword)
+      if [[ -n "''${prompt_password-}" ]]; then
+        echo "$prompt_password" | tr -d "\n" > "$out"/adminpassword
+      else
+        xkcdpass --numwords 4 --delimiter - --count 1 | tr -d "\n" > "$out"/adminpassword
+      fi
+    '';
+  };
+
+  services.victoriametrics = {
+    extraOptions = [
+      "-httpAuth.username=file://${config.clan.core.vars.generators.b4l-victoriametrics.files.adminuser.path}"
+      "-httpAuth.password=file://${config.clan.core.vars.generators.b4l-victoriametrics.files.adminpassword.path}"
+    ];
+  };
+
+  services.nginx.virtualHosts."${vmDomain}" = {
+    forceSSL = true;
+    useACMEHost = "${config.networking.fqdn}";
+    locations."/" = {
+      proxyPass = "http://localhost${builtins.toString config.services.victoriametrics.listenAddress}";
+    };
+  };
+
+}

machines/b4l/services/vikunja.nix

@@ -0,0 +1,26 @@
+{ config, ... }:
+{
+  clan.core.vars.generators.b4l-vikunja = {
+    files.subdomain.secret = false;
+
+    prompts = {
+      subdomain = {
+        persist = true;
+        type = "line";
+        description = "Sub-domain for Vikunja todo app. Default:(todo)";
+      };
+    };
+
+    script = ''cat $prompts/subdomain || echo "todo" > $out/subdomain'';
+  };
+  services.vikunja = {
+    frontendHostname = "${config.clan.core.vars.generators.b4l-vikunja.files.subdomain.value}.${config.networking.fqdn}";
+  };
+  services.nginx.virtualHosts."${config.services.vikunja.frontendHostname}" = {
+    useACMEHost = "${config.networking.fqdn}";
+    forceSSL = true;
+    locations."/" = {
+      proxyPass = "${config.services.vikunja.frontendScheme}://${config.services.vikunja.frontendHostname}:${builtins.toString config.services.vikunja.port}";
+    };
+  };
+}

machines/bosona/configuration.nix

@@ -1,105 +0,0 @@
-{
-  inputs,
-  pkgs,
-  config,
-  ...
-}:
-let
-  sitename = "tempoerp.newedge.house";
-in
-{
-  clan.core.settings.machine.description = "VM machine that host ERPNext for tempo";
-  imports = [
-    inputs.frappix.nixosModules.x86_64-linux.frappix
-  ];
-  nixpkgs.overlays = [
-    inputs.self.overlays.frappixFrappeOverlay
-    inputs.self.overlays.frappixLibsOverlay
-    inputs.self.overlays.frappixPythonOverlay
-    inputs.self.overlays.frappixToolsOverlay
-  ];
-
-  clan.core.vars.generators.frappix = {
-    files = {
-      sslCertificate.secret = false;
-      sslCertificateKey = {
-        owner = "nginx";
-        group = "nginx";
-        secret = true;
-      };
-      adminPassword.secret = true;
-    };
-    runtimeInputs = with pkgs; [
-      openssl
-      xkcdpass
-    ];
-    script = ''
-      openssl req -x509 -newkey rsa:4096 -keyout $out/sslCertificateKey -out $out/sslCertificate -sha256 -days 3650 -nodes -subj "/C=TH/ST=ChiangMai/L=ChiangMai/O=kurogeek/CN=kurogeek.home" 
-      xkcdpass --numwords 4 --delimiter - --count 1 | tr -d "\n" > "$out"/adminPassword
-    '';
-  };
-
-  services.frappe = {
-    enable = true;
-    project = "poyerp";
-    gunicorn_workers = 2;
-    adminPassword = config.clan.core.vars.generators.frappix.files.adminPassword.path;
-    apps = [
-      pkgs.frappix.erpnext
-      pkgs.frappix.hrms
-      pkgs.frappix.crm
-    ];
-    sites = {
-      "${sitename}" = {
-        domains = [ sitename ];
-        apps = [
-          "frappe"
-          "erpnext"
-          "hrms"
-          "crm"
-        ];
-      };
-    };
-  };
-  services.nginx.virtualHosts."${sitename}" = {
-    sslCertificate = config.clan.core.vars.generators.frappix.files.sslCertificate.path;
-    sslCertificateKey = config.clan.core.vars.generators.frappix.files.sslCertificateKey.path;
-  };
-
-  nixpkgs.hostPlatform = {
-    system = "x86_64-linux";
-  };
-
-  clan.core.vars.generators.nginx = {
-    files = {
-      sslCert = {
-        owner = "nginx";
-        group = "nginx";
-        secret = true;
-      };
-      sslKey = {
-        owner = "nginx";
-        group = "nginx";
-        secret = true;
-      };
-    };
-
-    runtimeInputs = [
-      pkgs.openssl
-    ];
-    script = ''
-      openssl req -x509 -nodes -days 3650 -newkey rsa:2048 \
-        -keyout $out/sslKey \
-        -out $out/sslCert \
-        -subj "/CN=localhost"
-    '';
-  };
-
-  networking.firewall.allowedTCPPorts = [
-    80
-    443
-  ];
-
-  system.stateVersion = "25.11";
-  clan.core.sops.defaultGroups = [ "admins" ];
-}

machines/bosona/disko.nix

@@ -1,85 +0,0 @@
-let
-  hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
-  os = "/dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0";
-in
-{
-
-  boot.loader = {
-    systemd-boot = {
-      enable = true;
-    };
-    efi = {
-      canTouchEfiVariables = true;
-    };
-  };
-
-  boot.zfs.forceImportRoot = true;
-
-  disko.devices = {
-    disk = {
-      "os-${hashDisk os}" = {
-        type = "disk";
-        device = os;
-        content = {
-          type = "gpt";
-          partitions = {
-            ESP = {
-              size = "1G";
-              type = "EF00";
-              content = {
-                type = "filesystem";
-                format = "vfat";
-                mountpoint = "/boot";
-                mountOptions = [ "nofail" ];
-              };
-            };
-            system = {
-              size = "100%";
-              content = {
-                type = "zfs";
-                pool = "zroot";
-              };
-            };
-          };
-        };
-      };
-    };
-    zpool = {
-      zroot = {
-        type = "zpool";
-        rootFsOptions = {
-          mountpoint = "none";
-          compression = "lz4";
-          acltype = "posixacl";
-          xattr = "sa";
-          "com.sun:auto-snapshot" = "true";
-        };
-        options.ashift = "12";
-        datasets = {
-          "root" = {
-            type = "zfs_fs";
-            options.mountpoint = "none";
-          };
-          "root/nixos" = {
-            type = "zfs_fs";
-            options.mountpoint = "/";
-            mountpoint = "/";
-          };
-          "root/home" = {
-            type = "zfs_fs";
-            options.mountpoint = "/home";
-            mountpoint = "/home";
-          };
-          "root/tmp" = {
-            type = "zfs_fs";
-            mountpoint = "/tmp";
-            options = {
-              mountpoint = "/tmp";
-              sync = "disabled";
-            };
-          };
-        };
-      };
-    };
-  };
-}

machines/buna/configuration.nix

@@ -1,14 +0,0 @@
-{ config, ... }:
-{
-  nixpkgs.hostPlatform = {
-    system = "x86_64-linux";
-  };
-  system.stateVersion = "25.11";
-  clan.core.sops.defaultGroups = [ "admins" ];
-  # clan.core.networking.targetHost = "root@";
-
-  clan.core.settings.name = "buna";
-  clan.core.settings.machine.description =
-    "Radxa X4 SBC board for one of w phone network. (With w whitehouse)";
-
-}

machines/buna/disko.nix

@@ -1,56 +0,0 @@
-{ ... }:
-let
-  hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
-  os = "/dev/disk/by-id/usb-Generic_MassStorageClass_000000001539-0:0";
-in
-{
-
-  boot.loader = {
-    systemd-boot = {
-      enable = true;
-    };
-    efi = {
-      canTouchEfiVariables = true;
-    };
-  };
-
-  disko.devices = {
-    disk = {
-      "os-${hashDisk os}" = {
-        type = "disk";
-        device = os;
-        content = {
-          type = "gpt";
-          partitions = {
-            ESP = {
-              end = "500M";
-              type = "EF00";
-              content = {
-                type = "filesystem";
-                format = "vfat";
-                mountpoint = "/boot";
-                mountOptions = [ "umask=0077" ];
-              };
-            };
-            root = {
-              name = "root";
-              end = "-0";
-              content = {
-                type = "filesystem";
-                format = "f2fs";
-                mountpoint = "/";
-                extraArgs = [
-                  "-O"
-                  "extra_attr,inode_checksum,sb_checksum,compression"
-                ];
-                mountOptions = [
-                  "compress_algorithm=zstd:6,compress_chksum,atgc,gc_merge,lazytime,nodiscard"
-                ];
-              };
-            };
-          };
-        };
-      };
-    };
-  };
-}

machines/canopus/configuration.nix

@@ -1,109 +0,0 @@
-{
-  inputs,
-  pkgs,
-  config,
-  ...
-}:
-let
-  sitename = "glomerp.newedge.house";
-  nbClientName = "netbird-b4l";
-in
-{
-  clan.core.settings.machine.description = "VM machine that host ERPNext for glomglom";
-
-  imports = [ inputs.frappix.nixosModules.x86_64-linux.frappix ];
-  nixpkgs.overlays = [
-    inputs.self.overlays.frappixFrappeOverlay
-    inputs.self.overlays.frappixLibsOverlay
-    inputs.self.overlays.frappixPythonOverlay
-    inputs.self.overlays.frappixToolsOverlay
-  ];
-
-  clan.core.vars.generators.frappix = {
-    files = {
-      sslCertificate.secret = false;
-      sslCertificateKey = {
-        owner = "nginx";
-        group = "nginx";
-        secret = true;
-      };
-      adminPassword.secret = true;
-    };
-    runtimeInputs = with pkgs; [
-      openssl
-      xkcdpass
-    ];
-    script = ''
-      openssl req -x509 -newkey rsa:4096 -keyout $out/sslCertificateKey -out $out/sslCertificate -sha256 -days 3650 -nodes -subj "/C=TH/ST=ChiangMai/L=ChiangMai/O=kurogeek/CN=kurogeek.home" 
-      xkcdpass --numwords 4 --delimiter - --count 1 | tr -d "\n" > "$out"/adminPassword
-    '';
-  };
-
-  services.frappe = {
-    enable = true;
-    project = "glomerp";
-    gunicorn_workers = 2;
-    adminPassword = config.clan.core.vars.generators.frappix.files.adminPassword.path;
-    apps = [
-      pkgs.frappix.erpnext
-      pkgs.frappix.hrms
-    ];
-    sites = {
-      "${sitename}" = {
-        domains = [ sitename ];
-        apps = [
-          "frappe"
-          "erpnext"
-          "hrms"
-        ];
-      };
-    };
-  };
-  services.nginx.virtualHosts."${sitename}" = {
-    sslCertificate = config.clan.core.vars.generators.frappix.files.sslCertificate.path;
-    sslCertificateKey = config.clan.core.vars.generators.frappix.files.sslCertificateKey.path;
-  };
-
-  nixpkgs.hostPlatform = {
-    system = "x86_64-linux";
-  };
-
-  clan.core.vars.generators.nginx = {
-    files = {
-      sslCert = {
-        owner = "nginx";
-        group = "nginx";
-        secret = true;
-      };
-      sslKey = {
-        owner = "nginx";
-        group = "nginx";
-        secret = true;
-      };
-    };
-
-    runtimeInputs = [
-      pkgs.openssl
-    ];
-    script = ''
-      openssl req -x509 -nodes -days 3650 -newkey rsa:2048 \
-        -keyout $out/sslKey \
-        -out $out/sslCert \
-        -subj "/CN=localhost"
-    '';
-  };
-
-  networking.firewall.allowedTCPPorts = [
-    80
-    443
-  ];
-
-  # services.nginx.virtualHosts."${domain}" = {
-  #   forceSSL = true;
-  #   sslCertificate = config.clan.core.vars.generators.nginx.files.sslCert.path;
-  #   sslCertificateKey = config.clan.core.vars.generators.nginx.files.sslKey.path;
-  # };
-
-  system.stateVersion = "25.11";
-  clan.core.sops.defaultGroups = [ "admins" ];
-}

machines/canopus/disko.nix

@@ -1,85 +0,0 @@
-let
-  hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
-  os = "/dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0";
-in
-{
-
-  boot.loader = {
-    systemd-boot = {
-      enable = true;
-    };
-    efi = {
-      canTouchEfiVariables = true;
-    };
-  };
-
-  boot.zfs.forceImportRoot = true;
-
-  disko.devices = {
-    disk = {
-      "os-${hashDisk os}" = {
-        type = "disk";
-        device = os;
-        content = {
-          type = "gpt";
-          partitions = {
-            ESP = {
-              size = "1G";
-              type = "EF00";
-              content = {
-                type = "filesystem";
-                format = "vfat";
-                mountpoint = "/boot";
-                mountOptions = [ "nofail" ];
-              };
-            };
-            system = {
-              size = "100%";
-              content = {
-                type = "zfs";
-                pool = "zroot";
-              };
-            };
-          };
-        };
-      };
-    };
-    zpool = {
-      zroot = {
-        type = "zpool";
-        rootFsOptions = {
-          mountpoint = "none";
-          compression = "lz4";
-          acltype = "posixacl";
-          xattr = "sa";
-          "com.sun:auto-snapshot" = "true";
-        };
-        options.ashift = "12";
-        datasets = {
-          "root" = {
-            type = "zfs_fs";
-            options.mountpoint = "none";
-          };
-          "root/nixos" = {
-            type = "zfs_fs";
-            options.mountpoint = "/";
-            mountpoint = "/";
-          };
-          "root/home" = {
-            type = "zfs_fs";
-            options.mountpoint = "/home";
-            mountpoint = "/home";
-          };
-          "root/tmp" = {
-            type = "zfs_fs";
-            mountpoint = "/tmp";
-            options = {
-              mountpoint = "/tmp";
-              sync = "disabled";
-            };
-          };
-        };
-      };
-    };
-  };
-}

machines/cursa/configuration.nix

@@ -1,14 +0,0 @@
-{
-  ...
-}:
-{
-  clan.core.settings.machine.description =
-    "VM machine for collecting prometheus metrics and fire alerts";
-
-  nixpkgs.hostPlatform = {
-    system = "x86_64-linux";
-  };
-
-  system.stateVersion = "25.11";
-  clan.core.sops.defaultGroups = [ "admins" ];
-}

machines/cursa/disko.nix

@@ -1,85 +0,0 @@
-let
-  hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
-  os = "/dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0";
-in
-{
-
-  boot.loader = {
-    systemd-boot = {
-      enable = true;
-    };
-    efi = {
-      canTouchEfiVariables = true;
-    };
-  };
-
-  boot.zfs.forceImportRoot = true;
-
-  disko.devices = {
-    disk = {
-      "os-${hashDisk os}" = {
-        type = "disk";
-        device = os;
-        content = {
-          type = "gpt";
-          partitions = {
-            ESP = {
-              size = "1G";
-              type = "EF00";
-              content = {
-                type = "filesystem";
-                format = "vfat";
-                mountpoint = "/boot";
-                mountOptions = [ "nofail" ];
-              };
-            };
-            system = {
-              size = "100%";
-              content = {
-                type = "zfs";
-                pool = "zroot";
-              };
-            };
-          };
-        };
-      };
-    };
-    zpool = {
-      zroot = {
-        type = "zpool";
-        rootFsOptions = {
-          mountpoint = "none";
-          compression = "lz4";
-          acltype = "posixacl";
-          xattr = "sa";
-          "com.sun:auto-snapshot" = "true";
-        };
-        options.ashift = "12";
-        datasets = {
-          "root" = {
-            type = "zfs_fs";
-            options.mountpoint = "none";
-          };
-          "root/nixos" = {
-            type = "zfs_fs";
-            options.mountpoint = "/";
-            mountpoint = "/";
-          };
-          "root/home" = {
-            type = "zfs_fs";
-            options.mountpoint = "/home";
-            mountpoint = "/home";
-          };
-          "root/tmp" = {
-            type = "zfs_fs";
-            mountpoint = "/tmp";
-            options = {
-              mountpoint = "/tmp";
-              sync = "disabled";
-            };
-          };
-        };
-      };
-    };
-  };
-}

machines/default.nix

@@ -1,27 +1,11 @@
-{
+{ inputs, self, ... }:
-  inputs,
-  self,
-  ...
-}:
 {
   imports = [
     inputs.clan-core.flakeModules.default
   ];
   clan = {
     meta.name = "NewEdgeClan";
-    machines = {
+    machines = { };
-      cursa = { ... }: { clan.core.state."vars".folders = [ "/var/lib" ]; };
-      hadar = { ... }: { clan.core.state."vars".folders = [ "/var/lib" ]; };
-      procyon = { ... }: { clan.core.state."vars".folders = [ "/var/lib" ]; };
-      bosona = { ... }: { clan.core.state."vars".folders = [ "/var/lib" ]; };
-      canopus = { ... }: { clan.core.state."vars".folders = [ "/var/lib" ]; };
-      deneb = { ... }: { clan.core.state."vars".folders = [ "/var/lib" ]; };
-      alasia = { ... }: { clan.core.state."vars".folders = [ "/var/lib" ]; };
-    };
-    secrets.age.plugins = [
-      "age-plugin-yubikey"
-      "age-plugin-fido2-hmac"
-    ];
     specialArgs = { inherit inputs self; };
     inherit self;
   };

machines/deneb/configuration.nix

@@ -1,126 +0,0 @@
-{
-  inputs,
-  pkgs,
-  config,
-  ...
-}:
-let
-  sitename = "poyerp.newedge.house";
-in
-{
-  clan.core.settings.machine.description = "VM machine that host ERPNext for poysound";
-  imports = [
-    inputs.frappix.nixosModules.x86_64-linux.frappix
-
-    # (import ../../lib/auto-accept-zerotier-members.nix {
-    #   memberIds = [
-    #     # Alex Caddy gateway
-    #     "dbe44c0287"
-    #     "e3d6559697"
-    #   ];
-    # })
-  ];
-  nixpkgs.overlays = [
-    inputs.self.overlays.frappixFrappeOverlay
-    inputs.self.overlays.frappixLibsOverlay
-    inputs.self.overlays.frappixPythonOverlay
-    inputs.self.overlays.frappixToolsOverlay
-    inputs.self.overlays.frappixAppsOverlay
-  ];
-
-  fonts.packages = [ pkgs.tlwg ];
-
-  clan.core.vars.generators.frappix = {
-    files = {
-      sslCertificate.secret = false;
-      sslCertificateKey = {
-        owner = "nginx";
-        group = "nginx";
-        secret = true;
-      };
-      adminPassword.secret = true;
-    };
-    runtimeInputs = with pkgs; [
-      openssl
-      xkcdpass
-    ];
-    script = ''
-      openssl req -x509 -newkey rsa:4096 -keyout $out/sslCertificateKey -out $out/sslCertificate -sha256 -days 3650 -nodes -subj "/C=TH/ST=ChiangMai/L=ChiangMai/O=kurogeek/CN=kurogeek.home" 
-      xkcdpass --numwords 4 --delimiter - --count 1 | tr -d "\n" > "$out"/adminPassword
-    '';
-  };
-
-  services.frappe = {
-    enable = true;
-    project = "poyerp";
-    gunicorn_workers = 2;
-    adminPassword = config.clan.core.vars.generators.frappix.files.adminPassword.path;
-    apps = [
-      pkgs.frappix.erpnext
-      pkgs.frappix.hrms
-      pkgs.frappix.crm
-      pkgs.frappix.posprinter
-      pkgs.frappix.default_thai_company
-    ];
-    sites = {
-      "${sitename}" = {
-        domains = [ sitename ];
-        apps = [
-          "frappe"
-          "erpnext"
-          "hrms"
-          "crm"
-          "posprinter"
-          "default_thai_company"
-        ];
-      };
-    };
-  };
-  services.nginx.virtualHosts."${sitename}" = {
-    sslCertificate = config.clan.core.vars.generators.frappix.files.sslCertificate.path;
-    sslCertificateKey = config.clan.core.vars.generators.frappix.files.sslCertificateKey.path;
-  };
-
-  nixpkgs.hostPlatform = {
-    system = "x86_64-linux";
-  };
-
-  clan.core.vars.generators.nginx = {
-    files = {
-      sslCert = {
-        owner = "nginx";
-        group = "nginx";
-        secret = true;
-      };
-      sslKey = {
-        owner = "nginx";
-        group = "nginx";
-        secret = true;
-      };
-    };
-
-    runtimeInputs = [
-      pkgs.openssl
-    ];
-    script = ''
-      openssl req -x509 -nodes -days 3650 -newkey rsa:2048 \
-        -keyout $out/sslKey \
-        -out $out/sslCert \
-        -subj "/CN=localhost"
-    '';
-  };
-
-  networking.firewall.allowedTCPPorts = [
-    80
-    443
-  ];
-
-  # services.nginx.virtualHosts."${domain}" = {
-  #   forceSSL = true;
-  #   sslCertificate = config.clan.core.vars.generators.nginx.files.sslCert.path;
-  #   sslCertificateKey = config.clan.core.vars.generators.nginx.files.sslKey.path;
-  # };
-
-  system.stateVersion = "25.11";
-  clan.core.sops.defaultGroups = [ "admins" ];
-}

machines/deneb/disko.nix

@@ -1,85 +0,0 @@
-let
-  hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
-  os = "/dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0";
-in
-{
-
-  boot.loader = {
-    systemd-boot = {
-      enable = true;
-    };
-    efi = {
-      canTouchEfiVariables = true;
-    };
-  };
-
-  boot.zfs.forceImportRoot = true;
-
-  disko.devices = {
-    disk = {
-      "os-${hashDisk os}" = {
-        type = "disk";
-        device = os;
-        content = {
-          type = "gpt";
-          partitions = {
-            ESP = {
-              size = "1G";
-              type = "EF00";
-              content = {
-                type = "filesystem";
-                format = "vfat";
-                mountpoint = "/boot";
-                mountOptions = [ "nofail" ];
-              };
-            };
-            system = {
-              size = "100%";
-              content = {
-                type = "zfs";
-                pool = "zroot";
-              };
-            };
-          };
-        };
-      };
-    };
-    zpool = {
-      zroot = {
-        type = "zpool";
-        rootFsOptions = {
-          mountpoint = "none";
-          compression = "lz4";
-          acltype = "posixacl";
-          xattr = "sa";
-          "com.sun:auto-snapshot" = "true";
-        };
-        options.ashift = "12";
-        datasets = {
-          "root" = {
-            type = "zfs_fs";
-            options.mountpoint = "none";
-          };
-          "root/nixos" = {
-            type = "zfs_fs";
-            options.mountpoint = "/";
-            mountpoint = "/";
-          };
-          "root/home" = {
-            type = "zfs_fs";
-            options.mountpoint = "/home";
-            mountpoint = "/home";
-          };
-          "root/tmp" = {
-            type = "zfs_fs";
-            mountpoint = "/tmp";
-            options = {
-              mountpoint = "/tmp";
-              sync = "disabled";
-            };
-          };
-        };
-      };
-    };
-  };
-}

machines/hadar/configuration.nix

@@ -1,86 +0,0 @@
-{
-  inputs,
-  config,
-  pkgs,
-  ...
-}:
-let
-  domain = "poy-inventory.newedge.house";
-in
-{
-  clan.core.settings.machine.description = "VM machine that host Inventree system for Poy";
-
-  nixpkgs.hostPlatform = {
-    system = "x86_64-linux";
-  };
-
-  clan.core.vars.generators.inventree = {
-    files = {
-      secret-key = {
-        owner = "inventree";
-        group = "inventree";
-        secret = true;
-      };
-      oidc-key = {
-        owner = "inventree";
-        group = "inventree";
-        secret = true;
-      };
-      admin-password = {
-        owner = "inventree";
-        group = "inventree";
-        secret = true;
-      };
-    };
-    runtimeInputs = [
-      pkgs.pwgen
-      pkgs.xkcdpass
-    ];
-    script = ''
-      pwgen -s 32 1 > $out/secret-key
-      pwgen -s 32 1 > $out/oidc-key
-      xkcdpass --numwords 4 --delimiter - --count 1 | tr -d "\n" > "$out"/admin-password
-    '';
-  };
-
-  clan.core.vars.generators.nginx = {
-    files = {
-      sslCert = {
-        owner = "nginx";
-        group = "nginx";
-        secret = true;
-      };
-      sslKey = {
-        owner = "nginx";
-        group = "nginx";
-        secret = true;
-      };
-    };
-
-    runtimeInputs = [
-      pkgs.openssl
-    ];
-    script = ''
-      openssl req -x509 -nodes -days 3650 -newkey rsa:2048 \
-        -keyout $out/sslKey \
-        -out $out/sslCert \
-        -subj "/CN=localhost"
-    '';
-  };
-
-  networking.firewall.allowedTCPPorts = [
-    80
-    443
-  ];
-
-  services.inventree = {
-    enable = true;
-    inherit domain;
-    secretKeyFile = config.clan.core.vars.generators.inventree.files.secret-key.path;
-    adminPasswordFile = config.clan.core.vars.generators.inventree.files.admin-password.path;
-    settings.INVENTREE_SITE_URL = "https://${domain}";
-  };
-
-  system.stateVersion = "25.11";
-  clan.core.sops.defaultGroups = [ "admins" ];
-}

machines/hadar/disko.nix

@@ -1,85 +0,0 @@
-let
-  hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
-  os = "/dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0";
-in
-{
-
-  boot.loader = {
-    systemd-boot = {
-      enable = true;
-    };
-    efi = {
-      canTouchEfiVariables = true;
-    };
-  };
-
-  boot.zfs.forceImportRoot = true;
-
-  disko.devices = {
-    disk = {
-      "os-${hashDisk os}" = {
-        type = "disk";
-        device = os;
-        content = {
-          type = "gpt";
-          partitions = {
-            ESP = {
-              size = "1G";
-              type = "EF00";
-              content = {
-                type = "filesystem";
-                format = "vfat";
-                mountpoint = "/boot";
-                mountOptions = [ "nofail" ];
-              };
-            };
-            system = {
-              size = "100%";
-              content = {
-                type = "zfs";
-                pool = "zroot";
-              };
-            };
-          };
-        };
-      };
-    };
-    zpool = {
-      zroot = {
-        type = "zpool";
-        rootFsOptions = {
-          mountpoint = "none";
-          compression = "lz4";
-          acltype = "posixacl";
-          xattr = "sa";
-          "com.sun:auto-snapshot" = "true";
-        };
-        options.ashift = "12";
-        datasets = {
-          "root" = {
-            type = "zfs_fs";
-            options.mountpoint = "none";
-          };
-          "root/nixos" = {
-            type = "zfs_fs";
-            options.mountpoint = "/";
-            mountpoint = "/";
-          };
-          "root/home" = {
-            type = "zfs_fs";
-            options.mountpoint = "/home";
-            mountpoint = "/home";
-          };
-          "root/tmp" = {
-            type = "zfs_fs";
-            mountpoint = "/tmp";
-            options = {
-              mountpoint = "/tmp";
-              sync = "disabled";
-            };
-          };
-        };
-      };
-    };
-  };
-}

machines/mirach/configuration.nix

@@ -1,13 +0,0 @@
-{ config, ... }:
-{
-  nixpkgs.hostPlatform = {
-    system = "x86_64-linux";
-  };
-  system.stateVersion = "25.11";
-  clan.core.sops.defaultGroups = [ "admins" ];
-  # clan.core.networking.targetHost = "root@";
-
-  clan.core.settings.name = "mirach";
-  clan.core.settings.machine.description = "Radxa X4 SBC board for one of w phone network.";
-
-}

machines/mirach/disko.nix

@@ -1,92 +0,0 @@
-{ ... }:
-let
-  hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
-  os = "/dev/disk/by-id/mmc-CUTB42_0x95d64f33";
-in
-{
-
-  boot.loader = {
-    systemd-boot = {
-      enable = true;
-    };
-    efi = {
-      canTouchEfiVariables = true;
-    };
-  };
-
-  boot.zfs.forceImportRoot = true;
-
-  disko.devices = {
-    disk = {
-      "os-${hashDisk os}" = {
-        type = "disk";
-        device = os;
-        content = {
-          type = "gpt";
-          partitions = {
-            ESP = {
-              size = "1G";
-              type = "EF00";
-              content = {
-                type = "filesystem";
-                format = "vfat";
-                mountpoint = "/boot";
-                mountOptions = [ "nofail" ];
-              };
-            };
-            system = {
-              size = "100%";
-              content = {
-                type = "zfs";
-                pool = "zroot";
-              };
-            };
-            swap = {
-              size = "4G";
-              content = {
-                type = "swap";
-              };
-            };
-          };
-        };
-      };
-    };
-    zpool = {
-      zroot = {
-        type = "zpool";
-        rootFsOptions = {
-          mountpoint = "none";
-          compression = "lz4";
-          acltype = "posixacl";
-          xattr = "sa";
-          "com.sun:auto-snapshot" = "true";
-        };
-        options.ashift = "12";
-        datasets = {
-          "root" = {
-            type = "zfs_fs";
-            options.mountpoint = "none";
-          };
-          "root/nixos" = {
-            type = "zfs_fs";
-            options.mountpoint = "/";
-            mountpoint = "/";
-          };
-          "root/home" = {
-            type = "zfs_fs";
-            options.mountpoint = "/home";
-            mountpoint = "/home";
-          };
-          "root/tmp" = {
-            type = "zfs_fs";
-            mountpoint = "/tmp";
-            options = {
-              mountpoint = "/tmp";
-              sync = "disabled";
-            };
-          };
-        };
-      };
-    };
-  };
-}

machines/neptune/configuration.nix

@@ -1,61 +0,0 @@
-{
-  inputs,
-  config,
-  lib,
-  ...
-}:
-{
-  nixpkgs.hostPlatform = {
-    system = "x86_64-linux";
-  };
-  system.stateVersion = "25.11";
-  clan.core.sops.defaultGroups = [ "admins" ];
-
-  networking.interfaces.enx00e04c106368.useDHCP = true; # recovery
-
-  clan.core.vars.generators.wireless-credentials = {
-    files = {
-      essid.secret = false;
-      psk.secret = true;
-    };
-    prompts = {
-      essid.persist = true;
-      psk.persist = true;
-    };
-    script = ''
-      cat "$prompts"/essid > $out/essid
-      prompt_psk=$(cat "$prompts"/psk)
-      echo "psk=$prompt_psk" > $out/psk
-    '';
-  };
-
-  networking.wireless =
-    let
-      credentials = config.clan.core.vars.generators.wireless-credentials.files;
-    in
-    {
-      enable = true;
-      secretsFile = credentials.psk.path;
-      networks.${credentials.essid.value}.pskRaw = "ext:psk";
-    };
-
-  networking.interfaces.wlp1s0 = {
-    useDHCP = false;
-    ipv4.addresses = [
-      {
-        address = "10.0.0.9";
-        prefixLength = 24;
-      }
-    ];
-  };
-
-  services.yggdrasil.settings.Peers = lib.mkForce [
-    "tcp://newt.barry.town:1337"
-    "tls://yg-hkg.magicum.net:32333"
-    "tls://astrra.space:55535"
-  ];
-
-  clan.core.settings.name = "neptune";
-  clan.core.settings.machine.description = "Radxa SBC board for testing. (With vi)";
-
-}

machines/neptune/disko.nix

@@ -1,92 +0,0 @@
-{ ... }:
-let
-  hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
-  os = "/dev/disk/by-id/mmc-CUTB42_0x9d59499c";
-in
-{
-
-  boot.loader = {
-    systemd-boot = {
-      enable = true;
-    };
-    efi = {
-      canTouchEfiVariables = true;
-    };
-  };
-
-  boot.zfs.forceImportRoot = true;
-
-  disko.devices = {
-    disk = {
-      "os-${hashDisk os}" = {
-        type = "disk";
-        device = os;
-        content = {
-          type = "gpt";
-          partitions = {
-            ESP = {
-              size = "1G";
-              type = "EF00";
-              content = {
-                type = "filesystem";
-                format = "vfat";
-                mountpoint = "/boot";
-                mountOptions = [ "nofail" ];
-              };
-            };
-            system = {
-              size = "100%";
-              content = {
-                type = "zfs";
-                pool = "zroot";
-              };
-            };
-            swap = {
-              size = "16G";
-              content = {
-                type = "swap";
-              };
-            };
-          };
-        };
-      };
-    };
-    zpool = {
-      zroot = {
-        type = "zpool";
-        rootFsOptions = {
-          mountpoint = "none";
-          compression = "lz4";
-          acltype = "posixacl";
-          xattr = "sa";
-          "com.sun:auto-snapshot" = "true";
-        };
-        options.ashift = "12";
-        datasets = {
-          "root" = {
-            type = "zfs_fs";
-            options.mountpoint = "none";
-          };
-          "root/nixos" = {
-            type = "zfs_fs";
-            options.mountpoint = "/";
-            mountpoint = "/";
-          };
-          "root/home" = {
-            type = "zfs_fs";
-            options.mountpoint = "/home";
-            mountpoint = "/home";
-          };
-          "root/tmp" = {
-            type = "zfs_fs";
-            mountpoint = "/tmp";
-            options = {
-              mountpoint = "/tmp";
-              sync = "disabled";
-            };
-          };
-        };
-      };
-    };
-  };
-}

machines/petra/configuration.nix

@@ -1,13 +0,0 @@
-{ self, ... }:
-{
-  imports = [
-    self.nixosModules.common
-  ];
-
-  nixpkgs.hostPlatform = {
-    system = "x86_64-linux";
-  };
-  system.stateVersion = "25.11";
-  clan.core.sops.defaultGroups = [ "admins" ];
-  clan.core.settings.machine.description = "A personal computer for Chocolate Shop";
-}

machines/petra/disko.nix

@@ -1,79 +0,0 @@
-{ ... }:
-let
-  hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
-  os = "/dev/disk/by-id/ata-TOSHIBA_MQ01ABD100_85N8C2DPT";
-in
-{
-
-  boot.loader = {
-    systemd-boot = {
-      enable = true;
-    };
-    efi = {
-      canTouchEfiVariables = true;
-    };
-  };
-
-  boot.zfs.forceImportRoot = true;
-
-  disko.devices = {
-    disk = {
-      "os-${hashDisk os}" = {
-        type = "disk";
-        device = os;
-        content = {
-          type = "gpt";
-          partitions = {
-            ESP = {
-              size = "1G";
-              type = "EF00";
-              content = {
-                type = "filesystem";
-                format = "vfat";
-                mountpoint = "/boot";
-                mountOptions = [ "nofail" ];
-              };
-            };
-            system = {
-              size = "100%";
-              content = {
-                type = "zfs";
-                pool = "zroot";
-              };
-            };
-            swap = {
-              size = "16G";
-              content = {
-                type = "swap";
-              };
-            };
-          };
-        };
-      };
-    };
-    zpool = {
-      zroot = {
-        type = "zpool";
-        rootFsOptions = {
-          mountpoint = "none";
-          compression = "lz4";
-          acltype = "posixacl";
-          xattr = "sa";
-          "com.sun:auto-snapshot" = "true";
-        };
-        options.ashift = "12";
-        datasets = {
-          "root" = {
-            type = "zfs_fs";
-            options.mountpoint = "none";
-          };
-          "root/nixos" = {
-            type = "zfs_fs";
-            options.mountpoint = "/";
-            mountpoint = "/";
-          };
-        };
-      };
-    };
-  };
-}

machines/procyon/configuration.nix

@@ -1,86 +0,0 @@
-{
-  inputs,
-  config,
-  pkgs,
-  ...
-}:
-let
-  domain = "glom-inventory.newedge.house";
-in
-{
-  clan.core.settings.machine.description = "VM machine that host Inventree system for Glom";
-
-  nixpkgs.hostPlatform = {
-    system = "x86_64-linux";
-  };
-
-  clan.core.vars.generators.inventree = {
-    files = {
-      secret-key = {
-        owner = "inventree";
-        group = "inventree";
-        secret = true;
-      };
-      oidc-key = {
-        owner = "inventree";
-        group = "inventree";
-        secret = true;
-      };
-      admin-password = {
-        owner = "inventree";
-        group = "inventree";
-        secret = true;
-      };
-    };
-    runtimeInputs = [
-      pkgs.pwgen
-      pkgs.xkcdpass
-    ];
-    script = ''
-      pwgen -s 32 1 > $out/secret-key
-      pwgen -s 32 1 > $out/oidc-key
-      xkcdpass --numwords 4 --delimiter - --count 1 | tr -d "\n" > "$out"/admin-password
-    '';
-  };
-
-  clan.core.vars.generators.nginx = {
-    files = {
-      sslCert = {
-        owner = "nginx";
-        group = "nginx";
-        secret = true;
-      };
-      sslKey = {
-        owner = "nginx";
-        group = "nginx";
-        secret = true;
-      };
-    };
-
-    runtimeInputs = [
-      pkgs.openssl
-    ];
-    script = ''
-      openssl req -x509 -nodes -days 3650 -newkey rsa:2048 \
-        -keyout $out/sslKey \
-        -out $out/sslCert \
-        -subj "/CN=localhost"
-    '';
-  };
-
-  networking.firewall.allowedTCPPorts = [
-    80
-    443
-  ];
-
-  services.inventree = {
-    enable = true;
-    inherit domain;
-    secretKeyFile = config.clan.core.vars.generators.inventree.files.secret-key.path;
-    adminPasswordFile = config.clan.core.vars.generators.inventree.files.admin-password.path;
-    settings.INVENTREE_SITE_URL = "https://${domain}";
-  };
-
-  system.stateVersion = "25.11";
-  clan.core.sops.defaultGroups = [ "admins" ];
-}

machines/procyon/disko.nix

@@ -1,85 +0,0 @@
-let
-  hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
-  os = "/dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0";
-in
-{
-
-  boot.loader = {
-    systemd-boot = {
-      enable = true;
-    };
-    efi = {
-      canTouchEfiVariables = true;
-    };
-  };
-
-  boot.zfs.forceImportRoot = true;
-
-  disko.devices = {
-    disk = {
-      "os-${hashDisk os}" = {
-        type = "disk";
-        device = os;
-        content = {
-          type = "gpt";
-          partitions = {
-            ESP = {
-              size = "1G";
-              type = "EF00";
-              content = {
-                type = "filesystem";
-                format = "vfat";
-                mountpoint = "/boot";
-                mountOptions = [ "nofail" ];
-              };
-            };
-            system = {
-              size = "100%";
-              content = {
-                type = "zfs";
-                pool = "zroot";
-              };
-            };
-          };
-        };
-      };
-    };
-    zpool = {
-      zroot = {
-        type = "zpool";
-        rootFsOptions = {
-          mountpoint = "none";
-          compression = "lz4";
-          acltype = "posixacl";
-          xattr = "sa";
-          "com.sun:auto-snapshot" = "true";
-        };
-        options.ashift = "12";
-        datasets = {
-          "root" = {
-            type = "zfs_fs";
-            options.mountpoint = "none";
-          };
-          "root/nixos" = {
-            type = "zfs_fs";
-            options.mountpoint = "/";
-            mountpoint = "/";
-          };
-          "root/home" = {
-            type = "zfs_fs";
-            options.mountpoint = "/home";
-            mountpoint = "/home";
-          };
-          "root/tmp" = {
-            type = "zfs_fs";
-            mountpoint = "/tmp";
-            options = {
-              mountpoint = "/tmp";
-              sync = "disabled";
-            };
-          };
-        };
-      };
-    };
-  };
-}

machines/ramus/configuration.nix

@@ -1,32 +0,0 @@
-{ self, config, ... }:
-{
-  system.stateVersion = "25.11";
-  nixpkgs.hostPlatform = {
-    system = "x86_64-linux";
-  };
-
-  clan.core.settings.name = "ramus";
-  clan.core.settings.machine.description = "A Hetzner VPS machine own by Alex.";
-
-  clan.core.sops.defaultGroups = [ "admins" ];
-
-  clan.core.vars.generators.acme = {
-    share = true;
-    files.email.secret = false;
-
-    prompts.email = {
-      type = "line";
-      description = "Email for ACME registeration";
-    };
-
-    script = ''
-      cat $prompts/email > $out/email
-    '';
-  };
-
-  users.users.nginx.extraGroups = [ "acme" ];
-
-  security.acme.acceptTerms = true;
-
-  imports = [ ./think-greater-chiangmai.nix ];
-}

machines/ramus/disko.nix

@@ -1,86 +0,0 @@
-{ ... }:
-let
-  hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
-  os = "/dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_107266387";
-in
-{
-
-  boot.loader = {
-    systemd-boot = {
-      enable = true;
-    };
-    efi = {
-      canTouchEfiVariables = true;
-    };
-  };
-
-  boot.zfs.forceImportRoot = true;
-
-  disko.devices = {
-    disk = {
-      "os-${hashDisk os}" = {
-        type = "disk";
-        device = os;
-        content = {
-          type = "gpt";
-          partitions = {
-            ESP = {
-              size = "1G";
-              type = "EF00";
-              content = {
-                type = "filesystem";
-                format = "vfat";
-                mountpoint = "/boot";
-                mountOptions = [ "nofail" ];
-              };
-            };
-            system = {
-              size = "100%";
-              content = {
-                type = "zfs";
-                pool = "zroot";
-              };
-            };
-          };
-        };
-      };
-    };
-    zpool = {
-      zroot = {
-        type = "zpool";
-        rootFsOptions = {
-          mountpoint = "none";
-          compression = "lz4";
-          acltype = "posixacl";
-          xattr = "sa";
-          "com.sun:auto-snapshot" = "true";
-        };
-        options.ashift = "12";
-        datasets = {
-          "root" = {
-            type = "zfs_fs";
-            options.mountpoint = "none";
-          };
-          "root/nixos" = {
-            type = "zfs_fs";
-            options.mountpoint = "/";
-            mountpoint = "/";
-          };
-          "root/home" = {
-            type = "zfs_fs";
-            options.mountpoint = "/home";
-            mountpoint = "/home";
-          };
-          "root/tmp" = {
-            type = "zfs_fs";
-            mountpoint = "/tmp";
-            options = {
-              mountpoint = "/tmp";
-              sync = "disabled";
-            };
-          };
-        };
-      };
-    };
-  };
-}

machines/ramus/think-greater-chiangmai.nix

@@ -1,139 +0,0 @@
-{ self, config, ... }:
-let
-  commonSettings = rec {
-    APP_NAME = "Laravel";
-    APP_ENV = "local";
-    APP_KEY._secret = config.clan.core.vars.generators.greaterchiangmai.files.app_key.path;
-    APP_DEBUG = "false";
-    APP_URL = "http://localhost";
-
-    DB_CONNECTION = "mysql";
-    DB_HOST = "localhost";
-    DB_PORT = 3306;
-    DB_DATABASE = "thinkgtcm";
-    DB_USERNAME = "gtcm";
-
-    R2_SCHEMA_URL = "https://${R2_BUCKET}.${R2_REGION}.your-objectstorage.com/test-large-files/";
-    R2_ACCESS_KEY_ID = config.clan.core.vars.generators.greaterchiangmai-s3.files.access_key_id.value;
-    R2_SECRET_ACCESS_KEY._secret =
-      config.clan.core.vars.generators.greaterchiangmai-s3.files.secret_access_key.path;
-    R2_REGION = config.clan.core.vars.generators.greaterchiangmai-s3.files.region.value;
-    R2_BUCKET = config.clan.core.vars.generators.greaterchiangmai-s3.files.bucket.value;
-    R2_ENDPOINT = config.clan.core.vars.generators.greaterchiangmai-s3.files.endpoint.value;
-
-    R2_BUCKET_NAME = R2_BUCKET;
-
-    LOG_CHANNEL = "stack";
-    LOG_LEVEL = "debug";
-
-    FILESYSTEM_DISK = "local";
-
-    BROADCAST_DRIVER = "log";
-    CACHE_DRIVER = "file";
-    QUEUE_CONNECTION = "sync";
-    SESSION_DRIVER = "file";
-    SESSION_LIFETIME = 120;
-
-    MEMCACHED_HOST = "127.0.0.1";
-
-    REDIS_HOST = "127.0.0.1";
-    REDIS_PORT = 6379;
-
-    UPLOAD_MAX_FILESIZE = "5000M";
-    POST_MAX_SIZE = "5000M";
-
-    TEST_LOCAL = true;
-  };
-
-  baseDomain = "greaterchiangmai.com";
-  domain = "think.${baseDomain}";
-  domainBackend = "think-backend.${baseDomain}";
-in
-{
-  imports = [
-    self.nixosModules.think-gtcm
-    self.nixosModules.think-backend-gtcm
-  ];
-  nixpkgs.overlays = [ self.overlays.packagesOverlay ];
-
-  clan.core.vars.generators.greaterchiangmai = {
-    files = {
-      app_key = {
-        secret = true;
-        owner = config.services.think-greaterchiangmai.user;
-        group = config.services.think-greaterchiangmai.group;
-      };
-    };
-
-    prompts = {
-      app_key.persist = true;
-    };
-
-    script = ''
-      cat $prompts/app_key > $out/app_key
-    '';
-  };
-
-  clan.core.vars.generators.greaterchiangmai-s3 = {
-    files = {
-      access_key_id.secret = false;
-      secret_access_key = {
-        secret = true;
-        owner = config.services.think-greaterchiangmai.user;
-        group = config.services.think-greaterchiangmai.group;
-      };
-      endpoint.secret = false;
-      region.secret = false;
-      bucket.secret = false;
-    };
-
-    prompts = {
-      access_key_id.persist = true;
-      secret_access_key.persist = true;
-      endpoint.persist = true;
-      region.persist = true;
-      bucket.persist = true;
-    };
-
-    script = ''
-      cat $prompts/access_key_id > $out/access_key_id
-      cat $prompts/secret_access_key > $out/secret_access_key
-      cat $prompts/endpoint > $out/endpoint
-      cat $prompts/region > $out/region
-      cat $prompts/bucket > $out/bucket
-    '';
-  };
-
-  services.think-greaterchiangmai = {
-    enable = true;
-    domain = domain;
-    settings = commonSettings;
-  };
-  services.think-backend-greaterchiangmai = {
-    enable = true;
-    domain = domainBackend;
-    settings = commonSettings;
-  };
-
-  security.acme.certs = {
-    "${domain}" = {
-      email = config.clan.core.vars.generators.acme.files.email.value;
-      webroot = "/var/lib/acme/acme-challenge/${domain}";
-    };
-    "${domainBackend}" = {
-      email = config.clan.core.vars.generators.acme.files.email.value;
-      webroot = "/var/lib/acme/acme-challenge/${domainBackend}";
-    };
-  };
-
-  services.nginx.virtualHosts.${domain} = {
-    forceSSL = true;
-    useACMEHost = domain;
-    acmeRoot = config.security.acme.certs.${domain}.webroot;
-  };
-  services.nginx.virtualHosts.${domainBackend} = {
-    forceSSL = true;
-    useACMEHost = domainBackend;
-    acmeRoot = config.security.acme.certs.${domainBackend}.webroot;
-  };
-}

machines/rana/configuration.nix

@@ -1,22 +0,0 @@
-{ self, pkgs, ... }:
-{
-  clan.core.settings.machine.description = "Emmie personal computer";
-
-  imports = [
-    self.nixosModules.common
-  ];
-
-  nixpkgs.hostPlatform = {
-    system = "x86_64-linux";
-  };
-  system.stateVersion = "25.11";
-  clan.core.sops.defaultGroups = [ "admins" ];
-
-  boot.kernelParams = [
-    "amdgpu.dcdebugmask=0x10"
-    "amdgpu.cwsr_enable=0"
-    "amdgpu.gpu_recovery=1"
-  ];
-
-  boot.kernelPackages = pkgs.linuxKernel.packages.linux_6_12;
-}

machines/rana/disko.nix

@@ -1,95 +0,0 @@
-{ ... }:
-let
-  hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
-  os = "/dev/disk/by-id/nvme-SAMSUNG_MZVL81T0HFLB-00BLL_S7XKNF0Y966645";
-in
-{
-
-  boot.loader = {
-    systemd-boot = {
-      enable = true;
-    };
-    efi = {
-      canTouchEfiVariables = true;
-    };
-  };
-
-  boot.zfs.forceImportRoot = true;
-
-  disko.devices = {
-    disk = {
-      "os-${hashDisk os}" = {
-        type = "disk";
-        device = os;
-        content = {
-          type = "gpt";
-          partitions = {
-            ESP = {
-              size = "1G";
-              type = "EF00";
-              content = {
-                type = "filesystem";
-                format = "vfat";
-                mountpoint = "/boot";
-                mountOptions = [ "nofail" ];
-              };
-            };
-            system = {
-              size = "100%";
-              content = {
-                type = "zfs";
-                pool = "zroot";
-              };
-            };
-            swap = {
-              size = "16G";
-              content = {
-                type = "swap";
-              };
-            };
-          };
-        };
-      };
-    };
-    zpool = {
-      zroot = {
-        type = "zpool";
-        rootFsOptions = {
-          encryption = "aes-256-gcm";
-          keyformat = "passphrase";
-          keylocation = "file:///tmp/secret.key";
-          mountpoint = "none";
-          compression = "lz4";
-          acltype = "posixacl";
-          xattr = "sa";
-          "com.sun:auto-snapshot" = "true";
-        };
-        options.ashift = "12";
-        datasets = {
-          "root" = {
-            type = "zfs_fs";
-            options.mountpoint = "none";
-          };
-          "root/nixos" = {
-            type = "zfs_fs";
-            options.mountpoint = "/";
-            mountpoint = "/";
-          };
-          "root/home" = {
-            type = "zfs_fs";
-            options.mountpoint = "/home";
-            mountpoint = "/home";
-          };
-          "root/tmp" = {
-            type = "zfs_fs";
-            mountpoint = "/tmp";
-            options = {
-              mountpoint = "/tmp";
-              sync = "disabled";
-            };
-          };
-        };
-      };
-    };
-  };
-}

machines/rigel/configuration.nix

@@ -1,7 +1,3 @@
-{ config, ... }:
 {
   system.stateVersion = "25.11";
-  clan.core.sops.defaultGroups = [ "admins" ];
-
-  clan.core.settings.machine.description = "Zima board computer for testing in B4L";
 }

machines/sirius/README.md

@@ -1,21 +0,0 @@
-## How to setup this machine.
-
-This machine cannot be setup the same way as other machines are setup. Meaning that `clan machine install` won't work. Because of `disko` issue. So, below is how the machine is setup.
-
-1. Build an image to flash to an sd-card using
-
-```
-nix build -L --show-trace .\#nixosConfigurations.sirius.config.system.build.images.sd-card
-```
-
-2. Import the `zdata`
-
-```
-zpool import zdata
-```
-
-3. Update configuration
-
-```
-clan machine update sirius
-```

machines/sirius/configuration.nix

@@ -1,108 +0,0 @@
-{
-  self,
-  pkgs,
-  ...
-}:
-{
-  imports = [
-    ./hardware-configuration.nix
-  ];
-
-  image.modules.sd-card = {
-    disabledModules = [
-      ./hardware-configuration.nix
-    ];
-  };
-
-  clan.core.settings.machine.description = "w NAS";
-
-  clan.core.sops.defaultGroups = [ "admins" ];
-
-  nixpkgs.hostPlatform = {
-    system = "aarch64-linux";
-  };
-  nixpkgs.buildPlatform = {
-    system = "x86_64-linux";
-  };
-
-  system.stateVersion = "25.11";
-
-  services.udisks2.enable = false;
-
-  nix.settings.log-lines = 25;
-  nix.settings.auto-optimise-store = true;
-  nix.gc = {
-    automatic = true;
-    dates = "weekly";
-    options = "--delete-older-than 15d";
-  };
-
-  boot.loader.grub.enable = false;
-  boot.loader.generic-extlinux-compatible.enable = true;
-
-  boot.zfs.forceImportRoot = false;
-
-  boot.zfs.extraPools = [ "zdata" ];
-  boot.supportedFilesystems = [ "zfs" ];
-  boot.initrd.availableKernelModules = [
-    "usb_storage"
-    "sd_mod"
-  ];
-
-  boot = {
-    consoleLogLevel = 0;
-    kernel.sysctl = {
-      "fs.suid_dumpable" = 0;
-      "kernel.core_pattern" = "/dev/null";
-    };
-    tmp = {
-      useTmpfs = true;
-    };
-  };
-
-  services.journald.settings.Journal.Storage = "none";
-
-  systemd = {
-    coredump.enable = false;
-  };
-
-  fileSystems."/mnt/hdd" = {
-    device = "zdata/nas";
-    fsType = "zfs";
-    mountPoint = "/mnt/hdd";
-    options = [
-      "nofail"
-      "zfsutil"
-    ];
-  };
-
-  fileSystems."/var/lib" = {
-    device = "zdata/service-data";
-    fsType = "zfs";
-    mountPoint = "/var/lib";
-    options = [
-      "x-initrd.mount"
-      "nofail"
-      "zfsutil"
-    ];
-  };
-
-  systemd.services.heartbeat-push = {
-    description = "Heartbeat push to uptime monitor";
-    serviceConfig = {
-      Type = "oneshot";
-      ExecStart = "${pkgs.curl}/bin/curl -s -o /dev/null https://uptime.b4l.co.th/api/push/X0WCHAcY5gPf1U8If7BT1FLjpacZqGZu?status=up&msg=OK&ping=";
-    };
-  };
-
-  systemd.timers.heartbeat-push = {
-    description = "Heartbeat push timer";
-    wantedBy = [ "timers.target" ];
-    timerConfig = {
-      OnBootSec = "60s";
-      OnUnitActiveSec = "60s";
-      Unit = "heartbeat-push.service";
-    };
-  };
-
-}

machines/sirius/disko-ref.nix

@@ -1,150 +0,0 @@
-{ lib, pkgs, ... }:
-let
-  hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
-  # os = "/dev/disk/by-id/mmc-SD64G_0x8336354b";
-  vdev = [
-    "/dev/disk/by-id/ata-ST20000NM002H-3KV133_ZYDBVV7Z"
-    "/dev/disk/by-id/ata-ST20000NM002H-3KV133_ZYDBSJRE"
-  ];
-  configTxt = pkgs.writeText "config.txt" ''
-    [pi4]
-    kernel=u-boot-rpi4.bin
-    enable_gic=1
-
-    # Otherwise the resolution will be weird in most cases, compared to
-    # what the pi3 firmware does by default.
-    disable_overscan=1
-
-    # Supported in newer board revisions
-    arm_boost=1
-
-    [all]
-    # Boot in 64-bit mode.
-    arm_64bit=1
-
-    # U-Boot needs this to work, regardless of whether UART is actually used or not.
-    # Look in arch/arm/mach-bcm283x/Kconfig in the U-Boot tree to see if this is still
-    # a requirement in the future.
-    enable_uart=1
-
-    # Prevent the firmware from smashing the framebuffer setup done by the mainline kernel
-    # when attempting to show low-voltage or overtemperature warnings.
-    avoid_warnings=1
-  '';
-in
-{
-
-  boot.loader = {
-    systemd-boot = {
-      enable = true;
-    };
-    efi = {
-      canTouchEfiVariables = true;
-    };
-  };
-  # boot.tmp.useTmpfs = true;
-
-  disko.devices = {
-    disk = {
-      # "os-${hashDisk os}" = {
-      #   type = "disk";
-      #   device = os;
-      #   content = {
-      #     type = "gpt";
-      #     partitions = {
-      #       firmware = {
-      #         size = "60M";
-      #         priority = 1;
-      #         type = "0700";
-      #         content = {
-      #           type = "filesystem";
-      #           format = "vfat";
-      #           mountpoint = "/firmware";
-      #           postMountHook = toString (
-      #             pkgs.writeScript "postMountHook.sh" ''
-      #               (cd ${pkgs.raspberrypifw}/share/raspberrypi/boot && cp bootcode.bin fixup*.dat start*.elf *.dtb /mnt/firmware/)
-      #               cp ${pkgs.ubootRaspberryPi4_64bit}/u-boot.bin /mnt/firmware/u-boot-rpi4.bin
-      #               cp ${configTxt} /mnt/firmware/config.txt
-      #             ''
-      #           );
-      #         };
-      #       };
-      #       ESP = {
-      #         size = "2G";
-      #         type = "EF00";
-      #         content = {
-      #           type = "filesystem";
-      #           format = "vfat";
-      #           mountpoint = "/boot";
-      #           mountOptions = [ "umask=0077" ];
-      #         };
-      #       };
-      #       root = {
-      #         name = "root";
-      #         end = "-0";
-      #         content = {
-      #           type = "filesystem";
-      #           format = "f2fs";
-      #           mountpoint = "/";
-      #           extraArgs = [
-      #             "-O"
-      #             "extra_attr,inode_checksum,sb_checksum,compression"
-      #           ];
-      #           mountOptions = [ "compress_algorithm=zstd:6,compress_chksum,atgc,gc_merge,lazytime,nodiscard" ];
-      #         };
-      #       };
-      #     };
-      #   };
-      # };
-    }
-    // (lib.listToAttrs (
-      map (disk: {
-        name = "data-${hashDisk disk}";
-        value = {
-          type = "disk";
-          device = disk;
-          content = {
-            type = "zfs";
-            pool = "zdata";
-          };
-        };
-      }) vdev
-    ));
-    zpool = {
-      zdata = {
-        type = "zpool";
-        options.ashift = "12";
-        rootFsOptions = {
-          mountpoint = "none";
-          compression = "lz4";
-          acltype = "posixacl";
-          xattr = "sa";
-          "com.sun:auto-snapshot" = "true";
-        };
-        mode = {
-          topology = {
-            type = "topology";
-            vdev = [
-              {
-                mode = "mirror";
-                members = vdev;
-              }
-            ];
-          };
-        };
-        datasets = {
-          "nas" = {
-            type = "zfs_fs";
-            mountpoint = "/mnt/hdd";
-            mountOptions = [ "nofail" ];
-          };
-          "service-data" = {
-            type = "zfs_fs";
-            mountpoint = "/var/lib";
-            mountOptions = [ "nofail" ];
-          };
-        };
-      };
-    };
-  };
-}

machines/sirius/hardware-configuration.nix

@@ -1,6 +0,0 @@
-{
-  fileSystems."/" = {
-    device = "/dev/disk/by-uuid/44444444-4444-4444-8888-888888888888";
-    fsType = "ext4";
-  };
-}

machines/stellio/configuration.nix

@@ -1,31 +0,0 @@
-{ inputs, lib, ... }:
-{
-  imports = [
-    inputs.matthew-hardware.nixosModules.mt7986a-glinet-gl-mt6000
-  ];
-
-  # matthew-hardware's common/generic-uefi-image.nix still sets
-  # `image.repart.enable = true`; nixpkgs removed that option (importing
-  # image/repart.nix now always defines system.build.image). Declare it so the
-  # definition has somewhere to land. Drop once upstream stops setting it.
-  options.image.repart.enable = lib.mkOption {
-    type = lib.types.bool;
-    default = true;
-    internal = true;
-  };
-
-  config = {
-    hardware.mt7986a-glinet-gl-mt6000.enable = true;
-    hardware.mt7986a-glinet-gl-mt6000.zealous = true;
-    hardware.mt7986a-glinet-gl-mt6000.image.repart.enable = true;
-
-    nixpkgs.hostPlatform.system = "aarch64-linux";
-    nixpkgs.buildPlatform.system = "x86_64-linux";
-
-    system.stateVersion = "26.11";
-    clan.core.sops.defaultGroups = [ "admins" ];
-
-    clan.core.settings.name = "stellio";
-    clan.core.settings.machine.description = "Flint-2 router";
-  };
-}

machines/stellio/disko.nix

@@ -1,13 +0,0 @@
-{ inputs, ... }:
-{
-  disko = {
-    imageBuilder = {
-      # Avoid double emulation to significantly speed up image building process.
-      # Update the system according to your host system.
-      # See https://github.com/nix-community/disko/issues/856
-      qemu =
-        inputs.nixpkgs.legacyPackages.x86_64-linux.qemu
-        + "/bin/qemu-system-aarch64 -M virt -cpu cortex-a57";
-    };
-  };
-}

machines/tangra/configuration.nix

@@ -1,32 +0,0 @@
-{
-  system.stateVersion = "25.11";
-  nixpkgs.hostPlatform = {
-    system = "x86_64-linux";
-  };
-
-  clan.core.settings.name = "tangra";
-  clan.core.settings.machine.description =
-    "A Hetzner VPS machine own by Alex. This is a machine for poyfestival.com";
-
-  clan.core.sops.defaultGroups = [ "admins" ];
-
-  clan.core.vars.generators.acme = {
-    share = true;
-    files.email.secret = false;
-
-    prompts.email = {
-      type = "line";
-      description = "Email for ACME registeration";
-    };
-
-    script = ''
-      cat $prompts/email > $out/email
-    '';
-  };
-
-  users.users.nginx.extraGroups = [ "acme" ];
-
-  security.acme.acceptTerms = true;
-
-  imports = [ ];
-}

machines/tangra/disko.nix

@@ -1,86 +0,0 @@
-{ ... }:
-let
-  hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
-  os = "/dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_119349241";
-in
-{
-
-  boot.loader = {
-    systemd-boot = {
-      enable = true;
-    };
-    efi = {
-      canTouchEfiVariables = true;
-    };
-  };
-
-  boot.zfs.forceImportRoot = true;
-
-  disko.devices = {
-    disk = {
-      "os-${hashDisk os}" = {
-        type = "disk";
-        device = os;
-        content = {
-          type = "gpt";
-          partitions = {
-            ESP = {
-              size = "1G";
-              type = "EF00";
-              content = {
-                type = "filesystem";
-                format = "vfat";
-                mountpoint = "/boot";
-                mountOptions = [ "nofail" ];
-              };
-            };
-            system = {
-              size = "100%";
-              content = {
-                type = "zfs";
-                pool = "zroot";
-              };
-            };
-          };
-        };
-      };
-    };
-    zpool = {
-      zroot = {
-        type = "zpool";
-        rootFsOptions = {
-          mountpoint = "none";
-          compression = "lz4";
-          acltype = "posixacl";
-          xattr = "sa";
-          "com.sun:auto-snapshot" = "true";
-        };
-        options.ashift = "12";
-        datasets = {
-          "root" = {
-            type = "zfs_fs";
-            options.mountpoint = "none";
-          };
-          "root/nixos" = {
-            type = "zfs_fs";
-            options.mountpoint = "/";
-            mountpoint = "/";
-          };
-          "root/home" = {
-            type = "zfs_fs";
-            options.mountpoint = "/home";
-            mountpoint = "/home";
-          };
-          "root/tmp" = {
-            type = "zfs_fs";
-            mountpoint = "/tmp";
-            options = {
-              mountpoint = "/tmp";
-              sync = "disabled";
-            };
-          };
-        };
-      };
-    };
-  };
-}

machines/vega/configuration.nix

@@ -1,59 +0,0 @@
-{
-  inputs,
-  config,
-  self,
-  ...
-}:
-{
-  imports = [
-    self.nixosModules.common
-
-    (inputs.import-tree ./services)
-
-  ];
-
-  clan.core.sops.defaultGroups = [ "admins" ];
-
-  clan.core.settings.machine.description = "Glom NAS";
-
-  nixpkgs.hostPlatform = {
-    system = "x86_64-linux";
-  };
-
-  clan.core.vars.generators.vega-public-domain = {
-    files.name.secret = false;
-
-    prompts = {
-      name = {
-        persist = true;
-        type = "line";
-        description = "Base public domain for Vega machine. Default:(glomglom.fun)";
-      };
-    };
-
-    script = ''cat $prompts/name || echo -n "glomglom.fun" > $out/name'';
-  };
-
-  clan.core.vars.generators.vega-internal-domain = {
-    files.name.secret = false;
-
-    prompts = {
-      name = {
-        persist = true;
-        type = "line";
-        description = "Base internal domain for Vega machine. Default:(glom.newedge.house)";
-      };
-    };
-
-    script = ''cat $prompts/name || echo -n "glom.newedge.house" > $out/name'';
-  };
-
-  networking.fqdn = config.clan.core.vars.generators.vega-internal-domain.files.name.value;
-  system.stateVersion = "25.11";
-
-  # security.acme.defaults.email = "admin@b4l.co.th";
-  # security.acme.acceptTerms = true;
-  # services.nginx.virtualHosts."${config.networking.fqdn}" = {
-  #   enableACME = true;
-  # };
-}

machines/vega/disko.nix

@@ -1,143 +0,0 @@
-{ lib, ... }:
-let
-  hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
-  os = "/dev/disk/by-id/mmc-CUTB42_0x95d14f9e";
-  vdev = [
-    "/dev/disk/by-id/ata-ST20000NM002H-3KV133_ZYD5RYRG"
-    "/dev/disk/by-id/ata-ST20000NM002H-3KV133_ZYD5S02X"
-  ];
-in
-{
-
-  boot.loader = {
-    systemd-boot = {
-      enable = true;
-    };
-    efi = {
-      canTouchEfiVariables = true;
-    };
-  };
-
-  boot.zfs.forceImportRoot = true;
-
-  disko.devices = {
-    disk = {
-      "os-${hashDisk os}" = {
-        type = "disk";
-        device = os;
-        content = {
-          type = "gpt";
-          partitions = {
-            ESP = {
-              size = "1G";
-              type = "EF00";
-              content = {
-                type = "filesystem";
-                format = "vfat";
-                mountpoint = "/boot";
-                mountOptions = [ "nofail" ];
-              };
-            };
-            system = {
-              size = "100%";
-              content = {
-                type = "zfs";
-                pool = "zroot";
-              };
-            };
-            swap = {
-              size = "16G";
-              content = {
-                type = "swap";
-              };
-            };
-          };
-        };
-      };
-    }
-    // (lib.listToAttrs (
-      map (disk: {
-        name = "data-${hashDisk disk}";
-        value = {
-          type = "disk";
-          device = disk;
-          content = {
-            type = "zfs";
-            pool = "zdata";
-          };
-        };
-      }) vdev
-    ));
-    zpool = {
-      zroot = {
-        type = "zpool";
-        rootFsOptions = {
-          mountpoint = "none";
-          compression = "lz4";
-          acltype = "posixacl";
-          xattr = "sa";
-          "com.sun:auto-snapshot" = "true";
-        };
-        options.ashift = "12";
-        datasets = {
-          "root" = {
-            type = "zfs_fs";
-            options.mountpoint = "none";
-          };
-          "root/nixos" = {
-            type = "zfs_fs";
-            options.mountpoint = "/";
-            mountpoint = "/";
-          };
-          "root/home" = {
-            type = "zfs_fs";
-            options.mountpoint = "/home";
-            mountpoint = "/home";
-          };
-          "root/tmp" = {
-            type = "zfs_fs";
-            mountpoint = "/tmp";
-            options = {
-              mountpoint = "/tmp";
-              sync = "disabled";
-            };
-          };
-        };
-      };
-      zdata = {
-        type = "zpool";
-        options.ashift = "12";
-        rootFsOptions = {
-          mountpoint = "none";
-          compression = "lz4";
-          acltype = "posixacl";
-          xattr = "sa";
-          "com.sun:auto-snapshot" = "true";
-        };
-        mode = {
-          topology = {
-            type = "topology";
-            vdev = [
-              {
-                mode = "mirror";
-                members = vdev;
-              }
-            ];
-          };
-        };
-        datasets = {
-          "nas" = {
-            type = "zfs_fs";
-            mountpoint = "/mnt/hdd";
-            mountOptions = [ "nofail" ];
-          };
-          "service-data" = {
-            type = "zfs_fs";
-            mountpoint = "/var/lib";
-            mountOptions = [ "nofail" ];
-          };
-        };
-      };
-    };
-  };
-}

machines/vega/services/samba.nix

@@ -1,93 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}:
-let
-  sambaUser = lib.filterAttrs (
-    name: user: user.isNormalUser && builtins.elem "samba" user.extraGroups
-  ) config.users.users;
-
-  sharedFolders = {
-    GLOM.users = [
-      "w"
-      "kurogeek"
-      "berwn"
-    ];
-  };
-in
-{
-
-  services.samba = {
-    enable = true;
-    openFirewall = true;
-    settings = {
-      global = {
-        security = "user";
-        workgroup = "WORKGROUP";
-        "server string" = "Glom Vega";
-        interfaces = "eth* en*";
-        "max log size" = "50";
-        "dns proxy" = false;
-        "syslog only" = true;
-        "map to guest" = "Bad User";
-        "guest account" = "nobody";
-      };
-    }
-    // lib.mapAttrs (share: opts: {
-      path = "/mnt/hdd/samba/${share}";
-      comment = share;
-      "force user" = share;
-      "force group" = share;
-      public = "yes";
-      "guest ok" = "yes";
-      "create mask" = "0640";
-      "directory mask" = "0750";
-      writable = "no";
-      browseable = "yes";
-      printable = "no";
-      # TODO
-      # "valid users" = toString opts.users;
-    }) sharedFolders;
-  };
-
-  users.users = lib.mapAttrs (share: opts: {
-    isSystemUser = true;
-    group = share;
-  }) sharedFolders;
-
-  users.groups = lib.mapAttrs (share: opts: { }) sharedFolders;
-
-  systemd.services.samba-smbd.postStart =
-    lib.concatMapStrings (
-      user:
-      let
-        password = config.clan.core.vars.generators."${user}-smb-password".files.password.path;
-      in
-      ''
-        mkdir -p /mnt/hdd/samba/${user}
-        chown ${user}:users /mnt/hdd/samba/${user}
-        # if a password is unchanged, this will error
-        (echo $(<${password}); echo $(<${password})) | ${config.services.samba.package}/bin/smbpasswd -s -a ${user}
-      ''
-    ) (lib.attrNames sambaUser)
-    + lib.concatMapStrings (share: ''
-      mkdir -p /mnt/hdd/samba/${share}
-      chown ${share}:${share} /mnt/hdd/samba/${share}
-    '') (lib.attrNames sharedFolders);
-
-  services.samba-wsdd = {
-    enable = true;
-    openFirewall = true;
-  };
-
-  services.avahi = {
-    publish.enable = true;
-    publish.userServices = true;
-    # ^^ Needed to allow samba to automatically register mDNS records (without the need for an `extraServiceFile`
-    nssmdns4 = true;
-    # ^^ Not one hundred percent sure if this is needed- if it aint broke, don't fix it
-    enable = true;
-    openFirewall = true;
-  };
-}

modules/clan/actual-budget/default.nix

@@ -3,11 +3,9 @@
   _class = "clan.service";
   manifest.name = "actual-budget";
   manifest.description = "A local-first personal finance app ";
-  manifest.readme = "A local-first personal finance app";
   manifest.categories = [ "System" ];
 
   roles.default = {
-    description = "A default server role.";
 
     perInstance.nixosModule =
       {

modules/clan/actual-budget/flake-module.nix

@@ -10,7 +10,7 @@ in
   perSystem =
     { ... }:
     {
-      clan.nixosTests.service-actual-budget = {
+      clan.nixosTests.actual-budget = {
         imports = [ ./tests/vm/default.nix ];
 
         clan.modules."@clan/actual-budget" = module;

modules/clan/actual-budget/tests/vm/default.nix

@@ -5,7 +5,6 @@
   name = "service-actual-budget";
 
   clan = {
-    test.useContainers = false;
     directory = ./.;
     inventory = {
       machines.server = { };

modules/clan/apple-network/README.md

@@ -1,3 +0,0 @@
-# Apple Network
-
-This service allows atalkd instances to connect to each other over vxlan over Yggdrasil. We need to use vxlan due to the support of broadcasting it provides. The service will form a network of star-topology vxlan using the underlying Yggdrasil network. With this vxlan network, we can have a private Apple Talk network over the internet.

modules/clan/apple-network/default.nix

@@ -1,139 +0,0 @@
-{ clanLib, ... }:
-{
-  _class = "clan.service";
-  manifest.name = "apple-network";
-  manifest.description = "This service will create an instance of `atalkd` for each peer to talk to Apple machines over Apple Talk protocol and automatically connect each peer using vxlan over Yggdrasil network to achieve Apple Talk over internet experience";
-  manifest.readme = builtins.readFile ./README.md;
-  manifest.categories = [ "Network" ];
-
-  roles.peer = {
-    description = "A gateway machine that allow classic Apple machines to connect to other Apple machines over the internet";
-
-    interface =
-      { lib, ... }:
-      {
-        options = {
-          zone_name = lib.mkOption {
-            type = with lib.types; str;
-            description = "Zone name for Apple Talk protocol";
-            default = "Default";
-          };
-        };
-      };
-
-    perInstance =
-      { roles, settings, ... }:
-      {
-        nixosModule =
-          {
-            lib,
-            config,
-            pkgs,
-            ...
-          }:
-          let
-            vxlanPort = 4789;
-
-            getYggdrasilIP =
-              machineName:
-              if config.clan.core.vars.generators.yggdrasil.files.address ? value then
-                clanLib.getPublicValue {
-                  flake = config.clan.core.settings.directory;
-                  machine = machineName;
-                  generator = "yggdrasil";
-                  file = "address";
-                  default = null;
-                }
-              else
-                throw "clanService/yggdrasil is required";
-
-            noSelfPeers = builtins.filter (peerName: peerName != config.clan.core.settings.machine.name) (
-              lib.mapAttrsToList (machineName: _: machineName) roles.peer.machines
-            );
-
-            sortedPeers = builtins.sort (x: y: x < y) (
-              lib.mapAttrsToList (machineName: _: machineName) roles.peer.machines
-            );
-
-            getMachineIndex = machineName: lib.lists.findFirstIndex (x: x == machineName) null sortedPeers;
-
-            selfVXAddress = "192.168.254.${
-              lib.toString ((getMachineIndex config.clan.core.settings.machine.name) + 1)
-            }/24";
-          in
-          {
-
-            services.atalkd = {
-              enable = true;
-              interfaces = {
-                vxlan.config = ''
-                  -router -phase 2 -net 1 -zone "${settings.zone_name}"
-                '';
-              };
-            };
-
-            networking.useNetworkd = true;
-
-            networking.firewall.interfaces."ygg".allowedUDPPorts = [ vxlanPort ];
-
-            boot.kernelModules = [ "vxlan" ];
-
-            systemd.network.netdevs =
-              builtins.listToAttrs (
-                map (
-                  peerName:
-                  (lib.nameValuePair "10-apl-vxlan-${peerName}" {
-                    enable = true;
-                    netdevConfig = {
-                      Name = "vxlan-${peerName}";
-                      Kind = "vxlan";
-                    };
-                    vxlanConfig = {
-                      VNI = (getMachineIndex config.clan.core.settings.machine.name) + (getMachineIndex peerName);
-                      Remote = getYggdrasilIP peerName;
-                      DestinationPort = vxlanPort;
-                      Independent = true;
-                    };
-                  })
-                ) noSelfPeers
-              )
-              // {
-                "10-apl-vxlan" = {
-                  enable = true;
-                  netdevConfig = {
-                    Kind = "bridge";
-                    Name = "vxlan";
-                  };
-                  bridgeConfig = {
-                    STP = true;
-                  };
-                };
-              };
-
-            systemd.network.networks =
-              builtins.listToAttrs (
-                map (
-                  peerName:
-                  (lib.nameValuePair "10-apl-vxlan-${peerName}" {
-                    enable = true;
-                    matchConfig.Name = "vxlan-${peerName}";
-                    networkConfig.Bridge = "vxlan";
-                  })
-                ) noSelfPeers
-              )
-              // {
-                "10-apl-vxlan" = {
-                  enable = true;
-                  matchConfig.Name = "vxlan";
-                  address = [ selfVXAddress ];
-                };
-              };
-
-            environment.systemPackages = [
-              pkgs.netatalk
-              pkgs.bridge-utils
-            ];
-          };
-      };
-  };
-}

modules/clan/apple-network/flake-module.nix

@@ -1,19 +0,0 @@
-{ inputs, self, ... }:
-let
-  module = ./default.nix;
-in
-{
-  clan.modules = {
-    apple-network = module;
-  };
-  perSystem =
-    { ... }:
-    {
-      clan.nixosTests.service-apple-network = {
-        imports = [ ./tests/vm/default.nix ];
-        _module.args = { inherit self inputs; };
-
-        clan.modules."@clan/apple-network" = module;
-      };
-    };
-}

modules/clan/apple-network/tests/vm/default.nix

@@ -1,76 +0,0 @@
-{
-  self,
-  lib,
-  config,
-  hostPkgs,
-  ...
-}:
-{
-  name = "service-apple-network";
-
-  result.update-vars =
-    let
-      relativeDir = lib.removePrefix "${self}/" (toString config.clan.directory);
-    in
-    hostPkgs.writeShellScriptBin "update-vars" ''
-      set -x
-      export PRJ_ROOT=$(git rev-parse --show-toplevel)
-      ${
-        self.inputs.clan-core.packages.${hostPkgs.system}.clan-cli
-      }/bin/clan-generate-test-vars $PRJ_ROOT/${relativeDir} ${config.name}
-    '';
-
-  clan = {
-    directory = ./.;
-    test.useContainers = false;
-
-    inventory = {
-      meta.domain = "test.clan";
-
-      machines.peer1 = { };
-      machines.peer2 = { };
-      machines.peer3 = { };
-
-      instances = {
-        apple-network = {
-          module.name = "@clan/apple-network";
-          module.input = "self";
-          roles.peer.machines = {
-            peer1 = { };
-            peer2 = { };
-            peer3 = { };
-          };
-        };
-        yggdrasil = {
-          module.name = "yggdrasil";
-          roles.default.tags.all = { };
-          roles.default.settings.extraPeers = [
-            "tls://ygg.jjolly.dev:3443"
-            "tls://[2602:fc24:18:7a42::1]:993"
-            "tcp://leo.node.3dt.net:9002"
-            "tcp://ygg-kcmo.incognet.io:8883"
-          ];
-        };
-      };
-    };
-  };
-
-  nodes = {
-    peer1 = { };
-    peer2 = { };
-    peer3 = { };
-  };
-
-  testScript = _: ''
-    # cannot test connectivity due to Yggdrasil's establishment
-    start_all()
-    peer1.wait_for_unit("atalkd")
-    peer1.succeed("systemctl status atalkd")
-
-    peer2.wait_for_unit("atalkd")
-    peer2.succeed("systemctl status atalkd")
-
-    peer3.wait_for_unit("atalkd")
-    peer3.succeed("systemctl status atalkd")
-  '';
-}

modules/clan/apple-network/tests/vm/sops/machines/peer1/key.json

@@ -1,6 +0,0 @@
-[
-  {
-    "publickey": "age1f92zl8y70z5w9gn0l5leg2fhyvxy6m93dfh7n6ltgvuu9nyg6epsrw6t8x",
-    "type": "age"
-  }
-]

modules/clan/apple-network/tests/vm/sops/machines/peer2/key.json

@@ -1,6 +0,0 @@
-[
-  {
-    "publickey": "age1u36fr87cru90vfznf5szasya9nhvvseh4atk8zsdj0rrsu0nnvwqsyt8g6",
-    "type": "age"
-  }
-]

modules/clan/apple-network/tests/vm/sops/machines/peer3/key.json

@@ -1,6 +0,0 @@
-[
-  {
-    "publickey": "age1rka3368ltqc787xw99uu762lqfk7qxld9265u2t62fpxnp9xhufsc2q5rw",
-    "type": "age"
-  }
-]

modules/clan/apple-network/tests/vm/sops/secrets/peer1-age.key/secret

@@ -1,14 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:hC4Lle6mXuTFq//wBHUTyH3X778u/gYJSXJOiQ7xUb+gnC8beH1olxL2ZhtUiMkktzhsPM/j6cxhltPp25UTeJnUOcoYesqZcp8=,iv:WOx2P2Cu4v58xM9ePjAw1gdA0fFnGG2UqEXH2iksGoo=,tag:43n1ibVSy2AeS9f5qQBKNQ==,type:str]",
-	"sops": {
-		"age": [
-			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtT244N1Q3Zk9pRjFFQlUr\ncDExSTBwSWk5UXVyMjhWclQwSFZaYnpTRFY0CnE5YStVdzMrS3BKYzYvc3V3QVFY\nbDVwVytoNERveU1xQllqNUFGV2hYbGMKLS0tIDJSUmkwMUQzL3Y0MU5qZTJ3eFN3\nNGdwamM1UDBPdzhvSWsyZzR6anZ0eFEKKnr1/7rf3fH1i7KUoZdilLDgb44K2qzn\nI9Y+7FbV4gzQUzKWjAQeFN37Z4Qiuy0xJVA0lw8KvM+NCxSZDfh3kw==\n-----END AGE ENCRYPTED FILE-----\n",
-				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg"
-			}
-		],
-		"lastmodified": "2026-07-03T10:46:56Z",
-		"mac": "ENC[AES256_GCM,data:hmpbOtra6EyNiPg7EsA3F4elHEO87JPUr4VKVppvzUwLX1HSj67WrU6k3rEoJT+k7Hq1lxnAzDEckSG1fUOap11rk8ksp1IAGR0+yqykC/Qj/Nl8wXqP84gr49bJK6xE/DDdCRCcBff2d6IpnehyEr8fGFEZbWGygblec8U8GPo=,iv:+M1C3rL22foowr0VD80jwrNFb5xz4k5JQ/DJm4ThKHk=,tag:wabFAC5NTCVGfIQQzm0yGg==,type:str]",
-		"version": "3.13.1"
-	}
-}

modules/clan/apple-network/tests/vm/sops/secrets/peer1-age.key/users/admin

@@ -1 +0,0 @@
-../../../users/admin

modules/clan/apple-network/tests/vm/sops/secrets/peer2-age.key/secret

@@ -1,14 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:ndWIEOqP2ybCN7Ak5g+8q3YG5rLQ7OuSv/vCbnMA8AK6Lby2JMGRkRGysqJdyEF7eh4w7PpZ/AtKPtPbUucjeTB5+8g76PPJTBE=,iv:EYy0GGqEBmIc5rSWP7Zleb5eQ0JzTz84HqeJPpCSpxk=,tag:iMgTUb9+wxE9S2kKoOEvsQ==,type:str]",
-	"sops": {
-		"age": [
-			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQTEF6OXN4K0dHdXhWWmt2\neG5wdkNIc2F0UnFEeHFLQkdTWkFpUWhTa0NBCmw2N2J1T0FJVE9JR3VBRWV0THh5\nVEZlbVZrcXAwK3BsYXFOZUF6c3lRSkUKLS0tIFRCQzNUaGFHdERWNWR4enVWRGpx\nbDEzRU9jWHgxWHovaENjbkFlZERIbkkKvAW31gTJg9izrWuAMeDHS9SWPQYtxRBY\necDCn8QORFrnDdxEusCnGJrAU4kmS3Y3CwSHCtEijs3JdIgg9wl/MA==\n-----END AGE ENCRYPTED FILE-----\n",
-				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg"
-			}
-		],
-		"lastmodified": "2026-07-03T10:47:04Z",
-		"mac": "ENC[AES256_GCM,data:y1U2vsdqR97fPAnp6iZiLY1KbWYmgDqgZ5bwIkWPCr7Gjjrn+qV+sc2T1BTVz3Zo0JOz4ScCc+f6snVsFKdCDU/NmDVFt/sqyH4NHUPRQ3StsQim8C7IkSwUtm3EhrqpLYFD21MEjrYYdHMHbWybxrOI0qI6mDwZymHJFeCLdQA=,iv:lVvPn69eQE/huwDmwePepfpi2l9ZOPQO7W20o4AJBFQ=,tag:7VPfjKZsBVJTZxNwTcI6sg==,type:str]",
-		"version": "3.13.1"
-	}
-}

modules/clan/apple-network/tests/vm/sops/secrets/peer2-age.key/users/admin

@@ -1 +0,0 @@
-../../../users/admin

modules/clan/apple-network/tests/vm/sops/secrets/peer3-age.key/secret

@@ -1,14 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:JPdetkhtF9eSmgEfCO2exXlGQ5KWLeIM3mnW5BfyTY8r0PxWSEGAwBskC1SiDdRERWB2VEbPiPgCNXMnGaYlDqSdZN6R9wSFvsQ=,iv:qGveNhUtgxvKnmdsPoPpffKyi5srlq0Pd6aW283B5C0=,tag:TcJsCrBlzfjXvztcRaxYFQ==,type:str]",
-	"sops": {
-		"age": [
-			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvdjNHa1RlcFJHazB5TXFu\nOUQ4REpCZm5Yc3ZhcVhwT1FqRHlvbnoxZWlFCnNrVUEyK2ZYSmlacmJ2b2QrclZl\nSDV1eWxXVmJxZlhMMXgrTWtjcjVhQlkKLS0tIHZPN3pCUVBLQmpRVGx6SDBQNDZo\nSitheGhXNGl5QW9HTGNsTTdTdWVwaE0KfuM5xZOPbR1lxkJPJUOVrtlW5Ujobemp\nid40reDqxKQxP3khJv8lf9ZoN8LAx2Iwh0DeAl+UJpsoVWgS7uI2qQ==\n-----END AGE ENCRYPTED FILE-----\n",
-				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg"
-			}
-		],
-		"lastmodified": "2026-07-07T04:54:10Z",
-		"mac": "ENC[AES256_GCM,data:Tt8yqzfAnSDe2n7KDt1Z/D73hkS1w7DsqIh+s5WljLzar9PEt5vUCLb8DIvBwITyzGAoHH1ym3v3NrnJWCdxajKExTMBf4aY3MJCtykeCG37701S/KxumjTW9/fJw74gcET5I6NafTWb6H5XHsrRaQX1Xnspcs8B7uLGZZ28dSM=,iv:Fo5UPVhnjuOx6Cp4grofHOiD2pm0TXuRRuoTwvxKn1s=,tag:VQ/TF1TiyJADj7/3RwPCAg==,type:str]",
-		"version": "3.13.1"
-	}
-}

modules/clan/apple-network/tests/vm/sops/secrets/peer3-age.key/users/admin

@@ -1 +0,0 @@
-../../../users/admin