mob next [ci-skip] [ci skip] [skip ci]

lastFile:flake.nix
2026-03-16 17:06:56 +07:00 · 2026-03-16 15:49:49 +07:00 · 2026-03-16 15:43:28 +07:00 · 2026-03-06 16:31:26 +07:00 · 2026-03-06 16:25:41 +07:00 · 2026-03-05 19:52:26 +07:00
596 changed files with 42092 additions and 202 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -2,4 +2,4 @@
 # Ignore build outputs from performing a nix-build or `nix build` command
 result
 result-*
-
+run-vm-*
--- a/flake.lock
+++ b/flake.lock
@@ -9,7 +9,6 @@
        ],
        "nix-darwin": "nix-darwin",
        "nix-select": "nix-select",
-        "nixos-facter-modules": "nixos-facter-modules",
        "nixpkgs": [
          "nixpkgs"
        ],
@@ -20,11 +19,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1754535625,
-        "narHash": "sha256-RdT3/DskBjwx74cvHJHb/mLSO2XeSHitSYViNmYGU/k=",
+        "lastModified": 1772411144,
+        "narHash": "sha256-WhXudztwPNnKXaqGX4DOqNfHzHdBSiGCvKGHM20pscw=",
        "ref": "refs/heads/main",
-        "rev": "f69e28a1333527cdbadb233966a7e19d4b35a1a3",
-        "revCount": 8886,
+        "rev": "92cc85bc24eb31ce5725e1e72753129810ce3fe9",
+        "revCount": 13201,
        "type": "git",
        "url": "https://git.clan.lol/clan/clan-core"
      },
@@ -49,11 +48,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1753067306,
-        "narHash": "sha256-jyoEbaXa8/MwVQ+PajUdT63y3gYhgD9o7snO/SLaikw=",
-        "rev": "18dfd42bdb2cfff510b8c74206005f733e38d8b9",
+        "lastModified": 1772273147,
+        "narHash": "sha256-Wzhoc6ifjTDZi8aVRH3fuLJPdd4ouNTTwwVhgoMcMek=",
+        "rev": "d5de7a8d9e5726e678c94e62fe8ac3a809fee5da",
        "type": "tarball",
-        "url": "https://git.clan.lol/api/v1/repos/clan/data-mesher/archive/18dfd42bdb2cfff510b8c74206005f733e38d8b9.tar.gz"
+        "url": "https://git.clan.lol/api/v1/repos/clan/data-mesher/archive/d5de7a8d9e5726e678c94e62fe8ac3a809fee5da.tar.gz"
      },
      "original": {
        "type": "tarball",
@@ -88,11 +87,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1753140376,
-        "narHash": "sha256-7lrVrE0jSvZHrxEzvnfHFE/Wkk9DDqb+mYCodI5uuB8=",
+        "lastModified": 1771881364,
+        "narHash": "sha256-A5uE/hMium5of/QGC6JwF5TGoDAfpNtW00T0s9u/PN8=",
        "owner": "nix-community",
        "repo": "disko",
-        "rev": "545aba02960caa78a31bd9a8709a0ad4b6320a5c",
+        "rev": "a4cb7bf73f264d40560ba527f9280469f1f081c6",
        "type": "github"
      },
      "original": {
@@ -121,6 +120,26 @@
        "type": "github"
      }
    },
+    "home-manager": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1768068402,
+        "narHash": "sha256-bAXnnJZKJiF7Xr6eNW6+PhBf1lg2P1aFUO9+xgWkXfA=",
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "rev": "8bc5473b6bc2b6e1529a9c4040411e1199c43b4c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "type": "github"
+      }
+    },
    "import-tree": {
      "locked": {
        "lastModified": 1752730890,
@@ -136,6 +155,22 @@
        "type": "github"
      }
    },
+    "liminix": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1773253359,
+        "narHash": "sha256-LogvYVd2NfZnTlxAkl5K9tqX9c7wEEPdnYJsW9WTSG4=",
+        "ref": "refs/heads/main",
+        "rev": "7f23c5dc0f442de9fe07c076297c3a74f2a34e72",
+        "revCount": 1656,
+        "type": "git",
+        "url": "https://gti.telent.net/dan/liminix"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://gti.telent.net/dan/liminix"
+      }
+    },
    "nix-darwin": {
      "inputs": {
        "nixpkgs": [
@@ -144,11 +179,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1751313918,
-        "narHash": "sha256-HsJM3XLa43WpG+665aGEh8iS8AfEwOIQWk3Mke3e7nk=",
+        "lastModified": 1772379624,
+        "narHash": "sha256-NG9LLTWlz4YiaTAiRGChbrzbVxBfX+Auq4Ab/SWmk4A=",
        "owner": "nix-darwin",
        "repo": "nix-darwin",
-        "rev": "e04a388232d9a6ba56967ce5b53a8a6f713cdfcf",
+        "rev": "52d061516108769656a8bd9c6e811c677ec5b462",
        "type": "github"
      },
      "original": {
@@ -159,39 +194,24 @@
    },
    "nix-select": {
      "locked": {
-        "lastModified": 1745005516,
-        "narHash": "sha256-IVaoOGDIvAa/8I0sdiiZuKptDldrkDWUNf/+ezIRhyc=",
-        "rev": "69d8bf596194c5c35a4e90dd02c52aa530caddf8",
+        "lastModified": 1763303120,
+        "narHash": "sha256-yxcNOha7Cfv2nhVpz9ZXSNKk0R7wt4AiBklJ8D24rVg=",
+        "rev": "3d1e3860bef36857a01a2ddecba7cdb0a14c35a9",
        "type": "tarball",
-        "url": "https://git.clan.lol/api/v1/repos/clan/nix-select/archive/69d8bf596194c5c35a4e90dd02c52aa530caddf8.tar.gz"
+        "url": "https://git.clan.lol/api/v1/repos/clan/nix-select/archive/3d1e3860bef36857a01a2ddecba7cdb0a14c35a9.tar.gz"
      },
      "original": {
        "type": "tarball",
        "url": "https://git.clan.lol/clan/nix-select/archive/main.tar.gz"
      }
    },
-    "nixos-facter-modules": {
-      "locked": {
-        "lastModified": 1750412875,
-        "narHash": "sha256-uP9Xxw5XcFwjX9lNoYRpybOnIIe1BHfZu5vJnnPg3Jc=",
-        "owner": "nix-community",
-        "repo": "nixos-facter-modules",
-        "rev": "14df13c84552a7d1f33c1cd18336128fbc43f920",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "nixos-facter-modules",
-        "type": "github"
-      }
-    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1754278406,
-        "narHash": "sha256-jvIQTMN5EzoOP5RaGztpVese8a3wqy0M/h6tNzycW28=",
+        "lastModified": 1772173633,
+        "narHash": "sha256-MOH58F4AIbCkh6qlQcwMycyk5SWvsqnS/TCfnqDlpj4=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "6a489c9482ca676ce23c0bcd7f2e1795383325fa",
+        "rev": "c0f3d81a7ddbc2b1332be0d8481a672b4f6004d6",
        "type": "github"
      },
      "original": {
@@ -201,13 +221,40 @@
        "type": "github"
      }
    },
+    "openwrt-imagebuilder": {
+      "inputs": {
+        "flake-parts": [
+          "flake-parts"
+        ],
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "systems": "systems_2"
+      },
+      "locked": {
+        "lastModified": 1773564448,
+        "narHash": "sha256-RdhwMI7cAMa0bHkBIG2j1GVTYMEiZOqHWNpNV5nWgdo=",
+        "owner": "astro",
+        "repo": "nix-openwrt-imagebuilder",
+        "rev": "e7c0890d1c740dfd0c0bb2d1dc1703acde60a25f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "astro",
+        "repo": "nix-openwrt-imagebuilder",
+        "type": "github"
+      }
+    },
    "root": {
      "inputs": {
        "clan-core": "clan-core",
        "devshell": "devshell",
        "flake-parts": "flake-parts",
+        "home-manager": "home-manager",
        "import-tree": "import-tree",
+        "liminix": "liminix",
        "nixpkgs": "nixpkgs",
+        "openwrt-imagebuilder": "openwrt-imagebuilder",
        "treefmt-nix": "treefmt-nix"
      }
    },
@@ -219,11 +266,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1754328224,
-        "narHash": "sha256-glPK8DF329/dXtosV7YSzRlF4n35WDjaVwdOMEoEXHA=",
+        "lastModified": 1772340640,
+        "narHash": "sha256-1nq7+Kt5IUBD8Hu3nptVPbMf+22rNJoHT0t9L1X+GKA=",
        "owner": "Mic92",
        "repo": "sops-nix",
-        "rev": "49021900e69812ba7ddb9e40f9170218a7eca9f4",
+        "rev": "dec4d8eac700dcd2fe3c020857d3ee220ec147f1",
        "type": "github"
      },
      "original": {
@@ -247,6 +294,21 @@
        "type": "github"
      }
    },
+    "systems_2": {
+      "locked": {
+        "lastModified": 1680978846,
+        "narHash": "sha256-Gtqg8b/v49BFDpDetjclCYXm8mAnTrUzR0JnE2nv5aw=",
+        "owner": "nix-systems",
+        "repo": "x86_64-linux",
+        "rev": "2ecfcac5e15790ba6ce360ceccddb15ad16d08a8",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "x86_64-linux",
+        "type": "github"
+      }
+    },
    "treefmt-nix": {
      "inputs": {
        "nixpkgs": [
@@ -254,11 +316,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1752055615,
-        "narHash": "sha256-19m7P4O/Aw/6+CzncWMAJu89JaKeMh3aMle1CNQSIwM=",
+        "lastModified": 1768158989,
+        "narHash": "sha256-67vyT1+xClLldnumAzCTBvU0jLZ1YBcf4vANRWP3+Ak=",
        "owner": "numtide",
        "repo": "treefmt-nix",
-        "rev": "c9d477b5d5bd7f26adddd3f96cfd6a904768d4f9",
+        "rev": "e96d59dff5c0d7fddb9d113ba108f03c3ef99eca",
        "type": "github"
      },
      "original": {
--- a/flake.nix
+++ b/flake.nix
@@ -15,12 +15,25 @@
      inputs.nixpkgs-lib.follows = "nixpkgs";
      url = "github:hercules-ci/flake-parts";
    };
+    home-manager = {
+      inputs.nixpkgs.follows = "nixpkgs";
+      url = "github:nix-community/home-manager";
+    };
    import-tree.url = "github:vic/import-tree";
    nixpkgs.url = "github:nixos/nixpkgs/nixpkgs-unstable";
+    openwrt-imagebuilder = {
+      inputs.nixpkgs.follows = "nixpkgs";
+      inputs.flake-parts.follows = "flake-parts";
+      url = "github:astro/nix-openwrt-imagebuilder";
+    };
    treefmt-nix = {
      url = "github:numtide/treefmt-nix";
      inputs.nixpkgs.follows = "nixpkgs";
    };
+    liminix = {
+      url = "git+https://gti.telent.net/dan/liminix";
+      flake = false;
+    };
  };
  outputs =
    {
@@ -38,9 +51,54 @@
          ./shell.nix

          ./machines
+          ./routers
          ./inventories
+          ./overlays
+          ./tests
          ./modules/clan/flake-module.nix
+          ./modules/nixos/flake-module.nix
        ];
+        perSystem =
+          { pkgs, system, ... }:
+          {
+            _module.args.pkgs = import inputs.nixpkgs {
+              inherit system;
+              overlays = [
+                inputs.self.overlays.packagesOverlay
+              ];
+              config = { };
+            };
+            packages.think = pkgs.think-gtcm;
+            packages.think-be = pkgs.think-backend-gtcm;
+            packages.file-uploader = pkgs.gtcm-file-uploader;
+          };
+
+        flake.packages.x86_64-linux.myrouter =
+          let
+            pkgs = inputs.nixpkgs.legacyPackages.x86_64-linux;
+            profiles = inputs.openwrt-imagebuilder.lib.profiles { inherit pkgs; };
+            config = profiles.identifyProfile "glinet_gl-mt6000" // {
+              # add package to include in the image, ie. packages that you don't
+              # want to install manually later
+              packages = [ "tcpdump" ];
+
+              disabledServices = [ "dnsmasq" ];
+
+              # include files in the images.
+              # to set UCI configuration, create a uci-defauts scripts as per
+              # official OpenWRT ImageBuilder recommendation.
+              files = pkgs.runCommand "image-files" { } ''
+                mkdir -p $out/etc/uci-defaults
+                cat > $out/etc/uci-defaults/99-custom <<EOF
+                uci -q batch << EOI
+                set system.@system[0].hostname='testap'
+                commit
+                EOI
+                EOF
+              '';
+            };
+          in
+          inputs.openwrt-imagebuilder.lib.build config;
      }
    );
 }
--- a/inventories/default.nix
+++ b/inventories/default.nix
@@ -1,10 +1,36 @@
 {
+  imports = [
+    ./personal-computer.nix
+    ./emmie.nix
+  ];
  clan = {
    inventory = {

      tags = {
-        glom = [ "vega" ];
-        b4l = [ "rigel" ];
+        glom = [
+          "vega"
+          "ramus"
+        ];
+        w = [ "sirius" ];
+        b4l = [
+          "rigel"
+          "neptune"
+          "rana"
+          "petra"
+        ];
+        phonebox = [
+          "neptune"
+          "rigel"
+          "almach"
+          "alpheratz"
+          "mirach"
+          "adhil"
+          "buna"
+        ];
+        global-network = [
+          "rana"
+          "sirius"
+        ];
      };

      instances = {
@@ -30,6 +56,28 @@
          };
        };

+        tor = {
+          module = {
+            name = "tor";
+            input = "clan-core";
+          };
+          roles.server.tags."nixos" = { };
+        };
+
+        w-network = {
+          module = {
+            name = "zerotier";
+            input = "clan-core";
+          };
+          roles.controller.machines."sirius" = {
+            settings.allowedIps = [
+              #kurogeek
+              "fdfe:7bf:a795:4524:4c99:932b:d36d:b8cc"
+            ];
+          };
+          roles.peer.tags.w = { };
+        };
+
        glom-network = {
          module = {
            name = "zerotier";
@@ -48,6 +96,45 @@
          roles.peer.tags.b4l = { };
        };

+        yggdrasil-global-network = {
+          module = {
+            name = "yggdrasil";
+            input = "clan-core";
+          };
+          roles.default.tags."global-network" = { };
+          roles.default.settings.extraPeers = [
+            "tls://ygg.jjolly.dev:3443"
+            "tls://[2602:fc24:18:7a42::1]:993"
+            "tcp://leo.node.3dt.net:9002"
+            "tcp://ygg-kcmo.incognet.io:8883"
+          ];
+        };
+
+        yggdrasil-phone-network = {
+          module = {
+            name = "yggdrasil";
+            input = "clan-core";
+          };
+          roles.default.tags."phonebox" = { };
+          roles.default.settings.extraPeers = [
+            "tls://ygg.jjolly.dev:3443"
+            "tls://[2602:fc24:18:7a42::1]:993"
+            "tcp://leo.node.3dt.net:9002"
+            "tcp://ygg-kcmo.incognet.io:8883"
+          ];
+        };
+
+        phonebox = {
+          module = {
+            name = "phonebox";
+            input = "self";
+          };
+          roles.default.tags."phonebox" = { };
+          roles.default.machines."adhil".settings = {
+            ata-ethernet-iface = "end0";
+          };
+        };
+
        pocket-id = {
          module = {
            name = "pocket-id";
@@ -97,13 +184,6 @@
          };
          roles.default.machines.b4l = { };
        };
-        pingvin = {
-          module = {
-            name = "pingvin";
-            input = "self";
-          };
-          roles.default.machines.b4l = { };
-        };
        paperless = {
          module = {
            name = "paperless";
@@ -111,6 +191,98 @@
          };
          roles.default.machines.b4l = { };
        };
+        pulse-stream = {
+          module = {
+            name = "pulse-stream";
+            input = "self";
+          };
+          roles.default.machines.neptune = {
+            settings.client-ip-ranges = [
+              "10.0.0.0/24"
+            ];
+          };
+        };
+        jukebox = {
+          module = {
+            name = "jukebox";
+            input = "self";
+          };
+          roles.default.machines.neptune = {
+            settings = {
+              binds = [ "wlp1s0" ];
+              disks.m3 = {
+                uuid = "105D-319E";
+                mountOptions = [ "utf8" ];
+              };
+            };
+          };
+        };
+        git-daemon = {
+          module = {
+            name = "git-daemon";
+            input = "self";
+          };
+          roles.default.machines.neptune = {
+            settings.repositories =
+              let
+                defaults = rec {
+                  write-access = [
+                    "10.0.0.0/24"
+                    "200:d7b1:c5d5:ea7:27ad:6837:40f6:404d/128"
+                  ];
+                  read-access = write-access;
+                };
+                PUBLIC = {
+                  read-access = [
+                    "10.0.0.0/24"
+                    "0200::/7"
+                  ];
+                };
+              in
+              builtins.mapAttrs (_: override: defaults // override) {
+                "9e" = PUBLIC;
+                archive-dl = { };
+                barrytown = { };
+                cleanroom = PUBLIC;
+                community-memory = { };
+                eris = { };
+                ftdi-sd-spi = { };
+                go-go-gadget = { };
+                hacking-the-kindle = { };
+                islands = PUBLIC;
+                kt = { };
+                legba = { };
+                llb = PUBLIC;
+                llc = PUBLIC;
+                lora = { };
+                mute = { };
+                navi = { };
+                notmuch-memoryhole = PUBLIC;
+                pms5003 = { };
+                thinc = PUBLIC;
+                toad = { };
+                yggdrasil-erlang = { };
+              };
+          };
+        };
+
+        samba = {
+          module = {
+            name = "samba";
+            input = "self";
+          };
+          roles.server.machines."sirius".settings = {
+            globalUsers = {
+              w.writePerm = true;
+            };
+            sharedFolders = {
+              WHITEHOUSE = {
+                allowedGuest = true;
+              };
+            };
+            dataDir = "/mnt/hdd/samba";
+          };
+        };
      };
    };
  };
--- a/inventories/emmie.nix
+++ b/inventories/emmie.nix
@@ -0,0 +1,26 @@
+{
+  clan.inventory = {
+    tags = {
+      emmie = [ "rana" ];
+    };
+
+    instances = {
+      emmie-syncthing = {
+        module = {
+          name = "syncthing";
+          input = "clan-core";
+        };
+        roles.peer.tags.emmie = { };
+        roles.peer.settings = {
+          extraDevices = {
+            pixel7a = {
+              id = "CEUJMEG-SOHXIJF-G2FT5QB-6MZW3EN-PONI3QN-HPEIOSU-IMSLGW7-XUU6BQK";
+              name = "eris";
+              addresses = [ "dynamic" ];
+            };
+          };
+        };
+      };
+    };
+  };
+}
--- a/inventories/personal-computer.nix
+++ b/inventories/personal-computer.nix
@@ -0,0 +1,55 @@
+{
+  clan.inventory = {
+    tags = {
+      kde-desktop = [
+        "rana"
+        "petra"
+      ];
+      personal-computer = [
+        "rana"
+        "petra"
+      ];
+    };
+
+    instances = {
+      emmie-home = {
+        module = {
+          name = "home-user";
+          input = "self";
+        };
+        roles.default.settings = {
+          username = "emmie";
+          kbLayout = "us,th";
+          kbOptions = "grp:win_space_toggle,grp:alt_shift_toggle";
+        };
+        roles.default.machines."rana" = { };
+      };
+      chocolate-home = {
+        module = {
+          name = "home-user";
+          input = "self";
+        };
+        roles.default.settings = {
+          username = "chocolate";
+          kbLayout = "us,th";
+          kbOptions = "grp:win_space_toggle,grp:alt_shift_toggle";
+        };
+        roles.default.machines."petra" = { };
+      };
+      personal-computer = {
+        module = {
+          name = "personal-computer";
+          input = "self";
+        };
+        roles.default.tags."personal-computer" = { };
+      };
+      kde = {
+        module = {
+          name = "kde";
+          input = "clan-core";
+        };
+        roles.default.tags."kde-desktop" = { };
+      };
+    };
+  };
+}
--- a/inventory.json
+++ b/inventory.json
@@ -1 +1,34 @@
-{}
+{
+  "machines": {
+    "ramus": {
+      "installedAt": 1764139649
+    },
+    "alpheratz": {
+      "installedAt": 1764741499
+    },
+    "mirach": {
+      "installedAt": 1764744666
+    },
+    "almach": {
+      "installedAt": 1764745787
+    },
+    "neptune": {
+      "installedAt": 1762147067
+    },
+    "adhil": {
+      "installedAt": 1765277591
+    },
+    "buna": {
+      "installedAt": 1765343708
+    },
+    "rana": {
+      "installedAt": 1768294839
+    },
+    "petra": {
+      "installedAt": 1769064458
+    },
+    "sirius": {
+      "installedAt": 1770974584
+    }
+  }
+}
--- a/machines/adhil/configuration.nix
+++ b/machines/adhil/configuration.nix
@@ -0,0 +1,13 @@
+{ ... }:
+{
+  nixpkgs.hostPlatform = {
+    system = "aarch64-linux";
+  };
+  system.stateVersion = "25.11";
+  clan.core.sops.defaultGroups = [ "admins" ];
+  # clan.core.networking.targetHost = "root@";
+
+  clan.core.settings.name = "adhil";
+  # clan.meta.description = "Raspberry Pi 4 SBC board for one of w phone network. (With w office)";
+
+}
--- a/machines/adhil/disko.nix
+++ b/machines/adhil/disko.nix
@@ -0,0 +1,56 @@
+{ ... }:
+let
+  hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
+  os = "/dev/disk/by-id/mmc-SD64G_0xfb330ff6";
+in
+{
+
+  boot.loader = {
+    systemd-boot = {
+      enable = true;
+    };
+    efi = {
+      canTouchEfiVariables = true;
+    };
+  };
+
+  disko.devices = {
+    disk = {
+      "os-${hashDisk os}" = {
+        type = "disk";
+        device = os;
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              end = "500M";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [ "umask=0077" ];
+              };
+            };
+            root = {
+              name = "root";
+              end = "-0";
+              content = {
+                type = "filesystem";
+                format = "f2fs";
+                mountpoint = "/";
+                extraArgs = [
+                  "-O"
+                  "extra_attr,inode_checksum,sb_checksum,compression"
+                ];
+                mountOptions = [
+                  "compress_algorithm=zstd:6,compress_chksum,atgc,gc_merge,lazytime,nodiscard"
+                ];
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+}
--- a/machines/adhil/facter.json
+++ b/machines/adhil/facter.json
--- a/machines/almach/configuration.nix
+++ b/machines/almach/configuration.nix
@@ -0,0 +1,13 @@
+{ config, ... }:
+{
+  nixpkgs.hostPlatform = {
+    system = "x86_64-linux";
+  };
+  system.stateVersion = "25.11";
+  clan.core.sops.defaultGroups = [ "admins" ];
+  # clan.core.networking.targetHost = "root@";
+
+  clan.core.settings.name = "almach";
+  # clan.meta.description = "Radxa X4 SBC board for one of w phone network.";
+
+}
--- a/machines/almach/disko.nix
+++ b/machines/almach/disko.nix
@@ -0,0 +1,90 @@
+{ ... }:
+let
+  hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
+  os = "/dev/disk/by-id/mmc-CUTB42_0x95d64f17";
+in
+{
+
+  boot.loader = {
+    systemd-boot = {
+      enable = true;
+    };
+    efi = {
+      canTouchEfiVariables = true;
+    };
+  };
+
+  disko.devices = {
+    disk = {
+      "os-${hashDisk os}" = {
+        type = "disk";
+        device = os;
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              size = "1G";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [ "nofail" ];
+              };
+            };
+            system = {
+              size = "100%";
+              content = {
+                type = "zfs";
+                pool = "zroot";
+              };
+            };
+            swap = {
+              size = "4G";
+              content = {
+                type = "swap";
+              };
+            };
+          };
+        };
+      };
+    };
+    zpool = {
+      zroot = {
+        type = "zpool";
+        rootFsOptions = {
+          mountpoint = "none";
+          compression = "lz4";
+          acltype = "posixacl";
+          xattr = "sa";
+          "com.sun:auto-snapshot" = "true";
+        };
+        options.ashift = "12";
+        datasets = {
+          "root" = {
+            type = "zfs_fs";
+            options.mountpoint = "none";
+          };
+          "root/nixos" = {
+            type = "zfs_fs";
+            options.mountpoint = "/";
+            mountpoint = "/";
+          };
+          "root/home" = {
+            type = "zfs_fs";
+            options.mountpoint = "/home";
+            mountpoint = "/home";
+          };
+          "root/tmp" = {
+            type = "zfs_fs";
+            mountpoint = "/tmp";
+            options = {
+              mountpoint = "/tmp";
+              sync = "disabled";
+            };
+          };
+        };
+      };
+    };
+  };
+}
--- a/machines/almach/facter.json
+++ b/machines/almach/facter.json
--- a/machines/alpheratz/configuration.nix
+++ b/machines/alpheratz/configuration.nix
@@ -0,0 +1,13 @@
+{ config, ... }:
+{
+  nixpkgs.hostPlatform = {
+    system = "x86_64-linux";
+  };
+  system.stateVersion = "25.11";
+  clan.core.sops.defaultGroups = [ "admins" ];
+  # clan.core.networking.targetHost = "root@";
+
+  clan.core.settings.name = "alpheratz";
+  # clan.meta.description = "Radxa X4 SBC board for one of w phone network.";
+
+}
--- a/machines/alpheratz/disko.nix
+++ b/machines/alpheratz/disko.nix
@@ -0,0 +1,90 @@
+{ ... }:
+let
+  hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
+  os = "/dev/disk/by-id/mmc-CUTB42_0xaedcfa8b";
+in
+{
+
+  boot.loader = {
+    systemd-boot = {
+      enable = true;
+    };
+    efi = {
+      canTouchEfiVariables = true;
+    };
+  };
+
+  disko.devices = {
+    disk = {
+      "os-${hashDisk os}" = {
+        type = "disk";
+        device = os;
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              size = "1G";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [ "nofail" ];
+              };
+            };
+            system = {
+              size = "100%";
+              content = {
+                type = "zfs";
+                pool = "zroot";
+              };
+            };
+            swap = {
+              size = "4G";
+              content = {
+                type = "swap";
+              };
+            };
+          };
+        };
+      };
+    };
+    zpool = {
+      zroot = {
+        type = "zpool";
+        rootFsOptions = {
+          mountpoint = "none";
+          compression = "lz4";
+          acltype = "posixacl";
+          xattr = "sa";
+          "com.sun:auto-snapshot" = "true";
+        };
+        options.ashift = "12";
+        datasets = {
+          "root" = {
+            type = "zfs_fs";
+            options.mountpoint = "none";
+          };
+          "root/nixos" = {
+            type = "zfs_fs";
+            options.mountpoint = "/";
+            mountpoint = "/";
+          };
+          "root/home" = {
+            type = "zfs_fs";
+            options.mountpoint = "/home";
+            mountpoint = "/home";
+          };
+          "root/tmp" = {
+            type = "zfs_fs";
+            mountpoint = "/tmp";
+            options = {
+              mountpoint = "/tmp";
+              sync = "disabled";
+            };
+          };
+        };
+      };
+    };
+  };
+}
--- a/machines/alpheratz/facter.json
+++ b/machines/alpheratz/facter.json
--- a/machines/b4l/configuration.nix
+++ b/machines/b4l/configuration.nix
@@ -19,4 +19,18 @@
  services.nginx.virtualHosts."${config.networking.fqdn}" = {
    enableACME = true;
  };
+
+  clan.core.vars.generators.acme = {
+    share = true;
+    files.email.secret = false;
+
+    prompts.email = {
+      type = "line";
+      description = "Email for ACME registeration";
+    };
+
+    script = ''
+      cat $prompts/email > $out/email
+    '';
+  };
 }
--- a/machines/b4l/services/nextcloud.nix
+++ b/machines/b4l/services/nextcloud.nix
@@ -19,7 +19,7 @@ in

  services.nextcloud = {
    hostName = ncDomain;
-    package = pkgs.nextcloud31;
+    package = pkgs.nextcloud32;

    settings = {

--- a/machines/b4l/services/pingvin.nix
+++ b/machines/b4l/services/pingvin.nix
@@ -1,45 +0,0 @@
-{
-  pkgs,
-  config,
-  ...
-}:
-let
-  serviceName = "${config.networking.hostName}-pingvin";
-  domain-name = "${
-    config.clan.core.vars.generators."${serviceName}".files.subdomain.value
-  }.${config.networking.fqdn}";
-in
-{
-  clan.core.vars.generators."${serviceName}" = {
-    files = {
-      subdomain.secret = false;
-    };
-    prompts = {
-      subdomain = {
-        persist = true;
-        type = "line";
-        description = "Sub-domain for Pingvin. Default:(share)";
-      };
-    };
-
-    runtimeInputs = [
-      pkgs.xkcdpass
-      pkgs.coreutils
-    ];
-
-    script = ''
-      prompt_domain=$(cat "$prompts"/subdomain)
-      if [[ -n "''${prompt_domain-}" ]]; then
-        echo $prompt_domain | tr -d "\n" > "$out"/subdomain
-      else
-        echo -n "share" > "$out"/subdomain
-      fi
-    '';
-  };
-
-  services.pingvin-share = {
-    nginx.enable = true;
-    https = true;
-    hostname = domain-name;
-  };
-}
--- a/machines/buna/configuration.nix
+++ b/machines/buna/configuration.nix
@@ -0,0 +1,13 @@
+{ config, ... }:
+{
+  nixpkgs.hostPlatform = {
+    system = "x86_64-linux";
+  };
+  system.stateVersion = "25.11";
+  clan.core.sops.defaultGroups = [ "admins" ];
+  # clan.core.networking.targetHost = "root@";
+
+  clan.core.settings.name = "buna";
+  # clan.meta.description = "Radxa X4 SBC board for one of w phone network. (With w whitehouse)";
+
+}
--- a/machines/buna/disko.nix
+++ b/machines/buna/disko.nix
@@ -0,0 +1,56 @@
+{ ... }:
+let
+  hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
+  os = "/dev/disk/by-id/usb-Generic_MassStorageClass_000000001539-0:0";
+in
+{
+
+  boot.loader = {
+    systemd-boot = {
+      enable = true;
+    };
+    efi = {
+      canTouchEfiVariables = true;
+    };
+  };
+
+  disko.devices = {
+    disk = {
+      "os-${hashDisk os}" = {
+        type = "disk";
+        device = os;
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              end = "500M";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [ "umask=0077" ];
+              };
+            };
+            root = {
+              name = "root";
+              end = "-0";
+              content = {
+                type = "filesystem";
+                format = "f2fs";
+                mountpoint = "/";
+                extraArgs = [
+                  "-O"
+                  "extra_attr,inode_checksum,sb_checksum,compression"
+                ];
+                mountOptions = [
+                  "compress_algorithm=zstd:6,compress_chksum,atgc,gc_merge,lazytime,nodiscard"
+                ];
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+}
--- a/machines/buna/facter.json
+++ b/machines/buna/facter.json
--- a/machines/mirach/configuration.nix
+++ b/machines/mirach/configuration.nix
@@ -0,0 +1,13 @@
+{ config, ... }:
+{
+  nixpkgs.hostPlatform = {
+    system = "x86_64-linux";
+  };
+  system.stateVersion = "25.11";
+  clan.core.sops.defaultGroups = [ "admins" ];
+  # clan.core.networking.targetHost = "root@";
+
+  clan.core.settings.name = "mirach";
+  # clan.meta.description = "Radxa X4 SBC board for one of w phone network.";
+
+}
--- a/machines/mirach/disko.nix
+++ b/machines/mirach/disko.nix
@@ -0,0 +1,90 @@
+{ ... }:
+let
+  hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
+  os = "/dev/disk/by-id/mmc-CUTB42_0x95d64f33";
+in
+{
+
+  boot.loader = {
+    systemd-boot = {
+      enable = true;
+    };
+    efi = {
+      canTouchEfiVariables = true;
+    };
+  };
+
+  disko.devices = {
+    disk = {
+      "os-${hashDisk os}" = {
+        type = "disk";
+        device = os;
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              size = "1G";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [ "nofail" ];
+              };
+            };
+            system = {
+              size = "100%";
+              content = {
+                type = "zfs";
+                pool = "zroot";
+              };
+            };
+            swap = {
+              size = "4G";
+              content = {
+                type = "swap";
+              };
+            };
+          };
+        };
+      };
+    };
+    zpool = {
+      zroot = {
+        type = "zpool";
+        rootFsOptions = {
+          mountpoint = "none";
+          compression = "lz4";
+          acltype = "posixacl";
+          xattr = "sa";
+          "com.sun:auto-snapshot" = "true";
+        };
+        options.ashift = "12";
+        datasets = {
+          "root" = {
+            type = "zfs_fs";
+            options.mountpoint = "none";
+          };
+          "root/nixos" = {
+            type = "zfs_fs";
+            options.mountpoint = "/";
+            mountpoint = "/";
+          };
+          "root/home" = {
+            type = "zfs_fs";
+            options.mountpoint = "/home";
+            mountpoint = "/home";
+          };
+          "root/tmp" = {
+            type = "zfs_fs";
+            mountpoint = "/tmp";
+            options = {
+              mountpoint = "/tmp";
+              sync = "disabled";
+            };
+          };
+        };
+      };
+    };
+  };
+}
--- a/machines/mirach/facter.json
+++ b/machines/mirach/facter.json
--- a/machines/neptune/configuration.nix
+++ b/machines/neptune/configuration.nix
@@ -0,0 +1,62 @@
+{
+  inputs,
+  config,
+  lib,
+  ...
+}:
+{
+  nixpkgs.hostPlatform = {
+    system = "x86_64-linux";
+  };
+  system.stateVersion = "25.11";
+  clan.core.sops.defaultGroups = [ "admins" ];
+  clan.core.networking.targetHost = "root@[${config.clan.core.vars.generators.zerotier.files.zerotier-ip.value}]";
+
+  networking.interfaces.enx00e04c106368.useDHCP = true; # recovery
+
+  clan.core.vars.generators.wireless-credentials = {
+    files = {
+      essid.secret = false;
+      psk.secret = true;
+    };
+    prompts = {
+      essid.persist = true;
+      psk.persist = true;
+    };
+    script = ''
+      cat "$prompts"/essid > $out/essid
+      prompt_psk=$(cat "$prompts"/psk)
+      echo "psk=$prompt_psk" > $out/psk
+    '';
+  };
+
+  networking.wireless =
+    let
+      credentials = config.clan.core.vars.generators.wireless-credentials.files;
+    in
+    {
+      enable = true;
+      secretsFile = credentials.psk.path;
+      networks.${credentials.essid.value}.pskRaw = "ext:psk";
+    };
+
+  networking.interfaces.wlp1s0 = {
+    useDHCP = false;
+    ipv4.addresses = [
+      {
+        address = "10.0.0.9";
+        prefixLength = 24;
+      }
+    ];
+  };
+
+  services.yggdrasil.settings.Peers = lib.mkForce [
+    "tcp://newt.barry.town:1337"
+    "tls://yg-hkg.magicum.net:32333"
+    "tls://astrra.space:55535"
+  ];
+
+  clan.core.settings.name = "neptune";
+  # clan.meta.description = "Radxa SBC board for testing. (With vi)";
+
+}
--- a/machines/neptune/disko.nix
+++ b/machines/neptune/disko.nix
@@ -0,0 +1,90 @@
+{ ... }:
+let
+  hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
+  os = "/dev/disk/by-id/mmc-CUTB42_0x9d59499c";
+in
+{
+
+  boot.loader = {
+    systemd-boot = {
+      enable = true;
+    };
+    efi = {
+      canTouchEfiVariables = true;
+    };
+  };
+
+  disko.devices = {
+    disk = {
+      "os-${hashDisk os}" = {
+        type = "disk";
+        device = os;
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              size = "1G";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [ "nofail" ];
+              };
+            };
+            system = {
+              size = "100%";
+              content = {
+                type = "zfs";
+                pool = "zroot";
+              };
+            };
+            swap = {
+              size = "16G";
+              content = {
+                type = "swap";
+              };
+            };
+          };
+        };
+      };
+    };
+    zpool = {
+      zroot = {
+        type = "zpool";
+        rootFsOptions = {
+          mountpoint = "none";
+          compression = "lz4";
+          acltype = "posixacl";
+          xattr = "sa";
+          "com.sun:auto-snapshot" = "true";
+        };
+        options.ashift = "12";
+        datasets = {
+          "root" = {
+            type = "zfs_fs";
+            options.mountpoint = "none";
+          };
+          "root/nixos" = {
+            type = "zfs_fs";
+            options.mountpoint = "/";
+            mountpoint = "/";
+          };
+          "root/home" = {
+            type = "zfs_fs";
+            options.mountpoint = "/home";
+            mountpoint = "/home";
+          };
+          "root/tmp" = {
+            type = "zfs_fs";
+            mountpoint = "/tmp";
+            options = {
+              mountpoint = "/tmp";
+              sync = "disabled";
+            };
+          };
+        };
+      };
+    };
+  };
+}
--- a/machines/neptune/facter.json
+++ b/machines/neptune/facter.json
--- a/machines/petra/configuration.nix
+++ b/machines/petra/configuration.nix
@@ -0,0 +1,12 @@
+{ self, ... }:
+{
+  imports = [
+    self.nixosModules.common
+  ];
+
+  nixpkgs.hostPlatform = {
+    system = "x86_64-linux";
+  };
+  system.stateVersion = "25.11";
+  clan.core.sops.defaultGroups = [ "admins" ];
+}
--- a/machines/petra/disko.nix
+++ b/machines/petra/disko.nix
@@ -0,0 +1,77 @@
+{ ... }:
+let
+  hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
+  os = "/dev/disk/by-id/ata-TOSHIBA_MQ01ABD100_85N8C2DPT";
+in
+{
+
+  boot.loader = {
+    systemd-boot = {
+      enable = true;
+    };
+    efi = {
+      canTouchEfiVariables = true;
+    };
+  };
+
+  disko.devices = {
+    disk = {
+      "os-${hashDisk os}" = {
+        type = "disk";
+        device = os;
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              size = "1G";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [ "nofail" ];
+              };
+            };
+            system = {
+              size = "100%";
+              content = {
+                type = "zfs";
+                pool = "zroot";
+              };
+            };
+            swap = {
+              size = "16G";
+              content = {
+                type = "swap";
+              };
+            };
+          };
+        };
+      };
+    };
+    zpool = {
+      zroot = {
+        type = "zpool";
+        rootFsOptions = {
+          mountpoint = "none";
+          compression = "lz4";
+          acltype = "posixacl";
+          xattr = "sa";
+          "com.sun:auto-snapshot" = "true";
+        };
+        options.ashift = "12";
+        datasets = {
+          "root" = {
+            type = "zfs_fs";
+            options.mountpoint = "none";
+          };
+          "root/nixos" = {
+            type = "zfs_fs";
+            options.mountpoint = "/";
+            mountpoint = "/";
+          };
+        };
+      };
+    };
+  };
+}
--- a/machines/petra/facter.json
+++ b/machines/petra/facter.json
--- a/machines/ramus/configuration.nix
+++ b/machines/ramus/configuration.nix
@@ -0,0 +1,35 @@
+{ self, config, ... }:
+{
+  system.stateVersion = "25.11";
+  nixpkgs.hostPlatform = {
+    system = "x86_64-linux";
+  };
+
+  clan.core.settings.name = "ramus";
+  # clan.meta.description = ''
+  #   A Hetzner VPS machine own by Alex.
+  # '';
+
+  clan.core.sops.defaultGroups = [ "admins" ];
+  clan.core.networking.targetHost = "root@[${config.clan.core.vars.generators.zerotier.files.zerotier-ip.value}]";
+
+  clan.core.vars.generators.acme = {
+    share = true;
+    files.email.secret = false;
+
+    prompts.email = {
+      type = "line";
+      description = "Email for ACME registeration";
+    };
+
+    script = ''
+      cat $prompts/email > $out/email
+    '';
+  };
+
+  users.users.nginx.extraGroups = [ "acme" ];
+
+  security.acme.acceptTerms = true;
+
+  imports = [ ./think-greater-chiangmai.nix ];
+}
--- a/machines/ramus/disko.nix
+++ b/machines/ramus/disko.nix
@@ -0,0 +1,84 @@
+{ ... }:
+let
+  hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
+  os = "/dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_107266387";
+in
+{
+
+  boot.loader = {
+    systemd-boot = {
+      enable = true;
+    };
+    efi = {
+      canTouchEfiVariables = true;
+    };
+  };
+
+  disko.devices = {
+    disk = {
+      "os-${hashDisk os}" = {
+        type = "disk";
+        device = os;
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              size = "1G";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [ "nofail" ];
+              };
+            };
+            system = {
+              size = "100%";
+              content = {
+                type = "zfs";
+                pool = "zroot";
+              };
+            };
+          };
+        };
+      };
+    };
+    zpool = {
+      zroot = {
+        type = "zpool";
+        rootFsOptions = {
+          mountpoint = "none";
+          compression = "lz4";
+          acltype = "posixacl";
+          xattr = "sa";
+          "com.sun:auto-snapshot" = "true";
+        };
+        options.ashift = "12";
+        datasets = {
+          "root" = {
+            type = "zfs_fs";
+            options.mountpoint = "none";
+          };
+          "root/nixos" = {
+            type = "zfs_fs";
+            options.mountpoint = "/";
+            mountpoint = "/";
+          };
+          "root/home" = {
+            type = "zfs_fs";
+            options.mountpoint = "/home";
+            mountpoint = "/home";
+          };
+          "root/tmp" = {
+            type = "zfs_fs";
+            mountpoint = "/tmp";
+            options = {
+              mountpoint = "/tmp";
+              sync = "disabled";
+            };
+          };
+        };
+      };
+    };
+  };
+}
--- a/machines/ramus/facter.json
+++ b/machines/ramus/facter.json
--- a/machines/ramus/think-greater-chiangmai.nix
+++ b/machines/ramus/think-greater-chiangmai.nix
@@ -0,0 +1,139 @@
+{ self, config, ... }:
+let
+  commonSettings = rec {
+    APP_NAME = "Laravel";
+    APP_ENV = "local";
+    APP_KEY._secret = config.clan.core.vars.generators.greaterchiangmai.files.app_key.path;
+    APP_DEBUG = "false";
+    APP_URL = "http://localhost";
+
+    DB_CONNECTION = "mysql";
+    DB_HOST = "localhost";
+    DB_PORT = 3306;
+    DB_DATABASE = "thinkgtcm";
+    DB_USERNAME = "gtcm";
+
+    R2_SCHEMA_URL = "https://${R2_BUCKET}.${R2_REGION}.your-objectstorage.com/test-large-files/";
+    R2_ACCESS_KEY_ID = config.clan.core.vars.generators.greaterchiangmai-s3.files.access_key_id.value;
+    R2_SECRET_ACCESS_KEY._secret =
+      config.clan.core.vars.generators.greaterchiangmai-s3.files.secret_access_key.path;
+    R2_REGION = config.clan.core.vars.generators.greaterchiangmai-s3.files.region.value;
+    R2_BUCKET = config.clan.core.vars.generators.greaterchiangmai-s3.files.bucket.value;
+    R2_ENDPOINT = config.clan.core.vars.generators.greaterchiangmai-s3.files.endpoint.value;
+
+    R2_BUCKET_NAME = R2_BUCKET;
+
+    LOG_CHANNEL = "stack";
+    LOG_LEVEL = "debug";
+
+    FILESYSTEM_DISK = "local";
+
+    BROADCAST_DRIVER = "log";
+    CACHE_DRIVER = "file";
+    QUEUE_CONNECTION = "sync";
+    SESSION_DRIVER = "file";
+    SESSION_LIFETIME = 120;
+
+    MEMCACHED_HOST = "127.0.0.1";
+
+    REDIS_HOST = "127.0.0.1";
+    REDIS_PORT = 6379;
+
+    UPLOAD_MAX_FILESIZE = "5000M";
+    POST_MAX_SIZE = "5000M";
+
+    TEST_LOCAL = true;
+  };
+
+  baseDomain = "greaterchiangmai.com";
+  domain = "think.${baseDomain}";
+  domainBackend = "think-backend.${baseDomain}";
+in
+{
+  imports = [
+    self.nixosModules.think-gtcm
+    self.nixosModules.think-backend-gtcm
+  ];
+  nixpkgs.overlays = [ self.overlays.packagesOverlay ];
+
+  clan.core.vars.generators.greaterchiangmai = {
+    files = {
+      app_key = {
+        secret = true;
+        owner = config.services.think-greaterchiangmai.user;
+        group = config.services.think-greaterchiangmai.group;
+      };
+    };
+
+    prompts = {
+      app_key.persist = true;
+    };
+
+    script = ''
+      cat $prompts/app_key > $out/app_key
+    '';
+  };
+
+  clan.core.vars.generators.greaterchiangmai-s3 = {
+    files = {
+      access_key_id.secret = false;
+      secret_access_key = {
+        secret = true;
+        owner = config.services.think-greaterchiangmai.user;
+        group = config.services.think-greaterchiangmai.group;
+      };
+      endpoint.secret = false;
+      region.secret = false;
+      bucket.secret = false;
+    };
+
+    prompts = {
+      access_key_id.persist = true;
+      secret_access_key.persist = true;
+      endpoint.persist = true;
+      region.persist = true;
+      bucket.persist = true;
+    };
+
+    script = ''
+      cat $prompts/access_key_id > $out/access_key_id
+      cat $prompts/secret_access_key > $out/secret_access_key
+      cat $prompts/endpoint > $out/endpoint
+      cat $prompts/region > $out/region
+      cat $prompts/bucket > $out/bucket
+    '';
+  };
+
+  services.think-greaterchiangmai = {
+    enable = true;
+    domain = domain;
+    settings = commonSettings;
+  };
+  services.think-backend-greaterchiangmai = {
+    enable = true;
+    domain = domainBackend;
+    settings = commonSettings;
+  };
+
+  security.acme.certs = {
+    "${domain}" = {
+      email = config.clan.core.vars.generators.acme.files.email.value;
+      webroot = "/var/lib/acme/acme-challenge/${domain}";
+    };
+    "${domainBackend}" = {
+      email = config.clan.core.vars.generators.acme.files.email.value;
+      webroot = "/var/lib/acme/acme-challenge/${domainBackend}";
+    };
+  };
+
+  services.nginx.virtualHosts.${domain} = {
+    forceSSL = true;
+    useACMEHost = domain;
+    acmeRoot = config.security.acme.certs.${domain}.webroot;
+  };
+  services.nginx.virtualHosts.${domainBackend} = {
+    forceSSL = true;
+    useACMEHost = domainBackend;
+    acmeRoot = config.security.acme.certs.${domainBackend}.webroot;
+  };
+}
--- a/machines/rana/configuration.nix
+++ b/machines/rana/configuration.nix
@@ -0,0 +1,12 @@
+{ self, ... }:
+{
+  imports = [
+    self.nixosModules.common
+  ];
+
+  nixpkgs.hostPlatform = {
+    system = "x86_64-linux";
+  };
+  system.stateVersion = "25.11";
+  clan.core.sops.defaultGroups = [ "admins" ];
+}
--- a/machines/rana/disko.nix
+++ b/machines/rana/disko.nix
@@ -0,0 +1,90 @@
+{ ... }:
+let
+  hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
+  os = "/dev/disk/by-id/nvme-SAMSUNG_MZVL81T0HFLB-00BLL_S7XKNF0Y966645";
+in
+{
+
+  boot.loader = {
+    systemd-boot = {
+      enable = true;
+    };
+    efi = {
+      canTouchEfiVariables = true;
+    };
+  };
+
+  disko.devices = {
+    disk = {
+      "os-${hashDisk os}" = {
+        type = "disk";
+        device = os;
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              size = "1G";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [ "nofail" ];
+              };
+            };
+            system = {
+              size = "100%";
+              content = {
+                type = "zfs";
+                pool = "zroot";
+              };
+            };
+            swap = {
+              size = "16G";
+              content = {
+                type = "swap";
+              };
+            };
+          };
+        };
+      };
+    };
+    zpool = {
+      zroot = {
+        type = "zpool";
+        rootFsOptions = {
+          mountpoint = "none";
+          compression = "lz4";
+          acltype = "posixacl";
+          xattr = "sa";
+          "com.sun:auto-snapshot" = "true";
+        };
+        options.ashift = "12";
+        datasets = {
+          "root" = {
+            type = "zfs_fs";
+            options.mountpoint = "none";
+          };
+          "root/nixos" = {
+            type = "zfs_fs";
+            options.mountpoint = "/";
+            mountpoint = "/";
+          };
+          "root/home" = {
+            type = "zfs_fs";
+            options.mountpoint = "/home";
+            mountpoint = "/home";
+          };
+          "root/tmp" = {
+            type = "zfs_fs";
+            mountpoint = "/tmp";
+            options = {
+              mountpoint = "/tmp";
+              sync = "disabled";
+            };
+          };
+        };
+      };
+    };
+  };
+}
--- a/machines/rana/facter.json
+++ b/machines/rana/facter.json
--- a/machines/sirius/README.md
+++ b/machines/sirius/README.md
@@ -0,0 +1,21 @@
+## How to setup this machine.
+
+This machine cannot be setup the same way as other machines are setup. Meaning that `clan machine install` won't work. Because of `disko` issue. So, below is how the machine is setup.
+
+1. Build an image to flash to an sd-card using
+
+```
+nix build -L --show-trace .\#nixosConfigurations.sirius.config.system.build.images.sd-card
+```
+
+2. Import the `zdata`
+
+```
+zpool import zdata
+```
+
+3. Update configuration
+
+```
+clan machine update sirius
+```
--- a/machines/sirius/configuration.nix
+++ b/machines/sirius/configuration.nix
@@ -0,0 +1,73 @@
+{
+  self,
+  ...
+}:
+{
+  imports = [
+    self.nixosModules.common
+
+    ./hardware-configuration.nix
+  ];
+
+  image.modules.sd-card = {
+    disabledModules = [
+      ./hardware-configuration.nix
+    ];
+  };
+
+  clan.core.sops.defaultGroups = [ "admins" ];
+
+  nixpkgs.hostPlatform = {
+    system = "aarch64-linux";
+  };
+
+  system.stateVersion = "25.11";
+
+  services.journald.extraConfig = ''
+    Storage=volatile
+    RuntimeMaxUse=30M
+    RuntimeMaxFileSize=10M
+  '';
+
+  services.udisks2.enable = false;
+
+  nix.settings.log-lines = 25;
+  nix.settings.auto-optimise-store = true;
+  nix.gc = {
+    automatic = true;
+    dates = "weekly";
+    options = "--delete-older-than 15d";
+  };
+
+  boot.loader.grub.enable = false;
+  boot.loader.generic-extlinux-compatible.enable = true;
+
+  boot.zfs.extraPools = [ "zdata" ];
+  boot.supportedFilesystems = [ "zfs" ];
+  boot.initrd.availableKernelModules = [
+    "usb_storage"
+    "sd_mod"
+  ];
+
+  fileSystems."/mnt/hdd" = {
+    device = "zdata/nas";
+    fsType = "zfs";
+    mountPoint = "/mnt/hdd";
+    options = [
+      "nofail"
+      "zfsutil"
+    ];
+  };
+
+  fileSystems."/var/lib" = {
+    device = "zdata/service-data";
+    fsType = "zfs";
+    mountPoint = "/var/lib";
+    options = [
+      "x-initrd.mount"
+      "nofail"
+      "zfsutil"
+    ];
+  };
+
+}
--- a/machines/sirius/disko-ref.nix
+++ b/machines/sirius/disko-ref.nix
@@ -0,0 +1,150 @@
+{ lib, pkgs, ... }:
+let
+  hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
+  # os = "/dev/disk/by-id/mmc-SD64G_0x8336354b";
+  vdev = [
+    "/dev/disk/by-id/ata-ST20000NM002H-3KV133_ZYDBVV7Z"
+    "/dev/disk/by-id/ata-ST20000NM002H-3KV133_ZYDBSJRE"
+  ];
+  configTxt = pkgs.writeText "config.txt" ''
+    [pi4]
+    kernel=u-boot-rpi4.bin
+    enable_gic=1
+
+    # Otherwise the resolution will be weird in most cases, compared to
+    # what the pi3 firmware does by default.
+    disable_overscan=1
+
+    # Supported in newer board revisions
+    arm_boost=1
+
+    [all]
+    # Boot in 64-bit mode.
+    arm_64bit=1
+
+    # U-Boot needs this to work, regardless of whether UART is actually used or not.
+    # Look in arch/arm/mach-bcm283x/Kconfig in the U-Boot tree to see if this is still
+    # a requirement in the future.
+    enable_uart=1
+
+    # Prevent the firmware from smashing the framebuffer setup done by the mainline kernel
+    # when attempting to show low-voltage or overtemperature warnings.
+    avoid_warnings=1
+  '';
+in
+{
+
+  boot.loader = {
+    systemd-boot = {
+      enable = true;
+    };
+    efi = {
+      canTouchEfiVariables = true;
+    };
+  };
+  # boot.tmp.useTmpfs = true;
+
+  disko.devices = {
+    disk = {
+      # "os-${hashDisk os}" = {
+      #   type = "disk";
+      #   device = os;
+      #   content = {
+      #     type = "gpt";
+      #     partitions = {
+      #       firmware = {
+      #         size = "60M";
+      #         priority = 1;
+      #         type = "0700";
+      #         content = {
+      #           type = "filesystem";
+      #           format = "vfat";
+      #           mountpoint = "/firmware";
+      #           postMountHook = toString (
+      #             pkgs.writeScript "postMountHook.sh" ''
+      #               (cd ${pkgs.raspberrypifw}/share/raspberrypi/boot && cp bootcode.bin fixup*.dat start*.elf *.dtb /mnt/firmware/)
+      #               cp ${pkgs.ubootRaspberryPi4_64bit}/u-boot.bin /mnt/firmware/u-boot-rpi4.bin
+      #               cp ${configTxt} /mnt/firmware/config.txt
+      #             ''
+      #           );
+      #         };
+      #       };
+      #       ESP = {
+      #         size = "2G";
+      #         type = "EF00";
+      #         content = {
+      #           type = "filesystem";
+      #           format = "vfat";
+      #           mountpoint = "/boot";
+      #           mountOptions = [ "umask=0077" ];
+      #         };
+      #       };
+      #       root = {
+      #         name = "root";
+      #         end = "-0";
+      #         content = {
+      #           type = "filesystem";
+      #           format = "f2fs";
+      #           mountpoint = "/";
+      #           extraArgs = [
+      #             "-O"
+      #             "extra_attr,inode_checksum,sb_checksum,compression"
+      #           ];
+      #           mountOptions = [ "compress_algorithm=zstd:6,compress_chksum,atgc,gc_merge,lazytime,nodiscard" ];
+      #         };
+      #       };
+      #     };
+      #   };
+      # };
+    }
+    // (lib.listToAttrs (
+      map (disk: {
+        name = "data-${hashDisk disk}";
+        value = {
+          type = "disk";
+          device = disk;
+          content = {
+            type = "zfs";
+            pool = "zdata";
+          };
+        };
+      }) vdev
+    ));
+    zpool = {
+      zdata = {
+        type = "zpool";
+        options.ashift = "12";
+        rootFsOptions = {
+          mountpoint = "none";
+          compression = "lz4";
+          acltype = "posixacl";
+          xattr = "sa";
+          "com.sun:auto-snapshot" = "true";
+        };
+        mode = {
+          topology = {
+            type = "topology";
+            vdev = [
+              {
+                mode = "mirror";
+                members = vdev;
+              }
+            ];
+          };
+        };
+        datasets = {
+          "nas" = {
+            type = "zfs_fs";
+            mountpoint = "/mnt/hdd";
+            mountOptions = [ "nofail" ];
+          };
+          "service-data" = {
+            type = "zfs_fs";
+            mountpoint = "/var/lib";
+            mountOptions = [ "nofail" ];
+          };
+        };
+      };
+    };
+  };
+}
--- a/machines/sirius/hardware-configuration.nix
+++ b/machines/sirius/hardware-configuration.nix
@@ -0,0 +1,6 @@
+{
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/44444444-4444-4444-8888-888888888888";
+    fsType = "ext4";
+  };
+}
--- a/machines/vega/configuration.nix
+++ b/machines/vega/configuration.nix
@@ -1,10 +1,13 @@
 {
  inputs,
  config,
+  self,
  ...
 }:
 {
  imports = [
+    self.nixosModules.common
+
    (inputs.import-tree ./services)

    (import ../../lib/auto-accept-zerotier-members.nix {
--- a/modules/clan/actual-budget/default.nix
+++ b/modules/clan/actual-budget/default.nix
@@ -3,9 +3,11 @@
  _class = "clan.service";
  manifest.name = "actual-budget";
  manifest.description = "A local-first personal finance app ";
+  manifest.readme = "A local-first personal finance app";
  manifest.categories = [ "System" ];

  roles.default = {
+    description = "A default server role.";

    perInstance.nixosModule =
      {
--- a/modules/clan/actual-budget/flake-module.nix
+++ b/modules/clan/actual-budget/flake-module.nix
@@ -10,7 +10,7 @@ in
  perSystem =
    { ... }:
    {
-      clan.nixosTests.actual-budget = {
+      clan.nixosTests.service-actual-budget = {
        imports = [ ./tests/vm/default.nix ];

        clan.modules."@clan/actual-budget" = module;
--- a/modules/clan/flake-module.nix
+++ b/modules/clan/flake-module.nix
@@ -1,4 +1,7 @@
-{ inputs, lib, ... }:
+{
+  inputs,
+  ...
+}:
 {
  imports =
    let
@@ -16,12 +19,7 @@

      # Create import paths for each valid directory
      imports = (map (name: ./. + "/${name}/flake-module.nix") validModuleDirs) ++ [
-        (import (inputs.clan-core + "/lib/flake-parts/clan-nixos-test.nix") {
-          inherit lib;
-          flake-parts-lib = inputs.flake-parts.lib;
-          self = inputs.clan-core;
-          inputs = inputs.clan-core.clan.self.inputs;
-        })
+        inputs.clan-core.flakeModules.testModule
      ];
    in
    imports;
--- a/modules/clan/git-daemon/default.nix
+++ b/modules/clan/git-daemon/default.nix
@@ -0,0 +1,174 @@
+{ ... }:
+{
+  _class = "clan.service";
+  manifest.name = "git-daemon";
+  manifest.description = "a really simple server for git repositories";
+  manifest.readme = "a really simple server for git repositories";
+  manifest.categories = [ "System" ];
+
+  roles.default = {
+    description = "a default server role";
+    interface =
+      { lib, ... }:
+      {
+        options = with lib; {
+          directory = lib.mkOption {
+            type = types.str;
+            default = "/var/git";
+          };
+          repositories = lib.mkOption {
+            type =
+              with lib.types;
+              attrsOf (
+                submodule (
+                  { name, ... }:
+                  {
+                    options = {
+                      name = lib.mkOption {
+                        type = str;
+                        default = name;
+                      };
+                      read-access = lib.mkOption {
+                        type = listOf str;
+                        default = [ ];
+                      };
+                      write-access = lib.mkOption {
+                        type = listOf str;
+                        default = [ ];
+                      };
+                    };
+                  }
+                )
+              );
+            default = { };
+          };
+        };
+      };
+    perInstance =
+      {
+        settings,
+        ...
+      }:
+      {
+        nixosModule =
+          {
+            pkgs,
+            lib,
+            config,
+            ...
+          }:
+          {
+            systemd.services.git-init = {
+              serviceConfig = {
+                Type = "oneshot";
+                User = config.services.gitDaemon.user;
+                Group = config.services.gitDaemon.group;
+                ExecStartPre = toString [
+                  "+${pkgs.coreutils}/bin/install"
+                  "--directory"
+                  "--owner=${config.services.gitDaemon.user}"
+                  "--group=${config.services.gitDaemon.group}"
+                  "--mode=0750"
+                  settings.directory
+                ];
+                ExecStart =
+                  let
+                    git-template = pkgs.stdenv.mkDerivation {
+                      name = "git-template";
+                      buildCommand = ''
+                        cp --no-preserve=mode,ownership --recursive \
+                          ${pkgs.git}/share/git-core/templates $out
+                        install -m550 $out/hooks/post-update{.sample,}
+                      '';
+                    };
+                    init-script =
+                      { name, ... }:
+                      pkgs.writeShellScript "git-init-${name}" ''
+                        ${pkgs.git}/bin/git init \
+                          --bare --template=${git-template} --shared=0660 \
+                          ${settings.directory}/${name}.git
+                        ${pkgs.git}/bin/git \
+                          -C ${settings.directory}/${name}.git \
+                          config set receive.denyNonFastforwards false
+                      '';
+                  in
+                  map init-script (lib.attrValues settings.repositories);
+              };
+            };
+
+            services.gitDaemon = {
+              enable = true;
+              user = "git";
+              group = "git";
+              options =
+                let
+                  firewall = pkgs.writeText "git-daemon-firewall.json" (
+                    builtins.toJSON (builtins.attrValues settings.repositories)
+                  );
+                  hook = pkgs.writers.writePython3 "hook.py" { flakeIgnore = [ "E" ]; } ''
+                    import os, sys, enum, pathlib, ipaddress, json
+
+                    class Service(enum.Enum):
+                        UploadPack = enum.auto()
+                        ReceivePack = enum.auto()
+                        UploadArchive = enum.auto()
+
+                        @classmethod
+                        def parse(cls, string):
+                            return {
+                                'upload-pack': cls.UploadPack,
+                                'receive-pack': cls.ReceivePack,
+                                'upload-archive': cls.UploadArchive
+                            }[string]
+
+                        @property
+                        def service(self):
+                            return {
+                                UploadPack: 'read-access',
+                                ReceivePack: 'write-access'
+                            }[self]
+                    UploadPack = Service.UploadPack
+                    ReceivePack = Service.ReceivePack
+
+                    def parse_remote_addr(remote_addr):
+                        if remote_addr.startswith('[') and remote_addr.endswith(']'):
+                            return ipaddress.ip_address(remote_addr[1:-1])
+                        return ipaddress.ip_address(remote_addr)
+
+                    service = Service.parse(sys.argv[1])
+                    repo = pathlib.Path(sys.argv[2]).stem
+                    client = parse_remote_addr(os.environ['REMOTE_ADDR'])
+
+                    with open("${firewall}", 'r') as f:
+                        firewall = json.load(f)
+
+                    for rule in firewall:
+                        if rule["name"] == repo:
+                           for network in rule[service.service]:
+                               if client in ipaddress.ip_network(network):
+                                   sys.exit(0)
+                    print('stairway denied')
+                    sys.exit(1)
+                  '';
+                in
+                toString [
+                  "--enable=upload-pack"
+                  "--enable=receive-pack"
+                  "--disable=upload-archive"
+                  "--access-hook=${hook}"
+                  "--informative-errors"
+                ];
+              exportAll = true;
+              basePath = settings.directory;
+            };
+
+            systemd.services.git-daemon = {
+              requires = [ "git-init.service" ];
+              after = [ "git-init.service" ];
+            };
+
+            networking.firewall.allowedTCPPorts = [ 9418 ];
+          };
+      };
+  };
+}
--- a/modules/clan/git-daemon/flake-module.nix
+++ b/modules/clan/git-daemon/flake-module.nix
@@ -0,0 +1,9 @@
+{ lib, ... }:
+let
+  module = lib.modules.importApply ./default.nix { };
+in
+{
+  clan.modules = {
+    git-daemon = module;
+  };
+}
--- a/modules/clan/grafana/default.nix
+++ b/modules/clan/grafana/default.nix
@@ -3,19 +3,38 @@
  _class = "clan.service";
  manifest.name = "grafana";
  manifest.description = "Platform for data analytics and monitoring";
+  manifest.readme = "Platform for data analytics and monitoring";
  manifest.categories = [ "System" ];

  roles.default = {
+    description = "A default server role";

    perInstance.nixosModule =
      {
        config,
        lib,
+        pkgs,
        ...
      }:
      {
+        clan.core.vars.generators.grafana = {
+          files = {
+            secret_key = {
+              owner = "grafana";
+              group = "grafana";
+              secret = true;
+            };
+          };
+          script = ''
+            openssl rand -hex 32 > "$out"/secret_key
+          '';
+          runtimeInputs = [
+            pkgs.openssl
+          ];
+        };
        services.grafana = {
          enable = lib.mkDefault true;
+          settings.security.secret_key = "$__file{${config.clan.core.vars.generators.grafana.files.secret_key.path}}";
        };

        clan.core.state.grafana.folders = [ config.services.grafana.dataDir ];
--- a/modules/clan/grafana/flake-module.nix
+++ b/modules/clan/grafana/flake-module.nix
@@ -1,6 +1,6 @@
-{ lib, ... }:
+{ self, inputs, ... }:
 let
-  module = lib.modules.importApply ./default.nix { };
+  module = ./default.nix;
 in
 {
  clan.modules = {
@@ -9,8 +9,9 @@ in
  perSystem =
    { ... }:
    {
-      clan.nixosTests.grafana = {
+      clan.nixosTests.service-grafana = {
        imports = [ ./tests/vm/default.nix ];
+        _module.args = { inherit self inputs; };

        clan.modules."@clan/grafana" = module;
      };
--- a/modules/clan/grafana/tests/vm/default.nix
+++ b/modules/clan/grafana/tests/vm/default.nix
@@ -1,8 +1,23 @@
 {
+  self,
+  config,
+  lib,
+  hostPkgs,
  ...
 }:
 {
  name = "service-grafana";
+  result.update-vars =
+    let
+      relativeDir = lib.removePrefix "${self}/" (toString config.clan.directory);
+    in
+    hostPkgs.writeShellScriptBin "update-vars" ''
+      set -x
+      export PRJ_ROOT=$(git rev-parse --show-toplevel)
+      ${
+        self.inputs.clan-core.packages.${hostPkgs.system}.clan-cli
+      }/bin/clan-generate-test-vars $PRJ_ROOT/${relativeDir} ${config.name}
+    '';

  clan = {
    directory = ./.;
--- a/modules/clan/grafana/tests/vm/sops/machines/server/key.json
+++ b/modules/clan/grafana/tests/vm/sops/machines/server/key.json
@@ -0,0 +1,6 @@
+[
+  {
+    "publickey": "age1chfz220hkkxvv25x4cmqsen38ppat9erplqus8gvynv0ajnu4uaqgfq3tj",
+    "type": "age"
+  }
+]
--- a/modules/clan/grafana/tests/vm/sops/secrets/server-age.key/secret
+++ b/modules/clan/grafana/tests/vm/sops/secrets/server-age.key/secret
@@ -0,0 +1,14 @@
+{
+	"data": "ENC[AES256_GCM,data:ZGt489y6VugKlhVLz6hC5sL+E+IDT6MkHS7jMU36WFWK9Co9btY4HRo+JtH/3C5iVuGLf/0j7n6W8SYZXigVCUTUQJvE56RfZ1s=,iv:rQM4ZZhN345KE2A16J9/ZKMZ9O+Qvb5y6kwXA/6SuZg=,tag:C+oeBtNFcImKd3HV/6yFCQ==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZU0hqYmtDKzBRWDVMNVdm\nUW5XMXd4WDNha0ppbENwOHk1bk1mVWxVV0F3CktYT01XdktyenNvUzU4UXBReEVp\nZXJKS05kS0NsbFNqamlXMkVzRmRhUkEKLS0tIEgweFVCT2tOZmMrdERDV0FBN3N2\nVjZPZXR3L0x0dER4T1Q4cTBlV20vUjAK9QJ2p8VzNqVY/lrcKwL56YF2JBfJp11M\ns801/6IQ5WvMPziG/E/nppv/9zL0kQTh9EPGqevy0juGcvqQgn1KQw==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-03-02T07:38:10Z",
+		"mac": "ENC[AES256_GCM,data:ShP6xVJaIIyj5kqRJeIbTNJBkY3H/xvj/RgbEl65RZbJNVE0HTHkTmartKVEyROWQlMyhwesJr8FEKAnOrWysUOKQUKV9Cgfvr6J/IXZj1ZJkXbE9NcFmsRshv4Po4sCig7Hq7qt/hQLBqutUjXnpvLaKgARz2dcOv8HSoVkCKU=,iv:bvl6lFb2z8DGQkShEWe5XlYmhtXNf3bL5RHSsk9LAXs=,tag:HomMsFH3jEHCR0L6aXVsBw==,type:str]",
+		"version": "3.12.1"
+	}
+}
--- a/modules/clan/grafana/tests/vm/sops/secrets/server-age.key/users/admin
+++ b/modules/clan/grafana/tests/vm/sops/secrets/server-age.key/users/admin
@@ -0,0 +1 @@
+../../../users/admin
--- a/modules/clan/grafana/tests/vm/sops/users/admin/key.json
+++ b/modules/clan/grafana/tests/vm/sops/users/admin/key.json
@@ -0,0 +1,4 @@
+{
+  "publickey": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
+  "type": "age"
+}
--- a/modules/clan/grafana/tests/vm/vars/per-machine/server/grafana/secret_key/machines/server
+++ b/modules/clan/grafana/tests/vm/vars/per-machine/server/grafana/secret_key/machines/server
@@ -0,0 +1 @@
+../../../../../../sops/machines/server
--- a/modules/clan/grafana/tests/vm/vars/per-machine/server/grafana/secret_key/secret
+++ b/modules/clan/grafana/tests/vm/vars/per-machine/server/grafana/secret_key/secret
@@ -0,0 +1,18 @@
+{
+	"data": "ENC[AES256_GCM,data:xXGuIJCmajuSHV3rBaAC0+XZZekqPd3rTr1bTKjMIU34IF9ueairclcSAUjFHakRG5EeGJ90PTosuC1vnqk/emQ=,iv:9Od0lV3SeTlT9sgJHY6yw/tLz5WNbaMDDFfjvIMO76M=,tag:T4ybZEUDGrp+p4I5NEr+Xg==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1chfz220hkkxvv25x4cmqsen38ppat9erplqus8gvynv0ajnu4uaqgfq3tj",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4aUc5Yy8xOU0xcW02eDVK\nR0d5eXVtVU50dVk4L2dnZ3pObTJjOGQycHlnCjJBSndpdGNhRWVxeGZGdTJwZklU\nekdQTjZ1UTUzYklRVDd6WlVFeko0cEEKLS0tIDB2SkVpRXVEcG9nSGM0OG5hYmlR\ncXBMdUZ2MHdZd2hCaFF5Y1duOVlzc3MKgFUx3NZSoXiALUWj0gxPZLbmwfzRuq5w\nSc3CPCuEEALGq1unzndXJLSg+q4u/PAsZ/Q4l2CDHxuk5INct3Px7g==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTTmxFL0UyNlhCaVhKWVJ5\nRUpLV3ZJdnNpYWZLa2phTlVNMmpzd20yd0FnCk9sOTFOZWQ3MzRHb3EwNUdzRDZ1\ndDk4eDVJRGFrOVIwd0xsb3c1b3VpWmcKLS0tIG16Nkc1TmlvbDNaYWZwcUFHYkV4\nT3Y5M1VOMWF3MHBMVlNMam1sSXIwNTQKRVvOVcV5GWua5hfS2ijKT5+C6Y5rZsXN\nKVzvemCk7pEGjVRSi4P0hrPnD37A6uwwj8FJqiLd7Y1p3hIVvBqR3w==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-03-02T07:38:11Z",
+		"mac": "ENC[AES256_GCM,data:HiiWGBruyPo/vGDdz/Zc/8Vd8oB2aMqoDjJCTybe9tRTJAojiSYZR4YyBO2ApCnYDyStJqXL0ZRjjRB73dwvldaNASz2odl/GGprmxcCH3T0A+Zrgu2gN9yNA5i+LkBLC2URXYwra4Den/WvIOTnrvvQcszN9SUBs+MOJM56KZo=,iv:+pjWMIf0+wBvWzkvsvqP7CI6zJpO3+8sqaZUEocXkXU=,tag:yp2CpOb38Kp13f2CJSzHEg==,type:str]",
+		"version": "3.12.1"
+	}
+}
--- a/modules/clan/grafana/tests/vm/vars/per-machine/server/grafana/secret_key/users/admin
+++ b/modules/clan/grafana/tests/vm/vars/per-machine/server/grafana/secret_key/users/admin
@@ -0,0 +1 @@
+../../../../../../sops/users/admin
--- a/modules/clan/grafana/tests/vm/vars/per-machine/server/state-version/version/value
+++ b/modules/clan/grafana/tests/vm/vars/per-machine/server/state-version/version/value
@@ -0,0 +1 @@
+26.05
--- a/modules/clan/home-profiles/flake-module.nix
+++ b/modules/clan/home-profiles/flake-module.nix
@@ -0,0 +1,6 @@
+{ lib, ... }:
+{
+  clan.modules = {
+    home-user = lib.modules.importApply ./home-user { };
+  };
+}
--- a/modules/clan/home-profiles/home-user/default.nix
+++ b/modules/clan/home-profiles/home-user/default.nix
@@ -0,0 +1,64 @@
+{ ... }:
+{
+  _class = "clan.service";
+  manifest.name = "common-user-home-manager";
+  manifest.description = "General users' home-manager profile generator";
+  manifest.readme = "General users' home-manager profile generator";
+  manifest.categories = [ "System" ];
+
+  roles.default = {
+    description = "a default role for the user";
+    interface =
+      { lib, ... }:
+      {
+        options = {
+          username = lib.mkOption {
+            type = lib.types.str;
+          };
+          kbLayout = lib.mkOption {
+            type = lib.types.str;
+            default = "us";
+          };
+          kbOptions = lib.mkOption {
+            type = lib.types.str;
+            default = "grp:win_space_toggle";
+          };
+        };
+      };
+    perInstance =
+      { settings, ... }:
+      {
+        nixosModule =
+          { inputs, ... }:
+          let
+            username = settings.username;
+          in
+          {
+            imports = [ inputs.home-manager.nixosModules.home-manager ];
+
+            users.users.${username} = {
+              initialPassword = "";
+              isNormalUser = true;
+              extraGroups = [
+                "audio"
+                "video"
+                "networkmanager"
+              ];
+            };
+
+            services.xserver = {
+              enable = true;
+              xkb.layout = settings.kbLayout;
+              xkb.options = settings.kbOptions;
+            };
+
+            home-manager.useGlobalPkgs = true;
+            home-manager.useUserPackages = true;
+            home-manager.users.${username} = ./home.nix;
+            home-manager.extraSpecialArgs = {
+              inherit inputs username;
+            };
+          };
+      };
+  };
+}
--- a/modules/clan/home-profiles/home-user/home.nix
+++ b/modules/clan/home-profiles/home-user/home.nix
@@ -0,0 +1,26 @@
+{
+  osConfig,
+  pkgs,
+  lib,
+  username,
+  ...
+}:
+{
+  home = {
+    inherit username;
+    homeDirectory = lib.mkForce "/home/${username}";
+    stateVersion = osConfig.system.stateVersion;
+    packages = with pkgs; [
+      libreoffice-fresh
+      element-desktop
+      signal-desktop
+      brave
+      firefox
+      keepassxc
+      vlc
+      thunderbird
+    ];
+  };
+  programs.home-manager.enable = true;
+  services.syncthing.tray.enable = osConfig.services.syncthing.enable;
+}
--- a/modules/clan/jukebox/default.nix
+++ b/modules/clan/jukebox/default.nix
@@ -0,0 +1,138 @@
+{ ... }:
+{
+  _class = "clan.service";
+  manifest.name = "jukebox";
+  manifest.description = "mpd server, library on removable disks";
+  manifest.readme = "mpd server, library on removable disks";
+  manifest.categories = [ "System" ];
+
+  roles.default = {
+    description = "a default server role";
+    interface =
+      { lib, ... }:
+      {
+        options = {
+          baseDir = lib.mkOption {
+            type = lib.types.str;
+            default = "/mnt/jukebox";
+          };
+          binds = lib.mkOption {
+            type = with lib.types; listOf str;
+            default = [ ];
+          };
+          disks = lib.mkOption {
+            type =
+              with lib.types;
+              attrsOf (
+                submodule (
+                  { name, ... }:
+                  {
+                    options = {
+                      name = lib.mkOption {
+                        type = str;
+                        default = name;
+                      };
+                      uuid = lib.mkOption {
+                        type = str;
+                      };
+                      mountOptions = lib.mkOption {
+                        type = listOf str;
+                        default = [ ];
+                      };
+                    };
+                  }
+                )
+              );
+            default = { };
+            description = "disks comprising library";
+          };
+        };
+      };
+    perInstance =
+      {
+        settings,
+        ...
+      }:
+      {
+        nixosModule =
+          {
+            config,
+            lib,
+            pkgs,
+            ...
+          }:
+          {
+            services.pulseaudio.enable = true;
+
+            # workaround cookie permissions
+            services.pulseaudio.tcp.enable = true;
+            services.pulseaudio.tcp.anonymousClients = {
+              allowedIpRanges = [ "127.0.0.1" ];
+              allowAll = true;
+            };
+
+            systemd.tmpfiles.rules = [
+              "d ${settings.baseDir} 0755 root root"
+            ];
+
+            fileSystems =
+              let
+                disk2fs =
+                  {
+                    name,
+                    uuid,
+                    mountOptions,
+                    ...
+                  }:
+                  lib.nameValuePair "${settings.baseDir}/${name}" {
+                    device = "/dev/disk/by-uuid/${uuid}";
+                    fsType = "auto";
+                    options = [
+                      "noauto"
+                      "nofail"
+                    ]
+                    ++ mountOptions;
+                  };
+              in
+              lib.listToAttrs (lib.mapAttrsToList (_: disk2fs) settings.disks);
+
+            services.udev.extraRules =
+              let
+                translate-prefix = path: (lib.removePrefix "-" (lib.replaceStrings [ "/" ] [ "-" ] path));
+                mount-name = name: "${translate-prefix settings.baseDir}-${name}.mount";
+                disk2rule =
+                  { name, uuid, ... }:
+                  lib.concatStringsSep ", " [
+                    ''ACTION=="add"''
+                    ''SUBSYSTEM=="block"''
+                    ''ENV{DEVLINKS}=="*/dev/disk/by-uuid/${uuid}*"''
+                    ''ENV{SYSTEMD_WANTS}="${mount-name name}"''
+                  ];
+              in
+              lib.concatMapStringsSep "\n" disk2rule (lib.attrValues settings.disks);
+
+            services.mpd = {
+              enable = true;
+              openFirewall = true;
+              settings = {
+                bind_to_address = "any";
+                music_directory = settings.baseDir;
+                audio_output = [
+                  {
+                    type = "pulse";
+                    name = "jukebox";
+                    server = "localhost";
+                  }
+                ];
+              };
+            };
+
+            networking.firewall.interfaces = lib.genAttrs settings.binds (_: {
+              allowedTCPPorts = [ config.services.mpd.settings.port ];
+            });
+
+            environment.systemPackages = [ pkgs.mpc ];
+          };
+      };
+  };
+}
--- a/modules/clan/jukebox/flake-module.nix
+++ b/modules/clan/jukebox/flake-module.nix
@@ -0,0 +1,9 @@
+{ lib, ... }:
+let
+  module = lib.modules.importApply ./default.nix { };
+in
+{
+  clan.modules = {
+    jukebox = module;
+  };
+}
--- a/modules/clan/nextcloud/default.nix
+++ b/modules/clan/nextcloud/default.nix
@@ -3,9 +3,11 @@
  _class = "clan.service";
  manifest.name = "nextcloud";
  manifest.description = "Nextcloud server, a safe home for all your data";
+  manifest.readme = "Nextcloud server, a safe home for all your data";
  manifest.categories = [ "System" ];

  roles.default = {
+    description = "a default server role";

    perInstance.nixosModule =
      {
--- a/modules/clan/nextcloud/flake-module.nix
+++ b/modules/clan/nextcloud/flake-module.nix
@@ -10,7 +10,7 @@ in
  perSystem =
    { ... }:
    {
-      clan.nixosTests.nextcloud = {
+      clan.nixosTests.service-nextcloud = {
        imports = [ ./tests/vm/default.nix ];

        clan.modules."@clan/nextcloud" = module;
--- a/modules/clan/paperless/default.nix
+++ b/modules/clan/paperless/default.nix
@@ -3,9 +3,11 @@
  _class = "clan.service";
  manifest.name = "paperless";
  manifest.description = "A community-supported supercharged document management system: scan, index and archive all your documents";
+  manifest.readme = "A community-supported supercharged document management system: scan, index and archive all your documents";
  manifest.categories = [ "System" ];

  roles.default = {
+    description = "a default server role";

    perInstance.nixosModule =
      {
@@ -14,6 +16,18 @@
        ...
      }:
      {
+        nixpkgs.overlays = [
+          (final: prev: {
+            pythonPackagesExtensions = prev.pythonPackagesExtensions ++ [
+              (pyFinal: pyPrev: {
+                psycopg = pyPrev.psycopg.overrideAttrs (old: {
+                  disabledTests = old.disabledTests ++ [ "test_stats_connect" ];
+                });
+              })
+            ];
+          })
+        ];
+
        services.paperless = {
          enable = lib.mkDefault true;
        };
--- a/modules/clan/paperless/flake-module.nix
+++ b/modules/clan/paperless/flake-module.nix
@@ -10,7 +10,7 @@ in
  perSystem =
    { ... }:
    {
-      clan.nixosTests.paperless = {
+      clan.nixosTests.service-paperless = {
        imports = [ ./tests/vm/default.nix ];

        clan.modules."@clan/paperless" = module;
--- a/modules/clan/personal-computer/automatic-timezone.nix
+++ b/modules/clan/personal-computer/automatic-timezone.nix
@@ -0,0 +1,8 @@
+{ lib, ... }:
+{
+  services.automatic-timezoned.enable = true;
+  services.geoclue2 = {
+    enableDemoAgent = lib.mkForce true;
+    geoProviderUrl = "https://beacondb.net/v1/geolocate";
+  };
+}
--- a/modules/clan/personal-computer/default.nix
+++ b/modules/clan/personal-computer/default.nix
@@ -0,0 +1,21 @@
+{ ... }:
+{
+  _class = "clan.service";
+  manifest.name = "personal-computer";
+  manifest.description = "A service for configuring personal computer such as printing, automatic-timezone, etc.";
+  manifest.readme = "A service for configuring personal computer such as printing, automatic-timezone, etc.";
+  manifest.categories = [ "System" ];
+
+  roles.default = {
+    description = "an only one default role";
+    perInstance.nixosModule =
+      { inputs, lib, ... }:
+      {
+        imports = [
+          (inputs.import-tree.initFilter (
+            p: !lib.hasSuffix "default.nix" p && !lib.hasSuffix "flake-module.nix" p
+          ) ./.)
+        ];
+      };
+  };
+}
--- a/modules/clan/personal-computer/desktop-environment.nix
+++ b/modules/clan/personal-computer/desktop-environment.nix
@@ -0,0 +1,9 @@
+{ config, lib, ... }:
+{
+  security.pam.services."sddm".kwallet.enable = config.services.desktopManager.plasma6.enable;
+  security.pam.services."gdm".kwallet.enable = config.services.desktopManager.plasma6.enable;
+
+  services.displayManager.sddm.enable = lib.mkForce false;
+  services.displayManager.gdm.enable = true;
+  services.displayManager.gdm.wayland = true;
+}
--- a/modules/clan/personal-computer/flake-module.nix
+++ b/modules/clan/personal-computer/flake-module.nix
@@ -0,0 +1,6 @@
+{ lib, ... }:
+{
+  clan.modules = {
+    personal-computer = lib.modules.importApply ./default.nix { };
+  };
+}
--- a/modules/clan/personal-computer/libinput.nix
+++ b/modules/clan/personal-computer/libinput.nix
@@ -0,0 +1,11 @@
+{
+  services = {
+    libinput = {
+      enable = true;
+      touchpad = {
+        disableWhileTyping = true;
+        naturalScrolling = true;
+      };
+    };
+  };
+}
--- a/modules/clan/personal-computer/printing.nix
+++ b/modules/clan/personal-computer/printing.nix
@@ -0,0 +1,62 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+let
+  allowManageGroups = [
+    "root"
+    "wheel"
+    "lpadmin"
+  ];
+  polkitAllowGroups = builtins.concatStringsSep "||" (
+    builtins.map (group: ''subject.isInGroup("${group}")'') allowManageGroups
+  );
+
+  printerMember = lib.map (user: user.name) (
+    lib.attrsets.attrsToList (
+      lib.attrsets.filterAttrs (name: value: value.isNormalUser) config.users.users
+    )
+  );
+
+in
+{
+  services.printing = {
+    enable = true;
+    drivers = [
+      pkgs.brlaser
+      pkgs.gutenprint
+    ];
+
+    extraFilesConf = ''
+      SystemGroup ${builtins.concatStringsSep " " allowManageGroups}
+    '';
+  };
+
+  security.polkit = {
+    enable = true;
+
+    extraConfig = ''
+      polkit.addRule(function(action, subject) {
+        var actionMatchs = (
+          action.id.indexOf('org.opensuse.cupspkhelper.mechanism.') === 0
+        );
+        if (actionMatchs) {
+          if (${polkitAllowGroups}) {
+            return polkit.Result.YES
+          }
+        }
+      });
+    '';
+  };
+
+  hardware.sane = {
+    enable = true;
+  };
+
+  users.groups.lpadmin.members = printerMember;
+  users.groups.lp.members = printerMember;
+  users.groups.scanner.members = printerMember;
+
+}
--- a/modules/clan/personal-computer/users.nix
+++ b/modules/clan/personal-computer/users.nix
@@ -0,0 +1,11 @@
+{ lib, ... }:
+{
+  users.mutableUsers = lib.mkForce true;
+  security.polkit.extraConfig = ''
+    polkit.addRule(function(action, subject) {
+      if ((action.id == "org.freedesktop.accounts.change-own-password")) {
+        return polkit.Result.AUTH_SELF;
+      }
+    });
+  '';
+}
--- a/modules/clan/personal-computer/wireless.nix
+++ b/modules/clan/personal-computer/wireless.nix
@@ -0,0 +1,4 @@
+{
+  networking.networkmanager.enable = true;
+  hardware.bluetooth.enable = true;
+}
--- a/modules/clan/phonebox/default.nix
+++ b/modules/clan/phonebox/default.nix
@@ -0,0 +1,456 @@
+{
+  clanLib,
+  ...
+}:
+{
+  _class = "clan.service";
+  manifest.name = "phonebox";
+  manifest.description = "A peer to peer phone relay network built on top of yggdrasil.";
+  manifest.readme = "A peer to peer phone relay network built on top of yggdrasil.";
+  manifest.categories = [ "System" ];
+
+  roles.default = {
+    description = "a default server role";
+    interface =
+      { lib, ... }:
+      {
+        options.ata-ethernet-iface = lib.mkOption {
+          type = lib.types.str;
+          description = "An Ethernet interface that connect to ATA box.";
+          default = "enp2s0";
+        };
+        options.ownerName = lib.mkOption {
+          type = lib.types.str;
+          description = "";
+          default = "";
+        };
+      };
+    perInstance =
+      {
+        roles,
+        settings,
+        ...
+      }:
+      {
+
+        nixosModule =
+          {
+            lib,
+            config,
+            pkgs,
+            ...
+          }:
+          let
+            asterisk = pkgs.asterisk.overrideAttrs (old: {
+              propagatedNativeBuildInputs = [ pkgs.spandsp3 ];
+            });
+
+            machines = lib.attrNames roles.default.machines;
+
+            user = "asterisk";
+            faxDir = "/run/asterisk/fax";
+            rtpPortFrom = 10000;
+            rtpPortTo = 20000;
+            ata-interface = settings.ata-ethernet-iface;
+
+            contactList = builtins.map (machineName: {
+              name = "${clanLib.getPublicValue {
+                flake = config.clan.core.settings.directory;
+                machine = machineName;
+                generator = "phonebox";
+                file = "owner-name";
+                default = null;
+              }}";
+              number = "${
+                clanLib.getPublicValue {
+                  flake = config.clan.core.settings.directory;
+                  machine = machineName;
+                  generator = "phonebox";
+                  file = "server-prefix-number";
+                  default = null;
+                }
+              }${
+                clanLib.getPublicValue {
+                  flake = config.clan.core.settings.directory;
+                  machine = machineName;
+                  generator = "phonebox";
+                  file = "ata-local-number";
+                  default = null;
+                }
+              }";
+            }) machines;
+
+            createContactListTiff =
+              let
+                contactTXT = lib.concatStringsSep "\n" (
+                  builtins.map (contact: "${contact.number}\t\t: \t\t${contact.name}") contactList
+                );
+              in
+              pkgs.writeShellApplication {
+                name = "create-contact-tiff";
+                text = ''
+                  magick -background white -fill black -pointsize 20 -font DejaVu-Sans label:"${contactTXT}" "$1"
+                  magick "$1" -border 20x50 -bordercolor white "$1"
+                  magick "$1" -resize 1728x -units PixelsPerInch -compress Group4 -density 204x196 -monochrome -depth 1 "$1"
+                '';
+                runtimeInputs = [ pkgs.imagemagick ];
+              };
+
+            genServerSIPEndpoint =
+              { hostname, address }:
+              ''
+                [${hostname}](internal_endpoint)
+                aors=${hostname}
+
+                [${hostname}](ip_auth)
+                endpoint=${hostname}
+                match=[${address}]
+
+                [${hostname}](dynamiic_aor)
+                contact=sip:[${address}]
+              '';
+
+            genLocalSIPEndpoint =
+              { localNumber }:
+              ''
+                [${localNumber}](internal_endpoint)
+                aors=${localNumber}
+                auth=${localNumber}
+
+                [${localNumber}](userpass_auth)
+                username=${localNumber}
+                password=${localNumber}
+
+                [${localNumber}](dynamiic_aor)
+                max_contacts=1
+                remove_existing=yes
+              '';
+
+            genLocalExtenConf =
+              { localNumber }:
+              ''
+                exten => ${localNumber},1,Dial(PJSIP/${localNumber},20)
+              '';
+            genExtentConf =
+              {
+                prefixNumber,
+                hostname,
+                localNumber,
+              }:
+              let
+                replaceWithX =
+                  ln: builtins.concatStringsSep "" (builtins.genList (_: "X") (builtins.stringLength ln));
+              in
+              ''
+                exten => _${prefixNumber}${replaceWithX localNumber},1,Dial(PJSIP/''${EXTEN:${builtins.toString (builtins.stringLength prefixNumber)}}@${hostname},30)
+              '';
+
+            getYggdrasilIP =
+              machineName:
+              if config.clan.core.vars.generators.yggdrasil.files.address ? value then
+                clanLib.getPublicValue {
+                  flake = config.clan.core.settings.directory;
+                  machine = machineName;
+                  generator = "yggdrasil";
+                  file = "address";
+                  default = null;
+                }
+              else
+                throw "clanService/yggdrasil is required";
+          in
+          {
+            clan.core.vars.generators.phonebox = builtins.break {
+              files = {
+                server-prefix-number.secret = false;
+                ata-local-number.secret = false;
+                owner-name.secret = false;
+              };
+
+              prompts = {
+                server-prefix-number = {
+                  type = "line";
+                  persist = true;
+                  description = "Server prefix number: indicate server to connect to [10XX]";
+                };
+                ata-local-number = {
+                  persist = true;
+                  type = "line";
+                  description = "Local suffix number: indicate local number on the server [XX00]";
+                };
+                owner-name = {
+                  persist = true;
+                  type = "line";
+                  description = "The owner's name for this unit";
+                };
+              };
+
+              script = ''
+                cat $prompts/server-prefix-number > $out/server-prefix-number
+                cat $prompts/ata-local-number > $out/ata-local-number
+                cat $prompts/owner-name > $out/owner-name
+              '';
+            };
+
+            networking.interfaces = {
+              ${ata-interface} = {
+                useDHCP = false;
+                ipv4.addresses = [
+                  {
+                    address = "192.168.254.1";
+                    prefixLength = 24;
+                  }
+                ];
+              };
+            };
+
+            services.dnsmasq = {
+              enable = true;
+
+              settings = {
+                bind-dynamic = true;
+                listen-address = "192.168.254.1";
+                # enable-ra = true;
+                domain-needed = true;
+                domain = "localhost";
+                dhcp-range = [
+                  "192.168.254.100,192.168.254.100,255.255.255.0,3m"
+                ];
+                dhcp-leasefile = "/dev/null";
+                dhcp-option = [
+                  "3,192.168.254.1"
+                ];
+                interface = [ ata-interface ];
+              };
+            };
+
+            services.nginx = {
+              enable = true;
+              virtualHosts = {
+                "_" = {
+                  locations."/" = {
+                    proxyPass = "http://192.168.254.100";
+                    extraConfig = ''
+                      client_max_body_size 100M;
+                    '';
+                  };
+                };
+              };
+            };
+
+            networking.firewall.allowedUDPPortRanges = [
+              {
+                from = rtpPortFrom;
+                to = rtpPortTo;
+              }
+            ];
+
+            networking.firewall.allowedUDPPorts = [
+              53
+              67
+              5060
+            ];
+            networking.firewall.allowedTCPPorts = [
+              53
+            ];
+            networking.firewall.interfaces =
+              let
+                matchAll = if !config.networking.nftables.enable then "zt+" else "zt*";
+              in
+              {
+                "${matchAll}".allowedTCPPorts = [ 80 ];
+              };
+
+            services.asterisk = {
+              enable = lib.mkDefault true;
+              package = lib.mkDefault asterisk;
+              confFiles =
+                let
+                  nodes = builtins.foldl' (
+                    nodes: name:
+                    nodes
+                    ++ [
+                      {
+                        hostname = name;
+                        address = getYggdrasilIP name;
+                        prefixNumber = clanLib.getPublicValue {
+                          flake = config.clan.core.settings.directory;
+                          machine = name;
+                          generator = "phonebox";
+                          file = "server-prefix-number";
+                          default = null;
+                        };
+
+                        localNumber = clanLib.getPublicValue {
+                          flake = config.clan.core.settings.directory;
+                          machine = name;
+                          generator = "phonebox";
+                          file = "ata-local-number";
+                          default = null;
+                        };
+                      }
+                    ]
+                  ) [ ] machines;
+                in
+                {
+                  "logger.conf" = ''
+                    [general]
+                    dateformat = %F %T.%3q ; ISO 8601 date format with milliseconds
+                    use_callids = yes
+                    appendhostname = no
+                    queue_log = yes
+                    queue_log_to_file = no
+                    queue_log_name = queue_log
+                    queue_log_realtime_use_gmt = no
+                    rotatestrategy = rotate
+                    exec_after_rotate=gzip -9 $\{filename\}.2
+                    [logfiles]
+                    console => notice,warning,error
+                    security => security
+                    messages => notice,warning,error
+                    full => notice,warning,error,verbose,dtmf,fax
+                    syslog.local0 => notice,warning,error
+                  '';
+
+                  "modules.conf" = ''
+                    [modules]
+                    autoload=yes
+
+                    load => res_fax_spandsp.so
+                  '';
+
+                  # Dial plan config
+                  "extensions.conf" =
+                    let
+                      serverConf = builtins.foldl' (
+                        config: node:
+                        config
+                        + (genExtentConf {
+                          inherit (node) prefixNumber hostname localNumber;
+                        })
+                      ) "" nodes;
+                    in
+                    ''
+                      [from-internal]
+                      exten => 999,1,Answer()
+                      same  =>     n,Playback(hello-world)
+                      same  =>     n,Hangup()
+
+                      exten => 000,1,Answer()
+                      same => n,ReceiveFAX(${faxDir}/echo-''${UNIQUEID}.tiff)
+                      same => n,Set(FAXFILE=${faxDir}/echo-''${UNIQUEID}.tiff)
+                      same => n,Set(FAXECHO=true)
+
+                      exten => 888,1,Answer()
+                      same => n,Set(FAXFILE=${faxDir}/contact.tiff)
+                      same => n,System(${lib.getExe createContactListTiff} ''${FAXFILE})
+                      same => n,Set(FAXECHO=true)
+                      same => n,Playback(vm-goodbye)
+                      same => n,Wait(3)
+
+                      exten => h,1,GotoIf($[''${FAXECHO}]?sendfax)
+                      same => n,Hangup()
+                      same => n(sendfax),Originate(PJSIP/00,app,SendFAX,''${FAXFILE})
+                      same => n,Set(FAXECHO=false)
+
+                    ''
+                    + (genLocalExtenConf {
+                      localNumber = config.clan.core.vars.generators.phonebox.files.ata-local-number.value;
+                    })
+                    + serverConf;
+
+                  "rtp.conf" = ''
+                    [general]
+                    rtpstart=${builtins.toString rtpPortFrom}
+                    rtpend=${builtins.toString rtpPortTo}
+                  '';
+
+                  "pjsip.conf" =
+                    let
+                      serverConf = builtins.foldl' (
+                        conf: node:
+                        conf
+                        + (genServerSIPEndpoint {
+                          hostname = node.hostname;
+                          address = node.address;
+                        })
+                      ) "" nodes;
+                    in
+                    ''
+                      [transport-udp]
+                      type=transport
+                      protocol=udp
+                      bind=0.0.0.0
+                      [transport-udp6]
+                      type=transport
+                      protocol=udp
+                      bind=::
+
+                      [base_endpoint](!)
+                      type=endpoint
+                      disallow=all
+                      allow=ulaw,alaw,g722,gsm
+                      direct_media=no
+
+                      [internal_endpoint](!,base_endpoint)
+                      context=from-internal
+
+                      [userpass_auth](!)
+                      type=auth
+                      auth_type=userpass
+
+                      [ip_auth](!)
+                      type=identify
+                      endpoint=external
+
+                      [dynamiic_aor](!)
+                      type=aor
+
+                    ''
+                    + (genLocalSIPEndpoint {
+                      localNumber = config.clan.core.vars.generators.phonebox.files.ata-local-number.value;
+                    })
+                    + serverConf;
+                };
+            };
+
+            environment.systemPackages = [
+              createContactListTiff
+            ];
+
+            systemd.tmpfiles.rules = [
+              "d ${faxDir}                            0755 ${user} ${user} - -"
+            ];
+
+            systemd.services.asterisk-watcher = {
+              enable = true;
+              description = "Asterisk Configuration files watcher";
+
+              requires = [ "asterisk.service" ];
+              after = [ "network.target" ];
+              wantedBy = [ "multi-user.target" ];
+              path = with pkgs; [
+                inotify-tools
+                asterisk
+              ];
+              script = ''
+                inotifywait -m -e move /etc/asterisk |
+                while read path action file; do
+                  case "$file" in
+                    pjsip.conf)
+                      echo "restarting pjsip"
+                      asterisk -rx "pjsip reload"
+                      ;;
+                  esac
+                  case "$file" in
+                    extensions.conf)
+                      echo "restarting core"
+                      asterisk -rx "core restart now"
+                      ;;
+                  esac
+                done
+              '';
+            };
+          };
+      };
+  };
+}
--- a/modules/clan/phonebox/flake-module.nix
+++ b/modules/clan/phonebox/flake-module.nix
@@ -0,0 +1,23 @@
+{
+  inputs,
+  self,
+  ...
+}:
+let
+  module = ./default.nix;
+in
+{
+  clan.modules = {
+    phonebox = module;
+  };
+  perSystem =
+    { ... }:
+    {
+      clan.nixosTests.service-phonebox = {
+        imports = [ ./tests/vm/default.nix ];
+        _module.args = { inherit self inputs; };
+
+        clan.modules."@clan/phonebox" = module;
+      };
+    };
+}
--- a/modules/clan/phonebox/tests/vm/default.nix
+++ b/modules/clan/phonebox/tests/vm/default.nix
@@ -0,0 +1,59 @@
+{
+  self,
+  hostPkgs,
+  config,
+  inputs,
+  lib,
+  ...
+}:
+{
+  name = "service-phonebox";
+  result.update-vars =
+    let
+      relativeDir = lib.removePrefix "${self}/" (toString config.clan.directory);
+    in
+    hostPkgs.writeShellScriptBin "update-vars" ''
+      set -x
+      export PRJ_ROOT=$(git rev-parse --show-toplevel)
+      ${
+        self.inputs.clan-core.packages.${hostPkgs.system}.clan-cli
+      }/bin/clan-generate-test-vars $PRJ_ROOT/${relativeDir} ${config.name}
+    '';
+
+  clan = {
+    directory = ./.;
+    inventory = {
+      machines.server = { };
+
+      instances = {
+        yggdrasil = {
+          module.name = "yggdrasil";
+          roles.default.machines.server = { };
+        };
+        phonebox-test = {
+          module.name = "@clan/phonebox";
+          module.input = "self";
+          roles.default.machines."server".settings = {
+            ata-ethernet-iface = "enp2s0";
+          };
+        };
+      };
+    };
+  };
+
+  nodes = {
+    server = {
+      services.asterisk = {
+      };
+    };
+  };
+
+  testScript = ''
+    start_all()
+
+    server.wait_for_unit("asterisk")
+
+    server.succeed("systemctl status asterisk")
+
+  '';
+}
--- a/modules/clan/phonebox/tests/vm/sops/machines/server/key.json
+++ b/modules/clan/phonebox/tests/vm/sops/machines/server/key.json
@@ -0,0 +1,6 @@
+[
+  {
+    "publickey": "age1fdkan6n20swmut0sa86g5a6gxrj8qj2sgqe8hxtw32c0u9rr4drqlyr5mf",
+    "type": "age"
+  }
+]
--- a/modules/clan/phonebox/tests/vm/sops/secrets/server-age.key/secret
+++ b/modules/clan/phonebox/tests/vm/sops/secrets/server-age.key/secret
@@ -0,0 +1,14 @@
+{
+	"data": "ENC[AES256_GCM,data:t+zYfcA2f1sdUNBAl+bRGyhPEl5HZFIu+au6heH3+SoHf0zy+Deh25gaVay/oswIg2q806ozjEnTw9q2eaq0VXwMSAWOoTWteI0=,iv:sXoOmfzoCv6GHe21n2Elxr/GTdViI5vfLzMwOLvf1F4=,tag:Fmo9MjEaKV3BehR/bYRdVw==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzVlo0YjZFVFF2VkFlSzBL\ndHp4YTQ5RlNxV2FWNnNScTh5d0hXR05RL0NVCnBVUENNNjg0dTFVcmx3N3djZ25l\ncmxYTVVrNGhGSkdwVThoaC9UVTQ3L2sKLS0tIG1uREdFcXNubGxzUUQ1Rkh5Wnlx\nRG5OZmJwaGh2dkt6RSttb0gxZ3FBaEkKZzwUuQmOeBk5kfRfVVdqgNvsTU1Ssb/I\nx9Iv9w/YKHDmmcFLcAbGAHbS0/Js0YqBKZonxEMDdWP/+/F+Pv8LqQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-10-31T07:08:30Z",
+		"mac": "ENC[AES256_GCM,data:CBuTnVIta0eFqlB7ZpDkzPOEGbIQbb5oCpksI4umscB3uE0HM3j4N5r6bCPEcYpehB3qWXuCxlj4NfH7zmp6CDq6Be6bfpB1f8MCwTlPvQUho2f31so3U/g99q6ZyWI2rJO50dzn77bdma3JXo9VQb3uRqJ0mk72IYXFwdHvO9s=,iv:9uwjtGYpqsLcXRoBFmjJjfHUq7R47ZqkrKEXMulw4OY=,tag:4Auq3mnhlusogyW44SJfqg==,type:str]",
+		"version": "3.11.0"
+	}
+}
--- a/modules/clan/phonebox/tests/vm/sops/secrets/server-age.key/users/admin
+++ b/modules/clan/phonebox/tests/vm/sops/secrets/server-age.key/users/admin
@@ -0,0 +1 @@
+../../../users/admin
--- a/modules/clan/phonebox/tests/vm/sops/users/admin/key.json
+++ b/modules/clan/phonebox/tests/vm/sops/users/admin/key.json
@@ -0,0 +1,4 @@
+{
+  "publickey": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
+  "type": "age"
+}
--- a/modules/clan/phonebox/tests/vm/vars/per-machine/server/phonebox/ata-local-number/value
+++ b/modules/clan/phonebox/tests/vm/vars/per-machine/server/phonebox/ata-local-number/value
@@ -0,0 +1 @@
+fake_line_value
--- a/modules/clan/phonebox/tests/vm/vars/per-machine/server/phonebox/ata-password/machines/server
+++ b/modules/clan/phonebox/tests/vm/vars/per-machine/server/phonebox/ata-password/machines/server
@@ -0,0 +1 @@
+../../../../../../sops/machines/server
--- a/modules/clan/phonebox/tests/vm/vars/per-machine/server/phonebox/ata-password/secret
+++ b/modules/clan/phonebox/tests/vm/vars/per-machine/server/phonebox/ata-password/secret
@@ -0,0 +1,18 @@
+{
+	"data": "ENC[AES256_GCM,data:L4fWAVQdQP2tgYPzUnDY5X0=,iv:fWeTc1buW/JI/8qngZwzDp+wq2OTZPGdItqG0Up5eZ8=,tag:RJt6PQdCisDhtbr3ph3fWA==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1fdkan6n20swmut0sa86g5a6gxrj8qj2sgqe8hxtw32c0u9rr4drqlyr5mf",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFK2x0SkcxK2RxTDRvOEpZ\nTS9QNGJxbmZIL2xtUWxyNjA2VDNVWEQzQVc4CkkxeEZDQm1mQVdUUzVIQThDVkV3\nU2lWbnlnb3lqWDZ0NWRqa2RJV0pVK1UKLS0tIHc5eUJBUUtiL0NwZDRnN004UEtr\nYnU2SWlFOGlucTdydGVmZCtGK3NjS28KkNAxwz9MesicLWtViL302AwZYdiTHmd5\nppbwelisNVlsYHSa5ybVDYER4IUz1d8AKO0jtS7qEDfT53R36swSAA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArbEpzdk0xQTFkM2V0K2xz\nRFhDak0ybkhZUjJJdVI4YTl3cStXT2hTZDBFCmRvQ3ZXYkQ1NktCb004ZE1FS1FF\naSt4RlVXSlRhYWdlQ3htTkdkb2dyVDAKLS0tIG16VFNQM0dnaGVSRmlFRFB0WWtW\nN0dPL08rV01sY3ovRnEvUnNMaWVhd2sKvQIZIo5pPMXKh9Ea3ZgHj99Dn1X3JkmB\noscG8S7HOJh/cw+uITmkuv00TyIA9pid6L1kXvfcfv+tcuY9H1Vg4w==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-10-31T07:08:30Z",
+		"mac": "ENC[AES256_GCM,data:bmvshL97XNvNYYg0EjkUAQViHpKJ/+A+CGE90/uSM2WXooJF5yzvVJSHLAuYxWM295awN8ygTRUZ2VJ0SyfjzjAyUIH4SxqlrgywqMouyVsiFDAB6R4AmMmbvvC6rSs/TSMOwYC5pchrISbpsE2kmJnAXCqcev6Q0fl8Sa1PSxo=,iv:BuBQCFb3EWfG+bPzgaRDseDq6MJQ/Fs8okvksvEj1bA=,tag:n14VDbQk+zl+XbJPkTRAGg==,type:str]",
+		"version": "3.11.0"
+	}
+}
--- a/modules/clan/phonebox/tests/vm/vars/per-machine/server/phonebox/ata-password/users/admin
+++ b/modules/clan/phonebox/tests/vm/vars/per-machine/server/phonebox/ata-password/users/admin
@@ -0,0 +1 @@
+../../../../../../sops/users/admin
--- a/modules/clan/phonebox/tests/vm/vars/per-machine/server/phonebox/owner-name/value
+++ b/modules/clan/phonebox/tests/vm/vars/per-machine/server/phonebox/owner-name/value
@@ -0,0 +1 @@
+fake_line_value
--- a/modules/clan/phonebox/tests/vm/vars/per-machine/server/phonebox/server-prefix-number/value
+++ b/modules/clan/phonebox/tests/vm/vars/per-machine/server/phonebox/server-prefix-number/value
@@ -0,0 +1 @@
+fake_line_value
--- a/modules/clan/phonebox/tests/vm/vars/per-machine/server/state-version/version/value
+++ b/modules/clan/phonebox/tests/vm/vars/per-machine/server/state-version/version/value
@@ -0,0 +1 @@
+25.11
--- a/modules/clan/phonebox/tests/vm/vars/per-machine/server/yggdrasil/address/value
+++ b/modules/clan/phonebox/tests/vm/vars/per-machine/server/yggdrasil/address/value
@@ -0,0 +1 @@
+202:fe87:1ca6:3cfd:e095:c2b1:321c:c391
--- a/modules/clan/phonebox/tests/vm/vars/per-machine/server/yggdrasil/privateKey/machines/server
+++ b/modules/clan/phonebox/tests/vm/vars/per-machine/server/yggdrasil/privateKey/machines/server
@@ -0,0 +1 @@
+../../../../../../sops/machines/server
--- a/modules/clan/phonebox/tests/vm/vars/per-machine/server/yggdrasil/privateKey/secret
+++ b/modules/clan/phonebox/tests/vm/vars/per-machine/server/yggdrasil/privateKey/secret
@@ -0,0 +1,18 @@
+{
+	"data": "ENC[AES256_GCM,data:0LwQxArH6fpIYpGIEzPtjh8elyKSaed7L+KqgnIlPVneR0UbsbOM6p5kVGTRPh5LWH6jmkURCqc2c5oT5CNLBePLQcgvtfLDSFWyyPrD9WtBSPu+YGF7K51JUUIkX07//LqTQQaM5Uu/STQRIoL1BD0Tofk2woA=,iv:3rSDqBj8N9RsSLijZm7mUUjUhiLHc2yidGkil8NvCD8=,tag:F8zlw9pfMjZdJSObDePLsQ==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1fdkan6n20swmut0sa86g5a6gxrj8qj2sgqe8hxtw32c0u9rr4drqlyr5mf",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0NnVzT0lOWnFTUU85c0d5\nZ0Q1b0xkS1NWbWVsc0o1emxLOW5NRU52REFZCjRkUGJHaDhyazdFdkxWaW1XVW53\nb25pUXlDRmhrTHlIWGl6RDJBZ2hTOW8KLS0tIGsxQmlQejkvQk9wTmtMQzZJa2dB\na0piOGlyMzVrTmNOUEhtaDNTWHdwTDAKroQG8KlnWZ6gwu1y0mr0gGezDF1jsS0Y\nC1LUAarHl+lY51sw+HJT88Y9mDfLjvYIMHKS33zdJuBXbNpoIfWyzA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqQVJhYkI1eEFYL0d5OE1F\nSStqV0xPb0pybyt2QWd4SEpiaDhlNDJicTA0CkgrVU9FcThuQktaMThTaXBmWHNV\nd2tpMVVYT21TWUFvMS9wakl4RyszTGsKLS0tIHVVeDdoMUJQaURMOGFkM3dNa3ZG\nMmVPdEg3bmdZZHgwaGpnbFFKUTdvcUUKTaxEfp19+9AJihqx51m0cLz6IuR5pvnT\nt90kZxq+BH3/6gjiDlhwzqztnMbdqQYcVuCDVp/1aVWfThABUZ92aQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-12-05T04:42:06Z",
+		"mac": "ENC[AES256_GCM,data:1/u3c/wf2Gh6PPeVTKKGBxG1FWvN7hyuzx3Qa7yU3yKCD7LDHrrzTbQkFHDo1ZrXixK5NICCw48BWA0Jao0kItu6aU1Dbk5PexZI9ls1eyaDS7nwtZuHKDSEtDYu/kx5kZgQKH9tsokLqKlcoeocS0Mp1tjvUSQsiZFaYsuKaM4=,iv:gCPqFgpwjSONn/JN3dpJOk1BXtdd9cvIAz/NKPuAdKg=,tag:j8upk9sgDiYj5lmfU4V+OQ==,type:str]",
+		"version": "3.11.0"
+	}
+}
--- a/modules/clan/phonebox/tests/vm/vars/per-machine/server/yggdrasil/privateKey/users/admin
+++ b/modules/clan/phonebox/tests/vm/vars/per-machine/server/yggdrasil/privateKey/users/admin
@@ -0,0 +1 @@
+../../../../../../sops/users/admin
--- a/modules/clan/phonebox/tests/vm/vars/per-machine/server/yggdrasil/publicKey/value
+++ b/modules/clan/phonebox/tests/vm/vars/per-machine/server/yggdrasil/publicKey/value
@@ -0,0 +1,3 @@
+-----BEGIN PUBLIC KEY-----
+MCowBQYDK2VwAyEAIC8cazhgQ+1Hqdm8Z43J5ooymP2ytrBEvdfXYz0ryp8=
+-----END PUBLIC KEY-----
--- a/modules/clan/phonebox/tests/vm/vars/per-machine/server/yggdrasil/yggdrasil-ip/value
+++ b/modules/clan/phonebox/tests/vm/vars/per-machine/server/yggdrasil/yggdrasil-ip/value
@@ -0,0 +1 @@
+201:b9d:4329:71c2:79ca:3648:e86d:4236
--- a/modules/clan/phonebox/tests/vm/vars/per-machine/server/yggdrasil/yggdrasil-secret/machines/server
+++ b/modules/clan/phonebox/tests/vm/vars/per-machine/server/yggdrasil/yggdrasil-secret/machines/server
@@ -0,0 +1 @@
+../../../../../../sops/machines/server
--- a/modules/clan/phonebox/tests/vm/vars/per-machine/server/yggdrasil/yggdrasil-secret/secret
+++ b/modules/clan/phonebox/tests/vm/vars/per-machine/server/yggdrasil/yggdrasil-secret/secret
@@ -0,0 +1,18 @@
+{
+	"data": "ENC[AES256_GCM,data:bAJv40t1hkgMBz4boOEIw9GIY/4UFYI2WZidRrU88ky0JDBwSmHDnxuBFRpdjfAx7sO9d6vSHxAmaf45NlTKwnkUJnaIW0NK+979lXbLV+AG0suc4Vci6fsdbAHofR//3DfTYs03HoALkRUgRemTl7kQtdMB6E6LN02OE19HSVuFjMiEipwosmFfMoR69ZZuPSzNg1uVnw==,iv:LbZZGbwkXc71PAKgjD2CvXJVtyiqgi+cNsBzbulPyIk=,tag:VPESc2Y8SdU5CovQinZleA==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1fdkan6n20swmut0sa86g5a6gxrj8qj2sgqe8hxtw32c0u9rr4drqlyr5mf",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2L3FzSkh3UTkvdTR6eEVE\nNnYrcnAydUl4QnJSbWJRbFFQODFmSld1YkJZCnNFUHp6YjQ3WW0vVHh5dXZBMzFJ\nYWRnZWNHN2dkL1JBWHNrZTcvTHI5S3MKLS0tIGpnekxneURuMWFkQ1RLTEszTFhi\nUUkzR2ljTXFhb1c2RDhpeFJXaXpYakUK/fLOqjNR2LML7uN3fiB9GdhWTDcr0wn4\n37ESeS1kx0EobRMaDVu8GPZovcdypFOOPiuUpEu6hIEdwvl736oDSA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjQWE2L3F1RW9oNlQzR0I3\nZDJoZ1hIM2N0Mm1aQ1IrN1gweWZxeWVGdUdzCmlIZXdKYm8rUGkvVVpiY1BJZmlD\nN0MwRHN3dUNrRU9McjNFMXpranJGU1UKLS0tIG1yMmJGaEp1cU1iZGdqdzRUTWZW\nZzZrVkRuOTBTcnFuaTE1Um1ISUxBaTQKf842rL3N7Gl1QfrIURWiu26LwO0ERkP4\nvfXN2HH1jjp2pblQF9qb+5vmUsaX1pPSY1R+YMvUK7wIwOb9zyIfmQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-10-31T07:50:02Z",
+		"mac": "ENC[AES256_GCM,data:/c1jqMSLd9/fxm1PxtRITr3qkjtrlJ/5wJgEVkraAqU6XTuzSyseMhdeWLL2Fy2OunT/+alM6VpaliBmcZqRkSSGngbuvMsujDiJLgUXQ8wNhMcK7ln/dqFMcA+RYGxihGEMwuPKs3yOVKj9PDzFYnm6TUCFkU/heotI/hQ1lQI=,iv:EsWsi4r4DctMLvi4WmqKe0D1NTHwYVKCcxKQ+6grzYg=,tag:28dmpzF/6dbvGIriaBVKPw==,type:str]",
+		"version": "3.11.0"
+	}
+}
--- a/modules/clan/phonebox/tests/vm/vars/per-machine/server/yggdrasil/yggdrasil-secret/users/admin
+++ b/modules/clan/phonebox/tests/vm/vars/per-machine/server/yggdrasil/yggdrasil-secret/users/admin
@@ -0,0 +1 @@
+../../../../../../sops/users/admin
--- a/modules/clan/phonebox/tests/vm/vars/per-machine/server/yggdrasil/yggdrasil-subnet/value
+++ b/modules/clan/phonebox/tests/vm/vars/per-machine/server/yggdrasil/yggdrasil-subnet/value
@@ -0,0 +1 @@
+301:b9d:4329:71c2::/64
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
kurogeek	f3e25e7837	mob next [ci-skip] [ci skip] [skip ci] lastFile:flake.nix	2026-03-16 17:06:56 +07:00
kurogeek	c96f8d999a	mob next [ci-skip] [ci skip] [skip ci] lastFile:flake.lock	2026-03-16 15:49:49 +07:00
kurogeek	a123682c93	inputs/liminix: update	2026-03-16 15:43:28 +07:00
kurogeek	b3c8ee76e9	machines/rana: enable syncthing	2026-03-06 16:31:26 +07:00
kurogeek	1d5a528cd1	machines/sirius: finalize config	2026-03-06 16:25:41 +07:00
kurogeek	891e80a3a9	inputs/liminix: changed to upstream	2026-03-05 19:52:26 +07:00
kurogeek	9c85e82b59	bump clan-core, nixpkgs	2026-03-02 18:09:11 +07:00
kurogeek	73232a4800	clanService/grafana: add requred attr	2026-03-02 18:08:41 +07:00
kurogeek	9b7e9b5be6	temporary fixed while waiting for https://github.com/NixOS/nixpkgs/issues/495499 to land	2026-03-02 18:07:18 +07:00
kurogeek	2b7316be2a	temporary fixed while waiting for https://github.com/NixOS/nixpkgs/pull/494510 to get fixed	2026-03-02 18:06:13 +07:00
kurogeek	5b733b794a	clanService/home-profiles: libreoffice -> libreoffice-fresh for temporary fix build fail on upstream	2026-03-02 11:49:45 +07:00
kurogeek	3ae485084c	clanService/samba: no valid user option	2026-02-27 17:57:14 +07:00
kurogeek	24fb9efa0f	clanService/home-profiles: add signal-desktop	2026-02-26 10:19:01 +07:00
kurogeek	66883bc4bd	machines/sirius: format facter.json	2026-02-14 11:09:14 +07:00
kurogeek	55abd6ff73	rm unrelated file	2026-02-13 17:48:29 +07:00
kurogeek	096db119cc	machines/sirius: fix disko config	2026-02-13 17:47:08 +07:00
kurogeek	faae7e9371	machines/sirius: no fixed target host	2026-02-13 17:46:10 +07:00
kurogeek	bd81196e1c	machines/sirius: in yggdrasil network	2026-02-13 17:45:48 +07:00
kurogeek	53961703ef	update(inventory.json): Installed sirius	2026-02-13 16:23:04 +07:00
kurogeek	a722d12f74	update(inventory.json): Installed sirius	2026-02-13 16:02:24 +07:00
kurogeek	bc982447d9	update(inventory.json): Installed sirius	2026-02-13 15:43:55 +07:00
kurogeek	dafd60194b	update(inventory.json): Installed sirius	2026-02-13 15:36:10 +07:00
kurogeek	723a0e652a	update(inventory.json): Installed sirius	2026-02-13 15:24:09 +07:00
kurogeek	c15699c247	update(inventory.json): Installed sirius	2026-02-13 15:00:48 +07:00
kurogeek	f626577062	update(inventory.json): Installed sirius	2026-02-13 14:48:12 +07:00
kurogeek	8b8f3978cb	Update vars via generator yggdrasil for machine sirius	2026-02-13 14:40:20 +07:00
kurogeek	7b6fd3fc93	update(inventory.json): Installed sirius	2026-02-13 14:25:11 +07:00
kurogeek	c364a7ac77	machines/sirius/facter.json: update hardware configuration	2026-02-13 14:25:11 +07:00
kurogeek	c3e2757a61	machines/sirius: fix disko config	2026-02-13 13:31:02 +07:00
kurogeek	2bd53ed63c	machines/sirius: facter.json	2026-02-13 11:24:54 +07:00
kurogeek	e1d70f9a04	inventory/samba: sirius is NAS samba server	2026-02-13 11:15:09 +07:00
kurogeek	86694e6ef0	Update vars via generator w-smb-password for machine sirius	2026-02-13 11:14:29 +07:00
kurogeek	eadcd0a996	machines/sirius: fixed config	2026-02-13 11:05:14 +07:00
kurogeek	052e391429	machines/sirius: fixed wrong tmpfs option	2026-02-13 11:02:36 +07:00
kurogeek	c03dce200f	machines/sirius: actual disk	2026-02-13 11:02:06 +07:00
kurogeek	009aae29db	machines/sirius: use f2fs file system	2026-02-12 17:46:04 +07:00
kurogeek	ac6aaefbd4	machines/sirius: system = aarch64-linux	2026-02-12 17:45:33 +07:00
kurogeek	b507af2a03	machines/sirius: no dedicated samba	2026-02-11 17:07:20 +07:00
kurogeek	2834b43d66	clanService/samba: samba service	2026-02-11 17:01:51 +07:00
kurogeek	d91da5d74b	clanService/phonebox: pjsip.conf has remove_existing=yes	2026-02-06 10:47:50 +07:00
kurogeek	f64119da4f	clanService/personal-computer: now uses gdm	2026-01-23 11:48:36 +07:00
kurogeek	8af9450ff6	machines/petra: added to yggdrasil global network	2026-01-23 11:14:19 +07:00
kurogeek	0b09a47f04	machines/petra: rm yggdrasil vars	2026-01-23 11:13:44 +07:00
kurogeek	ba35bebf89	Update vars via generator yggdrasil for machine petra	2026-01-23 11:10:03 +07:00
kurogeek	526244a8c6	Update vars via generator zerotier for machine petra	2026-01-23 10:39:09 +07:00
kurogeek	23d211d815	Update vars via generator yggdrasil for machine rana	2026-01-23 09:10:40 +07:00
kurogeek	696d5278cd	Update vars via generator yggdrasil for machine petra	2026-01-23 09:10:39 +07:00
kurogeek	a418222c4b	bump treefmt-nix	2026-01-22 17:07:10 +07:00
kurogeek	e50009e326	machines/petra: chocolate laptop pc	2026-01-22 15:35:36 +07:00
kurogeek	cfc967fac9	fix think-backend upload and get avartar image	2026-01-20 14:22:02 +07:00
kurogeek	f3d282b763	bump nixpkgs	2026-01-15 11:35:36 +07:00
kurogeek	a37a0cc7d1	rm clanService/pingvin	2026-01-15 11:35:12 +07:00
kurogeek	a629fa123a	no clanService warnings	2026-01-15 10:26:57 +07:00
kurogeek	d3c7baf551	rana machine: emmie personal laptop	2026-01-15 09:59:37 +07:00
vi	162ba62cb2	neptune: git-daemon: global read access to islands and thinc	2026-01-01 00:00:00 +00:00
kurogeek	5af1fa25b9	think-greaterchiangmai file uploader	2026-01-12 13:07:56 +07:00
kurogeek	87fe4ff8bc	clan.meta.name -> clan.core.settings.name	2026-01-09 15:23:24 +07:00
kurogeek	49449d70e6	clanService/phonebox: update-vars	2026-01-09 14:33:19 +07:00
kurogeek	c724a8ee2b	think-greaterchiangmai missing R2_SCHEMA_URL is fixed	2026-01-07 13:15:39 +07:00
kurogeek	ca9a8d458c	clanService/phonebox: phonebook feature	2025-12-30 10:10:16 +07:00
kurogeek	90c739991d	bump clan-core	2025-12-29 16:55:23 +07:00
vi	4e83773e21	init git-daemon module	2025-12-01 00:00:00 +00:00
kurogeek	322d1bd612	clanService/phonebox: use FAXFILE variable	2025-12-26 16:53:07 +07:00
kurogeek	ec4c3897e2	clanService:phonebox: fax echo feature	2025-12-16 10:28:16 +07:00
kurogeek	39bfcd0080	nix fmt	2025-12-12 18:27:30 +07:00
kurogeek	6f9791746e	buna machine	2025-12-10 13:14:14 +07:00
kurogeek	d093103d86	clanService/phonebox: asterisk restart core when extensions.conf changed	2025-12-10 13:01:31 +07:00
kurogeek	1f7ce58067	adhil machine	2025-12-10 11:38:03 +07:00
kurogeek	b3d61ef94e	nix fmt	2025-12-10 11:08:12 +07:00
kurogeek	3b2b4ff2a4	clanService/phonebox: asterisk auto reload when pjsip.conf changed	2025-12-10 11:06:52 +07:00
vi	e26caa3429	jukebox: reassign mpd access control to the firewall dunno how to reliably ensure the mpd service is ordered after each binds_to address is bound (& so bind(3)able)	2025-12-01 00:00:00 +00:00
vi	6604ec303d	neptune: try wifi-only for a bit	2025-12-01 00:00:00 +00:00
vi	c628dd76dd	init jukebox module for neptune fax machine now also stereo	2025-12-01 00:00:00 +00:00
vi	f8f8731303	neptune: lan hosts can stream audio to speakers	2025-12-01 00:00:00 +00:00
vi	3eeb11571d	neptune: static v4 address for (usb nic) uplink	2025-12-01 00:00:00 +00:00
vi	beffa195bf	neptune: use oriental yggdrasil peers	2025-12-09 11:49:47 +07:00
kurogeek	6f85d03d30	update neptune desciption	2025-12-08 13:20:40 +07:00
kurogeek	77f5647d35	clanService/phonebox: fix 'no address available	2025-12-08 12:37:31 +07:00
kurogeek	7caebda927	change clan-core locked.lastModified	2025-12-08 09:51:27 +07:00
kurogeek	6d92bcade3	mirach is a phonebox	2025-12-08 09:47:01 +07:00
kurogeek	03f575edfe	phonebox: wrong strip extension is fixed	2025-12-08 09:33:58 +07:00
kurogeek	08dc583686	alpheratz is a phonebox	2025-12-07 11:29:31 +07:00
kurogeek	eda331d61f	add almach to phonebox	2025-12-07 11:24:50 +07:00
kurogeek	b89e62b727	think.greaterchiangmai.com is running on ramus	2025-12-06 11:26:18 +07:00
kurogeek	6a4eeeb34b	clanService/phonebox: default ata-ethernet-iface is	2025-12-05 14:51:05 +07:00
kurogeek	701f815a01	phonebox: cleanup vars	2025-12-05 14:31:00 +07:00
kurogeek	188c893e97	phone number scheme change to 2 digits prefix and 2 digits local	2025-12-05 14:14:43 +07:00
kurogeek	3a4253cb67	clanService/phonebox: phone and fax network built on yggdrasil with predefine number	2025-12-05 12:12:01 +07:00
kurogeek	c9ec7371f2	inventory yggdrasil -> yggdrasil-phone-network	2025-12-05 11:27:14 +07:00
kurogeek	39a277a075	use clan-core yggdrasil	2025-12-05 11:22:05 +07:00
kurogeek	79cad87f43	bump clan-core	2025-12-05 10:35:41 +07:00
kurogeek	6312ae3587	bump clan-core	2025-12-05 10:27:27 +07:00
kurogeek	b6297c2d8e	rm clanService/asterisk	2025-12-04 17:30:57 +07:00
kurogeek	7067fd43c4	bump clan-core	2025-12-04 10:00:55 +07:00
kurogeek	36ff92a984	nix fmt	2025-12-04 09:57:07 +07:00
kurogeek	62e4ea61e0	almach machine	2025-12-03 14:11:42 +07:00
kurogeek	bba1858c6a	mirach machine	2025-12-03 14:01:36 +07:00
kurogeek	58bd02575f	alpheratz machine	2025-12-03 13:40:18 +07:00
kurogeek	5ecff1bc9e	bump clan-core	2025-12-03 09:58:39 +07:00
kurogeek	7a381a310e	tor connection	2025-11-28 14:55:21 +07:00
kurogeek	36c31507e2	Update vars via generator tor_tor for machine vega	2025-11-28 14:54:35 +07:00
kurogeek	bfea371501	Update vars via generator tor_tor for machine sirius	2025-11-28 14:54:32 +07:00
kurogeek	ff0bc698d4	Update vars via generator tor_tor for machine rigel	2025-11-28 14:54:29 +07:00
kurogeek	11c109970a	Update vars via generator tor_tor for machine ramus	2025-11-28 14:54:26 +07:00
kurogeek	ad95a8710c	Update vars via generator tor_tor for machine b4l	2025-11-28 14:54:23 +07:00
kurogeek	e6760d320d	ramus machine	2025-11-26 14:01:11 +07:00
kurogeek	bfeea4156b	disappearing default route is fixed by a hacky way	2025-11-21 16:53:55 +07:00
kurogeek	3aa93c1333	nameservers whitehouse	2025-11-18 13:58:59 +07:00
kurogeek	b541e9ff4c	Update vars via generator state-version for machine rigel	2025-11-10 14:48:37 +07:00
kurogeek	bdf1e3e5bc	Update vars via generator state-version for machine b4l	2025-11-10 14:48:37 +07:00
kurogeek	ab88d74226	sirius WhiteHouse NAS	2025-11-10 14:47:09 +07:00
kurogeek	162707546c	whitehouse router: add vlan on wan interface	2025-11-07 15:04:26 +07:00
kurogeek	2c9592c542	more packages on common	2025-11-06 15:57:01 +07:00
kurogeek	0bb6314a03	Update vars via generator state-version for machine vega	2025-11-05 16:22:09 +07:00
kurogeek	13df0a8421	common nixos module	2025-11-05 16:21:50 +07:00
kurogeek	4259d8014e	use upstream clan testModule	2025-10-31 13:53:16 +07:00
kurogeek	71a3ca375f	nixpkgs go back to rev d7f52a7a640bc54c7bb414cca603835bf8dd4b10 since the new one has issue with clan tests	2025-10-31 13:52:52 +07:00
kurogeek	891504f173	rename checks services	2025-10-30 12:03:24 +07:00
kurogeek	5ffbe0ed9b	bump clan-core, nixpkgs	2025-10-30 11:59:22 +07:00
kurogeek	7115a93a0b	clanService asterisk	2025-10-22 16:40:59 +07:00
kurogeek	b5f3adacd8	clanService yggdrasil add vars yggdrasil/yggdrasil-subnet	2025-10-21 15:55:18 +07:00
kurogeek	2eb52251cc	clanService yggdrasil	2025-10-17 16:58:43 +07:00
kurogeek	be25560858	WhiteHouse router configuration	2025-10-16 14:53:41 +07:00