feat: winters <> summers parity

2026-04-14 13:19:09 +02:00 · 2026-01-10 15:56:09 +01:00 · 2026-01-10 15:56:09 +01:00 · 04e3bcefc3
commit 04e3bcefc3
parent 7cacce85a0
144 changed files with 3628 additions and 732 deletions
--- a/modules/nixos/common/globals.nix
+++ b/modules/nixos/common/globals.nix
@ -189,6 +189,14 @@ in
                    type = types.nullOr types.str;
                    default = null;
                  };
+                  serviceAddress = mkOption {
+                    type = types.nullOr types.str;
+                    default = null;
+                  };
+                  homeServiceAddress = mkOption {
+                    type = types.nullOr types.str;
+                    default = null;
+                  };
                  isHome = mkOption {
                    type = types.bool;
                    default = false;
--- a/modules/nixos/common/lanzaboote.nix
+++ b/modules/nixos/common/lanzaboote.nix
@ -1,18 +1,25 @@
 { lib, pkgs, config, minimal, ... }:
+let
+  inherit (config.swarselsystems) isSecureBoot isImpermanence;
+in
 {
  options.swarselmodules.lanzaboote = lib.mkEnableOption "lanzaboote config";
  config = lib.mkIf config.swarselmodules.lanzaboote {

-    environment.systemPackages = lib.mkIf config.swarselsystems.isSecureBoot [
+    environment.systemPackages = lib.mkIf isSecureBoot [
      pkgs.sbctl
    ];

+    environment.persistence."/persist" = lib.mkIf (isImpermanence && isSecureBoot) {
+      directories = [{ directory = "/var/lib/sbctl"; }];
+    };
+
    boot = {
      loader = {
        efi.canTouchEfiVariables = true;
-        systemd-boot.enable = lib.swarselsystems.mkIfElse (minimal || !config.swarselsystems.isSecureBoot) (lib.mkForce true) (lib.mkForce false);
+        systemd-boot.enable = lib.swarselsystems.mkIfElse (minimal || !isSecureBoot) (lib.mkForce true) (lib.mkForce false);
      };
-      lanzaboote = lib.mkIf (!minimal && config.swarselsystems.isSecureBoot) {
+      lanzaboote = lib.mkIf (!minimal && isSecureBoot) {
        enable = true;
        pkiBundle = "/var/lib/sbctl";
        configurationLimit = 6;
--- a/modules/nixos/common/pii.nix
+++ b/modules/nixos/common/pii.nix
@ -53,7 +53,7 @@ in

      secrets = lib.mkOption {
        readOnly = true;
-        default = lib.mapAttrs (_: x: importEncrypted x { inherit lib nodes inputs; }) config.repo.secretFiles;
+        default = lib.mapAttrs (_: x: importEncrypted x { inherit lib nodes inputs; inherit (inputs.topologyPrivate) topologyPrivate; }) config.repo.secretFiles;
        type = lib.types.unspecified;
        description = "Exposes the loaded repo secrets. This option is read-only.";
      };
--- a/modules/nixos/optional/systemd-networkd-server-home.nix
+++ b/modules/nixos/optional/systemd-networkd-server-home.nix
@ -21,6 +21,7 @@ in

    boot.initrd = lib.mkIf (isCrypted && (localVLANsList != [ ]) && (!isRouter)) {
      availableKernelModules = [ "8021q" ];
+      kernelModules = [ "8021q" ]; # at least summers needs this to actually find the interfaces
      systemd.network = {
        enable = true;
        netdevs."30-vlan-${initrdVLAN}" = {
@ -55,6 +56,20 @@ in
      };
    };

+    topology.self.interfaces = (lib.mapAttrs'
+      (vlanName: _:
+        lib.nameValuePair "vlan-${vlanName}" {
+          network = lib.mkForce vlanName;
+        }
+      )
+      localVLANs) // (lib.mapAttrs'
+      (vlanName: _:
+        lib.nameValuePair "me-${vlanName}" {
+          network = lib.mkForce vlanName;
+        }
+      )
+      localVLANs);
+
    systemd.network = {
      netdevs = lib.flip lib.concatMapAttrs localVLANs (
        vlanName: vlanCfg: {
--- a/modules/nixos/optional/systemd-networkd-server.nix
+++ b/modules/nixos/optional/systemd-networkd-server.nix
@ -25,6 +25,7 @@ in
        in
        {
          "10-${ifName}" = lib.mkIf (isRouter || (localVLANs == [ ])) {
+            # address = lib.optionals (isRouter || (localVLANs == [ ])) [
            address = [
              "${globals.networks.${config.swarselsystems.server.netConfigName}.hosts.${config.node.name}.cidrv4}"
              "${globals.networks.${config.swarselsystems.server.netConfigName}.hosts.${config.node.name}.cidrv6}"
--- a/modules/nixos/server/adguardhome.nix
+++ b/modules/nixos/server/adguardhome.nix
@ -24,7 +24,8 @@ in
      };
      services.${serviceName} = {
        domain = serviceDomain;
-        inherit proxyAddress4 proxyAddress6 isHome;
+        inherit proxyAddress4 proxyAddress6 isHome serviceAddress;
+        homeServiceAddress = lib.mkIf isHome homeServiceAddress;
      };
    };

@ -64,6 +65,7 @@ in
            # FIXME: change to homeWebProxy once that is setup
            answer = globals.networks.home-lan.vlans.services.hosts.${homeWebProxy}.ipv4;
            # answer = globals.hosts.${webProxy}.wanAddress4;
+            enabled = true;
          })
          homeDomains;
        filters = [
@ -83,6 +85,7 @@ in
            enabled = true;
          }
        ];
+        user_rules = config.repo.secrets.local.adguardUserRules;
      };
    };

--- a/modules/nixos/server/ankisync.nix
+++ b/modules/nixos/server/ankisync.nix
@ -31,7 +31,8 @@ in
      };
      services.${serviceName} = {
        domain = serviceDomain;
-        inherit proxyAddress4 proxyAddress6 isHome;
+        inherit proxyAddress4 proxyAddress6 isHome serviceAddress;
+        homeServiceAddress = lib.mkIf isHome homeServiceAddress;
      };
    };

--- a/modules/nixos/server/attic.nix
+++ b/modules/nixos/server/attic.nix
@ -28,7 +28,8 @@ in
      };
      services.${serviceName} = {
        domain = serviceDomain;
-        inherit proxyAddress4 proxyAddress6 isHome;
+        inherit proxyAddress4 proxyAddress6 isHome serviceAddress;
+        homeServiceAddress = lib.mkIf isHome homeServiceAddress;
      };
    };

--- a/modules/nixos/server/atuin.nix
+++ b/modules/nixos/server/atuin.nix
@ -20,7 +20,8 @@ in
      };
      services.${serviceName} = {
        domain = serviceDomain;
-        inherit proxyAddress4 proxyAddress6 isHome;
+        inherit proxyAddress4 proxyAddress6 isHome serviceAddress;
+        homeServiceAddress = lib.mkIf isHome homeServiceAddress;
      };
    };

--- a/modules/nixos/server/disk-encrypt.nix
+++ b/modules/nixos/server/disk-encrypt.nix
@ -51,6 +51,7 @@ in
      initrd = {
        secrets."/tmp${hostKeyPathBase}" = if minimal then (lib.mkForce generatedHostKey) else (lib.mkForce hostKeyPath); # need to mkForce this or it behaves stateful
        availableKernelModules = config.swarselsystems.networkKernelModules;
+        kernelModules = config.swarselsystems.networkKernelModules; # at least summers needs this to actually find the interfaces
        network = {
          enable = true;
          flushBeforeStage2 = true;
--- a/modules/nixos/server/firefly-iii.nix
+++ b/modules/nixos/server/firefly-iii.nix
@ -35,7 +35,8 @@ in

    globals.services.${serviceName} = {
      domain = serviceDomain;
-      inherit proxyAddress4 proxyAddress6 isHome;
+      inherit proxyAddress4 proxyAddress6 isHome serviceAddress;
+      homeServiceAddress = lib.mkIf isHome homeServiceAddress;
    };

    services = {
--- a/modules/nixos/server/firezone.nix
+++ b/modules/nixos/server/firezone.nix
@ -53,7 +53,8 @@ in
      };
      services.${serviceName} = {
        domain = serviceDomain;
-        inherit proxyAddress4 proxyAddress6 isHome;
+        inherit proxyAddress4 proxyAddress6 isHome serviceAddress;
+        homeServiceAddress = lib.mkIf isHome homeServiceAddress;
      };
    };

--- a/modules/nixos/server/forgejo.nix
+++ b/modules/nixos/server/forgejo.nix
@ -34,7 +34,8 @@ in
      };
      services.${serviceName} = {
        domain = serviceDomain;
-        inherit proxyAddress4 proxyAddress6 isHome;
+        inherit proxyAddress4 proxyAddress6 isHome serviceAddress;
+        homeServiceAddress = lib.mkIf isHome homeServiceAddress;
      };
    };

--- a/modules/nixos/server/freshrss.nix
+++ b/modules/nixos/server/freshrss.nix
@ -52,7 +52,8 @@ in

    globals.services.${serviceName} = {
      domain = serviceDomain;
-      inherit proxyAddress4 proxyAddress6 isHome;
+      inherit proxyAddress4 proxyAddress6 isHome serviceAddress;
+      homeServiceAddress = lib.mkIf isHome homeServiceAddress;
    };

    services.${serviceName} =
--- a/modules/nixos/server/garage.nix
+++ b/modules/nixos/server/garage.nix
@ -108,7 +108,8 @@ in
      };
      services.${specificServiceName} = {
        domain = serviceDomain;
-        inherit proxyAddress4 proxyAddress6 isHome;
+        inherit proxyAddress4 proxyAddress6 isHome serviceAddress;
+        homeServiceAddress = lib.mkIf isHome homeServiceAddress;
      };
    };

--- a/modules/nixos/server/homebox.nix
+++ b/modules/nixos/server/homebox.nix
@ -24,7 +24,8 @@ in
      };
      services.${serviceName} = {
        domain = serviceDomain;
-        inherit proxyAddress4 proxyAddress6 isHome;
+        inherit proxyAddress4 proxyAddress6 isHome serviceAddress;
+        homeServiceAddress = lib.mkIf isHome homeServiceAddress;
      };
    };

--- a/modules/nixos/server/hydra.nix
+++ b/modules/nixos/server/hydra.nix
@ -23,7 +23,8 @@ in
      };
      services.${serviceName} = {
        domain = serviceDomain;
-        inherit proxyAddress4 proxyAddress6 isHome;
+        inherit proxyAddress4 proxyAddress6 isHome serviceAddress;
+        homeServiceAddress = lib.mkIf isHome homeServiceAddress;
      };
    };

--- a/modules/nixos/server/immich.nix
+++ b/modules/nixos/server/immich.nix
@ -25,7 +25,8 @@ in
      };
      services.${serviceName} = {
        domain = serviceDomain;
-        inherit proxyAddress4 proxyAddress6 isHome;
+        inherit proxyAddress4 proxyAddress6 isHome serviceAddress;
+        homeServiceAddress = lib.mkIf isHome homeServiceAddress;
      };
    };

--- a/modules/nixos/server/jellyfin.nix
+++ b/modules/nixos/server/jellyfin.nix
@ -11,15 +11,15 @@ in
      extraGroups = [ "video" "render" "users" ];
    };

-    nixpkgs.config.packageOverrides = pkgs: {
-      intel-vaapi-driver = pkgs.intel-vaapi-driver.override { enableHybridCodec = true; };
-    };
+    # nixpkgs.config.packageOverrides = pkgs: {
+    #   intel-vaapi-driver = pkgs.intel-vaapi-driver.override { enableHybridCodec = true; };
+    # };

    hardware.graphics = {
      enable = true;
      extraPackages = with pkgs; [
        intel-media-driver # LIBVA_DRIVER_NAME=iHD
-        intel-vaapi-driver # LIBVA_DRIVER_NAME=i965 (older but works better for Firefox/Chromium)
+        # intel-vaapi-driver # LIBVA_DRIVER_NAME=i965 (older but works better for Firefox/Chromium)
        libva-vdpau-driver
        libvdpau-va-gl
      ];
@ -38,7 +38,8 @@ in
      };
      services.${serviceName} = {
        domain = serviceDomain;
-        inherit proxyAddress4 proxyAddress6 isHome;
+        inherit proxyAddress4 proxyAddress6 isHome serviceAddress;
+        homeServiceAddress = lib.mkIf isHome homeServiceAddress;
      };
    };

--- a/modules/nixos/server/jenkins.nix
+++ b/modules/nixos/server/jenkins.nix
@ -18,7 +18,8 @@ in
      };
      services.${serviceName} = {
        domain = serviceDomain;
-        inherit proxyAddress4 proxyAddress6 isHome;
+        inherit proxyAddress4 proxyAddress6 isHome serviceAddress;
+        homeServiceAddress = lib.mkIf isHome homeServiceAddress;
      };
    };

--- a/modules/nixos/server/kanidm.nix
+++ b/modules/nixos/server/kanidm.nix
@ -72,7 +72,8 @@ in
      };
      services.${serviceName} = {
        domain = serviceDomain;
-        inherit proxyAddress4 proxyAddress6 isHome;
+        inherit proxyAddress4 proxyAddress6 isHome serviceAddress;
+        homeServiceAddress = lib.mkIf isHome homeServiceAddress;
      };
    };

@ -396,13 +397,20 @@ in

    systemd.services.${serviceName}.serviceConfig.RestartSec = "30";

-    nodes = {
-      ${dnsServer}.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
-        "${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
+    nodes =
+      let
+        extraConfig = ''
+          allow ${globals.networks.home-lan.vlans.services.cidrv4};
+          allow ${globals.networks.home-lan.vlans.services.cidrv6};
+        '';
+      in
+      {
+        ${dnsServer}.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
+          "${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
+        };
+        ${webProxy}.services.nginx = confLib.genNginx { inherit serviceAddress servicePort serviceDomain serviceName; protocol = "https"; noSslVerify = true; };
+        ${homeWebProxy}.services.nginx = confLib.genNginx { inherit servicePort serviceDomain serviceName; protocol = "https"; noSslVerify = true; extraConfig = extraConfig + nginxAccessRules; serviceAddress = homeServiceAddress; };
      };
-      ${webProxy}.services.nginx = confLib.genNginx { inherit serviceAddress servicePort serviceDomain serviceName; protocol = "https"; noSslVerify = true; };
-      ${homeWebProxy}.services.nginx = confLib.genNginx { inherit servicePort serviceDomain serviceName; protocol = "https"; noSslVerify = true; extraConfig = nginxAccessRules; serviceAddress = homeServiceAddress; };
-    };

  };
 }
--- a/modules/nixos/server/kavita.nix
+++ b/modules/nixos/server/kavita.nix
@ -37,7 +37,8 @@ in
      };
      services.${serviceName} = {
        domain = serviceDomain;
-        inherit proxyAddress4 proxyAddress6 isHome;
+        inherit proxyAddress4 proxyAddress6 isHome serviceAddress;
+        homeServiceAddress = lib.mkIf isHome homeServiceAddress;
      };
    };

--- a/modules/nixos/server/kea.nix
+++ b/modules/nixos/server/kea.nix
@ -29,7 +29,7 @@ let
            rapid-commit = lib.mkIf (intX == 6) true;
            pools = [
              {
-                pool = "${lib.net.cidr.host 20 vlanCfg."cidrv${x}"} - ${lib.net.cidr.host (-6) vlanCfg."cidrv${x}"}";
+                pool = "${lib.net.cidr.host 100 vlanCfg."cidrv${x}"} - ${lib.net.cidr.host (-6) vlanCfg."cidrv${x}"}";
              }
            ];
            pd-pools = lib.mkIf (intX == 6) [
--- a/modules/nixos/server/koillection.nix
+++ b/modules/nixos/server/koillection.nix
@ -41,7 +41,8 @@ in
      };
      services.${serviceName} = {
        domain = serviceDomain;
-        inherit proxyAddress4 proxyAddress6 isHome;
+        inherit proxyAddress4 proxyAddress6 isHome serviceAddress;
+        homeServiceAddress = lib.mkIf isHome homeServiceAddress;
      };
    };

--- a/modules/nixos/server/mailserver.nix
+++ b/modules/nixos/server/mailserver.nix
@ -24,7 +24,8 @@ in
      };
      roundcube = {
        domain = roundcubeDomain;
-        inherit proxyAddress4 proxyAddress6 isHome;
+        inherit proxyAddress4 proxyAddress6 isHome serviceAddress;
+        homeServiceAddress = lib.mkIf isHome homeServiceAddress;
      };
    };

--- a/modules/nixos/server/matrix.nix
+++ b/modules/nixos/server/matrix.nix
@ -1,4 +1,4 @@
-{ lib, config, pkgs, globals, dns, confLib, ... }:
+{ self, lib, config, pkgs, globals, dns, confLib, ... }:
 let
  inherit (config.swarselsystems) sopsFile;
  inherit (confLib.gen { name = "matrix"; user = "matrix-synapse"; port = 8008; }) servicePort serviceName serviceUser serviceDomain serviceAddress proxyAddress4 proxyAddress6;
@ -59,6 +59,20 @@ in

    # networking.firewall.allowedTCPPorts = [ servicePort federationPort ];

+    topology.self.services = {
+      ${serviceName} = {
+        name = lib.swarselsystems.toCapitalized serviceName;
+        info = "https://${serviceDomain}";
+        icon = "${self}/files/topology-images/${serviceName}.png";
+      };
+    } // (lib.listToAttrs (map
+      (service:
+        lib.nameValuePair "mautrix-${service}" {
+          name = "mautrix-${service}";
+          icon = "${self}/files/topology-images/mautrix.png";
+        })
+      [ "whatsapp" "signal" "telegram" ]));
+
    systemd = {
      timers."restart-bridges" = {
        wantedBy = [ "timers.target" ];
@ -99,7 +113,8 @@ in
      };
      services.${serviceName} = {
        domain = serviceDomain;
-        inherit proxyAddress4 proxyAddress6 isHome;
+        inherit proxyAddress4 proxyAddress6 isHome serviceAddress;
+        homeServiceAddress = lib.mkIf isHome homeServiceAddress;
      };
    };

--- a/modules/nixos/server/microbin.nix
+++ b/modules/nixos/server/microbin.nix
@ -58,7 +58,8 @@ in
      };
      services.${serviceName} = {
        domain = serviceDomain;
-        inherit proxyAddress4 proxyAddress6 isHome;
+        inherit proxyAddress4 proxyAddress6 isHome serviceAddress;
+        homeServiceAddress = lib.mkIf isHome homeServiceAddress;
      };
    };

--- a/modules/nixos/server/monitoring.nix
+++ b/modules/nixos/server/monitoring.nix
@ -68,7 +68,8 @@ in
      };
      services.${serviceName} = {
        domain = serviceDomain;
-        inherit proxyAddress4 proxyAddress6 isHome;
+        inherit proxyAddress4 proxyAddress6 isHome serviceAddress;
+        homeServiceAddress = lib.mkIf isHome homeServiceAddress;
      };
    };

@ -221,6 +222,10 @@ in

    nodes =
      let
+        extraConfig = ''
+          allow ${globals.networks.home-lan.vlans.services.cidrv4};
+          allow ${globals.networks.home-lan.vlans.services.cidrv6};
+        '';
        genNginx = toAddress: extraConfigPre: {
          upstreams = {
            "${grafanaUpstream}" = {
@ -267,7 +272,7 @@ in
          "${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
        };
        ${webProxy}.services.nginx = genNginx serviceAddress "";
-        ${homeWebProxy}.services.nginx = genNginx homeServiceAddress nginxAccessRules;
+        ${homeWebProxy}.services.nginx = genNginx homeServiceAddress (extraConfig + nginxAccessRules);
      };
  };
 }
--- a/modules/nixos/server/navidrome.nix
+++ b/modules/nixos/server/navidrome.nix
@ -50,7 +50,8 @@ in
      };
      services.${serviceName} = {
        domain = serviceDomain;
-        inherit proxyAddress4 proxyAddress6 isHome;
+        inherit proxyAddress4 proxyAddress6 isHome serviceAddress;
+        homeServiceAddress = lib.mkIf isHome homeServiceAddress;
      };
    };

--- a/modules/nixos/server/network.nix
+++ b/modules/nixos/server/network.nix
@ -27,7 +27,7 @@ in

    swarselsystems.server.localNetwork = netConfig.localNetwork or "";

-    globals.networks = lib.mapAttrs'
+    globals.networks = lib.mkIf config.swarselsystems.writeGlobalNetworks (lib.mapAttrs'
      (netName: _:
        lib.nameValuePair "${netPrefix}-${netName}" {
          hosts.${config.node.name} = {
@ -36,7 +36,7 @@ in
          };
        }
      )
-      netConfig.networks;
+      netConfig.networks);

    globals.hosts.${config.node.name} = {
      defaultGateway4 = netConfig.defaultGateway4 or null;
--- a/modules/nixos/server/nextcloud.nix
+++ b/modules/nixos/server/nextcloud.nix
@ -18,7 +18,8 @@ in

    globals.services.${serviceName} = {
      domain = serviceDomain;
-      inherit proxyAddress4 proxyAddress6 isHome;
+      inherit proxyAddress4 proxyAddress6 isHome serviceAddress;
+      homeServiceAddress = lib.mkIf isHome homeServiceAddress;
    };

    services = {
--- a/modules/nixos/server/oauth2-proxy.nix
+++ b/modules/nixos/server/oauth2-proxy.nix
@ -1,7 +1,7 @@
 { lib, config, globals, dns, confLib, ... }:
 let
  inherit (confLib.gen { name = "oauth2-proxy"; port = 3004; }) servicePort serviceName serviceUser serviceGroup serviceDomain serviceAddress proxyAddress4 proxyAddress6;
-  inherit (confLib.static) isHome isProxied webProxy homeWebProxy dnsServer homeProxyIf webProxyIf oauthServer nginxAccessRules;
+  inherit (confLib.static) isHome isProxied webProxy homeWebProxy dnsServer homeProxyIf webProxyIf oauthServer nginxAccessRules homeServiceAddress;

  kanidmDomain = globals.services.kanidm.domain;
  mainDomain = globals.domains.main;
@ -153,7 +153,8 @@ in
      };
      services.${serviceName} = {
        domain = serviceDomain;
-        inherit proxyAddress4 proxyAddress6 isHome;
+        inherit proxyAddress4 proxyAddress6 isHome serviceAddress;
+        homeServiceAddress = lib.mkIf isHome homeServiceAddress;
      };
    };

@ -211,14 +212,16 @@ in
        extraConfig = ''
          proxy_set_header X-Scheme                $scheme;
          proxy_set_header X-Auth-Request-Redirect $scheme://$host$request_uri;
+          allow ${globals.networks.home-lan.vlans.services.cidrv4};
+          allow ${globals.networks.home-lan.vlans.services.cidrv6};
        '';
      in
      {
        ${dnsServer}.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
          "${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
        };
-        ${webProxy}.services.nginx = confLib.genNginx { inherit servicePort serviceAddress serviceDomain serviceName extraConfig; protocol = "https"; };
-        ${homeWebProxy}.services.nginx = confLib.genNginx { inherit servicePort serviceDomain serviceName; protocol = "https"; extraConfig = extraConfig + nginxAccessRules; serviceAddress = globals.hosts.${oauthServer}.wanAddress4; };
+        ${webProxy}.services.nginx = confLib.genNginx { inherit servicePort serviceAddress serviceDomain serviceName extraConfig; };
+        ${homeWebProxy}.services.nginx = confLib.genNginx { inherit servicePort serviceDomain serviceName; extraConfig = extraConfig + nginxAccessRules; serviceAddress = globals.hosts.${oauthServer}.wanAddress4; };
      };
  };
 }
--- a/modules/nixos/server/paperless.nix
+++ b/modules/nixos/server/paperless.nix
@ -34,7 +34,8 @@ in
      };
      services.${serviceName} = {
        domain = serviceDomain;
-        inherit proxyAddress4 proxyAddress6 isHome;
+        inherit proxyAddress4 proxyAddress6 isHome serviceAddress;
+        homeServiceAddress = lib.mkIf isHome homeServiceAddress;
      };
    };

--- a/modules/nixos/server/postgresql.nix
+++ b/modules/nixos/server/postgresql.nix
@ -1,4 +1,4 @@
-{ config, lib, pkgs, confLib, ... }:
+{ self, config, lib, pkgs, confLib, ... }:
 let
  inherit (confLib.gen { name = "postgresql"; port = 3254; }) serviceName;
  postgresVersion = 14;
@ -7,6 +7,14 @@ in
 {
  options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
  config = lib.mkIf config.swarselmodules.server.${serviceName} {
+
+    topology.self.services = {
+      ${serviceName} = {
+        name = lib.swarselsystems.toCapitalized serviceName;
+        icon = "${self}/files/topology-images/${serviceName}.png";
+      };
+    };
+
    services = {
      ${serviceName} = {
        enable = true;
--- a/modules/nixos/server/radicale.nix
+++ b/modules/nixos/server/radicale.nix
@ -42,7 +42,8 @@ in
      };
      services.${serviceName} = {
        domain = serviceDomain;
-        inherit proxyAddress4 proxyAddress6 isHome;
+        inherit proxyAddress4 proxyAddress6 isHome serviceAddress;
+        homeServiceAddress = lib.mkIf isHome homeServiceAddress;
      };
    };

--- a/modules/nixos/server/router.nix
+++ b/modules/nixos/server/router.nix
@ -7,8 +7,9 @@ let
    })
    globals.networks.home-lan.vlans;
  selectVLANs = vlans: map (vlan: { VLAN = globals.networks.home-lan.vlans.${vlan}.id; }) vlans;
+  lan3VLANs = selectVLANs [ "home" "devices" "services" ];
+  lan4VLANs = lan3VLANs;
  lan5VLANs = selectVLANs [ "home" "devices" "guests" ];
-  lan4VLANs = selectVLANs [ "home" "services" ];
  inherit (globals.general) homeDnsServer;
 in
 {
@ -205,9 +206,9 @@ in
              Bridge = "br";
              ConfigureWithoutCarrier = true;
            };
-            inherit bridgeVLANs;
+            bridgeVLANs = lan3VLANs;
          };
-          # winters
+          # summers
          "30-lan4" = {
            matchConfig.MACAddress = config.repo.secrets.local.networking.networks.lan4.mac;
            linkConfig.RequiredForOnline = "enslaved";
--- a/modules/nixos/server/shlink.nix
+++ b/modules/nixos/server/shlink.nix
@ -94,7 +94,8 @@ in
      };
      services.${serviceName} = {
        domain = serviceDomain;
-        inherit proxyAddress4 proxyAddress6 isHome;
+        inherit proxyAddress4 proxyAddress6 isHome serviceAddress;
+        homeServiceAddress = lib.mkIf isHome homeServiceAddress;
      };
    };

--- a/modules/nixos/server/slink.nix
+++ b/modules/nixos/server/slink.nix
@ -71,7 +71,8 @@ in
      };
      services.${serviceName} = {
        domain = serviceDomain;
-        inherit proxyAddress4 proxyAddress6 isHome;
+        inherit proxyAddress4 proxyAddress6 isHome serviceAddress;
+        homeServiceAddress = lib.mkIf isHome homeServiceAddress;
      };
    };

--- a/modules/nixos/server/snipe-it.nix
+++ b/modules/nixos/server/snipe-it.nix
@ -32,7 +32,8 @@ in
      };
      services.${serviceName} = {
        domain = serviceDomain;
-        inherit proxyAddress4 proxyAddress6 isHome;
+        inherit proxyAddress4 proxyAddress6 isHome serviceAddress;
+        homeServiceAddress = lib.mkIf isHome homeServiceAddress;
      };
    };

--- a/modules/nixos/server/syncthing.nix
+++ b/modules/nixos/server/syncthing.nix
@ -70,7 +70,8 @@ in
      };
      services.${specificServiceName} = {
        domain = serviceDomain;
-        inherit proxyAddress4 proxyAddress6 isHome;
+        inherit proxyAddress4 proxyAddress6 isHome serviceAddress;
+        homeServiceAddress = lib.mkIf isHome homeServiceAddress;
      };
    };

@ -129,8 +130,8 @@ in
    };

    nodes = {
-      ${dnsServer}.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
-        "${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
+      ${dnsServer}.swarselsystems.server.dns.${globals.services.${specificServiceName}.baseDomain}.subdomainRecords = {
+        "${globals.services.${specificServiceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
      };
      ${webProxy}.services.nginx = confLib.genNginx { inherit serviceAddress servicePort serviceDomain; serviceName = specificServiceName; maxBody = 0; };
      ${homeWebProxy}.services.nginx = lib.mkIf isHome (confLib.genNginx { inherit servicePort serviceDomain; serviceName = specificServiceName; maxBody = 0; extraConfig = nginxAccessRules; serviceAddress = homeServiceAddress; });