feat[client,server]: add remote builds, confLib

modules/nixos/client/remotebuild.nix

@@ -0,0 +1,85 @@
+{ lib, config, globals, ... }:
+let
+  inherit (config.swarselsystems) homeDir mainUser isClient;
+in
+{
+  options.swarselmodules.remotebuild = lib.mkEnableOption "enable remote builds on this machine";
+  config = lib.mkIf config.swarselmodules.remotebuild {
+
+    sops.secrets = {
+      builder-key = lib.mkIf isClient { owner = mainUser; path = "${homeDir}/.ssh/builder"; mode = "0600"; };
+      nixbuild-net-key = { owner = mainUser; path = "${homeDir}/.ssh/nixbuild-net"; mode = "0600"; };
+    };
+
+    nix = {
+      settings.builders-use-substitutes = true;
+      distributedBuilds = true;
+      buildMachines = [
+        (lib.mkIf isClient {
+          hostName = config.repo.secrets.common.builder1-ip;
+          system = "aarch64-linux";
+          maxJobs = 20;
+          speedFactor = 10;
+        })
+        (lib.mkIf isClient {
+          hostName = globals.hosts.belchsfactory.wanAddress4;
+          system = "aarch64-linux";
+          maxJobs = 4;
+          speedFactor = 2;
+          protocol = "ssh-ng";
+        })
+        {
+          hostName = "eu.nixbuild.net";
+          system = "x86_64-linux";
+          maxJobs = 100;
+          speedFactor = 2;
+          supportedFeatures = [ "big-parallel" ];
+        }
+      ];
+    };
+    programs.ssh = {
+      knownHosts = {
+        nixbuild = {
+          hostNames = [ "eu.nixbuild.net" ];
+          publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPIQCZc54poJ8vqawd8TraNryQeJnvH1eLpIDgbiqymM";
+        };
+        builder1 = lib.mkIf isClient {
+          hostNames = [ config.repo.secrets.common.builder1-ip ];
+          publicKey = config.repo.secrets.common.builder1-pubHostKey;
+        };
+        jump = lib.mkIf isClient {
+          hostNames = [ globals.hosts.liliputsteps.wanAddress4 ];
+          publicKey = config.repo.secrets.common.jump-pubHostKey;
+        };
+        builder2 = lib.mkIf isClient {
+          hostNames = [ globals.hosts.belchsfactory.wanAddress4 ];
+          publicKey = config.repo.secrets.common.builder2-pubHostKey;
+        };
+      };
+      extraConfig = ''
+        Host eu.nixbuild.net
+          ConnectTimeout 1
+          PubkeyAcceptedKeyTypes ssh-ed25519
+          ServerAliveInterval 60
+          IPQoS throughput
+          IdentityFile ${config.sops.secrets.nixbuild-net-key.path}
+      '' + lib.optionalString isClient ''
+        Host ${config.repo.secrets.common.builder1-ip}
+          ConnectTimeout 1
+          User ${mainUser}
+          IdentityFile ${config.sops.secrets.builder-key.path}
+
+        Host ${globals.hosts.belchsfactory.wanAddress4}
+          ConnectTimeout 5
+          ProxyJump ${globals.hosts.liliputsteps.wanAddress4}
+          User builder
+          IdentityFile ${config.sops.secrets.builder-key.path}
+
+        Host ${globals.hosts.liliputsteps.wanAddress4}
+          ConnectTimeout 1
+          User jump
+          IdentityFile ${config.sops.secrets.builder-key.path}
+      '';
+    };
+  };
+}

modules/nixos/client/uwsm.nix

@@ -13,7 +13,7 @@ in
           comment = "Sway compositor managed by UWSM";
           binPath = "/run/current-system/sw/bin/sway";
         };
-        niri = {
+        niri = lib.mkIf (config.swarselmodules ? niri) {
           prettyName = "Niri";
           comment = "Niri compositor managed by UWSM";
           binPath = "/run/current-system/sw/bin/niri-session";

modules/nixos/common/globals.nix

@@ -197,6 +197,10 @@ in
             main = mkOption {
               type = types.str;
             };
+            externalDns = mkOption {
+              type = types.listOf types.str;
+              description = "List of external dns nameservers";
+            };
           };
         };
       };

modules/nixos/common/home-manager-secrets.nix

@@ -25,7 +25,7 @@ in
       }) // (lib.optionalAttrs modules.emacs {
         emacs-radicale-pw = { owner = mainUser; };
         github-forge-token = { owner = mainUser; };
-      }) // (lib.optionalAttrs modules.optional.work {
+      }) // (lib.optionalAttrs (modules ? optional-work) {
         harica-root-ca = { sopsFile = certsSopsFile; path = "${homeDir}/.aws/certs/harica-root.pem"; owner = mainUser; };
       }) // (lib.optionalAttrs modules.anki {
         anki-user = { owner = mainUser; };

modules/nixos/common/nodes.nix

@@ -34,6 +34,11 @@ let
       "nginx"
       "virtualHosts"
     ]
+    [
+      "swarselsystems"
+      "server"
+      "dns"
+    ]
   ];
 
   attrsForEachOption =

modules/nixos/common/settings.nix

@@ -59,8 +59,8 @@ in
   config = lib.mkIf config.swarselmodules.general
     (lib.recursiveUpdate
       {
-        sops.secrets.github-api-token = lib.mkIf (!minimal) {
-          owner = mainUser;
+        sops.secrets = lib.mkIf (!minimal) {
+          github-api-token = { owner = mainUser; };
         };
 
         nix =
@@ -83,7 +83,11 @@ in
               trusted-public-keys = [
                 atticPublicKey
               ];
-              trusted-users = [ "@wheel" "${config.swarselsystems.mainUser}" ];
+              trusted-users = [
+                "@wheel"
+                "${config.swarselsystems.mainUser}"
+                (lib.mkIf config.swarselmodules.server.ssh-builder "builder")
+              ];
             };
             # extraOptions = ''
             #   plugin-files = ${pkgs.dev.nix-plugins}/lib/nix/plugins

modules/nixos/optional/amdcpu.nix

@@ -1,7 +1,6 @@
-{ lib, config, ... }:
+_:
 {
-  options.swarselmodules.optional.amdcpu = lib.mkEnableOption "optional amd cpu settings";
-  config = lib.mkIf config.swarselmodules.optional.amdcpu {
+  config = {
     hardware = {
       cpu.amd.updateMicrocode = true;
     };

modules/nixos/optional/amdgpu.nix

@@ -1,7 +1,6 @@
-{ lib, config, ... }:
+_:
 {
-  options.swarselmodules.optional.amdgpu = lib.mkEnableOption "optional amd gpu settings";
-  config = lib.mkIf config.swarselmodules.optional.amdgpu {
+  config = {
     hardware = {
       amdgpu = {
         opencl.enable = true;

modules/nixos/optional/framework.nix

@@ -1,7 +1,13 @@
-{ lib, config, ... }:
+{ self, config, ... }:
 {
-  options.swarselmodules.optional.framework = lib.mkEnableOption "optional framework machine settings";
-  config = lib.mkIf config.swarselmodules.optional.framework {
+  config = {
+
+    home-manager.users."${config.swarselsystems.mainUser}" = {
+      imports = [
+        "${self}/modules/home/optional/framework.nix"
+      ];
+    };
+
     services = {
       fwupd = {
         enable = true;

modules/nixos/optional/gaming.nix

@@ -1,7 +1,13 @@
-{ pkgs, lib, config, ... }:
+{ self, pkgs, config, ... }:
 {
-  options.swarselmodules.optional.gaming = lib.mkEnableOption "optional gaming settings";
-  config = lib.mkIf config.swarselmodules.optional.gaming {
+  config = {
+
+    home-manager.users."${config.swarselsystems.mainUser}" = {
+      imports = [
+        "${self}/modules/home/optional/gaming.nix"
+      ];
+    };
+
     programs.steam = {
       enable = true;
       package = pkgs.steam;

modules/nixos/optional/hibernation.nix

@@ -1,6 +1,5 @@
 { lib, config, ... }:
 {
-  options.swarselmodules.optional.hibernation = lib.mkEnableOption "optional amd gpu settings";
   options.swarselsystems = {
     hibernation = {
       offset = lib.mkOption {
@@ -13,7 +12,7 @@
       };
     };
   };
-  config = lib.mkIf config.swarselmodules.optional.hibernation {
+  config = {
     boot = {
       kernelParams = [
         "resume_offset=${builtins.toString config.swarselsystems.hibernation.offset}"

modules/nixos/optional/microvm-guest.nix

@@ -1,11 +1,9 @@
-{ lib, config, ... }:
+_:
 {
-  options.swarselmodules.optional.microvmGuest = lib.mkEnableOption "optional microvmGuest settings";
   # imports = [
   #   inputs.microvm.nixosModules.microvm
-  #   "${self}/profiles/nixos"
-  #   "${self}/modules/nixos"
   # ];
-  config = lib.mkIf config.swarselmodules.optional.microvmGuest
+
+  config =
     { };
 }

modules/nixos/optional/microvm-host.nix

@@ -1,10 +1,7 @@
-{ lib, config, ... }:
+{ config, lib, ... }:
 {
-  options = {
-    swarselmodules.optional.microvmHost = lib.mkEnableOption "optional microvmHost settings";
-  };
   # imports = [
-  #   inputs.microvm.nixosModules.host
+  # inputs.microvm.nixosModules.host
   # ];
 
   config = lib.mkIf (config.guests != { }) {

modules/nixos/optional/niri.nix

@@ -1,8 +1,11 @@
-{ lib, config, pkgs, ... }:
+{ inputs, lib, config, pkgs, ... }:
 let
   moduleName = "niri";
 in
 {
+  imports = [
+    inputs.niri-flake.nixosModules.niri
+  ];
   options.swarselmodules.${moduleName} = lib.mkEnableOption "${moduleName} settings";
   config = lib.mkIf config.swarselmodules.${moduleName}
     {

modules/nixos/optional/nswitch-rcm.nix

@@ -1,7 +1,6 @@
-{ lib, config, pkgs, ... }:
+{ pkgs, ... }:
 {
-  options.swarselmodules.optional.nswitch-rcm = lib.mkEnableOption "optional nswitch-rcm settings";
-  config = lib.mkIf config.swarselmodules.optional.nswitch-rcm {
+  config = {
     services.nswitch-rcm = {
       enable = true;
       package = pkgs.fetchurl {

modules/nixos/optional/systemd-networkd-server.nix

@@ -0,0 +1,50 @@
+{ lib, config, globals, ... }:
+{
+  networking = {
+    useDHCP = lib.mkForce false;
+    useNetworkd = true;
+    dhcpcd.enable = false;
+    renameInterfacesByMac = lib.mapAttrs (_: v: v.mac) (
+      config.repo.secrets.local.networking.networks or { }
+    );
+  };
+  boot.initrd.systemd.network = {
+    enable = true;
+    networks."10-${config.swarselsystems.server.localNetwork}" = config.systemd.network.networks."10-${config.swarselsystems.server.localNetwork}";
+  };
+
+  systemd = {
+    network = {
+      enable = true;
+      wait-online.enable = false;
+      networks =
+        let
+          netConfig = config.repo.secrets.local.networking;
+        in
+        {
+          "10-${config.swarselsystems.server.localNetwork}" = {
+            address = [
+              "${globals.networks.${config.swarselsystems.server.netConfigName}.hosts.${config.node.name}.cidrv4}"
+              "${globals.networks.${config.swarselsystems.server.netConfigName}.hosts.${config.node.name}.cidrv6}"
+            ];
+            routes = [
+              {
+                Gateway = netConfig.defaultGateway6;
+                GatewayOnLink = true;
+              }
+              {
+                Gateway = netConfig.defaultGateway4;
+                GatewayOnLink = true;
+              }
+            ];
+            networkConfig = {
+              IPv6PrivacyExtensions = true;
+              IPv6AcceptRA = false;
+            };
+            matchConfig.MACAddress = netConfig.networks.${config.swarselsystems.server.localNetwork}.mac;
+            linkConfig.RequiredForOnline = "routable";
+          };
+        };
+    };
+  };
+}

modules/nixos/optional/uni.nix

@@ -0,0 +1,11 @@
+{ self, config, ... }:
+{
+  config = {
+
+    home-manager.users."${config.swarselsystems.mainUser}" = {
+      imports = [
+        "${self}/modules/home/optional/work.nix"
+      ];
+    };
+  };
+}

modules/nixos/optional/virtualbox.nix

@@ -1,7 +1,6 @@
 { lib, config, pkgs, ... }:
 {
-  options.swarselmodules.optional.virtualbox = lib.mkEnableOption "optional VBox settings";
-  config = lib.mkIf config.swarselmodules.optional.virtualbox {
+  config = {
     # specialisation = {
     #   VBox.configuration = {
     virtualisation.virtualbox = {

modules/nixos/optional/vmware.nix

@@ -1,8 +1,7 @@
-{ lib, config, ... }:
+_:
 {
 
-  options.swarselmodules.optional.vmware = lib.mkEnableOption "optional vmware settings";
-  config = lib.mkIf config.swarselmodules.optional.vmware {
+  config = {
     virtualisation.vmware.host.enable = true;
     virtualisation.vmware.guest.enable = true;
   };

modules/nixos/optional/work.nix

@@ -1,4 +1,4 @@
-{ self, lib, pkgs, config, configName, ... }:
+{ self, lib, pkgs, config, ... }:
 let
   inherit (config.swarselsystems) mainUser homeDir;
   iwd = config.networking.networkmanager.wifi.backend == "iwd";
@@ -6,18 +6,24 @@ let
   sopsFile = self + /secrets/work/secrets.yaml;
 in
 {
-  options.swarselmodules.optional.work = lib.mkEnableOption "optional work settings";
   options.swarselsystems = {
     hostName = lib.mkOption {
       type = lib.types.str;
-      default = configName;
+      default = config.node.name;
     };
     fqdn = lib.mkOption {
       type = lib.types.str;
       default = "";
     };
   };
-  config = lib.mkIf config.swarselmodules.optional.work {
+  config = {
+
+    home-manager.users."${config.swarselsystems.mainUser}" = {
+      imports = [
+        "${self}/modules/home/optional/work.nix"
+      ];
+    };
+
     sops =
       let
         secretNames = [

modules/nixos/server/ankisync.nix

@@ -9,7 +9,7 @@ in
   options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
   config = lib.mkIf config.swarselmodules.server.${serviceName} {
 
-    swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
+    nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
       "${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
     };
 

modules/nixos/server/attic.nix

@@ -10,7 +10,7 @@ in
   };
   config = lib.mkIf config.swarselmodules.server.${serviceName} {
 
-    swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
+    nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
       "${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
     };
 

modules/nixos/server/atuin.nix

@@ -6,7 +6,7 @@ in
   options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
   config = lib.mkIf config.swarselmodules.server.${serviceName} {
 
-    swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
+    nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
       "${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
     };
 

modules/nixos/server/bastion.nix

@@ -0,0 +1,67 @@
+{ self, lib, config, ... }:
+{
+  options.swarselmodules.server.bastion = lib.mkEnableOption "enable bastion on server";
+  config = lib.mkIf config.swarselmodules.server.bastion {
+
+    users = {
+      groups = {
+        jump = { };
+      };
+      users = {
+        "jump" = {
+          isNormalUser = true;
+          useDefaultShell = true;
+          group = lib.mkForce "jump";
+          createHome = lib.mkForce true;
+          openssh.authorizedKeys.keyFiles = [
+            (self + /secrets/keys/ssh/yubikey.pub)
+            (self + /secrets/keys/ssh/magicant.pub)
+            (self + /secrets/keys/ssh/builder.pub)
+          ];
+        };
+      };
+    };
+
+
+    services.openssh = {
+      enable = true;
+      startWhenNeeded = lib.mkForce false;
+      authorizedKeysInHomedir = false;
+      extraConfig = ''
+        Match User jump
+          PermitTTY no
+          X11Forwarding no
+          PermitTunnel no
+          GatewayPorts no
+          AllowAgentForwarding no
+      '';
+      settings = {
+        PasswordAuthentication = false;
+        KbdInteractiveAuthentication = false;
+        PermitRootLogin = lib.mkDefault "no";
+        AllowUsers = [
+          "jump"
+        ];
+      };
+      hostKeys = lib.mkIf (!config.swarselmodules.server.ssh) [
+        {
+          path = "/etc/ssh/ssh_host_ed25519_key";
+          type = "ed25519";
+        }
+      ];
+    };
+
+    home-manager.users.jump.config = {
+      home.stateVersion = lib.mkDefault "23.05";
+      programs.ssh = {
+        enable = true;
+        enableDefaultConfig = false;
+        matchBlocks = {
+          "*" = {
+            forwardAgent = false;
+          };
+        } // config.repo.secrets.local.ssh.hosts;
+      };
+    };
+  };
+}

modules/nixos/server/croc.nix

@@ -17,7 +17,7 @@ in
   options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
   config = lib.mkIf config.swarselmodules.server.${serviceName} {
 
-    swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
+    nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
       "${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
     };
 

modules/nixos/server/disk-encrypt.nix

@@ -1,7 +1,7 @@
 { self, pkgs, lib, config, globals, minimal, ... }:
 let
-  localIp = globals.networks."${if config.swarselsystems.isCloud then config.node.name else "home"}-${config.swarselsystems.server.localNetwork}".hosts.${config.node.name}.ipv4;
-  subnetMask = globals.networks."${if config.swarselsystems.isCloud then config.node.name else "home"}-${config.swarselsystems.server.localNetwork}".subnetMask4;
+  localIp = globals.networks.${config.swarselsystems.server.netConfigName}.hosts.${config.node.name}.ipv4;
+  subnetMask = globals.networks.${config.swarselsystems.server.netConfigName}.subnetMask4;
   gatewayIp = globals.hosts.${config.node.name}.defaultGateway4;
 
   hostKeyPathBase = "/etc/secrets/initrd/ssh_host_ed25519_key";
@@ -36,7 +36,7 @@ in
       files = [ hostKeyPathBase ];
     };
 
-    boot = lib.mkIf (!config.swarselsystems.isLaptop) {
+    boot = lib.mkIf (!config.swarselsystems.isClient) {
       kernelParams = lib.mkIf (!config.swarselsystems.isCloud) [
         "ip=${localIp}::${gatewayIp}:${subnetMask}:${config.networking.hostName}::none"
       ];

modules/nixos/server/firefly-iii.nix

@@ -11,7 +11,7 @@ in
   options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
   config = lib.mkIf config.swarselmodules.server.${serviceName} {
 
-    swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
+    nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
       "${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
     };
 

modules/nixos/server/forgejo.nix

@@ -9,7 +9,7 @@ in
   options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
   config = lib.mkIf config.swarselmodules.server.${serviceName} {
 
-    swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
+    nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
       "${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
     };
 

modules/nixos/server/freshrss.nix

@@ -8,7 +8,7 @@ in
   options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
   config = lib.mkIf config.swarselmodules.server.${serviceName} {
 
-    swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
+    nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
       "${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
     };
 

modules/nixos/server/garage.nix

@@ -54,11 +54,11 @@ in
     assertions = [
       {
         assertion = config.swarselsystems.server.${serviceName}.buckets != [ ];
-        message = "If Garage is enabled, at least one bucket must be specified in atro.garage.buckets";
+        message = "If Garage is enabled, at least one bucket must be specified in swarselsystems.server.${serviceName}.buckets";
       }
       {
         assertion = builtins.length (lib.attrsToList config.swarselsystems.server.${serviceName}.keys) > 0;
-        message = "If Garage is enabled, at least one key must be specified in atro.garage.keys";
+        message = "If Garage is enabled, at least one key must be specified in swarselsystems.server.${serviceName}.keys";
       }
       {
         assertion =
@@ -71,7 +71,7 @@ in
       }
     ];
 
-    swarselsystems.server.dns.${baseDomain}.subdomainRecords = {
+    nodes.stoicclub.swarselsystems.server.dns.${baseDomain}.subdomainRecords = {
       "${subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
       "${subDomain}admin" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
       "${subDomain}web" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
@@ -121,7 +121,7 @@ in
 
         rpc_bind_addr = "[::]:${builtins.toString garageRpcPort}";
         # we are not joining our nodes, just use the private ipv4
-        rpc_public_addr = "${globals.networks."${if config.swarselsystems.isCloud then config.node.name else "home"}-${config.swarselsystems.server.localNetwork}".hosts.${config.node.name}.ipv4}:${builtins.toString garageRpcPort}";
+        rpc_public_addr = "${globals.networks.${config.swarselsystems.server.netConfigName}.hosts.${config.node.name}.ipv4}:${builtins.toString garageRpcPort}";
 
         rpc_secret_file = config.sops.secrets.garage-rpc-secret.path;
 

modules/nixos/server/homebox.nix

@@ -6,7 +6,7 @@ in
   options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
   config = lib.mkIf config.swarselmodules.server.${serviceName} {
 
-    swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
+    nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
       "${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
     };
 

modules/nixos/server/immich.nix

@@ -6,7 +6,7 @@ in
   options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
   config = lib.mkIf config.swarselmodules.server.${serviceName} {
 
-    swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
+    nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
       "${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
     };
 

modules/nixos/server/jellyfin.nix

@@ -6,7 +6,7 @@ in
   options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
   config = lib.mkIf config.swarselmodules.server.${serviceName} {
 
-    swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
+    nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
       "${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
     };
 

modules/nixos/server/jenkins.nix

@@ -6,7 +6,7 @@ in
   options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
   config = lib.mkIf config.swarselmodules.server.${serviceName} {
 
-    swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
+    nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
       "${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
     };
 

modules/nixos/server/kanidm.nix

@@ -31,7 +31,7 @@ in
   options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
   config = lib.mkIf config.swarselmodules.server.${serviceName} {
 
-    swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
+    nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
       "${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
     };
 

modules/nixos/server/kavita.nix

@@ -11,7 +11,7 @@ in
       calibre
     ];
 
-    swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
+    nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
       "${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
     };
 

modules/nixos/server/koillection.nix

@@ -14,7 +14,7 @@ in
   config = lib.mkIf config.swarselmodules.server.${serviceName} {
 
 
-    swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
+    nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
       "${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
     };
     sops.secrets = {

modules/nixos/server/mailserver.nix

@@ -11,7 +11,7 @@ in
   };
   config = lib.mkIf config.swarselmodules.server.${serviceName} {
 
-    swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
+    nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
       "${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
     };
 

modules/nixos/server/matrix.nix

@@ -20,7 +20,7 @@ in
   options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
   config = lib.mkIf config.swarselmodules.server.${serviceName} {
 
-    swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
+    nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
       "${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
     };
 

modules/nixos/server/microbin.nix

@@ -10,7 +10,7 @@ in
   options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
   config = lib.mkIf config.swarselmodules.server.${serviceName} {
 
-    swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
+    nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
       "${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
     };
 

modules/nixos/server/minecraft/default.nix

@@ -8,7 +8,7 @@ in
   options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
   config = lib.mkIf config.swarselmodules.server.${serviceName} {
 
-    swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
+    nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
       "${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
     };
 

modules/nixos/server/monitoring.nix

@@ -16,7 +16,7 @@ in
   options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
   config = lib.mkIf config.swarselmodules.server.${serviceName} {
 
-    swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
+    nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
       "${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
     };
 

modules/nixos/server/navidrome.nix

@@ -6,7 +6,7 @@ in
   options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
   config = lib.mkIf config.swarselmodules.server.${serviceName} {
 
-    swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
+    nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
       "${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
     };
 

modules/nixos/server/network.nix

@@ -1,28 +1,40 @@
 { lib, config, ... }:
 let
-  inherit (config.swarselsystems.server) localNetwork;
+  netConfig = config.repo.secrets.local.networking;
+  netName = "${if config.swarselsystems.isCloud then config.node.name else "home"}-${config.swarselsystems.server.localNetwork}";
 in
 {
-  options.swarselmodules.server.network = lib.mkEnableOption "enable server network config";
-  options.swarselsystems.server.localNetwork = lib.mkOption {
-    type = lib.types.str;
-    default = "home";
+  options = {
+    swarselmodules.server.network = lib.mkEnableOption "enable server network config";
+    swarselsystems.server = {
+      localNetwork = lib.mkOption {
+        type = lib.types.str;
+        default = "";
+      };
+      netConfigName = lib.mkOption {
+        type = lib.types.str;
+        default = netName;
+        readOnly = true;
+      };
+    };
   };
   config = lib.mkIf config.swarselmodules.server.network {
 
-    globals.networks."${if config.swarselsystems.isCloud then config.node.name else "home"}-${localNetwork}".hosts.${config.node.name} = {
-      inherit (config.repo.secrets.local.networking.networks.${localNetwork}) id;
-      mac = config.repo.secrets.local.networking.networks.${localNetwork}.mac or null;
+    swarselsystems.server.localNetwork = netConfig.localNetwork or "";
+
+    globals.networks.${netName}.hosts.${config.node.name} = {
+      inherit (netConfig.networks.${netConfig.localNetwork}) id;
+      mac = netConfig.networks.${netConfig.localNetwork}.mac or null;
     };
 
     globals.hosts.${config.node.name} = {
       inherit (config.repo.secrets.local.networking) defaultGateway4;
-      wanAddress4 = config.repo.secrets.local.networking.wanAddress4 or null;
-      wanAddress6 = config.repo.secrets.local.networking.wanAddress6 or null;
+      wanAddress4 = netConfig.wanAddress4 or null;
+      wanAddress6 = netConfig.wanAddress6 or null;
     };
 
     networking = {
-      inherit (config.repo.secrets.local.networking) hostId;
+      inherit (netConfig) hostId;
       hostName = config.node.name;
       nftables.enable = lib.mkDefault false;
       enableIPv6 = lib.mkDefault true;

modules/nixos/server/nextcloud.nix

@@ -10,7 +10,7 @@ in
   options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
   config = lib.mkIf config.swarselmodules.server.${serviceName} {
 
-    swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
+    nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
       "${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
     };
 

modules/nixos/server/nginx.nix

@@ -1,6 +1,6 @@
 { pkgs, lib, config, ... }:
 let
-  inherit (config.repo.secrets.common) dnsProvider;
+  inherit (config.repo.secrets.common) dnsProvider dnsBase;
   inherit (config.repo.secrets.common.mail) address3;
 
   serviceUser = "nginx";
@@ -63,9 +63,12 @@ in
     ];
 
     sops = {
-      secrets.acme-dns-token = { inherit (config.swarselsystems) sopsFile; };
+      secrets = {
+        acme-dns-token = { inherit (config.swarselsystems) sopsFile; };
+      };
       templates."certs.secret".content = ''
-        CF_DNS_API_TOKEN=${config.sops.placeholder.acme-dns-token}
+        ACME_DNS_API_BASE=${dnsBase}
+        ACME_DNS_STORAGE_PATH=${config.sops.placeholder.acme-dns-token}
       '';
     };
 

modules/nixos/server/nsd/default.nix

@@ -1,10 +1,7 @@
-{ inputs, lib, config, globals, dns, confLib, ... }:
+{ lib, config, globals, dns, confLib, ... }:
 let
-  inherit (confLib.gen { name = "nsd"; port = 53; }) serviceName;
-  # servicePort = 53;
-  # serviceDomain = config.repo.secrets.common.services.domains."${serviceName}";
-  # serviceAddress = globals.networks."${if config.swarselsystems.isCloud then config.node.name else "home"}-${config.swarselsystems.server.localNetwork}".hosts.${config.node.name}.ipv4;
-
+  inherit (confLib.gen { name = "nsd"; port = 53; }) serviceName servicePort proxyAddress4 proxyAddress6;
+  inherit (config.swarselsystems) sopsFile;
 in
 {
   options = {
@@ -14,7 +11,7 @@ in
         lib.types.submodule {
           options = {
             subdomainRecords = lib.mkOption {
-              type = lib.types.attrsOf inputs.dns.subzone;
+              type = lib.types.attrsOf dns.lib.types.subzone;
               default = { };
             };
           };
@@ -23,14 +20,69 @@ in
     };
   };
   config = lib.mkIf config.swarselmodules.server.${serviceName} {
+
+    sops.secrets = {
+      tsig-key = { inherit sopsFile; };
+    };
+
+    # services.resolved.enable = false;
+    networking = {
+      # nameservers = [ "1.1.1.1" "8.8.8.8" ];
+      firewall = {
+        allowedUDPPorts = [ servicePort ];
+        allowedTCPPorts = [ servicePort ];
+      };
+    };
+
     services.nsd = {
       enable = true;
-      zones = {
-        "${globals.domains.main}" = {
-          # provideXFR = [ ... ];
-          # notify = [ ... ];
-          data = dns.lib.toString "${globals.domains.main}" (import ./site1.nix { inherit config globals dns; });
+      keys = {
+        "${globals.domains.main}.${proxyAddress4}" = {
+          algorithm = "hmac-sha256";
+          keyFile = config.sops.secrets.tsig-key.path;
         };
+        "${globals.domains.main}.${proxyAddress6}" = {
+          algorithm = "hmac-sha256";
+          keyFile = config.sops.secrets.tsig-key.path;
+        };
+        "${globals.domains.main}" = {
+          algorithm = "hmac-sha256";
+          keyFile = config.sops.secrets.tsig-key.path;
+        };
+      };
+      interfaces = [
+        "10.1.2.157"
+        "2603:c020:801f:a0cc::9d"
+      ];
+      zones = {
+        "${globals.domains.main}" =
+          let
+            keyName4 = "${globals.domains.main}.${proxyAddress4}";
+            keyName6 = "${globals.domains.main}.${proxyAddress6}";
+            keyName = "${globals.domains.main}";
+            transferList = [
+              "213.239.242.238 ${keyName4}"
+              "2a01:4f8:0:a101::a:1 ${keyName6}"
+              "213.133.100.103 ${keyName4}"
+              "2a01:4f8:0:1::5ddc:2 ${keyName6}"
+              "193.47.99.3 ${keyName4}"
+              "2001:67c:192c::add:a3 ${keyName6}"
+            ];
+
+          in
+          {
+            outgoingInterface = "2603:c020:801f:a0cc::9d";
+            notify = transferList ++ [
+              "216.218.130.2 ${keyName}"
+            ];
+            provideXFR = transferList ++ [
+              "216.218.133.2 ${keyName}"
+              "2001:470:600::2 ${keyName}"
+            ];
+
+            # dnssec = true;
+            data = dns.lib.toString "${globals.domains.main}" (import ./site1.nix { inherit config globals dns proxyAddress4 proxyAddress6; });
+          };
       };
     };
 

modules/nixos/server/nsd/site1.nix

@@ -1,40 +1,35 @@
-{ config, globals, dns, ... }:
+{ config, globals, dns, proxyAddress4, proxyAddress6, ... }:
 with dns.lib.combinators; {
   SOA = {
     nameServer = "soa";
-    adminEmail = "admin@${globals.domains.main}";
-    serial = 2025112101;
+    adminEmail = "admin@${globals.domains.main}"; # this option is not parsed as domain (we cannot just write "admin")
+    serial = 2025120201; # update this on changes for secondary dns
   };
 
   useOrigin = false;
 
   NS = [
-    "soa.${globals.domains.name}."
-    "ns1.he.net"
-    "ns2.he.net"
-    "ns3.he.net"
-    "ns4.he.net"
-    "ns5.he.net"
-    "oxygen.ns.hetzner.com"
-    "pola.ns.cloudflare.com"
-  ];
+    "soa"
+    "srv"
+  ] ++ globals.domains.externalDns;
 
-  A = [ "75.2.60.5" ];
+
+  A = [ config.repo.secrets.local.dns.homepage-ip ];
 
   SRV = [
     {
       service = "_matrix";
       proto = "_tcp";
       port = 443;
-      target = "${globals.services.matrix.baseDomain}.${globals.domains.main}";
+      target = "${globals.services.matrix.subDomain}";
       priority = 10;
-      wweight = 5;
+      weight = 5;
     }
     {
       service = "_submissions";
       proto = "_tcp";
       port = 465;
-      target = "${globals.services.mailserver.baseDomain}.${globals.domains.main}";
+      target = "${globals.services.mailserver.subDomain}";
       priority = 5;
       weight = 0;
       ttl = 3600;
@@ -43,7 +38,7 @@ with dns.lib.combinators; {
       service = "_submission";
       proto = "_tcp";
       port = 587;
-      target = "${globals.services.mailserver.baseDomain}.${globals.domains.main}";
+      target = "${globals.services.mailserver.subDomain}";
       priority = 5;
       weight = 0;
       ttl = 3600;
@@ -52,7 +47,7 @@ with dns.lib.combinators; {
       service = "_imap";
       proto = "_tcp";
       port = 143;
-      target = "${globals.services.mailserver.baseDomain}.${globals.domains.main}";
+      target = "${globals.services.mailserver.subDomain}";
       priority = 5;
       weight = 0;
       ttl = 3600;
@@ -61,7 +56,7 @@ with dns.lib.combinators; {
       service = "_imaps";
       proto = "_tcp";
       port = 993;
-      target = "${globals.services.mailserver.baseDomain}.${globals.domains.main}";
+      target = "${globals.services.mailserver.subDomain}";
       priority = 5;
       weight = 0;
       ttl = 3600;
@@ -71,13 +66,7 @@ with dns.lib.combinators; {
   MX = [
     {
       preference = 10;
-      exchange = "${globals.services.mailserver.baseDomain}.${globals.domains.main}";
-    }
-  ];
-
-  CNAME = [
-    {
-      cname = "www.${glovals.domains.main}";
+      exchange = "${globals.services.mailserver.subDomain}";
     }
   ];
 
@@ -90,28 +79,22 @@ with dns.lib.combinators; {
     }
   ];
 
-  DMARC = [
-    {
-      p = "none";
-      ttl = 10800;
-    }
-  ];
-
   TXT = [
-    (with spf; strict [ "a:${globals.services.mailserver.baseDomain}.${globals.domains.main}" ])
+    (with spf; strict [ "a:${globals.services.mailserver.subDomain}.${globals.domains.main}" ])
     "google-site-verification=${config.repo.secrets.local.dns.google-site-verification}"
   ];
 
   DMARC = [
     {
-      selector = "mail";
-      k = "rsa";
       p = "none";
       ttl = 10800;
     }
   ];
 
-  subdomains = config.swarselsystems.server.dns.${globals.domain.main}.subdomainRecords // {
-    "minecraft" = host "130.61.119.12" null;
+  subdomains = config.swarselsystems.server.dns.${globals.domains.main}.subdomainRecords // {
+    "www".CNAME = [ "${globals.domains.main}." ];
+    "_acme-challenge".CNAME = [ "${config.repo.secrets.local.dns.acme-challenge-domain}." ];
+    "soa" = host proxyAddress4 proxyAddress6;
+    "srv" = host proxyAddress4 proxyAddress6;
   };
 }

modules/nixos/server/oauth2-proxy.nix

@@ -119,7 +119,7 @@ in
   };
   config = lib.mkIf config.swarselmodules.server.${serviceName} {
 
-    swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
+    nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
       "${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
     };
 

modules/nixos/server/paperless.nix

@@ -11,7 +11,7 @@ in
   options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
   config = lib.mkIf config.swarselmodules.server.${serviceName} {
 
-    swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
+    nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
       "${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
     };
 

modules/nixos/server/radicale.nix

@@ -9,7 +9,7 @@ in
   options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
   config = lib.mkIf config.swarselmodules.server.${serviceName} {
 
-    swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
+    nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
       "${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
     };
 

modules/nixos/server/shlink.nix

@@ -12,7 +12,7 @@ in
   };
   config = lib.mkIf config.swarselmodules.server.${serviceName} {
 
-    swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
+    nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
       "${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
     };
 

modules/nixos/server/slink.nix

@@ -10,7 +10,7 @@ in
   };
   config = lib.mkIf config.swarselmodules.server.${serviceName} {
 
-    swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
+    nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
       "${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
     };
 

modules/nixos/server/snipe-it.nix

@@ -11,7 +11,7 @@ in
   options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
   config = lib.mkIf config.swarselmodules.server.${serviceName} {
 
-    swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
+    nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
       "${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
     };
 

modules/nixos/server/ssh-builder.nix

@@ -0,0 +1,35 @@
+{ self, pkgs, lib, config, ... }:
+let
+  ssh-restrict = "restrict,pty,command=\"${wrapper-dispatch-ssh-nix}/bin/wrapper-dispatch-ssh-nix\" ";
+
+  wrapper-dispatch-ssh-nix = pkgs.writeShellScriptBin "wrapper-dispatch-ssh-nix" ''
+    case $SSH_ORIGINAL_COMMAND in
+      "nix-daemon --stdio")
+        exec env NIX_SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt ${config.nix.package}/bin/nix-daemon --stdio
+        ;;
+      "nix-store --serve --write")
+        exec env NIX_SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt ${config.nix.package}/bin/nix-store --serve --write
+        ;;
+      *)
+        echo "Access only allowed for using the nix remote builder" 1>&2
+        exit
+    esac
+  '';
+in
+{
+  options.swarselmodules.server.ssh-builder = lib.mkEnableOption "enable ssh-builder config on server";
+  config = lib.mkIf config.swarselmodules.server.ssh-builder {
+    users = {
+      groups.builder = { };
+      users.builder = {
+        useDefaultShell = true;
+        isSystemUser = true;
+        group = "builder";
+        openssh.authorizedKeys.keys = [
+          ''${ssh-restrict} ${builtins.readFile "${self}/secrets/keys/ssh/builder.pub"}''
+        ];
+      };
+    };
+
+  };
+}

modules/nixos/server/ssh.nix

@@ -9,6 +9,10 @@
         PasswordAuthentication = false;
         KbdInteractiveAuthentication = false;
         PermitRootLogin = "yes";
+        AllowUsers = [
+          "root"
+          config.swarselsystems.mainUser
+        ];
       };
       hostKeys = [
         {
@@ -20,10 +24,12 @@
     users.users."${config.swarselsystems.mainUser}".openssh.authorizedKeys.keyFiles = [
       (self + /secrets/keys/ssh/yubikey.pub)
       (self + /secrets/keys/ssh/magicant.pub)
+      # (lib.mkIf config.swarselsystems.isBastionTarget (self + /secrets/keys/ssh/jump.pub))
     ];
     users.users.root.openssh.authorizedKeys.keyFiles = [
       (self + /secrets/keys/ssh/yubikey.pub)
       (self + /secrets/keys/ssh/magicant.pub)
+      # (lib.mkIf config.swarselsystems.isBastionTarget (self + /secrets/keys/ssh/jump.pub))
     ];
     security.sudo.extraConfig = ''
       Defaults    env_keep+=SSH_AUTH_SOCK

modules/nixos/server/syncthing.nix

@@ -42,7 +42,7 @@ in
   };
   config = lib.mkIf config.swarselmodules.server.${serviceName} {
 
-    swarselsystems.server.dns.${globals.services.${specificServiceName}.baseDomain}.subdomainRecords = {
+    nodes.stoicclub.swarselsystems.server.dns.${globals.services.${specificServiceName}.baseDomain}.subdomainRecords = {
       "${globals.services.${specificServiceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
     };