feat[server]: network management

2025-12-06 09:07:21 +01:00 · 2025-11-28 13:27:11 +01:00 · 2025-11-28 13:27:11 +01:00 · c20f1b0b59
commit c20f1b0b59
parent 8f833485da
17 changed files with 415 additions and 356 deletions
--- a/hosts/nixos/x86_64-linux/eagleland/default.nix
+++ b/hosts/nixos/x86_64-linux/eagleland/default.nix
@ -1,4 +1,4 @@
-{ lib, config, minimal, ... }:
+{ lib, config, minimal, globals, ... }:
 {
  imports = [
    ./hardware-configuration.nix
@ -35,19 +35,24 @@
        {
          "10-wan" = {
            address = [
-              "${netConfig.wanAddress4}/32"
-              "${netConfig.wanAddress6}/64"
+              "${globals.networks."${if config.swarselsystems.isCloud then config.node.name else "home"}-${config.swarselsystems.server.localNetwork}".hosts.${config.node.name}.cidrv4}"
+              "${globals.networks."${if config.swarselsystems.isCloud then config.node.name else "home"}-${config.swarselsystems.server.localNetwork}".hosts.${config.node.name}.cidrv6}"
            ];
-            gateway = [ "fe80::1" ];
            routes = [
-              { Destination = netConfig.defaultGateway4; }
+              {
+                Gateway = netConfig.defaultGateway6;
+                GatewayOnLink = true;
+              }
              {
                Gateway = netConfig.defaultGateway4;
                GatewayOnLink = true;
              }
            ];
+            networkConfig = {
+              IPv6PrivacyExtensions = true;
+              IPv6AcceptRA = false;
+            };
            matchConfig.MACAddress = netConfig.networks.${config.swarselsystems.server.localNetwork}.mac;
-            networkConfig.IPv6PrivacyExtensions = "yes";
            linkConfig.RequiredForOnline = "routable";
          };
        };
--- a/hosts/nixos/x86_64-linux/eagleland/secrets/pii.nix.enc
+++ b/hosts/nixos/x86_64-linux/eagleland/secrets/pii.nix.enc
@ -1,5 +1,5 @@
 {
-	"data": "ENC[AES256_GCM,data:vLTAWtyZJVHtXifwicSRYRYj1PjoEiumhE3bcsMuhj5P0PjyT9f2wzse7GDtusUFXDNWQXNWMNwk1V0auQmWayJa0zvpfRGtnGJrwdl/dImK+UN7ddJ6x6tNU6kjNZ05UplaUsJAJ9tm4eg050muY7KLBuEw1E4Ki9clDDxhxULXv4bdv5QpXaYSiK33ZORnD2EWcYvqUJayU/d8zSRTHV456ePHDIJPfXo22XQSLY7//q1v44ZMKDptOwlktxVQr9/asvE4eLDjdDTA5DXHTfsAGBDZCHqPI33CxZbHENM9UOHw7S0qYpKW2f232Huwv4J7llmsOIT8Axppz6fC8neBKOFPH+n4bZQTaZUL/xSLCQrF/T8k8k84lKJ3eBJdfyTpU8oInu8VAe/w+s2lC+n/zAjGoSGIF412xQ5VS0fsG1Wi/veRDr50KybYUuYQNjwtIXle3fUibUaMGFwd4Y9uSlxrWwWQxJhFpoZhoPPfeNMrT+7BSpVax27HvM7p9+VKkLfWtHiwuSZNSI3HKRmrsxHJVUxuJdXO87TCbabQAvPWoqR6qKMwixN/gvN1JNZ6Ml59HPSe6SKBAh5SI95kzXaBMZ9d7Yy7bUy/xkbbFHNYLwXR62H89XyK3yW6CMr+M7JLSC0WErAVHkUEuIEkWILBIiTeqU3Q,iv:KoTbJUnhbZp7jX/jPmX8gBobDJDoLPAvhBU9j9RYr/g=,tag:qhd6OAHNkbn0xN7wJhF1Fw==,type:str]",
+	"data": "ENC[AES256_GCM,data:nIgv3b+6o5Ce9X9xZtBK62f6dgsAGLPqq7aVFCw2qjD9UiHCrAY9vTn5NSW2O2pbLAfx6h7falS3/0yU+AkJ2H3zhxBy7ZxQ0m9dLoQGrYY/E9Z45xZmdFRxtzexCaxr2DxbP8haJKomQ22cHk07HGsrEZ/CFGkyjRxUr3Y4rewgZPBXahVtM75mWbNpVGApc8cs/W4JbjuXw3qlCQcACz8sZVPHKCjbEypypo6nTmU7NO7worrAJ2QgU75oGJ9g96wp9paFMEDofVp2Y25IVYReGg8T1Qi/kTcZzfzGfSpEwnQBB/ZCW6gNYhMK3shfB8DxKy6+romVXm1K+/0yUmwsCM8xC5zJX0GsO8Uu63YFrW/Y2E6aYZfBHdIgfy4lYOFKC2o0ixirw9EO8HyfsDt47QYB970vLPjYZfKNAZBgltbV3KPsOHxmgiZbTbAl0cb9zRc+jV2voH9T5VhFiUWdfaLBY1HUAVAjU7h62uZoCsi1HWyAroEROKS96npTD+3/vHehYuEGBf1IxYnLwHnKeqsr/Bqoukf3OecOH2EkMTTFQ7E0k9s0keRypoHmeYIh2a3dRcaXXbNEgiAMfabhgUh1NNcYKSZhcIekN8WN8azXjbVIrfEakJ8S+PUf5fJdspN/3Ppm06fDLv7yLHnLc8Eae2COOR8vYKIo3Onu4doxNjisfpHujLXYaCGhWpINEGWF7fkeC1B7,iv:v9MxvhcHg+P00UnOWujSgVlMNcOnDm/gK8kNcN54E2E=,tag:XnPMzsDeGJMt9yv6GnFzqg==,type:str]",
 	"sops": {
 		"age": [
 			{
@ -7,8 +7,8 @@
 				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJR1ZPZFUxRTh0QjB6UDJ4\nOFd2c2lFejhHck5UdUxVbmFFbVRYNEJaSzJZCkNxbndVVThObDkxUmx2WW9ESzhh\na2o0LzFCbWdJVlRIV00rTVUwTktoek0KLS0tIC9qalVvZmpGQXZsV3RIYWRPbmRY\nam80NkRkT2l0ak8wV3pTSW9kSC9nZ3cKCH8eEMmku6WMliEDdAiW2Lk1jAGH9SoP\nWQ5Y6e90jEnp8XbGE7KYiG+jy5fHSc6Y5/YyMmi/b9bF9AhmRT6rdw==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
-		"lastmodified": "2025-11-25T15:44:12Z",
-		"mac": "ENC[AES256_GCM,data:EqEvcd75Si3I0Tgxm0ffeVRKrKNqaFNI+NqZcB02mKPYPWTR6fX4VT2oVhLIxvn+5MQY2BBR/VzSxblcX6K149REpk/22aGuHfk45giq8q1xBnZeNzEQDuhoY8XZd8dzqxk1pHmQFS+jL/zl42a2Qib/jVmlnPof0bcwa/HlZDU=,iv:5V2zSQOCG/XkRF7zgFe1oDuzrP3dx6pWZpsvdVT8hz8=,tag:DYHQIFEedflw43aCTT/ACA==,type:str]",
+		"lastmodified": "2025-11-28T10:50:22Z",
+		"mac": "ENC[AES256_GCM,data:lwkkp8YSzX8NM7E65kmPpF/q9Vn+FnCTeePLswDH6AVgndo/7QOy0GtJeXmiwt2YsA4AhRqxexWl2R8tjEysP35pyfQJ4vEkVi+V2tEnoLgftriNJzpoeVuRNXLxTPhPezOZgAcTDDL4yyqJXpcFj0PE1DPHKxazT28BoilaBYE=,iv:3dcAqkw/y6rAPL8wb5iewz37S4xszYFGHxvQiQ98sLk=,tag:SEmbptei6GrTXXyb7zwrIg==,type:str]",
 		"pgp": [
 			{
 				"created_at": "2025-11-23T15:25:41Z",
--- a/hosts/nixos/x86_64-linux/milkywell/default.nix
+++ b/hosts/nixos/x86_64-linux/milkywell/default.nix
@ -1,46 +0,0 @@
-{ lib, config, minimal, ... }:
-{
-  imports = [
-    ./hardware-configuration.nix
-    ./disk-config.nix
-  ];
-  node.lockFromBootstrapping = false;
-  sops = {
-    age.sshKeyPaths = lib.mkDefault [ "/etc/ssh/ssh_host_ed25519_key" ];
-  };
-
-  topology.self = {
-    icon = "devices.cloud-server";
-  };
-
-  networking = {
-    domain = "subnet03112148.vcn03112148.oraclevcn.com";
-    firewall = {
-      allowedTCPPorts = [ 53 ];
-    };
-  };
-
-  system.stateVersion = "23.11";
-
-  swarselsystems = {
-    flakePath = "/root/.dotfiles";
-    info = "VM.Standard.E2.1.Micro";
-    isImpermanence = true;
-    isSecureBoot = false;
-    isCrypted = false;
-    isSwap = true;
-    swapSize = "8G";
-    rootDisk = "/dev/sda";
-    isBtrfs = true;
-    isNixos = true;
-    isLinux = true;
-    server = {
-      inherit (config.repo.secrets.local.networking) localNetwork;
-    };
-  };
-} // lib.optionalAttrs (!minimal) {
-  swarselprofiles = {
-    server = true;
-  };
-
-}
--- a/hosts/nixos/x86_64-linux/milkywell/disk-config.nix
+++ b/hosts/nixos/x86_64-linux/milkywell/disk-config.nix
@ -1,121 +0,0 @@
-{ lib, pkgs, config, ... }:
-let
-  type = "btrfs";
-  extraArgs = [ "-L" "nixos" "-f" ]; # force overwrite
-  subvolumes = {
-    "/root" = {
-      mountpoint = "/";
-      mountOptions = [
-        "subvol=root"
-        "compress=zstd"
-        "noatime"
-      ];
-    };
-    "/home" = lib.mkIf config.swarselsystems.isImpermanence {
-      mountpoint = "/home";
-      mountOptions = [
-        "subvol=home"
-        "compress=zstd"
-        "noatime"
-      ];
-    };
-    "/persist" = lib.mkIf config.swarselsystems.isImpermanence {
-      mountpoint = "/persist";
-      mountOptions = [
-        "subvol=persist"
-        "compress=zstd"
-        "noatime"
-      ];
-    };
-    "/log" = lib.mkIf config.swarselsystems.isImpermanence {
-      mountpoint = "/var/log";
-      mountOptions = [
-        "subvol=log"
-        "compress=zstd"
-        "noatime"
-      ];
-    };
-    "/nix" = {
-      mountpoint = "/nix";
-      mountOptions = [
-        "subvol=nix"
-        "compress=zstd"
-        "noatime"
-      ];
-    };
-    "/swap" = lib.mkIf config.swarselsystems.isSwap {
-      mountpoint = "/.swapvol";
-      swap.swapfile.size = config.swarselsystems.swapSize;
-    };
-  };
-in
-{
-  disko = {
-    imageBuilder.extraDependencies = [ pkgs.kmod ];
-    devices = {
-      disk = {
-        disk0 = {
-          type = "disk";
-          device = config.swarselsystems.rootDisk;
-          content = {
-            type = "gpt";
-            partitions = {
-              ESP = {
-                priority = 1;
-                name = "ESP";
-                size = "512M";
-                type = "EF00";
-                content = {
-                  type = "filesystem";
-                  format = "vfat";
-                  mountpoint = "/boot";
-                  mountOptions = [ "defaults" ];
-                };
-              };
-              root = lib.mkIf (!config.swarselsystems.isCrypted) {
-                size = "100%";
-                content = {
-                  inherit type subvolumes extraArgs;
-                  postCreateHook = lib.mkIf config.swarselsystems.isImpermanence ''
-                    MNTPOINT=$(mktemp -d)
-                    mount "/dev/disk/by-label/nixos" "$MNTPOINT" -o subvolid=5
-                    trap 'umount $MNTPOINT; rm -rf $MNTPOINT' EXIT
-                    btrfs subvolume snapshot -r $MNTPOINT/root $MNTPOINT/root-blank
-                  '';
-                };
-              };
-              luks = lib.mkIf config.swarselsystems.isCrypted {
-                size = "100%";
-                content = {
-                  type = "luks";
-                  name = "cryptroot";
-                  passwordFile = "/tmp/disko-password"; # this is populated by bootstrap.sh
-                  settings = {
-                    allowDiscards = true;
-                    # https://github.com/hmajid2301/dotfiles/blob/a0b511c79b11d9b4afe2a5e2b7eedb2af23e288f/systems/x86_64-linux/framework/disks.nix#L36
-                    crypttabExtraOpts = [
-                      "fido2-device=auto"
-                      "token-timeout=10"
-                    ];
-                  };
-                  content = {
-                    inherit type subvolumes extraArgs;
-                    postCreateHook = lib.mkIf config.swarselsystems.isImpermanence ''
-                      MNTPOINT=$(mktemp -d)
-                      mount "/dev/mapper/cryptroot" "$MNTPOINT" -o subvolid=5
-                      trap 'umount $MNTPOINT; rm -rf $MNTPOINT' EXIT
-                      btrfs subvolume snapshot -r $MNTPOINT/root $MNTPOINT/root-blank
-                    '';
-                  };
-                };
-              };
-            };
-          };
-        };
-      };
-    };
-  };
-
-  fileSystems."/persist".neededForBoot = lib.mkIf config.swarselsystems.isImpermanence true;
-  fileSystems."/home".neededForBoot = lib.mkIf config.swarselsystems.isImpermanence true;
-}
--- a/hosts/nixos/x86_64-linux/milkywell/hardware-configuration.nix
+++ b/hosts/nixos/x86_64-linux/milkywell/hardware-configuration.nix
@ -1,26 +0,0 @@
-{ lib, modulesPath, ... }:
-
-{
-  imports =
-    [
-      (modulesPath + "/profiles/qemu-guest.nix")
-    ];
-
-  boot = {
-    initrd = {
-      availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" ];
-      kernelModules = [ "dm-snapshot" ];
-    };
-    kernelModules = [ "kvm-amd" ];
-    extraModulePackages = [ ];
-  };
-
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.ens3.useDHCP = lib.mkDefault true;
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-}
--- a/hosts/nixos/x86_64-linux/milkywell/secrets/pii.nix.enc
+++ b/hosts/nixos/x86_64-linux/milkywell/secrets/pii.nix.enc
@ -1,22 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:pikVONWg81bulGRM+enUyBGxFw4C51177O3WrhRzvCiWpulc9RHVH12AfVh4uAkoOANrPyLZuEUGdu8hvFgcTWBzJXPSPZ2sMfAjx593RhSsW+VM58IS0Oa+N9XxwpYnKiUBHrvAxgJD3vhVgCIrL+1LSylZG/RF4Wj6fw4dkttlCqioRkyNPufBtpMEN+MTw9IFsAKaCV5LTFnetIzm6wUPepExaPOpdFhf61JYyzsHkKZslA4FKs1cWgK5ggJkfQS1aA3KCh8pU8vU6uXRgl4ixyUzn/l1HnGZRhFxjcc0x4RqrJYFW9Qyj7oehHU6AxuzD2bf0vuVxZn7nQy8MrDfsvYL5yU34MSdokwrvg3IBXvPogbmjWoBLl6+0WSlV5s6o8GbTkhFi0kWv5H9AKcywY54ltyzoxAQ/9hsZa9IIGCNMFjVfcrKPQKAfrdLbYQxdioq62lHX0LbXKWU9WPRhiG9eRsETudIPan8VRMvHx/6qS6bXSaEjYkKsVSmUOhcVYp7bp58wl9JKu4qYUOLyE2T00IdmbUWrQ+MP14lj6XKNyLN6//8qFyTyhDBLPBJ5DxOMt6qn1qe/lqD4R8Iqvvj63IFq3/psdDXHu+WNmq2/LQH3Y8GTxIoEQ+uPK/I7Tqdh2DXQgKYK162ybczcqsQwGwQWe+DWtno8fauypNrFp6Wgd7c62pxY+8nJzTU9gYSyAIHWEHmRW1LV231X+7kB+JwB2AxfDFXRChuNtJkOK9pdwo4SSS/tGDS5RLmsO4VpE2mPmhxA78IuU88c0LF/e4fC8N5hteecXjMMsSswbC1VUO/3B0JfN8nI0/BnE5Hhau8McSZ1Z06/GsxC+6ArX+zIXthcLIr95nAnLDgJUOKOU7XvLQ9Y22u4lmYWedSTg+vjdljjUG3aBNyp5ZI2xXQmOOgL21aE9aQgBN27GQGqgzECrNEbK0osBefjw14sxv/aZlWU9hHlVROLVbpyWl3edN9ZEMYSJDCpMPwFkEOshlkZ78IfQw7fWRKoBW3W9uHyRPEFeldy8KQ2Lux8A5KwokgFFrp4JI92gjUSubfFsCZp/NHrV5k5UltfMz50QdaKw==,iv:5tRqYZwfz4AeC/HSetPfDaysniUoAgklLl7mEiWBqiM=,tag:7TnVeBMtP8Q81eqeRu02gg==,type:str]",
-	"sops": {
-		"age": [
-			{
-				"recipient": "age1glge4e97vgqzh332mqs5990vteezu2m8k4wq3z35jk0q8czw3gks2d7a3h",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJZzY0QVQ4ZUxxZkdhQ2Zn\nOHpmTnRaR0R3cXh2Z2JFM1RDVDB2QnE3M3prCm43NjQyOS93UTZKaUlUUmhVcTdG\nUWp1YU1kVmZPc0tBN2FMY2FFVkI1a0UKLS0tIFovZi9FQlhMaXpvcnRYN2FiSm16\nTzJESjNyZ1NzajJRNDR6ZTd2TitoQTgKe2hC6OpYIzgqzhmeJuHWe0yXNE+/Ek26\nGt7s1B6OKnrj+S3es84ePOjAbLHr/ez282b/h0y55ws4R7jMemUIrQ==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2025-11-25T15:37:26Z",
-		"mac": "ENC[AES256_GCM,data:nZoyO4iZKAgecFiQ0tBdTEogMIDhe+Tg28L73DLVGCDTaG4QTR4ulvh77R3+Guun6eV5CsH86hTgENgDvybEVJV9bZmJWVbVQ0a+QYsZKIVDcH+o1ZK5EiOoaUb+Tfze1CGey2aw8zBgz3hl7ZeVjb5XNsKOhQz00Oc8xQ7z2CQ=,iv:x7oSgep++DVe2JQ1PPORcqfgBpCRbjO+MNPpDVSlzeI=,tag:JlibH3nTCf64bqxpnCxJAg==,type:str]",
-		"pgp": [
-			{
-				"created_at": "2025-11-20T01:03:05Z",
-				"enc": "-----BEGIN PGP MESSAGE-----\n\nhQIMAwDh3VI7VctTAQ//eTxMD8ZbwJUqVsi1IKK2qdprLTjE0rqdDue+OvP0V+Ns\n1uTnw+b2UBykbIofXcG4P61OxAFdEs8whiIdffQtkDTkOgzV9IQCBOSGxZGEJXMe\nrl5BZLlF98JZ5R15v8V8vMwWwtC90GZ7gZLDV+yZz40Zqm3mTrFz/3PERukwu4Gb\nLTJDOsGmpooyI8KnrIsBhfEwo7/ouAayuKQfvt2i2Tngk9Em73R91BlpcxsOEmqr\n5KWA4GCsjUOmZZKLj2vyENPgQh8t8bP5fGJ3Rf4J1MCWAB89omcE0aRWId/l5sdA\n/Nxinh3xQsiXHPzPLZQ+UjHs+MjNdUoZapoDBP84j2tHsSxh0RMRhlHpESDWq3Mm\n1acWrChyyds6Lz5ZqkioqvAZ3lslS0kPdQqfsLzYWBhA9kLOIJKYfat+vxsAPwAa\n6kceXtxSzUpThtDUPDibjomn7Mrj7ZoHhiJZup/M27glf/V4P3zk+ctpXMSIE7Ia\nQ/jgRDzpcs+u05RsP32jFbCAfi//WxRo77MoxGMJxDhYibBp+aRkFAgVYiElhxbt\n/NedcIAHSJZFyDPm0wn411+DPnUTPn9D9LCkmSG68ZeGDGZJl7Sz3bJ3obWWecTG\nBjqxMZVwRuU2gdg1IwempP9u1dP0Q+g8B3veui/gczGx3J5kvNv8hnUBTeUl2EyF\nAgwDC9FRLmchgYQBD/oCciOvXMrH9/hWIIYb1sKiuCmgdVfs7H0q92XdVNgkbPRz\nXAakX7dl5cZt748u/eCHlGUGr4q7yA1tDx9Vm/J+O2HljN3lBVCbm7HP+YcI+5g0\nvvxr0cIPtr5CXlZz6hJjTgzE4HfEKagGdjgllbHYBB+0rtq/2pZTa20fG0w4coeI\nB/D0iVFwyuM3Wxt/7gXpPtI+m/3qt8QoFIGsZkck7X5hdJwGF4DD5jKxYB28s5Hc\n4ZBG19jezjMIVJUGE58TTVDTvZvJ5Vaw2RizV8DRkFS3q0UIOapOESpZiRnoOqA1\nDQpAU26RSEj8wlYsgNrVWUpdwlYs5e3EWYNkGROTRSB/dGcCSVF31A76W7af+6uv\nwZdMCrAGlD4GBj/yojdnqstfB2Jxu99VubcImWKfaJEXYx5xoREGmK9+t896GJi+\nE8mjiMOMRZFV2n2nwTxAFMaiDJ+VpKpKGVKCOSDwqsePhY/A4kb+N1nnhutmSl/v\n1SCDDvC9+jYNLUC1IaJfFOrNClA43IdJELOAavRx2t1RdyfyOx3D8rrWhF4+NB9Z\nlAc2e7hOoP/OEtf4YjZWq3dQtWSdwePWBxD9xyvF/kEmd2NcezqdfggH3g84qBxy\nUxBDD3ojMMAXlkPU3hRiDeLd1mHxDizVxqYkIYDSeAKtuv2ECH8y7/mv3sKrFtJe\nAQvSMW7gOmIdtQaIpsXHMxzXf+Nv0l3dZeWYD/TnVvoeVOaRQ9dHrtl3J0U9UN3j\nBOJdFaptlS4SIRkva6v6srrM7dXKvjR6IabdzaWl098VW9RFD+YGJ6ZhuQ+zOA==\n=l0k2\n-----END PGP MESSAGE-----",
-				"fp": "4BE7925262289B476DBBC17B76FD3810215AE097"
-			}
-		],
-		"unencrypted_suffix": "_unencrypted",
-		"version": "3.11.0"
-	}
-}