refactor(modules): organize module tree

modules/network/ssh.nix

@@ -0,0 +1,335 @@
+{
+  config,
+  lib,
+  registry,
+  ...
+}:
+# SSH on this machine, in both directions.
+let
+  cfg = config.modules.network.ssh;
+  user = config.user.name;
+
+  inherit (lib)
+    concatLists
+    concatStringsSep
+    elem
+    filter
+    genAttrs
+    hasAttr
+    imap0
+    listToAttrs
+    mapAttrs
+    mapAttrsToList
+    mkIf
+    mkMerge
+    mkOption
+    nameValuePair
+    optional
+    optionalAttrs
+    types
+    unique
+    ;
+
+  hostKeySecret = type: "ssh-host-${type}-key";
+  userKeySecret = "ssh-user-ed25519-key";
+
+  targetType = types.submodule (
+    { name, ... }:
+    {
+      options = {
+        hostName = mkOption {
+          type = types.str;
+          default = name;
+          description = ''
+            The network address OpenSSH connects to for this target.
+          '';
+        };
+
+        user = mkOption {
+          type = types.str;
+          default = config.user.name;
+          description = ''
+            The remote login name OpenSSH uses for this target.
+          '';
+        };
+
+        port = mkOption {
+          type = types.port;
+          default = 22;
+          description = ''
+            The TCP port OpenSSH uses for this target.
+          '';
+        };
+
+        aliases = mkOption {
+          type = types.listOf types.str;
+          default = [ name ];
+          description = ''
+            Host patterns written into the generated OpenSSH client block.
+          '';
+        };
+
+        clientKey = mkOption {
+          type = types.nullOr types.str;
+          default = null;
+          description = ''
+            The public key this target offers when it connects outward.
+            Other machines admit this key according to the host groups below.
+          '';
+        };
+
+        hostKeys = mkOption {
+          type = types.listOf types.str;
+          default = [ ];
+          description = ''
+            The public keys this target presents when it accepts inbound SSH.
+            These keys generate system-wide known-host entries.
+          '';
+        };
+      };
+    }
+  );
+
+  keyWithoutComment = key: concatStringsSep " " (lib.take 2 (lib.splitString " " key));
+
+  targetNamesIn = names: filter (name: hasAttr name cfg.targets) names;
+
+  workstationNames = targetNamesIn cfg.hosts.workstations;
+  serverNames = targetNamesIn cfg.hosts.servers;
+
+  clientKeysFor = names: filter (key: key != null) (map (name: cfg.targets.${name}.clientKey) names);
+
+  currentHost = config.networking.hostName;
+  isServer = elem currentHost cfg.hosts.servers;
+  isWorkstation = elem currentHost cfg.hosts.workstations;
+
+  defaultAuthorizedKeys = lib.flatten (
+    clientKeysFor workstationNames
+    ++ optional isServer (clientKeysFor serverNames)
+  );
+
+  outboundTargetNames =
+    let
+      groupTargets =
+        if isServer then
+          [ "gitea" ] ++ cfg.hosts.servers
+        else if isWorkstation then
+          [ "gitea" ] ++ cfg.hosts.servers ++ cfg.hosts.workstations
+        else
+          [ "gitea" ];
+    in
+    filter (name: name != currentHost) (targetNamesIn groupTargets);
+
+  sshSettingsFor = name:
+    let
+      target = cfg.targets.${name};
+    in
+    {
+      header = "Host ${concatStringsSep " " target.aliases}";
+      HostName = target.hostName;
+      User = target.user;
+    }
+    // optionalAttrs (target.port != 22) { Port = target.port; };
+
+  knownHostNamesFor = target:
+    let
+      names = unique (target.aliases ++ [ target.hostName ]);
+      withPort = name: if target.port == 22 then name else "[${name}]:${toString target.port}";
+    in
+    map withPort names;
+
+  knownHosts = listToAttrs (
+    concatLists (
+      mapAttrsToList (
+        targetName: target:
+        imap0 (i: key:
+          nameValuePair "${targetName}-${toString i}" {
+            hostNames = knownHostNamesFor target;
+            publicKey = keyWithoutComment key;
+          }
+        ) target.hostKeys
+      ) cfg.targets
+    )
+  );
+in
+{
+  options.modules.network.ssh = {
+    enable = lib.mkEnableOption "the OpenSSH daemon, with host keys restored from secrets";
+
+    hosts = {
+      servers = mkOption {
+        type = types.listOf types.str;
+        default = [ "pikachu" ];
+        description = ''
+          Hosts that serve durable services.
+          They admit workstation keys and server keys, and they receive aliases for other servers and the forge.
+        '';
+      };
+
+      workstations = mkOption {
+        type = types.listOf types.str;
+        default = [ "neogaia" ];
+        description = ''
+          Hosts the operator works from.
+          Their keys are admitted by every host, and they receive aliases for the whole fleet and the forge.
+        '';
+      };
+    };
+
+    targets = mkOption {
+      type = types.attrsOf targetType;
+      default = {
+        gitea = {
+          hostName = "git.alexion.dev";
+          port = 2022;
+          user = "gitea";
+          aliases = [
+            "gitea"
+            "git.alexion.dev"
+          ];
+        };
+
+        neogaia = {
+          hostName = registry.address.neogaia.self;
+          clientKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGxQ4kWsBo2OGYIPOkFe0vNEcB3yoJwAu0y9wrdQzALE alexion@neogaia";
+          hostKeys = [
+            "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJS+wp7K123+4BT6G4f954R6WyrbWveY7VlpoBUf6I5p neogaia"
+            "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCo2wWUKxyAS4J5TqbWf8glDhJvS5XmdRqFhMeJwG3pOB+4AccZ1T8LU7ZN+RjtRi3j2qXBJvIHuzhtQNtmT59TxocvfobYiqOgJpvVO5K6yD8ZoUJs6ziDkIduI9w9mdRIESoi+dBbVu8n24r61cKDVh+jWX+yjzkOcWcOzqDyQhhkjqblZ1WMAdujEMuEPvif1i2LCxStUaZqRGcx09m/ME2fYcaJrpuxxxvX2+CPJNicoo6Rx9i7ZjAoNuvH+jui4KT62DzlQtQtCl2CFUOM0gCPSa+MbNQ9elfHPvGzEcwOIMo2cuy9KURUkQu+sAgaG8S1PEniDDTecskHtuRdmPZawnQGpIhzo919Q6wUgjT8scK4mmSXRWmGmkMt0GNA2tfj5tDks6r5Q8XsYqtWs4rsOEvfmxVSdM771w+fqDBAil99Jsh0ksPK9+Bwgg8cMDzLLFDn8JA5y2G1HocMMom+u5DYKwPXEKnCILkasB8y24+O3PhSu1EuWw277w6EUEXvU03rCf0Ak/ULjxp9a00EGlloEwSmFI7Aub9XHDr87IdbGInEn+PMqyBYADiN+3h6nE2JO+nMa6i/CHdebmT+T7YJvuTKHD9sjFmQsYaghlq03DZrhHcm4hgUvE1dqGojHrhk/WgA3EWTWtK/+BP0Vy2jXaaz+qAx+EGnhQ== neogaia"
+          ];
+        };
+
+        pikachu = {
+          hostName = registry.address.pikachu.self;
+          clientKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINNqJIC6VRXyvrNf3n9su9KdPCikC3CjK/QrCK2reHdB alexion@pikachu";
+          hostKeys = [
+            "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKljRf4pJO+pqEqjpPz08gOYq3g1PpxvE66xVw7uMEnA root@pikachu"
+            "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCy/riwm7dflA3mT+3a0/2CIoS2LbAsK/vn35kOoNeuzn0yhiF+imexP6tkB3S2t+H5ybRzkbbuNZcynFfeCqthFc8kvbdCnt8Diqoeg96fZ6ecvh5QE5yH9op8534EySetZ/exakFLnF+6EiWMuWUW3DFwsc2kcgDJObqSE8gTx/d7JK953MiTFmSJBFyg1RtQ3ZnMT+iCrvY2dyCLQai7VeF8koVKF2c0leAq2Hc75rb/L9md8MoJa64iPiz7hwTCin3xoFyaY/5hNVvyqFd5PivgR69gLdJkuVsUYO2mJzhur8cYmJD+pGjJ0U45hyE9TMrCFjeJHHuvSt3+2kph62wv95jLNk0WmMlwgyunISxENCSVVtNYdBMXhUh8VhEAW17QpVUg9EnPvxOdTKEjrvfOZYASWUa51JKbgBgexVgFbxdjDZR88DZa31AVBts/cx/59gXTUahFXMYLdZgssx+5uibZQWnvCyfUV9WLbfmK1lgL6hzReg1VkQ87iGr6skjtQYemJxRaFNA1+Q5f3kmG3KncuK/594a3qXYP4gC6A2blf8om1YZ4aXXh6f+GFKLjoEw1vvM2rJ+rjzfymwDX+pxVQ9L13OEtVZc9Ez76pOkbm1hqdbL0gY45+0cpxodhWV0wMQJBDXL1MHP8qcs+/vw0GxVK5l1SnWBGlw== root@pikachu"
+          ];
+        };
+      };
+      description = ''
+        SSH targets known to the fleet.
+        The inventory holds connection details plus public keys used for authorization and host verification.
+      '';
+    };
+
+    extraAuthorizedKeys = mkOption {
+      type = types.listOf types.str;
+      default = [ ];
+      description = ''
+        Additional client public keys admitted by this host.
+      '';
+    };
+
+    authorizedKeys = mkOption {
+      type = types.nullOr (types.listOf types.str);
+      default = null;
+      description = ''
+        Complete override for client public keys admitted by this host.
+        Leave null to derive access from `modules.network.ssh.hosts` and `modules.network.ssh.targets`.
+      '';
+    };
+
+    extraSettings = mkOption {
+      type = types.attrsOf types.anything;
+      default = { };
+      description = ''
+        Additional OpenSSH client settings merged into the generated Home Manager configuration.
+      '';
+    };
+
+    hostKeys.restore = mkOption {
+      type = types.bool;
+      default = true;
+      description = ''
+        Restore the host keys from secrets rather than letting the daemon generate its own.
+        A machine with its own identity keeps its fingerprint across a reimage by restoring committed keys.
+        A guest carries no host identity, so it turns this off and presents a self-generated key instead.
+      '';
+    };
+
+    hostKeys.sopsFile = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      description = ''
+        Encrypted file holding this host's SSH host private keys, one entry per key type, named `ssh-host-<type>-key`.
+        Required when `restore` is on.
+      '';
+    };
+
+    hostKeys.types = mkOption {
+      type = types.listOf types.str;
+      default = [
+        "ed25519"
+        "rsa"
+      ];
+      description = ''
+        Key types to restore, naming both the entries read from the encrypted file and the algorithms the daemon offers.
+      '';
+    };
+
+    userKey.sopsFile = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      description = ''
+        Encrypted file holding this machine's SSH client private key, under the entry `ssh-user-ed25519-key`.
+        Left unset on a machine that authenticates to no remote server, such as a guest.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable (
+    mkMerge [
+      {
+        services.openssh.enable = true;
+
+        users.users.${user}.openssh.authorizedKeys.keys =
+          if cfg.authorizedKeys != null then
+            cfg.authorizedKeys
+          else
+            defaultAuthorizedKeys ++ cfg.extraAuthorizedKeys;
+
+        programs.ssh.knownHosts = knownHosts;
+
+        home-manager.users.${user}.programs.ssh = {
+          enable = true;
+          enableDefaultConfig = false;
+          settings =
+            mapAttrs (name: _: sshSettingsFor name) (genAttrs outboundTargetNames (name: name))
+            // cfg.extraSettings;
+        };
+      }
+
+      (mkIf cfg.hostKeys.restore {
+        assertions = [
+          {
+            assertion = cfg.hostKeys.sopsFile != null;
+            message = "modules.network.ssh.hostKeys.restore requires modules.network.ssh.hostKeys.sopsFile to name the encrypted host keys.";
+          }
+        ];
+
+        sops.secrets = genAttrs (map hostKeySecret cfg.hostKeys.types) (_: {
+          inherit (cfg.hostKeys) sopsFile;
+          mode = "0400";
+          restartUnits = [ "sshd.service" ];
+        });
+
+        services.openssh.hostKeys = [ ];
+        services.openssh.extraConfig = concatStringsSep "" (
+          map (type: "HostKey ${config.sops.secrets.${hostKeySecret type}.path}\n") cfg.hostKeys.types
+        );
+      })
+
+      (mkIf (cfg.userKey.sopsFile != null) {
+        sops.secrets.${userKeySecret} = {
+          inherit (cfg.userKey) sopsFile;
+          mode = "0400";
+          owner = user;
+        };
+
+        home-manager.users.${user}.programs.ssh.settings."*".IdentityFile =
+          config.sops.secrets.${userKeySecret}.path;
+      })
+    ]
+  );
+}

modules/network/vlans.nix

@@ -0,0 +1,141 @@
+{
+  config,
+  lib,
+  my,
+  ...
+}:
+# The host networking foundation: per-VLAN bridges over a tagged trunk.
+let
+  cfg = config.modules.network.vlans;
+
+  inherit (my) bridgeName;
+
+  vlanName = id: "${cfg.trunk}.${toString id}";
+in
+{
+  options.modules.network.vlans = {
+    enable = lib.mkEnableOption "host VLAN bridges over a tagged trunk";
+
+    trunk = lib.mkOption {
+      type = lib.types.str;
+      example = "enp1s0";
+      description = ''
+        Physical interface that carries 802.1Q-tagged traffic for every VLAN.
+        Each declared VLAN attaches to its own bridge.
+      '';
+    };
+
+    ids = lib.mkOption {
+      type = lib.types.listOf (lib.types.ints.between 1 4094);
+      default = [ ];
+      example = [
+        10
+        20
+        30
+      ];
+      description = ''
+        Tagged VLAN ids to materialize.
+        Each id N creates one bridge named `br-vlanN`.
+      '';
+    };
+
+    management = {
+      vlan = lib.mkOption {
+        type = lib.types.nullOr (lib.types.ints.between 1 4094);
+        default = null;
+        description = ''
+          VLAN whose bridge carries the host's own management address.
+          The value must be one of `ids`.
+          Left null, the host takes no address on any bridge.
+        '';
+      };
+
+      address = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
+        default = null;
+        example = "10.0.10.2/24";
+        description = ''
+          Host static management address in CIDR form.
+          Left null, the host takes its management address by DHCP.
+        '';
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = cfg.management.vlan == null || lib.elem cfg.management.vlan cfg.ids;
+        message = "modules.network.vlans.management.vlan (${toString cfg.management.vlan}) must name one of modules.network.vlans.ids.";
+      }
+      {
+        assertion = cfg.management.address == null || cfg.management.vlan != null;
+        message = "modules.network.vlans.management.address needs modules.network.vlans.management.vlan to say which bridge carries it.";
+      }
+    ];
+
+    # networkd owns these interfaces so NetworkManager does not contend for them.
+    networking.networkmanager.unmanaged =
+      [ "interface-name:${cfg.trunk}" ]
+      ++ map (id: "interface-name:${bridgeName id}") cfg.ids
+      ++ map (id: "interface-name:${vlanName id}") cfg.ids;
+
+    systemd.network = {
+      enable = true;
+
+      netdevs = lib.mkMerge (
+        map (id: {
+          "40-${bridgeName id}" = {
+            netdevConfig = {
+              Name = bridgeName id;
+              Kind = "bridge";
+            };
+          };
+          "40-${vlanName id}" = {
+            netdevConfig = {
+              Name = vlanName id;
+              Kind = "vlan";
+            };
+            vlanConfig.Id = id;
+          };
+        }) cfg.ids
+      );
+
+      networks = lib.mkMerge (
+        [
+          # The trunk carries only tagged frames and takes no address.
+          {
+            "30-${cfg.trunk}" = {
+              matchConfig.Name = cfg.trunk;
+              networkConfig.LinkLocalAddressing = "no";
+              linkConfig.RequiredForOnline = "no";
+              vlan = map vlanName cfg.ids;
+            };
+          }
+        ]
+        ++ map (id: {
+          # Enslaved to its bridge, carrying no address itself.
+          "40-${vlanName id}" = {
+            matchConfig.Name = vlanName id;
+            networkConfig.Bridge = bridgeName id;
+            linkConfig.RequiredForOnline = "no";
+          };
+          # The management bridge carries the host address.
+          # Other bridges provide L2 segments for guests.
+          "40-${bridgeName id}" = lib.mkMerge [
+            {
+              matchConfig.Name = bridgeName id;
+              linkConfig.RequiredForOnline = "no";
+            }
+            (lib.mkIf (cfg.management.vlan == id) (
+              if cfg.management.address == null then
+                { networkConfig.DHCP = "yes"; }
+              else
+                { address = [ cfg.management.address ]; }
+            ))
+          ];
+        }) cfg.ids
+      );
+    };
+  };
+}