diff --git a/flake.nix b/flake.nix index cc2bccf..b3ddcf1 100644 --- a/flake.nix +++ b/flake.nix @@ -291,51 +291,63 @@ touch $out ''; - network-endpoint-fleet-registry = + address-registry = let - hostEndpointConfig = + hostAddressConfig = lib.nixosSystem { system = "x86_64-linux"; specialArgs.my = self.lib; modules = [ - ./modules/network.nix + self.lib.registry.module { - modules.network.endpoint.address = "10.23.50.146"; + registry.address.neogaia.self = "10.23.50.146"; + system.stateVersion = "26.11"; } ]; }; - guestEndpointConfig = + guestAddressConfig = lib.nixosSystem { system = "x86_64-linux"; specialArgs.my = self.lib; modules = [ inputs.sops-nix.nixosModules.sops + self.lib.registry.module ./modules/network.nix ./modules/reverse-proxy.nix (self.lib.guest { name = "copyparty"; }) { + networking.hostName = "pikachu"; modules.network.vlans = [ 20 ]; guests.copyparty = { enable = true; vlan = 20; - endpoint.address = "10.23.20.126"; + address = "10.23.20.126"; }; + system.stateVersion = "26.11"; } ]; }; + registry = self.lib.registry.collect { + hosts = { + neogaia = hostAddressConfig; + pikachu = guestAddressConfig; + }; + }; fleetEndpoints = self.lib.networkEndpoints.collectFleetEndpoints { - neogaia = hostEndpointConfig; - pikachu = guestEndpointConfig; + neogaia = hostAddressConfig; + pikachu = guestAddressConfig; }; in - pkgs.runCommand "network-endpoint-fleet-registry-check" { } '' + pkgs.runCommand "address-registry-check" { } '' ${ lib.optionalString ( !( - fleetEndpoints.neogaia.address == "10.23.50.146" + registry.address.neogaia.self == "10.23.50.146" + && registry.address.pikachu.copyparty == "10.23.20.126" + && fleetEndpoints.neogaia.address == "10.23.50.146" && fleetEndpoints."pikachu-copyparty".address == "10.23.20.126" && !(fleetEndpoints ? pikachu) - && guestEndpointConfig.config.containers.copyparty.config.systemd.network.networks."20-eth0".networkConfig.DHCP == "yes" + && guestAddressConfig.config.containers.copyparty.config.systemd.network.networks."20-eth0".networkConfig.DHCP == "yes" ) ) "exit 1" } @@ -393,9 +405,10 @@ system = "x86_64-linux"; specialArgs.my = self.lib; modules = [ - ./modules/network.nix + self.lib.registry.module { - modules.network.endpoint.address = "10.23.50.146"; + registry.address.worker.self = "10.23.50.146"; + system.stateVersion = "26.11"; } ]; }; @@ -420,6 +433,7 @@ specialArgs.my = self.lib; modules = [ inputs.sops-nix.nixosModules.sops + self.lib.registry.module ./modules/network.nix ./modules/reverse-proxy.nix (self.lib.guest { name = "files"; }) @@ -429,13 +443,14 @@ guests.files = { enable = true; vlan = 20; - endpoint.address = "10.23.20.126"; + address = "10.23.20.126"; reverseProxy = { enable = true; host = "files.alexion.dev"; port = 3923; }; }; + system.stateVersion = "26.11"; } ]; }; diff --git a/hosts/pikachu/default.nix b/hosts/pikachu/default.nix index 12da3ce..643ad6d 100644 --- a/hosts/pikachu/default.nix +++ b/hosts/pikachu/default.nix @@ -1,4 +1,9 @@ -{ config, pkgs, ... }: +{ + config, + pkgs, + registry, + ... +}: # pikachu — AZW ME Pro server. # Disk layout is in ./disk.nix. # `fileSystems` for the root disk are derived from it. @@ -79,7 +84,7 @@ vlan = 20; mac = "BC:24:11:C1:CD:28"; dataPath = "/pikachu/data/actualbudget"; - endpoint.address = "10.23.20.42"; + address = "10.23.20.42"; reverseProxy = { enable = true; host = "budget.alexion.dev"; @@ -91,7 +96,7 @@ enable = true; vlan = 20; mac = "02:98:64:5a:07:4f"; - endpoint.address = "10.23.20.109"; + address = "10.23.20.109"; }; guests.copyparty = { @@ -99,12 +104,12 @@ vlan = 20; mac = "02:23:20:39:23:01"; statePath = "/pikachu/data/copyparty"; - endpoint.address = "10.23.20.126"; + address = "10.23.20.126"; reverseProxy = { enable = true; host = "files.alexion.dev"; port = 3923; - trustedSources = [ "${config.modules.network.endpoints."reverse-proxy".address}/32" ]; + trustedSources = [ "${registry.address.${config.networking.hostName}."reverse-proxy"}/32" ]; }; volumes = { "/inbox" = { diff --git a/lib/guests.nix b/lib/guests.nix index 123ba8e..1750756 100644 --- a/lib/guests.nix +++ b/lib/guests.nix @@ -78,8 +78,7 @@ let systemd.network.networks."20-eth0" = { matchConfig.Name = "eth0"; linkConfig.MACAddress = cfg.mac; - networkConfig = lib.mkIf (cfg.address == null) { DHCP = "yes"; }; - address = lib.mkIf (cfg.address != null) [ cfg.address ]; + networkConfig.DHCP = "yes"; }; }; }; @@ -125,24 +124,12 @@ let address = lib.mkOption { type = lib.types.nullOr lib.types.str; default = null; - example = "10.0.10.5/24"; + example = "10.23.20.126"; description = '' - The guest's static address, in CIDR form, on its VLAN. Left null, the - guest takes its address by DHCP, keeping IP management at the router. + Expected IP address assigned outside NixOS for this guest. + Left null, this guest contributes no address to the address registry. ''; }; - endpoint = { - address = lib.mkOption { - type = lib.types.nullOr lib.types.str; - default = null; - example = "10.23.20.126"; - description = '' - Expected IP address assigned outside NixOS for this guest's - network endpoint. Left null, this guest contributes no endpoint to - the fleet endpoint registry. - ''; - }; - }; reverseProxy = reverseProxyRoutes.mkRouteOptions { subject = "guest route"; enableDefault = false; @@ -290,9 +277,7 @@ let config = lib.mkIf cfg.enable { sops.secrets = lib.genAttrs cfg.secrets (_: { }); - modules.network.endpoints.${machineName} = lib.mkIf (cfg.endpoint.address != null) { - inherit (cfg.endpoint) address; - }; + registry.address.${config.networking.hostName}.${machineName} = lib.mkIf (cfg.address != null) cfg.address; modules.reverse-proxy.routes.${machineName} = lib.mkIf cfg.reverseProxy.enable ( reverseProxyRoutes.routeFields ( diff --git a/lib/network-endpoints.nix b/lib/network-endpoints.nix index d823fb4..a4eaa6c 100644 --- a/lib/network-endpoints.nix +++ b/lib/network-endpoints.nix @@ -1,42 +1,20 @@ { lib }: +# TODO: Remove this compatibility bridge when route backend resolution reads registry.address directly. let - endpointOptions = { - address = lib.mkOption { - type = lib.types.str; - example = "10.23.20.126"; - description = "Expected IP address assigned outside NixOS for this network endpoint."; - }; - }; + endpointFields = address: { inherit address; }; - endpointType = lib.types.submodule { - options = endpointOptions; - }; - - endpointFields = endpoint: { - inherit (endpoint) address; - }; - - collectFleetEndpoints = - hosts: + collectFleetEndpoints = hosts: lib.concatMapAttrs ( hostName: host: - let - cfg = host.config.modules.network; - hostEndpoint = lib.optionalAttrs (cfg.endpoint.address != null) { - ${hostName} = endpointFields cfg.endpoint; - }; - guestEndpoints = lib.mapAttrs' ( - endpointName: endpoint: lib.nameValuePair "${hostName}-${endpointName}" (endpointFields endpoint) - ) cfg.endpoints; - in - hostEndpoint // guestEndpoints + lib.mapAttrs' ( + entryName: address: + let + endpointName = if entryName == "self" then hostName else "${hostName}-${entryName}"; + in + lib.nameValuePair endpointName (endpointFields address) + ) (host.config.registry.address.${hostName} or { }) ) hosts; in { - inherit - collectFleetEndpoints - endpointFields - endpointOptions - endpointType - ; + inherit collectFleetEndpoints endpointFields; } diff --git a/modules/network.nix b/modules/network.nix index 3f29ca0..f7e872e 100644 --- a/modules/network.nix +++ b/modules/network.nix @@ -43,28 +43,6 @@ in ''; }; - endpoint = { - address = lib.mkOption { - type = lib.types.nullOr lib.types.str; - default = null; - example = "10.23.50.146"; - description = '' - Expected IP address assigned outside NixOS for this host's network - endpoint. Left null, this host contributes no host endpoint to the - fleet endpoint registry. - ''; - }; - }; - - endpoints = lib.mkOption { - type = lib.types.attrsOf my.networkEndpoints.endpointType; - default = { }; - description = '' - Network endpoint declarations contributed by placed workloads on this - host, keyed by their local stable endpoint name. - ''; - }; - management = { vlan = lib.mkOption { type = lib.types.nullOr (lib.types.ints.between 1 4094);