refactor(flake): split assembly by concept

flake/default.nix

@@ -5,26 +5,11 @@
 }:
 let
   registryAssembly = import ./registry.nix { inherit lib self; };
+  modules = import ./modules.nix { inherit lib; };
+  dotfilesLib = import ../lib { inherit lib; };
 
-  collectNixFiles =
+  moduleFiles = modules.mkModules (self + "/modules");
-    dir:
+  guestFiles = modules.mkModules (self + "/guests");
-    lib.flatten (
-      lib.mapAttrsToList (
-        name: type:
-        let
-          path = dir + "/${name}";
-        in
-        if type == "directory" then
-          collectNixFiles path
-        else if type == "regular" && lib.hasSuffix ".nix" name then
-          [ path ]
-        else
-          [ ]
-      ) (builtins.readDir dir)
-    );
-
-  moduleFiles = collectNixFiles (self + "/modules");
-  guestFiles = collectNixFiles (self + "/guests");
 
   collectedRegistry = registryAssembly.collect { hosts = self.nixosConfigurations; };
 
@@ -37,15 +22,10 @@ let
     registry = collectedRegistry;
   };
 
-  bridgeName = id: "br-vlan${toString id}";
-
   dotfiles = {
-    inherit (guests) guest;
+    inherit (guests) mkGuest;
 
-    lib = {
+    lib = dotfilesLib;
-      inherit bridgeName;
-      inherit (guests) deriveMac;
-    };
   };
 
   guests = import ./guests.nix {
@@ -54,43 +34,24 @@ let
       lib
       self
       specialArgs
-      bridgeName
       moduleFiles
       registryAssembly
+      dotfilesLib
       ;
   };
 
-  mkHost =
+  hosts = import ./hosts.nix {
-    {
+    inherit
-      hostName,
+      inputs
-      system ? "x86_64-linux",
+      lib
-    }:
+      self
-    inputs.nixpkgs.lib.nixosSystem {
+      specialArgs
-      inherit system specialArgs;
+      moduleFiles
-      modules =
+      guestFiles
-        moduleFiles
+      registryAssembly
-        ++ guestFiles
+      ;
-        ++ [
+  };
-          inputs.chaotic.nixosModules.default
-          inputs.disko.nixosModules.disko
-          inputs.sops-nix.nixosModules.sops
-          inputs.stylix.nixosModules.stylix
-          registryAssembly.module
-          (self + "/hosts/${hostName}")
-          {
-            networking.hostName = hostName;
-            modules.host.enable = true;
-          }
-        ];
-    };
-
-  mkHosts =
-    hostsDir:
-    let
-      hostNames = lib.attrNames (lib.filterAttrs (_name: type: type == "directory") (builtins.readDir hostsDir));
-    in
-    lib.genAttrs hostNames (hostName: mkHost { inherit hostName; });
 in
 {
-  inherit mkHosts;
+  inherit (hosts) mkHosts;
 }

flake/guests.nix

@@ -3,22 +3,12 @@
   lib,
   self,
   specialArgs,
-  bridgeName,
   moduleFiles,
   registryAssembly,
+  dotfilesLib,
 }:
 let
-  inherit (lib) escapeShellArg mapAttrsToList;
+  mkGuest =
-
-  deriveMac =
-    name:
-    let
-      hash = builtins.hashString "sha256" name;
-      octet = i: builtins.substring (i * 2) 2 hash;
-    in
-    lib.concatStringsSep ":" ([ "02" ] ++ map octet [ 0 1 2 3 4 ]);
-
-  guest =
     {
       name,
       interior ? { },
@@ -59,13 +49,13 @@ let
 
       createdMounts = lib.filterAttrs (_guestPath: m: m.create != null) cfg.mounts;
       mountCreateScript = lib.concatStringsSep "\n" (
-        mapAttrsToList (
+        lib.mapAttrsToList (
           _guestPath: m:
           let
             create = m.create;
           in
           ''
-            ${config.system.path}/bin/install -d -o ${escapeShellArg (toString create.owner)} -g ${escapeShellArg create.group} -m ${escapeShellArg create.mode} ${escapeShellArg m.hostPath}
+            ${config.system.path}/bin/install -d -o ${lib.escapeShellArg (toString create.owner)} -g ${lib.escapeShellArg create.group} -m ${lib.escapeShellArg create.mode} ${lib.escapeShellArg m.hostPath}
           ''
         ) createdMounts
       );
@@ -113,7 +103,7 @@ let
         };
         mac = lib.mkOption {
           type = lib.types.str;
-          default = deriveMac name;
+          default = dotfilesLib.deriveMac name;
           defaultText = lib.literalMD "a stable address derived from the guest's namespace path";
           example = "bc:24:11:00:00:01";
           description = ''
@@ -316,7 +306,7 @@ let
             }
             (lib.mkIf networked (
               let
-                bridgeDevice = "sys-subsystem-net-devices-${lib.replaceStrings [ "-" ] [ "\\x2d" ] (bridgeName cfg.vlan)}.device";
+                bridgeDevice = "sys-subsystem-net-devices-${lib.replaceStrings [ "-" ] [ "\\x2d" ] (dotfilesLib.bridgeName cfg.vlan)}.device";
               in
               {
                 after = [ bridgeDevice ];
@@ -329,7 +319,7 @@ let
         containers.${machineName} = lib.mkIf (cfg.backend == "container") {
           autoStart = cfg.autoStart;
           privateNetwork = lib.mkDefault true;
-          hostBridge = lib.mkIf networked (bridgeName cfg.vlan);
+          hostBridge = lib.mkIf networked (dotfilesLib.bridgeName cfg.vlan);
           privateUsers = lib.mkDefault "no";
           additionalCapabilities = lib.optionals cfg.nesting [ "CAP_NET_ADMIN" ];
           allowedDevices = lib.optionals cfg.nesting [
@@ -366,5 +356,5 @@ let
     };
 in
 {
-  inherit deriveMac guest;
+  inherit mkGuest;
 }

flake/hosts.nix

@@ -0,0 +1,44 @@
+{
+  inputs,
+  lib,
+  self,
+  specialArgs,
+  moduleFiles,
+  guestFiles,
+  registryAssembly,
+}:
+let
+  mkHost =
+    {
+      hostName,
+      system ? "x86_64-linux",
+    }:
+    inputs.nixpkgs.lib.nixosSystem {
+      inherit system specialArgs;
+      modules =
+        moduleFiles
+        ++ guestFiles
+        ++ [
+          inputs.chaotic.nixosModules.default
+          inputs.disko.nixosModules.disko
+          inputs.sops-nix.nixosModules.sops
+          inputs.stylix.nixosModules.stylix
+          registryAssembly.module
+          (self + "/hosts/${hostName}")
+          {
+            networking.hostName = hostName;
+            modules.host.enable = true;
+          }
+        ];
+    };
+
+  mkHosts =
+    hostsDir:
+    let
+      hostNames = lib.attrNames (lib.filterAttrs (_name: type: type == "directory") (builtins.readDir hostsDir));
+    in
+    lib.genAttrs hostNames (hostName: mkHost { inherit hostName; });
+in
+{
+  inherit mkHosts;
+}

flake/modules.nix

@@ -0,0 +1,22 @@
+{ lib }:
+let
+  collectNixFiles =
+    dir:
+    lib.flatten (
+      lib.mapAttrsToList (
+        name: type:
+        let
+          path = dir + "/${name}";
+        in
+        if type == "directory" then
+          collectNixFiles path
+        else if type == "regular" && lib.hasSuffix ".nix" name then
+          [ path ]
+        else
+          [ ]
+      ) (builtins.readDir dir)
+    );
+in
+{
+  mkModules = collectNixFiles;
+}

guests/actualbudget.nix

@@ -10,7 +10,7 @@ let
 in
 {
   imports = [
-    (dotfiles.guest {
+    (dotfiles.mkGuest {
       name = "actualbudget";
       interior = {
         modules.services.actualbudget = {

guests/copyparty.nix

@@ -35,7 +35,7 @@ let
 in
 {
   imports = [
-    (dotfiles.guest {
+    (dotfiles.mkGuest {
       name = "copyparty";
       interior = {
         modules.services.copyparty = {

guests/nesting-sample.nix

@@ -1,7 +1,7 @@
 args@{ dotfiles, ... }:
 # A sample guest whose interior runs an OCI container on Podman.
 # The image is pulled at runtime, so the guest builds with no build-time fetch.
-dotfiles.guest {
+dotfiles.mkGuest {
   name = "nesting-sample";
   interior = {
     virtualisation.oci-containers.containers.hello = {

guests/reverse-proxy.nix

@@ -9,7 +9,7 @@ let
 in
 {
   imports = [
-    (dotfiles.guest {
+    (dotfiles.mkGuest {
       name = "reverse-proxy";
       interior = {
         modules.services.reverse-proxy.enable = true;

guests/sample.nix

@@ -2,4 +2,4 @@ args@{ dotfiles, ... }:
 # The tracer-bullet guest: the thinnest complete path from discovery to a
 # running nested container. Its interior is just the guest-base — the baseline
 # toolset and SSH access — so it proves the concept without carrying a service.
-dotfiles.guest { name = "sample"; } args
+dotfiles.mkGuest { name = "sample"; } args

lib/default.nix

@@ -0,0 +1,7 @@
+{ lib }:
+let
+  network = import ./network.nix { inherit lib; };
+in
+{
+  inherit (network) bridgeName deriveMac;
+}

lib/network.nix

@@ -0,0 +1,12 @@
+{ lib }:
+{
+  bridgeName = id: "br-vlan${toString id}";
+
+  deriveMac =
+    name:
+    let
+      hash = builtins.hashString "sha256" name;
+      octet = i: builtins.substring (i * 2) 2 hash;
+    in
+    lib.concatStringsSep ":" ([ "02" ] ++ map octet [ 0 1 2 3 4 ]);
+}