flake.nix

@@ -291,51 +291,63 @@
               touch $out
             '';
 
-          network-endpoint-fleet-registry =
+          address-registry =
             let
-              hostEndpointConfig =
+              hostAddressConfig =
                 lib.nixosSystem {
                   system = "x86_64-linux";
                   specialArgs.my = self.lib;
                   modules = [
-                    ./modules/network.nix
+                    self.lib.registry.module
                     {
-                      modules.network.endpoint.address = "10.23.50.146";
+                      registry.address.neogaia.self = "10.23.50.146";
+                      system.stateVersion = "26.11";
                     }
                   ];
                 };
-              guestEndpointConfig =
+              guestAddressConfig =
                 lib.nixosSystem {
                   system = "x86_64-linux";
                   specialArgs.my = self.lib;
                   modules = [
                     inputs.sops-nix.nixosModules.sops
+                    self.lib.registry.module
                     ./modules/network.nix
                     ./modules/reverse-proxy.nix
                     (self.lib.guest { name = "copyparty"; })
                     {
+                      networking.hostName = "pikachu";
                       modules.network.vlans = [ 20 ];
                       guests.copyparty = {
                         enable = true;
                         vlan = 20;
-                        endpoint.address = "10.23.20.126";
+                        address = "10.23.20.126";
                       };
+                      system.stateVersion = "26.11";
                     }
                   ];
                 };
+              registry = self.lib.registry.collect {
+                hosts = {
+                  neogaia = hostAddressConfig;
+                  pikachu = guestAddressConfig;
+                };
+              };
               fleetEndpoints = self.lib.networkEndpoints.collectFleetEndpoints {
-                neogaia = hostEndpointConfig;
+                neogaia = hostAddressConfig;
-                pikachu = guestEndpointConfig;
+                pikachu = guestAddressConfig;
               };
             in
-            pkgs.runCommand "network-endpoint-fleet-registry-check" { } ''
+            pkgs.runCommand "address-registry-check" { } ''
               ${
                 lib.optionalString (
                   !(
-                    fleetEndpoints.neogaia.address == "10.23.50.146"
+                    registry.address.neogaia.self == "10.23.50.146"
+                    && registry.address.pikachu.copyparty == "10.23.20.126"
+                    && fleetEndpoints.neogaia.address == "10.23.50.146"
                     && fleetEndpoints."pikachu-copyparty".address == "10.23.20.126"
                     && !(fleetEndpoints ? pikachu)
-                    && guestEndpointConfig.config.containers.copyparty.config.systemd.network.networks."20-eth0".networkConfig.DHCP == "yes"
+                    && guestAddressConfig.config.containers.copyparty.config.systemd.network.networks."20-eth0".networkConfig.DHCP == "yes"
                   )
                 ) "exit 1"
               }
@@ -393,9 +405,10 @@
                   system = "x86_64-linux";
                   specialArgs.my = self.lib;
                   modules = [
-                    ./modules/network.nix
+                    self.lib.registry.module
                     {
-                      modules.network.endpoint.address = "10.23.50.146";
+                      registry.address.worker.self = "10.23.50.146";
+                      system.stateVersion = "26.11";
                     }
                   ];
                 };
@@ -420,6 +433,7 @@
                   specialArgs.my = self.lib;
                   modules = [
                     inputs.sops-nix.nixosModules.sops
+                    self.lib.registry.module
                     ./modules/network.nix
                     ./modules/reverse-proxy.nix
                     (self.lib.guest { name = "files"; })
@@ -429,13 +443,14 @@
                       guests.files = {
                         enable = true;
                         vlan = 20;
-                        endpoint.address = "10.23.20.126";
+                        address = "10.23.20.126";
                         reverseProxy = {
                           enable = true;
                           host = "files.alexion.dev";
                           port = 3923;
                         };
                       };
+                      system.stateVersion = "26.11";
                     }
                   ];
                 };

hosts/pikachu/default.nix

@@ -1,4 +1,9 @@
-{ config, pkgs, ... }:
+{
+  config,
+  pkgs,
+  registry,
+  ...
+}:
 # pikachu — AZW ME Pro server.
 # Disk layout is in ./disk.nix.
 # `fileSystems` for the root disk are derived from it.
@@ -79,7 +84,7 @@
     vlan = 20;
     mac = "BC:24:11:C1:CD:28";
     dataPath = "/pikachu/data/actualbudget";
-    endpoint.address = "10.23.20.42";
+    address = "10.23.20.42";
     reverseProxy = {
       enable = true;
       host = "budget.alexion.dev";
@@ -91,7 +96,7 @@
     enable = true;
     vlan = 20;
     mac = "02:98:64:5a:07:4f";
-    endpoint.address = "10.23.20.109";
+    address = "10.23.20.109";
   };
 
   guests.copyparty = {
@@ -99,12 +104,12 @@
     vlan = 20;
     mac = "02:23:20:39:23:01";
     statePath = "/pikachu/data/copyparty";
-    endpoint.address = "10.23.20.126";
+    address = "10.23.20.126";
     reverseProxy = {
       enable = true;
       host = "files.alexion.dev";
       port = 3923;
-      trustedSources = [ "${config.modules.network.endpoints."reverse-proxy".address}/32" ];
+      trustedSources = [ "${registry.address.${config.networking.hostName}."reverse-proxy"}/32" ];
     };
     volumes = {
       "/inbox" = {

lib/guests.nix

@@ -78,8 +78,7 @@ let
             systemd.network.networks."20-eth0" = {
               matchConfig.Name = "eth0";
               linkConfig.MACAddress = cfg.mac;
-              networkConfig = lib.mkIf (cfg.address == null) { DHCP = "yes"; };
+              networkConfig.DHCP = "yes";
-              address = lib.mkIf (cfg.address != null) [ cfg.address ];
             };
           };
         };
@@ -122,27 +121,15 @@ let
             from the guest's namespace path in the locally-administered range.
           '';
         };
-        address = lib.mkOption {
-          type = lib.types.nullOr lib.types.str;
-          default = null;
-          example = "10.0.10.5/24";
-          description = ''
-            The guest's static address, in CIDR form, on its VLAN. Left null, the
-            guest takes its address by DHCP, keeping IP management at the router.
-          '';
-        };
-        endpoint = {
         address = lib.mkOption {
           type = lib.types.nullOr lib.types.str;
           default = null;
           example = "10.23.20.126";
           description = ''
-              Expected IP address assigned outside NixOS for this guest's
+            Expected IP address assigned outside NixOS for this guest.
-              network endpoint. Left null, this guest contributes no endpoint to
+            Left null, this guest contributes no address to the address registry.
-              the fleet endpoint registry.
           '';
         };
-        };
         reverseProxy = reverseProxyRoutes.mkRouteOptions {
           subject = "guest route";
           enableDefault = false;
@@ -290,9 +277,7 @@ let
       config = lib.mkIf cfg.enable {
         sops.secrets = lib.genAttrs cfg.secrets (_: { });
 
-        modules.network.endpoints.${machineName} = lib.mkIf (cfg.endpoint.address != null) {
+        registry.address.${config.networking.hostName}.${machineName} = lib.mkIf (cfg.address != null) cfg.address;
-          inherit (cfg.endpoint) address;
-        };
 
         modules.reverse-proxy.routes.${machineName} = lib.mkIf cfg.reverseProxy.enable (
           reverseProxyRoutes.routeFields (

lib/network-endpoints.nix

@@ -1,42 +1,20 @@
 { lib }:
+# TODO: Remove this compatibility bridge when route backend resolution reads registry.address directly.
 let
-  endpointOptions = {
+  endpointFields = address: { inherit address; };
-    address = lib.mkOption {
-      type = lib.types.str;
-      example = "10.23.20.126";
-      description = "Expected IP address assigned outside NixOS for this network endpoint.";
-    };
-  };
 
-  endpointType = lib.types.submodule {
+  collectFleetEndpoints = hosts:
-    options = endpointOptions;
-  };
-
-  endpointFields = endpoint: {
-    inherit (endpoint) address;
-  };
-
-  collectFleetEndpoints =
-    hosts:
     lib.concatMapAttrs (
       hostName: host:
+      lib.mapAttrs' (
+        entryName: address:
         let
-        cfg = host.config.modules.network;
+          endpointName = if entryName == "self" then hostName else "${hostName}-${entryName}";
-        hostEndpoint = lib.optionalAttrs (cfg.endpoint.address != null) {
-          ${hostName} = endpointFields cfg.endpoint;
-        };
-        guestEndpoints = lib.mapAttrs' (
-          endpointName: endpoint: lib.nameValuePair "${hostName}-${endpointName}" (endpointFields endpoint)
-        ) cfg.endpoints;
         in
-      hostEndpoint // guestEndpoints
+        lib.nameValuePair endpointName (endpointFields address)
+      ) (host.config.registry.address.${hostName} or { })
     ) hosts;
 in
 {
-  inherit
+  inherit collectFleetEndpoints endpointFields;
-    collectFleetEndpoints
-    endpointFields
-    endpointOptions
-    endpointType
-    ;
 }

modules/network.nix

@@ -43,28 +43,6 @@ in
       '';
     };
 
-    endpoint = {
-      address = lib.mkOption {
-        type = lib.types.nullOr lib.types.str;
-        default = null;
-        example = "10.23.50.146";
-        description = ''
-          Expected IP address assigned outside NixOS for this host's network
-          endpoint. Left null, this host contributes no host endpoint to the
-          fleet endpoint registry.
-        '';
-      };
-    };
-
-    endpoints = lib.mkOption {
-      type = lib.types.attrsOf my.networkEndpoints.endpointType;
-      default = { };
-      description = ''
-        Network endpoint declarations contributed by placed workloads on this
-        host, keyed by their local stable endpoint name.
-      '';
-    };
-
     management = {
       vlan = lib.mkOption {
         type = lib.types.nullOr (lib.types.ints.between 1 4094);