flake.nix

@@ -394,10 +394,6 @@
                   pikachu = guestAddressConfig;
                 };
               };
-              fleetEndpoints = self.lib.networkEndpoints.collectFleetEndpoints {
-                neogaia = hostAddressConfig;
-                pikachu = guestAddressConfig;
-              };
             in
             pkgs.runCommand "address-registry-check" { } ''
               ${
@@ -405,9 +401,6 @@
                   !(
                     registry.address.neogaia.self == "10.23.50.146"
                     && registry.address.pikachu.copyparty == "10.23.20.126"
-                    && fleetEndpoints.neogaia.address == "10.23.50.146"
-                    && fleetEndpoints."pikachu-copyparty".address == "10.23.20.126"
-                    && !(fleetEndpoints ? pikachu)
                     && guestAddressConfig.config.containers.copyparty.config.systemd.network.networks."20-eth0".networkConfig.DHCP == "yes"
                   )
                 ) "exit 1"
@@ -415,7 +408,29 @@
               touch $out
             '';
 
-          reverse-proxy-fleet-routes =
+          ssh-targets-use-address-registry =
+            let
+              neogaiaConfig = self.nixosConfigurations.neogaia.config;
+              pikachuConfig = self.nixosConfigurations.pikachu.config;
+              neogaiaUser = neogaiaConfig.user.name;
+              neogaiaSsh = neogaiaConfig.home-manager.users.${neogaiaUser}.programs.ssh.settings;
+            in
+            pkgs.runCommand "ssh-targets-use-address-registry-check" { } ''
+              ${
+                lib.optionalString (
+                  !(
+                    neogaiaConfig.registry.address.neogaia.self == "10.23.50.146"
+                    && pikachuConfig.registry.address.pikachu.self == "10.23.10.102"
+                    && neogaiaConfig.modules.ssh.targets.pikachu.hostName == pikachuConfig.registry.address.pikachu.self
+                    && pikachuConfig.modules.ssh.targets.neogaia.hostName == neogaiaConfig.registry.address.neogaia.self
+                    && neogaiaSsh.pikachu.data.HostName == pikachuConfig.registry.address.pikachu.self
+                  )
+                ) "exit 1"
+              }
+              touch $out
+            '';
+
+          reverse-proxy-route-registry =
             let
               routeHost =
                 lib.nixosSystem {
@@ -455,7 +470,7 @@
                 }).config;
               vhosts = testConfig.services.nginx.virtualHosts;
             in
-            pkgs.runCommand "reverse-proxy-fleet-routes-check" { } ''
+            pkgs.runCommand "reverse-proxy-route-registry-check" { } ''
               ${
                 lib.optionalString (
                   !(

hosts/neogaia/default.nix

@@ -31,6 +31,8 @@
   # So wifi can be joined from the console.
   networking.networkmanager.enable = true;
 
+  registry.address.neogaia.self = "10.23.50.146";
+
   # So setup can be driven over the network.
   # The matching host public keys sit beside this file in plaintext, since
   # publishing them is their purpose.

hosts/pikachu/default.nix

@@ -72,6 +72,8 @@
     pools.pikachu = { };
   };
 
+  registry.address.pikachu.self = "10.23.10.102";
+
   modules.ssh.enable = true;
   modules.ssh.hostKeys.sopsFile = ../../secrets/pikachu.yaml;
   modules.ssh.userKey.sopsFile = ../../secrets/pikachu.yaml;

lib/default.nix

@@ -15,7 +15,6 @@ let
 
   serviceIdentityRegistry = import ./service-identities.nix { inherit lib; };
   registry = import ./registry.nix { inherit lib self; };
-  networkEndpoints = import ./network-endpoints.nix { inherit lib; };
 
   collectNixFiles =
     dir:
@@ -87,7 +86,6 @@ in
     mkHosts
     bridgeName
     registry
-    networkEndpoints
     ;
 
   inherit (guests) deriveMac guest;

lib/network-endpoints.nix

@@ -1,20 +0,0 @@
-{ lib }:
-# TODO: Remove this compatibility bridge when route backend resolution reads registry.address directly.
-let
-  endpointFields = address: { inherit address; };
-
-  collectFleetEndpoints = hosts:
-    lib.concatMapAttrs (
-      hostName: host:
-      lib.mapAttrs' (
-        entryName: address:
-        let
-          endpointName = if entryName == "self" then hostName else "${hostName}-${entryName}";
-        in
-        lib.nameValuePair endpointName (endpointFields address)
-      ) (host.config.registry.address.${hostName} or { })
-    ) hosts;
-in
-{
-  inherit collectFleetEndpoints endpointFields;
-}

modules/ssh.nix

@@ -1,6 +1,7 @@
 {
   config,
   lib,
+  registry,
   ...
 }:
 # SSH on this machine, in both directions.
@@ -189,7 +190,7 @@ in
         };
 
         neogaia = {
-          hostName = "10.23.50.146";
+          hostName = registry.address.neogaia.self;
           clientKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGxQ4kWsBo2OGYIPOkFe0vNEcB3yoJwAu0y9wrdQzALE alexion@neogaia";
           hostKeys = [
             "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJS+wp7K123+4BT6G4f954R6WyrbWveY7VlpoBUf6I5p neogaia"
@@ -198,7 +199,7 @@ in
         };
 
         pikachu = {
-          hostName = "10.23.10.102";
+          hostName = registry.address.pikachu.self;
           clientKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINNqJIC6VRXyvrNf3n9su9KdPCikC3CjK/QrCK2reHdB alexion@pikachu";
           hostKeys = [
             "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKljRf4pJO+pqEqjpPz08gOYq3g1PpxvE66xVw7uMEnA root@pikachu"