Merge pull request 'clanModules/mumble: prefer str instead of string' (#1939 ) from kenji/clan-core:mumble-str into main

clanModules/mumble: prefer str instead of string
Merge pull request 'Automatic flake update - nixos-images - 2024-08-20T14:47+02:00' (#1934 ) from flake-update-nixos-images-2024-08-20 into main
2024-08-20 13:22:24 +00:00 · 2024-08-20 15:15:19 +02:00 · 2024-08-20 13:00:08 +00:00 · 2024-08-20 13:00:08 +00:00 · 2024-08-20 12:59:55 +00:00 · 2024-08-20 12:59:55 +00:00
398 changed files with 18581 additions and 4656 deletions
--- a/.envrc
+++ b/.envrc
@ -1,11 +1,13 @@
+# shellcheck shell=bash
 if ! has nix_direnv_version || ! nix_direnv_version 3.0.4; then
  source_url "https://raw.githubusercontent.com/nix-community/nix-direnv/3.0.4/direnvrc" "sha256-DzlYZ33mWF/Gs8DDeyjr8mnVmQGx7ASYqA5WlxwvBG4="
 fi

 watch_file .direnv/selected-shell 
+watch_file formatter.nix

 if [ -e .direnv/selected-shell ]; then
-  use flake .#$(cat .direnv/selected-shell)
+  use flake ".#$(cat .direnv/selected-shell)"
 else
  use flake
 fi
--- a/.gitea/workflows/deploy.yaml
+++ b/.gitea/workflows/deploy.yaml
@ -1,6 +1,6 @@
 name: deploy
 on:
- push:
+  push:
    branches:
      - main
 jobs:
@ -10,4 +10,4 @@ jobs:
      - uses: actions/checkout@v3
      - run: nix run .#deploy-docs
    env:
-      SSH_HOMEPAGE_KEY: ${{ secrets.SSH_HOMEPAGE_KEY }}
+      SSH_HOMEPAGE_KEY: ${{ secrets.SSH_HOMEPAGE_KEY }}
--- a/.gitignore
+++ b/.gitignore
@ -1,4 +1,5 @@
 .direnv
+**/.nixos-test-history
 ***/.hypothesis
 out.log
 .coverage.*
@ -14,6 +15,7 @@ nixos.qcow2
 **/*.glade~
 /docs/out

+
 # dream2nix
 .dream2nix

--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@ -19,3 +19,5 @@ Run a local server:
 ```shell-session
 mkdocs serve
 ```
+
+Open http://localhost:8000/ in your browser.
--- a/checks/backups/flake-module.nix
+++ b/checks/backups/flake-module.nix
@ -27,7 +27,7 @@
          self.clanModules.localbackup
          self.clanModules.sshd
        ];
-        clan.networking.targetHost = "machine";
+        clan.core.networking.targetHost = "machine";
        networking.hostName = "machine";
        services.openssh.settings.UseDns = false;

--- a/checks/devshell/flake-module.nix
+++ b/checks/devshell/flake-module.nix
@ -0,0 +1,22 @@
+{ ... }:
+{
+  perSystem =
+    { self', pkgs, ... }:
+    {
+      checks.devshell =
+        pkgs.runCommand "check-devshell-not-depends-on-clan-cli"
+          {
+            exportReferencesGraph = [
+              "graph"
+              self'.devShells.default
+            ];
+          }
+          ''
+            if grep -q "${self'.packages.clan-cli}" ./graph; then
+              echo "devshell depends on clan-cli, which is not allowed";
+              exit 1;
+            fi
+            mkdir $out
+          '';
+    };
+}
--- a/checks/flake-module.nix
+++ b/checks/flake-module.nix
@ -1,10 +1,11 @@
 { self, ... }:
 {
  imports = [
-    ./impure/flake-module.nix
    ./backups/flake-module.nix
-    ./installation/flake-module.nix
+    ./devshell/flake-module.nix
    ./flash/flake-module.nix
+    ./impure/flake-module.nix
+    ./installation/flake-module.nix
  ];
  perSystem =
    {
@ -40,10 +41,11 @@
            secrets = import ./secrets nixosTestArgs;
            container = import ./container nixosTestArgs;
            deltachat = import ./deltachat nixosTestArgs;
-            matrix-synapse = import ./matrix-synapse nixosTestArgs;
-            zt-tcp-relay = import ./zt-tcp-relay nixosTestArgs;
            borgbackup = import ./borgbackup nixosTestArgs;
+            matrix-synapse = import ./matrix-synapse nixosTestArgs;
+            mumble = import ./mumble nixosTestArgs;
            syncthing = import ./syncthing nixosTestArgs;
+            zt-tcp-relay = import ./zt-tcp-relay nixosTestArgs;
            postgresql = import ./postgresql nixosTestArgs;
            wayland-proxy-virtwl = import ./wayland-proxy-virtwl nixosTestArgs;
          };
--- a/checks/impure/flake-module.nix
+++ b/checks/impure/flake-module.nix
@ -1,6 +1,11 @@
 {
  perSystem =
-    { pkgs, lib, ... }:
+    {
+      pkgs,
+      lib,
+      self',
+      ...
+    }:
    {
      # a script that executes all other checks
      packages.impure-checks = pkgs.writeShellScriptBin "impure-checks" ''
@ -10,14 +15,21 @@
        unset CLAN_DIR

        export PATH="${
-          lib.makeBinPath [
-            pkgs.gitMinimal
-            pkgs.nix
-            pkgs.rsync # needed to have rsync installed on the dummy ssh server
-          ]
+          lib.makeBinPath (
+            [
+              pkgs.gitMinimal
+              pkgs.nix
+              pkgs.rsync # needed to have rsync installed on the dummy ssh server
+            ]
+            ++ self'.packages.clan-cli-full.runtimeDependencies
+          )
        }"
        ROOT=$(git rev-parse --show-toplevel)
        cd "$ROOT/pkgs/clan-cli"
+
+        # this disables dynamic dependency loading in clan-cli
+        export CLAN_NO_DYNAMIC_DEPS=1
+
        nix develop "$ROOT#clan-cli" -c bash -c "TMPDIR=/tmp python -m pytest -s -m impure ./tests $@"
      '';
    };
--- a/checks/installation/flake-module.nix
+++ b/checks/installation/flake-module.nix
@ -1,7 +1,7 @@
 { self, lib, ... }:
 {
  clan.machines.test_install_machine = {
-    clan.networking.targetHost = "test_install_machine";
+    clan.core.networking.targetHost = "test_install_machine";
    fileSystems."/".device = lib.mkDefault "/dev/vdb";
    boot.loader.grub.device = lib.mkDefault "/dev/vdb";

--- a/checks/matrix-synapse/default.nix
+++ b/checks/matrix-synapse/default.nix
@ -22,7 +22,11 @@
              enableACME = lib.mkForce false;
              forceSSL = lib.mkForce false;
            };
-            clan.matrix-synapse.domain = "clan.test";
+            security.acme.defaults.email = "admin@clan.test";
+            clan.matrix-synapse.domain = {
+              server = "matrix.clan.test";
+              client = "element.clan.test";
+            };
            clan.matrix-synapse.users.admin.admin = true;
            clan.matrix-synapse.users.someuser = { };

--- a/checks/mumble/default.nix
+++ b/checks/mumble/default.nix
@ -0,0 +1,146 @@
+(import ../lib/test-base.nix) (
+  { ... }:
+  let
+    common =
+      { self, pkgs, ... }:
+      {
+        imports = [
+          self.clanModules.mumble
+          self.nixosModules.clanCore
+          (self.inputs.nixpkgs + "/nixos/tests/common/x11.nix")
+          {
+            clan.core.clanDir = ./.;
+            environment.systemPackages = [ pkgs.killall ];
+            services.murmur.sslKey = "/etc/mumble-key";
+            services.murmur.sslCert = "/etc/mumble-cert";
+            clan.core.facts.services.mumble.secret."mumble-key".path = "/etc/mumble-key";
+            clan.core.facts.services.mumble.public."mumble-cert".path = "/etc/mumble-cert";
+          }
+        ];
+
+      };
+  in
+  {
+    name = "mumble";
+
+    enableOCR = true;
+
+    nodes.peer1 =
+      { ... }:
+      {
+        imports = [
+          common
+          {
+            clan.core.machineName = "peer1";
+            environment.etc = {
+              "mumble-key".source = ./peer_1/peer_1_test_key;
+              "mumble-cert".source = ./peer_1/peer_1_test_cert;
+            };
+            systemd.tmpfiles.settings."vmsecrets" = {
+              "/etc/secrets/mumble-key" = {
+                C.argument = "${./peer_1/peer_1_test_key}";
+                z = {
+                  mode = "0400";
+                  user = "murmur";
+                };
+              };
+              "/etc/secrets/mumble-cert" = {
+                C.argument = "${./peer_1/peer_1_test_cert}";
+                z = {
+                  mode = "0400";
+                  user = "murmur";
+                };
+              };
+            };
+            services.murmur.sslKey = "/etc/mumble-key";
+            services.murmur.sslCert = "/etc/mumble-cert";
+            clan.core.facts.services.mumble.secret."mumble-key".path = "/etc/mumble-key";
+            clan.core.facts.services.mumble.public."mumble-cert".path = "/etc/mumble-cert";
+          }
+        ];
+      };
+    nodes.peer2 =
+      { ... }:
+      {
+        imports = [
+          common
+          {
+            clan.core.machineName = "peer2";
+            environment.etc = {
+              "mumble-key".source = ./peer_2/peer_2_test_key;
+              "mumble-cert".source = ./peer_2/peer_2_test_cert;
+            };
+            systemd.tmpfiles.settings."vmsecrets" = {
+              "/etc/secrets/mumble-key" = {
+                C.argument = "${./peer_2/peer_2_test_key}";
+                z = {
+                  mode = "0400";
+                  user = "murmur";
+                };
+              };
+              "/etc/secrets/mumble-cert" = {
+                C.argument = "${./peer_2/peer_2_test_cert}";
+                z = {
+                  mode = "0400";
+                  user = "murmur";
+                };
+              };
+            };
+          }
+        ];
+      };
+    testScript = ''
+      start_all()
+
+      with subtest("Waiting for x"):
+        peer1.wait_for_x()
+        peer2.wait_for_x()
+
+      with subtest("Waiting for murmur"):
+        peer1.wait_for_unit("murmur.service")
+        peer2.wait_for_unit("murmur.service")
+
+      with subtest("Starting Mumble"):
+        # starting mumble is blocking
+        peer1.execute("mumble >&2 &")
+        peer2.execute("mumble >&2 &")
+
+      with subtest("Wait for Mumble"):
+        peer1.wait_for_window(r"^Mumble$")
+        peer2.wait_for_window(r"^Mumble$")
+
+      with subtest("Wait for certificate creation"):
+        peer1.wait_for_window(r"^Mumble$")
+        peer1.sleep(3) # mumble is slow to register handlers
+        peer1.send_chars("\n") 
+        peer1.send_chars("\n") 
+        peer2.wait_for_window(r"^Mumble$")
+        peer2.sleep(3) # mumble is slow to register handlers
+        peer2.send_chars("\n") 
+        peer2.send_chars("\n") 
+
+      with subtest("Wait for server connect"):
+        peer1.wait_for_window(r"^Mumble Server Connect$")
+        peer2.wait_for_window(r"^Mumble Server Connect$")
+
+      with subtest("Check validity of server certificates"):
+        peer1.execute("killall .mumble-wrapped")
+        peer1.sleep(1)
+        peer1.execute("mumble mumble://peer2 >&2 &")
+        peer1.wait_for_window(r"^Mumble$")
+        peer1.sleep(3) # mumble is slow to register handlers
+        peer1.send_chars("\n") 
+        peer1.send_chars("\n") 
+        peer1.wait_for_text("Connected.")
+
+        peer2.execute("killall .mumble-wrapped")
+        peer2.sleep(1)
+        peer2.execute("mumble mumble://peer1 >&2 &")
+        peer2.wait_for_window(r"^Mumble$")
+        peer2.sleep(3) # mumble is slow to register handlers
+        peer2.send_chars("\n") 
+        peer2.send_chars("\n") 
+        peer2.wait_for_text("Connected.")
+    '';
+  }
+)
--- a/checks/mumble/machines/peer1/facts/mumble-cert
+++ b/checks/mumble/machines/peer1/facts/mumble-cert
@ -0,0 +1,22 @@
+-----BEGIN CERTIFICATE-----
+MIIDazCCAlOgAwIBAgIUCUjfNkF0CDhTKbO3nNczcsCW4qEwDQYJKoZIhvcNAQEL
+BQAwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoM
+GEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDAeFw0yNDA2MjcwOTM2NDZaFw0yNDA3
+MjcwOTM2NDZaMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEw
+HwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwggEiMA0GCSqGSIb3DQEB
+AQUAA4IBDwAwggEKAoIBAQDCcdZEJvXJIeOKO5pF5XUFvUeJtCCiwfWvWS662bxc
+R/5MZucRLqfTNYo9aBv4NITw5kxZsTaaubmS4zSGQoTEAVzqzVdi3a/gNvsdVLb+
+7CivpmweLllX/OGsTL0kHPEI+74AYiTBjXfdWV1Y5T1tuwc3G8ATrguQ33Uo5vvF
+vcqsbTKcRZC0pB9O/nn4q03GsRdvlpaKakIhjMpRG/uZ3u7wtbyZ+WqjsjxZNfnY
+aMyPoaipFqX1v+L7GKlOj2NpyEZFVVwa2ZqhVSYXyDfpAWQFznwKGzD5mjtcyKym
+gnv/5LwrpH4Xj+JMt48hN+rPnu5vfXT8Y4KnID30OQW7AgMBAAGjUzBRMB0GA1Ud
+DgQWBBQBBO8Wp975pAGioMjkaxANAVInfzAfBgNVHSMEGDAWgBQBBO8Wp975pAGi
+oMjkaxANAVInfzAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQAg
+F40MszTZXpR/A1z9B1CcXH47tNK67f8bCMR2dhvXODbpatwSihyxhQjtLb5R6kYH
+5Yq/B4yrh303j0CXaobCQ4nQH7zI7fhViww+TzW7vDhgM7ueEyyXrqCXt6JY8avg
+TuvIRtJSeWSQJ5aLNaYqmiwMf/tj9W3BMDpctGyLqu1WTSrbpYa9mA5Vudud70Yz
+DgZ/aqHilB07cVNqzVYZzRZ56WJlTjGzVevRgnHZqPiZNVrU13H6gtWa3r8aV4Gj
+i4F663eRAttj166cRgfl1QqpSG2IprNyV9UfuS2LlUaVNT3y0idawiJ4HhaA8pGB
+ZqMUUkA4DSucb6xxEcTK
+-----END CERTIFICATE-----
+
--- a/checks/mumble/machines/peer1/key.age
+++ b/checks/mumble/machines/peer1/key.age
@ -0,0 +1 @@
+AGE-SECRET-KEY-1UCXEUJH6JXF8LFKWFHDM4N9AQE2CCGQZGXLUNV4TKR5KY0KC8FDQ2TY4NX
--- a/checks/mumble/machines/peer1/peer_1_test_cert
+++ b/checks/mumble/machines/peer1/peer_1_test_cert
@ -0,0 +1,14 @@
+-----BEGIN CERTIFICATE-----
+MIICHTCCAaKgAwIBAgIIT2gZuvqVFP0wCgYIKoZIzj0EAwIwSjESMBAGA1UEChMJ
+U3luY3RoaW5nMSAwHgYDVQQLExdBdXRvbWF0aWNhbGx5IEdlbmVyYXRlZDESMBAG
+A1UEAxMJc3luY3RoaW5nMB4XDTIzMTIwNjAwMDAwMFoXDTQzMTIwMTAwMDAwMFow
+SjESMBAGA1UEChMJU3luY3RoaW5nMSAwHgYDVQQLExdBdXRvbWF0aWNhbGx5IEdl
+bmVyYXRlZDESMBAGA1UEAxMJc3luY3RoaW5nMHYwEAYHKoZIzj0CAQYFK4EEACID
+YgAEBAr1CsciwCa0vi7eC6xxuSGijY3txbjtsyFanec/fge4oJBD3rVpaLKFETb3
+TvHHsuvblzElcP483MEVq6FMUoxwuL9CzTtpJrRhtwSmAs8AHLFu8irVn8sZjgkL
+sXMho1UwUzAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsG
+AQUFBwMCMAwGA1UdEwEB/wQCMAAwFAYDVR0RBA0wC4IJc3luY3RoaW5nMAoGCCqG
+SM49BAMCA2kAMGYCMQDbrtLgfcyMMIkNQn+PJe9DHYAqj8C47LQcWuIY/nekhOu0
+aUfKctEAwyBtI60Y5zcCMQCEdgD/6CNBh7Qqq3z3CKPhlrpxHtCO5tNw17k0jfdH
+haCwJInHZvZgclHk4EtFpTw=
+-----END CERTIFICATE-----
--- a/checks/mumble/machines/peer1/peer_1_test_key
+++ b/checks/mumble/machines/peer1/peer_1_test_key
@ -0,0 +1,6 @@
+-----BEGIN EC PRIVATE KEY-----
+MIGkAgEBBDA14Nqo17Xs/xRLGH2KLuyzjKp4eW9iWFobVNM93RZZbECT++W3XcQc
+cEc5WVtiPmWgBwYFK4EEACKhZANiAAQECvUKxyLAJrS+Lt4LrHG5IaKNje3FuO2z
+IVqd5z9+B7igkEPetWlosoURNvdO8cey69uXMSVw/jzcwRWroUxSjHC4v0LNO2km
+tGG3BKYCzwAcsW7yKtWfyxmOCQuxcyE=
+-----END EC PRIVATE KEY-----
--- a/checks/mumble/machines/peer2/facts/mumble-cert
+++ b/checks/mumble/machines/peer2/facts/mumble-cert
@ -0,0 +1,22 @@
+-----BEGIN CERTIFICATE-----
+MIIDazCCAlOgAwIBAgIUfENbTtH5nr7giuawwQpDYqUpWJswDQYJKoZIhvcNAQEL
+BQAwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoM
+GEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDAeFw0yNDA2MjcwOTQxNDNaFw0yNDA3
+MjcwOTQxNDNaMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEw
+HwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwggEiMA0GCSqGSIb3DQEB
+AQUAA4IBDwAwggEKAoIBAQCfP6cZhCs9jOnWqyQP12vrOOxlBrWofYZFf9amUA24
+AfE7oGcSfkylanmkxzvGqQkhgLAvkHZj/GEvHujKyy8PgcEGP+pwmsfWNQMvU0Dz
+j3syjWOTi3eIC/3DoUnHlWCT2qCil/bjqxgU1l7fO/OXUlq5kyvIjln7Za4sUHun
+ixe/m96Er6l8a4Mh2pxh2C5pkLCvulkQhjjGG+R6MccH8wwQwmLg5oVBkFEZrnRE
+pnRKBI0DvA+wk1aJFAPOI4d8Q5T7o/MyxH3f8TYGHqbeMQFCKwusnlWPRtrNdaIc
+gaLvSpR0LVlroXGu8tYmRpvHPByoKGDbgVvO0Bwx8fmRAgMBAAGjUzBRMB0GA1Ud
+DgQWBBR7r+mQWNUZ0TpQNwrwjgxgngvOjTAfBgNVHSMEGDAWgBR7r+mQWNUZ0TpQ
+NwrwjgxgngvOjTAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQCO
+7B4s6uQEGE8jg3CQgy76oU/D8sazGcP8+/E4JLHSc0Nj49w4ztSpkOVk2HyEtzbm
+uR3TreIw+SfqpbiOI/ivVNDbEBsb/vEeq7qPzDH1Bi72plHZNRVhNGGV5rd7ibga
+TkfXHKPM9yt8ffffHHiu1ROvb8gg2B6JbQwboU4hvvmmorW7onyTFSYEzZVdNSpv
+pUtKPldxYjTnLlbsJdXC4xyCC4PrJt2CC0n0jsWfICJ77LMxIxTODh8oZNjbPg6r
+RdI7U/DsD+R072DjbIcrivvigotJM+jihzz5inZwbO8o0WQOHAbJLIG3C3BnRW3A
+Ek4u3+HXZMl5a0LGJ76u
+-----END CERTIFICATE-----
+
--- a/checks/mumble/machines/peer2/peer_2_test_cert
+++ b/checks/mumble/machines/peer2/peer_2_test_cert
@ -0,0 +1,14 @@
+-----BEGIN CERTIFICATE-----
+MIICHjCCAaOgAwIBAgIJAKbMWefkf1rVMAoGCCqGSM49BAMCMEoxEjAQBgNVBAoT
+CVN5bmN0aGluZzEgMB4GA1UECxMXQXV0b21hdGljYWxseSBHZW5lcmF0ZWQxEjAQ
+BgNVBAMTCXN5bmN0aGluZzAeFw0yMzEyMDYwMDAwMDBaFw00MzEyMDEwMDAwMDBa
+MEoxEjAQBgNVBAoTCVN5bmN0aGluZzEgMB4GA1UECxMXQXV0b21hdGljYWxseSBH
+ZW5lcmF0ZWQxEjAQBgNVBAMTCXN5bmN0aGluZzB2MBAGByqGSM49AgEGBSuBBAAi
+A2IABFZTMt4RfsfBue0va7QuNdjfXMI4HfZzJCEcG+b9MtV7FlDmwMKX5fgGykD9
+FBbC7yiza3+xCobdMb5bakz1qYJ7nUFCv1mwSDo2eNM+/XE+rJmlre8NwkwGmvzl
+h1uhyqNVMFMwDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggr
+BgEFBQcDAjAMBgNVHRMBAf8EAjAAMBQGA1UdEQQNMAuCCXN5bmN0aGluZzAKBggq
+hkjOPQQDAgNpADBmAjEAwzhsroN6R4/quWeXj6dO5gt5CfSTLkLee6vrcuIP5i1U
+rZvJ3OKQVmmGG6IWYe7iAjEAyuq3X2wznaqiw2YK3IDI4qVeYWpCUap0fwRNq7/x
+4dC4k+BOzHcuJOwNBIY/bEuK
+-----END CERTIFICATE-----
--- a/checks/mumble/machines/peer2/peer_2_test_key
+++ b/checks/mumble/machines/peer2/peer_2_test_key
@ -0,0 +1,6 @@
+-----BEGIN EC PRIVATE KEY-----
+MIGkAgEBBDCXHGpvumKjjDRxB6SsjZOb7duw3w+rdlGQCJTIvRThLjD6zwjnyImi
+7c3PD5nWtLqgBwYFK4EEACKhZANiAARWUzLeEX7HwbntL2u0LjXY31zCOB32cyQh
+HBvm/TLVexZQ5sDCl+X4BspA/RQWwu8os2t/sQqG3TG+W2pM9amCe51BQr9ZsEg6
+NnjTPv1xPqyZpa3vDcJMBpr85Ydboco=
+-----END EC PRIVATE KEY-----
--- a/checks/mumble/peer_1/key.age
+++ b/checks/mumble/peer_1/key.age
@ -0,0 +1 @@
+AGE-SECRET-KEY-1UCXEUJH6JXF8LFKWFHDM4N9AQE2CCGQZGXLUNV4TKR5KY0KC8FDQ2TY4NX
--- a/checks/mumble/peer_1/peer_1_test_cert
+++ b/checks/mumble/peer_1/peer_1_test_cert
@ -0,0 +1,22 @@
+-----BEGIN CERTIFICATE-----
+MIIDazCCAlOgAwIBAgIUCUjfNkF0CDhTKbO3nNczcsCW4qEwDQYJKoZIhvcNAQEL
+BQAwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoM
+GEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDAeFw0yNDA2MjcwOTM2NDZaFw0yNDA3
+MjcwOTM2NDZaMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEw
+HwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwggEiMA0GCSqGSIb3DQEB
+AQUAA4IBDwAwggEKAoIBAQDCcdZEJvXJIeOKO5pF5XUFvUeJtCCiwfWvWS662bxc
+R/5MZucRLqfTNYo9aBv4NITw5kxZsTaaubmS4zSGQoTEAVzqzVdi3a/gNvsdVLb+
+7CivpmweLllX/OGsTL0kHPEI+74AYiTBjXfdWV1Y5T1tuwc3G8ATrguQ33Uo5vvF
+vcqsbTKcRZC0pB9O/nn4q03GsRdvlpaKakIhjMpRG/uZ3u7wtbyZ+WqjsjxZNfnY
+aMyPoaipFqX1v+L7GKlOj2NpyEZFVVwa2ZqhVSYXyDfpAWQFznwKGzD5mjtcyKym
+gnv/5LwrpH4Xj+JMt48hN+rPnu5vfXT8Y4KnID30OQW7AgMBAAGjUzBRMB0GA1Ud
+DgQWBBQBBO8Wp975pAGioMjkaxANAVInfzAfBgNVHSMEGDAWgBQBBO8Wp975pAGi
+oMjkaxANAVInfzAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQAg
+F40MszTZXpR/A1z9B1CcXH47tNK67f8bCMR2dhvXODbpatwSihyxhQjtLb5R6kYH
+5Yq/B4yrh303j0CXaobCQ4nQH7zI7fhViww+TzW7vDhgM7ueEyyXrqCXt6JY8avg
+TuvIRtJSeWSQJ5aLNaYqmiwMf/tj9W3BMDpctGyLqu1WTSrbpYa9mA5Vudud70Yz
+DgZ/aqHilB07cVNqzVYZzRZ56WJlTjGzVevRgnHZqPiZNVrU13H6gtWa3r8aV4Gj
+i4F663eRAttj166cRgfl1QqpSG2IprNyV9UfuS2LlUaVNT3y0idawiJ4HhaA8pGB
+ZqMUUkA4DSucb6xxEcTK
+-----END CERTIFICATE-----
+
--- a/checks/mumble/peer_1/peer_1_test_key
+++ b/checks/mumble/peer_1/peer_1_test_key
@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDCcdZEJvXJIeOK
+O5pF5XUFvUeJtCCiwfWvWS662bxcR/5MZucRLqfTNYo9aBv4NITw5kxZsTaaubmS
+4zSGQoTEAVzqzVdi3a/gNvsdVLb+7CivpmweLllX/OGsTL0kHPEI+74AYiTBjXfd
+WV1Y5T1tuwc3G8ATrguQ33Uo5vvFvcqsbTKcRZC0pB9O/nn4q03GsRdvlpaKakIh
+jMpRG/uZ3u7wtbyZ+WqjsjxZNfnYaMyPoaipFqX1v+L7GKlOj2NpyEZFVVwa2Zqh
+VSYXyDfpAWQFznwKGzD5mjtcyKymgnv/5LwrpH4Xj+JMt48hN+rPnu5vfXT8Y4Kn
+ID30OQW7AgMBAAECggEAGVKn+/Iy+kG+l2cRvV6XseqnoWhjA69M5swviMgIfuAl
+Xx/boeI4mwoS+dJQKi/0zEbB1MB+gwIDB/0s/vs0vS4MQswBQG/skr+2TmiU+Hgb
+CF0dIYUZv5rAbScFTumx/mCCqxwc+1QIMzyLKqOYL203EFc92ZJGEVT4th321haZ
+8Wd+dllcYAb7BbEeBhCrTqRe9T3zt5reZgtZTquTF5hGm8EAyBp6rLjZK7dyZ9dd
+gyIsDbWgPC9vkRc6x/eANn70hgDbYOuoXwAP/qIFnWLL1Zzy8LKUyOsSgQ91S3S3
+Il4Lt6lEyU3+61MsCYss7jDoP/7REEjz5h6gfxlFSQKBgQD9u8nhHuwte4/d9VNU
+rhSBW9h8IJzwPif/eS8vh9VaS2SjR2dDCcHg6rGYKnexeEzUcx56aQMA+p3nRJwy
+Uwnx5BfEWs9FO6yPR8VEI0a2sBp+hoWKJX/Lvat+QCs6IFuGmlQpczD7/RYAkhG4
+mwyt/ymqzjukb9mFaeYIltOfPwKBgQDELnkH1ChTUH5u3HgDoelFbzR18okz6dxH
+urMbfZMAl8W5h2zAvHsAX5qxyHHankOUsiH2y3BrAgqQtTuIA2a5W7j+yHBkYiEZ
+EUNeI9YNA0KU+wwZpVVvRGUsRB5SUBo5LlcSYmX/V32f0oU5Np44i0vjl3Ju8esx
+2MLfj1A2hQKBgQDCxtZZZ0h8Pb8Z7wpSFfQNvXi5CLwQvFYuClQLk6VXVErkAJsn
+XiUjyGYeXnNVm/i2mcyKwXQZ20k90HBrPU2ED8mi5Ob5ya5Uqw6mmMHe2d7sw81d
+WB37RBWSrCXC0DYSZQQ4cYHn3sd2Fqtd4EBijV7qDLjCKU582OdKLqYzNwKBgH31
+UKQkJZgIkIThbPT4GewI0GgCRvFb76DmUGUQJTg2Oi86siq1WUwOFiabie5RuxZX
+oNLyH8W008/BbO2RMX1FVOvRCciJ8LJFkTl6TM6iDzfUUBqPOuFryoG3Yrh60btw
+81rMbqyZIgFhi0QGu2OWnC0Oadyt2tJwV/5t55R5AoGBAPspZttDmOzVkAJDSn9Z
+iByYt1KmwBQ6l7LpFg33a7ds9zWqW4+i6r0PzXvSewf/z69L0cAywSk5CaJJjDso
+dTlNMqwux01wd6V+nQGR871xnsOg+qzgJ565TJZelWgRmNRUooi4DMp5POJA33xp
+rqAISUfW0w2S+q7/5Lm0QiJE
+-----END PRIVATE KEY-----
--- a/checks/mumble/peer_2/peer_2_test_cert
+++ b/checks/mumble/peer_2/peer_2_test_cert
@ -0,0 +1,22 @@
+-----BEGIN CERTIFICATE-----
+MIIDazCCAlOgAwIBAgIUfENbTtH5nr7giuawwQpDYqUpWJswDQYJKoZIhvcNAQEL
+BQAwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoM
+GEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDAeFw0yNDA2MjcwOTQxNDNaFw0yNDA3
+MjcwOTQxNDNaMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEw
+HwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwggEiMA0GCSqGSIb3DQEB
+AQUAA4IBDwAwggEKAoIBAQCfP6cZhCs9jOnWqyQP12vrOOxlBrWofYZFf9amUA24
+AfE7oGcSfkylanmkxzvGqQkhgLAvkHZj/GEvHujKyy8PgcEGP+pwmsfWNQMvU0Dz
+j3syjWOTi3eIC/3DoUnHlWCT2qCil/bjqxgU1l7fO/OXUlq5kyvIjln7Za4sUHun
+ixe/m96Er6l8a4Mh2pxh2C5pkLCvulkQhjjGG+R6MccH8wwQwmLg5oVBkFEZrnRE
+pnRKBI0DvA+wk1aJFAPOI4d8Q5T7o/MyxH3f8TYGHqbeMQFCKwusnlWPRtrNdaIc
+gaLvSpR0LVlroXGu8tYmRpvHPByoKGDbgVvO0Bwx8fmRAgMBAAGjUzBRMB0GA1Ud
+DgQWBBR7r+mQWNUZ0TpQNwrwjgxgngvOjTAfBgNVHSMEGDAWgBR7r+mQWNUZ0TpQ
+NwrwjgxgngvOjTAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQCO
+7B4s6uQEGE8jg3CQgy76oU/D8sazGcP8+/E4JLHSc0Nj49w4ztSpkOVk2HyEtzbm
+uR3TreIw+SfqpbiOI/ivVNDbEBsb/vEeq7qPzDH1Bi72plHZNRVhNGGV5rd7ibga
+TkfXHKPM9yt8ffffHHiu1ROvb8gg2B6JbQwboU4hvvmmorW7onyTFSYEzZVdNSpv
+pUtKPldxYjTnLlbsJdXC4xyCC4PrJt2CC0n0jsWfICJ77LMxIxTODh8oZNjbPg6r
+RdI7U/DsD+R072DjbIcrivvigotJM+jihzz5inZwbO8o0WQOHAbJLIG3C3BnRW3A
+Ek4u3+HXZMl5a0LGJ76u
+-----END CERTIFICATE-----
+
--- a/checks/mumble/peer_2/peer_2_test_key
+++ b/checks/mumble/peer_2/peer_2_test_key
@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCfP6cZhCs9jOnW
+qyQP12vrOOxlBrWofYZFf9amUA24AfE7oGcSfkylanmkxzvGqQkhgLAvkHZj/GEv
+HujKyy8PgcEGP+pwmsfWNQMvU0Dzj3syjWOTi3eIC/3DoUnHlWCT2qCil/bjqxgU
+1l7fO/OXUlq5kyvIjln7Za4sUHunixe/m96Er6l8a4Mh2pxh2C5pkLCvulkQhjjG
+G+R6MccH8wwQwmLg5oVBkFEZrnREpnRKBI0DvA+wk1aJFAPOI4d8Q5T7o/MyxH3f
+8TYGHqbeMQFCKwusnlWPRtrNdaIcgaLvSpR0LVlroXGu8tYmRpvHPByoKGDbgVvO
+0Bwx8fmRAgMBAAECggEACAkjOnNj5zA0IIP0RuRc6rqtmw9ynTTwUJN51lyVxKI8
+dQDMEq/S2En+J2VyS7z92/XtbgkBIFx83u7VWl5UWpj2j4UsJFB7IwD7zyiJT4D+
+3cM/kX8Wx4XyQZbfbm47N0MXAgFCkn45hxHH0acLReXwmN9wxoDyl7AIjZRdwvG
+Qq0rnOnIc8kkkew7L6AiFwQS8b77eyzua3d6moKXN9hU/kfiJ6YUFG/WLe0pmQA1
+HbF27YghfeLnYUt50oDuX6jF6CzQhflchWVq/wn8/cxEpg/RMicWE8ulrTk7o27l
+JwCrHrhYEBsPuZO4mxX/DHrAMmhTeFjLaV5bQlz0PQKBgQDgRPSOEixYnKz9iPs/
+EDTlji5LA3Rm6TytRCNsjYY6Trw60KcvYqwyDUCiEjruvOQ9mqgBiQm1VHSalrG3
+RcbVfpEMouyZbEwmTjS8KdOi5x4Z6AX+4yWDN31jX3b8sktgbxV/HRdg3sA3q7MJ
+vExTUuoXg57W+FepIZ+XlhSoQwKBgQC1x6UMAlAeW45/yUUm/LFRcCgb/bdCQx+e
+hSb8w3jdvVoNWgx1j7RsjjFKaZUnseK3qQvVfCm4Qjvlz6MpKDxslaUYuR162Ku0
+e153z/xc7XRoXyPyPLdGZFlWii30jirB7ZqPdyz6mwlWwqdImNerbUqdFt9R8bId
+pYsyHB5zmwKBgBjYCq9iW/9E+/TqI8sMpI95fK9app5v4AThs3rnAqOa7Ucmrh6V
+s7Wnui06D8U6r54Tb+EbqTOpM3Gcl/tRg4FLEA5yTfuA/76Ok1D04Tj+mVsNVPyz
+dQhgMUe835WGusroA12df2V/x5NjNeYyMdJZMQ2ByyrNQAjAbMmCGq+5AoGBAIj8
+ERFysMOfxUvg9b7CkDFJrsAhOzew86P2vYGfIHchGTqUkG0LRTDFGrnzxNXsBGjY
+DUB40Kajx7IkTETxC0jvA1ceq23l/VjPrZVQt0YiC+a+rCyNn7SYkyHxsfTVr9b
+ea0BZyDXMntyJrPbkjL6Ik8tDE9pLwuOU84ISJ5fAoGAZ2+Ams/VhdZj/wpRpMky
+K4jtS4nzbCmJzzTa6vdVV7Kjer5kFxSFFqMrS/FtJ/RxHeHvxdze9dfGu9jIdTKK
+vSzbyQdHFfZgRkmAKfcoN9u567z7Oc74AQ9UgFEGdEVFQUbfWOevmr8KIPt8nDQK
+J9HuVfILi1kH0jzDd/64TvA=
+-----END PRIVATE KEY-----
--- a/checks/secrets/sops/machines/machine/key.json
+++ b/checks/secrets/sops/machines/machine/key.json
@ -1,4 +1,4 @@
 {
  "publickey": "age15x8u838dwqflr3t6csf4tlghxm4tx77y379ncqxav7y2n8qp7yzqgrwt00",
  "type": "age"
-}
+}
--- a/checks/secrets/sops/users/admin/key.json
+++ b/checks/secrets/sops/users/admin/key.json
@ -1,4 +1,4 @@
 {
  "publickey": "age15x8u838dwqflr3t6csf4tlghxm4tx77y379ncqxav7y2n8qp7yzqgrwt00",
  "type": "age"
-}
+}
--- a/clanModules/borgbackup/default.nix
+++ b/clanModules/borgbackup/default.nix
@ -106,6 +106,16 @@ in
    '';
  };

+  options.clan.borgbackup.exclude = lib.mkOption {
+    type = lib.types.listOf lib.types.str;
+    example = [ "*.pyc" ];
+    default = [ ];
+    description = ''
+      Directories/Files to exclude from the backup.
+      Use * as a wildcard.
+    '';
+  };
+
  imports = [
    (lib.mkRemovedOptionModule [
      "clan"
@ -129,7 +139,7 @@ in
      paths = lib.unique (
        lib.flatten (map (state: state.folders) (lib.attrValues config.clan.core.state))
      );
-      exclude = [ "*.pyc" ];
+      exclude = cfg.exclude;
      repo = dest.repo;
      environment.BORG_RSH = dest.rsh;
      compression = "auto,zstd";
--- a/clanModules/borgbackup/roles/server.nix
+++ b/clanModules/borgbackup/roles/server.nix
@ -28,7 +28,13 @@ in
        let
          fullPath = borgbackupIpMachinePath machine;
        in
-        if builtins.pathExists fullPath then machine else null
+        if builtins.pathExists fullPath then
+          machine
+        else
+          lib.warn ''
+            Machine ${machine} does not have a borgbackup key at ${fullPath},
+            run `clan facts generate ${machine}` to generate it.
+          '' null
      ) allClients;

      machinesWithKey = lib.filter (x: x != null) machinesMaybeKey;
--- a/clanModules/dyndns/README.md
+++ b/clanModules/dyndns/README.md
@ -0,0 +1,6 @@
+---
+description = "A dynamic DNS service to update domain IPs"
+---
+
+
+
--- a/clanModules/dyndns/default.nix
+++ b/clanModules/dyndns/default.nix
@ -0,0 +1,260 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+
+let
+  name = "dyndns";
+  cfg = config.clan.${name};
+
+  # We dedup secrets if they have the same provider + base domain
+  secret_id = opt: "${name}-${opt.provider}-${opt.domain}";
+  secret_path =
+    opt: config.clan.core.facts.services."${secret_id opt}".secret."${secret_id opt}".path;
+
+  # We check that a secret has not been set in extraSettings.
+  extraSettingsSafe =
+    opt:
+    if (builtins.hasAttr opt.secret_field_name opt.extraSettings) then
+      throw "Please do not set ${opt.secret_field_name} in extraSettings, it is automatically set by the dyndns module."
+    else
+      opt.extraSettings;
+  /*
+    We go from:
+    {home.example.com:{value:{domain:example.com,host:home, provider:namecheap}}}
+    To:
+    {settings: [{domain: example.com, host: home, provider: namecheap, password: dyndns-namecheap-example.com}]}
+  */
+  service_config = {
+    settings = builtins.catAttrs "value" (
+      builtins.attrValues (
+        lib.mapAttrs (_: opt: {
+          value =
+            (extraSettingsSafe opt)
+            // {
+              domain = opt.domain;
+              provider = opt.provider;
+            }
+            // {
+              "${opt.secret_field_name}" = secret_id opt;
+            };
+        }) cfg.settings
+      )
+    );
+  };
+
+  secret_generator = _: opt: {
+    name = secret_id opt;
+    value = {
+      secret.${secret_id opt} = { };
+      generator.prompt = "Dyndns passphrase for ${secret_id opt}";
+      generator.script = ''
+        echo "$prompt_value" > $secrets/${secret_id opt}
+      '';
+    };
+  };
+in
+{
+  options.clan.${name} = {
+
+    user = lib.mkOption {
+      type = lib.types.str;
+      default = name;
+      description = "User to run the service as";
+    };
+    group = lib.mkOption {
+      type = lib.types.str;
+      default = name;
+      description = "Group to run the service as";
+    };
+
+    server = {
+      enable = lib.mkEnableOption "dyndns webserver";
+      domain = lib.mkOption {
+        type = lib.types.str;
+        description = "Domain to serve the webservice on";
+      };
+      port = lib.mkOption {
+        type = lib.types.int;
+        default = 54805;
+        description = "Port to listen on";
+      };
+    };
+
+    period = lib.mkOption {
+      type = lib.types.int;
+      default = 5;
+      description = "Domain update period in minutes";
+    };
+
+    settings = lib.mkOption {
+      type = lib.types.attrsOf (
+        lib.types.submodule (
+          { ... }:
+          {
+            options = {
+              provider = lib.mkOption {
+                example = "namecheap";
+                type = lib.types.str;
+                description = "The dyndns provider to use";
+              };
+              domain = lib.mkOption {
+                type = lib.types.str;
+                example = "example.com";
+                description = "The top level domain to update.";
+              };
+              secret_field_name = lib.mkOption {
+                example = [
+                  "password"
+                  "api_key"
+                ];
+                type = lib.types.enum [
+                  "password"
+                  "token"
+                  "api_key"
+                ];
+                default = "password";
+                description = "The field name for the secret";
+              };
+              # TODO: Ideally we would create a gigantic list of all possible settings / types
+              # optimally we would have a way to generate the options from the source code
+              extraSettings = lib.mkOption {
+                type = lib.types.attrsOf lib.types.str;
+                default = { };
+                description = ''
+                  Extra settings for the provider.
+                  Provider specific settings: https://github.com/qdm12/ddns-updater#configuration
+                '';
+              };
+            };
+          }
+        )
+      );
+      default = [ ];
+      description = "Configuration for which domains to update";
+    };
+  };
+
+  imports = [
+    (lib.mkRemovedOptionModule [
+      "clan"
+      "dyndns"
+      "enable"
+    ] "Just define clan.dyndns.settings to enable it")
+    ../nginx
+  ];
+
+  config = lib.mkMerge [
+    (lib.mkIf (cfg.settings != { }) {
+      clan.core.facts.services = lib.mapAttrs' secret_generator cfg.settings;
+
+      users.groups.${cfg.group} = { };
+      users.users.${cfg.user} = {
+        group = cfg.group;
+        isSystemUser = true;
+        description = "User for ${name} service";
+        home = "/var/lib/${name}";
+        createHome = true;
+      };
+
+      services.nginx = lib.mkIf cfg.server.enable {
+        enable = true;
+        virtualHosts = {
+          "${cfg.server.domain}" = {
+            forceSSL = true;
+            enableACME = true;
+            locations."/" = {
+              proxyPass = "http://localhost:${toString cfg.server.port}";
+            };
+          };
+        };
+      };
+
+      systemd.services.${name} = {
+        path = [ ];
+        description = "Dynamic DNS updater";
+        after = [ "network.target" ];
+        wantedBy = [ "multi-user.target" ];
+        environment = {
+          MYCONFIG = "${builtins.toJSON service_config}";
+          SERVER_ENABLED = if cfg.server.enable then "yes" else "no";
+          PERIOD = "${toString cfg.period}m";
+          LISTENING_ADDRESS = ":${toString cfg.server.port}";
+        };
+
+        serviceConfig =
+          let
+            pyscript = pkgs.writers.writePyPy3Bin "test.py" { libraries = [ ]; } ''
+              import json
+              from pathlib import Path
+              import os
+
+              cred_dir = Path(os.getenv("CREDENTIALS_DIRECTORY"))
+              config_str = os.getenv("MYCONFIG")
+
+
+              def get_credential(name):
+                  secret_p = cred_dir / name
+                  with open(secret_p, 'r') as f:
+                      return f.read().strip()
+
+
+              config = json.loads(config_str)
+              print(f"Config: {config}")
+              for attrset in config["settings"]:
+                  if "password" in attrset:
+                      attrset['password'] = get_credential(attrset['password'])
+                  elif "token" in attrset:
+                      attrset['token'] = get_credential(attrset['token'])
+                  elif "api_key" in attrset:
+                      attrset['api_key'] = get_credential(attrset['api_key'])
+                  else:
+                      raise ValueError(f"Missing secret field in {attrset}")
+
+              # create directory data if it does not exist
+              data_dir = Path('data')
+              data_dir.mkdir(mode=0o770, exist_ok=True)
+
+              # Write the config with secrets back
+              config_path = data_dir / 'config.json'
+              with open(config_path, 'w') as f:
+                  f.write(json.dumps(config, indent=4))
+
+              # Set file permissions to read and write
+              # only by the user and group
+              config_path.chmod(0o660)
+
+              # Set file permissions to read
+              # and write only by the user and group
+              for file in data_dir.iterdir():
+                  file.chmod(0o660)
+            '';
+          in
+          {
+            ExecStartPre = lib.getExe pyscript;
+            ExecStart = lib.getExe pkgs.ddns-updater;
+            LoadCredential = lib.mapAttrsToList (_: opt: "${secret_id opt}:${secret_path opt}") cfg.settings;
+            User = cfg.user;
+            Group = cfg.group;
+            NoNewPrivileges = true;
+            PrivateTmp = true;
+            ProtectSystem = "strict";
+            ReadOnlyPaths = "/";
+            PrivateDevices = "yes";
+            ProtectKernelModules = "yes";
+            ProtectKernelTunables = "yes";
+            WorkingDirectory = "/var/lib/${name}";
+            ReadWritePaths = [
+              "/proc/self"
+              "/var/lib/${name}"
+            ];
+
+            Restart = "always";
+            RestartSec = 60;
+          };
+      };
+    })
+  ];
+}
--- a/clanModules/flake-module.nix
+++ b/clanModules/flake-module.nix
@ -4,23 +4,30 @@
    borgbackup = ./borgbackup;
    borgbackup-static = ./borgbackup-static;
    deltachat = ./deltachat;
+    dyndns = ./dyndns;
    ergochat = ./ergochat;
+    garage = ./garage;
+    golem-provider = ./golem-provider;
+    iwd = ./iwd;
    localbackup = ./localbackup;
    localsend = ./localsend;
-    single-disk = ./single-disk;
    matrix-synapse = ./matrix-synapse;
    moonlight = ./moonlight;
+    mumble = ./mumble;
    packages = ./packages;
+    nginx = ./nginx;
    postgresql = ./postgresql;
    root-password = ./root-password;
+    single-disk = ./single-disk;
    sshd = ./sshd;
-    sunshine = ./sunshine;
    static-hosts = ./static-hosts;
+    sunshine = ./sunshine;
    syncthing = ./syncthing;
    syncthing-static-peers = ./syncthing-static-peers;
    thelounge = ./thelounge;
    trusted-nix-caches = ./trusted-nix-caches;
    user-password = ./user-password;
+    vaultwarden = ./vaultwarden;
    xfce = ./xfce;
    zerotier-static-peers = ./zerotier-static-peers;
    zt-tcp-relay = ./zt-tcp-relay;
--- a/clanModules/garage/README.md
+++ b/clanModules/garage/README.md
@ -0,0 +1,10 @@
+---
+description = "S3-compatible object store for small self-hosted geo-distributed deployments"
+---
+
+This module generates garage specific keys automatically.
+When using garage in a distributed deployment the `rpc_key` between connected instances must be shared.
+This is currently still a manual process.
+
+Options: [NixosModuleOptions](https://search.nixos.org/options?channel=unstable&size=50&sort=relevance&type=packages&query=garage)
+Documentation: https://garagehq.deuxfleurs.fr/
--- a/clanModules/garage/default.nix
+++ b/clanModules/garage/default.nix
@ -0,0 +1,33 @@
+{ config, pkgs, ... }:
+{
+  systemd.services.garage.serviceConfig = {
+    LoadCredential = [
+      "rpc_secret_path:${config.clan.core.vars.generators.garage.files.rpc_secret.path}"
+      "admin_token_path:${config.clan.core.vars.generators.garage.files.admin_token.path}"
+      "metrics_token_path:${config.clan.core.vars.generators.garage.files.metrics_token.path}"
+    ];
+    Environment = [
+      "GARAGE_ALLOW_WORLD_READABLE_SECRETS=true"
+      "GARAGE_RPC_SECRET_FILE=%d/rpc_secret_path"
+      "GARAGE_ADMIN_TOKEN_FILE=%d/admin_token_path"
+      "GARAGE_METRICS_TOKEN_FILE=%d/metrics_token_path"
+    ];
+  };
+
+  clan.core.vars.generators.garage = {
+    files.rpc_secret = { };
+    files.admin_token = { };
+    files.metrics_token = { };
+    runtimeInputs = [
+      pkgs.coreutils
+      pkgs.openssl
+    ];
+    script = ''
+      openssl rand -hex -out $out/rpc_secret 32
+      openssl rand -base64 -out $out/admin_token 32
+      openssl rand -base64 -out $out/metrics_token 32
+    '';
+  };
+
+  clan.core.state.garage.folders = [ config.services.garage.settings.metadata_dir ];
+}
--- a/clanModules/golem-provider/README.md
+++ b/clanModules/golem-provider/README.md
@ -0,0 +1,7 @@
+---
+description = "Golem Provider for the Golem Network, an open-source and decentralized platform where everyone can use and share each other's computing power without relying on centralized entities like cloud computing corporations"
+---
+
+By running a golem provider your machine's compute resources are offered via the golem network which will allow other members to execute compute tasks on your machine. If this happens, you will be compensated with GLM, an ERC20 token.
+
+More about golem providers: https://docs.golem.network/docs/golem/overview
--- a/clanModules/golem-provider/default.nix
+++ b/clanModules/golem-provider/default.nix
@ -0,0 +1,34 @@
+{ config, pkgs, ... }:
+let
+  cfg = config.clan.golem-provider;
+  yagna = pkgs.callPackage ../../pkgs/yagna { };
+  accountFlag = if cfg.account != null then "--account ${cfg.account}" else "";
+in
+{
+  imports = [ ./interface.nix ];
+
+  users.users.golem = {
+    isSystemUser = true;
+    home = "/var/lib/golem";
+    group = "golem";
+    createHome = true;
+  };
+
+  users.groups.golem = { };
+
+  environment.systemPackages = [ yagna ];
+
+  systemd.services.golem-provider = {
+    description = "Golem Provider";
+    wantedBy = [ "multi-user.target" ];
+    after = [ "network-online.target" ];
+    serviceConfig = {
+      Type = "simple";
+      ExecStart = "${yagna}/bin/golemsp run --no-interactive ${accountFlag}";
+      Restart = "always";
+      RestartSec = "5";
+      User = "golem";
+      Group = "golem";
+    };
+  };
+}
--- a/clanModules/golem-provider/interface.nix
+++ b/clanModules/golem-provider/interface.nix
@ -0,0 +1,20 @@
+{ lib, ... }:
+let
+  inherit (lib) mkOption;
+
+  inherit (lib.types) nullOr str;
+
+in
+{
+  options.clan.golem-provider = {
+    account = mkOption {
+      type = nullOr str;
+      description = ''
+        Ethereum address for payouts.
+
+        Leave empty to automatically generate a new address upon first start.
+      '';
+      default = null;
+    };
+  };
+}
--- a/clanModules/golem-provider/test/vm.nix
+++ b/clanModules/golem-provider/test/vm.nix
@ -0,0 +1,4 @@
+{ ... }:
+{
+  imports = [ ../. ];
+}
--- a/clanModules/iwd/README.md
+++ b/clanModules/iwd/README.md
@ -0,0 +1,6 @@
+---
+description = "Automatically provisions wifi credentials"
+---
+
+
+
--- a/clanModules/iwd/default.nix
+++ b/clanModules/iwd/default.nix
@ -0,0 +1,83 @@
+{ lib, config, ... }:
+
+let
+  cfg = config.clan.iwd;
+  secret_path = ssid: config.clan.core.facts.services."iwd.${ssid}".secret."iwd.${ssid}".path;
+  secret_generator = name: value: {
+    name = "iwd.${value.ssid}";
+    value =
+      let
+        secret_name = "iwd.${value.ssid}";
+      in
+      {
+        secret.${secret_name} = { };
+        generator.prompt = "Wifi password for '${value.ssid}'";
+        generator.script = ''
+          config="
+          [Security]
+            Passphrase=$prompt_value
+          "
+          echo "$config" > $secrets/${secret_name}
+        '';
+      };
+  };
+in
+{
+  options.clan.iwd = {
+    networks = lib.mkOption {
+      type = lib.types.attrsOf (
+        lib.types.submodule (
+          { name, ... }:
+          {
+            options = {
+              ssid = lib.mkOption {
+                type = lib.types.strMatching "^[a-zA-Z0-9._-]+$";
+                default = name;
+                description = "The name of the wifi network";
+              };
+            };
+          }
+        )
+      );
+      default = { };
+      description = "Wifi networks to predefine";
+    };
+  };
+
+  imports = [
+    (lib.mkRemovedOptionModule [
+      "clan"
+      "iwd"
+      "enable"
+    ] "Just define clan.iwd.networks to enable it")
+  ];
+
+  config = lib.mkMerge [
+    (lib.mkIf (cfg.networks != { }) {
+      # Systemd tmpfiles rule to create /var/lib/iwd/example.psk file
+      systemd.tmpfiles.rules = lib.mapAttrsToList (
+        _: value: "C /var/lib/iwd/${value.ssid}.psk 0600 root root - ${secret_path value.ssid}"
+      ) cfg.networks;
+
+      clan.core.facts.services = lib.mapAttrs' secret_generator cfg.networks;
+
+      # TODO: restart the iwd.service if something changes
+    })
+    {
+      # disable wpa supplicant
+      networking.wireless.enable = false;
+
+      # Use iwd instead of wpa_supplicant. It has a user friendly CLI
+      networking.wireless.iwd = {
+        enable = true;
+        settings = {
+          Network = {
+            EnableIPv6 = true;
+            RoutePriorityOffset = 300;
+          };
+          Settings.AutoConnect = true;
+        };
+      };
+    }
+  ];
+}
--- a/clanModules/matrix-synapse/0001-register_new_matrix_user-add-password-file-flag.patch
+++ b/clanModules/matrix-synapse/0001-register_new_matrix_user-add-password-file-flag.patch
@ -1,100 +0,0 @@
-From bc199a27f23b0fcf175b116f7cf606c0d22b422a Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
-Date: Tue, 11 Jun 2024 11:40:47 +0200
-Subject: [PATCH 1/2] register_new_matrix_user: add password-file flag
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-getpass in python expects stdin to be a tty, hence we cannot just pipe
-into register_new_matrix_user. --password-file instead works better and
-it would also allow the use of stdin if /dev/stdin is passed.
-
-Co-authored-by: Andrew Morgan <1342360+anoadragon453@users.noreply.github.com>
-Signed-off-by: Jörg Thalheim <joerg@thalheim.io>
---
- changelog.d/17294.feature                    |  2 ++
- debian/register_new_matrix_user.ronn         |  9 +++++++--
- synapse/_scripts/register_new_matrix_user.py | 20 +++++++++++++++-----
- 3 files changed, 24 insertions(+), 7 deletions(-)
- create mode 100644 changelog.d/17294.feature
-
-diff --git a/changelog.d/17294.feature b/changelog.d/17294.feature
-new file mode 100644
-index 000000000..33aac7b0b
--- /dev/null
-+++ b/changelog.d/17294.feature
-@@ -0,0 +1,2 @@
-+`register_new_matrix_user` now supports a --password-file flag, which
-+is useful for scripting.
-diff --git a/debian/register_new_matrix_user.ronn b/debian/register_new_matrix_user.ronn
-index 0410b1f4c..d99e9215a 100644
--- a/debian/register_new_matrix_user.ronn
-+++ b/debian/register_new_matrix_user.ronn
-@@ -31,8 +31,13 @@ A sample YAML file accepted by `register_new_matrix_user` is described below:
-     Local part of the new user. Will prompt if omitted.
- 
-   * `-p`, `--password`:
-    New password for user. Will prompt if omitted. Supplying the password
-    on the command line is not recommended. Use the STDIN instead.
-+    New password for user. Will prompt if this option and `--password-file` are omitted.
-+    Supplying the password on the command line is not recommended.
-+    Use `--password-file` if possible.
-+
-+  * `--password-file`:
-+    File containing the new password for user. If set, overrides `--password`.
-+    This is a more secure alternative to specifying the password on the command line.
- 
-   * `-a`, `--admin`:
-     Register new user as an admin. Will prompt if omitted.
-diff --git a/synapse/_scripts/register_new_matrix_user.py b/synapse/_scripts/register_new_matrix_user.py
-index 77a7129ee..972b35e2d 100644
--- a/synapse/_scripts/register_new_matrix_user.py
-+++ b/synapse/_scripts/register_new_matrix_user.py
-@@ -173,11 +173,18 @@ def main() -> None:
-         default=None,
-         help="Local part of the new user. Will prompt if omitted.",
-     )
-    parser.add_argument(
-+    password_group = parser.add_mutually_exclusive_group()
-+    password_group.add_argument(
-         "-p",
-         "--password",
-         default=None,
-        help="New password for user. Will prompt if omitted.",
-+        help="New password for user. Will prompt for a password if "
-+        "this flag and `--password-file` are both omitted.",
-+    )
-+    password_group.add_argument(
-+        "--password-file",
-+        default=None,
-+        help="File containing the new password for user. If set, will override `--password`.",
-     )
-     parser.add_argument(
-         "-t",
-@@ -247,6 +254,11 @@ def main() -> None:
-             print(_NO_SHARED_SECRET_OPTS_ERROR, file=sys.stderr)
-             sys.exit(1)
- 
-+    if args.password_file:
-+        password = _read_file(args.password_file, "password-file").strip()
-+    else:
-+        password = args.password
-+
-     if args.server_url:
-         server_url = args.server_url
-     elif config is not None:
-@@ -269,9 +281,7 @@ def main() -> None:
-     if args.admin or args.no_admin:
-         admin = args.admin
- 
-    register_new_user(
-        args.user, args.password, server_url, secret, admin, args.user_type
-    )
-+    register_new_user(args.user, password, server_url, secret, admin, args.user_type)
- 
- 
- def _read_file(file_path: Any, config_path: str) -> str:
-- 
-2.44.1
-
--- a/clanModules/matrix-synapse/0002-register-new-matrix-user-add-a-flag-to-ignore-alread.patch
+++ b/clanModules/matrix-synapse/0002-register-new-matrix-user-add-a-flag-to-ignore-alread.patch
@ -1,94 +0,0 @@
-From 1789416df425d22693b0055a6688d8686e0ee4a1 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
-Date: Thu, 13 Jun 2024 14:38:19 +0200
-Subject: [PATCH 2/2] register-new-matrix-user: add a flag to ignore already
- existing users
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-This allows to register users in a more declarative and stateless way.
-
-Signed-off-by: Jörg Thalheim <joerg@thalheim.io>
---
- synapse/_scripts/register_new_matrix_user.py | 22 ++++++++++++++++++--
- 1 file changed, 20 insertions(+), 2 deletions(-)
-
-diff --git a/synapse/_scripts/register_new_matrix_user.py b/synapse/_scripts/register_new_matrix_user.py
-index 972b35e2d..233e7267d 100644
--- a/synapse/_scripts/register_new_matrix_user.py
-+++ b/synapse/_scripts/register_new_matrix_user.py
-@@ -52,6 +52,7 @@ def request_registration(
-     user_type: Optional[str] = None,
-     _print: Callable[[str], None] = print,
-     exit: Callable[[int], None] = sys.exit,
-+    exists_ok: bool = False,
- ) -> None:
-     url = "%s/_synapse/admin/v1/register" % (server_location.rstrip("/"),)
- 
-@@ -97,6 +98,10 @@ def request_registration(
-     r = requests.post(url, json=data)
- 
-     if r.status_code != 200:
-+        response = r.json()
-+        if exists_ok and response["errcode"] == "M_USER_IN_USE":
-+            _print("User already exists. Skipping.")
-+            return
-         _print("ERROR! Received %d %s" % (r.status_code, r.reason))
-         if 400 <= r.status_code < 500:
-             try:
-@@ -115,6 +120,7 @@ def register_new_user(
-     shared_secret: str,
-     admin: Optional[bool],
-     user_type: Optional[str],
-+    exists_ok: bool = False,
- ) -> None:
-     if not user:
-         try:
-@@ -154,7 +160,13 @@ def register_new_user(
-             admin = False
- 
-     request_registration(
-        user, password, server_location, shared_secret, bool(admin), user_type
-+        user,
-+        password,
-+        server_location,
-+        shared_secret,
-+        bool(admin),
-+        user_type,
-+        exists_ok=exists_ok,
-     )
- 
- 
-@@ -173,6 +185,11 @@ def main() -> None:
-         default=None,
-         help="Local part of the new user. Will prompt if omitted.",
-     )
-+    parser.add_argument(
-+        "--exists-ok",
-+        action="store_true",
-+        help="Do not fail if user already exists.",
-+    )
-     password_group = parser.add_mutually_exclusive_group()
-     password_group.add_argument(
-         "-p",
-@@ -192,6 +209,7 @@ def main() -> None:
-         default=None,
-         help="User type as specified in synapse.api.constants.UserTypes",
-     )
-+
-     admin_group = parser.add_mutually_exclusive_group()
-     admin_group.add_argument(
-         "-a",
-@@ -281,7 +299,7 @@ def main() -> None:
-     if args.admin or args.no_admin:
-         admin = args.admin
- 
-    register_new_user(args.user, password, server_url, secret, admin, args.user_type)
-+    register_new_user(args.user, password, server_url, secret, admin, args.user_type, exists_ok=args.exists_ok)
- 
- 
- def _read_file(file_path: Any, config_path: str) -> str:
-- 
-2.44.1
-
--- a/clanModules/matrix-synapse/default.nix
+++ b/clanModules/matrix-synapse/default.nix
@ -6,37 +6,31 @@
 }:
 let
  cfg = config.clan.matrix-synapse;
-  nginx-vhost = "matrix.${config.clan.matrix-synapse.domain}";
  element-web =
    pkgs.runCommand "element-web-with-config" { nativeBuildInputs = [ pkgs.buildPackages.jq ]; }
      ''
        cp -r ${pkgs.element-web} $out
        chmod -R u+w $out
-        jq '."default_server_config"."m.homeserver" = { "base_url": "https://${nginx-vhost}:443", "server_name": "${config.clan.matrix-synapse.domain}" }' \
+        jq '."default_server_config"."m.homeserver" = { "base_url": "https://${cfg.domain.server}:443", "server_name": "${cfg.domain.server}" }' \
          > $out/config.json < ${pkgs.element-web}/config.json
-        ln -s $out/config.json $out/config.${nginx-vhost}.json
+        ln -s $out/config.json $out/config.${cfg.domain.server}.json
      '';
-
-  # FIXME: This was taken from upstream. Drop this when our patch is upstream
-  synapseCfg = config.services.matrix-synapse;
-  wantedExtras =
-    synapseCfg.extras
-    ++ lib.optional (synapseCfg.settings ? oidc_providers) "oidc"
-    ++ lib.optional (synapseCfg.settings ? jwt_config) "jwt"
-    ++ lib.optional (synapseCfg.settings ? saml2_config) "saml2"
-    ++ lib.optional (synapseCfg.settings ? redis) "redis"
-    ++ lib.optional (synapseCfg.settings ? sentry) "sentry"
-    ++ lib.optional (synapseCfg.settings ? user_directory) "user-search"
-    ++ lib.optional (synapseCfg.settings.url_preview_enabled) "url-preview"
-    ++ lib.optional (synapseCfg.settings.database.name == "psycopg2") "postgres";
 in
+# FIXME: This was taken from upstream. Drop this when our patch is upstream
 {
  options.services.matrix-synapse.package = lib.mkOption { readOnly = false; };
  options.clan.matrix-synapse = {
-    domain = lib.mkOption {
-      type = lib.types.str;
-      description = "The domain name of the matrix server";
-      example = "example.com";
+    domain = {
+      server = lib.mkOption {
+        type = lib.types.str;
+        description = "The domain name of the matrix server";
+        example = "matrix.example.com";
+      };
+      client = lib.mkOption {
+        type = lib.types.str;
+        description = "The domain name of the matrix client";
+        example = "element.example.com";
+      };
    };
    users = lib.mkOption {
      default = { };
@ -73,29 +67,14 @@ in
      "matrix-synapse"
      "enable"
    ] "Importing the module will already enable the service.")
-
-    ../postgresql
+    ../nginx
  ];
  config = {
    services.matrix-synapse = {
-      package = lib.mkForce (
-        pkgs.matrix-synapse.override {
-          matrix-synapse-unwrapped = pkgs.matrix-synapse.unwrapped.overrideAttrs (_old: {
-            doInstallCheck = false; # too slow, nixpkgs maintainer already run this.
-            patches = [
-              # see: https://github.com/element-hq/synapse/pull/17304
-              ./0001-register_new_matrix_user-add-password-file-flag.patch
-              ./0002-register-new-matrix-user-add-a-flag-to-ignore-alread.patch
-            ];
-          });
-          extras = wantedExtras;
-          plugins = synapseCfg.plugins;
-        }
-      );
-
      enable = true;
      settings = {
-        server_name = cfg.domain;
+        server_name = cfg.domain.server;
+        enable_registration = false;
        database = {
          args.user = "matrix-synapse";
          args.database = "matrix-synapse";
@ -199,10 +178,10 @@ in
    services.nginx = {
      enable = true;
      virtualHosts = {
-        ${cfg.domain} = {
+        "${cfg.domain.server}" = {
          locations."= /.well-known/matrix/server".extraConfig = ''
            add_header Content-Type application/json;
-            return 200 '${builtins.toJSON { "m.server" = "matrix.${cfg.domain}:443"; }}';
+            return 200 '${builtins.toJSON { "m.server" = "${cfg.domain.server}:443"; }}';
          '';
          locations."= /.well-known/matrix/client".extraConfig = ''
            add_header Content-Type application/json;
@ -210,7 +189,7 @@ in
            return 200 '${
              builtins.toJSON {
                "m.homeserver" = {
-                  "base_url" = "https://${nginx-vhost}";
+                  "base_url" = "https://${cfg.domain.server}";
                };
                "m.identity_server" = {
                  "base_url" = "https://vector.im";
@ -218,12 +197,14 @@ in
              }
            }';
          '';
-        };
-        ${nginx-vhost} = {
          forceSSL = true;
          enableACME = true;
          locations."/_matrix".proxyPass = "http://localhost:8008";
          locations."/_synapse".proxyPass = "http://localhost:8008";
+        };
+        "${cfg.domain.client}" = {
+          forceSSL = true;
+          enableACME = true;
          locations."/".root = element-web;
        };
      };
--- a/clanModules/mumble/README.md
+++ b/clanModules/mumble/README.md
@ -0,0 +1,14 @@
+---
+description = "Open Source, Low Latency, High Quality Voice Chat."
+categories = ["chat", "voice"]
+---
+The mumble clan module gives you:
+
+- True low latency voice communication.
+- Secure, authenticated encryption.
+- Free software.
+- Backed by a large and active open-source community.
+
+This all set up in a way that allows peer-to-peer hosting.
+Every machine inside the clan can be a host for mumble, 
+and thus it doesn't matter who in the network is online - as long as two people are online they are able to chat with each other.
--- a/clanModules/mumble/default.nix
+++ b/clanModules/mumble/default.nix
@ -0,0 +1,104 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+let
+  clanDir = config.clan.core.clanDir;
+  machineDir = clanDir + "/machines/";
+  machinesFileSet = builtins.readDir machineDir;
+  machines = lib.mapAttrsToList (name: _: name) machinesFileSet;
+  machineJson = builtins.toJSON machines;
+  certificateMachinePath = machines: machineDir + "/${machines}" + "/facts/mumble-cert";
+  certificatesUnchecked = builtins.map (
+    machine:
+    let
+      fullPath = certificateMachinePath machine;
+    in
+    if builtins.pathExists fullPath then machine else null
+  ) machines;
+  certificate = lib.filter (machine: machine != null) certificatesUnchecked;
+  machineCert = builtins.map (
+    machine: (lib.nameValuePair machine (builtins.readFile (certificateMachinePath machine)))
+  ) certificate;
+  machineCertJson = builtins.toJSON machineCert;
+
+in
+{
+  options.clan.services.mumble = {
+    user = lib.mkOption {
+      type = lib.types.str;
+      default = "alice";
+      description = "The user mumble should be set up for.";
+    };
+  };
+
+  config = {
+    services.murmur = {
+      enable = true;
+      logDays = -1;
+      registerName = config.clan.core.machineName;
+      openFirewall = true;
+      bonjour = true;
+      sslKey = config.clan.core.facts.services.mumble.secret.mumble-key.path;
+      sslCert = config.clan.core.facts.services.mumble.public.mumble-cert.path;
+    };
+
+    clan.core.state.mumble.folders = [
+      "/var/lib/mumble"
+      "/var/lib/murmur"
+    ];
+
+    systemd.tmpfiles.rules = [
+      "d '/var/lib/mumble' 0770 '${config.clan.services.mumble.user}' 'users' - -"
+    ];
+
+    environment.systemPackages =
+      let
+        mumbleCfgDir = "/var/lib/mumble";
+        mumbleDatabasePath = "${mumbleCfgDir}/mumble.sqlite";
+        mumbleCfgPath = "/var/lib/mumble/mumble_settings.json";
+        populate-channels = pkgs.writers.writePython3 "mumble-populate-channels" {
+          libraries = [
+            pkgs.python3Packages.cryptography
+            pkgs.python3Packages.pyopenssl
+          ];
+          flakeIgnore = [
+            # We don't live in the dark ages anymore.
+            # Languages like Python that are whitespace heavy will overrun
+            # 79 characters..
+            "E501"
+          ];
+        } (builtins.readFile ./mumble-populate-channels.py);
+        mumble = pkgs.writeShellScriptBin "mumble" ''
+          set -xeu
+          mkdir -p ${mumbleCfgDir}
+          pushd "${mumbleCfgDir}"
+          XDG_DATA_HOME=${mumbleCfgDir}
+          XDG_DATA_DIR=${mumbleCfgDir}
+          ${populate-channels} --ensure-config '${mumbleCfgPath}' --db-location ${mumbleDatabasePath}
+          echo ${machineCertJson}
+          ${populate-channels} --machines '${machineJson}' --username ${config.clan.core.machineName} --db-location ${mumbleDatabasePath}
+          ${populate-channels} --servers '${machineCertJson}' --username ${config.clan.core.machineName} --db-location ${mumbleDatabasePath} --cert True
+          ${pkgs.mumble}/bin/mumble --config ${mumbleCfgPath} "$@"
+          popd
+        '';
+      in
+      [ mumble ];
+
+    clan.core.facts.services.mumble = {
+      secret.mumble-key = { };
+      public.mumble-cert = { };
+      generator.path = [
+        pkgs.coreutils
+        pkgs.openssl
+      ];
+      generator.script = ''
+        openssl genrsa -out $secrets/mumble-key 2048
+        openssl req -new -x509 -key $secrets/mumble-key -out $facts/mumble-cert
+      '';
+    };
+  };
+
+}
--- a/clanModules/mumble/mumble-populate-channels.py
+++ b/clanModules/mumble/mumble-populate-channels.py
@ -0,0 +1,249 @@
+import argparse
+import json
+import os
+import sqlite3
+
+
+def ensure_config(path: str, db_path: str) -> None:
+    # Default JSON structure if the file doesn't exist
+    default_json = {
+        "misc": {
+            "audio_wizard_has_been_shown": True,
+            "database_location": db_path,
+            "viewed_server_ping_consent_message": True,
+        },
+        "settings_version": 1,
+    }
+
+    # Check if the file exists
+    if os.path.exists(path):
+        with open(path) as file:
+            data = json.load(file)
+    else:
+        data = default_json
+        # Create the file with default JSON structure
+        with open(path, "w") as file:
+            json.dump(data, file, indent=4)
+
+    # TODO: make sure to only update the diff
+    updated_data = {**default_json, **data}
+
+    # Write the modified JSON object back to the file
+    with open(path, "w") as file:
+        json.dump(updated_data, file, indent=4)
+
+
+def initialize_database(db_location: str) -> None:
+    """
+    Initializes the database. If the database or the servers table does not exist, it creates them.
+
+    :param db_location: The path to the SQLite database
+    """
+    conn = sqlite3.connect(db_location)
+    try:
+        cursor = conn.cursor()
+
+        # Create the servers table if it doesn't exist
+        cursor.execute("""
+        CREATE TABLE IF NOT EXISTS servers (
+            id INTEGER PRIMARY KEY AUTOINCREMENT,
+            name TEXT NOT NULL,
+            hostname TEXT NOT NULL,
+            port INTEGER NOT NULL,
+            username TEXT NOT NULL,
+            password TEXT NOT NULL,
+            url TEXT
+        )
+        """)
+
+        # Commit the changes
+        conn.commit()
+
+    except sqlite3.Error as e:
+        print(f"An error occurred while initializing the database: {e}")
+    finally:
+        conn.close()
+
+
+def initialize_certificates(
+    db_location: str, hostname: str, port: str, digest: str
+) -> None:
+    # Connect to the SQLite database
+    conn = sqlite3.connect(db_location)
+
+    try:
+        # Create a cursor object
+        cursor = conn.cursor()
+
+        # TODO: check if cert already there
+        # if server_check(cursor, name, hostname):
+        #     print(
+        #         f"Server with name '{name}' and hostname '{hostname}' already exists."
+        #     )
+        #     return
+
+        # SQL command to insert data into the servers table
+        insert_query = """
+        INSERT INTO cert (hostname, port, digest)
+        VALUES (?, ?, ?)
+        """
+
+        # Data to be inserted
+        data = (hostname, port, digest)
+
+        # Execute the insert command with the provided data
+        cursor.execute(insert_query, data)
+
+        # Commit the changes
+        conn.commit()
+
+        print("Data has been successfully inserted.")
+    except sqlite3.Error as e:
+        print(f"An error occurred: {e}")
+    finally:
+        # Close the connection
+        conn.close()
+    pass
+
+
+def calculate_digest(cert: str) -> str:
+    from cryptography import x509
+    from cryptography.hazmat.backends import default_backend
+    from cryptography.hazmat.primitives import hashes
+
+    cert = cert.strip()
+    cert = cert.encode("utf-8")
+    cert = x509.load_pem_x509_certificate(cert, default_backend())
+    digest = cert.fingerprint(hashes.SHA1()).hex()
+    return digest
+
+
+def server_check(cursor: str, name: str, hostname: str) -> bool:
+    """
+    Check if a server with the given name and hostname already exists.
+
+    :param cursor: The database cursor
+    :param name: The name of the server
+    :param hostname: The hostname of the server
+    :return: True if the server exists, False otherwise
+    """
+    check_query = """
+    SELECT 1 FROM servers WHERE name = ? AND hostname = ?
+    """
+    cursor.execute(check_query, (name, hostname))
+    return cursor.fetchone() is not None
+
+
+def insert_server(
+    name: str,
+    hostname: str,
+    port: str,
+    username: str,
+    password: str,
+    url: str,
+    db_location: str,
+) -> None:
+    """
+    Inserts a new server record into the servers table.
+
+    :param name: The name of the server
+    :param hostname: The hostname of the server
+    :param port: The port number
+    :param username: The username
+    :param password: The password
+    :param url: The URL
+    """
+    # Connect to the SQLite database
+    conn = sqlite3.connect(db_location)
+
+    try:
+        # Create a cursor object
+        cursor = conn.cursor()
+
+        if server_check(cursor, name, hostname):
+            print(
+                f"Server with name '{name}' and hostname '{hostname}' already exists."
+            )
+            return
+
+        # SQL command to insert data into the servers table
+        insert_query = """
+        INSERT INTO servers (name, hostname, port, username, password, url)
+        VALUES (?, ?, ?, ?, ?, ?)
+        """
+
+        # Data to be inserted
+        data = (name, hostname, port, username, password, url)
+
+        # Execute the insert command with the provided data
+        cursor.execute(insert_query, data)
+
+        # Commit the changes
+        conn.commit()
+
+        print("Data has been successfully inserted.")
+    except sqlite3.Error as e:
+        print(f"An error occurred: {e}")
+    finally:
+        # Close the connection
+        conn.close()
+
+
+if __name__ == "__main__":
+    port = 64738
+    password = ""
+    url = None
+
+    parser = argparse.ArgumentParser(
+        prog="initialize_mumble",
+    )
+
+    subparser = parser.add_subparsers(dest="certificates")
+    # cert_parser = subparser.add_parser("certificates")
+
+    parser.add_argument("--cert")
+    parser.add_argument("--digest")
+    parser.add_argument("--machines")
+    parser.add_argument("--servers")
+    parser.add_argument("--username")
+    parser.add_argument("--db-location")
+    parser.add_argument("--ensure-config")
+    args = parser.parse_args()
+
+    print(args)
+
+    if args.ensure_config:
+        ensure_config(args.ensure_config, args.db_location)
+        print("Initialized config")
+        exit(0)
+
+    if args.servers:
+        print(args.servers)
+        servers = json.loads(f"{args.servers}")
+        db_location = args.db_location
+        for server in servers:
+            digest = calculate_digest(server.get("value"))
+            name = server.get("name")
+            initialize_certificates(db_location, name, port, digest)
+        print("Initialized certificates")
+        exit(0)
+
+    initialize_database(args.db_location)
+
+    # Insert the server into the database
+    print(args.machines)
+    machines = json.loads(f"{args.machines}")
+    print(machines)
+    print(list(machines))
+
+    for machine in list(machines):
+        print(f"Inserting {machine}.")
+        insert_server(
+            machine,
+            machine,
+            port,
+            args.username,
+            password,
+            url,
+            args.db_location,
+        )
--- a/clanModules/mumble/test.nix
+++ b/clanModules/mumble/test.nix
@ -0,0 +1,42 @@
+{ pkgs, self, ... }:
+pkgs.nixosTest {
+  name = "mumble";
+  nodes.peer1 =
+    { ... }:
+    {
+      imports = [
+        self.nixosModules.mumble
+        self.inputs.clan-core.nixosModules.clanCore
+        {
+          config = {
+            clan.core.machineName = "peer1";
+            clan.core.clanDir = ./.;
+
+            documentation.enable = false;
+          };
+        }
+      ];
+    };
+  nodes.peer2 =
+    { ... }:
+    {
+      imports = [
+        self.nixosModules.mumble
+        self.inputs.clan-core.nixosModules.clanCore
+        {
+          config = {
+
+            clan.core.machineName = "peer2";
+            clan.core.clanDir = ./.;
+
+            documentation.enable = false;
+          };
+        }
+      ];
+    };
+
+  testScript = ''
+    start_all()
+  '';
+
+}
--- a/clanModules/nginx/README.md
+++ b/clanModules/nginx/README.md
@ -0,0 +1,3 @@
+---
+description = "Good defaults for the nginx webserver"
+---
--- a/clanModules/nginx/default.nix
+++ b/clanModules/nginx/default.nix
@ -0,0 +1,75 @@
+{ config, lib, ... }:
+let
+  nginx_acme_email = "nginx-acme";
+in
+{
+
+  imports = [
+    (lib.mkRemovedOptionModule [
+      "clan"
+      "nginx"
+      "enable"
+    ] "Importing the module will already enable the service.")
+
+  ];
+  config = {
+
+    clan.core.facts.services."${nginx_acme_email}" = {
+      public."${nginx_acme_email}" = { };
+      generator.prompt = "Please enter your email address for Let's Encrypt certificate generation";
+
+      generator.script = ''
+        echo -n $prompt_value | tr -d "\n" > "$facts"/${nginx_acme_email}
+      '';
+    };
+    security.acme.acceptTerms = true;
+    security.acme.defaults.email = lib.mkDefault (
+      let
+        path = config.clan.core.facts.services."${nginx_acme_email}".public."${nginx_acme_email}".path;
+      in
+      if builtins.pathExists path then builtins.readFile path else null
+    );
+
+    networking.firewall.allowedTCPPorts = [
+      443
+      80
+    ];
+
+    services.nginx = {
+      enable = true;
+
+      statusPage = lib.mkDefault true;
+      recommendedBrotliSettings = lib.mkDefault true;
+      recommendedGzipSettings = lib.mkDefault true;
+      recommendedOptimisation = lib.mkDefault true;
+      recommendedProxySettings = lib.mkDefault true;
+      recommendedTlsSettings = lib.mkDefault true;
+      recommendedZstdSettings = lib.mkDefault true;
+
+      # Nginx sends all the access logs to /var/log/nginx/access.log by default.
+      # instead of going to the journal!
+      commonHttpConfig = "access_log syslog:server=unix:/dev/log;";
+
+      resolver.addresses =
+        let
+          isIPv6 = addr: builtins.match ".*:.*:.*" addr != null;
+          escapeIPv6 = addr: if isIPv6 addr then "[${addr}]" else addr;
+          cloudflare = [
+            "1.1.1.1"
+            "2606:4700:4700::1111"
+          ];
+          resolvers =
+            if config.networking.nameservers == [ ] then cloudflare else config.networking.nameservers;
+        in
+        map escapeIPv6 resolvers;
+
+      sslDhparam = config.security.dhparams.params.nginx.path;
+    };
+
+    security.dhparams = {
+      enable = true;
+      params.nginx = { };
+    };
+  };
+
+}
--- a/clanModules/postgresql/default.nix
+++ b/clanModules/postgresql/default.nix
@ -91,6 +91,7 @@ in
  options.clan.postgresql = {
    # we are reimplemeting ensureDatabase and ensureUser options here to allow to create databases with options
    databases = lib.mkOption {
+      description = "Databases to create";
      default = { };
      type = lib.types.attrsOf (
        lib.types.submodule (
@ -114,6 +115,7 @@ in
                description = "Create the database if it does not exist.";
              };
              create.options = lib.mkOption {
+                description = "Options to pass to the CREATE DATABASE command.";
                type = lib.types.lazyAttrsOf lib.types.str;
                default = { };
                example = {
@ -135,12 +137,14 @@ in
      );
    };
    users = lib.mkOption {
+      description = "Users to create";
      default = { };
      type = lib.types.attrsOf (
        lib.types.submodule (
          { name, ... }:
          {
            options.name = lib.mkOption {
+              description = "User name";
              type = lib.types.str;
              default = name;
            };
--- a/clanModules/root-password/default.nix
+++ b/clanModules/root-password/default.nix
@ -1,9 +1,18 @@
-{ pkgs, config, ... }:
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}:
 {
  users.mutableUsers = false;
  users.users.root.hashedPasswordFile =
    config.clan.core.facts.services.root-password.secret.password-hash.path;
-  sops.secrets."${config.clan.core.machineName}-password-hash".neededForUsers = true;
+
+  sops.secrets = lib.mkIf (config.clan.core.facts.secretStore == "sops") {
+    "${config.clan.core.machineName}-password-hash".neededForUsers = true;
+  };
+
  clan.core.facts.services.root-password = {
    secret.password = { };
    secret.password-hash = { };
--- a/clanModules/single-disk/default.nix
+++ b/clanModules/single-disk/default.nix
@ -2,7 +2,8 @@
 {
  options.clan.single-disk = {
    device = lib.mkOption {
-      type = lib.types.str;
+      default = null;
+      type = lib.types.nullOr lib.types.str;
      description = "The primary disk device to install the system on";
      # Question: should we set a default here?
      # default = "/dev/null";
--- a/clanModules/sshd/default.nix
+++ b/clanModules/sshd/default.nix
@ -2,10 +2,6 @@
 {
  services.openssh.enable = true;
  services.openssh.settings.PasswordAuthentication = false;
-  # We might want to remove this once, openssh is fixed everywhere:
-  # Workaround for CVE-2024-6387
-  # https://github.com/NixOS/nixpkgs/pull/323753#issuecomment-2199762128
-  services.openssh.settings.LoginGraceTime = 0;

  services.openssh.hostKeys = [
    {
--- a/clanModules/syncthing/default.nix
+++ b/clanModules/syncthing/default.nix
@ -7,6 +7,10 @@
 {
  options.clan.syncthing = {
    id = lib.mkOption {
+      description = ''
+        The ID of the machine.
+        It is generated automatically by default.
+      '';
      type = lib.types.nullOr lib.types.str;
      example = "BABNJY4-G2ICDLF-QQEG7DD-N3OBNGF-BCCOFK6-MV3K7QJ-2WUZHXS-7DTW4AS";
      default = config.clan.core.facts.services.syncthing.public."syncthing.pub".value or null;
@ -94,7 +98,7 @@
        settings = {
          options = {
            urAccepted = -1;
-            allowedNetworks = [ config.clan.networking.zerotier.subnet ];
+            allowedNetworks = [ config.clan.core.networking.zerotier.subnet ];
          };
          devices =
            { }
--- a/clanModules/user-password/default.nix
+++ b/clanModules/user-password/default.nix
@ -23,7 +23,11 @@
    users.mutableUsers = false;
    users.users.${config.clan.user-password.user}.hashedPasswordFile =
      config.clan.core.facts.services.user-password.secret.user-password-hash.path;
-    sops.secrets."${config.clan.core.machineName}-user-password-hash".neededForUsers = true;
+
+    sops.secrets = lib.mkIf (config.clan.core.facts.secretStore == "sops") {
+      "${config.clan.core.machineName}-user-password-hash".neededForUsers = true;
+    };
+
    clan.core.facts.services.user-password = {
      secret.user-password = { };
      secret.user-password-hash = { };
--- a/clanModules/vaultwarden/README.md
+++ b/clanModules/vaultwarden/README.md
@ -0,0 +1,3 @@
+---
+description = "The server for the password manager bitwarden"
+---
--- a/clanModules/vaultwarden/default.nix
+++ b/clanModules/vaultwarden/default.nix
@ -0,0 +1,164 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.clan.vaultwarden;
+  module_name = "vaultwarden";
+
+  admin_pwd_secret = "${module_name}-admin";
+  admin_pwd_hash_secret = "${admin_pwd_secret}-hash";
+  smtp_pwd_secret = "${module_name}-smtp";
+  smtp_pwd_secret_path =
+    config.clan.core.facts.services."${smtp_pwd_secret}".secret."${smtp_pwd_secret}".path;
+  admin_secret_cfg_path =
+    config.clan.core.facts.services."${admin_pwd_secret}".secret."${admin_pwd_hash_secret}".path;
+in
+
+{
+  imports = [
+    ../postgresql
+    (lib.mkRemovedOptionModule [
+      "clan"
+      "vaultwarden"
+      "enable"
+    ] "Importing the module will already enable the service.")
+    ../nginx
+  ];
+
+  options.clan."${module_name}" = {
+    domain = lib.mkOption {
+      type = lib.types.str;
+      example = "bitwarden.example.com";
+      description = "The domain to use for Vaultwarden";
+    };
+    port = lib.mkOption {
+      type = lib.types.int;
+      default = 3011;
+      description = "The port to use for Vaultwarden";
+    };
+    allow_signups = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = "Allow signups for new users";
+    };
+
+    smtp = {
+      host = lib.mkOption {
+        type = lib.types.str;
+        example = "smtp.example.com";
+        description = "The email server domain address";
+      };
+      from = lib.mkOption {
+        type = lib.types.str;
+        example = "foobar@example.com";
+        description = "From whom the email is coming from";
+      };
+      username = lib.mkOption {
+        type = lib.types.str;
+        example = "foobar@example.com";
+        description = "The email server username";
+      };
+    };
+  };
+
+  config = {
+
+    clan.postgresql.users.vaultwarden = { };
+    clan.postgresql.databases.vaultwarden.create.options = {
+      TEMPLATE = "template0";
+      LC_COLLATE = "C";
+      LC_CTYPE = "C";
+      ENCODING = "UTF8";
+      OWNER = "vaultwarden";
+    };
+    clan.postgresql.databases.vaultwarden.restore.stopOnRestore = [ "vaultwarden" ];
+
+    services.nginx = {
+      enable = true;
+      virtualHosts = {
+        "${cfg.domain}" = {
+          forceSSL = true;
+          enableACME = true;
+          extraConfig = ''
+            client_max_body_size 128M;
+          '';
+          locations."/" = {
+            proxyPass = "http://localhost:${builtins.toString cfg.port}";
+            proxyWebsockets = true;
+          };
+          locations."/notifications/hub" = {
+            proxyPass = "http://localhost:${builtins.toString cfg.port}";
+            proxyWebsockets = true;
+          };
+          locations."/notifications/hub/negotiate" = {
+            proxyPass = "http://localhost:${builtins.toString cfg.port}";
+            proxyWebsockets = true;
+          };
+        };
+      };
+    };
+
+    clan.core.facts.services = {
+      "${admin_pwd_secret}" = {
+        secret."${admin_pwd_secret}" = { };
+        secret."${admin_pwd_hash_secret}" = { };
+        generator.path = with pkgs; [
+          coreutils
+          pwgen
+          libargon2
+          openssl
+        ];
+        generator.script = ''
+          ADMIN_PWD=$(pwgen 16 -n1 | tr -d "\n")
+          ADMIN_HASH=$(echo -n "$ADMIN_PWD" | argon2 "$(openssl rand -base64 32)" -e -id -k 65540 -t 3 -p 4)
+
+          config="
+          ADMIN_TOKEN=\"$ADMIN_HASH\"
+          "
+          echo -n "$ADMIN_PWD" > $secrets/${admin_pwd_secret}
+          echo -n "$config" > $secrets/${admin_pwd_hash_secret}
+        '';
+      };
+      "${smtp_pwd_secret}" = {
+        secret."${smtp_pwd_secret}" = { };
+        generator.prompt = "${cfg.smtp.from} SMTP password";
+        generator.path = with pkgs; [ coreutils ];
+        generator.script = ''
+          config="
+            SMTP_PASSWORD="$prompt_value"
+          "
+          echo -n "$config" > $secrets/${smtp_pwd_secret}
+        '';
+      };
+    };
+
+    systemd.services."${module_name}" = {
+      serviceConfig = {
+        EnvironmentFile = [ smtp_pwd_secret_path ];
+      };
+    };
+
+    services."${module_name}" = {
+      enable = true;
+      dbBackend = "postgresql";
+      environmentFile = admin_secret_cfg_path; # TODO: Make this upstream an array
+      config = {
+        SMTP_SECURITY = "force_tls";
+        SMTP_HOST = cfg.smtp.host;
+        SMTP_FROM = cfg.smtp.from;
+        SMTP_USERNAME = cfg.smtp.username;
+        DOMAIN = "https://${cfg.domain}";
+        SIGNUPS_ALLOWED = cfg.allow_signups;
+        ROCKET_PORT = builtins.toString cfg.port;
+        DATABASE_URL = "postgresql://"; # TODO: This should be set upstream if dbBackend is set to postgresql
+        ENABLE_WEBSOCKET = true;
+        ROCKET_ADDRESS = "127.0.0.1";
+      };
+    };
+
+  };
+
+}
--- a/clanModules/zerotier-static-peers/default.nix
+++ b/clanModules/zerotier-static-peers/default.nix
@ -30,6 +30,16 @@ in
      default = [ config.clan.core.machineName ];
      description = "Hosts that should be excluded";
    };
+    networkIps = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+      description = "Extra zerotier network Ips that should be accepted";
+    };
+    networkIds = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+      description = "Extra zerotier network Ids that should be accepted";
+    };
  };

  config.systemd.services.zerotier-static-peers-autoaccept =
@ -56,8 +66,9 @@ in
          lib.nameValuePair (builtins.readFile fullPath) [ machine ]
        ) filteredMachines
      );
+      allHostIPs = config.clan.zerotier-static-peers.networkIps ++ hosts;
    in
-    lib.mkIf (config.clan.networking.zerotier.controller.enable) {
+    lib.mkIf (config.clan.core.networking.zerotier.controller.enable) {
      wantedBy = [ "multi-user.target" ];
      after = [ "zerotierone.service" ];
      path = [ config.clan.core.clanPkgs.zerotierone ];
@ -65,9 +76,12 @@ in
        #!/bin/sh
        ${lib.concatMapStringsSep "\n" (host: ''
          ${config.clan.core.clanPkgs.zerotier-members}/bin/zerotier-members allow --member-ip ${host}
-        '') hosts}
+        '') allHostIPs}
+        ${lib.concatMapStringsSep "\n" (host: ''
+          ${config.clan.core.clanPkgs.zerotier-members}/bin/zerotier-members allow ${host}
+        '') config.clan.zerotier-static-peers.networkIds}
      '';
    };

-  config.clan.networking.zerotier.networkId = lib.mkDefault networkId;
+  config.clan.core.networking.zerotier.networkId = lib.mkDefault networkId;
 }
--- a/devShell.nix
+++ b/devShell.nix
@ -38,6 +38,7 @@
        ];
        shellHook = ''
          echo -e "${ansiEscapes.green}switch to another dev-shell using: select-shell${ansiEscapes.reset}"
+          export PROJECT_ROOT=$(git rev-parse --show-toplevel)
        '';
      };
    };
--- a/docs/.envrc
+++ b/docs/.envrc
@ -1,6 +1,8 @@
+# shellcheck shell=bash
 source_up

-watch_file $(find ./nix -name "*.nix" -printf '%p ')
+mapfile -d '' -t nix_files < <(find ./nix -name "*.nix" -print0)
+watch_file "${nix_files[@]}"

 # Because we depend on nixpkgs sources, uploading to builders takes a long time
 use flake .#docs --builders ''
--- a/docs/.gitignore
+++ b/docs/.gitignore
@ -1,3 +1,6 @@
-/site/reference
+/site/reference/clan-core
+/site/reference/clanModules
+/site/reference/nix-api/inventory.md
+/site/reference/cli
 /site/static/Roboto-Regular.ttf
 /site/static/FiraCode-VF.ttf
--- a/docs/mkdocs.yml
+++ b/docs/mkdocs.yml
@ -14,6 +14,7 @@ markdown_extensions:
  - attr_list
  - footnotes
  - md_in_html
+  - def_list
  - meta
  - plantuml_markdown
  - pymdownx.emoji:
@ -38,27 +39,38 @@ exclude_docs: |
  /drafts/

 nav:
-  - Blog:
-      - blog/index.md
  - Getting started:
      - index.md
      - Installer: getting-started/installer.md
      - Configure: getting-started/configure.md
      - Secrets & Facts: getting-started/secrets.md
      - Deploy Machine: getting-started/deploy.md
+      - Disk Encryption: getting-started/disk-encryption.md
      - Mesh VPN: getting-started/mesh-vpn.md
      - Backup & Restore: getting-started/backups.md
      - Flake-parts: getting-started/flake-parts.md
+  - Guides:
+      - guides/index.md
+      - Inventory: guides/inventory.md
  - Reference:
+      - reference/index.md
      - Clan Modules:
          - reference/clanModules/borgbackup-static.md
          - reference/clanModules/borgbackup.md
          - reference/clanModules/deltachat.md
+          - reference/clanModules/dyndns.md
+          - reference/clanModules/nginx.md
+          - reference/clanModules/vaultwarden.md
          - reference/clanModules/ergochat.md
+          - reference/clanModules/garage.md
+          - reference/clanModules/golem-provider.md
+          - reference/clanModules/index.md
+          - reference/clanModules/iwd.md
          - reference/clanModules/localbackup.md
          - reference/clanModules/localsend.md
          - reference/clanModules/matrix-synapse.md
          - reference/clanModules/moonlight.md
+          - reference/clanModules/mumble.md
          - reference/clanModules/packages.md
          - reference/clanModules/postgresql.md
          - reference/clanModules/root-password.md
@ -75,13 +87,12 @@ nav:
          - reference/clanModules/zerotier-static-peers.md
          - reference/clanModules/zt-tcp-relay.md
      - CLI:
+          - reference/cli/index.md
          - reference/cli/backups.md
-          - reference/cli/config.md
          - reference/cli/facts.md
          - reference/cli/flakes.md
          - reference/cli/flash.md
          - reference/cli/history.md
-          - reference/cli/index.md
          - reference/cli/machines.md
          - reference/cli/secrets.md
          - reference/cli/show.md
@ -94,7 +105,15 @@ nav:
          - reference/clan-core/facts.md
          - reference/clan-core/sops.md
          - reference/clan-core/state.md
+          - reference/clan-core/deployment.md
+          - reference/clan-core/networking.md
+      - Nix API:
+          - reference/nix-api/index.md
+          - buildClan: reference/nix-api/buildclan.md
+          - Inventory: reference/nix-api/inventory.md
  - Contributing: contributing/contributing.md
+  - Blog:
+      - blog/index.md

 docs_dir: site
 site_dir: out
--- a/docs/nix/default.nix
+++ b/docs/nix/default.nix
@ -2,6 +2,7 @@
  pkgs,
  module-docs,
  clan-cli-docs,
+  inventory-api-docs,
  asciinema-player-js,
  asciinema-player-css,
  roboto,
@ -26,11 +27,13 @@ pkgs.stdenv.mkDerivation {
      mkdocs-material
      mkdocs-rss-plugin
      mkdocs-macros
+      filelock # FIXME: this should be already provided by mkdocs-rss-plugin
    ]);
  configurePhase = ''
    mkdir -p ./site/reference/cli
    cp -af ${module-docs}/* ./site/reference/
    cp -af ${clan-cli-docs}/* ./site/reference/cli/
+    cp -af ${inventory-api-docs} ./site/reference/nix-api/inventory.md

    mkdir -p ./site/static/asciinema-player
    ln -snf ${asciinema-player-js} ./site/static/asciinema-player/asciinema-player.min.js
--- a/docs/nix/flake-module.nix
+++ b/docs/nix/flake-module.nix
@ -38,7 +38,7 @@
            patchShebangs --build $out

            ruff format --check --diff $out
-            ruff --line-length 88 $out
+            ruff check --line-length 88 $out
            mypy --strict $out
          '';

@ -54,9 +54,11 @@
      module-docs =
        pkgs.runCommand "rendered"
          {
-            nativeBuildInputs = [
+            buildInputs = [
              pkgs.python3
              self'.packages.clan-cli
+              # TODO: see postFixup clan-cli/default.nix:L188
+              self'.packages.clan-cli.propagatedBuildInputs
            ];
          }
          ''
@ -73,14 +75,17 @@
    in
    {
      devShells.docs = pkgs.callPackage ./shell.nix {
-        inherit (self'.packages) docs clan-cli-docs;
-        inherit module-docs;
-        inherit asciinema-player-js;
-        inherit asciinema-player-css;
+        inherit (self'.packages) docs clan-cli-docs inventory-api-docs;
+        inherit
+          asciinema-player-js
+          asciinema-player-css
+          module-docs
+          self'
+          ;
      };
      packages = {
        docs = pkgs.python3.pkgs.callPackage ./default.nix {
-          inherit (self'.packages) clan-cli-docs;
+          inherit (self'.packages) clan-cli-docs inventory-api-docs;
          inherit (inputs) nixpkgs;
          inherit module-docs;
          inherit asciinema-player-js;
--- a/docs/nix/get-module-docs.nix
+++ b/docs/nix/get-module-docs.nix
@ -30,7 +30,7 @@ let
    options:
    pkgs.nixosOptionsDoc {
      options = options;
-      warningsAreErrors = false;
+      warningsAreErrors = true;
    };

  # clanModules docs
--- a/docs/nix/scripts/renderOptions.py
+++ b/docs/nix/scripts/renderOptions.py
@ -113,12 +113,13 @@ def render_option(name: str, option: dict[str, Any], level: int = 3) -> str:
 """

    decls = option.get("declarations", [])
-    source_path, name = replace_store_path(decls[0])
-    print(source_path, name)
-    res += f"""
+    if decls:
+        source_path, name = replace_store_path(decls[0])
+        print(source_path, name)
+        res += f"""
 :simple-git: [{name}]({source_path})
 """
-    res += "\n"
+        res += "\n"

    return res

@ -219,6 +220,11 @@ def render_roles(roles: list[str] | None, module_name: str) -> str:
    return ""


+clan_modules_descr = """Clan modules are [NixOS modules](https://wiki.nixos.org/wiki/NixOS_modules) which have been enhanced with additional features provided by Clan, with certain option types restricted to enable configuration through a graphical interface.
+
+"""
+
+
 def produce_clan_modules_docs() -> None:
    if not CLAN_MODULES:
        raise ValueError(
@ -244,6 +250,12 @@ def produce_clan_modules_docs() -> None:
    #     print(meta_map)

    # {'borgbackup': '/nix/store/hi17dwgy7963ddd4ijh81fv0c9sbh8sw-options.json', ... }
+
+    modules_index = "# Modules Overview\n\n"
+    modules_index += clan_modules_descr
+    modules_index += "## Overview\n\n"
+    modules_index += '<div class="grid cards" markdown>\n\n'
+
    for module_name, options_file in links.items():
        readme_file = Path(CLAN_CORE_PATH) / "clanModules" / module_name / "README.md"
        print(module_name, readme_file)
@ -253,6 +265,8 @@ def produce_clan_modules_docs() -> None:
            frontmatter, readme_content = extract_frontmatter(readme, str(readme_file))
            print(frontmatter, readme_content)

+        modules_index += build_option_card(module_name, frontmatter)
+
        with open(Path(options_file) / "share/doc/nixos/options.json") as f:
            options: dict[str, dict[str, Any]] = json.load(f)
            print(f"Rendering options for {module_name}...")
@ -281,6 +295,39 @@ def produce_clan_modules_docs() -> None:
            with open(outfile, "w") as of:
                of.write(output)

+    modules_index += "</div>"
+    modules_index += "\n"
+    modules_outfile = Path(OUT) / "clanModules/index.md"
+
+    with open(modules_outfile, "w") as of:
+        of.write(modules_index)
+
+
+def build_option_card(module_name: str, frontmatter: Frontmatter) -> str:
+    """
+    Build the overview index card for each reference target option.
+    """
+
+    def indent_all(text: str, indent_size: int = 4) -> str:
+        """
+        Indent all lines in a string.
+        """
+        indent = " " * indent_size
+        lines = text.split("\n")
+        indented_text = indent + ("\n" + indent).join(lines)
+        return indented_text
+
+    def to_md_li(module_name: str, frontmatter: Frontmatter) -> str:
+        md_li = (
+            f"""-   **[{module_name}](./{"-".join(module_name.split(" "))}.md)**\n\n"""
+        )
+        md_li += f"""{indent_all("---", 4)}\n\n"""
+        fmd = f"\n{frontmatter.description.strip()}" if frontmatter.description else ""
+        md_li += f"""{indent_all(fmd, 4)}"""
+        return md_li
+
+    return f"{to_md_li(module_name, frontmatter)}\n\n"
+

 if __name__ == "__main__":
    produce_clan_core_docs()
--- a/docs/nix/shell.nix
+++ b/docs/nix/shell.nix
@ -3,18 +3,25 @@
  pkgs,
  module-docs,
  clan-cli-docs,
+  inventory-api-docs,
  asciinema-player-js,
  asciinema-player-css,
  roboto,
  fira-code,
+  self',
  ...
 }:
 pkgs.mkShell {
-  inputsFrom = [ docs ];
+  inputsFrom = [
+    docs
+    self'.devShells.default
+  ];
  shellHook = ''
    mkdir -p ./site/reference/cli
    cp -af ${module-docs}/* ./site/reference/
    cp -af ${clan-cli-docs}/* ./site/reference/cli/
+    cp -af ${inventory-api-docs} ./site/reference/nix-api/inventory.md
+
    chmod +w ./site/reference/*

    echo "Generated API documentation in './site/reference/' "
--- a/docs/overrides/main.html
+++ b/docs/overrides/main.html
@ -1,12 +1,19 @@
-{% extends "base.html" %}
-
-{% block extrahead %}
-<meta property="og:title" content="Clan - Documentation, Blog & Getting Started Guide" />
-<meta property="og:description" content="Documentation for Clan. The peer-to-peer machine deployment framework." />
-<meta property="og:image" content="https://clan.lol/static/dark-favicon/128x128.png" />
+{% extends "base.html" %} {% block extrahead %}
+<meta
+  property="og:title"
+  content="Clan - Documentation, Blog & Getting Started Guide"
+/>
+<meta
+  property="og:description"
+  content="Documentation for Clan. The peer-to-peer machine deployment framework."
+/>
+<meta
+  property="og:image"
+  content="https://clan.lol/static/dark-favicon/128x128.png"
+/>
 <meta property="og:url" content="https://docs.clan.lol" />
 <meta property="og:type" content="website" />
 <meta property="og:site_name" content="Clan" />
 <meta property="og:locale" content="en_US" />

-{% endblock %}
+{% endblock %}
--- a/docs/site/blog/.authors.yml
+++ b/docs/site/blog/.authors.yml
@ -24,3 +24,8 @@ authors:
    description: "Core Developer"
    avatar: "https://clan.lol/static/profiles/qubasa.png"
    url: "https://github.com/Qubasa"
+  BrianMcGee:
+    name: "Brian McGee"
+    description: "Contributor"
+    avatar: "https://avatars.githubusercontent.com/u/1173648?v=4"
+    url: "https://bmcgee.ie"
--- a/docs/site/blog/posts/nixos-facter.md
+++ b/docs/site/blog/posts/nixos-facter.md
@ -0,0 +1,100 @@
+---
+title: "Introducing NixOS Facter"
+description: "Declarative Hardware Configuration in NixOS"
+authors:
+  - BrianMcGee
+date: 2024-07-19
+slug: nixos-facter
+---
+
+If you've ever installed [NixOS], you'll be familiar with a little Perl script called [nixos-generate-config]. Unsurprisingly, it generates a couple of NixOS modules based on available hardware, mounted filesystems, configured swap, etc.
+
+It's a critical component of the install process, aiming to ensure you have a good starting point for your NixOS system, with necessary or recommended kernel modules, file system mounts, networking config and much more.
+
+As solutions go, it's a solid one. It has helped many users take their first steps into this rabbit hole we call NixOS. However, it does suffer from one fundamental limitation.
+
+## Static Generation
+
+When a user generates a `hardware-configuration.nix` with `nixos-generate-config`, it makes choices based on the current state of the world as it sees it. By its very nature, then, it cannot account for changes in NixOS over time.
+
+A recommended configuration option today might be different two NixOS releases from now.
+
+To account for this, you could always run `nixos-generate-config` again. But that requires a working system, which may have broken due to the historical choices made last time, or worst-case, requiring you to fire up the installer again.
+
+## A Layer of Indirection
+
+What if, instead of generating some Nix code, we first describe the current hardware in an intermediate format? This hardware report would be _'pure'_, devoid of any reference to NixOS, and intended as a stable, longer-term representation of the system.
+
+From here, we can create a series of NixOS modules designed to examine the report's contents and make the same kinds of decisions that `nixos-generate-config` does. The critical difference is that as NixOS evolves, so can these modules, and with a full hardware report available we can make more interesting config choices about things such as GPUs and other devices.
+
+In a perfect world, we should not need to regenerate the underlying report as long as there are no hardware changes. We can take this one step further.
+
+Provided that certain sensitive information, such as serial numbers and MAC addresses, is filtered out, there is no reason why these hardware reports could not be shared after they are generated for things like EC2 instance types, specific laptop models, and so on, much like [NixOS Hardware] currently shares Nix configs.
+
+## Introducing NixOS Facter
+
+Still in its early stages, [NixOS Facter] is intended to do what I've described above.
+
+A user can generate a JSON-based hardware report using a (eventually static) Go program: `nixos-facter -o facter.json`. From there, they can include this report in their NixOS config and make use of our [NixOS modules](https://github.com/numtide/nixos-facter-modules) as follows:
+
+=== "**flake.nix**"
+
+    ```nix
+    {
+        inputs = {
+            nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
+            nixos-facter-modules.url = "github:numtide/nixos-facter-modules";
+        };
+
+        outputs = inputs @ {
+            nixpkgs,
+            ...
+        }: {
+            nixosConfigurations.basic = nixpkgs.lib.nixosSystem {
+                modules = [
+                    inputs.nixos-facter-modules.nixosModules.facter
+                    { config.facter.reportPath = ./facter.json; }
+                    # ...
+                ];
+            };
+        };
+    }
+    ```
+
+=== "**without flakes**"
+
+    ```nix
+    # configuration.nix
+    {
+        imports = [
+          "${(builtins.fetchTarball {
+            url = "https://github.com/numtide/nixos-facter-modules/";
+          })}/modules/nixos/facter.nix"
+        ];
+
+        config.facter.reportPath = ./facter.json;
+    }
+    ```
+
+That's it.
+
+> We assume that users will rely on [disko], so we have not implemented file system configuration yet (it's on the roadmap). 
+> In the meantime, if you don't use disko you have to specify that part of the configuration yourself or take it from `nixos-generate-config`.
+
+
+## Early Days
+
+Please be aware that [NixOS Facter] is still in early development and is still subject to significant changes especially the output json format as we flesh things out. Our initial goal is to reach feature parity with [nixos-generate-config].
+
+From there, we want to continue building our NixOS modules, opening things up to the community, and beginning to capture shared hardware configurations for providers such as Hetzner, etc.
+
+Over the coming weeks, we will also build up documentation and examples to make it easier to play with. For now, please be patient.
+
+> Side note: if you are wondering why the repo is in the [Numtide] org, we started partnering with Clan! Both companies are looking to make self-hosting easier and we're excited to be working together on this. Expect more tools and features to come!
+
+[NixOS Facter]: https://github.com/numtide/nixos-facter
+[NixOS Hardware]: https://github.com/NixOS/nixos-hardware
+[NixOS]: https://nixos.org "Declarative builds and deployments"
+[Numtide]: https://numtide.com
+[disko]: https://github.com/nix-community/disko
+[nixos-generate-config]: https://github.com/NixOS/nixpkgs/blob/dac9cdf8c930c0af98a63cbfe8005546ba0125fb/nixos/modules/installer/tools/nixos-generate-config.pl
--- a/docs/site/getting-started/configure.md
+++ b/docs/site/getting-started/configure.md
@ -1,5 +1,31 @@
 # Configuration - How to configure clan with your own machines

+Managing machine configurations can be done in the following ways:
+
+- writing `nix` expressions in a `flake.nix` file,
+- placing `autoincluded` files into your machine directory,
+- configuring everything in a simple UI (upcoming).
+
+Clan currently offers the following methods to configure machines:
+
+!!! Success "Recommended for nix people"
+
+    - flake.nix (i.e. via `buildClan`)
+        - `machine` argument
+        - `inventory` argument
+
+    - machines/`machine_name`/configuration.nix (`autoincluded` if it exists)
+
+???+ Note "Used by CLI & UI"
+
+    - inventory.json
+    - machines/`machine_name`/hardware-configuration.nix (`autoincluded` if it exists)
+
+
+!!! Warning "Deprecated"
+
+    machines/`machine_name`/settings.json
+
 ## Global configuration

 In the `flake.nix` file:
@ -89,7 +115,7 @@ Adding or configuring a new machine requires two simple steps:

              # Change this to the correct ip-address or hostname
              # The hostname is the machine name by default
-              clan.networking.targetHost = pkgs.lib.mkDefault "root@jon"
+              clan.core.networking.targetHost = pkgs.lib.mkDefault "root@jon"

              # Change this to the ID-LINK of the desired disk shown by 'lsblk'
              disko.devices.disk.main = {
@ -122,7 +148,7 @@ Adding or configuring a new machine requires two simple steps:

              # Change this to the correct ip-address or hostname
              # The hostname is the machine name by default
-              clan.networking.targetHost = pkgs.lib.mkDefault "root@jon"
+              clan.core.networking.targetHost = pkgs.lib.mkDefault "root@jon"

              # Change this to the ID-LINK of the desired disk shown by 'lsblk'
              disko.devices.disk.main = {
--- a/docs/site/getting-started/deploy.md
+++ b/docs/site/getting-started/deploy.md
@ -160,7 +160,7 @@ buildClan {
            # Set this for clan commands use ssh i.e. `clan machines update`
            # If you change the hostname, you need to update this line to root@<new-hostname>
            # This only works however if you have avahi running on your admin machine else use IP
-            clan.networking.targetHost = pkgs.lib.mkDefault "root@jon";
+            clan.core.networking.targetHost = pkgs.lib.mkDefault "root@jon";
        };
    };
 };
@ -197,7 +197,7 @@ buildClan {
    # ...
    machines = {
        "jon" = {
-            clan.networking.buildHost = "root@<host_or_ip>";
+            clan.core.networking.buildHost = "root@<host_or_ip>";
        };
    };
 };
@ -225,6 +225,7 @@ This is useful for machines that are not always online or are not part of the re

 ## What's next ?

+- [**Disk Encryption**](./disk-encryption.md): Configure disk encryption with remote decryption
 - [**Mesh VPN**](./mesh-vpn.md): Configuring a secure mesh network.

 ---
--- a/docs/site/getting-started/disk-encryption.md
+++ b/docs/site/getting-started/disk-encryption.md
@ -0,0 +1,301 @@
+## Setting up Encryption with Remote Decryption in NixOS
+
+This guide provides an example setup for a single-disk ZFS system with native encryption, accessible for decryption remotely. This configuration only applies to `systemd-boot` enabled systems and requires UEFI booting.
+
+For a mirrored disk setup, add `mode = "mirror";` to `zroot`. Under the `disk` option, provide the additional disk identifier, e.g., `y = mirrorBoot /dev/disk/by-id/<second_disk_id>`.
+
+Replace the disk `nvme-eui.002538b931b59865` with your own. 
+
+Below is the configuration for `disko.nix`
+```nix
+{ lib, ... }:
+let
+  mirrorBoot = idx: {
+    type = "disk";
+    device = "/dev/disk/by-id/${idx}";
+    content = {
+      type = "gpt";
+      partitions = {
+        boot = {
+          size = "1M";
+          type = "EF02"; # for grub MBR
+          priority = 1;
+        };
+        ESP = lib.mkIf (idx == "nvme-eui.002538b931b59865") {
+          size = "1G";
+          type = "EF00";
+          content = {
+            type = "filesystem";
+            format = "vfat";
+            mountpoint = "/boot";
+            mountOptions = [ "nofail" ];
+          };
+        };
+        zfs = {
+          size = "100%";
+          content = {
+            type = "zfs";
+            pool = "zroot";
+          };
+        };
+      };
+    };
+  };
+in
+{
+  boot.loader.systemd-boot.enable = true;
+
+  disko.devices = {
+    disk = {
+      x = mirrorBoot "nvme-eui.002538b931b59865";
+    };
+    zpool = {
+      zroot = {
+        type = "zpool";
+        rootFsOptions = {
+          compression = "lz4";
+          acltype = "posixacl";
+          xattr = "sa";
+          "com.sun:auto-snapshot" = "true";
+          mountpoint = "none";
+        };
+        datasets = {
+          "root" = {
+            type = "zfs_fs";
+            options = {
+              mountpoint = "none";
+              encryption = "aes-256-gcm";
+              keyformat = "passphrase";
+              keylocation = "file:///tmp/secret.key";
+            };
+          };
+          "root/nixos" = {
+            type = "zfs_fs";
+            options.mountpoint = "/";
+            mountpoint = "/";
+          };
+          "root/home" = {
+            type = "zfs_fs";
+            options.mountpoint = "/home";
+            mountpoint = "/home";
+          };
+          "root/tmp" = {
+            type = "zfs_fs";
+            mountpoint = "/tmp";
+            options = {
+              mountpoint = "/tmp";
+              sync = "disabled";
+            };
+          };
+        };
+      };
+    };
+  };
+}
+```
+
+Add this to networking.nix and **replace** the `default` values as well as the name `gchq-local` and `networking.hostId` with your own.
+
+```nix
+{ config, lib, ... }:
+{
+  options = {
+    networking.gchq-local.ipv4.address = lib.mkOption {
+      type = lib.types.str;
+      default = "192.168.178.177";
+    };
+    networking.gchq-local.ipv4.cidr = lib.mkOption {
+      type = lib.types.str;
+      default = "24";
+    };
+
+    networking.gchq-local.ipv4.gateway = lib.mkOption {
+      type = lib.types.str;
+      default = "192.168.178.1";
+    };
+
+    networking.gchq-local.ipv6.address = lib.mkOption {
+      type = lib.types.str;
+      default = "2003:100:6701:d500:fbbc:40fb:cff3:3b87";
+    };
+
+    networking.gchq-local.ipv6.cidr = lib.mkOption {
+      type = lib.types.str;
+      default = "64";
+    };
+    networking.gchq-local.ipv6.gateway = lib.mkOption {
+      type = lib.types.str;
+      default = "fe80::3ea6:2fff:feef:3435";
+    };
+  };
+
+  config = {
+    networking.dhcpcd.enable = false;
+    networking.nameservers = [ "127.0.0.1" ];
+    networking.hostId = "a76ebcca"; # Needs to be unique for each host
+
+    # The '10' in the network name is the priority, so this will be the first network to be configured
+    systemd.network.networks."10-eth" = {
+      matchConfig.Type = "ether";
+      addresses = [
+        {
+          Address=config.networking.gchq-local.ipv4.address + "/" + config.networking.gchq-local.ipv4.cidr;
+        }
+        {
+          Address=config.networking.gchq-local.ipv6.address + "/" + config.networking.gchq-local.ipv6.cidr;
+        }
+      ];
+      DHCP = "yes";
+    };
+  };
+}
+```
+
+Put this into initrd.nix and add your pubkey to `authorizedKeys`.
+Replace `kernelModules` with the ethernet module loaded one on your system.
+```nix
+{config, pkgs, ...}:
+
+{
+
+  boot.initrd.systemd = {
+    enable = true;
+    network.networks."10-eth" = config.systemd.network.networks."10-eth";
+  };
+  boot.initrd.network = {
+    enable = true;
+
+    ssh = {
+      enable = true;
+      port = 7172;
+      authorizedKeys = [ "<yourkey>" ];
+      hostKeys = [
+        "/var/lib/initrd-ssh-key"
+      ];
+    };
+  };
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+  ];
+
+  # Check the network card by running `lspci -k` on the target machine
+  boot.initrd.kernelModules = [ "r8169" ];
+}
+```
+
+
+### Step 1: Copying SSH Public Key
+
+Before starting the installation process, ensure that the SSH public key is copied to the NixOS installer.
+
+1. Copy your public SSH key to the installer, if it has not been copied already:
+
+```bash
+ssh-copy-id -o PreferredAuthentications=password -o PubkeyAuthentication=no root@nixos-installer.local
+```
+
+### Step 1.5: Prepare Secret Key and Clear Disk Data
+
+1. Access the installer using SSH:
+
+```bash
+ssh root@nixos-installer.local
+```
+
+2. Create a `secret.key` file in `/tmp` using `nano` or another text editor:
+
+```bash
+nano /tmp/secret.key
+```
+
+3. Discard the old disk partition data:
+
+```bash
+blkdiscard /dev/disk/by-id/nvme-eui.002538b931b59865
+```
+
+4. Run the `clan` machine installation with the following command:
+
+```bash
+clan machines install gchq-local root@nixos-installer --yes --no-reboot
+```
+
+### Step 2: ZFS Pool Import and System Installation
+
+1. SSH into the installer once again:
+
+```bash
+ssh root@nixos-installer.local
+```
+
+2. Perform the following commands on the remote installation environment:
+
+```bash
+zpool import zroot
+zfs set keystate=prompt zroot/root
+zfs load-key zroot/root
+zfs set mountpoint=/mnt zroot/root/nixos
+mount /dev/nvme0n1p2 /mnt/boot
+```
+
+3. Disconnect from the SSH session:
+
+```bash
+CTRL+D
+```
+
+4. Securely copy your local `initrd_rsa_key` to the installer's `/mnt` directory:
+
+```bash
+scp ~/.ssh/initrd_rsa_key root@nixos-installer.local:/mnt/var/lib/initrd-ssh-key
+```
+
+5. SSH back into the installer:
+
+```bash
+ssh root@nixos-installer.local
+```
+
+6. Navigate to the `/mnt` directory, enter the `nixos-enter` environment, and then exit:
+
+```bash
+cd /mnt
+nixos-enter
+realpath /run/current-system
+exit
+```
+
+7. Run the `nixos-install` command with the appropriate system path `<SYS_PATH>`:
+
+```bash
+nixos-install --no-root-passwd --no-channel-copy --root /mnt --system <SYS_PATH>
+```
+
+8. After the installation process, unmount `/mnt/boot`, change the ZFS mountpoint, and reboot the system:
+
+```bash
+umount /mnt/boot
+cd /
+zfs set mountpoint=/ zroot/root/nixos
+reboot
+```
+
+9. Perform a hard reboot of the machine and remove the USB stick.
+
+### Step 3: Accessing the Initial Ramdisk (initrd) Environment
+
+1. SSH into the initrd environment using the `initrd_rsa_key` and provided port:
+
+```bash
+ssh -p 7172 root@192.168.178.141
+```
+
+2. Run the `systemd-tty-ask-password-agent` utility to query a password:
+
+```bash
+systemd-tty-ask-password-agent --query
+```
+
+After completing these steps, your NixOS should be successfully installed and ready for use.
+
+**Note:** Replace `root@nixos-installer.local` and `192.168.178.141` with the appropriate user and IP addresses for your setup. Also, adjust `<SYS_PATH>` to reflect the correct system path for your environment.
--- a/docs/site/getting-started/flake-parts.md
+++ b/docs/site/getting-started/flake-parts.md
@ -75,7 +75,7 @@ Below is a guide on how to structure this in your flake.nix:
            nixpkgs.hostPlatform = "x86_64-linux";

            # Set this for clan commands use ssh i.e. `clan machines update`
-            clan.networking.targetHost = pkgs.lib.mkDefault "root@jon";
+            clan.core.networking.targetHost = pkgs.lib.mkDefault "root@jon";

            # remote> lsblk --output NAME,ID-LINK,FSTYPE,SIZE,MOUNTPOINT
            disko.devices.disk.main = {
@ -83,7 +83,7 @@ Below is a guide on how to structure this in your flake.nix:
            };

            # There needs to be exactly one controller per clan
-            clan.networking.zerotier.controller.enable = true;
+            clan.core.networking.zerotier.controller.enable = true;

          };
        };
--- a/docs/site/getting-started/installer.md
+++ b/docs/site/getting-started/installer.md
@ -48,13 +48,18 @@ sudo umount /dev/sdb1
    ```bash
    clan flash --flake git+https://git.clan.lol/clan/clan-core \
      --ssh-pubkey $HOME/.ssh/id_ed25519.pub \
-      --keymap en \
-      --language en \
+      --keymap us \
+      --language en_US.utf-8 \
      --disk main /dev/sd<X> \
      flash-installer
    ```

    The `--ssh-pubkey`, `--language` and `--keymap` are optional.
+    You can get a list of all keymaps with the following command:
+
+    ```
+    $ find $(nix-build 'https://github.com/NixOS/nixpkgs/archive/refs/heads/nixpkgs-unstable.tar.gz' --no-out-link -A kbd)/share/keymaps -type f -name '*.map.gz'
+    ```
    Replace `$HOME/.ssh/id_ed25519.pub` with a path to your SSH public key.
    If you do not have an ssh key yet, you can generate one with `ssh-keygen -t ed25519` command.

--- a/docs/site/getting-started/mesh-vpn.md
+++ b/docs/site/getting-started/mesh-vpn.md
@ -29,7 +29,7 @@ peers. Once addresses are allocated, the controller's continuous operation is no
 2. **Add Configuration**: Input the following configuration to the NixOS
   configuration of the controller machine:
   ```nix
-   clan.networking.zerotier.controller = {
+   clan.core.networking.zerotier.controller = {
     enable = true;
     public = true;
   };
@ -48,7 +48,7 @@ To introduce a new machine to the VPN, adhere to the following steps:
   configuration, substituting `<CONTROLLER>` with the controller machine name:
   ```nix
   { config, ... }: {
-     clan.networking.zerotier.networkId = builtins.readFile (config.clan.core.clanDir + "/machines/<CONTROLLER>/facts/zerotier-network-id");
+     clan.core.networking.zerotier.networkId = builtins.readFile (config.clan.core.clanDir + "/machines/<CONTROLLER>/facts/zerotier-network-id");
   }
   ```
 1. **Update the New Machine**: Execute:
--- a/docs/site/guides/index.md
+++ b/docs/site/guides/index.md
@ -0,0 +1,5 @@
+# Guides
+
+Detailed guides into the following subtopics:
+
+- [Inventory](./inventory.md): Configuring Services across machine boundaries
--- a/docs/site/guides/inventory.md
+++ b/docs/site/guides/inventory.md
@ -0,0 +1,196 @@
+# Inventory
+
+`Inventory` is an abstract service layer for consistently configuring distributed services across machine boundaries.
+
+See [Inventory API Documentation](../reference/nix-api/inventory.md)
+
+This guide will walk you through setting up a backup-service, where the inventory becomes useful.
+
+## Prerequisites Meta (optional)
+
+Metadata about the clan, will be displayed upfront in the upcomming clan-app, make sure to choose a unique name.
+
+Make sure to set `name` either via `inventory.meta` OR via `clan.meta`.
+
+```{.nix hl_lines="3-8"}
+buildClan {
+    inventory = {
+        meta = {
+            name = "Superclan"
+            description = "Awesome backups and family stuff"
+        };
+    };
+}
+```
+
+## How to add machines
+
+Machines can be added via `inventory.machines` OR via `buildClan` directly.
+
+!!! Note
+    It doesn't matter where the machine gets introduced to buildClan - All delarations are valid, duplications are merged.
+
+    However the clan-app (UI) will create machines in the inventory, because it cannot create arbitrary nix code or nixos configs.
+
+In the following example `backup_server` is one machine - it may specify parts of its configuration in different places.
+
+```{.nix hl_lines="3-5 12-20"}
+buildClan {
+    machines = {
+        "backup_server" = {
+            # Any valid nixos config
+        };
+        "jon" = {
+            # Any valid nixos config
+        };
+    };
+    inventory = {
+        machines = {
+            "backup_server" = {
+                # Don't include any nixos config here
+                # The following fields are avilable
+                # description: null | string
+                # icon:        null | string
+                # name:        string
+                # system:      null | string
+                # tags:        [...string]
+            };
+            "jon" = {
+                # Same as above
+            };
+        };
+    };
+}
+```
+
+## Services
+
+### Available clanModules
+
+Currently the inventory interface is implemented by the following clanModules
+
+- [borgbackup](../reference/clanModules/borgbackup.md)
+- [packages](../reference/clanModules/packages.md)
+- [single-disk](../reference/clanModules/single-disk.md)
+
+See the respective module documentation for available roles.
+
+### Adding services to machines
+
+A module can be added to one or multiple machines via `Roles`. clan's `Role` interface provide sane defaults for a module this allows the module author to reduce the configuration overhead to a minimum.
+
+Each service can still be customized and configured according to the modules options.
+
+- Per instance configuration via `services.<serviceName>.<instanceName>.config`
+- Per role configuration via `services.<serviceName>.<instanceName>.roles.<roleName>.config`
+- Per machine configuration via `services.<serviceName>.<instanceName>.machines.<machineName>.config`
+
+### Setting up the Backup Service
+
+!!! Example "Borgbackup Example"
+
+    To configure a service it needs to be added to the machine.
+    It is required to assign the service (`borgbackup`) an arbitrary instance name. (`instance_1`)
+
+    See also: [Multiple Service Instances](#multiple-service-instances)
+
+    ```{.nix hl_lines="14-17"}
+    buildClan {
+        inventory = {
+            machines = {
+                "backup_server" = {
+                    # Don't include any nixos config here
+                    # See inventory.Machines for available options
+                };
+                "jon" = {
+                    # Don't include any nixos config here
+                    # See inventory.Machines for available options
+                };
+            };
+            services = {
+                borgbackup.instance_1 = {
+                    roles.client.machines = [ "jon" ];
+                    roles.server.machines = [ "backup_server" ];
+                };
+            };
+        };
+    }
+    ```
+
+### Scalabling the Backup
+
+The inventory allows machines to set **Tags**
+
+It is possible to add services to multiple machines via tags. The service instance gets added in the specified role. In this case `role = "client"`
+
+!!! Example "Tags Example"
+
+    ```{.nix hl_lines="9 12 17"}
+    buildClan {
+        inventory = {
+            machines = {
+                "backup_server" = {
+                    # Don't include any nixos config here
+                    # See inventory.Machines for available options
+                };
+                "jon" = {
+                    tags = [ "backup" ];
+                };
+                "sara" = {
+                    tags = [ "backup" ];
+                };
+            };
+            services = {
+                borgbackup.instance_1 = {
+                    roles.client.tags = [ "backup" ];
+                    roles.server.machines = [ "backup_server" ];
+                };
+            };
+        };
+    }
+    ```
+
+### Multiple Service Instances
+
+!!! danger "Important"
+    Not all modules implement support for multiple instances yet.
+    Multiple instance usage could create complexity, refer to each modules documentation, for intended usage.
+
+!!! Example
+
+    In this example `backup_server` has role `client` and `server` in different instances.
+
+    ```{.nix hl_lines="11 14"}
+    buildClan {
+        inventory = {
+            machines = {
+                "jon" = {};
+                "backup_server" = {};
+                "backup_backup_server" = {}
+            };
+            services = {
+                borgbackup.instance_1 = {
+                    roles.client.machines = [ "jon" ];
+                    roles.server.machines = [ "backup_server" ];
+                };
+                borgbackup.instance_1 = {
+                    roles.client.machines = [ "backup_server" ];
+                    roles.server.machines = [ "backup_backup_server" ];
+                };
+            };
+        };
+    }
+    ```
+
+### API specification
+
+**The complete schema specification is available [here](../reference/nix-api/inventory.md)**
+
+Or it can build anytime via:
+
+```sh
+nix build git+https://git.clan.lol/clan/clan-core#inventory-schema
+> result
+> ├── schema.cue
+> └── schema.json
+```
--- a/docs/site/index.md
+++ b/docs/site/index.md
@ -12,17 +12,24 @@ Create your own clan with these initial steps and manage a fleet of machines wit
    curl --proto '=https' --tlsv1.2 -sSf -L https://install.determinate.systems/nix | sh -s -- install
    ```

-=== "**NixOS**"
-
-    If you run NixOS the `nix` binary is already installed.
-
-    You will also need to enable the `flakes` and `nix-commands` experimental features.
+    If you already have installed Nix, make sure you have the `nix-command` and `flakes` configuration enabled in your ~/.config/nix/nix.conf.
+    The determinate installer already comes with this configuration by default.

    ```bash
    # /etc/nix/nix.conf or ~/.config/nix/nix.conf
    experimental-features = nix-command flakes
    ```

+=== "**NixOS**"
+
+    If you run NixOS the `nix` binary is already installed.
+
+    You will also need to enable the `flakes` and `nix-commands` experimental features in your configuration.nix:
+
+    ```nix
+    { nix.settings.experimental-features = [ "nix-command" "flakes" ]; }
+    ```
+
 === "**Other**"

    Clan doesn't offer dedicated support for other operating systems yet.
--- a/docs/site/reference/index.md
+++ b/docs/site/reference/index.md
@ -0,0 +1,8 @@
+# Documentation
+
+This section of the site contains information about the following topics:
+
+- How to use the [Clan CLI](./cli/index.md)
+- Available services and application [modules](./clanModules/index.md)
+- [Configuration options](./clan-core/index.md) controlling the essential features
+- Descriptions of the [Nix interfaces](./nix-api/index.md) for defining a Clan
--- a/docs/site/reference/nix-api/buildclan.md
+++ b/docs/site/reference/nix-api/buildclan.md
@ -0,0 +1,29 @@
+# buildClan
+
+The core [function](https://git.clan.lol/clan/clan-core/src/branch/main/lib/build-clan/default.nix) that produces a Clan. It returns a set of consistent configurations for all machines with ready-to-use secrets, backups and other services.
+
+## Inputs
+
+`directory`
+: The directory containing the machines subdirectory
+
+`machines`
+: Allows to include machine-specific modules i.e. machines.${name} = { ... }
+
+`meta`
+: An optional set
+
+: `{ name :: string, icon :: string, description :: string }`
+
+`inventory`
+: Service set for easily configuring distributed services, such as backups
+
+: For more details see [Inventory](./inventory.md)
+
+`specialArgs`
+: Extra arguments to pass to nixosSystem i.e. useful to make self available
+
+`pkgsForSystem`
+: A function that maps from architecture to pkgs, if specified this nixpkgs will be only imported once for each system.
+  This improves performance, but all nipxkgs.* options will be ignored.
+  `(string -> pkgs )`
--- a/docs/site/reference/nix-api/index.md
+++ b/docs/site/reference/nix-api/index.md
@ -0,0 +1,6 @@
+# Nix API Overview
+
+There are two top-level components of the Nix API, which together allow for the declarative definition of a Clan:
+
+- the [Inventory](./inventory.md), a structure representing the machines, services, custom configurations, and other data that constitute a Clan, and
+- the [`buildClan`](./buildclan.md) function, which constructs a Clan from an Inventory definition.
--- a/docs/site/static/extra.css
+++ b/docs/site/static/extra.css
@ -1,13 +1,13 @@
@font-face {
-    font-family: "Roboto";
-    src: url(./Roboto-Regular.ttf) format('truetype');
+  font-family: "Roboto";
+  src: url(./Roboto-Regular.ttf) format("truetype");
 }
@font-face {
-    font-family: "Fira Code";
-    src: url(./FiraCode-VF.ttf) format('truetype');
+  font-family: "Fira Code";
+  src: url(./FiraCode-VF.ttf) format("truetype");
 }

 :root {
-    --md-text-font: "Roboto"; 
-    --md-code-font: "Fira Code";
-}
+  --md-text-font: "Roboto";
+  --md-code-font: "Fira Code";
+}
--- a/flake.lock
+++ b/flake.lock
@ -7,11 +7,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1718846788,
-        "narHash": "sha256-9dtXYtEkmXoUJV+PGLqscqF7qTn4AIhAKpFWRFU2NYs=",
+        "lastModified": 1723080788,
+        "narHash": "sha256-C5LbM5VMdcolt9zHeLQ0bYMRjUL+N+AL5pK7/tVTdes=",
        "owner": "nix-community",
        "repo": "disko",
-        "rev": "e1174d991944a01eaaa04bc59c6281edca4c0e6e",
+        "rev": "ffc1f95f6c28e1c6d1e587b51a2147027a3e45ed",
        "type": "github"
      },
      "original": {
@ -27,11 +27,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1717285511,
-        "narHash": "sha256-iKzJcpdXih14qYVcZ9QC9XuZYnPc6T8YImb6dX166kw=",
+        "lastModified": 1722555600,
+        "narHash": "sha256-XOQkdLafnb/p9ij77byFQjDf5m5QYl9b2REiVClC+x4=",
        "owner": "hercules-ci",
        "repo": "flake-parts",
-        "rev": "2a55567fcf15b1b1c7ed712a2c6fadaec7412ea8",
+        "rev": "8471fe90ad337a8074e957b69ca4d0089218391d",
        "type": "github"
      },
      "original": {
@ -40,29 +40,6 @@
        "type": "github"
      }
    },
-    "nixos-generators": {
-      "inputs": {
-        "nixlib": [
-          "nixpkgs"
-        ],
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1718025593,
-        "narHash": "sha256-WZ1gdKq/9u1Ns/oXuNsDm+W0salonVA0VY1amw8urJ4=",
-        "owner": "nix-community",
-        "repo": "nixos-generators",
-        "rev": "35c20ba421dfa5059e20e0ef2343c875372bdcf3",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "nixos-generators",
-        "type": "github"
-      }
-    },
    "nixos-images": {
      "inputs": {
        "nixos-stable": [],
@ -71,11 +48,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1718845599,
-        "narHash": "sha256-HbQ0iKohKJC5grC95HNjLxGPdgsc/BJgoENDYNbzkLo=",
+        "lastModified": 1724028934,
+        "narHash": "sha256-2M5dqS7UbAKfrO+1U+P/t5S2QIGbuGIsTNMYJzwB17g=",
        "owner": "nix-community",
        "repo": "nixos-images",
-        "rev": "c1e6a5f7b08f1c9993de1cfc5f15f838bf783b88",
+        "rev": "b733f0680a42cc01d6ad53896fb5ca40a66d5e79",
        "type": "github"
      },
      "original": {
@ -86,11 +63,11 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1719451888,
-        "narHash": "sha256-Ky0sgEEJMcBmNEJztY6KcVn+6bq74EKM7pd1CR1wnPQ=",
+        "lastModified": 1724137240,
+        "narHash": "sha256-VjbV/91spoYpl+fD7cK1asDhQIjJduP0lT+SgeXtcIc=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "3664857c48feacb35770c00abfdc671e55849be5",
+        "rev": "d2fa2514f041934a6aa261c66dc44829251cffd3",
        "type": "github"
      },
      "original": {
@ -104,10 +81,10 @@
      "inputs": {
        "disko": "disko",
        "flake-parts": "flake-parts",
-        "nixos-generators": "nixos-generators",
        "nixos-images": "nixos-images",
        "nixpkgs": "nixpkgs",
        "sops-nix": "sops-nix",
+        "systems": "systems",
        "treefmt-nix": "treefmt-nix"
      }
    },
@ -119,11 +96,11 @@
        "nixpkgs-stable": []
      },
      "locked": {
-        "lastModified": 1719111739,
-        "narHash": "sha256-kr2QzRrplzlCP87ddayCZQS+dhGW98kw2zy7+jUXtF4=",
+        "lastModified": 1723501126,
+        "narHash": "sha256-N9IcHgj/p1+2Pvk8P4Zc1bfrMwld5PcosVA0nL6IGdE=",
        "owner": "Mic92",
        "repo": "sops-nix",
-        "rev": "5e2e9421e9ed2b918be0a441c4535cfa45e04811",
+        "rev": "be0eec2d27563590194a9206f551a6f73d52fa34",
        "type": "github"
      },
      "original": {
@ -132,6 +109,21 @@
        "type": "github"
      }
    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
    "treefmt-nix": {
      "inputs": {
        "nixpkgs": [
@ -139,11 +131,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1718522839,
-        "narHash": "sha256-ULzoKzEaBOiLRtjeY3YoGFJMwWSKRYOic6VNw2UyTls=",
+        "lastModified": 1723808491,
+        "narHash": "sha256-rhis3qNuGmJmYC/okT7Dkc4M8CeUuRCSvW6kC2f3hBc=",
        "owner": "numtide",
        "repo": "treefmt-nix",
-        "rev": "68eb1dc333ce82d0ab0c0357363ea17c31ea1f81",
+        "rev": "1d07739554fdc4f8481068f1b11d6ab4c1a4167a",
        "type": "github"
      },
      "original": {
--- a/flake.nix
+++ b/flake.nix
@ -1,11 +1,6 @@
 {
  description = "clan.lol base operating system";

-  nixConfig.extra-substituters = [ "https://cache.clan.lol" ];
-  nixConfig.extra-trusted-public-keys = [
-    "cache.clan.lol-1:3KztgSAB5R1M+Dz7vzkBGzXdodizbgLXGXKXlcQLA28="
-  ];
-
  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable-small";
    disko.url = "github:nix-community/disko";
@ -13,21 +8,24 @@
    sops-nix.url = "github:Mic92/sops-nix";
    sops-nix.inputs.nixpkgs.follows = "nixpkgs";
    sops-nix.inputs.nixpkgs-stable.follows = "";
-    nixos-generators.url = "github:nix-community/nixos-generators";
-    nixos-generators.inputs.nixpkgs.follows = "nixpkgs";
-    nixos-generators.inputs.nixlib.follows = "nixpkgs";
    nixos-images.url = "github:nix-community/nixos-images";
    nixos-images.inputs.nixos-unstable.follows = "nixpkgs";
    # unused input
    nixos-images.inputs.nixos-stable.follows = "";
    flake-parts.url = "github:hercules-ci/flake-parts";
    flake-parts.inputs.nixpkgs-lib.follows = "nixpkgs";
+    systems.url = "github:nix-systems/default";
    treefmt-nix.url = "github:numtide/treefmt-nix";
    treefmt-nix.inputs.nixpkgs.follows = "nixpkgs";
  };

  outputs =
-    inputs@{ flake-parts, self, ... }:
+    inputs@{
+      flake-parts,
+      self,
+      systems,
+      ...
+    }:
    flake-parts.lib.mkFlake { inherit inputs; } (
      { ... }:
      {
@ -35,11 +33,7 @@
          meta.name = "clan-core";
          directory = self;
        };
-        systems = [
-          "x86_64-linux"
-          "aarch64-linux"
-          "aarch64-darwin"
-        ];
+        systems = import systems;
        imports = [
          ./checks/flake-module.nix
          ./clanModules/flake-module.nix
--- a/flakeModules/clan.nix
+++ b/flakeModules/clan.nix
@ -3,116 +3,34 @@ clan-core:
  config,
  lib,
  flake-parts-lib,
-  inputs,
  self,
+  inputs,
  ...
 }:
 let
-  inherit (lib) mkOption types;
-  buildClan = import ../lib/build-clan {
-    inherit lib clan-core;
-    inherit (inputs) nixpkgs;
-  };
-  cfg = config.clan;
+  inherit (lib) types;
 in
 {
-  imports = [
-    # TODO: figure out how to print the deprecation warning
-    # "${inputs.nixpkgs}/nixos/modules/misc/assertions.nix"
-    (lib.mkRenamedOptionModule
-      [
-        "clan"
-        "clanName"
-      ]
-      [
-        "clan"
-        "meta"
-        "name"
-      ]
-    )
-    (lib.mkRenamedOptionModule
-      [
-        "clan"
-        "clanIcon"
-      ]
-      [
-        "clan"
-        "meta"
-        "icon"
-      ]
-    )
-  ];

-  options.clan = {
-    directory = mkOption {
-      type = types.path;
-      description = "The directory containing the clan subdirectory";
-      default = self; # default to the directory of the flake
-    };
-    specialArgs = mkOption {
-      type = types.attrsOf types.raw;
-      default = { };
-      description = "Extra arguments to pass to nixosSystem i.e. useful to make self available";
-    };
-    machines = mkOption {
-      type = types.attrsOf types.raw;
-      default = { };
-      description = "Allows to include machine-specific modules i.e. machines.\${name} = { ... }";
-    };
-
-    # Checks are performed in 'buildClan'
-    # Not everyone uses flake-parts
-    meta = {
-      name = lib.mkOption {
-        type = types.nullOr types.str;
-        default = null;
-        description = "Needs to be (globally) unique, as this determines the folder name where the flake gets downloaded to.";
+  options.clan = lib.mkOption {
+    type = types.submoduleWith {
+      specialArgs = {
+        inherit clan-core self;
+        inherit (inputs) nixpkgs;
      };
-      icon = mkOption {
-        type = types.nullOr types.path;
-        default = null;
-        description = "A path to an icon to be used for the clan in the GUI";
-      };
-      description = mkOption {
-        type = types.nullOr types.str;
-        default = null;
-        description = "A short description of the clan";
-      };
-    };
-
-    pkgsForSystem = mkOption {
-      type = types.functionTo types.raw;
-      default = _system: null;
-      description = "A map from arch to pkgs, if specified this nixpkgs will be only imported once for each system.";
+      modules = [
+        ../lib/build-clan/interface.nix
+        ../lib/build-clan/module.nix
+      ];
    };
  };
-  options.flake = flake-parts-lib.mkSubmoduleOptions {
-    clanInternals = lib.mkOption {
-      type = lib.types.submodule {
-        options = {
-          inventory = lib.mkOption { type = lib.types.attrsOf lib.types.unspecified; };
-          inventoryFile = lib.mkOption { type = lib.types.unspecified; };

-          clanModules = lib.mkOption { type = lib.types.attrsOf lib.types.path; };
-          source = lib.mkOption { type = lib.types.path; };
-          meta = lib.mkOption { type = lib.types.attrsOf lib.types.unspecified; };
-          all-machines-json = lib.mkOption { type = lib.types.attrsOf lib.types.unspecified; };
-          machines = lib.mkOption { type = lib.types.attrsOf (lib.types.attrsOf lib.types.unspecified); };
-          machinesFunc = lib.mkOption { type = lib.types.attrsOf (lib.types.attrsOf lib.types.unspecified); };
-        };
-      };
-    };
+  options.flake = flake-parts-lib.mkSubmoduleOptions {
+    clanInternals = lib.mkOption { type = types.raw; };
  };
  config = {
-    flake = buildClan {
-      inherit (cfg)
-        directory
-        specialArgs
-        machines
-        pkgsForSystem
-        meta
-        ;
-    };
+    flake.clanInternals = config.clan.clanInternals;
+    flake.nixosConfigurations = config.clan.nixosConfigurations;
  };
  _file = __curPos.file;
 }
--- a/formatter.nix
+++ b/formatter.nix
@ -1,97 +1,80 @@
-{ lib, inputs, ... }:
+{ inputs, ... }:
 {
  imports = [ inputs.treefmt-nix.flakeModule ];
  perSystem =
    { self', pkgs, ... }:
    {
-      treefmt.projectRootFile = "flake.nix";
+      treefmt.projectRootFile = ".git/config";
      treefmt.programs.shellcheck.enable = true;

      treefmt.programs.mypy.enable = true;
-      treefmt.programs.mypy.directories = {
-        "pkgs/clan-cli".extraPythonPackages = self'.packages.clan-cli.testDependencies;
-        "pkgs/clan-app".extraPythonPackages =
-          # clan-app currently only exists on linux
-          (self'.packages.clan-app.externalTestDeps or [ ]) ++ self'.packages.clan-cli.testDependencies;
+      treefmt.programs.nixfmt.enable = true;
+      treefmt.programs.nixfmt.package = pkgs.nixfmt-rfc-style;
+      treefmt.programs.deadnix.enable = true;
+      treefmt.settings.global.excludes = [
+        "*.png"
+        "*.jpeg"
+        "*.gitignore"
+        ".vscode/*"
+        "*.toml"
+        "*.clan-flake"
+        "*.code-workspace"
+        "*.pub"
+        "*.typed"
+        "*.age"
+        "*.list"
+        "*.desktop"
+      ];
+      treefmt.programs.prettier = {
+        enable = true;
+        includes = [
+          "*.cjs"
+          "*.css"
+          "*.html"
+          "*.js"
+          "*.json5"
+          "*.jsx"
+          "*.mdx"
+          "*.mjs"
+          "*.scss"
+          "*.ts"
+          "*.tsx"
+          "*.vue"
+          "*.yaml"
+          "*.yml"
+        ];
+        # plugins = [
+        #   "${self'.packages.prettier-plugin-tailwindcss}/lib/node_modules/prettier-plugin-tailwindcss/dist/index.mjs"
+        # ];
      };
+      treefmt.programs.mypy.directories =
+        {
+          "pkgs/clan-cli" = {
+            extraPythonPackages = self'.packages.clan-cli.testDependencies;
+            modules = [ "clan_cli" ];
+          };
+          "pkgs/clan-app" = {
+            extraPythonPackages =
+              (self'.packages.clan-app.externalTestDeps or [ ]) ++ self'.packages.clan-cli.testDependencies;
+            extraPythonPaths = [ "../clan-cli" ];
+            modules = [ "clan_app" ];
+          };
+        }
+        // (
+          if pkgs.stdenv.isLinux then
+            {
+              "pkgs/clan-vm-manager" = {
+                extraPythonPackages =
+                  self'.packages.clan-vm-manager.externalTestDeps ++ self'.packages.clan-cli.testDependencies;
+                extraPythonPaths = [ "../clan-cli" ];
+                modules = [ "clan_vm_manager" ];
+              };
+            }
+          else
+            { }
+        );
+      treefmt.programs.ruff.check = true;
+      treefmt.programs.ruff.format = true;

-      treefmt.settings.formatter.nix = {
-        command = "sh";
-        options = [
-          "-eucx"
-          ''
-            # First deadnix
-            ${lib.getExe pkgs.deadnix} --edit "$@"
-            # Then nixpkgs-fmt
-            ${lib.getExe pkgs.nixfmt-rfc-style} "$@"
-          ''
-          "--" # this argument is ignored by bash
-        ];
-        includes = [ "*.nix" ];
-        excludes = [
-          # Was copied from nixpkgs. Keep diff minimal to simplify upstreaming.
-          "pkgs/builders/script-writers.nix"
-        ];
-      };
-      treefmt.settings.formatter.python = {
-        command = "sh";
-        options = [
-          "-eucx"
-          ''
-            ${lib.getExe pkgs.ruff} check --fix "$@"
-            ${lib.getExe pkgs.ruff} format "$@"
-          ''
-          "--" # this argument is ignored by bash
-        ];
-        includes = [ "*.py" ];
-      };
-      # FIXME: currently broken in CI
-      #treefmt.settings.formatter.vale =
-      #  let
-      #    vocab = "cLAN";
-      #    style = "Docs";
-      #    config = pkgs.writeText "vale.ini" ''
-      #      StylesPath = ${styles}
-      #      Vocab = ${vocab}
-
-      #      [*.md]
-      #      BasedOnStyles = Vale, ${style}
-      #      Vale.Terms = No
-      #    '';
-      #    styles = pkgs.symlinkJoin {
-      #      name = "vale-style";
-      #      paths = [
-      #        accept
-      #        headings
-      #      ];
-      #    };
-      #    accept = pkgs.writeTextDir "config/vocabularies/${vocab}/accept.txt" ''
-      #      Nix
-      #      NixOS
-      #      Nixpkgs
-      #      clan.lol
-      #      Clan
-      #      monorepo
-      #    '';
-      #    headings = pkgs.writeTextDir "${style}/headings.yml" ''
-      #      extends: capitalization
-      #      message: "'%s' should be in sentence case"
-      #      level: error
-      #      scope: heading
-      #      # $title, $sentence, $lower, $upper, or a pattern.
-      #      match: $sentence
-      #    '';
-      #  in
-      #  {
-      #    command = "${pkgs.vale}/bin/vale";
-      #    options = [ "--config=${config}" ];
-      #    includes = [ "*.md" ];
-      #    # TODO: too much at once, fix piecemeal
-      #    excludes = [
-      #      "docs/*"
-      #      "clanModules/*"
-      #      "pkgs/*"
-      #    ];
-      #  };
    };
 }
--- a/inventory.json
+++ b/inventory.json
@ -1,71 +1,96 @@
 {
+  "meta": {
+    "name": "clan-core",
+    "description": null,
+    "icon": null
+  },
  "machines": {
-    "minimal-inventory-machine": {
+    "test-inventory-machine": {
      "name": "foo",
-      "system": "x86_64-linux",
+      "deploy": {
+        "targetHost": null
+      },
      "description": "A nice thing",
      "icon": "./path/to/icon.png",
-      "tags": ["1", "2", "3"]
+      "tags": ["1", "2", "3"],
+      "system": "x86_64-linux"
    }
  },
  "services": {
    "packages": {
      "editors": {
        "meta": {
-          "name": "Some editor packages"
+          "name": "Some editor packages",
+          "description": null,
+          "icon": null
        },
        "roles": {
          "default": {
-            "machines": ["minimal-inventory-machine"]
+            "imports": [],
+            "machines": ["test-inventory-machine"],
+            "tags": []
          }
        },
+        "config": {},
+        "imports": [],
        "machines": {
-          "minimal-inventory-machine": {
+          "test-inventory-machine": {
            "config": {
              "packages": ["zed-editor"]
-            }
+            },
+            "imports": []
          }
-        },
-        "config": {
-          "packages": ["vim"]
        }
      },
      "browsing": {
        "meta": {
-          "name": "Web browsing packages"
+          "name": "Web browsing packages",
+          "description": null,
+          "icon": null
        },
        "roles": {
          "default": {
-            "machines": ["minimal-inventory-machine"]
+            "config": {},
+            "imports": [],
+            "machines": ["test-inventory-machine"],
+            "tags": []
          }
        },
+        "config": {},
+        "imports": [],
        "machines": {
-          "minimal-inventory-machine": {
+          "test-inventory-machine": {
            "config": {
              "packages": ["chromium"]
-            }
+            },
+            "imports": []
          }
-        },
-        "config": {
-          "packages": ["firefox"]
        }
      }
    },
    "single-disk": {
      "default": {
        "meta": {
-          "name": "single-disk"
+          "name": "single-disk",
+          "description": null,
+          "icon": null
        },
        "roles": {
          "default": {
-            "machines": ["minimal-inventory-machine"]
+            "config": {},
+            "imports": [],
+            "machines": ["test-inventory-machine"],
+            "tags": []
          }
        },
+        "config": {},
+        "imports": [],
        "machines": {
-          "minimal-inventory-machine": {
+          "test-inventory-machine": {
            "config": {
              "device": "/dev/null"
-            }
+            },
+            "imports": []
          }
        }
      }
--- a/lib/build-clan/default.nix
+++ b/lib/build-clan/default.nix
@ -1,259 +1,39 @@
+## WARNING: Do not add core logic here.
+## This is only a wrapper such that buildClan can be called as a function.
+## Add any logic to ./module.nix
 {
-  clan-core,
-  nixpkgs,
  lib,
+  nixpkgs,
+  clan-core,
 }:
 {
-  directory, # The directory containing the machines subdirectory
-  specialArgs ? { }, # Extra arguments to pass to nixosSystem i.e. useful to make self available
-  machines ? { }, # allows to include machine-specific modules i.e. machines.${name} = { ... }
-  # DEPRECATED: use meta.name instead
-  clanName ? null, # Needs to be (globally) unique, as this determines the folder name where the flake gets downloaded to.
-  # DEPRECATED: use meta.icon instead
-  clanIcon ? null, # A path to an icon to be used for the clan, should be the same for all machines
-  meta ? { }, # A set containing clan meta: name :: string, icon :: string, description :: string
+  ## Inputs
+  directory, # The directory containing the machines subdirectory # allows to include machine-specific modules i.e. machines.${name} = { ... }
  # A map from arch to pkgs, if specified this nixpkgs will be only imported once for each system.
  # This improves performance, but all nipxkgs.* options will be ignored.
-  pkgsForSystem ? (_system: null),
-  /*
-    Low level inventory configuration.
-    Overrides the services configuration.
-  */
+  # deadnix: skip
  inventory ? { },
-}:
+  ## Sepcial inputs (not passed to the module system as config)
+  specialArgs ? { }, # Extra arguments to pass to nixosSystem i.e. useful to make self available # A set containing clan meta: name :: string, icon :: string, description :: string
+  ##
+  ...
+}@attrs:
 let
-  # Internal inventory, this is the result of merging all potential inventory sources:
-  # - Default instances configured via 'services'
-  # - The inventory overrides
-  #   - Machines that exist in inventory.machines
-  # - Machines explicitly configured via 'machines' argument
-  # - Machines that exist in the machines directory
-  # Checks on the module level:
-  # - Each service role must reference a valid machine after all machines are merged
-  mergedInventory =
-    (lib.evalModules {
-      modules = [
-        clan-core.lib.inventory.interface
-        { inherit meta; }
-        (
-          if
-            builtins.pathExists "${directory}/inventory.json"
-          # Is recursively applied. Any explicit nix will override.
-          then
-            (builtins.fromJSON (builtins.readFile "${directory}/inventory.json"))
-          else
-            { }
-        )
-        inventory
-        # Machines explicitly configured via 'machines' argument
-        {
-          # { ${name} :: meta // { name, tags } }
-          machines = lib.mapAttrs (
-            name: config:
-            (lib.attrByPath [
-              "clan"
-              "meta"
-            ] { } config)
-            // {
-              # meta.name default is the attribute name of the machine
-              name = lib.mkDefault (
-                lib.attrByPath [
-                  "clan"
-                  "meta"
-                  "name"
-                ] name config
-              );
-              tags = lib.attrByPath [
-                "clan"
-                "tags"
-              ] [ ] config;
-
-              system = lib.attrByPath [
-                "nixpkgs"
-                "hostSystem"
-              ] null config;
-            }
-          ) machines;
-        }
-
-        # Will be deprecated
-        {
-          machines = lib.mapAttrs (
-            name: _:
-            # Use mkForce to make sure users migrate to the inventory system.
-            # When the settings.json exists the evaluation will print the deprecation warning.
-            lib.mkForce {
-              inherit name;
-              system = (machineSettings name).nixpkgs.hostSystem or null;
-            }
-          ) machinesDirs;
-        }
-
-        # Deprecated interface
-        (if clanName != null then { meta.name = clanName; } else { })
-        (if clanIcon != null then { meta.icon = clanIcon; } else { })
-      ];
-    }).config;
-
-  inherit (clan-core.lib.inventory) buildInventory;
-
-  # map from machine name to service configuration
-  # { ${machineName} :: Config }
-  serviceConfigs = buildInventory mergedInventory;
-
-  machinesDirs = lib.optionalAttrs (builtins.pathExists "${directory}/machines") (
-    builtins.readDir (directory + /machines)
-  );
-
-  machineSettings =
-    machineName:
-    let
-      warn = lib.warn ''
-        Usage of Settings.json is only supported for test compatibility.
-        !!! Consider using the inventory system. !!!
-
-        File: ${directory + /machines/${machineName}/settings.json}
-
-        If there are still features missing in the inventory system, please open an issue on the clan-core repository.
-      '';
-    in
-    # CLAN_MACHINE_SETTINGS_FILE allows to override the settings file temporarily
-    # This is useful for doing a dry-run before writing changes into the settings.json
-    # Using CLAN_MACHINE_SETTINGS_FILE requires passing --impure to nix eval
-    if builtins.getEnv "CLAN_MACHINE_SETTINGS_FILE" != "" then
-      warn (builtins.fromJSON (builtins.readFile (builtins.getEnv "CLAN_MACHINE_SETTINGS_FILE")))
-    else
-      lib.optionalAttrs (builtins.pathExists "${directory}/machines/${machineName}/settings.json") (
-        warn (builtins.fromJSON (builtins.readFile (directory + /machines/${machineName}/settings.json)))
-      );
-
-  machineImports =
-    machineSettings: map (module: clan-core.clanModules.${module}) (machineSettings.clanImports or [ ]);
-
-  deprecationWarnings = [
-    (lib.warnIf (
-      clanName != null
-    ) "clanName in buildClan is deprecated, please use meta.name instead." null)
-    (lib.warnIf (clanIcon != null) "clanIcon is deprecated, please use meta.icon instead" null)
-  ];
-
-  # TODO: remove default system once we have a hardware-config mechanism
-  nixosConfiguration =
-    {
-      system ? "x86_64-linux",
-      name,
-      pkgs ? null,
-      extraConfig ? { },
-    }:
-    nixpkgs.lib.nixosSystem {
-      modules =
-        let
-          settings = machineSettings name;
-        in
-        (machineImports settings)
-        ++ [
-          settings
-          clan-core.nixosModules.clanCore
-          extraConfig
-          (machines.${name} or { })
-          # Inherit the inventory assertions ?
-          { inherit (mergedInventory) assertions; }
-          { imports = serviceConfigs.${name} or { }; }
-          (
-            {
-              # Settings
-              clan.core.clanDir = directory;
-              # Inherited from clan wide settings
-              clan.core.clanName = meta.name or clanName;
-              clan.core.clanIcon = meta.icon or clanIcon;
-
-              # Machine specific settings
-              clan.core.machineName = name;
-              networking.hostName = lib.mkDefault name;
-              nixpkgs.hostPlatform = lib.mkDefault system;
-
-              # speeds up nix commands by using the nixpkgs from the host system (especially useful in VMs)
-              nix.registry.nixpkgs.to = {
-                type = "path";
-                path = lib.mkDefault nixpkgs;
-              };
-            }
-            // lib.optionalAttrs (pkgs != null) { nixpkgs.pkgs = lib.mkForce pkgs; }
-          )
-        ];
-      specialArgs = {
-        inherit clan-core;
-      } // specialArgs;
-    };
-
-  allMachines = mergedInventory.machines or { };
-
-  supportedSystems = [
-    "x86_64-linux"
-    "aarch64-linux"
-    "riscv64-linux"
-    "x86_64-darwin"
-    "aarch64-darwin"
-  ];
-
-  nixosConfigurations = lib.mapAttrs (name: _: nixosConfiguration { inherit name; }) allMachines;
-
-  # This instantiates nixos for each system that we support:
-  # configPerSystem = <system>.<machine>.nixosConfiguration
-  # We need this to build nixos secret generators for each system
-  configsPerSystem = builtins.listToAttrs (
-    builtins.map (
-      system:
-      lib.nameValuePair system (
-        lib.mapAttrs (
-          name: _:
-          nixosConfiguration {
-            inherit name system;
-            pkgs = pkgsForSystem system;
-          }
-        ) allMachines
-      )
-    ) supportedSystems
-  );
-
-  configsFuncPerSystem = builtins.listToAttrs (
-    builtins.map (
-      system:
-      lib.nameValuePair system (
-        lib.mapAttrs (
-          name: _: args:
-          nixosConfiguration (
-            args
-            // {
-              inherit name system;
-              pkgs = pkgsForSystem system;
-            }
-          )
-        ) allMachines
-      )
-    ) supportedSystems
-  );
-in
-builtins.deepSeq deprecationWarnings {
-  inherit nixosConfigurations;
-
-  clanInternals = {
-    inherit (clan-core) clanModules;
-    source = "${clan-core}";
-
-    meta = mergedInventory.meta;
-    inventory = mergedInventory;
-
-    inventoryFile = "${directory}/inventory.json";
-
-    # machine specifics
-    machines = configsPerSystem;
-    machinesFunc = configsFuncPerSystem;
-    all-machines-json = lib.mapAttrs (
-      system: configs:
-      nixpkgs.legacyPackages.${system}.writers.writeJSON "machines.json" (
-        lib.mapAttrs (_: m: m.config.system.clan.deployment.data) configs
-      )
-    ) configsPerSystem;
+  eval = import ./eval.nix {
+    inherit
+      lib
+      nixpkgs
+      specialArgs
+      clan-core
+      ;
+    self = directory;
  };
+  rest = builtins.removeAttrs attrs [ "specialArgs" ];
+in
+eval {
+  imports = [
+    rest
+    # implementation
+    ./module.nix
+  ];
 }
--- a/lib/build-clan/eval.nix
+++ b/lib/build-clan/eval.nix
@ -0,0 +1,19 @@
+{
+  lib,
+  nixpkgs,
+  clan-core,
+  specialArgs ? { },
+  self,
+}:
+# Returns a function that takes self, which should point to the directory of the flake
+module:
+(lib.evalModules {
+  specialArgs = {
+    inherit self clan-core nixpkgs;
+  };
+  modules = [
+    ./interface.nix
+    module
+    { inherit specialArgs; }
+  ];
+}).config
--- a/lib/build-clan/flake-module.nix
+++ b/lib/build-clan/flake-module.nix
@ -0,0 +1,41 @@
+{ self, inputs, ... }:
+let
+  inputOverrides = builtins.concatStringsSep " " (
+    builtins.map (input: " --override-input ${input} ${inputs.${input}}") (builtins.attrNames inputs)
+  );
+in
+{
+
+  perSystem =
+    {
+      pkgs,
+      lib,
+      system,
+      ...
+    }:
+    # let
+
+    # in
+    {
+
+      # Run: nix-unit --extra-experimental-features flakes --flake .#legacyPackages.x86_64-linux.evalTests
+      legacyPackages.evalTests-build-clan = import ./tests.nix {
+        inherit lib;
+        inherit (inputs) nixpkgs;
+        clan-core = self;
+        buildClan = self.lib.buildClan;
+      };
+      checks = {
+        lib-build-clan-eval = pkgs.runCommand "tests" { nativeBuildInputs = [ pkgs.nix-unit ]; } ''
+          export HOME="$(realpath .)"
+
+          nix-unit --eval-store "$HOME" \
+            --extra-experimental-features flakes \
+            ${inputOverrides} \
+            --flake ${self}#legacyPackages.${system}.evalTests-build-clan
+
+          touch $out
+        '';
+      };
+    };
+}
--- a/lib/build-clan/interface.nix
+++ b/lib/build-clan/interface.nix
@ -0,0 +1,74 @@
+{ lib, self, ... }:
+let
+  types = lib.types;
+in
+{
+  options = {
+    # Required options
+    directory = lib.mkOption {
+      type = types.path;
+      default = self;
+      description = "The directory containing the clan subdirectory";
+    };
+
+    specialArgs = lib.mkOption {
+      type = types.attrsOf types.raw;
+      default = { };
+      description = "Extra arguments to pass to nixosSystem i.e. useful to make self available";
+    };
+
+    # Optional
+    machines = lib.mkOption {
+      type = types.attrsOf types.deferredModule;
+      default = { };
+    };
+    inventory = lib.mkOption {
+      type = types.submodule { imports = [ ../inventory/build-inventory/interface.nix ]; };
+    };
+
+    # Meta
+    meta = lib.mkOption {
+      type = types.nullOr (
+        types.submodule {
+          options = {
+            name = lib.mkOption {
+              type = types.nullOr types.str;
+              description = "Needs to be (globally) unique, as this determines the folder name where the flake gets downloaded to.";
+            };
+          };
+        }
+      );
+      default = null;
+    };
+
+    pkgsForSystem = lib.mkOption {
+      type = types.functionTo (types.nullOr types.attrs);
+      default = _: null;
+    };
+
+    # Outputs
+    nixosConfigurations = lib.mkOption {
+      type = types.lazyAttrsOf types.raw;
+      default = { };
+    };
+    # flake.clanInternals
+    clanInternals = lib.mkOption {
+      # type = types.raw;
+      # ClanInternals
+      type = types.submodule {
+        options = {
+          # Those options are interfaced by the CLI
+          # We don't speficy the type here, for better performance.
+          inventory = lib.mkOption { type = lib.types.raw; };
+          inventoryFile = lib.mkOption { type = lib.types.raw; };
+          clanModules = lib.mkOption { type = lib.types.raw; };
+          source = lib.mkOption { type = lib.types.raw; };
+          meta = lib.mkOption { type = lib.types.raw; };
+          all-machines-json = lib.mkOption { type = lib.types.raw; };
+          machines = lib.mkOption { type = lib.types.raw; };
+          machinesFunc = lib.mkOption { type = lib.types.raw; };
+        };
+      };
+    };
+  };
+}
--- a/lib/build-clan/module.nix
+++ b/lib/build-clan/module.nix
@ -0,0 +1,228 @@
+{
+  config,
+  clan-core,
+  nixpkgs,
+  lib,
+  ...
+}:
+let
+  inherit (config)
+    directory
+    machines
+    pkgsForSystem
+    specialArgs
+    ;
+
+  inherit (config.clanInternals) inventory;
+
+  inherit (clan-core.lib.inventory) buildInventory;
+
+  # map from machine name to service configuration
+  # { ${machineName} :: Config }
+  serviceConfigs = (
+    buildInventory {
+      inherit inventory;
+      inherit directory;
+    }
+  );
+
+  machineSettings =
+    machineName:
+    let
+      warn = lib.warn ''
+        The use of ./machines/<machine>/settings.json is deprecated.
+        If your settings.json is empty, you can safely remove it.
+        !!! Consider using the inventory system. !!!
+
+        File: ${directory + /machines/${machineName}/settings.json}
+
+        If there are still features missing in the inventory system, please open an issue on the clan-core repository.
+      '';
+    in
+    # CLAN_MACHINE_SETTINGS_FILE allows to override the settings file temporarily
+    # This is useful for doing a dry-run before writing changes into the settings.json
+    # Using CLAN_MACHINE_SETTINGS_FILE requires passing --impure to nix eval
+    if builtins.getEnv "CLAN_MACHINE_SETTINGS_FILE" != "" then
+      warn (builtins.fromJSON (builtins.readFile (builtins.getEnv "CLAN_MACHINE_SETTINGS_FILE")))
+    else
+      lib.optionalAttrs (builtins.pathExists "${directory}/machines/${machineName}/settings.json") (
+        warn (builtins.fromJSON (builtins.readFile (directory + /machines/${machineName}/settings.json)))
+      );
+
+  machineImports =
+    machineSettings: map (module: clan-core.clanModules.${module}) (machineSettings.clanImports or [ ]);
+
+  # TODO: remove default system once we have a hardware-config mechanism
+  nixosConfiguration =
+    {
+      system ? "x86_64-linux",
+      name,
+      pkgs ? null,
+      extraConfig ? { },
+    }:
+    nixpkgs.lib.nixosSystem {
+      modules =
+        let
+          settings = machineSettings name;
+        in
+        (machineImports settings)
+        ++ [
+          {
+            # Autoinclude configuration.nix and hardware-configuration.nix
+            imports = builtins.filter builtins.pathExists [
+              "${directory}/machines/${name}/configuration.nix"
+              "${directory}/machines/${name}/hardware-configuration.nix"
+            ];
+          }
+          settings
+          clan-core.nixosModules.clanCore
+          extraConfig
+          (machines.${name} or { })
+          # Inherit the inventory assertions ?
+          # { inherit (mergedInventory) assertions; }
+          { imports = serviceConfigs.${name} or [ ]; }
+          (
+            {
+              # Settings
+              clan.core.clanDir = directory;
+              # Inherited from clan wide settings
+              # TODO: remove these
+              clan.core.name = config.inventory.meta.name;
+              clan.core.icon = config.inventory.meta.icon;
+
+              # Machine specific settings
+              clan.core.machineName = name;
+              networking.hostName = lib.mkDefault name;
+              nixpkgs.hostPlatform = lib.mkDefault system;
+
+              # speeds up nix commands by using the nixpkgs from the host system (especially useful in VMs)
+              nix.registry.nixpkgs.to = {
+                type = "path";
+                path = lib.mkDefault nixpkgs;
+              };
+            }
+            // lib.optionalAttrs (pkgs != null) { nixpkgs.pkgs = lib.mkForce pkgs; }
+          )
+        ];
+
+      specialArgs = {
+        inherit clan-core;
+      } // specialArgs;
+    };
+
+  # TODO: Will be deprecated
+  # We must migrate the tests, that create a settings.json to add a machine.
+  ##################################################
+  testMachines =
+    lib.mapAttrs
+      (name: _: {
+        inherit name;
+        system = (machineSettings name).nixpkgs.hostSystem or null;
+      })
+      (
+        lib.filterAttrs (
+          machineName: _:
+          if builtins.pathExists "${directory}/machines/${machineName}/settings.json" then
+            lib.warn ''
+              The use of ./machines/<machine>/settings.json is deprecated.
+              If your settings.json is empty, you can safely remove it.
+              !!! Consider using the inventory system. !!!
+
+              File: ${directory + /machines/${machineName}/settings.json}
+
+              If there are still features missing in the inventory system, please open an issue on the clan-core repository.
+            '' true
+          else
+            false
+        ) machinesDirs
+      );
+  machinesDirs = lib.optionalAttrs (builtins.pathExists "${directory}/machines") (
+    builtins.readDir (directory + /machines)
+  );
+  ##################################################
+
+  allMachines = inventory.machines or { } // config.machines or { } // testMachines;
+
+  supportedSystems = [
+    "x86_64-linux"
+    "aarch64-linux"
+    "riscv64-linux"
+    "x86_64-darwin"
+    "aarch64-darwin"
+  ];
+
+  nixosConfigurations = lib.mapAttrs (name: _: nixosConfiguration { inherit name; }) allMachines;
+
+  # This instantiates nixos for each system that we support:
+  # configPerSystem = <system>.<machine>.nixosConfiguration
+  # We need this to build nixos secret generators for each system
+  configsPerSystem = builtins.listToAttrs (
+    builtins.map (
+      system:
+      lib.nameValuePair system (
+        lib.mapAttrs (
+          name: _:
+          nixosConfiguration {
+            inherit name system;
+            pkgs = pkgsForSystem system;
+          }
+        ) allMachines
+      )
+    ) supportedSystems
+  );
+
+  configsFuncPerSystem = builtins.listToAttrs (
+    builtins.map (
+      system:
+      lib.nameValuePair system (
+        lib.mapAttrs (
+          name: _: args:
+          nixosConfiguration (
+            args
+            // {
+              inherit name system;
+              pkgs = pkgsForSystem system;
+            }
+          )
+        ) allMachines
+      )
+    ) supportedSystems
+  );
+
+  inventoryFile = "${directory}/inventory.json";
+
+  inventoryLoaded =
+    if builtins.pathExists inventoryFile then
+      (builtins.fromJSON (builtins.readFile inventoryFile))
+    else
+      { };
+in
+{
+  imports = [
+    # Merge the inventory file
+    { inventory = inventoryLoaded; }
+    # Merge the meta attributes from the buildClan function
+    { inventory.meta = if config.meta != null then config.meta else { }; }
+  ];
+
+  inherit nixosConfigurations;
+
+  clanInternals = {
+    inherit (clan-core) clanModules;
+    inherit inventoryFile;
+    inventory = config.inventory;
+    meta = config.inventory.meta;
+
+    source = "${clan-core}";
+
+    # machine specifics
+    machines = configsPerSystem;
+    machinesFunc = configsFuncPerSystem;
+    all-machines-json = lib.mapAttrs (
+      system: configs:
+      nixpkgs.legacyPackages.${system}.writers.writeJSON "machines.json" (
+        lib.mapAttrs (_: m: m.config.system.clan.deployment.data) configs
+      )
+    ) configsPerSystem;
+  };
+}
--- a/lib/build-clan/tests.nix
+++ b/lib/build-clan/tests.nix
@ -0,0 +1,153 @@
+{
+  lib,
+  nixpkgs,
+  clan-core,
+  buildClan,
+  ...
+}:
+let
+  evalClan = import ./eval.nix {
+    inherit lib nixpkgs clan-core;
+    self = ./.;
+  };
+in
+#######
+{
+  test_only_required =
+    let
+      config = evalClan {
+        meta.name = "test";
+        imports = [ ./module.nix ];
+      };
+    in
+    {
+      expr = config.inventory ? meta;
+      expected = true;
+    };
+
+  test_all_simple =
+    let
+      config = evalClan {
+        directory = ./.;
+        machines = { };
+        inventory = {
+          meta.name = "test";
+        };
+        pkgsForSystem = _system: { };
+      };
+    in
+    {
+      expr = config ? inventory;
+      expected = true;
+    };
+
+  test_outputs_clanInternals =
+    let
+      config = evalClan {
+        imports = [
+          # What the user needs to specif
+          {
+            directory = ./.;
+            inventory.meta.name = "test";
+          }
+
+          ./module.nix
+          # Explicit output, usually defined by flake-parts
+          { options.nixosConfigurations = lib.mkOption { type = lib.types.raw; }; }
+        ];
+      };
+    in
+    {
+      expr = config.clanInternals.meta;
+      expected = {
+        description = null;
+        icon = null;
+        name = "test";
+      };
+    };
+
+  test_fn_simple =
+    let
+      result = buildClan {
+        directory = ./.;
+        meta.name = "test";
+      };
+    in
+    {
+      expr = result.clanInternals.meta;
+      expected = {
+        description = null;
+        icon = null;
+        name = "test";
+      };
+    };
+
+  test_fn_extensiv_meta =
+    let
+      result = buildClan {
+        directory = ./.;
+        meta.name = "test";
+        meta.description = "test";
+        meta.icon = "test";
+        inventory.meta.name = "superclan";
+        inventory.meta.description = "description";
+        inventory.meta.icon = "icon";
+      };
+    in
+    {
+      expr = result.clanInternals.meta;
+      expectedError = {
+        type = "ThrownError";
+        msg = "";
+      };
+    };
+
+  test_fn_clan_core =
+    let
+      result = buildClan {
+        directory = ../../.;
+        meta.name = "test-clan-core";
+      };
+    in
+    {
+      expr = builtins.attrNames result.nixosConfigurations;
+      expected = [ "test-inventory-machine" ];
+    };
+
+  test_buildClan_all_machines =
+    let
+      result = buildClan {
+        directory = ./.;
+        meta.name = "test";
+        inventory.machines.machine1.meta.name = "machine1";
+
+        machines.machine2 = { };
+
+      };
+    in
+    {
+      expr = builtins.attrNames result.nixosConfigurations;
+      expected = [
+        "machine1"
+        "machine2"
+      ];
+    };
+
+  test_buildClan_specialArgs =
+    let
+      result = buildClan {
+        directory = ./.;
+        meta.name = "test";
+        specialArgs.foo = "dream2nix";
+        machines.machine2 =
+          { foo, ... }:
+          {
+            networking.hostName = foo;
+          };
+      };
+    in
+    {
+      expr = result.nixosConfigurations.machine2.config.networking.hostName;
+      expected = "dream2nix";
+    };
+}
--- a/lib/default.nix
+++ b/lib/default.nix
@ -6,7 +6,7 @@
 }:
 {
  evalClanModules = import ./eval-clan-modules { inherit clan-core nixpkgs lib; };
-  buildClan = import ./build-clan { inherit clan-core lib nixpkgs; };
+  buildClan = import ./build-clan { inherit lib nixpkgs clan-core; };
  facts = import ./facts.nix { inherit lib; };
  inventory = import ./inventory { inherit lib clan-core; };
  jsonschema = import ./jsonschema { inherit lib; };
--- a/lib/eval-clan-modules/default.nix
+++ b/lib/eval-clan-modules/default.nix
@ -12,7 +12,7 @@ let
    imports = (import (pkgs.path + "/nixos/modules/module-list.nix")) ++ [
      {
        nixpkgs.hostPlatform = "x86_64-linux";
-        clan.core.clanName = "dummy";
+        clan.core.name = "dummy";
      }
    ];
  };
--- a/lib/facts.nix
+++ b/lib/facts.nix
@ -1,15 +1,15 @@
 { lib, ... }:
-machineDir:
+clanDir:
 let

-  allMachineNames = lib.mapAttrsToList (name: _: name) (builtins.readDir machineDir);
+  allMachineNames = lib.mapAttrsToList (name: _: name) (builtins.readDir clanDir);

-  getFactPath = fact: machine: "${machineDir}/${machine}/facts/${fact}";
+  getFactPath = machine: fact: "${clanDir}/machines/${machine}/facts/${fact}";

  readFact =
-    fact: machine:
+    machine: fact:
    let
-      path = getFactPath fact machine;
+      path = getFactPath machine fact;
    in
    if builtins.pathExists path then builtins.readFile path else null;

@ -24,7 +24,7 @@ let
    fact:
    let
      machines = allMachineNames;
-      facts = lib.genAttrs machines (readFact fact);
+      facts = lib.genAttrs machines (machine: readFact machine fact);
      filteredFacts = lib.filterAttrs (_machine: fact: fact != null) facts;
    in
    filteredFacts;
@ -51,7 +51,7 @@ let
    let
      # machine -> fact -> factvalue
      machinesFactsAttrs = lib.genAttrs allMachineNames (
-        machine: lib.genAttrs facts (fact: readFact fact machine)
+        machine: lib.genAttrs facts (fact: readFact machine fact)
      );
      # remove all machines which don't have all facts set
      filteredMachineFactAttrs = lib.filterAttrs (
--- a/lib/flake-module.nix
+++ b/lib/flake-module.nix
@ -8,6 +8,7 @@
  imports = [
    ./jsonschema/flake-module.nix
    ./inventory/flake-module.nix
+    ./build-clan/flake-module.nix
  ];
  flake.lib = import ./default.nix {
    inherit lib inputs;
--- a/lib/inventory/.envrc
+++ b/lib/inventory/.envrc
@ -1,3 +1,4 @@
+# shellcheck shell=bash
 source_up

 watch_file flake-module.nix
--- a/lib/inventory/build-inventory/assertions.nix
+++ b/lib/inventory/build-inventory/assertions.nix
@ -0,0 +1,77 @@
+# Integrity validation of the inventory
+{ config, lib, ... }:
+{
+  # Assertion must be of type
+  #  { assertion :: bool, message :: string, severity :: "error" | "warning" }
+  imports = [
+    # Check that each machine used in a service is defined in the top-level machines
+    {
+      assertions = lib.foldlAttrs (
+        ass1: serviceName: c:
+        ass1
+        ++ lib.foldlAttrs (
+          ass2: instanceName: instanceConfig:
+          let
+            topLevelMachines = lib.attrNames config.machines;
+            # All machines must be defined in the top-level machines
+            assertions = lib.foldlAttrs (
+              assertions: roleName: role:
+              assertions
+              ++ builtins.filter (a: !a.assertion) (
+                builtins.map (m: {
+                  assertion = builtins.elem m topLevelMachines;
+                  message = ''
+                    Machine '${m}' is not defined in the inventory. This might still work, if the machine is defined via nix.
+
+                    Defined in service: '${serviceName}' instance: '${instanceName}' role: '${roleName}'.
+
+                    Inventory machines:
+                    ${builtins.concatStringsSep "\n" (map (n: "'${n}'") topLevelMachines)}
+                  '';
+                  severity = "warning";
+                }) role.machines
+              )
+            ) [ ] instanceConfig.roles;
+          in
+          ass2 ++ assertions
+        ) [ ] c
+      ) [ ] config.services;
+    }
+    # Check that each tag used in a role is defined in at least one machines tags
+    {
+      assertions = lib.foldlAttrs (
+        ass1: serviceName: c:
+        ass1
+        ++ lib.foldlAttrs (
+          ass2: instanceName: instanceConfig:
+          let
+            allTags = lib.foldlAttrs (
+              tags: _machineName: machine:
+              tags ++ machine.tags
+            ) [ ] config.machines;
+            # All machines must be defined in the top-level machines
+            assertions = lib.foldlAttrs (
+              assertions: roleName: role:
+              assertions
+              ++ builtins.filter (a: !a.assertion) (
+                builtins.map (m: {
+                  assertion = builtins.elem m allTags;
+                  message = ''
+                    Tag '${m}' is not defined in the inventory.
+
+                    Defined in service: '${serviceName}' instance: '${instanceName}' role: '${roleName}'.
+
+                    Available tags:
+                    ${builtins.concatStringsSep "\n" (map (n: "'${n}'") allTags)}
+                  '';
+                  severity = "error";
+                }) role.tags
+              )
+            ) [ ] instanceConfig.roles;
+          in
+          ass2 ++ assertions
+        ) [ ] c
+      ) [ ] config.services;
+    }
+  ];
+}
--- a/lib/inventory/build-inventory/default.nix
+++ b/lib/inventory/build-inventory/default.nix
@ -1,13 +1,17 @@
 # Generate partial NixOS configurations for every machine in the inventory
 # This function is responsible for generating the module configuration for every machine in the inventory.
 { lib, clan-core }:
-inventory:
 let
-  machines = machinesFromInventory inventory;
-
  resolveTags =
    # Inventory, { machines :: [string], tags :: [string] }
-    inventory: members: {
+    {
+      serviceName,
+      instanceName,
+      roleName,
+      inventory,
+      members,
+    }:
+    {
      machines =
        members.machines or [ ]
        ++ (builtins.foldl' (
@ -17,14 +21,17 @@ let
            availableTags = lib.foldlAttrs (
              acc: _: v:
              v.tags or [ ] ++ acc
-            ) [ ] inventory.machines;
+            ) [ ] (inventory.machines);

            tagMembers = builtins.attrNames (
              lib.filterAttrs (_n: v: builtins.elem tag v.tags or [ ]) inventory.machines
            );
          in
          if tagMembers == [ ] then
-            throw "Tag: '${tag}' not found. Available tags: ${builtins.toJSON (lib.unique availableTags)}"
+            throw ''
+              inventory.services.${serviceName}.${instanceName}: - ${roleName} tags: no machine with tag '${tag}' found.
+              Available tags: ${builtins.toJSON (lib.unique availableTags)}
+            ''
          else
            acc ++ tagMembers
        ) [ ] members.tags or [ ]);
@ -35,15 +42,48 @@ let

    machinesFromInventory :: Inventory -> { ${machine_name} :: NixOSConfiguration }
  */
-  machinesFromInventory =
+
+  # { client_1_machine = { tags = [ "backup" ]; }; client_2_machine = { tags = [ "backup" ]; }; not_used_machine = { }; }
+  getAllMachines =
    inventory:
+    lib.foldlAttrs (
+      res: serviceName: serviceConfigs:
+      (lib.foldlAttrs (
+        res: instanceName: serviceConfig:
+        lib.foldlAttrs (
+          res: roleName: members:
+          let
+            resolved = resolveTags {
+              inherit
+                serviceName
+                instanceName
+                roleName
+                inventory
+                members
+                ;
+            };
+          in
+          res
+          // builtins.listToAttrs (
+            builtins.map (m: {
+              name = m;
+              value = { };
+            }) resolved.machines
+          )
+        ) res serviceConfig.roles
+      ) res serviceConfigs)
+    ) { } (inventory.services or { })
+    // inventory.machines or { };
+
+  buildInventory =
+    { inventory, directory }:
    # For every machine in the inventory, build a NixOS configuration
    # For each machine generate config, forEach service, if the machine is used.
    builtins.mapAttrs (
      machineName: machineConfig:
      lib.foldlAttrs (
        # [ Modules ], String, { ${instance_name} :: ServiceConfig }
-        acc: moduleName: serviceConfigs:
+        acc: serviceName: serviceConfigs:
        acc
        # Collect service config
        ++ (lib.foldlAttrs (
@ -51,7 +91,16 @@ let
          acc2: instanceName: serviceConfig:
          let
            resolvedRoles = builtins.mapAttrs (
-              _roleName: members: resolveTags inventory members
+              roleName: members:
+              resolveTags {
+                inherit
+                  serviceName
+                  instanceName
+                  roleName
+                  inventory
+                  members
+                  ;
+              }
            ) serviceConfig.roles;

            isInService = builtins.any (members: builtins.elem machineName members.machines) (
@ -72,30 +121,48 @@ let
            machineServiceConfig = (serviceConfig.machines.${machineName} or { }).config or { };
            globalConfig = serviceConfig.config or { };

+            globalImports = serviceConfig.imports or [ ];
+            machineImports = serviceConfig.machines.${machineName}.imports or [ ];
+            roleServiceImports = builtins.foldl' (
+              acc: role: acc ++ serviceConfig.roles.${role}.imports or [ ]
+            ) [ ] inverseRoles.${machineName} or [ ];
+
            # TODO: maybe optimize this dont lookup the role in inverse roles. Imports are not lazy
            roleModules = builtins.map (
              role:
              let
-                path = "${clan-core.clanModules.${moduleName}}/roles/${role}.nix";
+                path = "${clan-core.clanModules.${serviceName}}/roles/${role}.nix";
              in
              if builtins.pathExists path then
                path
              else
                throw "Module doesn't have role: '${role}'. Path: ${path} not found."
            ) inverseRoles.${machineName} or [ ];
+
+            roleServiceConfigs = builtins.map (
+              role: serviceConfig.roles.${role}.config or { }
+            ) inverseRoles.${machineName} or [ ];
+
+            customImports = map (s: "${directory}/${s}") (
+              globalImports ++ machineImports ++ roleServiceImports
+            );
          in
+
          if isInService then
            acc2
            ++ [
              {
-                imports = [ clan-core.clanModules.${moduleName} ] ++ roleModules;
-                config.clan.${moduleName} = lib.mkMerge [
-                  globalConfig
-                  machineServiceConfig
-                ];
+                imports = [ clan-core.clanModules.${serviceName} ] ++ roleModules ++ customImports;
+                config.clan.${serviceName} = lib.mkMerge (
+                  [
+                    globalConfig
+                    machineServiceConfig
+                  ]
+                  ++ roleServiceConfigs
+                );
              }
              {
-                config.clan.inventory.services.${moduleName}.${instanceName} = {
+                config.clan.inventory.services.${serviceName}.${instanceName} = {
                  roles = resolvedRoles;
                  # TODO: Add inverseRoles to the service config if needed
                  # inherit inverseRoles;
@ -111,7 +178,12 @@ let
        (lib.optionalAttrs (machineConfig.system or null != null) {
          config.nixpkgs.hostPlatform = machineConfig.system;
        })
+        (lib.optionalAttrs (machineConfig.deploy.targetHost or null != null) {
+          config.clan.core.networking.targetHost = machineConfig.deploy.targetHost;
+        })
      ]
-    ) inventory.machines or { };
+    ) (getAllMachines inventory);
 in
-machines
+{
+  inherit buildInventory getAllMachines;
+}
--- a/lib/inventory/build-inventory/interface.nix
+++ b/lib/inventory/build-inventory/interface.nix
@ -1,136 +1,130 @@
 { config, lib, ... }:
 let
-  t = lib.types;
+  types = lib.types;

  metaOptions = {
-    name = lib.mkOption { type = t.str; };
+    name = lib.mkOption { type = types.str; };
    description = lib.mkOption {
      default = null;
-      type = t.nullOr t.str;
+      type = types.nullOr types.str;
    };
    icon = lib.mkOption {
      default = null;
-      type = t.nullOr t.str;
+      type = types.nullOr types.str;
    };
  };

-  machineRef = lib.mkOptionType {
-    name = "machineRef";
-    description = "Machine :: [${builtins.concatStringsSep " | " (builtins.attrNames config.machines)}]";
-    check = v: lib.isString v && builtins.elem v (builtins.attrNames config.machines);
-    merge = lib.mergeEqualOption;
+  moduleConfig = lib.mkOption {
+    default = { };
+    type = types.attrsOf types.anything;
  };

-  allTags = lib.unique (
-    lib.foldlAttrs (
-      tags: _: m:
-      tags ++ m.tags or [ ]
-    ) [ ] config.machines
-  );
+  importsOption = lib.mkOption {
+    description = ''
+      List of imported '.nix' files.

-  tagRef = lib.mkOptionType {
-    name = "tagRef";
-    description = "Tags :: [${builtins.concatStringsSep " | " allTags}]";
-    check = v: lib.isString v && builtins.elem v allTags;
-    merge = lib.mergeEqualOption;
+          Each filename must be a string and is interpreted relative to the 'directory' passed to buildClan.
+          The import only happens if the machine is part of the service or role.
+
+          ## Example
+
+          To import the `special.nix` file
+
+          ```
+          . Clan Directory
+          ├── flake.nix
+          ...
+          └── modules
+              ├── special.nix
+              └── ...
+          ```
+
+          ```nix
+          {
+            imports = [ "modules/special.nix" ];
+          }
+          ```
+
+    '';
+    default = [ ];
+    type = types.listOf types.str;
  };
 in
 {
-  options.assertions = lib.mkOption {
-    type = t.listOf t.unspecified;
-    internal = true;
-    default = [ ];
-  };
-  config.assertions =
-    let
-      serviceAssertions = lib.foldlAttrs (
-        ass1: serviceName: c:
-        ass1
-        ++ lib.foldlAttrs (
-          ass2: instanceName: instanceConfig:
-          let
-            serviceMachineNames = lib.attrNames instanceConfig.machines;
-            topLevelMachines = lib.attrNames config.machines;
-            # All machines must be defined in the top-level machines
-            assertions = builtins.map (m: {
-              assertion = builtins.elem m topLevelMachines;
-              message = "${serviceName}.${instanceName}.machines.${m}. Should be one of [ ${builtins.concatStringsSep " | " topLevelMachines} ]";
-            }) serviceMachineNames;
-          in
-          ass2 ++ assertions
-        ) [ ] c
-      ) [ ] config.services;
-      machineAssertions = map (
-        { name, value }:
-        {
-          assertion = true;
-          message = "Machine ${name} should define its host system in the inventory. ()";
-        }
-      ) (lib.attrsToList (lib.filterAttrs (_n: v: v.system or null == null) config.machines));
-    in
-    machineAssertions ++ serviceAssertions;
+  imports = [ ./assertions.nix ];
+  options = {
+    assertions = lib.mkOption {
+      type = types.listOf types.unspecified;
+      internal = true;
+      visible = false;
+      default = [ ];
+    };
+    meta = metaOptions;

-  options.meta = metaOptions;
+    machines = lib.mkOption {
+      default = { };
+      type = types.attrsOf (
+        types.submodule {
+          options = {
+            inherit (metaOptions) name description icon;
+            tags = lib.mkOption {

-  options.machines = lib.mkOption {
-    default = { };
-    type = t.attrsOf (
-      t.submodule {
-        options = {
-          inherit (metaOptions) name description icon;
-          tags = lib.mkOption {
-            default = [ ];
-            apply = lib.unique;
-            type = t.listOf t.str;
-          };
-          system = lib.mkOption {
-            default = null;
-            type = t.nullOr t.str;
-          };
-        };
-      }
-    );
-  };
-
-  options.services = lib.mkOption {
-    default = { };
-    type = t.attrsOf (
-      t.attrsOf (
-        t.submodule {
-          options.meta = metaOptions;
-          options.config = lib.mkOption {
-            default = { };
-            type = t.anything;
-          };
-          options.machines = lib.mkOption {
-            default = { };
-            type = t.attrsOf (
-              t.submodule {
-                options.config = lib.mkOption {
-                  default = { };
-                  type = t.anything;
-                };
-              }
-            );
-          };
-          options.roles = lib.mkOption {
-            default = { };
-            type = t.attrsOf (
-              t.submodule {
-                options.machines = lib.mkOption {
-                  default = [ ];
-                  type = t.listOf machineRef;
-                };
-                options.tags = lib.mkOption {
-                  default = [ ];
-                  apply = lib.unique;
-                  type = t.listOf tagRef;
-                };
-              }
-            );
+              default = [ ];
+              apply = lib.unique;
+              type = types.listOf types.str;
+            };
+            system = lib.mkOption {
+              default = null;
+              type = types.nullOr types.str;
+            };
+            deploy.targetHost = lib.mkOption {
+              description = "Configuration for the deployment of the machine";
+              default = null;
+              type = types.nullOr types.str;
+            };
          };
        }
-      )
-    );
+      );
+    };
+
+    services = lib.mkOption {
+      default = { };
+      type = types.attrsOf (
+        types.attrsOf (
+          types.submodule {
+            options.meta = metaOptions;
+            options.imports = importsOption;
+            options.config = moduleConfig;
+            options.machines = lib.mkOption {
+              default = { };
+              type = types.attrsOf (
+                types.submodule {
+                  options.imports = importsOption;
+                  options.config = moduleConfig;
+                }
+              );
+            };
+            options.roles = lib.mkOption {
+              default = { };
+              type = types.attrsOf (
+                types.submodule {
+                  options.machines = lib.mkOption {
+                    default = [ ];
+                    type = types.listOf types.str;
+                  };
+                  options.tags = lib.mkOption {
+                    default = [ ];
+                    apply = lib.unique;
+                    type = types.listOf types.str;
+                  };
+                  options.config = moduleConfig;
+                  options.imports = importsOption;
+                }
+              );
+            };
+          }
+        )
+      );
+    };
  };
 }
--- a/Show More
+++ b/Show More
				`@ -0,0 +1 @@`
				`AGE-SECRET-KEY-1UCXEUJH6JXF8LFKWFHDM4N9AQE2CCGQZGXLUNV4TKR5KY0KC8FDQ2TY4NX`