schallerclan/clan.nix

# https://docs.clan.lol
{
  meta = {
    name = "schallerclan";
    domain = "clan";
  };

  inventory.machines = {
    "barebonej3160".tags = [
      "impermanance"
      "interactive"
      "serve_dns"
    ];
    "darkbase900".tags = [
      "impermanance"
      "interactive"
      "users"
    ];
    "minisforumhm80".tags = [
      "impermanance"
      "interactive"
      "night-sleep"
      "users"
    ];
  };

  inventory.instances = {
    sshd = {
      roles.server.settings = {
        authorizedKeys = {
          "david@DavidDESKTOP" =
            "***REMOVED_SSH-PUBLICKEY***";
          "david@DavidLEGION" =
            "***REMOVED_SSH-PUBLICKEY***";
        };
      };

      roles.server.tags = [ "all" ];
    };

    root = {
      # password
      module.name = "users";
      roles.default.tags = [ "all" ];
    };

    #
    # Networking
    #
    # https://docs.clan.lol/guides/networking/networking/
    internet = {
      roles.default.machines."barebonej3160".settings.host = "barebonej3160.tail67c8bb.ts.net";
      roles.default.machines."darkbase900".settings.host = "darkbase900.tail67c8bb.ts.net";
      roles.default.machines."minisforumhm80".settings.host = "minisforumhm80.tail67c8bb.ts.net";
    };

    tailscale = {
      module.input = "self";
      module.name = "@schallerclan/tailscale";

      roles.default.machines."barebonej3160" = { };
      roles.default.machines."darkbase900" = { };
      roles.default.machines."minisforumhm80" = { };
    };

    tor = {
      roles.client.tags = [ "all" ];
      roles.server = {
        tags = [ "all" ];
        settings = {
          secretHostname = false;
          portMapping = [
            {
              port = 6443; # yggdrasil TCP
              target.port = 6443;
            }
            {
              port = 6446; # yggdrasil TLS
              target.port = 6446;
            }
          ];
        };
      };
    };

    dns = {
      module.name = "@schallerclan/dns";
      module.input = "self";

      roles.server = {
        tags = [ "serve_dns" ];
        extraModules = [ modules/blocky.nix ];
      };

      roles.default = {
        tags = [ "all" ];
        machines = {
          "barebonej3160".settings.extraRecords = {
            A = [
              "***REMOVED_IPv4***" # lan
              "***REMOVED_IPv4***" # tailscale
            ];
            AAAA = [
              "***REMOVED_IPv6***" # lan
              "***REMOVED_IPv6***" # tailscale
            ];
          };
          "darkbase900".settings.extraRecords = {
            A = [
              "***REMOVED_IPv4***" # lan
              "***REMOVED_IPv4***" # tailscale
            ];
            AAAA = [
              "***REMOVED_IPv6***" # lan
              "***REMOVED_IPv6***" # tailscale
            ];
          };
          "minisforumhm80".settings.extraRecords = {
            A = [
              "***REMOVED_IPv4***" # lan
              "***REMOVED_IPv4***" # tailscale
            ];
            AAAA = [
              "***REMOVED_IPv6***" # lan
              "***REMOVED_IPv6***" # tailscale
            ];
          };
        };
      };
    };

    #
    # Modules & Services
    #
    base = {
      module.name = "importer";
      roles.default.tags = [ "all" ];
      roles.default.extraModules = [
        modules/base/boot.nix
        modules/base/environment.nix
        modules/base/firewall.nix
        modules/base/locale.nix
        modules/base/nix.nix
        modules/base/time.nix
      ];
    };

    fish = {
      module.name = "importer";
      roles.default.tags = [ "interactive" ];
      roles.default.extraModules = [ modules/fish.nix ];
    };

    impermanance = {
      module.name = "importer";
      roles.default.tags = [ "impermanance" ];
      roles.default.extraModules = [ modules/impermanance.nix ];
    };

    week-night-sleep = {
      module.name = "@schallerclan/sleep";
      module.input = "self";

      roles.default.tags = [ "night-sleep" ];
      roles.default.settings = {
        mode = "poweroff";
        sleepAt = "Sun..Thu ***REMOVED_IPv6***";
        wakeAt = "tomorrow ***REMOVED_IPv6***";
      };
    };
    week-night-sleep-2 = {
      module.name = "@schallerclan/sleep";
      module.input = "self";

      roles.default.tags = [ "night-sleep" ];
      roles.default.settings = {
        mode = "poweroff";
        sleepAt = "Mon..Fri 00..***REMOVED_IPv6***";
        wakeAt = "***REMOVED_IPv6***";
      };
    };
    weekend-night-sleep = {
      module.name = "@schallerclan/sleep";
      module.input = "self";

      roles.default.tags = [ "night-sleep" ];
      roles.default.settings = {
        mode = "poweroff";
        sleepAt = "Sat,Sun 01..***REMOVED_IPv6***";
        wakeAt = "***REMOVED_IPv6***";
      };
    };

    poweroff = {
      module.name = "@schallerclan/poweroff";
      module.input = "self";

      roles.at.machines."darkbase900".settings.time = "***REMOVED_IPv6***";
      roles.idle.machines."darkbase900".settings.uptime = 30;
    };

    wakeonlan = {
      module.name = "@schallerclan/wakeonlan";
      module.input = "self";

      roles.target.machines."barebonej3160".settings.interfaces = [
        "00:E***REMOVED_IPv6***B:9F"
        "00:E***REMOVED_IPv6***B:A0"
        "00:E***REMOVED_IPv6***B:A1"
        "00:E***REMOVED_IPv6***B:A2"
      ];
      roles.target.machines."darkbase900".settings.interfaces = [
        "D8:BB:C***REMOVED_IPv6***:A8"
      ];
      roles.target.machines."minisforumhm80".settings.interfaces = [
        "1C***REMOVED_IPv6***:BF:7B"
        "1C***REMOVED_IPv6***:BE:A7"
      ];

      roles.source.tags = [ "all" ];
    };

    garage = {
      # roles.default.machines."server" = { };
      roles.default.extraModules = [ modules/garage.nix ];
    };

    quadlets = {
      module.name = "@schallerclan/quadlets";
      module.input = "self";

      roles.default.machines."barebonej3160".settings.quadlets = [
        quadlets/ca-files.nix
        quadlets/whoami.nix
      ];
      roles.default.machines."minisforumhm80".settings.quadlets = [
        quadlets/bitwarden.nix
        quadlets/glance.nix
        quadlets/searxng.nix
        quadlets/syncthing.nix
        quadlets/vikunja.nix
      ];
    };

    pki = {
      roles.default.tags = [ "all" ];
    };

    #
    # Backups
    #
    localbackup = {
      roles.default.machines = {
        "barebonej3160".settings.targets."varlib".directory = "/var/lib/localbackup";
        "minisforumhm80".settings.targets."varlib".directory = "/var/lib/localbackup";
      };
    };

    borgbackup = {
      roles.client = {
        settings.exclude = [ ];

        # destinations ^= externalDestinations
        machines = {
          "barebonej3160".settings.destinations = {
            "schallernetz-magentacloud" = {
              repo = "/mnt/schallernetz-magentacloud/SchallerclanBACKUPS/barebonej3160";
            };
          };
          "minisforumhm80" = { };
        };

        extraModules = [
          modules/borgbackup/schallernetz-magentacloud.nix
          {
            config.systemd.services = {
              "borgbackup-job-darkbase900".environment.BORG_RELOCATED_REPO_ACCESS_IS_OK = "yes";
            };
          }
        ];
      };

      roles.server.machines = {
        "darkbase900" = { };
      };
    };

    #
    # Users
    #
    david = {
      module.name = "users";

      roles.default = {
        tags = [ "users" ];
        settings = {
          share = true;
          openssh.authorizedKeys.keys = [
            "***REMOVED_SSH-PUBLICKEY*** david@DavidDESKTOP"
            "***REMOVED_SSH-PUBLICKEY*** david@DavidLEGION"
          ];
        };
      };
    };

    timon = {
      module.name = "users";

      roles.default = {
        tags = [ "users" ];
        settings = {
          share = true;
          openssh.authorizedKeys.keys = [ ];
        };
      };
    };
  };
}