Commit 4f98813

@@ -0,0 +1,8 @@
+age-encryption.org/v1
+-> ssh-ed25519 7JvPpg FEt0KbFb2jae5QAc/QbVZuuhLiOiZXMIhYNqQWdq7FM
+0VUAjX1903JB+RAdeYjBFXvC1g/OslFuKAMD/fapF4U
+-> Lf92-grease
+Y2jl1k2juttgGqZ6gEWHdpbkV7wTGGMaPtKJw2fehh80tmE2FKhFUBLl7uK72sx0
+
+--- iaLvbyl4K7ljkVMhv5yvVVRcJsd7sMvqYBZh3GkrO5g
+I.C$q9D8��xN���B+��}h͍��(�~�����ؘ�L������D�r*t
\ No newline at end of file

@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> ssh-ed25519 7JvPpg /XHpFm/PKIh0vGjQK2kHGTXPbFzeEm6K/u3bI77pKTs
+rvMQ90aLUh9DK7wEUYiFTcZcRMfOzP6SoN5S1/iGfb0
+-> ~-grease -KD6|
+KwkvSw4q22iELAsf3pITgroojv4JWZnwPguwcuWNqMbzgax7i+D3eMxi7auNR/c0
+PIzUz7cQ8hLiRC5U3nDwJAB83GZhvv8Db4Oxz0amUVyxnNzh4QDC8dVLhZSgoslQ
+Wg
+--- aHozlnQksehF4ZvkGpyDS8ntJp7DQlcjjtTSyUfz5ys
+�P3^��� K����:N��71��'�E��-�^�ieN�N�p��R
\ No newline at end of file

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 diaafw z/puoY7ooZ3bMnJNuwW2UDt5tFliLudWtu3NxddvQyM
+0CwTA9TfBfSP8QfDJiW7fIxLiM+tBttTG3hmkL+lf1A
+-> -^7<%0/d-grease
+zmRYcR9Gu1hQyHPDhoZYqjHvpn/Enu2qCK01PqyuTuQvurjxwnIa
+--- FYsfmfxL85DfRZ8glKhHdEya44rWA15BglOP0ceslH8
+K��P�,6V����N�-��߭k���w�ϛ�FMS�R��m�`9}7݉
\ No newline at end of file

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 diaafw jduS8+z8VhjHaW+UPiyzDek5mnGo5adlOp9TgKTO5As
+hKbjaGodPnLqC11C2ErG3mkSe0GYOfRimpuY9AikjKw
+-> \AvL$9i^-grease
+U8Pt3g
+--- K/lBgBjSk9VNmD362ol04GtbxVrwBiDsasqJpuz/f18
+<�M�ÓkZ)}A��|.aM1u^n)�"z�������gӷ�����
\ No newline at end of file

@@ -0,0 +1,8 @@
+age-encryption.org/v1
+-> piv-p256 xCEwtQ ArU3eThOqr380hU4DH3Yo1TjDBiE7vK6jEJVQz2JvWjk
+gCdoSyqnLwKO2DubUjR3m3Pq90pLQu3Eq0331frXiFg
+-> X`F'E^5-grease ?;K% ^k=A,xm PzxXB@ ~<d?ha.
+q8+1+opjWxH/DTtE6iTNt+Uf37yf0Bb9kz6mX248HR9fJH8zV6Cu5zBpRKxzQ0Mg
+1/9wPkkjjIozl63816PQGOVyCzxBKtuNqcLQBBLVkpeREpDyojrB5n65q7ilbQ
+--- yYjw1kdjPSmkKZ02/DG82P5l7FbdVh26katZ71VIu8o
+U��X�irk��)@X�{yFKg�1Np���K߮����D��U�a�
\ No newline at end of file

@@ -0,0 +1,52 @@
+{
+  den.hosts.cyrene = {
+    address = {
+      ipv4.secret = {
+        name = "host-ipv4-cyrene";
+        file = ./ipv4.age;
+      };
+      ipv6.secret = {
+        name = "host-ipv6-cyrene";
+        file = ./ipv6.age;
+      };
+    };
+  };
+
+  den.aspects.cyrene = {
+    nixos = {
+      host,
+      config,
+      ...
+    }: {
+      networking = {
+        useNetworkd = true;
+        useDHCP = false;
+        usePredictableInterfaceNames = false; # Useless in VPS
+      };
+
+      systemd.network.networks = {
+        "40-eth0" = {
+          matchConfig.Name = "eth0";
+          linkConfig.RequiredForOnline = "routable";
+        };
+      };
+
+      environment.etc."systemd/network/40-eth0.network.d/99-address-n-routes.conf" = {
+        source = config.vaultix.templates.networkd-secrets.path;
+      };
+
+      vaultix.templates.networkd-secrets = {
+        content = ''
+          [Network]
+          Address=${config.vaultix.placeholder.${host.address.ipv4.secret.name}}/22
+          Address=${config.vaultix.placeholder.${host.address.ipv6.secret.name}}/64
+        '';
+        owner = "systemd-network";
+        group = "systemd-network";
+        mode = "0440";
+      };
+      vaultix.secrets.${host.address.ipv4.secret.name}.file = host.address.ipv4.secret.file;
+      vaultix.secrets.${host.address.ipv6.secret.name}.file = host.address.ipv6.secret.file;
+    };
+  };
+}

@@ -0,0 +1,8 @@
+age-encryption.org/v1
+-> piv-p256 xCEwtQ AgJPDBPjvK7iBZ9xqx2bGHL2THC+kmEsn1z1K++gh/pe
++YsNXSt1Uy60RcP9rO7lEYefnt4bnHPeYnMhZ9D/vs8
+-> 0Zs6Wv{--grease :p~DL%7 Tp.F
+JyGO5EfwN/HkbwjqGZlaEAK9cJgMPYMJ3Kid0Fwzwvo3A2t45zVucPuSpl5eMsrm
+qUjLeANFfCIpKA8KyISQb5ykpneZtY78cA
+--- TZ4F9+sIYayfx8n+DAxUEiOtRXqZZmM8KjIygNGZBjY
+a�q�f<��6��W�1��w����կ�h-e��R?'l�o��[����
\ No newline at end of file

@@ -0,0 +1,51 @@
+{
+  den.hosts.hyacine = {
+    address = {
+      ipv4.secret = {
+        name = "host-ipv4-hyacine";
+        file = ./ipv4.age;
+      };
+    };
+  };
+
+  den.aspects.hyacine = {
+    nixos = {
+      host,
+      config,
+      ...
+    }: {
+      networking = {
+        useNetworkd = true;
+        useDHCP = false;
+        usePredictableInterfaceNames = false; # Useless in VPS
+      };
+
+      systemd.network.networks = {
+        "40-eth0" = {
+          matchConfig.Name = "eth0";
+          linkConfig.RequiredForOnline = "routable";
+        };
+      };
+
+      environment.etc."systemd/network/40-eth0.network.d/99-address-n-routes.conf" = {
+        source = config.vaultix.templates.networkd-secrets.path;
+      };
+
+      vaultix.templates.networkd-secrets = {
+        content = ''
+          [Network]
+          Address=${config.vaultix.placeholder.${host.address.ipv4.secret.name}}/24
+
+          [Route]
+          Gateway=${config.vaultix.placeholder.host-gateway4-hyacine}
+          Destination=0.0.0.0/0
+        '';
+        owner = "systemd-network";
+        group = "systemd-network";
+        mode = "0440";
+      };
+      vaultix.secrets.${host.address.ipv4.secret.name}.file = host.address.ipv4.secret.file;
+      vaultix.secrets.host-gateway4-hyacine.file = ./gateway4.age;
+    };
+  };
+}

@@ -0,0 +1,7 @@
+{
+  den.aspects.kevin = {
+    nixos = {
+      networking.networkmanager.enable = true;
+    };
+  };
+}

@@ -0,0 +1,7 @@
+{
+  den.aspects.mobius = {
+    nixos = {
+      networking.networkmanager.enable = true;
+    };
+  };
+}

@@ -0,0 +1,93 @@
+{
+  den.aspects.tribios = {
+    nixos = {
+      boot.kernel.sysctl = {
+        "net.ipv4.ip_forward" = 1;
+        "net.ipv4.conf.all.send_redirects" = 0;
+        "net.ipv4.conf.default.send_redirects" = 0;
+        "net.ipv4.conf.br-lan.send_redirects" = 0;
+        "net.ipv6.conf.all.forwarding" = 1;
+        "net.ipv6.conf.br-lan.forwarding" = 1;
+      };
+
+      # Tribios' network interfaces:
+      # wan: enP3p49s0 (2.5Gbps)
+      # lan: enP4p65s0 (2.5Gbps), end0 (1.0Gbps)
+      # Automatically configurated by nixos-factor.
+      networking = {
+        useNetworkd = true;
+        bridges = {
+          br-lan = {
+            interfaces = ["enP4p65s0" "end0"];
+          };
+        };
+        interfaces = {
+          br-lan = {
+            useDHCP = false;
+            ipv4.addresses = [
+              {
+                address = "192.168.52.1";
+                prefixLength = 24;
+              }
+            ];
+          };
+        };
+
+        firewall = {
+          enable = true;
+          trustedInterfaces = ["br-lan"];
+        };
+
+        nat = {
+          enable = true;
+          internalInterfaces = ["br-lan"];
+          externalInterface = "enP3p49s0";
+        };
+      };
+
+      # NAT-PMP for Tailscale NAT traversal.
+      # Tailscale clients behind this router will auto-request
+      # endpoint-independent port mappings, enabling direct
+      # connections from the company network (192.168.100.x).
+      services.miniupnpd = {
+        enable = true;
+        externalInterface = "enP3p49s0";
+        internalIPs = ["br-lan"];
+        upnp = false;
+        natpmp = true;
+      };
+
+      systemd.services.miniupnpd.after = ["systemd-networkd.service"];
+
+      services.kea.dhcp4 = {
+        enable = true;
+        settings = {
+          interfaces-config.interfaces = ["br-lan"];
+          lease-database = {
+            name = "/var/lib/kea/dhcp4.leases";
+            persist = true;
+            type = "memfile";
+          };
+          valid-lifetime = 4000;
+          subnet4 = [
+            {
+              id = 1;
+              subnet = "192.168.52.0/24";
+              pools = [{pool = "192.168.52.2 - 192.168.52.200";}];
+              option-data = [
+                {
+                  name = "routers";
+                  data = "192.168.52.1";
+                }
+                {
+                  name = "domain-name-servers";
+                  data = "223.5.5.5, 119.29.29.29";
+                }
+              ];
+            }
+          ];
+        };
+      };
+    };
+  };
+}

@@ -1,6 +1,30 @@
-{
+{lib, ...}: {
   den.schema.host = {
     options = {
+      address = let
+        ipvXOptions = ver: {
+          clearText = lib.mkOption {
+            description = "Clear text of public IPv${toString ver} address for this host.";
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+          };
+          secret = {
+            name = lib.mkOption {
+              description = "Secret name of public IPv${toString ver} address for this host.";
+              type = lib.types.nullOr lib.types.str;
+              default = null;
+            };
+            file = lib.mkOption {
+              description = "Secret file of public IPv${toString ver} address for this host.";
+              type = lib.types.nullOr lib.types.path;
+              default = null;
+            };
+          };
+        };
+      in {
+        ipv4 = ipvXOptions 4;
+        ipv6 = ipvXOptions 6;
+      };
     };
   };
 }