Commit b024a47

@@ -8,6 +8,7 @@
     '';
 
     pubKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINy57YGTUNEbBVs1YHD6m/zhJnJKnicNEaLB5fEcJln6 root@hyacine";
+    settings.core.openssh.access.port = 22876;
 
     rootHashedPasswordFileAged = ./hashed-password.age;
   };

@@ -0,0 +1,8 @@
+age-encryption.org/v1
+-> piv-p256 xCEwtQ AgJPDBPjvK7iBZ9xqx2bGHL2THC+kmEsn1z1K++gh/pe
++YsNXSt1Uy60RcP9rO7lEYefnt4bnHPeYnMhZ9D/vs8
+-> 0Zs6Wv{--grease :p~DL%7 Tp.F
+JyGO5EfwN/HkbwjqGZlaEAK9cJgMPYMJ3Kid0Fwzwvo3A2t45zVucPuSpl5eMsrm
+qUjLeANFfCIpKA8KyISQb5ykpneZtY78cA
+--- TZ4F9+sIYayfx8n+DAxUEiOtRXqZZmM8KjIygNGZBjY
+a�q�f<��6��W�1��w����կ�h-e��R?'l�o��[����
\ No newline at end of file

@@ -0,0 +1,50 @@
+{
+  den.hosts.hyacine = {
+    address = {
+      ipv4.secret = {
+        name = "host-ipv4-hyacine";
+        file = ./ipv4.age;
+      };
+    };
+  };
+
+  den.aspects.hyacine = {
+    nixos = {config, ...}: {
+      boot.kernelParams = [
+        "net.ifnames=0" # Useless in VPS
+      ];
+
+      networking = {
+        useNetworkd = true;
+        useDHCP = false;
+      };
+
+      systemd.network.networks = {
+        "40-eth0" = {
+          matchConfig.Name = "eth0";
+          linkConfig.RequiredForOnline = "routable";
+        };
+      };
+
+      environment.etc."systemd/network/40-eth0.network.d/99-address-n-routes.conf" = {
+        source = config.vaultix.templates.networkd-secrets.path;
+      };
+
+      vaultix.templates.networkd-secrets = {
+        content = ''
+          [Network]
+          Address=${config.vaultix.placeholder.host-ipv4-hyacine}/24
+
+          [Route]
+          Gateway=${config.vaultix.placeholder.host-gateway4-hyacine}
+          Destination=0.0.0.0/0
+        '';
+        owner = "systemd-network";
+        group = "systemd-network";
+        mode = "0440";
+      };
+      vaultix.secrets.host-ipv4-hyacine.file = ./ipv4.age;
+      vaultix.secrets.host-gateway4-hyacine.file = ./gateway4.age;
+    };
+  };
+}

@@ -0,0 +1,7 @@
+{
+  den.aspects.kevin = {
+    nixos = {
+      networking.networkmanager.enable = true;
+    };
+  };
+}

@@ -0,0 +1,7 @@
+{
+  den.aspects.mobius = {
+    nixos = {
+      networking.networkmanager.enable = true;
+    };
+  };
+}

@@ -0,0 +1,86 @@
+{
+  den.aspects.tribios = {
+    nixos = {
+      boot.kernel.sysctl = {
+        "net.ipv4.ip_forward" = 1;
+      };
+
+      # Tribios' network interfaces:
+      # wan: enP3p49s0 (2.5Gbps)
+      # lan: enP4p65s0 (2.5Gbps), end0 (1.0Gbps)
+      # Automatically configurated by nixos-factor.
+      networking = {
+        useNetworkd = true;
+        bridges = {
+          br-lan = {
+            interfaces = ["enP4p65s0" "end0"];
+          };
+        };
+        interfaces = {
+          br-lan = {
+            useDHCP = false;
+            ipv4.addresses = [
+              {
+                address = "192.168.52.1";
+                prefixLength = 24;
+              }
+            ];
+          };
+        };
+
+        firewall = {
+          enable = true;
+          trustedInterfaces = ["br-lan"];
+        };
+
+        nat = {
+          enable = true;
+          internalInterfaces = ["br-lan"];
+          externalInterface = "enP3p49s0";
+        };
+      };
+
+      # NAT-PMP for Tailscale NAT traversal.
+      # Tailscale clients behind this router will auto-request
+      # endpoint-independent port mappings, enabling direct
+      # connections from the company network (192.168.100.x).
+      services.miniupnpd = {
+        enable = true;
+        externalInterface = "enP3p49s0";
+        internalIPs = ["br-lan"];
+        upnp = false;
+        natpmp = true;
+      };
+
+      services.kea.dhcp4 = {
+        enable = true;
+        settings = {
+          interfaces-config.interfaces = ["br-lan"];
+          lease-database = {
+            name = "/var/lib/kea/dhcp4.leases";
+            persist = true;
+            type = "memfile";
+          };
+          valid-lifetime = 4000;
+          subnet4 = [
+            {
+              id = 1;
+              subnet = "192.168.52.0/24";
+              pools = [{pool = "192.168.52.2 - 192.168.52.200";}];
+              option-data = [
+                {
+                  name = "routers";
+                  data = "192.168.52.1";
+                }
+                {
+                  name = "domain-name-servers";
+                  data = "223.5.5.5, 119.29.29.29";
+                }
+              ];
+            }
+          ];
+        };
+      };
+    };
+  };
+}

@@ -102,6 +102,47 @@
         type = lib.types.nullOr lib.types.path;
         default = null;
       };
+
+      address = {
+        ipv4 = {
+          clearText = lib.mkOption {
+            description = "Clear text of public IPv4 address for this host.";
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+          };
+          secret = {
+            name = lib.mkOption {
+              description = "Secret name of public IPv4 address for this host.";
+              type = lib.types.nullOr lib.types.str;
+              default = null;
+            };
+            file = lib.mkOption {
+              description = "Secret file of public IPv4 address for this host.";
+              type = lib.types.nullOr lib.types.path;
+              default = null;
+            };
+          };
+        };
+        ipv6 = {
+          clearText = lib.mkOption {
+            description = "Clear text of public IPv6 address for this host.";
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+          };
+          secret = {
+            name = lib.mkOption {
+              description = "Secret name of public IPv6 address for this host.";
+              type = lib.types.nullOr lib.types.str;
+              default = null;
+            };
+            file = lib.mkOption {
+              description = "Secret file of public IPv6 address for this host.";
+              type = lib.types.nullOr lib.types.path;
+              default = null;
+            };
+          };
+        };
+      };
     };
   };
 }

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 PtFVIA 813M++MR2sO2iMyNj2nivQPY7G2DyJMnijHNcuX3t3A
+LGCUKAuo98stn/pZLUvhoZa+TxSsGmL2PA0Swf7b71s
+-> "&-grease /Zf_]*DX
+2F04uxFsc+OQHUMFhkpZgkJbYFqgeATZ5H6DHqk
+--- uJvUv6ykDps3jt5Degh70ptI1CuCFXU3WbSCeqyqeOg
+�ߌ�Ӧ7"�:�ܵ�_H>�њ�I�6l�������d\�EG_�6�H
\ No newline at end of file

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 PtFVIA cLPjxO2jjNF1C47aIb0684aedP6I5P8icd5qTfQaWgY
+oyiJr7emH/YUbmrKVhE2+7KP458djEP0eroL77XazIo
+-> 3Dj-grease %G/*df
+exQ8Jxi1sBYepZ26iSWs5GqgrYj5ja7oeE4
+--- z3l+awOPwpCYM70jjm7Jycdo0mNFjOwh5D9odz/LU9c
+�6e=����ޕ%G���'2D嫔L����}�L���v����
\ No newline at end of file