An overhaul of the module system.

config/modules/home/settings.nix

@@ -1,14 +1,9 @@
-{ sources, ... }:
-
-{
-  imports = [
+{ sources, ... }: {
+  external = [
     (import (sources.arcexprs + "/modules")).home-manager
     (import (sources.katexprs + "/modules")).home
     (import (sources.impermanence + "/home-manager.nix"))
     (import sources.anicca).modules.home
-    ./deploy.nix
-    ./theme.nix
-    ./secrets.nix
     (sources.tf-nix + "/modules/home/secrets.nix")
   ];
 }

config/modules/meta/default.nix

@@ -1,9 +0,0 @@
-{ ... }:
-
-{
-  imports = [
-    ./imports.nix
-    ./deploy.nix
-    ./network.nix
-  ];
-}

config/modules/meta/network.nix

@@ -59,8 +59,7 @@ with lib;
     nixos = {
       extraModules = [
         "${toString sources.home-manager}/nixos"
-        ../../modules/nixos
-      ];
+      ] ++ singleton meta.modules.nixos;
       specialArgs = {
         inherit (config.network) nodes;
         inherit sources meta;

config/modules/nixos/default.nix

@@ -1,27 +0,0 @@
-{ meta, sources, lib, ... }:
-
-{
-  imports =
-    [
-      (import (sources.arcexprs + "/modules")).nixos
-      (import (sources.katexprs + "/modules")).nixos
-      (import (sources.impermanence + "/nixos.nix"))
-      (import sources.anicca).modules.nixos
-      ./deploy.nix
-      ./monitoring.nix
-      ./secrets.nix
-      (sources.tf-nix + "/modules/nixos/secrets.nix")
-      (sources.tf-nix + "/modules/nixos/secrets-users.nix")
-      (sources.hexchen + "/modules/network/yggdrasil")
-    ];
-
-  options.hexchen.dns = lib.mkOption { };
-  options.hexchen.deploy = lib.mkOption { };
-
-  /*
-    This maps hosts to network.nodes from the meta config. This is required for hexchen's yggdrasil network module.
-  */
-  config = {
-    _module.args.hosts = lib.mapAttrs (_: config: { inherit config; }) meta.network.nodes;
-  };
-}

config/modules/nixos/settings.nix

@@ -0,0 +1,13 @@
+{ sources, ... }: {
+  external = [
+    (import (sources.arcexprs + "/modules")).nixos
+    (import (sources.katexprs + "/modules")).nixos
+    (import (sources.impermanence + "/nixos.nix"))
+    (import sources.anicca).modules.nixos
+    (sources.tf-nix + "/modules/nixos/secrets.nix")
+    (sources.tf-nix + "/modules/nixos/secrets-users.nix")
+  ];
+  excludes = [
+    "oracle"
+  ];
+}

config/modules/nixos/yggdrasil.nix

@@ -0,0 +1,155 @@
+{ config, meta, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.network.yggdrasil;
+  calcAddr = pubkey: lib.readFile (pkgs.runCommandNoCC "calcaddr-${pubkey}" {} ''
+    echo '{ EncryptionPublicKey: "${pubkey}" }' | ${config.services.yggdrasil.package}/bin/yggdrasil -useconf -address | tr -d '\n' > $out
+  '').outPath;
+in {
+  options.network.yggdrasil = {
+    enable = mkEnableOption "Enable the yggdrasil-based private hexnet";
+    pubkey = mkOption {
+      type = types.str;
+      description = "Public key of this node";
+    };
+    address = mkOption {
+      type = types.str;
+      description = "Main Yggdrasil address. Set automatically";
+      default = calcAddr cfg.pubkey;
+    };
+    trust = mkOption {
+      type = types.bool;
+      description = "Open Firewall completely for the network";
+      default = false;
+    };
+    listen.enable = mkOption {
+      type = types.bool;
+      description = "Allow other hosts in the network to connect directly";
+      default = false;
+    };
+    listen.endpoints = mkOption {
+      type = types.listOf types.str;
+      description = "Endpoints to listen on";
+      default = [];
+    };
+    dns.enable = mkOption {
+      type = types.bool;
+      description = "enable automatic dns record generation";
+      default = false;
+    };
+    dns.zone = mkOption {
+      type = types.str;
+      description = "Main zone to insert DNS records into";
+      default = "lilwit.ch";
+    };
+    dns.subdomain = mkOption {
+      type = types.str;
+      description = "subdomain to put the records into";
+      default = "net";
+    };
+    tunnel.localV6 = mkOption {
+      type = types.listOf types.str;
+      description = "v6 subnets to expose";
+      default = [];
+    };
+    tunnel.localV4 = mkOption {
+      type = types.listOf types.str;
+      description = "v4 subnets to expose";
+      default = [];
+    };
+    tunnel.remoteV6 = mkOption {
+      type = types.attrsOf types.str;
+      description = "Extra v6 subnets to route";
+      default = {};
+    };
+    tunnel.remoteV4 = mkOption {
+      type = types.attrsOf types.str;
+      description = "Extra v4 subnets to route";
+      default = {};
+    };
+    extra.pubkeys = mkOption {
+      type = types.attrsOf types.str;
+      description = "Additional hosts to allow into the network. Keys won't be added to definition host.";
+      default = {};
+      example = { host = "0000000000000000000000000000000000000000000000000000000000000000"; };
+    };
+    extra.addresses = mkOption {
+      type = types.attrsOf types.str;
+      internal = true;
+      default = mapAttrs (_: c: calcAddr c) cfg.extra.pubkeys;
+    };
+    extra.localV6 = mkOption {
+      type = types.listOf types.str;
+      description = "v6 subnets to expose, but not route";
+      default = [];
+    };
+    extra.localV4 = mkOption {
+      type = types.listOf types.str;
+      description = "v4 subnets to expose, but not route";
+      default = [];
+    };
+  };
+
+  config = mkIf cfg.enable (let
+    yggConfigs = filter (
+      c: c.enable && (cfg.pubkey != c.pubkey)
+      ) (
+      mapAttrsToList (_: node: node.network.yggdrasil or { enable = false; pubkey = null; }) meta.network.nodes
+    );
+    pubkeys = flatten (map (c: [ c.pubkey ] ++ (attrValues c.extra.pubkeys)) yggConfigs);
+  in {
+    assertions = [
+      {
+        assertion = !(cfg.listen.enable && (cfg.listen.endpoints == []));
+        message = "Specify network.yggdrasil.listen.endpoints";
+      }
+    ];
+
+    networking.firewall.trustedInterfaces = mkIf cfg.trust [ "yggdrasil" ];
+
+    services.yggdrasil = {
+      enable = true;
+      persistentKeys = true;
+      config = {
+        AllowedEncryptionPublicKeys = pubkeys;
+        IfName = "yggdrasil";
+        Listen = cfg.listen.endpoints;
+        Peers = lib.flatten (map (c: c.listen.endpoints) (filter (c: c.listen.enable) yggConfigs));
+        SessionFirewall = {
+          Enable = true;
+          AllowFromRemote = false;
+          WhitelistEncryptionPublicKeys = pubkeys;
+        };
+        TunnelRouting = let
+          subnets = v: (
+            listToAttrs (flatten (map (c: map (net: nameValuePair net c.pubkey) c.tunnel."localV${toString v}") yggConfigs))
+          ) // cfg.tunnel."remoteV${toString v}";
+        in {
+          Enable = true;
+          IPv4LocalSubnets = cfg.tunnel.localV4 ++ cfg.extra.localV4;
+          IPv6LocalSubnets = cfg.tunnel.localV6 ++ cfg.extra.localV6;
+          IPv4RemoteSubnets = subnets 4;
+          IPv6RemoteSubnets = subnets 6;
+        };
+      };
+    };
+
+    systemd.services.yggdrasil.postStart = let
+      yggTun = config.services.yggdrasil.config.TunnelRouting;
+      addNets = v: nets: concatMapStringsSep "\n" (net: "${pkgs.iproute}/bin/ip -${toString v} route add ${net} dev yggdrasil") (attrNames nets);
+    in "sleep 1\n" + (concatMapStringsSep "\n" (v: addNets v yggTun."IPv${toString v}RemoteSubnets") [ 4 6 ]);
+
+    system.build.yggdrasilTemplate = let
+      json = builtins.toJSON {
+        inherit (config.services.yggdrasil.config) Peers SessionFirewall TunnelRouting;
+        EncryptionPublicKey = "";
+        EncryptionPrivateKey = "";
+        SigningPublicKey = "";
+        SigningPrivateKey = "";
+      };
+    in pkgs.runCommandNoCC "yggdrasil-template.json" {}
+      "echo '${json}' | ${config.services.yggdrasil.package}/bin/yggdrasil -useconf -normaliseconf > $out";
+  });
+}