This repository has no description
configs.kartei: replace krebs.hosts with kartei directly
Render /etc/hosts, ssh known_hosts and ssh ports from kartei (plus the
superconfig-only cards in retiolum/) instead of stockholm's krebs.hosts,
and drop krebs.build.host everywhere: readers now use kartei.hosts or
networking.hostName, which comes from the clan machine name.
- remove stockholm users/hosts/build/dns/ssh imports; declare krebs.users
locally
- drop the acheron/starkstrom krebs.hosts cards; both now appear in every
machine's /etc/hosts
- neoprism: stop serving /hosts and /retiolum.hosts
- ignavia: move the styx tinc Address override onto the kartei-built host
file; the krebs.hosts one had no effect since the kartei cutover
author
lassulus
date
(Oct 6, 2026, 2:34 PM CEST)
commit
01c31c3b
01c31c3b0f10cb8221f15380ef435bf101e8f070
parent
fc417798
fc4177987dcb34553987632e632ea4dea0b50c31
+161
-179
+28
-4
configs/consul.nix
+28
-4
configs/consul.nix
···
1
1
{
2
+
self,
2
3
config,
3
4
lib,
4
5
pkgs,
5
6
...
6
7
}:
8
+
let
9
+
inherit (self.inputs.kartei) hosts;
10
+
11
+
# consul server peers; stockholm policy (krebs/3modules/kartei/overlay.nix),
12
+
# not kartei data
13
+
consulHosts = [
14
+
"aergia"
15
+
"blue"
16
+
"coaxmetal"
17
+
"daedalus"
18
+
"green"
19
+
"icarus"
20
+
"ignavia"
21
+
"littleT"
22
+
"massulus"
23
+
"neoprism"
24
+
"orange"
25
+
"radio"
26
+
"shodan"
27
+
"skynet"
28
+
"styx"
29
+
"ubik"
30
+
"yellow"
31
+
];
32
+
in
7
33
{
8
34
services.consul = {
9
35
enable = true;
···
11
37
webUi = true;
12
38
# interface.bind = "retiolum";
13
39
extraConfig = {
14
-
bind_addr = config.krebs.build.host.nets.retiolum.ip4.addr;
40
+
bind_addr = hosts.${config.networking.hostName}.nets.retiolum.ip4.addr;
15
41
bootstrap_expect = 3;
16
42
server = true;
17
43
# retry_join = config.services.consul.extraConfig.start_join;
18
-
retry_join = lib.mapAttrsToList (_n: h: lib.head h.nets.retiolum.aliases) (
19
-
lib.filterAttrs (_n: h: h.consul) config.krebs.hosts
20
-
);
44
+
retry_join = map (name: lib.head hosts.${name}.nets.retiolum.aliases) consulHosts;
21
45
rejoin_after_leave = true;
22
46
23
47
# try to fix random lock loss on leader reelection
+3
-9
configs/default.nix
+3
-9
configs/default.nix
···
34
34
./nix.nix
35
35
36
36
# Import stockholm modules
37
-
self.inputs.stockholm.nixosModules.users
38
-
self.inputs.stockholm.nixosModules.hosts
39
-
./kartei.nix
40
-
self.inputs.stockholm.nixosModules.build
41
-
self.inputs.stockholm.nixosModules.dns
42
-
self.inputs.stockholm.nixosModules.iptables
43
37
self.inputs.stockholm.nixosModules.secret
38
+
./kartei.nix
39
+
self.inputs.stockholm.nixosModules.iptables
44
40
self.inputs.stockholm.nixosModules.setuid
45
41
self.inputs.stockholm.nixosModules.sitemap
46
42
self.inputs.stockholm.nixosModules.ssl
47
43
self.inputs.stockholm.nixosModules.systemd
48
-
self.inputs.stockholm.nixosModules.ssh
49
44
{
50
45
# nix-index
51
46
imports = [
···
162
157
}
163
158
];
164
159
165
-
networking.hostName = config.krebs.build.host.name;
160
+
networking.hostName = config.clan.core.settings.machine.name;
166
161
167
162
krebs = {
168
163
enable = true;
169
-
build.user = config.krebs.users.lass;
170
164
ssl.trustIntermediate = true;
171
165
};
172
166
+1
-1
configs/gc.nix
+1
-1
configs/gc.nix
+81
-39
configs/kartei.nix
+81
-39
configs/kartei.nix
···
1
-
# krebs.hosts and foreign krebs.users from the kartei flake input, instead
2
-
# of stockholm's nixosModules.kartei (which pins its own kartei submodule).
1
+
# Host and user data from the kartei flake input, rendered straight into
2
+
# NixOS options; stockholm's krebs.hosts (and its hosts/ssh/build modules) is
3
+
# not used. Hosts are kartei's plus the superconfig-only cards in ../retiolum.
3
4
# Our own users are defined here from ../keys, not taken from kartei.
4
5
{
5
6
config,
···
10
11
let
11
12
inherit (self.inputs) kartei;
12
13
13
-
# Host flag that is stockholm policy (krebs/3modules/kartei/overlay.nix),
14
-
# not kartei data, still read by configs/consul.nix (retry_join).
15
-
consulHosts = [
16
-
"aergia"
17
-
"blue"
18
-
"coaxmetal"
19
-
"daedalus"
20
-
"green"
21
-
"icarus"
22
-
"ignavia"
23
-
"littleT"
24
-
"massulus"
25
-
"neoprism"
26
-
"orange"
27
-
"radio"
28
-
"shodan"
29
-
"skynet"
30
-
"styx"
31
-
"ubik"
32
-
"yellow"
14
+
hosts = kartei.hosts // self.retiolum.hosts;
15
+
16
+
# Name suffixes that go into /etc/hosts; ".r" names also get a bare short
17
+
# form (barnacle.r -> barnacle), as stockholm's krebs.dns did.
18
+
domains = [
19
+
"r"
20
+
"i"
21
+
"w"
22
+
"shack"
33
23
];
24
+
hostDomain = alias: lib.any (d: lib.hasSuffix ".${d}" alias) domains;
25
+
shortsOf = aliases: map (lib.removeSuffix ".r") (lib.filter (lib.hasSuffix ".r") aliases);
26
+
27
+
# superconfig's own cards (../retiolum) only carry ip4/ip6/aliases
28
+
netAddrs =
29
+
net:
30
+
net.addrs or (
31
+
lib.optional (net.ip4 or null != null) net.ip4.addr
32
+
++ lib.optional (net.ip6 or null != null) net.ip6.addr
33
+
);
34
+
netAliases = net: net.aliases or [ ];
35
+
sshPort = net: net.ssh.port or 22;
36
+
37
+
allNets = lib.concatMap (host: lib.attrValues (host.nets or { })) (lib.attrValues hosts);
34
38
35
39
ownUsers = {
36
40
lass = {
···
41
45
};
42
46
in
43
47
{
44
-
krebs.hosts = lib.mapAttrs (
45
-
name: host:
46
-
removeAttrs host [ "owner" ]
47
-
// {
48
-
# hosts may be owned by users without a kartei record; the krebs.users
49
-
# type fills in all defaults from the name alone
50
-
owner = config.krebs.users.${host.owner} or { name = host.owner; };
51
-
consul = lib.elem name consulHosts;
52
-
}
53
-
) kartei.hosts;
48
+
options.krebs.users = lib.mkOption {
49
+
type = lib.types.attrsOf self.inputs.stockholm.lib.types.user;
50
+
};
54
51
55
-
# drop null fields so other modules (e.g. stockholm's users.nix for the
56
-
# krebs user) can define them without conflicting definitions
57
-
krebs.users =
58
-
lib.mapAttrs (_: lib.filterAttrs (_: v: v != null)) (
59
-
removeAttrs kartei.users (lib.attrNames ownUsers)
60
-
)
61
-
// ownUsers;
52
+
config = {
53
+
networking.hosts = lib.filterAttrs (_: names: names != [ ]) (
54
+
lib.zipAttrsWith (_: lib.concatLists) (
55
+
lib.concatMap (
56
+
net:
57
+
let
58
+
longs = lib.filter hostDomain (netAliases net);
59
+
names = longs ++ shortsOf longs;
60
+
in
61
+
map (addr: { ${addr} = names; }) (netAddrs net)
62
+
) allNets
63
+
)
64
+
);
65
+
66
+
services.openssh.knownHosts =
67
+
lib.filterAttrs (_: known: known.publicKey != null && known.hostNames != [ ])
68
+
(
69
+
lib.mapAttrs (_: host: {
70
+
publicKey = host.ssh.pubkey or null;
71
+
hostNames = lib.concatMap (
72
+
net:
73
+
map (name: if sshPort net != 22 then "[${name}]:${toString (sshPort net)}" else name) (
74
+
shortsOf (netAliases net) ++ netAliases net ++ netAddrs net
75
+
)
76
+
) (lib.attrValues (host.nets or { }));
77
+
}) hosts
78
+
// {
79
+
localhost = {
80
+
publicKey = hosts.${config.networking.hostName}.ssh.pubkey or null;
81
+
hostNames = [
82
+
"localhost"
83
+
"127.0.0.1"
84
+
"::1"
85
+
];
86
+
};
87
+
}
88
+
);
89
+
90
+
programs.ssh.extraConfig = lib.mkBefore (
91
+
lib.concatMapStrings (net: ''
92
+
Host ${toString (netAliases net ++ netAddrs net)}
93
+
Port ${toString (sshPort net)}
94
+
'') (lib.filter (net: sshPort net != 22) allNets)
95
+
);
96
+
97
+
# drop null fields so they keep the krebs.users type defaults
98
+
krebs.users =
99
+
lib.mapAttrs (_: lib.filterAttrs (_: v: v != null)) (
100
+
removeAttrs kartei.users (lib.attrNames ownUsers)
101
+
)
102
+
// ownUsers;
103
+
};
62
104
}
+6
-6
configs/mailserver.nix
+6
-6
configs/mailserver.nix
···
6
6
...
7
7
}:
8
8
let
9
-
relayHosts = map (host: host.nets.retiolum.ip6.addr) [
10
-
config.krebs.hosts.aergia
11
-
config.krebs.hosts.ignavia
12
-
config.krebs.hosts.coaxmetal
13
-
config.krebs.hosts.green
14
-
config.krebs.hosts.mors
9
+
relayHosts = map (name: self.inputs.kartei.hosts.${name}.nets.retiolum.ip6.addr) [
10
+
"aergia"
11
+
"ignavia"
12
+
"coaxmetal"
13
+
"green"
14
+
"mors"
15
15
];
16
16
17
17
mynetworks = map (ip: "[${ip}]") relayHosts;
+3
-1
configs/realwallpaper.nix
+3
-1
configs/realwallpaper.nix
···
15
15
'';
16
16
services.nginx.virtualHosts.wallpaper = {
17
17
extraConfig = ''
18
-
if ( $server_addr = "${config.krebs.build.host.nets.internet.ip4.addr}" ) {
18
+
if ( $server_addr = "${
19
+
self.inputs.kartei.hosts.${config.networking.hostName}.nets.internet.ip4.addr
20
+
}" ) {
19
21
return 403;
20
22
}
21
23
'';
+3
-5
configs/retiolum.nix
+3
-5
configs/retiolum.nix
···
15
15
ln -s bin $out/sbin
16
16
'';
17
17
18
-
# Peer keys and addresses come straight from kartei, not through
19
-
# stockholm's krebs.hosts: stockholm pins an older kartei and its host type
20
-
# still requires the legacy RSA pubkey. This is only the host database --
21
-
# the daemon stays on nixpkgs' services.tinc with pkgs/tincr swapped in
22
-
# (barnacle does the same with tincr's darwin module, see
18
+
# Peer keys and addresses come straight from kartei. This is only the host
19
+
# database -- the daemon stays on nixpkgs' services.tinc with pkgs/tincr
20
+
# swapped in (barnacle does the same with tincr's darwin module, see
23
21
# machines/barnacle/retiolum.nix).
24
22
#
25
23
# tincHosts is already filtered to SPTPS-capable nodes, so the RSA-only
+1
-1
retiolum/default.nix
+1
-1
retiolum/default.nix
···
9
9
#
10
10
# This is data, not a module -- same shape as keys/.
11
11
#
12
-
# Cards use the same nets.<net> layout as kartei and krebs.hosts, and the
12
+
# Cards use the same nets.<net> layout as kartei, and the
13
13
# renderer below mirrors kartei's modules/retiolum/hosts.nix, so an entry can
14
14
# move into kartei/lass unchanged if it should become reachable by the rest of
15
15
# krebs rather than just the fleet.
+7
-8
configs/websites/lassulus.nix
+7
-8
configs/websites/lassulus.nix
···
1
-
{ config, pkgs, ... }:
1
+
{
2
+
self,
3
+
config,
4
+
pkgs,
5
+
...
6
+
}:
2
7
let
3
8
# ANSI-terminal-style homepage, inline HTML with clickable links. The IBM
4
9
# VGA webfont (CC BY-SA 4.0, int10h.org/oldschool-pc-fonts) is base64-inlined
···
39
44
root ${webroot};
40
45
default_type text/plain;
41
46
'';
42
-
locations."= /hosts".extraConfig = ''
43
-
alias ${pkgs.krebs-hosts_combined};
44
-
'';
45
-
locations."= /retiolum.hosts".extraConfig = ''
46
-
alias ${pkgs.krebs-hosts-retiolum};
47
-
'';
48
47
locations."= /wireguard-key".extraConfig = ''
49
-
alias ${pkgs.writeText "neoprism.wg" config.krebs.hosts.neoprism.nets.wiregrill.wireguard.pubkey};
48
+
alias ${pkgs.writeText "neoprism.wg" self.inputs.kartei.hosts.neoprism.nets.wiregrill.wireguard.pubkey};
50
49
'';
51
50
locations."= /ssh.pub".extraConfig = ''
52
51
alias ${pkgs.writeText "pub" config.krebs.users.lass.pubkey};
+5
-31
machines/acheron/config.nix
+5
-31
machines/acheron/config.nix
···
1
-
{
2
-
self,
3
-
config,
4
-
...
5
-
}:
6
-
let
7
-
# acheron replaces styx as the gg23 router. Like starkstrom it has no card in
8
-
# the shared kartei registry; its retiolum identity lives in retiolum/
9
-
# (self.retiolum), which every superconfig machine injects into its tinc
10
-
# host set. Move that entry into kartei/lass if the rest of krebs should be
11
-
# able to reach it too.
12
-
net = self.retiolum.hosts.acheron.nets.retiolum;
13
-
in
1
+
# acheron replaces styx as the gg23 router. Like starkstrom it has no card in
2
+
# the shared kartei registry; its retiolum identity lives in retiolum/
3
+
# (self.retiolum), which every superconfig machine injects into its tinc host
4
+
# set and /etc/hosts. Move that entry into kartei/lass if the rest of krebs
5
+
# should be able to reach it too.
14
6
{
15
7
imports = [
16
8
../../configs
17
9
../../configs/retiolum.nix
18
10
../../configs/gg23.nix
19
11
];
20
-
21
-
# krebs.build.host and the monitoring/dns bits still read this card, so build
22
-
# it from the same data rather than repeating the addresses and keys.
23
-
# stockholm's host type additionally insists on the legacy RSA pubkey, which
24
-
# tincr ignores.
25
-
krebs.hosts.acheron = {
26
-
owner = config.krebs.users.lass;
27
-
monitoring = true;
28
-
nets.retiolum = {
29
-
inherit (net) ip4 ip6 aliases;
30
-
tinc = {
31
-
pubkey = config.clan.core.vars.generators.retiolum.files."retiolum.rsa_key.pub".value;
32
-
inherit (net.tinc) pubkey_ed25519;
33
-
};
34
-
};
35
-
};
36
-
37
-
krebs.build.host = config.krebs.hosts.acheron;
38
12
39
13
services.earlyoom.enable = true;
40
14
+1
-3
machines/aergia/config.nix
+1
-3
machines/aergia/config.nix
-1
machines/atlas/config.nix
-1
machines/atlas/config.nix
-2
machines/coaxmetal/config.nix
-2
machines/coaxmetal/config.nix
-2
machines/daedalus/config.nix
-2
machines/daedalus/config.nix
-2
machines/green/config.nix
-2
machines/green/config.nix
+1
-3
machines/hilum/config.nix
+1
-3
machines/hilum/config.nix
+1
-3
machines/icarus/config.nix
+1
-3
machines/icarus/config.nix
+2
-4
machines/mors/config.nix
+2
-4
machines/mors/config.nix
···
35
35
default = true;
36
36
serverAliases = [
37
37
"localhost"
38
-
"${config.krebs.build.host.name}"
39
-
"${config.krebs.build.host.name}.r"
38
+
"${config.networking.hostName}"
39
+
"${config.networking.hostName}.r"
40
40
];
41
41
locations."~ ^/~(.+?)(/.*)?\$".extraConfig = ''
42
42
alias /home/$1/public_html$2;
···
60
60
};
61
61
}
62
62
];
63
-
64
-
krebs.build.host = config.krebs.hosts.mors;
65
63
66
64
environment.systemPackages = with pkgs; [
67
65
android-tools
-2
machines/neoprism/config.nix
-2
machines/neoprism/config.nix
+1
-2
machines/orange/config.nix
+1
-2
machines/orange/config.nix
···
1
-
{ config, pkgs, ... }:
1
+
{ pkgs, ... }:
2
2
{
3
3
clan.core.vars.password-store.secretLocation = "/var/state/secret-vars";
4
4
···
9
9
../../configs/nginx.nix
10
10
];
11
11
12
-
krebs.build.host = config.krebs.hosts.orange;
13
12
system.stateVersion = "24.05";
14
13
15
14
services.nginx.enable = true;
-1
machines/radio/config.nix
-1
machines/radio/config.nix
+1
-3
machines/shodan/config.nix
+1
-3
machines/shodan/config.nix
···
1
-
{ config, ... }:
1
+
{ ... }:
2
2
3
3
{
4
4
imports = [
···
13
13
../../configs/sigexec/executor.nix
14
14
../../configs/rad.nix
15
15
];
16
-
17
-
krebs.build.host = config.krebs.hosts.shodan;
18
16
19
17
services.logind.lidSwitch = "ignore";
20
18
services.logind.lidSwitchDocked = "ignore";
+4
-31
machines/starkstrom/config.nix
+4
-31
machines/starkstrom/config.nix
···
1
-
{
2
-
self,
3
-
config,
4
-
...
5
-
}:
6
-
let
7
-
# starkstrom is deliberately not in the shared kartei registry; its retiolum
8
-
# identity lives in retiolum/ (self.retiolum), which every superconfig
9
-
# machine injects into its tinc host set. Move that entry into kartei/lass if
10
-
# the rest of krebs should be able to reach it too.
11
-
net = self.retiolum.hosts.starkstrom.nets.retiolum;
12
-
in
1
+
# starkstrom is deliberately not in the shared kartei registry; its retiolum
2
+
# identity lives in retiolum/ (self.retiolum), which every superconfig machine
3
+
# injects into its tinc host set and /etc/hosts. Move that entry into
4
+
# kartei/lass if the rest of krebs should be able to reach it too.
13
5
{
14
6
imports = [
15
7
../../configs
···
20
12
./ipfs.nix
21
13
./ipfs-endpoint.nix
22
14
];
23
-
24
-
# krebs.build.host and the monitoring/dns bits still read this card, so build
25
-
# it from the same data rather than repeating the addresses and keys.
26
-
# stockholm's host type additionally insists on the legacy RSA pubkey, which
27
-
# tincr ignores; via is left out because stockholm resolves it to a net
28
-
# submodule, not a name.
29
-
krebs.hosts.starkstrom = {
30
-
owner = config.krebs.users.lass;
31
-
monitoring = true;
32
-
nets.retiolum = {
33
-
inherit (net) ip4 ip6 aliases;
34
-
tinc = {
35
-
pubkey = config.clan.core.vars.generators.retiolum.files."retiolum.rsa_key.pub".value;
36
-
inherit (net.tinc) pubkey_ed25519;
37
-
};
38
-
};
39
-
};
40
-
41
-
krebs.build.host = config.krebs.hosts.starkstrom;
42
15
43
16
# The fleet has no retiolum route here (see kartei note above), so the
44
17
# sigexec dashboard on neoprism reaches this executor over public TLS
-3
machines/styx/config.nix
-3
machines/styx/config.nix
-1
machines/virtulus/config.nix
-1
machines/virtulus/config.nix
-3
machines/xerxes/config.nix
-3
machines/xerxes/config.nix
-1
machines/yellow/config.nix
-1
machines/yellow/config.nix
+2
-2
configs/services/flix/proxy.nix
+2
-2
configs/services/flix/proxy.nix
···
1
-
{ config, pkgs, ... }:
1
+
{ self, pkgs, ... }:
2
2
{
3
3
# POST → ipfs-upload backend (writes file to /var/lib/ipfs/download/<path>
4
4
# and returns the CID). Anything else → the kubo gateway.
···
32
32
# jellyfin only listens on IPv4; yellow.r also resolves to its
33
33
# retiolum AAAA, which nginx round-robins into -> intermittent
34
34
# 502 "no live upstreams". Pin the v4 address.
35
-
proxyPass = "http://${config.krebs.hosts.yellow.nets.retiolum.ip4.addr}:8096";
35
+
proxyPass = "http://${self.inputs.kartei.hosts.yellow.nets.retiolum.ip4.addr}:8096";
36
36
proxyWebsockets = true;
37
37
recommendedProxySettings = true;
38
38
};
+7
-2
configs/services/matrix/default.nix
+7
-2
configs/services/matrix/default.nix
···
1
-
{ config, pkgs, ... }:
1
+
{
2
+
self,
3
+
config,
4
+
pkgs,
5
+
...
6
+
}:
2
7
{
3
8
services.matrix-synapse = {
4
9
enable = true;
···
58
63
port = 8008;
59
64
bind_addresses = [
60
65
"::1"
61
-
config.krebs.build.host.nets.retiolum.ip6.addr
66
+
self.inputs.kartei.hosts.${config.networking.hostName}.nets.retiolum.ip6.addr
62
67
];
63
68
type = "http";
64
69
tls = false;