Pretty massive changes really

config/client.nix

@@ -3,7 +3,7 @@
 with lib;
 let
   make-passwd-file = hostname:
-    pkgs.lib.fudo.passwd.stablerandom-passwd-file
+    pkgs.lib.passwd.stablerandom-passwd-file
       "${hostname}-fudo-client-passwd"
       config.instance.build-seed;
 

config/default.nix

@@ -6,14 +6,10 @@
                 ./bash.nix
                 ./client.nix
                 ./common.nix
-                ./domains.nix
                 ./dns.nix
                 ./groups.nix
-                ./hosts.nix
                 ./instance.nix
                 ./kerberos.nix
-                ./networks.nix
-                ./sites.nix
                 ./users.nix
                 ./user-config.nix
                 ./wireless-networks.nix

config/dns.nix

@@ -18,8 +18,8 @@ let
 in {
   config = {
     fudo.dns = mkIf is-primary (let
-      primary-ip = pkgs.lib.fudo.network.host-ipv4 config hostname;
-      all-ips = pkgs.lib.fudo.network.host-ips config hostname;
+      primary-ip = pkgs.lib.network.host-ipv4 config hostname;
+      all-ips = pkgs.lib.network.host-ips config hostname;
     in {
       enable = true;
       identity = "${hostname}.${domain}";
@@ -44,9 +44,9 @@ in {
           # TODO: there's no guarantee this exists...
           dmarc-report-address = "dmarc-report@${domain}";
 
-          network-definition = let
-            network = config.fudo.networks.${domain};
-          in network // {
+          zone-definition = let
+            zone = config.fudo.zones.${domain};
+          in zone // {
             srv-records = {
               tcp = {
                 domain = [{

config/hardware/lambda.nix

@@ -35,7 +35,7 @@ in {
     "/boot" = {
       device = "/dev/disk/by-label/lambda-boot";
       fsType = "ext4";
-      options = [ "noexec" ];
+      options = [ "noexec" "noatime" "nodiratime" ];
     };
 
     "/" = {
@@ -47,19 +47,20 @@ in {
     "/nix" = {
       device = "lambda/transient/nix";
       fsType = "zfs";
+      options = [ "noatime" "nodiratime" ];
     };
 
     "/var/log" = {
       device = "lambda/transient/logs";
       fsType = "zfs";
       neededForBoot = true;
-      options = [ "noexec" ];
+      options = [ "noexec" "noatime" "nodiratime" ];
     };
 
     "/state" = {
       device = "lambda/persistent/state";
       fsType = "zfs";
-      options = [ "noexec" ];
+      options = [ "noexec" "noatime" "nodiratime" ];
     };
   };
 

config/hardware/legatus.nix

@@ -68,7 +68,7 @@ with lib; {
     interfaces = {
       extif0 = {
         macAddress =
-          pkgs.lib.fudo.network.generate-mac-address "legatus" "extif0";
+          pkgs.lib.network.generate-mac-address "legatus" "extif0";
       };
     };
   };

config/hardware/nutboy3.nix

@@ -72,7 +72,7 @@ with lib; {
     interfaces = {
       extif0 = {
         macAddress =
-          pkgs.lib.fudo.network.generate-mac-address config.instance.hostname "extif0";
+          pkgs.lib.network.generate-mac-address config.instance.hostname "extif0";
       };
     };
   };

config/host-config/france.nix

@@ -88,7 +88,7 @@ in {
     };
 
     fudo = let
-      backplane-dns-password-file = pkgs.lib.fudo.passwd.stablerandom-passwd-file
+      backplane-dns-password-file = pkgs.lib.passwd.stablerandom-passwd-file
         "dns-service-backplane-passwd"
         "dns-service-backplane-passwd-${config.instance.build-seed}";
     in {
@@ -118,7 +118,7 @@ in {
         };
         ldap-root-passwd = {
           source-file =
-            pkgs.lib.fudo.passwd.random-passwd-file "ldap-root-passwd" 20;
+            pkgs.lib.passwd.random-passwd-file "ldap-root-passwd" 20;
           target-file = "/run/openldap/root.passwd";
           user = ldap-user;
           group = ldap-group;

config/host-config/lambda.nix

@@ -36,12 +36,6 @@ in {
   #   secret-paths = [ "/state/secrets" ];
   # };
 
-  fudo.games.valheim = {
-    enable = true;
-    state-directory = "/state/games/valheim";
-    password = "silkymilky";
-  };
-
   systemd.tmpfiles.rules = [
     "L /root/.gnupg           - - - - ${state-dir}/user/root/gnupg"
     "L /root/.ssh/id_rsa      - - - - ${state-dir}/user/root/ssh/id_rsa"

config/host-config/limina.nix

@@ -57,7 +57,7 @@ in {
         dhcp-dynamic-network = site.dynamic-network;
         search-domains = [ domain-name "fudo.org" ];
         enable-reverse-mappings = true;
-        network-definition = config.fudo.networks.${domain-name};
+        zone-definition = config.fudo.zones.${domain-name};
       };
 
       client.dns.external-interface = "enp1s0";

config/host-config/nostromo.nix

@@ -17,13 +17,15 @@ in {
 
       intif0 = { useDHCP = true; };
     };
+
+    firewall.enable = false;
   };
 
   # Hopefully this'll help with NFS...
   boot.kernelModules = [ "rpcsec_gss_krb5" ];
 
   services.nfs = {
-    # See lib/fudo/users.nix for the user@REALM -> user mapping
+    # See ../user-config.nix for the user@REALM -> user mapping
     server = {
       enable = true;
       createMountPoints = false;
@@ -56,12 +58,4 @@ in {
   #   users = [ "niten" ];
   #   api-address = "/ip4/0.0.0.0/tcp/5001";
   # };
-
-  virtualisation = {
-    libvirtd = {
-      enable = true;
-      qemuPackage = pkgs.qemu_kvm;
-      onShutdown = "shutdown";
-    };
-  };
 }

config/hosts/atom.nix

@@ -3,9 +3,10 @@
   enable-gui = false;
   rp = "niten";
   admin-email = "niten@fudo.org";
-  domain = "mobile.fudo.org";
-  site = "mobile";
+  domain = "sea.fudo.org";
+  site = "seattle";
   profile = "laptop";
   arch = "x86_64-linux";
-  nixos-system = true;
+  # FIXME: Need a better story for laptops
+  nixos-system = false;
 }

config/kerberos.nix

@@ -19,9 +19,8 @@ in {
       auth.kdc = mkIf (is-master || is-slave) {
         enable = true;
         realm = cfg.gssapi-realm;
-        # TODO: Also bind to ::1?
         bind-addresses =
-          (pkgs.lib.fudo.network.host-ips config hostname) ++
+          (pkgs.lib.network.host-ips config hostname) ++
           [ "127.0.0.1" ] ++ (optional config.networking.enableIPv6 "::1");
         master-config = mkIf is-master {
           acl = let
@@ -40,7 +39,7 @@ in {
       };
 
       dns.domains.${domain} = {
-        network-definition = mkIf kerberized-domain {
+        zone-definition = mkIf kerberized-domain {
           srv-records = let
             get-fqdn = hostname:
               "${hostname}.${config.fudo.hosts.${hostname}.domain}";

config/user-config.nix

@@ -10,6 +10,8 @@ with lib;
 
     hostname = config.instance.hostname;
     host-cfg = config.fudo.hosts.${hostname};
+
+    sys = config.instance;
   in {
     fudo.auth.ldap-server = {
       users = filterAttrs