Seems to be almost working

lib/default.nix

@@ -29,6 +29,7 @@ with lib; {
     ./fudo/mail-container.nix
     ./fudo/minecraft-server.nix
     ./fudo/netinfo-email.nix
+    ./fudo/networks.nix
     ./fudo/node-exporter.nix
     ./fudo/password.nix
     ./fudo/postgres.nix

lib/fudo/dns.nix

@@ -123,6 +123,9 @@ in {
 
             $TTL 6h
 
+            ${optionalString (dom-cfg.gssapi-realm != null)
+            ''_kerberos IN TXT "${dom-cfg.gssapi-realm}"''}
+
             ${nsRecords dom cfg.nameservers}
             ${join-lines (mapAttrsToList hostRecords cfg.nameservers)}
 

lib/fudo/domains.nix

@@ -33,8 +33,8 @@ let
 
       local-groups = mkOption {
         type = with types; listOf str;
-	description = "List of groups which should exist within this domain.";
-	default = [ ];
+        description = "List of groups which should exist within this domain.";
+        default = [ ];
       };
 
       admin-email = mkOption {

lib/fudo/hosts.nix

@@ -3,7 +3,7 @@
 with lib;
 let
   hostOpts = { hostname, ... }: {
-    options = {
+    options = with types; {
       hostname = mkOption {
         type = types.str;
         description = "Hostname (without domain name).";
@@ -23,7 +23,7 @@ let
       };
 
       local-networks = mkOption {
-        type = with types; listof str;
+        type = listof str;
         description =
           "A list of networks to be considered trusted by this host.";
         default = [ "127.0.0.0/8" ];
@@ -31,25 +31,19 @@ let
 
       profile = mkOption {
         # FIXME: get this list from profiles directly
-        type = with types; listof (enum "desktop" "laptop" "server");
+        type = listof (enum "desktop" "laptop" "server");
         description =
           "The profile to be applied to the host, determining what software is included.";
       };
 
       admin-email = mkOption {
-        type = with types; nullOr str;
+        type = nullOr str;
         description = "Email for the administrator of this host.";
         default = null;
       };
 
-      hardware-configuration = mkOption {
-        type = types.attrs;
-        description =
-          "The hardware configuration of the host (i.e. the contents of hardware-configuration.nix)";
-      };
-
       local-users = mkOption {
-        type = with types; listOf str;
+        type = listOf str;
         description =
           "List of users who should have local (i.e. login) access to the host.";
         default = [ ];
@@ -62,25 +56,20 @@ let
       };
 
       local-admins = mkOption {
-        type = with types; listOf str;
+        type = listOf str;
         description =
           "A list of users who should have admin access to this host.";
         default = [ ];
       };
 
       local-groups = mkOption {
-        type = with types; listOf str;
+        type = listOf str;
         description = "List of groups which should exist on this host.";
         default = [ ];
       };
 
-      hardware-config = mkOption {
-        type = types.str;
-        description = "Path to the hardware configuration for this host.";
-      };
-
       ssh-fingerprints = mkOption {
-        type = with types; listOf str;
+        type = listOf str;
         description = ''
           A list of DNS SSHFP records for this host.
         '';
@@ -88,7 +77,7 @@ let
       };
 
       rp = mkOption {
-        type = with types; nullOr str;
+        type = nullOr str;
         description = "Responsible person.";
         default = null;
       };
@@ -100,11 +89,12 @@ let
   };
 
 in {
-  options.fudo.hosts = mkOption {
-    type = with types; attrsOf (submodule hostOpts);
-    description = "Host configurations for all hosts known to the system.";
-    default = { };
-  };
+  options.fudo.hosts = with types;
+    mkOption {
+      type = attrsOf (submodule hostOpts);
+      description = "Host configurations for all hosts known to the system.";
+      default = { };
+    };
 
   config = let
     hostname = config.instance.hostname;

lib/fudo/local-network.nix

@@ -12,12 +12,6 @@ let
 
   traceout = out: builtins.trace out out;
 
-  hosts = let
-    existingHosts = filterAttrs (host: hostOpts: hasAttr host cfg.fudo.hosts)
-      cfg.network-definition.hosts;
-  in mapAttrs (host: hostAttrs: hostAttrs // cfg.fudo.hosts.${host})
-  existingHosts;
-
 in {
 
   options.fudo.local-network = with types; {
@@ -31,7 +25,7 @@ in {
 
     dns-servers = mkOption {
       type = listOf str;
-      description = "A list of domain name servers to pass to local clients..";
+      description = "A list of domain name servers to pass to local clients.";
     };
 
     dhcp-interfaces = mkOption {
@@ -74,12 +68,7 @@ in {
     recursive-resolver = mkOption {
       type = str;
       description = "DNS nameserver to use for recursive resolution.";
-      default = "1.1.1.1";
-    };
-
-    dns-server-ip = mkOption {
-      type = str;
-      description = "IP of the DNS server.";
+      default = "1.1.1.1 port 53";
     };
 
     search-domains = mkOption {
@@ -89,15 +78,18 @@ in {
       default = [ ];
     };
 
-    network-definition = mkOption {
-      type =
-        submodule (import ../types/network-definition.nix { inherit lib; });
-      description = "Definition of network to be served by local server.";
-    };
+    network-definition =
+      let networkOpts = import ../types/network-definition.nix { inherit lib; };
+      in mkOption {
+        type = submodule networkOpts;
+        description = "Definition of network to be served by local server.";
+        default = { };
+      };
   };
 
   config = mkIf cfg.enable {
-    services.dhcpd4 = {
+    services.dhcpd4 = let network = cfg.network-definition;
+    in {
       enable = true;
 
       machines = mapAttrsToList (hostname: hostOpts: {
@@ -105,7 +97,8 @@ in {
         hostName = hostname;
         ipAddress = hostOpts.ipv4-address;
       }) (filterAttrs (host: hostOpts:
-        hostOpts.mac-address != null && hostOpts.ipv4-address != null) hosts);
+        hostOpts.mac-address != null && hostOpts.ipv4-address != null)
+        network.hosts);
 
       interfaces = cfg.dhcp-interfaces;
 
@@ -137,7 +130,7 @@ in {
         file = let
           # We should add these...but need a domain to assign them to.
           # ip-last-el = ip: toInt (last (splitString "." ip));
-          # used-els = map (host-data: ip-last-el host-data.ip-address) hosts-data;
+          # used-els = map (host-data: ip-last-el host-data.ipv4-address) hosts-data;
           # unused-els = subtractLists used-els (map toString (range 1 255));
 
         in pkgs.writeText "db.${block}-zone" ''
@@ -160,22 +153,31 @@ in {
       ipToBlock = ip:
         concatStringsSep "." (reverseList (take 3 (splitString "." ip)));
       compactHosts =
-        mapAttrsToList (host: data: data // { host = host; }) hosts;
+        mapAttrsToList (host: data: data // { host = host; }) network.hosts;
       hostsByBlock =
-        groupBy (host-data: ipToBlock host-data.ip-address) compactHosts;
+        groupBy (host-data: ipToBlock host-data.ipv4-address) compactHosts;
       hostPtrRecord = host-data:
         "${
-          last (splitString "." host-data.ip-address)
+          last (splitString "." host-data.ipv4-address)
         } IN PTR ${host-data.host}.${cfg.domain}.";
 
       blockZones = mapAttrsToList blockHostsToZone hostsByBlock;
 
-      hostARecord = host: data: "${host} IN A ${data.ip-address}";
+      hostARecord = host: data: "${host} IN A ${data.ipv4-address}";
       hostSshFpRecords = host: data:
-        join-lines
-        (map (sshfp: "${host} IN SSHFP ${sshfp}") data.ssh-fingerprints);
+        let
+          ssh-fingerprints = if (hasAttr host known-hosts) then
+            known-hosts.${host}.ssh-fingerprints
+          else
+            [ ];
+        in join-lines
+        (map (sshfp: "${host} IN SSHFP ${sshfp}") ssh-fingerprints);
       cnameRecord = alias: host: "${alias} IN CNAME ${host}";
 
+      network = cfg.network-definition;
+
+      known-hosts = config.fudo.hosts;
+
     in {
       enable = true;
       cacheNetworks = [ cfg.network "localhost" "localnets" ];
@@ -207,12 +209,17 @@ in {
 
           $TTL 30m
 
-          ns1 IN A ${cfg.server-ip}
-          ${join-lines (mapAttrsToList hostARecord cfg.hosts)}
-          ${join-lines (mapAttrsToList hostSshFpRecords cfg.hosts)}
-          ${join-lines (mapAttrsToList cnameRecord cfg.aliases)}
-          ${join-lines cfg.extra-dns-records}
-          ${dns.srvRecordsToBindZone cfg.srv-records}
+          ${optionalString (network.gssapi-realm != null)
+          ''_kerberos IN TXT "${network.gssapi-realm}"''}
+
+          ${join-lines
+          (imap1 (i: server-ip: "ns${toString i} IN A ${server-ip}")
+            cfg.dns-servers)}
+          ${join-lines (mapAttrsToList hostARecord network.hosts)}
+          ${join-lines (mapAttrsToList hostSshFpRecords network.hosts)}
+          ${join-lines (mapAttrsToList cnameRecord network.aliases)}
+          ${join-lines network.verbatim-dns-records}
+          ${dns.srvRecordsToBindZone network.srv-records}
         '';
       }] ++ blockZones;
     };

lib/fudo/networks.nix

@@ -0,0 +1,13 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+with types;
+let networkOpts = import ../types/network-definition.nix { inherit lib; };
+
+in {
+  options.fudo.networks = mkOption {
+    type = attrsOf (submodule networkOpts);
+    description = "A map of networks to network definitions.";
+    default = { };
+  };
+}

lib/fudo/networks/rus.selby.ca.nix

@@ -0,0 +1,86 @@
+{ config, lib, ... }:
+
+{
+  default-host = "10.0.0.1";
+
+  mx = [ "mail.fudo.org" ];
+
+  hosts = {
+    clunk = {
+      ipv4-address = "10.0.0.1";
+      mac-address = "02:44:d1:eb:c3:6b";
+    };
+
+    dns-proxy = {
+      ipv4-address = "10.0.0.2";
+      # This is just a second IP on clunk, for the pihole
+    };
+
+    google-wifi = {
+      ipv4-address = "10.0.0.11";
+      mac-address = "70:3a:cb:c0:3b:09";
+    };
+
+    pselby-work = {
+      ipv4-address = "10.0.0.151";
+      mac-address = "00:50:b6:aa:bd:b3";
+    };
+
+    downstairs-desktop = {
+      ipv4-address = "10.0.0.100";
+      mac-address = "90:b1:1c:8e:29:cf";
+    };
+
+    upstairs-desktop = {
+      ipv4-address = "10.0.0.101";
+      mac-address = "80:e8:2c:22:65:c2";
+    };
+  };
+
+  aliases = {
+    dns-hole = "clunk";
+    gateway = "clunk";
+    upstairs = "upstairs-desktop";
+    downstairs = "downstairs-desktop";
+  };
+
+  srv-records = {
+    tcp = {
+      domain = [{
+        port = 53;
+        host = "clunk.${local-domain}";
+      }];
+      kerberos = [{
+        port = 88;
+        host = "france.fudo.org";
+      }];
+      kerberos-adm = [{
+        port = 88;
+        host = "france.fudo.org";
+      }];
+      ssh = [{
+        port = 22;
+        host = "clunk.${local-domain}";
+      }];
+    };
+
+    udp = {
+      domain = [{
+        port = 53;
+        host = "clunk.${local-domain}";
+      }];
+      kerberos = [{
+        port = 88;
+        host = "france.fudo.org";
+      }];
+      kerboros-master = [{
+        port = 88;
+        host = "france.fudo.org";
+      }];
+      kpasswd = [{
+        port = 464;
+        host = "france.fudo.org";
+      }];
+    };
+  };
+}

lib/fudo/networks/sea.fudo.org.nix

@@ -0,0 +1,214 @@
+{ config, lib, ... }:
+
+{
+  default-host = "10.0.0.1";
+
+  mx = [ "mail.fudo.org" ];
+
+  aliases = {
+    kadmin = "nostromo";
+    kdc = "nostromo";
+    photo = "doraemon";
+    music = "doraemon";
+    panopticon = "lambda";
+    panopticon-od = "lambda";
+    ipfs = "nostromo";
+    hole = "nostromo";
+    pihole = "nostromo";
+    dns-hole = "nostromo";
+    mon-1 = "srv-1";
+  };
+
+  srv-records = {
+    tcp = {
+      domain = [{
+        port = 53;
+        host = "nostromo.sea.fudo.org";
+      }];
+      kerberos = [{
+        port = 88;
+        host = "france.fudo.org";
+      }];
+      kerberos-adm = [{
+        port = 88;
+        host = "france.fudo.org";
+      }];
+      ssh = [{
+        port = 22;
+        host = "nostromo.sea.fudo.org";
+      }];
+      ldap = [{
+        port = 389;
+        host = "france.fudo.org";
+      }];
+    };
+
+    udp = {
+      domain = [{
+        port = 53;
+        host = "nostromo.sea.fudo.org";
+      }];
+      kerberos = [{
+        port = 88;
+        host = "france.fudo.org";
+      }];
+      kerboros-master = [{
+        port = 88;
+        host = "france.fudo.org";
+      }];
+      kpasswd = [{
+        port = 464;
+        host = "france.fudo.org";
+      }];
+    };
+  };
+
+  hosts = {
+    nostromo = {
+      ip-address = "10.0.0.1";
+      mac-address = "46:54:76:06:f1:10";
+    };
+    lm = {
+      ip-address = "10.0.0.2";
+      mac-address = "00:23:7d:e6:d9:ea";
+    };
+    lambda = {
+      ip-address = "10.0.0.3";
+      mac-address = "02:50:f6:52:9f:9d";
+    };
+    switch-master = {
+      ip-address = "10.0.0.5";
+      mac-address = "00:14:1C:B6:BB:40";
+    };
+    google-wifi = {
+      ip-address = "10.0.0.7";
+      mac-address = "7C:D9:5C:9F:6F:E9";
+    };
+    cam-entrance = {
+      ip-address = "10.0.0.31";
+      mac-address = "9c:8e:cd:0e:99:7b";
+    };
+    cam-driveway = {
+      ip-address = "10.0.0.32";
+      mac-address = "9c:8e:cd:0d:3b:09";
+    };
+    cam-deck = {
+      ip-address = "10.0.0.33";
+      mac-address = "9c:8e:cd:0e:98:c8";
+    };
+    cargo = {
+      ip-address = "10.0.0.50";
+      mac-address = "00:11:32:75:d8:b7";
+    };
+    whitedwarf = {
+      ip-address = "10.0.0.51";
+      mac-address = "00:11:32:12:14:1d";
+    };
+    doraemon = {
+      ip-address = "10.0.0.52";
+      mac-address = "00:11:32:0a:06:c5";
+    };
+    android = {
+      ip-address = "10.0.0.81";
+      mac-address = "00:16:3e:43:39:fc";
+    };
+    retro-wired = {
+      ip-address = "10.0.0.82";
+      mac-address = "dc:a6:32:6b:57:43";
+    };
+    retro = {
+      ip-address = "10.0.0.83";
+      mac-address = "dc:a6:32:6b:57:45";
+    };
+    monolith = {
+      ip-address = "10.0.0.100";
+      mac-address = "6c:62:6d:c8:b0:d8";
+    };
+    taipan = {
+      ip-address = "10.0.0.107";
+      mac-address = "52:54:00:34:c4:78";
+    };
+    spark = {
+      ip-address = "10.0.0.108";
+      mac-address = "78:24:af:04:f7:dd";
+    };
+    hyperion = {
+      ip-address = "10.0.0.109";
+      mac-address = "52:54:00:33:46:de";
+    };
+    zbox = {
+      ip-address = "10.0.0.110";
+      mac-address = "02:dd:80:52:83:9b";
+    };
+    ubiquiti-wifi = {
+      ip-address = "10.0.0.126";
+      mac-address = "04:18:d6:20:48:fb";
+    };
+    generator-wireless = {
+      ip-address = "10.0.0.130";
+      mac-address = "B8:27:EB:A6:32:26";
+    };
+    brother-wireless = {
+      ip-address = "10.0.0.160";
+      mac-address = "c0:38:96:64:49:65";
+    };
+    nest = {
+      ip-address = "10.0.0.176";
+      mac-address = "18:b4:30:16:7c:5a";
+    };
+    xixi-phone = {
+      ip-address = "10.0.0.193";
+      mac-address = "48:43:7c:75:89:42";
+    };
+    ipad = {
+      ip-address = "10.0.0.202";
+      mac-address = "9c:35:eb:48:6e:71";
+    };
+    cam-front = {
+      ip-address = "10.0.0.203";
+      mac-address = "c4:d6:55:3e:b4:c3";
+    };
+    family-tv = {
+      ip-address = "10.0.0.205";
+      mac-address = "84:a4:66:3a:b1:f8";
+    };
+    babycam = {
+      ip-address = "10.0.0.206";
+      mac-address = "08:ea:40:59:5f:9e";
+    };
+    workphone = {
+      ip-address = "10.0.0.211";
+      mac-address = "a8:8e:24:5c:12:67";
+    };
+    chromecast-2 = {
+      ip-address = "10.0.0.215";
+      mac-address = "a4:77:33:59:a2:ba";
+    };
+    front-light = {
+      ip-address = "10.0.0.221";
+      mac-address = "94:10:3e:48:94:ed";
+    };
+
+    # Ceph network
+    srv-1 = {
+      ip-address = "10.0.10.1";
+      mac-address = "02:65:d7:00:7d:1b";
+    };
+    node-1 = {
+      ip-address = "10.0.10.101";
+      mac-address = "00:1e:06:36:81:cf";
+    };
+    node-2 = {
+      ip-address = "10.0.10.102";
+      mac-address = "00:1e:06:36:ec:3e";
+    };
+    node-3 = {
+      ip-address = "10.0.10.103";
+      mac-address = "00:1e:06:36:ec:4b";
+    };
+    node-4 = {
+      ip-address = "10.0.10.104";
+      mac-address = "00:1e:06:36:dd:8c";
+    };
+  };
+}

lib/types/network-definition.nix

@@ -7,6 +7,7 @@ let
       service = {
         type = str;
         description = "Service name of SRV record.";
+        default = service;
       };
 
       priority = mkOption {
@@ -15,6 +16,13 @@ let
         default = 0;
       };
 
+      weight = mkOption {
+        type = int;
+        description =
+          "Weight to give this record, among records of equivalent priority.";
+        default = 5;
+      };
+
       port = mkOption {
         type = port;
         description = "Port for service on this host.";
@@ -29,7 +37,7 @@ let
     };
   };
 
-  hostOpts = { hostname, ... }: {
+  networkHostOpts = { hostname, ... }: {
     options = with types; {
       hostname = mkOption {
         type = str;
@@ -40,22 +48,18 @@ let
 
       ipv4-address = mkOption {
         type = nullOr str;
-        description = ''
-          The V4 IP of a given host, if any.
-        '';
+        description = "The V4 IP of a given host, if any.";
         default = null;
       };
 
       ipv6-address = mkOption {
         type = nullOr str;
-        description = ''
-          The V6 IP of a given host, if any.
-        '';
+        description = "The V6 IP of a given host, if any.";
         default = null;
       };
 
       mac-address = mkOption {
-        type = with types; nullOr types.str;
+        type = nullOr types.str;
         description =
           "The MAC address of a given host, if desired for IP reservation.";
         default = null;
@@ -65,16 +69,22 @@ let
 
 in {
   options = with types; {
-    hosts = {
-      type = attrsOf networkHostOpts;
+    hosts = mkOption {
+      type = attrsOf (submodule networkHostOpts);
       description = "Hosts on the local network, with relevant settings.";
+      example = {
+        my-host = {
+          ipv4-address = "192.168.0.1";
+          mac-address = "aa:aa:aa:aa:aa";
+        };
+      };
       default = { };
     };
 
-    srv-records = {
-      type = attrsOf (attrsOf (listOf (submodule protocolSrvRecords)));
+    srv-records = mkOption {
+      type = attrsOf (attrsOf (listOf (submodule srvRecordOpts)));
       description = "SRV records for the network.";
-      default = {
+      example = {
         tcp = {
           kerberos = {
             port = 88;
@@ -82,6 +92,7 @@ in {
           };
         };
       };
+      default = { };
     };
 
     aliases = mkOption {
@@ -121,5 +132,11 @@ in {
       description = "A list of mail servers serving this domain.";
       default = [ ];
     };
+
+    gssapi-realm = mkOption {
+      type = nullOr str;
+      description = "Kerberos GSSAPI realm of the network.";
+      default = null;
+    };
   };
 }