# skyworks-Nix-infra

NixOS configurations for the two NixOS hosts. Flake-based (`flake.nix`)
with `disko` for disk layout, `agenix` for secrets, and `deploy-rs` for
push-based deploys from a workstation (the canonical workflow, magic-rollback
on). Hosts can also self-update with `git pull && nixos-rebuild switch` on the
box — handy when the workstation can't cross-build the target closure.

## Hosts

| Host | IP (mgmt) | Role |
|---|---|---|
| `xlab-gateway` | 10.253.254.1 | Lab gateway / WAN router. Bond + VLANs (lan254, wan99, mgmt) + WireGuard tunnels with policy routing, NAT/masquerade. Kea DHCP4/6, radvd, fail2ban. |
| `skydick` | 10.0.1.1 | Storage server. ZFS data pool with hot spares; Samba (LDAP-backed passdb) + NFS + iSCSI. Jumbo frames (MTU 9200) over bonded 2×40G ConnectX-3 (LACP 802.3ad, `bond40g`). |

## Layout

```
flake.nix              # entrypoint, defines both hosts + deploy-rs nodes
hosts/
  xlab-gateway/
    default.nix          # host config (boot, users, packages, smartd)
    networking.nix       # bond/VLAN/WG/nftables/services.resolved
    dhcp.nix             # Kea DHCP4/6 + DDNS
    disko.nix            # ZFS root layout
    hardware-configuration.nix
  skydick/
    default.nix          # host config + most networking inline
    datapool.nix         # ZFS pool layout, Samba + LDAP integration
    disko.nix            # boot disk layout
    samba-ldap-bootstrap.ldif
modules/
  common.nix             # locale, packages, sshd hardening defaults
  users.nix              # ldx user + ssh keys
  ssh.nix                # sshd hardening
  monitoring.nix         # node-exporter, smart, etc.
secrets/                 # agenix-encrypted (.age files)
```

## Deploy (the simple way, from the box)

```sh
ssh ldx@<host>
cd /etc/nixos && sudo git pull && sudo nixos-rebuild switch --flake /etc/nixos#<host>
```

## Deploy via deploy-rs (from a workstation)

```sh
# From an aarch64-darwin Mac (can't cross-build the x86_64-linux closure):
nix run github:serokell/deploy-rs -- --remote-build --skip-checks .#<host>
```

`--remote-build` builds on the target (its store is reachable as
`ssh-ng://ldx@<host>`); `--skip-checks` skips `nix flake check`, whose
x86_64-linux `deployChecks` can't be built on darwin. Magic-rollback is on, so a
bad activation auto-reverts. Note: deploy-rs activates a closure but does **not**
update `/etc/nixos` git on the host — use the on-the-box `git pull` flow if you
want the host's checkout to track `main`.

## Common gotchas

- **DNS**: both hosts route DNS via `10.0.0.1` (mosdns) with a fallback set
  in `services.resolved.fallbackDns`. Don't add a co-primary nameserver to
  `networking.nameservers` — systemd-resolved load-balances and bypasses
  the analytics filter on 10.0.0.1.

- **IPv6 RA**: `skydick` runs IPv6 *enabled* (SLAAC, stable token `::d1c0` on
  `bond40g`). RA-provided DNS is kept out of systemd-resolved with `UseDNS =
  false` in `ipv6AcceptRAConfig` — **not** by disabling IPv6. Pin the stable
  token address with `IPv6PrivacyExtensions = lib.mkForce false` (NixOS forces
  `"kernel"` otherwise) and `tempAddress = "disabled"`. Do not reintroduce
  `enableIPv6 = false` / `accept_ra = 0` on skydick.

- **deploy-rs ssh user**: defined as `ldx` with sudo escalation to root.
  Make sure the host key in `secrets.nix` matches reality after a reinstall
  (rekey all secrets if the host key changes).

## Remote

`gitbucket.skyw.top/Skyworks/skyworks-Nix-infra` is canonical. No GitHub
remote configured.