
docs	docs: record implemented gateway optimizations (IPv4 egress, QoS, L7 DPI live)	1 month ago
hosts	skydick: read-only [torrents] SMB share + stale-doc fixes	1 month ago
modules	skydick/monitoring: drop InfluxDB zpool_io, add Prometheus pool-member map	1 month ago
secrets	Fix influxdb-token encryption (was empty)	3 months ago
.gitignore	gitignore: add .DS_Store	2 months ago
README.md	skydick: read-only [torrents] SMB share + stale-doc fixes	1 month ago
flake.lock	skydick: upgrade to nixos-25.11, add Spotlight + recycle bin	4 months ago
flake.nix	Add InfluxDB v2 on skydick for fleet monitoring	3 months ago

skyworks-Nix-infra

NixOS configurations for the two NixOS hosts. Flake-based (flake.nix)
with disko for disk layout, agenix for secrets, and deploy-rs for
push-based deploys from a workstation (the canonical workflow, magic-rollback
on). Hosts can also self-update with git pull && nixos-rebuild switch on the
box — handy when the workstation can't cross-build the target closure.

Hosts

Host	IP (mgmt)	Role
`xlab-gateway`	10.253.254.1	Lab gateway / WAN router. Bond + VLANs (lan254, wan99, mgmt) + WireGuard tunnels with policy routing, NAT/masquerade. Kea DHCP4/6, radvd, fail2ban.
`skydick`	10.0.1.1	Storage server. ZFS data pool with hot spares; Samba (LDAP-backed passdb) + NFS + iSCSI. Jumbo frames (MTU 9200) over bonded 2×40G ConnectX-3 (LACP 802.3ad, `bond40g`).

Layout

flake.nix              # entrypoint, defines both hosts + deploy-rs nodes
hosts/
  xlab-gateway/
    default.nix          # host config (boot, users, packages, smartd)
    networking.nix       # bond/VLAN/WG/nftables/services.resolved
    dhcp.nix             # Kea DHCP4/6 + DDNS
    disko.nix            # ZFS root layout
    hardware-configuration.nix
  skydick/
    default.nix          # host config + most networking inline
    datapool.nix         # ZFS pool layout, Samba + LDAP integration
    disko.nix            # boot disk layout
    samba-ldap-bootstrap.ldif
modules/
  common.nix             # locale, packages, sshd hardening defaults
  users.nix              # ldx user + ssh keys
  ssh.nix                # sshd hardening
  monitoring.nix         # node-exporter, smart, etc.
secrets/                 # agenix-encrypted (.age files)

Deploy (the simple way, from the box)

ssh ldx@<host>
cd /etc/nixos && sudo git pull && sudo nixos-rebuild switch --flake /etc/nixos#<host>

Deploy via deploy-rs (from a workstation)

# From an aarch64-darwin Mac (can't cross-build the x86_64-linux closure):
nix run github:serokell/deploy-rs -- --remote-build --skip-checks .#<host>

--remote-build builds on the target (its store is reachable as
ssh-ng://ldx@<host>); --skip-checks skips nix flake check, whose
x86_64-linux deployChecks can't be built on darwin. Magic-rollback is on, so a
bad activation auto-reverts. Note: deploy-rs activates a closure but does not
update /etc/nixos git on the host — use the on-the-box git pull flow if you
want the host's checkout to track main.

Common gotchas

DNS: both hosts route DNS via 10.0.0.1 (mosdns) with a fallback set
in services.resolved.fallbackDns. Don't add a co-primary nameserver to
networking.nameservers — systemd-resolved load-balances and bypasses
the analytics filter on 10.0.0.1.
IPv6 RA: skydick runs IPv6 enabled (SLAAC, stable token ::d1c0 on
bond40g). RA-provided DNS is kept out of systemd-resolved with UseDNS = false in ipv6AcceptRAConfig — not by disabling IPv6. Pin the stable
token address with IPv6PrivacyExtensions = lib.mkForce false (NixOS forces
"kernel" otherwise) and tempAddress = "disabled". Do not reintroduce
enableIPv6 = false / accept_ra = 0 on skydick.
deploy-rs ssh user: defined as ldx with sudo escalation to root.
Make sure the host key in secrets.nix matches reality after a reinstall
(rekey all secrets if the host key changes).

Remote

gitbucket.skyw.top/Skyworks/skyworks-Nix-infra is canonical. No GitHub
remote configured.