flake: init

108 files changed, 652 insertions, 547 deletions

diff --git a/flake.lock b/flake.lock
new file mode 100644
index 000000000..937db8871
--- /dev/null
+++ b/flake.lock
@@ -0,0 +1,44 @@
+{
+  "nodes": {
+    "nix-writers": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1677612737,
+        "narHash": "sha256-UaCKZ4PbMZU6UZH7XNFcjRtd5jheswl66rjZDBfQgp8=",
+        "ref": "refs/heads/master",
+        "rev": "66a1f6833464bbb121b6d94247ad769f277351f8",
+        "revCount": 39,
+        "type": "git",
+        "url": "https://cgit.krebsco.de/nix-writers"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://cgit.krebsco.de/nix-writers"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1686135559,
+        "narHash": "sha256-pY8waAV8K/sbHBdLn5diPFnQKpNg0YS9w03MrD2lUGE=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "381e92a35e2d196fdd6077680dca0cd0197e75cb",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "nix-writers": "nix-writers",
+        "nixpkgs": "nixpkgs"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}
diff --git a/flake.nix b/flake.nix
new file mode 100644
index 000000000..213f06482
--- /dev/null
+++ b/flake.nix
@@ -0,0 +1,30 @@
+{
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    nix-writers = {
+      url = "git+https://cgit.krebsco.de/nix-writers";
+      flake = false;
+    };
+    # disko.url = "github:nix-community/disko";
+    # disko.inputs.nixpkgs.follows = "nixpkgs";
+  };
+
+  description = "stockholm";
+
+  outputs = { self, nixpkgs, nix-writers }: {
+    nixosConfigurations.hotdog = nixpkgs.lib.nixosSystem {
+      system = "x86_64-linux";
+      specialArgs.stockholm = self;
+      specialArgs.nix-writers = nix-writers;
+      specialArgs.secrets = toString ./krebs/0tests/data/secrets;
+      modules = [
+        ./krebs/1systems/hotdog/config.nix
+      ];
+    };
+    kartei = {
+      hosts = self.nixosConfigurations.hotdog.config.krebs.hosts;
+      users = self.nixosConfigurations.hotdog.config.krebs.users;
+    };
+    lib = import (self.outPath + "/lib/pure.nix") { lib = nixpkgs.lib; };
+  };
+}
diff --git a/kartei/0x4A6F/default.nix b/kartei/0x4A6F/default.nix
index 8939f267d..eb3d08e8d 100644
--- a/kartei/0x4A6F/default.nix
+++ b/kartei/0x4A6F/default.nix
@@ -1,12 +1,13 @@
-with import ../../lib;
-{ config, ... }: let
+{ config, lib, ... }: let
+  inherit (lib) flip mapAttrs optionalAttrs recursiveUpdate;
+  slib = import ../../lib/pure.nix { inherit lib; };
   hostDefaults = hostName: host: flip recursiveUpdate host ({
     ci = false;
     external = true;
     monitoring = false;
   } // optionalAttrs (host.nets?retiolum) {
     nets.retiolum.ip6.addr =
-      (krebs.genipv6 "retiolum" "external" { inherit hostName; }).address;
+      (slib.krebs.genipv6 "retiolum" "external" { inherit hostName; }).address;
   });
 in {
   users = {
diff --git a/kartei/dave/default.nix b/kartei/dave/default.nix
index 053ec412b..04f226cc1 100644
--- a/kartei/dave/default.nix
+++ b/kartei/dave/default.nix
@@ -1,5 +1,5 @@
-{ config, ... }: let
-  lib = import ../../lib;
+{ config, lib, ... }: let
+  slib = import ../../lib/pure.nix { inherit lib; };
 in {
   users.dave = {
     mail = "hsngrmpf@gmail.com";
@@ -8,7 +8,7 @@ in {
     owner = config.krebs.users.dave;
     nets.retiolum = {
       aliases = [ "dave.r" ];
-      ip6.addr = (lib.krebs.genipv6 "retiolum" "dave" { hostName = "dave"; }).address;
+      ip6.addr = (slib.krebs.genipv6 "retiolum" "dave" { hostName = "dave"; }).address;
       ip4.addr = "10.243.0.6";
       tinc.pubkey = ''
         -----BEGIN RSA PUBLIC KEY-----
diff --git a/kartei/dbalan/default.nix b/kartei/dbalan/default.nix
index fadf187db..6bf10b921 100644
--- a/kartei/dbalan/default.nix
+++ b/kartei/dbalan/default.nix
@@ -1,6 +1,7 @@
-with import ../../lib;
-{ config, ... }:
+{ config, lib, ... }:
 let
+  inherit (lib) flip mapAttrs optionalAttrs recursiveUpdate;
+  slib = import ../../lib/pure.nix { inherit lib; };
   hostDefaults = hostName: host: flip recursiveUpdate host ({
     ci = false;
     external = true;
@@ -8,11 +9,11 @@ let
     owner = config.krebs.users.dbalan;
   } // optionalAttrs (host.nets?retiolum) {
     nets.retiolum = {
-      ip6.addr = (krebs.genipv6 "retiolum" "external" { inherit hostName; }).address;
+      ip6.addr = (slib.krebs.genipv6 "retiolum" "external" { inherit hostName; }).address;
     };
   } // optionalAttrs (host.nets?wiregrill) {
     nets.wiregrill = {
-      ip6.addr = (krebs.genipv6 "wiregrill" "external" { inherit hostName; }).address;
+      ip6.addr = (slib.krebs.genipv6 "wiregrill" "external" { inherit hostName; }).address;
     };
   });
 in
diff --git a/kartei/default.nix b/kartei/default.nix
index 6024e2351..046efdd7b 100644
--- a/kartei/default.nix
+++ b/kartei/default.nix
@@ -9,7 +9,7 @@ in {
         (name: _type: let
           path = ./. + "/${name}";
         in {
-          krebs = import path { inherit config; };
+          krebs = import path { inherit config lib; };
         })
         (removeTemplate
           (lib.filterAttrs
diff --git a/kartei/feliks/default.nix b/kartei/feliks/default.nix
index e98da7bc6..96c20f602 100644
--- a/kartei/feliks/default.nix
+++ b/kartei/feliks/default.nix
@@ -1,5 +1,6 @@
-with import ../../lib;
-{ config, ... }: let
+{ config, lib, ... }: let
+  inherit (lib) flip mapAttrs optionalAttrs recursiveUpdate;
+  slib = import ../../lib/pure.nix { inherit lib; };
   hostDefaults = hostName: host: flip recursiveUpdate host ({
     owner = config.krebs.users.feliks;
     ci = false;
@@ -7,10 +8,10 @@ with import ../../lib;
     monitoring = false;
   } // optionalAttrs (host.nets?retiolum) {
     nets.retiolum.ip6.addr =
-      (krebs.genipv6 "retiolum" "external" { inherit hostName; }).address;
+      (slib.krebs.genipv6 "retiolum" "external" { inherit hostName; }).address;
   } // optionalAttrs (host.nets?wiregrill) {
     nets.wiregrill.ip6.addr =
-      (krebs.genipv6 "wiregrill" "external" { inherit hostName; }).address;
+      (slib.krebs.genipv6 "wiregrill" "external" { inherit hostName; }).address;
   });
 in {
   users.feliks = {
diff --git a/kartei/jan/default.nix b/kartei/jan/default.nix
index 72b5cb331..c0e3922a7 100644
--- a/kartei/jan/default.nix
+++ b/kartei/jan/default.nix
@@ -1,5 +1,5 @@
-{ config, ... }: let
-  lib = import ../../lib;
+{ config, lib, ... }: let
+  slib = import ../../lib/pure.nix { inherit lib; };
 in {
 
   users.jan = {
@@ -67,7 +67,7 @@ in {
     nets.retiolum = {
       aliases = [ "grill.r" ];
       ip4.addr = "10.243.217.217";
-      ip6.addr = (lib.krebs.genipv6 "retiolum" "jan" { hostName = "grill"; }).address;
+      ip6.addr = (slib.krebs.genipv6 "retiolum" "jan" { hostName = "grill"; }).address;
       tinc.pubkey = ''
         -----BEGIN RSA PUBLIC KEY-----
         MIICCgKCAgEAs4P6CfRcwFGCqkfv1tyTbbk2eHh08kEqxPNQ655sMKWxMhgRnRII
diff --git a/kartei/jeschli/default.nix b/kartei/jeschli/default.nix
index fe12c16a4..a53ff7a22 100644
--- a/kartei/jeschli/default.nix
+++ b/kartei/jeschli/default.nix
@@ -1,12 +1,12 @@
-with import ../../lib;
-{ config, ... }: let
-
+{ config, lib, ... }: let
+  inherit (lib) flip mapAttrs optionalAttrs recursiveUpdate;
+  slib = import ../../lib/pure.nix { inherit lib; };
   hostDefaults = hostName: host: flip recursiveUpdate host ({
     ci = true;
     owner = config.krebs.users.jeschli;
   } // optionalAttrs (host.nets?retiolum) {
     nets.retiolum.ip6.addr =
-      (krebs.genipv6 "retiolum" "jeschli" { inherit hostName; }).address;
+      (slib.krebs.genipv6 "retiolum" "jeschli" { inherit hostName; }).address;
   });
 
 in {
diff --git a/kartei/kmein/default.nix b/kartei/kmein/default.nix
index 1a5a57d1a..