fedora-csb-system-manager
1{ lib }:
2let
3 /**
4 Check if the given name matches the current hostname.
5
6 @param hostname The current hostname to compare against
7 @param n The name to check
8 @return true if n equals hostname, false otherwise
9 */
10 isCurrentHost = hostname: n: n == hostname;
11
12 /**
13 Check if a host has a VPN public key configured.
14
15 @param host The host configuration to check
16 @return true if host has a non-empty VPN public key, false otherwise
17 */
18 hasVPNPublicKey = host: (lib.attrsets.attrByPath [ "net" "vpn" "pubkey" ] "" host) != "";
19
20 /**
21 Check if a host has VPN IP addresses configured.
22
23 @param host The host configuration to check
24 @return true if host has at least one VPN IP address, false otherwise
25 */
26 hasVPNips = host: (builtins.length (lib.attrsets.attrByPath [ "net" "vpn" "ips" ] [ ] host)) > 0;
27
28 /**
29 Check if a host has network IP addresses configured.
30
31 @param host The host configuration to check
32 @return true if host has at least one VPN IP address, false otherwise
33 */
34 hasIps = host: (builtins.length (lib.attrsets.attrByPath [ "net" "ips" ] [ ] host)) > 0;
35
36 /**
37 Return true if the given host has a list of Syncthing folder configured.
38
39 @param host The host configuration to check
40 @return true if host has syncthing folders configured, false otherwise
41 */
42 hasSyncthingFolders =
43 host:
44 builtins.hasAttr "syncthing" host
45 && builtins.hasAttr "folders" host.syncthing
46 && (builtins.length (lib.attrsets.attrValues host.syncthing.folders)) > 0;
47
48 /**
49 Check if a host has SSH host keys configured.
50
51 @param host The host configuration to check
52 @return true if host has SSH host keys, false otherwise
53 */
54 hasSSHHostKeys = host: builtins.hasAttr "ssh" host && builtins.hasAttr "hostKey" host.ssh;
55
56 /**
57 Get the path for the given folder, either using the host specified path or the default one.
58
59 @param name The folder name
60 @param folder The folder configuration
61 @param folders The complete folders configuration
62 @return The path for the folder
63 */
64 syncthingFolderPath =
65 name: folder: folders:
66 lib.attrsets.attrByPath [ "path" ] folders."${name}".path folder;
67
68 /**
69 Filter machines with the given syncthing folder.
70
71 @param hostname The current hostname to exclude from results
72 @param folderName The folder name to filter by
73 @param machines The set of all machines
74 @return Filtered set of machines that have the specified folder and are not the current host
75 */
76 syncthingMachinesWithFolder =
77 hostname: folderName: machines:
78 lib.attrsets.filterAttrs (
79 name: value:
80 hasSyncthingFolders value
81 && !(isCurrentHost hostname name)
82 && (builtins.hasAttr folderName value.syncthing.folders)
83 ) machines;
84
85 /**
86 Generate Syncthing addresses for a machine from its network configuration.
87
88 @param machine The machine configuration
89 @return List of TCP addresses (ips, vpn ips, and names) prefixed with "tcp://"
90 */
91 generateSyncthingAdresses =
92 machine:
93 builtins.map (x: "tcp://${x}") (
94 lib.attrsets.attrByPath [ "net" "ips" ] [ ] machine
95 ++ lib.attrsets.attrByPath [ "net" "vpn" "ips" ] [ ] machine
96 ++ lib.attrsets.attrByPath [ "net" "names" ] [ ] machine
97 );
98
99 /**
100 Get SSH host identifiers for a machine (names, IPs, and VPN IPs).
101
102 @param machine The machine configuration
103 @return List of all network identifiers for the machine
104 */
105 sshHostIdentifier =
106 machine:
107 lib.attrsets.attrByPath [ "net" "names" ] [ ] machine
108 ++ lib.attrsets.attrByPath [ "net" "ips" ] [ ] machine
109 ++ lib.attrsets.attrByPath [ "net" "vpn" "ips" ] [ ] machine;
110
111 /**
112 Generate host configuration mapping IPs to appropriate hostnames.
113
114 @param machine The machine configuration
115 @return Attribute set mapping IP addresses to corresponding hostnames
116 */
117 hostConfig =
118 machine:
119 builtins.listToAttrs (
120 map
121 (x: {
122 name = x;
123 value =
124 if (lib.strings.hasPrefix "10.100" x) then
125 builtins.filter (n: lib.strings.hasSuffix ".vpn" n) machine.net.names
126 else if (lib.strings.hasPrefix "192.168" x) then
127 builtins.filter (n: lib.strings.hasSuffix ".home" n) machine.net.names
128 else
129 [ ];
130 })
131 (
132 lib.attrsets.attrByPath [ "net" "ips" ] [ ] machine
133 ++ lib.attrsets.attrByPath [ "net" "vpn" "ips" ] [ ] machine
134 )
135 );
136
137 /**
138 Generate SSH configuration for a machine.
139
140 @param machine The machine configuration
141 @return Attribute set of SSH host configurations with hostnames, identity settings, etc.
142 */
143 sshConfig =
144 machine:
145 builtins.listToAttrs (
146 map
147 (x: {
148 name = x;
149 value = {
150 hostname =
151 if (lib.strings.hasSuffix ".vpn" x) then
152 builtins.head machine.net.vpn.ips
153 else if (lib.strings.hasSuffix ".home" x) then
154 builtins.head machine.net.ips
155 else
156 x;
157 forwardAgent = false;
158 # Disable IdentityAgent only for aomi.home (prevents yubikey prompts in TRAMP)
159 extraOptions = lib.optionalAttrs (x == "aomi.home") {
160 IdentityAgent = "none";
161 };
162 };
163 })
164 (
165 builtins.filter (x: (lib.strings.hasSuffix ".home" x) || (lib.strings.hasSuffix ".vpn" x)) (
166 sshHostIdentifier machine
167 )
168 )
169 );
170
171 /**
172 Return a list of wireguard ips from a list of ips.
173
174 Essentially, it will append /32 to each element of the list.
175
176 @param ips List of IP addresses
177 @return List of IP addresses with /32 suffix for wireguard configuration
178 */
179 wg-ips = ips: builtins.map (x: "${x}/32") ips;
180
181 /**
182 Generate Wireguard peer configurations from a set of machines.
183
184 @param machines The set of all machines
185 @return List of wireguard peer configurations with allowedIPs and publicKey
186 */
187 generateWireguardPeers =
188 machines:
189 lib.attrsets.attrValues (
190 lib.attrsets.mapAttrs
191 (_name: value: {
192 allowedIPs = value.net.vpn.ips;
193 publicKey = value.net.vpn.pubkey;
194 })
195 (
196 lib.attrsets.filterAttrs (
197 name: value: name != "kerkouane" && (hasVPNPublicKey value) && (hasVPNips value)
198 ) machines
199 )
200 );
201
202 /**
203 Generate Syncthing folder configurations for the current machine.
204
205 @param hostname The current hostname
206 @param machine The current machine configuration
207 @param machines The set of all machines
208 @param folders The folder definitions
209 @return Attribute set of syncthing folder configurations
210 */
211 generateSyncthingFolders =
212 hostname: machine: machines: folders:
213 let
214 # Default ignore patterns applied to all folders unless overridden
215 defaultIgnores = [
216 "(?d).DS_Store" # macOS metadata files
217 "(?d).localized" # macOS localized folder names
218 "(?d)Thumbs.db" # Windows thumbnails
219 "(?d)desktop.ini" # Windows folder config
220 "*.tmp" # Temporary files
221 "~*" # Backup files
222 ".~lock.*" # LibreOffice lock files
223 ];
224 in
225 lib.attrsets.mapAttrs' (
226 name: value:
227 lib.attrsets.nameValuePair (syncthingFolderPath name value folders) {
228 inherit (folders."${name}") id;
229 label = name;
230 devices = lib.attrsets.mapAttrsToList (n: _v: n) (
231 syncthingMachinesWithFolder hostname name machines
232 );
233 rescanIntervalS = 3600 * 6; # TODO: make it configurable
234 # Apply default ignores if not specified in globals
235 ignores = folders."${name}".ignores or defaultIgnores;
236 }
237 ) (lib.attrsets.attrByPath [ "syncthing" "folders" ] { } machine);
238
239 /**
240 Generate Syncthing device configurations for all machines except the current one.
241
242 @param hostname The current hostname to exclude
243 @param machines The set of all machines
244 @return Attribute set of syncthing device configurations with IDs and addresses
245 */
246 generateSyncthingDevices =
247 hostname: machines:
248 lib.attrsets.mapAttrs
249 (_name: value: {
250 inherit (value.syncthing) id;
251 addresses = generateSyncthingAdresses value;
252 })
253 (
254 lib.attrsets.filterAttrs (
255 name: value: hasSyncthingFolders value && !(isCurrentHost hostname name)
256 ) machines
257 );
258
259 /**
260 Generate Syncthing GUI address for a machine.
261
262 @param machine The machine configuration
263 @return String in format "IP:8384" for accessing Syncthing GUI
264 */
265 syncthingGuiAddress =
266 machine:
267 (builtins.head (lib.attrsets.attrByPath [ "net" "vpn" "ips" ] [ "127.0.0.1" ] machine)) + ":8384";
268
269 /**
270 Generate SSH known_hosts entries for all machines with SSH host keys.
271
272 @param machines The set of all machines
273 @return String containing SSH known_hosts entries
274 */
275 sshKnownHosts =
276 machines:
277 lib.strings.concatStringsSep "\n" (
278 lib.attrsets.mapAttrsToList (
279 _name: value: "${lib.strings.concatStringsSep "," (sshHostIdentifier value)} ${value.ssh.hostKey}"
280 ) (lib.attrsets.filterAttrs (_name: hasSSHHostKeys) machines)
281 );
282
283 /**
284 Merge host configurations from all machines.
285
286 @param machines The set of all machines
287 @return Merged attribute set of all host configurations
288 */
289 hostConfigs =
290 machines: lib.attrsets.mergeAttrsList (lib.attrsets.mapAttrsToList (_name: hostConfig) machines);
291
292 /**
293 Generate and merge SSH configurations from all machines.
294
295 @param machines The set of all machines
296 @return Merged attribute set of all SSH configurations
297 */
298 sshConfigs =
299 machines:
300 lib.attrsets.mergeAttrsList (
301 lib.attrsets.mapAttrsToList (_name: sshConfig) (
302 lib.attrsets.filterAttrs (_name: _value: true) machines
303 )
304 );
305
306 /**
307 Create service defaults for media/homelab services.
308
309 Common pattern for services that run as a specific user/group with firewall access.
310
311 @param user The user to run the service as (default: "vincent")
312 @param group The group to run the service as (default: "users")
313 @param openFirewall Whether to open firewall for the service (default: true)
314 @return Attribute set with user, group, and openFirewall settings
315 */
316 mkServiceDefaults =
317 {
318 user ? "vincent",
319 group ? "users",
320 openFirewall ? true,
321 }:
322 {
323 inherit user group openFirewall;
324 };
325
326 /**
327 Create a Samba share configuration with common defaults.
328
329 Standard configuration for public, writable shares with guest access.
330
331 @param name The name of the share
332 @param path The filesystem path to share
333 @param user The user for force user/group (default: "vincent")
334 @param group The group for force user/group (default: "users")
335 @param readOnly Make the share read-only (default: false)
336 @return Attribute set with complete Samba share configuration
337 */
338 mkSambaShare =
339 {
340 name,
341 path,
342 user ? "vincent",
343 group ? "users",
344 readOnly ? false,
345 }:
346 {
347 inherit path;
348 public = "yes";
349 browseable = "yes";
350 "read only" = if readOnly then "yes" else "no";
351 "guest ok" = "yes";
352 writable = if readOnly then "no" else "yes";
353 comment = if readOnly then "${name} (read-only)" else name;
354 "create mask" = "0644";
355 "directory mask" = "0755";
356 "force user" = user;
357 "force group" = group;
358 };
359in
360{
361 inherit
362 syncthingFolderPath
363 hasSyncthingFolders
364 syncthingMachinesWithFolder
365 generateSyncthingAdresses
366 isCurrentHost
367 hasVPNPublicKey
368 hasVPNips
369 hasIps
370 hasSSHHostKeys
371 sshHostIdentifier
372 sshConfig
373 hostConfig
374 wg-ips
375 generateWireguardPeers
376 generateSyncthingFolders
377 generateSyncthingDevices
378 syncthingGuiAddress
379 sshKnownHosts
380 hostConfigs
381 sshConfigs
382 mkServiceDefaults
383 mkSambaShare
384 ;
385}