refactor + syncthing

common/users.nix

@@ -22,7 +22,7 @@
       extraGroups = [ "wheel" ];
       shell = pkgs.fish;
       packages = [ ];
-      openssh.authorizedKeys.keys = var.ssh-keys.hd;
+      openssh.authorizedKeys.keys = var.ssh-keys.trusted;
       hashedPasswordFile = config.age.secrets.hd-password.path;
     };
     users.root = {

host/roam/default.nix

@@ -13,6 +13,7 @@
     ./hardware-configuration.nix
     ./networking.nix
     ./services.nix
+    ./syncthing.nix
   ];
 
   boot = {

host/roam/syncthing.nix

@@ -0,0 +1,6 @@
+{ ... }:
+{
+  services.syncthing = {
+    enable = false; # TODO
+  };
+}

var/default.nix

@@ -1,11 +1,13 @@
-{ lib, ... }@inp:
+{ lib, ... }@inputs:
 let
-  files = [
+  inputs' = inputs // {
-    "lan-dns"
+    var = outputs;
-    "ssh-keys"
+  };
-    "wg"
+  # watch out for cycles
-  ];
+  outputs = {
-  import_file = name: { ${name} = import ./${name}.nix (inp // { inherit var; }); };
+    "lan-dns" = import ./lan-dns.nix inputs';
-  var = lib.foldl' (a: b: a // b) { } (map import_file files);
+    "ssh-keys" = import ./ssh-keys.nix inputs';
+    "wg" = import ./wg.nix inputs';
+  };
 in
-var
+outputs

var/lan-dns.nix

@@ -1,3 +1,4 @@
+# Wireguard peers hardcoded in /etc/hosts until I have a nice dns solution
 { lib, var, ... }:
 let
   lan-hosts = lib.mapAttrs' (name: value: {

var/ssh-keys.nix

@@ -1,9 +1,7 @@
 { lib, ... }:
 let
   mkKeys = k: { by-host = k; } // builtins.mapAttrs (_: lib.attrValues) k;
-in
+  keys = {
-
-mkKeys {
     hd = {
       "solo" = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEG+dd4m98aKEWfFa/7VZUlJNX0axvIlHVihT8w7RLyY";
       "c2" = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIsoj2+esEebRwDV2PuNRt9Vz28oolOy+Hc2THwrWTAB";
@@ -16,4 +14,14 @@ mkKeys {
       "roam" = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID++uLcQOx/to3sEo5Nk97CenGf0Y6/dMsBbLouVTgIQ";
       "fw" = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOjfPXDS3UvVGXzJYXU8TyP5q0WDzb0anx4Std40AT+j";
     };
+  };
+  keys' = mkKeys keys;
+in
+keys'
+// {
+  trusted = with keys'.by-host.hd; [
+    solo
+    c2
+    fw
+  ];
 }

var/wg.nix

@@ -35,6 +35,7 @@ rec {
   };
   keyFile = "/var/secrets/wg.key";
 
+  # Helper method: `peers-for x` filters out `x` from wireguard-network
   peers-for =
     host:
     map (lib.filterAttrs (n: _: n != "ips")) (