Update nixpkgs 2025-12-16-02-03

configuration/common/programs.nix

@@ -7,6 +7,9 @@
     gptfdisk
     parted
     grow-last-partition-and-filesystem
+    pciutils
+    lshw
+    ethtool
 
     # Normal usage
     htop

flake.lock

@@ -650,11 +650,11 @@
     },
     "nixpkgs_5": {
       "locked": {
-        "lastModified": 1763421233,
-        "narHash": "sha256-Stk9ZYRkGrnnpyJ4eqt9eQtdFWRRIvMxpNRf4sIegnw=",
+        "lastModified": 1765779637,
+        "narHash": "sha256-KJ2wa/BLSrTqDjbfyNx70ov/HdgNBCBBSQP3BIzKnv4=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "89c2b2330e733d6cdb5eae7b899326930c2c0648",
+        "rev": "1306659b587dc277866c7b69eb97e5f07864d8c4",
         "type": "github"
       },
       "original": {

hosts/carbon/configuration.nix

@@ -7,18 +7,13 @@
 
       ./dns.nix
       ./ds-lite-ncfttb.nix
-      ./mdns.nix
       ./net-dsl.nix
-      ./net-gastnetz.nix
       ./net-heimnetz.nix
       ./net-iot.nix
-      ./net-lte.nix
       ./net-mgmt.nix
       ./net-printer.nix
-      ./net-voip.nix
       ./ntp.nix
       ./ppp-ncfttb.nix
-      ./scan-to-gpg.nix
       ./wg-clerie.nix
     ];
 
@@ -37,14 +32,6 @@
 
   networking.useDHCP = false;
 
-  networking.nat = {
-    enableIPv6 = true;
-    enable = true;
-    externalInterface = "ppp-ncfttb";
-    internalIPv6s = [ "fd00:152:152::/48" "fd00:3214:9453:4920::/64"];
-    internalIPs = [ "10.152.0.0/16" "192.168.32.0/24" ];
-  };
-
   services.radvd.enable = true;
 
   services.kea.dhcp4 = {

hosts/carbon/ds-lite-ncfttb.nix

@@ -8,7 +8,7 @@
     tunnelInterfaceName = "ds-lite-ncfttb";
     lanInterfaces = [
       {
-        name = "net-heimnetz";
+        name = "enp2s0";
         sla_id = 201;
         prefix_len = 64;
       }

hosts/carbon/mdns.nix

@@ -1,17 +0,0 @@
-{ pkgs, ... }:
-
-{
-
-  services.avahi = {
-    enable = true;
-    nssmdns4 = true;
-
-    allowInterfaces = [
-      "net-heimnetz"
-      "net-iot"
-    ];
-
-    reflector = true;
-  };
-
-}

hosts/carbon/net-dsl.nix

@@ -3,17 +3,9 @@
 {
 
   ## DSL-Uplink
-  networking.vlans."enp1s0.10" = {
-    id = 10;
-    interface = "enp1s0";
-  };
   networking.vlans."enp3s0.10" = {
     id = 10;
     interface = "enp3s0";
   };
-  networking.bridges."net-dsl".interfaces = [
-    "enp1s0.10"
-    "enp3s0.10"
-  ];
 
 }

hosts/carbon/net-gastnetz.nix

@@ -1,69 +0,0 @@
-{ ... }:
-
-{
-
-  ## Gastnetz
-  networking.vlans."enp1s0.202" = {
-    id = 202;
-    interface = "enp1s0";
-  };
-  networking.bridges."net-gastnetz".interfaces = [
-    "enp1s0.202"
-  ];
-  networking.interfaces."net-gastnetz".ipv6.addresses = [
-    { address = "fd00:3214:9453:4920::1"; prefixLength = 64; }
-  ];
-  networking.interfaces."net-gastnetz".ipv4.addresses = [
-    { address = "192.168.32.1"; prefixLength = 24; }
-  ];
-
-  services.radvd.config = ''
-    interface net-gastnetz {
-      AdvSendAdvert on;
-      MaxRtrAdvInterval 30;
-      prefix ::/64 {
-        AdvValidLifetime 300;
-        AdvPreferredLifetime 120;
-      };
-      RDNSS 2620:fe::fe 2620:fe::9 {}; # Quad 9
-    };
-  '';
-
-  services.kea.dhcp4 = {
-    settings = {
-      interfaces-config = {
-        interfaces = [ "net-gastnetz" ];
-      };
-      subnet4 = [
-        # Gastnetz
-        {
-          id = 202;
-          subnet = "192.168.32.0/24";
-          pools = [
-            {
-              pool = "192.168.32.100 - 192.168.32.240";
-            }
-          ];
-          option-data = [
-            {
-              name = "routers";
-              data = "192.168.32.1";
-            }
-            {
-              name = "domain-name-servers";
-              data = "9.9.9.9,149.112.112.112"; # Quad 9
-            }
-          ];
-        }
-      ];
-    };
-  };
-
-  # net-gastnetz can only access internet
-  clerie.firewall.extraForwardFilterCommands = ''
-    ip46tables -A forward-filter -i net-gastnetz -o ppp-ncfttb -j ACCEPT
-    ip46tables -A forward-filter -i net-gastnetz -j DROP
-    ip46tables -A forward-filter -o net-gastnetz -j DROP
-  '';
-
-}

hosts/carbon/net-heimnetz.nix

@@ -3,24 +3,16 @@
 {
 
   ## Heimnetz
-  networking.vlans."enp1s0.201" = {
-    id = 201;
-    interface = "enp1s0";
-  };
-  networking.bridges."net-heimnetz".interfaces = [
-    "enp1s0.201"
-    "enp2s0"
-  ];
-  networking.interfaces."net-heimnetz".ipv6.addresses = [
+  networking.interfaces."enp2s0".ipv6.addresses = [
     { address = "fe80::1"; prefixLength = 64; }
     { address = "fd00:152:152:4::1"; prefixLength = 64; }
   ];
-  networking.interfaces."net-heimnetz".ipv4.addresses = [
+  networking.interfaces."enp2s0".ipv4.addresses = [
     { address = "10.152.4.1"; prefixLength = 24; }
   ];
 
   services.radvd.config = ''
-    interface net-heimnetz {
+    interface enp2s0 {
       AdvSendAdvert on;
       MaxRtrAdvInterval 30;
       prefix ::/64 {
@@ -35,7 +27,7 @@
   services.kea.dhcp4 = {
     settings = {
       interfaces-config = {
-        interfaces = [ "net-heimnetz" ];
+        interfaces = [ "enp2s0" ];
       };
       subnet4 = [
         # Heimnetz

hosts/carbon/net-iot.nix

@@ -6,22 +6,19 @@
     id = 205;
     interface = "enp1s0";
   };
-  networking.bridges."net-iot".interfaces = [
-    "enp1s0.205"
-  ];
-  networking.interfaces."net-iot".ipv6.addresses = [
+  networking.interfaces."enp1s0.205".ipv6.addresses = [
     { address = "fe80::1"; prefixLength = 64; }
     { address = "fd00:152:152:205::1"; prefixLength = 64; }
   ];
-  networking.interfaces."net-iot".ipv4.addresses = [
+  networking.interfaces."enp1s0.205".ipv4.addresses = [
     { address = "10.152.205.1"; prefixLength = 24; }
   ];
 
   # Enable NTP
-  networking.firewall.interfaces."net-iot".allowedUDPPorts = [ 123 ];
+  networking.firewall.interfaces."enp1s0.205".allowedUDPPorts = [ 123 ];
 
   services.radvd.config = ''
-    interface net-iot {
+    interface enp1s0.205 {
       AdvSendAdvert on;
       MaxRtrAdvInterval 30;
       prefix ::/64 {
@@ -36,7 +33,7 @@
   services.kea.dhcp4 = {
     settings = {
       interfaces-config = {
-        interfaces = [ "net-iot" ];
+        interfaces = [ "enp1s0.205" ];
       };
       subnet4 = [
         {
@@ -72,9 +69,9 @@
 
   clerie.firewall.extraForwardFilterCommands = ''
     # Allow access from Heimnetz to IOT devices
-    ip46tables -A forward-filter -i net-heimnetz -o net-iot -j ACCEPT
-    ip46tables -A forward-filter -i net-iot -j DROP
-    ip46tables -A forward-filter -o net-iot -j DROP
+    ip46tables -A forward-filter -i enp2s0 -o enp1s0.205 -j ACCEPT
+    ip46tables -A forward-filter -i enp1s0.205 -j DROP
+    ip46tables -A forward-filter -o enp1s0.205 -j DROP
   '';
 
 }

hosts/carbon/net-lte.nix

@@ -1,11 +0,0 @@
-{ ... }:
-
-{
-
-  ## LTE-Uplink
-  networking.vlans."enp1s0.102" = {
-    id = 102;
-    interface = "enp1s0";
-  };
-
-}

hosts/carbon/net-mgmt.nix

@@ -6,19 +6,16 @@
     id = 203;
     interface = "enp1s0";
   };
-  networking.bridges."net-mgmt".interfaces = [
-    "enp1s0.203"
-  ];
-  networking.interfaces."net-mgmt".ipv6.addresses = [
+  networking.interfaces."enp1s0.203".ipv6.addresses = [
     { address = "fe80::1"; prefixLength = 64; }
     { address = "fd00:152:152:203::1"; prefixLength = 64; }
   ];
-  networking.interfaces."net-mgmt".ipv4.addresses = [
+  networking.interfaces."enp1s0.203".ipv4.addresses = [
     { address = "10.152.203.1"; prefixLength = 24; }
   ];
 
   services.radvd.config = ''
-    interface net-mgmt {
+    interface enp1s0.203 {
       AdvSendAdvert on;
       MaxRtrAdvInterval 30;
       prefix ::/64 {
@@ -31,7 +28,7 @@
   services.kea.dhcp4 = {
     settings = {
       interfaces-config = {
-        interfaces = [ "net-mgmt" ];
+        interfaces = [ "enp1s0.203" ];
       };
       subnet4 = [
         {
@@ -55,9 +52,9 @@
 
   clerie.firewall.extraForwardFilterCommands = ''
     # Allow access from Heimnetz to MGMT network
-    ip46tables -A forward-filter -i net-heimnetz -o net-mgmt -j ACCEPT
-    ip46tables -A forward-filter -i net-mgmt -j DROP
-    ip46tables -A forward-filter -o net-mgmt -j DROP
+    ip46tables -A forward-filter -i enp2s0 -o enp1s0.203 -j ACCEPT
+    ip46tables -A forward-filter -i enp1s0.203 -j DROP
+    ip46tables -A forward-filter -o enp1s0.203 -j DROP
   '';
 
 }

hosts/carbon/net-printer.nix

@@ -5,17 +5,14 @@
     id = 206;
     interface = "enp1s0";
   };
-  networking.bridges."net-printer".interfaces = [
-    "enp1s0.206"
-  ];
-  networking.interfaces."net-printer".ipv4.addresses = [
+  networking.interfaces."enp1s0.206".ipv4.addresses = [
     { address = "10.152.206.1"; prefixLength = 24; }
   ];
 
   services.kea.dhcp4 = {
     settings = {
       interfaces-config = {
-        interfaces = [ "net-printer" ];
+        interfaces = [ "enp1s0.206" ];
       };
       subnet4 = [
         {
@@ -37,15 +34,11 @@
     };
   };
 
-  # Enable scan-to-gpg
-  networking.firewall.interfaces."net-printer".allowedTCPPorts = [ 2121 ];
-  networking.firewall.interfaces."net-printer".allowedTCPPortRanges = [ { from = 2130; to = 2134; } ];
-
   clerie.firewall.extraForwardFilterCommands = ''
     # Allow access from Heimnetz to printer
-    ip46tables -A forward-filter -i net-heimnetz -o net-printer -j ACCEPT
-    ip46tables -A forward-filter -i net-printer -j DROP
-    ip46tables -A forward-filter -o net-printer -j DROP
+    ip46tables -A forward-filter -i enp2s0 -o enp1s0.206 -j ACCEPT
+    ip46tables -A forward-filter -i enp1s0.206 -j DROP
+    ip46tables -A forward-filter -o enp1s0.206 -j DROP
   '';
 
 }

hosts/carbon/net-voip.nix

@@ -1,105 +0,0 @@
-{ ... }:
-
-{
-
-  ## VoIP
-  networking.vlans."enp1s0.204" = {
-    id = 204;
-    interface = "enp1s0";
-  };
-  networking.interfaces."enp1s0.204".ipv4.addresses = [
-    { address = "10.152.33.1"; prefixLength = 24; }
-  ];
-
-  services.kea.dhcp4 = {
-    settings = {
-      interfaces-config = {
-        interfaces = [ "enp1s0.204" ];
-      };
-      option-def = [
-        {
-          space = "dhcp4";
-          name = "vendor-encapsulated-options";
-          code = 43;
-          type = "empty";
-          encapsulate = "sipdect";
-        }
-        {
-          space = "sipdect";
-          name = "ommip1";
-          code = 10;
-          type = "ipv4-address";
-        }
-        {
-          space = "sipdect";
-          name = "ommip2";
-          code = 19;
-          type = "ipv4-address";
-        }
-        {
-          space = "sipdect";
-          name = "syslogip";
-          code = 14;
-          type = "ipv4-address";
-        }
-        {
-          space = "sipdect";
-          name = "syslogport";
-          code = 15;
-          type = "int16";
-        }
-        {
-          space = "dhcp4";
-          name = "magic_str";
-          code = 224;
-          type = "string";
-        }
-      ];
-      subnet4 = [
-        # VoIP
-        {
-          id = 204;
-          subnet = "10.152.33.0/24";
-          pools = [
-            {
-              pool = "10.152.33.10 - 10.152.33.200";
-            }
-          ];
-          option-data = [
-            {
-              name = "routers";
-              data = "10.152.33.1";
-            }
-          ];
-
-          reservations = [
-            {
-              hostname = "iridium";
-              hw-address = "00:30:42:1B:8C:7C";
-              ip-address = "10.152.33.11";
-              option-data = [
-                {
-                  name = "host-name";
-                  data = "iridium";
-                }
-                {
-                  name = "vendor-encapsulated-options";
-                }
-                {
-                  space = "sipdect";
-                  name = "ommip1";
-                  data = "10.152.33.11";
-                }
-                {
-                  name = "magic_str";
-                  data = "OpenMobilitySIP-DECT";
-                }
-              ];
-            }
-          ];
-        }
-      ];
-    };
-  };
-
-}

hosts/carbon/ppp-ncfttb.nix

@@ -6,7 +6,7 @@
     enable = true;
     peers.ncfttb = {
       config = ''
-        plugin pppoe.so net-dsl
+        plugin pppoe.so enp3s0.10
         user "''${PPPD_NETCOLOGNE_USERNAME}"
         ifname ppp-ncfttb
         persist
@@ -56,6 +56,46 @@
     ];
   };
 
+  environment.etc."ppp/ipv6-up" = {
+    text = ''
+      #! ${pkgs.runtimeShell} -e
+
+      ${pkgs.systemd}/bin/systemctl restart --no-block "ppp-setup-interface-queues@''${IFNAME}.service"
+      ${pkgs.systemd}/bin/systemctl restart --no-block ds-lite-dhcpcd.service
+    '';
+    mode = "555";
+  };
+
+  systemd.services."ppp-setup-interface-queues@".serviceConfig = let
+    setup-interface-queues = pkgs.clerie-build-support.writePythonScript {
+      name = "setup-interface-queues";
+      text = ''
+        import multiprocessing
+        from pathlib import Path
+        import sys
+
+        interface_name = sys.argv[1]
+
+        print(f"New ppp interface: {interface_name}")
+
+        num_cpus = multiprocessing.cpu_count()
+
+        print(f"Detected {num_cpus} cpus")
+
+        bitmask = "1" * num_cpus
+        hexmask = "{:x}".format(int(bitmask, 2))
+
+        rps_cpus = Path(f"/sys/class/net/{interface_name}/queues/rx-0/rps_cpus")
+        rps_cpus.write_text(hexmask)
+
+        print(f"Wrote hexmask {hexmask} to {rps_cpus}")
+      '';
+   };
+  in {
+    Type = "oneshot";
+    ExecStart = "${lib.getExe setup-interface-queues} %i";
+  };
+
   clerie.firewall.extraForwardMangleCommands = ''
     ip46tables -t mangle -A forward-mangle -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
   '';

hosts/carbon/scan-to-gpg.nix

@@ -1,11 +0,0 @@
-{ pkgs, ... }:
-
-{
-
-  services.scan-to-gpg = {
-    enable = true;
-    gpgkey = "${pkgs.clerie-keys}/gpg/clerie@clerie.de.asc";
-  };
-
-  users.users."clerie".extraGroups = [ "scan-to-gpg" ];
-}

hosts/dn42-il-gw1/configuration.nix

@@ -4,6 +4,8 @@
   imports =
     [
       ./hardware-configuration.nix
+
+      ./documentation.nix
     ];
 
   profiles.clerie.mercury-vm.enable = true;
@@ -41,6 +43,28 @@
 
   networking.wireguard.enable = true;
   networking.wireguard.interfaces = {
+    # dn42-router-general-wireguard-key public key:
+    # r38qvXqu26x4f6yUGxg44Ji4db/g2HK7RZwG7Boh+38=
+
+    # darkpoint
+    wg0150 = {
+      ips = [
+        "fe80::2574/128"
+      ];
+      postSetup = ''
+      ip addr replace dev wg0150 fe80::2574/128 peer fe80::150/128
+      '';
+      listenPort = 50150;
+      allowedIPsAsRoutes = false;
+      peers = [
+        {
+          allowedIPs = [ "fe80::/10" "fd00::/8" ];
+          endpoint = "fra.darkpoint.xyz:22574";
+          publicKey = "nfoxTtmJdBdxNR3TmfVLG13KA5E+ZtU+uIGCegxrxxw=";
+        }
+      ];
+      privateKeyFile = config.sops.secrets.dn42-router-general-wireguard-key.path;
+    };
     # e1mo
     wg0565 = {
       ips = [
@@ -62,6 +86,45 @@
       ];
       privateKeyFile = config.sops.secrets.wg0565.path;
     };
+    # pilz
+    wg0663 = {
+      ips = [
+        "fe80::1111/128"
+      ];
+      postSetup = ''
+      ip addr replace dev wg0663 fe80::1111/128 peer fe80::acab/128
+      '';
+      listenPort = 50663;
+      allowedIPsAsRoutes = false;
+      peers = [
+        {
+          allowedIPs = [ "fe80::/10" "fd00::/8" ];
+          endpoint = "dn42.ams1.as214958.net:163";
+          publicKey = "NxHkdwZPVL+3HdrHTFOslUpUckTf0dzEG9qpZ0FTBnA=";
+        }
+      ];
+      privateKeyFile = config.sops.secrets.dn42-router-general-wireguard-key.path;
+    };
+    # prefixlabs
+    # https://prefixlabs.net/
+    wg1240 = {
+      ips = [
+        "fe80::2574/128"
+      ];
+      postSetup = ''
+      ip addr replace dev wg1240 fe80::2574/128 peer fe80::1240:11/128
+      '';
+      listenPort = 51240;
+      allowedIPsAsRoutes = false;
+      peers = [
+        {
+          allowedIPs = [ "fe80::/10" "fd00::/8" ];
+          endpoint = "de-01.prefixlabs.net:22574";
+          publicKey = "ixeEBfac1BXpjNKbxcgL6Beg9HTgtmq6CjHIfMwNSDw=";
+        }
+      ];
+      privateKeyFile = config.sops.secrets.wg1240.path;
+    };
     # fooker
     wg1271 = {
       ips = [
@@ -120,25 +183,25 @@
       ];
       privateKeyFile = config.sops.secrets.wg1280.path;
     };
-    # lutoma
-    wg4719 = {
+    # c4tg1rl5
+    # https://catgirls.systems/peering/
+    wg1411 = {
       ips = [
-        #"fe80::1/128"
-        # peer fe80::acab/128
+        "fe80::2574/128"
       ];
       postSetup = ''
-      ip addr add dev wg4719 fe80::1/128 peer fe80::acab/128
+      ip addr replace dev wg1411 fe80::2574/128 peer fe80::1411/128
       '';
-      listenPort = 54719;
+      listenPort = 51411;
       allowedIPsAsRoutes = false;
       peers = [
-        {
-          allowedIPs = [ "fe80::/10" "fd00::/8" ];
-          endpoint = "[2603:c020:8001:ed42::42]:42546";
-          publicKey = "MkVyCgIq0BOStFIu2/Wl91ofFuRvnG3ZqTWFfVs/VlQ=";
-        }
+        #{
+        #  allowedIPs = [ "fe80::/10" "fd00::/8" ];
+        #  endpoint = "";
+        #  publicKey = "";
+        #}
       ];
-      privateKeyFile = config.sops.secrets.wg4719.path;
+      privateKeyFile = config.sops.secrets.dn42-router-general-wireguard-key.path;
     };
     # zaphyra
     wg1718 = {
@@ -160,15 +223,101 @@
       ];
       privateKeyFile = config.sops.secrets.wg1718.path;
     };
+    # iedon
+    # https://iedon.net/
+    wg2189 = {
+      ips = [
+        "fe80::2574/128"
+      ];
+      postSetup = ''
+      ip addr replace dev wg2189 fe80::2574/128 peer fe80::2189:e9/128
+      '';
+      listenPort = 52189;
+      allowedIPsAsRoutes = false;
+      peers = [
+        {
+          allowedIPs = [ "fe80::/10" "fd00::/8" ];
+          endpoint = "de-fra.dn42.iedon.net:42463";
+          publicKey = "FHp0OR4UpAS8/Ra0FUNffTk18soUYCa6NcvZdOgxY0k=";
+        }
+      ];
+      privateKeyFile = config.sops.secrets.dn42-router-general-wireguard-key.path;
+    };
+    # jona / cryne
+    wg3402 = {
+      ips = [
+        "fe80::2574/128"
+      ];
+      postSetup = ''
+      ip addr replace dev wg3402 fe80::2574/128 peer fe80::3402/128
+      '';
+      listenPort = 53402;
+      allowedIPsAsRoutes = false;
+      peers = [
+        {
+          allowedIPs = [ "fe80::/10" "fd00::/8" ];
+          endpoint = "dn42.cryne.me:42574";
+          publicKey = "YsKInIp90is8ysnQDHGoKnz2CqlTMWMZDmQ+vwvN2C0=";
+        }
+      ];
+      privateKeyFile = config.sops.secrets.dn42-router-general-wireguard-key.path;
+    };
+    # lutoma
+    wg4719 = {
+      ips = [
+        #"fe80::1/128"
+        # peer fe80::acab/128
+      ];
+      postSetup = ''
+      ip addr add dev wg4719 fe80::1/128 peer fe80::acab/128
+      '';
+      listenPort = 54719;
+      allowedIPsAsRoutes = false;
+      peers = [
+        {
+          allowedIPs = [ "fe80::/10" "fd00::/8" ];
+          endpoint = "[2603:c020:8001:ed42::42]:42546";
+          publicKey = "MkVyCgIq0BOStFIu2/Wl91ofFuRvnG3ZqTWFfVs/VlQ=";
+        }
+      ];
+      privateKeyFile = config.sops.secrets.wg4719.path;
+    };
+    # tbspace
+    wg6190 = {
+      ips = [
+        "fe80::2574/128"
+      ];
+      postSetup = ''
+      ip addr replace dev wg6190 fe80::2574/128 peer fe80::1299:e/128
+      '';
+      listenPort = 56190;
+      allowedIPsAsRoutes = false;
+      peers = [
+        {
+          allowedIPs = [ "fe80::/10" "fd00::/8" ];
+          endpoint = "dn42.tbspace.de:49168";
+          publicKey = "skvyDl81J8Zu3Ziem+7JKeU4UYLhhWt7gWelg8nEbzQ=";
+        }
+      ];
+      privateKeyFile = config.sops.secrets.dn42-router-general-wireguard-key.path;
+    };
   };
 
   networking.firewall.allowedUDPPorts = [
+    50150 # wg0150
     50565 # wg0565
+    50663 # wg0663
+    51240 # wg1240
+    51241 # wg1241
     51271 # wg1271
     51272 # wg1272
     51280 # wg1280
-    54719 # wg4719
+    51411 # wg1411
     51718 # wg1718
+    52189 # wg2189
+    53402 # wg3402
+    54719 # wg4719
+    56190 # wg6190
   ];
 
   profiles.clerie.dn42-router = {
@@ -192,6 +341,13 @@
     ];
 
     wireguardPeers = [
+      {
+        peerName = "peer_0150";
+        remoteAddress = "fe80::150";
+        interfaceName = "wg0150";
+        remoteAsn = "4242420150";
+        localAddress = "fe80::2574";
+      }
       {
         peerName = "peer_0565";
         remoteAddress = "fe80::565";
@@ -199,6 +355,20 @@
         remoteAsn = "4242420565";
         localAddress = "fe80::2574";
       }
+      {
+        peerName = "peer_0663";
+        remoteAddress = "fe80::acab";
+        interfaceName = "wg0663";
+        remoteAsn = "4242420663";
+        localAddress = "fe80::1111";
+      }
+      {
+        peerName = "peer_1240_de_01";
+        remoteAddress = "fe80::1240:11";
+        interfaceName = "wg1240";
+        remoteAsn = "4242421240";
+        localAddress = "fe80::2574";
+      }
       {
         peerName = "peer_1271_north";
         remoteAddress = "fe80::2";
@@ -220,6 +390,34 @@
         remoteAsn = "4242421280";
         localAddress = "fde3:4c0d:2836:ff00::21";
       }
+      {
+        peerName = "peer_1411_de_fsn";
+        remoteAddress = "fe80::1411";
+        interfaceName = "wg1411";
+        remoteAsn = "4242421411";
+        localAddress = "fe80::2574";
+      }
+      {
+        peerName = "peer_1718";
+        remoteAddress = "fe80::6b61";
+        interfaceName = "wg1718";
+        remoteAsn = "4242421718";
+        localAddress = "fe80::2574";
+      }
+      {
+        peerName = "peer_2189_de_fra";
+        remoteAddress = "fe80::2189:e9";
+        interfaceName = "wg2189";
+        remoteAsn = "4242422189";
+        localAddress = "fe80::2574";
+      }
+      {
+        peerName = "peer_3402";
+        remoteAddress = "fe80::3402";
+        interfaceName = "wg3402";
+        remoteAsn = "4242423402";
+        localAddress = "fe80::2574";
+      }
       {
         peerName = "peer_4719";
         remoteAddress = "fe80::acab";
@@ -228,10 +426,10 @@
         localAddress = "fe80::1";
       }
       {
-        peerName = "peer_1718";
-        remoteAddress = "fe80::6b61";
-        interfaceName = "wg1718";
-        remoteAsn = "4242421718";
+        peerName = "peer_6190";
+        remoteAddress = "fe80::1299:e";
+        interfaceName = "wg6190";
+        remoteAsn = "76190";
         localAddress = "fe80::2574";
       }
     ];

hosts/dn42-il-gw1/documentation.nix

@@ -0,0 +1,21 @@
+{ config, lib, pkgs, ... }:
+
+{
+
+  services.nginx.enable = true;
+
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
+
+  services.nginx.virtualHosts = {
+    "${config.networking.fqdn}" = {
+      enableACME = true;
+      forceSSL = true;
+      root = pkgs.writeTextFile {
+        name = "dn42-router-documentation";
+        text = config.profiles.clerie.dn42-router.htmlDocumentation;
+        destination = "/index.html";
+      };
+    };
+  };
+
+}

hosts/dn42-il-gw1/secrets.json

@@ -1,6 +1,8 @@
 {
+	"dn42-router-general-wireguard-key": "ENC[AES256_GCM,data:z1qOABBiObnWgcJDSnCHCfttJdDXQ3LO+Y/uHblJg49wrxTostamnP6GuvE=,iv:0KTyNqMOLQue8UODWXF2I+sY4pVKVe0aNiVETC9zOzk=,tag:KOzS9HaR6plPA0HlMT8jhQ==,type:str]",
 	"wg0197": "ENC[AES256_GCM,data:1QJ5GXLMLIOj6xNC4sMnShjyB1wqfTkhkPTlLJz6AJxMjA0BsBZvZ1Pdln4=,iv:nVRIQB8/Ged616ELhkGnDyAz6A+3HQ55+yG0vf0f7aQ=,tag:GtI8ICMCih1tN4Xoc+8RdQ==,type:str]",
 	"wg0565": "ENC[AES256_GCM,data:kLgKOGDA+kPDB0SZ/yU7Ax7NYn28LiVT2W6zSsc0APfyoZWW6nF0fUQFv4s=,iv:6zjLGAOROifubQUMxRLvoFzN6GRYob841rzNiVyrt84=,tag:Gh15/ROPYiqqobcJcTzmGQ==,type:str]",
+	"wg1240": "ENC[AES256_GCM,data:ta0FRxhDGeta6TpWghWP2ogqymtiVsnWvuwzOhqhGN6zyK/GYd5b+SgSYAI=,iv:9gxEtK+ZOFj0D/SNWV7GyWHkBXjGgofJPmqcu3CMMKo=,tag:MFE/bhGk6oLeOK4TaEoXgQ==,type:str]",
 	"wg1271": "ENC[AES256_GCM,data:NPcFMxVNpwoPkLsb6NvZVxGxw+Og3RzlYx7TAL9nT95x6I8aDRpOnR5tY5w=,iv:gYuem6vX+jRQvirrt3lZQb5gKnN/z32W/MgmGuzQ/Ks=,tag:I9qZJSNKFEM3Vx4Yugxy1w==,type:str]",
 	"wg1272": "ENC[AES256_GCM,data:LU6jtNkNn2Xs+0OH8cD1HJnbHsNNnqlY83lDFa11/dHwVgdFxMtDXMqIMEc=,iv:/A8rWGR6jExa4ms7jTYC0eZVGCvlKw1I58Co41gw3TU=,tag:tIBRkQzFFpEEzflnDrpcOA==,type:str]",
 	"wg1280": "ENC[AES256_GCM,data:F4KLY6jiZNl52ko32nM0iTER0DyHvaCSmxeYAKB0MLUD8l9u1Ugk6kYZnUc=,iv:XcaxnvxM1kE/ahNFX+BH7Jmr9q2Py1vHHqOjFUqs5O8=,tag:a1up4gGFqyHz2lmDRJl3bA==,type:str]",
@@ -15,8 +17,8 @@
 				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3QWdFYjFjTmRVRlV3U3p4\nTSsyc1E0dWtiYjNtVkV2SXJEWkxnTDhLN1Y0Cng4aGlidjhydUVGaFcvK215aGdq\nN0FGajYwa1lPUCsva0tmNkErUGtlOWsKLS0tIG9pLzJEUDA2WWUzd1kzSVZrdVRX\nbUxjQzBCd3p0R1dWTTJaRmZNQjJEUVkKPz6OUQHpYrhRxMdQzpZRR3exVqkG2JvX\nI32PwvbeQK8cgpYwKLGar8U8aiPPm0Y64pID1wedDsNZzLqLOrS3wQ==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
-		"lastmodified": "2025-06-10T20:51:10Z",
-		"mac": "ENC[AES256_GCM,data:9lF4HV0oJyGHXdtYdMxR7+ev7JLAQVr6kE55nLoZcrbC92MHJzQpgM9XAhIynvwdAmC7ARd3orCn6eYkQJDdNX0JjMtebsBE+H4B7mEUCz8wtTN0iHS+oHmQxrqjnoSw2uHh9udgqAJa+sd6VGU3t2XUuuKtVHPwzROqVgvas9M=,iv:KT+BlFeXGZQc5pbBX+XOsmKEydUtir1LuPvseDkFeqw=,tag:hlRskY6b5EAZkUYs7ph/JA==,type:str]",
+		"lastmodified": "2025-12-03T20:44:07Z",
+		"mac": "ENC[AES256_GCM,data:GL2GWM7YcGxfKWh9Vt0wm6YqbXTgqskkVHzsTTWqcQWhzbtqyWfFebli77UsDYoCYSR+yiPhi2opF1oMJl6Jr44PtmpPk+WGPUrcjuVDuf0NueaW8j++nzJzSFEnHeTbIg8qNpb9FwapWM0jlHVkGo6RVwVa9E597U/AKdES9ww=,iv:s3ABxKoCcEUOjtnvDGcrJoEiwXC0imLLO0kEXT+/69s=,tag:Vzk6aKDRwD6T60G0pDF9Jw==,type:str]",
 		"pgp": [
 			{
 				"created_at": "2024-04-28T09:25:37Z",
@@ -25,6 +27,6 @@
 			}
 		],
 		"unencrypted_suffix": "_unencrypted",
-		"version": "3.10.2"
+		"version": "3.11.0"
 	}
 }

hosts/krypton/configuration.nix

@@ -13,6 +13,10 @@
     ];
 
   profiles.clerie.desktop.enable = true;
+  profiles.clerie.desktop.users = [
+    "clerie"
+  ];
+
 
   # Use the systemd-boot EFI boot loader.
   boot.loader.systemd-boot.enable = true;

profiles/common-ssh/default.nix

@@ -2,13 +2,33 @@
 
 with lib;
 
-{
+let
+
+  cfg = config.profiles.clerie.common-ssh;
+
+  knownHostsFiles = [
+    "/etc/ssh/ssh_known_hosts"
+  ] ++ cfg.knownHostsFiles;
+
+in {
 
   options.profiles.clerie.common-ssh = {
     enable = mkEnableOption "Common ssh config";
+    knownHostsFiles = mkOption {
+      type = with types; listOf str;
+      default = [];
+      description = "List of paths to ssh known hosts files";
+    };
   };
 
-  config = mkIf config.profiles.clerie.common-ssh.enable {
+  config = mkIf cfg.enable {
+
+    assertions = [
+      {
+        assertion = config.programs.ssh.knownHostsFiles == [];
+        message = "profiles.clerie.common-ssh sets a custom set of global known hosts file that is incompatible with the settings from the official NixOS module, use profiles.clerie.common-ssh.knownHostsFiles instead";
+      }
+    ];
 
     services.openssh.enable = true;
     services.openssh.settings = {
@@ -21,11 +41,16 @@ with lib;
       { type = "ed25519"; path = "/etc/ssh/ssh_host_ed25519_key"; }
     ];
 
-    programs.ssh.knownHostsFiles = [
+    profiles.clerie.common-ssh.knownHostsFiles = [
       (pkgs.clerie-ssh-known-hosts + "/known_hosts")
       (pkgs.fem-ssh-known-hosts + "/known_hosts")
       (pkgs.well-known-ssh-known-hosts + "/known_hosts")
     ];
 
+    programs.ssh.extraConfig = ''
+      Host *
+      GlobalKnownHostsFile ${builtins.concatStringsSep " " knownHostsFiles}
+    '';
+
   };
 }

profiles/common-webserver/default.nix

@@ -53,10 +53,8 @@ in {
           default = true;
           rejectSSL = true;
           locations."/" = {
-            return = ''200 "Some piece of infrastructure\n"'';
-            extraConfig = ''
-              types { } default_type "text/plain; charset=utf-8";
-            '';
+            # Terminate connection without response
+            return = ''444'';
           };
         };
       };

profiles/desktop/default.nix

@@ -6,6 +6,11 @@ with lib;
 
   options.profiles.clerie.desktop = {
     enable = mkEnableOption "clerie Desktop Config";
+    users = mkOption {
+      type = with types; listOf str;
+      default = [];
+      description = "Names of users that are considered desktop users and therefore get special permissions";
+    };
   };
 
   imports = [

profiles/desktop/gnome.nix

@@ -34,6 +34,7 @@ with lib;
       evolution
       gnome-terminal
       gnome-tweaks
+      gnome-decoder # scan qr codes
     ];
 
     services.gnome.evolution-data-server.enable = true;

profiles/desktop/networking.nix

@@ -2,9 +2,13 @@
 
 with lib;
 
-{
+let
 
-  config = mkIf config.profiles.clerie.desktop.enable {
+  cfg = config.profiles.clerie.desktop;
+
+in {
+
+  config = mkIf cfg.enable {
 
     networking.networkmanager.settings = {
       connectivity = {
@@ -15,6 +19,8 @@ with lib;
       };
     };
 
+    users.groups.networkmanager.members = cfg.users;
+
   };
 
 }

profiles/dn42-router/default.nix

@@ -11,6 +11,9 @@ let
   bgp6Table = 2342;
 
 in {
+  imports = [
+    ./documentation.nix
+  ];
 
   options.profiles.clerie.dn42-router = {
     enable = mkEnableOption "DN42 router base config";
@@ -93,6 +96,10 @@ in {
       type = types.str;
       default = "";
     };
+    htmlDocumentation = mkOption {
+      type = types.str;
+      description = "This option is set by the module itself and contains the documentation for this router setup";
+    };
   };
 
   config = mkIf config.profiles.clerie.dn42-router.enable {

profiles/dn42-router/documentation.nix

@@ -0,0 +1,88 @@
+{ config, lib, ... }:
+
+with lib;
+
+let
+
+  cfg = config.profiles.clerie.dn42-router;
+
+in {
+
+  profiles.clerie.dn42-router.htmlDocumentation = ''
+    <!DOCTYPE html>
+    <html lang="en">
+      <head>
+      </head>
+      <body>
+        <h1>${config.networking.fqdn}</h1>
+
+        <p>This is a router in the <a href="https://wiki.dn42.us/">experimental decentralized network dn42</a>.</p>
+
+        <p>If you like to peer, please drop me an email to <a href="mailto:dn42@clerie.de">dn42@clerie.de</a>.</p>
+
+        <p>Happy peering!</p>
+
+        <h2>Router Information</h2>
+
+        <ul>
+          <li>ASN: <code>AS4242422574</code></li>
+          <li>Loopback IP: <code>${cfg.loopbackIp}</code></li>
+          <li>Router ID: <code>${cfg.routerId}</code></li>
+        </ul>
+
+        <h2>Wireguard Peers</h2>
+
+        <table>
+        ${concatMapStringsSep "\n" (peer: ''
+          <tr>
+            <td>${peer.peerName}</td>
+            <td><a href="https://explorer.burble.com/#/aut-num/AS${peer.remoteAsn}">AS${peer.remoteAsn}</a></td>
+            <td>
+              <details>
+                <summary>Peering config</summary>
+                <ul>
+                  <li>Local Endpoint: <code>${config.networking.fqdn}:???</code></li>
+                  <li>Local Address: <code>${peer.localAddress}</code></li>
+                  <li>Local ASN: <code>AS4242422574</code></li>
+                </ul>
+                <ul>
+                  <li>Remote Endpoint: <code>???</code></li>
+                  <li>Remote Address: <code>${peer.remoteAddress}</code></li>
+                  <li>Remote ASN: <code>AS${peer.remoteAsn}</code></li>
+                </ul>
+              </details>
+            </td>
+            <td><a href="https://map.iedon.net/#${peer.remoteAsn}">[Map]</a></td>
+          </tr>
+        '') cfg.wireguardPeers}
+        </table>
+
+        <h2>BGP Peers</h2>
+
+        <table>
+        ${concatMapStringsSep "\n" (peer: ''
+          <tr>
+            <td>${peer.peerName}</td>
+            <td>AS${peer.remoteAsn}</td>
+            <td>
+              <details>
+                <summary>Peering config</summary>
+                <ul>
+                  <li>Local Address: <code>${peer.localAddress}</code></li>
+                  <li>Local ASN: <code>AS4242422574</code></li>
+                </ul>
+                <ul>
+                  <li>Remote Address: <code>${peer.remoteAddress}</code></li>
+                  <li>Remote ASN: <code>AS${peer.remoteAsn}</code></li>
+                </ul>
+              </details>
+            </td>
+            <td><a href="https://map.iedon.net/#${peer.remoteAsn}">[Map]</a></td>
+          </tr>
+        '') cfg.bgpPeers}
+        </table>
+      </body>
+    </html>
+  '';
+
+}

profiles/hetzner-storage-box-client/default.nix

@@ -1,4 +1,4 @@
-{ config, lib, ... }:
+{ config, lib, pkgs, ... }:
 
 with lib;
 
@@ -10,8 +10,8 @@ with lib;
 
   config = mkIf config.profiles.clerie.hetzner-storage-box-client.enable {
 
-   programs.ssh.knownHostsFiles = [
-     ./hetzner-storage-box-ssh_known_hosts
+    profiles.clerie.common-ssh.knownHostsFiles = [
+      (pkgs.copyPathToStore ./hetzner-storage-box-ssh_known_hosts)
     ];
 
  };