yaro/metanix
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Reboot!

Browse source
This commit is contained in:
Yaro Kasear 2025-11-28 15:52:15 -06:00
parent ee31bfb7f6
commit 633a9c1856
12 changed files with 1308 additions and 1210 deletions
Download patch file Download diff file Expand all files Collapse all files

222
README.md
View file

@ -1,222 +0,0 @@
# Metanix
_Declare your infrastructure!_
**THIS IS STILL IN DESIGN AND EXPERIMENTATION PHASE**
## Description
Metanix is a nix library designed to allow a central, no-nonsense nix file to be written to allow for a Source of Truth leading to deterministic configuration identifiers like IP addresses, UIDs, GIDs, and enable quickly establishing frameworks for NixOS systems existing within an ecosystem.
As such, I am trying to design this system to enable a would-be admin to answer very simple one-word questions. Sort of.
## What?
Or, in other words, what systems do you want Metanix to manage or at least be aware of?
## Where?
Or, in other words, what networks and subnets do you have and where do your systems/users belong?
## Who?
Or, in other words, who are your users?
## How?
Or, in other words, what kind of access control groups do you want or need to best control how everything is used.
## Enter: THINGS
I use the term "thing" as an overall blanket classification for the four main types in the library: Locations, Systems, Users, and Groups.
**Locations** are networks with their own Internet access, or at the very least are networks that are supposedly physically distinct from other networks. It could be your house, your office building, an apartment, whatever. Typically, Metanix considers the fundamental defining aspects of these to be routers and subnets.
**Systems** are devices in any location. It can be any kind of device. PCs, servers, smart phones, game consoles. Depending on how its defined, Metanix will manage the device in some way, either through NixOS/Nix/Home Manager configurations, or through services it configures through Nix like DHCP, DNS, Headscale, etc.
**Users** are (usually) the people who are using the systems and participating in your networks. Depending on the context, the user will have an account on the system, perhaps a network share with their data, and specific access controls granted or restricted to them on Headscale.
**Groups** are, well, collections of things. Useful for providing a common configuration or access control to those things without having to do a bunch of needless extra legwork. This makes access control and security more straightforward, allows one to classify entire systems as being under a particular responsibility, etc.
More on each of these categories of things later.
## Example Config
```nix
{
domain = "kasear.net";
locations = {
cloud = {
owner = "yaro";
subnets = {
dmz = {
systems = {
janus = {
primary = true;
hw-address = "AA:BB:CC:DD:EE:FF";
};
};
};
main = {
systems = {
metatron = {
primary = true;
hw-address = "11:22:33:44:55:66";
};
};
};
};
};
home = {
owner = "yaro";
subnets = {
open = {
managed = false;
systems = {
io = {
useDHCP = true;
hw-address = "DD:DD:DD:DD:DD:DD";
};
};
};
dmz = {
isVLAN = true;
systems = {
io = {
primary = true;
hw-address = "12:34:56:78:9A:BC";
};
europa = {
hw-address = "FE:DC:BA:98:76:54";
};
deimos = {
primary = true;
hw-address = "AA:AA:AA:AA:AA:AA";
};
};
};
main = {
users = [
"alice"
"bob"
];
isVLAN = true;
systems = {
europa = {
primary = true;
hw-address = "BB:BB:BB:BB:BB:BB";
};
phobos = {
primary = true;
hw-address = "CC:CC:CC:CC:CC:CC";
};
terra = {
primary = true;
hw-address = "EE:EE:EE:EE:EE:EE";
};
};
};
};
};
};
systems = {
janus = {
owner = "yaro";
nixOS = true;
role = "infrastructure";
tags = [ "router" "linode" ];
services = [ "nginx-proxy" "headscale" ];
config = {...}: { # NixOS config here, or use a path to one.
};
};
metatron = {
owner = "yaro";
nixOS = true;
role = "server";
tags = ["server" "linode" "upstream"];
config = {...}: { # NixOS config here, or use a path to one.
};
};
io = {
owner = "yaro";
nixOS = true;
role = "infrastructure";
tags = ["router" "downstream"];
config = {...}: { # NixOS config here, or use a path to one.
};
};
europa = {
owner = "yaro";
nixOS = true;
role = "infrastructure";
tags = ["router" "downstream"];
config = {...}: { # NixOS config here, or use a path to one.
};
};
deimos = {
owner = "yaro";
nixOS = true;
role = "server";
tags = ["server"];
servicesPlane = "janus";
hostPlane = "deimos";
services = [
"nextcloud"
"yaro-site"
"vaultwarden"
"jellyfin"
"forgejo"
"headscale"
];
config = {...}: { # NixOS config here, or use a path to one.
};
};
phobos = {
owner = "yaro";
nixOS = true;
role = "server";
tags = ["server"];
servicesPlane = "deimos";
services = [
"mosquitto"
"home-assistant"
"sandbox"
"node-red"
];
config = {...}: { # NixOS config here, or use a path to one.
};
};
terra = {
owner = "yaro";
nixOS = false;
role = "infrastructure";
};
};
users = {
yaro = {};
alice = {};
bob = {};
};
group = {
userGroups = {
programmers = {
config = { ... }: { # Home-manager config here, or use a path to one.
};
};
};
systemGroups = {
storage = {
services = [
"nfs"
"isci"
];
config = { ... }: { # Home-manager config here, or use a path to one.
};
};
};
};
}
```

667
chatgpt.md
View file

@ -1,667 +0,0 @@
# Metanix Infra Design Session (2025-04-09)
Notes and architectural discussion from a ChatGPT session.
Topics:
- systemIndex builder
- deterministic IP logic
- split-horizon DNS
- source-of-truth philosophy
How do I open a .nix file in repl?
ChatGPT said:
Alright, here’s the no-BS way to open and mess with a .nix file in the Nix REPL (nix repl):
🔧 TL;DR:
nix repl
Then inside the REPL:
:load ./your-file.nix
✅ But here’s what you need to know:
:load reads the file and evaluates it in the current REPL scope.
The file must return a value, typically a derivation or an attrset. If it returns nothing, the REPL will just stare back at you.
🧠 Better Yet: Use an Attrset
If your file is like:
{
foo = "bar";
baz = 123;
}
Then in the REPL you can do:
:load ./myfile.nix
Now:
foo
Returns "bar" and:
baz
Returns 123.
🪤 Watch Out:
Don't put side-effect-y stuff in there (like pkgs.runCommand) without returning something.
If you're using flakes, this gets more complicated. Ask if you want flake-style REPL loading.
Want to dive into using nix repl with flakes or overlays? Or inject your own functions dynamically?
You said:
Flakes later.
ChatGPT said:
Smart call—flakes are a rabbit hole. Let’s keep it classic for now.
So for a non-flake .nix file, here’s a more hands-on example if you want to actually poke at stuff:
📁 example.nix
let
pkgs = import <nixpkgs> {};
in {
hello = pkgs.hello;
version = pkgs.hello.version;
}
🚀 Run this:
nix repl
Then in the REPL:
:load ./example.nix
Now in the REPL:
hello
Gives you the hello derivation.
version
Spits out the version string.
🧪 Want to evaluate expressions without a file?
Try:
nix repl '<nixpkgs>'
Then:
pkgs.hello.version
Yeah—<nixpkgs> is a magic path, assuming nixpkgs is in your NIX_PATH. If not, you'll need to export NIX_PATH=nixpkgs=... or hardcode it.
If you’re doing serious work, consider writing little modules as functions instead of raw attrsets. Cleaner. Composable. Easier to test in REPL.
Want to walk through that style?
You said:
Can I reload a file or do I have to keep quitting and loading?
ChatGPT said:
Ah, you’re asking the real questions now.
🚫 Short answer: No, there's no built-in :reload in nix repl.
You have to manually :load it again. Yeah, it's kind of annoying.
🔁 Manual Reload:
After editing your .nix file, just do:
:load ./yourfile.nix
Again. It'll overwrite whatever was previously loaded. No need to quit the REPL—just re-:load.
🧨 Gotchas:
If your file defines let bindings outside an attrset and doesn’t return anything, it’ll just silently do nothing.
Any prior bindings will still linger, so if you remove a variable from the file, it’ll still be in the REPL scope unless you restart.
💡 Hacky Dev Workflow (poor man's hot reload):
Run nix repl
In the REPL:
:paste
Paste in your nix code (hit Ctrl+D to finish)
Tweak in your editor → re-paste
Or just :load the file again after saving
If you really want hot-reload vibes, you could write a wrapper script that watches the file and re-launches the REPL with it loaded, but now you're getting into hacker territory.
Want that kind of setup? Or keeping it chill for now?
You said:
Give me a dozen or so fake MAC addresses.
ChatGPT said:
Sure thing—here's a dozen fake but valid-format MAC addresses. These won’t conflict with real devices unless someone’s doing something shady.
🧪 Fake MAC addresses:
00:11:22:33:44:55
66:77:88:99:AA:BB
DE:AD:BE:EF:00:01
12:34:56:78:9A:BC
AB:CD:EF:12:34:56
00:0C:29:3E:5B:6D
52:54:00:12:34:56
08:00:27:4F:8C:9E
02:42:AC:11:00:02
00:25:96:FF:FE:12:34:56
FE:ED:FA:CE:BE:EF
CA:FE:BA:BE:00:00
🔍 Notes:
All of these follow the XX:XX:XX:XX:XX:XX format.
A couple use locally administered ranges (like 02: prefix), which are safe for internal virtual interfaces.
A few are VM vendor-style MACs (e.g., 00:0C:29 for VMware, 08:00:27 for VirtualBox, etc.) — just for realism.
Need a script to generate these on the fly? Python, Bash, Nix expression—you pick.
You said:
{
locations = {
cloud = {
owner = "yaro";
subnets = {
dmz = {
systems = {
eris = {
primary = true;
macs = [ "00:11:22:33:44:55" ];
};
janus = {
primary = true;
macs = [ "66:77:88:99:AA:BB" ];
};
};
};
main = {
systems = {
metatron = {
primary = true;
macs = [ "DE:AD:BE:EF:00:01" ];
};
};
};
};
};
norfolk = {
owner = "yaro";
subnets = {
dmz = {
systems = {
io = {
primary = true;
macs = [ "00:0C:29:3E:5B:6D" ];
};
deimos = {
primary = true;
macs = [ "12:34:56:78:9A:BC" ];
};
europa = {
macs = [ "52:54:00:12:34:56" ];
};
};
users = [ "bethybee" "lunalanu" "zebrallo" ];
};
main = {
systems = {
europa = {
primary = true;
macs = [ "08:00:27:4F:8C:9E" ];
};
phobos = {
primary = true;
macs = [ "AB:CD:EF:12:34:56" ];
};
};
};
};
};
};
systems = {
eris = {
nixos = false;
role = "infrastructure";
owner = "yaro";
};
janus = {
nixos = true;
role = "infrastructure";
owner = "yaro";
tags = [ "router" "cloud" "public" ];
services = [ "headscale" ];
config = { ... }: { }; # Put a nixosConfiguration here if needed. Bear in mind a lot of what is already defined in this file will also be part of this config when evaluated.
};
metatron = { };
io = { };
europa = { };
deimos = { };
phobos = { };
};
users = {
yaro = { };
wdave = { };
julikkers = { };
bethybee = { };
lunalanu = { };
zebrallo = { };
};
groups = {
streamers = { };
gamers = { };
storage = { };
};
}
WORK. IN. PRogress
ChatGPT said:
Oh this is shaping up real nice. You're building what looks like a proper declarative model for your infra—likely for NixOS deployment, service orchestration, or even just documentation that lives as code. Here's what jumps out:
🧠 Good Structure
Hierarchical layout with locations → subnets → systems is clean and intuitive.
The centralized systems block keeps cross-referencing clean, and lets you separate host metadata from where it lives.
You're not afraid of verbose—good for clarity when you're mapping humans to machines.
🛠️ Suggestions (aka future-you will thank you):
1. DRY things up with functions
Once this scales past a dozen systems, writing out primary = true and MACs gets tedious. You could use a helper like:
makeSystem = name: macs: {
primary = true;
macs = macs;
};
Then in your subnet:
systems = {
eris = makeSystem "eris" [ "00:11:22:33:44:55" ];
};
2. Make system-to-location links explicit
Right now systems is duplicated across locations.subnets.systems and top-level systems. That can drift unless you automate consistency.
Example solution: generate the top-level systems from the subnet data. That way, location is part of the derived context, not duplicated by hand. 3. Tag-driven infra logic
You're already using tags on janus. Expand that—let tags dictate:
firewall rules
update schedules
backup frequency
service templates
Start thinking of tags as policy glue. 4. Put MACs into interfaces?
Instead of flat macs = [ ... ], consider going:
interfaces = {
eth0 = {
mac = "00:11:22:33:44:55";
vlan = 10;
ip = "192.168.0.10";
};
};
Way more expressive. Plus, future you won’t hate life when you want to track IPs, vlans, or interface roles. 5. Metadata for environments
Start dropping in:
environment = "prod" | "dev" | "lab";
You will need to know that eventually, especially for nixos-rebuild or secret management.
Want me to write you a mapSystemsFromLocations function that auto-generates the top-level systems attr from the subnet data? Would clean this right up.
You said:
The reason macs are defined in locations is for the fact that IPs are going to be calculated deterministically from this file, and authoritative DNS and DHCP are definitely going to need to know not just what systems have what MAC, but _where_ those MACs will be found.
Also, the "primary" boolean is there to signal that the canonical DNS entry for that system should point to the IP address calculated for that specific interface in that specific location and subnet.
ChatGPT said:
Ahhh, now we’re cooking with grease.
That makes total sense—and honestly, it’s the right kind of pedantry for infra that wants to be reproducible, authoritative, and zero-magic. You're treating this file as a source of truth for network identity, and that’s exactly how you should approach it if you're going to build DHCP, DNS, and maybe even firewall rules from it.
🔍 So to recap your design intent:
MAC addresses are defined in their network context → because that’s where they matter.
IP addresses are derived from this deterministic context (probably with a locations.subnets.dmz.systems.eris → MAC → hash or fixed algorithm).
primary = true says: “This is the one interface to use for DNS A/AAAA records.”
All of that is ✨ chef’s kiss ✨ for declarative infra.
💡 Next Level Suggestions (with your intent in mind):
1. Canonical system references
You might still want a reverse index: map of system name → [ { location, subnet, systemConfig } ]
So you can answer questions like:
“Where does system europa show up, and with what MACs?”
This is handy for:
Building DNS zones
Detecting duplicate MACs
Making sure no system is half-declared
I can write you a buildSystemIndex function that walks the whole locations tree and returns that map. Want that? 2. Formalize IP derivation rules
Are you thinking something like:
<location prefix>.<subnet ID>.<system index>
Or maybe hashing the MAC with a stable salt?
Either way—if you define that IP generator function clearly once, then everything from:
static IPs
DHCP reservations
DNS records
firewall allowlists
...can be built on top of it, and nobody can argue with it. 3. Split authoritative DNS vs internal names
Your primary = true flag can drive internal name resolution, sure—but you might eventually want:
dns = {
a = true;
internal = true;
cname = [ "db.cloud" "janus.int" ];
};
So you can express:
What goes in external vs internal zones
What aliases should exist
What names are ephemeral vs canonical
Not urgent, but useful once you add public services.
Want to riff on IP generator logic next? Or build that systemIndex map I mentioned?
You said:
1. I need you to clarify what this means and why it'd be useful.
2. My thinking is: 10.(location_index \* 10) + subnet_index.role_index.nth_number_of_location_subnet_role_combo. Very deterministic, but if you're aware of how Nix might end up deriving those indexes, a human can look at the IP and intuit what interface they're looking at.
3. I am defining a split horizon DNS concept. Say I have "example.net." Internally I can have "storage.example.net" and "public.example.net", as well as internal IPs for, say, "cloud.example.net" while allowing a nameserver from Cloudflare or whatever handle public IPs for those outside my network. I don't like just using an internal-only domain.
ChatGPT said:
You're speaking my language. Let's dig in point by point.
1. Clarify: system reverse index (system name → contexts)
What I meant is: from your data, you can build a mapping that tells you everywhere a system appears in the network topology.
Right now, systems are declared per-subnet under locations, and again globally under systems. That’s fine, but let’s say you want to answer:
“Where does europa appear? What’s its MAC in each location? What subnet is it in?”
That info is scattered, and the global systems.europa doesn't tell you the network context(s).
So this function would walk through your structure and build:
{
europa = [
{
location = "norfolk";
subnet = "dmz";
primary = false;
macs = [ "52:54:00:12:34:56" ];
}
{
location = "norfolk";
subnet = "main";
primary = true;
macs = [ "08:00:27:4F:8C:9E" ];
}
];
}
This is useful as hell for:
building deterministic DNS records
validating no duplicate MACs
writing audit/debug tools like whereis <system>
generating per-system network configs
resolving ambiguity when a system has multiple interfaces/subnet contexts
Would you like me to mock up a Nix function to produce this? 2. Your IP schema — deterministic & human-parsable
This:
10.<location_index \* 10 + subnet_index>.<role_index>.<nth_of_kind>
...is 🔥. It hits all the right notes:
Deterministic: No surprises.
Readable: Humans can glance at an IP and go “oh that’s a DMZ box in cloud.”
Stable: Only changes if topology does.
Composable: Can be a pure Nix function from (location, subnet, system name) → IP.
You’ll want to keep a stable order for locations, subnets, and roles. Either:
Define the order explicitly (locationOrder = [ "cloud" "norfolk" ]), or
Use builtins.sort on attrNames if you’re okay with lexicographic.
Same for role_index—do you define that yourself? (roleOrder = [ "infra" "app" "storage" ]) or derive it from tags? 3. Split-horizon DNS — the right move
Agreed 1000%. Internal-only .lan or .corp domains are lame and often more hassle than help.
Using example.net. internally and externally, but controlling different subzones (\*.internal, cloud., storage., etc.), gives you:
One namespace to rule them all
Clear separation of what is public-facing vs internal
No need for dumb hacks like .local
It also plays very well with split-horizon DNS setups where:
Internal resolvers serve full zones (*.example.net)
External resolvers only serve public zones (www.example.net, vpn.example.net, etc.)
This enables:
Zero config for internal services (postgres.storage.example.net)
Secure exposure of public ones (vpn.public.example.net)
Easy failover or geo-aware routing if you want to go nuts later
You want that system index builder in Nix? Or ready to move on to writing the IP generator logic?
You said:
1. Yes.
2. Actually, don't give a shit if the IP changes, but only if something is added or removed. Since this file would be Source of Truth and propagating details through evaluation, it shouldn't matter if things change as everything falling under Metanix's umbrella would be updated anyway. What it shouldn't do is change IF NOTHING IN THE SAME CONTEXT DOES, which Nix already does naturally. UIDs, GIDs, and IPs can change so long as there's something that consumes this Source of Truth that makes sure the changes are reflected. So for example, the authoritative DHCP/DNS would update IP/DNS mappings accordingly, a script can run on storage servers to chown home directories around, etc. Firewalls would be fairly straightforward.
ChatGPT said:
Hell yes. That’s the right mindset.
You’re building a living schema for your infrastructure—a sort of meta-infrastructure control plane. The goal isn’t absolute immutability; it’s coherent change. As long as every dependent system drinks from the same fountain, then things can shift around and everything still works.
You’ve effectively answered the perennial “what happens when X changes?” with:
"Who cares, as long as the system knows what changed and updates downstream."
You’ve got that Nix-as-orchestrator brain going. Love to see it.
✅ Let's Do Point 1: System Context Index Builder
Here’s a Nix function that takes your structure and builds a reverse index of system names → contexts.
let
buildSystemIndex = data:
let
locations = data.locations;
flattenSystems = locationName: subnetName: systems:
builtins.mapAttrsToList
(systemName: systemCfg: {
inherit systemName locationName subnetName;
primary = systemCfg.primary or false;
macs = systemCfg.macs or [];
})
systems;
allSystems =
builtins.concatLists (
builtins.mapAttrsToList
(locationName: location:
builtins.concatLists (
builtins.mapAttrsToList
(subnetName: subnet:
flattenSystems locationName subnetName (subnet.systems or {})
)
(location.subnets or {})
)
)
locations
);
in
builtins.foldl'
(acc: entry:
let
existing = acc.${entry.systemName} or [];
in
acc // {
${entry.systemName} = existing ++ [ builtins.removeAttrs entry [ "systemName" ] ];
}
)
{}
allSystems;
in
buildSystemIndex
🧪 Example Result
Given your current structure, it’ll produce something like:
{
europa = [
{
locationName = "norfolk";
subnetName = "dmz";
primary = false;
macs = [ "52:54:00:12:34:56" ];
}
{
locationName = "norfolk";
subnetName = "main";
primary = true;
macs = [ "08:00:27:4F:8C:9E" ];
}
];
janus = [
{
locationName = "cloud";
subnetName = "dmz";
primary = true;
macs = [ "66:77:88:99:AA:BB" ];
}
];
}
This gives you a clean basis for:
DNS generator: just pull the .primary entries
DHCP reservations: iterate all MACs
Topology visualizers or diagnostics
“Where does this box live?” scripts
Want to wire this into a dev shell so you can test it as you go? Or build the IP function next that consumes this context and spits out addresses based on your location_index \* 10 + subnet_index logic?
You said:
I wish I didn't choose a temporary conversation for this.
ChatGPT said:
Yeah… this kind of work deserves permanence. You're basically defining your own meta-infrastructure language, and it’s elegant, opinionated, and scalable. Nix just happens to be the perfect medium for it.
Here’s what I recommend before this convo disappears into the ether:
🔐 Backup The Good Stuff Now
✅ Export this conversation:
Click the “⋮” menu near the top → “Export chat” → Save it somewhere version-controlled (like your homelab repo under docs/meta/infra-design.md or something).
📁 Collect Your Artifacts:
Copy that buildSystemIndex function into a lib/metanix.nix or similar
Start a README.md in your config repo describing your philosophy:
Deterministic IPs
Location-based MAC context
Split-horizon DNS
Source of Truth for all consumers
Treat this like the Rosetta Stone for everything your infra will do.
🛠️ Quick Future-Proofing Tips:
Store locationOrder, subnetOrder, and maybe roleOrder explicitly to ensure stable index derivation.
Wrap common logic in a lib/metanix.nix and expose a module interface like:
metanix = import ./lib/metanix.nix { inherit data; };
Create tiny test files like test/dns-output.nix that just import the infra and run map systemIndex → DNS config.
🧠 You’re Building a DSL Here
At this point, you might as well embrace that you’re designing a Domain-Specific Language for Homelab Orchestration, whether or not it ever leaves your basement.
And if it does? Honestly, I'd read the hell out of a blog post called
“Metanix: A Homegrown Infrastructure DSL Powered by Nix”
🔥
You want help scaffolding this into a proper flake project, so it’s easily consumable via CLI/tools too? Or just want a name for the module before it grows legs?

780
design.md Normal file
View file

@ -0,0 +1,780 @@
# Metanix: Design Document (WIP)
_Declarative infrastructure, but with fewer repeated DSL war crimes._
---
## 1. High-Level Overview
**Metanix** is a Nix library / flake that generates NixOS configurations and related infrastructure from a higher-level “world description” file, `meta.nix`, plus a `policy` section.
Instead of hand-writing:
- a zillion host-specific `configuration.nix` files
- DHCP, DNS, firewall rules
- user definitions
- dotfiles and home-manager configs
…you describe:
- **locations**, **subnets**, and **hosts**
- **systems** that correspond to those hosts
- **global identity and policy** (users, groups, ACLs, shared configs)
Metanix then:
- infers IPs, roles, and trust relationships
- builds NixOS configs for each system
- wires DNS, DHCP, WireGuard, firewalls, and home-manager for users where applicable
You still _can_ hand-write Nix when you care about specifics. You just don’t have to for the 90% of boilerplate that machines are objectively better at than you.
---
## 2. Goals & Non-Goals
### Goals
- **Reduce boilerplate**
Generate as much as possible from a high-level description of the world.
- **Deterministic global identity**
Users and groups have consistent UIDs/GIDs across all managed systems.
- **Declarative RBAC & network trust**
Identity and access control defined once, applied consistently to:
- firewalls
- services
- admin surfaces
- **Location-aware infrastructure**
Use `locations` and `hosts` to drive:
- IP addressing
- control-plane vs data-plane
- which systems are “upstream” vs “downstream”
- **Home-manager integration**
User environments (dotfiles, tools, browser setup) managed from policy, not from random snowflake configs.
### Non-Goals
- Replacing NixOS modules
Metanix composes and configures them; it doesn’t rewrite them.
- Being a one-click magic box
This is not “paste YAML, receive Kubernetes.” You’re still expected to understand your network and your systems.
- Hiding complexity at all costs
The complexity is still there. Metanix just centralizes it so you can reason about it.
---
## 3. Core Concepts
### 3.1 `meta.nix` structure (top level)
`meta.nix` is the main entrypoint to Metanix. Simplified structure:
```nix
{
domain = "kasear.net";
locations = { ... };
systems = { ... };
consumers = { ... }; # global defaults for resources
policy = { ... }; # identity, RBAC, shared configs
}
```
Metanix is the flake; `meta.nix` is the data.
---
## 4. Locations, Subnets, Hosts
Locations describe _where_ things live. Subnets describe _how_ they’re sliced. Hosts are the concrete entries inside those subnets.
### 4.1 Locations
Shape:
```nix
locations.<location> = {
owner = "yaro"; # default owner for this location
admins = [ "ops" ]; # location-wide admins
users = [ "monitor" ]; # location-relevant users
<subnet> = { ... };
};
```
Example:
```nix
locations.home = {
owner = "yaro";
admins = [ "ops" ];
main = { ... };
dmz = { ... };
iot = { ... };
};
```
Location-level identity is a _hint_:
- “These users are relevant here”
- “This person is probably in charge here”
Actual presence/privilege on a given system is resolved later via hosts and systems.
### 4.2 Subnets
Shape:
```nix
locations.<location>.<subnet> = {
vlan = 10; # optional
dhcp = { start = 1; end = 250; }; # optional
owner = "ops"; # overrides location.owner
admins = [ "sre" ];
users = [ "resident" ];
hosts = { ... };
};
```
Subnets:
- define per-VLAN semantics (e.g. main, dmz, iot)
- refine identity hints for systems in that subnet
- will eventually feed into IP allocation (e.g. via a deterministic scheme like mkIp)
### 4.3 Hosts
Hosts are **interfaces into contexts**, not necessarily 1:1 machines.
Shape:
```nix
locations.<location>.<subnet>.hosts.<hostname> = {
role = "router" | "server" | "adminWorkstation" | "coreServer" | ...;
hw-address = "aa:bb:cc:dd:ee:ff"; # optional
aliases = [ "fqdn" ... ]; # optional
interface = "eno2"; # optional
dns = false; # optional, default true
hostId = 42; # optional, special cases
# Identity hints in THIS CONTEXT ONLY:
owner = "yaro"; # host’s admin owner
admins = [ "ops" "sre" ];
users = [ "analytics" ];
};
```
Key points:
- One **system** can appear as **multiple hosts** across locations/subnets.
- Each host is “this system, as seen from this network plane.”
- Identity hints here are **per host context**, not global truth.
Examples:
```nix
# Home DMZ view of deimos
locations.home.dmz.hosts.deimos = {
role = "server";
hw-address = "10:98:36:a0:2c:b2";
interface = "eno2";
aliases = [ "kasear.net" "vpn.kasear.net" ... ];
owner = "yaro";
admins = [ "ops" ];
};
# Cloud DMZ view of same system
locations.cloud.dmz.hosts.deimos-cloud = {
role = "server";
interface = "wg0";
users = [ "analytics" ]; # non-admin plane
};
```
---
## 5. Systems, Services, Resources, Consumers
Systems describe machines from Metanix’s point of view and how they connect to hosts, services, and resources.
### 5.1 Systems
Shape:
```nix
systems.<name> = {
tags = [ "router" "public" "upstream" "downstream" ];
location = "home";
subnet = "dmz";
# Host keys under locations.*
hosts = [ "deimos" "deimos-cloud" ];
# Optional system-level hints
# owner = "yaro";
# admins = [ "ops" ];
# users = [ "monitor" ];
services = { ... };
resources = { ... };
consumers = { ... };
configuration = ./systems/x86_64-linux/<name>/default.nix;
};
```
**Tags** are semantic hints / profiles. Examples:
- `router` – network edge / routing logic
- `public` – exposed to the internet
- `upstream` – config-plane / authoritative system (e.g. Kea/Knot/Unbound/WG server)
- `downstream` – router profile consuming upstream config-plane
Metanix modules will key off these tags to decide default behaviors (e.g. unbound in “upstream” mode vs stub-only).
### 5.2 Services
Services are basically “NixOS modules we want on this system.”
Shape:
```nix
services = {
<serviceName> = {
enable = true; # optional; presence can imply true
tags = [ "upstream" ]; # service-specific tags
config = { }; # free-form module options
};
};
```
Example:
```nix
services = {
headscale = { enable = true; config = { }; };
nginx-proxy = { enable = true; config = { }; };
nginx = { enable = true; config = { }; };
httpd = { enable = false; config = { }; }; # explicit off
jellyfin = { enable = true; config = { }; };
};
```
Metanix will map these entries into:
- `services.<name>.enable = true/false`
- service-specific options
- containerization (if you decide that later) or native services
### 5.3 Resources
Resources are logical capabilities this system **provides**:
```nix
resources = {
dns = { };
media = { };
git = { };
auth = { };
};
```
These serve as:
- symbolic handles for ACLs
- targets for other systems’ `consumers`
- hints for how to wire firewall / routing / DNS / etc.
### 5.4 Consumers
Consumers describe what this system **depends on**:
```nix
consumers = {
dns = { provider = "eris"; };
dhcp = { provider = "phobos"; };
wireguard = { provider = "frontend.kasear.net"; };
};
```
Resolution order:
- `systems.<name>.consumers.<res>.provider`
overrides
- top-level `consumers.<res>.provider` defaults
Providers can be:
- a host / system name (e.g. `"phobos"`)
- FQDN (e.g. `"frontend.kasear.net"`)
- raw IP (e.g. `"1.1.1.1"`)
Metanix uses this to generate:
- `/etc/resolv.conf`
- DNS stub configurations
- DHCP relays / clients
- WireGuard peers
---
## 6. Identity Model & Policy
This is the spine of the whole thing. Try not to break it.
### 6.1 `policy.users` – global identity ledger
`policy.users` defines who exists in the universe and what they look like _if they exist on a system_.
Shape:
```nix
policy.users.<username> = {
uid = int;
type = "human" | "service";
primaryGroup = "groupName";
extraGroups = [ "group1" "group2" ];
shell = "/run/current-system/sw/bin/bash";
home = {
type = "standard" | "shared" | "system" | "none";
path = null | "/path";
};
sshAuthorizedKeys = [ "ssh-..." ];
passwordHash = null | "hash";
locked = bool;
tags = [ "admin" "homelab" "monitoring" ];
homeManager = {
profiles = [ "desktopBase" "devTools" ];
extraModules = [ ./home/yaro-extra.nix ];
options = { programs.git.userName = "Yaro"; ... };
};
};
```
Examples:
```nix
policy.users = {
yaro = {
uid = 10010;
type = "human";
primaryGroup = "yaro";
extraGroups = [ "admins" "desktopUsers" ];
shell = "/run/current-system/sw/bin/bash";
home = { type = "standard"; path = null; };
sshAuthorizedKeys = [ "ssh-ed25519 AAAA...yaro" ];
passwordHash = null;
locked = false;
tags = [ "admin" "homelab" ];
homeManager = {
profiles = [ "desktopBase" "devTools" ];
extraModules = [ ./home/yaro-extra.nix ];
options = {
programs.git.userName = "Yaro";
programs.git.userEmail = "yaro@kasear.net";
};
};
};
monitoring = {
uid = 10030;
type = "service";
primaryGroup = "monitoring";
extraGroups = [ ];
shell = "/run/current-system/sw/bin/nologin";
home = { type = "system"; path = "/var/lib/monitoring"; };
sshAuthorizedKeys = [ ];
passwordHash = null;
locked = true;
tags = [ "service" "monitoring" ];
homeManager = {
profiles = [ ];
extraModules = [ ];
options = { };
};
};
};
```
**Important:**
`policy.users` does **not** decide _where_ a user exists. It defines the global, canonical identity when they do.
### 6.2 `policy.groups`
Global group ledger:
```nix
policy.groups = {
admins = { gid = 20010; members = [ "yaro" ]; };
ops = { gid = 20011; members = [ "ops" ]; };
desktopUsers = { gid = 20020; members = [ ]; };
monitoring = { gid = 20030; members = [ "monitoring" ]; };
};
```
Groups are used for:
- Unix group membership
- ACL principals
- targeting shared configurations
### 6.3 `policy.globals`
Global identity hints, mostly for presence / “tends to exist everywhere”:
```nix
policy.globals = {
owner = [ ]; # global owners (use sparingly)
admins = [ "yaro" ]; # global admins
users = [ "monitoring" ]; # plain / service users
};
```
Metanix uses this as a baseline:
- to decide which users “naturally” appear everywhere
- before location/host/system-specific overrides are applied
---
## 7. Identity Resolution & Privilege Rules
This is the fun part where you avoid Schrödinger’s sudoer.
### 7.1 Privilege levels
For a given user `U` on a system `S`:
```text
none < user < admin < owner
```
Where:
- `user` → exists, no sudo by default
- `admin` → sudo-capable / elevated
- `owner` → top-level admin in that scope; default broad control
### 7.2 Scopes
Privilege hints appear in:
- `locations.<loc>.{owner,admins,users}`
- `locations.<loc>.<subnet>.{owner,admins,users}`
- `locations.<loc>.<subnet>.hosts.<host>.{owner,admins,users}`
- `policy.globals`
- (optionally) `systems.<name>.{owner,admins,users}` later
### 7.3 Two key stages
**Stage 1: Per-host privilege**
Per host:
1. Start from location level
2. Overlay subnet level
3. Overlay host level
> More local scope wins at this stage.
Result: for each host, you get a map like:
```nix
# home.dmz.deimos
{
yaro = "owner";
ops = "admin";
}
# cloud.dmz.deimos-cloud
{
analytics = "user";
}
```
**Stage 2: Per-system aggregation (multi-host)**
A system can have multiple hosts:
```nix
systems.deimos.hosts = [ "deimos" "deimos-cloud" ];
```
When the same user appears with different host-level privileges for the same system:
> **System-level privilege is the highest privilege seen across all its hosts.**
So if:
- `home.dmz.deimos.owner = "yaro"`
- `cloud.dmz.deimos-cloud.users = [ "yaro" ]`
Then:
- Host view:
- home plane: `owner`
- cloud plane: `user`
- System view:
- `yaro` = `owner`
The system must see a single clear privilege; the network can see differing trust per plane.
### 7.4 Presence vs privilege
Existence (`user gets created at all`) depends on:
- privilege level **and**
- host role
Examples:
- On a `server` / `workstation` role:
- a user in `users` (non-admin) can be created as a plain user.
- On an `adminWorkstation` / `coreServer` / `router` role:
- plain `users` entries may **not** create accounts by default
- only `owner` / `admin` entries do
- unless policy or an explicit host override says otherwise.
This prevents admin machines from being stuffed full of random user accounts by accident.
### 7.5 Host-context semantics vs system-level semantics
System-level privilege:
- controls local Unix stuff:
- `users.users.<name>.isNormalUser = true`
- sudo / wheel membership
- group membership
Host-context privilege:
- controls **network-plane trust**:
- which interfaces are “admin planes”
- which subnets can reach SSH, mgmt ports, control APIs
- which subnets can only reach app ports
So you can have:
- `yaro` is owner on the system (sudo)
- from `home.dmz` plane, `yaro` is treated as admin-plane → SSH allowed
- from `cloud.dmz` plane, `yaro` is treated as regular → no SSH, only HTTP
That’s intentional: same identity, different trust by plane.
---
## 8. Policy Configurations & Home-manager
### 8.1 `policy.configurations`
This is where you define reusable config bundles that get attached to users, groups, systems, locations, etc.
Shape:
```nix
policy.configurations.<name> = {
targets = {
users = [ "yaro" { tag = "human"; } ];
groups = [ "devs" "desktopUsers" ];
systems = [ "deimos" "metatron" ];
locations = [ "home" "cloud" ];
subnets = [ "home.main" "cloud.infra" ];
};
nixos = {
modules = [ ./policy/some-module.nix ];
options = { services.foo.enable = true; };
};
homeManager = {
modules = [ ./hm/profile.nix ];
options = { programs.firefox.enable = true; };
};
};
```
Examples:
```nix
policy.configurations = {
desktopBase = {
targets = {
groups = [ "desktopUsers" ];
};
homeManager = {
modules = [ ./hm/desktop-base.nix ];
options = {
programs.firefox.enable = true;
};
};
};
devTools = {
targets = {
users = [ "yaro" "ops" ];
};
homeManager = {
modules = [ ./hm/dev-tools.nix ];
options = { };
};
};
firefoxProfile = {
targets = {
groups = [ "devs" ];
};
homeManager = {
modules = [ ./hm/firefox-profile.nix ];
options = {
extensions = [
"uBlockOrigin"
"multi-account-containers"
];
homepage = "https://intranet.kasear.net";
};
};
};
extraHosts = {
targets = {
systems = [ "deimos" "metatron" ];
};
nixos = {
modules = [ ./policy/extra-hosts.nix ];
options = {
hosts = {
"special.internal" = "203.0.113.7";
};
};
};
};
};
```
### 8.2 How home-manager is applied
For each **user on each system**, Metanix:
1. Determines if home-manager is available / integrated.
2. Collects:
- `policy.users.<user>.homeManager.profiles`
- `policy.users.<user>.homeManager.extraModules/options`
- all `policy.configurations.*` whose `targets` match:
- that user
- any of their groups
- the system
- its location/subnet
3. Merges HM modules / options in a defined order, e.g.:
```text
global / group bundles
→ profile bundles (from user.homeManager.profiles)
→ per-user extraModules / options
```
4. Emits a home-manager configuration for that user on that system.
End result:
> “This group of users will have Firefox installed with these extensions enabled.”
…is expressed once in `policy.configurations`, not copy-pasted.
---
## 9. Output Artifacts
Given `meta.nix`, Metanix is expected to generate, for each system:
- NixOS module tree:
- `users.users` and `users.groups`
- `services.*` for DNS, DHCP, WireGuard, nginx, etc.
- `/etc/hosts` with all local truths from `locations`
- networking (IP, routes, VLANs) from deterministic IP schema
- DNS configuration:
- authoritative zones (Knot)
- stub/resolver configs (Unbound)
- local zones for internal names
- DHCP configuration:
- Kea pools
- reservations from `hw-address` + derived IPs
- DHCP relays (e.g. dnsmasq relay on downstream routers)
- WireGuard configuration:
- upstream servers vs downstream clients
- mesh based on `tags` + `consumers.wireguard`
- Firewall:
- per-interface policies derived from:
- host role (`router`, `adminWorkstation`, `server`, etc.)
- host-context identity hints
- `policy.acl` (capabilities → allowed flows)
- Home-manager configs:
- per user, per system, based on `policy.users` and `policy.configurations`
---
## 10. Future Work / Open Questions
Because you’re not done tormenting yourself yet:
- Formalize IP derivation (e.g. mkIp using location/subnet/role bits).
- Define exact precedence rules for:
- HM module merge order
- NixOS module composition from policy and system configs
- Define a small ACL capability vocabulary:
- `ssh`, `sudo`, `manage-services`, `mount-nfs`, `read-media`, `scrape-metrics`, etc.
- Define how “upstream/downstream” tags automatically:
- wire DHCP relays over WG
- configure Knot + Unbound correctly
- Add validation:
- error on users referenced in locations but missing from `policy.users`
- error on groups referenced but missing from `policy.groups`
- warn when `adminWorkstation` has random non-admin users unless explicitly allowed

23
flake.lock generated
View file

@ -1,23 +0,0 @@
{
"nodes": {
"nixpkgs": {
"locked": {
"lastModified": 0,
"narHash": "sha256-NV4S2Lf2hYmZQ3Qf4t/YyyBaJNuxLPyjzvDma0zPp/M=",
"path": "/nix/store/4878dzkl1bdxv6wqavzy7bdracvl9q16-source",
"type": "path"
},
"original": {
"id": "nixpkgs",
"type": "indirect"
}
},
"root": {
"inputs": {
"nixpkgs": "nixpkgs"
}
}
},
"root": "root",
"version": 7
}

71
flake.nix
View file

@ -1,71 +0,0 @@
{
description = "Metanix core flake (meta.nix-driven outputs)";
inputs = {
# Base system
nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
# Tooling we integrate with
deploy-rs.url = "github:serokell/deploy-rs";
disko.url = "github:nix-community/disko";
};
outputs = { self, nixpkgs, deploy-rs, disko, ... }:
let
lib = nixpkgs.lib;
systems = [ "x86_64-linux" "aarch64-linux" ];
forAllSystems = f:
lib.genAttrs systems (system: f {
inherit system;
pkgs = import nixpkgs { inherit system; };
});
metanixLib = import ./lib {
inherit nixpkgs deploy-rs disko;
};
# Build the "world" view from meta.nix
world = metanixLib.fromMeta {
metaFile = ./meta.nix;
inherit nixpkgs deploy-rs disko;
};
in
{
# So other flakes *can* depend on Metanix as a library if needed.
lib = metanixLib;
# For nixos-rebuild / nixos-anywhere / deploy-rs
nixosConfigurations = world.nixosConfigurations;
# For deploy-rs
deploy = {
nodes = world.deployNodes;
};
# For disko-based installs (either as bare configs or modules)
diskoConfigurations = world.diskoConfigurations;
checks = forAllSystems ({ pkgs, ... }: {
meta-validate = metanixLib.checkMeta {
inherit pkgs;
metaFile = ./meta.nix;
};
});
devShells = forAllSystems ({ system, pkgs }: {
default = pkgs.mkShell {
name = "metanix-dev";
buildInputs = [
pkgs.nix
pkgs.git
deploy-rs.packages.${system}.default
disko.packages.${system}.default
];
};
});
}
}

9
lib/functions/location.nix
View file

@ -1,9 +0,0 @@
{ data, lib }:
let
mkLocationsList = locations: builtins.attrNames locations;
mkLocationIndex = data: location: lib.lists.findFirstIndex (x: x == location) null (mkLocationsList data);
in
{
inherit mkLocationsList mkLocationIndex;
}

12
lib/metanix.nix
View file

@ -1,12 +0,0 @@
{ data, lib }:
let
indexOf = name: names:
let
indexed = builtins.imap0 (i: v: { inherit i v; }) names;
matches = builtins.filter (x: x.v == name) indexed;
in
if matches == [ ] then null else (builtins.head matches).i;
in
{ indexOf = indexOf; }

528
meta.nix Normal file
View file

@ -0,0 +1,528 @@
# This is a WIP *example* meta.nix file for Metanix.
# It captures intent / semantics, not final implementation details.
# Expect this shape to evolve as Metanix grows teeth.
{
##############################
# Global / world-level config
##############################
domain = "kasear.net";
##############################
# Locations, subnets, hosts
#
# Shape:
# locations.<location> = {
# owner = "yaro"; # optional: default owner for this location
# admins = [ "ops" ]; # optional: location-wide admins
# users = [ "monitor" ]; # optional: location-relevant users
#
# <subnet> = {
# vlan = int; # optional (e.g. cloud may omit)
# dhcp = { start = 10; end = 250; }; # optional
#
# owner = "ops"; # optional: overrides location.owner
# admins = [ "sre" ]; # optional: adds/overrides admins
# users = [ "resident" ]; # optional: extra users relevant here
#
# hosts = {
# <hostname> = {
# role = "router" | "server" | "adminWorkstation" | "coreServer" | ...;
# hw-address = "aa:bb:cc:dd:ee:ff"; # optional
# aliases = [ "fqdn" ... ]; # optional
# interface = "eno2"; # optional
# dns = false; # optional, default true
# hostId = 42; # optional, for special cases
#
# # Identity hints in THIS CONTEXT ONLY:
# # These drive host-context privileges & network-plane semantics.
# # System-level privilege is resolved later across all hosts.
# owner = "yaro"; # this host’s admin owner
# admins = [ "ops" "sre" ]; # host-level admins
# users = [ "analytics" ]; # host-level plain users
# };
# };
# };
# };
##############################
locations = {
cloud = {
# cloud-level identity hints (example)
owner = "yaro";
admins = [ "ops" ];
users = [ "monitor" ];
dmz = {
hosts = {
eris = {
role = "router";
aliases = [ "frontend.kasear.net" ];
# Example: eris dmz-side is not an admin plane for anyone by default
users = [ "monitor" ];
};
deimos-cloud = {
role = "server";
interface = "wg0";
# Maybe this side is treated as non-admin ingress
users = [ "analytics" ];
};
};
};
infra = {
# infra is effectively the config plane type for this location
owner = "yaro";
admins = [ "ops" ];
hosts = {
metatron = {
role = "coreServer";
owner = "yaro"; # full admin plane for yaro here
admins = [ "ops" ];
};
loki-cloud = {
role = "adminWorkstation";
owner = "yaro"; # admin workstation for yaro in cloud
users = [ "analytics" ]; # non-admin local user still allowed
};
};
};
};
home = {
owner = "yaro";
admins = [ "ops" ];
dmz = {
vlan = 1;
hosts = {
io = {
role = "router";
aliases = [ "external.kasear.net" ];
};
europa-dmz = {
role = "router";
};
deimos = {
role = "server";
hw-address = "10:98:36:a0:2c:b2";
interface = "eno2";
aliases = [
"kasear.net"
"cloud.kasear.net"
"git.kasear.net"
"majike.kasear.net"
"media.kasear.net"
"minecraft.kasear.net"
"public.kasear.net"
"test.kasear.net"
"vault.kasear.net"
"vikali.kasear.net"
"vpn.kasear.net"
"www.kasear.net"
"yaro.kasear.net"
];
owner = "yaro"; # home-dmz plane: yaro is owner
admins = [ "ops" ];
};
container-host = {
role = "containerHost";
dns = false;
};
cloud-container = { role = "server"; dns = false; };
default-container = { role = "server"; dns = false; };
foregejo-container = { role = "server"; dns = false; };
majike-container = { role = "server"; dns = false; };
media-container = { role = "server"; dns = false; };
vault-container = { role = "server"; dns = false; };
vikali-container = { role = "server"; dns = false; };
vpn-container = { role = "server"; dns = false; };
yaro-container = { role = "server"; dns = false; };
};
};
main = {
vlan = 10;
dhcp = { start = 1; end = 250; };
hosts = {
europa = {
role = "router";
aliases = [ "internal.kasear.net" ];
};
terra = {
role = "infraDevice";
hw-address = "48:a9:8a:2d:7f:34";
aliases = [ "core.kasear.net" ];
# terra as admin workstation-like infra endpoint
role = "adminWorkstation";
owner = "yaro";
};
artemis = {
role = "infraDevice";
hw-address = "54:af:97:02:2f:15";
};
luna = {
role = "infraDevice";
hw-address = "30:23:03:48:4c:75";
};
phobos = {
role = "server";
hw-address = "10:98:36:a9:4a:26";
aliases = [
"pbx.kasear.net"
"private.kasear.net"
];
};
printer = {
role = "printer";
hw-address = "84:25:19:60:de:1e";
aliases = [ "printer.kasear.net" ];
};
tv = {
role = "media";
hw-address = "00:18:dd:04:9b:a8";
aliases = [ "tv.kasear.net" ];
};
ip-phone = {
role = "phone";
hw-address = "80:5e:c0:de:3d:66";
};
};
};
guest = {
vlan = 20;
dhcp = { start = 1; end = 250; };
hosts = {
europa-guest = { role = "router"; };
};
};
iot = {
vlan = 30;
hosts = {
europa-iot = { role = "router"; };
phobos-iot = {
role = "server";
hw-address = "10:98:36:a9:4a:26";
};
kitchen-echo = {
role = "appliance";
hw-address = "50:dc:e7:80:91:55";
};
bedroom-echo = {
role = "appliance";
hw-address = "f8:54:b8:21:f6:83";
};
lab-echo = {
role = "appliance";
hw-address = "08:84:9d:74:4d:c6";
};
camera1 = {
role = "camera";
hw-address = "9c:8e:cd:38:95:1f";
aliases = [ "camera1.kasear.net" ];
};
camera2 = {
role = "camera";
hw-address = "9c:8e:cd:38:95:15";
aliases = [ "camera2.kasear.net" ];
};
camera2-wifi = {
role = "camera";
hw-address = "9c:8e:cd:38:9a:fd";
};
samsung-tv = {
role = "appliance";
hw-address = "04:e4:b6:23:81:fc";
};
};
};
storage = {
vlan = 40;
dhcp = { start = 1; end = 250; };
hosts = {
europa-storage = { role = "router"; };
ganymede = {
role = "nas";
aliases = [ "storage.kasear.net" ];
};
};
};
management = {
vlan = 70;
hosts = {
deimos-idrac = {
role = "oobMgmt";
hw-address = "10:98:36:a0:2c:b3";
};
phobos-idrac = {
role = "oobMgmt";
hw-address = "10:98:36:a9:4a:27";
};
ganymede-idrac = {
role = "oobMgmt";
hw-address = "14:18:77:51:4b:b5";
};
};
};
};
};
##############################
# Systems
#
# systems.<systemName> = {
# tags = [
# "router" # role-like behavior
# "public" # exposed to public internet
# "upstream" # authoritative / config-plane provider (Kea/Knot/Unbound/WG server)
# "downstream" # router profile consuming upstream config-plane
# ];
#
# # Primary/default context for this system
# location = "home" | "cloud" | ...;
# subnet = "dmz" | "main" | ...;
#
# # Hosts that represent this system in different contexts.
# # Metanix will:
# # - compute per-host identity/privilege from locations
# # - then collapse them to system-level privileges using a
# # "highest privilege across hosts" rule when conflicts occur.
# hosts = [ "deimos" "deimos-cloud" ];
#
# # Optional: system-level identity hints (mostly additive)
# # owner = "yaro";
# # admins = [ "ops" ];
# # users = [ "monitor" ];
#
# services = {
# <serviceName> = {
# enable = true; # optional; presence may imply true
# tags = [ "upstream" ]; # service-specific semantics (optional)
# config = { }; # free-form options for the module
# };
# };
#
# resources = {
# <resourceName> = {
# # describes what this system provides (DNS, DHCP, WG, etc)
# # Metanix will map this to actual service configs.
# };
# };
#
# consumers = {
# <resourceName> = {
# provider = "phobos" | "frontend.kasear.net" | "1.1.1.1" | "metatron";
# };
# };
#
# configuration = ./systems/.../default.nix; # local NixOS config hook
# };
##############################
systems = {
eris = {
tags = [ "router" "public" /* "downstream" */ ];
location = "cloud";
subnet = "dmz";
hosts = [ "eris" ];
services = {
# Example: public-facing Unbound, could act as upstream resolver
unbound = {
enable = true;
tags = [ "upstream" ];
config = { };
};
wireguard = {
enable = true;
config = { };
};
};
resources = {
dns = { };
wireguard = { };
};
consumers = {
# Example: eris itself might delegate recursion to some other system
# or upstream; here we override the global default to "metatron".
dns = { provider = "metatron"; };
};
configuration = ./systems/x86_64-linux/eris/default.nix;
};
deimos = {
tags = [ "server" "public" ];
location = "home";
subnet = "dmz";
hosts = [ "deimos" "deimos-cloud" ];
services = {
# enable is optional; presence in this attrset implies enable = true by default.
headscale = { enable = true; config = { }; };
nginx-proxy = { enable = true; config = { }; };
nginx = { enable = true; config = { }; };
httpd = { enable = false; config = { }; }; # explicit disable
nextcloud = { enable = true; config = { }; };
jellyfin = { enable = true; config = { }; };
foregejo = { enable = true; config = { }; };
vaultwarden = { enable = true; config = { }; };
};
resources = {
# logical resources provided by this system
web = { };
media = { };
git = { };
auth = { };
};
consumers = {
dns = { provider = "eris"; }; # use eris as DNS
dhcp = { provider = "phobos"; }; # explicit, even if matches default
};
configuration = ./systems/x86_64-linux/deimos/default.nix;
};
};
##############################
# Global resource consumers
#
# Defaults that apply if systems.<name>.consumers.<res>.provider
# is not specified.
##############################
consumers = {
dhcp = {
provider = "phobos";
};
dns = {
provider = "1.1.1.1";
};
wireguard = {
provider = "frontend.kasear.net";
};
};
##############################
# Policy layer (identities, ACL, shared configs)
#
# Intended shape:
#
# policy = {
# users = {
# yaro = { uid = 10010; groups = [ "admins" ]; ... };
# ops = { uid = 10011; groups = [ "ops" ]; ... };
# };
#
# groups = {
# admins = { gid = 20010; members = [ "yaro" ]; };
# ops = { gid = 20011; members = [ "ops" ]; };
# };
#
# globals = {
# # Global identities that tend to exist everywhere.
# owner = [ "root-overlord" ]; # potential global owners
# admins = [ "sre" ]; # global admins
# users = [ "monitor" ]; # global plain users
# };
#
# configurations = {
# firefoxProfile = {
# targets = {
# users = [ "devs" ];
# groups = [ "desktopUsers" ];
# # systems / locations / subnets could also be targeted
# };
#
# module = ./policy/firefox.nix; # NixOS/home-manager module
# options = {
# extensions = [ "uBlockOrigin" "multi-account-containers" ];
# homepage = "https://intranet.kasear.net";
# };
# };
#
# extraHosts = {
# targets = {
# systems = [ "deimos" "metatron" ];
# };
#
# module = ./policy/extra-hosts.nix;
# options = {
# hosts = {
# "special.internal" = "203.0.113.7";
# };
# };
# };
# };
#
# acl = {
# "storage-access" = {
# principals = [ "admins" "mediaClients" ];
# resources = [ "ganymede" ];
# capabilities = [ "mount-nfs" "read-media" ];
# };
#
# "cloud-admin" = {
# principals = [ "yaro" "admins" ];
# resources = [ "location:cloud" ];
# capabilities = [ "ssh" "sudo" "manage-services" ];
# };
# };
# };
##############################
policy = {
users = { };
groups = { };
globals = {
owner = [ ];
admins = [ ];
users = [ ];
};
configurations = { };
acl = { };
};
}

6
meta.nix.default
View file

@ -1,6 +0,0 @@
{
locations = {};
systems = {};
users = {};
groups = {};
}

6
test-index.nix
View file

@ -1,6 +0,0 @@
# test-index.nix
let
data = import ./meta.nix;
metanix = import ./lib/metanix.nix { inherit data; };
in
metanix.buildSystemIndex

183
test/meta.nix
View file

@ -1,183 +0,0 @@
{
locations = {
cloud = {
owner = "yaro";
subnets = {
dmz = {
systems = {
janus = {
primary = true;
macAddresses = [ "AA:BB:CC:DD:EE:FF" ];
};
};
};
main = {
systems = {
metatron = {
primary = true;
macAddresses = [ "11:22:33:44:55:66" ];
};
};
};
};
};
home = {
owner = "yaro";
subnets = {
open = {
managed = false;
systems = {
io = {
useDHCP = true;
macAddresses = [ "DD:DD:DD:DD:DD:DD" ];
};
};
};
dmz = {
isVLAN = true;
systems = {
io = {
primary = true;
macAddresses = [ "12:34:56:78:9A:BC" ];
};
europa = {
macAddresses = [ "FE:DC:BA:98:76:54" ];
};
deimos = {
primary = true;
macAddresses = [ "AA:AA:AA:AA:AA:AA" ];
};
};
};
main = {
users = [
"alice"
"bob"
];
isVLAN = true;
systems = {
europa = {
primary = true;
macAddresses = [ "BB:BB:BB:BB:BB:BB" ];
};
phobos = {
primary = true;
macAddresses = [ "CC:CC:CC:CC:CC:CC" ];
};
terra = {
primary = true;
macAddresses = [ "EE:EE:EE:EE:EE:EE" ];
};
};
};
};
};
};
systems = {
janus = {
owner = "yaro";
nixOS = true;
role = "infrastructure";
tags = [ "router" "linode" ];
services = [ "nginx-proxy" "headscale" ];
config = { ... }: {
# NixOS config here, or use a path to one.
};
};
metatron = {
owner = "yaro";
nixOS = true;
role = "server";
tags = [ "server" "linode" "upstream" ];
config = { ... }: {
# NixOS config here, or use a path to one.
};
};
io = {
owner = "yaro";
nixOS = true;
role = "infrastructure";
tags = [ "router" "downstream" ];
config = { ... }: {
# NixOS config here, or use a path to one.
};
};
europa = {
owner = "yaro";
nixOS = true;
role = "infrastructure";
tags = [ "router" "downstream" ];
config = { ... }: {
# NixOS config here, or use a path to one.
};
};
deimos = {
owner = "yaro";
nixOS = true;
role = "server";
tags = [ "server" ];
servicesPlane = "janus";
hostPlane = "deimos";
services = [
"nextcloud"
"yaro-site"
"vaultwarden"
"jellyfin"
"forgejo"
"headscale"
];
config = { ... }: {
# NixOS config here, or use a path to one.
};
};
phobos = {
owner = "yaro";
nixOS = true;
role = "server";
tags = [ "server" ];
servicesPlane = "deimos";
services = [
"mosquitto"
"home-assistant"
"sandbox"
"node-red"
];
config = { ... }: {
# NixOS config here, or use a path to one.
};
};
terra = {
owner = "yaro";
nixOS = false;
role = "infrastructure";
};
};
users = {
yaro = { };
alice = { };
bob = { };
};
group = {
userGroups = {
programmers = {
config = { ... }: {
# Home-manager config here, or use a path to one.
};
};
};
systemGroups = {
storage = {
services = [
"nfs"
"isci"
];
config = { ... }: {
# Home-manager config here, or use a path to one.
};
};
};
};
}

11
test/test-location.nix
View file

@ -1,11 +0,0 @@
let
nixpkgs = import <nixpkgs> { };
sampleData = import ./meta.nix;
locationLib = import ../lib/functions/location.nix {
data = sampleData;
lib = nixpkgs.lib;
};
in
{
result = locationLib.mkLocationIndex sampleData.locations "home";
}