Merge branch 'hosts-v2' into 'main'

Draft: Nouvelle structure du repo nix

See merge request nounous/nixos!74

flake.nix

@@ -38,67 +38,67 @@
               ./modules
               agenix.nixosModules.default
             ];
+            get_hosts_names = path:
+              attrNames (
+                attrsets.filterAttrs (name: type: type == "directory")
+                  (readDir path)
+            ) ;
+            hostVM = get_hosts_names ./hosts/vm;
+            hostPhysique = get_hosts_names ./hosts/physiques;
+            get_info =
+              path: lists:
+              filter (x: x != null)
+                (map (name:
+                  let filePath = path + "/${name}/info.nix";
                   in
+                  if builtins.pathExists filePath then
+                  #   let eval = evalModules {
+                  #     specialArgs = inputs;
+                  #     modules = [
+                  #       ./modules/crans
+                  #       {
+                  #         crans = import filePath;
+                  #       }
+                  #       # agenix.nixosModules.default
+                  #     ];
+                  #   };
+                  # in
+                  #   eval.config
                   {
-            apprentix = nixosSystem {
+                    crans = import filePath;
-              specialArgs = inputs;
+                  }
-              modules = [ ./hosts/vm/apprentix ] ++ baseModules;
+                  else
-            };
+                    warn "${toString filePath} not found" null
+              ) lists
+            );
+            hosts_vm_info = get_info ./hosts/vm hostVM;
+            hosts_physique_info = get_info ./hosts/physiques hostPhysique;
 
-            collabora = nixosSystem {
+            listInfoToAttrs =
-              specialArgs = inputs;
+              path: infos:
-              modules = [ ./hosts/vm/collabora ] ++ baseModules;
+                listToAttrs (
-            };
+                  map (info:
-
+                    {
-            jitsi = nixosSystem {
+                    name = info.crans.name;
-              specialArgs = inputs;
+                    value = info;
-              modules = [ ./hosts/vm/jitsi ] ++ baseModules;
+                  }
-            };
+                  ) infos)
-
+              ;
-            livre = nixosSystem {
+            attrsToNixosSystem = path: all_hosts: hosts:
-              specialArgs = inputs;
+              mapAttrs (name: info:
-              modules = [ ./hosts/vm/livre ] ++ baseModules;
+                nixosSystem {
-            };
+                  specialArgs = { hosts = all_hosts; inherit inputs;};
-
+                  modules = [(path + "/${name}")] ++ [info] ++ baseModules
-            neo = nixosSystem {
+                  ;
-              specialArgs = inputs;
+                }
-              modules = [ ./hosts/vm/neo ] ++ baseModules;
+                ) hosts;
-            };
+            attrs_vm_info = listInfoToAttrs ./hosts/vm hosts_vm_info;
-
+            attrs_physique_info = listInfoToAttrs ./hosts/physiques hosts_physique_info;
-            nextcloud = nixosSystem {
+            attrs_all_info = attrs_physique_info // attrs_vm_info;
-              specialArgs = inputs;
+          in
-              modules = [ ./hosts/vm/nextcloud ] ++ baseModules;
+            (attrsToNixosSystem ./hosts/vm attrs_all_info attrs_vm_info)
-            };
+            //
-
+          {
-            periodique = nixosSystem {
-              specialArgs = inputs;
-              modules = [ ./hosts/vm/periodique ] ++ baseModules;
-            };
-
-            redite = nixosSystem {
-              specialArgs = inputs;
-              modules = [ ./hosts/vm/redite ] ++ baseModules;
-            };
-
-            reverseproxy = nixosSystem {
-              specialArgs = inputs;
-              modules = [ ./hosts/vm/reverseproxy ] ++ baseModules;
-            };
-
-            thot = nixosSystem {
-              specialArgs = inputs;
-              modules = [ ./hosts/physiques/thot ] ++ baseModules;
-            };
-
-            two = nixosSystem {
-              specialArgs = inputs;
-              modules = [ ./hosts/vm/two ] ++ baseModules;
-            };
-
-            vaultwarden = nixosSystem {
-              specialArgs = inputs;
-              modules = [ ./hosts/vm/vaultwarden ] ++ baseModules;
-            };
            cransIso = nixosSystem {
               system = "x86_64-linux";
               specialArgs = inputs;

hosts/physiques/cameron/info.nix

@@ -0,0 +1,22 @@
+{
+  name = "cameron";
+  description = "Serveur de stockage adh";
+  id = 2;
+
+  isDebian = true;
+
+  networking = {
+    adm.enable = true;
+    san.enable = true;
+
+    switch = {
+      # todo recheck port
+      salameche = -1;
+    };
+  };
+  
+  ilo = {
+    id = 52;
+    switch.salameche = 16;
+  };
+}

hosts/physiques/cephiroth/info.nix

@@ -0,0 +1,20 @@
+{
+  name = "cephiroth";
+  description = "Serveur de stockage ceph";
+  id = 3;
+
+  networking = {
+    adm.enable = true;
+    san.enable = true;
+
+    switch = {
+      carapuce = 12;
+      arceus = 12;
+    };
+  };
+  
+  ilo = {
+    id = 53;
+    switch.salameche = 20;
+  };
+}

hosts/physiques/daniel/info.nix

@@ -0,0 +1,23 @@
+{
+  name = "daniel";
+  description = "PVE adm";
+  id = 12;
+
+  isDebian = true;
+
+  networking = {
+    adm.enable = true;
+    san.enable = true;
+    srv-nat.enable = true;
+
+    switch = {
+      carapuce = 3;
+      arceus = 3;
+    };
+  };
+  
+  ilo = {
+    id = 22;
+    switch.salameche = 4;
+  };
+}

hosts/physiques/ft/info.nix

@@ -0,0 +1,17 @@
+{
+  name = "ft";
+  description = "Serveur de backup du Crans, en SQ39";
+  id = 15;
+
+  isDebian = true;
+
+  networking = {
+    adm.enable = true;
+
+    switch = {
+      carapuce = 13;
+      arceus = 13;
+    };
+  };
+  
+}

hosts/physiques/gulp/info.nix

@@ -0,0 +1,22 @@
+{
+  name = "gulp";
+  description = "PVE adh";
+  id = 18;
+
+  isDebian = true;
+
+  networking = {
+    adm.enable = true;
+    adh.enable = true;
+
+    switch = {
+      carapuce = 11;
+      arceus = 11;
+    };
+  };
+  
+  ilo = {
+    id = 28;
+    switch.salameche = 12;
+  };
+}

hosts/physiques/jack/info.nix

@@ -0,0 +1,24 @@
+{
+  name = "jack";
+  description = "PVE adm";
+  id = 13;
+
+  isDebian = true;
+
+  networking = {
+    adm.enable = true;
+    san.enable = true;
+    srv-nat.enable = true;
+
+    switch = {
+      carapuce = 5;
+      arceus = 5;
+    };
+  };
+  
+  ilo = {
+    id = 23;
+    switch.salameche = 6;
+  };
+}
+

hosts/physiques/odlyd/info.nix

@@ -0,0 +1,21 @@
+{
+  name = "odlyd";
+  description = "PVE adh";
+  id = 16;
+
+  isDebian = true;
+
+  networking = {
+    adm.enable = true;
+    adh.enable = true;
+
+    switch = {
+      # pas branche
+    };
+  };
+  
+  ilo = {
+    id = 26;
+    switch.salameche = 8;
+  };
+}

hosts/physiques/sam/info.nix

@@ -0,0 +1,23 @@
+{
+  name = "sam";
+  description = "PVE adm";
+  id = 11;
+
+  isDebian = true;
+
+  networking = {
+    adm.enable = true;
+    san.enable = true;
+    srv-nat.enable = true;
+
+    switch = {
+      carapuce = 1;
+      arceus = 1;
+    };
+  };
+  
+  ilo = {
+    id = 21;
+    switch.salameche = 2;
+  };
+}

hosts/physiques/stitch/info.nix

@@ -0,0 +1,22 @@
+{
+  name = "stitch";
+  description = "PVE adh";
+  id = 17;
+
+  isDebian = true;
+
+  networking = {
+    adm.enable = true;
+    adh.enable = true;
+
+    switch = {
+      carapuce = 9;
+      arceus = 9;
+    };
+  };
+  
+  ilo = {
+    id = 27;
+    switch.salameche = 10;
+  };
+}

hosts/physiques/tealc/info.nix

@@ -0,0 +1,22 @@
+{
+  name = "tealc";
+  description = "Serveur de stockage adm";
+  id = 1;
+
+  isDebian = true;
+
+  networking = {
+    adm.enable = true;
+    san.enable = true;
+
+    switch = {
+      carapuce = 10;
+      arceus = 10;
+    };
+  };
+  
+  ilo = {
+    id = 51;
+    switch.salameche = 18;
+  };
+}

hosts/physiques/thot/default.nix

@@ -38,19 +38,5 @@
     restic
   ];
 
-  crans = {
-    enable = true;
-
-    networking.adm.enable = false;
-    resticClient.enable = false;
-
-    services = {
-      resticServer = {
-        enable = true;
-        port = 4242;
-      };
-    };
-  };
-
   system.stateVersion = "24.05";
 }

hosts/physiques/thot/info.nix

@@ -0,0 +1,17 @@
+{
+  name = "thot";
+  description = "Serveur de backup sous nixos utilisant Restic";
+  id = 14;
+  
+  enable = true;
+
+  networking.adm.enable = false;
+  resticClient.enable = false;
+
+  services = {
+    resticServer = {
+      enable = true;
+      port = 4242;
+    };
+  };
+}

hosts/physiques/zamok/info.nix

@@ -0,0 +1,23 @@
+{
+  name = "zamok";
+  description = "Serveur de calcul adhérent";
+  id = 31;
+
+  isDebian = true;
+
+  networking = {
+    adm.enable = true;
+    adh.enable = true;
+    san.enable = true;
+
+    switch = {
+      carapuce = 7;
+      arceus = 4;
+    };
+  };
+  
+  ilo = {
+    id = 54;
+    switch.salameche = 14;
+  };
+}

hosts/vm/apprentix/default.nix

@@ -9,21 +9,6 @@
 
   networking.hostName = "apprentix";
 
-  crans = {
-    enable = true;
-
-    networking = {
-      id = 150;
-      srvNat.enable = true;
-    };
-
-    resticClient.when = "01:23";
-
-    homeNounou.enable = false;
-
-    users.root.passwordFile = ../../../secrets/apprentix/root.age;
-  };
-
   security.sudo.extraRules = [
     {
       groups = [ "_user" ];

hosts/vm/apprentix/info.nix

@@ -0,0 +1,17 @@
+{
+    name = "apprentix";
+    description = "VM pour les apprenti⋅es";
+    id = 150;
+    
+    enable = true;
+
+    networking = {
+      srvNat.enable = true;
+    };
+
+    resticClient.when = "01:23";
+
+    homeNounou.enable = false;
+
+    users.root.passwordFile = ../../../secrets/apprentix/root.age;
+}

hosts/vm/collabora/default.nix

@@ -9,16 +9,5 @@
   networking.hostName = "collabora";
   boot.loader.grub.devices = [ "/dev/sda" ];
 
-  crans = {
-    enable = true;
-
-    networking = {
-      id = 149;
-      srvNat.enable = true;
-    };
-
-    resticClient.enable = false;
-  };
-
   system.stateVersion = "25.09";
 }

hosts/vm/collabora/info.nix

@@ -0,0 +1,14 @@
+{
+  name = "collabora";
+  description = "Collabora du Crans";
+  id = 149;
+
+  enable = true;
+
+  networking = {
+    srvNat.enable = true;
+  };
+
+  resticClient.enable = false;
+}
+

hosts/vm/jitsi/default.nix

@@ -9,23 +9,5 @@
   networking.hostName = "jitsi";
   boot.loader.grub.devices = [ "/dev/vda" ];
 
-  crans = {
-    enable = true;
-
-    networking = {
-      id = 163;
-      srv = {
-        enable = true;
-        ipv4 = "185.230.79.15";
-      };
-    };
-
-    resticClient.when = "02:34";
-
-    services = {
-      acme.enable = true;
-    };
-  };
-
   system.stateVersion = "24.11";
 }

hosts/vm/jitsi/info.nix

@@ -0,0 +1,27 @@
+{
+  name = "jitsi";
+  description = "Machine qui gère Jitsi";
+
+  id = 163;
+
+  networking = {
+    adm.enable = true;
+    srv = {
+      enable = true;
+      ipv4 = "185.230.79.15";
+    };
+  };
+
+  resticClient.when = "02:34";
+
+  services = {
+    acme.enable = true;
+  };
+
+  # aliasDNS = [
+  #   "visio"
+  # ];
+
+  public-ssh = "";
+  
+}

hosts/vm/livre/default.nix

@@ -9,16 +9,5 @@
   networking.hostName = "livre";
   boot.loader.grub.devices = [ "/dev/sda" ];
 
-  crans = {
-    enable = true;
-
-    networking = {
-      id = 140;
-      srvNat.enable = true;
-    };
-
-    resticClient.when = "03:45";
-  };
-
   system.stateVersion = "24.11";
 }

hosts/vm/livre/info.nix

@@ -0,0 +1,14 @@
+{
+  name = "livre";
+  description = "Editeur de PDF en ligne via Stirling-PDF";
+  id = 140;
+
+  enable = true;
+
+  networking = {
+    srvNat.enable = true;
+  };
+
+  resticClient.when = "03:45";
+}
+

hosts/vm/neo/default.nix

@@ -12,24 +12,5 @@
 
   networking.hostName = "neo";
 
-  crans = {
-    enable = true;
-
-    networking = {
-      id = 141;
-      srv = {
-        enable = true;
-        ipv4 = "185.230.79.5";
-      };
-    };
-
-    resticClient.when = "04:56";
-
-    services = {
-      acme.enable = true;
-      coturn.enable = true;
-    };
-  };
-
   system.stateVersion = "24.11";
 }

hosts/vm/neo/info.nix

@@ -0,0 +1,20 @@
+{
+  name = "neo";
+  description = "Matrix du Crans et bridge IRC/Matrix";
+  enable = true;
+  id = 141;
+
+  networking = {
+    srv = {
+      enable = true;
+      ipv4 = "185.230.79.5";
+    };
+  };
+
+  resticClient.when = "04:56";
+
+  services = {
+    acme.enable = true;
+    coturn.enable = true;
+  };
+}

hosts/vm/nextcloud/default.nix

@@ -9,25 +9,6 @@
   networking.hostName = "nextcloud";
   boot.loader.grub.devices = [ "/dev/sda" ];
 
-  crans = {
-    enable = true;
-    networking = {
-      id = 146;
-      srvNat = {
-        enable = true;
-        interface = "ens20";
-      };
-      san = {
-        enable = true;
-        interface = "ens19";
-      };
-    };
-
-    homeAdh.enable = true;
-
-    resticClient.enable = false;
-  };
-
   services.autofs = {
     enable = true;
 

hosts/vm/nextcloud/info.nix

@@ -0,0 +1,22 @@
+{
+    name = "nextcloud";
+    description = "Nextcloud du Crans";
+    id = 146;
+    
+    enable = true;
+
+    networking = {
+      srvNat = {
+        enable = true;
+        interface = "ens20";
+      };
+      san = {
+        enable = true;
+        interface = "ens19";
+      };
+    };
+
+    homeAdh.enable = true;
+
+    resticClient.enable = false;
+}

hosts/vm/periodique/default.nix

@@ -9,16 +9,5 @@
   networking.hostName = "periodique";
   boot.loader.grub.devices = [ "/dev/sda" ];
 
-  crans = {
-    enable = true;
-
-    networking = {
-      id = 118;
-      srvNat.enable = true;
-    };
-
-    resticClient.when = "02:56";
-  };
-
   system.stateVersion = "24.11";
 }

hosts/vm/periodique/info.nix

@@ -0,0 +1,14 @@
+{
+  name = "periodique";
+  description = "Frontend Matrix du Crans (element)";
+  id = 118;
+
+  enable = true;
+
+  networking = {
+    srvNat.enable = true;
+  };
+
+  resticClient.when = "02:56";
+}
+

hosts/vm/redite/default.nix

@@ -9,16 +9,5 @@
   networking.hostName = "redite";
   boot.loader.grub.devices = [ "/dev/sda" ];
 
-  crans = {
-    enable = true;
-
-    networking = {
-      id = 139;
-      srvNat.enable = true;
-    };
-
-    resticClient.when = "06:18";
-  };
-
   system.stateVersion = "23.11";
 }

hosts/vm/redite/info.nix

@@ -0,0 +1,13 @@
+{
+  name = "redite";
+  description = "Frontend reddit libre";
+  id = 139;
+
+  enable = true;
+
+  networking = {
+    srvNat.enable = true;
+  };
+
+  resticClient.when = "06:18";
+}

hosts/vm/reverseproxy/default.nix

@@ -13,22 +13,5 @@
   users.users."nginx".home = "/var/lib/nginx";
   users.users."anubis".extraGroups = [ "nginx" ];
 
-  crans = {
-    enable = true;
-
-    networking = {
-      id = 151;
-      srvNat.enable = true;
-      srv = {
-        enable = true;
-        interface = "ens20";
-        ipv4 = "185.230.79.42";
-      };
-    };
-
-    resticClient.when = "03:42";
-
-  };
-
   system.stateVersion = "25.05";
 }

hosts/vm/reverseproxy/info.nix

@@ -0,0 +1,20 @@
+{
+  name = "reverseproxy";
+  description = "reverse-proxy principale du Crans";
+  id = 151;
+
+  enable = true;
+
+  networking = {
+    srvNat.enable = true;
+    srv = {
+      enable = true;
+      interface = "ens20";
+      ipv4 = "185.230.79.42";
+    };
+  };
+
+  resticClient.when = "03:42";
+
+}
+

hosts/vm/two/default.nix

@@ -8,19 +8,6 @@
   networking.hostName = "two";
   boot.loader.grub.devices = [ "/dev/sda" ];
 
-  crans = {
-    enable = true;
-
-    networking = {
-      id = 135;
-      srvNat = {
-        enable = true;
-        interface = "ens19";
-      };
-    };
-
-    resticClient.when = "07:29";
-  };
 
   system.stateVersion = "23.11";
 }

hosts/vm/two/info.nix

@@ -0,0 +1,16 @@
+{
+  name = "two";
+  description = "VM de test";
+  id = 135;
+    
+  enable = true;
+
+  networking = {
+    srvNat = {
+      enable = true;
+      interface = "ens19";
+    };
+  };
+
+  resticClient.when = "07:29";
+}

hosts/vm/vaultwarden/default.nix

@@ -9,16 +9,5 @@
   networking.hostName = "vaultwarden";
   boot.loader.grub.devices = [ "/dev/sda" ];
 
-  crans = {
-    enable = true;
-
-    networking = {
-      id = 159;
-      srvNat.enable = true;
-    };
-
-    resticClient.when = "04:44";
-  };
-
   system.stateVersion = "24.05";
 }

hosts/vm/vaultwarden/info.nix

@@ -0,0 +1,13 @@
+{
+  name = "vaultwarden";
+  description = "Vaultarden du crans, gestionnaire de mot de passe";
+  id = 159;
+  
+  enable = true;
+
+  networking = {
+    srvNat.enable = true;
+  };
+
+  resticClient.when = "04:44";
+}

modules/crans/default.nix

@@ -8,6 +8,7 @@ in
 {
   imports = [
     ./age.nix
+    ./extra.nix
     ./grub.nix
     ./home.nix
     ./locale.nix

modules/crans/extra.nix

@@ -0,0 +1,32 @@
+{ lib, ... }:
+with lib;
+{
+  options.crans = {
+    name = mkOption {
+      type = types.str;
+      example = "vm-test";
+      description = "Nom de la machine";
+    };
+    
+    description = mkOption {
+      type = types.str;
+      example = "VM de test";
+      description = "Description de la machine";
+    };
+
+    id = mkOption {
+      type = types.int;
+      example = 135;
+      description = """
+        ID de la machine :
+        - < 100 machine physique
+        - >= 100 VM ( id de la VM dans proxmox )
+        """;
+    };
+
+    public-ssh = mkOption {
+      type = types.str;
+      description = "Clé ssh public de la machine";
+    };
+  };
+}

modules/crans/networking.nix

@@ -1,13 +1,15 @@
-{ lib, config, ... }:
+{ lib, config, hosts, ... }:
 
 let
-  cfg = config.crans.networking;
+  cfg = config.crans;
+  cfg-net = cfg.networking;
 
   inherit (lib)
     mkEnableOption
     mkIf
     mkOption
     types
+    mod
     ;
 
   idString = toString cfg.id;
@@ -15,17 +17,13 @@ let
   hostIdString = lib.fixedWidthString 2 "0" (toString hostId);
   isVm = cfg.id >= 100;
   isVmString = toString isVm;
+  get_mac = id: vlan_num:
+    "02:00:00:0${toString (id >= 100)}:${toString (mod id 100)}:${lib.fixedWidthString 2 "0" (toString vlan_num)}";
 in
 {
   options.crans.networking = {
     enable = mkEnableOption "Configuration réseaux commune à toutes les machines du Crans.";
 
-    id = mkOption {
-      type = types.int;
-      example = 135;
-      description = "Le numéro de la VM dans Proxmox.";
-    };
-
     adm = {
       enable = mkEnableOption "Configuration du VLAN adm.";
 
@@ -35,6 +33,21 @@ in
         example = "ens20";
         description = "Nom de l'interface réseau sur laquelle est située le VLAN adm.";
       };
+
+      ipv4 = mkOption {
+        type = types.str;
+        example = "176.16.10.102";
+        default = "172.16.10.${idString}";
+        description = "Adresse IPv4 de la machine sur le VLAN adm";
+      };
+
+      ipv6 = mkOption {
+        type = types.str;
+        example = "fd00::10:0:ff:fe01:0210";
+        default = "fd00::10:0:ff:fe0${isVmString}:${hostIdString}10";
+        description = "Adresse IPv6 de la machine sur le VLAN adm";
+      };
+      
     };
 
     srv = {
@@ -52,6 +65,13 @@ in
         example = "185.230.79.1";
         description = "Adresse IPv4 de la machine.";
       };
+      
+      ipv6 = mkOption {
+        type = types.str;
+        example = "2a0c:700:2::ff:fe01:0202";
+        default = "2a0c:700:2::ff:fe0${isVmString}:${hostIdString}02";
+        description = "Adresse IPv6 de la machine sur le VLAN srv.";
+      };
     };
 
     srvNat = {
@@ -63,6 +83,20 @@ in
         example = "ens20";
         description = "Nom de l'interface réseau sur laquelle est située le VLAN srv-nat.";
       };
+
+      ipv4 = mkOption {
+        type = types.str;
+        example = "176.16.3.102";
+        default = "172.16.3.${idString}";
+        description = "Adresse IPv4 de la machine sur le VLAN srv-nat.";
+      };
+
+      ipv6 = mkOption {
+        type = types.str;
+        example = "2a0c:700:3::ff:fe01:0203";
+        default = "2a0c:700:3::ff:fe0${isVmString}:${hostIdString}03";
+        description = "Adresse IPv6 de la machine sur le VLAN srv-nat.";
+      };
     };
 
     san = {
@@ -73,11 +107,26 @@ in
         example = "ens19";
         description = "Nom de l'interface réseau sur laquelle est située le VLAN san.";
       };
+      
+      ipv4 = mkOption {
+        type = types.str;
+        example = "176.16.4.102";
+        default = "172.16.4.${idString}";
+        description = "Adresse IPv4 de la machine sur le VLAN srv-nat.";
+      };
+
+      ipv6 = mkOption {
+        type = types.str;
+        example = "fd00::4:0:ff:fe01:0204";
+        default = "fd00::4:0:ff:fe0${isVmString}:${hostIdString}04";
+        description = "Adresse IPv6 de la machine sur le VLAN san.";
+      };
     };
   };
 
-  config = mkIf cfg.enable {
+  config = mkIf cfg-net.enable {
     networking = {
+      hostName = cfg.name;
       useDHCP = false;
       firewall.enable = lib.mkDefault false;
       nameservers = [ "172.16.10.128" ];
@@ -92,24 +141,24 @@ in
         # plus bas).
         lib.attrsets.mapAttrs'
           (interface: conf: {
-            name = cfg."${interface}".interface;
+            name = cfg-net."${interface}".interface;
             value = conf;
           })
           (
             # On filtre sur les interfaces activées
-            lib.attrsets.filterAttrs (interface: _: cfg."${interface}".enable) {
+            lib.attrsets.filterAttrs (interface: _: cfg-net."${interface}".enable) {
               # Configuration du VLAN adm
               adm = {
                 ipv4.addresses = [
                   {
-                    address = "172.16.10.${idString}";
+                    address = cfg-net.adm.ipv4;
                     prefixLength = 24;
                   }
                 ];
 
                 ipv6.addresses = [
                   {
-                    address = "fd00::10:0:ff:fe0${isVmString}:${hostIdString}10";
+                    address = cfg-net.adm.ipv6;
                     prefixLength = 64;
                   }
                 ];
@@ -120,7 +169,7 @@ in
                 ipv4 = {
                   addresses = [
                     {
-                      address = cfg.srv.ipv4;
+                      address = cfg-net.srv.ipv4;
                       prefixLength = 26;
                     }
                   ];
@@ -135,7 +184,7 @@ in
                 ipv6 = {
                   addresses = [
                     {
-                      address = "2a0c:700:2::ff:fe0${isVmString}:${hostIdString}02";
+                      address = cfg-net.srv.ipv6;
                       prefixLength = 64;
                     }
                   ];
@@ -154,7 +203,7 @@ in
                 ipv4 = {
                   addresses = [
                     {
-                      address = "172.16.3.${idString}";
+                      address = cfg-net.srvNat.ipv4;
                       prefixLength = 24;
                     }
                   ];
@@ -170,7 +219,7 @@ in
                 ipv6 = {
                   addresses = [
                     {
-                      address = "2a0c:700:3::ff:fe0${isVmString}:${hostIdString}03";
+                      address = cfg-net.srvNat.ipv6;
                       prefixLength = 64;
                     }
                   ];
@@ -188,14 +237,14 @@ in
               san = {
                 ipv4.addresses = [
                   {
-                    address = "172.16.4.${idString}";
+                    address = cfg-net.san.ipv4;
                     prefixLength = 24;
                   }
                 ];
 
                 ipv6.addresses = [
                   {
-                    address = "fd00::4:0:ff:fe0${isVmString}:${hostIdString}04";
+                    address = cfg-net.san.ipv6;
                     prefixLength = 64;
                   }
                 ];

modules/crans/users.nix

@@ -18,7 +18,7 @@ in
 
     root = {
       passwordFile = mkOption {
-        type = types.path;
+        type = types.externalPath;
         default = ../../secrets/common/root.age;
         example = ../../secrets/apprentix/root.age;
         description = "Fichier chiffré par age contenant le mot de passe root.";