Remove clanModules

.gitea/PULL_REQUEST_TEMPLATE.md

@@ -1,12 +0,0 @@
-## Description of the change
-
-<!-- Brief summary of the change if not already clear from the title -->
-
-## Checklist
-
-- [ ] Updated Documentation
-- [ ] Added tests
-- [ ] Doesn't affect backwards compatibility - or check the next points
-  - [ ] Add the breaking change and migration details to docs/release-notes.md
-  - !!! Review from another person is required *BEFORE* merge !!!
-- [ ] Add introduction of major feature to docs/release-notes.md

.gitea/workflows/build-clan-app-darwin.yml

@@ -1,20 +0,0 @@
-name: Build Clan App (Darwin)
-
-on:
-  schedule:
-    # Run every 4 hours
-    - cron: "0 */4 * * *"
-  workflow_dispatch:
-  push:
-    branches:
-      - main
-
-jobs:
-  build-clan-app-darwin:
-    runs-on: nix
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Build clan-app for x86_64-darwin
-        run: |
-          nix build .#packages.x86_64-darwin.clan-app --log-format bar-with-logs

.gitea/workflows/checks.yaml

@@ -0,0 +1,9 @@
+name: checks
+on:
+  pull_request:
+jobs:
+  checks-impure:
+    runs-on: nix
+    steps:
+      - uses: actions/checkout@v4
+      - run: nix run .#impure-checks

.gitea/workflows/create-pr.sh

@@ -1,7 +1,6 @@
-#!/bin/sh
+#!/usr/bin/env bash
-
 # Shared script for creating pull requests in Gitea workflows
-set -eu
+set -euo pipefail
 
 # Required environment variables:
 # - CI_BOT_TOKEN: Gitea bot token for authentication
@@ -9,22 +8,22 @@ set -eu
 # - PR_TITLE: Title of the pull request
 # - PR_BODY: Body/description of the pull request
 
-if [ -z "${CI_BOT_TOKEN:-}" ]; then
+if [[ -z "${CI_BOT_TOKEN:-}" ]]; then
   echo "Error: CI_BOT_TOKEN is not set" >&2
   exit 1
 fi
 
-if [ -z "${PR_BRANCH:-}" ]; then
+if [[ -z "${PR_BRANCH:-}" ]]; then
   echo "Error: PR_BRANCH is not set" >&2
   exit 1
 fi
 
-if [ -z "${PR_TITLE:-}" ]; then
+if [[ -z "${PR_TITLE:-}" ]]; then
   echo "Error: PR_TITLE is not set" >&2
   exit 1
 fi
 
-if [ -z "${PR_BODY:-}" ]; then
+if [[ -z "${PR_BODY:-}" ]]; then
   echo "Error: PR_BODY is not set" >&2
   exit 1
 fi
@@ -44,12 +43,9 @@ resp=$(nix run --inputs-from . nixpkgs#curl -- -X POST \
   }" \
   "https://git.clan.lol/api/v1/repos/clan/clan-core/pulls")
 
-if ! pr_number=$(echo "$resp" | jq -r '.number'); then
+pr_number=$(echo "$resp" | jq -r '.number')
-  echo "Error parsing response from pull request creation" >&2
-  exit 1
-fi
 
-if [ "$pr_number" = "null" ]; then
+if [[ "$pr_number" == "null" ]]; then
   echo "Error creating pull request:" >&2
   echo "$resp" | jq . >&2
   exit 1
@@ -68,11 +64,8 @@ while true; do
       "delete_branch_after_merge": true
     }' \
     "https://git.clan.lol/api/v1/repos/clan/clan-core/pulls/$pr_number/merge")
-  if ! msg=$(echo "$resp" | jq -r '.message'); then
+  msg=$(echo "$resp" | jq -r '.message')
-    echo "Error parsing merge response" >&2
+  if [[ "$msg" != "Please try again later" ]]; then
-    exit 1
-  fi
-  if [ "$msg" != "Please try again later" ]; then
     break
   fi
   echo "Retrying in 2 seconds..."

.gitea/workflows/deploy.yaml

@@ -8,6 +8,6 @@ jobs:
     runs-on: nix
     steps:
       - uses: actions/checkout@v4
-      - run: nix run --print-build-logs .#deploy-docs
+      - run: nix run .#deploy-docs
     env:
       SSH_HOMEPAGE_KEY: ${{ secrets.SSH_HOMEPAGE_KEY }}

.gitea/workflows/update-clan-core-for-checks.yml

@@ -0,0 +1,28 @@
+name: "Update pinned clan-core for checks"
+on:
+  repository_dispatch:
+  workflow_dispatch:
+  schedule:
+    - cron: "51 2 * * *"
+jobs:
+  update-pinned-clan-core:
+    runs-on: nix
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: true
+      - name: Update clan-core for checks
+        run: nix run .#update-clan-core-for-checks
+      - name: Create pull request
+        env:
+          CI_BOT_TOKEN: ${{ secrets.CI_BOT_TOKEN }}
+        run: |
+          export GIT_AUTHOR_NAME=clan-bot GIT_AUTHOR_EMAIL=clan-bot@clan.lol GIT_COMMITTER_NAME=clan-bot GIT_COMMITTER_EMAIL=clan-bot@clan.lol
+          git commit -am "Update pinned clan-core for checks"
+
+          # Use shared PR creation script
+          export PR_BRANCH="update-clan-core-for-checks"
+          export PR_TITLE="Update Clan Core for Checks"
+          export PR_BODY="This PR updates the pinned clan-core flake input that is used for checks."
+
+          ./.gitea/workflows/create-pr.sh

.gitea/workflows/update-flake-inputs.yml

@@ -19,11 +19,8 @@ jobs:
         uses: Mic92/update-flake-inputs-gitea@main
         with:
           # Exclude private flakes and update-clan-core checks flake
-          exclude-patterns: "checks/impure/flake.nix"
+
+          exclude-patterns: "devFlake/private/flake.nix,checks/impure/flake.nix"
           auto-merge: true
-          git-author-name: "clan-bot"
-          git-committer-name: "clan-bot"
-          git-author-email: "clan-bot@clan.lol"
-          git-committer-email: "clan-bot@clan.lol"
           gitea-token: ${{ secrets.CI_BOT_TOKEN }}
           github-token: ${{ secrets.CI_BOT_GITHUB_TOKEN }}

.gitea/workflows/update-private-flake-inputs.yml

@@ -0,0 +1,40 @@
+name: "Update private flake inputs"
+on:
+  repository_dispatch:
+  workflow_dispatch:
+  schedule:
+    - cron: "0 3 * * *" # Run daily at 3 AM
+jobs:
+  update-private-flake:
+    runs-on: nix
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: true
+      - name: Update private flake inputs
+        run: |
+          # Update the private flake lock file
+          cd devFlake/private
+          nix flake update
+          cd ../..
+
+          # Update the narHash
+          bash ./devFlake/update-private-narhash
+      - name: Create pull request
+        env:
+          CI_BOT_TOKEN: ${{ secrets.CI_BOT_TOKEN }}
+        run: |
+          export GIT_AUTHOR_NAME=clan-bot GIT_AUTHOR_EMAIL=clan-bot@clan.lol GIT_COMMITTER_NAME=clan-bot GIT_COMMITTER_EMAIL=clan-bot@clan.lol
+
+          # Check if there are any changes
+          if ! git diff --quiet; then
+            git add devFlake/private/flake.lock devFlake/private.narHash
+            git commit -m "Update dev flake"
+            
+            # Use shared PR creation script
+            export PR_BRANCH="update-dev-flake"
+            export PR_TITLE="Update dev flake"
+            export PR_BODY="This PR updates the dev flake inputs and corresponding narHash."
+          else
+            echo "No changes detected in dev flake inputs"
+          fi

.github/workflows/repo-sync.yml

@@ -10,7 +10,7 @@ jobs:
     if: github.repository_owner == 'clan-lol'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v4
         with:
           persist-credentials: false
       - uses: actions/create-github-app-token@v2

.gitignore

@@ -39,6 +39,7 @@ select
 # Generated files
 pkgs/clan-app/ui/api/API.json
 pkgs/clan-app/ui/api/API.ts
+pkgs/clan-app/ui/api/Inventory.ts
 pkgs/clan-app/ui/api/modules_schemas.json
 pkgs/clan-app/ui/api/schema.json
 pkgs/clan-app/ui/.fonts
@@ -52,5 +53,3 @@ pkgs/clan-app/ui/.fonts
 *.gif
 *.mp4
 *.mkv
-
-.jj

CODEOWNERS

@@ -1,22 +1,2 @@
-clanServices/.* @pinpox @kenji
+nixosModules/clanCore/vars/.* @lopter
-
+pkgs/clan-cli/clan_cli/(secrets|vars)/.* @lopter
-lib/test/container-test-driver/.* @DavHau @mic92
-lib/inventory/.* @hsjobeki
-lib/inventoryClass/.* @hsjobeki
-
-modules/.* @hsjobeki
-
-pkgs/clan-app/ui/.* @hsjobeki @brianmcgee
-pkgs/clan-app/clan_app/.* @qubasa @hsjobeki
-
-pkgs/clan-cli/clan_cli/.* @lassulus @mic92 @kenji
-pkgs/clan-cli/clan_cli/(secrets|vars)/.* @DavHau @lassulus
-
-pkgs/clan-cli/clan_lib/log_machines/.* @Qubasa
-pkgs/clan-cli/clan_lib/ssh/.* @Qubasa @Mic92 @lassulus
-pkgs/clan-cli/clan_lib/tags/.* @hsjobeki
-pkgs/clan-cli/clan_lib/persist/.* @hsjobeki
-pkgs/clan-cli/clan_lib/flake/.* @lassulus
-
-pkgs/clan-cli/api.py @hsjobeki
-pkgs/clan-cli/openapi.py @hsjobeki

CONTRIBUTING.md

@@ -0,0 +1,4 @@
+# Contributing to Clan
+
+<!-- Local file: docs/CONTRIBUTING.md -->
+Go to the Contributing guide at https://docs.clan.lol/guides/contributing/CONTRIBUTING

LICENSE.md

@@ -1,4 +1,4 @@
-Copyright 2023-2025 Clan contributors
+Copyright 2023-2024 Clan contributors
 
 Permission is hereby granted, free of charge, to any person obtaining a copy of
 this software and associated documentation files (the "Software"), to deal in

README.md

@@ -8,7 +8,7 @@ Our mission is simple: to democratize computing by providing tools that empower
 
 ## Features of Clan
 
-- **Full-Stack System Deployment:** Utilize Clan's toolkit alongside Nix's reliability to build and manage systems effortlessly.
+- **Full-Stack System Deployment:** Utilize Clan’s toolkit alongside Nix's reliability to build and manage systems effortlessly.
 - **Overlay Networks:** Secure, private communication channels between devices.
 - **Virtual Machine Integration:** Seamless operation of VM applications within the main operating system.
 - **Robust Backup Management:** Long-term, self-hosted data preservation.
@@ -24,13 +24,13 @@ If you're new to Clan and eager to dive in, start with our quickstart guide and
 
 In the Clan ecosystem, security is paramount. Learn how to handle secrets effectively:
 
-- **Secrets Management**: Securely manage secrets by consulting [Vars](https://docs.clan.lol/concepts/generators/)<!-- [secrets.md](docs/site/concepts/generators.md) -->.
+- **Secrets Management**: Securely manage secrets by consulting [secrets](https://docs.clan.lol/guides/getting-started/secrets/)<!-- [secrets.md](docs/site/guides/getting-started/secrets.md) -->.
 
 ### Contributing to Clan
 
 The Clan project thrives on community contributions. We welcome everyone to contribute and collaborate:
 
-- **Contribution Guidelines**: Make a meaningful impact by following the steps in [contributing](https://docs.clan.lol/guides/contributing/CONTRIBUTING/)<!-- [contributing.md](docs/CONTRIBUTING.md) -->.
+- **Contribution Guidelines**: Make a meaningful impact by following the steps in [contributing](https://docs.clan.lol/contributing/contributing/)<!-- [contributing.md](docs/CONTRIBUTING.md) -->.
 
 ## Join the revolution
 

checks/borgbackup-legacy/default.nix

@@ -0,0 +1,51 @@
+(
+  { ... }:
+  {
+    name = "borgbackup";
+
+    nodes.machine =
+      { self, pkgs, ... }:
+      {
+        imports = [
+          self.clanModules.borgbackup
+          self.nixosModules.clanCore
+          {
+            services.openssh.enable = true;
+            services.borgbackup.repos.testrepo = {
+              authorizedKeys = [ (builtins.readFile ../assets/ssh/pubkey) ];
+            };
+          }
+          {
+            clan.core.settings.directory = ./.;
+            clan.core.state.testState.folders = [ "/etc/state" ];
+            environment.etc.state.text = "hello world";
+            systemd.tmpfiles.settings."vmsecrets" = {
+              "/etc/secrets/borgbackup/borgbackup.ssh" = {
+                C.argument = "${../assets/ssh/privkey}";
+                z = {
+                  mode = "0400";
+                  user = "root";
+                };
+              };
+              "/etc/secrets/borgbackup/borgbackup.repokey" = {
+                C.argument = builtins.toString (pkgs.writeText "repokey" "repokey12345");
+                z = {
+                  mode = "0400";
+                  user = "root";
+                };
+              };
+            };
+            # clan.core.facts.secretStore = "vm";
+            clan.core.vars.settings.secretStore = "vm";
+
+            clan.borgbackup.destinations.test.repo = "borg@localhost:.";
+          }
+        ];
+      };
+    testScript = ''
+      start_all()
+      machine.systemctl("start --wait borgbackup-job-test.service")
+      assert "machine-test" in machine.succeed("BORG_UNKNOWN_UNENCRYPTED_REPO_ACCESS_IS_OK=yes /run/current-system/sw/bin/borg-job-test list")
+    '';
+  }
+)

checks/clan-core-for-checks.nix

@@ -0,0 +1,6 @@
+{ fetchgit }:
+fetchgit {
+  url = "https://git.clan.lol/clan/clan-core.git";
+  rev = "eea93ea22c9818da67e148ba586277bab9e73cea";
+  sha256 = "sha256-PV0Z+97QuxQbkYSVuNIJwUNXMbHZG/vhsA9M4cDTCOE=";
+}

checks/flake-module.nix

@@ -2,7 +2,6 @@
   self,
   lib,
   inputs,
-  privateInputs ? { },
   ...
 }:
 let
@@ -12,6 +11,7 @@ let
     elem
     filter
     filterAttrs
+    flip
     genAttrs
     hasPrefix
     pathExists
@@ -20,22 +20,21 @@ let
 in
 {
   imports = filter pathExists [
+    ./backups/flake-module.nix
+    ../nixosModules/clanCore/machine-id/tests/flake-module.nix
+    ../nixosModules/clanCore/state-version/tests/flake-module.nix
     ./devshell/flake-module.nix
     ./flash/flake-module.nix
+    ./impure/flake-module.nix
     ./installation/flake-module.nix
-    ./update/flake-module.nix
     ./morph/flake-module.nix
     ./nixos-documentation/flake-module.nix
     ./dont-depend-on-repo-root.nix
-    # clan core submodule tests
-    ../nixosModules/clanCore/machine-id/tests/flake-module.nix
-    ../nixosModules/clanCore/postgresql/tests/flake-module.nix
-    ../nixosModules/clanCore/state-version/tests/flake-module.nix
   ];
   flake.check = genAttrs [ "x86_64-linux" "aarch64-darwin" ] (
     system:
     let
-      checks = filterAttrs (
+      checks = flip filterAttrs self.checks.${system} (
         name: _check:
         !(hasPrefix "nixos-test-" name)
         && !(hasPrefix "nixos-" name)
@@ -47,7 +46,7 @@ in
           "clan-core-for-checks"
           "clan-deps"
         ])
-      ) self.checks.${system};
+      );
     in
     inputs.nixpkgs.legacyPackages.${system}.runCommand "fast-flake-checks-${system}"
       { passthru.checks = checks; }
@@ -86,11 +85,11 @@ in
 
             # Container Tests
             nixos-test-container = self.clanLib.test.containerTest ./container nixosTestArgs;
-            nixos-systemd-abstraction = self.clanLib.test.containerTest ./systemd-abstraction nixosTestArgs;
+            # nixos-test-zt-tcp-relay = self.clanLib.test.containerTest ./zt-tcp-relay nixosTestArgs;
-            nixos-llm-test = self.clanLib.test.containerTest ./llm nixosTestArgs;
+            # nixos-test-matrix-synapse = self.clanLib.test.containerTest ./matrix-synapse nixosTestArgs;
+            # nixos-test-postgresql = self.clanLib.test.containerTest ./postgresql nixosTestArgs;
             nixos-test-user-firewall-iptables = self.clanLib.test.containerTest ./user-firewall/iptables.nix nixosTestArgs;
             nixos-test-user-firewall-nftables = self.clanLib.test.containerTest ./user-firewall/nftables.nix nixosTestArgs;
-            nixos-test-extra-python-packages = self.clanLib.test.containerTest ./test-extra-python-packages nixosTestArgs;
 
             service-dummy-test = import ./service-dummy-test nixosTestArgs;
             service-dummy-test-from-flake = import ./service-dummy-test-from-flake nixosTestArgs;
@@ -102,8 +101,6 @@ in
             "dont-depend-on-repo-root"
           ];
 
-          # Temporary workaround: Filter out docs package and devshell for aarch64-darwin due to CI builder hangs
-          # TODO: Remove this filter once macOS CI builder is updated
           flakeOutputs =
             lib.mapAttrs' (
               name: config: lib.nameValuePair "nixos-${name}" config.config.system.build.toplevel
@@ -111,18 +108,8 @@ in
             // lib.mapAttrs' (
               name: config: lib.nameValuePair "darwin-${name}" config.config.system.build.toplevel
             ) (self.darwinConfigurations or { })
-            // lib.mapAttrs' (n: lib.nameValuePair "package-${n}") (
+            // lib.mapAttrs' (n: lib.nameValuePair "package-${n}") packagesToBuild
-              if system == "aarch64-darwin" then
+            // lib.mapAttrs' (n: lib.nameValuePair "devShell-${n}") self'.devShells
-                lib.filterAttrs (n: _: n != "docs" && n != "deploy-docs" && n != "option-search") packagesToBuild
-              else
-                packagesToBuild
-            )
-            // lib.mapAttrs' (n: lib.nameValuePair "devShell-${n}") (
-              if system == "aarch64-darwin" then
-                lib.filterAttrs (n: _: n != "docs") self'.devShells
-              else
-                self'.devShells
-            )
             // lib.mapAttrs' (name: config: lib.nameValuePair "home-manager-${name}" config.activation-script) (
               self'.legacyPackages.homeConfigurations or { }
             );
@@ -130,13 +117,37 @@ in
         nixosTests
         // flakeOutputs
         // {
-          clan-core-for-checks = pkgs.runCommand "clan-core-for-checks" { } ''
+          # TODO: Automatically provide this check to downstream users to check their modules
-            cp -r ${privateInputs.clan-core-for-checks} $out
+          clan-modules-json-compatible =
-            chmod -R +w $out
+            let
-            cp ${../flake.lock} $out/flake.lock
+              allSchemas = lib.mapAttrs (
+                _n: m:
+                let
+                  schema =
+                    (self.clanLib.evalService {
+                      modules = [ m ];
+                      prefix = [
+                        "checks"
+                        system
+                      ];
+                    }).config.result.api.schema;
+                in
+                schema
+              ) self.clan.modules;
+            in
+            pkgs.runCommand "combined-result"
+              {
+                schemaFile = builtins.toFile "schemas.json" (builtins.toJSON allSchemas);
+              }
+              ''
+                mkdir -p $out
+                cat $schemaFile > $out/allSchemas.json
+              '';
 
-            # Create marker file to disable private flake loading in tests
+          clan-core-for-checks = pkgs.runCommand "clan-core-for-checks" { } ''
-            touch $out/.skip-private-inputs
+            cp -r ${pkgs.callPackage ./clan-core-for-checks.nix { }} $out
+            chmod +w $out/flake.lock
+            cp ${../flake.lock} $out/flake.lock
           '';
         };
       packages = lib.optionalAttrs (pkgs.stdenv.isLinux) {

checks/flash/flake-module.nix

@@ -13,6 +13,8 @@
         fileSystems."/".device = lib.mkDefault "/dev/vda";
         boot.loader.grub.device = lib.mkDefault "/dev/vda";
 
+        # We need to use `mkForce` because we inherit from `test-install-machine`
+        # which currently hardcodes `nixpkgs.hostPlatform`
         nixpkgs.hostPlatform = lib.mkForce system;
 
         imports = [ self.nixosModules.test-flash-machine ];
@@ -26,24 +28,10 @@
       {
         imports = [ self.nixosModules.test-install-machine-without-system ];
 
-        # We don't want our system to define any `vars` generators as these can't
-        # be generated as the flake is inside `/nix/store`.
-        clan.core.settings.state-version.enable = false;
         clan.core.vars.generators.test = lib.mkForce { };
+
         disko.devices.disk.main.preCreateHook = lib.mkForce "";
-
-        # Every option here should match the options set through `clan flash write`
-        # if you get a mass rebuild on the disko derivation, this means you need to
-        # adjust something here. Also make sure that the injected json in clan flash write
-        # is up to date.
-        i18n.defaultLocale = "de_DE.UTF-8";
-        console.keyMap = "de";
-        services.xserver.xkb.layout = "de";
-        users.users.root.openssh.authorizedKeys.keys = [
-          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIRWUusawhlIorx7VFeQJHmMkhl9X3QpnvOdhnV/bQNG root@target\n"
-        ];
       };
-
   };
 
   perSystem =
@@ -56,31 +44,22 @@
       dependencies = [
         pkgs.disko
         pkgs.buildPackages.xorg.lndir
-        pkgs.glibcLocales
-        pkgs.kbd.out
         self.nixosConfigurations."test-flash-machine-${pkgs.hostPlatform.system}".pkgs.perlPackages.ConfigIniFiles
         self.nixosConfigurations."test-flash-machine-${pkgs.hostPlatform.system}".pkgs.perlPackages.FileSlurp
-        pkgs.bubblewrap
 
         self.nixosConfigurations."test-flash-machine-${pkgs.hostPlatform.system}".config.system.build.toplevel
         self.nixosConfigurations."test-flash-machine-${pkgs.hostPlatform.system}".config.system.build.diskoScript
         self.nixosConfigurations."test-flash-machine-${pkgs.hostPlatform.system}".config.system.build.diskoScript.drvPath
-      ]
+      ] ++ builtins.map (i: i.outPath) (builtins.attrValues self.inputs);
-      ++ builtins.map (i: i.outPath) (builtins.attrValues self.inputs);
       closureInfo = pkgs.closureInfo { rootPaths = dependencies; };
     in
     {
-      # Skip flash test on aarch64-linux for now as it's too slow
+      checks = pkgs.lib.mkIf pkgs.stdenv.isLinux {
-      checks = lib.optionalAttrs (pkgs.stdenv.isLinux && pkgs.hostPlatform.system != "aarch64-linux") {
         nixos-test-flash = self.clanLib.test.baseTest {
           name = "flash";
           nodes.target = {
             virtualisation.emptyDiskImages = [ 4096 ];
             virtualisation.memorySize = 4096;
-
-            virtualisation.useNixStoreImage = true;
-            virtualisation.writableStore = true;
-
             environment.systemPackages = [ self.packages.${pkgs.system}.clan-cli ];
             environment.etc."install-closure".source = "${closureInfo}/store-paths";
 
@@ -88,7 +67,7 @@
               substituters = lib.mkForce [ ];
               hashed-mirrors = null;
               connect-timeout = lib.mkForce 3;
-              flake-registry = "";
+              flake-registry = pkgs.writeText "flake-registry" ''{"flakes":[],"version":2}'';
               experimental-features = [
                 "nix-command"
                 "flakes"
@@ -97,10 +76,10 @@
           };
           testScript = ''
             start_all()
-            machine.succeed("echo 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIRWUusawhlIorx7VFeQJHmMkhl9X3QpnvOdhnV/bQNG root@target' > ./test_id_ed25519.pub")
+
             # Some distros like to automount disks with spaces
-            machine.succeed('mkdir -p "/mnt/with spaces" && mkfs.ext4 /dev/vdc && mount /dev/vdc "/mnt/with spaces"')
+            machine.succeed('mkdir -p "/mnt/with spaces" && mkfs.ext4 /dev/vdb && mount /dev/vdb "/mnt/with spaces"')
-            machine.succeed("clan flash write --ssh-pubkey ./test_id_ed25519.pub --keymap de --language de_DE.UTF-8 --debug --flake ${self.checks.x86_64-linux.clan-core-for-checks} --yes --disk main /dev/vdc test-flash-machine-${pkgs.hostPlatform.system}")
+            machine.succeed("clan flash write --debug --flake ${self.checks.x86_64-linux.clan-core-for-checks} --yes --disk main /dev/vdb test-flash-machine-${pkgs.hostPlatform.system}")
           '';
         } { inherit pkgs self; };
       };

checks/impure/flake-module.nix

@@ -0,0 +1,51 @@
+{
+  perSystem =
+    {
+      pkgs,
+      lib,
+      self',
+      ...
+    }:
+    {
+      # a script that executes all other checks
+      packages.impure-checks = pkgs.writeShellScriptBin "impure-checks" ''
+        #!${pkgs.bash}/bin/bash
+        set -euo pipefail
+
+        unset CLAN_DIR
+
+        export PATH="${
+          lib.makeBinPath (
+            [
+              pkgs.gitMinimal
+              pkgs.nix
+              pkgs.coreutils
+              pkgs.rsync # needed to have rsync installed on the dummy ssh server
+            ]
+            ++ self'.packages.clan-cli-full.runtimeDependencies
+          )
+        }"
+        ROOT=$(git rev-parse --show-toplevel)
+        cd "$ROOT/pkgs/clan-cli"
+
+        # Set up custom git configuration for tests
+        export GIT_CONFIG_GLOBAL=$(mktemp)
+        git config --file "$GIT_CONFIG_GLOBAL" user.name "Test User"
+        git config --file "$GIT_CONFIG_GLOBAL" user.email "test@example.com"
+        export GIT_CONFIG_SYSTEM=/dev/null
+
+        # this disables dynamic dependency loading in clan-cli
+        export CLAN_NO_DYNAMIC_DEPS=1
+
+        jobs=$(nproc)
+        # Spawning worker in pytest is relatively slow, so we limit the number of jobs to 13
+        # (current number of impure tests)
+        jobs="$((jobs > 13 ? 13 : jobs))"
+
+        nix develop "$ROOT#clan-cli" -c bash -c "TMPDIR=/tmp python -m pytest -n $jobs -m impure ./clan_cli $@"
+
+        # Clean up temporary git config
+        rm -f "$GIT_CONFIG_GLOBAL"
+      '';
+    };
+}

checks/installation/flake-module.nix

@@ -1,8 +1,7 @@
 {
-  config,
   self,
   lib,
-  privateInputs,
+
   ...
 }:
 {
@@ -14,38 +13,31 @@
   # you can get a new one by adding
   # client.fail("cat test-flake/machines/test-install-machine/facter.json >&2")
   # to the installation test.
-  clan.machines = {
+  clan.machines.test-install-machine-without-system = {
-    test-install-machine-without-system = {
     fileSystems."/".device = lib.mkDefault "/dev/vda";
     boot.loader.grub.device = lib.mkDefault "/dev/vda";
 
-      imports = [
+    imports = [ self.nixosModules.test-install-machine-without-system ];
-        self.nixosModules.test-install-machine-without-system
-      ];
   };
-  }
+  clan.machines.test-install-machine-with-system =
-  // (lib.listToAttrs (
+    { pkgs, ... }:
-    lib.map (
-      system:
-      lib.nameValuePair "test-install-machine-${system}" {
-        imports = [
-          self.nixosModules.test-install-machine-without-system
-          (
-            if privateInputs ? test-fixtures then
     {
-                facter.reportPath = privateInputs.test-fixtures + /nixos-vm-facter-json/${system}.json;
+      # https://git.clan.lol/clan/test-fixtures
+      facter.reportPath = builtins.fetchurl {
+        url = "https://git.clan.lol/clan/test-fixtures/raw/commit/4a2bc56d886578124b05060d3fb7eddc38c019f8/nixos-vm-facter-json/${pkgs.hostPlatform.system}.json";
+        sha256 =
+          {
+            aarch64-linux = "sha256:1rlfymk03rmfkm2qgrc8l5kj5i20srx79n1y1h4nzlpwaz0j7hh2";
+            x86_64-linux = "sha256:16myh0ll2gdwsiwkjw5ba4dl23ppwbsanxx214863j7nvzx42pws";
           }
-            else
+          .${pkgs.hostPlatform.system};
-              { nixpkgs.hostPlatform = system; }
+      };
-          )
-        ];
 
       fileSystems."/".device = lib.mkDefault "/dev/vda";
       boot.loader.grub.device = lib.mkDefault "/dev/vda";
-      }
-    ) (lib.filter (lib.hasSuffix "linux") config.systems)
-  ));
 
+      imports = [ self.nixosModules.test-install-machine-without-system ];
+    };
   flake.nixosModules = {
     test-install-machine-without-system =
       { lib, modulesPath, ... }:
@@ -157,17 +149,17 @@
       # vm-test-run-test-installation-> target:   To debug, enter the VM and run 'systemctl status backdoor.service'.
       checks =
         let
+          # Custom Python package for port management utilities
           closureInfo = pkgs.closureInfo {
             rootPaths = [
-              privateInputs.clan-core-for-checks
+              self.checks.x86_64-linux.clan-core-for-checks
-              self.nixosConfigurations."test-install-machine-${pkgs.hostPlatform.system}".config.system.build.toplevel
+              self.clanInternals.machines.${pkgs.hostPlatform.system}.test-install-machine-with-system.config.system.build.toplevel
-              self.nixosConfigurations."test-install-machine-${pkgs.hostPlatform.system}".config.system.build.initialRamdisk
+              self.clanInternals.machines.${pkgs.hostPlatform.system}.test-install-machine-with-system.config.system.build.initialRamdisk
-              self.nixosConfigurations."test-install-machine-${pkgs.hostPlatform.system}".config.system.build.diskoScript
+              self.clanInternals.machines.${pkgs.hostPlatform.system}.test-install-machine-with-system.config.system.build.diskoScript
               pkgs.stdenv.drvPath
               pkgs.bash.drvPath
               pkgs.buildPackages.xorg.lndir
-            ]
+            ] ++ builtins.map (i: i.outPath) (builtins.attrValues self.inputs);
-            ++ builtins.map (i: i.outPath) (builtins.attrValues self.inputs);
           };
         in
         pkgs.lib.mkIf (pkgs.stdenv.isLinux && !pkgs.stdenv.isAarch64) {
@@ -215,7 +207,7 @@
                   # Prepare test flake and Nix store
                   flake_dir = prepare_test_flake(
                       temp_dir,
-                      "${self.checks.${pkgs.hostPlatform.system}.clan-core-for-checks}",
+                      "${self.checks.x86_64-linux.clan-core-for-checks}",
                       "${closureInfo}"
                   )
 
@@ -226,22 +218,6 @@
                       "${../assets/ssh/privkey}"
                   )
 
-                  # Run clan install from host using port forwarding
-                  clan_cmd = [
-                      "${self.packages.${pkgs.system}.clan-cli-full}/bin/clan",
-                      "machines",
-                      "init-hardware-config",
-                      "--debug",
-                      "--flake", str(flake_dir),
-                      "--yes", "test-install-machine-without-system",
-                      "--host-key-check", "none",
-                      "--target-host", f"nonrootuser@localhost:{ssh_conn.host_port}",
-                      "-i", ssh_conn.ssh_key,
-                      "--option", "store", os.environ['CLAN_TEST_STORE']
-                  ]
-                  subprocess.run(clan_cmd, check=True)
-
-
                   # Run clan install from host using port forwarding
                   clan_cmd = [
                       "${self.packages.${pkgs.system}.clan-cli-full}/bin/clan",
@@ -249,13 +225,12 @@
                       "install",
                       "--phases", "disko,install",
                       "--debug",
-                      "--flake", str(flake_dir),
+                      "--flake", flake_dir,
                       "--yes", "test-install-machine-without-system",
                       "--target-host", f"nonrootuser@localhost:{ssh_conn.host_port}",
                       "-i", ssh_conn.ssh_key,
                       "--option", "store", os.environ['CLAN_TEST_STORE'],
                       "--update-hardware-config", "nixos-facter",
-                      "--no-persist-state",
                   ]
 
                   subprocess.run(clan_cmd, check=True)
@@ -265,7 +240,7 @@
                   target.shutdown()
               except BrokenPipeError:
                   # qemu has already exited
-                  target.connected = False
+                  pass
 
               # Create a new machine instance that boots from the installed system
               installed_machine = create_test_machine(target, "${pkgs.qemu_test}", name="after_install")
@@ -296,7 +271,7 @@
                   # Prepare test flake and Nix store
                   flake_dir = prepare_test_flake(
                       temp_dir,
-                      "${self.checks.${pkgs.hostPlatform.system}.clan-core-for-checks}",
+                      "${self.checks.x86_64-linux.clan-core-for-checks}",
                       "${closureInfo}"
                   )
                   
@@ -314,6 +289,9 @@
                   assert not os.path.exists(hw_config_file), "hardware-configuration.nix should not exist initially"
                   assert not os.path.exists(facter_file), "facter.json should not exist initially"
 
+                  # Set CLAN_FLAKE for the commands
+                  os.environ["CLAN_FLAKE"] = flake_dir
+
                   # Test facter backend
                   clan_cmd = [
                       "${self.packages.${pkgs.system}.clan-cli-full}/bin/clan",
@@ -325,8 +303,7 @@
                       "test-install-machine-without-system",
                       "-i", ssh_conn.ssh_key,
                       "--option", "store", os.environ['CLAN_TEST_STORE'],
-                      "--target-host", f"nonrootuser@localhost:{ssh_conn.host_port}",
+                      f"nonrootuser@localhost:{ssh_conn.host_port}"
-                      "--yes"
                   ]
 
                   result = subprocess.run(clan_cmd, capture_output=True, cwd=flake_dir)
@@ -350,9 +327,7 @@
                       "test-install-machine-without-system",
                       "-i", ssh_conn.ssh_key,
                       "--option", "store", os.environ['CLAN_TEST_STORE'],
-                      "--target-host",
+                      f"nonrootuser@localhost:{ssh_conn.host_port}"
-                      f"nonrootuser@localhost:{ssh_conn.host_port}",
-                      "--yes"
                   ]
 
                   result = subprocess.run(clan_cmd, capture_output=True, cwd=flake_dir)

checks/installation/test-helpers.nix

@@ -15,6 +15,7 @@ let
       networking.useNetworkd = true;
       services.openssh.enable = true;
       services.openssh.settings.UseDns = false;
+      services.openssh.settings.PasswordAuthentication = false;
       system.nixos.variant_id = "installer";
       environment.systemPackages = [
         pkgs.nixos-facter
@@ -146,11 +147,27 @@ let
     ];
     doCheck = false;
   };
+
+  # Common closure info
+  closureInfo = pkgs.closureInfo {
+    rootPaths = [
+      self.checks.x86_64-linux.clan-core-for-checks
+      self.clanInternals.machines.${pkgs.hostPlatform.system}.test-install-machine-with-system.config.system.build.toplevel
+      self.clanInternals.machines.${pkgs.hostPlatform.system}.test-install-machine-with-system.config.system.build.initialRamdisk
+      self.clanInternals.machines.${pkgs.hostPlatform.system}.test-install-machine-with-system.config.system.build.diskoScript
+      self.clanInternals.machines.${pkgs.hostPlatform.system}.test-install-machine-with-system.config.system.clan.deployment.file
+      pkgs.stdenv.drvPath
+      pkgs.bash.drvPath
+      pkgs.buildPackages.xorg.lndir
+    ] ++ builtins.map (i: i.outPath) (builtins.attrValues self.inputs);
+  };
+
 in
 {
   inherit
     target
     baseTestMachine
     nixosTestLib
+    closureInfo
     ;
 }

checks/llm/default.nix

@@ -1,82 +0,0 @@
-{ self, pkgs, ... }:
-
-let
-
-  cli = self.packages.${pkgs.hostPlatform.system}.clan-cli-full;
-
-  ollama-model = pkgs.callPackage ./qwen3-4b-instruct.nix { };
-in
-{
-  name = "llm";
-
-  nodes = {
-    peer1 =
-      { pkgs, ... }:
-      {
-
-        users.users.text-user = {
-          isNormalUser = true;
-          linger = true;
-          uid = 1000;
-          extraGroups = [ "systemd-journal" ];
-        };
-
-        # Set environment variables for user systemd
-        environment.extraInit = ''
-          if [ "$(id -u)" = "1000" ]; then
-            export XDG_RUNTIME_DIR="/run/user/1000"
-            export DBUS_SESSION_BUS_ADDRESS="unix:path=/run/user/1000/bus"
-
-            ollama_dir="$HOME/.ollama"
-            mkdir -p "$ollama_dir"
-            ln -sf ${ollama-model}/models "$ollama_dir"/models
-          fi
-        '';
-
-        # Enable PAM for user systemd sessions
-        security.pam.services.systemd-user = {
-          startSession = true;
-          # Workaround for containers - use pam_permit to avoid helper binary issues
-          text = pkgs.lib.mkForce ''
-            account required pam_permit.so
-            session required pam_permit.so
-            session required pam_env.so conffile=/etc/pam/environment readenv=0
-            session required ${pkgs.systemd}/lib/security/pam_systemd.so
-          '';
-        };
-
-        environment.systemPackages = [
-          cli
-          pkgs.ollama
-          (cli.pythonRuntime.withPackages (
-            ps: with ps; [
-              pytest
-              pytest-xdist
-              (cli.pythonRuntime.pkgs.toPythonModule cli)
-              self.legacyPackages.${pkgs.hostPlatform.system}.nixosTestLib
-            ]
-          ))
-        ];
-      };
-  };
-
-  testScript =
-    { ... }:
-    ''
-      start_all()
-
-      peer1.wait_for_unit("multi-user.target")
-      peer1.wait_for_unit("user@1000.service")
-
-      # Fix user journal permissions so text-user can read their own logs
-      peer1.succeed("chown text-user:systemd-journal /var/log/journal/*/user-1000.journal*")
-      peer1.succeed("chmod 640 /var/log/journal/*/user-1000.journal*")
-      # the -o adopts="" is needed to overwrite any args coming from pyproject.toml
-      # -p no:cacheprovider disables pytest's cacheprovider which tries to write to the nix store in this case
-      cmd = "su - text-user -c 'pytest -s -n0 -m service_runner -p no:cacheprovider -o addopts="" ${cli.passthru.sourceWithTests}/clan_lib/llm'"
-      print("Running tests with command: " + cmd)
-
-      # Run tests as text-user (environment variables are set automatically)
-      peer1.succeed(cmd)
-    '';
-}

checks/llm/qwen3-4b-instruct.nix

@@ -1,70 +0,0 @@
-{ pkgs }:
-
-let
-  # Got them from https://github.com/Gholamrezadar/ollama-direct-downloader
-
-  # Download manifest
-  manifest = pkgs.fetchurl {
-    url = "https://registry.ollama.ai/v2/library/qwen3/manifests/4b-instruct";
-    # You'll need to calculate this hash - run the derivation once and it will tell you the correct hash
-    hash = "sha256-Dtze80WT6sGqK+nH0GxDLc+BlFrcpeyi8nZiwY8Wi6A=";
-  };
-
-  # Download blobs
-  blob1 = pkgs.fetchurl {
-    url = "https://registry.ollama.ai/v2/library/qwen3/blobs/sha256:b72accf9724e93698c57cbd3b1af2d3341b3d05ec2089d86d273d97964853cd2";
-    hash = "sha256-tyrM+XJOk2mMV8vTsa8tM0Gz0F7CCJ2G0nPZeWSFPNI=";
-  };
-
-  blob2 = pkgs.fetchurl {
-    url = "https://registry.ollama.ai/v2/library/qwen3/blobs/sha256:85e4a5b7b8ef0e48af0e8658f5aaab9c2324c76c1641493f4d1e25fce54b18b9";
-    hash = "sha256-heSlt7jvDkivDoZY9aqrnCMkx2wWQUk/TR4l/OVLGLk=";
-  };
-
-  blob3 = pkgs.fetchurl {
-    url = "https://registry.ollama.ai/v2/library/qwen3/blobs/sha256:eade0a07cac7712787bbce23d12f9306adb4781d873d1df6e16f7840fa37afec";
-    hash = "sha256-6t4KB8rHcSeHu84j0S+TBq20eB2HPR324W94QPo3r+w=";
-  };
-
-  blob4 = pkgs.fetchurl {
-    url = "https://registry.ollama.ai/v2/library/qwen3/blobs/sha256:d18a5cc71b84bc4af394a31116bd3932b42241de70c77d2b76d69a314ec8aa12";
-    hash = "sha256-0YpcxxuEvErzlKMRFr05MrQiQd5wx30rdtaaMU7IqhI=";
-  };
-
-  blob5 = pkgs.fetchurl {
-    url = "https://registry.ollama.ai/v2/library/qwen3/blobs/sha256:0914c7781e001948488d937994217538375b4fd8c1466c5e7a625221abd3ea7a";
-    hash = "sha256-CRTHeB4AGUhIjZN5lCF1ODdbT9jBRmxeemJSIavT6no=";
-  };
-in
-pkgs.stdenv.mkDerivation {
-  pname = "ollama-qwen3-4b-instruct";
-  version = "1.0";
-
-  dontUnpack = true;
-
-  buildPhase = ''
-    mkdir -p $out/models/manifests/registry.ollama.ai/library/qwen3
-    mkdir -p $out/models/blobs
-
-    # Copy manifest
-    cp ${manifest} $out/models/manifests/registry.ollama.ai/library/qwen3/4b-instruct
-
-    # Copy blobs with correct names
-    cp ${blob1} $out/models/blobs/sha256-b72accf9724e93698c57cbd3b1af2d3341b3d05ec2089d86d273d97964853cd2
-    cp ${blob2} $out/models/blobs/sha256-85e4a5b7b8ef0e48af0e8658f5aaab9c2324c76c1641493f4d1e25fce54b18b9
-    cp ${blob3} $out/models/blobs/sha256-eade0a07cac7712787bbce23d12f9306adb4781d873d1df6e16f7840fa37afec
-    cp ${blob4} $out/models/blobs/sha256-d18a5cc71b84bc4af394a31116bd3932b42241de70c77d2b76d69a314ec8aa12
-    cp ${blob5} $out/models/blobs/sha256-0914c7781e001948488d937994217538375b4fd8c1466c5e7a625221abd3ea7a
-  '';
-
-  installPhase = ''
-    # buildPhase already created everything in $out
-    :
-  '';
-
-  meta = with pkgs.lib; {
-    description = "Qwen3 4B Instruct model for Ollama";
-    license = "apache-2.0";
-    platforms = platforms.all;
-  };
-}

checks/matrix-synapse/default.nix

@@ -0,0 +1,83 @@
+(
+  { pkgs, ... }:
+  {
+    name = "matrix-synapse";
+
+    nodes.machine =
+      {
+        config,
+        self,
+        lib,
+        ...
+      }:
+      {
+        imports = [
+          self.clanModules.matrix-synapse
+          self.nixosModules.clanCore
+          {
+            clan.core.settings.directory = ./.;
+
+            services.nginx.virtualHosts."matrix.clan.test" = {
+              enableACME = lib.mkForce false;
+              forceSSL = lib.mkForce false;
+            };
+            clan.nginx.acme.email = "admins@clan.lol";
+            clan.matrix-synapse = {
+              server_tld = "clan.test";
+              app_domain = "matrix.clan.test";
+            };
+            clan.matrix-synapse.users.admin.admin = true;
+            clan.matrix-synapse.users.someuser = { };
+
+            clan.core.facts.secretStore = "vm";
+            clan.core.vars.settings.secretStore = "vm";
+            clan.core.vars.settings.publicStore = "in_repo";
+
+            # because we use systemd-tmpfiles to copy the secrets, we need to a separate systemd-tmpfiles call to provision them.
+            boot.postBootCommands = "${config.systemd.package}/bin/systemd-tmpfiles --create /etc/tmpfiles.d/00-vmsecrets.conf";
+
+            systemd.tmpfiles.settings."00-vmsecrets" = {
+              # run before 00-nixos.conf
+              "/etc/secrets" = {
+                d.mode = "0700";
+                z.mode = "0700";
+              };
+              "/etc/secrets/matrix-synapse/synapse-registration_shared_secret" = {
+                f.argument = "supersecret";
+                z = {
+                  mode = "0400";
+                  user = "root";
+                };
+              };
+              "/etc/secrets/matrix-password-admin/matrix-password-admin" = {
+                f.argument = "matrix-password1";
+                z = {
+                  mode = "0400";
+                  user = "root";
+                };
+              };
+              "/etc/secrets/matrix-password-someuser/matrix-password-someuser" = {
+                f.argument = "matrix-password2";
+                z = {
+                  mode = "0400";
+                  user = "root";
+                };
+              };
+            };
+          }
+        ];
+      };
+    testScript = ''
+      start_all()
+      machine.wait_for_unit("matrix-synapse")
+      machine.succeed("${pkgs.netcat}/bin/nc -z -v ::1 8008")
+      machine.wait_until_succeeds("${pkgs.curl}/bin/curl -Ssf -L http://localhost/_matrix/static/ -H 'Host: matrix.clan.test'")
+
+      machine.systemctl("restart matrix-synapse >&2") # check if user creation is idempotent
+      machine.execute("journalctl -u matrix-synapse --no-pager >&2")
+      machine.wait_for_unit("matrix-synapse")
+      machine.succeed("${pkgs.netcat}/bin/nc -z -v ::1 8008")
+      machine.succeed("${pkgs.curl}/bin/curl -Ssf -L http://localhost/_matrix/static/ -H 'Host: matrix.clan.test'")
+    '';
+  }
+)

checks/matrix-synapse/synapse-registration_shared_secret

@@ -0,0 +1 @@
+registration_shared_secret: supersecret

checks/morph/flake-module.nix

@@ -35,8 +35,7 @@
                   pkgs.stdenv.drvPath
                   pkgs.stdenvNoCC
                   self.nixosConfigurations.test-morph-machine.config.system.build.toplevel
-                ]
+                ] ++ builtins.map (i: i.outPath) (builtins.attrValues self.inputs);
-                ++ builtins.map (i: i.outPath) (builtins.attrValues self.inputs);
                 closureInfo = pkgs.closureInfo { rootPaths = dependencies; };
               in
 

checks/postgresql/default.nix

@@ -0,0 +1,73 @@
+({
+  name = "postgresql";
+
+  nodes.machine =
+    { self, config, ... }:
+    {
+      imports = [
+        self.nixosModules.clanCore
+        self.clanModules.postgresql
+        self.clanModules.localbackup
+      ];
+      clan.postgresql.users.test = { };
+      clan.postgresql.databases.test.create.options.OWNER = "test";
+      clan.postgresql.databases.test.restore.stopOnRestore = [ "sample-service" ];
+      clan.localbackup.targets.hdd.directory = "/mnt/external-disk";
+      clan.core.settings.directory = ./.;
+
+      systemd.services.sample-service = {
+        wantedBy = [ "multi-user.target" ];
+        script = ''
+          while true; do
+            echo "Hello, world!"
+            sleep 5
+          done
+        '';
+      };
+
+      environment.systemPackages = [ config.services.postgresql.package ];
+    };
+  testScript =
+    { nodes, ... }:
+    ''
+      start_all()
+      machine.wait_for_unit("postgresql")
+      machine.wait_for_unit("sample-service")
+      # Create a test table
+      machine.succeed("runuser -u postgres -- /run/current-system/sw/bin/psql -c 'CREATE TABLE test (id serial PRIMARY KEY);' test")
+
+      machine.succeed("/run/current-system/sw/bin/localbackup-create >&2")
+      timestamp_before = int(machine.succeed("systemctl show --property=ExecMainStartTimestampMonotonic sample-service | cut -d= -f2").strip())
+
+      machine.succeed("test -e /mnt/external-disk/snapshot.0/machine/var/backup/postgres/test/pg-dump || { echo 'pg-dump not found'; exit 1; }")
+      machine.succeed("runuser -u postgres -- /run/current-system/sw/bin/psql -d test -c 'INSERT INTO test DEFAULT VALUES;'")
+      machine.succeed("runuser -u postgres -- /run/current-system/sw/bin/psql -d test -c 'DROP TABLE test;'")
+      machine.succeed("test -e /var/backup/postgres/test/pg-dump || { echo 'pg-dump not found'; exit 1; }")
+
+      machine.succeed("rm -rf /var/backup/postgres")
+
+      machine.succeed("NAME=/mnt/external-disk/snapshot.0 FOLDERS=/var/backup/postgres/test /run/current-system/sw/bin/localbackup-restore >&2")
+      machine.succeed("test -e /var/backup/postgres/test/pg-dump || { echo 'pg-dump not found'; exit 1; }")
+
+      machine.succeed("""
+      set -x
+      ${nodes.machine.clan.core.state.test.postRestoreCommand}
+      """)
+      machine.succeed("runuser -u postgres -- /run/current-system/sw/bin/psql -l >&2")
+      machine.succeed("runuser -u postgres -- /run/current-system/sw/bin/psql -d test -c '\dt' >&2")
+
+      timestamp_after = int(machine.succeed("systemctl show --property=ExecMainStartTimestampMonotonic sample-service | cut -d= -f2").strip())
+      assert timestamp_before < timestamp_after, f"{timestamp_before} >= {timestamp_after}: expected sample-service to be restarted after restore"
+
+      # Check that the table is still there
+      machine.succeed("runuser -u postgres -- /run/current-system/sw/bin/psql -d test -c 'SELECT * FROM test;'")
+      output = machine.succeed("runuser -u postgres -- /run/current-system/sw/bin/psql --csv -c \"SELECT datdba::regrole FROM pg_database WHERE datname = 'test'\"")
+      owner = output.split("\n")[1]
+      assert owner == "test", f"Expected database owner to be 'test', got '{owner}'"
+
+      # check if restore works if the database does not exist
+      machine.succeed("runuser -u postgres -- dropdb test")
+      machine.succeed("${nodes.machine.clan.core.state.test.postRestoreCommand}")
+      machine.succeed("runuser -u postgres -- /run/current-system/sw/bin/psql -d test -c '\dt' >&2")
+    '';
+})

checks/service-dummy-test-from-flake/default.nix

@@ -28,12 +28,18 @@ nixosLib.runTest (
     testScript =
       { nodes, ... }:
       ''
-        import subprocess
+        from nixos_test_lib.nix_setup import setup_nix_in_nix # type: ignore[import-untyped]
-        import tempfile
+        setup_nix_in_nix(None)  # No closure info for this test
-        from nixos_test_lib.nix_setup import setup_nix_in_nix
 
-        with tempfile.TemporaryDirectory() as temp_dir:
+        def run_clan(cmd: list[str], **kwargs) -> str:
-          setup_nix_in_nix(temp_dir, None)  # No closure info for this test
+            import subprocess
+            clan = "${clan-core.packages.${hostPkgs.system}.clan-cli}/bin/clan"
+            clan_args = ["--flake", "${config.clan.test.flakeForSandbox}"]
+            return subprocess.run(
+                ["${hostPkgs.util-linux}/bin/unshare", "--user", "--map-user", "1000", "--map-group", "1000", clan, *cmd, *clan_args],
+                **kwargs,
+                check=True,
+            ).stdout
 
         start_all()
         admin1.wait_for_unit("multi-user.target")
@@ -50,13 +56,7 @@ nixosLib.runTest (
         # Check that the file is in the '0644' mode
         assert "-rw-r--r--" in ls_out, f"File is not in the '0644' mode: {ls_out}"
 
-          # Run clan command
+        run_clan(["machines", "list"])
-          result = subprocess.run(
-              ["${
-                clan-core.packages.${hostPkgs.system}.clan-cli
-              }/bin/clan", "machines", "list", "--flake", "${config.clan.test.flakeForSandbox}"],
-              check=True
-          )
       '';
   }
 )

checks/service-dummy-test-from-flake/flake.nix

@@ -27,10 +27,7 @@
         modules.new-service = {
           _class = "clan.service";
           manifest.name = "new-service";
-          manifest.readme = "Just a sample readme to not trigger the warning.";
+          roles.peer = { };
-          roles.peer = {
-            description = "A peer that uses the new-service to generate some files.";
-          };
           perMachine = {
             nixosModule = {
               # This should be generated by:

checks/service-dummy-test/default.nix

@@ -34,10 +34,7 @@ nixosLib.runTest (
       modules.new-service = {
         _class = "clan.service";
         manifest.name = "new-service";
-        manifest.readme = "Just a sample readme to not trigger the warning.";
+        roles.peer = { };
-        roles.peer = {
-          description = "A peer that uses the new-service to generate some files.";
-        };
         perMachine = {
           nixosModule = {
             # This should be generated by:

checks/systemd-abstraction/default.nix

@@ -1,67 +0,0 @@
-{ self, pkgs, ... }:
-
-let
-
-  cli = self.packages.${pkgs.hostPlatform.system}.clan-cli-full;
-in
-{
-  name = "systemd-abstraction";
-
-  nodes = {
-    peer1 = {
-
-      users.users.text-user = {
-        isNormalUser = true;
-        linger = true;
-        uid = 1000;
-        extraGroups = [ "systemd-journal" ];
-      };
-
-      # Set environment variables for user systemd
-      environment.extraInit = ''
-        if [ "$(id -u)" = "1000" ]; then
-          export XDG_RUNTIME_DIR="/run/user/1000"
-          export DBUS_SESSION_BUS_ADDRESS="unix:path=/run/user/1000/bus"
-        fi
-      '';
-
-      # Enable PAM for user systemd sessions
-      security.pam.services.systemd-user = {
-        startSession = true;
-        # Workaround for containers - use pam_permit to avoid helper binary issues
-        text = pkgs.lib.mkForce ''
-          account required pam_permit.so
-          session required pam_permit.so
-          session required pam_env.so conffile=/etc/pam/environment readenv=0
-          session required ${pkgs.systemd}/lib/security/pam_systemd.so
-        '';
-      };
-
-      environment.systemPackages = [
-        cli
-        (cli.pythonRuntime.withPackages (
-          ps: with ps; [
-            pytest
-            pytest-xdist
-          ]
-        ))
-      ];
-    };
-  };
-
-  testScript =
-    { ... }:
-    ''
-      start_all()
-
-      peer1.wait_for_unit("multi-user.target")
-      peer1.wait_for_unit("user@1000.service")
-
-      # Fix user journal permissions so text-user can read their own logs
-      peer1.succeed("chown text-user:systemd-journal /var/log/journal/*/user-1000.journal*")
-      peer1.succeed("chmod 640 /var/log/journal/*/user-1000.journal*")
-
-      # Run tests as text-user (environment variables are set automatically)
-      peer1.succeed("su - text-user -c 'pytest -p no:cacheprovider -o addopts="" -s -n0 ${cli.passthru.sourceWithTests}/clan_lib/service_runner'")
-    '';
-}

checks/test-extra-python-packages/default.nix

@@ -1,26 +0,0 @@
-(
-  { ... }:
-  {
-    name = "test-extra-python-packages";
-
-    extraPythonPackages = ps: [ ps.numpy ];
-
-    nodes.machine =
-      { ... }:
-      {
-        networking.hostName = "machine";
-      };
-
-    testScript = ''
-      import numpy as np
-
-      start_all()
-      machine.wait_for_unit("multi-user.target")
-
-      # Test availability of numpy
-      arr = np.array([1, 2, 3])
-      print(f"Numpy array: {arr}")
-      assert len(arr) == 3
-    '';
-  }
-)

checks/update/flake-module.nix

@@ -1,318 +0,0 @@
-{ self, ... }:
-{
-  # Machine for update test
-  clan.machines.test-update-machine = {
-    imports = [
-      self.nixosModules.test-update-machine
-      # Import the configuration file that will be created/updated during the test
-      ./test-update-machine/configuration.nix
-    ];
-  };
-  flake.nixosModules.test-update-machine =
-    { lib, modulesPath, ... }:
-    {
-      imports = [
-        (modulesPath + "/testing/test-instrumentation.nix")
-        (modulesPath + "/profiles/qemu-guest.nix")
-        self.clanLib.test.minifyModule
-        ../../lib/test/container-test-driver/nixos-module.nix
-      ];
-
-      # Apply patch to fix x-initrd.mount filesystem handling in switch-to-configuration-ng
-      nixpkgs.overlays = [
-        (_final: prev: {
-          switch-to-configuration-ng = prev.switch-to-configuration-ng.overrideAttrs (old: {
-            patches = (old.patches or [ ]) ++ [ ./switch-to-configuration-initrd-mount-fix.patch ];
-          });
-        })
-      ];
-
-      networking.hostName = "update-machine";
-
-      environment.etc."install-successful".text = "ok";
-
-      # Enable SSH and add authorized key for testing
-      services.openssh.enable = true;
-      services.openssh.settings.PasswordAuthentication = false;
-      users.users.root.openssh.authorizedKeys.keys = [ (builtins.readFile ../assets/ssh/pubkey) ];
-      services.openssh.knownHosts.localhost.publicKeyFile = ../assets/ssh/pubkey;
-      services.openssh.hostKeys = [
-        {
-          path = ../assets/ssh/privkey;
-          type = "ed25519";
-        }
-      ];
-      security.sudo.wheelNeedsPassword = false;
-
-      boot.consoleLogLevel = lib.mkForce 100;
-      boot.kernelParams = [ "boot.shell_on_fail" ];
-
-      boot.isContainer = true;
-      nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-      # Preserve the IP addresses assigned by the test framework
-      # (based on virtualisation.vlans = [1] and node number 1)
-      networking.interfaces.eth1 = {
-        useDHCP = false;
-        ipv4.addresses = [
-          {
-            address = "192.168.1.1";
-            prefixLength = 24;
-          }
-        ];
-        ipv6.addresses = [
-          {
-            address = "2001:db8:1::1";
-            prefixLength = 64;
-          }
-        ];
-      };
-
-      nix.settings = {
-        flake-registry = "";
-        # required for setting the `flake-registry`
-        experimental-features = [
-          "nix-command"
-          "flakes"
-        ];
-      };
-
-      # Define the mounts that exist in the container to prevent them from being stopped
-      fileSystems = {
-        "/" = {
-          device = "/dev/disk/by-label/nixos";
-          fsType = "ext4";
-          options = [ "x-initrd.mount" ];
-        };
-        "/nix/.rw-store" = {
-          device = "tmpfs";
-          fsType = "tmpfs";
-          options = [
-            "mode=0755"
-          ];
-        };
-        "/nix/store" = {
-          device = "overlay";
-          fsType = "overlay";
-          options = [
-            "lowerdir=/nix/.ro-store"
-            "upperdir=/nix/.rw-store/upper"
-            "workdir=/nix/.rw-store/work"
-          ];
-        };
-      };
-    };
-
-  perSystem =
-    {
-      pkgs,
-      ...
-    }:
-    {
-      checks =
-        pkgs.lib.optionalAttrs (pkgs.stdenv.isLinux && pkgs.stdenv.hostPlatform.system == "x86_64-linux")
-          {
-            nixos-test-update =
-              let
-                closureInfo = pkgs.closureInfo {
-                  rootPaths = [
-                    self.packages.${pkgs.hostPlatform.system}.clan-cli
-                    self.checks.${pkgs.hostPlatform.system}.clan-core-for-checks
-                    self.clanInternals.machines.${pkgs.hostPlatform.system}.test-update-machine.config.system.build.toplevel
-                    pkgs.stdenv.drvPath
-                    pkgs.bash.drvPath
-                    pkgs.buildPackages.xorg.lndir
-                    pkgs.bubblewrap
-                  ]
-                  ++ builtins.map (i: i.outPath) (builtins.attrValues self.inputs);
-                };
-              in
-              self.clanLib.test.containerTest {
-                name = "update";
-                nodes.machine = {
-                  imports = [ self.nixosModules.test-update-machine ];
-                };
-                extraPythonPackages = _p: [
-                  self.legacyPackages.${pkgs.hostPlatform.system}.nixosTestLib
-                ];
-
-                testScript = ''
-                  import tempfile
-                  import os
-                  import subprocess
-                  from nixos_test_lib.ssh import setup_ssh_connection # type: ignore[import-untyped]
-                  from nixos_test_lib.nix_setup import prepare_test_flake # type: ignore[import-untyped]
-
-                  start_all()
-                  machine.wait_for_unit("multi-user.target")
-
-                  # Verify initial state
-                  machine.succeed("test -f /etc/install-successful")
-                  machine.fail("test -f /etc/update-successful")
-
-                  # Set up test environment
-                  with tempfile.TemporaryDirectory() as temp_dir:
-                      # Prepare test flake and Nix store
-                      flake_dir = prepare_test_flake(
-                          temp_dir,
-                          "${self.checks.${pkgs.hostPlatform.system}.clan-core-for-checks}",
-                          "${closureInfo}"
-                      )
-                      (flake_dir / ".clan-flake").write_text("")  # Ensure .clan-flake exists
-
-                      # Set up SSH connection
-                      ssh_conn = setup_ssh_connection(
-                          machine,
-                          temp_dir,
-                          "${../assets/ssh/privkey}"
-                      )
-
-                      # Update the machine configuration to add a new file
-                      machine_config_path = os.path.join(flake_dir, "machines", "test-update-machine", "configuration.nix")
-                      os.makedirs(os.path.dirname(machine_config_path), exist_ok=True)
-
-                      # Note: update command doesn't accept -i flag, SSH key must be in ssh-agent
-                      # Start ssh-agent and add the key
-                      agent_output = subprocess.check_output(["${pkgs.openssh}/bin/ssh-agent", "-s"], text=True)
-                      for line in agent_output.splitlines():
-                          if line.startswith("SSH_AUTH_SOCK="):
-                              os.environ["SSH_AUTH_SOCK"] = line.split("=", 1)[1].split(";")[0]
-                          elif line.startswith("SSH_AGENT_PID="):
-                              os.environ["SSH_AGENT_PID"] = line.split("=", 1)[1].split(";")[0]
-
-                      # Add the SSH key to the agent
-                      subprocess.run(["${pkgs.openssh}/bin/ssh-add", ssh_conn.ssh_key], check=True)
-
-
-                      ##############
-                      print("TEST: update with --build-host local")
-                      with open(machine_config_path, "w") as f:
-                          f.write("""
-                      {
-                        environment.etc."update-build-local-successful".text = "ok";
-                      }
-                      """)
-
-                      # rsync the flake into the container
-                      os.environ["PATH"] = f"{os.environ['PATH']}:${pkgs.openssh}/bin"
-                      subprocess.run(
-                        [
-                            "${pkgs.rsync}/bin/rsync",
-                            "-a",
-                            "--delete",
-                            "-e",
-                            "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no",
-                            f"{str(flake_dir)}/",
-                            f"root@192.168.1.1:/flake",
-                        ],
-                        check=True
-                      )
-
-                      # allow machine to ssh into itself
-                      subprocess.run([
-                          "ssh",
-                          "-o", "UserKnownHostsFile=/dev/null",
-                          "-o", "StrictHostKeyChecking=no",
-                          f"root@192.168.1.1",
-                          "mkdir -p /root/.ssh && chmod 700 /root/.ssh && echo \"$(cat \"${../assets/ssh/privkey}\")\" > /root/.ssh/id_ed25519 && chmod 600 /root/.ssh/id_ed25519",
-                      ], check=True)
-
-                      # install the clan-cli package into the container's Nix store
-                      subprocess.run(
-                        [
-                            "${pkgs.nix}/bin/nix",
-                            "copy",
-                            "--from",
-                            f"{temp_dir}/store",
-                            "--to",
-                            "ssh://root@192.168.1.1",
-                            "--no-check-sigs",
-                            f"${self.packages.${pkgs.hostPlatform.system}.clan-cli}",
-                            "--extra-experimental-features", "nix-command flakes",
-                        ],
-                        check=True,
-                        env={
-                          **os.environ,
-                          "NIX_SSHOPTS": "-o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no",
-                        },
-                      )
-
-                      # Run ssh on the host to run the clan update command via --build-host local
-                      subprocess.run([
-                          "ssh",
-                          "-o", "UserKnownHostsFile=/dev/null",
-                          "-o", "StrictHostKeyChecking=no",
-                          f"root@192.168.1.1",
-                          "${self.packages.${pkgs.hostPlatform.system}.clan-cli}/bin/clan",
-                          "machines",
-                          "update",
-                          "--debug",
-                          "--flake", "/flake",
-                          "--host-key-check", "none",
-                          "--upload-inputs",  # Use local store instead of fetching from network
-                          "--build-host", "localhost",
-                          "test-update-machine",
-                          "--target-host", f"root@localhost",
-                      ], check=True)
-
-                      # Verify the update was successful
-                      machine.succeed("test -f /etc/update-build-local-successful")
-
-
-                      ##############
-                      print("TEST: update with --target-host")
-
-                      with open(machine_config_path, "w") as f:
-                          f.write("""
-                      {
-                        environment.etc."target-host-update-successful".text = "ok";
-                      }
-                      """)
-
-                      # Run clan update command
-                      subprocess.run([
-                          "${self.packages.${pkgs.hostPlatform.system}.clan-cli-full}/bin/clan",
-                          "machines",
-                          "update",
-                          "--debug",
-                          "--flake", flake_dir,
-                          "--host-key-check", "none",
-                          "--upload-inputs",  # Use local store instead of fetching from network
-                          "test-update-machine",
-                          "--target-host", f"root@192.168.1.1:{ssh_conn.host_port}",
-                      ], check=True)
-
-                      # Verify the update was successful
-                      machine.succeed("test -f /etc/target-host-update-successful")
-
-
-                      ##############
-                      print("TEST: update with --build-host")
-                      # Update configuration again
-                      with open(machine_config_path, "w") as f:
-                          f.write("""
-                      {
-                        environment.etc."build-host-update-successful".text = "ok";
-                      }
-                      """)
-
-                      # Run clan update command with --build-host
-                      subprocess.run([
-                          "${self.packages.${pkgs.hostPlatform.system}.clan-cli-full}/bin/clan",
-                          "machines",
-                          "update",
-                          "--debug",
-                          "--flake", flake_dir,
-                          "--host-key-check", "none",
-                          "--upload-inputs",  # Use local store instead of fetching from network
-                          "--build-host", f"root@192.168.1.1:{ssh_conn.host_port}",
-                          "test-update-machine",
-                          "--target-host", f"root@192.168.1.1:{ssh_conn.host_port}",
-                      ], check=True)
-
-                      # Verify the second update was successful
-                      machine.succeed("test -f /etc/build-host-update-successful")
-                '';
-              } { inherit pkgs self; };
-          };
-    };
-}

checks/update/switch-to-configuration-initrd-mount-fix.patch

@@ -1,17 +0,0 @@
-diff --git a/src/main.rs b/src/main.rs
-index 8baf5924a7db..1234567890ab 100644
---- a/src/main.rs
-+++ b/src/main.rs
-@@ -1295,6 +1295,12 @@ won't take effect until you reboot the system.
- 
-     for (mountpoint, current_filesystem) in current_filesystems {
-         // Use current version of systemctl binary before daemon is reexeced.
-+        
-+        // Skip filesystem comparison if x-initrd.mount is present in options
-+        if current_filesystem.options.contains("x-initrd.mount") {
-+            continue;
-+        }
-+        
-         let unit = path_to_unit_name(&current_system_bin, &mountpoint);
-         if let Some(new_filesystem) = new_filesystems.get(&mountpoint) {
-             if current_filesystem.fs_type != new_filesystem.fs_type

checks/update/test-update-machine/configuration.nix

@@ -1,3 +0,0 @@
-{
-  # Initial empty configuration
-}

checks/zt-tcp-relay/default.nix

@@ -0,0 +1,24 @@
+(
+  { pkgs, ... }:
+  {
+    name = "zt-tcp-relay";
+
+    nodes.machine =
+      { self, ... }:
+      {
+        imports = [
+          self.nixosModules.clanCore
+          self.clanModules.zt-tcp-relay
+          {
+            clan.core.settings.directory = ./.;
+          }
+        ];
+      };
+    testScript = ''
+      start_all()
+      machine.wait_for_unit("zt-tcp-relay.service")
+      out = machine.succeed("${pkgs.netcat}/bin/nc -z -v localhost 4443")
+      print(out)
+    '';
+  }
+)

clanModules/borgbackup/roles/client.nix

@@ -0,0 +1,210 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  # Instances might be empty, if the module is not used via the inventory
+  instances = config.clan.inventory.services.borgbackup or { };
+  # roles = { ${role_name} :: { machines :: [string] } }
+  allServers = lib.foldlAttrs (
+    acc: _instanceName: instanceConfig:
+    acc
+    ++ (
+      if builtins.elem machineName instanceConfig.roles.client.machines then
+        instanceConfig.roles.server.machines
+      else
+        [ ]
+    )
+  ) [ ] instances;
+
+  machineName = config.clan.core.settings.machine.name;
+
+  cfg = config.clan.borgbackup;
+  preBackupScript = ''
+    declare -A preCommandErrors
+
+    ${lib.concatMapStringsSep "\n" (
+      state:
+      lib.optionalString (state.preBackupCommand != null) ''
+        echo "Running pre-backup command for ${state.name}"
+        if ! /run/current-system/sw/bin/${state.preBackupCommand}; then
+          preCommandErrors["${state.name}"]=1
+        fi
+      ''
+    ) (lib.attrValues config.clan.core.state)}
+
+    if [[ ''${#preCommandErrors[@]} -gt 0 ]]; then
+      echo "pre-backup commands failed for the following services:"
+      for state in "''${!preCommandErrors[@]}"; do
+        echo "  $state"
+      done
+      exit 1
+    fi
+  '';
+in
+{
+  options.clan.borgbackup.destinations = lib.mkOption {
+    type = lib.types.attrsOf (
+      lib.types.submodule (
+        { name, ... }:
+        {
+          options = {
+            name = lib.mkOption {
+              type = lib.types.strMatching "^[a-zA-Z0-9._-]+$";
+              default = name;
+              description = "the name of the backup job";
+            };
+            repo = lib.mkOption {
+              type = lib.types.str;
+              description = "the borgbackup repository to backup to";
+            };
+            rsh = lib.mkOption {
+              type = lib.types.str;
+              default = "ssh -i ${
+                config.clan.core.vars.generators.borgbackup.files."borgbackup.ssh".path
+              } -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o IdentitiesOnly=Yes";
+              defaultText = "ssh -i \${config.clan.core.vars.generators.borgbackup.files.\"borgbackup.ssh\".path} -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null";
+              description = "the rsh to use for the backup";
+            };
+          };
+        }
+      )
+    );
+    default = { };
+    description = ''
+      destinations where the machine should be backuped to
+    '';
+  };
+
+  options.clan.borgbackup.exclude = lib.mkOption {
+    type = lib.types.listOf lib.types.str;
+    example = [ "*.pyc" ];
+    default = [ ];
+    description = ''
+      Directories/Files to exclude from the backup.
+      Use * as a wildcard.
+    '';
+  };
+
+  config = {
+
+    warnings = [
+      "The clan.borgbackup module is deprecated and will be removed on 2025-07-15.
+      Please migrate to user-maintained configuration or the new equivalent clan services
+      (https://docs.clan.lol/reference/clanServices)."
+    ];
+
+    # Destinations
+    clan.borgbackup.destinations =
+      let
+        destinations = builtins.map (serverName: {
+          name = serverName;
+          value = {
+            repo = "borg@${serverName}:/var/lib/borgbackup/${machineName}";
+          };
+        }) allServers;
+      in
+      (builtins.listToAttrs destinations);
+
+    # Derived from the destinations
+    systemd.services = lib.mapAttrs' (
+      _: dest:
+      lib.nameValuePair "borgbackup-job-${dest.name}" {
+        # since borgbackup mounts the system read-only, we need to run in a
+        # ExecStartPre script, so we can generate additional files.
+        serviceConfig.ExecStartPre = [
+          ''+${pkgs.writeShellScript "borgbackup-job-${dest.name}-pre-backup-commands" preBackupScript}''
+        ];
+      }
+    ) cfg.destinations;
+
+    services.borgbackup.jobs = lib.mapAttrs (_: dest: {
+      paths = lib.unique (
+        lib.flatten (map (state: state.folders) (lib.attrValues config.clan.core.state))
+      );
+      exclude = cfg.exclude;
+      repo = dest.repo;
+      environment.BORG_RSH = dest.rsh;
+      compression = "auto,zstd";
+      startAt = "*-*-* 01:00:00";
+      persistentTimer = true;
+
+      encryption = {
+        mode = "repokey";
+        passCommand = "cat ${config.clan.core.vars.generators.borgbackup.files."borgbackup.repokey".path}";
+      };
+
+      prune.keep = {
+        within = "1d"; # Keep all archives from the last day
+        daily = 7;
+        weekly = 4;
+        monthly = 0;
+      };
+    }) cfg.destinations;
+
+    environment.systemPackages = [
+      (pkgs.writeShellApplication {
+        name = "borgbackup-create";
+        runtimeInputs = [ config.systemd.package ];
+        text = ''
+          ${lib.concatMapStringsSep "\n" (dest: ''
+            systemctl start borgbackup-job-${dest.name}
+          '') (lib.attrValues cfg.destinations)}
+        '';
+      })
+      (pkgs.writeShellApplication {
+        name = "borgbackup-list";
+        runtimeInputs = [ pkgs.jq ];
+        text = ''
+          (${
+            lib.concatMapStringsSep "\n" (
+              dest:
+              # we need yes here to skip the changed url verification
+              ''echo y | /run/current-system/sw/bin/borg-job-${dest.name} list --json | jq '[.archives[] | {"name": ("${dest.name}::${dest.repo}::" + .name)}]' ''
+            ) (lib.attrValues cfg.destinations)
+          }) | jq -s 'add // []'
+        '';
+      })
+      (pkgs.writeShellApplication {
+        name = "borgbackup-restore";
+        runtimeInputs = [ pkgs.gawk ];
+        text = ''
+          cd /
+          IFS=':' read -ra FOLDER <<< "''${FOLDERS-}"
+          job_name=$(echo "$NAME" | awk -F'::' '{print $1}')
+          backup_name=''${NAME#"$job_name"::}
+          if [[ ! -x /run/current-system/sw/bin/borg-job-"$job_name" ]]; then
+            echo "borg-job-$job_name not found: Backup name is invalid" >&2
+            exit 1
+          fi
+          echo y | /run/current-system/sw/bin/borg-job-"$job_name" extract "$backup_name" "''${FOLDER[@]}"
+        '';
+      })
+    ];
+
+    clan.core.vars.generators.borgbackup = {
+      files."borgbackup.ssh.pub".secret = false;
+      files."borgbackup.ssh" = { };
+      files."borgbackup.repokey" = { };
+
+      migrateFact = "borgbackup";
+      runtimeInputs = [
+        pkgs.coreutils
+        pkgs.openssh
+        pkgs.xkcdpass
+      ];
+      script = ''
+        ssh-keygen -t ed25519 -N "" -C "" -f "$out"/borgbackup.ssh
+        xkcdpass -n 4 -d - > "$out"/borgbackup.repokey
+      '';
+    };
+
+    clan.core.backups.providers.borgbackup = {
+      list = "borgbackup-list";
+      create = "borgbackup-create";
+      restore = "borgbackup-restore";
+    };
+  };
+}

clanModules/disk-id/roles/default.nix

@@ -0,0 +1,36 @@
+{
+  pkgs,
+  ...
+}:
+
+{
+
+  config = {
+
+    warnings = [
+      ''
+        The clan.disk-id module is deprecated and will be removed on 2025-07-15.
+        For migration see: https://docs.clan.lol/guides/migrations/disk-id/
+
+        !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+        !!! Please migrate. Otherwise you may not be able to boot your system after that date.  !!!
+        !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+      ''
+    ];
+    clan.core.vars.generators.disk-id = {
+      files.diskId.secret = false;
+      runtimeInputs = [
+        pkgs.coreutils
+        pkgs.bash
+      ];
+      script = ''
+        uuid=$(bash ${./uuid4.sh})
+
+        # Remove the hyphens from the UUID
+        uuid_no_hyphens=$(echo -n "$uuid" | tr -d '-')
+
+        echo -n "$uuid_no_hyphens" > "$out/diskId"
+      '';
+    };
+  };
+}

clanModules/flake-module.nix

@@ -2,61 +2,22 @@
 
 let
   error = builtins.throw ''
+    clanModules have been removed!
 
-    ###############################################################################
+    Refer to https://docs.clan.lol/guides/migrations/migrate-inventory-services for migration.
-    #                                                                             #
-    # Clan modules (clanModules) have been deprecated and removed in favor of     #
-    # Clan services!                                                              #
-    #                                                                             #
-    # Refer to https://docs.clan.lol/guides/migrations/migrate-inventory-services #
-    # for migration instructions.                                                 #
-    #                                                                             #
-    ###############################################################################
-
   '';
-
-  modnames = [
-    "admin"
-    "borgbackup"
-    "borgbackup-static"
-    "deltachat"
-    "disk-id"
-    "dyndns"
-    "ergochat"
-    "garage"
-    "heisenbridge"
-    "iwd"
-    "localbackup"
-    "localsend"
-    "matrix-synapse"
-    "moonlight"
-    "mumble"
-    "nginx"
-    "packages"
-    "postgresql"
-    "root-password"
-    "single-disk"
-    "sshd"
-    "state-version"
-    "static-hosts"
-    "sunshine"
-    "syncthing"
-    "syncthing-static-peers"
-    "thelounge"
-    "trusted-nix-caches"
-    "user-password"
-    "vaultwarden"
-    "xfce"
-    "zerotier-static-peers"
-    "zt-tcp-relay"
-  ];
 in
 
 {
-  flake.clanModules = builtins.listToAttrs (
+  flake.clanModules = {
-    map (name: {
+    outPath = "removed-clan-modules";
-      inherit name;
     value = error;
-    }) modnames
+  };
-  );
+
+  # builtins.listToAttrs (
+  #   map (name: {
+  #     inherit name;
+  #     value = error;
+  #   }) modnames
+  # );
 }

clanModules/importer/README.md

@@ -0,0 +1,27 @@
+---
+description = "Convenient, structured module imports for hosts."
+categories = ["Utility"]
+features = [ "inventory" ]
+---
+The importer module allows users to configure importing modules in a flexible and structured way.
+
+It exposes the `extraModules` functionality of the inventory, without any added configuration.
+
+## Usage
+
+```nix
+inventory.services = {
+  importer.base = {
+    roles.default.tags = [ "all" ];
+    roles.default.extraModules = [ "modules/base.nix" ];
+  };
+  importer.zone1 = {
+    roles.default.tags = [ "zone1" ];
+    roles.default.extraModules = [ "modules/zone1.nix" ];
+  };
+};
+```
+
+This will import the module `modules/base.nix` to all machines that have the `all` tag,
+which by default is every machine managed by the clan.
+And also import for all machines tagged with `zone1` the module at `modules/zone1.nix`.

clanModules/sshd/roles/server.nix

@@ -0,0 +1,106 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  stringSet = list: builtins.attrNames (builtins.groupBy lib.id list);
+
+  domains = stringSet config.clan.sshd.certificate.searchDomains;
+
+  cfg = config.clan.sshd;
+in
+{
+  imports = [ ../shared.nix ];
+  options = {
+    clan.sshd.hostKeys.rsa.enable = lib.mkEnableOption "Generate RSA host key";
+  };
+  config = {
+
+    warnings = [
+      "The clan.sshd module is deprecated and will be removed on 2025-07-15.
+      Please migrate to user-maintained configuration or the new equivalent clan services
+      (https://docs.clan.lol/reference/clanServices)."
+    ];
+
+    services.openssh = {
+      enable = true;
+      settings.PasswordAuthentication = false;
+
+      settings.HostCertificate = lib.mkIf (
+        cfg.certificate.searchDomains != [ ]
+      ) config.clan.core.vars.generators.openssh-cert.files."ssh.id_ed25519-cert.pub".path;
+
+      hostKeys =
+        [
+          {
+            path = config.clan.core.vars.generators.openssh.files."ssh.id_ed25519".path;
+            type = "ed25519";
+          }
+        ]
+        ++ lib.optional cfg.hostKeys.rsa.enable {
+          path = config.clan.core.vars.generators.openssh-rsa.files."ssh.id_rsa".path;
+          type = "rsa";
+        };
+    };
+
+    clan.core.vars.generators.openssh = {
+      files."ssh.id_ed25519" = { };
+      files."ssh.id_ed25519.pub".secret = false;
+      migrateFact = "openssh";
+      runtimeInputs = [
+        pkgs.coreutils
+        pkgs.openssh
+      ];
+      script = ''
+        ssh-keygen -t ed25519 -N "" -C "" -f "$out"/ssh.id_ed25519
+      '';
+    };
+
+    programs.ssh.knownHosts.clan-sshd-self-ed25519 = {
+      hostNames = [
+        "localhost"
+        config.networking.hostName
+      ] ++ (lib.optional (config.networking.domain != null) config.networking.fqdn);
+      publicKey = config.clan.core.vars.generators.openssh.files."ssh.id_ed25519.pub".value;
+    };
+
+    clan.core.vars.generators.openssh-rsa = lib.mkIf config.clan.sshd.hostKeys.rsa.enable {
+      files."ssh.id_rsa" = { };
+      files."ssh.id_rsa.pub".secret = false;
+      runtimeInputs = [
+        pkgs.coreutils
+        pkgs.openssh
+      ];
+      script = ''
+        ssh-keygen -t rsa -b 4096 -N "" -C "" -f "$out"/ssh.id_rsa
+      '';
+    };
+
+    clan.core.vars.generators.openssh-cert = lib.mkIf (cfg.certificate.searchDomains != [ ]) {
+      files."ssh.id_ed25519-cert.pub".secret = false;
+      dependencies = [
+        "openssh"
+        "openssh-ca"
+      ];
+      validation = {
+        name = config.clan.core.settings.machine.name;
+        domains = lib.genAttrs config.clan.sshd.certificate.searchDomains lib.id;
+      };
+      runtimeInputs = [
+        pkgs.openssh
+        pkgs.jq
+      ];
+      script = ''
+        ssh-keygen \
+          -s $in/openssh-ca/id_ed25519 \
+          -I ${config.clan.core.settings.machine.name} \
+          -h \
+          -n ${lib.concatMapStringsSep "," (d: "${config.clan.core.settings.machine.name}.${d}") domains} \
+          $in/openssh/ssh.id_ed25519.pub
+        mv $in/openssh/ssh.id_ed25519-cert.pub "$out"/ssh.id_ed25519-cert.pub
+      '';
+    };
+  };
+}

clanModules/sshd/shared.nix

@@ -0,0 +1,49 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+{
+  options = {
+    clan.sshd.certificate = {
+      # TODO: allow per-server domains that we than collect in the inventory
+      #domains = lib.mkOption {
+      #  type = lib.types.listOf lib.types.str;
+      #  default = [ ];
+      #  example = [ "git.mydomain.com" ];
+      #  description = "List of domains to include in the certificate. This option will not prepend the machine name in front of each domain.";
+      #};
+      searchDomains = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        default = [ ];
+        example = [ "mydomain.com" ];
+        description = "List of domains to include in the certificate. This option will prepend the machine name in front of each domain before adding it to the certificate.";
+      };
+    };
+  };
+  config = {
+    clan.core.vars.generators.openssh-ca =
+      lib.mkIf (config.clan.sshd.certificate.searchDomains != [ ])
+        {
+          share = true;
+          files.id_ed25519.deploy = false;
+          files."id_ed25519.pub" = {
+            deploy = false;
+            secret = false;
+          };
+          runtimeInputs = [
+            pkgs.openssh
+          ];
+          script = ''
+            ssh-keygen -t ed25519 -N "" -C "" -f "$out"/id_ed25519
+          '';
+        };
+
+    programs.ssh.knownHosts.ssh-ca = lib.mkIf (config.clan.sshd.certificate.searchDomains != [ ]) {
+      certAuthority = true;
+      extraHostNames = builtins.map (domain: "*.${domain}") config.clan.sshd.certificate.searchDomains;
+      publicKey = config.clan.core.vars.generators.openssh-ca.files."id_ed25519.pub".value;
+    };
+  };
+}

clanServices/admin/README.md

@@ -1,25 +0,0 @@
-The admin service aggregates components that allow an administrator to log in to and manage the machine.
-
-The following configuration:
-
-1. Enables OpenSSH with root login and adds an SSH public key named`myusersKey` to the machine's authorized_keys via the `allowedKeys` setting.
-
-2. Automatically generates a password for the root user.
-
-```nix
-instances = {
-    admin = {
-        roles.default.tags = {
-            all = {  };
-        };
-        roles.default.settings = {
-            allowedKeys = {
-                myusersKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEFDNnynMbFWatSFdANzbJ8iiEKL7+9ZpDaMLrWRQjyH lhebendanz@wintux";
-            };
-        };
-    };
-};
-```
-
-
-

clanServices/admin/default.nix

@@ -1,15 +1,15 @@
+{ ... }:
 {
   _class = "clan.service";
   manifest.name = "clan-core/admin";
-  manifest.description = "Adds a root user with ssh access";
+  manifest.description = "Convenient Administration for the Clan App";
   manifest.categories = [ "Utility" ];
-  manifest.readme = builtins.readFile ./README.md;
 
   roles.default = {
-    description = "Placeholder role to apply the admin service";
     interface =
       { lib, ... }:
       {
+
         options = {
           allowedKeys = lib.mkOption {
             default = { };
@@ -41,13 +41,25 @@
           };
         };
       };
-  };
 
+    perInstance =
+      { settings, ... }:
+      {
+        nixosModule =
+          { ... }:
+          {
+            imports = [
               # We don't have a good way to specify dependencies between
               # clanServices for now. When it get's implemtende, we should just
               # use the ssh and users modules here.
-  imports = [
               ./ssh.nix
               ./root-password.nix
             ];
+
+            _module.args = { inherit settings; };
+
+            users.users.root.openssh.authorizedKeys.keys = builtins.attrValues settings.allowedKeys;
+          };
+      };
+  };
 }

clanServices/admin/flake-module.nix

@@ -1,6 +1,6 @@
-{ ... }:
+{ lib, ... }:
 let
-  module = ./default.nix;
+  module = lib.modules.importApply ./default.nix { };
 in
 {
   clan.modules = {

clanServices/admin/root-password.nix

@@ -1,10 +1,5 @@
 # We don't have a way of specifying dependencies between clanServices for now.
 # When it get's added this file should be removed and the users module used instead.
-{
-  roles.default.perInstance =
-    { ... }:
-    {
-      nixosModule =
 {
   config,
   pkgs,
@@ -27,18 +22,9 @@
       pkgs.xkcdpass
     ];
 
-            prompts.password.display = {
-              group = "Root User";
-              label = "Password";
-              required = false;
-              helperText = ''
-                Your password will be encrypted and stored securely using the secret store you've configured.
-              '';
-            };
-
     prompts.password.type = "hidden";
     prompts.password.persist = true;
-            prompts.password.description = "Leave empty to generate automatically";
+    prompts.password.description = "You can autogenerate a password, if you leave this prompt blank.";
 
     script = ''
       prompt_value="$(cat "$prompts"/password)"
@@ -50,6 +36,4 @@
       mkpasswd -s -m sha-512 < "$out"/password | tr -d "\n" > "$out"/password-hash
     '';
   };
-        };
-    };
 }

clanServices/admin/ssh.nix

@@ -1,13 +1,8 @@
-{
-  roles.default.perInstance =
-    { settings, ... }:
-    {
-      nixosModule =
-
 {
   config,
   pkgs,
   lib,
+  settings,
   ...
 }:
 let
@@ -18,8 +13,6 @@
 in
 {
 
-          users.users.root.openssh.authorizedKeys.keys = builtins.attrValues settings.allowedKeys;
-
   services.openssh = {
     enable = true;
     settings.PasswordAuthentication = false;
@@ -28,7 +21,8 @@
       settings.certificateSearchDomains != [ ]
     ) config.clan.core.vars.generators.openssh-cert.files."ssh.id_ed25519-cert.pub".path;
 
-            hostKeys = [
+    hostKeys =
+      [
         {
           path = config.clan.core.vars.generators.openssh.files."ssh.id_ed25519".path;
           type = "ed25519";
@@ -57,8 +51,7 @@
     hostNames = [
       "localhost"
       config.networking.hostName
-            ]
+    ] ++ (lib.optional (config.networking.domain != null) config.networking.fqdn);
-            ++ (lib.optional (config.networking.domain != null) config.networking.fqdn);
     publicKey = config.clan.core.vars.generators.openssh.files."ssh.id_ed25519.pub".value;
   };
 
@@ -119,6 +112,4 @@
     extraHostNames = builtins.map (domain: "*.${domain}") settings.certificateSearchDomains;
     publicKey = config.clan.core.vars.generators.openssh-ca.files."id_ed25519.pub".value;
   };
-        };
-    };
 }

clanServices/admin/tests/vm/default.nix

@@ -2,7 +2,7 @@ let
   public-key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII6zj7ubTg6z/aDwRNwvM/WlQdUocMprQ8E92NWxl6t+ test@test";
 in
 {
-  name = "admin";
+  name = "service-admin";
 
   clan = {
     directory = ./.;

clanServices/admin/tests/vm/vars/per-machine/server/state-version/version/value

@@ -1 +0,0 @@
-25.11

clanServices/borgbackup/README.md

@@ -1,59 +1,9 @@
-## Usage
+BorgBackup (short: Borg) gives you:
 
-```nix
+- Space efficient storage of backups.
-inventory.instances = {
+- Secure, authenticated encryption.
-  borgbackup = {
+- Compression: lz4, zstd, zlib, lzma or none.
-    module = {
+- Mountable backups with FUSE.
-      name = "borgbackup";
-      input = "clan-core";
-    };
-    roles.client.machines."jon".settings = {
-      destinations."storagebox" = {
-        repo = "username@hostname:/./borgbackup";
-        rsh = ''ssh -oPort=23 -i /run/secrets/vars/borgbackup/borgbackup.ssh'';
-      };
-    };
-    roles.server.machines = { };
-  };
-};
-```
-
-The input should be named according to your flake input. Jon is configured as a
-client machine with a destination pointing to a Hetzner Storage Box.
-
-## Overview
-
-This guide explains how to set up and manage
-[BorgBackup](https://borgbackup.readthedocs.io/) for secure, efficient backups
-in a clan network. BorgBackup provides:
-
-- Space efficient storage of backups with deduplication
-- Secure, authenticated encryption
-- Compression: lz4, zstd, zlib, lzma or none
-- Mountable backups with FUSE
 - Easy installation on multiple platforms: Linux, macOS, BSD, …
 - Free software (BSD license).
 - Backed by a large and active open-source community.
-
-## Roles
-
-### 1. Client
-
-Clients are machines that create and send backups to various destinations. Each
-client can have multiple backup destinations configured.
-
-### 2. Server
-
-Servers act as backup repositories, receiving and storing backups from client
-machines. They can be dedicated backup servers within your clan network.
-
-## Backup destinations
-
-This service allows you to perform backups to multiple `destinations`.
-Destinations can be:
-
-- **Local**: Local disk storage
-- **Server**: Your own borgbackup server (using the `server` role)
-- **Third-party services**: Such as Hetzner's Storage Box
-
-For a more comprehensive guide on backups look into the guide section.

clanServices/borgbackup/default.nix

@@ -9,7 +9,7 @@
   # TODO: a client can only be in one instance, add constraint
 
   roles.server = {
-    description = "A borgbackup server that stores the backups of clients.";
+
     interface =
       { lib, ... }:
       {
@@ -54,7 +54,7 @@
                   authorizedKeys = [ (builtins.readFile (borgbackupIpMachinePath machineName)) ];
                   # };
                   # }) machinesWithKey;
-                }) (roles.client.machines or { });
+                }) roles.client.machines;
               in
               hosts;
           };
@@ -62,7 +62,6 @@
   };
 
   roles.client = {
-    description = "A borgbackup client that backs up to all borgbackup server roles.";
     interface =
       {
         lib,
@@ -188,7 +187,7 @@
                           config.clan.core.vars.generators.borgbackup.files."borgbackup.ssh".path
                         } -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o IdentitiesOnly=Yes";
                       };
-                    }) (builtins.attrNames (roles.server.machines or { }));
+                    }) (builtins.attrNames roles.server.machines);
                   in
                   (builtins.listToAttrs destinations);
 

clanServices/borgbackup/flake-module.nix

@@ -1,6 +1,6 @@
-{ ... }:
+{ lib, ... }:
 let
-  module = ./default.nix;
+  module = lib.modules.importApply ./default.nix { };
 in
 {
   clan.modules = {

clanServices/borgbackup/tests/vm/default.nix

@@ -3,7 +3,7 @@
   ...
 }:
 {
-  name = "borgbackup";
+  name = "service-borgbackup";
 
   clan = {
     directory = ./.;

clanServices/borgbackup/tests/vm/vars/per-machine/clientone/state-version/version/value

@@ -1 +0,0 @@
-25.11

clanServices/borgbackup/tests/vm/vars/per-machine/serverone/state-version/version/value

@@ -1 +0,0 @@
-25.11

clanServices/certificates/README.md

@@ -1,32 +0,0 @@
-This service sets up a certificate authority (CA) that can issue certificates to
-other machines in your clan. For this the `ca` role is used.
-It additionally provides a `default` role, that can be applied to all machines
-in your clan and will make sure they trust your CA.
-
-## Example Usage
-
-The following configuration would add a CA for the top level domain `.foo`. If
-the machine `server` now hosts a webservice at `https://something.foo`, it will
-get a certificate from `ca` which is valid inside your clan. The machine
-`client` will trust this certificate if it makes a request to
-`https://something.foo`.
-
-This clan service can be combined with the `coredns` service for easy to deploy,
-SSL secured clan-internal service hosting.
-
-```nix
-inventory = {
-  machines.ca = { };
-  machines.client = { };
-  machines.server = { };
-
-  instances."certificates" = {
-    module.name = "certificates";
-    module.input = "self";
-
-    roles.ca.machines.ca.settings.tlds = [ "foo" ];
-    roles.default.machines.client = { };
-    roles.default.machines.server = { };
-  };
-};
-```

clanServices/certificates/default.nix

@@ -1,246 +0,0 @@
-{ ... }:
-{
-  _class = "clan.service";
-  manifest.name = "certificates";
-  manifest.description = "Sets up a PKI certificate chain using step-ca";
-  manifest.categories = [ "Network" ];
-  manifest.readme = builtins.readFile ./README.md;
-
-  roles.ca = {
-    description = "A certificate authority that issues and signs certificates for other machines.";
-    interface =
-      { lib, ... }:
-      {
-
-        options.acmeEmail = lib.mkOption {
-          type = lib.types.str;
-          default = "none@none.tld";
-          description = ''
-            Email address for account creation and correspondence from the CA.
-            It is recommended to use the same email for all certs to avoid account
-            creation limits.
-          '';
-        };
-
-        options.tlds = lib.mkOption {
-          type = lib.types.listOf lib.types.str;
-          description = "Top level domain for this CA. Certificates will be issued and trusted for *.<tld>";
-        };
-
-        options.expire = lib.mkOption {
-          type = lib.types.nullOr lib.types.str;
-          description = "When the certificate should expire.";
-          default = "8760h";
-          example = "8760h";
-        };
-      };
-
-    perInstance =
-      { settings, ... }:
-      {
-        nixosModule =
-          {
-            config,
-            pkgs,
-            lib,
-            ...
-          }:
-          let
-            domains = map (tld: "ca.${tld}") settings.tlds;
-          in
-          {
-            security.acme.defaults.email = settings.acmeEmail;
-            security.acme = {
-              certs = builtins.listToAttrs (
-                map (domain: {
-                  name = domain;
-                  value = {
-                    server = "https://${domain}:1443/acme/acme/directory";
-                  };
-                }) domains
-              );
-            };
-
-            networking.firewall.allowedTCPPorts = [
-              80
-              443
-            ];
-
-            services.nginx = {
-              enable = true;
-              recommendedProxySettings = true;
-              virtualHosts = builtins.listToAttrs (
-                map (domain: {
-                  name = domain;
-                  value = {
-                    addSSL = true;
-                    enableACME = true;
-                    locations."/".proxyPass = "https://localhost:1443";
-                    locations."= /ca.crt".alias =
-                      config.clan.core.vars.generators.step-intermediate-cert.files."intermediate.crt".path;
-                  };
-                }) domains
-              );
-            };
-
-            clan.core.vars.generators = {
-
-              # Intermediate key generator
-              "step-intermediate-key" = {
-                files."intermediate.key" = {
-                  secret = true;
-                  deploy = true;
-                  owner = "step-ca";
-                  group = "step-ca";
-                };
-                runtimeInputs = [ pkgs.step-cli ];
-                script = ''
-                  step crypto keypair --kty EC --curve P-256 --no-password --insecure $out/intermediate.pub $out/intermediate.key
-                '';
-              };
-
-              # Intermediate certificate generator
-              "step-intermediate-cert" = {
-                files."intermediate.crt".secret = false;
-                dependencies = [
-                  "step-ca"
-                  "step-intermediate-key"
-                ];
-                runtimeInputs = [ pkgs.step-cli ];
-                script = ''
-                  # Create intermediate certificate
-                  step certificate create \
-                    --ca $in/step-ca/ca.crt \
-                    --ca-key $in/step-ca/ca.key \
-                    --ca-password-file /dev/null \
-                    --key $in/step-intermediate-key/intermediate.key \
-                    --template ${pkgs.writeText "intermediate.tmpl" ''
-                      {
-                        "subject": {{ toJson .Subject }},
-                        "keyUsage": ["certSign", "crlSign"],
-                        "basicConstraints": {
-                          "isCA": true,
-                          "maxPathLen": 0
-                        },
-                        "nameConstraints": {
-                          "critical": true,
-                          "permittedDNSDomains": [${
-                            (lib.strings.concatStringsSep "," (map (tld: ''"${tld}"'') settings.tlds))
-                          }]
-                        }
-                      }
-                    ''} ${lib.optionalString (settings.expire != null) "--not-after ${settings.expire}"} \
-                    --not-before=-12h \
-                    --no-password --insecure \
-                    "Clan Intermediate CA" \
-                    $out/intermediate.crt
-                '';
-              };
-            };
-
-            services.step-ca = {
-              enable = true;
-              intermediatePasswordFile = "/dev/null";
-              address = "0.0.0.0";
-              port = 1443;
-              settings = {
-                root = config.clan.core.vars.generators.step-ca.files."ca.crt".path;
-                crt = config.clan.core.vars.generators.step-intermediate-cert.files."intermediate.crt".path;
-                key = config.clan.core.vars.generators.step-intermediate-key.files."intermediate.key".path;
-                dnsNames = domains;
-                logger.format = "text";
-                db = {
-                  type = "badger";
-                  dataSource = "/var/lib/step-ca/db";
-                };
-                authority = {
-                  provisioners = [
-                    {
-                      type = "ACME";
-                      name = "acme";
-                      forceCN = true;
-                    }
-                  ];
-                  claims = {
-                    maxTLSCertDuration = "2160h";
-                    defaultTLSCertDuration = "2160h";
-                  };
-                  backdate = "1m0s";
-                };
-                tls = {
-                  cipherSuites = [
-                    "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256"
-                    "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
-                  ];
-                  minVersion = 1.2;
-                  maxVersion = 1.3;
-                  renegotiation = false;
-                };
-              };
-            };
-          };
-      };
-  };
-
-  # Empty role, so we can add non-ca machins to the instance to trust the CA
-  roles.default = {
-    description = "A machine that trusts the CA and can get certificates issued by it.";
-    interface =
-      { lib, ... }:
-      {
-        options.acmeEmail = lib.mkOption {
-          type = lib.types.str;
-          default = "none@none.tld";
-          description = ''
-            Email address for account creation and correspondence from the CA.
-            It is recommended to use the same email for all certs to avoid account
-            creation limits.
-          '';
-        };
-      };
-
-    perInstance =
-      { settings, ... }:
-      {
-        nixosModule.security.acme.defaults.email = settings.acmeEmail;
-      };
-  };
-
-  # All machines (independent of role) will trust the CA
-  perMachine.nixosModule =
-    { pkgs, config, ... }:
-    {
-      # Root CA generator
-      clan.core.vars.generators = {
-        "step-ca" = {
-          share = true;
-          files."ca.key" = {
-            secret = true;
-            deploy = false;
-          };
-          files."ca.crt".secret = false;
-          runtimeInputs = [ pkgs.step-cli ];
-          script = ''
-            step certificate create --template ${pkgs.writeText "root.tmpl" ''
-              {
-                "subject": {{ toJson .Subject }},
-                "issuer": {{ toJson .Subject }},
-                "keyUsage": ["certSign", "crlSign"],
-                "basicConstraints": {
-                  "isCA": true,
-                  "maxPathLen": 1
-                }
-              }
-            ''} "Clan Root CA" $out/ca.crt $out/ca.key \
-              --kty EC --curve P-256 \
-              --not-after=8760h \
-              --not-before=-12h \
-              --no-password --insecure
-          '';
-        };
-      };
-      security.pki.certificateFiles = [ config.clan.core.vars.generators."step-ca".files."ca.crt".path ];
-      environment.systemPackages = [ pkgs.openssl ];
-      security.acme.acceptTerms = true;
-    };
-}

clanServices/certificates/flake-module.nix

@@ -1,17 +0,0 @@
-{
-  ...
-}:
-let
-  module = ./default.nix;
-in
-{
-  clan.modules.certificates = module;
-  perSystem =
-    { ... }:
-    {
-      clan.nixosTests.certificates = {
-        imports = [ ./tests/vm/default.nix ];
-        clan.modules.certificates = module;
-      };
-    };
-}

clanServices/certificates/tests/vm/default.nix

@@ -1,84 +0,0 @@
-{
-  name = "certificates";
-
-  clan = {
-    directory = ./.;
-    inventory = {
-
-      machines.ca = { }; # 192.168.1.1
-      machines.client = { }; # 192.168.1.2
-      machines.server = { }; # 192.168.1.3
-
-      instances."certificates" = {
-        module.name = "certificates";
-        module.input = "self";
-
-        roles.ca.machines.ca.settings.tlds = [ "foo" ];
-        roles.default.machines.client = { };
-        roles.default.machines.server = { };
-      };
-    };
-  };
-
-  nodes =
-    let
-      hostConfig = ''
-        192.168.1.1 ca.foo
-        192.168.1.3 test.foo
-      '';
-    in
-    {
-
-      client.networking.extraHosts = hostConfig;
-      ca.networking.extraHosts = hostConfig;
-
-      server = {
-
-        networking.extraHosts = hostConfig;
-
-        # TODO: Could this be set automatically?
-        # I would like to get this information from the coredns module, but we
-        # cannot model dependencies yet
-        security.acme.certs."test.foo".server = "https://ca.foo/acme/acme/directory";
-
-        # Host a simple service on 'server', with SSL provided via our CA. 'client'
-        # should be able to curl it via https and accept the certificates
-        # presented
-        networking.firewall.allowedTCPPorts = [
-          80
-          443
-        ];
-
-        services.nginx = {
-          enable = true;
-          virtualHosts."test.foo" = {
-            enableACME = true;
-            forceSSL = true;
-            locations."/" = {
-              return = "200 'test server response'";
-              extraConfig = "add_header Content-Type text/plain;";
-            };
-          };
-        };
-      };
-    };
-
-  testScript = ''
-    start_all()
-
-    import time
-
-    time.sleep(3)
-    ca.succeed("systemctl restart acme-order-renew-ca.foo.service ")
-
-    time.sleep(3)
-    server.succeed("systemctl restart acme-test.foo.service")
-
-    # It takes a while for the correct certs to appear (before that self-signed
-    # are presented by nginx) so we wait for a bit.
-    client.wait_until_succeeds("curl -v https://test.foo")
-
-    # Show certificate information for debugging
-    client.succeed("openssl s_client -connect test.foo:443 -servername test.foo </dev/null 2>/dev/null | openssl x509 -text -noout 1>&2")
-  '';
-}

clanServices/certificates/tests/vm/sops/machines/ca/key.json

@@ -1,6 +0,0 @@
-[
-  {
-    "publickey": "age1yd2cden7jav8x4nzx2fwze2fsa5j0qm2m3t7zum765z3u4gj433q7dqj43",
-    "type": "age"
-  }
-]

clanServices/certificates/tests/vm/sops/machines/client/key.json

@@ -1,6 +0,0 @@
-[
-  {
-    "publickey": "age1js225d8jc507sgcg0fdfv2x3xv3asm4ds5c6s4hp37nq8spxu95sc5x3ce",
-    "type": "age"
-  }
-]

clanServices/certificates/tests/vm/sops/machines/server/key.json

@@ -1,6 +0,0 @@
-[
-  {
-    "publickey": "age1nwuh8lc604mnz5r8ku8zswyswnwv02excw237c0cmtlejp7xfp8sdrcwfa",
-    "type": "age"
-  }
-]

clanServices/certificates/tests/vm/sops/secrets/ca-age.key/secret

@@ -1,15 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:6+XilULKRuWtAZ6B8Lj9UqCfi1T6dmqrDqBNXqS4SvBwM1bIWiL6juaT1Q7ByOexzID7tY740gmQBqTey54uLydh8mW0m4ZtUqw=,iv:9kscsrMPBGkutTnxrc5nrc7tQXpzLxw+929pUDKqTu0=,tag:753uIjm8ZRs0xsjiejEY8g==,type:str]",
-	"sops": {
-		"age": [
-			{
-				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1d3kycldZRXhmR0FqTXJp\nWWU0MDBYNmxxbFE5M2xKYm5KWnQ0MXBHNEM4CjN4RFFVcFlkd3pjTFVDQ3Vackdj\nVTVhMWoxdFpsWHp5S1p4L05kYk5LUkkKLS0tIENtZFZZTjY2amFVQmZLZFplQzBC\nZm1vWFI4MXR1ZHIxTTQ5VXdSYUhvOTQKte0bKjXQ0xA8FrpuChjDUvjVqp97D8kT\n3tVh6scdjxW48VSBZP1GRmqcMqCdj75GvJTbWeNEV4PDBW7GI0UW+Q==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2025-09-02T08:42:39Z",
-		"mac": "ENC[AES256_GCM,data:AftMorrH7qX5ctVu5evYHn5h9pC4Mmm2VYaAV8Hy0PKTc777jNsL6DrxFVV3NVqtecpwrzZFWKgzukcdcRJe4veVeBrusmoZYtifH0AWZTEVpVlr2UXYYxCDmNZt1WHfVUo40bT//X6QM0ye6a/2Y1jYPbMbryQNcGmnpk9PDvU=,iv:5nk+d8hzA05LQp7ZHRbIgiENg2Ha6J6YzyducM6zcNU=,tag:dy1hqWVzMu/+fSK57h9ZCA==,type:str]",
-		"unencrypted_suffix": "_unencrypted",
-		"version": "3.10.2"
-	}
-}

clanServices/certificates/tests/vm/sops/secrets/ca-age.key/users/admin

@@ -1 +0,0 @@
-../../../users/admin

clanServices/certificates/tests/vm/sops/secrets/client-age.key/secret

@@ -1,15 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:jdTuGQUYvT1yXei1RHKsOCsABmMlkcLuziHDVhA7NequZeNu0fSbrJTXQDCHsDGhlYRcjU5EsEDT750xdleXuD3Gs9zWvPVobI4=,iv:YVow3K1j6fzRF9bRfIEpuOkO/nRpku/UQxWNGC+UJQQ=,tag:cNLM5R7uu6QpwPB9K6MYzg==,type:str]",
-	"sops": {
-		"age": [
-			{
-				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvOVF2WXRSL0NpQzFZR01I\nNU85TGcyQmVDazN1dmpuRFVTZEg5NDRKTGhrCk1IVjFSU1V6WHBVRnFWcHkyVERr\nTjFKbW1mQ2FWOWhjN2VPamMxVEQ5VkkKLS0tIENVUGlhanhuWGtDKzBzRmk2dE4v\nMXZBRXNMa3IrOTZTNHRUWVE3UXEwSWMK2cBLoL/H/Vxd/klVrqVLdX9Mww5j7gw/\nEWc5/hN+km6XoW+DiJxVG4qaJ7qqld6u5ZnKgJT+2h9CfjA04I2akg==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2025-09-02T08:42:51Z",
-		"mac": "ENC[AES256_GCM,data:zOBQVM2Ydu4v0+Fw3p3cEU+5+7eKaadV0tKro1JVOxclG1Vs6Myq57nw2eWf5JxIl0ulL+FavPKY26qOQ3aqcGOT3PMRlCda9z+0oSn9Im9bE/DzAGmoH/bp76kFkgTTOCZTMUoqJ+UJqv0qy1BH/92sSSKmYshEX6d1vr5ISrw=,iv:i9ZW4sLxOCan4UokHlySVr1CW39nCTusG4DmEPj/gIw=,tag:iZBDPHDkE3Vt5mFcFu1TPQ==,type:str]",
-		"unencrypted_suffix": "_unencrypted",
-		"version": "3.10.2"
-	}
-}

clanServices/certificates/tests/vm/sops/secrets/client-age.key/users/admin

@@ -1 +0,0 @@
-../../../users/admin

clanServices/certificates/tests/vm/sops/secrets/server-age.key/secret

@@ -1,15 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:5CJuHcxJMXZJ8GqAeG3BrbWtT1kade4kxgJsn1cRpmr1UgN0ZVYnluPEiBscClNSOzcc6vcrBpfTI3dj1tASKTLP58M+GDBFQDo=,iv:gsK7XqBGkYCoqAvyFlIXuJ27PKSbTmy7f6cgTmT2gow=,tag:qG5KejkBvy9ytfhGXa/Mnw==,type:str]",
-	"sops": {
-		"age": [
-			{
-				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxbzVqYkplTzJKN1pwS3VM\naFFIK2VsR3lYUVExYW9ieERBL0tlcFZtVzJRCkpiLzdmWmFlOUZ5QUJ4WkhXZ2tQ\nZm92YXBCV0RpYnIydUdEVTRiamI4bjAKLS0tIG93a2htS1hFcjBOeVFnNCtQTHVr\na2FPYjVGbWtORjJVWXE5bndPU1RWcXMKikMEB7X+kb7OtiyqXn3HRpLYkCdoayDh\n7cjGnplk17q25/lRNHM4JVS5isFfuftCl01enESqkvgq+cwuFwa9DQ==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2025-09-02T08:42:59Z",
-		"mac": "ENC[AES256_GCM,data:xybV2D0xukZnH2OwRpIugPnS7LN9AbgGKwFioPJc1FQWx9TxMUVDwgMN6V5WrhWkXgF2zP4krtDYpEz4Vq+LbOjcnTUteuCc+7pMHubuRuip7j+M32MH1kuf4bVZuXbCfvm7brGxe83FzjoioLqzA8g/X6Q1q7/ErkNeFjluC3Q=,iv:QEW3EUKSRZY3fbXlP7z+SffWkQeXwMAa5K8RQW7NvPE=,tag:DhFxY7xr7H1Wbd527swD0Q==,type:str]",
-		"unencrypted_suffix": "_unencrypted",
-		"version": "3.10.2"
-	}
-}

clanServices/certificates/tests/vm/sops/secrets/server-age.key/users/admin

@@ -1 +0,0 @@
-../../../users/admin

clanServices/certificates/tests/vm/vars/per-machine/ca/state-version/version/value

@@ -1 +0,0 @@
-25.11

clanServices/certificates/tests/vm/vars/per-machine/ca/step-intermediate-cert/intermediate.crt/value

@@ -1,12 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIBsDCCAVegAwIBAgIQbT1Ivm+uwyf0HNkJfan2BTAKBggqhkjOPQQDAjAXMRUw
-EwYDVQQDEwxDbGFuIFJvb3QgQ0EwHhcNMjUwOTAxMjA0MzAzWhcNMjYwOTAyMDg0
-MzAzWjAfMR0wGwYDVQQDExRDbGFuIEludGVybWVkaWF0ZSBDQTBZMBMGByqGSM49
-AgEGCCqGSM49AwEHA0IABDXCNrUIotju9P1U6JxLV43sOxLlRphQJS4dM+lvjTZc
-aQ+HwQg0AHVlQNRwS3JqKrJJtJVyKbZklh6eFaDPoj6jfTB7MA4GA1UdDwEB/wQE
-AwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBRKHaccHgP2ccSWVBWN
-zGoDdTg7aTAfBgNVHSMEGDAWgBSfsnz4phMJx9su/kgeF/FbZQCBgzAVBgNVHR4B
-Af8ECzAJoAcwBYIDZm9vMAoGCCqGSM49BAMCA0cAMEQCICiUDk1zGNzpS/iVKLfW
-zUGaCagpn2mCx4xAXQM9UranAiAn68nVYGWjkzhU31wyCAupxOjw7Bt96XXqIAz9
-hLLtMA==
------END CERTIFICATE-----

clanServices/certificates/tests/vm/vars/per-machine/ca/step-intermediate-key/intermediate.key/machines/ca

@@ -1 +0,0 @@
-../../../../../../sops/machines/ca

clanServices/certificates/tests/vm/vars/per-machine/ca/step-intermediate-key/intermediate.key/secret

@@ -1,19 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:Auonh9fa7jSkld1Zyxw74x5ydj6Xc+0SOgiqumVETNCfner9K96Rmv1PkREuHNGWPsnzyEM3pRT8ijvu3QoKvy9QPCCewyT07Wqe4G74+bk1iMeAHsV3To6kHs6M8OISvE+CmG0+hlLmdfRSabTzyWPLHbOjvFTEEuA5G7xiryacSYOE++eeEHdn+oUDh/IMTcfLjCGMjsXFikx1Hb+ofeRTlCg47+0w4MXVvQkOzQB5V2C694jZXvZ19jd/ioqr8YASz2xatGvqwW6cpZxqOWyZJ0UAj/6yFk6tZWifqVB3wgU=,iv:ITFCrDkeWl4GWCebVq15ei9QmkOLDwUIYojKZ2TU6JU=,tag:8k4iYbCIusUykY79H86WUQ==,type:str]",
-	"sops": {
-		"age": [
-			{
-				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsT25UbjJTQ2tzbnQyUm9p\neWx1UlZIeVpocnBqUCt0YnFlN2FOU25Lb0hNCmdXUUsyalRTbHRRQ0NLSGc1YllV\nUXRwaENhaXU1WmdnVDE0UWprUUUyeDAKLS0tIHV3dHU3aG5JclM0V3FadzN0SU14\ndFptbEJUNXQ4QVlqbkJ1TjAvdDQwSGsKcKPWUjhK7wzIpdIdksMShF2fpLdDTUBS\nZiU7P1T+3psxad9qhapvU0JrAY+9veFaYVEHha2aN/XKs8HqUcTp3A==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1yd2cden7jav8x4nzx2fwze2fsa5j0qm2m3t7zum765z3u4gj433q7dqj43",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjZFVteVZwVGVmRE9NT3hG\nNGMyS3FSaXluM1FpeUp6SDVMUEpwYzg5SmdvCkRPU0QyU1JicGNkdlMyQWVkT0k3\nL2YrbDhWeGk4WFhxcUFmTmhZQ0pEQncKLS0tIG85Ui9rKzBJQ2VkMFBUQTMvSTlu\nbm8rZ09Wa24rQkNvTTNtYTZBN3MrZlkK7cjNhlUKZdOrRq/nKUsbUQgNTzX8jO+0\nzADpz6WCMvsJ15xazc10BGh03OtdMWl5tcoWMaZ71HWtI9Gip5DH0w==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2025-09-02T08:42:42Z",
-		"mac": "ENC[AES256_GCM,data:9xlO5Yis8DG/y8GjvP63NltD4xEL7zqdHL2cQE8gAoh/ZamAmK5ZL0ld80mB3eIYEPKZYvmUYI4Lkrge2ZdqyDoubrW+eJ3dxn9+StxA9FzXYwUE0t+bbsNJfOOp/kDojf060qLGsu0kAGKd2ca4WiDccR0Cieky335C7Zzhi/Q=,iv:bWQ4wr0CJHSN+6ipUbkYTDWZJyFQjDKszfpVX9EEUsY=,tag:kADIFgJBEGCvr5fPbbdEDA==,type:str]",
-		"unencrypted_suffix": "_unencrypted",
-		"version": "3.10.2"
-	}
-}

clanServices/certificates/tests/vm/vars/per-machine/ca/step-intermediate-key/intermediate.key/users/admin

@@ -1 +0,0 @@
-../../../../../../sops/users/admin

clanServices/certificates/tests/vm/vars/per-machine/client/state-version/version/value

@@ -1 +0,0 @@
-25.11

clanServices/certificates/tests/vm/vars/per-machine/server/state-version/version/value

@@ -1 +0,0 @@
-25.11

clanServices/certificates/tests/vm/vars/shared/step-ca/ca.crt/value

@@ -1,10 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIBcTCCARigAwIBAgIRAIix99+AE7Y+uyiLGaRHEhUwCgYIKoZIzj0EAwIwFzEV
-MBMGA1UEAxMMQ2xhbiBSb290IENBMB4XDTI1MDkwMTIwNDI1N1oXDTI2MDkwMjA4
-NDI1N1owFzEVMBMGA1UEAxMMQ2xhbiBSb290IENBMFkwEwYHKoZIzj0CAQYIKoZI
-zj0DAQcDQgAEk7nn9kzxI+xkRmNMlxD+7T78UqV3aqus0foJh6uu1CHC+XaebMcw
-JN95nAe3oYA3yZG6Mnq9nCxsYha4EhzGYqNFMEMwDgYDVR0PAQH/BAQDAgEGMBIG
-A1UdEwEB/wQIMAYBAf8CAQEwHQYDVR0OBBYEFJ+yfPimEwnH2y7+SB4X8VtlAIGD
-MAoGCCqGSM49BAMCA0cAMEQCIBId/CcbT5MPFL90xa+XQz+gVTdRwsu6Bg7ehMso
-Bj0oAiBjSlttd5yeuZGXBm+O0Gl+WdKV60QlrWutNewXFS4UpQ==
------END CERTIFICATE-----

clanServices/certificates/tests/vm/vars/shared/step-ca/ca.key/secret

@@ -1,15 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:PnEXteU3I7U0OKgE+oR3xjHdLWYTpJjM/jlzxtGU0uP2pUBuQv3LxtEz+cP0ZsafHLNq2iNJ7xpUEE0g4d3M296S56oSocK3fREWBiJFiaC7SAEUiil1l3UCwHn7LzmdEmn8Kq7T+FK89wwqtVWIASLo2gZC/yHE5eEanEATTchGLSNiHJRzZ8n0Ekm8EFUA6czOqA5nPQHaSmeLzu1g80lSSi1ICly6dJksa6DVucwOyVFYFEeq8Dfyc1eyP8L1ee0D7QFYBMduYOXTKPtNnyDmdaQMj7cMMvE7fn04idIiAqw=,iv:nvLmAfFk2GXnnUy+Afr648R60Ou13eu9UKykkiA8Y+4=,tag:lTTAxfG0EDCU6u7xlW6xSQ==,type:str]",
-	"sops": {
-		"age": [
-			{
-				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEMjNWUm5NbktQeTRWRjJE\nWWFZc2Rsa3I5aitPSno1WnhORENNcng5OHprCjNUQVhBVHFBcWFjaW5UdmxKTnZw\nQlI4MDk5Wkp0RElCeWgzZ2dFQkF2dkkKLS0tIDVreTkydnJ0RDdHSHlQeVV6bGlP\nTmpJOVBSb2dkVS9TZG5SRmFjdnQ1b3cKQ5XvwH1jD4XPVs5RzOotBDq8kiE6S5k2\nDBv6ugjsM5qV7/oGP9H69aSB4jKPZjEn3yiNw++Oorc8uXd5kSGh7w==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2025-09-02T08:43:00Z",
-		"mac": "ENC[AES256_GCM,data:3jFf66UyZUWEtPdPu809LCS3K/Hc6zbnluystl3eXS+KGI+dCoYmN9hQruRNBRxf6jli2RIlArmmEPBDQVt67gG/qugTdT12krWnYAZ78iocmOnkf44fWxn/pqVnn4JYpjEYRgy8ueGDnUkwvpGWVZpcXw5659YeDQuYOJ2mq0U=,iv:3k7fBPrABdLItQ2Z+Mx8Nx0eIEKo93zG/23K+Q5Hl3I=,tag:aehAObdx//DEjbKlOeM7iQ==,type:str]",
-		"unencrypted_suffix": "_unencrypted",
-		"version": "3.10.2"
-	}
-}

clanServices/certificates/tests/vm/vars/shared/step-ca/ca.key/users/admin

@@ -1 +0,0 @@
-../../../../../sops/users/admin

clanServices/coredns/README.md

@@ -1,70 +0,0 @@
-This module enables hosting clan-internal services easily, which can be resolved
-inside your VPN. This allows defining a custom top-level domain (e.g. `.clan`)
-and exposing endpoints from a machine to others, which will be
-accessible under `http://<service>.clan` in your browser.
-
-The service consists of two roles:
-
-- A `server` role: This is the DNS-server that will be queried when trying to
-  resolve clan-internal services. It defines the top-level domain.
-- A `default` role: This does two things. First, it sets up the nameservers so
-  that clan-internal queries are resolved via the `server` machine, while
-  external queries are resolved as normal via DHCP. Second, it allows exposing
-  services (see example below).
-
-## Example Usage
-
-Here the machine `dnsserver` is designated as internal DNS-server for the TLD
-`.foo`. `server01` will host an application that shall be reachable at
-`http://one.foo` and `server02` is going to be reachable at `http://two.foo`.
-`client` is any other machine that is part of the clan but does not host any
-services.
-
-When `client` tries to resolve `http://one.foo`, the DNS query will be
-routed to `dnsserver`, which will answer with `192.168.1.3`. If it tries to
-resolve some external domain (e.g. `https://clan.lol`), the query will not be
-routed to `dnsserver` but resolved as before, via the nameservers advertised by
-DHCP.
-
-```nix
-inventory = {
-
-  machines = {
-    dnsserver = { }; # 192.168.1.2
-    server01 = { };  # 192.168.1.3
-    server02 = { };  # 192.168.1.4
-    client = { };    # 192.168.1.5
-  };
-
-  instances = {
-    coredns = {
-
-      module.name = "@clan/coredns";
-      module.input = "self";
-
-      # Add the default role to all machines, including `client`
-      roles.default.tags.all = { };
-
-      # DNS server queries to http://<name>.foo are resolved here
-      roles.server.machines."dnsserver".settings = {
-        ip = "192.168.1.2";
-        tld = "foo";
-      };
-
-      # First service
-      # Registers http://one.foo will resolve to 192.168.1.3
-      # underlying service runs on server01
-      roles.default.machines."server01".settings = {
-        ip = "192.168.1.3";
-        services = [ "one" ];
-      };
-
-      # Second service
-      roles.default.machines."server02".settings = {
-        ip = "192.168.1.4";
-        services = [ "two" ];
-      };
-    };
-  };
-};
-```

clanServices/coredns/default.nix

@@ -1,177 +0,0 @@
-{ ... }:
-
-{
-  _class = "clan.service";
-  manifest.name = "coredns";
-  manifest.description = "Clan-internal DNS and service exposure";
-  manifest.categories = [ "Network" ];
-  manifest.readme = builtins.readFile ./README.md;
-
-  roles.server = {
-    description = "A DNS server that resolves services in the clan network.";
-    interface =
-      { lib, ... }:
-      {
-        options.tld = lib.mkOption {
-          type = lib.types.str;
-          default = "clan";
-          description = ''
-            Top-level domain for this instance. All services below this will be
-            resolved internally.
-          '';
-        };
-
-        options.ip = lib.mkOption {
-          type = lib.types.str;
-          # TODO: Set a default
-          description = "IP for the DNS to listen on";
-        };
-
-        options.dnsPort = lib.mkOption {
-          type = lib.types.int;
-          default = 1053;
-          description = "Port of the clan-internal DNS server";
-        };
-      };
-
-    perInstance =
-      {
-        roles,
-        settings,
-        ...
-      }:
-      {
-        nixosModule =
-          {
-            lib,
-            pkgs,
-            ...
-          }:
-          {
-
-            networking.firewall.allowedTCPPorts = [ settings.dnsPort ];
-            networking.firewall.allowedUDPPorts = [ settings.dnsPort ];
-
-            services.coredns =
-              let
-
-                # Get all service entries for one host
-                hostServiceEntries =
-                  host:
-                  lib.strings.concatStringsSep "\n" (
-                    map (
-                      service: "${service} IN A ${roles.default.machines.${host}.settings.ip}   ; ${host}"
-                    ) roles.default.machines.${host}.settings.services
-                  );
-
-                zonefile = pkgs.writeTextFile {
-                  name = "db.${settings.tld}";
-                  text = ''
-                    $TTL 3600
-                    @   IN SOA  ns.${settings.tld}. admin.${settings.tld}. 1 7200 3600 1209600 3600
-                        IN NS   ns.${settings.tld}.
-                    ns  IN A    ${settings.ip}   ; DNS server
-
-                  ''
-                  + (lib.strings.concatStringsSep "\n" (
-                    map (host: hostServiceEntries host) (lib.attrNames roles.default.machines)
-                  ));
-                };
-
-              in
-              {
-                enable = true;
-                config =
-
-                  let
-                    dnsPort = builtins.toString settings.dnsPort;
-                  in
-
-                  ''
-                    .:${dnsPort} {
-                        forward . 1.1.1.1
-                        cache 30
-                    }
-
-                    ${settings.tld}:${dnsPort} {
-                        file ${zonefile}
-                    }
-                  '';
-              };
-          };
-      };
-  };
-
-  roles.default = {
-    description = "A machine that registers the 'server' role as resolver and registers services under the configured TLD in the resolver.";
-    interface =
-      { lib, ... }:
-      {
-        options.services = lib.mkOption {
-          type = lib.types.listOf lib.types.str;
-          default = [ ];
-          description = ''
-            Service endpoints this host exposes (without TLD). Each entry will
-            be resolved to <entry>.<tld> using the configured top-level domain.
-          '';
-        };
-
-        options.ip = lib.mkOption {
-          type = lib.types.str;
-          # TODO: Set a default
-          description = "IP on which the services will listen";
-        };
-
-        options.dnsPort = lib.mkOption {
-          type = lib.types.int;
-          default = 1053;
-          description = "Port of the clan-internal DNS server";
-        };
-      };
-
-    perInstance =
-      { roles, settings, ... }:
-      {
-        nixosModule =
-          { lib, ... }:
-          {
-
-            networking.nameservers = map (m: "127.0.0.1:5353#${roles.server.machines.${m}.settings.tld}") (
-              lib.attrNames roles.server.machines
-            );
-
-            services.resolved.domains = map (m: "~${roles.server.machines.${m}.settings.tld}") (
-              lib.attrNames roles.server.machines
-            );
-
-            services.unbound = {
-              enable = true;
-              settings = {
-                server = {
-                  port = 5353;
-                  verbosity = 2;
-                  interface = [ "127.0.0.1" ];
-                  access-control = [ "127.0.0.0/8 allow" ];
-                  do-not-query-localhost = "no";
-                  domain-insecure = map (m: "${roles.server.machines.${m}.settings.tld}.") (
-                    lib.attrNames roles.server.machines
-                  );
-                };
-
-                # Default: forward everything else to DHCP-provided resolvers
-                forward-zone = [
-                  {
-                    name = ".";
-                    forward-addr = "127.0.0.53@53"; # Forward to systemd-resolved
-                  }
-                ];
-                stub-zone = map (m: {
-                  name = "${roles.server.machines.${m}.settings.tld}.";
-                  stub-addr = "${roles.server.machines.${m}.settings.ip}@${builtins.toString settings.dnsPort}";
-                }) (lib.attrNames roles.server.machines);
-              };
-            };
-          };
-      };
-  };
-}

clanServices/coredns/flake-module.nix

@@ -1,18 +0,0 @@
-{ ... }:
-let
-  module = ./default.nix;
-in
-{
-  clan.modules = {
-    coredns = module;
-  };
-  perSystem =
-    { ... }:
-    {
-      clan.nixosTests.coredns = {
-        imports = [ ./tests/vm/default.nix ];
-
-        clan.modules."@clan/coredns" = module;
-      };
-    };
-}

clanServices/coredns/tests/vm/default.nix

@@ -1,110 +0,0 @@
-{
-  ...
-}:
-{
-  name = "coredns";
-
-  clan = {
-    directory = ./.;
-    test.useContainers = true;
-    inventory = {
-
-      machines = {
-        dns = { }; # 192.168.1.2
-        server01 = { }; # 192.168.1.3
-        server02 = { }; # 192.168.1.4
-        client = { }; # 192.168.1.1
-      };
-
-      instances = {
-        coredns = {
-
-          module.name = "@clan/coredns";
-          module.input = "self";
-
-          roles.default.tags.all = { };
-
-          # First service
-          roles.default.machines."server01".settings = {
-            ip = "192.168.1.3";
-            services = [ "one" ];
-          };
-
-          # Second service
-          roles.default.machines."server02".settings = {
-            ip = "192.168.1.4";
-            services = [ "two" ];
-          };
-
-          # DNS server
-          roles.server.machines."dns".settings = {
-            ip = "192.168.1.2";
-            tld = "foo";
-          };
-        };
-      };
-    };
-  };
-
-  nodes = {
-    dns =
-      { pkgs, ... }:
-      {
-        environment.systemPackages = [ pkgs.net-tools ];
-      };
-
-    client =
-      { pkgs, ... }:
-      {
-        environment.systemPackages = [ pkgs.net-tools ];
-      };
-
-    server01 = {
-      services.nginx = {
-        enable = true;
-        virtualHosts."one.foo" = {
-          locations."/" = {
-            return = "200 'test server response one'";
-            extraConfig = "add_header Content-Type text/plain;";
-          };
-        };
-      };
-    };
-    server02 = {
-      services.nginx = {
-        enable = true;
-        virtualHosts."two.foo" = {
-          locations."/" = {
-            return = "200 'test server response two'";
-            extraConfig = "add_header Content-Type text/plain;";
-          };
-        };
-      };
-    };
-  };
-
-  testScript = ''
-    import json
-    start_all()
-
-    machines = [server01, server02, dns, client]
-
-    for m in machines:
-        m.systemctl("start network-online.target")
-
-    for m in machines:
-        m.wait_for_unit("network-online.target")
-
-    # This should work, but is borken in tests i think? Instead we dig directly
-
-    # client.succeed("curl -k -v http://one.foo")
-    # client.succeed("curl -k -v http://two.foo")
-
-    answer = client.succeed("dig @192.168.1.2 -p 1053 one.foo")
-    assert "192.168.1.3" in answer, "IP not found"
-
-    answer = client.succeed("dig @192.168.1.2 -p 1053 two.foo")
-    assert "192.168.1.4" in answer, "IP not found"
-
-  '';
-}

clanServices/coredns/tests/vm/sops/users/admin/key.json

@@ -1,4 +0,0 @@
-{
-  "publickey": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
-  "type": "age"
-}

clanServices/data-mesher/admin.nix

@@ -0,0 +1,29 @@
+{
+  lib,
+  config,
+  settings,
+  ...
+}:
+{
+
+  services.data-mesher.initNetwork =
+    let
+      # for a given machine, read it's public key and remove any new lines
+      readHostKey =
+        machine:
+        let
+          path = "${config.clan.core.settings.directory}/vars/per-machine/${machine}/data-mesher-host-key/public_key/value";
+        in
+        builtins.elemAt (lib.splitString "\n" (builtins.readFile path)) 1;
+    in
+    {
+      enable = true;
+      keyPath = config.clan.core.vars.generators.data-mesher-network-key.files.private_key.path;
+
+      tld = settings.network.tld;
+      hostTTL = settings.network.hostTTL;
+
+      # admin and signer host public keys
+      signingKeys = builtins.map readHostKey (builtins.attrNames settings.bootstrapNodes);
+    };
+}

clanServices/data-mesher/default.nix

@@ -1,22 +1,35 @@
-{
+{ ... }:
-  clanLib,
-  ...
-}:
 let
   sharedInterface =
     { lib, ... }:
     {
       options = {
         bootstrapNodes = lib.mkOption {
-          type = lib.types.nullOr (lib.types.listOf lib.types.str);
+          type = lib.types.nullOr (lib.types.attrsOf lib.types.str);
+          # the default bootstrap nodes are any machines with the admin or signers role
+          # we iterate through those machines, determining an IP address for them based on their VPN
+          # currently only supports zerotier
+          # default = builtins.foldl' (
+          #   urls: name:
+          #   let
+          #     ipPath = "${config.clan.core.settings.directory}/vars/per-machine/${name}/zerotier/zerotier-ip/value";
+          #   in
+          #   if builtins.pathExists ipPath then
+          #     let
+          #       ip = builtins.readFile ipPath;
+          #     in
+          #     urls ++ [ "[${ip}]:${builtins.toString settings.network.port}" ]
+          #   else
+          #     urls
+          # ) [ ] (dmLib.machines config).bootstrap;
           description = ''
             A list of bootstrap nodes that act as an initial gateway when joining
             the cluster.
           '';
-          example = [
+          example = {
-            "192.168.1.1:7946"
+            "node1" = "192.168.1.1:7946";
-            "192.168.1.2:7946"
+            "node2" = "192.168.1.2:7946";
-          ];
+          };
         };
 
         network = {
@@ -42,59 +55,6 @@ let
         };
       };
     };
-
-  mkBootstrapNodes =
-    {
-      config,
-      lib,
-      roles,
-      settings,
-    }:
-    lib.mkDefault (
-      builtins.foldl' (
-        urls: name:
-        let
-          ip = clanLib.vars.getPublicValue {
-            flake = config.clan.core.settings.directory;
-            machine = name;
-            generator = "zerotier";
-            file = "zerotier-ip";
-            default = null;
-          };
-        in
-        if ip != null then urls ++ [ "[${ip}]:${builtins.toString settings.network.port}" ] else urls
-      ) [ ] (builtins.attrNames ((roles.admin.machines or { }) // (roles.signer.machines or { })))
-    );
-
-  mkDmService = dmSettings: config: {
-    enable = true;
-    openFirewall = true;
-
-    settings = {
-      log_level = "warn";
-      state_dir = "/var/lib/data-mesher";
-
-      # read network id from vars
-      network.id = config.clan.core.vars.generators.data-mesher-network-key.files.public_key.value;
-
-      host = {
-        names = [ config.networking.hostName ];
-        key_path = config.clan.core.vars.generators.data-mesher-host-key.files.private_key.path;
-      };
-
-      cluster = {
-        port = dmSettings.network.port;
-        join_interval = "30s";
-        push_pull_interval = "30s";
-        interface = dmSettings.network.interface;
-        bootstrap_nodes = dmSettings.bootstrapNodes;
-      };
-
-      http.port = 7331;
-      http.interface = "lo";
-    };
-  };
-
 in
 {
   _class = "clan.service";
@@ -104,13 +64,14 @@ in
   manifest.readme = builtins.readFile ./README.md;
 
   roles.admin = {
-    description = "A data-mesher admin node that bootstraps the network and can sign new nodes into the network.";
     interface =
       { lib, ... }:
       {
+
         imports = [ sharedInterface ];
 
         options = {
+
           network = {
             tld = lib.mkOption {
               type = lib.types.str;
@@ -128,124 +89,54 @@ in
         };
       };
     perInstance =
+      { settings, roles, ... }:
       {
-        extendSettings,
+        nixosModule = {
-        roles,
+          imports = [
-        lib,
+            ./admin.nix
-        ...
+            ./shared.nix
-      }:
+          ];
-      {
+          _module.args = { inherit settings roles; };
-        nixosModule =
-          { config, ... }:
-          let
-            settings = extendSettings {
-              bootstrapNodes = mkBootstrapNodes {
-                inherit
-                  config
-                  lib
-                  roles
-                  settings
-                  ;
-              };
-            };
-          in
-          {
-            imports = [ ./shared.nix ];
-
-            services.data-mesher = (mkDmService settings config) // {
-              initNetwork =
-                let
-                  # for a given machine, read it's public key and remove any new lines
-                  readHostKey =
-                    machine:
-                    let
-                      publicKey = clanLib.vars.getPublicValue {
-                        flake = config.clan.core.settings.directory;
-                        inherit machine;
-                        generator = "data-mesher-host-key";
-                        file = "public_key";
-                      };
-                    in
-                    builtins.elemAt (lib.splitString "\n" publicKey) 1;
-                in
-                {
-                  enable = true;
-                  keyPath = config.clan.core.vars.generators.data-mesher-network-key.files.private_key.path;
-
-                  tld = settings.network.tld;
-                  hostTTL = settings.network.hostTTL;
-
-                  # admin and signer host public keys
-                  signingKeys = builtins.map readHostKey (
-                    builtins.attrNames ((roles.admin.machines or { }) // (roles.signer.machines or { }))
-                  );
-                };
-            };
         };
       };
   };
 
   roles.signer = {
-    description = "A data-mesher signer node that can sign new nodes into the network.";
+    interface =
-    interface = sharedInterface;
+      { ... }:
+      {
+        imports = [ sharedInterface ];
+      };
     perInstance =
+      { settings, roles, ... }:
       {
-        extendSettings,
+        nixosModule = {
-        lib,
+          imports = [
-        roles,
+            ./signer.nix
-        ...
+            ./shared.nix
-      }:
+          ];
-      {
+          _module.args = { inherit settings roles; };
-        nixosModule =
-          { config, ... }:
-          let
-            settings = extendSettings {
-              bootstrapNodes = mkBootstrapNodes {
-                inherit
-                  config
-                  lib
-                  roles
-                  settings
-                  ;
-              };
-            };
-          in
-          {
-            imports = [ ./shared.nix ];
-            services.data-mesher = (mkDmService settings config);
         };
       };
   };
 
   roles.peer = {
-    description = "A data-mesher peer node that connects to the network.";
+    interface =
-    interface = sharedInterface;
+      { ... }:
+      {
+        imports = [ sharedInterface ];
+      };
     perInstance =
+      { settings, roles, ... }:
       {
-        extendSettings,
+        nixosModule = {
-        lib,
+          imports = [
-        roles,
+            ./peer.nix
-        ...
+            ./shared.nix
-      }:
+          ];
-      {
+          _module.args = { inherit settings roles; };
-        nixosModule =
-          { config, ... }:
-          let
-            settings = extendSettings {
-              bootstrapNodes = mkBootstrapNodes {
-                inherit
-                  config
-                  lib
-                  roles
-                  settings
-                  ;
-              };
-            };
-          in
-          {
-            imports = [ ./shared.nix ];
-            services.data-mesher = (mkDmService settings config);
         };
       };
   };
+
 }

clanServices/data-mesher/flake-module.nix

@@ -1,6 +1,6 @@
-{ ... }:
+{ lib, ... }:
 let
-  module = ./default.nix;
+  module = lib.modules.importApply ./default.nix { };
 in
 {
   clan.modules = {
@@ -9,7 +9,7 @@ in
   perSystem =
     { ... }:
     {
-      clan.nixosTests.data-mesher = {
+      clan.nixosTests.service-data-mesher = {
         imports = [ ./tests/vm/default.nix ];
         clan.modules."@clan/data-mesher" = module;
       };

clanServices/data-mesher/shared.nix

@@ -1,9 +1,39 @@
 {
   config,
+  settings,
   ...
 }:
 {
 
+  services.data-mesher = {
+    enable = true;
+    openFirewall = true;
+
+    settings = {
+      log_level = "warn";
+      state_dir = "/var/lib/data-mesher";
+
+      # read network id from vars
+      network.id = config.clan.core.vars.generators.data-mesher-network-key.files.public_key.value;
+
+      host = {
+        names = [ config.networking.hostName ];
+        key_path = config.clan.core.vars.generators.data-mesher-host-key.files.private_key.path;
+      };
+
+      cluster = {
+        port = settings.network.port;
+        join_interval = "30s";
+        push_pull_interval = "30s";
+        interface = settings.network.interface;
+        bootstrap_nodes = (builtins.attrValues settings.bootstrapNodes);
+      };
+
+      http.port = 7331;
+      http.interface = "lo";
+    };
+  };
+
   # Generate host key.
   clan.core.vars.generators.data-mesher-host-key = {
     files =

clanServices/data-mesher/tests/vm/default.nix

@@ -2,7 +2,7 @@
   ...
 }:
 {
-  name = "data-mesher";
+  name = "service-data-mesher";
 
   clan = {
     directory = ./.;
@@ -16,11 +16,11 @@
       instances = {
         data-mesher =
           let
-            bootstrapNodes = [
+            bootstrapNodes = {
-              "[2001:db8:1::1]:7946" # admin
+              admin = "[2001:db8:1::1]:7946";
-              "[2001:db8:1::2]:7946" # peer
+              peer = "[2001:db8:1::2]:7946";
-              # "2001:db8:1::3:7946" #signer
+              # signer = "2001:db8:1::3:7946";
-            ];
+            };
           in
           {
             roles.peer.machines.peer.settings = {

clanServices/data-mesher/tests/vm/vars/per-machine/admin/state-version/version/value

@@ -1 +0,0 @@
-25.11

clanServices/data-mesher/tests/vm/vars/per-machine/peer/state-version/version/value

@@ -1 +0,0 @@
-25.11

clanServices/data-mesher/tests/vm/vars/per-machine/signer/state-version/version/value

@@ -1 +0,0 @@
-25.11

clanServices/dyndns/README.md

@@ -1,86 +0,0 @@
-
-A Dynamic-DNS (DDNS) service continuously keeps one or more DNS records in sync with the current public IP address of your machine.  
-In *clan* this service is backed by [qdm12/ddns-updater](https://github.com/qdm12/ddns-updater).
-
-> Info  
-> ddns-updater itself is **heavily opinionated and version-specific**. Whenever you need the exhaustive list of flags or
-> provider-specific fields refer to its *versioned* documentation – **not** the GitHub README
----
-
-# 1. Configuration model
-
-Internally ddns-updater consumes a single file named `config.json`.  
-A minimal configuration for the registrar *Namecheap* looks like:
-
-```json
-{
-  "settings": [
-    {
-      "provider": "namecheap",
-      "domain": "sub.example.com",
-      "password": "e5322165c1d74692bfa6d807100c0310"
-    }
-  ]
-}
-```
-
-Another example for *Porkbun*:
-
-```json
-{
-  "settings": [
-    {
-      "provider": "porkbun",
-      "domain": "domain.com",
-      "api_key": "sk1_…",
-      "secret_api_key": "pk1_…",
-      "ip_version": "ipv4",
-      "ipv6_suffix": ""
-    }
-  ]
-}
-```
-
-When you write a `clan.nix` the **common** fields (`provider`, `domain`, `period`, …) are already exposed as typed
-*Nix options*.  
-Registrar-specific or very new keys can be passed through an open attribute set called **extraSettings**.
-
----
-
-# 2. Full Porkbun example
-
-Manage three records – `@`, `home` and `test` – of the domain
-`jon.blog` and refresh them every 15 minutes:
-
-```nix title="clan.nix" hl_lines="10-11"
-inventory.instances = {
-  dyndns = {
-    roles.default.machines."jon" = { };
-    roles.default.settings = {
-      period   = 15;                # minutes
-      settings = {
-        "all-jon-blog" = {
-          provider         = "porkbun";
-          domain           = "jon.blog";
-
-          # (1) tell the secret-manager which key we are going to store
-          secret_field_name = "secret_api_key";
-
-          # everything below is copied verbatim into config.json
-          extraSettings = {
-            host         = "@,home,test";   # (2) comma-separated list of sub-domains
-            ip_version   = "ipv4";
-            ipv6_suffix  = "";
-            api_key      = "pk1_4bb2b231275a02fdc23b7e6f3552s01S213S"; # (3) public – safe to commit
-          };
-        };
-      };
-    };
-  };
-};
-```
-
-1. `secret_field_name` tells the *vars-generator* to store the entered secret under the specified JSON field name in the configuration.
-2. ddns-updater allows multiple hosts by separating them with a comma.
-3. The `api_key` above is *public*; the corresponding **private key** is retrieved through `secret_field_name`.
-

clanServices/dyndns/default.nix

@@ -1,278 +0,0 @@
-{ ... }:
-{
-  _class = "clan.service";
-  manifest.name = "clan-core/dyndns";
-  manifest.description = "A dynamic DNS service to auto update domain IPs";
-  manifest.categories = [ "Network" ];
-  manifest.readme = builtins.readFile ./README.md;
-
-  roles.default = {
-    description = "Placeholder role to apply the dyndns service";
-    interface =
-      { lib, ... }:
-      {
-        options = {
-          server = {
-            enable = lib.mkEnableOption "dyndns webserver";
-            domain = lib.mkOption {
-              type = lib.types.str;
-              description = "Domain to serve the webservice on";
-            };
-            port = lib.mkOption {
-              type = lib.types.int;
-              default = 54805;
-              description = "Port to listen on";
-            };
-            acmeEmail = lib.mkOption {
-              type = lib.types.str;
-              description = ''
-                Email address for account creation and correspondence from the CA.
-                It is recommended to use the same email for all certs to avoid account
-                creation limits.
-              '';
-            };
-          };
-
-          period = lib.mkOption {
-            type = lib.types.int;
-            default = 5;
-            description = "Domain update period in minutes";
-          };
-
-          settings = lib.mkOption {
-            type = lib.types.attrsOf (
-              lib.types.submodule (
-                { ... }:
-                {
-                  options = {
-                    provider = lib.mkOption {
-                      example = "namecheap";
-                      type = lib.types.str;
-                      description = "The dyndns provider to use";
-                    };
-                    domain = lib.mkOption {
-                      type = lib.types.str;
-                      example = "example.com";
-                      description = "The top level domain to update.";
-                    };
-                    secret_field_name = lib.mkOption {
-                      example = "api_key";
-
-                      type = lib.types.enum [
-                        "password"
-                        "token"
-                        "api_key"
-                        "secret_api_key"
-                      ];
-                      default = "password";
-                      description = "The field name for the secret";
-                    };
-                    extraSettings = lib.mkOption {
-                      type = lib.types.attrsOf lib.types.str;
-                      default = { };
-                      description = ''
-                        Extra settings for the provider.
-                        Provider specific settings: https://github.com/qdm12/ddns-updater#configuration
-                      '';
-                    };
-                  };
-                }
-              )
-            );
-            default = { };
-            description = "Configuration for which domains to update";
-          };
-        };
-      };
-
-    perInstance =
-      { settings, ... }:
-      {
-        nixosModule =
-          {
-            config,
-            lib,
-            pkgs,
-            ...
-          }:
-          let
-            name = "dyndns";
-            cfg = settings;
-
-            # We dedup secrets if they have the same provider + base domain
-            secret_id = opt: "${name}-${opt.provider}-${opt.domain}";
-            secret_path =
-              opt: config.clan.core.vars.generators."${secret_id opt}".files."${secret_id opt}".path;
-
-            # We check that a secret has not been set in extraSettings.
-            extraSettingsSafe =
-              opt:
-              if (builtins.hasAttr opt.secret_field_name opt.extraSettings) then
-                throw "Please do not set ${opt.secret_field_name} in extraSettings, it is automatically set by the dyndns module."
-              else
-                opt.extraSettings;
-
-            service_config = {
-              settings = builtins.catAttrs "value" (
-                builtins.attrValues (
-                  lib.mapAttrs (_: opt: {
-                    value =
-                      (extraSettingsSafe opt)
-                      // {
-                        domain = opt.domain;
-                        provider = opt.provider;
-                      }
-                      // {
-                        "${opt.secret_field_name}" = secret_id opt;
-                      };
-                  }) cfg.settings
-                )
-              );
-            };
-
-            secret_generator = _: opt: {
-              name = secret_id opt;
-              value = {
-                share = true;
-                migrateFact = "${secret_id opt}";
-                prompts.${secret_id opt} = {
-                  type = "hidden";
-                  persist = true;
-                };
-              };
-            };
-          in
-          {
-            imports = lib.optional cfg.server.enable (
-              lib.modules.importApply ./nginx.nix {
-                inherit config;
-                inherit settings;
-                inherit lib;
-              }
-            );
-
-            clan.core.vars.generators = lib.mkIf (cfg.settings != { }) (
-              lib.mapAttrs' secret_generator cfg.settings
-            );
-
-            users.groups.${name} = lib.mkIf (cfg.settings != { }) { };
-            users.users.${name} = lib.mkIf (cfg.settings != { }) {
-              group = name;
-              isSystemUser = true;
-              description = "User for ${name} service";
-              home = "/var/lib/${name}";
-              createHome = true;
-            };
-
-            services.nginx = lib.mkIf cfg.server.enable {
-              virtualHosts = {
-                "${cfg.server.domain}" = {
-                  forceSSL = true;
-                  enableACME = true;
-                  locations."/" = {
-                    proxyPass = "http://localhost:${toString cfg.server.port}";
-                  };
-                };
-              };
-            };
-
-            systemd.services.${name} = lib.mkIf (cfg.settings != { }) {
-              path = [ ];
-              description = "Dynamic DNS updater";
-              after = [ "network.target" ];
-              wantedBy = [ "multi-user.target" ];
-              environment = {
-                MYCONFIG = "${builtins.toJSON service_config}";
-                SERVER_ENABLED = if cfg.server.enable then "yes" else "no";
-                PERIOD = "${toString cfg.period}m";
-                LISTENING_ADDRESS = ":${toString cfg.server.port}";
-                GODEBUG = "netdns=go"; # We need to set this untill this has been merged. https://github.com/NixOS/nixpkgs/pull/432758
-              };
-
-              serviceConfig =
-                let
-                  pyscript =
-                    pkgs.writers.writePython3Bin "generate_secret_config.py"
-                      {
-                        libraries = [ ];
-                        doCheck = false;
-                      }
-                      ''
-                        import json
-                        from pathlib import Path
-                        import os
-
-                        cred_dir = Path(os.getenv("CREDENTIALS_DIRECTORY"))
-                        config_str = os.getenv("MYCONFIG")
-
-
-                        def get_credential(name):
-                            secret_p = cred_dir / name
-                            with open(secret_p, 'r') as f:
-                                return f.read().strip()
-
-
-                        config = json.loads(config_str)
-                        print(f"Config: {config}")
-                        for attrset in config["settings"]:
-                            if "password" in attrset:
-                                attrset['password'] = get_credential(attrset['password'])
-                            elif "token" in attrset:
-                                attrset['token'] = get_credential(attrset['token'])
-                            elif "secret_api_key" in attrset:
-                                attrset['secret_api_key'] = get_credential(attrset['secret_api_key'])
-                            elif "api_key" in attrset:
-                                attrset['api_key'] = get_credential(attrset['api_key'])
-                            else:
-                                raise ValueError(f"Missing secret field in {attrset}")
-
-                        # create directory data if it does not exist
-                        data_dir = Path('data')
-                        data_dir.mkdir(mode=0o770, exist_ok=True)
-
-                        # Create a temporary config file
-                        # with appropriate permissions
-                        tmp_config_path = data_dir / '.config.json'
-                        tmp_config_path.touch(mode=0o660, exist_ok=False)
-
-                        # Write the config with secrets back
-                        with open(tmp_config_path, 'w') as f:
-                            f.write(json.dumps(config, indent=4))
-
-                        # Move config into place
-                        config_path = data_dir / 'config.json'
-                        tmp_config_path.rename(config_path)
-
-                        # Set file permissions to read
-                        # and write only by the user and group
-                        for file in data_dir.iterdir():
-                            file.chmod(0o660)
-                      '';
-                in
-                {
-                  ExecStartPre = lib.getExe pyscript;
-                  ExecStart = lib.getExe pkgs.ddns-updater;
-                  LoadCredential = lib.mapAttrsToList (_: opt: "${secret_id opt}:${secret_path opt}") cfg.settings;
-                  User = name;
-                  Group = name;
-                  NoNewPrivileges = true;
-                  PrivateTmp = true;
-                  ProtectSystem = "strict";
-                  ReadOnlyPaths = "/";
-                  PrivateDevices = "yes";
-                  ProtectKernelModules = "yes";
-                  ProtectKernelTunables = "yes";
-                  WorkingDirectory = "/var/lib/${name}";
-                  ReadWritePaths = [
-                    "/proc/self"
-                    "/var/lib/${name}"
-                  ];
-
-                  Restart = "always";
-                  RestartSec = 60;
-                };
-            };
-          };
-      };
-  };
-}

clanServices/dyndns/flake-module.nix

@@ -1,19 +0,0 @@
-{ ... }:
-let
-  module = ./default.nix;
-in
-{
-  clan.modules = {
-    dyndns = module;
-  };
-
-  perSystem =
-    { ... }:
-    {
-      clan.nixosTests.dyndns = {
-        imports = [ ./tests/vm/default.nix ];
-
-        clan.modules."@clan/dyndns" = module;
-      };
-    };
-}

clanServices/dyndns/nginx.nix

@@ -1,50 +0,0 @@
-{
-  config,
-  lib,
-  settings,
-  ...
-}:
-{
-  security.acme.acceptTerms = true;
-  security.acme.defaults.email = settings.server.acmeEmail;
-
-  networking.firewall.allowedTCPPorts = [
-    443
-    80
-  ];
-
-  services.nginx = {
-    enable = true;
-
-    statusPage = lib.mkDefault true;
-    recommendedBrotliSettings = lib.mkDefault true;
-    recommendedGzipSettings = lib.mkDefault true;
-    recommendedOptimisation = lib.mkDefault true;
-    recommendedProxySettings = lib.mkDefault true;
-    recommendedTlsSettings = lib.mkDefault true;
-
-    # Nginx sends all the access logs to /var/log/nginx/access.log by default.
-    # instead of going to the journal!
-    commonHttpConfig = "access_log syslog:server=unix:/dev/log;";
-
-    resolver.addresses =
-      let
-        isIPv6 = addr: builtins.match ".*:.*:.*" addr != null;
-        escapeIPv6 = addr: if isIPv6 addr then "[${addr}]" else addr;
-        cloudflare = [
-          "1.1.1.1"
-          "2606:4700:4700::1111"
-        ];
-        resolvers =
-          if config.networking.nameservers == [ ] then cloudflare else config.networking.nameservers;
-      in
-      map escapeIPv6 resolvers;
-
-    sslDhparam = config.security.dhparams.params.nginx.path;
-  };
-
-  security.dhparams = {
-    enable = true;
-    params.nginx = { };
-  };
-}

clanServices/dyndns/tests/vm/default.nix

@@ -1,77 +0,0 @@
-{
-  pkgs,
-  ...
-}:
-{
-  name = "dyndns";
-
-  clan = {
-    directory = ./.;
-    inventory = {
-      machines.server = { };
-
-      instances = {
-        dyndns-test = {
-          module.name = "@clan/dyndns";
-          module.input = "self";
-          roles.default.machines."server".settings = {
-            server = {
-              enable = true;
-              domain = "test.example.com";
-              port = 54805;
-              acmeEmail = "test@example.com";
-            };
-            period = 1;
-            settings = {
-              "test.example.com" = {
-                provider = "namecheap";
-                domain = "example.com";
-                secret_field_name = "password";
-                extraSettings = {
-                  host = "test";
-                  server = "dynamicdns.park-your-domain.com";
-                };
-              };
-            };
-          };
-        };
-      };
-    };
-  };
-
-  nodes = {
-    server = {
-      # Disable firewall for testing
-      networking.firewall.enable = false;
-
-      # Mock ACME for testing (avoid real certificate requests)
-      security.acme.defaults.server = "https://localhost:14000/dir";
-    };
-  };
-
-  testScript = ''
-    start_all()
-
-    # Test that dyndns service starts (will fail without secrets, but that's expected)
-    server.wait_for_unit("multi-user.target")
-
-    # Test that nginx service is running
-    server.wait_for_unit("nginx.service")
-
-    # Test that nginx is listening on expected ports
-    server.wait_for_open_port(80)
-    server.wait_for_open_port(443)
-
-    # Test that the dyndns user was created
-    # server.succeed("getent passwd dyndns")
-    # server.succeed("getent group dyndns")
-    #
-    # Test that the home directory was created
-    server.succeed("test -d /var/lib/dyndns")
-
-    # Test that nginx configuration includes our domain
-    server.succeed("${pkgs.nginx}/bin/nginx -t")
-
-    print("All tests passed!")
-  '';
-}

clanServices/dyndns/tests/vm/sops/machines/server/key.json

@@ -1,6 +0,0 @@
-[
-  {
-    "publickey": "age164wrhlnake7f7duhzs936lq6w49dtg53hcdyxqwxj0agad6tqg2s2u4yta",
-    "type": "age"
-  }
-]

clanServices/dyndns/tests/vm/sops/secrets/server-age.key/secret

@@ -1,14 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:seLxbv590dO0KvMJmtN7WVvUcH27VYwAc3rmyD7q6ZmwCgswOKx55LFnh0stRDKSZa8K7Dq1x7D9adhZtPAMWX8tbJswBeNMPt8=,iv:G52eugxfTi0tTzH4EN4CWmpyv6feSL34++UVSjb0aAo=,tag:6r10/a7kD2hBAmae0nz2OQ==,type:str]",
-	"sops": {
-		"age": [
-			{
-				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHVC8wZUZJYUl5MXVNa2k5\ndGV1MnFWbUNLNVdxeEtCVUc3MTd0ck9aeFFBCnFhZW40amVYc3FlN1FPRTFSWTJR\nQzhNOERKbnRnSlJVeElNSEM5ZUJsZGsKLS0tIG1uNnlNN3MweHlYczNRTW9xSytu\neThzUmxKZTJBT2lCcTdiNUI4N3paTVEKgS9j2/GVt1KBoggUj9d6UK/mIlK4niLQ\nzVq2BHt3irxQpkpGUogXH2b86zSAOEJFzsL1Rk8HM1mogTG8jqf0qA==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2025-10-19T12:49:11Z",
-		"mac": "ENC[AES256_GCM,data:T/2xw2mvUi8YALyxz78qG/g/xguoUTeHNzcZfXwwSyCXMg9ircsGGLO9SOVWy/QNkibnw3Yp80tXNJyr4oJH28PhFH7RrRp8jzNdopF49ZNJb2IqJ3C7xNYRZMHfjOCd/raka+ehZq8YGilEpXUWLRk1ere9lbBMh1ycL7jJS3c=,iv:FZbY/jTNPM+p4qD41FD0K7B9zoppGuvnUY5hL/EkmYM=,tag:IF5QTyUkHXWthlAGBn9R8w==,type:str]",
-		"version": "3.11.0"
-	}
-}

clanServices/dyndns/tests/vm/sops/secrets/server-age.key/users/admin

@@ -1 +0,0 @@
-../../../users/admin

clanServices/dyndns/tests/vm/sops/users/admin/key.json

@@ -1,4 +0,0 @@
-{
-  "publickey": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
-  "type": "age"
-}