don't enable ssh askpass for now if we have a build_host set

.gitea/workflows/create-pr.sh

@@ -1,75 +0,0 @@
-#!/usr/bin/env bash
-# Shared script for creating pull requests in Gitea workflows
-set -euo pipefail
-
-# Required environment variables:
-# - CI_BOT_TOKEN: Gitea bot token for authentication
-# - PR_BRANCH: Branch name for the pull request
-# - PR_TITLE: Title of the pull request
-# - PR_BODY: Body/description of the pull request
-
-if [[ -z "${CI_BOT_TOKEN:-}" ]]; then
-  echo "Error: CI_BOT_TOKEN is not set" >&2
-  exit 1
-fi
-
-if [[ -z "${PR_BRANCH:-}" ]]; then
-  echo "Error: PR_BRANCH is not set" >&2
-  exit 1
-fi
-
-if [[ -z "${PR_TITLE:-}" ]]; then
-  echo "Error: PR_TITLE is not set" >&2
-  exit 1
-fi
-
-if [[ -z "${PR_BODY:-}" ]]; then
-  echo "Error: PR_BODY is not set" >&2
-  exit 1
-fi
-
-# Push the branch
-git push origin "+HEAD:${PR_BRANCH}"
-
-# Create pull request
-resp=$(nix run --inputs-from . nixpkgs#curl -- -X POST \
-  -H "Authorization: token $CI_BOT_TOKEN" \
-  -H "Content-Type: application/json" \
-  -d "{
-    \"head\": \"${PR_BRANCH}\",
-    \"base\": \"main\",
-    \"title\": \"${PR_TITLE}\",
-    \"body\": \"${PR_BODY}\"
-  }" \
-  "https://git.clan.lol/api/v1/repos/clan/clan-core/pulls")
-
-pr_number=$(echo "$resp" | jq -r '.number')
-
-if [[ "$pr_number" == "null" ]]; then
-  echo "Error creating pull request:" >&2
-  echo "$resp" | jq . >&2
-  exit 1
-fi
-
-echo "Created pull request #$pr_number"
-
-# Merge when checks succeed
-while true; do
-  resp=$(nix run --inputs-from . nixpkgs#curl -- -X POST \
-    -H "Authorization: token $CI_BOT_TOKEN" \
-    -H "Content-Type: application/json" \
-    -d '{
-      "Do": "merge",
-      "merge_when_checks_succeed": true,
-      "delete_branch_after_merge": true
-    }' \
-    "https://git.clan.lol/api/v1/repos/clan/clan-core/pulls/$pr_number/merge")
-  msg=$(echo "$resp" | jq -r '.message')
-  if [[ "$msg" != "Please try again later" ]]; then
-    break
-  fi
-  echo "Retrying in 2 seconds..."
-  sleep 2
-done
-
-echo "Pull request #$pr_number merge initiated"

.gitea/workflows/update-clan-core-for-checks.yml

@@ -19,10 +19,35 @@ jobs:
         run: |
           export GIT_AUTHOR_NAME=clan-bot GIT_AUTHOR_EMAIL=clan-bot@clan.lol GIT_COMMITTER_NAME=clan-bot GIT_COMMITTER_EMAIL=clan-bot@clan.lol
           git commit -am "Update pinned clan-core for checks"
+          git push origin +HEAD:update-clan-core-for-checks
+          set -x
+          resp=$(nix run --inputs-from . nixpkgs#curl -- -X POST \
+            -H "Authorization: token $CI_BOT_TOKEN" \
+            -H "Content-Type: application/json" \
+            -d '{
+              "head": "update-clan-core-for-checks",
+              "base": "main",
+              "title": "Update Clan Core for Checks",
+              "body": "This PR updates the pinned clan-core flake input that is used for checks."
+            }' \
+           "https://git.clan.lol/api/v1/repos/clan/clan-core/pulls")
+          pr_number=$(echo "$resp" | jq -r '.number')
 
-          # Use shared PR creation script
-          export PR_BRANCH="update-clan-core-for-checks"
-          export PR_TITLE="Update Clan Core for Checks"
-          export PR_BODY="This PR updates the pinned clan-core flake input that is used for checks."
-
-          ./.gitea/workflows/create-pr.sh
+          # Merge when succeed
+          while true; do
+            resp=$(nix run --inputs-from . nixpkgs#curl -- -X POST \
+              -H "Authorization: token $CI_BOT_TOKEN" \
+              -H "Content-Type: application/json" \
+              -d '{
+                "Do": "merge",
+                "merge_when_checks_succeed": true,
+                "delete_branch_after_merge": true
+              }' \
+              "https://git.clan.lol/api/v1/repos/clan/clan-core/pulls/$pr_number/merge")
+            msg=$(echo $resp | jq -r '.message')
+            if [[ "$msg" != "Please try again later" ]]; then
+              break
+            fi
+            echo "Retrying in 2 seconds..."
+            sleep 2
+          done

.gitea/workflows/update-flake-inputs.yml

@@ -1,27 +0,0 @@
-name: Update Flake Inputs
-
-on:
-  schedule:
-    # Run weekly on Sunday at 4:00 AM UTC
-    - cron: "0 4 * * 0"
-  workflow_dispatch:
-  repository_dispatch:
-
-jobs:
-  update-flake-inputs:
-    runs-on: nix
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Configure git
-        run: |
-          git config --global user.email "clan-bot@clan.lol"
-          git config --global user.name "clan-bot"
-
-      - name: Update flake inputs
-        uses: Mic92/update-flake-inputs-gitea@main
-        env:
-          # Exclude private flakes and update-clan-core checks flake
-          EXCLUDE_PATTERNS: "devFlake/private/flake.nix,checks/impure/flake.nix"

.gitea/workflows/update-private-flake-inputs.yml

@@ -1,40 +0,0 @@
-name: "Update private flake inputs"
-on:
-  repository_dispatch:
-  workflow_dispatch:
-  schedule:
-    - cron: "0 3 * * *" # Run daily at 3 AM
-jobs:
-  update-private-flake:
-    runs-on: nix
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          submodules: true
-      - name: Update private flake inputs
-        run: |
-          # Update the private flake lock file
-          cd devFlake/private
-          nix flake update
-          cd ../..
-
-          # Update the narHash
-          bash ./devFlake/update-private-narhash
-      - name: Create pull request
-        env:
-          CI_BOT_TOKEN: ${{ secrets.CI_BOT_TOKEN }}
-        run: |
-          export GIT_AUTHOR_NAME=clan-bot GIT_AUTHOR_EMAIL=clan-bot@clan.lol GIT_COMMITTER_NAME=clan-bot GIT_COMMITTER_EMAIL=clan-bot@clan.lol
-
-          # Check if there are any changes
-          if ! git diff --quiet; then
-            git add devFlake/private/flake.lock devFlake/private.narHash
-            git commit -m "Update dev flake"
-            
-            # Use shared PR creation script
-            export PR_BRANCH="update-dev-flake"
-            export PR_TITLE="Update dev flake"
-            export PR_BODY="This PR updates the dev flake inputs and corresponding narHash."
-          else
-            echo "No changes detected in dev flake inputs"
-          fi

checks/backups/flake-module.nix

@@ -19,11 +19,10 @@
         ...
       }:
       let
-        dependencies =
-          [
-            pkgs.stdenv.drvPath
-          ]
-          ++ builtins.map (i: i.outPath) (builtins.attrValues (builtins.removeAttrs self.inputs [ "self" ]));
+        dependencies = [
+          self
+          pkgs.stdenv.drvPath
+        ] ++ builtins.map (i: i.outPath) (builtins.attrValues self.inputs);
         closureInfo = pkgs.closureInfo { rootPaths = dependencies; };
       in
       {

checks/borgbackup/default.nix

@@ -47,6 +47,14 @@ nixosLib.runTest (
 
       clientone =
         { config, pkgs, ... }:
+        let
+          dependencies = [
+            clan-core
+            pkgs.stdenv.drvPath
+          ] ++ builtins.map (i: i.outPath) (builtins.attrValues clan-core.inputs);
+          closureInfo = pkgs.closureInfo { rootPaths = dependencies; };
+
+        in
         {
 
           services.openssh.enable = true;
@@ -57,6 +65,15 @@ nixosLib.runTest (
 
           environment.systemPackages = [ clan-core.packages.${pkgs.system}.clan-cli ];
 
+          environment.etc.install-closure.source = "${closureInfo}/store-paths";
+          nix.settings = {
+            substituters = pkgs.lib.mkForce [ ];
+            hashed-mirrors = null;
+            connect-timeout = pkgs.lib.mkForce 3;
+            flake-registry = pkgs.writeText "flake-registry" ''{"flakes":[],"version":2}'';
+          };
+          system.extraDependencies = dependencies;
+
           clan.core.state.test-backups.folders = [ "/var/test-backups" ];
         };
 

checks/data-mesher/default.nix

@@ -0,0 +1,89 @@
+{
+  pkgs,
+  nixosLib,
+  clan-core,
+  lib,
+  ...
+}:
+let
+  machines = [
+    "admin"
+    "peer"
+    "signer"
+  ];
+in
+nixosLib.runTest (
+  { ... }:
+  {
+    imports = [
+      clan-core.modules.nixosTest.clanTest
+    ];
+
+    hostPkgs = pkgs;
+    name = "service-data-mesher";
+
+    clan = {
+      directory = ./.;
+      inventory = {
+        machines = lib.genAttrs machines (_: { });
+        services = {
+          data-mesher.default = {
+            roles.peer.machines = [ "peer" ];
+            roles.admin.machines = [ "admin" ];
+            roles.signer.machines = [ "signer" ];
+          };
+        };
+      };
+    };
+
+    defaults =
+      { config, ... }:
+      {
+        environment.systemPackages = [
+          config.services.data-mesher.package
+        ];
+
+        clan.data-mesher.network.interface = "eth1";
+        clan.data-mesher.bootstrapNodes = [
+          "[2001:db8:1::1]:7946" # peer1
+          "[2001:db8:1::2]:7946" # peer2
+        ];
+
+        # speed up for testing
+        services.data-mesher.settings = {
+          cluster.join_interval = lib.mkForce "2s";
+          cluster.push_pull_interval = lib.mkForce "5s";
+        };
+      };
+
+    nodes = {
+      admin.clan.data-mesher.network.tld = "foo";
+    };
+
+    # TODO Add better test script.
+    testScript = ''
+
+      def resolve(node, success = {}, fail = [], timeout = 60):
+        for hostname, ips in success.items():
+            for ip in ips:
+                node.wait_until_succeeds(f"getent ahosts {hostname} | grep {ip}", timeout)
+
+        for hostname in fail:
+            node.wait_until_fails(f"getent ahosts {hostname}")
+
+      start_all()
+
+      admin.wait_for_unit("data-mesher")
+      signer.wait_for_unit("data-mesher")
+      peer.wait_for_unit("data-mesher")
+
+      # check dns resolution
+      for node in [admin, signer, peer]:
+        resolve(node, {
+            "admin.foo": ["2001:db8:1::1", "192.168.1.1"],
+            "peer.foo": ["2001:db8:1::2", "192.168.1.2"],
+            "signer.foo": ["2001:db8:1::3", "192.168.1.3"]
+        })
+    '';
+  }
+)

checks/data-mesher/sops/machines/admin/key.json

@@ -0,0 +1,4 @@
+{
+  "publickey": "age10zxkj45fah3qa8uyg3a36jsd06d839xfq64nrez9etrsf4km0gtsp45gsz",
+  "type": "age"
+}

checks/data-mesher/sops/machines/peer/key.json

@@ -0,0 +1,4 @@
+{
+  "publickey": "age1faqrml2ukc6unfm75d3v2vnaf62v92rdxaagg3ty3cfna7vt99gqlzs43l",
+  "type": "age"
+}

checks/data-mesher/sops/machines/signer/key.json

@@ -0,0 +1,4 @@
+{
+  "publickey": "age153mke8v2qksyqjc7vta7wglzdqr5epazt83nch0ur5v7kl87cfdsr07qld",
+  "type": "age"
+}

checks/data-mesher/sops/secrets/admin-age.key/secret

@@ -0,0 +1,20 @@
+{
+	"data": "ENC[AES256_GCM,data:7xyb6WoaN7uRWEO8QRkBw7iytP5hFrA94VRi+sy/UhzqT9AyDPmxB/F8ASFsBbzJUwi0Oqd2E1CeIYRoDhG7JHnDyL2bYonz2RQ=,iv:slh3x774m6oTHAXFwcen1qF+jEchOKCyNsJMbNhqXHE=,tag:wtK8H8PZCESPA1vZCd7Ptw==,type:str]",
+	"sops": {
+		"kms": null,
+		"gcp_kms": null,
+		"azure_kv": null,
+		"hc_vault": null,
+		"age": [
+			{
+				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPTzZ4RTVNb2I1MTBRMEcy\neU1Eek9GakkydEJBVm9kR3AyY1pEYkorNUYwCkh2WHhNQmc1eWI2cCtEUFFWdzJq\nS0FvQWtoOFkzRVBxVzhuczc0aVprbkkKLS0tIFRLdmpnbzY1Uk9LdklEWnQzZHM2\nVEx3dzhMSnMwaWE0V0J6VTZ5ZVFYMjgKdaICa/hprHxhH89XD7ri0vyTT4rM+Si0\niHcQU4x64dgoJa4gKxgr4k9XncjoNEjJhxL7i/ZNZ5deaaLRn5rKMg==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-04-08T13:24:55Z",
+		"mac": "ENC[AES256_GCM,data:TJWDHGSRBfOCW8Q+t3YxG3vlpf9a5u7B27AamnOk95huqIv0htqWV3RuV7NoOZ5v2ijqSe/pLfpwrmtdhO2sUBEvhdhJm8UzLShP7AbH9lxV+icJOsY7VSrp+R5W526V46ONP6p47b7fOQBbp03BMz01G191N68WYOf6k2arGxU=,iv:nEyTBwJ2EA+OAl8Ulo5cvFX6Ow2FwzTWooF/rdkPiXg=,tag:oYcG16zR+Fb5XzVsHhq2Qw==,type:str]",
+		"pgp": null,
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.9.4"
+	}
+}

checks/data-mesher/sops/secrets/peer-age.key/secret

@@ -0,0 +1,20 @@
+{
+	"data": "ENC[AES256_GCM,data:JOOhvl0clDD/b5YO45CXR3wVopBSNe9dYBG+p5iD+nniN2OgOwBgYPNSCVtc+NemqutD12hFUSfCzXidkv0ijhD1JZeLar9Ygxc=,iv:XctQwSYSvKhDRk/XMacC9uMydZ8e9hnhpoWTgyXiFI0=,tag:foAhBlg4DwpQU2G9DzTo5g==,type:str]",
+	"sops": {
+		"kms": null,
+		"gcp_kms": null,
+		"azure_kv": null,
+		"hc_vault": null,
+		"age": [
+			{
+				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBVWMvWkp5TnZQcGs5Ykhp\nWC91YkoyZERqdXpxQm5JVmRhaUhueEJETDJVCkM4V0hSYldkV1U2Q0d1TGh3eGNR\nVjJ1VFd6ZEN0SXZjSVEvcnV2WW0vbVUKLS0tIFRCNW9nWHdYaUxLSVVUSXM0OGtN\nVFMzRXExNkYxcFE3QWlxVUM3ay9INm8KV6r8ftpwarly3qXoU9y8KxKrUKLvP9KX\nGsP0pORsaM+qPMsdfEo35CqhAeQu0+6DWd7/67+fUMp6Jr0DthtTmg==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-04-08T13:25:28Z",
+		"mac": "ENC[AES256_GCM,data:scY9+/fcXhfHEdrsZJLOM6nfjpRaURgTVbCRepUjhUo24B4ByEsAo2B8psVAaGEHEsFRZuoiByqrGzKhyUASmUs+wn+ziOKBTLzu55fOakp8PWYtQ4miiz2TQffp80gCQRJpykcbUgqIKXNSNutt4tosTBL7osXwCEnEQWd+SaA=,iv:1VXNvLP6DUxZYEr1juOLJmZCGbLp33DlwhxHQV9AMD4=,tag:uFM1R8OmkFS74/zkUG0k8A==,type:str]",
+		"pgp": null,
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.9.4"
+	}
+}

checks/data-mesher/sops/secrets/signer-age.key/secret

@@ -0,0 +1,20 @@
+{
+	"data": "ENC[AES256_GCM,data:i1YBJdK8XmWnVnZKBpmWggSN8JSOr8pm2Zx+CeE8qqeLZ7xwMO8SYCutM8l94M5vzmmX0CmwzeMZ/JVPbEwFd3ZAImUfh685HOY=,iv:N4rHNaX+WmoPb0EZPqMt+CT1BzaWO9LyoemBxKn+u/s=,tag:PnzSvdGwVnTMK8Do8VzFaQ==,type:str]",
+	"sops": {
+		"kms": null,
+		"gcp_kms": null,
+		"azure_kv": null,
+		"hc_vault": null,
+		"age": [
+			{
+				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4RXlmcVNGTnlkY2ZqZFlH\nVnh0eHhRNE5hRDNDVkt0TEE0bmRNN2JIVkN3CkxnaGM4Y3M3a0xoK2xMRzBLMHRV\nT1FzKzNRMFZOeWc2K3E5K2FzdUsvWmsKLS0tIENtVlFSWElHN3RtOUY2alhxajhs\naXI1MmR4WC9EVGVFK3dHM1gvVnlZMVUKCyLz0DkdbWfSfccShO1xjWfxhunEIbD0\n6imeIBhZHvVJmZLXnVl7B0pNXo6be7WSBMAUM9gUtCNh4zaChBNwGw==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-04-08T13:25:52Z",
+		"mac": "ENC[AES256_GCM,data:WFGysoXN95e/RxL094CoL4iueqEcSqCSQZLahwz9HMLi+8HWZIXr55a+jyK7piqR8nBS4BquU5fKhlC6BvEbZFt69t4onTA+LxS3D7A8/TO0CWS0RymUjW9omJUseRQWwAHtE7l0qI5hdOUKhQ+o5pU+2bc3PUlaONM0aOCCoFo=,iv:l1f4aVqLl5VAMfjNxDbxQEQp/qY/nxzgv2GTuPVBoBA=,tag:4PPDCmDrviqdn42RLHQYbA==,type:str]",
+		"pgp": null,
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.9.4"
+	}
+}

checks/data-mesher/vars/per-machine/admin/data-mesher-host-key/private_key/secret

@@ -0,0 +1,24 @@
+{
+	"data": "ENC[AES256_GCM,data:w3bU23Pfe8W89lF+tOmEYPU/A4FkY6n7rgQ6yo+eqCJFxTyHydV6Mg4/g4jaL+4wwIqNYRiMR8J8jLhSvw3Bc59u7Ul+RGwdpiKoBBJfsHjO8r6uOz2u9Raa+iUJH1EJWmGvsQXAILpliZ+klS96VWnGN3pYMEI=,iv:7QbUxta6NPQLZrh6AOcNe+0wkrADuTI9VKVp8q+XoZ8=,tag:ZH0t3RylfQk5U23ZHWaw0g==,type:str]",
+	"sops": {
+		"kms": null,
+		"gcp_kms": null,
+		"azure_kv": null,
+		"hc_vault": null,
+		"age": [
+			{
+				"recipient": "age10zxkj45fah3qa8uyg3a36jsd06d839xfq64nrez9etrsf4km0gtsp45gsz",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKaTBoSFJVSTdZeW4wZG9p\nWFR1LzVmYS8xWmRqTlNtWFVkSW9jZXpVejJBCkpqZm12L1dDSmNhekVsK1JBOU9r\nZThScGdDakFlRzNsVXp1eE5yOStFSW8KLS0tIFRrTkZBQlRsR2VNcUJvNEkzS2pw\nNksvM296UkFWTkZDVVp1ZVZMNUs4cWsKWTteB1G9Oo38a81PeqKO09NUQetuqosC\nhrToQ6NMo5O7/StmVG228MHbJS3KLXsvh2AFOEPyZrbpB2Opd2wwoA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6U2FWRThRNkVQdk9yZ0VE\nM09iSVhmeldMcDZVaFRDNGtjWTdBa0VIT2pJCkdtd04xSXdicDY3OHI1WXl5TndB\nemtQeW1SS2tVVllPUHhLUTRla3haZGMKLS0tIGN0NVNEN3RKeWM0azBBMnBpQU4r\nTFFzQ0lOcGt0ek9UZmZZRjhibTNTc0EKReUwYBVM1NKX0FD/ZeokFAAknwju5Azq\nGzl4UVJBi5Es0GWORdCGElPXMd7jMud1SwgY04AdZj/dzinCSW4CZw==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-04-08T13:25:10Z",
+		"mac": "ENC[AES256_GCM,data:0vl9Gt4QeH+GJcnl8FuWSaqQXC8S6Pe50NmeDg5Nl2NWagz8aLCvOFyTqX/Icp/bTi1XQ5icHHhF3YhM+QAvdUL3aO0WGbh92dPRnFuvlZsdtwCFhT+LyHyYHFf6yP+0h/uFpJv9fE6xY22CezA6ZVQ8ywi1epaC548Gr27uVe4=,iv:G4hZVCLkIpbg9uwB7Y8xtHLdnlmBvFrPjxSoqdyHNvM=,tag:uvKwakhUY2aa7v0tmR/o8A==,type:str]",
+		"pgp": null,
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.9.4"
+	}
+}

checks/data-mesher/vars/per-machine/admin/data-mesher-host-key/public_key/value

@@ -0,0 +1,3 @@
+-----BEGIN PUBLIC KEY-----
+MCowBQYDK2VwAyEAm204bpSFi4jOjZuXDpIZ/rcJBrbG4zAc7OSA4rAVSYE=
+-----END PUBLIC KEY-----

checks/data-mesher/vars/per-machine/peer/data-mesher-host-key/private_key/secret

@@ -0,0 +1,24 @@
+{
+	"data": "ENC[AES256_GCM,data:kERPY40pyvke0mRBnafa4zOaF46rbueRbhpUCXjYP5ORpC7zoOhbdlVBhOsPqE2vfEP4RWkH+ZPdDYXOKXwotBCmlq2i7TfZeoNXFkzWXc3GyM5mndnjCc8hvYEQF1w6xkkVSUt4n06BAw/gT0ppz+vo5dExIA8=,iv:JmYD2o4DGqds6DV7ucUmUD0BRB61exbRsNAtINOR8cQ=,tag:Z58gVnHD+4s21Z84IRw+Vw==,type:str]",
+	"sops": {
+		"kms": null,
+		"gcp_kms": null,
+		"azure_kv": null,
+		"hc_vault": null,
+		"age": [
+			{
+				"recipient": "age1faqrml2ukc6unfm75d3v2vnaf62v92rdxaagg3ty3cfna7vt99gqlzs43l",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4OFluVThBdUJSTmRVTk94\neFZnLytvcnNSdmQvR3ZkT2UvWFVieFV1SUFNCm9jWHlyZXRwaVdFaG9ocnd4S3FU\ndTZ2dklBbkFVL0hVT0Y2L1o5dnUyNG8KLS0tIGFvYlBJR3l2b3F6OU9uMTFkYjli\nNVFLOWQzOStpU2kzb0xyZUFCMnBmMVUK5Jzssf1XBX25bq0RKlJY8NwtKIytxL/c\nBPPFDZywJiUgw1izsdfGVkRhhSFCQIz+yWIJWzr01NU2jLyFjSfCNw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzYW92c3Q4SktwSnJ1TkRJ\nZEJyZk96cG8ybkpPQzYzVk0xZGs0eCtISVR3CmhDaWxTem1FMjJKNmZNaTkxN01n\nenUvdFI1UkFmL1lzNlM5N0Ixd0dpc1EKLS0tIHpyS2VHaHRRdUovQVgvRmRHaXh3\naFpSNURjTWkxaW9TOXpKL2IvcUFEbmMKq4Ch7DIL34NetFV+xygTdcpQjjmV8v1n\nlvYcjUO/9c3nVkxNMJYGjuxFLuFc4Gw+AyawCjpsIYXRskYRW4UR1w==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-04-08T13:25:43Z",
+		"mac": "ENC[AES256_GCM,data:YhL2d6i0VpUd15B4ow2BgRpyEm0KEA8NSb7jZcjI58d7d4lAqBMcDQB+8a9e2NZbPk8p1EYl3q4VXbEnuwsJiPZI2kabRusy/IGoHzUTUMFfVaOuUcC0eyINNVSmzJxnCbLCAA1Aj1yXzgRQ0MWr7r0RHMKw0D1e0HxdEsuAPrA=,iv:yPlMmE6+NEEQ9uOZzD3lUTBcfUwGX/Ar+bCu0XKnjIg=,tag:eR22BCFVAlRHdggg9oCeaA==,type:str]",
+		"pgp": null,
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.9.4"
+	}
+}

checks/data-mesher/vars/per-machine/peer/data-mesher-host-key/public_key/value

@@ -0,0 +1,3 @@
+-----BEGIN PUBLIC KEY-----
+MCowBQYDK2VwAyEAv5dICFue2fYO0Zi1IyfYjoNfR6713WpISo7+2bSjL18=
+-----END PUBLIC KEY-----

checks/data-mesher/vars/per-machine/signer/data-mesher-host-key/private_key/secret

@@ -0,0 +1,24 @@
+{
+	"data": "ENC[AES256_GCM,data:U8F7clQ2Tuj8zy5EoEga/Mc9N3LLZrlFf5m7UJKrP5yybFRCJSBs05hOcNe+LQZdEAvvr0Qbkry1pQyE84gCVbxHvwkD+l3GbguBuLMsW96bHcmstb6AvZyhMDBpm73Azf4lXhNaiB8p2pDWdxV77E+PPw1MNYI=,iv:hQhN6Ak8tB6cXSCnTmmQqHEpXWpWck3uIVCk5pUqFqU=,tag:uC4ljcs92WPlUOfwSkrK9Q==,type:str]",
+	"sops": {
+		"kms": null,
+		"gcp_kms": null,
+		"azure_kv": null,
+		"hc_vault": null,
+		"age": [
+			{
+				"recipient": "age153mke8v2qksyqjc7vta7wglzdqr5epazt83nch0ur5v7kl87cfdsr07qld",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvV05lejQrdUQvQjZPOG9v\nZ01naXlYZ1JxWHhDT1M1aUs1RWJDSU1acVFFCmdHY094aGRPYWxpdVVxSFVHRU9v\nNnVaeTlpSEdtSWRDMmVMSjdSOEQ4ZlEKLS0tIFo5NVk2bzBxYjZ5ZWpDWTMrQ2VF\nVThWUk0rVXpTY2svSCtiVDhTQ2kvbFkKEM2DBuFtdEj1G/vS1TsyIfQxSFFvPTDq\nCmO7L/J5lHdyfIXzp/FlhdKpjvmchb8gbfJn7IWpKopc7Zimy/JnGQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArNzVUaHkzUzVEMlh1Q3Qr\nOEo0aDJIMG91amJiZG50MEhqblRCTWxRRVVRCk4xZlp4SkJuUHc2UnFyU1prczkz\nNGtlQlRlNnBDRFFvUGhReTh6MTBZaXMKLS0tIGxtaXhUMDM0RU4yQytualdzdTFt\nWGRiVG54MnYrR2lqZVZoT0VkbmV5WUUKbzAnOkn8RYOo7z4RISQ0yN875vSEQMDa\nnnttzVrQuK0/iZvzJ0Zq8U9+JJJKvFB1tHqye6CN0zMbv55CLLnA0g==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-04-08T13:26:07Z",
+		"mac": "ENC[AES256_GCM,data:uMss4+BiVupFqX7nHnMo+0yZ8RPuFD8VHYK2EtJSqzgurQrZVT4tJwY50mz2gVmwbrm49QYKk5S+H29DU0cM0HiEOgB5P5ObpXTRJPagWQ48CEFrDpBzLplobxulwnN6jJ1dpL3JF3jfrzrnSDFXMvx+n5x/86/AYXYRsi/UeyY=,iv:mPT1svKrNGmYpbL9hh2Bxxakml69q+U6gQ0ZnEcbEyg=,tag:zcZx1lTw/bEsX/1g+6T04g==,type:str]",
+		"pgp": null,
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.9.4"
+	}
+}

checks/data-mesher/vars/per-machine/signer/data-mesher-host-key/public_key/value

@@ -0,0 +1,3 @@
+-----BEGIN PUBLIC KEY-----
+MCowBQYDK2VwAyEAeUkW5UIwA1svbNY71ePyJKX68UhxrqIUGQ2jd06w5WM=
+-----END PUBLIC KEY-----

checks/data-mesher/vars/shared/data-mesher-network-key/private_key/secret

@@ -0,0 +1,32 @@
+{
+	"data": "ENC[AES256_GCM,data:nRlCMF58cnkdUAE2aVHEG1+vAckKtVt48Jr21Bklfbsqe1yTiHPFAMLL1ywgWWWd7FjI/Z8WID9sWzh9J8Vmotw4aJWU/rIQSeF8cJHALvfOxarJIIyb7purAiPoPPs6ggGmSmVFGB1aw8kH1JMcppQN8OItdQM=,iv:qTwaL2mgw6g7heN/H5qcjei3oY+h46PdSe3v2hDlkTs=,tag:jYNULrOPl9mcQTTrx1SDeA==,type:str]",
+	"sops": {
+		"kms": null,
+		"gcp_kms": null,
+		"azure_kv": null,
+		"hc_vault": null,
+		"age": [
+			{
+				"recipient": "age153mke8v2qksyqjc7vta7wglzdqr5epazt83nch0ur5v7kl87cfdsr07qld",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRcG44cGFBWXk2Z0pmNklv\nTnJ5b0svLytzZmNNRkxCVU1zaDVhNUs2cld3CklsenpWd0g2OEdKKzBMQlNEejRn\nTlEvY01HYjdvVExadnN3aXZIRTZ4YlEKLS0tIGRPUXdNSHZCRDBMbno2MjJqRHBl\nSzdiSURDYitQWFpaSElkdmdicDVjMWsKweQiRqyzXmzabmU2fmgwHtOa9uDmhx9O\ns9NfUhC3ifooQUSeYp58b1ZGJQx5O5bn9q/DaEoit5LTOUprt1pUPA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiTEdlL29sVWFpSDNNaXRJ\ndTJDRkU4VzFPQ0M4MkFha2IxV2FXN2o3ZEFRCjF3UnZ5U1hTc3VvSTIzcWxOZjl0\ncHlLVEFqRk1UbGdxaUxEeDFqbFVYaU0KLS0tIFFyMnJkZnRHdWg4Z1IyRHFkY0I5\nQjdIMGtGLzRGMFM0ektDZ3hzZDdHSmMKvxOQuKgePom0QfPSvn+4vsGHhJ4BoOvW\nc27Vn4/i4hbjfJr4JpULAwyIwt3F0RaTA2M6EkFkY8otEi3vkcpWvA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age10zxkj45fah3qa8uyg3a36jsd06d839xfq64nrez9etrsf4km0gtsp45gsz",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5ZzdsaVRnSmsrMGR1Ylg3\nZkpscTdwNUl5NUVXN3kvMU1icE0yZU1WSEJBClB6SlJYZUhDSElRREx5b0VueFUw\nNVFRU3BSU24yWEtpRnJoUC83SDVaUWsKLS0tIGVxNEo3TjlwakpDZlNsSkVCOXlz\nNDgwaE1xNjZkSnJBVlU5YXVHeGxVNFEKsXKyTzq9VsERpXzbFJGv/pbAghFAcXkf\nMmCgQHsfIMBJQUstcO8sAkxv3ced0dAEz8O6NUd0FS2zlhBzt29Rnw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1faqrml2ukc6unfm75d3v2vnaf62v92rdxaagg3ty3cfna7vt99gqlzs43l",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkK1hDMGxCc1IvYXlJMnBF\nWncxaXBQa1RpTWdwUHc3Yk16My8rVHNJc2dFCkNlK2h0dy9oU3Z5ZGhwRWVLYVUz\ncVBKT2x5VnlhbXNmdHkwbmZzVG5sd0EKLS0tIHJaMzhDanF4Rkl3akN4MEIxOHFC\nYWRUZ08xb1UwOFNRaktkMjIzNXZmNkUK1rlbJ96oUNQZLmCmPNDOKxfDMMa+Bl2E\nJPxcNc7XY3WBHa3xFUbcqiPxWxDyaZjhq/LYQGpepiGonGMEzR5JOQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-04-08T13:25:20Z",
+		"mac": "ENC[AES256_GCM,data:za9ku+9lu1TTRjbPcd5LYDM4tJsAYF/yuWFCGkAhqcYguEducsIfoKBwL42ahAzqLjCZp91YJuINtw16mM+Hmlhi/BVwhnXNHqcfnKoAS/zg9KJvWcvXwKMmjEjaBovqaCWXWoKS7dn/wZ7nfGrlsiUilCDkW4BzTIzkqNkyREU=,iv:2X9apXMatwCPRBIRbPxz6PJQwGrlr7O+z+MrsnFq+sQ=,tag:IYvitoV4MhyJyRO1ySxbLQ==,type:str]",
+		"pgp": null,
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.9.4"
+	}
+}

checks/data-mesher/vars/shared/data-mesher-network-key/public_key/value

@@ -0,0 +1,3 @@
+-----BEGIN PUBLIC KEY-----
+MCowBQYDK2VwAyEA/5j+Js7oxwWvZdfjfEO/3UuRqMxLKXsaNc3/5N2WSaw=
+-----END PUBLIC KEY-----

checks/flake-module.nix

@@ -94,6 +94,7 @@ in
 
             service-dummy-test = import ./service-dummy-test nixosTestArgs;
             service-dummy-test-from-flake = import ./service-dummy-test-from-flake nixosTestArgs;
+            service-data-mesher = import ./data-mesher nixosTestArgs;
           };
 
           packagesToBuild = lib.removeAttrs self'.packages [

checks/flash/flake-module.nix

@@ -59,7 +59,7 @@
           name = "flash";
           nodes.target = {
             virtualisation.emptyDiskImages = [ 4096 ];
-            virtualisation.memorySize = 4096;
+            virtualisation.memorySize = 3000;
             environment.systemPackages = [ self.packages.${pkgs.system}.clan-cli ];
             environment.etc."install-closure".source = "${closureInfo}/store-paths";
 

clanModules/disk-id/roles/default.nix

@@ -1,4 +1,5 @@
 {
+  config,
   pkgs,
   ...
 }:
@@ -8,14 +9,9 @@
   config = {
 
     warnings = [
-      ''
-        The clan.disk-id module is deprecated and will be removed on 2025-07-15.
-        For migration see: https://docs.clan.lol/guides/migrations/disk-id/
-
-        !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
-        !!! Please migrate. Otherwise you may not be able to boot your system after that date.  !!!
-        !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
-      ''
+      "The clan.disk-id module is deprecated and will be removed on 2025-07-15.
+      Please migrate to user-maintained configuration or the new equivalent clan services
+      (https://docs.clan.lol/reference/clanServices)."
     ];
     clan.core.vars.generators.disk-id = {
       files.diskId.secret = false;

clanServices/admin/default.nix

@@ -9,37 +9,15 @@
     interface =
       { lib, ... }:
       {
-
-        options = {
-          allowedKeys = lib.mkOption {
-            default = { };
-            type = lib.types.attrsOf lib.types.str;
-            description = "The allowed public keys for ssh access to the admin user";
-            example = {
-              "key_1" = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQD...";
-            };
-          };
-
-          rsaHostKey.enable = lib.mkEnableOption "Generate RSA host key";
-
-          # TODO: allow per-server domains that we than collect in the inventory
-          #certicficateDomains = lib.mkOption {
-          #  type = lib.types.listOf lib.types.str;
-          #  default = [ ];
-          #  example = [ "git.mydomain.com" ];
-          #  description = "List of domains to include in the certificate. This option will not prepend the machine name in front of each domain.";
-          #};
-
-          certificateSearchDomains = lib.mkOption {
-            type = lib.types.listOf lib.types.str;
-            default = [ ];
-            example = [ "mydomain.com" ];
-            description = ''
-              List of domains to include in the certificate.
-              This option will prepend the machine name in front of each domain before adding it to the certificate.
-            '';
+        options.allowedKeys = lib.mkOption {
+          default = { };
+          type = lib.types.attrsOf lib.types.str;
+          description = "The allowed public keys for ssh access to the admin user";
+          example = {
+            "key_1" = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQD...";
           };
         };
+
       };
 
     perInstance =
@@ -49,15 +27,10 @@
           { ... }:
           {
             imports = [
-              # We don't have a good way to specify dependencies between
-              # clanServices for now. When it get's implemtende, we should just
-              # use the ssh and users modules here.
-              ./ssh.nix
-              ./root-password.nix
+              ../../clanModules/sshd
+              ../../clanModules/root-password
             ];
 
-            _module.args = { inherit settings; };
-
             users.users.root.openssh.authorizedKeys.keys = builtins.attrValues settings.allowedKeys;
           };
       };

clanServices/admin/root-password.nix

@@ -1,39 +0,0 @@
-# We don't have a way of specifying dependencies between clanServices for now.
-# When it get's added this file should be removed and the users module used instead.
-{
-  config,
-  pkgs,
-  ...
-}:
-{
-
-  users.mutableUsers = false;
-  users.users.root.hashedPasswordFile =
-    config.clan.core.vars.generators.root-password.files.password-hash.path;
-
-  clan.core.vars.generators.root-password = {
-    files.password-hash.neededFor = "users";
-
-    files.password.deploy = false;
-
-    runtimeInputs = [
-      pkgs.coreutils
-      pkgs.mkpasswd
-      pkgs.xkcdpass
-    ];
-
-    prompts.password.type = "hidden";
-    prompts.password.persist = true;
-    prompts.password.description = "You can autogenerate a password, if you leave this prompt blank.";
-
-    script = ''
-      prompt_value="$(cat "$prompts"/password)"
-      if [[ -n "''${prompt_value-}" ]]; then
-        echo "$prompt_value" | tr -d "\n" > "$out"/password
-      else
-        xkcdpass --numwords 5 --delimiter - --count 1 | tr -d "\n" > "$out"/password
-      fi
-      mkpasswd -s -m sha-512 < "$out"/password | tr -d "\n" > "$out"/password-hash
-    '';
-  };
-}

clanServices/admin/ssh.nix

@@ -1,115 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  settings,
-  ...
-}:
-let
-  stringSet = list: builtins.attrNames (builtins.groupBy lib.id list);
-
-  domains = stringSet settings.certificateSearchDomains;
-
-in
-{
-
-  services.openssh = {
-    enable = true;
-    settings.PasswordAuthentication = false;
-
-    settings.HostCertificate = lib.mkIf (
-      settings.certificateSearchDomains != [ ]
-    ) config.clan.core.vars.generators.openssh-cert.files."ssh.id_ed25519-cert.pub".path;
-
-    hostKeys =
-      [
-        {
-          path = config.clan.core.vars.generators.openssh.files."ssh.id_ed25519".path;
-          type = "ed25519";
-        }
-      ]
-      ++ lib.optional settings.rsaHostKey.enable {
-        path = config.clan.core.vars.generators.openssh-rsa.files."ssh.id_rsa".path;
-        type = "rsa";
-      };
-  };
-
-  clan.core.vars.generators.openssh = {
-    files."ssh.id_ed25519" = { };
-    files."ssh.id_ed25519.pub".secret = false;
-    migrateFact = "openssh";
-    runtimeInputs = [
-      pkgs.coreutils
-      pkgs.openssh
-    ];
-    script = ''
-      ssh-keygen -t ed25519 -N "" -C "" -f "$out"/ssh.id_ed25519
-    '';
-  };
-
-  programs.ssh.knownHosts.clan-sshd-self-ed25519 = {
-    hostNames = [
-      "localhost"
-      config.networking.hostName
-    ] ++ (lib.optional (config.networking.domain != null) config.networking.fqdn);
-    publicKey = config.clan.core.vars.generators.openssh.files."ssh.id_ed25519.pub".value;
-  };
-
-  clan.core.vars.generators.openssh-rsa = lib.mkIf settings.rsaHostKey.enable {
-    files."ssh.id_rsa" = { };
-    files."ssh.id_rsa.pub".secret = false;
-    runtimeInputs = [
-      pkgs.coreutils
-      pkgs.openssh
-    ];
-    script = ''
-      ssh-keygen -t rsa -b 4096 -N "" -C "" -f "$out"/ssh.id_rsa
-    '';
-  };
-
-  clan.core.vars.generators.openssh-cert = lib.mkIf (settings.certificateSearchDomains != [ ]) {
-    files."ssh.id_ed25519-cert.pub".secret = false;
-    dependencies = [
-      "openssh"
-      "openssh-ca"
-    ];
-    validation = {
-      name = config.clan.core.settings.machine.name;
-      domains = lib.genAttrs settings.certificateSearchDomains lib.id;
-    };
-    runtimeInputs = [
-      pkgs.openssh
-      pkgs.jq
-    ];
-    script = ''
-      ssh-keygen \
-        -s $in/openssh-ca/id_ed25519 \
-        -I ${config.clan.core.settings.machine.name} \
-        -h \
-        -n ${lib.concatMapStringsSep "," (d: "${config.clan.core.settings.machine.name}.${d}") domains} \
-        $in/openssh/ssh.id_ed25519.pub
-      mv $in/openssh/ssh.id_ed25519-cert.pub "$out"/ssh.id_ed25519-cert.pub
-    '';
-  };
-
-  clan.core.vars.generators.openssh-ca = lib.mkIf (settings.certificateSearchDomains != [ ]) {
-    share = true;
-    files.id_ed25519.deploy = false;
-    files."id_ed25519.pub" = {
-      deploy = false;
-      secret = false;
-    };
-    runtimeInputs = [
-      pkgs.openssh
-    ];
-    script = ''
-      ssh-keygen -t ed25519 -N "" -C "" -f "$out"/id_ed25519
-    '';
-  };
-
-  programs.ssh.knownHosts.ssh-ca = lib.mkIf (settings.certificateSearchDomains != [ ]) {
-    certAuthority = true;
-    extraHostNames = builtins.map (domain: "*.${domain}") settings.certificateSearchDomains;
-    publicKey = config.clan.core.vars.generators.openssh-ca.files."id_ed25519.pub".value;
-  };
-}

clanServices/borgbackup/tests/vm/default.nix

@@ -41,6 +41,14 @@
         clan-core,
         ...
       }:
+      let
+        dependencies = [
+          clan-core
+          pkgs.stdenv.drvPath
+        ] ++ builtins.map (i: i.outPath) (builtins.attrValues clan-core.inputs);
+        closureInfo = pkgs.closureInfo { rootPaths = dependencies; };
+
+      in
       {
 
         services.openssh.enable = true;
@@ -51,6 +59,15 @@
 
         environment.systemPackages = [ clan-core.packages.${pkgs.system}.clan-cli ];
 
+        environment.etc.install-closure.source = "${closureInfo}/store-paths";
+        nix.settings = {
+          substituters = pkgs.lib.mkForce [ ];
+          hashed-mirrors = null;
+          connect-timeout = pkgs.lib.mkForce 3;
+          flake-registry = pkgs.writeText "flake-registry" ''{"flakes":[],"version":2}'';
+        };
+        system.extraDependencies = dependencies;
+
         clan.core.state.test-backups.folders = [ "/var/test-backups" ];
       };
 

clanServices/data-mesher/README.md

@@ -1,29 +0,0 @@
-This service will set up data-mesher.
-
-## Usage
-
-```nix
-inventory.instances = {
-  data-mesher = {
-    module = {
-      name = "data-mesher";
-      input = "clan-core";
-    };
-    roles.admin.machines.server0 = {
-      settings = {
-        bootstrapNodes = {
-          node1 = "192.168.1.1:7946";
-          node2 = "192.168.1.2:7946";
-        };
-
-        network = {
-          hostTTL = "24h";
-          interface = "tailscale0";
-        };
-      };
-    };
-    roles.peer.machines.server1 = { };
-    roles.signer.machines.server2 = { };
-  };
-}
-```

clanServices/data-mesher/admin.nix

@@ -1,29 +0,0 @@
-{
-  lib,
-  config,
-  settings,
-  ...
-}:
-{
-
-  services.data-mesher.initNetwork =
-    let
-      # for a given machine, read it's public key and remove any new lines
-      readHostKey =
-        machine:
-        let
-          path = "${config.clan.core.settings.directory}/vars/per-machine/${machine}/data-mesher-host-key/public_key/value";
-        in
-        builtins.elemAt (lib.splitString "\n" (builtins.readFile path)) 1;
-    in
-    {
-      enable = true;
-      keyPath = config.clan.core.vars.generators.data-mesher-network-key.files.private_key.path;
-
-      tld = settings.network.tld;
-      hostTTL = settings.network.hostTTL;
-
-      # admin and signer host public keys
-      signingKeys = builtins.map readHostKey (builtins.attrNames settings.bootstrapNodes);
-    };
-}

clanServices/data-mesher/default.nix

@@ -1,142 +0,0 @@
-{ ... }:
-let
-  sharedInterface =
-    { lib, ... }:
-    {
-      options = {
-        bootstrapNodes = lib.mkOption {
-          type = lib.types.nullOr (lib.types.attrsOf lib.types.str);
-          # the default bootstrap nodes are any machines with the admin or signers role
-          # we iterate through those machines, determining an IP address for them based on their VPN
-          # currently only supports zerotier
-          # default = builtins.foldl' (
-          #   urls: name:
-          #   let
-          #     ipPath = "${config.clan.core.settings.directory}/vars/per-machine/${name}/zerotier/zerotier-ip/value";
-          #   in
-          #   if builtins.pathExists ipPath then
-          #     let
-          #       ip = builtins.readFile ipPath;
-          #     in
-          #     urls ++ [ "[${ip}]:${builtins.toString settings.network.port}" ]
-          #   else
-          #     urls
-          # ) [ ] (dmLib.machines config).bootstrap;
-          description = ''
-            A list of bootstrap nodes that act as an initial gateway when joining
-            the cluster.
-          '';
-          example = {
-            "node1" = "192.168.1.1:7946";
-            "node2" = "192.168.1.2:7946";
-          };
-        };
-
-        network = {
-          interface = lib.mkOption {
-            type = lib.types.str;
-            description = ''
-              The interface over which cluster communication should be performed.
-              All the ip addresses associate with this interface will be part of
-              our host claim, including both ipv4 and ipv6.
-
-              This should be set to an internal/VPN interface.
-            '';
-            example = "tailscale0";
-          };
-
-          port = lib.mkOption {
-            type = lib.types.port;
-            default = 7946;
-            description = ''
-              Port to listen on for cluster communication.
-            '';
-          };
-        };
-      };
-    };
-in
-{
-  _class = "clan.service";
-  manifest.name = "data-mesher";
-  manifest.description = "Set up data-mesher";
-  manifest.categories = [ "System" ];
-  manifest.readme = builtins.readFile ./README.md;
-
-  roles.admin = {
-    interface =
-      { lib, ... }:
-      {
-
-        imports = [ sharedInterface ];
-
-        options = {
-
-          network = {
-            tld = lib.mkOption {
-              type = lib.types.str;
-              default = "clan";
-              description = "Top level domain to use for the network";
-            };
-
-            hostTTL = lib.mkOption {
-              type = lib.types.str;
-              default = "${toString (24 * 28)}h";
-              example = "24h";
-              description = "The TTL for hosts in the network, in the form of a Go time.Duration";
-            };
-          };
-        };
-      };
-    perInstance =
-      { settings, roles, ... }:
-      {
-        nixosModule = {
-          imports = [
-            ./admin.nix
-            ./shared.nix
-          ];
-          _module.args = { inherit settings roles; };
-        };
-      };
-  };
-
-  roles.signer = {
-    interface =
-      { ... }:
-      {
-        imports = [ sharedInterface ];
-      };
-    perInstance =
-      { settings, roles, ... }:
-      {
-        nixosModule = {
-          imports = [
-            ./signer.nix
-            ./shared.nix
-          ];
-          _module.args = { inherit settings roles; };
-        };
-      };
-  };
-
-  roles.peer = {
-    interface =
-      { ... }:
-      {
-        imports = [ sharedInterface ];
-      };
-    perInstance =
-      { settings, roles, ... }:
-      {
-        nixosModule = {
-          imports = [
-            ./peer.nix
-            ./shared.nix
-          ];
-          _module.args = { inherit settings roles; };
-        };
-      };
-  };
-
-}

clanServices/data-mesher/flake-module.nix

@@ -1,17 +0,0 @@
-{ lib, ... }:
-let
-  module = lib.modules.importApply ./default.nix { };
-in
-{
-  clan.modules = {
-    data-mesher = module;
-  };
-  perSystem =
-    { ... }:
-    {
-      clan.nixosTests.service-data-mesher = {
-        imports = [ ./tests/vm/default.nix ];
-        clan.modules."@clan/data-mesher" = module;
-      };
-    };
-}

clanServices/data-mesher/peer.nix

@@ -1,2 +0,0 @@
-{
-}

clanServices/data-mesher/shared.nix

@@ -1,86 +0,0 @@
-{
-  config,
-  settings,
-  ...
-}:
-{
-
-  services.data-mesher = {
-    enable = true;
-    openFirewall = true;
-
-    settings = {
-      log_level = "warn";
-      state_dir = "/var/lib/data-mesher";
-
-      # read network id from vars
-      network.id = config.clan.core.vars.generators.data-mesher-network-key.files.public_key.value;
-
-      host = {
-        names = [ config.networking.hostName ];
-        key_path = config.clan.core.vars.generators.data-mesher-host-key.files.private_key.path;
-      };
-
-      cluster = {
-        port = settings.network.port;
-        join_interval = "30s";
-        push_pull_interval = "30s";
-        interface = settings.network.interface;
-        bootstrap_nodes = (builtins.attrValues settings.bootstrapNodes);
-      };
-
-      http.port = 7331;
-      http.interface = "lo";
-    };
-  };
-
-  # Generate host key.
-  clan.core.vars.generators.data-mesher-host-key = {
-    files =
-      let
-        owner = config.users.users.data-mesher.name;
-      in
-      {
-        private_key = {
-          inherit owner;
-        };
-        public_key.secret = false;
-      };
-
-    runtimeInputs = [
-      config.services.data-mesher.package
-    ];
-
-    script = ''
-      data-mesher generate keypair \
-          --public-key-path "$out"/public_key \
-          --private-key-path "$out"/private_key
-    '';
-  };
-
-  clan.core.vars.generators.data-mesher-network-key = {
-    # generated once per clan
-    share = true;
-
-    files =
-      let
-        owner = config.users.users.data-mesher.name;
-      in
-      {
-        private_key = {
-          inherit owner;
-        };
-        public_key.secret = false;
-      };
-
-    runtimeInputs = [
-      config.services.data-mesher.package
-    ];
-
-    script = ''
-      data-mesher generate keypair \
-          --public-key-path "$out"/public_key \
-          --private-key-path "$out"/private_key
-    '';
-  };
-}

clanServices/data-mesher/signer.nix

@@ -1,2 +0,0 @@
-{
-}

clanServices/data-mesher/tests/vm/default.nix

@@ -1,90 +0,0 @@
-{
-  ...
-}:
-{
-  name = "service-data-mesher";
-
-  clan = {
-    directory = ./.;
-    test.useContainers = true;
-    inventory = {
-
-      machines.peer = { };
-      machines.admin = { };
-      machines.signer = { };
-
-      instances = {
-        data-mesher =
-          let
-            bootstrapNodes = {
-              admin = "[2001:db8:1::1]:7946";
-              peer = "[2001:db8:1::2]:7946";
-              # signer = "2001:db8:1::3:7946";
-            };
-          in
-          {
-            roles.peer.machines.peer.settings = {
-              network.interface = "eth1";
-              inherit bootstrapNodes;
-            };
-            roles.signer.machines.signer.settings = {
-              network.interface = "eth1";
-              inherit bootstrapNodes;
-            };
-            roles.admin.machines.admin.settings = {
-              network.tld = "foo";
-              network.interface = "eth1";
-              inherit bootstrapNodes;
-            };
-          };
-      };
-    };
-  };
-
-  nodes =
-    let
-      commonConfig =
-        { lib, config, ... }:
-        {
-          environment.systemPackages = [
-            config.services.data-mesher.package
-          ];
-
-          # speed up for testing
-          services.data-mesher.settings = {
-            cluster.join_interval = lib.mkForce "2s";
-            cluster.push_pull_interval = lib.mkForce "5s";
-          };
-
-        };
-    in
-    {
-      peer = commonConfig;
-      admin = commonConfig;
-      signer = commonConfig;
-    };
-
-  testScript = ''
-    def resolve(node, success = {}, fail = [], timeout = 60):
-      for hostname, ips in success.items():
-          for ip in ips:
-              node.wait_until_succeeds(f"getent ahosts {hostname} | grep {ip}", timeout)
-
-      for hostname in fail:
-          node.wait_until_fails(f"getent ahosts {hostname}")
-
-    start_all()
-
-    admin.wait_for_unit("data-mesher")
-    signer.wait_for_unit("data-mesher")
-    peer.wait_for_unit("data-mesher")
-
-    # check dns resolution
-    for node in [admin, signer, peer]:
-      resolve(node, {
-          "admin.foo": ["2001:db8:1::1", "192.168.1.1"],
-          "peer.foo": ["2001:db8:1::2", "192.168.1.2"],
-          "signer.foo": ["2001:db8:1::3", "192.168.1.3"]
-      })
-  '';
-}

clanServices/data-mesher/tests/vm/sops/machines/admin/key.json

@@ -1,6 +0,0 @@
-[
-  {
-    "publickey": "age1r99qtxl0v86wg8ndcem87yk5wag5xcsk98ngaumqzww6t7pyms0q5cyl80",
-    "type": "age"
-  }
-]

clanServices/data-mesher/tests/vm/sops/machines/peer/key.json

@@ -1,6 +0,0 @@
-[
-  {
-    "publickey": "age1hgjs2yqxhcxfgtvhydnfe5wzlagxw2dw4hu658e8neduy0lkye0skmjfc7",
-    "type": "age"
-  }
-]

clanServices/data-mesher/tests/vm/sops/machines/signer/key.json

@@ -1,6 +0,0 @@
-[
-  {
-    "publickey": "age1k6h9mespmnr9zhtwwqlhnla80x5jhpd4c2p7hp0nfanr5tspup0s0rld2f",
-    "type": "age"
-  }
-]

clanServices/data-mesher/tests/vm/sops/secrets/admin-age.key/secret

@@ -1,15 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:87WFWukgpTGlH67MTkHxzTosABK/6flJObt+u9UrGSOzBr1lx4V5IsMQ9HAM4jvLpveBNH4hlFDCxbD5666n2oYylGoyBph2vAg=,iv:GKLcU7Xqmb0ImvY7M71NddkOlUDSPa/fcXrXny2iZ1o=,tag:589QMSZeXdmTxRFtMFasZg==,type:str]",
-	"sops": {
-		"age": [
-			{
-				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFaXlqZEU0eHRZZjBncDE1\nV2hzTGZiVy9rM0NnWjc1NlpHVVZEUFd5S2pJCmo3Nm11bGQyWWt1R2tHS2pOYlpn\nY3lGa0w3UFpDT1RLSDU4cnJ2YVBkSU0KLS0tIEJjZVc1YXJqcHczYSt6WjV3ai93\nakdPd3VHWkVnWkdhNCtZakp4VXhBUG8Kg3xd9w5oW3/q+s59LkDy5N+xmvuvHRmh\njUv6KFLaB81yv3kb7bzj8E3aMzX0x2fMIDZ3EoPVggqA/sCWQu0p5Q==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2025-07-09T10:02:45Z",
-		"mac": "ENC[AES256_GCM,data:IWKfE1Y6SNg/SK+OOAmra5SwqAUfhepCNPClWPDWpOyJDwXSpk/OKl7hi3KFfIZOGupaC0xV2tTni0Uj6IBwf8zW2Mb/b1T+fWkGiyafoKlucfNPXPCob/fyf4Ju4iD/u1mD5BYYYqNTNqJWE+MCyQigL0MPE4tXGEPDa7htM6w=,iv:5RKArbEKnYjacopfL+4QhzGB8txqc3gnlwNPfRWQSlM=,tag:mdXf02nYiW7CexIbUUaMyw==,type:str]",
-		"unencrypted_suffix": "_unencrypted",
-		"version": "3.10.2"
-	}
-}

clanServices/data-mesher/tests/vm/sops/secrets/peer-age.key/secret

@@ -1,15 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:C9evAr01JpYiMBwuy31h+G9phm+uOYoQu+PegPFAMRbjgkjh0R+uolKtweedtHumMhzEkvz7y+BlfrriVh16ceyMozfzDEkVSWM=,iv:jM4Qx4B/j5Mvc3ybOf+10hKU19l1fCc5KcKulKgMP3c=,tag:mz01kIv5kU6u3f2+FeItYA==,type:str]",
-	"sops": {
-		"age": [
-			{
-				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAydzZrdDVidGpyd1NXT0Fu\nUEtZV3I4S0p5Z095QjBGaXpwOExJSkxVclVJCm54Vk12czQ5dm5TUExNNzlEcFNp\nUWorcWc1c1pvL3pkUFlQY3BJUGhUS3MKLS0tIHd2a291M0xkcjJvTXNnelRNZXda\nQi93R3FQVm0xTXBGR3E3SVpIMzgvR3MKmps5ObV1nODBQ0TKgZ++RLkjCEQM6sMn\nzonKtBingYzfeq+0+cASVkHZJpt/t0G5wmTgivKfv0OIP5eNSgIWFw==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2025-07-09T10:02:57Z",
-		"mac": "ENC[AES256_GCM,data:Jk5eL2SmNpakrGF4N/31Q/PWShV5KYfA8NmlxEkD82UsIpPiIJ4Nec6NOoo7Y4bl/J53MLjK3u0/S6q7vv0Tih6+ze6hIddMJHTCp2qqclJvpH2xn6Ln+2ZK4okK2ZbWeSDF+LHc6nIpBak8JVjC/d8dQFT2L49Dkufc1nCD46w=,iv:oR0aQzjaEpFNrpWGc1TX6/zpg0WSfQjVG6VjAMwoLTI=,tag:pigUaCkVv91tynuaNoZenA==,type:str]",
-		"unencrypted_suffix": "_unencrypted",
-		"version": "3.10.2"
-	}
-}

clanServices/data-mesher/tests/vm/sops/secrets/signer-age.key/secret

@@ -1,15 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:bIx3chjDwy4epCyFuJoZlO7EglT/vEg6pdf6x+ISxqekGrrGNdiGtw3Z9foXWAPQrzngVztbwIlcEpUusKwoRPpdGIj5YzbGZbU=,iv:Gi1hjn6cL8z+LP5g6o3bUMsuIzoZRr8e3j3EBwG3p+Y=,tag:ttIfOLhDroV/WK57KBFd0w==,type:str]",
-	"sops": {
-		"age": [
-			{
-				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHNVh6OGE4aGJxbFd2Zks1\nL1ZoNkgrQjFSVFFUL2UzOGNqRXFkZURTMkJRCnZMWk00enRndzNXQmFvMG1UekI0\nUjhwZW9sQnFvb0FGbVE0N042UjF2OTAKLS0tIEdickxQdDdaZkVmN3RsemJzSElY\nWThGQVNMcnpxRlJ3bC9wVE56blljQUUK21wWOBiQc0Kyvl047nJ1N6QKR0/5Dd6r\nlqhhdFWninzqfVXJUk2pcMio8RVlvBujDsyjrPuhbRceSi+bUXIn+w==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2025-07-09T10:03:08Z",
-		"mac": "ENC[AES256_GCM,data:kA2KCDZkZuR5rD7uU4xn5sIkizcnpGcoa3PYMbl73eux7JJYuSpUojFBRcYo1WCwMeOQUGsqo8LVF/rYhH4BVJ9LERs5zTLBaUsTarY8r/UK0Q5lNYZqIrqcb5LgOf1uCvfdXg5yfaFgPFJrEqjeekb9bx8xvhDZXpsND93rrUI=,iv:B6JqWWcQV/MxP4ucAIe7EnLiq9c4pnAUj3dnEp9IXJU=,tag:1i0Fv2i7Lak5JzIbPa2/cw==,type:str]",
-		"unencrypted_suffix": "_unencrypted",
-		"version": "3.10.2"
-	}
-}

clanServices/data-mesher/tests/vm/vars/per-machine/admin/data-mesher-host-key/private_key/secret

@@ -1,19 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:2FgvnmawAdk+/k+RVWNsKQlUFUF+pZrrEBuupdG50uLNyxHd7Gi772gKNgHWyzZ/lpODg5mQi0rL+GmZYQwtZ7h76AGUEeQvuMMTzVUop69txxwhJD2dxZyhUAxZpibwo/St84ai+8+VksLkCSYfTXCulaeOVh4=,iv:YkPNq4zDj35PRNgt2kHEkHhbLcVc9dHP/zrAwdd94sM=,tag:KwW/74C7Z/+3dNoXB3NHwQ==,type:str]",
-	"sops": {
-		"age": [
-			{
-				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoaS94M0JsR2Q5N21DNnFB\nUHgvelRTK3FKZkNKcTJFbEJ1VGFIM256MVVRCmw5YjdyTVlXMlFpWnczV2dTSzhu\nSm5mMVRPeU1pYVFZNEN5MjJFZHVTejgKLS0tIDB0V2hSRkt5QzFYald0TWVza1lC\ncGNXemhGcklENTJiV1QvTFZxUDNRRlUK2dVEzSbdDNXZy7rQi5/Vq4KyHq5rMtEz\npTI8i1rFKIAy4TC7to03bOIudOIzKSCCzX31xARkM6qON0vEU9aHFg==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1r99qtxl0v86wg8ndcem87yk5wag5xcsk98ngaumqzww6t7pyms0q5cyl80",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEOEMzcExzTTF3MmpaenRN\ncS9RbnM0aStZSjNqbjF4QisrRjhoaDg1T0ZBCmFVOWJYZkFaOXBOUGJTdytYWk52\nVXV1MDdmSWQ1OS9iODAvN2c2Q3VGYXMKLS0tIEQxeWR4bmRoOWJ2Z1FyUk1PUk1n\nM0c5Ri9FdG9FNE9CZ29VSmgvN2xDdjgKjfG38gVOXXN2ftGiCPxMFbnh7lKM1USl\nqf11k+rgvR8M9XsDy2SnirKAaNmpks1dR6Zs5ppQuYJDEYyQCrEO5g==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2025-07-09T10:02:45Z",
-		"mac": "ENC[AES256_GCM,data:TEH57vUZ/swTsWQPJ1X3J//xa1Q1LYPETZS7fuXCH1LCK51u88XGqVpNzSETREQ8LAOt34qN284b03UQIBGTeTr7I9cqt+/l8ew/0rFTiO3aiaT49q9aBkeFZlA+gy47r4hkhMmzGQJMUenvnzTHwT3Pw2RES5Vjs/2TSitpqlA=,iv:ffIotRGKU8y6j/VDLKbTmA8dZJVP5vafeG4F3wd60tc=,tag:q4xOwzLw5jxDR0pPIy2irA==,type:str]",
-		"unencrypted_suffix": "_unencrypted",
-		"version": "3.10.2"
-	}
-}

clanServices/data-mesher/tests/vm/vars/per-machine/admin/data-mesher-host-key/public_key/value

@@ -1,3 +0,0 @@
------BEGIN PUBLIC KEY-----
-MCowBQYDK2VwAyEAi6qF8u2uvPXlSflB4fzJNlOhj5PgAmRiv+JyyYOOgg4=
------END PUBLIC KEY-----

clanServices/data-mesher/tests/vm/vars/per-machine/peer/data-mesher-host-key/private_key/secret

@@ -1,19 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:LUNuEP/xSmzJ44sheoIYN6F24Qpr3svn6rTVUpr4KZA8uVJ9gPUd4ko4+pDisc9PyXCcxx+cYGRqr1cBp8Q3R+IyFFlR2HzuReQJaScvgjlntGtMJ2hin/aBp4pHS0F4nqPcKKROiZvIN4NHsxQ6XRVDOZbI3kE=,iv:BdRHjQXJL/OGgmqWaEDLit/zHgduNfPe3GUmYDrWLPw=,tag:N0n7CCiu+COgrfrwHUwQBQ==,type:str]",
-	"sops": {
-		"age": [
-			{
-				"recipient": "age1hgjs2yqxhcxfgtvhydnfe5wzlagxw2dw4hu658e8neduy0lkye0skmjfc7",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCYlhrU2c1NnIyTzlVRHEx\nQTFxOUY1OWJXcHl1OHpPdWN1ZGpQV0UvZ1NzCnlKbmx0bllWMTd1ZnIxUHY0ZUU0\nVG9Jb3grSEdWeVpwaHoyQUxvNERqT00KLS0tIGtwZm5aMU1DOUhJbVVpVzIxZFow\nNVEvMy91SEg3M094MEFBSkVMRkhKZmMKuUzbEITGkYS39G14JXbKWLjiQFd4SVft\nWH34B97TFhOqusVF3zHsSCMxm/0BMeBvLxO/3RmzlwBtgNiKOqLwtQ==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2SUhJQW5EN0VKVHpQdlZC\nYTczdVJiRFdFNGtURFc2SmxKWFFycjZkQUgwCnRBVkJvUytuUDlhVlhFYno2cnBR\nRUdjL0lab1MwZzhGTklyVWZDVFJmN3cKLS0tIFRjOC9DS3llWGZWMGI2aThVYTRu\nVEFhK2Y2YkRTZHEyMWV0Q05ISHdhVVUKo9bPdV1dUeIkm4gI0r9V/s1dAfJC+H5Z\nEIUdYA7fl3jRZ01cSZ0iYWlvdl2jj0XzKafZsEQU7rL0jg9zbA2s2g==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2025-07-09T10:02:59Z",
-		"mac": "ENC[AES256_GCM,data:+JtuPacwUMHXtp93DZmkiVne7bQUP8J7VpoS8koM0oJWJqZoQRHd9qH/04lrpp8q/YoOXtqXwhViZvFLieJVRexiXf/AAHfAfMn0EI7ois9oHhscN88Ps9nY6JUxhNd0h0OrUA58KKhrkGoqreAKAPADtVhaVCmWbU7vMUu1StE=,iv:BmJnTsgMSbl4XsBUkhSLfKd0XjhrEQfurEkaRJ6uD/g=,tag:jg21c4y4bQp0RwWTXkxF1A==,type:str]",
-		"unencrypted_suffix": "_unencrypted",
-		"version": "3.10.2"
-	}
-}

clanServices/data-mesher/tests/vm/vars/per-machine/peer/data-mesher-host-key/public_key/value

@@ -1,3 +0,0 @@
------BEGIN PUBLIC KEY-----
-MCowBQYDK2VwAyEA7kRKjQpj+BXPe5buvDZtBAcU1HIcfGmbuHZqaVm3zCo=
------END PUBLIC KEY-----

clanServices/data-mesher/tests/vm/vars/per-machine/signer/data-mesher-host-key/private_key/secret

@@ -1,19 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:armAfuTE0mkoy1fxAysCX/UPNM4/mt9P6/zEDwtagTSvQjMTwVzzsM+kRdLOUV4fbZ7HdqMceaZWzurAQJenXvWlBXgn87YFOFBSpf3OnpEwCTUs9H8dsVrdSUk4SrKjCjV33mybTrae/h9tMHdkRhKJzPD1+/8=,iv:x9KVGqT2Ug6B6PNwzL7NVDQqyOmFUptUsHAJEdn30dg=,tag:XSSO6JvXaXq8aezYvpF65Q==,type:str]",
-	"sops": {
-		"age": [
-			{
-				"recipient": "age1k6h9mespmnr9zhtwwqlhnla80x5jhpd4c2p7hp0nfanr5tspup0s0rld2f",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIMVUwMEFzVjJhYXg5MXR4\nMzZPZUFrUWdEU2hPWUVDNHpVVENpdEdYSWtnCnN0R2pVdEIxYWZXYWNBb3N5bGNK\naVpWOXp5aWVJWG9vUWtMUnhYSmMyV0UKLS0tIEtMdFAybk1PN0t2M2lkaEYzUTY3\nVzVOdTBFbnlNVTAvRU5kU0dReEZ6MlUKNHIkAUUAqnuMtXbvXqLxQwuFALsnD/i0\naBCiz6J4S18uqt3kFbXAEksbD7jCexI8m5SMp4iuumWJ/Bx1lL4TWg==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkbzBFSGt1dXI2bDN5TmFU\nY3N6djNmMTh2ek4vUzdHbTF6Z1hDQ2t5WVNJClEzZDZiaVpBekFrYTYweDNsNmk5\nTlhYZGRNd0llMndyMkZWMyt5N3pwTE0KLS0tIGJJbU9vbnBhSE5vRW1pRG83cEFJ\nR2xDTHk3VkJaVUZSVThRV3Jldkp6cnMK1V37txaSFYfLQM0qqRWjojyTN4fTJkRm\nGO3yHX9uwo/4D2xI7LM48n4vnNhSF05bWpq0X4r13fI4DofCJeEo1g==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2025-07-09T10:03:11Z",
-		"mac": "ENC[AES256_GCM,data:qD1w+DO8cWFDQMBOrmO9FvxvJRn+mlUbh13exTGgmsdPn3uzTXknIDDHeWfkpF699nSzS6wRmgrB21e55rBU6iHMx1TW16S8wvCoYMFwib8zTrJzND7EJr/gRwQa0N080kBY3xBivKLUFlctgKtFUYZ9GQ6UTQeq18QKPoROjww=,iv:1mt8Er6YHxQ42F5Kb+xNtjbCAzokbeoNlHesC9Uzmhk=,tag:provO4tKDzoL5PHDg5EmhA==,type:str]",
-		"unencrypted_suffix": "_unencrypted",
-		"version": "3.10.2"
-	}
-}

clanServices/data-mesher/tests/vm/vars/per-machine/signer/data-mesher-host-key/public_key/value

@@ -1,3 +0,0 @@
------BEGIN PUBLIC KEY-----
-MCowBQYDK2VwAyEAVA6c25s+yNe5225PnELDV9FwbWi9ppLoTfgmdY8kILo=
------END PUBLIC KEY-----

clanServices/data-mesher/tests/vm/vars/shared/data-mesher-network-key/private_key/secret

@@ -1,27 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:VzcB/JABSPoFdKYhRSn+nKxasn9zO/9fyNMrg3XstBelQNPpbO8mhmcnSamc/7e5GkpoVWgLRSULvosv+o6sz9EHRZ3UpSLBBTkDGAJmoBnkR8DbstPA9EgScpQ9IGOUP5tQ0oEOcJC3FrivdbWIzeXjpWb9BrU=,iv:6BNUrubJ9aNCkgonDRNgdyckCTndkPVDLE4X3J5d2zA=,tag:YqHTiGslEkslzUk24bmPZg==,type:str]",
-	"sops": {
-		"age": [
-			{
-				"recipient": "age1hgjs2yqxhcxfgtvhydnfe5wzlagxw2dw4hu658e8neduy0lkye0skmjfc7",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwK2lMUTkrSmM4dHQxU0tI\nRVV6Wm4wWlJMYXBGbGdubExrMi8vRnJjdVd3CjI3aFVpdHRURHp6UEk3ZEZMcDZT\nZWZWaGFWYmY2Mk1iQ1BjalZkUnpUUm8KLS0tIEhFUVhBUjg1dC9LWHg2TytkRTlX\nNnlJZkJQc2ExK1BwaVVFcEw2b3BLZjQK8kqf3ZP9uLtbjCJLSEYpAqgq9zOS2HrY\n5MbPAKQI8iCUfnegti6hU+/MxjvPlaX1vT4V0Kd3gT4Khjl+OPw0Og==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1r99qtxl0v86wg8ndcem87yk5wag5xcsk98ngaumqzww6t7pyms0q5cyl80",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWeUk3ZW9rdnZBTk9vQlFZ\nTzFZVDAvcXZyQjdkcGNNbnA0T3UyM3lzVERvCjFreE9RdWxnb2xWWmI4amJVdHBv\nNE9JN2tFazRnSGhiM0FId2RCUHNKWVEKLS0tIGlmM3JNSVZtR21ndFliUVpLTzJO\ncHJ2SjI1OExQK2hEN01WdG9wZ3RmVTAKi0BXp9yV2/9a9NeT7aTSK2CfkQ5yColJ\nm0+uv5AJndZ9IsaZGJxNOdAOspYdvsW38hFdfjUtVuUCyIOPc20WUg==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1k6h9mespmnr9zhtwwqlhnla80x5jhpd4c2p7hp0nfanr5tspup0s0rld2f",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkSUR1QVMvZ3F0NUxXd00z\nOWJGZFlsUy8vUmMxa1NoakZRVmJrSmd1RzBrCk1ZcDlBMFB0WVdWeFZaT3ZBTTh5\nS2RReWpUOGRBdGV6MDdjcEY5dFYrdjAKLS0tIG9oRWhUaWJZSElRdmlOZmRKSnNq\nUUNDZFdZbmM0c25MOGpvem1JSm9pVWsKxCLPivdHc6IN6Jbf9FujLGJaXP6ieO1S\nKsrs3Fe0RdYcEKI7P9EQNebQD2kKXficM0kKV5lRRVtW5024PftWoQ==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3amkyWWlxSTJkZEdMZFhL\nU2t5OGFIa25TRmdFM0ZNcUhFRHk0eDJQN2tjCm9UcUs2V0lEZ0hyNU9uaDVrckpj\nZ1JSQlhNeExjOER2aFJTM2NDS25PN2MKLS0tIFhmM21rT0Z4aUI5TUZyNnNBQ3Jy\nSDAxejhhZDZNQTVCNjNUSTBsZncra1kKFFQrFxNMyg0AEMb1wpKBc7LOVtEHyFZW\n/o7L52fTNa0GFJ3SVEdqg0PpnRzTyA8F5L77FBGKtx6auCVVHyZZ9g==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2025-07-09T10:02:48Z",
-		"mac": "ENC[AES256_GCM,data:HooesDb1S24Cfb7H0lVTA8fAjM2QAN9MaJFvOSHniR6ICJAX8t8X0xfWIFRFuwPjAxi4kpBYSjW0420Yz9lZ2m4Fxswo1TV3lzHDVN2u9hdrsfpKXg5fW+2oZihuvCRStDagT3l2fKv+C+gBnGs1qyCM60BStvrEiQxTxTTHfho=,iv:kL8N0qBj4q+ZJbNJ8Y8RcV1KpUUMvNCpdwKbTPGpG6k=,tag:o2PmRsSkqTP5Idq7veGDOw==,type:str]",
-		"unencrypted_suffix": "_unencrypted",
-		"version": "3.10.2"
-	}
-}

clanServices/data-mesher/tests/vm/vars/shared/data-mesher-network-key/public_key/value

@@ -1,3 +0,0 @@
------BEGIN PUBLIC KEY-----
-MCowBQYDK2VwAyEA/MuamRX6ZLcJunm7lZvlai0OZh++YuqMa56GiTwO68A=
------END PUBLIC KEY-----

clanServices/emergency-access/default.nix

@@ -4,7 +4,6 @@
   manifest.name = "clan-core/emergency-access";
   manifest.description = "Set recovery password for emergency access to machine";
   manifest.categories = [ "System" ];
-  manifest.readme = builtins.readFile ./README.md;
 
   roles.default.perInstance = {
     nixosModule =

clanServices/hello-world/flake-module.nix

@@ -23,13 +23,7 @@ in
       unit-test-module = (
         self.clanLib.test.flakeModules.makeEvalChecks {
           inherit module;
-          inherit inputs;
-          fileset = lib.fileset.unions [
-            # The hello-world service being tested
-            ../../clanServices/hello-world
-            # Required modules
-            ../../nixosModules/clanCore
-          ];
+          inherit self inputs;
           testName = "hello-world";
           tests = ./tests/eval-tests.nix;
           # Optional arguments passed to the test

clanServices/sshd/default.nix

@@ -7,7 +7,6 @@
     "System"
     "Network"
   ];
-  manifest.readme = builtins.readFile ./README.md;
 
   roles.client = {
     interface =

clanServices/state-version/default.nix

@@ -4,7 +4,6 @@
   manifest.name = "clan-core/state-version";
   manifest.description = "Automatically generate the state version of the nixos installation.";
   manifest.categories = [ "System" ];
-  manifest.readme = builtins.readFile ./README.md;
 
   roles.default = {
 

clanServices/trusted-nix-caches/default.nix

@@ -4,7 +4,6 @@
   manifest.name = "clan-core/trusted-nix-caches";
   manifest.description = "This module sets the `clan.lol` and `nix-community` cache up as a trusted cache.";
   manifest.categories = [ "System" ];
-  manifest.readme = builtins.readFile ./README.md;
 
   roles.default = {
 

clanServices/users/default.nix

@@ -1,17 +1,13 @@
 { ... }:
 {
   _class = "clan.service";
-  manifest.name = "clan-core/user";
-  manifest.description = ''
-    An instance of this module will create a user account on the added machines,
-    along with a generated password that is constant across machines and user settings.
-  '';
+  manifest.name = "clan-core/users";
+  manifest.description = "Automatically generates and configures a password for the specified user account.";
   manifest.categories = [ "System" ];
-  manifest.readme = builtins.readFile ./README.md;
 
   roles.default = {
     interface =
-      { config, lib, ... }:
+      { lib, ... }:
       {
         options = {
           user = lib.mkOption {
@@ -23,58 +19,7 @@
             type = lib.types.bool;
             default = true;
             example = false;
-            description = ''
-              Whether the user should be prompted for a password.
-
-              Effects:
-
-              - *enabled* (`true`) - Prompt for a password during the machine installation or update workflow.
-              - *disabled* (`false`) - Generate a password during the machine installation or update workflow.
-
-              The password can be shown in two steps:
-
-              - `clan vars list <machine-name>`
-              - `clan vars get <machine-name> <name-of-password-variable>`
-            '';
-          };
-          regularUser = lib.mkOption {
-            type = lib.types.bool;
-            default = config.user != "root";
-            defaultText = lib.literalExpression "config.user != \"root\"";
-            example = false;
-            description = ''
-              Whether the user should be a regular user or a system user.
-
-              Regular users are normal users that can log in and have a home directory.
-
-              System users are used for system services and do not have a home directory.
-
-              !!! Warning
-                  `root` cannot be a regular user.
-                  You must set this to `false` for `root`
-            '';
-          };
-          groups = lib.mkOption {
-            type = lib.types.listOf lib.types.str;
-            default = [ ];
-            example = [
-              "wheel"
-              "networkmanager"
-              "video"
-              "input"
-            ];
-            description = ''
-              Additional groups the user should be added to.
-              You can add any group that exists on your system.
-              Make sure these group exists on all machines where the user is enabled.
-
-              Commonly used groups:
-
-              - "wheel" - Allows the user to run commands as root using `sudo`.
-              - "networkmanager" - Allows the user to manage network connections.
-              - "video" - Allows the user to access video devices.
-              - "input" - Allows the user to access input devices.
-            '';
+            description = "Whether the user should be prompted.";
           };
         };
       };
@@ -90,13 +35,9 @@
             ...
           }:
           {
-            users.users.${settings.user} = {
-              isNormalUser = settings.regularUser;
-              extraGroups = settings.groups;
-
-              hashedPasswordFile =
-                config.clan.core.vars.generators."user-password-${settings.user}".files.user-password-hash.path;
-            };
+            users.mutableUsers = false;
+            users.users.${settings.user}.hashedPasswordFile =
+              config.clan.core.vars.generators."user-password-${settings.user}".files.user-password-hash.path;
 
             clan.core.vars.generators."user-password-${settings.user}" = {
 
@@ -139,11 +80,4 @@
           };
       };
   };
-
-  perMachine = {
-    nixosModule = {
-      # Immutable users to ensure that this module has exclusive control over the users.
-      users.mutableUsers = false;
-    };
-  };
 }

clanServices/users/tests/vm/default.nix

@@ -31,6 +31,7 @@
     server = {
       users.users.testuser.group = "testuser";
       users.groups.testuser = { };
+      users.users.testuser.isNormalUser = true;
     };
   };
 

clanServices/zerotier/flake-module.nix

@@ -15,15 +15,7 @@ in
       unit-test-module = (
         self.clanLib.test.flakeModules.makeEvalChecks {
           inherit module;
-          inherit inputs;
-          fileset = lib.fileset.unions [
-            # The zerotier service being tested
-            ../../clanServices/zerotier
-            # Required modules
-            ../../nixosModules/clanCore
-            # Dependencies like clan-cli
-            ../../pkgs/clan-cli
-          ];
+          inherit self inputs;
           testName = "zerotier";
           tests = ./tests/eval-tests.nix;
           testArgs = { };

devFlake/private.narHash

@@ -1 +0,0 @@
-sha256-LdjcFZLL8WNldUO2LbdqFlss/ERiGeXVqMee0IxV2z0=

devFlake/private/flake.lock

@@ -1,165 +0,0 @@
-{
-  "nodes": {
-    "flake-utils": {
-      "inputs": {
-        "systems": [
-          "systems"
-        ]
-      },
-      "locked": {
-        "lastModified": 1731533236,
-        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "flake-utils_2": {
-      "inputs": {
-        "systems": "systems"
-      },
-      "locked": {
-        "lastModified": 1731533236,
-        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "ixx": {
-      "inputs": {
-        "flake-utils": [
-          "nuschtos",
-          "flake-utils"
-        ],
-        "nixpkgs": [
-          "nuschtos",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1748294338,
-        "narHash": "sha256-FVO01jdmUNArzBS7NmaktLdGA5qA3lUMJ4B7a05Iynw=",
-        "owner": "NuschtOS",
-        "repo": "ixx",
-        "rev": "cc5f390f7caf265461d4aab37e98d2292ebbdb85",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NuschtOS",
-        "ref": "v0.0.8",
-        "repo": "ixx",
-        "type": "github"
-      }
-    },
-    "nixpkgs-dev": {
-      "locked": {
-        "lastModified": 1752467518,
-        "narHash": "sha256-7SSvjNlM5ZsFZMP7Nw2uUa7EKYhB6Ny9iNtxtPPhWYY=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "2f21cef1d1dc734a2dd89f535427cf291aebc8ef",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-unstable-small",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nuschtos": {
-      "inputs": {
-        "flake-utils": "flake-utils_2",
-        "ixx": "ixx",
-        "nixpkgs": [
-          "nixpkgs-dev"
-        ]
-      },
-      "locked": {
-        "lastModified": 1749730855,
-        "narHash": "sha256-L3x2nSlFkXkM6tQPLJP3oCBMIsRifhIDPMQQdHO5xWo=",
-        "owner": "NuschtOS",
-        "repo": "search",
-        "rev": "8dfe5879dd009ff4742b668d9c699bc4b9761742",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NuschtOS",
-        "repo": "search",
-        "type": "github"
-      }
-    },
-    "root": {
-      "inputs": {
-        "flake-utils": "flake-utils",
-        "nixpkgs-dev": "nixpkgs-dev",
-        "nuschtos": "nuschtos",
-        "systems": "systems_2",
-        "treefmt-nix": "treefmt-nix"
-      }
-    },
-    "systems": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    },
-    "systems_2": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    },
-    "treefmt-nix": {
-      "inputs": {
-        "nixpkgs": []
-      },
-      "locked": {
-        "lastModified": 1752055615,
-        "narHash": "sha256-19m7P4O/Aw/6+CzncWMAJu89JaKeMh3aMle1CNQSIwM=",
-        "owner": "numtide",
-        "repo": "treefmt-nix",
-        "rev": "c9d477b5d5bd7f26adddd3f96cfd6a904768d4f9",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "treefmt-nix",
-        "type": "github"
-      }
-    }
-  },
-  "root": "root",
-  "version": 7
-}

devFlake/private/flake.nix

@@ -1,19 +0,0 @@
-{
-  description = "private dev inputs";
-
-  # Dev dependencies
-  inputs.nixpkgs-dev.url = "github:NixOS/nixpkgs/nixos-unstable-small";
-
-  inputs.flake-utils.url = "github:numtide/flake-utils";
-  inputs.flake-utils.inputs.systems.follows = "systems";
-
-  inputs.nuschtos.url = "github:NuschtOS/search";
-  inputs.nuschtos.inputs.nixpkgs.follows = "nixpkgs-dev";
-
-  inputs.treefmt-nix.url = "github:numtide/treefmt-nix";
-  inputs.treefmt-nix.inputs.nixpkgs.follows = "";
-
-  inputs.systems.url = "github:nix-systems/default";
-
-  outputs = _: { };
-}

devFlake/update-private-narhash

@@ -1,12 +0,0 @@
-#!/usr/bin/env bash
-# Used to update the private dev flake hash reference.
-set -euo pipefail
-
-cd "$(dirname "$0")"
-
-echo "Updating $PWD/private.narHash" >&2
-
-nix --extra-experimental-features 'flakes nix-command' flake lock ./private
-nix --extra-experimental-features 'flakes nix-command' hash path ./private >./private.narHash
-
-echo OK

docs/mkdocs.yml

@@ -51,7 +51,6 @@ nav:
           - 🚀 Creating Your First Clan: guides/getting-started/index.md
           - 📀 Create USB Installer (optional): guides/getting-started/installer.md
           - ⚙️ Add Machines: guides/getting-started/add-machines.md
-          - ⚙️ Add User: guides/getting-started/add-user.md
           - ⚙️ Add Services: guides/getting-started/add-services.md
           - 🔐 Secrets & Facts: guides/getting-started/secrets.md
           - 🚢 Deploy Machine: guides/getting-started/deploy.md
@@ -80,7 +79,6 @@ nav:
           - Migrate existing Flakes: guides/migrations/migration-guide.md
           - Migrate inventory Services: guides/migrations/migrate-inventory-services.md
           - Facts Vars Migration: guides/migrations/migration-facts-vars.md
-          - Disk id: guides/migrations/disk-id.md
       - macOS: guides/macos.md
   - Reference:
       - Overview: reference/index.md
@@ -88,7 +86,6 @@ nav:
           - Overview: reference/clanServices/index.md
           - reference/clanServices/admin.md
           - reference/clanServices/borgbackup.md
-          - reference/clanServices/data-mesher.md
           - reference/clanServices/emergency-access.md
           - reference/clanServices/garage.md
           - reference/clanServices/hello-world.md
@@ -202,6 +199,7 @@ theme:
     - navigation.instant
     - navigation.tabs
     - navigation.tabs.sticky
+    - navigation.footer
     - content.code.annotate
     - content.code.copy
     - content.tabs.link

docs/nix/default.nix

@@ -1,4 +1,5 @@
 {
+  clan-core,
   pkgs,
   module-docs,
   clan-cli-docs,
@@ -18,17 +19,7 @@ pkgs.stdenv.mkDerivation {
 
   # Points to repository root.
   # so that we can access directories outside of docs to include code snippets
-  src = pkgs.lib.fileset.toSource {
-    root = ../..;
-    fileset = pkgs.lib.fileset.unions [
-      # Docs directory
-      ../../docs
-      # Icons needed for the build
-      ../../pkgs/clan-app/ui/icons
-      # Any other directories that might be referenced for code snippets
-      # Add them here as needed based on what mkdocs actually uses
-    ];
-  };
+  src = clan-core;
 
   nativeBuildInputs =
     [

docs/nix/flake-module.nix

@@ -29,10 +29,7 @@
       # Frontmatter for clanModules
       clanModulesFrontmatter =
         let
-          docs = pkgs.nixosOptionsDoc {
-            options = self.clanLib.modules.frontmatterOptions;
-            transformOptions = self.clanLib.docs.stripStorePathsFromDeclarations;
-          };
+          docs = pkgs.nixosOptionsDoc { options = self.clanLib.modules.frontmatterOptions; };
         in
         docs.optionsJSON;
 
@@ -85,9 +82,10 @@
           }
           ''
             export CLAN_CORE_PATH=${
-              inputs.nixpkgs.lib.fileset.toSource {
-                root = ../..;
-                fileset = ../../clanModules;
+              self.filter {
+                include = [
+                  "clanModules"
+                ];
               }
             }
             export CLAN_CORE_DOCS=${jsonDocs.clanCore}/share/doc/nixos/options.json
@@ -128,6 +126,7 @@
       });
       packages = {
         docs = pkgs.python3.pkgs.callPackage ./default.nix {
+          clan-core = self;
           inherit (self'.packages)
             clan-cli-docs
             docs-options

docs/nix/get-module-docs.nix

@@ -7,10 +7,6 @@
   pkgs,
   clan-core,
 }:
-let
-  inherit (clan-core.clanLib.docs) stripStorePathsFromDeclarations;
-  transformOptions = stripStorePathsFromDeclarations;
-in
 {
   # clanModules docs
   clanModulesViaNix = lib.mapAttrs (
@@ -24,7 +20,6 @@ in
           }).options
           ).clan.${name} or { };
         warningsAreErrors = true;
-        inherit transformOptions;
       }).optionsJSON
     else
       { }
@@ -37,7 +32,6 @@ in
       (nixosOptionsDoc {
         inherit options;
         warningsAreErrors = true;
-        inherit transformOptions;
       }).optionsJSON
     ) rolesOptions
   ) modulesRolesOptions;
@@ -58,15 +52,7 @@ in
 
         (nixosOptionsDoc {
           transformOptions =
-            opt:
-            let
-              # Apply store path stripping first
-              transformed = transformOptions opt;
-            in
-            if lib.strings.hasPrefix "_" transformed.name then
-              transformed // { visible = false; }
-            else
-              transformed;
+            opt: if lib.strings.hasPrefix "_" opt.name then opt // { visible = false; } else opt;
           options = (lib.evalModules { modules = [ role.interface ]; }).options;
           warningsAreErrors = true;
         }).optionsJSON
@@ -86,6 +72,5 @@ in
         }).options
         ).clan.core or { };
       warningsAreErrors = true;
-      inherit transformOptions;
     }).optionsJSON;
 }

docs/nix/options/flake-module.nix

@@ -1,15 +1,9 @@
-{
-  self,
-  config,
-  inputs,
-  privateInputs ? { },
-  ...
-}:
+{ self, config, ... }:
 {
   perSystem =
     {
+      inputs',
       lib,
-      pkgs,
       ...
     }:
     let
@@ -163,16 +157,11 @@
       };
     in
     {
-      packages = lib.optionalAttrs ((privateInputs ? nuschtos) || (inputs ? nuschtos)) {
-        docs-options =
-          (privateInputs.nuschtos or inputs.nuschtos)
-          .packages.${pkgs.stdenv.hostPlatform.system}.mkMultiSearch
-            {
-              inherit baseHref;
-              title = "Clan Options";
-              # scopes = mapAttrsToList mkScope serviceModules;
-              scopes = [ (mkScope "Clan Inventory" serviceModules) ];
-            };
+      packages.docs-options = inputs'.nuschtos.packages.mkMultiSearch {
+        inherit baseHref;
+        title = "Clan Options";
+        # scopes = mapAttrsToList mkScope serviceModules;
+        scopes = [ (mkScope "Clan Inventory" serviceModules) ];
       };
     };
 }

docs/nix/render_options/__init__.py

@@ -29,13 +29,13 @@ from dataclasses import dataclass, field
 from pathlib import Path
 from typing import Any
 
-from clan_lib.errors import ClanError
-from clan_lib.services.modules import (
+from clan_lib.api.modules import (
     CategoryInfo,
     Frontmatter,
     extract_frontmatter,
     get_roles,
 )
+from clan_lib.errors import ClanError
 
 # Get environment variables
 CLAN_CORE_PATH = Path(os.environ["CLAN_CORE_PATH"])
@@ -62,11 +62,14 @@ def sanitize(text: str) -> str:
     return text.replace(">", "\\>")
 
 
-def replace_git_url(text: str) -> tuple[str, str]:
+def replace_store_path(text: str) -> tuple[str, str]:
     res = text
-    name = Path(res).name
-    if text.startswith("https://git.clan.lol/clan/clan-core/src/branch/main/"):
-        name = str(Path(*Path(text).parts[7:]))
+    if text.startswith("/nix/store/"):
+        res = "https://git.clan.lol/clan/clan-core/src/branch/main/" + str(
+            Path(*Path(text).parts[4:])
+        )
+    # name = Path(res).name
+    name = str(Path(*Path(text).parts[4:]))
     return (res, name)
 
 
@@ -156,7 +159,7 @@ def render_option(
 
     decls = option.get("declarations", [])
     if decls:
-        source_path, name = replace_git_url(decls[0])
+        source_path, name = replace_store_path(decls[0])
 
         name = name.split(",")[0]
         source_path = source_path.split(",")[0]
@@ -449,6 +452,7 @@ Each `clanService`:
 * Is a module of class **`clan.service`**
 * Can define **roles** (e.g., `client`, `server`)
 * Uses **`inventory.instances`** to configure where and how it is deployed
+* Replaces the legacy `clanModules` and `inventory.services` system altogether
 
 !!! Note
     `clanServices` are part of Clan's next-generation service model and are intended to replace `clanModules`.

docs/site/guides/authoring/clanModules/index.md

@@ -52,7 +52,6 @@ clanModules/borgbackup
 
     ```nix title="flake.nix"
     # ...
-    # Sometimes this attribute set is defined in clan.nix
     clan-core.lib.clan {
         # 1. Add the module to the available clanModules with inventory support
         inventory.modules = {
@@ -176,7 +175,6 @@ The following shows how to add options to your module.
     Configuration can be set as follows.
 
     ```nix title="flake.nix"
-    # Sometimes this attribute set is defined in clan.nix
     clan-core.lib.clan {
         inventory.services = {
             custom-module.instance_1 = {

docs/site/guides/authoring/clanServices/index.md

@@ -27,7 +27,6 @@ i.e. `@hsjobeki/customNetworking`
 outputs = inputs: inputs.flake-parts.lib.mkFlake { inherit inputs; } ({
     imports = [ inputs.clan-core.flakeModules.default ];
     # ...
-    # Sometimes this attribute set is defined in clan.nix
     clan = {
         # If needed: Exporting the module for other people
         modules."@hsjobeki/customNetworking" = import ./service-modules/networking.nix;
@@ -219,7 +218,6 @@ To import the module use `importApply`
 outputs = inputs: flake-parts.lib.mkFlake { inherit inputs; } ({self, lib, ...}: {
     imports = [ inputs.clan-core.flakeModules.default ];
     # ...
-    # Sometimes this attribute set is defined in clan.nix
     clan = {
         # Register the module
         modules."@hsjobeki/messaging" = lib.importApply ./service-modules/messaging.nix { inherit self; };
@@ -246,7 +244,6 @@ Then wrap the module and forward the variable `self` from the outer context into
 outputs = inputs: flake-parts.lib.mkFlake { inherit inputs; } ({self, lib, ...}: {
     imports = [ inputs.clan-core.flakeModules.default ];
     # ...
-    # Sometimes this attribute set is defined in clan.nix
     clan = {
         # Register the module
         modules."@hsjobeki/messaging" = {

docs/site/guides/contributing/debugging.md

@@ -55,37 +55,9 @@ If you're using VSCode, it has a handy feature that makes paths to source code f
 
 ## Finding Print Messages
 
-To trace the origin of print messages in `clan-cli`, you can enable special debugging features using environment variables:
-
-- Set `TRACE_PRINT=1` to include the source location with each print message:
-    ```bash
-    export TRACE_PRINT=1
-    ```
-    When running commands with `--debug`, every print will show where it was triggered in the code.
-
-- To see a deeper stack trace for each print, set `TRACE_DEPTH` to the desired number of stack frames (e.g., 3):
-    ```bash
-    export TRACE_DEPTH=3
-    ```
-
-### Additional Debug Logging
-
-You can enable more detailed logging for specific components by setting these environment variables:
-
-- `CLAN_DEBUG_NIX_SELECTORS=1` — verbose logs for flake.select operations
-- `CLAN_DEBUG_NIX_PREFETCH=1` — verbose logs for flake.prefetch operations
-- `CLAN_DEBUG_COMMANDS=1` — print the diffed environment of executed commands
-
-Example:
-```bash
-export CLAN_DEBUG_NIX_SELECTORS=1
-export CLAN_DEBUG_NIX_PREFETCH=1
-export CLAN_DEBUG_COMMANDS=1
-```
-
-These options help you pinpoint the source and context of print messages and debug logs during development.
-
+To identify where a specific print message comes from, you can enable a helpful feature. Simply set the environment variable `export TRACE_PRINT=1`. When you run commands with `--debug` mode, each print message will include information about its source location.
 
+If you need more details, you can expand the stack trace information that appears with each print by setting the environment variable `export TRACE_DEPTH=3`.
 
 ## Analyzing Performance
 
@@ -133,7 +105,7 @@ git+file:///home/lhebendanz/Projects/clan-core
 │       ├───editor omitted (use '--all-systems' to show)
 └───templates
     ├───default: template: Initialize a new clan flake
-    └───default: template: Initialize a new clan flake
+    └───new-clan: template: Initialize a new clan flake
 ```
 
 You can execute every test separately by following the tree path `nix run .#checks.x86_64-linux.clan-pytest -L` for example.

docs/site/guides/getting-started/add-machines.md

@@ -10,26 +10,67 @@ See the complete [list](../../guides/more-machines.md#automatic-registration) of
 
 ## Create a machine
 
-=== "clan.nix (declarative)"
+=== "flake.nix (flake-parts)"
 
-    ```{.nix hl_lines="3-4"}
+    ```{.nix hl_lines=12-15}
     {
-        inventory.machines = {
-            # Define a machine
-            jon = { };
-        };
+        inputs.clan-core.url = "https://git.clan.lol/clan/clan-core/archive/main.tar.gz";
+        inputs.nixpkgs.follows = "clan-core/nixpkgs";
+        inputs.flake-parts.follows = "clan-core/flake-parts";
+        inputs.flake-parts.inputs.nixpkgs-lib.follows = "clan-core/nixpkgs";
 
-        # Additional NixOS configuration can be added here.
-        # machines/jon/configuration.nix will be automatically imported.
-        # See: https://docs.clan.lol/guides/more-machines/#automatic-registration
-        machines = {
-            # jon = { config, ... }: {
-            #   environment.systemPackages = [ pkgs.asciinema ];
-            # };
+        outputs =
+            inputs@{ flake-parts, ... }:
+            flake-parts.lib.mkFlake { inherit inputs; } {
+                imports = [ inputs.clan-core.flakeModules.default ];
+                clan = {
+                    inventory.machines = {
+                        # Define a machine
+                        jon = { };
+                    };
+                };
+
+                systems = [
+                    "x86_64-linux"
+                    "aarch64-linux"
+                    "x86_64-darwin"
+                    "aarch64-darwin"
+                ];
         };
     }
     ```
 
+=== "flake.nix (classic)"
+
+    ```{.nix hl_lines=11-14}
+    {
+        inputs.clan-core.url = "https://git.clan.lol/clan/clan-core/archive/main.tar.gz";
+        inputs.nixpkgs.follows = "clan-core/nixpkgs";
+
+        outputs =
+            { self, clan-core, ... }:
+            let
+                clan = clan-core.lib.clan {
+                    inherit self;
+
+                    inventory.machines = {
+                        # Define a machine
+                        jon = { };
+                    };
+                };
+            in
+            {
+                inherit (clan.config)
+                    nixosConfigurations
+                    nixosModules
+                    clanInternals
+                    darwinConfigurations
+                    darwinModules
+                    ;
+            };
+    }
+    ```
+
 === "CLI (imperative)"
 
     ```sh
@@ -48,15 +89,15 @@ See the complete [list](../../guides/more-machines.md#automatic-registration) of
 
     The option: `machines.<name>` is used to add extra *nixosConfiguration* to a machine
 
-Add the following to your `clan.nix` file for each machine.
-This example demonstrates what is needed based on a machine called `jon`:
-
-```{.nix .annotate title="clan.nix" hl_lines="3-6 15-19"}
-{
+```{.nix .annotate title="flake.nix" hl_lines="3-13 18-22"}
+clan = {
     inventory.machines = {
         jon = {
-            # Define tags here (optional)
-            tags = [ ]; # (1)
+            # Define targetHost here
+            # Required before deployment
+            deploy.targetHost = "root@jon"; # (1)
+            # Define tags here
+            tags = [ ];
         };
         sara = {
             deploy.targetHost = "root@sara";
@@ -75,24 +116,9 @@ This example demonstrates what is needed based on a machine called `jon`:
 }
 ```
 
-1. Tags can be used to automatically add this machine to services later on. - You dont need to set this now.
+1. It is required to define a *targetHost* for each machine before deploying. Best practice has been, to use the zerotier ip/hostname or the ip from the from overlay network you decided to use.
 2. Add your *ssh key* here - That will ensure you can always login to your machine via *ssh* in case something goes wrong.
 
-### (Optional) Create a `configuration.nix`
-
-```nix title="./machines/jon/configuration.nix"
-{
-    imports = [
-        # enables GNOME desktop (optional)
-        ../../modules/gnome.nix
-    ];
-
-    # Set nixosOptions here
-    # Or import your own modules via 'imports'
-    # ...
-}
-```
-
 ### (Optional) Renaming a Machine
 
 Older templates included static machine folders like `jon` and `sara`.

docs/site/guides/getting-started/add-services.md

@@ -17,61 +17,102 @@ To learn more: [Guide about clanService](../clanServices.md)
 
 ## Configure a Zerotier Network (recommended)
 
-```{.nix title="clan.nix" hl_lines="8-16"}
+```{.nix title="flake.nix" hl_lines="20-28"}
 {
-    inventory.machines = {
-        jon = { };
-        sara = { };
-    };
+    inputs.clan-core.url = "https://git.clan.lol/clan/clan-core/archive/main.tar.gz";
+    inputs.nixpkgs.follows = "clan-core/nixpkgs";
+    inputs.flake-parts.follows = "clan-core/flake-parts";
+    inputs.flake-parts.inputs.nixpkgs-lib.follows = "clan-core/nixpkgs";
 
-    inventory.instances = {
-        zerotier = { # (1)
-            # Replace with the name (string) of your machine that you will use as zerotier-controller
-            # See: https://docs.zerotier.com/controller/
-            # Deploy this machine first to create the network secrets
-            roles.controller.machines."jon" = { }; # (2)
-            # Peers of the network
-            # this line means 'all' clan machines will be 'peers'
-            roles.peer.tags.all = { }; # (3)
-        };
+    outputs =
+        inputs@{ flake-parts, ... }:
+        flake-parts.lib.mkFlake { inherit inputs; } {
+            imports = [ inputs.clan-core.flakeModules.default ];
+            clan = {
+                inventory.machines = {
+                    jon = {
+                        targetHost = "root@jon";
+                    };
+                    sara = {
+                        targetHost = "root@jon";
+                    };
+                };
+                inventory.instances = {
+                    zerotier = { # (1)
+                        # Defines 'jon' as the controller
+                        roles.controller.machines.jon = {};
+                        # Defines all machines as networking peer.
+                        # The 'all' tag is a clan builtin.
+                        roles.peer.tags.all = {};
+                    };
+                }
+            };
+
+            systems = [
+                "x86_64-linux"
+                "aarch64-linux"
+                "x86_64-darwin"
+                "aarch64-darwin"
+            ];
     };
-    # ...
-    # elided
 }
 ```
 
 1. See [reference/clanServices](../../reference/clanServices/index.md) for all available services and how to configure them.
    Or read [authoring/clanServices](../authoring/clanServices/index.md) if you want to bring your own
 
-2. Replace `__YOUR_CONTROLLER_` with the *name* of your machine.
-
-3. This line will add all machines of your clan as `peer` to zerotier
-
 ## Adding more recommended defaults
 
 Adding the following services is recommended for most users:
 
-```{.nix title="clan.nix" hl_lines="7-14"}
+```{.nix title="flake.nix" hl_lines="25-35"}
 {
-    inventory.machines = {
-        jon = { };
-        sara = { };
-    };
-    inventory.instances = {
-        admin = { # (1)
-            roles.default.tags.all = { };
-            roles.default.settings = {
-                allowedKeys = {
-                    "my-user" = "ssh-ed25519 AAAAC3N..."; # (2)
+    inputs.clan-core.url = "https://git.clan.lol/clan/clan-core/archive/main.tar.gz";
+    inputs.nixpkgs.follows = "clan-core/nixpkgs";
+    inputs.flake-parts.follows = "clan-core/flake-parts";
+    inputs.flake-parts.inputs.nixpkgs-lib.follows = "clan-core/nixpkgs";
+
+    outputs =
+        inputs@{ flake-parts, ... }:
+        flake-parts.lib.mkFlake { inherit inputs; } {
+            imports = [ inputs.clan-core.flakeModules.default ];
+            clan = {
+                inventory.machines = {
+                    jon = {
+                        targetHost = "root@jon";
+                    };
+                    sara = {
+                        targetHost = "root@jon";
+                    };
+                };
+                inventory.instances = {
+                    zerotier = {
+                        roles.controller.machines.jon = {};
+                        roles.peer.tags.all = {};
+                    };
+                    admin = { # (1)
+                        roles.default.tags.all = { };
+                        roles.default.settings = {
+                            allowedKeys = {
+                                "my-user" = "ssh-ed25519 AAAAC3N..."; # elided
+                            };
+                        };
+                    };
+                    state-version = { # (2)
+                        roles.default.tags.all = { };
+                    };
                 };
             };
-        };
-        # ...
-        # elided
+            systems = [
+                "x86_64-linux"
+                "aarch64-linux"
+                "x86_64-darwin"
+                "aarch64-darwin"
+            ];
     };
 }
 ```
 
 1. The `admin` service will generate a **root-password** and **add your ssh-key** that allows for convienient administration.
-2. Equivalent to directly setting `authorizedKeys` like in [configuring a machine](./add-machines.md#configuring-a-machine)
-3. Adds `user = jon` as a user on all machines. Will create a `home` directory, and prompt for a password before deployment.
+
+2. The `state-version` service will generate a [nixos state version](https://wiki.nixos.org/wiki/FAQ/When_do_I_update_stateVersion) for each system once it is deployed.

docs/site/guides/getting-started/add-user.md

@@ -1,127 +0,0 @@
-# How to add users
-
-!!! Note "Under construction"
-
-The users concept of clan is not done yet. This guide outlines some solutions from our community.
-Defining users can be done in many different ways. We want to highlight two approaches:
-
-- Using clan's [users](../../reference/clanServices/users.md) service.
-- Using a custom approach.
-
-## Adding Users using the [users](../../reference/clanServices/users.md) service
-
-To add a first *user* this guide will be leveraging two things:
-
-- [clanServices](../../reference/clanServices/index.md): Allows to bind arbitrary logic to something we call an `ìnstance`.
-- [clanServices/users](../../reference/clanServices/users.md): Implements logic for adding a single user perInstance.
-
-The example shows how to add a user called `jon`:
-
-```{.nix title="clan.nix" hl_lines="7-21"}
-{
-    inventory.machines = {
-        jon = { };
-        sara = { };
-    };
-    inventory.instances = {
-        jon-user = { # (1)
-            module.name = "users";
-
-            roles.default.tags.all = { }; # (2)
-
-            roles.default.settings = {
-                user = "jon"; # (3)
-                groups = [
-                    "wheel" # Allow using 'sudo'
-                    "networkmanager" # Allows to manage network connections.
-                    "video" # Allows to access video devices.
-                    "input" # Allows to access input devices.
-                ];
-            };
-        };
-        # ...
-        # elided
-    };
-}
-```
-
-1. Add `user = jon` as a user on all machines. Will create a `home` directory, and prompt for a password before deployment.
-2. Add this user to `all` machines
-3. Define the `name` of the user to be `jon`
-
-The `users` service creates a `/home/jon` directory, allows `jon` to sign in and will take care of the users password as part of [deployment](./deploy.md).
-
-For more information see [clanService/users](../../reference/clanServices/users.md)
-
-## Using a custom approach
-
-Some people like to define a `users` folder in their repository root.
-That allows to bind all user specific logic to a single place (`default.nix`)
-Which can be imported into individual machines to make the user avilable on that machine.
-
-```bash
-.
-├── machines
-│   ├── jon
-# ......
-├── users
-│   ├── jon
-│   │   └── default.nix # <- a NixOS module; sets some options
-# ... ... ...
-```
-
-## using [home-manager](https://github.com/nix-community/home-manager)
-
-When using clan's `users` service it is possible to define extraModules.
-In fact this is always possible when using clan's services.
-
-We can use this property of clan services to bind a nixosModule to the user, which configures home-manager.
-
-```{.nix title="clan.nix" hl_lines="22"}
-{
-    inventory.machines = {
-        jon = { };
-        sara = { };
-    };
-    inventory.instances = {
-        jon-user = {
-            module.name = "users";
-
-            roles.default.tags.all = { };
-
-            roles.default.settings = {
-                user = "jon",
-                groups = [
-                    "wheel"
-                    "networkmanager"
-                    "video"
-                    "input"
-                ];
-            };
-
-            roles.default.extraModules = [ ./users/jon/home.nix ]; # (1)
-        };
-        # ...
-        # elided
-    };
-}
-```
-
-1. Type `path` or `string`: Must point to a seperate file. Inlining a module is not possible
-
-!!! Note "This is inspiration"
-    Our community might come up with better solutions soon.
-    We are seeking contributions to improve this pattern if you have a nicer solution in mind.
-
-```nix title="users/jon/home.nix"
-# NixOS module to import home-manager and the home-manager configuration of 'jon'
-{ self, ...}:
-{
-  imports = [ self.inputs.home-manager.nixosModules.default ];
-  home-manager.users.jon = {
-    imports = [
-      ./home-configuration.nix
-    ];
-  };
-}
-```

docs/site/guides/getting-started/deploy.md

@@ -1,6 +1,6 @@
 # Deploy a machine
 
-Now that you have created a machines, added some services and setup secrets. This guide will walk through how to deploy it.
+Now that you have created a new machine, we will walk through how to install it.
 
 ## Prerequisites
 
@@ -10,212 +10,256 @@ Now that you have created a machines, added some services and setup secrets. Thi
     - [x] **Machine configuration**: See our basic [adding and configuring machine guide](./add-machines.md)
     - [x] **Initialized secrets**: See [secrets](secrets.md) for how to initialize your secrets.
 
-## Physical Hardware
+=== "**Physical Hardware**"
 
-!!! note "skip this if using a cloud VM"
+    - [x] **USB Flash Drive**: See [Clan Installer](installer.md)
 
-Steps:
+    !!! Steps
 
-- Create a NixOS installer image and transfer it to a bootable USB drive as described in the [installer](./installer.md).
-- Boot the target machine and connect it to a network that makes it reachable from your setup computer.
-- Note down a reachable ip adress (*ipv4*, *ipv6* or *tor*)
+        1. Create a NixOS installer image and transfer it to a bootable USB drive as described in the [installer](./installer.md).
 
----
+        2. Boot the target machine and connect it to a network that makes it reachable from your setup computer.
 
-The installer will generate a password and local addresses on boot, then run ssh with these preconfigured.
-The installer shows it's deployment relevant information in two formats, a text form, as well as a QR code.
+=== "**Cloud VMs**"
 
-Sample boot screen shows:
+    - [x] Any cloud machine if it is reachable via SSH and supports `kexec`.
 
-- Root password
-- IP address
-- Optional Tor and mDNS details
-
-```{ .bash .annotate .no-copy .nohighlight}
-┌─────────────────────────────────────────────────────────────────────────────────────┐
-│ ┌───────────────────────────┐                                                       │
-│ │███████████████████████████│ # This is the QR Code (1)                             │
-│ │██ ▄▄▄▄▄ █▀▄█▀█▀▄█ ▄▄▄▄▄ ██│                                                       │
-│ │██ █   █ █▀▄▄▄█ ▀█ █   █ ██│                                                       │
-│ │██ █▄▄▄█ █▀▄ ▀▄▄▄█ █▄▄▄█ ██│                                                       │
-│ │██▄▄▄▄▄▄▄█▄▀ ▀▄▀▄█▄▄▄▄▄▄▄██│                                                       │
-│ │███▀▀▀ █▄▄█ ▀▄   ▄▀▄█   ███│                                                       │
-│ │██▄██▄▄█▄▄▀▀██▄▀ ▄▄▄ ▄▀█▀██│                                                       │
-│ │██ ▄▄▄▄▄ █▄▄▄▄ █ █▄█ █▀ ███│                                                       │
-│ │██ █   █ █ █  █ ▄▄▄  ▄▀▀ ██│                                                       │
-│ │██ █▄▄▄█ █ ▄ ▄    ▄ ▀█ ▄███│                                                       │
-│ │██▄▄▄▄▄▄▄█▄▄▄▄▄▄█▄▄▄▄▄█▄███│                                                       │
-│ │███████████████████████████│                                                       │
-│ └───────────────────────────┘                                                       │
-│ ┌─────────────────────────────────────────────────────────────────────────────────┐ │
-│ │Root password: cheesy-capital-unwell  # password (2)                             │ │
-│ │Local network addresses:                                                         │ │
-│ │enp1s0           UP    192.168.178.169/24 metric 1024 fe80::21e:6ff:fe45:3c92/64 │ │
-│ │enp2s0           DOWN                                                            │ │
-│ │wlan0            DOWN # connect to wlan (3)                                      │ │
-│ │Onion address: 6evxy5yhzytwpnhc2vpscrbti3iktxdhpnf6yim6bbs25p4v6beemzyd.onion    │ │
-│ │Multicast DNS: nixos-installer.local                                             │ │
-│ └─────────────────────────────────────────────────────────────────────────────────┘ │
-│ Press 'Ctrl-C' for console access                                                   │
-│                                                                                     │
-└─────────────────────────────────────────────────────────────────────────────────────┘
-```
-
-1.  This is not an actual QR code, because it is displayed rather poorly on text sites.
-    This would be the actual content of this specific QR code prettified:
-    ```json
-    {
-        "pass": "cheesy-capital-unwell",
-        "tor": "6evxy5yhzytwpnhc2vpscrbti3iktxdhpnf6yim6bbs25p4v6beemzyd.onion",
-        "addrs": [
-        "2001:9e8:347:ca00:21e:6ff:fe45:3c92"
-        ]
-    }
-    ```
-
-    To generate the actual QR code, that would be displayed use:
-    ```shellSession
-    echo '{"pass":"cheesy-capital-unwell","tor":"6evxy5yhzytwpnhc2vpscrbti3iktxdhpnf6yim6bbs25p4v6beemzyd.onion","addrs":["2001:9e8:347:ca00:21e:6ff:fe45:3c92"]}' | nix run nixpkgs#qrencode -- -s 2 -m 2 -t utf8
-    ```
-2.  The root password for the installer medium.
-    This password is autogenerated and meant to be easily typeable.
-3.  See [how to connect to wlan](./installer.md#optional-connect-to-wifi-manually).
-
-!!! tip
-    Use [KDE Connect](https://apps.kde.org/de/kdeconnect/) for easyily sharing QR codes from phone to desktop
-
-## Cloud VMs
-
-!!! note "skip this if using a physical machine"
-
-Clan supports any cloud machine if it is reachable via SSH and supports `kexec`.
-
-Steps:
-
-- Go to the configuration panel and note down how to connect to the machine via ssh.
-
-!!! tip "NixOS can cause strange issues when booting in certain cloud environments."
-    If on Linode: Make sure that the system uses "Direct Disk boot kernel" (found in the configuration panel)
+    !!! Warning "NixOS can cause strange issues when booting in certain cloud environments."
+        If on Linode: Make sure that the system uses Direct Disk boot kernel (found in the configuration pannel)
 
 ## Setting `targetHost`
 
-In your nix files set the targetHost (reachable ip) that you retrieved in the previous step.
+=== "flake.nix (flake-parts)"
 
-```{.nix title="clan.nix" hl_lines="9"}
-{
-  # Ensure this is unique among all clans you want to use.
-  meta.name = "my-clan";
+    ```{.nix hl_lines="22"}
+    {
+        inputs.clan-core.url = "https://git.clan.lol/clan/clan-core/archive/main.tar.gz";
+        inputs.nixpkgs.follows = "clan-core/nixpkgs";
+        inputs.flake-parts.follows = "clan-core/flake-parts";
+        inputs.flake-parts.inputs.nixpkgs-lib.follows = "clan-core/nixpkgs";
 
-  inventory.machines = {
-    # Define machines here.
-    # The machine name will be used as the hostname.
-    jon = {
-        deploy.targetHost = "root@192.168.192.4"; # (1)
-    };
-  };
-  # ...
-  # elided
-}
-```
+        outputs =
+            inputs@{ flake-parts, ... }:
+            flake-parts.lib.mkFlake { inherit inputs; } {
+            systems = [
+                "x86_64-linux"
+                "aarch64-linux"
+                "x86_64-darwin"
+                "aarch64-darwin"
+            ];
+            imports = [ inputs.clan-core.flakeModules.default ];
 
-1. Use the ip address of your targetMachine that you want to deploy. If using the [flash-installer](./installer.md) it should display its local ip-address when booted.
+            clan = {
+                inventory.machines = {
+                    jon = {
+                        # targetHost will get picked up by cli commands
+                        deploy.targetHost = "root@jon";
+                    };
+                };
+            };
+        };
+    }
+    ```
+
+=== "flake.nix (classic)"
+
+    ```{.nix hl_lines="14"}
+    {
+        inputs.clan-core.url = "https://git.clan.lol/clan/clan-core/archive/main.tar.gz";
+        inputs.nixpkgs.follows = "clan-core/nixpkgs";
+
+        outputs =
+            { self, clan-core, ... }:
+            let
+                clan = clan-core.lib.clan {
+                    inherit self;
+
+                    inventory.machines = {
+                        jon = {
+                            # targetHost will get picked up by cli commands
+                            deploy.targetHost = "root@jon";
+                        };
+                    };
+                };
+            in
+            {
+                inherit (clan.config)
+                    nixosConfigurations
+                    nixosModules
+                    clanInternals
+                    darwinConfigurations
+                    darwinModules
+                    ;
+            };
+    }
+    ```
 
 !!! warning
     The use of `root@` in the target address implies SSH access as the `root` user.
     Ensure that the root login is secured and only used when necessary.
 
-See also [how to set TargetHost](../target-host.md) for other methods.
+## Identify the Target Disk
 
-## Retrieve the hardware report
+On the setup computer, SSH into the target:
 
-By default clan uses [nixos-facter](https://github.com/nix-community/nixos-facter) which captures detailed information about the machine or virtual environment.
-
-To generate the hardware-report (`facter.json`) run:
-
-```bash
-clan machines update-hardware-config <machineName>
+```bash title="setup computer"
+ssh root@<IP> lsblk --output NAME,ID-LINK,FSTYPE,SIZE,MOUNTPOINT
 ```
 
-Example output:
+Replace `<IP>` with the machine's IP or hostname if mDNS (i.e. Avahi) is available.
 
-```shell-session
-$ clan machines update-hardware-config jon
-[jon] $ nixos-facter
-Successfully generated: ./machines/jon/facter.json
+Which should show something like:
+
+```{.shellSession hl_lines="6" .no-copy}
+NAME        ID-LINK                                         FSTYPE   SIZE MOUNTPOINT
+sda         usb-ST_16GB_AA6271026J1000000509-0:0                    14.9G
+├─sda1      usb-ST_16GB_AA6271026J1000000509-0:0-part1                 1M
+├─sda2      usb-ST_16GB_AA6271026J1000000509-0:0-part2      vfat     100M /boot
+└─sda3      usb-ST_16GB_AA6271026J1000000509-0:0-part3      ext4     2.9G /
+nvme0n1     nvme-eui.e8238fa6bf530001001b448b4aec2929              476.9G
+├─nvme0n1p1 nvme-eui.e8238fa6bf530001001b448b4aec2929-part1 vfat     512M
+├─nvme0n1p2 nvme-eui.e8238fa6bf530001001b448b4aec2929-part2 ext4   459.6G
+└─nvme0n1p3 nvme-eui.e8238fa6bf530001001b448b4aec2929-part3 swap    16.8G
 ```
 
-See [update-hardware-config cli reference](../../reference/cli/machines.md#machines-update-hardware-config) for further configuration possibilities if needed.
+Look for the top-level disk device (e.g., nvme0n1 or sda) and copy its `ID-LINK`. Avoid using partition IDs like `nvme0n1p1`.
 
-## Configure your disk schema
-
-By default clan uses [disko](https://github.com/nix-community/disko) which allows for declarative disk partitioning.
-
-To setup a disk schema for a machine run
-
-```bash
-clan templates apply disk single-disk jon --set mainDisk ""
-```
-
-Which should fail and give the valid options for the specific hardware:
-
-```shellSession
-Invalid value  for placeholder mainDisk - Valid options:
-/dev/disk/by-id/nvme-WD_PC_SN740_SDDQNQD-512G-1201_232557804368
-```
-
-Re-run the command with the correct disk:
-
-```bash
-clan templates apply disk single-disk jon --set mainDisk "/dev/disk/by-id/nvme-WD_PC_SN740_SDDQNQD-512G-1201_232557804368"
-```
-
-Should now be succesfull
-
-```shellSession
-Applied disk template 'single-disk' to machine 'jon'
-```
-
-A disko.nix file should be created in `machines/jon`
-You can have a look and customize it if needed.
+In this example we would copy `nvme-eui.e8238fa6bf530001001b448b4aec2929`
 
 !!! tip
     For advanced partitioning, see [Disko templates](https://github.com/nix-community/disko-templates) or [Disko examples](https://github.com/nix-community/disko/tree/master/example).
 
-!!! Danger
-    Don't change the `disko.nix` after the machine is installed for the first time.
+## Fill in hardware specific machine configuration
 
-    Changing disko configuration requires wiping and reinstalling the machine.
+Edit the following fields inside the `./machines/<machine_name>/configuration.nix`
 
-    Unless you really know what you are doing.
+<!-- Note: Use "jon" instead of "<machine>" as "<" is not supported in title tag -->
+
+```nix title="./machines/jon/configuration.nix" hl_lines="12 15 19"
+{
+    imports = [
+    # contains your disk format and partitioning configuration.
+    ../../modules/disko.nix
+    # this file is shared among all machines
+    ../../modules/shared.nix
+    # enables GNOME desktop (optional)
+    ../../modules/gnome.nix
+    ];
+
+    # Put your username here for login
+    users.users.user.name = "__YOUR_USERNAME__";
+
+    # Replace this __CHANGE_ME__ with the copied result of the lsblk command
+    disko.devices.disk.main.device = "/dev/disk/by-id/__CHANGE_ME__";
+
+    # IMPORTANT! Add your SSH key here
+    # e.g. > cat ~/.ssh/id_ed25519.pub
+    users.users.root.openssh.authorizedKeys.keys = [ "__YOUR_SSH_KEY__" ];
+
+    # ...
+}
+```
+
+!!! Info "Replace `__YOUR_USERNAME__` with the ip of your machine, if you use avahi you can also use your hostname"
+!!! Info "Replace `__CHANGE_ME__` with the appropriate `ID-LINK` identifier, such as `nvme-eui.e8238fa6bf530001001b448b4aec2929`"
+!!! Info "Replace `__YOUR_SSH_KEY__` with your personal key, like `ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILoMI0NC5eT9pHlQExrvR5ASV3iW9+BXwhfchq0smXUJ jon@jon-desktop`"
 
 ## Deploy the machine
 
-**Finally deployment time!** Use one of the following commands to build and deploy the image via SSH onto your machine.
+**Finally deployment time!** Use the following command to build and deploy the image via SSH onto your machine.
+
+=== "**Image Installer**"
+
+    The installer will generate a password and local addresses on boot, then run ssh with these preconfigured.
+    The installer shows it's deployment relevant information in two formats, a text form, as well as a QR code.
+
+    Sample boot screen shows:
+
+    - Root password
+    - IP address
+    - Optional Tor and mDNS details
+
+    ```{ .bash .annotate .no-copy .nohighlight}
+    ┌─────────────────────────────────────────────────────────────────────────────────────┐
+    │ ┌───────────────────────────┐                                                       │
+    │ │███████████████████████████│ # This is the QR Code (1)                             │
+    │ │██ ▄▄▄▄▄ █▀▄█▀█▀▄█ ▄▄▄▄▄ ██│                                                       │
+    │ │██ █   █ █▀▄▄▄█ ▀█ █   █ ██│                                                       │
+    │ │██ █▄▄▄█ █▀▄ ▀▄▄▄█ █▄▄▄█ ██│                                                       │
+    │ │██▄▄▄▄▄▄▄█▄▀ ▀▄▀▄█▄▄▄▄▄▄▄██│                                                       │
+    │ │███▀▀▀ █▄▄█ ▀▄   ▄▀▄█   ███│                                                       │
+    │ │██▄██▄▄█▄▄▀▀██▄▀ ▄▄▄ ▄▀█▀██│                                                       │
+    │ │██ ▄▄▄▄▄ █▄▄▄▄ █ █▄█ █▀ ███│                                                       │
+    │ │██ █   █ █ █  █ ▄▄▄  ▄▀▀ ██│                                                       │
+    │ │██ █▄▄▄█ █ ▄ ▄    ▄ ▀█ ▄███│                                                       │
+    │ │██▄▄▄▄▄▄▄█▄▄▄▄▄▄█▄▄▄▄▄█▄███│                                                       │
+    │ │███████████████████████████│                                                       │
+    │ └───────────────────────────┘                                                       │
+    │ ┌─────────────────────────────────────────────────────────────────────────────────┐ │
+    │ │Root password: cheesy-capital-unwell  # password (2)                             │ │
+    │ │Local network addresses:                                                         │ │
+    │ │enp1s0           UP    192.168.178.169/24 metric 1024 fe80::21e:6ff:fe45:3c92/64 │ │
+    │ │enp2s0           DOWN                                                            │ │
+    │ │wlan0            DOWN # connect to wlan (3)                                      │ │
+    │ │Onion address: 6evxy5yhzytwpnhc2vpscrbti3iktxdhpnf6yim6bbs25p4v6beemzyd.onion    │ │
+    │ │Multicast DNS: nixos-installer.local                                             │ │
+    │ └─────────────────────────────────────────────────────────────────────────────────┘ │
+    │ Press 'Ctrl-C' for console access                                                   │
+    │                                                                                     │
+    └─────────────────────────────────────────────────────────────────────────────────────┘
+    ```
+
+    1.  This is not an actual QR code, because it is displayed rather poorly on text sites.
+        This would be the actual content of this specific QR code prettified:
+        ```json
+        {
+            "pass": "cheesy-capital-unwell",
+            "tor": "6evxy5yhzytwpnhc2vpscrbti3iktxdhpnf6yim6bbs25p4v6beemzyd.onion",
+            "addrs": [
+            "2001:9e8:347:ca00:21e:6ff:fe45:3c92"
+            ]
+        }
+        ```
+
+        To generate the actual QR code, that would be displayed use:
+        ```shellSession
+        echo '{"pass":"cheesy-capital-unwell","tor":"6evxy5yhzytwpnhc2vpscrbti3iktxdhpnf6yim6bbs25p4v6beemzyd.onion","addrs":["2001:9e8:347:ca00:21e:6ff:fe45:3c92"]}' | nix run nixpkgs#qrencode -- -s 2 -m 2 -t utf8
+        ```
+    2.  The root password for the installer medium.
+        This password is autogenerated and meant to be easily typeable.
+    3.  See [how to connect to wlan](./installer.md#optional-connect-to-wifi-manually).
+
+    !!! tip
+        Use [KDE Connect](https://apps.kde.org/de/kdeconnect/) for easyily sharing QR codes from phone to desktop
+
+=== "**Cloud VM**"
+
+    Just run the command **Option B: Cloud VM** below
 
 ### Deployment Commands
 
 #### Using password auth
 
 ```bash
-clan machines install [MACHINE] --target-host <IP>
+clan machines install [MACHINE] --target-host <IP> --update-hardware-config nixos-facter
 ```
 
 #### Using QR JSON
 
 ```bash
-clan machines install [MACHINE] --json "[JSON]"
+clan machines install [MACHINE] --json "[JSON]" --update-hardware-config nixos-facter
 ```
 
 #### Using QR image file
 
 ```bash
-clan machines install [MACHINE] --png [PATH]
+clan machines install [MACHINE] --png [PATH] --update-hardware-config nixos-facter
 ```
 
 #### Option B: Cloud VM
 
 ```bash
-clan machines install [MACHINE] --target-host <IP>
+clan machines install [MACHINE] --target-host <IP> --update-hardware-config nixos-facter
 ```
 
 !!! success
@@ -274,3 +318,4 @@ clan {
 ```
 
 This is useful for machines that are not always online or are not part of the regular update cycle.
+

docs/site/guides/getting-started/index.md

@@ -38,24 +38,31 @@ By the end of this guide, you'll have a fresh NixOS configuration ready to push
 
 ## Add Clan CLI to Your Shell
 
-Create a new clan
+Add the Clan CLI into your environment:
 
 ```bash
-nix run git+https://git.clan.lol/clan/clan-core#clan-cli --refresh -- flakes create
+nix shell git+https://git.clan.lol/clan/clan-core#clan-cli --refresh
 ```
 
-This should prompt for a *name*:
-
 ```terminalSession
-Enter a name for the new clan: my-clan
+clan --help
 ```
 
-Enter a *name*, confirm with *enter*. A directory with that name will be created and initialized.
+Should print the avilable commands.
 
-!!! Note
-    This command uses the `default` template
+Also checkout the [cli-reference documentation](../../reference/cli/index.md).
 
-    See `clan templates list` and the `--help` reference for how to use other templates.
+## Initialize Your Project
+
+If you want to migrate an existing project, follow this [guide](../migrations/migration-guide.md).
+
+Set the foundation of your Clan project by initializing it by running:
+
+```bash
+clan flakes create my-clan
+```
+
+This command creates a `flake.nix` and some other files for your project.
 
 ## Explore the Project Structure
 
@@ -76,47 +83,30 @@ For example, you might see something like:
 └── README.md
 ```
 
-Don’t worry if your output looks different — Clan templates evolve over time.
+Don’t worry if your output looks different—the template evolves over time.
 
-To interact with your newly created clan the you need to load the `clan` cli-package it into your environment by running:
+??? info "Recommended way of sourcing the `clan` CLI tool"
 
-=== "Automatic (direnv, recommended)"
-    - prerequisite: [install nix-direnv](https://github.com/nix-community/nix-direnv)
+    The default template adds the `clan` CLI tool to the development shell.
+    This means that you can access the `clan` CLI tool directly from the folder
+    you are in right now.
 
-    ```
-    direnv allow
-    ```
-
-=== "Manual (nix develop)"
+    In the `my-clan` directory, run the following command:
 
     ```
     nix develop
     ```
 
-verify that you can run `clan` commands:
+    This will ensure the `clan` CLI tool is available in your shell environment.
 
-```bash
-clan show
+    To automatically add the `clan` CLI tool to your environment without having to
+    run `nix develop` every time, we recommend setting up [direnv](https://direnv.net/).
+
+```
+clan machines list
 ```
 
-You should see something like this:
-
-```shellSession
-Name: __CHANGE_ME__
-Description: None
-```
-
-To change the name of your clan edit `meta.name` in the `clan.nix` or `flake.nix` file
-
-```{.nix title="clan.nix" hl_lines="3"}
-{
-  # Ensure this is unique among all clans you want to use.
-  meta.name = "__CHANGE_ME__";
-
-  # ...
-  # elided
-}
-```
+If you see no output yet, that’s expected — [add machines](./add-machines.md) to populate it.
 
 ---
 
@@ -128,7 +118,6 @@ You can continue with **any** of the following steps at your own pace:
 - [x] [Initialize Clan](./index.md#initialize-your-project)
 - [ ] [Create USB Installer (optional)](./installer.md)
 - [ ] [Add Machines](./add-machines.md)
-- [ ] [Add a User](./add-user.md)
 - [ ] [Add Services](./add-services.md)
 - [ ] [Configure Secrets](./secrets.md)
 - [ ] [Deploy](./deploy.md) - Requires configured secrets

docs/site/guides/getting-started/secrets.md

@@ -152,7 +152,6 @@ are loaded when using Clan:
   outputs =
     { self, clan-core, ... }:
     let
-      # Sometimes this attribute set is defined in clan.nix
       clan = clan-core.lib.clan {
         inherit self;
 

docs/site/guides/mesh-vpn.md

@@ -39,7 +39,6 @@ For the purpose of this guide we have two machines:
   outputs =
     { self, clan-core, ... }:
     let
-      # Sometimes this attribute set is defined in clan.nix
       clan = clan-core.lib.clan {
         inherit self;
 

docs/site/guides/migrations/disk-id.md

@@ -1,98 +0,0 @@
-# Migrate disko config from `clanModules.disk-id`
-
-If you previously bootstrapped a machine's disk using `clanModules.disk-id`, you should now migrate to a standalone, self-contained disko configuration. This ensures long-term stability and avoids reliance on dynamic values from Clan.
-
-If your `disko.nix` currently looks something like this:
-
-```nix title="disko.nix"
-{
-  lib,
-  clan-core,
-  config,
-  ...
-}:
-
-let
-  suffix = config.clan.core.vars.generators.disk-id.files.diskId.value;
-in
-{
-  imports = [
-    clan-core.clanModules.disk-id
-  ];
-
-  # DO NOT EDIT THIS FILE AFTER INSTALLATION of a machine
-  # Otherwise your system might not boot because of missing partitions / filesystems
-  boot.loader.grub.efiSupport = lib.mkDefault true;
-  boot.loader.grub.efiInstallAsRemovable = lib.mkDefault true;
-  disko.devices = {
-    disk = {
-      "main" = {
-        # suffix is to prevent disk name collisions
-        name = "main-" + suffix;
-        type = "disk";
-        # Set the following in flake.nix for each maschine:
-        # device = <uuid>;
-        content = {
-          # edlied
-        };
-      };
-    };
-  };
-}
-```
-
-## Step 1: Retrieve your `disk-id`
-
-Run the following command to retrieve the generated disk ID for your machine:
-
-```bash
-clan vars list <machineName>
-```
-
-Which should print the generated `disk-id/diskId` value in clear text
-You should see output like:
-
-```shellSession
-disk-id/diskId: fcef30a749f8451d8f60c46e1ead726f
-# ...
-# elided
-```
-
-Copy this value — you'll need it in the next step.
-
-## ✍️ Step 2: Replace Dynamic Configuration with Static Values
-
-✅ Goal: Make your disko.nix file standalone.
-
-We are going to make three changes:
-
-- Remove `let in, imports, {lib,clan-core,config, ...}:` to isolate the file.
-- Replace `suffix` with the actual disk-id
-- Move `disko.devices.disk.main.device` from `flake.nix` or `configuration.nix` into this file.
-
-```{.nix title="disko.nix" hl_lines="7-9 11-14"}
-{
-  boot.loader.grub.efiSupport = lib.mkDefault true;
-  boot.loader.grub.efiInstallAsRemovable = lib.mkDefault true;
-  disko.devices = {
-    disk = {
-      "main" = {
-        #       ↓ Copy the disk-id into place
-        name = "main-fcef30a749f8451d8f60c46e1ead726f";
-        type = "disk";
-
-        # Some earlier guides had this line in a flake.nix
-        # disko.devices.disk.main.device = "/dev/disk/by-id/__CHANGE_ME__";
-        #        ↓ Copy the '/dev/disk/by-id' into here instead
-        device = "/dev/disk/by-id/nvme-eui.e8238fa6bf530001001b448b4aec2929";
-
-        # edlied;
-      };
-    };
-  };
-}
-```
-
-These steps are only needed for existing configurations that depend on the `diskId` module.
-
-For newer machines clan offers simple *disk templates* via its [templates cli](../../reference/cli/templates.md)

docs/site/guides/target-host.md

@@ -14,7 +14,6 @@ If the hostname is **static**, like `server.example.com`, set it in the **invent
   outputs =
     { self, clan-core, ... }:
     let
-      # Sometimes this attribute set is defined in clan.nix
       clan = clan-core.lib.clan {
         inventory.machines.jon = {
             deploy.targetHost = "root@server.example.com";
@@ -42,7 +41,6 @@ If your target host depends on a **dynamic expression** (like using the machine
   outputs =
     { self, clan-core, ... }:
     let
-      # Sometimes this attribute set is defined in clan.nix
       clan = clan-core.lib.clan {
         machines.jon = {config, ...}: {
             clan.core.networking.targetHost = "jon@${config.networking.fqdn}";

flake.lock

@@ -16,11 +16,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1752451292,
-        "narHash": "sha256-jvLbfYFvcS5f0AEpUlFS2xZRnK770r9TRM2smpUFFaU=",
-        "rev": "309e06fbc9a6d133ab6dd1c7d8e4876526e058bb",
+        "lastModified": 1751846468,
+        "narHash": "sha256-h0mpWZIOIAKj4fmLNyI2HDG+c0YOkbYmyJXSj/bQ9s0=",
+        "rev": "a2166c13b0cb3febdaf36391cd2019aa2ccf4366",
         "type": "tarball",
-        "url": "https://git.clan.lol/api/v1/repos/clan/data-mesher/archive/309e06fbc9a6d133ab6dd1c7d8e4876526e058bb.tar.gz"
+        "url": "https://git.clan.lol/api/v1/repos/clan/data-mesher/archive/a2166c13b0cb3febdaf36391cd2019aa2ccf4366.tar.gz"
       },
       "original": {
         "type": "tarball",
@@ -34,11 +34,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1752113600,
-        "narHash": "sha256-7LYDxKxZgBQ8LZUuolAQ8UkIB+jb4A2UmiR+kzY9CLI=",
+        "lastModified": 1751854533,
+        "narHash": "sha256-U/OQFplExOR1jazZY4KkaQkJqOl59xlh21HP9mI79Vc=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "79264292b7e3482e5702932949de9cbb69fedf6d",
+        "rev": "16b74a1e304197248a1bc663280f2548dbfcae3c",
         "type": "github"
       },
       "original": {
@@ -67,6 +67,52 @@
         "type": "github"
       }
     },
+    "flake-utils": {
+      "inputs": {
+        "systems": [
+          "systems"
+        ]
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "ixx": {
+      "inputs": {
+        "flake-utils": [
+          "nuschtos",
+          "flake-utils"
+        ],
+        "nixpkgs": [
+          "nuschtos",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1748294338,
+        "narHash": "sha256-FVO01jdmUNArzBS7NmaktLdGA5qA3lUMJ4B7a05Iynw=",
+        "owner": "NuschtOS",
+        "repo": "ixx",
+        "rev": "cc5f390f7caf265461d4aab37e98d2292ebbdb85",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NuschtOS",
+        "ref": "v0.0.8",
+        "repo": "ixx",
+        "type": "github"
+      }
+    },
     "nix-darwin": {
       "inputs": {
         "nixpkgs": [
@@ -128,15 +174,41 @@
         "url": "https://nixos.org/channels/nixpkgs-unstable/nixexprs.tar.xz"
       }
     },
+    "nuschtos": {
+      "inputs": {
+        "flake-utils": [
+          "flake-utils"
+        ],
+        "ixx": "ixx",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1749730855,
+        "narHash": "sha256-L3x2nSlFkXkM6tQPLJP3oCBMIsRifhIDPMQQdHO5xWo=",
+        "owner": "NuschtOS",
+        "repo": "search",
+        "rev": "8dfe5879dd009ff4742b668d9c699bc4b9761742",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NuschtOS",
+        "repo": "search",
+        "type": "github"
+      }
+    },
     "root": {
       "inputs": {
         "data-mesher": "data-mesher",
         "disko": "disko",
         "flake-parts": "flake-parts",
+        "flake-utils": "flake-utils",
         "nix-darwin": "nix-darwin",
         "nix-select": "nix-select",
         "nixos-facter-modules": "nixos-facter-modules",
         "nixpkgs": "nixpkgs",
+        "nuschtos": "nuschtos",
         "sops-nix": "sops-nix",
         "systems": "systems",
         "treefmt-nix": "treefmt-nix"
@@ -184,11 +256,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1752055615,
-        "narHash": "sha256-19m7P4O/Aw/6+CzncWMAJu89JaKeMh3aMle1CNQSIwM=",
+        "lastModified": 1750931469,
+        "narHash": "sha256-0IEdQB1nS+uViQw4k3VGUXntjkDp7aAlqcxdewb/hAc=",
         "owner": "numtide",
         "repo": "treefmt-nix",
-        "rev": "c9d477b5d5bd7f26adddd3f96cfd6a904768d4f9",
+        "rev": "ac8e6f32e11e9c7f153823abc3ab007f2a65d3e1",
         "type": "github"
       },
       "original": {

flake.nix

@@ -35,13 +35,19 @@
       };
     };
 
+    # dependencies needed for nuschtos
+    flake-utils.url = "github:numtide/flake-utils";
+    flake-utils.inputs.systems.follows = "systems";
+    nuschtos.url = "github:NuschtOS/search";
+    nuschtos.inputs.nixpkgs.follows = "nixpkgs";
+    nuschtos.inputs.flake-utils.follows = "flake-utils";
   };
 
   outputs =
     inputs@{
+      flake-parts,
       nixpkgs,
       systems,
-      flake-parts,
       ...
     }:
     let
@@ -50,25 +56,10 @@
         optional
         pathExists
         ;
-
-      loadDevFlake =
-        path:
-        let
-          flakeHash = nixpkgs.lib.fileContents "${toString path}.narHash";
-          flakePath = "path:${toString path}?narHash=${flakeHash}";
-        in
-        builtins.getFlake (builtins.unsafeDiscardStringContext flakePath);
-
-      devFlake = builtins.tryEval (loadDevFlake ./devFlake/private);
-
-      privateInputs = if devFlake.success then devFlake.value.inputs else { };
     in
     flake-parts.lib.mkFlake { inherit inputs; } (
       { ... }:
       {
-        _module.args = {
-          inherit privateInputs;
-        };
         clan = {
           meta.name = "clan-core";
           inventory = {

formatter.nix

@@ -4,7 +4,7 @@
   perSystem =
     { self', pkgs, ... }:
     {
-      treefmt.projectRootFile = "LICENSE.md";
+      treefmt.projectRootFile = ".git/config";
       treefmt.programs.shellcheck.enable = true;
 
       treefmt.programs.mypy.enable = true;

lib/default.nix

@@ -37,7 +37,6 @@ lib.fix (
     inventory = clanLib.callLib ./modules/inventory { };
     modules = clanLib.callLib ./modules/inventory/frontmatter { };
     test = clanLib.callLib ./test { };
-    flake-inputs = clanLib.callLib ./flake-inputs.nix { };
     # Custom types
     types = clanLib.callLib ./types { };
 
@@ -45,7 +44,6 @@ lib.fix (
     introspection = import ./introspection { inherit lib; };
     jsonschema = import ./jsonschema { inherit lib; };
     facts = import ./facts.nix { inherit lib; };
-    docs = import ./docs.nix { inherit lib; };
 
     # flakes
     flakes = clanLib.callLib ./flakes.nix { };

lib/docs.nix

@@ -1,25 +0,0 @@
-{ lib, ... }:
-rec {
-  prefix = "https://git.clan.lol/clan/clan-core/src/branch/main/";
-  # Strip store paths from option declarations to make docs more stable
-  # This prevents documentation from rebuilding when store paths change
-  # but the actual content remains the same
-  stripStorePathsFromDeclarations =
-    opt:
-    opt
-    // {
-      declarations = map (
-        decl:
-        if lib.isString decl && lib.hasPrefix "/nix/store/" decl then
-          let
-            parts = lib.splitString "/" decl;
-          in
-          if builtins.length parts > 4 then
-            (prefix + "/" + lib.concatStringsSep "/" (lib.drop 4 parts))
-          else
-            decl
-        else
-          decl
-      ) opt.declarations;
-    };
-}

lib/flake-inputs.nix

@@ -1,18 +0,0 @@
-{ ... }:
-{
-  /**
-    Generate nix-unit input overrides for tests
-
-    # Example
-    ```nix
-    inputOverrides = clanLib.flake-inputs.getOverrides inputs;
-    ```
-  */
-  getOverrides =
-    inputs:
-    builtins.concatStringsSep " " (
-      builtins.map (input: " --override-input ${input} ${inputs.${input}}") (
-        builtins.filter (name: name != "self") (builtins.attrNames inputs)
-      )
-    );
-}