2 files changed, 81 insertions, 101 deletions

diff --git a/hosts/vidhar/network/dhcp/default.nix b/hosts/vidhar/network/dhcp/default.nix
index f36d0c7f..e4c3f16e 100644
--- a/hosts/vidhar/network/dhcp/default.nix
+++ b/hosts/vidhar/network/dhcp/default.nix
@@ -5,6 +5,7 @@ with lib;
 let
   nfsrootBaseUrl = "http://nfsroot.vidhar.yggdrasil";
   tftpIp = "10.141.0.1";
+  nfsIp = tftpIp;
   ipxe = pkgs.ipxe.override {
     additionalTargets = {
       "bin-i386-efi/ipxe.efi" = "i386-ipxe.efi";
@@ -47,12 +48,12 @@ in {
           };
 
           client-classes = [
-            { name = "ipxe-eostre";
-              test = "hexstring(pkt4.mac, ':') == '00:d8:61:79:c5:40' and option[77].hex == 'iPXE-yggdrasil'";
-              next-server = tftpIp;
-              boot-file-name = "${nfsrootBaseUrl}/eostre.menu.ipxe";
-              only-if-required = true;
-            }
+            # { name = "ipxe-eostre";
+            #   test = "hexstring(pkt4.mac, ':') == '00:d8:61:79:c5:40' and option[77].hex == 'iPXE-yggdrasil'";
+            #   next-server = tftpIp;
+            #   boot-file-name = "${nfsrootBaseUrl}/eostre.menu.ipxe";
+            #   only-if-required = true;
+            # }
             { name = "ipxe-yggdrasil";
               test = "option[77].hex == 'iPXE-yggdrasil'";
               next-server = tftpIp;
@@ -255,40 +256,27 @@ in {
               }
             ];
           };
+          tsig-keys = [
+            { name = "local_key";
+              algorithm = "HMAC-SHA256";
+              secret-file = "/run/credentials/kea-dhcp-ddns-server.service/local_key";
+            }
+          ];
         };
       };
     };
 
     systemd.services.kea-dhcp-ddns-server = {
-      preStart = let
-        configLines = [
-          "<?include \"\${CREDENTIALS_DIRECTORY}/knot-tsig.json.frag\"?>"
-        ] ++ mapAttrsToList (k: v:
-          "\"${k}\": ${builtins.toJSON v}"
-        ) config.services.kea.dhcp-ddns.settings;
-
-        config-template = pkgs.writeText "dhcp-ddns.conf" ''
-          {"DhcpDdns": {
-            ${concatStringsSep ",\n  " configLines}
-          }}
-        '';
-      in ''
-        ${pkgs.envsubst}/bin/envsubst -i "${config-template}" -o "''${RUNTIME_DIRECTORY}/dhcp-ddns.conf"
-      '';
-
       serviceConfig = {
-        ExecStart = mkForce ''
-          ${pkgs.kea}/bin/kea-dhcp-ddns -c "''${RUNTIME_DIRECTORY}/dhcp-ddns.conf" ${escapeShellArgs config.services.kea.dhcp-ddns.extraArgs}
-        '';
         LoadCredential = [
-          "knot-tsig.json.frag:${config.sops.secrets."kea-knot-tsig.json.frag".path}"
+          "local_key:${config.sops.secrets."kea-knot-tsig".path}"
         ];
       };
     };
 
-    sops.secrets."kea-knot-tsig.json.frag" = {
+    sops.secrets."kea-knot-tsig" = {
       format = "binary";
-      sopsFile = ./knot-tsig.json.frag;
+      sopsFile = ./knot-tsig;
     };
 
     services.nginx.virtualHosts."nfsroot.vidhar.yggdrasil" = {
@@ -305,32 +293,30 @@ in {
               pkgs.symlinkJoin {
                 name = "installer-${system}";
                 paths = [
-                  (let
-                    installerBuild = (flake.nixosConfigurations.${"installer-${system}-nfsroot"}.extendModules {
+                  (builtins.addErrorContext "while evaluating installer-${system}-nfsroot" (let
+                    installerBuild' = (flake.nixosConfigurations.${"installer-${system}-nfsroot"}.extendModules {
                       modules = [
                         ({ ... }: {
-                          config.nfsroot.storeDevice = "${tftpIp}:nix-store";
+                          config.nfsroot.storeDevice = "${nfsIp}:nix-store";
                           config.nfsroot.registrationUrl = "${nfsrootBaseUrl}/installer-${system}/registration";
+                          config.system.nixos.label = "installer-${system}";
                         })
                       ];
-                    }).config.system.build;
-                  in builtins.toPath (pkgs.runCommandLocal "install-${system}" {} ''
+                    });
+                    installerBuild = installerBuild'.config.system.build;
+                  in builtins.toPath (pkgs.runCommandLocal "installer-${system}" {} ''
                     mkdir -p $out/installer-${system}
                     install -m 0444 -t $out/installer-${system} \
                       ${installerBuild.initialRamdisk}/initrd \
                       ${installerBuild.kernel}/bzImage \
                       ${installerBuild.netbootIpxeScript}/netboot.ipxe \
                       ${pkgs.closureInfo { rootPaths = installerBuild.storeContents; }}/registration
-                  ''))
-                  (pkgs.writeTextFile {
-                    name = "installer-${system}.menu.ipxe";
-                    destination = "/installer-${system}.menu.ipxe";
-                    text = ''
+                    install -m 0444 ${pkgs.writeText "installer-${system}.menu.ipxe" ''
                       #!ipxe
 
                       :start
                       menu iPXE boot menu for installer-${system}
-                      item installer installer-${system}
+                      item installer ${with installerBuild'; "${config.system.nixos.distroName} ${config.system.nixos.codeName} ${config.system.nixos.label} (Linux ${config.boot.kernelPackages.kernel.modDirVersion})"}
                       item memtest memtest86plus
                       item netboot netboot.xyz
                       item shell iPXE shell
@@ -350,10 +336,10 @@ in {
                       goto start
 
                       :memtest
-                      iseq ''${platform} efi && chain --autofree memtest.efi || chain --autofree memtest.bin
+                      chain --autofree mt86plus.efi
                       goto start
-                    '';
-                  })
+                    ''} $out/installer-${system}.menu.ipxe
+                  '')))
                 ];
               }) ["x86_64-linux"]
             ) ++ [
@@ -361,63 +347,61 @@ in {
                 mkdir $out
                 install -m 0444 -t $out \
                   ${ipxe}/{ipxe.efi,i386-ipxe.efi,ipxe.lkrn} \
-                  ${pkgs.memtest86plus}/{memtest.efi,memtest.bin}
+                  ${pkgs.memtest86plus}/mt86plus.efi
                 install -m 0444 ${sources.netbootxyz-efi.src} $out/netboot.xyz.efi
                 install -m 0444 ${sources.netbootxyz-lkrn.src} $out/netboot.xyz.lkrn
               '')
-              (let
-                 eostreBuild = (flake.nixosConfigurations.eostre.extendModules {
-                   modules = [
-                     ({ ... }: {
-                       config.nfsroot.storeDevice = "${tftpIp}:nix-store";
-                       config.nfsroot.registrationUrl = "${nfsrootBaseUrl}/eostre/registration";
-                     })
-                   ];
-                 }).config.system.build;
-               in builtins.toPath (pkgs.runCommandLocal "eostre" {} ''
-                    mkdir -p $out/eostre
-                    install -m 0444 -t $out/eostre \
-                      ${eostreBuild.initialRamdisk}/initrd \
-                      ${eostreBuild.kernel}/bzImage \
-                      ${eostreBuild.netbootIpxeScript}/netboot.ipxe \
-                      ${pkgs.closureInfo { rootPaths = eostreBuild.storeContents; }}/registration
-                  ''))
-              (pkgs.writeTextFile {
-                name = "eostre.menu.ipxe";
-                destination = "/eostre.menu.ipxe";
-                text = ''
-                  #!ipxe
+              # (builtins.addErrorContext "while evaluating eostre" (let
+              #    eostreBuild' = (flake.nixosConfigurations.eostre.extendModules {
+              #      modules = [
+              #        ({ ... }: {
+              #          config.nfsroot.storeDevice = "${nfsIp}:nix-store";
+              #          config.nfsroot.registrationUrl = "${nfsrootBaseUrl}/eostre/registration";
+              #          config.system.nixos.label = "eostre";
+              #        })
+              #      ];
+              #    });
+              #    eostreBuild = eostreBuild'.config.system.build;
+              #  in builtins.toPath (pkgs.runCommandLocal "eostre" {} ''
+              #       mkdir -p $out/eostre
+              #       install -m 0444 -t $out/eostre \
+              #         ${eostreBuild.initialRamdisk}/initrd \
+              #         ${eostreBuild.kernel}/bzImage \
+              #         ${eostreBuild.netbootIpxeScript}/netboot.ipxe \
+              #         ${pkgs.closureInfo { rootPaths = eostreBuild.storeContents; }}/registration
+              #       install -m 0444 ${pkgs.writeText "eostre.menu.ipxe" ''
+              #         #!ipxe
 
-                  set menu-timeout 5000
+              #         set menu-timeout 5000
 
-                  :start
-                  menu iPXE boot menu for eostre
-                  item eostre eostre
-                  item memtest memtest86plus
-                  item netboot netboot.xyz
-                  item shell iPXE shell
-                  choose --timeout ''${menu-timeout} --default eostre selected || goto shell
-                  set menu-timeout 0
-                  goto ''${selected}
+              #         :start
+              #         menu iPXE boot menu for eostre
+              #         item eostre ${with eostreBuild'; "${config.system.nixos.distroName} ${config.system.nixos.codeName} ${config.system.nixos.label} (Linux ${config.boot.kernelPackages.kernel.modDirVersion})"}
+              #         item memtest memtest86plus
+              #         item netboot netboot.xyz
+              #         item shell iPXE shell
+              #         choose --timeout ''${menu-timeout} --default eostre selected || goto shell
+              #         set menu-timeout 0
+              #         goto ''${selected}
 
-                  :shell
-                  set menu-timeout 0
-                  shell
-                  goto start
+              #         :shell
+              #         set menu-timeout 0
+              #         shell
+              #         goto start
 
-                  :eostre
-                  chain eostre/netboot.ipxe
-                  goto start
+              #         :eostre
+              #         chain eostre/netboot.ipxe
+              #         goto start
 
-                  :netboot
-                  iseq ''${platform} efi && chain --autofree netboot.xyz.efi || chain --autofree netboot.xyz.lkrn
-                  goto start
+              #         :netboot
+              #         iseq ''${platform} efi && chain --autofree netboot.xyz.efi || chain --autofree netboot.xyz.lkrn
+              #         goto start
 
-                  :memtest
-                  iseq ''${platform} efi && chain --autofree memtest.efi || chain --autofree memtest.bin
-                  goto start
-                '';
-              })
+              #         :memtest
+              #         chain --autofree mt86plus.efi
+              #         goto start
+              #       ''} $out/eostre.menu.ipxe
+              #     '')))
             ];
         };
       };
diff --git a/hosts/vidhar/network/dhcp/knot-tsig.json.frag b/hosts/vidhar/network/dhcp/knot-tsig
index c10115cf..73a8f11d 100644
--- a/hosts/vidhar/network/dhcp/knot-tsig.json.frag
+++ b/hosts/vidhar/network/dhcp/knot-tsig
@@ -1,18 +1,14 @@
 {
-        "data": "ENC[AES256_GCM,data:cGcoqYZ341xQOFukDm4J5KDfG6+NaNbk2U2k4YGneRsAoPJZe/8KDmVr8TBWFCXXbuzeCGbiuXRVBmtYSEIqbqTN4u00RdQgpeL72cB3ZFd2c7cideEQV5z802pqFfXSlmLBC01OPG3TwAgk6xhQYSn5IcBTIL6fRF235Y9Q8k/X96rhfwPRVq84,iv:UoweWBcVuQIXeWFFl/WNUHLXG8nEri1UuTskC2I26hU=,tag:TJldVr2LDTmKA3ozZoX+cQ==,type:str]",
+        "data": "ENC[AES256_GCM,data:ZjPqKfUCRYD4iD7yC7qObZhBAMll0DXNzImZ43TM0D8SXRtANqG6YnfwQuJ7,iv:GXD5LutgEz6ktGEtpI9z41IJLLzIMj6OvPADQlZcvwk=,tag:v9ISQFDubtLWcb2mVHa4zA==,type:str]",
         "sops": {
-                "kms": null,
-                "gcp_kms": null,
-                "azure_kv": null,
-                "hc_vault": null,
                 "age": [
                         {
-                                "recipient": "age1qffdqvy9arld9zd5a5cylt0n98xhcns5shxhrhwjq5g4qa844ejselaa4l",
-                                "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCYk5tM1lPRXc0MGpHZENQ\ndDU2M2VKY2t2VGFrcTUvd0NrU3VMZGQ3NHlNClNTaWVjdDNTQXh6WDFmMDk3SWtn\ncjJjRzUxODFFL25Ic0dabyt1ZW5xRE0KLS0tIDJlT0NTVDlXNWphQ1B0VTQ1U0NH\nNktRNlIrQzdhRjZ0SjR0T3oyRkZiWXMKX28S4SySQguT1cgMZpDY4o/OKY6IvjT9\n1oUzwx/BzBbC2JbpGYvQQgp/qfiM2k0oXmQlfdTv8kD/MoOqPO8E1Q==\n-----END AGE ENCRYPTED FILE-----\n"
+                                "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCYk5tM1lPRXc0MGpHZENQ\ndDU2M2VKY2t2VGFrcTUvd0NrU3VMZGQ3NHlNClNTaWVjdDNTQXh6WDFmMDk3SWtn\ncjJjRzUxODFFL25Ic0dabyt1ZW5xRE0KLS0tIDJlT0NTVDlXNWphQ1B0VTQ1U0NH\nNktRNlIrQzdhRjZ0SjR0T3oyRkZiWXMKX28S4SySQguT1cgMZpDY4o/OKY6IvjT9\n1oUzwx/BzBbC2JbpGYvQQgp/qfiM2k0oXmQlfdTv8kD/MoOqPO8E1Q==\n-----END AGE ENCRYPTED FILE-----\n",
+                                "recipient": "age1qffdqvy9arld9zd5a5cylt0n98xhcns5shxhrhwjq5g4qa844ejselaa4l"
                         }
                 ],
-                "lastmodified": "2022-03-15T13:52:17Z",
-                "mac": "ENC[AES256_GCM,data:rTelaGx5S2E2oYPNGfctFbgDKdyRX8tpVTqLtpcCAJ8MS5ppFTjnSwYi4yQHvTicfAPNz7hGJYAnTdyC2QDTciJgkS6KC3CCXWCimkTybBdVW4Azwz9iBZCpWu+rB1vcQhSLlLCaKmKskkqDZZ5+mfuaXc+TT2uwTA0SDtZWvnM=,iv:ANCZ1fHy6w/svEE53o7rWsp5qU15qoriqyVMzClH6J0=,tag:H92RM5GuLIl9/kslq4tzkQ==,type:str]",
+                "lastmodified": "2026-07-29T06:39:18Z",
+                "mac": "ENC[AES256_GCM,data:hj/YR0N8NhGHQEcCOjt/r+rfM8plkaUZoee9sI25evvEvOlfX69YRxUv1vyd6Sqd9wPEgCsF5STnMXFQhq3zgGjoTFcdHU+olRVmRq9rkYQo/ButZ/NEIQ7uc5b4FRPdPwOGF14aSpgI67F35oRavv1vtk10zGme+X0I1VXTIqE=,iv:rMUL+CyTLhQBJrsQJQPhN75FjCf5uGFh1z6KAXKDeB8=,tag:bpeQZ3UPZ10tCrgveoDklg==,type:str]",
                 "pgp": [
                         {
                                 "created_at": "2023-01-30T11:00:34Z",
@@ -21,6 +17,6 @@
                         }
                 ],
                 "unencrypted_suffix": "_unencrypted",
-                "version": "3.7.1"
+                "version": "3.13.2"
         }
-}
\ No newline at end of file
+}