3 files changed, 67 insertions, 51 deletions

diff --git a/hosts/vidhar/network/default.nix b/hosts/vidhar/network/default.nix
index 0643f0bb..92d755f3 100644
--- a/hosts/vidhar/network/default.nix
+++ b/hosts/vidhar/network/default.nix
@@ -103,7 +103,14 @@ with lib;
           /srv/nfs/nix-store 10.141.0.0/24(ro,async,root_squash) 2a03:4000:52:ada:1::/80(ro,async,root_squash)
         '';
       };
-      settings.nfsd.vers3 = false;
+      settings.nfsd = {
+        rdma = true;
+        vers3 = false;
+        vers4 = true;
+        "vers4.0" = false;
+        "vers4.1" = false;
+        "vers4.2" = true;
+      };
     };
 
     fileSystems = {
diff --git a/hosts/vidhar/network/dhcp/default.nix b/hosts/vidhar/network/dhcp/default.nix
index f36d0c7f..11460393 100644
--- a/hosts/vidhar/network/dhcp/default.nix
+++ b/hosts/vidhar/network/dhcp/default.nix
@@ -5,6 +5,7 @@ with lib;
 let
   nfsrootBaseUrl = "http://nfsroot.vidhar.yggdrasil";
   tftpIp = "10.141.0.1";
+  nfsIp = tftpIp;
   ipxe = pkgs.ipxe.override {
     additionalTargets = {
       "bin-i386-efi/ipxe.efi" = "i386-ipxe.efi";
@@ -305,32 +306,30 @@ in {
               pkgs.symlinkJoin {
                 name = "installer-${system}";
                 paths = [
-                  (let
-                    installerBuild = (flake.nixosConfigurations.${"installer-${system}-nfsroot"}.extendModules {
+                  (builtins.addErrorContext "while evaluating installer-${system}-nfsroot" (let
+                    installerBuild' = (flake.nixosConfigurations.${"installer-${system}-nfsroot"}.extendModules {
                       modules = [
                         ({ ... }: {
-                          config.nfsroot.storeDevice = "${tftpIp}:nix-store";
+                          config.nfsroot.storeDevice = "${nfsIp}:nix-store";
                           config.nfsroot.registrationUrl = "${nfsrootBaseUrl}/installer-${system}/registration";
+                          config.system.nixos.label = "installer-${system}";
                         })
                       ];
-                    }).config.system.build;
-                  in builtins.toPath (pkgs.runCommandLocal "install-${system}" {} ''
+                    });
+                    installerBuild = installerBuild'.config.system.build;
+                  in builtins.toPath (pkgs.runCommandLocal "installer-${system}" {} ''
                     mkdir -p $out/installer-${system}
                     install -m 0444 -t $out/installer-${system} \
                       ${installerBuild.initialRamdisk}/initrd \
                       ${installerBuild.kernel}/bzImage \
                       ${installerBuild.netbootIpxeScript}/netboot.ipxe \
                       ${pkgs.closureInfo { rootPaths = installerBuild.storeContents; }}/registration
-                  ''))
-                  (pkgs.writeTextFile {
-                    name = "installer-${system}.menu.ipxe";
-                    destination = "/installer-${system}.menu.ipxe";
-                    text = ''
+                    install -m 0444 ${pkgs.writeText "installer-${system}.menu.ipxe" ''
                       #!ipxe
 
                       :start
                       menu iPXE boot menu for installer-${system}
-                      item installer installer-${system}
+                      item installer ${with installerBuild'; "${config.system.nixos.distroName} ${config.system.nixos.codeName} ${config.system.nixos.label} (Linux ${config.boot.kernelPackages.kernel.modDirVersion})"}
                       item memtest memtest86plus
                       item netboot netboot.xyz
                       item shell iPXE shell
@@ -352,8 +351,8 @@ in {
                       :memtest
                       iseq ''${platform} efi && chain --autofree memtest.efi || chain --autofree memtest.bin
                       goto start
-                    '';
-                  })
+                    ''} $out/installer-${system}.menu.ipxe
+                  '')))
                 ];
               }) ["x86_64-linux"]
             ) ++ [
@@ -365,15 +364,17 @@ in {
                 install -m 0444 ${sources.netbootxyz-efi.src} $out/netboot.xyz.efi
                 install -m 0444 ${sources.netbootxyz-lkrn.src} $out/netboot.xyz.lkrn
               '')
-              (let
-                 eostreBuild = (flake.nixosConfigurations.eostre.extendModules {
+              (builtins.addErrorContext "while evaluating eostre" (let
+                 eostreBuild' = (flake.nixosConfigurations.eostre.extendModules {
                    modules = [
                      ({ ... }: {
-                       config.nfsroot.storeDevice = "${tftpIp}:nix-store";
+                       config.nfsroot.storeDevice = "${nfsIp}:nix-store";
                        config.nfsroot.registrationUrl = "${nfsrootBaseUrl}/eostre/registration";
+                       config.system.nixos.label = "eostre";
                      })
                    ];
-                 }).config.system.build;
+                 });
+                 eostreBuild = eostreBuild'.config.system.build;
                in builtins.toPath (pkgs.runCommandLocal "eostre" {} ''
                     mkdir -p $out/eostre
                     install -m 0444 -t $out/eostre \
@@ -381,43 +382,39 @@ in {
                       ${eostreBuild.kernel}/bzImage \
                       ${eostreBuild.netbootIpxeScript}/netboot.ipxe \
                       ${pkgs.closureInfo { rootPaths = eostreBuild.storeContents; }}/registration
-                  ''))
-              (pkgs.writeTextFile {
-                name = "eostre.menu.ipxe";
-                destination = "/eostre.menu.ipxe";
-                text = ''
-                  #!ipxe
+                    install -m 0444 ${pkgs.writeText "eostre.menu.ipxe" ''
+                      #!ipxe
 
-                  set menu-timeout 5000
+                      set menu-timeout 5000
 
-                  :start
-                  menu iPXE boot menu for eostre
-                  item eostre eostre
-                  item memtest memtest86plus
-                  item netboot netboot.xyz
-                  item shell iPXE shell
-                  choose --timeout ''${menu-timeout} --default eostre selected || goto shell
-                  set menu-timeout 0
-                  goto ''${selected}
+                      :start
+                      menu iPXE boot menu for eostre
+                      item eostre ${with eostreBuild'; "${config.system.nixos.distroName} ${config.system.nixos.codeName} ${config.system.nixos.label} (Linux ${config.boot.kernelPackages.kernel.modDirVersion})"}
+                      item memtest memtest86plus
+                      item netboot netboot.xyz
+                      item shell iPXE shell
+                      choose --timeout ''${menu-timeout} --default eostre selected || goto shell
+                      set menu-timeout 0
+                      goto ''${selected}
 
-                  :shell
-                  set menu-timeout 0
-                  shell
-                  goto start
+                      :shell
+                      set menu-timeout 0
+                      shell
+                      goto start
 
-                  :eostre
-                  chain eostre/netboot.ipxe
-                  goto start
+                      :eostre
+                      chain eostre/netboot.ipxe
+                      goto start
 
-                  :netboot
-                  iseq ''${platform} efi && chain --autofree netboot.xyz.efi || chain --autofree netboot.xyz.lkrn
-                  goto start
+                      :netboot
+                      iseq ''${platform} efi && chain --autofree netboot.xyz.efi || chain --autofree netboot.xyz.lkrn
+                      goto start
 
-                  :memtest
-                  iseq ''${platform} efi && chain --autofree memtest.efi || chain --autofree memtest.bin
-                  goto start
-                '';
-              })
+                      :memtest
+                      iseq ''${platform} efi && chain --autofree memtest.efi || chain --autofree memtest.bin
+                      goto start
+                    ''} $out/eostre.menu.ipxe
+                  '')))
             ];
         };
       };
diff --git a/hosts/vidhar/network/ruleset.nft b/hosts/vidhar/network/ruleset.nft
index 1edae167..7897fb3d 100644
--- a/hosts/vidhar/network/ruleset.nft
+++ b/hosts/vidhar/network/ruleset.nft
@@ -60,6 +60,7 @@ table inet filter {
   counter fw-lo {}
   counter fw-lan {}
   counter fw-gpon {}
+  counter fw-kimai {}
 
   counter fw-cups {}
 
@@ -94,6 +95,8 @@ table inet filter {
   counter immich-rx {}
   counter paperless-rx {}
   counter hledger-rx {}
+  counter audiobookshelf-rx {}
+  counter kimai-rx {}
 
   counter established-rx {}
 
@@ -125,6 +128,8 @@ table inet filter {
   counter immich-tx {}
   counter paperless-tx {}
   counter hledger-tx {}
+  counter audiobookshelf-tx {}
+  counter kimai-tx {}
 
   counter tx {}
 
@@ -148,8 +153,13 @@ table inet filter {
 
     oifname { lan, gpon, bifrost } meta l4proto $icmp_protos jump forward_icmp_accept
     iifname lan oifname { gpon, bifrost } counter name fw-lan accept
+    iifname ve-kimai oifname gpon counter name fw-kimai accept
 
     iifname gpon oifname lan ct state { established, related } counter name fw-gpon accept
+    iifname gpon oifname ve-kimai ct state { established, related } counter name fw-kimai accept
+
+    iifname bifrost oifname ve-kimai tcp dport 80 ip6 saddr $bifrost_surtr ip6 daddr 2a03:4000:52:ada:6::2 counter name kimai-rx accept
+    iifname ve-kimai oifname bifrost tcp sport 80 ip6 saddr 2a03:4000:52:ada:6::2 ip6 daddr $bifrost_surtr counter name kimai-tx accept
 
 
     limit name lim_reject log level debug prefix "drop forward: " counter name reject-ratelimit-fw drop
@@ -203,6 +213,7 @@ table inet filter {
     iifname bifrost tcp dport 2283 ip6 saddr $bifrost_surtr counter name immich-rx accept
     iifname bifrost tcp dport 28981 ip6 saddr $bifrost_surtr counter name paperless-rx accept
     iifname bifrost tcp dport 5000 ip6 saddr $bifrost_surtr counter name hledger-rx accept
+    iifname bifrost tcp dport 28982 ip6 saddr $bifrost_surtr counter name audiobookshelf-rx accept
 
     ct state { established, related } counter name established-rx accept
 
@@ -254,6 +265,7 @@ table inet filter {
     iifname bifrost tcp sport 2283 ip6 daddr $bifrost_surtr counter name immich-tx accept
     iifname bifrost tcp sport 28981 ip6 daddr $bifrost_surtr counter name paperless-tx accept
     iifname bifrost tcp sport 5000 ip6 daddr $bifrost_surtr counter name hledger-tx accept
+    iifname bifrost tcp sport 28982 ip6 daddr $bifrost_surtr counter name audiobookshelf-tx accept
 
 
     counter name tx
@@ -262,7 +274,7 @@ table inet filter {
 
 table inet nat {
   counter gpon-nat {}
-  # counter container-nat {}
+  counter kimai-nat {}
 
   chain postrouting {
     type nat hook postrouting priority srcnat
@@ -270,7 +282,7 @@ table inet nat {
 
 
     meta nfproto ipv4 oifname gpon counter name gpon-nat masquerade
-    # iifname ve-* oifname gpon counter name container-nat masquerade
+    iifname ve-kimai oifname gpon counter name kimai-nat masquerade
   }
 }