hosts: remove the is-target attribute and opt into roles via the config system instead

hosts/by-name/lappy/default.nix

@@ -4,6 +4,8 @@
     ./fs.nix
   ];
 
+  sane.roles.client = true;
+
   # sane.packages.enableDevPkgs = true;
 
   # sane.users.guest.enable = true;

hosts/by-name/servo/default.nix

@@ -17,6 +17,8 @@
   ];
   sane.persist.enable = true;
   sane.services.dyn-dns.enable = true;
+  sane.services.wg-home.enable = true;
+  sane.services.wg-home.role = "server";
   # sane.services.duplicity.enable = true;  # TODO: re-enable after HW upgrade
 
   boot.loader.efi.canTouchEfiVariables = false;

hosts/instantiate.nix

@@ -13,7 +13,6 @@
     ./modules
   ];
 
-  sane.hosts.by-name."${hostName}".is-target = true;
   networking.hostName = hostName;
 
   nixpkgs.overlays = [

hosts/modules/default.nix

@@ -4,6 +4,7 @@
   imports = [
     ./hardware
     ./hosts.nix
+    ./roles
     ./wg-home.nix
   ];
 }

hosts/modules/hosts.nix

@@ -6,29 +6,6 @@ let
 
   host = types.submodule ({ config, ... }: {
     options = {
-      is-target = mkOption {
-        type = types.bool;
-        default = false;
-        description = ''
-          set to true if the config is being built for deployment to this host.
-        '';
-      };
-
-      roles.server = mkOption {
-        type = types.bool;
-        default = false;
-        description = ''
-          whether this machine is a server for domain-level services like wireguard, rss aggregation, etc.
-        '';
-      };
-      roles.client = mkOption {
-        type = types.bool;
-        default = false;
-        description = ''
-          whether this machine is a client to domain-level services like wireguard, rss aggregation, etc.
-        '';
-      };
-
       ssh.user_pubkey = mkOption {
         type = types.nullOr types.str;
         description = ''
@@ -56,13 +33,6 @@ in
         like its ssh pubkey, etc.
       '';
     };
-    # TODO: questionable. the target should specifically output config rather than other bits peeking at this.
-    sane.hosts.target = mkOption {
-      type = host;
-      description = ''
-        host to which the config being built applies to.
-      '';
-    };
   };
 
   config = {
@@ -70,30 +40,22 @@ in
     sane.hosts.by-name."desko" = {
       ssh.user_pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPU5GlsSfbaarMvDA20bxpSZGWviEzXGD8gtrIowc1pX";
       ssh.host_pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFw9NoRaYrM6LbDd3aFBc4yyBlxGQn8HjeHd/dZ3CfHk";
-      roles.client = true;
     };
     sane.hosts.by-name."lappy" = {
       ssh.user_pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDpmFdNSVPRol5hkbbCivRhyeENzb9HVyf9KutGLP2Zu";
       ssh.host_pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILSJnqmVl9/SYQ0btvGb0REwwWY8wkdkGXQZfn/1geEc";
-      roles.client = true;
     };
     sane.hosts.by-name."moby" = {
       ssh.user_pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICrR+gePnl0nV/vy7I5BzrGeyVL+9eOuXHU1yNE3uCwU";
       ssh.host_pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO1N/IT3nQYUD+dBlU1sTEEVMxfOyMkrrDeyHcYgnJvw";
-      roles.client = true;
     };
     sane.hosts.by-name."servo" = {
       ssh.user_pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPS1qFzKurAdB9blkWomq8gI1g0T3sTs9LsmFOj5VtqX";
       ssh.host_pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOfdSmFkrVT6DhpgvFeQKm3Fh9VKZ9DbLYOPOJWYQ0E8";
-      roles.server = true;
     };
     sane.hosts.by-name."rescue" = {
       ssh.user_pubkey = null;
       ssh.host_pubkey = null;
     };
-
-    sane.hosts."target" = mkMerge (attrValues
-      (filterAttrs (host: c: c.is-target) cfg.by-name)
-    );
   };
 }

hosts/modules/roles/client.nix

@@ -0,0 +1,16 @@
+{ config, lib, ... }:
+
+let
+  inherit (lib) mkIf mkOption types;
+in
+{
+  options.sane.roles.client = mkOption {
+    type = types.bool;
+    default = false;
+  };
+
+  config = mkIf config.sane.roles.client {
+    sane.services.wg-home.enable = true;
+    sane.services.wg-home.role = "client";
+  };
+}

hosts/modules/roles/default.nix

@@ -0,0 +1,6 @@
+{ ... }:
+{
+  imports = [
+    ./client.nix
+  ];
+}

hosts/modules/wg-home.nix

@@ -1,20 +1,30 @@
 { config, lib, ... }:
 
 let
-  inherit (lib) optionalAttrs;
-  me = config.sane.hosts.target;
+  inherit (lib) mkIf mkOption optionalAttrs types;
+  cfg = config.sane.services.wg-home;
 in
 {
+  options = {
+    sane.services.wg-home.enable = mkOption {
+      type = types.bool;
+      default = false;
+    };
+    sane.services.wg-home.role = mkOption {
+      type = types.enum [ "client" "server" ];
+    };
+  };
+
+  config = mkIf cfg.enable {
     # wireguard VPN which allows everything on my domain to speak to each other even when
     # not behind a shared LAN.
     # this config defines both the endpoint (server) and client configs
 
     networking.firewall.allowedUDPPorts = [ 51820 ];
-  # TODO: remove this hacky `if` block
     networking.wireguard.interfaces.wg-home = {
       privateKeyFile = config.sops.secrets.wg_home_privkey.path;
       listenPort = 51820; # to match firewall allowedUDPPorts (without this wg uses random port numbers)
-  } // (optionalAttrs me.roles.client {
+    } // (optionalAttrs (cfg.role == "client") {
       # client IP (TODO: make host-specific)
       ips = [ "10.0.10.20/32" ];
 
@@ -32,7 +42,7 @@ in
           persistentKeepalive = 25;
         }
       ];
-  }) // (optionalAttrs me.roles.server {
+    }) // (optionalAttrs (cfg.role == "server") {
       ips = [
         "10.0.10.5/24"
       ];
@@ -61,4 +71,5 @@ in
         # }
       ];
     });
+  };
 }