Update flake.lock

The same subnet on different routing peers makes problems for the
reverse proxy feature. Therefore add the possibility to set a different
subnet on different hosts.

flake.lock

@@ -30,11 +30,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1778403279,
-        "narHash": "sha256-qOn95CiAxdt+x0YV5Qrc039HFpByEvURVCHPzCVr8tE=",
+        "lastModified": 1780814819,
+        "narHash": "sha256-tCqZRB4pvZlcz2cMi7mfvhFRsfdkbFMP67jGNciogmc=",
         "owner": "AdnanHodzic",
         "repo": "auto-cpufreq",
-        "rev": "c1ba0fe5df2542681e8dfcef6b0aa0217cf9edb4",
+        "rev": "f325b2a221ab9adb5bb729a1e5d7a45aea686382",
         "type": "github"
       },
       "original": {
@@ -43,6 +43,21 @@
         "type": "github"
       }
     },
+    "crane": {
+      "locked": {
+        "lastModified": 1765145449,
+        "narHash": "sha256-aBVHGWWRzSpfL++LubA0CwOOQ64WNLegrYHwsVuVN7A=",
+        "owner": "ipetkov",
+        "repo": "crane",
+        "rev": "69f538cdce5955fcd47abfed4395dc6d5194c1c5",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ipetkov",
+        "repo": "crane",
+        "type": "github"
+      }
+    },
     "disko": {
       "inputs": {
         "nixpkgs": [
@@ -50,11 +65,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1777713215,
-        "narHash": "sha256-8GzXDOXckDWwST8TY5DbwYFjdvQLlP7K9CLSVx6iTTo=",
+        "lastModified": 1780290312,
+        "narHash": "sha256-eTAlX0CwgB84Ts3GaBd944A3DRXVMzgA0EqroZBISUo=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "63b4e7e6cf75307c1d26ac3762b886b5b0247267",
+        "rev": "115e5211780054d8a890b41f0b7734cafad54dfe",
         "type": "github"
       },
       "original": {
@@ -64,6 +79,22 @@
       }
     },
     "flake-compat": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1761588595,
+        "narHash": "sha256-XKUZz9zewJNUj46b4AJdiRZJAvSZ0Dqj2BNfXvFlJC4=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "f387cd2afec9419c8ee37694406ca490c3f34ee5",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "flake-compat_2": {
       "flake": false,
       "locked": {
         "lastModified": 1696426674,
@@ -79,7 +110,7 @@
         "type": "github"
       }
     },
-    "flake-compat_2": {
+    "flake-compat_3": {
       "locked": {
         "lastModified": 1747046372,
         "narHash": "sha256-CIVLLkVgvHYbgI2UpXvIIBJ12HWgX+fjA8Xf8PUmqCY=",
@@ -95,6 +126,28 @@
       }
     },
     "gitignore": {
+      "inputs": {
+        "nixpkgs": [
+          "lanzaboote",
+          "pre-commit",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1709087332,
+        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "type": "github"
+      }
+    },
+    "gitignore_2": {
       "inputs": {
         "nixpkgs": [
           "lazy-apps",
@@ -144,11 +197,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1778401693,
-        "narHash": "sha256-OVHdCqXXUF5UdGkH+FF2ZL06OLZjj2kvP2dIUmzVWoo=",
+        "lastModified": 1779506708,
+        "narHash": "sha256-QOD/CNm196nCJRheux/URi4/HE66fthdOMqCJoPP1Y0=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "389b83002efc26f1145e89a6a8e6edc5a6435948",
+        "rev": "3ee51fbdac8c8bdfe1e7e1fcaba6520a563f394f",
         "type": "github"
       },
       "original": {
@@ -158,6 +211,30 @@
         "type": "github"
       }
     },
+    "lanzaboote": {
+      "inputs": {
+        "crane": "crane",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "pre-commit": "pre-commit",
+        "rust-overlay": "rust-overlay"
+      },
+      "locked": {
+        "lastModified": 1765382359,
+        "narHash": "sha256-RJmgVDzjRI18BWVogG6wpsl1UCuV6ui8qr4DJ1LfWZ8=",
+        "owner": "nix-community",
+        "repo": "lanzaboote",
+        "rev": "e8c096ade12ec9130ff931b0f0e25d2f1bc63607",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "ref": "v1.0.0",
+        "repo": "lanzaboote",
+        "type": "github"
+      }
+    },
     "lazy-apps": {
       "inputs": {
         "nixpkgs": [
@@ -180,12 +257,15 @@
       }
     },
     "nixos-hardware": {
+      "inputs": {
+        "nixpkgs": "nixpkgs"
+      },
       "locked": {
-        "lastModified": 1778143761,
-        "narHash": "sha256-lkesY6x2X2qxlqLM7CT2iM/0rP2JB7fruPN3h8POXmI=",
+        "lastModified": 1780310866,
+        "narHash": "sha256-fPBRVf6A5xlACYcOI59shGrjURuvwu0lRsDoSCEXt/I=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "3bcaa367d4c550d687a17ac792fd5cda214ee871",
+        "rev": "4ed851c979641e28597a05086332d75cdc9e395f",
         "type": "github"
       },
       "original": {
@@ -197,18 +277,15 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1778003029,
-        "narHash": "sha256-q/nkKLDtHIyLjZpKhWk3cSK5IYsFqtMd6UtXF3ddjgA=",
-        "owner": "nixos",
-        "repo": "nixpkgs",
-        "rev": "0c88e1f2bdb93d5999019e99cb0e61e1fe2af4c5",
-        "type": "github"
+        "lastModified": 1767892417,
+        "narHash": "sha256-8bW3q88CEg2u4hSP66Vf4lpbLonHz7hqDNBMcCY7E9U=",
+        "rev": "3497aa5c9457a9d88d71fa93a4a8368816fbeeba",
+        "type": "tarball",
+        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.05pre924538.3497aa5c9457/nixexprs.tar.xz"
       },
       "original": {
-        "owner": "nixos",
-        "ref": "nixos-25.11",
-        "repo": "nixpkgs",
-        "type": "github"
+        "type": "tarball",
+        "url": "https://channels.nixos.org/nixos-unstable/nixexprs.tar.xz"
       }
     },
     "nixpkgs-libvncserver": {
@@ -261,11 +338,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1777954456,
-        "narHash": "sha256-hGdgeU2Nk87RAuZyYjyDjFL6LK7dAZN5RE9+hrDTkDU=",
+        "lastModified": 1780243769,
+        "narHash": "sha256-x5UQuRsH3MqI0U9afaXSNqzTPSeZlRLvFAav2Ux1pNw=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "549bd84d6279f9852cae6225e372cc67fb91a4c1",
+        "rev": "331800de5053fcebacf6813adb5db9c9dca22a0c",
         "type": "github"
       },
       "original": {
@@ -275,10 +352,49 @@
         "type": "github"
       }
     },
-    "pre-commit-hooks": {
+    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1780511130,
+        "narHash": "sha256-2v9lT4ya59Lh1FqPeLnz1MoX9y/wz2huqfe9RtQZITk=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "535f3e6942cb1cead3929c604320d3db54b542b9",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-25.11",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "pre-commit": {
       "inputs": {
         "flake-compat": "flake-compat",
         "gitignore": "gitignore",
+        "nixpkgs": [
+          "lanzaboote",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1765016596,
+        "narHash": "sha256-rhSqPNxDVow7OQKi4qS5H8Au0P4S3AYbawBSmJNUtBQ=",
+        "owner": "cachix",
+        "repo": "pre-commit-hooks.nix",
+        "rev": "548fc44fca28a5e81c5d6b846e555e6b9c2a5a3c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cachix",
+        "repo": "pre-commit-hooks.nix",
+        "type": "github"
+      }
+    },
+    "pre-commit-hooks": {
+      "inputs": {
+        "flake-compat": "flake-compat_2",
+        "gitignore": "gitignore_2",
         "nixpkgs": [
           "lazy-apps",
           "nixpkgs"
@@ -301,17 +417,17 @@
     },
     "proxmox-nixos": {
       "inputs": {
-        "flake-compat": "flake-compat_2",
+        "flake-compat": "flake-compat_3",
         "nixpkgs-libvncserver": "nixpkgs-libvncserver",
         "nixpkgs-stable": "nixpkgs-stable_2",
         "utils": "utils"
       },
       "locked": {
-        "lastModified": 1777731636,
-        "narHash": "sha256-OkFcWIKnrl0n5ULcFnzmLjdfD7Z8IHtYLge3e7EuARs=",
+        "lastModified": 1779805430,
+        "narHash": "sha256-SyjG3ld9PyGVxjJOHmhOyWA3tbHgWqIDXBu28f/HLjE=",
         "owner": "SaumonNet",
         "repo": "proxmox-nixos",
-        "rev": "22b690085bfb2b82cbbc8e9d637a67c9c704b6db",
+        "rev": "d2537c08100f135b609389a8cd98f6424339de8c",
         "type": "github"
       },
       "original": {
@@ -326,23 +442,45 @@
         "auto-cpufreq": "auto-cpufreq",
         "disko": "disko",
         "home-manager": "home-manager_2",
+        "lanzaboote": "lanzaboote",
         "lazy-apps": "lazy-apps",
         "nixos-hardware": "nixos-hardware",
-        "nixpkgs": "nixpkgs",
+        "nixpkgs": "nixpkgs_2",
         "nixpkgs-unstable": "nixpkgs-unstable",
         "proxmox-nixos": "proxmox-nixos",
         "secrets": "secrets",
         "systems": "systems_3"
       }
     },
+    "rust-overlay": {
+      "inputs": {
+        "nixpkgs": [
+          "lanzaboote",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1765075567,
+        "narHash": "sha256-KFDCdQcHJ0hE3Nt5Gm5enRIhmtEifAjpxgUQ3mzSJpA=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "769156779b41e8787a46ca3d7d76443aaf68be6f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
+      }
+    },
     "secrets": {
       "flake": false,
       "locked": {
-        "lastModified": 1777152364,
-        "narHash": "sha256-yS8TxtPFFf7xIDNbsErZUnTBLn2fnyCcC4On+t3v1Zs=",
+        "lastModified": 1779441912,
+        "narHash": "sha256-Le50mFgpetFC8gyc1j3+oXEjRV3lZdeU2vqBtoWaAJo=",
         "ref": "refs/heads/main",
-        "rev": "bfb7da1297d73100a56a044d09792fc6e59357e6",
-        "revCount": 34,
+        "rev": "847ed2f52fd5ff0ead5958d6932b219b4254a2bf",
+        "revCount": 38,
         "type": "git",
         "url": "ssh://git@git.jfreudenberger.de/JuliusFreudenberger/nix-private.git"
       },

flake.nix

@@ -38,6 +38,10 @@
         darwin.follows = "";
       };
     };
+    lanzaboote = {
+      url = "github:nix-community/lanzaboote/v1.0.0";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
     secrets = {
       url = "git+ssh://git@git.jfreudenberger.de/JuliusFreudenberger/nix-private.git";
       flake = false;
@@ -55,6 +59,7 @@
     proxmox-nixos,
     agenix,
     disko,
+    lanzaboote,
     systems,
     ...
   } @ inputs: let
@@ -158,6 +163,23 @@
         ];
       };
 
+      busch-gpu-docker = nixpkgs.lib.nixosSystem rec {
+        system = "x86_64-linux";
+
+        specialArgs = {
+          inherit inputs outputs;
+          pkgs-unstable = import nixpkgs-unstable {
+            inherit system;
+          };
+        };
+
+        modules = [
+          ./hosts/busch-gpu-docker
+          disko.nixosModules.disko
+          agenix.nixosModules.default
+        ];
+      };
+
       srv01-hf = nixpkgs.lib.nixosSystem rec {
         system = "x86_64-linux";
 
@@ -193,6 +215,24 @@
         ];
       };
 
+      xcy = nixpkgs.lib.nixosSystem rec {
+        system = "x86_64-linux";
+
+        specialArgs = {
+          inherit inputs outputs;
+          pkgs-unstable = import nixpkgs-unstable {
+            inherit system;
+          };
+        };
+
+        modules = [
+          disko.nixosModules.disko
+          agenix.nixosModules.default
+          lanzaboote.nixosModules.lanzaboote
+          ./hosts/xcy
+        ];
+      };
+
     };
 
     homeConfigurations = {

hosts/busch-gpu-docker/default.nix

@@ -0,0 +1,72 @@
+{ inputs, outputs, config, lib, pkgs, pkgs-unstable, ... }:
+
+{
+  imports =
+    [
+      ../../modules/disko/legacy-full-ext4.nix
+      ./secrets.nix
+
+      ../../users/julius/nixos-server.nix
+      ../../modules/nix.nix
+      ../../modules/auto-upgrade.nix
+      ../../modules/locale.nix
+      ../../modules/server-cli.nix
+      ../../modules/sshd.nix
+      ../../modules/docker.nix
+      ../../modules/hawser.nix
+      ../../modules/netbird-client.nix
+      "${inputs.secrets}/modules/opkssh.nix"
+
+      # Include the results of the hardware scan.
+      ./hardware-configuration.nix
+    ];
+
+  # Use the GRUB 2 boot loader.
+  boot = {
+    loader.grub = {
+      enable = true;
+    };
+    tmp.useTmpfs = true;
+  };
+
+  hardware = {
+    graphics.enable = true;
+    nvidia = {
+      package = config.boot.kernelPackages.nvidiaPackages.legacy_470;
+      # TODO GTX 970 or GTX 960 driver 580 (>= 545)
+    };
+    nvidia-container-toolkit.enable = true;
+  };
+  nixpkgs.config.nvidia.acceptLicense = true;
+  services.xserver.videoDrivers = [ "nvidia" ];
+
+  networking.hostName = "docker-gpu"; # Define your hostname.
+
+  services.netbird-client = {
+    enable = true;
+    managementUrl = "https://netbird.jfreudenberger.de";
+    host.setupKey = "830217A8-BE0A-4919-A262-3CF7599487BA";
+    docker.setupKey = "C4C9FAE3-5FAE-4949-B8E8-BEDA3B954859";
+    dockerSubnet = "40";
+  };
+
+  services.hawser = {
+    enable = true;
+    dockhandServerUrl = "wss://dockhand-connect.jfreudenberger.de/api/hawser/connect";
+    tokenSecretFile = config.age.secrets.hawser-token;
+  };
+
+  # This option defines the first version of NixOS you have installed on this particular machine,
+  # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
+  # Most users should NEVER change this value after the initial install, for any reason,
+  # even if you've upgraded your system to a new NixOS release.
+  # This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
+  # so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how
+  # to actually do that.
+  # This value being lower than the current NixOS release does NOT mean your system is
+  # out of date, out of support, or vulnerable.
+  # Do NOT change this value unless you have manually inspected all the changes it would make to your configuration,
+  # and migrated your data accordingly.
+  # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion .
+  system.stateVersion = "25.05"; # Did you read the comment?
+}

hosts/busch-gpu-docker/hardware-configuration.nix

@@ -0,0 +1,17 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/profiles/qemu-guest.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "ehci_pci" "ahci" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}

hosts/busch-gpu-docker/secrets.nix

@@ -0,0 +1,6 @@
+{ inputs, ... }:
+{
+  age.secrets = {
+    hawser-token.file = "${inputs.secrets}/secrets/busch-gpu-docker/hawser-token";
+  };
+}

hosts/busch-main-docker/default.nix

@@ -4,6 +4,7 @@
   imports =
     [
       ../../modules/disko/legacy-full-ext4.nix
+      ./secrets.nix
 
       ../../users/julius/nixos-server.nix
       ../../modules/nix.nix
@@ -12,12 +13,14 @@
       ../../modules/server-cli.nix
       ../../modules/sshd.nix
       ../../modules/docker.nix
+      ../../modules/hawser.nix
       ../../modules/netbird-client.nix
       "${inputs.secrets}/modules/opkssh.nix"
 
       # Include the results of the hardware scan.
       ./hardware-configuration.nix
     ];
+
   # Use the GRUB 2 boot loader.
   boot = {
     loader.grub = {
@@ -31,7 +34,14 @@
     enable = true;
     managementUrl = "https://netbird.jfreudenberger.de";
     host.setupKey = "DB64713B-FB23-49F1-A4A7-9B9E37B585D4";
-    docker.setupKey = "B9ECD884-B445-4156-8643-D0F34D64C200";
+    docker.setupKey = "0028C8B8-BE57-4045-B16E-507B110AF24D";
+    dockerSubnet = "30";
+  };
+
+  services.hawser = {
+    enable = true;
+    dockhandServerUrl = "wss://dockhand-connect.jfreudenberger.de/api/hawser/connect";
+    tokenSecretFile = config.age.secrets.hawser-token;
   };
 
   # This option defines the first version of NixOS you have installed on this particular machine,

hosts/busch-main-docker/secrets.nix

@@ -0,0 +1,6 @@
+{ inputs, ... }:
+{
+  age.secrets = {
+    hawser-token.file = "${inputs.secrets}/secrets/busch-main-docker/hawser-token";
+  };
+}

hosts/xcy/default.nix

@@ -0,0 +1,104 @@
+{ inputs, outputs, config, lib, pkgs, pkgs-unstable, ... }:
+
+{
+  imports =
+    [
+      ./secrets.nix
+      ./disko.nix
+
+      ../../users/julius/nixos-server.nix
+      ../../modules/nix.nix
+      ../../modules/locale.nix
+      ../../modules/server-cli.nix
+      ../../modules/sshd.nix
+      ../../modules/docker.nix
+      ../../modules/hawser.nix
+      ../../modules/netbird-client.nix
+      ../../modules/auto-upgrade.nix
+      "${inputs.secrets}/modules/opkssh.nix"
+      # Include the results of the hardware scan.
+      ./hardware-configuration.nix
+    ];
+
+  services.netbird-client = {
+    enable = true;
+    managementUrl = "https://netbird.jfreudenberger.de";
+    host.setupKey = "86D1861F-193B-44F5-9B03-1E34C126FA6F";
+    docker.setupKey = "A9715FB6-8BF2-4274-BE02-43740A3BD4D9";
+  };
+
+  services.hawser = {
+    enable = true;
+    dockhandServerUrl = "wss://dockhand-connect.jfreudenberger.de/api/hawser/connect";
+    tokenSecretFile = config.age.secrets.hawser-token;
+  };
+
+  networking.firewall = {
+    checkReversePath = "loose";
+    allowedTCPPorts = [
+      # Ports for Unifi Server
+      11443
+      5005
+      9543
+      6789
+      8080
+      8443
+      8444
+      11084
+      5671
+      8880
+      8881
+      8882
+
+      # Home assistant
+      8123
+    ];
+    allowedUDPPorts = [
+      # Unifi Server
+      3478
+      5514
+      10003
+    ];
+  };
+
+
+  boot.kernel.sysctl = {
+    "net.ipv4.conf.all.forwarding" = true;
+    "net.ipv6.conf.all.forwarding" = true;
+  };
+
+  boot = {
+    tmp.cleanOnBoot = true;
+    tmp.useTmpfs = true;
+    growPartition = true;
+    initrd.systemd.enable = true;
+    loader = {
+      efi.canTouchEfiVariables = true;
+      grub.enable = false;
+      systemd-boot.enable = false;
+    };
+    lanzaboote = {
+      enable = true;
+      pkiBundle = "/var/lib/sbctl";
+      extraEfiSysMountPoints = [
+        "/boot-fallback"
+      ];
+    };
+  };
+
+  networking.hostName = "xcy"; # Define your hostname.
+
+  # This option defines the first version of NixOS you have installed on this particular machine,
+  # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
+  # Most users should NEVER change this value after the initial install, for any reason,
+  # even if you've upgraded your system to a new NixOS release.
+  # This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
+  # so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how
+  # to actually do that.
+  # This value being lower than the current NixOS release does NOT mean your system is
+  # out of date, out of support, or vulnerable.
+  # Do NOT change this value unless you have manually inspected all the changes it would make to your configuration,
+  # and migrated your data accordingly.
+  # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion .
+  system.stateVersion = "25.05"; # Did you read the comment?
+}

hosts/xcy/disko.nix

@@ -0,0 +1,103 @@
+{
+  disko.devices = {
+    disk = {
+      disk1 = {
+        type = "disk";
+        device = "/dev/disk/by-id/ata-Samsung_SSD_850_PRO_256GB_S251NX0H809669K";
+        content = {
+          type = "gpt";
+          partitions = {
+            MBR = {
+              type = "EF02"; # for grub MBR
+              size = "1M";
+              priority = 1; # Needs to be first partition
+            };
+            ESP = {
+              priority = 1;
+              name = "ESP";
+              size = "2G";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [ "umask=0077" ];
+              };
+            };
+            crypt_p1 = {
+              size = "100%";
+              content = {
+                type = "luks";
+                name = "p1";
+                settings = {
+                  allowDiscards = true;
+                };
+              };
+            };
+          };
+        };
+      };
+      disk2 = {
+        type = "disk";
+        device = "/dev/disk/by-id/nvme-eui.1843558044350001001b448b4495a259";
+        content = {
+          type = "gpt";
+          partitions = {
+            MBR = {
+              type = "EF02"; # for grub MBR
+              size = "1M";
+              priority = 1; # Needs to be first partition
+            };
+            ESP = {
+              priority = 1;
+              name = "ESP";
+              size = "2G";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot-fallback";
+                mountOptions = [ "umask=0077" ];
+              };
+            };
+            crypt_p2 = {
+              size = "100%";
+              content = {
+                type = "luks";
+                name = "p2";
+                settings = {
+                  allowDiscards = true;
+                };
+                content = {
+                  type = "btrfs";
+                  extraArgs = [
+                    "-d raid1"
+                    "-m raid1"
+                    "/dev/mapper/p1"
+                  ];
+                  subvolumes = {
+                    "/rootfs" = {
+                      mountpoint = "/";
+                    };
+                    "/home" = {
+                      mountOptions = [ "compress=zstd" ];
+                      mountpoint = "/home";
+                    };
+                    "/nix" = {
+                      mountOptions = [ "compress=zstd" "noatime" ];
+                      mountpoint = "/nix";
+                    };
+                    "/swap" = {
+                      mountpoint = "/.swapvol";
+                      swap.swapfile.size = "32G";
+                    };
+                  };
+                };
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+}

hosts/xcy/hardware-configuration.nix

@@ -0,0 +1,25 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usb_storage" "usbhid" "sd_mod" "sr_mod" ];
+  boot.initrd.kernelModules = [ "dm-snapshot" ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp1s0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/xcy/secrets.nix

@@ -0,0 +1,6 @@
+{ inputs, ... }:
+{
+  age.secrets = {
+    hawser-token.file = "${inputs.secrets}/secrets/xcy/hawser-token";
+  };
+}

modules/hawser.nix

@@ -0,0 +1,48 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  cfg = config.services.hawser;
+in {
+  options.services.hawser = {
+    enable = lib.mkEnableOption "hawser, the agent for Dockhand";
+    agentName = lib.mkOption {
+      description = "Name of the hawser agent";
+      default = config.networking.hostName;
+      type = lib.types.str;
+    };
+    dockhandServerUrl = lib.mkOption {
+      description = "Websocket endpoint the hawser agent can use to connect to dockhand.";
+      example = "wss://your-dockhand.example.com/api/hawser/connect";
+      type = lib.types.str;
+    };
+    tokenSecretFile = lib.mkOption {
+      description = "Agenix secret containing the token as environment variable TOKEN";
+      type = lib.types.anything;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    virtualisation.oci-containers.containers = {
+      hawser = {
+        image = "ghcr.io/finsys/hawser:0.2.42";
+        volumes = [
+          "/var/run/docker.sock:/var/run/docker.sock"
+        ];
+        environment = {
+          STACKS_DIR = "/opt/hawser-stacks";
+          DOCKHAND_SERVER_URL = cfg.dockhandServerUrl;
+          AGENT_NAME = cfg.agentName;
+        };
+        environmentFiles = [
+          cfg.tokenSecretFile.path
+        ];
+        extraOptions = [
+          ''--mount=type=volume,source=hawser-data,target=/opt/hawser-stacks,volume-driver=local''
+        ];
+      };
+    };
+  };
+}

modules/netbird-client.nix

@@ -10,7 +10,7 @@ let
 
   cfg = config.services.netbird-client;
 
-  clientVersion = "0.69.0";
+  clientVersion = "0.71.2";
 
   clientConfiguration = lib.types.submodule {
     options = {
@@ -37,6 +37,11 @@ in {
       description = "Configuration for docker connection";
       type = clientConfiguration;
     };
+    dockerSubnet = lib.mkOption {
+      description = "Second part of ipv4 subnet";
+      type = lib.types.str;
+      default = "20";
+    };
   };
 
   config = lib.mkIf cfg.enable {
@@ -57,6 +62,8 @@ in {
     };
     systemd.services.${config.services.netbird.clients.wt0.service.name}.path = [ pkgs.shadow ];
 
+    services.resolved.enable = true;
+
     virtualisation.oci-containers.containers = {
       netbird = {
         image = "netbirdio/netbird:${clientVersion}-rootless";
@@ -92,7 +99,7 @@ in {
         Type = "oneshot";
       };
       script = ''
-        docker network inspect webproxy || docker network create webproxy --ipv4 --ipv6 --subnet=172.20.0.0/16 --gateway=172.20.0.1
+        docker network inspect webproxy || docker network create webproxy --ipv4 --ipv6 --subnet=172.${cfg.dockerSubnet}.0.0/16 --gateway=172.${cfg.dockerSubnet}.0.1
       '';
     };
   };

modules/netbird-docker.nix

@@ -10,8 +10,8 @@ let
   cfg = config.services.netbird-docker;
   netbirdCfg = config.services.netbird;
 
-  serverVersion = "0.69.0";
-  dashboardVersion = "2.37.1";
+  serverVersion = "0.70.5";
+  dashboardVersion = "2.38.0";
 
 in {
 
@@ -34,6 +34,14 @@ in {
               '';
             type = lib.types.anything;
           };
+          extraPorts = lib.mkOption {
+            description = ''
+              Extra ports to open for L4 routing.
+              Ports described in the config (https://docs.netbird.io/selfhosted/migration/enable-reverse-proxy#exposing-l4-ports) can be specified here.
+            '';
+            type = lib.types.listOf lib.types.str;
+            default = [ ];
+          };
         };
       };
     };
@@ -49,6 +57,7 @@ in {
   };
 
   config = lib.mkIf cfg.enable {
+    services.netbird.useRoutingFeatures = lib.mkDefault "server";
     virtualisation.oci-containers.containers = {
       netbird-dashboard = {
         image = "netbirdio/dashboard:v${dashboardVersion}";
@@ -167,7 +176,7 @@ in {
         autoStart = true;
         ports = [
           "51820:51820/udp"
-        ];
+        ] ++ cfg.proxy.extraPorts;
         networks = [
           "traefik"
         ];