wip: add vogon + many other things

Added lots of things done in a hurry following the dodecagon failure.

Signed-off-by: Jeltz <jeltz@federez.net>

hive.nix

@@ -11,14 +11,14 @@ in
     nixpkgs = src.nixpkgs;
   };
 
+  # FIXME
+  nixpkgs.config.permittedInsecurePackage = [ "olm-3.2.16" ];
+
   defaults = { pkgs, lib, ... }: {
     imports = [
       ./profiles/sysadmin.nix
-      ./profiles/glucagon.nix
-      ./profiles/child-netdata.nix
-      ./profiles/ldap.nix
+      #./profiles/ldap.nix
       "${src.agenix}/modules/age.nix"
-      (disko.config diskConfig)
     ];
 
     security.acme.defaults.email = "monitoring@federez.net";
@@ -27,9 +27,7 @@ in
     systemd.network.enable = true;
     networking.useDHCP = false;
     services.openssh.enable = true;
-
-    # By default, everyone is a child except klington itself.
-    federez.monitoring.enableChild = lib.mkDefault true;
+    networking.nftables.enable = true;
 
     # Enable system diffs.
     system.activationScripts.system-diff = {
@@ -44,84 +42,107 @@ in
     # Mot de passe classique qu'on trouvera dans le "trousseau" legacy.
     users.users.root.initialHashedPassword = "$y$j9T$RoSZj8ezgR7cI8Le6xqwW/$0BI6G1Nqy/G0g0sNhQhyEedqoHsEyMFVjQgc3TPqE.4";
     system.stateVersion = "24.05";
-    system.build.diskoScript = disko.diskoScript diskConfig pkgs;
     time.timeZone = "Europe/Paris";
   };
 
-  estragon = { name, nodes, ... }: {
+  vogon = { name, nodes, ... }: {
+    deployment.tags = [ "hypervisor" ];
+    deployment.targetHost = "vogon.federez.net";
+    networking.hostName = name;
+    networking.hostId = "1751e2a7";
+
+    imports = [
+      ./profiles/vogon.nix
+      ./profiles/incus.nix
+    ];
+  };
+
+  estragon = { name, nodes, pkgs, ... }: {
     deployment.tags = [ "matrix" ];
     deployment.targetHost = "estragon.federez.net";
     networking.hostName = name;
-    federez.monitoring.apiKey = "3411043d-55b5-425e-af43-0932d6147148";
+
+    environment.systemPackages = [ pkgs.tcpdump pkgs.openssl ];
 
     glucagon.networking = {
       nibble = 227;
       wan-mac = "BC:24:11:5C:A4:5A";
     };
 
+    infra-net.leaf = {
+      mac = "BC:24:11:AC:7B:59";
+      id = 12;
+    };
+
     imports = [
+      (disko.config diskConfig)
       ./profiles/vm.nix
+      ./profiles/glucagon.nix
+      ./profiles/infra-net.nix
       ./profiles/matrix-server.nix
       ./profiles/element.nix
       ./profiles/telegram-bot.nix
       ./profiles/irc-bot.nix
     ];
+
+    system.build.diskoScript = disko.diskoScript diskConfig pkgs;
   };
 
   wagon = { name, nodes, ... }: {
     deployment.tags = [ "vaultwarden" "pass" "passwords" ];
     deployment.targetHost = "wagon.federez.net";
     networking.hostName = name;
-    federez.monitoring.apiKey = "a8bd7953-dfca-4393-b770-98c5ab11dea5";
 
     glucagon.networking = {
       nibble = 228;
       wan-mac = "BC:24:11:EA:6C:0B";
     };
 
+    infra-net.leaf = {
+      mac = "BC:24:11:5A:0F:44";
+      id = 8;
+    };
+
     imports = [
+      (disko.config diskConfig)
       ./profiles/vm.nix
+      ./profiles/glucagon.nix
+      ./profiles/infra-net.nix
       ./profiles/vaultwarden.nix
     ];
+
+    system.build.diskoScript = disko.diskoScript diskConfig pkgs;
   };
 
   lagon = { name, nodes, ... }: {
     deployment.tags = [ "keycloak" "wayf" ];
     deployment.targetHost = "lagon.federez.net";
     networking.hostName = name;
-    federez.monitoring.apiKey = "f85dcb12-970c-4ea1-99b4-01e2fc26bc6c";
 
     glucagon.networking = {
       nibble = 229;
       wan-mac = "BC:24:11:7F:19:60";
     };
 
-    imports = [
-      ./profiles/vm.nix
-      ./profiles/wayf.nix
-    ];
-  };
-
-  klingon = { name, nodes, ... }: {
-    deployment.tags = [ "monitoring" ];
-    deployment.targetHost = "klingon.federez.net";
-    networking.hostName = name;
-
-    glucagon.networking = {
-      nibble = 230;
-      wan-mac = "BC:24:11:B7:AE:80";
+    infra-net.leaf = {
+      mac = "BC:24:11:91:61:8E";
+      id = 9;
     };
 
     imports = [
+      (disko.config diskConfig)
       ./profiles/vm.nix
-      ./profiles/netdata.nix
+      ./profiles/glucagon.nix
+      ./profiles/infra-net.nix
+      ./profiles/wayf.nix
     ];
+
+    system.build.diskoScript = disko.diskoScript diskConfig pkgs;
   };
 
   aragon = { name, nodes, ... }: {
     deployment.tags = [ "gitlab" ];
     deployment.targetHost = "aragon.federez.net";
-    federez.monitoring.apiKey = "370a181d-6b00-4c3d-af27-ca65e6e4c1b0";
     networking.hostName = name;
 
     glucagon.networking = {
@@ -129,16 +150,26 @@ in
       wan-mac = "BC:24:11:E3:12:4A";
     };
 
+    infra-net.leaf = {
+      mac = "BC:24:11:E4:C7:69";
+      id = 10;
+    };
+
     imports = [
+      (disko.config diskConfig)
       ./profiles/vm.nix
+      ./profiles/glucagon.nix
+      ./profiles/infra-net.nix
       ./profiles/gitlab.nix
     ];
+
+    system.build.diskoScript = disko.diskoScript diskConfig pkgs;
   };
 
+  # FIXME can't update: discourse pkg is broken
   pendragon = { name, nodes, ... }: {
     deployment.tags = [ "discourse" ];
     deployment.targetHost = "pendragon.federez.net";
-    federez.monitoring.apiKey = "370a181d-6b00-4c3d-af27-ca65e6e4c1b0";
     networking.hostName = name;
 
     glucagon.networking = {
@@ -146,10 +177,20 @@ in
       wan-mac = "BC:24:11:C2:AA:47";
     };
 
+    infra-net.leaf = {
+      mac = "BC:24:11:31:B8:DD";
+      id = 11;
+    };
+
     imports = [
+      (disko.config diskConfig)
       ./profiles/vm.nix
+      ./profiles/glucagon.nix
+      ./profiles/infra-net.nix
       ./profiles/discourse.nix
     ];
+
+    system.build.diskoScript = disko.diskoScript diskConfig pkgs;
   };
 
   perdrigon = { name, nodes, ... }: {