feat(shoukei): pin home Wi-Fi to a static IPv4 & adjust networking.nix (#407)

vars/networking.nix

@@ -36,39 +36,19 @@ rec {
     };
   };
 
+  # Static LAN addresses, sorted by IPv4 ascending -- keep it sorted when adding
+  # a host so the next free address is obvious. `homeOnly = true` marks an
+  # address that only exists at home (the laptop's home Wi-Fi static); ssh and
+  # monitoring skip those entries.
   hostsAddr = {
-    # ============================================
-    # Homelab's Physical Machines (VM hosts)
-    # ============================================
-    shoryu = {
-      iface = "eno1";
-      ipv4 = "192.168.5.181";
-    };
-    shushou = {
-      iface = "eno1";
-      ipv4 = "192.168.5.182";
-    };
-    youko = {
-      iface = "eno1";
-      ipv4 = "192.168.5.183";
-    };
-
-    # ============================================
-    # Other VMs and Physical Machines
-    # ============================================
     ai = {
       # Desktop PC
       iface = "enp130s0";
       ipv4 = "192.168.5.100";
       ipv6 = "fe80::10"; # Link-local Address
     };
-    # akane = {
-    #   # VM (running in macOS's UTM App), using DHCP instead of static ip.
-    #   iface = "enp0s1";
-    #   ipv4 = "192.168.64.2";
-    # };
     aquamarine = {
-      # VM
+      # VM (retired)
       iface = "enp2s0";
       ipv4 = "192.168.5.101";
     };
@@ -102,40 +82,12 @@ rec {
       iface = "end1";
       ipv4 = "192.168.5.107";
     };
-    rakushun = {
-      # Orange Pi 5 - ARM
-      # RJ45 port 1 - enP4p65s0
-      # RJ45 port 2 - enP3p49s0
-      iface = "enP4p65s0";
-      ipv4 = "192.168.5.179";
-    };
-    suzi = {
-      iface = "enp2s0"; # fake iface, it's not used by the host
-      ipv4 = "192.168.5.178";
-      ipv6 = "fe80::8"; # Link-local Address, can be used as default gateway
-    };
-    mitsuha = {
-      iface = "enp2s0"; # fake iface, it's not used by the host
-      ipv4 = "192.168.5.177";
-    };
-
-    # ============================================
-    # Kubernetes Clusters
-    # ============================================
-    k3s-test-1-master-1 = {
-      # VM
-      iface = "enp2s0";
-      ipv4 = "192.168.5.114";
-    };
-    k3s-test-1-master-2 = {
-      # VM
-      iface = "enp2s0";
-      ipv4 = "192.168.5.115";
-    };
-    k3s-test-1-master-3 = {
-      # VM
-      iface = "enp2s0";
-      ipv4 = "192.168.5.116";
+    shoukei = {
+      # Laptop: pinned on the home Wi-Fi only, by `just shoukei-home-wifi`; off
+      # the home network it uses DHCP.
+      iface = "wld0";
+      ipv4 = "192.168.5.108";
+      homeOnly = true;
     };
     k3s-test-1-worker-1 = {
       # VM
@@ -152,6 +104,57 @@ rec {
       iface = "enp2s0";
       ipv4 = "192.168.5.113";
     };
+    k3s-test-1-master-1 = {
+      # VM
+      iface = "enp2s0";
+      ipv4 = "192.168.5.114";
+    };
+    k3s-test-1-master-2 = {
+      # VM
+      iface = "enp2s0";
+      ipv4 = "192.168.5.115";
+    };
+    k3s-test-1-master-3 = {
+      # VM
+      iface = "enp2s0";
+      ipv4 = "192.168.5.116";
+    };
+    mitsuha = {
+      iface = "enp2s0"; # fake iface, it's not used by the host
+      ipv4 = "192.168.5.177";
+    };
+    suzi = {
+      iface = "enp2s0"; # fake iface, it's not used by the host
+      ipv4 = "192.168.5.178";
+      ipv6 = "fe80::8"; # Link-local Address, can be used as default gateway
+    };
+    rakushun = {
+      # Orange Pi 5 - ARM, now running Armbian (not NixOS)
+      # RJ45 port 1 - enP4p65s0
+      # RJ45 port 2 - enP3p49s0
+      iface = "enP4p65s0";
+      ipv4 = "192.168.5.179";
+    };
+    shoryu = {
+      # Homelab's physical machine (VM host)
+      iface = "eno1";
+      ipv4 = "192.168.5.181";
+    };
+    shushou = {
+      # Homelab's physical machine (VM host)
+      iface = "eno1";
+      ipv4 = "192.168.5.182";
+    };
+    youko = {
+      # Homelab's physical machine (VM host)
+      iface = "eno1";
+      ipv4 = "192.168.5.183";
+    };
+    # akane = {
+    #   # VM (running in macOS's UTM App), using DHCP instead of static ip.
+    #   iface = "enp0s1";
+    #   ipv4 = "192.168.64.2";
+    # };
   };
 
   ssh = {
@@ -164,15 +167,20 @@ rec {
     #   IdentityFile — the location of your SSH key authentication file for the account.
     # Format in details:
     #   https://www.ssh.com/academy/ssh/config
+    # `homeOnly` entries get no alias: their address is not reachable off the
+    # home LAN, so an alias would break e.g. `ssh shoukei` over Tailscale.
     extraConfig = (
       lib.attrsets.foldlAttrs (
         acc: host: val:
-        acc
-        + ''
-          Host ${host}
-            HostName ${val.ipv4}
-            Port 22
-        ''
+        if val.homeOnly or false then
+          acc
+        else
+          acc
+          + ''
+            Host ${host}
+              HostName ${val.ipv4}
+              Port 22
+          ''
       ) "" hostsAddr
     );