refactor(wolumonde): reorganize some modules into folders, add headscale acl [skip ci]

hosts/wolumonde/modules/forgejo.nix hosts/wolumonde/modules/forgejo.nix/default.nix

···
       makeCopyCommand = dir: ''
         mkdir -p ${customDir}
         rm -rf ${getCustomDir dir}
-        cp -r --no-preserve=mode,ownership ${./forgejo/${dir}} ${getCustomDir dir}
+        cp -r --no-preserve=mode,ownership ${./${dir}} ${getCustomDir dir}
       '';
     in
     lib.concatMapStrings makeCopyCommand [

hosts/wolumonde/modules/headscale.nix hosts/wolumonde/modules/headscale.nix/default.nix

···
   domain = "vpn.${rootDomain}";
 in {
   age.secrets.headscaleOidcSecret = {
-    file = ../../../secrets/headscaleOidcSecret.age;
+    file = ../../../../secrets/headscaleOidcSecret.age;
     mode = "600";
     owner = config.services.headscale.user;
     group = config.services.headscale.group;
···
     port = 1111;
     settings = {
       server_url = "https://${domain}";
-      policy.mode = "database";
+      policy = {
+        mode = "file";
+        file = ./acl.hujson;
+      };
       dns = {
         base_domain = "lan.${rootDomain}";
         nameservers.global = ["1.1.1.1" "1.0.0.1" "9.9.9.9" "149.112.112.112"];

hosts/wolumonde/modules/headscale.nix/acl.hujson

···
+{
+    // Headscale ACL Configuration
+    // Defines groups, tags, and access control rules
+
+    // Groups define collections of users
+    "groups": {
+        "group:admin": ["90008@"],
+    },
+
+    // Tags are used to label devices/nodes for access control
+    "tagOwners": {
+        "tag:private-infra": ["group:admin"],
+        "tag:other-infra": ["group:admin"],
+    },
+
+    // Access Control Lists - define what can access what
+    "acls": [
+        // Admin group (user 90008) can access their own devices
+        {
+            "action": "accept",
+            "src": ["group:admin"],
+            "dst": ["group:admin:*"],
+        },
+
+        // Private infrastructure can access other infrastructure
+        {
+            "action": "accept",
+            "src": ["tag:private-infra"],
+            "dst": ["tag:other-infra:*"],
+        },
+
+        // Private infrastructure can access itself
+        {
+            "action": "accept",
+            "src": ["tag:private-infra"],
+            "dst": ["tag:private-infra:*"],
+        },
+
+        // Other infrastructure can access itself
+        {
+            "action": "accept",
+            "src": ["tag:other-infra"],
+            "dst": ["tag:other-infra:*"],
+        },
+
+        // Admin group can access both infrastructure tags
+        {
+            "action": "accept",
+            "src": ["group:admin"],
+            "dst": ["tag:private-infra:*", "tag:other-infra:*"],
+        },
+    ],
+}

hosts/wolumonde/modules/perses.nix hosts/wolumonde/modules/perses.nix/default.nix

···
   };
 
   age.secrets.persesSecret = {
-    file = ../../../secrets/persesSecret.age;
+    file = ../../../../secrets/persesSecret.age;
     owner = user;
     group = user;
   };
   age.secrets.persesAdminUser = {
-    file = ../../../secrets/persesAdminUser.age;
+    file = ../../../../secrets/persesAdminUser.age;
     owner = user;
     group = user;
   };
···
     ''
       rm -rf ${provisioningFolder} && mkdir -p ${provisioningFolder}
       cp -f ${secrets.persesAdminUser.path} ${provisioningFolder}/1-admin-user.json
-      cp -f ${./perses/provision}/* ${provisioningFolder}
+      cp -f ${./provision}/* ${provisioningFolder}
     '';
 
   virtualisation.oci-containers.containers.perses = {

hosts/wolumonde/modules/tailscale.nix

···
     enable = true;
     port = 41641;
     extraSetFlags = [ "--advertise-exit-node" ];
+    extraUpFlags = [ "--ssh" ];
     extraDaemonFlags = [ "--no-logs-no-support" ];
     useRoutingFeatures = "both";
     authKeyFile = config.age.secrets.tailscaleAuthKey.path;

hosts/wolumonde/modules/webhook.nix hosts/wolumonde/modules/webhook.nix/default.nix

···
 { config, tlib, ... }:
 {
-  imports = tlib.importFolder ./webhooks;
+  imports = tlib.importFolder ./.;
 
   services.webhook = {
     enable = true;
···
   };
 
   age.secrets.webhookAuth = {
-    file = ../../../secrets/webhookAuth.age;
+    file = ../../../../secrets/webhookAuth.age;
     mode = "600";
     owner = "nginx";
     group = "nginx";

lib/default.nix

···
       files = b.readDir modules;
       fileNames = b.attrNames files;
       filesToImport = b.map (name: "${modules}/${name}") (
-        b.filter (name: b.match ".*\.nix" name != null) fileNames
+        b.filter (name: (b.match ".*\.nix" name != null) && (name != "default.nix")) fileNames
       );
     in
     filesToImport;

secrets/tailscaleAuthKey.age

···
 age-encryption.org/v1
 -> ssh-rsa Abmvag
-NKeTQ1taN613x+apPY0ZIeL5kisXNZ/BQkFaOUeGz1J6esoiTtHQb2c426iH/1Xr
-doQnrpveP1g3xAhmcwPSrTFM1ZGmaTXw7OmWJJruPoaUgvJ+mzeYpHlCFcP/jZLZ
-/DSZklljD1kaefNsZVFrL44P/N9us65RclC9LtWsBy9uHKDR9vpAg+a/BchY1pfd
-laukKd3V+aZGBucBvXlzYz1vhmV8gAmiTzV8az/QEnXTUSY+9IF3rMFT0ZpppJAA
-KJ4Rk+iDK/0lIkHUrOdoZneeENt55nvc22eBKAzyF1GrifuBt5/yk9kPS7sv1svV
-ruNAnJyvBIT7Vnwasv9ZTy7+U/VeFjWaTiSs1DewBPOiLpHw9mmxbmF28oIP6dLz
-oRo1ZoZHyjF0+kgsMco6d9VgOCqIRLj3ObXvvda8iJQThMZsPjEKmvHt64usxwjT
-cVaE240zswtjnHfdtC7nxDG2aUHr5oeH6QXH7sAwKwx31zoJX9J7N0nc/ctD40nQ
-z0oevXgzN0MD5L/X2cjwJ0L2qajJjyJBrAlb5XiaOK38MTwf32cQZnaIej8cDzfE
-ReXXOmFiXq/Dl8nEKoHDQI3p+4ZOLztXu/5i/TL1HuvF5Riod5hA1oW2ubwHeHxR
-ApZ7ry5dtbBUxnuTI5zRLQY78BnrqsuJ9ghp2fDzSsc
--> ssh-ed25519 KjIL7g SFusm9HUDdCCjjjKwOji+X66SpI2TzEf7p7AthPAWQU
-11ovCJnXkMlOz/6570chlP62LkBoKx64EkFkcTXKELg
---- mufkRbwTo+mBT3hXsyh5Mv7O30CtTtqXtR6EaJ2tZY8
-BS>���;Q6/<���KGM��m!����*��,Ƥ����KlM"s[Z��>�Nv
-WQ�kD��$Q> za)2*'�Y_���<
+cdEH6fTtZbBDJzNHCRdD6/xjHl/CG//VQqF5qIdJ+CVBTYZ8cyaY13fkJG7hKPAR
+WaMcRKyPwgAA1Dbhc3/K2VwGAZBSibIHhkj+iBOfu46WIRjEGPcz9HrMVMI6MmRf
+cCOw4VdTWYrUbcOclC9mGy/dimw+hHaTFIuepuDulVsSjC56kYDrhBSg+nmBBY1n
+7nHiHOznHhjXfao65AuB++1kxqf7RifEq6bDcfgkvaXhUDJrc2kDY78o9qctvfFR
+6sX77+vt8xxRgTZvWkix14WQRfOvWfXsroFfoSnno0A3KYlkko0JKxwkd/G56efi
+BA41j5OES3K+NxwdNvHlA73uXs/jumgtI76JXg7KHh2zWDbG6qtA290piKb6hSG8
+VnWoFJ37SKFNZTOuMjgpwurzzyCscRf4RHGy3/anUd/1yAK8RS35nlOS3QDKECyu
+Q6FIwcBItvZkzBmoFJKj6seUENZ46Wb6h1AOhaTCljkQyGTqti16Es0CGcyw+iTe
+OFWj7C6JXIlr/D8PTFK0pR9bVWc+NcJ0EF12kCC7jeqkBZ1BCa/SI3y3RxEGxVBQ
+qnJpeci/jEi6vUczx669+JU/WT015Ad73CwrILpY6GdvM5B5dLhKoiRTcrmZErLW
+N3qR1s0e+GDMOD6j6KQ9p5ob4/Iwb4KyFT1ua3pvVeo
+-> ssh-ed25519 KjIL7g BiO1JiyYp3Ekc5pPeMi8tMNcY+jaUcuDMrLl1r31FTk
+6ynf4SG+Bg+vaTwiNssmwXUM7L8hIrkhK4OEPBCiyaY
+--- Didicg7j8DbrYwg+DCCiLrfp92LLa4nim3oPnRESZSw
+ւ���22�6Y[�"�u<s{�
?��ʲ.�� 5�t0!ul5�Q�y�.dܰEz�
�%7&��CA��Ko�^ YvD�P�