some work

flake.nix

@@ -22,7 +22,13 @@
 
     lanzaboote = {
       url = "github:nix-community/lanzaboote/v0.4.1";
-      inputs.nixpkgs.follows = "nixpkgs-stable";
+      inputs.nixpkgs.follows = "nixpkgs-unstable";
+    };
+
+    authentik-nix = {
+      url = "github:nix-community/authentik-nix";
+      inputs.nixpkgs.follows = "nixpkgs-unstable";
+      # inputs.flake-parts.follows
     };
 
     tmux-yank = {
@@ -34,6 +40,7 @@
   outputs =
     inputs@{
       self,
+      authentik-nix,
       flake-utils,
       lanzaboote,
       microvm,
@@ -90,6 +97,7 @@
           specialArgs = { inherit inputs; };
           modules = [
             sops-nix.nixosModules.sops
+            microvm.nixosModules.host
 
             ./hosts/minime
             ./modules/basic-tools
@@ -98,7 +106,20 @@
             ./modules/wg
           ];
         };
+
+        authentik = nixpkgs-stable.lib.nixosSystem {
+          system = "x84_64-linux";
+          specialArgs = { inherit inputs; };
+          modules = [
+            sops-nix.nixosModules.sops
+            microvm.nixosModules.microvm
+            authentik-nix.nixosModules.default
+
+            ./microvms/authentik
+            ./modules/server
       };
+
+
       hydraJobs =
         let
           get-toplevel = (

hosts/minime/default.nix

@@ -3,7 +3,7 @@
   imports = [
     ./configuration.nix
     ./hardware-configuration.nix
-    ./networking.nix
+    ./networking
     ./secrets.nix
     ./zfs.nix
   ];

hosts/minime/networking/default.nix

@@ -0,0 +1,24 @@
+{ ... }: {
+  imports = [
+    ./uplink.nix
+    ./uvm.nix
+  ];
+
+  networking.hostName = "minime"; # Define your hostname.
+  networking.useNetworkd = true;
+  networking.firewall.enable = true;
+
+  services.resolved = {
+    enable = true;
+    dnssec = "false";
+    fallbackDns = [
+      "9.9.9.9"
+      "2620:fe::fe"
+      "149.112.112.112"
+      "2620:fe::9"
+    ];
+  };
+
+  systemd.network.enable = true;
+
+}

hosts/minime/networking/uvm.nix

@@ -0,0 +1,19 @@
+{ ... }: {
+  systemd.network = {
+    netdevs."10-uvm-br" = {
+      netdevConfig = {
+        Kind = bridge;
+        Name = "uvm-br";
+      };
+    };
+
+    networks."10-uvm-br" = {
+      matchConfig.Name = "uvm-br";
+      networkConfig = {
+        DHCPServer = false;
+        IPv6SendRA = true;
+      };
+      Address = [ ];
+    };
+  };
+}

modules/wg/module.nix

@@ -1,8 +1,6 @@
 {
   lib,
   config,
-  self,
-  registry,
   ...
 }:
 {

modules/wg/proxy.nix

@@ -23,6 +23,14 @@
             publicIface = "enp1s0";
           };
         };
+        "authentik" = {
+          address = [
+            "10.89.88.2/24"
+            "fd31:185d:722f::2/48"
+          ];
+          publicKey = "";
+          privateKeyFile = config.sops.secrets."wg/0xa-proxy".path;
+        };
       };
     }
   ];