From f901a0f775f42b3427728949eac894a458d2cc61 Mon Sep 17 00:00:00 2001
From: dadada <dadada@dadada.li>
Date: Sun, 10 Apr 2022 16:07:17 +0200
Subject: [PATCH 01/10] Update backup config

---
 nixos/ifrit/configuration.nix | 68 ++++++++++++++---------------------
 nixos/modules/backup.nix      |  8 +----
 2 files changed, 28 insertions(+), 48 deletions(-)

diff --git a/nixos/ifrit/configuration.nix b/nixos/ifrit/configuration.nix
index e94310f..20cac31 100644
--- a/nixos/ifrit/configuration.nix
+++ b/nixos/ifrit/configuration.nix
@@ -4,8 +4,33 @@ let
     "ifrit.dadada.li"
     "bs.vpn.dadada.li"
     "media.dadada.li"
+    "backup.dadada.li"
   ];
   backups = "/mnt/storage/backup";
+  ddns = hostname: {
+    timers."ddns-${hostname}" = {
+      wantedBy = [ "timers.target" ];
+      partOf = [ "ddns-${hostname}.service" ];
+      timerConfig.OnCalendar = "hourly";
+    };
+    services."ddns-${hostname}" = {
+      serviceConfig.Type = "oneshot";
+      script = ''
+        function url() {
+        echo "https://svc.joker.com/nic/update?username=$1&password=$2&hostname=$3"
+        }
+
+        IFS=':'
+        read -r user password < /var/lib/ddns/credentials
+        unset IFS
+
+        curl_url=$(url "$user" "$password" ${hostname})
+
+        ${pkgs.curl}/bin/curl -4 "$curl_url"
+        ${pkgs.curl}/bin/curl -6 "$curl_url"
+      '';
+    };
+  };
 in
 {
   imports = [
@@ -49,6 +74,7 @@ in
     };
   };
 
+  users.users.borg.home = "/mnt/storage/backup";
   services.borgbackup.repos = {
     "metis" = {
       allowSubRepos = false;
@@ -109,11 +135,6 @@ in
     "::1" = hostAliases;
   };
 
-  networking.nameservers = [
-    "1.1.1.1"
-    "1.0.0.1"
-  ];
-
   # weird issues with crappy plastic router
   networking.interfaces."ens3".tempAddress = "disabled";
 
@@ -143,19 +164,6 @@ in
     allowPing = true;
     allowedTCPPorts = [
       22 # SSH
-      80
-      443 # HTTP(S)
-      111
-      2049 # NFS
-      139
-      445 # SMB
-    ];
-    allowedUDPPorts = [
-      137
-      138
-      111
-      2049 # NFS
-      51234 # Wireguard
     ];
   };
 
@@ -188,30 +196,8 @@ in
   };
 
   environment.systemPackages = [ pkgs.curl ];
-  systemd = {
-    timers.ddns-joker = {
-      wantedBy = [ "timers.target" ];
-      partOf = [ "ddns-joker.service" ];
-      timerConfig.OnCalendar = "hourly";
-    };
-    services.ddns-joker = {
-      serviceConfig.Type = "oneshot";
-      script = ''
-        function url() {
-        echo "https://svc.joker.com/nic/update?username=$1&password=$2&hostname=$3"
-        }
 
-        IFS=':'
-        read -r user password < /var/lib/ddns/credentials
-        unset IFS
-
-        curl_url=$(url "$user" "$password" bs.vpn.dadada.li)
-
-        ${pkgs.curl}/bin/curl -4 "$curl_url"
-        ${pkgs.curl}/bin/curl -6 "$curl_url"
-      '';
-    };
-  };
+  systemd = (ddns "bs.vpn.dadada.li") // (ddns "backup0.dadada.li");
 
   system.stateVersion = "20.03";
 }
diff --git a/nixos/modules/backup.nix b/nixos/modules/backup.nix
index 11c0908..eecddd8 100644
--- a/nixos/modules/backup.nix
+++ b/nixos/modules/backup.nix
@@ -60,16 +60,10 @@ in
       startAt = "monthly";
     };
 
-    networking.hosts = mkIf cfg.bs {
-      "fd42:dead:beef:0:5054:ff:fefb:7361" = [
-        "media.dadada.li"
-      ];
-    };
-
     services.borgbackup.jobs.bs = mkIf cfg.bs {
       paths = "/";
       exclude = backupExcludes;
-      repo = "borg@media.dadada.li:/mnt/storage/backup/${config.networking.hostName}";
+      repo = "borg@backup0.dadada.li:${config.networking.hostName}";
       doInit = false;
       environment = {
         BORG_RSH = "ssh -i /var/lib/borgbackup/bs/id_ed25519 -o 'StrictHostKeyChecking accept-new'";
-- 
2.49.0


From ec63b1c032c0953d117ad6ab579961d0a5226582 Mon Sep 17 00:00:00 2001
From: dadada <dadada@dadada.li>
Date: Sun, 10 Apr 2022 16:10:04 +0200
Subject: [PATCH 02/10] Update vpn config

---
 nixos/modules/networking.nix | 20 +++-----------------
 1 file changed, 3 insertions(+), 17 deletions(-)

diff --git a/nixos/modules/networking.nix b/nixos/modules/networking.nix
index 5520bd7..e1ffb9f 100644
--- a/nixos/modules/networking.nix
+++ b/nixos/modules/networking.nix
@@ -114,7 +114,7 @@ in
     }));
 
     networking.wireguard.interfaces = mkIf (cfg.vpnExtension != null) {
-      bs = {
+      dadada = {
         ips = [ "fd42:9c3b:f96d:200::${cfg.vpnExtension}/64" ];
         listenPort = 51234;
 
@@ -124,7 +124,7 @@ in
           {
             publicKey = "lFB2DWtzp55ajV0Fk/OWdO9JlGvN9QsayYKQQHV3GEs=";
             allowedIPs = [ "fd42:9c3b:f96d::/48" ];
-            endpoint = "bs.vpn.dadada.li:51234";
+            endpoint = "vpn.dadada.li:51234";
             persistentKeepalive = 25;
           }
         ];
@@ -140,22 +140,8 @@ in
     systemd.services.wg-reresolve-dns = mkIf (cfg.vpnExtension != null) {
       serviceConfig.Type = "oneshot";
       script = ''
-        ${pkgs.wireguard-tools}/bin/wg set bs peer lFB2DWtzp55ajV0Fk/OWdO9JlGvN9QsayYKQQHV3GEs= endpoint bs.vpn.dadada.li:51234 persistent-keepalive 25 allowed-ips fd42:9c3b:f96d::/48
+        ${pkgs.wireguard-tools}/bin/wg set dadada peer lFB2DWtzp55ajV0Fk/OWdO9JlGvN9QsayYKQQHV3GEs= endpoint vpn.dadada.li:51234 persistent-keepalive 25 allowed-ips fd42:9c3b:f96d::/48
       '';
     };
-
-    fileSystems."/mnt/media.dadada.li" = mkIf cfg.enableBsShare {
-      device = "media.dadada.li:/mnt/storage/share";
-      fsType = "nfs";
-      options = [ "x-systemd.automount" "noauto" "x-systemd.idle-timeout=600" ];
-    };
-
-    networking.firewall = {
-      enable = true;
-      allowedUDPPorts = [
-        51234 # Wireguard
-        5353 # mDNS
-      ];
-    };
   };
 }
-- 
2.49.0


From ee3816fc80c1fe1aa27adeb698a54c63a9fa35c2 Mon Sep 17 00:00:00 2001
From: dadada <dadada@dadada.li>
Date: Sun, 10 Apr 2022 16:27:35 +0200
Subject: [PATCH 03/10] update vlan config

---
 nixos/agares/configuration.nix | 4 ++++
 nixos/ifrit/configuration.nix  | 3 +++
 2 files changed, 7 insertions(+)

diff --git a/nixos/agares/configuration.nix b/nixos/agares/configuration.nix
index 0dcb87b..e051ce3 100644
--- a/nixos/agares/configuration.nix
+++ b/nixos/agares/configuration.nix
@@ -40,6 +40,10 @@
       id = 12;
       interface = "enp1s0";
     };
+    lan = {
+      id = 13;
+      interface = "enp1s0";
+    };
   };
   networking.interfaces.vpn.useDHCP = true;
 
diff --git a/nixos/ifrit/configuration.nix b/nixos/ifrit/configuration.nix
index 20cac31..a60d5c2 100644
--- a/nixos/ifrit/configuration.nix
+++ b/nixos/ifrit/configuration.nix
@@ -165,6 +165,9 @@ in
     allowedTCPPorts = [
       22 # SSH
     ];
+    allowedUDPPorts = [
+      51234
+    ];
   };
 
   security.acme = {
-- 
2.49.0


From 85c5e1a744818d2422e536a4fb0065057ce2d81b Mon Sep 17 00:00:00 2001
From: dadada <dadada@dadada.li>
Date: Sun, 10 Apr 2022 18:40:26 +0200
Subject: [PATCH 04/10] fix vlan config

---
 nixos/agares/configuration.nix | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/nixos/agares/configuration.nix b/nixos/agares/configuration.nix
index e051ce3..7f21586 100644
--- a/nixos/agares/configuration.nix
+++ b/nixos/agares/configuration.nix
@@ -31,21 +31,26 @@
     "vfio_virqfd"
   ];
 
-  networking.interfaces.enp2s0.useDHCP = false;
-  networking.interfaces.enp3s0.useDHCP = false;
-
-  networking.interfaces.enp1s0.useDHCP = true;
   networking.vlans = {
+    lan = {
+      id = 11;
+      interface = "enp1s0";
+    };
     vpn = {
       id = 12;
       interface = "enp1s0";
     };
-    lan = {
+    backup = {
       id = 13;
       interface = "enp1s0";
     };
   };
-  networking.interfaces.vpn.useDHCP = true;
+  networking.interfaces.enp1s0.useDHCP = true;
+  networking.interfaces.enp2s0.useDHCP = false;
+  networking.interfaces.enp3s0.useDHCP = false;
+  networking.interfaces.lan.useDHCP = false;
+  networking.interfaces.vpn.useDHCP = false;
+  networking.interfaces.backup.useDHCP = false;
 
   i18n.defaultLocale = "en_US.UTF-8";
   console = {
-- 
2.49.0


From 7bd28525cb77aa84334afa85e4596dc8b1540cb9 Mon Sep 17 00:00:00 2001
From: dadada <dadada@dadada.li>
Date: Sun, 10 Apr 2022 21:22:01 +0200
Subject: [PATCH 05/10] Configure bridges

---
 nixos/agares/configuration.nix | 18 +++++++++++++-----
 nixos/ifrit/configuration.nix  |  1 +
 2 files changed, 14 insertions(+), 5 deletions(-)

diff --git a/nixos/agares/configuration.nix b/nixos/agares/configuration.nix
index 7f21586..4fe1a3e 100644
--- a/nixos/agares/configuration.nix
+++ b/nixos/agares/configuration.nix
@@ -45,12 +45,20 @@
       interface = "enp1s0";
     };
   };
+
+  networking.bridges = {
+    "br-lan" = {
+      interfaces = [ "lan" ];
+    };
+    "br-vpn" = {
+      interfaces = [ "vpn" ];
+    };
+    "br-backup" = {
+      interfaces = [ "backup" ];
+    };
+  };
+
   networking.interfaces.enp1s0.useDHCP = true;
-  networking.interfaces.enp2s0.useDHCP = false;
-  networking.interfaces.enp3s0.useDHCP = false;
-  networking.interfaces.lan.useDHCP = false;
-  networking.interfaces.vpn.useDHCP = false;
-  networking.interfaces.backup.useDHCP = false;
 
   i18n.defaultLocale = "en_US.UTF-8";
   console = {
diff --git a/nixos/ifrit/configuration.nix b/nixos/ifrit/configuration.nix
index a60d5c2..b5e08e3 100644
--- a/nixos/ifrit/configuration.nix
+++ b/nixos/ifrit/configuration.nix
@@ -151,6 +151,7 @@ in
 
   networking.useDHCP = false;
   networking.interfaces.ens3.useDHCP = true;
+  networking.interfaces.ens4.useDHCP = true;
 
   fileSystems."/mnt/storage" = {
     device = "/dev/disk/by-uuid/a34e36fc-d7dd-4ceb-93c4-48f9c2727cb7";
-- 
2.49.0


From 3bf7ca48b0d9c75fd4a6fd212c96744c4b52175c Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 11 Apr 2022 00:40:06 +0000
Subject: [PATCH 06/10] Bump cachix/install-nix-action from 13 to 17

Bumps [cachix/install-nix-action](https://github.com/cachix/install-nix-action) from 13 to 17.
- [Release notes](https://github.com/cachix/install-nix-action/releases)
- [Commits](https://github.com/cachix/install-nix-action/compare/v13...v17)

---
updated-dependencies:
- dependency-name: cachix/install-nix-action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/nix-flake-check.yml  | 2 +-
 .github/workflows/nix-flake-update.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/nix-flake-check.yml b/.github/workflows/nix-flake-check.yml
index 33671cc..1847f95 100644
--- a/.github/workflows/nix-flake-check.yml
+++ b/.github/workflows/nix-flake-check.yml
@@ -7,7 +7,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v2
-      - uses: cachix/install-nix-action@v13
+      - uses: cachix/install-nix-action@v17
         with:
           install_url: https://github.com/numtide/nix-flakes-installer/releases/download/nix-2.4pre20210604_8e6ee1b/install
           extra_nix_config: |
diff --git a/.github/workflows/nix-flake-update.yml b/.github/workflows/nix-flake-update.yml
index b73fbce..edc343d 100644
--- a/.github/workflows/nix-flake-update.yml
+++ b/.github/workflows/nix-flake-update.yml
@@ -9,7 +9,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v2
-      - uses: cachix/install-nix-action@v13
+      - uses: cachix/install-nix-action@v17
         with:
           install_url: https://github.com/numtide/nix-flakes-installer/releases/download/nix-2.4pre20210604_8e6ee1b/install
           extra_nix_config: |
-- 
2.49.0


From 5a556254a858ea4fecc48bb9e2daa01116921fdc Mon Sep 17 00:00:00 2001
From: dadada <dadada@dadada.li>
Date: Wed, 13 Apr 2022 17:01:05 +0200
Subject: [PATCH 07/10] flake.lock: Update
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Flake lock file updates:

• Updated input 'flake-utils':
    'github:numtide/flake-utils/0f8662f1319ad6abf89b3380dd2722369fc51ade' (2022-03-26)
  → 'github:numtide/flake-utils/a4b154ebbdc88c8498a5c7b01589addc9e9cb678' (2022-04-11)
• Updated input 'home-manager':
    'github:nix-community/home-manager/f911ebbec927e8e9b582f2e32e2b35f730074cfc' (2022-04-08)
  → 'github:nix-community/home-manager/e39a9d0103e3b2e42059c986a8c633824b96c193' (2022-04-11)
• Updated input 'myNixpkgs':
    'github:NixOS/nixpkgs/42948b300670223ca8286aaf916bc381f66a5313' (2022-04-08)
  → 'github:NixOS/nixpkgs/33772708c6d0e33f697426ba386aa0149cbcbecb' (2022-04-11)
• Updated input 'nixos-hardware':
    'github:NixOS/nixos-hardware/850308db3ef0bcc7454155063b5fec28b4ffbc8c' (2022-04-09)
  → 'github:NixOS/nixos-hardware/1a0ccdbf4583ed0fce37eea7955e8ef90f840a9f' (2022-04-13)
• Updated input 'nvd/flake-utils':
    'github:numtide/flake-utils/0f8662f1319ad6abf89b3380dd2722369fc51ade' (2022-03-26)
  → 'github:numtide/flake-utils/a4b154ebbdc88c8498a5c7b01589addc9e9cb678' (2022-04-11)
---
 flake.lock | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/flake.lock b/flake.lock
index 401ec76..611954a 100644
--- a/flake.lock
+++ b/flake.lock
@@ -131,11 +131,11 @@
     },
     "flake-utils": {
       "locked": {
-        "lastModified": 1648297722,
-        "narHash": "sha256-W+qlPsiZd8F3XkzXOzAoR+mpFqzm3ekQkJNa+PIh1BQ=",
+        "lastModified": 1649676176,
+        "narHash": "sha256-OWKJratjt2RW151VUlJPRALb7OU2S5s+f0vLj4o1bHM=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "0f8662f1319ad6abf89b3380dd2722369fc51ade",
+        "rev": "a4b154ebbdc88c8498a5c7b01589addc9e9cb678",
         "type": "github"
       },
       "original": {
@@ -161,11 +161,11 @@
     },
     "flake-utils_3": {
       "locked": {
-        "lastModified": 1648297722,
-        "narHash": "sha256-W+qlPsiZd8F3XkzXOzAoR+mpFqzm3ekQkJNa+PIh1BQ=",
+        "lastModified": 1649676176,
+        "narHash": "sha256-OWKJratjt2RW151VUlJPRALb7OU2S5s+f0vLj4o1bHM=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "0f8662f1319ad6abf89b3380dd2722369fc51ade",
+        "rev": "a4b154ebbdc88c8498a5c7b01589addc9e9cb678",
         "type": "github"
       },
       "original": {
@@ -228,11 +228,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1649392573,
-        "narHash": "sha256-dCPEJZzExz2+i7AjUuViZUgHC+JXDlBBG/IzuSYWCh8=",
+        "lastModified": 1649642044,
+        "narHash": "sha256-V9ZjTJcbDPgWG+H3rIC6XuPHZAPK1VupBbSsuDbptkQ=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "f911ebbec927e8e9b582f2e32e2b35f730074cfc",
+        "rev": "e39a9d0103e3b2e42059c986a8c633824b96c193",
         "type": "github"
       },
       "original": {
@@ -278,11 +278,11 @@
     },
     "myNixpkgs": {
       "locked": {
-        "lastModified": 1649408932,
-        "narHash": "sha256-JhTW1OtS5fACcRXLqcTTQyYO5vLkO+bceCqeRms13SY=",
+        "lastModified": 1649673231,
+        "narHash": "sha256-1T3AFscfS7s9pkFA+UIDrHH3/RLVjRdYs5ImuLYpOlE=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "42948b300670223ca8286aaf916bc381f66a5313",
+        "rev": "33772708c6d0e33f697426ba386aa0149cbcbecb",
         "type": "github"
       },
       "original": {
@@ -349,11 +349,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1649488242,
-        "narHash": "sha256-GFahTvlMnqotZ8i1AO3J8OtVFrJe4QHcEPxpFH+DIEw=",
+        "lastModified": 1649849514,
+        "narHash": "sha256-zQyTr2UebTKUh1KLyLtevhHsM8umPK1LfQLGUGjRjiQ=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "850308db3ef0bcc7454155063b5fec28b4ffbc8c",
+        "rev": "1a0ccdbf4583ed0fce37eea7955e8ef90f840a9f",
         "type": "github"
       },
       "original": {
-- 
2.49.0


From 6d90e97f9e9dfb0abb8586b5b500478a6a87f1df Mon Sep 17 00:00:00 2001
From: dadada <dadada@dadada.li>
Date: Wed, 13 Apr 2022 17:18:02 +0200
Subject: [PATCH 08/10] Updated interface config on ifrit

---
 nixos/ifrit/configuration.nix | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/nixos/ifrit/configuration.nix b/nixos/ifrit/configuration.nix
index b5e08e3..00b8865 100644
--- a/nixos/ifrit/configuration.nix
+++ b/nixos/ifrit/configuration.nix
@@ -135,9 +135,6 @@ in
     "::1" = hostAliases;
   };
 
-  # weird issues with crappy plastic router
-  networking.interfaces."ens3".tempAddress = "disabled";
-
   # Use the GRUB 2 boot loader.
   boot.loader.grub.enable = true;
   boot.loader.grub.version = 2;
@@ -149,9 +146,13 @@ in
     keyMap = "us";
   };
 
+  # weird issues with crappy plastic router
+  networking.interfaces."ens3".tempAddress = "disabled";
+  networking.interfaces."ens7".tempAddress = "disabled";
+
   networking.useDHCP = false;
   networking.interfaces.ens3.useDHCP = true;
-  networking.interfaces.ens4.useDHCP = true;
+  networking.interfaces.ens7.useDHCP = true;
 
   fileSystems."/mnt/storage" = {
     device = "/dev/disk/by-uuid/a34e36fc-d7dd-4ceb-93c4-48f9c2727cb7";
-- 
2.49.0


From 743b84363c76ffe783e8cc9075ccf8f94cef88bb Mon Sep 17 00:00:00 2001
From: dadada <dadada@dadada.li>
Date: Wed, 13 Apr 2022 17:24:21 +0200
Subject: [PATCH 09/10] Disable dhcp on ens7 on ifrit

---
 nixos/ifrit/configuration.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/ifrit/configuration.nix b/nixos/ifrit/configuration.nix
index 00b8865..882063b 100644
--- a/nixos/ifrit/configuration.nix
+++ b/nixos/ifrit/configuration.nix
@@ -152,7 +152,7 @@ in
 
   networking.useDHCP = false;
   networking.interfaces.ens3.useDHCP = true;
-  networking.interfaces.ens7.useDHCP = true;
+  networking.interfaces.ens7.useDHCP = false;
 
   fileSystems."/mnt/storage" = {
     device = "/dev/disk/by-uuid/a34e36fc-d7dd-4ceb-93c4-48f9c2727cb7";
-- 
2.49.0


From 38e910fb46d56e62f4ccc48eaeea0ad18e1a8348 Mon Sep 17 00:00:00 2001
From: dadada <dadada@dadada.li>
Date: Wed, 13 Apr 2022 17:26:55 +0200
Subject: [PATCH 10/10] fixup hostname for vpn

---
 nixos/ifrit/configuration.nix | 34 +++++--------------------
 nixos/modules/ddns.nix        | 47 +++++++++++++++++++++++++++++++++++
 nixos/modules/default.nix     |  1 +
 3 files changed, 54 insertions(+), 28 deletions(-)
 create mode 100644 nixos/modules/ddns.nix

diff --git a/nixos/ifrit/configuration.nix b/nixos/ifrit/configuration.nix
index 882063b..ed63375 100644
--- a/nixos/ifrit/configuration.nix
+++ b/nixos/ifrit/configuration.nix
@@ -2,35 +2,11 @@
 let
   hostAliases = [
     "ifrit.dadada.li"
-    "bs.vpn.dadada.li"
+    "vpn.dadada.li"
     "media.dadada.li"
-    "backup.dadada.li"
+    "backup0.dadada.li"
   ];
   backups = "/mnt/storage/backup";
-  ddns = hostname: {
-    timers."ddns-${hostname}" = {
-      wantedBy = [ "timers.target" ];
-      partOf = [ "ddns-${hostname}.service" ];
-      timerConfig.OnCalendar = "hourly";
-    };
-    services."ddns-${hostname}" = {
-      serviceConfig.Type = "oneshot";
-      script = ''
-        function url() {
-        echo "https://svc.joker.com/nic/update?username=$1&password=$2&hostname=$3"
-        }
-
-        IFS=':'
-        read -r user password < /var/lib/ddns/credentials
-        unset IFS
-
-        curl_url=$(url "$user" "$password" ${hostname})
-
-        ${pkgs.curl}/bin/curl -4 "$curl_url"
-        ${pkgs.curl}/bin/curl -6 "$curl_url"
-      '';
-    };
-  };
 in
 {
   imports = [
@@ -72,6 +48,10 @@ in
         key = "5EaLm7uC8XzoN8+BaGzgGRUU4q5shM7gQJcs/d7n+Vo=";
       };
     };
+    ddns.domains = [
+      "vpn.dadada.li"
+      "backup0.dadada.li"
+    ];
   };
 
   users.users.borg.home = "/mnt/storage/backup";
@@ -202,7 +182,5 @@ in
 
   environment.systemPackages = [ pkgs.curl ];
 
-  systemd = (ddns "bs.vpn.dadada.li") // (ddns "backup0.dadada.li");
-
   system.stateVersion = "20.03";
 }
diff --git a/nixos/modules/ddns.nix b/nixos/modules/ddns.nix
new file mode 100644
index 0000000..2c42ce4
--- /dev/null
+++ b/nixos/modules/ddns.nix
@@ -0,0 +1,47 @@
+{ config, pkgs, lib, ... }:
+with lib;
+let
+  cfg = config.dadada.ddns;
+  ddnsConfig = hostNames: {
+    systemd.timers = listToAttrs (forEach hostNames (hostname: nameValuePair "ddns-${hostname}"
+    { 
+      wantedBy = [ "timers.target" ];
+      partOf = [ "ddns-${hostname}.service" ];
+      timerConfig.OnCalendar = "hourly";
+    }));
+
+    systemd.services = listToAttrs (forEach hostNames (hostname: nameValuePair "ddns-${hostname}"
+    {
+      serviceConfig.Type = "oneshot";
+      script = ''
+        function url() {
+        echo "https://svc.joker.com/nic/update?username=$1&password=$2&hostname=$3"
+        }
+
+        IFS=':'
+        read -r user password < /var/lib/ddns/credentials
+        unset IFS
+
+        curl_url=$(url "$user" "$password" ${hostname})
+
+        ${pkgs.curl}/bin/curl -4 "$curl_url"
+        ${pkgs.curl}/bin/curl -6 "$curl_url"
+      '';
+    }));
+  };
+in {
+  options = {
+    dadada.ddns.domains = mkOption {
+      type = types.listOf types.str;
+      description = ''
+          Enables DDNS for these domains.
+      '';
+      example = ''
+        [ "example.com" ]
+      '';
+      default = [];
+    };
+  };
+
+  config = ddnsConfig cfg.domains;
+}
diff --git a/nixos/modules/default.nix b/nixos/modules/default.nix
index 1930b23..bb3cf37 100644
--- a/nixos/modules/default.nix
+++ b/nixos/modules/default.nix
@@ -2,6 +2,7 @@
 {
   admin = import ./admin.nix;
   backup = import ./backup.nix;
+  ddns = import ./ddns.nix;
   element = import ./element.nix;
   fido2 = import ./fido2.nix;
   fileShare = import ./fileShare.nix;
-- 
2.49.0