feat: nb change networking and add projects

hosts/nb/configuration.nix

@@ -40,6 +40,7 @@ in {
       # ./modules/steam.nix
       ./modules/fingerprint.nix
       ./modules/set-nix-channel.nix
+      ./modules/networking.nix
 
       ./hardware-configuration.nix
     ];
@@ -249,36 +250,6 @@ in {
     };
   };
 
-  networking.wireguard.interfaces = {
-    wg0 = {
-      ips = [ "10.42.98.201/32" ];
-      # publicKey: YdlRGsjh4hS3OMJI+t6SZ2eGXKbs0wZBXWudHW4NyS8=
-      privateKeyFile = config.sops.secrets.wg-cloonar-key.path;
-
-      peers = [
-        {
-          publicKey = "TKQVDmBnf9av46kQxLQSBDhAeaK8r1zh8zpU64zuc1Q=";
-          allowedIPs = [
-            "10.42.96.0/20"
-            # wohnservice-wien
-            "10.254.240.0/24"
-            "10.254.235.0/24"
-            # epicenter.works
-            "10.14.0.0/16"
-            "10.25.0.0/16"
-            "188.34.191.144/32" # web-arm
-            "91.107.201.241" # mail
-          ];
-          endpoint = "vpn.cloonar.com:51820"; # ToDo: route to endpoint not automatically configured https://wiki.archlinux.org/index.php/WireGuard#Loop_routing https://discourse.nixos.org/t/solved-minimal-firewall-setup-for-wireguard-client/7577
-          persistentKeepalive = 25;
-        }
-      ];
-      postSetup = ''
-        printf "nameserver 10.42.97.1\nsearch cloonar.com" | ${pkgs.openresolv}/bin/resolvconf -a wg0 -m 0 -x
-      '';
-    };
-  };
-
   # pgp
   services.pcscd.enable = true;
   programs.gnupg.agent = {

hosts/nb/modules/networking.nix

@@ -0,0 +1,63 @@
+{ config, lib, pkgs, ... }:
+
+{
+  # Enable systemd-resolved with split DNS for ddev.site
+  services.resolved = {
+    enable = true;
+    dnssec = "false";
+    extraConfig = ''
+      DNS=127.0.0.1:5353
+      Domains=~ddev.site
+    '';
+  };
+
+  # Integrate NetworkManager with systemd-resolved
+  networking.networkmanager.dns = "systemd-resolved";
+
+  # Local dnsmasq for .ddev.site resolution only (port 5353)
+  services.dnsmasq = {
+    enable = true;
+    settings = {
+      port = 5353;
+      listen-address = "127.0.0.1";
+      bind-interfaces = true;
+      no-resolv = true;
+      address = "/.ddev.site/127.0.0.1";
+    };
+  };
+
+  # WireGuard VPN configuration
+  networking.wireguard.interfaces = {
+    wg0 = {
+      ips = [ "10.42.98.201/32" ];
+      # publicKey: YdlRGsjh4hS3OMJI+t6SZ2eGXKbs0wZBXWudHW4NyS8=
+      privateKeyFile = config.sops.secrets.wg-cloonar-key.path;
+
+      peers = [
+        {
+          publicKey = "TKQVDmBnf9av46kQxLQSBDhAeaK8r1zh8zpU64zuc1Q=";
+          allowedIPs = [
+            "10.42.96.0/20"
+            # wohnservice-wien
+            "10.254.240.0/24"
+            "10.254.235.0/24"
+            # epicenter.works
+            "10.14.0.0/16"
+            "10.25.0.0/16"
+            "188.34.191.144/32" # web-arm
+            "91.107.201.241" # mail
+          ];
+          endpoint = "vpn.cloonar.com:51820"; # ToDo: route to endpoint not automatically configured https://wiki.archlinux.org/index.php/WireGuard#Loop_routing https://discourse.nixos.org/t/solved-minimal-firewall-setup-for-wireguard-client/7577
+          persistentKeepalive = 25;
+        }
+      ];
+
+      # Use resolvectl for systemd-resolved integration
+      # Note: No postDown needed - systemd-resolved automatically handles interface removal
+      postSetup = ''
+        ${pkgs.systemd}/bin/resolvectl dns wg0 10.42.97.1
+        ${pkgs.systemd}/bin/resolvectl domain wg0 cloonar.com
+      '';
+    };
+  };
+}

hosts/nb/users/configs/project_history

@@ -1,3 +1,6 @@
+/home/dominik/projects/infrastructure/actions
+/home/dominik/projects/infrastructure/forgejo-mcp
+
 /home/dominik/projects/cloonar/chatgpt.vim
 /home/dominik/projects/cloonar/ai.nvim
 /home/dominik/projects/cloonar/gitea.nvim

hosts/nb/users/dominik.nix

@@ -620,6 +620,8 @@ in
       git clone gitea@git.cloonar.com:ScanA11y/sa-core.git ${persistHome}/projects/scana11y/sa-core 2>/dev/null
       git clone gitea@git.cloonar.com:Cloonar/ai-image-alt.git ${persistHome}/projects/cloonar/ai-image-alt 2>/dev/null
       git clone gitea@git.cloonar.com:Cloonar/bookmap.git ${persistHome}/projects/cloonar/bookmap 2>/dev/null
+      git clone gitea@git.cloonar.com:infrastructure/actions.git ${persistHome}/projects/infrastructure/actions 2>/dev/null
+      git clone ssh://git@codeberg.org/razormind/forgejo-mcp.git ${persistHome}/projects/infrastructure/forgejo-mcp 2>/dev/null
 
 
       git clone gitea@git.cloonar.com:dominik.polakovics/typo3-basic.git ${persistHome}/cloonar/typo3-basic 2>/dev/null