diff --git a/nix/lib/config/default.nix b/nix/lib/config/default.nix
index b102d86..ddd057c 100644
--- a/nix/lib/config/default.nix
+++ b/nix/lib/config/default.nix
@@ -13,6 +13,10 @@ let
         { lib, ... }:
         with lib;
         {
+          options.assertions = mkOption {
+            type = with types; listOf unspecified;
+            internal = true;
+          };
           options.warnings = mkOption {
             type = types.listOf types.str;
             default = [];
@@ -30,5 +34,33 @@ let
       ./legacy.nix
     ];
   };
+  inherit (result) config;
+
+  warn = result:
+    if builtins.length config.warnings > 0
+    then builtins.trace ''
+      Warnings:
+
+      ${self.lib.concatStringsSep "\n" config.warnings}
+    '' result
+    else result;
+
+  error = result:
+    let
+      failed =
+        builtins.filter ({ assertion, ... }: !assertion)
+          config.assertions;
+    in
+      if failed != []
+      then throw ''
+        Errors:
+
+        ${self.lib.concatMapStringsSep "\n" ({ message, ... }: message) failed}
+      ''
+      else result;
 in
-result.config
+warn (
+  error (
+    builtins.removeAttrs config [ "assertions" "warnings" "gpgKey" "salt-pillar" ]
+  )
+)
diff --git a/nix/lib/config/options.nix b/nix/lib/config/options.nix
index dbfe740..ee02ee4 100644
--- a/nix/lib/config/options.nix
+++ b/nix/lib/config/options.nix
@@ -524,4 +524,9 @@ in
       (reportCollisions "IPv4 subnet" (x: if x.subnet4 == null then [] else [x.subnet4]) config.site.net) ++
       (reportCollisions "IPv6 subnet" (x: builtins.attrValues x.subnets6) config.site.net) ++
       ospfUpstreamXorGw;
+
+  config.assertions = map (name: {
+    assertion = ! config.site.net ? ${name};
+    message = "Host \"${name}\" must be named differently if net \"${name}\" exists.";
+  }) (builtins.attrNames config.site.hosts);
 }