forked from
lass.pds.lassul.us/superconfig
This repository has no description
2configs.retiolum: take host data from kartei directly
The daemon stays on nixpkgs services.tinc; only the host database moves.
stockholm pins a kartei from before barnacle and its host type still requires
the legacy RSA pubkey, so peer keys now come from kartei modules/retiolum/hosts.nix
instead of config.krebs.hosts. krebs.hosts is untouched for everything else
(dns, iptables, consul, ...).
Effects: barnacle and 5 newer hosts become known fleet-wide, and the 35
RSA-only entries drop out -- tincr is SPTPS-only and refused them once per
connection attempt anyway.
starkstrom has no kartei card and keeps the one it declares locally in
krebs.hosts; that fallback goes away once it is in kartei.
author
lassulus
date
(Sep 11, 2026, 12:43 PM CEST)
commit
2507de3b
2507de3b135ccf87680068d94568076a1f1a1948
parent
a6b1644c
a6b1644cfe286bdda177aa9b9c0722353064da23
+28
-8
+28
-8
2configs/retiolum.nix
+28
-8
2configs/retiolum.nix
···
14
14
chmod -R u+w $out
15
15
ln -s bin $out/sbin
16
16
'';
17
+
18
+
# Peer keys and addresses come straight from kartei, not through
19
+
# stockholm's krebs.hosts: stockholm pins an older kartei and its host type
20
+
# still requires the legacy RSA pubkey. This is only the host database --
21
+
# the daemon stays on nixpkgs' services.tinc (kartei's own retiolum module
22
+
# is nix-darwin only here, see machines/barnacle/retiolum.nix).
23
+
#
24
+
# tincHosts is already filtered to SPTPS-capable nodes, so the RSA-only
25
+
# leftovers tincr refuses per connection attempt are gone.
26
+
kartei = import (self.inputs.kartei + "/modules/retiolum/hosts.nix") { inherit lib; };
27
+
28
+
name = config.networking.hostName;
29
+
inKartei = kartei.tincHosts ? ${name};
30
+
31
+
# Hosts that have no kartei card yet (starkstrom) keep the card they declare
32
+
# locally in krebs.hosts. Drops out once they are in kartei.
33
+
localNet = config.krebs.build.host.nets.retiolum;
34
+
own =
35
+
if inKartei then
36
+
kartei.own.${name}
37
+
else
38
+
{
39
+
ip4 = localNet.ip4.addr;
40
+
ip6 = localNet.ip6.addr;
41
+
};
17
42
in
18
43
19
44
{
···
27
52
# (tens of thousands of suppressed messages per minute) and rotates
28
53
# all other units' logs out of the journal within hours
29
54
debugLevel = 0;
30
-
hosts = lib.mapAttrs' (name: host: lib.nameValuePair name host.nets.retiolum.tinc.config) (
31
-
lib.filterAttrs (_: host: host.nets.retiolum.tinc.config or null != null) config.krebs.hosts
32
-
);
55
+
hosts = kartei.tincHosts // lib.optionalAttrs (!inKartei) { ${name} = localNet.tinc.config; };
33
56
extraConfig = ''
34
57
AutoConnect = yes
35
58
LocalDiscovery = yes
36
59
'';
37
60
settings = {
38
61
Interface = "retiolum";
39
-
Name = config.krebs.build.host.name;
62
+
Name = name;
40
63
ConnectTo = [
41
64
"neoprism"
42
65
"prism"
···
80
103
81
104
systemd.network.networks.retiolum = {
82
105
matchConfig.Name = "retiolum";
83
-
address = [
84
-
"${config.krebs.build.host.nets.retiolum.ip4.addr}/16"
85
-
"${config.krebs.build.host.nets.retiolum.ip6.addr}/16"
86
-
];
106
+
address = lib.optional (own.ip4 != null) "${own.ip4}/16" ++ [ "${own.ip6}/16" ];
87
107
linkConfig = {
88
108
MTUBytes = "1377";
89
109
RequiredForOnline = "no";