This repository has no description
3.5 kB
97 lines
1{ lib }:
2
3# Retiolum nodes that deliberately have no card in the shared kartei registry:
4# they exist only inside superconfig, so every superconfig machine has to be
5# told about them explicitly. Exposed as self.retiolum (see ./flake-module.nix)
6# and consumed by configs/retiolum.nix (NixOS, via nixpkgs services.tinc) and
7# machines/barnacle/retiolum.nix (darwin, via kartei's tincr module), so both
8# platforms agree on the peer set.
9#
10# This is data, not a module -- same shape as keys/.
11#
12# Cards use the same nets.<net> layout as kartei, and the
13# renderer below mirrors kartei's modules/retiolum/hosts.nix, so an entry can
14# move into kartei/lass unchanged if it should become reachable by the rest of
15# krebs rather than just the fleet.
16let
17 # Only the public half, and only from the node's own committed clan vars --
18 # nothing secret and no second copy to keep in sync. tincr writes it as a
19 # ready-made `Ed25519PublicKey = <key>` line, so keep just the key.
20 ed25519 =
21 machine:
22 lib.last (
23 lib.splitString " " (
24 lib.removeSuffix "\n" (
25 builtins.readFile (../vars/per-machine + "/${machine}/retiolum/retiolum.ed25519_key.pub/value")
26 )
27 )
28 );
29
30 retiolumOf = host: host.nets.retiolum;
31
32 # Own addresses in the net, rendered as Subnet lines (implicit /32 and /128).
33 addrsOf =
34 net:
35 lib.optional (net.ip4 or null != null) net.ip4.addr
36 ++ lib.optional (net.ip6 or null != null) net.ip6.addr;
37
38 tincHostFile =
39 name: host:
40 let
41 net = retiolumOf host;
42 tinc = net.tinc or { };
43 # A node with a via net is dialable there; everyone else is relayed.
44 via = if net.via or null != null then host.nets.${net.via} else null;
45 in
46 lib.concatStringsSep "\n" (
47 lib.optionals (via != null) (
48 map (addr: "Address = ${addr} ${toString (tinc.port or 655)}") via.addrs
49 )
50 ++ map (addr: "Subnet = ${addr}") (addrsOf net)
51 # bare labels: tincr's DNS stub appends its suffix
52 ++ map (alias: "Alias = ${alias}") (
53 lib.filter (alias: alias != name) (
54 map (lib.removeSuffix ".r") (lib.filter (lib.hasSuffix ".r") (net.aliases or [ ]))
55 )
56 )
57 ++ [ "Ed25519PublicKey = ${tinc.pubkey_ed25519}" ]
58 ++ lib.optional (tinc.weight or 300 != null) "Weight = ${toString (tinc.weight or 300)}"
59 );
60in
61rec {
62 hosts = {
63 starkstrom = {
64 nets = {
65 # Hetzner KVM box; static address, and configs/retiolum.nix opens 655,
66 # so peers dial it directly instead of relaying through neoprism/prism.
67 internet.addrs = [ "194.110.87.67" ];
68 retiolum = {
69 via = "internet";
70 ip4.addr = "10.243.0.100";
71 ip6.addr = "42:0:ce16::100";
72 aliases = [ "starkstrom.r" ];
73 tinc.pubkey_ed25519 = ed25519 "starkstrom";
74 };
75 };
76 };
77 acheron = {
78 # gg23 router replacing styx; sits behind the vodafone NAT, so it dials
79 # out and is relayed like any other node (no via net).
80 nets.retiolum = {
81 ip4.addr = "10.243.11.2";
82 ip6.addr = "42:0:ce16::112";
83 aliases = [ "acheron.r" ];
84 tinc.pubkey_ed25519 = ed25519 "acheron";
85 };
86 };
87 };
88
89 # Same interface kartei's modules/retiolum/hosts.nix exposes, so consumers
90 # can treat both sources the same way.
91 tincHosts = lib.mapAttrs tincHostFile hosts;
92
93 own = lib.mapAttrs (_: host: {
94 ip4 = (retiolumOf host).ip4.addr or null;
95 ip6 = (retiolumOf host).ip6.addr or null;
96 }) hosts;
97}