This repository has no description
4.1 kB
117 lines
1{ lib }:
2
3# Retiolum nodes that deliberately have no card in the shared kartei registry:
4# they exist only inside superconfig, so every superconfig machine has to be
5# told about them explicitly. Exposed as self.retiolum (see ./flake-module.nix)
6# and consumed by configs/retiolum.nix (NixOS, via nixpkgs services.tinc) and
7# machines/barnacle/retiolum.nix (darwin, via kartei's tincr module), so both
8# platforms agree on the peer set.
9#
10# This is data, not a module -- same shape as keys/.
11#
12# Cards use the same nets.<net> layout as kartei, and the
13# renderer below mirrors kartei's modules/retiolum/hosts.nix, so an entry can
14# move into kartei/lass unchanged if it should become reachable by the rest of
15# krebs rather than just the fleet.
16let
17 # Only the public half, and only from the node's own committed clan vars --
18 # nothing secret and no second copy to keep in sync. tincr writes it as a
19 # ready-made `Ed25519PublicKey = <key>` line, so keep just the key.
20 ed25519 =
21 machine:
22 lib.last (
23 lib.splitString " " (
24 lib.removeSuffix "\n" (
25 builtins.readFile (../vars/per-machine + "/${machine}/retiolum/retiolum.ed25519_key.pub/value")
26 )
27 )
28 );
29
30 retiolumOf = host: host.nets.retiolum;
31
32 # Own addresses in the net, rendered as Subnet lines (implicit /32 and /128).
33 addrsOf =
34 net:
35 lib.optional (net.ip4 or null != null) net.ip4.addr
36 ++ lib.optional (net.ip6 or null != null) net.ip6.addr;
37
38 tincHostFile =
39 name: host:
40 let
41 net = retiolumOf host;
42 tinc = net.tinc or { };
43 # A node with a via net is dialable there; everyone else is relayed.
44 via = if net.via or null != null then host.nets.${net.via} else null;
45 in
46 lib.concatStringsSep "\n" (
47 lib.optionals (via != null) (
48 map (addr: "Address = ${addr} ${toString (tinc.port or 655)}") via.addrs
49 )
50 ++ map (addr: "Subnet = ${addr}") (addrsOf net)
51 # bare labels: tincr's DNS stub appends its suffix
52 ++ map (alias: "Alias = ${alias}") (
53 lib.filter (alias: alias != name) (
54 map (lib.removeSuffix ".r") (lib.filter (lib.hasSuffix ".r") (net.aliases or [ ]))
55 )
56 )
57 ++ [ "Ed25519PublicKey = ${tinc.pubkey_ed25519}" ]
58 ++ lib.optional (tinc.weight or 300 != null) "Weight = ${toString (tinc.weight or 300)}"
59 );
60
61 # /etc/hosts lines, rendered like kartei's netHostsLines for retiolum.
62 hostsLines =
63 hosts: withV4:
64 lib.concatStrings (
65 lib.mapAttrsToList (
66 name: host:
67 let
68 net = retiolumOf host;
69 aliases = lib.concatStringsSep " " (lib.unique ([ "${name}.r" ] ++ net.aliases or [ ]));
70 in
71 lib.optionalString (withV4 && net.ip4 or null != null) "${net.ip4.addr} ${aliases}\n"
72 + lib.optionalString (net.ip6 or null != null) "${net.ip6.addr} ${aliases}\n"
73 ) hosts
74 );
75in
76rec {
77 hosts = {
78 starkstrom = {
79 nets = {
80 # Hetzner KVM box; static address, and configs/retiolum.nix opens 655,
81 # so peers dial it directly instead of relaying through neoprism/prism.
82 internet.addrs = [ "194.110.87.67" ];
83 retiolum = {
84 via = "internet";
85 ip4.addr = "10.243.0.100";
86 ip6.addr = "42:0:ce16::100";
87 aliases = [ "starkstrom.r" ];
88 tinc.pubkey_ed25519 = ed25519 "starkstrom";
89 };
90 };
91 };
92 acheron = {
93 # gg23 router replacing styx; sits behind the vodafone NAT, so it dials
94 # out and is relayed like any other node (no via net).
95 nets.retiolum = {
96 ip4.addr = "10.243.11.2";
97 ip6.addr = "42:0:ce16::112";
98 aliases = [ "acheron.r" ];
99 tinc.pubkey_ed25519 = ed25519 "acheron";
100 };
101 };
102 };
103
104 # Same interface kartei's modules/retiolum/hosts.nix exposes, so consumers
105 # can treat both sources the same way.
106 tincHosts = lib.mapAttrs tincHostFile hosts;
107
108 own = lib.mapAttrs (_: host: {
109 ip4 = (retiolumOf host).ip4.addr or null;
110 ip6 = (retiolumOf host).ip6.addr or null;
111 }) hosts;
112
113 extraHosts = {
114 v4v6 = hostsLines hosts true;
115 v6only = hostsLines hosts false;
116 };
117}