This repository has no description
4.4 kB
126 lines
1{
2 self,
3 config,
4 pkgs,
5 lib,
6 ...
7}:
8
9let
10 tincr = self.packages.${pkgs.system}.tincr;
11 tincrPkg = pkgs.runCommand "tincr-sbin-${tincr.version}" { version = tincr.version; } ''
12 mkdir -p $out
13 cp -r ${tincr}/* $out/
14 chmod -R u+w $out
15 ln -s bin $out/sbin
16 '';
17
18 # Peer keys and addresses come straight from kartei. This is only the host
19 # database -- the daemon stays on nixpkgs' services.tinc with pkgs/tincr
20 # swapped in (barnacle does the same with tincr's darwin module, see
21 # machines/barnacle/retiolum.nix).
22 #
23 # tincHosts is already filtered to SPTPS-capable nodes, so the RSA-only
24 # leftovers tincr refuses per connection attempt are gone.
25 kartei = import (self.inputs.kartei + "/modules/retiolum/hosts.nix") { inherit lib; };
26
27 name = config.networking.hostName;
28 own = kartei.own.${name};
29in
30
31{
32
33 networking.firewall.allowedTCPPorts = [ 655 ];
34 networking.firewall.allowedUDPPorts = [ 655 ];
35
36 services.tinc.networks.retiolum = {
37 package = tincrPkg;
38 # 1+ maps to per-packet Debug/Trace in tincr, which floods journald
39 # (tens of thousands of suppressed messages per minute) and rotates
40 # all other units' logs out of the journal within hours
41 debugLevel = 0;
42 hosts = kartei.tincHosts;
43 extraConfig = ''
44 AutoConnect = yes
45 LocalDiscovery = yes
46 '';
47 settings = {
48 Interface = "retiolum";
49 Name = name;
50 ConnectTo = [
51 "neoprism"
52 "eve"
53 ];
54 };
55 };
56
57 # A changed tinc unit is restarted in switch-to-configuration's start phase
58 # instead of stopped up front: otherwise retiolum stays down for the whole
59 # stop phase (minutes when a unit like ipfs waits out its stop timeout) and
60 # takes the deploying ssh session over <machine>.r with it.
61 systemd.services."tinc.retiolum".stopIfChanged = false;
62
63 # Warn and Error for every tinc* crate, plus Info for the per-event
64 # targets: reachability (graph), meta connections (conn) and UDP path,
65 # MTU and key-exchange changes (net). Their Debug/Trace and the other
66 # targets' Info (autoconnect, auth, proto) stay off. Target-scoped on
67 # purpose: `-d 0` sets the global directive and replaces a bare
68 # RUST_LOG=warn, while `tinc` prefix-matches every tinc* crate's target.
69 systemd.services."tinc.retiolum".environment.RUST_LOG =
70 "tinc=warn,tincd::graph=info,tincd::conn=info,tincd::net=info";
71
72 # Copy keys into the tinc config directory before tinc starts.
73 # Running before nixpkgs' preStart ensures key generation is skipped.
74 systemd.services."tinc.retiolum".preStart = lib.mkBefore ''
75 rm -f /etc/tinc/retiolum/rsa_key.priv /etc/tinc/retiolum/ed25519_key.priv /etc/tinc/retiolum/tinc-up
76 cp ${
77 config.clan.core.vars.generators.retiolum.files."retiolum.rsa_key.priv".path
78 } /etc/tinc/retiolum/rsa_key.priv
79 cp ${
80 config.clan.core.vars.generators.retiolum.files."retiolum.ed25519_key.priv".path
81 } /etc/tinc/retiolum/ed25519_key.priv
82 chown tinc-retiolum /etc/tinc/retiolum/rsa_key.priv /etc/tinc/retiolum/ed25519_key.priv
83 chmod 600 /etc/tinc/retiolum/rsa_key.priv /etc/tinc/retiolum/ed25519_key.priv
84 '';
85
86 clan.core.vars.generators.retiolum = {
87 files."retiolum.rsa_key.priv" = { };
88 files."retiolum.ed25519_key.priv" = { };
89 files."retiolum.rsa_key.pub".secret = false;
90 files."retiolum.ed25519_key.pub".secret = false;
91 runtimeInputs = with pkgs; [
92 coreutils
93 tinc_pre
94 ];
95 script = ''
96 tinc --config "$out" generate-keys 4096 >/dev/null
97 mv "$out"/rsa_key.priv "$out"/retiolum.rsa_key.priv
98 mv "$out"/ed25519_key.priv "$out"/retiolum.ed25519_key.priv
99 mv "$out"/rsa_key.pub "$out"/retiolum.rsa_key.pub
100 mv "$out"/ed25519_key.pub "$out"/retiolum.ed25519_key.pub
101 '';
102 };
103
104 systemd.network.networks.retiolum = {
105 matchConfig.Name = "retiolum";
106 address = lib.optional (own.ip4 != null) "${own.ip4}/16" ++ [ "${own.ip6}/16" ];
107 linkConfig = {
108 MTUBytes = "1377";
109 RequiredForOnline = "no";
110 };
111 networkConfig = {
112 LinkLocalAddressing = "no";
113 };
114 };
115
116 environment.systemPackages = [
117 tincrPkg
118 ];
119
120 # Upstream nixos/tinc preStart chowns hosts/ and invitations/ but not
121 # the network dir itself, so tincr (and tinc 1.1pre18) can't persist
122 # its address-cache there. Drop this once nixpkgs#520533 lands.
123 systemd.tmpfiles.rules = [
124 "z /etc/tinc/retiolum 0755 tinc-retiolum - -"
125 ];
126}