This repository has no description
2.8 kB
97 lines
1{
2 self,
3 config,
4 pkgs,
5 lib,
6 ...
7}:
8
9let
10 tincr = self.packages.${pkgs.system}.tincr;
11 tincrPkg = pkgs.runCommand "tincr-sbin-${tincr.version}" { version = tincr.version; } ''
12 mkdir -p $out
13 cp -r ${tincr}/* $out/
14 chmod -R u+w $out
15 ln -s bin $out/sbin
16 '';
17in
18
19{
20
21 networking.firewall.allowedTCPPorts = [ 655 ];
22 networking.firewall.allowedUDPPorts = [ 655 ];
23
24 services.tinc.networks.retiolum = {
25 package = tincrPkg;
26 debugLevel = 3;
27 hosts = lib.mapAttrs' (name: host: lib.nameValuePair name host.nets.retiolum.tinc.config) (
28 lib.filterAttrs (_: host: host.nets.retiolum.tinc.config or null != null) config.krebs.hosts
29 );
30 extraConfig = ''
31 AutoConnect = yes
32 LocalDiscovery = yes
33 '';
34 settings = {
35 Interface = "retiolum";
36 Name = config.krebs.build.host.name;
37 ConnectTo = [
38 "neoprism"
39 "prism"
40 "ni"
41 "eve"
42 ];
43 };
44 };
45
46 # Copy keys into the tinc config directory before tinc starts.
47 # Running before nixpkgs' preStart ensures key generation is skipped.
48 systemd.services."tinc.retiolum".preStart = lib.mkBefore ''
49 rm -f /etc/tinc/retiolum/rsa_key.priv /etc/tinc/retiolum/ed25519_key.priv /etc/tinc/retiolum/tinc-up
50 cp ${
51 config.clan.core.vars.generators.retiolum.files."retiolum.rsa_key.priv".path
52 } /etc/tinc/retiolum/rsa_key.priv
53 cp ${
54 config.clan.core.vars.generators.retiolum.files."retiolum.ed25519_key.priv".path
55 } /etc/tinc/retiolum/ed25519_key.priv
56 chown tinc-retiolum /etc/tinc/retiolum/rsa_key.priv /etc/tinc/retiolum/ed25519_key.priv
57 chmod 600 /etc/tinc/retiolum/rsa_key.priv /etc/tinc/retiolum/ed25519_key.priv
58 '';
59
60 clan.core.vars.generators.retiolum = {
61 files."retiolum.rsa_key.priv" = { };
62 files."retiolum.ed25519_key.priv" = { };
63 files."retiolum.rsa_key.pub".secret = false;
64 files."retiolum.ed25519_key.pub".secret = false;
65 migrateFact = "retiolum";
66 runtimeInputs = with pkgs; [
67 coreutils
68 tinc_pre
69 ];
70 script = ''
71 tinc --config "$out" generate-keys 4096 >/dev/null
72 mv "$out"/rsa_key.priv "$out"/retiolum.rsa_key.priv
73 mv "$out"/ed25519_key.priv "$out"/retiolum.ed25519_key.priv
74 mv "$out"/rsa_key.pub "$out"/retiolum.rsa_key.pub
75 mv "$out"/ed25519_key.pub "$out"/retiolum.ed25519_key.pub
76 '';
77 };
78
79 systemd.network.networks.retiolum = {
80 matchConfig.Name = "retiolum";
81 address = [
82 "${config.krebs.build.host.nets.retiolum.ip4.addr}/16"
83 "${config.krebs.build.host.nets.retiolum.ip6.addr}/16"
84 ];
85 linkConfig = {
86 MTUBytes = "1377";
87 RequiredForOnline = "no";
88 };
89 networkConfig = {
90 LinkLocalAddressing = "no";
91 };
92 };
93
94 environment.systemPackages = [
95 tincrPkg
96 ];
97}