This repository has no description
3.9 kB
119 lines
1{
2 self,
3 config,
4 pkgs,
5 lib,
6 ...
7}:
8
9let
10 tincr = self.packages.${pkgs.system}.tincr;
11 tincrPkg = pkgs.runCommand "tincr-sbin-${tincr.version}" { version = tincr.version; } ''
12 mkdir -p $out
13 cp -r ${tincr}/* $out/
14 chmod -R u+w $out
15 ln -s bin $out/sbin
16 '';
17
18 # Peer keys and addresses come straight from kartei, not through
19 # stockholm's krebs.hosts: stockholm pins an older kartei and its host type
20 # still requires the legacy RSA pubkey. This is only the host database --
21 # the daemon stays on nixpkgs' services.tinc with 5pkgs/tincr swapped in
22 # (barnacle does the same with tincr's darwin module, see
23 # machines/barnacle/retiolum.nix).
24 #
25 # tincHosts is already filtered to SPTPS-capable nodes, so the RSA-only
26 # leftovers tincr refuses per connection attempt are gone.
27 kartei = import (self.inputs.kartei + "/modules/retiolum/hosts.nix") { inherit lib; };
28
29 name = config.networking.hostName;
30
31 # Nodes with no kartei card, known only inside superconfig. Exposes the same
32 # interface as kartei's hosts.nix, so both sources merge the same way.
33 local = self.retiolum;
34
35 own = kartei.own.${name} or local.own.${name};
36in
37
38{
39
40 networking.firewall.allowedTCPPorts = [ 655 ];
41 networking.firewall.allowedUDPPorts = [ 655 ];
42
43 services.tinc.networks.retiolum = {
44 package = tincrPkg;
45 # 1+ maps to per-packet Debug/Trace in tincr, which floods journald
46 # (tens of thousands of suppressed messages per minute) and rotates
47 # all other units' logs out of the journal within hours
48 debugLevel = 0;
49 hosts = kartei.tincHosts // local.tincHosts;
50 extraConfig = ''
51 AutoConnect = yes
52 LocalDiscovery = yes
53 '';
54 settings = {
55 Interface = "retiolum";
56 Name = name;
57 ConnectTo = [
58 "neoprism"
59 "ni"
60 "eve"
61 ];
62 };
63 };
64
65 # Copy keys into the tinc config directory before tinc starts.
66 # Running before nixpkgs' preStart ensures key generation is skipped.
67 systemd.services."tinc.retiolum".preStart = lib.mkBefore ''
68 rm -f /etc/tinc/retiolum/rsa_key.priv /etc/tinc/retiolum/ed25519_key.priv /etc/tinc/retiolum/tinc-up
69 cp ${
70 config.clan.core.vars.generators.retiolum.files."retiolum.rsa_key.priv".path
71 } /etc/tinc/retiolum/rsa_key.priv
72 cp ${
73 config.clan.core.vars.generators.retiolum.files."retiolum.ed25519_key.priv".path
74 } /etc/tinc/retiolum/ed25519_key.priv
75 chown tinc-retiolum /etc/tinc/retiolum/rsa_key.priv /etc/tinc/retiolum/ed25519_key.priv
76 chmod 600 /etc/tinc/retiolum/rsa_key.priv /etc/tinc/retiolum/ed25519_key.priv
77 '';
78
79 clan.core.vars.generators.retiolum = {
80 files."retiolum.rsa_key.priv" = { };
81 files."retiolum.ed25519_key.priv" = { };
82 files."retiolum.rsa_key.pub".secret = false;
83 files."retiolum.ed25519_key.pub".secret = false;
84 runtimeInputs = with pkgs; [
85 coreutils
86 tinc_pre
87 ];
88 script = ''
89 tinc --config "$out" generate-keys 4096 >/dev/null
90 mv "$out"/rsa_key.priv "$out"/retiolum.rsa_key.priv
91 mv "$out"/ed25519_key.priv "$out"/retiolum.ed25519_key.priv
92 mv "$out"/rsa_key.pub "$out"/retiolum.rsa_key.pub
93 mv "$out"/ed25519_key.pub "$out"/retiolum.ed25519_key.pub
94 '';
95 };
96
97 systemd.network.networks.retiolum = {
98 matchConfig.Name = "retiolum";
99 address = lib.optional (own.ip4 != null) "${own.ip4}/16" ++ [ "${own.ip6}/16" ];
100 linkConfig = {
101 MTUBytes = "1377";
102 RequiredForOnline = "no";
103 };
104 networkConfig = {
105 LinkLocalAddressing = "no";
106 };
107 };
108
109 environment.systemPackages = [
110 tincrPkg
111 ];
112
113 # Upstream nixos/tinc preStart chowns hosts/ and invitations/ but not
114 # the network dir itself, so tincr (and tinc 1.1pre18) can't persist
115 # its address-cache there. Drop this once nixpkgs#520533 lands.
116 systemd.tmpfiles.rules = [
117 "z /etc/tinc/retiolum 0755 tinc-retiolum - -"
118 ];
119}