This repository has no description
3.3 kB
106 lines
1{
2 self,
3 config,
4 pkgs,
5 lib,
6 ...
7}:
8
9let
10 tincr = self.packages.${pkgs.system}.tincr;
11 tincrPkg = pkgs.runCommand "tincr-sbin-${tincr.version}" { version = tincr.version; } ''
12 mkdir -p $out
13 cp -r ${tincr}/* $out/
14 chmod -R u+w $out
15 ln -s bin $out/sbin
16 '';
17in
18
19{
20
21 networking.firewall.allowedTCPPorts = [ 655 ];
22 networking.firewall.allowedUDPPorts = [ 655 ];
23
24 services.tinc.networks.retiolum = {
25 package = tincrPkg;
26 # 1+ maps to per-packet Debug/Trace in tincr, which floods journald
27 # (tens of thousands of suppressed messages per minute) and rotates
28 # all other units' logs out of the journal within hours
29 debugLevel = 0;
30 hosts = lib.mapAttrs' (name: host: lib.nameValuePair name host.nets.retiolum.tinc.config) (
31 lib.filterAttrs (_: host: host.nets.retiolum.tinc.config or null != null) config.krebs.hosts
32 );
33 extraConfig = ''
34 AutoConnect = yes
35 LocalDiscovery = yes
36 '';
37 settings = {
38 Interface = "retiolum";
39 Name = config.krebs.build.host.name;
40 ConnectTo = [
41 "neoprism"
42 "prism"
43 "ni"
44 "eve"
45 ];
46 };
47 };
48
49 # Copy keys into the tinc config directory before tinc starts.
50 # Running before nixpkgs' preStart ensures key generation is skipped.
51 systemd.services."tinc.retiolum".preStart = lib.mkBefore ''
52 rm -f /etc/tinc/retiolum/rsa_key.priv /etc/tinc/retiolum/ed25519_key.priv /etc/tinc/retiolum/tinc-up
53 cp ${
54 config.clan.core.vars.generators.retiolum.files."retiolum.rsa_key.priv".path
55 } /etc/tinc/retiolum/rsa_key.priv
56 cp ${
57 config.clan.core.vars.generators.retiolum.files."retiolum.ed25519_key.priv".path
58 } /etc/tinc/retiolum/ed25519_key.priv
59 chown tinc-retiolum /etc/tinc/retiolum/rsa_key.priv /etc/tinc/retiolum/ed25519_key.priv
60 chmod 600 /etc/tinc/retiolum/rsa_key.priv /etc/tinc/retiolum/ed25519_key.priv
61 '';
62
63 clan.core.vars.generators.retiolum = {
64 files."retiolum.rsa_key.priv" = { };
65 files."retiolum.ed25519_key.priv" = { };
66 files."retiolum.rsa_key.pub".secret = false;
67 files."retiolum.ed25519_key.pub".secret = false;
68 runtimeInputs = with pkgs; [
69 coreutils
70 tinc_pre
71 ];
72 script = ''
73 tinc --config "$out" generate-keys 4096 >/dev/null
74 mv "$out"/rsa_key.priv "$out"/retiolum.rsa_key.priv
75 mv "$out"/ed25519_key.priv "$out"/retiolum.ed25519_key.priv
76 mv "$out"/rsa_key.pub "$out"/retiolum.rsa_key.pub
77 mv "$out"/ed25519_key.pub "$out"/retiolum.ed25519_key.pub
78 '';
79 };
80
81 systemd.network.networks.retiolum = {
82 matchConfig.Name = "retiolum";
83 address = [
84 "${config.krebs.build.host.nets.retiolum.ip4.addr}/16"
85 "${config.krebs.build.host.nets.retiolum.ip6.addr}/16"
86 ];
87 linkConfig = {
88 MTUBytes = "1377";
89 RequiredForOnline = "no";
90 };
91 networkConfig = {
92 LinkLocalAddressing = "no";
93 };
94 };
95
96 environment.systemPackages = [
97 tincrPkg
98 ];
99
100 # Upstream nixos/tinc preStart chowns hosts/ and invitations/ but not
101 # the network dir itself, so tincr (and tinc 1.1pre18) can't persist
102 # its address-cache there. Drop this once nixpkgs#520533 lands.
103 systemd.tmpfiles.rules = [
104 "z /etc/tinc/retiolum 0755 tinc-retiolum - -"
105 ];
106}