This repository has no description
1.7 kB
64 lines
1{ config, pkgs, ... }:
2
3{
4
5 networking.firewall.allowedTCPPorts = [ 655 ];
6 networking.firewall.allowedUDPPorts = [ 655 ];
7
8 krebs.tinc.retiolum = {
9 enable = true;
10 connectTo = [
11 "neoprism"
12 "prism"
13 "ni"
14 "eve"
15 ];
16 extraConfig = ''
17 AutoConnect = yes
18 LocalDiscovery = yes
19 '';
20 privkey = config.clanCore.facts.services.retiolum.secret."retiolum.rsa_key.priv".path;
21 privkey_ed25519 = config.clanCore.facts.services.retiolum.secret."retiolum.ed25519_key.priv".path;
22 };
23
24 clanCore.facts.services.retiolum = {
25 secret."retiolum.rsa_key.priv" = { };
26 secret."retiolum.ed25519_key.priv" = { };
27 public."retiolum.rsa_key.pub" = { };
28 public."retiolum.ed25519_key.pub" = { };
29 generator.path = with pkgs; [
30 coreutils
31 tinc_pre
32 ];
33 generator.script = ''
34 tinc --config "$secrets" generate-keys 4096 >/dev/null
35 mv "$secrets"/rsa_key.priv "$secrets"/retiolum.rsa_key.priv
36 mv "$secrets"/ed25519_key.priv "$secrets"/retiolum.ed25519_key.priv
37 mv "$secrets"/rsa_key.pub "$facts"/retiolum.rsa_key.pub
38 mv "$secrets"/ed25519_key.pub "$facts"/retiolum.ed25519_key.pub
39 '';
40 };
41
42 systemd.network.networks.retiolum = {
43 matchConfig.Name = "retiolum";
44 address = [
45 "${config.krebs.build.host.nets.retiolum.ip4.addr}/16"
46 "${config.krebs.build.host.nets.retiolum.ip6.addr}/16"
47 ];
48 linkConfig = {
49 MTUBytes = "1377";
50 RequiredForOnline = "no";
51 };
52 networkConfig = {
53 LinkLocalAddressing = "no";
54 };
55 };
56
57 nixpkgs.config.packageOverrides = pkgs: {
58 tinc = pkgs.tinc_pre;
59 };
60
61 environment.systemPackages = [
62 pkgs.tinc
63 ];
64}