This repository has no description
1.7 kB
61 lines
1{ config, lib, pkgs, ... }:
2
3{
4
5 networking.firewall.allowedTCPPorts = [ 655 ];
6 networking.firewall.allowedUDPPorts = [ 655 ];
7
8 krebs.tinc.retiolum = {
9 enable = true;
10 connectTo = [
11 "neoprism"
12 "prism"
13 "ni"
14 "eve"
15 ];
16 extraConfig = ''
17 AutoConnect = yes
18 LocalDiscovery = yes
19 '';
20 tincUp = lib.mkIf config.systemd.network.enable "";
21 privkey = "${config.krebs.secret.directory}/retiolum.rsa_key.priv";
22 privkey_ed25519 = "${config.krebs.secret.directory}/retiolum.ed25519_key.priv";
23 };
24
25 clanCore.secrets.retiolum = {
26 secrets."retiolum.rsa_key.priv" = { };
27 secrets."retiolum.ed25519_key.priv" = { };
28 facts."retiolum.rsa_key.pub" = { };
29 facts."retiolum.ed25519_key.pub" = { };
30 generator.script = ''
31 ${pkgs.tinc_pre}/bin/tinc --config "$secrets" generate-keys 4096 >/dev/null
32 mv "$secrets"/rsa_key.priv "$secrets"/retiolum.rsa_key.priv
33 mv "$secrets"/ed25519_key.priv "$secrets"/retiolum.ed25519_key.priv
34 mv "$secrets"/rsa_key.pub "$facts"/retiolum.rsa_key.pub
35 mv "$secrets"/ed25519_key.pub "$facts"/retiolum.ed25519_key.pub
36 '';
37 };
38
39 systemd.network.networks.retiolum = {
40 matchConfig.Name = "retiolum";
41 address = [
42 "${config.krebs.build.host.nets.retiolum.ip4.addr}/16"
43 "${config.krebs.build.host.nets.retiolum.ip6.addr}/16"
44 ];
45 linkConfig = {
46 MTUBytes = "1377";
47 RequiredForOnline = "no";
48 };
49 networkConfig = {
50 LinkLocalAddressing = "no";
51 };
52 };
53
54 nixpkgs.config.packageOverrides = pkgs: {
55 tinc = pkgs.tinc_pre;
56 };
57
58 environment.systemPackages = [
59 pkgs.tinc
60 ];
61}