This repository has no description
3.4 kB
101 lines
1{
2 self,
3 config,
4 pkgs,
5 lib,
6 ...
7}:
8
9# Retiolum node on nix-darwin. tincr's own darwin module does the launchd
10# plumbing; the daemon is the same pkgs/tincr the NixOS machines run (they
11# use nixpkgs' services.tinc, see configs/retiolum.nix). kartei is only the
12# host database here, same as on NixOS — its darwin retiolum shim would
13# pull tincd from kartei's own tincr pin instead.
14let
15 net = "retiolum";
16 name = config.networking.hostName;
17 vars = config.clan.core.vars.generators.${net};
18
19 kartei = import (self.inputs.kartei + "/modules/retiolum/hosts.nix") { inherit lib; };
20 own = kartei.own.${name};
21in
22{
23 imports = [ self.inputs.tincr.darwinModules.tincr ];
24
25 services.tincr.package = self.packages.${pkgs.system}.tincr;
26
27 services.tincr.networks.${net} = {
28 nodeName = name;
29 listenPort = 655;
30 ed25519PrivateKeyFile = vars.files."${net}.ed25519_key.priv".path;
31 hosts = kartei.tincHosts;
32 # eve/eva/ni/prism: the krebs hubs kartei's shim dialled. A laptop
33 # behind NAT also needs relays we control; same list as the NixOS
34 # nodes in configs/retiolum.nix, plus starkstrom.
35 connectTo = [
36 "eve"
37 "eva"
38 "ni"
39 "prism"
40 "neoprism"
41 "starkstrom"
42 ];
43 addresses = lib.optional (own.ip4 != null) "${own.ip4}/12" ++ [ "${own.ip6}/16" ];
44 extraConfig = ''
45 LocalDiscovery = yes
46 Broadcast = no
47 '';
48 };
49
50 # No resolved on Darwin, so the tincr DNS stub cannot be routed
51 # per-suffix; keep a static hosts block, replaced in place on every
52 # darwin-rebuild via BEGIN/END markers.
53 system.activationScripts.postActivation.text =
54 let
55 hostsFile = if own.ip4 == null then kartei.extraHosts.v6only else kartei.extraHosts.v4v6;
56 in
57 lib.mkAfter ''
58 tmp=$(mktemp /private/etc/hosts.XXXXXX)
59 chmod 644 "$tmp"
60 awk '
61 /^# BEGIN RETIOLUM HOSTS$/ { skip=1; next }
62 /^# END RETIOLUM HOSTS$/ { skip=0; next }
63 !skip { print }
64 ' /private/etc/hosts > "$tmp"
65 {
66 echo "# BEGIN RETIOLUM HOSTS"
67 cat ${builtins.toFile "retiolum-hosts" hostsFile}
68 echo "# END RETIOLUM HOSTS"
69 } >> "$tmp"
70 mv "$tmp" /private/etc/hosts
71 '';
72
73 # Same generator as configs/retiolum.nix, minus the RSA half: tincr is
74 # SPTPS/Ed25519-only and kartei no longer wants an rsa.key.
75 #
76 # neededFor = "activation" because clan's /run/secrets installer is
77 # Linux-only (tmpfs + move-mount), so on darwin the key is deployed as a
78 # plain file below clan.core.vars.password-store.secretLocation.
79 #
80 # The public half is published in kartei as
81 # lass/hosts/barnacle/retiolum/ed25519.key; keep this script stable or the
82 # regenerated key will no longer match that card.
83 clan.core.vars.generators.${net} = {
84 files."${net}.ed25519_key.priv".neededFor = "activation";
85 files."${net}.ed25519_key.pub".secret = false;
86 runtimeInputs = [
87 pkgs.coreutils
88 self.packages.${pkgs.system}.tincr
89 ];
90 # generate-ed25519-keys wants a Name in tinc.conf and writes the pubkey as
91 # a ready-made `Ed25519PublicKey = ...` line into hosts/$Name.
92 script = ''
93 mkdir -p "$out/hosts"
94 echo 'Name = ${name}' >"$out/tinc.conf"
95 tinc --config "$out" generate-ed25519-keys
96 mv "$out/ed25519_key.priv" "$out/${net}.ed25519_key.priv"
97 mv "$out/hosts/${name}" "$out/${net}.ed25519_key.pub"
98 rm -r "$out/tinc.conf" "$out/hosts"
99 '';
100 };
101}