This repository has no description
3.6 kB
103 lines
1{
2 self,
3 config,
4 pkgs,
5 lib,
6 ...
7}:
8
9# Retiolum node on nix-darwin. tincr's own darwin module does the launchd
10# plumbing; the daemon is the same pkgs/tincr the NixOS machines run (they
11# use nixpkgs' services.tinc, see 2configs/retiolum.nix). kartei is only the
12# host database here, same as on NixOS — its darwin retiolum shim would
13# pull tincd from kartei's own tincr pin instead.
14let
15 net = "retiolum";
16 name = config.networking.hostName;
17 vars = config.clan.core.vars.generators.${net};
18
19 kartei = import (self.inputs.kartei + "/modules/retiolum/hosts.nix") { inherit lib; };
20 # Nodes with no kartei card, known only inside superconfig.
21 local = self.retiolum;
22 own = kartei.own.${name} or local.own.${name};
23in
24{
25 imports = [ self.inputs.tincr.darwinModules.tincr ];
26
27 services.tincr.package = self.packages.${pkgs.system}.tincr;
28
29 services.tincr.networks.${net} = {
30 nodeName = name;
31 listenPort = 655;
32 ed25519PrivateKeyFile = vars.files."${net}.ed25519_key.priv".path;
33 hosts = kartei.tincHosts // local.tincHosts;
34 # eve/eva/ni/prism: the krebs hubs kartei's shim dialled. A laptop
35 # behind NAT also needs relays we control; same list as the NixOS
36 # nodes in 2configs/retiolum.nix, plus starkstrom.
37 connectTo = [
38 "eve"
39 "eva"
40 "ni"
41 "prism"
42 "neoprism"
43 "starkstrom"
44 ];
45 addresses = lib.optional (own.ip4 != null) "${own.ip4}/12" ++ [ "${own.ip6}/16" ];
46 extraConfig = ''
47 LocalDiscovery = yes
48 Broadcast = no
49 '';
50 };
51
52 # No resolved on Darwin, so the tincr DNS stub cannot be routed
53 # per-suffix; keep a static hosts block, replaced in place on every
54 # darwin-rebuild via BEGIN/END markers.
55 system.activationScripts.postActivation.text =
56 let
57 hostsFile = if own.ip4 == null then kartei.extraHosts.v6only else kartei.extraHosts.v4v6;
58 in
59 lib.mkAfter ''
60 tmp=$(mktemp /private/etc/hosts.XXXXXX)
61 chmod 644 "$tmp"
62 awk '
63 /^# BEGIN RETIOLUM HOSTS$/ { skip=1; next }
64 /^# END RETIOLUM HOSTS$/ { skip=0; next }
65 !skip { print }
66 ' /private/etc/hosts > "$tmp"
67 {
68 echo "# BEGIN RETIOLUM HOSTS"
69 cat ${builtins.toFile "retiolum-hosts" hostsFile}
70 echo "# END RETIOLUM HOSTS"
71 } >> "$tmp"
72 mv "$tmp" /private/etc/hosts
73 '';
74
75 # Same generator as 2configs/retiolum.nix, minus the RSA half: tincr is
76 # SPTPS/Ed25519-only and kartei no longer wants an rsa.key.
77 #
78 # neededFor = "activation" because clan's /run/secrets installer is
79 # Linux-only (tmpfs + move-mount), so on darwin the key is deployed as a
80 # plain file below clan.core.vars.password-store.secretLocation.
81 #
82 # The public half is published in kartei as
83 # lass/hosts/barnacle/retiolum/ed25519.key; keep this script stable or the
84 # regenerated key will no longer match that card.
85 clan.core.vars.generators.${net} = {
86 files."${net}.ed25519_key.priv".neededFor = "activation";
87 files."${net}.ed25519_key.pub".secret = false;
88 runtimeInputs = [
89 pkgs.coreutils
90 self.packages.${pkgs.system}.tincr
91 ];
92 # generate-ed25519-keys wants a Name in tinc.conf and writes the pubkey as
93 # a ready-made `Ed25519PublicKey = ...` line into hosts/$Name.
94 script = ''
95 mkdir -p "$out/hosts"
96 echo 'Name = ${name}' >"$out/tinc.conf"
97 tinc --config "$out" generate-ed25519-keys
98 mv "$out/ed25519_key.priv" "$out/${net}.ed25519_key.priv"
99 mv "$out/hosts/${name}" "$out/${net}.ed25519_key.pub"
100 rm -r "$out/tinc.conf" "$out/hosts"
101 '';
102 };
103}