This repository has no description
2.0 kB
71 lines
1{ config, lib, pkgs, ... }:
2
3{
4
5 krebs.iptables = {
6 tables = {
7 filter.INPUT.rules = let
8 tincport = toString config.krebs.build.host.nets.retiolum.tinc.port;
9 in [
10 { predicate = "-p tcp --dport ${tincport}"; target = "ACCEPT"; }
11 { predicate = "-p udp --dport ${tincport}"; target = "ACCEPT"; }
12 ];
13 };
14 };
15
16 krebs.tinc.retiolum = {
17 enable = true;
18 connectTo = [
19 "prism"
20 "ni"
21 "eve"
22 ];
23 extraConfig = ''
24 AutoConnect = no
25 ${lib.optionalString (config.krebs.build.host.nets.retiolum.via != null) ''
26 LocalDiscovery = no
27 ''}
28 '';
29 tincUp = lib.mkIf config.systemd.network.enable "";
30 privkey = "${config.krebs.secret.directory}/retiolum.rsa_key.priv";
31 privkey_ed25519 = "${config.krebs.secret.directory}/retiolum.ed25519_key.priv";
32 };
33
34 clanCore.secrets.retiolum = {
35 secrets."retiolum.rsa_key.priv" = { };
36 secrets."retiolum.ed25519_key.priv" = { };
37 facts."retiolum.rsa_key.pub" = { };
38 facts."retiolum.ed25519_key.pub" = { };
39 generator = ''
40 ${pkgs.tinc_pre}/bin/tinc --config "$secrets" generate-keys 4096 >/dev/null
41 mv "$secrets"/rsa_key.priv "$secrets"/retiolum.rsa_key.priv
42 mv "$secrets"/ed25519_key.priv "$secrets"/retiolum.ed25519_key.priv
43 mv "$secrets"/rsa_key.pub "$facts"/retiolum.rsa_key.pub
44 mv "$secrets"/ed25519_key.pub "$facts"/retiolum.ed25519_key.pub
45 '';
46 };
47
48 systemd.network.networks.retiolum = {
49 matchConfig.Name = "retiolum";
50 address = [
51 "${config.krebs.build.host.nets.retiolum.ip4.addr}/16"
52 "${config.krebs.build.host.nets.retiolum.ip6.addr}/16"
53 ];
54 linkConfig = {
55 MTUBytes = "1377";
56 RequiredForOnline = "no";
57 };
58 networkConfig = {
59 IgnoreCarrierLoss = "10s";
60 LinkLocalAddressing = "no";
61 };
62 };
63
64 nixpkgs.config.packageOverrides = pkgs: {
65 tinc = pkgs.tinc_pre;
66 };
67
68 environment.systemPackages = [
69 pkgs.tinc
70 ];
71}