This repository has no description
1.3 kB
37 lines
1{ pkgs, ... }:
2let
3 port = 7654;
4in
5{
6 systemd.services.n2n-supernode = {
7 description = "n2n supernode";
8 wantedBy = [ "multi-user.target" ];
9 after = [ "network.target" ];
10 serviceConfig = {
11 # -F sets the supernode federation name; n2n prepends '*', so this
12 # becomes the federation community '*krebs' (avoids the default
13 # '*Federation'). Only affects supernode-to-supernode federation, not
14 # the community (-c) edges use.
15 ExecStart = "${pkgs.n2n}/bin/supernode -f -p ${toString port} -F krebs";
16 Restart = "always";
17 RestartSec = 5;
18 # supernode insists on dropping privileges to nobody (uid/gid 65534) itself
19 # and aborts if the setuid() fails, so it must start as root -- DynamicUser
20 # leaves it already-unprivileged and the drop fails (exit 1).
21 ProtectSystem = "strict";
22 ProtectHome = true;
23 PrivateTmp = true;
24 ProtectKernelTunables = true;
25 ProtectControlGroups = true;
26 RestrictAddressFamilies = [
27 "AF_INET"
28 "AF_INET6"
29 ];
30 };
31 };
32
33 # UDP is the main n2n protocol; TCP is the supernode's "aux" listener,
34 # used by edges started with -S2 when their network blocks UDP.
35 networking.firewall.allowedUDPPorts = [ port ];
36 networking.firewall.allowedTCPPorts = [ port ];
37}