This repository has no description
1.7 kB
65 lines
1{ config, lib, pkgs, ... }:
2
3{
4
5 networking.firewall.allowedTCPPorts = [ 655 ];
6 networking.firewall.allowedUDPPorts = [ 655 ];
7
8 krebs.tinc.retiolum = {
9 enable = true;
10 connectTo = [
11 "neoprism"
12 "prism"
13 "ni"
14 "eve"
15 ];
16 extraConfig = ''
17 AutoConnect = yes
18 LocalDiscovery = yes
19 '';
20 tincUp = lib.mkIf config.systemd.network.enable "";
21 privkey = "${config.krebs.secret.directory}/retiolum.rsa_key.priv";
22 privkey_ed25519 = "${config.krebs.secret.directory}/retiolum.ed25519_key.priv";
23 };
24
25 clanCore.secrets.retiolum = {
26 secrets."retiolum.rsa_key.priv" = { };
27 secrets."retiolum.ed25519_key.priv" = { };
28 facts."retiolum.rsa_key.pub" = { };
29 facts."retiolum.ed25519_key.pub" = { };
30 generator.path = with pkgs; [
31 coreutils
32 tinc_pre
33 ];
34 generator.script = ''
35 tinc --config "$secrets" generate-keys 4096 >/dev/null
36 mv "$secrets"/rsa_key.priv "$secrets"/retiolum.rsa_key.priv
37 mv "$secrets"/ed25519_key.priv "$secrets"/retiolum.ed25519_key.priv
38 mv "$secrets"/rsa_key.pub "$facts"/retiolum.rsa_key.pub
39 mv "$secrets"/ed25519_key.pub "$facts"/retiolum.ed25519_key.pub
40 '';
41 };
42
43 systemd.network.networks.retiolum = {
44 matchConfig.Name = "retiolum";
45 address = [
46 "${config.krebs.build.host.nets.retiolum.ip4.addr}/16"
47 "${config.krebs.build.host.nets.retiolum.ip6.addr}/16"
48 ];
49 linkConfig = {
50 MTUBytes = "1377";
51 RequiredForOnline = "no";
52 };
53 networkConfig = {
54 LinkLocalAddressing = "no";
55 };
56 };
57
58 nixpkgs.config.packageOverrides = pkgs: {
59 tinc = pkgs.tinc_pre;
60 };
61
62 environment.systemPackages = [
63 pkgs.tinc
64 ];
65}