This repository has no description
2.5 kB
68 lines
1{
2 self,
3 config,
4 pkgs,
5 ...
6}:
7
8# Retiolum node, driven by kartei's nix-darwin module (tincr + host data
9# straight out of the kartei host database). The NixOS machines run the same
10# host database through nixpkgs' services.tinc instead, see
11# 2configs/retiolum.nix.
12let
13 net = "retiolum";
14 vars = config.clan.core.vars.generators.${net};
15in
16{
17 imports = [ self.inputs.kartei.darwinModules.retiolum ];
18
19 # nodename defaults to networking.hostName ("barnacle"); the addresses and
20 # aliases come from lass/hosts/barnacle in kartei.
21
22 networking.retiolum.ed25519PrivateKeyFile = vars.files."${net}.ed25519_key.priv".path;
23
24 # Both merge with what kartei's module sets: hosts is attrsOf lines,
25 # connectTo is listOf str.
26 services.tincr.networks.${net} = {
27 # Peers that only exist inside superconfig, on top of the kartei cards.
28 hosts = self.retiolum.tincHosts;
29
30 # kartei's module dials eve/eva/ni/prism -- krebs hubs that only learn
31 # about barnacle when their own registry pins move. A laptop behind NAT
32 # needs relays we control, so also dial our own public servers; same list
33 # the NixOS nodes use in 2configs/retiolum.nix, plus starkstrom.
34 connectTo = [
35 "neoprism"
36 "starkstrom"
37 ];
38 };
39
40 # Same generator as 2configs/retiolum.nix, minus the RSA half: tincr is
41 # SPTPS/Ed25519-only and kartei no longer wants an rsa.key.
42 #
43 # neededFor = "activation" because clan's /run/secrets installer is
44 # Linux-only (tmpfs + move-mount), so on darwin the key is deployed as a
45 # plain file below clan.core.vars.password-store.secretLocation.
46 #
47 # The public half is published in kartei as
48 # lass/hosts/barnacle/retiolum/ed25519.key; keep this script stable or the
49 # regenerated key will no longer match that card.
50 clan.core.vars.generators.${net} = {
51 files."${net}.ed25519_key.priv".neededFor = "activation";
52 files."${net}.ed25519_key.pub".secret = false;
53 runtimeInputs = [
54 pkgs.coreutils
55 self.packages.${pkgs.system}.tincr
56 ];
57 # generate-ed25519-keys wants a Name in tinc.conf and writes the pubkey as
58 # a ready-made `Ed25519PublicKey = ...` line into hosts/$Name.
59 script = ''
60 mkdir -p "$out/hosts"
61 echo 'Name = ${config.networking.hostName}' >"$out/tinc.conf"
62 tinc --config "$out" generate-ed25519-keys
63 mv "$out/ed25519_key.priv" "$out/${net}.ed25519_key.priv"
64 mv "$out/hosts/${config.networking.hostName}" "$out/${net}.ed25519_key.pub"
65 rm -r "$out/tinc.conf" "$out/hosts"
66 '';
67 };
68}