This repository has no description
3.8 kB
117 lines
1{
2 self,
3 config,
4 pkgs,
5 lib,
6 ...
7}:
8
9let
10 tincr = self.packages.${pkgs.system}.tincr;
11 tincrPkg = pkgs.runCommand "tincr-sbin-${tincr.version}" { version = tincr.version; } ''
12 mkdir -p $out
13 cp -r ${tincr}/* $out/
14 chmod -R u+w $out
15 ln -s bin $out/sbin
16 '';
17
18 # Peer keys and addresses come straight from kartei. This is only the host
19 # database -- the daemon stays on nixpkgs' services.tinc with pkgs/tincr
20 # swapped in (barnacle does the same with tincr's darwin module, see
21 # machines/barnacle/retiolum.nix).
22 #
23 # tincHosts is already filtered to SPTPS-capable nodes, so the RSA-only
24 # leftovers tincr refuses per connection attempt are gone.
25 kartei = import (self.inputs.kartei + "/modules/retiolum/hosts.nix") { inherit lib; };
26
27 name = config.networking.hostName;
28
29 # Nodes with no kartei card, known only inside superconfig. Exposes the same
30 # interface as kartei's hosts.nix, so both sources merge the same way.
31 local = self.retiolum;
32
33 own = kartei.own.${name} or local.own.${name};
34in
35
36{
37
38 networking.firewall.allowedTCPPorts = [ 655 ];
39 networking.firewall.allowedUDPPorts = [ 655 ];
40
41 services.tinc.networks.retiolum = {
42 package = tincrPkg;
43 # 1+ maps to per-packet Debug/Trace in tincr, which floods journald
44 # (tens of thousands of suppressed messages per minute) and rotates
45 # all other units' logs out of the journal within hours
46 debugLevel = 0;
47 hosts = kartei.tincHosts // local.tincHosts;
48 extraConfig = ''
49 AutoConnect = yes
50 LocalDiscovery = yes
51 '';
52 settings = {
53 Interface = "retiolum";
54 Name = name;
55 ConnectTo = [
56 "neoprism"
57 "ni"
58 "eve"
59 ];
60 };
61 };
62
63 # Copy keys into the tinc config directory before tinc starts.
64 # Running before nixpkgs' preStart ensures key generation is skipped.
65 systemd.services."tinc.retiolum".preStart = lib.mkBefore ''
66 rm -f /etc/tinc/retiolum/rsa_key.priv /etc/tinc/retiolum/ed25519_key.priv /etc/tinc/retiolum/tinc-up
67 cp ${
68 config.clan.core.vars.generators.retiolum.files."retiolum.rsa_key.priv".path
69 } /etc/tinc/retiolum/rsa_key.priv
70 cp ${
71 config.clan.core.vars.generators.retiolum.files."retiolum.ed25519_key.priv".path
72 } /etc/tinc/retiolum/ed25519_key.priv
73 chown tinc-retiolum /etc/tinc/retiolum/rsa_key.priv /etc/tinc/retiolum/ed25519_key.priv
74 chmod 600 /etc/tinc/retiolum/rsa_key.priv /etc/tinc/retiolum/ed25519_key.priv
75 '';
76
77 clan.core.vars.generators.retiolum = {
78 files."retiolum.rsa_key.priv" = { };
79 files."retiolum.ed25519_key.priv" = { };
80 files."retiolum.rsa_key.pub".secret = false;
81 files."retiolum.ed25519_key.pub".secret = false;
82 runtimeInputs = with pkgs; [
83 coreutils
84 tinc_pre
85 ];
86 script = ''
87 tinc --config "$out" generate-keys 4096 >/dev/null
88 mv "$out"/rsa_key.priv "$out"/retiolum.rsa_key.priv
89 mv "$out"/ed25519_key.priv "$out"/retiolum.ed25519_key.priv
90 mv "$out"/rsa_key.pub "$out"/retiolum.rsa_key.pub
91 mv "$out"/ed25519_key.pub "$out"/retiolum.ed25519_key.pub
92 '';
93 };
94
95 systemd.network.networks.retiolum = {
96 matchConfig.Name = "retiolum";
97 address = lib.optional (own.ip4 != null) "${own.ip4}/16" ++ [ "${own.ip6}/16" ];
98 linkConfig = {
99 MTUBytes = "1377";
100 RequiredForOnline = "no";
101 };
102 networkConfig = {
103 LinkLocalAddressing = "no";
104 };
105 };
106
107 environment.systemPackages = [
108 tincrPkg
109 ];
110
111 # Upstream nixos/tinc preStart chowns hosts/ and invitations/ but not
112 # the network dir itself, so tincr (and tinc 1.1pre18) can't persist
113 # its address-cache there. Drop this once nixpkgs#520533 lands.
114 systemd.tmpfiles.rules = [
115 "z /etc/tinc/retiolum 0755 tinc-retiolum - -"
116 ];
117}