This repository has no description
3.7 kB
107 lines
1{
2 self,
3 config,
4 pkgs,
5 lib,
6 ...
7}:
8
9# Retiolum node on nix-darwin. tincr's own darwin module does the launchd
10# plumbing; the daemon is the same pkgs/tincr the NixOS machines run (they
11# use nixpkgs' services.tinc, see configs/retiolum.nix). kartei is only the
12# host database here, same as on NixOS — its darwin retiolum shim would
13# pull tincd from kartei's own tincr pin instead.
14let
15 net = "retiolum";
16 name = config.networking.hostName;
17 vars = config.clan.core.vars.generators.${net};
18
19 kartei = import (self.inputs.kartei + "/modules/retiolum/hosts.nix") { inherit lib; };
20 # Nodes with no kartei card, known only inside superconfig.
21 local = self.retiolum;
22 own = kartei.own.${name} or local.own.${name};
23in
24{
25 imports = [ self.inputs.tincr.darwinModules.tincr ];
26
27 services.tincr.package = self.packages.${pkgs.system}.tincr;
28
29 services.tincr.networks.${net} = {
30 nodeName = name;
31 listenPort = 655;
32 ed25519PrivateKeyFile = vars.files."${net}.ed25519_key.priv".path;
33 hosts = kartei.tincHosts // local.tincHosts;
34 # eve/eva/ni/prism: the krebs hubs kartei's shim dialled. A laptop
35 # behind NAT also needs relays we control; same list as the NixOS
36 # nodes in configs/retiolum.nix, plus starkstrom.
37 connectTo = [
38 "eve"
39 "eva"
40 "ni"
41 "prism"
42 "neoprism"
43 "starkstrom"
44 ];
45 addresses = lib.optional (own.ip4 != null) "${own.ip4}/12" ++ [ "${own.ip6}/16" ];
46 extraConfig = ''
47 LocalDiscovery = yes
48 Broadcast = no
49 '';
50 };
51
52 # No resolved on Darwin, so the tincr DNS stub cannot be routed
53 # per-suffix; keep a static hosts block, replaced in place on every
54 # darwin-rebuild via BEGIN/END markers.
55 system.activationScripts.postActivation.text =
56 let
57 hostsFile =
58 if own.ip4 == null then
59 kartei.extraHosts.v6only + local.extraHosts.v6only
60 else
61 kartei.extraHosts.v4v6 + local.extraHosts.v4v6;
62 in
63 lib.mkAfter ''
64 tmp=$(mktemp /private/etc/hosts.XXXXXX)
65 chmod 644 "$tmp"
66 awk '
67 /^# BEGIN RETIOLUM HOSTS$/ { skip=1; next }
68 /^# END RETIOLUM HOSTS$/ { skip=0; next }
69 !skip { print }
70 ' /private/etc/hosts > "$tmp"
71 {
72 echo "# BEGIN RETIOLUM HOSTS"
73 cat ${builtins.toFile "retiolum-hosts" hostsFile}
74 echo "# END RETIOLUM HOSTS"
75 } >> "$tmp"
76 mv "$tmp" /private/etc/hosts
77 '';
78
79 # Same generator as configs/retiolum.nix, minus the RSA half: tincr is
80 # SPTPS/Ed25519-only and kartei no longer wants an rsa.key.
81 #
82 # neededFor = "activation" because clan's /run/secrets installer is
83 # Linux-only (tmpfs + move-mount), so on darwin the key is deployed as a
84 # plain file below clan.core.vars.password-store.secretLocation.
85 #
86 # The public half is published in kartei as
87 # lass/hosts/barnacle/retiolum/ed25519.key; keep this script stable or the
88 # regenerated key will no longer match that card.
89 clan.core.vars.generators.${net} = {
90 files."${net}.ed25519_key.priv".neededFor = "activation";
91 files."${net}.ed25519_key.pub".secret = false;
92 runtimeInputs = [
93 pkgs.coreutils
94 self.packages.${pkgs.system}.tincr
95 ];
96 # generate-ed25519-keys wants a Name in tinc.conf and writes the pubkey as
97 # a ready-made `Ed25519PublicKey = ...` line into hosts/$Name.
98 script = ''
99 mkdir -p "$out/hosts"
100 echo 'Name = ${name}' >"$out/tinc.conf"
101 tinc --config "$out" generate-ed25519-keys
102 mv "$out/ed25519_key.priv" "$out/${net}.ed25519_key.priv"
103 mv "$out/hosts/${name}" "$out/${net}.ed25519_key.pub"
104 rm -r "$out/tinc.conf" "$out/hosts"
105 '';
106 };
107}