This repository has no description
3.2 kB
87 lines
1{ lib }:
2
3# Retiolum nodes that deliberately have no card in the shared kartei registry:
4# they exist only inside superconfig, so every superconfig machine has to be
5# told about them explicitly. Exposed as self.retiolum (see ./flake-module.nix)
6# and consumed by 2configs/retiolum.nix (NixOS, via nixpkgs services.tinc) and
7# machines/barnacle/retiolum.nix (darwin, via kartei's tincr module), so both
8# platforms agree on the peer set.
9#
10# This is data, not a module -- same shape as keys/.
11#
12# Cards use the same nets.<net> layout as kartei and krebs.hosts, and the
13# renderer below mirrors kartei's modules/retiolum/hosts.nix, so an entry can
14# move into kartei/lass unchanged if it should become reachable by the rest of
15# krebs rather than just the fleet.
16let
17 # Only the public half, and only from the node's own committed clan vars --
18 # nothing secret and no second copy to keep in sync. tincr writes it as a
19 # ready-made `Ed25519PublicKey = <key>` line, so keep just the key.
20 ed25519 =
21 machine:
22 lib.last (
23 lib.splitString " " (
24 lib.removeSuffix "\n" (
25 builtins.readFile (../vars/per-machine + "/${machine}/retiolum/retiolum.ed25519_key.pub/value")
26 )
27 )
28 );
29
30 retiolumOf = host: host.nets.retiolum;
31
32 # Own addresses in the net, rendered as Subnet lines (implicit /32 and /128).
33 addrsOf =
34 net:
35 lib.optional (net.ip4 or null != null) net.ip4.addr
36 ++ lib.optional (net.ip6 or null != null) net.ip6.addr;
37
38 tincHostFile =
39 name: host:
40 let
41 net = retiolumOf host;
42 tinc = net.tinc or { };
43 # A node with a via net is dialable there; everyone else is relayed.
44 via = if net.via or null != null then host.nets.${net.via} else null;
45 in
46 lib.concatStringsSep "\n" (
47 lib.optionals (via != null) (
48 map (addr: "Address = ${addr} ${toString (tinc.port or 655)}") via.addrs
49 )
50 ++ map (addr: "Subnet = ${addr}") (addrsOf net)
51 # bare labels: tincr's DNS stub appends its suffix
52 ++ map (alias: "Alias = ${alias}") (
53 lib.filter (alias: alias != name) (
54 map (lib.removeSuffix ".r") (lib.filter (lib.hasSuffix ".r") (net.aliases or [ ]))
55 )
56 )
57 ++ [ "Ed25519PublicKey = ${tinc.pubkey_ed25519}" ]
58 ++ lib.optional (tinc.weight or 300 != null) "Weight = ${toString (tinc.weight or 300)}"
59 );
60in
61rec {
62 hosts = {
63 starkstrom = {
64 nets = {
65 # Hetzner KVM box; static address, and 2configs/retiolum.nix opens 655,
66 # so peers dial it directly instead of relaying through neoprism/prism.
67 internet.addrs = [ "194.110.87.67" ];
68 retiolum = {
69 via = "internet";
70 ip4.addr = "10.243.0.100";
71 ip6.addr = "42:0:ce16::100";
72 aliases = [ "starkstrom.r" ];
73 tinc.pubkey_ed25519 = ed25519 "starkstrom";
74 };
75 };
76 };
77 };
78
79 # Same interface kartei's modules/retiolum/hosts.nix exposes, so consumers
80 # can treat both sources the same way.
81 tincHosts = lib.mapAttrs tincHostFile hosts;
82
83 own = lib.mapAttrs (_: host: {
84 ip4 = (retiolumOf host).ip4.addr or null;
85 ip6 = (retiolumOf host).ip6.addr or null;
86 }) hosts;
87}