This repository has no description
barnacle: run 5pkgs/tincr via tincr's darwin module, drop kartei shim
kartei's darwinModules.retiolum pulled tincd from kartei's own tincr
input, so barnacle ran a different daemon than the NixOS nodes. Now
every machine runs 5pkgs/tincr (Lassulus/tincr fix/edge-walk-address):
barnacle imports tincr's darwinModules.tincr directly with
services.tincr.package set, and reproduces the shim's settings itself
(node data from kartei's hosts.nix exactly as 2configs/retiolum.nix
does, connectTo = krebs hubs + neoprism/starkstrom, LocalDiscovery,
Broadcast = no, the BEGIN/END RETIOLUM HOSTS block in /etc/hosts).
kartei is host database only on both platforms.
New flake input `tincr` (fork branch, module only); kartei's tincr/
crane/fenix follow it so the lock has a single node each.
author
lassulus
date
(Sep 14, 2026, 10:38 AM CEST)
commit
28a957a6
28a957a6362526b026a23440d5c414426433ee06
parent
1fb27433
1fb274337d1419e99fba84a09fbf5d98f020fe77
+91
-45
+21
-19
flake.lock
+21
-19
flake.lock
···
190
190
"fenix": {
191
191
"inputs": {
192
192
"nixpkgs": [
193
-
"kartei",
193
+
"tincr",
194
194
"nixpkgs"
195
195
],
196
196
"rust-analyzer-src": "rust-analyzer-src"
···
476
476
},
477
477
"kartei": {
478
478
"inputs": {
479
-
"crane": "crane",
480
-
"fenix": "fenix",
479
+
"crane": [
480
+
"tincr",
481
+
"crane"
482
+
],
483
+
"fenix": [
484
+
"tincr",
485
+
"fenix"
486
+
],
481
487
"nixpkgs": [
482
488
"nixpkgs"
483
489
],
484
-
"tincr": "tincr",
490
+
"tincr": [
491
+
"tincr"
492
+
],
485
493
"treefmt-nix": "treefmt-nix_2"
486
494
},
487
495
"locked": {
···
930
938
"sigexec": "sigexec",
931
939
"spora": "spora",
932
940
"stockholm": "stockholm",
941
+
"tincr": "tincr",
933
942
"treefmt-nix": "treefmt-nix_8",
934
943
"wrappers": "wrappers"
935
944
}
···
1116
1125
},
1117
1126
"tincr": {
1118
1127
"inputs": {
1119
-
"crane": [
1120
-
"kartei",
1121
-
"crane"
1122
-
],
1123
-
"fenix": [
1124
-
"kartei",
1125
-
"fenix"
1126
-
],
1128
+
"crane": "crane",
1129
+
"fenix": "fenix",
1127
1130
"nixpkgs": [
1128
-
"kartei",
1129
1131
"nixpkgs"
1130
1132
],
1131
1133
"treefmt-nix": [
1132
-
"kartei",
1133
1134
"treefmt-nix"
1134
1135
]
1135
1136
},
1136
1137
"locked": {
1137
-
"lastModified": 1789301661,
1138
-
"narHash": "sha256-NdOx7bwXMMpmFsXFMO/6iLx+k/lyI6ck46tWHQgHWY8=",
1139
-
"owner": "Mic92",
1138
+
"lastModified": 1789372505,
1139
+
"narHash": "sha256-K4iHJX3qHwgVXB6X05of1sjB57qMzY5mGCYuPODiHwY=",
1140
+
"owner": "Lassulus",
1140
1141
"repo": "tincr",
1141
-
"rev": "779d35c89e5f1b8e13909c1f110d7fdd354a7d18",
1142
+
"rev": "44220d98a08c73eaf61f5e75f6743843bfd58746",
1142
1143
"type": "github"
1143
1144
},
1144
1145
"original": {
1145
-
"owner": "Mic92",
1146
+
"owner": "Lassulus",
1147
+
"ref": "fix/edge-walk-address",
1146
1148
"repo": "tincr",
1147
1149
"type": "github"
1148
1150
}
+12
-3
flake.nix
+12
-3
flake.nix
···
29
29
stockholm.inputs.nixpkgs.follows = "nixpkgs";
30
30
stockholm.inputs.buildbot-nix.follows = "";
31
31
32
-
# Host database + retiolum modules. barnacle (darwin) consumes these
33
-
# directly; the NixOS machines still get their host data through
34
-
# stockholm's older kartei pin.
32
+
# Host database only (modules/retiolum/hosts.nix), on every platform.
33
+
# The daemon is 5pkgs/tincr everywhere; barnacle imports tincr's own
34
+
# darwin module below, not kartei's retiolum shim.
35
35
kartei.url = "github:krebs/kartei";
36
36
kartei.inputs.nixpkgs.follows = "nixpkgs";
37
+
kartei.inputs.tincr.follows = "tincr";
38
+
kartei.inputs.crane.follows = "tincr/crane";
39
+
kartei.inputs.fenix.follows = "tincr/fenix";
40
+
41
+
# Only for darwinModules.tincr (launchd plumbing); the package comes
42
+
# from 5pkgs/tincr, which pins the same fork branch.
43
+
tincr.url = "github:Lassulus/tincr/fix/edge-walk-address";
44
+
tincr.inputs.nixpkgs.follows = "nixpkgs";
45
+
tincr.inputs.treefmt-nix.follows = "treefmt-nix";
37
46
38
47
disko.url = "github:nix-community/disko";
39
48
# disko.url = "path:/home/lass/src/disko/";
+3
-2
2configs/retiolum.nix
+3
-2
2configs/retiolum.nix
···
18
18
# Peer keys and addresses come straight from kartei, not through
19
19
# stockholm's krebs.hosts: stockholm pins an older kartei and its host type
20
20
# still requires the legacy RSA pubkey. This is only the host database --
21
-
# the daemon stays on nixpkgs' services.tinc (kartei's own retiolum module
22
-
# is nix-darwin only here, see machines/barnacle/retiolum.nix).
21
+
# the daemon stays on nixpkgs' services.tinc with 5pkgs/tincr swapped in
22
+
# (barnacle does the same with tincr's darwin module, see
23
+
# machines/barnacle/retiolum.nix).
23
24
#
24
25
# tincHosts is already filtered to SPTPS-capable nodes, so the RSA-only
25
26
# leftovers tincr refuses per connection attempt are gone.
+55
-21
machines/barnacle/retiolum.nix
+55
-21
machines/barnacle/retiolum.nix
···
2
2
self,
3
3
config,
4
4
pkgs,
5
+
lib,
5
6
...
6
7
}:
7
8
8
-
# Retiolum node, driven by kartei's nix-darwin retiolum module (host data
9
-
# straight out of the kartei host database on top of tincr's own launchd
10
-
# module, which also supplies the tincd package). The NixOS machines run the same
11
-
# host database through nixpkgs' services.tinc instead, see
12
-
# 2configs/retiolum.nix.
9
+
# Retiolum node on nix-darwin. tincr's own darwin module does the launchd
10
+
# plumbing; the daemon is the same 5pkgs/tincr the NixOS machines run (they
11
+
# use nixpkgs' services.tinc, see 2configs/retiolum.nix). kartei is only the
12
+
# host database here, same as on NixOS — its darwin retiolum shim would
13
+
# pull tincd from kartei's own tincr pin instead.
13
14
let
14
15
net = "retiolum";
16
+
name = config.networking.hostName;
15
17
vars = config.clan.core.vars.generators.${net};
18
+
19
+
kartei = import (self.inputs.kartei + "/modules/retiolum/hosts.nix") { inherit lib; };
20
+
# Nodes with no kartei card, known only inside superconfig.
21
+
local = self.retiolum;
22
+
own = kartei.own.${name} or local.own.${name};
16
23
in
17
24
{
18
-
imports = [ self.inputs.kartei.darwinModules.retiolum ];
25
+
imports = [ self.inputs.tincr.darwinModules.tincr ];
19
26
20
-
# nodename defaults to networking.hostName ("barnacle"); the addresses and
21
-
# aliases come from lass/hosts/barnacle in kartei.
27
+
services.tincr.package = self.packages.${pkgs.system}.tincr;
22
28
23
-
networking.retiolum.ed25519PrivateKeyFile = vars.files."${net}.ed25519_key.priv".path;
24
-
25
-
# Both merge with what kartei's module sets: hosts is attrsOf lines,
26
-
# connectTo is listOf str.
27
29
services.tincr.networks.${net} = {
28
-
# Peers that only exist inside superconfig, on top of the kartei cards.
29
-
hosts = self.retiolum.tincHosts;
30
-
31
-
# kartei's module dials eve/eva/ni -- krebs hubs that only learn
32
-
# about barnacle when their own registry pins move. A laptop behind NAT
33
-
# needs relays we control, so also dial our own public servers; same list
34
-
# the NixOS nodes use in 2configs/retiolum.nix, plus starkstrom.
30
+
nodeName = name;
31
+
listenPort = 655;
32
+
ed25519PrivateKeyFile = vars.files."${net}.ed25519_key.priv".path;
33
+
hosts = kartei.tincHosts // local.tincHosts;
34
+
# eve/eva/ni/prism: the krebs hubs kartei's shim dialled. A laptop
35
+
# behind NAT also needs relays we control; same list as the NixOS
36
+
# nodes in 2configs/retiolum.nix, plus starkstrom.
35
37
connectTo = [
38
+
"eve"
39
+
"eva"
40
+
"ni"
41
+
"prism"
36
42
"neoprism"
37
43
"starkstrom"
38
44
];
45
+
addresses = lib.optional (own.ip4 != null) "${own.ip4}/12" ++ [ "${own.ip6}/16" ];
46
+
extraConfig = ''
47
+
LocalDiscovery = yes
48
+
Broadcast = no
49
+
'';
39
50
};
51
+
52
+
# No resolved on Darwin, so the tincr DNS stub cannot be routed
53
+
# per-suffix; keep a static hosts block, replaced in place on every
54
+
# darwin-rebuild via BEGIN/END markers.
55
+
system.activationScripts.postActivation.text =
56
+
let
57
+
hostsFile = if own.ip4 == null then kartei.extraHosts.v6only else kartei.extraHosts.v4v6;
58
+
in
59
+
lib.mkAfter ''
60
+
tmp=$(mktemp /private/etc/hosts.XXXXXX)
61
+
chmod 644 "$tmp"
62
+
awk '
63
+
/^# BEGIN RETIOLUM HOSTS$/ { skip=1; next }
64
+
/^# END RETIOLUM HOSTS$/ { skip=0; next }
65
+
!skip { print }
66
+
' /private/etc/hosts > "$tmp"
67
+
{
68
+
echo "# BEGIN RETIOLUM HOSTS"
69
+
cat ${builtins.toFile "retiolum-hosts" hostsFile}
70
+
echo "# END RETIOLUM HOSTS"
71
+
} >> "$tmp"
72
+
mv "$tmp" /private/etc/hosts
73
+
'';
40
74
41
75
# Same generator as 2configs/retiolum.nix, minus the RSA half: tincr is
42
76
# SPTPS/Ed25519-only and kartei no longer wants an rsa.key.
···
59
93
# a ready-made `Ed25519PublicKey = ...` line into hosts/$Name.
60
94
script = ''
61
95
mkdir -p "$out/hosts"
62
-
echo 'Name = ${config.networking.hostName}' >"$out/tinc.conf"
96
+
echo 'Name = ${name}' >"$out/tinc.conf"
63
97
tinc --config "$out" generate-ed25519-keys
64
98
mv "$out/ed25519_key.priv" "$out/${net}.ed25519_key.priv"
65
-
mv "$out/hosts/${config.networking.hostName}" "$out/${net}.ed25519_key.pub"
99
+
mv "$out/hosts/${name}" "$out/${net}.ed25519_key.pub"
66
100
rm -r "$out/tinc.conf" "$out/hosts"
67
101
'';
68
102
};