This repository has no description
retiolum: keep non-kartei peers in self.retiolum
starkstrom stays out of the shared kartei registry but should still be
reachable inside the fleet. Its card now lives in retiolum/ in the same
nets.<net> layout kartei and krebs.hosts use, rendered by a copy of kartei
modules/retiolum/hosts.nix, so the entry can move to kartei/lass unchanged if
the rest of krebs should reach it too.
Every superconfig machine injects that set into its tinc hosts: the NixOS
nodes through nixpkgs services.tinc, barnacle through kartei tincr module
(hosts is attrsOf lines, so the entries merge). Previously only starkstrom
itself knew its card, so the fleet had no route to it; now all 16 machines do,
and peers dial its static address directly instead of relaying.
self.retiolum exposes hosts/tincHosts/own, the same interface as kartei, so
both sources merge symmetrically. starkstrom krebs.hosts card is composed from
it -- addresses, aliases and the ed25519 key have one source now; only the
legacy RSA pubkey stockholm insists on stays local.
author
lassulus
date
(Sep 11, 2026, 1:26 PM CEST)
commit
57c9f859
57c9f8590f6ed69d04d7340d0b3bd901d43b3975
parent
2507de3b
2507de3b135ccf87680068d94568076a1f1a1948
+127
-34
+1
flake.nix
+1
flake.nix
+6
-13
2configs/retiolum.nix
+6
-13
2configs/retiolum.nix
···
26
26
kartei = import (self.inputs.kartei + "/modules/retiolum/hosts.nix") { inherit lib; };
27
27
28
28
name = config.networking.hostName;
29
-
inKartei = kartei.tincHosts ? ${name};
30
29
31
-
# Hosts that have no kartei card yet (starkstrom) keep the card they declare
32
-
# locally in krebs.hosts. Drops out once they are in kartei.
33
-
localNet = config.krebs.build.host.nets.retiolum;
34
-
own =
35
-
if inKartei then
36
-
kartei.own.${name}
37
-
else
38
-
{
39
-
ip4 = localNet.ip4.addr;
40
-
ip6 = localNet.ip6.addr;
41
-
};
30
+
# Nodes with no kartei card, known only inside superconfig. Exposes the same
31
+
# interface as kartei's hosts.nix, so both sources merge the same way.
32
+
local = self.retiolum;
33
+
34
+
own = kartei.own.${name} or local.own.${name};
42
35
in
43
36
44
37
{
···
52
45
# (tens of thousands of suppressed messages per minute) and rotates
53
46
# all other units' logs out of the journal within hours
54
47
debugLevel = 0;
55
-
hosts = kartei.tincHosts // lib.optionalAttrs (!inKartei) { ${name} = localNet.tinc.config; };
48
+
hosts = kartei.tincHosts // local.tincHosts;
56
49
extraConfig = ''
57
50
AutoConnect = yes
58
51
LocalDiscovery = yes
+87
retiolum/default.nix
+87
retiolum/default.nix
···
1
+
{ lib }:
2
+
3
+
# Retiolum nodes that deliberately have no card in the shared kartei registry:
4
+
# they exist only inside superconfig, so every superconfig machine has to be
5
+
# told about them explicitly. Exposed as self.retiolum (see ./flake-module.nix)
6
+
# and consumed by 2configs/retiolum.nix (NixOS, via nixpkgs services.tinc) and
7
+
# machines/barnacle/retiolum.nix (darwin, via kartei's tincr module), so both
8
+
# platforms agree on the peer set.
9
+
#
10
+
# This is data, not a module -- same shape as keys/.
11
+
#
12
+
# Cards use the same nets.<net> layout as kartei and krebs.hosts, and the
13
+
# renderer below mirrors kartei's modules/retiolum/hosts.nix, so an entry can
14
+
# move into kartei/lass unchanged if it should become reachable by the rest of
15
+
# krebs rather than just the fleet.
16
+
let
17
+
# Only the public half, and only from the node's own committed clan vars --
18
+
# nothing secret and no second copy to keep in sync. tincr writes it as a
19
+
# ready-made `Ed25519PublicKey = <key>` line, so keep just the key.
20
+
ed25519 =
21
+
machine:
22
+
lib.last (
23
+
lib.splitString " " (
24
+
lib.removeSuffix "\n" (
25
+
builtins.readFile (../vars/per-machine + "/${machine}/retiolum/retiolum.ed25519_key.pub/value")
26
+
)
27
+
)
28
+
);
29
+
30
+
retiolumOf = host: host.nets.retiolum;
31
+
32
+
# Own addresses in the net, rendered as Subnet lines (implicit /32 and /128).
33
+
addrsOf =
34
+
net:
35
+
lib.optional (net.ip4 or null != null) net.ip4.addr
36
+
++ lib.optional (net.ip6 or null != null) net.ip6.addr;
37
+
38
+
tincHostFile =
39
+
name: host:
40
+
let
41
+
net = retiolumOf host;
42
+
tinc = net.tinc or { };
43
+
# A node with a via net is dialable there; everyone else is relayed.
44
+
via = if net.via or null != null then host.nets.${net.via} else null;
45
+
in
46
+
lib.concatStringsSep "\n" (
47
+
lib.optionals (via != null) (
48
+
map (addr: "Address = ${addr} ${toString (tinc.port or 655)}") via.addrs
49
+
)
50
+
++ map (addr: "Subnet = ${addr}") (addrsOf net)
51
+
# bare labels: tincr's DNS stub appends its suffix
52
+
++ map (alias: "Alias = ${alias}") (
53
+
lib.filter (alias: alias != name) (
54
+
map (lib.removeSuffix ".r") (lib.filter (lib.hasSuffix ".r") (net.aliases or [ ]))
55
+
)
56
+
)
57
+
++ [ "Ed25519PublicKey = ${tinc.pubkey_ed25519}" ]
58
+
++ lib.optional (tinc.weight or 300 != null) "Weight = ${toString (tinc.weight or 300)}"
59
+
);
60
+
in
61
+
rec {
62
+
hosts = {
63
+
starkstrom = {
64
+
nets = {
65
+
# Hetzner KVM box; static address, and 2configs/retiolum.nix opens 655,
66
+
# so peers dial it directly instead of relaying through neoprism/prism.
67
+
internet.addrs = [ "194.110.87.67" ];
68
+
retiolum = {
69
+
via = "internet";
70
+
ip4.addr = "10.243.0.100";
71
+
ip6.addr = "42:0:ce16::100";
72
+
aliases = [ "starkstrom.r" ];
73
+
tinc.pubkey_ed25519 = ed25519 "starkstrom";
74
+
};
75
+
};
76
+
};
77
+
};
78
+
79
+
# Same interface kartei's modules/retiolum/hosts.nix exposes, so consumers
80
+
# can treat both sources the same way.
81
+
tincHosts = lib.mapAttrs tincHostFile hosts;
82
+
83
+
own = lib.mapAttrs (_: host: {
84
+
ip4 = (retiolumOf host).ip4.addr or null;
85
+
ip6 = (retiolumOf host).ip6.addr or null;
86
+
}) hosts;
87
+
}
+4
retiolum/flake-module.nix
+4
retiolum/flake-module.nix
+7
-3
machines/barnacle/retiolum.nix
+7
-3
machines/barnacle/retiolum.nix
···
6
6
}:
7
7
8
8
# Retiolum node, driven by kartei's nix-darwin module (tincr + host data
9
-
# straight out of the kartei host database). The NixOS machines still go
10
-
# through 2configs/retiolum.nix and stockholm's older kartei pin; barnacle is
11
-
# the first node on the upstream modules.
9
+
# straight out of the kartei host database). The NixOS machines run the same
10
+
# host database through nixpkgs' services.tinc instead, see
11
+
# 2configs/retiolum.nix.
12
12
let
13
13
net = "retiolum";
14
14
vars = config.clan.core.vars.generators.${net};
···
20
20
# aliases come from lass/hosts/barnacle in kartei.
21
21
22
22
networking.retiolum.ed25519PrivateKeyFile = vars.files."${net}.ed25519_key.priv".path;
23
+
24
+
# Peers that only exist inside superconfig; merged on top of the cards
25
+
# kartei's module installs (hosts is attrsOf lines, so this adds to them).
26
+
services.tincr.networks.${net}.hosts = self.retiolum.tincHosts;
23
27
24
28
# Same generator as 2configs/retiolum.nix, minus the RSA half: tincr is
25
29
# SPTPS/Ed25519-only and kartei no longer wants an rsa.key.
+22
-18
machines/starkstrom/config.nix
+22
-18
machines/starkstrom/config.nix
···
1
-
{ config, lib, ... }:
1
+
{
2
+
self,
3
+
config,
4
+
...
5
+
}:
6
+
let
7
+
# starkstrom is deliberately not in the shared kartei registry; its retiolum
8
+
# identity lives in retiolum/ (self.retiolum), which every superconfig
9
+
# machine injects into its tinc host set. Move that entry into kartei/lass if
10
+
# the rest of krebs should be able to reach it too.
11
+
net = self.retiolum.hosts.starkstrom.nets.retiolum;
12
+
in
2
13
{
3
14
imports = [
4
15
../../2configs
···
10
21
./ipfs-endpoint.nix
11
22
];
12
23
13
-
# starkstrom is not (yet) in the shared kartei registry, so its retiolum
14
-
# identity is declared here. Migrate this block into kartei/lass to give the
15
-
# rest of the fleet starkstrom's keys (full mesh); until then only starkstrom
16
-
# knows the peers it ConnectTo's.
17
-
# Pubkeys are read from this machine's clan vars, so they always match the
18
-
# private keys deployed to the host.
24
+
# krebs.build.host and the monitoring/dns bits still read this card, so build
25
+
# it from the same data rather than repeating the addresses and keys.
26
+
# stockholm's host type additionally insists on the legacy RSA pubkey, which
27
+
# tincr ignores; via is left out because stockholm resolves it to a net
28
+
# submodule, not a name.
19
29
krebs.hosts.starkstrom = {
20
30
owner = config.krebs.users.lass;
21
31
monitoring = true;
22
32
nets.retiolum = {
23
-
ip4.addr = "10.243.0.100";
24
-
ip6.addr = "42:0:ce16::100";
25
-
aliases = [ "starkstrom.r" ];
26
-
tinc.pubkey = config.clan.core.vars.generators.retiolum.files."retiolum.rsa_key.pub".value;
27
-
# tincr writes the pub as `Ed25519PublicKey = <key>`; keep only the key.
28
-
tinc.pubkey_ed25519 = lib.last (
29
-
lib.splitString " " (
30
-
lib.removeSuffix "\n"
31
-
config.clan.core.vars.generators.retiolum.files."retiolum.ed25519_key.pub".value
32
-
)
33
-
);
33
+
inherit (net) ip4 ip6 aliases;
34
+
tinc = {
35
+
pubkey = config.clan.core.vars.generators.retiolum.files."retiolum.rsa_key.pub".value;
36
+
inherit (net.tinc) pubkey_ed25519;
37
+
};
34
38
};
35
39
};
36
40