This repository has no description
config.retiolum: switch from krebs.tinc to services.tinc
author
lassulus
date
(May 4, 2026, 12:58 PM CEST)
commit
7515ed97
7515ed97af0b7575d8738885da7071bf19ca30be
parent
16c3d776
16c3d7761d54ac2de18aed9ca22ea9c32766c78c
+32
-20
-1
2configs/default.nix
-1
2configs/default.nix
···
41
41
self.inputs.stockholm.nixosModules.kartei
42
42
self.inputs.stockholm.nixosModules.build
43
43
self.inputs.stockholm.nixosModules.dns
44
-
self.inputs.stockholm.nixosModules.tinc
45
44
self.inputs.stockholm.nixosModules.iptables
46
45
self.inputs.stockholm.nixosModules.secret
47
46
self.inputs.stockholm.nixosModules.setuid
+32
-13
2configs/retiolum.nix
+32
-13
2configs/retiolum.nix
···
2
2
self,
3
3
config,
4
4
pkgs,
5
+
lib,
5
6
...
6
7
}:
7
8
8
9
let
9
10
tincr = self.packages.${pkgs.system}.tincr;
10
-
# krebs.tinc invokes ${tincPackage}/sbin/{tinc,tincd}; tincr ships in /bin.
11
-
tincrPkg = pkgs.runCommand "tincr-sbin-${tincr.version}" { } ''
11
+
tincrPkg = pkgs.runCommand "tincr-sbin-${tincr.version}" { version = tincr.version; } ''
12
12
mkdir -p $out
13
13
cp -r ${tincr}/* $out/
14
14
chmod -R u+w $out
···
21
21
networking.firewall.allowedTCPPorts = [ 655 ];
22
22
networking.firewall.allowedUDPPorts = [ 655 ];
23
23
24
-
krebs.tinc.retiolum = {
25
-
enable = true;
26
-
tincPackage = tincrPkg;
27
-
connectTo = [
28
-
"neoprism"
29
-
"prism"
30
-
"ni"
31
-
"eve"
32
-
];
24
+
services.tinc.networks.retiolum = {
25
+
package = tincrPkg;
26
+
debugLevel = 3;
27
+
hosts = lib.mapAttrs' (name: host: lib.nameValuePair name host.nets.retiolum.tinc.config) (
28
+
lib.filterAttrs (_: host: host.nets.retiolum.tinc.config or null != null) config.krebs.hosts
29
+
);
33
30
extraConfig = ''
34
31
AutoConnect = yes
35
32
LocalDiscovery = yes
36
33
'';
37
-
privkey = config.clan.core.vars.generators.retiolum.files."retiolum.rsa_key.priv".path;
38
-
privkey_ed25519 = config.clan.core.vars.generators.retiolum.files."retiolum.ed25519_key.priv".path;
34
+
settings = {
35
+
Interface = "retiolum";
36
+
Name = config.krebs.build.host.name;
37
+
ConnectTo = [
38
+
"neoprism"
39
+
"prism"
40
+
"ni"
41
+
"eve"
42
+
];
43
+
};
39
44
};
45
+
46
+
# Copy keys into the tinc config directory before tinc starts.
47
+
# Running before nixpkgs' preStart ensures key generation is skipped.
48
+
systemd.services."tinc.retiolum".preStart = lib.mkBefore ''
49
+
rm -f /etc/tinc/retiolum/rsa_key.priv /etc/tinc/retiolum/ed25519_key.priv /etc/tinc/retiolum/tinc-up
50
+
cp ${
51
+
config.clan.core.vars.generators.retiolum.files."retiolum.rsa_key.priv".path
52
+
} /etc/tinc/retiolum/rsa_key.priv
53
+
cp ${
54
+
config.clan.core.vars.generators.retiolum.files."retiolum.ed25519_key.priv".path
55
+
} /etc/tinc/retiolum/ed25519_key.priv
56
+
chown tinc-retiolum /etc/tinc/retiolum/rsa_key.priv /etc/tinc/retiolum/ed25519_key.priv
57
+
chmod 600 /etc/tinc/retiolum/rsa_key.priv /etc/tinc/retiolum/ed25519_key.priv
58
+
'';
40
59
41
60
clan.core.vars.generators.retiolum = {
42
61
files."retiolum.rsa_key.priv" = { };
-3
2configs/websites/lassulus.nix
-3
2configs/websites/lassulus.nix
···
23
23
locations."/".extraConfig = ''
24
24
root /srv/http/lassul.us;
25
25
'';
26
-
locations."= /retiolum-hosts.tar.bz2".extraConfig = ''
27
-
alias ${config.krebs.tinc.retiolum.hostsArchive};
28
-
'';
29
26
locations."= /hosts".extraConfig = ''
30
27
alias ${pkgs.krebs-hosts_combined};
31
28
'';
-3
2configs/services/site/default.nix
-3
2configs/services/site/default.nix
···
17
17
locations."/".extraConfig = ''
18
18
root /srv/http/lassul.us;
19
19
'';
20
-
locations."= /retiolum-hosts.tar.bz2".extraConfig = ''
21
-
alias ${config.krebs.tinc.retiolum.hostsArchive};
22
-
'';
23
20
locations."= /hosts".extraConfig = ''
24
21
alias ${pkgs.krebs-hosts_combined};
25
22
'';