This repository has no description
retiolum: drop self.retiolum, acheron and starkstrom are in kartei now
kartei carries both cards (krebs/kartei#92), so the superconfig-only host
set is empty; read hosts, own addresses and tinc host files from kartei
alone.
author
Hermes
committer
lassulus
date
(Oct 15, 2026, 7:01 AM CEST)
commit
95113e68
95113e68ed449998f49302be081e12c9efb0d2b1
parent
4b834f42
4b834f42ad728f9313a650837b6a8d8b28121d30
+19
-167
-1
flake.nix
-1
flake.nix
+3
-9
configs/kartei.nix
+3
-9
configs/kartei.nix
···
1
1
# Host data from the kartei flake input, rendered straight into NixOS
2
2
# options; stockholm's krebs.hosts (and its hosts/ssh/build modules) is not
3
-
# used. Hosts are kartei's plus the superconfig-only cards in ../retiolum.
3
+
# used.
4
4
{
5
5
config,
6
6
lib,
···
10
10
let
11
11
inherit (self.inputs) kartei;
12
12
13
-
hosts = kartei.hosts // self.retiolum.hosts;
13
+
inherit (kartei) hosts;
14
14
15
15
# Name suffixes that go into /etc/hosts; ".r" names also get a bare short
16
16
# form (barnacle.r -> barnacle), as stockholm's krebs.dns did.
···
23
23
hostDomain = alias: lib.any (d: lib.hasSuffix ".${d}" alias) domains;
24
24
shortsOf = aliases: map (lib.removeSuffix ".r") (lib.filter (lib.hasSuffix ".r") aliases);
25
25
26
-
# superconfig's own cards (../retiolum) only carry ip4/ip6/aliases
27
-
netAddrs =
28
-
net:
29
-
net.addrs or (
30
-
lib.optional (net.ip4 or null != null) net.ip4.addr
31
-
++ lib.optional (net.ip6 or null != null) net.ip6.addr
32
-
);
26
+
netAddrs = net: net.addrs;
33
27
netAliases = net: net.aliases or [ ];
34
28
sshPort = net: net.ssh.port or 22;
35
29
+2
-7
configs/retiolum.nix
+2
-7
configs/retiolum.nix
···
25
25
kartei = import (self.inputs.kartei + "/modules/retiolum/hosts.nix") { inherit lib; };
26
26
27
27
name = config.networking.hostName;
28
-
29
-
# Nodes with no kartei card, known only inside superconfig. Exposes the same
30
-
# interface as kartei's hosts.nix, so both sources merge the same way.
31
-
local = self.retiolum;
32
-
33
-
own = kartei.own.${name} or local.own.${name};
28
+
own = kartei.own.${name};
34
29
in
35
30
36
31
{
···
44
39
# (tens of thousands of suppressed messages per minute) and rotates
45
40
# all other units' logs out of the journal within hours
46
41
debugLevel = 0;
47
-
hosts = kartei.tincHosts // local.tincHosts;
42
+
hosts = kartei.tincHosts;
48
43
extraConfig = ''
49
44
AutoConnect = yes
50
45
LocalDiscovery = yes
-117
retiolum/default.nix
-117
retiolum/default.nix
···
1
-
{ lib }:
2
-
3
-
# Retiolum nodes that deliberately have no card in the shared kartei registry:
4
-
# they exist only inside superconfig, so every superconfig machine has to be
5
-
# told about them explicitly. Exposed as self.retiolum (see ./flake-module.nix)
6
-
# and consumed by configs/retiolum.nix (NixOS, via nixpkgs services.tinc) and
7
-
# machines/barnacle/retiolum.nix (darwin, via kartei's tincr module), so both
8
-
# platforms agree on the peer set.
9
-
#
10
-
# This is data, not a module -- same shape as keys/.
11
-
#
12
-
# Cards use the same nets.<net> layout as kartei, and the
13
-
# renderer below mirrors kartei's modules/retiolum/hosts.nix, so an entry can
14
-
# move into kartei/lass unchanged if it should become reachable by the rest of
15
-
# krebs rather than just the fleet.
16
-
let
17
-
# Only the public half, and only from the node's own committed clan vars --
18
-
# nothing secret and no second copy to keep in sync. tincr writes it as a
19
-
# ready-made `Ed25519PublicKey = <key>` line, so keep just the key.
20
-
ed25519 =
21
-
machine:
22
-
lib.last (
23
-
lib.splitString " " (
24
-
lib.removeSuffix "\n" (
25
-
builtins.readFile (../vars/per-machine + "/${machine}/retiolum/retiolum.ed25519_key.pub/value")
26
-
)
27
-
)
28
-
);
29
-
30
-
retiolumOf = host: host.nets.retiolum;
31
-
32
-
# Own addresses in the net, rendered as Subnet lines (implicit /32 and /128).
33
-
addrsOf =
34
-
net:
35
-
lib.optional (net.ip4 or null != null) net.ip4.addr
36
-
++ lib.optional (net.ip6 or null != null) net.ip6.addr;
37
-
38
-
tincHostFile =
39
-
name: host:
40
-
let
41
-
net = retiolumOf host;
42
-
tinc = net.tinc or { };
43
-
# A node with a via net is dialable there; everyone else is relayed.
44
-
via = if net.via or null != null then host.nets.${net.via} else null;
45
-
in
46
-
lib.concatStringsSep "\n" (
47
-
lib.optionals (via != null) (
48
-
map (addr: "Address = ${addr} ${toString (tinc.port or 655)}") via.addrs
49
-
)
50
-
++ map (addr: "Subnet = ${addr}") (addrsOf net)
51
-
# bare labels: tincr's DNS stub appends its suffix
52
-
++ map (alias: "Alias = ${alias}") (
53
-
lib.filter (alias: alias != name) (
54
-
map (lib.removeSuffix ".r") (lib.filter (lib.hasSuffix ".r") (net.aliases or [ ]))
55
-
)
56
-
)
57
-
++ [ "Ed25519PublicKey = ${tinc.pubkey_ed25519}" ]
58
-
++ lib.optional (tinc.weight or 300 != null) "Weight = ${toString (tinc.weight or 300)}"
59
-
);
60
-
61
-
# /etc/hosts lines, rendered like kartei's netHostsLines for retiolum.
62
-
hostsLines =
63
-
hosts: withV4:
64
-
lib.concatStrings (
65
-
lib.mapAttrsToList (
66
-
name: host:
67
-
let
68
-
net = retiolumOf host;
69
-
aliases = lib.concatStringsSep " " (lib.unique ([ "${name}.r" ] ++ net.aliases or [ ]));
70
-
in
71
-
lib.optionalString (withV4 && net.ip4 or null != null) "${net.ip4.addr} ${aliases}\n"
72
-
+ lib.optionalString (net.ip6 or null != null) "${net.ip6.addr} ${aliases}\n"
73
-
) hosts
74
-
);
75
-
in
76
-
rec {
77
-
hosts = {
78
-
starkstrom = {
79
-
nets = {
80
-
# Hetzner KVM box; static address, and configs/retiolum.nix opens 655,
81
-
# so peers dial it directly instead of relaying through neoprism/prism.
82
-
internet.addrs = [ "194.110.87.67" ];
83
-
retiolum = {
84
-
via = "internet";
85
-
ip4.addr = "10.243.0.100";
86
-
ip6.addr = "42:0:ce16::100";
87
-
aliases = [ "starkstrom.r" ];
88
-
tinc.pubkey_ed25519 = ed25519 "starkstrom";
89
-
};
90
-
};
91
-
};
92
-
acheron = {
93
-
# gg23 router replacing styx; sits behind the vodafone NAT, so it dials
94
-
# out and is relayed like any other node (no via net).
95
-
nets.retiolum = {
96
-
ip4.addr = "10.243.11.2";
97
-
ip6.addr = "42:0:ce16::112";
98
-
aliases = [ "acheron.r" ];
99
-
tinc.pubkey_ed25519 = ed25519 "acheron";
100
-
};
101
-
};
102
-
};
103
-
104
-
# Same interface kartei's modules/retiolum/hosts.nix exposes, so consumers
105
-
# can treat both sources the same way.
106
-
tincHosts = lib.mapAttrs tincHostFile hosts;
107
-
108
-
own = lib.mapAttrs (_: host: {
109
-
ip4 = (retiolumOf host).ip4.addr or null;
110
-
ip6 = (retiolumOf host).ip6.addr or null;
111
-
}) hosts;
112
-
113
-
extraHosts = {
114
-
v4v6 = hostsLines hosts true;
115
-
v6only = hostsLines hosts false;
116
-
};
117
-
}
-4
retiolum/flake-module.nix
-4
retiolum/flake-module.nix
+1
-2
configs/monitoring/server.nix
+1
-2
configs/monitoring/server.nix
···
18
18
peers = lib.remove name servers;
19
19
# Alertmanager gossips the address it advertises, so it must be the
20
20
# retiolum one, not whatever private address it would pick on its own.
21
-
hosts = self.inputs.kartei.hosts // self.retiolum.hosts;
22
-
retiolumIp = hosts.${name}.nets.retiolum.ip4.addr;
21
+
retiolumIp = self.inputs.kartei.hosts.${name}.nets.retiolum.ip4.addr;
23
22
24
23
receiverConfig = pkgs.writeText "matrix-alertmanager-receiver.json" (
25
24
builtins.toJSON {
+3
-3
configs/sigexec/dashboard.nix
+3
-3
configs/sigexec/dashboard.nix
···
26
26
coaxmetal = "http://coaxmetal.r:${toString executorPort}";
27
27
icarus = "http://icarus.r:${toString executorPort}";
28
28
shodan = "http://shodan.r:${toString executorPort}";
29
-
# starkstrom is not in the shared kartei registry yet, so the fleet has
30
-
# no retiolum route to it; its own nginx terminates TLS and strips the
31
-
# /sigexec prefix (machines/starkstrom/config.nix).
29
+
# over public TLS (set up before starkstrom had a kartei card); its own
30
+
# nginx terminates TLS and strips the /sigexec prefix
31
+
# (machines/starkstrom/config.nix).
32
32
starkstrom = "https://starkstrom.lassul.us/sigexec";
33
33
};
34
34
};
+1
-5
machines/acheron/config.nix
+1
-5
machines/acheron/config.nix
···
1
-
# acheron replaces styx as the gg23 router. Like starkstrom it has no card in
2
-
# the shared kartei registry; its retiolum identity lives in retiolum/
3
-
# (self.retiolum), which every superconfig machine injects into its tinc host
4
-
# set and /etc/hosts. Move that entry into kartei/lass if the rest of krebs
5
-
# should be able to reach it too.
1
+
# acheron replaces styx as the gg23 router.
6
2
{
7
3
imports = [
8
4
../../configs
+3
-9
machines/barnacle/retiolum.nix
+3
-9
machines/barnacle/retiolum.nix
···
17
17
vars = config.clan.core.vars.generators.${net};
18
18
19
19
kartei = import (self.inputs.kartei + "/modules/retiolum/hosts.nix") { inherit lib; };
20
-
# Nodes with no kartei card, known only inside superconfig.
21
-
local = self.retiolum;
22
-
own = kartei.own.${name} or local.own.${name};
20
+
own = kartei.own.${name};
23
21
in
24
22
{
25
23
imports = [ self.inputs.tincr.darwinModules.tincr ];
···
30
28
nodeName = name;
31
29
listenPort = 655;
32
30
ed25519PrivateKeyFile = vars.files."${net}.ed25519_key.priv".path;
33
-
hosts = kartei.tincHosts // local.tincHosts;
31
+
hosts = kartei.tincHosts;
34
32
# eve/eva/ni/prism: the krebs hubs kartei's shim dialled. A laptop
35
33
# behind NAT also needs relays we control; same list as the NixOS
36
34
# nodes in configs/retiolum.nix, plus starkstrom.
···
54
52
# darwin-rebuild via BEGIN/END markers.
55
53
system.activationScripts.postActivation.text =
56
54
let
57
-
hostsFile =
58
-
if own.ip4 == null then
59
-
kartei.extraHosts.v6only + local.extraHosts.v6only
60
-
else
61
-
kartei.extraHosts.v4v6 + local.extraHosts.v4v6;
55
+
hostsFile = if own.ip4 == null then kartei.extraHosts.v6only else kartei.extraHosts.v4v6;
62
56
in
63
57
lib.mkAfter ''
64
58
tmp=$(mktemp /private/etc/hosts.XXXXXX)
+4
-8
machines/starkstrom/config.nix
+4
-8
machines/starkstrom/config.nix
···
1
-
# starkstrom is deliberately not in the shared kartei registry; its retiolum
2
-
# identity lives in retiolum/ (self.retiolum), which every superconfig machine
3
-
# injects into its tinc host set and /etc/hosts. Move that entry into
4
-
# kartei/lass if the rest of krebs should be able to reach it too.
5
1
{
6
2
imports = [
7
3
../../configs
···
13
9
./ipfs-endpoint.nix
14
10
];
15
11
16
-
# The fleet has no retiolum route here (see kartei note above), so the
17
-
# sigexec dashboard on neoprism reaches this executor over public TLS
18
-
# instead: nginx strips /sigexec/ so the executor verifies the same paths
19
-
# the statements were signed over (/jobs etc).
12
+
# The sigexec dashboard on neoprism reaches this executor over public TLS
13
+
# (set up before starkstrom had a kartei card; starkstrom.r would work now):
14
+
# nginx strips /sigexec/ so the executor verifies the same paths the
15
+
# statements were signed over (/jobs etc).
20
16
services.nginx.virtualHosts."starkstrom.lassul.us".locations."/sigexec/" = {
21
17
proxyPass = "http://127.0.0.1:7601/";
22
18
extraConfig = ''
+1
-1
configs/gg23/audio/hub.nix
+1
-1
configs/gg23/audio/hub.nix
···
15
15
# send to their static retiolum IPs; tinc's LocalDiscovery keeps that on the
16
16
# LAN.
17
17
kartei = import (self.inputs.kartei + "/modules/retiolum/hosts.nix") { inherit lib; };
18
-
ip4 = n: (kartei.own.${n} or self.retiolum.own.${n}).ip4;
18
+
ip4 = n: kartei.own.${n}.ip4;
19
19
20
20
rooms = [
21
21
"shodan"
+1
-1
configs/gg23/audio/room.nix
+1
-1
configs/gg23/audio/room.nix
···
3
3
{ self, lib, ... }:
4
4
let
5
5
kartei = import (self.inputs.kartei + "/modules/retiolum/hosts.nix") { inherit lib; };
6
-
acheron = (kartei.own.acheron or self.retiolum.own.acheron).ip4;
6
+
acheron = kartei.own.acheron.ip4;
7
7
in
8
8
{
9
9
services.pipewire.extraConfig.pipewire."10-audio-room"."context.modules" = [