This repository has no description
pkgs.tincr: build on darwin
The source has a full macOS backend (utun via SYSPROTO_CONTROL, recvmsg_x
batching), and 5pkgs/flake-module.nix filters on meta.availableOn, so the
linux-only platforms list kept packages.<darwin>.tincr from existing.
barnacle needs it for retiolum key generation.
author
lassulus
date
(Sep 11, 2026, 12:16 PM CEST)
commit
ffc841fe
ffc841fe8a45da6053fdbd6b5abbf01185bf86ce
parent
16bfd2d4
16bfd2d4e29a3091519f8908be378c56ba3cee0d
+210
-12
+144
-11
flake.lock
+144
-11
flake.lock
···
104
104
"type": "github"
105
105
}
106
106
},
107
+
"crane": {
108
+
"locked": {
109
+
"lastModified": 1788310914,
110
+
"narHash": "sha256-B2vIgrwKQd2hFdSgzF2fvqqkzIkJtBlUGc85cKZh0e4=",
111
+
"owner": "ipetkov",
112
+
"repo": "crane",
113
+
"rev": "d852f62f060ef43937a78d409f63625c82b25af3",
114
+
"type": "github"
115
+
},
116
+
"original": {
117
+
"owner": "ipetkov",
118
+
"repo": "crane",
119
+
"type": "github"
120
+
}
121
+
},
107
122
"data-mesher": {
108
123
"inputs": {
109
124
"flake-parts": [
···
169
184
"original": {
170
185
"owner": "erikarvstedt",
171
186
"repo": "extra-container",
187
+
"type": "github"
188
+
}
189
+
},
190
+
"fenix": {
191
+
"inputs": {
192
+
"nixpkgs": [
193
+
"kartei",
194
+
"nixpkgs"
195
+
],
196
+
"rust-analyzer-src": "rust-analyzer-src"
197
+
},
198
+
"locked": {
199
+
"lastModified": 1788433075,
200
+
"narHash": "sha256-8j/0mNhbRbJQ7KyGxtS3vEeNhT5cK8NEM2ZQr03uOrU=",
201
+
"owner": "nix-community",
202
+
"repo": "fenix",
203
+
"rev": "c957e2d0e505ad7be04c7f2f2f3d7885fb9e242c",
204
+
"type": "github"
205
+
},
206
+
"original": {
207
+
"owner": "nix-community",
208
+
"repo": "fenix",
172
209
"type": "github"
173
210
}
174
211
},
···
437
474
"type": "github"
438
475
}
439
476
},
477
+
"kartei": {
478
+
"inputs": {
479
+
"crane": "crane",
480
+
"fenix": "fenix",
481
+
"nixpkgs": [
482
+
"nixpkgs"
483
+
],
484
+
"tincr": "tincr",
485
+
"treefmt-nix": "treefmt-nix_2"
486
+
},
487
+
"locked": {
488
+
"lastModified": 1788812154,
489
+
"narHash": "sha256-Z1CjMkP4x3dhnTdxpVB8h9UR4TMICtEB7tElLONVvXM=",
490
+
"owner": "krebs",
491
+
"repo": "kartei",
492
+
"rev": "bc93da3e2815802f11925a13b983e977737c2b5d",
493
+
"type": "github"
494
+
},
495
+
"original": {
496
+
"owner": "krebs",
497
+
"repo": "kartei",
498
+
"type": "github"
499
+
}
500
+
},
440
501
"le_menu": {
441
502
"inputs": {
442
503
"flake-parts": "flake-parts_3",
443
504
"nixpkgs": [
444
505
"nixpkgs"
445
506
],
446
-
"treefmt-nix": "treefmt-nix_2"
507
+
"treefmt-nix": "treefmt-nix_3"
447
508
},
448
509
"locked": {
449
510
"lastModified": 1729515958,
···
467
528
"nixpkgs"
468
529
],
469
530
"systems": "systems_4",
470
-
"treefmt-nix": "treefmt-nix_3"
531
+
"treefmt-nix": "treefmt-nix_4"
471
532
},
472
533
"locked": {
473
534
"lastModified": 1788858717,
···
493
554
"nixpkgs": [
494
555
"nixpkgs"
495
556
],
496
-
"treefmt-nix": "treefmt-nix_4"
557
+
"treefmt-nix": "treefmt-nix_5"
497
558
},
498
559
"locked": {
499
560
"lastModified": 1759305594,
···
758
819
"nixpkgs": [
759
820
"nixpkgs"
760
821
],
761
-
"treefmt-nix": "treefmt-nix_5"
822
+
"treefmt-nix": "treefmt-nix_6"
762
823
},
763
824
"locked": {
764
825
"lastModified": 1782727145,
···
829
890
"nixpkgs": [
830
891
"nixpkgs"
831
892
],
832
-
"treefmt-nix": "treefmt-nix_6"
893
+
"treefmt-nix": "treefmt-nix_7"
833
894
},
834
895
"locked": {
835
896
"lastModified": 1770248736,
···
852
913
"disko": "disko",
853
914
"extra-container": "extra-container",
854
915
"hermes-agent": "hermes-agent",
916
+
"kartei": "kartei",
855
917
"le_menu": "le_menu",
856
918
"llm-agents": "llm-agents",
857
919
"nether": "nether",
···
868
930
"sigexec": "sigexec",
869
931
"spora": "spora",
870
932
"stockholm": "stockholm",
871
-
"treefmt-nix": "treefmt-nix_7",
933
+
"treefmt-nix": "treefmt-nix_8",
872
934
"wrappers": "wrappers"
935
+
}
936
+
},
937
+
"rust-analyzer-src": {
938
+
"flake": false,
939
+
"locked": {
940
+
"lastModified": 1788394718,
941
+
"narHash": "sha256-Dyr++cx/ODeP4T4PdaaW7gX8TH9IQs7kScZdi9aMn2s=",
942
+
"owner": "rust-lang",
943
+
"repo": "rust-analyzer",
944
+
"rev": "bf25c45e974ab01bf46bc9fdca0f8b2fde66ae27",
945
+
"type": "github"
946
+
},
947
+
"original": {
948
+
"owner": "rust-lang",
949
+
"ref": "nightly",
950
+
"repo": "rust-analyzer",
951
+
"type": "github"
873
952
}
874
953
},
875
954
"sigexec": {
···
1035
1114
"type": "github"
1036
1115
}
1037
1116
},
1117
+
"tincr": {
1118
+
"inputs": {
1119
+
"crane": [
1120
+
"kartei",
1121
+
"crane"
1122
+
],
1123
+
"fenix": [
1124
+
"kartei",
1125
+
"fenix"
1126
+
],
1127
+
"nixpkgs": [
1128
+
"kartei",
1129
+
"nixpkgs"
1130
+
],
1131
+
"treefmt-nix": [
1132
+
"kartei",
1133
+
"treefmt-nix"
1134
+
]
1135
+
},
1136
+
"locked": {
1137
+
"lastModified": 1788292228,
1138
+
"narHash": "sha256-dC1X5rcD6iHJFLYANcVe0d40vLmmIMrEOpEe0BscIwc=",
1139
+
"owner": "Mic92",
1140
+
"repo": "tincr",
1141
+
"rev": "dc768f86cc70a244857295525553562b1d7fdd65",
1142
+
"type": "github"
1143
+
},
1144
+
"original": {
1145
+
"owner": "Mic92",
1146
+
"repo": "tincr",
1147
+
"type": "github"
1148
+
}
1149
+
},
1038
1150
"treefmt-nix": {
1039
1151
"inputs": {
1040
1152
"nixpkgs": [
···
1059
1171
"treefmt-nix_2": {
1060
1172
"inputs": {
1061
1173
"nixpkgs": [
1174
+
"kartei",
1175
+
"nixpkgs"
1176
+
]
1177
+
},
1178
+
"locked": {
1179
+
"lastModified": 1786901030,
1180
+
"narHash": "sha256-WSFCsDSE5ffgD2MqzkM2CYjeFiKhRF/dJUN8uedb6YE=",
1181
+
"owner": "numtide",
1182
+
"repo": "treefmt-nix",
1183
+
"rev": "27b3b12a8e6375f28ebe122f07d230ca5459bbfa",
1184
+
"type": "github"
1185
+
},
1186
+
"original": {
1187
+
"owner": "numtide",
1188
+
"repo": "treefmt-nix",
1189
+
"type": "github"
1190
+
}
1191
+
},
1192
+
"treefmt-nix_3": {
1193
+
"inputs": {
1194
+
"nixpkgs": [
1062
1195
"le_menu",
1063
1196
"nixpkgs"
1064
1197
]
···
1077
1210
"type": "github"
1078
1211
}
1079
1212
},
1080
-
"treefmt-nix_3": {
1213
+
"treefmt-nix_4": {
1081
1214
"inputs": {
1082
1215
"nixpkgs": [
1083
1216
"llm-agents",
···
1098
1231
"type": "github"
1099
1232
}
1100
1233
},
1101
-
"treefmt-nix_4": {
1234
+
"treefmt-nix_5": {
1102
1235
"inputs": {
1103
1236
"nixpkgs": [
1104
1237
"nether",
···
1119
1252
"type": "github"
1120
1253
}
1121
1254
},
1122
-
"treefmt-nix_5": {
1255
+
"treefmt-nix_6": {
1123
1256
"inputs": {
1124
1257
"nixpkgs": [
1125
1258
"opencrow",
···
1140
1273
"type": "github"
1141
1274
}
1142
1275
},
1143
-
"treefmt-nix_6": {
1276
+
"treefmt-nix_7": {
1144
1277
"inputs": {
1145
1278
"nixpkgs": [
1146
1279
"rogue-talk",
···
1161
1294
"type": "github"
1162
1295
}
1163
1296
},
1164
-
"treefmt-nix_7": {
1297
+
"treefmt-nix_8": {
1165
1298
"inputs": {
1166
1299
"nixpkgs": [
1167
1300
"nixpkgs"
+6
flake.nix
+6
flake.nix
···
29
29
stockholm.inputs.nixpkgs.follows = "nixpkgs";
30
30
stockholm.inputs.buildbot-nix.follows = "";
31
31
32
+
# Host database + retiolum modules. barnacle (darwin) consumes these
33
+
# directly; the NixOS machines still get their host data through
34
+
# stockholm's older kartei pin.
35
+
kartei.url = "github:krebs/kartei";
36
+
kartei.inputs.nixpkgs.follows = "nixpkgs";
37
+
32
38
disko.url = "github:nix-community/disko";
33
39
# disko.url = "path:/home/lass/src/disko/";
34
40
disko.inputs.nixpkgs.follows = "nixpkgs";
+1
-1
5pkgs/tincr/package.nix
+1
-1
5pkgs/tincr/package.nix
+59
machines/barnacle/retiolum.nix
+59
machines/barnacle/retiolum.nix
···
1
+
{
2
+
self,
3
+
config,
4
+
pkgs,
5
+
...
6
+
}:
7
+
8
+
# Retiolum node, driven by kartei's nix-darwin module (tincr + host data
9
+
# straight out of the kartei host database). The NixOS machines still go
10
+
# through 2configs/retiolum.nix and stockholm's older kartei pin; barnacle is
11
+
# the first node on the upstream modules.
12
+
let
13
+
net = "retiolum";
14
+
vars = config.clan.core.vars.generators.${net};
15
+
in
16
+
{
17
+
imports = [ self.inputs.kartei.darwinModules.retiolum ];
18
+
19
+
# nodename defaults to networking.hostName ("barnacle"); the addresses are
20
+
# looked up in kartei by that name.
21
+
#
22
+
# Pinned explicitly until krebs/kartei#lass-add-barnacle lands: without the
23
+
# card the module falls back to a hostname-derived IPv6 and no IPv4, which
24
+
# would re-address the running node. Drop both lines once the input carries
25
+
# the card -- the values are identical to lass/hosts/barnacle/retiolum/ip{4,6}.
26
+
networking.retiolum.ipv4 = "10.243.133.117";
27
+
networking.retiolum.ipv6 = "42:0:ce16::ba2c";
28
+
29
+
networking.retiolum.ed25519PrivateKeyFile = vars.files."${net}.ed25519_key.priv".path;
30
+
31
+
# Same generator as 2configs/retiolum.nix, minus the RSA half: tincr is
32
+
# SPTPS/Ed25519-only and kartei no longer wants an rsa.key.
33
+
#
34
+
# neededFor = "activation" because clan's /run/secrets installer is
35
+
# Linux-only (tmpfs + move-mount), so on darwin the key is deployed as a
36
+
# plain file below clan.core.vars.password-store.secretLocation.
37
+
#
38
+
# The public half is published in kartei as
39
+
# lass/hosts/barnacle/retiolum/ed25519.key; keep this script stable or the
40
+
# regenerated key will no longer match that card.
41
+
clan.core.vars.generators.${net} = {
42
+
files."${net}.ed25519_key.priv".neededFor = "activation";
43
+
files."${net}.ed25519_key.pub".secret = false;
44
+
runtimeInputs = [
45
+
pkgs.coreutils
46
+
self.packages.${pkgs.system}.tincr
47
+
];
48
+
# generate-ed25519-keys wants a Name in tinc.conf and writes the pubkey as
49
+
# a ready-made `Ed25519PublicKey = ...` line into hosts/$Name.
50
+
script = ''
51
+
mkdir -p "$out/hosts"
52
+
echo 'Name = ${config.networking.hostName}' >"$out/tinc.conf"
53
+
tinc --config "$out" generate-ed25519-keys
54
+
mv "$out/ed25519_key.priv" "$out/${net}.ed25519_key.priv"
55
+
mv "$out/hosts/${config.networking.hostName}" "$out/${net}.ed25519_key.pub"
56
+
rm -r "$out/tinc.conf" "$out/hosts"
57
+
'';
58
+
};
59
+
}