|
|
@@ -0,0 +1,62 @@ |
|
|
|
/* TODO: Translate this to a service/module at some point? Something like 'cryto.network' that handles all the internal-networking stuff. */ |
|
|
|
|
|
|
|
{ hostname, nodes, pingInterval ? 10 }: |
|
|
|
{ lib, ... }: let |
|
|
|
/* NOTE: We cannot just use simple string interpolation, because tinc's configuration format is not indentation-tolerant. Therefore, we do some programmatic concatenation magic to ensure that everything is indentation-free, without turning this file into a mess of wrong indentation. */ |
|
|
|
generateConfiguration = options: |
|
|
|
let |
|
|
|
keys = builtins.attrNames options; |
|
|
|
toPairs = map (key: {key = key; value = options.${key};}); |
|
|
|
createConfigEntries = map (item: "${item.key} = ${toString item.value}"); |
|
|
|
in |
|
|
|
builtins.concatStringsSep "\n" (createConfigEntries (toPairs keys)); |
|
|
|
in { |
|
|
|
deployment.secrets = { |
|
|
|
"tinc-key" = { |
|
|
|
source = "../private/${hostname}/tinc-key.priv"; |
|
|
|
destination = "/etc/tinc/cryto/ed25519_key.priv"; |
|
|
|
owner = { user = "tinc.cryto"; }; |
|
|
|
action = [ "systemctl" "restart" "tinc.cryto.service" ]; |
|
|
|
}; |
|
|
|
}; |
|
|
|
|
|
|
|
services.tinc.networks.cryto = { |
|
|
|
debugLevel = 3; |
|
|
|
|
|
|
|
extraConfig = generateConfiguration { |
|
|
|
AutoConnect = "yes"; |
|
|
|
PingInterval = pingInterval; |
|
|
|
}; |
|
|
|
|
|
|
|
hosts = let |
|
|
|
mapper = nodeName: nodeConfiguration: |
|
|
|
lib.nameValuePair |
|
|
|
/* NOTE: The below is because for a machine named `foo.bar-baz.net`, tinc expects a configuration file named `foo_bar_baz_net`. */ |
|
|
|
( builtins.replaceStrings [ "." "-" ] [ "_" "_" ] nodeName ) |
|
|
|
( generateConfiguration { |
|
|
|
# Address = nodeName; |
|
|
|
/* TODO: Figure out why a DNS name doesn't work here ("Error looking up machine-borg2-01.cryto.net port 655: Device or resource busy") */ |
|
|
|
Address = nodeConfiguration.ipv4; |
|
|
|
Subnet = "${nodeConfiguration.internalIpv4}/32"; |
|
|
|
Ed25519PublicKey = nodeConfiguration.tincPublicKey; |
|
|
|
} ); |
|
|
|
in lib.mapAttrs' mapper nodes; |
|
|
|
}; |
|
|
|
|
|
|
|
networking.interfaces."tinc.cryto".ipv4.addresses = [{ |
|
|
|
address = nodes.${hostname}.internalIpv4; |
|
|
|
prefixLength = 24; |
|
|
|
}]; |
|
|
|
|
|
|
|
networking.firewall = { |
|
|
|
allowedTCPPorts = [ |
|
|
|
655 |
|
|
|
]; |
|
|
|
allowedUDPPorts = [ |
|
|
|
655 |
|
|
|
]; |
|
|
|
trustedInterfaces = [ |
|
|
|
"tinc.cryto" |
|
|
|
]; |
|
|
|
}; |
|
|
|
} |