nixos-config/nixos/system/all/tinc.nix

158 lines
4.9 KiB
Nix
Raw Normal View History

2019-10-24 02:20:38 +02:00
{ config, pkgs, lib, ... }:
let
retiolum = pkgs.fetchgit {
url = "https://github.com/krebs/retiolum";
rev = "5b067937a10ea43f88f14cc6e0a5485c2ddcc826";
sha256 = "0kczrr6dr5dmhx2kbanw46w6ig2v3w42rqhjanv87xhwkgw81l08";
2019-10-24 02:20:38 +02:00
};
2021-11-01 09:20:42 +01:00
in
{
2019-10-24 02:20:38 +02:00
2021-09-25 11:07:09 +02:00
imports = [ ../../modules ];
2019-10-24 02:20:38 +02:00
networking.firewall.trustedInterfaces = [ "tinc.private" ];
2022-01-09 19:22:12 +01:00
users.users."tinc.private".group = "tinc.private";
users.groups."tinc.private" = { };
2022-02-07 19:13:27 +01:00
users.users."tinc.private".isSystemUser = lib.mkDefault true;
2022-01-09 19:22:12 +01:00
2019-10-24 02:20:38 +02:00
# nix-shell -p tinc_pre --run "tinc --config . generate-keys 4096"
module.cluster.services.tinc = {
"retiolum" = {
networkSubnet = "10.243.0.0/16";
port = 720;
extraConfig = ''
LocalDiscovery = yes
AutoConnect = yes
'';
privateEd25519KeyFile =
2021-10-10 19:06:24 +02:00
toString config.sops.secrets.tinc_retiolum_ed25519_key.path;
privateRsaKeyFile = toString config.sops.secrets.tinc_retiolum_rsa_key.path;
2019-10-24 02:20:38 +02:00
hosts = {
pepe = {
tincIp = "10.243.23.1";
publicKey = lib.fileContents ../../assets/tinc/retiolum/host_file;
2019-10-24 02:20:38 +02:00
};
sterni = {
tincIp = "10.243.23.3";
publicKey = lib.fileContents ../../assets/tinc/retiolum/host_file;
2019-10-24 02:20:38 +02:00
};
workhorse = {
tincIp = "10.243.23.5";
publicKey = lib.fileContents ../../assets/tinc/retiolum/host_file;
2019-10-24 02:20:38 +02:00
};
workout = {
tincIp = "10.243.23.4";
publicKey = lib.fileContents ../../assets/tinc/retiolum/host_file;
2019-10-24 02:20:38 +02:00
};
};
};
2020-01-24 11:19:48 +01:00
# nix-shell -p tinc_pre --run "tinc --config . generate-keys 4096"
2021-03-05 08:22:35 +01:00
"secret" = {
2020-02-03 03:38:22 +01:00
networkSubnet = "10.123.42.0/24";
port = 721;
extraConfig = ''
LocalDiscovery = yes
AutoConnect = yes
'';
privateEd25519KeyFile =
toString config.sops.secrets.tinc_ed25519_key.path;
privateRsaKeyFile = toString config.sops.secrets.tinc_rsa_key.path;
2020-02-03 03:38:22 +01:00
hosts = {
2021-03-05 08:22:35 +01:00
sternchen = {
tincIp = "10.123.42.25";
publicKey = lib.fileContents ../../assets/tinc/sternchen_host_file;
2021-03-05 08:22:35 +01:00
};
2020-02-03 03:38:22 +01:00
sterni = {
tincIp = "10.123.42.24";
publicKey = lib.fileContents ../../assets/tinc/workout_host_file;
2020-02-03 03:38:22 +01:00
};
porani = {
tincIp = "10.123.42.31";
publicKey = lib.fileContents ../../assets/tinc/porani_host_file;
2020-02-03 03:38:22 +01:00
};
workhorse = {
tincIp = "10.123.42.21";
publicKey = lib.fileContents ../../assets/tinc/workhorse_host_file;
2020-02-03 03:38:22 +01:00
};
sputnik = {
2020-02-03 05:21:27 +01:00
realAddress = [ "static.247.134.201.195.clients.your-server.de:721" ];
2020-02-03 03:38:22 +01:00
tincIp = "10.123.42.122";
publicKey = lib.fileContents ../../assets/tinc/sputnik_host_file;
2020-02-03 03:38:22 +01:00
};
2022-02-07 19:13:27 +01:00
robi = {
realAddress = [ "144.76.13.147" ];
tincIp = "10.123.42.123";
publicKey = lib.fileContents ../../assets/tinc/robi_host_file;
};
2020-02-03 03:38:22 +01:00
};
};
# nix-shell -p tinc_pre --run "tinc --config . generate-keys 4096"
2019-10-24 02:20:38 +02:00
"private" = {
networkSubnet = "10.23.42.0/24";
extraConfig = ''
LocalDiscovery = yes
'';
2021-12-28 16:19:29 +01:00
privateEd25519KeyFile = toString config.sops.secrets.tinc_ed25519_key.path;
privateRsaKeyFile = toString config.sops.secrets.tinc_rsa_key.path;
2019-10-24 02:20:38 +02:00
hosts = {
workout = {
tincIp = "10.23.42.27";
publicKey = lib.fileContents ../../assets/tinc/workout_host_file;
2019-10-24 02:20:38 +02:00
};
pepe = {
tincIp = "10.23.42.26";
publicKey = lib.fileContents ../../assets/tinc/pepe_host_file;
2019-10-24 02:20:38 +02:00
};
sterni = {
tincIp = "10.23.42.24";
publicKey = lib.fileContents ../../assets/tinc/workout_host_file;
2019-10-24 02:20:38 +02:00
};
2020-01-24 11:19:48 +01:00
mobi = {
tincIp = "10.23.42.23";
publicKey = lib.fileContents ../../assets/tinc/mobi_host_file;
2020-01-24 11:19:48 +01:00
};
2020-02-03 05:21:27 +01:00
#porani = {
# tincIp = "10.23.42.31";
# publicKey = lib.fileContents ../../assets/tinc/porani_host_file;
2020-02-03 05:21:27 +01:00
#};
2019-10-24 02:20:38 +02:00
workhorse = {
tincIp = "10.23.42.21";
publicKey = lib.fileContents ../../assets/tinc/workhorse_host_file;
2019-10-24 02:20:38 +02:00
};
2021-12-28 16:19:29 +01:00
robi = {
2021-12-28 19:48:14 +01:00
realAddress = [ "144.76.13.147" ];
2021-12-28 16:19:29 +01:00
tincIp = "10.23.42.111";
publicKey = lib.fileContents ../../assets/tinc/robi_host_file;
};
2019-10-24 02:20:38 +02:00
sputnik = {
realAddress = [
2020-04-12 13:36:15 +02:00
"195.201.134.247"
"195.201.134.247:443"
2020-03-21 09:36:49 +01:00
"static.247.134.201.195.clients.your-server.de"
2019-10-24 02:20:38 +02:00
"static.247.134.201.195.clients.your-server.de:443"
];
tincIp = "10.23.42.122";
publicKey = lib.fileContents ../../assets/tinc/sputnik_host_file;
2019-10-24 02:20:38 +02:00
};
};
};
};
sops.secrets.tinc_ed25519_key = { };
sops.secrets.tinc_rsa_key = { };
2019-10-24 02:20:38 +02:00
# retiolum stuff
networking.extraHosts = builtins.readFile (toString "${retiolum}/etc.hosts");
systemd.services."tinc.retiolum" = {
preStart = ''
cp -R ${retiolum}/hosts /etc/tinc/retiolum/ || true
'';
};
}