nixos-config/nixos/components/network/tinc/private.nix

110 lines
3.3 KiB
Nix
Raw Normal View History

2023-01-26 21:29:47 +01:00
{ ipv4
, ipv6
, config
, optionalString
, concatStringsSep
, mapAttrsToList
, ...
}:
let
hosts = {
mobi = "10.23.42.23";
sterni = "10.23.42.24";
bobi = "10.23.42.25";
pepe = "10.23.42.26";
robi = "10.23.42.111";
};
subDomains = {
2023-02-08 00:19:09 +01:00
# robi
2023-01-26 21:29:47 +01:00
"transmission.robi" = hosts.robi;
"transmission2.robi" = hosts.robi;
2023-02-02 20:13:10 +01:00
"loki.robi" = hosts.robi;
2023-02-08 00:19:09 +01:00
"grafana.robi" = hosts.robi;
"prometheus.robi" = hosts.robi;
# pepe
2023-02-02 20:13:10 +01:00
"loki.pepe" = hosts.pepe;
2023-02-07 21:56:04 +01:00
"grafana.pepe" = hosts.pepe;
"prometheus.pepe" = hosts.pepe;
2023-02-05 06:21:10 +01:00
"tts.pepe" = hosts.pepe;
2023-01-26 21:29:47 +01:00
};
network = "private";
in
2022-10-13 10:51:21 +02:00
{
2023-01-26 21:29:47 +01:00
networking.firewall.trustedInterfaces = [ "tinc.${network}" ];
2022-10-13 10:51:21 +02:00
2023-01-26 21:29:47 +01:00
sops.secrets.tinc_ed25519_key = { };
2022-10-13 10:51:21 +02:00
2023-01-26 21:29:47 +01:00
services.tinc.networks = {
${network} = {
ed25519PrivateKeyFile = config.sops.secrets.tinc_ed25519_key.path;
interfaceType = "tap";
extraConfig = ''
LocalDiscovery = yes
'';
hostSettings = {
mobi = {
subnets = [{ address = hosts.mobi; }];
settings.Ed25519PublicKey = "X5sp3YYevVNUrzYvi+HZ2iW5WbO0bIb58jR4jZFH6MB";
};
sterni = {
subnets = [{ address = hosts.sterni; }];
settings.Ed25519PublicKey = "r6mRDc814z2YtyG9ev/XXV2SgquqWR8n53V13xNXb7O";
};
bobi = {
subnets = [{ address = hosts.bobi; }];
settings.Ed25519PublicKey = "jwvNd4oAgz2cWEI74VTVYU1qgPWq823/a0iEDqJ8KMD";
};
pepe = {
subnets = [{ address = hosts.pepe; }];
settings.Ed25519PublicKey = "LnE+w6ZfNCky4Kad3TBxpFKRJ2PJshkSpW6mC3pcsPI";
};
robi = {
addresses = [{ address = "144.76.13.147"; }];
subnets = [{ address = hosts.robi; }];
settings.Ed25519PublicKey = "bZUbSdME4fwudNVbUoNO7PpoOS2xALsyTs81F260KbL";
};
};
};
2022-10-13 10:51:21 +02:00
};
2023-01-26 21:29:47 +01:00
systemd.network.enable = true;
systemd.network.networks.${network}.extraConfig = ''
[Match]
Name = tinc.${network}
[Link]
# tested with `ping -6 turingmachine.r -s 1378`, not sure how low it must be
MTUBytes=1377
[Network]
${optionalString (ipv4 != null) "Address=${ipv4}/24"}
${optionalString (ipv6 != null) "Address=${ipv6}/28"}
RequiredForOnline = no
LinkLocalAddressing = no
'';
networking.extraHosts = concatStringsSep "\n" (mapAttrsToList (name: ip: "${ip} ${name}.${network}") (hosts // subDomains));
services.openssh.knownHosts = {
"robi" = {
hostNames = [ "robi.${network}" hosts.robi ];
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK2PGX6cZuBUGX4VweMzi0aRh4uQ61yngCzZGcK3w5XV";
};
"sterni.${network}" = {
hostNames = [ "sterni.${network}" hosts.sterni ];
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEQRH4gzT4vWSx3KN80ePPYhSPZRUae/qSyEym6pJTht";
};
"pepe.${network}" = {
hostNames = [ "pepe.${network}" hosts.pepe ];
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJPlva+Vdj8WmQPlbQLN3qicMz5AAsyTzK53BincxtAz";
};
"bobi.${network}" = {
hostNames = [ "bobi.${network}" hosts.bobi ];
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK0haepNVEaocfWh6kwVc4QsSg2iqO5k+hjarphBqMVk";
};
"mobi.${network}" = {
hostNames = [ "mobi.${network}" hosts.mobi ];
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE3G7TwCoxcVfwhGL0913RtacEeokqKtufhzzkCxpPxk";
2022-10-13 10:51:21 +02:00
};
};
}