# shared tinc file between client and server
{ config, pkgs, lib, ... }:

{

  imports = [ <cluster-module> ];

  networking.firewall.trustedInterfaces = [ "tinc.private" ];

  # nix-shell -p tinc_pre --run "tinc --config . generate-keys 4096"
  module.cluster.services.tinc = {
    "test" = {
      networkSubnet = "10.123.142.0/24";
      extraConfig = ''
        LocalDiscovery = yes
      '';
      privateEd25519KeyFile = toString <assets/tinc/ed25519_key>;
      privateRsaKeyFile = toString <assets/tinc/rsa_key>;
      hosts = {
        server = {
          tincIp = "10.123.142.1";
          publicKey = lib.fileContents <assets/tinc/server_host_file>;
        };
        client = {
          tincIp = "10.123.142.100";
          publicKey = lib.fileContents <assets/tinc/client_host_file>;
        };
      };
    };
  };
}