{ config, lib, pkgs, ... }: { networking.firewall.trustedInterfaces = [ "tinc.private" ]; users.groups."tinc.private" = { }; users.users."tinc.private" = { group = "tinc.private"; isSystemUser = lib.mkDefault true; }; # nix-shell -p tinc_pre --run "tinc --config . generate-keys 4096" module.cluster.services.tinc."private" = { networkSubnet = "10.23.42.0/24"; extraConfig = '' LocalDiscovery = yes ''; privateEd25519KeyFile = toString config.sops.secrets.tinc_ed25519_key.path; privateRsaKeyFile = toString config.sops.secrets.tinc_rsa_key.path; hosts = { pepe = { tincIp = "10.23.42.26"; publicKey = lib.fileContents ../../../assets/tinc/pepe_host_file; }; sterni = { tincIp = "10.23.42.24"; publicKey = lib.fileContents ../../../assets/tinc/workout_host_file; }; mobi = { tincIp = "10.23.42.23"; publicKey = lib.fileContents ../../../assets/tinc/mobi_host_file; }; bobi = { tincIp = "10.23.42.25"; publicKey = lib.fileContents ../../../assets/tinc/bobi_host_file; }; robi = { realAddress = [ "144.76.13.147" ]; tincIp = "10.23.42.111"; publicKey = lib.fileContents ../../../assets/tinc/robi_host_file; }; }; }; }