{ ipv4 , ipv6 , config , optionalString , concatStringsSep , mapAttrsToList , ... }: let hosts = { mobi = "10.23.42.23"; sterni = "10.23.42.24"; bobi = "10.23.42.25"; pepe = "10.23.42.26"; cream = "10.23.42.27"; chungus = "10.23.42.28"; robi = "10.23.42.111"; }; subDomains = { # robi "grafana.robi" = hosts.robi; "loki.robi" = hosts.robi; "prometheus.robi" = hosts.robi; "sync.robi" = hosts.robi; "transmission.robi" = hosts.robi; "transmission2.robi" = hosts.robi; # pepe "grafana.pepe" = hosts.pepe; "loki.pepe" = hosts.pepe; "prometheus.pepe" = hosts.pepe; "tdarr.pepe" = hosts.pepe; "tts.pepe" = hosts.pepe; # chungus "de.tts.chungus" = hosts.chungus; "en.tts.chungus" = hosts.chungus; "flix.chungus" = hosts.chungus; "git.chungus" = hosts.chungus; "grafana.chungus" = hosts.chungus; "loki.chungus" = hosts.chungus; "prometheus.chungus" = hosts.chungus; "s3.chungus" = hosts.chungus; "sync.chungus" = hosts.chungus; "tdarr.chungus" = hosts.chungus; "trilium.chungus" = hosts.chungus; "tts.chungus" = hosts.chungus; # cream "trilium.cream" = hosts.cream; }; network = "private"; in { networking.firewall.trustedInterfaces = [ "tinc.${network}" ]; sops.secrets.tinc_ed25519_key = { }; # nix-shell -p tinc_pre --run "tinc --config . generate-keys 4096" services.tinc.networks = { ${network} = { ed25519PrivateKeyFile = config.sops.secrets.tinc_ed25519_key.path; interfaceType = "tap"; extraConfig = '' LocalDiscovery = yes ''; hostSettings = { mobi = { subnets = [{ address = hosts.mobi; }]; settings.Ed25519PublicKey = "X5sp3YYevVNUrzYvi+HZ2iW5WbO0bIb58jR4jZFH6MB"; }; cream = { subnets = [{ address = hosts.cream; }]; settings.Ed25519PublicKey = "Y/YRA90mAlNEmdhUWlUTHjjsco6d6hlvW11sPtarIdL"; }; sterni = { subnets = [{ address = hosts.sterni; }]; settings.Ed25519PublicKey = "r6mRDc814z2YtyG9ev/XXV2SgquqWR8n53V13xNXb7O"; }; bobi = { subnets = [{ address = hosts.bobi; }]; settings.Ed25519PublicKey = "jwvNd4oAgz2cWEI74VTVYU1qgPWq823/a0iEDqJ8KMD"; }; pepe = { subnets = [{ address = hosts.pepe; }]; settings.Ed25519PublicKey = "LnE+w6ZfNCky4Kad3TBxpFKRJ2PJshkSpW6mC3pcsPI"; }; chungus = { subnets = [{ address = hosts.chungus; }]; settings.Ed25519PublicKey = "mJP+zzYGv42KItpSf3lMkr3dwa5xW3n3hi0W2Z75jfJ"; }; robi = { addresses = [{ address = "144.76.13.147"; }]; subnets = [{ address = hosts.robi; }]; settings.Ed25519PublicKey = "bZUbSdME4fwudNVbUoNO7PpoOS2xALsyTs81F260KbL"; }; }; }; }; systemd.network.enable = true; systemd.network.networks.${network}.extraConfig = '' [Match] Name = tinc.${network} [Link] # tested with `ping -6 turingmachine.r -s 1378`, not sure how low it must be MTUBytes=1377 [Network] ${optionalString (ipv4 != null) "Address=${ipv4}/24"} ${optionalString (ipv6 != null) "Address=${ipv6}/28"} RequiredForOnline = no LinkLocalAddressing = no ''; networking.extraHosts = concatStringsSep "\n" (mapAttrsToList (name: ip: "${ip} ${name}.${network}") (hosts // subDomains)); services.openssh.knownHosts = { "robi" = { hostNames = [ "robi.${network}" hosts.robi ]; publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK2PGX6cZuBUGX4VweMzi0aRh4uQ61yngCzZGcK3w5XV"; }; "sterni.${network}" = { hostNames = [ "sterni.${network}" hosts.sterni ]; publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEQRH4gzT4vWSx3KN80ePPYhSPZRUae/qSyEym6pJTht"; }; "cream.${network}" = { hostNames = [ "cream.${network}" hosts.cream ]; publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIConHiCL7INgAhuN6Z9TqP0zP+xNpdV7+OHwUca4IRDD"; }; "pepe.${network}" = { hostNames = [ "pepe.${network}" hosts.pepe ]; publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJPlva+Vdj8WmQPlbQLN3qicMz5AAsyTzK53BincxtAz"; }; "chungus.${network}" = { hostNames = [ "chungus.${network}" hosts.chungus ]; publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP9jrbOJbgapreRjttyOKWv5vxGMThn7kAwlk8WnSyL9"; }; "bobi.${network}" = { hostNames = [ "bobi.${network}" hosts.bobi ]; publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK0haepNVEaocfWh6kwVc4QsSg2iqO5k+hjarphBqMVk"; }; "mobi.${network}" = { hostNames = [ "mobi.${network}" hosts.mobi ]; publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE3G7TwCoxcVfwhGL0913RtacEeokqKtufhzzkCxpPxk"; }; }; }