summaryrefslogtreecommitdiffstats
path: root/krebs
diff options
context:
space:
mode:
Diffstat (limited to 'krebs')
-rw-r--r--krebs/3modules/exim-retiolum.nix2
-rw-r--r--krebs/3modules/retiolum.nix299
2 files changed, 152 insertions, 149 deletions
diff --git a/krebs/3modules/exim-retiolum.nix b/krebs/3modules/exim-retiolum.nix
index d6b7ab753..fc127a414 100644
--- a/krebs/3modules/exim-retiolum.nix
+++ b/krebs/3modules/exim-retiolum.nix
@@ -37,7 +37,7 @@ let
config =
# This configuration makes only sense for retiolum-enabled hosts.
# TODO modular configuration
- assert config.krebs.retiolum.enable;
+ assert (lib.hasAttr "retiolum" config.krebs.tinc);
''
keep_environment =
diff --git a/krebs/3modules/retiolum.nix b/krebs/3modules/retiolum.nix
index 22991f093..1107e8575 100644
--- a/krebs/3modules/retiolum.nix
+++ b/krebs/3modules/retiolum.nix
@@ -1,130 +1,164 @@
{ config, pkgs, lib, ... }:
with config.krebs.lib;
let
- cfg = config.krebs.retiolum;
-
out = {
- options.krebs.retiolum = api;
- config = lib.mkIf cfg.enable imp;
+ options.krebs.tinc = api;
+ config = imp;
};
- api = {
- enable = mkEnableOption "krebs.retiolum";
-
- host = mkOption {
- type = types.host;
- default = config.krebs.build.host;
- };
-
- netname = mkOption {
- type = types.enum (attrNames cfg.host.nets);
- default = "retiolum";
- description = ''
- The tinc network name.
- It is used to name the TUN device and to generate the default value for
- <literal>config.krebs.retiolum.hosts</literal>.
- '';
- };
-
- extraConfig = mkOption {
- type = types.str;
- default = "";
- description = ''
- Extra Configuration to be appended to tinc.conf
- '';
- };
-
- tincPackage = mkOption {
- type = types.package;
- default = pkgs.tinc;
- description = "Tincd package to use.";
- };
-
- hosts = mkOption {
- type = with types; attrsOf host;
- default =
- filterAttrs (_: h: hasAttr cfg.netname h.nets) config.krebs.hosts;
- description = ''
- Hosts to generate <literal>config.krebs.retiolum.hostsPackage</literal>.
- Note that these hosts must have a network named
- <literal>config.krebs.retiolum.netname</literal>.
- '';
- };
-
- hostsPackage = mkOption {
- type = types.package;
- default = pkgs.stdenv.mkDerivation {
- name = "${cfg.netname}-tinc-hosts";
- phases = [ "installPhase" ];
- installPhase = ''
- mkdir $out
- ${concatStrings (mapAttrsToList (_: host: ''
- echo ${shell.escape host.nets.${cfg.netname}.tinc.config} \
- > $out/${shell.escape host.name}
- '') cfg.hosts)}
- '';
+ api = mkOption {
+ default = {};
+ description = ''
+ define a tinc network
+ '';
+ type = with types; attrsOf (submodule (tinc: {
+ options = {
+ host = mkOption {
+ type = types.host;
+ default = config.krebs.build.host;
+ };
+
+ netname = mkOption {
+ type = types.enum (attrNames tinc.config.host.nets);
+ default = tinc.config._module.args.name;
+ description = ''
+ The tinc network name.
+ It is used to name the TUN device and to generate the default value for
+ <literal>config.krebs.tinc.retiolum.hosts</literal>.
+ '';
+ };
+
+ extraConfig = mkOption {
+ type = types.str;
+ default = "";
+ description = ''
+ Extra Configuration to be appended to tinc.conf
+ '';
+ };
+
+ tincPackage = mkOption {
+ type = types.package;
+ default = pkgs.tinc;
+ description = "Tincd package to use.";
+ };
+
+ hosts = mkOption {
+ type = with types; attrsOf host;
+ default =
+ filterAttrs (_: h: hasAttr tinc.config.netname h.nets) config.krebs.hosts;
+ description = ''
+ Hosts to generate <literal>config.krebs.retiolum.hostsPackage</literal>.
+ Note that these hosts must have a network named
+ <literal>config.krebs.retiolum.netname</literal>.
+ '';
+ };
+
+ hostsPackage = mkOption {
+ type = types.package;
+ default = pkgs.stdenv.mkDerivation {
+ name = "${tinc.config.netname}-tinc-hosts";
+ phases = [ "installPhase" ];
+ installPhase = ''
+ mkdir $out
+ ${concatStrings (lib.mapAttrsToList (_: host: ''
+ echo ${shell.escape host.nets."${tinc.config.netname}".tinc.config} \
+ > $out/${shell.escape host.name}
+ '') tinc.config.hosts)}
+ '';
+ };
+ description = ''
+ Package of tinc host configuration files. By default, a package will
+ be generated from <literal>config.krebs.${tinc.config.netname}.hosts</literal>. This
+ option's main purpose is to expose the generated hosts package to other
+ modules, like <literal>config.krebs.tinc_graphs</literal>. But it can
+ also be used to provide a custom hosts directory.
+ '';
+ example = literalExample ''
+ (pkgs.stdenv.mkDerivation {
+ name = "my-tinc-hosts";
+ src = /home/tv/my-tinc-hosts;
+ installPhase = "cp -R . $out";
+ })
+ '';
+ };
+
+ iproutePackage = mkOption {
+ type = types.package;
+ default = pkgs.iproute;
+ description = "Iproute2 package to use.";
+ };
+
+ privkey = mkOption {
+ type = types.secret-file;
+ default = {
+ path = "${tinc.config.user.home}/tinc.rsa_key.priv";
+ owner = tinc.config.user;
+ source-path = toString <secrets> + "/${tinc.config.netname}.rsa_key.priv";
+ };
+ };
+
+ connectTo = mkOption {
+ type = types.listOf types.str;
+ default = [ "fastpoke" "cd" "prism" "gum" ];
+ description = ''
+ The list of hosts in the network which the client will try to connect
+ to. These hosts should have an 'Address' configured which points to a
+ routeable IPv4 or IPv6 address.
+
+ In stockholm this can be done by configuring:
+ krebs.hosts.${connect-host}.nets.${netname?"retiolum"}.via.addrs4 =
+ [ "${external-ip} ${external-port}" ]
+ '';
+ };
+
+ user = mkOption {
+ type = types.user;
+ default = {
+ name = tinc.config.netname;
+ home = "/var/lib/${tinc.config.user.name}";
+ };
+ };
};
- description = ''
- Package of tinc host configuration files. By default, a package will
- be generated from <literal>config.krebs.retiolum.hosts</literal>. This
- option's main purpose is to expose the generated hosts package to other
- modules, like <literal>config.krebs.tinc_graphs</literal>. But it can
- also be used to provide a custom hosts directory.
+ }));
+ };
+ imp = lib.mkMerge ( lib.mapAttrsToList (netname: cfg:
+ let
+ net = cfg.host.nets.${netname};
+
+ tinc = cfg.tincPackage;
+
+ iproute = cfg.iproutePackage;
+
+ confDir = let
+ namePathPair = name: path: { inherit name path; };
+ in pkgs.linkFarm "${netname}-etc-tinc" (lib.mapAttrsToList namePathPair {
+ "hosts" = cfg.hostsPackage;
+ "tinc.conf" = pkgs.writeText "${cfg.netname}-tinc.conf" ''
+ Name = ${cfg.host.name}
+ Interface = ${netname}
+ ${concatStrings (map (c: "ConnectTo = ${c}\n") cfg.connectTo)}
+ PrivateKeyFile = ${cfg.privkey.path}
+ ${cfg.extraConfig}
'';
- example = literalExample ''
- (pkgs.stdenv.mkDerivation {
- name = "my-tinc-hosts";
- src = /home/tv/my-tinc-hosts;
- installPhase = "cp -R . $out";
- })
+ "tinc-up" = pkgs.writeDash "${netname}-tinc-up" ''
+ ${iproute}/sbin/ip link set ${netname} up
+ ${optionalString (net.ip4 != null) /* sh */ ''
+ ${iproute}/sbin/ip -4 addr add ${net.ip4.addr} dev ${netname}
+ ${iproute}/sbin/ip -4 route add ${net.ip4.prefix} dev ${netname}
+ ''}
+ ${optionalString (net.ip6 != null) /* sh */ ''
+ ${iproute}/sbin/ip -6 addr add ${net.ip6.addr} dev ${netname}
+ ${iproute}/sbin/ip -6 route add ${net.ip6.prefix} dev ${netname}
+ ''}
'';
- };
-
- iproutePackage = mkOption {
- type = types.package;
- default = pkgs.iproute;
- description = "Iproute2 package to use.";
- };
-
- privkey = mkOption {
- type = types.secret-file;
- default = {
- path = "${cfg.user.home}/tinc.rsa_key.priv";
- owner = cfg.user;
- source-path = toString <secrets> + "/${cfg.netname}.rsa_key.priv";
- };
- };
-
- connectTo = mkOption {
- type = types.listOf types.str;
- default = [ "fastpoke" "cd" "prism" "gum" ];
- description = ''
- The list of hosts in the network which the client will try to connect
- to. These hosts should have an 'Address' configured which points to a
- routeable IPv4 or IPv6 address.
-
- In stockholm this can be done by configuring:
- krebs.hosts.${connect-host}.nets.${netname?"retiolum"}.via.addrs4 =
- [ "${external-ip} ${external-port}" ]
- '';
- };
-
- user = mkOption {
- type = types.user;
- default = {
- name = cfg.netname;
- home = "/var/lib/${cfg.user.name}";
- };
- };
- };
-
- imp = {
- krebs.secret.files."${cfg.netname}.rsa_key.priv" = cfg.privkey;
+ });
+ in {
+ krebs.secret.files."${netname}.rsa_key.priv" = cfg.privkey;
environment.systemPackages = [ tinc iproute ];
- systemd.services.${cfg.netname} = {
- description = "Tinc daemon for Retiolum";
+ systemd.services.${netname} = {
+ description = "Tinc daemon for ${netname}";
after = [ "network.target" ];
wantedBy = [ "multi-user.target" ];
requires = [ "secret.service" ];
@@ -132,7 +166,7 @@ let
serviceConfig = rec {
Restart = "always";
ExecStart = "${tinc}/sbin/tincd -c ${confDir} -d 0 -U ${cfg.user.name} -D --pidfile=/var/run/tinc.${SyslogIdentifier}.pid";
- SyslogIdentifier = cfg.netname;
+ SyslogIdentifier = netname;
};
};
@@ -140,36 +174,5 @@ let
inherit (cfg.user) home name uid;
createHome = true;
};
- };
-
- net = cfg.host.nets.${cfg.netname};
-
- tinc = cfg.tincPackage;
-
- iproute = cfg.iproutePackage;
-
- confDir = let
- namePathPair = name: path: { inherit name path; };
- in pkgs.linkFarm "${cfg.netname}-etc-tinc" (mapAttrsToList namePathPair {
- "hosts" = cfg.hostsPackage;
- "tinc.conf" = pkgs.writeText "${cfg.netname}-tinc.conf" ''
- Name = ${cfg.host.name}
- Interface = ${cfg.netname}
- ${concatStrings (map (c: "ConnectTo = ${c}\n") cfg.connectTo)}
- PrivateKeyFile = ${cfg.privkey.path}
- ${cfg.extraConfig}
- '';
- "tinc-up" = pkgs.writeDash "${cfg.netname}-tinc-up" ''
- ${iproute}/sbin/ip link set ${cfg.netname} up
- ${optionalString (net.ip4 != null) /* sh */ ''
- ${iproute}/sbin/ip -4 addr add ${net.ip4.addr} dev ${cfg.netname}
- ${iproute}/sbin/ip -4 route add ${net.ip4.prefix} dev ${cfg.netname}
- ''}
- ${optionalString (net.ip6 != null) /* sh */ ''
- ${iproute}/sbin/ip -6 addr add ${net.ip6.addr} dev ${cfg.netname}
- ${iproute}/sbin/ip -6 route add ${net.ip6.prefix} dev ${cfg.netname}
- ''}
- '';
- });
-
+ }) {} ); # TODO <<<< replace with the "config.krebs.tinc" and avoid infinite recursion
in out
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-01 08:32:19 +0000