{ config, pkgs, lib, ... }: with lib; let hosts = import ./hosts; cfg = config.services.my-tinc; hostNames = builtins.attrNames hosts; in { imports = [ ./hosts.nix ]; options.services.my-tinc = { enable = mkEnableOption "my private tinc cloud configuration"; rsaPrivateKey = mkOption { type = types.nullOr types.path; default = null; example = "./my-key.priv"; description = "The key file to be used as the private key"; }; ed25519PrivateKey = mkOption { type = types.nullOr types.path; default = null; example = "./my-key-ed25519.priv"; description = "The key file to be used as the private key"; }; hostName = mkOption { type = types.enum hostNames; description = "The configured host name"; }; bindPort = mkOption { type = types.port; default = 655; description = "The port to listen on"; }; }; config = mkIf cfg.enable (builtins.seq (mkIf (isNull cfg.rsaPrivateKey && isNull cfg.ed25519PrivateKey) (builtins.abort "one of the keys must be defined")) ( let networkName = "my-tinc"; myHost = builtins.getAttr cfg.hostName hosts; myMeshIp = myHost.subnetAddr; in { # Scripts that set up the tinc services environment.etc = { "tinc/${networkName}/tinc-up".source = pkgs.writeScript "tinc-up-${networkName}" '' #!${pkgs.stdenv.shell} ${pkgs.nettools}/bin/ifconfig $INTERFACE ${myMeshIp} netmask 255.255.255.0 ''; "tinc/${networkName}/tinc-down".source = pkgs.writeScript "tinc-down-${networkName}" '' #!${pkgs.stdenv.shell} /run/wrappers/bin/sudo ${pkgs.nettools}/bin/ifconfig $INTERFACE down ''; }; # Allow the tinc service to call ifconfig without sudo password. security.sudo.extraRules = [ { users = [ "tinc.${networkName}" ]; commands = [ { command = "${pkgs.nettools}/bin/ifconfig"; options = [ "NOPASSWD" ]; } ]; } ]; # simple interface setup # ---------------------- networking.interfaces."tinc.${networkName}".ipv4.addresses = [{ address = myMeshIp; prefixLength = 24; }]; # firewall networking.firewall.allowedUDPPorts = [ 655 ]; networking.firewall.allowedTCPPorts = [ 655 ]; networking.firewall.interfaces."tinc.${networkName}" = { allowedUDPPortRanges = [{ from = 0; to = 65535; }]; allowedTCPPortRanges = [{ from = 0; to = 65535; }]; }; # configure tinc service # ---------------------- services.tinc.networks."${networkName}" = { name = cfg.hostName; # who are we in this network. debugLevel = 3; # the debug level for journal -u tinc.private chroot = false; # otherwise addresses can't be a DNS interfaceType = "tap"; # tun might also work. bindToAddress = "* ${toString cfg.bindPort}"; ed25519PrivateKeyFile = cfg.ed25519PrivateKey; rsaPrivateKeyFile = cfg.rsaPrivateKey; settings.ExperimentalProtocol = "yes"; }; } ) ); }