From 3feb1de94aae4d978207ad8a73f0c78efd817bb9 Mon Sep 17 00:00:00 2001
From: Gregor Kleen <gkleen@yggdrasil.li>
Date: Sun, 29 Oct 2017 01:52:59 +0200
Subject: Use sudo

---
 custom/tinc/yggdrasil.nix | 61 +++++++++++++++++++++++++++--------------------
 1 file changed, 35 insertions(+), 26 deletions(-)

(limited to 'custom/tinc')

diff --git a/custom/tinc/yggdrasil.nix b/custom/tinc/yggdrasil.nix
index 035b9b10..d4bf26f1 100644
--- a/custom/tinc/yggdrasil.nix
+++ b/custom/tinc/yggdrasil.nix
@@ -4,8 +4,26 @@ with lib;
 
 let
   cfg = config.services.yggdrasilTinc;
-in {
 
+  borealis-up = pkgs.writeScript "borealis-up.sh" ''
+    #!${pkgs.stdenv.shell}
+    ${pkgs.nettools}/bin/route add -net 10.141.1.0 netmask 255.255.255.0 gw 10.141.1.1 dev $INTERFACE metric 9999
+    ${optionalString cfg.useDNS ''
+      ${pkgs.openresolv}/bin/resolvconf -m 0 -a tinc.yggdrasil <<EOF
+      domain yggdrasil
+      nameserver 10.141.1.1
+      EOF
+    ''}
+  '';
+
+  borealis-down = pkgs.writeScript "borealis-down.sh" ''
+    #!${pkgs.stdenv.shell}
+    ${pkgs.nettools}/bin/route del -net 10.141.1.0 netmask 255.255.255.0 gw 10.141.1.1 dev $INTERFACE
+    ${optionalString cfg.useDNS ''
+      ${pkgs.openresolv}/bin/resolvconf -d tinc.yggdrasil
+    ''}
+  '';
+in {
   options = {
     services.yggdrasilTinc = {
       enable = mkEnableOption "yggdrasil tinc network";
@@ -20,7 +38,7 @@ in {
 
       useDNS = mkOption {
         default = true;
-        types = types.bool;
+        type = types.bool;
         description = ''
           Use borealis as primary dns server
         '';
@@ -28,7 +46,7 @@ in {
 
       name = mkOption {
         default = config.networking.hostName;
-        types = types.str;
+        type = types.str;
         description = ''
           Node identifier
         '';
@@ -44,6 +62,13 @@ in {
   };
 
   config = mkIf cfg.enable {
+    security.sudo = {
+      enable = true;
+      extraConfig = ''
+        tinc.yggdrasil ${config.networking.hostName} = (root) ${borealis-up}, ${borealis-down}
+      '';
+    };
+  
     services.customTinc.networks."yggdrasil" = {
       inherit (cfg) name interfaceConfig;
       debugLevel = 2;
@@ -53,31 +78,15 @@ in {
         ${optionalString cfg.connect "ConnectTo = ymir"}
       '';
       scripts = {
-        "hosts/borealis-up" = "${config.security.wrapperDir}/borealis-up";
-        "hosts/borealis-down" = "${config.security.wrapperDir}/borealis-down";
-      };
-    };
+        "hosts/borealis-up" = ''
+          #!${pkgs.stdenv.shell}
 
-    security.wrappers = {
-      "borealis-up" = {
-        source = pkgs.writeScript "borealis-up.sh" ''
-          #!${stdenv.shell}
-          ${nettools}/bin/route add -net 10.141.1.0 netmask 255.255.255.0 gw 10.141.1.1 dev $INTERFACE metric 9999
-          ${optionalString cfg.useDNS ''
-            ${openresolv}/bin/resolvconf -m 0 -a tinc.yggdrasil <<EOF
-            domain yggdrasil
-            nameserver 10.141.1.1
-            EOF
-          ''}
+          exec ${pkgs.sudo}/bin/sudo ${borealis-up}
         '';
-      };
-      "borealis-down" = {
-        source = pkgs.writeScript "borealis-down.sh" ''
-          #!${stdenv.shell}
-          ${nettools}/bin/route del -net 10.141.1.0 netmask 255.255.255.0 gw 10.141.1.1 dev $INTERFACE
-          ${optionalString cfg.useDNS ''
-            ${openresolv}/bin/resolvconf -d tinc.yggdrasil
-          ''}
+        "hosts/borealis-down" = ''
+          #!${pkgs.stdenv.shell}
+
+          exec ${pkgs.sudo}/bin/sudo ${borealis-down}
         '';
       };
     };
-- 
cgit v1.2.3