summaryrefslogtreecommitdiff
path: root/custom/tinc/yggdrasil.nix
blob: 34933a198f13ec1c87c8c452c5e1e5046f653298 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
{ config, lib, pkgs, ... }:

with lib;

let
  cfg = config.services.yggdrasilTinc;

  heimdallr-up = pkgs.writeScript "heimdallr-up.sh" ''
    #!${pkgs.stdenv.shell}
    ${pkgs.nettools}/bin/route add -net 10.141.1.0 netmask 255.255.255.0 gw 10.141.1.1 dev $INTERFACE metric 9999
    ${optionalString cfg.useDNS ''
      ${pkgs.openresolv}/bin/resolvconf -m 0 -a yggdrasil <<EOF
      domain yggdrasil
      nameserver 10.141.1.1
      EOF
    ''}
  '';

  heimdallr-down = pkgs.writeScript "heimdallr-down.sh" ''
    #!${pkgs.stdenv.shell}
    ${pkgs.nettools}/bin/route del -net 10.141.1.0 netmask 255.255.255.0 gw 10.141.1.1 dev $INTERFACE
    ${optionalString cfg.useDNS ''
      ${pkgs.openresolv}/bin/resolvconf -d yggdrasil
    ''}
  '';
in {
  options = {
    services.yggdrasilTinc = {
      enable = mkEnableOption "yggdrasil tinc network";
      
      connect = mkOption {
        default = true;
        type = types.bool;
        description = ''
          Connect to central server
        '';
      };

      useDNS = mkOption {
        default = true;
        type = types.bool;
        description = ''
          Use heimdallr as primary dns server
        '';
      };

      name = mkOption {
        default = config.networking.hostName;
        type = types.str;
        description = ''
          Node identifier
        '';
      };

      interfaceConfig = mkOption {
        default = {};
        description = ''
          Additional configuration for the generated network interface
        '';
      };
    };
  };

  config = mkIf cfg.enable {
    security.sudo = {
      enable = true;
      extraConfig = ''
        tinc.yggdrasil ${config.networking.hostName} = (root) NOPASSWD: SETENV: ${heimdallr-up}, ${heimdallr-down}
      '';
    };
  
    services.customTinc.networks."yggdrasil" = {
      inherit (cfg) name interfaceConfig;
      debugLevel = 2;
      hosts = import ../../yggdrasil/hosts.nix;
      interfaceType = "tap";
      extraConfig = ''
        Mode = switch
        PingTimeout = 30
        ${optionalString cfg.connect "ConnectTo = ymir"}
      '';
      scripts = {
        "tinc-up" = ''
          #!${pkgs.stdenv.shell}

          set -e
          MACFILE="/var/db/$NETNAME.mac"
          [ -e $MACFILE ] && ${pkgs.iproute}/bin/ip link set dev $INTERFACE address `cat $MACFILE` || cat /sys/class/net/$INTERFACE/address >$MACFILE
        '';
        "hosts/heimdallr-up" = ''
          #!${pkgs.stdenv.shell}

          exec ${config.security.wrapperDir}/sudo -En ${heimdallr-up}
        '';
        "hosts/heimdallr-down" = ''
          #!${pkgs.stdenv.shell}

          exec ${config.security.wrapperDir}/sudo -En ${heimdallr-down}
        '';
      };
    };
  };
}