1 { config, pkgs, lib, ... }:
3 cfg = config.myServices.vpn;
7 vpn.enable = lib.mkEnableOption "Enable vpn service";
10 config = lib.mkIf cfg.enable {
11 myServices.dns.zones."immae.eu".subdomains.vpn = with config.myServices.dns.helpers;
12 ips servers.eldiron.ips.main // {
13 subdomains.gw.AAAA = [ "${config.myEnv.vpn.eldiron.prefix}:0:ffff:1" ];
14 # Fake address to designate the subnet
15 subdomains.sn.AAAA = [ "${config.myEnv.vpn.eldiron.prefix}::" ];
17 myServices.chatonsProperties.hostings.vpn = {
18 file.datetime = "2022-08-27T18:00:00";
22 website = "https://vpn.immae.eu";
23 logo = "https://tinc-vpn.org/favicon.ico";
25 status.description = "OK";
26 registration.load = "FULL";
27 install.type = "PACKAGE";
31 website = "https://tinc-vpn.org/";
32 license.url = "https://www.gnu.org/licenses/old-licenses/gpl-2.0.html";
33 license.name = "GNU General Public License v2.0";
34 version = pkgs.tinc.version;
35 source.url = "https://tinc-vpn.org/git/browse?p=tinc";
43 text = config.myEnv.vpn.eldiron.privateKey;
49 text = config.myEnv.vpn.eldiron.publicKey;
52 networking.firewall.allowedTCPPorts = [ 655 1194 ];
53 system.activationScripts.tinc = let
54 configFiles = pkgs.runCommand "tinc-files" {
55 mainInterface = "eth0";
58 keyFile = config.secrets.fullPaths."tinc/key.priv";
61 for i in ${./tinc}/*; do
62 substituteAll $i $out/$(basename $i)
66 install -m750 -o root -g root -d /var/lib/tinc/ /var/lib/tinc/Immae
67 install -m700 -o root -g root -t /var/lib/tinc/Immae ${configFiles}/{host-*,tinc-*}
68 install -m400 -o root -g root -t /var/lib/tinc/Immae ${configFiles}/tinc.conf
69 if [ ! -d /var/lib/tinc/Immae/hosts ]; then
70 ${pkgs.git}/bin/git clone -b master https://git.immae.eu/perso/Immae/Config/tinc/hosts /var/lib/tinc/Immae/hosts
74 systemd.slices.tinc = {
75 description = "Tinc slice";
78 systemd.services.tinc-Immae = {
79 description = "Tinc Daemon - Immae";
80 wantedBy = [ "multi-user.target" ];
81 after = [ "network.target" ];
82 path = [ pkgs.getent pkgs.tinc pkgs.bashInteractive pkgs.iproute pkgs.gnused pkgs.gawk pkgs.git pkgs.glibc ];
88 ExecStart = "${pkgs.tinc}/bin/tincd -d1 -D -c /var/lib/tinc/Immae --pidfile /run/tinc.Immae.pid";