aboutsummaryrefslogtreecommitdiff
path: root/modules/private/vpn
diff options
context:
space:
mode:
Diffstat (limited to 'modules/private/vpn')
-rw-r--r--modules/private/vpn/default.nix65
-rwxr-xr-xmodules/private/vpn/tinc/host-down7
-rwxr-xr-xmodules/private/vpn/tinc/host-up11
-rwxr-xr-xmodules/private/vpn/tinc/tinc-down12
-rwxr-xr-xmodules/private/vpn/tinc/tinc-up14
-rw-r--r--modules/private/vpn/tinc/tinc.conf11
6 files changed, 0 insertions, 120 deletions
diff --git a/modules/private/vpn/default.nix b/modules/private/vpn/default.nix
deleted file mode 100644
index d4b197d..0000000
--- a/modules/private/vpn/default.nix
+++ /dev/null
@@ -1,65 +0,0 @@
1{ config, pkgs, lib, ... }:
2let
3 cfg = config.myServices.vpn;
4in
5{
6 options.myServices = {
7 vpn.enable = lib.mkEnableOption "Enable vpn service";
8 };
9
10 config = lib.mkIf cfg.enable {
11 secrets.keys = {
12 "tinc/key.priv" = {
13 user = "root";
14 group = "root";
15 permissions = "0400";
16 text = config.myEnv.vpn.eldiron.privateKey;
17 };
18 "tinc/key.pub" = {
19 user = "root";
20 group = "root";
21 permissions = "0400";
22 text = config.myEnv.vpn.eldiron.publicKey;
23 };
24 };
25 networking.firewall.allowedTCPPorts = [ 655 1194 ];
26 system.activationScripts.tinc = let
27 configFiles = pkgs.runCommand "tinc-files" {
28 mainInterface = "eth0";
29 hostName = "ImmaeEu";
30 network = "Immae";
31 keyFile = config.secrets.fullPaths."tinc/key.priv";
32 } ''
33 mkdir -p $out
34 for i in ${./tinc}/*; do
35 substituteAll $i $out/$(basename $i)
36 done
37 '';
38 in ''
39 install -m750 -o root -g root -d /var/lib/tinc/ /var/lib/tinc/Immae
40 install -m700 -o root -g root -t /var/lib/tinc/Immae ${configFiles}/{host-*,tinc-*}
41 install -m400 -o root -g root -t /var/lib/tinc/Immae ${configFiles}/tinc.conf
42 if [ ! -d /var/lib/tinc/Immae/hosts ]; then
43 ${pkgs.git}/bin/git clone -b master https://git.immae.eu/perso/Immae/Config/tinc/hosts /var/lib/tinc/Immae/hosts
44 fi
45 '';
46
47 systemd.slices.tinc = {
48 description = "Tinc slice";
49 };
50
51 systemd.services.tinc-Immae = {
52 description = "Tinc Daemon - Immae";
53 wantedBy = [ "multi-user.target" ];
54 after = [ "network.target" ];
55 path = [ pkgs.tinc pkgs.bashInteractive pkgs.iproute pkgs.gnused pkgs.gawk pkgs.git pkgs.glibc ];
56 serviceConfig = {
57 Slice = "tinc.slice";
58 Type = "simple";
59 Restart = "always";
60 RestartSec = "3";
61 ExecStart = "${pkgs.tinc}/bin/tincd -d1 -D -c /var/lib/tinc/Immae --pidfile /run/tinc.Immae.pid";
62 };
63 };
64 };
65}
diff --git a/modules/private/vpn/tinc/host-down b/modules/private/vpn/tinc/host-down
deleted file mode 100755
index 1e79bd3..0000000
--- a/modules/private/vpn/tinc/host-down
+++ /dev/null
@@ -1,7 +0,0 @@
1#!/usr/bin/env bash
2
3SUBDOMAIN=$(echo "$NODE" | sed -e "s/\([A-Z][a-z0-9]*\)/\L\1 /g;" | awk '{ for (i=NF; i>1; i--) printf("%s.",$i); print $1; }')
4NODEIPS=`getent hosts ${SUBDOMAIN}.immae.eu | cut -d' ' -f1 | tr "\\n" ' '`
5for NODEIP in $NODEIPS; do
6 ip neigh del proxy $NODEIP dev @mainInterface@
7done
diff --git a/modules/private/vpn/tinc/host-up b/modules/private/vpn/tinc/host-up
deleted file mode 100755
index 2f7cee2..0000000
--- a/modules/private/vpn/tinc/host-up
+++ /dev/null
@@ -1,11 +0,0 @@
1#!/usr/bin/env bash
2
3SUBDOMAIN=$(echo "$NODE" | sed -e "s/\([A-Z][a-z0-9]*\)/\L\1 /g;" | awk '{ for (i=NF; i>1; i--) printf("%s.",$i); print $1; }')
4while [ -z "$NODEIPS" ]; do
5 NODEIPS=`getent hosts ${SUBDOMAIN}.immae.eu | cut -d' ' -f1 | tr "\\n" ' '`
6 sleep 5
7done
8for NODEIP in $NODEIPS; do
9 ip neigh add proxy $NODEIP dev @mainInterface@
10done
11(cd /var/lib/tinc/@network@/hosts && git pull -q origin master) || true
diff --git a/modules/private/vpn/tinc/tinc-down b/modules/private/vpn/tinc/tinc-down
deleted file mode 100755
index 1cc45c0..0000000
--- a/modules/private/vpn/tinc/tinc-down
+++ /dev/null
@@ -1,12 +0,0 @@
1#!/bin/sh
2# This file closes down the tap device.
3
4echo 0 > /proc/sys/net/ipv6/conf/@mainInterface@/proxy_ndp
5echo 0 > /proc/sys/net/ipv6/conf/all/forwarding
6
7GWIP=`getent hosts gw.vpn.immae.eu | head -n1 | cut -d' ' -f1`
8
9ip neigh del proxy $GWIP dev eth0
10
11ip -6 addr del $GWIP/96 dev $INTERFACE
12ip -6 link set $INTERFACE down
diff --git a/modules/private/vpn/tinc/tinc-up b/modules/private/vpn/tinc/tinc-up
deleted file mode 100755
index 26c1ec3..0000000
--- a/modules/private/vpn/tinc/tinc-up
+++ /dev/null
@@ -1,14 +0,0 @@
1#!/usr/bin/env bash
2
3echo 1 > /proc/sys/net/ipv6/conf/@mainInterface@/proxy_ndp
4echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
5
6SUBNET=`getent hosts sn.vpn.immae.eu | head -n1 | cut -d' ' -f1`
7GWIP=`getent hosts gw.vpn.immae.eu | head -n1 | cut -d' ' -f1`
8
9ip -6 link set $INTERFACE up mtu 1280 txqueuelen 1000
10
11ip -6 addr add $GWIP/96 dev $INTERFACE
12ip -6 route add $SUBNET/80 dev $INTERFACE
13
14ip neigh add proxy $GWIP dev @mainInterface@
diff --git a/modules/private/vpn/tinc/tinc.conf b/modules/private/vpn/tinc/tinc.conf
deleted file mode 100644
index 7a4f103..0000000
--- a/modules/private/vpn/tinc/tinc.conf
+++ /dev/null
@@ -1,11 +0,0 @@
1BindToAddress = * 655
2BindToAddress = * 1194
3
4Name = @hostName@
5Interface = vpn6
6
7Mode = switch
8
9Device = /dev/net/tun
10GraphDumpFile = /var/lib/tinc/@network@/tinc_graph
11PrivateKeyFile = @keyFile@