diff options
Diffstat (limited to 'modules/private/vpn')
-rw-r--r-- | modules/private/vpn/default.nix | 65 | ||||
-rwxr-xr-x | modules/private/vpn/tinc/host-down | 7 | ||||
-rwxr-xr-x | modules/private/vpn/tinc/host-up | 11 | ||||
-rwxr-xr-x | modules/private/vpn/tinc/tinc-down | 12 | ||||
-rwxr-xr-x | modules/private/vpn/tinc/tinc-up | 14 | ||||
-rw-r--r-- | modules/private/vpn/tinc/tinc.conf | 11 |
6 files changed, 0 insertions, 120 deletions
diff --git a/modules/private/vpn/default.nix b/modules/private/vpn/default.nix deleted file mode 100644 index d4b197d..0000000 --- a/modules/private/vpn/default.nix +++ /dev/null | |||
@@ -1,65 +0,0 @@ | |||
1 | { config, pkgs, lib, ... }: | ||
2 | let | ||
3 | cfg = config.myServices.vpn; | ||
4 | in | ||
5 | { | ||
6 | options.myServices = { | ||
7 | vpn.enable = lib.mkEnableOption "Enable vpn service"; | ||
8 | }; | ||
9 | |||
10 | config = lib.mkIf cfg.enable { | ||
11 | secrets.keys = { | ||
12 | "tinc/key.priv" = { | ||
13 | user = "root"; | ||
14 | group = "root"; | ||
15 | permissions = "0400"; | ||
16 | text = config.myEnv.vpn.eldiron.privateKey; | ||
17 | }; | ||
18 | "tinc/key.pub" = { | ||
19 | user = "root"; | ||
20 | group = "root"; | ||
21 | permissions = "0400"; | ||
22 | text = config.myEnv.vpn.eldiron.publicKey; | ||
23 | }; | ||
24 | }; | ||
25 | networking.firewall.allowedTCPPorts = [ 655 1194 ]; | ||
26 | system.activationScripts.tinc = let | ||
27 | configFiles = pkgs.runCommand "tinc-files" { | ||
28 | mainInterface = "eth0"; | ||
29 | hostName = "ImmaeEu"; | ||
30 | network = "Immae"; | ||
31 | keyFile = config.secrets.fullPaths."tinc/key.priv"; | ||
32 | } '' | ||
33 | mkdir -p $out | ||
34 | for i in ${./tinc}/*; do | ||
35 | substituteAll $i $out/$(basename $i) | ||
36 | done | ||
37 | ''; | ||
38 | in '' | ||
39 | install -m750 -o root -g root -d /var/lib/tinc/ /var/lib/tinc/Immae | ||
40 | install -m700 -o root -g root -t /var/lib/tinc/Immae ${configFiles}/{host-*,tinc-*} | ||
41 | install -m400 -o root -g root -t /var/lib/tinc/Immae ${configFiles}/tinc.conf | ||
42 | if [ ! -d /var/lib/tinc/Immae/hosts ]; then | ||
43 | ${pkgs.git}/bin/git clone -b master https://git.immae.eu/perso/Immae/Config/tinc/hosts /var/lib/tinc/Immae/hosts | ||
44 | fi | ||
45 | ''; | ||
46 | |||
47 | systemd.slices.tinc = { | ||
48 | description = "Tinc slice"; | ||
49 | }; | ||
50 | |||
51 | systemd.services.tinc-Immae = { | ||
52 | description = "Tinc Daemon - Immae"; | ||
53 | wantedBy = [ "multi-user.target" ]; | ||
54 | after = [ "network.target" ]; | ||
55 | path = [ pkgs.tinc pkgs.bashInteractive pkgs.iproute pkgs.gnused pkgs.gawk pkgs.git pkgs.glibc ]; | ||
56 | serviceConfig = { | ||
57 | Slice = "tinc.slice"; | ||
58 | Type = "simple"; | ||
59 | Restart = "always"; | ||
60 | RestartSec = "3"; | ||
61 | ExecStart = "${pkgs.tinc}/bin/tincd -d1 -D -c /var/lib/tinc/Immae --pidfile /run/tinc.Immae.pid"; | ||
62 | }; | ||
63 | }; | ||
64 | }; | ||
65 | } | ||
diff --git a/modules/private/vpn/tinc/host-down b/modules/private/vpn/tinc/host-down deleted file mode 100755 index 1e79bd3..0000000 --- a/modules/private/vpn/tinc/host-down +++ /dev/null | |||
@@ -1,7 +0,0 @@ | |||
1 | #!/usr/bin/env bash | ||
2 | |||
3 | SUBDOMAIN=$(echo "$NODE" | sed -e "s/\([A-Z][a-z0-9]*\)/\L\1 /g;" | awk '{ for (i=NF; i>1; i--) printf("%s.",$i); print $1; }') | ||
4 | NODEIPS=`getent hosts ${SUBDOMAIN}.immae.eu | cut -d' ' -f1 | tr "\\n" ' '` | ||
5 | for NODEIP in $NODEIPS; do | ||
6 | ip neigh del proxy $NODEIP dev @mainInterface@ | ||
7 | done | ||
diff --git a/modules/private/vpn/tinc/host-up b/modules/private/vpn/tinc/host-up deleted file mode 100755 index 2f7cee2..0000000 --- a/modules/private/vpn/tinc/host-up +++ /dev/null | |||
@@ -1,11 +0,0 @@ | |||
1 | #!/usr/bin/env bash | ||
2 | |||
3 | SUBDOMAIN=$(echo "$NODE" | sed -e "s/\([A-Z][a-z0-9]*\)/\L\1 /g;" | awk '{ for (i=NF; i>1; i--) printf("%s.",$i); print $1; }') | ||
4 | while [ -z "$NODEIPS" ]; do | ||
5 | NODEIPS=`getent hosts ${SUBDOMAIN}.immae.eu | cut -d' ' -f1 | tr "\\n" ' '` | ||
6 | sleep 5 | ||
7 | done | ||
8 | for NODEIP in $NODEIPS; do | ||
9 | ip neigh add proxy $NODEIP dev @mainInterface@ | ||
10 | done | ||
11 | (cd /var/lib/tinc/@network@/hosts && git pull -q origin master) || true | ||
diff --git a/modules/private/vpn/tinc/tinc-down b/modules/private/vpn/tinc/tinc-down deleted file mode 100755 index 1cc45c0..0000000 --- a/modules/private/vpn/tinc/tinc-down +++ /dev/null | |||
@@ -1,12 +0,0 @@ | |||
1 | #!/bin/sh | ||
2 | # This file closes down the tap device. | ||
3 | |||
4 | echo 0 > /proc/sys/net/ipv6/conf/@mainInterface@/proxy_ndp | ||
5 | echo 0 > /proc/sys/net/ipv6/conf/all/forwarding | ||
6 | |||
7 | GWIP=`getent hosts gw.vpn.immae.eu | head -n1 | cut -d' ' -f1` | ||
8 | |||
9 | ip neigh del proxy $GWIP dev eth0 | ||
10 | |||
11 | ip -6 addr del $GWIP/96 dev $INTERFACE | ||
12 | ip -6 link set $INTERFACE down | ||
diff --git a/modules/private/vpn/tinc/tinc-up b/modules/private/vpn/tinc/tinc-up deleted file mode 100755 index 26c1ec3..0000000 --- a/modules/private/vpn/tinc/tinc-up +++ /dev/null | |||
@@ -1,14 +0,0 @@ | |||
1 | #!/usr/bin/env bash | ||
2 | |||
3 | echo 1 > /proc/sys/net/ipv6/conf/@mainInterface@/proxy_ndp | ||
4 | echo 1 > /proc/sys/net/ipv6/conf/all/forwarding | ||
5 | |||
6 | SUBNET=`getent hosts sn.vpn.immae.eu | head -n1 | cut -d' ' -f1` | ||
7 | GWIP=`getent hosts gw.vpn.immae.eu | head -n1 | cut -d' ' -f1` | ||
8 | |||
9 | ip -6 link set $INTERFACE up mtu 1280 txqueuelen 1000 | ||
10 | |||
11 | ip -6 addr add $GWIP/96 dev $INTERFACE | ||
12 | ip -6 route add $SUBNET/80 dev $INTERFACE | ||
13 | |||
14 | ip neigh add proxy $GWIP dev @mainInterface@ | ||
diff --git a/modules/private/vpn/tinc/tinc.conf b/modules/private/vpn/tinc/tinc.conf deleted file mode 100644 index 7a4f103..0000000 --- a/modules/private/vpn/tinc/tinc.conf +++ /dev/null | |||
@@ -1,11 +0,0 @@ | |||
1 | BindToAddress = * 655 | ||
2 | BindToAddress = * 1194 | ||
3 | |||
4 | Name = @hostName@ | ||
5 | Interface = vpn6 | ||
6 | |||
7 | Mode = switch | ||
8 | |||
9 | Device = /dev/net/tun | ||
10 | GraphDumpFile = /var/lib/tinc/@network@/tinc_graph | ||
11 | PrivateKeyFile = @keyFile@ | ||