1 files changed, 42 insertions, 19 deletions

diff --git a/systems/eldiron/vpn/default.nix b/systems/eldiron/vpn/default.nix
index df56249..a5cc423 100644
--- a/systems/eldiron/vpn/default.nix
+++ b/systems/eldiron/vpn/default.nix
@@ -1,10 +1,50 @@
 { config, pkgs, lib, ... }:
 let
   cfg = config.myServices.vpn;
+  configFiles = pkgs.runCommand "tinc-files" {
+    mainInterface = "eth0";
+    hostName = "ImmaeEu";
+    network = "Immae";
+    keyFile = config.secrets.fullPaths."tinc/key.priv";
+  } ''
+    mkdir -p $out
+    for i in ${./tinc}/*; do
+      substituteAll $i $out/$(basename $i)
+    done
+  '';
+  keyPaths = lib.flatten (lib.mapAttrsToList
+    (ns: lib.mapAttrsToList
+      (name: s:
+        lib.nameValuePair
+          "${ns}${name}"
+          (if builtins.isPath s then s else pkgs.writeText "${ns}${name}" s)
+      )
+    ) config.myServices.vpn.keys);
+  keysDir = pkgs.runCommand "tinc-config" {} (''
+    install -m755 -d $out $out/hosts
+    install -m755 -t $out ${configFiles}/{host-*,tinc-*}
+    install -m444 -t $out ${configFiles}/tinc.conf
+    install -m755 -t $out/hosts ${configFiles}/ImmaeEu-*
+    install -m444 -t $out/hosts ${configFiles}/ImmaeEu
+  '' + builtins.concatStringsSep "\n" (builtins.map (p: "cp ${p.value} $out/hosts/${p.name}") keyPaths) + ''
+
+    cd $out
+    tar -czf $out/hosts.tar.gz hosts/
+  '');
 in
 {
   options.myServices = {
     vpn.enable = lib.mkEnableOption "Enable vpn service";
+    vpn.keys = lib.mkOption {
+      type = lib.types.attrsOf (lib.types.attrsOf (lib.types.either lib.types.path lib.types.str));
+      description = "Keys sorted by namespaces and names";
+      default = {};
+    };
+    vpn.hostsPath = lib.mkOption {
+      type = lib.types.path;
+      default = "${keysDir}/hosts.tar.gz";
+      readOnly = true;
+    };
   };
 
   config = lib.mkIf cfg.enable {
@@ -50,25 +90,8 @@ in
       };
     };
     networking.firewall.allowedTCPPorts = [ 655 1194 ];
-    system.activationScripts.tinc = let
-      configFiles = pkgs.runCommand "tinc-files" {
-        mainInterface = "eth0";
-        hostName = "ImmaeEu";
-        network = "Immae";
-        keyFile = config.secrets.fullPaths."tinc/key.priv";
-      } ''
-        mkdir -p $out
-        for i in ${./tinc}/*; do
-          substituteAll $i $out/$(basename $i)
-        done
-      '';
-    in ''
+    system.activationScripts.tinc = ''
       install -m750 -o root -g root -d /var/lib/tinc/ /var/lib/tinc/Immae
-      install -m700 -o root -g root -t /var/lib/tinc/Immae ${configFiles}/{host-*,tinc-*}
-      install -m400 -o root -g root -t /var/lib/tinc/Immae ${configFiles}/tinc.conf
-      if [ ! -d /var/lib/tinc/Immae/hosts ]; then
-        ${pkgs.git}/bin/git clone -b master https://git.immae.eu/perso/Immae/Config/tinc/hosts /var/lib/tinc/Immae/hosts
-      fi
     '';
 
     systemd.slices.tinc = {
@@ -85,7 +108,7 @@ in
         Type = "simple";
         Restart = "always";
         RestartSec = "3";
-        ExecStart = "${pkgs.tinc}/bin/tincd -d1 -D -c /var/lib/tinc/Immae --pidfile /run/tinc.Immae.pid";
+        ExecStart = "${pkgs.tinc}/bin/tincd -d1 -D -c ${keysDir} --pidfile /run/tinc.Immae.pid";
       };
     };
   };