6 files changed, 147 insertions, 0 deletions

diff --git a/systems/eldiron/vpn/default.nix b/systems/eldiron/vpn/default.nix
new file mode 100644
index 0000000..df56249
--- /dev/null
+++ b/systems/eldiron/vpn/default.nix
@@ -0,0 +1,92 @@
+{ config, pkgs, lib, ... }:
+let
+  cfg = config.myServices.vpn;
+in
+{
+  options.myServices = {
+    vpn.enable = lib.mkEnableOption "Enable vpn service";
+  };
+
+  config = lib.mkIf cfg.enable {
+    myServices.dns.zones."immae.eu".subdomains.vpn = with config.myServices.dns.helpers;
+      ips servers.eldiron.ips.main // {
+        subdomains.gw.AAAA = [ "${config.myEnv.vpn.eldiron.prefix}:0:ffff:1" ];
+        # Fake address to designate the subnet
+        subdomains.sn.AAAA = [ "${config.myEnv.vpn.eldiron.prefix}::" ];
+      };
+    myServices.chatonsProperties.hostings.vpn = {
+      file.datetime = "2022-08-27T18:00:00";
+      hosting = {
+        name = "VPN";
+        description = "VPN";
+        website = "https://vpn.immae.eu";
+        logo = "https://tinc-vpn.org/favicon.ico";
+        status.level = "OK";
+        status.description = "OK";
+        registration.load = "FULL";
+        install.type = "PACKAGE";
+      };
+      software = {
+        name = "tinc";
+        website = "https://tinc-vpn.org/";
+        license.url = "https://www.gnu.org/licenses/old-licenses/gpl-2.0.html";
+        license.name = "GNU General Public License v2.0";
+        version = pkgs.tinc.version;
+        source.url = "https://tinc-vpn.org/git/browse?p=tinc";
+      };
+    };
+    secrets.keys = {
+      "tinc/key.priv" = {
+        user = "root";
+        group = "root";
+        permissions = "0400";
+        text = config.myEnv.vpn.eldiron.privateKey;
+      };
+      "tinc/key.pub" = {
+        user = "root";
+        group = "root";
+        permissions = "0400";
+        text = config.myEnv.vpn.eldiron.publicKey;
+      };
+    };
+    networking.firewall.allowedTCPPorts = [ 655 1194 ];
+    system.activationScripts.tinc = let
+      configFiles = pkgs.runCommand "tinc-files" {
+        mainInterface = "eth0";
+        hostName = "ImmaeEu";
+        network = "Immae";
+        keyFile = config.secrets.fullPaths."tinc/key.priv";
+      } ''
+        mkdir -p $out
+        for i in ${./tinc}/*; do
+          substituteAll $i $out/$(basename $i)
+        done
+      '';
+    in ''
+      install -m750 -o root -g root -d /var/lib/tinc/ /var/lib/tinc/Immae
+      install -m700 -o root -g root -t /var/lib/tinc/Immae ${configFiles}/{host-*,tinc-*}
+      install -m400 -o root -g root -t /var/lib/tinc/Immae ${configFiles}/tinc.conf
+      if [ ! -d /var/lib/tinc/Immae/hosts ]; then
+        ${pkgs.git}/bin/git clone -b master https://git.immae.eu/perso/Immae/Config/tinc/hosts /var/lib/tinc/Immae/hosts
+      fi
+    '';
+
+    systemd.slices.tinc = {
+      description = "Tinc slice";
+    };
+
+    systemd.services.tinc-Immae = {
+      description = "Tinc Daemon - Immae";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+      path = [ pkgs.getent pkgs.tinc pkgs.bashInteractive pkgs.iproute pkgs.gnused pkgs.gawk pkgs.git pkgs.glibc ];
+      serviceConfig = {
+        Slice = "tinc.slice";
+        Type = "simple";
+        Restart = "always";
+        RestartSec = "3";
+        ExecStart = "${pkgs.tinc}/bin/tincd -d1 -D -c /var/lib/tinc/Immae --pidfile /run/tinc.Immae.pid";
+      };
+    };
+  };
+}
diff --git a/systems/eldiron/vpn/tinc/host-down b/systems/eldiron/vpn/tinc/host-down
new file mode 100755
index 0000000..1e79bd3
--- /dev/null
+++ b/systems/eldiron/vpn/tinc/host-down
@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+
+SUBDOMAIN=$(echo "$NODE" | sed -e "s/\([A-Z][a-z0-9]*\)/\L\1 /g;" | awk '{ for (i=NF; i>1; i--) printf("%s.",$i); print $1; }')
+NODEIPS=`getent hosts ${SUBDOMAIN}.immae.eu | cut -d' ' -f1 | tr "\\n" ' '`
+for NODEIP in $NODEIPS; do
+  ip neigh del proxy $NODEIP dev @mainInterface@
+done
diff --git a/systems/eldiron/vpn/tinc/host-up b/systems/eldiron/vpn/tinc/host-up
new file mode 100755
index 0000000..2f7cee2
--- /dev/null
+++ b/systems/eldiron/vpn/tinc/host-up
@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+
+SUBDOMAIN=$(echo "$NODE" | sed -e "s/\([A-Z][a-z0-9]*\)/\L\1 /g;" | awk '{ for (i=NF; i>1; i--) printf("%s.",$i); print $1; }')
+while [ -z "$NODEIPS" ]; do
+  NODEIPS=`getent hosts ${SUBDOMAIN}.immae.eu | cut -d' ' -f1 | tr "\\n" ' '`
+  sleep 5
+done
+for NODEIP in $NODEIPS; do
+  ip neigh add proxy $NODEIP dev @mainInterface@
+done
+(cd /var/lib/tinc/@network@/hosts && git pull -q origin master) || true
diff --git a/systems/eldiron/vpn/tinc/tinc-down b/systems/eldiron/vpn/tinc/tinc-down
new file mode 100755
index 0000000..1cc45c0
--- /dev/null
+++ b/systems/eldiron/vpn/tinc/tinc-down
@@ -0,0 +1,12 @@
+#!/bin/sh
+# This file closes down the tap device.
+
+echo 0 > /proc/sys/net/ipv6/conf/@mainInterface@/proxy_ndp
+echo 0 > /proc/sys/net/ipv6/conf/all/forwarding
+
+GWIP=`getent hosts gw.vpn.immae.eu | head -n1 | cut -d' ' -f1`
+
+ip neigh del proxy $GWIP dev eth0
+
+ip -6 addr del $GWIP/96 dev $INTERFACE
+ip -6 link set $INTERFACE down
diff --git a/systems/eldiron/vpn/tinc/tinc-up b/systems/eldiron/vpn/tinc/tinc-up
new file mode 100755
index 0000000..26c1ec3
--- /dev/null
+++ b/systems/eldiron/vpn/tinc/tinc-up
@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+
+echo 1 > /proc/sys/net/ipv6/conf/@mainInterface@/proxy_ndp
+echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
+
+SUBNET=`getent hosts sn.vpn.immae.eu | head -n1 | cut -d' ' -f1`
+GWIP=`getent hosts gw.vpn.immae.eu | head -n1 | cut -d' ' -f1`
+
+ip -6 link set $INTERFACE up mtu 1280 txqueuelen 1000
+
+ip -6 addr add $GWIP/96 dev $INTERFACE
+ip -6 route add $SUBNET/80 dev $INTERFACE
+
+ip neigh add proxy $GWIP dev @mainInterface@
diff --git a/systems/eldiron/vpn/tinc/tinc.conf b/systems/eldiron/vpn/tinc/tinc.conf
new file mode 100644
index 0000000..7a4f103
--- /dev/null
+++ b/systems/eldiron/vpn/tinc/tinc.conf
@@ -0,0 +1,11 @@
+BindToAddress = * 655
+BindToAddress = * 1194
+
+Name = @hostName@
+Interface = vpn6
+
+Mode = switch
+
+Device = /dev/net/tun
+GraphDumpFile = /var/lib/tinc/@network@/tinc_graph
+PrivateKeyFile = @keyFile@