blob: a5cc42332b484e5cb9fc95582800448aa6a3ad5a (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
|
{ config, pkgs, lib, ... }:
let
cfg = config.myServices.vpn;
configFiles = pkgs.runCommand "tinc-files" {
mainInterface = "eth0";
hostName = "ImmaeEu";
network = "Immae";
keyFile = config.secrets.fullPaths."tinc/key.priv";
} ''
mkdir -p $out
for i in ${./tinc}/*; do
substituteAll $i $out/$(basename $i)
done
'';
keyPaths = lib.flatten (lib.mapAttrsToList
(ns: lib.mapAttrsToList
(name: s:
lib.nameValuePair
"${ns}${name}"
(if builtins.isPath s then s else pkgs.writeText "${ns}${name}" s)
)
) config.myServices.vpn.keys);
keysDir = pkgs.runCommand "tinc-config" {} (''
install -m755 -d $out $out/hosts
install -m755 -t $out ${configFiles}/{host-*,tinc-*}
install -m444 -t $out ${configFiles}/tinc.conf
install -m755 -t $out/hosts ${configFiles}/ImmaeEu-*
install -m444 -t $out/hosts ${configFiles}/ImmaeEu
'' + builtins.concatStringsSep "\n" (builtins.map (p: "cp ${p.value} $out/hosts/${p.name}") keyPaths) + ''
cd $out
tar -czf $out/hosts.tar.gz hosts/
'');
in
{
options.myServices = {
vpn.enable = lib.mkEnableOption "Enable vpn service";
vpn.keys = lib.mkOption {
type = lib.types.attrsOf (lib.types.attrsOf (lib.types.either lib.types.path lib.types.str));
description = "Keys sorted by namespaces and names";
default = {};
};
vpn.hostsPath = lib.mkOption {
type = lib.types.path;
default = "${keysDir}/hosts.tar.gz";
readOnly = true;
};
};
config = lib.mkIf cfg.enable {
myServices.dns.zones."immae.eu".subdomains.vpn = with config.myServices.dns.helpers;
ips servers.eldiron.ips.main // {
subdomains.gw.AAAA = [ "${config.myEnv.vpn.eldiron.prefix}:0:ffff:1" ];
# Fake address to designate the subnet
subdomains.sn.AAAA = [ "${config.myEnv.vpn.eldiron.prefix}::" ];
};
myServices.chatonsProperties.hostings.vpn = {
file.datetime = "2022-08-27T18:00:00";
hosting = {
name = "VPN";
description = "VPN";
website = "https://vpn.immae.eu";
logo = "https://tinc-vpn.org/favicon.ico";
status.level = "OK";
status.description = "OK";
registration.load = "FULL";
install.type = "PACKAGE";
};
software = {
name = "tinc";
website = "https://tinc-vpn.org/";
license.url = "https://www.gnu.org/licenses/old-licenses/gpl-2.0.html";
license.name = "GNU General Public License v2.0";
version = pkgs.tinc.version;
source.url = "https://tinc-vpn.org/git/browse?p=tinc";
};
};
secrets.keys = {
"tinc/key.priv" = {
user = "root";
group = "root";
permissions = "0400";
text = config.myEnv.vpn.eldiron.privateKey;
};
"tinc/key.pub" = {
user = "root";
group = "root";
permissions = "0400";
text = config.myEnv.vpn.eldiron.publicKey;
};
};
networking.firewall.allowedTCPPorts = [ 655 1194 ];
system.activationScripts.tinc = ''
install -m750 -o root -g root -d /var/lib/tinc/ /var/lib/tinc/Immae
'';
systemd.slices.tinc = {
description = "Tinc slice";
};
systemd.services.tinc-Immae = {
description = "Tinc Daemon - Immae";
wantedBy = [ "multi-user.target" ];
after = [ "network.target" ];
path = [ pkgs.getent pkgs.tinc pkgs.bashInteractive pkgs.iproute pkgs.gnused pkgs.gawk pkgs.git pkgs.glibc ];
serviceConfig = {
Slice = "tinc.slice";
Type = "simple";
Restart = "always";
RestartSec = "3";
ExecStart = "${pkgs.tinc}/bin/tincd -d1 -D -c ${keysDir} --pidfile /run/tinc.Immae.pid";
};
};
};
}
|
