pyrox.dev
1{ config, lib, pkgs, ... }:
2
3with lib;
4
5let
6
7 cfg = config.services.tinc;
8
9in
10
11{
12
13 ###### interface
14
15 options = {
16
17 services.tinc = {
18
19 networks = mkOption {
20 default = { };
21 type = with types; attrsOf (submodule {
22 options = {
23
24 extraConfig = mkOption {
25 default = "";
26 type = types.lines;
27 description = ''
28 Extra lines to add to the tinc service configuration file.
29 '';
30 };
31
32 name = mkOption {
33 default = null;
34 type = types.nullOr types.str;
35 description = ''
36 The name of the node which is used as an identifier when communicating
37 with the remote nodes in the mesh. If null then the hostname of the system
38 is used to derive a name (note that tinc may replace non-alphanumeric characters in
39 hostnames by underscores).
40 '';
41 };
42
43 ed25519PrivateKeyFile = mkOption {
44 default = null;
45 type = types.nullOr types.path;
46 description = ''
47 Path of the private ed25519 keyfile.
48 '';
49 };
50
51 debugLevel = mkOption {
52 default = 0;
53 type = types.addCheck types.int (l: l >= 0 && l <= 5);
54 description = ''
55 The amount of debugging information to add to the log. 0 means little
56 logging while 5 is the most logging. <command>man tincd</command> for
57 more details.
58 '';
59 };
60
61 hosts = mkOption {
62 default = { };
63 type = types.attrsOf types.lines;
64 description = ''
65 The name of the host in the network as well as the configuration for that host.
66 This name should only contain alphanumerics and underscores.
67 '';
68 };
69
70 interfaceType = mkOption {
71 default = "tun";
72 type = types.enum [ "tun" "tap" ];
73 description = ''
74 The type of virtual interface used for the network connection
75 '';
76 };
77
78 listenAddress = mkOption {
79 default = null;
80 type = types.nullOr types.str;
81 description = ''
82 The ip address to listen on for incoming connections.
83 '';
84 };
85
86 bindToAddress = mkOption {
87 default = null;
88 type = types.nullOr types.str;
89 description = ''
90 The ip address to bind to (both listen on and send packets from).
91 '';
92 };
93
94 package = mkOption {
95 type = types.package;
96 default = pkgs.tinc_pre;
97 defaultText = "pkgs.tinc_pre";
98 description = ''
99 The package to use for the tinc daemon's binary.
100 '';
101 };
102
103 chroot = mkOption {
104 default = true;
105 type = types.bool;
106 description = ''
107 Change process root directory to the directory where the config file is located (/etc/tinc/netname/), for added security.
108 The chroot is performed after all the initialization is done, after writing pid files and opening network sockets.
109
110 Note that tinc can't run scripts anymore (such as tinc-down or host-up), unless it is setup to be runnable inside chroot environment.
111 '';
112 };
113 };
114 });
115
116 description = ''
117 Defines the tinc networks which will be started.
118 Each network invokes a different daemon.
119 '';
120 };
121 };
122
123 };
124
125
126 ###### implementation
127
128 config = mkIf (cfg.networks != { }) {
129
130 environment.etc = fold (a: b: a // b) { }
131 (flip mapAttrsToList cfg.networks (network: data:
132 flip mapAttrs' data.hosts (host: text: nameValuePair
133 ("tinc/${network}/hosts/${host}")
134 ({ mode = "0644"; user = "tinc.${network}"; inherit text; })
135 ) // {
136 "tinc/${network}/tinc.conf" = {
137 mode = "0444";
138 text = ''
139 Name = ${if data.name == null then "$HOST" else data.name}
140 DeviceType = ${data.interfaceType}
141 ${optionalString (data.ed25519PrivateKeyFile != null) "Ed25519PrivateKeyFile = ${data.ed25519PrivateKeyFile}"}
142 ${optionalString (data.listenAddress != null) "ListenAddress = ${data.listenAddress}"}
143 ${optionalString (data.bindToAddress != null) "BindToAddress = ${data.bindToAddress}"}
144 Device = /dev/net/tun
145 Interface = tinc.${network}
146 ${data.extraConfig}
147 '';
148 };
149 }
150 ));
151
152 networking.interfaces = flip mapAttrs' cfg.networks (network: data: nameValuePair
153 ("tinc.${network}")
154 ({
155 virtual = true;
156 virtualType = "${data.interfaceType}";
157 })
158 );
159
160 systemd.services = flip mapAttrs' cfg.networks (network: data: nameValuePair
161 ("tinc.${network}")
162 ({
163 description = "Tinc Daemon - ${network}";
164 wantedBy = [ "multi-user.target" ];
165 after = [ "network.target" ];
166 path = [ data.package ];
167 serviceConfig = {
168 Type = "simple";
169 Restart = "always";
170 RestartSec = "3";
171 };
172 preStart = ''
173 mkdir -p /etc/tinc/${network}/hosts
174 chown tinc.${network} /etc/tinc/${network}/hosts
175
176 # Determine how we should generate our keys
177 if type tinc >/dev/null 2>&1; then
178 # Tinc 1.1+ uses the tinc helper application for key generation
179 ${if data.ed25519PrivateKeyFile != null then " # Keyfile managed by nix" else ''
180 # Prefer ED25519 keys (only in 1.1+)
181 [ -f "/etc/tinc/${network}/ed25519_key.priv" ] || tinc -n ${network} generate-ed25519-keys
182 ''}
183 # Otherwise use RSA keys
184 [ -f "/etc/tinc/${network}/rsa_key.priv" ] || tinc -n ${network} generate-rsa-keys 4096
185 else
186 # Tinc 1.0 uses the tincd application
187 [ -f "/etc/tinc/${network}/rsa_key.priv" ] || tincd -n ${network} -K 4096
188 fi
189 '';
190 script = ''
191 tincd -D -U tinc.${network} -n ${network} ${optionalString (data.chroot) "-R"} --pidfile /run/tinc.${network}.pid -d ${toString data.debugLevel}
192 '';
193 })
194 );
195
196 environment.systemPackages = let
197 cli-wrappers = pkgs.stdenv.mkDerivation {
198 name = "tinc-cli-wrappers";
199 buildInputs = [ pkgs.makeWrapper ];
200 buildCommand = ''
201 mkdir -p $out/bin
202 ${concatStringsSep "\n" (mapAttrsToList (network: data: ''
203 makeWrapper ${data.package}/bin/tinc "$out/bin/tinc.${network}" --add-flags "--pidfile=/run/tinc.${network}.pid"
204 '') cfg.networks)}
205 '';
206 };
207 in [ cli-wrappers ];
208
209 users.extraUsers = flip mapAttrs' cfg.networks (network: _:
210 nameValuePair ("tinc.${network}") ({
211 description = "Tinc daemon user for ${network}";
212 isSystemUser = true;
213 })
214 );
215
216 };
217
218}