pyrox.dev
1{ config, pkgs, lib, utils, ... }:
2
3let
4 cfg = config.services.mycelium;
5in
6{
7 options.services.mycelium = {
8 enable = lib.mkEnableOption "mycelium network";
9 peers = lib.mkOption {
10 type = lib.types.listOf lib.types.str;
11 description = ''
12 List of peers to connect to, in the formats:
13 - `quic://[2001:0db8::1]:9651`
14 - `quic://192.0.2.1:9651`
15 - `tcp://[2001:0db8::1]:9651`
16 - `tcp://192.0.2.1:9651`
17
18 If addHostedPublicNodes is set to true, the hosted public nodes will also be added.
19 '';
20 default = [ ];
21 };
22 keyFile = lib.mkOption {
23 type = lib.types.nullOr lib.types.path;
24 default = null;
25 description = ''
26 Optional path to a file containing the mycelium key material.
27 If unset, the default location (`/var/lib/mycelium/key.bin`) will be used.
28 If no key exist at this location, it will be generated on startup.
29 '';
30 };
31 openFirewall = lib.mkOption {
32 type = lib.types.bool;
33 default = false;
34 description = "Open the firewall for mycelium";
35 };
36 package = lib.mkOption {
37 type = lib.types.package;
38 default = pkgs.mycelium;
39 defaultText = lib.literalExpression ''"''${pkgs.mycelium}"'';
40 description = "The mycelium package to use";
41 };
42 addHostedPublicNodes = lib.mkOption {
43 type = lib.types.bool;
44 default = true;
45 description = ''
46 Adds the hosted peers from https://github.com/threefoldtech/mycelium#hosted-public-nodes.
47 '';
48 };
49 extraArgs = lib.mkOption {
50 type = lib.types.listOf lib.types.str;
51 default = [ ];
52 description = ''
53 Extra command-line arguments to pass to mycelium.
54
55 See `mycelium --help` for all available options.
56 '';
57 };
58 };
59 config = lib.mkIf cfg.enable {
60 networking.firewall.allowedTCPPorts = lib.optionals cfg.openFirewall [ 9651 ];
61 networking.firewall.allowedUDPPorts = lib.optionals cfg.openFirewall [ 9650 9651 ];
62
63 systemd.services.mycelium = {
64 description = "Mycelium network";
65 after = [ "network.target" ];
66 wantedBy = [ "multi-user.target" ];
67 restartTriggers = [
68 cfg.keyFile
69 ];
70
71 unitConfig.Documentation = "https://github.com/threefoldtech/mycelium";
72
73 serviceConfig = {
74 User = "mycelium";
75 DynamicUser = true;
76 StateDirectory = "mycelium";
77 ProtectHome = true;
78 ProtectSystem = true;
79 LoadCredential = lib.mkIf (cfg.keyFile != null) "keyfile:${cfg.keyFile}";
80 SyslogIdentifier = "mycelium";
81 AmbientCapabilities = [ "CAP_NET_ADMIN" ];
82 MemoryDenyWriteExecute = true;
83 ProtectControlGroups = true;
84 ProtectKernelModules = true;
85 ProtectKernelTunables = true;
86 RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6 AF_NETLINK";
87 RestrictNamespaces = true;
88 RestrictRealtime = true;
89 SystemCallArchitectures = "native";
90 SystemCallFilter = [ "@system-service" "~@privileged @keyring" ];
91 ExecStart = lib.concatStringsSep " " ([
92 (lib.getExe cfg.package)
93 (if (cfg.keyFile != null) then
94 "--key-file \${CREDENTIALS_DIRECTORY}/keyfile" else
95 "--key-file %S/mycelium/key.bin"
96 )
97 "--tun-name"
98 "mycelium"
99 "${utils.escapeSystemdExecArgs cfg.extraArgs}"
100 ] ++
101 (lib.optional (cfg.addHostedPublicNodes || cfg.peers != [ ]) "--peers")
102 ++ cfg.peers ++ (lib.optionals cfg.addHostedPublicNodes [
103 "tcp://188.40.132.242:9651" # DE 01
104 "tcp://[2a01:4f8:221:1e0b::2]:9651"
105 "quic://188.40.132.242:9651"
106 "quic://[2a01:4f8:221:1e0b::2]:9651"
107
108 "tcp://136.243.47.186:9651" # DE 02
109 "tcp://[2a01:4f8:212:fa6::2]:9651"
110 "quic://136.243.47.186:9651"
111 "quic://[2a01:4f8:212:fa6::2]:9651"
112
113 "tcp://185.69.166.7:9651" # BE 03
114 "tcp://[2a02:1802:5e:0:8478:51ff:fee2:3331]:9651"
115 "quic://185.69.166.7:9651"
116 "quic://[2a02:1802:5e:0:8478:51ff:fee2:3331]:9651"
117
118 "tcp://185.69.166.8:9651" # BE 04
119 "tcp://[2a02:1802:5e:0:8c9e:7dff:fec9:f0d2]:9651"
120 "quic://185.69.166.8:9651"
121 "quic://[2a02:1802:5e:0:8c9e:7dff:fec9:f0d2]:9651"
122
123 "tcp://65.21.231.58:9651" # FI 05
124 "tcp://[2a01:4f9:6a:1dc5::2]:9651"
125 "quic://65.21.231.58:9651"
126 "quic://[2a01:4f9:6a:1dc5::2]:9651"
127
128 "tcp://65.109.18.113:9651" # FI 06
129 "tcp://[2a01:4f9:5a:1042::2]:9651"
130 "quic://65.109.18.113:9651"
131 "quic://[2a01:4f9:5a:1042::2]:9651"
132 ]));
133 Restart = "always";
134 RestartSec = 5;
135 TimeoutStopSec = 5;
136 };
137 };
138 };
139 meta = {
140 maintainers = with lib.maintainers; [ flokli lassulus ];
141 };
142}