pyrox.dev
1{
2 config,
3 lib,
4 pkgs,
5 ...
6}:
7
8with lib;
9
10let
11 cfg = config.services.zerotierone;
12
13 settingsFormat = pkgs.formats.json { };
14 localConfFile = settingsFormat.generate "zt-local.conf" cfg.localConf;
15 localConfFilePath = "/var/lib/zerotier-one/local.conf";
16in
17{
18 options.services.zerotierone.enable = mkEnableOption "ZeroTierOne";
19
20 options.services.zerotierone.joinNetworks = mkOption {
21 default = [ ];
22 example = [ "a8a2c3c10c1a68de" ];
23 type = types.listOf types.str;
24 description = ''
25 List of ZeroTier Network IDs to join on startup.
26 Note that networks are only ever joined, but not automatically left after removing them from the list.
27 To remove networks, use the ZeroTier CLI: `zerotier-cli leave <network-id>`
28 '';
29 };
30
31 options.services.zerotierone.port = mkOption {
32 default = 9993;
33 type = types.port;
34 description = ''
35 Network port used by ZeroTier.
36 '';
37 };
38
39 options.services.zerotierone.package = mkPackageOption pkgs "zerotierone" { };
40
41 options.services.zerotierone.localConf = mkOption {
42 default = { };
43 description = ''
44 Optional configuration to be written to the Zerotier JSON-based local.conf.
45 If set, the configuration will be symlinked to `/var/lib/zerotier-one/local.conf` at build time.
46 To understand the configuration format, refer to <https://docs.zerotier.com/config/#local-configuration-options>.
47 '';
48 example = {
49 settings.allowTcpFallbackRelay = false;
50 };
51 type = settingsFormat.type;
52 };
53
54 config = mkIf cfg.enable {
55 systemd.services.zerotierone = {
56 description = "ZeroTierOne";
57
58 wantedBy = [ "multi-user.target" ];
59 after = [ "network.target" ];
60 wants = [ "network-online.target" ];
61
62 path = [ cfg.package ];
63
64 preStart =
65 ''
66 mkdir -p /var/lib/zerotier-one/networks.d
67 chmod 700 /var/lib/zerotier-one
68 chown -R root:root /var/lib/zerotier-one
69
70 # cleans up old symlinks also if we unset localConf
71 if [[ -L "${localConfFilePath}" && "$(readlink "${localConfFilePath}")" =~ ^${builtins.storeDir}.* ]]; then
72 rm ${localConfFilePath}
73 fi
74 ''
75 + (concatMapStrings (netId: ''
76 touch "/var/lib/zerotier-one/networks.d/${netId}.conf"
77 '') cfg.joinNetworks)
78 + lib.optionalString (cfg.localConf != { }) ''
79 # in case the user has applied manual changes to the local.conf, we backup the file
80 if [ -f "${localConfFilePath}" ]; then
81 mv ${localConfFilePath} ${localConfFilePath}.bak
82 fi
83 ln -s ${localConfFile} ${localConfFilePath}
84 '';
85
86 serviceConfig = {
87 ExecStart = "${cfg.package}/bin/zerotier-one -p${toString cfg.port}";
88 Restart = "always";
89 KillMode = "process";
90 TimeoutStopSec = 5;
91 };
92 };
93
94 # ZeroTier does not issue DHCP leases, but some strangers might...
95 networking.dhcpcd.denyInterfaces = [ "zt*" ];
96
97 # ZeroTier receives UDP transmissions
98 networking.firewall.allowedUDPPorts = [ cfg.port ];
99
100 environment.systemPackages = [ cfg.package ];
101
102 # Prevent systemd from potentially changing the MAC address
103 systemd.network.links."50-zerotier" = {
104 matchConfig = {
105 OriginalName = "zt*";
106 };
107 linkConfig = {
108 AutoNegotiation = false;
109 MACAddressPolicy = "none";
110 };
111 };
112 };
113}