···

       
84
       
 
       
                description = "Whether this node is a relay.";

     

       
85
       
 
       
              };

     

       
86
       
 
       


     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
87
       
 
       
              lighthouses = lib.mkOption {

     

       
88
       
 
       
                type = lib.types.listOf lib.types.str;

     

       
89
       
 
       
                default = [ ];

     
···

       
172
       
 
       
                '';

     

       
173
       
 
       
                example = lib.literalExpression ''

     

       
174
       
 
       
                  {

     

       
175
       
-
       
                    lighthouse.dns = {

     

       
176
       
-
       
                      host = "0.0.0.0";

     

       
177
       
-
       
                      port = 53;

     

       
178
       
-
       
                    };

     

       
179
       
 
       
                  }

     

       
180
       
 
       
                '';

     

       
181
       
 
       
              };

     
···

       
203
       
 
       
            lighthouse = {

     

       
204
       
 
       
              am_lighthouse = netCfg.isLighthouse;

     

       
205
       
 
       
              hosts = netCfg.lighthouses;

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
206
       
 
       
            };

     

       
207
       
 
       
            relay = {

     

       
208
       
 
       
              am_relay = netCfg.isRelay;

     
···

       
231
       
 
       
              ''

     

       
232
       
 
       
              settings

     

       
233
       
 
       
          );

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
234
       
 
       
        in

     

       
235
       
 
       
        {

     

       
236
       
 
       
          # Create the systemd service for Nebula.

     
···

       
248
       
 
       
              Restart = "always";

     

       
249
       
 
       
              ExecStart = "${netCfg.package}/bin/nebula -config ${configFile}";

     

       
250
       
 
       
              UMask = "0027";

     

       
251
       
-
       
              CapabilityBoundingSet = "CAP_NET_ADMIN";

     

       
252
       
-
       
              AmbientCapabilities = "CAP_NET_ADMIN";

     

       
253
       
 
       
              LockPersonality = true;

     

       
254
       
 
       
              NoNewPrivileges = true;

     

       
255
       
 
       
              PrivateDevices = false; # needs access to /dev/net/tun (below)

     
···

       
302
       
 
       
    );

     

       
303
       
 
       
  };

     

       
304
       
 
       


     

       
305
       
-
       
  meta.maintainers = with lib.maintainers; [ numinit ];

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
306
       
 
       
}

     

···

       
84
       
 
       
                description = "Whether this node is a relay.";

     

       
85
       
 
       
              };

     

       
86
       
 
       


     

       
87
       
+
       
              lighthouse.dns.enable = lib.mkOption {

     

       
88
       
+
       
                type = lib.types.bool;

     

       
89
       
+
       
                default = false;

     

       
90
       
+
       
                description = "Whether this lighthouse node should serve DNS.";

     

       
91
       
+
       
              };

     

       
92
       
+
       


     

       
93
       
+
       
              lighthouse.dns.host = lib.mkOption {

     

       
94
       
+
       
                type = lib.types.str;

     

       
95
       
+
       
                default = "localhost";

     

       
96
       
+
       
                description = ''

     

       
97
       
+
       
                  IP address on which nebula lighthouse should serve DNS.

     

       
98
       
+
       
                  'localhost' is a good default to ensure the service does not listen on public interfaces;

     

       
99
       
+
       
                  use a Nebula address like 10.0.0.5 to make DNS resolution available to nebula hosts only.

     

       
100
       
+
       
                '';

     

       
101
       
+
       
              };

     

       
102
       
+
       


     

       
103
       
+
       
              lighthouse.dns.port = lib.mkOption {

     

       
104
       
+
       
                type = lib.types.nullOr lib.types.port;

     

       
105
       
+
       
                default = 5353;

     

       
106
       
+
       
                description = "UDP port number for lighthouse DNS server.";

     

       
107
       
+
       
              };

     

       
108
       
+
       


     

       
109
       
 
       
              lighthouses = lib.mkOption {

     

       
110
       
 
       
                type = lib.types.listOf lib.types.str;

     

       
111
       
 
       
                default = [ ];

     
···

       
194
       
 
       
                '';

     

       
195
       
 
       
                example = lib.literalExpression ''

     

       
196
       
 
       
                  {

     

       
197
       
+
       
                    lighthouse.interval = 15;

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
198
       
 
       
                  }

     

       
199
       
 
       
                '';

     

       
200
       
 
       
              };

     
···

       
222
       
 
       
            lighthouse = {

     

       
223
       
 
       
              am_lighthouse = netCfg.isLighthouse;

     

       
224
       
 
       
              hosts = netCfg.lighthouses;

     

       
225
       
+
       
              serve_dns = netCfg.lighthouse.dns.enable;

     

       
226
       
+
       
              dns.host = netCfg.lighthouse.dns.host;

     

       
227
       
+
       
              dns.port = netCfg.lighthouse.dns.port;

     

       
228
       
 
       
            };

     

       
229
       
 
       
            relay = {

     

       
230
       
 
       
              am_relay = netCfg.isRelay;

     
···

       
253
       
 
       
              ''

     

       
254
       
 
       
              settings

     

       
255
       
 
       
          );

     

       
256
       
+
       
          capabilities =

     

       
257
       
+
       
            let

     

       
258
       
+
       
              nebulaPort = if !settings.tun.disabled then settings.listen.port else 0;

     

       
259
       
+
       
              dnsPort = if settings.lighthouse.serve_dns then settings.lighthouse.dns.port else 0;

     

       
260
       
+
       
            in

     

       
261
       
+
       
            lib.concatStringsSep " " (

     

       
262
       
+
       
              # creation of tunnel interfaces

     

       
263
       
+
       
              lib.optional (!settings.tun.disabled) "CAP_NET_ADMIN"

     

       
264
       
+
       
              # binding to privileged ports

     

       
265
       
+
       
              ++ lib.optional (

     

       
266
       
+
       
                nebulaPort > 0 && nebulaPort < 1024 || dnsPort > 0 && dnsPort < 1024

     

       
267
       
+
       
              ) "CAP_NET_BIND_SERVICE"

     

       
268
       
+
       
            );

     

       
269
       
 
       
        in

     

       
270
       
 
       
        {

     

       
271
       
 
       
          # Create the systemd service for Nebula.

     
···

       
283
       
 
       
              Restart = "always";

     

       
284
       
 
       
              ExecStart = "${netCfg.package}/bin/nebula -config ${configFile}";

     

       
285
       
 
       
              UMask = "0027";

     

       
286
       
+
       
              CapabilityBoundingSet = capabilities;

     

       
287
       
+
       
              AmbientCapabilities = capabilities;

     

       
288
       
 
       
              LockPersonality = true;

     

       
289
       
 
       
              NoNewPrivileges = true;

     

       
290
       
 
       
              PrivateDevices = false; # needs access to /dev/net/tun (below)

     
···

       
337
       
 
       
    );

     

       
338
       
 
       
  };

     

       
339
       
 
       


     

       
340
       
+
       
  meta.maintainers = with lib.maintainers; [

     

       
341
       
+
       
    numinit

     

       
342
       
+
       
    siriobalmelli

     

       
343
       
+
       
  ];

     

       
344
       
 
       
}