commit 40567b6b8ddc2a2ed8d221db6192b64a8631ca8b · pyrox.dev/nixpkgs

+45 -7
nixos/modules/services/networking/nebula.nix
···

       84
       84
        
                       description = "Whether this node is a relay.";

     

       85
       85
        
                     };

     

       86
       86
        
       

     

       87
       87
       +
                     lighthouse.dns.enable = lib.mkOption {

     

       88
       88
       +
                       type = lib.types.bool;

     

       89
       89
       +
                       default = false;

     

       90
       90
       +
                       description = "Whether this lighthouse node should serve DNS.";

     

       91
       91
       +
                     };

     

       92
       92
       +
       

     

       93
       93
       +
                     lighthouse.dns.host = lib.mkOption {

     

       94
       94
       +
                       type = lib.types.str;

     

       95
       95
       +
                       default = "localhost";

     

       96
       96
       +
                       description = ''

     

       97
       97
       +
                         IP address on which nebula lighthouse should serve DNS.

     

       98
       98
       +
                         'localhost' is a good default to ensure the service does not listen on public interfaces;

     

       99
       99
       +
                         use a Nebula address like 10.0.0.5 to make DNS resolution available to nebula hosts only.

     

       100
       100
       +
                       '';

     

       101
       101
       +
                     };

     

       102
       102
       +
       

     

       103
       103
       +
                     lighthouse.dns.port = lib.mkOption {

     

       104
       104
       +
                       type = lib.types.nullOr lib.types.port;

     

       105
       105
       +
                       default = 5353;

     

       106
       106
       +
                       description = "UDP port number for lighthouse DNS server.";

     

       107
       107
       +
                     };

     

       108
       108
       +
       

     

       87
       109
        
                     lighthouses = lib.mkOption {

     

       88
       110
        
                       type = lib.types.listOf lib.types.str;

     

       89
       111
        
                       default = [ ];

     
···

       172
       194
        
                       '';

     

       173
       195
        
                       example = lib.literalExpression ''

     

       174
       196
        
                         {

     

       175
       175
       -
                           lighthouse.dns = {

     

       176
       176
       -
                             host = "0.0.0.0";

     

       177
       177
       -
                             port = 53;

     

       178
       178
       -
                           };

     

       197
       197
       +
                           lighthouse.interval = 15;

     

       179
       198
        
                         }

     

       180
       199
        
                       '';

     

       181
       200
        
                     };

     
···

       203
       222
        
                   lighthouse = {

     

       204
       223
        
                     am_lighthouse = netCfg.isLighthouse;

     

       205
       224
        
                     hosts = netCfg.lighthouses;

     

       225
       225
       +
                     serve_dns = netCfg.lighthouse.dns.enable;

     

       226
       226
       +
                     dns.host = netCfg.lighthouse.dns.host;

     

       227
       227
       +
                     dns.port = netCfg.lighthouse.dns.port;

     

       206
       228
        
                   };

     

       207
       229
        
                   relay = {

     

       208
       230
        
                     am_relay = netCfg.isRelay;

     
···

       231
       253
        
                     ''

     

       232
       254
        
                     settings

     

       233
       255
        
                 );

     

       256
       256
       +
                 capabilities =

     

       257
       257
       +
                   let

     

       258
       258
       +
                     nebulaPort = if !settings.tun.disabled then settings.listen.port else 0;

     

       259
       259
       +
                     dnsPort = if settings.lighthouse.serve_dns then settings.lighthouse.dns.port else 0;

     

       260
       260
       +
                   in

     

       261
       261
       +
                   lib.concatStringsSep " " (

     

       262
       262
       +
                     # creation of tunnel interfaces

     

       263
       263
       +
                     lib.optional (!settings.tun.disabled) "CAP_NET_ADMIN"

     

       264
       264
       +
                     # binding to privileged ports

     

       265
       265
       +
                     ++ lib.optional (

     

       266
       266
       +
                       nebulaPort > 0 && nebulaPort < 1024 || dnsPort > 0 && dnsPort < 1024

     

       267
       267
       +
                     ) "CAP_NET_BIND_SERVICE"

     

       268
       268
       +
                   );

     

       234
       269
        
               in

     

       235
       270
        
               {

     

       236
       271
        
                 # Create the systemd service for Nebula.

     
···

       248
       283
        
                     Restart = "always";

     

       249
       284
        
                     ExecStart = "${netCfg.package}/bin/nebula -config ${configFile}";

     

       250
       285
        
                     UMask = "0027";

     

       251
       251
       -
                     CapabilityBoundingSet = "CAP_NET_ADMIN";

     

       252
       252
       -
                     AmbientCapabilities = "CAP_NET_ADMIN";

     

       286
       286
       +
                     CapabilityBoundingSet = capabilities;

     

       287
       287
       +
                     AmbientCapabilities = capabilities;

     

       253
       288
        
                     LockPersonality = true;

     

       254
       289
        
                     NoNewPrivileges = true;

     

       255
       290
        
                     PrivateDevices = false; # needs access to /dev/net/tun (below)

     
···

       302
       337
        
           );

     

       303
       338
        
         };

     

       304
       339
        
       

     

       305
       305
       -
         meta.maintainers = with lib.maintainers; [ numinit ];

     

       340
       340
       +
         meta.maintainers = with lib.maintainers; [

     

       341
       341
       +
           numinit

     

       342
       342
       +
           siriobalmelli

     

       343
       343
       +
         ];

     

       306
       344
        
       }