From 46e818ebbc5446b4215ad9524089d9b2dc91cbd3 Mon Sep 17 00:00:00 2001 From: tv Date: Fri, 8 Apr 2016 03:53:34 +0200 Subject: retiolum: don't hardcode routing prefixes --- krebs/3modules/retiolum.nix | 83 ++++++++++++++++----------------------------- 1 file changed, 29 insertions(+), 54 deletions(-) (limited to 'krebs/3modules/retiolum.nix') diff --git a/krebs/3modules/retiolum.nix b/krebs/3modules/retiolum.nix index 61b4473e1..fe4dbd50c 100644 --- a/krebs/3modules/retiolum.nix +++ b/krebs/3modules/retiolum.nix @@ -11,26 +11,13 @@ let api = { enable = mkEnableOption "krebs.retiolum"; - name = mkOption { - type = types.str; - default = config.networking.hostName; - # Description stolen from tinc.conf(5). - description = '' - This is the name which identifies this tinc daemon. It must - be unique for the virtual private network this daemon will - connect to. The Name may only consist of alphanumeric and - underscore characters. If Name starts with a $, then the - contents of the environment variable that follows will be - used. In that case, invalid characters will be converted to - underscores. If Name is $HOST, but no such environment - variable exist, the hostname will be read using the - gethostnname() system call This is the name which identifies - the this tinc daemon. - ''; + host = mkOption { + type = types.host; + default = config.krebs.build.host; }; netname = mkOption { - type = types.str; + type = types.hostname; default = "retiolum"; description = '' The tinc network name. @@ -157,46 +144,34 @@ let uid = genid name; }; + net = cfg.host.nets.${cfg.netname}; + tinc = cfg.tincPackage; iproute = cfg.iproutePackage; - confDir = pkgs.runCommand "retiolum" { - # TODO text - executable = true; - preferLocalBuild = true; - } '' - set -euf - - mkdir -p $out - - ln -s ${cfg.hostsPackage} $out/hosts - - cat > $out/tinc.conf < $out/tinc-up < Date: Fri, 8 Apr 2016 03:59:26 +0200 Subject: retiolum netname: hostname -> enum --- krebs/3modules/retiolum.nix | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) (limited to 'krebs/3modules/retiolum.nix') diff --git a/krebs/3modules/retiolum.nix b/krebs/3modules/retiolum.nix index fe4dbd50c..8217cbcfd 100644 --- a/krebs/3modules/retiolum.nix +++ b/krebs/3modules/retiolum.nix @@ -17,7 +17,7 @@ let }; netname = mkOption { - type = types.hostname; + type = types.enum (attrNames cfg.host.nets); default = "retiolum"; description = '' The tinc network name. @@ -114,7 +114,7 @@ let imp = { environment.systemPackages = [ tinc iproute ]; - systemd.services.retiolum = { + systemd.services.${cfg.netname} = { description = "Tinc daemon for Retiolum"; after = [ "network.target" ]; wantedBy = [ "multi-user.target" ]; @@ -125,12 +125,12 @@ let Restart = "always"; # TODO we cannot chroot (-R) b/c we use symlinks to hosts # and the private key. - ExecStartPre = pkgs.writeScript "retiolum-init" '' + ExecStartPre = pkgs.writeScript "${cfg.netname}-prestart" '' #! /bin/sh install -o ${user.name} -m 0400 ${cfg.privateKeyFile} /tmp/retiolum-rsa_key.priv ''; ExecStart = "${tinc}/sbin/tincd -c ${confDir} -d 0 -U ${user.name} -D --pidfile=/var/run/tinc.${SyslogIdentifier}.pid"; - SyslogIdentifier = "retiolum"; + SyslogIdentifier = cfg.netname; }; }; @@ -140,7 +140,7 @@ let }; user = rec { - name = "retiolum"; + name = cfg.netname; uid = genid name; }; -- cgit v1.2.3 From 0dc2a751a902e11b4e3d2805fe2f97b09479ec85 Mon Sep 17 00:00:00 2001 From: tv Date: Fri, 8 Apr 2016 04:11:00 +0200 Subject: krebs.retiolum: use krebs.secret --- krebs/3modules/retiolum.nix | 50 ++++++++++++++++++++------------------------- 1 file changed, 22 insertions(+), 28 deletions(-) (limited to 'krebs/3modules/retiolum.nix') diff --git a/krebs/3modules/retiolum.nix b/krebs/3modules/retiolum.nix index 8217cbcfd..5aaeb5a30 100644 --- a/krebs/3modules/retiolum.nix +++ b/krebs/3modules/retiolum.nix @@ -86,17 +86,13 @@ let description = "Iproute2 package to use."; }; - - privateKeyFile = mkOption { - # TODO if it's types.path then it gets copied to /nix/store with - # bad unsafe permissions... - type = types.str; - default = toString ; - description = '' - Generate file with tincd -K. - This file must exist on the local system. The default points to - . - ''; + privkey = mkOption { + type = types.secret-file; + default = { + path = "${cfg.user.home}/tinc.rsa_key.priv"; + owner = cfg.user; + source-path = toString + "/${cfg.netname}.rsa_key.priv"; + }; }; connectTo = mkOption { @@ -109,41 +105,39 @@ let ''; }; + user = mkOption { + type = types.user; + default = { + name = cfg.netname; + home = "/var/lib/${cfg.user.name}"; + }; + }; }; imp = { + krebs.secret.files."${cfg.netname}.rsa_key.priv" = cfg.privkey; + environment.systemPackages = [ tinc iproute ]; systemd.services.${cfg.netname} = { description = "Tinc daemon for Retiolum"; after = [ "network.target" ]; wantedBy = [ "multi-user.target" ]; + requires = [ "secret.service" ]; path = [ tinc iproute ]; serviceConfig = rec { - PermissionsStartOnly = "true"; - PrivateTmp = "true"; Restart = "always"; - # TODO we cannot chroot (-R) b/c we use symlinks to hosts - # and the private key. - ExecStartPre = pkgs.writeScript "${cfg.netname}-prestart" '' - #! /bin/sh - install -o ${user.name} -m 0400 ${cfg.privateKeyFile} /tmp/retiolum-rsa_key.priv - ''; - ExecStart = "${tinc}/sbin/tincd -c ${confDir} -d 0 -U ${user.name} -D --pidfile=/var/run/tinc.${SyslogIdentifier}.pid"; + ExecStart = "${tinc}/sbin/tincd -c ${confDir} -d 0 -U ${cfg.user.name} -D --pidfile=/var/run/tinc.${SyslogIdentifier}.pid"; SyslogIdentifier = cfg.netname; }; }; - users.extraUsers = singleton { - inherit (user) name uid; + users.users.${cfg.user.name} = { + inherit (cfg.user) home name uid; + createHome = true; }; }; - user = rec { - name = cfg.netname; - uid = genid name; - }; - net = cfg.host.nets.${cfg.netname}; tinc = cfg.tincPackage; @@ -158,7 +152,7 @@ let Name = ${cfg.host.name} Interface = ${cfg.netname} ${concatStrings (map (c: "ConnectTo = ${c}\n") cfg.connectTo)} - PrivateKeyFile = /tmp/retiolum-rsa_key.priv + PrivateKeyFile = ${cfg.privkey.path} ${cfg.extraConfig} ''; "tinc-up" = pkgs.writeScript "${cfg.netname}-tinc-up" '' -- cgit v1.2.3 [cgit] Unable to lock slot /tmp/cgit/e2100000.lock: No such file or directory (2)