Krebs host database and retiolum VPN modules.
Each top-level user directory contains that user's host and user
records. module.nix declares the krebs.* options they populate
so the set can be evaluated without stockholm.
The retiolum NixOS/Darwin modules consume the host database
directly and drive tincr.
Before the NixOS module can start tincd, the mesh needs to know
your Ed25519 public key and you need a private key on disk.
$ nix shell --refresh 'github:Mic92/tincr'
$ # pre-AVX2 x86_64: nix shell --refresh 'github:Mic92/tincr#tincd-compat'
$ sptps_keypair ed25519_key.priv ed25519_key.pub
$ sudo install -Dm600 ed25519_key.priv /var/src/secrets/tinc.retiolum.ed25519_key.priv
$ rm ed25519_key.priv
$ grep -v '^-' ed25519_key.pub
ZD2Ft17KwDElzv0YPV6AeKrMYMpqlMpN9hbGt/HcveLThe last line is your tinc.pubkey_ed25519.
Fork this repository and either edit your existing user directory or
copy template/:
$ cp -r template alice
$ $EDITOR alice/default.nix{ config, lib, ... }: let
slib = import ../lib { inherit lib; };
in {
users.alice = {
mail = "alice@example.org";
};
hosts.toaster = {
owner = config.krebs.users.alice;
nets.retiolum = {
aliases = [ "toaster.alice.r" ];
ip6.addr = (slib.krebs.genipv6 "retiolum" "alice" { hostName = "toaster"; }).address;
# optional; ask in #krebs for a free 10.243.x.y
# ip4.addr = "10.243.42.1";
tinc.pubkey_ed25519 = "ZD2Ft17KwDElzv0YPV6AeKrMYMpqlMpN9hbGt/HcveL";
};
};
}Check it evaluates and open a PR:
$ nix flake check
$ git add alice && git commit -m 'alice: add toaster'Point your configuration at kartei as shown under NixOS or
NixOS without flakes.
networking.retiolum.nodename defaults to networking.hostName and
IPv4/IPv6 are looked up from the entry you added, so the only
required setting is the private key path:
networking.retiolum.ed25519PrivateKeyFile =
"/var/src/secrets/tinc.retiolum.ed25519_key.priv";After nixos-rebuild switch, tincr-retiolum.service comes up and
ping hotdog.r should answer.
{
inputs.kartei.url = "github:krebs/kartei";
outputs = { kartei, nixpkgs, ... }: {
nixosConfigurations.myhost = nixpkgs.lib.nixosSystem {
modules = [
kartei.nixosModules.retiolum
kartei.nixosModules.ca # optional: trust the .r/.w ACME CA
# kartei.nixosModules.default # bare krebs.{hosts,users} data
{
# nodename defaults to networking.hostName; ipv4/ipv6 are
# looked up in kartei by nodename.
networking.retiolum.ed25519PrivateKeyFile =
"/var/src/secrets/tinc.retiolum.ed25519_key.priv";
}
];
};
};
}.r names resolve via tincr's DNS stub through systemd-resolved.
A static /etc/hosts copy is installed by default
(networking.retiolum.extraHosts) so the mesh stays resolvable
while tincd is restarting.
On pre-AVX2 x86_64 hardware set
services.tincr.package = tincr.packages.${system}.tincd-compat;.
{
imports = let
kartei = builtins.fetchTarball "https://github.com/krebs/kartei/archive/master.tar.gz";
in [
"${kartei}/modules/retiolum"
"${kartei}/modules/ca"
];
networking.retiolum.ed25519PrivateKeyFile = "/var/src/secrets/tinc.retiolum.ed25519_key.priv";
}The module fetches tincr from the revision pinned in flake.lock.
darwinConfigurations.mymac = darwin.lib.darwinSystem {
modules = [
kartei.darwinModules.retiolum
kartei.darwinModules.ca
{
networking.retiolum.nodename = "mymac";
networking.retiolum.ed25519PrivateKeyFile =
"/var/src/secrets/tinc.retiolum.ed25519_key.priv";
}
];
};Plain-file outputs:
nix build .#retiolum-hosts # /etc/tinc/retiolum/hosts directory
nix build .#etc-hosts # /etc/hosts fragment (v4+v6)
nix build .#etc-hosts-v6only
nix build .#wiregrill-json