Mic92/stockholm
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

krebs.retiolum: use krebs.secret

Browse Source
This commit is contained in:
tv 2016-04-08 04:11:00 +02:00
parent 7b7e8b11b5
commit 0dc2a751a9
1 changed files with 22 additions and 28 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

50
krebs/3modules/retiolum.nix
View File

@ -86,17 +86,13 @@ let
description = "Iproute2 package to use."; description = "Iproute2 package to use.";
}; };
privkey = mkOption {
privateKeyFile = mkOption { type = types.secret-file;
# TODO if it's types.path then it gets copied to /nix/store with default = {
# bad unsafe permissions... path = "${cfg.user.home}/tinc.rsa_key.priv";
type = types.str; owner = cfg.user;
default = toString <secrets/retiolum.rsa_key.priv>; source-path = toString <secrets> + "/${cfg.netname}.rsa_key.priv";
description = '' };
Generate file with <literal>tincd -K</literal>.
This file must exist on the local system. The default points to
<secrets/retiolum.rsa_key.priv>.
'';
}; };
connectTo = mkOption { connectTo = mkOption {
@ -109,41 +105,39 @@ let
''; '';
}; };
user = mkOption {
type = types.user;
default = {
name = cfg.netname;
home = "/var/lib/${cfg.user.name}";
};
};
}; };
imp = { imp = {
krebs.secret.files."${cfg.netname}.rsa_key.priv" = cfg.privkey;
environment.systemPackages = [ tinc iproute ]; environment.systemPackages = [ tinc iproute ];
systemd.services.${cfg.netname} = { systemd.services.${cfg.netname} = {
description = "Tinc daemon for Retiolum"; description = "Tinc daemon for Retiolum";
after = [ "network.target" ]; after = [ "network.target" ];
wantedBy = [ "multi-user.target" ]; wantedBy = [ "multi-user.target" ];
requires = [ "secret.service" ];
path = [ tinc iproute ]; path = [ tinc iproute ];
serviceConfig = rec { serviceConfig = rec {
PermissionsStartOnly = "true";
PrivateTmp = "true";
Restart = "always"; Restart = "always";
# TODO we cannot chroot (-R) b/c we use symlinks to hosts ExecStart = "${tinc}/sbin/tincd -c ${confDir} -d 0 -U ${cfg.user.name} -D --pidfile=/var/run/tinc.${SyslogIdentifier}.pid";
# and the private key.
ExecStartPre = pkgs.writeScript "${cfg.netname}-prestart" ''
#! /bin/sh
install -o ${user.name} -m 0400 ${cfg.privateKeyFile} /tmp/retiolum-rsa_key.priv
'';
ExecStart = "${tinc}/sbin/tincd -c ${confDir} -d 0 -U ${user.name} -D --pidfile=/var/run/tinc.${SyslogIdentifier}.pid";
SyslogIdentifier = cfg.netname; SyslogIdentifier = cfg.netname;
}; };
}; };
users.extraUsers = singleton { users.users.${cfg.user.name} = {
inherit (user) name uid; inherit (cfg.user) home name uid;
createHome = true;
}; };
}; };
user = rec {
name = cfg.netname;
uid = genid name;
};
net = cfg.host.nets.${cfg.netname}; net = cfg.host.nets.${cfg.netname};
tinc = cfg.tincPackage; tinc = cfg.tincPackage;
@ -158,7 +152,7 @@ let
Name = ${cfg.host.name} Name = ${cfg.host.name}
Interface = ${cfg.netname} Interface = ${cfg.netname}
${concatStrings (map (c: "ConnectTo = ${c}\n") cfg.connectTo)} ${concatStrings (map (c: "ConnectTo = ${c}\n") cfg.connectTo)}
PrivateKeyFile = /tmp/retiolum-rsa_key.priv PrivateKeyFile = ${cfg.privkey.path}
${cfg.extraConfig} ${cfg.extraConfig}
''; '';
"tinc-up" = pkgs.writeScript "${cfg.netname}-tinc-up" '' "tinc-up" = pkgs.writeScript "${cfg.netname}-tinc-up" ''