49 lines
1.1 KiB
Nix
49 lines
1.1 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
|
|
{
|
|
|
|
krebs.iptables = {
|
|
tables = {
|
|
filter.INPUT.rules = let
|
|
tincport = toString config.krebs.build.host.nets.retiolum.tinc.port;
|
|
in [
|
|
{ predicate = "-p tcp --dport ${tincport}"; target = "ACCEPT"; }
|
|
{ predicate = "-p udp --dport ${tincport}"; target = "ACCEPT"; }
|
|
];
|
|
};
|
|
};
|
|
|
|
krebs.tinc.retiolum = {
|
|
enable = true;
|
|
connectTo = [
|
|
"prism"
|
|
"ni"
|
|
"eve"
|
|
];
|
|
extraConfig = ''
|
|
AutoConnect = no
|
|
StrictSubnets = yes
|
|
${lib.optionalString (config.krebs.build.host.nets.retiolum.via != null) ''
|
|
LocalDiscovery = no
|
|
''}
|
|
'';
|
|
tincUp = lib.mkIf config.systemd.network.enable "";
|
|
};
|
|
|
|
systemd.network.networks.retiolum = {
|
|
matchConfig.Name = "retiolum";
|
|
address = [
|
|
"${config.krebs.build.host.nets.retiolum.ip4.addr}/16"
|
|
"${config.krebs.build.host.nets.retiolum.ip6.addr}/16"
|
|
];
|
|
};
|
|
|
|
nixpkgs.config.packageOverrides = pkgs: {
|
|
tinc = pkgs.tinc_pre;
|
|
};
|
|
|
|
environment.systemPackages = [
|
|
pkgs.tinc
|
|
];
|
|
}
|