be042e3446
we do this so we never route via gum, which tends to eat our packets and makes it impossible to connect to other peers via gum.
39 lines
773 B
Nix
39 lines
773 B
Nix
{ config, lib, pkgs, ... }:
|
|
|
|
{
|
|
|
|
krebs.iptables = {
|
|
tables = {
|
|
filter.INPUT.rules = let
|
|
tincport = toString config.krebs.build.host.nets.retiolum.tinc.port;
|
|
in [
|
|
{ predicate = "-p tcp --dport ${tincport}"; target = "ACCEPT"; }
|
|
{ predicate = "-p udp --dport ${tincport}"; target = "ACCEPT"; }
|
|
];
|
|
};
|
|
};
|
|
|
|
krebs.tinc.retiolum = {
|
|
enable = true;
|
|
connectTo = [
|
|
"prism"
|
|
"ni"
|
|
"eve"
|
|
];
|
|
extraConfig = ''
|
|
StrictSubnets = yes
|
|
${lib.optionalString (config.krebs.build.host.nets.retiolum.via != null) ''
|
|
LocalDiscovery = no
|
|
''}
|
|
'';
|
|
};
|
|
|
|
nixpkgs.config.packageOverrides = pkgs: {
|
|
tinc = pkgs.tinc_pre;
|
|
};
|
|
|
|
environment.systemPackages = [
|
|
pkgs.tinc
|
|
];
|
|
}
|