From 21e407aa593c4ead51b44b0b993093f32cbdd852 Mon Sep 17 00:00:00 2001 From: tv Date: Thu, 23 Dec 2021 01:12:38 +0100 Subject: krebs.tinc: use LoadCredential --- krebs/3modules/tinc.nix | 77 +++++++++++++++++-------------------------------- 1 file changed, 27 insertions(+), 50 deletions(-) (limited to 'krebs/3modules/tinc.nix') diff --git a/krebs/3modules/tinc.nix b/krebs/3modules/tinc.nix index 3d0cc8fb..a0fc39e6 100644 --- a/krebs/3modules/tinc.nix +++ b/krebs/3modules/tinc.nix @@ -28,10 +28,6 @@ let Interface = ${netname} Broadcast = no ${concatMapStrings (c: "ConnectTo = ${c}\n") tinc.config.connectTo} - ${optionalString (tinc.config.privkey_ed25519 != null) - "Ed25519PrivateKeyFile = ${tinc.config.privkey_ed25519.path}" - } - PrivateKeyFile = ${tinc.config.privkey.path} Port = ${toString tinc.config.host.nets.${netname}.tinc.port} ${tinc.config.extraConfig} ''; @@ -169,25 +165,17 @@ let }; privkey = mkOption { - type = types.secret-file; - default = { - name = "${tinc.config.netname}.rsa_key.priv"; - path = "${tinc.config.user.home}/tinc.rsa_key.priv"; - owner = tinc.config.user; - source-path = toString + "/${tinc.config.netname}.rsa_key.priv"; - }; + type = types.absolute-pathname; + default = toString + "/${tinc.config.netname}.rsa_key.priv"; defaultText = "‹secrets/‹netname›.rsa_key.priv›"; }; privkey_ed25519 = mkOption { - type = types.nullOr types.secret-file; + type = types.nullOr types.absolute-pathname; default = - if config.krebs.hosts.${tinc.config.host.name}.nets.${tinc.config.netname}.tinc.pubkey_ed25519 == null then null else { - name = "${tinc.config.netname}.ed25519_key.priv"; - path = "${tinc.config.user.home}/tinc.ed25519_key.priv"; - owner = tinc.config.user; - source-path = toString + "/${tinc.config.netname}.ed25519_key.priv"; - }; + if tinc.config.host.nets.${netname}.tinc.pubkey_ed25519 == null + then null + else toString + "/${tinc.config.netname}.ed25519_key.priv"; defaultText = "‹secrets/‹netname›.ed25519_key.priv›"; }; @@ -230,24 +218,6 @@ let # TODO `environment.systemPackages = [ cfg.tincPackage cfg.iproutePackage ]` for each network, # avoid conflicts in environment if the packages differ - krebs.secret.files = - let - ed25519_keys = - filterAttrs - (_: key: key != null) - (mapAttrs' - (netname: cfg: - nameValuePair "${netname}.ed25519_key.priv" cfg.privkey_ed25519 - ) - config.krebs.tinc); - - rsa_keys = - mapAttrs' - (netname: cfg: nameValuePair "${netname}.rsa_key.priv" cfg.privkey) - config.krebs.tinc; - in - ed25519_keys // rsa_keys; - users.users = mapAttrs' (netname: cfg: nameValuePair "${netname}" { inherit (cfg.user) home name uid; @@ -267,30 +237,37 @@ let } ) config.krebs.tinc; - systemd.services = mapAttrs (netname: cfg: + krebs.systemd.services = mapAttrs (netname: cfg: let tinc = cfg.tincPackage; iproute = cfg.iproutePackage; in { description = "Tinc daemon for ${netname}"; - after = [ - "network.target" - config.krebs.secret.files."${netname}.rsa_key.priv".service - ] ++ optionals (cfg.privkey_ed25519 != null) [ - config.krebs.secret.files."${netname}.ed25519_key.priv".service - ]; - partOf = [ - config.krebs.secret.files."${netname}.rsa_key.priv".service - ] ++ optionals (cfg.privkey_ed25519 != null) [ - config.krebs.secret.files."${netname}.ed25519_key.priv".service - ]; + after = [ "network.target" ]; wantedBy = [ "multi-user.target" ]; path = [ tinc iproute ]; reloadIfChanged = true; restartTriggers = [ cfg.confDir ]; - serviceConfig = rec { + serviceConfig = { + LoadCredential = filter (x: x != "") [ + (optionalString (cfg.privkey_ed25519 != null) + "ed25519_key:${cfg.privkey_ed25519}" + ) + "rsa_key:${cfg.privkey}" + ]; Restart = "always"; - ExecStart = "${tinc}/sbin/tincd -c /etc/tinc/${netname} -d 0 -U ${cfg.user.name} -D --pidfile=/var/run/tinc.${SyslogIdentifier}.pid"; + ExecStart = toString [ + "${tinc}/sbin/tincd" + "-D" + "-U ${cfg.user.name}" + "-c /etc/tinc/${netname}" + "-d 0" + (optionalString (cfg.privkey_ed25519 != null) + "-o Ed25519PrivateKeyFile=\${CREDENTIALS_DIRECTORY}/ed25519_key" + ) + "-o PrivateKeyFile=\${CREDENTIALS_DIRECTORY}/rsa_key" + "--pidfile=/var/run/tinc.${netname}.pid" + ]; ExecReload = "${tinc}/sbin/tinc -n ${netname} reload"; SyslogIdentifier = netname; }; -- cgit v1.2.3 From 018018e16b95b45f4a086df48c10a102a34e79ba Mon Sep 17 00:00:00 2001 From: tv Date: Thu, 23 Dec 2021 03:12:02 +0100 Subject: krebs.tinc: don't bother aliasing packages --- krebs/3modules/tinc.nix | 70 ++++++++++++++++++++++++------------------------- 1 file changed, 34 insertions(+), 36 deletions(-) (limited to 'krebs/3modules/tinc.nix') diff --git a/krebs/3modules/tinc.nix b/krebs/3modules/tinc.nix index a0fc39e6..2daef8e1 100644 --- a/krebs/3modules/tinc.nix +++ b/krebs/3modules/tinc.nix @@ -237,41 +237,39 @@ let } ) config.krebs.tinc; - krebs.systemd.services = mapAttrs (netname: cfg: - let - tinc = cfg.tincPackage; - iproute = cfg.iproutePackage; - in { - description = "Tinc daemon for ${netname}"; - after = [ "network.target" ]; - wantedBy = [ "multi-user.target" ]; - path = [ tinc iproute ]; - reloadIfChanged = true; - restartTriggers = [ cfg.confDir ]; - serviceConfig = { - LoadCredential = filter (x: x != "") [ - (optionalString (cfg.privkey_ed25519 != null) - "ed25519_key:${cfg.privkey_ed25519}" - ) - "rsa_key:${cfg.privkey}" - ]; - Restart = "always"; - ExecStart = toString [ - "${tinc}/sbin/tincd" - "-D" - "-U ${cfg.user.name}" - "-c /etc/tinc/${netname}" - "-d 0" - (optionalString (cfg.privkey_ed25519 != null) - "-o Ed25519PrivateKeyFile=\${CREDENTIALS_DIRECTORY}/ed25519_key" - ) - "-o PrivateKeyFile=\${CREDENTIALS_DIRECTORY}/rsa_key" - "--pidfile=/var/run/tinc.${netname}.pid" - ]; - ExecReload = "${tinc}/sbin/tinc -n ${netname} reload"; - SyslogIdentifier = netname; - }; - } - ) config.krebs.tinc; + krebs.systemd.services = mapAttrs (netname: cfg: { + description = "Tinc daemon for ${netname}"; + after = [ "network.target" ]; + wantedBy = [ "multi-user.target" ]; + path = [ + cfg.iproutePackage + cfg.tincPackage + ]; + reloadIfChanged = true; + restartTriggers = [ cfg.confDir ]; + serviceConfig = { + LoadCredential = filter (x: x != "") [ + (optionalString (cfg.privkey_ed25519 != null) + "ed25519_key:${cfg.privkey_ed25519}" + ) + "rsa_key:${cfg.privkey}" + ]; + Restart = "always"; + ExecStart = toString [ + "${cfg.tincPackage}/sbin/tincd" + "-D" + "-U ${cfg.user.name}" + "-c /etc/tinc/${netname}" + "-d 0" + (optionalString (cfg.privkey_ed25519 != null) + "-o Ed25519PrivateKeyFile=\${CREDENTIALS_DIRECTORY}/ed25519_key" + ) + "-o PrivateKeyFile=\${CREDENTIALS_DIRECTORY}/rsa_key" + "--pidfile=/var/run/tinc.${netname}.pid" + ]; + ExecReload = "${cfg.tincPackage}/sbin/tinc -n ${netname} reload"; + SyslogIdentifier = netname; + }; + }) config.krebs.tinc; }; in out -- cgit v1.2.3 From 8029e80632da0dcb886445bd1e9ba2d55821cc30 Mon Sep 17 00:00:00 2001 From: tv Date: Thu, 23 Dec 2021 03:16:44 +0100 Subject: krebs.tinc: drop api and imp boilerplate --- krebs/3modules/tinc.nix | 14 ++++---------- 1 file changed, 4 insertions(+), 10 deletions(-) (limited to 'krebs/3modules/tinc.nix') diff --git a/krebs/3modules/tinc.nix b/krebs/3modules/tinc.nix index 2daef8e1..91aa37fd 100644 --- a/krebs/3modules/tinc.nix +++ b/krebs/3modules/tinc.nix @@ -1,12 +1,6 @@ with import ; -{ config, pkgs, ... }: -let - out = { - options.krebs.tinc = api; - config = imp; - }; - - api = mkOption { +{ config, pkgs, ... }: { + options.krebs.tinc = mkOption { default = {}; description = '' define a tinc network @@ -214,7 +208,7 @@ let })); }; - imp = { + config = { # TODO `environment.systemPackages = [ cfg.tincPackage cfg.iproutePackage ]` for each network, # avoid conflicts in environment if the packages differ @@ -272,4 +266,4 @@ let }; }) config.krebs.tinc; }; -in out +} -- cgit v1.2.3 From 5f7ab23ebf220194dc9ef28dd164f042ee2804c4 Mon Sep 17 00:00:00 2001 From: tv Date: Thu, 23 Dec 2021 03:20:36 +0100 Subject: krebs.tinc: drop environment.systemPackages TODO Nobody bothered about this for more than five years. And even though fixable, chances are quite high that this feature is not needed anymore. --- krebs/3modules/tinc.nix | 3 --- 1 file changed, 3 deletions(-) (limited to 'krebs/3modules/tinc.nix') diff --git a/krebs/3modules/tinc.nix b/krebs/3modules/tinc.nix index 91aa37fd..f709b334 100644 --- a/krebs/3modules/tinc.nix +++ b/krebs/3modules/tinc.nix @@ -209,9 +209,6 @@ with import ; }; config = { - # TODO `environment.systemPackages = [ cfg.tincPackage cfg.iproutePackage ]` for each network, - # avoid conflicts in environment if the packages differ - users.users = mapAttrs' (netname: cfg: nameValuePair "${netname}" { inherit (cfg.user) home name uid; -- cgit v1.2.3 From 1cf495d6eb113541dfa1667f03f7edd10c2217b1 Mon Sep 17 00:00:00 2001 From: tv Date: Thu, 23 Dec 2021 20:09:06 +0100 Subject: krebs.systemd: support credentials of any service --- krebs/3modules/tinc.nix | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) (limited to 'krebs/3modules/tinc.nix') diff --git a/krebs/3modules/tinc.nix b/krebs/3modules/tinc.nix index f709b334..dca764f6 100644 --- a/krebs/3modules/tinc.nix +++ b/krebs/3modules/tinc.nix @@ -229,6 +229,15 @@ with import ; ) config.krebs.tinc; krebs.systemd.services = mapAttrs (netname: cfg: { + serviceConfig.LoadCredential = filter (x: x != "") [ + (optionalString (cfg.privkey_ed25519 != null) + "ed25519_key:${cfg.privkey_ed25519}" + ) + "rsa_key:${cfg.privkey}" + ]; + }) config.krebs.tinc; + + systemd.services = mapAttrs (netname: cfg: { description = "Tinc daemon for ${netname}"; after = [ "network.target" ]; wantedBy = [ "multi-user.target" ]; @@ -239,12 +248,6 @@ with import ; reloadIfChanged = true; restartTriggers = [ cfg.confDir ]; serviceConfig = { - LoadCredential = filter (x: x != "") [ - (optionalString (cfg.privkey_ed25519 != null) - "ed25519_key:${cfg.privkey_ed25519}" - ) - "rsa_key:${cfg.privkey}" - ]; Restart = "always"; ExecStart = toString [ "${cfg.tincPackage}/sbin/tincd" -- cgit v1.2.3