Merge pull request 'zerotier: fix eval if meshname is not known yet' (#510) from Mic92-sops-nix into main

checks/meshnamed/default.nix

@@ -14,7 +14,7 @@
   testScript = ''
     start_all()
     machine.wait_for_unit("meshnamed")
-    out = machine.succeed("${pkgs.dnsutils}/bin/dig -p 53535 AAAA foo.7vbx332lkaunatuzsndtanix54.vpn @localhost +short")
+    out = machine.succeed("${pkgs.dnsutils}/bin/dig AAAA foo.7vbx332lkaunatuzsndtanix54.vpn @meshnamed +short")
     print(out)
     assert out.strip() == "fd43:7def:4b50:28d0:4e99:9347:3035:17ef"
   '';

clanModules/deltachat.nix

@@ -2,9 +2,15 @@
   networking.firewall.interfaces."zt+".allowedTCPPorts = [ 25 ]; # smtp with other hosts
   environment.systemPackages = [ pkgs.deltachat-desktop ];
 
-  services.maddy = {
+  services.maddy =
+    let
+      # FIXME move this to public setting
+      meshname = config.clanCore.secrets.zerotier.facts.zerotier-meshname.value or null;
+      domain = if meshname == null then "${config.clanCore.machineName}.local" else "${meshname}.vpn";
+    in
+    {
       enable = true;
-    primaryDomain = "${config.clanCore.machineName}.local";
+      primaryDomain = domain;
       config = ''
         # Minimal configuration with TLS disabled, adapted from upstream example
         # configuration here https://github.com/foxcpp/maddy/blob/master/maddy.conf

nixosModules/clanCore/flake-module.nix

@@ -1,7 +1,7 @@
 { self, inputs, lib, ... }: {
   flake.nixosModules.clanCore = { config, pkgs, options, ... }: {
     imports = [
-      ../clanImports
+      ./clan-imports
       ./secrets
       ./zerotier
       ./meshnamed

nixosModules/clanCore/meshnamed/default.nix

@@ -1,4 +1,7 @@
 { config, lib, pkgs, ... }:
+let
+  localAddress = "fd66:29e9:f422:8dfe:beba:68ec:bd09:7876";
+in
 {
   options.clan.networking.meshnamed = {
     enable = (lib.mkEnableOption "meshnamed") // {
@@ -28,6 +31,24 @@
     };
   };
   config = lib.mkIf config.clan.networking.meshnamed.enable {
+    # we assign this random source address to bind meshnamed to.
+    systemd.network.networks.loopback-addresses = {
+      matchConfig.Name = "lo";
+      networkConfig.Address = [ localAddress ];
+    };
+
+
+    services.resolved.extraConfig = ''
+      [Resolve]
+      DNS=${localAddress}
+      Domains=~${lib.concatMapStringsSep " " (network: network.name) (builtins.attrValues config.clan.networking.meshnamed.networks)}
+    '';
+
+    # for convience, so we can debug with dig
+    networking.extraHosts = ''
+      ${localAddress} meshnamed
+    '';
+
     systemd.services.meshnamed =
       let
         networks = lib.concatMapStringsSep "," (network: "${network.name}=${network.subnet}")
@@ -38,7 +59,10 @@
         after = [ "network.target" ];
         serviceConfig = {
           Type = "simple";
-          ExecStart = "${pkgs.callPackage ../../../pkgs/meshname/default.nix { }}/bin/meshnamed -networks ${networks}";
+          ExecStart = "${pkgs.callPackage ../../../pkgs/meshname/default.nix { }}/bin/meshnamed -networks ${networks} -listenaddr [${localAddress}]:53";
+
+          # to bind port 53
+          AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
           DynamicUser = true;
         };
       };

nixosModules/clanCore/networking.nix

@@ -18,4 +18,17 @@
       default = "root@${config.networking.hostName}";
     };
   };
+  config = {
+    # conflicts with systemd-resolved
+    networking.useHostResolvConf = false;
+
+    # The notion of "online" is a broken concept
+    # https://github.com/systemd/systemd/blob/e1b45a756f71deac8c1aa9a008bd0dab47f64777/NEWS#L13
+    systemd.services.NetworkManager-wait-online.enable = false;
+    systemd.network.wait-online.enable = false;
+
+    # Use networkd instead of the pile of shell scripts
+    networking.useNetworkd = lib.mkDefault true;
+    networking.useDHCP = lib.mkDefault false;
+  };
 }

nixosModules/clanCore/zerotier/default.nix

@@ -1,7 +1,7 @@
 { config, lib, pkgs, ... }:
 let
   cfg = config.clan.networking.zerotier;
-  facts = config.clanCore.secrets.zerotier.facts;
+  facts = config.clanCore.secrets.zerotier.facts or { };
   networkConfig = {
     authTokens = [
       null
@@ -56,7 +56,9 @@ in
       type = lib.types.nullOr lib.types.str;
       readOnly = true;
       default =
-        if cfg.networkId != null then
+        if cfg.networkId == null then
+          null
+        else
           let
             part0 = builtins.substring 0 2 cfg.networkId;
             part1 = builtins.substring 2 2 cfg.networkId;
@@ -67,9 +69,7 @@ in
             part6 = builtins.substring 12 2 cfg.networkId;
             part7 = builtins.substring 14 2 cfg.networkId;
           in
-          "fd${part0}:${part1}${part2}:${part3}${part4}:${part5}${part6}:${part7}99:9300::/88"
-        else
-          null;
+          "fd${part0}:${part1}${part2}:${part3}${part4}:${part5}${part6}:${part7}99:9300::/88";
       description = ''
         zerotier subnet
       '';
@@ -91,9 +91,10 @@ in
       # having to re-import nixpkgs.
       services.zerotierone.package = lib.mkDefault (pkgs.zerotierone.overrideAttrs (_old: { meta = { }; }));
     })
-    (lib.mkIf (cfg.networkId != null) {
+    (lib.mkIf (facts ? zerotier-meshname && (facts.zerotier-meshname.value or null) != null) {
       environment.etc."zerotier/hostname".text = "${facts.zerotier-meshname.value}.vpn";
-
+    })
+    (lib.mkIf (cfg.networkId != null) {
       clan.networking.meshnamed.networks.vpn.subnet = cfg.subnet;
 
       systemd.network.enable = true;
@@ -152,7 +153,7 @@ in
         '';
       };
     })
-    (lib.mkIf (cfg.controller.enable && config.clanCore.secrets ? zerotier && facts.zerotier-network-id.value != null) {
+    (lib.mkIf (cfg.controller.enable && (facts.zerotier-network-id.value or null) != null) {
       clan.networking.zerotier.networkId = facts.zerotier-network-id.value;
       environment.etc."zerotier/network-id".text = facts.zerotier-network-id.value;
 

pkgs/clan-cli/clan_cli/task_manager.py

@@ -38,6 +38,7 @@ class Command:
         cmd: list[str],
         env: Optional[dict[str, str]] = None,
         cwd: Optional[Path] = None,
+        name: str = "command",
     ) -> None:
         self.running = True
         self.log.debug(f"Command: {shlex.join(cmd)}")
@@ -70,11 +71,10 @@ class Command:
             for fd in rlist:
                 try:
                     for line in fd:
+                        self.log.debug(f"[{name}] {line.rstrip()}")
                         if fd == self.p.stderr:
-                            self.log.debug(f"[{cmd}] stderr: {line}")
                             self.stderr.append(line)
                         else:
-                            self.log.debug(f"[{cmd}] stdout: {line}")
                             self.stdout.append(line)
                         self._output.put(line)
                 except BlockingIOError:

pkgs/clan-cli/clan_cli/vms/create.py

@@ -42,7 +42,8 @@ class BuildVmTask(BaseTask):
                     f'{clan_dir}#clanInternals.machines."{system}"."{machine}".config.system.clan.vm.create'
                 ]
                 + self.nix_options
-            )
+            ),
+            name="buildvm",
         )
         vm_json = "".join(cmd.stdout).strip()
         self.log.debug(f"VM JSON path: {vm_json}")
@@ -52,7 +53,10 @@ class BuildVmTask(BaseTask):
     def get_clan_name(self, cmds: Iterator[Command]) -> str:
         clan_dir = self.vm.flake_url
         cmd = next(cmds)
-        cmd.run(nix_eval([f"{clan_dir}#clanInternals.clanName"]) + self.nix_options)
+        cmd.run(
+            nix_eval([f"{clan_dir}#clanInternals.clanName"]) + self.nix_options,
+            name="clanname",
+        )
         clan_name = cmd.stdout[0].strip().strip('"')
         return clan_name
 
@@ -95,6 +99,7 @@ class BuildVmTask(BaseTask):
                     cmd.run(
                         [vm_config["generateSecrets"], clan_name],
                         env=env,
+                        name="generateSecrets",
                     )
                 else:
                     self.log.warning("won't generate secrets for non local clan")
@@ -103,6 +108,7 @@ class BuildVmTask(BaseTask):
             cmd.run(
                 [vm_config["uploadSecrets"]],
                 env=env,
+                name="uploadSecrets",
             )
 
             cmd = next(cmds)
@@ -117,7 +123,8 @@ class BuildVmTask(BaseTask):
                         str(disk_img),
                         "1024M",
                     ],
-                )
+                ),
+                name="createDisk",
             )
 
             cmd = next(cmds)
@@ -130,7 +137,8 @@ class BuildVmTask(BaseTask):
                         "nixos",
                         str(disk_img),
                     ],
-                )
+                ),
+                name="formatDisk",
             )
 
             cmd = next(cmds)
@@ -184,7 +192,7 @@ class BuildVmTask(BaseTask):
             if not self.vm.graphics:
                 qemu_command.append("-nographic")
             print("$ " + shlex.join(qemu_command))
-            cmd.run(nix_shell(["qemu"], qemu_command))
+            cmd.run(nix_shell(["qemu"], qemu_command), name="qemu")
 
 
 def create_vm(vm: VmConfig, nix_options: list[str] = []) -> BuildVmTask:

pkgs/clan-cli/pyproject.toml

@@ -23,7 +23,7 @@ log_level = "DEBUG"
 log_format = "%(levelname)s: %(message)s\n       %(pathname)s:%(lineno)d::%(funcName)s"
 addopts = "--cov . --cov-report term --cov-report html:.reports/html --no-cov-on-fail --durations 5 --color=yes --new-first" # Add --pdb for debugging
 norecursedirs = "tests/helpers"
-markers = [ "impure" ]
+markers = [ "impure", "with_core" ]
 
 [tool.mypy]
 plugins = ["deal.mypy"]