Improved quickstart.me
This commit is contained in:
Luis-Hebendanz
32
nixosModules/core/flake-module.nix
Normal file
32
nixosModules/core/flake-module.nix
Normal file
@@ -0,0 +1,32 @@
|
||||
{ self, inputs, lib, ... }: {
|
||||
flake.nixosModules.clan.core = { pkgs, ... }: {
|
||||
options.clan.core = {
|
||||
clanDir = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = ''
|
||||
the location of the flake repo, used to calculate the location of facts and secrets
|
||||
'';
|
||||
};
|
||||
machineName = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = ''
|
||||
the name of the machine
|
||||
'';
|
||||
};
|
||||
clanPkgs = lib.mkOption {
|
||||
default = self.packages.${pkgs.system};
|
||||
};
|
||||
};
|
||||
options.system.clan = lib.mkOption {
|
||||
type = lib.types.lazyAttrsOf lib.types.raw;
|
||||
description = ''
|
||||
utility outputs for clan management of this machine
|
||||
'';
|
||||
};
|
||||
imports = [
|
||||
./secrets
|
||||
./zerotier.nix
|
||||
inputs.sops-nix.nixosModules.sops
|
||||
];
|
||||
};
|
||||
}
|
||||
66
nixosModules/core/secrets/default.nix
Normal file
66
nixosModules/core/secrets/default.nix
Normal file
@@ -0,0 +1,66 @@
|
||||
{ config, lib, ... }:
|
||||
{
|
||||
options.clan.core.secrets = lib.mkOption {
|
||||
type = lib.types.attrsOf
|
||||
(lib.types.submodule (secret: {
|
||||
options = {
|
||||
name = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = secret.config._module.args.name;
|
||||
description = ''
|
||||
namespace of the secret
|
||||
'';
|
||||
};
|
||||
generator = lib.mkOption {
|
||||
type = lib.types.nullOr lib.types.str;
|
||||
description = ''
|
||||
script to generate the secret.
|
||||
can be set to null. then the user has to provide the secret via the clan cli
|
||||
'';
|
||||
};
|
||||
secrets = lib.mkOption {
|
||||
type = lib.types.attrsOf (lib.types.submodule (secret: {
|
||||
options = {
|
||||
name = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = ''
|
||||
name of the secret
|
||||
'';
|
||||
default = secret.config._module.args.name;
|
||||
};
|
||||
};
|
||||
}));
|
||||
description = ''
|
||||
path where the secret is located in the filesystem
|
||||
'';
|
||||
};
|
||||
facts = lib.mkOption {
|
||||
type = lib.types.attrsOf (lib.types.submodule (fact: {
|
||||
options = {
|
||||
name = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = ''
|
||||
name of the fact
|
||||
'';
|
||||
default = fact.config._module.args.name;
|
||||
};
|
||||
path = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = ''
|
||||
path to a fact which is generated by the generator
|
||||
'';
|
||||
default = "${config.clan.core.clanDir}/facts/${config.clan.core.machineName}/${fact.config._module.args.name}";
|
||||
};
|
||||
value = lib.mkOption {
|
||||
default = builtins.readFile fact.config.path;
|
||||
};
|
||||
};
|
||||
}));
|
||||
};
|
||||
};
|
||||
}));
|
||||
};
|
||||
imports = [
|
||||
./sops.nix # for now we have only one implementation, thats why we import it here and not in clanModules
|
||||
];
|
||||
}
|
||||
63
nixosModules/core/secrets/sops.nix
Normal file
63
nixosModules/core/secrets/sops.nix
Normal file
@@ -0,0 +1,63 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
{
|
||||
config = {
|
||||
system.clan.generateSecrets = pkgs.writeScript "generate_secrets" ''
|
||||
#!/bin/sh
|
||||
set -efu
|
||||
set -x # remove for prod
|
||||
|
||||
PATH=$PATH:${lib.makeBinPath [
|
||||
config.clan.core.clanPkgs.clan-cli
|
||||
]}
|
||||
|
||||
# initialize secret store
|
||||
if ! clan secrets machines list | grep -q ${config.clan.core.machineName}; then (
|
||||
INITTMP=$(mktemp -d)
|
||||
trap 'rm -rf "$INITTMP"' EXIT
|
||||
${pkgs.age}/bin/age-keygen -o "$INITTMP/secret" 2> "$INITTMP/public"
|
||||
PUBKEY=$(cat "$INITTMP/public" | sed 's/.*: //')
|
||||
clan secrets machines add ${config.clan.core.machineName} "$PUBKEY"
|
||||
tail -1 "$INITTMP/secret" | clan secrets set --machine ${config.clan.core.machineName} ${config.clan.core.machineName}-age.key
|
||||
) fi
|
||||
|
||||
${lib.foldlAttrs (acc: n: v: ''
|
||||
${acc}
|
||||
# ${n}
|
||||
# if any of the secrets are missing, we regenerate all connected facts/secrets
|
||||
(if ! ${lib.concatMapStringsSep " && " (x: "clan secrets get ${config.clan.core.machineName}-${x.name} >/dev/null") (lib.attrValues v.secrets)}; then
|
||||
|
||||
facts=$(mktemp -d)
|
||||
trap "rm -rf $facts" EXIT
|
||||
secrets=$(mktemp -d)
|
||||
trap "rm -rf $secrets" EXIT
|
||||
${v.generator}
|
||||
|
||||
${lib.concatMapStrings (fact: ''
|
||||
mkdir -p "$(dirname ${fact.path})"
|
||||
cp "$facts"/${fact.name} ${fact.path}
|
||||
'') (lib.attrValues v.facts)}
|
||||
|
||||
${lib.concatMapStrings (secret: ''
|
||||
cat "$secrets"/${secret.name} | clan secrets set --machine ${config.clan.core.machineName} ${config.clan.core.machineName}-${secret.name}
|
||||
'') (lib.attrValues v.secrets)}
|
||||
fi)
|
||||
'') "" config.clan.core.secrets}
|
||||
'';
|
||||
sops.secrets =
|
||||
let
|
||||
encryptedForThisMachine = name: type:
|
||||
let
|
||||
symlink = config.clan.core.clanDir + "/sops/secrets/${name}/machines/${config.clan.core.machineName}";
|
||||
in
|
||||
# WTF, nix bug, my symlink is in the nixos module detected as a directory also it works in the repl
|
||||
type == "directory" && (builtins.readFileType symlink == "directory" || builtins.readFileType symlink == "symlink");
|
||||
secrets = lib.filterAttrs encryptedForThisMachine (builtins.readDir (config.clan.core.clanDir + "/sops/secrets"));
|
||||
in
|
||||
builtins.mapAttrs
|
||||
(name: _: {
|
||||
sopsFile = config.clan.core.clanDir + "/sops/secrets/${name}/secret";
|
||||
format = "binary";
|
||||
})
|
||||
secrets;
|
||||
};
|
||||
}
|
||||
100
nixosModules/core/zerotier.nix
Normal file
100
nixosModules/core/zerotier.nix
Normal file
@@ -0,0 +1,100 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
let
|
||||
cfg = config.clan.networking.zerotier;
|
||||
in
|
||||
{
|
||||
options.clan.networking.zerotier = {
|
||||
networkId = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = ''
|
||||
zerotier networking id
|
||||
'';
|
||||
};
|
||||
controller = {
|
||||
enable = lib.mkEnableOption "turn this machine into the networkcontroller";
|
||||
public = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = false;
|
||||
description = ''
|
||||
everyone can join a public network without having the administrator to accept
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
config = {
|
||||
systemd.network.networks.zerotier = {
|
||||
matchConfig.Name = "zt*";
|
||||
networkConfig = {
|
||||
LLMNR = true;
|
||||
LLDP = true;
|
||||
MulticastDNS = true;
|
||||
KeepConfiguration = "static";
|
||||
};
|
||||
};
|
||||
networking.firewall.allowedUDPPorts = [ 9993 ];
|
||||
networking.firewall.interfaces."zt+".allowedTCPPorts = [ 5353 ];
|
||||
networking.firewall.interfaces."zt+".allowedUDPPorts = [ 5353 ];
|
||||
services.zerotierone = {
|
||||
enable = true;
|
||||
joinNetworks = [ cfg.networkId ];
|
||||
};
|
||||
} // lib.mkIf cfg.controller.enable {
|
||||
# only the controller needs to have the key in the repo, the other clients can be dynamic
|
||||
# we generate the zerotier code manually for the controller, since it's part of the bootstrap command
|
||||
clan.core.secrets.zerotier = {
|
||||
facts."network.id" = { };
|
||||
secrets."identity.secret" = { };
|
||||
generator = ''
|
||||
TMPDIR=$(mktemp -d)
|
||||
trap 'rm -rf "$TMPDIR"' EXIT
|
||||
${config.clan.core.clanPkgs.clan-cli}/bin/clan zerotier --outpath "$TMPDIR"
|
||||
cp "$TMPDIR"/network.id "$facts"/network.id
|
||||
cp "$TMPDIR"/identity.secret "$secrets"/identity.secret
|
||||
'';
|
||||
};
|
||||
|
||||
systemd.tmpfiles.rules = [
|
||||
"L+ /var/lib/zerotierone/controller.d/network/${cfg.networkId}.json - - - - ${pkgs.writeText "net.json" (builtins.toJSON {
|
||||
authTokens = [
|
||||
null
|
||||
];
|
||||
authorizationEndpoint = "";
|
||||
capabilities = [];
|
||||
clientId = "";
|
||||
dns = [];
|
||||
enableBroadcast = true;
|
||||
id = cfg.networkId;
|
||||
ipAssignmentPools = [];
|
||||
mtu = 2800;
|
||||
multicastLimit = 32;
|
||||
name = "";
|
||||
uwid = cfg.networkId;
|
||||
objtype = "network";
|
||||
private = true;
|
||||
remoteTraceLevel = 0;
|
||||
remoteTraceTarget = null;
|
||||
revision = 1;
|
||||
routes = [];
|
||||
rules = [
|
||||
{
|
||||
not = false;
|
||||
or = false;
|
||||
type = "ACTION_ACCEPT";
|
||||
}
|
||||
];
|
||||
rulesSource = "";
|
||||
ssoEnabled = false;
|
||||
tags = [];
|
||||
v4AssignMode = {
|
||||
zt = false;
|
||||
};
|
||||
v6AssignMode = {
|
||||
"6plane" = false;
|
||||
rfc4193 = false;
|
||||
zt = false;
|
||||
};
|
||||
})}"
|
||||
];
|
||||
};
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user