clan/clan-core
11
2
Fork 13
Code Issues 91 Pull Requests 6 Actions Packages Projects 1 Releases Wiki Activity

clan.networking.zerotier: fix controller mode
All checks were successful
checks-impure / test (pull_request) Successful in 8s
Details
checks / test (pull_request) Successful in 24s
Details

Browse Source
This commit is contained in:
lassulus 2023-09-25 19:03:54 +02:00
parent 0b50e2d29c
commit 2cdc959a77
1 changed files with 82 additions and 74 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

156
nixosModules/clanCore/zerotier.nix
View File

@ -1,11 +1,52 @@
{ config, lib, pkgs, ... }:
let
cfg = config.clan.networking.zerotier;
networkConfig = {
authTokens = [
null
];
authorizationEndpoint = "";
capabilities = [ ];
clientId = "";
dns = [ ];
enableBroadcast = true;
id = cfg.networkId;
ipAssignmentPools = [ ];
mtu = 2800;
multicastLimit = 32;
name = "";
uwid = cfg.networkId;
objtype = "network";
private = !cfg.controller.public;
remoteTraceLevel = 0;
remoteTraceTarget = null;
revision = 1;
routes = [ ];
rules = [
{
not = false;
or = false;
type = "ACTION_ACCEPT";
}
];
rulesSource = "";
ssoEnabled = false;
tags = [ ];
v4AssignMode = {
zt = false;
};
v6AssignMode = {
"6plane" = false;
rfc4193 = true;
zt = false;
};
};
in
{
options.clan.networking.zerotier = {
networkId = lib.mkOption {
type = lib.types.str;
type = lib.types.nullOr lib.types.str;
default = null;
description = ''
zerotier networking id
'';
@ -21,80 +62,47 @@ in
};
};
};
config = {
systemd.network.networks.zerotier = {
matchConfig.Name = "zt*";
networkConfig = {
LLMNR = true;
LLDP = true;
MulticastDNS = true;
KeepConfiguration = "static";
config = lib.mkMerge [
(lib.mkIf (cfg.networkId != null) {
systemd.network.networks.zerotier = {
matchConfig.Name = "zt*";
networkConfig = {
LLMNR = true;
LLDP = true;
MulticastDNS = true;
KeepConfiguration = "static";
};
};
networking.firewall.allowedUDPPorts = [ 9993 ];
networking.firewall.interfaces."zt+".allowedTCPPorts = [ 5353 ];
networking.firewall.interfaces."zt+".allowedUDPPorts = [ 5353 ];
services.zerotierone = {
enable = true;
joinNetworks = [ cfg.networkId ];
};
})
(lib.mkIf cfg.controller.enable {
# only the controller needs to have the key in the repo, the other clients can be dynamic
# we generate the zerotier code manually for the controller, since it's part of the bootstrap command
clanCore.secrets.zerotier = {
facts."zerotier.network.id" = { };
secrets."zerotier.identity.secret" = { };
generator = ''
TMPDIR=$(mktemp -d)
trap 'rm -rf "$TMPDIR"' EXIT
${config.clanCore.clanPkgs.clan-cli}/bin/clan zerotier --outpath "$TMPDIR"
cp "$TMPDIR"/network.id "$facts"/zerotier.network.id
cp "$TMPDIR"/identity.secret "$secrets"/zerotier.identity.secret
'';
};
};
networking.firewall.allowedUDPPorts = [ 9993 ];
networking.firewall.interfaces."zt+".allowedTCPPorts = [ 5353 ];
networking.firewall.interfaces."zt+".allowedUDPPorts = [ 5353 ];
services.zerotierone = {
enable = true;
joinNetworks = [ cfg.networkId ];
};
} // lib.mkIf cfg.controller.enable {
# only the controller needs to have the key in the repo, the other clients can be dynamic
# we generate the zerotier code manually for the controller, since it's part of the bootstrap command
clanCore.secrets.zerotier = {
facts."network.id" = { };
secrets."identity.secret" = { };
generator = ''
TMPDIR=$(mktemp -d)
trap 'rm -rf "$TMPDIR"' EXIT
${config.clanCore.clanPkgs.clan-cli}/bin/clan zerotier --outpath "$TMPDIR"
cp "$TMPDIR"/network.id "$facts"/network.id
cp "$TMPDIR"/identity.secret "$secrets"/identity.secret
'';
};
systemd.tmpfiles.rules = [
"L+ /var/lib/zerotierone/controller.d/network/${cfg.networkId}.json - - - - ${pkgs.writeText "net.json" (builtins.toJSON {
authTokens = [
null
];
authorizationEndpoint = "";
capabilities = [];
clientId = "";
dns = [];
enableBroadcast = true;
id = cfg.networkId;
ipAssignmentPools = [];
mtu = 2800;
multicastLimit = 32;
name = "";
uwid = cfg.networkId;
objtype = "network";
private = true;
remoteTraceLevel = 0;
remoteTraceTarget = null;
revision = 1;
routes = [];
rules = [
{
not = false;
or = false;
type = "ACTION_ACCEPT";
}
];
rulesSource = "";
ssoEnabled = false;
tags = [];
v4AssignMode = {
zt = false;
};
v6AssignMode = {
"6plane" = false;
rfc4193 = false;
zt = false;
};
})}"
];
};
systemd.services.zerotierone.serviceConfig.ExecStartPre = [
"+${pkgs.writeShellScript "init_zerotier" ''
cp /etc/secrets/zerotier.identity.secret /var/lib/zerotier-one/identity.secret
ln -sfT ${pkgs.writeText "net.json" (builtins.toJSON networkConfig)} /var/lib/zerotier-one/controller.d/network/${cfg.networkId}.json
''}"
];
})
];
}