Merge pull request 'drop meshnamed from repository' (#909) from Mic92-main into main
This commit is contained in:
commit
ff8d08e4e4
@ -18,7 +18,6 @@
|
|||||||
secrets = import ./secrets nixosTestArgs;
|
secrets = import ./secrets nixosTestArgs;
|
||||||
container = import ./container nixosTestArgs;
|
container = import ./container nixosTestArgs;
|
||||||
deltachat = import ./deltachat nixosTestArgs;
|
deltachat = import ./deltachat nixosTestArgs;
|
||||||
meshnamed = import ./meshnamed nixosTestArgs;
|
|
||||||
zt-tcp-relay = import ./zt-tcp-relay nixosTestArgs;
|
zt-tcp-relay = import ./zt-tcp-relay nixosTestArgs;
|
||||||
borgbackup = import ./borgbackup nixosTestArgs;
|
borgbackup = import ./borgbackup nixosTestArgs;
|
||||||
syncthing = import ./syncthing nixosTestArgs;
|
syncthing = import ./syncthing nixosTestArgs;
|
||||||
|
@ -1,21 +0,0 @@
|
|||||||
(import ../lib/container-test.nix) ({ pkgs, ... }: {
|
|
||||||
name = "meshnamed";
|
|
||||||
|
|
||||||
nodes.machine = { self, ... }: {
|
|
||||||
imports = [
|
|
||||||
self.nixosModules.clanCore
|
|
||||||
{
|
|
||||||
clanCore.machineName = "machine";
|
|
||||||
clan.networking.meshnamed.networks.vpn.subnet = "fd43:7def:4b50:28d0:4e99:9347:3035:17ef/88";
|
|
||||||
clanCore.clanDir = ./.;
|
|
||||||
}
|
|
||||||
];
|
|
||||||
};
|
|
||||||
testScript = ''
|
|
||||||
start_all()
|
|
||||||
machine.wait_for_unit("meshnamed")
|
|
||||||
out = machine.succeed("${pkgs.dnsutils}/bin/dig AAAA foo.7vbx332lkaunatuzsndtanix54.vpn @meshnamed +short")
|
|
||||||
print(out)
|
|
||||||
assert out.strip() == "fd43:7def:4b50:28d0:4e99:9347:3035:17ef"
|
|
||||||
'';
|
|
||||||
})
|
|
@ -4,9 +4,7 @@
|
|||||||
|
|
||||||
services.maddy =
|
services.maddy =
|
||||||
let
|
let
|
||||||
# FIXME move this to public setting
|
domain = "${config.clanCore.machineName}.local";
|
||||||
meshname = config.clanCore.secrets.zerotier.facts.zerotier-meshname.value or null;
|
|
||||||
domain = if meshname == null then "${config.clanCore.machineName}.local" else "${meshname}.vpn";
|
|
||||||
in
|
in
|
||||||
{
|
{
|
||||||
enable = true;
|
enable = true;
|
||||||
|
@ -7,11 +7,11 @@
|
|||||||
]
|
]
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1708564520,
|
"lastModified": 1709632354,
|
||||||
"narHash": "sha256-juduDTYBhGN6jNfQ5RMDpbQF+MkO0pj3k7XGDSTjAbs=",
|
"narHash": "sha256-jxRHwqrtNze51WKFKvxlQ8Inf62UNRl5cFqEQ2V96vE=",
|
||||||
"owner": "nix-community",
|
"owner": "nix-community",
|
||||||
"repo": "disko",
|
"repo": "disko",
|
||||||
"rev": "23d308f0059955e3719efc81a34d1fc0369fbb74",
|
"rev": "0d11aa8d6431326e10b8656420f91085c3bd0b12",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
|
@ -3,7 +3,6 @@
|
|||||||
./backups.nix
|
./backups.nix
|
||||||
./manual.nix
|
./manual.nix
|
||||||
./imports.nix
|
./imports.nix
|
||||||
./meshnamed
|
|
||||||
./metadata.nix
|
./metadata.nix
|
||||||
./networking.nix
|
./networking.nix
|
||||||
./nix-settings.nix
|
./nix-settings.nix
|
||||||
|
@ -1,84 +0,0 @@
|
|||||||
{ config, lib, pkgs, ... }:
|
|
||||||
let
|
|
||||||
cfg = config.clan.networking.meshnamed;
|
|
||||||
in
|
|
||||||
{
|
|
||||||
options.clan.networking.meshnamed = {
|
|
||||||
enable = (lib.mkEnableOption "meshnamed") // {
|
|
||||||
default = config.clan.networking.meshnamed.networks != { };
|
|
||||||
};
|
|
||||||
listenAddress = lib.mkOption {
|
|
||||||
type = lib.types.str;
|
|
||||||
default = "fd66:29e9:f422:8dfe:beba:68ec:bd09:7876";
|
|
||||||
description = lib.mdDoc ''
|
|
||||||
The address to listen on.
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
networks = lib.mkOption {
|
|
||||||
default = { };
|
|
||||||
type = lib.types.attrsOf (lib.types.submodule ({ name, ... }: {
|
|
||||||
options = {
|
|
||||||
name = lib.mkOption {
|
|
||||||
default = name;
|
|
||||||
type = lib.types.str;
|
|
||||||
example = "my-network";
|
|
||||||
description = lib.mdDoc ''
|
|
||||||
The name of the network.
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
subnet = lib.mkOption {
|
|
||||||
type = lib.types.str;
|
|
||||||
example = "fd43:7def:4b50:28d0:4e99:9347:3035:17ef/88";
|
|
||||||
description = lib.mdDoc ''
|
|
||||||
The subnet to use for the mesh network.
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
};
|
|
||||||
}));
|
|
||||||
};
|
|
||||||
};
|
|
||||||
config = lib.mkIf config.clan.networking.meshnamed.enable {
|
|
||||||
# we assign this random source address to bind meshnamed to.
|
|
||||||
systemd.network.netdevs."08-meshnamed" = {
|
|
||||||
netdevConfig = {
|
|
||||||
Name = "meshnamed";
|
|
||||||
Kind = "dummy";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
systemd.network.networks."08-meshnamed" = {
|
|
||||||
matchConfig.Name = "meshnamed";
|
|
||||||
networkConfig = {
|
|
||||||
Address = [ "${cfg.listenAddress}/128" ];
|
|
||||||
DNS = [ config.clan.networking.meshnamed.listenAddress ];
|
|
||||||
Domains = [ "~${lib.concatMapStringsSep "," (network: network.name) (builtins.attrValues config.clan.networking.meshnamed.networks)}" ];
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
# for convenience, so we can debug with dig
|
|
||||||
networking.extraHosts = ''
|
|
||||||
${cfg.listenAddress} meshnamed
|
|
||||||
'';
|
|
||||||
|
|
||||||
networking.networkmanager.unmanaged = [ "interface-name:meshnamed" ];
|
|
||||||
|
|
||||||
systemd.services.meshnamed =
|
|
||||||
let
|
|
||||||
networks = lib.concatMapStringsSep "," (network: "${network.name}=${network.subnet}")
|
|
||||||
(builtins.attrValues config.clan.networking.meshnamed.networks);
|
|
||||||
in
|
|
||||||
{
|
|
||||||
# fix container test
|
|
||||||
after = [ "network.target" ] ++ lib.optional config.boot.isContainer "sys-devices-virtual-net-meshnamed.device";
|
|
||||||
bindsTo = lib.optional (!config.boot.isContainer) "sys-devices-virtual-net-meshnamed.device";
|
|
||||||
wantedBy = [ "multi-user.target" ];
|
|
||||||
serviceConfig = {
|
|
||||||
Type = "simple";
|
|
||||||
ExecStart = "${pkgs.callPackage ../../../pkgs/meshname/default.nix { }}/bin/meshnamed -networks ${networks} -listenaddr [${cfg.listenAddress}]:53";
|
|
||||||
|
|
||||||
# to bind port 53
|
|
||||||
AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
|
|
||||||
DynamicUser = true;
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
}
|
|
@ -87,14 +87,10 @@ in
|
|||||||
# having to re-import nixpkgs.
|
# having to re-import nixpkgs.
|
||||||
services.zerotierone.package = lib.mkDefault (pkgs.zerotierone.overrideAttrs (_old: { meta = { }; }));
|
services.zerotierone.package = lib.mkDefault (pkgs.zerotierone.overrideAttrs (_old: { meta = { }; }));
|
||||||
})
|
})
|
||||||
(lib.mkIf ((facts.zerotier-meshname.value or null) != null) {
|
|
||||||
environment.etc."zerotier/hostname".text = "${facts.zerotier-meshname.value}.vpn";
|
|
||||||
})
|
|
||||||
(lib.mkIf ((facts.zerotier-ip.value or null) != null) {
|
(lib.mkIf ((facts.zerotier-ip.value or null) != null) {
|
||||||
environment.etc."zerotier/ip".text = facts.zerotier-ip.value;
|
environment.etc."zerotier/ip".text = facts.zerotier-ip.value;
|
||||||
})
|
})
|
||||||
(lib.mkIf (cfg.networkId != null) {
|
(lib.mkIf (cfg.networkId != null) {
|
||||||
clan.networking.meshnamed.networks.vpn.subnet = cfg.subnet;
|
|
||||||
|
|
||||||
systemd.network.networks."09-zerotier" = {
|
systemd.network.networks."09-zerotier" = {
|
||||||
matchConfig.Name = "zt*";
|
matchConfig.Name = "zt*";
|
||||||
@ -174,14 +170,12 @@ in
|
|||||||
# we generate the zerotier code manually for the controller, since it's part of the bootstrap command
|
# we generate the zerotier code manually for the controller, since it's part of the bootstrap command
|
||||||
clanCore.secrets.zerotier = {
|
clanCore.secrets.zerotier = {
|
||||||
facts.zerotier-ip = { };
|
facts.zerotier-ip = { };
|
||||||
facts.zerotier-meshname = { };
|
|
||||||
facts.zerotier-network-id = { };
|
facts.zerotier-network-id = { };
|
||||||
secrets.zerotier-identity-secret = { };
|
secrets.zerotier-identity-secret = { };
|
||||||
generator.path = [ config.services.zerotierone.package pkgs.fakeroot pkgs.python3 ];
|
generator.path = [ config.services.zerotierone.package pkgs.fakeroot pkgs.python3 ];
|
||||||
generator.script = ''
|
generator.script = ''
|
||||||
python3 ${./generate.py} --mode network \
|
python3 ${./generate.py} --mode network \
|
||||||
--ip "$facts/zerotier-ip" \
|
--ip "$facts/zerotier-ip" \
|
||||||
--meshname "$facts/zerotier-meshname" \
|
|
||||||
--identity-secret "$secrets/zerotier-identity-secret" \
|
--identity-secret "$secrets/zerotier-identity-secret" \
|
||||||
--network-id "$facts/zerotier-network-id"
|
--network-id "$facts/zerotier-network-id"
|
||||||
'';
|
'';
|
||||||
@ -193,13 +187,11 @@ in
|
|||||||
(lib.mkIf (!cfg.controller.enable && cfg.networkId != null) {
|
(lib.mkIf (!cfg.controller.enable && cfg.networkId != null) {
|
||||||
clanCore.secrets.zerotier = {
|
clanCore.secrets.zerotier = {
|
||||||
facts.zerotier-ip = { };
|
facts.zerotier-ip = { };
|
||||||
facts.zerotier-meshname = { };
|
|
||||||
secrets.zerotier-identity-secret = { };
|
secrets.zerotier-identity-secret = { };
|
||||||
generator.path = [ config.services.zerotierone.package pkgs.python3 ];
|
generator.path = [ config.services.zerotierone.package pkgs.python3 ];
|
||||||
generator.script = ''
|
generator.script = ''
|
||||||
python3 ${./generate.py} --mode identity \
|
python3 ${./generate.py} --mode identity \
|
||||||
--ip "$facts/zerotier-ip" \
|
--ip "$facts/zerotier-ip" \
|
||||||
--meshname "$facts/zerotier-meshname" \
|
|
||||||
--identity-secret "$secrets/zerotier-identity-secret" \
|
--identity-secret "$secrets/zerotier-identity-secret" \
|
||||||
--network-id ${cfg.networkId}
|
--network-id ${cfg.networkId}
|
||||||
'';
|
'';
|
||||||
|
@ -1,5 +1,4 @@
|
|||||||
import argparse
|
import argparse
|
||||||
import base64
|
|
||||||
import contextlib
|
import contextlib
|
||||||
import ipaddress
|
import ipaddress
|
||||||
import json
|
import json
|
||||||
@ -198,17 +197,12 @@ def compute_zerotier_ip(network_id: str, identity: Identity) -> ipaddress.IPv6Ad
|
|||||||
return ipaddress.IPv6Address(bytes(addr_parts))
|
return ipaddress.IPv6Address(bytes(addr_parts))
|
||||||
|
|
||||||
|
|
||||||
def compute_zerotier_meshname(ip: ipaddress.IPv6Address) -> str:
|
|
||||||
return base64.b32encode(ip.packed)[0:26].decode("ascii").lower()
|
|
||||||
|
|
||||||
|
|
||||||
def main() -> None:
|
def main() -> None:
|
||||||
parser = argparse.ArgumentParser()
|
parser = argparse.ArgumentParser()
|
||||||
parser.add_argument(
|
parser.add_argument(
|
||||||
"--mode", choices=["network", "identity"], required=True, type=str
|
"--mode", choices=["network", "identity"], required=True, type=str
|
||||||
)
|
)
|
||||||
parser.add_argument("--ip", type=Path, required=True)
|
parser.add_argument("--ip", type=Path, required=True)
|
||||||
parser.add_argument("--meshname", type=Path, required=True)
|
|
||||||
parser.add_argument("--identity-secret", type=Path, required=True)
|
parser.add_argument("--identity-secret", type=Path, required=True)
|
||||||
parser.add_argument("--network-id", type=str, required=False)
|
parser.add_argument("--network-id", type=str, required=False)
|
||||||
args = parser.parse_args()
|
args = parser.parse_args()
|
||||||
@ -227,11 +221,9 @@ def main() -> None:
|
|||||||
case _:
|
case _:
|
||||||
raise ValueError(f"unknown mode {args.mode}")
|
raise ValueError(f"unknown mode {args.mode}")
|
||||||
ip = compute_zerotier_ip(network_id, identity)
|
ip = compute_zerotier_ip(network_id, identity)
|
||||||
meshname = compute_zerotier_meshname(ip)
|
|
||||||
|
|
||||||
args.identity_secret.write_text(identity.private)
|
args.identity_secret.write_text(identity.private)
|
||||||
args.ip.write_text(ip.compressed)
|
args.ip.write_text(ip.compressed)
|
||||||
args.meshname.write_text(meshname)
|
|
||||||
|
|
||||||
|
|
||||||
if __name__ == "__main__":
|
if __name__ == "__main__":
|
||||||
|
@ -73,5 +73,3 @@ def test_generate_secret(
|
|||||||
assert has_secret(test_flake_with_core.path, "vm2-zerotier-identity-secret")
|
assert has_secret(test_flake_with_core.path, "vm2-zerotier-identity-secret")
|
||||||
ip = machine_get_fact(test_flake_with_core.path, "vm1", "zerotier-ip")
|
ip = machine_get_fact(test_flake_with_core.path, "vm1", "zerotier-ip")
|
||||||
assert ipaddress.IPv6Address(ip).is_private
|
assert ipaddress.IPv6Address(ip).is_private
|
||||||
meshname = machine_get_fact(test_flake_with_core.path, "vm1", "zerotier-meshname")
|
|
||||||
assert len(meshname) == 26
|
|
||||||
|
@ -14,7 +14,6 @@
|
|||||||
inherit (config.packages) tea-create-pr;
|
inherit (config.packages) tea-create-pr;
|
||||||
};
|
};
|
||||||
pending-reviews = pkgs.callPackage ./pending-reviews { };
|
pending-reviews = pkgs.callPackage ./pending-reviews { };
|
||||||
meshname = pkgs.callPackage ./meshname { };
|
|
||||||
} // lib.optionalAttrs pkgs.stdenv.isLinux {
|
} // lib.optionalAttrs pkgs.stdenv.isLinux {
|
||||||
wayland-proxy-virtwl = pkgs.callPackage ./wayland-proxy-virtwl { };
|
wayland-proxy-virtwl = pkgs.callPackage ./wayland-proxy-virtwl { };
|
||||||
waypipe = pkgs.waypipe.overrideAttrs
|
waypipe = pkgs.waypipe.overrideAttrs
|
||||||
|
@ -1,19 +1,31 @@
|
|||||||
{ self, lib, ... }:
|
{ self, lib, ... }:
|
||||||
let
|
let
|
||||||
installer = lib.nixosSystem {
|
installerModule = { config, pkgs, ... }: {
|
||||||
pkgs = self.inputs.nixpkgs.legacyPackages.x86_64-linux;
|
imports = [
|
||||||
system = "x86_64-linux";
|
|
||||||
modules = [
|
|
||||||
self.nixosModules.installer
|
self.nixosModules.installer
|
||||||
self.nixosModules.hidden-ssh-announce
|
self.nixosModules.hidden-ssh-announce
|
||||||
self.inputs.nixos-generators.nixosModules.all-formats
|
self.inputs.nixos-generators.nixosModules.all-formats
|
||||||
self.inputs.disko.nixosModules.disko
|
self.inputs.disko.nixosModules.disko
|
||||||
({ config, ... }: { system.stateVersion = config.system.nixos.version; })
|
|
||||||
];
|
];
|
||||||
|
|
||||||
|
system.stateVersion = config.system.nixos.version;
|
||||||
|
nixpkgs.pkgs = self.inputs.nixpkgs.legacyPackages.x86_64-linux;
|
||||||
|
};
|
||||||
|
|
||||||
|
installer = lib.nixosSystem { modules = [ installerModule ]; };
|
||||||
|
|
||||||
|
clan = self.lib.buildClan {
|
||||||
|
clanName = "clan-core";
|
||||||
|
directory = self;
|
||||||
|
machines.installer = installerModule;
|
||||||
};
|
};
|
||||||
in
|
in
|
||||||
{
|
{
|
||||||
flake.packages.x86_64-linux.install-iso = self.inputs.disko.lib.makeDiskImages { nixosConfig = installer; };
|
flake.packages.x86_64-linux.install-iso = self.inputs.disko.lib.makeDiskImages {
|
||||||
|
nixosConfig = installer;
|
||||||
|
};
|
||||||
|
flake.nixosConfigurations = clan.nixosConfigurations;
|
||||||
|
flake.clanInternals = clan.clanInternals;
|
||||||
flake.apps.x86_64-linux.install-vm.program = installer.config.formats.vm.outPath;
|
flake.apps.x86_64-linux.install-vm.program = installer.config.formats.vm.outPath;
|
||||||
flake.apps.x86_64-linux.install-vm-nogui.program = installer.config.formats.vm-nogui.outPath;
|
flake.apps.x86_64-linux.install-vm-nogui.program = installer.config.formats.vm-nogui.outPath;
|
||||||
}
|
}
|
||||||
|
@ -1,30 +0,0 @@
|
|||||||
{ lib
|
|
||||||
, buildGoModule
|
|
||||||
, fetchFromGitHub
|
|
||||||
}:
|
|
||||||
|
|
||||||
buildGoModule {
|
|
||||||
pname = "meshname";
|
|
||||||
version = "unstable-2023-11-08";
|
|
||||||
|
|
||||||
src = fetchFromGitHub {
|
|
||||||
owner = "Mic92";
|
|
||||||
repo = "meshname";
|
|
||||||
rev = "9b11879d63ac02b0df59960f47063aefc1baf176";
|
|
||||||
hash = "sha256-oK2fKxCSonWs87s7BRdLO8GRm5MCfQNaJE7AoaH6K/c=";
|
|
||||||
};
|
|
||||||
|
|
||||||
subPackages = [ "cmd/meshnamed" ];
|
|
||||||
|
|
||||||
vendorHash = "sha256-kiNxB2R3Z6Z/Resr3r4jKCImVhyoOY55dEiV+JRUjDk=";
|
|
||||||
|
|
||||||
ldflags = [ "-s" "-w" ];
|
|
||||||
|
|
||||||
meta = with lib; {
|
|
||||||
description = "Meshname, a universal naming system for all IPv6-based mesh networks, including CJDNS and Yggdrasil";
|
|
||||||
homepage = "https://github.com/Mic92/meshname";
|
|
||||||
license = licenses.mit;
|
|
||||||
maintainers = with maintainers; [ mic92 ];
|
|
||||||
mainProgram = "meshnamed";
|
|
||||||
};
|
|
||||||
}
|
|
Loading…
Reference in New Issue
Block a user