Tinc: Difference between revisions
imported>V3vAP No edit summary |
imported>Aforemny m Add missing quotes around `address`'s value |
||
| (5 intermediate revisions by 4 users not shown) | |||
| Line 24: | Line 24: | ||
Tinc clients need to verify themselves to each other, which is done by keys. There are multiple ways to generate your keys. Here is one. | Tinc clients need to verify themselves to each other, which is done by keys. There are multiple ways to generate your keys. Here is one. | ||
<pre>nix-shell -p tinc_pre --run | <pre>nix-shell -p tinc_pre --run "tinc generate-keys 4096"</pre> | ||
The command ask you where to put the keys. If you hit enter a few times it will generate 4 files. (instead of hitting enter you can give it different file path) | The command ask you where to put the keys. If you hit enter a few times it will generate 4 files. (instead of hitting enter you can give it different file path) | ||
| Line 67: | Line 67: | ||
The simplest way is to use the networking module. But it has some minor flaws on package updates. | The simplest way is to use the networking module. But it has some minor flaws on package updates. | ||
< | <syntaxHighlight lang=nix># for heinz | ||
networking.interfaces. | networking.interfaces."tinc.${networkName}".ipv4.addresses = [ { address = "10.1.1.25"; prefixLength = 24; } ]; | ||
</ | </syntaxHighlight> | ||
Another author has experienced problems with the network failing to restart when using the above to configure interfaces. | Another author has experienced problems with the network failing to restart when using the above to configure interfaces. | ||
The following snippet '''seems''' to fix that (until perhaps a more proper fix is upstreamed?): | The following snippet '''seems''' to fix that (until perhaps a more proper fix is upstreamed?): | ||
< | <syntaxHighlight lang=nix> | ||
systemd.services."network-addresses-tinc.${networkName}". | # Start the unit for adding addresses if Tinc is started | ||
systemd.services."network- | systemd.services."tinc.${networkName}".wants = [ "network-addresses-tinc.${networkName}.service" ]; | ||
</ | # Stop the unit for adding addresses if Tinc is stopped or restarted | ||
systemd.services."network-addresses-tinc.${networkName}".partOf = [ "tinc.${networkName}.service" ]; | |||
# Start the unit for adding addresses after the Tinc device is added | |||
systemd.services."network-addresses-tinc.${networkName}".after = [ "sys-subsystem-net-devices-tinc.${networkName}.device" ]; | |||
</syntaxHighlight> | |||
=== tinc-up/tinc-down === | === tinc-up/tinc-down === | ||
| Line 83: | Line 88: | ||
First we have to create the scripts: | First we have to create the scripts: | ||
< | <syntaxHighlight lang=nix># for heinz | ||
environment.etc | environment.etc = { | ||
"tinc/private/tinc-up".source = pkgs.writeScript "tinc-up-private" '' | |||
#!${pkgs.stdenv.shell} | |||
''; | ${pkgs.nettools}/bin/ifconfig $INTERFACE 10.1.1.25 netmask 255.255.255.0 | ||
''; | |||
"tinc/private/tinc-down".source = pkgs.writeScript "tinc-down-private" '' | |||
#!${pkgs.stdenv.shell} | |||
'';</ | /run/wrappers/bin/sudo ${pkgs.nettools}/bin/ifconfig $INTERFACE down | ||
''; | |||
};</syntaxHighlight> | |||
For the <code>tinc-down</code> we need to use sudo, because the user <code>tinc.private</code> who starts the service is not able to tear down the interface. | For the <code>tinc-down</code> we need to use sudo, because the user <code>tinc.private</code> who starts the service is not able to tear down the interface. | ||
So we have to make sure this user can call sudo without entering a password. | So we have to make sure this user can call sudo without entering a password. | ||
< | <syntaxHighlight lang=nix> security.sudo.extraRules = [ | ||
{ | { | ||
users = [ | users = [ "tinc.private" ]; | ||
commands = [ | commands = [ | ||
{ | { | ||
command = | command = "${pkgs.nettools}/bin/ifconfig"; | ||
options = [ | options = [ "NOPASSWD" ]; | ||
} | } | ||
]; | ]; | ||
} | } | ||
];</ | ];</syntaxHighlight> | ||
== Open the Firewall == | == Open the Firewall == | ||
The computer which you connect to needs to open some ports. | The computer which you connect to needs to open some ports. | ||
< | <syntaxHighlight lang=nix>networking.firewall.allowedUDPPorts = [ 655 ]; | ||
networking.firewall.allowedTCPPorts = [ 655 ];</ | networking.firewall.allowedTCPPorts = [ 655 ];</syntaxHighlight> | ||
== use service.tinc module == | == use service.tinc module == | ||
| Line 123: | Line 130: | ||
=== /etc/nixos/tinc.nix on heinz === | === /etc/nixos/tinc.nix on heinz === | ||
< | <syntaxHighlight lang=nix>{ config, pkgs, ... }: | ||
let | let | ||
myMeshIp = | myMeshIp = "10.1.1.25"; | ||
myMeshMask = | myMeshMask = "255.255.255.0"; | ||
myMeshName = | myMeshName = "private"; | ||
in { | in { | ||
| Line 135: | Line 142: | ||
# simple interface setup | # simple interface setup | ||
# ---------------------- | # ---------------------- | ||
networking.interfaces. | networking.interfaces."tinc.${myMeshName}" = [ { address = myMeshIp; } ]; | ||
# configure tinc service | # configure tinc service | ||
# ---------------------- | # ---------------------- | ||
services.tinc.networks. | services.tinc.networks."${myMeshName}"= { | ||
name = | name = "heinz"; # who are we in this network. | ||
debugLevel = 3; # the debug level for journal -u tinc.private | debugLevel = 3; # the debug level for journal -u tinc.private | ||
chroot = false; # otherwise addresses can't be a DNS | chroot = false; # otherwise addresses can't be a DNS | ||
interfaceType = | interfaceType = "tap"; # tun might also work. | ||
extraConfig = '' | extraConfig = '' | ||
| Line 158: | Line 165: | ||
# if you don't set the path as string, it will import the file in | # if you don't set the path as string, it will import the file in | ||
# in the nix/store where everybody can read it. | # in the nix/store where everybody can read it. | ||
Ed25519PrivateKeyFile = | Ed25519PrivateKeyFile = "/root/secrets/heinz/ed25519_key.priv" | ||
PrivateKeyFile = | PrivateKeyFile = "/root/secrets/heinz/rsa_key.priv" | ||
''; | ''; | ||
hosts = { | hosts = { | ||
| Line 185: | Line 192: | ||
}; | }; | ||
} | } | ||
</ | </syntaxHighlight> | ||
=== /etc/nixos/tinc.nix on peter === | === /etc/nixos/tinc.nix on peter === | ||
< | <syntaxHighlight lang=nix>{ config, pkgs, ... }: | ||
let | let | ||
myMeshIp = | myMeshIp = "10.1.1.21"; | ||
myMeshMask = | myMeshMask = "255.255.255.0"; | ||
myMeshName = | myMeshName = "private"; | ||
in { | in { | ||
| Line 205: | Line 212: | ||
# simple interface setup | # simple interface setup | ||
# ---------------------- | # ---------------------- | ||
networking.interfaces. | networking.interfaces."tinc.${myMeshName}" = [ { address = myMeshIp; } ]; | ||
# configure tinc service | # configure tinc service | ||
# ---------------------- | # ---------------------- | ||
services.tinc.networks. | services.tinc.networks."${myMeshName}"= { | ||
name = | name = "peter"; # who are we in this network. | ||
debugLevel = 3; # the debug level for journal -u tinc.private | debugLevel = 3; # the debug level for journal -u tinc.private | ||
chroot = false; # otherwise addresses can't be a DNS | chroot = false; # otherwise addresses can't be a DNS | ||
interfaceType = | interfaceType = "tap"; # tun might also work. | ||
extraConfig = '' | extraConfig = '' | ||
| Line 223: | Line 230: | ||
# if you don't set the path as string, it will import the file in | # if you don't set the path as string, it will import the file in | ||
# in the nix/store where everybody can read it. | # in the nix/store where everybody can read it. | ||
Ed25519PrivateKeyFile = | Ed25519PrivateKeyFile = "/root/secrets/peter/ed25519_key.priv" | ||
PrivateKeyFile = | PrivateKeyFile = "/root/secrets/peter/rsa_key.priv" | ||
''; | ''; | ||
hosts = { | hosts = { | ||
| Line 249: | Line 256: | ||
}; | }; | ||
}; | }; | ||
}</ | }</syntaxHighlight> | ||