nebula

modules/nixos/services/nebula-lighthouse/default.nix

@@ -0,0 +1,53 @@
+{
+  config,
+  lib,
+  namespace,
+  ...
+}:
+with lib;
+let
+  name = "nebula-lighthouse";
+  cfg = config.${namespace}.services.${name};
+  rootUrl = "https://lighthouse.${namespace}.dev/";
+  ca = config.sops.secrets."pi4/nebula/ca-cert".path;
+  cert = config.sops.secrets."pi4/nebula/lighthouse-cert".path;
+  key = config.sops.secrets."pi4/nebula/lighthouse-key".path;
+
+  nebulaConfig = lib.${namespace}.mkModule {
+    inherit config name;
+    description = "nebula";
+    options = { };
+    moduleConfig = {
+      services.nebula.networks = {
+        jallen-nebula = {
+          enable = true;
+          enableReload = true;
+          isLighthouse = true;
+          ca = ca;
+          cert = cert;
+          key = key;
+          lighthouse = {
+            dns = {
+              enable = true;
+              host = "localhost";
+              port = 53;
+            };
+          };
+          listen = {
+            host = cfg.listenAddress;
+            port = cfg.port;
+          };
+          # lighthouses = [
+          #   "10.1.1.1"
+          # ];
+        };
+      };
+    };
+  };
+in
+{
+  imports = [
+    nebulaConfig
+    ./sops.nix
+  ];
+}

modules/nixos/services/nebula-lighthouse/sops.nix

@@ -0,0 +1,45 @@
+{
+  config,
+  lib,
+  namespace,
+  ...
+}:
+with lib;
+let
+  cfg = config.${namespace}.services.nebula-lighthouse;
+in
+{
+
+  config = mkIf cfg.enable {
+    sops = {
+      secrets = {
+        "pi4/nebula/ca-cert" = {
+          sopsFile = (lib.snowfall.fs.get-file "secrets/nas-secrets.yaml");
+          owner = "nebula-nas-nebula";
+          group = "nebula-nas-nebula";
+          restartUnits = [ "nebula@nas-nebula.service" ];
+        };
+
+        "pi4/nebula/ca-key" = {
+          sopsFile = (lib.snowfall.fs.get-file "secrets/nas-secrets.yaml");
+          owner = "nebula-nas-nebula";
+          group = "nebula-nas-nebula";
+          restartUnits = [ "nebula@nas-nebula.service" ];
+        };
+
+        "pi4/nebula/lighthouse-cert" = {
+          sopsFile = (lib.snowfall.fs.get-file "secrets/nas-secrets.yaml");
+          owner = "nebula-nas-nebula";
+          group = "nebula-nas-nebula";
+          restartUnits = [ "nebula@nas-nebula.service" ];
+        };
+        "pi4/nebula/lighthouse-key" = {
+          sopsFile = (lib.snowfall.fs.get-file "secrets/nas-secrets.yaml");
+          owner = "nebula-nas-nebula";
+          group = "nebula-nas-nebula";
+          restartUnits = [ "nebula@nas-nebula.service" ];
+        };
+      };
+    };
+  };
+}