diff --git a/nixos/modules/services/networking/yggdrasil.xml b/nixos/modules/services/networking/yggdrasil.xml
index 5d7de4c58ceed..c012cd4a92949 100644
--- a/nixos/modules/services/networking/yggdrasil.xml
+++ b/nixos/modules/services/networking/yggdrasil.xml
@@ -10,25 +10,8 @@
-Yggdrasil is an early-stage implementation of a fully end-to-end encrypted
-IPv6 network. It is lightweight, self-arranging, supported on multiple
-platforms and allows pretty much any IPv6-capable application to communicate
-securely with other Yggdrasil nodes.
-
-
-When enabled the Yggdrasil service creates a tun device with a unique IPv6 in
-the 200::/8 address space. This device and address can be
-used to communicate with all other connected nodes in the
-200::/7 Yggdrasil network. Each Yggdrasil node can also
-route a subnet using the first half of its address with the eighth bit masked
-as a prefix, that is to say, within the 300::/8 space. This
-prefix may be announced to locally attached networks.
-
-
-Despite the normal distribution of nodes within the 200::/8
-space, the addresses of connected nodes can be readily enumerated, unlike the
-the traditional global IPv6 network. For this reason, all open services on a
-node should be considered public, or the system firewall should be enabled.
+Yggdrasil is an early-stage implementation of a fully end-to-end encrypted,
+self-arranging IPv6 network.
Configuration
@@ -40,6 +23,10 @@ An annotated example of a simple configuration:
{
services.yggdrasil = {
enable = true;
+ persistentKeys = false;
+ # The NixOS module will generate new keys and a new IPv6 address each time
+ # it is started if persistentKeys is not enabled.
+
config = {
Peers = [
# Yggdrasil will automatically connect and "peer" with other nodes it
@@ -48,6 +35,8 @@ An annotated example of a simple configuration:
# network that it can tunnel to.
"tcp://1.2.3.4:1024"
"tcp://1.2.3.5:1024"
+ # Public peers can be found at
+ # https://github.com/yggdrasil-network/public-peers
];
};
};
@@ -115,7 +104,8 @@ A NixOS container attached to the Yggdrasil network via a node running on the
host:
let
- yggPrefix64 = "…";
+ yggPrefix64 = "310:5217:69c0:9afc";
+ # Again, taken from the output of "yggdrasilctl getself".
in
{
boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = 1;