Merge pull request #45392 from dguibert/dg/wireguard
nixos/wireguard: setup interface with systemd-networkd
This commit is contained in:
commit
9f237fe444
|
@ -55,6 +55,27 @@ let
|
|||
(assertMacAddress "MACAddress")
|
||||
];
|
||||
|
||||
# NOTE The PrivateKey directive is missing on purpose here, please
|
||||
# do not add it to this list. The nix store is world-readable let's
|
||||
# refrain ourselves from providing a footgun.
|
||||
checkWireGuard = checkUnitConfig "WireGuard" [
|
||||
(assertOnlyFields [
|
||||
"PrivateKeyFile" "ListenPort" "FwMark"
|
||||
])
|
||||
(assertRange "FwMark" 1 4294967295)
|
||||
];
|
||||
|
||||
# NOTE The PresharedKey directive is missing on purpose here, please
|
||||
# do not add it to this list. The nix store is world-readable,let's
|
||||
# refrain ourselves from providing a footgun.
|
||||
checkWireGuardPeer = checkUnitConfig "WireGuardPeer" [
|
||||
(assertOnlyFields [
|
||||
"PublicKey" "PresharedKeyFile" "AllowedIPs"
|
||||
"Endpoint" "PersistentKeepalive"
|
||||
])
|
||||
(assertRange "PersistentKeepalive" 1 65535)
|
||||
];
|
||||
|
||||
checkVlan = checkUnitConfig "VLAN" [
|
||||
(assertOnlyFields ["Id" "GVRP" "MVRP" "LooseBinding" "ReorderHeader"])
|
||||
(assertRange "Id" 0 4094)
|
||||
|
@ -320,6 +341,46 @@ let
|
|||
'';
|
||||
};
|
||||
|
||||
wireguardConfig = mkOption {
|
||||
default = {};
|
||||
example = {
|
||||
PrivateKeyFile = "/etc/wireguard/secret.key";
|
||||
ListenPort = 51820;
|
||||
FwMark = 42;
|
||||
};
|
||||
type = types.addCheck (types.attrsOf unitOption) checkWireGuard;
|
||||
description = ''
|
||||
Each attribute in this set specifies an option in the
|
||||
<literal>[WireGuard]</literal> section of the unit. See
|
||||
<citerefentry><refentrytitle>systemd.netdev</refentrytitle>
|
||||
<manvolnum>5</manvolnum></citerefentry> for details.
|
||||
Use <literal>PrivateKeyFile</literal> instead of
|
||||
<literal>PrivateKey</literal>: the nix store is
|
||||
world-readable.
|
||||
'';
|
||||
};
|
||||
|
||||
wireguardPeers = mkOption {
|
||||
default = [];
|
||||
example = [ { wireguardPeerConfig={
|
||||
Endpoint = "192.168.1.1:51820";
|
||||
PublicKey = "27s0OvaBBdHoJYkH9osZpjpgSOVNw+RaKfboT/Sfq0g=";
|
||||
PresharedKeyFile = "/etc/wireguard/psk.key";
|
||||
AllowedIPs = [ "10.0.0.1/32" ];
|
||||
PersistentKeepalive = 15;
|
||||
};}];
|
||||
type = with types; listOf (submodule wireguardPeerOptions);
|
||||
description = ''
|
||||
Each item in this array specifies an option in the
|
||||
<literal>[WireGuardPeer]</literal> section of the unit. See
|
||||
<citerefentry><refentrytitle>systemd.netdev</refentrytitle>
|
||||
<manvolnum>5</manvolnum></citerefentry> for details.
|
||||
Use <literal>PresharedKeyFile</literal> instead of
|
||||
<literal>PresharedKey</literal>: the nix store is
|
||||
world-readable.
|
||||
'';
|
||||
};
|
||||
|
||||
vlanConfig = mkOption {
|
||||
default = {};
|
||||
example = { Id = "4"; };
|
||||
|
@ -450,6 +511,23 @@ let
|
|||
};
|
||||
};
|
||||
|
||||
wireguardPeerOptions = {
|
||||
options = {
|
||||
wireguardPeerConfig = mkOption {
|
||||
default = {};
|
||||
example = { };
|
||||
type = types.addCheck (types.attrsOf unitOption) checkWireGuardPeer;
|
||||
description = ''
|
||||
Each attribute in this set specifies an option in the
|
||||
<literal>[WireGuardPeer]</literal> section of the unit. See
|
||||
<citerefentry><refentrytitle>systemd.network</refentrytitle>
|
||||
<manvolnum>5</manvolnum></citerefentry> for details.
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
|
||||
networkOptions = commonNetworkOptions // {
|
||||
|
||||
networkConfig = mkOption {
|
||||
|
@ -732,6 +810,16 @@ let
|
|||
${attrsToSection def.bondConfig}
|
||||
|
||||
''}
|
||||
${optionalString (def.wireguardConfig != { }) ''
|
||||
[WireGuard]
|
||||
${attrsToSection def.wireguardConfig}
|
||||
|
||||
''}
|
||||
${flip concatMapStrings def.wireguardPeers (x: ''
|
||||
[WireGuardPeer]
|
||||
${attrsToSection x.wireguardPeerConfig}
|
||||
|
||||
'')}
|
||||
${def.extraConfig}
|
||||
'';
|
||||
};
|
||||
|
|
|
@ -254,6 +254,7 @@ in
|
|||
systemd = handleTest ./systemd.nix {};
|
||||
systemd-confinement = handleTest ./systemd-confinement.nix {};
|
||||
systemd-timesyncd = handleTest ./systemd-timesyncd.nix {};
|
||||
systemd-networkd-wireguard = handleTest ./systemd-networkd-wireguard.nix {};
|
||||
pdns-recursor = handleTest ./pdns-recursor.nix {};
|
||||
taskserver = handleTest ./taskserver.nix {};
|
||||
telegraf = handleTest ./telegraf.nix {};
|
||||
|
|
80
nixos/tests/systemd-networkd-wireguard.nix
Normal file
80
nixos/tests/systemd-networkd-wireguard.nix
Normal file
|
@ -0,0 +1,80 @@
|
|||
let generateNodeConf = { lib, pkgs, config, privkpath, pubk, peerId, nodeId, ...}: {
|
||||
imports = [ common/user-account.nix ];
|
||||
systemd.services.systemd-networkd.environment.SYSTEMD_LOG_LEVEL = "debug";
|
||||
networking.useNetworkd = true;
|
||||
networking.firewall.enable = false;
|
||||
virtualisation.vlans = [ 1 ];
|
||||
environment.systemPackages = with pkgs; [ wireguard-tools ];
|
||||
boot.extraModulePackages = [ config.boot.kernelPackages.wireguard ];
|
||||
systemd.network = {
|
||||
enable = true;
|
||||
netdevs = {
|
||||
"90-wg0" = {
|
||||
netdevConfig = { Kind = "wireguard"; Name = "wg0"; };
|
||||
wireguardConfig = {
|
||||
PrivateKeyFile = privkpath ;
|
||||
ListenPort = 51820;
|
||||
FwMark = 42;
|
||||
};
|
||||
wireguardPeers = [ {wireguardPeerConfig={
|
||||
Endpoint = "192.168.1.${peerId}:51820";
|
||||
PublicKey = pubk;
|
||||
PresharedKeyFile = pkgs.writeText "psk.key" "yTL3sCOL33Wzi6yCnf9uZQl/Z8laSE+zwpqOHC4HhFU=";
|
||||
AllowedIPs = [ "10.0.0.${peerId}/32" ];
|
||||
PersistentKeepalive = 15;
|
||||
};}];
|
||||
};
|
||||
};
|
||||
networks = {
|
||||
"99-nope" = {
|
||||
matchConfig.Name = "eth*";
|
||||
linkConfig.Unmanaged = true;
|
||||
};
|
||||
"90-wg0" = {
|
||||
matchConfig = { Name = "wg0"; };
|
||||
address = [ "10.0.0.${nodeId}/32" ];
|
||||
routes = [
|
||||
{ routeConfig = { Gateway = "10.0.0.${nodeId}"; Destination = "10.0.0.0/24"; }; }
|
||||
];
|
||||
};
|
||||
"90-eth1" = {
|
||||
matchConfig = { Name = "eth1"; };
|
||||
address = [ "192.168.1.${nodeId}/24" ];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
in import ./make-test.nix ({pkgs, ... }: {
|
||||
name = "networkd-wireguard";
|
||||
meta = with pkgs.stdenv.lib.maintainers; {
|
||||
maintainers = [ ninjatrappeur ];
|
||||
};
|
||||
nodes = {
|
||||
node1 = { pkgs, ... }@attrs:
|
||||
let localConf = {
|
||||
privkpath = pkgs.writeText "priv.key" "GDiXWlMQKb379XthwX0haAbK6hTdjblllpjGX0heP00=";
|
||||
pubk = "iRxpqj42nnY0Qz8MAQbSm7bXxXP5hkPqWYIULmvW+EE=";
|
||||
nodeId = "1";
|
||||
peerId = "2";
|
||||
};
|
||||
in generateNodeConf (attrs // localConf);
|
||||
|
||||
node2 = { pkgs, ... }@attrs:
|
||||
let localConf = {
|
||||
privkpath = pkgs.writeText "priv.key" "eHxSI2jwX/P4AOI0r8YppPw0+4NZnjOxfbS5mt06K2k=";
|
||||
pubk = "27s0OvaBBdHoJYkH9osZpjpgSOVNw+RaKfboT/Sfq0g=";
|
||||
nodeId = "2";
|
||||
peerId = "1";
|
||||
};
|
||||
in generateNodeConf (attrs // localConf);
|
||||
};
|
||||
testScript = ''
|
||||
startAll;
|
||||
$node1->waitForUnit('systemd-networkd-wait-online.service');
|
||||
$node2->waitForUnit('systemd-networkd-wait-online.service');
|
||||
$node1->succeed('ping -c 5 10.0.0.2');
|
||||
$node2->succeed('ping -c 5 10.0.0.1');
|
||||
# Is the fwmark set?
|
||||
$node2->succeed('wg | grep -q 42');
|
||||
'';
|
||||
})
|
Loading…
Reference in a new issue