b12f/nixpkgs
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

Merge pull request #171155 from cab404/wg-quick-files

Browse source 
nixos/wg-quick: added support for configuration files
This commit is contained in:
Timothy DeHerrera 2022-06-11 22:00:45 -07:00 committed by GitHub
parent 18bd58aa85 8de1e9e2f8
commit ec4e23d4e9
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 27 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

29
nixos/modules/services/networking/wg-quick.nix
View file

@ -10,6 +10,18 @@ let
interfaceOpts = { ... }: {
options = {
configFile = mkOption {
example = "/secret/wg0.conf";
default = null;
type = with types; nullOr str;
description = ''
wg-quick .conf file, describing the interface.
This overrides any other configuration interface configuration options.
See wg-quick manpage for more details.
'';
};
address = mkOption {
example = [ "192.168.2.1/24" ];
default = [];
@ -205,7 +217,7 @@ let
writeScriptFile = name: text: ((pkgs.writeShellScriptBin name text) + "/bin/${name}");
generateUnit = name: values:
assert assertMsg ((values.privateKey != null) != (values.privateKeyFile != null)) "Only one of privateKey or privateKeyFile may be set";
assert assertMsg (values.configFile != null || ((values.privateKey != null) != (values.privateKeyFile != null))) "Only one of privateKey, configFile or privateKeyFile may be set";
let
preUpFile = if values.preUp != "" then writeScriptFile "preUp.sh" values.preUp else null;
postUp =
@ -247,7 +259,12 @@ let
optionalString (peer.allowedIPs != []) "AllowedIPs = ${concatStringsSep "," peer.allowedIPs}\n"
) values.peers;
};
configPath = "${configDir}/${name}.conf";
configPath =
if values.configFile != null then
# This uses bind-mounted private tmp folder (/tmp/systemd-private-***)
"/tmp/${name}.conf"
else
"${configDir}/${name}.conf";
in
nameValuePair "wg-quick-${name}"
{
@ -265,9 +282,17 @@ let
script = ''
${optionalString (!config.boot.isContainer) "modprobe wireguard"}
${optionalString (values.configFile != null) ''
cp ${values.configFile} ${configPath}
''}
wg-quick up ${configPath}
'';
serviceConfig = {
# Used to privately store renamed copies of external config files during activation
PrivateTmp = true;
};
preStop = ''
wg-quick down ${configPath}
'';