os/modules/wireguard/tunnel.nix

{
  lib,
  config,
  pkgs,
  ...
}:
with lib; let
  psCfg = config.pub-solar;
  cfg = config.pub-solar.wireguard.tunnel;
in {
  options.pub-solar.wireguard.tunnel = {
    ownIPs = mkOption {
      description = "Internal ips in wireguard used for cluster control-plane communication.";
      type = types.listOf types.str;
      default = [];
    };

    privateKeyFile = mkOption {
      description = "Location of private key file";
      type = types.path;
    };

    peer = {
      publicKey = mkOption {
        description = "Public key of the peer";
        type = types.str;
      };
      endpoint = mkOption {
        description = "Peer endpoint address";
        type = types.str;
      };
    };

    useDNS = mkOption {
      description = "Whether to use the DNS of the interface as default";
      default = false;
      type = types.bool;
    };
  };

  config = mkIf (length cfg.ownIPs != 0){
    networking.firewall.allowedUDPPorts = [51820];

    systemd.network.wait-online.ignoredInterfaces = [ "wg-tunnel" ];

    systemd.targets.wireguard-wg-tunnel = {
      wantedBy = lib.mkForce [];
    };

    systemd.services.wireguard-wg-tunnel = {
      wants = [
        "wireguard-wg-private.service"
      ];

      preStart = ''
        while true; do
          if ${pkgs.netcat}/bin/nc -w 5 -z 10.13.12.7 22 2>/dev/null; then
            exit 0;
          else
            sleep 1;
          fi
        done;
      '';

      serviceConfig = {
        Type = mkForce "simple";
        Restart = "on-failure";
        RestartSec = "30";
      };

      environment = {
        WG_ENDPOINT_RESOLUTION_RETRIES = "infinity";
      };
    };

    networking.wireguard.interfaces = let
      splitEndpoint = (strings.splitString ":" cfg.peer.endpoint);
      joinIPV6 = p: ip: p + (if (stringLength ip > 0) then ":" else "") + ip;
      isIPV4 = length splitEndpoint < 3;
      ipFlag = if isIPV4 then "-4" else "-6";
      endpointIP = (if isIPV4
        then elemAt splitEndpoint 0
        else lists.fold joinIPV6 "" ((lists.take ((length splitEndpoint) - 1)) splitEndpoint)
      );
      endpointIPStripped = strings.removePrefix "[" (strings.removeSuffix "]" endpointIP);
    in {
      wg-tunnel = {
        listenPort = 51820;
        ips = cfg.ownIPs;
        privateKeyFile = cfg.privateKeyFile;
        postSetup = ''
          defaultRoute=$(${pkgs.iproute2}/bin/ip ${ipFlag} r | ${pkgs.gnugrep}/bin/grep "default via" | head -n 1 | ${pkgs.gawk}/bin/awk '{ print $3 " " $4 " " $5 }')
          ${pkgs.iproute2}/bin/ip ${ipFlag} route add "${endpointIPStripped}${if isIPV4 then "/32" else "/128"}" metric 256 via $defaultRoute
          ip -4 route delete default dev wg-tunnel || true
          ip -4 route add default dev wg-tunnel metric 512
          ip -6 route delete default dev wg-tunnel || true
          ip -6 route add default dev wg-tunnel metric 512
        '' + (if cfg.useDNS
          then ''printf "nameserver 10.64.0.1" | resolvconf -a wg-tunnel -m 0 -x''
          else "");
        postShutdown = ''
          addedRoute=$(${pkgs.iproute2}/bin/ip ${ipFlag} r | ${pkgs.gnugrep}/bin/grep "${endpointIPStripped}" | head -n 1 | ${pkgs.gawk}/bin/awk '{ print $1 " " $2 " " $3 " " $4 " " $5 }')
          if [ -n "$addedRoute" ]; then
            ${pkgs.iproute2}/bin/ip ${ipFlag} route delete $addedRoute
          fi
        '' + (if cfg.useDNS
          then ''resolvconf -d wg-tunnel -f''
          else "");
        peers = [
          {
            publicKey = cfg.peer.publicKey;
            allowedIPs = [
              "0.0.0.0/0"
              "::/0"
            ];
            endpoint = cfg.peer.endpoint;
            persistentKeepalive = 30;
            dynamicEndpointRefreshSeconds = 30;
          }
        ];
      };
    };
  };
}