wireguard: add public network

hosts/biolimo/networking.nix

@@ -10,11 +10,11 @@
 
   age.secrets.wg-private-key.file = "${flake.self}/secrets/wg-private-biolimo.age";
 
-  pub-solar.wireguard-client = {
+  pub-solar.wireguard.private = {
     ownIPs = [
       "10.13.12.6/32"
       "fd00:b12f:acab:1312:acab:6::/96"
     ];
-    wireguardPrivateKeyFile = "/run/agenix/wg-private-key";
+    privateKeyFile = config.age.secrets.wg-private-key.path;
   };
 }

hosts/chocolatebar/networking.nix

@@ -9,11 +9,11 @@
 
   age.secrets.wg-private-key.file = "${flake.self}/secrets/wg-private-chocolatebar.age";
 
-  pub-solar.wireguard-client = {
+  pub-solar.wireguard.private = {
     ownIPs = [
       "10.13.12.5/32"
       "fd00:b12f:acab:1312:acab:5::/96"
     ];
-    wireguardPrivateKeyFile = "/run/agenix/wg-private-key";
+    privateKeyFile = config.age.secrets.wg-private-key.path;
   };
 }

hosts/default.nix

@@ -18,7 +18,6 @@
           self.nixosModules.office
           self.nixosModules.persistence
           self.nixosModules.printing
-          self.nixosModules.wireguard-client
         ];
       };
 
@@ -36,7 +35,6 @@
           self.nixosModules.nextcloud
           self.nixosModules.office
           self.nixosModules.printing
-          self.nixosModules.wireguard-client
         ];
       };
 
@@ -56,7 +54,6 @@
           self.nixosModules.office
           self.nixosModules.printing
           self.nixosModules.virtualisation
-          self.nixosModules.wireguard-client
           self.nixosModules.wireshark
         ];
       };
@@ -68,7 +65,6 @@
           self.nixosModules.base
           ./droppie
           self.nixosModules.yule
-          self.nixosModules.wireguard-client
           self.nixosModules.persistence
         ];
       };
@@ -83,7 +79,6 @@
           self.nixosModules.acme
           self.nixosModules.docker
           self.nixosModules.invoiceplane
-          self.nixosModules.wireguard-client
         ];
       };
 

hosts/droppie/networking.nix

@@ -13,17 +13,33 @@
     ipv6.addresses = [ { address = "2a02:908:5b1:e3c0:3::"; prefixLength = 64; } ];
   };
 
-  age.secrets.wg-private-key.file = "${flake.self}/secrets/wg-private-droppie.age";
-
   # Allow pub.solar restic backups
   services.openssh.allowSFTP = true;
   services.openssh.openFirewall = true;
 
-  pub-solar.wireguard-client = {
+  age.secrets.wg-private-key.file = "${flake.self}/secrets/wg-private-droppie.age";
+
+  pub-solar.wireguard.private = {
     ownIPs = [
       "10.13.12.3/32"
       "fd00:b12f:acab:1312:acab:3::/96"
     ];
-    wireguardPrivateKeyFile = "/run/agenix/wg-private-key";
+    privateKeyFile = config.age.secrets.wg-private-key.path;
+    useDNS = false;
+  };
+
+  age.secrets.wg-public-key.file = "${flake.self}/secrets/wg-public-droppie.age";
+
+  pub-solar.wireguard.public = {
+    ownIPs = [
+      "10.70.16.244/32"
+      "fc00:bbbb:bbbb:bb01::7:10f3/128"
+    ];
+    privateKeyFile = config.age.secrets.wg-public-key.path;
+    useDNS = true;
+    peer = {
+      publicKey = "m9w2Fr0rcN6R1a9HYrGnUTU176rTZIq2pcsovPd9sms=";
+      endpoint = "[2a02:6ea0:d406:1::a18f]:3019";
+    };
   };
 }

hosts/frikandel/wireguard.nix

@@ -5,29 +5,27 @@
   lib,
   ...
 }: with lib; {
-  age.secrets.wg-private-key-server.file = "${flake.self}/secrets/wg-private-frikandel-server.age";
-
   boot.kernel.sysctl = {
     "net.ipv4.ip_forward" = 1;
-    "net.ipv6.conf.wg0.forwarding" = 1;
-    "net.ipv6.conf.wg0.accept_ra" = 1;
-    "net.ipv6.conf.wg0.accept_ra_pinfo" = 1;
+    "net.ipv6.conf.wg-private.forwarding" = 1;
+    "net.ipv6.conf.wg-private.accept_ra" = 1;
+    "net.ipv6.conf.wg-private.accept_ra_pinfo" = 1;
   };
 
   networking.nat = {
     enable = true;
     enableIPv6 = true;
     externalInterface = "enp1s0";
-    internalInterfaces = [ "wg0" ];
+    internalInterfaces = [ "wg-private" ];
   };
 
   networking.firewall.allowedUDPPorts = [ 51899 ];
   networking.firewall.extraForwardRules = [
-    "iifname { != wg0 } reject"
-    "iifname wg0 accept"
+    "iifname { != wg-private } reject"
+    "iifname wg-private accept"
   ];
 
-  systemd.services.wireguard-wg0 = {
+  systemd.services.wireguard-wg-private = {
     after = [
       "network.target"
       "network-online.target"
@@ -45,16 +43,18 @@
     };
   };
 
+  age.secrets.wg-private-key.file = "${flake.self}/secrets/wg-private-frikandel-server.age";
+
   # Enable WireGuard
   networking.wireguard.interfaces = {
-    wg0 = {
+    wg-private = {
       listenPort = 51899;
       mtu = 1300;
       ips = [
         "10.13.12.7/32"
         "fd00:b12f:acab:1312:acab:7::/96"
       ];
-      privateKeyFile = "/run/agenix/wg-private-key-server";
+      privateKeyFile = config.age.secrets.wg-private-key.path;
       peers = [
         { # pie
           publicKey = "hPTXEqQ2GYEywdPNdZBacwB9KKcoFZ/heClxnqmizyw=";
@@ -62,7 +62,6 @@
             "10.13.12.2/32"
             "fd00:b12f:acab:1312:acab:2::/96"
           ];
-          endpoint = "pie-wg.b12f.io:51899";
           persistentKeepalive = 25;
         }
         { # droppie

hosts/pie/networking.nix

@@ -28,12 +28,12 @@
 
   age.secrets.wg-private-key.file = "${flake.self}/secrets/wg-private-pie.age";
 
-  pub-solar.wireguard-client = {
+  pub-solar.wireguard.private = {
     useDNS = false;
     ownIPs = [
       "10.13.12.2/32"
       "fd00:b12f:acab:1312:acab:2::/96"
     ];
-    wireguardPrivateKeyFile = "/run/agenix/wg-private-key";
+    privateKeyFile = config.age.secrets.wg-private-key.path;
   };
 }

hosts/stroopwafel/networking.nix

@@ -10,11 +10,25 @@
 
   age.secrets.wg-private-key.file = "${flake.self}/secrets/wg-private-stroopwafel.age";
 
-  pub-solar.wireguard-client = {
+  pub-solar.wireguard.private = {
     ownIPs = [
       "10.13.12.8/32"
       "fd00:b12f:acab:1312:acab:8::/96"
     ];
-    wireguardPrivateKeyFile = "/run/agenix/wg-private-key";
+    privateKeyFile = config.age.secrets.wg-private-key.path;
+  };
+
+  age.secrets.wg-public-key.file = "${flake.self}/secrets/wg-public-stroopwafel.age";
+
+  pub-solar.wireguard.public = {
+    ownIPs = [
+      "10.68.3.133/32"
+      "fc00:bbbb:bbbb:bb01::5:384/128"
+    ];
+    privateKeyFile = config.age.secrets.wg-public-key.path;
+    peer = {
+      publicKey = "5FZW+fNA2iVBSY99HFl+KjGc9AFVNE+UFAedLNhu8lc=";
+      endpoint = "146.70.134.2:3565";
+    };
   };
 }

modules/default.nix

@@ -25,7 +25,7 @@
       terminal-life = import ./terminal-life;
       user = import ./user;
       virtualisation = import ./virtualisation;
-      wireguard-client = import ./wireguard-client;
+      wireguard = import ./wireguard;
       wireshark = import ./wireshark;
 
       base.imports = [
@@ -37,6 +37,7 @@
         self.nixosModules.crypto
         self.nixosModules.nix
         self.nixosModules.terminal-life
+        self.nixosModules.wireguard
 
         self.nixosModules.root
         self.nixosModules.user

modules/wireguard/default.nix

@@ -0,0 +1,11 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}: {
+  imports = [
+    ./private.nix
+    ./public.nix
+  ];
+}

modules/wireguard/private.nix

@@ -6,17 +6,18 @@
 }:
 with lib; let
   psCfg = config.pub-solar;
-  cfg = config.pub-solar.wireguard-client;
+  cfg = config.pub-solar.wireguard.private;
 in {
-  options.pub-solar.wireguard-client = {
+  options.pub-solar.wireguard.private = {
     ownIPs = mkOption {
       description = ''
         Internal ips in wireguard used for cluster control-plane communication.
       '';
       type = types.listOf types.str;
+      default = [];
     };
 
-    wireguardPrivateKeyFile = mkOption {
+    privateKeyFile = mkOption {
       description = ''
         Location of private key file
       '';
@@ -40,10 +41,10 @@ in {
     };
   };
 
-  config = {
+  config =  mkIf (builtins.length cfg.ownIPs != 0) {
     networking.firewall.allowedUDPPorts = [51899];
 
-    systemd.services.wireguard-wg0 = {
+    systemd.services.wireguard-wg-private = {
       after = [
         "network.target"
         "network-online.target"
@@ -62,16 +63,24 @@ in {
     };
 
     networking.wireguard.interfaces = {
-      wg0 = {
+      wg-private = {
         listenPort = 51899;
         mtu = 1300;
         ips = cfg.ownIPs;
-        privateKeyFile = cfg.wireguardPrivateKeyFile;
-        postSetup = lib.mkIf cfg.useDNS ''
-          printf "nameserver 10.13.12.7\nnameserver fd00:b12f:acab:1312:acab:7::" | resolvconf -a wg0 -m 0 -x
-        '';
+        privateKeyFile = cfg.privateKeyFile;
+        postSetup = ""
+        + (if cfg.useDNS then ''
+          printf "nameserver 10.13.12.7\nnameserver fd00:b12f:acab:1312:acab:7::" | resolvconf -a wg-private -m 0 -x
+        '' else "")
+        + (if cfg.fullTunnel then ''
+          defaultRoute=$(${pkgs.iproute2}/bin/ip r | ${pkgs.gnugrep}/bin/grep "default via" | head -n 1 | ${pkgs.gawk}/bin/awk '{ print $3 " " $4 " " $5 }')
+          ipv4=$(${pkgs.dnsutils}/bin/dig +short A vpn.b12f.io)
+          ${pkgs.iproute2}/bin/ip route add $ipv4 via $defaultRoute
+          ipv6=$(${pkgs.dnsutils}/bin/dig +short AAAA vpn.b12f.io)
+          ${pkgs.iproute2}/bin/ip route add $ipv6 via $defaultRoute
+        '' else "");
         postShutdown = lib.mkIf cfg.useDNS ''
-          resolvconf -d wg0 -f
+          resolvconf -d wg-private -f
         '';
         peers = [
           {

modules/wireguard/public.nix

@@ -0,0 +1,83 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+with lib; let
+  psCfg = config.pub-solar;
+  cfg = config.pub-solar.wireguard.public;
+in {
+  options.pub-solar.wireguard.public = {
+    ownIPs = mkOption {
+      description = "Internal ips in wireguard used for cluster control-plane communication.";
+      type = types.listOf types.str;
+      default = [];
+    };
+
+    privateKeyFile = mkOption {
+      description = "Location of private key file";
+      type = types.path;
+    };
+
+    peer = {
+      publicKey = mkOption {
+        description = "Public key of the peer";
+        type = types.str;
+      };
+      endpoint = mkOption {
+        description = "Peer endpoint address";
+        type = types.str;
+      };
+    };
+
+    useDNS = mkOption {
+      description = "Whether to use the DNS of the interface as default";
+      default = true;
+      type = types.bool;
+    };
+  };
+
+  config = mkIf (length cfg.ownIPs != 0){
+    networking.firewall.allowedUDPPorts = [51820];
+
+    systemd.services.wireguard-wg-public = mkIf (length config.pub-solar.wireguard.private.ownIPs != 0) {
+      after = [ "wireguard-wg-private.service" ];
+    };
+
+    networking.wireguard.interfaces = {
+      wg-public = {
+        listenPort = 51820;
+        ips = cfg.ownIPs;
+        privateKeyFile = cfg.privateKeyFile;
+        postSetup = let
+          splitEndpoint = (strings.splitString ":" cfg.peer.endpoint);
+          joinIPV6 = p: ip: p + (if (stringLength ip > 0) then ":" else "") + ip;
+          isIPV4 = length splitEndpoint < 3;
+          endpointIP = (if isIPV4
+            then elemAt splitEndpoint 0
+            else lists.fold joinIPV6 "" ((lists.take ((length splitEndpoint) - 1)) splitEndpoint)
+          );
+        in mkIf cfg.useDNS ''
+          printf "nameserver 10.64.0.1" | resolvconf -a wg-public -m 0 -x
+          defaultRoute=$(${pkgs.iproute2}/bin/ip r | ${pkgs.gnugrep}/bin/grep "default via" | head -n 1 | ${pkgs.gawk}/bin/awk '{ print $3 " " $4 " " $5 }')
+          ${pkgs.iproute2}/bin/ip ${if isIPV4 then "" else "-6"} route add ${endpointIP}${if isIPV4 then "" else "/128"} via $defaultRoute
+        '';
+        postShutdown = mkIf cfg.useDNS ''
+          resolvconf -d wg-public -f
+        '';
+        peers = [
+          {
+            publicKey = cfg.peer.publicKey;
+            allowedIPs = [
+              "0.0.0.0/0"
+              "::/0"
+            ];
+            endpoint = cfg.peer.endpoint;
+            persistentKeepalive = 25;
+          }
+        ];
+      };
+    };
+  };
+}

secrets/secrets.nix

@@ -80,6 +80,9 @@ in {
   "wg-private-droppie.age".publicKeys = droppieKeys ++ baseKeys;
   "wg-private-frikandel-server.age".publicKeys = frikandelKeys ++ baseKeys;
 
+  "wg-public-stroopwafel.age".publicKeys = stroopwafelKeys ++ baseKeys;
+  "wg-public-droppie.age".publicKeys = droppieKeys ++ baseKeys;
+
   "invoiceplane-db-password.age".publicKeys = pieKeys ++ baseKeys;
   "invoiceplane-db-secrets.env.age".publicKeys = pieKeys ++ baseKeys;
 

secrets/wg-public-droppie.age

@@ -0,0 +1,25 @@
+age-encryption.org/v1
+-> ssh-ed25519 LVlqCg i1tTmBYjRhUWC9g3712yHyoOtJI+OC1zDLS0LTwB6BU
+qQVM3zeTYDd6f6JNO970Xe9OUhaRN9oAU/6HM/NSp9o
+-> ssh-rsa kFDS0A
+h9B46QuyjABsEZf5GkFJ5JrAFKjyFrxhWEIK2X3wCVtG+8QiJ6Ij4OzXmMoMwSwk
+QDF7yjmrbzyf+7331Hfh6FjSRUQ0TOK6lAjQJi4l8i7yB91d5NzcxKfyq5GiTrya
+0l3A/FeRKwdKaHgyMONq+eFcCEiF7NPjmS/ALxO+fFJxrxUPGujgwSKH14JnN8P8
+RzIAWOqrL6odN2oRCDsCFEheKbFBTRYPf7VrPJHDlr11jM9O+XKEJigN80w+8Byt
+U79pVgLEbvppxoXE2i5vrdhRmTIVN0qck9KtdEDSBMjc758nMMlTv6NdRkRXNnR5
+BQWVtqx/BMS/rV58jv3TTkBR/gl3aTaEnLDBW/GeZoBTBe9of3kAtJtGO7bZmkIP
+SSuZKhZj5w4aq6kppiKEqf2iYYvb8Rx19OoBzCER25puE1XfshTlaorH06APAB+6
+lWrDIKQovSH4j+2SUVncoCiathyzCyKZB5hGs6bcBcAgUaAPFARPiuX5tYnXCiox
+rMiZ3kP6ivTxcHDcZOrTXLiIeamaXVzv9sRREcn2SX76rgNlyi09kJL9E0W2XCom
+O4Isl2vBSd0F6jv03VSQJnAPHNzB5i7/Fuer+WzD29BvQUqhoj/M2olBh7fluBo9
+Q4Sl6TM3r5Tng6UnnvjCcWDYy1W68epJDO8ijwtRj5U
+-> piv-p256 zqq/iw ArboTsOuymJL0R4DjPFn6YQqC0Z4MWJuR8DhFvD+xdP+
+mmerIEHZNmBlX9Arb6BKxnDNZvgnjfn1b2+48/vbZH8
+-> piv-p256 vRzPNw Ava9AZcCeI0Y0FkB8mP54ywDYGcuInc9xZ2frmBL9aXV
+6sLexmlUZC5iehf3qNj5y2N6Ss7WKqrqxiUYHa5jEJk
+-> PaU0nX@"-grease
+v+xWWiviKP1h5IEGV4KUXKsuMw50FVDzlikOrHx9zH89p8rJSTfsOnjiQQQoLADo
+
+--- 88jMG7EjNFpsb0AmpMPfaMdv3Jc/ctCR2GP5xpAYYjA
+“»)D:\/IÜXä^}¯<>Éi<C389>;î“ùœYá<59>>e¥Ô¡Ð
+¼··tÀf¶ÃÖ»lê	Îv™²zÍå±ùk¿˜'Uý›
QçȧP´