{ lib, config, pkgs, ... }: with lib; let psCfg = config.pub-solar; cfg = config.pub-solar.wireguard.tunnel; in { options.pub-solar.wireguard.tunnel = { ownIPs = mkOption { description = "Internal ips in wireguard used for cluster control-plane communication."; type = types.listOf types.str; default = []; }; privateKeyFile = mkOption { description = "Location of private key file"; type = types.path; }; peer = { publicKey = mkOption { description = "Public key of the peer"; type = types.str; }; endpoint = mkOption { description = "Peer endpoint address"; type = types.str; }; }; useDNS = mkOption { description = "Whether to use the DNS of the interface as default"; default = false; type = types.bool; }; }; config = mkIf (length cfg.ownIPs != 0){ networking.firewall.allowedUDPPorts = [51820]; systemd.services.wireguard-wg-tunnel = mkIf (length config.pub-solar.wireguard.private.ownIPs != 0) { after = [ "wireguard-wg-private.service" ]; serviceConfig = { Type = mkForce "simple"; Restart = "on-failure"; RestartSec = "30"; }; environment = { WG_ENDPOINT_RESOLUTION_RETRIES = "infinity"; }; }; networking.wireguard.interfaces = let splitEndpoint = (strings.splitString ":" cfg.peer.endpoint); joinIPV6 = p: ip: p + (if (stringLength ip > 0) then ":" else "") + ip; isIPV4 = length splitEndpoint < 3; ipFlag = if isIPV4 then "-4" else "-6"; endpointIP = (if isIPV4 then elemAt splitEndpoint 0 else lists.fold joinIPV6 "" ((lists.take ((length splitEndpoint) - 1)) splitEndpoint) ); endpointIPStripped = strings.removePrefix "[" (strings.removeSuffix "]" endpointIP); in { wg-tunnel = { listenPort = 51820; ips = cfg.ownIPs; privateKeyFile = cfg.privateKeyFile; postSetup = '' defaultRoute=$(${pkgs.iproute2}/bin/ip ${ipFlag} r | ${pkgs.gnugrep}/bin/grep "default via" | head -n 1 | ${pkgs.gawk}/bin/awk '{ print $3 " " $4 " " $5 }') ${pkgs.iproute2}/bin/ip ${ipFlag} route add "${endpointIPStripped}${if isIPV4 then "/32" else "/128"}" metric 256 via $defaultRoute ip -4 route delete default dev wg-tunnel || true ip -4 route add default dev wg-tunnel metric 512 ip -6 route delete default dev wg-tunnel || true ip -6 route add default dev wg-tunnel metric 512 '' + (if cfg.useDNS then ''printf "nameserver 10.64.0.1" | resolvconf -a wg-tunnel -m 0 -x'' else ""); postShutdown = '' addedRoute=$(${pkgs.iproute2}/bin/ip ${ipFlag} r | ${pkgs.gnugrep}/bin/grep "${endpointIPStripped}" | head -n 1 | ${pkgs.gawk}/bin/awk '{ print $1 " " $2 " " $3 " " $4 " " $5 }') if [ -n "$addedRoute" ]; then ${pkgs.iproute2}/bin/ip ${ipFlag} route delete $addedRoute fi '' + (if cfg.useDNS then ''resolvconf -d wg-tunnel -f'' else ""); peers = [ { publicKey = cfg.peer.publicKey; allowedIPs = [ "0.0.0.0/0" "::/0" ]; endpoint = cfg.peer.endpoint; persistentKeepalive = 30; dynamicEndpointRefreshSeconds = 30; } ]; }; }; }; }