97 lines
3.2 KiB
Nix
97 lines
3.2 KiB
Nix
{
|
|
lib,
|
|
config,
|
|
pkgs,
|
|
...
|
|
}:
|
|
with lib; let
|
|
psCfg = config.pub-solar;
|
|
cfg = config.pub-solar.wireguard.tunnel;
|
|
in {
|
|
options.pub-solar.wireguard.tunnel = {
|
|
ownIPs = mkOption {
|
|
description = "Internal ips in wireguard used for cluster control-plane communication.";
|
|
type = types.listOf types.str;
|
|
default = [];
|
|
};
|
|
|
|
privateKeyFile = mkOption {
|
|
description = "Location of private key file";
|
|
type = types.path;
|
|
};
|
|
|
|
peer = {
|
|
publicKey = mkOption {
|
|
description = "Public key of the peer";
|
|
type = types.str;
|
|
};
|
|
endpoint = mkOption {
|
|
description = "Peer endpoint address";
|
|
type = types.str;
|
|
};
|
|
};
|
|
|
|
useDNS = mkOption {
|
|
description = "Whether to use the DNS of the interface as default";
|
|
default = false;
|
|
type = types.bool;
|
|
};
|
|
};
|
|
|
|
config = mkIf (length cfg.ownIPs != 0){
|
|
networking.firewall.allowedUDPPorts = [51820];
|
|
|
|
systemd.services.wireguard-wg-tunnel = mkIf (length config.pub-solar.wireguard.private.ownIPs != 0) {
|
|
after = [ "wireguard-wg-private.service" ];
|
|
};
|
|
|
|
networking.wireguard.interfaces = let
|
|
splitEndpoint = (strings.splitString ":" cfg.peer.endpoint);
|
|
joinIPV6 = p: ip: p + (if (stringLength ip > 0) then ":" else "") + ip;
|
|
isIPV4 = length splitEndpoint < 3;
|
|
ipFlag = if isIPV4 then "-4" else "-6";
|
|
endpointIP = (if isIPV4
|
|
then elemAt splitEndpoint 0
|
|
else lists.fold joinIPV6 "" ((lists.take ((length splitEndpoint) - 1)) splitEndpoint)
|
|
);
|
|
endpointIPStripped = strings.removePrefix "[" (strings.removeSuffix "]" endpointIP);
|
|
in {
|
|
wg-tunnel = {
|
|
listenPort = 51820;
|
|
ips = cfg.ownIPs;
|
|
privateKeyFile = cfg.privateKeyFile;
|
|
postSetup = ''
|
|
defaultRoute=$(${pkgs.iproute2}/bin/ip ${ipFlag} r | ${pkgs.gnugrep}/bin/grep "default via" | head -n 1 | ${pkgs.gawk}/bin/awk '{ print $3 " " $4 " " $5 }')
|
|
${pkgs.iproute2}/bin/ip ${ipFlag} route add "${endpointIPStripped}${if isIPV4 then "/32" else "/128"}" metric 256 via $defaultRoute
|
|
ip -4 route delete default dev wg-tunnel || true
|
|
ip -4 route add default dev wg-tunnel metric 512
|
|
ip -6 route delete default dev wg-tunnel || true
|
|
ip -6 route add default dev wg-tunnel metric 512
|
|
'' + (if cfg.useDNS
|
|
then ''printf "nameserver 10.64.0.1" | resolvconf -a wg-tunnel -m 0 -x''
|
|
else "");
|
|
postShutdown = ''
|
|
addedRoute=$(${pkgs.iproute2}/bin/ip ${ipFlag} r | ${pkgs.gnugrep}/bin/grep "${endpointIPStripped}" | head -n 1 | ${pkgs.gawk}/bin/awk '{ print $1 " " $2 " " $3 " " $4 " " $5 }')
|
|
if [ -n "$addedRoute" ]; then
|
|
${pkgs.iproute2}/bin/ip ${ipFlag} route delete $addedRoute
|
|
fi
|
|
'' + (if cfg.useDNS
|
|
then ''resolvconf -d wg-tunnel -f''
|
|
else "");
|
|
peers = [
|
|
{
|
|
publicKey = cfg.peer.publicKey;
|
|
allowedIPs = [
|
|
"0.0.0.0/0"
|
|
"::/0"
|
|
];
|
|
endpoint = cfg.peer.endpoint;
|
|
persistentKeepalive = 30;
|
|
dynamicEndpointRefreshSeconds = 30;
|
|
}
|
|
];
|
|
};
|
|
};
|
|
};
|
|
}
|