119 lines
3.5 KiB
Nix
119 lines
3.5 KiB
Nix
{
|
|
lib,
|
|
config,
|
|
pkgs,
|
|
...
|
|
}:
|
|
with lib; let
|
|
psCfg = config.pub-solar;
|
|
cfg = config.pub-solar.wireguard.tunnel;
|
|
in {
|
|
options.pub-solar.wireguard.tunnel = {
|
|
ownIPs = mkOption {
|
|
description = "Internal ips in wireguard used for cluster control-plane communication.";
|
|
type = types.listOf types.str;
|
|
default = [];
|
|
};
|
|
|
|
privateKeyFile = mkOption {
|
|
description = "Location of private key file";
|
|
type = types.path;
|
|
};
|
|
|
|
peer = {
|
|
publicKey = mkOption {
|
|
description = "Public key of the peer";
|
|
type = types.str;
|
|
};
|
|
endpoint = mkOption {
|
|
description = "Peer endpoint address";
|
|
type = types.str;
|
|
};
|
|
};
|
|
|
|
useDNS = mkOption {
|
|
description = "Whether to use the DNS of the interface as default";
|
|
default = false;
|
|
type = types.bool;
|
|
};
|
|
};
|
|
|
|
config = mkIf (length cfg.ownIPs != 0){
|
|
networking.firewall.allowedUDPPorts = [51820];
|
|
|
|
systemd.services.wireguard-wg-tunnel = {
|
|
wants = [
|
|
"wireguard-wg-private.service"
|
|
];
|
|
|
|
preStart = ''
|
|
while true; do
|
|
if ${pkgs.netcat}/bin/nc -w 5 -z 10.13.12.7 22 2>/dev/null; then
|
|
exit 0;
|
|
else
|
|
sleep 1;
|
|
fi
|
|
done;
|
|
'';
|
|
|
|
serviceConfig = {
|
|
Type = mkForce "simple";
|
|
Restart = "on-failure";
|
|
RestartSec = "30";
|
|
};
|
|
|
|
environment = {
|
|
WG_ENDPOINT_RESOLUTION_RETRIES = "infinity";
|
|
};
|
|
};
|
|
|
|
networking.wireguard.interfaces = let
|
|
splitEndpoint = (strings.splitString ":" cfg.peer.endpoint);
|
|
joinIPV6 = p: ip: p + (if (stringLength ip > 0) then ":" else "") + ip;
|
|
isIPV4 = length splitEndpoint < 3;
|
|
ipFlag = if isIPV4 then "-4" else "-6";
|
|
endpointIP = (if isIPV4
|
|
then elemAt splitEndpoint 0
|
|
else lists.fold joinIPV6 "" ((lists.take ((length splitEndpoint) - 1)) splitEndpoint)
|
|
);
|
|
endpointIPStripped = strings.removePrefix "[" (strings.removeSuffix "]" endpointIP);
|
|
in {
|
|
wg-tunnel = {
|
|
listenPort = 51820;
|
|
ips = cfg.ownIPs;
|
|
privateKeyFile = cfg.privateKeyFile;
|
|
postSetup = ''
|
|
defaultRoute=$(${pkgs.iproute2}/bin/ip ${ipFlag} r | ${pkgs.gnugrep}/bin/grep "default via" | head -n 1 | ${pkgs.gawk}/bin/awk '{ print $3 " " $4 " " $5 }')
|
|
${pkgs.iproute2}/bin/ip ${ipFlag} route add "${endpointIPStripped}${if isIPV4 then "/32" else "/128"}" metric 256 via $defaultRoute
|
|
ip -4 route delete default dev wg-tunnel || true
|
|
ip -4 route add default dev wg-tunnel metric 512
|
|
ip -6 route delete default dev wg-tunnel || true
|
|
ip -6 route add default dev wg-tunnel metric 512
|
|
'' + (if cfg.useDNS
|
|
then ''printf "nameserver 10.64.0.1" | resolvconf -a wg-tunnel -m 0 -x''
|
|
else "");
|
|
postShutdown = ''
|
|
addedRoute=$(${pkgs.iproute2}/bin/ip ${ipFlag} r | ${pkgs.gnugrep}/bin/grep "${endpointIPStripped}" | head -n 1 | ${pkgs.gawk}/bin/awk '{ print $1 " " $2 " " $3 " " $4 " " $5 }')
|
|
if [ -n "$addedRoute" ]; then
|
|
${pkgs.iproute2}/bin/ip ${ipFlag} route delete $addedRoute
|
|
fi
|
|
'' + (if cfg.useDNS
|
|
then ''resolvconf -d wg-tunnel -f''
|
|
else "");
|
|
peers = [
|
|
{
|
|
publicKey = cfg.peer.publicKey;
|
|
allowedIPs = [
|
|
"0.0.0.0/0"
|
|
"::/0"
|
|
];
|
|
endpoint = cfg.peer.endpoint;
|
|
persistentKeepalive = 30;
|
|
dynamicEndpointRefreshSeconds = 30;
|
|
}
|
|
];
|
|
};
|
|
};
|
|
};
|
|
}
|