colin/nix-files
1
0
Fork 1
Code Issues Pull Requests Projects Releases Wiki Activity

wg-home: unify server and client config

Browse Source
This commit is contained in:
colin 2023-01-20 07:42:31 +00:00
parent 708cb841fe
commit 6a2374e046
5 changed files with 59 additions and 69 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
hosts/by-name/lappy/default.nix
View File

@ -1,10 +1,12 @@
{ pkgs, ... }:
{ config, pkgs, ... }:
{
imports = [
./fs.nix
];
sane.roles.client = true;
sane.services.wg-home.enable = true;
sane.services.wg-home.ip = config.sane.hosts.by-name."lappy".wg-home.ip;
# sane.packages.enableDevPkgs = true;

5
hosts/by-name/servo/default.nix
View File

@ -1,4 +1,4 @@
{ pkgs, ... }:
{ config, pkgs, ... }:
{
imports = [
@ -8,6 +8,9 @@
./secrets.nix
./services
];
o
sane.services.wg-home.enable = true;
sane.services.wg-home.ip = config.sane.hosts.by-name."servo".wg-home.ip;
sane.packages.extraUserPkgs = with pkgs; [
# for administering services

8
hosts/modules/hosts.nix
View File

@ -22,6 +22,7 @@ let
};
wg-home.pubkey = mkOption {
type = types.nullOr types.str;
default = null;
description = ''
wireguard public key for the wg-home VPN.
e.g. "pWtnKW7f7sNIZQ2M83uJ7cHg3IL1tebE3IoVkCgjkXM=".
@ -29,11 +30,16 @@ let
};
wg-home.ip = mkOption {
type = types.nullOr types.str;
default = null;
description = ''
IP address to use on the wg-home VPN.
e.g. "10.0.10.5";
'';
};
wg-home.endpoint = mkOption {
type = types.nullOr types.str;
default = null;
};
lan-ip = mkOption {
type = types.str;
description = ''
@ -83,6 +89,8 @@ in
ssh.host_pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOfdSmFkrVT6DhpgvFeQKm3Fh9VKZ9DbLYOPOJWYQ0E8";
wg-home.pubkey = "roAw+IUFVtdpCcqa4khB385Qcv9l5JAB//730tyK4Wk=";
wg-home.ip = "10.0.10.5";
# wg-home.endpoint = "uninsane.org:51820";
wg-home.endpoint = "97.126.41.123:51820";
lan-ip = "192.168.0.5";
};
};

6
hosts/modules/roles/client/default.nix
View File

@ -9,13 +9,9 @@ in
./wifi-pairings.nix
];
# option is consumed by the other imports in this dir
options.sane.roles.client = mkOption {
type = types.bool;
default = false;
};
config = mkIf config.sane.roles.client {
sane.services.wg-home.enable = true;
sane.services.wg-home.role = "client";
};
}

105
hosts/modules/wg-home.nix
View File

@ -1,8 +1,7 @@
{ config, lib, pkgs, ... }:
let
inherit (builtins) mapAttrsToList;
inherit (lib) mkIf mkMerge mkOption optionalAttrs types;
inherit (lib) mapAttrsToList mkIf mkMerge mkOption optionalAttrs types;
cfg = config.sane.services.wg-home;
server-cfg = config.sane.hosts.by-name."servo".wg-home;
in
@ -12,73 +11,55 @@ in
type = types.bool;
default = false;
};
sane.services.wg-home.role = mkOption {
type = types.enum [ "client" "server" ];
sane.services.wg-home.ip = mkOption {
type = types.str;
};
};
config = mkIf cfg.enable (mkMerge [
{
# generate a (deterministic) wireguard private key
sane.derived-secrets."/run/wg-home.priv" = {
len = 32;
encoding = "base64";
};
config = mkIf cfg.enable {
# generate a (deterministic) wireguard private key
sane.derived-secrets."/run/wg-home.priv" = {
len = 32;
encoding = "base64";
};
# wireguard VPN which allows everything on my domain to speak to each other even when
# not behind a shared LAN.
# this config defines both the endpoint (server) and client configs
# wireguard VPN which allows everything on my domain to speak to each other even when
# not behind a shared LAN.
# this config defines both the endpoint (server) and client configs
# for convenience, have both the server and client use the same port for their wireguard connections.
networking.firewall.allowedUDPPorts = [ 51820 ];
networking.wireguard.interfaces.wg-home = {
listenPort = 51820;
privateKeyFile = "/run/wg-home.priv";
preSetup =
let
gen-key = config.sane.fs."/run/wg-home.priv".unit;
in
"${pkgs.systemd}/bin/systemctl start '${gen-key}'";
};
}
# for convenience, have both the server and client use the same port for their wireguard connections.
networking.firewall.allowedUDPPorts = [ 51820 ];
networking.wireguard.interfaces.wg-home = {
listenPort = 51820;
privateKeyFile = "/run/wg-home.priv";
preSetup =
let
gen-key = config.sane.fs."/run/wg-home.priv".unit;
in
"${pkgs.systemd}/bin/systemctl start '${gen-key}'";
{
networking.wireguard.interfaces.wg-home = lib.mkIf (cfg.role == "client") {
# client IP (TODO: make host-specific)
ips = [ "10.0.10.20/24" ];
ips = [
"${cfg.ip}/24"
];
peers = [
{
# server pubkey
publicKey = server-cfg.pubkey;
# include all peers -- except for ourself
peers = mapAttrsToList
(name: hostcfg:
mkIf (hostcfg.wg-home.ip != null && hostcfg.wg-home.ip != cfg.ip) {
publicKey = hostcfg.wg-home.pubkey;
allowedIPs = [ "${hostcfg.wg-home.ip}/32" ];
endpoint = lib.mkIf
(hostcfg.wg-home.endpoint != null)
hostcfg.wg-home.endpoint;
# accept traffic from any IP addr on the other side of the tunnel
# allowedIPs = [ "0.0.0.0/0" ];
allowedIPs = [ "10.0.10.5/32" ];
# endpoint = "uninsane.org:51820";
endpoint = "97.126.41.123:51820";
# send keepalives every 25 seconds to keep NAT routes live
persistentKeepalive = 25;
# send keepalives every 25 seconds to keep NAT routes live.
# only need to do this from client -> server though, i think.
persistentKeepalive = lib.mkIf
(hostcfg.wg-home.endpoint != null)
25;
}
];
};
}
{
networking.wireguard.interfaces.wg-home = lib.mkIf (cfg.role == "server") {
ips = [
"10.0.10.5/24"
];
peers = mapAttrsToList
(name: hostcfg:
lib.mkIf (hostcfg.wg-home.ip or server-cfg.ip != server-cfg.ip) {
publicKey = hostcfg.wg-home.pubkey;
allowedIPs = [ "${hostcfg.wg-home.ip}/32" ];
}
)
config.sane.hosts.by-name;
};
}
]);
)
config.sane.hosts.by-name;
};
};
}