wg-home: unify server and client config
This commit is contained in:
parent
708cb841fe
commit
6a2374e046
|
@ -1,10 +1,12 @@
|
||||||
{ pkgs, ... }:
|
{ config, pkgs, ... }:
|
||||||
{
|
{
|
||||||
imports = [
|
imports = [
|
||||||
./fs.nix
|
./fs.nix
|
||||||
];
|
];
|
||||||
|
|
||||||
sane.roles.client = true;
|
sane.roles.client = true;
|
||||||
|
sane.services.wg-home.enable = true;
|
||||||
|
sane.services.wg-home.ip = config.sane.hosts.by-name."lappy".wg-home.ip;
|
||||||
|
|
||||||
# sane.packages.enableDevPkgs = true;
|
# sane.packages.enableDevPkgs = true;
|
||||||
|
|
||||||
|
|
|
@ -1,4 +1,4 @@
|
||||||
{ pkgs, ... }:
|
{ config, pkgs, ... }:
|
||||||
|
|
||||||
{
|
{
|
||||||
imports = [
|
imports = [
|
||||||
|
@ -8,6 +8,9 @@
|
||||||
./secrets.nix
|
./secrets.nix
|
||||||
./services
|
./services
|
||||||
];
|
];
|
||||||
|
o
|
||||||
|
sane.services.wg-home.enable = true;
|
||||||
|
sane.services.wg-home.ip = config.sane.hosts.by-name."servo".wg-home.ip;
|
||||||
|
|
||||||
sane.packages.extraUserPkgs = with pkgs; [
|
sane.packages.extraUserPkgs = with pkgs; [
|
||||||
# for administering services
|
# for administering services
|
||||||
|
|
|
@ -22,6 +22,7 @@ let
|
||||||
};
|
};
|
||||||
wg-home.pubkey = mkOption {
|
wg-home.pubkey = mkOption {
|
||||||
type = types.nullOr types.str;
|
type = types.nullOr types.str;
|
||||||
|
default = null;
|
||||||
description = ''
|
description = ''
|
||||||
wireguard public key for the wg-home VPN.
|
wireguard public key for the wg-home VPN.
|
||||||
e.g. "pWtnKW7f7sNIZQ2M83uJ7cHg3IL1tebE3IoVkCgjkXM=".
|
e.g. "pWtnKW7f7sNIZQ2M83uJ7cHg3IL1tebE3IoVkCgjkXM=".
|
||||||
|
@ -29,11 +30,16 @@ let
|
||||||
};
|
};
|
||||||
wg-home.ip = mkOption {
|
wg-home.ip = mkOption {
|
||||||
type = types.nullOr types.str;
|
type = types.nullOr types.str;
|
||||||
|
default = null;
|
||||||
description = ''
|
description = ''
|
||||||
IP address to use on the wg-home VPN.
|
IP address to use on the wg-home VPN.
|
||||||
e.g. "10.0.10.5";
|
e.g. "10.0.10.5";
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
|
wg-home.endpoint = mkOption {
|
||||||
|
type = types.nullOr types.str;
|
||||||
|
default = null;
|
||||||
|
};
|
||||||
lan-ip = mkOption {
|
lan-ip = mkOption {
|
||||||
type = types.str;
|
type = types.str;
|
||||||
description = ''
|
description = ''
|
||||||
|
@ -83,6 +89,8 @@ in
|
||||||
ssh.host_pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOfdSmFkrVT6DhpgvFeQKm3Fh9VKZ9DbLYOPOJWYQ0E8";
|
ssh.host_pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOfdSmFkrVT6DhpgvFeQKm3Fh9VKZ9DbLYOPOJWYQ0E8";
|
||||||
wg-home.pubkey = "roAw+IUFVtdpCcqa4khB385Qcv9l5JAB//730tyK4Wk=";
|
wg-home.pubkey = "roAw+IUFVtdpCcqa4khB385Qcv9l5JAB//730tyK4Wk=";
|
||||||
wg-home.ip = "10.0.10.5";
|
wg-home.ip = "10.0.10.5";
|
||||||
|
# wg-home.endpoint = "uninsane.org:51820";
|
||||||
|
wg-home.endpoint = "97.126.41.123:51820";
|
||||||
lan-ip = "192.168.0.5";
|
lan-ip = "192.168.0.5";
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
|
@ -9,13 +9,9 @@ in
|
||||||
./wifi-pairings.nix
|
./wifi-pairings.nix
|
||||||
];
|
];
|
||||||
|
|
||||||
|
# option is consumed by the other imports in this dir
|
||||||
options.sane.roles.client = mkOption {
|
options.sane.roles.client = mkOption {
|
||||||
type = types.bool;
|
type = types.bool;
|
||||||
default = false;
|
default = false;
|
||||||
};
|
};
|
||||||
|
|
||||||
config = mkIf config.sane.roles.client {
|
|
||||||
sane.services.wg-home.enable = true;
|
|
||||||
sane.services.wg-home.role = "client";
|
|
||||||
};
|
|
||||||
}
|
}
|
||||||
|
|
|
@ -1,8 +1,7 @@
|
||||||
{ config, lib, pkgs, ... }:
|
{ config, lib, pkgs, ... }:
|
||||||
|
|
||||||
let
|
let
|
||||||
inherit (builtins) mapAttrsToList;
|
inherit (lib) mapAttrsToList mkIf mkMerge mkOption optionalAttrs types;
|
||||||
inherit (lib) mkIf mkMerge mkOption optionalAttrs types;
|
|
||||||
cfg = config.sane.services.wg-home;
|
cfg = config.sane.services.wg-home;
|
||||||
server-cfg = config.sane.hosts.by-name."servo".wg-home;
|
server-cfg = config.sane.hosts.by-name."servo".wg-home;
|
||||||
in
|
in
|
||||||
|
@ -12,13 +11,12 @@ in
|
||||||
type = types.bool;
|
type = types.bool;
|
||||||
default = false;
|
default = false;
|
||||||
};
|
};
|
||||||
sane.services.wg-home.role = mkOption {
|
sane.services.wg-home.ip = mkOption {
|
||||||
type = types.enum [ "client" "server" ];
|
type = types.str;
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
config = mkIf cfg.enable (mkMerge [
|
config = mkIf cfg.enable {
|
||||||
{
|
|
||||||
# generate a (deterministic) wireguard private key
|
# generate a (deterministic) wireguard private key
|
||||||
sane.derived-secrets."/run/wg-home.priv" = {
|
sane.derived-secrets."/run/wg-home.priv" = {
|
||||||
len = 32;
|
len = 32;
|
||||||
|
@ -39,46 +37,29 @@ in
|
||||||
gen-key = config.sane.fs."/run/wg-home.priv".unit;
|
gen-key = config.sane.fs."/run/wg-home.priv".unit;
|
||||||
in
|
in
|
||||||
"${pkgs.systemd}/bin/systemctl start '${gen-key}'";
|
"${pkgs.systemd}/bin/systemctl start '${gen-key}'";
|
||||||
};
|
|
||||||
}
|
|
||||||
|
|
||||||
{
|
|
||||||
networking.wireguard.interfaces.wg-home = lib.mkIf (cfg.role == "client") {
|
|
||||||
# client IP (TODO: make host-specific)
|
|
||||||
ips = [ "10.0.10.20/24" ];
|
|
||||||
|
|
||||||
peers = [
|
|
||||||
{
|
|
||||||
# server pubkey
|
|
||||||
publicKey = server-cfg.pubkey;
|
|
||||||
|
|
||||||
# accept traffic from any IP addr on the other side of the tunnel
|
|
||||||
# allowedIPs = [ "0.0.0.0/0" ];
|
|
||||||
allowedIPs = [ "10.0.10.5/32" ];
|
|
||||||
|
|
||||||
# endpoint = "uninsane.org:51820";
|
|
||||||
endpoint = "97.126.41.123:51820";
|
|
||||||
|
|
||||||
# send keepalives every 25 seconds to keep NAT routes live
|
|
||||||
persistentKeepalive = 25;
|
|
||||||
}
|
|
||||||
];
|
|
||||||
};
|
|
||||||
}
|
|
||||||
{
|
|
||||||
networking.wireguard.interfaces.wg-home = lib.mkIf (cfg.role == "server") {
|
|
||||||
ips = [
|
ips = [
|
||||||
"10.0.10.5/24"
|
"${cfg.ip}/24"
|
||||||
];
|
];
|
||||||
|
|
||||||
|
# include all peers -- except for ourself
|
||||||
peers = mapAttrsToList
|
peers = mapAttrsToList
|
||||||
(name: hostcfg:
|
(name: hostcfg:
|
||||||
lib.mkIf (hostcfg.wg-home.ip or server-cfg.ip != server-cfg.ip) {
|
mkIf (hostcfg.wg-home.ip != null && hostcfg.wg-home.ip != cfg.ip) {
|
||||||
publicKey = hostcfg.wg-home.pubkey;
|
publicKey = hostcfg.wg-home.pubkey;
|
||||||
allowedIPs = [ "${hostcfg.wg-home.ip}/32" ];
|
allowedIPs = [ "${hostcfg.wg-home.ip}/32" ];
|
||||||
|
endpoint = lib.mkIf
|
||||||
|
(hostcfg.wg-home.endpoint != null)
|
||||||
|
hostcfg.wg-home.endpoint;
|
||||||
|
|
||||||
|
# send keepalives every 25 seconds to keep NAT routes live.
|
||||||
|
# only need to do this from client -> server though, i think.
|
||||||
|
persistentKeepalive = lib.mkIf
|
||||||
|
(hostcfg.wg-home.endpoint != null)
|
||||||
|
25;
|
||||||
}
|
}
|
||||||
)
|
)
|
||||||
config.sane.hosts.by-name;
|
config.sane.hosts.by-name;
|
||||||
};
|
};
|
||||||
}
|
};
|
||||||
]);
|
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in New Issue
Block a user