colin/nix-files
1
0
Fork 1
Code Issues Pull Requests Projects Releases Wiki Activity

wg-home: unify server and client config

Browse Source
This commit is contained in:
colin 2023-01-20 07:42:31 +00:00
parent 708cb841fe
commit 6a2374e046
5 changed files with 59 additions and 69 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
hosts/by-name/lappy/default.nix
View File

@ -1,10 +1,12 @@
{ pkgs, ... }: { config, pkgs, ... }:
{ {
imports = [ imports = [
./fs.nix ./fs.nix
]; ];
sane.roles.client = true; sane.roles.client = true;
sane.services.wg-home.enable = true;
sane.services.wg-home.ip = config.sane.hosts.by-name."lappy".wg-home.ip;
# sane.packages.enableDevPkgs = true; # sane.packages.enableDevPkgs = true;

5
hosts/by-name/servo/default.nix
View File

@ -1,4 +1,4 @@
{ pkgs, ... }: { config, pkgs, ... }:
{ {
imports = [ imports = [
@ -8,6 +8,9 @@
./secrets.nix ./secrets.nix
./services ./services
]; ];
o
sane.services.wg-home.enable = true;
sane.services.wg-home.ip = config.sane.hosts.by-name."servo".wg-home.ip;
sane.packages.extraUserPkgs = with pkgs; [ sane.packages.extraUserPkgs = with pkgs; [
# for administering services # for administering services

8
hosts/modules/hosts.nix
View File

@ -22,6 +22,7 @@ let
}; };
wg-home.pubkey = mkOption { wg-home.pubkey = mkOption {
type = types.nullOr types.str; type = types.nullOr types.str;
default = null;
description = '' description = ''
wireguard public key for the wg-home VPN. wireguard public key for the wg-home VPN.
e.g. "pWtnKW7f7sNIZQ2M83uJ7cHg3IL1tebE3IoVkCgjkXM=". e.g. "pWtnKW7f7sNIZQ2M83uJ7cHg3IL1tebE3IoVkCgjkXM=".
@ -29,11 +30,16 @@ let
}; };
wg-home.ip = mkOption { wg-home.ip = mkOption {
type = types.nullOr types.str; type = types.nullOr types.str;
default = null;
description = '' description = ''
IP address to use on the wg-home VPN. IP address to use on the wg-home VPN.
e.g. "10.0.10.5"; e.g. "10.0.10.5";
''; '';
}; };
wg-home.endpoint = mkOption {
type = types.nullOr types.str;
default = null;
};
lan-ip = mkOption { lan-ip = mkOption {
type = types.str; type = types.str;
description = '' description = ''
@ -83,6 +89,8 @@ in
ssh.host_pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOfdSmFkrVT6DhpgvFeQKm3Fh9VKZ9DbLYOPOJWYQ0E8"; ssh.host_pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOfdSmFkrVT6DhpgvFeQKm3Fh9VKZ9DbLYOPOJWYQ0E8";
wg-home.pubkey = "roAw+IUFVtdpCcqa4khB385Qcv9l5JAB//730tyK4Wk="; wg-home.pubkey = "roAw+IUFVtdpCcqa4khB385Qcv9l5JAB//730tyK4Wk=";
wg-home.ip = "10.0.10.5"; wg-home.ip = "10.0.10.5";
# wg-home.endpoint = "uninsane.org:51820";
wg-home.endpoint = "97.126.41.123:51820";
lan-ip = "192.168.0.5"; lan-ip = "192.168.0.5";
}; };
}; };

6
hosts/modules/roles/client/default.nix
View File

@ -9,13 +9,9 @@ in
./wifi-pairings.nix ./wifi-pairings.nix
]; ];
# option is consumed by the other imports in this dir
options.sane.roles.client = mkOption { options.sane.roles.client = mkOption {
type = types.bool; type = types.bool;
default = false; default = false;
}; };
config = mkIf config.sane.roles.client {
sane.services.wg-home.enable = true;
sane.services.wg-home.role = "client";
};
} }

105
hosts/modules/wg-home.nix
View File

@ -1,8 +1,7 @@
{ config, lib, pkgs, ... }: { config, lib, pkgs, ... }:
let let
inherit (builtins) mapAttrsToList; inherit (lib) mapAttrsToList mkIf mkMerge mkOption optionalAttrs types;
inherit (lib) mkIf mkMerge mkOption optionalAttrs types;
cfg = config.sane.services.wg-home; cfg = config.sane.services.wg-home;
server-cfg = config.sane.hosts.by-name."servo".wg-home; server-cfg = config.sane.hosts.by-name."servo".wg-home;
in in
@ -12,73 +11,55 @@ in
type = types.bool; type = types.bool;
default = false; default = false;
}; };
sane.services.wg-home.role = mkOption { sane.services.wg-home.ip = mkOption {
type = types.enum [ "client" "server" ]; type = types.str;
}; };
}; };
config = mkIf cfg.enable (mkMerge [ config = mkIf cfg.enable {
{ # generate a (deterministic) wireguard private key
# generate a (deterministic) wireguard private key sane.derived-secrets."/run/wg-home.priv" = {
sane.derived-secrets."/run/wg-home.priv" = { len = 32;
len = 32; encoding = "base64";
encoding = "base64"; };
};
# wireguard VPN which allows everything on my domain to speak to each other even when # wireguard VPN which allows everything on my domain to speak to each other even when
# not behind a shared LAN. # not behind a shared LAN.
# this config defines both the endpoint (server) and client configs # this config defines both the endpoint (server) and client configs
# for convenience, have both the server and client use the same port for their wireguard connections. # for convenience, have both the server and client use the same port for their wireguard connections.
networking.firewall.allowedUDPPorts = [ 51820 ]; networking.firewall.allowedUDPPorts = [ 51820 ];
networking.wireguard.interfaces.wg-home = { networking.wireguard.interfaces.wg-home = {
listenPort = 51820; listenPort = 51820;
privateKeyFile = "/run/wg-home.priv"; privateKeyFile = "/run/wg-home.priv";
preSetup = preSetup =
let let
gen-key = config.sane.fs."/run/wg-home.priv".unit; gen-key = config.sane.fs."/run/wg-home.priv".unit;
in in
"${pkgs.systemd}/bin/systemctl start '${gen-key}'"; "${pkgs.systemd}/bin/systemctl start '${gen-key}'";
};
}
{ ips = [
networking.wireguard.interfaces.wg-home = lib.mkIf (cfg.role == "client") { "${cfg.ip}/24"
# client IP (TODO: make host-specific) ];
ips = [ "10.0.10.20/24" ];
peers = [ # include all peers -- except for ourself
{ peers = mapAttrsToList
# server pubkey (name: hostcfg:
publicKey = server-cfg.pubkey; mkIf (hostcfg.wg-home.ip != null && hostcfg.wg-home.ip != cfg.ip) {
publicKey = hostcfg.wg-home.pubkey;
allowedIPs = [ "${hostcfg.wg-home.ip}/32" ];
endpoint = lib.mkIf
(hostcfg.wg-home.endpoint != null)
hostcfg.wg-home.endpoint;
# accept traffic from any IP addr on the other side of the tunnel # send keepalives every 25 seconds to keep NAT routes live.
# allowedIPs = [ "0.0.0.0/0" ]; # only need to do this from client -> server though, i think.
allowedIPs = [ "10.0.10.5/32" ]; persistentKeepalive = lib.mkIf
(hostcfg.wg-home.endpoint != null)
# endpoint = "uninsane.org:51820"; 25;
endpoint = "97.126.41.123:51820";
# send keepalives every 25 seconds to keep NAT routes live
persistentKeepalive = 25;
} }
]; )
}; config.sane.hosts.by-name;
} };
{ };
networking.wireguard.interfaces.wg-home = lib.mkIf (cfg.role == "server") {
ips = [
"10.0.10.5/24"
];
peers = mapAttrsToList
(name: hostcfg:
lib.mkIf (hostcfg.wg-home.ip or server-cfg.ip != server-cfg.ip) {
publicKey = hostcfg.wg-home.pubkey;
allowedIPs = [ "${hostcfg.wg-home.ip}/32" ];
}
)
config.sane.hosts.by-name;
};
}
]);
} }