This repository has no description
2.9 kB
97 lines
1{
2 config,
3 lib,
4 pkgs,
5 ...
6}:
7with lib;
8let
9
10 self = config.krebs.build.host.nets.wiregrill;
11 isRouter = !isNull self.via;
12
13in
14mkIf (hasAttr "wiregrill" config.krebs.build.host.nets) {
15 #hack for modprobe inside containers
16 systemd.services."wireguard-wiregrill".path = mkIf config.boot.isContainer (mkBefore [
17 (pkgs.writeDashBin "modprobe" ":")
18 ]);
19
20 boot.kernel.sysctl = mkIf isRouter {
21 "net.ipv6.conf.all.forwarding" = 1;
22 };
23 krebs.iptables.tables.filter.INPUT.rules = [
24 {
25 predicate = "-p udp --dport ${toString self.wireguard.port}";
26 target = "ACCEPT";
27 }
28 ];
29 krebs.iptables.tables.filter.FORWARD.rules = mkIf isRouter (mkBefore [
30 {
31 predicate = "-i wiregrill -o wiregrill";
32 target = "ACCEPT";
33 }
34 {
35 predicate = "-i wiregrill -o retiolum";
36 target = "ACCEPT";
37 }
38 {
39 predicate = "-i retiolum -o wiregrill";
40 target = "ACCEPT";
41 }
42 {
43 predicate = "-i wiregrill -o eth0";
44 target = "ACCEPT";
45 }
46 {
47 predicate = "-o wiregrill -m conntrack --ctstate RELATED,ESTABLISHED";
48 target = "ACCEPT";
49 }
50 ]);
51
52 clanCore.facts.services.wiregrill = {
53 secret."wiregrill.key" = { };
54 public."wiregrill.pub" = { };
55 generator.path = with pkgs; [
56 coreutils
57 wireguard-tools
58 ];
59 generator.script = ''
60 wg genkey > "$secrets"/wiregrill.key
61 cat "$secrets"/wiregrill.key | wg pubkey > "$facts"/wiregrill.pub
62 '';
63 };
64
65 systemd.network.networks.wiregrill = {
66 matchConfig.Name = "wiregrill";
67 address =
68 (optional (!isNull self.ip4) "${self.ip4.addr}/16")
69 ++ (optional (!isNull self.ip6) "${self.ip6.addr}/48");
70 networkConfig = {
71 IgnoreCarrierLoss = "10s";
72 };
73 };
74
75 networking.wireguard.interfaces.wiregrill = {
76 ips =
77 (optional (!isNull self.ip4 && !config.systemd.network.enable) self.ip4.addr)
78 ++ (optional (!isNull self.ip6 && !config.systemd.network.enable) self.ip6.addr);
79 listenPort = 51820;
80 privateKeyFile = "${config.krebs.secret.directory}/wiregrill.key";
81 allowedIPsAsRoutes = true;
82 peers = mapAttrsToList (_name: host: {
83 # inherit name;
84 allowedIPs =
85 if isRouter then
86 (optional (!isNull host.nets.wiregrill.ip4) host.nets.wiregrill.ip4.addr)
87 ++ (optional (!isNull host.nets.wiregrill.ip6) host.nets.wiregrill.ip6.addr)
88 else
89 host.nets.wiregrill.wireguard.subnets;
90 endpoint = mkIf (!isNull host.nets.wiregrill.via) (
91 host.nets.wiregrill.via.ip4.addr + ":${toString host.nets.wiregrill.wireguard.port}"
92 );
93 persistentKeepalive = mkIf (!isNull host.nets.wiregrill.via) 61;
94 publicKey = (replaceStrings [ "\n" ] [ "" ] host.nets.wiregrill.wireguard.pubkey);
95 }) (filterAttrs (_: h: hasAttr "wiregrill" h.nets) config.krebs.hosts);
96 };
97}