This repository has no description
3.0 kB
103 lines
1{
2 config,
3 lib,
4 pkgs,
5 ...
6}:
7with lib;
8let
9
10 self = config.krebs.build.host.nets.wiregrill;
11 isRouter = !isNull self.via;
12
13in
14mkIf (hasAttr "wiregrill" config.krebs.build.host.nets) {
15 #hack for modprobe inside containers
16 systemd.services."wireguard-wiregrill".path = mkIf config.boot.isContainer (mkBefore [
17 (pkgs.writeDashBin "modprobe" ":")
18 ]);
19
20 boot.kernel.sysctl = mkIf isRouter {
21 "net.ipv6.conf.all.forwarding" = 1;
22 };
23 krebs.iptables.tables.filter.INPUT.rules = [
24 {
25 predicate = "-p udp --dport ${toString self.wireguard.port}";
26 target = "ACCEPT";
27 }
28 ];
29 krebs.iptables.tables.filter.FORWARD.rules = mkIf isRouter (mkBefore [
30 {
31 predicate = "-i wiregrill -o wiregrill";
32 target = "ACCEPT";
33 }
34 {
35 predicate = "-i wiregrill -o retiolum";
36 target = "ACCEPT";
37 }
38 {
39 predicate = "-i retiolum -o wiregrill";
40 target = "ACCEPT";
41 }
42 {
43 predicate = "-i wiregrill -o eth0";
44 target = "ACCEPT";
45 }
46 {
47 predicate = "-o wiregrill -m conntrack --ctstate RELATED,ESTABLISHED";
48 target = "ACCEPT";
49 }
50 ]);
51
52 clan.core.vars.generators.wiregrill = {
53 files."wiregrill.key" = { };
54 files."wiregrill.pub" = { };
55 migrateFact = "wiregrill";
56 runtimeInputs = with pkgs; [
57 coreutils
58 wireguard-tools
59 ];
60 script = ''
61 wg genkey > "$out"/wiregrill.key
62 cat "$out"/wiregrill.key | wg pubkey > "$out"/wiregrill.pub
63 '';
64 };
65
66 systemd.network.networks.wiregrill = {
67 matchConfig.Name = "wiregrill";
68 address =
69 (optional (!isNull self.ip4) "${self.ip4.addr}/16")
70 ++ (optional (!isNull self.ip6) "${self.ip6.addr}/48");
71 networkConfig = {
72 IgnoreCarrierLoss = "10s";
73 };
74 };
75
76 networking.wireguard.interfaces.wiregrill = {
77 ips =
78 (optional (!isNull self.ip4 && !config.systemd.network.enable) self.ip4.addr)
79 ++ (optional (!isNull self.ip6 && !config.systemd.network.enable) self.ip6.addr);
80 listenPort = 51820;
81 privateKeyFile = config.clan.core.vars.generators.wiregrill.files."wiregrill.key".path;
82 allowedIPsAsRoutes = true;
83 peers = mapAttrsToList (_name: host: {
84 # inherit name;
85 allowedIPs =
86 if isRouter then
87 (optional (!isNull host.nets.wiregrill.ip4) host.nets.wiregrill.ip4.addr)
88 ++ (optional (!isNull host.nets.wiregrill.ip6) host.nets.wiregrill.ip6.addr)
89 else
90 host.nets.wiregrill.wireguard.subnets;
91 endpoint = mkIf (!isNull host.nets.wiregrill.via) (
92 host.nets.wiregrill.via.ip4.addr + ":${toString host.nets.wiregrill.wireguard.port}"
93 );
94 persistentKeepalive = mkIf (!isNull host.nets.wiregrill.via) 61;
95 publicKey = (replaceStrings [ "\n" ] [ "" ] host.nets.wiregrill.wireguard.pubkey);
96 }) (filterAttrs (_: h:
97 hasAttr "wiregrill" h.nets
98 && hasAttr "wireguard" h.nets.wiregrill
99 && !isNull h.nets.wiregrill.wireguard
100 && !isNull h.nets.wiregrill.wireguard.pubkey
101 ) config.krebs.hosts);
102 };
103}