This repository has no description
3.3 kB
113 lines
1{
2 config,
3 lib,
4 pkgs,
5 ...
6}:
7with lib;
8let
9
10 self = config.krebs.build.host.nets.wiregrill;
11 isRouter = !isNull self.via;
12
13in
14mkIf (hasAttr "wiregrill" config.krebs.build.host.nets) {
15 #hack for modprobe inside containers
16 systemd.services."wireguard-wiregrill".path = mkIf config.boot.isContainer (mkBefore [
17 (pkgs.writeDashBin "modprobe" ":")
18 ]);
19
20 boot.kernel.sysctl = mkIf isRouter {
21 "net.ipv6.conf.all.forwarding" = 1;
22 };
23 krebs.iptables.tables.filter.INPUT.rules = [
24 {
25 predicate = "-p udp --dport ${toString self.wireguard.port}";
26 target = "ACCEPT";
27 }
28 ];
29 krebs.iptables.tables.filter.FORWARD.rules = mkIf isRouter (mkBefore [
30 {
31 predicate = "-i wiregrill -o wiregrill";
32 target = "ACCEPT";
33 }
34 {
35 predicate = "-i wiregrill -o retiolum";
36 target = "ACCEPT";
37 }
38 {
39 predicate = "-i retiolum -o wiregrill";
40 target = "ACCEPT";
41 }
42 {
43 predicate = "-i wiregrill -o eth0";
44 target = "ACCEPT";
45 }
46 {
47 predicate = "-o wiregrill -m conntrack --ctstate RELATED,ESTABLISHED";
48 target = "ACCEPT";
49 }
50 ]);
51
52 clan.core.vars.generators.wiregrill = {
53 files."wiregrill.key" = { };
54 files."wiregrill.pub" = { };
55 runtimeInputs = with pkgs; [
56 coreutils
57 wireguard-tools
58 ];
59 script = ''
60 wg genkey > "$out"/wiregrill.key
61 cat "$out"/wiregrill.key | wg pubkey > "$out"/wiregrill.pub
62 '';
63 };
64
65 systemd.network.networks.wiregrill = {
66 matchConfig.Name = "wiregrill";
67 address =
68 (optional (!isNull self.ip4) "${self.ip4.addr}/16")
69 ++ (optional (!isNull self.ip6) "${self.ip6.addr}/48");
70 networkConfig = {
71 IgnoreCarrierLoss = "10s";
72 };
73 };
74
75 networking.wireguard.interfaces.wiregrill = {
76 ips =
77 (optional (!isNull self.ip4 && !config.systemd.network.enable) self.ip4.addr)
78 ++ (optional (!isNull self.ip6 && !config.systemd.network.enable) self.ip6.addr);
79 listenPort = 51820;
80 privateKeyFile = config.clan.core.vars.generators.wiregrill.files."wiregrill.key".path;
81 allowedIPsAsRoutes = true;
82 peers =
83 mapAttrsToList
84 (_name: host: {
85 # inherit name;
86 allowedIPs =
87 if isRouter then
88 (optional (!isNull host.nets.wiregrill.ip4) host.nets.wiregrill.ip4.addr)
89 ++ (optional (!isNull host.nets.wiregrill.ip6) host.nets.wiregrill.ip6.addr)
90 else
91 host.nets.wiregrill.wireguard.subnets;
92 endpoint = mkIf (!isNull host.nets.wiregrill.via) (
93 host.nets.wiregrill.via.ip4.addr + ":${toString host.nets.wiregrill.wireguard.port}"
94 );
95 persistentKeepalive = mkIf (!isNull host.nets.wiregrill.via) 61;
96 publicKey = (replaceStrings [ "\n" ] [ "" ] host.nets.wiregrill.wireguard.pubkey);
97 })
98 (
99 filterAttrs (
100 _: h:
101 hasAttr "wiregrill" h.nets
102 && hasAttr "wireguard" h.nets.wiregrill
103 && !isNull h.nets.wiregrill.wireguard
104 && (
105 let
106 pk = builtins.tryEval h.nets.wiregrill.wireguard.pubkey;
107 in
108 pk.success && !isNull pk.value
109 )
110 ) config.krebs.hosts
111 );
112 };
113}