summaryrefslogtreecommitdiff
path: root/modules/wg
diff options
context:
space:
mode:
Diffstat (limited to 'modules/wg')
-rw-r--r--modules/wg/default.nix3
-rw-r--r--modules/wg/mgmt.nix20
-rw-r--r--modules/wg/module.nix85
-rw-r--r--modules/wg/options.nix141
4 files changed, 148 insertions, 101 deletions
diff --git a/modules/wg/default.nix b/modules/wg/default.nix
index cab721b..82c1179 100644
--- a/modules/wg/default.nix
+++ b/modules/wg/default.nix
@@ -1,4 +1,5 @@
-{ ... }: {
+{ ... }:
+{
imports = [
# module
./module.nix
diff --git a/modules/wg/mgmt.nix b/modules/wg/mgmt.nix
index 33f483e..64a55fd 100644
--- a/modules/wg/mgmt.nix
+++ b/modules/wg/mgmt.nix
@@ -4,11 +4,17 @@
oxalab.wg = [
{
networkName = "0xa-mgmt";
- CIDRs = [ "10.89.87.0/24" "fd31:185d:722e::/48" ];
+ CIDRs = [
+ "10.89.87.0/24"
+ "fd31:185d:722e::/48"
+ ];
hosts = {
"cloud" = {
- address = [ "10.89.87.1/24" "fd31:185d:722e::1/48" ];
+ address = [
+ "10.89.87.1/24"
+ "fd31:185d:722e::1/48"
+ ];
publicKey = "zKSaw+SXzWgi/T7ByXHqPk1XNXXapoQYB8UPMTRmhm0=";
privateKeyFile = config.sops.secrets."wg/0xa-mgmt".path;
endpoint = {
@@ -20,12 +26,18 @@
};
"toaster" = {
- address = [ "10.89.87.100/24" "fd31:185d:722e::100/48" ];
+ address = [
+ "10.89.87.100/24"
+ "fd31:185d:722e::100/48"
+ ];
publicKey = "H+WeYIBdX7ZHwkgm4BGnF0HF0JULkxyNMcvCviHhmks=";
privateKeyFile = config.sops.secrets."wg/0xa-mgmt".path;
};
"minime" = {
- address = [ "10.89.87.10/24" "fd31:185d:722e::10/48" ];
+ address = [
+ "10.89.87.10/24"
+ "fd31:185d:722e::10/48"
+ ];
publicKey = "zN2Dr/ZGMh1Ftparszp22Qnbz2ISJU12iDVatebOHUE=";
privateKeyFile = config.sops.secrets."wg/0xa-mgmt".path;
};
diff --git a/modules/wg/module.nix b/modules/wg/module.nix
index 84575c7..c27f325 100644
--- a/modules/wg/module.nix
+++ b/modules/wg/module.nix
@@ -1,8 +1,11 @@
-{ lib
-, config
-, self
-, registry
-, ... }: {
+{
+ lib,
+ config,
+ self,
+ registry,
+ ...
+}:
+{
config =
let
@@ -17,10 +20,20 @@
name = "30-wg-${net.networkName}";
value = {
matchConfig.Name = "wg-${net.networkName}";
- networkConfig = {
- Address = net.hosts.${currenthost}.address;
- IPv6AcceptRA = false; # for now static IPv6
- } // (if net.hosts.${currenthost}.endpoint.enable then {IPv4Forwarding=true; IPv6Forwarding=true; } else {});
+ networkConfig =
+ {
+ Address = net.hosts.${currenthost}.address;
+ IPv6AcceptRA = false; # for now static IPv6
+ }
+ // (
+ if net.hosts.${currenthost}.endpoint.enable then
+ {
+ IPv4Forwarding = true;
+ IPv6Forwarding = true;
+ }
+ else
+ { }
+ );
};
}) networks;
@@ -45,8 +58,7 @@
wireguardPeers =
let
endpoint = lib.attrsets.filterAttrs (_k: v: v.endpoint.enable) net.hosts;
- wg-peers-attrs = lib.attrsets.mapAttrs (_k: v:
- {
+ wg-peers-attrs = lib.attrsets.mapAttrs (_k: v: {
PersistentKeepalive = 29;
PublicKey = v.publicKey;
Endpoint = "${v.endpoint.endpoint}:${toString v.endpoint.port}";
@@ -55,19 +67,24 @@
wg-peers = lib.attrsets.attrValues wg-peers-attrs;
in
wg-peers;
- };
- }) net-client;
- netdev-client = builtins.listToAttrs netdev-client-list;
+ };
+ }) net-client;
+ netdev-client = builtins.listToAttrs netdev-client-list;
- maskip = (net: hostattrs:
- if hostattrs.endpoint.enable then hostattrs.address else map (baseaddr:
- if lib.strings.hasInfix "." baseaddr then "${baseaddr}/32" else "${baseaddr}/128"
- ) (map (addr: builtins.elemAt (lib.strings.splitString "/" addr) 0) hostattrs.address));
+ maskip = (
+ net: hostattrs:
+ if hostattrs.endpoint.enable then
+ hostattrs.address
+ else
+ map (baseaddr: if lib.strings.hasInfix "." baseaddr then "${baseaddr}/32" else "${baseaddr}/128") (
+ map (addr: builtins.elemAt (lib.strings.splitString "/" addr) 0) hostattrs.address
+ )
+ );
# endpoint
# TODO: this requires bit more logic for allowedIPs if we have more then
# 2 endpoints e.g. for routing client -> endpoint1 -> endpoint2 ->
# client2
- netdev-endpoint-list = map (net: {
+ netdev-endpoint-list = map (net: {
name = "30-wg-${net.networkName}";
value = {
netdevConfig = {
@@ -79,19 +96,27 @@
wireguardPeers =
let
peers = lib.attrsets.filterAttrs (k: _v: k != currenthost) net.hosts;
- wg-peers-attrs = lib.attrsets.mapAttrs (_k: v:
- {
- PersistentKeepalive = 29;
- PublicKey = v.publicKey;
- # only route to /32 or /128, i.e. single client
- AllowedIPs = maskip net v;
- } // (if !isNull v.endpoint.endpoint then { Endpoint = "${v.endpoint.endpoint}:${toString v.endpoint.port}"; } else {})) peers;
+ wg-peers-attrs = lib.attrsets.mapAttrs (
+ _k: v:
+ {
+ PersistentKeepalive = 29;
+ PublicKey = v.publicKey;
+ # only route to /32 or /128, i.e. single client
+ AllowedIPs = maskip net v;
+ }
+ // (
+ if !isNull v.endpoint.endpoint then
+ { Endpoint = "${v.endpoint.endpoint}:${toString v.endpoint.port}"; }
+ else
+ { }
+ )
+ ) peers;
wg-peers = lib.attrsets.attrValues wg-peers-attrs;
in
wg-peers;
- };
- }) net-endpoint;
- netdev-endpoint = builtins.listToAttrs netdev-endpoint-list;
+ };
+ }) net-endpoint;
+ netdev-endpoint = builtins.listToAttrs netdev-endpoint-list;
in
{
@@ -102,4 +127,4 @@
systemd.network.networks = systemd-networks;
systemd.network.netdevs = netdev-client // netdev-endpoint;
};
- }
+}
diff --git a/modules/wg/options.nix b/modules/wg/options.nix
index 4f090d0..56fd964 100644
--- a/modules/wg/options.nix
+++ b/modules/wg/options.nix
@@ -1,79 +1,88 @@
-{ lib
-, ...}:
{
- options.oxalab.wg = with lib;
- lib.mkOption {
- default = [];
- type = types.listOf (types.submodule {
- options = {
- # general network stuff
- networkName = mkOption {
- type = types.nullOr types.str;
- default = null;
- };
- CIDRs = mkOption {
- type = types.nullOr (types.listOf types.str);
- default = null;
- };
-
- hosts = mkOption {
- default = {};
- type = types.attrsOf (types.submodule {
- options = {
-
- enable = mkOption {
- type = types.bool;
- default = true;
- };
- address = mkOption {
- type = types.listOf types.str;
- default = null;
- };
- publicKey = mkOption {
- type = types.str;
- default = null;
- };
- privateKeyFile = mkOption {
- type = types.path;
- default = null;
- };
-
- endpoint.enable = mkOption {
- type = types.bool;
- default = false;
- };
- endpoint.endpoint = mkOption {
- type = types.nullOr types.str;
- default = null;
- };
- endpoint.port = mkOption {
- type = types.nullOr types.int;
- default = null;
- };
- endpoint.publicIface = mkOption {
- type = types.nullOr types.str;
- default = null;
- };
+ lib,
+ ...
+}:
+{
+ options.oxalab.wg =
+ with lib;
+ lib.mkOption {
+ default = [ ];
+ type = types.listOf (
+ types.submodule {
+ options = {
+ # general network stuff
+ networkName = mkOption {
+ type = types.nullOr types.str;
+ default = null;
+ };
+ CIDRs = mkOption {
+ type = types.nullOr (types.listOf types.str);
+ default = null;
+ };
- endpoint.extraPeers = mkOption {
- default = [];
- type = types.listOf (types.submodule {
+ hosts = mkOption {
+ default = { };
+ type = types.attrsOf (
+ types.submodule {
options = {
+
+ enable = mkOption {
+ type = types.bool;
+ default = true;
+ };
address = mkOption {
type = types.listOf types.str;
- default = [];
+ default = null;
};
publicKey = mkOption {
+ type = types.str;
+ default = null;
+ };
+ privateKeyFile = mkOption {
+ type = types.path;
+ default = null;
+ };
+
+ endpoint.enable = mkOption {
+ type = types.bool;
+ default = false;
+ };
+ endpoint.endpoint = mkOption {
type = types.nullOr types.str;
default = null;
};
+ endpoint.port = mkOption {
+ type = types.nullOr types.int;
+ default = null;
+ };
+ endpoint.publicIface = mkOption {
+ type = types.nullOr types.str;
+ default = null;
+ };
+
+ endpoint.extraPeers = mkOption {
+ default = [ ];
+ type = types.listOf (
+ types.submodule {
+ options = {
+ address = mkOption {
+ type = types.listOf types.str;
+ default = [ ];
+ };
+ publicKey = mkOption {
+ type = types.nullOr types.str;
+ default = null;
+ };
+ };
+ }
+ );
+ };
};
- });
- };
+ }
+ );
};
- });
- };
- };
- });
- };
+ };
+ }
+ );
+ };
}
generated by cgit v1.3.1 (git 2.54.0) at 2026-07-28 04:12:33 +0000