Setup wireguard

2022-11-18 23:25:54 +01:00 · 2022-11-18 23:25:54 +01:00 · d6619a35fa
commit d6619a35fa
parent 66e515a419
10 changed files with 216 additions and 46 deletions
--- a/modules/base/network/wireguard.nix
+++ b/modules/base/network/wireguard.nix
@ -0,0 +1,106 @@
+{ config, lib, pkgs, ... }:
+
+let
+  data = {
+    fairphone = {
+      pubkey = "mHAq+2AP1EZdlSZIxA8UCret8EStrR3nEIU2x6NVETE=";
+      ip = "10.240.0.5";
+    };
+    kharbranth = {
+      pubkey = "Zc45PJl+kaa/2GnIs1ObfAmbe640uJ4h1oRn6+qOQHU=";
+      privkeyFile = config.age.secrets."files/wireguard/kharbranth.privkey".path;
+      ip = "10.240.0.3";
+    };
+    kholinar = {
+      pubkey = "oRA22ymFeNQBeRx6Jyd6Gd8EOUpAv9QSFkGs+Br7yEk=";
+      privkeyFile = config.age.secrets."files/wireguard/kholinar.privkey".path;
+      ip = "10.240.0.4";
+    };
+    lasting-integrity = {
+      pubkey = "mid3XfCY2jaNK0J6C9ltFLAbxL0IApwMw9K1Z+PU8C0=";
+      privkeyFile = config.age.secrets."files/wireguard/lasting-integrity.privkey".path;
+      ip = "10.240.0.1";
+    };
+    urithiru = {
+      pubkey = "f4bnm/qNhMW5iXdQcBMmP8IUN6n+pDS15Ikct7QPr0E=";
+      privkeyFile = config.age.secrets."files/wireguard/urithiru.privkey".path;
+      ip = "10.240.0.2";
+    };
+  };
+  subnet = "10.240.0.0/24";
+  pskFile = config.age.secrets."files/wireguard/psk".path;
+in
+{
+  options.chvp.base.network.wireguard = {
+    server = lib.mkOption {
+      default = false;
+      example = true;
+    };
+  };
+  config = {
+    networking.firewall.allowedUDPPorts = lib.optional config.chvp.base.network.wireguard.server 51820;
+    networking.firewall.trustedInterfaces = [ "wg0" ];
+    boot.kernel.sysctl = lib.mkIf config.chvp.base.network.wireguard.server { "net.ipv4.ip_forward" = 1; };
+    systemd.network = {
+      netdevs.wg0 = {
+        enable = true;
+        netdevConfig = {
+          Name = "wg0";
+          Kind = "wireguard";
+        };
+        wireguardConfig =
+          if config.chvp.base.network.wireguard.server then {
+            PrivateKeyFile = data.${config.networking.hostName}.privkeyFile;
+            ListenPort = 51820;
+          } else {
+            PrivateKeyFile = data.${config.networking.hostName}.privkeyFile;
+          };
+        wireguardPeers =
+          if config.chvp.base.network.wireguard.server then
+            (builtins.map
+              (name: {
+                wireguardPeerConfig = {
+                  PublicKey = data.${name}.pubkey;
+                  AllowedIPs = "${data.${name}.ip}/32";
+                  PresharedKeyFile = pskFile;
+                };
+              })
+              (builtins.filter (name: name != config.networking.hostName) (builtins.attrNames data)))
+          else
+            ([{
+              wireguardPeerConfig = {
+                PublicKey = data.lasting-integrity.pubkey;
+                AllowedIPs = subnet;
+                Endpoint = "lasting-integrity.vanpetegem.me:51820";
+                PresharedKeyFile = pskFile;
+                PersistentKeepalive = 25;
+              };
+            }]);
+      };
+      networks.wg0 = {
+        enable = true;
+        name = "wg0";
+        address = [ "${data.${config.networking.hostName}.ip}/32" ];
+        routes = [{
+          routeConfig =
+            if config.chvp.base.network.wireguard.server then {
+              Gateway = "${data.${config.networking.hostName}.ip}";
+              Destination = subnet;
+            } else {
+              Gateway = "${data.lasting-integrity.ip}";
+              Destination = subnet;
+              GatewayOnLink = true;
+            };
+        }];
+      };
+    };
+    age.secrets."files/wireguard/psk" = {
+      file = ../../../secrets/files/wireguard/psk.age;
+      owner = "systemd-network";
+    };
+    age.secrets."files/wireguard/${config.networking.hostName}.privkey" = {
+      file = ../../../secrets/files/wireguard + "/${config.networking.hostName}.privkey.age";
+      owner = "systemd-network";
+    };
+  };
+}