Merge pull request 'Passer wgautomesh en prod' (#9) from wgautomesh into main

Reviewed-on: https://git.deuxfleurs.fr/Deuxfleurs/nixcfg/pulls/9

1 files changed, 39 insertions, 15 deletions

diff --git a/nix/deuxfleurs.nix b/nix/deuxfleurs.nix
index 3a94860..f7b70d7 100644
--- a/nix/deuxfleurs.nix
+++ b/nix/deuxfleurs.nix
@@ -28,12 +28,8 @@ in
         };
         endpoint = mkOption {
           type = nullOr str;
-          description = "Wireguard endpoint on the public Internet";
-        };
-        lan_endpoint = mkOption {
-          type = nullOr str;
-          description = "Wireguard endpoint for nodes in the same site";
           default = null;
+          description = "Wireguard endpoint on the public Internet";
         };
       };
     };
@@ -134,6 +130,10 @@ in
     };
   };
 
+  imports = [
+      ./wgautomesh.nix
+    ];
+
   config =
     let node_meta = {
         "site" = cfg.site_name;
@@ -147,6 +147,7 @@ in
         else {});
     in
   {
+
     # Configure admin accounts on all nodes
     users.users = builtins.mapAttrs (name: publicKeys: {
       isNormalUser = true;
@@ -233,20 +234,43 @@ in
     services.resolved.enable = false;
 
     # Configure Wireguard VPN between all nodes
-    systemd.services."wg-quick-wg0".after = [ "unbound.service" ];
-    networking.wg-quick.interfaces.wg0 = {
-      address = [ "${cfg.cluster_ip}/16" ];
+    networking.wireguard.interfaces.wg0 = {
+      ips = [ "${cfg.cluster_ip}/16" ];
       listenPort = cfg.wireguard_port;
       privateKeyFile = "/var/lib/deuxfleurs/wireguard-keys/private";
       mtu = 1420;
-      peers = map ({ publicKey, endpoint, IP, site_name, lan_endpoint, ... }: {
-        publicKey = publicKey;
-        allowedIPs = [ "${IP}/32" ];
-        endpoint = if site_name != null && site_name == cfg.site_name && lan_endpoint != null
-                   then lan_endpoint else endpoint;
-        persistentKeepalive = 25;
+    };
+    services.wgautomesh = {
+      enable = true;
+      interface = "wg0";
+      gossipPort = 1666;
+      gossipSecretFile = "/var/lib/wgautomesh/gossip_secret";
+      persistFile = "/var/lib/wgautomesh/state";
+      upnpForwardPublicPort = 
+        let
+          us = filter ({ hostname, ...}: hostname == config.networking.hostName) cfg.cluster_nodes;
+        in
+        if length us > 0 && (head us).endpoint != null then
+          strings.toInt (lists.last (split ":" (head us).endpoint))
+        else null;
+      peers = map ({ publicKey, endpoint, IP, ... }: {
+        address = IP;
+        pubkey = publicKey;
+        endpoint = endpoint;
       }) cfg.cluster_nodes;
     };
+    # Old code for wg-quick, we can use this as a fallback if we fail to make wgautomesh work
+    # systemd.services."wg-quick-wg0".after = [ "unbound.service" ];
+    # networking.wg-quick.interfaces.wg0 = {
+    #   address = [ "${cfg.cluster_ip}/16" ];
+    #   listenPort = cfg.wireguard_port;
+    #   privateKeyFile = "/var/lib/deuxfleurs/wireguard-keys/private";
+    #   mtu = 1420;
+    #   peers = map ({ publicKey, endpoint, IP, ... }: {
+    #     inherit publicKey endpoint;
+    #     allowedIPs = [ "${IP}/32" ];
+    #     persistentKeepalive = 25;
+    # };
 
     system.activationScripts.generate_df_wg_key = ''
       if [ ! -f /var/lib/deuxfleurs/wireguard-keys/private ]; then
@@ -303,7 +327,7 @@ in
 
     services.nomad.enable = true;
     systemd.services.nomad.after = [ "wg-quick-wg0.service" ];
-    services.nomad.package = pkgs.nomad_1_3;
+    services.nomad.package = pkgs.nomad_1_4;
     services.nomad.extraPackages = [
       pkgs.glibc
       pkgs.zstd