Replace ad-hoc wireguard by wesher on staging cluster

1 files changed, 70 insertions, 67 deletions

diff --git a/nix/deuxfleurs.nix b/nix/deuxfleurs.nix
index 7772f0e..2050776 100644
--- a/nix/deuxfleurs.nix
+++ b/nix/deuxfleurs.nix
@@ -7,37 +7,6 @@ in
   with pkgs.lib;
 {
   options.deuxfleurs = 
-    let wg_node = with types; submodule {
-      options = {
-        hostname = mkOption {
-          type = str;
-          description = "Host name";
-        };
-        site_name = mkOption {
-          type = nullOr str;
-          description = "Site where the node is located";
-          default = null;
-        };
-        IP = mkOption {
-          type = str;
-          description = "IP Address";
-        };
-        publicKey = mkOption {
-          type = str;
-          description = "Public key";
-        };
-        endpoint = mkOption {
-          type = nullOr str;
-          description = "Wireguard endpoint on the public Internet";
-        };
-        lan_endpoint = mkOption {
-          type = nullOr str;
-          description = "Wireguard endpoint for nodes in the same site";
-          default = null;
-        };
-      };
-    };
-  in
   {
     # Parameters for individual nodes
     network_interface = mkOption {
@@ -52,14 +21,28 @@ in
       description = "Prefix length associated with lan_ip";
       type = types.int;
     };
+    ipv6 = mkOption {
+      description = "Public IPv6 address of this node";
+      type = types.str;
+    };
+    ipv6_prefix_length = mkOption {
+      description = "Prefix length associated with ipv6 ip";
+      type = types.int;
+    };
 
-    vpn_ip = mkOption {
-      description = "IP address of this node on the Wireguard VPN";
+    wesher_cluster_prefix = mkOption {
+      description = "IP address prefix for the Wesher overlay network";
       type = types.str;
     };
-    vpn_listen_port = mkOption {
-      description = "Port for incoming Wireguard VPN connections";
-      type = types.port;
+    wesher_cluster_prefix_length = mkOption {
+      description = "IP address prefix length for the Wesher overlay network";
+      type = types.int;
+      default = 16;
+    };
+
+    cluster_ip = mkOption {
+      description = "IP address of this node on the Wesher mesh network";
+      type = types.str;
     };
     is_raft_server = mkOption {
       description = "Make this node a RAFT server for the Nomad and Consul deployments";
@@ -83,14 +66,6 @@ in
       description = "Name of this Deuxfleurs deployment";
       type = types.str;
     };
-    cluster_nodes = mkOption {
-      description = "Nodes that are part of the cluster";
-      type = types.listOf wg_node;
-    };
-    admin_nodes = mkOption {
-      description = "Machines that are part of the Wireguard VPN for administration purposes";
-      type = types.listOf wg_node;
-    };
     admin_accounts = mkOption {
       description = "List of users having an admin account on cluster nodes, maps user names to a list of authorized SSH keys";
       type = types.attrsOf (types.listOf types.str);
@@ -114,32 +89,31 @@ in
           prefixLength = cfg.lan_ip_prefix_length;
         }
       ];
+      ipv6.addresses = [
+        {
+          address = cfg.ipv6;
+          prefixLength = cfg.ipv6_prefix_length;
+        }
+      ];
     };
     networking.defaultGateway = {
       address = cfg.lan_default_gateway;
       interface = cfg.network_interface;
     };
 
-    # Configure Wireguard VPN between all nodes
-    networking.wireguard.interfaces.wg0 = {
-      ips = [ "${cfg.vpn_ip}/16" ];
-      listenPort = cfg.vpn_listen_port;
-      privateKeyFile = "/var/lib/deuxfleurs/wireguard-keys/private";
-      peers = map ({ publicKey, endpoint, IP, site_name, lan_endpoint, ... }: {
-        publicKey = publicKey;
-        allowedIPs = [ "${IP}/32" ];
-        endpoint = if site_name != null && site_name == cfg.site_name && lan_endpoint != null
-                   then lan_endpoint else endpoint;
-        persistentKeepalive = 25;
-      }) (cfg.cluster_nodes ++ cfg.admin_nodes);
+    # wesher overlay network
+    services.wesher = {
+      enable = true;
+      bindAddr = cfg.ipv6;
+      overlayNet = "${cfg.wesher_cluster_prefix}/${toString cfg.wesher_cluster_prefix_length}";
+      interface = "wg0";
+      logLevel = "debug";
     };
 
-    networking.firewall.allowedUDPPorts = [ cfg.vpn_listen_port ];
-
     # Configure /etc/hosts to link all hostnames to their Wireguard IP
-    networking.extraHosts = builtins.concatStringsSep "\n" (map
-      ({ hostname, IP, ...}: "${IP} ${hostname}")
-      (cfg.cluster_nodes ++ cfg.admin_nodes));
+    #networking.extraHosts = builtins.concatStringsSep "\n" (map
+    #  ({ hostname, IP, ...}: "${IP} ${hostname}")
+    #  (cfg.cluster_nodes ++ cfg.admin_nodes));
 
     # Enable Hashicorp Consul & Nomad
     services.consul.enable = true;
@@ -156,14 +130,12 @@ in
         "site" = cfg.site_name;
       };
       ui = true;
-      bind_addr = cfg.vpn_ip;
+      bind_addr = "${cfg.cluster_ip}";
 
       ports.http = -1;
       addresses.https = "0.0.0.0";
       ports.https = 8501;
 
-      retry_join = map (node_info: node_info.IP) cfg.cluster_nodes;
-
       ca_file = "/var/lib/consul/pki/consul-ca.crt";
       cert_file = "/var/lib/consul/pki/consul2022.crt";
       key_file = "/var/lib/consul/pki/consul2022.key";
@@ -185,9 +157,9 @@ in
       region = cfg.cluster_name;
       datacenter = cfg.site_name;
       advertise = {
-        rpc = cfg.vpn_ip;
-        http = cfg.vpn_ip;
-        serf = cfg.vpn_ip;
+        rpc = "${cfg.cluster_ip}";
+        http = "${cfg.cluster_ip}";
+        serf = "${cfg.cluster_ip}";
       };
       consul = {
         address = "localhost:8501";
@@ -227,5 +199,36 @@ in
         }
       ];
     };
+
+    # ---- Firewall config ----
+
+    # Open ports in the firewall.
+    networking.firewall = {
+      enable = true;
+
+      # Allow anyone to connect on SSH port
+      allowedTCPPorts = [
+        (builtins.head ({ openssh.ports = [22]; } // config.services).openssh.ports)
+      ];
+
+      # Allow specific hosts access to specific things in the cluster
+      extraCommands = ''
+        # Allow everything from router (usefull for UPnP/IGD)
+        iptables -A INPUT -s 192.168.1.254 -j ACCEPT
+
+        # Allow docker containers to access all ports
+        iptables -A INPUT -s 172.17.0.0/16 -j ACCEPT
+
+        # Allow other nodes on VPN to access all ports
+        iptables -A INPUT -s ${cfg.wesher_cluster_prefix}/${toString cfg.wesher_cluster_prefix_length} -j ACCEPT
+      '';
+
+      # When stopping firewall, delete all rules that were configured manually above
+      extraStopCommands = ''
+        iptables -D INPUT -s 192.168.1.254 -j ACCEPT
+        iptables -D INPUT -s 172.17.0.0/16 -j ACCEPT
+        iptables -D INPUT -s ${cfg.wesher_cluster_prefix}/${toString cfg.wesher_cluster_prefix_length} -j ACCEPT
+      '';
+    };
   };
 }