sample deployment of wgautomesh on staging (dont deploy prod with this commit)

2 files changed, 131 insertions, 9 deletions

diff --git a/nix/deuxfleurs.nix b/nix/deuxfleurs.nix
index 3a94860..4de99cf 100644
--- a/nix/deuxfleurs.nix
+++ b/nix/deuxfleurs.nix
@@ -28,6 +28,7 @@ in
         };
         endpoint = mkOption {
           type = nullOr str;
+          default = null;
           description = "Wireguard endpoint on the public Internet";
         };
         lan_endpoint = mkOption {
@@ -134,6 +135,10 @@ in
     };
   };
 
+  imports = [
+      ./wgautomesh.nix
+    ];
+
   config =
     let node_meta = {
         "site" = cfg.site_name;
@@ -147,6 +152,7 @@ in
         else {});
     in
   {
+
     # Configure admin accounts on all nodes
     users.users = builtins.mapAttrs (name: publicKeys: {
       isNormalUser = true;
@@ -233,18 +239,27 @@ in
     services.resolved.enable = false;
 
     # Configure Wireguard VPN between all nodes
-    systemd.services."wg-quick-wg0".after = [ "unbound.service" ];
-    networking.wg-quick.interfaces.wg0 = {
-      address = [ "${cfg.cluster_ip}/16" ];
+    networking.wireguard.interfaces.wg0 = {
+      ips = [ "${cfg.cluster_ip}/16" ];
       listenPort = cfg.wireguard_port;
       privateKeyFile = "/var/lib/deuxfleurs/wireguard-keys/private";
       mtu = 1420;
-      peers = map ({ publicKey, endpoint, IP, site_name, lan_endpoint, ... }: {
-        publicKey = publicKey;
-        allowedIPs = [ "${IP}/32" ];
-        endpoint = if site_name != null && site_name == cfg.site_name && lan_endpoint != null
-                   then lan_endpoint else endpoint;
-        persistentKeepalive = 25;
+    };
+    services.wgautomesh = {
+      enable = true;
+      interface = "wg0";
+      gossipPort = 1666;
+      upnpForwardPublicPort = 
+        let
+          us = filter ({ hostname, ...}: hostname == config.networking.hostName) cfg.cluster_nodes;
+        in
+        if length us > 0 && (head us).endpoint != null then
+          strings.toInt (lists.last (split ":" (head us).endpoint))
+        else null;
+      peers = map ({ publicKey, endpoint, IP, ... }: {
+        address = IP;
+        pubkey = publicKey;
+        endpoint = endpoint;
       }) cfg.cluster_nodes;
     };
 
diff --git a/nix/wgautomesh.nix b/nix/wgautomesh.nix
new file mode 100644
index 0000000..8812fb3
--- /dev/null
+++ b/nix/wgautomesh.nix
@@ -0,0 +1,107 @@
+let
+  src = builtins.fetchGit {
+    url = "https://git.deuxfleurs.fr/lx/wgautomesh";
+    rev = "43eced6e9aa5935b4553251604207f72bf0214c1";
+  };
+  wgautomesh = (import src).packages.x86_64-linux.default;
+in
+
+{ lib, config, pkgs, ... }:
+with lib;
+let 
+  cfg = config.services.wgautomesh;
+in
+  with builtins;
+  {
+    options.services.wgautomesh = {
+      enable = mkEnableOption "wgautomesh";
+      interface = mkOption {
+        type = types.str;
+        description = "Wireguard interface to manage";
+      };
+      gossipPort = mkOption {
+        type = types.port;
+        description = "wgautomesh gossip port";
+      };
+      lanDiscovery = mkOption {
+        type = types.bool;
+        default = true;
+        description = "Enable discovery using LAN broadcast";
+      };
+      openFirewall = mkOption {
+        type = types.bool;
+        default = true;
+        description = "Automatically open gossip port in firewall";
+      };
+      upnpForwardPublicPort = mkOption {
+        type = types.nullOr types.port;
+        default = null;
+        description = "Public port number to try to redirect to this machine using UPnP IGD";
+      };
+      peers = mkOption {
+        type = types.listOf (types.submodule {
+          options = {
+            pubkey = mkOption {
+              type = types.str;
+              description = "Wireguard public key";
+            };
+            address = mkOption {
+              type = types.str;
+              description = "Wireguard peer address";
+            };
+            endpoint = mkOption {
+              type = types.nullOr types.str;
+              description = "bootstrap endpoint";
+            };
+          };
+        });
+        description = "wgautomesh peer list";
+      };
+    };
+
+    config = mkIf cfg.enable ( 
+    let
+      peerDefs = map (peer:
+        let endpointDef = if peer.endpoint == null then ""
+        else ''endpoint = "${peer.endpoint}"'';
+        in
+        ''
+          [[peers]]
+          pubkey = "${peer.pubkey}"
+          address = "${peer.address}"
+          ${endpointDef}
+        '') cfg.peers;
+      extraDefs = (if cfg.lanDiscovery then ["lan_discovery = true"] else [])
+        ++ (if (cfg.upnpForwardPublicPort != null)
+          then [''upnp_forward_external_port = ${toString cfg.upnpForwardPublicPort}''] else []);
+      configfile = pkgs.writeText "wgautomesh.toml" ''
+        interface = "${cfg.interface}"
+        gossip_port = ${toString cfg.gossipPort}
+
+        ${concatStringsSep "\n" (extraDefs ++ peerDefs)}
+        '';
+    in {
+      systemd.services.wgautomesh = {
+        enable = true;
+        path = [ pkgs.wireguard-tools ];
+        environment = {
+          RUST_LOG = "wgautomesh=info";
+        };
+        description = "wgautomesh";
+        serviceConfig = {
+          Type = "simple";
+
+          ExecStart = "${wgautomesh}/bin/wgautomesh ${configfile}";
+          Restart = "always";
+          RestartSec = "30";
+
+          DynamicUser = true;
+          AmbientCapabilities = "CAP_NET_ADMIN CAP_NET_BIND_SERVICE";
+          CapabilityBoundingSet = "CAP_NET_ADMIN CAP_NET_BIND_SERVICE";
+        };
+        wantedBy = [ "multi-user.target" ];
+      };
+      networking.firewall.allowedUDPPorts = mkIf cfg.openFirewall [ cfg.gossipPort ];
+    });
+  }
+