aboutsummaryrefslogtreecommitdiff
path: root/nix
diff options
context:
space:
mode:
authorAlex Auvolat <alex@adnab.me>2023-03-09 15:31:05 +0100
committerAlex Auvolat <alex@adnab.me>2023-03-17 17:17:56 +0100
commitbaae97b1920d4fb616781bedd6e3d09debe678f0 (patch)
treec297a37031812adec2b48151d6ed7ad6efe9185b /nix
parent870511931a6b65dddaa726c5d03d068da03f5857 (diff)
downloadnixcfg-baae97b1920d4fb616781bedd6e3d09debe678f0.tar.gz
nixcfg-baae97b1920d4fb616781bedd6e3d09debe678f0.zip
sample deployment of wgautomesh on staging (dont deploy prod with this commit)
Diffstat (limited to 'nix')
-rw-r--r--nix/deuxfleurs.nix33
-rw-r--r--nix/wgautomesh.nix107
2 files changed, 131 insertions, 9 deletions
diff --git a/nix/deuxfleurs.nix b/nix/deuxfleurs.nix
index 3a94860..4de99cf 100644
--- a/nix/deuxfleurs.nix
+++ b/nix/deuxfleurs.nix
@@ -28,6 +28,7 @@ in
};
endpoint = mkOption {
type = nullOr str;
+ default = null;
description = "Wireguard endpoint on the public Internet";
};
lan_endpoint = mkOption {
@@ -134,6 +135,10 @@ in
};
};
+ imports = [
+ ./wgautomesh.nix
+ ];
+
config =
let node_meta = {
"site" = cfg.site_name;
@@ -147,6 +152,7 @@ in
else {});
in
{
+
# Configure admin accounts on all nodes
users.users = builtins.mapAttrs (name: publicKeys: {
isNormalUser = true;
@@ -233,18 +239,27 @@ in
services.resolved.enable = false;
# Configure Wireguard VPN between all nodes
- systemd.services."wg-quick-wg0".after = [ "unbound.service" ];
- networking.wg-quick.interfaces.wg0 = {
- address = [ "${cfg.cluster_ip}/16" ];
+ networking.wireguard.interfaces.wg0 = {
+ ips = [ "${cfg.cluster_ip}/16" ];
listenPort = cfg.wireguard_port;
privateKeyFile = "/var/lib/deuxfleurs/wireguard-keys/private";
mtu = 1420;
- peers = map ({ publicKey, endpoint, IP, site_name, lan_endpoint, ... }: {
- publicKey = publicKey;
- allowedIPs = [ "${IP}/32" ];
- endpoint = if site_name != null && site_name == cfg.site_name && lan_endpoint != null
- then lan_endpoint else endpoint;
- persistentKeepalive = 25;
+ };
+ services.wgautomesh = {
+ enable = true;
+ interface = "wg0";
+ gossipPort = 1666;
+ upnpForwardPublicPort =
+ let
+ us = filter ({ hostname, ...}: hostname == config.networking.hostName) cfg.cluster_nodes;
+ in
+ if length us > 0 && (head us).endpoint != null then
+ strings.toInt (lists.last (split ":" (head us).endpoint))
+ else null;
+ peers = map ({ publicKey, endpoint, IP, ... }: {
+ address = IP;
+ pubkey = publicKey;
+ endpoint = endpoint;
}) cfg.cluster_nodes;
};
diff --git a/nix/wgautomesh.nix b/nix/wgautomesh.nix
new file mode 100644
index 0000000..8812fb3
--- /dev/null
+++ b/nix/wgautomesh.nix
@@ -0,0 +1,107 @@
+let
+ src = builtins.fetchGit {
+ url = "https://git.deuxfleurs.fr/lx/wgautomesh";
+ rev = "43eced6e9aa5935b4553251604207f72bf0214c1";
+ };
+ wgautomesh = (import src).packages.x86_64-linux.default;
+in
+
+{ lib, config, pkgs, ... }:
+with lib;
+let
+ cfg = config.services.wgautomesh;
+in
+ with builtins;
+ {
+ options.services.wgautomesh = {
+ enable = mkEnableOption "wgautomesh";
+ interface = mkOption {
+ type = types.str;
+ description = "Wireguard interface to manage";
+ };
+ gossipPort = mkOption {
+ type = types.port;
+ description = "wgautomesh gossip port";
+ };
+ lanDiscovery = mkOption {
+ type = types.bool;
+ default = true;
+ description = "Enable discovery using LAN broadcast";
+ };
+ openFirewall = mkOption {
+ type = types.bool;
+ default = true;
+ description = "Automatically open gossip port in firewall";
+ };
+ upnpForwardPublicPort = mkOption {
+ type = types.nullOr types.port;
+ default = null;
+ description = "Public port number to try to redirect to this machine using UPnP IGD";
+ };
+ peers = mkOption {
+ type = types.listOf (types.submodule {
+ options = {
+ pubkey = mkOption {
+ type = types.str;
+ description = "Wireguard public key";
+ };
+ address = mkOption {
+ type = types.str;
+ description = "Wireguard peer address";
+ };
+ endpoint = mkOption {
+ type = types.nullOr types.str;
+ description = "bootstrap endpoint";
+ };
+ };
+ });
+ description = "wgautomesh peer list";
+ };
+ };
+
+ config = mkIf cfg.enable (
+ let
+ peerDefs = map (peer:
+ let endpointDef = if peer.endpoint == null then ""
+ else ''endpoint = "${peer.endpoint}"'';
+ in
+ ''
+ [[peers]]
+ pubkey = "${peer.pubkey}"
+ address = "${peer.address}"
+ ${endpointDef}
+ '') cfg.peers;
+ extraDefs = (if cfg.lanDiscovery then ["lan_discovery = true"] else [])
+ ++ (if (cfg.upnpForwardPublicPort != null)
+ then [''upnp_forward_external_port = ${toString cfg.upnpForwardPublicPort}''] else []);
+ configfile = pkgs.writeText "wgautomesh.toml" ''
+ interface = "${cfg.interface}"
+ gossip_port = ${toString cfg.gossipPort}
+
+ ${concatStringsSep "\n" (extraDefs ++ peerDefs)}
+ '';
+ in {
+ systemd.services.wgautomesh = {
+ enable = true;
+ path = [ pkgs.wireguard-tools ];
+ environment = {
+ RUST_LOG = "wgautomesh=info";
+ };
+ description = "wgautomesh";
+ serviceConfig = {
+ Type = "simple";
+
+ ExecStart = "${wgautomesh}/bin/wgautomesh ${configfile}";
+ Restart = "always";
+ RestartSec = "30";
+
+ DynamicUser = true;
+ AmbientCapabilities = "CAP_NET_ADMIN CAP_NET_BIND_SERVICE";
+ CapabilityBoundingSet = "CAP_NET_ADMIN CAP_NET_BIND_SERVICE";
+ };
+ wantedBy = [ "multi-user.target" ];
+ };
+ networking.firewall.allowedUDPPorts = mkIf cfg.openFirewall [ cfg.gossipPort ];
+ });
+ }
+