diff options
author | Alex Auvolat <alex@adnab.me> | 2023-03-09 15:31:05 +0100 |
---|---|---|
committer | Alex Auvolat <alex@adnab.me> | 2023-03-17 17:17:56 +0100 |
commit | baae97b1920d4fb616781bedd6e3d09debe678f0 (patch) | |
tree | c297a37031812adec2b48151d6ed7ad6efe9185b /nix | |
parent | 870511931a6b65dddaa726c5d03d068da03f5857 (diff) | |
download | nixcfg-baae97b1920d4fb616781bedd6e3d09debe678f0.tar.gz nixcfg-baae97b1920d4fb616781bedd6e3d09debe678f0.zip |
sample deployment of wgautomesh on staging (dont deploy prod with this commit)
Diffstat (limited to 'nix')
-rw-r--r-- | nix/deuxfleurs.nix | 33 | ||||
-rw-r--r-- | nix/wgautomesh.nix | 107 |
2 files changed, 131 insertions, 9 deletions
diff --git a/nix/deuxfleurs.nix b/nix/deuxfleurs.nix index 3a94860..4de99cf 100644 --- a/nix/deuxfleurs.nix +++ b/nix/deuxfleurs.nix @@ -28,6 +28,7 @@ in }; endpoint = mkOption { type = nullOr str; + default = null; description = "Wireguard endpoint on the public Internet"; }; lan_endpoint = mkOption { @@ -134,6 +135,10 @@ in }; }; + imports = [ + ./wgautomesh.nix + ]; + config = let node_meta = { "site" = cfg.site_name; @@ -147,6 +152,7 @@ in else {}); in { + # Configure admin accounts on all nodes users.users = builtins.mapAttrs (name: publicKeys: { isNormalUser = true; @@ -233,18 +239,27 @@ in services.resolved.enable = false; # Configure Wireguard VPN between all nodes - systemd.services."wg-quick-wg0".after = [ "unbound.service" ]; - networking.wg-quick.interfaces.wg0 = { - address = [ "${cfg.cluster_ip}/16" ]; + networking.wireguard.interfaces.wg0 = { + ips = [ "${cfg.cluster_ip}/16" ]; listenPort = cfg.wireguard_port; privateKeyFile = "/var/lib/deuxfleurs/wireguard-keys/private"; mtu = 1420; - peers = map ({ publicKey, endpoint, IP, site_name, lan_endpoint, ... }: { - publicKey = publicKey; - allowedIPs = [ "${IP}/32" ]; - endpoint = if site_name != null && site_name == cfg.site_name && lan_endpoint != null - then lan_endpoint else endpoint; - persistentKeepalive = 25; + }; + services.wgautomesh = { + enable = true; + interface = "wg0"; + gossipPort = 1666; + upnpForwardPublicPort = + let + us = filter ({ hostname, ...}: hostname == config.networking.hostName) cfg.cluster_nodes; + in + if length us > 0 && (head us).endpoint != null then + strings.toInt (lists.last (split ":" (head us).endpoint)) + else null; + peers = map ({ publicKey, endpoint, IP, ... }: { + address = IP; + pubkey = publicKey; + endpoint = endpoint; }) cfg.cluster_nodes; }; diff --git a/nix/wgautomesh.nix b/nix/wgautomesh.nix new file mode 100644 index 0000000..8812fb3 --- /dev/null +++ b/nix/wgautomesh.nix @@ -0,0 +1,107 @@ +let + src = builtins.fetchGit { + url = "https://git.deuxfleurs.fr/lx/wgautomesh"; + rev = "43eced6e9aa5935b4553251604207f72bf0214c1"; + }; + wgautomesh = (import src).packages.x86_64-linux.default; +in + +{ lib, config, pkgs, ... }: +with lib; +let + cfg = config.services.wgautomesh; +in + with builtins; + { + options.services.wgautomesh = { + enable = mkEnableOption "wgautomesh"; + interface = mkOption { + type = types.str; + description = "Wireguard interface to manage"; + }; + gossipPort = mkOption { + type = types.port; + description = "wgautomesh gossip port"; + }; + lanDiscovery = mkOption { + type = types.bool; + default = true; + description = "Enable discovery using LAN broadcast"; + }; + openFirewall = mkOption { + type = types.bool; + default = true; + description = "Automatically open gossip port in firewall"; + }; + upnpForwardPublicPort = mkOption { + type = types.nullOr types.port; + default = null; + description = "Public port number to try to redirect to this machine using UPnP IGD"; + }; + peers = mkOption { + type = types.listOf (types.submodule { + options = { + pubkey = mkOption { + type = types.str; + description = "Wireguard public key"; + }; + address = mkOption { + type = types.str; + description = "Wireguard peer address"; + }; + endpoint = mkOption { + type = types.nullOr types.str; + description = "bootstrap endpoint"; + }; + }; + }); + description = "wgautomesh peer list"; + }; + }; + + config = mkIf cfg.enable ( + let + peerDefs = map (peer: + let endpointDef = if peer.endpoint == null then "" + else ''endpoint = "${peer.endpoint}"''; + in + '' + [[peers]] + pubkey = "${peer.pubkey}" + address = "${peer.address}" + ${endpointDef} + '') cfg.peers; + extraDefs = (if cfg.lanDiscovery then ["lan_discovery = true"] else []) + ++ (if (cfg.upnpForwardPublicPort != null) + then [''upnp_forward_external_port = ${toString cfg.upnpForwardPublicPort}''] else []); + configfile = pkgs.writeText "wgautomesh.toml" '' + interface = "${cfg.interface}" + gossip_port = ${toString cfg.gossipPort} + + ${concatStringsSep "\n" (extraDefs ++ peerDefs)} + ''; + in { + systemd.services.wgautomesh = { + enable = true; + path = [ pkgs.wireguard-tools ]; + environment = { + RUST_LOG = "wgautomesh=info"; + }; + description = "wgautomesh"; + serviceConfig = { + Type = "simple"; + + ExecStart = "${wgautomesh}/bin/wgautomesh ${configfile}"; + Restart = "always"; + RestartSec = "30"; + + DynamicUser = true; + AmbientCapabilities = "CAP_NET_ADMIN CAP_NET_BIND_SERVICE"; + CapabilityBoundingSet = "CAP_NET_ADMIN CAP_NET_BIND_SERVICE"; + }; + wantedBy = [ "multi-user.target" ]; + }; + networking.firewall.allowedUDPPorts = mkIf cfg.openFirewall [ cfg.gossipPort ]; + }); + } + |