aboutsummaryrefslogtreecommitdiff
path: root/nix/deuxfleurs.nix
diff options
context:
space:
mode:
Diffstat (limited to 'nix/deuxfleurs.nix')
-rw-r--r--nix/deuxfleurs.nix54
1 files changed, 39 insertions, 15 deletions
diff --git a/nix/deuxfleurs.nix b/nix/deuxfleurs.nix
index 3a94860..f7b70d7 100644
--- a/nix/deuxfleurs.nix
+++ b/nix/deuxfleurs.nix
@@ -28,12 +28,8 @@ in
};
endpoint = mkOption {
type = nullOr str;
- description = "Wireguard endpoint on the public Internet";
- };
- lan_endpoint = mkOption {
- type = nullOr str;
- description = "Wireguard endpoint for nodes in the same site";
default = null;
+ description = "Wireguard endpoint on the public Internet";
};
};
};
@@ -134,6 +130,10 @@ in
};
};
+ imports = [
+ ./wgautomesh.nix
+ ];
+
config =
let node_meta = {
"site" = cfg.site_name;
@@ -147,6 +147,7 @@ in
else {});
in
{
+
# Configure admin accounts on all nodes
users.users = builtins.mapAttrs (name: publicKeys: {
isNormalUser = true;
@@ -233,20 +234,43 @@ in
services.resolved.enable = false;
# Configure Wireguard VPN between all nodes
- systemd.services."wg-quick-wg0".after = [ "unbound.service" ];
- networking.wg-quick.interfaces.wg0 = {
- address = [ "${cfg.cluster_ip}/16" ];
+ networking.wireguard.interfaces.wg0 = {
+ ips = [ "${cfg.cluster_ip}/16" ];
listenPort = cfg.wireguard_port;
privateKeyFile = "/var/lib/deuxfleurs/wireguard-keys/private";
mtu = 1420;
- peers = map ({ publicKey, endpoint, IP, site_name, lan_endpoint, ... }: {
- publicKey = publicKey;
- allowedIPs = [ "${IP}/32" ];
- endpoint = if site_name != null && site_name == cfg.site_name && lan_endpoint != null
- then lan_endpoint else endpoint;
- persistentKeepalive = 25;
+ };
+ services.wgautomesh = {
+ enable = true;
+ interface = "wg0";
+ gossipPort = 1666;
+ gossipSecretFile = "/var/lib/wgautomesh/gossip_secret";
+ persistFile = "/var/lib/wgautomesh/state";
+ upnpForwardPublicPort =
+ let
+ us = filter ({ hostname, ...}: hostname == config.networking.hostName) cfg.cluster_nodes;
+ in
+ if length us > 0 && (head us).endpoint != null then
+ strings.toInt (lists.last (split ":" (head us).endpoint))
+ else null;
+ peers = map ({ publicKey, endpoint, IP, ... }: {
+ address = IP;
+ pubkey = publicKey;
+ endpoint = endpoint;
}) cfg.cluster_nodes;
};
+ # Old code for wg-quick, we can use this as a fallback if we fail to make wgautomesh work
+ # systemd.services."wg-quick-wg0".after = [ "unbound.service" ];
+ # networking.wg-quick.interfaces.wg0 = {
+ # address = [ "${cfg.cluster_ip}/16" ];
+ # listenPort = cfg.wireguard_port;
+ # privateKeyFile = "/var/lib/deuxfleurs/wireguard-keys/private";
+ # mtu = 1420;
+ # peers = map ({ publicKey, endpoint, IP, ... }: {
+ # inherit publicKey endpoint;
+ # allowedIPs = [ "${IP}/32" ];
+ # persistentKeepalive = 25;
+ # };
system.activationScripts.generate_df_wg_key = ''
if [ ! -f /var/lib/deuxfleurs/wireguard-keys/private ]; then
@@ -303,7 +327,7 @@ in
services.nomad.enable = true;
systemd.services.nomad.after = [ "wg-quick-wg0.service" ];
- services.nomad.package = pkgs.nomad_1_3;
+ services.nomad.package = pkgs.nomad_1_4;
services.nomad.extraPackages = [
pkgs.glibc
pkgs.zstd