diff options
Diffstat (limited to 'nix/deuxfleurs.nix')
| -rw-r--r-- | nix/deuxfleurs.nix | 33 |
1 files changed, 24 insertions, 9 deletions
diff --git a/nix/deuxfleurs.nix b/nix/deuxfleurs.nix index 3a94860..4de99cf 100644 --- a/nix/deuxfleurs.nix +++ b/nix/deuxfleurs.nix @@ -28,6 +28,7 @@ in }; endpoint = mkOption { type = nullOr str; + default = null; description = "Wireguard endpoint on the public Internet"; }; lan_endpoint = mkOption { @@ -134,6 +135,10 @@ in }; }; + imports = [ + ./wgautomesh.nix + ]; + config = let node_meta = { "site" = cfg.site_name; @@ -147,6 +152,7 @@ in else {}); in { + # Configure admin accounts on all nodes users.users = builtins.mapAttrs (name: publicKeys: { isNormalUser = true; @@ -233,18 +239,27 @@ in services.resolved.enable = false; # Configure Wireguard VPN between all nodes - systemd.services."wg-quick-wg0".after = [ "unbound.service" ]; - networking.wg-quick.interfaces.wg0 = { - address = [ "${cfg.cluster_ip}/16" ]; + networking.wireguard.interfaces.wg0 = { + ips = [ "${cfg.cluster_ip}/16" ]; listenPort = cfg.wireguard_port; privateKeyFile = "/var/lib/deuxfleurs/wireguard-keys/private"; mtu = 1420; - peers = map ({ publicKey, endpoint, IP, site_name, lan_endpoint, ... }: { - publicKey = publicKey; - allowedIPs = [ "${IP}/32" ]; - endpoint = if site_name != null && site_name == cfg.site_name && lan_endpoint != null - then lan_endpoint else endpoint; - persistentKeepalive = 25; + }; + services.wgautomesh = { + enable = true; + interface = "wg0"; + gossipPort = 1666; + upnpForwardPublicPort = + let + us = filter ({ hostname, ...}: hostname == config.networking.hostName) cfg.cluster_nodes; + in + if length us > 0 && (head us).endpoint != null then + strings.toInt (lists.last (split ":" (head us).endpoint)) + else null; + peers = map ({ publicKey, endpoint, IP, ... }: { + address = IP; + pubkey = publicKey; + endpoint = endpoint; }) cfg.cluster_nodes; }; |