diff options
Diffstat (limited to 'nix')
| -rw-r--r-- | nix/deuxfleurs.nix | 47 | ||||
| -rw-r--r-- | nix/wgautomesh.nix | 129 |
2 files changed, 167 insertions, 9 deletions
diff --git a/nix/deuxfleurs.nix b/nix/deuxfleurs.nix index 3a94860..ba8cdfc 100644 --- a/nix/deuxfleurs.nix +++ b/nix/deuxfleurs.nix @@ -28,6 +28,7 @@ in }; endpoint = mkOption { type = nullOr str; + default = null; description = "Wireguard endpoint on the public Internet"; }; lan_endpoint = mkOption { @@ -134,6 +135,10 @@ in }; }; + imports = [ + ./wgautomesh.nix + ]; + config = let node_meta = { "site" = cfg.site_name; @@ -147,6 +152,7 @@ in else {}); in { + # Configure admin accounts on all nodes users.users = builtins.mapAttrs (name: publicKeys: { isNormalUser = true; @@ -233,20 +239,43 @@ in services.resolved.enable = false; # Configure Wireguard VPN between all nodes - systemd.services."wg-quick-wg0".after = [ "unbound.service" ]; - networking.wg-quick.interfaces.wg0 = { - address = [ "${cfg.cluster_ip}/16" ]; + networking.wireguard.interfaces.wg0 = { + ips = [ "${cfg.cluster_ip}/16" ]; listenPort = cfg.wireguard_port; privateKeyFile = "/var/lib/deuxfleurs/wireguard-keys/private"; mtu = 1420; - peers = map ({ publicKey, endpoint, IP, site_name, lan_endpoint, ... }: { - publicKey = publicKey; - allowedIPs = [ "${IP}/32" ]; - endpoint = if site_name != null && site_name == cfg.site_name && lan_endpoint != null - then lan_endpoint else endpoint; - persistentKeepalive = 25; + }; + services.wgautomesh = { + enable = true; + interface = "wg0"; + gossipPort = 1666; + gossipSecretFile = "/var/lib/wgautomesh/gossip_secret"; + persistFile = "/var/lib/wgautomesh/state"; + upnpForwardPublicPort = + let + us = filter ({ hostname, ...}: hostname == config.networking.hostName) cfg.cluster_nodes; + in + if length us > 0 && (head us).endpoint != null then + strings.toInt (lists.last (split ":" (head us).endpoint)) + else null; + peers = map ({ publicKey, endpoint, IP, ... }: { + address = IP; + pubkey = publicKey; + endpoint = endpoint; }) cfg.cluster_nodes; }; + # Old code for wg-quick, we can use this as a fallback if we fail to make wgautomesh work + # systemd.services."wg-quick-wg0".after = [ "unbound.service" ]; + # networking.wg-quick.interfaces.wg0 = { + # address = [ "${cfg.cluster_ip}/16" ]; + # listenPort = cfg.wireguard_port; + # privateKeyFile = "/var/lib/deuxfleurs/wireguard-keys/private"; + # mtu = 1420; + # peers = map ({ publicKey, endpoint, IP, site_name, lan_endpoint, ... }: { + # inherit publicKey endpoint; + # allowedIPs = [ "${IP}/32" ]; + # persistentKeepalive = 25; + # }; system.activationScripts.generate_df_wg_key = '' if [ ! -f /var/lib/deuxfleurs/wireguard-keys/private ]; then diff --git a/nix/wgautomesh.nix b/nix/wgautomesh.nix new file mode 100644 index 0000000..c64c4af --- /dev/null +++ b/nix/wgautomesh.nix @@ -0,0 +1,129 @@ +let + wgautomesh = builtins.fetchTarball { + url = "https://git.deuxfleurs.fr/attachments/ce203833-1ae7-43d4-9bf4-b49b560c9f4b"; + sha256 = "sha256:1kc990s7xkwff53vs6c3slg7ljsyr9xz1i13j61ivfj6djyh8rmj"; + }; +in + +{ lib, config, pkgs, ... }: +with lib; +let + cfg = config.services.wgautomesh; +in + with builtins; + { + options.services.wgautomesh = { + enable = mkEnableOption "wgautomesh"; + logLevel = mkOption { + type = types.enum [ "trace" "debug" "info" "warn" "error" ]; + default = "info"; + description = "wgautomesh log level (trace/debug/info/warn/error)"; + }; + interface = mkOption { + type = types.str; + description = "Wireguard interface to manage"; + }; + gossipPort = mkOption { + type = types.port; + description = "wgautomesh gossip port"; + }; + gossipSecretFile = mkOption { + type = types.nullOr types.str; + description = "File containing the gossip secret encryption key"; + }; + persistFile = mkOption { + type = types.nullOr types.str; + description = "Path where to persist known peer addresses"; + }; + lanDiscovery = mkOption { + type = types.bool; + default = true; + description = "Enable discovery using LAN broadcast"; + }; + openFirewall = mkOption { + type = types.bool; + default = true; + description = "Automatically open gossip port in firewall"; + }; + upnpForwardPublicPort = mkOption { + type = types.nullOr types.port; + default = null; + description = "Public port number to try to redirect to this machine using UPnP IGD"; + }; + peers = mkOption { + type = types.listOf (types.submodule { + options = { + pubkey = mkOption { + type = types.str; + description = "Wireguard public key"; + }; + address = mkOption { + type = types.str; + description = "Wireguard peer address"; + }; + endpoint = mkOption { + type = types.nullOr types.str; + description = "bootstrap endpoint"; + }; + }; + }); + description = "wgautomesh peer list"; + }; + }; + + config = mkIf cfg.enable ( + let + peerDefs = map (peer: + let endpointDef = if peer.endpoint == null then "" + else ''endpoint = "${peer.endpoint}"''; + in + '' + [[peers]] + pubkey = "${peer.pubkey}" + address = "${peer.address}" + ${endpointDef} + '') cfg.peers; + extraDefs = (if cfg.lanDiscovery then ["lan_discovery = true"] else []) + ++ (if (cfg.gossipSecretFile != null) + then [''gossip_secret_file = "${cfg.gossipSecretFile}"''] else []) + ++ (if (cfg.persistFile != null) + then [''persist_file = "${cfg.persistFile}"''] else []) + ++ (if (cfg.upnpForwardPublicPort != null) + then [''upnp_forward_external_port = ${toString cfg.upnpForwardPublicPort}''] else []); + configfile = pkgs.writeText "wgautomesh.toml" '' + interface = "${cfg.interface}" + gossip_port = ${toString cfg.gossipPort} + ${concatStringsSep "\n" extraDefs} + + ${concatStringsSep "\n" peerDefs} + ''; + in { + systemd.services.wgautomesh = { + enable = true; + path = [ pkgs.wireguard-tools ]; + environment = { + RUST_LOG = "wgautomesh=${cfg.logLevel}"; + }; + description = "wgautomesh"; + serviceConfig = { + Type = "simple"; + + ExecStart = "${wgautomesh}/bin/wgautomesh ${configfile}"; + Restart = "always"; + RestartSec = "30"; + + ExecStartPre = [ "+${pkgs.coreutils}/bin/chown wgautomesh /var/lib/wgautomesh/gossip_secret" ]; + + DynamicUser = true; + User = "wgautomesh"; + StateDirectory = "wgautomesh"; + StateDirectoryMode = "0700"; + AmbientCapabilities = "CAP_NET_ADMIN CAP_NET_BIND_SERVICE"; + CapabilityBoundingSet = "CAP_NET_ADMIN CAP_NET_BIND_SERVICE"; + }; + wantedBy = [ "multi-user.target" ]; + }; + networking.firewall.allowedUDPPorts = mkIf cfg.openFirewall [ cfg.gossipPort ]; + }); + } + |