From baae97b1920d4fb616781bedd6e3d09debe678f0 Mon Sep 17 00:00:00 2001 From: Alex Auvolat Date: Thu, 9 Mar 2023 15:31:05 +0100 Subject: sample deployment of wgautomesh on staging (dont deploy prod with this commit) --- nix/wgautomesh.nix | 107 +++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 107 insertions(+) create mode 100644 nix/wgautomesh.nix (limited to 'nix/wgautomesh.nix') diff --git a/nix/wgautomesh.nix b/nix/wgautomesh.nix new file mode 100644 index 0000000..8812fb3 --- /dev/null +++ b/nix/wgautomesh.nix @@ -0,0 +1,107 @@ +let + src = builtins.fetchGit { + url = "https://git.deuxfleurs.fr/lx/wgautomesh"; + rev = "43eced6e9aa5935b4553251604207f72bf0214c1"; + }; + wgautomesh = (import src).packages.x86_64-linux.default; +in + +{ lib, config, pkgs, ... }: +with lib; +let + cfg = config.services.wgautomesh; +in + with builtins; + { + options.services.wgautomesh = { + enable = mkEnableOption "wgautomesh"; + interface = mkOption { + type = types.str; + description = "Wireguard interface to manage"; + }; + gossipPort = mkOption { + type = types.port; + description = "wgautomesh gossip port"; + }; + lanDiscovery = mkOption { + type = types.bool; + default = true; + description = "Enable discovery using LAN broadcast"; + }; + openFirewall = mkOption { + type = types.bool; + default = true; + description = "Automatically open gossip port in firewall"; + }; + upnpForwardPublicPort = mkOption { + type = types.nullOr types.port; + default = null; + description = "Public port number to try to redirect to this machine using UPnP IGD"; + }; + peers = mkOption { + type = types.listOf (types.submodule { + options = { + pubkey = mkOption { + type = types.str; + description = "Wireguard public key"; + }; + address = mkOption { + type = types.str; + description = "Wireguard peer address"; + }; + endpoint = mkOption { + type = types.nullOr types.str; + description = "bootstrap endpoint"; + }; + }; + }); + description = "wgautomesh peer list"; + }; + }; + + config = mkIf cfg.enable ( + let + peerDefs = map (peer: + let endpointDef = if peer.endpoint == null then "" + else ''endpoint = "${peer.endpoint}"''; + in + '' + [[peers]] + pubkey = "${peer.pubkey}" + address = "${peer.address}" + ${endpointDef} + '') cfg.peers; + extraDefs = (if cfg.lanDiscovery then ["lan_discovery = true"] else []) + ++ (if (cfg.upnpForwardPublicPort != null) + then [''upnp_forward_external_port = ${toString cfg.upnpForwardPublicPort}''] else []); + configfile = pkgs.writeText "wgautomesh.toml" '' + interface = "${cfg.interface}" + gossip_port = ${toString cfg.gossipPort} + + ${concatStringsSep "\n" (extraDefs ++ peerDefs)} + ''; + in { + systemd.services.wgautomesh = { + enable = true; + path = [ pkgs.wireguard-tools ]; + environment = { + RUST_LOG = "wgautomesh=info"; + }; + description = "wgautomesh"; + serviceConfig = { + Type = "simple"; + + ExecStart = "${wgautomesh}/bin/wgautomesh ${configfile}"; + Restart = "always"; + RestartSec = "30"; + + DynamicUser = true; + AmbientCapabilities = "CAP_NET_ADMIN CAP_NET_BIND_SERVICE"; + CapabilityBoundingSet = "CAP_NET_ADMIN CAP_NET_BIND_SERVICE"; + }; + wantedBy = [ "multi-user.target" ]; + }; + networking.firewall.allowedUDPPorts = mkIf cfg.openFirewall [ cfg.gossipPort ]; + }); + } + -- cgit v1.2.3 From 6664affaa0127123d9eeae54128f845246ec7194 Mon Sep 17 00:00:00 2001 From: Alex Auvolat Date: Thu, 9 Mar 2023 16:39:58 +0100 Subject: wgautomesh gossip secret file --- nix/wgautomesh.nix | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) (limited to 'nix/wgautomesh.nix') diff --git a/nix/wgautomesh.nix b/nix/wgautomesh.nix index 8812fb3..c09b874 100644 --- a/nix/wgautomesh.nix +++ b/nix/wgautomesh.nix @@ -23,6 +23,10 @@ in type = types.port; description = "wgautomesh gossip port"; }; + gossipSecretFile = mkOption { + type = types.nullOr types.str; + description = "File containing the gossip secret encryption key"; + }; lanDiscovery = mkOption { type = types.bool; default = true; @@ -72,13 +76,16 @@ in ${endpointDef} '') cfg.peers; extraDefs = (if cfg.lanDiscovery then ["lan_discovery = true"] else []) + ++ (if (cfg.gossipSecretFile != null) + then [''gossip_secret_file = "${cfg.gossipSecretFile}"''] else []) ++ (if (cfg.upnpForwardPublicPort != null) then [''upnp_forward_external_port = ${toString cfg.upnpForwardPublicPort}''] else []); configfile = pkgs.writeText "wgautomesh.toml" '' interface = "${cfg.interface}" gossip_port = ${toString cfg.gossipPort} + ${concatStringsSep "\n" extraDefs} - ${concatStringsSep "\n" (extraDefs ++ peerDefs)} + ${concatStringsSep "\n" peerDefs} ''; in { systemd.services.wgautomesh = { @@ -95,7 +102,12 @@ in Restart = "always"; RestartSec = "30"; + ExecStartPre = [ "+${pkgs.coreutils}/bin/chown wgautomesh /var/lib/wgautomesh/gossip_secret" ]; + DynamicUser = true; + User = "wgautomesh"; + StateDirectory = "wgautomesh"; + StateDirectoryMode = "0700"; AmbientCapabilities = "CAP_NET_ADMIN CAP_NET_BIND_SERVICE"; CapabilityBoundingSet = "CAP_NET_ADMIN CAP_NET_BIND_SERVICE"; }; -- cgit v1.2.3 From bb2660792f2e1dd63bd152b08095d9bf3879d569 Mon Sep 17 00:00:00 2001 From: Alex Auvolat Date: Thu, 9 Mar 2023 17:06:57 +0100 Subject: wgautomesh persist state to file --- nix/wgautomesh.nix | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) (limited to 'nix/wgautomesh.nix') diff --git a/nix/wgautomesh.nix b/nix/wgautomesh.nix index c09b874..0e0b7b3 100644 --- a/nix/wgautomesh.nix +++ b/nix/wgautomesh.nix @@ -1,7 +1,7 @@ let src = builtins.fetchGit { url = "https://git.deuxfleurs.fr/lx/wgautomesh"; - rev = "43eced6e9aa5935b4553251604207f72bf0214c1"; + rev = "65e979de801daa5f6ef77ed875e6505aa902fd9c"; }; wgautomesh = (import src).packages.x86_64-linux.default; in @@ -27,6 +27,10 @@ in type = types.nullOr types.str; description = "File containing the gossip secret encryption key"; }; + persistFile = mkOption { + type = types.nullOr types.str; + description = "Path where to persist known peer addresses"; + }; lanDiscovery = mkOption { type = types.bool; default = true; @@ -78,6 +82,8 @@ in extraDefs = (if cfg.lanDiscovery then ["lan_discovery = true"] else []) ++ (if (cfg.gossipSecretFile != null) then [''gossip_secret_file = "${cfg.gossipSecretFile}"''] else []) + ++ (if (cfg.persistFile != null) + then [''persist_file = "${cfg.persistFile}"''] else []) ++ (if (cfg.upnpForwardPublicPort != null) then [''upnp_forward_external_port = ${toString cfg.upnpForwardPublicPort}''] else []); configfile = pkgs.writeText "wgautomesh.toml" '' -- cgit v1.2.3 From f9b94f0b470aec6f2e8cb1085b11724ca303c221 Mon Sep 17 00:00:00 2001 From: Alex Auvolat Date: Thu, 16 Mar 2023 14:32:18 +0100 Subject: update wgautomesh --- nix/wgautomesh.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'nix/wgautomesh.nix') diff --git a/nix/wgautomesh.nix b/nix/wgautomesh.nix index 0e0b7b3..fd2fe0d 100644 --- a/nix/wgautomesh.nix +++ b/nix/wgautomesh.nix @@ -1,7 +1,7 @@ let src = builtins.fetchGit { url = "https://git.deuxfleurs.fr/lx/wgautomesh"; - rev = "65e979de801daa5f6ef77ed875e6505aa902fd9c"; + rev = "a02cb2bb43935c45a1d3914ed74197d2a85920a0"; }; wgautomesh = (import src).packages.x86_64-linux.default; in -- cgit v1.2.3 From f629f4c17187be0561cd27cd042270c33d2b2d98 Mon Sep 17 00:00:00 2001 From: Alex Auvolat Date: Fri, 17 Mar 2023 18:01:35 +0100 Subject: wgautomesh from static binary hosted on gitea --- nix/wgautomesh.nix | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) (limited to 'nix/wgautomesh.nix') diff --git a/nix/wgautomesh.nix b/nix/wgautomesh.nix index fd2fe0d..e46ad75 100644 --- a/nix/wgautomesh.nix +++ b/nix/wgautomesh.nix @@ -1,9 +1,8 @@ let - src = builtins.fetchGit { - url = "https://git.deuxfleurs.fr/lx/wgautomesh"; - rev = "a02cb2bb43935c45a1d3914ed74197d2a85920a0"; + wgautomesh = builtins.fetchTarball { + url = "https://git.deuxfleurs.fr/attachments/ce203833-1ae7-43d4-9bf4-b49b560c9f4b"; + sha256 = "sha256:1kc990s7xkwff53vs6c3slg7ljsyr9xz1i13j61ivfj6djyh8rmj"; }; - wgautomesh = (import src).packages.x86_64-linux.default; in { lib, config, pkgs, ... }: -- cgit v1.2.3 From 90efd9155b4e2014b75133ff123893fb0478c025 Mon Sep 17 00:00:00 2001 From: Alex Auvolat Date: Fri, 17 Mar 2023 18:21:50 +0100 Subject: wgautomesh variable log level (debug for staging) --- nix/wgautomesh.nix | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) (limited to 'nix/wgautomesh.nix') diff --git a/nix/wgautomesh.nix b/nix/wgautomesh.nix index e46ad75..5a1480c 100644 --- a/nix/wgautomesh.nix +++ b/nix/wgautomesh.nix @@ -14,6 +14,11 @@ in { options.services.wgautomesh = { enable = mkEnableOption "wgautomesh"; + logLevel = mkOption { + type = types.str; + default = "info"; + description = "wgautomesh log level (trace/debug/info/warn/error)"; + }; interface = mkOption { type = types.str; description = "Wireguard interface to manage"; @@ -97,7 +102,7 @@ in enable = true; path = [ pkgs.wireguard-tools ]; environment = { - RUST_LOG = "wgautomesh=info"; + RUST_LOG = "wgautomesh=${cfg.logLevel}"; }; description = "wgautomesh"; serviceConfig = { -- cgit v1.2.3 From 6ffaa0ed91a6e2e4ecec6741677ad9307dcdbab2 Mon Sep 17 00:00:00 2001 From: Alex Auvolat Date: Mon, 20 Mar 2023 11:17:38 +0100 Subject: use nix enum type --- nix/wgautomesh.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'nix/wgautomesh.nix') diff --git a/nix/wgautomesh.nix b/nix/wgautomesh.nix index 5a1480c..c64c4af 100644 --- a/nix/wgautomesh.nix +++ b/nix/wgautomesh.nix @@ -15,7 +15,7 @@ in options.services.wgautomesh = { enable = mkEnableOption "wgautomesh"; logLevel = mkOption { - type = types.str; + type = types.enum [ "trace" "debug" "info" "warn" "error" ]; default = "info"; description = "wgautomesh log level (trace/debug/info/warn/error)"; }; -- cgit v1.2.3 From 53b9cfd8385a4cf60176df02eea7a3804b3891fb Mon Sep 17 00:00:00 2001 From: Alex Auvolat Date: Fri, 24 Mar 2023 12:01:38 +0100 Subject: wgautomesh actually on prod --- nix/wgautomesh.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'nix/wgautomesh.nix') diff --git a/nix/wgautomesh.nix b/nix/wgautomesh.nix index c64c4af..55aa73f 100644 --- a/nix/wgautomesh.nix +++ b/nix/wgautomesh.nix @@ -118,8 +118,8 @@ in User = "wgautomesh"; StateDirectory = "wgautomesh"; StateDirectoryMode = "0700"; - AmbientCapabilities = "CAP_NET_ADMIN CAP_NET_BIND_SERVICE"; - CapabilityBoundingSet = "CAP_NET_ADMIN CAP_NET_BIND_SERVICE"; + AmbientCapabilities = "CAP_NET_ADMIN"; + CapabilityBoundingSet = "CAP_NET_ADMIN"; }; wantedBy = [ "multi-user.target" ]; }; -- cgit v1.2.3