Skip to content

Commit ecbcd2d

Browse files
pinpoxpinpox
committed
Use new wireguard module
1 parent 3f55510 commit ecbcd2d

File tree

15 files changed

+104
-350
lines changed

15 files changed

+104
-350
lines changed

‎clan-service-modules/wireguard.nix‎

Lines changed: 53 additions & 89 deletions
Original file line numberDiff line numberDiff line change
@@ -1,47 +1,35 @@
1-
# TODO add assertions like this:
2-
# perMachine = { instances }:
3-
# # ...
4-
# instanceNames = builtins.attrNames instances;
5-
# # .....
6-
# assertions =
7-
# [
8-
# {
9-
# assertion = builtins.length instanceNames == 1;
10-
# message = "The zerotier module currently only supports one instance per machine, but found ${builtins.toString instanceNames} on machine ${config.clan.core.settings.machine.name}";
11-
# }
12-
# ]
13-
# # TODO: remove this assertion once we start verifying constraints again
14-
# ++ (lib.mapAttrsToList (_instanceName: instance: {
15-
# assertion = builtins.length (lib.attrNames instance.roles.controller.machines) == 1;
16-
# message = "ZeroTier only supports one controller per network";
17-
# }) instances);
18-
191
{ lib, ... }:
202
{
213
_class = "clan.service";
224
manifest.name = "wireguard";
235

24-
# Define what roles exist
6+
# Peer options and configuration
257
roles.peer = {
8+
269
interface = {
2710

28-
# These options can be set via 'roles.client.settings'
2911
options.ip = lib.mkOption {
3012
type = lib.types.str;
31-
# default = "0.0.0.0";
3213
example = "192.168.8.1";
3314
description = ''
3415
IP address of the host.
3516
'';
3617
};
18+
19+
options.extraIPs = lib.mkOption {
20+
type = lib.types.listOf lib.types.str;
21+
default = [];
22+
example = [ "192.168.2.0/24" ];
23+
description = ''
24+
IP address of the host.
25+
'';
26+
};
3727
};
3828

39-
# Maps over all instances and produces one result per instance.
4029
perInstance =
4130
{
4231
instanceName,
4332
settings,
44-
machine,
4533
roles,
4634
...
4735
}:
@@ -51,50 +39,37 @@
5139
nixosModule =
5240
{ config, ... }:
5341
{
54-
55-
networking.wireguard.interfaces =
56-
let
57-
# Get all controller names:
58-
allControllerNames = (lib.attrNames roles.controller.machines);
59-
in
60-
{
61-
62-
"${instanceName}" = {
63-
64-
ips = [ "${settings.ip}/24" ];
65-
66-
peers = map (name: {
67-
68-
# Public key of the server (not a file path).
69-
publicKey = (
70-
builtins.readFile (
71-
config.clan.core.settings.directory
72-
+ "/vars/per-machine/${name}/wireguard-${instanceName}/publickey/value"
73-
)
74-
);
75-
76-
# Don't forward all the traffic via VPN, only particular subnets
77-
allowedIPs = [ "192.168.8.0/24" ];
78-
79-
# Server IP and port.
80-
endpoint = roles.controller.machines."${name}".settings.endpoint;
81-
82-
# Send keepalives every 25 seconds. Important to keep NAT tables
83-
# alive.
84-
persistentKeepalive = 25;
85-
86-
}) allControllerNames;
87-
};
42+
networking.wireguard.interfaces = {
43+
"${instanceName}" = {
44+
ips = [ "${settings.ip}/24" ];
45+
peers = map (name: {
46+
# Public key of the server
47+
publicKey = (
48+
builtins.readFile (
49+
config.clan.core.settings.directory
50+
+ "/vars/per-machine/${name}/wireguard-${instanceName}/publickey/value"
51+
)
52+
);
53+
54+
# Don't forward all the traffic via VPN, only particular subnets
55+
allowedIPs = [ "192.168.8.0/24" ];
56+
57+
# Server IP and port
58+
endpoint = roles.controller.machines."${name}".settings.endpoint;
59+
60+
# Send keepalives every 25 seconds to keep NAT tables alive
61+
persistentKeepalive = 25;
62+
63+
}) (lib.attrNames roles.controller.machines);
8864
};
65+
};
8966
};
9067
};
9168
};
9269

70+
# Controller options and configuration
9371
roles.controller = {
9472
interface = {
95-
# These options can be set via 'roles.server.settings'
96-
# options.dynamicIp.enable =with lib; mkOption { type = bool; };
97-
9873
options.endpoint = lib.mkOption {
9974
type = lib.types.str;
10075
example = "vpn.pablo.tools:51820";
@@ -143,7 +118,7 @@
143118
allowedIPs = [
144119
# TODO we might want to add extra ip's here, e.g. for birne?
145120
roles.peer.machines."${peer}".settings.ip
146-
];
121+
] ++ roles.peer.machines."${peer}".settings.extraIPs;
147122

148123
persistentKeepalive = 25;
149124
}) (lib.attrNames roles.peer.machines);
@@ -153,43 +128,32 @@
153128
};
154129
};
155130

156-
# Maps over all machines and produces one result per machine.
131+
# Maps over all machines and produces one result per machine, regardless of role
157132
perMachine =
133+
{ instances, ... }:
158134
{
159-
instances,
160-
machine,
161-
# instanceName,
162-
...
163-
}:
164-
{
165-
# Analog to 'perSystem' of flake-parts.
166-
# For every machine of this service we will add exactly one nixosModule to a machine
167135
nixosModule =
168136
{ config, pkgs, ... }:
169137
{
170138

139+
# Generate keys for each instance of the host
140+
clan.core.vars.generators = lib.mapAttrs' (
141+
name: value:
142+
lib.nameValuePair ("wireguard-" + name) {
143+
files.publickey.secret = false;
144+
files.privatekey = { };
145+
runtimeInputs = with pkgs; [ wireguard-tools ];
146+
script = ''
147+
wg genkey > $out/privatekey
148+
wg pubkey < $out/privatekey > $out/publickey
149+
'';
150+
}
151+
) instances;
152+
153+
# Set the private key for each instance
171154
networking.wireguard.interfaces = builtins.mapAttrs (name: _: {
172155
privateKeyFile = "${config.clan.core.vars.generators."wireguard-${name}".files."privatekey".path}";
173156
}) instances;
174-
175-
clan.core.vars.generators =
176-
177-
# mapAttrs' (name: value: nameValuePair ("foo_" + name) ("bar-" + value))
178-
# { x = "a"; y = "b"; }
179-
# => { foo_x = "bar-a"; foo_y = "bar-b"; }
180-
181-
lib.mapAttrs' (
182-
name: value:
183-
lib.nameValuePair ("wireguard-" + name) {
184-
files.publickey.secret = false;
185-
files.privatekey = { };
186-
runtimeInputs = with pkgs; [ wireguard-tools ];
187-
script = ''
188-
wg genkey > $out/privatekey
189-
wg pubkey < $out/privatekey > $out/publickey
190-
'';
191-
}
192-
) instances;
193157
};
194158
};
195159
}

‎flake.nix‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -185,12 +185,16 @@
185185
endpoint = "vpn.pablo.tools:51820";
186186
};
187187

188-
roles.peer.machines.kartoffel.settings.ip = "192.168.8.3";
189-
roles.peer.machines.limette.settings.ip = "192.168.8.8";
190-
roles.peer.machines.porree.settings.ip = "192.168.8.1";
188+
roles.peer.machines = {
189+
kartoffel.settings.ip = "192.168.8.3";
190+
limette.settings.ip = "192.168.8.8";
191+
# porree.settings.ip = "192.168.8.1";
192+
kfbox.settings.ip = "192.168.8.5";
193+
birne.settings.ip = "192.168.8.4";
194+
birne.settings.extraIPs = [ "192.168.2.0/24" ];
195+
};
191196

192197
# roles.peer.tags.all = { };
193-
# roles.peer.settings.peerFileText = "CLIENT";
194198
};
195199
};
196200

‎machines/birne/configuration.nix‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -34,11 +34,6 @@
3434
home-assistant.enable = true;
3535
};
3636

37-
wg-client = {
38-
enable = true;
39-
clientIp = "192.168.7.4";
40-
};
41-
4237
defaults = {
4338
lvm-grub.enable = true;
4439
environment.enable = true;

‎machines/kartoffel/README.md‎

Lines changed: 0 additions & 60 deletions
This file was deleted.

‎machines/kartoffel/configuration.nix‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,6 @@
1111

1212
pinpox.desktop = {
1313
enable = true;
14-
wireguardIp = "192.168.7.3";
1514
hostname = "kartoffel";
1615
};
1716

‎machines/kfbox/configuration.nix‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -87,11 +87,6 @@ in
8787
stateVersion = "22.05";
8888
};
8989

90-
wg-client = {
91-
enable = true;
92-
clientIp = "192.168.7.5";
93-
};
94-
9590
services = {
9691
# TODO Add miniflux and vikunja to dex
9792
# TODO Remove gitea apps

‎machines/limette/configuration.nix‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,6 @@
3232

3333
pinpox.desktop = {
3434
enable = true;
35-
wireguardIp = "192.168.7.8";
3635
hostname = "limette";
3736
};
3837

0 commit comments

Comments
 (0)