nixos/profiles/wireguard/wg-intra.nix

   1 { pkgs, lib, config, hostName, private, ... }:
   2 let
   3   iface = "wg-intra";
   4   peers = import wg-intra/peers.nix;
   5   wg = config.networking.wireguard.interfaces.${iface};
   6 in
   7 {
   8 options.networking.wireguard.${iface}.peers =
   9   lib.genAttrs (lib.attrNames peers) (peerName: {
  10     enable = lib.mkEnableOption "this peer";
  11   });
  12 config = {
  13 networking.wireguard.interfaces.${iface} = lib.recursiveUpdate
  14   (removeAttrs peers.${hostName} ["ipv4" "persistentKeepalive" "peer"])
  15   {
  16     peers =
  17       lib.mapAttrsToList (peerName: peer:
  18         lib.recursiveUpdate
  19           {
  20             persistentKeepalive =
  21               peer.persistentKeepalive # Useful if this peer is behind a NAT
  22               or peers.${hostName}.persistentKeepalive # Useful if this host is behind a NAT
  23               or null;
  24           }
  25           peer.peer)
  26         (removeAttrs
  27           (lib.filterAttrs (peerName: _: config.networking.wireguard.${iface}.peers.${peerName}.enable) peers)
  28           [hostName]);
  29     privateKeyFile = lib.mkDefault "${private}/${hostName}/wireguard/${iface}/privateKey";
  30
  31     # Set the MTU to a minimum
  32     # (IPv4 requires at least 68 but it's 1280 for IPv6).
  33     # This prevents connections to stall on huge packets,
  34     # or delaying their initializing due to TCP PMTU probing.
  35     postSetup = ''
  36       ip link set dev ${iface} mtu 1280
  37     '';
  38   };
  39 networking.hosts = lib.mkMerge [
  40   (lib.mapAttrs' (hostName: host:
  41     lib.nameValuePair host.ipv4 [ "${hostName}.wg" ]) peers)
  42   {
  43     "${peers.losurdo.ipv4}" = [
  44       "nix-extracache.losurdo.wg"
  45       "nix-localcache.losurdo.wg"
  46       "sftp.losurdo.wg"
  47     ];
  48   }
  49 ];
  50 networking.firewall.extraCommands = lib.optionalString (wg.listenPort != null) ''
  51   ip46tables -A nixos-fw -i any -p udp -m udp --dport ${toString wg.listenPort} -j ACCEPT
  52 '';
  53 services.fail2ban.ignoreIP = lib.concatMap
  54   (host: host.peer.allowedIPs)
  55   (lib.attrValues peers);
  56 };
  57 }