]> Git — Sourcephile - julm/julm-nix.git/blob - nixos/profiles/wireguard/wg-intra.nix
aubergine: add julm to networkmanager
[julm/julm-nix.git] / nixos / profiles / wireguard / wg-intra.nix
1 { pkgs, lib, config, hostName, credentials, ... }:
2 let
3 wgIface = "wg-intra";
4 peers = import wg-intra/peers.nix;
5 wg = config.networking.wireguard.interfaces.${wgIface};
6 in
7 {
8 # Each peer select the other peers allowed to connect to it
9 options.networking.wireguard.${wgIface}.peers =
10 lib.genAttrs (lib.attrNames peers) (peerName: {
11 enable = lib.mkEnableOption "this peer";
12 });
13 config = {
14 systemd.services."wireguard-${wgIface}".serviceConfig.LoadCredentialEncrypted = "privateKey:${credentials}/wireguard/${wgIface}/privateKey.secret";
15 networking.wireguard.interfaces.${wgIface} = lib.recursiveUpdate
16 (removeAttrs peers.${hostName} ["ipv4" "persistentKeepalive" "peer"])
17 {
18 peers =
19 lib.mapAttrsToList (peerName: peer:
20 lib.recursiveUpdate
21 {
22 persistentKeepalive =
23 peer.persistentKeepalive # Useful if this peer is behind a NAT
24 or peers.${hostName}.persistentKeepalive # Useful if this host is behind a NAT
25 or null;
26 }
27 peer.peer)
28 (removeAttrs
29 (lib.filterAttrs (peerName: _: config.networking.wireguard.${wgIface}.peers.${peerName}.enable) peers)
30 [hostName]);
31 privateKeyFile = "$CREDENTIALS_DIRECTORY/privateKey";
32
33 # Set the MTU to a minimum
34 # (IPv4 requires at least 68 but it's 1280 for IPv6).
35 # This prevents connections to stall on huge packets,
36 # or delaying their initializing due to TCP PMTU probing.
37 postSetup = ''
38 ip link set dev ${wgIface} mtu 1280
39 '';
40 };
41 networking.hosts = lib.mkMerge [
42 (lib.mapAttrs' (hostName: host:
43 lib.nameValuePair host.ipv4 [ "${hostName}.wg" ]) peers)
44 {
45 "${peers.losurdo.ipv4}" = [
46 "nix-extracache.losurdo.wg"
47 "nix-localcache.losurdo.wg"
48 "sftp.losurdo.wg"
49 ];
50 }
51 ];
52 networking.firewall.extraCommands = lib.optionalString (wg.listenPort != null) ''
53 ip46tables -A nixos-fw -i any -p udp -m udp --dport ${toString wg.listenPort} -j ACCEPT
54 '';
55
56 networking.nftables.ruleset = lib.optionalString (wg.listenPort != null) ''
57 table inet filter {
58 chain input-lan {
59 udp dport ${toString wg.listenPort} counter accept comment "Wireguard ${wgIface} input from peers"
60 }
61 chain input-net {
62 udp dport ${toString wg.listenPort} counter accept comment "Wireguard ${wgIface} input from peers"
63 }
64 chain input-intra {
65 ${lib.optionalString (peers.${hostName}.peer.endpointsUpdater.enable or false) ''
66 tcp dport ${toString peers.${hostName}.listenPort} ip daddr ${peers.${hostName}.ipv4} counter accept comment "Wireguard ${wgIface} from peers to endpointUpdater"
67 ''
68 }
69 }
70 chain input {
71 iifname ${wgIface} jump input-intra
72 iifname ${wgIface} log level warn prefix "input-intra: " counter drop
73 }
74
75 chain output-lan {
76 udp sport ${toString wg.listenPort} counter accept comment "Wireguard ${wgIface} output to peers"
77 }
78 chain output-net {
79 udp sport ${toString wg.listenPort} counter accept comment "Wireguard ${wgIface} output to peers"
80 }
81 chain output-intra {
82 ${lib.concatStringsSep "\n"
83 (lib.mapAttrsToList (peerName: peer: ''
84 tcp dport ${toString peer.listenPort} ip daddr ${peer.ipv4} counter accept comment "Wireguard ${wgIface} to endpointUpdater ${peerName}"
85 '')
86 (lib.filterAttrs (peerName: peer:
87 config.networking.wireguard.${wgIface}.peers.${peerName}.enable &&
88 (peers.${peerName}.peer.endpointsUpdater.enable or false))
89 peers))
90 }
91 }
92 chain output {
93 oifname ${wgIface} jump output-intra
94 oifname ${wgIface} log level warn prefix "output-intra: " counter drop
95 }
96 }
97 '';
98
99 services.fail2ban.ignoreIP = lib.concatMap
100 (host: host.peer.allowedIPs)
101 (lib.attrValues peers);
102 networking.networkmanager.unmanaged = [ wgIface ];
103 systemd.services.sshd.after = ["wireguard-${wgIface}.service"];
104 };
105 }