hosts/aubergine/wireguard/wg-intra.nix

   1 { hostName, ... }:
   2 let
   3   peers = import ../../../nixos/profiles/wireguard/wg-intra/peers.nix;
   4   network = import ../networking/names-and-numbers.nix;
   5 in
   6 {
   7   networking.wireguard.wg-intra.peers = {
   8     mermet.enable = true;
   9     losurdo.enable = true;
  10     oignon.enable = true;
  11     patate.enable = true;
  12   };
  13   systemd.services.fix-wireguard-behind-lte = {
  14     wantedBy = [ "multi-user.target" ];
  15     startAt = "*:0/5"; # every 5 min
  16     path = with pkgs; [ gnused iproute2 socat ];
  17     serviceConfig = {
  18       Type = "simple";
  19       ExecStart = pkgs.writeShellScript "fix-wireguard-behind-lte" ''
  20         set -eux
  21         ip addr replace "$(socat - TCP:mermet.wg:${peers.mermet.listenPort} | sed -ne 's/^${peers.${hostName}.peer.publicKey}\s\([^:]*\):.*/\1/p')"/32 dev ${network.lteIface}
  22       '';
  23       Restart = "on-failure";
  24       RestartSec = "30s";
  25     };
  26   };
  27 }