]> Git — Sourcephile - julm/julm-nix.git/blob - nixos/profiles/wireguard/wg-intra.nix
irssi: add #bluehats
[julm/julm-nix.git] / nixos / profiles / wireguard / wg-intra.nix
1 { pkgs, lib, config, hostName, private, ... }:
2 let
3 iface = "wg-intra";
4 peers = import wg-intra/peers.nix;
5 wg = config.networking.wireguard.interfaces.${iface};
6 in
7 {
8 options.networking.wireguard.${iface}.peers =
9 lib.genAttrs (lib.attrNames peers) (peerName: {
10 enable = lib.mkEnableOption "this peer";
11 });
12 config = {
13 networking.wireguard.interfaces.${iface} = lib.recursiveUpdate
14 (removeAttrs peers.${hostName} ["ipv4" "persistentKeepalive" "peer"])
15 {
16 peers =
17 lib.mapAttrsToList (peerName: peer:
18 lib.recursiveUpdate
19 {
20 persistentKeepalive =
21 peer.persistentKeepalive # Useful if this peer is behind a NAT
22 or peers.${hostName}.persistentKeepalive # Useful if this host is behind a NAT
23 or null;
24 }
25 peer.peer)
26 (removeAttrs
27 (lib.filterAttrs (peerName: _: config.networking.wireguard.${iface}.peers.${peerName}.enable) peers)
28 [hostName]);
29 privateKeyFile = lib.mkDefault "${private}/${hostName}/wireguard/${iface}/privateKey";
30
31 # Set the MTU to a minimum
32 # (IPv4 requires at least 68 but it's 1280 for IPv6).
33 # This prevents connections to stall on huge packets,
34 # or delaying their initializing due to TCP PMTU probing.
35 postSetup = ''
36 ip link set dev ${iface} mtu 1280
37 '';
38 };
39 networking.hosts = lib.mkMerge [
40 (lib.mapAttrs' (hostName: host:
41 lib.nameValuePair host.ipv4 [ "${hostName}.wg" ]) peers)
42 {
43 "${peers.losurdo.ipv4}" = [
44 "nix-extracache.losurdo.wg"
45 "nix-localcache.losurdo.wg"
46 "sftp.losurdo.wg"
47 ];
48 }
49 ];
50 networking.firewall.extraCommands = lib.optionalString (wg.listenPort != null) ''
51 ip46tables -A nixos-fw -i any -p udp -m udp --dport ${toString wg.listenPort} -j ACCEPT
52 '';
53 services.fail2ban.ignoreIP = lib.concatMap
54 (host: host.peer.allowedIPs)
55 (lib.attrValues peers);
56 };
57 }