hosts/aubergine/wireguard.nix

   1 { pkgs, hostName, ... }:
   2 let
   3   peers = import ../../nixos/profiles/wireguard/wg-intra/peers.nix;
   4   network = import ./networking/names-and-numbers.nix;
   5 in
   6 {
   7   systemd.services."wireguard-wg-intra".serviceConfig.LoadCredentialEncrypted = [
   8     "privateKey:${./wireguard/wg-intra/privateKey.cred}"
   9   ];
  10   networking.wireguard.wg-intra.peers = {
  11     mermet.enable = true;
  12     losurdo.enable = true;
  13     oignon.enable = true;
  14     patate.enable = true;
  15   };
  16   # FIXME: this is enough to connect to the LTE router,
  17   # but not enough to connect the wg-intra hosts behind the LTE router.
  18   systemd.services.fix-wireguard-behind-lte = {
  19     after = [ "NetworkManager-wait-online.service" ];
  20     requires = [ "NetworkManager-wait-online.service" ];
  21     wantedBy = [ "network-online.target" ];
  22     #startAt = "*:0/5"; # every 5 min
  23     path = with pkgs; [ iproute2 curl /*gnused socat*/ ];
  24     unitConfig = { StartLimitIntervalSec = 0; };
  25     serviceConfig = {
  26       Type = "simple";
  27       User = "root";
  28       IPAddressAllow = [ peers.mermet.ipv4 ];
  29       RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_NETLINK" ];
  30       ExecStart = pkgs.writeShellScript "fix-wireguard-behind-lte" ''
  31         set -ux
  32         while sleep 300; do
  33           # FIXME: lift mermet's restriction of only one connection at a time
  34           #externalIP=$(socat - TCP:${peers.mermet.ipv4}:${toString peers.mermet.listenPort} |
  35           externalIP=$(curl -s4L https://icanhazip.com)
  36           test -z "''${externalIP-}" ||
  37           ip addr replace "$externalIP"/32 dev ${network.lteIface}
  38         done
  39       '';
  40       Restart = "on-failure";
  41       RestartSec = "30s";
  42     };
  43   };
  44 }