networking/wireguard/wg-intra.nix

   1 { pkgs, lib, config, hostName, private, ... }:
   2 let
   3   iface = "wg-intra";
   4   hosts = import wg-intra/hosts.nix;
   5   wg = config.networking.wireguard.interfaces.${iface};
   6 in
   7 {
   8 networking.wireguard.interfaces.${iface} = lib.recursiveUpdate
   9   (removeAttrs hosts.${hostName} ["ipv4" "persistentKeepalive" "peer"])
  10   {
  11     peers =
  12       lib.mapAttrsToList (peerName: peer: lib.recursiveUpdate
  13         { persistentKeepalive = hosts.${hostName}.persistentKeepalive or null; }
  14         peer.peer
  15       ) (removeAttrs hosts [hostName]);
  16     privateKeyFile = lib.mkDefault "${private}/${hostName}/wireguard/${iface}/privateKey";
  17
  18     # Set the MTU to a minimum
  19     # (IPv4 requires at least 68 but it's 1280 for IPv6).
  20     # This prevents connections to stall on huge packets,
  21     # or delaying their initializing due to TCP PMTU probing.
  22     postSetup = ''
  23       ip link set dev ${iface} mtu 1280
  24     '';
  25   };
  26 networking.hosts = lib.mkMerge [
  27   (lib.mapAttrs' (hostName: host:
  28     lib.nameValuePair host.ipv4 [ "${hostName}.wg" ]) hosts)
  29   { "${hosts.losurdo.ipv4}" = [
  30     "nix-extracache.losurdo.wg"
  31     "nix-localcache.losurdo.wg"
  32   ]; }
  33 ];
  34 networking.firewall.extraCommands = ''
  35   ip46tables -A nixos-fw -i ${iface} -p tcp -m tcp --dport 22 -j ACCEPT
  36 '' + lib.optionalString (wg.listenPort != null) ''
  37   ip46tables -A nixos-fw -i any -p udp -m udp --dport ${toString wg.listenPort} -j ACCEPT
  38 '';
  39 services.fail2ban.ignoreIP = lib.concatMap
  40   (host: host.peer.allowedIPs)
  41   (lib.attrValues hosts);
  42 }