aubergine: add wwan tools

[julm/julm-nix.git] / nixos / profiles / wireguard / wg-intra.nix

diff --git a/nixos/profiles/wireguard/wg-intra.nix b/nixos/profiles/wireguard/wg-intra.nix
index 47fe251024b05c47cbe4ff5a096ea6537768568e..bbb9ee6ad05c81e0cf4f22a354061b710731782b 100644 (file)
--- a/nixos/profiles/wireguard/wg-intra.nix
+++ b/nixos/profiles/wireguard/wg-intra.nix
@@ -1,16 +1,18 @@
-{ pkgs, lib, config, hostName, private, ... }:
+{ pkgs, lib, config, hostName, credentials, ... }:
 let
-  iface = "wg-intra";
+  wgIface = "wg-intra";
   peers = import wg-intra/peers.nix;
-  wg = config.networking.wireguard.interfaces.${iface};
+  wg = config.networking.wireguard.interfaces.${wgIface};
 in
 {
-options.networking.wireguard.${iface}.peers =
+# Each peer select the other peers allowed to connect to it
+options.networking.wireguard.${wgIface}.peers =
   lib.genAttrs (lib.attrNames peers) (peerName: {
     enable = lib.mkEnableOption "this peer";
   });
 config = {
-networking.wireguard.interfaces.${iface} = lib.recursiveUpdate
+systemd.services."wireguard-${wgIface}".serviceConfig.LoadCredentialEncrypted = "privateKey:${credentials}/wireguard/${wgIface}/privateKey.secret";
+networking.wireguard.interfaces.${wgIface} = lib.recursiveUpdate
   (removeAttrs peers.${hostName} ["ipv4" "persistentKeepalive" "peer"])
   {
     peers =
@@ -24,16 +26,16 @@ networking.wireguard.interfaces.${iface} = lib.recursiveUpdate
           }
           peer.peer)
         (removeAttrs
-          (lib.filterAttrs (peerName: _: config.networking.wireguard.${iface}.peers.${peerName}.enable) peers)
+          (lib.filterAttrs (peerName: _: config.networking.wireguard.${wgIface}.peers.${peerName}.enable) peers)
           [hostName]);
-    privateKeyFile = lib.mkDefault "${private}/${hostName}/wireguard/${iface}/privateKey";
+    privateKeyFile = "$CREDENTIALS_DIRECTORY/privateKey";
 
     # Set the MTU to a minimum
     # (IPv4 requires at least 68 but it's 1280 for IPv6).
     # This prevents connections to stall on huge packets,
     # or delaying their initializing due to TCP PMTU probing.
     postSetup = ''
-      ip link set dev ${iface} mtu 1280
+      ip link set dev ${wgIface} mtu 1280
     '';
   };
 networking.hosts = lib.mkMerge [
@@ -50,8 +52,54 @@ networking.hosts = lib.mkMerge [
 networking.firewall.extraCommands = lib.optionalString (wg.listenPort != null) ''
   ip46tables -A nixos-fw -i any -p udp -m udp --dport ${toString wg.listenPort} -j ACCEPT
 '';
+
+networking.nftables.ruleset = lib.optionalString (wg.listenPort != null) ''
+  table inet filter {
+    chain input-lan {
+      udp dport ${toString wg.listenPort} counter accept comment "Wireguard ${wgIface} input from peers"
+    }
+    chain input-net {
+      udp dport ${toString wg.listenPort} counter accept comment "Wireguard ${wgIface} input from peers"
+    }
+    chain input-intra {
+      ${lib.optionalString (peers.${hostName}.peer.endpointsUpdater.enable or false) ''
+        tcp dport ${toString peers.${hostName}.listenPort} ip daddr ${peers.${hostName}.ipv4} counter accept comment "Wireguard ${wgIface} from peers to endpointUpdater"
+        ''
+      }
+    }
+    chain input {
+      iifname ${wgIface} jump input-intra
+      iifname ${wgIface} log level warn prefix "input-intra: " counter drop
+    }
+
+    chain output-lan {
+      udp sport ${toString wg.listenPort} counter accept comment "Wireguard ${wgIface} output to peers"
+    }
+    chain output-net {
+      udp sport ${toString wg.listenPort} counter accept comment "Wireguard ${wgIface} output to peers"
+    }
+    chain output-intra {
+      ${lib.concatStringsSep "\n"
+          (lib.mapAttrsToList (peerName: peer: ''
+            tcp dport ${toString peer.listenPort} ip daddr ${peer.ipv4} counter accept comment "Wireguard ${wgIface} to endpointUpdater ${peerName}"
+            '')
+            (lib.filterAttrs (peerName: peer:
+              config.networking.wireguard.${wgIface}.peers.${peerName}.enable &&
+              (peers.${peerName}.peer.endpointsUpdater.enable or false))
+              peers))
+      }
+    }
+    chain output {
+      oifname ${wgIface} jump output-intra
+      oifname ${wgIface} log level warn prefix "output-intra: " counter drop
+    }
+  }
+'';
+
 services.fail2ban.ignoreIP = lib.concatMap
   (host: host.peer.allowedIPs)
   (lib.attrValues peers);
+networking.networkmanager.unmanaged = [ wgIface ];
+systemd.services.sshd.after = ["wireguard-${wgIface}.service"];
 };
 }