wireguard: enable peer filtering

diff --git a/hosts/oignon/wireguard.nix b/hosts/oignon/wireguard.nix
index 9d724c00031daf264226a7d12fc2755144bd679d..97bdb5cb1a5ad411455daf199772009d83f4331a 100644 (file)
--- a/hosts/oignon/wireguard.nix
+++ b/hosts/oignon/wireguard.nix
@@ -1,5 +1,7 @@
 { pkgs, lib, config, hostName, private, ... }:
 {
+networking.wireguard.wg-intra.peers.mermet.enable = true;
+networking.wireguard.wg-intra.peers.losurdo.enable = true;
 networking.hosts."192.168.42.2" = [
   "sourcephile.wg"
   "builds.sourcephile.wg"

diff --git a/nixos/profiles/wireguard/wg-intra.nix b/nixos/profiles/wireguard/wg-intra.nix
index add589a178c082f0dd837bed4fc04f3674386774..297bc28ea77a41b6a7c607eeed1fdc5074c3dc09 100644 (file)
--- a/nixos/profiles/wireguard/wg-intra.nix
+++ b/nixos/profiles/wireguard/wg-intra.nix
@@ -1,21 +1,31 @@
 { pkgs, lib, config, hostName, private, ... }:
 let
   iface = "wg-intra";
-  hosts = import wg-intra/hosts.nix;
+  peers = import wg-intra/peers.nix;
   wg = config.networking.wireguard.interfaces.${iface};
 in
 {
+options.networking.wireguard.${iface}.peers =
+  lib.genAttrs (lib.attrNames peers) (peerName: {
+    enable = lib.mkEnableOption "this peer";
+  });
+config = {
 networking.wireguard.interfaces.${iface} = lib.recursiveUpdate
-  (removeAttrs hosts.${hostName} ["ipv4" "persistentKeepalive" "peer"])
+  (removeAttrs peers.${hostName} ["ipv4" "persistentKeepalive" "peer"])
   {
     peers =
-      lib.mapAttrsToList (peerName: peer: lib.recursiveUpdate
-        { persistentKeepalive =
-          peer.persistentKeepalive # Useful if this peer is behind a NAT
-          or hosts.${hostName}.persistentKeepalive # Useful if this host is behind a NAT
-          or null; }
-        peer.peer
-      ) (removeAttrs hosts [hostName]);
+      lib.mapAttrsToList (peerName: peer:
+        lib.recursiveUpdate
+          {
+            persistentKeepalive =
+              peer.persistentKeepalive # Useful if this peer is behind a NAT
+              or peers.${hostName}.persistentKeepalive # Useful if this host is behind a NAT
+              or null;
+          }
+          peer.peer)
+        (removeAttrs
+          (lib.filterAttrs (peerName: _: config.networking.wireguard.${iface}.peers.${peerName}.enable) peers)
+          [hostName]);
     privateKeyFile = lib.mkDefault "${private}/${hostName}/wireguard/${iface}/privateKey";
 
     # Set the MTU to a minimum
@@ -28,8 +38,8 @@ networking.wireguard.interfaces.${iface} = lib.recursiveUpdate
   };
 networking.hosts = lib.mkMerge [
   (lib.mapAttrs' (hostName: host:
-    lib.nameValuePair host.ipv4 [ "${hostName}.wg" ]) hosts)
-  { "${hosts.losurdo.ipv4}" = [
+    lib.nameValuePair host.ipv4 [ "${hostName}.wg" ]) peers)
+  { "${peers.losurdo.ipv4}" = [
     "nix-extracache.losurdo.wg"
     "nix-localcache.losurdo.wg"
   ]; }
@@ -41,5 +51,6 @@ networking.firewall.extraCommands = ''
 '';
 services.fail2ban.ignoreIP = lib.concatMap
   (host: host.peer.allowedIPs)
-  (lib.attrValues hosts);
+  (lib.attrValues peers);
+};
 }

diff --git a/nixos/profiles/wireguard/wg-intra/hosts.nix b/nixos/profiles/wireguard/wg-intra/peers.nix
similarity index 100%
rename from nixos/profiles/wireguard/wg-intra/hosts.nix
rename to nixos/profiles/wireguard/wg-intra/peers.nix