hosts/losurdo/wireguard/wg-intra.nix

   1 { pkgs, lib, config, inputs, ... }:
   2 let
   3   inherit (config.boot) initrd;
   4   wgIface = "wg-intra";
   5   wg = config.networking.wireguard.interfaces.${wgIface};
   6   wg-intra-peers = import (inputs.julm-nix + "/nixos/profiles/wireguard/wg-intra/peers.nix");
   7   relay = wg-intra-peers.mermet;
   8 in
   9 {
  10   imports = [
  11     (inputs.julm-nix + "/nixos/profiles/wireguard/wg-intra.nix")
  12   ];
  13   systemd.services."wireguard-${wgIface}" = {
  14     serviceConfig = {
  15       LoadCredentialEncrypted = [ "privateKey:${./. + "/${wgIface}/privateKey.cred"}" ];
  16     };
  17     unitConfig = {
  18       Upholds = [ "upnpc-${toString wg.listenPort}.service" ];
  19     };
  20   };
  21   networking.wireguard.${wgIface}.peers = {
  22     mermet.enable = true;
  23     oignon.enable = true;
  24     patate.enable = true;
  25     carotte.enable = true;
  26     aubergine.enable = true;
  27   };
  28   networking.nftables.ruleset = ''
  29     table inet filter {
  30       chain input-intra {
  31         tcp dport ssh counter accept comment "SSH"
  32         udp dport 60000-61000 counter accept comment "Mosh"
  33       }
  34       chain output-intra {
  35         tcp dport { ssh, 2222 } counter accept comment "SSH"
  36         udp dport 60001-60010 counter accept comment "Mosh"
  37         tcp dport { http, https } counter accept comment "HTTP"
  38         tcp dport git counter accept comment "Git"
  39       }
  40     }
  41     table inet nat {
  42       chain postrouting {
  43         iifname ${wgIface} oifname netIface masquerade
  44       }
  45     }
  46   '';
  47   # Apparently required to get NAT reflection.
  48   services.upnpc.enable = true;
  49   services.upnpc.redirections = [
  50     {
  51       description = "WireGuard";
  52       externalPort = wg.listenPort;
  53       protocol = "UDP";
  54       duration = 30 * 60;
  55       service.requiredBy = [ "wireguard-${wgIface}.service" ];
  56       service.before = [ "wireguard-${wgIface}.service" ];
  57     }
  58   ];
  59   boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
  60
  61   # Open a wireguard tunnel to a relay
  62   # in case the host is hosted behind a NAT and has no SSH port forwarding.
  63   # This enables to send the disk password to the initrd, like that:
  64   # ssh -J mermet.sourcephile.fr root@losurdo.wg -p 2222
  65   # TODO: use a dedicated interface wg-initrd
  66   boot.initrd.secrets."/root/initrd/${wgIface}.key" = "/run/credentials/wireguard-${wgIface}.service/privateKey";
  67   boot.initrd.kernelModules = [ "wireguard" ];
  68   boot.initrd.extraUtilsCommands = ''
  69     #copy_bin_and_libs ${pkgs.wireguard-tools}/bin/wg
  70     cp -fpdv ${pkgs.wireguard-tools}/bin/.wg-wrapped $out/bin/wg
  71   '';
  72   boot.initrd.network.postCommands = ''
  73     ip link add dev ${wgIface} type wireguard
  74     ${lib.concatMapStringsSep "\n" (ip: ''
  75       ip address add ${ip} dev ${wgIface}
  76     '') wg.ips}
  77     wg set ${wgIface} private-key /root/initrd/${wgIface}.key \
  78        listen-port ${toString wg.listenPort}
  79     ip link set up dev ${wgIface} mtu 1280
  80     wg set ${wgIface} peer ${relay.peer.publicKey} \
  81        endpoint ${relay.ipv4}:${toString relay.listenPort} \
  82        allowed-ips ${relay.ipv4}/32 \
  83        persistent-keepalive 5
  84     ip route replace ${relay.ipv4}/32 dev ${wgIface} table main
  85   '';
  86   boot.initrd.postMountCommands = lib.mkIf initrd.network.flushBeforeStage2 ''
  87     ip link del dev ${wgIface}
  88   '';
  89 }