hosts/losurdo/wireguard/wg-intra.nix

   1 { pkgs, lib, config, inputs, ... }:
   2 let
   3   inherit (config.boot) initrd;
   4   wgIface = "wg-intra";
   5   wg = config.networking.wireguard.interfaces.${wgIface};
   6   wg-intra-peers = import (inputs.julm-nix + "/nixos/profiles/wireguard/wg-intra/peers.nix");
   7   relay = wg-intra-peers.mermet;
   8 in
   9 {
  10   imports = [
  11     (inputs.julm-nix + "/nixos/profiles/wireguard/wg-intra.nix")
  12   ];
  13   networking.wireguard.${wgIface}.peers = {
  14     mermet.enable = true;
  15     oignon.enable = true;
  16     patate.enable = true;
  17     carotte.enable = true;
  18     aubergine.enable = true;
  19   };
  20   systemd.services."wireguard-${wgIface}" = {
  21     unitConfig.Upholds = [ "upnpc-${toString wg.listenPort}.service" ];
  22   };
  23   networking.nftables.ruleset = ''
  24     table inet filter {
  25       chain input-intra {
  26         tcp dport ssh counter accept comment "SSH"
  27         udp dport 60000-61000 counter accept comment "Mosh"
  28       }
  29       chain output-intra {
  30         tcp dport { ssh, 2222 } counter accept comment "SSH"
  31         udp dport 60001-60010 counter accept comment "Mosh"
  32         tcp dport { http, https } counter accept comment "HTTP"
  33         tcp dport git counter accept comment "Git"
  34       }
  35     }
  36     table inet nat {
  37       chain postrouting {
  38         iifname ${wgIface} oifname netIface masquerade
  39       }
  40     }
  41   '';
  42   # Apparently required to get NAT reflection.
  43   services.upnpc.redirections = [
  44     {
  45       description = "WireGuard";
  46       externalPort = wg.listenPort;
  47       protocol = "UDP";
  48       duration = 30 * 60;
  49       service.requiredBy = [ "wireguard-${wgIface}.service" ];
  50       service.before = [ "wireguard-${wgIface}.service" ];
  51     }
  52   ];
  53   boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
  54
  55   # Open a wireguard tunnel to a relay
  56   # in case the host is hosted behind a NAT and has no SSH port forwarding.
  57   # This enables to send the disk password to the initrd, like that:
  58   # ssh -J mermet.sourcephile.fr root@losurdo.wg -p 2222
  59   # TODO: use a dedicated interface wg-initrd
  60   boot.initrd.secrets."/root/initrd/${wgIface}.key" = "/run/credentials/wireguard-${wgIface}.service/privateKey";
  61   boot.initrd.kernelModules = [ "wireguard" ];
  62   boot.initrd.extraUtilsCommands = ''
  63     #copy_bin_and_libs ${pkgs.wireguard-tools}/bin/wg
  64     cp -fpdv ${pkgs.wireguard-tools}/bin/.wg-wrapped $out/bin/wg
  65   '';
  66   boot.initrd.network.postCommands = ''
  67     ip link add dev ${wgIface} type wireguard
  68     ${lib.concatMapStringsSep "\n" (ip: ''
  69       ip address add ${ip} dev ${wgIface}
  70     '') wg.ips}
  71     wg set ${wgIface} private-key /root/initrd/${wgIface}.key \
  72        listen-port ${toString wg.listenPort}
  73     ip link set up dev ${wgIface} mtu 1280
  74     wg set ${wgIface} peer ${relay.peer.publicKey} \
  75        endpoint ${relay.ipv4}:${toString relay.listenPort} \
  76        allowed-ips ${relay.ipv4}/32 \
  77        persistent-keepalive 5
  78     ip route replace ${relay.ipv4}/32 dev ${wgIface} table main
  79   '';
  80   boot.initrd.postMountCommands = lib.mkIf initrd.network.flushBeforeStage2 ''
  81     ip link del dev ${wgIface}
  82   '';
  83 }