]> Git — Sourcephile - sourcephile-nix.git/blob - machines/losurdo/networking/wireguard.nix
wireguard: setup in initrd
[sourcephile-nix.git] / machines / losurdo / networking / wireguard.nix
1 { pkgs, lib, config, machines, machineName, wireguard, ... }:
2 let
3 inherit (builtins) hasAttr removeAttrs;
4 inherit (config.security) gnupg;
5 wg = "wg-intranet";
6 relay = machines.mermet.extraArgs.wireguard."${wg}";
7 peers = lib.filterAttrs (peerName: machine:
8 hasAttr "${wg}" machine.extraArgs.wireguard
9 ) (removeAttrs machines [machineName]);
10 in
11 {
12 security.gnupg.secrets."wireguard/${wg}/privateKey" = {};
13 systemd.services."wireguard-${wg}" = {
14 after = [ gnupg.secrets."wireguard/${wg}/privateKey".service ];
15 requires = [ gnupg.secrets."wireguard/${wg}/privateKey".service ];
16 };
17 networking.nftables.ruleset = ''
18 # Allow initiating connection for ${wg}
19 add rule inet filter fw2net udp dport ${toString relay.listenPort} counter accept comment "${wg}"
20 #add rule inet filter fw2net udp sport ${toString wireguard."${wg}".listenPort} counter accept comment "${wg}"
21 # Allow peers to initiate connection for ${wg}
22 #add rule inet filter net2fw udp dport ${toString wireguard."${wg}".listenPort} counter accept comment "${wg}"
23
24 # Hook ${wg} into relevant chains
25 add rule inet filter input iifname "${wg}" jump intra2fw
26 add rule inet filter input iifname "${wg}" log level warn prefix "intra2fw: " counter drop
27 add rule inet filter output oifname "${wg}" jump fw2intra
28 add rule inet filter output oifname "${wg}" log level warn prefix "fw2intra: " counter drop
29
30 # ${wg} firewalling
31 add rule inet filter fw2intra counter accept
32 add rule inet filter intra2fw ip saddr ${relay.ipv4} counter accept comment "relay"
33 add rule inet filter forward iifname "${wg}" jump fwd-intra
34 '';
35 boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
36 networking.wireguard.interfaces."${wg}" = {
37 ips = [ "${wireguard."${wg}".ipv4}/24" ];
38 listenPort = wireguard."${wg}".listenPort;
39 privateKeyFile = gnupg.secrets."wireguard/${wg}/privateKey".path;
40 peers = lib.mapAttrsToList (peerName: machine:
41 machine.extraArgs.wireguard."${wg}".peer //
42 { inherit (wireguard."${wg}") persistentKeepalive; }
43 ) peers;
44 };
45 networking.hosts = lib.mapAttrs' (machineName: machine: lib.nameValuePair
46 machine.extraArgs.wireguard."${wg}".ipv4
47 [ "${machineName}.intranet" ]
48 ) peers;
49
50 # Open a wireguard tunnel to a relay
51 # in case the machine is hosted behind a NAT and has no SSH port forwarding.
52 # This enables to send the disk password to the initrd, like that:
53 # ssh -J mermet.sourcephile.fr root@losurdo.intranet -p 2222
54 boot.initrd.secrets."/root/initrd/${wg}.key" = "/root/initrd/${wg}.key";
55 installer.ssh-nixos.script = ''
56 # Send the wireguard key of the initrd
57 gpg --decrypt '${gnupg.store}/wireguard/${wg}/privateKey.gpg' |
58 ssh '${config.installer.ssh-nixos.target}' \
59 install -D -m 400 -o root -g root /dev/stdin /root/initrd/${wg}.key
60 '';
61 boot.initrd.kernelModules = [ "wireguard" ];
62 boot.initrd.extraUtilsCommands = ''
63 #copy_bin_and_libs ${pkgs.wireguard-tools}/bin/wg
64 cp -fpdv ${pkgs.wireguard-tools}/bin/.wg-wrapped $out/bin/wg
65 '';
66 boot.initrd.network.postCommands = ''
67 ip link add dev ${wg} type wireguard
68 ip address add ${wireguard."${wg}".ipv4}/24 dev ${wg}
69 wg set ${wg} private-key /root/initrd/${wg}.key
70 ip link set up dev ${wg}
71 wg set ${wg} peer ${relay.peer.publicKey} \
72 endpoint ${machines.mermet.extraArgs.ipv4}:${toString relay.listenPort} \
73 allowed-ips ${relay.ipv4}/32 \
74 persistent-keepalive 5
75 ip route replace ${relay.ipv4}/32 dev ${wg} table main
76 '';
77 }