hosts/mermet/networking/wireguard.nix

   1 { pkgs, lib, config, hostName, inputs, ... }:
   2 let
   3   inherit (config.security.gnupg) secrets;
   4   iface = "wg-intra";
   5   wg = config.networking.wireguard.interfaces.${iface};
   6   wg-intra-peers = import (inputs.julm-nix + "/nixos/profiles/wireguard/wg-intra/peers.nix");
   7 in
   8 {
   9 imports = [
  10   (inputs.julm-nix + "/nixos/profiles/wireguard/wg-intra.nix")
  11 ];
  12 config = {
  13 networking.wireguard.${iface}.peers = {
  14   losurdo.enable = true;
  15   oignon.enable = true;
  16   patate.enable = true;
  17 };
  18 networking.wireguard.interfaces.${iface} = {
  19   privateKeyFile = secrets."wireguard/${iface}/privateKey".path;
  20 };
  21 security.gnupg.secrets."wireguard/${iface}/privateKey" = {};
  22 systemd.services."wireguard-${iface}" = {
  23   after    = [ secrets."wireguard/${iface}/privateKey".service ];
  24   requires = [ secrets."wireguard/${iface}/privateKey".service ];
  25 };
  26 networking.nftables.ruleset = ''
  27   # Allow peers to initiate connection for ${iface}
  28   add rule inet filter net2fw udp dport ${toString wg.listenPort} counter accept comment "${iface}"
  29
  30   # Hook ${iface} into relevant chains
  31   add rule inet filter input  iifname "${iface}" jump intra2fw
  32   add rule inet filter input  iifname "${iface}" log level warn prefix "intra2fw: " counter drop
  33   add rule inet filter output oifname "${iface}" jump fw2intra
  34   add rule inet filter output oifname "${iface}" log level warn prefix "fw2intra: " counter drop
  35
  36   # ${iface} firewalling
  37   add rule inet filter fw2intra counter accept
  38   add rule inet filter intra2fw tcp dport ${toString wg.peersAnnouncing.listenPort} counter accept comment "WireGuard peers announcing"
  39   add rule inet filter intra2fw ip saddr ${wg-intra-peers.losurdo.ipv4} counter accept comment "losurdo"
  40 '';
  41 };
  42 }