hosts/losurdo/wireguard/wg-intra.nix

   1 { pkgs, lib, config, inputs, ... }:
   2 let
   3   inherit (config.boot) initrd;
   4   wgIface = "wg-intra";
   5   wg = config.networking.wireguard.interfaces.${wgIface};
   6   wg-intra-peers = import (inputs.julm-nix + "/nixos/profiles/wireguard/wg-intra/peers.nix");
   7   relay = wg-intra-peers.mermet;
   8 in
   9 {
  10   imports = [
  11     (inputs.julm-nix + "/nixos/profiles/wireguard/wg-intra.nix")
  12   ];
  13   networking.wireguard.${wgIface}.peers = {
  14     mermet.enable = true;
  15     oignon.enable = true;
  16     patate.enable = true;
  17     carotte.enable = true;
  18     aubergine.enable = true;
  19   };
  20   systemd.services."wireguard-${wgIface}" = {
  21     unitConfig.Upholds = [ "upnpc-${toString wg.listenPort}.service" ];
  22   };
  23   networking.nftables.ruleset = ''
  24     table inet filter {
  25       chain input-intra {
  26         tcp dport ssh counter accept comment "SSH"
  27         udp dport 60000-61000 counter accept comment "Mosh"
  28       }
  29       chain output-intra {
  30         tcp dport { ssh, 2222 } counter accept comment "SSH"
  31         udp dport 60001-60010 counter accept comment "Mosh"
  32         tcp dport { http, https } counter accept comment "HTTP"
  33         tcp dport git counter accept comment "Git"
  34       }
  35     }
  36     table inet nat {
  37       chain postrouting {
  38         iifname ${wgIface} oifname netIface masquerade
  39       }
  40     }
  41   '';
  42   # Apparently required to get NAT reflection.
  43   services.upnpc.enable = true;
  44   services.upnpc.redirections = [
  45     {
  46       description = "WireGuard";
  47       externalPort = wg.listenPort;
  48       protocol = "UDP";
  49       duration = 30 * 60;
  50       service.requiredBy = [ "wireguard-${wgIface}.service" ];
  51       service.before = [ "wireguard-${wgIface}.service" ];
  52     }
  53   ];
  54   boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
  55
  56   # Open a wireguard tunnel to a relay
  57   # in case the host is hosted behind a NAT and has no SSH port forwarding.
  58   # This enables to send the disk password to the initrd, like that:
  59   # ssh -J mermet.sourcephile.fr root@losurdo.wg -p 2222
  60   # TODO: use a dedicated interface wg-initrd
  61   boot.initrd.secrets."/root/initrd/${wgIface}.key" = "/run/credentials/wireguard-${wgIface}.service/privateKey";
  62   boot.initrd.kernelModules = [ "wireguard" ];
  63   boot.initrd.extraUtilsCommands = ''
  64     #copy_bin_and_libs ${pkgs.wireguard-tools}/bin/wg
  65     cp -fpdv ${pkgs.wireguard-tools}/bin/.wg-wrapped $out/bin/wg
  66   '';
  67   boot.initrd.network.postCommands = ''
  68     ip link add dev ${wgIface} type wireguard
  69     ${lib.concatMapStringsSep "\n" (ip: ''
  70       ip address add ${ip} dev ${wgIface}
  71     '') wg.ips}
  72     wg set ${wgIface} private-key /root/initrd/${wgIface}.key \
  73        listen-port ${toString wg.listenPort}
  74     ip link set up dev ${wgIface} mtu 1280
  75     wg set ${wgIface} peer ${relay.peer.publicKey} \
  76        endpoint ${relay.ipv4}:${toString relay.listenPort} \
  77        allowed-ips ${relay.ipv4}/32 \
  78        persistent-keepalive 5
  79     ip route replace ${relay.ipv4}/32 dev ${wgIface} table main
  80   '';
  81   boot.initrd.postMountCommands = lib.mkIf initrd.network.flushBeforeStage2 ''
  82     ip link del dev ${wgIface}
  83   '';
  84 }