nixos-config/modules/wireguard/home.nix

124 lines
3.4 KiB
Nix
Raw Normal View History

2021-02-20 19:56:33 +01:00
{ lib, config, pkgs, ... }:
2020-12-05 14:39:36 +01:00
let
serverHostName = "vueko";
peers = {
sayuri = {
address = "10.80.0.5";
publicKey = "t7hpd2yZupAKHxYerHtXnlPRUjV1aGbrrzjYakKdOwE=";
};
vueko = {
address = "10.80.0.6";
publicKey = "JbOfL4FxPCzJOjI8AGklPHY2FniCXq0QwOa08gjSyns=";
};
fuuko = {
address = "10.80.0.7";
publicKey = "VXic8mhaJBSl6yFkx0Cu6JI8tqqjjM3UbW7x+05pV0M=";
};
2021-09-30 07:32:03 +02:00
mayushii = {
address = "10.80.0.9";
publicKey = "nnLdgywXmDg8HWH6I0G28Z2zb4OmmyFDpnvvEBzKJTg=";
};
2021-09-08 18:23:21 +02:00
yuzuru = {
address = "10.80.0.8";
publicKey = "2pQ2r0q+960dq7wXr1c5Shcz6K+rdhIA8fKAu2Lnhl0=";
2022-03-03 09:48:22 +01:00
};
okarin = {
address = "10.80.0.10";
publicKey = "wspALdgkj8Sw+ehNSwHziYE5ZTVyF6rRBKvDHl7moj8=";
2021-09-08 18:23:21 +02:00
};
2022-03-23 15:03:08 +01:00
renge = {
address = "10.80.0.11";
publicKey = "RlLs/uiWb9qaBU2iDgRag7Q+FFaR7oHI3yOPLZPKgmA=";
};
};
2020-12-05 14:39:36 +01:00
cfg = config.sbruder.wireguard.home;
enableServer = config.networking.hostName == serverHostName;
2020-12-05 14:39:36 +01:00
in
2020-08-22 17:44:39 +02:00
{
2020-12-05 14:39:36 +01:00
options = {
sbruder.wireguard.home = {
enable = lib.mkEnableOption "WireGuard tunnel wg-home";
address = lib.mkOption {
type = lib.types.str;
visible = false;
readOnly = true;
2020-12-05 14:39:36 +01:00
};
2020-08-22 17:44:39 +02:00
};
};
2020-12-05 14:39:36 +01:00
2021-01-06 13:09:29 +01:00
config = lib.mkIf cfg.enable {
sops.secrets.wg-home-private-key = {
2021-05-01 13:16:14 +02:00
sopsFile = ./../../machines + "/${config.networking.hostName}/secrets.yaml";
};
2021-01-06 13:09:29 +01:00
sbruder.wireguard.home.address = peers."${config.networking.hostName}".address;
2021-01-06 13:09:29 +01:00
networking.wireguard.interfaces.wg-home = {
privateKeyFile = config.sops.secrets.wg-home-private-key.path;
2021-01-06 13:09:29 +01:00
ips = [ "${cfg.address}/24" ];
listenPort = if enableServer then 51820 else null;
peers =
if enableServer
then
map
(peerConfig: with peerConfig; {
allowedIPs = [ "${address}/32" ];
inherit publicKey;
})
(lib.attrValues
(lib.filterAttrs
(n: v: n != config.networking.hostName)
peers))
else [
{
allowedIPs = [ "10.80.0.0/24" ];
publicKey = peers."${serverHostName}".publicKey;
endpoint = "${serverHostName}.sbruder.de:51820";
persistentKeepalive = 25;
}
];
2021-01-06 13:09:29 +01:00
};
networking.firewall = {
trustedInterfaces = [ "wg-home" ];
allowedUDPPorts = lib.optionals enableServer [
51820
53
];
};
boot.kernel.sysctl = lib.optionalAttrs enableServer {
"net.ipv4.ip_forward" = 1;
};
2021-02-20 19:56:33 +01:00
services.bind = lib.mkIf enableServer {
enable = true;
zones = lib.singleton {
name = "vpn.sbruder.de";
master = true;
2021-02-20 19:56:33 +01:00
file =
let
# !!! very hacky
hexStringToInt = hex: (builtins.fromTOML "int = 0x${hex}").int;
peerRecords = lib.concatStrings
(lib.mapAttrsToList
(peer: peerConfig: ''
${peer} IN A ${peerConfig.address}
'')
peers);
peerRecordsHash = builtins.hashString "sha256" peerRecords;
serial = hexStringToInt (lib.substring 0 8 peerRecordsHash);
in
pkgs.writeText "vpn.sbruder.de.zone" (''
$TTL 3600
@ IN SOA ${serverHostName}.sbruder.de. hostmaster.sbruder.de. ${toString serial} 28800 3600 604800 3600
@ IN NS ${serverHostName}.sbruder.de.
'' + peerRecords);
};
};
2020-12-05 14:39:36 +01:00
};
2020-08-22 17:44:39 +02:00
}