common wireguard module

1 files changed, 78 insertions, 0 deletions

diff --git a/wireguard.nix b/wireguard.nix
new file mode 100644
index 0000000..04ec3bc
--- /dev/null
+++ b/wireguard.nix
@@ -0,0 +1,78 @@
+{ config, pkgs, ... }:
+let
+  hostname = config.networking.hostName;
+  conf = hosts."${hostname}";
+  privateKeyPath = ./secrets/wireguard/${hostname}.txt;
+
+  lib = pkgs.lib;
+  wgPort = 51820; # Common port used on all peers
+  firewallMark = 42;
+
+  hosts = {
+    sagittarius = {
+      address = "2301:db8:acad:a::1/128";
+      publicKey = "GrrN8j9ZlPjTU5sQD4l8RDCGAn2YYszbSIE1zuG4OiI=";
+      endpoint = "95.216.136.85:${toString wgPort}";
+    };
+    nyaan = {
+      address = "2301:db8:acad:a::2/128";
+      publicKey = "u5nh+YNV84IbS7g0ncfs/V+cqEudNh500LQ7pmdS7j0=";
+    };
+  };
+
+  generatePeer =
+    hostname: values:
+    {
+      PublicKey = values.publicKey;
+      AllowedIPs = [ values.address ];
+    }
+    // lib.optionalAttrs (builtins.hasAttr "endpoint" values) {
+      Endpoint = values.endpoint;
+      PersistentKeepalive = 1;
+    };
+  generatePeers =
+    hostname:
+    let
+      peers = lib.attrsets.filterAttrs (k: v: k != hostname) hosts;
+    in
+    lib.attrsets.mapAttrsToList generatePeer peers;
+in
+{
+  sops.secrets."wireguard-${hostname}-pk" = {
+    sopsFile = privateKeyPath;
+    owner = "systemd-network";
+    group = "systemd-network";
+    mode = "0640";
+    format = "binary";
+  };
+
+  networking.firewall.allowedUDPPorts = [ wgPort ];
+
+  systemd.network = {
+    enable = true;
+    networks."50-wg" = {
+      matchConfig.Name = "wg0";
+      address = [ conf.address ];
+    };
+
+    netdevs."50-wg" = {
+      netdevConfig = {
+        Kind = "wireguard";
+        Name = "wg0";
+      };
+
+      wireguardConfig = {
+        ListenPort = wgPort;
+        PrivateKeyFile = config.sops.secrets."wireguard-${hostname}-pk".path;
+        # To automatically create routes for everything in AllowedIPs,
+        # add RouteTable=main
+        RouteTable = "main";
+        # FirewallMark marks all packets send and received by wg0 with the
+        # number, which can be used to define policy rules on these packets.
+        FirewallMark = firewallMark;
+      };
+
+      wireguardPeers = generatePeers hostname;
+    };
+  };
+}