diff options
| -rw-r--r-- | hosts/nyaan/network.nix | 1 | ||||
| -rw-r--r-- | hosts/sagittarius/network.nix | 1 | ||||
| -rw-r--r-- | wireguard.nix | 39 |
3 files changed, 13 insertions, 28 deletions
diff --git a/hosts/nyaan/network.nix b/hosts/nyaan/network.nix index 14cbfe2..e855f6d 100644 --- a/hosts/nyaan/network.nix +++ b/hosts/nyaan/network.nix @@ -56,7 +56,6 @@ in chain input-allow { # tcp dport { 22, 80, 443 } accept udp dport 51820 accept - udp dport 5353 meta mark 42 accept comment "mDNS over wireguard" meta l4proto . th dport @temp-ports accept icmp type echo-request accept comment "allow ping" icmpv6 type != { nd-redirect, 139 } accept comment "Accept all ICMPv6 messages except redirects and node information queries (type 139). See RFC 4890, section 4.4." diff --git a/hosts/sagittarius/network.nix b/hosts/sagittarius/network.nix index ef5f66e..32362e6 100644 --- a/hosts/sagittarius/network.nix +++ b/hosts/sagittarius/network.nix @@ -43,7 +43,6 @@ chain input-allow { tcp dport { 22, 80, 443 } accept udp dport 51820 accept - udp dport 5353 meta mark 42 accept comment "mDNS over wireguard" meta l4proto . th dport @temp-ports accept icmp type echo-request accept comment "allow ping" icmpv6 type != { nd-redirect, 139 } accept comment "Accept all ICMPv6 messages except redirects and node information queries (type 139). See RFC 4890, section 4.4." diff --git a/wireguard.nix b/wireguard.nix index b4fb1fa..8709647 100644 --- a/wireguard.nix +++ b/wireguard.nix @@ -19,6 +19,7 @@ let publicKey = "u5nh+YNV84IbS7g0ncfs/V+cqEudNh500LQ7pmdS7j0="; }; }; + peers = lib.attrsets.filterAttrs (k: v: k != hostname) hosts; generatePeer = hostname: values: @@ -30,12 +31,16 @@ let Endpoint = values.endpoint; PersistentKeepalive = 1; }; - generatePeers = - hostname: - let - peers = lib.attrsets.filterAttrs (k: v: k != hostname) hosts; - in - lib.attrsets.mapAttrsToList generatePeer peers; + generatedPeers = lib.attrsets.mapAttrsToList generatePeer peers; + + stripNetmask = addr: lib.strings.removeSuffix "/128" addr; + generatedHosts = lib.attrsets.mapAttrs' (hostname: value: { + name = stripNetmask value.address; + value = [ + hostname + "${hostname}.internal" + ]; + }) peers; in { sops.secrets."wireguard-${hostname}-pk" = { @@ -46,7 +51,7 @@ in format = "binary"; }; - services.resolved.settings.Resolve.MulticastDNS = false; + networking.hosts = generatedHosts; systemd.network = { enable = true; @@ -72,25 +77,7 @@ in FirewallMark = firewallMark; }; - wireguardPeers = generatePeers hostname; - }; - }; - - services.avahi = { - enable = true; - ipv4 = false; - nssmdns4 = false; - ipv6 = true; - nssmdns6 = true; - reflector = true; - allowInterfaces = [ "wg0" ]; - publish = { - enable = true; - userServices = true; - workstation = true; - domain = true; + wireguardPeers = generatedPeers; }; - debug = true; - allowPointToPoint = true; }; } |