diff options
| -rw-r--r-- | wireguard.nix | 80 |
1 files changed, 72 insertions, 8 deletions
diff --git a/wireguard.nix b/wireguard.nix index 8709647..23e2cf2 100644 --- a/wireguard.nix +++ b/wireguard.nix @@ -8,11 +8,15 @@ let wgPort = 51820; # Common port used on all peers firewallMark = 42; + # The topology is hub-and-spoke/star + # sagittarius is the hub == 2301:db8:acad:a::1 + # it hosts authoritative DNS and spokes do keepalive with it. hosts = { sagittarius = { address = "2301:db8:acad:a::1/128"; publicKey = "GrrN8j9ZlPjTU5sQD4l8RDCGAn2YYszbSIE1zuG4OiI="; endpoint = "95.216.136.85:${toString wgPort}"; + hub = true; }; nyaan = { address = "2301:db8:acad:a::2/128"; @@ -21,6 +25,13 @@ let }; peers = lib.attrsets.filterAttrs (k: v: k != hostname) hosts; + hub = + let + filtered = lib.attrsets.filterAttrs (_: v: v.hub == true) hosts; + mapped = map (k: (builtins.getAttr k hosts) // { hostname = "k"; }) builtins.attrNames filtered; + in + builtins.elemAt 0 mapped; + generatePeer = hostname: values: { @@ -34,13 +45,13 @@ let generatedPeers = lib.attrsets.mapAttrsToList generatePeer peers; stripNetmask = addr: lib.strings.removeSuffix "/128" addr; - generatedHosts = lib.attrsets.mapAttrs' (hostname: value: { - name = stripNetmask value.address; - value = [ - hostname - "${hostname}.internal" - ]; - }) peers; + # generatedHosts = lib.attrsets.mapAttrs' (hostname: value: { + # name = stripNetmask value.address; + # value = [ + # hostname + # "${hostname}.internal" + # ]; + # }) peers; in { sops.secrets."wireguard-${hostname}-pk" = { @@ -51,7 +62,60 @@ in format = "binary"; }; - networking.hosts = generatedHosts; + services.resolved = { + enable = true; + dnsDelegates.wg = { + Domains = lib.attrsets.mapAttrsToList (host: _: "${host}.internal") hosts; + DNS = stripNetmask hub.address; + }; + }; + + services.nsd = { + enable = config.networking.hostName == hub.hostname; + interfaces = [ + stripNetmask + hub.address + ]; + ipv4 = false; + ipv6 = true; + serverCount = 1; + tcpCount = 100; + + zones = { + sagittarius = { + data = '' + $ORIGIN sagittarius.internal. + $TTL 300 + + @ IN SOA ns1.sagittarius.internal. hostmaster.mydomain.internal. ( + 2024053101 ; serial — YYYYMMDDNN + 3600 ; refresh + 900 ; retry + 1209600 ; expire + 300 ; minimum TTL + ) + + ; Nameservers (required for a valid zone) + @ IN NS ns1.mydomain.internal. + ns1 IN A 10.0.0.1 + + ; Wildcard — catches any undefined subdomain + * IN A 10.0.0.1 + + ; Explicit host entries + server IN A 10.0.0.1 + alpha IN A 10.0.0.10 + bravo IN A 10.0.0.11 + charlie IN A 10.0.0.12 + + ; SRV records for service discovery + _http._tcp IN SRV 10 5 80 server + _https._tcp IN SRV 10 5 443 server + ''; + }; + }; + }; + systemd.network = { enable = true; |