diff options
Diffstat (limited to 'wireguard.nix')
| -rw-r--r-- | wireguard.nix | 58 |
1 files changed, 36 insertions, 22 deletions
diff --git a/wireguard.nix b/wireguard.nix index d800f90..278ae0c 100644 --- a/wireguard.nix +++ b/wireguard.nix @@ -1,22 +1,22 @@ { config, pkgs, ... }: let - hostname = config.networking.hostName; - conf = hosts."${hostname}"; - privateKeyPath = ./secrets/wireguard/${hostname}.txt; - - lib = pkgs.lib; wgPort = 51820; # Common port used on all peers firewallMark = 42; + inherit (pkgs) lib; + inherit (lib.attrsets) + mapAttrsToList; + # The topology is hub-and-spoke/star # sagittarius is the hub == 2301:db8:acad:a::1 # it hosts authoritative DNS and spokes do keepalive with it. - hosts = { - sagittarius = { - address = "2301:db8:acad:a::1/128"; - publicKey = "GrrN8j9ZlPjTU5sQD4l8RDCGAn2YYszbSIE1zuG4OiI="; - endpoint = "95.216.136.85:${toString wgPort}"; - }; + hub = { + hostName = "sagittarius"; + address = "2301:db8:acad:a::1/128"; + publicKey = "GrrN8j9ZlPjTU5sQD4l8RDCGAn2YYszbSIE1zuG4OiI="; + endpoint = "95.216.136.85:${toString wgPort}"; + }; + spokes = { nyaan = { address = "2301:db8:acad:a::2/128"; publicKey = "u5nh+YNV84IbS7g0ncfs/V+cqEudNh500LQ7pmdS7j0="; @@ -26,7 +26,6 @@ let publicKey = "awBcQzNBdlYWpoOF1n7ijol2EiaJy5cxrVXfrqCvM0k="; }; }; - peers = lib.attrsets.filterAttrs (k: v: k != hostname) hosts; generatePeer = hostname: values: @@ -38,16 +37,21 @@ let Endpoint = values.endpoint; PersistentKeepalive = 1; }; - generatedPeers = lib.attrsets.mapAttrsToList generatePeer peers; - # stripNetmask = addr: lib.strings.removeSuffix "/128" addr; - # generatedHosts = lib.attrsets.mapAttrs' (hostname: value: { - # name = stripNetmask value.address; - # value = [ - # hostname - # "${hostname}.internal" - # ]; - # }) peers; + hubPeers = mapAttrsToList generatePeer spokes; + spokePeers = [ + { + PublicKey = hub.publicKey; + AllowedIPs = [ "2301:db8:acad:a::/64" ]; + Endpoint = hub.endpoint; + PersistentKeepalive = 10; + } + ]; + + hostname = config.networking.hostName; + isHub = hostname == hub.hostName; + conf = if isHub then hub else spokes."${hostname}"; + privateKeyPath = ./secrets/wireguard/${hostname}.txt; in { sops.secrets."wireguard-${hostname}-pk" = { @@ -68,6 +72,10 @@ in networks."50-wg" = { matchConfig.Name = "wg0"; address = [ conf.address ]; + networkConfig = lib.mkIf isHub { + IPv6Forwarding = true; + IPv6AcceptRA = false; # Disable RA acceptance on router interfaces + }; }; netdevs."50-wg" = { @@ -87,7 +95,13 @@ in FirewallMark = firewallMark; }; - wireguardPeers = generatedPeers; + wireguardPeers = if isHub then hubPeers else spokePeers; }; }; + + boot.kernel.sysctl = lib.mkIf isHub { + # I *think* this should be fine since networkd will prevent forwarding + # on any interface that doesn't have IPv6Forwarding set to true. + "net.ipv6.conf.all.forwarding" = true; + }; } |