From c71260c28834921139de7e008869d2c26dd7936d Mon Sep 17 00:00:00 2001
From: Isabella Bastaja <isabella@sorre.xyz>
Date: Tue, 7 Jul 2026 12:57:05 +0200
Subject: wireguard: make the topology actually hub-and-spoke

---
 wireguard.nix | 58 ++++++++++++++++++++++++++++++++++++----------------------
 1 file changed, 36 insertions(+), 22 deletions(-)

diff --git a/wireguard.nix b/wireguard.nix
index d800f90..278ae0c 100644
--- a/wireguard.nix
+++ b/wireguard.nix
@@ -1,22 +1,22 @@
 { config, pkgs, ... }:
 let
-  hostname = config.networking.hostName;
-  conf = hosts."${hostname}";
-  privateKeyPath = ./secrets/wireguard/${hostname}.txt;
-
-  lib = pkgs.lib;
   wgPort = 51820; # Common port used on all peers
   firewallMark = 42;
 
+  inherit (pkgs) lib;
+  inherit (lib.attrsets)
+    mapAttrsToList;
+
   # The topology is hub-and-spoke/star
   # sagittarius is the hub == 2301:db8:acad:a::1
   # it hosts authoritative DNS and spokes do keepalive with it.
-  hosts = {
-    sagittarius = {
-      address = "2301:db8:acad:a::1/128";
-      publicKey = "GrrN8j9ZlPjTU5sQD4l8RDCGAn2YYszbSIE1zuG4OiI=";
-      endpoint = "95.216.136.85:${toString wgPort}";
-    };
+  hub = {
+    hostName = "sagittarius";
+    address = "2301:db8:acad:a::1/128";
+    publicKey = "GrrN8j9ZlPjTU5sQD4l8RDCGAn2YYszbSIE1zuG4OiI=";
+    endpoint = "95.216.136.85:${toString wgPort}";
+  };
+  spokes = {
     nyaan = {
       address = "2301:db8:acad:a::2/128";
       publicKey = "u5nh+YNV84IbS7g0ncfs/V+cqEudNh500LQ7pmdS7j0=";
@@ -26,7 +26,6 @@ let
       publicKey = "awBcQzNBdlYWpoOF1n7ijol2EiaJy5cxrVXfrqCvM0k=";
     };
   };
-  peers = lib.attrsets.filterAttrs (k: v: k != hostname) hosts;
 
   generatePeer =
     hostname: values:
@@ -38,16 +37,21 @@ let
       Endpoint = values.endpoint;
       PersistentKeepalive = 1;
     };
-  generatedPeers = lib.attrsets.mapAttrsToList generatePeer peers;
 
-  # stripNetmask = addr: lib.strings.removeSuffix "/128" addr;
-  # generatedHosts = lib.attrsets.mapAttrs' (hostname: value: {
-  #   name = stripNetmask value.address;
-  #   value = [
-  #     hostname
-  #     "${hostname}.internal"
-  #   ];
-  # }) peers;
+  hubPeers = mapAttrsToList generatePeer spokes;
+  spokePeers = [
+    {
+      PublicKey = hub.publicKey;
+      AllowedIPs = [ "2301:db8:acad:a::/64" ];
+      Endpoint = hub.endpoint;
+      PersistentKeepalive = 10;
+    }
+  ];
+
+  hostname = config.networking.hostName;
+  isHub = hostname == hub.hostName;
+  conf = if isHub then hub else spokes."${hostname}";
+  privateKeyPath = ./secrets/wireguard/${hostname}.txt;
 in
 {
   sops.secrets."wireguard-${hostname}-pk" = {
@@ -68,6 +72,10 @@ in
     networks."50-wg" = {
       matchConfig.Name = "wg0";
       address = [ conf.address ];
+      networkConfig = lib.mkIf isHub {
+        IPv6Forwarding = true;
+        IPv6AcceptRA = false;  # Disable RA acceptance on router interfaces
+      };
     };
 
     netdevs."50-wg" = {
@@ -87,7 +95,13 @@ in
         FirewallMark = firewallMark;
       };
 
-      wireguardPeers = generatedPeers;
+      wireguardPeers = if isHub then hubPeers else spokePeers;
     };
   };
+
+  boot.kernel.sysctl = lib.mkIf isHub {
+    # I *think* this should be fine since networkd will prevent forwarding
+    # on any interface that doesn't have IPv6Forwarding set to true.
+    "net.ipv6.conf.all.forwarding" = true;
+  };
 }
-- 
cgit v1.3.1