initial wireguard setup

12 files changed, 30 insertions, 111 deletions

diff --git a/hosts/ganymede/config.nix b/hosts/ganymede/config.nix
index f6b3b74..a7a68ea 100644
--- a/hosts/ganymede/config.nix
+++ b/hosts/ganymede/config.nix
@@ -1,6 +1,4 @@
-{config, ...}: let
-  tailscaleIP = "100.100.218.182";
-in {
+{config, ...}: {
   collinux = {
     user.name = "collin";
 
@@ -21,18 +19,16 @@ in {
       ip = "100.100.0.1";
       gateway = "100.100.0.1";
       privateKeyFile = config.collinux.secrets."wg-key".path;
-      peers = [
-        {
-          # mercury
+      peers = {
+        "mercury" = {
           publicKey = "EDDppGqbLfEwEcHLP3J+bxKVGW16fAcU83K/ZKR2h3A=";
           ip = "100.100.0.5/32";
-        }
-        {
-          # jupiter
+        };
+        "jupiter" = {
           publicKey = "Pi1PydaaEz9IcAZ+elH5HkzEa2D35P/tUy+9KKH6PHI=";
           ip = "100.100.0.10/32";
-        }
-      ];
+        };
+      };
     };
 
     terminal = {
@@ -59,10 +55,10 @@ in {
             gateway = "192.168.50.1";
           };
         };
-        tailscale = {
-          enable = true;
-          tailnet = "collinux.tailnet";
-        };
+        # tailscale = {
+        #   enable = true;
+        #   tailnet = "collinux.tailnet";
+        # };
         sshd = {
           enable = true;
           bind_host = "0.0.0.0";
@@ -77,15 +73,15 @@ in {
 
         forgejo = {
           enable = true;
-          bind_host = tailscaleIP;
+          bind_host = "127.0.0.1";
           root_url = "ganymede.collinux.tailnet:8010";
         };
 
-        headscale = {
-          enable = true;
-          root_url = "headscale.williamsfam.us.com";
-          caddy.enable = true;
-        };
+        # headscale = {
+        #   enable = true;
+        #   root_url = "headscale.williamsfam.us.com";
+        #   caddy.enable = true;
+        # };
       };
     };
   };
diff --git a/hosts/ganymede/nixos.nix b/hosts/ganymede/nixos.nix
index 9dc6dec..6680967 100644
--- a/hosts/ganymede/nixos.nix
+++ b/hosts/ganymede/nixos.nix
@@ -5,7 +5,6 @@
 }: {
   imports = [
     inputs.disko.nixosModules.disko
-    inputs.tsnsrv.nixosModules.default
     ./disks.nix
 
     ./minecraft.nix
diff --git a/hosts/mercury/config.nix b/hosts/mercury/config.nix
index f996be9..712c1aa 100644
--- a/hosts/mercury/config.nix
+++ b/hosts/mercury/config.nix
@@ -12,14 +12,13 @@
       ip = "100.100.0.5";
       gateway = "100.100.0.1";
       privateKeyFile = config.collinux.secrets."wg-key".path;
-      peers = [
-        {
-          # ganymede
+      peers = {
+        "ganymede" = {
           publicKey = "WNLf8M6JGSHeRVvbAF6E/6oxAHeNxv6bXqqlmwMdvlk=";
           ip = "100.100.0.0/24";
           endpoint = "williamsfam.us.com:51820";
-        }
-      ];
+        };
+      };
     };
 
     desktop = {
@@ -52,7 +51,7 @@
       networking = {
         enable = true;
         iwd.enable = true;
-        tailscale.enable = true;
+        # tailscale.enable = true;
       };
       bluetooth = {
         enable = true;
diff --git a/modules/desktop/options.nix b/modules/desktop/options.nix
index a4ba38d..5ba4423 100644
--- a/modules/desktop/options.nix
+++ b/modules/desktop/options.nix
@@ -62,7 +62,7 @@ in {
               name = "catppuccin-mocha-dark-cursors";
               package = pkgs.catppuccin-cursors.mochaDark;
             }
-            else if config.collinux.gtk.theme == "adwaita"
+            else if config.collinux.desktop.gtk.theme == "adwaita"
             then {
               name = "Vanilla-DMZ";
               package = pkgs.vanilla-dmz;
@@ -136,7 +136,7 @@ in {
         message = "Can't enable gdm and greetd at the same time";
       }
       {
-        assertion = with config.collinux.desktop.greetd; enable && !(autologin.enable && cosmic-greeter.enable);
+        assertion = with config.collinux.desktop.greetd; enable -> !(autologin.enable && cosmic-greeter.enable);
         message = "Can't use autologin and cosmic-greeter at the same time";
       }
     ];
diff --git a/modules/services/nixos/default.nix b/modules/services/nixos/default.nix
index db637e8..9c95180 100644
--- a/modules/services/nixos/default.nix
+++ b/modules/services/nixos/default.nix
@@ -4,7 +4,6 @@
     ./audio.nix
     ./bluetooth.nix
     ./tailscale.nix
-    ./wireguard
     ./selfhost
     ./ssh.nix
   ];
diff --git a/modules/services/nixos/networking/iwd.nix b/modules/services/nixos/networking/iwd.nix
index 910549c..fdd296a 100644
--- a/modules/services/nixos/networking/iwd.nix
+++ b/modules/services/nixos/networking/iwd.nix
@@ -23,5 +23,4 @@ in
       useDHCP = false;
       networkmanager.enable = false;
     };
-    systemd.network.enable = lib.mkForce false;
   }
diff --git a/modules/services/nixos/networking/networkmanager.nix b/modules/services/nixos/networking/networkmanager.nix
index 1bfe94e..e032bd0 100644
--- a/modules/services/nixos/networking/networkmanager.nix
+++ b/modules/services/nixos/networking/networkmanager.nix
@@ -14,10 +14,7 @@ in
       };
 
       dhcpcd.enable = false;
-      useNetworkd = false;
     };
 
-    systemd.network.enable = false;
-
     services.tailscale.extraSetFlags = lib.optional config.collinux.services.networking.tailscale.enable "--accept-dns=true";
   }
diff --git a/modules/services/nixos/wireguard/client.nix b/modules/services/nixos/wireguard/client.nix
deleted file mode 100644
index ec41ad5..0000000
--- a/modules/services/nixos/wireguard/client.nix
+++ /dev/null
@@ -1,50 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}: let
-  cfg = config.collinux.services.networking.wireguard;
-in
-  lib.mkIf (cfg.enable && cfg.localPeer.role == "spoke") {
-    boot.extraModulePackages = [config.boot.kernelPackages.wireguard];
-
-    # we know the machine is configured to use networkd already
-    systemd.network = {
-      netdevs = {
-        "10-wg0" = {
-          netdevConfig = {
-            Kind = "wireguard";
-            Name = "wg0";
-          };
-
-          wireguardConfig = {
-            PrivateKeyFile = cfg.privateKeyFile;
-            ListenPort = 51820;
-          };
-
-          wireguardPeers = [
-            {
-              PublicKey = ""; # will configure later
-              AllowedIPs = ["100.100.0.1"];
-              Endpoint = "williamsfam.us.com:51820"; # not configured yet
-            }
-          ];
-        };
-      };
-
-      networks."12-wireguard" = {
-        name = "wg0";
-
-        networkConfig = {
-          Address = cfg.ip;
-          Gateway = "100.100.0.1";
-          DHCP = "no";
-
-          # disable ipv6 addresses
-          IPv6AcceptRA = "no";
-          IPv6PrivacyExtensions = "no";
-          LinkLocalAddressing = "no";
-        };
-      };
-    };
-  }
diff --git a/modules/services/nixos/wireguard/default.nix b/modules/services/nixos/wireguard/default.nix
deleted file mode 100644
index f7ecff0..0000000
--- a/modules/services/nixos/wireguard/default.nix
+++ /dev/null
@@ -1,6 +0,0 @@
-{
-  imports = [
-    ./client.nix
-    ./server.nix
-  ];
-}
diff --git a/modules/services/options.nix b/modules/services/options.nix
index 085895e..b2cc24e 100644
--- a/modules/services/options.nix
+++ b/modules/services/options.nix
@@ -132,18 +132,6 @@ in {
         assertion = with config.collinux.services.networking; (iwd.enable && !networkmanager.enable && !networkd.enable) || (!iwd.enable && networkmanager.enable && !networkd.enable) || (!iwd.enable && !networkmanager.enable && networkd.enable);
         message = "only one networking method (iwd, networkmanager, networkd) can be active";
       }
-      {
-        assertion = with config.collinux.services.networking; !(wireguard.enable && tailscale.enable);
-        message = "only one vpn method (tailscale, wireguard) can be active";
-      }
-      {
-        assertion = with config.collinux.services.networking; wireguard.enable && !networkd.enable;
-        message = "wireguard configuration only supports networkd at the moment";
-      }
-      {
-        assertion = with config.collinux.services.networking.wireguard; enable && (peersConfig |> (builtins.filter (m: m.role == "hub")) |> lib.count) == 1;
-        message = "there must be exactly one hub in the wireguard configuration";
-      }
     ];
   };
 }
diff --git a/modules/wireguard/nixos/default.nix b/modules/wireguard/nixos/default.nix
index 6f51ddf..ada218a 100644
--- a/modules/wireguard/nixos/default.nix
+++ b/modules/wireguard/nixos/default.nix
@@ -6,11 +6,10 @@
   cfg = config.collinux.wireguard;
 in
   lib.mkIf cfg.enable {
-    boot.extraModulePackages = [config.boot.kernelPackages.wireguard];
-    boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
-
     networking.useNetworkd = true;
     systemd.network = {
+      enable = true;
+
       netdevs."10-wg" = {
         netdevConfig = {
           Kind = "wireguard";
@@ -23,12 +22,13 @@ in
         };
 
         wireguardPeers =
-          builtins.map (m: {
+          cfg.peers
+          |> builtins.mapAttrs (_: m: {
             PublicKey = m.publicKey;
             AllowedIPs = [m.ip];
             Endpoint = m.endpoint;
           })
-          cfg.peers;
+          |> builtins.attrValues;
       };
 
       networks."12-wireguard" = {
@@ -39,8 +39,6 @@ in
           DHCP = "no";
           Gateway = cfg.gateway;
 
-          IPMasquerade = "ipv4";
-          IPv4Forwarding = true;
           IPv6AcceptRA = false;
         };
       };
diff --git a/modules/wireguard/options.nix b/modules/wireguard/options.nix
index 8e5398e..94d62e9 100644
--- a/modules/wireguard/options.nix
+++ b/modules/wireguard/options.nix
@@ -29,7 +29,7 @@ in {
               description = "peer's IP address";
             };
             endpoint = mkOption {
-              type = lib.types.str;
+              type = lib.types.nullOr lib.types.str;
               description = "peer's endpoint";
             };
           };