initial wireguard configuration

11 files changed, 171 insertions, 83 deletions

diff --git a/hosts/ganymede/config.nix b/hosts/ganymede/config.nix
index 50ef29a..297d7c6 100644
--- a/hosts/ganymede/config.nix
+++ b/hosts/ganymede/config.nix
@@ -5,6 +5,27 @@
     secrets = {
       "williams-psk".file = ./williams-psk.age;
       "caddy-env".file = ./caddy-env.age;
+
+      "wg-key".file = ./ganymede-wg-key.age;
+    };
+
+    wireguard = {
+      enable = true;
+      ip = "100.100.0.1";
+      gateway = "100.100.0.1";
+      privateKeyFile = config.collinux.secrets."wg-key".path;
+      peers = [
+        {
+          # mercury
+          publicKey = "EDDppGqbLfEwEcHLP3J+bxKVGW16fAcU83K/ZKR2h3A=";
+          ip = "100.100.0.5/32";
+        }
+        {
+          # jupiter
+          publicKey = "Pi1PydaaEz9IcAZ+elH5HkzEa2D35P/tUy+9KKH6PHI=";
+          ip = "100.100.0.10/32";
+        }
+      ];
     };
 
     terminal = {
diff --git a/hosts/ganymede/ganymede-wg-key.age b/hosts/ganymede/ganymede-wg-key.age
new file mode 100644
index 0000000..2ef8256
--- /dev/null
+++ b/hosts/ganymede/ganymede-wg-key.age
@@ -0,0 +1,5 @@
+age-encryption.org/v1
+-> ssh-ed25519 Jg4yWQ PMAfdBRZ9mLnral4UdHEtr3QWmk8j9lKek6XH8L6QCk
+B342qgV/kGHvIt3hm8Yyd0yw7nHJ1kqV3UGLREhWbKA
+--- mOBS3t1P5ZAIV8llDldbGC+F855Xy3Jd5V8tVrwisig
+��L\đ��g5���w��\̃�9	A:=
bL����n�O������c�"��<�J��O;wJ�[���.*��/��	0��
\ No newline at end of file
diff --git a/hosts/jupiter/config.nix b/hosts/jupiter/config.nix
index a0c1583..cd4df81 100644
--- a/hosts/jupiter/config.nix
+++ b/hosts/jupiter/config.nix
@@ -1,9 +1,28 @@
-{
+{config, ...}: {
   collinux = {
     theme = "adwaita";
 
     user.name = "collin";
 
+    secrets = {
+      "wg-key".file = ./jupiter-wg-key.age;
+    };
+
+    wireguard = {
+      enable = true;
+      ip = "100.100.0.10";
+      gateway = "100.100.0.1";
+      privateKeyFile = config.collinux.secrets."wg-key".path;
+      peers = [
+        {
+          # ganymede
+          publicKey = "WNLf8M6JGSHeRVvbAF6E/6oxAHeNxv6bXqqlmwMdvlk=";
+          ip = "100.100.0.0/24";
+          endpoint = "williamsfam.us.com:51820";
+        }
+      ];
+    };
+
     desktop = {
       gnome.enable = true;
       gdm.enable = true;
diff --git a/hosts/jupiter/jupiter-wg-key.age b/hosts/jupiter/jupiter-wg-key.age
new file mode 100644
index 0000000..1c8bab8
--- /dev/null
+++ b/hosts/jupiter/jupiter-wg-key.age
@@ -0,0 +1,5 @@
+age-encryption.org/v1
+-> ssh-ed25519 cIV9vQ WnCpZXPYLOuQkCmFuWfbcZloVPGcQN/2qMyd0Mg0hGE
+oDN7vnXNXaDSIKXPa65Y0EvkOLv5W4IbEYOmGuGh2Ik
+--- kfOs0NCAbxF4jFiHbBMgXQEjpsdz6e0blKH38NLFJBw
+�|Ra)F���*���j�G�k[�#�����,ۚRN�7o�Tw�“\��JM��&��D�x���n�-�`�P]��rz
\ No newline at end of file
diff --git a/hosts/mercury/config.nix b/hosts/mercury/config.nix
index 9ee29d0..590698a 100644
--- a/hosts/mercury/config.nix
+++ b/hosts/mercury/config.nix
@@ -1,18 +1,34 @@
-{pkgs, ...}: {
+{config, ...}: {
   collinux = {
     theme = "catppuccin";
     user.name = "collin";
 
+    secrets = {
+      "wg-key".file = ./mercury-wg-key.age;
+    };
+
+    wireguard = {
+      enable = true;
+      ip = "100.100.0.5";
+      gateway = "100.100.0.1";
+      privateKeyFile = config.collinux.secrets."wg-key".path;
+      peers = [
+        {
+          # ganymede
+          publicKey = "WNLf8M6JGSHeRVvbAF6E/6oxAHeNxv6bXqqlmwMdvlk=";
+          ip = "100.100.0.0/24";
+          endpoint = "williamsfam.us.com:51820";
+        }
+      ];
+    };
+
     desktop = {
       wallpaper = ./wallpaper.jpg;
 
-      # gtk.enable = true;
-
       greetd.enable = true;
 
       wm = {
-        # sway.enable = true;
-        niri.enable = true;
+        sway.enable = true;
         components.fuzzel.enable = true;
         components.dunst.enable = true;
       };
diff --git a/hosts/mercury/mercury-wg-key.age b/hosts/mercury/mercury-wg-key.age
new file mode 100644
index 0000000..397f99c
--- /dev/null
+++ b/hosts/mercury/mercury-wg-key.age
@@ -0,0 +1,6 @@
+age-encryption.org/v1
+-> ssh-ed25519 azBilg t589gal+hWbEiNH9vFQFb94UU2ElhLUwBpSg+6516wg
+ZmRj3LLDctDPpDKGg3HvI4r7Ex6Sf0ERcPJlqUJXv0w
+--- IpOHjk3TkNRT8aW1ocgCie/ljv/sWWFRuaYGhxlf948
+0��:��,̅��������;ǛTɿ��NR���Akll�
D�����:�5%�{���.��
+V8��Ƀ�8nBR��
\ No newline at end of file
diff --git a/hosts/wg_peers.nix b/hosts/wg_peers.nix
deleted file mode 100644
index 36fb465..0000000
--- a/hosts/wg_peers.nix
+++ /dev/null
@@ -1,39 +0,0 @@
-{
-  "ganymede" = {
-    hub = {
-      domain = "williamsfam.us.com";
-      port = 51823;
-
-      ip_addr = "100.100.0.2";
-      key = "";
-    };
-  };
-
-  "mercury" = {
-    spoke = {
-      ip_addr = "100.100.0.5";
-      key = "";
-    };
-  };
-
-  "jupiter" = {
-    spoke = {
-      ip_addr = "100.100.0.10";
-      key = "";
-    };
-  };
-
-  "terra" = {
-    spoke = {
-      ip_addr = "100.100.0.24";
-      key = "";
-    };
-  };
-
-  "uranus" = {
-    spoke = {
-      ip_addr = "100.100.0.45";
-      key = "";
-    };
-  };
-}
diff --git a/modules/services/options.nix b/modules/services/options.nix
index cae9e72..e87ecb3 100644
--- a/modules/services/options.nix
+++ b/modules/services/options.nix
@@ -32,44 +32,6 @@ in {
           };
         };
         tailscale.enable = mkEnableOption "tailscale";
-        wireguard = let
-          spokeOpts = {
-            ip = mkOption {
-              type = ip_addr;
-            };
-            key = mkOption {
-              type = lib.types.str;
-            };
-          };
-
-          hubOpts =
-            spokeOpts
-            // {
-              domain = mkOption {
-                type = lib.types.str;
-              };
-              port = mkOption {
-                type = lib.types.port;
-              };
-            };
-        in {
-          # based on https://www.procustodibus.com/blog/2020/11/wireguard-hub-and-spoke-config
-          enable = mkEnableOption "wireguard";
-
-          peersConfig = {
-            hub = mkOption {
-              type = lib.types.attrsOf (lib.types.submodule {options = hubOpts;});
-            };
-
-            spokes = mkOption {
-              type = lib.types.attrsOf (lib.types.submodule {options = spokeOpts;});
-            };
-          };
-
-          localPeer = mkOption {
-            type = lib.types.oneOf [hubOpts spokeOpts];
-          };
-        };
         sshd.enable = mkEnableOption "OpenSSH server";
       };
       audio = {
diff --git a/modules/wireguard/nixos/default.nix b/modules/wireguard/nixos/default.nix
new file mode 100644
index 0000000..6f51ddf
--- /dev/null
+++ b/modules/wireguard/nixos/default.nix
@@ -0,0 +1,48 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  cfg = config.collinux.wireguard;
+in
+  lib.mkIf cfg.enable {
+    boot.extraModulePackages = [config.boot.kernelPackages.wireguard];
+    boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
+
+    networking.useNetworkd = true;
+    systemd.network = {
+      netdevs."10-wg" = {
+        netdevConfig = {
+          Kind = "wireguard";
+          Name = "wg0";
+        };
+
+        wireguardConfig = {
+          PrivateKeyFile = cfg.privateKeyFile;
+          ListenPort = 51820;
+        };
+
+        wireguardPeers =
+          builtins.map (m: {
+            PublicKey = m.publicKey;
+            AllowedIPs = [m.ip];
+            Endpoint = m.endpoint;
+          })
+          cfg.peers;
+      };
+
+      networks."12-wireguard" = {
+        name = "wg0";
+
+        networkConfig = {
+          Address = cfg.ip;
+          DHCP = "no";
+          Gateway = cfg.gateway;
+
+          IPMasquerade = "ipv4";
+          IPv4Forwarding = true;
+          IPv6AcceptRA = false;
+        };
+      };
+    };
+  }
diff --git a/modules/wireguard/options.nix b/modules/wireguard/options.nix
new file mode 100644
index 0000000..8e5398e
--- /dev/null
+++ b/modules/wireguard/options.nix
@@ -0,0 +1,40 @@
+{lib, ...}: let
+  inherit (lib) mkOption mkEnableOption;
+in {
+  options = {
+    collinux.wireguard = {
+      enable = mkEnableOption "wireguard";
+      ip = mkOption {
+        type = lib.types.str;
+        description = "host's ip address on the wireguard network (with cidr)";
+      };
+      gateway = mkOption {
+        type = lib.types.str;
+        description = "host's gateway";
+      };
+      privateKeyFile = mkOption {
+        type = lib.types.str;
+        description = "path to local private key file";
+        example = "/run/secretd.d/wireguard-key";
+      };
+      peers = mkOption {
+        type = lib.types.attrsOf (lib.types.submodule {
+          options = {
+            publicKey = mkOption {
+              type = lib.types.str;
+              description = "peer's public key";
+            };
+            ip = mkOption {
+              type = lib.types.str;
+              description = "peer's IP address";
+            };
+            endpoint = mkOption {
+              type = lib.types.str;
+              description = "peer's endpoint";
+            };
+          };
+        });
+      };
+    };
+  };
+}
diff --git a/secrets.nix b/secrets.nix
index 3dc8491..1bcca44 100644
--- a/secrets.nix
+++ b/secrets.nix
@@ -7,4 +7,9 @@ in {
   "caddy-env.age".publicKeys = [ganymede];
   "williams-psk.age".publicKeys = [ganymede];
   "github-ssh-key.age".publicKeys = [mercury jupiter];
+
+  # wireguard keys
+  "mercury-wg-key.age".publicKeys = [mercury];
+  "jupiter-wg-key.age".publicKeys = [jupiter];
+  "ganymede-wg-key.age".publicKeys = [ganymede];
 }