diff options
| -rw-r--r-- | hosts/wg_peers.nix | 39 | ||||
| -rw-r--r-- | modules/services/nixos/default.nix | 1 | ||||
| -rw-r--r-- | modules/services/nixos/wireguard/client.nix | 50 | ||||
| -rw-r--r-- | modules/services/nixos/wireguard/default.nix | 6 | ||||
| -rw-r--r-- | modules/services/options.nix | 51 |
5 files changed, 146 insertions, 1 deletions
diff --git a/hosts/wg_peers.nix b/hosts/wg_peers.nix new file mode 100644 index 0000000..36fb465 --- /dev/null +++ b/hosts/wg_peers.nix @@ -0,0 +1,39 @@ +{ + "ganymede" = { + hub = { + domain = "williamsfam.us.com"; + port = 51823; + + ip_addr = "100.100.0.2"; + key = ""; + }; + }; + + "mercury" = { + spoke = { + ip_addr = "100.100.0.5"; + key = ""; + }; + }; + + "jupiter" = { + spoke = { + ip_addr = "100.100.0.10"; + key = ""; + }; + }; + + "terra" = { + spoke = { + ip_addr = "100.100.0.24"; + key = ""; + }; + }; + + "uranus" = { + spoke = { + ip_addr = "100.100.0.45"; + key = ""; + }; + }; +} diff --git a/modules/services/nixos/default.nix b/modules/services/nixos/default.nix index 9c95180..db637e8 100644 --- a/modules/services/nixos/default.nix +++ b/modules/services/nixos/default.nix @@ -4,6 +4,7 @@ ./audio.nix ./bluetooth.nix ./tailscale.nix + ./wireguard ./selfhost ./ssh.nix ]; diff --git a/modules/services/nixos/wireguard/client.nix b/modules/services/nixos/wireguard/client.nix new file mode 100644 index 0000000..ec41ad5 --- /dev/null +++ b/modules/services/nixos/wireguard/client.nix @@ -0,0 +1,50 @@ +{ + config, + lib, + ... +}: let + cfg = config.collinux.services.networking.wireguard; +in + lib.mkIf (cfg.enable && cfg.localPeer.role == "spoke") { + boot.extraModulePackages = [config.boot.kernelPackages.wireguard]; + + # we know the machine is configured to use networkd already + systemd.network = { + netdevs = { + "10-wg0" = { + netdevConfig = { + Kind = "wireguard"; + Name = "wg0"; + }; + + wireguardConfig = { + PrivateKeyFile = cfg.privateKeyFile; + ListenPort = 51820; + }; + + wireguardPeers = [ + { + PublicKey = ""; # will configure later + AllowedIPs = ["100.100.0.1"]; + Endpoint = "williamsfam.us.com:51820"; # not configured yet + } + ]; + }; + }; + + networks."12-wireguard" = { + name = "wg0"; + + networkConfig = { + Address = cfg.ip; + Gateway = "100.100.0.1"; + DHCP = "no"; + + # disable ipv6 addresses + IPv6AcceptRA = "no"; + IPv6PrivacyExtensions = "no"; + LinkLocalAddressing = "no"; + }; + }; + }; + } diff --git a/modules/services/nixos/wireguard/default.nix b/modules/services/nixos/wireguard/default.nix new file mode 100644 index 0000000..f7ecff0 --- /dev/null +++ b/modules/services/nixos/wireguard/default.nix @@ -0,0 +1,6 @@ +{ + imports = [ + ./client.nix + ./server.nix + ]; +} diff --git a/modules/services/options.nix b/modules/services/options.nix index f42dd12..cae9e72 100644 --- a/modules/services/options.nix +++ b/modules/services/options.nix @@ -32,12 +32,49 @@ in { }; }; tailscale.enable = mkEnableOption "tailscale"; + wireguard = let + spokeOpts = { + ip = mkOption { + type = ip_addr; + }; + key = mkOption { + type = lib.types.str; + }; + }; + + hubOpts = + spokeOpts + // { + domain = mkOption { + type = lib.types.str; + }; + port = mkOption { + type = lib.types.port; + }; + }; + in { + # based on https://www.procustodibus.com/blog/2020/11/wireguard-hub-and-spoke-config + enable = mkEnableOption "wireguard"; + + peersConfig = { + hub = mkOption { + type = lib.types.attrsOf (lib.types.submodule {options = hubOpts;}); + }; + + spokes = mkOption { + type = lib.types.attrsOf (lib.types.submodule {options = spokeOpts;}); + }; + }; + + localPeer = mkOption { + type = lib.types.oneOf [hubOpts spokeOpts]; + }; + }; sshd.enable = mkEnableOption "OpenSSH server"; }; audio = { enable = mkEnableOption "pipewire + wireplumber"; pulse.enable = mkEnableOption "pipewire-pulse"; - # some config to make audio work with wine (TODO for jupiter) }; bluetooth = { enable = mkEnableOption "bluetooth"; @@ -97,6 +134,18 @@ in { assertion = with config.collinux.services.networking; (iwd.enable && !networkmanager.enable && !networkd.enable) || (!iwd.enable && networkmanager.enable && !networkd.enable) || (!iwd.enable && !networkmanager.enable && networkd.enable); message = "only one networking method (iwd, networkmanager, static) can be active"; } + { + assertion = with config.collinux.services.networking; !(wireguard.enable && tailscale.enable); + message = "only one vpn method (tailscale, wireguard) can be active"; + } + { + assertion = with config.collinux.services.networking; wireguard.enable && !networkd.enable; + message = "wireguard configuration only supports networkd at the moment"; + } + { + assertion = with config.collinux.services.networking.wireguard; enable && (peersConfig |> (builtins.filter (m: m.role == "hub")) |> lib.count) == 1; + message = "there must be exactly one hub in the wireguard configuration"; + } ]; }; } |