diff options
| -rw-r--r-- | hosts/ganymede/config.nix | 22 | ||||
| -rw-r--r-- | hosts/ganymede/ganymede-wg-key.age | 5 | ||||
| -rw-r--r-- | hosts/jupiter/config.nix | 21 | ||||
| -rw-r--r-- | hosts/jupiter/jupiter-wg-key.age | 5 | ||||
| -rw-r--r-- | hosts/mercury/config.nix | 21 | ||||
| -rw-r--r-- | hosts/mercury/mercury-wg-key.age | 6 | ||||
| -rw-r--r-- | modules/services/nixos/default.nix | 1 | ||||
| -rw-r--r-- | modules/services/nixos/wireguard/client.nix | 50 | ||||
| -rw-r--r-- | modules/services/nixos/wireguard/default.nix | 6 | ||||
| -rw-r--r-- | modules/services/options.nix | 13 | ||||
| -rw-r--r-- | modules/wireguard/nixos/default.nix | 48 | ||||
| -rw-r--r-- | modules/wireguard/options.nix | 40 | ||||
| -rw-r--r-- | secrets.nix | 5 |
13 files changed, 240 insertions, 3 deletions
diff --git a/hosts/ganymede/config.nix b/hosts/ganymede/config.nix index 0d3f15e..f6b3b74 100644 --- a/hosts/ganymede/config.nix +++ b/hosts/ganymede/config.nix @@ -9,8 +9,30 @@ in { file = ./williams-psk.age; owner = "wpa_supplicant"; }; + "caddy-env".file = ./caddy-env.age; "tsnsrv-authkey".file = ./tsnsrv-authkey.age; + + "wg-key".file = ./ganymede-wg-key.age; + }; + + wireguard = { + enable = true; + ip = "100.100.0.1"; + gateway = "100.100.0.1"; + privateKeyFile = config.collinux.secrets."wg-key".path; + peers = [ + { + # mercury + publicKey = "EDDppGqbLfEwEcHLP3J+bxKVGW16fAcU83K/ZKR2h3A="; + ip = "100.100.0.5/32"; + } + { + # jupiter + publicKey = "Pi1PydaaEz9IcAZ+elH5HkzEa2D35P/tUy+9KKH6PHI="; + ip = "100.100.0.10/32"; + } + ]; }; terminal = { diff --git a/hosts/ganymede/ganymede-wg-key.age b/hosts/ganymede/ganymede-wg-key.age new file mode 100644 index 0000000..2ef8256 --- /dev/null +++ b/hosts/ganymede/ganymede-wg-key.age @@ -0,0 +1,5 @@ +age-encryption.org/v1 +-> ssh-ed25519 Jg4yWQ PMAfdBRZ9mLnral4UdHEtr3QWmk8j9lKek6XH8L6QCk +B342qgV/kGHvIt3hm8Yyd0yw7nHJ1kqV3UGLREhWbKA +--- mOBS3t1P5ZAIV8llDldbGC+F855Xy3Jd5V8tVrwisig +L\đg5w\̃9 A:=
bLnOc"<JO;wJ[ .*/ 0
\ No newline at end of file diff --git a/hosts/jupiter/config.nix b/hosts/jupiter/config.nix index decaa61..806785e 100644 --- a/hosts/jupiter/config.nix +++ b/hosts/jupiter/config.nix @@ -1,9 +1,28 @@ -{ +{config, ...}: { collinux = { theme = "adwaita"; user.name = "collin"; + secrets = { + "wg-key".file = ./jupiter-wg-key.age; + }; + + wireguard = { + enable = true; + ip = "100.100.0.10"; + gateway = "100.100.0.1"; + privateKeyFile = config.collinux.secrets."wg-key".path; + peers = [ + { + # ganymede + publicKey = "WNLf8M6JGSHeRVvbAF6E/6oxAHeNxv6bXqqlmwMdvlk="; + ip = "100.100.0.0/24"; + endpoint = "williamsfam.us.com:51820"; + } + ]; + }; + desktop = { gnome.enable = true; gdm.enable = true; diff --git a/hosts/jupiter/jupiter-wg-key.age b/hosts/jupiter/jupiter-wg-key.age new file mode 100644 index 0000000..1c8bab8 --- /dev/null +++ b/hosts/jupiter/jupiter-wg-key.age @@ -0,0 +1,5 @@ +age-encryption.org/v1 +-> ssh-ed25519 cIV9vQ WnCpZXPYLOuQkCmFuWfbcZloVPGcQN/2qMyd0Mg0hGE +oDN7vnXNXaDSIKXPa65Y0EvkOLv5W4IbEYOmGuGh2Ik +--- kfOs0NCAbxF4jFiHbBMgXQEjpsdz6e0blKH38NLFJBw +|Ra)F*jGk[#,ۚRN7oTw\JM &Dxn-`P]rz
\ No newline at end of file diff --git a/hosts/mercury/config.nix b/hosts/mercury/config.nix index e9c7d9e..f996be9 100644 --- a/hosts/mercury/config.nix +++ b/hosts/mercury/config.nix @@ -1,8 +1,27 @@ -{ +{config, ...}: { collinux = { theme = "catppuccin"; user.name = "collin"; + secrets = { + "wg-key".file = ./mercury-wg-key.age; + }; + + wireguard = { + enable = true; + ip = "100.100.0.5"; + gateway = "100.100.0.1"; + privateKeyFile = config.collinux.secrets."wg-key".path; + peers = [ + { + # ganymede + publicKey = "WNLf8M6JGSHeRVvbAF6E/6oxAHeNxv6bXqqlmwMdvlk="; + ip = "100.100.0.0/24"; + endpoint = "williamsfam.us.com:51820"; + } + ]; + }; + desktop = { wallpaper = ./wallpapers/abstract-swirls.jpg; gtk.enable = true; diff --git a/hosts/mercury/mercury-wg-key.age b/hosts/mercury/mercury-wg-key.age new file mode 100644 index 0000000..397f99c --- /dev/null +++ b/hosts/mercury/mercury-wg-key.age @@ -0,0 +1,6 @@ +age-encryption.org/v1 +-> ssh-ed25519 azBilg t589gal+hWbEiNH9vFQFb94UU2ElhLUwBpSg+6516wg +ZmRj3LLDctDPpDKGg3HvI4r7Ex6Sf0ERcPJlqUJXv0w +--- IpOHjk3TkNRT8aW1ocgCie/ljv/sWWFRuaYGhxlf948 +0:,̅;ǛTɿ NRAkllD:5%{.Й +V8Ƀ8nBR
\ No newline at end of file diff --git a/modules/services/nixos/default.nix b/modules/services/nixos/default.nix index 9c95180..db637e8 100644 --- a/modules/services/nixos/default.nix +++ b/modules/services/nixos/default.nix @@ -4,6 +4,7 @@ ./audio.nix ./bluetooth.nix ./tailscale.nix + ./wireguard ./selfhost ./ssh.nix ]; diff --git a/modules/services/nixos/wireguard/client.nix b/modules/services/nixos/wireguard/client.nix new file mode 100644 index 0000000..ec41ad5 --- /dev/null +++ b/modules/services/nixos/wireguard/client.nix @@ -0,0 +1,50 @@ +{ + config, + lib, + ... +}: let + cfg = config.collinux.services.networking.wireguard; +in + lib.mkIf (cfg.enable && cfg.localPeer.role == "spoke") { + boot.extraModulePackages = [config.boot.kernelPackages.wireguard]; + + # we know the machine is configured to use networkd already + systemd.network = { + netdevs = { + "10-wg0" = { + netdevConfig = { + Kind = "wireguard"; + Name = "wg0"; + }; + + wireguardConfig = { + PrivateKeyFile = cfg.privateKeyFile; + ListenPort = 51820; + }; + + wireguardPeers = [ + { + PublicKey = ""; # will configure later + AllowedIPs = ["100.100.0.1"]; + Endpoint = "williamsfam.us.com:51820"; # not configured yet + } + ]; + }; + }; + + networks."12-wireguard" = { + name = "wg0"; + + networkConfig = { + Address = cfg.ip; + Gateway = "100.100.0.1"; + DHCP = "no"; + + # disable ipv6 addresses + IPv6AcceptRA = "no"; + IPv6PrivacyExtensions = "no"; + LinkLocalAddressing = "no"; + }; + }; + }; + } diff --git a/modules/services/nixos/wireguard/default.nix b/modules/services/nixos/wireguard/default.nix new file mode 100644 index 0000000..f7ecff0 --- /dev/null +++ b/modules/services/nixos/wireguard/default.nix @@ -0,0 +1,6 @@ +{ + imports = [ + ./client.nix + ./server.nix + ]; +} diff --git a/modules/services/options.nix b/modules/services/options.nix index 231c949..085895e 100644 --- a/modules/services/options.nix +++ b/modules/services/options.nix @@ -47,7 +47,6 @@ in { }; tailscale.enable = mkEnableOption "tailscale"; - sshd = { enable = mkEnableOption "OpenSSH server"; bind_host = mkOption { @@ -133,6 +132,18 @@ in { assertion = with config.collinux.services.networking; (iwd.enable && !networkmanager.enable && !networkd.enable) || (!iwd.enable && networkmanager.enable && !networkd.enable) || (!iwd.enable && !networkmanager.enable && networkd.enable); message = "only one networking method (iwd, networkmanager, networkd) can be active"; } + { + assertion = with config.collinux.services.networking; !(wireguard.enable && tailscale.enable); + message = "only one vpn method (tailscale, wireguard) can be active"; + } + { + assertion = with config.collinux.services.networking; wireguard.enable && !networkd.enable; + message = "wireguard configuration only supports networkd at the moment"; + } + { + assertion = with config.collinux.services.networking.wireguard; enable && (peersConfig |> (builtins.filter (m: m.role == "hub")) |> lib.count) == 1; + message = "there must be exactly one hub in the wireguard configuration"; + } ]; }; } diff --git a/modules/wireguard/nixos/default.nix b/modules/wireguard/nixos/default.nix new file mode 100644 index 0000000..6f51ddf --- /dev/null +++ b/modules/wireguard/nixos/default.nix @@ -0,0 +1,48 @@ +{ + config, + lib, + ... +}: let + cfg = config.collinux.wireguard; +in + lib.mkIf cfg.enable { + boot.extraModulePackages = [config.boot.kernelPackages.wireguard]; + boot.kernel.sysctl."net.ipv4.ip_forward" = 1; + + networking.useNetworkd = true; + systemd.network = { + netdevs."10-wg" = { + netdevConfig = { + Kind = "wireguard"; + Name = "wg0"; + }; + + wireguardConfig = { + PrivateKeyFile = cfg.privateKeyFile; + ListenPort = 51820; + }; + + wireguardPeers = + builtins.map (m: { + PublicKey = m.publicKey; + AllowedIPs = [m.ip]; + Endpoint = m.endpoint; + }) + cfg.peers; + }; + + networks."12-wireguard" = { + name = "wg0"; + + networkConfig = { + Address = cfg.ip; + DHCP = "no"; + Gateway = cfg.gateway; + + IPMasquerade = "ipv4"; + IPv4Forwarding = true; + IPv6AcceptRA = false; + }; + }; + }; + } diff --git a/modules/wireguard/options.nix b/modules/wireguard/options.nix new file mode 100644 index 0000000..8e5398e --- /dev/null +++ b/modules/wireguard/options.nix @@ -0,0 +1,40 @@ +{lib, ...}: let + inherit (lib) mkOption mkEnableOption; +in { + options = { + collinux.wireguard = { + enable = mkEnableOption "wireguard"; + ip = mkOption { + type = lib.types.str; + description = "host's ip address on the wireguard network (with cidr)"; + }; + gateway = mkOption { + type = lib.types.str; + description = "host's gateway"; + }; + privateKeyFile = mkOption { + type = lib.types.str; + description = "path to local private key file"; + example = "/run/secretd.d/wireguard-key"; + }; + peers = mkOption { + type = lib.types.attrsOf (lib.types.submodule { + options = { + publicKey = mkOption { + type = lib.types.str; + description = "peer's public key"; + }; + ip = mkOption { + type = lib.types.str; + description = "peer's IP address"; + }; + endpoint = mkOption { + type = lib.types.str; + description = "peer's endpoint"; + }; + }; + }); + }; + }; + }; +} diff --git a/secrets.nix b/secrets.nix index d0a5ffb..d95f27a 100644 --- a/secrets.nix +++ b/secrets.nix @@ -8,4 +8,9 @@ in { "tsnsrv-authkey.age".publicKeys = [ganymede mercury]; "williams-psk.age".publicKeys = [ganymede]; "github-ssh-key.age".publicKeys = [mercury jupiter]; + + # wireguard keys + "mercury-wg-key.age".publicKeys = [mercury]; + "jupiter-wg-key.age".publicKeys = [jupiter]; + "ganymede-wg-key.age".publicKeys = [ganymede]; } |