6 files changed, 157 insertions, 1 deletions
diff --git a/modules/services/nixos/default.nix b/modules/services/nixos/default.nix
index 9c95180..db637e8 100644
--- a/modules/services/nixos/default.nix
+++ b/modules/services/nixos/default.nix
@@ -4,6 +4,7 @@
     ./audio.nix
     ./bluetooth.nix
     ./tailscale.nix
+    ./wireguard
     ./selfhost
     ./ssh.nix
   ];
diff --git a/modules/services/nixos/wireguard/client.nix b/modules/services/nixos/wireguard/client.nix
new file mode 100644
index 0000000..ec41ad5
--- /dev/null
+++ b/modules/services/nixos/wireguard/client.nix
@@ -0,0 +1,50 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  cfg = config.collinux.services.networking.wireguard;
+in
+  lib.mkIf (cfg.enable && cfg.localPeer.role == "spoke") {
+    boot.extraModulePackages = [config.boot.kernelPackages.wireguard];
+
+    # we know the machine is configured to use networkd already
+    systemd.network = {
+      netdevs = {
+        "10-wg0" = {
+          netdevConfig = {
+            Kind = "wireguard";
+            Name = "wg0";
+          };
+
+          wireguardConfig = {
+            PrivateKeyFile = cfg.privateKeyFile;
+            ListenPort = 51820;
+          };
+
+          wireguardPeers = [
+            {
+              PublicKey = ""; # will configure later
+              AllowedIPs = ["100.100.0.1"];
+              Endpoint = "williamsfam.us.com:51820"; # not configured yet
+            }
+          ];
+        };
+      };
+
+      networks."12-wireguard" = {
+        name = "wg0";
+
+        networkConfig = {
+          Address = cfg.ip;
+          Gateway = "100.100.0.1";
+          DHCP = "no";
+
+          # disable ipv6 addresses
+          IPv6AcceptRA = "no";
+          IPv6PrivacyExtensions = "no";
+          LinkLocalAddressing = "no";
+        };
+      };
+    };
+  }
diff --git a/modules/services/nixos/wireguard/default.nix b/modules/services/nixos/wireguard/default.nix
new file mode 100644
index 0000000..f7ecff0
--- /dev/null
+++ b/modules/services/nixos/wireguard/default.nix
@@ -0,0 +1,6 @@
+{
+  imports = [
+    ./client.nix
+    ./server.nix
+  ];
+}
diff --git a/modules/services/options.nix b/modules/services/options.nix
index 231c949..085895e 100644
--- a/modules/services/options.nix
+++ b/modules/services/options.nix
@@ -47,7 +47,6 @@ in {
         };
 
         tailscale.enable = mkEnableOption "tailscale";
-
         sshd = {
           enable = mkEnableOption "OpenSSH server";
           bind_host = mkOption {
@@ -133,6 +132,18 @@ in {
         assertion = with config.collinux.services.networking; (iwd.enable && !networkmanager.enable && !networkd.enable) || (!iwd.enable && networkmanager.enable && !networkd.enable) || (!iwd.enable && !networkmanager.enable && networkd.enable);
         message = "only one networking method (iwd, networkmanager, networkd) can be active";
       }
+      {
+        assertion = with config.collinux.services.networking; !(wireguard.enable && tailscale.enable);
+        message = "only one vpn method (tailscale, wireguard) can be active";
+      }
+      {
+        assertion = with config.collinux.services.networking; wireguard.enable && !networkd.enable;
+        message = "wireguard configuration only supports networkd at the moment";
+      }
+      {
+        assertion = with config.collinux.services.networking.wireguard; enable && (peersConfig |> (builtins.filter (m: m.role == "hub")) |> lib.count) == 1;
+        message = "there must be exactly one hub in the wireguard configuration";
+      }
     ];
   };
 }
diff --git a/modules/wireguard/nixos/default.nix b/modules/wireguard/nixos/default.nix
new file mode 100644
index 0000000..6f51ddf
--- /dev/null
+++ b/modules/wireguard/nixos/default.nix
@@ -0,0 +1,48 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  cfg = config.collinux.wireguard;
+in
+  lib.mkIf cfg.enable {
+    boot.extraModulePackages = [config.boot.kernelPackages.wireguard];
+    boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
+
+    networking.useNetworkd = true;
+    systemd.network = {
+      netdevs."10-wg" = {
+        netdevConfig = {
+          Kind = "wireguard";
+          Name = "wg0";
+        };
+
+        wireguardConfig = {
+          PrivateKeyFile = cfg.privateKeyFile;
+          ListenPort = 51820;
+        };
+
+        wireguardPeers =
+          builtins.map (m: {
+            PublicKey = m.publicKey;
+            AllowedIPs = [m.ip];
+            Endpoint = m.endpoint;
+          })
+          cfg.peers;
+      };
+
+      networks."12-wireguard" = {
+        name = "wg0";
+
+        networkConfig = {
+          Address = cfg.ip;
+          DHCP = "no";
+          Gateway = cfg.gateway;
+
+          IPMasquerade = "ipv4";
+          IPv4Forwarding = true;
+          IPv6AcceptRA = false;
+        };
+      };
+    };
+  }
diff --git a/modules/wireguard/options.nix b/modules/wireguard/options.nix
new file mode 100644
index 0000000..8e5398e
--- /dev/null
+++ b/modules/wireguard/options.nix
@@ -0,0 +1,40 @@
+{lib, ...}: let
+  inherit (lib) mkOption mkEnableOption;
+in {
+  options = {
+    collinux.wireguard = {
+      enable = mkEnableOption "wireguard";
+      ip = mkOption {
+        type = lib.types.str;
+        description = "host's ip address on the wireguard network (with cidr)";
+      };
+      gateway = mkOption {
+        type = lib.types.str;
+        description = "host's gateway";
+      };
+      privateKeyFile = mkOption {
+        type = lib.types.str;
+        description = "path to local private key file";
+        example = "/run/secretd.d/wireguard-key";
+      };
+      peers = mkOption {
+        type = lib.types.attrsOf (lib.types.submodule {
+          options = {
+            publicKey = mkOption {
+              type = lib.types.str;
+              description = "peer's public key";
+            };
+            ip = mkOption {
+              type = lib.types.str;
+              description = "peer's IP address";
+            };
+            endpoint = mkOption {
+              type = lib.types.str;
+              description = "peer's endpoint";
+            };
+          };
+        });
+      };
+    };
+  };
+}