cooking

modules/services/wireguard.nix

@@ -0,0 +1,88 @@
+{
+  pkgs,
+  lib,
+  config,
+  instanceConfigs,
+  instanceConfig,
+  ...
+}:
+let
+  cfg = config.xyno.services.wireguard;
+  ula = "fd68:b6a4:36e4";
+  ulaPrefix = "${ula}:1337"; # /64 for normal vpn
+  monitoringUlaPrefix = "${ula}:2337"; # /64 for monitoring
+
+  # uses a hash digest as the host identifier
+  genUlaForHost =
+    prefix: hostName:
+    let
+      hostHash = builtins.hashString "sha512" hostName;
+      localParts = map (n: builtins.substring (n * 4) 4 hostHash) hostHash;
+      localPart = lib.concatStringsSep ":" localParts;
+    in
+    "${prefix}:${localPart}";
+  # peers list for networkd
+  wgPeers = map (
+    c:
+    (
+      (lib.optionals (lib.hasAttr c "publicHostname") {
+        # if peer is publicly on the internet
+        AllowedIPs =
+          (lib.optionals (c.wgServer) [
+            "${ulaPrefix}::/48" # all traffic in the ula shall be sent to the server
+          ])
+          ++ (lib.optionals (!c.wgServer) [
+            "${genUlaForHost ulaPrefix c.hostName}/128" # if a host is reachable but shouldn't play server, send only to the hosts ip
+          ]);
+        Endpoint = "${c.publicHostname}:51820";
+        PersistentKeepalive = 25;
+        PublicKey = c.wgPubKey;
+      })
+      ++ (lib.optionals (!(lib.hasAttr c "publicHostname") && instanceConfig.wgServer && (lib.hasAttr c "wgPubKey")) {
+        # if this is the server and the peer isn't reachable on the internet
+        AllowedIPs = [
+          "${genUlaForHost ulaPrefix c.hostName}/128"
+          "${genUlaForHost monitoringUlaPrefix c.hostName}/128"
+        ];
+        PublicKey = c.wgPubKey;
+        # TODO: preshared keys
+      })
+    )
+  ) instanceConfigs;
+in
+{
+  options.xyno.services.wireguard.enable = lib.mkEnableOption "enables wireguard";
+  options.xyno.services.wireguard.hostsDomain = lib.mkOpion { type = lib.types.str; default = "wg.hailsatan.eu"; };
+  config = lib.mkIf cfg.enable {
+    xyno.services.monitoring.ip = genUlaForHost monitoringUlaPrefix config.networking.hostName;
+    networking.hosts = lib.mapAttrs' (
+      n: v: {
+        name = "${v.hostName}.${cfg.hostsDomain}";
+        value = [ (genUlaForHost ulaPrefix v.hostName) ];
+      }
+    );
+    networking.firewall.allowedUDPPorts = lib.mkIf instanceConfig.wgServer [ 51820 ];
+    systemd.network.netdevs."wg0" = {
+      wireguardConfig = {
+        ListenPort = lib.mkIf instanceConfig.wgServer 51820;
+        PrivateKeyFile = config.sops.secrets.wg_privkey.path; # TODO
+      };
+      wireguardPeers = wgPeers;
+    };
+    systemd.network.networks."wg0" = {
+      matchConfig.Name = "wg0";
+      networkConfig = {
+        Description = "xyno wireguard";
+      };
+      address = [
+        "${(genUlaForHost ulaPrefix config.networking.hostName)}/128"
+        "${(genUlaForHost monitoringUlaPrefix config.networking.hostName)}/128"
+      ];
+    };
+
+    sops.secrets.wg_privkey = {
+      reloadUnits = [ "systemd-networkd.service" ];
+    };
+
+  };
+}