update

modules/services/wireguard.nix

@@ -2,14 +2,13 @@
   pkgs,
   lib,
   config,
-  instanceConfigs,
-  instanceConfig,
+  otherNodes,
   ...
 }:
 with lib;
 let
-  wgServer = instanceConfig ? wg.server && instanceConfig.wg.server;
   cfg = config.xyno.services.wireguard;
+  wgServer = cfg.server;
   ula = cfg.ula;
   ulaPrefix = "${ula}:1337"; # /64 for normal vpn
   monitoringUlaPrefix = "${ula}:2337"; # /64 for monitoring
@@ -25,51 +24,50 @@ let
     in
     "${prefix}:${localPart}";
   # peers list for networkd
-  filteredConfigs = builtins.filter (x: x.hostName != config.networking.hostName) (
-    attrValues instanceConfigs
-  );
-  wgPeersLists = map (
+  wgPeersLists = attrValues (mapAttrs (
     c:
+    let
+      hasV4 = c.xyno.services.wireguard.v4 && cfg.v4;
+      isServer = c.xyno.services.wireguard.server;
+      publicHostname = c.deployment.targetHost;
+      pubKey = c.xyno.services.wireguard.pubKey;
+    in
     (
-      (optional (c ? publicHostname) {
+      (optional (publicHostname != null) {
         # if peer is publicly on the internet
         AllowedIPs =
-          (optionals (c ? wg.server && c.wg.server) [
-            # is server
+          (optionals (isServer) [
             "::/0"
           ])
-          ++ (optionals (c ? wg.server && c.wg.server && c ? wg.v4 && instanceConfig ? wg.v4) [
-            # both client and server have a v4
+          ++ (optionals (isServer && hasV4) [
             "0.0.0.0/0"
           ])
-          ++ (optionals (!c ? wg.server || !c.wg.server) [
-            # is not server
-            "${genUlaForHost ulaPrefix c.hostName}/128" # if a host is reachable but shouldn't play server, send only to the hosts ip
+          ++ (optionals (!isServer) [
+            "${genUlaForHost ulaPrefix c.networking.hostName}/128" # if a host is reachable but shouldn't play server, send only to the hosts ip
           ])
-          ++ (optionals ((!c ? wg.server || !c.wg.server) && c ? wg.v4 && instanceConfig ? wg.v4) [
-            # no server, no ipv4 yay
+          ++ (optionals ((!isServer) && hasV4) [
             "${c.wg.v4}/32"
           ]);
         RouteTable = 1000;
-        Endpoint = "${c.publicHostname}:51820";
+        Endpoint = "${publicHostname}:51820";
         PersistentKeepalive = 25;
-        PublicKey = c.wg.pubKey;
+        PublicKey = pubKey;
         PresharedKeyFile = config.sops.secrets."wg/psk".path;
       })
-      ++ (optional ((!c ? publicHostname) && wgServer && (c ? wg.pubKey)) {
+      ++ (optional ((publicHostname == null) && wgServer && (pubKey != null)) {
         # if this is the server and the peer isn't reachable on the internet
         AllowedIPs = [
           "${genUlaForHost ulaPrefix c.hostName}/128"
           "${genUlaForHost monitoringUlaPrefix c.hostName}/128"
         ]
-        ++ (optionals (c ? wg.v4 && instanceConfig ? wg.v4) [
+        ++ (optionals (hasV4) [
           "${c.wg.v4}/32"
         ]);
-        PublicKey = c.wg.pubKey;
+        PublicKey = pubKey;
         PresharedKeyFile = config.sops.secrets."wg/psk".path;
       })
     )
-  ) filteredConfigs;
+  ) otherNodes);
   wgPeers = flatten wgPeersLists;
 in
 {
@@ -94,18 +92,34 @@ in
     type = types.str;
     default = genUlaForHost monitoringUlaPrefix config.networking.hostName;
   };
+  options.xyno.services.wireguard.pubKey = mkOption {
+    type = types.nullOr types.str;
+    default = null;
+  };
+  options.xyno.services.wireguard.server = mkOption {
+    type = types.bool;
+    default = false;
+  };
+  options.xyno.services.wireguard.v4 = mkOption {
+    type = types.nullOr types.str;
+    default = null;
+
+  };
   config = mkIf cfg.enable {
     # TODO: add a all traffic through this network
     networking.hosts =
       (mapAttrs' (
-        n: v: nameValuePair (genUlaForHost ulaPrefix v.hostName) [ "${v.hostName}.${cfg.hostsDomain}" ]
-      ) instanceConfigs)
+        n: v:
+        nameValuePair (genUlaForHost ulaPrefix v.networking.hostName) [
+          "${v.networking.hostName}.${cfg.hostsDomain}"
+        ]
+      ) otherNodes)
       // (mapAttrs' (
         n: v:
-        nameValuePair (genUlaForHost monitoringUlaPrefix v.hostName) [
-          "${v.hostName}.${cfg.monHostsDomain}"
+        nameValuePair (genUlaForHost monitoringUlaPrefix v.networking.hostName) [
+          "${v.networking.hostName}.${cfg.monHostsDomain}"
         ]
-      ) instanceConfigs);
+      ) otherNodes);
     networking.firewall.allowedUDPPorts = optional wgServer 51820;
     networking.firewall.interfaces."wg0".allowedUDPPorts = optional wgServer 53;
     systemd.network.netdevs."99-wg0" = {
@@ -126,15 +140,15 @@ in
       matchConfig.Name = "wg0";
       networkConfig = {
         Description = "xyno wireguard";
-        IPMasquerade = mkIf (instanceConfig ? wg.server && instanceConfig.wg.server) "both";
-        IPv4Forwarding = (instanceConfig ? wg.server && instanceConfig.wg.server);
-        IPv6Forwarding = (instanceConfig ? wg.server && instanceConfig.wg.server);
+        IPMasquerade = mkIf wgServer "both";
+        IPv4Forwarding = wgServer;
+        IPv6Forwarding = wgServer;
       };
       address = [
         "${(genUlaForHost ulaPrefix config.networking.hostName)}/64"
         "${(genUlaForHost monitoringUlaPrefix config.networking.hostName)}/64"
       ]
-      ++ (optionals (instanceConfig ? wg.v4) [ "${instanceConfig.wg.v4}/24" ]);
+      ++ (optionals (cfg.v4) [ "${cfg.v4}/24" ]);
     };
     systemd.network.networks."51-wg0-all-traffic" = {
       matchConfig.Name = "wg0";