nix-configs/modules/services/wireguard.nix

{
  pkgs,
  lib,
  config,
  instanceConfigs,
  instanceConfig,
  ...
}:
with lib;
let
  wgServer = instanceConfig ? wg.server && instanceConfig.wg.server;
  cfg = config.xyno.services.wireguard;
  ula = cfg.ula;
  ulaPrefix = "${ula}:1337"; # /64 for normal vpn
  monitoringUlaPrefix = "${ula}:2337"; # /64 for monitoring
  v4Subnet = "10.13.12.0/24";

  # uses a hash digest as the host identifier
  genUlaForHost =
    prefix: hostName:
    let
      hostHash = builtins.hashString "sha512" hostName;
      localParts = map (n: builtins.substring (n * 4) 4 hostHash) (range 0 3);
      localPart = concatStringsSep ":" localParts;
    in
    "${prefix}:${localPart}";
  # peers list for networkd
  filteredConfigs = builtins.filter (x: x.hostName != config.networking.hostName) (
    attrValues instanceConfigs
  );
  wgPeersLists = map (
    c:
    (
      (optional (c ? publicHostname) {
        # if peer is publicly on the internet
        AllowedIPs =
          (optionals (c ? wg.server && c.wg.server) [
            # is server
            "::/0"
          ])
          ++ (optionals (c ? wg.server && c.wg.server && c ? wg.v4 && instanceConfig ? wg.v4) [
            # both client and server have a v4
            "0.0.0.0/0"
          ])
          ++ (optionals (!c ? wg.server || !c.wg.server) [
            # is not server
            "${genUlaForHost ulaPrefix c.hostName}/128" # if a host is reachable but shouldn't play server, send only to the hosts ip
          ])
          ++ (optionals ((!c ? wg.server || !c.wg.server) && c ? wg.v4 && instanceConfig ? wg.v4) [
            # no server, no ipv4 yay
            "${c.wg.v4}/32"
          ]);
        RouteTable = 1000;
        Endpoint = "${c.publicHostname}:51820";
        PersistentKeepalive = 25;
        PublicKey = c.wg.pubKey;
        PresharedKeyFile = config.sops.secrets."wg/psk".path;
      })
      ++ (optional ((!c ? publicHostname) && wgServer && (c ? wg.pubKey)) {
        # if this is the server and the peer isn't reachable on the internet
        AllowedIPs = [
          "${genUlaForHost ulaPrefix c.hostName}/128"
          "${genUlaForHost monitoringUlaPrefix c.hostName}/128"
        ]
        ++ (optionals (c ? wg.v4 && instanceConfig ? wg.v4) [
          "${c.wg.v4}/32"
        ]);
        PublicKey = c.wg.pubKey;
        PresharedKeyFile = config.sops.secrets."wg/psk".path;
      })
    )
  ) filteredConfigs;
  wgPeers = flatten wgPeersLists;
in
{
  options.xyno.services.wireguard.enable = mkEnableOption "enables wireguard";
  options.xyno.services.wireguard.monHostsDomain = mkOption {
    type = types.str;
    default = "mon.wg.hailsatan.eu";
  };
  options.xyno.services.wireguard.hostsDomain = mkOption {
    type = types.str;
    default = "wg.hailsatan.eu";
  };
  options.xyno.services.wireguard.ula = mkOption {
    type = types.str;
    default = "fd68:b6a4:36e4";
  };
  options.xyno.services.wireguard.ip6 = mkOption {
    type = types.str;
    default = genUlaForHost ulaPrefix config.networking.hostName;
  };
  options.xyno.services.wireguard.monIp6 = mkOption {
    type = types.str;
    default = genUlaForHost monitoringUlaPrefix config.networking.hostName;
  };
  config = mkIf cfg.enable {
    # TODO: add a all traffic through this network
    networking.hosts =
      (mapAttrs' (
        n: v: nameValuePair (genUlaForHost ulaPrefix v.hostName) [ "${v.hostName}.${cfg.hostsDomain}" ]
      ) instanceConfigs)
      // (mapAttrs' (
        n: v:
        nameValuePair (genUlaForHost monitoringUlaPrefix v.hostName) [
          "${v.hostName}.${cfg.monHostsDomain}"
        ]
      ) instanceConfigs);
    networking.firewall.allowedUDPPorts = optional wgServer 51820;
    networking.firewall.interfaces."wg0".allowedUDPPorts = optional wgServer 53;
    systemd.network.netdevs."99-wg0" = {
      netdevConfig = {
        Name = "wg0";
        Kind = "wireguard";
        Description = "main wireguard tunnel";

      };
      wireguardConfig = {
        ListenPort = mkIf wgServer 51820;
        PrivateKeyFile = config.sops.secrets."wg/privkey".path;
        FirewallMark = 34952;
      };
      wireguardPeers = wgPeers;
    };
    systemd.network.networks."50-wg0" = {
      matchConfig.Name = "wg0";
      networkConfig = {
        Description = "xyno wireguard";
        IPMasquerade = mkIf (instanceConfig ? wg.server && instanceConfig.wg.server) "both";
        IPv4Forwarding = (instanceConfig ? wg.server && instanceConfig.wg.server);
        IPv6Forwarding = (instanceConfig ? wg.server && instanceConfig.wg.server);
      };
      address = [
        "${(genUlaForHost ulaPrefix config.networking.hostName)}/64"
        "${(genUlaForHost monitoringUlaPrefix config.networking.hostName)}/64"
      ]
      ++ (optionals (instanceConfig ? wg.v4) [ "${instanceConfig.wg.v4}/24" ]);
    };
    systemd.network.networks."51-wg0-all-traffic" = {
      matchConfig.Name = "wg0";
      networkConfig = {
        Description = "xyno wireguard all traffic";
        DNSDefaultRoute = true;
        DNS = "2a07:e340::2#dns.mullvad.net";
        DNSOverTLS = true;
      };
      routingPolicyRules = [
        {
          FirewallMark = 34952;
          InvertRule = true;
          Table = 1000;
          Priority = 10;
        }
      ];
    };
    services.prometheus.exporters.wireguard =
      mkIf (wgServer && config.xyno.services.monitoring.enable)
        {
          enable = true;
          interfaces = [ "wg0" ];
        };

    services.coredns = mkIf wgServer {
      # for non nixos devices to be able to resolve vpn hostnames
      enable = true;
      config = ''
        . {
          bind wg0
          prometheus
          hosts ${cfg.hostsDomain}
          forward . /etc/resolv.conf
        }
      '';
    };
    xyno.services.monitoring.exporters.coredns = mkIf wgServer 9153;
    xyno.services.monitoring.exporters.wireguard =
      mkIf wgServer config.services.prometheus.exporters.wireguard.port;
    sops.secrets."wg/privkey" = {
      reloadUnits = [ "systemd-networkd.service" ];
      sopsFile = ../../instances/${config.networking.hostName}/secrets/wg.yaml;
    };
    sops.secrets."wg/psk" = {
      reloadUnits = [ "systemd-networkd.service" ];
    };

  };
}