CaZzzer/nix-conf
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

WIP: router: wireguard: attempt to convert wg0Peers from list to attrset (gone not well)

Browse Source
This commit is contained in:
Yuri Tatishchev 2025-05-22 00:21:58 -07:00
parent 4641775e54
commit 1c0871f54e
Signed by: CaZzzer
SSH Key Fingerprint: SHA256:sqXB3fe0LMpfH+IeM/vlmxKdso52kssrIJBlwKXVe1U
1 changed files with 21 additions and 22 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

43
hosts/router/wireguard.nix
View File

@ -2,56 +2,55 @@
let let
vars = import ./vars.nix; vars = import ./vars.nix;
wg0Peers = [ wg0Peers = {
{ "Yura-TPX13" = {
name = "Yura-TPX13";
allowedIPs = [ "10.6.0.3/32" "${vars.extra.opnsense.p6}::6:3:0/112" ]; allowedIPs = [ "10.6.0.3/32" "${vars.extra.opnsense.p6}::6:3:0/112" ];
publicKey = "iJa5JmJbMHNlbEluNwoB2Q8LyrPAfb7S/mluanMcI08="; publicKey = "iJa5JmJbMHNlbEluNwoB2Q8LyrPAfb7S/mluanMcI08=";
pskEnabled = true; pskEnabled = true;
} };
{ "Yura-Pixel7Pro" = {
name = "Yura-Pixel7Pro";
allowedIPs = [ "10.6.0.4/32" "${vars.extra.opnsense.p6}::6:4:0/112" ]; allowedIPs = [ "10.6.0.4/32" "${vars.extra.opnsense.p6}::6:4:0/112" ];
publicKey = "UjZlsukmAsX60Z5FnZwKCSu141Gjj74+hBVT3TRhwT4="; publicKey = "UjZlsukmAsX60Z5FnZwKCSu141Gjj74+hBVT3TRhwT4=";
pskEnabled = true; pskEnabled = true;
} };
{ "AsusS513" = {
name = "AsusS513";
allowedIPs = [ "10.6.0.100/32" ]; allowedIPs = [ "10.6.0.100/32" ];
publicKey = "XozJ7dHdJfkLORkCVxaB1VmvHEOAA285kRZcmzfPl38="; publicKey = "XozJ7dHdJfkLORkCVxaB1VmvHEOAA285kRZcmzfPl38=";
pskEnabled = true; pskEnabled = true;
} };
]; };
in in
{ {
secrix.services.systemd-networkd.secrets = let secrix.services.systemd-networkd.secrets = let
pskEnabledPeers = builtins.filter (peer: peer.pskEnabled) wg0Peers; peerSecretName = name: "wg0-peer-${name}-psk";
peerToSecretAttrs = peer: { mapPeer = name: peer: {
name = "wg0-peer-${peer.name}-psk"; name = peerSecretName name;
value.encrypted.file = ./secrets/wireguard/wg0-peer-${peer.name}-psk.age; value = if peer.pskEnabled then {encrypted.file = ./secrets/wireguard/${peerSecretName name}.age;} else null;
}; };
peerSecretsList = map peerToSecretAttrs pskEnabledPeers; peerSecrets = lib.attrsets.mapAttrs' mapPeer wg0Peers;
peerSecrets = builtins.listToAttrs peerSecretsList;
in in
{ {
wg0-private-key.encrypted.file = ./secrets/wireguard/wg0-private-key.age; wg0-private-key.encrypted.file = ./secrets/wireguard/wg0-private-key.age;
} // peerSecrets; } // peerSecrets;
systemd.network.netdevs = { systemd.network.netdevs = let
secrets = config.secrix.services.systemd-networkd.secrets;
in
{
"10-wg0" = { "10-wg0" = {
netdevConfig = { netdevConfig = {
Kind = "wireguard"; Kind = "wireguard";
Name = "wg0"; Name = "wg0";
}; };
wireguardConfig = { wireguardConfig = {
PrivateKeyFile = config.secrix.services.systemd-networkd.secrets.wg0-private-key.decrypted.path; PrivateKeyFile = secrets.wg0-private-key.decrypted.path;
ListenPort = 18596; ListenPort = 18596;
}; };
wireguardPeers = map (peer: { wireguardPeers = lib.attrsets.foldlAttrs (name: peer: acc: acc ++ [{
AllowedIPs = lib.strings.concatStringsSep "," peer.allowedIPs; AllowedIPs = lib.strings.concatStringsSep "," peer.allowedIPs;
PublicKey = peer.publicKey; PublicKey = peer.publicKey;
PresharedKeyFile = if peer.pskEnabled then config.secrix.services.systemd-networkd.secrets."wg0-peer-${peer.name}-psk".decrypted.path else null; PresharedKeyFile = if peer.pskEnabled then secrets."wg0-peer-${name}-psk".decrypted.path else null;
}) wg0Peers; }]) [] wg0Peers;
}; };
}; };
} }