73 lines
2.1 KiB
Nix
73 lines
2.1 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
let
|
|
vars = import ./vars.nix config;
|
|
wg0 = vars.ifs.wg0;
|
|
|
|
peerIps = ifObj: token: [
|
|
"${ifObj.p4}.${toString token}/32"
|
|
"${ifObj.p6}:${toString token}:0/112"
|
|
"${ifObj.ulaPrefix}:${toString token}:0/112"
|
|
];
|
|
|
|
mkWg0Peer = token: publicKey: {
|
|
allowedIPs = peerIps wg0 token;
|
|
inherit publicKey;
|
|
pskEnabled = true;
|
|
};
|
|
|
|
wg0Peers = {
|
|
"Yura-TPX13" = mkWg0Peer 100 "iFdsPYrpw7vsFYYJB4SOTa+wxxGVcmYp9CPxe0P9ewA=";
|
|
"Yura-Pixel7Pro" = mkWg0Peer 101 "GPdXxjvnhsyufd2QX/qsR02dinUtPnnxrE66oGt/KyA=";
|
|
};
|
|
peerSecretName = name: "wg0-peer-${name}-psk";
|
|
secrets = config.secrix.services.systemd-networkd.secrets;
|
|
in
|
|
{
|
|
secrix.services.systemd-networkd.secrets = let
|
|
pskPeers = lib.attrsets.filterAttrs (name: peer: peer.pskEnabled) wg0Peers;
|
|
mapPeer = name: peer: {
|
|
name = peerSecretName name;
|
|
value.encrypted.file = ./secrets/wireguard/${peerSecretName name}.age;
|
|
};
|
|
peerSecrets = lib.attrsets.mapAttrs' mapPeer pskPeers;
|
|
|
|
allSecrets = {
|
|
wg0-private-key.encrypted.file = ./secrets/wireguard/wg0-private-key.age;
|
|
} // peerSecrets;
|
|
|
|
setSecretOwnership = name: value: value // {
|
|
decrypted.user = "systemd-network";
|
|
decrypted.group = "systemd-network";
|
|
};
|
|
in lib.attrsets.mapAttrs setSecretOwnership allSecrets;
|
|
|
|
systemd.network.netdevs = {
|
|
"10-wg0" = {
|
|
netdevConfig = {
|
|
Kind = "wireguard";
|
|
Name = wg0.name;
|
|
};
|
|
wireguardConfig = {
|
|
PrivateKeyFile = secrets.wg0-private-key.decrypted.path;
|
|
ListenPort = wg0.listenPort;
|
|
};
|
|
wireguardPeers = map (peer: {
|
|
AllowedIPs = lib.strings.concatStringsSep "," peer.value.allowedIPs;
|
|
PublicKey = peer.value.publicKey;
|
|
PresharedKeyFile = if peer.value.pskEnabled then secrets."${peerSecretName peer.name}".decrypted.path else null;
|
|
}) (lib.attrsToList wg0Peers);
|
|
};
|
|
};
|
|
|
|
systemd.network.networks = {
|
|
"10-wg0" = {
|
|
matchConfig.Name = "wg0";
|
|
networkConfig = {
|
|
IPv4Forwarding = true;
|
|
IPv6SendRA = false;
|
|
Address = [ wg0.addr4Sized wg0.addr6Sized wg0.ulaAddrSized ];
|
|
};
|
|
};
|
|
};
|
|
}
|