91 lines
2.1 KiB
Nix
91 lines
2.1 KiB
Nix
{
|
|
pkgs,
|
|
lib,
|
|
config,
|
|
...
|
|
}:
|
|
let
|
|
meshHosts = {
|
|
kumatani = {
|
|
address = "kumatani";
|
|
publicKey = "pKkl30tba29FG86wuaC0KrpSHMr1tSOujikHFbx75BM=";
|
|
isRouter = false;
|
|
ip = "10.100.0.1";
|
|
};
|
|
usahara = {
|
|
address = "usahara";
|
|
publicKey = "4v7GyAIsKfwWjLMVB4eoosJDvLkIDHW0KsEYoQqSnh4=";
|
|
isRouter = false;
|
|
ip = "10.100.0.2";
|
|
};
|
|
tux = {
|
|
address = "tux";
|
|
publicKey = "Z17ci3Flk1eDAhJ8QZSUgtmlw6BVu4XqvpqLKLWTYWw=";
|
|
isRouter = false;
|
|
ip = "10.100.0.3";
|
|
};
|
|
oakbay-pfsense = {
|
|
endpoint = "oakbay.lucalise.ca:51822";
|
|
publicKey = "xOTPZBIC9m1BkkiLCOUTty3b7/NOvslteVQHzEFxqWQ=";
|
|
isRouter = true;
|
|
ip = "10.100.0.250";
|
|
routes = [
|
|
"10.100.0.0/24"
|
|
"192.168.15.0/27"
|
|
"192.168.20.0/26"
|
|
"192.168.27.0/24"
|
|
];
|
|
};
|
|
pearce-udm = {
|
|
endpoint = "pearce.lucalise.ca:51823";
|
|
publicKey = "hDb2DzI+isaqXLdxwAF1hc5Nid8TK/M1SQ+zDpf9QxY=";
|
|
isRouter = true;
|
|
ip = "10.100.0.251";
|
|
routes = [
|
|
"192.168.18.0/27"
|
|
];
|
|
};
|
|
};
|
|
|
|
getEndpoint =
|
|
name: host:
|
|
if host.isRouter or false then "${host.endpoint}" else "${host.address}:${toString 51820}";
|
|
|
|
mkPeer = name: host: {
|
|
publicKey = host.publicKey;
|
|
allowedIPs = [ "${host.ip}/32" ] ++ (host.routes or [ ]);
|
|
endpoint = getEndpoint name host;
|
|
persistentKeepalive = 25;
|
|
dynamicEndpointRefreshSeconds = 300;
|
|
};
|
|
|
|
mkPeersFor =
|
|
selfName:
|
|
lib.mapAttrsToList mkPeer (
|
|
lib.filterAttrs (name: host: name != selfName && (host.isRouter or false)) meshHosts
|
|
);
|
|
|
|
selfConfig = meshHosts.${config.networking.hostName} or null;
|
|
in
|
|
{
|
|
config = lib.mkIf (selfConfig != null) {
|
|
networking.wireguard.interfaces = {
|
|
wg0 = {
|
|
privateKeyFile = "/etc/wireguard/private.key";
|
|
ips = [ "${selfConfig.ip}/32" ];
|
|
listenPort = 51820;
|
|
peers = mkPeersFor config.networking.hostName;
|
|
};
|
|
};
|
|
|
|
networking.firewall = {
|
|
allowedUDPPorts = [ 51820 ];
|
|
trustedInterfaces = [ "wg0" ];
|
|
};
|
|
|
|
systemd.tmpfiles.rules = [
|
|
"d /etc/wireguard 0700 root root -"
|
|
];
|
|
};
|
|
}
|