lynatic/flake
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fixed wireguard \o/

Browse source
This commit is contained in:
Lyn 2024-11-20 21:39:42 +01:00
parent 1d2cb130cf
commit b3ae9ba314
2 changed files with 13 additions and 28 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

33
hosts/network.nix
View file

@ -5,12 +5,6 @@
}: let }: let
prefix = "lyn"; prefix = "lyn";
#subnets routed through wireguard
wg_subnets = {
IPv4 = "10.35.0.0/24";
IPv6 = "fd1a:acab:cafe:1337::/64";
};
#hosts are defined here #hosts are defined here
hosts = { hosts = {
wg-gateway = { wg-gateway = {
@ -19,12 +13,12 @@
pubkey = "Fknzk7lltkPKJZlF3KXWKGQXXSj7CUD9ev0ZEZtpbjY="; pubkey = "Fknzk7lltkPKJZlF3KXWKGQXXSj7CUD9ev0ZEZtpbjY=";
port = 51820; port = 51820;
}; };
v4 = { IPv4 = {
public = "78.47.226.47"; public = "78.47.226.47";
# we use 10.35.0.0/16 as a range for private subnets, specifically 10.35.0.0/24 for wireguard peers # we use 10.35.0.0/16 as a range for private subnets, specifically 10.35.0.0/24 for wireguard peers
internal = "10.35.0.3"; internal = "10.35.0.3";
}; };
v6 = { IPv6 = {
public = "2a01:4f8:1c1b:d2db::"; public = "2a01:4f8:1c1b:d2db::";
# 1aacabcafe is the global ID and 1337 is the wireguard peer subnet ID, resulting in the ULA fd1a:acab:cafe:1337::/64 # 1aacabcafe is the global ID and 1337 is the wireguard peer subnet ID, resulting in the ULA fd1a:acab:cafe:1337::/64
internal = "fd1a:acab:cafe:1337:8f4c:68cd::"; internal = "fd1a:acab:cafe:1337:8f4c:68cd::";
@ -36,12 +30,12 @@
pubkey = "jdfbOnP0mFWFobtQunm0h6EtqOZiar9G9jngMU7b+Co="; pubkey = "jdfbOnP0mFWFobtQunm0h6EtqOZiar9G9jngMU7b+Co=";
port = 51820; port = 51820;
}; };
v4 = { IPv4 = {
public = ""; public = "";
# we use 10.35.0.0/16 as a range for private subnets, specifically 10.35.0.0/24 for wireguard peers # we use 10.35.0.0/16 as a range for private subnets, specifically 10.35.0.0/24 for wireguard peers
internal = "10.35.0.2"; internal = "10.35.0.2";
}; };
v6 = { IPv6 = {
public = ""; public = "";
# 1aacabcafe is the global ID and 1337 is the wireguard peer subnet ID, resulting in the ULA fd1a:acab:cafe:1337::/64 # 1aacabcafe is the global ID and 1337 is the wireguard peer subnet ID, resulting in the ULA fd1a:acab:cafe:1337::/64
internal = "fd1a:acab:cafe:1337:6722:3657::"; internal = "fd1a:acab:cafe:1337:6722:3657::";
@ -51,15 +45,6 @@
in { in {
options = { options = {
${prefix} = { ${prefix} = {
network.wg_subnets.IPv4 = lib.mkOption {
type = lib.types.str;
description = "The IPv6 range that wireguard peers will use";
};
network.wg_subnets.IPv6 = lib.mkOption {
type = lib.types.str;
description = "The IPv4 range that wireguard peers will use";
};
# defining the entire hosts part as a module # defining the entire hosts part as a module
network.hosts = lib.mkOption { network.hosts = lib.mkOption {
type = lib.types.attrsOf (lib.types.submodule { type = lib.types.attrsOf (lib.types.submodule {
@ -86,7 +71,7 @@ in {
}; };
description = "WireGuard configuration"; description = "WireGuard configuration";
}; };
v4 = lib.mkOption { IPv4 = lib.mkOption {
type = lib.types.submodule { type = lib.types.submodule {
options = { options = {
public = lib.mkOption { public = lib.mkOption {
@ -103,7 +88,7 @@ in {
description = "IPv4 configuration"; description = "IPv4 configuration";
default = {}; default = {};
}; };
v6 = lib.mkOption { IPv6 = lib.mkOption {
type = lib.types.submodule { type = lib.types.submodule {
options = { options = {
public = lib.mkOption { public = lib.mkOption {
@ -130,12 +115,12 @@ in {
config = { config = {
${prefix}.network = { ${prefix}.network = {
inherit hosts wg_subnets; inherit hosts;
}; };
assertions = [ assertions = [
{ {
assertion = lib.any (host: host.v4 != null || host.v6 != null) (lib.attrValues hosts); assertion = lib.any (host: host.IPv4 != null || host.IPv6 != null) (lib.attrValues hosts);
message = "At least one of v4 or v6 must be defined for each host"; message = "Either an IPv4 or IPv6 must be defined for each host";
} }
]; ];
}; };

8
modules/services/wgautomesh.nix
View file

@ -57,8 +57,8 @@ in {
networking.wireguard.interfaces.wg0 = { networking.wireguard.interfaces.wg0 = {
ips = ips =
if cfg.useIPv6 if cfg.useIPv6
then ["${meshnetwork.wg_subnets.IPv6}"] then ["${currentHost.IPv6.internal}/64"]
else ["${meshnetwork.wg_subnets.IPv4}"]; else ["${currentHost.IPv4.internal}/24"];
listenPort = wireguardPort; listenPort = wireguardPort;
privateKeyFile = "/var/lib/wireguard-keys/private"; privateKeyFile = "/var/lib/wireguard-keys/private";
mtu = 1200; mtu = 1200;
@ -70,8 +70,8 @@ in {
interface = "wg0"; interface = "wg0";
peers = peers =
if cfg.useIPv6 if cfg.useIPv6
then buildPeerlist "v6" meshnetwork.hosts then buildPeerlist "IPv6" meshnetwork.hosts
else buildPeerlist "v4" meshnetwork.hosts; else buildPeerlist "IPv4" meshnetwork.hosts;
upnp_forward_external_port = wireguardPort; upnp_forward_external_port = wireguardPort;
}; };
gossipSecretFile = gossip_secret_path; gossipSecretFile = gossip_secret_path;