helm/modules/nixos/wireguard.nix
2025-11-21 21:06:42 -08:00

90 lines
2.8 KiB
Nix

{ config, lib, pkgs, ... }:
with lib;
let
cfg = config.mossnet.wg;
in
{
options = {
mossnet.wg = {
enable = mkEnableOption "Gain access to all mossnet systems through wireguard";
ips = lib.mkOption {
type = with types; listOf str;
default = { };
example = literalExample ''
[ "10.0.69.2/24" ];
'';
description = ''
The IP this machine is allowed to connect to
'';
};
privateKeyFile = lib.mkOption {
type = types.path;
default = { };
example = literalExample ''
/run/agenix/wg-curve
'';
description = ''
The private ssh key file to use to connect!
Remember set age.secrets.*.file and age.secrets.*.user
'';
};
};
};
config = mkIf cfg.enable {
networking.firewall.allowedUDPPorts = [ 60990 ];
networking.wireguard.interfaces = {
wg0 = {
ips = cfg.ips;
listenPort = 60990; # to match firewall allowedUDPPorts (without this wg uses random port numbers)
privateKeyFile = cfg.privateKeyFile;
peers = [
# For a client configuration, one peer entry for the server will suffice.
{
publicKey = "c1J4p63rD3IlszugMZiki7UBV3YmDdqa3DU4UejXzAI=";
allowedIPs = [ "10.0.69.0/24" ];
# Set this to the server IP and port.
endpoint = "sealight.xyz:60990"; # ToDo: route to endpoint not automatically configured https://wiki.archlinux.org/index.php/WireGuard#Loop_routing https://discourse.nixos.org/t/solved-minimal-firewall-setup-for-wireguard-client/7577
persistentKeepalive = 25;
}
];
};
};
# Ensure WireGuard restarts on failure
systemd.services.wireguard-wg0 = {
serviceConfig = {
Restart = "on-failure";
RestartSec = "5s";
};
};
# Periodic connection health check and reconnect
systemd.services.wireguard-wg0-healthcheck = {
description = "WireGuard wg0 connection health check";
after = [ "network-online.target" "wireguard-wg0.service" ];
wants = [ "network-online.target" ];
serviceConfig = {
Type = "oneshot";
ExecStart = pkgs.writeShellScript "wg0-healthcheck" ''
# Check if we can ping the WireGuard gateway
if ! ${pkgs.iputils}/bin/ping -c 1 -W 5 10.0.69.1 &>/dev/null; then
echo "WireGuard connection down, restarting..."
${pkgs.systemd}/bin/systemctl restart wireguard-wg0.service
fi
'';
};
};
systemd.timers.wireguard-wg0-healthcheck = {
description = "Timer for WireGuard wg0 health check";
wantedBy = [ "timers.target" ];
timerConfig = {
OnBootSec = "2min";
OnUnitActiveSec = "2min";
Unit = "wireguard-wg0-healthcheck.service";
};
};
};
}