90 lines
2.8 KiB
Nix
90 lines
2.8 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
with lib;
|
|
let
|
|
cfg = config.mossnet.wg;
|
|
in
|
|
{
|
|
options = {
|
|
mossnet.wg = {
|
|
enable = mkEnableOption "Gain access to all mossnet systems through wireguard";
|
|
ips = lib.mkOption {
|
|
type = with types; listOf str;
|
|
default = { };
|
|
example = literalExample ''
|
|
[ "10.0.69.2/24" ];
|
|
'';
|
|
description = ''
|
|
The IP this machine is allowed to connect to
|
|
'';
|
|
};
|
|
privateKeyFile = lib.mkOption {
|
|
type = types.path;
|
|
default = { };
|
|
example = literalExample ''
|
|
/run/agenix/wg-curve
|
|
'';
|
|
description = ''
|
|
The private ssh key file to use to connect!
|
|
Remember set age.secrets.*.file and age.secrets.*.user
|
|
'';
|
|
};
|
|
};
|
|
};
|
|
config = mkIf cfg.enable {
|
|
networking.firewall.allowedUDPPorts = [ 60990 ];
|
|
networking.wireguard.interfaces = {
|
|
wg0 = {
|
|
ips = cfg.ips;
|
|
listenPort = 60990; # to match firewall allowedUDPPorts (without this wg uses random port numbers)
|
|
|
|
privateKeyFile = cfg.privateKeyFile;
|
|
peers = [
|
|
# For a client configuration, one peer entry for the server will suffice.
|
|
{
|
|
publicKey = "c1J4p63rD3IlszugMZiki7UBV3YmDdqa3DU4UejXzAI=";
|
|
allowedIPs = [ "10.0.69.0/24" ];
|
|
# Set this to the server IP and port.
|
|
endpoint = "sealight.xyz:60990"; # ToDo: route to endpoint not automatically configured https://wiki.archlinux.org/index.php/WireGuard#Loop_routing https://discourse.nixos.org/t/solved-minimal-firewall-setup-for-wireguard-client/7577
|
|
persistentKeepalive = 25;
|
|
}
|
|
];
|
|
};
|
|
};
|
|
|
|
# Ensure WireGuard restarts on failure
|
|
systemd.services.wireguard-wg0 = {
|
|
serviceConfig = {
|
|
Restart = "on-failure";
|
|
RestartSec = "5s";
|
|
};
|
|
};
|
|
|
|
# Periodic connection health check and reconnect
|
|
systemd.services.wireguard-wg0-healthcheck = {
|
|
description = "WireGuard wg0 connection health check";
|
|
after = [ "network-online.target" "wireguard-wg0.service" ];
|
|
wants = [ "network-online.target" ];
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
ExecStart = pkgs.writeShellScript "wg0-healthcheck" ''
|
|
# Check if we can ping the WireGuard gateway
|
|
if ! ${pkgs.iputils}/bin/ping -c 1 -W 5 10.0.69.1 &>/dev/null; then
|
|
echo "WireGuard connection down, restarting..."
|
|
${pkgs.systemd}/bin/systemctl restart wireguard-wg0.service
|
|
fi
|
|
'';
|
|
};
|
|
};
|
|
|
|
systemd.timers.wireguard-wg0-healthcheck = {
|
|
description = "Timer for WireGuard wg0 health check";
|
|
wantedBy = [ "timers.target" ];
|
|
timerConfig = {
|
|
OnBootSec = "2min";
|
|
OnUnitActiveSec = "2min";
|
|
Unit = "wireguard-wg0-healthcheck.service";
|
|
};
|
|
};
|
|
};
|
|
}
|