2023-12-07 17:18:55 +08:00
|
|
|
inputs:
|
|
|
|
{
|
|
|
|
options.nixos.services.wireguard = let inherit (inputs.lib) mkOption types; in
|
|
|
|
{
|
|
|
|
enable = mkOption { type = types.bool; default = false; };
|
2023-12-17 12:10:45 +08:00
|
|
|
# wg genkey | wg pubkey
|
|
|
|
publicKey = mkOption { type = types.nonEmptyStr; };
|
|
|
|
lighthouse = mkOption { type = types.bool; default = false; };
|
2024-01-19 19:45:56 +08:00
|
|
|
behindNat = mkOption
|
|
|
|
{
|
|
|
|
type = types.bool;
|
|
|
|
default = inputs.config.nixos.services.xray.client.enable;
|
|
|
|
};
|
|
|
|
listenIp = mkOption { type = types.nullOr types.nonEmptyStr; default = null; };
|
|
|
|
# if the host is behind xray, it should listen on another port, to make xray succeffully listen on 51820
|
|
|
|
listenPort = mkOption
|
|
|
|
{
|
|
|
|
type = types.ints.unsigned;
|
|
|
|
default = if inputs.config.nixos.services.wireguard.behindNat then 51821 else 51820;
|
|
|
|
};
|
|
|
|
wireguardIp = mkOption { type = types.nonEmptyStr; };
|
|
|
|
peers = mkOption { type = types.nonEmptyListOf types.nonEmptyStr; default = []; };
|
2023-12-07 17:18:55 +08:00
|
|
|
};
|
|
|
|
config =
|
|
|
|
let
|
2024-01-19 19:45:56 +08:00
|
|
|
inherit (inputs.lib) mkIf mkMerge;
|
2023-12-07 17:18:55 +08:00
|
|
|
inherit (inputs.config.nixos.services) wireguard;
|
2024-01-19 19:45:56 +08:00
|
|
|
inherit (builtins) map toString listToAttrs filter;
|
|
|
|
in mkMerge
|
|
|
|
[
|
|
|
|
{
|
|
|
|
assertions =
|
|
|
|
[{
|
|
|
|
assertion = !wireguard.behindNat -> wireguard.listenIp != null;
|
|
|
|
message = "wireguard.listenIp should be not null when behindNat is false.";
|
|
|
|
}];
|
|
|
|
}
|
|
|
|
(
|
|
|
|
mkIf wireguard.enable
|
2023-12-07 17:18:55 +08:00
|
|
|
{
|
2024-01-19 19:45:56 +08:00
|
|
|
networking =
|
2023-12-14 23:34:03 +08:00
|
|
|
{
|
2024-01-19 19:45:56 +08:00
|
|
|
firewall = { allowedUDPPorts = [ wireguard.listenPort ]; trustedInterfaces = [ "wireguard" ]; };
|
|
|
|
wireguard.interfaces.wireguard =
|
|
|
|
{
|
|
|
|
ips = [ "${wireguard.wireguardIp}/24" ];
|
|
|
|
inherit (wireguard) listenPort;
|
|
|
|
privateKeyFile = inputs.config.sops.secrets."wireguard/privateKey".path;
|
|
|
|
peers = map
|
|
|
|
(peer:
|
|
|
|
{
|
|
|
|
publicKey = peer.publicKey;
|
|
|
|
allowedIPs = [ (if peer.lighthouse then "192.168.83.0/24" else "${peer.wireguardIp}/32") ];
|
|
|
|
endpoint = mkIf (!peer.behindNat) "${peer.listenIp}:${builtins.toString peer.listenPort}";
|
2024-03-07 00:32:49 +08:00
|
|
|
persistentKeepalive = mkIf peer.lighthouse 5;
|
2024-01-19 19:45:56 +08:00
|
|
|
})
|
|
|
|
(map
|
|
|
|
(peer: inputs.topInputs.self.nixosConfigurations.${peer}.config.nixos.services.wireguard)
|
|
|
|
wireguard.peers);
|
|
|
|
};
|
|
|
|
};
|
|
|
|
sops.secrets."wireguard/privateKey" = {};
|
|
|
|
# somehow fix wireguard connection
|
|
|
|
systemd.services = mkIf wireguard.behindNat (listToAttrs (map
|
|
|
|
(peer:
|
|
|
|
{
|
|
|
|
name = "wireguard-ping-${peer.name}";
|
|
|
|
value =
|
|
|
|
{
|
|
|
|
description = "ping ${peer.name}";
|
|
|
|
after = [ "network.target" ];
|
|
|
|
wantedBy = [ "multi-user.target" ];
|
|
|
|
serviceConfig =
|
|
|
|
{
|
2024-03-07 00:32:49 +08:00
|
|
|
ExecStart = "${inputs.pkgs.iputils}/bin/ping -i 5 ${peer.value.wireguardIp}";
|
2024-01-19 19:45:56 +08:00
|
|
|
Restart = "always";
|
|
|
|
};
|
|
|
|
};
|
|
|
|
})
|
|
|
|
(filter (peer: !peer.value.behindNat) (map
|
2023-12-14 23:34:03 +08:00
|
|
|
(peer:
|
|
|
|
{
|
2024-01-19 19:45:56 +08:00
|
|
|
name = peer;
|
|
|
|
value = inputs.topInputs.self.nixosConfigurations.${peer}.config.nixos.services.wireguard;
|
2023-12-14 23:34:03 +08:00
|
|
|
})
|
2024-01-19 19:45:56 +08:00
|
|
|
wireguard.peers))));
|
|
|
|
}
|
|
|
|
)
|
|
|
|
];
|
2023-12-07 17:18:55 +08:00
|
|
|
}
|