2023-12-07 17:18:55 +08:00
|
|
|
inputs:
|
|
|
|
{
|
|
|
|
options.nixos.services.wireguard = let inherit (inputs.lib) mkOption types; in
|
|
|
|
{
|
|
|
|
enable = mkOption { type = types.bool; default = false; };
|
|
|
|
peers = mkOption { type = types.nonEmptyListOf types.nonEmptyStr; default = []; };
|
2023-12-17 12:10:45 +08:00
|
|
|
# wg genkey | wg pubkey
|
|
|
|
publicKey = mkOption { type = types.nonEmptyStr; };
|
|
|
|
wireguardIp = mkOption { type = types.nonEmptyStr; };
|
|
|
|
externalIp = mkOption { type = types.nullOr types.nonEmptyStr; default = null; };
|
|
|
|
lighthouse = mkOption { type = types.bool; default = false; };
|
2023-12-07 17:18:55 +08:00
|
|
|
};
|
|
|
|
config =
|
|
|
|
let
|
|
|
|
inherit (inputs.lib) mkIf;
|
|
|
|
inherit (inputs.config.nixos.services) wireguard;
|
2023-12-07 17:41:51 +08:00
|
|
|
inherit (builtins) map toString;
|
2023-12-07 17:18:55 +08:00
|
|
|
in mkIf wireguard.enable
|
|
|
|
{
|
2023-12-14 23:34:03 +08:00
|
|
|
networking =
|
|
|
|
let
|
|
|
|
# if the host is behind xray, it should listen on another port, to make xray succeffully listen on 51820
|
|
|
|
port = 51820 + (if inputs.config.nixos.services.xrayClient.enable then 1 else 0);
|
|
|
|
in
|
2023-12-07 17:18:55 +08:00
|
|
|
{
|
2023-12-15 12:40:28 +08:00
|
|
|
firewall = { allowedUDPPorts = [ port ]; trustedInterfaces = [ "wireguard" ]; };
|
2023-12-14 23:34:03 +08:00
|
|
|
wireguard.interfaces.wireguard =
|
|
|
|
{
|
2023-12-17 12:10:45 +08:00
|
|
|
ips = [ "${wireguard.wireguardIp}/24" ];
|
2023-12-14 23:34:03 +08:00
|
|
|
listenPort = port;
|
|
|
|
privateKeyFile = inputs.config.sops.secrets."wireguard/privateKey".path;
|
|
|
|
peers = map
|
|
|
|
(peer:
|
|
|
|
{
|
|
|
|
publicKey = peer.publicKey;
|
|
|
|
allowedIPs = [ (if peer.lighthouse then "192.168.83.0/24" else "${peer.wireguardIp}/32") ];
|
|
|
|
endpoint = mkIf (peer.externalIp != null) "${peer.externalIp}:51820";
|
|
|
|
persistentKeepalive = 3;
|
|
|
|
})
|
2023-12-17 12:10:45 +08:00
|
|
|
(map
|
|
|
|
(peer: inputs.topInputs.self.nixosConfigurations.${peer}.config.nixos.services.wireguard)
|
|
|
|
wireguard.peers);
|
2023-12-14 23:34:03 +08:00
|
|
|
};
|
2023-12-07 17:18:55 +08:00
|
|
|
};
|
|
|
|
sops.secrets."wireguard/privateKey" = {};
|
|
|
|
};
|
|
|
|
}
|