92 lines
3 KiB
Nix
92 lines
3 KiB
Nix
{ pkgs, config, secret, ... }:
|
|
|
|
{
|
|
environment.systemPackages = with pkgs; [ ldns tcpdump wireguard-tools ];
|
|
|
|
environment.etc."netns/wg/resolv.conf" = {
|
|
mode = "0644";
|
|
text = ''
|
|
nameserver ${secret.wireguard.dnsv4}
|
|
nameserver ${secret.wireguard.dnsv6}
|
|
'';
|
|
};
|
|
|
|
environment.etc."netns/wg/nsswitch.conf" = {
|
|
mode = "0644";
|
|
text = ''
|
|
passwd: files systemd
|
|
group: files [success=merge] systemd
|
|
shadow: files
|
|
|
|
hosts: dns [!UNAVAIL=return] files
|
|
networks: files
|
|
|
|
ethers: files
|
|
services: files
|
|
protocols: files
|
|
rpc: files
|
|
'';
|
|
};
|
|
|
|
systemd.services."netns@" = {
|
|
description = "%I network namespace";
|
|
before = [ "network.target" ];
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
RemainAfterExit = true;
|
|
ExecStart = "${pkgs.iproute}/bin/ip netns add %I";
|
|
ExecStop = "${pkgs.iproute}/bin/ip netns del %I";
|
|
};
|
|
};
|
|
|
|
systemd.services.wg = {
|
|
description = "wg network interface";
|
|
bindsTo = [ "netns@wg.service" ];
|
|
wants = [ "network-online.target" ];
|
|
after = [ "netns@wg.service" "network-online.target" "run-agenix.d.mount" ];
|
|
environment.WG_ENDPOINT_RESOLUTION_RETRIES = "infinity";
|
|
|
|
restartTriggers = [
|
|
"${config.age.secrets.wireguard-config.file}"
|
|
];
|
|
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
RemainAfterExit = true;
|
|
ExecStart = with pkgs; writers.writeBash "wg-up" ''
|
|
set -e
|
|
echo "Setting lo to up ..."
|
|
${iproute}/bin/ip -n wg link set lo up
|
|
echo "Creating veth network ..."
|
|
${iproute}/bin/ip link add name vethwghost0 type veth peer vethwgns0 netns wg
|
|
${iproute}/bin/ip address add 192.168.42.1/24 dev vethwghost0
|
|
${iproute}/bin/ip -n wg address add 192.168.42.2/24 dev vethwgns0
|
|
${iproute}/bin/ip link set vethwghost0 up
|
|
${iproute}/bin/ip -n wg link set vethwgns0 up
|
|
echo "Creating wg0 interface ..."
|
|
${iproute}/bin/ip link add wg0 type wireguard
|
|
${wireguard-tools}/bin/wg setconf wg0 ${config.age.secrets.wireguard-config.path}
|
|
${iproute}/bin/ip link set wg0 netns wg
|
|
${iproute}/bin/ip -n wg address add ${secret.wireguard.ipv4} dev wg0
|
|
${iproute}/bin/ip -n wg -6 address add ${secret.wireguard.ipv6} dev wg0
|
|
${iproute}/bin/ip -n wg link set wg0 up
|
|
${iproute}/bin/ip -n wg route add default dev wg0
|
|
${iproute}/bin/ip -n wg -6 route add default dev wg0
|
|
echo "Done!"
|
|
'';
|
|
ExecStop = with pkgs; writers.writeBash "wg-down" ''
|
|
echo "Tearing down wg0 ..."
|
|
${iproute}/bin/ip -n wg route del default dev wg0
|
|
${iproute}/bin/ip -n wg -6 route del default dev wg0
|
|
${iproute}/bin/ip -n wg link del wg0
|
|
echo "Tearing down veth network ..."
|
|
${iproute}/bin/ip link del vethwghost0
|
|
${iproute}/bin/ip -n wg link del vethwgns0
|
|
echo "Setting lo to down ..."
|
|
${iproute}/bin/ip -n wg link set lo down
|
|
echo "Done!"
|
|
'';
|
|
};
|
|
};
|
|
}
|