89 lines
2.5 KiB
Nix
89 lines
2.5 KiB
Nix
{config, lib, pkgs, ...}:
|
|
let
|
|
cfg = config.cos.wireguard;
|
|
in
|
|
{
|
|
options.cos.wireguard = {
|
|
enable = lib.mkEnableOption "enable";
|
|
interface = lib.mkOption {
|
|
type = lib.types.str;
|
|
default = "wg0";
|
|
};
|
|
clientPubOptionsMap = lib.mkOption {
|
|
type = lib.types.submodule {
|
|
options = lib.attrsets.genAttrs config.cos.knownHosts (host: lib.mkOption {
|
|
type = lib.types.nullOr (lib.types.submodule {
|
|
options = {
|
|
clientNumber = lib.mkOption {
|
|
type = lib.types.ints.u8;
|
|
description = "appended to IP";
|
|
};
|
|
ip = lib.mkOption {
|
|
type = lib.types.str;
|
|
default = "${cfg.baseIP}.${builtins.toString cfg.clientPubOptionsMap.${host}.clientNumber}";
|
|
};
|
|
port = lib.mkOption {
|
|
type = lib.types.port;
|
|
default = 51820;
|
|
};
|
|
publicKey = lib.mkOption {
|
|
type = lib.types.str;
|
|
};
|
|
};
|
|
});
|
|
default = null;
|
|
});
|
|
};
|
|
};
|
|
baseIP = lib.mkOption {
|
|
type = lib.types.str;
|
|
default = "10.100.0";
|
|
};
|
|
clientInternalIP = lib.mkOption {
|
|
type = lib.types.str;
|
|
default = cfg.clientPubOptionsMap.${config.cos.hostName}.ip;
|
|
};
|
|
clientInternalPort = lib.mkOption {
|
|
type = lib.types.port;
|
|
default = cfg.clientPubOptionsMap.${config.cos.hostName}.port;
|
|
};
|
|
clientPublicKey = lib.mkOption {
|
|
type = lib.types.str;
|
|
default = cfg.clientPubOptionsMap.${config.cos.hostName}.publicKey;
|
|
};
|
|
privateKeyFile = lib.mkOption {
|
|
type = lib.types.str;
|
|
};
|
|
};
|
|
|
|
config = lib.mkIf cfg.enable {
|
|
networking.firewall.interfaces.${cfg.interface}.allowedUDPPorts = [
|
|
cfg.clientInternalPort
|
|
];
|
|
|
|
environment.systemPackages = with pkgs; [
|
|
wireguard-tools
|
|
];
|
|
|
|
networking.wireguard = {
|
|
enable = true;
|
|
interfaces = {
|
|
${cfg.interface} = {
|
|
ips = [ "${cfg.clientInternalIP}/24" ];
|
|
listenPort = cfg.clientInternalPort;
|
|
|
|
privateKeyFile = cfg.privateKeyFile;
|
|
|
|
peers = [
|
|
{
|
|
publicKey = cfg.clientPubOptionsMap.loadedskypotato.publicKey;
|
|
allowedIPs = [ "${cfg.baseIP}.0/24" ];
|
|
endpoint = "${config.cos.knownPublicIPs.loadedskypotato}:${builtins.toString cfg.clientPubOptionsMap.loadedskypotato.port}";
|
|
persistentKeepalive = 25;
|
|
}
|
|
];
|
|
};
|
|
};
|
|
};
|
|
};
|
|
}
|