sample deployment of wgautomesh on staging (dont deploy prod with this commit)

This commit is contained in:
Alex 2023-03-09 15:31:05 +01:00
parent 870511931a
commit baae97b192
6 changed files with 136 additions and 15 deletions

View file

@ -13,7 +13,6 @@
site_name = "neptune";
publicKey = "7Nm7pMmyS7Nts1MB+loyD8u84ODxHPTkDu+uqQR6yDk=";
IP = "10.14.1.2";
lan_endpoint = "192.168.1.22:33799";
endpoint = "77.207.15.215:33722";
}
{
@ -21,7 +20,6 @@
site_name = "neptune";
publicKey = "lABn/axzD1jkFulX8c+K3B3CbKXORlIMDDoe8sQVxhs=";
IP = "10.14.1.3";
lan_endpoint = "192.168.1.23:33799";
endpoint = "77.207.15.215:33723";
}
{
@ -29,7 +27,6 @@
site_name = "jupiter";
publicKey = "smBQYUS60JDkNoqkTT7TgbpqFiM43005fcrT6472llI=";
IP = "10.14.2.33";
lan_endpoint = "192.168.1.33:33799";
endpoint = "82.64.238.84:33733";
}
{
@ -37,7 +34,6 @@
site_name = "corrin";
publicKey = "m9rLf+233X1VColmeVrM/xfDGro5W6Gk5N0zqcf32WY=";
IP = "10.14.3.1";
lan_endpoint = "192.168.1.25:33799";
endpoint = "82.120.233.78:33721";
}
{
@ -45,7 +41,6 @@
site_name = "bespin";
publicKey = "XLOYoMXF+PO4jcgfSVAk+thh4VmWx0wzWnb0xs08G1s=";
IP = "10.14.4.1";
lan_endpoint = "192.168.5.130:33799";
endpoint = "bitfrost.fiber.shirokumo.net:33734";
}
];

View file

@ -8,3 +8,4 @@ piranha.polyno.me,2a01:cb05:8984:3c00:223:24ff:feb0:ea82 ssh-ed25519 AAAAC3NzaC1
2001:910:1204:1::21 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPXTUrXRFhudJBESCqjHCOttzqYPyIzpPOMkI8+SwLRx
2a01:e0a:5e4:1d0:223:24ff:feaf:fdec ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAsZas74RT6lCZwuUOPR23nPdbSdpWORyAmRgjoiMVHK
df-pw5.machine.deuxfleurs.fr ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK/dJIxioCkfeehxeGiZR7qquYGoqEH/YrRJ/ukEcaLH
10.14.3.1 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJnpO6zpLWsyyugOoOj+2bUow9TUrcWgURFGGaoyu+co

View file

@ -10,7 +10,9 @@ Host origan
HostName origan.df.trinity.fr.eu.org
Host piranha
HostName piranha.polyno.me
ProxyJump caribou.machine.deuxfleurs.fr
HostName 10.14.3.1
#HostName piranha.polyno.me
Host df-pw5
HostName df-pw5.machine.deuxfleurs.fr

View file

@ -9,6 +9,7 @@ copy cluster/$CLUSTER/node/$NIXHOST.site.nix /etc/nixos/site.nix
if [ "$CLUSTER" = "staging" ]; then
copy nix/nomad-driver-nix2.nix /etc/nixos/nomad-driver-nix2.nix
copy nix/wgautomesh.nix /etc/nixos/wgautomesh.nix
fi
if [ "$CLUSTER" = "prod" ]; then

View file

@ -28,6 +28,7 @@ in
};
endpoint = mkOption {
type = nullOr str;
default = null;
description = "Wireguard endpoint on the public Internet";
};
lan_endpoint = mkOption {
@ -134,6 +135,10 @@ in
};
};
imports = [
./wgautomesh.nix
];
config =
let node_meta = {
"site" = cfg.site_name;
@ -147,6 +152,7 @@ in
else {});
in
{
# Configure admin accounts on all nodes
users.users = builtins.mapAttrs (name: publicKeys: {
isNormalUser = true;
@ -233,18 +239,27 @@ in
services.resolved.enable = false;
# Configure Wireguard VPN between all nodes
systemd.services."wg-quick-wg0".after = [ "unbound.service" ];
networking.wg-quick.interfaces.wg0 = {
address = [ "${cfg.cluster_ip}/16" ];
networking.wireguard.interfaces.wg0 = {
ips = [ "${cfg.cluster_ip}/16" ];
listenPort = cfg.wireguard_port;
privateKeyFile = "/var/lib/deuxfleurs/wireguard-keys/private";
mtu = 1420;
peers = map ({ publicKey, endpoint, IP, site_name, lan_endpoint, ... }: {
publicKey = publicKey;
allowedIPs = [ "${IP}/32" ];
endpoint = if site_name != null && site_name == cfg.site_name && lan_endpoint != null
then lan_endpoint else endpoint;
persistentKeepalive = 25;
};
services.wgautomesh = {
enable = true;
interface = "wg0";
gossipPort = 1666;
upnpForwardPublicPort =
let
us = filter ({ hostname, ...}: hostname == config.networking.hostName) cfg.cluster_nodes;
in
if length us > 0 && (head us).endpoint != null then
strings.toInt (lists.last (split ":" (head us).endpoint))
else null;
peers = map ({ publicKey, endpoint, IP, ... }: {
address = IP;
pubkey = publicKey;
endpoint = endpoint;
}) cfg.cluster_nodes;
};

107
nix/wgautomesh.nix Normal file
View file

@ -0,0 +1,107 @@
let
src = builtins.fetchGit {
url = "https://git.deuxfleurs.fr/lx/wgautomesh";
rev = "43eced6e9aa5935b4553251604207f72bf0214c1";
};
wgautomesh = (import src).packages.x86_64-linux.default;
in
{ lib, config, pkgs, ... }:
with lib;
let
cfg = config.services.wgautomesh;
in
with builtins;
{
options.services.wgautomesh = {
enable = mkEnableOption "wgautomesh";
interface = mkOption {
type = types.str;
description = "Wireguard interface to manage";
};
gossipPort = mkOption {
type = types.port;
description = "wgautomesh gossip port";
};
lanDiscovery = mkOption {
type = types.bool;
default = true;
description = "Enable discovery using LAN broadcast";
};
openFirewall = mkOption {
type = types.bool;
default = true;
description = "Automatically open gossip port in firewall";
};
upnpForwardPublicPort = mkOption {
type = types.nullOr types.port;
default = null;
description = "Public port number to try to redirect to this machine using UPnP IGD";
};
peers = mkOption {
type = types.listOf (types.submodule {
options = {
pubkey = mkOption {
type = types.str;
description = "Wireguard public key";
};
address = mkOption {
type = types.str;
description = "Wireguard peer address";
};
endpoint = mkOption {
type = types.nullOr types.str;
description = "bootstrap endpoint";
};
};
});
description = "wgautomesh peer list";
};
};
config = mkIf cfg.enable (
let
peerDefs = map (peer:
let endpointDef = if peer.endpoint == null then ""
else ''endpoint = "${peer.endpoint}"'';
in
''
[[peers]]
pubkey = "${peer.pubkey}"
address = "${peer.address}"
${endpointDef}
'') cfg.peers;
extraDefs = (if cfg.lanDiscovery then ["lan_discovery = true"] else [])
++ (if (cfg.upnpForwardPublicPort != null)
then [''upnp_forward_external_port = ${toString cfg.upnpForwardPublicPort}''] else []);
configfile = pkgs.writeText "wgautomesh.toml" ''
interface = "${cfg.interface}"
gossip_port = ${toString cfg.gossipPort}
${concatStringsSep "\n" (extraDefs ++ peerDefs)}
'';
in {
systemd.services.wgautomesh = {
enable = true;
path = [ pkgs.wireguard-tools ];
environment = {
RUST_LOG = "wgautomesh=info";
};
description = "wgautomesh";
serviceConfig = {
Type = "simple";
ExecStart = "${wgautomesh}/bin/wgautomesh ${configfile}";
Restart = "always";
RestartSec = "30";
DynamicUser = true;
AmbientCapabilities = "CAP_NET_ADMIN CAP_NET_BIND_SERVICE";
CapabilityBoundingSet = "CAP_NET_ADMIN CAP_NET_BIND_SERVICE";
};
wantedBy = [ "multi-user.target" ];
};
networking.firewall.allowedUDPPorts = mkIf cfg.openFirewall [ cfg.gossipPort ];
});
}