Compare commits

..

No commits in common. "2add84963dab019b165d8199b94e790d43d6e0cd" and "a31c6d109e95a33e165d43c4a47de54ea53ca436" have entirely different histories.

3 changed files with 129 additions and 166 deletions

View file

@ -7,9 +7,9 @@ copy cluster/$CLUSTER/cluster.nix /etc/nixos/cluster.nix
copy cluster/$CLUSTER/node/$NIXHOST.nix /etc/nixos/node.nix copy cluster/$CLUSTER/node/$NIXHOST.nix /etc/nixos/node.nix
copy cluster/$CLUSTER/node/$NIXHOST.site.nix /etc/nixos/site.nix copy cluster/$CLUSTER/node/$NIXHOST.site.nix /etc/nixos/site.nix
cmd mkdir -p /var/lib/wgautomesh
write_pass deuxfleurs/cluster/$CLUSTER/wgautomesh_gossip_secret /var/lib/wgautomesh/gossip_secret
copy nix/wgautomesh.nix /etc/nixos/wgautomesh.nix copy nix/wgautomesh.nix /etc/nixos/wgautomesh.nix
cmd mkdir -p /var/lib/deuxfleurs
write_pass deuxfleurs/cluster/$CLUSTER/wgautomesh_gossip_secret /var/lib/deuxfleurs/wgautomesh_gossip_secret
if [ "$CLUSTER" = "staging" ]; then if [ "$CLUSTER" = "staging" ]; then
copy nix/nomad-driver-nix2.nix /etc/nixos/nomad-driver-nix2.nix copy nix/nomad-driver-nix2.nix /etc/nixos/nomad-driver-nix2.nix

View file

@ -207,19 +207,18 @@ in
}; };
services.wgautomesh = { services.wgautomesh = {
enable = true; enable = true;
gossipSecretFile = "/var/lib/deuxfleurs/wgautomesh_gossip_secret"; interface = "wg0";
settings = { gossipPort = 1666;
interface = "wg0"; gossipSecretFile = "/var/lib/wgautomesh/gossip_secret";
gossip_port = 1666; persistFile = "/var/lib/wgautomesh/state";
upnp_forward_external_port = upnpForwardPublicPort =
if clusterNodeCfg.endpoint != null then if clusterNodeCfg.endpoint != null then
strings.toInt (lists.last (split ":" clusterNodeCfg.endpoint)) strings.toInt (lists.last (split ":" clusterNodeCfg.endpoint))
else null; else null;
peers = attrValues (mapAttrs (hostname: { publicKey, endpoint, address, ... }: { peers = attrValues (mapAttrs (hostname: { publicKey, endpoint, address, ... }: {
inherit address endpoint; inherit address endpoint;
pubkey = publicKey; pubkey = publicKey;
}) cfg.clusterNodes); }) cfg.clusterNodes);
};
}; };
# Old code for wg-quick, we can use this as a fallback if we fail to make wgautomesh work # Old code for wg-quick, we can use this as a fallback if we fail to make wgautomesh work
# systemd.services."wg-quick-wg0".after = [ "unbound.service" ]; # systemd.services."wg-quick-wg0".after = [ "unbound.service" ];

View file

@ -7,159 +7,123 @@ in
{ lib, config, pkgs, ... }: { lib, config, pkgs, ... }:
with lib; with lib;
let let
cfg = config.services.wgautomesh; cfg = config.services.wgautomesh;
settingsFormat = pkgs.formats.toml { };
configFile =
# Have to remove nulls manually as TOML generator will not just skip key
# if value is null
settingsFormat.generate "wgautomesh-config.toml"
(filterAttrs (k: v: v != null)
(mapAttrs
(k: v:
if k == "peers"
then map (e: filterAttrs (k: v: v != null) e) v
else v)
cfg.settings));
runtimeConfigFile =
if cfg.enableGossipEncryption
then "/run/wgautomesh/wgautomesh.toml"
else configFile;
in in
{ with builtins;
options.services.wgautomesh = { {
enable = mkEnableOption (mdDoc "the wgautomesh daemon"); options.services.wgautomesh = {
logLevel = mkOption { enable = mkEnableOption "wgautomesh";
type = types.enum [ "trace" "debug" "info" "warn" "error" ]; logLevel = mkOption {
default = "info"; type = types.enum [ "trace" "debug" "info" "warn" "error" ];
description = mdDoc "wgautomesh log level."; default = "info";
}; description = "wgautomesh log level (trace/debug/info/warn/error)";
enableGossipEncryption = mkOption { };
type = types.bool; interface = mkOption {
default = true; type = types.str;
description = mdDoc "Enable encryption of gossip traffic."; description = "Wireguard interface to manage";
}; };
gossipSecretFile = mkOption { gossipPort = mkOption {
type = types.path; type = types.port;
description = mdDoc '' description = "wgautomesh gossip port";
File containing the shared secret key to use for gossip encryption. };
Required if `enableGossipEncryption` is set. gossipSecretFile = mkOption {
''; type = types.nullOr types.str;
}; description = "File containing the gossip secret encryption key";
enablePersistence = mkOption { };
type = types.bool; persistFile = mkOption {
default = true; type = types.nullOr types.str;
description = mdDoc "Enable persistence of Wireguard peer info between restarts."; description = "Path where to persist known peer addresses";
}; };
openFirewall = mkOption { lanDiscovery = mkOption {
type = types.bool; type = types.bool;
default = true; default = true;
description = mdDoc "Automatically open gossip port in firewall (recommended)."; description = "Enable discovery using LAN broadcast";
}; };
settings = mkOption { openFirewall = mkOption {
type = types.submodule { type = types.bool;
freeformType = settingsFormat.type; default = true;
options = { description = "Automatically open gossip port in firewall";
interface = mkOption { };
type = types.str; upnpForwardPublicPort = mkOption {
description = mdDoc '' type = types.nullOr types.port;
Wireguard interface to manage (it is NOT created by wgautomesh, you default = null;
should use another NixOS option to create it such as description = "Public port number to try to redirect to this machine using UPnP IGD";
`networking.wireguard.interfaces.wg0 = {...};`). };
''; peers = mkOption {
example = "wg0"; type = types.listOf (types.submodule {
}; options = {
gossip_port = mkOption { pubkey = mkOption {
type = types.port; type = types.str;
description = mdDoc '' description = "Wireguard public key";
wgautomesh gossip port, this MUST be the same number on all nodes in };
the wgautomesh network. address = mkOption {
''; type = types.str;
default = 1666; description = "Wireguard peer address";
}; };
lan_discovery = mkOption { endpoint = mkOption {
type = types.bool; type = types.nullOr types.str;
default = true; description = "bootstrap endpoint";
description = mdDoc "Enable discovery of peers on the same LAN using UDP broadcast."; };
};
upnp_forward_external_port = mkOption {
type = types.nullOr types.port;
default = null;
description = mdDoc ''
Public port number to try to redirect to this machine's Wireguard
daemon using UPnP IGD.
'';
};
peers = mkOption {
type = types.listOf (types.submodule {
options = {
pubkey = mkOption {
type = types.str;
description = mdDoc "Wireguard public key of this peer.";
};
address = mkOption {
type = types.str;
description = mdDoc ''
Wireguard address of this peer (a single IP address, multliple
addresses or address ranges are not supported).
'';
example = "10.0.0.42";
};
endpoint = mkOption {
type = types.nullOr types.str;
description = mdDoc ''
Bootstrap endpoint for connecting to this Wireguard peer if no
other address is known or none are working.
'';
default = null;
example = "wgnode.mydomain.example:51820";
};
};
});
default = [ ];
description = mdDoc "wgautomesh peer list.";
}; };
});
description = "wgautomesh peer list";
};
};
config = mkIf cfg.enable (
let
peerDefs = map (peer:
let endpointDef = if peer.endpoint == null then ""
else ''endpoint = "${peer.endpoint}"'';
in
''
[[peers]]
pubkey = "${peer.pubkey}"
address = "${peer.address}"
${endpointDef}
'') cfg.peers;
extraDefs = (if cfg.lanDiscovery then ["lan_discovery = true"] else [])
++ (if (cfg.gossipSecretFile != null)
then [''gossip_secret_file = "${cfg.gossipSecretFile}"''] else [])
++ (if (cfg.persistFile != null)
then [''persist_file = "${cfg.persistFile}"''] else [])
++ (if (cfg.upnpForwardPublicPort != null)
then [''upnp_forward_external_port = ${toString cfg.upnpForwardPublicPort}''] else []);
configfile = pkgs.writeText "wgautomesh.toml" ''
interface = "${cfg.interface}"
gossip_port = ${toString cfg.gossipPort}
${concatStringsSep "\n" extraDefs}
${concatStringsSep "\n" peerDefs}
'';
in {
systemd.services.wgautomesh = {
enable = true;
path = [ pkgs.wireguard-tools ];
environment = {
RUST_LOG = "wgautomesh=${cfg.logLevel}";
}; };
description = "wgautomesh";
serviceConfig = {
Type = "simple";
ExecStart = "${wgautomesh}/bin/wgautomesh ${configfile}";
Restart = "always";
RestartSec = "30";
ExecStartPre = [ "+${pkgs.coreutils}/bin/chown wgautomesh /var/lib/wgautomesh/gossip_secret" ];
DynamicUser = true;
User = "wgautomesh";
StateDirectory = "wgautomesh";
StateDirectoryMode = "0700";
AmbientCapabilities = "CAP_NET_ADMIN";
CapabilityBoundingSet = "CAP_NET_ADMIN";
};
wantedBy = [ "multi-user.target" ];
}; };
default = { }; networking.firewall.allowedUDPPorts = mkIf cfg.openFirewall [ cfg.gossipPort ];
description = mdDoc "Configuration for wgautomesh."; });
}; }
};
config = mkIf cfg.enable {
services.wgautomesh.settings = {
gossip_secret_file = mkIf cfg.enableGossipEncryption "$CREDENTIALS_DIRECTORY/gossip_secret";
persist_file = mkIf cfg.enablePersistence "/var/lib/wgautomesh/state";
};
systemd.services.wgautomesh = {
path = [ pkgs.wireguard-tools ];
environment = { RUST_LOG = "wgautomesh=${cfg.logLevel}"; };
description = "wgautomesh";
serviceConfig = {
Type = "simple";
ExecStart = "${wgautomesh}/bin/wgautomesh ${runtimeConfigFile}";
Restart = "always";
RestartSec = "30";
LoadCredential = mkIf cfg.enableGossipEncryption [ "gossip_secret:${cfg.gossipSecretFile}" ];
ExecStartPre = mkIf cfg.enableGossipEncryption [
''${pkgs.envsubst}/bin/envsubst \
-i ${configFile} \
-o ${runtimeConfigFile}''
];
DynamicUser = true;
StateDirectory = "wgautomesh";
StateDirectoryMode = "0700";
RuntimeDirectory = "wgautomesh";
AmbientCapabilities = "CAP_NET_ADMIN";
CapabilityBoundingSet = "CAP_NET_ADMIN";
};
wantedBy = [ "multi-user.target" ];
};
networking.firewall.allowedUDPPorts =
mkIf cfg.openFirewall [ cfg.settings.gossip_port ];
};
}