wireguard: setup VPN

This commit is contained in:
Antoine Martin 2021-02-22 18:59:37 +01:00
parent 1359014331
commit 80942f7eb3
8 changed files with 158 additions and 1 deletions

1
.gitattributes vendored
View file

@ -1 +1,2 @@
secrets/*.secret filter=git-crypt diff=git-crypt secrets/*.secret filter=git-crypt diff=git-crypt
secrets/wireguard.nix filter=git-crypt diff=git-crypt

View file

@ -1,6 +1,7 @@
{ ... }: { ... }:
{ {
imports = [ imports = [
./networking.nix
./nix.nix ./nix.nix
./users.nix ./users.nix
]; ];

12
base/networking.nix Normal file
View file

@ -0,0 +1,12 @@
{ lib, ... }:
{
options.my.networking.externalInterface = with lib; mkOption {
type = types.nullOr types.str;
default = null;
example = "eth0";
description = ''
Name of the network interface that egresses to the internet. Used for
e.g. NATing internal networks.
'';
};
}

View file

@ -41,6 +41,7 @@ in
"62.210.16.6" "62.210.16.6"
"62.210.16.7" "62.210.16.7"
]; ];
my.networking.externalInterface = "eno1";
# List packages installed in system profile. To search, run: # List packages installed in system profile. To search, run:
# $ nix search wget # $ nix search wget
@ -119,6 +120,23 @@ in
username = "alarsyo"; username = "alarsyo";
password = secrets.transmission-password; password = secrets.transmission-password;
}; };
wireguard = {
enable = true;
iface = "wg";
port = 51820;
net = {
v4 = {
subnet = "10.0.0";
mask = 24;
};
v6 = {
subnet = "fd42:42:42";
mask = 64;
};
};
};
}; };
security.acme.acceptTerms = true; security.acme.acceptTerms = true;

View file

@ -1,4 +1,4 @@
{ lib, config, ... }: { pkgs, lib, config, ... }:
with lib; with lib;
{ {
options.my.secrets = mkOption { options.my.secrets = mkOption {
@ -12,5 +12,7 @@ with lib;
miniflux-admin-credentials = lib.fileContents ./miniflux-admin-credentials.secret; miniflux-admin-credentials = lib.fileContents ./miniflux-admin-credentials.secret;
borg-backup-repo = lib.fileContents ./borg-backup-repo.secret; borg-backup-repo = lib.fileContents ./borg-backup-repo.secret;
transmission-password = lib.fileContents ./transmission.secret; transmission-password = lib.fileContents ./transmission.secret;
wireguard = pkgs.callPackage ./wireguard.nix { };
}; };
} }

BIN
secrets/wireguard.nix Normal file

Binary file not shown.

View file

@ -14,5 +14,6 @@
./nginx.nix ./nginx.nix
./postgresql-backup.nix ./postgresql-backup.nix
./transmission.nix ./transmission.nix
./wireguard.nix
]; ];
} }

122
services/wireguard.nix Normal file
View file

@ -0,0 +1,122 @@
# Stolen from:
#
# https://gitea.belanyi.fr/ambroisie/nix-config/src/branch/main/services/wireguard.nix
{ config, lib, pkgs, ... }:
let
cfg = config.my.services.wireguard;
hostName = config.networking.hostName;
peers = config.my.secrets.wireguard.peers;
thisPeer = peers."${hostName}";
otherPeers = lib.filterAttrs (name: _: name != hostName) peers;
extIface = config.my.networking.externalInterface;
in
{
options.my.services.wireguard = with lib; {
enable = mkEnableOption "Wireguard VPN service";
iface = mkOption {
type = types.str;
default = "wg";
example = "wg0";
description = "Name of the interface to configure";
};
port = mkOption {
type = types.port;
default = 51820;
example = 55555;
description = "Port to configure for Wireguard";
};
net = {
v4 = {
subnet = mkOption {
type = types.str;
default = "10.0.0";
example = "10.100.0";
description = "Which prefix to use for internal IPs";
};
mask = mkOption {
type = types.int;
default = 24;
example = 28;
description = "The CIDR mask to use on internal IPs";
};
};
v6 = {
subnet = mkOption {
type = types.str;
default = "fd42:42:42";
example = "fdc9:281f:04d7:9ee9";
description = "Which prefix to use for internal IPs";
};
mask = mkOption {
type = types.int;
default = 64;
example = 68;
description = "The CIDR mask to use on internal IPs";
};
};
};
};
config.networking = lib.mkIf cfg.enable {
wg-quick.interfaces."${cfg.iface}" = {
listenPort = cfg.port;
address = with cfg.net; with lib; [
"${v4.subnet}.${toString thisPeer.clientNum}/${toString v4.mask}"
"${v6.subnet}::${toString thisPeer.clientNum}/${toHexString v6.mask}"
];
privateKey = thisPeer.privateKey;
peers = lib.mapAttrsToList
(name: peer: {
inherit (peer) publicKey;
} // lib.optionalAttrs (thisPeer ? externalIp) {
# Only forward from server to clients
allowedIPs = with cfg.net; [
"${v4.subnet}.${toString peer.clientNum}/32"
"${v6.subnet}::${toString peer.clientNum}/128"
];
} // lib.optionalAttrs (peer ? externalIp) {
# Known addresses
endpoint = "${peer.externalIp}:${toString cfg.port}";
} // lib.optionalAttrs (!(thisPeer ? externalIp)) {
# Forward all traffic to server
allowedIPs = with cfg.net; [
"0.0.0.0/0"
"::/0"
];
# Roaming clients need to keep NAT-ing active
persistentKeepalive = 10;
})
otherPeers;
} // lib.optionalAttrs (thisPeer ? externalIp) {
# Setup forwarding on server
postUp = with cfg.net; ''
${pkgs.iptables}/bin/iptables -A FORWARD -i ${cfg.iface} -j ACCEPT
${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s ${v4.subnet}.1/${toString v4.mask} -o ${extIface} -j MASQUERADE
${pkgs.iptables}/bin/ip6tables -A FORWARD -i ${cfg.iface} -j ACCEPT
${pkgs.iptables}/bin/ip6tables -t nat -A POSTROUTING -s ${v6.subnet}::1/${toString v6.mask} -o ${extIface} -j MASQUERADE
'';
preDown = with cfg.net; ''
${pkgs.iptables}/bin/iptables -D FORWARD -i ${cfg.iface} -j ACCEPT
${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s ${v4.subnet}.1/${toString v4.mask} -o ${extIface} -j MASQUERADE
${pkgs.iptables}/bin/ip6tables -D FORWARD -i ${cfg.iface} -j ACCEPT
${pkgs.iptables}/bin/ip6tables -t nat -D POSTROUTING -s ${v6.subnet}::1/${toString v6.mask} -o ${extIface} -j MASQUERADE
'';
};
nat = lib.optionalAttrs (thisPeer ? externalIp) {
enable = true;
externalInterface = extIface;
internalInterfaces = [ cfg.iface ];
};
firewall.allowedUDPPorts = lib.optional (thisPeer ? externalIp) cfg.port;
};
}