wireguard: setup VPN

.gitattributes

@@ -1 +1,2 @@
 secrets/*.secret filter=git-crypt diff=git-crypt
+secrets/wireguard.nix filter=git-crypt diff=git-crypt

base/default.nix

@@ -1,6 +1,7 @@
 { ... }:
 {
   imports = [
+    ./networking.nix
     ./nix.nix
     ./users.nix
   ];

base/networking.nix

@@ -0,0 +1,12 @@
+{ lib, ... }:
+{
+  options.my.networking.externalInterface = with lib; mkOption {
+    type = types.nullOr types.str;
+    default = null;
+    example = "eth0";
+    description = ''
+      Name of the network interface that egresses to the internet. Used for
+      e.g. NATing internal networks.
+    '';
+  };
+}

flake.lock

@@ -2,11 +2,11 @@
   "nodes": {
     "nixpkgs": {
       "locked": {
-        "lastModified": 1613722520,
+        "lastModified": 1613980253,
-        "narHash": "sha256-zMkNXzMTnE2K4Ew2Ex7RwBLnvqyAf1TYr2TLsmLkqDs=",
+        "narHash": "sha256-3jZJAUsTSsKaElPy509a4OX87Vvy1Mu5Z1V3pMg/Pc0=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "a83ee7565fba56cf85d4aff63413320a50fbb936",
+        "rev": "d4189f68fdbe0b14b7637447cb0efde2711f4abf",
         "type": "github"
       },
       "original": {

hosts/poseidon/default.nix

@@ -41,6 +41,7 @@ in
     "62.210.16.6"
     "62.210.16.7"
   ];
+  my.networking.externalInterface = "eno1";
 
   # List packages installed in system profile. To search, run:
   # $ nix search wget
@@ -119,6 +120,23 @@ in
       username = "alarsyo";
       password = secrets.transmission-password;
     };
+
+    wireguard = {
+      enable = true;
+      iface = "wg";
+      port = 51820;
+
+      net = {
+        v4 = {
+          subnet = "10.0.0";
+          mask = 24;
+        };
+        v6 = {
+          subnet = "fd42:42:42";
+          mask = 64;
+        };
+      };
+    };
   };
 
   security.acme.acceptTerms = true;

secrets/default.nix

@@ -1,4 +1,4 @@
-{ lib, config, ... }:
+{ pkgs, lib, config, ... }:
 with lib;
 {
   options.my.secrets = mkOption {
@@ -12,5 +12,7 @@ with lib;
     miniflux-admin-credentials = lib.fileContents ./miniflux-admin-credentials.secret;
     borg-backup-repo = lib.fileContents ./borg-backup-repo.secret;
     transmission-password = lib.fileContents ./transmission.secret;
+
+    wireguard = pkgs.callPackage ./wireguard.nix { };
   };
 }

services/default.nix

@@ -14,5 +14,6 @@
     ./nginx.nix
     ./postgresql-backup.nix
     ./transmission.nix
+    ./wireguard.nix
   ];
 }

services/wireguard.nix

@@ -0,0 +1,122 @@
+# Stolen from:
+#
+# https://gitea.belanyi.fr/ambroisie/nix-config/src/branch/main/services/wireguard.nix
+
+{ config, lib, pkgs, ... }:
+let
+  cfg = config.my.services.wireguard;
+  hostName = config.networking.hostName;
+
+  peers = config.my.secrets.wireguard.peers;
+  thisPeer = peers."${hostName}";
+  otherPeers = lib.filterAttrs (name: _: name != hostName) peers;
+
+  extIface = config.my.networking.externalInterface;
+in
+{
+  options.my.services.wireguard = with lib; {
+    enable = mkEnableOption "Wireguard VPN service";
+
+    iface = mkOption {
+      type = types.str;
+      default = "wg";
+      example = "wg0";
+      description = "Name of the interface to configure";
+    };
+
+    port = mkOption {
+      type = types.port;
+      default = 51820;
+      example = 55555;
+      description = "Port to configure for Wireguard";
+    };
+
+    net = {
+      v4 = {
+        subnet = mkOption {
+          type = types.str;
+          default = "10.0.0";
+          example = "10.100.0";
+          description = "Which prefix to use for internal IPs";
+        };
+        mask = mkOption {
+          type = types.int;
+          default = 24;
+          example = 28;
+          description = "The CIDR mask to use on internal IPs";
+        };
+      };
+      v6 = {
+        subnet = mkOption {
+          type = types.str;
+          default = "fd42:42:42";
+          example = "fdc9:281f:04d7:9ee9";
+          description = "Which prefix to use for internal IPs";
+        };
+        mask = mkOption {
+          type = types.int;
+          default = 64;
+          example = 68;
+          description = "The CIDR mask to use on internal IPs";
+        };
+      };
+    };
+  };
+
+  config.networking = lib.mkIf cfg.enable {
+    wg-quick.interfaces."${cfg.iface}" = {
+      listenPort = cfg.port;
+      address = with cfg.net; with lib; [
+        "${v4.subnet}.${toString thisPeer.clientNum}/${toString v4.mask}"
+        "${v6.subnet}::${toString thisPeer.clientNum}/${toHexString v6.mask}"
+      ];
+      privateKey = thisPeer.privateKey;
+
+      peers = lib.mapAttrsToList
+        (name: peer: {
+          inherit (peer) publicKey;
+        } // lib.optionalAttrs (thisPeer ? externalIp) {
+          # Only forward from server to clients
+          allowedIPs = with cfg.net; [
+            "${v4.subnet}.${toString peer.clientNum}/32"
+            "${v6.subnet}::${toString peer.clientNum}/128"
+          ];
+        } // lib.optionalAttrs (peer ? externalIp) {
+          # Known addresses
+          endpoint = "${peer.externalIp}:${toString cfg.port}";
+        } // lib.optionalAttrs (!(thisPeer ? externalIp)) {
+          # Forward all traffic to server
+          allowedIPs = with cfg.net; [
+            "0.0.0.0/0"
+            "::/0"
+          ];
+          # Roaming clients need to keep NAT-ing active
+          persistentKeepalive = 10;
+        })
+        otherPeers;
+    } // lib.optionalAttrs (thisPeer ? externalIp) {
+      # Setup forwarding on server
+      postUp = with cfg.net; ''
+        ${pkgs.iptables}/bin/iptables -A FORWARD -i ${cfg.iface} -j ACCEPT
+        ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s ${v4.subnet}.1/${toString v4.mask} -o ${extIface} -j MASQUERADE
+        ${pkgs.iptables}/bin/ip6tables -A FORWARD -i ${cfg.iface} -j ACCEPT
+        ${pkgs.iptables}/bin/ip6tables -t nat -A POSTROUTING -s ${v6.subnet}::1/${toString v6.mask} -o ${extIface} -j MASQUERADE
+      '';
+      preDown = with cfg.net; ''
+        ${pkgs.iptables}/bin/iptables -D FORWARD -i ${cfg.iface} -j ACCEPT
+        ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s ${v4.subnet}.1/${toString v4.mask} -o ${extIface} -j MASQUERADE
+        ${pkgs.iptables}/bin/ip6tables -D FORWARD -i ${cfg.iface} -j ACCEPT
+        ${pkgs.iptables}/bin/ip6tables -t nat -D POSTROUTING -s ${v6.subnet}::1/${toString v6.mask} -o ${extIface} -j MASQUERADE
+      '';
+
+    };
+
+    nat = lib.optionalAttrs (thisPeer ? externalIp) {
+      enable = true;
+      externalInterface = extIface;
+      internalInterfaces = [ cfg.iface ];
+    };
+
+    firewall.allowedUDPPorts = lib.optional (thisPeer ? externalIp) cfg.port;
+  };
+}