wireguard: init module

hosts/apricot/default.nix

@@ -15,6 +15,7 @@
     packages
     security
     snapper
+    wireguard
 
     ./filesystem.nix
     ./kernel.nix

hosts/fondue/default.nix

@@ -12,6 +12,7 @@
     packages
     security
     snapper
+    wireguard
 
     ./filesystem.nix
     ./firewall.nix

hosts/winter/default.nix

@@ -17,6 +17,7 @@
     packages
     security
     snapper
+    wireguard
 
     ./filesystem.nix
     ./kernel.nix

modules/system/wireguard.nix

@@ -0,0 +1,63 @@
+{ config, lib, pkgs, ... }:
+let
+  serverName = "fondue";
+  serverInterface = "enp2s1";
+
+  clients = {
+    apricot = {
+      publicKey = "CpQJxoDeWJr7DdhbIO09svCxP7tuG2vUwRM8U4io5ms=";
+      allowedIPs = [ "10.100.0.2/32" ];
+    };
+    winter = {
+      publicKey = "6nVhazYdmC15A/nke9VrqIg3sOBVOmqj4GEsyBq7MVo=";
+      allowedIPs = [ "10.100.0.3/32" ];
+    };
+  };
+
+  clientPeers = builtins.attrValues clients;
+  serverPeer = {
+    publicKey = "GwUO/hU/CrrmfYazqrXuAiP4kFB3ZoaMXf13N12X2SY=";
+    allowedIPs = [ "10.100.0.0/24" ];
+    endpoint = "fondue.lava.moe:20100";
+    persistentKeepalive = 25;
+  };
+
+  serverConfig = {
+    nat = {
+      enable = true;
+      externalInterface = serverInterface;
+      internalInterfaces = [ "wg0" ];
+    };
+
+    wireguard.interfaces.wg0 = {
+      ips = [ "10.100.0.1/24" ];
+      listenPort = 20100;
+
+      postSetup = ''
+        ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -o ${serverInterface} -j MASQUERADE
+      '';
+      postShutdown = ''
+        ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.100.0.0/24 -o ${serverInterface} -j MASQUERADE
+      '';
+
+      privateKeyFile = config.age.secrets."wg_${serverName}".path;
+      peers = clientPeers;
+    };
+  };
+
+  clientConfig = {
+    wireguard.interfaces.wg0 = {
+      ips = clients."${config.networking.hostName}".allowedIPs;
+      listenPort = 20100;
+
+      privateKeyFile = config.age.secrets."wg_${config.networking.hostName}".path;
+      peers = [ serverPeer ];
+    };
+  };
+in {
+  networking =
+    lib.mkMerge [
+      (lib.mkIf (config.networking.hostName == serverName) serverConfig)
+      (lib.mkIf (builtins.hasAttr config.networking.hostName clients) clientConfig)
+    ];
+}

secrets.nix

@@ -9,4 +9,8 @@ let
 in {
   "secrets/passwd.age".publicKeys = [ apricot fondue winter rin-apricot rin-fondue rin-winter ];
   "secrets/wpa_conf.age".publicKeys = [ apricot winter rin-apricot rin-winter ];
+
+  "secrets/wg_apricot.age".publicKeys = [ apricot rin-apricot rin-winter ];
+  "secrets/wg_fondue.age".publicKeys = [ fondue rin-fondue rin-winter ];
+  "secrets/wg_winter.age".publicKeys = [ winter rin-winter ];
 }

secrets/wg_apricot.age

@@ -0,0 +1,12 @@
+age-encryption.org/v1
+-> ssh-ed25519 U9FXlg YbiJfSTq1/k1WYQCtN/S5kEQZxXzJD0vK8wY7LzDy30
+bjKK+gKkrs6+wXj3SM21S/t6PJNpOfi8/f2FzoxuSes
+-> ssh-ed25519 pumkzw V6sDMLLmFVJfczK9+KqD4yuwoT/uIWYZuYo/8mNBiiA
+Jmf+H4gFJjx5/6FPFR5+2XJNmOf8X1mZ7h5UTojTWS0
+-> ssh-ed25519 l9dSQg ubkdn+xI446eViRqmPXj9TSyKfUp1aefb7IIB30ftHc
+XjmIQgGxNTA48Aswen93VK9WjAfqfMAU1EBDTMwr6+M
+-> $O-grease o1.b\<F
+CbAaFPbra6i7MpM1ogAF50v7I5UKTsizI6ELMvQsqBf6XDjCt0ukMIpbBxpbLt+f
+nm5bpcE
+--- mRqCpp+XPV+MZo+S2EWGqW/x1c8M6rlV7/Mr995OiuI
+«öÔ]~ö¶ØIôÝ€Þ˜Ä.hÓ"°O“Jp=¹~T‰lòç€ü?A«k$šFÀ)'¥k~$¼|¤9s-F^½¿
:‹ãírV<72>ý

secrets/wg_fondue.age

@@ -0,0 +1,12 @@
+age-encryption.org/v1
+-> ssh-ed25519 U9FXlg 3/QnM8zAovLFAWtuBhFgR/dkqF1XkXpc/0aC7YM/l3s
+/bRy+x1ARoUO/jLdSwAfTvwkuE6rLoY6ar7S1S8QcE4
+-> ssh-ed25519 W08TTA FLhhvGFWIm6JlYpDAHV39Io7hnj86f8Bm6S5OmhTwVs
+f6O+ZTHvvpT+iq7HTw3JfOEk+4CHCc3gaGC7UbHRecU
+-> ssh-ed25519 1f0c9Q 5tWjB31aCfV865BgJjrYulhQf4NOXTph3vUoPyovCSY
+3BKpoGQxv2WfwJEzMxhuls+OtttGadlbjDAmrMxWnHQ
+-> ^-grease U1#S>aw Q!xFss
+BEHdYGI8rrokXkOAYmBRn3shh1Hp7k3eW+UQ+pgETav4Ew
+--- oIeMw9AThaYLfWbJCU+LKHt6yqUZCXGji2gyYRYu2tQ
+¤Lxä=z:Zµ–
+yþi`»k¿œ¬užàg¯XWþʵ$<24> º«cÑa‹¥<E280B9>‡üR	:<3A>ž)Xàô
š}ÕJî^<5E>ŠŒHkýX¿re

secrets/wg_winter.age

@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> ssh-ed25519 U9FXlg FMswMl915t4poFFGb2xPz4g/blQtdH9FagTte61d/R8
+AXHuHH4ShWsMgub48/qbsq/NeK/viI/bCSS1++pomGU
+-> ssh-ed25519 CUCjXQ XdF7iwyHqvjdM/nzsqwqaSHMyyA5PfKk/v3CrzkcyE4
+tcQI27NojK1cOwWBmcKXIj35ZAXHzVkxrnmUjVlB/Jc
+-> +gVY-grease ?w,;$2a 8ID6J] 0-9@5Bwt DRDl)
+PQ
+--- Jx/j4/ICbGtU8KY6fwOcC4XcHl9bSR2cUuicod/oV0o
+z¡ä7.òýAO?
Öº’w#›•‚aß”ãËeõ¯ë¤ä4óÝ+L'C<06>1PÞ3¸‹œÐD{[>/GÀ‹ìÀ–¹Ùíï_¬[	ÁWÈøJ