From b9ff30367fcc7b9fd0a9ab72444df984137b7d23 Mon Sep 17 00:00:00 2001 From: dish Date: Thu, 13 Nov 2025 14:06:23 -0500 Subject: [PATCH] [hosts.prefect] redo dn42 configuration with dn42.nix --- .nvim.lua | 3 + flake.lock | 85 ++++++- flake.nix | 4 + hosts/default.nix | 4 + hosts/prefect/dn42/bgp.nix | 109 -------- hosts/prefect/dn42/bird.conf | 315 ------------------------ hosts/prefect/dn42/default.nix | 73 ++++-- hosts/prefect/dn42/peers/bandura.nix | 25 ++ hosts/prefect/dn42/peers/catgirls.nix | 26 ++ hosts/prefect/dn42/peers/chrismoos.nix | 26 ++ hosts/prefect/dn42/peers/default.nix | 21 ++ hosts/prefect/dn42/peers/iedon.nix | 26 ++ hosts/prefect/dn42/peers/kioubit.nix | 27 ++ hosts/prefect/dn42/peers/lare.nix | 25 ++ hosts/prefect/dn42/peers/potato.nix | 26 ++ hosts/prefect/dn42/peers/routedbits.nix | 26 ++ hosts/prefect/dn42/peers/sunnet.nix | 26 ++ hosts/prefect/dn42/peers/uffsalot.nix | 26 ++ hosts/prefect/dn42/services.nix | 69 ------ hosts/prefect/dn42/tunnels.nix | 75 ------ hosts/prefect/dn42/types.nix | 63 +++++ hosts/prefect/dn42/wireguard.nix | 43 ---- hosts/prefect/firewall.nix | 19 +- hosts/prefect/services/tailscale.nix | 1 - nixosModules/default.nix | 2 + nixosModules/dn42Wireguard/default.nix | 127 ++++++++++ optnix.toml | 4 + 27 files changed, 623 insertions(+), 653 deletions(-) delete mode 100644 hosts/prefect/dn42/bgp.nix delete mode 100644 hosts/prefect/dn42/bird.conf create mode 100644 hosts/prefect/dn42/peers/bandura.nix create mode 100644 hosts/prefect/dn42/peers/catgirls.nix create mode 100644 hosts/prefect/dn42/peers/chrismoos.nix create mode 100644 hosts/prefect/dn42/peers/default.nix create mode 100644 hosts/prefect/dn42/peers/iedon.nix create mode 100644 hosts/prefect/dn42/peers/kioubit.nix create mode 100644 hosts/prefect/dn42/peers/lare.nix create mode 100644 hosts/prefect/dn42/peers/potato.nix create mode 100644 hosts/prefect/dn42/peers/routedbits.nix create mode 100644 hosts/prefect/dn42/peers/sunnet.nix create mode 100644 hosts/prefect/dn42/peers/uffsalot.nix delete mode 100644 hosts/prefect/dn42/services.nix delete mode 100644 hosts/prefect/dn42/tunnels.nix create mode 100644 hosts/prefect/dn42/types.nix delete mode 100644 hosts/prefect/dn42/wireguard.nix create mode 100644 nixosModules/dn42Wireguard/default.nix create mode 100644 optnix.toml diff --git a/.nvim.lua b/.nvim.lua index db8fb634..0a568b72 100644 --- a/.nvim.lua +++ b/.nvim.lua @@ -22,6 +22,9 @@ nvim_lsp.nixd.setup({ flake_parts_perSystem = { expr = "(builtins.getFlake (builtins.toString ./.)).currentSystem.options", }, + my_modules = { + exper = "(pkgs.lib.evalModules { modules = (builtins.getFlake (builtins.toString ./.)).nixosModules; }).options" + } }, }, }, diff --git a/flake.lock b/flake.lock index 0d6ed6a8..a228e97c 100644 --- a/flake.lock +++ b/flake.lock @@ -25,6 +25,28 @@ "type": "github" } }, + "bird": { + "inputs": { + "flake-utils": "flake-utils", + "nixpkgs": [ + "dn42", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1757884119, + "narHash": "sha256-RF0Em7PjDRaQ5cBFgc3fL22qgDVbv2HoVW1TDRaaSNo=", + "owner": "NuschtOS", + "repo": "bird.nix", + "rev": "f8d18c2c8eebd477987001a9c0af50a9ca7909e5", + "type": "github" + }, + "original": { + "owner": "NuschtOS", + "repo": "bird.nix", + "type": "github" + } + }, "buildbot-nix": { "inputs": { "flake-parts": [ @@ -250,6 +272,27 @@ "type": "github" } }, + "dn42": { + "inputs": { + "bird": "bird", + "nixpkgs": [ + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1759332252, + "narHash": "sha256-zMPiXQmun2EIefsFlfkvcL6V2TcP0ASCjNbdaTQei68=", + "owner": "NuschtOS", + "repo": "dn42.nix", + "rev": "4f786e87300f5f0361e4b6f3577e323b091d128b", + "type": "github" + }, + "original": { + "owner": "NuschtOS", + "repo": "dn42.nix", + "type": "github" + } + }, "easy-hosts": { "locked": { "lastModified": 1755470564, @@ -332,7 +375,25 @@ }, "flake-utils_2": { "inputs": { - "systems": "systems_4" + "systems": "systems_3" + }, + "locked": { + "lastModified": 1731533236, + "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=", + "owner": "numtide", + "repo": "flake-utils", + "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b", + "type": "github" + }, + "original": { + "owner": "numtide", + "repo": "flake-utils", + "type": "github" + } + }, + "flake-utils_3": { + "inputs": { + "systems": "systems_5" }, "locked": { "lastModified": 1694529238, @@ -353,7 +414,7 @@ "nixpkgs": [ "nixpkgs" ], - "systems": "systems_3" + "systems": "systems_4" }, "locked": { "lastModified": 1760925941, @@ -371,7 +432,7 @@ }, "gomod2nix": { "inputs": { - "flake-utils": "flake-utils_2", + "flake-utils": "flake-utils_3", "nixpkgs": [ "tangled", "nixpkgs" @@ -676,10 +737,11 @@ "dms-plugins": "dms-plugins", "dms-power-usage": "dms-power-usage", "dms-wp-shuffler": "dms-wp-shuffler", + "dn42": "dn42", "easy-hosts": "easy-hosts", "flake-compat": "flake-compat", "flake-parts": "flake-parts", - "flake-utils": "flake-utils", + "flake-utils": "flake-utils_2", "golink": "golink", "hardware": "hardware", "home-manager": "home-manager", @@ -765,6 +827,21 @@ "type": "github" } }, + "systems_5": { + "locked": { + "lastModified": 1681028828, + "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=", + "owner": "nix-systems", + "repo": "default", + "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e", + "type": "github" + }, + "original": { + "owner": "nix-systems", + "repo": "default", + "type": "github" + } + }, "tangled": { "inputs": { "flake-compat": "flake-compat_2", diff --git a/flake.nix b/flake.nix index 72cfb5c0..9be1acb0 100644 --- a/flake.nix +++ b/flake.nix @@ -50,6 +50,10 @@ ctp = { url = "github:catppuccin/nix"; }; + dn42 = { + url = "github:NuschtOS/dn42.nix"; + inputs.nixpkgs.follows = "nixpkgs"; + }; dms = { url = "github:AvengeMedia/DankMaterialShell"; inputs.nixpkgs.follows = "nixpkgs"; diff --git a/hosts/default.nix b/hosts/default.nix index 6e1a7f8a..575260b4 100644 --- a/hosts/default.nix +++ b/hosts/default.nix @@ -40,6 +40,10 @@ "server" "vps" ]; + modules = [ + inputs.self.nixosModules.dn42Wireguard + inputs.dn42.nixosModules.default + ]; }; thought = { deployable = true; diff --git a/hosts/prefect/dn42/bgp.nix b/hosts/prefect/dn42/bgp.nix deleted file mode 100644 index 97bab669..00000000 --- a/hosts/prefect/dn42/bgp.nix +++ /dev/null @@ -1,109 +0,0 @@ -_: { - sessions = [ - # Chrismoos - { - multi = true; - multihop = false; - gracefulRestart = true; - name = "chrismoos"; - neigh = "fe80::1588%wg42_chris"; - as = "4242421588"; - link = "1"; - } - # Kioubit - { - multi = true; - multihop = false; - gracefulRestart = true; - name = "kioubit"; - neigh = "fe80::ade0%wg42_kioubit"; - as = "4242423914"; - link = "3"; - } - # IEDON - { - multi = true; - multihop = false; - gracefulRestart = true; - name = "ideon"; - neigh = "fe80::2189:e8%wg42_iedon"; - as = "4242422189"; - link = "5"; - } - # SUNNET - { - multi = true; - multihop = false; - gracefulRestart = true; - name = "sunnet"; - neigh = "fe80::3088:193%wg42_sunnet"; - as = "4242423088"; - link = "3"; - } - # C4TG1RL5 - { - multi = true; - multihop = false; - gracefulRestart = true; - name = "c4tg1rl5"; - neigh = "fe80::4242%wg42_catgirls"; - as = "4242421411"; - link = "6"; - } - # Potat0 - { - multi = true; - multihop = false; - gracefulRestart = true; - name = "potato"; - neigh = "fe80::1816%wg42_potato"; - as = "4242421816"; - link = "2"; - } - # Uffsalot-v6 - { - multi = false; - v4 = false; - v6 = true; - multihop = false; - gracefulRestart = true; - name = "uffsalot_v6"; - neigh = "fe80::780%wg42_uffsalot"; - as = "4242420780"; - link = "5"; - } - # Uffsalot-v6 - { - multi = false; - v4 = true; - v6 = false; - multihop = false; - gracefulRestart = true; - name = "uffsalot_v4"; - neigh = "172.20.191.129"; - as = "4242420780"; - link = "5"; - } - # Bandura - { - multi = true; - multihop = false; - gracefulRestart = true; - name = "bandura"; - neigh = "fe80::2926%wg42_bandura"; - as = "4242422923"; - link = "4"; - } - # Bluemedia - { - multi = true; - multihop = false; - gracefulRestart = true; - name = "bluemedia"; - neigh = "fe80::42:3343:20:1%wg42_bluemedia"; - as = "4242423343"; - link = "5"; - } - ]; - extraConfig = ""; -} diff --git a/hosts/prefect/dn42/bird.conf b/hosts/prefect/dn42/bird.conf deleted file mode 100644 index 897e11c5..00000000 --- a/hosts/prefect/dn42/bird.conf +++ /dev/null @@ -1,315 +0,0 @@ -log stderr all; -debug protocols all; -timeformat protocol iso long; -################################################ -# Variable header # -################################################ - -define OWNAS = 4242422459; -define OWNIP = 172.20.43.96; -define OWNIPv6 = fd21:1500:66b0::1; -define OWNNET = 172.20.43.96/27; -define OWNNETv6 = fd21:1500:66b0::/48; -define OWNNETSET = [172.20.43.96/29+]; -define OWNNETSETv6 = [fd21:1500:66b0::/48+]; -define DN42_REGION = 42; - -################################################ -# Header end # -################################################ - -router id OWNIP; - -protocol device { - scan time 10; -} - -/* - * Utility functions - */ - -function is_self_net() { - return net ~ OWNNETSET; -} - -function is_self_net_v6() { - return net ~ OWNNETSETv6; -} - -function is_valid_network() { - return net ~ [ - 172.20.0.0/14{21,29}, # dn42 - 172.20.0.0/24{28,32}, # dn42 Anycast - 172.21.0.0/24{28,32}, # dn42 Anycast - 172.22.0.0/24{28,32}, # dn42 Anycast - 172.23.0.0/24{28,32}, # dn42 Anycast - 172.31.0.0/16+, # ChaosVPN - 10.100.0.0/14+, # ChaosVPN - 10.127.0.0/16{16,32}, # neonetwork - 10.0.0.0/8{15,24} # Freifunk.net - ]; -} - -roa4 table dn42_roa; -roa6 table dn42_roa_v6; - -protocol static { - roa4 { table dn42_roa; }; - include "/etc/bird/roa_dn42.conf"; -}; - -protocol static { - roa6 { table dn42_roa_v6; }; - include "/etc/bird/roa_dn42_v6.conf"; -}; - -function is_valid_network_v6() { - return net ~ [ - fd00::/8{44,64} # ULA address space as per RFC 4193 - ]; -} - -protocol kernel { - scan time 20; - - ipv6 { - import none; - export filter { - if source = RTS_STATIC then reject; - krt_prefsrc = OWNIPv6; - accept; - }; - }; -}; - -protocol kernel { - scan time 20; - ipv4 { - import none; - export filter { - if source = RTS_STATIC then reject; - krt_prefsrc = OWNIP; - accept; - }; - }; -} - -protocol static { - route OWNNET reject; - - ipv4 { - import all; - export none; - }; -} - -protocol static { - route OWNNETv6 reject; - - ipv6 { - import all; - export none; - }; -} - -template bgp dnpeers { - local as OWNAS; - path metric 1; -} - -protocol ospf v3 { - ipv4 { - export filter { - if source = RTS_STATIC || source = RTS_BGP then reject; - accept; - }; - }; - - area 0 { - interface "lo" { - stub; - }; - - interface "ospf_*"{ - type pointopoint; - }; - }; -} - -protocol ospf v3 { - ipv6 { - export filter { - if source = RTS_STATIC || source = RTS_BGP then reject; - accept; - }; - }; - - area 0 { - interface "lo" { - stub; - }; - - interface "ospf_*" { - type pointopoint; - }; - - }; -} - - -function update_latency(int link_latency) { - bgp_community.add((64511, link_latency)); - if (64511, 9) ~ bgp_community then { bgp_community.delete([(64511, 1..8)]); return 9; } - else if (64511, 8) ~ bgp_community then { bgp_community.delete([(64511, 1..7)]); return 8; } - else if (64511, 7) ~ bgp_community then { bgp_community.delete([(64511, 1..6)]); return 7; } - else if (64511, 6) ~ bgp_community then { bgp_community.delete([(64511, 1..5)]); return 6; } - else if (64511, 5) ~ bgp_community then { bgp_community.delete([(64511, 1..4)]); return 5; } - else if (64511, 4) ~ bgp_community then { bgp_community.delete([(64511, 1..3)]); return 4; } - else if (64511, 3) ~ bgp_community then { bgp_community.delete([(64511, 1..2)]); return 3; } - else if (64511, 2) ~ bgp_community then { bgp_community.delete([(64511, 1..1)]); return 2; } - else return 1; -} - -function update_bandwidth(int link_bandwidth) { - bgp_community.add((64511, link_bandwidth)); - if (64511, 21) ~ bgp_community then { bgp_community.delete([(64511, 22..29)]); return 21; } - else if (64511, 22) ~ bgp_community then { bgp_community.delete([(64511, 23..29)]); return 22; } - else if (64511, 23) ~ bgp_community then { bgp_community.delete([(64511, 24..29)]); return 23; } - else if (64511, 24) ~ bgp_community then { bgp_community.delete([(64511, 25..29)]); return 24; } - else if (64511, 25) ~ bgp_community then { bgp_community.delete([(64511, 26..29)]); return 25; } - else if (64511, 26) ~ bgp_community then { bgp_community.delete([(64511, 27..29)]); return 26; } - else if (64511, 27) ~ bgp_community then { bgp_community.delete([(64511, 28..29)]); return 27; } - else if (64511, 28) ~ bgp_community then { bgp_community.delete([(64511, 29..29)]); return 28; } - else return 29; -} - -function update_crypto(int link_crypto) { - bgp_community.add((64511, link_crypto)); - if (64511, 31) ~ bgp_community then { bgp_community.delete([(64511, 32..34)]); return 31; } - else if (64511, 32) ~ bgp_community then { bgp_community.delete([(64511, 33..34)]); return 32; } - else if (64511, 33) ~ bgp_community then { bgp_community.delete([(64511, 34..34)]); return 33; } - else return 34; -} - -function get_region() { -if (64511, 41) ~ bgp_community then { return 41; } -else if (64511, 42) ~ bgp_community then { return 42; } -else if (64511, 43) ~ bgp_community then { return 43; } -else if (64511, 44) ~ bgp_community then { return 44; } -else if (64511, 45) ~ bgp_community then { return 45; } -else if (64511, 46) ~ bgp_community then { return 46; } -else if (64511, 47) ~ bgp_community then { return 47; } -else if (64511, 48) ~ bgp_community then { return 48; } -else if (64511, 49) ~ bgp_community then { return 49; } -else if (64511, 50) ~ bgp_community then { return 50; } -else if (64511, 51) ~ bgp_community then { return 51; } -else if (64511, 52) ~ bgp_community then { return 52; } -else if (64511, 53) ~ bgp_community then { return 53; } -else return DN42_REGION; -} - - -function calculate_local_pref(int dn42_latency) -int pref; -{ - pref = 100; - if (is_self_net() || is_self_net_v6()) then { - pref = 2000; - } - else if (bgp_path.len = 1) then { - pref = 1000; - } - else if (DN42_REGION = get_region()) then { - pref= 500; - } - else { - if (DN42_REGION > get_region()) then { - pref = 500 - ((DN42_REGION - get_region()) * 10); - } - else { - pref = 500 - ((get_region() - DN42_REGION) * 10); - } - } - pref = pref - 10*dn42_latency - 10* bgp_path.len; - if pref > 2000 then { - pref = 10; - } - return pref; -} - -function update_flags(int link_latency; int link_bandwidth; int link_crypto) -int dn42_latency; -int dn42_bandwidth; -int dn42_crypto; -{ - dn42_latency = update_latency(link_latency); - dn42_bandwidth = update_bandwidth(link_bandwidth) - 20; - dn42_crypto = update_crypto(link_crypto) - 30; - if dn42_bandwidth > 5 then dn42_bandwidth = 5; - bgp_local_pref = calculate_local_pref(dn42_latency); - return true; -} - - -function dn42_import_filter(int link_latency; int link_bandwidth; int link_crypto) { - if (is_valid_network() && !is_self_net()) || (is_valid_network_v6() && !is_self_net_v6()) then { - if roa_check(dn42_roa, net, bgp_path.last) != ROA_VALID && roa_check(dn42_roa_v6, net, bgp_path.last) != ROA_VALID then { - print "[dn42] Import : ROA check failed for ", net, " ASN ", bgp_path.last, " on ", proto; - reject; - } - update_flags(link_latency, link_bandwidth, link_crypto); - if (65535, 666) ~ bgp_community then dest = RTD_BLACKHOLE; - accept; - } - print "[dn42] Import : Invalid Network for ", net, " ASN ", bgp_path.last, " on ", proto; - reject; -} - -function dn42_export_filter(int link_latency; int link_bandwith; int link_crypto) { - if is_valid_network() || is_valid_network_v6() then { -# if roa_check(dn42_roa, net, bgp_path.last) != ROA_VALID && roa_check(dn42_roa_v6, net, bgp_path.last) != ROA_VALID then { -# print "[dn42] Export : ROA check failed for ", net, " ASN ", bgp_path.last, " on ", proto; -# reject; -# } - if source = RTS_STATIC then bgp_community.add((64511, DN42_REGION)); - update_flags(link_latency, link_bandwith, link_crypto); - accept; - } - reject; -} - -protocol bgp route_collector from dnpeers { - neighbor fd42:4242:2601:ac12::1 as 4242422602; - multihop; - ipv4 { - # export all available paths to the collector - add paths tx; - - # import/export filters - import none; - export filter { - # export all valid routes - if ( is_valid_network() && source ~ [ RTS_STATIC, RTS_BGP ] ) - then { - accept; - } - reject; - }; - }; - - ipv6 { - # export all available paths to the collector - add paths tx; - - # import/export filters - import none; - export filter { - # export all valid routes - if ( is_valid_network_v6() && source ~ [ RTS_STATIC, RTS_BGP ] ) - then { - accept; - } - reject; - }; - }; -} diff --git a/hosts/prefect/dn42/default.nix b/hosts/prefect/dn42/default.nix index 067635c2..fa9bc13e 100644 --- a/hosts/prefect/dn42/default.nix +++ b/hosts/prefect/dn42/default.nix @@ -1,31 +1,64 @@ -{ pkgs, ... }: +{ pkgs, config, ... }: +let + cfg42 = config.networking.dn42; +in { imports = [ - ./services.nix - ./wireguard.nix + ./peers ]; - networking.interfaces.lo = { - ipv4.addresses = [ - { - address = "172.20.43.96"; - prefixLength = 32; - } - ]; - ipv6.addresses = [ - { - address = "fd21:1500:66b0::1"; - prefixLength = 128; - } - { - address = "fe80::1"; - prefixLength = 128; - } - ]; + networking = { + interfaces.lo = { + ipv4.addresses = [ + { + address = "172.20.43.96"; + prefixLength = 32; + } + ]; + ipv6.addresses = [ + { + address = "fd21:1500:66b0::1"; + prefixLength = 128; + } + { + address = "fe80::1"; + prefixLength = 128; + } + ]; + }; }; + environment.systemPackages = with pkgs; [ dnsutils mtr tcpdump wireguard-tools ]; + networking.dn42 = { + enable = true; + # ASN corresponding to DN42 PYRONET + as = 4242422459; + # Communities config + # https://dn42.dev/howto/BGP-communities + geo = 42; + country = 1840; + routerId = cfg42.addr.v4; + # Primary IP Addresses + addr = { + v4 = "172.20.43.96"; + v6 = "fd21:1500:66b0::1"; + }; + # Owned IP Ranges + nets = { + v4 = [ "172.20.43.96/27" ]; + v6 = [ "fd21:1500:66b0::/48" ]; + }; + + # Enable StayRTR + # https://github.com/bgp/stayrtr + stayrtr.enable = true; + wg.tunnelDefaults = { + privateKeyFile = "/run/agenix/dn42-privkey"; + localAddrs.v4 = cfg42.addr.v4; + }; + }; } diff --git a/hosts/prefect/dn42/peers/bandura.nix b/hosts/prefect/dn42/peers/bandura.nix new file mode 100644 index 00000000..e9c527e4 --- /dev/null +++ b/hosts/prefect/dn42/peers/bandura.nix @@ -0,0 +1,25 @@ +{ dn42Types, ... }: +{ + config.networking.dn42 = { + peers.bandura = { + as = 4242422923; + addr.v6 = "fe80::2926"; + interface = "wg42_bandura"; + extendedNextHop = true; + # My side + srcAddr.v6 = "fe80::11"; + # Communities + crypto = dn42Types.crypto.safePFS; + latency = dn42Types.latency."55ms"; + bandwidth = dn42Types.bandwidth."1000mb"; + transit = true; + }; + wg.tunnels.bandura = { + listenPort = 44923; + peerPubKey = "xPW1/cWYDkk/IAss1GbdwVMW7fzKtyHA+qrfCriOB2k="; + peerEndpoint = "aurora.mk16.de:52459"; + peerAddrs.v6 = "fe80::2926"; + localAddrs.v6 = "fe80::11"; + }; + }; +} diff --git a/hosts/prefect/dn42/peers/catgirls.nix b/hosts/prefect/dn42/peers/catgirls.nix new file mode 100644 index 00000000..0b3a6619 --- /dev/null +++ b/hosts/prefect/dn42/peers/catgirls.nix @@ -0,0 +1,26 @@ +{ dn42Types, ... }: +{ + config.networking.dn42 = { + peers.catgirls = { + as = 4242421411; + addr.v6 = "fe80::2189:124"; + interface = "wg42_catgirls"; + extendedNextHop = true; + # My side + srcAddr.v6 = "fe80::111"; + # Communities + crypto = dn42Types.crypto.safePFS; + latency = dn42Types.latency."148ms"; + bandwidth = dn42Types.bandwidth."1000mb"; + transit = true; + }; + wg.tunnels.catgirls = { + enable = false; + listenPort = 43411; + peerPubKey = ""; + peerEndpoint = ""; + peerAddrs.v6 = "fe80::111"; + localAddrs.v6 = "fe80::7"; + }; + }; +} diff --git a/hosts/prefect/dn42/peers/chrismoos.nix b/hosts/prefect/dn42/peers/chrismoos.nix new file mode 100644 index 00000000..fd1e2508 --- /dev/null +++ b/hosts/prefect/dn42/peers/chrismoos.nix @@ -0,0 +1,26 @@ +{ dn42Types, ... }: +{ + config.networking.dn42 = { + peers.chrismoos = { + as = 4242421588; + addr.v6 = "fe80::1588"; + interface = "wg42_chrismoos"; + extendedNextHop = true; + # My side + srcAddr.v6 = "fe80::100"; + # Communities + crypto = dn42Types.crypto.safePFS; + latency = dn42Types.latency."2.7ms"; + bandwidth = dn42Types.bandwidth."1000mb"; + transit = true; + }; + wg.tunnels.chrismoos = { + listenPort = 43588; + peerPubKey = "itmJ4Z8V1aNN368P6kMzuQM+GdzWbBKZjJiXrgSeGlw="; + peerEndpoint = "us-qas01.dn42.tech9.io:58768"; + peerAddrs.v4 = "172.20.16.143"; + peerAddrs.v6 = "fe80::1588"; + localAddrs.v6 = "fe80::100"; + }; + }; +} diff --git a/hosts/prefect/dn42/peers/default.nix b/hosts/prefect/dn42/peers/default.nix new file mode 100644 index 00000000..f9b20739 --- /dev/null +++ b/hosts/prefect/dn42/peers/default.nix @@ -0,0 +1,21 @@ +_: +let + dn42Types = import ../types.nix; +in +{ + # Port numbers are 42000 + `last 4 digits of ASN` + imports = [ + # keep-sorted start + (import ./bandura.nix { inherit dn42Types; }) + # (import ./catgirls.nix { inherit dn42Types; }) + (import ./chrismoos.nix { inherit dn42Types; }) + (import ./iedon.nix { inherit dn42Types; }) + (import ./kioubit.nix { inherit dn42Types; }) + (import ./lare.nix { inherit dn42Types; }) + (import ./potato.nix { inherit dn42Types; }) + (import ./routedbits.nix { inherit dn42Types; }) + (import ./sunnet.nix { inherit dn42Types; }) + (import ./uffsalot.nix { inherit dn42Types; }) + # keep-sorted end + ]; +} diff --git a/hosts/prefect/dn42/peers/iedon.nix b/hosts/prefect/dn42/peers/iedon.nix new file mode 100644 index 00000000..6755feb5 --- /dev/null +++ b/hosts/prefect/dn42/peers/iedon.nix @@ -0,0 +1,26 @@ +{ dn42Types, ... }: +{ + config.networking.dn42 = { + peers.iedon = { + as = 4242422189; + addr.v6 = "fe80::2189:124"; + interface = "wg42_iedon"; + extendedNextHop = true; + # My side + srcAddr.v6 = "fe80::6"; + # Communities + crypto = dn42Types.crypto.safePFS; + latency = dn42Types.latency."20ms"; + bandwidth = dn42Types.bandwidth."1000mb"; + transit = true; + }; + wg.tunnels.iedon = { + listenPort = 44198; + peerPubKey = "2Wmv10a9eVSni9nfZ7YPsyl3ZC5z7vHq0sTZGgk5WGo="; + peerEndpoint = "us-nyc.dn42.iedon.net:48883"; + peerAddrs.v4 = "172.23.91.124"; + peerAddrs.v6 = "fe80::2189:124"; + localAddrs.v6 = "fe80::6"; + }; + }; +} diff --git a/hosts/prefect/dn42/peers/kioubit.nix b/hosts/prefect/dn42/peers/kioubit.nix new file mode 100644 index 00000000..5b99dd5c --- /dev/null +++ b/hosts/prefect/dn42/peers/kioubit.nix @@ -0,0 +1,27 @@ +{ dn42Types, ... }: +{ + config.networking.dn42 = { + peers.kioubit = { + as = 4242423914; + addr.v6 = "fe80::ade0"; + interface = "wg42_kioubit"; + extendedNextHop = true; + # My side + srcAddr.v6 = "fe80::ade1"; + # Communities + crypto = dn42Types.crypto.safePFS; + latency = dn42Types.latency."7.3ms"; + bandwidth = dn42Types.bandwidth."1000mb"; + transit = true; + }; + wg.tunnels.kioubit = { + listenPort = 45914; + peerPubKey = "6Cylr9h1xFduAO+5nyXhFI1XJ0+Sw9jCpCDvcqErF1s="; + peerEndpoint = "us2.g-load.eu:22459"; + peerAddrs.v4 = "172.20.53.98"; + peerAddrs.v6 = "fe80::ade0"; + localAddrs.v4 = "192.168.220.70"; + localAddrs.v6 = "fe80::ade1"; + }; + }; +} diff --git a/hosts/prefect/dn42/peers/lare.nix b/hosts/prefect/dn42/peers/lare.nix new file mode 100644 index 00000000..effcd85b --- /dev/null +++ b/hosts/prefect/dn42/peers/lare.nix @@ -0,0 +1,25 @@ +{ dn42Types, ... }: +{ + config.networking.dn42 = { + peers.lare = { + as = 4242423035; + addr.v6 = "fe80::3035:137"; + interface = "wg42_lare"; + extendedNextHop = true; + # My side + srcAddr.v6 = "fe80::112"; + # Communities + crypto = dn42Types.crypto.safePFS; + latency = dn42Types.latency."20ms"; + bandwidth = dn42Types.bandwidth."1000mb"; + transit = true; + }; + wg.tunnels.lare = { + listenPort = 45035; + peerPubKey = "AREskFoxP2cd6DXoJ7druDsiWKX+8TwrkQqfi4JxRRw="; + peerEndpoint = "use2.dn42.lare.cc:22459"; + peerAddrs.v6 = "fe80::3035:137"; + localAddrs.v6 = "fe80::112"; + }; + }; +} diff --git a/hosts/prefect/dn42/peers/potato.nix b/hosts/prefect/dn42/peers/potato.nix new file mode 100644 index 00000000..1ec419af --- /dev/null +++ b/hosts/prefect/dn42/peers/potato.nix @@ -0,0 +1,26 @@ +{ dn42Types, ... }: +{ + config.networking.dn42 = { + peers.potato = { + as = 4242421816; + addr.v6 = "fe80::1816"; + interface = "wg42_potato"; + extendedNextHop = true; + # My side + srcAddr.v6 = "fe80::111"; + # Communities + crypto = dn42Types.crypto.safePFS; + latency = dn42Types.latency."148ms"; + bandwidth = dn42Types.bandwidth."1000mb"; + transit = true; + }; + wg.tunnels.potato = { + enable = false; + listenPort = 43816; + peerPubKey = "LUwqKS6QrCPv510Pwt1eAIiHACYDsbMjrkrbGTJfviU="; + peerEndpoint = "las.node.potat0.cc:22459"; + peerAddrs.v6 = "fe80::1816"; + localAddrs.v6 = "fe80::9"; + }; + }; +} diff --git a/hosts/prefect/dn42/peers/routedbits.nix b/hosts/prefect/dn42/peers/routedbits.nix new file mode 100644 index 00000000..448fff27 --- /dev/null +++ b/hosts/prefect/dn42/peers/routedbits.nix @@ -0,0 +1,26 @@ +{ dn42Types, ... }: +{ + config.networking.dn42 = { + peers.routedbits = { + as = 4242420207; + addr.v6 = "fe80::207"; + interface = "wg42_routedbits"; + extendedNextHop = true; + # My side + srcAddr.v6 = "fe80::5"; + # Communities + crypto = dn42Types.crypto.safePFS; + latency = dn42Types.latency."2.7ms"; + bandwidth = dn42Types.bandwidth."1000mb"; + transit = true; + }; + wg.tunnels.routedbits = { + listenPort = 42207; + peerPubKey = "/RLM4EcF8b7FKKcxnvHIYyDoES59HXIBqhKEWt4yRy0="; + peerEndpoint = "router.iad1.routedbits.com:52459"; + peerAddrs.v4 = "172.20.19.73"; + peerAddrs.v6 = "fe80::207"; + localAddrs.v6 = "fe80::5"; + }; + }; +} diff --git a/hosts/prefect/dn42/peers/sunnet.nix b/hosts/prefect/dn42/peers/sunnet.nix new file mode 100644 index 00000000..018dc226 --- /dev/null +++ b/hosts/prefect/dn42/peers/sunnet.nix @@ -0,0 +1,26 @@ +{ dn42Types, ... }: +{ + config.networking.dn42 = { + peers.sunnet = { + as = 4242423088; + addr.v6 = "fe80::3088:193"; + interface = "wg42_sunnet"; + extendedNextHop = true; + # My side + srcAddr.v6 = "fe80::abcd"; + # Communities + crypto = dn42Types.crypto.safePFS; + latency = dn42Types.latency."148ms"; + bandwidth = dn42Types.bandwidth."1000mb"; + transit = true; + }; + wg.tunnels.sunnet = { + listenPort = 45088; + peerPubKey = "QSAeFPotqFpF6fFe3CMrMjrpS5AL54AxWY2w1+Ot2Bo="; + peerEndpoint = "lax1-us.dn42.6700.cc:22459"; + peerAddrs.v4 = "172.21.100.193"; + peerAddrs.v6 = "fe80::3088:193"; + localAddrs.v6 = "fe80::abcd"; + }; + }; +} diff --git a/hosts/prefect/dn42/peers/uffsalot.nix b/hosts/prefect/dn42/peers/uffsalot.nix new file mode 100644 index 00000000..80d1c7b6 --- /dev/null +++ b/hosts/prefect/dn42/peers/uffsalot.nix @@ -0,0 +1,26 @@ +{ dn42Types, ... }: +{ + config.networking.dn42 = { + peers.uffsalot = { + as = 4242420780; + addr.v6 = "fe80::780"; + interface = "wg42_uffsalot"; + extendedNextHop = true; + # My side + srcAddr.v6 = "fe80::10"; + # Communities + crypto = dn42Types.crypto.safePFS; + latency = dn42Types.latency."148ms"; + bandwidth = dn42Types.bandwidth."1000mb"; + transit = true; + }; + wg.tunnels.uffsalot = { + listenPort = 42780; + peerPubKey = "7V65FxvD9AQetyUr0qSiu+ik8samB4Atrw2ekvC0xQM="; + peerEndpoint = "dn42-de-fra4.brand-web.net:42459"; + peerAddrs.v4 = "172.20.191.129"; + peerAddrs.v6 = "fe80::780"; + localAddrs.v6 = "fe80::10"; + }; + }; +} diff --git a/hosts/prefect/dn42/services.nix b/hosts/prefect/dn42/services.nix deleted file mode 100644 index 8d5902c1..00000000 --- a/hosts/prefect/dn42/services.nix +++ /dev/null @@ -1,69 +0,0 @@ -{ pkgs, lib, ... }: -let - script = pkgs.writeShellScriptBin "update-roa" '' - mkdir -p /etc/bird/ - ${pkgs.curl}/bin/curl -sfSLR {-o,-z}/etc/bird/roa_dn42_v6.conf https://dn42.burble.com/roa/dn42_roa_bird2_6.conf - ${pkgs.curl}/bin/curl -sfSLR {-o,-z}/etc/bird/roa_dn42.conf https://dn42.burble.com/roa/dn42_roa_bird2_4.conf - ${pkgs.bird2}/bin/birdc c - ${pkgs.bird2}/bin/birdc reload in all - ''; - bgp = import ./bgp.nix { }; -in -{ - systemd = { - timers.dn42-roa = { - description = "Trigger a ROA table update"; - - timerConfig = { - OnBootSec = "5m"; - OnUnitInactiveSec = "1h"; - Unit = "dn42-roa.service"; - }; - - wantedBy = [ "timers.target" ]; - before = [ "bird.service" ]; - }; - services = { - dn42-roa = { - after = [ "network.target" ]; - description = "DN42 ROA Updated"; - unitConfig = { - Type = "one-shot"; - }; - serviceConfig = { - ExecStart = "${script}/bin/update-roa"; - }; - }; - }; - }; - - services = { - bird = { - enable = true; - package = pkgs.bird2; - checkConfig = false; - config = - builtins.readFile ./bird.conf - + lib.concatStrings ( - builtins.map ( - x: - "\n protocol bgp ${x.name} from dnpeers {\n ${if x.multihop then "multihop;" else ""}\n ${ - if x.gracefulRestart then "graceful restart on;" else "" - }\n neighbor ${x.neigh} as ${x.as};\n ${ - if x.multi || x.v4 then - "\n ipv4 {\n extended next hop on;\n import where dn42_import_filter(${x.link},25,34);\n export where dn42_export_filter(${x.link},25,34);\n import keep filtered;\n };\n " - else - "" - }\n ${ - if x.multi || x.v6 then - "\n ipv6 {\n extended next hop on;\n import where dn42_import_filter(${x.link},25,34);\n export where dn42_export_filter(${x.link},25,34);\n import keep filtered;\n };\n " - else - "" - }\n }\n " - ) bgp.sessions - ) - + bgp.extraConfig; - }; - }; - users.users.thehedgehog.extraGroups = [ "bird2" ]; -} diff --git a/hosts/prefect/dn42/tunnels.nix b/hosts/prefect/dn42/tunnels.nix deleted file mode 100644 index 809227e1..00000000 --- a/hosts/prefect/dn42/tunnels.nix +++ /dev/null @@ -1,75 +0,0 @@ -{ tunnel, ... }: -let - # _defaultPubKey = "e6kp9sca4XIzncKa9GEQwyOnMjje299Xg9ZdgXWMwHg="; - defaultPrivKeyFile = "/run/agenix/dn42-privkey"; - defaultLocalIPv4 = "172.20.43.96"; -in -{ - wg42_chris = - # Ports 485-486 available - - tunnel 487 defaultPrivKeyFile "itmJ4Z8V1aNN368P6kMzuQM+GdzWbBKZjJiXrgSeGlw=" defaultLocalIPv4 "fe80::100" - "us-qas01.dn42.tech9.io:52322" - "wg42_chris" - "172.20.16.143" - "fe80::1588"; - - wg42_kioubit = - tunnel 488 defaultPrivKeyFile "6Cylr9h1xFduAO+5nyXhFI1XJ0+Sw9jCpCDvcqErF1s=" defaultLocalIPv4 "fe80::3" - "us2.g-load.eu:22459" - "wg42_kioubit" - "172.20.53.98" - "fe80::ade0"; - - # Ports 489-490 available - - wg42_iedon = - tunnel 491 defaultPrivKeyFile "Sz0UhewjDk2yRKI0QL9rB+5daWpXFVlbbz9cLfVVLn4=" defaultLocalIPv4 "fe80::6" - "us-sjc.dn42.kuu.moe:35470" - "wg42_iedon" - "172.23.91.117" - "fe80::2189:e8"; - - wg42_sunnet = - tunnel 492 defaultPrivKeyFile "QSAeFPotqFpF6fFe3CMrMjrpS5AL54AxWY2w1+Ot2Bo=" defaultLocalIPv4 "fe80::abcd" - "v6.lax1-us.dn42.6700.cc:22459" - "wg42_sunnet" - "172.21.100.193" - "fe80::3088:193"; - - wg42_catgirls = - tunnel 493 defaultPrivKeyFile "jo8eAfY8LeA4FAEJ4laYYMNkMd4z3oO/zN5DN0Mo+RQ=" defaultLocalIPv4 "fe80::7" "karx.xyz:22459" - "wg42_catgirls" - "" - "fe80::4242"; - - # Port 494 Available - - wg42_potato = - tunnel 495 defaultPrivKeyFile "LUwqKS6QrCPv510Pwt1eAIiHACYDsbMjrkrbGTJfviU=" defaultLocalIPv4 "fe80::9" - "las.node.potat0.cc:22459" - "wg42_potato" - "" - "fe80::1816"; - - wg42_uffsalot = - tunnel 496 defaultPrivKeyFile "7V65FxvD9AQetyUr0qSiu+ik8samB4Atrw2ekvC0xQM=" defaultLocalIPv4 "fe80::10" - "dn42-de-fra4.brand-web.net:42459" - "wg42_uffsalot" - "172.20.191.129" - "fe80::780"; - - wg42_bandura = - tunnel 497 defaultPrivKeyFile "xPW1/cWYDkk/IAss1GbdwVMW7fzKtyHA+qrfCriOB2k=" defaultLocalIPv4 "fe80::11" - "aurora.mk16.de:52459" - "wg42_bandura" - "" - "fe80::2926"; - - wg42_bluemedia = - tunnel 498 defaultPrivKeyFile "7HNg2+uMI2WfntN+WlMnlTDG6xra/Dusee82cuXWMBY=" defaultLocalIPv4 "fe80::12" - "de-fra01.dn42.bluemedia.dev:22459" - "wg42_bluemedia" - "172.22.167.82" - "fe80::42:3343:20:1"; -} diff --git a/hosts/prefect/dn42/types.nix b/hosts/prefect/dn42/types.nix new file mode 100644 index 00000000..d5044845 --- /dev/null +++ b/hosts/prefect/dn42/types.nix @@ -0,0 +1,63 @@ +# DN42 Community Standard BGP Communities +# See main lists here: https://dn42.dev/howto/BGP-communities +{ + latency = { + "2.7ms" = 1; + "7.3ms" = 2; + "20ms" = 3; + "55ms" = 4; + "148ms" = 5; + "403ms" = 6; + "1097ms" = 7; + "2981ms" = 8; + "gt2981" = 9; + }; + bandwidth = { + "0.1mb" = 21; + "1mb" = 22; + "10mb" = 23; + "100mb" = 24; + "1000mb" = 25; + }; + crypto = { + unencrypted = 31; + unsafeVPN = 32; + safeNoPFS = 33; + safePFS = 34; + }; + region = { + europe = 41; + northAmericaEast = 42; + northAmericaCentral = 43; + northAmericaWest = 44; + centralAmerica = 45; + southAmericaEast = 46; + southAmericaWest = 47; + africaNorth = 48; + africaSouth = 49; + asiaSouth = 50; + asiaSouthEast = 51; + asiaEast = 52; + pacificOceania = 53; + antarctica = 54; + asiaNorth = 55; + asiaWest = 56; + centralAsia = 57; + }; + country = { + canada = 1124; + china = 1156; + taiwan = 1158; + france = 1250; + germany = 1276; + hongKong = 1344; + japan = 1392; + netherlands = 1528; + norway = 1578; + russianFederation = 1643; + singapore = 1702; + switzerland = 1756; + unitedKingdom = 1826; + unitedStatesOfAmerica = 1840; + }; +} diff --git a/hosts/prefect/dn42/wireguard.nix b/hosts/prefect/dn42/wireguard.nix deleted file mode 100644 index a0730b42..00000000 --- a/hosts/prefect/dn42/wireguard.nix +++ /dev/null @@ -1,43 +0,0 @@ -{ pkgs, lib, ... }: -let - defaultLocalIPv4 = "172.20.43.96/32"; - defaultLocalIPv6 = "fe80::1/64"; - privKeyFile = "/run/agenix/dn42-privkey"; - # _defaultPubKey = "e6kp9sca4XIzncKa9GEQwyOnMjje299Xg9ZdgXWMwHg="; -in -{ - environment.systemPackages = [ pkgs.wireguard-tools ]; - - networking.wireguard.interfaces = import ./tunnels.nix rec { - customTunnel = listenPort: privKeyFile: peerPubKey: endpoint: name: peerIPv4: peerIPv6: localIPv4: localIPv6: isOspf: { - inherit listenPort; - privateKeyFile = privKeyFile; - allowedIPsAsRoutes = false; - peers = [ - { - inherit endpoint; - publicKey = peerPubKey; - allowedIPs = [ - "0.0.0.0/0" - "::/0" - ]; - dynamicEndpointRefreshSeconds = 5; - persistentKeepalive = 15; - } - ]; - postSetup = '' - ${if peerIPv4 != "" then "${pkgs.iproute2}/bin/ip addr add ${localIPv4} peer ${peerIPv4} dev ${name}" else ""} - ${if peerIPv6 != "" then "${pkgs.iproute2}/bin/ip -6 addr add ${localIPv6} peer ${peerIPv6} dev ${name}" else ""} - '' - + lib.optionalString isOspf "${pkgs.iproute2}/bin/ip -6 addr add ${defaultLocalIPv6} dev ${name}"; - }; - # deadnix: skip - tunnel = - listenPort: _privKey: peerPubKey: localIPv4: localIPv6: endpoint: name: peerIPv4: peerIPv6: - customTunnel listenPort privKeyFile peerPubKey endpoint name peerIPv4 peerIPv6 localIPv4 localIPv6 false; - # deadnix: skip - ospf = - listenPort: _privKey: peerPubKey: endpoint: name: peerIPv4: peerIPv6: ULAIPv6: - customTunnel listenPort privKeyFile peerPubKey endpoint name peerIPv4 peerIPv6 defaultLocalIPv4 ULAIPv6 true; - }; -} diff --git a/hosts/prefect/firewall.nix b/hosts/prefect/firewall.nix index b58b7409..74742fd4 100644 --- a/hosts/prefect/firewall.nix +++ b/hosts/prefect/firewall.nix @@ -28,27 +28,12 @@ ]; allowedUDPPortRanges = [ { - from = 480; - to = 510; + from = 42000; + to = 52000; } ]; trustedInterfaces = [ - "tailscale0" "wg0" - - # DN42 Interfaces - "wg42_bandura" - "wg42_bluemedia" - "wg42_catgirls" - "wg42_chris" - "wg42_iedon" - "wg42_kioubit" - "wg42_liki" - "wg42_lutoma" - "wg42_potato" - "wg42_sunnet" - "wg42_uffsalot" - "wg42_usman" ]; extraForwardRules = '' meta iifname "wg42_*" meta oifname "wg42_*" accept diff --git a/hosts/prefect/services/tailscale.nix b/hosts/prefect/services/tailscale.nix index 0f640cb9..0e95d630 100644 --- a/hosts/prefect/services/tailscale.nix +++ b/hosts/prefect/services/tailscale.nix @@ -6,6 +6,5 @@ networking.firewall = { trustedInterfaces = [ "tailscale0" ]; allowedUDPPorts = [ config.services.tailscale.port ]; - checkReversePath = "loose"; }; } diff --git a/nixosModules/default.nix b/nixosModules/default.nix index 70e3f9d4..d1721e3d 100644 --- a/nixosModules/default.nix +++ b/nixosModules/default.nix @@ -5,6 +5,8 @@ _: { defaultUsers = import ./default-users; profiles = import ./profiles; + dn42Wireguard = import ./dn42Wireguard; + # Programs chromium = import ./programs/chromium; firefox = import ./programs/firefox; diff --git a/nixosModules/dn42Wireguard/default.nix b/nixosModules/dn42Wireguard/default.nix new file mode 100644 index 00000000..d86108ec --- /dev/null +++ b/nixosModules/dn42Wireguard/default.nix @@ -0,0 +1,127 @@ +{ + config, + lib, + pkgs, + ... +}: +let + inherit (lib) types; + cfg = config.networking.dn42.wg; + + tunnelDef = { + options = { + enable = lib.mkOption { + description = "Whether to enable this wireguard tunnel"; + type = types.bool; + default = true; + example = false; + }; + listenPort = lib.mkOption { + description = "The port this tunnel listens on"; + type = types.port; + example = 42000; + }; + privateKeyFile = lib.mkOption { + description = "Path to the tunnel's private key"; + type = types.nullOr types.path; + example = "/path/to/private/key"; + default = null; + }; + peerPubKey = lib.mkOption { + description = "Public key of the peer you're connecting to"; + type = types.str; + example = "e6kp9sca4XIzncKa9GEQwyOnMjje299Xg9ZdgXWMwHg="; + }; + peerEndpoint = lib.mkOption { + description = "The endpoint of the peer you're connecting to"; + type = types.str; + example = "example.com:42000"; + }; + peerAddrs = { + v4 = lib.mkOption { + description = "The peer IPv4 address to connect to in the tunnel"; + type = types.nullOr types.str; + example = "192.168.1.1"; + default = null; + }; + v6 = lib.mkOption { + description = "The peer IPv6 address to connect to in the tunnel"; + type = types.nullOr types.str; + example = "fe80::42"; + default = null; + }; + }; + localAddrs = { + v4 = lib.mkOption { + description = "The local IPv4 address to listen on in the tunnel"; + type = types.nullOr types.str; + example = "192.168.1.1"; + default = null; + }; + v6 = lib.mkOption { + description = "The local IPv6 address to listen on in the tunnel"; + type = types.nullOr types.str; + example = "fe80::42"; + default = null; + }; + }; + }; + }; +in +{ + options.networking.dn42.wg = { + tunnelDefaults = lib.mkOption { + description = "The default settings to apply to all tunnels"; + type = types.submodule tunnelDef; + }; + tunnels = lib.mkOption { + description = "DN42 WireGuard tunnels configuration"; + type = types.attrsOf (types.submodule tunnelDef); + }; + }; + config.networking = { + wireguard.interfaces = lib.mapAttrs' ( + name: value: + let + # Merge defaults with tunnel config, right side has priority + # so tunnel config overrides defaults + fc = cfg.tunnelDefaults // (lib.filterAttrs (_: v: v != null) value); + in + (lib.nameValuePair "wg42_${name}" { + inherit (fc) listenPort privateKeyFile; + allowedIPsAsRoutes = false; + peers = [ + { + endpoint = fc.peerEndpoint; + publicKey = fc.peerPubKey; + allowedIPs = [ + "0.0.0.0/0" + "::/0" + ]; + dynamicEndpointRefreshSeconds = 5; + persistentKeepalive = 15; + } + ]; + postSetup = '' + ${lib.optionalString ( + fc.peerAddrs.v4 != null && fc.localAddrs.v4 != null + ) "${pkgs.iproute2}/bin/ip addr add ${fc.localAddrs.v4} peer ${fc.peerAddrs.v4} dev wg42_${name}"} + ${lib.optionalString ( + fc.peerAddrs.v6 != null && fc.localAddrs.v6 != null + ) "${pkgs.iproute2}/bin/ip addr add ${fc.localAddrs.v6} peer ${fc.peerAddrs.v6} dev wg42_${name}"} + ''; + }) + ) (lib.filterAttrs (_: v: v.enable == true) cfg.tunnels); + firewall = { + trustedInterfaces = lib.mapAttrsToList (name: _: "wg42_" + name) ( + lib.filterAttrs (_: v: v.enable == true) cfg.tunnels + ); + checkReversePath = false; + extraInputRules = '' + ip saddr 172.20.0.0/14 accept + ip6 saddr fd00::/8 accept + ip6 saddr fe80::/64 accept + ''; + }; + }; +} diff --git a/optnix.toml b/optnix.toml new file mode 100644 index 00000000..98a2d2c8 --- /dev/null +++ b/optnix.toml @@ -0,0 +1,4 @@ +[scopes.flake-parts] +description = "flake-parts config" +options-list-cmd = "nix eval --json .#debug.options-doc" +evaluator = "nix eval .#debug.config.{{ .Option }}" -- 2.51.2