macs: import, set up with wireguard
Eelco Dolstra committed
Apr 26, 2019 at 04:38 UTC
415ff1016696bc1b7081a5a408da31a13fddcf24
2 files changed
+127
-23
delft/network.nix
+74
-3
@@ -1,8 +1,7 @@
1
let
2
makeMac = { ip, extra }: {
3
deployment = {
4
- targetHost = "localhost";
5
- targetPort = 2222;
4
+ targetHost = ip;
5
};
6
macosGuest = {
7
enable = true;
@@ -40,11 +39,83 @@ in {
39
eris = import ./eris.nix;
40
41
mac1 = makeMac {
43
- ip = "192.168.2.101";
42
+ ip = "10.254.2.1";
43
extra = {
44
imports = [
45
../macs/nodes/mac1.nix
46
+ (import ../modules/wireguard.nix "mac1")
47
];
48
};
49
};
50
+
51
+ mac2 = makeMac {
52
+ ip = "10.254.2.2";
53
+ extra = {
54
+ imports = [
55
+ ../macs/nodes/mac2.nix
56
+ (import ../modules/wireguard.nix "mac2")
57
+ ];
58
+ };
59
+ };
60
+
61
+ mac3 = makeMac {
62
+ ip = "10.254.2.3";
63
+ extra = {
64
+ imports = [
65
+ ../macs/nodes/mac3.nix
66
+ (import ../modules/wireguard.nix "mac3")
67
+ ];
68
+ };
69
+ };
70
+
71
+ mac4 = makeMac {
72
+ ip = "10.254.2.4";
73
+ extra = {
74
+ imports = [
75
+ ../macs/nodes/mac4.nix
76
+ (import ../modules/wireguard.nix "mac4")
77
+ ];
78
+ };
79
+ };
80
+
81
+ mac5 = makeMac {
82
+ ip = "10.254.2.5";
83
+ extra = {
84
+ imports = [
85
+ ../macs/nodes/mac5.nix
86
+ (import ../modules/wireguard.nix "mac5")
87
+ ];
88
+ };
89
+ };
90
+
91
+ mac6 = makeMac {
92
+ ip = "10.254.2.6";
93
+ extra = {
94
+ imports = [
95
+ ../macs/nodes/mac6.nix
96
+ (import ../modules/wireguard.nix "mac6")
97
+ ];
98
+ };
99
+ };
100
+
101
+ mac7 = makeMac {
102
+ ip = "10.254.2.7";
103
+ extra = {
104
+ imports = [
105
+ ../macs/nodes/mac7.nix
106
+ (import ../modules/wireguard.nix "mac7")
107
+ ];
108
+ };
109
+ };
110
+
111
+ mac8 = makeMac {
112
+ ip = "10.254.2.8";
113
+ extra = {
114
+ imports = [
115
+ ../macs/nodes/mac8.nix
116
+ (import ../modules/wireguard.nix "mac8")
117
+ ];
118
+ };
119
+ };
120
+ # mac9
121
}
modules/wireguard.nix
+53
-20
@@ -5,14 +5,42 @@ let
5
hosts = {
6
bastion = {
7
ip = "10.254.1.1";
8
- endoint = "bastion.nixos.org";
8
+ endpoint = "bastion.nixos.org";
9
port = 51820;
10
publicKey = "nG7I9gegJIynKOZ6tzpvmLdCZ/xScTgRZeFvYLFyil4=";
11
};
12
13
mac1 = {
14
ip = "10.254.2.1";
15
- # publicKey = "abc123";
15
+ publicKey = "IiGbZ3l+IYWP/nOjPBhUL0oBh2XJAtUD5DToM9FhTTE=";
16
+ };
17
+ mac2 = {
18
+ ip = "10.254.2.2";
19
+ publicKey = "igZp34acbeIStPF1bJUnzUSqfnMAuFusBPWCUhd5h08=";
20
+ };
21
+ mac3 = {
22
+ ip = "10.254.2.3";
23
+ publicKey = "4q9mQEsYADzraTNSowLME/OC0RDLCIM25Vanixz771c=";
24
+ };
25
+ mac4 = {
26
+ ip = "10.254.2.4";
27
+ publicKey = "Les8giS7Dx6qVUMmHe6xXweRCsiRNG6VYVKxoNuSIzI=";
28
+ };
29
+ mac5 = {
30
+ ip = "10.254.2.5";
31
+ publicKey = "M0e3nR/y5V5J9txmxcOsc0olhanQtHFBe5jwNNMDjRk=";
32
+ };
33
+ mac6 = {
34
+ ip = "10.254.2.6";
35
+ publicKey = "BJdCRAyaipdL6X+sl4ZM8594h/fnbdLT+YtFbRiVnic=";
36
+ };
37
+ mac7 = {
38
+ ip = "10.254.2.7";
39
+ publicKey = "j+DFm60vy4vj1hsMBuo3qVpFsmdLstDI+GbCOZNkKUU=";
40
+ };
41
+ mac8 = {
42
+ ip = "10.254.2.8";
43
+ publicKey = "fii4V76RpLngPiqa1x4mev4Cbon0WopKlOcfgB4VBVs=";
44
};
45
};
46
@@ -20,21 +48,26 @@ let
48
(hostname != selfHost)
49
&& (hostcfg ? "publicKey")
50
) hosts;
23
-in {
24
- networking.wireguard.interfaces.wg0 = {
25
- ips = [ "${hosts."${host}".ip}/${toString network}" ];
26
- privateKeyFile = "/etc/wireguard/private.key";
27
- generatePrivateKeyFile = true;
28
- listenPort = hosts."${host}".port or null;
29
-
30
- peers = lib.mapAttrsToList (hostname: hostcfg:
31
- {
32
- inherit (hostcfg) publicKey;
33
- allowedIPs = [ "${hostcfg.ip}/32" ];
34
- } // (lib.optionalAttrs (hostcfg ? endpoint) {
35
- persistentKeepalive = 60;
36
- inherit (hostcfg) endpoint;
37
- })
38
- ) (peerable host);
39
- };
40
-}
\ No newline at end of file
51
+in lib.mkMerge [
52
+ (lib.mkIf (hosts."${host}" ? "port") {
53
+ networking.firewall.allowedUDPPorts = [ hosts."${host}".port ];
54
+ })
55
+ {
56
+ networking.wireguard.interfaces.wg0 = {
57
+ ips = [ "${hosts."${host}".ip}/${toString network}" ];
58
+ privateKeyFile = "/etc/wireguard/private.key";
59
+ generatePrivateKeyFile = true;
60
+ listenPort = hosts."${host}".port or null;
61
+
62
+ peers = lib.mapAttrsToList (hostname: hostcfg:
63
+ {
64
+ inherit (hostcfg) publicKey;
65
+ allowedIPs = [ "${hostcfg.ip}/32" ];
66
+ } // (lib.optionalAttrs (hostcfg ? "endpoint") {
67
+ endpoint = "${hostcfg.endpoint}:${toString hostcfg.port}";
68
+ persistentKeepalive = 60;
69
+ })
70
+ ) (peerable host);
71
+ };
72
+ }
73
+]
\ No newline at end of file