switch macOS VMs to wireguard
Eelco Dolstra committed
Aug 19, 2019 at 19:33 UTC
0cc1c2a9505da123650c3c41250717f12675e049
4 files changed
+40
-35
delft/hydra.nix
+23
-30
@@ -83,52 +83,47 @@ in
83
TCPKeepAlive yes
84
85
Host mac1-guest
86
- Hostname 37.153.215.191
87
- Port 6001
86
+ Hostname 10.254.2.1
87
+ Port 2200
88
Compression yes
89
90
Host mac2-guest
91
- Hostname 37.153.215.191
92
- Port 6002
91
+ Hostname 10.254.2.2
92
+ Port 2200
93
Compression yes
94
95
Host mac3-guest
96
- Hostname 37.153.215.191
97
- Port 6003
96
+ Hostname 10.254.2.3
97
+ Port 2200
98
Compression yes
99
100
Host mac4-guest
101
- Hostname 37.153.215.191
102
- Port 6004
101
+ Hostname 10.254.2.4
102
+ Port 2200
103
Compression yes
104
105
Host mac5-guest
106
- Hostname 37.153.215.191
107
- Port 6005
106
+ Hostname 10.254.2.5
107
+ Port 2200
108
Compression yes
109
110
Host mac6-guest
111
- Hostname 37.153.215.191
112
- Port 6006
111
+ Hostname 10.254.2.6
112
+ Port 2200
113
Compression yes
114
115
Host mac7-guest
116
- Hostname 37.153.215.191
117
- Port 6007
116
+ Hostname 10.254.2.7
117
+ Port 2200
118
Compression yes
119
120
Host mac8-guest
121
- Hostname 37.153.215.191
122
- Port 6008
121
+ Hostname 10.254.2.8
122
+ Port 2200
123
Compression yes
124
125
Host mac9-guest
126
- Hostname 37.153.215.191
127
- Port 6009
128
- Compression yes
129
-
130
- Host bigmac-guest
131
- Hostname 147.75.64.174
126
+ Hostname 10.254.2.9
127
Port 2200
128
Compression yes
129
@@ -170,14 +165,12 @@ in
165
{ hostNames = [ "83.87.124.39" ]; publicKey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDVTkY4tQ6V29XTW1aKtoFJoF4uyaEy0fms3HqmI56av8UCg3MN5G6CL6EDIvbe46mBsI3++V3uGiOr0pLPbM9fkWC92LYGk5f7fNvCoy9bvuZy5bHwFQ5b5S9IJ1o3yDlCToc9CppmPVbFMMMLgKF06pQiGBeMCUG/VoCfiUBq+UgEGhAifWcuWIOGmdua6clljH5Dcc+7S0HTLoVtrxmPPXBVZUvW+lgAJTM6FXYIZiIqMSC2uZHGVstY87nPcZFXIbzhlYQqxx5H0um2bL3mbS7vdKhSsIWWaUZeck9ghNyUV1fVRLUhuXkQHe/8Z58cAhTv5dDd42YLB0fgjETV"; }
166
167
# (for i in $(seq 6000 6010); do ssh-keyscan -t ssh-ed25519 -p $i 37.153.215.191 2> /dev/null; done) | sed -e 's/^/ { hostNames = [ "/' -e 's/ ssh/" ]; publicKey = "ssh/' -e 's/$/"; }/'; echo
173
- { hostNames = [ "[37.153.215.191]:6002" ]; publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKJSLxndBO2SqMklTT4dWsv54CtKVMHDOhXl7v1tC38v"; }
174
- { hostNames = [ "[37.153.215.191]:6003" ]; publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKdzP9scGjJ31wwDJdcXcO4+wayvrHkFAefP/0I7UB0r"; }
175
- { hostNames = [ "[37.153.215.191]:6004" ]; publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAaK44azT14aWHTE2fMYJFeJBTg1hQg2n2KAEgu8qlII"; }
176
- { hostNames = [ "[37.153.215.191]:6005" ]; publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEgJ2Mh0vkrBcIBcWgFoEPsYG9dyPOAUgL0GOhhBoRcD"; }
177
- { hostNames = [ "[37.153.215.191]:6006" ]; publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICyjTqJsNioHUP0HMmGVfDpej9dCIQH0Bdn5aNbe8oYU"; }
178
- { hostNames = [ "[37.153.215.191]:6007" ]; publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKjy5mXHUHqGO+lzeyj09iuADIDtcQtnBtwiPCmV/UBq"; }
179
- { hostNames = [ "[37.153.215.191]:6008" ]; publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHHJF0dXSTvZwWtPjN/iUBp2A5pHCPuOUVOvBkjXw+Eu"; }
180
- { hostNames = [ "[139.178.82.19]:2200" ]; publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIyfeCptEJWPP2nsC5jBZ62Z13+Vl1I/5fFQ9acTbQp3"; }
168
+ { hostNames = [ "[10.254.2.2]:2200" ]; publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKJSLxndBO2SqMklTT4dWsv54CtKVMHDOhXl7v1tC38v"; }
169
+ { hostNames = [ "[10.254.2.3]:2200" ]; publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKdzP9scGjJ31wwDJdcXcO4+wayvrHkFAefP/0I7UB0r"; }
170
+ { hostNames = [ "[10.254.2.4]:2200" ]; publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAaK44azT14aWHTE2fMYJFeJBTg1hQg2n2KAEgu8qlII"; }
171
+ { hostNames = [ "[10.254.2.5]:2200" ]; publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEgJ2Mh0vkrBcIBcWgFoEPsYG9dyPOAUgL0GOhhBoRcD"; }
172
+ { hostNames = [ "[10.254.2.6]:2200" ]; publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICyjTqJsNioHUP0HMmGVfDpej9dCIQH0Bdn5aNbe8oYU"; }
173
+ { hostNames = [ "[10.254.2.7]:2200" ]; publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKjy5mXHUHqGO+lzeyj09iuADIDtcQtnBtwiPCmV/UBq"; }
174
175
# bigmac
176
{ hostNames = [ "[147.75.64.174]:2200" ]; publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINM+o3+x2cncVNdRTVZTOeckSzheAJRzVkYdu7PsgDkq"; }
delft/network.nix
+1
@@ -8,6 +8,7 @@ let
8
network = {
9
interiorNetworkPrefix = "10.172.170"; #172="n", 170="x"
10
externalInterface = "enp3s0f0";
11
+ sshInterface = "wg0";
12
};
13
14
guest = {
macs/host/default.nix
+7
@@ -44,6 +44,13 @@ in {
44
'';
45
};
46
47
+ sshInterface = mkOption {
48
+ type = types.str;
49
+ description = ''
50
+ Public network interface to receive SSH connections on.
51
+ '';
52
+ };
53
+
54
interiorNetworkPrefix = mkOption {
55
type = types.str;
56
description = ''
macs/host/networking.nix
+9
-5
@@ -34,11 +34,6 @@ in {
34
"${subnetIP}/24"
35
];
36
forwardPorts = [
37
- {
38
- destination = "${guestIP}:22";
39
- proto = "tcp";
40
- sourcePort = 2200;
41
- }
37
{
38
destination = "${guestIP}:9100";
39
proto = "tcp";
@@ -108,5 +103,14 @@ in {
103
${pkgs.expect}/bin/unbuffer ${ncl}
104
'';
105
};
106
+
107
+ systemd.services.forward-wg0-ssh-to-guest = {
108
+ wantedBy = [ "multi-user.target" ];
109
+ script = ''
110
+ set -euxo pipefail
111
+ exec ${pkgs.socat}/bin/socat TCP-LISTEN:2200,fork,so-bindtodevice=${config.macosGuest.network.sshInterface} TCP:${guestIP}:22
112
+ '';
113
+ };
114
+
115
};
116
}