Setup wireguard on bastion
Graham Christensen committed
Apr 26, 2019 at 00:50 UTC
ab018c628bcf240e15cb766b431a59d1410e52bc
2 files changed
+50
-2
bastion/network.nix
+10
-2
@@ -34,7 +34,14 @@ in
34
inherit region accessKeyId;
35
vpcId = resources.vpc.bastion-vpc;
36
rules =
37
- with import ../ip-addresses.nix;
37
+ [
38
+ {
39
+ fromPort = 51820;
40
+ toPort = 51820;
41
+ sourceIp = "0.0.0.0/0";
42
+ }
43
+ ] ++
44
+ (with import ../ip-addresses.nix;
45
map
46
(ip: { toPort = 22; fromPort = 22; sourceIp = "${ip}/32"; })
47
[ eelcoHome
@@ -44,7 +51,7 @@ in
51
zimbatm
52
amine
53
"34.254.208.229" # == resources.elasticIPs."bastion.nixos.org".address FIXME: doesn't work
47
- ];
54
+ ]);
55
};
56
57
resources.vpcRouteTables.bastion-route-table =
@@ -109,6 +116,7 @@ in
116
117
imports =
118
[ ../modules/common.nix
119
+ (import ../modules/wireguard.nix "bastion")
120
../modules/tarball-mirror.nix
121
../modules/hydra-mirror.nix
122
];
modules/wireguard.nix
new
+40
@@ -0,0 +1,40 @@
1
+host:
2
+{ lib, ... }:
3
+let
4
+ network = 16;
5
+ hosts = {
6
+ bastion = {
7
+ ip = "10.254.1.1";
8
+ endoint = "bastion.nixos.org";
9
+ port = 51820;
10
+ publicKey = "nG7I9gegJIynKOZ6tzpvmLdCZ/xScTgRZeFvYLFyil4=";
11
+ };
12
+
13
+ mac1 = {
14
+ ip = "10.254.2.1";
15
+ # publicKey = "abc123";
16
+ };
17
+ };
18
+
19
+ peerable = selfHost: lib.filterAttrs (hostname: hostcfg:
20
+ (hostname != selfHost)
21
+ && (hostcfg ? "publicKey")
22
+ ) hosts;
23
+in {
24
+ networking.wireguard.interfaces.wg0 = {
25
+ ips = [ "${hosts."${host}".ip}/${toString network}" ];
26
+ privateKeyFile = "/etc/wireguard/private.key";
27
+ generatePrivateKeyFile = true;
28
+ listenPort = hosts."${host}".port or null;
29
+
30
+ peers = lib.mapAttrsToList (hostname: hostcfg:
31
+ {
32
+ inherit (hostcfg) publicKey;
33
+ allowedIPs = [ "${hostcfg.ip}/32" ];
34
+ } // (lib.optionalAttrs (hostcfg ? endpoint) {
35
+ persistentKeepalive = 60;
36
+ inherit (hostcfg) endpoint;
37
+ })
38
+ ) (peerable host);
39
+ };
40
+}
\ No newline at end of file