add mesh

2025-07-21 01:58:24 +02:00 · 2025-07-21 01:58:24 +02:00 · 4264f02794
commit 4264f02794
parent eeef2a7338
3 changed files with 72 additions and 0 deletions
--- a/shared/commons/mesh.nix
+++ b/shared/commons/mesh.nix
@ -0,0 +1,70 @@
+{ config, lib, ... }:
+
+let
+    # Import nodes
+    nodes = import ./../../nodes.nix;
+
+    buildSecret = zone: id: {
+        "wg-private-zone-${toString zone}-id-${toString id}" = {
+            file = ./../../secrets/wireguard + ( "/wg-private-zone-" + toString zone + "-id-" + toString id + ".age" );
+            owner = "root";
+            group = "root";
+        };
+    };
+    generatedSecrets = lib.mapAttrsToList (name: node: generateSecret node.zone) nodes;
+
+    generateWireGuardInterfaces = nodesConfig: let
+        myPeer = nodesConfig."${config.hostName}";
+        myZone = myPeer.zone;
+        myId = myPeer.id;
+    
+        # Filter itself out of the peer list
+        peerConfigs = lib.filterAttrs (_peerName: peerConfig: (peerConfig.zone != myZone) || (peerConfig.id != myId)) nodesConfig;
+    
+        # Build peers
+        interfacePeers = lib.flatten (lib.mapAttrsToList (peerName: peerConfig: let
+            # For now only IPv4 based tunnel are deployed
+            if4 = {
+                "wg-${peerName}" = {
+                    ips = [
+                        "172.19.${toString myZone}.${toString myId}/16"
+                        "fc00::${toString myZone}:${toString myId}/96"
+                    ];
+                    privateKeyFile = config.age.secrets."wg-private-zone-${toString myZone}-id-${toString myId}".path;
+                    listenPort = 51820;
+                    peers = [{
+                        name = "${peerName}-ip4";
+                        publicKey = peerConfig.wg-pub;
+                        allowedIPs = [ 
+                            "172.19.0.0/16"
+                            "fc00::/96"
+                        ];
+                        endpoint = "${builtins.head (builtins.split "/" peerConfig.ip4)}:51820";
+                        persistentKeepalive = 25;
+                    }];
+                };
+            };
+
+        in if4) peerConfigs);
+        interfaces = builtins.foldl' (acc: set: acc // set) {} interfacePeers;
+    in interfaces;
+
+    wireguardInterfaces = generateWireGuardInterfaces nodes;
+in
+{
+    age.secrets = lib.lists.foldl' (acc: set: lib.attrsets.recursiveUpdate acc set) {} generatedSecrets;
+
+    # Networkd backend introduce in 25.05
+    # No independant target are generated 
+    # when using networkd as a backend
+    # If custom systemd ordering is needed 
+    # between wg interface and the rest of 
+    # networking: switch to false here
+    networking.wireguard.useNetworkd = true;
+
+    # Return all WireGuard interfaces for each node
+    networking.wireguard.interfaces = wireguardInterfaces;
+
+    # Open UDP port for wireguard traffic
+    networking.firewall.allowedUDPPorts = [ 51820 ];
+}