lasuite-federez/nix
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

simplified mesh

Browse source
This commit is contained in:
asyncnomi 2025-07-22 20:50:48 +02:00
parent 6aee4ab033
commit 71be15629e
14 changed files with 45 additions and 64 deletions
Download patch file Download diff file Expand all files Collapse all files

24
secrets/secrets.nix
View file

@ -57,18 +57,18 @@ in
"wireguard/wg-private-zone-1-id-13.age".publicKeys = system-wg ++ users; "wireguard/wg-private-zone-1-id-13.age".publicKeys = system-wg ++ users;
# Zone 2 (Rennes) # Zone 2 (Rennes)
"wireguard/wg-private-zone-2-id-14.age".publicKeys = system-wg ++ users; "wireguard/wg-private-zone-2-id-1.age".publicKeys = system-wg ++ users;
"wireguard/wg-private-zone-2-id-15.age".publicKeys = system-wg ++ users; "wireguard/wg-private-zone-2-id-2.age".publicKeys = system-wg ++ users;
"wireguard/wg-private-zone-2-id-16.age".publicKeys = system-wg ++ users; "wireguard/wg-private-zone-2-id-3.age".publicKeys = system-wg ++ users;
"wireguard/wg-private-zone-2-id-17.age".publicKeys = system-wg ++ users; "wireguard/wg-private-zone-2-id-4.age".publicKeys = system-wg ++ users;
"wireguard/wg-private-zone-2-id-18.age".publicKeys = system-wg ++ users; "wireguard/wg-private-zone-2-id-5.age".publicKeys = system-wg ++ users;
"wireguard/wg-private-zone-2-id-19.age".publicKeys = system-wg ++ users; "wireguard/wg-private-zone-2-id-6.age".publicKeys = system-wg ++ users;
"wireguard/wg-private-zone-2-id-20.age".publicKeys = system-wg ++ users; "wireguard/wg-private-zone-2-id-7.age".publicKeys = system-wg ++ users;
"wireguard/wg-private-zone-2-id-21.age".publicKeys = system-wg ++ users; "wireguard/wg-private-zone-2-id-8.age".publicKeys = system-wg ++ users;
"wireguard/wg-private-zone-2-id-22.age".publicKeys = system-wg ++ users; "wireguard/wg-private-zone-2-id-9.age".publicKeys = system-wg ++ users;
"wireguard/wg-private-zone-2-id-23.age".publicKeys = system-wg ++ users; "wireguard/wg-private-zone-2-id-10.age".publicKeys = system-wg ++ users;
"wireguard/wg-private-zone-2-id-24.age".publicKeys = system-wg ++ users; "wireguard/wg-private-zone-2-id-11.age".publicKeys = system-wg ++ users;
"wireguard/wg-private-zone-2-id-25.age".publicKeys = system-wg ++ users; "wireguard/wg-private-zone-2-id-12.age".publicKeys = system-wg ++ users;
# Bastion secrets # Bastion secrets

0
secrets/wireguard/wg-private-zone-2-id-14.age → secrets/wireguard/wg-private-zone-2-id-1.age
View file

0
secrets/wireguard/wg-private-zone-2-id-23.age → secrets/wireguard/wg-private-zone-2-id-10.age
View file

0
secrets/wireguard/wg-private-zone-2-id-24.age → secrets/wireguard/wg-private-zone-2-id-11.age
View file

0
secrets/wireguard/wg-private-zone-2-id-25.age → secrets/wireguard/wg-private-zone-2-id-12.age
View file

0
secrets/wireguard/wg-private-zone-2-id-15.age → secrets/wireguard/wg-private-zone-2-id-2.age
View file

0
secrets/wireguard/wg-private-zone-2-id-16.age → secrets/wireguard/wg-private-zone-2-id-3.age
View file

0
secrets/wireguard/wg-private-zone-2-id-17.age → secrets/wireguard/wg-private-zone-2-id-4.age
View file

0
secrets/wireguard/wg-private-zone-2-id-18.age → secrets/wireguard/wg-private-zone-2-id-5.age
View file

0
secrets/wireguard/wg-private-zone-2-id-19.age → secrets/wireguard/wg-private-zone-2-id-6.age
View file

0
secrets/wireguard/wg-private-zone-2-id-20.age → secrets/wireguard/wg-private-zone-2-id-7.age
View file

0
secrets/wireguard/wg-private-zone-2-id-21.age → secrets/wireguard/wg-private-zone-2-id-8.age
View file

0
secrets/wireguard/wg-private-zone-2-id-22.age → secrets/wireguard/wg-private-zone-2-id-9.age
View file

85
shared/commons/mesh.nix
View file

@ -19,71 +19,52 @@ let
}; };
generatedSecrets = lib.mapAttrsToList (name: node: buildSecret node.zone node.id) nodes; generatedSecrets = lib.mapAttrsToList (name: node: buildSecret node.zone node.id) nodes;
shorten = peerName: let generateWireGuardInterface = nodesConfig: let
parts = lib.splitString "-" peerName; myPeer = nodesConfig."${config.hostName}";
shortened = lib.concatStrings (map (part: lib.substring 0 1 part) parts); myZone = myPeer.zone;
in shortened; myId = myPeer.id;
# Filter itself out of the peer list # Filter itself out of the peer list
peerConfigs = lib.filterAttrs (_peerName: peerConfig: peerConfig.id != myId) nodes; peerConfigs = lib.filterAttrs (_peerName: peerConfig: (peerConfig.zone != myZone) || (peerConfig.id != myId)) nodesConfig;
# We'll make one if per peer, this is more flexible peers = lib.mapAttrsToList (peerName: peerConfig: {
interfacePeers = lib.flatten (lib.mapAttrsToList (peerName: peerConfig: let name = "${peerName}";
remoteId = peerConfig.id; publicKey = peerConfig.wg-pub;
remoteZone = peerConfig.zone; allowedIPs = [
"172.19.${toString peerConfig.zone}.${toString peerConfig.id}/32"
# The mesh is for now only IPv4 based "fc00::${toString peerConfig.zone}:${toString peerConfig.id}/128"
if4 = { ] ++ lib.optionals (lib.elem peerName mapping.bastion) [
"mesh-${shorten peerName}-${toString remoteZone}-${toString remoteId}" = { "172.19.${toString (peerConfig.zone + 127)}.0/24"
"fc00:f::${toString (peerConfig.zone + 127)}:0/112"
];
endpoint = "${builtins.head (builtins.split "/" peerConfig.ip4)}:51820";
persistentKeepalive = 25;
}) peerConfigs;
interface = {
"mesh" = {
ips = [ ips = [
"172.19.0.${toString myId}/32" "172.19.${toString myZone}.${toString myId}/16"
"172.19.${toString myId}.${toString remoteId}/32" "fc00::${toString myZone}:${toString myId}/96"
"fc00::${toString myId}/128"
"fc00::${toString myId}:${toString remoteId}/128"
]; ];
privateKeyFile = config.age.secrets."wg-private-zone-${toString myZone}-id-${toString myId}".path; privateKeyFile = config.age.secrets."wg-private-zone-${toString myZone}-id-${toString myId}".path;
listenPort = 51000 + remoteId; listenPort = 51820;
peers = [{ peers = peers;
name = "${peerName}-ip4";
publicKey = peerConfig.wg-pub;
allowedIPs = [
# Allow mesh trafic
"172.19.0.${toString peerConfig.id}/32"
"172.19.${toString peerConfig.id}.0/24"
"fc00::${toString peerConfig.id}:0/96"
# Allow mgmt transport
"172.19.128.0/17"
"fc00:f::/96"
];
endpoint = "${builtins.head (builtins.split "/" peerConfig.ip4)}:${toString (51000 + myId)}";
persistentKeepalive = 25;
}];
# Throw away route created by wireguard
table = "off";
}; };
}; };
in interface;
in if4) peerConfigs); wireguardInterfaces = generateWireGuardInterface nodes;
wireguardInterfaces = builtins.foldl' (acc: set: acc // set) {} interfacePeers;
generateRoute = peerName: peerConfig: '' generateRoute = peerName: peerConfig: ''
# Static route to declare static wireguard peer inner tunnel ip (that has been thrown away to the "off" table)
${pkgs.iproute2}/bin/ip route replace 172.19.${toString peerConfig.id}.0/24 dev mesh-${shorten peerName}-${toString peerConfig.zone}-${toString peerConfig.id} scope link
${pkgs.iproute2}/bin/ip -6 route replace fc00::${toString peerConfig.id}:0/112 dev mesh-${shorten peerName}-${toString peerConfig.zone}-${toString peerConfig.id} scope link
# Nodes self ip
${pkgs.iproute2}/bin/ip route replace 172.19.0.${toString peerConfig.id}/32 dev mesh-${shorten peerName}-${toString peerConfig.zone}-${toString peerConfig.id} scope link
${pkgs.iproute2}/bin/ip -6 route replace fc00::${toString peerConfig.id}/128 dev mesh-${shorten peerName}-${toString peerConfig.zone}-${toString peerConfig.id} scope link
# Return path for mgmt trafic # Return path for mgmt trafic
${if lib.elem peerName mapping.bastion then '' ${if lib.elem peerName mapping.bastion then ''
${pkgs.iproute2}/bin/ip route replace 172.19.${toString (peerConfig.zone + 127)}.0/24 via 172.19.${toString peerConfig.id}.${toString myId} dev mesh-${shorten peerName}-${toString peerConfig.zone}-${toString peerConfig.id} ${pkgs.iproute2}/bin/ip route replace 172.19.${toString (peerConfig.zone + 127)}.0/24 via 172.19.${toString peerConfig.id}.${toString myId} dev mesh
${pkgs.iproute2}/bin/ip -6 route replace fc00:f::${toString (peerConfig.zone + 127)}:0/112 via fc00::${toString peerConfig.id}:${toString myId} dev mesh-${shorten peerName}-${toString peerConfig.zone}-${toString peerConfig.id} ${pkgs.iproute2}/bin/ip -6 route replace fc00:f::${toString (peerConfig.zone + 127)}:0/112 via fc00::${toString peerConfig.id}:${toString myId} dev mesh
'' else ""} '' else ""}
''; '';
generateAfter = peerName: peerConfig: "wireguard-mesh-${shorten peerName}-${toString peerConfig.zone}-${toString peerConfig.id}.target"; generateAfter = peerName: peerConfig: "wireguard-mesh.target";
routes = lib.mapAttrsToList (name: peer: generateRoute name peer) peerConfigs; routes = lib.mapAttrsToList (name: peer: generateRoute name peer) peerConfigs;
afters = lib.mapAttrsToList (name: peer: generateAfter name peer) peerConfigs; afters = lib.mapAttrsToList (name: peer: generateAfter name peer) peerConfigs;