lasuite-federez/nix
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

imprv mesh

Browse source
This commit is contained in:
asyncnomi 2025-07-22 18:24:28 +02:00
parent e2bedf1203
commit cc99c25966
3 changed files with 9 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

1
shared/bastion.nix
View file

@ -3,5 +3,6 @@
# Import dependencies
imports = [
./bastion/wireguard.nix
./bastion/forward.nix
];
}

0
shared/commons/forward.nix → shared/bastion/forward.nix
View file

20
shared/commons/mesh.nix
View file

@ -37,9 +37,9 @@ let
"mesh-${shorten peerName}-${toString remoteZone}-${toString remoteId}" = {
ips = [
"172.19.${toString myId}.${toString myId}/32"
"172.19.${toString remoteId}.${toString myId}/32"
"172.19.${toString myId}.${toString remoteId}/32"
"fc00::${toString myId}:${toString myId}/128"
"fc00::${toString remoteId}:${toString myId}/128"
"fc00::${toString myId}:${toString remoteId}/128"
];
privateKeyFile = config.age.secrets."wg-private-zone-${toString myZone}-id-${toString myId}".path;
listenPort = 51000 + remoteId;
@ -48,8 +48,8 @@ let
publicKey = peerConfig.wg-pub;
allowedIPs = [
# Allow mesh trafic
"172.19.0.0/17"
"fc00::/96"
"172.19.${toString peerConfig.id}.0/24"
"fc00::${toString peerConfig.id}:0/96"
# Allow mgmt transport
"172.19.128.0/17"
"fc00:f::/96"
@ -68,17 +68,13 @@ let
generateRoute = peerName: peerConfig: ''
# Static route to declare static wireguard peer inner tunnel ip (that has been thrown away to the "off" table)
${pkgs.iproute2}/bin/ip route replace 172.19.${toString myId}.${toString peerConfig.id} dev mesh-${shorten peerName}-${toString peerConfig.zone}-${toString peerConfig.id} scope link
${pkgs.iproute2}/bin/ip -6 route replace fc00::${toString myId}:${toString peerConfig.id} dev mesh-${shorten peerName}-${toString peerConfig.zone}-${toString peerConfig.id} scope link
# Redirect
${pkgs.iproute2}/bin/ip route replace 172.19.${toString peerConfig.id}.0/24 via 172.19.${toString myId}.${toString peerConfig.id}
${pkgs.iproute2}/bin/ip -6 route replace fc00::${toString peerConfig.id}:0/112 via fc00::${toString myId}:${toString peerConfig.id}
${pkgs.iproute2}/bin/ip route replace 172.19.${toString peerConfig.id}.0/24 dev mesh-${shorten peerName}-${toString peerConfig.zone}-${toString peerConfig.id} scope link
${pkgs.iproute2}/bin/ip -6 route replace fc00::${toString peerConfig.id}:0/112 dev mesh-${shorten peerName}-${toString peerConfig.zone}-${toString peerConfig.id} scope link
# Return path for mgmt trafic
${if lib.elem peerName mapping.bastion then ''
${pkgs.iproute2}/bin/ip route replace 172.19.${toString (peerConfig.zone + 127)}.0/24 via 172.19.${toString myPeer.id}.${toString peerConfig.id} dev mesh-${shorten peerName}-${toString peerConfig.zone}-${toString peerConfig.id}
${pkgs.iproute2}/bin/ip -6 route replace fc00:f::${toString (peerConfig.zone + 127)}:0/112 via fc00::${toString myPeer.id}:${toString peerConfig.id} dev mesh-${shorten peerName}-${toString peerConfig.zone}-${toString peerConfig.id}
${pkgs.iproute2}/bin/ip route replace 172.19.${toString (peerConfig.zone + 127)}.0/24 via 172.19.${toString peerConfig.id}.${toString myId} dev mesh-${shorten peerName}-${toString peerConfig.zone}-${toString peerConfig.id}
${pkgs.iproute2}/bin/ip -6 route replace fc00:f::${toString (peerConfig.zone + 127)}:0/112 via fc00::${toString peerConfig.id}:${toString myId} dev mesh-${shorten peerName}-${toString peerConfig.zone}-${toString peerConfig.id}
'' else ""}
'';