lasuite-federez/nix
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix rt routing & nftables

Browse source
This commit is contained in:
asyncnomi 2025-07-22 21:00:30 +02:00
parent 71be15629e
commit ccf23a35b8
3 changed files with 42 additions and 54 deletions
Download patch file Download diff file Expand all files Collapse all files

66
shared/commons/mesh.nix
View file

@ -19,48 +19,40 @@ let
};
generatedSecrets = lib.mapAttrsToList (name: node: buildSecret node.zone node.id) nodes;
generateWireGuardInterface = nodesConfig: let
myPeer = nodesConfig."${config.hostName}";
myZone = myPeer.zone;
myId = myPeer.id;
# Filter itself out of the peer list
peerConfigs = lib.filterAttrs (_peerName: peerConfig: (peerConfig.zone != myZone) || (peerConfig.id != myId)) nodesConfig;
peers = lib.mapAttrsToList (peerName: peerConfig: {
name = "${peerName}";
publicKey = peerConfig.wg-pub;
allowedIPs = [
"172.19.${toString peerConfig.zone}.${toString peerConfig.id}/32"
"fc00::${toString peerConfig.zone}:${toString peerConfig.id}/128"
] ++ lib.optionals (lib.elem peerName mapping.bastion) [
"172.19.${toString (peerConfig.zone + 127)}.0/24"
"fc00:f::${toString (peerConfig.zone + 127)}:0/112"
# Filter itself out of the peer list
peerConfigs = lib.filterAttrs (_peerName: peerConfig: (peerConfig.zone != myZone) || (peerConfig.id != myId)) nodes;
peers = lib.mapAttrsToList (peerName: peerConfig: {
name = "${peerName}";
publicKey = peerConfig.wg-pub;
allowedIPs = [
"172.19.${toString peerConfig.zone}.${toString peerConfig.id}/32"
"fc00::${toString peerConfig.zone}:${toString peerConfig.id}/128"
] ++ lib.optionals (lib.elem peerName mapping.bastion) [
"172.19.${toString (peerConfig.zone + 127)}.0/24"
"fc00:f::${toString (peerConfig.zone + 127)}:0/112"
];
endpoint = "${builtins.head (builtins.split "/" peerConfig.ip4)}:51820";
persistentKeepalive = 25;
}) peerConfigs;
interfaces = {
"mesh" = {
ips = [
"172.19.${toString myZone}.${toString myId}/16"
"fc00::${toString myZone}:${toString myId}/96"
];
endpoint = "${builtins.head (builtins.split "/" peerConfig.ip4)}:51820";
persistentKeepalive = 25;
}) peerConfigs;
interface = {
"mesh" = {
ips = [
"172.19.${toString myZone}.${toString myId}/16"
"fc00::${toString myZone}:${toString myId}/96"
];
privateKeyFile = config.age.secrets."wg-private-zone-${toString myZone}-id-${toString myId}".path;
listenPort = 51820;
peers = peers;
};
privateKeyFile = config.age.secrets."wg-private-zone-${toString myZone}-id-${toString myId}".path;
listenPort = 51820;
peers = peers;
};
in interface;
wireguardInterfaces = generateWireGuardInterface nodes;
};
generateRoute = peerName: peerConfig: ''
# Return path for mgmt trafic
${if lib.elem peerName mapping.bastion then ''
${pkgs.iproute2}/bin/ip route replace 172.19.${toString (peerConfig.zone + 127)}.0/24 via 172.19.${toString peerConfig.id}.${toString myId} dev mesh
${pkgs.iproute2}/bin/ip -6 route replace fc00:f::${toString (peerConfig.zone + 127)}:0/112 via fc00::${toString peerConfig.id}:${toString myId} dev mesh
${pkgs.iproute2}/bin/ip route replace 172.19.${toString (peerConfig.zone + 127)}.0/24 via 172.19.${toString peerConfig.zone}.${toString peerConfig.id} dev mesh
${pkgs.iproute2}/bin/ip -6 route replace fc00:f::${toString (peerConfig.zone + 127)}:0/112 via fc00::${toString peerConfig.zone}:${toString peerConfig.id} dev mesh
'' else ""}
'';
@ -83,7 +75,7 @@ in
networking.wireguard.useNetworkd = false;
# Return all WireGuard interfaces for each node
networking.wireguard.interfaces = wireguardInterfaces;
networking.wireguard.interfaces = interfaces;
# Execute custom routing for wireguard
systemd.services.wireguardStaticRouting = {