lasuite-federez/nix
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

we only need one if and n peer, not the other way around

Browse source
This commit is contained in:
asyncnomi 2025-07-21 02:34:47 +02:00
parent 4264f02794
commit d6a068f952
2 changed files with 29 additions and 32 deletions
Download patch file Download diff file Expand all files Collapse all files

3
flake.nix
View file

@ -38,6 +38,7 @@
nodes = import ./nodes.nix; nodes = import ./nodes.nix;
defaultModules = [ defaultModules = [
agenix.nixosModules.default
./shared/users.nix ./shared/users.nix
./shared/commons.nix ./shared/commons.nix
]; ];
@ -66,7 +67,7 @@
}) nodes; }) nodes;
}; };
# This is highly advised, and will prevent many possible mistakes # This is highly advised, and will prevent many possible mistakes, just run "deploy -s" to bypass it
checks = builtins.mapAttrs (system: deployLib: deployLib.deployChecks self.deploy) deploy-rs.lib; checks = builtins.mapAttrs (system: deployLib: deployLib.deployChecks self.deploy) deploy-rs.lib;
}; };
} }

40
shared/commons/mesh.nix
View file

@ -11,9 +11,9 @@ let
group = "root"; group = "root";
}; };
}; };
generatedSecrets = lib.mapAttrsToList (name: node: generateSecret node.zone) nodes; generatedSecrets = lib.mapAttrsToList (name: node: buildSecret node.zone node.id) nodes;
generateWireGuardInterfaces = nodesConfig: let generateWireGuardInterface = nodesConfig: let
myPeer = nodesConfig."${config.hostName}"; myPeer = nodesConfig."${config.hostName}";
myZone = myPeer.zone; myZone = myPeer.zone;
myId = myPeer.id; myId = myPeer.id;
@ -21,35 +21,31 @@ let
# Filter itself out of the peer list # Filter itself out of the peer list
peerConfigs = lib.filterAttrs (_peerName: peerConfig: (peerConfig.zone != myZone) || (peerConfig.id != myId)) nodesConfig; peerConfigs = lib.filterAttrs (_peerName: peerConfig: (peerConfig.zone != myZone) || (peerConfig.id != myId)) nodesConfig;
# Build peers peers = lib.mapAttrsToList (peerName: peerConfig: {
interfacePeers = lib.flatten (lib.mapAttrsToList (peerName: peerConfig: let name = "${peerName}";
# For now only IPv4 based tunnel are deployed publicKey = peerConfig.wg-pub;
if4 = { allowedIPs = [
"wg-${peerName}" = { "172.19.${toString peerConfig.zone}.${toString peerConfig.id}/32"
"fc00::${toString peerConfig.zone}:${toString peerConfig.id}/128"
];
endpoint = "${builtins.head (builtins.split "/" peerConfig.ip4)}:51820";
persistentKeepalive = 25;
}) peerConfigs;
interface = {
"mesh" = {
ips = [ ips = [
"172.19.${toString myZone}.${toString myId}/16" "172.19.${toString myZone}.${toString myId}/16"
"fc00::${toString myZone}:${toString myId}/96" "fc00::${toString myZone}:${toString myId}/96"
]; ];
privateKeyFile = config.age.secrets."wg-private-zone-${toString myZone}-id-${toString myId}".path; privateKeyFile = config.age.secrets."wg-private-zone-${toString myZone}-id-${toString myId}".path;
listenPort = 51820; listenPort = 51820;
peers = [{ peers = peers;
name = "${peerName}-ip4";
publicKey = peerConfig.wg-pub;
allowedIPs = [
"172.19.0.0/16"
"fc00::/96"
];
endpoint = "${builtins.head (builtins.split "/" peerConfig.ip4)}:51820";
persistentKeepalive = 25;
}];
}; };
}; };
in interface;
in if4) peerConfigs); wireguardInterfaces = generateWireGuardInterface nodes;
interfaces = builtins.foldl' (acc: set: acc // set) {} interfacePeers;
in interfaces;
wireguardInterfaces = generateWireGuardInterfaces nodes;
in in
{ {
age.secrets = lib.lists.foldl' (acc: set: lib.attrsets.recursiveUpdate acc set) {} generatedSecrets; age.secrets = lib.lists.foldl' (acc: set: lib.attrsets.recursiveUpdate acc set) {} generatedSecrets;