mass reformat
This commit is contained in:
parent
ed1c53e94c
commit
9cb456ad60
25 changed files with 1216 additions and 1043 deletions
147
modules/ezwg.nix
147
modules/ezwg.nix
|
@ -1,9 +1,13 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
with lib;
|
||||
let
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
with lib; let
|
||||
cfg = config.services.ezwg;
|
||||
|
||||
peerNameReplacement = lib.replaceChars [ "/" "-" " " "+" "=" ] [
|
||||
peerNameReplacement = lib.replaceChars ["/" "-" " " "+" "="] [
|
||||
"-"
|
||||
"\\x2d"
|
||||
"\\x20"
|
||||
|
@ -11,35 +15,31 @@ let
|
|||
"\\x3d"
|
||||
];
|
||||
|
||||
ranges = serverIPs:
|
||||
let
|
||||
generateRangesScript =
|
||||
builtins.toFile "exclusionary-wildcard-ranges-generator.py" ''
|
||||
import ipaddress
|
||||
serverNetworks = [${map (ip: "ip_network('${ip}/32')") serverIPs}]
|
||||
ranges = [ipaddress.ip_network('0.0.0.0/0')]
|
||||
for serverNetwork in serverNetworks:
|
||||
ranges = map(lambda r: list(r.address_exclude(serverNetwork)), ranges)
|
||||
print(':'.join(ranges))
|
||||
'';
|
||||
rangesOutput = pkgs.runCommand "exclusionary-wildcard-ranges" { } ''
|
||||
${pkgs.python3}/bin/python3 ${generateRangesScript} > $out
|
||||
'';
|
||||
in
|
||||
ranges = serverIPs: let
|
||||
generateRangesScript = builtins.toFile "exclusionary-wildcard-ranges-generator.py" ''
|
||||
import ipaddress
|
||||
serverNetworks = [${map (ip: "ip_network('${ip}/32')") serverIPs}]
|
||||
ranges = [ipaddress.ip_network('0.0.0.0/0')]
|
||||
for serverNetwork in serverNetworks:
|
||||
ranges = map(lambda r: list(r.address_exclude(serverNetwork)), ranges)
|
||||
print(':'.join(ranges))
|
||||
'';
|
||||
rangesOutput = pkgs.runCommand "exclusionary-wildcard-ranges" {} ''
|
||||
${pkgs.python3}/bin/python3 ${generateRangesScript} > $out
|
||||
'';
|
||||
in
|
||||
lib.splitString ":" (builtins.readFile "${rangesOutput}");
|
||||
|
||||
subnet = vlanIP: vlanSize:
|
||||
let
|
||||
generateSubnetScript =
|
||||
builtins.toFile "subnet-without-host-bits-generator.py" ''
|
||||
import ipaddress
|
||||
n1 = ipaddress.ip_network('${vlanIP}/${toString vlanSize}', False)
|
||||
print(n1, end="")
|
||||
'';
|
||||
subnetOutput = pkgs.runCommand "subnet-without-host-bits" { } ''
|
||||
${pkgs.python3}/bin/python3 ${generateSubnetScript} > $out
|
||||
'';
|
||||
in
|
||||
subnet = vlanIP: vlanSize: let
|
||||
generateSubnetScript = builtins.toFile "subnet-without-host-bits-generator.py" ''
|
||||
import ipaddress
|
||||
n1 = ipaddress.ip_network('${vlanIP}/${toString vlanSize}', False)
|
||||
print(n1, end="")
|
||||
'';
|
||||
subnetOutput = pkgs.runCommand "subnet-without-host-bits" {} ''
|
||||
${pkgs.python3}/bin/python3 ${generateSubnetScript} > $out
|
||||
'';
|
||||
in
|
||||
builtins.readFile "${subnetOutput}";
|
||||
|
||||
serverOpts.options = {
|
||||
|
@ -61,7 +61,7 @@ let
|
|||
instanceOpts.options = {
|
||||
servers = mkOption {
|
||||
description = "Configuration of servers to connect to";
|
||||
default = { };
|
||||
default = {};
|
||||
type = with types; listOf (submodule serverOpts);
|
||||
};
|
||||
autoStart = mkOption {
|
||||
|
@ -88,13 +88,12 @@ let
|
|||
description = "The IP to use on the wg VLAN";
|
||||
};
|
||||
};
|
||||
in
|
||||
{
|
||||
in {
|
||||
options.services.ezwg = {
|
||||
enable = mkEnableOption "Enable simple Wireguard connection";
|
||||
instances = mkOption {
|
||||
description = "Configuration of instances of Wireguard";
|
||||
default = { };
|
||||
default = {};
|
||||
type = with types; attrsOf (submodule instanceOpts);
|
||||
};
|
||||
};
|
||||
|
@ -102,49 +101,59 @@ in
|
|||
config = mkIf cfg.enable {
|
||||
networking.firewall.checkReversePath = false;
|
||||
|
||||
systemd.paths = mapAttrs'
|
||||
systemd.paths =
|
||||
mapAttrs'
|
||||
(instName: inst: {
|
||||
name = "wireguard-${instName}";
|
||||
value = if inst.autoStart then { } else { wantedBy = mkForce [ ]; };
|
||||
value =
|
||||
if inst.autoStart
|
||||
then {}
|
||||
else {wantedBy = mkForce [];};
|
||||
})
|
||||
cfg.instances;
|
||||
|
||||
systemd.services = lib.listToAttrs (flatten (mapAttrsToList
|
||||
(instName: inst:
|
||||
[{
|
||||
name = "wireguard-${instName}";
|
||||
value = if inst.autoStart then { } else { wantedBy = mkForce [ ]; };
|
||||
}] ++ map
|
||||
(server: {
|
||||
name =
|
||||
"wireguard-${instName}-peer${peerNameReplacement server.publicKey}";
|
||||
value = if inst.autoStart then { } else { wantedBy = mkForce [ ]; };
|
||||
})
|
||||
inst.servers)
|
||||
[
|
||||
{
|
||||
name = "wireguard-${instName}";
|
||||
value =
|
||||
if inst.autoStart
|
||||
then {}
|
||||
else {wantedBy = mkForce [];};
|
||||
}
|
||||
]
|
||||
++ map
|
||||
(server: {
|
||||
name = "wireguard-${instName}-peer${peerNameReplacement server.publicKey}";
|
||||
value =
|
||||
if inst.autoStart
|
||||
then {}
|
||||
else {wantedBy = mkForce [];};
|
||||
})
|
||||
inst.servers)
|
||||
cfg.instances));
|
||||
|
||||
networking.wireguard.interfaces = mapAttrs
|
||||
(instName: inst:
|
||||
let
|
||||
allowedIPs =
|
||||
if inst.proxy then
|
||||
ranges (map (s: s.ip) inst.servers)
|
||||
else
|
||||
[ (subnet inst.vlanIP inst.vlanSize) ];
|
||||
in
|
||||
{
|
||||
ips = [ "${inst.vlanIP}/${toString inst.vlanSize}" ];
|
||||
privateKeyFile = inst.privateKeyFile;
|
||||
peers = map
|
||||
(server: {
|
||||
inherit allowedIPs;
|
||||
publicKey = server.publicKey;
|
||||
endpoint = "${server.ip}:${toString server.port}";
|
||||
persistentKeepalive = 25;
|
||||
})
|
||||
inst.servers;
|
||||
})
|
||||
networking.wireguard.interfaces =
|
||||
mapAttrs
|
||||
(instName: inst: let
|
||||
allowedIPs =
|
||||
if inst.proxy
|
||||
then ranges (map (s: s.ip) inst.servers)
|
||||
else [(subnet inst.vlanIP inst.vlanSize)];
|
||||
in {
|
||||
ips = ["${inst.vlanIP}/${toString inst.vlanSize}"];
|
||||
privateKeyFile = inst.privateKeyFile;
|
||||
peers =
|
||||
map
|
||||
(server: {
|
||||
inherit allowedIPs;
|
||||
publicKey = server.publicKey;
|
||||
endpoint = "${server.ip}:${toString server.port}";
|
||||
persistentKeepalive = 25;
|
||||
})
|
||||
inst.servers;
|
||||
})
|
||||
cfg.instances;
|
||||
|
||||
};
|
||||
}
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue