diff options
author | lassulus <git@lassul.us> | 2023-09-07 12:26:31 +0200 |
---|---|---|
committer | lassulus <git@lassul.us> | 2023-09-07 12:40:43 +0200 |
commit | 2e5167de1560ad0d7b8e294c72e1913f694160c2 (patch) | |
tree | b618daa9f125650e9276bae7848f854c48d6c95e /lass/2configs/wiregrill.nix | |
parent | 6a3a423dad19264c0c42821c7676e85ecc122d21 (diff) |
lass: migrate awayriplass
Diffstat (limited to 'lass/2configs/wiregrill.nix')
-rw-r--r-- | lass/2configs/wiregrill.nix | 59 |
1 files changed, 0 insertions, 59 deletions
diff --git a/lass/2configs/wiregrill.nix b/lass/2configs/wiregrill.nix deleted file mode 100644 index 81175c59e..000000000 --- a/lass/2configs/wiregrill.nix +++ /dev/null @@ -1,59 +0,0 @@ -with import <stockholm/lib>; -{ config, pkgs, ... }: let - - self = config.krebs.build.host.nets.wiregrill; - isRouter = !isNull self.via; - -in mkIf (hasAttr "wiregrill" config.krebs.build.host.nets) { - #hack for modprobe inside containers - systemd.services."wireguard-wiregrill".path = mkIf config.boot.isContainer (mkBefore [ - (pkgs.writeDashBin "modprobe" ":") - ]); - - boot.kernel.sysctl = mkIf isRouter { - "net.ipv6.conf.all.forwarding" = 1; - }; - krebs.iptables.tables.filter.INPUT.rules = [ - { predicate = "-p udp --dport ${toString self.wireguard.port}"; target = "ACCEPT"; } - ]; - krebs.iptables.tables.filter.FORWARD.rules = mkIf isRouter (mkBefore [ - { predicate = "-i wiregrill -o wiregrill"; target = "ACCEPT"; } - { predicate = "-i wiregrill -o retiolum"; target = "ACCEPT"; } - { predicate = "-i retiolum -o wiregrill"; target = "ACCEPT"; } - { predicate = "-i wiregrill -o eth0"; target = "ACCEPT"; } - { predicate = "-o wiregrill -m conntrack --ctstate RELATED,ESTABLISHED"; target = "ACCEPT"; } - ]); - systemd.network.networks.wiregrill = { - matchConfig.Name = "wiregrill"; - address = - (optional (!isNull self.ip4) "${self.ip4.addr}/16") ++ - (optional (!isNull self.ip6) "${self.ip6.addr}/48") - ; - networkConfig = { - IgnoreCarrierLoss = "10s"; - }; - }; - - networking.wireguard.interfaces.wiregrill = { - ips = - (optional (!isNull self.ip4 && !config.systemd.network.enable) self.ip4.addr) ++ - (optional (!isNull self.ip6 && !config.systemd.network.enable) self.ip6.addr); - listenPort = 51820; - privateKeyFile = (toString <secrets>) + "/wiregrill.key"; - allowedIPsAsRoutes = true; - peers = mapAttrsToList - (name: host: { - # inherit name; - allowedIPs = if isRouter then - (optional (!isNull host.nets.wiregrill.ip4) host.nets.wiregrill.ip4.addr) ++ - (optional (!isNull host.nets.wiregrill.ip6) host.nets.wiregrill.ip6.addr) - else - host.nets.wiregrill.wireguard.subnets - ; - endpoint = mkIf (!isNull host.nets.wiregrill.via) (host.nets.wiregrill.via.ip4.addr + ":${toString host.nets.wiregrill.wireguard.port}"); - persistentKeepalive = mkIf (!isNull host.nets.wiregrill.via) 61; - publicKey = (replaceStrings ["\n"] [""] host.nets.wiregrill.wireguard.pubkey); - }) - (filterAttrs (_: h: hasAttr "wiregrill" h.nets) config.krebs.hosts); - }; -} |