yggdrasil-wg: ...

1 files changed, 28 insertions, 3 deletions

diff --git a/modules/yggdrasil-wg/default.nix b/modules/yggdrasil-wg/default.nix
index e7ecf709..db7780fb 100644
--- a/modules/yggdrasil-wg/default.nix
+++ b/modules/yggdrasil-wg/default.nix
@@ -86,7 +86,28 @@ in {
     systemd.services = listToAttrs (filter ({ value, ...}: value != null) (imap0 (ix: opts@{to, from, ...}: let other = if from == hostName then to else from; in nameValuePair "yggdrasil-udp2raw@${other}" (if opts ? "endpointHost" && (from == hostName || to == hostName) then {
       path = with pkgs; [iptables];
       serviceConfig = {
-        ExecStart = "${pkgs.udp2raw}/bin/udp2raw ${if from == hostName then "-c -l 127.0.0.1:${toString (udp2rawPort + ix)} -r ${opts.endpointHost}:${toString (udp2rawPort + ix)}" else "-s -l 0.0.0.0:${toString (udp2rawPort + ix)} -r 127.0.0.1:${toString listenPort}"} -k tmpkey --auth-mode hmac_sha1 --raw-mode faketcp -a";
+        RuntimeDirectory = ["config"];
+        ExecStartPre = pkgs.writeShellScript "udp2raw-mkconfig-${other}.sh" ''
+          secret=$(cat ${config.sops.secrets."yggdrasil-udp2raw-secret".path})
+          cat >''${RUNTIME_DIRECTORY}/udp2raw.conf <<EOF
+          ${if from == hostName then ''
+            -c
+            -l 127.0.0.1:${toString (udp2rawPort + ix)}
+            -r ${opts.endpointHost}:${toString (udp2rawPort + ix)}
+          '' else ''
+            -s
+            -l 0.0.0.0:${toString (udp2rawPort + ix)}
+            -r 127.0.0.1:${toString listenPort}
+          ''}
+          -k $secret
+          --auth-mode hmac_sha1
+          --raw-mode faketcp
+          -a
+          --retry-on-error
+          EOF
+        '';
+        ExecStart = "${pkgs.udp2raw}/bin/udp2raw --conf-file \${RUNTIME_DIRECTORY}/udp2raw.conf";
+        Restart = "always";
       };
     } else null)) links)) // {
       "wireguard-yggdrasil" = {
@@ -96,11 +117,15 @@ in {
       firewall.path = optionals isRouter [pkgs.procps];
     };
 
-    sops.secrets = mkIf (pathExists privateKeyPath) {
-      "yggdrasil-wg.priv" = {
+    sops.secrets = {
+      "yggdrasil-wg.priv" = mkIf (pathExists privateKeyPath) {
         format = "binary";
         sopsFile = privateKeyPath;
       };
+      "yggdrasil-udp2raw-secret" = mkIf (any (opts@{to, from, ...}: (to == hostName || from == hostName) && opts ? "endpointHost") links) {
+        format = "binary";
+        sopsFile = ./udp2raw-secret;
+      };
     };
 
     networking.hosts = mkIf inNetwork (listToAttrs (concatMap ({name, value}: map (ip: nameValuePair (stripSubnet ip) ["${name}.yggdrasil"]) value) (mapAttrsToList nameValuePair hostIPs)));