yggdrasil-wg: dual stack

1 files changed, 96 insertions, 77 deletions

diff --git a/modules/yggdrasil-wg/default.nix b/modules/yggdrasil-wg/default.nix
index cef1ce4e..55064baa 100644
--- a/modules/yggdrasil-wg/default.nix
+++ b/modules/yggdrasil-wg/default.nix
@@ -4,10 +4,13 @@ with lib;
 
 let
   listenPort = 51820;
-  wgSubnet = "2a03:4000:52:ada:1";
+  wgSubnet = {
+    "4" = "2a03:4000:52:ada:2";
+    "6" = "2a03:4000:52:ada:3";
+  };
   wgSubnetLength = 80;
   wgHostLength = wgSubnetLength + 16;
-  batSubnet = "2a03:4000:52:ada:2";
+  batSubnet = "2a03:4000:52:ada:1";
   batSubnetLength = 80;
   batHostLength = batSubnetLength + 16;
 
@@ -16,27 +19,49 @@ let
       to = "surtr";
       endpointHost = "202.61.241.61";
       PersistentKeepalive = 25;
+      family = "4";
+    }
+    { from = "vidhar";
+      to = "surtr";
+      endpointHost = "2a03:4000:52:ada::";
+      PersistentKeepalive = 25;
+      family = "6";
+    }
+    { from = "sif";
+      to = "surtr";
+      endpointHost = "202.61.241.61";
+      PersistentKeepalive = 25;
+      family = "4";
     }
     { from = "sif";
       to = "surtr";
       endpointHost = "2a03:4000:52:ada::";
       PersistentKeepalive = 25;
+      family = "6";
     }
     { from = "sif";
       to = "vidhar";
       endpointHost = "192.168.2.168";
       PersistentKeepalive = 25;
+      family = "4";
     }
   ];
-  wgHostIPs = {
+  wgHostIPs = mapAttrs (_family: wgSubnet: {
     surtr = "${wgSubnet}::/${toString wgHostLength}";
     vidhar = "${wgSubnet}:1::/${toString wgHostLength}";
     sif = "${wgSubnet}:2::/${toString wgHostLength}";
-  };
+  }) wgSubnet;
   greHostMACPrefixes = {
-    surtr = "02:00:01:00:00";
-    vidhar = "02:00:01:00:01";
-    sif = "02:00:01:00:02";
+    "4" = {
+      surtr = "02:00:01:00:00";
+      vidhar = "02:00:01:00:01";
+      sif = "02:00:01:00:02";
+    };
+    "6" = {
+      surtr = "02:00:02:00:00";
+      vidhar = "02:00:02:00:01";
+      sif = "02:00:02:00:02";
+    };
   };
   batHostMACs = {
     surtr = "02:00:00:00:00:00";
@@ -49,46 +74,47 @@ let
     sif = ["${batSubnet}:2::/${toString batHostLength}"];
   };
 
-  mkPublicKeyPath = host: ./hosts + "/${host}.pub";
-  mkPrivateKeyPath = host: ./hosts + "/${host}.priv";
+  mkPublicKeyPath = family: host: ./hosts + "/${family}" + "/${host}.pub";
+  mkPrivateKeyPath = family: host: ./hosts + "/${family}" + "/${host}.priv";
 
   kernel = config.boot.kernelPackages;
   
-  publicKeyPath = mkPublicKeyPath hostName;
-  privateKeyPath = mkPrivateKeyPath hostName;
-  inNetwork = pathExists privateKeyPath && pathExists publicKeyPath;
-  hostLinks = filter ({ from, to, ... }: thisHost from || thisHost to) links;
-  linkToPeer = opts@{from, to, ...}:
+  publicKeyPath = family: mkPublicKeyPath family hostName;
+  privateKeyPath = family: mkPrivateKeyPath family hostName;
+  inNetwork' = family: pathExists (privateKeyPath family) && pathExists (publicKeyPath family);
+  inNetwork = any inNetwork' families;
+  hostLinks = filterAttrs (_family: links: links != []) (mapAttrs (_family: filter ({ from, to, ... }: thisHost from || thisHost to)) links);
+  linkToPeer = family: opts@{from, to, ...}:
     let
       other = if thisHost from then to else from;
     in {
-      AllowedIPs = wgHostIPs.${other};
-      PublicKey = trim (readFile (mkPublicKeyPath other));
+      AllowedIPs = wgHostIPs.${family}.${other};
+      PublicKey = trim (readFile (mkPublicKeyPath family other));
     } // (optionalAttrs (thisHost from) (linkCfgFilterCustom opts // linkMkEndpointCfg opts));
   linkCfgFilterCustom = filterAttrs (n: _v: !(elem n ["from" "to" "endpointHost"]));
   linkMkEndpointCfg = opts@{from, ...}: optionalAttrs (opts ? "endpointHost" && thisHost from) { Endpoint = "${opts.endpointHost}:${toString listenPort}"; };
-  linkToGreDev = opts@{from, to, ...}:
+  linkToGreDev = family: opts@{from, to, ...}:
     let
       other = if thisHost from then to else from;
-    in nameValuePair "yggre-${other}" {
+    in nameValuePair "yggre-${other}-${family}" {
       netdevConfig = {
-        Name = "yggre-${other}";
+        Name = "yggre-${other}-${family}";
         Kind = "ip6gretap";
       };
       tunnelConfig = {
-        Local = stripSubnet wgHostIPs.${hostName};
-        Remote = stripSubnet wgHostIPs.${other};
+        Local = stripSubnet wgHostIPs.${family}.${hostName};
+        Remote = stripSubnet wgHostIPs.${family}.${other};
       };
     };
-  linkToGreNetwork = ix: opts@{from, to, ...}:
+  linkToGreNetwork = family: ix: opts@{from, to, ...}:
     let
       other = if thisHost from then to else from;
     in nameValuePair "yggre-${other}" {
       matchConfig = {
-        Name = "yggre-${other}";
+        Name = "yggre-${other}-${family}";
       };
       linkConfig = {
-        MACAddress = "${greHostMACPrefixes.${hostName}}:${toHexByte ix}";
+        MACAddress = "${greHostMACPrefixes.${family}.${hostName}}:${toHexByte ix}";
         RequiredForOnline = false;
       };
       networkConfig = {
@@ -96,71 +122,72 @@ let
         LinkLocalAddressing = "no";
       };
     };
-  
-  thisHost = host: builtins.match "^(ipv(4|6)\.)?${hostName}$" host != null;
+  familyToYggdrasilDev = family: nameValuePair "yggdrasil-wg-${family}" {
+    netdevConfig = {
+      Name = "yggdrasil-wg-${family}";
+      Kind = "wireguard";
+    };
+    wireguardConfig = {
+      PrivateKeyFile = config.sops.secrets."yggdrasil-wg-${family}.priv".path;
+      ListenPort = listenPort;
+    };
+    wireguardPeers = map (opts@{to, from, ...}: { wireguardPeerConfig = linkToPeer family opts; }) hostLinks.${family};
+  };
+  familyToYggdrasilNetwork = family: nameValuePair "yggdrasil-wg-${family}" {
+    name = "yggdrasil-wg-${family}";
+    matchConfig = {
+      Name = "yggdrasil-wg-${family}";
+    };
+    address = [wgHostIPs.${family}.${hostName}];
+    routes = [
+      { routeConfig = {
+          Destination = "${wgSubnet.${family}}::/${toString wgSubnetLength}";
+        };
+      }
+    ];
+    linkConfig = {
+      RequiredForOnline = false;
+    };
+    networkConfig = {
+      Tunnel = map (opts@{from, to, ...}: let other = if thisHost from then to else from; in "yggre-${other}-${family}") hostLinks.${family};
+    };
+  };
+  familyToSopsSecret = family: nameValuePair "yggdrasil-wg-${family}.priv" (mkIf (pathExists (privateKeyPath family)) {
+    format = "binary";
+    sopsFile = privateKeyPath family;
+    mode = "0640";
+    owner = "root";
+    group = "systemd-network";
+  });
+
+  thisHost = host: host == hostName;
   trim = str: if hasSuffix "\n" str then trim (removeSuffix "\n" str) else str;
   stripSubnet = addr: let matchRes = builtins.match "^(.*)/[0-9]+$" addr; in if matchRes == null then addr else elemAt matchRes 0;
   optIx = optName: xs: let
     withOpts = listToAttrs (imap0 (ix: x: nameValuePair x.name (x.value // { ${optName} = ix; })) (filter (x: x.value.${optName} or false) (imap0 (ix: nameValuePair (toString ix)) xs)));
     withoutOpts = listToAttrs (map (nv: nameValuePair nv.name (removeAttrs nv.value [optName])) (filter (x: !(x.value.${optName} or false)) (imap0 (ix: nameValuePair (toString ix)) xs)));
   in genList (ix: withOpts.${toString ix} or withoutOpts.${toString ix}) (length xs);
-  mkLinks = id;
+  groupFamilies = links: mapAttrs (_name: value: map (filterAttrs (k: _v: k != "family")) value) (groupBy (x: x.family) links);
+  mkLinks = groupFamilies;
+  families = attrNames links;
+  hostFamilies = attrNames hostLinks;
   toHexByte = n: let
     hex = toHexString n;
   in if (stringLength hex < 2) then "0${hex}" else hex;
 in {
   config = {
-    assertions = [
-      { assertion = inNetwork || !(pathExists privateKeyPath || pathExists publicKeyPath);
-        message = "yggdrasil-wg: Either both public and private keys must exist or neither.";
-      }
-      { assertion = !inNetwork || (wgHostIPs ? "${hostName}");
-        message = "yggdrasil-wg: Entry in wgHostIPs must exist.";
-      }
-    ] ++ map ({from, to, ...}: let other = if thisHost from then to else from; in { assertion = pathExists (mkPublicKeyPath other); message = "yggdrasil-wg: This host (${hostName}) has a link with ‘${other}’, but no public key is available for ‘${other}’."; }) hostLinks;
-
     systemd.network = mkIf inNetwork {
       enable = true;
       netdevs = {
-        yggdrasil-wg = {
-          netdevConfig = {
-            Name = "yggdrasil-wg";
-            Kind = "wireguard";
-          };
-          wireguardConfig = {
-            PrivateKeyFile = config.sops.secrets."yggdrasil-wg.priv".path;
-            ListenPort = listenPort;
-          };
-          wireguardPeers = map (opts@{to, from, ...}: { wireguardPeerConfig = linkToPeer opts; }) hostLinks;
-        };
         yggdrasil = {
           netdevConfig = {
             Name = "yggdrasil";
             Kind = "batadv";
           };
         };
-      } // listToAttrs (map linkToGreDev hostLinks);
+      } // listToAttrs (map familyToYggdrasilDev hostFamilies) // listToAttrs (concatMap (family: map (linkToGreDev family) hostLinks.${family}) hostFamilies);
 
       networks = {
-        yggdrasil-wg = {
-          name = "yggdrasil-wg";
-          matchConfig = {
-            Name = "yggdrasil-wg";
-          };
-          address = [wgHostIPs.${hostName}];
-          routes = [
-            { routeConfig = {
-                Destination = "${wgSubnet}::/${toString wgSubnetLength}";
-              };
-            }
-          ];
-          linkConfig = {
-            RequiredForOnline = false;
-          };
-          networkConfig = {
-            Tunnel = map (opts@{from, to, ...}: let other = if thisHost from then to else from; in "yggre-${other}") hostLinks;
-          };
-        };
         yggdrasil = {
           name = "yggdrasil";
           matchConfig = {
@@ -178,18 +205,10 @@ in {
             RequiredForOnline = false;
           };
         };
-      } // listToAttrs (imap0 linkToGreNetwork hostLinks);
+      } // listToAttrs (map familyToYggdrasilNetwork hostFamilies) // listToAttrs (concatMap (family: imap0 (linkToGreNetwork family) hostLinks.${family}) hostFamilies);
     };
 
-    sops.secrets = {
-      "yggdrasil-wg.priv" = mkIf (pathExists privateKeyPath) {
-        format = "binary";
-        sopsFile = privateKeyPath;
-        mode = "0640";
-        owner = "root";
-        group = "systemd-network";
-      };
-    };
+    sops.secrets = listToAttrs (map familyToSopsSecret hostFamilies);
 
     networking.hosts = mkIf inNetwork (listToAttrs (concatMap ({name, value}: map (ip: nameValuePair (stripSubnet ip) ["${name}.yggdrasil"]) value) (mapAttrsToList nameValuePair batHostIPs)));