6 files changed, 124 insertions, 0 deletions

diff --git a/modules/yggdrasil-wg/default.nix b/modules/yggdrasil-wg/default.nix
new file mode 100644
index 00000000..08665e33
--- /dev/null
+++ b/modules/yggdrasil-wg/default.nix
@@ -0,0 +1,69 @@
+{ config, hostName, lib, ... }:
+
+with lib;
+
+let
+  listenPort = 51820;
+  subnet = "2a03:4000:52:ada:1";
+
+  links = [
+    { from = "vidhar";
+      to = "surtr";
+      endpointHost = "surtr.yggdrasil.li";
+      persistentKeepalive = 25;
+      dynamicEndpointRefreshSeconds = 86400;
+    }
+  ];
+  hostIPs = {
+    surtr = ["${subnet}::/32"];
+    vidhar = ["${subnet}:1::/32"];
+  };
+
+  mkPublicKeyPath = host: ./hosts + "/${host}.pub";
+  mkPrivateKeyPath = host: ./hosts + "/${host}.priv";
+  
+  publicKeyPath = mkPublicKeyPath hostName;
+  privateKeyPath = mkPrivateKeyPath hostName;
+  inNetwork = pathExists privateKeyPath && pathExists publicKeyPath;
+  hostLinks = filter ({ from, to, ... }: from == hostName || to == hostName) links;
+  linkToPeer = opts@{from, to, ...}:
+    let
+      other = if from == hostName then to else from;
+    in {
+      allowedIPs = hostIPs.${other};
+      publicKey = trim (readFile (mkPublicKeyPath other));
+    } // (optionalAttrs (from == hostName) (filterAttrs (n: _v: !(elem n ["from" "to" "endpointHost"])) opts // optionalAttrs (opts ? "endpointHost") { endpoint = "${opts.endpointHost}:${toString listenPort}"; }));
+
+  trim = str: if hasSuffix "\n" str then trim (removeSuffix "\n" str) else str;
+  stripSubnet = addr: let matchRes = builtins.match "^(.*)/[0-9]+$" addr; in if matchRes == null then addr else elemAt matchRes 0;
+in {
+  config = {
+    assertions = [
+      { assertion = inNetwork || !(pathExists privateKeyPath || pathExists publicKeyPath);
+        message = "yggdrasil-wg: Either both public and private keys must exist or neither.";
+      }
+      { assertion = !inNetwork || (hostIPs ? "${hostName}");
+        message = "yggdrasil-wg: Entry in hostIPs must exist.";
+      }
+    ] ++ map ({from, to, ...}: let other = if from == hostName then to else from; in { assertion = pathExists (mkPublicKeyPath other); message = "yggdrasil-wg: This host (${hostName}) has a link with ‘${other}’, but no public key is available for ‘${other}’."; }) hostLinks;
+
+    networking.wireguard.interfaces = mkIf inNetwork {
+      yggdrasil = {
+        allowedIPsAsRoutes = true;
+        inherit listenPort;
+        ips = hostIPs.${hostName};
+        peers = map linkToPeer hostLinks;
+        privateKeyFile = config.sops.secrets."yggdrasil-wg.priv".path;
+      };
+    };
+
+    sops.secrets = mkIf (pathExists privateKeyPath) {
+      "yggdrasil-wg.priv" = {
+        format = "binary";
+        sopsFile = privateKeyPath;
+      };
+    };
+
+    networking.hosts = mkIf inNetwork (listToAttrs (concatMap ({name, value}: map (ip: nameValuePair (stripSubnet ip) ["${name}.yggdrasil"]) value) (mapAttrsToList nameValuePair hostIPs)));
+  };
+}
diff --git a/modules/yggdrasil-wg/hosts/surtr.priv b/modules/yggdrasil-wg/hosts/surtr.priv
new file mode 100644
index 00000000..b5d107f5
--- /dev/null
+++ b/modules/yggdrasil-wg/hosts/surtr.priv
@@ -0,0 +1,26 @@
+{
+        "data": "ENC[AES256_GCM,data:TbEkDgs1y71JYTfmF8wXtPDtkFlhYRnpOPIVQPV+u5Se9D7l5TT6r7CFP/FP,iv:OjktMWZhKYIklsKTdj3cViXcO6LcnGSsDllZatof4hg=,tag:oHoSbCPEcQWkAu7mhSOUiA==,type:str]",
+        "sops": {
+                "kms": null,
+                "gcp_kms": null,
+                "azure_kv": null,
+                "hc_vault": null,
+                "age": null,
+                "lastmodified": "2021-09-29T19:10:07Z",
+                "mac": "ENC[AES256_GCM,data:/hFdwXsAxrt3SCU0rbPPeBZ6mBsWcGkN3IMcOP3c28Df452/H0FM67/54NXwSErubnfIY4RXyGfj1dgLBV3A3r43E/F3uN4K8Qt1Ms+dJJdMjKiYpsOuCMgLe27yvI6LtUu0ePPJAPu+me1dOMSdvlQAMwNByrtKmLceMFVJ7gw=,iv:UauO61EBRWvVxYU2vlMI8nqIWw+KO1lEVIc82vVs4ZA=,tag:BzYnM9XcefVd/2T0JcMM2A==,type:str]",
+                "pgp": [
+                        {
+                                "created_at": "2021-09-29T19:10:06Z",
+                                "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DXxoViZlp6dISAQdAoHdrbuBJjuTnrUDbeAf7aeb6Kz6HbLuLiHZmSt/rSlow\nfgcSqsdYKMdSFeemRzAw++dBuIeduye31GGNDpsZUYyK9r90x0PJaFL3AABudAsj\n0l4Bm1YyqMDv/gzZeK87QDGpYZPu7+dkSrYO1sRe1qHrdI0L1WUs38l0eQM1qSUR\n4Gv4JBXNipoVTH8cfcGRvAy9y2+deEdzDtNK8rqLaQrc+q2TdV8Qlngp/EZqsQef\n=PM7q\n-----END PGP MESSAGE-----\n",
+                                "fp": "30D3453B8CD02FE2A3E7C78C0FB536FB87AE8F51"
+                        },
+                        {
+                                "created_at": "2021-09-29T19:10:06Z",
+                                "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DyFKFNkTVG5oSAQdAIQL7kGdUkG3CgEyRFdayydeTJGxjD4epYvaQBl4L0g4w\npKoTQuDf8FD3HeFI6ZO/jaE0BFX9Ifd3TYINK/XtqePOkYteos8aqJ/83t35aCIa\n0l4Bq2wt9BRR1pOQzJxnu8Dn9BsnOAQTp8JpwX5fY/FuPXTP8SV2XwWuHKnRd0j/\np7cSOUrog9agk9pc8tjwR+M451xN5AOpqdbqLkuNhi1b6QuxvI+sGsdh3sMz0UBs\n=5ozm\n-----END PGP MESSAGE-----\n",
+                                "fp": "7ED22F4AA7BB55728B643DC5471B7D88E4EF66F8"
+                        }
+                ],
+                "unencrypted_suffix": "_unencrypted",
+                "version": "3.7.1"
+        }
+}
\ No newline at end of file
diff --git a/modules/yggdrasil-wg/hosts/surtr.pub b/modules/yggdrasil-wg/hosts/surtr.pub
new file mode 100644
index 00000000..abe753eb
--- /dev/null
+++ b/modules/yggdrasil-wg/hosts/surtr.pub
@@ -0,0 +1 @@
+YP/sWEUWw51czlGxvgrgyEZ+ssx/3C9siufgd0a8d3g=
diff --git a/modules/yggdrasil-wg/hosts/vidhar.priv b/modules/yggdrasil-wg/hosts/vidhar.priv
new file mode 100644
index 00000000..c5b2ea99
--- /dev/null
+++ b/modules/yggdrasil-wg/hosts/vidhar.priv
@@ -0,0 +1,26 @@
+{
+        "data": "ENC[AES256_GCM,data:5RT5TQsBBZY5c4yRpDTYL+M3zLIzYSLST8L31ZmwlQdZs7saXwfehnHo5j0o,iv:/3QrjBfLqQ//ySv9TdTV7jGIzFkR+ZPBi0KJBAkxH+Y=,tag:kwx+Uln6AFBxkv7EE2jFgg==,type:str]",
+        "sops": {
+                "kms": null,
+                "gcp_kms": null,
+                "azure_kv": null,
+                "hc_vault": null,
+                "age": null,
+                "lastmodified": "2021-09-29T19:10:37Z",
+                "mac": "ENC[AES256_GCM,data:iglf4GccydO5//TZbw2TWndqeIuZz3G1k7blAW1fNgoxdEDGN16NtsH+/iduQj27BsFhRdPXLO9JWmpeOjwzUMnmkuEOhmALYMZGaZRBzO/x6k5EICFacm6lGUHDm307hexzWtIpNaViuZJiWVlT4IDi5k3N2QaUCYp02AqzPeU=,iv:c5RCIl4zLxrWewc37QIwKIyK5lrBWwSe7Me/yP3UCoU=,tag:LfjGnveOB/lMGhOYk3Ev3A==,type:str]",
+                "pgp": [
+                        {
+                                "created_at": "2021-09-29T19:10:37Z",
+                                "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DXxoViZlp6dISAQdA0wHAgvPYDG0FBH2rql1gX37YtzsK1K/AUNSarn71dAQw\nJ6FEldRQ6M+hN41ooX9DSebEtumtiLNQHnvShICw8ULFhrsgyGdUkZAb9eJ9pHnO\n0l4BDS9/MbcTpsZWW+LfFPAZCGsVi1eF5abQKDFDt5RMvxERefIR7jHd6vmjDKgy\nrESOG1nGFsvLnU5/OKJtSmWKDsnMh4ohJ1Agojh4YeVRUnFkM0vdihdZnEAlMz6E\n=DO1o\n-----END PGP MESSAGE-----\n",
+                                "fp": "30D3453B8CD02FE2A3E7C78C0FB536FB87AE8F51"
+                        },
+                        {
+                                "created_at": "2021-09-29T19:10:37Z",
+                                "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DbYDvGI0HDr0SAQdAJ09HBaaPhDdTOfpzVxuhtzG7s5ZjVrpZWmKKeO23bGYw\n2ctQ4YdNJt5Wv0AhgA0XVZK06rHtBV18utaeXhP7DYZID+wyMUkO7UR4/hhEGmb9\n0l4BzTxnL9liRwH5zB9r7erJYcDOUixtqtriRaoHUM2hDemprMqg+GoBj/Js7V52\nOKCiNGx5uDZ83W6+SFITIExm6I9pvBIcKUNc5aXSov3IWRRik46nU1iqYqYg5n/0\n=2+px\n-----END PGP MESSAGE-----\n",
+                                "fp": "A1C7C95E6CAF0A965CB47277BCF50A89C1B1F362"
+                        }
+                ],
+                "unencrypted_suffix": "_unencrypted",
+                "version": "3.7.1"
+        }
+}
\ No newline at end of file
diff --git a/modules/yggdrasil-wg/hosts/vidhar.pub b/modules/yggdrasil-wg/hosts/vidhar.pub
new file mode 100644
index 00000000..2807df64
--- /dev/null
+++ b/modules/yggdrasil-wg/hosts/vidhar.pub
@@ -0,0 +1 @@
+IOuHpNQ2ff09HCPKtKY95lDXoRhd8FIBsbB8kaMeUUA=
diff --git a/shell.nix b/shell.nix
index 2840bec7..af0a0e9e 100644
--- a/shell.nix
+++ b/shell.nix
@@ -13,5 +13,6 @@ in pkgs.mkShell {
   nativeBuildInputs = with pkgs; [
     nixWithFlakes
     sops
+    wireguard
   ];
 }