From eebfe0864f92f5c390ed0e4a6959cb69f7f7f40e Mon Sep 17 00:00:00 2001 From: Gregor Kleen Date: Wed, 29 Sep 2021 21:55:16 +0200 Subject: yggdrasil-wg: init --- modules/yggdrasil-wg/default.nix | 69 ++++++++++++++++++++++++++++++++++ modules/yggdrasil-wg/hosts/surtr.priv | 26 +++++++++++++ modules/yggdrasil-wg/hosts/surtr.pub | 1 + modules/yggdrasil-wg/hosts/vidhar.priv | 26 +++++++++++++ modules/yggdrasil-wg/hosts/vidhar.pub | 1 + shell.nix | 1 + 6 files changed, 124 insertions(+) create mode 100644 modules/yggdrasil-wg/default.nix create mode 100644 modules/yggdrasil-wg/hosts/surtr.priv create mode 100644 modules/yggdrasil-wg/hosts/surtr.pub create mode 100644 modules/yggdrasil-wg/hosts/vidhar.priv create mode 100644 modules/yggdrasil-wg/hosts/vidhar.pub diff --git a/modules/yggdrasil-wg/default.nix b/modules/yggdrasil-wg/default.nix new file mode 100644 index 00000000..08665e33 --- /dev/null +++ b/modules/yggdrasil-wg/default.nix @@ -0,0 +1,69 @@ +{ config, hostName, lib, ... }: + +with lib; + +let + listenPort = 51820; + subnet = "2a03:4000:52:ada:1"; + + links = [ + { from = "vidhar"; + to = "surtr"; + endpointHost = "surtr.yggdrasil.li"; + persistentKeepalive = 25; + dynamicEndpointRefreshSeconds = 86400; + } + ]; + hostIPs = { + surtr = ["${subnet}::/32"]; + vidhar = ["${subnet}:1::/32"]; + }; + + mkPublicKeyPath = host: ./hosts + "/${host}.pub"; + mkPrivateKeyPath = host: ./hosts + "/${host}.priv"; + + publicKeyPath = mkPublicKeyPath hostName; + privateKeyPath = mkPrivateKeyPath hostName; + inNetwork = pathExists privateKeyPath && pathExists publicKeyPath; + hostLinks = filter ({ from, to, ... }: from == hostName || to == hostName) links; + linkToPeer = opts@{from, to, ...}: + let + other = if from == hostName then to else from; + in { + allowedIPs = hostIPs.${other}; + publicKey = trim (readFile (mkPublicKeyPath other)); + } // (optionalAttrs (from == hostName) (filterAttrs (n: _v: !(elem n ["from" "to" "endpointHost"])) opts // optionalAttrs (opts ? "endpointHost") { endpoint = "${opts.endpointHost}:${toString listenPort}"; })); + + trim = str: if hasSuffix "\n" str then trim (removeSuffix "\n" str) else str; + stripSubnet = addr: let matchRes = builtins.match "^(.*)/[0-9]+$" addr; in if matchRes == null then addr else elemAt matchRes 0; +in { + config = { + assertions = [ + { assertion = inNetwork || !(pathExists privateKeyPath || pathExists publicKeyPath); + message = "yggdrasil-wg: Either both public and private keys must exist or neither."; + } + { assertion = !inNetwork || (hostIPs ? "${hostName}"); + message = "yggdrasil-wg: Entry in hostIPs must exist."; + } + ] ++ map ({from, to, ...}: let other = if from == hostName then to else from; in { assertion = pathExists (mkPublicKeyPath other); message = "yggdrasil-wg: This host (${hostName}) has a link with ‘${other}’, but no public key is available for ‘${other}’."; }) hostLinks; + + networking.wireguard.interfaces = mkIf inNetwork { + yggdrasil = { + allowedIPsAsRoutes = true; + inherit listenPort; + ips = hostIPs.${hostName}; + peers = map linkToPeer hostLinks; + privateKeyFile = config.sops.secrets."yggdrasil-wg.priv".path; + }; + }; + + sops.secrets = mkIf (pathExists privateKeyPath) { + "yggdrasil-wg.priv" = { + format = "binary"; + sopsFile = privateKeyPath; + }; + }; + + networking.hosts = mkIf inNetwork (listToAttrs (concatMap ({name, value}: map (ip: nameValuePair (stripSubnet ip) ["${name}.yggdrasil"]) value) (mapAttrsToList nameValuePair hostIPs))); + }; +} diff --git a/modules/yggdrasil-wg/hosts/surtr.priv b/modules/yggdrasil-wg/hosts/surtr.priv new file mode 100644 index 00000000..b5d107f5 --- /dev/null +++ b/modules/yggdrasil-wg/hosts/surtr.priv @@ -0,0 +1,26 @@ +{ + "data": "ENC[AES256_GCM,data:TbEkDgs1y71JYTfmF8wXtPDtkFlhYRnpOPIVQPV+u5Se9D7l5TT6r7CFP/FP,iv:OjktMWZhKYIklsKTdj3cViXcO6LcnGSsDllZatof4hg=,tag:oHoSbCPEcQWkAu7mhSOUiA==,type:str]", + "sops": { + "kms": null, + "gcp_kms": null, + "azure_kv": null, + "hc_vault": null, + "age": null, + "lastmodified": "2021-09-29T19:10:07Z", + "mac": "ENC[AES256_GCM,data:/hFdwXsAxrt3SCU0rbPPeBZ6mBsWcGkN3IMcOP3c28Df452/H0FM67/54NXwSErubnfIY4RXyGfj1dgLBV3A3r43E/F3uN4K8Qt1Ms+dJJdMjKiYpsOuCMgLe27yvI6LtUu0ePPJAPu+me1dOMSdvlQAMwNByrtKmLceMFVJ7gw=,iv:UauO61EBRWvVxYU2vlMI8nqIWw+KO1lEVIc82vVs4ZA=,tag:BzYnM9XcefVd/2T0JcMM2A==,type:str]", + "pgp": [ + { + "created_at": "2021-09-29T19:10:06Z", + "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DXxoViZlp6dISAQdAoHdrbuBJjuTnrUDbeAf7aeb6Kz6HbLuLiHZmSt/rSlow\nfgcSqsdYKMdSFeemRzAw++dBuIeduye31GGNDpsZUYyK9r90x0PJaFL3AABudAsj\n0l4Bm1YyqMDv/gzZeK87QDGpYZPu7+dkSrYO1sRe1qHrdI0L1WUs38l0eQM1qSUR\n4Gv4JBXNipoVTH8cfcGRvAy9y2+deEdzDtNK8rqLaQrc+q2TdV8Qlngp/EZqsQef\n=PM7q\n-----END PGP MESSAGE-----\n", + "fp": "30D3453B8CD02FE2A3E7C78C0FB536FB87AE8F51" + }, + { + "created_at": "2021-09-29T19:10:06Z", + "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DyFKFNkTVG5oSAQdAIQL7kGdUkG3CgEyRFdayydeTJGxjD4epYvaQBl4L0g4w\npKoTQuDf8FD3HeFI6ZO/jaE0BFX9Ifd3TYINK/XtqePOkYteos8aqJ/83t35aCIa\n0l4Bq2wt9BRR1pOQzJxnu8Dn9BsnOAQTp8JpwX5fY/FuPXTP8SV2XwWuHKnRd0j/\np7cSOUrog9agk9pc8tjwR+M451xN5AOpqdbqLkuNhi1b6QuxvI+sGsdh3sMz0UBs\n=5ozm\n-----END PGP MESSAGE-----\n", + "fp": "7ED22F4AA7BB55728B643DC5471B7D88E4EF66F8" + } + ], + "unencrypted_suffix": "_unencrypted", + "version": "3.7.1" + } +} \ No newline at end of file diff --git a/modules/yggdrasil-wg/hosts/surtr.pub b/modules/yggdrasil-wg/hosts/surtr.pub new file mode 100644 index 00000000..abe753eb --- /dev/null +++ b/modules/yggdrasil-wg/hosts/surtr.pub @@ -0,0 +1 @@ +YP/sWEUWw51czlGxvgrgyEZ+ssx/3C9siufgd0a8d3g= diff --git a/modules/yggdrasil-wg/hosts/vidhar.priv b/modules/yggdrasil-wg/hosts/vidhar.priv new file mode 100644 index 00000000..c5b2ea99 --- /dev/null +++ b/modules/yggdrasil-wg/hosts/vidhar.priv @@ -0,0 +1,26 @@ +{ + "data": "ENC[AES256_GCM,data:5RT5TQsBBZY5c4yRpDTYL+M3zLIzYSLST8L31ZmwlQdZs7saXwfehnHo5j0o,iv:/3QrjBfLqQ//ySv9TdTV7jGIzFkR+ZPBi0KJBAkxH+Y=,tag:kwx+Uln6AFBxkv7EE2jFgg==,type:str]", + "sops": { + "kms": null, + "gcp_kms": null, + "azure_kv": null, + "hc_vault": null, + "age": null, + "lastmodified": "2021-09-29T19:10:37Z", + "mac": "ENC[AES256_GCM,data:iglf4GccydO5//TZbw2TWndqeIuZz3G1k7blAW1fNgoxdEDGN16NtsH+/iduQj27BsFhRdPXLO9JWmpeOjwzUMnmkuEOhmALYMZGaZRBzO/x6k5EICFacm6lGUHDm307hexzWtIpNaViuZJiWVlT4IDi5k3N2QaUCYp02AqzPeU=,iv:c5RCIl4zLxrWewc37QIwKIyK5lrBWwSe7Me/yP3UCoU=,tag:LfjGnveOB/lMGhOYk3Ev3A==,type:str]", + "pgp": [ + { + "created_at": "2021-09-29T19:10:37Z", + "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DXxoViZlp6dISAQdA0wHAgvPYDG0FBH2rql1gX37YtzsK1K/AUNSarn71dAQw\nJ6FEldRQ6M+hN41ooX9DSebEtumtiLNQHnvShICw8ULFhrsgyGdUkZAb9eJ9pHnO\n0l4BDS9/MbcTpsZWW+LfFPAZCGsVi1eF5abQKDFDt5RMvxERefIR7jHd6vmjDKgy\nrESOG1nGFsvLnU5/OKJtSmWKDsnMh4ohJ1Agojh4YeVRUnFkM0vdihdZnEAlMz6E\n=DO1o\n-----END PGP MESSAGE-----\n", + "fp": "30D3453B8CD02FE2A3E7C78C0FB536FB87AE8F51" + }, + { + "created_at": "2021-09-29T19:10:37Z", + "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DbYDvGI0HDr0SAQdAJ09HBaaPhDdTOfpzVxuhtzG7s5ZjVrpZWmKKeO23bGYw\n2ctQ4YdNJt5Wv0AhgA0XVZK06rHtBV18utaeXhP7DYZID+wyMUkO7UR4/hhEGmb9\n0l4BzTxnL9liRwH5zB9r7erJYcDOUixtqtriRaoHUM2hDemprMqg+GoBj/Js7V52\nOKCiNGx5uDZ83W6+SFITIExm6I9pvBIcKUNc5aXSov3IWRRik46nU1iqYqYg5n/0\n=2+px\n-----END PGP MESSAGE-----\n", + "fp": "A1C7C95E6CAF0A965CB47277BCF50A89C1B1F362" + } + ], + "unencrypted_suffix": "_unencrypted", + "version": "3.7.1" + } +} \ No newline at end of file diff --git a/modules/yggdrasil-wg/hosts/vidhar.pub b/modules/yggdrasil-wg/hosts/vidhar.pub new file mode 100644 index 00000000..2807df64 --- /dev/null +++ b/modules/yggdrasil-wg/hosts/vidhar.pub @@ -0,0 +1 @@ +IOuHpNQ2ff09HCPKtKY95lDXoRhd8FIBsbB8kaMeUUA= diff --git a/shell.nix b/shell.nix index 2840bec7..af0a0e9e 100644 --- a/shell.nix +++ b/shell.nix @@ -13,5 +13,6 @@ in pkgs.mkShell { nativeBuildInputs = with pkgs; [ nixWithFlakes sops + wireguard ]; } -- cgit v1.2.3