you know it's good when you keep rewriting it
Matthew Salerno
1 year ago
parent
e58ea8655e
commit
5a3c11f81f
@ -1,145 +0,0 @@
|
||||
{lib}: wirenix-config:
|
||||
with lib.attrsets;
|
||||
with lib.lists;
|
||||
with lib.trivial;
|
||||
with builtins;
|
||||
let
|
||||
# Math
|
||||
# extract-key :: string -> list -> attrSet
|
||||
# Example:
|
||||
# listOfSetsToSetByKey "primary" [ {primary = "foo"; secondary = 1; tertiary = "one"} {primary = "bar"; secondary = 2; tertiary = "two"} ]
|
||||
# {foo = {secondary = 1; tertiary = "one"}; bar = {secondary = 2; tertiary = "two"};}
|
||||
listOfSetsToSetByKey = key: list:
|
||||
listToAttrs (
|
||||
forEach list (elem: {
|
||||
name = elem."${key}";
|
||||
value = removeAttrs elem [ key ];
|
||||
})
|
||||
);
|
||||
# returns true if `elem` is in `list`
|
||||
inList = elem: list: any (e: e == elem) list;
|
||||
# adds colons to a string every 4 characters for IPv6 shenanigans
|
||||
add-colons = string:
|
||||
if ((stringLength string) > 4)
|
||||
then
|
||||
((substring 0 4 string) + ":" + (add-colons (substring 4 32 string)))
|
||||
else string;
|
||||
|
||||
# Peer Information
|
||||
# Helper functions for querying data about peers from the config
|
||||
peerInfo = {
|
||||
# last 20 (hardcoded atm) characters (80 bits) of the peer's IPv6 address
|
||||
ipSuffix = peerName: substring 0 20 (hashString "sha256" peerName);
|
||||
# list of subnets (as subnet attrset in wirenix config) the peer belongs to
|
||||
subnets = peer: filter (subnet: inList subnet.name peer.subnets) wirenix-config.subnets;
|
||||
# list of groups the peer connects to
|
||||
groupConnections = peer: catAttrs "group" peer.connections;
|
||||
# list of peers the peer connects to
|
||||
directConnections = peer: catAttrs "peer" peer.connections;
|
||||
# list of subnets for which the peer will try to connect to all peer in the subnet
|
||||
subnetConnections = peer: catAttrs "subnet" peer.connections;
|
||||
# gets the peer (as peer attrset in wirenix config) from a name
|
||||
peerFromName = peerName: head (filter (peer: peer.name == peerName) wirenix-config.peers);
|
||||
# gets all peers (as peer attrset in wirenix config) the are in a group
|
||||
peersInGroup = groupName: filter (peer: inList groupName peer.groups) wirenix-config.peers;
|
||||
# returns true if peer is in group
|
||||
peerIsInGroup = peer: groupName: inList peer (peerInfo.peersInGroup groupName);
|
||||
# gets all peers (as peer attrset in wirenix config) that the given peer connects to, may contain the peer itself and duplicates
|
||||
connectionsUnfiltered = peer:
|
||||
(map (peerInfo.peerFromName) (peerInfo.directConnections peer)) ++
|
||||
(concatMap (group: peerInfo.peersInGroup group) (peerInfo.groupConnections peer)) ++
|
||||
(concatMap (subnet: subnetInfo.peersInSubnet subnet) (peerInfo.subnetConnections peer));
|
||||
# gets all peers (as peer attrset in wirenix config) that the given peer connects to, will not contain the peer itself or duplicates
|
||||
connections = peer: remove peer (unique (peerInfo.connectionsUnfiltered peer));
|
||||
# returns the peer's IP when given the peer's name and subnet name
|
||||
ip = subnetName: PeerName: (add-colons ((subnetInfo.prefix subnetName) + (peerInfo.ipSuffix PeerName))) + "/80";
|
||||
# returns the endpoint for peerTo that peerFrom will connect with
|
||||
endpointMatches = peerFrom: peerTo: map (matched: removeAttrs matched [ "match" ]) (
|
||||
filter (endpoint:
|
||||
if endpoint == {} then true else
|
||||
all (id) (
|
||||
mapAttrsToList (type: value:
|
||||
if (type == "group") then
|
||||
(peerInfo.peerIsInGroup peerFrom value)
|
||||
else if (type == "peer") then
|
||||
(peerFrom.name == endpoint.match.peer)
|
||||
else if (type == "subnet") then
|
||||
(peerInfo.peerIsInSubnet peerFrom (subnetInfo.subnetFromName value))
|
||||
else throw "Unexpected type "+type+" in endpoints config."
|
||||
) endpoint
|
||||
)
|
||||
) peerTo.endpoints
|
||||
);
|
||||
endpoint = foldl' (mergeAttrs) {} endpointMatches;
|
||||
};
|
||||
# Subnet Information
|
||||
# Helper functions for querying data about subnets from the config
|
||||
subnetInfo = {
|
||||
# gets all peers (as peer attrset in wirenix config) that belong to the subnet
|
||||
peersInSubnet = subnet: filter (peer: inList subnet.name peer.subnets) wirenix-config.peers;
|
||||
# returns true if peer is in subnet
|
||||
peerIsInSubnet = subnet: peer: inList peer (subnetInfo.peersInSubnet subnet);
|
||||
# gets the subnet (as subnet attrset in wirenix config) from a name
|
||||
subnetFromName = subnetName: head (filter (subnet: subnet.name == subnetName) wirenix-config.subnets);
|
||||
# gets the first 10 characters of the IPV6 address for the subnet name
|
||||
prefix = subnetName: "fd" + (substring 0 10 (hashString "sha256" subnetName));
|
||||
};
|
||||
|
||||
# Mappers take a peer or subnet from the config and convert it
|
||||
# into a recursive attrset that is better suited for nix configs
|
||||
mappers = rec {
|
||||
|
||||
# Maps a wirenix config subnet to a recursive attrset, structure is as follows:
|
||||
# peers: a set of peers (as similar recursive attrsets), keyed by name
|
||||
# ip: the subnet ip in CIDR notation
|
||||
subnetMap = subnet: {
|
||||
name = subnet.name;
|
||||
peers = listOfSetsToSetByKey "name" (map (peerMap) (subnetInfo.peersInSubnet subnet));
|
||||
ip = (add-colons (subnetInfo.prefix subnet.name)) + "::/80";
|
||||
};
|
||||
|
||||
# Maps a wirenix config peer to a recursive attrset, structure is as follows:
|
||||
# subnets: a set of subnets (as similar recursive attrsets), keyed by name, with the following structure:
|
||||
# subnet: the subnet as described in the subnetMap function's description
|
||||
# ip: the peer's ip on the subnet (can only be one IP at the moment)
|
||||
# peers: peers (as recursive attrset) on the subnet that the current peer has connections to, keyed by name, with the following structure:
|
||||
# peer: the peer as described by this description
|
||||
# ip: the connected peers ip on the subnet (same as subnets[subnetName].peers[peerName].subnets[subnetName].ip)
|
||||
# endpoint: the endpoint to connect to, described as follows:
|
||||
# ip: the ip to connect to
|
||||
# port: the port to connect to
|
||||
# persistentKeepalive: (optional) see networking.wireguard.interfaces.<name>.*.persistentKeepalive
|
||||
# dynamicEndpointRefreshSeconds: (optional) see networking.wireguard.interfaces.<name>.*.dynamicEndpointRefreshSeconds
|
||||
# dynamicEndpointRefreshRestartSeconds: (optional) see networking.wireguard.interfaces.<name>.*.dynamicEndpointRefreshRestartSeconds
|
||||
# connections: a set of all peers (as recursive attrset) which the current peer connects to, keyed by name
|
||||
# publicKey: the peer's public key
|
||||
# privateKeyFile: the location of the peer's private key
|
||||
peerMap = peer: {
|
||||
name = peer.name;
|
||||
subnets = listOfSetsToSetByKey "name" (
|
||||
map (subnet: {
|
||||
name = subnet.name;
|
||||
subnet = removeAttrs (subnetMap subnet) [ "name" ];
|
||||
ip = peerInfo.ip subnet.name peer.name;
|
||||
peers = listOfSetsToSetByKey "name" (
|
||||
(map (peerTo: {
|
||||
name = peerTo.name;
|
||||
peer = removeAttrs (peerMap peerTo) [ "name" ];
|
||||
ip = peerInfo.ip subnet.name peerTo.name;
|
||||
endpoint = peerInfo.endpoint peer peerTo;
|
||||
}) (filter (otherPeer: inList subnet.name otherPeer.subnets) (peerInfo.connections peer)))
|
||||
);
|
||||
}) (peerInfo.subnets peer)
|
||||
);
|
||||
connections = listOfSetsToSetByKey "name" (map (peerMap) (peerInfo.connections peer));
|
||||
publicKey = peer.publicKey;
|
||||
privateKeyFile = peer.privateKeyFile;
|
||||
};
|
||||
};
|
||||
in
|
||||
{
|
||||
peerFromName = removeAttrs (mappers.peerMap peerInfo.peerFromName) [ "name" ];
|
||||
subnetFromName = removeAttrs (mappers.subnetMap subnetInfo.subnetFromName) [ "name" ];
|
||||
peers = listOfSetsToSetByKey "name" (map (mappers.peerMap) (wirenix-config.peers));
|
||||
subnets = listOfSetsToSetByKey "name" (map (mappers.subnetMap) (wirenix-config.subnets));
|
||||
}
|
||||
@ -1,7 +0,0 @@
|
||||
{
|
||||
"nodes": {
|
||||
"root": {}
|
||||
},
|
||||
"root": "root",
|
||||
"version": 7
|
||||
}
|
||||
@ -0,0 +1,124 @@
|
||||
{lib, ...}: v1_acl:
|
||||
with lib.attrsets;
|
||||
with lib.lists;
|
||||
with lib.trivial;
|
||||
with (import ../lib.nix);
|
||||
with builtins;
|
||||
let
|
||||
/** parsePeer :: acl_peer -> ic_peer */
|
||||
parsePeer = acl_peer: {
|
||||
subnetConnections = listOfSetsToSetByKey "name" (pipeMap [subnetFromName (getSubnetConnectionAndName acl_peer)] acl_peer.subnets);
|
||||
publicKey = acl_peer.publicKey;
|
||||
privateKeyFile = acl_peer.privateKeyFile;
|
||||
} //
|
||||
(if acl_peer ? extraArgs then {extraArgs = acl_peer.extraArgs;} else {}) //
|
||||
{
|
||||
publicKey = acl_peer.publicKey;
|
||||
privateKeyFile = acl_peer.privateKeyFile;
|
||||
} //
|
||||
(if acl_peer ? groups then {groups = map groupFromName acl_peer.groups;} else {groups = [];});
|
||||
|
||||
/** parseGroup :: acl_group -> ic_group */
|
||||
parseGroup = acl_group: {
|
||||
peers = mapListOfSetsToSetByKey parsePeer (selectPeers [{type="group"; rule="is"; value="${acl_group.name}";}]);
|
||||
} // (if acl_group ? extraArgs then {extraArgs = acl_group.extraArgs;} else {});
|
||||
|
||||
/** parseSubnet :: acl_subnet -> ic_subnet */
|
||||
parseSubnet = acl_subnet: {
|
||||
peers = mapListOfSetsToSetByKey parsePeer (selectPeers [{type="subnet"; rule="is"; value="${acl_subnet.name}";}]);
|
||||
} // (if acl_subnet ? extraArgs then {extraArgs = acl_subnet.extraArgs;} else {});
|
||||
|
||||
/** getSubnetConnection :: acl_peer -> acl_subnet -> (subnetConnection // {name}) */
|
||||
getSubnetConnectionAndName = acl_peer: acl_subnet: {
|
||||
name = acl_subnet.name; # name gets removed shortly after, name is not in the actual subnetConnection object
|
||||
subnet = parseSubnet acl_subnet;
|
||||
ipAddresses = getIpAddresses acl_peer acl_subnet;
|
||||
listenPort = acl_peer.subnets."${acl_subnet.name}".listenPort;
|
||||
peerConnections = getPeerConnections acl_peer acl_subnet;
|
||||
} // (if acl_peer.subnets."${acl_subnet.name}" ? extraArgs then {extraArgs = acl_peer.subnets."${acl_subnet.name}".extraArgs;} else {});
|
||||
|
||||
/** getIpAddresses :: acl_peer -> acl_subnet -> [str] */
|
||||
getIpAddresses = acl_peer: acl_subnet:
|
||||
if (acl_peer.subnets."${acl_subnet.name}" ? ipAddresses) then (
|
||||
if (elem "auto" acl_peer.subnets."${acl_subnet.name}".ipAddresses) then (
|
||||
(remove "auto" acl_peer.subnets."${acl_subnet.name}".ipAddresses) ++ (singleton (generateIPv6Address acl_peer.name acl_subnet.name))
|
||||
) else acl_peer.subnets."${acl_subnet.name}".ipAddresses
|
||||
) else (singleton (generateIPv6Address acl_peer.name acl_subnet.name));
|
||||
|
||||
/** getPeerConnections :: acl_peer -> acl_subnet -> str -> peerConnection */
|
||||
getPeerConnections = acl_peerFrom: acl_subnet:
|
||||
let
|
||||
filterSubnets = connection: elem acl_subnet.name connection.subnets;
|
||||
filterPeer = key: acl_peer: connection: elem acl_peer.name (catAttrs "name" (selectPeers connection."${key}"));
|
||||
getConnectionsX = key: filter (connection: all (x: x connection) [filterSubnets (filterPeer key acl_peerFrom)]) v1_acl.connections;
|
||||
getConnectionsA = getConnectionsX "a";
|
||||
getConnectionsB = getConnectionsX "b";
|
||||
allPeers = unique ((concatMap (connection: selectPeers connection.b) getConnectionsA) ++ (concatMap (connection: selectPeers connection.a) getConnectionsB));
|
||||
allOtherPeers = remove acl_peerFrom allPeers;
|
||||
getExtraArgs = acl_peerTo:
|
||||
let
|
||||
connections = (filter (filterPeer "a" acl_peerTo) getConnectionsB) ++ (filter (filterPeer "b" acl_peerTo) getConnectionsA);
|
||||
extraArgsList = catAttrs "extraArgs" connections;
|
||||
in
|
||||
foldl' mergeAttrs {} extraArgsList;
|
||||
in
|
||||
listOfSetsToSetByKey "name" (map (acl_peerTo:
|
||||
{
|
||||
name = acl_peerTo.name;
|
||||
peer = parsePeer acl_peerTo;
|
||||
ipAddresses = getIpAddresses acl_peerTo acl_subnet;
|
||||
endpoint = getEndpoint acl_peerFrom acl_peerTo;
|
||||
extraArgs = getExtraArgs acl_peerTo;
|
||||
}) allOtherPeers);
|
||||
|
||||
/** getEndpoint :: acl_peer -> acl_peer -> ic_endpoint */
|
||||
getEndpoint = acl_peerFrom: acl_peerTo:
|
||||
let
|
||||
getAllEndpointMatches = filter (endpoint: elem acl_peerFrom.name (catAttrs "name" (selectPeers (if endpoint ? match then endpoint.match else [])))) acl_peerTo.endpoints;
|
||||
in
|
||||
removeAttrs (foldl' mergeAttrs {} getAllEndpointMatches) [ "match" ];
|
||||
|
||||
/** selectPeers :: [acl_filters] -> str -> [acl_peer]
|
||||
* (str -> ic_peer) means it returns an attrset of peers keyed by name, typescript syntax:
|
||||
* selectPeers(acl: acl, acl_filters: acl_filter[]): {[peerName: string]: ic_peer};
|
||||
*/
|
||||
selectPeers = acl_filters:
|
||||
if length acl_filters == 0
|
||||
then
|
||||
v1_acl.peers
|
||||
else
|
||||
foldl' intersectAttrs (selectPeersSingleFilter (head acl_filters)) (map selectPeersSingleFilter acl_filters);
|
||||
|
||||
/** selectPeersSingleFilter :: acl_filter -> [acl_peer] */
|
||||
selectPeersSingleFilter = acl_filter:
|
||||
with acl_filter;
|
||||
let
|
||||
applyRule = comparison: if rule == "is" then comparison else if rule == "not" then !comparison else throw ("Unknown filter rule " + rule);
|
||||
in
|
||||
if type == "peer" then
|
||||
(filter (acl_peer: applyRule (acl_peer.name == value)) v1_acl.peers)
|
||||
else if type == "group" then
|
||||
(filter (acl_peer: applyRule (elem value acl_peer.groups)) v1_acl.peers)
|
||||
else if type == "subnet" then
|
||||
(filter (acl_peer: applyRule (elem value (attrNames acl_peer.subnets))) v1_acl.peers)
|
||||
else throw ("Unknown filter type " + type);
|
||||
|
||||
groupFromName = groupName: findSingle
|
||||
(group: group.name == groupName)
|
||||
(throw "No group " + groupName)
|
||||
(throw "Multiply defined group " + groupName)
|
||||
v1_acl.groups;
|
||||
|
||||
subnetFromName = subnetName: findSingle
|
||||
(subnet: subnet.name == subnetName)
|
||||
(throw "No subnet " + subnetName)
|
||||
(throw "Multiply defined subnet " + subnetName)
|
||||
v1_acl.subnets;
|
||||
|
||||
|
||||
in
|
||||
{
|
||||
peers = mapListOfSetsToSetByKey parsePeer v1_acl.peers;
|
||||
subnets = mapListOfSetsToSetByKey parseSubnet v1_acl.subnets;
|
||||
groups = mapListOfSetsToSetByKey parseGroup v1_acl.groups;
|
||||
}
|
||||
@ -0,0 +1,307 @@
|
||||
WireNix is a Nix Flake designed to make creation of Wireguard mesh networks
|
||||
easier. The simplist and most likely layout is a full mesh network, but Wirenix
|
||||
is able to support arbitrary graph topologies.
|
||||
# Reading the README
|
||||
Due to Nix's typeless nature, I have opted to define all my configurations in
|
||||
psuedo-typescript to make options more legible. I have chosen typescript
|
||||
because it looks somewhat like JSON and is easy to understand. Examples will
|
||||
still be given in Nix EL.
|
||||
|
||||
You can start by reading the `ACL Configuration` section, then reading
|
||||
`Quick Start` section for how to use configure your machines. Other sections
|
||||
exist to provide helpful context and advanced usage, but should not be
|
||||
necessary for a working setup.
|
||||
|
||||
# Glosary
|
||||
## ACL
|
||||
Access Control List:
|
||||
This is your shared configuration for the network.
|
||||
|
||||
## Subnet
|
||||
In Wirenix, the word subnet represents any network of connected peers.
|
||||
In the implementation, subnets are keyed by their `name` property. Subnet names
|
||||
define the initial 32 bits after `fd` in of an the IPv6 addresses peers
|
||||
connecting to the subnet will use. Generally speaking, one subnet = one
|
||||
wireguard interface for each client on the subnet.
|
||||
|
||||
## Peer
|
||||
In Wirenix, peer is any machine with a unique public key In the
|
||||
implementation, peer names define last 80 bits of their IPv6 address.
|
||||
|
||||
## Group
|
||||
In Wirenix, a group is just a tag that peers can have. These are used for
|
||||
matching peers and can contain arbitrary names.
|
||||
|
||||
## Endpoint
|
||||
In wirenix, an endpoint specifies external IP of a peer that other peers should
|
||||
connect to.
|
||||
In the ACL configuration, endpoints can exist on subnets, groups, and peers,
|
||||
but these are just for convenience. Think of adding an endpoint to a subnet or
|
||||
group as being the same as adding the endpoint to all peers in the subnet or
|
||||
group.
|
||||
Endpoints have filters, which can specify for which connecting clients the
|
||||
endpoint will apply to.
|
||||
|
||||
## Filter
|
||||
In Wirenix, a filter is used to select peers by their subnets, groups, and
|
||||
names. A filter is made up of filter rules, specifying multiple rules will
|
||||
yield the intersection of those rules.
|
||||
Note that selecting by peer name will always return a list of 1 or 0 entries,
|
||||
on account of names needing to be unique.
|
||||
|
||||
# ACL Configuration
|
||||
The ACL is a nix attrset designed to be represented in JSON for easy importing
|
||||
and potential use outside of the nix ecosystem.
|
||||
|
||||
## top level acl:
|
||||
```typescript
|
||||
type ACL = {
|
||||
version?: str;
|
||||
subnets: subnet[];
|
||||
groups: group[];
|
||||
peers: peer[];
|
||||
connections: connection[];
|
||||
extraArgs?: any;
|
||||
};
|
||||
```
|
||||
Version is used to check for config compatibility and is recommended. Not
|
||||
specifying version will parse the configuration with the most recent parser
|
||||
available and generate a warning. Using an older configuration version than
|
||||
available will use the parser for that version and generate a warning. Using
|
||||
a version newer than any parsers available will throw an error.
|
||||
|
||||
## subnet:
|
||||
```typescript
|
||||
type subnet = {
|
||||
name: str;
|
||||
endpoints?: endpoint[];
|
||||
extraArgs?: any;
|
||||
};
|
||||
```
|
||||
|
||||
## Group:
|
||||
```typescript
|
||||
type group = {
|
||||
name: str;
|
||||
endpoints?: endpoint[];
|
||||
extraArgs?: any;
|
||||
};
|
||||
```
|
||||
|
||||
## Peer:
|
||||
```typescript
|
||||
type peer = {
|
||||
name: str;
|
||||
subnets: [subnetName: str]: {
|
||||
listenPort: int;
|
||||
ipAddresses?: str[];
|
||||
extraArgs?: any;
|
||||
};
|
||||
groups?: str[];
|
||||
endpoints?: endpoint[];
|
||||
extraArgs?: any;
|
||||
};
|
||||
```
|
||||
|
||||
## Connection:
|
||||
```typescript
|
||||
type connection = {
|
||||
a: filter;
|
||||
b: filter;
|
||||
subnets: str[];
|
||||
extraArgs?: any;
|
||||
};
|
||||
```
|
||||
|
||||
Connections connect all peers matching filter `a` to all peers matching
|
||||
filter `b`, and all peers matching filter `b` to all peers matching filter `a`
|
||||
subnets filters the connection to only be made over the subnets listed. It is
|
||||
recomended to use the subnets property iff the `subnet` filter is also used
|
||||
(the `subnet` filter on its own will connect all shared subnets of machines in
|
||||
`a` and `b`, even subnets not mentioned in the filters if they are shared).
|
||||
|
||||
## Endpoint:
|
||||
```typescript
|
||||
type endpoint = {
|
||||
match?: filter;
|
||||
ip?: str;
|
||||
port?: int;
|
||||
persistentKeepalive?: int;
|
||||
dynamicEndpointRefreshSeconds?: int;
|
||||
dynamicEndpointRefreshRestartSeconds?: int;
|
||||
extraArgs?: any;
|
||||
};
|
||||
```
|
||||
Endpoints are merged in this order: First lists of endpoints are merged top to
|
||||
bottom, with the bottom endpoints overriding the top ones. Then, lists are
|
||||
merged in this order: subnet -> group -> peer; with peer being the highest
|
||||
priority, overriding others. A good layout is to set ports in subnet, ip in
|
||||
peer, and leave group empty. group endpoints can be useful for specifying
|
||||
connection details across port forwarded NATs, however.
|
||||
|
||||
## Filter:
|
||||
```typescript
|
||||
type filter = {
|
||||
type: ["peer" | "group" | "subnet"];
|
||||
rule: [ "is" | "not" ];
|
||||
value: str;
|
||||
}[]; // <==== Important! It's a list
|
||||
```
|
||||
|
||||
## extraArgs
|
||||
`extraArgs` is intentionally left alone. I promise I won't ever set
|
||||
`extraArgs`, but any value in it will be forwarded on to the corresponding
|
||||
section in the intermediate configuration. Because of this, it can be used to
|
||||
pass data into user defined Configuration Modules. Most users can ignore
|
||||
`extraArgs`.
|
||||
|
||||
# Architecture
|
||||
WireNix consists of 4 main components:
|
||||
1. The shared ACL Configuration
|
||||
2. Parser Modules
|
||||
3. The intermediate Configuration
|
||||
4. Configuration Modules
|
||||
The goal of splitting WireNix into modules is both for my own sanity when
|
||||
developing, and to make it hackable without requiring users to make their own
|
||||
fork. Users are able to specify their own Parser Modules, enabling them to use
|
||||
their own preferred ACL syntax if they desire. Users can also specify their own
|
||||
configuration modules, allowing them to add compatibility to for other network
|
||||
stacks or to enable their own modules. Using both custom Parser and
|
||||
Configuration modules enables essentially rewriting this flake however you see
|
||||
fit, all without making a fork (although at that point I may question why you
|
||||
don't write your own module from scratch).
|
||||
|
||||
## ACL
|
||||
The shared ACL configuration should describe the full network topology. It does
|
||||
not need to consist only of NixOS peers (although at the moment, other peers
|
||||
will have to be configured manually to conform to the expected settings). The
|
||||
details of this file are documented in the `Top Level ACL` section.
|
||||
You can make your own ACL configuration format so long as you keep the
|
||||
`version` field and set it to some unique name. You can then register your
|
||||
parser which takes your ACL and produces an intermediate configuration like so:
|
||||
|
||||
TODO
|
||||
|
||||
## Parser Modules
|
||||
Parser Modules are responsible for taking an ACL and converting it to the
|
||||
intermediate configuration format. Parser modules are selected by matching the
|
||||
ACL version field. A parser module must take an ACL and return the
|
||||
corresponding Intermediate Configuration You can register your own parser
|
||||
module like so:
|
||||
|
||||
TODO
|
||||
|
||||
## Intermediate Configuration
|
||||
The Intermediate Configuration is a recursive attrset that is more suited for
|
||||
being used in a NixOS configuration than the ACL Configuration.
|
||||
Unlike the ACL, the intermediate configuration is more verbose, easier to
|
||||
traverse, repeats itself often, and is recursive. This allows cross version
|
||||
compatibility so long as the intermediate configuration doesn't change. Any
|
||||
changes will likely only be the addition of optional features that do not
|
||||
interfere with existing intermediate configuration use, though at this stage
|
||||
there are no guarentees.
|
||||
It can be assumed that all types mentioned are types for the intermediate
|
||||
connection and NOT the related to types in the ACL. The intermediate
|
||||
configuration has the following structure:
|
||||
|
||||
### Root Structure
|
||||
```typescript
|
||||
type intermediateConfiguration = {
|
||||
peers: {[peerName: string]: peer};
|
||||
subnets: {[subnetName: string]: subnet};
|
||||
groups: {[groupName: string]: group};
|
||||
}
|
||||
```
|
||||
|
||||
### Peer
|
||||
```typescript
|
||||
type peer = {
|
||||
subnetConnections: {[subnetName: string]: subnetConnection};
|
||||
groups: {[groupName: string]: group}
|
||||
publicKey: string;
|
||||
privateKeyFile: string;
|
||||
extraArgs?: any;
|
||||
};
|
||||
```
|
||||
|
||||
|
||||
### Subnet
|
||||
```typescript
|
||||
type subnet = {
|
||||
peers: {[peerName: string]: peer};
|
||||
extraArgs?: any;
|
||||
};
|
||||
```
|
||||
|
||||
### Group
|
||||
```typescript
|
||||
type group = {
|
||||
peers: {[peerName: string]: peer};
|
||||
extraArgs?: any;
|
||||
};
|
||||
```
|
||||
|
||||
### Peer Connection
|
||||
```typescript
|
||||
type peerConnection = {
|
||||
peer: peer;
|
||||
ipAddresses: string[];
|
||||
endpoint: endpoint;
|
||||
extraArgs?: any;
|
||||
};
|
||||
```
|
||||
|
||||
### Subnet Connection
|
||||
```typescript
|
||||
type subnetConnection = {
|
||||
subnet: subnet;
|
||||
ipAddresses: string[];
|
||||
listenPort: int;
|
||||
peerConnections: {[peerName: string]: peerConnection};
|
||||
extraArgs?: any;
|
||||
};
|
||||
```
|
||||
|
||||
### Endpoint
|
||||
```typescript
|
||||
type endpoint = {
|
||||
ip: str;
|
||||
port: int;
|
||||
persistentKeepalive?: int;
|
||||
dynamicEndpointRefreshSeconds?: int;
|
||||
dynamicEndpointRefreshRestartSeconds?: int;
|
||||
extraArgs?: any;
|
||||
};
|
||||
```
|
||||
|
||||
Unlike the ACL, this structure is recursive, resembling an arbitrary graph.
|
||||
This graph can be traversed back and forth in circles until you run out of
|
||||
stack space.
|
||||
|
||||
## Configuration Modules
|
||||
Configuration Modules take the Intermediate Configuration and produce NixOS
|
||||
configurations from them. By default, there exist configuration modules for
|
||||
setting up wireguard with the static network configuration, networkd, and
|
||||
Network Manager. There is a fourth, "default" configuration module that
|
||||
intelligently selects which module to use (with priority being networkd >
|
||||
network manager > static configuration). However, you can manually override
|
||||
which module is used (or use your own module) in your flake.nix file:
|
||||
|
||||
TODO
|
||||
|
||||
# Integrations:
|
||||
By default, WireNix supports setting wireguard keypairs with agenix-rekey if
|
||||
the module is detected (via the existence of `config.rekey`). WireNix also
|
||||
supports networkd, network manager, and the nixos static network configuration
|
||||
(in that order of preference).
|
||||
|
||||
# Current Issues / Drawbacks
|
||||
- To keep configuration and the initial POC simpler, assigning IP addresses
|
||||
manually on subnets is not supported (yet).
|
||||
- WireNix does not do NAT traversal, it's up to you to forward the correct
|
||||
ports on your NAT device(s) and apply the correct firewall rules on your
|
||||
router(s).
|
||||
- WireNix does not allow for dynamic addition of peers. If you need something
|
||||
more dynamic, look into Tailscale/Headscale.
|
||||
- Peers cannot have multiple keys. If this is a desirable feature I may think
|
||||
of adding it, but I cannot think of a good reason for it.
|
||||
@ -1,120 +0,0 @@
|
||||
{
|
||||
version = "1";
|
||||
subnets = [
|
||||
{ name = "subnet.one"; defaultPort = 51820; }
|
||||
{ name = "subnet.two"; defaultPort = 51821; }
|
||||
{ name = "subnet.three"; defaultPort = 51822; }
|
||||
];
|
||||
peers = [
|
||||
{
|
||||
name = "peer.zero";
|
||||
endpoints = [
|
||||
{match = {group = "subnet two group";}; ip = "1.1.1.1"; port = 51820;}
|
||||
{match = {peer = "peer.one";}; ip = "2.2.2.2"; port = 51820;}
|
||||
{match = {}; ip = "3.3.3.3"; port = 51820;}
|
||||
];
|
||||
subnets = [
|
||||
|
||||
];
|
||||
groups = [
|
||||
|
||||
];
|
||||
connections = [
|
||||
{ group = "everyoneConnectsToMe"; }
|
||||
];
|
||||
privateKeyFile = "/not/yet";
|
||||
publicKey = "testData";
|
||||
presharedKeyFile = "testData2";
|
||||
}
|
||||
{
|
||||
name = "peer.one";
|
||||
endpoints = [
|
||||
{match = {group = "subnet two group";}; ip = "1.1.1.1"; port = 51820; persistentKeepalive = 15;}
|
||||
{match = {peer = "peer.one";}; ip = "2.2.2.2"; port = 51820;}
|
||||
{match = {}; ip = "3.3.3.3"; port = 51820;}
|
||||
];
|
||||
subnets = [
|
||||
"subnet.one"
|
||||
];
|
||||
groups = [
|
||||
|
||||
];
|
||||
connections = [
|
||||
{ group = "everyoneConnectsToMe"; }
|
||||
{ group = "subnet one group"; }
|
||||
];
|
||||
privateKeyFile = "/not/yet";
|
||||
publicKey = "testData";
|
||||
presharedKeyFile = "testData2";
|
||||
}
|
||||
{
|
||||
name = "peer.two";
|
||||
endpoints = [
|
||||
{match = {group = "subnet two group";}; ip = "1.1.1.1"; port = 51820;}
|
||||
{match = {peer = "peer.one";}; ip = "2.2.2.2"; port = 51820;}
|
||||
{match = {}; ip = "3.3.3.3"; port = 51820;}
|
||||
];
|
||||
subnets = [
|
||||
"subnet.one"
|
||||
"subnet.two"
|
||||
];
|
||||
groups = [
|
||||
"everyoneConnectsToMe"
|
||||
"subnet two group"
|
||||
];
|
||||
connections = [
|
||||
{ group = "everyoneConnectsToMe"; }
|
||||
{ group = "subnet two group"; }
|
||||
];
|
||||
privateKeyFile = "/not/yet";
|
||||
publicKey = "testData";
|
||||
presharedKeyFile = "testData2";
|
||||
}
|
||||
{
|
||||
name = "peer.three";
|
||||
endpoints = [
|
||||
{match = {group = "subnet two group";}; ip = "1.1.1.1"; port = 51820;}
|
||||
{match = {peer = "peer.one";}; ip = "2.2.2.2"; port = 51820;}
|
||||
{match = {}; ip = "3.3.3.3"; port = 51820;}
|
||||
];
|
||||
subnets = [
|
||||
"subnet.one"
|
||||
"subnet.two"
|
||||
"subnet.three"
|
||||
];
|
||||
groups = [
|
||||
"everyoneConnectsToMe"
|
||||
"subnet two group"
|
||||
];
|
||||
connections = [
|
||||
{ group = "everyoneConnectsToMe"; }
|
||||
{ group = "subnet two group"; }
|
||||
];
|
||||
privateKeyFile = "/not/yet";
|
||||
publicKey = "testData";
|
||||
presharedKeyFile = "testData2";
|
||||
}
|
||||
{
|
||||
name = "peer.four";
|
||||
endpoints = [
|
||||
{match = {group = "subnet two group";}; ip = "1.1.1.1"; port = 51820;}
|
||||
{match = {peer = "peer.one";}; ip = "2.2.2.2"; port = 51820;}
|
||||
{match = {}; ip = "3.3.3.3"; port = 51820;}
|
||||
];
|
||||
subnets = [
|
||||
"subnet.three"
|
||||
"subnet.one"
|
||||
];
|
||||
groups = [
|
||||
|
||||
];
|
||||
connections = [
|
||||
{ group = "everyoneConnectsToMe"; }
|
||||
{ peer = "peer.one"; }
|
||||
];
|
||||
privateKeyFile = "/not/yet";
|
||||
publicKey = "testData";
|
||||
presharedKeyFile = "testData2";
|
||||
}
|
||||
];
|
||||
}
|
||||
Loading…
Reference in New Issue