Key providers and other changes I forgot (sorry git historians)
parent
ca4c6e0393
commit
e3c89e816f
@ -0,0 +1,36 @@
|
||||
{ config, lib, ... }@inputs:
|
||||
with lib;
|
||||
with import ./lib.nix;
|
||||
{
|
||||
options = {
|
||||
wirenix = {
|
||||
enable = mkOption {
|
||||
default = true;
|
||||
type = with lib.types; bool;
|
||||
description = ''
|
||||
Wirenix
|
||||
'';
|
||||
};
|
||||
secretsDir = mkOption {
|
||||
type = types.path;
|
||||
description = mdDoc ''
|
||||
where you want the wireguard secrets stored.
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
config =
|
||||
let
|
||||
configurers = defaultConfigurers // config.modules.wirenix.additionalConfigurers;
|
||||
parsers = defaultParsers // config.modules.wirenix.additionalParsers;
|
||||
acl = config.modules.wirenix.aclConfig;
|
||||
parser = parsers."${acl.version}" inputs;
|
||||
configurer = configurers."${config.modules.wirenix.configurer}" inputs;
|
||||
nixosConfigForPeer = peerName: builtins.head (builtins.attrValues (
|
||||
lib.attrsets.filterAttrs (
|
||||
name: value: (lib.attrsets.attrByPath ["config" "modules" "wirenix" "peerName"] null value) == peerName
|
||||
) nixosConfigurations));
|
||||
in
|
||||
lib.mkIf (config.modules.wirenix.enable)
|
||||
configurer (parser acl) config.modules.wirenix.peerName;
|
||||
}
|
@ -0,0 +1,10 @@
|
||||
{lib, ...}: intermediateConfig:
|
||||
with import ../lib.nix;
|
||||
with lib.attrsets;
|
||||
with builtins;
|
||||
{
|
||||
config = {};
|
||||
getPeerPubKey = peerName: attrByPath [peerName "publicKey"] null intermediateConfig.peers;
|
||||
getPeerPrivKeyFile = peerName: attrByPath [peerName "privateKeyFile"] null intermediateConfig.peers;
|
||||
getSubnetPSK = subnetName: attrByPath [subnetName "presharedKeyFile"] null intermediateConfig.subnets;
|
||||
}
|
@ -0,0 +1,33 @@
|
||||
{config, nixosConfigurations, lib, ...}: intermediateConfig: peerName:
|
||||
with (import ../lib.nix);
|
||||
with lib.attrsets;
|
||||
with builtins;
|
||||
let secretsDir = peerName: (nixosConfigForPeer nixosConfigurations peerName).config.modules.wirenix.secrestsDir; in
|
||||
{
|
||||
config = {
|
||||
age.generators.wireguard-priv = {pkgs, file, ...}: ''
|
||||
priv=$(${pkgs.wireguard-tools}/bin/wg genkey)
|
||||
${pkgs.wireguard-tools}/bin/wg pubkey <<< "$priv" > ${lib.escapeShellArg (lib.removeSuffix ".age" file + ".pub")}
|
||||
echo "$priv"
|
||||
'';
|
||||
age.generators.wireguard-psk = {pkgs, file, ...}: ''
|
||||
psk=$(${pkgs.wireguard-tools}/bin/wg genpsk)
|
||||
echo "$psk"
|
||||
'';
|
||||
age.secrets = {
|
||||
age.secrets = {
|
||||
"wirenix-peer-${peerName}" = {
|
||||
rekeyFile = config.modules.wirenix.secretsDir + /wirenix- + peerName + ".age";
|
||||
generator.script = "wireguard-priv";
|
||||
};
|
||||
} // mapAttrs' (name: value: nameValuePair ("wirenix-subnet-${name}") {
|
||||
rekeyFile = config.modules.wirenix.subnetSecretsDir + /wirenix-subnet- + name + ".age";
|
||||
generator.script = "wireguard-psk";
|
||||
}) intermediateConfig.peers."${peerName}".subnetConnections;
|
||||
|
||||
};
|
||||
getPeerPubKey = otherPeerName: lib.removeSuffix ".age" ((secretsDir otherPeerName).config.secrets."wirenix-peer-${peerName}".path) + ".pub";
|
||||
getPrivKeyFile = config.age.secrets."wirenix-peer-${peerName}".path;
|
||||
getPubKey = lib.removeSuffix ".age" (config.age.secrets."wirenix-peer-${peerName}".path) + ".pub";
|
||||
getSubnetPSKFile = subnetName: config.age.secrets."wirenix-subnet-${subnetName}".path;
|
||||
}
|
Loading…
Reference in New Issue