Made helper functions to remap data in more config-friendly ways

flake.lock

@@ -0,0 +1,7 @@
+{
+  "nodes": {
+    "root": {}
+  },
+  "root": "root",
+  "version": 7
+}

flake.nix

@@ -0,0 +1,8 @@
+{
+  description = "Do we have agnenix-rekey?";
+
+  outputs = { self, ... }:
+  {
+      nixosModules.myModule = import ./wire.nix;
+  };
+}

peer-config-generator.nix

@@ -0,0 +1,9 @@
+
+{config, lib, ...}: 
+let
+  has-rekey = config ? rekey;
+  infoRemapper = import ./peer-info-remapper.nix {inherit lib;} config.modules.wirenix.config;
+in
+{
+  
+}

peer-info-remapper.nix

@@ -0,0 +1,61 @@
+{lib}: wirenix-config:
+let 
+  # Math
+  inList = elem: list: builtins.any (e: e == elem) list;  
+  # IP
+  add-colons = string: 
+    if ((builtins.stringLength string) > 4) 
+    then 
+      ((builtins.substring 0 4 string) + ":" + (add-colons (builtins.substring 4 32 string)))
+    else string;
+  
+  # Peer Information
+  peerInfo = {
+    peerSuffix = peerName: builtins.substring 0 20 (builtins.hashString "sha256" peerName);
+    peerSubnets = peer: builtins.filter (subnet: inList subnet.name peer.subnets) wirenix-config.subnets;
+    peerGroups = peer: builtins.catAttrs "group" peer.peers;
+    directPeers = peer: builtins.catAttrs "peer" peer.peers;
+    peerFromName = peerName: builtins.head (builtins.filter (peer: peer.name == peerName) wirenix-config.peers);
+    peersInGroup = groupName: builtins.filter (peer: inList groupName peer.groups) wirenix-config.peers;
+    peerPeersUnfiltered = peer: (builtins.map (peerInfo.peerFromName) (peerInfo.directPeers peer)) ++ (builtins.concatMap (group: peerInfo.peersInGroup group) (peerInfo.peerGroups peer));
+    peerIP = subnetName: PeerName: (add-colons ((subnetInfo.subnetPrefix subnetName) + (peerInfo.peerSuffix PeerName))) + "/80";  
+    };
+  # Subnet Information
+  subnetInfo = {
+    subnetPrefix = subnetName: "fd" + (builtins.substring 0 10 (builtins.hashString "sha256" subnetName));    
+    subnetPeers = subnet: builtins.filter (peer: inList subnet.name peer.subnets) wirenix-config.peers;
+  };
+in 
+{
+  peer = peer:
+    rec {
+      subnets = peerInfo.peerSubnets peer;
+      peers = lib.lists.remove peer (lib.lists.unique (peerInfo.peerPeersUnfiltered peer)); 
+      ip = subnet: peerInfo.peerIP subnet.name peer.name;  
+      peersOnSubnet = subnet: builtins.filter (otherPeer: inList subnet.name otherPeer.subnets) peers;  
+      publicKey = peer.publicKey;
+      privateKeyFile = peer.privateKeyFile;
+    };
+  subnet = subnet:
+    {
+      peers = subnetInfo.subnetPeers subnet;
+      ip = (add-colons (subnetInfo.subnetPrefix subnet.name)) + "::/80";
+    };
+}
+# subnets:
+#   networkOne:
+#     prefix: "auto" or "none" or canonicalized ipv6
+#     ipv4: canonicalized ipv4 or "none"
+#     ipv6: canonicalized ipv6 or "auto" or "none"
+# peers:
+#   peerOne:
+#     pubKey: "ABC..." Or "auto"
+#     subnets:
+#       networkOne:
+#         - ipv4: ip
+#         - ipv6: "auto" or "none" or ip
+#     groups:
+#       - "groupOne"
+#     peers:
+#       - peer: "peerTwo"
+#       - group: "groupOne"

test-data.nix

@@ -0,0 +1,94 @@
+{
+  subnets = [
+    { name = "subnet.one"; }
+    { name = "subnet.two"; }
+    { name = "subnet.three"; }
+  ];
+  peers = [
+    {
+      name = "peer.zero";
+      subnets = [
+        
+      ];
+      groups = [
+
+      ];
+      peers = [
+        { group = "everyoneConnectsToMe"; }
+      ];
+      privateKeyFile = "/not/yet";
+      publicKey = "testData";
+      presharedKeyFile = "testData2";
+    }
+    {
+      name = "peer.one";
+      subnets = [
+        "subnet.one"
+      ];
+      groups = [
+
+      ];
+      peers = [
+        { group = "everyoneConnectsToMe"; }
+        { group = "subnet one group"; }
+      ];
+      privateKeyFile = "/not/yet";
+      publicKey = "testData";
+      presharedKeyFile = "testData2";
+    }
+    {
+      name = "peer.two";
+      subnets = [
+        "subnet.one"
+        "subnet.two"
+      ];
+      groups = [
+        "everyoneConnectsToMe"
+        "subnet two group"
+      ];
+      peers = [
+        { group = "everyoneConnectsToMe"; }
+        { group = "subnet two group"; }
+      ];
+      privateKeyFile = "/not/yet";
+      publicKey = "testData";
+      presharedKeyFile = "testData2";
+    }
+    {
+      name = "peer.three";
+      subnets = [
+        "subnet.one"
+        "subnet.two"
+        "subnet.three"
+      ];
+      groups = [
+        "everyoneConnectsToMe"
+        "subnet two group"
+      ];
+      peers = [
+        { group = "everyoneConnectsToMe"; }
+        { group = "subnet two group"; }
+      ];
+      privateKeyFile = "/not/yet";
+      publicKey = "testData";
+      presharedKeyFile = "testData2";
+    }
+    {
+      name = "peer.four";
+      subnets = [
+        "subnet.three"
+        "subnet.one"
+      ];
+      groups = [
+        
+      ];
+      peers = [
+        { group = "everyoneConnectsToMe"; }
+        { peer = "peer.one"; }
+      ];
+      privateKeyFile = "/not/yet";
+      publicKey = "testData";
+      presharedKeyFile = "testData2";
+    }
+  ];
+}

wire.nix

@@ -0,0 +1,123 @@
+{ config, lib, pkgs, ... }: 
+with lib;
+let
+  has-rekey = config ? rekey;
+  peerOpts = {
+    options = {
+      subnets = mkOption {
+        default = [];
+        type = with types; listOf str;
+        description = ''
+          subnets the peer belongs to
+        '';
+      };
+      groups = mkOption {
+        default = true;
+        type = with types; listOf str;
+        description = ''
+          groups the peer belongs to
+        '';
+      };
+      peers = {
+        default = true;
+        type = with types; listOf set;
+        description = mdDoc ''
+          Peers the peer is connected to, can be one of `{ peer = "peerName"; }`
+          or `{ group = "groupname"; }`. Remember to configure this for *both* peers.
+          The best way to do this is with a simple full mesh network, where all peers
+          belong to one group ("groupA"), and their peers are `{ group = "groupA"}`.
+          '';
+      };
+      privateKeyFile = mkOption {
+        example = "/private/wireguard_key";
+        type = with types; nullOr str;
+        default = null;
+        description = mdDoc ''
+          Private key file as generated by {command}`wg genkey`.
+        '';
+      };
+      name = mkOption {
+        default = config.networking.hostName;
+        defaultText = literalExpression "hostName";
+        example = "bernd";
+        type = types.str;
+        description = mdDoc "Unique name for the peer (must be unique for all subdomains this peer is a member of)";
+      };
+      publicKey = mkOption {
+        example = "xTIBA5rboUvnH4htodjb6e697QjLERt1NAB4mZqp8Dg=";
+        type = types.singleLineStr;
+        description = mdDoc "The base64 public key of the peer.";
+      };
+      presharedKeyFile = mkOption {
+        default = null;
+        example = "/private/wireguard_psk";
+        type = with types; nullOr str;
+        description = mdDoc ''
+          File pointing to preshared key as generated by {command}`wg genpsk`.
+          Optional, and may be omitted. This option adds an additional layer of
+          symmetric-key cryptography to be mixed into the already existing
+          public-key cryptography, for post-quantum resistance.
+        '';
+      };
+    };
+  };
+  subnetOpts = {
+    options = {
+      name = mkOption {
+        default = "wireguard";
+        example = "mySubnet.myDomain.me";
+        type = types.str;
+        description = mdDoc "Unique name for the subnet";
+      };
+    };
+  };
+  configOpts = {
+    options = {
+      subnets = mkOption {
+        default = {};
+        type = with types; listOf (submodule subnetOpts);
+        description = ''
+          Shared configuration file that describes all clients 
+        '';
+      };
+      peers = mkOption {
+        default = {};
+        type = with types; listOf (submodule peerOpts);
+        description = ''
+          Shared configuration file that describes all clients 
+        '';
+      };
+    };
+  };
+in
+{
+  options = {
+    modules.wirenix = {
+      enable = mkOption {
+        default = true;
+        type = with lib.types; bool;
+        description = ''
+          Wirenix
+        '';
+      };
+      config = mkOption {
+        default = {};
+        type = with types; setOf (submodule configOpts);
+        description = ''
+          Shared configuration file that describes all clients
+        '';
+      };
+    };
+  };
+  
+  # --------------------------------------------------------------- #
+  
+  config = lib.mkIf (config.modules.wirenix.enable) (lib.mkMerge [
+    (lib.mkIf (has-rekey) {
+      environment.etc.rekey.text = "yes";
+    })
+    (lib.mkIf (!has-rekey ) {
+      environment.etc.rekey.text = "no";
+    })
+  ]);
+}