sokai/mynixos-config
1
1
Fork 0
forked from mirrors_public/oddlama_nix-config
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: route the whole wireguard network when we are a client.

Browse source
This commit is contained in:
oddlama 2023-05-20 20:58:37 +02:00
parent f95bc0eb30
commit 43b2bd1982
No known key found for this signature in database
GPG key ID: 14EFE510775FE39A
2 changed files with 9 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

6
modules/wireguard.nix
View file

@ -219,8 +219,10 @@
wireguardPeerConfig = { wireguardPeerConfig = {
PublicKey = builtins.readFile (peerPublicKeyPath wgCfg.client.via); PublicKey = builtins.readFile (peerPublicKeyPath wgCfg.client.via);
PresharedKeyFile = config.rekey.secrets.${peerPresharedKeySecret nodeName wgCfg.client.via}.path; PresharedKeyFile = config.rekey.secrets.${peerPresharedKeySecret nodeName wgCfg.client.via}.path;
# TODO this should be 0.0.0.0 if the client wants to route all traffic # Access to the whole network is routed through our entry node.
AllowedIPs = serverAllowedIPs wgCfg.client.via; # TODO this should add any routedAddresses on ANY server in the network, right?
# if A entries via B and only C can route 0.0.0.0/0, does that work?
AllowedIPs = networkCidrs;
}; };
} }
]; ];

6
nix/lib.nix
View file

@ -213,6 +213,10 @@ in rec {
net.cidr.merge (usedAddresses net.cidr.merge (usedAddresses
++ concatMap (n: (wgCfgOf n).server.reservedAddresses) associatedServerNodes); ++ concatMap (n: (wgCfgOf n).server.reservedAddresses) associatedServerNodes);
# The network spanning cidr addresses. The respective cidrv4 and cirdv6 are only
# included if they exist.
networkCidrs = filter (x: x != null) (attrValues networkAddresses);
# Appends / replaces the correct cidr length to the argument, # Appends / replaces the correct cidr length to the argument,
# so that the resulting address is in the cidr. # so that the resulting address is in the cidr.
toNetworkAddr = addr: let toNetworkAddr = addr: let
@ -245,7 +249,7 @@ in rec {
[Peer] [Peer]
PublicKey = ${removeSuffix "\n" (builtins.readFile (peerPublicKeyPath serverNode))} PublicKey = ${removeSuffix "\n" (builtins.readFile (peerPublicKeyPath serverNode))}
PresharedKey = $serverPsk PresharedKey = $serverPsk
AllowedIPs = ${concatStringsSep ", " snCfg.addresses} AllowedIPs = ${concatStringsSep ", " networkCidrs}
Endpoint = ${snCfg.server.host}:${toString snCfg.server.port} Endpoint = ${snCfg.server.host}:${toString snCfg.server.port}
EOF EOF
''; '';