pyrox.dev
1import ../make-test-python.nix ({ pkgs, lib, kernelPackages ? null, ...} :
2 let
3 wg-snakeoil-keys = import ./snakeoil-keys.nix;
4 peer = (import ./make-peer.nix) { inherit lib; };
5 in
6 {
7 name = "wireguard";
8 meta = with pkgs.lib.maintainers; {
9 maintainers = [ ma27 ];
10 };
11
12 nodes = {
13 peer0 = peer {
14 ip4 = "192.168.0.1";
15 ip6 = "fd00::1";
16 extraConfig = {
17 boot = lib.mkIf (kernelPackages != null) { inherit kernelPackages; };
18 networking.firewall.allowedUDPPorts = [ 23542 ];
19 networking.wireguard.interfaces.wg0 = {
20 ips = [ "10.23.42.1/32" "fc00::1/128" ];
21 listenPort = 23542;
22
23 inherit (wg-snakeoil-keys.peer0) privateKey;
24
25 peers = lib.singleton {
26 allowedIPs = [ "10.23.42.2/32" "fc00::2/128" ];
27
28 inherit (wg-snakeoil-keys.peer1) publicKey;
29 };
30 };
31 };
32 };
33
34 peer1 = peer {
35 ip4 = "192.168.0.2";
36 ip6 = "fd00::2";
37 extraConfig = {
38 boot = lib.mkIf (kernelPackages != null) { inherit kernelPackages; };
39 networking.wireguard.interfaces.wg0 = {
40 ips = [ "10.23.42.2/32" "fc00::2/128" ];
41 listenPort = 23542;
42 allowedIPsAsRoutes = false;
43
44 inherit (wg-snakeoil-keys.peer1) privateKey;
45
46 peers = lib.singleton {
47 allowedIPs = [ "0.0.0.0/0" "::/0" ];
48 endpoint = "192.168.0.1:23542";
49 persistentKeepalive = 25;
50
51 inherit (wg-snakeoil-keys.peer0) publicKey;
52 };
53
54 postSetup = let inherit (pkgs) iproute2; in ''
55 ${iproute2}/bin/ip route replace 10.23.42.1/32 dev wg0
56 ${iproute2}/bin/ip route replace fc00::1/128 dev wg0
57 '';
58 };
59 };
60 };
61 };
62
63 testScript = ''
64 start_all()
65
66 peer0.wait_for_unit("wireguard-wg0.service")
67 peer1.wait_for_unit("wireguard-wg0.service")
68
69 peer1.succeed("ping -c5 fc00::1")
70 peer1.succeed("ping -c5 10.23.42.1")
71 '';
72 }
73)