···

       
5
       
 
       
let cfg = config.wireguard; in

     

       
6
       
 
       
{

     

       
7
       
 
       
  options.wireguard = {

     

       
8
       
-
       
    enable = lib.mkEnableOption "wireguard";

     

       
9
       
 
       
    server = mkOption {

     

       
10
       
 
       
      type = with types; bool;

     

       
11
       
 
       
      default = cfg.hosts.${config.networking.hostName}.server;

     
···

       
22
       
 
       
          server = mkOption {

     

       
23
       
 
       
            type = types.bool;

     

       
24
       
 
       
            default = false;

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
25
       
 
       
          };

     

       
26
       
 
       
        };

     

       
27
       
 
       
      };

     
···

       
47
       
 
       


     

       
48
       
 
       
      wireguard = {

     

       
49
       
 
       
        enable = true;

     

       
50
       
-
       
        interfaces.wg0 = {

     

       
51
       
-
       
          ips = [ "${cfg.hosts.${config.networking.hostName}.ip}/24" ];

     

       
52
       
 
       
          listenPort = 51820;

     

       
53
       
-
       
          privateKeyFile = "${config.custom.secretsDir}/wireguard-key-${config.networking.hostName}";

     

       
54
       
-
       
          peers = mkIf (!cfg.server) [

     

       
55
       
-
       
            {

     

       
56
       
-
       
              allowedIPs = [ "10.0.0.0/24" ];

     

       
57
       
-
       
              publicKey = "${cfg.hosts.vps.publicKey}";

     

       
58
       
-
       
              endpoint = "${config.hosting.serverIpv4}:51820";

     

       
59
       
-
       
              persistentKeepalive = mkIf (config.networking.hostName == "rasp-pi") 25;

     

       
60
       
-
       
            }

     

       
61
       
-
       
          ];

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
62
       
 
       
        };

     

       
63
       
 
       
      };

     

       
64
       
 
       
    };

     

···

       
5
       
 
       
let cfg = config.wireguard; in

     

       
6
       
 
       
{

     

       
7
       
 
       
  options.wireguard = {

     

       
8
       
+
       
    enable = mkEnableOption "wireguard";

     

       
9
       
 
       
    server = mkOption {

     

       
10
       
 
       
      type = with types; bool;

     

       
11
       
 
       
      default = cfg.hosts.${config.networking.hostName}.server;

     
···

       
22
       
 
       
          server = mkOption {

     

       
23
       
 
       
            type = types.bool;

     

       
24
       
 
       
            default = false;

     

       
25
       
+
       
          };

     

       
26
       
+
       
          endpoint = mkOption {

     

       
27
       
+
       
            type = with types; nullOr str;

     

       
28
       
+
       
            default = null;

     

       
29
       
+
       
            # should not be null when server = true

     

       
30
       
+
       
          };

     

       
31
       
+
       
          persistentKeepalive = mkOption {

     

       
32
       
+
       
            type = with types; nullOr int;

     

       
33
       
+
       
            default = null;

     

       
34
       
 
       
          };

     

       
35
       
 
       
        };

     

       
36
       
 
       
      };

     
···

       
56
       
 
       


     

       
57
       
 
       
      wireguard = {

     

       
58
       
 
       
        enable = true;

     

       
59
       
+
       
        interfaces.wg0 = let hostName = config.networking.hostName; in {

     

       
60
       
+
       
          ips = [ "${cfg.hosts."${hostName}".ip}/24" ];

     

       
61
       
 
       
          listenPort = 51820;

     

       
62
       
+
       
          privateKeyFile = "${config.custom.secretsDir}/wireguard-key-${hostName}";

     

       
63
       
+
       
          peers =

     

       
64
       
+
       
            let

     

       
65
       
+
       
              serverPeers = attrsets.mapAttrsToList

     

       
66
       
+
       
                (hostName: values:

     

       
67
       
+
       
                  if values.server then

     

       
68
       
+
       
                  {

     

       
69
       
+
       
                    allowedIPs = [ "10.0.0.0/24" ];

     

       
70
       
+
       
                    publicKey = values.publicKey;

     

       
71
       
+
       
                    endpoint = "${values.endpoint}:51820";

     

       
72
       
+
       
                    persistentKeepalive = values.persistentKeepalive;

     

       
73
       
+
       
                  }

     

       
74
       
+
       
                else {})

     

       
75
       
+
       
                cfg.hosts;

     

       
76
       
+
       
              # remove empty elements

     

       
77
       
+
       
              cleanedServerPeers = lists.remove { } serverPeers;

     

       
78
       
+
       
            in mkIf (!cfg.server) cleanedServerPeers; 

     

       
79
       
 
       
        };

     

       
80
       
 
       
      };

     

       
81
       
 
       
    };

     

···

       
31
       
 
       
          hostName: values: {

     

       
32
       
 
       
            allowedIPs = [ "${values.ip}/32" ];

     

       
33
       
 
       
            publicKey = values.publicKey;

     

       
34
       
-
       
            persistentKeepalive = lib.mkIf (hostName == "rasp-pi") 25;

     

       
35
       
 
       
          }

     

       
36
       
 
       
        ) cfg.hosts;

     

       
37
       
 
       
    };

     

···

       
31
       
 
       
          hostName: values: {

     

       
32
       
 
       
            allowedIPs = [ "${values.ip}/32" ];

     

       
33
       
 
       
            publicKey = values.publicKey;

     

       
34
       
+
       
            persistentKeepalive = values.persistentKeepalive;

     

       
35
       
 
       
          }

     

       
36
       
 
       
        ) cfg.hosts;

     

       
37
       
 
       
    };