You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

systemd-networkd-wireguard.nix 2.8KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081
  1. let generateNodeConf = { lib, pkgs, config, privkpath, pubk, peerId, nodeId, ...}: {
  2. imports = [ common/user-account.nix ];
  3. systemd.services.systemd-networkd.environment.SYSTEMD_LOG_LEVEL = "debug";
  4. networking.useNetworkd = true;
  5. networking.useDHCP = false;
  6. networking.firewall.enable = false;
  7. virtualisation.vlans = [ 1 ];
  8. environment.systemPackages = with pkgs; [ wireguard-tools ];
  9. boot.extraModulePackages = [ config.boot.kernelPackages.wireguard ];
  10. systemd.network = {
  11. enable = true;
  12. netdevs = {
  13. "90-wg0" = {
  14. netdevConfig = { Kind = "wireguard"; Name = "wg0"; };
  15. wireguardConfig = {
  16. PrivateKeyFile = privkpath ;
  17. ListenPort = 51820;
  18. FwMark = 42;
  19. };
  20. wireguardPeers = [ {wireguardPeerConfig={
  21. Endpoint = "192.168.1.${peerId}:51820";
  22. PublicKey = pubk;
  23. PresharedKeyFile = pkgs.writeText "psk.key" "yTL3sCOL33Wzi6yCnf9uZQl/Z8laSE+zwpqOHC4HhFU=";
  24. AllowedIPs = [ "10.0.0.${peerId}/32" ];
  25. PersistentKeepalive = 15;
  26. };}];
  27. };
  28. };
  29. networks = {
  30. "99-nope" = {
  31. matchConfig.Name = "eth*";
  32. linkConfig.Unmanaged = true;
  33. };
  34. "90-wg0" = {
  35. matchConfig = { Name = "wg0"; };
  36. address = [ "10.0.0.${nodeId}/32" ];
  37. routes = [
  38. { routeConfig = { Gateway = "10.0.0.${nodeId}"; Destination = "10.0.0.0/24"; }; }
  39. ];
  40. };
  41. "90-eth1" = {
  42. matchConfig = { Name = "eth1"; };
  43. address = [ "192.168.1.${nodeId}/24" ];
  44. };
  45. };
  46. };
  47. };
  48. in import ./make-test.nix ({pkgs, ... }: {
  49. name = "networkd-wireguard";
  50. meta = with pkgs.stdenv.lib.maintainers; {
  51. maintainers = [ ninjatrappeur ];
  52. };
  53. nodes = {
  54. node1 = { pkgs, ... }@attrs:
  55. let localConf = {
  56. privkpath = pkgs.writeText "priv.key" "GDiXWlMQKb379XthwX0haAbK6hTdjblllpjGX0heP00=";
  57. pubk = "iRxpqj42nnY0Qz8MAQbSm7bXxXP5hkPqWYIULmvW+EE=";
  58. nodeId = "1";
  59. peerId = "2";
  60. };
  61. in generateNodeConf (attrs // localConf);
  62. node2 = { pkgs, ... }@attrs:
  63. let localConf = {
  64. privkpath = pkgs.writeText "priv.key" "eHxSI2jwX/P4AOI0r8YppPw0+4NZnjOxfbS5mt06K2k=";
  65. pubk = "27s0OvaBBdHoJYkH9osZpjpgSOVNw+RaKfboT/Sfq0g=";
  66. nodeId = "2";
  67. peerId = "1";
  68. };
  69. in generateNodeConf (attrs // localConf);
  70. };
  71. testScript = ''
  72. startAll;
  73. $node1->waitForUnit('systemd-networkd-wait-online.service');
  74. $node2->waitForUnit('systemd-networkd-wait-online.service');
  75. $node1->succeed('ping -c 5 10.0.0.2');
  76. $node2->succeed('ping -c 5 10.0.0.1');
  77. # Is the fwmark set?
  78. $node2->succeed('wg | grep -q 42');
  79. '';
  80. })