with import ; { config, pkgs, ... }: let self = config.krebs.build.host.nets.wiregrill; isRouter = !isNull self.via; # via "internet" is not set ext-if = config.makefu.server.primary-itf; in mkIf (hasAttr "wiregrill" config.krebs.build.host.nets) { #hack for modprobe inside containers systemd.services."wireguard-wiregrill".path = mkIf config.boot.isContainer (mkBefore [ (pkgs.writeDashBin "modprobe" ":") ]); boot.kernel.sysctl = mkIf isRouter { "net.ipv6.conf.all.forwarding" = 1; "net.ipv4.conf.all.forwarding" = 1; }; networking.nat = { enable = true; externalInterface = ext-if; internalInterfaces = [ "wiregrill" ]; }; networking.firewall = { allowedUDPPorts = [ self.wireguard.port ]; extraCommands = '' ${pkgs.iptables}/bin/iptables -A FORWARD -i wiregrill -o wiregrill -j ACCEPT ''; }; networking.wireguard.interfaces.wiregrill = { postSetup = '' ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.220.245.0/24 -o ${ext-if} -j MASQUERADE ${pkgs.iptables}/bin/ip6tables -t nat -A POSTROUTING -s 42::/16 -o ${ext-if} -j MASQUERADE ''; # This undoes the above command postShutdown = '' ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.244.245.0/24 -o ${ext-if} -j MASQUERADE ${pkgs.iptables}/bin/ip6tables -t nat -D POSTROUTING -s 42::/16 -o ${ext-if} -j MASQUERADE ''; ips = (optional (!isNull self.ip4) self.ip4.addr) ++ (optional (!isNull self.ip6) self.ip6.addr); listenPort = self.wireguard.port; privateKeyFile = (toString ) + "/wiregrill.key"; allowedIPsAsRoutes = true; peers = mapAttrsToList (_: host: { allowedIPs = if isRouter then (optional (!isNull host.nets.wiregrill.ip4) host.nets.wiregrill.ip4.addr) ++ (optional (!isNull host.nets.wiregrill.ip6) host.nets.wiregrill.ip6.addr) else host.nets.wiregrill.wireguard.subnets ; endpoint = mkIf (!isNull host.nets.wiregrill.via) (host.nets.wiregrill.via.ip4.addr + ":${toString host.nets.wiregrill.wireguard.port}"); persistentKeepalive = mkIf (!isNull host.nets.wiregrill.via) 61; publicKey = (replaceStrings ["\n"] [""] host.nets.wiregrill.wireguard.pubkey); }) (filterAttrs (_: h: hasAttr "wiregrill" h.nets) config.krebs.hosts); }; }