mirror of
https://github.com/NixOS/nixpkgs.git
synced 2025-07-14 14:10:33 +03:00
nixos/{wg-quick,wireguard}: add AmneziaWG support (#341663)
This commit is contained in:
Azat Bahawi
GitHub
commit
0589bd307d
6 changed files with 346 additions and 22 deletions
|
|
@ -11,6 +11,15 @@ let
|
|||
interfaceOpts = { ... }: {
|
||||
options = {
|
||||
|
||||
type = mkOption {
|
||||
example = "amneziawg";
|
||||
default = "wireguard";
|
||||
type = types.enum ["wireguard" "amneziawg"];
|
||||
description = ''
|
||||
The type of the interface. Currently only "wireguard" and "amneziawg" are supported.
|
||||
'';
|
||||
};
|
||||
|
||||
configFile = mkOption {
|
||||
example = "/secret/wg0.conf";
|
||||
default = null;
|
||||
|
|
@ -151,6 +160,22 @@ let
|
|||
description = "Peers linked to the interface.";
|
||||
type = with types; listOf (submodule peerOpts);
|
||||
};
|
||||
|
||||
extraOptions = mkOption {
|
||||
type = with types; attrsOf (oneOf [ str int ]);
|
||||
default = { };
|
||||
example = {
|
||||
Jc = 5;
|
||||
Jmin = 10;
|
||||
Jmax = 42;
|
||||
S1 = 60;
|
||||
S2 = 90;
|
||||
H4 = 12345;
|
||||
};
|
||||
description = ''
|
||||
Extra options to append to the interface section. Can be used to define AmneziaWG-specific options.
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
|
|
@ -230,7 +255,7 @@ let
|
|||
|
||||
writeScriptFile = name: text: ((pkgs.writeShellScriptBin name text) + "/bin/${name}");
|
||||
|
||||
generatePrivateKeyScript = privateKeyFile: ''
|
||||
generatePrivateKeyScript = privateKeyFile: wgBin: ''
|
||||
set -e
|
||||
|
||||
# If the parent dir does not already exist, create it.
|
||||
|
|
@ -239,7 +264,7 @@ let
|
|||
|
||||
if [ ! -f "${privateKeyFile}" ]; then
|
||||
# Write private key file with atomically-correct permissions.
|
||||
(set -e; umask 077; wg genkey > "${privateKeyFile}")
|
||||
(set -e; umask 077; ${wgBin} genkey > "${privateKeyFile}")
|
||||
fi
|
||||
'';
|
||||
|
||||
|
|
@ -247,11 +272,19 @@ let
|
|||
assert assertMsg (values.configFile != null || ((values.privateKey != null) != (values.privateKeyFile != null))) "Only one of privateKey, configFile or privateKeyFile may be set";
|
||||
assert assertMsg (values.generatePrivateKeyFile == false || values.privateKeyFile != null) "generatePrivateKeyFile requires privateKeyFile to be set";
|
||||
let
|
||||
generateKeyScriptFile = if values.generatePrivateKeyFile then writeScriptFile "generatePrivateKey.sh" (generatePrivateKeyScript values.privateKeyFile) else null;
|
||||
wgBin = {
|
||||
wireguard = "wg";
|
||||
amneziawg = "awg";
|
||||
}.${values.type};
|
||||
generateKeyScriptFile =
|
||||
if values.generatePrivateKeyFile then
|
||||
writeScriptFile "generatePrivateKey.sh" (generatePrivateKeyScript values.privateKeyFile wgBin)
|
||||
else
|
||||
null;
|
||||
preUpFile = if values.preUp != "" then writeScriptFile "preUp.sh" values.preUp else null;
|
||||
postUp =
|
||||
optional (values.privateKeyFile != null) "wg set ${name} private-key <(cat ${values.privateKeyFile})" ++
|
||||
(concatMap (peer: optional (peer.presharedKeyFile != null) "wg set ${name} peer ${peer.publicKey} preshared-key <(cat ${peer.presharedKeyFile})") values.peers) ++
|
||||
optional (values.privateKeyFile != null) "${wgBin} set ${name} private-key <(cat ${values.privateKeyFile})" ++
|
||||
(concatMap (peer: optional (peer.presharedKeyFile != null) "${wgBin} set ${name} peer ${peer.publicKey} preshared-key <(cat ${peer.presharedKeyFile})") values.peers) ++
|
||||
optional (values.postUp != "") values.postUp;
|
||||
postUpFile = if postUp != [] then writeScriptFile "postUp.sh" (concatMapStringsSep "\n" (line: line) postUp) else null;
|
||||
preDownFile = if values.preDown != "" then writeScriptFile "preDown.sh" values.preDown else null;
|
||||
|
|
@ -279,6 +312,7 @@ let
|
|||
optionalString (postUpFile != null) "PostUp = ${postUpFile}\n" +
|
||||
optionalString (preDownFile != null) "PreDown = ${preDownFile}\n" +
|
||||
optionalString (postDownFile != null) "PostDown = ${postDownFile}\n" +
|
||||
concatLines (mapAttrsToList (n: v: "${n} = ${toString v}") values.extraOptions) +
|
||||
concatMapStringsSep "\n" (peer:
|
||||
assert assertMsg (!((peer.presharedKeyFile != null) && (peer.presharedKey != null))) "Only one of presharedKey or presharedKeyFile may be set";
|
||||
"[Peer]\n" +
|
||||
|
|
@ -304,7 +338,10 @@ let
|
|||
wantedBy = optional values.autostart "multi-user.target";
|
||||
environment.DEVICE = name;
|
||||
path = [
|
||||
pkgs.wireguard-tools
|
||||
{
|
||||
wireguard = pkgs.wireguard-tools;
|
||||
amneziawg = pkgs.amneziawg-tools;
|
||||
}.${values.type}
|
||||
config.networking.firewall.package # iptables or nftables
|
||||
config.networking.resolvconf.package # openresolv or systemd
|
||||
];
|
||||
|
|
@ -315,11 +352,11 @@ let
|
|||
};
|
||||
|
||||
script = ''
|
||||
${optionalString (!config.boot.isContainer) "${pkgs.kmod}/bin/modprobe wireguard"}
|
||||
${optionalString (!config.boot.isContainer) "${pkgs.kmod}/bin/modprobe ${values.type}"}
|
||||
${optionalString (values.configFile != null) ''
|
||||
cp ${values.configFile} ${configPath}
|
||||
''}
|
||||
wg-quick up ${configPath}
|
||||
${wgBin}-quick up ${configPath}
|
||||
'';
|
||||
|
||||
serviceConfig = {
|
||||
|
|
@ -328,7 +365,7 @@ let
|
|||
};
|
||||
|
||||
preStop = ''
|
||||
wg-quick down ${configPath}
|
||||
${wgBin}-quick down ${configPath}
|
||||
'';
|
||||
};
|
||||
in {
|
||||
|
|
@ -360,8 +397,12 @@ in {
|
|||
###### implementation
|
||||
|
||||
config = mkIf (cfg.interfaces != {}) {
|
||||
boot.extraModulePackages = optional (versionOlder kernel.kernel.version "5.6") kernel.wireguard;
|
||||
environment.systemPackages = [ pkgs.wireguard-tools ];
|
||||
boot.extraModulePackages =
|
||||
optional (any (x: x.type == "wireguard") (attrValues cfg.interfaces) && (versionOlder kernel.kernel.version "5.6")) kernel.wireguard
|
||||
++ optional (any (x: x.type == "amneziawg") (attrValues cfg.interfaces)) kernel.amneziawg;
|
||||
environment.systemPackages =
|
||||
optional (any (x: x.type == "wireguard") (attrValues cfg.interfaces)) pkgs.wireguard-tools
|
||||
++ optional (any (x: x.type == "amneziawg") (attrValues cfg.interfaces)) pkgs.amneziawg-tools;
|
||||
systemd.services = mapAttrs' generateUnit cfg.interfaces;
|
||||
|
||||
# Prevent networkd from clearing the rules set by wg-quick when restarted (e.g. when waking up from suspend).
|
||||
|
|
|
|||
|
|
@ -189,6 +189,10 @@ in
|
|||
assertion = interface.interfaceNamespace == null;
|
||||
message = "networking.wireguard.interfaces.${name}.interfaceNamespace cannot be used with networkd.";
|
||||
}
|
||||
{
|
||||
assertion = interface.type == "wireguard";
|
||||
message = "networking.wireguard.interfaces.${name}.type value must be \"wireguard\" when used with networkd.";
|
||||
}
|
||||
]
|
||||
++ flip concatMap interface.ips (ip: [
|
||||
# IP assertions
|
||||
|
|
|
|||
|
|
@ -15,6 +15,15 @@ let
|
|||
|
||||
options = {
|
||||
|
||||
type = mkOption {
|
||||
example = "amneziawg";
|
||||
default = "wireguard";
|
||||
type = types.enum ["wireguard" "amneziawg"];
|
||||
description = ''
|
||||
The type of the interface. Currently only "wireguard" and "amneziawg" are supported.
|
||||
'';
|
||||
};
|
||||
|
||||
ips = mkOption {
|
||||
example = [ "192.168.2.1/24" ];
|
||||
default = [];
|
||||
|
|
@ -206,6 +215,22 @@ let
|
|||
:::
|
||||
'';
|
||||
};
|
||||
|
||||
extraOptions = mkOption {
|
||||
type = with types; attrsOf (oneOf [ str int ]);
|
||||
default = { };
|
||||
example = {
|
||||
Jc = 5;
|
||||
Jmin = 10;
|
||||
Jmax = 42;
|
||||
S1 = 60;
|
||||
S2 = 90;
|
||||
H4 = 12345;
|
||||
};
|
||||
description = ''
|
||||
Extra options to append to the interface section. Can be used to define AmneziaWG-specific options.
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
};
|
||||
|
|
@ -346,6 +371,16 @@ let
|
|||
|
||||
};
|
||||
|
||||
wgBins = {
|
||||
wireguard = "wg";
|
||||
amneziawg = "awg";
|
||||
};
|
||||
|
||||
wgPackages = {
|
||||
wireguard = pkgs.wireguard-tools;
|
||||
amneziawg = pkgs.amneziawg-tools;
|
||||
};
|
||||
|
||||
generateKeyServiceUnit = name: values:
|
||||
assert values.generatePrivateKeyFile;
|
||||
nameValuePair "wireguard-${name}-key"
|
||||
|
|
@ -354,7 +389,7 @@ let
|
|||
wantedBy = [ "wireguard-${name}.service" ];
|
||||
requiredBy = [ "wireguard-${name}.service" ];
|
||||
before = [ "wireguard-${name}.service" ];
|
||||
path = with pkgs; [ wireguard-tools ];
|
||||
path = [ wgPackages.${values.type} ];
|
||||
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
|
|
@ -370,7 +405,7 @@ let
|
|||
|
||||
if [ ! -f "${values.privateKeyFile}" ]; then
|
||||
# Write private key file with atomically-correct permissions.
|
||||
(set -e; umask 077; wg genkey > "${values.privateKeyFile}")
|
||||
(set -e; umask 077; ${wgBins.${values.type}} genkey > "${values.privateKeyFile}")
|
||||
fi
|
||||
'';
|
||||
};
|
||||
|
|
@ -395,7 +430,7 @@ let
|
|||
src = interfaceCfg.socketNamespace;
|
||||
dst = interfaceCfg.interfaceNamespace;
|
||||
ip = nsWrap "ip" src dst;
|
||||
wg = nsWrap "wg" src dst;
|
||||
wg = nsWrap wgBins.${interfaceCfg.type} src dst;
|
||||
dynamicEndpointRefreshSeconds = dynamicRefreshSeconds interfaceCfg peer;
|
||||
dynamicRefreshEnabled = dynamicEndpointRefreshSeconds != 0;
|
||||
# We generate a different name (a `-refresh` suffix) when `dynamicEndpointRefreshSeconds`
|
||||
|
|
@ -412,7 +447,7 @@ let
|
|||
wantedBy = [ "wireguard-${interfaceName}.service" ];
|
||||
environment.DEVICE = interfaceName;
|
||||
environment.WG_ENDPOINT_RESOLUTION_RETRIES = "infinity";
|
||||
path = with pkgs; [ iproute2 wireguard-tools ];
|
||||
path = with pkgs; [ iproute2 wgPackages.${interfaceCfg.type} ];
|
||||
|
||||
serviceConfig =
|
||||
if !dynamicRefreshEnabled
|
||||
|
|
@ -501,7 +536,7 @@ let
|
|||
dst = values.interfaceNamespace;
|
||||
ipPreMove = nsWrap "ip" src null;
|
||||
ipPostMove = nsWrap "ip" src dst;
|
||||
wg = nsWrap "wg" src dst;
|
||||
wg = nsWrap wgBins.${values.type} src dst;
|
||||
ns = if dst == "init" then "1" else dst;
|
||||
|
||||
in
|
||||
|
|
@ -512,7 +547,7 @@ let
|
|||
wants = [ "network.target" ];
|
||||
before = [ "network.target" ];
|
||||
environment.DEVICE = name;
|
||||
path = with pkgs; [ kmod iproute2 wireguard-tools ];
|
||||
path = with pkgs; [ kmod iproute2 wgPackages.${values.type} ];
|
||||
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
|
|
@ -520,10 +555,10 @@ let
|
|||
};
|
||||
|
||||
script = concatStringsSep "\n" (
|
||||
optional (!config.boot.isContainer) "modprobe wireguard || true"
|
||||
optional (!config.boot.isContainer) "modprobe ${values.type} || true"
|
||||
++ [
|
||||
values.preSetup
|
||||
''${ipPreMove} link add dev "${name}" type wireguard''
|
||||
''${ipPreMove} link add dev "${name}" type ${values.type}''
|
||||
]
|
||||
++ optional (values.interfaceNamespace != null && values.interfaceNamespace != values.socketNamespace) ''${ipPreMove} link set "${name}" netns "${ns}"''
|
||||
++ optional (values.mtu != null) ''${ipPostMove} link set "${name}" mtu ${toString values.mtu}''
|
||||
|
|
@ -535,6 +570,7 @@ let
|
|||
[ ''${wg} set "${name}" private-key "${privKey}"'' ]
|
||||
++ optional (values.listenPort != null) ''listen-port "${toString values.listenPort}"''
|
||||
++ optional (values.fwMark != null) ''fwmark "${values.fwMark}"''
|
||||
++ mapAttrsToList (k: v: ''${toLower k} "${toString v}"'') values.extraOptions
|
||||
))
|
||||
''${ipPostMove} link set up dev "${name}"''
|
||||
values.postSetup
|
||||
|
|
@ -554,6 +590,9 @@ let
|
|||
ns = last nsList;
|
||||
in
|
||||
if (length nsList > 0 && ns != "init") then ''ip netns exec "${ns}" "${cmd}"'' else cmd;
|
||||
|
||||
usingWg = any (x: x.type == "wireguard") (attrValues cfg.interfaces);
|
||||
usingAwg = any (x: x.type == "amneziawg") (attrValues cfg.interfaces);
|
||||
in
|
||||
|
||||
{
|
||||
|
|
@ -628,9 +667,11 @@ in
|
|||
message = "networking.wireguard.interfaces.${interfaceName} peer «${peer.publicKey}» has both presharedKey and presharedKeyFile set, but only one can be used.";
|
||||
}) all_peers;
|
||||
|
||||
boot.extraModulePackages = optional (versionOlder kernel.kernel.version "5.6") kernel.wireguard;
|
||||
boot.kernelModules = [ "wireguard" ];
|
||||
environment.systemPackages = [ pkgs.wireguard-tools ];
|
||||
boot.extraModulePackages =
|
||||
optional (usingWg && (versionOlder kernel.kernel.version "5.6")) kernel.wireguard
|
||||
++ optional usingAwg kernel.amneziawg;
|
||||
boot.kernelModules = optional usingWg "wireguard" ++ optional usingAwg "amneziawg";
|
||||
environment.systemPackages = optional usingWg pkgs.wireguard-tools ++ optional usingAwg pkgs.amneziawg-tools;
|
||||
|
||||
systemd.services = mkIf (!cfg.useNetworkd) (
|
||||
(mapAttrs' generateInterfaceUnit cfg.interfaces)
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue