Add WireGuard

Provisioning.md

@@ -50,6 +50,13 @@ ln -rs "$HOME/src/configuration/common/packages.nix" "$HOME/.config/nixpkgs/over
 Host-specific secrets:
 
 ```bash
+# U2F
 pamu2fcfg > "$HOME/src/configuration/hosts/$HOST/local/resources/andrew.u2f" # Keychain
 pamu2fcfg -n >> "$HOME/src/configuration/hosts/$HOST/local/resources/andrew.u2f" # Backup
+
+# Wireguard
+sudo mkdir '/var/lib/wireguard'
+gopass show --password "wireguard/$HOST" | sudo tee '/var/lib/wireguard/wg0.key' >/dev/null
+sudo chown root:systemd-network '/var/lib/wireguard/wg0.key'
+sudo chmod 640 '/var/lib/wireguard/wg0.key'
 ```

common/components/applications.nix

@@ -109,6 +109,7 @@ in
     virt-manager
     visidata
     whois
+    wireguard-tools
     xorg.xev
     yq
   ];

common/nixos.nix

@@ -24,6 +24,17 @@ in
     name = lib.mkOption { type = lib.types.str; };
     local = lib.mkOption { type = lib.types.path; };
     resources = lib.mkOption { type = lib.types.path; };
+    wireguard = {
+      ip = lib.mkOption { type = lib.types.str; };
+      port = lib.mkOption { type = lib.types.int; };
+      peers = lib.mkOption {
+        type = lib.types.attrsOf (lib.types.submodule { options = {
+          ip = lib.mkOption { type = lib.types.str; };
+          key = lib.mkOption { type = lib.types.str; };
+          endpoint = lib.mkOption { type = lib.types.str; };
+        }; });
+      };
+    };
   };
 
   config = {
@@ -76,6 +87,24 @@ in
     networking.hostName = host.name;
     networking.domain = "home.arpa";
     networking.search = [ "home.arpa" ];
+    networking.extraHosts = lib.concatStringsSep "\n"
+      (lib.mapAttrsToList (hostname: peer: "${peer.ip} ${hostname}") host.wireguard.peers);
+    systemd.network = {
+      enable = true;
+      netdevs."90-wg0" = {
+        netdevConfig = { Name = "wg0"; Kind = "wireguard"; };
+        wireguardConfig.PrivateKeyFile = "/var/lib/wireguard/wg0.key";
+        wireguardPeers = lib.mapAttrsToList (_: peer: {
+          wireguardPeerConfig = {
+            AllowedIPs = [ "${peer.ip}/32" ];
+            Endpoint = peer.endpoint;
+            PublicKey = peer.key;
+          };
+        }) host.wireguard.peers;
+      };
+      networks."90-wg0" = { name = "wg0"; address = [ "${host.wireguard.ip}/24" ]; };
+    };
+
     # Workaround for `avahi-daemon[1234]: Failed to read /etc/avahi/services.`
     # Upstream: https://github.com/lathiat/avahi/blob/v0.8/avahi-daemon/static-services.c#L917-L919
     system.activationScripts.etcAvahiServices = "mkdir -p /etc/avahi/services";

common/resources/words.txt

@@ -769,6 +769,7 @@ whitespace
 Whois
 windsports
 WIP
+WireGuard
 Wireshark
 WMS
 wordmark