blob: 781d7505f87c3b729fa9b63e677898fe552ca86e (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
|
let
mkNodeIfStateConfig =
{
pkgs,
id,
wgPriv,
wgPeerPubKey,
wgPeerId,
}:
{
enable = true;
settings = {
namespaces.outside.interfaces.eth1 = {
addresses = [ "2001:0db8:a::${toString id}/64" ];
link = {
state = "up";
kind = "physical";
};
};
interfaces = {
wg0 = {
addresses = [ "2001:0db8:b::${toString id}/64" ];
link = {
state = "up";
kind = "wireguard";
bind_netns = "outside";
};
wireguard = {
private_key = "!include ${pkgs.writeText "wg_priv.key" wgPriv}";
listen_port = 51820;
peers."${wgPeerPubKey}" = {
endpoint = "[2001:0db8:a::${toString wgPeerId}]:51820";
allowedips = [ "::/0" ];
};
};
};
};
routing.routes = [
{
to = "2001:0db8:b::/64";
dev = "wg0";
}
];
};
};
in
{
name = "ifstate-initrd-wireguard";
nodes = {
foo =
{ pkgs, ... }:
{
imports = [ ../../modules/profiles/minimal.nix ];
virtualisation.interfaces.eth1.vlan = 1;
# Initrd IfState enforces stage 2 ifstate using assertion.
networking.ifstate = {
enable = true;
settings.interfaces = { };
};
boot.initrd = {
# otherwise the interfaces do not get created
kernelModules = [ "virtio_net" ];
network = {
enable = true;
ifstate =
mkNodeIfStateConfig {
inherit pkgs;
id = 1;
wgPriv = "6KmLyTyrN9OZIOCkdpiAwoVoeSiwvyI+mtn1wooKSEU=";
wgPeerPubKey = "olFuE7u5pVwSeWLFtrXSvD8+aCDBiKNKCLjLb/dgXiA=";
wgPeerId = 2;
}
// {
allowIfstateToDrasticlyIncreaseInitrdSize = true;
};
};
systemd = {
enable = true;
network.enable = false;
services.boot-blocker = {
before = [ "initrd.target" ];
wantedBy = [ "initrd.target" ];
script = "sleep infinity";
serviceConfig.Type = "oneshot";
};
};
};
};
bar =
{ pkgs, ... }:
{
imports = [ ../../modules/profiles/minimal.nix ];
virtualisation.interfaces.eth1.vlan = 1;
networking = {
ifstate = mkNodeIfStateConfig {
inherit pkgs;
id = 2;
wgPriv = "QN89cvFD0C8z1MSpUaJa1YBXt2MaIQegVkEYROi71Fg=";
wgPeerPubKey = "5qeKbAGc7wh9Xg0MoMXqXCSmp9TawmtI1bVk/vp3Cn4=";
wgPeerId = 1;
};
};
};
};
testScript = # python
''
start_all()
bar.wait_for_unit("default.target")
bar.wait_until_succeeds("ping -c 1 2001:0db8:b::1")
'';
}
|
