blob: bc568bf587b7b1b64fa372fca49e03b87749ca7f (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
|
let
mkNode =
{
id,
wgPriv,
wgPeerPubKey,
wgPeerId,
}:
(
{ pkgs, ... }:
{
imports = [ ../../modules/profiles/minimal.nix ];
virtualisation.interfaces.eth1.vlan = 1;
networking = {
firewall.interfaces.eth1.allowedUDPPorts = [ 51820 ];
ifstate = {
enable = true;
settings = {
namespaces.outside.interfaces.eth1 = {
addresses = [ "2001:0db8:a::${toString id}/64" ];
link = {
state = "up";
kind = "physical";
};
};
interfaces = {
wg0 = {
addresses = [ "2001:0db8:b::${toString id}/64" ];
link = {
state = "up";
kind = "wireguard";
bind_netns = "outside";
};
wireguard = {
private_key = "!include ${pkgs.writeText "wg_priv.key" wgPriv}";
listen_port = 51820;
peers."${wgPeerPubKey}" = {
endpoint = "[2001:0db8:a::${toString wgPeerId}]:51820";
allowedips = [ "::/0" ];
};
};
};
};
routing.routes = [
{
to = "2001:0db8:b::/64";
dev = "wg0";
}
];
};
};
};
}
);
in
{
name = "ifstate-wireguard";
nodes = {
foo = mkNode {
id = 1;
wgPriv = "6KmLyTyrN9OZIOCkdpiAwoVoeSiwvyI+mtn1wooKSEU=";
wgPeerPubKey = "olFuE7u5pVwSeWLFtrXSvD8+aCDBiKNKCLjLb/dgXiA=";
wgPeerId = 2;
};
bar = mkNode {
id = 2;
wgPriv = "QN89cvFD0C8z1MSpUaJa1YBXt2MaIQegVkEYROi71Fg=";
wgPeerPubKey = "5qeKbAGc7wh9Xg0MoMXqXCSmp9TawmtI1bVk/vp3Cn4=";
wgPeerId = 1;
};
};
testScript = # python
''
start_all()
foo.wait_for_unit("default.target")
bar.wait_for_unit("default.target")
foo.wait_until_succeeds("ping -c 1 2001:0db8:b::2")
bar.wait_until_succeeds("ping -c 1 2001:0db8:b::1")
'';
}
|
