80 lines
2.3 KiB
Nix
80 lines
2.3 KiB
Nix
{
|
|
config,
|
|
lib,
|
|
pkgs,
|
|
...
|
|
}: let
|
|
cfg = config.server.wireguard-netns;
|
|
in {
|
|
options.server.wireguard-netns = {
|
|
enable = lib.mkEnableOption "Enable a network namespace with WireGuard VPN";
|
|
configFile = lib.mkOption {
|
|
type = lib.types.path;
|
|
description = "Path to the WireGuard configuration file (e.g., mullvad.conf)";
|
|
};
|
|
namespace = lib.mkOption {
|
|
type = lib.types.str;
|
|
default = "vpn";
|
|
description = "Name of the network namespace";
|
|
};
|
|
};
|
|
|
|
config = lib.mkIf cfg.enable (
|
|
let
|
|
netnsSetup = pkgs.writeShellApplication {
|
|
name = "netns-${cfg.namespace}-setup";
|
|
runtimeInputs = with pkgs; [iproute2 wireguard-tools gawk coreutils];
|
|
text = ''
|
|
set -eux
|
|
|
|
CONFIG=${cfg.configFile}
|
|
NS=${cfg.namespace}
|
|
ADDR=$(awk -F' *= *' '/^Address/ { print $2 }' "$CONFIG")
|
|
DNS=$(awk -F' *= *' '/^DNS/ { print $2 }' "$CONFIG")
|
|
|
|
ip netns delete "$NS" 2>/dev/null || true
|
|
ip netns add "$NS"
|
|
ip link add wg0 type wireguard
|
|
ip link set wg0 netns "$NS"
|
|
|
|
IFS=',' read -ra ADDRS <<< "$ADDR"
|
|
for ip in "''${ADDRS[@]}"; do
|
|
ip -n "$NS" addr add "$ip" dev wg0
|
|
done
|
|
|
|
ip -n "$NS" link set wg0 up
|
|
ip netns exec "$NS" wg setconf wg0 "$CONFIG"
|
|
ip netns exec "$NS" ip link set lo up
|
|
ip netns exec "$NS" ip route add default dev wg0
|
|
|
|
mkdir -p /etc/netns/"$NS"
|
|
echo "nameserver $DNS" > /etc/netns/"$NS"/resolv.conf
|
|
'';
|
|
};
|
|
|
|
netnsTeardown = pkgs.writeShellApplication {
|
|
name = "netns-${cfg.namespace}-teardown";
|
|
runtimeInputs = with pkgs; [iproute2];
|
|
text = ''
|
|
set -eu
|
|
ip netns delete ${cfg.namespace} || true
|
|
'';
|
|
};
|
|
in {
|
|
systemd.services."netns@${cfg.namespace}" = {
|
|
description = "WireGuard VPN netns (${cfg.namespace})";
|
|
after = ["network-online.target"];
|
|
wants = ["network-online.target"];
|
|
wantedBy = ["multi-user.target"];
|
|
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
RemainAfterExit = true;
|
|
ExecStart = "${netnsSetup}/bin/netns-${cfg.namespace}-setup";
|
|
ExecStop = "${netnsTeardown}/bin/netns-${cfg.namespace}-teardown";
|
|
};
|
|
};
|
|
}
|
|
);
|
|
}
|