Compare commits
No commits in common. "42fc42517391c7d9309544810a73e0f1ac5a2546" and "811a3caf985333bd74d9b19a295f6421209b8991" have entirely different histories.
42fc425173
...
811a3caf98
11 changed files with 84 additions and 126 deletions
|
|
@ -1,36 +0,0 @@
|
|||
#!/usr/bin/env python3
|
||||
|
||||
from bundlewrap.repo import Repository
|
||||
from os.path import realpath, dirname
|
||||
from sys import argv
|
||||
from ipaddress import ip_network, ip_interface
|
||||
|
||||
repo = Repository(dirname(dirname(realpath(__file__))))
|
||||
|
||||
server_node = repo.get_node('htz.mails')
|
||||
data = server_node.metadata.get(f'wireguard/clients/{argv[1]}')
|
||||
|
||||
vpn_network = ip_interface(server_node.metadata.get('wireguard/my_ip')).network
|
||||
allowed_ips = [
|
||||
vpn_network,
|
||||
ip_interface(server_node.metadata.get('network/internal/ipv4')).network,
|
||||
]
|
||||
for peer in server_node.metadata.get('wireguard/s2s').values():
|
||||
for network in peer['allowed_ips']:
|
||||
if not ip_network(network).subnet_of(vpn_network):
|
||||
allowed_ips.append(ip_network(network))
|
||||
|
||||
print(
|
||||
f'''[Interface]
|
||||
PrivateKey = {repo.libs.wireguard.privkey(data['peer_id'])}
|
||||
ListenPort = 51820
|
||||
Address = {data['peer_ip']}
|
||||
DNS = 8.8.8.8
|
||||
|
||||
[Peer]
|
||||
PublicKey = {repo.libs.wireguard.pubkey(server_node.metadata.get('id'))}
|
||||
PresharedKey = {repo.libs.wireguard.psk(data['peer_id'], server_node.metadata.get('id'))}
|
||||
AllowedIPs = {', '.join(str(client_route) for client_route in sorted(allowed_ips))}
|
||||
Endpoint = {ip_interface(server_node.metadata.get('network/external/ipv4')).ip}:51820
|
||||
PersistentKeepalive = 10'''
|
||||
)
|
||||
|
|
@ -1,2 +0,0 @@
|
|||
echo module wireguard +p > /sys/kernel/debug/dynamic_debug/control
|
||||
dmesg -wT | grep wireguard
|
||||
|
|
@ -1 +1,3 @@
|
|||
from ipaddress import ip_network
|
||||
|
||||
repo.libs.tools.require_bundle(node, 'systemd-networkd')
|
||||
|
|
|
|||
|
|
@ -3,14 +3,16 @@ from ipaddress import ip_network, ip_interface
|
|||
from bundlewrap.exceptions import NoSuchNode
|
||||
from bundlewrap.metadata import atomic
|
||||
|
||||
repo.libs.wireguard.repo = repo
|
||||
|
||||
|
||||
defaults = {
|
||||
'apt': {
|
||||
'packages': {
|
||||
# 'linux-headers-amd64': {},
|
||||
'wireguard': {
|
||||
'backports': node.os_version < (11,),
|
||||
# 'needs': [
|
||||
# 'pkg_apt:linux-headers-amd64',
|
||||
# ],
|
||||
'triggers': [
|
||||
'svc_systemd:systemd-networkd:restart',
|
||||
],
|
||||
|
|
@ -18,39 +20,7 @@ defaults = {
|
|||
},
|
||||
},
|
||||
'wireguard': {
|
||||
's2s': {},
|
||||
'clients': {},
|
||||
},
|
||||
}
|
||||
|
||||
|
||||
@metadata_reactor.provides(
|
||||
'wireguard/s2s',
|
||||
'wireguard/clients',
|
||||
)
|
||||
def s2s_peer_specific(metadata):
|
||||
return {
|
||||
'wireguard': {
|
||||
's2s': {
|
||||
s2s: {
|
||||
'peer_id': repo.get_node(s2s).metadata.get(f'id'),
|
||||
'peer_ip': repo.get_node(s2s).metadata.get(f'wireguard/my_ip'),
|
||||
'endpoint': f'{repo.get_node(s2s).hostname}:51820',
|
||||
'allowed_ips': [
|
||||
str(ip_interface(repo.get_node(s2s).metadata.get(f'wireguard/my_ip')).network),
|
||||
],
|
||||
}
|
||||
for s2s in metadata.get('wireguard/s2s')
|
||||
},
|
||||
'clients': {
|
||||
client: {
|
||||
'peer_id': client,
|
||||
'allowed_ips': [
|
||||
str(ip_interface(conf['peer_ip']).network),
|
||||
],
|
||||
}
|
||||
for client, conf in metadata.get('wireguard/clients').items()
|
||||
},
|
||||
'privatekey': repo.vault.random_bytes_as_base64_for(f'{node.name} wireguard privatekey'),
|
||||
},
|
||||
}
|
||||
|
||||
|
|
@ -66,6 +36,11 @@ def systemd_networkd_networks(metadata):
|
|||
'Address': {
|
||||
'Address': metadata.get('wireguard/my_ip'),
|
||||
},
|
||||
'Route': {
|
||||
'Destination': str(ip_interface(metadata.get('wireguard/my_ip')).network),
|
||||
'GatewayOnlink': 'yes',
|
||||
'PreferredSource': str(ip_interface(metadata.get('network/internal/ipv4')).ip),
|
||||
},
|
||||
'Network': {
|
||||
'DHCP': 'no',
|
||||
'IPForward': 'yes',
|
||||
|
|
@ -73,12 +48,14 @@ def systemd_networkd_networks(metadata):
|
|||
},
|
||||
}
|
||||
|
||||
for peer, config in metadata.get('wireguard/s2s').items():
|
||||
for route in config.get('allowed_ips', []):
|
||||
for peer, config in metadata.get('wireguard/peers').items():
|
||||
for route in config.get('route', []):
|
||||
network.update({
|
||||
f'Route#{peer}_{route}': {
|
||||
'Destination': route,
|
||||
'Gateway': str(ip_interface(metadata.get('wireguard/my_ip')).ip),
|
||||
'Gateway': str(ip_interface(repo.get_node(peer).metadata.get(f'wireguard/my_ip')).ip),
|
||||
'GatewayOnlink': 'yes',
|
||||
'PreferredSource': str(ip_interface(metadata.get('network/internal/ipv4')).ip),
|
||||
}
|
||||
})
|
||||
|
||||
|
|
@ -102,25 +79,24 @@ def systemd_networkd_netdevs(metadata):
|
|||
'Description': 'WireGuard server',
|
||||
},
|
||||
'WireGuard': {
|
||||
'PrivateKey': repo.libs.wireguard.privkey(metadata.get('id')),
|
||||
'PrivateKey': metadata.get('wireguard/privatekey'),
|
||||
'ListenPort': 51820,
|
||||
},
|
||||
}
|
||||
|
||||
for peer, config in {
|
||||
**metadata.get('wireguard/s2s'),
|
||||
**metadata.get('wireguard/clients'),
|
||||
}.items():
|
||||
for peer, config in metadata.get('wireguard/peers').items():
|
||||
netdev.update({
|
||||
f'WireGuardPeer#{peer}': {
|
||||
'PublicKey': repo.libs.wireguard.pubkey(config['peer_id']),
|
||||
'PresharedKey': repo.libs.wireguard.psk(config['peer_id'], metadata.get('id')),
|
||||
'AllowedIPs': ', '.join(config.get('allowed_ips', [])),
|
||||
'Endpoint': config['endpoint'],
|
||||
'PublicKey': config['pubkey'],
|
||||
'PresharedKey': config['psk'],
|
||||
'AllowedIPs': ', '.join([
|
||||
str(ip_interface(repo.get_node(peer).metadata.get(f'wireguard/my_ip')).ip),
|
||||
*config.get('route', []),
|
||||
]), # FIXME
|
||||
'PersistentKeepalive': 30,
|
||||
}
|
||||
})
|
||||
if config.get('endpoint'):
|
||||
netdev[f'WireGuardPeer#{peer}']['Endpoint'] = config['endpoint']
|
||||
|
||||
return {
|
||||
'systemd': {
|
||||
|
|
@ -129,3 +105,33 @@ def systemd_networkd_netdevs(metadata):
|
|||
},
|
||||
},
|
||||
}
|
||||
|
||||
|
||||
@metadata_reactor.provides(
|
||||
'wireguard/peers',
|
||||
)
|
||||
def peer_keys(metadata):
|
||||
peers = {}
|
||||
|
||||
for peer_name in metadata.get('wireguard/peers', {}):
|
||||
peer_node = repo.get_node(peer_name)
|
||||
|
||||
first, second = sorted([node.metadata.get('id'), peer_node.metadata.get('id')])
|
||||
psk = repo.vault.random_bytes_as_base64_for(f'{first} wireguard {second}')
|
||||
|
||||
pubkey = repo.libs.keys.get_pubkey_from_privkey(
|
||||
f'{peer_name} wireguard pubkey',
|
||||
peer_node.metadata.get('wireguard/privatekey'),
|
||||
)
|
||||
|
||||
peers[peer_name] = {
|
||||
'psk': psk,
|
||||
'pubkey': pubkey,
|
||||
'endpoint': f'{peer_node.hostname}:51820',
|
||||
}
|
||||
|
||||
return {
|
||||
'wireguard': {
|
||||
'peers': peers,
|
||||
},
|
||||
}
|
||||
|
|
|
|||
15
libs/keys.py
Normal file
15
libs/keys.py
Normal file
|
|
@ -0,0 +1,15 @@
|
|||
import base64
|
||||
from nacl.public import PrivateKey
|
||||
from nacl.encoding import Base64Encoder
|
||||
from bundlewrap.utils import Fault
|
||||
|
||||
def gen_privkey(repo, identifier):
|
||||
return repo.vault.random_bytes_as_base64_for(identifier)
|
||||
|
||||
def get_pubkey_from_privkey(identifier, privkey):
|
||||
# FIXME this assumes the privkey is always a base64 encoded string
|
||||
def derive_pubkey():
|
||||
pub_key = PrivateKey(base64.b64decode(str(privkey))).public_key
|
||||
return pub_key.encode(encoder=Base64Encoder).decode('ascii')
|
||||
|
||||
return Fault(f'pubkey from privkey {identifier}', derive_pubkey)
|
||||
|
|
@ -1,16 +0,0 @@
|
|||
import base64
|
||||
from nacl.public import PrivateKey
|
||||
from nacl.encoding import Base64Encoder
|
||||
from functools import cache
|
||||
|
||||
@cache
|
||||
def privkey(id):
|
||||
return str(repo.vault.random_bytes_as_base64_for(f"wireguard privkey {id}"))
|
||||
|
||||
@cache
|
||||
def pubkey(id):
|
||||
return PrivateKey(base64.b64decode(privkey(id))).public_key.encode(encoder=Base64Encoder).decode('ascii')
|
||||
|
||||
@cache
|
||||
def psk(id1, id2):
|
||||
return repo.vault.random_bytes_as_base64_for(f"wireguard psk {' '.join(sorted([id1, id2]))}")
|
||||
|
|
@ -58,10 +58,10 @@
|
|||
'ram': 16192,
|
||||
},
|
||||
'wireguard': {
|
||||
'my_ip': '172.30.0.2/32',
|
||||
's2s': {
|
||||
'my_ip': '172.30.0.2/24',
|
||||
'peers': {
|
||||
'htz.mails': {
|
||||
'allowed_ips': [
|
||||
'route': [
|
||||
'10.0.10.0/24',
|
||||
'10.0.11.0/24',
|
||||
'10.0.20.0/24',
|
||||
|
|
|
|||
|
|
@ -141,36 +141,25 @@
|
|||
},
|
||||
'wireguard': {
|
||||
'my_ip': '172.30.0.1/24',
|
||||
's2s': {
|
||||
'peers': {
|
||||
'home.server': {
|
||||
'allowed_ips': [
|
||||
'route': [
|
||||
'10.0.0.0/24',
|
||||
'10.0.2.0/24',
|
||||
'10.0.9.0/24',
|
||||
],
|
||||
},
|
||||
'netcup.secondary': {
|
||||
'allowed_ips': [
|
||||
'route': [
|
||||
'10.0.11.0/24',
|
||||
],
|
||||
},
|
||||
'wb.offsite-backups': {
|
||||
'allowed_ips': [
|
||||
'route': [
|
||||
'192.168.178.0/24',
|
||||
],
|
||||
},
|
||||
},
|
||||
'clients': {
|
||||
'macbook': {
|
||||
'peer_ip': '172.30.0.100/32',
|
||||
},
|
||||
'phone': {
|
||||
'peer_ip': '172.30.0.101/32',
|
||||
},
|
||||
'ipad': {
|
||||
'peer_ip': '172.30.0.102/32',
|
||||
},
|
||||
},
|
||||
},
|
||||
'zfs': {
|
||||
'pools': {
|
||||
|
|
|
|||
|
|
@ -31,10 +31,10 @@
|
|||
# 'hostname': 'mail2.sublimity.de',
|
||||
# },
|
||||
'wireguard': {
|
||||
'my_ip': '172.30.0.3/32',
|
||||
's2s': {
|
||||
'my_ip': '172.30.0.3/24',
|
||||
'peers': {
|
||||
'htz.mails': {
|
||||
'allowed_ips': [
|
||||
'route': [
|
||||
'10.0.0.0/24',
|
||||
'10.0.2.0/24',
|
||||
'10.0.9.0/24',
|
||||
|
|
|
|||
|
|
@ -22,10 +22,10 @@
|
|||
},
|
||||
},
|
||||
'wireguard': {
|
||||
'my_ip': '172.30.0.4/32',
|
||||
's2s': {
|
||||
'my_ip': '172.30.0.4/24',
|
||||
'peers': {
|
||||
'htz.mails': {
|
||||
'allowed_ips': [
|
||||
'route': [
|
||||
'10.0.0.0/24',
|
||||
'10.0.2.0/24',
|
||||
'10.0.9.0/24',
|
||||
|
|
|
|||
Loading…
Reference in a new issue