bundles/wireguard/metadata.py

@@ -9,8 +9,12 @@ repo.libs.wireguard.repo = repo
 defaults = {
     'apt': {
         'packages': {
+            # 'linux-headers-amd64': {},
             'wireguard': {
                 'backports': node.os_version < (11,),
+                # 'needs': [
+                #     'pkg_apt:linux-headers-amd64',
+                # ],
                 'triggers': [
                     'svc_systemd:systemd-networkd:restart',
                 ],
@@ -35,9 +39,6 @@ def s2s_peer_specific(metadata):
                     'id': repo.get_node(peer).metadata.get(f'id'),
                     'ip': repo.get_node(peer).metadata.get(f'wireguard/my_ip'),
                     'endpoint': f'{repo.get_node(peer).hostname}:51820',
-                    'route': [
-                        str(ip_interface(repo.get_node(peer).metadata.get(f'wireguard/my_ip')).network),
-                    ],
                 }
                     for peer in metadata.get('wireguard/peers')
             },
@@ -54,11 +55,8 @@ def client_peer_specific(metadata):
             'clients': {
                 client: {
                     'id': client,
-                    'route': [
-                        str(ip_interface(conf['ip']).network),
-                    ]
                 }
-                    for client, conf in metadata.get('wireguard/clients').items()
+                    for client in metadata.get('wireguard/clients')
             },
         },
     }
@@ -75,6 +73,11 @@ def systemd_networkd_networks(metadata):
         'Address': {
             'Address': metadata.get('wireguard/my_ip'),
         },
+        'Route': {
+            'Destination': str(ip_interface(metadata.get('wireguard/my_ip')).network),
+            'GatewayOnlink': 'yes',
+            'PreferredSource': str(ip_interface(metadata.get('network/internal/ipv4')).ip),
+        },
         'Network': {
             'DHCP': 'no',
             'IPForward': 'yes',
@@ -84,12 +87,15 @@ def systemd_networkd_networks(metadata):
 
     for peer, config in {
         **metadata.get('wireguard/peers'),
+        **metadata.get('wireguard/clients'),
     }.items():
         for route in config.get('route', []):
             network.update({
                 f'Route#{peer}_{route}': {
                     'Destination': route,
-                    'Gateway': str(ip_interface(metadata.get('wireguard/my_ip')).ip),
+                    'Gateway': str(ip_interface(config['ip']).ip),
+                    'GatewayOnlink': 'yes',
+                    'PreferredSource': str(ip_interface(metadata.get('network/internal/ipv4')).ip),
                 }
             })
 
@@ -127,7 +133,7 @@ def systemd_networkd_netdevs(metadata):
                 'PublicKey': repo.libs.wireguard.pubkey(config['id']),
                 'PresharedKey': repo.libs.wireguard.psk(config['id'], metadata.get('id')),
                 'AllowedIPs': ', '.join([
-                    # '172.30.0.0/24', # FIXME
+                    str(ip_interface(config['ip']).ip),
                     *config.get('route', []),
                 ]), # FIXME
                 'PersistentKeepalive': 30,

nodes/home.server.py

@@ -58,7 +58,7 @@
             'ram':  16192,
         },
         'wireguard': {
-            'my_ip': '172.30.0.2/32',
+            'my_ip': '172.30.0.2/24',
             'peers': {
                 'htz.mails': {
                     'route': [

nodes/htz.mails.py

@@ -162,13 +162,13 @@
             },
             'clients': {
                 'macbook': {
-                    'ip': '172.30.0.100/32',
+                    'ip': '172.30.0.100/24',
                 },
                 'phone': {
-                    'ip': '172.30.0.101/32',
+                    'ip': '172.30.0.101/24',
                 },
                 'ipad': {
-                    'ip': '172.30.0.102/32',
+                    'ip': '172.30.0.102/24',
                 },
             },
         },

nodes/netcup.secondary.py

@@ -31,7 +31,7 @@
         #     'hostname': 'mail2.sublimity.de',
         # },
         'wireguard': {
-            'my_ip': '172.30.0.3/32',
+            'my_ip': '172.30.0.3/24',
             'peers': {
                 'htz.mails': {
                     'route': [

nodes/wb.offsite-backups.py

@@ -22,7 +22,7 @@
             },
         },
         'wireguard': {
-            'my_ip': '172.30.0.4/32',
+            'my_ip': '172.30.0.4/24',
             'peers': {
                 'htz.mails': {
                     'route': [