77 lines
2.4 KiB
Nix
77 lines
2.4 KiB
Nix
{
|
|
lib,
|
|
config,
|
|
pkgs,
|
|
...
|
|
}:
|
|
|
|
let
|
|
cfg = config.networking.vpn-netns;
|
|
|
|
netnsName = cfg.interfaceNamespace;
|
|
vethOuterName = cfg.vethInterfaceName;
|
|
vethEncapsulatedName = vethOuterName + "0";
|
|
|
|
outerIP = cfg.vethOuterIP + "/32";
|
|
encapsulatedIP = cfg.vethIP + "/32";
|
|
in
|
|
|
|
{
|
|
config = lib.mkIf (cfg.restrictedServices != [ ]) {
|
|
systemd.services = builtins.listToAttrs (
|
|
builtins.map (name: {
|
|
inherit name;
|
|
value = {
|
|
after = [ "wireguard.target" ];
|
|
# preStart = "sleep 3";
|
|
serviceConfig.NetworkNamespacePath = "/var/run/netns/${netnsName}";
|
|
};
|
|
}) cfg.restrictedServices
|
|
);
|
|
|
|
networking = {
|
|
wireguard.interfaces.${cfg.wireguardInterface} =
|
|
let
|
|
ip = "${pkgs.iproute2}/bin/ip";
|
|
in
|
|
{
|
|
preSetup = ''
|
|
# clean interfaces
|
|
${ip} netns delete "${netnsName}" 2> /dev/null || true
|
|
${ip} link delete ${vethOuterName} 2> /dev/null || true
|
|
rm -rf /etc/netns/${netnsName}
|
|
|
|
# add a namespace-specific resolv.conf
|
|
mkdir -p "/etc/netns/${netnsName}"
|
|
sed '/nameserver /d' /etc/resolv.conf > "/etc/netns/${netnsName}/resolv.conf"
|
|
echo "nameserver ${cfg.nameserver}" >> "/etc/netns/${netnsName}/resolv.conf"
|
|
|
|
# create the network namespace
|
|
${ip} netns add "${netnsName}"
|
|
${ip} -n "${netnsName}" link set lo up
|
|
|
|
# Add a custom link between netns
|
|
${ip} link add ${vethOuterName} type veth peer name ${vethEncapsulatedName}
|
|
${ip} link set ${vethEncapsulatedName} netns ${netnsName}
|
|
${ip} addr add ${outerIP} dev ${vethOuterName}
|
|
${ip} link set ${vethOuterName} up
|
|
${ip} route add ${encapsulatedIP} dev ${vethOuterName}
|
|
${ip} -n ${netnsName} addr add ${encapsulatedIP} dev ${vethEncapsulatedName}
|
|
${ip} -n ${netnsName} link set ${vethEncapsulatedName} up
|
|
${ip} -n ${netnsName} route add ${outerIP} dev ${vethEncapsulatedName}
|
|
'';
|
|
|
|
postShutdown = ''
|
|
${ip} netns delete "${netnsName}" || true
|
|
${ip} link delete ${vethOuterName} || true
|
|
rm -rf /etc/netns/${netnsName}
|
|
'';
|
|
|
|
inherit (cfg) interfaceNamespace;
|
|
}
|
|
// cfg.wireguardOptions;
|
|
|
|
firewall.trustedInterfaces = [ cfg.vethInterfaceName ];
|
|
};
|
|
};
|
|
}
|