1# Generate system config files for Fedora work hosts without system-manager.
 2# Usage: nix build .#fedoraConfigs.<hostname>
 3# Then: sudo ./result/deploy
 4{
 5  lib,
 6  pkgs,
 7  globals,
 8  libx,
 9  hostname,
10}:
11let
12  machine = globals.machines.${hostname};
13  hostsEntries = libx.hostConfigs globals.machines;
14  hostsFile = lib.concatStringsSep "\n" (
15    lib.mapAttrsToList (ip: names: "${ip} ${lib.concatStringsSep " " names}") hostsEntries
16  );
17
18  hosts = pkgs.writeText "hosts" ''
19    127.0.0.1 localhost
20    ::1 localhost
21    ${hostsFile}
22  '';
23
24  wgConf = pkgs.writeText "wg0.conf" ''
25    [Interface]
26    PostUp = wg set %i private-key /etc/wireguard/private.key
27    Address = ${builtins.head machine.net.vpn.ips}/24
28
29    [Peer]
30    PublicKey = ${globals.machines.carthage.net.vpn.pubkey}
31    AllowedIPs = 10.100.0.0/24
32    Endpoint = ${globals.net.vpn.endpoint}:51820
33    PersistentKeepalive = 25
34  '';
35
36  nixCustomConf = pkgs.writeText "nix.custom.conf" ''
37    trusted-users = root @wheel
38    extra-substituters = http://okinawa.vpn:5000
39    extra-trusted-public-keys = cache.okinawa.home:gp+IG0OaO4L/J0drL8OwmDtMPmdUq4kfLwg3mR8BkCs=
40  '';
41
42  nmDispatcher = pkgs.writeScript "99-wireguard-route" ''
43    #!/bin/bash
44    INTERFACE="$1"
45    ACTION="$2"
46    if [[ "$INTERFACE" == "tun0" && "$ACTION" == "vpn-up" ]]; then
47      TABLE=$(ip rule show | grep -oP 'lookup \K[0-9]+' | head -1)
48      if [[ -n "$TABLE" && "$TABLE" != "local" ]]; then
49        ip route add 10.100.0.0/24 dev wg0 table "$TABLE" 2>/dev/null || true
50      fi
51    fi
52  '';
53
54  deployScript = pkgs.writeShellScript "deploy-configs" ''
55    set -euo pipefail
56    echo "Deploying system configs for ${hostname}..."
57    install -m 0644 ${hosts} /etc/hosts
58    mkdir -p /etc/wireguard
59    install -m 0600 ${wgConf} /etc/wireguard/wg0.conf
60    if [ -f /etc/nix/nix.custom.conf ]; then
61      if ! grep -q 'trusted-users' /etc/nix/nix.custom.conf 2>/dev/null; then
62        cat ${nixCustomConf} >> /etc/nix/nix.custom.conf
63      fi
64    fi
65    mkdir -p /etc/NetworkManager/dispatcher.d
66    install -m 0755 ${nmDispatcher} /etc/NetworkManager/dispatcher.d/99-wireguard-route
67    echo "Done!"
68  '';
69in
70pkgs.runCommand "fedora-configs-${hostname}" { } ''
71  mkdir -p $out/etc/wireguard $out/etc/NetworkManager/dispatcher.d $out/etc/nix
72  cp ${hosts} $out/etc/hosts
73  cp ${wgConf} $out/etc/wireguard/wg0.conf
74  cp ${nixCustomConf} $out/etc/nix/nix.custom.conf
75  cp ${nmDispatcher} $out/etc/NetworkManager/dispatcher.d/99-wireguard-route
76  cp ${deployScript} $out/deploy
77''