TakeV
/
guix
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

services: wireguard: Allow specifying pre-shared keys. 

* gnu/services/vpn.scm (<wireguard-peer>)[preshared-key]: New field.
* doc/guix.texi (VPN Services): Document it.

Signed-off-by: Mathieu Othacehe <othacehe@gnu.org>
This commit is contained in:
Timo Wilken 2022-12-18 18:19:47 +01:00 committed by Mathieu Othacehe
parent f81c05d89b
commit 2967abf1a2
No known key found for this signature in database
GPG Key ID: 8354763531769CA6
2 changed files with 18 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
doc/guix.texi
View File

@ -31770,6 +31770,10 @@ The optional endpoint for the peer, such as
@item @code{public-key}
The peer public-key represented as a base64 string.
@item @code{preshared-key} (default: @code{#f})
An optional pre-shared key file for this peer. The given file will not
be autogenerated.
@item @code{allowed-ips}
A list of IP addresses from which incoming traffic for this peer is
allowed and to which incoming traffic for this peer is directed.

15
gnu/services/vpn.scm
View File

@ -10,6 +10,7 @@
;;; Copyright © 2021 jgart <jgart@dismail.de>
;;; Copyright © 2021 Nathan Dehnel <ncdehnel@gmail.com>
;;; Copyright © 2022 Cameron V Chaparro <cameron@cameronchaparro.com>
;;; Copyright © 2022 Timo Wilken <guix@twilken.net>
;;;
;;; This file is part of GNU Guix.
;;;
@ -61,6 +62,7 @@
wireguard-peer-endpoint
wireguard-peer-allowed-ips
wireguard-peer-public-key
wireguard-peer-preshared-key
wireguard-peer-keep-alive
wireguard-configuration
@ -709,6 +711,8 @@ strongSwan.")))
(endpoint wireguard-peer-endpoint
(default #f)) ;string
(public-key wireguard-peer-public-key) ;string
(preshared-key wireguard-peer-preshared-key
(default #f)) ;string
(allowed-ips wireguard-peer-allowed-ips) ;list of strings
(keep-alive wireguard-peer-keep-alive
(default #f))) ;integer
@ -762,10 +766,18 @@ AllowedIPs = ~a
(format #f "PersistentKeepalive = ~a\n" keep-alive)
"\n"))))
(define (peers->preshared-keys peer keys)
(let ((public-key (wireguard-peer-public-key peer))
(preshared-key (wireguard-peer-preshared-key peer)))
(if preshared-key
(cons* public-key preshared-key keys)
keys)))
(match-record config <wireguard-configuration>
(wireguard interface addresses port private-key peers dns
pre-up post-up pre-down post-down table)
(let* ((config-file (string-append interface ".conf"))
(peer-keys (fold peers->preshared-keys (list) peers))
(peers (map peer->config peers))
(config
(computed-file
@ -780,7 +792,7 @@ AllowedIPs = ~a
Address = ~a
~a
~a
PostUp = ~a set %i private-key ~a
PostUp = ~a set %i private-key ~a~{ peer ~a preshared-key ~a~}
~a
~a
~a
@ -800,6 +812,7 @@ PostUp = ~a set %i private-key ~a
"\n"))
#$(file-append wireguard "/bin/wg")
#$private-key
'#$peer-keys
#$(if (null? post-up)
""
(string-join