Re-resolve WireGuard peers' endpoint names

systemd-networkd resolves an endpoint name once, when it creates the
device. A peer behind a dynamic DNS name that changes its address was
never found again until the next restart.

A timer (router.wireguardEndpointRefresh, default 1min, null for off)
runs wg set for the peers with a name whose last handshake is older than
135 seconds, as wireguard-tools' reresolve-dns does. Working tunnels are
left alone.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AeFqV9dZrK6nipHkPfyM4F

modules/router/options.nix

@@ -426,6 +426,20 @@ in
       );
     };
 
+    wireguardEndpointRefresh = mkOption {
+      type = types.nullOr (types.strMatching "[0-9]+(s|min|h)");
+      default = "1min";
+      example = "5min";
+      description = ''
+        How often the names in WireGuard peers' `endpoint` are looked up
+        again, for peers that have not completed a handshake in the last two
+        minutes. systemd-networkd resolves a name only when it creates the
+        tunnel, so without this a tunnel whose peer got a new address (dynamic
+        DNS) stays down until the peer contacts the router, or forever if both
+        ends changed. A tunnel that works is not touched. null turns it off.
+      '';
+    };
+
     firewall.zones = mkOption {
       type = types.listOf types.str;
       default = [ ];

modules/router/wireguard.nix

@@ -1,4 +1,9 @@
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 let
   cfg = config.router;
 
@@ -20,6 +25,27 @@ let
       )
     ) cfg.wireguard
   );
+
+  # Peers whose endpoint is a name (not an address). systemd-networkd looks a
+  # name up when it creates the device (and retries until it resolves, every
+  # 25 s at most), but never again: after the peer's address changes both
+  # sides keep sending to the old one.
+  isName = e: e != null && !lib.hasPrefix "[" e && builtins.match "[0-9.]+:[0-9]+" e == null;
+  namedPeers = lib.concatLists (
+    lib.mapAttrsToList (
+      name: wg:
+      lib.concatLists (
+        lib.mapAttrsToList (
+          peer: p:
+          lib.optional (isName p.endpoint) {
+            inherit (wg) interface;
+            inherit peer;
+            inherit (p) publicKey endpoint;
+          }
+        ) wg.peers
+      )
+    ) cfg.wireguard
+  );
 in
 {
   config = lib.mkIf (cfg.enable && cfg.wireguard != { }) {
@@ -79,5 +105,70 @@ in
         ) (lib.attrValues wg.peers);
       }
     ) cfg.wireguard;
+    # Look the names up again, like wireguard-tools' reresolve-dns: only for
+    # peers that have not shown a handshake lately (a working tunnel is left
+    # alone; with keepalive, handshakes are at most about two minutes apart).
+    systemd.services.router-wireguard-reresolve =
+      lib.mkIf (cfg.wireguardEndpointRefresh != null && namedPeers != [ ])
+        {
+          description = "Look up the names of WireGuard peer endpoints again";
+          after = [ "systemd-networkd.service" ];
+          path = [
+            pkgs.wireguard-tools
+            pkgs.gawk
+            pkgs.coreutils
+          ];
+          script = ''
+            now=$(date +%s)
+            refresh() { # device peer-name public-key endpoint
+              last=$(wg show "$1" latest-handshakes 2>/dev/null | awk -v k="$3" '$1 == k { print $2 }')
+              [ -n "$last" ] || return 0 # no such device or peer (yet)
+              if [ "$last" -gt 0 ] && [ $((now - last)) -lt 135 ]; then return 0; fi
+              before=$(wg show "$1" endpoints | awk -v k="$3" '$1 == k { print $2 }')
+              if ! wg set "$1" peer "$3" endpoint "$4"; then
+                echo "$1: $2: cannot resolve $4"
+                return 0
+              fi
+              after=$(wg show "$1" endpoints | awk -v k="$3" '$1 == k { print $2 }')
+              if [ "$before" != "$after" ]; then echo "$1: $2: endpoint $before -> $after ($4)"; fi
+            }
+          ''
+          + lib.concatMapStrings (
+            p:
+            "refresh ${
+              lib.escapeShellArgs [
+                p.interface
+                p.peer
+                p.publicKey
+                p.endpoint
+              ]
+            }\n"
+          ) namedPeers;
+          serviceConfig = {
+            Type = "oneshot";
+            CapabilityBoundingSet = [ "CAP_NET_ADMIN" ];
+            RestrictAddressFamilies = [
+              "AF_INET"
+              "AF_INET6"
+              "AF_NETLINK"
+              "AF_UNIX"
+            ];
+            NoNewPrivileges = true;
+            PrivateTmp = true;
+            PrivateDevices = true;
+            ProtectSystem = "strict";
+            ProtectHome = true;
+          };
+        };
+    systemd.timers.router-wireguard-reresolve =
+      lib.mkIf (cfg.wireguardEndpointRefresh != null && namedPeers != [ ])
+        {
+          wantedBy = [ "timers.target" ];
+          timerConfig = {
+            OnBootSec = "2min";
+            OnUnitActiveSec = cfg.wireguardEndpointRefresh;
+            AccuracySec = "10s";
+          };
+        };
   };
 }