nilsandClaude Sonnet 5.5
30ab1a0ed6
router.wireguard.<name> configures tunnels through networkd: road warrior (listening, dual-stack), site-to-site (no transfer network) and provider dial-out with masquerade. A tunnel has a zone like a LAN, so inter-zone rules apply; management, DNS and internet are opt-in. Peers' allowedIPs become routes (destination-based routing; default-route tunnels are rejected). Tunnels have a kill switch (default on): forwarded packets for their allowedIPs are dropped if they would leave via an uplink, before the established-accept so flows that used the tunnel are cut too. Private keys stay outside the Nix store and are passed to the unprivileged systemd-networkd with LoadCredential, so key files can be root-only. Assertions cover CIDR/key/endpoint formats, duplicate allowedIPs, overlaps with LAN subnets, port and device clashes, and rule destinations inside tunnel networks. A five-VM `wireguard` check covers road warrior, site-to-site, the provider tunnel with an IPv6 transfer net, zone rules and the kill switch. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
24 lines
586 B
Nix
24 lines
586 B
Nix
# Pieces shared by the VM tests.
|
|
{
|
|
# `fail` in a test script also passes on "command not found", so make sure
|
|
# the tools the scripts rely on are really there.
|
|
tools =
|
|
{ pkgs, ... }:
|
|
{
|
|
environment.systemPackages = with pkgs; [
|
|
dnsutils
|
|
netcat-openbsd
|
|
curl
|
|
tcpdump
|
|
wireguard-tools
|
|
];
|
|
};
|
|
|
|
# `driverInteractive` uses the full QEMU, which would open a window per VM;
|
|
# `nix run .#lab` wants the consoles in the terminal instead.
|
|
interactiveDefaults.virtualisation.qemu.options = [
|
|
"-display"
|
|
"none"
|
|
];
|
|
}
|