diff options
| author | Timo Wilken <guix@twilken.net> | 2022-12-18 18:19:47 +0100 |
|---|---|---|
| committer | Mathieu Othacehe <othacehe@gnu.org> | 2022-12-25 16:56:48 +0100 |
| commit | 2967abf1a2ae6787842c04752949f3c214da9338 (patch) | |
| tree | 6e1c356a36d3154e32eaaba24790c86a2dd5b106 | |
| parent | f81c05d89bf9a91cb46524cb777f65d0295e6981 (diff) | |
| download | guix-2967abf1a2ae6787842c04752949f3c214da9338.tar.gz | |
services: wireguard: Allow specifying pre-shared keys.
* gnu/services/vpn.scm (<wireguard-peer>)[preshared-key]: New field. * doc/guix.texi (VPN Services): Document it. Signed-off-by: Mathieu Othacehe <othacehe@gnu.org>
| -rw-r--r-- | doc/guix.texi | 4 | ||||
| -rw-r--r-- | gnu/services/vpn.scm | 15 |
2 files changed, 18 insertions, 1 deletions
diff --git a/doc/guix.texi b/doc/guix.texi index e25692fd27..c5ae350a47 100644 --- a/doc/guix.texi +++ b/doc/guix.texi @@ -31770,6 +31770,10 @@ The optional endpoint for the peer, such as @item @code{public-key} The peer public-key represented as a base64 string. +@item @code{preshared-key} (default: @code{#f}) +An optional pre-shared key file for this peer. The given file will not +be autogenerated. + @item @code{allowed-ips} A list of IP addresses from which incoming traffic for this peer is allowed and to which incoming traffic for this peer is directed. diff --git a/gnu/services/vpn.scm b/gnu/services/vpn.scm index 7b3bb8903c..4103f89ecf 100644 --- a/gnu/services/vpn.scm +++ b/gnu/services/vpn.scm @@ -10,6 +10,7 @@ ;;; Copyright © 2021 jgart <jgart@dismail.de> ;;; Copyright © 2021 Nathan Dehnel <ncdehnel@gmail.com> ;;; Copyright © 2022 Cameron V Chaparro <cameron@cameronchaparro.com> +;;; Copyright © 2022 Timo Wilken <guix@twilken.net> ;;; ;;; This file is part of GNU Guix. ;;; @@ -61,6 +62,7 @@ wireguard-peer-endpoint wireguard-peer-allowed-ips wireguard-peer-public-key + wireguard-peer-preshared-key wireguard-peer-keep-alive wireguard-configuration @@ -709,6 +711,8 @@ strongSwan."))) (endpoint wireguard-peer-endpoint (default #f)) ;string (public-key wireguard-peer-public-key) ;string + (preshared-key wireguard-peer-preshared-key + (default #f)) ;string (allowed-ips wireguard-peer-allowed-ips) ;list of strings (keep-alive wireguard-peer-keep-alive (default #f))) ;integer @@ -762,10 +766,18 @@ AllowedIPs = ~a (format #f "PersistentKeepalive = ~a\n" keep-alive) "\n")))) + (define (peers->preshared-keys peer keys) + (let ((public-key (wireguard-peer-public-key peer)) + (preshared-key (wireguard-peer-preshared-key peer))) + (if preshared-key + (cons* public-key preshared-key keys) + keys))) + (match-record config <wireguard-configuration> (wireguard interface addresses port private-key peers dns pre-up post-up pre-down post-down table) (let* ((config-file (string-append interface ".conf")) + (peer-keys (fold peers->preshared-keys (list) peers)) (peers (map peer->config peers)) (config (computed-file @@ -780,7 +792,7 @@ AllowedIPs = ~a Address = ~a ~a ~a -PostUp = ~a set %i private-key ~a +PostUp = ~a set %i private-key ~a~{ peer ~a preshared-key ~a~} ~a ~a ~a @@ -800,6 +812,7 @@ PostUp = ~a set %i private-key ~a "\n")) #$(file-append wireguard "/bin/wg") #$private-key + '#$peer-keys #$(if (null? post-up) "" (string-join |