diff --git a/nixos/modules/system/boot/networkd.nix b/nixos/modules/system/boot/networkd.nix
index f1aa9064bef4..4f37f6a89082 100644
--- a/nixos/modules/system/boot/networkd.nix
+++ b/nixos/modules/system/boot/networkd.nix
@@ -93,6 +93,27 @@ let
(assertRange "FlowLabel" 0 1048575)
];
+ # NOTE The PrivateKey directive is missing on purpose here, please
+ # do not add it to this list. The nix store is world-readable let's
+ # refrain ourselves from providing a footgun.
+ checkWireguard = checkUnitConfig "WireGuard" [
+ (assertOnlyFields [
+ "PrivateKeyFile" "ListenPort" "FwMark"
+ ])
+ (assertRange "FwMark" 1 4294967295)
+ ];
+
+ # NOTE The PresharedKey directive is missing on purpose here, please
+ # do not add it to this list. The nix store is world-readable,let's
+ # refrain ourselves from providing a footgun.
+ checkWireguardPeer = checkUnitConfig "WireGuardPeer" [
+ (assertOnlyFields [
+ "PublicKey" "PresharedKeyFile" "AllowedIPs"
+ "Endpoint" "PersistentKeepalive"
+ ])
+ (assertRange "PersistentKeepalive" 1 65535)
+ ];
+
checkTunnel = checkUnitConfig "Tunnel" [
(assertOnlyFields [
"Local" "Remote" "TOS" "TTL" "DiscoverPathMTU" "IPv6FlowLabel" "CopyDSCP"
@@ -356,6 +377,46 @@ let
'';
};
+ wireguardConfig = mkOption {
+ default = {};
+ example = {
+ PrivateKeyFile = "/etc/wireguard/secret.key";
+ ListenPort = 51820;
+ FwMark = 42;
+ };
+ type = types.addCheck (types.attrsOf unitOption) checkWireguard;
+ description = ''
+ Each attribute in this set specifies an option in the
+ [WireGuard] section of the unit. See
+ systemd.netdev
+ 5 for details.
+ Use PrivateKeyFile instead of
+ PrivateKey: the nix store is
+ world-readable.
+ '';
+ };
+
+ wireguardPeerConfig = mkOption {
+ default = {};
+ example = {
+ Endpoint = "192.168.1.1:51820";
+ PublicKey = "27s0OvaBBdHoJYkH9osZpjpgSOVNw+RaKfboT/Sfq0g=";
+ PresharedKeyFile = "/etc/wireguard/psk.key";
+ AllowedIPs = [ "10.0.0.1/32" ];
+ PersistentKeepalive = 15;
+ };
+ type = types.addCheck (types.attrsOf unitOption) checkWireguardPeer;
+ description = ''
+ Each attribute in this set specifies an option in the
+ [WireGuardPeer] section of the unit. See
+ systemd.netdev
+ 5 for details.
+ Use PresharedKeyFile instead of
+ PresharedKey: the nix store is
+ world-readable.
+ '';
+ };
+
tunnelConfig = mkOption {
default = {};
example = { Remote = "192.168.1.1"; };
@@ -706,6 +767,16 @@ let
[VXLAN]
${attrsToSection def.vxlanConfig}
+ ''}
+ ${optionalString (def.wireguardConfig != {}) ''
+ [WireGuard]
+ ${attrsToSection def.wireguardConfig}
+
+ ''}
+ ${optionalString (def.wireguardConfig != {}) ''
+ [WireGuardPeer]
+ ${attrsToSection def.wireguardPeerConfig}
+
''}
${optionalString (def.tunnelConfig != { }) ''
[Tunnel]
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 359f62751b99..2884d9b6d1b0 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -242,6 +242,7 @@ in
systemd = handleTest ./systemd.nix {};
systemd-confinement = handleTest ./systemd-confinement.nix {};
systemd-timesyncd = handleTest ./systemd-timesyncd.nix {};
+ systemd-networkd-wireguard = handleTest ./systemd-networkd-wireguard.nix {};
pdns-recursor = handleTest ./pdns-recursor.nix {};
taskserver = handleTest ./taskserver.nix {};
telegraf = handleTest ./telegraf.nix {};
diff --git a/nixos/tests/systemd-networkd-wireguard.nix b/nixos/tests/systemd-networkd-wireguard.nix
new file mode 100644
index 000000000000..ecebd765b37d
--- /dev/null
+++ b/nixos/tests/systemd-networkd-wireguard.nix
@@ -0,0 +1,80 @@
+let generateNodeConf = { lib, pkgs, config, privkpath, pubk, peerId, nodeId, ...}: {
+ imports = [ common/user-account.nix ];
+ systemd.services.systemd-networkd.environment.SYSTEMD_LOG_LEVEL = "debug";
+ networking.useNetworkd = true;
+ networking.firewall.enable = false;
+ virtualisation.vlans = [ 1 ];
+ environment.systemPackages = with pkgs; [ wireguard-tools ];
+ boot.extraModulePackages = [ config.boot.kernelPackages.wireguard ];
+ systemd.network = {
+ enable = true;
+ netdevs = {
+ "90-wg0" = {
+ netdevConfig = { Kind = "wireguard"; Name = "wg0"; };
+ wireguardConfig = {
+ PrivateKeyFile = privkpath ;
+ ListenPort = 51820;
+ FwMark = 42;
+ };
+ wireguardPeerConfig = {
+ Endpoint = "192.168.1.${peerId}:51820";
+ PublicKey = pubk;
+ PresharedKeyFile = pkgs.writeText "psk.key" "yTL3sCOL33Wzi6yCnf9uZQl/Z8laSE+zwpqOHC4HhFU=";
+ AllowedIPs = [ "10.0.0.${peerId}/32" ];
+ PersistentKeepalive = 15;
+ };
+ };
+ };
+ networks = {
+ "99-nope" = {
+ matchConfig.Name = "eth*";
+ linkConfig.Unmanaged = true;
+ };
+ "90-wg0" = {
+ matchConfig = { Name = "wg0"; };
+ address = [ "10.0.0.${nodeId}/32" ];
+ routes = [
+ { routeConfig = { Gateway = "10.0.0.${nodeId}"; Destination = "10.0.0.0/24"; }; }
+ ];
+ };
+ "90-eth1" = {
+ matchConfig = { Name = "eth1"; };
+ address = [ "192.168.1.${nodeId}/24" ];
+ };
+ };
+ };
+ };
+in import ./make-test.nix ({pkgs, ... }: {
+ name = "networkd-wireguard";
+ meta = with pkgs.stdenv.lib.maintainers; {
+ maintainers = [ ninjatrappeur ];
+ };
+ nodes = {
+ node1 = { pkgs, ... }@attrs:
+ let localConf = {
+ privkpath = pkgs.writeText "priv.key" "GDiXWlMQKb379XthwX0haAbK6hTdjblllpjGX0heP00=";
+ pubk = "iRxpqj42nnY0Qz8MAQbSm7bXxXP5hkPqWYIULmvW+EE=";
+ nodeId = "1";
+ peerId = "2";
+ };
+ in generateNodeConf (attrs // localConf);
+
+ node2 = { pkgs, ... }@attrs:
+ let localConf = {
+ privkpath = pkgs.writeText "priv.key" "eHxSI2jwX/P4AOI0r8YppPw0+4NZnjOxfbS5mt06K2k=";
+ pubk = "27s0OvaBBdHoJYkH9osZpjpgSOVNw+RaKfboT/Sfq0g=";
+ nodeId = "2";
+ peerId = "1";
+ };
+ in generateNodeConf (attrs // localConf);
+ };
+testScript = ''
+ startAll;
+ $node1->waitForUnit('systemd-networkd-wait-online.service');
+ $node2->waitForUnit('systemd-networkd-wait-online.service');
+ $node1->succeed('ping -c 5 10.0.0.2');
+ $node2->succeed('ping -c 5 10.0.0.1');
+ # Is the fwmark set?
+ $node2->succeed('wg | grep -q 42');
+'';
+})