nixos/wireguard add endpointFile option

nixos/modules/services/networking/wireguard.nix

@@ -223,7 +223,30 @@ let
         type = with types; nullOr str;
         description = lib.mdDoc ''
           Endpoint IP or hostname of the peer, followed by a colon,
-          and then a port number of the peer.
+          and then a port number of the peer. Mutually exclusive with
+          "endpointFile".
+
+          Warning for endpoints with changing IPs:
+          The WireGuard kernel side cannot perform DNS resolution.
+          Thus DNS resolution is done once by the `wg` userspace
+          utility, when setting up WireGuard. Consequently, if the IP address
+          behind the name changes, WireGuard will not notice.
+          This is especially common for dynamic-DNS setups, but also applies to
+          any other DNS-based setup.
+          If you do not use IP endpoints, you likely want to set
+          {option}`networking.wireguard.dynamicEndpointRefreshSeconds`
+          to refresh the IPs periodically.
+        '';
+      };
+
+      endpointFile = mkOption {
+        default = null;
+        example = "/run/secrets/peer.address";
+        type = with types; nullOr str;
+        description = lib.mdDoc ''
+          File containing the endpoint IP or hostname of the peer,
+          followed by a colon, and then a port number of the peer. Mutally exclusive
+          with "endpoint".
 
           Warning for endpoints with changing IPs:
           The WireGuard kernel side cannot perform DNS resolution.
@@ -379,6 +402,7 @@ let
             [ ''${wg} set ${interfaceName} peer "${peer.publicKey}"'' ]
             ++ optional (psk != null) ''preshared-key "${psk}"''
             ++ optional (peer.endpoint != null) ''endpoint "${peer.endpoint}"''
+            ++ optional (peer.endpointFile != null) ''endpoint "$(cat ${peer.endpointFile})"''
             ++ optional (peer.persistentKeepalive != null) ''persistent-keepalive "${toString peer.persistentKeepalive}"''
             ++ optional (peer.allowedIPs != []) ''allowed-ips "${concatStringsSep "," peer.allowedIPs}"''
           );
@@ -565,6 +589,10 @@ in
         ++ map ({ interfaceName, peer, ... }: {
           assertion = (peer.presharedKey == null) || (peer.presharedKeyFile == null);
           message = "networking.wireguard.interfaces.${interfaceName} peer «${peer.publicKey}» has both presharedKey and presharedKeyFile set, but only one can be used.";
+        }) all_peers
+        ++ map ({ interfaceName, peer, ... }: {
+          assertion = (peer.endpoint == null) || (peer.endpointFile == null);
+          message = "networking.wireguard.interfaces.${interfaceName} peer «${peer.publicKey}» has both endpoint and endpointFile set, but only one can be used.";
         }) all_peers;
 
     boot.extraModulePackages = optional (versionOlder kernel.kernel.version "5.6") kernel.wireguard;

nixos/tests/wireguard/default.nix

@@ -13,6 +13,7 @@ let
     wg-quick = callTest ./wg-quick.nix;
     wg-quick-nftables = args: callTest ./wg-quick.nix ({ nftables = true; } // args);
     generated = callTest ./generated.nix;
+    file-config = callTest ./file-config.nix;
   };
 in
 

nixos/tests/wireguard/file-config.nix

@@ -0,0 +1,81 @@
+import ../make-test-python.nix ({ pkgs, lib, kernelPackages ? null, ...} :
+  let
+    wg-snakeoil-keys = import ./snakeoil-keys.nix;
+    peer = (import ./make-peer.nix) { inherit lib; };
+  in
+  {
+    name = "wireguard";
+    meta = with pkgs.lib.maintainers; {
+      maintainers = [ ma27 ];
+    };
+
+    nodes = {
+      peer0 = peer {
+        ip4 = "192.168.0.1";
+        ip6 = "fd00::1";
+        extraConfig = {
+          boot = lib.mkIf (kernelPackages != null) { inherit kernelPackages; };
+          environment.etc."wireguard/private".text =
+            wg-snakeoil-keys.peer0.privateKey;
+          environment.etc."wireguard/endpoint".text =
+            "[fd00::2]:23542";
+
+          networking.firewall.allowedUDPPorts = [ 23542 ];
+          networking.wireguard.interfaces.wg0 = {
+            ips = [ "10.23.42.1/32" "fc00::1/128" ];
+            listenPort = 23542;
+            privateKeyFile = "/etc/wireguard/private";
+            peers = lib.singleton {
+              allowedIPs = [ "10.23.42.2/32" "fc00::2/128" ];
+              endpointFile = "/etc/wireguard/endpoint";
+              inherit (wg-snakeoil-keys.peer1) publicKey;
+            };
+          };
+        };
+      };
+
+      peer1 = peer {
+        ip4 = "192.168.0.2";
+        ip6 = "fd00::2";
+        extraConfig = {
+          boot = lib.mkIf (kernelPackages != null) { inherit kernelPackages; };
+          environment.etc."wireguard/private".text =
+            wg-snakeoil-keys.peer1.privateKey;
+          environment.etc."wireguard/endpoint".text =
+            "192.168.0.1:23542";
+          networking.firewall.allowedUDPPorts = [ 23542 ];
+          networking.wireguard.interfaces.wg0 = {
+            ips = [ "10.23.42.2/32" "fc00::2/128" ];
+            listenPort = 23542;
+            allowedIPsAsRoutes = false;
+
+            privateKeyFile = "/etc/wireguard/private";
+
+            peers = lib.singleton {
+              allowedIPs = [ "0.0.0.0/0" "::/0" ];
+              endpointFile = "/etc/wireguard/endpoint";
+              persistentKeepalive = 25;
+
+              inherit (wg-snakeoil-keys.peer0) publicKey;
+            };
+
+            postSetup = let inherit (pkgs) iproute2; in ''
+              ${iproute2}/bin/ip route replace 10.23.42.1/32 dev wg0
+              ${iproute2}/bin/ip route replace fc00::1/128 dev wg0
+            '';
+          };
+        };
+      };
+    };
+
+    testScript = ''
+      start_all()
+
+      peer0.wait_for_unit("wireguard-wg0.service")
+      peer1.wait_for_unit("wireguard-wg0.service")
+
+      peer1.succeed("ping -c5 fc00::1")
+      peer1.succeed("ping -c5 10.23.42.1")
+    '';
+  }
+)