diff options
| author | seb314 <sebastian.bachem@tum.de> | 2021-10-02 13:34:25 +0200 |
|---|---|---|
| committer | github-actions[bot] <github-actions[bot]@users.noreply.github.com> | 2022-12-02 15:55:13 +0000 |
| commit | f151c80c345ffb88bfd13d684690c4a8e7286542 (patch) | |
| tree | 2b715fa0c6b13079f2a8ee2d277de5613a326f92 | |
| parent | Merge pull request #204095 from NixOS/backport-204089-to-release-22.11 (diff) | |
| download | nixpkgs-origin/backport-140890-to-release-22.11.tar.gz | |
wireguard: when dyn-dns refresh is enabled, reconnect after failuresorigin/backport-140890-to-release-22.11
Make the dynamic-dns refresh systemd service (controlled via the
preexisting option dynamicEndpointRefreshSecond) robust to e.g. dns
failures that happen on intermittent network connections.
Background:
When dns resolution fails with a 'permanent' error ("Name or service not
known" instead of "Temporary failure in name resolution"), wireguard
won't retry despite WG_ENDPOINT_RESOLUTION_RETRIES=infinity.
-> This change should improve reliability/connectivity.
somewhat related thread: https://github.com/NixOS/nixpkgs/issues/63869
(cherry picked from commit 82c5c3c9a9b5309a329f8b247621b0f36fd9210e)
| -rw-r--r-- | nixos/modules/services/networking/wireguard.nix | 24 |
1 files changed, 24 insertions, 0 deletions
diff --git a/nixos/modules/services/networking/wireguard.nix b/nixos/modules/services/networking/wireguard.nix index e3c3d3ba3c96..ce5616672c16 100644 --- a/nixos/modules/services/networking/wireguard.nix +++ b/nixos/modules/services/networking/wireguard.nix @@ -251,6 +251,21 @@ let ''; }; + dynamicEndpointRefreshRestartSeconds = mkOption { + default = null; + example = 5; + type = with types; nullOr ints.unsigned; + description = lib.mdDoc '' + When the dynamic endpoint refresh that is configured via + dynamicEndpointRefreshSeconds exits (likely due to a failure), + restart that service after this many seconds. + + If set to `null` the value of + {option}`networking.wireguard.dynamicEndpointRefreshSeconds` + will be used as the default. + ''; + }; + persistentKeepalive = mkOption { default = null; type = with types; nullOr int; @@ -348,7 +363,16 @@ let # cannot be used with systemd timers (see `man systemd.timer`), # which is why `simple` with a loop is the best choice here. # It also makes starting and stopping easiest. + # + # Restart if the service exits (e.g. when wireguard gives up after "Name or service not known" dns failures): + Restart = "always"; + RestartSec = if null != peer.dynamicEndpointRefreshRestartSeconds + then peer.dynamicEndpointRefreshRestartSeconds + else peer.dynamicEndpointRefreshSeconds; }; + unitConfig = lib.optionalAttrs dynamicRefreshEnabled { + StartLimitIntervalSec = 0; + }; script = let wg_setup = concatStringsSep " " ( |