nixos/wireguard: Add dynamicEndpointRefreshSeconds option

[nh2]

Motivation for this change

Implements refreshing the IP of DNS-based endpoints periodically, which WireGuard itself cannot do. It only does it once at the beginning when the wg utility is invoked.

See also ArchWiki: Endpoint with changing IP

Those also mention a script called reresolve-dns that is included in WireGuard's examples folder (but not packaged in nixpkgs); however, that does some pretty ugly shell-based config file parsing, and it is much cleaner to just periodically execute the wg set wg0 peer command we already construct in the module for initial setup.

Also included:

• A refactoring that implement correct shell argument quoting for all CLI invocations

Things done

• Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
• Built on platform(s)
  • NixOS
  • macOS
  • other Linux distributions
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
• Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Determined the impact on package closure size (by running nix path-info -S before and after)
• Ensured that relevant documentation is up to date
• Fits CONTRIBUTING.md.

[peterhoeg]

The feature is great, but turning the regular oneshot service into simple + sleep gives me a slightly bad taste in the mouth. How about this instead - leave the exiting units alone and then have a simple timer + oneshot that runs the wg set wg0 peer bit?

[nh2]

How about this instead - leave the exiting units alone and then have a simple timer + oneshot that runs the wg set wg0 peer bit?

@peterhoeg I am not in favour of it, because timers + oneshot do not work well with reliable automation:

• It is not easy to determine whether the DNS update loop is currently "running" or not. I need that for my NixOps setups; for example, I need other services to shut down if the Wireguard refresh stops working.
  Systemd gives us tools like Requires, BindsTo etc, to run something when a simple service is up, but none of those work well with timers and oneshots.
• systemd timers have bugs that stop them from working after a while, which I have already observed on NixOS in production, and which I cannot afford on important fundamental infrastructure services like VPN.

turning the regular oneshot service into simple + sleep gives me a slightly bad taste in the mouth

That surprises me a bit -- I found it quite sensible that a "do it once" configuration turns into a oneshot, and a "do it permanently" configuration turns into a simple.

[nh2]

How about this instead - leave the exiting units alone and then have a simple timer + oneshot that runs the wg set wg0 peer bit?

@peterhoeg I am not in favour of it, because timers + oneshot do not work well with reliable automation:

• It is not easy to determine whether the DNS update loop is currently "running" or not. I need that for my NixOps setups; for example, I need other services to shut down if the Wireguard refresh stops working.
  Systemd gives us tools like Requires, BindsTo etc, to run something when a simple service is up, but none of those work well with timers and oneshots.
• systemd timers have bugs that stop them from working after a while, which I have already observed on NixOS in production, and which I cannot afford on important fundamental infrastructure services like VPN.

turning the regular oneshot service into simple + sleep gives me a slightly bad taste in the mouth

That surprises me a bit -- I found it quite sensible that a "do it once" configuration turns into a oneshot, and a "do it permanently" configuration turns into a simple.

We could make a separate simple service though (with a different name), if that would be preferred, e.g. wireguard-${interfaceName}-peer-${unitName}-refresh or so.

[fricklerhandwerk]

Diff LGTM. Excellent documentation!

[nh2]

I've force-pushed out the timer, which was superfluous from my preivous implementation.

[nh2]

(with a different name), if that would be preferred, e.g. wireguard-${interfaceName}-peer-${unitName}-refresh

I have implemented this with the last force-push; the service is now suffixed -refresh if it's a simple.