nix/nixos/hosts/osaka-linode-01/wireguard.nix

81 lines
2.6 KiB
Nix
Raw Normal View History

2024-07-07 04:11:15 +02:00
{ hostname, pkgs, ... }: {
2023-12-11 13:07:16 +01:00
# Allow these hosts to directly communicate with their hostnames
2023-12-11 13:09:56 +01:00
networking.extraHosts = ''
2024-07-07 08:19:50 +02:00
10.100.0.1 osaka-linode-01
2024-03-28 05:24:18 +01:00
10.100.0.2 headscale.sysctl.io
2024-07-07 08:19:50 +02:00
10.100.0.3 backups-rpi4
10.100.0.4 frankfurt-linode-01
2023-12-11 13:07:16 +01:00
'';
2023-12-05 05:27:06 +01:00
networking.firewall.allowedUDPPorts = [ 51820 ];
networking.firewall.interfaces.wireguard0.allowedTCPPorts = [ 22 ];
# Set up the secrets file:
2024-01-12 09:23:27 +01:00
sops.secrets."wireguard_key" = {
2023-12-05 05:27:06 +01:00
owner = "root";
2024-07-07 04:11:15 +02:00
sopsFile = ../../../secrets/hosts/${hostname}.yaml;
2023-12-05 05:27:06 +01:00
};
2024-01-12 09:23:27 +01:00
sops.secrets."preshared_key" = {
2023-12-05 05:27:06 +01:00
owner = "root";
sopsFile = ../../../secrets/wireguard.yaml;
};
# Wireguard Forwarder
boot.kernel.sysctl = {
"net.ipv4.conf.all.forwarding" = 1;
"net.ipv4.conf.default.forwarding" = 1;
};
networking.wireguard = {
enable = true;
interfaces = {
"wireguard0" = {
2024-03-30 15:53:56 +01:00
ips = [
"10.100.0.1/24"
"10.100.1.1/24"
];
2023-12-05 05:27:06 +01:00
listenPort = 51820;
2024-01-12 09:23:27 +01:00
privateKeyFile = "/run/secrets/wireguard_key";
2024-03-30 07:27:21 +01:00
postSetup = ''${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -o enp0s4 -j MASQUERADE'';
postShutdown = ''${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -o enp0s4 -j MASQUERADE'';
2023-12-05 05:27:06 +01:00
peers = [
2024-07-07 04:11:15 +02:00
{ # framework-server / ovh-server
2023-12-05 05:27:06 +01:00
publicKey = "trHvfNtQ7HKMiJjxEXo2Iubq5G6egjx7gHiBlDmJ5Ek=";
2024-01-12 09:23:27 +01:00
presharedKeyFile = "/run/secrets/preshared_key";
2023-12-05 05:27:06 +01:00
allowedIPs = [ "10.100.0.2/32" ];
2024-03-30 15:53:56 +01:00
persistentKeepalive = 5;
2023-12-05 05:27:06 +01:00
}
{ # backups-rpi4
2024-01-29 08:30:25 +01:00
publicKey = "cqocpMyY8Z0Jl0hoAdghn3dR3VhkkOYyeSwW6UKk9Fs=";
presharedKeyFile = "/run/secrets/preshared_key";
allowedIPs = [ "10.100.0.3/32" ];
2024-03-30 15:53:56 +01:00
persistentKeepalive = 5;
}
{ # framewrk-server docker:wg-enshrouded
publicKey = "ucV6LgUwSbEyyxPlS83OayFPK6ysQKu6cVBV97S07mI=";
presharedKeyFile = "/run/secrets/preshared_key";
allowedIPs = [ "10.100.1.2/32" ];
persistentKeepalive = 5;
}
2024-04-17 07:51:37 +02:00
{ # framewrk-server docker:wg-mailserver
publicKey = "5C1ft3LIGmyFwi00pyLeYjvJpqHLTQFNMRlXlva6uEI=";
presharedKeyFile = "/run/secrets/preshared_key";
allowedIPs = [ "10.100.1.3/32" ];
persistentKeepalive = 5;
}
2024-08-26 14:46:56 +02:00
{ # framework-server docker:wg-vintage-story
publicKey = "jv36MtY5XV18jirGm7nJTgePJEobhhVd1rf53EUxY1U=";
presharedKeyFile = "/run/secrets/preshared_key";
allowedIPs = [ "10.100.1.5/32" ];
persistentKeepalive = 5;
}
2023-12-05 05:27:06 +01:00
];
};
};
};
2024-03-25 01:46:12 +01:00
}
2024-04-17 07:51:37 +02:00
2024-08-26 14:46:56 +02:00