albert/nix
albert/nix
1
0
Fork 0
Code Issues Pull requests Activity Actions

Testing Wireguard

Browse source
This commit is contained in:
iFargle 2023-10-06 13:04:39 +09:00
parent 2a470a3ff1
commit 37391cf226
2 changed files with 23 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
nixos/hosts/nixos-rpi4-01/default.nix
View file

@ -52,7 +52,7 @@
# networking.firewall.allowedTCPPorts = [ 22 ]; # networking.firewall.allowedTCPPorts = [ 22 ];
# Set up the secrets file: # Set up the secrets file:
sops.secrets."wireguard_keys/osaka-vultr-01/private" = { sops.secrets."wireguard_keys/osaka-vultr-01" = {
owner = "root"; owner = "root";
sopsFile = ../../../secrets/wireguard.yaml; sopsFile = ../../../secrets/wireguard.yaml;
}; };
@ -61,14 +61,17 @@
networking.wireguard = { networking.wireguard = {
enable = true; enable = true;
interfaces = { interfaces = {
"exit" = { "wireguard0" = {
privateKeyFile = "/run/secrets/wireguard_keys/nixos-rpi4-01"; privateKeyFile = "/run/secrets/wireguard_keys/nixos-rpi4-01";
# Testing # Testing
peers."osaka-vultr-01" = { peers = [
publicKey = ""; { # osaka-vultr-01
persistentKeepalive = 5; publicKey = "";
endpoint = "64.176.54.57:51820" persistentKeepalive = 5;
}; allowedIPs = [ "0.0.0.0/0" ];
endpoint = "64.176.54.57:51820";
}
]
}; };
}; };
}; };

19
nixos/hosts/osaka-vultr-01/default.nix
View file

@ -19,7 +19,7 @@
networking.firewall.allowedUDPPorts = [ 51820 ]; networking.firewall.allowedUDPPorts = [ 51820 ];
# Set up the secrets file: # Set up the secrets file:
sops.secrets."wireguard_keys/osaka-vultr-01/private" = { sops.secrets."wireguard_keys/osaka-vultr-01" = {
owner = "root"; owner = "root";
sopsFile = ../../../secrets/wireguard.yaml; sopsFile = ../../../secrets/wireguard.yaml;
}; };
@ -29,13 +29,20 @@
networking.wireguard = { networking.wireguard = {
enable = true; enable = true;
interfaces = { interfaces = {
"exit" = { "wireguard0" = {
ips = [ "10.100.0.1/24 "];
listenPort = 51820;
postSetup = ''${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -o eno3 -j MASQUERADE'';
postShutdown = ''${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.100.0.0/24 -o eno3 -j MASQUERADE'';
privateKeyFile = "/run/secrets/wireguard_keys/osaka-vultr-01"; privateKeyFile = "/run/secrets/wireguard_keys/osaka-vultr-01";
# Testing # Testing
peers."nixos-rpi4-01" = { peers = [
publicKey = ""; { # nixos-rpi4-01
persistentKeepalive = 5; publicKey = "";
}; allowedIPs = [ "10.100.0.2/32" ];
persistentKeepalive = 5;
}
];
}; };
}; };
}; };