albert/nix
albert/nix
1
0
Fork 0
Code Issues Pull requests Activity Actions

Testing Wireguard

Browse source
This commit is contained in:
iFargle 2023-10-06 13:04:39 +09:00
parent 2a470a3ff1
commit 37391cf226
2 changed files with 23 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
nixos/hosts/nixos-rpi4-01/default.nix
View file

@ -52,7 +52,7 @@
# networking.firewall.allowedTCPPorts = [ 22 ];
# Set up the secrets file:
sops.secrets."wireguard_keys/osaka-vultr-01/private" = {
sops.secrets."wireguard_keys/osaka-vultr-01" = {
owner = "root";
sopsFile = ../../../secrets/wireguard.yaml;
};
@ -61,14 +61,17 @@
networking.wireguard = {
enable = true;
interfaces = {
"exit" = {
"wireguard0" = {
privateKeyFile = "/run/secrets/wireguard_keys/nixos-rpi4-01";
# Testing
peers."osaka-vultr-01" = {
publicKey = "";
persistentKeepalive = 5;
endpoint = "64.176.54.57:51820"
};
peers = [
{ # osaka-vultr-01
publicKey = "";
persistentKeepalive = 5;
allowedIPs = [ "0.0.0.0/0" ];
endpoint = "64.176.54.57:51820";
}
]
};
};
};

19
nixos/hosts/osaka-vultr-01/default.nix
View file

@ -19,7 +19,7 @@
networking.firewall.allowedUDPPorts = [ 51820 ];
# Set up the secrets file:
sops.secrets."wireguard_keys/osaka-vultr-01/private" = {
sops.secrets."wireguard_keys/osaka-vultr-01" = {
owner = "root";
sopsFile = ../../../secrets/wireguard.yaml;
};
@ -29,13 +29,20 @@
networking.wireguard = {
enable = true;
interfaces = {
"exit" = {
"wireguard0" = {
ips = [ "10.100.0.1/24 "];
listenPort = 51820;
postSetup = ''${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -o eno3 -j MASQUERADE'';
postShutdown = ''${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.100.0.0/24 -o eno3 -j MASQUERADE'';
privateKeyFile = "/run/secrets/wireguard_keys/osaka-vultr-01";
# Testing
peers."nixos-rpi4-01" = {
publicKey = "";
persistentKeepalive = 5;
};
peers = [
{ # nixos-rpi4-01
publicKey = "";
allowedIPs = [ "10.100.0.2/32" ];
persistentKeepalive = 5;
}
];
};
};
};