albert/nix
albert/nix
1
0
Fork 0
Code Issues Pull requests Activity Actions

Test SSL

Browse source
This commit is contained in:
iFargle 2023-10-09 10:31:53 +09:00
parent 9a6a06fa30
commit 81b0fcdcce
2 changed files with 15 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
nixos/hosts/nixos-rpi4-03/temp.nix
View file

@ -2,6 +2,11 @@
networking.firewall.interfaces.wireguard0.allowedTCPPorts = [ 80 443 ]; networking.firewall.interfaces.wireguard0.allowedTCPPorts = [ 80 443 ];
# networking.firewall.allowedTCPPorts = [ 80 443 ]; # networking.firewall.allowedTCPPorts = [ 80 443 ];
# Generate a test cert
# sudo openssl req -x509 -newkey rsa:4096 -sha256 -days 3650 \
# -nodes -keyout test-ssl.key -out test-ssl.crt -subj "/CN=test-ssl" \
# -addext "subjectAltName=DNS:test-ssl,DNS:*.test-ssl,IP:10.100.0.2"
services.nginx = { services.nginx = {
enable = true; enable = true;
httpConfig = '' httpConfig = ''
@ -12,6 +17,14 @@
server_name_in_redirect off; server_name_in_redirect off;
root /var/www/test; root /var/www/test;
} }
server {
listen 443 ssl;
server_name _;
server_name_in_redirect off;
root /var/www/test-ssl;
ssl_certificate /etc/ssl/nginx/test-ssl.crt;
ssl_certificate_key /etc/ssl/nginx/test-ssl.key;
}
''; '';
}; };
} }

9
nixos/hosts/osaka-vultr-01/wireguard.nix
View file

@ -18,7 +18,6 @@
"net.ipv4.conf.all.forwarding" = 1; "net.ipv4.conf.all.forwarding" = 1;
"net.ipv4.conf.default.forwarding" = 1; "net.ipv4.conf.default.forwarding" = 1;
}; };
networking.firewall.allowPing = true;
networking.wireguard = { networking.wireguard = {
enable = true; enable = true;
interfaces = { interfaces = {
@ -26,12 +25,8 @@
ips = [ "10.100.0.1/24" ]; ips = [ "10.100.0.1/24" ];
listenPort = 51820; listenPort = 51820;
privateKeyFile = "/run/secrets/wireguard_keys/osaka-vultr-01"; privateKeyFile = "/run/secrets/wireguard_keys/osaka-vultr-01";
postSetup = '' postSetup = ''${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -o eno3 -j MASQUERADE'';
${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -o eno3 -j MASQUERADE postShutdown = ''${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.100.0.0/24 -o eno3 -j MASQUERADE'';
'';
postShutdown = ''
${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.100.0.0/24 -o eno3 -j MASQUERADE
'';
peers = [ peers = [
{ # nixos-rpi4-03 { # nixos-rpi4-03
publicKey = "trHvfNtQ7HKMiJjxEXo2Iubq5G6egjx7gHiBlDmJ5Ek="; publicKey = "trHvfNtQ7HKMiJjxEXo2Iubq5G6egjx7gHiBlDmJ5Ek=";