albert/nix
albert/nix
1
0
Fork 0
Code Issues Pull requests Activity Actions

Update wireguard link

Browse source
This commit is contained in:
iFargle 2024-01-12 17:23:27 +09:00
parent e3cd22141c
commit d8e5475667
2 changed files with 10 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
nixos/hosts/framework-server/wireguard.nix
View file

@ -9,11 +9,11 @@
networking.firewall.interfaces.wireguard0.allowedTCPPorts = [ 22 ]; networking.firewall.interfaces.wireguard0.allowedTCPPorts = [ 22 ];
# Set up the secrets file: # Set up the secrets file:
sops.secrets."wireguard_keys/framework-server" = { sops.secrets."wireguard_key" = {
owner = "root"; owner = "root";
sopsFile = ../../../secrets/wireguard.yaml; sopsFile = ../../../secrets/hosts/framework-server.yaml;
}; };
sops.secrets."wireguard_keys/preshared_key" = { sops.secrets."preshared_key" = {
owner = "root"; owner = "root";
sopsFile = ../../../secrets/wireguard.yaml; sopsFile = ../../../secrets/wireguard.yaml;
}; };
@ -26,12 +26,12 @@
"wireguard0" = { "wireguard0" = {
ips = [ "10.100.0.2/24" ]; ips = [ "10.100.0.2/24" ];
listenPort = 51820; listenPort = 51820;
privateKeyFile = "/run/secrets/wireguard_keys/framework-server"; privateKeyFile = "/run/secrets/wireguard_key";
# Testing # Testing
peers = [ peers = [
{ # osaka-linode-01 { # osaka-linode-01
publicKey = "yPZ3EmmIqCkReXf1DRTxzVaKQ2k+ifGmYJHji5nnMmE="; publicKey = "yPZ3EmmIqCkReXf1DRTxzVaKQ2k+ifGmYJHji5nnMmE=";
presharedKeyFile = "/run/secrets/wireguard_keys/preshared_key"; presharedKeyFile = "/run/secrets/preshared_key";
persistentKeepalive = 5; persistentKeepalive = 5;
allowedIPs = [ "10.100.0.1/32" ]; allowedIPs = [ "10.100.0.1/32" ];
endpoint = "172.234.84.222:51820"; # osaka-linode-01 endpoint = "172.234.84.222:51820"; # osaka-linode-01

10
nixos/hosts/osaka-linode-01/wireguard.nix
View file

@ -15,12 +15,12 @@
networking.firewall.interfaces.wireguard0.allowedTCPPorts = [ 22 ]; networking.firewall.interfaces.wireguard0.allowedTCPPorts = [ 22 ];
# Set up the secrets file: # Set up the secrets file:
sops.secrets."wireguard_keys/osaka-linode-01" = { sops.secrets."wireguard_key" = {
owner = "root"; owner = "root";
sopsFile = ../../../secrets/wireguard.yaml; sopsFile = ../../../secrets/hosts/osaka-linode-01.yaml;
}; };
sops.secrets."wireguard_keys/preshared_key" = { sops.secrets."preshared_key" = {
owner = "root"; owner = "root";
sopsFile = ../../../secrets/wireguard.yaml; sopsFile = ../../../secrets/wireguard.yaml;
}; };
@ -38,13 +38,13 @@
"wireguard0" = { "wireguard0" = {
ips = [ "10.100.0.1/24" ]; ips = [ "10.100.0.1/24" ];
listenPort = 51820; listenPort = 51820;
privateKeyFile = "/run/secrets/wireguard_keys/osaka-linode-01"; privateKeyFile = "/run/secrets/wireguard_key";
postSetup = ''${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -o enp0s4 -j MASQUERADE''; postSetup = ''${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -o enp0s4 -j MASQUERADE'';
postShutdown = ''${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.100.0.0/24 -o enp0s4 -j MASQUERADE''; postShutdown = ''${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.100.0.0/24 -o enp0s4 -j MASQUERADE'';
peers = [ peers = [
{ # nixos-rpi4-03 { # nixos-rpi4-03
publicKey = "trHvfNtQ7HKMiJjxEXo2Iubq5G6egjx7gHiBlDmJ5Ek="; publicKey = "trHvfNtQ7HKMiJjxEXo2Iubq5G6egjx7gHiBlDmJ5Ek=";
presharedKeyFile = "/run/secrets/wireguard_keys/preshared_key"; presharedKeyFile = "/run/secrets/preshared_key";
persistentKeepalive = 5; persistentKeepalive = 5;
allowedIPs = [ "10.100.0.2/32" ]; allowedIPs = [ "10.100.0.2/32" ];
} }