cilly/flakes
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

system/wireguard: revamp to use sugarcane as host

Browse source
This commit is contained in:
LavaDesu 2022-02-02 16:51:32 +07:00
parent 5578ac4c3d
commit 43ac1228f4
Signed by: cilly
GPG key ID: 6500251E087653C9
1 changed files with 11 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

22
modules/system/wireguard.nix
View file

@ -1,13 +1,10 @@
{ config, lib, pkgs, ... }: { config, lib, pkgs, ... }:
let let
serverName = "fondue"; port = 51820;
serverInterface = "enp2s1"; serverName = "sugarcane";
serverInterface = "ens3";
clients = { clients = {
apricot = {
publicKey = "CpQJxoDeWJr7DdhbIO09svCxP7tuG2vUwRM8U4io5ms=";
allowedIPs = [ "10.100.0.2/32" ];
};
blossom = { blossom = {
publicKey = "6nVhazYdmC15A/nke9VrqIg3sOBVOmqj4GEsyBq7MVo="; publicKey = "6nVhazYdmC15A/nke9VrqIg3sOBVOmqj4GEsyBq7MVo=";
allowedIPs = [ "10.100.0.3/32" ]; allowedIPs = [ "10.100.0.3/32" ];
@ -20,9 +17,9 @@ let
clientPeers = builtins.attrValues clients; clientPeers = builtins.attrValues clients;
serverPeer = { serverPeer = {
publicKey = "GwUO/hU/CrrmfYazqrXuAiP4kFB3ZoaMXf13N12X2SY="; publicKey = "3ugIk2tQZXjAH9/95s63ld2WNUHQrd4Mz5jzbln6oj0=";
allowedIPs = [ "10.100.0.0/24" ]; allowedIPs = [ "0.0.0.0/0" ];
endpoint = "fondue.lava.moe:20100"; endpoint = "sugarcane.lava.moe:${toString port}";
persistentKeepalive = 25; persistentKeepalive = 25;
}; };
@ -32,10 +29,13 @@ let
externalInterface = serverInterface; externalInterface = serverInterface;
internalInterfaces = [ "wg0" ]; internalInterfaces = [ "wg0" ];
}; };
firewall = {
allowedUDPPorts = [ port ];
};
wireguard.interfaces.wg0 = { wireguard.interfaces.wg0 = {
ips = [ "10.100.0.1/24" ]; ips = [ "10.100.0.1/24" ];
listenPort = 20100; listenPort = port;
postSetup = '' postSetup = ''
${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -o ${serverInterface} -j MASQUERADE ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -o ${serverInterface} -j MASQUERADE
@ -52,7 +52,7 @@ let
clientConfig = { clientConfig = {
wireguard.interfaces.wg0 = { wireguard.interfaces.wg0 = {
ips = clients."${config.networking.hostName}".allowedIPs; ips = clients."${config.networking.hostName}".allowedIPs;
listenPort = 20100; listenPort = port;
privateKeyFile = config.age.secrets."wg_${config.networking.hostName}".path; privateKeyFile = config.age.secrets."wg_${config.networking.hostName}".path;
peers = [ serverPeer ]; peers = [ serverPeer ];