cilly/flakes
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

system/wireguard: refactor, and add hazel

Browse source
This commit is contained in:
LavaDesu 2025-05-23 00:03:52 +10:00
parent 718437153f
commit 7aa3a988fe
Signed by: cilly
GPG key ID: 6500251E087653C9
1 changed files with 27 additions and 23 deletions
Download patch file Download diff file Expand all files Collapse all files

50
modules/system/wireguard.nix
View file

@ -25,30 +25,45 @@ let
hyacinth = {
publicKey = "6nVhazYdmC15A/nke9VrqIg3sOBVOmqj4GEsyBq7MVo=";
allowedIPs = [ "10.100.0.3/32" "${gcSecrets.wireguard.ipv6Subnet}:3" "fd0d::3" ];
interfaces = {
wg0 = { peers = [ server6OnlyPeer ]; };
wg1 = { peers = [ serverPeer ]; autostart = false; };
};
};
anemone = {
publicKey = "px5+JNdAmqBvUC++DhiJrUBRAr+BYP6iYVt4sbhPTWY=";
allowedIPs = [ "10.100.0.4/32" "${gcSecrets.wireguard.ipv6Subnet}:4" "fd0d::4" ];
interfaces = {
wg0 = { peers = [ server6OnlyPeer ]; };
wg1 = { peers = [ serverPeer ]; autostart = false; };
};
};
hibiscus = {
publicKey = "vQ5a2KMrwi7RCRsD0yvog+n35vQYFuvwiPn+W4lbRBw=";
allowedIPs = [ "10.100.0.5/32" "${gcSecrets.wireguard.ipv6Subnet}:5" "fd0d::5" ];
interfaces = {
wg0 = { peers = [ server6OnlyPeer ]; };
wg1 = { peers = [ serverPeer ]; autostart = false; };
};
};
hazel = {
publicKey = "vQ5a2KMrwi7RCRsD0yvog+n35vQYFuvwiPn+W4lbRBw=";
allowedIPs = [ "10.100.0.21/32" "${gcSecrets.wireguard.ipv6Subnet}:21" "fd0d::21" ];
interfaces = {
wg0 = { peers = [ (serverPeerWith [ "10.100.0.0/24" "fd0d::/16" ]) ]; };
};
};
};
clientPeers = builtins.attrValues clients;
serverPeer = {
serverPeerWith = ips: {
publicKey = "3ugIk2tQZXjAH9/95s63ld2WNUHQrd4Mz5jzbln6oj0=";
allowedIPs = [ "0.0.0.0/0" "::/0" ];
endpoint = "${serverIp}:${toString port}";
persistentKeepalive = 25;
};
server6OnlyPeer = {
publicKey = "3ugIk2tQZXjAH9/95s63ld2WNUHQrd4Mz5jzbln6oj0=";
allowedIPs = [ "::/0" ];
allowedIPs = ips;
endpoint = "${serverIp}:${toString port}";
persistentKeepalive = 25;
};
serverPeer = serverPeerWith [ "0.0.0.0/0" "::/0" ];
server6OnlyPeer = serverPeerWith [ "10.100.0.0/24" "::/0" ];
serverConfig = {
nat = {
@ -83,23 +98,12 @@ let
wg-quick.interfaces =
let
client = clients."${config.networking.hostName}";
in {
wg0 = {
in
builtins.mapAttrs (interface: conf: {
address = client.allowedIPs;
dns = [ "fd0d::1" "10.100.0.1" ];
privateKeyFile = config.age.secrets."wg_${config.networking.hostName}".path;
peers = [ server6OnlyPeer ];
};
wg1 = {
address = client.allowedIPs;
dns = [ "fd0d::1" "10.100.0.1" ];
privateKeyFile = config.age.secrets."wg_${config.networking.hostName}".path;
peers = [ serverPeer ];
autostart = false;
};
};
} // conf) client.interfaces;
};
in {
boot.kernel.sysctl = lib.mkIf (config.networking.hostName == serverName) ({
@ -109,6 +113,6 @@ in {
networking =
lib.mkMerge [
(lib.mkIf (config.networking.hostName == serverName) serverConfig)
(lib.mkIf (builtins.hasAttr config.networking.hostName clients) clientConfig)
(lib.mkIf (config.networking.hostName != serverName) clientConfig)
];
}