cilly/flakes
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

system/wireguard: refactor, and add hazel

Browse source
This commit is contained in:
LavaDesu 2025-05-23 00:03:52 +10:00
parent 718437153f
commit 7aa3a988fe
Signed by: cilly
GPG key ID: 6500251E087653C9
1 changed files with 27 additions and 23 deletions
Download patch file Download diff file Expand all files Collapse all files

50
modules/system/wireguard.nix
View file

@ -25,30 +25,45 @@ let
hyacinth = { hyacinth = {
publicKey = "6nVhazYdmC15A/nke9VrqIg3sOBVOmqj4GEsyBq7MVo="; publicKey = "6nVhazYdmC15A/nke9VrqIg3sOBVOmqj4GEsyBq7MVo=";
allowedIPs = [ "10.100.0.3/32" "${gcSecrets.wireguard.ipv6Subnet}:3" "fd0d::3" ]; allowedIPs = [ "10.100.0.3/32" "${gcSecrets.wireguard.ipv6Subnet}:3" "fd0d::3" ];
interfaces = {
wg0 = { peers = [ server6OnlyPeer ]; };
wg1 = { peers = [ serverPeer ]; autostart = false; };
};
}; };
anemone = { anemone = {
publicKey = "px5+JNdAmqBvUC++DhiJrUBRAr+BYP6iYVt4sbhPTWY="; publicKey = "px5+JNdAmqBvUC++DhiJrUBRAr+BYP6iYVt4sbhPTWY=";
allowedIPs = [ "10.100.0.4/32" "${gcSecrets.wireguard.ipv6Subnet}:4" "fd0d::4" ]; allowedIPs = [ "10.100.0.4/32" "${gcSecrets.wireguard.ipv6Subnet}:4" "fd0d::4" ];
interfaces = {
wg0 = { peers = [ server6OnlyPeer ]; };
wg1 = { peers = [ serverPeer ]; autostart = false; };
};
}; };
hibiscus = { hibiscus = {
publicKey = "vQ5a2KMrwi7RCRsD0yvog+n35vQYFuvwiPn+W4lbRBw="; publicKey = "vQ5a2KMrwi7RCRsD0yvog+n35vQYFuvwiPn+W4lbRBw=";
allowedIPs = [ "10.100.0.5/32" "${gcSecrets.wireguard.ipv6Subnet}:5" "fd0d::5" ]; allowedIPs = [ "10.100.0.5/32" "${gcSecrets.wireguard.ipv6Subnet}:5" "fd0d::5" ];
interfaces = {
wg0 = { peers = [ server6OnlyPeer ]; };
wg1 = { peers = [ serverPeer ]; autostart = false; };
};
};
hazel = {
publicKey = "vQ5a2KMrwi7RCRsD0yvog+n35vQYFuvwiPn+W4lbRBw=";
allowedIPs = [ "10.100.0.21/32" "${gcSecrets.wireguard.ipv6Subnet}:21" "fd0d::21" ];
interfaces = {
wg0 = { peers = [ (serverPeerWith [ "10.100.0.0/24" "fd0d::/16" ]) ]; };
};
}; };
}; };
clientPeers = builtins.attrValues clients; clientPeers = builtins.attrValues clients;
serverPeer = { serverPeerWith = ips: {
publicKey = "3ugIk2tQZXjAH9/95s63ld2WNUHQrd4Mz5jzbln6oj0="; publicKey = "3ugIk2tQZXjAH9/95s63ld2WNUHQrd4Mz5jzbln6oj0=";
allowedIPs = [ "0.0.0.0/0" "::/0" ]; allowedIPs = ips;
endpoint = "${serverIp}:${toString port}";
persistentKeepalive = 25;
};
server6OnlyPeer = {
publicKey = "3ugIk2tQZXjAH9/95s63ld2WNUHQrd4Mz5jzbln6oj0=";
allowedIPs = [ "::/0" ];
endpoint = "${serverIp}:${toString port}"; endpoint = "${serverIp}:${toString port}";
persistentKeepalive = 25; persistentKeepalive = 25;
}; };
serverPeer = serverPeerWith [ "0.0.0.0/0" "::/0" ];
server6OnlyPeer = serverPeerWith [ "10.100.0.0/24" "::/0" ];
serverConfig = { serverConfig = {
nat = { nat = {
@ -83,23 +98,12 @@ let
wg-quick.interfaces = wg-quick.interfaces =
let let
client = clients."${config.networking.hostName}"; client = clients."${config.networking.hostName}";
in { in
wg0 = { builtins.mapAttrs (interface: conf: {
address = client.allowedIPs; address = client.allowedIPs;
dns = [ "fd0d::1" "10.100.0.1" ]; dns = [ "fd0d::1" "10.100.0.1" ];
privateKeyFile = config.age.secrets."wg_${config.networking.hostName}".path; privateKeyFile = config.age.secrets."wg_${config.networking.hostName}".path;
} // conf) client.interfaces;
peers = [ server6OnlyPeer ];
};
wg1 = {
address = client.allowedIPs;
dns = [ "fd0d::1" "10.100.0.1" ];
privateKeyFile = config.age.secrets."wg_${config.networking.hostName}".path;
peers = [ serverPeer ];
autostart = false;
};
};
}; };
in { in {
boot.kernel.sysctl = lib.mkIf (config.networking.hostName == serverName) ({ boot.kernel.sysctl = lib.mkIf (config.networking.hostName == serverName) ({
@ -109,6 +113,6 @@ in {
networking = networking =
lib.mkMerge [ lib.mkMerge [
(lib.mkIf (config.networking.hostName == serverName) serverConfig) (lib.mkIf (config.networking.hostName == serverName) serverConfig)
(lib.mkIf (builtins.hasAttr config.networking.hostName clients) clientConfig) (lib.mkIf (config.networking.hostName != serverName) clientConfig)
]; ];
} }