cilly/flakes
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

system/wireguard: bring back, with ipv6 support

Browse source
This commit is contained in:
LavaDesu 2025-05-20 02:34:18 +10:00
parent 8b0dfd5661
commit 9217ce6e91
Signed by: cilly
GPG key ID: 6500251E087653C9
14 changed files with 49 additions and 48 deletions
Download patch file Download diff file Expand all files Collapse all files

56
modules/system/wireguard.nix
View file

@ -1,14 +1,12 @@
{ config, lib, pkgs, ... }:
{ config, lib, pkgs, gcSecrets, ... }:
let
port = 51820;
serverName = "sugarcane";
serverInterface = "ens3";
serverIp = "51.79.240.130";
serverName = "dandelion";
serverInterface = "enp0s6";
serverIp = gcSecrets.wireguard.gateway;
forwarding = {
"80" = [ "10.100.0.2" "80" ];
"443" = [ "10.100.0.2" "443" ];
"22727" = [ "10.100.0.3" "7777" ];
# "22727" = [ "10.100.0.3" "7777" ];
};
mapForwards = type:
@ -24,45 +22,39 @@ let
);
routeBypass = {
caramel = {
gateway = "192.168.100.1";
interface = "wlan0";
routes = [
serverIp
];
anemone = {
interface = "wlp1s0";
routes = [ serverIp ];
};
hyacinth = {
gateway = "192.168.100.1";
interface = "enp5s0";
routes = [
serverIp
];
routes = [ serverIp ];
};
};
clients = {
caramel = {
publicKey = "VDqcpS0lJzFgwikj61MJ1xc9P8Cuq0NXa+Hc+etn2iA=";
allowedIPs = [ "10.100.0.2/32" ];
};
# caramel = {
# publicKey = "VDqcpS0lJzFgwikj61MJ1xc9P8Cuq0NXa+Hc+etn2iA=";
# allowedIPs = [ "10.100.0.2/32" ];
# };
hyacinth = {
publicKey = "6nVhazYdmC15A/nke9VrqIg3sOBVOmqj4GEsyBq7MVo=";
allowedIPs = [ "10.100.0.3/32" ];
allowedIPs = [ "10.100.0.3/32" "${gcSecrets.wireguard.ipv6Subnet}:3"];
};
strawberry = {
anemone = {
publicKey = "Fkcp/VSN4Dkhly8V4hskF4lnDviA7VZHCnWf7OliFCg=";
allowedIPs = [ "10.100.0.4/32" ];
allowedIPs = [ "10.100.0.4/32" "${gcSecrets.wireguard.ipv6Subnet}:4" ];
};
maple = {
publicKey = "kPw8hpANygfz83Oi/l+iCVYalV2zfs7fhkccjoGG2Do=";
allowedIPs = [ "10.100.0.5/32" ];
hibiscus = {
publicKey = "vQ5a2KMrwi7RCRsD0yvog+n35vQYFuvwiPn+W4lbRBw=";
allowedIPs = [ "10.100.0.5/32" "${gcSecrets.wireguard.ipv6Subnet}:5" ];
};
};
clientPeers = builtins.attrValues clients;
serverPeer = {
publicKey = "3ugIk2tQZXjAH9/95s63ld2WNUHQrd4Mz5jzbln6oj0=";
allowedIPs = [ "0.0.0.0/0" ];
allowedIPs = [ "0.0.0.0/0" "::/0" ];
endpoint = "${serverIp}:${toString port}";
persistentKeepalive = 25;
};
@ -79,7 +71,7 @@ let
};
wireguard.interfaces.wg0 = {
ips = [ "10.100.0.1/24" ];
ips = [ "10.100.0.1/24" "${gcSecrets.wireguard.ipv6Subnet}:1" ];
listenPort = port;
postSetup = ''
@ -101,7 +93,7 @@ let
let
client = clients."${config.networking.hostName}";
routes = routeBypass."${config.networking.hostName}";
mapRoutes = type: lib.concatMapStringsSep "\n" (r: "${pkgs.iproute2}/bin/ip route ${type} ${r} via ${routes.gateway} dev ${routes.interface}") routes.routes;
mapRoutes = type: lib.concatMapStringsSep "\n" (r: "${pkgs.iproute2}/bin/ip route ${type} ${r} dev ${routes.interface}") routes.routes;
in {
ips = client.allowedIPs;
listenPort = port;
@ -121,6 +113,10 @@ let
};
};
in {
boot.kernel.sysctl = lib.mkIf (config.networking.hostName == serverName) ({
"net.ipv6.conf.all.forwarding" = true;
"net.ipv6.conf.default.forwarding" = true;
});
networking =
lib.mkMerge [
(lib.mkIf (config.networking.hostName == serverName) serverConfig)