aciceri/nixfleet
1
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

Refactor Wireguard to make it use sisko as server

Browse source
This commit is contained in:
Andrea Ciceri 2023-12-13 13:55:27 +01:00
parent 0d3c1aae46
commit f05c12545a
Signed by: aciceri
SSH key fingerprint: SHA256:/AagBweyV4Hlfg9u092n8hbHwD5fcB6A3qhDiDA65Rg
29 changed files with 430 additions and 418 deletions
Download patch file Download diff file Expand all files Collapse all files

2
modules/cloudflare-dyndns/default.nix
View file

@ -9,7 +9,7 @@
"torrent.aciceri.dev"
"search.aciceri.dev"
"invidious.aciceri.dev"
"wireguard.aciceri.dev"
"vpn.aciceri.dev"
];
apiTokenFile = config.age.secrets.cloudflare-dyndns-api-token.path;
};

39
modules/wireguard-client/default.nix
View file

@ -1,27 +1,26 @@
{
config,
fleetFlake,
vpn,
...
}: {
networking.firewall = {
allowedUDPPorts = [51820];
};
networking.firewall.trustedInterfaces = ["wg0"];
networking.wireguard.interfaces = {
wg0 = {
ips = ["${(import "${fleetFlake}/lib").ips."${config.networking.hostName}"}/32"];
listenPort = 51820;
imports = [../wireguard-common];
privateKeyFile = config.age.secrets."${config.networking.hostName}-wireguard-private-key".path;
peers = [
{
publicKey = "O9V2PI7+vZm7gGn3f9SaTsJbVe9urf/jZkdXFz/mjVU=";
allowedIPs = ["10.100.0.0/24"];
endpoint = "mothership.aciceri.dev:51820";
persistentKeepalive = 25;
}
];
};
networking.wireguard.interfaces.wg0 = {
ips = ["${vpn.${config.networking.hostName}.ip}/32"];
# TODO having two peers like this a good idea? (they are the same host)
peers = [
{
publicKey = vpn.sisko.publicKey; # FIXME hardcoding `sisko` here
allowedIPs = ["10.100.0.0/24"];
endpoint = "vpn.aciceri.dev:51820";
persistentKeepalive = 25;
}
{
publicKey = vpn.sisko.publicKey; # FIXME hardcoding `sisko` here
allowedIPs = ["10.100.0.0/24"];
endpoint = "10.1.1.2:51820";
persistentKeepalive = 25;
}
];
};
}

21
modules/wireguard-common/default.nix Normal file
View file

@ -0,0 +1,21 @@
{config, ...}: {
networking.firewall.interfaces.wg0 = {
allowedUDPPortRanges = [
{
from = 0;
to = 65535;
}
];
allowedTCPPortRanges = [
{
from = 0;
to = 65535;
}
];
};
networking.wireguard.interfaces.wg0 = {
privateKeyFile = config.age.secrets."${config.networking.hostName}-wireguard-private-key".path;
listenPort = 51820;
};
}

63
modules/wireguard-server/default.nix
View file

@ -1,61 +1,22 @@
{
pkgs,
config,
fleetFlake,
lib,
vpn,
...
}: {
imports = [../wireguard-common];
networking.nat.enable = true;
networking.nat.externalInterface = "enp5s0"; # mothership network interface, shouldn't be hardcoded here
networking.nat.internalInterfaces = ["wg0"];
networking.firewall = {
allowedUDPPorts = [51820];
interfaces.wg0 = {
allowedUDPPortRanges = [
{
from = 0;
to = 65535;
}
];
allowedTCPPortRanges = [
{
from = 0;
to = 65535;
}
];
};
};
networking.wireguard.interfaces = {
wg0 = {
ips = ["10.100.0.1/24"];
networking.firewall.allowedUDPPorts = [config.networking.wireguard.interfaces.wg0.listenPort]; # FIXME move this to wireguard-server
listenPort = 51820;
postSetup = ''
${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -o eth0 -j MASQUERADE
'';
postShutdown = ''
${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.100.0.0/24 -o eth0 -j MASQUERADE
'';
privateKeyFile = config.age.secrets."${config.networking.hostName}-wireguard-private-key".path;
peers = let
publicKeys = {
thinkpad = "g8wId6Rl0olRFRtAnQ046ihPRYFCtMxOJ+/Z9ARwIxI=";
oneplus6t = "O6/tKaA8Hs7OEqi15hV4RwviR6vyCTMYv6ZlhsI+tnI=";
rock5b = "bc5giljukT1+ChbbyTLdOfejfR3c8RZ4XoXmQM54nTY=";
pbp = "jvfAfQ2ykBndpnoLQTBJzDOhpjMOtIyCufEw+BxMxSc=";
babbo = "mb1BsvGurWVA6s3uXP1hdEi3YPpzM0vtXD/7Vfsw2HI=";
};
mkPeer = hostname: {
publicKey = publicKeys."${hostname}";
allowedIPs = ["${(import "${fleetFlake}/lib").ips."${hostname}"}/32"];
};
in
builtins.map mkPeer (lib.mapAttrsToList (hostname: _: hostname) publicKeys);
};
networking.wireguard.interfaces.wg0 = {
ips = ["${vpn.${config.networking.hostName}.ip}/24"];
peers =
lib.mapAttrsToList (hostname: vpnConfig: {
publicKey = vpnConfig.publicKey;
allowedIPs = ["${vpnConfig.ip}/32"];
})
vpn;
};
}