aciceri/nixfleet
1
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

Refactor Wireguard to make it use sisko as server

Browse source
This commit is contained in:
Andrea Ciceri 2023-12-13 13:55:27 +01:00
parent 0d3c1aae46
commit f05c12545a
Signed by: aciceri
SSH key fingerprint: SHA256:/AagBweyV4Hlfg9u092n8hbHwD5fcB6A3qhDiDA65Rg
29 changed files with 430 additions and 418 deletions
Download patch file Download diff file Expand all files Collapse all files

39
modules/wireguard-client/default.nix
View file

@ -1,27 +1,26 @@
{
config,
fleetFlake,
vpn,
...
}: {
networking.firewall = {
allowedUDPPorts = [51820];
};
networking.firewall.trustedInterfaces = ["wg0"];
networking.wireguard.interfaces = {
wg0 = {
ips = ["${(import "${fleetFlake}/lib").ips."${config.networking.hostName}"}/32"];
listenPort = 51820;
imports = [../wireguard-common];
privateKeyFile = config.age.secrets."${config.networking.hostName}-wireguard-private-key".path;
peers = [
{
publicKey = "O9V2PI7+vZm7gGn3f9SaTsJbVe9urf/jZkdXFz/mjVU=";
allowedIPs = ["10.100.0.0/24"];
endpoint = "mothership.aciceri.dev:51820";
persistentKeepalive = 25;
}
];
};
networking.wireguard.interfaces.wg0 = {
ips = ["${vpn.${config.networking.hostName}.ip}/32"];
# TODO having two peers like this a good idea? (they are the same host)
peers = [
{
publicKey = vpn.sisko.publicKey; # FIXME hardcoding `sisko` here
allowedIPs = ["10.100.0.0/24"];
endpoint = "vpn.aciceri.dev:51820";
persistentKeepalive = 25;
}
{
publicKey = vpn.sisko.publicKey; # FIXME hardcoding `sisko` here
allowedIPs = ["10.100.0.0/24"];
endpoint = "10.1.1.2:51820";
persistentKeepalive = 25;
}
];
};
}