From c16d8513d226a386624988a063f62e0bfa170b0b Mon Sep 17 00:00:00 2001 From: Antoine Martin Date: Tue, 13 Jul 2021 23:51:17 +0200 Subject: [PATCH] services: wireguard: removed unused module replaced by tailscale --- .gitattributes | 1 - README.org | 2 - hosts/boreal/default.nix | 17 ------ hosts/poseidon/default.nix | 17 ------ secrets/default.nix | 2 - secrets/wireguard.nix | Bin 804 -> 0 bytes services/default.nix | 1 - services/wireguard.nix | 122 ------------------------------------- 8 files changed, 162 deletions(-) delete mode 100644 secrets/wireguard.nix delete mode 100644 services/wireguard.nix diff --git a/.gitattributes b/.gitattributes index fdfc04b..dca0b4c 100644 --- a/.gitattributes +++ b/.gitattributes @@ -1,4 +1,3 @@ secrets/**/*.secret filter=git-crypt diff=git-crypt secrets/matrix-email-config.nix filter=git-crypt diff=git-crypt -secrets/wireguard.nix filter=git-crypt diff=git-crypt home/secrets/*.secret filter=git-crypt diff=git-crypt diff --git a/README.org b/README.org index 16dad36..dc9d8ff 100644 --- a/README.org +++ b/README.org @@ -42,5 +42,3 @@ RSS reader Grafana and Prometheus are currently used as a glorified =htop=. ** Nextcloud - -** Wireguard VPN diff --git a/hosts/boreal/default.nix b/hosts/boreal/default.nix index 1640821..2cb59ee 100644 --- a/hosts/boreal/default.nix +++ b/hosts/boreal/default.nix @@ -83,23 +83,6 @@ in pipewire.enable = true; tailscale.enable = true; - - wireguard = { - enable = false; - iface = "wg"; - port = 51820; - - net = { - v4 = { - subnet = "10.0.0"; - mask = 24; - }; - v6 = { - subnet = "fd42:42:42"; - mask = 64; - }; - }; - }; }; services = { diff --git a/hosts/poseidon/default.nix b/hosts/poseidon/default.nix index c5d6b97..b81dbf3 100644 --- a/hosts/poseidon/default.nix +++ b/hosts/poseidon/default.nix @@ -134,23 +134,6 @@ in username = "alarsyo"; password = secrets.transmission-password; }; - - wireguard = { - enable = true; - iface = "wg"; - port = 51820; - - net = { - v4 = { - subnet = "10.0.0"; - mask = 24; - }; - v6 = { - subnet = "fd42:42:42"; - mask = 64; - }; - }; - }; }; # Enable the OpenSSH daemon. diff --git a/secrets/default.nix b/secrets/default.nix index 9df6f72..547eb06 100644 --- a/secrets/default.nix +++ b/secrets/default.nix @@ -18,8 +18,6 @@ with lib; borg-backup = import ./borg-backup { inherit lib; }; - wireguard = pkgs.callPackage ./wireguard.nix { }; - matrixEmailConfig = import ./matrix-email-config.nix; }; } diff --git a/secrets/wireguard.nix b/secrets/wireguard.nix deleted file mode 100644 index 3a19c0574538b092f51f8d4a56fd1e7ca937d541..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 804 zcmV+<1Ka!nM@dveQdv+`0B+|5#1-Yk$R3Sz_=9W zbq>I%OvTf|#`EL}9_Ptz2u5EQD_Puzu^K>1E|u2RbDc1kTAv44`u{bSgn{3p0oAwLFEe zzM^!@1#iOMU{o#@l)0^5;c%6H;iG3B3ZQZLed(e2V4>79p{2!%gJhz)3;Jc{D}w!h z(pm8-nH~O-m33YCMEyZ`jX>)G*D|}VvodqDxn@aUm5?;uh&ze#B3PjQ9dUdYiD_g= z2btAB3s@@{E2%9J@l12ApPs2zut0KQpX~KMh1Wy z;%{93wpqum2~cN_1?qaLtPvhbtVBNVMcKjEtUd{gLlaLCGT|Ia25iG29%kUWVt5|$ z0=`Z9Z}Q?=vFYsb!Tr?g-jrQ1PFjb7-V8dKwQ&woWD`Eekqh4{yLsD)X78S+t{KTW z#&9AtCk3p_+2WIl1BF~dSu3(ly!yH73U!w;{1`KM5Tjib<$OhS?T3|%#Q*MT_Rra@Z1iLo*6`F)1i>C=)kiun3TE11NS&t$}U0HbW^7ewn~Jh8o`sj#@)4Yd|*60E3_!Oj=7np%nYL$FDR3tjBhTCV|k-(>{|A zRd(EBigP`De>c>CYGe%=L|*{t|1Ki>ml0|=-rUI@22}IE`-y=bN2o22C}L+UXmfOc ir|+yjXnJ`6DCYfKZmY&!#N1(Rk9+*1yBf{2Ons@^V2>RD diff --git a/services/default.nix b/services/default.nix index c108814..79b72f4 100644 --- a/services/default.nix +++ b/services/default.nix @@ -22,6 +22,5 @@ ./tailscale.nix ./tgv.nix ./transmission.nix - ./wireguard.nix ]; } diff --git a/services/wireguard.nix b/services/wireguard.nix deleted file mode 100644 index 9d13b55..0000000 --- a/services/wireguard.nix +++ /dev/null @@ -1,122 +0,0 @@ -# Stolen from: -# -# https://gitea.belanyi.fr/ambroisie/nix-config/src/branch/main/services/wireguard.nix - -{ config, lib, pkgs, ... }: -let - cfg = config.my.services.wireguard; - hostName = config.networking.hostName; - - peers = config.my.secrets.wireguard.peers; - thisPeer = peers."${hostName}"; - otherPeers = lib.filterAttrs (name: _: name != hostName) peers; - - extIface = config.my.networking.externalInterface; -in -{ - options.my.services.wireguard = with lib; { - enable = mkEnableOption "Wireguard VPN service"; - - iface = mkOption { - type = types.str; - default = "wg"; - example = "wg0"; - description = "Name of the interface to configure"; - }; - - port = mkOption { - type = types.port; - default = 51820; - example = 55555; - description = "Port to configure for Wireguard"; - }; - - net = { - v4 = { - subnet = mkOption { - type = types.str; - default = "10.0.0"; - example = "10.100.0"; - description = "Which prefix to use for internal IPs"; - }; - mask = mkOption { - type = types.int; - default = 24; - example = 28; - description = "The CIDR mask to use on internal IPs"; - }; - }; - v6 = { - subnet = mkOption { - type = types.str; - default = "fd42:42:42"; - example = "fdc9:281f:04d7:9ee9"; - description = "Which prefix to use for internal IPs"; - }; - mask = mkOption { - type = types.int; - default = 64; - example = 68; - description = "The CIDR mask to use on internal IPs"; - }; - }; - }; - }; - - config.networking = lib.mkIf cfg.enable { - wg-quick.interfaces."${cfg.iface}" = { - listenPort = cfg.port; - address = with cfg.net; with lib; [ - "${v4.subnet}.${toString thisPeer.clientNum}/${toString v4.mask}" - "${v6.subnet}::${toString thisPeer.clientNum}/${toHexString v6.mask}" - ]; - privateKey = thisPeer.privateKey; - - peers = lib.mapAttrsToList - (name: peer: { - inherit (peer) publicKey; - } // lib.optionalAttrs (thisPeer ? externalIp) { - # Only forward from server to clients - allowedIPs = with cfg.net; [ - "${v4.subnet}.${toString peer.clientNum}/32" - "${v6.subnet}::${toString peer.clientNum}/128" - ]; - } // lib.optionalAttrs (peer ? externalIp) { - # Known addresses - endpoint = "${peer.externalIp}:${toString cfg.port}"; - } // lib.optionalAttrs (!(thisPeer ? externalIp)) { - # Forward all traffic to server - allowedIPs = with cfg.net; [ - "0.0.0.0/0" - "::/0" - ]; - # Roaming clients need to keep NAT-ing active - persistentKeepalive = 10; - }) - otherPeers; - } // lib.optionalAttrs (thisPeer ? externalIp) { - # Setup forwarding on server - postUp = with cfg.net; '' - ${pkgs.iptables}/bin/iptables -A FORWARD -i ${cfg.iface} -j ACCEPT - ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s ${v4.subnet}.1/${toString v4.mask} -o ${extIface} -j MASQUERADE - ${pkgs.iptables}/bin/ip6tables -A FORWARD -i ${cfg.iface} -j ACCEPT - ${pkgs.iptables}/bin/ip6tables -t nat -A POSTROUTING -s ${v6.subnet}::1/${toString v6.mask} -o ${extIface} -j MASQUERADE - ''; - preDown = with cfg.net; '' - ${pkgs.iptables}/bin/iptables -D FORWARD -i ${cfg.iface} -j ACCEPT - ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s ${v4.subnet}.1/${toString v4.mask} -o ${extIface} -j MASQUERADE - ${pkgs.iptables}/bin/ip6tables -D FORWARD -i ${cfg.iface} -j ACCEPT - ${pkgs.iptables}/bin/ip6tables -t nat -D POSTROUTING -s ${v6.subnet}::1/${toString v6.mask} -o ${extIface} -j MASQUERADE - ''; - - }; - - nat = lib.optionalAttrs (thisPeer ? externalIp) { - enable = true; - externalInterface = extIface; - internalInterfaces = [ cfg.iface ]; - }; - - firewall.allowedUDPPorts = lib.optional (thisPeer ? externalIp) cfg.port; - }; -}