alarsyo/nixos-config
alarsyo/nixos-config
1
1
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

services: wireguard: removed unused module

Browse source 
replaced by tailscale
This commit is contained in:
Antoine Martin 2021-07-13 23:51:17 +02:00
parent 1d8750efed
commit c16d8513d2
8 changed files with 0 additions and 162 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
.gitattributes vendored
View file

@ -1,4 +1,3 @@
secrets/**/*.secret filter=git-crypt diff=git-crypt
secrets/matrix-email-config.nix filter=git-crypt diff=git-crypt
secrets/wireguard.nix filter=git-crypt diff=git-crypt
home/secrets/*.secret filter=git-crypt diff=git-crypt

2
README.org
View file

@ -42,5 +42,3 @@ RSS reader
Grafana and Prometheus are currently used as a glorified =htop=.
** Nextcloud
** Wireguard VPN

17
hosts/boreal/default.nix
View file

@ -83,23 +83,6 @@ in
pipewire.enable = true;
tailscale.enable = true;
wireguard = {
enable = false;
iface = "wg";
port = 51820;
net = {
v4 = {
subnet = "10.0.0";
mask = 24;
};
v6 = {
subnet = "fd42:42:42";
mask = 64;
};
};
};
};
services = {

17
hosts/poseidon/default.nix
View file

@ -134,23 +134,6 @@ in
username = "alarsyo";
password = secrets.transmission-password;
};
wireguard = {
enable = true;
iface = "wg";
port = 51820;
net = {
v4 = {
subnet = "10.0.0";
mask = 24;
};
v6 = {
subnet = "fd42:42:42";
mask = 64;
};
};
};
};
# Enable the OpenSSH daemon.

2
secrets/default.nix
View file

@ -18,8 +18,6 @@ with lib;
borg-backup = import ./borg-backup { inherit lib; };
wireguard = pkgs.callPackage ./wireguard.nix { };
matrixEmailConfig = import ./matrix-email-config.nix;
};
}

BIN
secrets/wireguard.nix
View file

Binary file not shown.

1
services/default.nix
View file

@ -22,6 +22,5 @@
./tailscale.nix
./tgv.nix
./transmission.nix
./wireguard.nix
];
}

122
services/wireguard.nix
View file

@ -1,122 +0,0 @@
# Stolen from:
#
# https://gitea.belanyi.fr/ambroisie/nix-config/src/branch/main/services/wireguard.nix
{ config, lib, pkgs, ... }:
let
cfg = config.my.services.wireguard;
hostName = config.networking.hostName;
peers = config.my.secrets.wireguard.peers;
thisPeer = peers."${hostName}";
otherPeers = lib.filterAttrs (name: _: name != hostName) peers;
extIface = config.my.networking.externalInterface;
in
{
options.my.services.wireguard = with lib; {
enable = mkEnableOption "Wireguard VPN service";
iface = mkOption {
type = types.str;
default = "wg";
example = "wg0";
description = "Name of the interface to configure";
};
port = mkOption {
type = types.port;
default = 51820;
example = 55555;
description = "Port to configure for Wireguard";
};
net = {
v4 = {
subnet = mkOption {
type = types.str;
default = "10.0.0";
example = "10.100.0";
description = "Which prefix to use for internal IPs";
};
mask = mkOption {
type = types.int;
default = 24;
example = 28;
description = "The CIDR mask to use on internal IPs";
};
};
v6 = {
subnet = mkOption {
type = types.str;
default = "fd42:42:42";
example = "fdc9:281f:04d7:9ee9";
description = "Which prefix to use for internal IPs";
};
mask = mkOption {
type = types.int;
default = 64;
example = 68;
description = "The CIDR mask to use on internal IPs";
};
};
};
};
config.networking = lib.mkIf cfg.enable {
wg-quick.interfaces."${cfg.iface}" = {
listenPort = cfg.port;
address = with cfg.net; with lib; [
"${v4.subnet}.${toString thisPeer.clientNum}/${toString v4.mask}"
"${v6.subnet}::${toString thisPeer.clientNum}/${toHexString v6.mask}"
];
privateKey = thisPeer.privateKey;
peers = lib.mapAttrsToList
(name: peer: {
inherit (peer) publicKey;
} // lib.optionalAttrs (thisPeer ? externalIp) {
# Only forward from server to clients
allowedIPs = with cfg.net; [
"${v4.subnet}.${toString peer.clientNum}/32"
"${v6.subnet}::${toString peer.clientNum}/128"
];
} // lib.optionalAttrs (peer ? externalIp) {
# Known addresses
endpoint = "${peer.externalIp}:${toString cfg.port}";
} // lib.optionalAttrs (!(thisPeer ? externalIp)) {
# Forward all traffic to server
allowedIPs = with cfg.net; [
"0.0.0.0/0"
"::/0"
];
# Roaming clients need to keep NAT-ing active
persistentKeepalive = 10;
})
otherPeers;
} // lib.optionalAttrs (thisPeer ? externalIp) {
# Setup forwarding on server
postUp = with cfg.net; ''
${pkgs.iptables}/bin/iptables -A FORWARD -i ${cfg.iface} -j ACCEPT
${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s ${v4.subnet}.1/${toString v4.mask} -o ${extIface} -j MASQUERADE
${pkgs.iptables}/bin/ip6tables -A FORWARD -i ${cfg.iface} -j ACCEPT
${pkgs.iptables}/bin/ip6tables -t nat -A POSTROUTING -s ${v6.subnet}::1/${toString v6.mask} -o ${extIface} -j MASQUERADE
'';
preDown = with cfg.net; ''
${pkgs.iptables}/bin/iptables -D FORWARD -i ${cfg.iface} -j ACCEPT
${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s ${v4.subnet}.1/${toString v4.mask} -o ${extIface} -j MASQUERADE
${pkgs.iptables}/bin/ip6tables -D FORWARD -i ${cfg.iface} -j ACCEPT
${pkgs.iptables}/bin/ip6tables -t nat -D POSTROUTING -s ${v6.subnet}::1/${toString v6.mask} -o ${extIface} -j MASQUERADE
'';
};
nat = lib.optionalAttrs (thisPeer ? externalIp) {
enable = true;
externalInterface = extIface;
internalInterfaces = [ cfg.iface ];
};
firewall.allowedUDPPorts = lib.optional (thisPeer ? externalIp) cfg.port;
};
}