Compare commits
No commits in common. "80942f7eb331b6b975be7a2d3e9bec8acdc941f3" and "a1065eb8abc6ccaec2db372efcbb7cf2a9878e0b" have entirely different histories.
80942f7eb3
...
a1065eb8ab
1
.gitattributes
vendored
1
.gitattributes
vendored
|
|
@ -1,2 +1 @@
|
|||
secrets/*.secret filter=git-crypt diff=git-crypt
|
||||
secrets/wireguard.nix filter=git-crypt diff=git-crypt
|
||||
|
|
|
|||
|
|
@ -1,7 +1,6 @@
|
|||
{ ... }:
|
||||
{
|
||||
imports = [
|
||||
./networking.nix
|
||||
./nix.nix
|
||||
./users.nix
|
||||
];
|
||||
|
|
|
|||
|
|
@ -1,12 +0,0 @@
|
|||
{ lib, ... }:
|
||||
{
|
||||
options.my.networking.externalInterface = with lib; mkOption {
|
||||
type = types.nullOr types.str;
|
||||
default = null;
|
||||
example = "eth0";
|
||||
description = ''
|
||||
Name of the network interface that egresses to the internet. Used for
|
||||
e.g. NATing internal networks.
|
||||
'';
|
||||
};
|
||||
}
|
||||
|
|
@ -2,11 +2,11 @@
|
|||
"nodes": {
|
||||
"nixpkgs": {
|
||||
"locked": {
|
||||
"lastModified": 1613980253,
|
||||
"narHash": "sha256-3jZJAUsTSsKaElPy509a4OX87Vvy1Mu5Z1V3pMg/Pc0=",
|
||||
"lastModified": 1613722520,
|
||||
"narHash": "sha256-zMkNXzMTnE2K4Ew2Ex7RwBLnvqyAf1TYr2TLsmLkqDs=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "d4189f68fdbe0b14b7637447cb0efde2711f4abf",
|
||||
"rev": "a83ee7565fba56cf85d4aff63413320a50fbb936",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
|
|||
|
|
@ -41,7 +41,6 @@ in
|
|||
"62.210.16.6"
|
||||
"62.210.16.7"
|
||||
];
|
||||
my.networking.externalInterface = "eno1";
|
||||
|
||||
# List packages installed in system profile. To search, run:
|
||||
# $ nix search wget
|
||||
|
|
@ -120,23 +119,6 @@ in
|
|||
username = "alarsyo";
|
||||
password = secrets.transmission-password;
|
||||
};
|
||||
|
||||
wireguard = {
|
||||
enable = true;
|
||||
iface = "wg";
|
||||
port = 51820;
|
||||
|
||||
net = {
|
||||
v4 = {
|
||||
subnet = "10.0.0";
|
||||
mask = 24;
|
||||
};
|
||||
v6 = {
|
||||
subnet = "fd42:42:42";
|
||||
mask = 64;
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
security.acme.acceptTerms = true;
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
{ pkgs, lib, config, ... }:
|
||||
{ lib, config, ... }:
|
||||
with lib;
|
||||
{
|
||||
options.my.secrets = mkOption {
|
||||
|
|
@ -12,7 +12,5 @@ with lib;
|
|||
miniflux-admin-credentials = lib.fileContents ./miniflux-admin-credentials.secret;
|
||||
borg-backup-repo = lib.fileContents ./borg-backup-repo.secret;
|
||||
transmission-password = lib.fileContents ./transmission.secret;
|
||||
|
||||
wireguard = pkgs.callPackage ./wireguard.nix { };
|
||||
};
|
||||
}
|
||||
|
|
|
|||
Binary file not shown.
|
|
@ -14,6 +14,5 @@
|
|||
./nginx.nix
|
||||
./postgresql-backup.nix
|
||||
./transmission.nix
|
||||
./wireguard.nix
|
||||
];
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,122 +0,0 @@
|
|||
# Stolen from:
|
||||
#
|
||||
# https://gitea.belanyi.fr/ambroisie/nix-config/src/branch/main/services/wireguard.nix
|
||||
|
||||
{ config, lib, pkgs, ... }:
|
||||
let
|
||||
cfg = config.my.services.wireguard;
|
||||
hostName = config.networking.hostName;
|
||||
|
||||
peers = config.my.secrets.wireguard.peers;
|
||||
thisPeer = peers."${hostName}";
|
||||
otherPeers = lib.filterAttrs (name: _: name != hostName) peers;
|
||||
|
||||
extIface = config.my.networking.externalInterface;
|
||||
in
|
||||
{
|
||||
options.my.services.wireguard = with lib; {
|
||||
enable = mkEnableOption "Wireguard VPN service";
|
||||
|
||||
iface = mkOption {
|
||||
type = types.str;
|
||||
default = "wg";
|
||||
example = "wg0";
|
||||
description = "Name of the interface to configure";
|
||||
};
|
||||
|
||||
port = mkOption {
|
||||
type = types.port;
|
||||
default = 51820;
|
||||
example = 55555;
|
||||
description = "Port to configure for Wireguard";
|
||||
};
|
||||
|
||||
net = {
|
||||
v4 = {
|
||||
subnet = mkOption {
|
||||
type = types.str;
|
||||
default = "10.0.0";
|
||||
example = "10.100.0";
|
||||
description = "Which prefix to use for internal IPs";
|
||||
};
|
||||
mask = mkOption {
|
||||
type = types.int;
|
||||
default = 24;
|
||||
example = 28;
|
||||
description = "The CIDR mask to use on internal IPs";
|
||||
};
|
||||
};
|
||||
v6 = {
|
||||
subnet = mkOption {
|
||||
type = types.str;
|
||||
default = "fd42:42:42";
|
||||
example = "fdc9:281f:04d7:9ee9";
|
||||
description = "Which prefix to use for internal IPs";
|
||||
};
|
||||
mask = mkOption {
|
||||
type = types.int;
|
||||
default = 64;
|
||||
example = 68;
|
||||
description = "The CIDR mask to use on internal IPs";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config.networking = lib.mkIf cfg.enable {
|
||||
wg-quick.interfaces."${cfg.iface}" = {
|
||||
listenPort = cfg.port;
|
||||
address = with cfg.net; with lib; [
|
||||
"${v4.subnet}.${toString thisPeer.clientNum}/${toString v4.mask}"
|
||||
"${v6.subnet}::${toString thisPeer.clientNum}/${toHexString v6.mask}"
|
||||
];
|
||||
privateKey = thisPeer.privateKey;
|
||||
|
||||
peers = lib.mapAttrsToList
|
||||
(name: peer: {
|
||||
inherit (peer) publicKey;
|
||||
} // lib.optionalAttrs (thisPeer ? externalIp) {
|
||||
# Only forward from server to clients
|
||||
allowedIPs = with cfg.net; [
|
||||
"${v4.subnet}.${toString peer.clientNum}/32"
|
||||
"${v6.subnet}::${toString peer.clientNum}/128"
|
||||
];
|
||||
} // lib.optionalAttrs (peer ? externalIp) {
|
||||
# Known addresses
|
||||
endpoint = "${peer.externalIp}:${toString cfg.port}";
|
||||
} // lib.optionalAttrs (!(thisPeer ? externalIp)) {
|
||||
# Forward all traffic to server
|
||||
allowedIPs = with cfg.net; [
|
||||
"0.0.0.0/0"
|
||||
"::/0"
|
||||
];
|
||||
# Roaming clients need to keep NAT-ing active
|
||||
persistentKeepalive = 10;
|
||||
})
|
||||
otherPeers;
|
||||
} // lib.optionalAttrs (thisPeer ? externalIp) {
|
||||
# Setup forwarding on server
|
||||
postUp = with cfg.net; ''
|
||||
${pkgs.iptables}/bin/iptables -A FORWARD -i ${cfg.iface} -j ACCEPT
|
||||
${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s ${v4.subnet}.1/${toString v4.mask} -o ${extIface} -j MASQUERADE
|
||||
${pkgs.iptables}/bin/ip6tables -A FORWARD -i ${cfg.iface} -j ACCEPT
|
||||
${pkgs.iptables}/bin/ip6tables -t nat -A POSTROUTING -s ${v6.subnet}::1/${toString v6.mask} -o ${extIface} -j MASQUERADE
|
||||
'';
|
||||
preDown = with cfg.net; ''
|
||||
${pkgs.iptables}/bin/iptables -D FORWARD -i ${cfg.iface} -j ACCEPT
|
||||
${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s ${v4.subnet}.1/${toString v4.mask} -o ${extIface} -j MASQUERADE
|
||||
${pkgs.iptables}/bin/ip6tables -D FORWARD -i ${cfg.iface} -j ACCEPT
|
||||
${pkgs.iptables}/bin/ip6tables -t nat -D POSTROUTING -s ${v6.subnet}::1/${toString v6.mask} -o ${extIface} -j MASQUERADE
|
||||
'';
|
||||
|
||||
};
|
||||
|
||||
nat = lib.optionalAttrs (thisPeer ? externalIp) {
|
||||
enable = true;
|
||||
externalInterface = extIface;
|
||||
internalInterfaces = [ cfg.iface ];
|
||||
};
|
||||
|
||||
firewall.allowedUDPPorts = lib.optional (thisPeer ? externalIp) cfg.port;
|
||||
};
|
||||
}
|
||||
Loading…
Reference in a new issue