55 lines
1.7 KiB
Nix
55 lines
1.7 KiB
Nix
|
{ config, lib, pkgs, ... }:
|
||
|
|
with lib;
|
||
|
|
let
|
||
|
|
cfg = config.mossnet.wg;
|
||
|
|
in
|
||
|
|
{
|
||
|
|
options = {
|
||
|
|
mossnet.wg = {
|
||
|
|
enable = mkEnableOption "Gain access to all mossnet systems through wireguard";
|
||
|
|
ips = lib.mkOption {
|
||
|
|
type = with types; listOf str;
|
||
|
|
default = { };
|
||
|
|
example = literalExample ''
|
||
|
|
[ "10.0.69.2/24" ];
|
||
|
|
'';
|
||
|
|
description = ''
|
||
|
|
The IP this machine is allowed to connect to
|
||
|
|
'';
|
||
|
|
};
|
||
|
|
privateKeyFile = lib.mkOption {
|
||
|
|
type = types.path;
|
||
|
|
default = { };
|
||
|
|
example = literalExample ''
|
||
|
|
/run/agenix/wg-curve
|
||
|
|
'';
|
||
|
|
description = ''
|
||
|
|
The private ssh key file to use to connect!
|
||
|
|
Remember set age.secrets.*.file and age.secrets.*.user
|
||
|
|
'';
|
||
|
|
};
|
||
|
|
};
|
||
|
|
};
|
||
|
|
config = mkIf cfg.enable {
|
||
|
|
networking.firewall.allowedUDPPorts = [ 60990 ];
|
||
|
|
networking.wireguard.interfaces = {
|
||
|
|
wg0 = {
|
||
|
|
ips = cfg.ips;
|
||
|
|
listenPort = 60990; # to match firewall allowedUDPPorts (without this wg uses random port numbers)
|
||
|
|
|
||
|
|
privateKeyFile = cfg.privateKeyFile;
|
||
|
|
peers = [
|
||
|
|
# For a client configuration, one peer entry for the server will suffice.
|
||
|
|
{
|
||
|
|
publicKey = "c1J4p63rD3IlszugMZiki7UBV3YmDdqa3DU4UejXzAI=";
|
||
|
|
allowedIPs = [ "10.0.69.0/24" ];
|
||
|
|
# Set this to the server IP and port.
|
||
|
|
endpoint = "149.28.163.78:60990"; # ToDo: route to endpoint not automatically configured https://wiki.archlinux.org/index.php/WireGuard#Loop_routing https://discourse.nixos.org/t/solved-minimal-firewall-setup-for-wireguard-client/7577
|
||
|
|
persistentKeepalive = 25;
|
||
|
|
}
|
||
|
|
];
|
||
|
|
};
|
||
|
|
};
|
||
|
|
};
|
||
|
|
}
|