add wireguard module
This commit is contained in:
		
							parent
							
								
									143059edc5
								
							
						
					
					
						commit
						3d2e050370
					
				
							
								
								
									
										54
									
								
								modules/wireguard.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										54
									
								
								modules/wireguard.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,54 @@ | |||
| { config, lib, pkgs, ... }: | ||||
| with lib; | ||||
| let | ||||
|   cfg = config.mossnet.wg; | ||||
| in | ||||
| { | ||||
|   options = { | ||||
|     mossnet.wg = { | ||||
|       enable = mkEnableOption "Gain access to all mossnet systems through wireguard, but only if it's already included in the server config"; | ||||
|       ips = lib.mkOption { | ||||
|         type = with types; listOf str; | ||||
|         default = { }; | ||||
|         example = literalExample '' | ||||
|           [ "10.0.69.2/24" ]; | ||||
|         ''; | ||||
|         description = '' | ||||
|           The IP this machine is allowed to connect to | ||||
|         ''; | ||||
|         privateKeyFile = lib.mkOption { | ||||
|           type = types.path; | ||||
|           default = { }; | ||||
|           example = literalExample '' | ||||
|             /run/agenix/wg-curve | ||||
|           ''; | ||||
|           description = '' | ||||
|             The private ssh key file to use to connect! | ||||
|             Remember set age.secrets.*.file and age.secrets.*.user | ||||
|           ''; | ||||
|         }; | ||||
|       }; | ||||
|     }; | ||||
|   }; | ||||
|   config = mkIf cfg.enable { | ||||
|     networking.firewall.allowedUDPPorts = [ 60990 ]; | ||||
|     networking.wireguard.interfaces = { | ||||
|       wg0 = { | ||||
|         ips = cfg.ips; | ||||
|         listenPort = 60990; # to match firewall allowedUDPPorts (without this wg uses random port numbers) | ||||
| 
 | ||||
|         privateKeyFile = cfg.privateKeyFile; | ||||
|         peers = [ | ||||
|           # For a client configuration, one peer entry for the server will suffice. | ||||
|           { | ||||
|             publicKey = "c1J4p63rD3IlszugMZiki7UBV3YmDdqa3DU4UejXzAI="; | ||||
|             allowedIPs = [ "10.0.69.0/24" ]; | ||||
|             # Set this to the server IP and port. | ||||
|             endpoint = "149.28.163.78:60990"; # ToDo: route to endpoint not automatically configured https://wiki.archlinux.org/index.php/WireGuard#Loop_routing https://discourse.nixos.org/t/solved-minimal-firewall-setup-for-wireguard-client/7577 | ||||
|             persistentKeepalive = 25; | ||||
|           } | ||||
|         ]; | ||||
|       }; | ||||
|     }; | ||||
|   }; | ||||
| } | ||||
		Loading…
	
		Reference in a new issue