aynish/helm
1
0
Fork 0
Code Pull requests Packages Projects Releases Activity

get working wireguard on work

Browse source
This commit is contained in:
Anish Lakhwara 2024-09-04 13:41:34 -07:00
parent e5eef474c6
commit 629b8eb49e
2 changed files with 22 additions and 38 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
home/darwin/default.nix
View file

@ -14,24 +14,6 @@
home.homeDirectory = "/Users/anishlakhwara";
home.stateVersion = "22.05";
# networking.wg-quick.interfaces = {
# wg0 = {
# address = [ "10.0.69.7/24" ];
# listenPort = 60990; # to match firewall allowedUDPPorts (without this wg uses random port numbers)
# privateKeyFile = "/run/agenix/work-wg";
# peers = [
# # For a client configuration, one peer entry for the server will suffice.
# {
# publicKey = "c1J4p63rD3IlszugMZiki7UBV3YmDdqa3DU4UejXzAI=";
# allowedIPs = [ "10.0.69.0/24" ];
# # Set this to the server IP and port.
# endpoint = "sealight.xyz:60990"; # TODO: route to endpoint not automatically configured https://wiki.archlinux.org/index.php/WireGuard#Loop_routing https://discourse.nixos.org/t/solved-minimal-firewall-setup-for-wireguard-client/7577
# persistentKeepalive = 25;
# }
# ];
# };
# };
programs.zsh.initExtra = ''
PATH=/Users/anishlakhwara/.sourcegraph/bin:/Users/anishlakhwara/.sourcegraph/sg.zsh_autocomplete:/Users/anishlakhwara/google-cloud-sdk/bin:/Users/anishlakhwara/google-cloud-sdk/completion.zsh.inc:/Users/anishlakhwara/google-cloud-sdk/path.zsh.inc:/Users/anishlakhwara/.sg:/opt/homebrew/bin:$PATH
'';

42
hosts/darwin/default.nix
View file

@ -1,4 +1,4 @@
{ self, pkgs, ... }:
{ self, pkgs, config, ... }:
{
imports = [
@ -18,25 +18,27 @@
pkgs.kubernetes-helm
];
# age.secrets.curve-wg.file = "${self}/secrets/work-wg.age";
# age.secrets.curve-wg.owner = "anishlakhwara";
# networking.wg-quick.interfaces = {
# wg0 = {
# address = [ "10.0.69.7/24" ];
# listenPort = 60990; # to match firewall allowedUDPPorts (without this wg uses random port numbers)
# privateKeyFile = "/run/agenix/work-wg";
# peers = [
# # For a client configuration, one peer entry for the server will suffice.
# {
# publicKey = "c1J4p63rD3IlszugMZiki7UBV3YmDdqa3DU4UejXzAI=";
# allowedIPs = [ "10.0.69.0/24" ];
# # Set this to the server IP and port.
# endpoint = "sealight.xyz:60990"; # ToDo: route to endpoint not automatically configured https://wiki.archlinux.org/index.php/WireGuard#Loop_routing https://discourse.nixos.org/t/solved-minimal-firewall-setup-for-wireguard-client/7577
# persistentKeepalive = 25;
# }
# ];
# };
# };
age.identityPaths = [ "/Users/anishlakhwara/.ssh/id_ed25519" ];
age.secrets.work-wg.file = "${self}/secrets/work-wg.age";
age.secrets.work-wg.owner = "anishlakhwara";
networking.wg-quick.interfaces = {
wg0 = {
address = [ "10.0.69.7/24" ];
listenPort = 60990; # to match firewall allowedUDPPorts (without this wg uses random port numbers)
privateKeyFile = config.age.secrets.work-wg.path;
dns = [ "10.0.69.4" ];
peers = [
# For a client configuration, one peer entry for the server will suffice.
{
publicKey = "c1J4p63rD3IlszugMZiki7UBV3YmDdqa3DU4UejXzAI=";
allowedIPs = [ "10.0.69.0/24" ];
# Set this to the server IP and port.
endpoint = "sealight.xyz:60990"; # ToDo: route to endpoint not automatically configured https://wiki.archlinux.org/index.php/WireGuard#Loop_routing https://discourse.nixos.org/t/solved-minimal-firewall-setup-for-wireguard-client/7577
persistentKeepalive = 25;
}
];
};
};
# Auto upgrade nix package and the daemon service.
services.nix-daemon.enable = true;