37 lines
920 B
Nix
37 lines
920 B
Nix
{ config, pkgs, lib, ... }:
|
|
{
|
|
environment.systemPackages = [ pkgs.wireguard pkgs.mosh ];
|
|
networking.nat = {
|
|
enable = true;
|
|
externalInterface = "ens3";
|
|
internalInterfaces = [ "wg0" ];
|
|
};
|
|
networking.firewall = {
|
|
allowedUDPPorts = [ 60990 ];
|
|
};
|
|
|
|
networking.wireguard.interfaces.wg0 = {
|
|
ips = [ "10.0.69.1/24" ];
|
|
listenPort = 60990;
|
|
privateKeyFile = "/var/lib/wireguard/private";
|
|
generatePrivateKeyFile = true; # TODO agenix secret
|
|
peers = [
|
|
{
|
|
# box
|
|
publicKey = "Ra78mOc110K7URN5uB3m9d78iBKgeRHzT+3HkiFp9BU=";
|
|
allowedIPs = [ "10.0.69.4/32" ];
|
|
}
|
|
{
|
|
# line
|
|
publicKey = "fsb1FuGmYi89p4CVXytKw2FYamONKtoanxrgs/dJjC8=";
|
|
allowedIPs = [ "10.0.69.3/32" ];
|
|
}
|
|
{
|
|
# curve
|
|
publicKey = "XmV4AcPPND/eeSI6d9M1iahCjtymqY6DdUDEFNP/x3g=";
|
|
allowedIPs = [ "10.0.69.2/32" ];
|
|
}
|
|
];
|
|
};
|
|
}
|