55 lines
		
	
	
		
			1.7 KiB
		
	
	
	
		
			Nix
		
	
	
	
	
	
			
		
		
	
	
			55 lines
		
	
	
		
			1.7 KiB
		
	
	
	
		
			Nix
		
	
	
	
	
	
| { config, lib, pkgs, ... }:
 | |
| with lib;
 | |
| let
 | |
|   cfg = config.mossnet.wg;
 | |
| in
 | |
| {
 | |
|   options = {
 | |
|     mossnet.wg = {
 | |
|       enable = mkEnableOption "Gain access to all mossnet systems through wireguard";
 | |
|       ips = lib.mkOption {
 | |
|         type = with types; listOf str;
 | |
|         default = { };
 | |
|         example = literalExample ''
 | |
|           [ "10.0.69.2/24" ];
 | |
|         '';
 | |
|         description = ''
 | |
|           The IP this machine is allowed to connect to
 | |
|         '';
 | |
|       };
 | |
|       privateKeyFile = lib.mkOption {
 | |
|         type = types.path;
 | |
|         default = { };
 | |
|         example = literalExample ''
 | |
|           /run/agenix/wg-curve
 | |
|         '';
 | |
|         description = ''
 | |
|           The private ssh key file to use to connect!
 | |
|           Remember set age.secrets.*.file and age.secrets.*.user
 | |
|         '';
 | |
|       };
 | |
|     };
 | |
|   };
 | |
|   config = mkIf cfg.enable {
 | |
|     networking.firewall.allowedUDPPorts = [ 60990 ];
 | |
|     networking.wireguard.interfaces = {
 | |
|       wg0 = {
 | |
|         ips = cfg.ips;
 | |
|         listenPort = 60990; # to match firewall allowedUDPPorts (without this wg uses random port numbers)
 | |
| 
 | |
|         privateKeyFile = cfg.privateKeyFile;
 | |
|         peers = [
 | |
|           # For a client configuration, one peer entry for the server will suffice.
 | |
|           {
 | |
|             publicKey = "c1J4p63rD3IlszugMZiki7UBV3YmDdqa3DU4UejXzAI=";
 | |
|             allowedIPs = [ "10.0.69.0/24" ];
 | |
|             # Set this to the server IP and port.
 | |
|             endpoint = "sealight.xyz:60990"; # ToDo: route to endpoint not automatically configured https://wiki.archlinux.org/index.php/WireGuard#Loop_routing https://discourse.nixos.org/t/solved-minimal-firewall-setup-for-wireguard-client/7577
 | |
|             persistentKeepalive = 25;
 | |
|           }
 | |
|         ];
 | |
|       };
 | |
|     };
 | |
|   };
 | |
| }
 |