helm/modules/wireguard.nix
2022-09-19 08:13:50 +10:00

55 lines
1.7 KiB
Nix

{ config, lib, pkgs, ... }:
with lib;
let
cfg = config.mossnet.wg;
in
{
options = {
mossnet.wg = {
enable = mkEnableOption "Gain access to all mossnet systems through wireguard";
ips = lib.mkOption {
type = with types; listOf str;
default = { };
example = literalExample ''
[ "10.0.69.2/24" ];
'';
description = ''
The IP this machine is allowed to connect to
'';
};
privateKeyFile = lib.mkOption {
type = types.path;
default = { };
example = literalExample ''
/run/agenix/wg-curve
'';
description = ''
The private ssh key file to use to connect!
Remember set age.secrets.*.file and age.secrets.*.user
'';
};
};
};
config = mkIf cfg.enable {
networking.firewall.allowedUDPPorts = [ 60990 ];
networking.wireguard.interfaces = {
wg0 = {
ips = cfg.ips;
listenPort = 60990; # to match firewall allowedUDPPorts (without this wg uses random port numbers)
privateKeyFile = cfg.privateKeyFile;
peers = [
# For a client configuration, one peer entry for the server will suffice.
{
publicKey = "c1J4p63rD3IlszugMZiki7UBV3YmDdqa3DU4UejXzAI=";
allowedIPs = [ "10.0.69.0/24" ];
# Set this to the server IP and port.
endpoint = "149.28.163.78:60990"; # ToDo: route to endpoint not automatically configured https://wiki.archlinux.org/index.php/WireGuard#Loop_routing https://discourse.nixos.org/t/solved-minimal-firewall-setup-for-wireguard-client/7577
persistentKeepalive = 25;
}
];
};
};
};
}