adtya/configuration.nix
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

all: use wireguard module

Browse source
This commit is contained in:
Adithya 2024-07-06 00:54:18 +05:30
parent 97d2bcc6ae
commit 883b78da03
Signed by: adtya
GPG key ID: B8857BFBA2C47B9C
5 changed files with 43 additions and 101 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
flake.nix
View file

@ -83,6 +83,7 @@
lanzaboote.nixosModules.lanzaboote lanzaboote.nixosModules.lanzaboote
impermanence.nixosModules.impermanence impermanence.nixosModules.impermanence
home-manager.nixosModules.home-manager home-manager.nixosModules.home-manager
self.nixosModules.default
./common ./common
./hosts/skipper ./hosts/skipper
./home ./home
@ -129,9 +130,9 @@
} }
lix-module.nixosModules.default lix-module.nixosModules.default
sops-nix.nixosModules.sops sops-nix.nixosModules.sops
self.nixosModules.default
./common ./common
./hosts/rico1 ./hosts/rico1
self.nixosModules.default
]; ];
}; };
Rico2 = Rico2 =

35
hosts/rico0/wireguard.nix
View file

@ -1,4 +1,6 @@
{ config, ... }: { { config, ... }: {
imports = [ ../shared/wireguard.nix ];
sops.secrets = { sops.secrets = {
"wireguard/rico0/pk" = { "wireguard/rico0/pk" = {
mode = "400"; mode = "400";
@ -12,31 +14,14 @@
}; };
}; };
networking.firewall.trustedInterfaces = [ "wg0" ]; nodeconfig.wireguard = {
networking.wireguard = {
enable = true; enable = true;
interfaces = { listen-port = 51830;
wg0 = { pk-file = config.sops.secrets."wireguard/rico0/pk".path;
ips = [ psk-file = config.sops.secrets."wireguard/rico0/psk".path;
"10.10.10.10/24" node-ips = [
"fd7c:585c:c4ae::10/64" "10.10.10.10/24"
]; "fd7c:585c:c4ae::10/64"
listenPort = 51830; ];
privateKeyFile = config.sops.secrets."wireguard/rico0/pk".path;
peers = [
{
name = "Proxy";
endpoint = "165.232.180.97:51821";
publicKey = "NNw/iDMCTq8mpHncrecEh4UlvtINX/UUDtCJf2ToFR4=";
presharedKeyFile = config.sops.secrets."wireguard/rico0/psk".path;
persistentKeepalive = 20;
allowedIPs = [
"10.10.10.0/24"
"fd7c:585c:c4ae::0/64"
];
}
];
};
};
}; };
} }

35
hosts/rico1/wireguard.nix
View file

@ -1,4 +1,6 @@
{ config, ... }: { { config, ... }: {
imports = [ ../shared/wireguard.nix ];
sops.secrets = { sops.secrets = {
"wireguard/rico1/pk" = { "wireguard/rico1/pk" = {
mode = "400"; mode = "400";
@ -12,31 +14,14 @@
}; };
}; };
networking.firewall.trustedInterfaces = [ "wg0" ]; nodeconfig.wireguard = {
networking.wireguard = {
enable = true; enable = true;
interfaces = { listen-port = 51831;
wg0 = { pk-file = config.sops.secrets."wireguard/rico1/pk".path;
ips = [ psk-file = config.sops.secrets."wireguard/rico1/psk".path;
"10.10.10.11/24" node-ips = [
"fd7c:585c:c4ae::11/64" "10.10.10.11/24"
]; "fd7c:585c:c4ae::11/64"
listenPort = 51831; ];
privateKeyFile = config.sops.secrets."wireguard/rico1/pk".path;
peers = [
{
name = "Proxy";
endpoint = "165.232.180.97:51821";
publicKey = "NNw/iDMCTq8mpHncrecEh4UlvtINX/UUDtCJf2ToFR4=";
presharedKeyFile = config.sops.secrets."wireguard/rico1/psk".path;
persistentKeepalive = 20;
allowedIPs = [
"10.10.10.0/24"
"fd7c:585c:c4ae::0/64"
];
}
];
};
};
}; };
} }

35
hosts/rico2/wireguard.nix
View file

@ -1,4 +1,6 @@
{ config, ... }: { { config, ... }: {
imports = [ ../shared/wireguard.nix ];
sops.secrets = { sops.secrets = {
"wireguard/rico2/pk" = { "wireguard/rico2/pk" = {
mode = "400"; mode = "400";
@ -12,31 +14,14 @@
}; };
}; };
networking.firewall.trustedInterfaces = [ "wg0" ]; nodeconfig.wireguard = {
networking.wireguard = {
enable = true; enable = true;
interfaces = { listen-port = 51832;
wg0 = { pk-file = config.sops.secrets."wireguard/rico2/pk".path;
ips = [ psk-file = config.sops.secrets."wireguard/rico2/psk".path;
"10.10.10.12/24" node-ips = [
"fd7c:585c:c4ae::12/64" "10.10.10.12/24"
]; "fd7c:585c:c4ae::12/64"
listenPort = 51832; ];
privateKeyFile = config.sops.secrets."wireguard/rico2/pk".path;
peers = [
{
name = "Proxy";
endpoint = "165.232.180.97:51821";
publicKey = "NNw/iDMCTq8mpHncrecEh4UlvtINX/UUDtCJf2ToFR4=";
presharedKeyFile = config.sops.secrets."wireguard/rico2/psk".path;
persistentKeepalive = 20;
allowedIPs = [
"10.10.10.0/24"
"fd7c:585c:c4ae::0/64"
];
}
];
};
};
}; };
} }

36
hosts/skipper/network/wireguard.nix
View file

@ -1,4 +1,6 @@
{ config, ... }: { { config, ... }: {
imports = [ ../../shared/wireguard.nix ];
sops.secrets = { sops.secrets = {
"wireguard/skipper/pk" = { "wireguard/skipper/pk" = {
mode = "400"; mode = "400";
@ -11,31 +13,15 @@
group = config.users.users.root.group; group = config.users.users.root.group;
}; };
}; };
networking.firewall.trustedInterfaces = [ "wg0" ];
networking.wireguard = { nodeconfig.wireguard = {
enable = true; enable = true;
interfaces = { listen-port = 51822;
wg0 = { pk-file = config.sops.secrets."wireguard/skipper/pk".path;
ips = [ psk-file = config.sops.secrets."wireguard/skipper/psk".path;
"10.10.10.2/24" node-ips = [
"fd7c:585c:c4ae::2/64" "10.10.10.2/24"
]; "fd7c:585c:c4ae::2/64"
listenPort = 51822; ];
privateKeyFile = config.sops.secrets."wireguard/skipper/pk".path;
peers = [
{
name = "Proxy";
endpoint = "165.232.180.97:51821";
publicKey = "NNw/iDMCTq8mpHncrecEh4UlvtINX/UUDtCJf2ToFR4=";
presharedKeyFile = config.sops.secrets."wireguard/skipper/psk".path;
persistentKeepalive = 20;
allowedIPs = [
"10.10.10.0/24"
"fd7c:585c:c4ae::0/64"
];
}
];
};
};
}; };
} }