diff --git a/modules/default.nix b/modules/default.nix index 4ed84f6..ec8caf9 100644 --- a/modules/default.nix +++ b/modules/default.nix @@ -5,6 +5,5 @@ _: { ./nix.nix ./pi.nix ./server.nix - ./wireguard.nix ]; } diff --git a/modules/wireguard.nix b/modules/wireguard.nix deleted file mode 100644 index 50344f6..0000000 --- a/modules/wireguard.nix +++ /dev/null @@ -1,80 +0,0 @@ -{ lib, config, ... }: -let cfg = config.nodeconfig; in { - options.nodeconfig = { - wireguard = { - enable = lib.mkOption { - type = lib.types.bool; - default = false; - description = "Use WireGuard on the node"; - }; - listen-port = lib.mkOption { - type = lib.types.int; - default = 51820; - description = "Listen port used by WireGuard on the the default interface"; - }; - pk-file = lib.mkOption { - type = lib.types.str; - default = "/etc/wireguard/private.key"; - description = "Path to the file containing the WireGuard private key"; - }; - endpoint = lib.mkOption { - type = lib.types.str; - example = "123.122.121.120:51820"; - description = "IP and port of the default peer"; - }; - endpoint-publickey = lib.mkOption { - type = lib.types.str; - description = "Public key of the default peer"; - }; - psk-file = lib.mkOption { - type = lib.types.nullOr lib.types.str; - default = ""; - example = "/etc/wireguard/preshared.key"; - description = "Path to the file containing the pre-shared key"; - }; - interface-name = lib.mkOption { - type = lib.types.str; - default = "wg0"; - description = "Name of the WireGuard interface created"; - }; - dns = lib.mkOption { - type = lib.types.listOf lib.types.str; - default = [ ]; - description = "list of DNS servers"; - }; - allowed-ips = lib.mkOption { - type = lib.types.listOf lib.types.str; - default = [ "10.0.0.0/24" "fd7c::/64" ]; - description = "IP ranges used with WireGuard"; - }; - node-ips = lib.mkOption { - type = lib.types.listOf lib.types.str; - default = [ "10.0.0.1/24" "fd7c::1/64" ]; - description = "WireGuard IPs of this node"; - }; - }; - }; - - config = lib.mkIf cfg.wireguard.enable { - networking.firewall.trustedInterfaces = [ cfg.wireguard.interface-name ]; - networking.wg-quick = { - interfaces = { - "${cfg.wireguard.interface-name}" = { - address = cfg.wireguard.node-ips; - dns = cfg.wireguard.dns; - listenPort = cfg.wireguard.listen-port; - privateKeyFile = cfg.wireguard.pk-file; - peers = [ - { - endpoint = cfg.wireguard.endpoint; - publicKey = cfg.wireguard.endpoint-publickey; - presharedKeyFile = cfg.wireguard.psk-file; - persistentKeepalive = 20; - allowedIPs = cfg.wireguard.allowed-ips; - } - ]; - }; - }; - }; - }; -}