mirror of
https://gitlab.com/upRootNutrition/dotfiles.git
synced 2025-08-09 13:24:38 -05:00
47 lines
1.1 KiB
Nix
47 lines
1.1 KiB
Nix
|
{ config, flake, ... }:
|
||
|
|
let
|
||
|
|
inherit (flake.config.services.instances) wireGuard web;
|
||
|
|
inherit (flake.config.machines.devices) mars;
|
||
|
|
service = wireGuard;
|
||
|
|
in
|
||
|
|
{
|
||
|
|
networking = {
|
||
|
|
wg-quick.interfaces = {
|
||
|
|
wg0 = {
|
||
|
|
address = [ mars.wireguard.ip0 ];
|
||
|
|
privateKeyFile = config.sops.secrets."${service.name}-mars-private".path;
|
||
|
|
peers = [
|
||
|
|
{
|
||
|
|
publicKey = "fs58+Kz+eG9qAXvvMB2NkW+wa88yP61uam4HHWaBJVw=";
|
||
|
|
allowedIPs = [ "${web.localhost.address1}/0" ];
|
||
|
|
endpoint = "${web.remotehost.address0}:${builtins.toString service.ports.port0}";
|
||
|
|
persistentKeepalive = 25;
|
||
|
|
}
|
||
|
|
];
|
||
|
|
};
|
||
|
|
};
|
||
|
|
};
|
||
|
|
|
||
|
|
sops =
|
||
|
|
let
|
||
|
|
sopsPath = secret: {
|
||
|
|
path = "${service.sops.path0}/${service.name}-${secret}-pass";
|
||
|
|
owner = "root";
|
||
|
|
mode = "600";
|
||
|
|
};
|
||
|
|
in
|
||
|
|
{
|
||
|
|
secrets = builtins.listToAttrs (
|
||
|
|
map
|
||
|
|
(secret: {
|
||
|
|
name = "${service.name}-${secret}";
|
||
|
|
value = sopsPath secret;
|
||
|
|
})
|
||
|
|
[
|
||
|
|
"mars-private"
|
||
|
|
"mars-public"
|
||
|
|
]
|
||
|
|
);
|
||
|
|
};
|
||
|
|
}
|