upRootNutrition/dotfiles
1
0
Fork 0
mirror of https://gitlab.com/upRootNutrition/dotfiles.git synced 2025-08-08 04:44:39 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat: wireguard test

Browse source
This commit is contained in:
Nick 2025-07-01 04:32:00 -05:00
parent 1bf51ec551
commit b280e69c40
3 changed files with 9 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

2
modules/config/devices/config/ceres.nix
View file

@ -28,7 +28,7 @@ in
options = ownerExclusiveReadWriteMask;
};
wireguard = {
ip0 = "10.100.0.2";
ip0 = "10.100.0.1";
};
storage0 = {
mount = "/mnt/media/${ceresStorageDriveName}";

7
modules/nixos/services/searx/default.nix
View file

@ -46,6 +46,11 @@ in
virtualHosts = {
"${configHelpers.host}" = {
extraConfig = ''
@blocked {
not remote_ip 10.100.0.0/24
}
respond @blocked 403 "Access allowed only via WireGuard"
redir /.well-known/carddav /remote.php/dav/ 301
redir /.well-known/caldav /remote.php/dav/ 301
@ -87,7 +92,7 @@ in
networking = {
firewall = {
allowedTCPPorts = [
interfaces.wg0.allowedTCPPorts = [
configHelpers.service.ports.port0
];
};

4
systems/ceres/config/wireguard.nix
View file

@ -1,7 +1,7 @@
{ config, flake, ... }:
let
inherit (flake.config.services.instances) wireGuard web;
inherit (flake.config.machines.devices) mars;
inherit (flake.config.machines.devices) mars ceres;
service = wireGuard;
in
{
@ -27,7 +27,7 @@ in
wireguard.interfaces = {
wg0 = {
ips = [ "${web.wireguard.interface0}/24" ];
ips = [ "${ceres.wireguard.ip0}/24" ];
listenPort = service.ports.port0;
privateKeyFile = config.sops.secrets."${service.name}-private".path;
peers = [