upRootNutrition/dotfiles
1
0
Fork 0
mirror of https://gitlab.com/upRootNutrition/dotfiles.git synced 2025-08-08 21:04:38 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat: wireguard test

Browse source
This commit is contained in:
Nick 2025-07-01 04:32:00 -05:00
parent 1bf51ec551
commit b280e69c40
3 changed files with 9 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

2
modules/config/devices/config/ceres.nix
View file

@ -28,7 +28,7 @@ in
options = ownerExclusiveReadWriteMask; options = ownerExclusiveReadWriteMask;
}; };
wireguard = { wireguard = {
ip0 = "10.100.0.2"; ip0 = "10.100.0.1";
}; };
storage0 = { storage0 = {
mount = "/mnt/media/${ceresStorageDriveName}"; mount = "/mnt/media/${ceresStorageDriveName}";

7
modules/nixos/services/searx/default.nix
View file

@ -46,6 +46,11 @@ in
virtualHosts = { virtualHosts = {
"${configHelpers.host}" = { "${configHelpers.host}" = {
extraConfig = '' extraConfig = ''
@blocked {
not remote_ip 10.100.0.0/24
}
respond @blocked 403 "Access allowed only via WireGuard"
redir /.well-known/carddav /remote.php/dav/ 301 redir /.well-known/carddav /remote.php/dav/ 301
redir /.well-known/caldav /remote.php/dav/ 301 redir /.well-known/caldav /remote.php/dav/ 301
@ -87,7 +92,7 @@ in
networking = { networking = {
firewall = { firewall = {
allowedTCPPorts = [ interfaces.wg0.allowedTCPPorts = [
configHelpers.service.ports.port0 configHelpers.service.ports.port0
]; ];
}; };

4
systems/ceres/config/wireguard.nix
View file

@ -1,7 +1,7 @@
{ config, flake, ... }: { config, flake, ... }:
let let
inherit (flake.config.services.instances) wireGuard web; inherit (flake.config.services.instances) wireGuard web;
inherit (flake.config.machines.devices) mars; inherit (flake.config.machines.devices) mars ceres;
service = wireGuard; service = wireGuard;
in in
{ {
@ -27,7 +27,7 @@ in
wireguard.interfaces = { wireguard.interfaces = {
wg0 = { wg0 = {
ips = [ "${web.wireguard.interface0}/24" ]; ips = [ "${ceres.wireguard.ip0}/24" ];
listenPort = service.ports.port0; listenPort = service.ports.port0;
privateKeyFile = config.sops.secrets."${service.name}-private".path; privateKeyFile = config.sops.secrets."${service.name}-private".path;
peers = [ peers = [