upRootNutrition/dotfiles
1
0
Fork 0
mirror of https://gitlab.com/upRootNutrition/dotfiles.git synced 2025-08-08 12:54:38 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat: wireguard test

Browse source
This commit is contained in:
Nick 2025-07-01 04:11:32 -05:00
parent 30712af182
commit b85ddb710d
23 changed files with 309 additions and 510 deletions
Download patch file Download diff file Expand all files Collapse all files

1
systems/ceres/config/boot.nix
View file

@ -7,6 +7,7 @@
boot = {
extraModulePackages = [
config.boot.kernelPackages.v4l2loopback.out
config.boot.kernelPackages.wireguard
];
supportedFilesystems = [
"ntfs"

65
systems/ceres/config/wireguard.nix Normal file
View file

@ -0,0 +1,65 @@
{ config, flake, ... }:
let
inherit (flake.config.services.instances) wireGuard web;
inherit (flake.config.machines.devices) mars;
service = wireGuard;
in
{
networking = {
firewall = {
allowedUDPPorts = [
53
service.ports.port0
];
interfaces.wg0.allowedTCPPorts = [
80
443
8080
];
};
nat = {
enable = true;
enableIPv6 = true;
externalInterface = "eth0";
internalInterfaces = [ "wg0" ];
};
wireguard.interfaces = {
wg0 = {
ips = [ "${web.wireguard.interface0}/24" ];
listenPort = service.ports.port0;
privateKeyFile = config.sops.secrets."${service.name}-private".path;
peers = [
{
publicKey = "9zfRPxkxTLHM9tABC8lIaDMrzdjcF2l1mtG82uqGKUQ=";
allowedIPs = [ "${mars.wireguard.ip0}/32" ];
}
];
};
};
};
sops.secrets =
let
sopsPath = secret: {
path = "${service.sops.path0}/${service.name}-${secret}";
owner = "root";
mode = "600";
};
in
(map
(secret: {
name = "${service.name}-${secret}";
value = sopsPath secret;
})
[
"private"
"public"
]
);
boot.kernel.sysctl = {
"net.ipv4.ip_forward" = 1;
};
}

46
systems/mars/config/wireguard.nix Normal file
View file

@ -0,0 +1,46 @@
{ config, flake, ... }:
let
inherit (flake.config.services.instances) wireGuard web;
inherit (flake.config.machines.devices) mars;
service = wireGuard;
in
{
networking = {
wg-quick.interfaces = {
wg0 = {
address = [ mars.wireguard.ip0 ];
privateKeyFile = config.sops.secrets."${service.name}-mars-private".path;
peers = [
{
publicKey = "fs58+Kz+eG9qAXvvMB2NkW+wa88yP61uam4HHWaBJVw=";
allowedIPs = [ "${web.localhost.address1}/0" ];
endpoint = "${web.remotehost.address0}:${builtins.toString service.ports.port0}";
persistentKeepalive = 25;
}
];
};
};
};
sops =
let
sopsPath = secret: {
path = "${service.sops.path0}/${service.name}-${secret}-pass";
owner = "root";
mode = "600";
};
in
{
secrets = builtins.listToAttrs (
map
(secret: {
name = "${service.name}-${secret}";
value = sopsPath secret;
})
[
"mars-private"
"mars-public"
]
);
};
}