os/modules/wireguard-client/default.nix

Ignoring revisions in .git-blame-ignore-revs. Click here to bypass and see the normal blame view.

49 lines
1 KiB
Nix
Raw Normal View History

2023-10-19 18:55:56 +00:00
{
lib,
config,
pkgs,
...
}:
with lib; let
psCfg = config.pub-solar;
cfg = config.pub-solar.wireguard-client;
in {
options.pub-solar.wireguard-client = {
ownIPs = mkOption {
description = ''
Internal ips in wireguard used for cluster control-plane communication.
'';
type = types.listOf types.str;
};
wireguardPrivateKeyFile = mkOption {
description = ''
Location of private key file
'';
type = types.path;
};
};
config = {
networking.firewall.allowedUDPPorts = [51899];
networking.wg-quick.interfaces = {
wg0 = {
listenPort = 51899;
2023-10-19 18:55:56 +00:00
address = cfg.ownIPs;
dns = [ "10.0.1.2" ];
2023-10-19 18:55:56 +00:00
privateKeyFile = cfg.wireguardPrivateKeyFile;
peers = [
{
2023-10-24 15:56:14 +00:00
# frikandel
publicKey = "p6YKNYBlySKfhTN+wbSsKdoNjzko/XSAiTAlCJzP1jA=";
allowedIPs = [ "10.0.1.0/24" ];
endpoint = "[2a01:4f8:c2c:b60::]:51899";
2023-10-19 18:55:56 +00:00
persistentKeepalive = 25;
}
];
};
};
};
}