b12f/os
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

Revert "fix: remove ipv6 local addresses from wireguard"

Browse source 
This reverts commit cff59a1b7a.
This commit is contained in:
Benjamin Bädorf 2023-10-25 13:23:13 +02:00
parent 52e8aa2502
commit 9995e15760
No known key found for this signature in database
GPG key ID: 1B7BF5B77A521346
8 changed files with 56 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
hosts/biolimo/networking.nix
View file

@ -8,7 +8,10 @@
age.secrets.wg-private-key.file = "${flake.self}/secrets/wg-private-biolimo.age";
pub-solar.wireguard-client = {
ownIPs = [ "10.0.1.6/32" ];
ownIPs = [
"10.0.1.6/32"
"fd00:acab:1312:acab:6::/128"
];
wireguardPrivateKeyFile = "/run/agenix/wg-private-key";
};
};

5
hosts/chocolatebar/networking.nix
View file

@ -8,7 +8,10 @@
age.secrets.wg-private-key.file = "${flake.self}/secrets/wg-private-chocolatebar.age";
pub-solar.wireguard-client = {
ownIPs = [ "10.0.1.5/32" ];
ownIPs = [
"10.0.1.5/32"
"fd00:acab:1312:acab:5::/128"
];
wireguardPrivateKeyFile = "/run/agenix/wg-private-key";
};
};

5
hosts/droppie/networking.nix
View file

@ -8,7 +8,10 @@
age.secrets.wg-private-key.file = "${flake.self}/secrets/wg-private-droppie.age";
pub-solar.wireguard-client = {
ownIPs = [ "10.0.1.3/32" ];
ownIPs = [
"10.0.1.3/32"
"fd00:acab:1312:acab:3::/128"
];
wireguardPrivateKeyFile = "/run/agenix/wg-private-key";
};
};

31
hosts/frikandel/wireguard.nix
View file

@ -8,6 +8,9 @@
boot.kernel.sysctl = {
"net.ipv4.ip_forward" = 1;
"net.ipv6.conf.all.forwarding" = 1;
"net.ipv6.conf.all.accept_ra" = 1;
"net.ipv6.conf.all.accept_ra_pinfo" = 1;
};
networking.nat = {
@ -27,29 +30,47 @@
wg0 = {
listenPort = 51899;
address = [ "10.0.1.7/32" ];
address = [
"10.0.1.7/32"
"fd00:b12f:acab:1312:acab:7::/32"
];
privateKeyFile = "/run/agenix/wg-private-key-server";
peers = [
{ # pie
publicKey = "hPTXEqQ2GYEywdPNdZBacwB9KKcoFZ/heClxnqmizyw=";
allowedIPs = [ "10.0.1.2/32" ];
allowedIPs = [
"10.0.1.2/32"
"fd00:b12f:acab:1312:acab:2::/32"
];
persistentKeepalive = 25;
}
{ # droppie
publicKey = "qsnBMoj9Z16D8PJ5ummRtIfT5AiMpoF3SoOCo4sbyiw=";
allowedIPs = [ "10.0.1.3/32" ];
allowedIPs = [
"10.0.1.3/32"
"fd00:b12f:acab:1312:acab:3::/32"
];
persistentKeepalive = 25;
}
{ # chocolatebar
publicKey = "nk8EtGE/QsnSEm1lhLS3/w83nOBD2OGYhODIf92G91A=";
allowedIPs = [ "10.0.1.5/32" ];
allowedIPs = [
"10.0.1.5/32"
"fd00:b12f:acab:1312:acab:5::/32"
];
persistentKeepalive = 25;
}
{ # biolimo
publicKey = "4ymN7wwBuhF+h+5fFN0TqXmVyOe1AsWiTqRL0jJ3CDc=";
allowedIPs = [ "10.0.1.6/32" ];
allowedIPs = [
"10.0.1.6/32"
"fd00:b12f:acab:1312:acab:6::/32"
];
persistentKeepalive = 25;
}
];

2
hosts/pie/ddclient.nix
View file

@ -13,7 +13,7 @@ with lib; let
${curl}/bin/curl -4 https://ipcheck-ds.wieistmeineip.de/callback/ | ${coreutils}/bin/tail -c +2 | ${coreutils}/bin/head -c -1 | ${jq}/bin/jq '.ip' -r
'';
getIP6 = with pkgs; writeShellScriptBin "getIP" ''
${curl}/bin/curl -6 https://ipcheck-ds.wieistmeineip.de/callback/ | ${coreutils}/bin/tail -c +2 | ${coreutils}/bin/head -c -1 | ${jq}/bin/jq '.ip' -r
echo "2a02:908:5b1:e3c0:3077:2::"
'';
in {
imports = [

2
hosts/pie/networking.nix
View file

@ -25,7 +25,7 @@
# Caddy reverse proxy for local services like cups
services.caddy = {
globalConfig = ''
default_bind 192.168.178.2 2a02:908:5b1:e3c0:3077:2:: 10.0.1.2
default_bind 192.168.178.2 2a02:908:5b1:e3c0:3077:2:: 10.0.1.2 fd00:acab:1312:acab:2::
auto_https off
'';
};

8
hosts/pie/unbound.nix
View file

@ -19,6 +19,7 @@
# Allow from wireguard
"10.0.1.0/24 allow"
"fd00:acab:1312:acab::/48 allow"
];
local-zone = [
"\"b12f.io\" static"
@ -32,16 +33,23 @@
"\"droppie.local. 10800 IN AAAA 2a02:908:5b1:e3c0:3077:3::\""
"\"droppie.b12f.io. 10800 IN A 10.0.1.3\""
"\"droppie.b12f.io. 10800 IN AAAA fd00:acab:1312:acab:3::\""
"\"backup.b12f.io. 10800 IN A 10.0.1.3\""
"\"backup.b12f.io. 10800 IN AAAA fd00:acab:1312:acab:3::\""
"\"pie.local. 10800 IN A 192.168.178.2\""
"\"pie.local. 10800 IN AAAA 2a02:908:5b1:e3c0:3077:2::\""
"\"pie.b12f.io. 10800 IN A 10.0.1.2\""
"\"pie.b12f.io. 10800 IN AAAA fd00:acab:1312:acab:2::\""
"\"firefly.b12f.io. 10800 IN A 10.0.1.2\""
"\"firefly.b12f.io. 10800 IN AAAA fd00:acab:1312:acab:2::\""
"\"firefly-importer.b12f.io. 10800 IN A 10.0.1.2\""
"\"firefly-importer.b12f.io. 10800 IN AAAA fd00:acab:1312:acab:2::\""
"\"paperless.b12f.io. 10800 IN A 10.0.1.2\""
"\"paperless.b12f.io. 10800 IN AAAA fd00:acab:1312:acab:2::\""
"\"invoicing.b12f.io. 10800 IN A 10.0.1.2\""
"\"invoicing.b12f.io. 10800 IN AAAA fd00:acab:1312:acab:2::\""
"\"vpn.b12f.io. 10800 IN A 128.140.109.213\""
"\"vpn.b12f.io. 10800 IN AAAA 2a02:908:5b1:e3c0:3077:2::\""

10
modules/wireguard-client/default.nix
View file

@ -31,13 +31,19 @@ in {
wg0 = {
listenPort = 51899;
address = cfg.ownIPs;
dns = [ "10.0.1.2" ];
dns = [
"10.0.1.2"
"fd00:b12f:acab:1312:acab:2::"
];
privateKeyFile = cfg.wireguardPrivateKeyFile;
peers = [
{
# frikandel
publicKey = "p6YKNYBlySKfhTN+wbSsKdoNjzko/XSAiTAlCJzP1jA=";
allowedIPs = [ "10.0.1.0/24" ];
allowedIPs = [
"10.0.1.0/24"
"fd00:b12f:acab:1312:acab::/48"
];
endpoint = "[2a01:4f8:c2c:b60::]:51899";
persistentKeepalive = 25;
}