os/hosts/frikandel/wireguard.nix

80 lines
1.8 KiB
Nix

{
flake,
config,
pkgs,
...
}: {
age.secrets.wg-private-key-server.file = "${flake.self}/secrets/wg-private-frikandel-server.age";
boot.kernel.sysctl = {
"net.ipv4.ip_forward" = 1;
"net.ipv6.conf.wg0.forwarding" = 1;
"net.ipv6.conf.wg0.accept_ra" = 1;
"net.ipv6.conf.wg0.accept_ra_pinfo" = 1;
};
networking.nat = {
enable = true;
enableIPv6 = true;
internalInterfaces = [ "wg0" ];
};
networking.firewall.allowedUDPPorts = [ 51899 ];
networking.firewall.extraForwardRules = [
"iifname wg0 accept"
"iifname enp1s0 reject"
];
# Enable WireGuard
networking.wg-quick.interfaces = {
wg0 = {
listenPort = 51899;
address = [
"10.0.1.7/32"
"fd00:b12f:acab:1312:acab:7::/32"
];
privateKeyFile = "/run/agenix/wg-private-key-server";
peers = [
{ # pie
publicKey = "hPTXEqQ2GYEywdPNdZBacwB9KKcoFZ/heClxnqmizyw=";
allowedIPs = [
"10.0.1.2/32"
"fd00:b12f:acab:1312:acab:2::/32"
];
persistentKeepalive = 25;
}
{ # droppie
publicKey = "qsnBMoj9Z16D8PJ5ummRtIfT5AiMpoF3SoOCo4sbyiw=";
allowedIPs = [
"10.0.1.3/32"
"fd00:b12f:acab:1312:acab:3::/32"
];
persistentKeepalive = 25;
}
{ # chocolatebar
publicKey = "nk8EtGE/QsnSEm1lhLS3/w83nOBD2OGYhODIf92G91A=";
allowedIPs = [
"10.0.1.5/32"
"fd00:b12f:acab:1312:acab:5::/32"
];
persistentKeepalive = 25;
}
{ # biolimo
publicKey = "4ymN7wwBuhF+h+5fFN0TqXmVyOe1AsWiTqRL0jJ3CDc=";
allowedIPs = [
"10.0.1.6/32"
"fd00:b12f:acab:1312:acab:6::/32"
];
persistentKeepalive = 25;
}
];
};
};
}