tstarr/dotfiles
1
0
Fork 0
mirror of https://github.com/starr-dusT/dotfiles.git synced 2025-02-19 19:27:31 -08:00
Code Issues Packages Projects Releases Wiki Activity

Move wireguard server outside of modules

Browse Source
This commit is contained in:
Tyler Starr 2023-10-07 02:04:31 -07:00
parent 30b85b90c5
commit 5a58d74799
4 changed files with 58 additions and 60 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
provision/nixos/hosts/torus/configuration.nix
View File

@ -1,5 +1,10 @@
{ config, pkgs, user, lib, ... }:
{
imports = [
./wireguard-server.nix
../../modules
];
nix = {
package = pkgs.nixFlakes;
extraOptions = "experimental-features = nix-command flakes";
@ -118,7 +123,6 @@
};
# Enable modules
imports = [ ../../modules ];
modules = {
devel = {
tooling.enable = true;
@ -127,7 +131,6 @@
samba-server.enable = true;
jellyfin.enable = true;
syncthing.enable = true;
wireguard-server.enable = true;
};
system = {
terminal.enable = true;

52
provision/nixos/hosts/torus/wireguard-server.nix Normal file
View File

@ -0,0 +1,52 @@
{ config, lib, pkgs, ... }:
{
# Enable NAT
networking.nat = {
enable = true;
enableIPv6 = true;
externalInterface = "enp4s0";
internalInterfaces = [ "wg0" ];
};
# Open ports in the firewall
networking.firewall = {
allowedTCPPorts = [ 53 ];
allowedUDPPorts = [ 53 51820 ];
};
networking.wg-quick.interfaces = {
# "wg0" is the network interface name. You can name the interface arbitrarily.
wg0 = {
# Determines the IP/IPv6 address and subnet of the client's end of the tunnel interface
address = [ "192.168.2.1/24" ];
# The port that WireGuard listens to - recommended that this be changed from default
listenPort = 51820;
# Path to the server's private key
privateKeyFile = "/engi/apps/wireguard/private";
# This allows the wireguard server to route your traffic to the internet and hence be like a VPN
postUp = ''
${pkgs.iptables}/bin/iptables -A FORWARD -i %i -j ACCEPT
${pkgs.iptables}/bin/iptables -A FORWARD -o %i -j ACCEPT
${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -o enp4s0 -j MASQUERADE
'';
# Undo the above
preDown = ''
${pkgs.iptables}/bin/iptables -D FORWARD -i %i -j ACCEPT
${pkgs.iptables}/bin/iptables -D FORWARD -o %i -j ACCEPT
${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -o enp4s0 -j MASQUERADE
'';
peers = [
{
# Adjudicator
publicKey = "r2/IeYCO1T+l248387wUBoNnc2DK9O8pHcIr/NQqezM=";
allowedIPs = [ "192.168.2.2/32" ];
}
# More peers can be added here.
];
};
};
}

2
provision/nixos/modules/services/default.nix
View File

@ -1,4 +1,4 @@
{ ... }:
{
imports = [ ./wireguard-server.nix ./syncthing.nix ./samba-server.nix ./samba-client.nix ./jellyfin.nix ./virt-manager.nix ./peripherals.nix ];
imports = [ ./syncthing.nix ./samba-server.nix ./samba-client.nix ./jellyfin.nix ./virt-manager.nix ./peripherals.nix ];
}

57
provision/nixos/modules/services/wireguard-server.nix
View File

@ -1,57 +0,0 @@
{ config, lib, pkgs, ... }:
let cfg = config.modules.services.wireguard-server;
in {
options.modules.services.wireguard-server.enable = lib.mkEnableOption "wireguard-server";
config = lib.mkIf cfg.enable {
# Enable NAT
networking.nat = {
enable = true;
enableIPv6 = true;
externalInterface = "enp4s0";
internalInterfaces = [ "wg0" ];
};
# Open ports in the firewall
networking.firewall = {
allowedTCPPorts = [ 53 ];
allowedUDPPorts = [ 53 51820 ];
};
networking.wg-quick.interfaces = {
# "wg0" is the network interface name. You can name the interface arbitrarily.
wg0 = {
# Determines the IP/IPv6 address and subnet of the client's end of the tunnel interface
address = [ "192.168.2.1/24" ];
# The port that WireGuard listens to - recommended that this be changed from default
listenPort = 51820;
# Path to the server's private key
privateKeyFile = "/engi/apps/wireguard/private";
# This allows the wireguard server to route your traffic to the internet and hence be like a VPN
postUp = ''
${pkgs.iptables}/bin/iptables -A FORWARD -i %i -j ACCEPT
${pkgs.iptables}/bin/iptables -A FORWARD -o %i -j ACCEPT
${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -o enp4s0 -j MASQUERADE
'';
# Undo the above
preDown = ''
${pkgs.iptables}/bin/iptables -D FORWARD -i %i -j ACCEPT
${pkgs.iptables}/bin/iptables -D FORWARD -o %i -j ACCEPT
${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -o enp4s0 -j MASQUERADE
'';
peers = [
{
# Adjudicator
publicKey = "r2/IeYCO1T+l248387wUBoNnc2DK9O8pHcIr/NQqezM=";
allowedIPs = [ "192.168.2.2/32" ];
}
# More peers can be added here.
];
};
};
};
}