sora/nixconfig
1
0
Fork 0
Code Issues 2 Pull Requests Actions Releases Activity

fix

Browse Source
This commit is contained in:
soraefir
2026-05-02 00:50:56 +02:00
parent 25b2e3e05f
commit 1ceb440026
9 changed files with 33 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files

34
modules/nixos/system/network/wireguard/default.nix
View File

@@ -1,4 +1,21 @@
{ config, lib, pkgs, ... }: {
{ config, lib, pkgs, ... }: let
systemsDir = ../../../../../systems;
systemNames = lib.attrNames (lib.filterAttrs
(name: type: type == "directory" && builtins.pathExists (systemsDir + "/${name}/cfg.nix"))
(builtins.readDir systemsDir));
# Use a helper to check if the attribute path exists safely
# This prevents the "attribute 'net' missing" error
isValidPeer = p:
(p ? syscfg.net.wg.enable) &&
(p.syscfg.net.wg.enable == true) &&
(p.syscfg.net.wg.pubkey != config.syscfg.net.wg.pubkey);
importedConfigs = map (name: import (systemsDir + "/${name}/cfg.nix")) systemNames;
activePeers = builtins.filter isValidPeer importedConfigs;
in
{
imports = [ ./forwarding.nix ];
config = lib.mkIf (config.syscfg.net.wg.enable) {
networking.wireguard = {
@@ -10,18 +27,13 @@
config.sops.secrets."${config.syscfg.hostname}_wg_priv".path;
listenPort = 1515;
mtu = 1340;
postSetup = if config.syscfg.net.wg.server.enable then ''
for keyfile in /run/secrets/*_wg_pub; do
if [ -f "$keyfile" ]; then
${pkgs.wireguard-tools}/bin/wg set wg0 \
peer "$(cat "$keyfile")" \
allowed-ips 10.10.1.0/24,fd10:10:10::0/64
fi
done
'' else '''';
peers =
if config.syscfg.net.wg.server.enable then
[]
map (p: {
name = p.syscfg.hostname;
publicKey = p.syscfg.net.wg.pubkey;
allowedIPs = [ p.syscfg.net.wg.ip4 p.syscfg.net.wg.ip6 ];
}) activePeers
else
[{
allowedIPs = [ "10.10.1.0/24" "fd10:10:10::0/64" ];