sora/nixconfig
1
0
Fork 0
Code Issues 2 Pull Requests Actions Releases Activity

Better Server cfg

Browse Source
This commit is contained in:
soraefir
2026-05-03 02:20:41 +02:00
parent d3a3941591
commit 9377d1ce45
8 changed files with 99 additions and 70 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
modules/nixos/system/network/wireguard/default.nix
View File

@@ -7,7 +7,6 @@
activePeers = builtins.filter isValidPeer config.syscfg.peers;
in
{
imports = [ ./forwarding.nix ];
config = lib.mkIf (config.syscfg.net.wg.enable) {
networking.wireguard = {
enable = true;
@@ -19,7 +18,7 @@ in
listenPort = 1515;
mtu = 1340;
peers =
if config.syscfg.net.wg.server.enable then
if config.syscfg.server ? wireguard then
map (p: {
name = p.syscfg.hostname;
publicKey = p.syscfg.net.wg.pubkey;

41
modules/nixos/system/network/wireguard/forwarding.nix
View File

@@ -1,41 +0,0 @@
{ config, lib, pkgs, ... }:
{
config = lib.mkIf (config.syscfg.net.wg.server.enable) {
boot.kernel.sysctl = {
"net.ipv4.ip_forward" = 1;
"net.ipv6.conf.all.forwarding" = 1;
};
networking.nftables.enable = true;
networking.nftables.ruleset = ''
table inet nat {
chain prerouting {
type nat hook prerouting priority dstnat; policy accept;
${lib.concatMapStringsSep "\n" (rule:
let
srcInt = builtins.elemAt rule 0;
dstAddr4 = builtins.elemAt rule 1;
dstAddr6 = builtins.elemAt rule 2;
srcPort = toString (builtins.elemAt rule 3);
dstPort = toString (builtins.elemAt rule 4);
in ''
iifname "${srcInt}" tcp dport ${srcPort} counter dnat ip to ${dstAddr4}:${dstPort}
iifname "${srcInt}" udp dport ${srcPort} counter dnat ip to ${dstAddr4}:${dstPort}
iifname "${srcInt}" tcp dport ${srcPort} counter dnat ip6 to [${dstAddr6}]:${dstPort}
iifname "${srcInt}" udp dport ${srcPort} counter dnat ip6 to [${dstAddr6}]:${dstPort}
''
) config.syscfg.net.wg.server.forward}
}
chain postrouting {
type nat hook postrouting priority srcnat; policy accept;
oifname { "wg0", "ens3" } masquerade
}
}
'';
};
}