sora/nixconfig
1
0 Fork 1
Code Issues 2 Pull Requests Actions Releases Activity

vpn mode to eww

Browse Source
This commit is contained in:
sora committed 2026-11-01 12:12:59 +01:00
1 parent 086d8651ff
commit 9a99024688
6 files changed
+90 -16
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

modules/nixos/system/network/wireguard/default.nix
+51 -7
View File
@@ -5,6 +5,37 @@
(p.syscfg.net.wg.enable == true) &&
(p.syscfg.net.wg.pubkey != config.syscfg.net.wg.pubkey);
activePeers = builtins.filter isValidPeer config.syscfg.peers;
isServer = config.syscfg.server ? wireguard && config.syscfg.server.wireguard;
vpnPeer = {
name = "vpn-helcel";
publicKey = "NFBJvYXZC+bd62jhrKnM7/pugidWhgR6+C5qIiUiq3Q=";
allowedIPs = [ "10.10.1.0/24" "fd10:10:10::0/64" ];
};
vpnTable = "51820";
vpnDown = pkgs.writeShellScript "wg0-vpn-down" ''
PATH=${lib.makeBinPath [ pkgs.iproute2 pkgs.wireguard-tools ]}
for f in -4 -6; do
ip $f rule del pref 31000 2>/dev/null
ip $f rule del pref 31001 2>/dev/null
ip $f route flush table ${vpnTable} 2>/dev/null
done
wg set wg0 fwmark off peer ${vpnPeer.publicKey} allowed-ips ${lib.concatStringsSep "," vpnPeer.allowedIPs} 2>/dev/null
true
'';
vpnUp = pkgs.writeShellScript "wg0-vpn-up" ''
set -e
PATH=${lib.makeBinPath [ pkgs.iproute2 pkgs.wireguard-tools pkgs.procps ]}
${vpnDown}
sysctl -q net.ipv4.conf.all.src_valid_mark=1
wg set wg0 fwmark ${vpnTable} peer ${vpnPeer.publicKey} allowed-ips 0.0.0.0/0,::/0
for f in -4 -6; do
ip $f route replace default dev wg0 table ${vpnTable}
ip $f rule add table main suppress_prefixlength 0 pref 31000
ip $f rule add not fwmark ${vpnTable} table ${vpnTable} pref 31001
done
'';
in
{
config = lib.mkIf (config.syscfg.net.wg.enable) {
@@ -18,20 +49,17 @@ in
listenPort = 1515;
mtu = 1340;
peers =
if (config.syscfg.server ? wireguard && config.syscfg.server.wireguard) then
if isServer then
map (p: {
name = p.syscfg.hostname;
publicKey = p.syscfg.net.wg.pubkey;
allowedIPs = [ p.syscfg.net.wg.ip4 p.syscfg.net.wg.ip6 ];
}) activePeers
else
[{
allowedIPs = [ "10.10.1.0/24" "fd10:10:10::0/64" ];
name = "vpn-helcel";
[(vpnPeer // {
endpoint = "vpn.helcel.net:1515";
publicKey = "NFBJvYXZC+bd62jhrKnM7/pugidWhgR6+C5qIiUiq3Q=";
persistentKeepalive = 30;
}];
})];
};
};
};
@@ -59,7 +87,23 @@ in
Restart = "on-failure";
RestartSec = "10s"; # Wait 2 seconds before retrying the domain query
};
startLimitIntervalSec = 0;
startLimitIntervalSec = 0;
};
systemd.services."wireguard-wg0-vpn" = lib.mkIf (!isServer) {
description = "WireGuard wg0 - route all traffic";
bindsTo = [ "wireguard-wg0.service" ];
wants = [ "wireguard-wg0-peer-vpn-helcel.service" ];
partOf = [ "wireguard-wg0-peer-vpn-helcel.service" ];
after = [ "wireguard-wg0.service" "wireguard-wg0-peer-vpn-helcel.service" ];
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
ExecStart = vpnUp;
ExecStop = vpnDown;
};
};
networking.firewall.checkReversePath = lib.mkIf (!isServer) "loose";
};
}