sora/nixconfig
1
0
Fork 0
Code Issues 2 Pull Requests Actions Releases Activity

wg sops

Browse Source
This commit is contained in:
soraefir
2026-05-02 00:20:20 +02:00
parent d68c26a4eb
commit c9ebc6e512
1 changed files with 10 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
modules/nixos/system/network/wireguard/default.nix
View File

@@ -10,12 +10,21 @@
config.sops.secrets."${config.syscfg.hostname}_wg_priv".path; config.sops.secrets."${config.syscfg.hostname}_wg_priv".path;
listenPort = 1515; listenPort = 1515;
mtu = 1340; mtu = 1340;
postUp = if config.syscfg.net.wg.server.enable then ''
for keyfile in /run/secrets/*_wg_pub; do
if [ -f "$keyfile" ]; then
${pkgs.wireguard-tools}/bin/wg set %i \
peer "$(cat "$keyfile")" \
allowed-ips 10.10.1.0/24,fd10:10:10::0/64
fi
done
'' else '''';
peers = peers =
if config.syscfg.net.wg.server.enable then if config.syscfg.net.wg.server.enable then
map(secretName:{ map(secretName:{
name = "${secretName}"; name = "${secretName}";
allowedIPs = [ "10.10.1.0/24" "fd10:10:10::0/64" ]; allowedIPs = [ "10.10.1.0/24" "fd10:10:10::0/64" ];
publicKeyFile = config.sops.secrets."${secretName}_wg_pub".path; publicKey = config.sops.secrets."${secretName}_wg_pub".path;
}) config.syscfg.net.wg.server.peers }) config.syscfg.net.wg.server.peers
else else
[{ [{