41 lines
1.4 KiB
Nix
41 lines
1.4 KiB
Nix
{ config, lib, pkgs, ... }: {
|
|
imports = [ ./forwarding.nix ];
|
|
config = lib.mkIf (config.syscfg.net.wg.enable) {
|
|
networking.wireguard = {
|
|
enable = true;
|
|
interfaces = {
|
|
wg0 = {
|
|
ips = [ config.syscfg.net.wg.ip4 config.syscfg.net.wg.ip6 ];
|
|
privateKeyFile =
|
|
config.sops.secrets."${config.syscfg.hostname}_wg_priv".path;
|
|
listenPort = 1515;
|
|
mtu = 1340;
|
|
postSetup = if config.syscfg.net.wg.server.enable then ''
|
|
for keyfile in /run/secrets/*_wg_pub; do
|
|
if [ -f "$keyfile" ]; then
|
|
${pkgs.wireguard-tools}/bin/wg set %i \
|
|
peer "$(cat "$keyfile")" \
|
|
allowed-ips 10.10.1.0/24,fd10:10:10::0/64
|
|
fi
|
|
done
|
|
'' else '''';
|
|
peers =
|
|
if config.syscfg.net.wg.server.enable then
|
|
map(secretName:{
|
|
name = "${secretName}";
|
|
allowedIPs = [ "10.10.1.0/24" "fd10:10:10::0/64" ];
|
|
publicKey = config.sops.secrets."${secretName}_wg_pub".path;
|
|
}) config.syscfg.net.wg.server.peers
|
|
else
|
|
[{
|
|
allowedIPs = [ "10.10.1.0/24" "fd10:10:10::0/64" ];
|
|
endpoint = "vpn.helcel.net:1515";
|
|
publicKey = "NFBJvYXZC+bd62jhrKnM7/pugidWhgR6+C5qIiUiq3Q=";
|
|
persistentKeepalive = 30;
|
|
}];
|
|
};
|
|
};
|
|
};
|
|
};
|
|
}
|