chvp/nixos-config
1
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

thaylen-city: Add to wireguard network

Browse source
This commit is contained in:
Charlotte Van Petegem 2024-07-23 12:07:10 +02:00
parent 4aa0cb4f38
commit 20cfe2e7d8
7 changed files with 180 additions and 127 deletions
Download patch file Download diff file Expand all files Collapse all files

1
modules/darwin/base/default.nix
View file

@ -7,6 +7,7 @@ in
imports = [ imports = [
./emacs ./emacs
./nix ./nix
./wireguard
]; ];
users.users.${username}.home = "/Users/${username}"; users.users.${username}.home = "/Users/${username}";

25
modules/darwin/base/wireguard/default.nix Normal file
View file

@ -0,0 +1,25 @@
{ config, ... }:
let
data = config.chvp.base.network.wireguard.data;
subnet = config.chvp.base.network.wireguard.subnet;
pskFile = config.chvp.base.network.wireguard.pskFile;
in
{
networking.wg-quick.interfaces."wg0" = {
address = [ "${data.${config.networking.hostName}.ip}/32" ];
autostart = true;
dns = [ data.lasting-integrity.ip ];
mtu = 1342;
peers = [
{
allowedIPs = [ subnet ];
endpoint = "lasting-integrity.vanpetegem.me:51820";
presharedKeyFile = pskFile;
persistentKeepalive = 25;
publicKey = data.lasting-integrity.pubkey;
}
];
privateKeyFile = data.${config.networking.hostName}.privkeyFile;
};
}

213
modules/nixos/base/network/wireguard.nix
View file

@ -1,141 +1,100 @@
{ config, lib, pkgs, ... }: { config, lib, pkgs, ... }:
let let
data = { data = config.chvp.base.network.wireguard.data;
fairphone = { subnet = config.chvp.base.network.wireguard.subnet;
pubkey = "mHAq+2AP1EZdlSZIxA8UCret8EStrR3nEIU2x6NVETE="; pskFile = config.chvp.base.network.wireguard.pskFile;
ip = "10.240.0.4";
};
kholinar = {
pubkey = "oRA22ymFeNQBeRx6Jyd6Gd8EOUpAv9QSFkGs+Br7yEk=";
privkeyFile = config.age.secrets."files/wireguard/kholinar.privkey".path;
ip = "10.240.0.3";
};
lasting-integrity = {
pubkey = "mid3XfCY2jaNK0J6C9ltFLAbxL0IApwMw9K1Z+PU8C0=";
privkeyFile = config.age.secrets."files/wireguard/lasting-integrity.privkey".path;
ip = "10.240.0.1";
};
urithiru = {
pubkey = "f4bnm/qNhMW5iXdQcBMmP8IUN6n+pDS15Ikct7QPr0E=";
privkeyFile = config.age.secrets."files/wireguard/urithiru.privkey".path;
ip = "10.240.0.2";
};
};
subnet = "10.240.0.0/24";
pskFile = config.age.secrets."files/wireguard/psk".path;
in in
{ {
options.chvp.base.network.wireguard = { networking.firewall = {
server = lib.mkOption { allowedUDPPorts = lib.optional config.chvp.base.network.wireguard.server 51820;
default = false; allowedTCPPorts = lib.optional config.chvp.base.network.wireguard.server 8080;
example = true; trustedInterfaces = [ "wg0" ];
};
onCorporate = lib.mkOption {
default = false;
example = true;
};
}; };
config = { boot.kernel.sysctl = lib.mkIf config.chvp.base.network.wireguard.server { "net.ipv4.ip_forward" = 1; };
networking.firewall = { services.unbound = lib.mkIf config.chvp.base.network.wireguard.server {
allowedUDPPorts = lib.optional config.chvp.base.network.wireguard.server 51820; enable = true;
allowedTCPPorts = lib.optional config.chvp.base.network.wireguard.server 8080; resolveLocalQueries = true;
trustedInterfaces = [ "wg0" ]; settings = {
}; server = {
boot.kernel.sysctl = lib.mkIf config.chvp.base.network.wireguard.server { "net.ipv4.ip_forward" = 1; }; interface = [ "10.240.0.1" "127.0.0.1" "::1" ];
services.unbound = lib.mkIf config.chvp.base.network.wireguard.server { access-control = [
enable = true; "127.0.0.0/8 allow"
resolveLocalQueries = true; "10.240.0.0/24 allow"
settings = { ];
server = { private-domain = "internal";
interface = [ "10.240.0.1" "127.0.0.1" "::1" ]; domain-insecure = "internal";
access-control = [ local-zone = builtins.map (name: ''"${name}.internal" redirect'') (builtins.attrNames data);
"127.0.0.0/8 allow" local-data = builtins.map (name: ''"${name}.internal IN A ${data.${name}.ip}"'') (builtins.attrNames data);
"10.240.0.0/24 allow" };
]; forward-zone = {
private-domain = "internal"; name = ''"."'';
domain-insecure = "internal"; forward-addr = [
local-zone = builtins.map (name: ''"${name}.internal" redirect'') (builtins.attrNames data); "1.1.1.1@853"
local-data = builtins.map (name: ''"${name}.internal IN A ${data.${name}.ip}"'') (builtins.attrNames data); "1.0.0.1@853"
}; "2606:4700:4700::1111@853"
forward-zone = { "2606:4700:4700::1001@853"
name = ''"."''; ];
forward-addr = [ forward-tls-upstream = "yes";
"1.1.1.1@853"
"1.0.0.1@853"
"2606:4700:4700::1111@853"
"2606:4700:4700::1001@853"
];
forward-tls-upstream = "yes";
};
}; };
}; };
systemd = { };
network = { systemd = {
netdevs.wg0 = { network = {
enable = true; netdevs.wg0 = {
netdevConfig = { enable = true;
Name = "wg0"; netdevConfig = {
Kind = "wireguard"; Name = "wg0";
MTUBytes = "1342"; Kind = "wireguard";
MTUBytes = "1342";
};
wireguardConfig =
if config.chvp.base.network.wireguard.server then {
PrivateKeyFile = data.${config.networking.hostName}.privkeyFile;
ListenPort = 51820;
} else {
PrivateKeyFile = data.${config.networking.hostName}.privkeyFile;
}; };
wireguardConfig = wireguardPeers =
if config.chvp.base.network.wireguard.server then { if config.chvp.base.network.wireguard.server then
PrivateKeyFile = data.${config.networking.hostName}.privkeyFile; (builtins.map
ListenPort = 51820; (name: {
} else { PublicKey = data.${name}.pubkey;
PrivateKeyFile = data.${config.networking.hostName}.privkeyFile; AllowedIPs = "${data.${name}.ip}/32";
};
wireguardPeers =
if config.chvp.base.network.wireguard.server then
(builtins.map
(name: {
PublicKey = data.${name}.pubkey;
AllowedIPs = "${data.${name}.ip}/32";
PresharedKeyFile = pskFile;
})
(builtins.filter (name: name != config.networking.hostName) (builtins.attrNames data)))
else
([{
PublicKey = data.lasting-integrity.pubkey;
AllowedIPs = subnet;
Endpoint =
if config.chvp.base.network.wireguard.onCorporate
then "127.0.0.1:51820"
else "lasting-integrity.vanpetegem.me:51820";
PresharedKeyFile = pskFile; PresharedKeyFile = pskFile;
PersistentKeepalive = 25; })
}]); (builtins.filter (name: name != config.networking.hostName) (builtins.attrNames data)))
}; else
networks.wg0 = { ([{
enable = true; PublicKey = data.lasting-integrity.pubkey;
name = "wg0"; AllowedIPs = subnet;
address = [ "${data.${config.networking.hostName}.ip}/32" ]; Endpoint = "lasting-integrity.vanpetegem.me:51820";
domains = [ "internal" ]; PresharedKeyFile = pskFile;
dns = [ data.lasting-integrity.ip ]; PersistentKeepalive = 25;
linkConfig.MTUBytes = "1342"; }]);
routes = [ };
( networks.wg0 = {
if config.chvp.base.network.wireguard.server then { enable = true;
Gateway = "${data.${config.networking.hostName}.ip}"; name = "wg0";
Destination = subnet; address = [ "${data.${config.networking.hostName}.ip}/32" ];
} else { domains = [ "internal" ];
Gateway = "${data.lasting-integrity.ip}"; dns = [ data.lasting-integrity.ip ];
Destination = subnet; linkConfig.MTUBytes = "1342";
GatewayOnLink = true; routes = [
} (
) if config.chvp.base.network.wireguard.server then {
]; Gateway = "${data.${config.networking.hostName}.ip}";
}; Destination = subnet;
} else {
Gateway = "${data.lasting-integrity.ip}";
Destination = subnet;
GatewayOnLink = true;
}
)
];
}; };
}; };
age.secrets."files/wireguard/psk" = {
file = ../../../../secrets/files/wireguard/psk.age;
owner = "systemd-network";
};
age.secrets."files/wireguard/${config.networking.hostName}.privkey" = {
file = ../../../../secrets/files/wireguard + "/${config.networking.hostName}.privkey.age";
owner = "systemd-network";
};
}; };
age.secrets."files/wireguard/psk".owner = "systemd-network";
age.secrets."files/wireguard/${config.networking.hostName}.privkey".owner = "systemd-network";
} }

1
modules/shared/base/default.nix
View file

@ -6,6 +6,7 @@
./nix ./nix
./phone-push ./phone-push
./tmux ./tmux
./wireguard
./zfs ./zfs
./zsh ./zsh
]; ];

56
modules/shared/base/wireguard/default.nix Normal file
View file

@ -0,0 +1,56 @@
{ config, lib, ... }:
let
data = {
fairphone = {
pubkey = "mHAq+2AP1EZdlSZIxA8UCret8EStrR3nEIU2x6NVETE=";
ip = "10.240.0.4";
};
kholinar = {
pubkey = "oRA22ymFeNQBeRx6Jyd6Gd8EOUpAv9QSFkGs+Br7yEk=";
privkeyFile = config.age.secrets."files/wireguard/kholinar.privkey".path;
ip = "10.240.0.3";
};
lasting-integrity = {
pubkey = "mid3XfCY2jaNK0J6C9ltFLAbxL0IApwMw9K1Z+PU8C0=";
privkeyFile = config.age.secrets."files/wireguard/lasting-integrity.privkey".path;
ip = "10.240.0.1";
};
thaylen-city = {
pubkey = "O0q2/W7dRM4LvAL9MSDZqAbGSzqi8AHLVl1sJsRDsUY=";
privkeyFile = config.age.secrets."files/wireguard/thaylen-city.privkey".path;
ip = "10.240.0.5";
};
urithiru = {
pubkey = "f4bnm/qNhMW5iXdQcBMmP8IUN6n+pDS15Ikct7QPr0E=";
privkeyFile = config.age.secrets."files/wireguard/urithiru.privkey".path;
ip = "10.240.0.2";
};
};
subnet = "10.240.0.0/24";
pskFile = config.age.secrets."files/wireguard/psk".path;
in
{
options.chvp.base.network.wireguard = {
server = lib.mkOption {
default = false;
example = true;
};
data = lib.mkOption {
default = data;
readOnly = true;
};
subnet = lib.mkOption {
default = subnet;
readOnly = true;
};
pskFile = lib.mkOption {
default = pskFile;
readOnly = true;
};
};
config = {
age.secrets."files/wireguard/psk".file = ../../../../secrets/files/wireguard/psk.age;
age.secrets."files/wireguard/${config.networking.hostName}.privkey".file = ../../../../secrets/files/wireguard + "/${config.networking.hostName}.privkey.age";
};
}

1
secrets.nix
View file

@ -98,6 +98,7 @@ in
"secrets/files/wireguard/kholinar.privkey.age".publicKeys = [ kholinar ] ++ users; "secrets/files/wireguard/kholinar.privkey.age".publicKeys = [ kholinar ] ++ users;
"secrets/files/wireguard/lasting-integrity.privkey.age".publicKeys = [ lasting-integrity ] ++ users; "secrets/files/wireguard/lasting-integrity.privkey.age".publicKeys = [ lasting-integrity ] ++ users;
"secrets/files/wireguard/thaylen-city.privkey.age".publicKeys = [ thaylen-city ] ++ users;
"secrets/files/wireguard/urithiru.privkey.age".publicKeys = [ urithiru ] ++ users; "secrets/files/wireguard/urithiru.privkey.age".publicKeys = [ urithiru ] ++ users;
"secrets/files/wireguard/psk.age".publicKeys = hosts ++ users; "secrets/files/wireguard/psk.age".publicKeys = hosts ++ users;

10
secrets/files/wireguard/thaylen-city.privkey.age Normal file
View file

@ -0,0 +1,10 @@
age-encryption.org/v1
-> ssh-ed25519 KOkamg Ave15/4+uu5FWfIK1qLwImESyCDLzilWQeuNiim7MHc
yU/8z7o6CAQdeoXwOPL6tdJ17kV9Q/jWRZldPk4m9so
-> ssh-ed25519 s9rb8g r/CcbdZE6VCXnb2VbVFJCbcn/ANYIja0ulmr81tydhQ
KiKlxc6G1ry4/ryYZ6hoKNJPvLGaN+Q4L2oPqp+3Zbs
-> ssh-ed25519 +xxExQ TlRgGa91hF8kxkdVKyMQSe0A+8LRYRA270vVUnz4ySs
9uRwCJxDtnOssBji90+WHg6S+0vohS889YxX47J6sPI
--- Wgz5JZUMJpoXP/lEXZKIfGVyMdvgMcNeVpzOZ/FmDT0
GÐ1NÜ;^ÛŠÔŒ–,áwÏéNMÔ .)¾ûÞTu}·J`»¡_½W¢ÍóèåѬ—
'.que<>²`¿r‹†E<E280A0> ©ó+<2B>×V’Ä•