chvp/nixos-config
1
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

thaylen-city: Add to wireguard network

Browse source
This commit is contained in:
Charlotte Van Petegem 2024-07-23 12:07:10 +02:00
parent 4aa0cb4f38
commit 20cfe2e7d8
7 changed files with 180 additions and 127 deletions
Download patch file Download diff file Expand all files Collapse all files

1
modules/darwin/base/default.nix
View file

@ -7,6 +7,7 @@ in
imports = [
./emacs
./nix
./wireguard
];
users.users.${username}.home = "/Users/${username}";

25
modules/darwin/base/wireguard/default.nix Normal file
View file

@ -0,0 +1,25 @@
{ config, ... }:
let
data = config.chvp.base.network.wireguard.data;
subnet = config.chvp.base.network.wireguard.subnet;
pskFile = config.chvp.base.network.wireguard.pskFile;
in
{
networking.wg-quick.interfaces."wg0" = {
address = [ "${data.${config.networking.hostName}.ip}/32" ];
autostart = true;
dns = [ data.lasting-integrity.ip ];
mtu = 1342;
peers = [
{
allowedIPs = [ subnet ];
endpoint = "lasting-integrity.vanpetegem.me:51820";
presharedKeyFile = pskFile;
persistentKeepalive = 25;
publicKey = data.lasting-integrity.pubkey;
}
];
privateKeyFile = data.${config.networking.hostName}.privkeyFile;
};
}

53
modules/nixos/base/network/wireguard.nix
View file

@ -1,42 +1,11 @@
{ config, lib, pkgs, ... }:
let
data = {
fairphone = {
pubkey = "mHAq+2AP1EZdlSZIxA8UCret8EStrR3nEIU2x6NVETE=";
ip = "10.240.0.4";
};
kholinar = {
pubkey = "oRA22ymFeNQBeRx6Jyd6Gd8EOUpAv9QSFkGs+Br7yEk=";
privkeyFile = config.age.secrets."files/wireguard/kholinar.privkey".path;
ip = "10.240.0.3";
};
lasting-integrity = {
pubkey = "mid3XfCY2jaNK0J6C9ltFLAbxL0IApwMw9K1Z+PU8C0=";
privkeyFile = config.age.secrets."files/wireguard/lasting-integrity.privkey".path;
ip = "10.240.0.1";
};
urithiru = {
pubkey = "f4bnm/qNhMW5iXdQcBMmP8IUN6n+pDS15Ikct7QPr0E=";
privkeyFile = config.age.secrets."files/wireguard/urithiru.privkey".path;
ip = "10.240.0.2";
};
};
subnet = "10.240.0.0/24";
pskFile = config.age.secrets."files/wireguard/psk".path;
data = config.chvp.base.network.wireguard.data;
subnet = config.chvp.base.network.wireguard.subnet;
pskFile = config.chvp.base.network.wireguard.pskFile;
in
{
options.chvp.base.network.wireguard = {
server = lib.mkOption {
default = false;
example = true;
};
onCorporate = lib.mkOption {
default = false;
example = true;
};
};
config = {
networking.firewall = {
allowedUDPPorts = lib.optional config.chvp.base.network.wireguard.server 51820;
allowedTCPPorts = lib.optional config.chvp.base.network.wireguard.server 8080;
@ -99,10 +68,7 @@ in
([{
PublicKey = data.lasting-integrity.pubkey;
AllowedIPs = subnet;
Endpoint =
if config.chvp.base.network.wireguard.onCorporate
then "127.0.0.1:51820"
else "lasting-integrity.vanpetegem.me:51820";
Endpoint = "lasting-integrity.vanpetegem.me:51820";
PresharedKeyFile = pskFile;
PersistentKeepalive = 25;
}]);
@ -129,13 +95,6 @@ in
};
};
};
age.secrets."files/wireguard/psk" = {
file = ../../../../secrets/files/wireguard/psk.age;
owner = "systemd-network";
};
age.secrets."files/wireguard/${config.networking.hostName}.privkey" = {
file = ../../../../secrets/files/wireguard + "/${config.networking.hostName}.privkey.age";
owner = "systemd-network";
};
};
age.secrets."files/wireguard/psk".owner = "systemd-network";
age.secrets."files/wireguard/${config.networking.hostName}.privkey".owner = "systemd-network";
}

1
modules/shared/base/default.nix
View file

@ -6,6 +6,7 @@
./nix
./phone-push
./tmux
./wireguard
./zfs
./zsh
];

56
modules/shared/base/wireguard/default.nix Normal file
View file

@ -0,0 +1,56 @@
{ config, lib, ... }:
let
data = {
fairphone = {
pubkey = "mHAq+2AP1EZdlSZIxA8UCret8EStrR3nEIU2x6NVETE=";
ip = "10.240.0.4";
};
kholinar = {
pubkey = "oRA22ymFeNQBeRx6Jyd6Gd8EOUpAv9QSFkGs+Br7yEk=";
privkeyFile = config.age.secrets."files/wireguard/kholinar.privkey".path;
ip = "10.240.0.3";
};
lasting-integrity = {
pubkey = "mid3XfCY2jaNK0J6C9ltFLAbxL0IApwMw9K1Z+PU8C0=";
privkeyFile = config.age.secrets."files/wireguard/lasting-integrity.privkey".path;
ip = "10.240.0.1";
};
thaylen-city = {
pubkey = "O0q2/W7dRM4LvAL9MSDZqAbGSzqi8AHLVl1sJsRDsUY=";
privkeyFile = config.age.secrets."files/wireguard/thaylen-city.privkey".path;
ip = "10.240.0.5";
};
urithiru = {
pubkey = "f4bnm/qNhMW5iXdQcBMmP8IUN6n+pDS15Ikct7QPr0E=";
privkeyFile = config.age.secrets."files/wireguard/urithiru.privkey".path;
ip = "10.240.0.2";
};
};
subnet = "10.240.0.0/24";
pskFile = config.age.secrets."files/wireguard/psk".path;
in
{
options.chvp.base.network.wireguard = {
server = lib.mkOption {
default = false;
example = true;
};
data = lib.mkOption {
default = data;
readOnly = true;
};
subnet = lib.mkOption {
default = subnet;
readOnly = true;
};
pskFile = lib.mkOption {
default = pskFile;
readOnly = true;
};
};
config = {
age.secrets."files/wireguard/psk".file = ../../../../secrets/files/wireguard/psk.age;
age.secrets."files/wireguard/${config.networking.hostName}.privkey".file = ../../../../secrets/files/wireguard + "/${config.networking.hostName}.privkey.age";
};
}

1
secrets.nix
View file

@ -98,6 +98,7 @@ in
"secrets/files/wireguard/kholinar.privkey.age".publicKeys = [ kholinar ] ++ users;
"secrets/files/wireguard/lasting-integrity.privkey.age".publicKeys = [ lasting-integrity ] ++ users;
"secrets/files/wireguard/thaylen-city.privkey.age".publicKeys = [ thaylen-city ] ++ users;
"secrets/files/wireguard/urithiru.privkey.age".publicKeys = [ urithiru ] ++ users;
"secrets/files/wireguard/psk.age".publicKeys = hosts ++ users;

10
secrets/files/wireguard/thaylen-city.privkey.age Normal file
View file

@ -0,0 +1,10 @@
age-encryption.org/v1
-> ssh-ed25519 KOkamg Ave15/4+uu5FWfIK1qLwImESyCDLzilWQeuNiim7MHc
yU/8z7o6CAQdeoXwOPL6tdJ17kV9Q/jWRZldPk4m9so
-> ssh-ed25519 s9rb8g r/CcbdZE6VCXnb2VbVFJCbcn/ANYIja0ulmr81tydhQ
KiKlxc6G1ry4/ryYZ6hoKNJPvLGaN+Q4L2oPqp+3Zbs
-> ssh-ed25519 +xxExQ TlRgGa91hF8kxkdVKyMQSe0A+8LRYRA270vVUnz4ySs
9uRwCJxDtnOssBji90+WHg6S+0vohS889YxX47J6sPI
--- Wgz5JZUMJpoXP/lEXZKIfGVyMdvgMcNeVpzOZ/FmDT0
GÐ1NÜ;^ÛŠÔŒ–,áwÏéNMÔ .)¾ûÞTu}·J`»¡_½W¢ÍóèåѬ—
'.que<>²`¿r‹†E<E280A0> ©ó+<2B>×V’Ä•