chvp/nixos-config
1
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

thaylen-city: Add to wireguard network

Browse source
This commit is contained in:
Charlotte Van Petegem 2024-07-23 12:07:10 +02:00
parent 4aa0cb4f38
commit 20cfe2e7d8
7 changed files with 180 additions and 127 deletions
Download patch file Download diff file Expand all files Collapse all files

1
modules/darwin/base/default.nix
View file

@ -7,6 +7,7 @@ in
imports = [
./emacs
./nix
./wireguard
];
users.users.${username}.home = "/Users/${username}";

25
modules/darwin/base/wireguard/default.nix Normal file
View file

@ -0,0 +1,25 @@
{ config, ... }:
let
data = config.chvp.base.network.wireguard.data;
subnet = config.chvp.base.network.wireguard.subnet;
pskFile = config.chvp.base.network.wireguard.pskFile;
in
{
networking.wg-quick.interfaces."wg0" = {
address = [ "${data.${config.networking.hostName}.ip}/32" ];
autostart = true;
dns = [ data.lasting-integrity.ip ];
mtu = 1342;
peers = [
{
allowedIPs = [ subnet ];
endpoint = "lasting-integrity.vanpetegem.me:51820";
presharedKeyFile = pskFile;
persistentKeepalive = 25;
publicKey = data.lasting-integrity.pubkey;
}
];
privateKeyFile = data.${config.networking.hostName}.privkeyFile;
};
}

213
modules/nixos/base/network/wireguard.nix
View file

@ -1,141 +1,100 @@
{ config, lib, pkgs, ... }:
let
data = {
fairphone = {
pubkey = "mHAq+2AP1EZdlSZIxA8UCret8EStrR3nEIU2x6NVETE=";
ip = "10.240.0.4";
};
kholinar = {
pubkey = "oRA22ymFeNQBeRx6Jyd6Gd8EOUpAv9QSFkGs+Br7yEk=";
privkeyFile = config.age.secrets."files/wireguard/kholinar.privkey".path;
ip = "10.240.0.3";
};
lasting-integrity = {
pubkey = "mid3XfCY2jaNK0J6C9ltFLAbxL0IApwMw9K1Z+PU8C0=";
privkeyFile = config.age.secrets."files/wireguard/lasting-integrity.privkey".path;
ip = "10.240.0.1";
};
urithiru = {
pubkey = "f4bnm/qNhMW5iXdQcBMmP8IUN6n+pDS15Ikct7QPr0E=";
privkeyFile = config.age.secrets."files/wireguard/urithiru.privkey".path;
ip = "10.240.0.2";
};
};
subnet = "10.240.0.0/24";
pskFile = config.age.secrets."files/wireguard/psk".path;
data = config.chvp.base.network.wireguard.data;
subnet = config.chvp.base.network.wireguard.subnet;
pskFile = config.chvp.base.network.wireguard.pskFile;
in
{
options.chvp.base.network.wireguard = {
server = lib.mkOption {
default = false;
example = true;
};
onCorporate = lib.mkOption {
default = false;
example = true;
};
networking.firewall = {
allowedUDPPorts = lib.optional config.chvp.base.network.wireguard.server 51820;
allowedTCPPorts = lib.optional config.chvp.base.network.wireguard.server 8080;
trustedInterfaces = [ "wg0" ];
};
config = {
networking.firewall = {
allowedUDPPorts = lib.optional config.chvp.base.network.wireguard.server 51820;
allowedTCPPorts = lib.optional config.chvp.base.network.wireguard.server 8080;
trustedInterfaces = [ "wg0" ];
};
boot.kernel.sysctl = lib.mkIf config.chvp.base.network.wireguard.server { "net.ipv4.ip_forward" = 1; };
services.unbound = lib.mkIf config.chvp.base.network.wireguard.server {
enable = true;
resolveLocalQueries = true;
settings = {
server = {
interface = [ "10.240.0.1" "127.0.0.1" "::1" ];
access-control = [
"127.0.0.0/8 allow"
"10.240.0.0/24 allow"
];
private-domain = "internal";
domain-insecure = "internal";
local-zone = builtins.map (name: ''"${name}.internal" redirect'') (builtins.attrNames data);
local-data = builtins.map (name: ''"${name}.internal IN A ${data.${name}.ip}"'') (builtins.attrNames data);
};
forward-zone = {
name = ''"."'';
forward-addr = [
"1.1.1.1@853"
"1.0.0.1@853"
"2606:4700:4700::1111@853"
"2606:4700:4700::1001@853"
];
forward-tls-upstream = "yes";
};
boot.kernel.sysctl = lib.mkIf config.chvp.base.network.wireguard.server { "net.ipv4.ip_forward" = 1; };
services.unbound = lib.mkIf config.chvp.base.network.wireguard.server {
enable = true;
resolveLocalQueries = true;
settings = {
server = {
interface = [ "10.240.0.1" "127.0.0.1" "::1" ];
access-control = [
"127.0.0.0/8 allow"
"10.240.0.0/24 allow"
];
private-domain = "internal";
domain-insecure = "internal";
local-zone = builtins.map (name: ''"${name}.internal" redirect'') (builtins.attrNames data);
local-data = builtins.map (name: ''"${name}.internal IN A ${data.${name}.ip}"'') (builtins.attrNames data);
};
forward-zone = {
name = ''"."'';
forward-addr = [
"1.1.1.1@853"
"1.0.0.1@853"
"2606:4700:4700::1111@853"
"2606:4700:4700::1001@853"
];
forward-tls-upstream = "yes";
};
};
systemd = {
network = {
netdevs.wg0 = {
enable = true;
netdevConfig = {
Name = "wg0";
Kind = "wireguard";
MTUBytes = "1342";
};
systemd = {
network = {
netdevs.wg0 = {
enable = true;
netdevConfig = {
Name = "wg0";
Kind = "wireguard";
MTUBytes = "1342";
};
wireguardConfig =
if config.chvp.base.network.wireguard.server then {
PrivateKeyFile = data.${config.networking.hostName}.privkeyFile;
ListenPort = 51820;
} else {
PrivateKeyFile = data.${config.networking.hostName}.privkeyFile;
};
wireguardConfig =
if config.chvp.base.network.wireguard.server then {
PrivateKeyFile = data.${config.networking.hostName}.privkeyFile;
ListenPort = 51820;
} else {
PrivateKeyFile = data.${config.networking.hostName}.privkeyFile;
};
wireguardPeers =
if config.chvp.base.network.wireguard.server then
(builtins.map
(name: {
PublicKey = data.${name}.pubkey;
AllowedIPs = "${data.${name}.ip}/32";
PresharedKeyFile = pskFile;
})
(builtins.filter (name: name != config.networking.hostName) (builtins.attrNames data)))
else
([{
PublicKey = data.lasting-integrity.pubkey;
AllowedIPs = subnet;
Endpoint =
if config.chvp.base.network.wireguard.onCorporate
then "127.0.0.1:51820"
else "lasting-integrity.vanpetegem.me:51820";
wireguardPeers =
if config.chvp.base.network.wireguard.server then
(builtins.map
(name: {
PublicKey = data.${name}.pubkey;
AllowedIPs = "${data.${name}.ip}/32";
PresharedKeyFile = pskFile;
PersistentKeepalive = 25;
}]);
};
networks.wg0 = {
enable = true;
name = "wg0";
address = [ "${data.${config.networking.hostName}.ip}/32" ];
domains = [ "internal" ];
dns = [ data.lasting-integrity.ip ];
linkConfig.MTUBytes = "1342";
routes = [
(
if config.chvp.base.network.wireguard.server then {
Gateway = "${data.${config.networking.hostName}.ip}";
Destination = subnet;
} else {
Gateway = "${data.lasting-integrity.ip}";
Destination = subnet;
GatewayOnLink = true;
}
)
];
};
})
(builtins.filter (name: name != config.networking.hostName) (builtins.attrNames data)))
else
([{
PublicKey = data.lasting-integrity.pubkey;
AllowedIPs = subnet;
Endpoint = "lasting-integrity.vanpetegem.me:51820";
PresharedKeyFile = pskFile;
PersistentKeepalive = 25;
}]);
};
networks.wg0 = {
enable = true;
name = "wg0";
address = [ "${data.${config.networking.hostName}.ip}/32" ];
domains = [ "internal" ];
dns = [ data.lasting-integrity.ip ];
linkConfig.MTUBytes = "1342";
routes = [
(
if config.chvp.base.network.wireguard.server then {
Gateway = "${data.${config.networking.hostName}.ip}";
Destination = subnet;
} else {
Gateway = "${data.lasting-integrity.ip}";
Destination = subnet;
GatewayOnLink = true;
}
)
];
};
};
age.secrets."files/wireguard/psk" = {
file = ../../../../secrets/files/wireguard/psk.age;
owner = "systemd-network";
};
age.secrets."files/wireguard/${config.networking.hostName}.privkey" = {
file = ../../../../secrets/files/wireguard + "/${config.networking.hostName}.privkey.age";
owner = "systemd-network";
};
};
age.secrets."files/wireguard/psk".owner = "systemd-network";
age.secrets."files/wireguard/${config.networking.hostName}.privkey".owner = "systemd-network";
}

1
modules/shared/base/default.nix
View file

@ -6,6 +6,7 @@
./nix
./phone-push
./tmux
./wireguard
./zfs
./zsh
];

56
modules/shared/base/wireguard/default.nix Normal file
View file

@ -0,0 +1,56 @@
{ config, lib, ... }:
let
data = {
fairphone = {
pubkey = "mHAq+2AP1EZdlSZIxA8UCret8EStrR3nEIU2x6NVETE=";
ip = "10.240.0.4";
};
kholinar = {
pubkey = "oRA22ymFeNQBeRx6Jyd6Gd8EOUpAv9QSFkGs+Br7yEk=";
privkeyFile = config.age.secrets."files/wireguard/kholinar.privkey".path;
ip = "10.240.0.3";
};
lasting-integrity = {
pubkey = "mid3XfCY2jaNK0J6C9ltFLAbxL0IApwMw9K1Z+PU8C0=";
privkeyFile = config.age.secrets."files/wireguard/lasting-integrity.privkey".path;
ip = "10.240.0.1";
};
thaylen-city = {
pubkey = "O0q2/W7dRM4LvAL9MSDZqAbGSzqi8AHLVl1sJsRDsUY=";
privkeyFile = config.age.secrets."files/wireguard/thaylen-city.privkey".path;
ip = "10.240.0.5";
};
urithiru = {
pubkey = "f4bnm/qNhMW5iXdQcBMmP8IUN6n+pDS15Ikct7QPr0E=";
privkeyFile = config.age.secrets."files/wireguard/urithiru.privkey".path;
ip = "10.240.0.2";
};
};
subnet = "10.240.0.0/24";
pskFile = config.age.secrets."files/wireguard/psk".path;
in
{
options.chvp.base.network.wireguard = {
server = lib.mkOption {
default = false;
example = true;
};
data = lib.mkOption {
default = data;
readOnly = true;
};
subnet = lib.mkOption {
default = subnet;
readOnly = true;
};
pskFile = lib.mkOption {
default = pskFile;
readOnly = true;
};
};
config = {
age.secrets."files/wireguard/psk".file = ../../../../secrets/files/wireguard/psk.age;
age.secrets."files/wireguard/${config.networking.hostName}.privkey".file = ../../../../secrets/files/wireguard + "/${config.networking.hostName}.privkey.age";
};
}

1
secrets.nix
View file

@ -98,6 +98,7 @@ in
"secrets/files/wireguard/kholinar.privkey.age".publicKeys = [ kholinar ] ++ users;
"secrets/files/wireguard/lasting-integrity.privkey.age".publicKeys = [ lasting-integrity ] ++ users;
"secrets/files/wireguard/thaylen-city.privkey.age".publicKeys = [ thaylen-city ] ++ users;
"secrets/files/wireguard/urithiru.privkey.age".publicKeys = [ urithiru ] ++ users;
"secrets/files/wireguard/psk.age".publicKeys = hosts ++ users;

10
secrets/files/wireguard/thaylen-city.privkey.age Normal file
View file

@ -0,0 +1,10 @@
age-encryption.org/v1
-> ssh-ed25519 KOkamg Ave15/4+uu5FWfIK1qLwImESyCDLzilWQeuNiim7MHc
yU/8z7o6CAQdeoXwOPL6tdJ17kV9Q/jWRZldPk4m9so
-> ssh-ed25519 s9rb8g r/CcbdZE6VCXnb2VbVFJCbcn/ANYIja0ulmr81tydhQ
KiKlxc6G1ry4/ryYZ6hoKNJPvLGaN+Q4L2oPqp+3Zbs
-> ssh-ed25519 +xxExQ TlRgGa91hF8kxkdVKyMQSe0A+8LRYRA270vVUnz4ySs
9uRwCJxDtnOssBji90+WHg6S+0vohS889YxX47J6sPI
--- Wgz5JZUMJpoXP/lEXZKIfGVyMdvgMcNeVpzOZ/FmDT0
GÐ1NÜ;^ÛŠÔŒ–,áwÏéNMÔ .)¾ûÞTu}·J`»¡_½W¢ÍóèåѬ—
'.que<>²`¿r‹†E<E280A0> ©ó+<2B>×V’Ä•