chvp/nixos-config
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Setup wireguard

Browse source
This commit is contained in:
Charlotte Van Petegem 2022-11-18 23:25:54 +01:00
parent 66e515a419
commit d6619a35fa
No known key found for this signature in database
GPG key ID: 019E764B7184435A
10 changed files with 216 additions and 46 deletions
Download patch file Download diff file Expand all files Collapse all files

3
modules/base/network/default.nix
View file

@ -2,7 +2,8 @@
{
imports = [
./ovh.nix
./mobile.nix
./ovh.nix
./wireguard.nix
];
}

72
modules/base/network/mobile.nix
View file

@ -19,39 +19,39 @@
networking = {
useDHCP = false;
wireless = {
enable = true;
interfaces = [ wireless-interface ];
environmentFile = config.age.secrets."passwords/networks.age".path;
networks = {
"Public Universal Friend".psk = "@PSK_PUF@";
AndroidAP.psk = "@PSK_AndroidAP@";
draadloosnw.psk = "@PSK_draadloosnw@";
werknet.psk = "@PSK_werknet@";
Secorima.psk = "@PSK_Secorima@";
"Zeus WPI" = {
psk = "@PSK_Zeus@";
hidden = true;
enable = true;
interfaces = [ wireless-interface ];
environmentFile = config.age.secrets."passwords/networks.age".path;
networks = {
"Public Universal Friend".psk = "@PSK_PUF@";
AndroidAP.psk = "@PSK_AndroidAP@";
draadloosnw.psk = "@PSK_draadloosnw@";
werknet.psk = "@PSK_werknet@";
Secorima.psk = "@PSK_Secorima@";
"Zeus WPI" = {
psk = "@PSK_Zeus@";
hidden = true;
};
"Zeus Event 5G".psk = "@PSK_Zeus@";
eduroam = {
authProtocols = [ "WPA-EAP" ];
auth = ''
eap=PEAP
identity="@EDUROAM_USER@"
password="@EDUROAM_PASS@"
'';
extraConfig = ''
phase1="peaplabel=0"
phase2="auth=MSCHAPV2"
group=CCMP TKIP
ca_cert="${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
altsubject_match="DNS:radius.ugent.be"
'';
};
"GUK-huis".psk = "@PSK_GUKhuis@";
};
"Zeus Event 5G".psk = "@PSK_Zeus@";
eduroam = {
authProtocols = [ "WPA-EAP" ];
auth = ''
eap=PEAP
identity="@EDUROAM_USER@"
password="@EDUROAM_PASS@"
'';
extraConfig = ''
phase1="peaplabel=0"
phase2="auth=MSCHAPV2"
group=CCMP TKIP
ca_cert="${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
altsubject_match="DNS:radius.ugent.be"
'';
};
"GUK-huis".psk = "@PSK_GUKhuis@";
};
};
};
systemd.network = {
enable = true;
networks = {
@ -60,11 +60,13 @@
DHCP = "yes";
matchConfig = { Name = wireless-interface; };
};
} // lib.mapAttrs (name: attrs: {
enable = true;
DHCP = "yes";
matchConfig = { Name = name; };
} // attrs) wired-interfaces;
} // lib.mapAttrs
(name: attrs: {
enable = true;
DHCP = "yes";
matchConfig = { Name = name; };
} // attrs)
wired-interfaces;
wait-online.anyInterface = true;
};

106
modules/base/network/wireguard.nix Normal file
View file

@ -0,0 +1,106 @@
{ config, lib, pkgs, ... }:
let
data = {
fairphone = {
pubkey = "mHAq+2AP1EZdlSZIxA8UCret8EStrR3nEIU2x6NVETE=";
ip = "10.240.0.5";
};
kharbranth = {
pubkey = "Zc45PJl+kaa/2GnIs1ObfAmbe640uJ4h1oRn6+qOQHU=";
privkeyFile = config.age.secrets."files/wireguard/kharbranth.privkey".path;
ip = "10.240.0.3";
};
kholinar = {
pubkey = "oRA22ymFeNQBeRx6Jyd6Gd8EOUpAv9QSFkGs+Br7yEk=";
privkeyFile = config.age.secrets."files/wireguard/kholinar.privkey".path;
ip = "10.240.0.4";
};
lasting-integrity = {
pubkey = "mid3XfCY2jaNK0J6C9ltFLAbxL0IApwMw9K1Z+PU8C0=";
privkeyFile = config.age.secrets."files/wireguard/lasting-integrity.privkey".path;
ip = "10.240.0.1";
};
urithiru = {
pubkey = "f4bnm/qNhMW5iXdQcBMmP8IUN6n+pDS15Ikct7QPr0E=";
privkeyFile = config.age.secrets."files/wireguard/urithiru.privkey".path;
ip = "10.240.0.2";
};
};
subnet = "10.240.0.0/24";
pskFile = config.age.secrets."files/wireguard/psk".path;
in
{
options.chvp.base.network.wireguard = {
server = lib.mkOption {
default = false;
example = true;
};
};
config = {
networking.firewall.allowedUDPPorts = lib.optional config.chvp.base.network.wireguard.server 51820;
networking.firewall.trustedInterfaces = [ "wg0" ];
boot.kernel.sysctl = lib.mkIf config.chvp.base.network.wireguard.server { "net.ipv4.ip_forward" = 1; };
systemd.network = {
netdevs.wg0 = {
enable = true;
netdevConfig = {
Name = "wg0";
Kind = "wireguard";
};
wireguardConfig =
if config.chvp.base.network.wireguard.server then {
PrivateKeyFile = data.${config.networking.hostName}.privkeyFile;
ListenPort = 51820;
} else {
PrivateKeyFile = data.${config.networking.hostName}.privkeyFile;
};
wireguardPeers =
if config.chvp.base.network.wireguard.server then
(builtins.map
(name: {
wireguardPeerConfig = {
PublicKey = data.${name}.pubkey;
AllowedIPs = "${data.${name}.ip}/32";
PresharedKeyFile = pskFile;
};
})
(builtins.filter (name: name != config.networking.hostName) (builtins.attrNames data)))
else
([{
wireguardPeerConfig = {
PublicKey = data.lasting-integrity.pubkey;
AllowedIPs = subnet;
Endpoint = "lasting-integrity.vanpetegem.me:51820";
PresharedKeyFile = pskFile;
PersistentKeepalive = 25;
};
}]);
};
networks.wg0 = {
enable = true;
name = "wg0";
address = [ "${data.${config.networking.hostName}.ip}/32" ];
routes = [{
routeConfig =
if config.chvp.base.network.wireguard.server then {
Gateway = "${data.${config.networking.hostName}.ip}";
Destination = subnet;
} else {
Gateway = "${data.lasting-integrity.ip}";
Destination = subnet;
GatewayOnLink = true;
};
}];
};
};
age.secrets."files/wireguard/psk" = {
file = ../../../secrets/files/wireguard/psk.age;
owner = "systemd-network";
};
age.secrets."files/wireguard/${config.networking.hostName}.privkey" = {
file = ../../../secrets/files/wireguard + "/${config.networking.hostName}.privkey.age";
owner = "systemd-network";
};
};
}