tlaternet/tlaternet-server
1
0
Fork 0
Code Issues 10 Pull requests Activity

Add wireguard service

Browse source
This commit is contained in:
Tristan Daniël Maat 2023-04-23 23:42:25 +01:00
parent dc03395af5
commit d6333c0a57
Signed by: tlater
GPG key ID: 49670FD774E43268
4 changed files with 86 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

50
configuration/services/wireguard.nix Normal file
View file

@ -0,0 +1,50 @@
{config, ...}: {
systemd.network = {
netdevs = {
"20-wg0" = {
netdevConfig = {
Name = "wg0";
Kind = "wireguard";
Description = "wg0 - wireguard tunnel";
};
wireguardConfig = {
ListenPort = 51820;
PrivateKeyFile = config.sops.secrets."wireguard/server-key".path;
# Public key: 73z3Pga/2BCxETYM/qCT2FM1JUCUvQ+Cp+8ROxjhu0w=
};
wireguardPeers = [
{
# yui
wireguardPeerConfig = {
AllowedIPs = ["10.45.249.2/32"];
PublicKey = "5mlnqEVJWks5OqgeFA2bLIrvST9TlCE81Btl+j4myz0=";
};
}
{
# yuanyuan
wireguardPeerConfig = {
AllowedIPs = ["10.45.249.10/32"];
PublicKey = "0UsFE2atz/O5P3OKQ8UHyyyGQNJbp1MeIWUJLuoerwE=";
};
}
];
};
};
networks = {
"20-wg0" = {
matchConfig.Name = "wg0";
networkConfig.Address = [
"10.45.249.1/24"
# TODO(tlater): Add IPv6 whenever that becomes relevant
];
linkConfig.RequiredForOnline = "no";
};
};
};
}

44
configuration/sops.nix
View file

@ -1,22 +1,34 @@
{
sops = {
defaultSopsFile = ../keys/production.yaml;
secrets."nextcloud/tlater" = {
owner = "nextcloud";
group = "nextcloud";
};
secrets."steam/tlater" = {};
secrets."heisenbridge/as-token" = {};
secrets."heisenbridge/hs-token" = {};
secrets."turn/env" = {};
secrets."turn/secret" = {
owner = "turnserver";
};
secrets."turn/ssl-key" = {
owner = "turnserver";
};
secrets."turn/ssl-cert" = {
owner = "turnserver";
secrets = {
"nextcloud/tlater" = {
owner = "nextcloud";
group = "nextcloud";
};
"steam/tlater" = {};
"heisenbridge/as-token" = {};
"heisenbridge/hs-token" = {};
"wireguard/server-key" = {
owner = "root";
group = "systemd-network";
mode = "0440";
};
"turn/env" = {};
"turn/secret" = {
owner = "turnserver";
};
"turn/ssl-key" = {
owner = "turnserver";
};
"turn/ssl-cert" = {
owner = "turnserver";
};
};
};
}