40 lines
1.3 KiB
Nix
40 lines
1.3 KiB
Nix
|
{config, ...}: let
|
||
|
|
secrets = config.services.secrets.secrets;
|
||
|
|
in {
|
||
|
|
networking.firewall.trustedInterfaces = ["wg0"];
|
||
|
|
networking.wg-quick.interfaces = {
|
||
|
|
wg0 = {
|
||
|
|
autostart = false;
|
||
|
|
address = ["10.69.42.2/32"];
|
||
|
|
privateKeyFile = "${secrets.wg_priv.path}";
|
||
|
|
|
||
|
|
peers = [
|
||
|
|
# hetzner-vm
|
||
|
|
{
|
||
|
|
publicKey = "UJr+EmUM7KWkIy0nk0JA38ibvcLC++6iuOKkHdrx9Dc=";
|
||
|
|
presharedKeyFile = "${secrets.wg_preshared_hetzner-vm.path}";
|
||
|
|
allowedIPs = ["10.69.42.1/32"];
|
||
|
|
endpoint = "hetzner-vm.servers.genderfucked.monster:51820";
|
||
|
|
persistentKeepalive = 25;
|
||
|
|
}
|
||
|
|
# vault
|
||
|
|
{
|
||
|
|
publicKey = "IGq+WanFM/bKNUkwjO/0AAtDhJLvtvU+mVxH27QyHTc=";
|
||
|
|
presharedKeyFile = "${secrets.wg_preshared_vault.path}";
|
||
|
|
allowedIPs = ["10.69.42.3/32"];
|
||
|
|
endpoint = "vault.servers.genderfucked.monster:51820";
|
||
|
|
persistentKeepalive = 25;
|
||
|
|
}
|
||
|
|
# storage
|
||
|
|
{
|
||
|
|
publicKey = "biNNeCkjAWi2jUVoL5+1pBtXGa3OFZi4DltB2dqGjGg=";
|
||
|
|
presharedKeyFile = "${secrets.wg_preshared_storage.path}";
|
||
|
|
allowedIPs = ["10.69.42.4/32"];
|
||
|
|
endpoint = "storage.servers.genderfucked.monster:51820";
|
||
|
|
persistentKeepalive = 25;
|
||
|
|
}
|
||
|
|
];
|
||
|
|
};
|
||
|
|
};
|
||
|
|
}
|