59 lines
1.6 KiB
Nix
59 lines
1.6 KiB
Nix
{
|
|
lib,
|
|
config,
|
|
pkgs,
|
|
...
|
|
}: let
|
|
inherit (lib.modules) mkIf;
|
|
inherit (builtins) hasAttr;
|
|
|
|
# Assume this to be set
|
|
secrets = config.services.secrets.secrets;
|
|
|
|
wireguard_data = import ../../data/chaos_wireguard_internal.nix {};
|
|
wireguard_hosts = wireguard_data.hosts;
|
|
|
|
currentHostName = config.networking.hostName;
|
|
currentHostConfig = wireguard_hosts.${currentHostName};
|
|
in {
|
|
networking.firewall.allowPing = true;
|
|
networking.firewall.allowedUDPPorts = mkIf (hasAttr "endpoint" currentHostConfig) [51820];
|
|
|
|
systemd.services.wireguard-debug = {
|
|
wantedBy = ["multi-user.target"];
|
|
partOf = ["wg-quick-wg0.service"];
|
|
script = ''
|
|
echo module wireguard +p > /sys/kernel/debug/dynamic_debug/control
|
|
'';
|
|
};
|
|
|
|
networking.wg-quick.interfaces = {
|
|
wg0 = {
|
|
address = ["${currentHostConfig.ip}/24"];
|
|
privateKeyFile = "${secrets.wg_priv.path}";
|
|
listenPort = mkIf (hasAttr "endpoint" currentHostConfig) 51820;
|
|
|
|
peers = [
|
|
# hetzner-vm
|
|
(mkIf (currentHostName != "hetzner-vm") (let
|
|
host = wireguard_hosts."hetzner-vm";
|
|
in {
|
|
allowedIPs = ["${host.ip}/32"];
|
|
publicKey = host.public;
|
|
#presharedKeyFile = secrets.wg_preshared_hetzner-vm.path;
|
|
endpoint = host.endpoint or null;
|
|
}))
|
|
# vault
|
|
(mkIf (currentHostName != "vault") (let
|
|
host = wireguard_hosts."vault";
|
|
in {
|
|
allowedIPs = ["${host.ip}/32"];
|
|
publicKey = host.public;
|
|
#presharedKeyFile = secrets.wg_preshared_vault.path;
|
|
endpoint = host.endpoint or null;
|
|
}))
|
|
];
|
|
};
|
|
};
|
|
}
|