qenya/nixfiles
1
0
Fork 0
Code Issues 4 Pull requests Activity Actions

yevaud/pennykettle: Standardise port numbers and interface names

Browse source
This commit is contained in:
Katherina Walshe-Grey 2025-06-17 12:14:29 +01:00
parent f590432b7d
commit 5df6e93ae3
1 changed files with 17 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

34
hosts/yevaud/experiments/pennykettle.nix
View file

@ -3,25 +3,25 @@
{ {
networking.nat.enable = true; networking.nat.enable = true;
networking.nat.enableIPv6 = true; networking.nat.enableIPv6 = true;
networking.nat.internalInterfaces = [ "ve-pennykettle1" ]; networking.nat.internalInterfaces = [ "ve-pennykettle" ];
networking.nat.externalInterface = "ens3"; networking.nat.externalInterface = "ens3";
networking.nat.forwardPorts = [ networking.nat.forwardPorts = [
{ {
sourcePort = 51821; sourcePort = 51820;
destination = "10.231.136.2:51821"; destination = "10.231.136.2:51820";
proto = "udp"; proto = "udp";
} }
{ {
sourcePort = 51821; sourcePort = 51820;
destination = "[fc00::2]:51821"; destination = "[fc00::2]:51820";
proto = "udp"; proto = "udp";
} }
]; ];
networking.firewall.allowedUDPPorts = [ 51821 ]; networking.firewall.allowedUDPPorts = [ 51820 ];
containers."pennykettle1" = { containers."pennykettle" = {
privateNetwork = true; privateNetwork = true;
extraVeths."ve-pennykettle1" = { extraVeths."ve-pennykettle" = {
hostAddress = "10.231.136.1"; hostAddress = "10.231.136.1";
localAddress = "10.231.136.2"; localAddress = "10.231.136.2";
hostAddress6 = "fc00::1"; hostAddress6 = "fc00::1";
@ -29,7 +29,7 @@
}; };
ephemeral = true; ephemeral = true;
autoStart = true; autoStart = true;
bindMounts."/run/secrets/wg-key".hostPath = config.age.secrets.protonvpn-pennykettle1.path; bindMounts."/run/secrets/wg-key".hostPath = config.age.secrets.protonvpn-pennykettle.path;
config = { config, pkgs, ... }: { config = { config, pkgs, ... }: {
system.stateVersion = "24.05"; system.stateVersion = "24.05";
@ -38,12 +38,12 @@
networking.useDHCP = false; networking.useDHCP = false;
networking.useHostResolvConf = false; networking.useHostResolvConf = false;
networking.firewall.allowedUDPPorts = [ 51821 ]; networking.firewall.allowedUDPPorts = [ 51820 ];
systemd.network = { systemd.network = {
enable = true; enable = true;
networks."10-ve" = { networks."10-ve-pennykettle" = {
matchConfig.Name = "ve-pennykettle1"; matchConfig.Name = "ve-pennykettle";
networkConfig.Address = [ "10.231.136.2/24" "fc00::2/64" ]; networkConfig.Address = [ "10.231.136.2/24" "fc00::2/64" ];
linkConfig.RequiredForOnline = "yes"; linkConfig.RequiredForOnline = "yes";
routes = [{ routes = [{
@ -52,7 +52,7 @@
}]; }];
}; };
networks."30-protonvpn" = { networks."30-wg-protonvpn" = {
matchConfig.Name = "wg-protonvpn"; matchConfig.Name = "wg-protonvpn";
networkConfig = { networkConfig = {
Address = [ "10.2.0.2/32" ]; Address = [ "10.2.0.2/32" ];
@ -68,14 +68,14 @@
]; ];
}; };
netdevs."30-protonvpn" = { netdevs."30-wg-protonvpn" = {
netdevConfig = { netdevConfig = {
Name = "wg-protonvpn"; Name = "wg-protonvpn";
Kind = "wireguard"; Kind = "wireguard";
Description = "WireGuard tunnel to ProtonVPN (DE#1; NAT: strict, no port forwarding)"; Description = "WireGuard tunnel to ProtonVPN (DE#1; NAT: strict, no port forwarding)";
}; };
wireguardConfig = { wireguardConfig = {
ListenPort = 51821; ListenPort = 51820;
PrivateKeyFile = "/run/secrets/wg-key"; PrivateKeyFile = "/run/secrets/wg-key";
}; };
wireguardPeers = [{ wireguardPeers = [{
@ -89,12 +89,12 @@
networking.nat.enable = true; networking.nat.enable = true;
networking.nat.enableIPv6 = true; networking.nat.enableIPv6 = true;
networking.nat.internalInterfaces = [ "ve-pennykettle1" ]; networking.nat.internalInterfaces = [ "ve-pennykettle" ];
networking.nat.externalInterface = "wg-protonvpn"; networking.nat.externalInterface = "wg-protonvpn";
}; };
}; };
age.secrets.protonvpn-pennykettle1 = { age.secrets.protonvpn-pennykettle = {
file = ../../../secrets/protonvpn-pennykettle1.age; file = ../../../secrets/protonvpn-pennykettle1.age;
owner = "root"; owner = "root";
group = "systemd-network"; group = "systemd-network";