wireguard: initial setup

hosts/orm/configuration.nix

@@ -4,6 +4,7 @@
   imports = [
     ./hardware-configuration.nix
     ./home.nix
+    ./wireguard.nix
   ];
 
   boot.loader.systemd-boot.enable = true;

hosts/orm/wireguard.nix

@@ -0,0 +1,33 @@
+{ config, lib, pkgs, ... }:
+
+{
+  age.secrets.wireguard-hub.file = ../../secrets/wireguard-hub.age;
+
+  networking = {
+    nat = {
+      enable = true;
+      externalInterface = "ens3";
+      internalInterfaces = [ "wg0" ];
+    };
+
+    firewall.allowedUDPPorts = [ config.networking.wireguard.interfaces.wg0.listenPort ];
+
+    wireguard.interfaces.wg0 = {
+      ips = [ "10.127.1.1/24" "fd70:81ca:0f8f:1::1/64" ];
+      listenPort = 51820;
+      privateKeyFile = config.age.secrets.wireguard-hub.path;
+      peers = [
+        {
+          name = "shaw";
+          publicKey = "eD79pROC2zjhKz4tGRS43O95gcFRqO+SFb2XDnTr0zc=";
+          allowedIPs = [ "10.127.1.2" "fd70:81ca:0f8f:1::2" ];
+        }
+        {
+          name = "tohru";
+          publicKey = "lk3PCQM1jmZoI8sM/rWSyKNuZOUnjox3n9L9geJD+18=";
+          allowedIPs = [ "10.127.1.3" "fd70:81ca:0f8f:1::3" ];
+        }
+      ];
+    };
+  };
+}

hosts/tohru/configuration.nix

@@ -9,6 +9,7 @@
       ../../services/fonts.nix
       ../../services/steam.nix
       ./syncthing.nix
+      ./wireguard.nix
     ];
 
   boot.loader.systemd-boot.enable = true;

hosts/tohru/wireguard.nix

@@ -0,0 +1,23 @@
+{ config, lib, pkgs, ... }:
+
+{
+  age.secrets.wireguard-peer-tohru.file = ../../secrets/wireguard-peer-tohru.age;
+
+  networking = {
+    firewall.allowedUDPPorts = [ config.networking.wireguard.interfaces.wg0.listenPort ];
+
+    wireguard.interfaces.wg0 = {
+      ips = [ "10.127.1.3/24" "fd70:81ca:0f8f:1::3/64" ];
+      listenPort = 51821;
+      privateKeyFile = config.age.secrets.wireguard-peer-tohru.path;
+      peers = [
+        {
+          publicKey = "birdLVh8roeZpcVo308Ums4l/aibhAxbi7MBsglkJyA=";
+          allowedIPs = [ "10.127.1.0/24" "fd70:81ca:0f8f:1::/64" ];
+          endpoint = "birdsong.network:51820";
+          persistentKeepalive = 23;
+        }
+      ];
+    };
+  };
+}

secrets.nix

@@ -0,0 +1,19 @@
+let
+  keys = import ./keys.nix;
+
+  commonKeys = keys.users.qenya;
+
+  secrets = with keys; {
+    wireguard-hub = [ machines.orm ];
+    wireguard-peer-orm = [ machines.orm ];
+    wireguard-peer-tohru = [ machines.tohru ];
+  };
+in
+builtins.listToAttrs (
+  map
+    (secretName: {
+      name = "secrets/${secretName}.age";
+      value.publicKeys = secrets."${secretName}" ++ commonKeys;
+    })
+    (builtins.attrNames secrets)
+)

secrets/secrets.nix

@@ -1,4 +0,0 @@
-let
-  keys = ../ssh-keys.nix;
-in
-{ }

secrets/wireguard-hub.age

@@ -0,0 +1,10 @@
+age-encryption.org/v1
+-> ssh-ed25519 l/RSAw +h2Jz8m9ZEklGxWK8HcixO3+D4AVATPI3m3wE1ITviM
+US+J+FDPJ/nmLT1ylRGfXyfjiJRgLpdgCg1L3IPrmrc
+-> ssh-ed25519 900ILw bX/KdX53EFQCmWI0MU/wKfzqKmAw+/fMs4/955iYOlw
+7epwHu5g+p6BHe/ksaA9MAvpneZBwHeqnMtSc1m3FFY
+-> !V-grease &x6T2i d0B}!
+tkT/G8gEKyx280vDO1QgG5ERBCkR9XCgk8IIE1AeBONi9eo+Z0sGfNHv2DXFx14B
+TcKX31wDmUbtv8j+4d7722YeZ4jvKiSuQA38zLREOGJyhA
+--- TR/GFMXQ4N6AMuScg8LSednd6jAJugxgCJLegPtFmgI
+4>?(Yë×Ã|‹R5V¡×ù«	ôן4<C5B8>Å'æ[¤K_Ñ<5F>ë,ϧ
—ÅT²Ïkº5öåTC~“c›×*D[N䃼Þá<ê

secrets/wireguard-hub.pub

@@ -0,0 +1 @@
+birdLVh8roeZpcVo308Ums4l/aibhAxbi7MBsglkJyA=

secrets/wireguard-peer-tohru.age

@@ -0,0 +1,10 @@
+age-encryption.org/v1
+-> ssh-ed25519 yZzWlg HKjvqxwrKVDSKuKcog2RTryVc+0vWII6DdFuouffNWs
+fPlYoR4wSrGPlX3t11J1YSP3yToM2RjJVfLKM4oATxA
+-> ssh-ed25519 900ILw f76/jY251hkNMd3fBVZPuoWleh4ZdSdu95p7WDlmZi4
+iSULkGxw9aokMgv59fhW3LzJR/Dpx+LVCc6jbbPwCgU
+-> vdo-grease
+8NUae81gLW0x8UoCVKqQUZaqkG8FTXwnysjEgXaEGBgDxjpuTp+C5qWczNYAXOFN
+ha3mtF6IYHFHBZKsH0t1366nfYDAQXHOuu0hN4GBBz8gqnUt
+--- uB1k+yMkL5ZUHXGSDv8ZPHDn0UfHOv1x3tRa2eIdbP8
+締Eｭｾ暈Y3ﾎﾀD㎡e/兎4呼G[lQ=Cﾒ<05>ﾔ錏<EFBE94>oﾃvｪ枯ｿ<E69EAF>z<EFBFBD>寥ｷ/nbﾁ<1C>a･_<EFBDA5>ﾑhｸﾁﾎﾖ{A{ｨ

secrets/wireguard-peer-tohru.pub

@@ -0,0 +1 @@
+lk3PCQM1jmZoI8sM/rWSyKNuZOUnjox3n9L9geJD+18=