qenya/nixfiles
1
0
Fork 0
Code Issues 4 Pull requests Activity Actions

birdsong: fully modularise existing wireguard config

Browse source
This commit is contained in:
Katherina Walshe-Grey 2024-07-25 07:52:43 +01:00
parent 5b79e6826b
commit e90afae7ac
6 changed files with 197 additions and 52 deletions
Download patch file Download diff file Expand all files Collapse all files

29
hosts/orm/wireguard.nix
View file

@ -3,31 +3,8 @@
{
age.secrets.wireguard-hub.file = ../../secrets/wireguard-hub.age;
networking = {
nat = {
enable = true;
externalInterface = "ens3";
internalInterfaces = [ "wg0" ];
};
firewall.allowedUDPPorts = [ config.networking.wireguard.interfaces.wg0.listenPort ];
wireguard.interfaces.wg0 = {
ips = [ "10.127.1.1/24" "fd70:81ca:0f8f:1::1/64" ];
listenPort = 51820;
privateKeyFile = config.age.secrets.wireguard-hub.path;
peers = [
{
name = "shaw";
publicKey = "eD79pROC2zjhKz4tGRS43O95gcFRqO+SFb2XDnTr0zc=";
allowedIPs = [ "10.127.1.2" "fd70:81ca:0f8f:1::2" ];
}
{
name = "tohru";
publicKey = "lk3PCQM1jmZoI8sM/rWSyKNuZOUnjox3n9L9geJD+18=";
allowedIPs = [ "10.127.1.3" "fd70:81ca:0f8f:1::3" ];
}
];
};
birdsong.peer = {
enable = true;
privateKeyFile = config.age.secrets.wireguard-hub.path;
};
}

4
hosts/tohru/wireguard.nix
View file

@ -6,10 +6,6 @@
birdsong.peer = {
enable = true;
privateKeyFile = config.age.secrets.wireguard-peer-tohru.path;
listenPort = 51821;
persistentKeepalive = 23;
};
# TODO: get this from a list of peers, keyed on hostname
networking.wireguard.interfaces.birdsong.ips = [ "10.127.1.3/24" "fd70:81ca:0f8f:1::3/64" ];
}

7
hosts/yevaud/configuration.nix
View file

@ -9,6 +9,13 @@
boot.loader.systemd-boot.enable = true;
boot.loader.efi.canTouchEfiVariables = true;
age.secrets.wireguard-peer-yevaud.file = ../../secrets/wireguard-peer-yevaud.age;
birdsong.peer = {
enable = true;
privateKeyFile = config.age.secrets.wireguard-peer-yevaud.path;
};
qenya.services.forgejo = {
enable = true;
domain = "git.qenya.tel";