Test wireguard setup
This commit is contained in:
parent
7f98328b26
commit
5ddd010f03
5 changed files with 104 additions and 50 deletions
|
|
@ -6,6 +6,8 @@ mail:
|
|||
users:
|
||||
macronova:
|
||||
password: ENC[AES256_GCM,data:GSWsFhbxrUn1/tuURrl+D9wR80PZWzMU8sIjZpDyCyTrsCnbwcyqlsEx6MYSF/bRtAujR/kH2ppLM5O6QcIduETIMfjAMl8th9ZbQLUPiTpXRkfI01GKeUzYuvlATBGbnNHouJ2HJPamG+TJSBrbJJasoe5wUQ==,iv:RZQXTptp9MZejgrhWbeHSk0qgA4lSyo9yFdKZdJfvIk=,tag:38KJZbV19oT+3MH60d/grw==,type:str]
|
||||
wireguard:
|
||||
singularity: ENC[AES256_GCM,data:l9Caypu4lLh2uenMYgBxavvKvPMERx9t3yA4S9mDEonqJgQQivI/0+Iqfj4=,iv:VZmPjpsjzVjlXLjhVtvCduQyL2xO6UHf8RjjXhVbzYw=,tag:ob/jfUvWeFtsf/0J6Kee2A==,type:str]
|
||||
xray:
|
||||
config.json: ENC[AES256_GCM,data:OfdVi938yFyZxV9aXRmLcO6Yr/fwocu2msSUHXIfTZUn4D2lrQhZMCtdkJoZxI/4hCxPGGns9FlJ10++iVJTPAp0UyEV2f2bsWfR/K9X1oD0j0jSdF4V7bwXUeAFtdCJKcuZ8zj/7UrrUucQ3Pwg2iYrzkzyJq38qWu47mIv8N2ata+mS+mle66Fh2YX74pZ6BuziUGuZ6QSVjz/s/YvCfyhPQD1t4zAEjHD2/jigZ4ZKhE7HbdDt3/W1S8m5+DhWSf+INVjcQt+DU4buEz1jNrQQxZXJTR4ZtRQJI6/oUN6deQLQtzBIIL7dGlbsTKp9IW6bho4mP/u162muq0vNskUafawWwaSpdyRnqTzqRHuzA1JfsSJVc6awf+3N35VjCBNmLXOTsdl4GNXt4IA4sRNyXS3dnToW1V9Jbr4zuECsdm2XnnODvkc/wwbL0JG9uav9soerd+FZ/9LZ8ETvN/8UcbjuQtrdSwLvu+bKb/mkJ9k03/cZL0OPeSYvJo1tBjN+bR/r2WG0iQSLsIkZoIv4PfhjveBRitFHUeZYQAbVbxK+LbV5pzfb8Nbf7tMJyXBSBf1d364Z85Aj5+AgTTW7LQqKKSs9YuHsQSARBlqPBdXnh25nTgPfUIt/Z+PDE8ryxOW8vITvo8RJ6b15Y1niwwFFcfbpdn13r+/9exFaV48huVllZz3C7HpC57GBrMyIN34G2ZA/VQ7UW8LxJLxhaBDLj0jHHI/BzTsBvwzvWKWFbnIu1yKX9Nn9I+Qa4RSxfSbiLjGUkRelL6+ktzCZmUxx+DiUOITpQ2F36XBGbclZHKhBIJRoSYNPGP6BKB/7s3l2pk5MZW8rmhe0Y1gK3aVZEfS2d6sIxD5xZ7gVV+U6hVaa+CAGf9mlHWbnMWnjuHeuKGAXgw0c0GjpQvL6c7G16sCFBDyeaiiJJPUDyHCiY83m/UeL2RjhYAbG4ydDflP1/BfZl4YV5xNFnbvMWehNV7JY5J8FbepdIwz6OJ6tibt7Qfny7/uYvA5+dKb53G/A0MzLG9IkiLpfTVdfVwD1iU288hqcADCY1yw+m46ivGvU/GJNHxUzmZ1rvxB9+cxox2BIJp75Fre39EMcu0at8br9K+NGE63e2epdXqUQ0Qi3PQL/4Dx9xI1SVtn62DwOuFuAgjYbVP3BA7PYePan6nMEBOhIR+pJJWxBhYGeKJIuqBECoX6ht0ldVzn8wyoa0eEs2sc5LpqqrxAJij4oRprjol/7MYU+ZESMP2Cap46qsSeqCX8v6d/wz73VEmyzbzgSsfGfoXhu9k9eM+Xt5ULhjYyK1Rt+HoVRapyBI+tsk+AUc14ItBvQZfmZ0QZZgTyLXyYzDbGg3t2ZBCC/vedPzeRSW/PgBTS/fiVBRzKTms62IWZ1ggyn9X8QXpyWbIix9BFThfm2c1stKcCXp1iKs0IdNj6Lrwvoimuzs6nS7+oWhTJrELuNz9ok6sFxg6GDAv+9v+7dYZnYm6SwlzTD/DIxlqT2ozW2cqwNwilBC7gyxFH7wUuHD1tz7t5mkkIi+r2rq4gIRS/UFcW37zV0deg3JpFxhEkitIw4+WWG8gcuollYw60xfCI5qu4kIZiTYV7oRQYJTnJDF44pDngq1frOuPIT+D5lh+R4TSYL9/4zt6Cdp+2FLddyyyW6mUSXIz6ribg+q6JV2Su8qozBWAlAr3lkesBCuobgBRXECPfIksg9SOVhZulAu1/mo0H/F7XJvTBgQurx1+nTgfJSoQtLlbgSCYr4aViJZOMOdL+yZk5tBwKNx+sF6mZwhe4pSlpIbqtPJeDDA0JC6/OabvSFFXhkYOUll7nA071oUvtdiXYoh2Vv7GJdJMHxxbSVjKv/dYbfXuDN+036bXnXbu2WPbxRTyRxLeLSCli+ngxbl5BOPS+2N/JItTcaRur7K98vuaHDzr1y6eA0GXJxm0PDqMd2F2MW12QDLTtEhq0+hn5HJcOBB4CNLn0mBXbMS8VHDoLokwMtZg3ukcBMnBfza9Q7BcBovypOtjrZ50zU40x4bA7YwPojHSXkAHrUNElBPSOjV5JvkAcX6CF6BG8PloJc+5aC3eGFQ/teymS9HbmPpCI7rXV5D7gsy9kdL1yVtQpOLsdcoERidyh21aEL2q5s26ri8/7e7TF4bpVE1bNiuus68kNZxqabuBfVOEzS0yKBnEHxqtJxZlPvakVQjdfQ0faLLjzXCvXsn3+pPQf0h8yXtLKmlIOlC+G2CoSGtXQ30ha7XuQqzWQBCu5Wv3fAHQyAgJIRzGn+OVz86r2/Gt4sRIECWKPylZi3Yh0XkNIA53T170hUTIi+aSSUgH7trKm0hp7VMJIBa74gyBuQnfez/lI/IDxkiZICmatYgjRL1QkHBvvxmT+4LYHy+nIuSu8OQX0HVRlRY3mkdarH8ypMvqqDkuCtOJPyQlW3qZxg1Us68X4lyviQISd0EeBf7/pRXXGpk6t50CYCvB0Hpz6e/CQZnTcyMvLzwpR1L/SqLL0vHY+bE7B72pL97o3o5GfiBvgKvIhgqqqwYQpt34mR580ZH2UkfgeCWI9uvpv/WaX8y0jHf2rifhLcTYShDLcv2j+/Kq5kGx+UjaRe2JFYKWOCX0S7JUO/FVDaL56F1u/WVSj7LSWQhtWK18OdZfyx8Epdce+bgcEx2zv5I8HByQznbib6bIrWOIWzp5y4wdoIlbmbUC2zax6j9v5Mxwpdy5VW2731fCsOX9SarqeK4GGzhYzqqxePJpif+AD4xcAY53XgOg38hQ8nUdJvSk7xVb0Sl4iWezHF6tt495/tlw6yyNQfs1TfMnYP4o0UhN8jTi8FnA1V1cMiKnOz4FWPl06X6cyZZDwO3ZmfSNjilusNdeuXUMJk67+h5xyik+r7Mkduz6fbno6YRTGFwkz,iv:a/F/UBjwV+rteo2Qle9XOVYW9ltdD/nfLh/1Pr5yiWU=,tag:tYd1w+b7DfZERGZQwRbHoA==,type:str]
|
||||
sops:
|
||||
|
|
@ -32,8 +34,8 @@ sops:
|
|||
ZW9EMlgrMnFHaHdQSWgvM25ocmNoVEkKo7H1Y+kZrtmk58Oe6d51wJQLF5T7OZtX
|
||||
0LgNOjevRPfxG4FpNk9yhLyrelpHkiSmBFTGHqbnouFE54L1eot/UQ==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
lastmodified: "2023-11-10T04:23:27Z"
|
||||
mac: ENC[AES256_GCM,data:NlqS7FULlV2hDaliQUAgO5MS55CmtB/jL5r7SeVAZQ5+CpwdnyEZxV5xfMPFJ52gez1219c8NHPtlgXIpzxax/krx5Zjpfm1yK1XvKjn/BCKVJm0Uedoapaour3nlJFtjYq0xY4+XJKkDzB9Gn0GgZmrNMyyXR55FeEo+CkUWCg=,iv:28Jh0J4gsB7zNFam0ofarP19Aln3LAHhxzXFGnnXpm8=,tag:nF2O0trXvrdx0LE7yUe/FQ==,type:str]
|
||||
lastmodified: "2023-11-15T04:26:43Z"
|
||||
mac: ENC[AES256_GCM,data:8v+maj6UcpyVZJQGYurDjMAP824WJbiYrUpuCoow4R+bcmBecCu7F4v3G4T89tGP5ZgdOWryzoQwz6c3E5/YQkqiZh0JwYUJ2CY+UddDn1gbBU04Dyzmg/aKLWpWmwi9iyYVjVpNT26Jrykx+EQI9gfEEnUirPHZAW7mm+gT2Ww=,iv:xPTgMwKHPrNQiWyOxriIjoQsUR86M5UmQ5OIoZBhOE8=,tag:1E25JFRGxjMvvXXIoEh2jA==,type:str]
|
||||
pgp: []
|
||||
unencrypted_suffix: _unencrypted
|
||||
version: 3.8.1
|
||||
|
|
|
|||
|
|
@ -3,6 +3,9 @@ cloudflare:
|
|||
users:
|
||||
macronova:
|
||||
password: ENC[AES256_GCM,data:o3WtsW7x9wy+gtl8UiT/s5q7F7Ym4q/CGvTy5Hl6FfvaEhbC/GPHQKVbz0MmRF3WV7Oq3jNxdryxWgXcd+WSCHoThNRIh/B4ZpLePD9Yi7Bf6trEYGWMdQM1Qx9pET7FaEBVOJC8eg+Ca4b/cASo53iuim6wzw==,iv:dbypWZHIXhl1kSnyiqW6R/O4NZb7u0R9X+tYpCKEMw4=,tag:bgCiGaH7EVfu7Sox0vulug==,type:str]
|
||||
wireguard:
|
||||
blitzar: ENC[AES256_GCM,data:Sk4BMqMiGlpy5wrczusc5/3w5DU3ceEe2Ktw9JDG5+3+TFlhs1aw/rENgOY=,iv:Ck68whhhw2nqCzirMfrSQA4uiGoP8ZKXM3ho97tkoYA=,tag:qJRMGCwB1iCyhhUKfD9s1Q==,type:str]
|
||||
nebula: ENC[AES256_GCM,data:0psRgoaUQfP7zKnEaOIbvIPt0MDtRluICs+icz34kl7pJvnlVonY33qjJyA=,iv:hLL32WAy9VDND2/fiFvLzDPabvZjHzWRIOXvRDGVmgg=,tag:ltRzF8VZbPKC2GdxMrpF1Q==,type:str]
|
||||
sops:
|
||||
kms: []
|
||||
gcp_kms: []
|
||||
|
|
@ -36,8 +39,8 @@ sops:
|
|||
TG5mYWd3MnI5TlZiNXBjb0JJY3BvN0EKUd0ldQPe0/zdHjsmKEUhH7xkpO4nLfd5
|
||||
fnTk1jGonJg+t+TqLLg/YYKlcNkgExWaIZ7wrd0RVKXOeC2BtM/wzQ==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
lastmodified: "2023-08-18T01:56:26Z"
|
||||
mac: ENC[AES256_GCM,data:hYx5DAqxXmnVRpFiE+jamI+/hYODzOsQ6+t9Gjf4mxgKXOHNDBwsmfxtNc/ZGOyfVlwa7tdGlKUxkiqe1SlJ/5v+Z5O6xv2dGJM/E+1D1YFuhcnye6EL9IYtia0ziS0A/vcN1afpaXZK7G6pMWCtjTLZ76hRyu0FlPJh5MMQZYo=,iv:TsSyplcz4JHrEr/n7XOVWGvP+ttYv9+HsQpbGYFq13I=,tag:DDiAY0sTKPRSsG59kv4j0g==,type:str]
|
||||
lastmodified: "2023-11-15T04:54:01Z"
|
||||
mac: ENC[AES256_GCM,data:B+NuRN+BkRPdF2Vr5M4y5sv+4iMuLVZM4Rzuqb+7I0/LqUHNBkgUDg6VYLBkYr4wbr6MCpgACeoevIRQbbjJnfHW7YMwDTqDsX40uELIy23828aKGRW6vWXnSLllpYn5IrXRCWjT8j29tJrhqPLiLLlQt3XQVtiNGBTyhnq5fTw=,iv:IDuSMnQ0FcTi3xDpXUhiolBajAAWrjgW14gOTF8iu/k=,tag:XHEGFeeJcgKoum970a0WCQ==,type:str]
|
||||
pgp: []
|
||||
unencrypted_suffix: _unencrypted
|
||||
version: 3.7.3
|
||||
version: 3.8.1
|
||||
|
|
|
|||
|
|
@ -7,7 +7,17 @@
|
|||
wifi.backend = "iwd";
|
||||
};
|
||||
nftables.enable = true;
|
||||
wireguard.interfaces.wgb = {
|
||||
ips = [ "10.32.54.2/32" ];
|
||||
peers = [{
|
||||
allowedIPs = [ "10.32.54.0/24" ];
|
||||
publicKey = "0j8+alXU/f2UgWN61R6+Wjs9xelGRwpSbe5NyOwWlF4=";
|
||||
endpoint = "${config.constants.domain}:45556";
|
||||
}];
|
||||
privateKeyFile = config.sops.secrets."wireguard/${config.networking.hostName}".path;
|
||||
};
|
||||
wireless.iwd.enable = true;
|
||||
};
|
||||
services.resolved.enable = true;
|
||||
sops.secrets."wireguard/${config.networking.hostName}" = { };
|
||||
}
|
||||
|
|
|
|||
|
|
@ -11,32 +11,44 @@ let hn = config.networking.hostName; in {
|
|||
};
|
||||
nftables.enable = true;
|
||||
tempAddresses = "disabled";
|
||||
wireguard.interfaces.wgn = {
|
||||
ips = [ "10.32.54.3/32" ];
|
||||
peers = [{
|
||||
allowedIPs = [ "10.32.54.0/24" ];
|
||||
publicKey = "0j8+alXU/f2UgWN61R6+Wjs9xelGRwpSbe5NyOwWlF4=";
|
||||
endpoint = "${config.constants.domain}:45556";
|
||||
}];
|
||||
privateKeyFile = config.sops.secrets."wireguard/${hn}".path;
|
||||
};
|
||||
wireless.iwd.enable = true;
|
||||
};
|
||||
|
||||
sops.secrets."cloudflare/${hn}" = { };
|
||||
|
||||
services.cloudflare-dyndns = {
|
||||
enable = true;
|
||||
apiTokenFile = config.sops.secrets."cloudflare/${hn}".path;
|
||||
domains = builtins.attrNames config.services.caddy.virtualHosts;
|
||||
ipv4 = false;
|
||||
ipv6 = true;
|
||||
};
|
||||
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
hostKeys = [{
|
||||
comment = "host@${hn}";
|
||||
path = "/etc/ssh/host";
|
||||
rounds = 100;
|
||||
type = "ed25519";
|
||||
}];
|
||||
settings = {
|
||||
PasswordAuthentication = false;
|
||||
KbdInteractiveAuthentication = false;
|
||||
services = {
|
||||
cloudflare-dyndns = {
|
||||
enable = true;
|
||||
apiTokenFile = config.sops.secrets."cloudflare/${hn}".path;
|
||||
domains = builtins.attrNames config.services.caddy.virtualHosts;
|
||||
ipv4 = false;
|
||||
ipv6 = true;
|
||||
};
|
||||
openssh = {
|
||||
enable = true;
|
||||
hostKeys = [{
|
||||
comment = "host@${hn}";
|
||||
path = "/etc/ssh/host";
|
||||
rounds = 100;
|
||||
type = "ed25519";
|
||||
}];
|
||||
settings = {
|
||||
PasswordAuthentication = false;
|
||||
KbdInteractiveAuthentication = false;
|
||||
};
|
||||
};
|
||||
resolved.enable = true;
|
||||
};
|
||||
|
||||
services.resolved.enable = true;
|
||||
sops.secrets = {
|
||||
"cloudflare/${hn}" = { };
|
||||
"wireguard/${hn}" = { };
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,33 +1,60 @@
|
|||
{ config, ... }:
|
||||
|
||||
let hn = config.networking.hostName; in {
|
||||
networking = {
|
||||
networking = let wg = { interface = "wgs"; port = 45556; }; in {
|
||||
domain = config.constants.domain;
|
||||
firewall.allowedTCPPorts = [ 80 443 50051 ];
|
||||
hostId = "2cadb253";
|
||||
};
|
||||
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
settings = {
|
||||
KbdInteractiveAuthentication = false;
|
||||
PasswordAuthentication = false;
|
||||
firewall = {
|
||||
allowedTCPPorts = [ 80 443 50051 ];
|
||||
allowedUDPPorts = [ wg.port ];
|
||||
};
|
||||
hostId = "2cadb253";
|
||||
nat = {
|
||||
enable = true;
|
||||
externalInterface = "ens18";
|
||||
internalInterfaces = [ wg.interface ];
|
||||
};
|
||||
nftables.enable = true;
|
||||
wireguard.interfaces.${wg.interface} = {
|
||||
ips = [ "10.32.54.76/24" ];
|
||||
listenPort = wg.port;
|
||||
peers = [
|
||||
{
|
||||
allowedIPs = [ "10.32.54.2/32" ];
|
||||
publicKey = "RhS1H8g47EnOhu1F6y3QO6XqxnabGcNNb0BixBuKkDQ=";
|
||||
}
|
||||
{
|
||||
allowedIPs = [ "10.32.54.3/32" ];
|
||||
publicKey = "1OA03mqu7SxREAum4UabJKD7hf+foPLu1j0E1N5K508=";
|
||||
}
|
||||
];
|
||||
privateKeyFile = config.sops.secrets."wireguard/${hn}".path;
|
||||
};
|
||||
hostKeys = [{
|
||||
comment = "host@${hn}";
|
||||
path = "/etc/ssh/host";
|
||||
rounds = 100;
|
||||
type = "ed25519";
|
||||
}];
|
||||
};
|
||||
|
||||
sops.secrets."cloudflare/${hn}" = { };
|
||||
|
||||
services.cloudflare-dyndns = {
|
||||
enable = true;
|
||||
apiTokenFile = config.sops.secrets."cloudflare/${hn}".path;
|
||||
domains = builtins.attrNames config.services.caddy.virtualHosts;
|
||||
services = {
|
||||
cloudflare-dyndns = {
|
||||
enable = true;
|
||||
apiTokenFile = config.sops.secrets."cloudflare/${hn}".path;
|
||||
domains = builtins.attrNames config.services.caddy.virtualHosts;
|
||||
};
|
||||
openssh = {
|
||||
enable = true;
|
||||
settings = {
|
||||
KbdInteractiveAuthentication = false;
|
||||
PasswordAuthentication = false;
|
||||
};
|
||||
hostKeys = [{
|
||||
comment = "host@${hn}";
|
||||
path = "/etc/ssh/host";
|
||||
rounds = 100;
|
||||
type = "ed25519";
|
||||
}];
|
||||
};
|
||||
resolved.enable = true;
|
||||
};
|
||||
|
||||
services.resolved.enable = true;
|
||||
sops.secrets = {
|
||||
"cloudflare/${hn}" = { };
|
||||
"wireguard/${hn}" = { };
|
||||
};
|
||||
}
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue