macronova/nixos-config
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Test wireguard setup

Browse source
This commit is contained in:
Invariantspace 2023-11-14 20:56:38 -08:00
parent 7f98328b26
commit 5ddd010f03
5 changed files with 104 additions and 50 deletions
Download patch file Download diff file Expand all files Collapse all files

10
linux/blitzar/network.nix
View file

@ -7,7 +7,17 @@
wifi.backend = "iwd";
};
nftables.enable = true;
wireguard.interfaces.wgb = {
ips = [ "10.32.54.2/32" ];
peers = [{
allowedIPs = [ "10.32.54.0/24" ];
publicKey = "0j8+alXU/f2UgWN61R6+Wjs9xelGRwpSbe5NyOwWlF4=";
endpoint = "${config.constants.domain}:45556";
}];
privateKeyFile = config.sops.secrets."wireguard/${config.networking.hostName}".path;
};
wireless.iwd.enable = true;
};
services.resolved.enable = true;
sops.secrets."wireguard/${config.networking.hostName}" = { };
}

56
linux/nebula/network.nix
View file

@ -11,32 +11,44 @@ let hn = config.networking.hostName; in {
};
nftables.enable = true;
tempAddresses = "disabled";
wireguard.interfaces.wgn = {
ips = [ "10.32.54.3/32" ];
peers = [{
allowedIPs = [ "10.32.54.0/24" ];
publicKey = "0j8+alXU/f2UgWN61R6+Wjs9xelGRwpSbe5NyOwWlF4=";
endpoint = "${config.constants.domain}:45556";
}];
privateKeyFile = config.sops.secrets."wireguard/${hn}".path;
};
wireless.iwd.enable = true;
};
sops.secrets."cloudflare/${hn}" = { };
services.cloudflare-dyndns = {
enable = true;
apiTokenFile = config.sops.secrets."cloudflare/${hn}".path;
domains = builtins.attrNames config.services.caddy.virtualHosts;
ipv4 = false;
ipv6 = true;
};
services.openssh = {
enable = true;
hostKeys = [{
comment = "host@${hn}";
path = "/etc/ssh/host";
rounds = 100;
type = "ed25519";
}];
settings = {
PasswordAuthentication = false;
KbdInteractiveAuthentication = false;
services = {
cloudflare-dyndns = {
enable = true;
apiTokenFile = config.sops.secrets."cloudflare/${hn}".path;
domains = builtins.attrNames config.services.caddy.virtualHosts;
ipv4 = false;
ipv6 = true;
};
openssh = {
enable = true;
hostKeys = [{
comment = "host@${hn}";
path = "/etc/ssh/host";
rounds = 100;
type = "ed25519";
}];
settings = {
PasswordAuthentication = false;
KbdInteractiveAuthentication = false;
};
};
resolved.enable = true;
};
services.resolved.enable = true;
sops.secrets = {
"cloudflare/${hn}" = { };
"wireguard/${hn}" = { };
};
}

73
linux/singularity/network.nix
View file

@ -1,33 +1,60 @@
{ config, ... }:
let hn = config.networking.hostName; in {
networking = {
networking = let wg = { interface = "wgs"; port = 45556; }; in {
domain = config.constants.domain;
firewall.allowedTCPPorts = [ 80 443 50051 ];
hostId = "2cadb253";
};
services.openssh = {
enable = true;
settings = {
KbdInteractiveAuthentication = false;
PasswordAuthentication = false;
firewall = {
allowedTCPPorts = [ 80 443 50051 ];
allowedUDPPorts = [ wg.port ];
};
hostId = "2cadb253";
nat = {
enable = true;
externalInterface = "ens18";
internalInterfaces = [ wg.interface ];
};
nftables.enable = true;
wireguard.interfaces.${wg.interface} = {
ips = [ "10.32.54.76/24" ];
listenPort = wg.port;
peers = [
{
allowedIPs = [ "10.32.54.2/32" ];
publicKey = "RhS1H8g47EnOhu1F6y3QO6XqxnabGcNNb0BixBuKkDQ=";
}
{
allowedIPs = [ "10.32.54.3/32" ];
publicKey = "1OA03mqu7SxREAum4UabJKD7hf+foPLu1j0E1N5K508=";
}
];
privateKeyFile = config.sops.secrets."wireguard/${hn}".path;
};
hostKeys = [{
comment = "host@${hn}";
path = "/etc/ssh/host";
rounds = 100;
type = "ed25519";
}];
};
sops.secrets."cloudflare/${hn}" = { };
services.cloudflare-dyndns = {
enable = true;
apiTokenFile = config.sops.secrets."cloudflare/${hn}".path;
domains = builtins.attrNames config.services.caddy.virtualHosts;
services = {
cloudflare-dyndns = {
enable = true;
apiTokenFile = config.sops.secrets."cloudflare/${hn}".path;
domains = builtins.attrNames config.services.caddy.virtualHosts;
};
openssh = {
enable = true;
settings = {
KbdInteractiveAuthentication = false;
PasswordAuthentication = false;
};
hostKeys = [{
comment = "host@${hn}";
path = "/etc/ssh/host";
rounds = 100;
type = "ed25519";
}];
};
resolved.enable = true;
};
services.resolved.enable = true;
sops.secrets = {
"cloudflare/${hn}" = { };
"wireguard/${hn}" = { };
};
}