nixos-config/machines/chungus/network-wireguard.nix

35 lines
1.1 KiB
Nix
Raw Permalink Normal View History

2024-06-07 09:34:23 +02:00
{ config, factsGenerator, clanLib, ... }:
2023-05-12 11:17:58 +02:00
{
networking.firewall.allowedUDPPorts = [ 51820 ];
2024-06-19 13:19:55 +02:00
clan.core.facts.services.wireguard = factsGenerator.wireguard { name = "wg0"; };
clan.core.facts.services.wireguard_ip = factsGenerator.public {
2024-06-07 09:34:23 +02:00
"wireguard.wg0.cidr" = "10.100.0.2/32";
"wireguard.wg0.ip" = "10.100.0.2";
};
2023-05-12 11:17:58 +02:00
# Enable WireGuard
networking.wg-quick.interfaces = {
# Hub and Spoke Setup
# https://www.procustodibus.com/blog/2020/11/wireguard-hub-and-spoke-config/
wg0 = {
2024-06-07 09:34:23 +02:00
address = [
2024-06-19 13:19:55 +02:00
config.clan.core.facts.services.wireguard_ip.public."wireguard.wg0.cidr".value
2024-06-07 09:34:23 +02:00
];
2023-05-12 11:17:58 +02:00
listenPort = 51820; # to match firewall allowedUDPPorts (without this wg uses random port numbers)
2024-06-19 13:19:55 +02:00
privateKeyFile = config.clan.core.facts.services.wireguard.secret."wireguard.wg0.key".path;
2023-05-12 11:17:58 +02:00
mtu = 1280;
peers = [
{
2024-06-07 09:34:23 +02:00
publicKey = clanLib.readFact "wireguard.wg0.pub" "orbi";
allowedIPs = [
(clanLib.readFact "wireguard.wg0.cidr" "orbi")
];
endpoint = clanLib.readFact "wireguard.wg0.endpoint" "orbi";
2023-05-12 11:17:58 +02:00
persistentKeepalive = 25;
}
];
};
};
}