nixos-config/machines/cherry/network-wireguard-wg0.nix

45 lines
1.3 KiB
Nix
Raw Normal View History

2024-08-29 03:26:04 +02:00
{
pkgs,
2024-08-29 03:26:04 +02:00
config,
factsGenerator,
clanLib,
...
}:
2023-12-17 13:06:57 +01:00
{
healthchecks.localCommands.ping-wg0 = pkgs.writers.writeBash "ping-wg0" ''
ping -c 1 -W 5 ${config.clan.core.facts.services.wireguard_ip.public."wireguard.wg0.ip".value}
'';
2024-06-05 12:51:38 +02:00
networking.firewall.allowedUDPPorts = [ 51820 ];
2024-06-19 13:19:55 +02:00
clan.core.facts.services.wireguard = factsGenerator.wireguard { name = "wg0"; };
clan.core.facts.services.wireguard_ip = factsGenerator.public {
2024-06-07 09:34:23 +02:00
"wireguard.wg0.cidr" = "10.100.0.7/32";
"wireguard.wg0.ip" = "10.100.0.7";
};
2023-12-17 13:06:57 +01:00
# Enable WireGuard
networking.wg-quick.interfaces = {
# Hub and Spoke Setup
# https://www.procustodibus.com/blog/2020/11/wireguard-hub-and-spoke-config/
wg0 = {
2024-06-07 09:34:23 +02:00
address = [
2024-06-19 13:19:55 +02:00
config.clan.core.facts.services.wireguard_ip.public."wireguard.wg0.cidr".value
2024-06-07 09:34:23 +02:00
];
2023-12-17 13:06:57 +01:00
listenPort = 51820; # to match firewall allowedUDPPorts (without this wg uses random port numbers)
2024-06-19 13:19:55 +02:00
privateKeyFile = config.clan.core.facts.services.wireguard.secret."wireguard.wg0.key".path;
2023-12-17 13:06:57 +01:00
mtu = 1280;
peers = [
{
2024-06-07 09:34:23 +02:00
publicKey = clanLib.readFact "wireguard.wg0.pub" "orbi";
allowedIPs = [
(clanLib.readFact "wireguard.wg0.cidr" "orbi")
];
endpoint = clanLib.readFact "wireguard.wg0.endpoint" "orbi";
2023-12-17 13:06:57 +01:00
}
];
};
};
}