nixos-config/nixos/machines/cherry/wireguard.nix

30 lines
878 B
Nix
Raw Normal View History

2024-06-02 21:38:48 +02:00
{ config, factsGenerator, ... }:
2023-12-17 13:06:57 +01:00
{
2024-05-31 21:02:22 +02:00
2024-06-02 21:38:48 +02:00
clanCore.facts.services.wireguard = factsGenerator.wireguard { name = "wg0"; };
2023-12-17 13:06:57 +01:00
# Enable WireGuard
networking.wg-quick.interfaces = {
# Hub and Spoke Setup
# https://www.procustodibus.com/blog/2020/11/wireguard-hub-and-spoke-config/
wg0 = {
address = [ "10.100.0.7/32" ];
listenPort = 51820; # to match firewall allowedUDPPorts (without this wg uses random port numbers)
2024-06-02 21:38:48 +02:00
privateKeyFile = config.clanCore.facts.services.wireguard.secret."wireguard.wg0.key".path;
2024-05-31 21:02:22 +02:00
2023-12-17 13:06:57 +01:00
mtu = 1280;
peers = [
{
# robi
2024-05-31 21:02:22 +02:00
# todo : use public facts here
2023-12-17 13:06:57 +01:00
publicKey = "uWR93xJe5oEbX3DsAYpOS9CuSg1VmXEQxJzdlJpe3DU=";
allowedIPs = [ "10.100.0.1/24" ];
#endpoint = "ingolf-wagner.de:51820";
endpoint = "95.216.66.212:51820";
2023-12-17 13:06:57 +01:00
}
];
};
};
}