29 lines
775 B
Nix
29 lines
775 B
Nix
|
{outputs, ...}: let
|
||
|
|
ips = import ../modules/ips.nix;
|
||
|
|
in {
|
||
|
|
# enable NAT
|
||
|
|
networking.nat.enable = true;
|
||
|
|
networking.nat.externalInterface = "${ips.netInt}";
|
||
|
|
networking.nat.internalInterfaces = [ "wg0" ];
|
||
|
|
networking.firewall.allowedUDPPorts = [ 51820 ];
|
||
|
|
|
||
|
|
networking.wireguard = {
|
||
|
|
enable = true;
|
||
|
|
interfaces = {
|
||
|
|
# Wireguard interface name can be arbitrary
|
||
|
|
wg0 = {
|
||
|
|
# Determines the IP address and subnet of the server's end of the tunnel interface.
|
||
|
|
ips = [ "10.100.0.1/24" ];
|
||
|
|
listenPort = 51820;
|
||
|
|
privateKey = outputs.secrets.wireguardPriv;
|
||
|
|
peers = [
|
||
|
|
{ # Jimbo
|
||
|
|
publicKey = outputs.secrets.wirePhonePub;
|
||
|
|
allowedIPs = [ "10.100.0.2/32" ];
|
||
|
|
}
|
||
|
|
];
|
||
|
|
};
|
||
|
|
};
|
||
|
|
};
|
||
|
|
}
|