Jimbo/NixOS-Config
1
0
Fork 0
Code Issues Pull requests Actions Packages Projects Releases Wiki Activity

Maybe unfinished support for wireguard Nix clients

Browse source
This commit is contained in:
jimjam4real 2024-09-23 13:49:48 -04:00
parent 8a27361843
commit 040d7392dc
5 changed files with 40 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

BIN
secrets.nix
View file

Binary file not shown.

6
system/desktop/firewall.nix
View file

@ -1,11 +1,13 @@
{ let
ips = import ../modules/ips.nix;
in {
# Networking settings # Networking settings
networking = { networking = {
# Enable firewall # Enable firewall
firewall = { firewall = {
allowPing = false; allowPing = false;
extraInputRules = '' extraInputRules = ''
ip saddr 10.0.0.2 accept comment "Accept Server Connections" ip saddr { ${ips.server}, ${ips.wgSpan}.1 } accept comment "Accept Server"
''; '';
}; };
}; };

23
system/desktop/wireguard.nix Normal file
View file

@ -0,0 +1,23 @@
{outputs, ...}: let
ips = import ../modules/ips.nix;
in {
networking.firewall = {
allowedUDPPorts = [ 51820 ];
};
networking.wireguard.interfaces = {
"${ips.wgInt}" = {
# Define IP of client in per device config
listenPort = 51820;
privateKey = outputs.secrets.wgClientPriv;
peers = [
{ # 0.0.0.0 makes wg act like a traditional VPN
publicKey = outputs.secrets.wgServerPub;
allowedIPs = [ "0.0.0.0/0" ];
endpoint = "mc.${outputs.secrets.jimDomain}:51820";
persistentKeepalive = 25;
}
];
};
};
}

7
system/pinebook.nix
View file

@ -36,11 +36,14 @@
./services/mpd.nix ./services/mpd.nix
]; ];
# Set hostname
networking.hostName = "JimPine";
# Disable 32 bit graphics # Disable 32 bit graphics
hardware.opengl.driSupport32Bit = lib.mkForce false; hardware.opengl.driSupport32Bit = lib.mkForce false;
# Set hostname # Set the VPN IP per machine
networking.hostName = "JimPine"; networking.wireguard.interfaces."${ips.wgInt}".ips = [ "${ips.wgSpan}.17/24" ];
# https://nixos.wiki/wiki/FAQ/When_do_I_update_stateVersion # https://nixos.wiki/wiki/FAQ/When_do_I_update_stateVersion
system.stateVersion = "24.05"; system.stateVersion = "24.05";

14
system/server/wireguard.nix
View file

@ -14,21 +14,23 @@ in {
networking.wireguard = { networking.wireguard = {
enable = true; enable = true;
interfaces = { interfaces = {
# Wireguard interface name can be arbitrary "${ips.wgInt}" = {
wg0 = {
# Determines the IP and subnet of the tunnel interface
ips = [ "${ips.wgSpan}.1/24" ]; ips = [ "${ips.wgSpan}.1/24" ];
listenPort = 51820; listenPort = 51820;
privateKey = outputs.secrets.wireguardPriv; privateKey = outputs.secrets.wgServerPriv;
peers = [ peers = [
{ # Jimbo Pixel 9 { # Jimbo Pixel 9
publicKey = outputs.secrets.wirePixel9Pub; publicKey = outputs.secrets.wgPixel9Pub;
allowedIPs = [ "${ips.wgSpan}.2/32" ]; allowedIPs = [ "${ips.wgSpan}.2/32" ];
} }
{ # Oracle VM { # Oracle VM
publicKey = outputs.secrets.wireOraclePub; publicKey = outputs.secrets.wgOraclePub;
allowedIPs = [ "${ips.wgSpan}.3/32" ]; allowedIPs = [ "${ips.wgSpan}.3/32" ];
} }
{ # General Nix
publicKey = outputs.secrets.wgClientPub;
allowedIPs = [ "${ips.wgSpan}.16/28" ];
}
]; ];
}; };
}; };