Jimbo VPN.

This commit is contained in:
Jimbo 2024-09-06 01:18:21 -04:00
parent c1e3872b70
commit a0ac0f631c
6 changed files with 36 additions and 23 deletions

View file

@ -235,11 +235,11 @@
},
"nixpkgs-unstable": {
"locked": {
"lastModified": 1725103162,
"narHash": "sha256-Ym04C5+qovuQDYL/rKWSR+WESseQBbNAe5DsXNx5trY=",
"lastModified": 1725432240,
"narHash": "sha256-+yj+xgsfZaErbfYM3T+QvEE2hU7UuE+Jf0fJCJ8uPS0=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "12228ff1752d7b7624a54e9c1af4b222b3c1073b",
"rev": "ad416d066ca1222956472ab7d0555a6946746a80",
"type": "github"
},
"original": {
@ -314,11 +314,11 @@
},
"nur": {
"locked": {
"lastModified": 1725529639,
"narHash": "sha256-dRQHGPv6a5sFkIpjhZ1cXLrHG5rfXnVJVE3ETVq1ilY=",
"lastModified": 1725541414,
"narHash": "sha256-2btQOiIw+yMrxAHzVCp5ou9IbWkzYhQ5dIS3vRO7Sd8=",
"owner": "nix-community",
"repo": "NUR",
"rev": "72cd6b31e8256c9b28939fd02b9f87efafd2375c",
"rev": "72c08881a42221c2de613b425b735c4cd7f85d86",
"type": "github"
},
"original": {

View file

@ -33,9 +33,9 @@
./server/nginx.nix
./server/owncast.nix
./server/minecraft
./server/tandoor.nix
./server/vaultwarden.nix
./server/transmission.nix
./server/wireguard.nix
./server/misc.nix
# Matrix

View file

@ -43,6 +43,7 @@
chain POSTROUTING {
type nat hook postrouting priority 100; policy accept;
oifname "${ips.netInt}" masquerade
ip saddr 10.100.0.0/24 oifname "${ips.netInt}" masquerade comment "WireGuard"
}
'';
};

View file

@ -1,16 +0,0 @@
{outputs, ...}: {
services = {
tandoor-recipes = {
enable = true;
port = 5030;
};
nginx.virtualHosts."recipes.${outputs.secrets.jimDomain}" = {
enableACME = true;
forceSSL = true;
locations."/" = {
proxyPass = "http://127.0.0.1:5030";
proxyWebsockets = true;
};
};
};
}

View file

@ -0,0 +1,28 @@
{outputs, ...}: let
ips = import ../modules/ips.nix;
in {
# enable NAT
networking.nat.enable = true;
networking.nat.externalInterface = "${ips.netInt}";
networking.nat.internalInterfaces = [ "wg0" ];
networking.firewall.allowedUDPPorts = [ 51820 ];
networking.wireguard = {
enable = true;
interfaces = {
# Wireguard interface name can be arbitrary
wg0 = {
# Determines the IP address and subnet of the server's end of the tunnel interface.
ips = [ "10.100.0.1/24" ];
listenPort = 51820;
privateKey = outputs.secrets.wireguardPriv;
peers = [
{ # Jimbo
publicKey = outputs.secrets.wirePhonePub;
allowedIPs = [ "10.100.0.2/32" ];
}
];
};
};
};
}

Binary file not shown.