Jimbo VPN.
This commit is contained in:
parent
c1e3872b70
commit
a0ac0f631c
12
flake.lock
12
flake.lock
|
@ -235,11 +235,11 @@
|
|||
},
|
||||
"nixpkgs-unstable": {
|
||||
"locked": {
|
||||
"lastModified": 1725103162,
|
||||
"narHash": "sha256-Ym04C5+qovuQDYL/rKWSR+WESseQBbNAe5DsXNx5trY=",
|
||||
"lastModified": 1725432240,
|
||||
"narHash": "sha256-+yj+xgsfZaErbfYM3T+QvEE2hU7UuE+Jf0fJCJ8uPS0=",
|
||||
"owner": "nixos",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "12228ff1752d7b7624a54e9c1af4b222b3c1073b",
|
||||
"rev": "ad416d066ca1222956472ab7d0555a6946746a80",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
@ -314,11 +314,11 @@
|
|||
},
|
||||
"nur": {
|
||||
"locked": {
|
||||
"lastModified": 1725529639,
|
||||
"narHash": "sha256-dRQHGPv6a5sFkIpjhZ1cXLrHG5rfXnVJVE3ETVq1ilY=",
|
||||
"lastModified": 1725541414,
|
||||
"narHash": "sha256-2btQOiIw+yMrxAHzVCp5ou9IbWkzYhQ5dIS3vRO7Sd8=",
|
||||
"owner": "nix-community",
|
||||
"repo": "NUR",
|
||||
"rev": "72cd6b31e8256c9b28939fd02b9f87efafd2375c",
|
||||
"rev": "72c08881a42221c2de613b425b735c4cd7f85d86",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
|
@ -33,9 +33,9 @@
|
|||
./server/nginx.nix
|
||||
./server/owncast.nix
|
||||
./server/minecraft
|
||||
./server/tandoor.nix
|
||||
./server/vaultwarden.nix
|
||||
./server/transmission.nix
|
||||
./server/wireguard.nix
|
||||
./server/misc.nix
|
||||
|
||||
# Matrix
|
||||
|
|
|
@ -43,6 +43,7 @@
|
|||
chain POSTROUTING {
|
||||
type nat hook postrouting priority 100; policy accept;
|
||||
oifname "${ips.netInt}" masquerade
|
||||
ip saddr 10.100.0.0/24 oifname "${ips.netInt}" masquerade comment "WireGuard"
|
||||
}
|
||||
'';
|
||||
};
|
||||
|
|
|
@ -1,16 +0,0 @@
|
|||
{outputs, ...}: {
|
||||
services = {
|
||||
tandoor-recipes = {
|
||||
enable = true;
|
||||
port = 5030;
|
||||
};
|
||||
nginx.virtualHosts."recipes.${outputs.secrets.jimDomain}" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
locations."/" = {
|
||||
proxyPass = "http://127.0.0.1:5030";
|
||||
proxyWebsockets = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
28
nixos/server/wireguard.nix
Normal file
28
nixos/server/wireguard.nix
Normal file
|
@ -0,0 +1,28 @@
|
|||
{outputs, ...}: let
|
||||
ips = import ../modules/ips.nix;
|
||||
in {
|
||||
# enable NAT
|
||||
networking.nat.enable = true;
|
||||
networking.nat.externalInterface = "${ips.netInt}";
|
||||
networking.nat.internalInterfaces = [ "wg0" ];
|
||||
networking.firewall.allowedUDPPorts = [ 51820 ];
|
||||
|
||||
networking.wireguard = {
|
||||
enable = true;
|
||||
interfaces = {
|
||||
# Wireguard interface name can be arbitrary
|
||||
wg0 = {
|
||||
# Determines the IP address and subnet of the server's end of the tunnel interface.
|
||||
ips = [ "10.100.0.1/24" ];
|
||||
listenPort = 51820;
|
||||
privateKey = outputs.secrets.wireguardPriv;
|
||||
peers = [
|
||||
{ # Jimbo
|
||||
publicKey = outputs.secrets.wirePhonePub;
|
||||
allowedIPs = [ "10.100.0.2/32" ];
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
BIN
secrets.nix
BIN
secrets.nix
Binary file not shown.
Loading…
Reference in a new issue