From a0ac0f631c22ef5fe312b720f16bbeea723ad440 Mon Sep 17 00:00:00 2001 From: Jimbo Date: Fri, 6 Sep 2024 01:18:21 -0400 Subject: [PATCH] Jimbo VPN. --- flake.lock | 12 ++++++------ nixos/server.nix | 2 +- nixos/server/firewall.nix | 1 + nixos/server/tandoor.nix | 16 ---------------- nixos/server/wireguard.nix | 28 ++++++++++++++++++++++++++++ secrets.nix | Bin 1911 -> 2061 bytes 6 files changed, 36 insertions(+), 23 deletions(-) delete mode 100644 nixos/server/tandoor.nix create mode 100644 nixos/server/wireguard.nix diff --git a/flake.lock b/flake.lock index 556e167..ce60128 100644 --- a/flake.lock +++ b/flake.lock @@ -235,11 +235,11 @@ }, "nixpkgs-unstable": { "locked": { - "lastModified": 1725103162, - "narHash": "sha256-Ym04C5+qovuQDYL/rKWSR+WESseQBbNAe5DsXNx5trY=", + "lastModified": 1725432240, + "narHash": "sha256-+yj+xgsfZaErbfYM3T+QvEE2hU7UuE+Jf0fJCJ8uPS0=", "owner": "nixos", "repo": "nixpkgs", - "rev": "12228ff1752d7b7624a54e9c1af4b222b3c1073b", + "rev": "ad416d066ca1222956472ab7d0555a6946746a80", "type": "github" }, "original": { @@ -314,11 +314,11 @@ }, "nur": { "locked": { - "lastModified": 1725529639, - "narHash": "sha256-dRQHGPv6a5sFkIpjhZ1cXLrHG5rfXnVJVE3ETVq1ilY=", + "lastModified": 1725541414, + "narHash": "sha256-2btQOiIw+yMrxAHzVCp5ou9IbWkzYhQ5dIS3vRO7Sd8=", "owner": "nix-community", "repo": "NUR", - "rev": "72cd6b31e8256c9b28939fd02b9f87efafd2375c", + "rev": "72c08881a42221c2de613b425b735c4cd7f85d86", "type": "github" }, "original": { diff --git a/nixos/server.nix b/nixos/server.nix index ec583dc..7039f68 100644 --- a/nixos/server.nix +++ b/nixos/server.nix @@ -33,9 +33,9 @@ ./server/nginx.nix ./server/owncast.nix ./server/minecraft - ./server/tandoor.nix ./server/vaultwarden.nix ./server/transmission.nix + ./server/wireguard.nix ./server/misc.nix # Matrix diff --git a/nixos/server/firewall.nix b/nixos/server/firewall.nix index c78d44e..6173789 100644 --- a/nixos/server/firewall.nix +++ b/nixos/server/firewall.nix @@ -43,6 +43,7 @@ chain POSTROUTING { type nat hook postrouting priority 100; policy accept; oifname "${ips.netInt}" masquerade + ip saddr 10.100.0.0/24 oifname "${ips.netInt}" masquerade comment "WireGuard" } ''; }; diff --git a/nixos/server/tandoor.nix b/nixos/server/tandoor.nix deleted file mode 100644 index b0c3576..0000000 --- a/nixos/server/tandoor.nix +++ /dev/null @@ -1,16 +0,0 @@ -{outputs, ...}: { - services = { - tandoor-recipes = { - enable = true; - port = 5030; - }; - nginx.virtualHosts."recipes.${outputs.secrets.jimDomain}" = { - enableACME = true; - forceSSL = true; - locations."/" = { - proxyPass = "http://127.0.0.1:5030"; - proxyWebsockets = true; - }; - }; - }; -} diff --git a/nixos/server/wireguard.nix b/nixos/server/wireguard.nix new file mode 100644 index 0000000..6873d8a --- /dev/null +++ b/nixos/server/wireguard.nix @@ -0,0 +1,28 @@ +{outputs, ...}: let + ips = import ../modules/ips.nix; +in { + # enable NAT + networking.nat.enable = true; + networking.nat.externalInterface = "${ips.netInt}"; + networking.nat.internalInterfaces = [ "wg0" ]; + networking.firewall.allowedUDPPorts = [ 51820 ]; + + networking.wireguard = { + enable = true; + interfaces = { + # Wireguard interface name can be arbitrary + wg0 = { + # Determines the IP address and subnet of the server's end of the tunnel interface. + ips = [ "10.100.0.1/24" ]; + listenPort = 51820; + privateKey = outputs.secrets.wireguardPriv; + peers = [ + { # Jimbo + publicKey = outputs.secrets.wirePhonePub; + allowedIPs = [ "10.100.0.2/32" ]; + } + ]; + }; + }; + }; +} diff --git a/secrets.nix b/secrets.nix index 5ad04f03ec435706299033464a86ee4313a167c8..bcf084a8288927f988b1e78c83663279e10937c9 100644 GIT binary patch literal 2061 zcmV+o2=ey;M@dveQdv+`0MKg36FrSXom$rSqBw71222rig~kz|-mSn1G>{S{zS!=q zQ{HLcvgc?D#Lf;;(*A@g;|8U>E;Hk<-Z2JW=H@&83Oa>pm}ot|4cxcneC()@+?*Mi zF9Z49r#&!nRZpV(cmk5^@vxC&NAu-`V)0xv4&o8{Q#qwLGNw5n?EU|qOM-oQK@Y?W zV2iRu+BrlD0hb1+@WE=;ibIpXu~7WB3pzn^eMiJBGoC2IQHk%%R2f?%=9L@bCii;lZco}fsXtJoM;gXXbGt`cREw@#-SBjpM=wA3$DbNG`V>dFioK% zyoM618|^9|-IU^;BVf=|@=xNg_mXB(MMSy_Su=ws1s==Ti!SHQo5b647O%VRP6GjB z*afpjmDWl?G^5(w!9Fvh1#{-i&cAb^Wq)CGU(Ga;;|Dd6 zF#(BO>eA+Edy{QwlxPUU;^8h*xT02ylSeD}kcxPoQ>f;oKZO|O_>eyZMDPu#zBWU= z45+Ivy!bOup!uE6X!ve`IGX3X5(C!dI^?+`0E6w#r;LbCS{a$cPx$8n+nLgsuqxeu`P*Ty>})Sk|TRhUD;KPM7hVSQfdYG zZ91C+briPlt9g+GnV>*;SwW9plit6P@`%7a6va5NZ?`*$hiKTj;v+?F`va))j`I)9 zcP>f#sL`rfEmN;28va6+G50=tlEzyfBoB^xFrA@s0PduU!5fdKw+W9C6y_%41bYQ!%)aXs5kq8NL&vyC$g;LS8QQ=c&rez-{`M zD{Mu9KwyuOH)vu9^fyvOfEu4HHoD1>ci?AYH9z3CC?gQ~1@hb}d&LdQbsbt?B*U~s7ZtBm^EoBO+q zMyG4DtOnelz}Q5zh7&BGQE0bOavU?C=R@KMT+5$}E4>R0hz=@(=W!8A4C2P#ht=s@ zj}lwFldLWyA zk0BRcypiO>i6Gfv*;|}{vB!P?fkn;;FZAXuJwmLC72aq)I4g^6V8ohqtHyTE@&f#ykl)8gI zm8!V2y)nZ>yDNwHmG{L;_rlP?!WSZ;y55_~BU%{?_}f%PT|- zCmw5>%W*me3XVM@#J>)Qm(i9#i@<$kWpv^u19wGObp1R}@2s;$#y5u`+G)BDa}c>V0V_p4)_fFZDV rUrqU{7ReE%v>uMJj2b82p96+kuuY42Q$(fo-j{0lx7VBCXMhV_Ozr>y literal 1911 zcmV--2Z;CpM@dveQdv+`091?k_4q2bS*IX0eG%$EIwa7(B$_d678~|hOXxV!<*TmP z$lA~jMk%BKF4MGpko^FJ8qBM+C7gxaUn3o^z!ed}ZE6y(<_IbLHIi+}218Lkzz!DS&z)3R>_8cQ+oKt{1hif%4 zj&P1qTa=sZs)DzcC(Jjv4=RL)MUu|~3g_S~7))y;2X4&ccc*?Y(h=aB0&>Cc{R2g2_(lqyo2}e z!b7ho7&=>Hq=w(X$uZmAV@NYOrJry_g*M!JFfqkIs}@oxcYuITuS!m@A2}6_2;lA; zNS2FP0w4c|RRX<8cf~`N&vxzyeUsK#o#Oe=UDiaZZ%Z;+3>rjuUHLw*`W18j>ardY0H3 zq&v8EG>>*gmP%b;=*CpMk|cQHLWTbM3?dpDg)J|j=-f#82i?`dzVV>dN&jC)!(AQo ztXnq+Va_}s5RqZaWbk`!o0DS3P{Sx}?-E@lKBzKXy4ec?O}CXcpzhROsUo6s8!+9R zp97@L;tkAV!b*KvnFTu_qkp^b)OAAOm~cKx0ccHgh|E85Ew)L%rO0wp3hxK-yr-zj{hb zzhk*~^J-?dlQ5gbNnx8)RqegxwAn{i5p*lU_a107ZhV6*wkj`a~p*ncMsPW$u;>j%dDC#JRQ6%NiLqW1DY%=1N?S}oW{!TTG7^p z5@%7Ks4@>l&3od?Iy}AD^Q~v+rzeJ{T>2X7GzRv3FR`vhwXtY$DJN=Y%}|hDz#MJx z0Sj?@pBFn}7cIDK=cn4utEqdi`lhw+r31_I(iLl~ijVidcHLjpf@qh#dfyp6txt|s zKE1W8-4d1E8B_!;5dKd#8M>Zjoc$>*`oD<58go>Dnp{vzmruqmP{r$YjfXul!QZ`5 zH(c3{_TM5<6WsOAx!$h^KAtLnrx;@TMM zMfWdfRI@WxtT~3g26R&1L*>Woz^Z`Mp=RxnDz^;my8phbcH&-Fy()^uKx_&|cpaJD zjWy1QFZl1tZ47)nWOC=Pkunw4#}kL>00LHK%61Ixc327ffnoKI6wVd5=nFCXi7o#ebJHTos_>e<-ylFfBd`(+({c@stcfcNy6?K6#Z&EP5O zEb^}9syUYiyR-O z`!G7X22u=qtN`=B+9mkKh~KIG*lxDRIEmuiFIdMERXX03&udNMxZDUEi;JTgnJR83 z3`?8)ST!VEcF*R5Aj7L@n51w4NFEsi_n@(o^%-)u^0sQ$(x-(0nLcx}M`uUO$k1)m zwZ75^sf<98kW2>55#HUQswSut(ob=GMqNu(ecdEpmtlU;!Md%nT)wJFeaZ1v7cEjD znwD?Yy+mWpTAvxplNSfinm{bSviL&Xv9Yr%;e#&s7PQ;s@xYI!sgO|;A&ztx&8Z9E zP5Rd+k2efx+fhzT0>r)hH5M~ii#}i|5UqcINbtcglcpNEN>(SwRoM8Dhzz9v_6W~; zCE%z5NIdtare~EB^x@kfqRWFw0TpteO#Mk?6<}R!@?EcF9n48;5B>m81T6l7Z9bYf z7||h*zmqL26VH2%Wejil3b%_2shz9onoUo4iXEq=?uzHR{{cIjSCy&$|CqOv`M&HJ zBo>}jB|x(j+NDBTT^TE3o~J;I=cANBs>Mo{1mHNfISzA3-m4lY>*$0XNdO}iY7(*m zD!p3PmG!}{#L@95s{zlQucH?ZuDo9igc=mkX*V?dX{$#X{cGRuN4SlgMcS?nJXwP z2=^926