37 lines
947 B
Nix
37 lines
947 B
Nix
{ config, ... }:
|
|
{
|
|
networking = {
|
|
nat = {
|
|
enable = true;
|
|
externalInterface = "${config.ips.netInt}";
|
|
internalInterfaces = [ "${config.ips.wgInt}" ];
|
|
};
|
|
firewall.allowedUDPPorts = [ 51820 ];
|
|
};
|
|
|
|
networking.wireguard = {
|
|
enable = true;
|
|
interfaces = {
|
|
"${config.ips.wgInt}" = {
|
|
ips = [ "${config.ips.wgSpan}.1/24" ];
|
|
listenPort = 51820;
|
|
privateKey = config.secrets.wgServerPriv;
|
|
peers = [
|
|
{ # Jimbo Pixel 9
|
|
publicKey = config.secrets.wgPixel9Pub;
|
|
allowedIPs = [ "${config.ips.wgSpan}.2/32" ];
|
|
}
|
|
{ # Oracle VM
|
|
publicKey = config.secrets.wgOraclePub;
|
|
allowedIPs = [ "${config.ips.wgSpan}.3/32" ];
|
|
}
|
|
{ # General Nix
|
|
publicKey = config.secrets.wgClientPub;
|
|
allowedIPs = [ "${config.ips.wgSpan}.16/28" ];
|
|
}
|
|
];
|
|
};
|
|
};
|
|
};
|
|
}
|