1
0
Fork 0

Update greatyamada config

This commit is contained in:
Avery 2025-06-21 15:42:06 +02:00
parent 5c4921895e
commit 97bf3bb177
Signed by: Avery
GPG key ID: B684FD451B692E04
22 changed files with 556 additions and 212 deletions

View file

@ -1,34 +1,36 @@
{ ... }:
{ pkgs, ... }:
let portDefinitions = import ./_port-definitions.nix;
in {
networking = {
nat = {
enable = true;
externalInterface = "enp5s0";
internalInterfaces = [ "wg0" ];
};
firewall.allowedUDPPorts = [ portDefinitions.wireguard ];
wireguard = {
enable = true;
interfaces.wg0 = {
ips = [ "10.10.0.1/24" ];
listenPort = portDefinitions.wireguard;
peers = [{
allowedIPs = [ "10.10.0.2/32" ];
name = "Note9";
name = "Pixel9a";
publicKey = "Y5A5iv0ukg1TQMcIdtXd+bmDxtrqHCuoEhYRmBqwkFY=";
presharedKeyFile = "/run/secrets/preshared_keys_note9";
presharedKeyFile = "/run/secrets/wireguard/preshared_keys/note9";
}];
postSetup =
"iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o enp5s0 -j MASQUERADE";
postShutdown =
"iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o enp5s0 -j MASQUERADE";
privateKeyFile = "/run/secrets/wg_private_key";
postSetup = ''
${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.10.0.0/24 -o enp5s0 -j MASQUERADE
'';
postShutdown = ''
${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.10.0.0/24 -o enp5s0 -j MASQUERADE
'';
privateKeyFile = "/run/secrets/wireguard/private_key";
};
};
};
sops.secrets = {
"wireguard/private_key" = {
path = "/run/secrets/wg_private_key";
owner = "root";
};
"wireguard/preshared_keys/note9" = {
path = "/run/secrets/preshared_keys_note9";
owner = "root";
};
"wireguard/private_key" = { owner = "root"; };
"wireguard/preshared_keys/note9" = { owner = "root"; };
};
}