Avery/NixOS
Avery/NixOS
1
0
Fork 0
Code Activity

Update greatyamada services

Browse source
This commit is contained in:
Avery 2025-02-14 21:52:49 +01:00
parent 2fef3e01c6
commit fa0b9b18cd
Signed by: Avery
GPG key ID: B684FD451B692E04
22 changed files with 290 additions and 191 deletions
Download patch file Download diff file Expand all files Collapse all files

34
hosts/greatyamada/services/wireguard.nix Normal file
View file

@ -0,0 +1,34 @@
{ ... }:
let portDefinitions = import ./_port-definitions.nix;
in {
networking = {
firewall.allowedUDPPorts = [ portDefinitions.wireguard ];
wireguard = {
enable = true;
interfaces.wg0 = {
ips = [ 10.10.0.1/24 ];
peers = [{
allowedIPs = [ 10.10.0.2/32 ];
name = "Note9";
publicKey = "Y5A5iv0ukg1TQMcIdtXd+bmDxtrqHCuoEhYRmBqwkFY=";
presharedKeyFile = "/run/secrets/preshared_keys_note9";
}];
postSetup =
"iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o enp5s0 -j MASQUERADE";
postShutdown =
"iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o enp5s0 -j MASQUERADE";
privateKeyFile = "/run/secrets/wg_private_key";
};
};
};
sops.secrets = {
"wireguard/private_key" = {
path = "/run/secrets/wg_private_key";
user = "root";
};
"wireguard/preshared_keys/note9" = {
path = "/run/secrets/preshared_keys_note9";
user = "root";
};
};
}