Fix selene

modules/servermodules/jellyfin/jellyfin.nix

@@ -18,7 +18,7 @@
   };
 
   age.secrets.jellyfin-key = {
-    file = ./secrets/jellyfin-key;
+    file = ../../../keys/jellyfin-key;
     owner = "jellyfin";
   };
 

modules/servermodules/nginx.nix

@@ -1,4 +1,4 @@
-{ rootdomain }:
+rootdomain:
 {
   systemd.services.nginx.serviceConfig.ReadWritePaths = [ "/logs/nginx" ];
   services.nginx.enable = true;
@@ -71,6 +71,6 @@
   systemd.tmpfiles.rules = [
   # Type  Path           Mode    User   Group  Age  Argument
   "d /logs/nginx        0755    nginx  nginx  -    -"
-  ]
+  ];
 }
 

modules/servermodules/packages.nix

@@ -1,4 +1,4 @@
-{ pkgs, ... }:
+{ pkgs, config, ... }:
 {
   environment.systemPackages = [
     pkgs.git
@@ -8,7 +8,7 @@
     pkgs.tmux
   ];
   age.secrets.google-storage-key = {
-    file = ./secrets/google-storage-key;
+    file = ../../keys/google-storage-key;
     owner = "root";
   };
   environment.variables.GOOGLE_APPLICATION_CREDENTIALS = config.age.secrets."google-storage-key".path;

modules/servermodules/wireguard/wireguard-server.nix

@@ -0,0 +1,58 @@
+{
+  pkgs,
+  config,
+  ...
+}:
+{
+  # enable NAT
+  networking.nat.enable = true;
+  networking.nat.externalInterface = "eth0";
+  networking.nat.internalInterfaces = [ "wg0" ];
+  networking.firewall = {
+    allowedUDPPorts = [ 51820 ];
+  };
+
+  age.secrets.wg-selene = {
+    file = ../../../keys/wg-selene;
+    owner = "selene";
+  };
+  networking.wireguard.interfaces = {
+    # "wg0" is the network interface name. You can name the interface arbitrarily.
+    wg0 = {
+      # Determines the IP address and subnet of the server's end of the tunnel interface.
+      ips = [ "10.100.0.1/24" ];
+
+      # The port that WireGuard listens to. Must be accessible by the client.
+      listenPort = 51820;
+
+      # This allows the wireguard server to route your traffic to the internet and hence be like a VPN
+      # For this to work you have to set the dnsserver IP of your router (or dnsserver of choice) in your clients
+      # postSetup = ''
+      #   ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -o eth0 -j MASQUERADE
+      # '';
+
+      # # This undoes the above command
+      # postShutdown = ''
+      #   ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.100.0.0/24 -o eth0 -j MASQUERADE
+      # '';
+
+      # Path to the private key file.
+      #
+      # Note: The private key can also be included inline via the privateKey option,
+      # but this makes the private key world-readable; thus, using privateKeyFile is
+      # recommended.
+
+      privateKeyFile = config.age.secrets.wg-selene.path;
+
+      peers = [
+        # List of allowed peers.
+        { # Feel free to give a meaningful name
+          # Public key of the peer (not a file path).
+          publicKey = (builtins.readFile ../../../keys/wg-macbook.pub);
+          # List of IPs assigned to this peer within the tunnel subnet. Used to configure routing.
+          allowedIPs = [ "10.100.0.2/32" ];
+        }
+      ];
+    };
+  };
+}