Git/Nixconfigs
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Refactor the clients

Browse source
This commit is contained in:
Maxiem Geldhof 2025-10-18 14:26:06 +02:00
parent 195a5e1540
commit b6714ee64f
4 changed files with 85 additions and 80 deletions
Download patch file Download diff file Expand all files Collapse all files

106
modules/servermodules/wireguard/wireguard-server.nix
View file

@ -1,58 +1,68 @@
let
allowedIPs = [ "10.100.0.1/24" ];
port = 51820;
publicIp = "37.27.207.39";
in
{
pkgs,
config,
...
}:
{
# enable NAT
networking.nat.enable = true;
networking.nat.externalInterface = "eth0";
networking.nat.internalInterfaces = [ "wg0" ];
networking.firewall = {
allowedUDPPorts = [ 51820 ];
};
serverModule =
{
pkgs,
config,
...
}:
{
# enable NAT
networking.nat.enable = true;
networking.nat.externalInterface = "eth0";
networking.nat.internalInterfaces = [ "wg0" ];
networking.firewall = {
allowedUDPPorts = [ port ];
};
age.secrets.wg-selene = {
file = ../../../keys/wg-selene;
owner = "selene";
};
networking.wireguard.interfaces = {
# "wg0" is the network interface name. You can name the interface arbitrarily.
wg0 = {
# Determines the IP address and subnet of the server's end of the tunnel interface.
ips = [ "10.100.0.1/24" ];
age.secrets.wg-selene = {
file = ../../../keys/wg-selene;
owner = "selene";
};
networking.wireguard.interfaces = {
# "wg0" is the network interface name. You can name the interface arbitrarily.
wg0 = {
# Determines the IP address and subnet of the server's end of the tunnel interface.
ips = allowedIPs;
# The port that WireGuard listens to. Must be accessible by the client.
listenPort = 51820;
# The port that WireGuard listens to. Must be accessible by the client.
listenPort = port;
# This allows the wireguard server to route your traffic to the internet and hence be like a VPN
# For this to work you have to set the dnsserver IP of your router (or dnsserver of choice) in your clients
# postSetup = ''
# ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -o eth0 -j MASQUERADE
# '';
# This allows the wireguard server to route your traffic to the internet and hence be like a VPN
# For this to work you have to set the dnsserver IP of your router (or dnsserver of choice) in your clients
# postSetup = ''
# ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -o eth0 -j MASQUERADE
# '';
# # This undoes the above command
# postShutdown = ''
# ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.100.0.0/24 -o eth0 -j MASQUERADE
# '';
# # This undoes the above command
# postShutdown = ''
# ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.100.0.0/24 -o eth0 -j MASQUERADE
# '';
# Path to the private key file.
#
# Note: The private key can also be included inline via the privateKey option,
# but this makes the private key world-readable; thus, using privateKeyFile is
# recommended.
# Path to the private key file.
#
# Note: The private key can also be included inline via the privateKey option,
# but this makes the private key world-readable; thus, using privateKeyFile is
# recommended.
privateKeyFile = config.age.secrets.wg-selene.path;
privateKeyFile = config.age.secrets.wg-selene.path;
peers = [
# List of allowed peers.
{ # Feel free to give a meaningful name
# Public key of the peer (not a file path).
publicKey = (builtins.readFile ../../../keys/wg-macbook.pub);
# List of IPs assigned to this peer within the tunnel subnet. Used to configure routing.
allowedIPs = [ "10.100.0.2/32" ];
}
];
peers = [
# List of allowed peers.
(import ../../systems/macbook/wireguard.nix).peerConfig
];
};
};
};
infoForClients = {
endpoint = "${publicIp}:${builtins.toString port}";
allowedIPs = allowedIPs;
publicKey = builtins.readFile ../../../keys/wg-selene.pub;
persistentKeepalive = 25;
};
}
}