asmir/nixos_flake_config
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

magpie/wireguard: add server

Browse Source
This commit is contained in:
Asmir A 2024-04-04 21:58:53 +02:00
parent f0a5174494
commit 02a4d33e79
Signed by: asmir
GPG Key ID: 020C42B7A9ABA3E2
1 changed files with 37 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

39
magpie/configuration.nix
View File

@ -264,15 +264,50 @@
owner = config.users.users.nextcloud.name;
};
sops.secrets."wg_privkey" = {
sopsFile = ./secrets/wg_privkey.yaml;
};
networking.hostName = "magpie";
networking.firewall.enable = true;
networking.firewall.allowedTCPPorts = [80 443 587];
networking.firewall.allowedUDPPorts = [443];
networking.firewall.allowedUDPPorts = [443 51820];
networking.firewall.allowPing = true;
networking.firewall.logRefusedConnections = lib.mkDefault false;
networking.hostName = "magpie";
networking.nat.enable = true;
networking.nat.externalInterface = "enp1s0";
networking.nat.internalInterfaces = ["wg0"];
networking.networkmanager.enable = true;
networking.wireless.enable = false;
networking.wireguard.interfaces = {
wg0 = {
ips = ["10.100.0.1/24"];
listenPort = 51820;
# This allows the wireguard server to route your traffic to the internet and hence be like a VPN
# For this to work you have to set the dnsserver IP of your router (or dnsserver of choice) in your clients
postSetup = ''
${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -o eth0 -j MASQUERADE
'';
# This undoes the above command
postShutdown = ''
${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.100.0.0/24 -o eth0 -j MASQUERADE
'';
privateKeyFile = config.sops.secrets."wg_privkey".path;
peers = [
{
publicKey = builtins.readFile ../nixy/wg_pubkey;
allowedIPs = ["10.100.0.6/32"];
}
];
};
};
systemd = {
enableEmergencyMode = false;