-{ pkgs, lib, config, hostName, private, ... }:
-let
- domain = "sourcephile.fr";
- iface = "wg-intra";
- wg = config.networking.wireguard.interfaces.${iface};
- peer = {
- publicKey = "tE4fzqDrr7BgfOo9tWgGnpu3v0JRDEUZbJnm9e2F/GA=";
- allowedIPs = [ "192.168.42.3/32" ];
- };
- peers = {
- mermet = {
- publicKey = "XbTEP2X71LBTjmdmySdiOpQJ+uIomcXvg1aiQGUtWBI=";
- endpoint = "mermet.${domain}:43642";
- endpointsUpdater.enable = true;
- allowedIPs = [ "192.168.42.1/32" ];
- persistentKeepalive = 25;
- dynamicEndpointRefreshSeconds = 30 * 60;
- };
- losurdo = {
- publicKey = "xsFFep3k8z0pXgUOz4aryOF8l/KPBSOd4WQA26BkXy0=";
- #endpoint = "losurdo.${domain}:43642";
- allowedIPs = [ "192.168.42.2/32" ];
- persistentKeepalive = 5;
- };
- };
- keyToUnitName = lib.replaceChars
- [ "/" "-" " " "+" "=" ]
- [ "-" "\\x2d" "\\x20" "\\x2b" "\\x3d" ];
-in
+_:
{
-networking.firewall.extraCommands = ''
- ip46tables -A nixos-fw -i ${iface} -p tcp -m tcp --dport 22 -j ACCEPT
- ip46tables -A nixos-fw -i any -p udp -m udp --dport ${toString wg.listenPort} -j ACCEPT
-'';
-networking.wireguard.interfaces.${iface} = {
- ips = peer.allowedIPs;
- # Different from losurdo's listenPort to have them work behind the same NAT.
- listenPort = 43641;
- privateKeyFile = "${private}/${hostName}/wireguard/${iface}/privateKey";
- peers = lib.attrValues peers;
-};
-networking.hosts = builtins.listToAttrs (lib.concatLists (lib.attrValues (lib.mapAttrs (peerName: peer:
- map (ip: lib.nameValuePair (lib.removeSuffix "/32" ip) ["${peerName}.wg"]) peer.allowedIPs
- ) peers)));
-/*
-systemd.services =
- {
- openssh = {
- after = ["wireguard-${iface}.service"];
- serviceConfig.Restart = "on-failure";
- };
+ systemd.services."wireguard-wg-intra".serviceConfig.LoadCredentialEncrypted = [
+ "privateKey:${./wireguard/wg-intra/privateKey.cred}"
+ ];
+ networking.wireguard.wg-intra.peers = {
+ mermet.enable = true;
+ losurdo.enable = true;
+ patate.enable = true;
+ aubergine.enable = true;
};
-services.openssh.listenAddresses = map (ip: {addr=lib.removeSuffix "/32" ip;}) peer.allowedIPs;
-*/
}