]> Git — Sourcephile - sourcephile-nix.git/blob - hosts/mermet/networking/wireguard.nix
sourcehut: update
[sourcephile-nix.git] / hosts / mermet / networking / wireguard.nix
1 { pkgs, lib, config, hostName, inputs, ... }:
2 let
3 inherit (config.security.gnupg) secrets;
4 iface = "wg-intra";
5 wg = config.networking.wireguard.interfaces.${iface};
6 wg-intra-peers = import (inputs.julm-nix + "/nixos/profiles/wireguard/wg-intra/peers.nix");
7 in
8 {
9 imports = [
10 (inputs.julm-nix + "/nixos/profiles/wireguard/wg-intra.nix")
11 ];
12 config = {
13 networking.wireguard.${iface}.peers = {
14 losurdo.enable = true;
15 oignon.enable = true;
16 patate.enable = true;
17 };
18 networking.wireguard.interfaces.${iface} = {
19 privateKeyFile = secrets."wireguard/${iface}/privateKey".path;
20 };
21 security.gnupg.secrets."wireguard/${iface}/privateKey" = {};
22 systemd.services."wireguard-${iface}" = {
23 after = [ secrets."wireguard/${iface}/privateKey".service ];
24 requires = [ secrets."wireguard/${iface}/privateKey".service ];
25 };
26 networking.nftables.ruleset = ''
27 # Allow peers to initiate connection for ${iface}
28 add rule inet filter net2fw udp dport ${toString wg.listenPort} counter accept comment "${iface}"
29
30 # Hook ${iface} into relevant chains
31 add rule inet filter input iifname "${iface}" jump intra2fw
32 add rule inet filter input iifname "${iface}" log level warn prefix "intra2fw: " counter drop
33 add rule inet filter output oifname "${iface}" jump fw2intra
34 add rule inet filter output oifname "${iface}" log level warn prefix "fw2intra: " counter drop
35
36 # ${iface} firewalling
37 add rule inet filter fw2intra counter accept
38 add rule inet filter intra2fw tcp dport ${toString wg.peersAnnouncing.listenPort} counter accept comment "WireGuard peers announcing"
39 add rule inet filter intra2fw ip saddr ${wg-intra-peers.losurdo.ipv4} counter accept comment "losurdo"
40 '';
41 };
42 }