hosts/losurdo/networking/wireguard/extranet.nix

   1 { pkgs, lib, config, hosts, hostName, credentials, ... }:
   2 let
   3   wgIface = "wg-extra";
   4   listenPort = 16843;
   5 in
   6 {
   7 networking.nftables.ruleset = ''
   8   table inet filter {
   9     chain input-net {
  10       udp dport ${toString listenPort} counter accept comment "${wgIface}"
  11     }
  12     chain input-extra {
  13       counter accept
  14     }
  15     chain input {
  16       iifname ${wgIface} jump input-extra
  17       iifname ${wgIface} log level warn prefix "input-extra: " counter drop
  18     }
  19     chain output-net {
  20     }
  21     chain output-extra {
  22       counter accept
  23     }
  24     chain output {
  25       oifname ${wgIface} jump output-extra
  26       oifname ${wgIface} log level warn prefix "output-extra: " counter drop
  27     }
  28     chain forward {
  29       # forward
  30       iifname ${wgIface} counter accept
  31     }
  32   }
  33 '';
  34 #boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
  35 systemd.services."wireguard-${wgIface}".serviceConfig.LoadCredentialEncrypted = "privateKey:${credentials}/wireguard/${wgIface}/privateKey.secret";
  36 networking.wireguard.interfaces."${wgIface}" = {
  37   # publicKey: 1Iyq96rPHfyrt4B31NqKLgWzlglkMAWjA41aF279gjM=
  38   privateKeyFile = "$CREDENTIALS_DIRECTORY/privateKey";
  39   ips = [ "192.168.43.1/32" ];
  40   inherit listenPort;
  41   socketNamespace = null;
  42   /*
  43   interfaceNamespace = "extra";
  44   preSetup = ''
  45     ${pkgs.iproute}/bin/ip netns add extra
  46   '';
  47   */
  48   peers = [
  49     { # julm-laptop
  50       publicKey = "Ul1+GINJ/eXy7MhUQLB6wXboLUfKW32nwHd/IAGtwSk=";
  51       allowedIPs = [ "192.168.43.2/32" ];
  52     }
  53     { # julm-mobile
  54       publicKey = "7hdI8aInfxFG0Ua1jHMDmx1RezI1q1PObFx6Kp2g5iI=";
  55       allowedIPs = [ "192.168.43.3/32" ];
  56     }
  57   ];
  58 };
  59 }