1 { pkgs, lib, config, hosts, hostName, credentials, ... }:
7 networking.nftables.ruleset = ''
10 udp dport ${toString listenPort} counter accept comment "${wgIface}"
16 iifname ${wgIface} jump input-extra
17 iifname ${wgIface} log level warn prefix "input-extra: " counter drop
25 oifname ${wgIface} jump output-extra
26 oifname ${wgIface} log level warn prefix "output-extra: " counter drop
30 iifname ${wgIface} counter accept
34 #boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
35 systemd.services."wireguard-${wgIface}".serviceConfig.LoadCredentialEncrypted = "privateKey:${credentials}/wireguard/${wgIface}/privateKey.secret";
36 networking.wireguard.interfaces."${wgIface}" = {
37 # publicKey: 1Iyq96rPHfyrt4B31NqKLgWzlglkMAWjA41aF279gjM=
38 privateKeyFile = "$CREDENTIALS_DIRECTORY/privateKey";
39 ips = [ "192.168.43.1/32" ];
41 socketNamespace = null;
43 interfaceNamespace = "extra";
45 ${pkgs.iproute}/bin/ip netns add extra
50 publicKey = "Ul1+GINJ/eXy7MhUQLB6wXboLUfKW32nwHd/IAGtwSk=";
51 allowedIPs = [ "192.168.43.2/32" ];
54 publicKey = "7hdI8aInfxFG0Ua1jHMDmx1RezI1q1PObFx6Kp2g5iI=";
55 allowedIPs = [ "192.168.43.3/32" ];