]> Git — Sourcephile - sourcephile-nix.git/blob - hosts/losurdo/networking/wireguard/wg-extra.nix
creds: finish to migrate to systemd-creds.nix
[sourcephile-nix.git] / hosts / losurdo / networking / wireguard / wg-extra.nix
1 { pkgs, lib, config, inputs, hosts, hostName, ... }:
2 let
3 wgIface = "wg-extra";
4 listenPort = 16843;
5 in
6 {
7 networking.nftables.ruleset = ''
8 table inet filter {
9 chain input-net {
10 udp dport ${toString listenPort} counter accept comment "${wgIface}"
11 }
12 chain input-extra {
13 counter accept
14 }
15 chain input {
16 iifname ${wgIface} jump input-extra
17 iifname ${wgIface} log level warn prefix "input-extra: " counter drop
18 }
19 chain output-net {
20 }
21 chain output-extra {
22 counter accept
23 }
24 chain output {
25 oifname ${wgIface} jump output-extra
26 oifname ${wgIface} log level warn prefix "output-extra: " counter drop
27 }
28 chain forward {
29 # forward
30 iifname ${wgIface} counter accept
31 }
32 }
33 '';
34 #boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
35 systemd.services."wireguard-${wgIface}".serviceConfig.LoadCredentialEncrypted =
36 [ "privateKey:${inputs.self}/hosts/${hostName}/networking/wireguard/${wgIface}/privateKey.cred" ];
37 networking.wireguard.interfaces."${wgIface}" = {
38 # publicKey: 1Iyq96rPHfyrt4B31NqKLgWzlglkMAWjA41aF279gjM=
39 privateKeyFile = "$CREDENTIALS_DIRECTORY/privateKey";
40 ips = [ "192.168.43.1/32" ];
41 inherit listenPort;
42 socketNamespace = null;
43 /*
44 interfaceNamespace = "extra";
45 preSetup = ''
46 ${pkgs.iproute}/bin/ip netns add extra
47 '';
48 */
49 peers = [
50 { # julm-laptop
51 publicKey = "Ul1+GINJ/eXy7MhUQLB6wXboLUfKW32nwHd/IAGtwSk=";
52 allowedIPs = [ "192.168.43.2/32" ];
53 }
54 { # julm-mobile
55 publicKey = "7hdI8aInfxFG0Ua1jHMDmx1RezI1q1PObFx6Kp2g5iI=";
56 allowedIPs = [ "192.168.43.3/32" ];
57 }
58 ];
59 };
60 }