]> Git — Sourcephile - sourcephile-nix.git/blob - hosts/losurdo/wireguard/wg-extra.nix
mermet: gitolite: update
[sourcephile-nix.git] / hosts / losurdo / wireguard / wg-extra.nix
1 { inputs, hostName, ... }:
2 let
3 wgIface = "wg-extra";
4 listenPort = 16843;
5 in
6 {
7 networking.nftables.ruleset = ''
8 table inet filter {
9 chain input-net {
10 udp dport ${toString listenPort} counter accept comment "${wgIface}"
11 }
12 chain input-extra {
13 counter accept
14 }
15 chain input {
16 iifname ${wgIface} jump input-extra
17 iifname ${wgIface} log level warn prefix "input-extra: " counter drop
18 }
19 chain output-net {
20 }
21 chain output-extra {
22 counter accept
23 }
24 chain output {
25 oifname ${wgIface} jump output-extra
26 oifname ${wgIface} log level warn prefix "output-extra: " counter drop
27 }
28 chain forward {
29 # forward
30 iifname ${wgIface} counter accept
31 }
32 }
33 '';
34 #boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
35 systemd.services."wireguard-${wgIface}".serviceConfig.LoadCredentialEncrypted = [
36 "privateKey:${./. + "/${wgIface}/privateKey.cred"}"
37 ];
38 networking.networkmanager.unmanaged = [ wgIface ];
39 networking.wireguard.interfaces.${wgIface} = {
40 # publicKey: 1Iyq96rPHfyrt4B31NqKLgWzlglkMAWjA41aF279gjM=
41 privateKeyFile = "$CREDENTIALS_DIRECTORY/privateKey";
42 ips = [ "192.168.43.1/32" ];
43 inherit listenPort;
44 socketNamespace = null;
45 /*
46 interfaceNamespace = "extra";
47 preSetup = ''
48 ${pkgs.iproute}/bin/ip netns add extra
49 '';
50 */
51 peers = [
52 {
53 # julm-laptop
54 publicKey = "Ul1+GINJ/eXy7MhUQLB6wXboLUfKW32nwHd/IAGtwSk=";
55 allowedIPs = [ "192.168.43.2/32" ];
56 }
57 {
58 # julm-mobile
59 publicKey = "7hdI8aInfxFG0Ua1jHMDmx1RezI1q1PObFx6Kp2g5iI=";
60 allowedIPs = [ "192.168.43.3/32" ];
61 }
62 ];
63 };
64 }