]> Git — Sourcephile - sourcephile-nix.git/blob - hosts/losurdo/networking/wireguard/wg-extra.nix
nix: revamp secrets
[sourcephile-nix.git] / hosts / losurdo / networking / wireguard / wg-extra.nix
1 { pkgs, lib, config, hosts, hostName, ... }:
2 let
3 wgIface = "wg-extra";
4 listenPort = 16843;
5 in
6 {
7 networking.nftables.ruleset = ''
8 table inet filter {
9 chain input-net {
10 udp dport ${toString listenPort} counter accept comment "${wgIface}"
11 }
12 chain input-extra {
13 counter accept
14 }
15 chain input {
16 iifname ${wgIface} jump input-extra
17 iifname ${wgIface} log level warn prefix "input-extra: " counter drop
18 }
19 chain output-net {
20 }
21 chain output-extra {
22 counter accept
23 }
24 chain output {
25 oifname ${wgIface} jump output-extra
26 oifname ${wgIface} log level warn prefix "output-extra: " counter drop
27 }
28 chain forward {
29 # forward
30 iifname ${wgIface} counter accept
31 }
32 }
33 '';
34 #boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
35 systemd.services."wireguard-${wgIface}".serviceConfig.LoadCredentialEncrypted = "privateKey:" + ./. + "/${wgIface}/privateKey.cred";
36 networking.wireguard.interfaces."${wgIface}" = {
37 # publicKey: 1Iyq96rPHfyrt4B31NqKLgWzlglkMAWjA41aF279gjM=
38 privateKeyFile = "$CREDENTIALS_DIRECTORY/privateKey";
39 ips = [ "192.168.43.1/32" ];
40 inherit listenPort;
41 socketNamespace = null;
42 /*
43 interfaceNamespace = "extra";
44 preSetup = ''
45 ${pkgs.iproute}/bin/ip netns add extra
46 '';
47 */
48 peers = [
49 { # julm-laptop
50 publicKey = "Ul1+GINJ/eXy7MhUQLB6wXboLUfKW32nwHd/IAGtwSk=";
51 allowedIPs = [ "192.168.43.2/32" ];
52 }
53 { # julm-mobile
54 publicKey = "7hdI8aInfxFG0Ua1jHMDmx1RezI1q1PObFx6Kp2g5iI=";
55 allowedIPs = [ "192.168.43.3/32" ];
56 }
57 ];
58 };
59 }