losurdo: allow oignon's SSH key

[sourcephile-nix.git] / hosts / losurdo / networking / wireguard / intranet.nix

diff --git a/hosts/losurdo/networking/wireguard/intranet.nix b/hosts/losurdo/networking/wireguard/intranet.nix
index bb27bdea0d48a3419041f078e66eb0e47e02d289..f7cccae013d1e1bf27158ac864fc28b7fff132bc 100644 (file)
--- a/hosts/losurdo/networking/wireguard/intranet.nix
+++ b/hosts/losurdo/networking/wireguard/intranet.nix
@@ -5,14 +5,8 @@ let
   inherit (config.boot) initrd;
   iface = "wg-intra";
   wg = config.networking.wireguard.interfaces.${iface};
-  relay =
-    hosts.mermet.extraArgs //
-    hosts.mermet.config.networking.wireguard.interfaces.${iface} //
-    lib.head (lib.filter (peer:
-      peer.endpoint != null &&
-      builtins.match "^\(.*\):[0-9]*$" peer.endpoint ==
-        [hosts.mermet.extraArgs.ipv4])
-      wg.peers);
+  wg-intra-hosts = import ../../../../networking/wireguard/wg-intra/hosts.nix;
+  relay = wg-intra-hosts.mermet;
 in
 {
 imports = [
@@ -34,12 +28,12 @@ security.gnupg.secrets."wireguard/${iface}/privateKey" = {
 systemd.services."wireguard-${iface}" = {
   after    = [ gnupg.secrets."wireguard/${iface}/privateKey".service ];
   requires = [ gnupg.secrets."wireguard/${iface}/privateKey".service ];
-  serviceConfig.Upholds = [ "upnpc-${toString wg.listenPort}.service" ];
+  unitConfig.Upholds = [ "upnpc-${toString wg.listenPort}.service" ];
 };
 networking.nftables.ruleset = ''
   # Allow initiating connection to and from other peers
-  add rule inet filter fw2net udp sport ${toString wg.listenPort} counter accept comment "${iface} output to peers"
-  add rule inet filter net2fw udp dport ${toString wg.listenPort} counter accept comment "${iface} input from peers"
+  add rule inet filter fw2net udp sport ${toString wg.listenPort} counter accept comment "WireGuard ${iface} output to peers"
+  add rule inet filter net2fw udp dport ${toString wg.listenPort} counter accept comment "WireGuard ${iface} input from peers"
 
   # Hook ${iface} into relevant chains
   add rule inet filter input  iifname "${iface}" jump intra2fw
@@ -89,7 +83,7 @@ boot.initrd.network.postCommands = ''
   wg set ${iface} private-key /root/initrd/${iface}.key \
      listen-port ${toString wg.listenPort}
   ip link set up dev ${iface}
-  wg set ${iface} peer ${relay.publicKey} \
+  wg set ${iface} peer ${relay.peer.publicKey} \
      endpoint ${relay.ipv4}:${toString relay.listenPort} \
      allowed-ips ${relay.ipv4}/32 \
      persistent-keepalive 5