CaZzzer/nix-conf
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

router: wireguard: add wg0 interface with some peers for testing

Browse Source
This commit is contained in:
Yuri Tatishchev
2025-05-20 23:32:21 -07:00
parent fce994ae9f
commit ff2f6d28bb
8 changed files with 75 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
hosts/router/default.nix
View File

@@ -8,6 +8,7 @@ in
[ # Include the results of the hardware scan.
./hardware-configuration.nix
./ifconfig.nix
./wireguard.nix
./firewall.nix
./dns.nix
./kea.nix

5
hosts/router/secrets/cf-api-key.age Normal file
View File

@@ -0,0 +1,5 @@
age-encryption.org/v1
-> ssh-ed25519 D2MY/A Kj69kavxx+ATNHP5pX0JtGggU76f9uRwkZp2HbjwiWc
SbU3jIcQzUzaQjRHzVSoW1WKiUj+1ijbkUKqVb406fY
--- vMV0TcchFvxw1xetQQZ0xVi2KwjLFRfZBM1gl7BGbGI
<EFBFBD><EFBFBD>1<10><><EFBFBD><EFBFBD>K<EFBFBD><<3C>

5
hosts/router/secrets/wireguard/wg0-peer-AsusS513-psk.age Normal file
View File

@@ -0,0 +1,5 @@
age-encryption.org/v1
-> ssh-ed25519 D2MY/A YAk0egMScFdPo0uAZzITtgQyPAifDcVUfb957Zhz9Ec
pAEM+7sbPE8rHBhRV7mTmH1w4mbfKFopMWbwu/3KHCw
--- ykshsqEqKvCCE2kWIPAJPA/DFW7mu6+0x4MQhHgi1yU
'<27>zƀ{g<>id\{<7B>E<EFBFBD><45><EFBFBD>tp<74>U<>g2QC3g<33><08>JG<4A>V1<56>6<>WG_E&<26>v<EFBFBD><76>)<29>&<26><><EFBFBD>ޑ N"<22><><EFBFBD>n<EFBFBD>_T͒<54>

BIN
hosts/router/secrets/wireguard/wg0-peer-Yura-Pixel7Pro-psk.age Normal file
View File

Binary file not shown.

6
hosts/router/secrets/wireguard/wg0-peer-Yura-TPX13-psk.age Normal file
View File

@@ -0,0 +1,6 @@
age-encryption.org/v1
-> ssh-ed25519 D2MY/A P88M0uj4ZphVo3WrRYDu+c7B0Dl7ncctbYkByYmU2wg
DV3Gn6TQ6iByAlNt0gg8kSZ2r0Gie/wcznZx9M+CC2g
--- KhwGM50BVql02Jq0do2uhXMfgWPPDfbodzDRmZ9n0O4
r<EFBFBD><EFBFBD><EFBFBD>Զa<EFBFBD>yY/C<><43>J<EFBFBD>B<EFBFBD>X<EFBFBD>!<21>"F
<EFBFBD>h<EFBFBD><EFBFBD><EFBFBD>(<28>L><3E>()<29><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>S;<3B>}}2ОO.<2E><13>hoqY<19>K"c<>E<EFBFBD><45>JM?-<2D>O

5
hosts/router/secrets/wireguard/wg0-private-key.age Normal file
View File

@@ -0,0 +1,5 @@
age-encryption.org/v1
-> ssh-ed25519 D2MY/A tvRtTGWnaB0zxqZRba4/XpzwPa61RrnHCk4tT8OfnGQ
IX85Q5VKxQTl+MnhzwiuTnNMVkR9QrYo/1njrbZeBnQ
--- dmlPIL2T+RFhbO2iLDRa4BxxYSSUQdedV3TK83ooFdA
<18>gE 7<><37>0`d<>V(o<>W<EFBFBD><57><EFBFBD>S@<01>ۭ<EFBFBD><DBAD><EFBFBD>p<EFBFBD><70><EFBFBD><EFBFBD><EFBFBD>Z<EFBFBD><5A>ЃT<D083><54><EFBFBD><EFBFBD><14>U<EFBFBD><55>+*<2A>\Q<><51>[<5B><><EFBFBD><EFBFBD>x<><78>29<32>i5<69>k

2
hosts/router/services.nix
View File

@@ -52,7 +52,7 @@ in
};
};
secrix.system.secrets.cf-api-key.encrypted.file = ../../secrets/cf_api_key.age;
secrix.system.secrets.cf-api-key.encrypted.file = ./secrets/cf-api-key.age;
systemd.services.caddy.serviceConfig.EnvironmentFile = config.secrix.system.secrets.cf-api-key.decrypted.path;
services.caddy = {
enable = true;

57
hosts/router/wireguard.nix Normal file
View File

@@ -0,0 +1,57 @@
{ config, lib, pkgs, ... }:
let
vars = import ./vars.nix;
wg0Peers = [
{
name = "Yura-TPX13";
allowedIPs = [ "10.6.0.3/32" "${vars.extra.opnsense.p6}::6:3:0/112" ];
publicKey = "iJa5JmJbMHNlbEluNwoB2Q8LyrPAfb7S/mluanMcI08=";
pskEnabled = true;
}
{
name = "Yura-Pixel7Pro";
allowedIPs = [ "10.6.0.4/32" "${vars.extra.opnsense.p6}::6:4:0/112" ];
publicKey = "UjZlsukmAsX60Z5FnZwKCSu141Gjj74+hBVT3TRhwT4=";
pskEnabled = true;
}
{
name = "AsusS513";
allowedIPs = [ "10.6.0.100/32" ];
publicKey = "XozJ7dHdJfkLORkCVxaB1VmvHEOAA285kRZcmzfPl38=";
pskEnabled = true;
}
];
in
{
secrix.services.systemd-networkd.secrets = let
pskEnabledPeers = builtins.filter (peer: peer.pskEnabled) wg0Peers;
peerToSecretAttrs = peer: {
name = "wg0-peer-${peer.name}-psk";
value.encrypted.file = ./secrets/wireguard/wg0-peer-${peer.name}-psk.age;
};
peerSecretsList = map peerToSecretAttrs pskEnabledPeers;
peerSecrets = builtins.listToAttrs peerSecretsList;
in
{
wg0-private-key.encrypted.file = ./secrets/wireguard/wg0-private-key.age;
} // peerSecrets;
systemd.network.netdevs = {
"10-wg0" = {
netdevConfig = {
Kind = "wireguard";
Name = "wg0";
};
wireguardConfig = {
PrivateKeyFile = config.secrix.services.systemd-networkd.secrets.wg0-private-key.decrypted.path;
ListenPort = 18596;
};
wireguardPeers = map (peer: {
AllowedIPs = lib.strings.concatStringsSep "," peer.allowedIPs;
PublicKey = peer.publicKey;
PresharedKeyFile = if peer.pskEnabled then config.secrix.services.systemd-networkd.secrets."wg0-peer-${peer.name}-psk".decrypted.path else null;
}) wg0Peers;
};
};
}