erwin/nixos-config
1
0
Fork 0
Code Issues 1 Pull requests Projects 1 Releases Wiki Activity Actions

Rework vpn config, change to VM

Browse source
This commit is contained in:
Erwin Boskma 2022-10-05 19:21:46 +02:00
parent 688a3ce42d
commit 4d7dabf4ca
Signed by: erwin
GPG key ID: 270B20D17394F7E5
2 changed files with 77 additions and 35 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

110
machines/vpn/configuration.nix
View file

@ -1,4 +1,8 @@
{ self, ... } @ inputs: {
{ self, ... } @ inputs:
let
pkgs = self.inputs.nixpkgs.legacyPackages.x86_64-linux;
in
{
imports = [
./hardware-configuration.nix
../../users/root
@ -11,35 +15,77 @@
enable = true;
remote-builders = true;
};
services = {
wireguard = {
server = {
enable = true;
externalInterface = "eth0";
internalInterface = "wg0";
internalIPs = [ "10.1.0.0/24" ];
privateKeyFile = "/run/secrets/wireguard_key";
peers = [
# horus
# {
# publicKey = "";
# persistentKeepalive = 25;
# allowedIPs = [
# "10.1.0.0/24"
# "10.0.0.0/24"
# ];
# }
# iphone
{
publicKey = "SlJSLRMaqoujNsTkzQRZlNLBGB0Q/tt3b8KijFEaH2s=";
persistentKeepalive = 25;
allowedIPs = [
"10.1.0.0/24"
"10.0.0.0/24"
];
}
];
};
};
networking = {
hostName = "vpn";
useDHCP = false;
nat = {
enable = true;
externalInterface = "br0";
internalInterfaces = [ "wg0" ];
};
interfaces = {
br0 = {
ipv4.addresses = [{ address = "10.0.0.250"; prefixLength = 24; }];
};
eth1 = {
ipv4.addresses = [{ address = "10.2.0.20"; prefixLength = 24; }];
};
};
firewall.trustedInterfaces = [ "eth1" ];
bridges = {
br0 = {
interfaces = [ "eth0" ];
rstp = true;
};
};
defaultGateway = {
address = "10.2.0.1";
interface = "eth1";
};
nameservers = [ "10.0.0.254" ];
wireguard.interfaces = {
wg0 = {
ips = [ "10.1.0.0/24" ];
listenPort = 51820;
privateKeyFile = "/run/secrets/wireguard_key";
postSetup = [
"${pkgs.iptables}/bin/iptables -A FORWARD -i %i -j ACCEPT"
"${pkgs.iptables}/bin/iptables -A FORWARD -o %i -j ACCEPT"
"${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -o br0 -j MASQUERADE"
];
postShutdown = [
"${pkgs.iptables}/bin/iptables -D FORWARD -i %i -j ACCEPT"
"${pkgs.iptables}/bin/iptables -D FORWARD -o %i -j ACCEPT"
"${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -o br0 -j MASQUERADE"
];
peers = [
# horus
# {
# publicKey = "";
# persistentKeepalive = 25;
# allowedIPs = [
# "10.1.0.0/24"
# "10.0.0.0/24"
# ];
# }
# iphone
{
publicKey = "SlJSLRMaqoujNsTkzQRZlNLBGB0Q/tt3b8KijFEaH2s=";
persistentKeepalive = 25;
allowedIPs = [
"10.1.0.0/24"
"10.0.0.0/24"
];
}
];
};
};
};
@ -54,10 +100,6 @@
services.openssh.enable = true;
proxmoxLXC = {
privileged = true;
};
sops.defaultSopsFile = ./secrets.yaml;
sops.secrets = {
wireguard_key = { };

2
machines/vpn/hardware-configuration.nix
View file

@ -5,6 +5,6 @@
, ...
}: {
imports = [
(modulesPath + "/virtualisation/proxmox-lxc.nix")
(modulesPath + "/virtualisation/proxmox-image.nix")
];
}