kalipso/infrastructure
1
1
Fork 1
Code Issues 43 Pull Requests 3 Actions Projects 2 Releases Wiki Activity

[malobeo/vpn] use wg-quick instead wireguard
All checks were successful
Evaluate Hydra Jobs / eval-hydra-jobs (push) Successful in 9m22s
Details

Browse Source 
this is compatible with systemd network (also in the future)
This commit is contained in:
kalipso
2024-12-19 15:23:46 +01:00
parent 6e4e35fcdf
commit 0d6df1d0ce
3 changed files with 27 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
machines/modules/malobeo/peers.nix
View File

@@ -2,7 +2,7 @@
"vpn" = { "vpn" = {
role = "server"; role = "server";
publicIp = "5.9.153.217"; publicIp = "5.9.153.217";
ips = [ "10.100.0.1/24" ]; address = [ "10.100.0.1/24" ];
allowedIPs = [ "10.100.0.0/24" ]; allowedIPs = [ "10.100.0.0/24" ];
listenPort = 51821; listenPort = 51821;
publicKey = "hF9H10Y8Ar7zvZXFoNM8LSoaYFgPCXv30c54SSEucX4="; publicKey = "hF9H10Y8Ar7zvZXFoNM8LSoaYFgPCXv30c54SSEucX4=";
@@ -10,15 +10,15 @@
"fanny" = { "fanny" = {
role = "client"; role = "client";
ips = [ "10.100.0.2/24" ]; address = [ "10.100.0.2/24" ];
allowedIPs = [ "10.100.0.0/24" ]; allowedIPs = [ "10.100.0.0/24" ];
publicKey = ""; publicKey = "hF8H10Y8Ar7zvZXFoNM8LSoaYFgPCXv30c54SSEucX4=";
}; };
"test" = { "test" = {
role = "client"; role = "client";
ips = [ "10.100.0.3/24" ]; address = [ "10.100.0.3/24" ];
allowedIPs = [ "10.100.0.0/24" ]; allowedIPs = [ "10.100.0.0/24" ];
publicKey = ""; publicKey = "hF7H10Y8Ar7zvZXFoNM8LSoaYFgPCXv30c54SSEucX4=";
}; };
} }

41
machines/modules/malobeo/wireguard.nix
View File

@@ -16,7 +16,7 @@ let
) peerList; ) peerList;
filteredPeerlist = map (host: builtins.removeAttrs host [ filteredPeerlist = map (host: builtins.removeAttrs host [
"role" "role"
"ips" "address"
"listenPort" "listenPort"
"publicIp" "publicIp"
] ) peerListWithEndpoint; ] ) peerListWithEndpoint;
@@ -38,7 +38,7 @@ in
''; '';
}; };
privateKey = mkOption { privateKeyFile = mkOption {
default = ""; default = "";
type = types.str; type = types.str;
description = '' description = ''
@@ -48,43 +48,44 @@ in
}; };
}; };
imports = [
inputs.microvm.nixosModules.host
];
config = mkIf cfg.enable { config = mkIf cfg.enable {
assertions = [ assertions = [
#{ {
# assertion = !(myPeer != "client" && cfg.role != "server"); assertion = !(myPeer.role != "client" && myPeer.role != "server");
# message = '' message = ''
# VPN Role must be either client or server, nothing else! VPN Role must be either client or server, nothing else!
# ''; '';
#} }
]; ];
networking.wireguard = { networking.wg-quick = {
enable = true;
interfaces = { interfaces = {
malovpn = { malovpn = {
ips = myPeer.ips; address = myPeer.address;
listenPort = mkIf (myPeer.role == "server") myPeer.listenPort; listenPort = mkIf (myPeer.role == "server") myPeer.listenPort;
# This allows the wireguard server to route your traffic to the internet and hence be like a VPN # This allows the wireguard server to route your traffic to the internet and hence be like a VPN
# For this to work you have to set the dnsserver IP of your router (or dnsserver of choice) in your clients # For this to work you have to set the dnsserver IP of your router (or dnsserver of choice) in your clients
postSetup = mkIf (myPeer.role == "server") '' postUp = mkIf (myPeer.role == "server") ''
${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -o eth0 -j MASQUERADE ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -o enp0s3 -j MASQUERADE
''; '';
# This undoes the above command # This undoes the above command
postShutdown = mkIf (myPeer.role == "server") '' postDown = mkIf (myPeer.role == "server") ''
${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.100.0.0/24 -o eth0 -j MASQUERADE ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.100.0.0/24 -o enp0s3 -j MASQUERADE
''; '';
privateKey = cfg.privateKey; privateKeyFile = cfg.privateKeyFile;
peers = filteredPeerlist; peers = filteredPeerlist;
}; };
}; };
}; };
#networking.nat = mkIf (myPeer.role == "server"){
# enable = true;
# internalInterfaces = [ "microvm" ];
# externalInterface = "eth0"; #change to your interface name
#};
}; };
} }

2
machines/vpn/configuration.nix
View File

@@ -21,7 +21,7 @@ with lib;
services.malobeo.vpn = { services.malobeo.vpn = {
enable = true; enable = true;
name = "vpn"; name = "vpn";
privateKey = config.sops.secrets.wg_private.path; privateKeyFile = config.sops.secrets.wg_private.path;
}; };
system.stateVersion = "22.11"; # Did you read the comment? system.stateVersion = "22.11"; # Did you read the comment?