From a55e5da50936e741c9bb5fb9ab796d40dbc61f86 Mon Sep 17 00:00:00 2001 From: Haak Saxberg Date: Sat, 12 Nov 2022 22:47:22 -0800 Subject: [PATCH] use secrets file for key directly, since we have control of the server ephemeral key is less useful --- nix/deployments/nixops.nix | 60 +++++++++++++++++++++----------------- 1 file changed, 34 insertions(+), 26 deletions(-) diff --git a/nix/deployments/nixops.nix b/nix/deployments/nixops.nix index 6771102..ed57dd0 100644 --- a/nix/deployments/nixops.nix +++ b/nix/deployments/nixops.nix @@ -105,37 +105,45 @@ in deployment.keys.wireguard.text = builtins.readFile ../../secrets/wireguard/svalbard; # Enable WireGuard - networking.wg-quick.interfaces = { - # "wg0" is the network interface name. You can name the interface arbitrarily. - wg0 = { - # Determines the IP address and subnet of the client's end of the tunnel interface. - address = [ "10.64.168.213/32" "fc00:bbbb:bbbb:bb01::1:a8d4/128" ]; - dns = [ "10.64.0.1" ]; - listenPort = 51820; # to match firewall allowedUDPPorts (without this wg uses random port numbers) + networking.wg-quick.interfaces = + let + # Public key of the server (not a file path). + publicKey = "5y66WShsFXqM5K7/4CPEGCWfk7PQyNhVBT2ILjbGm2I="; + in + { + # "wg0" is the network interface name. You can name the interface arbitrarily. + wg0 = { + # Determines the IP address and subnet of the client's end of the tunnel interface. + address = [ "10.64.168.213/32" "fc00:bbbb:bbbb:bb01::1:a8d4/128" ]; + dns = [ "10.64.0.1" ]; + listenPort = 51820; # to match firewall allowedUDPPorts (without this wg uses random port numbers) - # Note: The private key can also be included inline via the privateKey option, - # but this makes the private key world-readable; thus, using privateKeyFile is - # recommended. - privateKeyFile = "/run/keys/wireguard"; + # Note: The private key can also be included inline via the privateKey option, + # but this makes the private key world-readable; thus, using privateKeyFile is + # recommended. + #privateKeyFile = "/run/keys/wireguard"; + # See https://nixos.wiki/wiki/WireGuard#Tunnel_does_not_automatically_connect_despite_persistentKeepalive_being_set + # postUp = [ "wg set wg0 peer ${publicKey} persistent-keepalive 25" ]; + privateKey = builtins.readFile ../../secrets/wireguard/svalbard; - # For a client configuration, one peer entry for the server will suffice. - peers = [ - # Sweden, Malmo, se15 - { - # Public key of the server (not a file path). - publicKey = "5y66WShsFXqM5K7/4CPEGCWfk7PQyNhVBT2ILjbGm2I="; + # For a client configuration, one peer entry for the server will suffice. + peers = [ + # Sweden, Malmo, se15 + { + inherit publicKey; - # Forward all the traffic via VPN. - allowedIPs = [ "0.0.0.0/0" "::0/0" ]; + # Forward all the traffic via VPN. + allowedIPs = [ "0.0.0.0/0" "::0/0" ]; - # Set this to the server IP and port. - endpoint = "193.138.218.80:51820"; # ToDo: route to endpoint not automatically configured https://wiki.archlinux.org/index.php/WireGuard#Loop_routing https://discourse.nixos.org/t/solved-minimal-firewall-setup-for-wireguard-client/7577 + # Set this to the server IP and port. + endpoint = "193.138.218.80:51820"; # ToDo: route to endpoint not automatically configured https://wiki.archlinux.org/index.php/WireGuard#Loop_routing https://discourse.nixos.org/t/solved-minimal-firewall-setup-for-wireguard-client/7577 - # Send keepalives every 25 seconds. Important to keep NAT tables alive. - persistentKeepalive = 25; - } - ]; + # Send keepalives every 25 seconds. Important to keep NAT tables alive. + # see https://nixos.wiki/wiki/WireGuard#Tunnel_does_not_automatically_connect_despite_persistentKeepalive_being_set + persistentKeepalive = 25; + } + ]; + }; }; - }; }; }