haak/dotfiles
1
0
Fork 0
Code Issues Pull requests Wiki Activity Actions

use secrets file for key directly, since we have control of the server ephemeral key is less useful

Browse source
This commit is contained in:
Haak Saxberg 2022-11-12 22:47:22 -08:00
parent fe39e730ae
commit a55e5da509
1 changed files with 34 additions and 26 deletions
Download patch file Download diff file Expand all files Collapse all files

16
nix/deployments/nixops.nix
View file

@ -105,7 +105,12 @@ in
deployment.keys.wireguard.text = builtins.readFile ../../secrets/wireguard/svalbard; deployment.keys.wireguard.text = builtins.readFile ../../secrets/wireguard/svalbard;
# Enable WireGuard # Enable WireGuard
networking.wg-quick.interfaces = { networking.wg-quick.interfaces =
let
# Public key of the server (not a file path).
publicKey = "5y66WShsFXqM5K7/4CPEGCWfk7PQyNhVBT2ILjbGm2I=";
in
{
# "wg0" is the network interface name. You can name the interface arbitrarily. # "wg0" is the network interface name. You can name the interface arbitrarily.
wg0 = { wg0 = {
# Determines the IP address and subnet of the client's end of the tunnel interface. # Determines the IP address and subnet of the client's end of the tunnel interface.
@ -116,14 +121,16 @@ in
# Note: The private key can also be included inline via the privateKey option, # Note: The private key can also be included inline via the privateKey option,
# but this makes the private key world-readable; thus, using privateKeyFile is # but this makes the private key world-readable; thus, using privateKeyFile is
# recommended. # recommended.
privateKeyFile = "/run/keys/wireguard"; #privateKeyFile = "/run/keys/wireguard";
# See https://nixos.wiki/wiki/WireGuard#Tunnel_does_not_automatically_connect_despite_persistentKeepalive_being_set
# postUp = [ "wg set wg0 peer ${publicKey} persistent-keepalive 25" ];
privateKey = builtins.readFile ../../secrets/wireguard/svalbard;
# For a client configuration, one peer entry for the server will suffice. # For a client configuration, one peer entry for the server will suffice.
peers = [ peers = [
# Sweden, Malmo, se15 # Sweden, Malmo, se15
{ {
# Public key of the server (not a file path). inherit publicKey;
publicKey = "5y66WShsFXqM5K7/4CPEGCWfk7PQyNhVBT2ILjbGm2I=";
# Forward all the traffic via VPN. # Forward all the traffic via VPN.
allowedIPs = [ "0.0.0.0/0" "::0/0" ]; allowedIPs = [ "0.0.0.0/0" "::0/0" ];
@ -132,6 +139,7 @@ in
endpoint = "193.138.218.80:51820"; # ToDo: route to endpoint not automatically configured https://wiki.archlinux.org/index.php/WireGuard#Loop_routing https://discourse.nixos.org/t/solved-minimal-firewall-setup-for-wireguard-client/7577 endpoint = "193.138.218.80:51820"; # ToDo: route to endpoint not automatically configured https://wiki.archlinux.org/index.php/WireGuard#Loop_routing https://discourse.nixos.org/t/solved-minimal-firewall-setup-for-wireguard-client/7577
# Send keepalives every 25 seconds. Important to keep NAT tables alive. # Send keepalives every 25 seconds. Important to keep NAT tables alive.
# see https://nixos.wiki/wiki/WireGuard#Tunnel_does_not_automatically_connect_despite_persistentKeepalive_being_set
persistentKeepalive = 25; persistentKeepalive = 25;
} }
]; ];