haak/dotfiles
1
0
Fork 0
Code Issues Pull requests Wiki Activity Actions

use secrets file for key directly, since we have control of the server ephemeral key is less useful

Browse source
This commit is contained in:
Haak Saxberg 2022-11-12 22:47:22 -08:00
parent fe39e730ae
commit a55e5da509
1 changed files with 34 additions and 26 deletions
Download patch file Download diff file Expand all files Collapse all files

60
nix/deployments/nixops.nix
View file

@ -105,37 +105,45 @@ in
deployment.keys.wireguard.text = builtins.readFile ../../secrets/wireguard/svalbard;
# Enable WireGuard
networking.wg-quick.interfaces = {
# "wg0" is the network interface name. You can name the interface arbitrarily.
wg0 = {
# Determines the IP address and subnet of the client's end of the tunnel interface.
address = [ "10.64.168.213/32" "fc00:bbbb:bbbb:bb01::1:a8d4/128" ];
dns = [ "10.64.0.1" ];
listenPort = 51820; # to match firewall allowedUDPPorts (without this wg uses random port numbers)
networking.wg-quick.interfaces =
let
# Public key of the server (not a file path).
publicKey = "5y66WShsFXqM5K7/4CPEGCWfk7PQyNhVBT2ILjbGm2I=";
in
{
# "wg0" is the network interface name. You can name the interface arbitrarily.
wg0 = {
# Determines the IP address and subnet of the client's end of the tunnel interface.
address = [ "10.64.168.213/32" "fc00:bbbb:bbbb:bb01::1:a8d4/128" ];
dns = [ "10.64.0.1" ];
listenPort = 51820; # to match firewall allowedUDPPorts (without this wg uses random port numbers)
# Note: The private key can also be included inline via the privateKey option,
# but this makes the private key world-readable; thus, using privateKeyFile is
# recommended.
privateKeyFile = "/run/keys/wireguard";
# Note: The private key can also be included inline via the privateKey option,
# but this makes the private key world-readable; thus, using privateKeyFile is
# recommended.
#privateKeyFile = "/run/keys/wireguard";
# See https://nixos.wiki/wiki/WireGuard#Tunnel_does_not_automatically_connect_despite_persistentKeepalive_being_set
# postUp = [ "wg set wg0 peer ${publicKey} persistent-keepalive 25" ];
privateKey = builtins.readFile ../../secrets/wireguard/svalbard;
# For a client configuration, one peer entry for the server will suffice.
peers = [
# Sweden, Malmo, se15
{
# Public key of the server (not a file path).
publicKey = "5y66WShsFXqM5K7/4CPEGCWfk7PQyNhVBT2ILjbGm2I=";
# For a client configuration, one peer entry for the server will suffice.
peers = [
# Sweden, Malmo, se15
{
inherit publicKey;
# Forward all the traffic via VPN.
allowedIPs = [ "0.0.0.0/0" "::0/0" ];
# Forward all the traffic via VPN.
allowedIPs = [ "0.0.0.0/0" "::0/0" ];
# Set this to the server IP and port.
endpoint = "193.138.218.80:51820"; # ToDo: route to endpoint not automatically configured https://wiki.archlinux.org/index.php/WireGuard#Loop_routing https://discourse.nixos.org/t/solved-minimal-firewall-setup-for-wireguard-client/7577
# Set this to the server IP and port.
endpoint = "193.138.218.80:51820"; # ToDo: route to endpoint not automatically configured https://wiki.archlinux.org/index.php/WireGuard#Loop_routing https://discourse.nixos.org/t/solved-minimal-firewall-setup-for-wireguard-client/7577
# Send keepalives every 25 seconds. Important to keep NAT tables alive.
persistentKeepalive = 25;
}
];
# Send keepalives every 25 seconds. Important to keep NAT tables alive.
# see https://nixos.wiki/wiki/WireGuard#Tunnel_does_not_automatically_connect_despite_persistentKeepalive_being_set
persistentKeepalive = 25;
}
];
};
};
};
};
}