mynix/system
1
1
Fork 0
Code Issues 2 Pull requests Activity

canigou: cosmetic changes

Browse source
This commit is contained in:
Dmitriy Pleshevskiy 2023-03-20 23:32:29 +03:00
parent af6e140afa
commit 0575849fb6
Signed by: pleshevskiy
GPG key ID: 79C4487B44403985
3 changed files with 11 additions and 11 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

BIN
nixos/hosts/canigou/data.secret.nix
View file

Binary file not shown.

7
nixos/hosts/canigou/services/wireguard.nix
View file

@ -1,7 +1,8 @@
{ config, pkgs, ... }: { config, pkgs, ... }:
let let
port = 51820; canigouData = import ../data.secret.nix;
port = canigouData.wireguardPort;
in in
{ {
# enable NAT # enable NAT
@ -45,13 +46,13 @@ in
publicKey = "Gg+p7tysAhu2X841weBiQrqoKXh6kvcmDiCY62rLwQg="; publicKey = "Gg+p7tysAhu2X841weBiQrqoKXh6kvcmDiCY62rLwQg=";
# List of IPs assigned to this peer within the tunnel subnet. Used to configure routing. # List of IPs assigned to this peer within the tunnel subnet. Used to configure routing.
allowedIPs = [ "10.100.0.2/32" ]; allowedIPs = [ "10.100.0.2/32" ];
persistentKeepalive = 25; persistentKeepalive = 15;
} }
{ {
# Asus # Asus
publicKey = "mzVH0N3q7UE/XjMwgRks+D8KFuIj91VkOK2ytgjsnkw="; publicKey = "mzVH0N3q7UE/XjMwgRks+D8KFuIj91VkOK2ytgjsnkw=";
allowedIPs = [ "10.100.0.3/32" ]; allowedIPs = [ "10.100.0.3/32" ];
persistentKeepalive = 25; persistentKeepalive = 15;
} }
]; ];
}; };

15
nixos/modules/wireguard-client.nix
View file

@ -3,9 +3,10 @@
let let
cfg = config.local.wireguard; cfg = config.local.wireguard;
port = 51820; canigouData = import ../hosts/canigou/data.secret.nix;
serverAddr = (import ../hosts/canigou/data.secret.nix).addr; serverAddr = canigouData.addr;
serverPort = canigouData.wireguardPort;
# Run `ip route` to show gateway # Run `ip route` to show gateway
defaultGateway = "192.168.0.1"; defaultGateway = "192.168.0.1";
@ -25,7 +26,7 @@ in
config = lib.mkIf cfg.enable { config = lib.mkIf cfg.enable {
networking.firewall = { networking.firewall = {
allowedUDPPorts = [ port ]; # Clients and peers can use the same port, see listenport allowedUDPPorts = [ serverPort ]; # Clients and peers can use the same port, see listenport
}; };
# Enable WireGuard # Enable WireGuard
networking.wireguard.interfaces = { networking.wireguard.interfaces = {
@ -33,7 +34,7 @@ in
wg0 = { wg0 = {
# Determines the IP address and subnet of the client's end of the tunnel interface. # Determines the IP address and subnet of the client's end of the tunnel interface.
ips = [ cfg.ip ]; ips = [ cfg.ip ];
listenPort = port; # to match firewall allowedUDPPorts (without this wg uses random port numbers) listenPort = serverPort; # to match firewall allowedUDPPorts (without this wg uses random port numbers)
# Path to the private key file. # Path to the private key file.
privateKeyFile = cfg.privateKeyFile; privateKeyFile = cfg.privateKeyFile;
@ -56,12 +57,10 @@ in
# allowedIPs = [ "192.168.0.0/24" ]; # allowedIPs = [ "192.168.0.0/24" ];
# Set this to the server IP and port. # Set this to the server IP and port.
endpoint = "${serverAddr}:${toString port}"; endpoint = "${serverAddr}:${toString serverPort}";
# Send keepalives every 25 seconds. Important to keep NAT tables alive. # Send keepalives every 25 seconds. Important to keep NAT tables alive.
persistentKeepalive = 25; persistentKeepalive = 15;
dynamicEndpointRefreshRestartSeconds = 5;
} }
]; ];
}; };