95 lines
2.2 KiB
Nix
95 lines
2.2 KiB
Nix
{ container, pkgs, lib, config, ... }: with lib; let
|
|
cfg = config.container.module.vpn;
|
|
|
|
wireguardPeers = let
|
|
mkPeer = name: ip: PublicKey: {
|
|
inherit PublicKey;
|
|
PresharedKeyFile = "/var/lib/wireguard/preshared/${name}";
|
|
AllowedIPs = [ "${ip}/32" ];
|
|
};
|
|
in [
|
|
(mkPeer "dashaphone" "10.1.1.3" "O/3y8+QKEY8UoLVlmbc8xdhs248L4wtQcl1MsBBfoQo=")
|
|
(mkPeer "laptop" "10.1.1.9" "xxoCNPSB86zs8L8p+wXhqaIwpNDkiZu1Yjv8sj8XhgY=")
|
|
(mkPeer "phone" "10.1.1.5" "bFmFisMqbDpIrAg3o/GiRl9XhceZEVnZtkegZDTL4yg=")
|
|
(mkPeer "tablet" "10.1.1.6" "BdslswVc9OgUpEhJd0sugDBmYw44DiS0FbUPT5EjOG0=")
|
|
(mkPeer "work" "10.1.1.2" "Pk0AASSInKO9O8RaQEmm1uNrl0cwWTJDcT8rLn7PSA0=")
|
|
];
|
|
in {
|
|
options = {
|
|
container.module.vpn = {
|
|
enable = mkEnableOption "Vpn server.";
|
|
address = mkOption {
|
|
default = "10.1.0.23";
|
|
type = types.str;
|
|
};
|
|
port = mkOption {
|
|
default = 51820;
|
|
type = types.int;
|
|
};
|
|
storage = mkOption {
|
|
default = "${config.container.storage}/vpn";
|
|
type = types.str;
|
|
};
|
|
};
|
|
};
|
|
|
|
config = mkIf cfg.enable {
|
|
systemd.tmpfiles.rules = container.mkContainerDir cfg [
|
|
"data"
|
|
"data/preshared"
|
|
];
|
|
|
|
boot.kernel.sysctl = {
|
|
"net.ipv4.conf.all.src_valid_mark" = 1;
|
|
};
|
|
|
|
containers.vpn = container.mkContainer cfg {
|
|
forwardPorts = [
|
|
{
|
|
containerPort = cfg.port;
|
|
hostPort = cfg.port;
|
|
protocol = "udp";
|
|
}
|
|
];
|
|
bindMounts = {
|
|
"/var/lib/wireguard" = {
|
|
hostPath = "${cfg.storage}/data";
|
|
isReadOnly = false;
|
|
};
|
|
};
|
|
|
|
config = { ... }: container.mkContainerConfig cfg {
|
|
environment.systemPackages = with pkgs; [ wireguard-tools ];
|
|
networking.useNetworkd = true;
|
|
systemd.network = {
|
|
enable = true;
|
|
netdevs = {
|
|
"50-wg0" = {
|
|
netdevConfig = {
|
|
Kind = "wireguard";
|
|
MTUBytes = "1300";
|
|
Name = "wg0";
|
|
};
|
|
wireguardConfig = {
|
|
PrivateKeyFile = "/var/lib/wireguard/privkey";
|
|
ListenPort = cfg.port;
|
|
};
|
|
inherit wireguardPeers;
|
|
};
|
|
};
|
|
|
|
networks.wg0 = {
|
|
matchConfig.Name = "wg0";
|
|
address = ["10.1.1.0/24"];
|
|
networkConfig = {
|
|
IPForward = true;
|
|
IPMasquerade = "ipv4";
|
|
};
|
|
};
|
|
};
|
|
};
|
|
};
|
|
};
|
|
}
|
|
|