jakalx/nixos-config
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

thrall: Enable and configure wireguard

Browse source
This commit is contained in:
Alexander Kobjolke 2021-07-23 18:10:52 +02:00
parent b4569c8231
commit d05719f15c
1 changed files with 35 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

36
hosts/thrall/default.nix
View file

@ -53,7 +53,35 @@
nameservers = [ "1.1.1.1" "8.8.8.8" ];
firewall = {
allowedTCPPorts = [ 22 80 443 ];
allowedUDPPorts = [ ];
allowedUDPPorts = [ 42666 ];
};
# wireguard related config
nat.enable = true;
nat.externalInterface = "ens3";
nat.internalInterfaces = [ "wg0" ];
wireguard.interfaces = {
wg0 = {
ips = [ "10.0.0.1/24" ];
listenPort = 42666;
postSetup = ''
${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.0.0.0/24 -o ens3 -j MASQUERADE
'';
postShutdown = ''
${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.0.0.0/24 -o ens3 -j MASQUERADE
'';
privateKeyFile = config.age.secrets.wireguard-thrall.path;
peers = [
{
# my phone
publicKey = "9EaBSNsJW0W/xPMLJ54zr3UNK3bZ/2ULOmhV1gPfSXk=";
allowedIPs = [ "10.0.0.2/32" ];
}
];
};
};
};
@ -130,6 +158,12 @@
# Enable the OpenSSH daemon.
services.openssh.enable = true;
services.dnsmasq = {
enable = true;
extraConfig = ''
interface=wg0
'';
};
services.nginx.enable = true;
services.nginx = {
recommendedTlsSettings = true;