jalr/nixos-configuration
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Refactor rules

Browse source
This commit is contained in:
Jakob Lechner 2025-09-16 09:55:18 +02:00
parent dfb70c1287
commit 6da5cb8a26
1 changed files with 25 additions and 22 deletions
Download patch file Download diff file Expand all files Collapse all files

47
hosts/iron/services/public-ip-tunnel.nix
View file

@ -1,4 +1,4 @@
{ config, pkgs, ... }:
{ config, lib, ... }:
let
inherit (config.networking) ports;
@ -21,27 +21,30 @@ in
'';
};
firewall.allowedUDPPorts = [ listenPort ];
wireguard.interfaces.hetzner-ha = {
ips = [ "${externalIp}/32" ];
privateKeyFile = config.sops.secrets.wireguard_key_hetzner-ha.path;
inherit listenPort;
table = rtTable.name;
postSetup = ''
${pkgs.iproute2}/bin/ip rule add from ${externalIp} to 192.168.0.0/16 table main priority 10
${pkgs.iproute2}/bin/ip rule add from ${externalIp} table ${rtTable.name} priority 20
'';
postShutdown = ''
${pkgs.iproute2}/bin/ip rule del from ${externalIp} to 192.168.0.0/16 table main priority 10
${pkgs.iproute2}/bin/ip rule del from ${externalIp} table ${rtTable.name} priority 20
'';
peers = [{
inherit publicKey;
endpoint = "${remoteHost}:${toString remotePort}";
persistentKeepalive = 25;
allowedIPs = [
"0.0.0.0/0"
wireguard.interfaces.hetzner-ha =
let
addRule = rule: "ip rule add " + rule;
deleteRule = rule: "ip rule delete " + rule;
rules = [
"from ${externalIp} to 192.168.0.0/16 table main priority 10"
"from ${externalIp} table ${rtTable.name} priority 20"
];
}];
};
in
{
ips = [ "${externalIp}/32" ];
privateKeyFile = config.sops.secrets.wireguard_key_hetzner-ha.path;
inherit listenPort;
table = rtTable.name;
postSetup = lib.concatLines (map addRule rules);
postShutdown = lib.concatLines (map deleteRule rules);
peers = [{
inherit publicKey;
endpoint = "${remoteHost}:${toString remotePort}";
persistentKeepalive = 25;
allowedIPs = [
"0.0.0.0/0"
];
}];
};
};
}