51 lines
1.4 KiB
Nix
51 lines
1.4 KiB
Nix
{
|
|
config,
|
|
pkgs,
|
|
...
|
|
}: let
|
|
remoteHost = "pretix1.hosts.production.digitaler-dienst.net";
|
|
remotePort = 51000;
|
|
publicKey = "e4QfcYmicW2NUMyyjP7PcLgOxiqf3IdvCKeMRWt4zlY=";
|
|
externalIp = "5.75.219.20";
|
|
interface = "public-ip4";
|
|
rtTable = {
|
|
id = 1000;
|
|
name = interface;
|
|
};
|
|
in {
|
|
sops.secrets."wireguard/${interface}" = {
|
|
sopsFile = ../secrets.yaml;
|
|
};
|
|
|
|
networking = {
|
|
iproute2 = {
|
|
enable = true;
|
|
rttablesExtraConfig = ''
|
|
${toString rtTable.id} ${rtTable.name}
|
|
'';
|
|
};
|
|
wireguard.interfaces."${interface}" = {
|
|
ips = ["${externalIp}/32"];
|
|
privateKeyFile = config.sops.secrets."wireguard/${interface}".path;
|
|
table = rtTable.name;
|
|
postSetup = ''
|
|
${pkgs.iproute2}/bin/ip rule add from ${externalIp} to 192.168.0.0/16 table main priority 10
|
|
${pkgs.iproute2}/bin/ip rule add from ${externalIp} table ${rtTable.name} priority 20
|
|
'';
|
|
postShutdown = ''
|
|
${pkgs.iproute2}/bin/ip rule del from ${externalIp} to 192.168.0.0/16 table main priority 10
|
|
${pkgs.iproute2}/bin/ip rule del from ${externalIp} table ${rtTable.name} priority 20
|
|
'';
|
|
peers = [
|
|
{
|
|
inherit publicKey;
|
|
endpoint = "${remoteHost}:${toString remotePort}";
|
|
persistentKeepalive = 25;
|
|
allowedIPs = [
|
|
"0.0.0.0/0"
|
|
];
|
|
}
|
|
];
|
|
};
|
|
};
|
|
}
|