changes.

1 files changed, 54 insertions, 0 deletions

diff --git a/hosts/mercury/wireguard.nix b/hosts/mercury/wireguard.nix
new file mode 100644
index 0000000..268cdc6
--- /dev/null
+++ b/hosts/mercury/wireguard.nix
@@ -0,0 +1,54 @@
+{
+  config,
+  hosts,
+  pkgs,
+  ...
+}: {
+  environment.systemPackages = [pkgs.wireguard-tools];
+
+  networking.firewall.interfaces."wg0" = {
+    allowedTCPPortRanges = [
+      {
+        from = 1714;
+        to = 1764;
+      }
+    ];
+    allowedUDPPortRanges = [
+      {
+        from = 1714;
+        to = 1764;
+      }
+    ];
+  };
+
+  systemd.network.netdevs."10-wg" = {
+    netdevConfig = {
+      Kind = "wireguard";
+      Name = "wg0";
+      MTUBytes = "1300";
+    };
+    wireguardConfig = {
+      PrivateKeyFile = config.collinux.secrets."wireguard-privkey".path;
+      ListenPort = 9918;
+    };
+    wireguardPeers = [
+      {
+        PublicKey = hosts.ganymede.wg_pubkey;
+        AllowedIPs = ["10.100.0.0/24"];
+        Endpoint = "williamsfam.us.com:51820";
+      }
+    ];
+  };
+  systemd.network.networks."wg0" = {
+    matchConfig.Name = "wg0";
+    address = ["${hosts.mercury.wg_ip}/24"];
+    DHCP = "no";
+    dns = ["${hosts.ganymede.wg_ip}:5353"];
+    domains = ["~ganymede"];
+    networkConfig.IPv6AcceptRA = false;
+    extraConfig = ''
+      DNSOverTLS=no
+      DNSSEC=no
+    '';
+  };
+}