initial wireguard configuration

1 files changed, 48 insertions, 0 deletions

diff --git a/modules/wireguard/nixos/default.nix b/modules/wireguard/nixos/default.nix
new file mode 100644
index 0000000..6f51ddf
--- /dev/null
+++ b/modules/wireguard/nixos/default.nix
@@ -0,0 +1,48 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  cfg = config.collinux.wireguard;
+in
+  lib.mkIf cfg.enable {
+    boot.extraModulePackages = [config.boot.kernelPackages.wireguard];
+    boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
+
+    networking.useNetworkd = true;
+    systemd.network = {
+      netdevs."10-wg" = {
+        netdevConfig = {
+          Kind = "wireguard";
+          Name = "wg0";
+        };
+
+        wireguardConfig = {
+          PrivateKeyFile = cfg.privateKeyFile;
+          ListenPort = 51820;
+        };
+
+        wireguardPeers =
+          builtins.map (m: {
+            PublicKey = m.publicKey;
+            AllowedIPs = [m.ip];
+            Endpoint = m.endpoint;
+          })
+          cfg.peers;
+      };
+
+      networks."12-wireguard" = {
+        name = "wg0";
+
+        networkConfig = {
+          Address = cfg.ip;
+          DHCP = "no";
+          Gateway = cfg.gateway;
+
+          IPMasquerade = "ipv4";
+          IPv4Forwarding = true;
+          IPv6AcceptRA = false;
+        };
+      };
+    };
+  }