diff options
| -rw-r--r-- | hosts/ganymede/config.nix | 8 | ||||
| -rw-r--r-- | hosts/ganymede/nixos.nix | 7 | ||||
| -rw-r--r-- | modules/wireguard/nixos/default.nix | 16 | ||||
| -rw-r--r-- | modules/wireguard/options.nix | 1 |
4 files changed, 24 insertions, 8 deletions
diff --git a/hosts/ganymede/config.nix b/hosts/ganymede/config.nix index a7a68ea..7b8fbea 100644 --- a/hosts/ganymede/config.nix +++ b/hosts/ganymede/config.nix @@ -9,9 +9,11 @@ }; "caddy-env".file = ./caddy-env.age; - "tsnsrv-authkey".file = ./tsnsrv-authkey.age; - "wg-key".file = ./ganymede-wg-key.age; + "wg-key" = { + file = ./ganymede-wg-key.age; + owner = "systemd-network"; + }; }; wireguard = { @@ -21,7 +23,7 @@ privateKeyFile = config.collinux.secrets."wg-key".path; peers = { "mercury" = { - publicKey = "EDDppGqbLfEwEcHLP3J+bxKVGW16fAcU83K/ZKR2h3A="; + publicKey = "dU9CI6OQr0nJXb2JCy3SgqcraK60zuQzFJu3iHG6AAU="; ip = "100.100.0.5/32"; }; "jupiter" = { diff --git a/hosts/ganymede/nixos.nix b/hosts/ganymede/nixos.nix index 6680967..47e3129 100644 --- a/hosts/ganymede/nixos.nix +++ b/hosts/ganymede/nixos.nix @@ -1,6 +1,7 @@ { config, inputs, + lib, ... }: { imports = [ @@ -15,12 +16,18 @@ services.tailscale.extraSetFlags = ["--advertise-exit-node"]; + networking.firewall.allowedUDPPorts = [51820]; + # backup usb teather configuration systemd.network.networks."80-usb-teather" = { name = "enp0s20f0u2"; networkConfig.DHCP = "yes"; }; + systemd.networks."12-wireguard" = { + networkConfig.Address = lib.mkForce ["100.100.0.1/24"]; + }; + # i broke something and this fixes it environment.etc."systemd/resolved.conf.d/10-dns.conf".text = config.environment.etc."systemd/resolved.conf".text; } diff --git a/modules/wireguard/nixos/default.nix b/modules/wireguard/nixos/default.nix index ada218a..706048e 100644 --- a/modules/wireguard/nixos/default.nix +++ b/modules/wireguard/nixos/default.nix @@ -23,11 +23,17 @@ in wireguardPeers = cfg.peers - |> builtins.mapAttrs (_: m: { - PublicKey = m.publicKey; - AllowedIPs = [m.ip]; - Endpoint = m.endpoint; - }) + |> builtins.mapAttrs (_: m: + if (m == null) + then { + PublicKey = m.publicKey; + AllowedIPs = [m.ip]; + } + else { + PublicKey = m.publicKey; + AllowedIPs = [m.ip]; + Endpoint = m.endpoint; + }) |> builtins.attrValues; }; diff --git a/modules/wireguard/options.nix b/modules/wireguard/options.nix index 94d62e9..c3c574f 100644 --- a/modules/wireguard/options.nix +++ b/modules/wireguard/options.nix @@ -31,6 +31,7 @@ in { endpoint = mkOption { type = lib.types.nullOr lib.types.str; description = "peer's endpoint"; + default = null; }; }; }); |