diff options
Diffstat (limited to 'hosts/ganymede')
| -rw-r--r-- | hosts/ganymede/networking.nix | 2 | ||||
| -rw-r--r-- | hosts/ganymede/wireguard.nix | 18 |
2 files changed, 18 insertions, 2 deletions
diff --git a/hosts/ganymede/networking.nix b/hosts/ganymede/networking.nix index 42a66c7..72eb026 100644 --- a/hosts/ganymede/networking.nix +++ b/hosts/ganymede/networking.nix @@ -72,7 +72,7 @@ in { unbound = { enable = true; settings.server = { - interface = ["0.0.0.0"]; + interface = ["0.0.0.0" "::1"]; port = 53; access-control = [ "127.0.0.0/8 allow" diff --git a/hosts/ganymede/wireguard.nix b/hosts/ganymede/wireguard.nix index 27d50bb..6e6ae05 100644 --- a/hosts/ganymede/wireguard.nix +++ b/hosts/ganymede/wireguard.nix @@ -11,15 +11,31 @@ networking.firewall = { allowedUDPPorts = [51820]; + allowedTCPPorts = [51843]; trustedInterfaces = ["wg0"]; }; + systemd.services.udp2raw-server = { + description = "udp2raw WireGuard transport"; + + wantedBy = ["multi-user.target"]; + after = ["network-online.target"]; + wants = ["network-online.target"]; + + serviceConfig = { + ExecStart = "${lib.getExe pkgs.udp2raw} -s -l 0.0.0.0:51843 -r 127.0.0.1:51820 -k shared-secret -a"; + + Restart = "on-failure"; + RestartSec = "2s"; + }; + }; + systemd.network.netdevs."50-wg0" = { netdevConfig = { Kind = "wireguard"; Name = "wg0"; - MTUBytes = 1200; + MTUBytes = "1200"; }; wireguardConfig = { |