diff options
Diffstat (limited to 'modules/services')
| -rw-r--r-- | modules/services/nixos/default.nix | 1 | ||||
| -rw-r--r-- | modules/services/nixos/wireguard/client.nix | 50 | ||||
| -rw-r--r-- | modules/services/nixos/wireguard/default.nix | 6 | ||||
| -rw-r--r-- | modules/services/options.nix | 13 |
4 files changed, 69 insertions, 1 deletions
diff --git a/modules/services/nixos/default.nix b/modules/services/nixos/default.nix index 9c95180..db637e8 100644 --- a/modules/services/nixos/default.nix +++ b/modules/services/nixos/default.nix @@ -4,6 +4,7 @@ ./audio.nix ./bluetooth.nix ./tailscale.nix + ./wireguard ./selfhost ./ssh.nix ]; diff --git a/modules/services/nixos/wireguard/client.nix b/modules/services/nixos/wireguard/client.nix new file mode 100644 index 0000000..ec41ad5 --- /dev/null +++ b/modules/services/nixos/wireguard/client.nix @@ -0,0 +1,50 @@ +{ + config, + lib, + ... +}: let + cfg = config.collinux.services.networking.wireguard; +in + lib.mkIf (cfg.enable && cfg.localPeer.role == "spoke") { + boot.extraModulePackages = [config.boot.kernelPackages.wireguard]; + + # we know the machine is configured to use networkd already + systemd.network = { + netdevs = { + "10-wg0" = { + netdevConfig = { + Kind = "wireguard"; + Name = "wg0"; + }; + + wireguardConfig = { + PrivateKeyFile = cfg.privateKeyFile; + ListenPort = 51820; + }; + + wireguardPeers = [ + { + PublicKey = ""; # will configure later + AllowedIPs = ["100.100.0.1"]; + Endpoint = "williamsfam.us.com:51820"; # not configured yet + } + ]; + }; + }; + + networks."12-wireguard" = { + name = "wg0"; + + networkConfig = { + Address = cfg.ip; + Gateway = "100.100.0.1"; + DHCP = "no"; + + # disable ipv6 addresses + IPv6AcceptRA = "no"; + IPv6PrivacyExtensions = "no"; + LinkLocalAddressing = "no"; + }; + }; + }; + } diff --git a/modules/services/nixos/wireguard/default.nix b/modules/services/nixos/wireguard/default.nix new file mode 100644 index 0000000..f7ecff0 --- /dev/null +++ b/modules/services/nixos/wireguard/default.nix @@ -0,0 +1,6 @@ +{ + imports = [ + ./client.nix + ./server.nix + ]; +} diff --git a/modules/services/options.nix b/modules/services/options.nix index 231c949..085895e 100644 --- a/modules/services/options.nix +++ b/modules/services/options.nix @@ -47,7 +47,6 @@ in { }; tailscale.enable = mkEnableOption "tailscale"; - sshd = { enable = mkEnableOption "OpenSSH server"; bind_host = mkOption { @@ -133,6 +132,18 @@ in { assertion = with config.collinux.services.networking; (iwd.enable && !networkmanager.enable && !networkd.enable) || (!iwd.enable && networkmanager.enable && !networkd.enable) || (!iwd.enable && !networkmanager.enable && networkd.enable); message = "only one networking method (iwd, networkmanager, networkd) can be active"; } + { + assertion = with config.collinux.services.networking; !(wireguard.enable && tailscale.enable); + message = "only one vpn method (tailscale, wireguard) can be active"; + } + { + assertion = with config.collinux.services.networking; wireguard.enable && !networkd.enable; + message = "wireguard configuration only supports networkd at the moment"; + } + { + assertion = with config.collinux.services.networking.wireguard; enable && (peersConfig |> (builtins.filter (m: m.role == "hub")) |> lib.count) == 1; + message = "there must be exactly one hub in the wireguard configuration"; + } ]; }; } |