adtya/configuration.nix
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

replace wg-quick with systemd-networkd

Browse source
This commit is contained in:
Adithya 2024-12-07 02:28:11 +05:30
parent 90c0d22af4
commit fba9d77668
Signed by: adtya
GPG key ID: B8857BFBA2C47B9C
10 changed files with 226 additions and 148 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

55
hosts/bifrost/network/wireguard.nix
View file

@ -1,10 +1,10 @@
{ config, ... }:
let wireguard-peers = import ../../shared/wireguard-peers.nix; in {
let wireguard-peers = import ../../shared/wireguard-peers.nix { noEndpoints = true; }; in {
sops.secrets = {
"wireguard/bifrost/pk" = {
mode = "400";
owner = config.users.users.root.name;
group = config.users.users.root.group;
owner = config.users.users.systemd-network.name;
group = config.users.users.systemd-network.group;
};
};
networking = {
@ -12,25 +12,36 @@ let wireguard-peers = import ../../shared/wireguard-peers.nix; in {
allowedUDPPorts = [ 51821 ];
trustedInterfaces = [ "Homelab" ];
};
wg-quick = {
interfaces = {
Homelab = {
listenPort = 51821;
privateKeyFile = config.sops.secrets."wireguard/bifrost/pk".path;
address = [
"${config.nodeconfig.facts.wireguard-ip}/24"
];
dns = [ "10.10.10.1" ];
peers = with wireguard-peers; [
(rico0 // { endpoint = null; })
(rico1 // { endpoint = null; })
(rico2 // { endpoint = null; })
(wynne // { endpoint = null; })
(layne // { endpoint = null; })
skipper
kowalski
];
};
};
systemd.network = {
netdevs."99-Homelab" = {
netdevConfig = {
Name = "Homelab";
Kind = "wireguard";
};
wireguardConfig = {
ListenPort = 51821;
PrivateKeyFile = config.sops.secrets."wireguard/bifrost/pk".path;
};
wireguardPeers = with wireguard-peers; [
rico0
rico1
rico2
wynne
layne
skipper
kowalski
];
};
networks."99-Homelab" = {
matchConfig = {
Name = "Homelab";
};
networkConfig = {
DNS = "10.10.10.1";
Address = [
"${config.nodeconfig.facts.wireguard-ip}/24"
];
};
};
};

52
hosts/layne/network/wireguard.nix
View file

@ -1,10 +1,10 @@
{ config, ... }:
let wireguard-peers = import ../../shared/wireguard-peers.nix; in {
let wireguard-peers = import ../../shared/wireguard-peers.nix { }; in {
sops.secrets = {
"wireguard/layne/pk" = {
mode = "400";
owner = config.users.users.root.name;
group = config.users.users.root.group;
owner = config.users.users.systemd-network.name;
group = config.users.users.systemd-network.group;
};
};
networking = {
@ -12,25 +12,35 @@ let wireguard-peers = import ../../shared/wireguard-peers.nix; in {
allowedUDPPorts = [ 51834 ];
trustedInterfaces = [ "Homelab" ];
};
wg-quick = {
interfaces = {
Homelab = {
listenPort = 51834;
privateKeyFile = config.sops.secrets."wireguard/layne/pk".path;
address = [
"${config.nodeconfig.facts.wireguard-ip}/24"
];
dns = [ "10.10.10.1" ];
peers = with wireguard-peers; [
(bifrost // { persistentKeepalive = 20; })
rico0
rico1
rico2
wynne
];
};
};
systemd.network = {
netdevs."99-Homelab" = {
netdevConfig = {
Name = "Homelab";
Kind = "wireguard";
};
wireguardConfig = {
ListenPort = 51834;
PrivateKeyFile = config.sops.secrets."wireguard/layne/pk".path;
};
wireguardPeers = with wireguard-peers; [
(bifrost // { PersistentKeepalive = 20; })
rico0
rico1
rico2
wynne
];
};
networks."99-Homelab" = {
matchConfig = {
Name = "Homelab";
};
networkConfig = {
DNS = "10.10.10.1";
Address = [
"${config.nodeconfig.facts.wireguard-ip}/24"
];
};
};
};
}

51
hosts/rico0/network/wireguard.nix
View file

@ -1,10 +1,10 @@
{ config, ... }:
let wireguard-peers = import ../../shared/wireguard-peers.nix; in {
let wireguard-peers = import ../../shared/wireguard-peers.nix { }; in {
sops.secrets = {
"wireguard/rico0/pk" = {
mode = "400";
owner = config.users.users.root.name;
group = config.users.users.root.group;
owner = config.users.users.systemd-network.name;
group = config.users.users.systemd-network.group;
};
};
networking = {
@ -12,23 +12,34 @@ let wireguard-peers = import ../../shared/wireguard-peers.nix; in {
allowedUDPPorts = [ 51830 ];
trustedInterfaces = [ "Homelab" ];
};
wg-quick = {
interfaces = {
Homelab = {
listenPort = 51830;
privateKeyFile = config.sops.secrets."wireguard/rico0/pk".path;
address = [
"${config.nodeconfig.facts.wireguard-ip}/24"
];
dns = [ "10.10.10.1" ];
peers = with wireguard-peers; [
(bifrost // { persistentKeepalive = 20; })
rico1
rico2
wynne
layne
];
};
};
systemd.network = {
netdevs."99-Homelab" = {
netdevConfig = {
Name = "Homelab";
Kind = "wireguard";
};
wireguardConfig = {
ListenPort = 51830;
PrivateKeyFile = config.sops.secrets."wireguard/rico0/pk".path;
};
wireguardPeers = with wireguard-peers; [
(bifrost // { PersistentKeepalive = 20; })
rico1
rico2
wynne
layne
];
};
networks."99-Homelab" = {
matchConfig = {
Name = "Homelab";
};
networkConfig = {
DNS = "10.10.10.1";
Address = [
"${config.nodeconfig.facts.wireguard-ip}/24"
];
};
};
};

51
hosts/rico1/network/wireguard.nix
View file

@ -1,10 +1,10 @@
{ config, ... }:
let wireguard-peers = import ../../shared/wireguard-peers.nix; in {
let wireguard-peers = import ../../shared/wireguard-peers.nix { }; in {
sops.secrets = {
"wireguard/rico1/pk" = {
mode = "400";
owner = config.users.users.root.name;
group = config.users.users.root.group;
owner = config.users.users.systemd-network.name;
group = config.users.users.systemd-network.group;
};
};
networking = {
@ -12,23 +12,34 @@ let wireguard-peers = import ../../shared/wireguard-peers.nix; in {
allowedUDPPorts = [ 51831 ];
trustedInterfaces = [ "Homelab" ];
};
wg-quick = {
interfaces = {
Homelab = {
listenPort = 51831;
privateKeyFile = config.sops.secrets."wireguard/rico1/pk".path;
address = [
"${config.nodeconfig.facts.wireguard-ip}/24"
];
dns = [ "10.10.10.1" ];
peers = with wireguard-peers; [
(bifrost // { persistentKeepalive = 20; })
rico0
rico2
wynne
layne
];
};
};
systemd.network = {
netdevs."99-Homelab" = {
netdevConfig = {
Name = "Homelab";
Kind = "wireguard";
};
wireguardConfig = {
ListenPort = 51831;
PrivateKeyFile = config.sops.secrets."wireguard/rico1/pk".path;
};
wireguardPeers = with wireguard-peers; [
(bifrost // { PersistentKeepalive = 20; })
rico0
rico2
wynne
layne
];
};
networks."99-Homelab" = {
matchConfig = {
Name = "Homelab";
};
networkConfig = {
DNS = "10.10.10.1";
Address = [
"${config.nodeconfig.facts.wireguard-ip}/24"
];
};
};
};

51
hosts/rico2/network/wireguard.nix
View file

@ -1,10 +1,10 @@
{ config, ... }:
let wireguard-peers = import ../../shared/wireguard-peers.nix; in {
let wireguard-peers = import ../../shared/wireguard-peers.nix { }; in {
sops.secrets = {
"wireguard/rico2/pk" = {
mode = "400";
owner = config.users.users.root.name;
group = config.users.users.root.group;
owner = config.users.users.systemd-network.name;
group = config.users.users.systemd-network.group;
};
};
networking = {
@ -12,23 +12,34 @@ let wireguard-peers = import ../../shared/wireguard-peers.nix; in {
allowedUDPPorts = [ 51832 ];
trustedInterfaces = [ "Homelab" ];
};
wg-quick = {
interfaces = {
Homelab = {
listenPort = 51832;
privateKeyFile = config.sops.secrets."wireguard/rico2/pk".path;
address = [
"${config.nodeconfig.facts.wireguard-ip}/24"
];
dns = [ "10.10.10.1" ];
peers = with wireguard-peers; [
(bifrost // { persistentKeepalive = 20; })
rico0
rico1
wynne
layne
];
};
};
systemd.network = {
netdevs."99-Homelab" = {
netdevConfig = {
Name = "Homelab";
Kind = "wireguard";
};
wireguardConfig = {
ListenPort = 51832;
PrivateKeyFile = config.sops.secrets."wireguard/rico2/pk".path;
};
wireguardPeers = with wireguard-peers; [
(bifrost // { PersistentKeepalive = 20; })
rico0
rico1
wynne
layne
];
};
networks."99-Homelab" = {
matchConfig = {
Name = "Homelab";
};
networkConfig = {
DNS = "10.10.10.1";
Address = [
"${config.nodeconfig.facts.wireguard-ip}/24"
];
};
};
};

1
hosts/shared/caddy.nix
View file

@ -21,7 +21,6 @@
'';
};
systemd.services.caddy = {
after = [ "wg-quick-Homelab.service" ];
serviceConfig.EnvironmentFile = config.sops.secrets."caddy/env_file".path;
};
networking.firewall.allowedTCPPorts = [ 80 443 ];

11
hosts/shared/wireguard-peers.nix
View file

@ -1,12 +1,13 @@
{ noEndpoints ? false }:
let
mkPeer = endpoint: publicKey: allowedIPs: {
inherit endpoint publicKey allowedIPs;
};
mkPeer = Endpoint: PublicKey: AllowedIPs: {
inherit PublicKey AllowedIPs;
} // (if (noEndpoints) then { } else { inherit Endpoint; });
in
{
bifrost = mkPeer "128.199.30.141:51821" "NNw/iDMCTq8mpHncrecEh4UlvtINX/UUDtCJf2ToFR4=" [ "10.10.10.1" "10.10.10.2" "10.10.10.3" ];
skipper = mkPeer null "ob8Ri5fYBCkksRnpbkq0kBlU0Ll3xjIPpMk8e9TKpl4=" [ "10.10.10.2" ];
kowalski = mkPeer null "ZgtftftDNAnNsOKo34cgaP3lQim2HMmoCXayALIVsFU=" [ "10.10.10.3" ];
skipper = mkPeer "" "ob8Ri5fYBCkksRnpbkq0kBlU0Ll3xjIPpMk8e9TKpl4=" [ "10.10.10.2" ];
kowalski = mkPeer "" "ZgtftftDNAnNsOKo34cgaP3lQim2HMmoCXayALIVsFU=" [ "10.10.10.3" ];
rico0 = mkPeer "192.168.1.10:51830" "9mfgKUM6hXllEUunvI8szlni9OFpKSbaLVZRAhAh51Q=" [ "10.10.10.10" ];
rico1 = mkPeer "192.168.1.11:51831" "lFtIm7CX3gcHMAu673ptRzNDQh5QEa7FbzlHSQerRg0=" [ "10.10.10.11" ];
rico2 = mkPeer "192.168.1.12:51832" "FyFlOHfAprr474cJCXKRvgsU6o22xaQ8gzs1563AQnI=" [ "10.10.10.12" ];

4
hosts/skipper/default.nix
View file

@ -10,6 +10,10 @@
./security.nix
];
nodeconfig.facts = {
wireguard-ip = "10.10.10.2";
};
console.useXkbConfig = true;
environment.sessionVariables = {

47
hosts/skipper/network/wireguard.nix
View file

@ -1,32 +1,41 @@
{ config, ... }:
let
wireguard-peers = import ../../shared/wireguard-peers.nix;
in
{
let wireguard-peers = import ../../shared/wireguard-peers.nix { }; in {
sops.secrets = {
"wireguard/skipper/pk" = {
mode = "400";
owner = config.users.users.root.name;
group = config.users.users.root.group;
owner = config.users.users.systemd-network.name;
group = config.users.users.systemd-network.group;
};
};
networking = {
firewall = {
trustedInterfaces = [ "Homelab" ];
};
wg-quick = {
interfaces = {
Homelab = {
listenPort = 51822;
privateKeyFile = config.sops.secrets."wireguard/skipper/pk".path;
address = [
"10.10.10.2/24"
];
dns = [ "10.10.10.1" ];
peers = with wireguard-peers; [
(bifrost // { allowedIPs = [ "10.10.10.0/24" ]; })
];
};
};
systemd.network = {
enable = true;
netdevs."99-Homelab" = {
netdevConfig = {
Name = "Homelab";
Kind = "wireguard";
};
wireguardConfig = {
ListenPort = 51822;
PrivateKeyFile = config.sops.secrets."wireguard/skipper/pk".path;
};
wireguardPeers = with wireguard-peers; [
(bifrost // { AllowedIPs = [ "10.10.10.0/24" ]; })
];
};
networks."99-Homelab" = {
matchConfig = {
Name = "Homelab";
};
networkConfig = {
DNS = "10.10.10.1";
Address = [
"${config.nodeconfig.facts.wireguard-ip}/24"
];
};
};
};

51
hosts/wynne/network/wireguard.nix
View file

@ -1,10 +1,10 @@
{ config, ... }:
let wireguard-peers = import ../../shared/wireguard-peers.nix; in {
let wireguard-peers = import ../../shared/wireguard-peers.nix { }; in {
sops.secrets = {
"wireguard/wynne/pk" = {
mode = "400";
owner = config.users.users.root.name;
group = config.users.users.root.group;
owner = config.users.users.systemd-network.name;
group = config.users.users.systemd-network.group;
};
};
networking = {
@ -12,23 +12,34 @@ let wireguard-peers = import ../../shared/wireguard-peers.nix; in {
allowedUDPPorts = [ 51833 ];
trustedInterfaces = [ "Homelab" ];
};
wg-quick = {
interfaces = {
Homelab = {
listenPort = 51833;
privateKeyFile = config.sops.secrets."wireguard/wynne/pk".path;
address = [
"${config.nodeconfig.facts.wireguard-ip}/24"
];
dns = [ "10.10.10.1" ];
peers = with wireguard-peers; [
(bifrost // { persistentKeepalive = 20; })
rico0
rico1
rico2
layne
];
};
};
systemd.network = {
netdevs."99-Homelab" = {
netdevConfig = {
Name = "Homelab";
Kind = "wireguard";
};
wireguardConfig = {
ListenPort = 51833;
PrivateKeyFile = config.sops.secrets."wireguard/wynne/pk".path;
};
wireguardPeers = with wireguard-peers; [
(bifrost // { PersistentKeepalive = 20; })
rico0
rico1
rico2
layne
];
};
networks."99-Homelab" = {
matchConfig = {
Name = "Homelab";
};
networkConfig = {
DNS = "10.10.10.1";
Address = [
"${config.nodeconfig.facts.wireguard-ip}/24"
];
};
};
};