copy nb configuration and modules

utils/modules/vpn/epicenter.works/default.nix

@@ -0,0 +1,19 @@
+{ pkgs, ... }:
+
+{
+  services.resolved.enable = true;
+  services.openvpn.servers = {
+    epicenterWorks  = {
+      config = ''
+        config /etc/nixos/modules/vpn/epicenter.works/vpn.conf
+
+        script-security 2
+        up ${pkgs.update-systemd-resolved}/libexec/openvpn/update-systemd-resolved
+        up-restart
+        down ${pkgs.update-systemd-resolved}/libexec/openvpn/update-systemd-resolved
+        down-pre
+      ''; 
+    };
+  };
+}
+

utils/modules/vpn/epicenter.works/hetzner.nix

@@ -0,0 +1,40 @@
+{ pkgs, ... }:
+
+{
+  networking.firewall = {
+    allowedUDPPorts = [ 51820 ]; # Clients and peers can use the same port, see listenport
+  };
+  # Enable WireGuard
+  networking.wireguard.interfaces = {
+    # "wg0" is the network interface name. You can name the interface arbitrarily.
+    wg0 = {
+      # Determines the IP address and subnet of the client's end of the tunnel interface.
+      ips = [ "10.50.60.6/24" ];
+      listenPort = 51820; # to match firewall allowedUDPPorts (without this wg uses random port numbers)
+
+      privateKeyFile = "/run/secrets/wg_private_key";
+
+      postSetup = ''printf "search epicenter.works\nnameserver 10.25.0.10" | ${pkgs.openresolv}/bin/resolvconf -a wg0 -m 0'';
+
+      postShutdown = "${pkgs.openresolv}/bin/resolvconf -d wg0";
+
+
+      peers = [
+        # For a client configuration, one peer entry for the server will suffice.
+        {
+          # Public key of the server (not a file path).
+          publicKey = "T7jPGSapSudtKyWwi2nu+2hjjse96I4U3lccRHZWd2s=";
+          presharedKeyFile = "/run/secrets/wg_preshared_key";
+
+          allowedIPs = [ "10.50.60.0/24" "10.25.0.0/24" ];
+
+          # Set this to the server IP and port.
+          endpoint = "5.9.131.17:51821"; # ToDo: route to endpoint not automatically configured https://wiki.archlinux.org/index.php/WireGuard#Loop_routing https://discourse.nixos.org/t/solved-minimal-firewall-setup-for-wireguard-client/7577
+
+          # Send keepalives every 25 seconds. Important to keep NAT tables alive.
+          persistentKeepalive = 25;
+        }
+      ];
+    };
+  };
+}

utils/modules/vpn/epicenter.works/vpn.conf

@@ -0,0 +1,14 @@
+dev tun
+persist-tun
+persist-key
+cipher AES-128-GCM
+auth RSA-SHA256
+client
+resolv-retry infinite
+remote vpn.epicenter.works 1195 udp
+lport 0
+verify-x509-name "C=AT, ST=Vienna, L=Vienna, O=epicenter_works, emailAddress=team@epicenter.works, CN=epicenter.works VPN Server" subject
+remote-cert-tls server
+ca /run/secrets/epicenter_vpn_ca
+cert /run/secrets/epicenter_vpn_cert
+key /run/secrets/epicenter_vpn_key