63 lines
1.9 KiB
Nix
63 lines
1.9 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
|
|
{
|
|
# Enable systemd-resolved with split DNS for ddev.site
|
|
services.resolved = {
|
|
enable = true;
|
|
dnssec = "false";
|
|
extraConfig = ''
|
|
DNS=127.0.0.1:5353
|
|
Domains=~ddev.site
|
|
'';
|
|
};
|
|
|
|
# Integrate NetworkManager with systemd-resolved
|
|
networking.networkmanager.dns = "systemd-resolved";
|
|
|
|
# Local dnsmasq for .ddev.site resolution only (port 5353)
|
|
services.dnsmasq = {
|
|
enable = true;
|
|
settings = {
|
|
port = 5353;
|
|
listen-address = "127.0.0.1";
|
|
bind-interfaces = true;
|
|
no-resolv = true;
|
|
address = "/.ddev.site/127.0.0.1";
|
|
};
|
|
};
|
|
|
|
# WireGuard VPN configuration
|
|
networking.wireguard.interfaces = {
|
|
wg0 = {
|
|
ips = [ "10.42.98.201/32" ];
|
|
# publicKey: YdlRGsjh4hS3OMJI+t6SZ2eGXKbs0wZBXWudHW4NyS8=
|
|
privateKeyFile = config.sops.secrets.wg-cloonar-key.path;
|
|
|
|
peers = [
|
|
{
|
|
publicKey = "TKQVDmBnf9av46kQxLQSBDhAeaK8r1zh8zpU64zuc1Q=";
|
|
allowedIPs = [
|
|
"10.42.96.0/20"
|
|
# wohnservice-wien
|
|
"10.254.240.0/24"
|
|
"10.254.235.0/24"
|
|
# epicenter.works
|
|
"10.14.0.0/16"
|
|
"10.25.0.0/16"
|
|
"188.34.191.144/32" # web-arm
|
|
"91.107.201.241" # mail
|
|
];
|
|
endpoint = "vpn.cloonar.com:51820"; # ToDo: route to endpoint not automatically configured https://wiki.archlinux.org/index.php/WireGuard#Loop_routing https://discourse.nixos.org/t/solved-minimal-firewall-setup-for-wireguard-client/7577
|
|
persistentKeepalive = 25;
|
|
}
|
|
];
|
|
|
|
# Use resolvectl for systemd-resolved integration
|
|
# Note: No postDown needed - systemd-resolved automatically handles interface removal
|
|
postSetup = ''
|
|
${pkgs.systemd}/bin/resolvectl dns wg0 10.42.97.1
|
|
${pkgs.systemd}/bin/resolvectl domain wg0 cloonar.com
|
|
'';
|
|
};
|
|
};
|
|
}
|