41 lines
1.5 KiB
Nix
41 lines
1.5 KiB
Nix
{ pkgs, ... }:
|
|
|
|
{
|
|
networking.firewall = {
|
|
allowedUDPPorts = [ 51820 ]; # Clients and peers can use the same port, see listenport
|
|
};
|
|
# Enable WireGuard
|
|
networking.wireguard.interfaces = {
|
|
# "wg0" is the network interface name. You can name the interface arbitrarily.
|
|
wg0 = {
|
|
# Determines the IP address and subnet of the client's end of the tunnel interface.
|
|
ips = [ "10.50.60.6/24" ];
|
|
listenPort = 51820; # to match firewall allowedUDPPorts (without this wg uses random port numbers)
|
|
|
|
privateKeyFile = "/run/secrets/wg_private_key";
|
|
|
|
postSetup = ''printf "search epicenter.works\nnameserver 10.25.0.10" | ${pkgs.openresolv}/bin/resolvconf -a wg0 -m 0'';
|
|
|
|
postShutdown = "${pkgs.openresolv}/bin/resolvconf -d wg0";
|
|
|
|
|
|
peers = [
|
|
# For a client configuration, one peer entry for the server will suffice.
|
|
{
|
|
# Public key of the server (not a file path).
|
|
publicKey = "T7jPGSapSudtKyWwi2nu+2hjjse96I4U3lccRHZWd2s=";
|
|
presharedKeyFile = "/run/secrets/wg_preshared_key";
|
|
|
|
allowedIPs = [ "10.50.60.0/24" "10.25.0.0/24" ];
|
|
|
|
# Set this to the server IP and port.
|
|
endpoint = "5.9.131.17:51821"; # ToDo: route to endpoint not automatically configured https://wiki.archlinux.org/index.php/WireGuard#Loop_routing https://discourse.nixos.org/t/solved-minimal-firewall-setup-for-wireguard-client/7577
|
|
|
|
# Send keepalives every 25 seconds. Important to keep NAT tables alive.
|
|
persistentKeepalive = 25;
|
|
}
|
|
];
|
|
};
|
|
};
|
|
}
|