82 lines
2.3 KiB
Nix
82 lines
2.3 KiB
Nix
|
{ lib, config, pkgs, ... }:
|
||
|
|
let
|
||
|
|
serverHostName = "vueko";
|
||
|
|
port = 51821;
|
||
|
|
peers = {
|
||
|
|
# Key of the server.
|
||
|
|
vueko = {
|
||
|
|
address = "10.80.16.1";
|
||
|
|
publicKey = "wN2vrYcltdrU+061SNcxThWklI5I/Mhbxh5+PmV/RTU=";
|
||
|
|
};
|
||
|
|
# Key for all of my hosts. One is enough, because it is only activated on demand.
|
||
|
|
simon = {
|
||
|
|
address = "10.80.16.2";
|
||
|
|
publicKey = "3jGyiDbwqNfwIT/UKDwxtcpT5zEc8re/k5kU0NLqEkg=";
|
||
|
|
};
|
||
|
|
# Keys for all hosts that are supported.
|
||
|
|
jane = {
|
||
|
|
address = "10.80.16.3";
|
||
|
|
publicKey = "pZJhYDMYaYn/Zyz5Kn660uWtvxh1bTAdyVDOjnR1j0w=";
|
||
|
|
};
|
||
|
|
};
|
||
|
|
in
|
||
|
|
{
|
||
|
|
config = lib.mkIf (config.networking.hostName == serverHostName) {
|
||
|
|
sops.secrets.wg-support-private-key = {
|
||
|
|
sopsFile = ./../../machines + "/${config.networking.hostName}/secrets.yaml";
|
||
|
|
};
|
||
|
|
|
||
|
|
networking.wireguard.interfaces.wg-support = {
|
||
|
|
privateKeyFile = config.sops.secrets.wg-support-private-key.path;
|
||
|
|
ips = [ "${peers.${serverHostName}.address}/24" ];
|
||
|
|
listenPort = port;
|
||
|
|
peers = map
|
||
|
|
(peerConfig: with peerConfig; {
|
||
|
|
allowedIPs = [ "${address}/32" ];
|
||
|
|
inherit publicKey;
|
||
|
|
})
|
||
|
|
(lib.attrValues
|
||
|
|
(lib.filterAttrs
|
||
|
|
(n: v: n != serverHostName)
|
||
|
|
peers));
|
||
|
|
};
|
||
|
|
|
||
|
|
networking.firewall.allowedUDPPorts = [
|
||
|
|
port
|
||
|
|
53
|
||
|
|
];
|
||
|
|
|
||
|
|
boot.kernel.sysctl = {
|
||
|
|
"net.ipv4.ip_forward" = lib.mkOverride 998 1;
|
||
|
|
};
|
||
|
|
|
||
|
|
services.bind = {
|
||
|
|
enable = true;
|
||
|
|
zones = lib.singleton {
|
||
|
|
name = "support.vpn.sbruder.de";
|
||
|
|
master = true;
|
||
|
|
file =
|
||
|
|
let
|
||
|
|
# !!! very hacky
|
||
|
|
hexStringToInt = hex: (builtins.fromTOML "int = 0x${hex}").int;
|
||
|
|
|
||
|
|
peerRecords = lib.concatStrings
|
||
|
|
(lib.mapAttrsToList
|
||
|
|
(peer: peerConfig: ''
|
||
|
|
${peer} IN A ${peerConfig.address}
|
||
|
|
'')
|
||
|
|
peers);
|
||
|
|
|
||
|
|
peerRecordsHash = builtins.hashString "sha256" peerRecords;
|
||
|
|
serial = hexStringToInt (lib.substring 0 8 peerRecordsHash);
|
||
|
|
in
|
||
|
|
pkgs.writeText "support.vpn.sbruder.de.zone" (''
|
||
|
|
$TTL 3600
|
||
|
|
@ IN SOA ${serverHostName}.sbruder.de. hostmaster.sbruder.de. ${toString serial} 28800 3600 604800 3600
|
||
|
|
@ IN NS ${serverHostName}.sbruder.de.
|
||
|
|
'' + peerRecords);
|
||
|
|
};
|
||
|
|
};
|
||
|
|
};
|
||
|
|
}
|