nixos-config/modules/wireguard/home.nix
Simon Bruder 9cdf89fe15
firewall: Trust wg-home
Fixes regression introduced in 126a0dad4b.
2021-01-18 00:05:18 +01:00

36 lines
930 B
Nix

{ lib, config, ... }:
let
cfg = config.sbruder.wireguard.home;
in
{
options = {
sbruder.wireguard.home = {
enable = lib.mkEnableOption "WireGuard tunnel wg-home";
address = lib.mkOption {
type = lib.types.str;
description = "IP(v4) address of the host";
example = "10.80.0.1";
};
};
};
config = lib.mkIf cfg.enable {
krops.secrets.wg-home-private-key = { };
networking.wireguard.interfaces.wg-home = {
privateKeyFile = config.krops.secrets.wg-home-private-key.path;
ips = [ "${cfg.address}/24" ];
peers = [
{
allowedIPs = [ "10.80.0.0/24" ];
publicKey = "UyZRAVTIc/RMs/J+591wrA8lHU0e8dwDJJwcpRb3xQA=";
endpoint = "87.140.16.73:51820"; # IPv6 is tunneled so legacy is preferred
persistentKeepalive = 25;
}
];
};
networking.firewall.trustedInterfaces = [ "wg-home" ];
};
}